1 /* $NetBSD: fil.c,v 1.37 2023/06/24 05:16:15 msaitoh Exp $ */ 2 3 /* 4 * Copyright (C) 2012 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 * 8 * Id: fil.c,v 1.1.1.2 2012/07/22 13:45:07 darrenr Exp $ 9 * 10 */ 11 #if defined(KERNEL) || defined(_KERNEL) 12 # undef KERNEL 13 # undef _KERNEL 14 # define KERNEL 1 15 # define _KERNEL 1 16 #endif 17 #include <sys/errno.h> 18 #include <sys/types.h> 19 #include <sys/param.h> 20 #include <sys/time.h> 21 #if defined(_KERNEL) && defined(__FreeBSD_version) && \ 22 (__FreeBSD_version >= 220000) 23 # if (__FreeBSD_version >= 400000) 24 # if !defined(IPFILTER_LKM) 25 # include "opt_inet6.h" 26 # endif 27 # if (__FreeBSD_version == 400019) 28 # define CSUM_DELAY_DATA 29 # endif 30 # endif 31 # include <sys/filio.h> 32 #else 33 # include <sys/ioctl.h> 34 #endif 35 #if (defined(__SVR4) || defined(__svr4__)) && defined(sun) 36 # include <sys/filio.h> 37 #endif 38 #if !defined(_AIX51) 39 # include <sys/fcntl.h> 40 #endif 41 #if defined(_KERNEL) 42 # include <sys/systm.h> 43 # include <sys/file.h> 44 #else 45 # include <stdio.h> 46 # include <string.h> 47 # include <stdlib.h> 48 # include <stddef.h> 49 # include <sys/file.h> 50 # define _KERNEL 51 # ifdef __OpenBSD__ 52 struct file; 53 # endif 54 # include <sys/uio.h> 55 # undef _KERNEL 56 #endif 57 #if !defined(__SVR4) && !defined(__svr4__) && !defined(__hpux) && \ 58 !defined(linux) 59 # include <sys/mbuf.h> 60 #else 61 # if !defined(linux) 62 # include <sys/byteorder.h> 63 # endif 64 # if (SOLARIS2 < 5) && defined(sun) 65 # include <sys/dditypes.h> 66 # endif 67 #endif 68 #ifdef __hpux 69 # define _NET_ROUTE_INCLUDED 70 #endif 71 #if !defined(linux) 72 # include <sys/protosw.h> 73 #endif 74 #include <sys/socket.h> 75 #include <net/if.h> 76 #ifdef sun 77 # include <net/af.h> 78 #endif 79 #include <netinet/in.h> 80 #include <netinet/in_systm.h> 81 #include <netinet/ip.h> 82 #if defined(__sgi) && defined(IFF_DRVRLOCK) /* IRIX 6 */ 83 # include <sys/hashing.h> 84 # include <netinet/in_var.h> 85 #endif 86 #include <netinet/tcp.h> 87 #if (!defined(__sgi) && !defined(AIX)) || defined(_KERNEL) 88 # include <netinet/udp.h> 89 # include <netinet/ip_icmp.h> 90 #endif 91 #ifdef __hpux 92 # undef _NET_ROUTE_INCLUDED 93 #endif 94 #ifdef __osf__ 95 # undef _RADIX_H_ 96 #endif 97 #include "netinet/ip_compat.h" 98 #ifdef USE_INET6 99 # include <netinet/icmp6.h> 100 # if !SOLARIS && defined(_KERNEL) && !defined(__osf__) && !defined(__hpux) 101 # include <netinet6/in6_var.h> 102 # endif 103 #endif 104 #include "netinet/ip_fil.h" 105 #include "netinet/ip_nat.h" 106 #include "netinet/ip_frag.h" 107 #include "netinet/ip_state.h" 108 #include "netinet/ip_proxy.h" 109 #include "netinet/ip_auth.h" 110 #ifdef IPFILTER_SCAN 111 # include "netinet/ip_scan.h" 112 #endif 113 #include "netinet/ip_sync.h" 114 #include "netinet/ip_lookup.h" 115 #include "netinet/ip_pool.h" 116 #include "netinet/ip_htable.h" 117 #ifdef IPFILTER_COMPILED 118 # include "netinet/ip_rules.h" 119 #endif 120 #if defined(IPFILTER_BPF) && defined(_KERNEL) 121 # include <net/bpf.h> 122 #endif 123 #if defined(__FreeBSD_version) && (__FreeBSD_version >= 300000) 124 # include <sys/malloc.h> 125 #endif 126 #include "netinet/ipl.h" 127 128 #if defined(__NetBSD__) && (__NetBSD_Version__ >= 104230000) 129 # include <sys/callout.h> 130 extern struct callout ipf_slowtimer_ch; 131 #endif 132 #if defined(__OpenBSD__) 133 # include <sys/timeout.h> 134 extern struct timeout ipf_slowtimer_ch; 135 #endif 136 #if defined(__NetBSD__) 137 #include <netinet/in_offload.h> 138 #endif 139 /* END OF INCLUDES */ 140 141 #if !defined(lint) 142 #if defined(__NetBSD__) 143 #include <sys/cdefs.h> 144 __KERNEL_RCSID(0, "$NetBSD: fil.c,v 1.37 2023/06/24 05:16:15 msaitoh Exp $"); 145 #else 146 static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed"; 147 static const char rcsid[] = "@(#)Id: fil.c,v 1.1.1.2 2012/07/22 13:45:07 darrenr Exp $"; 148 #endif 149 #endif 150 151 #ifndef _KERNEL 152 # include "ipf.h" 153 # include "ipt.h" 154 extern int opts; 155 extern int blockreason; 156 #endif /* _KERNEL */ 157 158 #define FASTROUTE_RECURSION 159 160 #define LBUMP(x) softc->x++ 161 #define LBUMPD(x, y) do { softc->x.y++; DT(y); } while (0) 162 163 static INLINE int ipf_check_ipf(fr_info_t *, frentry_t *, int); 164 static u_32_t ipf_checkcipso(fr_info_t *, u_char *, int); 165 static u_32_t ipf_checkripso(u_char *); 166 static u_32_t ipf_decaps(fr_info_t *, u_32_t, int); 167 #ifdef IPFILTER_LOG 168 static frentry_t *ipf_dolog(fr_info_t *, u_32_t *); 169 #endif 170 static int ipf_flushlist(ipf_main_softc_t *, int *, frentry_t **); 171 static int ipf_flush_groups(ipf_main_softc_t *, frgroup_t **, int); 172 static ipfunc_t ipf_findfunc(ipfunc_t); 173 static void *ipf_findlookup(ipf_main_softc_t *, int, frentry_t *, 174 i6addr_t *, i6addr_t *); 175 static frentry_t *ipf_firewall(fr_info_t *, u_32_t *); 176 static int ipf_fr_matcharray(fr_info_t *, int *); 177 static int ipf_frruleiter(ipf_main_softc_t *, void *, int, void *); 178 static void ipf_funcfini(ipf_main_softc_t *, frentry_t *);; 179 static int ipf_funcinit(ipf_main_softc_t *, frentry_t *); 180 static int ipf_geniter(ipf_main_softc_t *, ipftoken_t *, 181 ipfgeniter_t *); 182 static void ipf_getstat(ipf_main_softc_t *, 183 struct friostat *, int); 184 static int ipf_group_flush(ipf_main_softc_t *, frgroup_t *); 185 static void ipf_group_free(frgroup_t *); 186 static int ipf_grpmapfini(struct ipf_main_softc_s *, frentry_t *); 187 static int ipf_grpmapinit(struct ipf_main_softc_s *, frentry_t *); 188 static frentry_t *ipf_nextrule(ipf_main_softc_t *, int, int, 189 frentry_t *, int); 190 static int ipf_portcheck(frpcmp_t *, u_32_t); 191 static INLINE int ipf_pr_ah(fr_info_t *); 192 static INLINE void ipf_pr_esp(fr_info_t *); 193 static INLINE void ipf_pr_gre(fr_info_t *); 194 static INLINE void ipf_pr_udp(fr_info_t *); 195 static INLINE void ipf_pr_tcp(fr_info_t *); 196 static INLINE void ipf_pr_icmp(fr_info_t *); 197 static INLINE void ipf_pr_ipv4hdr(fr_info_t *); 198 static INLINE void ipf_pr_short(fr_info_t *, int); 199 static INLINE int ipf_pr_tcpcommon(fr_info_t *); 200 static INLINE int ipf_pr_udpcommon(fr_info_t *); 201 static void ipf_rule_delete(ipf_main_softc_t *, frentry_t *f, 202 int, int); 203 static void ipf_rule_expire_insert(ipf_main_softc_t *, 204 frentry_t *, int); 205 static int ipf_synclist(ipf_main_softc_t *, frentry_t *, void *); 206 static void ipf_token_flush(ipf_main_softc_t *); 207 static void ipf_token_unlink(ipf_main_softc_t *, ipftoken_t *); 208 static ipftuneable_t *ipf_tune_findbyname(ipftuneable_t *, const char *); 209 static ipftuneable_t *ipf_tune_findbycookie(ipftuneable_t **, void *, 210 void **); 211 static int ipf_updateipid(fr_info_t *); 212 static int ipf_settimeout(struct ipf_main_softc_s *, 213 struct ipftuneable *, ipftuneval_t *); 214 215 216 /* 217 * bit values for identifying presence of individual IP options 218 * All of these tables should be ordered by increasing key value on the left 219 * hand side to allow for binary searching of the array and include a trailer 220 * with a 0 for the bitmask for linear searches to easily find the end with. 221 */ 222 static const struct optlist ipopts[20] = { 223 { IPOPT_NOP, 0x000001 }, 224 { IPOPT_RR, 0x000002 }, 225 { IPOPT_ZSU, 0x000004 }, 226 { IPOPT_MTUP, 0x000008 }, 227 { IPOPT_MTUR, 0x000010 }, 228 { IPOPT_ENCODE, 0x000020 }, 229 { IPOPT_TS, 0x000040 }, 230 { IPOPT_TR, 0x000080 }, 231 { IPOPT_SECURITY, 0x000100 }, 232 { IPOPT_LSRR, 0x000200 }, 233 { IPOPT_E_SEC, 0x000400 }, 234 { IPOPT_CIPSO, 0x000800 }, 235 { IPOPT_SATID, 0x001000 }, 236 { IPOPT_SSRR, 0x002000 }, 237 { IPOPT_ADDEXT, 0x004000 }, 238 { IPOPT_VISA, 0x008000 }, 239 { IPOPT_IMITD, 0x010000 }, 240 { IPOPT_EIP, 0x020000 }, 241 { IPOPT_FINN, 0x040000 }, 242 { 0, 0x000000 } 243 }; 244 245 #ifdef USE_INET6 246 static const struct optlist ip6exthdr[] = { 247 { IPPROTO_HOPOPTS, 0x000001 }, 248 { IPPROTO_IPV6, 0x000002 }, 249 { IPPROTO_ROUTING, 0x000004 }, 250 { IPPROTO_FRAGMENT, 0x000008 }, 251 { IPPROTO_ESP, 0x000010 }, 252 { IPPROTO_AH, 0x000020 }, 253 { IPPROTO_NONE, 0x000040 }, 254 { IPPROTO_DSTOPTS, 0x000080 }, 255 { IPPROTO_MOBILITY, 0x000100 }, 256 { 0, 0 } 257 }; 258 #endif 259 260 /* 261 * bit values for identifying presence of individual IP security options 262 */ 263 static const struct optlist secopt[8] = { 264 { IPSO_CLASS_RES4, 0x01 }, 265 { IPSO_CLASS_TOPS, 0x02 }, 266 { IPSO_CLASS_SECR, 0x04 }, 267 { IPSO_CLASS_RES3, 0x08 }, 268 { IPSO_CLASS_CONF, 0x10 }, 269 { IPSO_CLASS_UNCL, 0x20 }, 270 { IPSO_CLASS_RES2, 0x40 }, 271 { IPSO_CLASS_RES1, 0x80 } 272 }; 273 274 char ipfilter_version[] = IPL_VERSION; 275 276 int ipf_features = 0 277 #ifdef IPFILTER_LKM 278 | IPF_FEAT_LKM 279 #endif 280 #ifdef IPFILTER_LOG 281 | IPF_FEAT_LOG 282 #endif 283 | IPF_FEAT_LOOKUP 284 #ifdef IPFILTER_BPF 285 | IPF_FEAT_BPF 286 #endif 287 #ifdef IPFILTER_COMPILED 288 | IPF_FEAT_COMPILED 289 #endif 290 #ifdef IPFILTER_CKSUM 291 | IPF_FEAT_CKSUM 292 #endif 293 | IPF_FEAT_SYNC 294 #ifdef IPFILTER_SCAN 295 | IPF_FEAT_SCAN 296 #endif 297 #ifdef USE_INET6 298 | IPF_FEAT_IPV6 299 #endif 300 ; 301 302 303 /* 304 * Table of functions available for use with call rules. 305 */ 306 static ipfunc_resolve_t ipf_availfuncs[] = { 307 { "srcgrpmap", ipf_srcgrpmap, ipf_grpmapinit, ipf_grpmapfini }, 308 { "dstgrpmap", ipf_dstgrpmap, ipf_grpmapinit, ipf_grpmapfini }, 309 { "", NULL, NULL, NULL } 310 }; 311 312 static const ipftuneable_t ipf_main_tuneables[] = { 313 { { (void *)offsetof(struct ipf_main_softc_s, ipf_flags) }, 314 "ipf_flags", 0, 0xffffffff, 315 stsizeof(ipf_main_softc_t, ipf_flags), 316 0, NULL, NULL }, 317 { { (void *)offsetof(struct ipf_main_softc_s, ipf_active) }, 318 "active", 0, 0, 319 stsizeof(ipf_main_softc_t, ipf_active), 320 IPFT_RDONLY, NULL, NULL }, 321 { { (void *)offsetof(ipf_main_softc_t, ipf_control_forwarding) }, 322 "control_forwarding", 0, 1, 323 stsizeof(ipf_main_softc_t, ipf_control_forwarding), 324 0, NULL, NULL }, 325 { { (void *)offsetof(ipf_main_softc_t, ipf_update_ipid) }, 326 "update_ipid", 0, 1, 327 stsizeof(ipf_main_softc_t, ipf_update_ipid), 328 0, NULL, NULL }, 329 { { (void *)offsetof(ipf_main_softc_t, ipf_chksrc) }, 330 "chksrc", 0, 1, 331 stsizeof(ipf_main_softc_t, ipf_chksrc), 332 0, NULL, NULL }, 333 { { (void *)offsetof(ipf_main_softc_t, ipf_minttl) }, 334 "min_ttl", 0, 1, 335 stsizeof(ipf_main_softc_t, ipf_minttl), 336 0, NULL, NULL }, 337 { { (void *)offsetof(ipf_main_softc_t, ipf_icmpminfragmtu) }, 338 "icmp_minfragmtu", 0, 1, 339 stsizeof(ipf_main_softc_t, ipf_icmpminfragmtu), 340 0, NULL, NULL }, 341 { { (void *)offsetof(ipf_main_softc_t, ipf_pass) }, 342 "default_pass", 0, 0xffffffff, 343 stsizeof(ipf_main_softc_t, ipf_pass), 344 0, NULL, NULL }, 345 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpidletimeout) }, 346 "tcp_idle_timeout", 1, 0x7fffffff, 347 stsizeof(ipf_main_softc_t, ipf_tcpidletimeout), 348 0, NULL, ipf_settimeout }, 349 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpclosewait) }, 350 "tcp_close_wait", 1, 0x7fffffff, 351 stsizeof(ipf_main_softc_t, ipf_tcpclosewait), 352 0, NULL, ipf_settimeout }, 353 { { (void *)offsetof(ipf_main_softc_t, ipf_tcplastack) }, 354 "tcp_last_ack", 1, 0x7fffffff, 355 stsizeof(ipf_main_softc_t, ipf_tcplastack), 356 0, NULL, ipf_settimeout }, 357 { { (void *)offsetof(ipf_main_softc_t, ipf_tcptimeout) }, 358 "tcp_timeout", 1, 0x7fffffff, 359 stsizeof(ipf_main_softc_t, ipf_tcptimeout), 360 0, NULL, ipf_settimeout }, 361 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpsynsent) }, 362 "tcp_syn_sent", 1, 0x7fffffff, 363 stsizeof(ipf_main_softc_t, ipf_tcpsynsent), 364 0, NULL, ipf_settimeout }, 365 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpsynrecv) }, 366 "tcp_syn_received", 1, 0x7fffffff, 367 stsizeof(ipf_main_softc_t, ipf_tcpsynrecv), 368 0, NULL, ipf_settimeout }, 369 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpclosed) }, 370 "tcp_closed", 1, 0x7fffffff, 371 stsizeof(ipf_main_softc_t, ipf_tcpclosed), 372 0, NULL, ipf_settimeout }, 373 { { (void *)offsetof(ipf_main_softc_t, ipf_tcphalfclosed) }, 374 "tcp_half_closed", 1, 0x7fffffff, 375 stsizeof(ipf_main_softc_t, ipf_tcphalfclosed), 376 0, NULL, ipf_settimeout }, 377 { { (void *)offsetof(ipf_main_softc_t, ipf_tcptimewait) }, 378 "tcp_time_wait", 1, 0x7fffffff, 379 stsizeof(ipf_main_softc_t, ipf_tcptimewait), 380 0, NULL, ipf_settimeout }, 381 { { (void *)offsetof(ipf_main_softc_t, ipf_udptimeout) }, 382 "udp_timeout", 1, 0x7fffffff, 383 stsizeof(ipf_main_softc_t, ipf_udptimeout), 384 0, NULL, ipf_settimeout }, 385 { { (void *)offsetof(ipf_main_softc_t, ipf_udpacktimeout) }, 386 "udp_ack_timeout", 1, 0x7fffffff, 387 stsizeof(ipf_main_softc_t, ipf_udpacktimeout), 388 0, NULL, ipf_settimeout }, 389 { { (void *)offsetof(ipf_main_softc_t, ipf_icmptimeout) }, 390 "icmp_timeout", 1, 0x7fffffff, 391 stsizeof(ipf_main_softc_t, ipf_icmptimeout), 392 0, NULL, ipf_settimeout }, 393 { { (void *)offsetof(ipf_main_softc_t, ipf_icmpacktimeout) }, 394 "icmp_ack_timeout", 1, 0x7fffffff, 395 stsizeof(ipf_main_softc_t, ipf_icmpacktimeout), 396 0, NULL, ipf_settimeout }, 397 { { (void *)offsetof(ipf_main_softc_t, ipf_iptimeout) }, 398 "ip_timeout", 1, 0x7fffffff, 399 stsizeof(ipf_main_softc_t, ipf_iptimeout), 400 0, NULL, ipf_settimeout }, 401 #if defined(INSTANCES) && defined(_KERNEL) 402 { { (void *)offsetof(ipf_main_softc_t, ipf_get_loopback) }, 403 "intercept_loopback", 0, 1, 404 stsizeof(ipf_main_softc_t, ipf_get_loopback), 405 0, NULL, ipf_set_loopback }, 406 #endif 407 { { 0 }, 408 NULL, 0, 0, 409 0, 410 0, NULL, NULL } 411 }; 412 413 414 /* 415 * The next section of code is a a collection of small routines that set 416 * fields in the fr_info_t structure passed based on properties of the 417 * current packet. There are different routines for the same protocol 418 * for each of IPv4 and IPv6. Adding a new protocol, for which there 419 * will "special" inspection for setup, is now more easily done by adding 420 * a new routine and expanding the ipf_pr_ipinit*() function rather than by 421 * adding more code to a growing switch statement. 422 */ 423 #ifdef USE_INET6 424 static INLINE int ipf_pr_ah6(fr_info_t *); 425 static INLINE void ipf_pr_esp6(fr_info_t *); 426 static INLINE void ipf_pr_gre6(fr_info_t *); 427 static INLINE void ipf_pr_udp6(fr_info_t *); 428 static INLINE void ipf_pr_tcp6(fr_info_t *); 429 static INLINE void ipf_pr_icmp6(fr_info_t *); 430 static INLINE void ipf_pr_ipv6hdr(fr_info_t *); 431 static INLINE void ipf_pr_short6(fr_info_t *, int); 432 static INLINE int ipf_pr_hopopts6(fr_info_t *); 433 static INLINE int ipf_pr_mobility6(fr_info_t *); 434 static INLINE int ipf_pr_routing6(fr_info_t *); 435 static INLINE int ipf_pr_dstopts6(fr_info_t *); 436 static INLINE int ipf_pr_fragment6(fr_info_t *); 437 static INLINE struct ip6_ext *ipf_pr_ipv6exthdr(fr_info_t *, int, int); 438 439 440 /* ------------------------------------------------------------------------ */ 441 /* Function: ipf_pr_short6 */ 442 /* Returns: void */ 443 /* Parameters: fin(I) - pointer to packet information */ 444 /* xmin(I) - minimum header size */ 445 /* */ 446 /* IPv6 Only */ 447 /* This is function enforces the 'is a packet too short to be legit' rule */ 448 /* for IPv6 and marks the packet with FI_SHORT if so. See function comment */ 449 /* for ipf_pr_short() for more details. */ 450 /* ------------------------------------------------------------------------ */ 451 static INLINE void 452 ipf_pr_short6(fr_info_t *fin, int xmin) 453 { 454 455 if (fin->fin_dlen < xmin) 456 fin->fin_flx |= FI_SHORT; 457 } 458 459 460 /* ------------------------------------------------------------------------ */ 461 /* Function: ipf_pr_ipv6hdr */ 462 /* Returns: void */ 463 /* Parameters: fin(I) - pointer to packet information */ 464 /* */ 465 /* IPv6 Only */ 466 /* Copy values from the IPv6 header into the fr_info_t struct and call the */ 467 /* per-protocol analyzer if it exists. In validating the packet, a protocol*/ 468 /* analyzer may pullup or free the packet itself so we need to be vigiliant */ 469 /* of that possibility arising. */ 470 /* ------------------------------------------------------------------------ */ 471 static INLINE void 472 ipf_pr_ipv6hdr(fr_info_t *fin) 473 { 474 ip6_t *ip6 = (ip6_t *)fin->fin_ip; 475 int p, go = 1, i, hdrcount; 476 fr_ip_t *fi = &fin->fin_fi; 477 478 fin->fin_off = 0; 479 480 fi->fi_tos = 0; 481 fi->fi_optmsk = 0; 482 fi->fi_secmsk = 0; 483 fi->fi_auth = 0; 484 485 p = ip6->ip6_nxt; 486 fin->fin_crc = p; 487 fi->fi_ttl = ip6->ip6_hlim; 488 fi->fi_src.in6 = ip6->ip6_src; 489 fin->fin_crc += fi->fi_src.i6[0]; 490 fin->fin_crc += fi->fi_src.i6[1]; 491 fin->fin_crc += fi->fi_src.i6[2]; 492 fin->fin_crc += fi->fi_src.i6[3]; 493 fi->fi_dst.in6 = ip6->ip6_dst; 494 fin->fin_crc += fi->fi_dst.i6[0]; 495 fin->fin_crc += fi->fi_dst.i6[1]; 496 fin->fin_crc += fi->fi_dst.i6[2]; 497 fin->fin_crc += fi->fi_dst.i6[3]; 498 fin->fin_id = 0; 499 if (IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6)) 500 fin->fin_flx |= FI_MULTICAST|FI_MBCAST; 501 502 hdrcount = 0; 503 while (go && !(fin->fin_flx & FI_SHORT)) { 504 switch (p) 505 { 506 case IPPROTO_UDP : 507 ipf_pr_udp6(fin); 508 go = 0; 509 break; 510 511 case IPPROTO_TCP : 512 ipf_pr_tcp6(fin); 513 go = 0; 514 break; 515 516 case IPPROTO_ICMPV6 : 517 ipf_pr_icmp6(fin); 518 go = 0; 519 break; 520 521 case IPPROTO_GRE : 522 ipf_pr_gre6(fin); 523 go = 0; 524 break; 525 526 case IPPROTO_HOPOPTS : 527 p = ipf_pr_hopopts6(fin); 528 break; 529 530 case IPPROTO_MOBILITY : 531 p = ipf_pr_mobility6(fin); 532 break; 533 534 case IPPROTO_DSTOPTS : 535 p = ipf_pr_dstopts6(fin); 536 break; 537 538 case IPPROTO_ROUTING : 539 p = ipf_pr_routing6(fin); 540 break; 541 542 case IPPROTO_AH : 543 p = ipf_pr_ah6(fin); 544 break; 545 546 case IPPROTO_ESP : 547 ipf_pr_esp6(fin); 548 go = 0; 549 break; 550 551 case IPPROTO_IPV6 : 552 for (i = 0; ip6exthdr[i].ol_bit != 0; i++) 553 if (ip6exthdr[i].ol_val == p) { 554 fin->fin_flx |= ip6exthdr[i].ol_bit; 555 break; 556 } 557 go = 0; 558 break; 559 560 case IPPROTO_NONE : 561 go = 0; 562 break; 563 564 case IPPROTO_FRAGMENT : 565 p = ipf_pr_fragment6(fin); 566 /* 567 * Given that the only fragments we want to let through 568 * (where fin_off != 0) are those where the non-first 569 * fragments only have data, we can safely stop looking 570 * at headers if this is a non-leading fragment. 571 */ 572 if (fin->fin_off != 0) 573 go = 0; 574 break; 575 576 default : 577 go = 0; 578 break; 579 } 580 hdrcount++; 581 582 /* 583 * It is important to note that at this point, for the 584 * extension headers (go != 0), the entire header may not have 585 * been pulled up when the code gets to this point. This is 586 * only done for "go != 0" because the other header handlers 587 * will all pullup their complete header. The other indicator 588 * of an incomplete packet is that this was just an extension 589 * header. 590 */ 591 if ((go != 0) && (p != IPPROTO_NONE) && 592 (ipf_pr_pullup(fin, 0) == -1)) { 593 p = IPPROTO_NONE; 594 break; 595 } 596 } 597 598 /* 599 * Some of the above functions, like ipf_pr_esp6(), can call ipf_pullup 600 * and destroy whatever packet was here. The caller of this function 601 * expects us to return if there is a problem with ipf_pullup. 602 */ 603 if (fin->fin_m == NULL) { 604 ipf_main_softc_t *softc = fin->fin_main_soft; 605 606 LBUMPD(ipf_stats[fin->fin_out], fr_v6_bad); 607 return; 608 } 609 610 fi->fi_p = p; 611 612 /* 613 * IPv6 fragment case 1 - see comment for ipf_pr_fragment6(). 614 * "go != 0" implies the above loop hasn't arrived at a layer 4 header. 615 */ 616 if ((go != 0) && (fin->fin_flx & FI_FRAG) && (fin->fin_off == 0)) { 617 ipf_main_softc_t *softc = fin->fin_main_soft; 618 619 fin->fin_flx |= FI_BAD; 620 DT2(ipf_fi_bad_ipv6_frag_1, fr_info_t *, fin, int, go); 621 LBUMPD(ipf_stats[fin->fin_out], fr_v6_badfrag); 622 LBUMP(ipf_stats[fin->fin_out].fr_v6_bad); 623 } 624 } 625 626 627 /* ------------------------------------------------------------------------ */ 628 /* Function: ipf_pr_ipv6exthdr */ 629 /* Returns: struct ip6_ext * - pointer to the start of the next header */ 630 /* or NULL if there is a prolblem. */ 631 /* Parameters: fin(I) - pointer to packet information */ 632 /* multiple(I) - flag indicating yes/no if multiple occurances */ 633 /* of this extension header are allowed. */ 634 /* proto(I) - protocol number for this extension header */ 635 /* */ 636 /* IPv6 Only */ 637 /* This function embodies a number of common checks that all IPv6 extension */ 638 /* headers must be subjected to. For example, making sure the packet is */ 639 /* big enough for it to be in, checking if it is repeated and setting a */ 640 /* flag to indicate its presence. */ 641 /* ------------------------------------------------------------------------ */ 642 static INLINE struct ip6_ext * 643 ipf_pr_ipv6exthdr(fr_info_t *fin, int multiple, int proto) 644 { 645 ipf_main_softc_t *softc = fin->fin_main_soft; 646 struct ip6_ext *hdr; 647 u_short shift; 648 int i; 649 650 fin->fin_flx |= FI_V6EXTHDR; 651 652 /* 8 is default length of extension hdr */ 653 if ((fin->fin_dlen - 8) < 0) { 654 fin->fin_flx |= FI_SHORT; 655 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_short); 656 return NULL; 657 } 658 659 if (ipf_pr_pullup(fin, 8) == -1) { 660 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_pullup); 661 return NULL; 662 } 663 664 hdr = fin->fin_dp; 665 switch (proto) 666 { 667 case IPPROTO_FRAGMENT : 668 shift = 8; 669 break; 670 default : 671 shift = 8 + (hdr->ip6e_len << 3); 672 break; 673 } 674 675 if (shift > fin->fin_dlen) { /* Nasty extension header length? */ 676 fin->fin_flx |= FI_BAD; 677 DT3(ipf_fi_bad_pr_ipv6exthdr_len, fr_info_t *, fin, u_short, shift, u_short, fin->fin_dlen); 678 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_hlen); 679 return NULL; 680 } 681 682 fin->fin_dp = (char *)fin->fin_dp + shift; 683 fin->fin_dlen -= shift; 684 685 /* 686 * If we have seen a fragment header, do not set any flags to indicate 687 * the presence of this extension header as it has no impact on the 688 * end result until after it has been defragmented. 689 */ 690 if (fin->fin_flx & FI_FRAG) 691 return hdr; 692 693 for (i = 0; ip6exthdr[i].ol_bit != 0; i++) 694 if (ip6exthdr[i].ol_val == proto) { 695 /* 696 * Most IPv6 extension headers are only allowed once. 697 */ 698 if ((multiple == 0) && 699 ((fin->fin_optmsk & ip6exthdr[i].ol_bit) != 0)) { 700 fin->fin_flx |= FI_BAD; 701 DT2(ipf_fi_bad_ipv6exthdr_once, fr_info_t *, fin, u_int, (fin->fin_optmsk & ip6exthdr[i].ol_bit)); 702 } else 703 fin->fin_optmsk |= ip6exthdr[i].ol_bit; 704 break; 705 } 706 707 return hdr; 708 } 709 710 711 /* ------------------------------------------------------------------------ */ 712 /* Function: ipf_pr_hopopts6 */ 713 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 714 /* Parameters: fin(I) - pointer to packet information */ 715 /* */ 716 /* IPv6 Only */ 717 /* This is function checks pending hop by hop options extension header */ 718 /* ------------------------------------------------------------------------ */ 719 static INLINE int 720 ipf_pr_hopopts6(fr_info_t *fin) 721 { 722 struct ip6_ext *hdr; 723 724 hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_HOPOPTS); 725 if (hdr == NULL) 726 return IPPROTO_NONE; 727 return hdr->ip6e_nxt; 728 } 729 730 731 /* ------------------------------------------------------------------------ */ 732 /* Function: ipf_pr_mobility6 */ 733 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 734 /* Parameters: fin(I) - pointer to packet information */ 735 /* */ 736 /* IPv6 Only */ 737 /* This is function checks the IPv6 mobility extension header */ 738 /* ------------------------------------------------------------------------ */ 739 static INLINE int 740 ipf_pr_mobility6(fr_info_t *fin) 741 { 742 struct ip6_ext *hdr; 743 744 hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_MOBILITY); 745 if (hdr == NULL) 746 return IPPROTO_NONE; 747 return hdr->ip6e_nxt; 748 } 749 750 751 /* ------------------------------------------------------------------------ */ 752 /* Function: ipf_pr_routing6 */ 753 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 754 /* Parameters: fin(I) - pointer to packet information */ 755 /* */ 756 /* IPv6 Only */ 757 /* This is function checks pending routing extension header */ 758 /* ------------------------------------------------------------------------ */ 759 static INLINE int 760 ipf_pr_routing6(fr_info_t *fin) 761 { 762 struct ip6_routing *hdr; 763 764 hdr = (struct ip6_routing *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_ROUTING); 765 if (hdr == NULL) 766 return IPPROTO_NONE; 767 768 switch (hdr->ip6r_type) 769 { 770 case 0 : 771 /* 772 * Nasty extension header length? 773 */ 774 if (((hdr->ip6r_len >> 1) < hdr->ip6r_segleft) || 775 (hdr->ip6r_segleft && (hdr->ip6r_len & 1))) { 776 ipf_main_softc_t *softc = fin->fin_main_soft; 777 778 fin->fin_flx |= FI_BAD; 779 DT1(ipf_fi_bad_routing6, fr_info_t *, fin); 780 LBUMPD(ipf_stats[fin->fin_out], fr_v6_rh_bad); 781 return IPPROTO_NONE; 782 } 783 break; 784 785 default : 786 break; 787 } 788 789 return hdr->ip6r_nxt; 790 } 791 792 793 /* ------------------------------------------------------------------------ */ 794 /* Function: ipf_pr_fragment6 */ 795 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 796 /* Parameters: fin(I) - pointer to packet information */ 797 /* */ 798 /* IPv6 Only */ 799 /* Examine the IPv6 fragment header and extract fragment offset information.*/ 800 /* */ 801 /* Fragments in IPv6 are extraordinarily difficult to deal with - much more */ 802 /* so than in IPv4. There are 5 cases of fragments with IPv6 that all */ 803 /* packets with a fragment header can fit into. They are as follows: */ 804 /* */ 805 /* 1. [IPv6][0-n EH][FH][0-n EH] (no L4HDR present) */ 806 /* 2. [IPV6][0-n EH][FH][0-n EH][L4HDR part] (short) */ 807 /* 3. [IPV6][0-n EH][FH][L4HDR part][0-n data] (short) */ 808 /* 4. [IPV6][0-n EH][FH][0-n EH][L4HDR][0-n data] */ 809 /* 5. [IPV6][0-n EH][FH][data] */ 810 /* */ 811 /* IPV6 = IPv6 header, FH = Fragment Header, */ 812 /* 0-n EH = 0 or more extension headers, 0-n data = 0 or more bytes of data */ 813 /* */ 814 /* Packets that match 1, 2, 3 will be dropped as the only reasonable */ 815 /* scenario in which they happen is in extreme circumstances that are most */ 816 /* likely to be an indication of an attack rather than normal traffic. */ 817 /* A type 3 packet may be sent by an attacked after a type 4 packet. There */ 818 /* are two rules that can be used to guard against type 3 packets: L4 */ 819 /* headers must always be in a packet that has the offset field set to 0 */ 820 /* and no packet is allowed to overlay that where offset = 0. */ 821 /* ------------------------------------------------------------------------ */ 822 static INLINE int 823 ipf_pr_fragment6(fr_info_t *fin) 824 { 825 ipf_main_softc_t *softc = fin->fin_main_soft; 826 struct ip6_frag *frag; 827 828 fin->fin_flx |= FI_FRAG; 829 830 frag = (struct ip6_frag *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_FRAGMENT); 831 if (frag == NULL) { 832 LBUMPD(ipf_stats[fin->fin_out], fr_v6_frag_bad); 833 return IPPROTO_NONE; 834 } 835 836 if ((frag->ip6f_offlg & IP6F_MORE_FRAG) != 0) { 837 /* 838 * Any fragment that isn't the last fragment must have its 839 * length as a multiple of 8. 840 */ 841 if ((fin->fin_plen & 7) != 0) { 842 fin->fin_flx |= FI_BAD; 843 DT2(ipf_fi_bad_frag_not_8, fr_info_t *, fin, u_int, (fin->fin_plen & 7)); 844 } 845 } 846 847 fin->fin_fraghdr = frag; 848 fin->fin_id = frag->ip6f_ident; 849 fin->fin_off = ntohs(frag->ip6f_offlg & IP6F_OFF_MASK); 850 if (fin->fin_off != 0) 851 fin->fin_flx |= FI_FRAGBODY; 852 853 /* 854 * Jumbograms aren't handled, so the max. length is 64k 855 */ 856 if ((fin->fin_off << 3) + fin->fin_dlen > 65535) { 857 fin->fin_flx |= FI_BAD; 858 DT2(ipf_fi_bad_jumbogram, fr_info_t *, fin, u_int, ((fin->fin_off << 3) + fin->fin_dlen)); 859 } 860 861 /* 862 * We don't know where the transport layer header (or whatever is next 863 * is), as it could be behind destination options (amongst others) so 864 * return the fragment header as the type of packet this is. Note that 865 * this effectively disables the fragment cache for > 1 protocol at a 866 * time. 867 */ 868 return frag->ip6f_nxt; 869 } 870 871 872 /* ------------------------------------------------------------------------ */ 873 /* Function: ipf_pr_dstopts6 */ 874 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 875 /* Parameters: fin(I) - pointer to packet information */ 876 /* */ 877 /* IPv6 Only */ 878 /* This is function checks pending destination options extension header */ 879 /* ------------------------------------------------------------------------ */ 880 static INLINE int 881 ipf_pr_dstopts6(fr_info_t *fin) 882 { 883 ipf_main_softc_t *softc = fin->fin_main_soft; 884 struct ip6_ext *hdr; 885 886 hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_DSTOPTS); 887 if (hdr == NULL) { 888 LBUMPD(ipf_stats[fin->fin_out], fr_v6_dst_bad); 889 return IPPROTO_NONE; 890 } 891 return hdr->ip6e_nxt; 892 } 893 894 895 /* ------------------------------------------------------------------------ */ 896 /* Function: ipf_pr_icmp6 */ 897 /* Returns: void */ 898 /* Parameters: fin(I) - pointer to packet information */ 899 /* */ 900 /* IPv6 Only */ 901 /* This routine is mainly concerned with determining the minimum valid size */ 902 /* for an ICMPv6 packet. */ 903 /* ------------------------------------------------------------------------ */ 904 static INLINE void 905 ipf_pr_icmp6(fr_info_t *fin) 906 { 907 int minicmpsz = sizeof(struct icmp6_hdr); 908 struct icmp6_hdr *icmp6; 909 910 if (ipf_pr_pullup(fin, ICMP6ERR_MINPKTLEN - sizeof(ip6_t)) == -1) { 911 ipf_main_softc_t *softc = fin->fin_main_soft; 912 913 LBUMPD(ipf_stats[fin->fin_out], fr_v6_icmp6_pullup); 914 return; 915 } 916 917 if (fin->fin_dlen > 1) { 918 ip6_t *ip6; 919 920 icmp6 = fin->fin_dp; 921 922 fin->fin_data[0] = *(u_short *)icmp6; 923 924 if ((icmp6->icmp6_type & ICMP6_INFOMSG_MASK) != 0) 925 fin->fin_flx |= FI_ICMPQUERY; 926 927 switch (icmp6->icmp6_type) 928 { 929 case ICMP6_ECHO_REPLY : 930 case ICMP6_ECHO_REQUEST : 931 if (fin->fin_dlen >= 6) 932 fin->fin_data[1] = icmp6->icmp6_id; 933 minicmpsz = ICMP6ERR_MINPKTLEN - sizeof(ip6_t); 934 break; 935 936 case ICMP6_DST_UNREACH : 937 case ICMP6_PACKET_TOO_BIG : 938 case ICMP6_TIME_EXCEEDED : 939 case ICMP6_PARAM_PROB : 940 fin->fin_flx |= FI_ICMPERR; 941 minicmpsz = ICMP6ERR_IPICMPHLEN - sizeof(ip6_t); 942 if (fin->fin_plen < ICMP6ERR_IPICMPHLEN) 943 break; 944 945 if (M_LEN(fin->fin_m) < fin->fin_plen) { 946 if (ipf_coalesce(fin) != 1) 947 return; 948 } 949 950 if (ipf_pr_pullup(fin, ICMP6ERR_MINPKTLEN) == -1) 951 return; 952 953 /* 954 * If the destination of this packet doesn't match the 955 * source of the original packet then this packet is 956 * not correct. 957 */ 958 icmp6 = fin->fin_dp; 959 ip6 = (ip6_t *)((char *)icmp6 + ICMPERR_ICMPHLEN); 960 if (IP6_NEQ(&fin->fin_fi.fi_dst, 961 &ip6->ip6_src)) { 962 fin->fin_flx |= FI_BAD; 963 DT1(ipf_fi_bad_icmp6, fr_info_t *, fin); 964 } 965 break; 966 default : 967 break; 968 } 969 } 970 971 ipf_pr_short6(fin, minicmpsz); 972 if ((fin->fin_flx & (FI_SHORT|FI_BAD)) == 0) { 973 u_char p = fin->fin_p; 974 975 fin->fin_p = IPPROTO_ICMPV6; 976 ipf_checkv6sum(fin); 977 fin->fin_p = p; 978 } 979 } 980 981 982 /* ------------------------------------------------------------------------ */ 983 /* Function: ipf_pr_udp6 */ 984 /* Returns: void */ 985 /* Parameters: fin(I) - pointer to packet information */ 986 /* */ 987 /* IPv6 Only */ 988 /* Analyse the packet for IPv6/UDP properties. */ 989 /* Is not expected to be called for fragmented packets. */ 990 /* ------------------------------------------------------------------------ */ 991 static INLINE void 992 ipf_pr_udp6(fr_info_t *fin) 993 { 994 995 if (ipf_pr_udpcommon(fin) == 0) { 996 u_char p = fin->fin_p; 997 998 fin->fin_p = IPPROTO_UDP; 999 ipf_checkv6sum(fin); 1000 fin->fin_p = p; 1001 } 1002 } 1003 1004 1005 /* ------------------------------------------------------------------------ */ 1006 /* Function: ipf_pr_tcp6 */ 1007 /* Returns: void */ 1008 /* Parameters: fin(I) - pointer to packet information */ 1009 /* */ 1010 /* IPv6 Only */ 1011 /* Analyse the packet for IPv6/TCP properties. */ 1012 /* Is not expected to be called for fragmented packets. */ 1013 /* ------------------------------------------------------------------------ */ 1014 static INLINE void 1015 ipf_pr_tcp6(fr_info_t *fin) 1016 { 1017 1018 if (ipf_pr_tcpcommon(fin) == 0) { 1019 u_char p = fin->fin_p; 1020 1021 fin->fin_p = IPPROTO_TCP; 1022 ipf_checkv6sum(fin); 1023 fin->fin_p = p; 1024 } 1025 } 1026 1027 1028 /* ------------------------------------------------------------------------ */ 1029 /* Function: ipf_pr_esp6 */ 1030 /* Returns: void */ 1031 /* Parameters: fin(I) - pointer to packet information */ 1032 /* */ 1033 /* IPv6 Only */ 1034 /* Analyse the packet for ESP properties. */ 1035 /* The minimum length is taken to be the SPI (32bits) plus a tail (32bits) */ 1036 /* even though the newer ESP packets must also have a sequence number that */ 1037 /* is 32bits as well, it is not possible(?) to determine the version from a */ 1038 /* simple packet header. */ 1039 /* ------------------------------------------------------------------------ */ 1040 static INLINE void 1041 ipf_pr_esp6(fr_info_t *fin) 1042 { 1043 1044 if ((fin->fin_off == 0) && (ipf_pr_pullup(fin, 8) == -1)) { 1045 ipf_main_softc_t *softc = fin->fin_main_soft; 1046 1047 LBUMPD(ipf_stats[fin->fin_out], fr_v6_esp_pullup); 1048 return; 1049 } 1050 } 1051 1052 1053 /* ------------------------------------------------------------------------ */ 1054 /* Function: ipf_pr_ah6 */ 1055 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 1056 /* Parameters: fin(I) - pointer to packet information */ 1057 /* */ 1058 /* IPv6 Only */ 1059 /* Analyse the packet for AH properties. */ 1060 /* The minimum length is taken to be the combination of all fields in the */ 1061 /* header being present and no authentication data (null algorithm used.) */ 1062 /* ------------------------------------------------------------------------ */ 1063 static INLINE int 1064 ipf_pr_ah6(fr_info_t *fin) 1065 { 1066 authhdr_t *ah; 1067 1068 fin->fin_flx |= FI_AH; 1069 1070 ah = (authhdr_t *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_HOPOPTS); 1071 if (ah == NULL) { 1072 ipf_main_softc_t *softc = fin->fin_main_soft; 1073 1074 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ah_bad); 1075 return IPPROTO_NONE; 1076 } 1077 1078 ipf_pr_short6(fin, sizeof(*ah)); 1079 1080 /* 1081 * No need for another pullup, ipf_pr_ipv6exthdr() will pullup 1082 * enough data to satisfy ah_next (the very first one.) 1083 */ 1084 return ah->ah_next; 1085 } 1086 1087 1088 /* ------------------------------------------------------------------------ */ 1089 /* Function: ipf_pr_gre6 */ 1090 /* Returns: void */ 1091 /* Parameters: fin(I) - pointer to packet information */ 1092 /* */ 1093 /* Analyse the packet for GRE properties. */ 1094 /* ------------------------------------------------------------------------ */ 1095 static INLINE void 1096 ipf_pr_gre6(fr_info_t *fin) 1097 { 1098 grehdr_t *gre; 1099 1100 if (ipf_pr_pullup(fin, sizeof(grehdr_t)) == -1) { 1101 ipf_main_softc_t *softc = fin->fin_main_soft; 1102 1103 LBUMPD(ipf_stats[fin->fin_out], fr_v6_gre_pullup); 1104 return; 1105 } 1106 1107 gre = fin->fin_dp; 1108 if (GRE_REV(gre->gr_flags) == 1) 1109 fin->fin_data[0] = gre->gr_call; 1110 } 1111 #endif /* USE_INET6 */ 1112 1113 1114 /* ------------------------------------------------------------------------ */ 1115 /* Function: ipf_pr_pullup */ 1116 /* Returns: int - 0 == pullup succeeded, -1 == failure */ 1117 /* Parameters: fin(I) - pointer to packet information */ 1118 /* plen(I) - length (excluding L3 header) to pullup */ 1119 /* */ 1120 /* Short inline function to cut down on code duplication to perform a call */ 1121 /* to ipf_pullup to ensure there is the required amount of data, */ 1122 /* consecutively in the packet buffer. */ 1123 /* */ 1124 /* This function pulls up 'extra' data at the location of fin_dp. fin_dp */ 1125 /* points to the first byte after the complete layer 3 header, which will */ 1126 /* include all of the known extension headers for IPv6 or options for IPv4. */ 1127 /* */ 1128 /* Since fr_pullup() expects the total length of bytes to be pulled up, it */ 1129 /* is necessary to add those we can already assume to be pulled up (fin_dp */ 1130 /* - fin_ip) to what is passed through. */ 1131 /* ------------------------------------------------------------------------ */ 1132 int 1133 ipf_pr_pullup(fr_info_t *fin, int plen) 1134 { 1135 ipf_main_softc_t *softc = fin->fin_main_soft; 1136 1137 if (fin->fin_m != NULL) { 1138 if (fin->fin_dp != NULL) 1139 plen += (char *)fin->fin_dp - 1140 ((char *)fin->fin_ip + fin->fin_hlen); 1141 plen += fin->fin_hlen; 1142 if (M_LEN(fin->fin_m) < plen + fin->fin_ipoff) { 1143 #if defined(_KERNEL) 1144 if (ipf_pullup(fin->fin_m, fin, plen) == NULL) { 1145 DT1(ipf_pullup_fail, fr_info_t *, fin); 1146 LBUMP(ipf_stats[fin->fin_out].fr_pull[1]); 1147 fin->fin_reason = FRB_PULLUP; 1148 fin->fin_flx |= FI_BAD; 1149 return -1; 1150 } 1151 LBUMP(ipf_stats[fin->fin_out].fr_pull[0]); 1152 #else 1153 LBUMP(ipf_stats[fin->fin_out].fr_pull[1]); 1154 /* 1155 * Fake ipf_pullup failing 1156 */ 1157 fin->fin_reason = FRB_PULLUP; 1158 *fin->fin_mp = NULL; 1159 fin->fin_m = NULL; 1160 fin->fin_ip = NULL; 1161 fin->fin_flx |= FI_BAD; 1162 return -1; 1163 #endif 1164 } 1165 } 1166 return 0; 1167 } 1168 1169 1170 /* ------------------------------------------------------------------------ */ 1171 /* Function: ipf_pr_short */ 1172 /* Returns: void */ 1173 /* Parameters: fin(I) - pointer to packet information */ 1174 /* xmin(I) - minimum header size */ 1175 /* */ 1176 /* Check if a packet is "short" as defined by xmin. The rule we are */ 1177 /* applying here is that the packet must not be fragmented within the layer */ 1178 /* 4 header. That is, it must not be a fragment that has its offset set to */ 1179 /* start within the layer 4 header (hdrmin) or if it is at offset 0, the */ 1180 /* entire layer 4 header must be present (min). */ 1181 /* ------------------------------------------------------------------------ */ 1182 static INLINE void 1183 ipf_pr_short(fr_info_t *fin, int xmin) 1184 { 1185 1186 if (fin->fin_off == 0) { 1187 if (fin->fin_dlen < xmin) 1188 fin->fin_flx |= FI_SHORT; 1189 } else if (fin->fin_off < xmin) { 1190 fin->fin_flx |= FI_SHORT; 1191 } 1192 } 1193 1194 1195 /* ------------------------------------------------------------------------ */ 1196 /* Function: ipf_pr_icmp */ 1197 /* Returns: void */ 1198 /* Parameters: fin(I) - pointer to packet information */ 1199 /* */ 1200 /* IPv4 Only */ 1201 /* Do a sanity check on the packet for ICMP (v4). In nearly all cases, */ 1202 /* except extrememly bad packets, both type and code will be present. */ 1203 /* The expected minimum size of an ICMP packet is very much dependent on */ 1204 /* the type of it. */ 1205 /* */ 1206 /* XXX - other ICMP sanity checks? */ 1207 /* ------------------------------------------------------------------------ */ 1208 static INLINE void 1209 ipf_pr_icmp(fr_info_t *fin) 1210 { 1211 ipf_main_softc_t *softc = fin->fin_main_soft; 1212 int minicmpsz = sizeof(struct icmp); 1213 icmphdr_t *icmp; 1214 ip_t *oip; 1215 1216 ipf_pr_short(fin, ICMPERR_ICMPHLEN); 1217 1218 if (fin->fin_off != 0) { 1219 LBUMPD(ipf_stats[fin->fin_out], fr_v4_icmp_frag); 1220 return; 1221 } 1222 1223 if (ipf_pr_pullup(fin, ICMPERR_ICMPHLEN) == -1) { 1224 LBUMPD(ipf_stats[fin->fin_out], fr_v4_icmp_pullup); 1225 return; 1226 } 1227 1228 icmp = fin->fin_dp; 1229 1230 fin->fin_data[0] = *(u_short *)icmp; 1231 fin->fin_data[1] = icmp->icmp_id; 1232 1233 switch (icmp->icmp_type) 1234 { 1235 case ICMP_ECHOREPLY : 1236 case ICMP_ECHO : 1237 /* Router discovery messaes - RFC 1256 */ 1238 case ICMP_ROUTERADVERT : 1239 case ICMP_ROUTERSOLICIT : 1240 fin->fin_flx |= FI_ICMPQUERY; 1241 minicmpsz = ICMP_MINLEN; 1242 break; 1243 /* 1244 * type(1) + code(1) + cksum(2) + id(2) seq(2) + 1245 * 3 * timestamp(3 * 4) 1246 */ 1247 case ICMP_TSTAMP : 1248 case ICMP_TSTAMPREPLY : 1249 fin->fin_flx |= FI_ICMPQUERY; 1250 minicmpsz = 20; 1251 break; 1252 /* 1253 * type(1) + code(1) + cksum(2) + id(2) seq(2) + 1254 * mask(4) 1255 */ 1256 case ICMP_IREQ : 1257 case ICMP_IREQREPLY : 1258 case ICMP_MASKREQ : 1259 case ICMP_MASKREPLY : 1260 fin->fin_flx |= FI_ICMPQUERY; 1261 minicmpsz = 12; 1262 break; 1263 /* 1264 * type(1) + code(1) + cksum(2) + id(2) seq(2) + ip(20+) 1265 */ 1266 case ICMP_UNREACH : 1267 #ifdef icmp_nextmtu 1268 if (icmp->icmp_code == ICMP_UNREACH_NEEDFRAG) { 1269 if (icmp->icmp_nextmtu < softc->ipf_icmpminfragmtu) { 1270 fin->fin_flx |= FI_BAD; 1271 DT3(ipf_fi_bad_icmp_nextmtu, fr_info_t *, fin, u_int, icmp->icmp_nextmtu, u_int, softc->ipf_icmpminfragmtu); 1272 } 1273 } 1274 #endif 1275 /* FALLTHROUGH */ 1276 case ICMP_SOURCEQUENCH : 1277 case ICMP_REDIRECT : 1278 case ICMP_TIMXCEED : 1279 case ICMP_PARAMPROB : 1280 fin->fin_flx |= FI_ICMPERR; 1281 if (ipf_coalesce(fin) != 1) { 1282 LBUMPD(ipf_stats[fin->fin_out], fr_icmp_coalesce); 1283 return; 1284 } 1285 1286 /* 1287 * ICMP error packets should not be generated for IP 1288 * packets that are a fragment that isn't the first 1289 * fragment. 1290 */ 1291 oip = (ip_t *)((char *)fin->fin_dp + ICMPERR_ICMPHLEN); 1292 if ((ntohs(oip->ip_off) & IP_OFFMASK) != 0) { 1293 fin->fin_flx |= FI_BAD; 1294 DT2(ipf_fi_bad_icmp_err, fr_info_t, fin, u_int, (ntohs(oip->ip_off) & IP_OFFMASK)); 1295 } 1296 1297 /* 1298 * If the destination of this packet doesn't match the 1299 * source of the original packet then this packet is 1300 * not correct. 1301 */ 1302 if (oip->ip_src.s_addr != fin->fin_daddr) { 1303 fin->fin_flx |= FI_BAD; 1304 DT1(ipf_fi_bad_src_ne_dst, fr_info_t *, fin); 1305 } 1306 break; 1307 default : 1308 break; 1309 } 1310 1311 ipf_pr_short(fin, minicmpsz); 1312 1313 ipf_checkv4sum(fin); 1314 } 1315 1316 1317 /* ------------------------------------------------------------------------ */ 1318 /* Function: ipf_pr_tcpcommon */ 1319 /* Returns: int - 0 = header ok, 1 = bad packet, -1 = buffer error */ 1320 /* Parameters: fin(I) - pointer to packet information */ 1321 /* */ 1322 /* TCP header sanity checking. Look for bad combinations of TCP flags, */ 1323 /* and make some checks with how they interact with other fields. */ 1324 /* If compiled with IPFILTER_CKSUM, check to see if the TCP checksum is */ 1325 /* valid and mark the packet as bad if not. */ 1326 /* ------------------------------------------------------------------------ */ 1327 static INLINE int 1328 ipf_pr_tcpcommon(fr_info_t *fin) 1329 { 1330 ipf_main_softc_t *softc = fin->fin_main_soft; 1331 int flags, tlen; 1332 tcphdr_t *tcp; 1333 1334 fin->fin_flx |= FI_TCPUDP; 1335 if (fin->fin_off != 0) { 1336 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_frag); 1337 return 0; 1338 } 1339 1340 if (ipf_pr_pullup(fin, sizeof(*tcp)) == -1) { 1341 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_pullup); 1342 return -1; 1343 } 1344 1345 tcp = fin->fin_dp; 1346 if (fin->fin_dlen > 3) { 1347 fin->fin_sport = ntohs(tcp->th_sport); 1348 fin->fin_dport = ntohs(tcp->th_dport); 1349 } 1350 1351 if ((fin->fin_flx & FI_SHORT) != 0) { 1352 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_short); 1353 return 1; 1354 } 1355 1356 /* 1357 * Use of the TCP data offset *must* result in a value that is at 1358 * least the same size as the TCP header. 1359 */ 1360 tlen = TCP_OFF(tcp) << 2; 1361 if (tlen < sizeof(tcphdr_t)) { 1362 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_small); 1363 fin->fin_flx |= FI_BAD; 1364 DT3(ipf_fi_bad_tlen, fr_info_t, fin, u_int, tlen, u_int, sizeof(tcphdr_t)); 1365 return 1; 1366 } 1367 1368 flags = tcp->th_flags; 1369 fin->fin_tcpf = tcp->th_flags; 1370 1371 /* 1372 * If the urgent flag is set, then the urgent pointer must 1373 * also be set and vice versa. Good TCP packets do not have 1374 * just one of these set. 1375 */ 1376 if ((flags & TH_URG) != 0 && (tcp->th_urp == 0)) { 1377 fin->fin_flx |= FI_BAD; 1378 DT3(ipf_fi_bad_th_urg, fr_info_t*, fin, u_int, (flags & TH_URG), u_int, tcp->th_urp); 1379 #if 0 1380 } else if ((flags & TH_URG) == 0 && (tcp->th_urp != 0)) { 1381 /* 1382 * Ignore this case (#if 0) as it shows up in "real" 1383 * traffic with bogus values in the urgent pointer field. 1384 */ 1385 fin->fin_flx |= FI_BAD; 1386 DT3(ipf_fi_bad_th_urg0, fr_info_t *, fin, u_int, (flags & TH_URG), u_int, tcp->th_urp); 1387 #endif 1388 } else if (((flags & (TH_SYN|TH_FIN)) != 0) && 1389 ((flags & (TH_RST|TH_ACK)) == TH_RST)) { 1390 /* TH_FIN|TH_RST|TH_ACK seems to appear "naturally" */ 1391 fin->fin_flx |= FI_BAD; 1392 DT1(ipf_fi_bad_th_fin_rst_ack, fr_info_t, fin); 1393 #if 1 1394 } else if (((flags & TH_SYN) != 0) && 1395 ((flags & (TH_URG|TH_PUSH)) != 0)) { 1396 /* 1397 * SYN with URG and PUSH set is not for normal TCP but it is 1398 * possible(?) with T/TCP...but who uses T/TCP? 1399 */ 1400 fin->fin_flx |= FI_BAD; 1401 DT1(ipf_fi_bad_th_syn_urg_psh, fr_info_t *, fin); 1402 #endif 1403 } else if (!(flags & TH_ACK)) { 1404 /* 1405 * If the ack bit isn't set, then either the SYN or 1406 * RST bit must be set. If the SYN bit is set, then 1407 * we expect the ACK field to be 0. If the ACK is 1408 * not set and if URG, PSH or FIN are set, consdier 1409 * that to indicate a bad TCP packet. 1410 */ 1411 if ((flags == TH_SYN) && (tcp->th_ack != 0)) { 1412 /* 1413 * Cisco PIX sets the ACK field to a random value. 1414 * In light of this, do not set FI_BAD until a patch 1415 * is available from Cisco to ensure that 1416 * interoperability between existing systems is 1417 * achieved. 1418 */ 1419 /*fin->fin_flx |= FI_BAD*/; 1420 /*DT1(ipf_fi_bad_th_syn_ack, fr_info_t *, fin);*/ 1421 } else if (!(flags & (TH_RST|TH_SYN))) { 1422 fin->fin_flx |= FI_BAD; 1423 DT1(ipf_fi_bad_th_rst_syn, fr_info_t *, fin); 1424 } else if ((flags & (TH_URG|TH_PUSH|TH_FIN)) != 0) { 1425 fin->fin_flx |= FI_BAD; 1426 DT1(ipf_fi_bad_th_urg_push_fin, fr_info_t *, fin); 1427 } 1428 } 1429 if (fin->fin_flx & FI_BAD) { 1430 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_bad_flags); 1431 return 1; 1432 } 1433 1434 /* 1435 * At this point, it's not exactly clear what is to be gained by 1436 * marking up which TCP options are and are not present. The one we 1437 * are most interested in is the TCP window scale. This is only in 1438 * a SYN packet [RFC1323] so we don't need this here...? 1439 * Now if we were to analyse the header for passive fingerprinting, 1440 * then that might add some weight to adding this... 1441 */ 1442 if (tlen == sizeof(tcphdr_t)) { 1443 return 0; 1444 } 1445 1446 if (ipf_pr_pullup(fin, tlen) == -1) { 1447 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_pullup); 1448 return -1; 1449 } 1450 1451 #if 0 1452 tcp = fin->fin_dp; 1453 ip = fin->fin_ip; 1454 s = (u_char *)(tcp + 1); 1455 off = IP_HL(ip) << 2; 1456 # ifdef _KERNEL 1457 if (fin->fin_mp != NULL) { 1458 mb_t *m = *fin->fin_mp; 1459 1460 if (off + tlen > M_LEN(m)) 1461 return; 1462 } 1463 # endif 1464 for (tlen -= (int)sizeof(*tcp); tlen > 0; ) { 1465 opt = *s; 1466 if (opt == '\0') 1467 break; 1468 else if (opt == TCPOPT_NOP) 1469 ol = 1; 1470 else { 1471 if (tlen < 2) 1472 break; 1473 ol = (int)*(s + 1); 1474 if (ol < 2 || ol > tlen) 1475 break; 1476 } 1477 1478 for (i = 9, mv = 4; mv >= 0; ) { 1479 op = ipopts + i; 1480 if (opt == (u_char)op->ol_val) { 1481 optmsk |= op->ol_bit; 1482 break; 1483 } 1484 } 1485 tlen -= ol; 1486 s += ol; 1487 } 1488 #endif /* 0 */ 1489 1490 return 0; 1491 } 1492 1493 1494 1495 /* ------------------------------------------------------------------------ */ 1496 /* Function: ipf_pr_udpcommon */ 1497 /* Returns: int - 0 = header ok, 1 = bad packet */ 1498 /* Parameters: fin(I) - pointer to packet information */ 1499 /* */ 1500 /* Extract the UDP source and destination ports, if present. If compiled */ 1501 /* with IPFILTER_CKSUM, check to see if the UDP checksum is valid. */ 1502 /* ------------------------------------------------------------------------ */ 1503 static INLINE int 1504 ipf_pr_udpcommon(fr_info_t *fin) 1505 { 1506 udphdr_t *udp; 1507 1508 fin->fin_flx |= FI_TCPUDP; 1509 1510 if (!fin->fin_off && (fin->fin_dlen > 3)) { 1511 if (ipf_pr_pullup(fin, sizeof(*udp)) == -1) { 1512 ipf_main_softc_t *softc = fin->fin_main_soft; 1513 1514 fin->fin_flx |= FI_SHORT; 1515 LBUMPD(ipf_stats[fin->fin_out], fr_udp_pullup); 1516 return 1; 1517 } 1518 1519 udp = fin->fin_dp; 1520 1521 fin->fin_sport = ntohs(udp->uh_sport); 1522 fin->fin_dport = ntohs(udp->uh_dport); 1523 } 1524 1525 return 0; 1526 } 1527 1528 1529 /* ------------------------------------------------------------------------ */ 1530 /* Function: ipf_pr_tcp */ 1531 /* Returns: void */ 1532 /* Parameters: fin(I) - pointer to packet information */ 1533 /* */ 1534 /* IPv4 Only */ 1535 /* Analyse the packet for IPv4/TCP properties. */ 1536 /* ------------------------------------------------------------------------ */ 1537 static INLINE void 1538 ipf_pr_tcp(fr_info_t *fin) 1539 { 1540 1541 ipf_pr_short(fin, sizeof(tcphdr_t)); 1542 1543 if (ipf_pr_tcpcommon(fin) == 0) 1544 ipf_checkv4sum(fin); 1545 } 1546 1547 1548 /* ------------------------------------------------------------------------ */ 1549 /* Function: ipf_pr_udp */ 1550 /* Returns: void */ 1551 /* Parameters: fin(I) - pointer to packet information */ 1552 /* */ 1553 /* IPv4 Only */ 1554 /* Analyse the packet for IPv4/UDP properties. */ 1555 /* ------------------------------------------------------------------------ */ 1556 static INLINE void 1557 ipf_pr_udp(fr_info_t *fin) 1558 { 1559 1560 ipf_pr_short(fin, sizeof(udphdr_t)); 1561 1562 if (ipf_pr_udpcommon(fin) == 0) 1563 ipf_checkv4sum(fin); 1564 } 1565 1566 1567 /* ------------------------------------------------------------------------ */ 1568 /* Function: ipf_pr_esp */ 1569 /* Returns: void */ 1570 /* Parameters: fin(I) - pointer to packet information */ 1571 /* */ 1572 /* Analyse the packet for ESP properties. */ 1573 /* The minimum length is taken to be the SPI (32bits) plus a tail (32bits) */ 1574 /* even though the newer ESP packets must also have a sequence number that */ 1575 /* is 32bits as well, it is not possible(?) to determine the version from a */ 1576 /* simple packet header. */ 1577 /* ------------------------------------------------------------------------ */ 1578 static INLINE void 1579 ipf_pr_esp(fr_info_t *fin) 1580 { 1581 1582 if (fin->fin_off == 0) { 1583 ipf_pr_short(fin, 8); 1584 if (ipf_pr_pullup(fin, 8) == -1) { 1585 ipf_main_softc_t *softc = fin->fin_main_soft; 1586 1587 LBUMPD(ipf_stats[fin->fin_out], fr_v4_esp_pullup); 1588 } 1589 } 1590 } 1591 1592 1593 /* ------------------------------------------------------------------------ */ 1594 /* Function: ipf_pr_ah */ 1595 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 1596 /* Parameters: fin(I) - pointer to packet information */ 1597 /* */ 1598 /* Analyse the packet for AH properties. */ 1599 /* The minimum length is taken to be the combination of all fields in the */ 1600 /* header being present and no authentication data (null algorithm used.) */ 1601 /* ------------------------------------------------------------------------ */ 1602 static INLINE int 1603 ipf_pr_ah(fr_info_t *fin) 1604 { 1605 ipf_main_softc_t *softc = fin->fin_main_soft; 1606 authhdr_t *ah; 1607 int len; 1608 1609 fin->fin_flx |= FI_AH; 1610 ipf_pr_short(fin, sizeof(*ah)); 1611 1612 if (((fin->fin_flx & FI_SHORT) != 0) || (fin->fin_off != 0)) { 1613 LBUMPD(ipf_stats[fin->fin_out], fr_v4_ah_bad); 1614 return IPPROTO_NONE; 1615 } 1616 1617 if (ipf_pr_pullup(fin, sizeof(*ah)) == -1) { 1618 DT(fr_v4_ah_pullup_1); 1619 LBUMP(ipf_stats[fin->fin_out].fr_v4_ah_pullup); 1620 return IPPROTO_NONE; 1621 } 1622 1623 ah = (authhdr_t *)fin->fin_dp; 1624 1625 len = (ah->ah_plen + 2) << 2; 1626 ipf_pr_short(fin, len); 1627 if (ipf_pr_pullup(fin, len) == -1) { 1628 DT(fr_v4_ah_pullup_2); 1629 LBUMP(ipf_stats[fin->fin_out].fr_v4_ah_pullup); 1630 return IPPROTO_NONE; 1631 } 1632 1633 /* 1634 * Adjust fin_dp and fin_dlen for skipping over the authentication 1635 * header. 1636 */ 1637 fin->fin_dp = (char *)fin->fin_dp + len; 1638 fin->fin_dlen -= len; 1639 return ah->ah_next; 1640 } 1641 1642 1643 /* ------------------------------------------------------------------------ */ 1644 /* Function: ipf_pr_gre */ 1645 /* Returns: void */ 1646 /* Parameters: fin(I) - pointer to packet information */ 1647 /* */ 1648 /* Analyse the packet for GRE properties. */ 1649 /* ------------------------------------------------------------------------ */ 1650 static INLINE void 1651 ipf_pr_gre(fr_info_t *fin) 1652 { 1653 ipf_main_softc_t *softc = fin->fin_main_soft; 1654 grehdr_t *gre; 1655 1656 ipf_pr_short(fin, sizeof(grehdr_t)); 1657 1658 if (fin->fin_off != 0) { 1659 LBUMPD(ipf_stats[fin->fin_out], fr_v4_gre_frag); 1660 return; 1661 } 1662 1663 if (ipf_pr_pullup(fin, sizeof(grehdr_t)) == -1) { 1664 LBUMPD(ipf_stats[fin->fin_out], fr_v4_gre_pullup); 1665 return; 1666 } 1667 1668 gre = fin->fin_dp; 1669 if (GRE_REV(gre->gr_flags) == 1) 1670 fin->fin_data[0] = gre->gr_call; 1671 } 1672 1673 1674 /* ------------------------------------------------------------------------ */ 1675 /* Function: ipf_pr_ipv4hdr */ 1676 /* Returns: void */ 1677 /* Parameters: fin(I) - pointer to packet information */ 1678 /* */ 1679 /* IPv4 Only */ 1680 /* Analyze the IPv4 header and set fields in the fr_info_t structure. */ 1681 /* Check all options present and flag their presence if any exist. */ 1682 /* ------------------------------------------------------------------------ */ 1683 static INLINE void 1684 ipf_pr_ipv4hdr(fr_info_t *fin) 1685 { 1686 u_short optmsk = 0, secmsk = 0, auth = 0; 1687 int hlen, ol, mv, p, i; 1688 const struct optlist *op; 1689 u_char *s, opt; 1690 u_short off; 1691 fr_ip_t *fi; 1692 ip_t *ip; 1693 1694 fi = &fin->fin_fi; 1695 hlen = fin->fin_hlen; 1696 1697 ip = fin->fin_ip; 1698 p = ip->ip_p; 1699 fi->fi_p = p; 1700 fin->fin_crc = p; 1701 fi->fi_tos = ip->ip_tos; 1702 fin->fin_id = ntohs(ip->ip_id); 1703 off = ntohs(ip->ip_off); 1704 1705 /* Get both TTL and protocol */ 1706 fi->fi_p = ip->ip_p; 1707 fi->fi_ttl = ip->ip_ttl; 1708 1709 /* Zero out bits not used in IPv6 address */ 1710 fi->fi_src.i6[1] = 0; 1711 fi->fi_src.i6[2] = 0; 1712 fi->fi_src.i6[3] = 0; 1713 fi->fi_dst.i6[1] = 0; 1714 fi->fi_dst.i6[2] = 0; 1715 fi->fi_dst.i6[3] = 0; 1716 1717 fi->fi_saddr = ip->ip_src.s_addr; 1718 fin->fin_crc += fi->fi_saddr; 1719 fi->fi_daddr = ip->ip_dst.s_addr; 1720 fin->fin_crc += fi->fi_daddr; 1721 if (IN_CLASSD(fi->fi_daddr)) 1722 fin->fin_flx |= FI_MULTICAST|FI_MBCAST; 1723 1724 /* 1725 * set packet attribute flags based on the offset and 1726 * calculate the byte offset that it represents. 1727 */ 1728 off &= IP_MF|IP_OFFMASK; 1729 if (off != 0) { 1730 int morefrag = off & IP_MF; 1731 fi->fi_flx |= FI_FRAG; 1732 off &= IP_OFFMASK; 1733 if (off != 0) { 1734 if (off == 1 && p == IPPROTO_TCP) { 1735 fin->fin_flx |= FI_SHORT; /* RFC 3128 */ 1736 DT1(ipf_fi_tcp_frag_off_1, fr_info_t *, fin); 1737 } 1738 1739 fin->fin_flx |= FI_FRAGBODY; 1740 off <<= 3; 1741 if ((off + fin->fin_dlen > 65535) || 1742 (fin->fin_dlen == 0) || 1743 ((morefrag != 0) && ((fin->fin_dlen & 7) != 0))) { 1744 /* 1745 * The length of the packet, starting at its 1746 * offset cannot exceed 65535 (0xffff) as the 1747 * length of an IP packet is only 16 bits. 1748 * 1749 * Any fragment that isn't the last fragment 1750 * must have a length greater than 0 and it 1751 * must be an even multiple of 8. 1752 */ 1753 fi->fi_flx |= FI_BAD; 1754 DT1(ipf_fi_bad_fragbody_gt_65535, fr_info_t *, fin); 1755 } 1756 } 1757 } 1758 fin->fin_off = off; 1759 1760 /* 1761 * Call per-protocol setup and checking 1762 */ 1763 if (p == IPPROTO_AH) { 1764 /* 1765 * Treat AH differently because we expect there to be another 1766 * layer 4 header after it. 1767 */ 1768 p = ipf_pr_ah(fin); 1769 } 1770 1771 switch (p) 1772 { 1773 case IPPROTO_UDP : 1774 ipf_pr_udp(fin); 1775 break; 1776 case IPPROTO_TCP : 1777 ipf_pr_tcp(fin); 1778 break; 1779 case IPPROTO_ICMP : 1780 ipf_pr_icmp(fin); 1781 break; 1782 case IPPROTO_ESP : 1783 ipf_pr_esp(fin); 1784 break; 1785 case IPPROTO_GRE : 1786 ipf_pr_gre(fin); 1787 break; 1788 } 1789 1790 ip = fin->fin_ip; 1791 if (ip == NULL) 1792 return; 1793 1794 /* 1795 * If it is a standard IP header (no options), set the flag fields 1796 * which relate to options to 0. 1797 */ 1798 if (hlen == sizeof(*ip)) { 1799 fi->fi_optmsk = 0; 1800 fi->fi_secmsk = 0; 1801 fi->fi_auth = 0; 1802 return; 1803 } 1804 1805 /* 1806 * So the IP header has some IP options attached. Walk the entire 1807 * list of options present with this packet and set flags to indicate 1808 * which ones are here and which ones are not. For the somewhat out 1809 * of date and obscure security classification options, set a flag to 1810 * represent which classification is present. 1811 */ 1812 fi->fi_flx |= FI_OPTIONS; 1813 1814 for (s = (u_char *)(ip + 1), hlen -= (int)sizeof(*ip); hlen > 0; ) { 1815 opt = *s; 1816 if (opt == '\0') 1817 break; 1818 else if (opt == IPOPT_NOP) 1819 ol = 1; 1820 else { 1821 if (hlen < 2) 1822 break; 1823 ol = (int)*(s + 1); 1824 if (ol < 2 || ol > hlen) 1825 break; 1826 } 1827 for (i = 9, mv = 4; mv >= 0; ) { 1828 op = ipopts + i; 1829 1830 if ((opt == (u_char)op->ol_val) && (ol > 4)) { 1831 u_32_t doi; 1832 1833 switch (opt) 1834 { 1835 case IPOPT_SECURITY : 1836 if (optmsk & op->ol_bit) { 1837 fin->fin_flx |= FI_BAD; 1838 DT2(ipf_fi_bad_ipopt_security, fr_info_t *, fin, u_short, (optmsk & op->ol_bit)); 1839 } else { 1840 doi = ipf_checkripso(s); 1841 secmsk = doi >> 16; 1842 auth = doi & 0xffff; 1843 } 1844 break; 1845 1846 case IPOPT_CIPSO : 1847 1848 if (optmsk & op->ol_bit) { 1849 fin->fin_flx |= FI_BAD; 1850 DT2(ipf_fi_bad_ipopt_cipso, fr_info_t *, fin, u_short, (optmsk & op->ol_bit)); 1851 } else { 1852 doi = ipf_checkcipso(fin, 1853 s, ol); 1854 secmsk = doi >> 16; 1855 auth = doi & 0xffff; 1856 } 1857 break; 1858 } 1859 optmsk |= op->ol_bit; 1860 } 1861 1862 if (opt < op->ol_val) 1863 i -= mv; 1864 else 1865 i += mv; 1866 mv--; 1867 } 1868 hlen -= ol; 1869 s += ol; 1870 } 1871 1872 /* 1873 * 1874 */ 1875 if (auth && !(auth & 0x0100)) 1876 auth &= 0xff00; 1877 fi->fi_optmsk = optmsk; 1878 fi->fi_secmsk = secmsk; 1879 fi->fi_auth = auth; 1880 } 1881 1882 1883 /* ------------------------------------------------------------------------ */ 1884 /* Function: ipf_checkripso */ 1885 /* Returns: void */ 1886 /* Parameters: s(I) - pointer to start of RIPSO option */ 1887 /* */ 1888 /* ------------------------------------------------------------------------ */ 1889 static u_32_t 1890 ipf_checkripso(u_char *s) 1891 { 1892 const struct optlist *sp; 1893 u_short secmsk = 0, auth = 0; 1894 u_char sec; 1895 int j, m; 1896 1897 sec = *(s + 2); /* classification */ 1898 for (j = 3, m = 2; m >= 0; ) { 1899 sp = secopt + j; 1900 if (sec == sp->ol_val) { 1901 secmsk |= sp->ol_bit; 1902 auth = *(s + 3); 1903 auth *= 256; 1904 auth += *(s + 4); 1905 break; 1906 } 1907 if (sec < sp->ol_val) 1908 j -= m; 1909 else 1910 j += m; 1911 m--; 1912 } 1913 1914 return (secmsk << 16) | auth; 1915 } 1916 1917 1918 /* ------------------------------------------------------------------------ */ 1919 /* Function: ipf_checkcipso */ 1920 /* Returns: u_32_t - 0 = failure, else the doi from the header */ 1921 /* Parameters: fin(IO) - pointer to packet information */ 1922 /* s(I) - pointer to start of CIPSO option */ 1923 /* ol(I) - length of CIPSO option field */ 1924 /* */ 1925 /* This function returns the domain of integrity (DOI) field from the CIPSO */ 1926 /* header and returns that whilst also storing the highest sensitivity */ 1927 /* value found in the fr_info_t structure. */ 1928 /* */ 1929 /* No attempt is made to extract the category bitmaps as these are defined */ 1930 /* by the user (rather than the protocol) and can be rather numerous on the */ 1931 /* end nodes. */ 1932 /* ------------------------------------------------------------------------ */ 1933 static u_32_t 1934 ipf_checkcipso(fr_info_t *fin, u_char *s, int ol) 1935 { 1936 ipf_main_softc_t *softc = fin->fin_main_soft; 1937 fr_ip_t *fi; 1938 u_32_t doi; 1939 u_char *t, tag, tlen, sensitivity; 1940 int len; 1941 1942 if (ol < 6 || ol > 40) { 1943 LBUMPD(ipf_stats[fin->fin_out], fr_v4_cipso_bad); 1944 fin->fin_flx |= FI_BAD; 1945 DT2(ipf_fi_bad_checkcipso_ol, fr_info_t *, fin, u_int, ol); 1946 return 0; 1947 } 1948 1949 fi = &fin->fin_fi; 1950 fi->fi_sensitivity = 0; 1951 /* 1952 * The DOI field MUST be there. 1953 */ 1954 bcopy(s + 2, &doi, sizeof(doi)); 1955 1956 t = (u_char *)s + 6; 1957 for (len = ol - 6; len >= 2; len -= tlen, t+= tlen) { 1958 tag = *t; 1959 tlen = *(t + 1); 1960 if (tlen > len || tlen < 4 || tlen > 34) { 1961 LBUMPD(ipf_stats[fin->fin_out], fr_v4_cipso_tlen); 1962 fin->fin_flx |= FI_BAD; 1963 DT2(ipf_fi_bad_checkcipso_tlen, fr_info_t *, fin, u_int, tlen); 1964 return 0; 1965 } 1966 1967 sensitivity = 0; 1968 /* 1969 * Tag numbers 0, 1, 2, 5 are laid out in the CIPSO Internet 1970 * draft (16 July 1992) that has expired. 1971 */ 1972 if (tag == 0) { 1973 fin->fin_flx |= FI_BAD; 1974 DT2(ipf_fi_bad_checkcipso_tag, fr_info_t *, fin, u_int, tag); 1975 continue; 1976 } else if (tag == 1) { 1977 if (*(t + 2) != 0) { 1978 fin->fin_flx |= FI_BAD; 1979 DT2(ipf_fi_bad_checkcipso_tag1_t2, fr_info_t *, fin, u_int, (*t + 2)); 1980 continue; 1981 } 1982 sensitivity = *(t + 3); 1983 /* Category bitmap for categories 0-239 */ 1984 1985 } else if (tag == 4) { 1986 if (*(t + 2) != 0) { 1987 fin->fin_flx |= FI_BAD; 1988 DT2(ipf_fi_bad_checkcipso_tag4_t2, fr_info_t *, fin, u_int, (*t + 2)); 1989 continue; 1990 } 1991 sensitivity = *(t + 3); 1992 /* Enumerated categories, 16bits each, upto 15 */ 1993 1994 } else if (tag == 5) { 1995 if (*(t + 2) != 0) { 1996 fin->fin_flx |= FI_BAD; 1997 DT2(ipf_fi_bad_checkcipso_tag5_t2, fr_info_t *, fin, u_int, (*t + 2)); 1998 continue; 1999 } 2000 sensitivity = *(t + 3); 2001 /* Range of categories (2*16bits), up to 7 pairs */ 2002 2003 } else if (tag > 127) { 2004 /* Custom defined DOI */ 2005 ; 2006 } else { 2007 DT2(ipf_fi_bad_checkcipso_tag127, fr_info_t *, fin, u_int, tag); 2008 fin->fin_flx |= FI_BAD; 2009 continue; 2010 } 2011 2012 if (sensitivity > fi->fi_sensitivity) 2013 fi->fi_sensitivity = sensitivity; 2014 } 2015 2016 return doi; 2017 } 2018 2019 2020 /* ------------------------------------------------------------------------ */ 2021 /* Function: ipf_makefrip */ 2022 /* Returns: int - 0 == packet ok, -1 == packet freed */ 2023 /* Parameters: hlen(I) - length of IP packet header */ 2024 /* ip(I) - pointer to the IP header */ 2025 /* fin(IO) - pointer to packet information */ 2026 /* */ 2027 /* Compact the IP header into a structure which contains just the info. */ 2028 /* which is useful for comparing IP headers with and store this information */ 2029 /* in the fr_info_t structure pointer to by fin. At present, it is assumed */ 2030 /* this function will be called with either an IPv4 or IPv6 packet. */ 2031 /* ------------------------------------------------------------------------ */ 2032 int 2033 ipf_makefrip(int hlen, ip_t *ip, fr_info_t *fin) 2034 { 2035 ipf_main_softc_t *softc = fin->fin_main_soft; 2036 int v; 2037 2038 fin->fin_depth = 0; 2039 fin->fin_hlen = (u_short)hlen; 2040 fin->fin_ip = ip; 2041 fin->fin_rule = 0xffffffff; 2042 fin->fin_group[0] = -1; 2043 fin->fin_group[1] = '\0'; 2044 fin->fin_dp = (char *)ip + hlen; 2045 2046 v = fin->fin_v; 2047 if (v == 4) { 2048 fin->fin_plen = ntohs(ip->ip_len); 2049 fin->fin_dlen = fin->fin_plen - hlen; 2050 ipf_pr_ipv4hdr(fin); 2051 #ifdef USE_INET6 2052 } else if (v == 6) { 2053 fin->fin_plen = ntohs(((ip6_t *)ip)->ip6_plen); 2054 fin->fin_dlen = fin->fin_plen; 2055 fin->fin_plen += hlen; 2056 2057 ipf_pr_ipv6hdr(fin); 2058 #endif 2059 } 2060 if (fin->fin_ip == NULL) { 2061 LBUMP(ipf_stats[fin->fin_out].fr_ip_freed); 2062 return -1; 2063 } 2064 return 0; 2065 } 2066 2067 2068 /* ------------------------------------------------------------------------ */ 2069 /* Function: ipf_portcheck */ 2070 /* Returns: int - 1 == port matched, 0 == port match failed */ 2071 /* Parameters: frp(I) - pointer to port check `expression' */ 2072 /* pop(I) - port number to evaluate */ 2073 /* */ 2074 /* Perform a comparison of a port number against some other(s), using a */ 2075 /* structure with compare information stored in it. */ 2076 /* ------------------------------------------------------------------------ */ 2077 static INLINE int 2078 ipf_portcheck(frpcmp_t *frp, u_32_t pop) 2079 { 2080 int err = 1; 2081 u_32_t po; 2082 2083 po = frp->frp_port; 2084 2085 /* 2086 * Do opposite test to that required and continue if that succeeds. 2087 */ 2088 switch (frp->frp_cmp) 2089 { 2090 case FR_EQUAL : 2091 if (pop != po) /* EQUAL */ 2092 err = 0; 2093 break; 2094 case FR_NEQUAL : 2095 if (pop == po) /* NOTEQUAL */ 2096 err = 0; 2097 break; 2098 case FR_LESST : 2099 if (pop >= po) /* LESSTHAN */ 2100 err = 0; 2101 break; 2102 case FR_GREATERT : 2103 if (pop <= po) /* GREATERTHAN */ 2104 err = 0; 2105 break; 2106 case FR_LESSTE : 2107 if (pop > po) /* LT or EQ */ 2108 err = 0; 2109 break; 2110 case FR_GREATERTE : 2111 if (pop < po) /* GT or EQ */ 2112 err = 0; 2113 break; 2114 case FR_OUTRANGE : 2115 if (pop >= po && pop <= frp->frp_top) /* Out of range */ 2116 err = 0; 2117 break; 2118 case FR_INRANGE : 2119 if (pop <= po || pop >= frp->frp_top) /* In range */ 2120 err = 0; 2121 break; 2122 case FR_INCRANGE : 2123 if (pop < po || pop > frp->frp_top) /* Inclusive range */ 2124 err = 0; 2125 break; 2126 default : 2127 break; 2128 } 2129 return err; 2130 } 2131 2132 2133 /* ------------------------------------------------------------------------ */ 2134 /* Function: ipf_tcpudpchk */ 2135 /* Returns: int - 1 == protocol matched, 0 == check failed */ 2136 /* Parameters: fda(I) - pointer to packet information */ 2137 /* ft(I) - pointer to structure with comparison data */ 2138 /* */ 2139 /* Compares the current pcket (assuming it is TCP/UDP) information with a */ 2140 /* structure containing information that we want to match against. */ 2141 /* ------------------------------------------------------------------------ */ 2142 int 2143 ipf_tcpudpchk(fr_ip_t *fi, frtuc_t *ft) 2144 { 2145 int err = 1; 2146 2147 /* 2148 * Both ports should *always* be in the first fragment. 2149 * So far, I cannot find any cases where they can not be. 2150 * 2151 * compare destination ports 2152 */ 2153 if (ft->ftu_dcmp) 2154 err = ipf_portcheck(&ft->ftu_dst, fi->fi_ports[1]); 2155 2156 /* 2157 * compare source ports 2158 */ 2159 if (err && ft->ftu_scmp) 2160 err = ipf_portcheck(&ft->ftu_src, fi->fi_ports[0]); 2161 2162 /* 2163 * If we don't have all the TCP/UDP header, then how can we 2164 * expect to do any sort of match on it ? If we were looking for 2165 * TCP flags, then NO match. If not, then match (which should 2166 * satisfy the "short" class too). 2167 */ 2168 if (err && (fi->fi_p == IPPROTO_TCP)) { 2169 if (fi->fi_flx & FI_SHORT) 2170 return !(ft->ftu_tcpf | ft->ftu_tcpfm); 2171 /* 2172 * Match the flags ? If not, abort this match. 2173 */ 2174 if (ft->ftu_tcpfm && 2175 ft->ftu_tcpf != (fi->fi_tcpf & ft->ftu_tcpfm)) { 2176 FR_DEBUG(("f. %#x & %#x != %#x\n", fi->fi_tcpf, 2177 ft->ftu_tcpfm, ft->ftu_tcpf)); 2178 err = 0; 2179 } 2180 } 2181 return err; 2182 } 2183 2184 2185 /* ------------------------------------------------------------------------ */ 2186 /* Function: ipf_check_ipf */ 2187 /* Returns: int - 0 == match, else no match */ 2188 /* Parameters: fin(I) - pointer to packet information */ 2189 /* fr(I) - pointer to filter rule */ 2190 /* portcmp(I) - flag indicating whether to attempt matching on */ 2191 /* TCP/UDP port data. */ 2192 /* */ 2193 /* Check to see if a packet matches an IPFilter rule. Checks of addresses, */ 2194 /* port numbers, etc, for "standard" IPFilter rules are all orchestrated in */ 2195 /* this function. */ 2196 /* ------------------------------------------------------------------------ */ 2197 static INLINE int 2198 ipf_check_ipf(fr_info_t *fin, frentry_t *fr, int portcmp) 2199 { 2200 u_32_t *ld, *lm, *lip; 2201 fripf_t *fri; 2202 fr_ip_t *fi; 2203 int i; 2204 2205 fi = &fin->fin_fi; 2206 fri = fr->fr_ipf; 2207 lip = (u_32_t *)fi; 2208 lm = (u_32_t *)&fri->fri_mip; 2209 ld = (u_32_t *)&fri->fri_ip; 2210 2211 /* 2212 * first 32 bits to check coversion: 2213 * IP version, TOS, TTL, protocol 2214 */ 2215 i = ((*lip & *lm) != *ld); 2216 FR_DEBUG(("0. %#08x & %#08x != %#08x\n", 2217 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2218 if (i) 2219 return 1; 2220 2221 /* 2222 * Next 32 bits is a constructed bitmask indicating which IP options 2223 * are present (if any) in this packet. 2224 */ 2225 lip++, lm++, ld++; 2226 i = ((*lip & *lm) != *ld); 2227 FR_DEBUG(("1. %#08x & %#08x != %#08x\n", 2228 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2229 if (i != 0) 2230 return 1; 2231 2232 lip++, lm++, ld++; 2233 /* 2234 * Unrolled loops (4 each, for 32 bits) for address checks. 2235 */ 2236 /* 2237 * Check the source address. 2238 */ 2239 if (fr->fr_satype == FRI_LOOKUP) { 2240 i = (*fr->fr_srcfunc)(fin->fin_main_soft, fr->fr_srcptr, 2241 fi->fi_v, lip, fin->fin_plen); 2242 if (i == -1) 2243 return 1; 2244 lip += 3; 2245 lm += 3; 2246 ld += 3; 2247 } else { 2248 i = ((*lip & *lm) != *ld); 2249 FR_DEBUG(("2a. %#08x & %#08x != %#08x\n", 2250 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2251 if (fi->fi_v == 6) { 2252 lip++, lm++, ld++; 2253 i |= ((*lip & *lm) != *ld); 2254 FR_DEBUG(("2b. %#08x & %#08x != %#08x\n", 2255 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2256 lip++, lm++, ld++; 2257 i |= ((*lip & *lm) != *ld); 2258 FR_DEBUG(("2c. %#08x & %#08x != %#08x\n", 2259 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2260 lip++, lm++, ld++; 2261 i |= ((*lip & *lm) != *ld); 2262 FR_DEBUG(("2d. %#08x & %#08x != %#08x\n", 2263 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2264 } else { 2265 lip += 3; 2266 lm += 3; 2267 ld += 3; 2268 } 2269 } 2270 i ^= (fr->fr_flags & FR_NOTSRCIP) >> 6; 2271 if (i != 0) 2272 return 1; 2273 2274 /* 2275 * Check the destination address. 2276 */ 2277 lip++, lm++, ld++; 2278 if (fr->fr_datype == FRI_LOOKUP) { 2279 i = (*fr->fr_dstfunc)(fin->fin_main_soft, fr->fr_dstptr, 2280 fi->fi_v, lip, fin->fin_plen); 2281 if (i == -1) 2282 return 1; 2283 lip += 3; 2284 lm += 3; 2285 ld += 3; 2286 } else { 2287 i = ((*lip & *lm) != *ld); 2288 FR_DEBUG(("3a. %#08x & %#08x != %#08x\n", 2289 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2290 if (fi->fi_v == 6) { 2291 lip++, lm++, ld++; 2292 i |= ((*lip & *lm) != *ld); 2293 FR_DEBUG(("3b. %#08x & %#08x != %#08x\n", 2294 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2295 lip++, lm++, ld++; 2296 i |= ((*lip & *lm) != *ld); 2297 FR_DEBUG(("3c. %#08x & %#08x != %#08x\n", 2298 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2299 lip++, lm++, ld++; 2300 i |= ((*lip & *lm) != *ld); 2301 FR_DEBUG(("3d. %#08x & %#08x != %#08x\n", 2302 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2303 } else { 2304 lip += 3; 2305 lm += 3; 2306 ld += 3; 2307 } 2308 } 2309 i ^= (fr->fr_flags & FR_NOTDSTIP) >> 7; 2310 if (i != 0) 2311 return 1; 2312 /* 2313 * IP addresses matched. The next 32bits contains: 2314 * mast of old IP header security & authentication bits. 2315 */ 2316 lip++, lm++, ld++; 2317 i = (*ld - (*lip & *lm)); 2318 FR_DEBUG(("4. %#08x & %#08x != %#08x\n", *lip, *lm, *ld)); 2319 2320 /* 2321 * Next we have 32 bits of packet flags. 2322 */ 2323 lip++, lm++, ld++; 2324 i |= (*ld - (*lip & *lm)); 2325 FR_DEBUG(("5. %#08x & %#08x != %#08x\n", *lip, *lm, *ld)); 2326 2327 if (i == 0) { 2328 /* 2329 * If a fragment, then only the first has what we're 2330 * looking for here... 2331 */ 2332 if (portcmp) { 2333 if (!ipf_tcpudpchk(&fin->fin_fi, &fr->fr_tuc)) 2334 i = 1; 2335 } else { 2336 if (fr->fr_dcmp || fr->fr_scmp || 2337 fr->fr_tcpf || fr->fr_tcpfm) 2338 i = 1; 2339 if (fr->fr_icmpm || fr->fr_icmp) { 2340 if (((fi->fi_p != IPPROTO_ICMP) && 2341 (fi->fi_p != IPPROTO_ICMPV6)) || 2342 fin->fin_off || (fin->fin_dlen < 2)) 2343 i = 1; 2344 else if ((fin->fin_data[0] & fr->fr_icmpm) != 2345 fr->fr_icmp) { 2346 FR_DEBUG(("i. %#x & %#x != %#x\n", 2347 fin->fin_data[0], 2348 fr->fr_icmpm, fr->fr_icmp)); 2349 i = 1; 2350 } 2351 } 2352 } 2353 } 2354 return i; 2355 } 2356 2357 2358 /* ------------------------------------------------------------------------ */ 2359 /* Function: ipf_scanlist */ 2360 /* Returns: int - result flags of scanning filter list */ 2361 /* Parameters: fin(I) - pointer to packet information */ 2362 /* pass(I) - default result to return for filtering */ 2363 /* */ 2364 /* Check the input/output list of rules for a match to the current packet. */ 2365 /* If a match is found, the value of fr_flags from the rule becomes the */ 2366 /* return value and fin->fin_fr points to the matched rule. */ 2367 /* */ 2368 /* This function may be called recursively upto 16 times (limit inbuilt.) */ 2369 /* When unwinding, it should finish up with fin_depth as 0. */ 2370 /* */ 2371 /* Could be per interface, but this gets real nasty when you don't have, */ 2372 /* or can't easily change, the kernel source code to . */ 2373 /* ------------------------------------------------------------------------ */ 2374 int 2375 ipf_scanlist(fr_info_t *fin, u_32_t pass) 2376 { 2377 ipf_main_softc_t *softc = fin->fin_main_soft; 2378 int rulen, portcmp, off, skip; 2379 struct frentry *fr, *fnext; 2380 u_32_t passt, passo; 2381 2382 /* 2383 * Do not allow nesting deeper than 16 levels. 2384 */ 2385 if (fin->fin_depth >= 16) 2386 return pass; 2387 2388 fr = fin->fin_fr; 2389 2390 /* 2391 * If there are no rules in this list, return now. 2392 */ 2393 if (fr == NULL) 2394 return pass; 2395 2396 skip = 0; 2397 portcmp = 0; 2398 fin->fin_depth++; 2399 fin->fin_fr = NULL; 2400 off = fin->fin_off; 2401 2402 if ((fin->fin_flx & FI_TCPUDP) && (fin->fin_dlen > 3) && !off) 2403 portcmp = 1; 2404 2405 for (rulen = 0; fr; fr = fnext, rulen++) { 2406 fnext = fr->fr_next; 2407 if (skip != 0) { 2408 FR_VERBOSE(("SKIP %d (%#x)\n", skip, fr->fr_flags)); 2409 skip--; 2410 continue; 2411 } 2412 2413 /* 2414 * In all checks below, a null (zero) value in the 2415 * filter struture is taken to mean a wildcard. 2416 * 2417 * check that we are working for the right interface 2418 */ 2419 #ifdef _KERNEL 2420 if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp) 2421 continue; 2422 #else 2423 if (opts & (OPT_VERBOSE|OPT_DEBUG)) 2424 printf("\n"); 2425 FR_VERBOSE(("%c", FR_ISSKIP(pass) ? 's' : 2426 FR_ISPASS(pass) ? 'p' : 2427 FR_ISACCOUNT(pass) ? 'A' : 2428 FR_ISAUTH(pass) ? 'a' : 2429 (pass & FR_NOMATCH) ? 'n' :'b')); 2430 if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp) 2431 continue; 2432 FR_VERBOSE((":i")); 2433 #endif 2434 2435 switch (fr->fr_type) 2436 { 2437 case FR_T_IPF : 2438 case FR_T_IPF_BUILTIN : 2439 if (ipf_check_ipf(fin, fr, portcmp)) 2440 continue; 2441 break; 2442 #if defined(IPFILTER_BPF) 2443 case FR_T_BPFOPC : 2444 case FR_T_BPFOPC_BUILTIN : 2445 { 2446 u_char *mc; 2447 int wlen; 2448 2449 if (*fin->fin_mp == NULL) 2450 continue; 2451 if (fin->fin_family != fr->fr_family) 2452 continue; 2453 mc = (u_char *)fin->fin_m; 2454 wlen = fin->fin_dlen + fin->fin_hlen; 2455 if (!bpf_filter(fr->fr_data, mc, wlen, 0)) 2456 continue; 2457 break; 2458 } 2459 #endif 2460 case FR_T_CALLFUNC_BUILTIN : 2461 { 2462 frentry_t *f; 2463 2464 f = (*fr->fr_func)(fin, &pass); 2465 if (f != NULL) 2466 fr = f; 2467 else 2468 continue; 2469 break; 2470 } 2471 2472 case FR_T_IPFEXPR : 2473 case FR_T_IPFEXPR_BUILTIN : 2474 if (fin->fin_family != fr->fr_family) 2475 continue; 2476 if (ipf_fr_matcharray(fin, fr->fr_data) == 0) 2477 continue; 2478 break; 2479 2480 default : 2481 break; 2482 } 2483 2484 if ((fin->fin_out == 0) && (fr->fr_nattag.ipt_num[0] != 0)) { 2485 if (fin->fin_nattag == NULL) 2486 continue; 2487 if (ipf_matchtag(&fr->fr_nattag, fin->fin_nattag) == 0) 2488 continue; 2489 } 2490 FR_VERBOSE(("=%d/%d.%d *", fr->fr_grhead, fr->fr_group, rulen)); 2491 2492 passt = fr->fr_flags; 2493 2494 /* 2495 * If the rule is a "call now" rule, then call the function 2496 * in the rule, if it exists and use the results from that. 2497 * If the function pointer is bad, just make like we ignore 2498 * it, except for increasing the hit counter. 2499 */ 2500 if ((passt & FR_CALLNOW) != 0) { 2501 frentry_t *frs; 2502 2503 ATOMIC_INC64(fr->fr_hits); 2504 if ((fr->fr_func == NULL) || 2505 (fr->fr_func == (ipfunc_t)-1)) 2506 continue; 2507 2508 frs = fin->fin_fr; 2509 fin->fin_fr = fr; 2510 fr = (*fr->fr_func)(fin, &passt); 2511 if (fr == NULL) { 2512 fin->fin_fr = frs; 2513 continue; 2514 } 2515 passt = fr->fr_flags; 2516 } 2517 fin->fin_fr = fr; 2518 2519 #ifdef IPFILTER_LOG 2520 /* 2521 * Just log this packet... 2522 */ 2523 if ((passt & FR_LOGMASK) == FR_LOG) { 2524 if (ipf_log_pkt(fin, passt) == -1) { 2525 if (passt & FR_LOGORBLOCK) { 2526 DT(frb_logfail); 2527 passt &= ~FR_CMDMASK; 2528 passt |= FR_BLOCK|FR_QUICK; 2529 fin->fin_reason = FRB_LOGFAIL; 2530 } 2531 } 2532 } 2533 #endif /* IPFILTER_LOG */ 2534 2535 MUTEX_ENTER(&fr->fr_lock); 2536 fr->fr_bytes += (U_QUAD_T)fin->fin_plen; 2537 fr->fr_hits++; 2538 MUTEX_EXIT(&fr->fr_lock); 2539 fin->fin_rule = rulen; 2540 2541 passo = pass; 2542 if (FR_ISSKIP(passt)) { 2543 skip = fr->fr_arg; 2544 continue; 2545 } else if (((passt & FR_LOGMASK) != FR_LOG) && 2546 ((passt & FR_LOGMASK) != FR_DECAPSULATE)) { 2547 pass = passt; 2548 } 2549 2550 if (passt & (FR_RETICMP|FR_FAKEICMP)) 2551 fin->fin_icode = fr->fr_icode; 2552 2553 if (fr->fr_group != -1) { 2554 (void) strncpy(fin->fin_group, 2555 FR_NAME(fr, fr_group), 2556 strlen(FR_NAME(fr, fr_group))); 2557 } else { 2558 fin->fin_group[0] = '\0'; 2559 } 2560 2561 FR_DEBUG(("pass %#x/%#x/%x\n", passo, pass, passt)); 2562 2563 if (fr->fr_grphead != NULL) { 2564 fin->fin_fr = fr->fr_grphead->fg_start; 2565 FR_VERBOSE(("group %s\n", FR_NAME(fr, fr_grhead))); 2566 2567 if (FR_ISDECAPS(passt)) 2568 passt = ipf_decaps(fin, pass, fr->fr_icode); 2569 else 2570 passt = ipf_scanlist(fin, pass); 2571 2572 if (fin->fin_fr == NULL) { 2573 fin->fin_rule = rulen; 2574 if (fr->fr_group != -1) 2575 (void) strncpy(fin->fin_group, 2576 fr->fr_names + 2577 fr->fr_group, 2578 strlen(fr->fr_names + 2579 fr->fr_group)); 2580 fin->fin_fr = fr; 2581 passt = pass; 2582 } 2583 pass = passt; 2584 } 2585 2586 if (pass & FR_QUICK) { 2587 /* 2588 * Finally, if we've asked to track state for this 2589 * packet, set it up. Add state for "quick" rules 2590 * here so that if the action fails we can consider 2591 * the rule to "not match" and keep on processing 2592 * filter rules. 2593 */ 2594 if ((pass & FR_KEEPSTATE) && !FR_ISAUTH(pass) && 2595 !(fin->fin_flx & FI_STATE)) { 2596 int out = fin->fin_out; 2597 2598 fin->fin_fr = fr; 2599 if (ipf_state_add(softc, fin, NULL, 0) == 0) { 2600 LBUMPD(ipf_stats[out], fr_ads); 2601 } else { 2602 LBUMPD(ipf_stats[out], fr_bads); 2603 pass = passo; 2604 continue; 2605 } 2606 } 2607 break; 2608 } 2609 } 2610 fin->fin_depth--; 2611 return pass; 2612 } 2613 2614 2615 /* ------------------------------------------------------------------------ */ 2616 /* Function: ipf_acctpkt */ 2617 /* Returns: frentry_t* - always returns NULL */ 2618 /* Parameters: fin(I) - pointer to packet information */ 2619 /* passp(IO) - pointer to current/new filter decision (unused) */ 2620 /* */ 2621 /* Checks a packet against accounting rules, if there are any for the given */ 2622 /* IP protocol version. */ 2623 /* */ 2624 /* N.B.: this function returns NULL to match the prototype used by other */ 2625 /* functions called from the IPFilter "mainline" in ipf_check(). */ 2626 /* ------------------------------------------------------------------------ */ 2627 frentry_t * 2628 ipf_acctpkt(fr_info_t *fin, u_32_t *passp) 2629 { 2630 ipf_main_softc_t *softc = fin->fin_main_soft; 2631 char group[FR_GROUPLEN]; 2632 frentry_t *fr, *frsave; 2633 u_32_t pass, rulen; 2634 2635 passp = passp; 2636 fr = softc->ipf_acct[fin->fin_out][softc->ipf_active]; 2637 2638 if (fr != NULL) { 2639 frsave = fin->fin_fr; 2640 bcopy(fin->fin_group, group, FR_GROUPLEN); 2641 rulen = fin->fin_rule; 2642 fin->fin_fr = fr; 2643 pass = ipf_scanlist(fin, FR_NOMATCH); 2644 if (FR_ISACCOUNT(pass)) { 2645 LBUMPD(ipf_stats[0], fr_acct); 2646 } 2647 fin->fin_fr = frsave; 2648 bcopy(group, fin->fin_group, FR_GROUPLEN); 2649 fin->fin_rule = rulen; 2650 } 2651 return NULL; 2652 } 2653 2654 2655 /* ------------------------------------------------------------------------ */ 2656 /* Function: ipf_firewall */ 2657 /* Returns: frentry_t* - returns pointer to matched rule, if no matches */ 2658 /* were found, returns NULL. */ 2659 /* Parameters: fin(I) - pointer to packet information */ 2660 /* passp(IO) - pointer to current/new filter decision (unused) */ 2661 /* */ 2662 /* Applies an appropriate set of firewall rules to the packet, to see if */ 2663 /* there are any matches. The first check is to see if a match can be seen */ 2664 /* in the cache. If not, then search an appropriate list of rules. Once a */ 2665 /* matching rule is found, take any appropriate actions as defined by the */ 2666 /* rule - except logging. */ 2667 /* ------------------------------------------------------------------------ */ 2668 static frentry_t * 2669 ipf_firewall(fr_info_t *fin, u_32_t *passp) 2670 { 2671 ipf_main_softc_t *softc = fin->fin_main_soft; 2672 frentry_t *fr; 2673 u_32_t pass; 2674 int out; 2675 2676 out = fin->fin_out; 2677 pass = *passp; 2678 2679 /* 2680 * This rule cache will only affect packets that are not being 2681 * statefully filtered. 2682 */ 2683 fin->fin_fr = softc->ipf_rules[out][softc->ipf_active]; 2684 if (fin->fin_fr != NULL) 2685 pass = ipf_scanlist(fin, softc->ipf_pass); 2686 2687 if ((pass & FR_NOMATCH)) { 2688 LBUMPD(ipf_stats[out], fr_nom); 2689 } 2690 fr = fin->fin_fr; 2691 2692 /* 2693 * Apply packets per second rate-limiting to a rule as required. 2694 */ 2695 if ((fr != NULL) && (fr->fr_pps != 0) && 2696 !ppsratecheck(&fr->fr_lastpkt, &fr->fr_curpps, fr->fr_pps)) { 2697 DT2(frb_ppsrate, fr_info_t *, fin, frentry_t *, fr); 2698 pass &= ~(FR_CMDMASK|FR_RETICMP|FR_RETRST); 2699 pass |= FR_BLOCK; 2700 LBUMPD(ipf_stats[out], fr_ppshit); 2701 fin->fin_reason = FRB_PPSRATE; 2702 } 2703 2704 /* 2705 * If we fail to add a packet to the authorization queue, then we 2706 * drop the packet later. However, if it was added then pretend 2707 * we've dropped it already. 2708 */ 2709 if (FR_ISAUTH(pass)) { 2710 if (ipf_auth_new(fin->fin_m, fin) != 0) { 2711 DT1(frb_authnew, fr_info_t *, fin); 2712 fin->fin_m = *fin->fin_mp = NULL; 2713 fin->fin_reason = FRB_AUTHNEW; 2714 fin->fin_error = 0; 2715 } else { 2716 IPFERROR(1); 2717 fin->fin_error = ENOSPC; 2718 } 2719 } 2720 2721 if ((fr != NULL) && (fr->fr_func != NULL) && 2722 (fr->fr_func != (ipfunc_t)-1) && !(pass & FR_CALLNOW)) 2723 (void) (*fr->fr_func)(fin, &pass); 2724 2725 /* 2726 * If a rule is a pre-auth rule, check again in the list of rules 2727 * loaded for authenticated use. It does not particulary matter 2728 * if this search fails because a "preauth" result, from a rule, 2729 * is treated as "not a pass", hence the packet is blocked. 2730 */ 2731 if (FR_ISPREAUTH(pass)) { 2732 pass = ipf_auth_pre_scanlist(softc, fin, pass); 2733 } 2734 2735 /* 2736 * If the rule has "keep frag" and the packet is actually a fragment, 2737 * then create a fragment state entry. 2738 */ 2739 if (pass & FR_KEEPFRAG) { 2740 if (fin->fin_flx & FI_FRAG) { 2741 if (ipf_frag_new(softc, fin, pass) == -1) { 2742 LBUMP(ipf_stats[out].fr_bnfr); 2743 } else { 2744 LBUMP(ipf_stats[out].fr_nfr); 2745 } 2746 } else { 2747 LBUMP(ipf_stats[out].fr_cfr); 2748 } 2749 } 2750 2751 fr = fin->fin_fr; 2752 *passp = pass; 2753 2754 return fr; 2755 } 2756 2757 2758 /* ------------------------------------------------------------------------ */ 2759 /* Function: ipf_check */ 2760 /* Returns: int - 0 == packet allowed through, */ 2761 /* User space: */ 2762 /* -1 == packet blocked */ 2763 /* 1 == packet not matched */ 2764 /* -2 == requires authentication */ 2765 /* Kernel: */ 2766 /* > 0 == filter error # for packet */ 2767 /* Parameters: ip(I) - pointer to start of IPv4/6 packet */ 2768 /* hlen(I) - length of header */ 2769 /* ifp(I) - pointer to interface this packet is on */ 2770 /* out(I) - 0 == packet going in, 1 == packet going out */ 2771 /* mp(IO) - pointer to caller's buffer pointer that holds this */ 2772 /* IP packet. */ 2773 /* Solaris & HP-UX ONLY : */ 2774 /* qpi(I) - pointer to STREAMS queue information for this */ 2775 /* interface & direction. */ 2776 /* */ 2777 /* ipf_check() is the master function for all IPFilter packet processing. */ 2778 /* It orchestrates: Network Address Translation (NAT), checking for packet */ 2779 /* authorisation (or pre-authorisation), presence of related state info., */ 2780 /* generating log entries, IP packet accounting, routing of packets as */ 2781 /* directed by firewall rules and of course whether or not to allow the */ 2782 /* packet to be further processed by the kernel. */ 2783 /* */ 2784 /* For packets blocked, the contents of "mp" will be NULL'd and the buffer */ 2785 /* freed. Packets passed may be returned with the pointer pointed to by */ 2786 /* by "mp" changed to a new buffer. */ 2787 /* ------------------------------------------------------------------------ */ 2788 int 2789 ipf_check(void *ctx, ip_t *ip, int hlen, void *ifp, int out, 2790 #if defined(_KERNEL) && defined(MENTAT) 2791 void *qif, 2792 #endif 2793 mb_t **mp) 2794 { 2795 /* 2796 * The above really sucks, but short of writing a diff 2797 */ 2798 ipf_main_softc_t *softc = ctx; 2799 fr_info_t frinfo; 2800 fr_info_t *fin = &frinfo; 2801 u_32_t pass = softc->ipf_pass; 2802 frentry_t *fr = NULL; 2803 int v = IP_V(ip); 2804 mb_t *mc = NULL; 2805 mb_t *m; 2806 /* 2807 * The first part of ipf_check() deals with making sure that what goes 2808 * into the filtering engine makes some sense. Information about the 2809 * the packet is distilled, collected into a fr_info_t structure and 2810 * the an attempt to ensure the buffer the packet is in is big enough 2811 * to hold all the required packet headers. 2812 */ 2813 #ifdef _KERNEL 2814 # ifdef MENTAT 2815 qpktinfo_t *qpi = qif; 2816 2817 # ifdef __sparc 2818 if ((u_int)ip & 0x3) 2819 return 2; 2820 # endif 2821 # else 2822 SPL_INT(s); 2823 # endif 2824 2825 if (softc->ipf_running <= 0) { 2826 return 0; 2827 } 2828 2829 bzero((char *)fin, sizeof(*fin)); 2830 2831 # ifdef MENTAT 2832 if (qpi->qpi_flags & QF_BROADCAST) 2833 fin->fin_flx |= FI_MBCAST|FI_BROADCAST; 2834 if (qpi->qpi_flags & QF_MULTICAST) 2835 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2836 m = qpi->qpi_m; 2837 fin->fin_qfm = m; 2838 fin->fin_qpi = qpi; 2839 # else /* MENTAT */ 2840 2841 m = *mp; 2842 2843 # if defined(M_MCAST) 2844 if ((m->m_flags & M_MCAST) != 0) 2845 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2846 # endif 2847 # if defined(M_MLOOP) 2848 if ((m->m_flags & M_MLOOP) != 0) 2849 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2850 # endif 2851 # if defined(M_BCAST) 2852 if ((m->m_flags & M_BCAST) != 0) 2853 fin->fin_flx |= FI_MBCAST|FI_BROADCAST; 2854 # endif 2855 # ifdef M_CANFASTFWD 2856 /* 2857 * XXX For now, IP Filter and fast-forwarding of cached flows 2858 * XXX are mutually exclusive. Eventually, IP Filter should 2859 * XXX get a "can-fast-forward" filter rule. 2860 */ 2861 m->m_flags &= ~M_CANFASTFWD; 2862 # endif /* M_CANFASTFWD */ 2863 # if defined(CSUM_DELAY_DATA) && (!defined(__FreeBSD_version) || \ 2864 (__FreeBSD_version < 501108)) 2865 /* 2866 * disable delayed checksums. 2867 */ 2868 if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) { 2869 in_undefer_cksum_tcpudp(m); 2870 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA; 2871 } 2872 # endif /* CSUM_DELAY_DATA */ 2873 # endif /* MENTAT */ 2874 #else 2875 bzero((char *)fin, sizeof(*fin)); 2876 m = *mp; 2877 # if defined(M_MCAST) 2878 if ((m->m_flags & M_MCAST) != 0) 2879 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2880 # endif 2881 # if defined(M_MLOOP) 2882 if ((m->m_flags & M_MLOOP) != 0) 2883 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2884 # endif 2885 # if defined(M_BCAST) 2886 if ((m->m_flags & M_BCAST) != 0) 2887 fin->fin_flx |= FI_MBCAST|FI_BROADCAST; 2888 # endif 2889 #endif /* _KERNEL */ 2890 2891 fin->fin_v = v; 2892 fin->fin_m = m; 2893 fin->fin_ip = ip; 2894 fin->fin_mp = mp; 2895 fin->fin_out = out; 2896 fin->fin_ifp = ifp; 2897 fin->fin_error = ENETUNREACH; 2898 fin->fin_hlen = (u_short)hlen; 2899 fin->fin_dp = (char *)ip + hlen; 2900 fin->fin_main_soft = softc; 2901 2902 fin->fin_ipoff = (char *)ip - MTOD(m, char *); 2903 2904 SPL_NET(s); 2905 2906 #ifdef USE_INET6 2907 if (v == 6) { 2908 LBUMP(ipf_stats[out].fr_ipv6); 2909 /* 2910 * Jumbo grams are quite likely too big for internal buffer 2911 * structures to handle comfortably, for now, so just drop 2912 * them. 2913 */ 2914 if (((ip6_t *)ip)->ip6_plen == 0) { 2915 DT1(frb_jumbo, ip6_t *, (ip6_t *)ip); 2916 pass = FR_BLOCK|FR_NOMATCH; 2917 fin->fin_reason = FRB_JUMBO; 2918 goto finished; 2919 } 2920 fin->fin_family = AF_INET6; 2921 } else 2922 #endif 2923 { 2924 fin->fin_family = AF_INET; 2925 } 2926 2927 if (ipf_makefrip(hlen, ip, fin) == -1) { 2928 DT1(frb_makefrip, fr_info_t *, fin); 2929 pass = FR_BLOCK|FR_NOMATCH; 2930 fin->fin_reason = FRB_MAKEFRIP; 2931 goto finished; 2932 } 2933 2934 /* 2935 * For at least IPv6 packets, if a m_pullup() fails then this pointer 2936 * becomes NULL and so we have no packet to free. 2937 */ 2938 if (*fin->fin_mp == NULL) 2939 goto finished; 2940 2941 if (!out) { 2942 if (v == 4) { 2943 if (softc->ipf_chksrc && !ipf_verifysrc(fin)) { 2944 LBUMPD(ipf_stats[0], fr_v4_badsrc); 2945 fin->fin_flx |= FI_BADSRC; 2946 } 2947 if (fin->fin_ip->ip_ttl < softc->ipf_minttl) { 2948 LBUMPD(ipf_stats[0], fr_v4_badttl); 2949 fin->fin_flx |= FI_LOWTTL; 2950 } 2951 } 2952 #ifdef USE_INET6 2953 else if (v == 6) { 2954 if (((ip6_t *)ip)->ip6_hlim < softc->ipf_minttl) { 2955 LBUMPD(ipf_stats[0], fr_v6_badttl); 2956 fin->fin_flx |= FI_LOWTTL; 2957 } 2958 } 2959 #endif 2960 } 2961 2962 if (fin->fin_flx & FI_SHORT) { 2963 LBUMPD(ipf_stats[out], fr_short); 2964 } 2965 2966 READ_ENTER(&softc->ipf_mutex); 2967 2968 if (!out) { 2969 switch (fin->fin_v) 2970 { 2971 case 4 : 2972 if (ipf_nat_checkin(fin, &pass) == -1) { 2973 goto filterdone; 2974 } 2975 break; 2976 #ifdef USE_INET6 2977 case 6 : 2978 if (ipf_nat6_checkin(fin, &pass) == -1) { 2979 goto filterdone; 2980 } 2981 break; 2982 #endif 2983 default : 2984 break; 2985 } 2986 } 2987 /* 2988 * Check auth now. 2989 * If a packet is found in the auth table, then skip checking 2990 * the access lists for permission but we do need to consider 2991 * the result as if it were from the ACL's. In addition, being 2992 * found in the auth table means it has been seen before, so do 2993 * not pass it through accounting (again), lest it be counted twice. 2994 */ 2995 fr = ipf_auth_check(fin, &pass); 2996 if (!out && (fr == NULL)) 2997 (void) ipf_acctpkt(fin, NULL); 2998 2999 if (fr == NULL) { 3000 if ((fin->fin_flx & FI_FRAG) != 0) 3001 fr = ipf_frag_known(fin, &pass); 3002 3003 if (fr == NULL) 3004 fr = ipf_state_check(fin, &pass); 3005 } 3006 3007 if ((pass & FR_NOMATCH) || (fr == NULL)) 3008 fr = ipf_firewall(fin, &pass); 3009 3010 /* 3011 * If we've asked to track state for this packet, set it up. 3012 * Here rather than ipf_firewall because ipf_checkauth may decide 3013 * to return a packet for "keep state" 3014 */ 3015 if ((pass & FR_KEEPSTATE) && (fin->fin_m != NULL) && 3016 !(fin->fin_flx & FI_STATE)) { 3017 if (ipf_state_add(softc, fin, NULL, 0) == 0) { 3018 LBUMP(ipf_stats[out].fr_ads); 3019 } else { 3020 LBUMP(ipf_stats[out].fr_bads); 3021 if (FR_ISPASS(pass)) { 3022 DT(frb_stateadd); 3023 pass &= ~FR_CMDMASK; 3024 pass |= FR_BLOCK; 3025 fin->fin_reason = FRB_STATEADD; 3026 } 3027 } 3028 } 3029 3030 fin->fin_fr = fr; 3031 if ((fr != NULL) && !(fin->fin_flx & FI_STATE)) { 3032 fin->fin_dif = &fr->fr_dif; 3033 fin->fin_tif = &fr->fr_tifs[fin->fin_rev]; 3034 } 3035 3036 /* 3037 * Only count/translate packets which will be passed on, out the 3038 * interface. 3039 */ 3040 if (out && FR_ISPASS(pass)) { 3041 (void) ipf_acctpkt(fin, NULL); 3042 3043 switch (fin->fin_v) 3044 { 3045 case 4 : 3046 if (ipf_nat_checkout(fin, &pass) == -1) { 3047 ; 3048 } else if ((softc->ipf_update_ipid != 0) && (v == 4)) { 3049 if (ipf_updateipid(fin) == -1) { 3050 DT(frb_updateipid); 3051 LBUMP(ipf_stats[1].fr_ipud); 3052 pass &= ~FR_CMDMASK; 3053 pass |= FR_BLOCK; 3054 fin->fin_reason = FRB_UPDATEIPID; 3055 } else { 3056 LBUMP(ipf_stats[0].fr_ipud); 3057 } 3058 } 3059 break; 3060 #ifdef USE_INET6 3061 case 6 : 3062 (void) ipf_nat6_checkout(fin, &pass); 3063 break; 3064 #endif 3065 default : 3066 break; 3067 } 3068 } 3069 3070 filterdone: 3071 #ifdef IPFILTER_LOG 3072 if ((softc->ipf_flags & FF_LOGGING) || (pass & FR_LOGMASK)) { 3073 (void) ipf_dolog(fin, &pass); 3074 } 3075 #endif 3076 3077 /* 3078 * The FI_STATE flag is cleared here so that calling ipf_state_check 3079 * will work when called from inside of fr_fastroute. Although 3080 * there is a similar flag, FI_NATED, for NAT, it does have the same 3081 * impact on code execution. 3082 */ 3083 fin->fin_flx &= ~FI_STATE; 3084 3085 #if defined(FASTROUTE_RECURSION) 3086 /* 3087 * Up the reference on fr_lock and exit ipf_mutex. The generation of 3088 * a packet below can sometimes cause a recursive call into IPFilter. 3089 * On those platforms where that does happen, we need to hang onto 3090 * the filter rule just in case someone decides to remove or flush it 3091 * in the meantime. 3092 */ 3093 if (fr != NULL) { 3094 MUTEX_ENTER(&fr->fr_lock); 3095 fr->fr_ref++; 3096 MUTEX_EXIT(&fr->fr_lock); 3097 } 3098 3099 RWLOCK_EXIT(&softc->ipf_mutex); 3100 #endif 3101 3102 if ((pass & FR_RETMASK) != 0) { 3103 /* 3104 * Should we return an ICMP packet to indicate error 3105 * status passing through the packet filter ? 3106 * WARNING: ICMP error packets AND TCP RST packets should 3107 * ONLY be sent in repsonse to incoming packets. Sending 3108 * them in response to outbound packets can result in a 3109 * panic on some operating systems. 3110 */ 3111 if (!out) { 3112 if (pass & FR_RETICMP) { 3113 int dst; 3114 3115 if ((pass & FR_RETMASK) == FR_FAKEICMP) 3116 dst = 1; 3117 else 3118 dst = 0; 3119 (void) ipf_send_icmp_err(ICMP_UNREACH, fin, 3120 dst); 3121 LBUMP(ipf_stats[0].fr_ret); 3122 } else if (((pass & FR_RETMASK) == FR_RETRST) && 3123 !(fin->fin_flx & FI_SHORT)) { 3124 if (((fin->fin_flx & FI_OOW) != 0) || 3125 (ipf_send_reset(fin) == 0)) { 3126 LBUMP(ipf_stats[1].fr_ret); 3127 } 3128 } 3129 3130 /* 3131 * When using return-* with auth rules, the auth code 3132 * takes over disposing of this packet. 3133 */ 3134 if (FR_ISAUTH(pass) && (fin->fin_m != NULL)) { 3135 DT1(frb_authcapture, fr_info_t *, fin); 3136 fin->fin_m = *fin->fin_mp = NULL; 3137 fin->fin_reason = FRB_AUTHCAPTURE; 3138 m = NULL; 3139 } 3140 } else { 3141 if (pass & FR_RETRST) { 3142 fin->fin_error = ECONNRESET; 3143 } 3144 } 3145 } 3146 3147 /* 3148 * After the above so that ICMP unreachables and TCP RSTs get 3149 * created properly. 3150 */ 3151 if (FR_ISBLOCK(pass) && (fin->fin_flx & FI_NEWNAT)) 3152 ipf_nat_uncreate(fin); 3153 3154 /* 3155 * If we didn't drop off the bottom of the list of rules (and thus 3156 * the 'current' rule fr is not NULL), then we may have some extra 3157 * instructions about what to do with a packet. 3158 * Once we're finished return to our caller, freeing the packet if 3159 * we are dropping it. 3160 */ 3161 if (fr != NULL) { 3162 frdest_t *fdp; 3163 3164 /* 3165 * Generate a duplicated packet first because ipf_fastroute 3166 * can lead to fin_m being free'd... not good. 3167 */ 3168 fdp = fin->fin_dif; 3169 if ((fdp != NULL) && (fdp->fd_ptr != NULL) && 3170 (fdp->fd_ptr != (void *)-1) && (fin->fin_m != NULL)) { 3171 mc = M_COPY(fin->fin_m); 3172 if (mc != NULL) 3173 ipf_fastroute(mc, &mc, fin, fdp); 3174 } 3175 3176 fdp = fin->fin_tif; 3177 if (!out && (pass & FR_FASTROUTE)) { 3178 /* 3179 * For fastroute rule, no destination interface defined 3180 * so pass NULL as the frdest_t parameter 3181 */ 3182 (void) ipf_fastroute(fin->fin_m, mp, fin, NULL); 3183 m = *mp = NULL; 3184 } else if ((fdp != NULL) && (fdp->fd_ptr != NULL) && 3185 (fdp->fd_ptr != (struct ifnet *)-1)) { 3186 /* this is for to rules: */ 3187 ipf_fastroute(fin->fin_m, mp, fin, fdp); 3188 m = *mp = NULL; 3189 } 3190 3191 #if defined(FASTROUTE_RECURSION) 3192 (void) ipf_derefrule(softc, &fr); 3193 #endif 3194 } 3195 #if !defined(FASTROUTE_RECURSION) 3196 RWLOCK_EXIT(&softc->ipf_mutex); 3197 #endif 3198 3199 finished: 3200 if (!FR_ISPASS(pass)) { 3201 LBUMP(ipf_stats[out].fr_block); 3202 if (*mp != NULL) { 3203 #ifdef _KERNEL 3204 FREE_MB_T(*mp); 3205 #endif 3206 m = *mp = NULL; 3207 } 3208 } else { 3209 LBUMP(ipf_stats[out].fr_pass); 3210 #if defined(_KERNEL) && defined(__sgi) 3211 if ((fin->fin_hbuf != NULL) && 3212 (mtod(fin->fin_m, struct ip *) != fin->fin_ip)) { 3213 COPYBACK(fin->fin_m, 0, fin->fin_plen, fin->fin_hbuf); 3214 } 3215 #endif 3216 } 3217 3218 SPL_X(s); 3219 3220 if (fin->fin_m == NULL && fin->fin_flx & FI_BAD && 3221 fin->fin_reason == FRB_PULLUP) { 3222 /* m_pullup() has freed the mbuf */ 3223 LBUMP(ipf_stats[out].fr_blocked[fin->fin_reason]); 3224 return (-1); 3225 } 3226 3227 #ifdef _KERNEL 3228 if (FR_ISPASS(pass)) 3229 return 0; 3230 LBUMP(ipf_stats[out].fr_blocked[fin->fin_reason]); 3231 return fin->fin_error; 3232 #else /* _KERNEL */ 3233 if (*mp != NULL) 3234 (*mp)->mb_ifp = fin->fin_ifp; 3235 blockreason = fin->fin_reason; 3236 FR_VERBOSE(("fin_flx %#x pass %#x ", fin->fin_flx, pass)); 3237 /*if ((pass & FR_CMDMASK) == (softc->ipf_pass & FR_CMDMASK))*/ 3238 if ((pass & FR_NOMATCH) != 0) 3239 return 1; 3240 3241 if ((pass & FR_RETMASK) != 0) 3242 switch (pass & FR_RETMASK) 3243 { 3244 case FR_RETRST : 3245 return 3; 3246 case FR_RETICMP : 3247 return 4; 3248 case FR_FAKEICMP : 3249 return 5; 3250 } 3251 3252 switch (pass & FR_CMDMASK) 3253 { 3254 case FR_PASS : 3255 return 0; 3256 case FR_BLOCK : 3257 return -1; 3258 case FR_AUTH : 3259 return -2; 3260 case FR_ACCOUNT : 3261 return -3; 3262 case FR_PREAUTH : 3263 return -4; 3264 } 3265 return 2; 3266 #endif /* _KERNEL */ 3267 } 3268 3269 3270 #ifdef IPFILTER_LOG 3271 /* ------------------------------------------------------------------------ */ 3272 /* Function: ipf_dolog */ 3273 /* Returns: frentry_t* - returns contents of fin_fr (no change made) */ 3274 /* Parameters: fin(I) - pointer to packet information */ 3275 /* passp(IO) - pointer to current/new filter decision (unused) */ 3276 /* */ 3277 /* Checks flags set to see how a packet should be logged, if it is to be */ 3278 /* logged. Adjust statistics based on its success or not. */ 3279 /* ------------------------------------------------------------------------ */ 3280 frentry_t * 3281 ipf_dolog(fr_info_t *fin, u_32_t *passp) 3282 { 3283 ipf_main_softc_t *softc = fin->fin_main_soft; 3284 u_32_t pass; 3285 int out; 3286 3287 out = fin->fin_out; 3288 pass = *passp; 3289 3290 if ((softc->ipf_flags & FF_LOGNOMATCH) && (pass & FR_NOMATCH)) { 3291 pass |= FF_LOGNOMATCH; 3292 LBUMPD(ipf_stats[out], fr_npkl); 3293 goto logit; 3294 3295 } else if (((pass & FR_LOGMASK) == FR_LOGP) || 3296 (FR_ISPASS(pass) && (softc->ipf_flags & FF_LOGPASS))) { 3297 if ((pass & FR_LOGMASK) != FR_LOGP) 3298 pass |= FF_LOGPASS; 3299 LBUMPD(ipf_stats[out], fr_ppkl); 3300 goto logit; 3301 3302 } else if (((pass & FR_LOGMASK) == FR_LOGB) || 3303 (FR_ISBLOCK(pass) && (softc->ipf_flags & FF_LOGBLOCK))) { 3304 if ((pass & FR_LOGMASK) != FR_LOGB) 3305 pass |= FF_LOGBLOCK; 3306 LBUMPD(ipf_stats[out], fr_bpkl); 3307 3308 logit: 3309 if (ipf_log_pkt(fin, pass) == -1) { 3310 /* 3311 * If the "or-block" option has been used then 3312 * block the packet if we failed to log it. 3313 */ 3314 if ((pass & FR_LOGORBLOCK) && FR_ISPASS(pass)) { 3315 DT1(frb_logfail2, u_int, pass); 3316 pass &= ~FR_CMDMASK; 3317 pass |= FR_BLOCK; 3318 fin->fin_reason = FRB_LOGFAIL2; 3319 } 3320 } 3321 *passp = pass; 3322 } 3323 3324 return fin->fin_fr; 3325 } 3326 #endif /* IPFILTER_LOG */ 3327 3328 3329 /* ------------------------------------------------------------------------ */ 3330 /* Function: ipf_cksum */ 3331 /* Returns: u_short - IP header checksum */ 3332 /* Parameters: addr(I) - pointer to start of buffer to checksum */ 3333 /* len(I) - length of buffer in bytes */ 3334 /* */ 3335 /* Calculate the two's complement 16 bit checksum of the buffer passed. */ 3336 /* */ 3337 /* N.B.: addr should be 16bit aligned. */ 3338 /* ------------------------------------------------------------------------ */ 3339 u_short 3340 ipf_cksum(u_short *addr, int len) 3341 { 3342 u_32_t sum = 0; 3343 3344 for (sum = 0; len > 1; len -= 2) 3345 sum += *addr++; 3346 3347 /* mop up an odd byte, if necessary */ 3348 if (len == 1) 3349 sum += *(u_char *)addr; 3350 3351 /* 3352 * add back carry outs from top 16 bits to low 16 bits 3353 */ 3354 sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */ 3355 sum += (sum >> 16); /* add carry */ 3356 return (u_short)(~sum); 3357 } 3358 3359 3360 /* ------------------------------------------------------------------------ */ 3361 /* Function: fr_cksum */ 3362 /* Returns: u_short - layer 4 checksum */ 3363 /* Parameters: fin(I) - pointer to packet information */ 3364 /* ip(I) - pointer to IP header */ 3365 /* l4proto(I) - protocol to caclulate checksum for */ 3366 /* l4hdr(I) - pointer to layer 4 header */ 3367 /* */ 3368 /* Calculates the TCP checksum for the packet held in "m", using the data */ 3369 /* in the IP header "ip" to seed it. */ 3370 /* */ 3371 /* NB: This function assumes we've pullup'd enough for all of the IP header */ 3372 /* and the TCP header. We also assume that data blocks aren't allocated in */ 3373 /* odd sizes. */ 3374 /* */ 3375 /* Expects ip_len and ip_off to be in network byte order when called. */ 3376 /* ------------------------------------------------------------------------ */ 3377 u_short 3378 fr_cksum(fr_info_t *fin, ip_t *ip, int l4proto, void *l4hdr) 3379 { 3380 u_short *sp, slen, sumsave, *csump; 3381 u_int sum, sum2; 3382 int hlen; 3383 int off; 3384 #ifdef USE_INET6 3385 ip6_t *ip6; 3386 #endif 3387 3388 csump = NULL; 3389 sumsave = 0; 3390 sp = NULL; 3391 slen = 0; 3392 hlen = 0; 3393 sum = 0; 3394 3395 sum = htons((u_short)l4proto); 3396 /* 3397 * Add up IP Header portion 3398 */ 3399 #ifdef USE_INET6 3400 if (IP_V(ip) == 4) { 3401 #endif 3402 hlen = IP_HL(ip) << 2; 3403 off = hlen; 3404 sp = (u_short *)&ip->ip_src; 3405 sum += *sp++; /* ip_src */ 3406 sum += *sp++; 3407 sum += *sp++; /* ip_dst */ 3408 sum += *sp++; 3409 #ifdef USE_INET6 3410 } else if (IP_V(ip) == 6) { 3411 ip6 = (ip6_t *)ip; 3412 hlen = sizeof(*ip6); 3413 off = ((char *)fin->fin_dp - (char *)fin->fin_ip); 3414 sp = (u_short *)&ip6->ip6_src; 3415 sum += *sp++; /* ip6_src */ 3416 sum += *sp++; 3417 sum += *sp++; 3418 sum += *sp++; 3419 sum += *sp++; 3420 sum += *sp++; 3421 sum += *sp++; 3422 sum += *sp++; 3423 /* This needs to be routing header aware. */ 3424 sum += *sp++; /* ip6_dst */ 3425 sum += *sp++; 3426 sum += *sp++; 3427 sum += *sp++; 3428 sum += *sp++; 3429 sum += *sp++; 3430 sum += *sp++; 3431 sum += *sp++; 3432 } else { 3433 return 0xffff; 3434 } 3435 #endif 3436 slen = fin->fin_plen - off; 3437 sum += htons(slen); 3438 3439 switch (l4proto) 3440 { 3441 case IPPROTO_UDP : 3442 csump = &((udphdr_t *)l4hdr)->uh_sum; 3443 break; 3444 3445 case IPPROTO_TCP : 3446 csump = &((tcphdr_t *)l4hdr)->th_sum; 3447 break; 3448 case IPPROTO_ICMP : 3449 csump = &((icmphdr_t *)l4hdr)->icmp_cksum; 3450 sum = 0; /* Pseudo-checksum is not included */ 3451 break; 3452 #ifdef USE_INET6 3453 case IPPROTO_ICMPV6 : 3454 csump = &((struct icmp6_hdr *)l4hdr)->icmp6_cksum; 3455 break; 3456 #endif 3457 default : 3458 break; 3459 } 3460 3461 if (csump != NULL) { 3462 sumsave = *csump; 3463 *csump = 0; 3464 } 3465 3466 sum2 = ipf_pcksum(fin, off, sum); 3467 if (csump != NULL) 3468 *csump = sumsave; 3469 return sum2; 3470 } 3471 3472 3473 /* ------------------------------------------------------------------------ */ 3474 /* Function: ipf_findgroup */ 3475 /* Returns: frgroup_t * - NULL = group not found, else pointer to group */ 3476 /* Parameters: softc(I) - pointer to soft context main structure */ 3477 /* group(I) - group name to search for */ 3478 /* unit(I) - device to which this group belongs */ 3479 /* set(I) - which set of rules (inactive/inactive) this is */ 3480 /* fgpp(O) - pointer to place to store pointer to the pointer */ 3481 /* to where to add the next (last) group or where */ 3482 /* to delete group from. */ 3483 /* */ 3484 /* Search amongst the defined groups for a particular group number. */ 3485 /* ------------------------------------------------------------------------ */ 3486 frgroup_t * 3487 ipf_findgroup(ipf_main_softc_t *softc, char *group, minor_t unit, int set, 3488 frgroup_t ***fgpp) 3489 { 3490 frgroup_t *fg, **fgp; 3491 3492 /* 3493 * Which list of groups to search in is dependent on which list of 3494 * rules are being operated on. 3495 */ 3496 fgp = &softc->ipf_groups[unit][set]; 3497 3498 while ((fg = *fgp) != NULL) { 3499 if (strncmp(group, fg->fg_name, FR_GROUPLEN) == 0) 3500 break; 3501 else 3502 fgp = &fg->fg_next; 3503 } 3504 if (fgpp != NULL) 3505 *fgpp = fgp; 3506 return fg; 3507 } 3508 3509 3510 /* ------------------------------------------------------------------------ */ 3511 /* Function: ipf_group_add */ 3512 /* Returns: frgroup_t * - NULL == did not create group, */ 3513 /* != NULL == pointer to the group */ 3514 /* Parameters: softc(I) - pointer to soft context main structure */ 3515 /* num(I) - group number to add */ 3516 /* head(I) - rule pointer that is using this as the head */ 3517 /* flags(I) - rule flags which describe the type of rule it is */ 3518 /* unit(I) - device to which this group will belong to */ 3519 /* set(I) - which set of rules (inactive/inactive) this is */ 3520 /* Write Locks: ipf_mutex */ 3521 /* */ 3522 /* Add a new group head, or if it already exists, increase the reference */ 3523 /* count to it. */ 3524 /* ------------------------------------------------------------------------ */ 3525 frgroup_t * 3526 ipf_group_add(ipf_main_softc_t *softc, char *group, void *head, u_32_t flags, 3527 minor_t unit, int set) 3528 { 3529 frgroup_t *fg, **fgp; 3530 u_32_t gflags; 3531 3532 if (group == NULL) 3533 return NULL; 3534 3535 if (unit == IPL_LOGIPF && *group == '\0') 3536 return NULL; 3537 3538 fgp = NULL; 3539 gflags = flags & FR_INOUT; 3540 3541 fg = ipf_findgroup(softc, group, unit, set, &fgp); 3542 if (fg != NULL) { 3543 if (fg->fg_head == NULL && head != NULL) 3544 fg->fg_head = head; 3545 if (fg->fg_flags == 0) 3546 fg->fg_flags = gflags; 3547 else if (gflags != fg->fg_flags) 3548 return NULL; 3549 fg->fg_ref++; 3550 return fg; 3551 } 3552 3553 KMALLOC(fg, frgroup_t *); 3554 if (fg != NULL) { 3555 fg->fg_head = head; 3556 fg->fg_start = NULL; 3557 fg->fg_next = *fgp; 3558 bcopy(group, fg->fg_name, strlen(group) + 1); 3559 fg->fg_flags = gflags; 3560 fg->fg_ref = 1; 3561 fg->fg_set = &softc->ipf_groups[unit][set]; 3562 *fgp = fg; 3563 } 3564 return fg; 3565 } 3566 3567 3568 /* ------------------------------------------------------------------------ */ 3569 /* Function: ipf_group_del */ 3570 /* Returns: int - number of rules deleted */ 3571 /* Parameters: softc(I) - pointer to soft context main structure */ 3572 /* group(I) - group name to delete */ 3573 /* fr(I) - filter rule from which group is referenced */ 3574 /* Write Locks: ipf_mutex */ 3575 /* */ 3576 /* This function is called whenever a reference to a group is to be dropped */ 3577 /* and thus its reference count needs to be lowered and the group free'd if */ 3578 /* the reference count reaches zero. Passing in fr is really for the sole */ 3579 /* purpose of knowing when the head rule is being deleted. */ 3580 /* ------------------------------------------------------------------------ */ 3581 void 3582 ipf_group_del(ipf_main_softc_t *softc, frgroup_t *group, frentry_t *fr) 3583 { 3584 3585 if (group->fg_head == fr) 3586 group->fg_head = NULL; 3587 3588 group->fg_ref--; 3589 if ((group->fg_ref == 0) && (group->fg_start == NULL)) 3590 ipf_group_free(group); 3591 } 3592 3593 3594 /* ------------------------------------------------------------------------ */ 3595 /* Function: ipf_group_free */ 3596 /* Returns: Nil */ 3597 /* Parameters: group(I) - pointer to filter rule group */ 3598 /* */ 3599 /* Remove the group from the list of groups and free it. */ 3600 /* ------------------------------------------------------------------------ */ 3601 static void 3602 ipf_group_free(frgroup_t *group) 3603 { 3604 frgroup_t **gp; 3605 3606 for (gp = group->fg_set; *gp != NULL; gp = &(*gp)->fg_next) { 3607 if (*gp == group) { 3608 *gp = group->fg_next; 3609 break; 3610 } 3611 } 3612 KFREE(group); 3613 } 3614 3615 3616 /* ------------------------------------------------------------------------ */ 3617 /* Function: ipf_group_flush */ 3618 /* Returns: int - number of rules flush from group */ 3619 /* Parameters: softc(I) - pointer to soft context main structure */ 3620 /* Parameters: group(I) - pointer to filter rule group */ 3621 /* */ 3622 /* Remove all of the rules that currently are listed under the given group. */ 3623 /* ------------------------------------------------------------------------ */ 3624 static int 3625 ipf_group_flush(ipf_main_softc_t *softc, frgroup_t *group) 3626 { 3627 int gone = 0; 3628 3629 (void) ipf_flushlist(softc, &gone, &group->fg_start); 3630 3631 return gone; 3632 } 3633 3634 3635 /* ------------------------------------------------------------------------ */ 3636 /* Function: ipf_getrulen */ 3637 /* Returns: frentry_t * - NULL == not found, else pointer to rule n */ 3638 /* Parameters: softc(I) - pointer to soft context main structure */ 3639 /* Parameters: unit(I) - device for which to count the rule's number */ 3640 /* flags(I) - which set of rules to find the rule in */ 3641 /* group(I) - group name */ 3642 /* n(I) - rule number to find */ 3643 /* */ 3644 /* Find rule # n in group # g and return a pointer to it. Return NULl if */ 3645 /* group # g doesn't exist or there are less than n rules in the group. */ 3646 /* ------------------------------------------------------------------------ */ 3647 frentry_t * 3648 ipf_getrulen(ipf_main_softc_t *softc, int unit, char *group, u_32_t n) 3649 { 3650 frentry_t *fr; 3651 frgroup_t *fg; 3652 3653 fg = ipf_findgroup(softc, group, unit, softc->ipf_active, NULL); 3654 if (fg == NULL) 3655 return NULL; 3656 for (fr = fg->fg_start; fr && n; fr = fr->fr_next, n--) 3657 ; 3658 if (n != 0) 3659 return NULL; 3660 return fr; 3661 } 3662 3663 3664 /* ------------------------------------------------------------------------ */ 3665 /* Function: ipf_flushlist */ 3666 /* Returns: int - >= 0 - number of flushed rules */ 3667 /* Parameters: softc(I) - pointer to soft context main structure */ 3668 /* nfreedp(O) - pointer to int where flush count is stored */ 3669 /* listp(I) - pointer to list to flush pointer */ 3670 /* Write Locks: ipf_mutex */ 3671 /* */ 3672 /* Recursively flush rules from the list, descending groups as they are */ 3673 /* encountered. if a rule is the head of a group and it has lost all its */ 3674 /* group members, then also delete the group reference. nfreedp is needed */ 3675 /* to store the accumulating count of rules removed, whereas the returned */ 3676 /* value is just the number removed from the current list. The latter is */ 3677 /* needed to correctly adjust reference counts on rules that define groups. */ 3678 /* */ 3679 /* NOTE: Rules not loaded from user space cannot be flushed. */ 3680 /* ------------------------------------------------------------------------ */ 3681 static int 3682 ipf_flushlist(ipf_main_softc_t *softc, int *nfreedp, frentry_t **listp) 3683 { 3684 int freed = 0; 3685 frentry_t *fp; 3686 3687 while ((fp = *listp) != NULL) { 3688 if ((fp->fr_type & FR_T_BUILTIN) || 3689 !(fp->fr_flags & FR_COPIED)) { 3690 listp = &fp->fr_next; 3691 continue; 3692 } 3693 *listp = fp->fr_next; 3694 if (fp->fr_next != NULL) 3695 fp->fr_next->fr_pnext = fp->fr_pnext; 3696 fp->fr_pnext = NULL; 3697 3698 if (fp->fr_grphead != NULL) { 3699 freed += ipf_group_flush(softc, fp->fr_grphead); 3700 fp->fr_names[fp->fr_grhead] = '\0'; 3701 } 3702 3703 if (fp->fr_icmpgrp != NULL) { 3704 freed += ipf_group_flush(softc, fp->fr_icmpgrp); 3705 fp->fr_names[fp->fr_icmphead] = '\0'; 3706 } 3707 3708 if (fp->fr_srctrack.ht_max_nodes) 3709 ipf_rb_ht_flush(&fp->fr_srctrack); 3710 3711 fp->fr_next = NULL; 3712 3713 ASSERT(fp->fr_ref > 0); 3714 if (ipf_derefrule(softc, &fp) == 0) 3715 freed++; 3716 } 3717 *nfreedp += freed; 3718 return freed; 3719 } 3720 3721 3722 /* ------------------------------------------------------------------------ */ 3723 /* Function: ipf_flush */ 3724 /* Returns: int - >= 0 - number of flushed rules */ 3725 /* Parameters: softc(I) - pointer to soft context main structure */ 3726 /* unit(I) - device for which to flush rules */ 3727 /* flags(I) - which set of rules to flush */ 3728 /* */ 3729 /* Calls flushlist() for all filter rules (accounting, firewall - both IPv4 */ 3730 /* and IPv6) as defined by the value of flags. */ 3731 /* ------------------------------------------------------------------------ */ 3732 int 3733 ipf_flush(ipf_main_softc_t *softc, minor_t unit, int flags) 3734 { 3735 int flushed = 0, set; 3736 3737 WRITE_ENTER(&softc->ipf_mutex); 3738 3739 set = softc->ipf_active; 3740 if ((flags & FR_INACTIVE) == FR_INACTIVE) 3741 set = 1 - set; 3742 3743 if (flags & FR_OUTQUE) { 3744 ipf_flushlist(softc, &flushed, &softc->ipf_rules[1][set]); 3745 ipf_flushlist(softc, &flushed, &softc->ipf_acct[1][set]); 3746 } 3747 if (flags & FR_INQUE) { 3748 ipf_flushlist(softc, &flushed, &softc->ipf_rules[0][set]); 3749 ipf_flushlist(softc, &flushed, &softc->ipf_acct[0][set]); 3750 } 3751 3752 flushed += ipf_flush_groups(softc, &softc->ipf_groups[unit][set], 3753 flags & (FR_INQUE|FR_OUTQUE)); 3754 3755 RWLOCK_EXIT(&softc->ipf_mutex); 3756 3757 if (unit == IPL_LOGIPF) { 3758 int tmp; 3759 3760 tmp = ipf_flush(softc, IPL_LOGCOUNT, flags); 3761 if (tmp >= 0) 3762 flushed += tmp; 3763 } 3764 return flushed; 3765 } 3766 3767 3768 /* ------------------------------------------------------------------------ */ 3769 /* Function: ipf_flush_groups */ 3770 /* Returns: int - >= 0 - number of flushed rules */ 3771 /* Parameters: softc(I) - soft context pointerto work with */ 3772 /* grhead(I) - pointer to the start of the group list to flush */ 3773 /* flags(I) - which set of rules to flush */ 3774 /* */ 3775 /* Walk through all of the groups under the given group head and remove all */ 3776 /* of those that match the flags passed in. The for loop here is bit more */ 3777 /* complicated than usual because the removal of a rule with ipf_derefrule */ 3778 /* may end up removing not only the structure pointed to by "fg" but also */ 3779 /* what is fg_next and fg_next after that. So if a filter rule is actually */ 3780 /* removed from the group then it is necessary to start again. */ 3781 /* ------------------------------------------------------------------------ */ 3782 static int 3783 ipf_flush_groups( ipf_main_softc_t *softc, frgroup_t **grhead, int flags) 3784 { 3785 frentry_t *fr, **frp; 3786 frgroup_t *fg, **fgp; 3787 int flushed = 0; 3788 int removed = 0; 3789 3790 for (fgp = grhead; (fg = *fgp) != NULL; ) { 3791 while ((fg != NULL) && ((fg->fg_flags & flags) == 0)) 3792 fg = fg->fg_next; 3793 if (fg == NULL) 3794 break; 3795 removed = 0; 3796 frp = &fg->fg_start; 3797 while ((removed == 0) && ((fr = *frp) != NULL)) { 3798 if ((fr->fr_flags & flags) == 0) { 3799 frp = &fr->fr_next; 3800 } else { 3801 if (fr->fr_next != NULL) 3802 fr->fr_next->fr_pnext = fr->fr_pnext; 3803 *frp = fr->fr_next; 3804 fr->fr_pnext = NULL; 3805 fr->fr_next = NULL; 3806 (void) ipf_derefrule(softc, &fr); 3807 flushed++; 3808 removed++; 3809 } 3810 } 3811 if (removed == 0) 3812 fgp = &fg->fg_next; 3813 } 3814 return flushed; 3815 } 3816 3817 3818 /* ------------------------------------------------------------------------ */ 3819 /* Function: memstr */ 3820 /* Returns: char * - NULL if failed, != NULL pointer to matching bytes */ 3821 /* Parameters: src(I) - pointer to byte sequence to match */ 3822 /* dst(I) - pointer to byte sequence to search */ 3823 /* slen(I) - match length */ 3824 /* dlen(I) - length available to search in */ 3825 /* */ 3826 /* Search dst for a sequence of bytes matching those at src and extend for */ 3827 /* slen bytes. */ 3828 /* ------------------------------------------------------------------------ */ 3829 char * 3830 memstr(const char *src, char *dst, size_t slen, size_t dlen) 3831 { 3832 char *s = NULL; 3833 3834 while (dlen >= slen) { 3835 if (memcmp(src, dst, slen) == 0) { 3836 s = dst; 3837 break; 3838 } 3839 dst++; 3840 dlen--; 3841 } 3842 return s; 3843 } 3844 3845 3846 /* ------------------------------------------------------------------------ */ 3847 /* Function: ipf_fixskip */ 3848 /* Returns: Nil */ 3849 /* Parameters: listp(IO) - pointer to start of list with skip rule */ 3850 /* rp(I) - rule added/removed with skip in it. */ 3851 /* addremove(I) - adjustment (-1/+1) to make to skip count, */ 3852 /* depending on whether a rule was just added */ 3853 /* or removed. */ 3854 /* */ 3855 /* Adjust all the rules in a list which would have skip'd past the position */ 3856 /* where we are inserting to skip to the right place given the change. */ 3857 /* ------------------------------------------------------------------------ */ 3858 void 3859 ipf_fixskip(frentry_t **listp, frentry_t *rp, int addremove) 3860 { 3861 int rules, rn; 3862 frentry_t *fp; 3863 3864 rules = 0; 3865 for (fp = *listp; (fp != NULL) && (fp != rp); fp = fp->fr_next) 3866 rules++; 3867 3868 if (!fp) 3869 return; 3870 3871 for (rn = 0, fp = *listp; fp && (fp != rp); fp = fp->fr_next, rn++) 3872 if (FR_ISSKIP(fp->fr_flags) && (rn + fp->fr_arg >= rules)) 3873 fp->fr_arg += addremove; 3874 } 3875 3876 3877 #ifdef _KERNEL 3878 /* ------------------------------------------------------------------------ */ 3879 /* Function: count4bits */ 3880 /* Returns: int - >= 0 - number of consecutive bits in input */ 3881 /* Parameters: ip(I) - 32bit IP address */ 3882 /* */ 3883 /* IPv4 ONLY */ 3884 /* count consecutive 1's in bit mask. If the mask generated by counting */ 3885 /* consecutive 1's is different to that passed, return -1, else return # */ 3886 /* of bits. */ 3887 /* ------------------------------------------------------------------------ */ 3888 int 3889 count4bits(u_32_t ip) 3890 { 3891 u_32_t ipn; 3892 int cnt = 0, i, j; 3893 3894 ip = ipn = ntohl(ip); 3895 for (i = 32; i; i--, ipn *= 2) 3896 if (ipn & 0x80000000) 3897 cnt++; 3898 else 3899 break; 3900 ipn = 0; 3901 for (i = 32, j = cnt; i; i--, j--) { 3902 ipn *= 2; 3903 if (j > 0) 3904 ipn++; 3905 } 3906 if (ipn == ip) 3907 return cnt; 3908 return -1; 3909 } 3910 3911 3912 /* ------------------------------------------------------------------------ */ 3913 /* Function: count6bits */ 3914 /* Returns: int - >= 0 - number of consecutive bits in input */ 3915 /* Parameters: msk(I) - pointer to start of IPv6 bitmask */ 3916 /* */ 3917 /* IPv6 ONLY */ 3918 /* count consecutive 1's in bit mask. */ 3919 /* ------------------------------------------------------------------------ */ 3920 # ifdef USE_INET6 3921 int 3922 count6bits(u_32_t *msk) 3923 { 3924 int i = 0, k; 3925 u_32_t j; 3926 3927 for (k = 3; k >= 0; k--) 3928 if (msk[k] == 0xffffffff) 3929 i += 32; 3930 else { 3931 for (j = msk[k]; j; j <<= 1) 3932 if (j & 0x80000000) 3933 i++; 3934 } 3935 return i; 3936 } 3937 # endif 3938 #endif /* _KERNEL */ 3939 3940 3941 /* ------------------------------------------------------------------------ */ 3942 /* Function: ipf_synclist */ 3943 /* Returns: int - 0 = no failures, else indication of first failure */ 3944 /* Parameters: fr(I) - start of filter list to sync interface names for */ 3945 /* ifp(I) - interface pointer for limiting sync lookups */ 3946 /* Write Locks: ipf_mutex */ 3947 /* */ 3948 /* Walk through a list of filter rules and resolve any interface names into */ 3949 /* pointers. Where dynamic addresses are used, also update the IP address */ 3950 /* used in the rule. The interface pointer is used to limit the lookups to */ 3951 /* a specific set of matching names if it is non-NULL. */ 3952 /* Errors can occur when resolving the destination name of to/dup-to fields */ 3953 /* when the name points to a pool and that pool doest not exist. If this */ 3954 /* does happen then it is necessary to check if there are any lookup refs */ 3955 /* that need to be dropped before returning with an error. */ 3956 /* ------------------------------------------------------------------------ */ 3957 static int 3958 ipf_synclist(ipf_main_softc_t *softc, frentry_t *fr, void *ifp) 3959 { 3960 frentry_t *frt, *start = fr; 3961 frdest_t *fdp; 3962 char *name; 3963 int error; 3964 void *ifa; 3965 int v, i; 3966 3967 error = 0; 3968 3969 for (; fr; fr = fr->fr_next) { 3970 if (fr->fr_family == AF_INET) 3971 v = 4; 3972 else if (fr->fr_family == AF_INET6) 3973 v = 6; 3974 else 3975 v = 0; 3976 3977 /* 3978 * Lookup all the interface names that are part of the rule. 3979 */ 3980 for (i = 0; i < 4; i++) { 3981 if ((ifp != NULL) && (fr->fr_ifas[i] != ifp)) 3982 continue; 3983 if (fr->fr_ifnames[i] == -1) 3984 continue; 3985 name = FR_NAME(fr, fr_ifnames[i]); 3986 fr->fr_ifas[i] = ipf_resolvenic(softc, name, v); 3987 } 3988 3989 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) { 3990 if (fr->fr_satype != FRI_NORMAL && 3991 fr->fr_satype != FRI_LOOKUP) { 3992 ifa = ipf_resolvenic(softc, fr->fr_names + 3993 fr->fr_sifpidx, v); 3994 ipf_ifpaddr(softc, v, fr->fr_satype, ifa, 3995 &fr->fr_src6, &fr->fr_smsk6); 3996 } 3997 if (fr->fr_datype != FRI_NORMAL && 3998 fr->fr_datype != FRI_LOOKUP) { 3999 ifa = ipf_resolvenic(softc, fr->fr_names + 4000 fr->fr_sifpidx, v); 4001 ipf_ifpaddr(softc, v, fr->fr_datype, ifa, 4002 &fr->fr_dst6, &fr->fr_dmsk6); 4003 } 4004 } 4005 4006 fdp = &fr->fr_tifs[0]; 4007 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) { 4008 error = ipf_resolvedest(softc, fr->fr_names, fdp, v); 4009 if (error != 0) 4010 goto unwind; 4011 } 4012 4013 fdp = &fr->fr_tifs[1]; 4014 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) { 4015 error = ipf_resolvedest(softc, fr->fr_names, fdp, v); 4016 if (error != 0) 4017 goto unwind; 4018 } 4019 4020 fdp = &fr->fr_dif; 4021 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) { 4022 error = ipf_resolvedest(softc, fr->fr_names, fdp, v); 4023 if (error != 0) 4024 goto unwind; 4025 } 4026 4027 if (((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4028 (fr->fr_satype == FRI_LOOKUP) && (fr->fr_srcptr == NULL)) { 4029 fr->fr_srcptr = ipf_lookup_res_num(softc, 4030 fr->fr_srctype, 4031 IPL_LOGIPF, 4032 fr->fr_srcnum, 4033 &fr->fr_srcfunc); 4034 } 4035 if (((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4036 (fr->fr_datype == FRI_LOOKUP) && (fr->fr_dstptr == NULL)) { 4037 fr->fr_dstptr = ipf_lookup_res_num(softc, 4038 fr->fr_dsttype, 4039 IPL_LOGIPF, 4040 fr->fr_dstnum, 4041 &fr->fr_dstfunc); 4042 } 4043 } 4044 return 0; 4045 4046 unwind: 4047 for (frt = start; frt != fr; fr = fr->fr_next) { 4048 if (((frt->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4049 (frt->fr_satype == FRI_LOOKUP) && (frt->fr_srcptr != NULL)) 4050 ipf_lookup_deref(softc, frt->fr_srctype, 4051 frt->fr_srcptr); 4052 if (((frt->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4053 (frt->fr_datype == FRI_LOOKUP) && (frt->fr_dstptr != NULL)) 4054 ipf_lookup_deref(softc, frt->fr_dsttype, 4055 frt->fr_dstptr); 4056 } 4057 return error; 4058 } 4059 4060 4061 /* ------------------------------------------------------------------------ */ 4062 /* Function: ipf_sync */ 4063 /* Returns: void */ 4064 /* Parameters: Nil */ 4065 /* */ 4066 /* ipf_sync() is called when we suspect that the interface list or */ 4067 /* information about interfaces (like IP#) has changed. Go through all */ 4068 /* filter rules, NAT entries and the state table and check if anything */ 4069 /* needs to be changed/updated. */ 4070 /* ------------------------------------------------------------------------ */ 4071 int 4072 ipf_sync(ipf_main_softc_t *softc, void *ifp) 4073 { 4074 int i; 4075 4076 # if !SOLARIS 4077 ipf_nat_sync(softc, ifp); 4078 ipf_state_sync(softc, ifp); 4079 ipf_lookup_sync(softc, ifp); 4080 # endif 4081 4082 WRITE_ENTER(&softc->ipf_mutex); 4083 (void) ipf_synclist(softc, softc->ipf_acct[0][softc->ipf_active], ifp); 4084 (void) ipf_synclist(softc, softc->ipf_acct[1][softc->ipf_active], ifp); 4085 (void) ipf_synclist(softc, softc->ipf_rules[0][softc->ipf_active], ifp); 4086 (void) ipf_synclist(softc, softc->ipf_rules[1][softc->ipf_active], ifp); 4087 4088 for (i = 0; i < IPL_LOGSIZE; i++) { 4089 frgroup_t *g; 4090 4091 for (g = softc->ipf_groups[i][0]; g != NULL; g = g->fg_next) 4092 (void) ipf_synclist(softc, g->fg_start, ifp); 4093 for (g = softc->ipf_groups[i][1]; g != NULL; g = g->fg_next) 4094 (void) ipf_synclist(softc, g->fg_start, ifp); 4095 } 4096 RWLOCK_EXIT(&softc->ipf_mutex); 4097 4098 return 0; 4099 } 4100 4101 4102 /* 4103 * In the functions below, bcopy() is called because the pointer being 4104 * copied _from_ in this instance is a pointer to a char buf (which could 4105 * end up being unaligned) and on the kernel's local stack. 4106 */ 4107 /* ------------------------------------------------------------------------ */ 4108 /* Function: copyinptr */ 4109 /* Returns: int - 0 = success, else failure */ 4110 /* Parameters: src(I) - pointer to the source address */ 4111 /* dst(I) - destination address */ 4112 /* size(I) - number of bytes to copy */ 4113 /* */ 4114 /* Copy a block of data in from user space, given a pointer to the pointer */ 4115 /* to start copying from (src) and a pointer to where to store it (dst). */ 4116 /* NB: src - pointer to user space pointer, dst - kernel space pointer */ 4117 /* ------------------------------------------------------------------------ */ 4118 int 4119 copyinptr(ipf_main_softc_t *softc, void *src, void *dst, size_t size) 4120 { 4121 void *ca; 4122 int error; 4123 4124 # if SOLARIS 4125 error = COPYIN(src, &ca, sizeof(ca)); 4126 if (error != 0) 4127 return error; 4128 # else 4129 bcopy(src, (void *)&ca, sizeof(ca)); 4130 # endif 4131 error = COPYIN(ca, dst, size); 4132 if (error != 0) { 4133 IPFERROR(3); 4134 error = EFAULT; 4135 } 4136 return error; 4137 } 4138 4139 4140 /* ------------------------------------------------------------------------ */ 4141 /* Function: copyoutptr */ 4142 /* Returns: int - 0 = success, else failure */ 4143 /* Parameters: src(I) - pointer to the source address */ 4144 /* dst(I) - destination address */ 4145 /* size(I) - number of bytes to copy */ 4146 /* */ 4147 /* Copy a block of data out to user space, given a pointer to the pointer */ 4148 /* to start copying from (src) and a pointer to where to store it (dst). */ 4149 /* NB: src - kernel space pointer, dst - pointer to user space pointer. */ 4150 /* ------------------------------------------------------------------------ */ 4151 int 4152 copyoutptr(ipf_main_softc_t *softc, void *src, void *dst, size_t size) 4153 { 4154 void *ca; 4155 int error; 4156 4157 bcopy(dst, &ca, sizeof(ca)); 4158 error = COPYOUT(src, ca, size); 4159 if (error != 0) { 4160 IPFERROR(4); 4161 error = EFAULT; 4162 } 4163 return error; 4164 } 4165 #ifdef _KERNEL 4166 #endif 4167 4168 4169 /* ------------------------------------------------------------------------ */ 4170 /* Function: ipf_lock */ 4171 /* Returns: int - 0 = success, else error */ 4172 /* Parameters: data(I) - pointer to lock value to set */ 4173 /* lockp(O) - pointer to location to store old lock value */ 4174 /* */ 4175 /* Get the new value for the lock integer, set it and return the old value */ 4176 /* in *lockp. */ 4177 /* ------------------------------------------------------------------------ */ 4178 int 4179 ipf_lock(void *data, int *lockp) 4180 { 4181 int arg, err; 4182 4183 err = BCOPYIN(data, &arg, sizeof(arg)); 4184 if (err != 0) 4185 return EFAULT; 4186 err = BCOPYOUT(lockp, data, sizeof(*lockp)); 4187 if (err != 0) 4188 return EFAULT; 4189 *lockp = arg; 4190 return 0; 4191 } 4192 4193 4194 /* ------------------------------------------------------------------------ */ 4195 /* Function: ipf_getstat */ 4196 /* Returns: Nil */ 4197 /* Parameters: softc(I) - pointer to soft context main structure */ 4198 /* fiop(I) - pointer to ipfilter stats structure */ 4199 /* rev(I) - version claim by program doing ioctl */ 4200 /* */ 4201 /* Stores a copy of current pointers, counters, etc, in the friostat */ 4202 /* structure. */ 4203 /* If IPFILTER_COMPAT is compiled, we pretend to be whatever version the */ 4204 /* program is looking for. This ensure that validation of the version it */ 4205 /* expects will always succeed. Thus kernels with IPFILTER_COMPAT will */ 4206 /* allow older binaries to work but kernels without it will not. */ 4207 /* ------------------------------------------------------------------------ */ 4208 /*ARGSUSED*/ 4209 static void 4210 ipf_getstat(ipf_main_softc_t *softc, friostat_t *fiop, int rev) 4211 { 4212 int i; 4213 4214 bcopy((char *)softc->ipf_stats, (char *)fiop->f_st, 4215 sizeof(ipf_statistics_t) * 2); 4216 fiop->f_locks[IPL_LOGSTATE] = -1; 4217 fiop->f_locks[IPL_LOGNAT] = -1; 4218 fiop->f_locks[IPL_LOGIPF] = -1; 4219 fiop->f_locks[IPL_LOGAUTH] = -1; 4220 4221 fiop->f_ipf[0][0] = softc->ipf_rules[0][0]; 4222 fiop->f_acct[0][0] = softc->ipf_acct[0][0]; 4223 fiop->f_ipf[0][1] = softc->ipf_rules[0][1]; 4224 fiop->f_acct[0][1] = softc->ipf_acct[0][1]; 4225 fiop->f_ipf[1][0] = softc->ipf_rules[1][0]; 4226 fiop->f_acct[1][0] = softc->ipf_acct[1][0]; 4227 fiop->f_ipf[1][1] = softc->ipf_rules[1][1]; 4228 fiop->f_acct[1][1] = softc->ipf_acct[1][1]; 4229 4230 fiop->f_ticks = softc->ipf_ticks; 4231 fiop->f_active = softc->ipf_active; 4232 fiop->f_froute[0] = softc->ipf_frouteok[0]; 4233 fiop->f_froute[1] = softc->ipf_frouteok[1]; 4234 fiop->f_rb_no_mem = softc->ipf_rb_no_mem; 4235 fiop->f_rb_node_max = softc->ipf_rb_node_max; 4236 4237 fiop->f_running = softc->ipf_running; 4238 for (i = 0; i < IPL_LOGSIZE; i++) { 4239 fiop->f_groups[i][0] = softc->ipf_groups[i][0]; 4240 fiop->f_groups[i][1] = softc->ipf_groups[i][1]; 4241 } 4242 #ifdef IPFILTER_LOG 4243 fiop->f_log_ok = ipf_log_logok(softc, IPL_LOGIPF); 4244 fiop->f_log_fail = ipf_log_failures(softc, IPL_LOGIPF); 4245 fiop->f_logging = 1; 4246 #else 4247 fiop->f_log_ok = 0; 4248 fiop->f_log_fail = 0; 4249 fiop->f_logging = 0; 4250 #endif 4251 fiop->f_defpass = softc->ipf_pass; 4252 fiop->f_features = ipf_features; 4253 4254 #ifdef IPFILTER_COMPAT 4255 snprintf(fiop->f_version, sizeof(fiop->f_version), 4256 "IP Filter: v%d.%d.%d", (rev / 1000000) % 100, 4257 (rev / 10000) % 100, (rev / 100) % 100); 4258 #else 4259 rev = rev; 4260 (void) strncpy(fiop->f_version, ipfilter_version, 4261 sizeof(fiop->f_version)); 4262 fiop->f_version[sizeof(fiop->f_version) - 1] = '\0'; 4263 #endif 4264 } 4265 4266 4267 #ifdef USE_INET6 4268 int icmptoicmp6types[ICMP_MAXTYPE+1] = { 4269 ICMP6_ECHO_REPLY, /* 0: ICMP_ECHOREPLY */ 4270 -1, /* 1: UNUSED */ 4271 -1, /* 2: UNUSED */ 4272 ICMP6_DST_UNREACH, /* 3: ICMP_UNREACH */ 4273 -1, /* 4: ICMP_SOURCEQUENCH */ 4274 ND_REDIRECT, /* 5: ICMP_REDIRECT */ 4275 -1, /* 6: UNUSED */ 4276 -1, /* 7: UNUSED */ 4277 ICMP6_ECHO_REQUEST, /* 8: ICMP_ECHO */ 4278 -1, /* 9: UNUSED */ 4279 -1, /* 10: UNUSED */ 4280 ICMP6_TIME_EXCEEDED, /* 11: ICMP_TIMXCEED */ 4281 ICMP6_PARAM_PROB, /* 12: ICMP_PARAMPROB */ 4282 -1, /* 13: ICMP_TSTAMP */ 4283 -1, /* 14: ICMP_TSTAMPREPLY */ 4284 -1, /* 15: ICMP_IREQ */ 4285 -1, /* 16: ICMP_IREQREPLY */ 4286 -1, /* 17: ICMP_MASKREQ */ 4287 -1, /* 18: ICMP_MASKREPLY */ 4288 }; 4289 4290 4291 int icmptoicmp6unreach[ICMP_MAX_UNREACH] = { 4292 ICMP6_DST_UNREACH_ADDR, /* 0: ICMP_UNREACH_NET */ 4293 ICMP6_DST_UNREACH_ADDR, /* 1: ICMP_UNREACH_HOST */ 4294 -1, /* 2: ICMP_UNREACH_PROTOCOL */ 4295 ICMP6_DST_UNREACH_NOPORT, /* 3: ICMP_UNREACH_PORT */ 4296 -1, /* 4: ICMP_UNREACH_NEEDFRAG */ 4297 ICMP6_DST_UNREACH_NOTNEIGHBOR, /* 5: ICMP_UNREACH_SRCFAIL */ 4298 ICMP6_DST_UNREACH_ADDR, /* 6: ICMP_UNREACH_NET_UNKNOWN */ 4299 ICMP6_DST_UNREACH_ADDR, /* 7: ICMP_UNREACH_HOST_UNKNOWN */ 4300 -1, /* 8: ICMP_UNREACH_ISOLATED */ 4301 ICMP6_DST_UNREACH_ADMIN, /* 9: ICMP_UNREACH_NET_PROHIB */ 4302 ICMP6_DST_UNREACH_ADMIN, /* 10: ICMP_UNREACH_HOST_PROHIB */ 4303 -1, /* 11: ICMP_UNREACH_TOSNET */ 4304 -1, /* 12: ICMP_UNREACH_TOSHOST */ 4305 ICMP6_DST_UNREACH_ADMIN, /* 13: ICMP_UNREACH_ADMIN_PROHIBIT */ 4306 }; 4307 int icmpreplytype6[ICMP6_MAXTYPE + 1]; 4308 #endif 4309 4310 int icmpreplytype4[ICMP_MAXTYPE + 1]; 4311 4312 4313 /* ------------------------------------------------------------------------ */ 4314 /* Function: ipf_matchicmpqueryreply */ 4315 /* Returns: int - 1 if "icmp" is a valid reply to "ic" else 0. */ 4316 /* Parameters: v(I) - IP protocol version (4 or 6) */ 4317 /* ic(I) - ICMP information */ 4318 /* icmp(I) - ICMP packet header */ 4319 /* rev(I) - direction (0 = forward/1 = reverse) of packet */ 4320 /* */ 4321 /* Check if the ICMP packet defined by the header pointed to by icmp is a */ 4322 /* reply to one as described by what's in ic. If it is a match, return 1, */ 4323 /* else return 0 for no match. */ 4324 /* ------------------------------------------------------------------------ */ 4325 int 4326 ipf_matchicmpqueryreply(int v, icmpinfo_t *ic, icmphdr_t *icmp, int rev) 4327 { 4328 int ictype; 4329 4330 ictype = ic->ici_type; 4331 4332 if (v == 4) { 4333 /* 4334 * If we matched its type on the way in, then when going out 4335 * it will still be the same type. 4336 */ 4337 if ((!rev && (icmp->icmp_type == ictype)) || 4338 (rev && (icmpreplytype4[ictype] == icmp->icmp_type))) { 4339 if (icmp->icmp_type != ICMP_ECHOREPLY) 4340 return 1; 4341 if (icmp->icmp_id == ic->ici_id) 4342 return 1; 4343 } 4344 } 4345 #ifdef USE_INET6 4346 else if (v == 6) { 4347 if ((!rev && (icmp->icmp_type == ictype)) || 4348 (rev && (icmpreplytype6[ictype] == icmp->icmp_type))) { 4349 if (icmp->icmp_type != ICMP6_ECHO_REPLY) 4350 return 1; 4351 if (icmp->icmp_id == ic->ici_id) 4352 return 1; 4353 } 4354 } 4355 #endif 4356 return 0; 4357 } 4358 4359 /* ------------------------------------------------------------------------ */ 4360 /* Function: ipf_rule_compare */ 4361 /* Parameters: fr1(I) - first rule structure to compare */ 4362 /* fr2(I) - second rule structure to compare */ 4363 /* Returns: int - 0 == rules are the same, else mismatch */ 4364 /* */ 4365 /* Compare two rules and return 0 if they match or a number indicating */ 4366 /* which of the individual checks failed. */ 4367 /* ------------------------------------------------------------------------ */ 4368 static int 4369 ipf_rule_compare(frentry_t *fr1, frentry_t *fr2) 4370 { 4371 if (fr1->fr_cksum != fr2->fr_cksum) 4372 return 1; 4373 if (fr1->fr_size != fr2->fr_size) 4374 return 2; 4375 if (fr1->fr_dsize != fr2->fr_dsize) 4376 return 3; 4377 if (memcmp(&fr1->fr_func, &fr2->fr_func, 4378 fr1->fr_size - offsetof(struct frentry, fr_func)) != 0) 4379 return 4; 4380 if (fr1->fr_data && !fr2->fr_data) 4381 return 5; 4382 if (!fr1->fr_data && fr2->fr_data) 4383 return 6; 4384 if (fr1->fr_data) { 4385 if (memcmp(fr1->fr_caddr, fr2->fr_caddr, fr1->fr_dsize)) 4386 return 7; 4387 } 4388 return 0; 4389 } 4390 4391 4392 /* ------------------------------------------------------------------------ */ 4393 /* Function: frrequest */ 4394 /* Returns: int - 0 == success, > 0 == errno value */ 4395 /* Parameters: unit(I) - device for which this is for */ 4396 /* req(I) - ioctl command (SIOC*) */ 4397 /* data(I) - pointr to ioctl data */ 4398 /* set(I) - 1 or 0 (filter set) */ 4399 /* makecopy(I) - flag indicating whether data points to a rule */ 4400 /* in kernel space & hence doesn't need copying. */ 4401 /* */ 4402 /* This function handles all the requests which operate on the list of */ 4403 /* filter rules. This includes adding, deleting, insertion. It is also */ 4404 /* responsible for creating groups when a "head" rule is loaded. Interface */ 4405 /* names are resolved here and other sanity checks are made on the content */ 4406 /* of the rule structure being loaded. If a rule has user defined timeouts */ 4407 /* then make sure they are created and initialised before exiting. */ 4408 /* ------------------------------------------------------------------------ */ 4409 int 4410 frrequest(ipf_main_softc_t *softc, int unit, ioctlcmd_t req, void *data, 4411 int set, int makecopy) 4412 { 4413 int error = 0, in, family, addrem, need_free = 0; 4414 frentry_t frd, *fp, *f, **fprev, **ftail; 4415 void *ptr, *uptr; 4416 u_int *p, *pp; 4417 frgroup_t *fg; 4418 char *group; 4419 4420 ptr = NULL; 4421 fg = NULL; 4422 fp = &frd; 4423 if (makecopy != 0) { 4424 bzero(fp, sizeof(frd)); 4425 error = ipf_inobj(softc, data, NULL, fp, IPFOBJ_FRENTRY); 4426 if (error) { 4427 return error; 4428 } 4429 if ((fp->fr_type & FR_T_BUILTIN) != 0) { 4430 IPFERROR(6); 4431 return EINVAL; 4432 } 4433 KMALLOCS(f, frentry_t *, fp->fr_size); 4434 if (f == NULL) { 4435 IPFERROR(131); 4436 return ENOMEM; 4437 } 4438 bzero(f, fp->fr_size); 4439 error = ipf_inobjsz(softc, data, f, IPFOBJ_FRENTRY, 4440 fp->fr_size); 4441 if (error) { 4442 KFREES(f, fp->fr_size); 4443 return error; 4444 } 4445 4446 fp = f; 4447 f = NULL; 4448 fp->fr_next = NULL; 4449 fp->fr_dnext = NULL; 4450 fp->fr_pnext = NULL; 4451 fp->fr_pdnext = NULL; 4452 fp->fr_grp = NULL; 4453 fp->fr_grphead = NULL; 4454 fp->fr_icmpgrp = NULL; 4455 fp->fr_isc = (void *)-1; 4456 fp->fr_ptr = NULL; 4457 fp->fr_ref = 0; 4458 fp->fr_flags |= FR_COPIED; 4459 } else { 4460 fp = (frentry_t *)data; 4461 if ((fp->fr_type & FR_T_BUILTIN) == 0) { 4462 IPFERROR(7); 4463 return EINVAL; 4464 } 4465 fp->fr_flags &= ~FR_COPIED; 4466 } 4467 4468 if (((fp->fr_dsize == 0) && (fp->fr_data != NULL)) || 4469 ((fp->fr_dsize != 0) && (fp->fr_data == NULL))) { 4470 IPFERROR(8); 4471 error = EINVAL; 4472 goto donenolock; 4473 } 4474 4475 family = fp->fr_family; 4476 uptr = fp->fr_data; 4477 4478 if (req == (ioctlcmd_t)SIOCINAFR || req == (ioctlcmd_t)SIOCINIFR || 4479 req == (ioctlcmd_t)SIOCADAFR || req == (ioctlcmd_t)SIOCADIFR) 4480 addrem = 0; 4481 else if (req == (ioctlcmd_t)SIOCRMAFR || req == (ioctlcmd_t)SIOCRMIFR) 4482 addrem = 1; 4483 else if (req == (ioctlcmd_t)SIOCZRLST) 4484 addrem = 2; 4485 else { 4486 IPFERROR(9); 4487 error = EINVAL; 4488 goto donenolock; 4489 } 4490 4491 /* 4492 * Only filter rules for IPv4 or IPv6 are accepted. 4493 */ 4494 if (family == AF_INET) { 4495 /*EMPTY*/; 4496 #ifdef USE_INET6 4497 } else if (family == AF_INET6) { 4498 /*EMPTY*/; 4499 #endif 4500 } else if (family != 0) { 4501 IPFERROR(10); 4502 error = EINVAL; 4503 goto donenolock; 4504 } 4505 4506 /* 4507 * If the rule is being loaded from user space, i.e. we had to copy it 4508 * into kernel space, then do not trust the function pointer in the 4509 * rule. 4510 */ 4511 if ((makecopy == 1) && (fp->fr_func != NULL)) { 4512 if (ipf_findfunc(fp->fr_func) == NULL) { 4513 IPFERROR(11); 4514 error = ESRCH; 4515 goto donenolock; 4516 } 4517 4518 if (addrem == 0) { 4519 error = ipf_funcinit(softc, fp); 4520 if (error != 0) 4521 goto donenolock; 4522 } 4523 } 4524 if ((fp->fr_flags & FR_CALLNOW) && 4525 ((fp->fr_func == NULL) || (fp->fr_func == (ipfunc_t)-1))) { 4526 IPFERROR(142); 4527 error = ESRCH; 4528 goto donenolock; 4529 } 4530 if (((fp->fr_flags & FR_CMDMASK) == FR_CALL) && 4531 ((fp->fr_func == NULL) || (fp->fr_func == (ipfunc_t)-1))) { 4532 IPFERROR(143); 4533 error = ESRCH; 4534 goto donenolock; 4535 } 4536 4537 ptr = NULL; 4538 4539 if (FR_ISACCOUNT(fp->fr_flags)) 4540 unit = IPL_LOGCOUNT; 4541 4542 /* 4543 * Check that each group name in the rule has a start index that 4544 * is valid. 4545 */ 4546 if (fp->fr_icmphead != -1) { 4547 if ((fp->fr_icmphead < 0) || 4548 (fp->fr_icmphead >= fp->fr_namelen)) { 4549 IPFERROR(136); 4550 error = EINVAL; 4551 goto donenolock; 4552 } 4553 if (!strcmp(FR_NAME(fp, fr_icmphead), "0")) 4554 fp->fr_names[fp->fr_icmphead] = '\0'; 4555 } 4556 4557 if (fp->fr_grhead != -1) { 4558 if ((fp->fr_grhead < 0) || 4559 (fp->fr_grhead >= fp->fr_namelen)) { 4560 IPFERROR(137); 4561 error = EINVAL; 4562 goto donenolock; 4563 } 4564 if (!strcmp(FR_NAME(fp, fr_grhead), "0")) 4565 fp->fr_names[fp->fr_grhead] = '\0'; 4566 } 4567 4568 if (fp->fr_group != -1) { 4569 if ((fp->fr_group < 0) || 4570 (fp->fr_group >= fp->fr_namelen)) { 4571 IPFERROR(138); 4572 error = EINVAL; 4573 goto donenolock; 4574 } 4575 if ((req != (int)SIOCZRLST) && (fp->fr_group != -1)) { 4576 /* 4577 * Allow loading rules that are in groups to cause 4578 * them to be created if they don't already exit. 4579 */ 4580 group = FR_NAME(fp, fr_group); 4581 if (addrem == 0) { 4582 fg = ipf_group_add(softc, group, NULL, 4583 fp->fr_flags, unit, set); 4584 if (fg == NULL) { 4585 IPFERROR(152); 4586 error = ESRCH; 4587 goto donenolock; 4588 } 4589 fp->fr_grp = fg; 4590 } else { 4591 fg = ipf_findgroup(softc, group, unit, 4592 set, NULL); 4593 if (fg == NULL) { 4594 IPFERROR(12); 4595 error = ESRCH; 4596 goto donenolock; 4597 } 4598 } 4599 4600 if (fg->fg_flags == 0) { 4601 fg->fg_flags = fp->fr_flags & FR_INOUT; 4602 } else if (fg->fg_flags != (fp->fr_flags & FR_INOUT)) { 4603 IPFERROR(13); 4604 error = ESRCH; 4605 goto donenolock; 4606 } 4607 } 4608 } else { 4609 /* 4610 * If a rule is going to be part of a group then it does 4611 * not matter whether it is an in or out rule, but if it 4612 * isn't in a group, then it does... 4613 */ 4614 if ((fp->fr_flags & (FR_INQUE|FR_OUTQUE)) == 0) { 4615 IPFERROR(14); 4616 error = EINVAL; 4617 goto donenolock; 4618 } 4619 } 4620 in = (fp->fr_flags & FR_INQUE) ? 0 : 1; 4621 4622 /* 4623 * Work out which rule list this change is being applied to. 4624 */ 4625 ftail = NULL; 4626 fprev = NULL; 4627 if (unit == IPL_LOGAUTH) { 4628 if ((fp->fr_tifs[0].fd_ptr != NULL) || 4629 (fp->fr_tifs[1].fd_ptr != NULL) || 4630 (fp->fr_dif.fd_ptr != NULL) || 4631 (fp->fr_flags & FR_FASTROUTE)) { 4632 IPFERROR(145); 4633 error = EINVAL; 4634 goto donenolock; 4635 } 4636 fprev = ipf_auth_rulehead(softc); 4637 } else { 4638 if (FR_ISACCOUNT(fp->fr_flags)) 4639 fprev = &softc->ipf_acct[in][set]; 4640 else if ((fp->fr_flags & (FR_OUTQUE|FR_INQUE)) != 0) 4641 fprev = &softc->ipf_rules[in][set]; 4642 } 4643 if (fprev == NULL) { 4644 IPFERROR(15); 4645 error = ESRCH; 4646 goto donenolock; 4647 } 4648 4649 if (fg != NULL) 4650 fprev = &fg->fg_start; 4651 4652 /* 4653 * Copy in extra data for the rule. 4654 */ 4655 if (fp->fr_dsize != 0) { 4656 if (makecopy != 0) { 4657 KMALLOCS(ptr, void *, fp->fr_dsize); 4658 if (ptr == NULL) { 4659 IPFERROR(16); 4660 error = ENOMEM; 4661 goto donenolock; 4662 } 4663 4664 /* 4665 * The bcopy case is for when the data is appended 4666 * to the rule by ipf_in_compat(). 4667 */ 4668 if (uptr >= (void *)fp && 4669 uptr < (void *)((char *)fp + fp->fr_size)) { 4670 bcopy(uptr, ptr, fp->fr_dsize); 4671 error = 0; 4672 } else { 4673 error = COPYIN(uptr, ptr, fp->fr_dsize); 4674 if (error != 0) { 4675 IPFERROR(17); 4676 error = EFAULT; 4677 goto donenolock; 4678 } 4679 } 4680 } else { 4681 ptr = uptr; 4682 } 4683 fp->fr_data = ptr; 4684 } else { 4685 fp->fr_data = NULL; 4686 } 4687 4688 /* 4689 * Perform per-rule type sanity checks of their members. 4690 * All code after this needs to be aware that allocated memory 4691 * may need to be free'd before exiting. 4692 */ 4693 switch (fp->fr_type & ~FR_T_BUILTIN) 4694 { 4695 #if defined(IPFILTER_BPF) 4696 case FR_T_BPFOPC : 4697 if (fp->fr_dsize == 0) { 4698 IPFERROR(19); 4699 error = EINVAL; 4700 break; 4701 } 4702 if (!bpf_validate(ptr, fp->fr_dsize/sizeof(struct bpf_insn))) { 4703 IPFERROR(20); 4704 error = EINVAL; 4705 break; 4706 } 4707 break; 4708 #endif 4709 case FR_T_IPF : 4710 /* 4711 * Preparation for error case at the bottom of this function. 4712 */ 4713 if (fp->fr_datype == FRI_LOOKUP) 4714 fp->fr_dstptr = NULL; 4715 if (fp->fr_satype == FRI_LOOKUP) 4716 fp->fr_srcptr = NULL; 4717 4718 if (fp->fr_dsize != sizeof(fripf_t)) { 4719 IPFERROR(21); 4720 error = EINVAL; 4721 break; 4722 } 4723 4724 /* 4725 * Allowing a rule with both "keep state" and "with oow" is 4726 * pointless because adding a state entry to the table will 4727 * fail with the out of window (oow) flag set. 4728 */ 4729 if ((fp->fr_flags & FR_KEEPSTATE) && (fp->fr_flx & FI_OOW)) { 4730 IPFERROR(22); 4731 error = EINVAL; 4732 break; 4733 } 4734 4735 switch (fp->fr_satype) 4736 { 4737 case FRI_BROADCAST : 4738 case FRI_DYNAMIC : 4739 case FRI_NETWORK : 4740 case FRI_NETMASKED : 4741 case FRI_PEERADDR : 4742 if (fp->fr_sifpidx < 0) { 4743 IPFERROR(23); 4744 error = EINVAL; 4745 } 4746 break; 4747 case FRI_LOOKUP : 4748 fp->fr_srcptr = ipf_findlookup(softc, unit, fp, 4749 &fp->fr_src6, 4750 &fp->fr_smsk6); 4751 if (fp->fr_srcfunc == NULL) { 4752 IPFERROR(132); 4753 error = ESRCH; 4754 break; 4755 } 4756 break; 4757 case FRI_NORMAL : 4758 break; 4759 default : 4760 IPFERROR(133); 4761 error = EINVAL; 4762 break; 4763 } 4764 if (error != 0) 4765 break; 4766 4767 switch (fp->fr_datype) 4768 { 4769 case FRI_BROADCAST : 4770 case FRI_DYNAMIC : 4771 case FRI_NETWORK : 4772 case FRI_NETMASKED : 4773 case FRI_PEERADDR : 4774 if (fp->fr_difpidx < 0) { 4775 IPFERROR(24); 4776 error = EINVAL; 4777 } 4778 break; 4779 case FRI_LOOKUP : 4780 fp->fr_dstptr = ipf_findlookup(softc, unit, fp, 4781 &fp->fr_dst6, 4782 &fp->fr_dmsk6); 4783 if (fp->fr_dstfunc == NULL) { 4784 IPFERROR(134); 4785 error = ESRCH; 4786 } 4787 break; 4788 case FRI_NORMAL : 4789 break; 4790 default : 4791 IPFERROR(135); 4792 error = EINVAL; 4793 } 4794 break; 4795 4796 case FR_T_NONE : 4797 case FR_T_CALLFUNC : 4798 case FR_T_COMPIPF : 4799 break; 4800 4801 case FR_T_IPFEXPR : 4802 if (ipf_matcharray_verify(fp->fr_data, fp->fr_dsize) == -1) { 4803 IPFERROR(25); 4804 error = EINVAL; 4805 } 4806 break; 4807 4808 default : 4809 IPFERROR(26); 4810 error = EINVAL; 4811 break; 4812 } 4813 if (error != 0) 4814 goto donenolock; 4815 4816 if (fp->fr_tif.fd_name != -1) { 4817 if ((fp->fr_tif.fd_name < 0) || 4818 (fp->fr_tif.fd_name >= fp->fr_namelen)) { 4819 IPFERROR(139); 4820 error = EINVAL; 4821 goto donenolock; 4822 } 4823 } 4824 4825 if (fp->fr_dif.fd_name != -1) { 4826 if ((fp->fr_dif.fd_name < 0) || 4827 (fp->fr_dif.fd_name >= fp->fr_namelen)) { 4828 IPFERROR(140); 4829 error = EINVAL; 4830 goto donenolock; 4831 } 4832 } 4833 4834 if (fp->fr_rif.fd_name != -1) { 4835 if ((fp->fr_rif.fd_name < 0) || 4836 (fp->fr_rif.fd_name >= fp->fr_namelen)) { 4837 IPFERROR(141); 4838 error = EINVAL; 4839 goto donenolock; 4840 } 4841 } 4842 4843 /* 4844 * Lookup all the interface names that are part of the rule. 4845 */ 4846 error = ipf_synclist(softc, fp, NULL); 4847 if (error != 0) 4848 goto donenolock; 4849 fp->fr_statecnt = 0; 4850 if (fp->fr_srctrack.ht_max_nodes != 0) 4851 ipf_rb_ht_init(&fp->fr_srctrack); 4852 4853 /* 4854 * Look for an existing matching filter rule, but don't include the 4855 * next or interface pointer in the comparison (fr_next, fr_ifa). 4856 * This elminates rules which are indentical being loaded. Checksum 4857 * the constant part of the filter rule to make comparisons quicker 4858 * (this meaning no pointers are included). 4859 */ 4860 for (fp->fr_cksum = 0, p = (u_int *)&fp->fr_func, pp = &fp->fr_cksum; 4861 p < pp; p++) 4862 fp->fr_cksum += *p; 4863 pp = (u_int *)((char *)fp->fr_caddr + fp->fr_dsize); 4864 for (p = (u_int *)fp->fr_data; p < pp; p++) 4865 fp->fr_cksum += *p; 4866 4867 WRITE_ENTER(&softc->ipf_mutex); 4868 4869 /* 4870 * Now that the filter rule lists are locked, we can walk the 4871 * chain of them without fear. 4872 */ 4873 ftail = fprev; 4874 for (f = *ftail; (f = *ftail) != NULL; ftail = &f->fr_next) { 4875 if (fp->fr_collect <= f->fr_collect) { 4876 ftail = fprev; 4877 f = NULL; 4878 break; 4879 } 4880 fprev = ftail; 4881 } 4882 4883 for (; (f = *ftail) != NULL; ftail = &f->fr_next) { 4884 DT2(rule_cmp, frentry_t *, fp, frentry_t *, f); 4885 if (ipf_rule_compare(fp, f) == 0) 4886 break; 4887 } 4888 4889 /* 4890 * If zero'ing statistics, copy current to caller and zero. 4891 */ 4892 if (addrem == 2) { 4893 if (f == NULL) { 4894 IPFERROR(27); 4895 error = ESRCH; 4896 } else { 4897 /* 4898 * Copy and reduce lock because of impending copyout. 4899 * Well we should, but if we do then the atomicity of 4900 * this call and the correctness of fr_hits and 4901 * fr_bytes cannot be guaranteed. As it is, this code 4902 * only resets them to 0 if they are successfully 4903 * copied out into user space. 4904 */ 4905 bcopy((char *)f, (char *)fp, f->fr_size); 4906 /* MUTEX_DOWNGRADE(&softc->ipf_mutex); */ 4907 4908 /* 4909 * When we copy this rule back out, set the data 4910 * pointer to be what it was in user space. 4911 */ 4912 fp->fr_data = uptr; 4913 error = ipf_outobj(softc, data, fp, IPFOBJ_FRENTRY); 4914 4915 if (error == 0) { 4916 if ((f->fr_dsize != 0) && (uptr != NULL)) { 4917 error = COPYOUT(f->fr_data, uptr, 4918 f->fr_dsize); 4919 if (error != 0) { 4920 IPFERROR(28); 4921 error = EFAULT; 4922 } 4923 } 4924 if (error == 0) { 4925 f->fr_hits = 0; 4926 f->fr_bytes = 0; 4927 } 4928 } 4929 } 4930 4931 if (makecopy != 0) { 4932 if (ptr != NULL) { 4933 KFREES(ptr, fp->fr_dsize); 4934 } 4935 KFREES(fp, fp->fr_size); 4936 } 4937 RWLOCK_EXIT(&softc->ipf_mutex); 4938 return error; 4939 } 4940 4941 if (!f) { 4942 /* 4943 * At the end of this, ftail must point to the place where the 4944 * new rule is to be saved/inserted/added. 4945 * For SIOCAD*FR, this should be the last rule in the group of 4946 * rules that have equal fr_collect fields. 4947 * For SIOCIN*FR, ... 4948 */ 4949 if (req == (ioctlcmd_t)SIOCADAFR || 4950 req == (ioctlcmd_t)SIOCADIFR) { 4951 4952 for (ftail = fprev; (f = *ftail) != NULL; ) { 4953 if (f->fr_collect > fp->fr_collect) 4954 break; 4955 ftail = &f->fr_next; 4956 fprev = ftail; 4957 } 4958 ftail = fprev; 4959 f = NULL; 4960 ptr = NULL; 4961 } else if (req == (ioctlcmd_t)SIOCINAFR || 4962 req == (ioctlcmd_t)SIOCINIFR) { 4963 while ((f = *fprev) != NULL) { 4964 if (f->fr_collect >= fp->fr_collect) 4965 break; 4966 fprev = &f->fr_next; 4967 } 4968 ftail = fprev; 4969 if (fp->fr_hits != 0) { 4970 while (fp->fr_hits && (f = *ftail)) { 4971 if (f->fr_collect != fp->fr_collect) 4972 break; 4973 fprev = ftail; 4974 ftail = &f->fr_next; 4975 fp->fr_hits--; 4976 } 4977 } 4978 f = NULL; 4979 ptr = NULL; 4980 } 4981 } 4982 4983 /* 4984 * Request to remove a rule. 4985 */ 4986 if (addrem == 1) { 4987 if (!f) { 4988 IPFERROR(29); 4989 error = ESRCH; 4990 } else { 4991 /* 4992 * Do not allow activity from user space to interfere 4993 * with rules not loaded that way. 4994 */ 4995 if ((makecopy == 1) && !(f->fr_flags & FR_COPIED)) { 4996 IPFERROR(30); 4997 error = EPERM; 4998 goto done; 4999 } 5000 5001 /* 5002 * Return EBUSY if the rule is being reference by 5003 * something else (eg state information.) 5004 */ 5005 if (f->fr_ref > 1) { 5006 IPFERROR(31); 5007 error = EBUSY; 5008 goto done; 5009 } 5010 #ifdef IPFILTER_SCAN 5011 if (f->fr_isctag != -1 && 5012 (f->fr_isc != (struct ipscan *)-1)) 5013 ipf_scan_detachfr(f); 5014 #endif 5015 5016 if (unit == IPL_LOGAUTH) { 5017 error = ipf_auth_precmd(softc, req, f, ftail); 5018 goto done; 5019 } 5020 5021 ipf_rule_delete(softc, f, unit, set); 5022 5023 need_free = makecopy; 5024 } 5025 } else { 5026 /* 5027 * Not removing, so we must be adding/inserting a rule. 5028 */ 5029 if (f != NULL) { 5030 IPFERROR(32); 5031 error = EEXIST; 5032 goto done; 5033 } 5034 if (unit == IPL_LOGAUTH) { 5035 error = ipf_auth_precmd(softc, req, fp, ftail); 5036 goto done; 5037 } 5038 5039 MUTEX_NUKE(&fp->fr_lock); 5040 MUTEX_INIT(&fp->fr_lock, "filter rule lock"); 5041 if (fp->fr_die != 0) 5042 ipf_rule_expire_insert(softc, fp, set); 5043 5044 fp->fr_hits = 0; 5045 if (makecopy != 0) 5046 fp->fr_ref = 1; 5047 fp->fr_pnext = ftail; 5048 fp->fr_next = *ftail; 5049 if (fp->fr_next != NULL) 5050 fp->fr_next->fr_pnext = &fp->fr_next; 5051 *ftail = fp; 5052 if (addrem == 0) 5053 ipf_fixskip(ftail, fp, 1); 5054 5055 fp->fr_icmpgrp = NULL; 5056 if (fp->fr_icmphead != -1) { 5057 group = FR_NAME(fp, fr_icmphead); 5058 fg = ipf_group_add(softc, group, fp, 0, unit, set); 5059 fp->fr_icmpgrp = fg; 5060 } 5061 5062 fp->fr_grphead = NULL; 5063 if (fp->fr_grhead != -1) { 5064 group = FR_NAME(fp, fr_grhead); 5065 fg = ipf_group_add(softc, group, fp, fp->fr_flags, 5066 unit, set); 5067 fp->fr_grphead = fg; 5068 } 5069 } 5070 done: 5071 RWLOCK_EXIT(&softc->ipf_mutex); 5072 donenolock: 5073 if (need_free || (error != 0)) { 5074 if ((fp->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) { 5075 if ((fp->fr_satype == FRI_LOOKUP) && 5076 (fp->fr_srcptr != NULL)) 5077 ipf_lookup_deref(softc, fp->fr_srctype, 5078 fp->fr_srcptr); 5079 if ((fp->fr_datype == FRI_LOOKUP) && 5080 (fp->fr_dstptr != NULL)) 5081 ipf_lookup_deref(softc, fp->fr_dsttype, 5082 fp->fr_dstptr); 5083 } 5084 if (fp->fr_grp != NULL) { 5085 WRITE_ENTER(&softc->ipf_mutex); 5086 ipf_group_del(softc, fp->fr_grp, fp); 5087 RWLOCK_EXIT(&softc->ipf_mutex); 5088 } 5089 if ((ptr != NULL) && (makecopy != 0)) { 5090 KFREES(ptr, fp->fr_dsize); 5091 } 5092 KFREES(fp, fp->fr_size); 5093 } 5094 return (error); 5095 } 5096 5097 5098 /* ------------------------------------------------------------------------ */ 5099 /* Function: ipf_rule_delete */ 5100 /* Returns: Nil */ 5101 /* Parameters: softc(I) - pointer to soft context main structure */ 5102 /* f(I) - pointer to the rule being deleted */ 5103 /* ftail(I) - pointer to the pointer to f */ 5104 /* unit(I) - device for which this is for */ 5105 /* set(I) - 1 or 0 (filter set) */ 5106 /* */ 5107 /* This function attempts to do what it can to delete a filter rule: remove */ 5108 /* it from any linked lists and remove any groups it is responsible for. */ 5109 /* But in the end, removing a rule can only drop the reference count - we */ 5110 /* must use that as the guide for whether or not it can be freed. */ 5111 /* ------------------------------------------------------------------------ */ 5112 static void 5113 ipf_rule_delete(ipf_main_softc_t *softc, frentry_t *f, int unit, int set) 5114 { 5115 5116 /* 5117 * If fr_pdnext is set, then the rule is on the expire list, so 5118 * remove it from there. 5119 */ 5120 if (f->fr_pdnext != NULL) { 5121 *f->fr_pdnext = f->fr_dnext; 5122 if (f->fr_dnext != NULL) 5123 f->fr_dnext->fr_pdnext = f->fr_pdnext; 5124 f->fr_pdnext = NULL; 5125 f->fr_dnext = NULL; 5126 } 5127 5128 ipf_fixskip(f->fr_pnext, f, -1); 5129 if (f->fr_pnext != NULL) 5130 *f->fr_pnext = f->fr_next; 5131 if (f->fr_next != NULL) 5132 f->fr_next->fr_pnext = f->fr_pnext; 5133 f->fr_pnext = NULL; 5134 f->fr_next = NULL; 5135 5136 (void) ipf_derefrule(softc, &f); 5137 } 5138 5139 /* ------------------------------------------------------------------------ */ 5140 /* Function: ipf_rule_expire_insert */ 5141 /* Returns: Nil */ 5142 /* Parameters: softc(I) - pointer to soft context main structure */ 5143 /* f(I) - pointer to rule to be added to expire list */ 5144 /* set(I) - 1 or 0 (filter set) */ 5145 /* */ 5146 /* If the new rule has a given expiration time, insert it into the list of */ 5147 /* expiring rules with the ones to be removed first added to the front of */ 5148 /* the list. The insertion is O(n) but it is kept sorted for quick scans at */ 5149 /* expiration interval checks. */ 5150 /* ------------------------------------------------------------------------ */ 5151 static void 5152 ipf_rule_expire_insert(ipf_main_softc_t *softc, frentry_t *f, int set) 5153 { 5154 frentry_t *fr; 5155 5156 /* 5157 */ 5158 5159 f->fr_die = softc->ipf_ticks + IPF_TTLVAL(f->fr_die); 5160 for (fr = softc->ipf_rule_explist[set]; fr != NULL; 5161 fr = fr->fr_dnext) { 5162 if (f->fr_die < fr->fr_die) 5163 break; 5164 if (fr->fr_dnext == NULL) { 5165 /* 5166 * We've got to the last rule and everything 5167 * wanted to be expired before this new node, 5168 * so we have to tack it on the end... 5169 */ 5170 fr->fr_dnext = f; 5171 f->fr_pdnext = &fr->fr_dnext; 5172 fr = NULL; 5173 break; 5174 } 5175 } 5176 5177 if (softc->ipf_rule_explist[set] == NULL) { 5178 softc->ipf_rule_explist[set] = f; 5179 f->fr_pdnext = &softc->ipf_rule_explist[set]; 5180 } else if (fr != NULL) { 5181 f->fr_dnext = fr; 5182 f->fr_pdnext = fr->fr_pdnext; 5183 fr->fr_pdnext = &f->fr_dnext; 5184 } 5185 } 5186 5187 5188 /* ------------------------------------------------------------------------ */ 5189 /* Function: ipf_findlookup */ 5190 /* Returns: NULL = failure, else success */ 5191 /* Parameters: softc(I) - pointer to soft context main structure */ 5192 /* unit(I) - ipf device we want to find match for */ 5193 /* fp(I) - rule for which lookup is for */ 5194 /* addrp(I) - pointer to lookup information in address struct */ 5195 /* maskp(O) - pointer to lookup information for storage */ 5196 /* */ 5197 /* When using pools and hash tables to store addresses for matching in */ 5198 /* rules, it is necessary to resolve both the object referred to by the */ 5199 /* name or address (and return that pointer) and also provide the means by */ 5200 /* which to determine if an address belongs to that object to make the */ 5201 /* packet matching quicker. */ 5202 /* ------------------------------------------------------------------------ */ 5203 static void * 5204 ipf_findlookup(ipf_main_softc_t *softc, int unit, frentry_t *fr, 5205 i6addr_t *addrp, i6addr_t *maskp) 5206 { 5207 void *ptr = NULL; 5208 5209 switch (addrp->iplookupsubtype) 5210 { 5211 case 0 : 5212 ptr = ipf_lookup_res_num(softc, unit, addrp->iplookuptype, 5213 addrp->iplookupnum, 5214 &maskp->iplookupfunc); 5215 break; 5216 case 1 : 5217 if (addrp->iplookupname < 0) 5218 break; 5219 if (addrp->iplookupname >= fr->fr_namelen) 5220 break; 5221 ptr = ipf_lookup_res_name(softc, unit, addrp->iplookuptype, 5222 fr->fr_names + addrp->iplookupname, 5223 &maskp->iplookupfunc); 5224 break; 5225 default : 5226 break; 5227 } 5228 5229 return ptr; 5230 } 5231 5232 5233 /* ------------------------------------------------------------------------ */ 5234 /* Function: ipf_funcinit */ 5235 /* Returns: int - 0 == success, else ESRCH: cannot resolve rule details */ 5236 /* Parameters: softc(I) - pointer to soft context main structure */ 5237 /* fr(I) - pointer to filter rule */ 5238 /* */ 5239 /* If a rule is a call rule, then check if the function it points to needs */ 5240 /* an init function to be called now the rule has been loaded. */ 5241 /* ------------------------------------------------------------------------ */ 5242 static int 5243 ipf_funcinit(ipf_main_softc_t *softc, frentry_t *fr) 5244 { 5245 ipfunc_resolve_t *ft; 5246 int err; 5247 5248 IPFERROR(34); 5249 err = ESRCH; 5250 5251 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5252 if (ft->ipfu_addr == fr->fr_func) { 5253 err = 0; 5254 if (ft->ipfu_init != NULL) 5255 err = (*ft->ipfu_init)(softc, fr); 5256 break; 5257 } 5258 return err; 5259 } 5260 5261 5262 /* ------------------------------------------------------------------------ */ 5263 /* Function: ipf_funcfini */ 5264 /* Returns: Nil */ 5265 /* Parameters: softc(I) - pointer to soft context main structure */ 5266 /* fr(I) - pointer to filter rule */ 5267 /* */ 5268 /* For a given filter rule, call the matching "fini" function if the rule */ 5269 /* is using a known function that would have resulted in the "init" being */ 5270 /* called for ealier. */ 5271 /* ------------------------------------------------------------------------ */ 5272 static void 5273 ipf_funcfini(ipf_main_softc_t *softc, frentry_t *fr) 5274 { 5275 ipfunc_resolve_t *ft; 5276 5277 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5278 if (ft->ipfu_addr == fr->fr_func) { 5279 if (ft->ipfu_fini != NULL) 5280 (void) (*ft->ipfu_fini)(softc, fr); 5281 break; 5282 } 5283 } 5284 5285 5286 /* ------------------------------------------------------------------------ */ 5287 /* Function: ipf_findfunc */ 5288 /* Returns: ipfunc_t - pointer to function if found, else NULL */ 5289 /* Parameters: funcptr(I) - function pointer to lookup */ 5290 /* */ 5291 /* Look for a function in the table of known functions. */ 5292 /* ------------------------------------------------------------------------ */ 5293 static ipfunc_t 5294 ipf_findfunc(ipfunc_t funcptr) 5295 { 5296 ipfunc_resolve_t *ft; 5297 5298 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5299 if (ft->ipfu_addr == funcptr) 5300 return funcptr; 5301 return NULL; 5302 } 5303 5304 5305 /* ------------------------------------------------------------------------ */ 5306 /* Function: ipf_resolvefunc */ 5307 /* Returns: int - 0 == success, else error */ 5308 /* Parameters: data(IO) - ioctl data pointer to ipfunc_resolve_t struct */ 5309 /* */ 5310 /* Copy in a ipfunc_resolve_t structure and then fill in the missing field. */ 5311 /* This will either be the function name (if the pointer is set) or the */ 5312 /* function pointer if the name is set. When found, fill in the other one */ 5313 /* so that the entire, complete, structure can be copied back to user space.*/ 5314 /* ------------------------------------------------------------------------ */ 5315 int 5316 ipf_resolvefunc(ipf_main_softc_t *softc, void *data) 5317 { 5318 ipfunc_resolve_t res, *ft; 5319 int error; 5320 5321 error = BCOPYIN(data, &res, sizeof(res)); 5322 if (error != 0) { 5323 IPFERROR(123); 5324 return EFAULT; 5325 } 5326 5327 if (res.ipfu_addr == NULL && res.ipfu_name[0] != '\0') { 5328 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5329 if (strncmp(res.ipfu_name, ft->ipfu_name, 5330 sizeof(res.ipfu_name)) == 0) { 5331 res.ipfu_addr = ft->ipfu_addr; 5332 res.ipfu_init = ft->ipfu_init; 5333 if (COPYOUT(&res, data, sizeof(res)) != 0) { 5334 IPFERROR(35); 5335 return EFAULT; 5336 } 5337 return 0; 5338 } 5339 } 5340 if (res.ipfu_addr != NULL && res.ipfu_name[0] == '\0') { 5341 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5342 if (ft->ipfu_addr == res.ipfu_addr) { 5343 (void) strncpy(res.ipfu_name, ft->ipfu_name, 5344 sizeof(res.ipfu_name)); 5345 res.ipfu_init = ft->ipfu_init; 5346 if (COPYOUT(&res, data, sizeof(res)) != 0) { 5347 IPFERROR(36); 5348 return EFAULT; 5349 } 5350 return 0; 5351 } 5352 } 5353 IPFERROR(37); 5354 return ESRCH; 5355 } 5356 5357 5358 #if !defined(_KERNEL) || (!defined(__NetBSD__) && !defined(__OpenBSD__) && \ 5359 !defined(__FreeBSD__)) || \ 5360 FREEBSD_LT_REV(501000) || NETBSD_LT_REV(105000000) || \ 5361 OPENBSD_LT_REV(200006) 5362 /* 5363 * From: NetBSD 5364 * ppsratecheck(): packets (or events) per second limitation. 5365 */ 5366 int 5367 ppsratecheck(lasttime, curpps, maxpps) 5368 struct timeval *lasttime; 5369 int *curpps; 5370 int maxpps; /* maximum pps allowed */ 5371 { 5372 struct timeval tv, delta; 5373 int rv; 5374 5375 GETKTIME(&tv); 5376 5377 delta.tv_sec = tv.tv_sec - lasttime->tv_sec; 5378 delta.tv_usec = tv.tv_usec - lasttime->tv_usec; 5379 if (delta.tv_usec < 0) { 5380 delta.tv_sec--; 5381 delta.tv_usec += 1000000; 5382 } 5383 5384 /* 5385 * check for 0,0 is so that the message will be seen at least once. 5386 * if more than one second have passed since the last update of 5387 * lasttime, reset the counter. 5388 * 5389 * we do increment *curpps even in *curpps < maxpps case, as some may 5390 * try to use *curpps for stat purposes as well. 5391 */ 5392 if ((lasttime->tv_sec == 0 && lasttime->tv_usec == 0) || 5393 delta.tv_sec >= 1) { 5394 *lasttime = tv; 5395 *curpps = 0; 5396 rv = 1; 5397 } else if (maxpps < 0) 5398 rv = 1; 5399 else if (*curpps < maxpps) 5400 rv = 1; 5401 else 5402 rv = 0; 5403 *curpps = *curpps + 1; 5404 5405 return (rv); 5406 } 5407 #endif 5408 5409 5410 /* ------------------------------------------------------------------------ */ 5411 /* Function: ipf_derefrule */ 5412 /* Returns: int - 0 == rule freed up, else rule not freed */ 5413 /* Parameters: fr(I) - pointer to filter rule */ 5414 /* */ 5415 /* Decrement the reference counter to a rule by one. If it reaches zero, */ 5416 /* free it and any associated storage space being used by it. */ 5417 /* ------------------------------------------------------------------------ */ 5418 int 5419 ipf_derefrule(ipf_main_softc_t *softc, frentry_t **frp) 5420 { 5421 frentry_t *fr; 5422 frdest_t *fdp; 5423 5424 fr = *frp; 5425 *frp = NULL; 5426 5427 MUTEX_ENTER(&fr->fr_lock); 5428 fr->fr_ref--; 5429 if (fr->fr_ref == 0) { 5430 MUTEX_EXIT(&fr->fr_lock); 5431 MUTEX_DESTROY(&fr->fr_lock); 5432 5433 ipf_funcfini(softc, fr); 5434 5435 fdp = &fr->fr_tif; 5436 if (fdp->fd_type == FRD_DSTLIST) 5437 ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr); 5438 5439 fdp = &fr->fr_rif; 5440 if (fdp->fd_type == FRD_DSTLIST) 5441 ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr); 5442 5443 fdp = &fr->fr_dif; 5444 if (fdp->fd_type == FRD_DSTLIST) 5445 ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr); 5446 5447 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF && 5448 fr->fr_satype == FRI_LOOKUP) 5449 ipf_lookup_deref(softc, fr->fr_srctype, fr->fr_srcptr); 5450 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF && 5451 fr->fr_datype == FRI_LOOKUP) 5452 ipf_lookup_deref(softc, fr->fr_dsttype, fr->fr_dstptr); 5453 5454 if (fr->fr_grp != NULL) 5455 ipf_group_del(softc, fr->fr_grp, fr); 5456 5457 if (fr->fr_grphead != NULL) 5458 ipf_group_del(softc, fr->fr_grphead, fr); 5459 5460 if (fr->fr_icmpgrp != NULL) 5461 ipf_group_del(softc, fr->fr_icmpgrp, fr); 5462 5463 if ((fr->fr_flags & FR_COPIED) != 0) { 5464 if (fr->fr_dsize) { 5465 KFREES(fr->fr_data, fr->fr_dsize); 5466 } 5467 KFREES(fr, fr->fr_size); 5468 return 0; 5469 } 5470 return 1; 5471 } else { 5472 MUTEX_EXIT(&fr->fr_lock); 5473 } 5474 return -1; 5475 } 5476 5477 5478 /* ------------------------------------------------------------------------ */ 5479 /* Function: ipf_grpmapinit */ 5480 /* Returns: int - 0 == success, else ESRCH because table entry not found*/ 5481 /* Parameters: fr(I) - pointer to rule to find hash table for */ 5482 /* */ 5483 /* Looks for group hash table fr_arg and stores a pointer to it in fr_ptr. */ 5484 /* fr_ptr is later used by ipf_srcgrpmap and ipf_dstgrpmap. */ 5485 /* ------------------------------------------------------------------------ */ 5486 static int 5487 ipf_grpmapinit(ipf_main_softc_t *softc, frentry_t *fr) 5488 { 5489 char name[FR_GROUPLEN]; 5490 iphtable_t *iph; 5491 5492 (void) snprintf(name, sizeof(name), "%d", fr->fr_arg); 5493 iph = ipf_lookup_find_htable(softc, IPL_LOGIPF, name); 5494 if (iph == NULL) { 5495 IPFERROR(38); 5496 return ESRCH; 5497 } 5498 if ((iph->iph_flags & FR_INOUT) != (fr->fr_flags & FR_INOUT)) { 5499 IPFERROR(39); 5500 return ESRCH; 5501 } 5502 iph->iph_ref++; 5503 fr->fr_ptr = iph; 5504 return 0; 5505 } 5506 5507 5508 /* ------------------------------------------------------------------------ */ 5509 /* Function: ipf_grpmapfini */ 5510 /* Returns: int - 0 == success, else ESRCH because table entry not found*/ 5511 /* Parameters: softc(I) - pointer to soft context main structure */ 5512 /* fr(I) - pointer to rule to release hash table for */ 5513 /* */ 5514 /* For rules that have had ipf_grpmapinit called, ipf_lookup_deref needs to */ 5515 /* be called to undo what ipf_grpmapinit caused to be done. */ 5516 /* ------------------------------------------------------------------------ */ 5517 static int 5518 ipf_grpmapfini(ipf_main_softc_t *softc, frentry_t *fr) 5519 { 5520 iphtable_t *iph; 5521 iph = fr->fr_ptr; 5522 if (iph != NULL) 5523 ipf_lookup_deref(softc, IPLT_HASH, iph); 5524 return 0; 5525 } 5526 5527 5528 /* ------------------------------------------------------------------------ */ 5529 /* Function: ipf_srcgrpmap */ 5530 /* Returns: frentry_t * - pointer to "new last matching" rule or NULL */ 5531 /* Parameters: fin(I) - pointer to packet information */ 5532 /* passp(IO) - pointer to current/new filter decision (unused) */ 5533 /* */ 5534 /* Look for a rule group head in a hash table, using the source address as */ 5535 /* the key, and descend into that group and continue matching rules against */ 5536 /* the packet. */ 5537 /* ------------------------------------------------------------------------ */ 5538 frentry_t * 5539 ipf_srcgrpmap(fr_info_t *fin, u_32_t *passp) 5540 { 5541 frgroup_t *fg; 5542 void *rval; 5543 5544 rval = ipf_iphmfindgroup(fin->fin_main_soft, fin->fin_fr->fr_ptr, 5545 &fin->fin_src); 5546 if (rval == NULL) 5547 return NULL; 5548 5549 fg = rval; 5550 fin->fin_fr = fg->fg_start; 5551 (void) ipf_scanlist(fin, *passp); 5552 return fin->fin_fr; 5553 } 5554 5555 5556 /* ------------------------------------------------------------------------ */ 5557 /* Function: ipf_dstgrpmap */ 5558 /* Returns: frentry_t * - pointer to "new last matching" rule or NULL */ 5559 /* Parameters: fin(I) - pointer to packet information */ 5560 /* passp(IO) - pointer to current/new filter decision (unused) */ 5561 /* */ 5562 /* Look for a rule group head in a hash table, using the destination */ 5563 /* address as the key, and descend into that group and continue matching */ 5564 /* rules against the packet. */ 5565 /* ------------------------------------------------------------------------ */ 5566 frentry_t * 5567 ipf_dstgrpmap(fr_info_t *fin, u_32_t *passp) 5568 { 5569 frgroup_t *fg; 5570 void *rval; 5571 5572 rval = ipf_iphmfindgroup(fin->fin_main_soft, fin->fin_fr->fr_ptr, 5573 &fin->fin_dst); 5574 if (rval == NULL) 5575 return NULL; 5576 5577 fg = rval; 5578 fin->fin_fr = fg->fg_start; 5579 (void) ipf_scanlist(fin, *passp); 5580 return fin->fin_fr; 5581 } 5582 5583 /* 5584 * Queue functions 5585 * =============== 5586 * These functions manage objects on queues for efficient timeouts. There 5587 * are a number of system defined queues as well as user defined timeouts. 5588 * It is expected that a lock is held in the domain in which the queue 5589 * belongs (i.e. either state or NAT) when calling any of these functions 5590 * that prevents ipf_freetimeoutqueue() from being called at the same time 5591 * as any other. 5592 */ 5593 5594 5595 /* ------------------------------------------------------------------------ */ 5596 /* Function: ipf_addtimeoutqueue */ 5597 /* Returns: struct ifqtq * - NULL if malloc fails, else pointer to */ 5598 /* timeout queue with given interval. */ 5599 /* Parameters: parent(I) - pointer to pointer to parent node of this list */ 5600 /* of interface queues. */ 5601 /* seconds(I) - timeout value in seconds for this queue. */ 5602 /* */ 5603 /* This routine first looks for a timeout queue that matches the interval */ 5604 /* being requested. If it finds one, increments the reference counter and */ 5605 /* returns a pointer to it. If none are found, it allocates a new one and */ 5606 /* inserts it at the top of the list. */ 5607 /* */ 5608 /* Locking. */ 5609 /* It is assumed that the caller of this function has an appropriate lock */ 5610 /* held (exclusively) in the domain that encompases 'parent'. */ 5611 /* ------------------------------------------------------------------------ */ 5612 ipftq_t * 5613 ipf_addtimeoutqueue(ipf_main_softc_t *softc, ipftq_t **parent, u_int seconds) 5614 { 5615 ipftq_t *ifq; 5616 u_int period; 5617 5618 period = seconds * IPF_HZ_DIVIDE; 5619 5620 MUTEX_ENTER(&softc->ipf_timeoutlock); 5621 for (ifq = *parent; ifq != NULL; ifq = ifq->ifq_next) { 5622 if (ifq->ifq_ttl == period) { 5623 /* 5624 * Reset the delete flag, if set, so the structure 5625 * gets reused rather than freed and reallocated. 5626 */ 5627 MUTEX_ENTER(&ifq->ifq_lock); 5628 ifq->ifq_flags &= ~IFQF_DELETE; 5629 ifq->ifq_ref++; 5630 MUTEX_EXIT(&ifq->ifq_lock); 5631 MUTEX_EXIT(&softc->ipf_timeoutlock); 5632 5633 return ifq; 5634 } 5635 } 5636 5637 KMALLOC(ifq, ipftq_t *); 5638 if (ifq != NULL) { 5639 MUTEX_NUKE(&ifq->ifq_lock); 5640 IPFTQ_INIT(ifq, period, "ipftq mutex"); 5641 ifq->ifq_next = *parent; 5642 ifq->ifq_pnext = parent; 5643 ifq->ifq_flags = IFQF_USER; 5644 ifq->ifq_ref++; 5645 *parent = ifq; 5646 softc->ipf_userifqs++; 5647 } 5648 MUTEX_EXIT(&softc->ipf_timeoutlock); 5649 return ifq; 5650 } 5651 5652 5653 /* ------------------------------------------------------------------------ */ 5654 /* Function: ipf_deletetimeoutqueue */ 5655 /* Returns: int - new reference count value of the timeout queue */ 5656 /* Parameters: ifq(I) - timeout queue which is losing a reference. */ 5657 /* Locks: ifq->ifq_lock */ 5658 /* */ 5659 /* This routine must be called when we're discarding a pointer to a timeout */ 5660 /* queue object, taking care of the reference counter. */ 5661 /* */ 5662 /* Now that this just sets a DELETE flag, it requires the expire code to */ 5663 /* check the list of user defined timeout queues and call the free function */ 5664 /* below (currently commented out) to stop memory leaking. It is done this */ 5665 /* way because the locking may not be sufficient to safely do a free when */ 5666 /* this function is called. */ 5667 /* ------------------------------------------------------------------------ */ 5668 int 5669 ipf_deletetimeoutqueue(ipftq_t *ifq) 5670 { 5671 5672 ifq->ifq_ref--; 5673 if ((ifq->ifq_ref == 0) && ((ifq->ifq_flags & IFQF_USER) != 0)) { 5674 ifq->ifq_flags |= IFQF_DELETE; 5675 } 5676 5677 return ifq->ifq_ref; 5678 } 5679 5680 5681 /* ------------------------------------------------------------------------ */ 5682 /* Function: ipf_freetimeoutqueue */ 5683 /* Parameters: ifq(I) - timeout queue which is losing a reference. */ 5684 /* Returns: Nil */ 5685 /* */ 5686 /* Locking: */ 5687 /* It is assumed that the caller of this function has an appropriate lock */ 5688 /* held (exclusively) in the domain that encompases the callers "domain". */ 5689 /* The ifq_lock for this structure should not be held. */ 5690 /* */ 5691 /* Remove a user defined timeout queue from the list of queues it is in and */ 5692 /* tidy up after this is done. */ 5693 /* ------------------------------------------------------------------------ */ 5694 void 5695 ipf_freetimeoutqueue(ipf_main_softc_t *softc, ipftq_t *ifq) 5696 { 5697 5698 if (((ifq->ifq_flags & IFQF_DELETE) == 0) || (ifq->ifq_ref != 0) || 5699 ((ifq->ifq_flags & IFQF_USER) == 0)) { 5700 printf("ipf_freetimeoutqueue(%lx) flags 0x%x ttl %d ref %d\n", 5701 (u_long)ifq, ifq->ifq_flags, ifq->ifq_ttl, 5702 ifq->ifq_ref); 5703 return; 5704 } 5705 5706 /* 5707 * Remove from its position in the list. 5708 */ 5709 *ifq->ifq_pnext = ifq->ifq_next; 5710 if (ifq->ifq_next != NULL) 5711 ifq->ifq_next->ifq_pnext = ifq->ifq_pnext; 5712 ifq->ifq_next = NULL; 5713 ifq->ifq_pnext = NULL; 5714 5715 MUTEX_DESTROY(&ifq->ifq_lock); 5716 ATOMIC_DEC(softc->ipf_userifqs); 5717 KFREE(ifq); 5718 } 5719 5720 5721 /* ------------------------------------------------------------------------ */ 5722 /* Function: ipf_deletequeueentry */ 5723 /* Returns: Nil */ 5724 /* Parameters: tqe(I) - timeout queue entry to delete */ 5725 /* */ 5726 /* Remove a tail queue entry from its queue and make it an orphan. */ 5727 /* ipf_deletetimeoutqueue is called to make sure the reference count on the */ 5728 /* queue is correct. We can't, however, call ipf_freetimeoutqueue because */ 5729 /* the correct lock(s) may not be held that would make it safe to do so. */ 5730 /* ------------------------------------------------------------------------ */ 5731 void 5732 ipf_deletequeueentry(ipftqent_t *tqe) 5733 { 5734 ipftq_t *ifq; 5735 5736 ifq = tqe->tqe_ifq; 5737 5738 MUTEX_ENTER(&ifq->ifq_lock); 5739 5740 if (tqe->tqe_pnext != NULL) { 5741 *tqe->tqe_pnext = tqe->tqe_next; 5742 if (tqe->tqe_next != NULL) 5743 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5744 else /* we must be the tail anyway */ 5745 ifq->ifq_tail = tqe->tqe_pnext; 5746 5747 tqe->tqe_pnext = NULL; 5748 tqe->tqe_ifq = NULL; 5749 } 5750 5751 (void) ipf_deletetimeoutqueue(ifq); 5752 ASSERT(ifq->ifq_ref > 0); 5753 5754 MUTEX_EXIT(&ifq->ifq_lock); 5755 } 5756 5757 5758 /* ------------------------------------------------------------------------ */ 5759 /* Function: ipf_queuefront */ 5760 /* Returns: Nil */ 5761 /* Parameters: tqe(I) - pointer to timeout queue entry */ 5762 /* */ 5763 /* Move a queue entry to the front of the queue, if it isn't already there. */ 5764 /* ------------------------------------------------------------------------ */ 5765 void 5766 ipf_queuefront(ipftqent_t *tqe) 5767 { 5768 ipftq_t *ifq; 5769 5770 ifq = tqe->tqe_ifq; 5771 if (ifq == NULL) 5772 return; 5773 5774 MUTEX_ENTER(&ifq->ifq_lock); 5775 if (ifq->ifq_head != tqe) { 5776 *tqe->tqe_pnext = tqe->tqe_next; 5777 if (tqe->tqe_next) 5778 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5779 else 5780 ifq->ifq_tail = tqe->tqe_pnext; 5781 5782 tqe->tqe_next = ifq->ifq_head; 5783 ifq->ifq_head->tqe_pnext = &tqe->tqe_next; 5784 ifq->ifq_head = tqe; 5785 tqe->tqe_pnext = &ifq->ifq_head; 5786 } 5787 MUTEX_EXIT(&ifq->ifq_lock); 5788 } 5789 5790 5791 /* ------------------------------------------------------------------------ */ 5792 /* Function: ipf_queueback */ 5793 /* Returns: Nil */ 5794 /* Parameters: ticks(I) - ipf tick time to use with this call */ 5795 /* tqe(I) - pointer to timeout queue entry */ 5796 /* */ 5797 /* Move a queue entry to the back of the queue, if it isn't already there. */ 5798 /* We use use ticks to calculate the expiration and mark for when we last */ 5799 /* touched the structure. */ 5800 /* ------------------------------------------------------------------------ */ 5801 void 5802 ipf_queueback(u_long ticks, ipftqent_t *tqe) 5803 { 5804 ipftq_t *ifq; 5805 5806 ifq = tqe->tqe_ifq; 5807 if (ifq == NULL) 5808 return; 5809 tqe->tqe_die = ticks + ifq->ifq_ttl; 5810 tqe->tqe_touched = ticks; 5811 5812 MUTEX_ENTER(&ifq->ifq_lock); 5813 if (tqe->tqe_next != NULL) { /* at the end already ? */ 5814 /* 5815 * Remove from list 5816 */ 5817 *tqe->tqe_pnext = tqe->tqe_next; 5818 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5819 5820 /* 5821 * Make it the last entry. 5822 */ 5823 tqe->tqe_next = NULL; 5824 tqe->tqe_pnext = ifq->ifq_tail; 5825 *ifq->ifq_tail = tqe; 5826 ifq->ifq_tail = &tqe->tqe_next; 5827 } 5828 MUTEX_EXIT(&ifq->ifq_lock); 5829 } 5830 5831 5832 /* ------------------------------------------------------------------------ */ 5833 /* Function: ipf_queueappend */ 5834 /* Returns: Nil */ 5835 /* Parameters: ticks(I) - ipf tick time to use with this call */ 5836 /* tqe(I) - pointer to timeout queue entry */ 5837 /* ifq(I) - pointer to timeout queue */ 5838 /* parent(I) - owing object pointer */ 5839 /* */ 5840 /* Add a new item to this queue and put it on the very end. */ 5841 /* We use use ticks to calculate the expiration and mark for when we last */ 5842 /* touched the structure. */ 5843 /* ------------------------------------------------------------------------ */ 5844 void 5845 ipf_queueappend(u_long ticks, ipftqent_t *tqe, ipftq_t *ifq, void *parent) 5846 { 5847 5848 MUTEX_ENTER(&ifq->ifq_lock); 5849 tqe->tqe_parent = parent; 5850 tqe->tqe_pnext = ifq->ifq_tail; 5851 *ifq->ifq_tail = tqe; 5852 ifq->ifq_tail = &tqe->tqe_next; 5853 tqe->tqe_next = NULL; 5854 tqe->tqe_ifq = ifq; 5855 tqe->tqe_die = ticks + ifq->ifq_ttl; 5856 tqe->tqe_touched = ticks; 5857 ifq->ifq_ref++; 5858 MUTEX_EXIT(&ifq->ifq_lock); 5859 } 5860 5861 5862 /* ------------------------------------------------------------------------ */ 5863 /* Function: ipf_movequeue */ 5864 /* Returns: Nil */ 5865 /* Parameters: tq(I) - pointer to timeout queue information */ 5866 /* oifp(I) - old timeout queue entry was on */ 5867 /* nifp(I) - new timeout queue to put entry on */ 5868 /* */ 5869 /* Move a queue entry from one timeout queue to another timeout queue. */ 5870 /* If it notices that the current entry is already last and does not need */ 5871 /* to move queue, the return. */ 5872 /* ------------------------------------------------------------------------ */ 5873 void 5874 ipf_movequeue(u_long ticks, ipftqent_t *tqe, ipftq_t *oifq, ipftq_t *nifq) 5875 { 5876 5877 /* 5878 * If the queue hasn't changed and we last touched this entry at the 5879 * same ipf time, then we're not going to achieve anything by either 5880 * changing the ttl or moving it on the queue. 5881 */ 5882 if (oifq == nifq && tqe->tqe_touched == ticks) 5883 return; 5884 5885 /* 5886 * For any of this to be outside the lock, there is a risk that two 5887 * packets entering simultaneously, with one changing to a different 5888 * queue and one not, could end up with things in a bizarre state. 5889 */ 5890 MUTEX_ENTER(&oifq->ifq_lock); 5891 5892 tqe->tqe_touched = ticks; 5893 tqe->tqe_die = ticks + nifq->ifq_ttl; 5894 /* 5895 * Is the operation here going to be a no-op ? 5896 */ 5897 if (oifq == nifq) { 5898 if ((tqe->tqe_next == NULL) || 5899 (tqe->tqe_next->tqe_die == tqe->tqe_die)) { 5900 MUTEX_EXIT(&oifq->ifq_lock); 5901 return; 5902 } 5903 } 5904 5905 /* 5906 * Remove from the old queue 5907 */ 5908 *tqe->tqe_pnext = tqe->tqe_next; 5909 if (tqe->tqe_next) 5910 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5911 else 5912 oifq->ifq_tail = tqe->tqe_pnext; 5913 tqe->tqe_next = NULL; 5914 5915 /* 5916 * If we're moving from one queue to another, release the 5917 * lock on the old queue and get a lock on the new queue. 5918 * For user defined queues, if we're moving off it, call 5919 * delete in case it can now be freed. 5920 */ 5921 if (oifq != nifq) { 5922 tqe->tqe_ifq = NULL; 5923 5924 (void) ipf_deletetimeoutqueue(oifq); 5925 5926 MUTEX_EXIT(&oifq->ifq_lock); 5927 5928 MUTEX_ENTER(&nifq->ifq_lock); 5929 5930 tqe->tqe_ifq = nifq; 5931 nifq->ifq_ref++; 5932 } 5933 5934 /* 5935 * Add to the bottom of the new queue 5936 */ 5937 tqe->tqe_pnext = nifq->ifq_tail; 5938 *nifq->ifq_tail = tqe; 5939 nifq->ifq_tail = &tqe->tqe_next; 5940 MUTEX_EXIT(&nifq->ifq_lock); 5941 } 5942 5943 5944 /* ------------------------------------------------------------------------ */ 5945 /* Function: ipf_updateipid */ 5946 /* Returns: int - 0 == success, -1 == error (packet should be dropped) */ 5947 /* Parameters: fin(I) - pointer to packet information */ 5948 /* */ 5949 /* When we are doing NAT, change the IP of every packet to represent a */ 5950 /* single sequence of packets coming from the host, hiding any host */ 5951 /* specific sequencing that might otherwise be revealed. If the packet is */ 5952 /* a fragment, then store the 'new' IPid in the fragment cache and look up */ 5953 /* the fragment cache for non-leading fragments. If a non-leading fragment */ 5954 /* has no match in the cache, return an error. */ 5955 /* ------------------------------------------------------------------------ */ 5956 static int 5957 ipf_updateipid(fr_info_t *fin) 5958 { 5959 u_short id, ido, sums; 5960 u_32_t sumd, sum; 5961 ip_t *ip; 5962 5963 if (fin->fin_off != 0) { 5964 sum = ipf_frag_ipidknown(fin); 5965 if (sum == 0xffffffff) 5966 return -1; 5967 sum &= 0xffff; 5968 id = (u_short)sum; 5969 } else { 5970 id = ipf_nextipid(fin); 5971 if (fin->fin_off == 0 && (fin->fin_flx & FI_FRAG) != 0) 5972 (void) ipf_frag_ipidnew(fin, (u_32_t)id); 5973 } 5974 5975 ip = fin->fin_ip; 5976 ido = ntohs(ip->ip_id); 5977 if (id == ido) 5978 return 0; 5979 ip->ip_id = htons(id); 5980 CALC_SUMD(ido, id, sumd); /* DESTRUCTIVE MACRO! id,ido change */ 5981 sum = (~ntohs(ip->ip_sum)) & 0xffff; 5982 sum += sumd; 5983 sum = (sum >> 16) + (sum & 0xffff); 5984 sum = (sum >> 16) + (sum & 0xffff); 5985 sums = ~(u_short)sum; 5986 ip->ip_sum = htons(sums); 5987 return 0; 5988 } 5989 5990 5991 #ifdef NEED_FRGETIFNAME 5992 /* ------------------------------------------------------------------------ */ 5993 /* Function: ipf_getifname */ 5994 /* Returns: char * - pointer to interface name */ 5995 /* Parameters: ifp(I) - pointer to network interface */ 5996 /* buffer(O) - pointer to where to store interface name */ 5997 /* */ 5998 /* Constructs an interface name in the buffer passed. The buffer passed is */ 5999 /* expected to be at least LIFNAMSIZ in bytes big. If buffer is passed in */ 6000 /* as a NULL pointer then return a pointer to a static array. */ 6001 /* ------------------------------------------------------------------------ */ 6002 char * 6003 ipf_getifname(ifp, buffer) 6004 struct ifnet *ifp; 6005 char *buffer; 6006 { 6007 static char namebuf[LIFNAMSIZ]; 6008 # if defined(MENTAT) || defined(__FreeBSD__) || defined(__osf__) || \ 6009 defined(__sgi) || defined(linux) || defined(_AIX51) || \ 6010 (defined(sun) && !defined(__SVR4) && !defined(__svr4__)) 6011 int unit, space; 6012 char temp[20]; 6013 char *s; 6014 # endif 6015 6016 if (buffer == NULL) 6017 buffer = namebuf; 6018 (void) strncpy(buffer, ifp->if_name, LIFNAMSIZ); 6019 buffer[LIFNAMSIZ - 1] = '\0'; 6020 # if defined(MENTAT) || defined(__FreeBSD__) || defined(__osf__) || \ 6021 defined(__sgi) || defined(_AIX51) || \ 6022 (defined(sun) && !defined(__SVR4) && !defined(__svr4__)) 6023 for (s = buffer; *s; s++) 6024 ; 6025 unit = ifp->if_unit; 6026 space = LIFNAMSIZ - (s - buffer); 6027 if ((space > 0) && (unit >= 0)) { 6028 snprintf(temp, sizeof(temp), "%d", unit); 6029 (void) strncpy(s, temp, space); 6030 s[space - 1] = '\0'; 6031 } 6032 # endif 6033 return buffer; 6034 } 6035 #endif 6036 6037 6038 /* ------------------------------------------------------------------------ */ 6039 /* Function: ipf_ioctlswitch */ 6040 /* Returns: int - -1 continue processing, else ioctl return value */ 6041 /* Parameters: unit(I) - device unit opened */ 6042 /* data(I) - pointer to ioctl data */ 6043 /* cmd(I) - ioctl command */ 6044 /* mode(I) - mode value */ 6045 /* uid(I) - uid making the ioctl call */ 6046 /* ctx(I) - pointer to context data */ 6047 /* */ 6048 /* Based on the value of unit, call the appropriate ioctl handler or return */ 6049 /* EIO if ipfilter is not running. Also checks if write perms are req'd */ 6050 /* for the device in order to execute the ioctl. A special case is made */ 6051 /* SIOCIPFINTERROR so that the same code isn't required in every handler. */ 6052 /* The context data pointer is passed through as this is used as the key */ 6053 /* for locating a matching token for continued access for walking lists, */ 6054 /* etc. */ 6055 /* ------------------------------------------------------------------------ */ 6056 int 6057 ipf_ioctlswitch(ipf_main_softc_t *softc, int unit, void *data, ioctlcmd_t cmd, 6058 int mode, int uid, void *ctx) 6059 { 6060 int error = 0; 6061 6062 switch (cmd) 6063 { 6064 case SIOCIPFINTERROR : 6065 error = BCOPYOUT(&softc->ipf_interror, data, 6066 sizeof(softc->ipf_interror)); 6067 if (error != 0) { 6068 IPFERROR(40); 6069 error = EFAULT; 6070 } 6071 return error; 6072 default : 6073 break; 6074 } 6075 6076 switch (unit) 6077 { 6078 case IPL_LOGIPF : 6079 error = ipf_ipf_ioctl(softc, data, cmd, mode, uid, ctx); 6080 break; 6081 case IPL_LOGNAT : 6082 if (softc->ipf_running > 0) { 6083 error = ipf_nat_ioctl(softc, data, cmd, mode, 6084 uid, ctx); 6085 } else { 6086 IPFERROR(42); 6087 error = EIO; 6088 } 6089 break; 6090 case IPL_LOGSTATE : 6091 if (softc->ipf_running > 0) { 6092 error = ipf_state_ioctl(softc, data, cmd, mode, 6093 uid, ctx); 6094 } else { 6095 IPFERROR(43); 6096 error = EIO; 6097 } 6098 break; 6099 case IPL_LOGAUTH : 6100 if (softc->ipf_running > 0) { 6101 error = ipf_auth_ioctl(softc, data, cmd, mode, 6102 uid, ctx); 6103 } else { 6104 IPFERROR(44); 6105 error = EIO; 6106 } 6107 break; 6108 case IPL_LOGSYNC : 6109 if (softc->ipf_running > 0) { 6110 error = ipf_sync_ioctl(softc, data, cmd, mode, 6111 uid, ctx); 6112 } else { 6113 error = EIO; 6114 IPFERROR(45); 6115 } 6116 break; 6117 case IPL_LOGSCAN : 6118 #ifdef IPFILTER_SCAN 6119 if (softc->ipf_running > 0) 6120 error = ipf_scan_ioctl(softc, data, cmd, mode, 6121 uid, ctx); 6122 else 6123 #endif 6124 { 6125 error = EIO; 6126 IPFERROR(46); 6127 } 6128 break; 6129 case IPL_LOGLOOKUP : 6130 if (softc->ipf_running > 0) { 6131 error = ipf_lookup_ioctl(softc, data, cmd, mode, 6132 uid, ctx); 6133 } else { 6134 error = EIO; 6135 IPFERROR(47); 6136 } 6137 break; 6138 default : 6139 IPFERROR(48); 6140 error = EIO; 6141 break; 6142 } 6143 6144 return error; 6145 } 6146 6147 6148 /* 6149 * This array defines the expected size of objects coming into the kernel 6150 * for the various recognised object types. The first column is flags (see 6151 * below), 2nd column is current size, 3rd column is the version number of 6152 * when the current size became current. 6153 * Flags: 6154 * 1 = minimum size, not absolute size 6155 */ 6156 static int ipf_objbytes[IPFOBJ_COUNT][3] = { 6157 { 1, sizeof(struct frentry), 5010000 }, /* 0 */ 6158 { 1, sizeof(struct friostat), 5010000 }, 6159 { 0, sizeof(struct fr_info), 5010000 }, 6160 { 0, sizeof(struct ipf_authstat), 4010100 }, 6161 { 0, sizeof(struct ipfrstat), 5010000 }, 6162 { 1, sizeof(struct ipnat), 5010000 }, /* 5 */ 6163 { 0, sizeof(struct natstat), 5010000 }, 6164 { 0, sizeof(struct ipstate_save), 5010000 }, 6165 { 1, sizeof(struct nat_save), 5010000 }, 6166 { 0, sizeof(struct natlookup), 5010000 }, 6167 { 1, sizeof(struct ipstate), 5010000 }, /* 10 */ 6168 { 0, sizeof(struct ips_stat), 5010000 }, 6169 { 0, sizeof(struct frauth), 5010000 }, 6170 { 0, sizeof(struct ipftune), 4010100 }, 6171 { 0, sizeof(struct nat), 5010000 }, 6172 { 0, sizeof(struct ipfruleiter), 4011400 }, /* 15 */ 6173 { 0, sizeof(struct ipfgeniter), 4011400 }, 6174 { 0, sizeof(struct ipftable), 4011400 }, 6175 { 0, sizeof(struct ipflookupiter), 4011400 }, 6176 { 0, sizeof(struct ipftq) * IPF_TCP_NSTATES }, 6177 { 1, 0, 0 }, /* IPFEXPR */ 6178 { 0, 0, 0 }, /* PROXYCTL */ 6179 { 0, sizeof (struct fripf), 5010000 } 6180 }; 6181 6182 6183 /* ------------------------------------------------------------------------ */ 6184 /* Function: ipf_inobj */ 6185 /* Returns: int - 0 = success, else failure */ 6186 /* Parameters: softc(I) - soft context pointerto work with */ 6187 /* data(I) - pointer to ioctl data */ 6188 /* objp(O) - where to store ipfobj structure */ 6189 /* ptr(I) - pointer to data to copy out */ 6190 /* type(I) - type of structure being moved */ 6191 /* */ 6192 /* Copy in the contents of what the ipfobj_t points to. In future, we */ 6193 /* add things to check for version numbers, sizes, etc, to make it backward */ 6194 /* compatible at the ABI for user land. */ 6195 /* If objp is not NULL then we assume that the caller wants to see what is */ 6196 /* in the ipfobj_t structure being copied in. As an example, this can tell */ 6197 /* the caller what version of ipfilter the ioctl program was written to. */ 6198 /* ------------------------------------------------------------------------ */ 6199 int 6200 ipf_inobj(ipf_main_softc_t *softc, void *data, ipfobj_t *objp, void *ptr, 6201 int type) 6202 { 6203 ipfobj_t obj; 6204 int error; 6205 int size; 6206 6207 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6208 IPFERROR(49); 6209 return EINVAL; 6210 } 6211 6212 if (objp == NULL) 6213 objp = &obj; 6214 error = BCOPYIN(data, objp, sizeof(*objp)); 6215 if (error != 0) { 6216 IPFERROR(124); 6217 return EFAULT; 6218 } 6219 6220 if (objp->ipfo_type != type) { 6221 IPFERROR(50); 6222 return EINVAL; 6223 } 6224 6225 if (objp->ipfo_rev >= ipf_objbytes[type][2]) { 6226 if ((ipf_objbytes[type][0] & 1) != 0) { 6227 if (objp->ipfo_size < ipf_objbytes[type][1]) { 6228 IPFERROR(51); 6229 return EINVAL; 6230 } 6231 size = ipf_objbytes[type][1]; 6232 } else if (objp->ipfo_size == ipf_objbytes[type][1]) { 6233 size = objp->ipfo_size; 6234 } else { 6235 IPFERROR(52); 6236 return EINVAL; 6237 } 6238 error = COPYIN(objp->ipfo_ptr, ptr, size); 6239 if (error != 0) { 6240 IPFERROR(55); 6241 error = EFAULT; 6242 } 6243 } else { 6244 #ifdef IPFILTER_COMPAT 6245 error = ipf_in_compat(softc, objp, ptr, 0); 6246 #else 6247 IPFERROR(54); 6248 error = EINVAL; 6249 #endif 6250 } 6251 return error; 6252 } 6253 6254 6255 /* ------------------------------------------------------------------------ */ 6256 /* Function: ipf_inobjsz */ 6257 /* Returns: int - 0 = success, else failure */ 6258 /* Parameters: softc(I) - soft context pointerto work with */ 6259 /* data(I) - pointer to ioctl data */ 6260 /* ptr(I) - pointer to store real data in */ 6261 /* type(I) - type of structure being moved */ 6262 /* sz(I) - size of data to copy */ 6263 /* */ 6264 /* As per ipf_inobj, except the size of the object to copy in is passed in */ 6265 /* but it must not be smaller than the size defined for the type and the */ 6266 /* type must allow for varied sized objects. The extra requirement here is */ 6267 /* that sz must match the size of the object being passed in - this is not */ 6268 /* not possible nor required in ipf_inobj(). */ 6269 /* ------------------------------------------------------------------------ */ 6270 int 6271 ipf_inobjsz(ipf_main_softc_t *softc, void *data, void *ptr, int type, int sz) 6272 { 6273 ipfobj_t obj; 6274 int error; 6275 6276 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6277 IPFERROR(56); 6278 return EINVAL; 6279 } 6280 6281 error = BCOPYIN(data, &obj, sizeof(obj)); 6282 if (error != 0) { 6283 IPFERROR(125); 6284 return EFAULT; 6285 } 6286 6287 if (obj.ipfo_type != type) { 6288 IPFERROR(58); 6289 return EINVAL; 6290 } 6291 6292 if (obj.ipfo_rev >= ipf_objbytes[type][2]) { 6293 if (((ipf_objbytes[type][0] & 1) == 0) || 6294 (sz < ipf_objbytes[type][1])) { 6295 IPFERROR(57); 6296 return EINVAL; 6297 } 6298 error = COPYIN(obj.ipfo_ptr, ptr, sz); 6299 if (error != 0) { 6300 IPFERROR(61); 6301 error = EFAULT; 6302 } 6303 } else { 6304 #ifdef IPFILTER_COMPAT 6305 error = ipf_in_compat(softc, &obj, ptr, sz); 6306 #else 6307 IPFERROR(60); 6308 error = EINVAL; 6309 #endif 6310 } 6311 return error; 6312 } 6313 6314 6315 /* ------------------------------------------------------------------------ */ 6316 /* Function: ipf_outobjsz */ 6317 /* Returns: int - 0 = success, else failure */ 6318 /* Parameters: data(I) - pointer to ioctl data */ 6319 /* ptr(I) - pointer to store real data in */ 6320 /* type(I) - type of structure being moved */ 6321 /* sz(I) - size of data to copy */ 6322 /* */ 6323 /* As per ipf_outobj, except the size of the object to copy out is passed in*/ 6324 /* but it must not be smaller than the size defined for the type and the */ 6325 /* type must allow for varied sized objects. The extra requirement here is */ 6326 /* that sz must match the size of the object being passed in - this is not */ 6327 /* not possible nor required in ipf_outobj(). */ 6328 /* ------------------------------------------------------------------------ */ 6329 int 6330 ipf_outobjsz(ipf_main_softc_t *softc, void *data, void *ptr, int type, int sz) 6331 { 6332 ipfobj_t obj; 6333 int error; 6334 6335 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6336 IPFERROR(62); 6337 return EINVAL; 6338 } 6339 6340 error = BCOPYIN(data, &obj, sizeof(obj)); 6341 if (error != 0) { 6342 IPFERROR(127); 6343 return EFAULT; 6344 } 6345 6346 if (obj.ipfo_type != type) { 6347 IPFERROR(63); 6348 return EINVAL; 6349 } 6350 6351 if (obj.ipfo_rev >= ipf_objbytes[type][2]) { 6352 if (((ipf_objbytes[type][0] & 1) == 0) || 6353 (sz < ipf_objbytes[type][1])) { 6354 IPFERROR(146); 6355 return EINVAL; 6356 } 6357 error = COPYOUT(ptr, obj.ipfo_ptr, sz); 6358 if (error != 0) { 6359 IPFERROR(66); 6360 error = EFAULT; 6361 } 6362 } else { 6363 #ifdef IPFILTER_COMPAT 6364 error = ipf_out_compat(softc, &obj, ptr); 6365 #else 6366 IPFERROR(65); 6367 error = EINVAL; 6368 #endif 6369 } 6370 return error; 6371 } 6372 6373 6374 /* ------------------------------------------------------------------------ */ 6375 /* Function: ipf_outobj */ 6376 /* Returns: int - 0 = success, else failure */ 6377 /* Parameters: data(I) - pointer to ioctl data */ 6378 /* ptr(I) - pointer to store real data in */ 6379 /* type(I) - type of structure being moved */ 6380 /* */ 6381 /* Copy out the contents of what ptr is to where ipfobj points to. In */ 6382 /* future, we add things to check for version numbers, sizes, etc, to make */ 6383 /* it backward compatible at the ABI for user land. */ 6384 /* ------------------------------------------------------------------------ */ 6385 int 6386 ipf_outobj(ipf_main_softc_t *softc, void *data, void *ptr, int type) 6387 { 6388 ipfobj_t obj; 6389 int error; 6390 6391 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6392 IPFERROR(67); 6393 return EINVAL; 6394 } 6395 6396 error = BCOPYIN(data, &obj, sizeof(obj)); 6397 if (error != 0) { 6398 IPFERROR(126); 6399 return EFAULT; 6400 } 6401 6402 if (obj.ipfo_type != type) { 6403 IPFERROR(68); 6404 return EINVAL; 6405 } 6406 6407 if (obj.ipfo_rev >= ipf_objbytes[type][2]) { 6408 if ((ipf_objbytes[type][0] & 1) != 0) { 6409 if (obj.ipfo_size < ipf_objbytes[type][1]) { 6410 IPFERROR(69); 6411 return EINVAL; 6412 } 6413 } else if (obj.ipfo_size != ipf_objbytes[type][1]) { 6414 IPFERROR(70); 6415 return EINVAL; 6416 } 6417 6418 error = COPYOUT(ptr, obj.ipfo_ptr, obj.ipfo_size); 6419 if (error != 0) { 6420 IPFERROR(73); 6421 error = EFAULT; 6422 } 6423 } else { 6424 #ifdef IPFILTER_COMPAT 6425 error = ipf_out_compat(softc, &obj, ptr); 6426 #else 6427 IPFERROR(72); 6428 error = EINVAL; 6429 #endif 6430 } 6431 return error; 6432 } 6433 6434 6435 /* ------------------------------------------------------------------------ */ 6436 /* Function: ipf_outobjk */ 6437 /* Returns: int - 0 = success, else failure */ 6438 /* Parameters: obj(I) - pointer to data description structure */ 6439 /* ptr(I) - pointer to kernel data to copy out */ 6440 /* */ 6441 /* In the above functions, the ipfobj_t structure is copied into the kernel,*/ 6442 /* telling ipfilter how to copy out data. In this instance, the ipfobj_t is */ 6443 /* already populated with information and now we just need to use it. */ 6444 /* There is no need for this function to have a "type" parameter as there */ 6445 /* is no point in validating information that comes from the kernel with */ 6446 /* itself. */ 6447 /* ------------------------------------------------------------------------ */ 6448 int 6449 ipf_outobjk(ipf_main_softc_t *softc, ipfobj_t *obj, void *ptr) 6450 { 6451 int type = obj->ipfo_type; 6452 int error; 6453 6454 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6455 IPFERROR(147); 6456 return EINVAL; 6457 } 6458 6459 if (obj->ipfo_rev >= ipf_objbytes[type][2]) { 6460 if ((ipf_objbytes[type][0] & 1) != 0) { 6461 if (obj->ipfo_size < ipf_objbytes[type][1]) { 6462 IPFERROR(148); 6463 return EINVAL; 6464 } 6465 6466 } else if (obj->ipfo_size != ipf_objbytes[type][1]) { 6467 IPFERROR(149); 6468 return EINVAL; 6469 } 6470 6471 error = COPYOUT(ptr, obj->ipfo_ptr, obj->ipfo_size); 6472 if (error != 0) { 6473 IPFERROR(150); 6474 error = EFAULT; 6475 } 6476 } else { 6477 #ifdef IPFILTER_COMPAT 6478 error = ipf_out_compat(softc, obj, ptr); 6479 #else 6480 IPFERROR(151); 6481 error = EINVAL; 6482 #endif 6483 } 6484 return error; 6485 } 6486 6487 6488 /* ------------------------------------------------------------------------ */ 6489 /* Function: ipf_checkl4sum */ 6490 /* Returns: int - 0 = good, -1 = bad, 1 = cannot check */ 6491 /* Parameters: fin(I) - pointer to packet information */ 6492 /* */ 6493 /* If possible, calculate the layer 4 checksum for the packet. If this is */ 6494 /* not possible, return without indicating a failure or success but in a */ 6495 /* way that is ditinguishable. This function should only be called by the */ 6496 /* ipf_checkv6sum() for each platform. */ 6497 /* ------------------------------------------------------------------------ */ 6498 int 6499 ipf_checkl4sum(fr_info_t *fin) 6500 { 6501 u_short sum, hdrsum, *csump; 6502 udphdr_t *udp; 6503 int dosum; 6504 6505 /* 6506 * If the TCP packet isn't a fragment, isn't too short and otherwise 6507 * isn't already considered "bad", then validate the checksum. If 6508 * this check fails then considered the packet to be "bad". 6509 */ 6510 if ((fin->fin_flx & (FI_FRAG|FI_SHORT|FI_BAD)) != 0) 6511 return 1; 6512 6513 csump = NULL; 6514 hdrsum = 0; 6515 dosum = 0; 6516 sum = 0; 6517 6518 switch (fin->fin_p) 6519 { 6520 case IPPROTO_TCP : 6521 csump = &((tcphdr_t *)fin->fin_dp)->th_sum; 6522 dosum = 1; 6523 break; 6524 6525 case IPPROTO_UDP : 6526 udp = fin->fin_dp; 6527 if (udp->uh_sum != 0) { 6528 csump = &udp->uh_sum; 6529 dosum = 1; 6530 } 6531 break; 6532 6533 #ifdef USE_INET6 6534 case IPPROTO_ICMPV6 : 6535 csump = &((struct icmp6_hdr *)fin->fin_dp)->icmp6_cksum; 6536 dosum = 1; 6537 break; 6538 #endif 6539 6540 case IPPROTO_ICMP : 6541 csump = &((struct icmp *)fin->fin_dp)->icmp_cksum; 6542 dosum = 1; 6543 break; 6544 6545 default : 6546 return 1; 6547 /*NOTREACHED*/ 6548 } 6549 6550 if (csump != NULL) { 6551 hdrsum = *csump; 6552 if (fin->fin_p == IPPROTO_UDP && hdrsum == 0xffff) 6553 hdrsum = 0x0000; 6554 } 6555 6556 if (dosum) { 6557 sum = fr_cksum(fin, fin->fin_ip, fin->fin_p, fin->fin_dp); 6558 } 6559 #if !defined(_KERNEL) 6560 if (sum == hdrsum) { 6561 FR_DEBUG(("checkl4sum: %hx == %hx\n", sum, hdrsum)); 6562 } else { 6563 FR_DEBUG(("checkl4sum: %hx != %hx\n", sum, hdrsum)); 6564 } 6565 #endif 6566 DT2(l4sums, u_short, hdrsum, u_short, sum); 6567 if (hdrsum == sum) { 6568 fin->fin_cksum = FI_CK_SUMOK; 6569 return 0; 6570 } 6571 fin->fin_cksum = FI_CK_BAD; 6572 return -1; 6573 } 6574 6575 6576 /* ------------------------------------------------------------------------ */ 6577 /* Function: ipf_ifpfillv4addr */ 6578 /* Returns: int - 0 = address update, -1 = address not updated */ 6579 /* Parameters: atype(I) - type of network address update to perform */ 6580 /* sin(I) - pointer to source of address information */ 6581 /* mask(I) - pointer to source of netmask information */ 6582 /* inp(I) - pointer to destination address store */ 6583 /* inpmask(I) - pointer to destination netmask store */ 6584 /* */ 6585 /* Given a type of network address update (atype) to perform, copy */ 6586 /* information from sin/mask into inp/inpmask. If ipnmask is NULL then no */ 6587 /* netmask update is performed unless FRI_NETMASKED is passed as atype, in */ 6588 /* which case the operation fails. For all values of atype other than */ 6589 /* FRI_NETMASKED, if inpmask is non-NULL then the mask is set to an all 1s */ 6590 /* value. */ 6591 /* ------------------------------------------------------------------------ */ 6592 int 6593 ipf_ifpfillv4addr(int atype, struct sockaddr_in *sin, struct sockaddr_in *mask, 6594 struct in_addr *inp, struct in_addr *inpmask) 6595 { 6596 if (inpmask != NULL && atype != FRI_NETMASKED) 6597 inpmask->s_addr = 0xffffffff; 6598 6599 if (atype == FRI_NETWORK || atype == FRI_NETMASKED) { 6600 if (atype == FRI_NETMASKED) { 6601 if (inpmask == NULL) 6602 return -1; 6603 inpmask->s_addr = mask->sin_addr.s_addr; 6604 } 6605 inp->s_addr = sin->sin_addr.s_addr & mask->sin_addr.s_addr; 6606 } else { 6607 inp->s_addr = sin->sin_addr.s_addr; 6608 } 6609 return 0; 6610 } 6611 6612 6613 #ifdef USE_INET6 6614 /* ------------------------------------------------------------------------ */ 6615 /* Function: ipf_ifpfillv6addr */ 6616 /* Returns: int - 0 = address update, -1 = address not updated */ 6617 /* Parameters: atype(I) - type of network address update to perform */ 6618 /* sin(I) - pointer to source of address information */ 6619 /* mask(I) - pointer to source of netmask information */ 6620 /* inp(I) - pointer to destination address store */ 6621 /* inpmask(I) - pointer to destination netmask store */ 6622 /* */ 6623 /* Given a type of network address update (atype) to perform, copy */ 6624 /* information from sin/mask into inp/inpmask. If ipnmask is NULL then no */ 6625 /* netmask update is performed unless FRI_NETMASKED is passed as atype, in */ 6626 /* which case the operation fails. For all values of atype other than */ 6627 /* FRI_NETMASKED, if inpmask is non-NULL then the mask is set to an all 1s */ 6628 /* value. */ 6629 /* ------------------------------------------------------------------------ */ 6630 int 6631 ipf_ifpfillv6addr(int atype, struct sockaddr_in6 *sin, 6632 struct sockaddr_in6 *mask, i6addr_t *inp, i6addr_t *inpmask) 6633 { 6634 i6addr_t *src, *and; 6635 6636 src = (i6addr_t *)&sin->sin6_addr; 6637 and = (i6addr_t *)&mask->sin6_addr; 6638 6639 if (inpmask != NULL && atype != FRI_NETMASKED) { 6640 inpmask->i6[0] = 0xffffffff; 6641 inpmask->i6[1] = 0xffffffff; 6642 inpmask->i6[2] = 0xffffffff; 6643 inpmask->i6[3] = 0xffffffff; 6644 } 6645 6646 if (atype == FRI_NETWORK || atype == FRI_NETMASKED) { 6647 if (atype == FRI_NETMASKED) { 6648 if (inpmask == NULL) 6649 return -1; 6650 inpmask->i6[0] = and->i6[0]; 6651 inpmask->i6[1] = and->i6[1]; 6652 inpmask->i6[2] = and->i6[2]; 6653 inpmask->i6[3] = and->i6[3]; 6654 } 6655 6656 inp->i6[0] = src->i6[0] & and->i6[0]; 6657 inp->i6[1] = src->i6[1] & and->i6[1]; 6658 inp->i6[2] = src->i6[2] & and->i6[2]; 6659 inp->i6[3] = src->i6[3] & and->i6[3]; 6660 } else { 6661 inp->i6[0] = src->i6[0]; 6662 inp->i6[1] = src->i6[1]; 6663 inp->i6[2] = src->i6[2]; 6664 inp->i6[3] = src->i6[3]; 6665 } 6666 return 0; 6667 } 6668 #endif 6669 6670 6671 /* ------------------------------------------------------------------------ */ 6672 /* Function: ipf_matchtag */ 6673 /* Returns: 0 == mismatch, 1 == match. */ 6674 /* Parameters: tag1(I) - pointer to first tag to compare */ 6675 /* tag2(I) - pointer to second tag to compare */ 6676 /* */ 6677 /* Returns true (non-zero) or false(0) if the two tag structures can be */ 6678 /* considered to be a match or not match, respectively. The tag is 16 */ 6679 /* bytes long (16 characters) but that is overlayed with 4 32bit ints so */ 6680 /* compare the ints instead, for speed. tag1 is the master of the */ 6681 /* comparison. This function should only be called with both tag1 and tag2 */ 6682 /* as non-NULL pointers. */ 6683 /* ------------------------------------------------------------------------ */ 6684 int 6685 ipf_matchtag(ipftag_t *tag1, ipftag_t *tag2) 6686 { 6687 if (tag1 == tag2) 6688 return 1; 6689 6690 if ((tag1->ipt_num[0] == 0) && (tag2->ipt_num[0] == 0)) 6691 return 1; 6692 6693 if ((tag1->ipt_num[0] == tag2->ipt_num[0]) && 6694 (tag1->ipt_num[1] == tag2->ipt_num[1]) && 6695 (tag1->ipt_num[2] == tag2->ipt_num[2]) && 6696 (tag1->ipt_num[3] == tag2->ipt_num[3])) 6697 return 1; 6698 return 0; 6699 } 6700 6701 6702 /* ------------------------------------------------------------------------ */ 6703 /* Function: ipf_coalesce */ 6704 /* Returns: 1 == success, -1 == failure, 0 == no change */ 6705 /* Parameters: fin(I) - pointer to packet information */ 6706 /* */ 6707 /* Attempt to get all of the packet data into a single, contiguous buffer. */ 6708 /* If this call returns a failure then the buffers have also been freed. */ 6709 /* ------------------------------------------------------------------------ */ 6710 int 6711 ipf_coalesce(fr_info_t *fin) 6712 { 6713 6714 if ((fin->fin_flx & FI_COALESCE) != 0) 6715 return 1; 6716 6717 /* 6718 * If the mbuf pointers indicate that there is no mbuf to work with, 6719 * return but do not indicate success or failure. 6720 */ 6721 if (fin->fin_m == NULL || fin->fin_mp == NULL) 6722 return 0; 6723 6724 #if defined(_KERNEL) 6725 if (ipf_pullup(fin->fin_m, fin, fin->fin_plen) == NULL) { 6726 ipf_main_softc_t *softc = fin->fin_main_soft; 6727 6728 DT1(frb_coalesce, fr_info_t *, fin); 6729 LBUMP(ipf_stats[fin->fin_out].fr_badcoalesces); 6730 # ifdef MENTAT 6731 FREE_MB_T(*fin->fin_mp); 6732 # endif 6733 fin->fin_reason = FRB_COALESCE; 6734 *fin->fin_mp = NULL; 6735 fin->fin_m = NULL; 6736 return -1; 6737 } 6738 #else 6739 fin = fin; /* LINT */ 6740 #endif 6741 return 1; 6742 } 6743 6744 6745 /* 6746 * The following table lists all of the tunable variables that can be 6747 * accessed via SIOCIPFGET/SIOCIPFSET/SIOCIPFGETNEXt. The format of each row 6748 * in the table below is as follows: 6749 * 6750 * pointer to value, name of value, minimum, maximum, size of the value's 6751 * container, value attribute flags 6752 * 6753 * For convienience, IPFT_RDONLY means the value is read-only, IPFT_WRDISABLED 6754 * means the value can only be written to when IPFilter is loaded but disabled. 6755 * The obvious implication is if neither of these are set then the value can be 6756 * changed at any time without harm. 6757 */ 6758 6759 6760 /* ------------------------------------------------------------------------ */ 6761 /* Function: ipf_tune_findbycookie */ 6762 /* Returns: NULL = search failed, else pointer to tune struct */ 6763 /* Parameters: cookie(I) - cookie value to search for amongst tuneables */ 6764 /* next(O) - pointer to place to store the cookie for the */ 6765 /* "next" tuneable, if it is desired. */ 6766 /* */ 6767 /* This function is used to walk through all of the existing tunables with */ 6768 /* successive calls. It searches the known tunables for the one which has */ 6769 /* a matching value for "cookie" - ie its address. When returning a match, */ 6770 /* the next one to be found may be returned inside next. */ 6771 /* ------------------------------------------------------------------------ */ 6772 static ipftuneable_t * 6773 ipf_tune_findbycookie(ipftuneable_t **ptop, void *cookie, void **next) 6774 { 6775 ipftuneable_t *ta, **tap; 6776 6777 for (ta = *ptop; ta->ipft_name != NULL; ta++) 6778 if (ta == cookie) { 6779 if (next != NULL) { 6780 /* 6781 * If the next entry in the array has a name 6782 * present, then return a pointer to it for 6783 * where to go next, else return a pointer to 6784 * the dynaminc list as a key to search there 6785 * next. This facilitates a weak linking of 6786 * the two "lists" together. 6787 */ 6788 if ((ta + 1)->ipft_name != NULL) 6789 *next = ta + 1; 6790 else 6791 *next = ptop; 6792 } 6793 return ta; 6794 } 6795 6796 for (tap = ptop; (ta = *tap) != NULL; tap = &ta->ipft_next) 6797 if (tap == cookie) { 6798 if (next != NULL) 6799 *next = &ta->ipft_next; 6800 return ta; 6801 } 6802 6803 if (next != NULL) 6804 *next = NULL; 6805 return NULL; 6806 } 6807 6808 6809 /* ------------------------------------------------------------------------ */ 6810 /* Function: ipf_tune_findbyname */ 6811 /* Returns: NULL = search failed, else pointer to tune struct */ 6812 /* Parameters: name(I) - name of the tuneable entry to find. */ 6813 /* */ 6814 /* Search the static array of tuneables and the list of dynamic tuneables */ 6815 /* for an entry with a matching name. If we can find one, return a pointer */ 6816 /* to the matching structure. */ 6817 /* ------------------------------------------------------------------------ */ 6818 static ipftuneable_t * 6819 ipf_tune_findbyname(ipftuneable_t *top, const char *name) 6820 { 6821 ipftuneable_t *ta; 6822 6823 for (ta = top; ta != NULL; ta = ta->ipft_next) 6824 if (!strcmp(ta->ipft_name, name)) { 6825 return ta; 6826 } 6827 6828 return NULL; 6829 } 6830 6831 6832 /* ------------------------------------------------------------------------ */ 6833 /* Function: ipf_tune_add_array */ 6834 /* Returns: int - 0 == success, else failure */ 6835 /* Parameters: newtune - pointer to new tune array to add to tuneables */ 6836 /* */ 6837 /* Appends tune structures from the array passed in (newtune) to the end of */ 6838 /* the current list of "dynamic" tuneable parameters. */ 6839 /* If any entry to be added is already present (by name) then the operation */ 6840 /* is aborted - entries that have been added are removed before returning. */ 6841 /* An entry with no name (NULL) is used as the indication that the end of */ 6842 /* the array has been reached. */ 6843 /* ------------------------------------------------------------------------ */ 6844 int 6845 ipf_tune_add_array(ipf_main_softc_t *softc, ipftuneable_t *newtune) 6846 { 6847 ipftuneable_t *nt, *dt; 6848 int error = 0; 6849 6850 for (nt = newtune; nt->ipft_name != NULL; nt++) { 6851 error = ipf_tune_add(softc, nt); 6852 if (error != 0) { 6853 for (dt = newtune; dt != nt; dt++) { 6854 (void) ipf_tune_del(softc, dt); 6855 } 6856 } 6857 } 6858 6859 return error; 6860 } 6861 6862 6863 /* ------------------------------------------------------------------------ */ 6864 /* Function: ipf_tune_array_link */ 6865 /* Returns: 0 == success, -1 == failure */ 6866 /* Parameters: softc(I) - soft context pointerto work with */ 6867 /* array(I) - pointer to an array of tuneables */ 6868 /* */ 6869 /* Given an array of tunables (array), append them to the current list of */ 6870 /* tuneables for this context (softc->ipf_tuners.) To properly prepare the */ 6871 /* the array for being appended to the list, initialise all of the next */ 6872 /* pointers so we don't need to walk parts of it with ++ and others with */ 6873 /* next. The array is expected to have an entry with a NULL name as the */ 6874 /* terminator. Trying to add an array with no non-NULL names will return as */ 6875 /* a failure. */ 6876 /* ------------------------------------------------------------------------ */ 6877 int 6878 ipf_tune_array_link(ipf_main_softc_t *softc, ipftuneable_t *array) 6879 { 6880 ipftuneable_t *t, **p; 6881 6882 t = array; 6883 if (t->ipft_name == NULL) 6884 return -1; 6885 6886 for (; t[1].ipft_name != NULL; t++) 6887 t[0].ipft_next = &t[1]; 6888 t->ipft_next = NULL; 6889 6890 /* 6891 * Since a pointer to the last entry isn't kept, we need to find it 6892 * each time we want to add new variables to the list. 6893 */ 6894 for (p = &softc->ipf_tuners; (t = *p) != NULL; p = &t->ipft_next) 6895 if (t->ipft_name == NULL) 6896 break; 6897 *p = array; 6898 6899 return 0; 6900 } 6901 6902 6903 /* ------------------------------------------------------------------------ */ 6904 /* Function: ipf_tune_array_unlink */ 6905 /* Returns: 0 == success, -1 == failure */ 6906 /* Parameters: softc(I) - soft context pointerto work with */ 6907 /* array(I) - pointer to an array of tuneables */ 6908 /* */ 6909 /* ------------------------------------------------------------------------ */ 6910 int 6911 ipf_tune_array_unlink(ipf_main_softc_t *softc, ipftuneable_t *array) 6912 { 6913 ipftuneable_t *t, **p; 6914 6915 for (p = &softc->ipf_tuners; (t = *p) != NULL; p = &t->ipft_next) 6916 if (t == array) 6917 break; 6918 if (t == NULL) 6919 return -1; 6920 6921 for (; t[1].ipft_name != NULL; t++) 6922 ; 6923 6924 *p = t->ipft_next; 6925 6926 return 0; 6927 } 6928 6929 6930 /* ------------------------------------------------------------------------ */ 6931 /* Function: ipf_tune_array_copy */ 6932 /* Returns: NULL = failure, else pointer to new array */ 6933 /* Parameters: base(I) - pointer to structure base */ 6934 /* size(I) - size of the array at template */ 6935 /* template(I) - original array to copy */ 6936 /* */ 6937 /* Allocate memory for a new set of tuneable values and copy everything */ 6938 /* from template into the new region of memory. The new region is full of */ 6939 /* uninitialised pointers (ipft_next) so set them up. Now, ipftp_offset... */ 6940 /* */ 6941 /* NOTE: the following assumes that sizeof(long) == sizeof(void *) */ 6942 /* In the array template, ipftp_offset is the offset (in bytes) of the */ 6943 /* location of the tuneable value inside the structure pointed to by base. */ 6944 /* As ipftp_offset is a union over the pointers to the tuneable values, if */ 6945 /* we add base to the copy's ipftp_offset, copy ends up with a pointer in */ 6946 /* ipftp_void that points to the stored value. */ 6947 /* ------------------------------------------------------------------------ */ 6948 ipftuneable_t * 6949 ipf_tune_array_copy(void *base, size_t size, const ipftuneable_t *template) 6950 { 6951 ipftuneable_t *copy; 6952 int i; 6953 6954 6955 KMALLOCS(copy, ipftuneable_t *, size); 6956 if (copy == NULL) { 6957 return NULL; 6958 } 6959 bcopy(template, copy, size); 6960 6961 for (i = 0; copy[i].ipft_name; i++) { 6962 copy[i].ipft_una.ipftp_offset += (u_long)base; 6963 copy[i].ipft_next = copy + i + 1; 6964 } 6965 6966 return copy; 6967 } 6968 6969 6970 /* ------------------------------------------------------------------------ */ 6971 /* Function: ipf_tune_add */ 6972 /* Returns: int - 0 == success, else failure */ 6973 /* Parameters: newtune - pointer to new tune entry to add to tuneables */ 6974 /* */ 6975 /* Appends tune structures from the array passed in (newtune) to the end of */ 6976 /* the current list of "dynamic" tuneable parameters. Once added, the */ 6977 /* owner of the object is not expected to ever change "ipft_next". */ 6978 /* ------------------------------------------------------------------------ */ 6979 int 6980 ipf_tune_add(ipf_main_softc_t *softc, ipftuneable_t *newtune) 6981 { 6982 ipftuneable_t *ta, **tap; 6983 6984 ta = ipf_tune_findbyname(softc->ipf_tuners, newtune->ipft_name); 6985 if (ta != NULL) { 6986 IPFERROR(74); 6987 return EEXIST; 6988 } 6989 6990 for (tap = &softc->ipf_tuners; *tap != NULL; tap = &(*tap)->ipft_next) 6991 ; 6992 6993 newtune->ipft_next = NULL; 6994 *tap = newtune; 6995 return 0; 6996 } 6997 6998 6999 /* ------------------------------------------------------------------------ */ 7000 /* Function: ipf_tune_del */ 7001 /* Returns: int - 0 == success, else failure */ 7002 /* Parameters: oldtune - pointer to tune entry to remove from the list of */ 7003 /* current dynamic tuneables */ 7004 /* */ 7005 /* Search for the tune structure, by pointer, in the list of those that are */ 7006 /* dynamically added at run time. If found, adjust the list so that this */ 7007 /* structure is no longer part of it. */ 7008 /* ------------------------------------------------------------------------ */ 7009 int 7010 ipf_tune_del(ipf_main_softc_t *softc, ipftuneable_t *oldtune) 7011 { 7012 ipftuneable_t *ta, **tap; 7013 int error = 0; 7014 7015 for (tap = &softc->ipf_tuners; (ta = *tap) != NULL; 7016 tap = &ta->ipft_next) { 7017 if (ta == oldtune) { 7018 *tap = oldtune->ipft_next; 7019 oldtune->ipft_next = NULL; 7020 break; 7021 } 7022 } 7023 7024 if (ta == NULL) { 7025 error = ESRCH; 7026 IPFERROR(75); 7027 } 7028 return error; 7029 } 7030 7031 7032 /* ------------------------------------------------------------------------ */ 7033 /* Function: ipf_tune_del_array */ 7034 /* Returns: int - 0 == success, else failure */ 7035 /* Parameters: oldtune - pointer to tuneables array */ 7036 /* */ 7037 /* Remove each tuneable entry in the array from the list of "dynamic" */ 7038 /* tunables. If one entry should fail to be found, an error will be */ 7039 /* returned and no further ones removed. */ 7040 /* An entry with a NULL name is used as the indicator of the last entry in */ 7041 /* the array. */ 7042 /* ------------------------------------------------------------------------ */ 7043 int 7044 ipf_tune_del_array(ipf_main_softc_t *softc, ipftuneable_t *oldtune) 7045 { 7046 ipftuneable_t *ot; 7047 int error = 0; 7048 7049 for (ot = oldtune; ot->ipft_name != NULL; ot++) { 7050 error = ipf_tune_del(softc, ot); 7051 if (error != 0) 7052 break; 7053 } 7054 7055 return error; 7056 7057 } 7058 7059 7060 /* ------------------------------------------------------------------------ */ 7061 /* Function: ipf_tune */ 7062 /* Returns: int - 0 == success, else failure */ 7063 /* Parameters: cmd(I) - ioctl command number */ 7064 /* data(I) - pointer to ioctl data structure */ 7065 /* */ 7066 /* Implement handling of SIOCIPFGETNEXT, SIOCIPFGET and SIOCIPFSET. These */ 7067 /* three ioctls provide the means to access and control global variables */ 7068 /* within IPFilter, allowing (for example) timeouts and table sizes to be */ 7069 /* changed without rebooting, reloading or recompiling. The initialisation */ 7070 /* and 'destruction' routines of the various components of ipfilter are all */ 7071 /* each responsible for handling their own values being too big. */ 7072 /* ------------------------------------------------------------------------ */ 7073 int 7074 ipf_ipftune(ipf_main_softc_t *softc, ioctlcmd_t cmd, void *data) 7075 { 7076 ipftuneable_t *ta; 7077 ipftune_t tu; 7078 void *cookie; 7079 int error; 7080 7081 error = ipf_inobj(softc, data, NULL, &tu, IPFOBJ_TUNEABLE); 7082 if (error != 0) 7083 return error; 7084 7085 tu.ipft_name[sizeof(tu.ipft_name) - 1] = '\0'; 7086 cookie = tu.ipft_cookie; 7087 ta = NULL; 7088 7089 switch (cmd) 7090 { 7091 case SIOCIPFGETNEXT : 7092 /* 7093 * If cookie is non-NULL, assume it to be a pointer to the last 7094 * entry we looked at, so find it (if possible) and return a 7095 * pointer to the next one after it. The last entry in the 7096 * the table is a NULL entry, so when we get to it, set cookie 7097 * to NULL and return that, indicating end of list, erstwhile 7098 * if we come in with cookie set to NULL, we are starting anew 7099 * at the front of the list. 7100 */ 7101 if (cookie != NULL) { 7102 ta = ipf_tune_findbycookie(&softc->ipf_tuners, 7103 cookie, &tu.ipft_cookie); 7104 } else { 7105 ta = softc->ipf_tuners; 7106 tu.ipft_cookie = ta + 1; 7107 } 7108 if (ta != NULL) { 7109 /* 7110 * Entry found, but does the data pointed to by that 7111 * row fit in what we can return? 7112 */ 7113 if (ta->ipft_sz > sizeof(tu.ipft_un)) { 7114 IPFERROR(76); 7115 return EINVAL; 7116 } 7117 7118 tu.ipft_vlong = 0; 7119 if (ta->ipft_sz == sizeof(u_long)) 7120 tu.ipft_vlong = *ta->ipft_plong; 7121 else if (ta->ipft_sz == sizeof(u_int)) 7122 tu.ipft_vint = *ta->ipft_pint; 7123 else if (ta->ipft_sz == sizeof(u_short)) 7124 tu.ipft_vshort = *ta->ipft_pshort; 7125 else if (ta->ipft_sz == sizeof(u_char)) 7126 tu.ipft_vchar = *ta->ipft_pchar; 7127 7128 tu.ipft_sz = ta->ipft_sz; 7129 tu.ipft_min = ta->ipft_min; 7130 tu.ipft_max = ta->ipft_max; 7131 tu.ipft_flags = ta->ipft_flags; 7132 bcopy(ta->ipft_name, tu.ipft_name, 7133 MIN(sizeof(tu.ipft_name), 7134 strlen(ta->ipft_name) + 1)); 7135 } 7136 error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE); 7137 break; 7138 7139 case SIOCIPFGET : 7140 case SIOCIPFSET : 7141 /* 7142 * Search by name or by cookie value for a particular entry 7143 * in the tuning paramter table. 7144 */ 7145 IPFERROR(77); 7146 error = ESRCH; 7147 if (cookie != NULL) { 7148 ta = ipf_tune_findbycookie(&softc->ipf_tuners, 7149 cookie, NULL); 7150 if (ta != NULL) 7151 error = 0; 7152 } else if (tu.ipft_name[0] != '\0') { 7153 ta = ipf_tune_findbyname(softc->ipf_tuners, 7154 tu.ipft_name); 7155 if (ta != NULL) 7156 error = 0; 7157 } 7158 if (error != 0) 7159 break; 7160 7161 if (cmd == (ioctlcmd_t)SIOCIPFGET) { 7162 /* 7163 * Fetch the tuning parameters for a particular value 7164 */ 7165 tu.ipft_vlong = 0; 7166 if (ta->ipft_sz == sizeof(u_long)) 7167 tu.ipft_vlong = *ta->ipft_plong; 7168 else if (ta->ipft_sz == sizeof(u_int)) 7169 tu.ipft_vint = *ta->ipft_pint; 7170 else if (ta->ipft_sz == sizeof(u_short)) 7171 tu.ipft_vshort = *ta->ipft_pshort; 7172 else if (ta->ipft_sz == sizeof(u_char)) 7173 tu.ipft_vchar = *ta->ipft_pchar; 7174 tu.ipft_cookie = ta; 7175 tu.ipft_sz = ta->ipft_sz; 7176 tu.ipft_min = ta->ipft_min; 7177 tu.ipft_max = ta->ipft_max; 7178 tu.ipft_flags = ta->ipft_flags; 7179 error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE); 7180 7181 } else if (cmd == (ioctlcmd_t)SIOCIPFSET) { 7182 /* 7183 * Set an internal parameter. The hard part here is 7184 * getting the new value safely and correctly out of 7185 * the kernel (given we only know its size, not type.) 7186 */ 7187 u_long in; 7188 7189 if (((ta->ipft_flags & IPFT_WRDISABLED) != 0) && 7190 (softc->ipf_running > 0)) { 7191 IPFERROR(78); 7192 error = EBUSY; 7193 break; 7194 } 7195 7196 in = tu.ipft_vlong; 7197 if (in < ta->ipft_min || in > ta->ipft_max) { 7198 IPFERROR(79); 7199 error = EINVAL; 7200 break; 7201 } 7202 7203 if (ta->ipft_func != NULL) { 7204 SPL_INT(s); 7205 7206 SPL_NET(s); 7207 error = (*ta->ipft_func)(softc, ta, 7208 &tu.ipft_un); 7209 SPL_X(s); 7210 7211 } else if (ta->ipft_sz == sizeof(u_long)) { 7212 tu.ipft_vlong = *ta->ipft_plong; 7213 *ta->ipft_plong = in; 7214 7215 } else if (ta->ipft_sz == sizeof(u_int)) { 7216 tu.ipft_vint = *ta->ipft_pint; 7217 *ta->ipft_pint = (u_int)(in & 0xffffffff); 7218 7219 } else if (ta->ipft_sz == sizeof(u_short)) { 7220 tu.ipft_vshort = *ta->ipft_pshort; 7221 *ta->ipft_pshort = (u_short)(in & 0xffff); 7222 7223 } else if (ta->ipft_sz == sizeof(u_char)) { 7224 tu.ipft_vchar = *ta->ipft_pchar; 7225 *ta->ipft_pchar = (u_char)(in & 0xff); 7226 } 7227 error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE); 7228 } 7229 break; 7230 7231 default : 7232 IPFERROR(80); 7233 error = EINVAL; 7234 break; 7235 } 7236 7237 return error; 7238 } 7239 7240 7241 /* ------------------------------------------------------------------------ */ 7242 /* Function: ipf_zerostats */ 7243 /* Returns: int - 0 = success, else failure */ 7244 /* Parameters: data(O) - pointer to pointer for copying data back to */ 7245 /* */ 7246 /* Copies the current statistics out to userspace and then zero's the */ 7247 /* current ones in the kernel. The lock is only held across the bzero() as */ 7248 /* the copyout may result in paging (ie network activity.) */ 7249 /* ------------------------------------------------------------------------ */ 7250 int 7251 ipf_zerostats(ipf_main_softc_t *softc, void *data) 7252 { 7253 friostat_t fio; 7254 ipfobj_t obj; 7255 int error; 7256 7257 error = ipf_inobj(softc, data, &obj, &fio, IPFOBJ_IPFSTAT); 7258 if (error != 0) 7259 return error; 7260 ipf_getstat(softc, &fio, obj.ipfo_rev); 7261 error = ipf_outobj(softc, data, &fio, IPFOBJ_IPFSTAT); 7262 if (error != 0) 7263 return error; 7264 7265 WRITE_ENTER(&softc->ipf_mutex); 7266 bzero(&softc->ipf_stats, sizeof(softc->ipf_stats)); 7267 RWLOCK_EXIT(&softc->ipf_mutex); 7268 7269 return 0; 7270 } 7271 7272 7273 /* ------------------------------------------------------------------------ */ 7274 /* Function: ipf_resolvedest */ 7275 /* Returns: Nil */ 7276 /* Parameters: softc(I) - pointer to soft context main structure */ 7277 /* base(I) - where strings are stored */ 7278 /* fdp(IO) - pointer to destination information to resolve */ 7279 /* v(I) - IP protocol version to match */ 7280 /* */ 7281 /* Looks up an interface name in the frdest structure pointed to by fdp and */ 7282 /* if a matching name can be found for the particular IP protocol version */ 7283 /* then store the interface pointer in the frdest struct. If no match is */ 7284 /* found, then set the interface pointer to be -1 as NULL is considered to */ 7285 /* indicate there is no information at all in the structure. */ 7286 /* ------------------------------------------------------------------------ */ 7287 int 7288 ipf_resolvedest(ipf_main_softc_t *softc, char *base, frdest_t *fdp, int v) 7289 { 7290 int errval = 0; 7291 void *ifp; 7292 7293 ifp = NULL; 7294 7295 if (fdp->fd_name != -1) { 7296 if (fdp->fd_type == FRD_DSTLIST) { 7297 ifp = ipf_lookup_res_name(softc, IPL_LOGIPF, 7298 IPLT_DSTLIST, 7299 base + fdp->fd_name, 7300 NULL); 7301 if (ifp == NULL) { 7302 IPFERROR(144); 7303 errval = ESRCH; 7304 } 7305 } else { 7306 ifp = GETIFP(base + fdp->fd_name, v); 7307 } 7308 } 7309 fdp->fd_ptr = ifp; 7310 7311 return errval; 7312 } 7313 7314 7315 /* ------------------------------------------------------------------------ */ 7316 /* Function: ipf_resolvenic */ 7317 /* Returns: void* - NULL = wildcard name, -1 = failed to find NIC, else */ 7318 /* pointer to interface structure for NIC */ 7319 /* Parameters: softc(I)- pointer to soft context main structure */ 7320 /* name(I) - complete interface name */ 7321 /* v(I) - IP protocol version */ 7322 /* */ 7323 /* Look for a network interface structure that firstly has a matching name */ 7324 /* to that passed in and that is also being used for that IP protocol */ 7325 /* version (necessary on some platforms where there are separate listings */ 7326 /* for both IPv4 and IPv6 on the same physical NIC. */ 7327 /* */ 7328 /* ------------------------------------------------------------------------ */ 7329 void * 7330 ipf_resolvenic(ipf_main_softc_t *softc, char *name, int v) 7331 { 7332 void *nic; 7333 7334 softc = softc; /* gcc -Wextra */ 7335 if (name[0] == '\0') 7336 return NULL; 7337 7338 if ((name[1] == '\0') && ((name[0] == '-') || (name[0] == '*'))) { 7339 return NULL; 7340 } 7341 7342 nic = GETIFP(name, v); 7343 if (nic == NULL) 7344 nic = (void *)-1; 7345 return nic; 7346 } 7347 7348 7349 /* ------------------------------------------------------------------------ */ 7350 /* Function: ipf_token_expire */ 7351 /* Returns: None. */ 7352 /* Parameters: softc(I) - pointer to soft context main structure */ 7353 /* */ 7354 /* This function is run every ipf tick to see if there are any tokens that */ 7355 /* have been held for too long and need to be freed up. */ 7356 /* ------------------------------------------------------------------------ */ 7357 void 7358 ipf_token_expire(ipf_main_softc_t *softc) 7359 { 7360 ipftoken_t *it; 7361 7362 WRITE_ENTER(&softc->ipf_tokens); 7363 while ((it = softc->ipf_token_head) != NULL) { 7364 if (it->ipt_die > softc->ipf_ticks) 7365 break; 7366 7367 ipf_token_deref(softc, it); 7368 } 7369 RWLOCK_EXIT(&softc->ipf_tokens); 7370 } 7371 7372 7373 /* ------------------------------------------------------------------------ */ 7374 /* Function: ipf_token_flush */ 7375 /* Returns: None. */ 7376 /* Parameters: softc(I) - pointer to soft context main structure */ 7377 /* */ 7378 /* Loop through all of the existing tokens and call deref to see if they */ 7379 /* can be freed. Normally a function like this might just loop on */ 7380 /* ipf_token_head but there is a chance that a token might have a ref count */ 7381 /* of greater than one and in that case the the reference would drop twice */ 7382 /* by code that is only entitled to drop it once. */ 7383 /* ------------------------------------------------------------------------ */ 7384 static void 7385 ipf_token_flush(ipf_main_softc_t *softc) 7386 { 7387 ipftoken_t *it, *next; 7388 7389 WRITE_ENTER(&softc->ipf_tokens); 7390 for (it = softc->ipf_token_head; it != NULL; it = next) { 7391 next = it->ipt_next; 7392 (void) ipf_token_deref(softc, it); 7393 } 7394 RWLOCK_EXIT(&softc->ipf_tokens); 7395 } 7396 7397 7398 /* ------------------------------------------------------------------------ */ 7399 /* Function: ipf_token_del */ 7400 /* Returns: int - 0 = success, else error */ 7401 /* Parameters: softc(I)- pointer to soft context main structure */ 7402 /* type(I) - the token type to match */ 7403 /* uid(I) - uid owning the token */ 7404 /* ptr(I) - context pointer for the token */ 7405 /* */ 7406 /* This function looks for a a token in the current list that matches up */ 7407 /* the fields (type, uid, ptr). If none is found, ESRCH is returned, else */ 7408 /* call ipf_token_dewref() to remove it from the list. In the event that */ 7409 /* the token has a reference held elsewhere, setting ipt_complete to 2 */ 7410 /* enables debugging to distinguish between the two paths that ultimately */ 7411 /* lead to a token to be deleted. */ 7412 /* ------------------------------------------------------------------------ */ 7413 int 7414 ipf_token_del(ipf_main_softc_t *softc, int type, int uid, void *ptr) 7415 { 7416 ipftoken_t *it; 7417 int error; 7418 7419 IPFERROR(82); 7420 error = ESRCH; 7421 7422 WRITE_ENTER(&softc->ipf_tokens); 7423 for (it = softc->ipf_token_head; it != NULL; it = it->ipt_next) { 7424 if (ptr == it->ipt_ctx && type == it->ipt_type && 7425 uid == it->ipt_uid) { 7426 it->ipt_complete = 2; 7427 ipf_token_deref(softc, it); 7428 error = 0; 7429 break; 7430 } 7431 } 7432 RWLOCK_EXIT(&softc->ipf_tokens); 7433 7434 return error; 7435 } 7436 7437 7438 /* ------------------------------------------------------------------------ */ 7439 /* Function: ipf_token_mark_complete */ 7440 /* Returns: None. */ 7441 /* Parameters: token(I) - pointer to token structure */ 7442 /* */ 7443 /* Mark a token as being ineligable for being found with ipf_token_find. */ 7444 /* ------------------------------------------------------------------------ */ 7445 void 7446 ipf_token_mark_complete(ipftoken_t *token) 7447 { 7448 if (token->ipt_complete == 0) 7449 token->ipt_complete = 1; 7450 } 7451 7452 7453 /* ------------------------------------------------------------------------ */ 7454 /* Function: ipf_token_find */ 7455 /* Returns: ipftoken_t * - NULL if no memory, else pointer to token */ 7456 /* Parameters: softc(I)- pointer to soft context main structure */ 7457 /* type(I) - the token type to match */ 7458 /* uid(I) - uid owning the token */ 7459 /* ptr(I) - context pointer for the token */ 7460 /* */ 7461 /* This function looks for a live token in the list of current tokens that */ 7462 /* matches the tuple (type, uid, ptr). If one cannot be found then one is */ 7463 /* allocated. If one is found then it is moved to the top of the list of */ 7464 /* currently active tokens. */ 7465 /* ------------------------------------------------------------------------ */ 7466 ipftoken_t * 7467 ipf_token_find(ipf_main_softc_t *softc, int type, int uid, void *ptr) 7468 { 7469 ipftoken_t *it, *new; 7470 7471 KMALLOC(new, ipftoken_t *); 7472 if (new != NULL) 7473 bzero((char *)new, sizeof(*new)); 7474 7475 WRITE_ENTER(&softc->ipf_tokens); 7476 for (it = softc->ipf_token_head; it != NULL; it = it->ipt_next) { 7477 if ((ptr == it->ipt_ctx) && (type == it->ipt_type) && 7478 (uid == it->ipt_uid) && (it->ipt_complete < 2)) 7479 break; 7480 } 7481 7482 if (it == NULL) { 7483 it = new; 7484 new = NULL; 7485 if (it == NULL) { 7486 RWLOCK_EXIT(&softc->ipf_tokens); 7487 return NULL; 7488 } 7489 it->ipt_ctx = ptr; 7490 it->ipt_uid = uid; 7491 it->ipt_type = type; 7492 it->ipt_ref = 1; 7493 } else { 7494 if (new != NULL) { 7495 KFREE(new); 7496 new = NULL; 7497 } 7498 7499 if (it->ipt_complete > 0) 7500 it = NULL; 7501 else 7502 ipf_token_unlink(softc, it); 7503 } 7504 7505 if (it != NULL) { 7506 it->ipt_pnext = softc->ipf_token_tail; 7507 *softc->ipf_token_tail = it; 7508 softc->ipf_token_tail = &it->ipt_next; 7509 it->ipt_next = NULL; 7510 it->ipt_ref++; 7511 7512 it->ipt_die = softc->ipf_ticks + 20; 7513 } 7514 7515 RWLOCK_EXIT(&softc->ipf_tokens); 7516 7517 return it; 7518 } 7519 7520 7521 /* ------------------------------------------------------------------------ */ 7522 /* Function: ipf_token_unlink */ 7523 /* Returns: None. */ 7524 /* Parameters: softc(I) - pointer to soft context main structure */ 7525 /* token(I) - pointer to token structure */ 7526 /* Write Locks: ipf_tokens */ 7527 /* */ 7528 /* This function unlinks a token structure from the linked list of tokens */ 7529 /* that "own" it. The head pointer never needs to be explicitly adjusted */ 7530 /* but the tail does due to the linked list implementation. */ 7531 /* ------------------------------------------------------------------------ */ 7532 static void 7533 ipf_token_unlink(ipf_main_softc_t *softc, ipftoken_t *token) 7534 { 7535 7536 if (softc->ipf_token_tail == &token->ipt_next) 7537 softc->ipf_token_tail = token->ipt_pnext; 7538 7539 *token->ipt_pnext = token->ipt_next; 7540 if (token->ipt_next != NULL) 7541 token->ipt_next->ipt_pnext = token->ipt_pnext; 7542 token->ipt_next = NULL; 7543 token->ipt_pnext = NULL; 7544 } 7545 7546 7547 /* ------------------------------------------------------------------------ */ 7548 /* Function: ipf_token_deref */ 7549 /* Returns: int - 0 == token freed, else reference count */ 7550 /* Parameters: softc(I) - pointer to soft context main structure */ 7551 /* token(I) - pointer to token structure */ 7552 /* Write Locks: ipf_tokens */ 7553 /* */ 7554 /* Drop the reference count on the token structure and if it drops to zero, */ 7555 /* call the dereference function for the token type because it is then */ 7556 /* possible to free the token data structure. */ 7557 /* ------------------------------------------------------------------------ */ 7558 int 7559 ipf_token_deref(ipf_main_softc_t *softc, ipftoken_t *token) 7560 { 7561 void *data, **datap; 7562 7563 ASSERT(token->ipt_ref > 0); 7564 token->ipt_ref--; 7565 if (token->ipt_ref > 0) 7566 return token->ipt_ref; 7567 7568 data = token->ipt_data; 7569 datap = &data; 7570 7571 if ((data != NULL) && (data != (void *)-1)) { 7572 switch (token->ipt_type) 7573 { 7574 case IPFGENITER_IPF : 7575 (void) ipf_derefrule(softc, (frentry_t **)datap); 7576 break; 7577 case IPFGENITER_IPNAT : 7578 WRITE_ENTER(&softc->ipf_nat); 7579 ipf_nat_rule_deref(softc, (ipnat_t **)datap); 7580 RWLOCK_EXIT(&softc->ipf_nat); 7581 break; 7582 case IPFGENITER_NAT : 7583 ipf_nat_deref(softc, (nat_t **)datap); 7584 break; 7585 case IPFGENITER_STATE : 7586 ipf_state_deref(softc, (ipstate_t **)datap); 7587 break; 7588 case IPFGENITER_FRAG : 7589 ipf_frag_pkt_deref(softc, (ipfr_t **)datap); 7590 break; 7591 case IPFGENITER_NATFRAG : 7592 ipf_frag_nat_deref(softc, (ipfr_t **)datap); 7593 break; 7594 case IPFGENITER_HOSTMAP : 7595 WRITE_ENTER(&softc->ipf_nat); 7596 ipf_nat_hostmapdel(softc, (hostmap_t **)datap); 7597 RWLOCK_EXIT(&softc->ipf_nat); 7598 break; 7599 default : 7600 ipf_lookup_iterderef(softc, token->ipt_type, data); 7601 break; 7602 } 7603 } 7604 7605 ipf_token_unlink(softc, token); 7606 KFREE(token); 7607 return 0; 7608 } 7609 7610 7611 /* ------------------------------------------------------------------------ */ 7612 /* Function: ipf_nextrule */ 7613 /* Returns: frentry_t * - NULL == no more rules, else pointer to next */ 7614 /* Parameters: softc(I) - pointer to soft context main structure */ 7615 /* fr(I) - pointer to filter rule */ 7616 /* out(I) - 1 == out rules, 0 == input rules */ 7617 /* */ 7618 /* Starting with "fr", find the next rule to visit. This includes visiting */ 7619 /* the list of rule groups if either fr is NULL (empty list) or it is the */ 7620 /* last rule in the list. When walking rule lists, it is either input or */ 7621 /* output rules that are returned, never both. */ 7622 /* ------------------------------------------------------------------------ */ 7623 static frentry_t * 7624 ipf_nextrule(ipf_main_softc_t *softc, int active, int unit, 7625 frentry_t *fr, int out) 7626 { 7627 frentry_t *next; 7628 frgroup_t *fg; 7629 7630 if (fr != NULL && fr->fr_group != -1) { 7631 fg = ipf_findgroup(softc, fr->fr_names + fr->fr_group, 7632 unit, active, NULL); 7633 if (fg != NULL) 7634 fg = fg->fg_next; 7635 } else { 7636 fg = softc->ipf_groups[unit][active]; 7637 } 7638 7639 while (fg != NULL) { 7640 next = fg->fg_start; 7641 while (next != NULL) { 7642 if (out) { 7643 if (next->fr_flags & FR_OUTQUE) 7644 return next; 7645 } else if (next->fr_flags & FR_INQUE) { 7646 return next; 7647 } 7648 next = next->fr_next; 7649 } 7650 if (next == NULL) 7651 fg = fg->fg_next; 7652 } 7653 7654 return NULL; 7655 } 7656 7657 /* ------------------------------------------------------------------------ */ 7658 /* Function: ipf_getnextrule */ 7659 /* Returns: int - 0 = success, else error */ 7660 /* Parameters: softc(I)- pointer to soft context main structure */ 7661 /* t(I) - pointer to destination information to resolve */ 7662 /* ptr(I) - pointer to ipfobj_t to copyin from user space */ 7663 /* */ 7664 /* This function's first job is to bring in the ipfruleiter_t structure via */ 7665 /* the ipfobj_t structure to determine what should be the next rule to */ 7666 /* return. Once the ipfruleiter_t has been brought in, it then tries to */ 7667 /* find the 'next rule'. This may include searching rule group lists or */ 7668 /* just be as simple as looking at the 'next' field in the rule structure. */ 7669 /* When we have found the rule to return, increase its reference count and */ 7670 /* if we used an existing rule to get here, decrease its reference count. */ 7671 /* ------------------------------------------------------------------------ */ 7672 int 7673 ipf_getnextrule(ipf_main_softc_t *softc, ipftoken_t *t, void *ptr) 7674 { 7675 frentry_t *fr, *next, zero; 7676 ipfruleiter_t it; 7677 int error, out; 7678 frgroup_t *fg; 7679 ipfobj_t obj; 7680 int predict; 7681 char *dst; 7682 int unit; 7683 7684 if (t == NULL || ptr == NULL) { 7685 IPFERROR(84); 7686 return EFAULT; 7687 } 7688 7689 error = ipf_inobj(softc, ptr, &obj, &it, IPFOBJ_IPFITER); 7690 if (error != 0) 7691 return error; 7692 7693 if ((it.iri_inout < 0) || (it.iri_inout > 3)) { 7694 IPFERROR(85); 7695 return EINVAL; 7696 } 7697 if ((it.iri_active != 0) && (it.iri_active != 1)) { 7698 IPFERROR(86); 7699 return EINVAL; 7700 } 7701 if (it.iri_nrules == 0) { 7702 IPFERROR(87); 7703 return ENOSPC; 7704 } 7705 if (it.iri_rule == NULL) { 7706 IPFERROR(88); 7707 return EFAULT; 7708 } 7709 7710 fg = NULL; 7711 fr = t->ipt_data; 7712 if ((it.iri_inout & F_OUT) != 0) 7713 out = 1; 7714 else 7715 out = 0; 7716 if ((it.iri_inout & F_ACIN) != 0) 7717 unit = IPL_LOGCOUNT; 7718 else 7719 unit = IPL_LOGIPF; 7720 7721 READ_ENTER(&softc->ipf_mutex); 7722 if (fr == NULL) { 7723 if (*it.iri_group == '\0') { 7724 if (unit == IPL_LOGCOUNT) { 7725 next = softc->ipf_acct[out][it.iri_active]; 7726 } else { 7727 next = softc->ipf_rules[out][it.iri_active]; 7728 } 7729 if (next == NULL) 7730 next = ipf_nextrule(softc, it.iri_active, 7731 unit, NULL, out); 7732 } else { 7733 fg = ipf_findgroup(softc, it.iri_group, unit, 7734 it.iri_active, NULL); 7735 if (fg != NULL) 7736 next = fg->fg_start; 7737 else 7738 next = NULL; 7739 } 7740 } else { 7741 next = fr->fr_next; 7742 if (next == NULL) 7743 next = ipf_nextrule(softc, it.iri_active, unit, 7744 fr, out); 7745 } 7746 7747 if (next != NULL && next->fr_next != NULL) 7748 predict = 1; 7749 else if (ipf_nextrule(softc, it.iri_active, unit, next, out) != NULL) 7750 predict = 1; 7751 else 7752 predict = 0; 7753 7754 if (fr != NULL) 7755 (void) ipf_derefrule(softc, &fr); 7756 7757 obj.ipfo_type = IPFOBJ_FRENTRY; 7758 dst = (char *)it.iri_rule; 7759 7760 if (next != NULL) { 7761 obj.ipfo_size = next->fr_size; 7762 MUTEX_ENTER(&next->fr_lock); 7763 next->fr_ref++; 7764 MUTEX_EXIT(&next->fr_lock); 7765 t->ipt_data = next; 7766 } else { 7767 obj.ipfo_size = sizeof(frentry_t); 7768 bzero(&zero, sizeof(zero)); 7769 next = &zero; 7770 t->ipt_data = NULL; 7771 } 7772 it.iri_rule = predict ? next : NULL; 7773 if (predict == 0) 7774 ipf_token_mark_complete(t); 7775 7776 RWLOCK_EXIT(&softc->ipf_mutex); 7777 7778 obj.ipfo_ptr = dst; 7779 error = ipf_outobjk(softc, &obj, next); 7780 if (error == 0 && t->ipt_data != NULL) { 7781 dst += obj.ipfo_size; 7782 if (next->fr_data != NULL) { 7783 ipfobj_t dobj; 7784 7785 if (next->fr_type == FR_T_IPFEXPR) 7786 dobj.ipfo_type = IPFOBJ_IPFEXPR; 7787 else 7788 dobj.ipfo_type = IPFOBJ_FRIPF; 7789 dobj.ipfo_size = next->fr_dsize; 7790 dobj.ipfo_rev = obj.ipfo_rev; 7791 dobj.ipfo_ptr = dst; 7792 error = ipf_outobjk(softc, &dobj, next->fr_data); 7793 } 7794 } 7795 7796 if ((fr != NULL) && (next == &zero)) 7797 (void) ipf_derefrule(softc, &fr); 7798 7799 return error; 7800 } 7801 7802 7803 /* ------------------------------------------------------------------------ */ 7804 /* Function: ipf_frruleiter */ 7805 /* Returns: int - 0 = success, else error */ 7806 /* Parameters: softc(I)- pointer to soft context main structure */ 7807 /* data(I) - the token type to match */ 7808 /* uid(I) - uid owning the token */ 7809 /* ptr(I) - context pointer for the token */ 7810 /* */ 7811 /* This function serves as a stepping stone between ipf_ipf_ioctl and */ 7812 /* ipf_getnextrule. It's role is to find the right token in the kernel for */ 7813 /* the process doing the ioctl and use that to ask for the next rule. */ 7814 /* ------------------------------------------------------------------------ */ 7815 static int 7816 ipf_frruleiter(ipf_main_softc_t *softc, void *data, int uid, void *ctx) 7817 { 7818 ipftoken_t *token; 7819 ipfruleiter_t it; 7820 ipfobj_t obj; 7821 int error; 7822 7823 token = ipf_token_find(softc, IPFGENITER_IPF, uid, ctx); 7824 if (token != NULL) { 7825 error = ipf_getnextrule(softc, token, data); 7826 WRITE_ENTER(&softc->ipf_tokens); 7827 ipf_token_deref(softc, token); 7828 RWLOCK_EXIT(&softc->ipf_tokens); 7829 } else { 7830 error = ipf_inobj(softc, data, &obj, &it, IPFOBJ_IPFITER); 7831 if (error != 0) 7832 return error; 7833 it.iri_rule = NULL; 7834 error = ipf_outobj(softc, data, &it, IPFOBJ_IPFITER); 7835 } 7836 7837 return error; 7838 } 7839 7840 7841 /* ------------------------------------------------------------------------ */ 7842 /* Function: ipf_geniter */ 7843 /* Returns: int - 0 = success, else error */ 7844 /* Parameters: softc(I) - pointer to soft context main structure */ 7845 /* token(I) - pointer to ipftoken_t structure */ 7846 /* itp(I) - pointer to iterator data */ 7847 /* */ 7848 /* Decide which iterator function to call using information passed through */ 7849 /* the ipfgeniter_t structure at itp. */ 7850 /* ------------------------------------------------------------------------ */ 7851 static int 7852 ipf_geniter(ipf_main_softc_t *softc, ipftoken_t *token, ipfgeniter_t *itp) 7853 { 7854 int error; 7855 7856 switch (itp->igi_type) 7857 { 7858 case IPFGENITER_FRAG : 7859 error = ipf_frag_pkt_next(softc, token, itp); 7860 break; 7861 default : 7862 IPFERROR(92); 7863 error = EINVAL; 7864 break; 7865 } 7866 7867 return error; 7868 } 7869 7870 7871 /* ------------------------------------------------------------------------ */ 7872 /* Function: ipf_genericiter */ 7873 /* Returns: int - 0 = success, else error */ 7874 /* Parameters: softc(I)- pointer to soft context main structure */ 7875 /* data(I) - the token type to match */ 7876 /* uid(I) - uid owning the token */ 7877 /* ptr(I) - context pointer for the token */ 7878 /* */ 7879 /* Handle the SIOCGENITER ioctl for the ipfilter device. The primary role */ 7880 /* ------------------------------------------------------------------------ */ 7881 int 7882 ipf_genericiter(ipf_main_softc_t *softc, void *data, int uid, void *ctx) 7883 { 7884 ipftoken_t *token; 7885 ipfgeniter_t iter; 7886 int error; 7887 7888 error = ipf_inobj(softc, data, NULL, &iter, IPFOBJ_GENITER); 7889 if (error != 0) 7890 return error; 7891 7892 token = ipf_token_find(softc, iter.igi_type, uid, ctx); 7893 if (token != NULL) { 7894 token->ipt_subtype = iter.igi_type; 7895 error = ipf_geniter(softc, token, &iter); 7896 WRITE_ENTER(&softc->ipf_tokens); 7897 ipf_token_deref(softc, token); 7898 RWLOCK_EXIT(&softc->ipf_tokens); 7899 } else { 7900 IPFERROR(93); 7901 error = 0; 7902 } 7903 7904 return error; 7905 } 7906 7907 7908 /* ------------------------------------------------------------------------ */ 7909 /* Function: ipf_ipf_ioctl */ 7910 /* Returns: int - 0 = success, else error */ 7911 /* Parameters: softc(I)- pointer to soft context main structure */ 7912 /* data(I) - the token type to match */ 7913 /* cmd(I) - the ioctl command number */ 7914 /* mode(I) - mode flags for the ioctl */ 7915 /* uid(I) - uid owning the token */ 7916 /* ptr(I) - context pointer for the token */ 7917 /* */ 7918 /* This function handles all of the ioctl command that are actually isssued */ 7919 /* to the /dev/ipl device. */ 7920 /* ------------------------------------------------------------------------ */ 7921 int 7922 ipf_ipf_ioctl(ipf_main_softc_t *softc, void *data, ioctlcmd_t cmd, int mode, 7923 int uid, void *ctx) 7924 { 7925 friostat_t fio; 7926 int error, tmp; 7927 ipfobj_t obj; 7928 SPL_INT(s); 7929 7930 switch (cmd) 7931 { 7932 case SIOCFRENB : 7933 if (!(mode & FWRITE)) { 7934 IPFERROR(94); 7935 error = EPERM; 7936 } else { 7937 error = BCOPYIN(data, &tmp, sizeof(tmp)); 7938 if (error != 0) { 7939 IPFERROR(95); 7940 error = EFAULT; 7941 break; 7942 } 7943 7944 WRITE_ENTER(&softc->ipf_global); 7945 if (tmp) { 7946 if (softc->ipf_running > 0) 7947 error = 0; 7948 else 7949 error = ipfattach(softc); 7950 if (error == 0) 7951 softc->ipf_running = 1; 7952 else 7953 (void) ipfdetach(softc); 7954 } else { 7955 if (softc->ipf_running == 1) 7956 error = ipfdetach(softc); 7957 else 7958 error = 0; 7959 if (error == 0) 7960 softc->ipf_running = -1; 7961 } 7962 RWLOCK_EXIT(&softc->ipf_global); 7963 } 7964 break; 7965 7966 case SIOCIPFSET : 7967 if (!(mode & FWRITE)) { 7968 IPFERROR(96); 7969 error = EPERM; 7970 break; 7971 } 7972 /* FALLTHRU */ 7973 case SIOCIPFGETNEXT : 7974 case SIOCIPFGET : 7975 error = ipf_ipftune(softc, cmd, (void *)data); 7976 break; 7977 7978 case SIOCSETFF : 7979 if (!(mode & FWRITE)) { 7980 IPFERROR(97); 7981 error = EPERM; 7982 } else { 7983 error = BCOPYIN(data, &softc->ipf_flags, 7984 sizeof(softc->ipf_flags)); 7985 if (error != 0) { 7986 IPFERROR(98); 7987 error = EFAULT; 7988 } 7989 } 7990 break; 7991 7992 case SIOCGETFF : 7993 error = BCOPYOUT(&softc->ipf_flags, data, 7994 sizeof(softc->ipf_flags)); 7995 if (error != 0) { 7996 IPFERROR(99); 7997 error = EFAULT; 7998 } 7999 break; 8000 8001 case SIOCFUNCL : 8002 error = ipf_resolvefunc(softc, (void *)data); 8003 break; 8004 8005 case SIOCINAFR : 8006 case SIOCRMAFR : 8007 case SIOCADAFR : 8008 case SIOCZRLST : 8009 if (!(mode & FWRITE)) { 8010 IPFERROR(100); 8011 error = EPERM; 8012 } else { 8013 error = frrequest(softc, IPL_LOGIPF, cmd, data, 8014 softc->ipf_active, 1); 8015 } 8016 break; 8017 8018 case SIOCINIFR : 8019 case SIOCRMIFR : 8020 case SIOCADIFR : 8021 if (!(mode & FWRITE)) { 8022 IPFERROR(101); 8023 error = EPERM; 8024 } else { 8025 error = frrequest(softc, IPL_LOGIPF, cmd, data, 8026 1 - softc->ipf_active, 1); 8027 } 8028 break; 8029 8030 case SIOCSWAPA : 8031 if (!(mode & FWRITE)) { 8032 IPFERROR(102); 8033 error = EPERM; 8034 } else { 8035 WRITE_ENTER(&softc->ipf_mutex); 8036 error = BCOPYOUT(&softc->ipf_active, data, 8037 sizeof(softc->ipf_active)); 8038 if (error != 0) { 8039 IPFERROR(103); 8040 error = EFAULT; 8041 } else { 8042 softc->ipf_active = 1 - softc->ipf_active; 8043 } 8044 RWLOCK_EXIT(&softc->ipf_mutex); 8045 } 8046 break; 8047 8048 case SIOCGETFS : 8049 error = ipf_inobj(softc, (void *)data, &obj, &fio, 8050 IPFOBJ_IPFSTAT); 8051 if (error != 0) 8052 break; 8053 ipf_getstat(softc, &fio, obj.ipfo_rev); 8054 error = ipf_outobj(softc, (void *)data, &fio, IPFOBJ_IPFSTAT); 8055 break; 8056 8057 case SIOCFRZST : 8058 if (!(mode & FWRITE)) { 8059 IPFERROR(104); 8060 error = EPERM; 8061 } else 8062 error = ipf_zerostats(softc, data); 8063 break; 8064 8065 case SIOCIPFFL : 8066 if (!(mode & FWRITE)) { 8067 IPFERROR(105); 8068 error = EPERM; 8069 } else { 8070 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8071 if (!error) { 8072 tmp = ipf_flush(softc, IPL_LOGIPF, tmp); 8073 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8074 if (error != 0) { 8075 IPFERROR(106); 8076 error = EFAULT; 8077 } 8078 } else { 8079 IPFERROR(107); 8080 error = EFAULT; 8081 } 8082 } 8083 break; 8084 8085 #ifdef USE_INET6 8086 case SIOCIPFL6 : 8087 if (!(mode & FWRITE)) { 8088 IPFERROR(108); 8089 error = EPERM; 8090 } else { 8091 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8092 if (!error) { 8093 tmp = ipf_flush(softc, IPL_LOGIPF, tmp); 8094 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8095 if (error != 0) { 8096 IPFERROR(109); 8097 error = EFAULT; 8098 } 8099 } else { 8100 IPFERROR(110); 8101 error = EFAULT; 8102 } 8103 } 8104 break; 8105 #endif 8106 8107 case SIOCSTLCK : 8108 if (!(mode & FWRITE)) { 8109 IPFERROR(122); 8110 error = EPERM; 8111 } else { 8112 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8113 if (error == 0) { 8114 ipf_state_setlock(softc->ipf_state_soft, tmp); 8115 ipf_nat_setlock(softc->ipf_nat_soft, tmp); 8116 ipf_frag_setlock(softc->ipf_frag_soft, tmp); 8117 ipf_auth_setlock(softc->ipf_auth_soft, tmp); 8118 } else { 8119 IPFERROR(111); 8120 error = EFAULT; 8121 } 8122 } 8123 break; 8124 8125 #ifdef IPFILTER_LOG 8126 case SIOCIPFFB : 8127 if (!(mode & FWRITE)) { 8128 IPFERROR(112); 8129 error = EPERM; 8130 } else { 8131 tmp = ipf_log_clear(softc, IPL_LOGIPF); 8132 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8133 if (error) { 8134 IPFERROR(113); 8135 error = EFAULT; 8136 } 8137 } 8138 break; 8139 #endif /* IPFILTER_LOG */ 8140 8141 case SIOCFRSYN : 8142 if (!(mode & FWRITE)) { 8143 IPFERROR(114); 8144 error = EPERM; 8145 } else { 8146 WRITE_ENTER(&softc->ipf_global); 8147 #if (defined(MENTAT) && defined(_KERNEL)) && !defined(INSTANCES) 8148 error = ipfsync(); 8149 #else 8150 ipf_sync(softc, NULL); 8151 error = 0; 8152 #endif 8153 RWLOCK_EXIT(&softc->ipf_global); 8154 8155 } 8156 break; 8157 8158 case SIOCGFRST : 8159 error = ipf_outobj(softc, (void *)data, 8160 ipf_frag_stats(softc->ipf_frag_soft), 8161 IPFOBJ_FRAGSTAT); 8162 break; 8163 8164 #ifdef IPFILTER_LOG 8165 case FIONREAD : 8166 tmp = ipf_log_bytesused(softc, IPL_LOGIPF); 8167 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8168 break; 8169 #endif 8170 8171 case SIOCIPFITER : 8172 SPL_SCHED(s); 8173 error = ipf_frruleiter(softc, data, uid, ctx); 8174 SPL_X(s); 8175 break; 8176 8177 case SIOCGENITER : 8178 SPL_SCHED(s); 8179 error = ipf_genericiter(softc, data, uid, ctx); 8180 SPL_X(s); 8181 break; 8182 8183 case SIOCIPFDELTOK : 8184 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8185 if (error == 0) { 8186 SPL_SCHED(s); 8187 error = ipf_token_del(softc, tmp, uid, ctx); 8188 SPL_X(s); 8189 } 8190 break; 8191 8192 default : 8193 IPFERROR(115); 8194 error = EINVAL; 8195 break; 8196 } 8197 8198 return error; 8199 } 8200 8201 8202 /* ------------------------------------------------------------------------ */ 8203 /* Function: ipf_decaps */ 8204 /* Returns: int - -1 == decapsulation failed, else bit mask of */ 8205 /* flags indicating packet filtering decision. */ 8206 /* Parameters: fin(I) - pointer to packet information */ 8207 /* pass(I) - IP protocol version to match */ 8208 /* l5proto(I) - layer 5 protocol to decode UDP data as. */ 8209 /* */ 8210 /* This function is called for packets that are wrapt up in other packets, */ 8211 /* for example, an IP packet that is the entire data segment for another IP */ 8212 /* packet. If the basic constraints for this are satisfied, change the */ 8213 /* buffer to point to the start of the inner packet and start processing */ 8214 /* rules belonging to the head group this rule specifies. */ 8215 /* ------------------------------------------------------------------------ */ 8216 u_32_t 8217 ipf_decaps(fr_info_t *fin, u_32_t pass, int l5proto) 8218 { 8219 fr_info_t fin2, *fino = NULL; 8220 int elen, hlen, nh; 8221 grehdr_t gre; 8222 ip_t *ip; 8223 mb_t *m; 8224 8225 if ((fin->fin_flx & FI_COALESCE) == 0) 8226 if (ipf_coalesce(fin) == -1) 8227 goto cantdecaps; 8228 8229 m = fin->fin_m; 8230 hlen = fin->fin_hlen; 8231 8232 switch (fin->fin_p) 8233 { 8234 case IPPROTO_UDP : 8235 /* 8236 * In this case, the specific protocol being decapsulated 8237 * inside UDP frames comes from the rule. 8238 */ 8239 nh = fin->fin_fr->fr_icode; 8240 break; 8241 8242 case IPPROTO_GRE : /* 47 */ 8243 bcopy(fin->fin_dp, (char *)&gre, sizeof(gre)); 8244 hlen += sizeof(grehdr_t); 8245 if (gre.gr_R|gre.gr_s) 8246 goto cantdecaps; 8247 if (gre.gr_C) 8248 hlen += 4; 8249 if (gre.gr_K) 8250 hlen += 4; 8251 if (gre.gr_S) 8252 hlen += 4; 8253 8254 nh = IPPROTO_IP; 8255 8256 /* 8257 * If the routing options flag is set, validate that it is 8258 * there and bounce over it. 8259 */ 8260 #if 0 8261 /* This is really heavy weight and lots of room for error, */ 8262 /* so for now, put it off and get the simple stuff right. */ 8263 if (gre.gr_R) { 8264 u_char off, len, *s; 8265 u_short af; 8266 int end; 8267 8268 end = 0; 8269 s = fin->fin_dp; 8270 s += hlen; 8271 aplen = fin->fin_plen - hlen; 8272 while (aplen > 3) { 8273 af = (s[0] << 8) | s[1]; 8274 off = s[2]; 8275 len = s[3]; 8276 aplen -= 4; 8277 s += 4; 8278 if (af == 0 && len == 0) { 8279 end = 1; 8280 break; 8281 } 8282 if (aplen < len) 8283 break; 8284 s += len; 8285 aplen -= len; 8286 } 8287 if (end != 1) 8288 goto cantdecaps; 8289 hlen = s - (u_char *)fin->fin_dp; 8290 } 8291 #endif 8292 break; 8293 8294 #ifdef IPPROTO_IPIP 8295 case IPPROTO_IPIP : /* 4 */ 8296 #endif 8297 nh = IPPROTO_IP; 8298 break; 8299 8300 default : /* Includes ESP, AH is special for IPv4 */ 8301 goto cantdecaps; 8302 } 8303 8304 switch (nh) 8305 { 8306 case IPPROTO_IP : 8307 case IPPROTO_IPV6 : 8308 break; 8309 default : 8310 goto cantdecaps; 8311 } 8312 8313 bcopy((char *)fin, (char *)&fin2, sizeof(fin2)); 8314 fino = fin; 8315 fin = &fin2; 8316 elen = hlen; 8317 #if defined(MENTAT) && defined(_KERNEL) 8318 m->b_rptr += elen; 8319 #else 8320 m->m_data += elen; 8321 m->m_len -= elen; 8322 #endif 8323 fin->fin_plen -= elen; 8324 8325 ip = (ip_t *)((char *)fin->fin_ip + elen); 8326 8327 /* 8328 * Make sure we have at least enough data for the network layer 8329 * header. 8330 */ 8331 if (IP_V(ip) == 4) 8332 hlen = IP_HL(ip) << 2; 8333 #ifdef USE_INET6 8334 else if (IP_V(ip) == 6) 8335 hlen = sizeof(ip6_t); 8336 #endif 8337 else 8338 goto cantdecaps2; 8339 8340 if (fin->fin_plen < hlen) 8341 goto cantdecaps2; 8342 8343 fin->fin_dp = (char *)ip + hlen; 8344 8345 if (IP_V(ip) == 4) { 8346 /* 8347 * Perform IPv4 header checksum validation. 8348 */ 8349 if (ipf_cksum((u_short *)ip, hlen)) 8350 goto cantdecaps2; 8351 } 8352 8353 if (ipf_makefrip(hlen, ip, fin) == -1) { 8354 cantdecaps2: 8355 if (m != NULL) { 8356 #if defined(MENTAT) && defined(_KERNEL) 8357 m->b_rptr -= elen; 8358 #else 8359 m->m_data -= elen; 8360 m->m_len += elen; 8361 #endif 8362 } 8363 cantdecaps: 8364 DT1(frb_decapfrip, fr_info_t *, fin); 8365 pass &= ~FR_CMDMASK; 8366 pass |= FR_BLOCK|FR_QUICK; 8367 fin->fin_reason = FRB_DECAPFRIP; 8368 return -1; 8369 } 8370 8371 pass = ipf_scanlist(fin, pass); 8372 8373 /* 8374 * Copy the packet filter "result" fields out of the fr_info_t struct 8375 * that is local to the decapsulation processing and back into the 8376 * one we were called with. 8377 */ 8378 fino->fin_flx = fin->fin_flx; 8379 fino->fin_rev = fin->fin_rev; 8380 fino->fin_icode = fin->fin_icode; 8381 fino->fin_rule = fin->fin_rule; 8382 (void) strncpy(fino->fin_group, fin->fin_group, FR_GROUPLEN); 8383 fino->fin_fr = fin->fin_fr; 8384 fino->fin_error = fin->fin_error; 8385 fino->fin_mp = fin->fin_mp; 8386 fino->fin_m = fin->fin_m; 8387 m = fin->fin_m; 8388 if (m != NULL) { 8389 #if defined(MENTAT) && defined(_KERNEL) 8390 m->b_rptr -= elen; 8391 #else 8392 m->m_data -= elen; 8393 m->m_len += elen; 8394 #endif 8395 } 8396 return pass; 8397 } 8398 8399 8400 /* ------------------------------------------------------------------------ */ 8401 /* Function: ipf_matcharray_load */ 8402 /* Returns: int - 0 = success, else error */ 8403 /* Parameters: softc(I) - pointer to soft context main structure */ 8404 /* data(I) - pointer to ioctl data */ 8405 /* objp(I) - ipfobj_t structure to load data into */ 8406 /* arrayptr(I) - pointer to location to store array pointer */ 8407 /* */ 8408 /* This function loads in a mathing array through the ipfobj_t struct that */ 8409 /* describes it. Sanity checking and array size limitations are enforced */ 8410 /* in this function to prevent userspace from trying to load in something */ 8411 /* that is insanely big. Once the size of the array is known, the memory */ 8412 /* required is malloc'd and returned through changing *arrayptr. The */ 8413 /* contents of the array are verified before returning. Only in the event */ 8414 /* of a successful call is the caller required to free up the malloc area. */ 8415 /* ------------------------------------------------------------------------ */ 8416 int 8417 ipf_matcharray_load(ipf_main_softc_t *softc, void *data, ipfobj_t *objp, 8418 int **arrayptr) 8419 { 8420 int arraysize, *array, error; 8421 8422 *arrayptr = NULL; 8423 8424 error = BCOPYIN(data, objp, sizeof(*objp)); 8425 if (error != 0) { 8426 IPFERROR(116); 8427 return EFAULT; 8428 } 8429 8430 if (objp->ipfo_type != IPFOBJ_IPFEXPR) { 8431 IPFERROR(117); 8432 return EINVAL; 8433 } 8434 8435 if (((objp->ipfo_size & 3) != 0) || (objp->ipfo_size == 0) || 8436 (objp->ipfo_size > 1024)) { 8437 IPFERROR(118); 8438 return EINVAL; 8439 } 8440 8441 arraysize = objp->ipfo_size * sizeof(*array); 8442 KMALLOCS(array, int *, arraysize); 8443 if (array == NULL) { 8444 IPFERROR(119); 8445 return ENOMEM; 8446 } 8447 8448 error = COPYIN(objp->ipfo_ptr, array, arraysize); 8449 if (error != 0) { 8450 KFREES(array, arraysize); 8451 IPFERROR(120); 8452 return EFAULT; 8453 } 8454 8455 if (ipf_matcharray_verify(array, arraysize) != 0) { 8456 KFREES(array, arraysize); 8457 IPFERROR(121); 8458 return EINVAL; 8459 } 8460 8461 *arrayptr = array; 8462 return 0; 8463 } 8464 8465 8466 /* ------------------------------------------------------------------------ */ 8467 /* Function: ipf_matcharray_verify */ 8468 /* Returns: Nil */ 8469 /* Parameters: array(I) - pointer to matching array */ 8470 /* arraysize(I) - number of elements in the array */ 8471 /* */ 8472 /* Verify the contents of a matching array by stepping through each element */ 8473 /* in it. The actual commands in the array are not verified for */ 8474 /* correctness, only that all of the sizes are correctly within limits. */ 8475 /* ------------------------------------------------------------------------ */ 8476 int 8477 ipf_matcharray_verify(int *array, int arraysize) 8478 { 8479 int i, nelem, maxidx; 8480 ipfexp_t *e; 8481 8482 nelem = arraysize / sizeof(*array); 8483 8484 /* 8485 * Currently, it makes no sense to have an array less than 6 8486 * elements long - the initial size at the from, a single operation 8487 * (minimum 4 in length) and a trailer, for a total of 6. 8488 */ 8489 if ((array[0] < 6) || (arraysize < 24) || (arraysize > 4096)) { 8490 return -1; 8491 } 8492 8493 /* 8494 * Verify the size of data pointed to by array with how long 8495 * the array claims to be itself. 8496 */ 8497 if (array[0] * sizeof(*array) != arraysize) { 8498 return -1; 8499 } 8500 8501 maxidx = nelem - 1; 8502 /* 8503 * The last opcode in this array should be an IPF_EXP_END. 8504 */ 8505 if (array[maxidx] != IPF_EXP_END) { 8506 return -1; 8507 } 8508 8509 for (i = 1; i < maxidx; ) { 8510 e = (ipfexp_t *)(array + i); 8511 8512 /* 8513 * The length of the bits to check must be at least 1 8514 * (or else there is nothing to comapre with!) and it 8515 * cannot exceed the length of the data present. 8516 */ 8517 if ((e->ipfe_size < 1 ) || 8518 (e->ipfe_size + i > maxidx)) { 8519 return -1; 8520 } 8521 i += e->ipfe_size; 8522 } 8523 return 0; 8524 } 8525 8526 8527 /* ------------------------------------------------------------------------ */ 8528 /* Function: ipf_fr_matcharray */ 8529 /* Returns: int - 0 = match failed, else positive match */ 8530 /* Parameters: fin(I) - pointer to packet information */ 8531 /* array(I) - pointer to matching array */ 8532 /* */ 8533 /* This function is used to apply a matching array against a packet and */ 8534 /* return an indication of whether or not the packet successfully matches */ 8535 /* all of the commands in it. */ 8536 /* ------------------------------------------------------------------------ */ 8537 static int 8538 ipf_fr_matcharray(fr_info_t *fin, int *array) 8539 { 8540 int i, n, *x, rv, p; 8541 ipfexp_t *e; 8542 8543 rv = 0; 8544 n = array[0]; 8545 x = array + 1; 8546 8547 for (; n > 0; x += 3 + x[3], rv = 0) { 8548 e = (ipfexp_t *)x; 8549 if (e->ipfe_cmd == IPF_EXP_END) 8550 break; 8551 n -= e->ipfe_size; 8552 8553 /* 8554 * The upper 16 bits currently store the protocol value. 8555 * This is currently used with TCP and UDP port compares and 8556 * allows "tcp.port = 80" without requiring an explicit 8557 " "ip.pr = tcp" first. 8558 */ 8559 p = e->ipfe_cmd >> 16; 8560 if ((p != 0) && (p != fin->fin_p)) 8561 break; 8562 8563 switch (e->ipfe_cmd) 8564 { 8565 case IPF_EXP_IP_PR : 8566 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8567 rv |= (fin->fin_p == e->ipfe_arg0[i]); 8568 } 8569 break; 8570 8571 case IPF_EXP_IP_SRCADDR : 8572 if (fin->fin_v != 4) 8573 break; 8574 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8575 rv |= ((fin->fin_saddr & 8576 e->ipfe_arg0[i * 2 + 1]) == 8577 e->ipfe_arg0[i * 2]); 8578 } 8579 break; 8580 8581 case IPF_EXP_IP_DSTADDR : 8582 if (fin->fin_v != 4) 8583 break; 8584 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8585 rv |= ((fin->fin_daddr & 8586 e->ipfe_arg0[i * 2 + 1]) == 8587 e->ipfe_arg0[i * 2]); 8588 } 8589 break; 8590 8591 case IPF_EXP_IP_ADDR : 8592 if (fin->fin_v != 4) 8593 break; 8594 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8595 rv |= ((fin->fin_saddr & 8596 e->ipfe_arg0[i * 2 + 1]) == 8597 e->ipfe_arg0[i * 2]) || 8598 ((fin->fin_daddr & 8599 e->ipfe_arg0[i * 2 + 1]) == 8600 e->ipfe_arg0[i * 2]); 8601 } 8602 break; 8603 8604 #ifdef USE_INET6 8605 case IPF_EXP_IP6_SRCADDR : 8606 if (fin->fin_v != 6) 8607 break; 8608 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8609 rv |= IP6_MASKEQ(&fin->fin_src6, 8610 &e->ipfe_arg0[i * 8 + 4], 8611 &e->ipfe_arg0[i * 8]); 8612 } 8613 break; 8614 8615 case IPF_EXP_IP6_DSTADDR : 8616 if (fin->fin_v != 6) 8617 break; 8618 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8619 rv |= IP6_MASKEQ(&fin->fin_dst6, 8620 &e->ipfe_arg0[i * 8 + 4], 8621 &e->ipfe_arg0[i * 8]); 8622 } 8623 break; 8624 8625 case IPF_EXP_IP6_ADDR : 8626 if (fin->fin_v != 6) 8627 break; 8628 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8629 rv |= IP6_MASKEQ(&fin->fin_src6, 8630 &e->ipfe_arg0[i * 8 + 4], 8631 &e->ipfe_arg0[i * 8]) || 8632 IP6_MASKEQ(&fin->fin_dst6, 8633 &e->ipfe_arg0[i * 8 + 4], 8634 &e->ipfe_arg0[i * 8]); 8635 } 8636 break; 8637 #endif 8638 8639 case IPF_EXP_UDP_PORT : 8640 case IPF_EXP_TCP_PORT : 8641 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8642 rv |= (fin->fin_sport == e->ipfe_arg0[i]) || 8643 (fin->fin_dport == e->ipfe_arg0[i]); 8644 } 8645 break; 8646 8647 case IPF_EXP_UDP_SPORT : 8648 case IPF_EXP_TCP_SPORT : 8649 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8650 rv |= (fin->fin_sport == e->ipfe_arg0[i]); 8651 } 8652 break; 8653 8654 case IPF_EXP_UDP_DPORT : 8655 case IPF_EXP_TCP_DPORT : 8656 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8657 rv |= (fin->fin_dport == e->ipfe_arg0[i]); 8658 } 8659 break; 8660 8661 case IPF_EXP_TCP_FLAGS : 8662 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8663 rv |= ((fin->fin_tcpf & 8664 e->ipfe_arg0[i * 2 + 1]) == 8665 e->ipfe_arg0[i * 2]); 8666 } 8667 break; 8668 } 8669 rv ^= e->ipfe_not; 8670 8671 if (rv == 0) 8672 break; 8673 } 8674 8675 return rv; 8676 } 8677 8678 8679 /* ------------------------------------------------------------------------ */ 8680 /* Function: ipf_queueflush */ 8681 /* Returns: int - number of entries flushed (0 = none) */ 8682 /* Parameters: softc(I) - pointer to soft context main structure */ 8683 /* deletefn(I) - function to call to delete entry */ 8684 /* ipfqs(I) - top of the list of ipf internal queues */ 8685 /* userqs(I) - top of the list of user defined timeouts */ 8686 /* */ 8687 /* This fucntion gets called when the state/NAT hash tables fill up and we */ 8688 /* need to try a bit harder to free up some space. The algorithm used here */ 8689 /* split into two parts but both halves have the same goal: to reduce the */ 8690 /* number of connections considered to be "active" to the low watermark. */ 8691 /* There are two steps in doing this: */ 8692 /* 1) Remove any TCP connections that are already considered to be "closed" */ 8693 /* but have not yet been removed from the state table. The two states */ 8694 /* TCPS_TIME_WAIT and TCPS_CLOSED are considered to be the perfect */ 8695 /* candidates for this style of removal. If freeing up entries in */ 8696 /* CLOSED or both CLOSED and TIME_WAIT brings us to the low watermark, */ 8697 /* we do not go on to step 2. */ 8698 /* */ 8699 /* 2) Look for the oldest entries on each timeout queue and free them if */ 8700 /* they are within the given window we are considering. Where the */ 8701 /* window starts and the steps taken to increase its size depend upon */ 8702 /* how long ipf has been running (ipf_ticks.) Anything modified in the */ 8703 /* last 30 seconds is not touched. */ 8704 /* touched */ 8705 /* die ipf_ticks 30*1.5 1800*1.5 | 43200*1.5 */ 8706 /* | | | | | | */ 8707 /* future <--+----------+--------+-----------+-----+-----+-----------> past */ 8708 /* now \_int=30s_/ \_int=1hr_/ \_int=12hr */ 8709 /* */ 8710 /* Points to note: */ 8711 /* - tqe_die is the time, in the future, when entries die. */ 8712 /* - tqe_die - ipf_ticks is how long left the connection has to live in ipf */ 8713 /* ticks. */ 8714 /* - tqe_touched is when the entry was last used by NAT/state */ 8715 /* - the closer tqe_touched is to ipf_ticks, the further tqe_die will be */ 8716 /* ipf_ticks any given timeout queue and vice versa. */ 8717 /* - both tqe_die and tqe_touched increase over time */ 8718 /* - timeout queues are sorted with the highest value of tqe_die at the */ 8719 /* bottom and therefore the smallest values of each are at the top */ 8720 /* - the pointer passed in as ipfqs should point to an array of timeout */ 8721 /* queues representing each of the TCP states */ 8722 /* */ 8723 /* We start by setting up a maximum range to scan for things to move of */ 8724 /* iend (newest) to istart (oldest) in chunks of "interval". If nothing is */ 8725 /* found in that range, "interval" is adjusted (so long as it isn't 30) and */ 8726 /* we start again with a new value for "iend" and "istart". This is */ 8727 /* continued until we either finish the scan of 30 second intervals or the */ 8728 /* low water mark is reached. */ 8729 /* ------------------------------------------------------------------------ */ 8730 int 8731 ipf_queueflush(ipf_main_softc_t *softc, ipftq_delete_fn_t deletefn, 8732 ipftq_t *ipfqs, ipftq_t *userqs, u_int *activep, int size, int low) 8733 { 8734 u_long interval, istart, iend; 8735 ipftq_t *ifq, *ifqnext; 8736 ipftqent_t *tqe, *tqn; 8737 int removed = 0; 8738 8739 for (tqn = ipfqs[IPF_TCPS_CLOSED].ifq_head; ((tqe = tqn) != NULL); ) { 8740 tqn = tqe->tqe_next; 8741 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 8742 removed++; 8743 } 8744 if ((*activep * 100 / size) > low) { 8745 for (tqn = ipfqs[IPF_TCPS_TIME_WAIT].ifq_head; 8746 ((tqe = tqn) != NULL); ) { 8747 tqn = tqe->tqe_next; 8748 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 8749 removed++; 8750 } 8751 } 8752 8753 if ((*activep * 100 / size) <= low) { 8754 return removed; 8755 } 8756 8757 /* 8758 * NOTE: Use of "* 15 / 10" is required here because if "* 1.5" is 8759 * used then the operations are upgraded to floating point 8760 * and kernels don't like floating point... 8761 */ 8762 if (softc->ipf_ticks > IPF_TTLVAL(43200 * 15 / 10)) { 8763 istart = IPF_TTLVAL(86400 * 4); 8764 interval = IPF_TTLVAL(43200); 8765 } else if (softc->ipf_ticks > IPF_TTLVAL(1800 * 15 / 10)) { 8766 istart = IPF_TTLVAL(43200); 8767 interval = IPF_TTLVAL(1800); 8768 } else if (softc->ipf_ticks > IPF_TTLVAL(30 * 15 / 10)) { 8769 istart = IPF_TTLVAL(1800); 8770 interval = IPF_TTLVAL(30); 8771 } else { 8772 return 0; 8773 } 8774 if (istart > softc->ipf_ticks) { 8775 if (softc->ipf_ticks - interval < interval) 8776 istart = interval; 8777 else 8778 istart = (softc->ipf_ticks / interval) * interval; 8779 } 8780 8781 iend = softc->ipf_ticks - interval; 8782 8783 while ((*activep * 100 / size) > low) { 8784 u_long try; 8785 8786 try = softc->ipf_ticks - istart; 8787 8788 for (ifq = ipfqs; ifq != NULL; ifq = ifq->ifq_next) { 8789 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 8790 if (try < tqe->tqe_touched) 8791 break; 8792 tqn = tqe->tqe_next; 8793 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 8794 removed++; 8795 } 8796 } 8797 8798 for (ifq = userqs; ifq != NULL; ifq = ifqnext) { 8799 ifqnext = ifq->ifq_next; 8800 8801 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 8802 if (try < tqe->tqe_touched) 8803 break; 8804 tqn = tqe->tqe_next; 8805 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 8806 removed++; 8807 } 8808 } 8809 8810 if (try >= iend) { 8811 if (interval == IPF_TTLVAL(43200)) { 8812 interval = IPF_TTLVAL(1800); 8813 } else if (interval == IPF_TTLVAL(1800)) { 8814 interval = IPF_TTLVAL(30); 8815 } else { 8816 break; 8817 } 8818 if (interval >= softc->ipf_ticks) 8819 break; 8820 8821 iend = softc->ipf_ticks - interval; 8822 } 8823 istart -= interval; 8824 } 8825 8826 return removed; 8827 } 8828 8829 8830 /* ------------------------------------------------------------------------ */ 8831 /* Function: ipf_deliverlocal */ 8832 /* Returns: int - 1 = local address, 0 = non-local address */ 8833 /* Parameters: softc(I) - pointer to soft context main structure */ 8834 /* ipversion(I) - IP protocol version (4 or 6) */ 8835 /* ifp(I) - network interface pointer */ 8836 /* ipaddr(I) - IPv4/6 destination address */ 8837 /* */ 8838 /* This fucntion is used to determine in the address "ipaddr" belongs to */ 8839 /* the network interface represented by ifp. */ 8840 /* ------------------------------------------------------------------------ */ 8841 int 8842 ipf_deliverlocal(ipf_main_softc_t *softc, int ipversion, void *ifp, 8843 i6addr_t *ipaddr) 8844 { 8845 i6addr_t addr; 8846 int islocal = 0; 8847 8848 if (ipversion == 4) { 8849 if (ipf_ifpaddr(softc, 4, FRI_NORMAL, ifp, &addr, NULL) == 0) { 8850 if (addr.in4.s_addr == ipaddr->in4.s_addr) 8851 islocal = 1; 8852 } 8853 8854 #ifdef USE_INET6 8855 } else if (ipversion == 6) { 8856 if (ipf_ifpaddr(softc, 6, FRI_NORMAL, ifp, &addr, NULL) == 0) { 8857 if (IP6_EQ(&addr, ipaddr)) 8858 islocal = 1; 8859 } 8860 #endif 8861 } 8862 8863 return islocal; 8864 } 8865 8866 8867 /* ------------------------------------------------------------------------ */ 8868 /* Function: ipf_settimeout */ 8869 /* Returns: int - 0 = success, -1 = failure */ 8870 /* Parameters: softc(I) - pointer to soft context main structure */ 8871 /* t(I) - pointer to tuneable array entry */ 8872 /* p(I) - pointer to values passed in to apply */ 8873 /* */ 8874 /* This function is called to set the timeout values for each distinct */ 8875 /* queue timeout that is available. When called, it calls into both the */ 8876 /* state and NAT code, telling them to update their timeout queues. */ 8877 /* ------------------------------------------------------------------------ */ 8878 static int 8879 ipf_settimeout(struct ipf_main_softc_s *softc, ipftuneable_t *t, 8880 ipftuneval_t *p) 8881 { 8882 8883 /* 8884 * ipf_interror should be set by the functions called here, not 8885 * by this function - it's just a middle man. 8886 */ 8887 if (ipf_state_settimeout(softc, t, p) == -1) 8888 return -1; 8889 if (ipf_nat_settimeout(softc, t, p) == -1) 8890 return -1; 8891 return 0; 8892 } 8893 8894 8895 /* ------------------------------------------------------------------------ */ 8896 /* Function: ipf_apply_timeout */ 8897 /* Returns: int - 0 = success, -1 = failure */ 8898 /* Parameters: head(I) - pointer to tuneable array entry */ 8899 /* seconds(I) - pointer to values passed in to apply */ 8900 /* */ 8901 /* This function applies a timeout of "seconds" to the timeout queue that */ 8902 /* is pointed to by "head". All entries on this list have an expiration */ 8903 /* set to be the current tick value of ipf plus the ttl. Given that this */ 8904 /* function should only be called when the delta is non-zero, the task is */ 8905 /* to walk the entire list and apply the change. The sort order will not */ 8906 /* change. The only catch is that this is O(n) across the list, so if the */ 8907 /* queue has lots of entries (10s of thousands or 100s of thousands), it */ 8908 /* could take a relatively long time to work through them all. */ 8909 /* ------------------------------------------------------------------------ */ 8910 void 8911 ipf_apply_timeout(ipftq_t *head, u_int seconds) 8912 { 8913 u_int oldtimeout, newtimeout; 8914 ipftqent_t *tqe; 8915 int delta; 8916 8917 MUTEX_ENTER(&head->ifq_lock); 8918 oldtimeout = head->ifq_ttl; 8919 newtimeout = IPF_TTLVAL(seconds); 8920 delta = oldtimeout - newtimeout; 8921 8922 head->ifq_ttl = newtimeout; 8923 8924 for (tqe = head->ifq_head; tqe != NULL; tqe = tqe->tqe_next) { 8925 tqe->tqe_die += delta; 8926 } 8927 MUTEX_EXIT(&head->ifq_lock); 8928 } 8929 8930 8931 /* ------------------------------------------------------------------------ */ 8932 /* Function: ipf_settimeout_tcp */ 8933 /* Returns: int - 0 = successfully applied, -1 = failed */ 8934 /* Parameters: t(I) - pointer to tuneable to change */ 8935 /* p(I) - pointer to new timeout information */ 8936 /* tab(I) - pointer to table of TCP queues */ 8937 /* */ 8938 /* This function applies the new timeout (p) to the TCP tunable (t) and */ 8939 /* updates all of the entries on the relevant timeout queue by calling */ 8940 /* ipf_apply_timeout(). */ 8941 /* ------------------------------------------------------------------------ */ 8942 int 8943 ipf_settimeout_tcp(ipftuneable_t *t, ipftuneval_t *p, ipftq_t *tab) 8944 { 8945 if (!strcmp(t->ipft_name, "tcp_idle_timeout") || 8946 !strcmp(t->ipft_name, "tcp_established")) { 8947 ipf_apply_timeout(&tab[IPF_TCPS_ESTABLISHED], p->ipftu_int); 8948 } else if (!strcmp(t->ipft_name, "tcp_close_wait")) { 8949 ipf_apply_timeout(&tab[IPF_TCPS_CLOSE_WAIT], p->ipftu_int); 8950 } else if (!strcmp(t->ipft_name, "tcp_last_ack")) { 8951 ipf_apply_timeout(&tab[IPF_TCPS_LAST_ACK], p->ipftu_int); 8952 } else if (!strcmp(t->ipft_name, "tcp_timeout")) { 8953 ipf_apply_timeout(&tab[IPF_TCPS_LISTEN], p->ipftu_int); 8954 ipf_apply_timeout(&tab[IPF_TCPS_HALF_ESTAB], p->ipftu_int); 8955 ipf_apply_timeout(&tab[IPF_TCPS_CLOSING], p->ipftu_int); 8956 } else if (!strcmp(t->ipft_name, "tcp_listen")) { 8957 ipf_apply_timeout(&tab[IPF_TCPS_LISTEN], p->ipftu_int); 8958 } else if (!strcmp(t->ipft_name, "tcp_half_established")) { 8959 ipf_apply_timeout(&tab[IPF_TCPS_HALF_ESTAB], p->ipftu_int); 8960 } else if (!strcmp(t->ipft_name, "tcp_closing")) { 8961 ipf_apply_timeout(&tab[IPF_TCPS_CLOSING], p->ipftu_int); 8962 } else if (!strcmp(t->ipft_name, "tcp_syn_received")) { 8963 ipf_apply_timeout(&tab[IPF_TCPS_SYN_RECEIVED], p->ipftu_int); 8964 } else if (!strcmp(t->ipft_name, "tcp_syn_sent")) { 8965 ipf_apply_timeout(&tab[IPF_TCPS_SYN_SENT], p->ipftu_int); 8966 } else if (!strcmp(t->ipft_name, "tcp_closed")) { 8967 ipf_apply_timeout(&tab[IPF_TCPS_CLOSED], p->ipftu_int); 8968 } else if (!strcmp(t->ipft_name, "tcp_half_closed")) { 8969 ipf_apply_timeout(&tab[IPF_TCPS_CLOSED], p->ipftu_int); 8970 } else if (!strcmp(t->ipft_name, "tcp_time_wait")) { 8971 ipf_apply_timeout(&tab[IPF_TCPS_TIME_WAIT], p->ipftu_int); 8972 } else { 8973 /* 8974 * ipf_interror isn't set here because it should be set 8975 * by whatever called this function. 8976 */ 8977 return -1; 8978 } 8979 return 0; 8980 } 8981 8982 8983 /* ------------------------------------------------------------------------ */ 8984 /* Function: ipf_main_soft_create */ 8985 /* Returns: NULL = failure, else success */ 8986 /* Parameters: arg(I) - pointer to soft context structure if already allocd */ 8987 /* */ 8988 /* Create the foundation soft context structure. In circumstances where it */ 8989 /* is not required to dynamically allocate the context, a pointer can be */ 8990 /* passed in (rather than NULL) to a structure to be initialised. */ 8991 /* The main thing of interest is that a number of locks are initialised */ 8992 /* here instead of in the where might be expected - in the relevant create */ 8993 /* function elsewhere. This is done because the current locking design has */ 8994 /* some areas where these locks are used outside of their module. */ 8995 /* Possibly the most important exercise that is done here is setting of all */ 8996 /* the timeout values, allowing them to be changed before init(). */ 8997 /* ------------------------------------------------------------------------ */ 8998 void * 8999 ipf_main_soft_create(void *arg) 9000 { 9001 ipf_main_softc_t *softc; 9002 9003 if (arg == NULL) { 9004 KMALLOC(softc, ipf_main_softc_t *); 9005 if (softc == NULL) 9006 return NULL; 9007 } else { 9008 softc = arg; 9009 } 9010 9011 bzero((char *)softc, sizeof(*softc)); 9012 9013 /* 9014 * This serves as a flag as to whether or not the softc should be 9015 * free'd when _destroy is called. 9016 */ 9017 softc->ipf_dynamic_softc = (arg == NULL) ? 1 : 0; 9018 9019 softc->ipf_tuners = ipf_tune_array_copy(softc, 9020 sizeof(ipf_main_tuneables), 9021 ipf_main_tuneables); 9022 if (softc->ipf_tuners == NULL) { 9023 ipf_main_soft_destroy(softc); 9024 return NULL; 9025 } 9026 9027 MUTEX_INIT(&softc->ipf_rw, "ipf rw mutex"); 9028 MUTEX_INIT(&softc->ipf_timeoutlock, "ipf timeout lock"); 9029 RWLOCK_INIT(&softc->ipf_global, "ipf filter load/unload mutex"); 9030 RWLOCK_INIT(&softc->ipf_mutex, "ipf filter rwlock"); 9031 RWLOCK_INIT(&softc->ipf_tokens, "ipf token rwlock"); 9032 RWLOCK_INIT(&softc->ipf_state, "ipf state rwlock"); 9033 RWLOCK_INIT(&softc->ipf_nat, "ipf IP NAT rwlock"); 9034 RWLOCK_INIT(&softc->ipf_poolrw, "ipf pool rwlock"); 9035 RWLOCK_INIT(&softc->ipf_frag, "ipf frag rwlock"); 9036 9037 softc->ipf_token_head = NULL; 9038 softc->ipf_token_tail = &softc->ipf_token_head; 9039 9040 softc->ipf_tcpidletimeout = FIVE_DAYS; 9041 softc->ipf_tcpclosewait = IPF_TTLVAL(2 * TCP_MSL); 9042 softc->ipf_tcplastack = IPF_TTLVAL(30); 9043 softc->ipf_tcptimewait = IPF_TTLVAL(2 * TCP_MSL); 9044 softc->ipf_tcptimeout = IPF_TTLVAL(2 * TCP_MSL); 9045 softc->ipf_tcpsynsent = IPF_TTLVAL(2 * TCP_MSL); 9046 softc->ipf_tcpsynrecv = IPF_TTLVAL(2 * TCP_MSL); 9047 softc->ipf_tcpclosed = IPF_TTLVAL(30); 9048 softc->ipf_tcphalfclosed = IPF_TTLVAL(2 * 3600); 9049 softc->ipf_udptimeout = IPF_TTLVAL(120); 9050 softc->ipf_udpacktimeout = IPF_TTLVAL(12); 9051 softc->ipf_icmptimeout = IPF_TTLVAL(60); 9052 softc->ipf_icmpacktimeout = IPF_TTLVAL(6); 9053 softc->ipf_iptimeout = IPF_TTLVAL(60); 9054 9055 #if defined(IPFILTER_DEFAULT_BLOCK) 9056 softc->ipf_pass = FR_BLOCK|FR_NOMATCH; 9057 #else 9058 softc->ipf_pass = (IPF_DEFAULT_PASS)|FR_NOMATCH; 9059 #endif 9060 softc->ipf_minttl = 4; 9061 softc->ipf_icmpminfragmtu = 68; 9062 softc->ipf_flags = IPF_LOGGING; 9063 9064 return softc; 9065 } 9066 9067 /* ------------------------------------------------------------------------ */ 9068 /* Function: ipf_main_soft_init */ 9069 /* Returns: 0 = success, -1 = failure */ 9070 /* Parameters: softc(I) - pointer to soft context main structure */ 9071 /* */ 9072 /* A null-op function that exists as a placeholder so that the flow in */ 9073 /* other functions is obvious. */ 9074 /* ------------------------------------------------------------------------ */ 9075 /*ARGSUSED*/ 9076 int 9077 ipf_main_soft_init(ipf_main_softc_t *softc) 9078 { 9079 return 0; 9080 } 9081 9082 9083 /* ------------------------------------------------------------------------ */ 9084 /* Function: ipf_main_soft_destroy */ 9085 /* Returns: void */ 9086 /* Parameters: softc(I) - pointer to soft context main structure */ 9087 /* */ 9088 /* Undo everything that we did in ipf_main_soft_create. */ 9089 /* */ 9090 /* The most important check that needs to be made here is whether or not */ 9091 /* the structure was allocated by ipf_main_soft_create() by checking what */ 9092 /* value is stored in ipf_dynamic_main. */ 9093 /* ------------------------------------------------------------------------ */ 9094 /*ARGSUSED*/ 9095 void 9096 ipf_main_soft_destroy(ipf_main_softc_t *softc) 9097 { 9098 9099 RW_DESTROY(&softc->ipf_frag); 9100 RW_DESTROY(&softc->ipf_poolrw); 9101 RW_DESTROY(&softc->ipf_nat); 9102 RW_DESTROY(&softc->ipf_state); 9103 RW_DESTROY(&softc->ipf_tokens); 9104 RW_DESTROY(&softc->ipf_mutex); 9105 RW_DESTROY(&softc->ipf_global); 9106 MUTEX_DESTROY(&softc->ipf_timeoutlock); 9107 MUTEX_DESTROY(&softc->ipf_rw); 9108 9109 if (softc->ipf_tuners != NULL) { 9110 KFREES(softc->ipf_tuners, sizeof(ipf_main_tuneables)); 9111 } 9112 if (softc->ipf_dynamic_softc == 1) { 9113 KFREE(softc); 9114 } 9115 } 9116 9117 9118 /* ------------------------------------------------------------------------ */ 9119 /* Function: ipf_main_soft_fini */ 9120 /* Returns: 0 = success, -1 = failure */ 9121 /* Parameters: softc(I) - pointer to soft context main structure */ 9122 /* */ 9123 /* Clean out the rules which have been added since _init was last called, */ 9124 /* the only dynamic part of the mainline. */ 9125 /* ------------------------------------------------------------------------ */ 9126 int 9127 ipf_main_soft_fini(ipf_main_softc_t *softc) 9128 { 9129 (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE|FR_INACTIVE); 9130 (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE); 9131 (void) ipf_flush(softc, IPL_LOGCOUNT, FR_INQUE|FR_OUTQUE|FR_INACTIVE); 9132 (void) ipf_flush(softc, IPL_LOGCOUNT, FR_INQUE|FR_OUTQUE); 9133 9134 return 0; 9135 } 9136 9137 9138 /* ------------------------------------------------------------------------ */ 9139 /* Function: ipf_main_load */ 9140 /* Returns: 0 = success, -1 = failure */ 9141 /* Parameters: none */ 9142 /* */ 9143 /* Handle global initialisation that needs to be done for the base part of */ 9144 /* IPFilter. At present this just amounts to initialising some ICMP lookup */ 9145 /* arrays that get used by the state/NAT code. */ 9146 /* ------------------------------------------------------------------------ */ 9147 int 9148 ipf_main_load(void) 9149 { 9150 int i; 9151 9152 /* fill icmp reply type table */ 9153 for (i = 0; i <= ICMP_MAXTYPE; i++) 9154 icmpreplytype4[i] = -1; 9155 icmpreplytype4[ICMP_ECHO] = ICMP_ECHOREPLY; 9156 icmpreplytype4[ICMP_TSTAMP] = ICMP_TSTAMPREPLY; 9157 icmpreplytype4[ICMP_IREQ] = ICMP_IREQREPLY; 9158 icmpreplytype4[ICMP_MASKREQ] = ICMP_MASKREPLY; 9159 9160 #ifdef USE_INET6 9161 /* fill icmp reply type table */ 9162 for (i = 0; i <= ICMP6_MAXTYPE; i++) 9163 icmpreplytype6[i] = -1; 9164 icmpreplytype6[ICMP6_ECHO_REQUEST] = ICMP6_ECHO_REPLY; 9165 icmpreplytype6[ICMP6_MEMBERSHIP_QUERY] = ICMP6_MEMBERSHIP_REPORT; 9166 icmpreplytype6[ICMP6_NI_QUERY] = ICMP6_NI_REPLY; 9167 icmpreplytype6[ND_ROUTER_SOLICIT] = ND_ROUTER_ADVERT; 9168 icmpreplytype6[ND_NEIGHBOR_SOLICIT] = ND_NEIGHBOR_ADVERT; 9169 #endif 9170 9171 return 0; 9172 } 9173 9174 9175 /* ------------------------------------------------------------------------ */ 9176 /* Function: ipf_main_unload */ 9177 /* Returns: 0 = success, -1 = failure */ 9178 /* Parameters: none */ 9179 /* */ 9180 /* A null-op function that exists as a placeholder so that the flow in */ 9181 /* other functions is obvious. */ 9182 /* ------------------------------------------------------------------------ */ 9183 int 9184 ipf_main_unload(void) 9185 { 9186 return 0; 9187 } 9188 9189 9190 /* ------------------------------------------------------------------------ */ 9191 /* Function: ipf_load_all */ 9192 /* Returns: 0 = success, -1 = failure */ 9193 /* Parameters: none */ 9194 /* */ 9195 /* Work through all of the subsystems inside IPFilter and call the load */ 9196 /* function for each in an order that won't lead to a crash :) */ 9197 /* ------------------------------------------------------------------------ */ 9198 int 9199 ipf_load_all(void) 9200 { 9201 if (ipf_main_load() == -1) 9202 return -1; 9203 9204 if (ipf_state_main_load() == -1) 9205 return -1; 9206 9207 if (ipf_nat_main_load() == -1) 9208 return -1; 9209 9210 if (ipf_frag_main_load() == -1) 9211 return -1; 9212 9213 if (ipf_auth_main_load() == -1) 9214 return -1; 9215 9216 if (ipf_proxy_main_load() == -1) 9217 return -1; 9218 9219 return 0; 9220 } 9221 9222 9223 /* ------------------------------------------------------------------------ */ 9224 /* Function: ipf_unload_all */ 9225 /* Returns: 0 = success, -1 = failure */ 9226 /* Parameters: none */ 9227 /* */ 9228 /* Work through all of the subsystems inside IPFilter and call the unload */ 9229 /* function for each in an order that won't lead to a crash :) */ 9230 /* ------------------------------------------------------------------------ */ 9231 int 9232 ipf_unload_all(void) 9233 { 9234 if (ipf_proxy_main_unload() == -1) 9235 return -1; 9236 9237 if (ipf_auth_main_unload() == -1) 9238 return -1; 9239 9240 if (ipf_frag_main_unload() == -1) 9241 return -1; 9242 9243 if (ipf_nat_main_unload() == -1) 9244 return -1; 9245 9246 if (ipf_state_main_unload() == -1) 9247 return -1; 9248 9249 if (ipf_main_unload() == -1) 9250 return -1; 9251 9252 return 0; 9253 } 9254 9255 9256 /* ------------------------------------------------------------------------ */ 9257 /* Function: ipf_create_all */ 9258 /* Returns: NULL = failure, else success */ 9259 /* Parameters: arg(I) - pointer to soft context main structure */ 9260 /* */ 9261 /* Work through all of the subsystems inside IPFilter and call the create */ 9262 /* function for each in an order that won't lead to a crash :) */ 9263 /* ------------------------------------------------------------------------ */ 9264 ipf_main_softc_t * 9265 ipf_create_all(void *arg) 9266 { 9267 ipf_main_softc_t *softc; 9268 9269 softc = ipf_main_soft_create(arg); 9270 if (softc == NULL) 9271 return NULL; 9272 9273 #ifdef IPFILTER_LOG 9274 softc->ipf_log_soft = ipf_log_soft_create(softc); 9275 if (softc->ipf_log_soft == NULL) { 9276 ipf_destroy_all(softc); 9277 return NULL; 9278 } 9279 #endif 9280 9281 softc->ipf_lookup_soft = ipf_lookup_soft_create(softc); 9282 if (softc->ipf_lookup_soft == NULL) { 9283 ipf_destroy_all(softc); 9284 return NULL; 9285 } 9286 9287 softc->ipf_sync_soft = ipf_sync_soft_create(softc); 9288 if (softc->ipf_sync_soft == NULL) { 9289 ipf_destroy_all(softc); 9290 return NULL; 9291 } 9292 9293 softc->ipf_state_soft = ipf_state_soft_create(softc); 9294 if (softc->ipf_state_soft == NULL) { 9295 ipf_destroy_all(softc); 9296 return NULL; 9297 } 9298 9299 softc->ipf_nat_soft = ipf_nat_soft_create(softc); 9300 if (softc->ipf_nat_soft == NULL) { 9301 ipf_destroy_all(softc); 9302 return NULL; 9303 } 9304 9305 softc->ipf_frag_soft = ipf_frag_soft_create(softc); 9306 if (softc->ipf_frag_soft == NULL) { 9307 ipf_destroy_all(softc); 9308 return NULL; 9309 } 9310 9311 softc->ipf_auth_soft = ipf_auth_soft_create(softc); 9312 if (softc->ipf_auth_soft == NULL) { 9313 ipf_destroy_all(softc); 9314 return NULL; 9315 } 9316 9317 softc->ipf_proxy_soft = ipf_proxy_soft_create(softc); 9318 if (softc->ipf_proxy_soft == NULL) { 9319 ipf_destroy_all(softc); 9320 return NULL; 9321 } 9322 9323 return softc; 9324 } 9325 9326 9327 /* ------------------------------------------------------------------------ */ 9328 /* Function: ipf_destroy_all */ 9329 /* Returns: void */ 9330 /* Parameters: softc(I) - pointer to soft context main structure */ 9331 /* */ 9332 /* Work through all of the subsystems inside IPFilter and call the destroy */ 9333 /* function for each in an order that won't lead to a crash :) */ 9334 /* */ 9335 /* Every one of these functions is expected to succeed, so there is no */ 9336 /* checking of return values. */ 9337 /* ------------------------------------------------------------------------ */ 9338 void 9339 ipf_destroy_all(ipf_main_softc_t *softc) 9340 { 9341 9342 if (softc->ipf_state_soft != NULL) { 9343 ipf_state_soft_destroy(softc, softc->ipf_state_soft); 9344 softc->ipf_state_soft = NULL; 9345 } 9346 9347 if (softc->ipf_nat_soft != NULL) { 9348 ipf_nat_soft_destroy(softc, softc->ipf_nat_soft); 9349 softc->ipf_nat_soft = NULL; 9350 } 9351 9352 if (softc->ipf_frag_soft != NULL) { 9353 ipf_frag_soft_destroy(softc, softc->ipf_frag_soft); 9354 softc->ipf_frag_soft = NULL; 9355 } 9356 9357 if (softc->ipf_auth_soft != NULL) { 9358 ipf_auth_soft_destroy(softc, softc->ipf_auth_soft); 9359 softc->ipf_auth_soft = NULL; 9360 } 9361 9362 if (softc->ipf_proxy_soft != NULL) { 9363 ipf_proxy_soft_destroy(softc, softc->ipf_proxy_soft); 9364 softc->ipf_proxy_soft = NULL; 9365 } 9366 9367 if (softc->ipf_sync_soft != NULL) { 9368 ipf_sync_soft_destroy(softc, softc->ipf_sync_soft); 9369 softc->ipf_sync_soft = NULL; 9370 } 9371 9372 if (softc->ipf_lookup_soft != NULL) { 9373 ipf_lookup_soft_destroy(softc, softc->ipf_lookup_soft); 9374 softc->ipf_lookup_soft = NULL; 9375 } 9376 9377 #ifdef IPFILTER_LOG 9378 if (softc->ipf_log_soft != NULL) { 9379 ipf_log_soft_destroy(softc, softc->ipf_log_soft); 9380 softc->ipf_log_soft = NULL; 9381 } 9382 #endif 9383 9384 ipf_main_soft_destroy(softc); 9385 } 9386 9387 9388 /* ------------------------------------------------------------------------ */ 9389 /* Function: ipf_init_all */ 9390 /* Returns: 0 = success, -1 = failure */ 9391 /* Parameters: softc(I) - pointer to soft context main structure */ 9392 /* */ 9393 /* Work through all of the subsystems inside IPFilter and call the init */ 9394 /* function for each in an order that won't lead to a crash :) */ 9395 /* ------------------------------------------------------------------------ */ 9396 int 9397 ipf_init_all(ipf_main_softc_t *softc) 9398 { 9399 9400 if (ipf_main_soft_init(softc) == -1) 9401 return -1; 9402 9403 #ifdef IPFILTER_LOG 9404 if (ipf_log_soft_init(softc, softc->ipf_log_soft) == -1) 9405 return -1; 9406 #endif 9407 9408 if (ipf_lookup_soft_init(softc, softc->ipf_lookup_soft) == -1) 9409 return -1; 9410 9411 if (ipf_sync_soft_init(softc, softc->ipf_sync_soft) == -1) 9412 return -1; 9413 9414 if (ipf_state_soft_init(softc, softc->ipf_state_soft) == -1) 9415 return -1; 9416 9417 if (ipf_nat_soft_init(softc, softc->ipf_nat_soft) == -1) 9418 return -1; 9419 9420 if (ipf_frag_soft_init(softc, softc->ipf_frag_soft) == -1) 9421 return -1; 9422 9423 if (ipf_auth_soft_init(softc, softc->ipf_auth_soft) == -1) 9424 return -1; 9425 9426 if (ipf_proxy_soft_init(softc, softc->ipf_proxy_soft) == -1) 9427 return -1; 9428 9429 return 0; 9430 } 9431 9432 9433 /* ------------------------------------------------------------------------ */ 9434 /* Function: ipf_fini_all */ 9435 /* Returns: 0 = success, -1 = failure */ 9436 /* Parameters: softc(I) - pointer to soft context main structure */ 9437 /* */ 9438 /* Work through all of the subsystems inside IPFilter and call the fini */ 9439 /* function for each in an order that won't lead to a crash :) */ 9440 /* ------------------------------------------------------------------------ */ 9441 int 9442 ipf_fini_all(ipf_main_softc_t *softc) 9443 { 9444 9445 ipf_token_flush(softc); 9446 9447 if (ipf_proxy_soft_fini(softc, softc->ipf_proxy_soft) == -1) 9448 return -1; 9449 9450 if (ipf_auth_soft_fini(softc, softc->ipf_auth_soft) == -1) 9451 return -1; 9452 9453 if (ipf_frag_soft_fini(softc, softc->ipf_frag_soft) == -1) 9454 return -1; 9455 9456 if (ipf_nat_soft_fini(softc, softc->ipf_nat_soft) == -1) 9457 return -1; 9458 9459 if (ipf_state_soft_fini(softc, softc->ipf_state_soft) == -1) 9460 return -1; 9461 9462 if (ipf_sync_soft_fini(softc, softc->ipf_sync_soft) == -1) 9463 return -1; 9464 9465 if (ipf_lookup_soft_fini(softc, softc->ipf_lookup_soft) == -1) 9466 return -1; 9467 9468 #ifdef IPFILTER_LOG 9469 if (ipf_log_soft_fini(softc, softc->ipf_log_soft) == -1) 9470 return -1; 9471 #endif 9472 9473 if (ipf_main_soft_fini(softc) == -1) 9474 return -1; 9475 9476 return 0; 9477 } 9478 9479 9480 /* ------------------------------------------------------------------------ */ 9481 /* Function: ipf_rule_expire */ 9482 /* Returns: Nil */ 9483 /* Parameters: softc(I) - pointer to soft context main structure */ 9484 /* */ 9485 /* At present this function exists just to support temporary addition of */ 9486 /* firewall rules. Both inactive and active lists are scanned for items to */ 9487 /* purge, as by rights, the expiration is computed as soon as the rule is */ 9488 /* loaded in. */ 9489 /* ------------------------------------------------------------------------ */ 9490 void 9491 ipf_rule_expire(ipf_main_softc_t *softc) 9492 { 9493 frentry_t *fr; 9494 9495 if ((softc->ipf_rule_explist[0] == NULL) && 9496 (softc->ipf_rule_explist[1] == NULL)) 9497 return; 9498 9499 WRITE_ENTER(&softc->ipf_mutex); 9500 9501 while ((fr = softc->ipf_rule_explist[0]) != NULL) { 9502 /* 9503 * Because the list is kept sorted on insertion, the fist 9504 * one that dies in the future means no more work to do. 9505 */ 9506 if (fr->fr_die > softc->ipf_ticks) 9507 break; 9508 ipf_rule_delete(softc, fr, IPL_LOGIPF, 0); 9509 } 9510 9511 while ((fr = softc->ipf_rule_explist[1]) != NULL) { 9512 /* 9513 * Because the list is kept sorted on insertion, the fist 9514 * one that dies in the future means no more work to do. 9515 */ 9516 if (fr->fr_die > softc->ipf_ticks) 9517 break; 9518 ipf_rule_delete(softc, fr, IPL_LOGIPF, 1); 9519 } 9520 9521 RWLOCK_EXIT(&softc->ipf_mutex); 9522 } 9523 9524 9525 static int ipf_ht_node_cmp(const struct host_node_s *, const struct host_node_s *); 9526 static void ipf_ht_node_make_key(host_track_t *, host_node_t *, int, 9527 i6addr_t *); 9528 9529 RBI_CODE(ipf_rb, host_node_t, hn_entry, ipf_ht_node_cmp) 9530 9531 9532 /* ------------------------------------------------------------------------ */ 9533 /* Function: ipf_ht_node_cmp */ 9534 /* Returns: int - 0 == nodes are the same, .. */ 9535 /* Parameters: k1(I) - pointer to first key to compare */ 9536 /* k2(I) - pointer to second key to compare */ 9537 /* */ 9538 /* The "key" for the node is a combination of two fields: the address */ 9539 /* family and the address itself. */ 9540 /* */ 9541 /* Because we're not actually interpreting the address data, it isn't */ 9542 /* necessary to convert them to/from network/host byte order. The mask is */ 9543 /* just used to remove bits that aren't significant - it doesn't matter */ 9544 /* where they are, as long as they're always in the same place. */ 9545 /* */ 9546 /* As with IP6_EQ, comparing IPv6 addresses starts at the bottom because */ 9547 /* this is where individual ones will differ the most - but not true for */ 9548 /* for /48's, etc. */ 9549 /* ------------------------------------------------------------------------ */ 9550 static int 9551 ipf_ht_node_cmp(const struct host_node_s *k1, const struct host_node_s *k2) 9552 { 9553 int i; 9554 9555 i = (k2->hn_addr.adf_family - k1->hn_addr.adf_family); 9556 if (i != 0) 9557 return i; 9558 9559 if (k1->hn_addr.adf_family == AF_INET) 9560 return (k2->hn_addr.adf_addr.in4.s_addr - 9561 k1->hn_addr.adf_addr.in4.s_addr); 9562 9563 i = k2->hn_addr.adf_addr.i6[3] - k1->hn_addr.adf_addr.i6[3]; 9564 if (i != 0) 9565 return i; 9566 i = k2->hn_addr.adf_addr.i6[2] - k1->hn_addr.adf_addr.i6[2]; 9567 if (i != 0) 9568 return i; 9569 i = k2->hn_addr.adf_addr.i6[1] - k1->hn_addr.adf_addr.i6[1]; 9570 if (i != 0) 9571 return i; 9572 i = k2->hn_addr.adf_addr.i6[0] - k1->hn_addr.adf_addr.i6[0]; 9573 return i; 9574 } 9575 9576 9577 /* ------------------------------------------------------------------------ */ 9578 /* Function: ipf_ht_node_make_key */ 9579 /* Returns: Nil */ 9580 /* parameters: htp(I) - pointer to address tracking structure */ 9581 /* key(I) - where to store masked address for lookup */ 9582 /* family(I) - protocol family of address */ 9583 /* addr(I) - pointer to network address */ 9584 /* */ 9585 /* Using the "netmask" (number of bits) stored parent host tracking struct, */ 9586 /* copy the address passed in into the key structure whilst masking out the */ 9587 /* bits that we don't want. */ 9588 /* */ 9589 /* Because the parser will set ht_netmask to 128 if there is no protocol */ 9590 /* specified (the parser doesn't know if it should be a v4 or v6 rule), we */ 9591 /* have to be wary of that and not allow 32-128 to happen. */ 9592 /* ------------------------------------------------------------------------ */ 9593 static void 9594 ipf_ht_node_make_key(host_track_t *htp, host_node_t *key, int family, 9595 i6addr_t *addr) 9596 { 9597 key->hn_addr.adf_family = family; 9598 if (family == AF_INET) { 9599 u_32_t mask; 9600 int bits; 9601 9602 key->hn_addr.adf_len = sizeof(key->hn_addr.adf_addr.in4); 9603 bits = htp->ht_netmask; 9604 if (bits >= 32) { 9605 mask = 0xffffffff; 9606 } else { 9607 mask = htonl(0xffffffff << (32 - bits)); 9608 } 9609 key->hn_addr.adf_addr.in4.s_addr = addr->in4.s_addr & mask; 9610 #ifdef USE_INET6 9611 } else { 9612 int bits = htp->ht_netmask; 9613 9614 key->hn_addr.adf_len = sizeof(key->hn_addr.adf_addr.in6); 9615 if (bits > 96) { 9616 key->hn_addr.adf_addr.i6[3] = addr->i6[3] & 9617 htonl(0xffffffff << (128 - bits)); 9618 key->hn_addr.adf_addr.i6[2] = addr->i6[2]; 9619 key->hn_addr.adf_addr.i6[1] = addr->i6[2]; 9620 key->hn_addr.adf_addr.i6[0] = addr->i6[2]; 9621 } else if (bits > 64) { 9622 key->hn_addr.adf_addr.i6[3] = 0; 9623 key->hn_addr.adf_addr.i6[2] = addr->i6[2] & 9624 htonl(0xffffffff << (96 - bits)); 9625 key->hn_addr.adf_addr.i6[1] = addr->i6[1]; 9626 key->hn_addr.adf_addr.i6[0] = addr->i6[0]; 9627 } else if (bits > 32) { 9628 key->hn_addr.adf_addr.i6[3] = 0; 9629 key->hn_addr.adf_addr.i6[2] = 0; 9630 key->hn_addr.adf_addr.i6[1] = addr->i6[1] & 9631 htonl(0xffffffff << (64 - bits)); 9632 key->hn_addr.adf_addr.i6[0] = addr->i6[0]; 9633 } else { 9634 key->hn_addr.adf_addr.i6[3] = 0; 9635 key->hn_addr.adf_addr.i6[2] = 0; 9636 key->hn_addr.adf_addr.i6[1] = 0; 9637 key->hn_addr.adf_addr.i6[0] = addr->i6[0] & 9638 htonl(0xffffffff << (32 - bits)); 9639 } 9640 #endif 9641 } 9642 } 9643 9644 9645 /* ------------------------------------------------------------------------ */ 9646 /* Function: ipf_ht_node_add */ 9647 /* Returns: int - 0 == success, -1 == failure */ 9648 /* Parameters: softc(I) - pointer to soft context main structure */ 9649 /* htp(I) - pointer to address tracking structure */ 9650 /* family(I) - protocol family of address */ 9651 /* addr(I) - pointer to network address */ 9652 /* */ 9653 /* NOTE: THIS FUNCTION MUST BE CALLED WITH AN EXCLUSIVE LOCK THAT PREVENTS */ 9654 /* ipf_ht_node_del FROM RUNNING CONCURRENTLY ON THE SAME htp. */ 9655 /* */ 9656 /* After preparing the key with the address information to find, look in */ 9657 /* the red-black tree to see if the address is known. A successful call to */ 9658 /* this function can mean one of two things: a new node was added to the */ 9659 /* tree or a matching node exists and we're able to bump up its activity. */ 9660 /* ------------------------------------------------------------------------ */ 9661 int 9662 ipf_ht_node_add(ipf_main_softc_t *softc, host_track_t *htp, int family, 9663 i6addr_t *addr) 9664 { 9665 host_node_t *h; 9666 host_node_t k; 9667 9668 ipf_ht_node_make_key(htp, &k, family, addr); 9669 9670 h = RBI_SEARCH(ipf_rb, &htp->ht_root, &k); 9671 if (h == NULL) { 9672 if (htp->ht_cur_nodes >= htp->ht_max_nodes) 9673 return -1; 9674 KMALLOC(h, host_node_t *); 9675 if (h == NULL) { 9676 DT(ipf_rb_no_mem); 9677 LBUMP(ipf_rb_no_mem); 9678 return -1; 9679 } 9680 9681 /* 9682 * If there was a macro to initialise the RB node then that 9683 * would get used here, but there isn't... 9684 */ 9685 bzero((char *)h, sizeof(*h)); 9686 h->hn_addr = k.hn_addr; 9687 h->hn_addr.adf_family = k.hn_addr.adf_family; 9688 RBI_INSERT(ipf_rb, &htp->ht_root, h); 9689 htp->ht_cur_nodes++; 9690 } else { 9691 if ((htp->ht_max_per_node != 0) && 9692 (h->hn_active >= htp->ht_max_per_node)) { 9693 DT(ipf_rb_node_max); 9694 LBUMP(ipf_rb_node_max); 9695 return -1; 9696 } 9697 } 9698 9699 h->hn_active++; 9700 9701 return 0; 9702 } 9703 9704 9705 /* ------------------------------------------------------------------------ */ 9706 /* Function: ipf_ht_node_del */ 9707 /* Returns: int - 0 == success, -1 == failure */ 9708 /* parameters: htp(I) - pointer to address tracking structure */ 9709 /* family(I) - protocol family of address */ 9710 /* addr(I) - pointer to network address */ 9711 /* */ 9712 /* NOTE: THIS FUNCTION MUST BE CALLED WITH AN EXCLUSIVE LOCK THAT PREVENTS */ 9713 /* ipf_ht_node_add FROM RUNNING CONCURRENTLY ON THE SAME htp. */ 9714 /* */ 9715 /* Try and find the address passed in amongst the leaves on this tree to */ 9716 /* be friend. If found then drop the active account for that node drops by */ 9717 /* one. If that count reaches 0, it is time to free it all up. */ 9718 /* ------------------------------------------------------------------------ */ 9719 int 9720 ipf_ht_node_del(host_track_t *htp, int family, i6addr_t *addr) 9721 { 9722 host_node_t *h; 9723 host_node_t k; 9724 9725 ipf_ht_node_make_key(htp, &k, family, addr); 9726 9727 h = RBI_SEARCH(ipf_rb, &htp->ht_root, &k); 9728 if (h == NULL) { 9729 return -1; 9730 } else { 9731 h->hn_active--; 9732 if (h->hn_active == 0) { 9733 (void) RBI_DELETE(ipf_rb, &htp->ht_root, h); 9734 htp->ht_cur_nodes--; 9735 KFREE(h); 9736 } 9737 } 9738 9739 return 0; 9740 } 9741 9742 9743 /* ------------------------------------------------------------------------ */ 9744 /* Function: ipf_rb_ht_init */ 9745 /* Returns: Nil */ 9746 /* Parameters: head(I) - pointer to host tracking structure */ 9747 /* */ 9748 /* Initialise the host tracking structure to be ready for use above. */ 9749 /* ------------------------------------------------------------------------ */ 9750 void 9751 ipf_rb_ht_init(host_track_t *head) 9752 { 9753 memset(head, 0, sizeof(*head)); 9754 RBI_INIT(ipf_rb, &head->ht_root); 9755 } 9756 9757 9758 /* ------------------------------------------------------------------------ */ 9759 /* Function: ipf_rb_ht_freenode */ 9760 /* Returns: Nil */ 9761 /* Parameters: head(I) - pointer to host tracking structure */ 9762 /* arg(I) - additional argument from walk caller */ 9763 /* */ 9764 /* Free an actual host_node_t structure. */ 9765 /* ------------------------------------------------------------------------ */ 9766 void 9767 ipf_rb_ht_freenode(host_node_t *node, void *arg) 9768 { 9769 KFREE(node); 9770 } 9771 9772 9773 /* ------------------------------------------------------------------------ */ 9774 /* Function: ipf_rb_ht_flush */ 9775 /* Returns: Nil */ 9776 /* Parameters: head(I) - pointer to host tracking structure */ 9777 /* */ 9778 /* Remove all of the nodes in the tree tracking hosts by calling a walker */ 9779 /* and free'ing each one. */ 9780 /* ------------------------------------------------------------------------ */ 9781 void 9782 ipf_rb_ht_flush(host_track_t *head) 9783 { 9784 /* XXX - May use node members after freeing the node. */ 9785 RBI_WALK(ipf_rb, &head->ht_root, ipf_rb_ht_freenode, NULL); 9786 } 9787 9788 9789 /* ------------------------------------------------------------------------ */ 9790 /* Function: ipf_slowtimer */ 9791 /* Returns: Nil */ 9792 /* Parameters: ptr(I) - pointer to main ipf soft context structure */ 9793 /* */ 9794 /* Slowly expire held state for fragments. Timeouts are set * in */ 9795 /* expectation of this being called twice per second. */ 9796 /* ------------------------------------------------------------------------ */ 9797 void 9798 ipf_slowtimer(ipf_main_softc_t *softc) 9799 { 9800 9801 ipf_token_expire(softc); 9802 ipf_frag_expire(softc); 9803 ipf_state_expire(softc); 9804 ipf_nat_expire(softc); 9805 ipf_auth_expire(softc); 9806 ipf_lookup_expire(softc); 9807 ipf_rule_expire(softc); 9808 ipf_sync_expire(softc); 9809 softc->ipf_ticks++; 9810 # if defined(__OpenBSD__) 9811 timeout_add(&ipf_slowtimer_ch, hz/2); 9812 # endif 9813 } 9814 9815 9816 /* ------------------------------------------------------------------------ */ 9817 /* Function: ipf_inet_mask_add */ 9818 /* Returns: Nil */ 9819 /* Parameters: bits(I) - pointer to nat context information */ 9820 /* mtab(I) - pointer to mask hash table structure */ 9821 /* */ 9822 /* When called, bits represents the mask of a new NAT rule that has just */ 9823 /* been added. This function inserts a bitmask into the array of masks to */ 9824 /* search when searching for a matching NAT rule for a packet. */ 9825 /* Prevention of duplicate masks is achieved by checking the use count for */ 9826 /* a given netmask. */ 9827 /* ------------------------------------------------------------------------ */ 9828 void 9829 ipf_inet_mask_add(int bits, ipf_v4_masktab_t *mtab) 9830 { 9831 u_32_t mask; 9832 int i, j; 9833 9834 mtab->imt4_masks[bits]++; 9835 if (mtab->imt4_masks[bits] > 1) 9836 return; 9837 9838 if (bits == 0) 9839 mask = 0; 9840 else 9841 mask = 0xffffffff << (32 - bits); 9842 9843 for (i = 0; i < 33; i++) { 9844 if (ntohl(mtab->imt4_active[i]) < mask) { 9845 for (j = 32; j > i; j--) 9846 mtab->imt4_active[j] = mtab->imt4_active[j - 1]; 9847 mtab->imt4_active[i] = htonl(mask); 9848 break; 9849 } 9850 } 9851 mtab->imt4_max++; 9852 } 9853 9854 9855 /* ------------------------------------------------------------------------ */ 9856 /* Function: ipf_inet_mask_del */ 9857 /* Returns: Nil */ 9858 /* Parameters: bits(I) - number of bits set in the netmask */ 9859 /* mtab(I) - pointer to mask hash table structure */ 9860 /* */ 9861 /* Remove the 32bit bitmask represented by "bits" from the collection of */ 9862 /* netmasks stored inside of mtab. */ 9863 /* ------------------------------------------------------------------------ */ 9864 void 9865 ipf_inet_mask_del(int bits, ipf_v4_masktab_t *mtab) 9866 { 9867 u_32_t mask; 9868 int i, j; 9869 9870 mtab->imt4_masks[bits]--; 9871 if (mtab->imt4_masks[bits] > 0) 9872 return; 9873 9874 mask = htonl(0xffffffff << (32 - bits)); 9875 for (i = 0; i < 33; i++) { 9876 if (mtab->imt4_active[i] == mask) { 9877 for (j = i + 1; j < 33; j++) 9878 mtab->imt4_active[j - 1] = mtab->imt4_active[j]; 9879 break; 9880 } 9881 } 9882 mtab->imt4_max--; 9883 ASSERT(mtab->imt4_max >= 0); 9884 } 9885 9886 9887 #ifdef USE_INET6 9888 /* ------------------------------------------------------------------------ */ 9889 /* Function: ipf_inet6_mask_add */ 9890 /* Returns: Nil */ 9891 /* Parameters: bits(I) - number of bits set in mask */ 9892 /* mask(I) - pointer to mask to add */ 9893 /* mtab(I) - pointer to mask hash table structure */ 9894 /* */ 9895 /* When called, bitcount represents the mask of a IPv6 NAT map rule that */ 9896 /* has just been added. This function inserts a bitmask into the array of */ 9897 /* masks to search when searching for a matching NAT rule for a packet. */ 9898 /* Prevention of duplicate masks is achieved by checking the use count for */ 9899 /* a given netmask. */ 9900 /* ------------------------------------------------------------------------ */ 9901 void 9902 ipf_inet6_mask_add(int bits, i6addr_t *mask, ipf_v6_masktab_t *mtab) 9903 { 9904 i6addr_t zero; 9905 int i, j; 9906 9907 mtab->imt6_masks[bits]++; 9908 if (mtab->imt6_masks[bits] > 1) 9909 return; 9910 9911 if (bits == 0) { 9912 mask = &zero; 9913 zero.i6[0] = 0; 9914 zero.i6[1] = 0; 9915 zero.i6[2] = 0; 9916 zero.i6[3] = 0; 9917 } 9918 9919 for (i = 0; i < 129; i++) { 9920 if (IP6_LT(&mtab->imt6_active[i], mask)) { 9921 for (j = 128; j > i; j--) 9922 mtab->imt6_active[j] = mtab->imt6_active[j - 1]; 9923 mtab->imt6_active[i] = *mask; 9924 break; 9925 } 9926 } 9927 mtab->imt6_max++; 9928 } 9929 9930 9931 /* ------------------------------------------------------------------------ */ 9932 /* Function: ipf_inet6_mask_del */ 9933 /* Returns: Nil */ 9934 /* Parameters: bits(I) - number of bits set in mask */ 9935 /* mask(I) - pointer to mask to remove */ 9936 /* mtab(I) - pointer to mask hash table structure */ 9937 /* */ 9938 /* Remove the 128bit bitmask represented by "bits" from the collection of */ 9939 /* netmasks stored inside of mtab. */ 9940 /* ------------------------------------------------------------------------ */ 9941 void 9942 ipf_inet6_mask_del(int bits, i6addr_t *mask, ipf_v6_masktab_t *mtab) 9943 { 9944 i6addr_t zero; 9945 int i, j; 9946 9947 mtab->imt6_masks[bits]--; 9948 if (mtab->imt6_masks[bits] > 0) 9949 return; 9950 9951 if (bits == 0) 9952 mask = &zero; 9953 zero.i6[0] = 0; 9954 zero.i6[1] = 0; 9955 zero.i6[2] = 0; 9956 zero.i6[3] = 0; 9957 9958 for (i = 0; i < 129; i++) { 9959 if (IP6_EQ(&mtab->imt6_active[i], mask)) { 9960 for (j = i + 1; j < 129; j++) { 9961 mtab->imt6_active[j - 1] = mtab->imt6_active[j]; 9962 if (IP6_EQ(&mtab->imt6_active[j - 1], &zero)) 9963 break; 9964 } 9965 break; 9966 } 9967 } 9968 mtab->imt6_max--; 9969 ASSERT(mtab->imt6_max >= 0); 9970 } 9971 #endif 9972
Indexes created Sat Sep 20 22:09:52 GMT 2025