1 /* $NetBSD: pf_norm.c,v 1.30 2023/08/07 23:28:58 mrg Exp $ */ 2 /* $OpenBSD: pf_norm.c,v 1.109 2007/05/28 17:16:39 henning Exp $ */ 3 4 /* 5 * Copyright 2001 Niels Provos <provos (at) citi.umich.edu> 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 __KERNEL_RCSID(0, "$NetBSD: pf_norm.c,v 1.30 2023/08/07 23:28:58 mrg Exp $"); 31 32 #ifdef _KERNEL_OPT 33 #include "opt_inet.h" 34 #endif 35 36 #include "pflog.h" 37 38 #include <sys/param.h> 39 #include <sys/systm.h> 40 #include <sys/mbuf.h> 41 #include <sys/filio.h> 42 #include <sys/fcntl.h> 43 #include <sys/socket.h> 44 #include <sys/kernel.h> 45 #include <sys/time.h> 46 #include <sys/pool.h> 47 48 #ifdef __NetBSD__ 49 #include <sys/cprng.h> 50 #else 51 #include <dev/rndvar.h> 52 #endif /* !__NetBSD__ */ 53 #include <net/if.h> 54 #include <net/if_types.h> 55 #include <net/bpf.h> 56 #include <net/route.h> 57 #include <net/if_pflog.h> 58 59 #include <netinet/in.h> 60 #include <netinet/in_var.h> 61 #include <netinet/in_systm.h> 62 #include <netinet/ip.h> 63 #include <netinet/ip_var.h> 64 #include <netinet/tcp.h> 65 #include <netinet/tcp_seq.h> 66 #include <netinet/udp.h> 67 #include <netinet/ip_icmp.h> 68 69 #ifdef INET6 70 #include <netinet/ip6.h> 71 #endif /* INET6 */ 72 73 #include <net/pfvar.h> 74 75 struct pf_frent { 76 LIST_ENTRY(pf_frent) fr_next; 77 struct ip *fr_ip; 78 struct mbuf *fr_m; 79 }; 80 81 struct pf_frcache { 82 LIST_ENTRY(pf_frcache) fr_next; 83 uint16_t fr_off; 84 uint16_t fr_end; 85 }; 86 87 #define PFFRAG_SEENLAST 0x0001 /* Seen the last fragment for this */ 88 #define PFFRAG_NOBUFFER 0x0002 /* Non-buffering fragment cache */ 89 #define PFFRAG_DROP 0x0004 /* Drop all fragments */ 90 #define BUFFER_FRAGMENTS(fr) (!((fr)->fr_flags & PFFRAG_NOBUFFER)) 91 92 struct pf_fragment { 93 RB_ENTRY(pf_fragment) fr_entry; 94 TAILQ_ENTRY(pf_fragment) frag_next; 95 struct in_addr fr_src; 96 struct in_addr fr_dst; 97 u_int8_t fr_p; /* protocol of this fragment */ 98 u_int8_t fr_flags; /* status flags */ 99 u_int16_t fr_id; /* fragment id for reassemble */ 100 u_int16_t fr_max; /* fragment data max */ 101 u_int32_t fr_timeout; 102 #define fr_queue fr_u.fru_queue 103 #define fr_cache fr_u.fru_cache 104 union { 105 LIST_HEAD(pf_fragq, pf_frent) fru_queue; /* buffering */ 106 LIST_HEAD(pf_cacheq, pf_frcache) fru_cache; /* non-buf */ 107 } fr_u; 108 }; 109 110 TAILQ_HEAD(pf_fragqueue, pf_fragment) pf_fragqueue; 111 TAILQ_HEAD(pf_cachequeue, pf_fragment) pf_cachequeue; 112 113 static __inline int pf_frag_compare(struct pf_fragment *, 114 struct pf_fragment *); 115 RB_HEAD(pf_frag_tree, pf_fragment) pf_frag_tree, pf_cache_tree; 116 RB_PROTOTYPE(pf_frag_tree, pf_fragment, fr_entry, pf_frag_compare); 117 RB_GENERATE(pf_frag_tree, pf_fragment, fr_entry, pf_frag_compare); 118 119 /* Private prototypes */ 120 void pf_ip2key(struct pf_fragment *, struct ip *); 121 void pf_remove_fragment(struct pf_fragment *); 122 void pf_flush_fragments(void); 123 void pf_free_fragment(struct pf_fragment *); 124 struct pf_fragment *pf_find_fragment(struct ip *, struct pf_frag_tree *); 125 struct mbuf *pf_reassemble(struct mbuf **, struct pf_fragment **, 126 struct pf_frent *, int); 127 struct mbuf *pf_fragcache(struct mbuf **, struct ip*, 128 struct pf_fragment **, int, int, int *); 129 int pf_normalize_tcpopt(struct pf_rule *, struct mbuf *, 130 struct tcphdr *, int); 131 132 #define DPFPRINTF(x) do { \ 133 if (pf_status.debug >= PF_DEBUG_MISC) { \ 134 printf("%s: ", __func__); \ 135 printf x ; \ 136 } \ 137 } while(0) 138 139 /* Globals */ 140 struct pool pf_frent_pl, pf_frag_pl, pf_cache_pl, pf_cent_pl; 141 struct pool pf_state_scrub_pl; 142 int pf_nfrents, pf_ncache; 143 144 void 145 pf_normalize_init(void) 146 { 147 #ifdef __NetBSD__ 148 pool_init(&pf_frent_pl, sizeof(struct pf_frent), 0, 0, 0, "pffrent", 149 NULL, IPL_SOFTNET); 150 pool_init(&pf_frag_pl, sizeof(struct pf_fragment), 0, 0, 0, "pffrag", 151 NULL, IPL_SOFTNET); 152 pool_init(&pf_cache_pl, sizeof(struct pf_fragment), 0, 0, 0, 153 "pffrcache", NULL, IPL_SOFTNET); 154 pool_init(&pf_cent_pl, sizeof(struct pf_frcache), 0, 0, 0, "pffrcent", 155 NULL, IPL_SOFTNET); 156 pool_init(&pf_state_scrub_pl, sizeof(struct pf_state_scrub), 0, 0, 0, 157 "pfstscr", NULL, IPL_SOFTNET); 158 #else 159 pool_init(&pf_frent_pl, sizeof(struct pf_frent), 0, 0, 0, "pffrent", 160 NULL); 161 pool_init(&pf_frag_pl, sizeof(struct pf_fragment), 0, 0, 0, "pffrag", 162 NULL); 163 pool_init(&pf_cache_pl, sizeof(struct pf_fragment), 0, 0, 0, 164 "pffrcache", NULL); 165 pool_init(&pf_cent_pl, sizeof(struct pf_frcache), 0, 0, 0, "pffrcent", 166 NULL); 167 pool_init(&pf_state_scrub_pl, sizeof(struct pf_state_scrub), 0, 0, 0, 168 "pfstscr", NULL); 169 #endif /* !__NetBSD__ */ 170 171 pool_sethiwat(&pf_frag_pl, PFFRAG_FRAG_HIWAT); 172 pool_sethardlimit(&pf_frent_pl, PFFRAG_FRENT_HIWAT, NULL, 0); 173 pool_sethardlimit(&pf_cache_pl, PFFRAG_FRCACHE_HIWAT, NULL, 0); 174 pool_sethardlimit(&pf_cent_pl, PFFRAG_FRCENT_HIWAT, NULL, 0); 175 176 TAILQ_INIT(&pf_fragqueue); 177 TAILQ_INIT(&pf_cachequeue); 178 } 179 180 #ifdef _MODULE 181 void 182 pf_normalize_destroy(void) 183 { 184 pool_destroy(&pf_state_scrub_pl); 185 pool_destroy(&pf_cent_pl); 186 pool_destroy(&pf_cache_pl); 187 pool_destroy(&pf_frag_pl); 188 pool_destroy(&pf_frent_pl); 189 } 190 #endif /* _MODULE */ 191 192 static __inline int 193 pf_frag_compare(struct pf_fragment *a, struct pf_fragment *b) 194 { 195 int diff; 196 197 if ((diff = a->fr_id - b->fr_id)) 198 return (diff); 199 else if ((diff = a->fr_p - b->fr_p)) 200 return (diff); 201 else if (a->fr_src.s_addr < b->fr_src.s_addr) 202 return (-1); 203 else if (a->fr_src.s_addr > b->fr_src.s_addr) 204 return (1); 205 else if (a->fr_dst.s_addr < b->fr_dst.s_addr) 206 return (-1); 207 else if (a->fr_dst.s_addr > b->fr_dst.s_addr) 208 return (1); 209 return (0); 210 } 211 212 void 213 pf_purge_expired_fragments(void) 214 { 215 struct pf_fragment *frag; 216 u_int32_t expire = time_second - 217 pf_default_rule.timeout[PFTM_FRAG]; 218 219 while ((frag = TAILQ_LAST(&pf_fragqueue, pf_fragqueue)) != NULL) { 220 KASSERT(BUFFER_FRAGMENTS(frag)); 221 if (frag->fr_timeout > expire) 222 break; 223 224 DPFPRINTF(("expiring %d(%p)\n", frag->fr_id, frag)); 225 pf_free_fragment(frag); 226 } 227 228 while ((frag = TAILQ_LAST(&pf_cachequeue, pf_cachequeue)) != NULL) { 229 KASSERT(!BUFFER_FRAGMENTS(frag)); 230 if (frag->fr_timeout > expire) 231 break; 232 233 DPFPRINTF(("expiring %d(%p)\n", frag->fr_id, frag)); 234 pf_free_fragment(frag); 235 KASSERT(TAILQ_EMPTY(&pf_cachequeue) || 236 TAILQ_LAST(&pf_cachequeue, pf_cachequeue) != frag); 237 } 238 } 239 240 /* 241 * Try to flush old fragments to make space for new ones 242 */ 243 244 void 245 pf_flush_fragments(void) 246 { 247 struct pf_fragment *frag; 248 int goal; 249 250 goal = pf_nfrents * 9 / 10; 251 DPFPRINTF(("trying to free > %d frents\n", 252 pf_nfrents - goal)); 253 while (goal < pf_nfrents) { 254 frag = TAILQ_LAST(&pf_fragqueue, pf_fragqueue); 255 if (frag == NULL) 256 break; 257 pf_free_fragment(frag); 258 } 259 260 261 goal = pf_ncache * 9 / 10; 262 DPFPRINTF(("trying to free > %d cache entries\n", 263 pf_ncache - goal)); 264 while (goal < pf_ncache) { 265 frag = TAILQ_LAST(&pf_cachequeue, pf_cachequeue); 266 if (frag == NULL) 267 break; 268 pf_free_fragment(frag); 269 } 270 } 271 272 /* Frees the fragments and all associated entries */ 273 274 void 275 pf_free_fragment(struct pf_fragment *frag) 276 { 277 struct pf_frent *frent; 278 struct pf_frcache *frcache; 279 280 /* Free all fragments */ 281 if (BUFFER_FRAGMENTS(frag)) { 282 for (frent = LIST_FIRST(&frag->fr_queue); frent; 283 frent = LIST_FIRST(&frag->fr_queue)) { 284 LIST_REMOVE(frent, fr_next); 285 286 m_freem(frent->fr_m); 287 pool_put(&pf_frent_pl, frent); 288 pf_nfrents--; 289 } 290 } else { 291 for (frcache = LIST_FIRST(&frag->fr_cache); frcache; 292 frcache = LIST_FIRST(&frag->fr_cache)) { 293 LIST_REMOVE(frcache, fr_next); 294 295 KASSERT(LIST_EMPTY(&frag->fr_cache) || 296 LIST_FIRST(&frag->fr_cache)->fr_off > 297 frcache->fr_end); 298 299 pool_put(&pf_cent_pl, frcache); 300 pf_ncache--; 301 } 302 } 303 304 pf_remove_fragment(frag); 305 } 306 307 void 308 pf_ip2key(struct pf_fragment *key, struct ip *ip) 309 { 310 key->fr_p = ip->ip_p; 311 key->fr_id = ip->ip_id; 312 key->fr_src.s_addr = ip->ip_src.s_addr; 313 key->fr_dst.s_addr = ip->ip_dst.s_addr; 314 } 315 316 struct pf_fragment * 317 pf_find_fragment(struct ip *ip, struct pf_frag_tree *tree) 318 { 319 struct pf_fragment key; 320 struct pf_fragment *frag; 321 322 pf_ip2key(&key, ip); 323 324 frag = RB_FIND(pf_frag_tree, tree, &key); 325 if (frag != NULL) { 326 /* XXX Are we sure we want to update the timeout? */ 327 frag->fr_timeout = time_second; 328 if (BUFFER_FRAGMENTS(frag)) { 329 TAILQ_REMOVE(&pf_fragqueue, frag, frag_next); 330 TAILQ_INSERT_HEAD(&pf_fragqueue, frag, frag_next); 331 } else { 332 TAILQ_REMOVE(&pf_cachequeue, frag, frag_next); 333 TAILQ_INSERT_HEAD(&pf_cachequeue, frag, frag_next); 334 } 335 } 336 337 return (frag); 338 } 339 340 /* Removes a fragment from the fragment queue and frees the fragment */ 341 342 void 343 pf_remove_fragment(struct pf_fragment *frag) 344 { 345 if (BUFFER_FRAGMENTS(frag)) { 346 RB_REMOVE(pf_frag_tree, &pf_frag_tree, frag); 347 TAILQ_REMOVE(&pf_fragqueue, frag, frag_next); 348 pool_put(&pf_frag_pl, frag); 349 } else { 350 RB_REMOVE(pf_frag_tree, &pf_cache_tree, frag); 351 TAILQ_REMOVE(&pf_cachequeue, frag, frag_next); 352 pool_put(&pf_cache_pl, frag); 353 } 354 } 355 356 #define FR_IP_OFF(fr) ((ntohs((fr)->fr_ip->ip_off) & IP_OFFMASK) << 3) 357 struct mbuf * 358 pf_reassemble(struct mbuf **m0, struct pf_fragment **frag, 359 struct pf_frent *frent, int mff) 360 { 361 struct mbuf *m = *m0, *m2; 362 struct pf_frent *frea, *next; 363 struct pf_frent *frep = NULL; 364 struct ip *ip = frent->fr_ip; 365 int hlen = ip->ip_hl << 2; 366 u_int16_t off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3; 367 u_int16_t ip_len = ntohs(ip->ip_len) - ip->ip_hl * 4; 368 u_int16_t frmax = ip_len + off; 369 370 KASSERT(*frag == NULL || BUFFER_FRAGMENTS(*frag)); 371 372 /* Strip off ip header */ 373 m->m_data += hlen; 374 m->m_len -= hlen; 375 376 /* Create a new reassembly queue for this packet */ 377 if (*frag == NULL) { 378 *frag = pool_get(&pf_frag_pl, PR_NOWAIT); 379 if (*frag == NULL) { 380 pf_flush_fragments(); 381 *frag = pool_get(&pf_frag_pl, PR_NOWAIT); 382 if (*frag == NULL) 383 goto drop_fragment; 384 } 385 386 (*frag)->fr_flags = 0; 387 (*frag)->fr_max = 0; 388 (*frag)->fr_src = frent->fr_ip->ip_src; 389 (*frag)->fr_dst = frent->fr_ip->ip_dst; 390 (*frag)->fr_p = frent->fr_ip->ip_p; 391 (*frag)->fr_id = frent->fr_ip->ip_id; 392 (*frag)->fr_timeout = time_second; 393 LIST_INIT(&(*frag)->fr_queue); 394 395 RB_INSERT(pf_frag_tree, &pf_frag_tree, *frag); 396 TAILQ_INSERT_HEAD(&pf_fragqueue, *frag, frag_next); 397 398 /* We do not have a previous fragment */ 399 frep = NULL; 400 goto insert; 401 } 402 403 /* 404 * Find a fragment after the current one: 405 * - off contains the real shifted offset. 406 */ 407 LIST_FOREACH(frea, &(*frag)->fr_queue, fr_next) { 408 if (FR_IP_OFF(frea) > off) 409 break; 410 frep = frea; 411 } 412 413 KASSERT(frep != NULL || frea != NULL); 414 415 if (frep != NULL && 416 FR_IP_OFF(frep) + ntohs(frep->fr_ip->ip_len) - frep->fr_ip->ip_hl * 417 4 > off) 418 { 419 u_int16_t precut; 420 421 precut = FR_IP_OFF(frep) + ntohs(frep->fr_ip->ip_len) - 422 frep->fr_ip->ip_hl * 4 - off; 423 if (precut >= ip_len) 424 goto drop_fragment; 425 m_adj(frent->fr_m, precut); 426 DPFPRINTF(("overlap -%d\n", precut)); 427 /* Enforce 8 byte boundaries */ 428 ip->ip_off = htons(ntohs(ip->ip_off) + (precut >> 3)); 429 off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3; 430 ip_len -= precut; 431 ip->ip_len = htons(ip_len); 432 } 433 434 for (; frea != NULL && ip_len + off > FR_IP_OFF(frea); 435 frea = next) 436 { 437 u_int16_t aftercut; 438 439 aftercut = ip_len + off - FR_IP_OFF(frea); 440 DPFPRINTF(("adjust overlap %d\n", aftercut)); 441 if (aftercut < ntohs(frea->fr_ip->ip_len) - frea->fr_ip->ip_hl 442 * 4) 443 { 444 frea->fr_ip->ip_len = 445 htons(ntohs(frea->fr_ip->ip_len) - aftercut); 446 frea->fr_ip->ip_off = htons(ntohs(frea->fr_ip->ip_off) + 447 (aftercut >> 3)); 448 m_adj(frea->fr_m, aftercut); 449 break; 450 } 451 452 /* This fragment is completely overlapped, lose it */ 453 next = LIST_NEXT(frea, fr_next); 454 m_freem(frea->fr_m); 455 LIST_REMOVE(frea, fr_next); 456 pool_put(&pf_frent_pl, frea); 457 pf_nfrents--; 458 } 459 460 insert: 461 /* Update maximum data size */ 462 if ((*frag)->fr_max < frmax) 463 (*frag)->fr_max = frmax; 464 /* This is the last segment */ 465 if (!mff) 466 (*frag)->fr_flags |= PFFRAG_SEENLAST; 467 468 if (frep == NULL) 469 LIST_INSERT_HEAD(&(*frag)->fr_queue, frent, fr_next); 470 else 471 LIST_INSERT_AFTER(frep, frent, fr_next); 472 473 /* Check if we are completely reassembled */ 474 if (!((*frag)->fr_flags & PFFRAG_SEENLAST)) 475 return (NULL); 476 477 /* Check if we have all the data */ 478 off = 0; 479 for (frep = LIST_FIRST(&(*frag)->fr_queue); frep; frep = next) { 480 next = LIST_NEXT(frep, fr_next); 481 482 off += ntohs(frep->fr_ip->ip_len) - frep->fr_ip->ip_hl * 4; 483 if (off < (*frag)->fr_max && 484 (next == NULL || FR_IP_OFF(next) != off)) 485 { 486 DPFPRINTF(("missing fragment at %d, next %d, max %d\n", 487 off, next == NULL ? -1 : FR_IP_OFF(next), 488 (*frag)->fr_max)); 489 return (NULL); 490 } 491 } 492 DPFPRINTF(("%d < %d?\n", off, (*frag)->fr_max)); 493 if (off < (*frag)->fr_max) 494 return (NULL); 495 496 /* We have all the data */ 497 frent = LIST_FIRST(&(*frag)->fr_queue); 498 KASSERT(frent != NULL); 499 if ((frent->fr_ip->ip_hl << 2) + off > IP_MAXPACKET) { 500 DPFPRINTF(("drop: too big: %d\n", off)); 501 pf_free_fragment(*frag); 502 *frag = NULL; 503 return (NULL); 504 } 505 next = LIST_NEXT(frent, fr_next); 506 507 /* Magic from ip_input */ 508 ip = frent->fr_ip; 509 m = frent->fr_m; 510 m2 = m->m_next; 511 m->m_next = NULL; 512 m_cat(m, m2); 513 pool_put(&pf_frent_pl, frent); 514 pf_nfrents--; 515 for (frent = next; frent != NULL; frent = next) { 516 next = LIST_NEXT(frent, fr_next); 517 518 m2 = frent->fr_m; 519 pool_put(&pf_frent_pl, frent); 520 pf_nfrents--; 521 m_cat(m, m2); 522 } 523 524 ip->ip_src = (*frag)->fr_src; 525 ip->ip_dst = (*frag)->fr_dst; 526 527 /* Remove from fragment queue */ 528 pf_remove_fragment(*frag); 529 *frag = NULL; 530 531 hlen = ip->ip_hl << 2; 532 ip->ip_len = htons(off + hlen); 533 m->m_len += hlen; 534 m->m_data -= hlen; 535 536 /* some debugging cruft by sklower, below, will go away soon */ 537 /* XXX this should be done elsewhere */ 538 if (m->m_flags & M_PKTHDR) { 539 int plen = 0; 540 for (m2 = m; m2; m2 = m2->m_next) 541 plen += m2->m_len; 542 m->m_pkthdr.len = plen; 543 #ifdef __NetBSD__ 544 m->m_pkthdr.csum_flags = 0; 545 #endif /* __NetBSD__ */ 546 } 547 548 DPFPRINTF(("complete: %p(%d)\n", m, ntohs(ip->ip_len))); 549 return (m); 550 551 drop_fragment: 552 /* Oops - fail safe - drop packet */ 553 pool_put(&pf_frent_pl, frent); 554 pf_nfrents--; 555 m_freem(m); 556 return (NULL); 557 } 558 559 struct mbuf * 560 pf_fragcache(struct mbuf **m0, struct ip *h, struct pf_fragment **frag, int mff, 561 int drop, int *nomem) 562 { 563 struct mbuf *m = *m0; 564 struct pf_frcache *frp, *fra, *cur = NULL; 565 int ip_len = ntohs(h->ip_len) - (h->ip_hl << 2); 566 u_int16_t off = ntohs(h->ip_off) << 3; 567 u_int16_t frmax = ip_len + off; 568 int hosed = 0; 569 570 KASSERT(*frag == NULL || !BUFFER_FRAGMENTS(*frag)); 571 572 /* Create a new range queue for this packet */ 573 if (*frag == NULL) { 574 *frag = pool_get(&pf_cache_pl, PR_NOWAIT); 575 if (*frag == NULL) { 576 pf_flush_fragments(); 577 *frag = pool_get(&pf_cache_pl, PR_NOWAIT); 578 if (*frag == NULL) 579 goto no_mem; 580 } 581 582 /* Get an entry for the queue */ 583 cur = pool_get(&pf_cent_pl, PR_NOWAIT); 584 if (cur == NULL) { 585 pool_put(&pf_cache_pl, *frag); 586 *frag = NULL; 587 goto no_mem; 588 } 589 pf_ncache++; 590 591 (*frag)->fr_flags = PFFRAG_NOBUFFER; 592 (*frag)->fr_max = 0; 593 (*frag)->fr_src = h->ip_src; 594 (*frag)->fr_dst = h->ip_dst; 595 (*frag)->fr_p = h->ip_p; 596 (*frag)->fr_id = h->ip_id; 597 (*frag)->fr_timeout = time_second; 598 599 cur->fr_off = off; 600 cur->fr_end = frmax; 601 LIST_INIT(&(*frag)->fr_cache); 602 LIST_INSERT_HEAD(&(*frag)->fr_cache, cur, fr_next); 603 604 RB_INSERT(pf_frag_tree, &pf_cache_tree, *frag); 605 TAILQ_INSERT_HEAD(&pf_cachequeue, *frag, frag_next); 606 607 DPFPRINTF(("fragcache[%d]: new %d-%d\n", h->ip_id, off, frmax)); 608 609 goto pass; 610 } 611 612 /* 613 * Find a fragment after the current one: 614 * - off contains the real shifted offset. 615 */ 616 frp = NULL; 617 LIST_FOREACH(fra, &(*frag)->fr_cache, fr_next) { 618 if (fra->fr_off > off) 619 break; 620 frp = fra; 621 } 622 623 KASSERT(frp != NULL || fra != NULL); 624 625 if (frp != NULL) { 626 int precut; 627 628 precut = frp->fr_end - off; 629 if (precut >= ip_len) { 630 /* Fragment is entirely a duplicate */ 631 DPFPRINTF(("fragcache[%d]: dead (%d-%d) %d-%d\n", 632 h->ip_id, frp->fr_off, frp->fr_end, off, frmax)); 633 goto drop_fragment; 634 } 635 if (precut == 0) { 636 /* They are adjacent. Fixup cache entry */ 637 DPFPRINTF(("fragcache[%d]: adjacent (%d-%d) %d-%d\n", 638 h->ip_id, frp->fr_off, frp->fr_end, off, frmax)); 639 frp->fr_end = frmax; 640 } else if (precut > 0) { 641 /* The first part of this payload overlaps with a 642 * fragment that has already been passed. 643 * Need to trim off the first part of the payload. 644 * But to do so easily, we need to create another 645 * mbuf to throw the original header into. 646 */ 647 648 DPFPRINTF(("fragcache[%d]: chop %d (%d-%d) %d-%d\n", 649 h->ip_id, precut, frp->fr_off, frp->fr_end, off, 650 frmax)); 651 652 off += precut; 653 frmax -= precut; 654 /* Update the previous frag to encompass this one */ 655 frp->fr_end = frmax; 656 657 if (!drop) { 658 /* XXX Optimization opportunity 659 * This is a very heavy way to trim the payload. 660 * we could do it much faster by diddling mbuf 661 * internals but that would be even less legible 662 * than this mbuf magic. For my next trick, 663 * I'll pull a rabbit out of my laptop. 664 */ 665 *m0 = m_dup(m, 0, h->ip_hl << 2, M_NOWAIT); 666 if (*m0 == NULL) 667 goto no_mem; 668 KASSERT((*m0)->m_next == NULL); 669 m_adj(m, precut + (h->ip_hl << 2)); 670 m_cat(*m0, m); 671 m = *m0; 672 if (m->m_flags & M_PKTHDR) { 673 int plen = 0; 674 struct mbuf *t; 675 for (t = m; t; t = t->m_next) 676 plen += t->m_len; 677 m->m_pkthdr.len = plen; 678 } 679 680 681 h = mtod(m, struct ip *); 682 683 684 KASSERT((int)m->m_len == 685 ntohs(h->ip_len) - precut); 686 h->ip_off = htons(ntohs(h->ip_off) + 687 (precut >> 3)); 688 h->ip_len = htons(ntohs(h->ip_len) - precut); 689 } else { 690 hosed++; 691 } 692 } else { 693 /* There is a gap between fragments */ 694 695 DPFPRINTF(("fragcache[%d]: gap %d (%d-%d) %d-%d\n", 696 h->ip_id, -precut, frp->fr_off, frp->fr_end, off, 697 frmax)); 698 699 cur = pool_get(&pf_cent_pl, PR_NOWAIT); 700 if (cur == NULL) 701 goto no_mem; 702 pf_ncache++; 703 704 cur->fr_off = off; 705 cur->fr_end = frmax; 706 LIST_INSERT_AFTER(frp, cur, fr_next); 707 } 708 } 709 710 if (fra != NULL) { 711 int aftercut; 712 int merge = 0; 713 714 aftercut = frmax - fra->fr_off; 715 if (aftercut == 0) { 716 /* Adjacent fragments */ 717 DPFPRINTF(("fragcache[%d]: adjacent %d-%d (%d-%d)\n", 718 h->ip_id, off, frmax, fra->fr_off, fra->fr_end)); 719 fra->fr_off = off; 720 merge = 1; 721 } else if (aftercut > 0) { 722 /* Need to chop off the tail of this fragment */ 723 DPFPRINTF(("fragcache[%d]: chop %d %d-%d (%d-%d)\n", 724 h->ip_id, aftercut, off, frmax, fra->fr_off, 725 fra->fr_end)); 726 fra->fr_off = off; 727 frmax -= aftercut; 728 729 merge = 1; 730 731 if (!drop) { 732 m_adj(m, -aftercut); 733 if (m->m_flags & M_PKTHDR) { 734 int plen = 0; 735 struct mbuf *t; 736 for (t = m; t; t = t->m_next) 737 plen += t->m_len; 738 m->m_pkthdr.len = plen; 739 } 740 h = mtod(m, struct ip *); 741 KASSERT((int)m->m_len == 742 ntohs(h->ip_len) - aftercut); 743 h->ip_len = htons(ntohs(h->ip_len) - aftercut); 744 } else { 745 hosed++; 746 } 747 } else if (frp == NULL) { 748 /* There is a gap between fragments */ 749 DPFPRINTF(("fragcache[%d]: gap %d %d-%d (%d-%d)\n", 750 h->ip_id, -aftercut, off, frmax, fra->fr_off, 751 fra->fr_end)); 752 753 cur = pool_get(&pf_cent_pl, PR_NOWAIT); 754 if (cur == NULL) 755 goto no_mem; 756 pf_ncache++; 757 758 cur->fr_off = off; 759 cur->fr_end = frmax; 760 LIST_INSERT_BEFORE(fra, cur, fr_next); 761 } 762 763 764 /* Need to glue together two separate fragment descriptors */ 765 if (merge) { 766 if (cur && fra->fr_off <= cur->fr_end) { 767 /* Need to merge in a previous 'cur' */ 768 DPFPRINTF(("fragcache[%d]: adjacent(merge " 769 "%d-%d) %d-%d (%d-%d)\n", 770 h->ip_id, cur->fr_off, cur->fr_end, off, 771 frmax, fra->fr_off, fra->fr_end)); 772 fra->fr_off = cur->fr_off; 773 LIST_REMOVE(cur, fr_next); 774 pool_put(&pf_cent_pl, cur); 775 pf_ncache--; 776 cur = NULL; 777 778 } else if (frp && fra->fr_off <= frp->fr_end) { 779 /* Need to merge in a modified 'frp' */ 780 KASSERT(cur == NULL); 781 DPFPRINTF(("fragcache[%d]: adjacent(merge " 782 "%d-%d) %d-%d (%d-%d)\n", 783 h->ip_id, frp->fr_off, frp->fr_end, off, 784 frmax, fra->fr_off, fra->fr_end)); 785 fra->fr_off = frp->fr_off; 786 LIST_REMOVE(frp, fr_next); 787 pool_put(&pf_cent_pl, frp); 788 pf_ncache--; 789 frp = NULL; 790 791 } 792 } 793 } 794 795 if (hosed) { 796 /* 797 * We must keep tracking the overall fragment even when 798 * we're going to drop it anyway so that we know when to 799 * free the overall descriptor. Thus we drop the frag late. 800 */ 801 goto drop_fragment; 802 } 803 804 805 pass: 806 /* Update maximum data size */ 807 if ((*frag)->fr_max < frmax) 808 (*frag)->fr_max = frmax; 809 810 /* This is the last segment */ 811 if (!mff) 812 (*frag)->fr_flags |= PFFRAG_SEENLAST; 813 814 /* Check if we are completely reassembled */ 815 if (((*frag)->fr_flags & PFFRAG_SEENLAST) && 816 LIST_FIRST(&(*frag)->fr_cache)->fr_off == 0 && 817 LIST_FIRST(&(*frag)->fr_cache)->fr_end == (*frag)->fr_max) { 818 /* Remove from fragment queue */ 819 DPFPRINTF(("fragcache[%d]: done 0-%d\n", h->ip_id, 820 (*frag)->fr_max)); 821 pf_free_fragment(*frag); 822 *frag = NULL; 823 } 824 825 return (m); 826 827 no_mem: 828 *nomem = 1; 829 830 /* Still need to pay attention to !IP_MF */ 831 if (!mff && *frag != NULL) 832 (*frag)->fr_flags |= PFFRAG_SEENLAST; 833 834 m_freem(m); 835 return (NULL); 836 837 drop_fragment: 838 839 /* Still need to pay attention to !IP_MF */ 840 if (!mff && *frag != NULL) 841 (*frag)->fr_flags |= PFFRAG_SEENLAST; 842 843 if (drop) { 844 /* This fragment has been deemed bad. Don't reass */ 845 if (((*frag)->fr_flags & PFFRAG_DROP) == 0) 846 DPFPRINTF(("fragcache[%d]: dropping overall fragment\n", 847 h->ip_id)); 848 (*frag)->fr_flags |= PFFRAG_DROP; 849 } 850 851 m_freem(m); 852 return (NULL); 853 } 854 855 int 856 pf_normalize_ip(struct mbuf **m0, int dir, struct pfi_kif *kif, u_short *reason, 857 struct pf_pdesc *pd) 858 { 859 struct mbuf *m = *m0; 860 struct pf_rule *r; 861 struct pf_frent *frent; 862 struct pf_fragment *frag = NULL; 863 struct ip *h = mtod(m, struct ip *); 864 int mff = (ntohs(h->ip_off) & IP_MF); 865 int hlen = h->ip_hl << 2; 866 u_int16_t fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3; 867 u_int16_t frmax; 868 int ip_len; 869 870 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr); 871 while (r != NULL) { 872 r->evaluations++; 873 if (pfi_kif_match(r->kif, kif) == r->ifnot) 874 r = r->skip[PF_SKIP_IFP].ptr; 875 else if (r->direction && r->direction != dir) 876 r = r->skip[PF_SKIP_DIR].ptr; 877 else if (r->af && r->af != AF_INET) 878 r = r->skip[PF_SKIP_AF].ptr; 879 else if (r->proto && r->proto != h->ip_p) 880 r = r->skip[PF_SKIP_PROTO].ptr; 881 else if (PF_MISMATCHAW(&r->src.addr, 882 (struct pf_addr *)&h->ip_src.s_addr, AF_INET, 883 r->src.neg, kif)) 884 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 885 else if (PF_MISMATCHAW(&r->dst.addr, 886 (struct pf_addr *)&h->ip_dst.s_addr, AF_INET, 887 r->dst.neg, NULL)) 888 r = r->skip[PF_SKIP_DST_ADDR].ptr; 889 else 890 break; 891 } 892 893 if (r == NULL || r->action == PF_NOSCRUB) 894 return (PF_PASS); 895 else { 896 r->packets[dir == PF_OUT]++; 897 r->bytes[dir == PF_OUT] += pd->tot_len; 898 } 899 900 /* Check for illegal packets */ 901 if (hlen < (int)sizeof(struct ip)) 902 goto drop; 903 904 if (hlen > ntohs(h->ip_len)) 905 goto drop; 906 907 /* Clear IP_DF if the rule uses the no-df option */ 908 if (r->rule_flag & PFRULE_NODF && h->ip_off & htons(IP_DF)) { 909 u_int16_t off = h->ip_off; 910 911 h->ip_off &= htons(~IP_DF); 912 h->ip_sum = pf_cksum_fixup(h->ip_sum, off, h->ip_off, 0); 913 } 914 915 /* We will need other tests here */ 916 if (!fragoff && !mff) 917 goto no_fragment; 918 919 /* We're dealing with a fragment now. Don't allow fragments 920 * with IP_DF to enter the cache. If the flag was cleared by 921 * no-df above, fine. Otherwise drop it. 922 */ 923 if (h->ip_off & htons(IP_DF)) { 924 DPFPRINTF(("IP_DF\n")); 925 goto bad; 926 } 927 928 ip_len = ntohs(h->ip_len) - hlen; 929 930 /* All fragments are 8 byte aligned */ 931 if (mff && (ip_len & 0x7)) { 932 DPFPRINTF(("mff and %d\n", ip_len)); 933 goto bad; 934 } 935 936 /* Respect maximum length */ 937 if (fragoff + ip_len > IP_MAXPACKET) { 938 DPFPRINTF(("max packet %d\n", fragoff + ip_len)); 939 goto bad; 940 } 941 frmax = fragoff + ip_len; 942 943 if ((r->rule_flag & (PFRULE_FRAGCROP|PFRULE_FRAGDROP)) == 0) { 944 /* Fully buffer all of the fragments */ 945 946 frag = pf_find_fragment(h, &pf_frag_tree); 947 948 /* Check if we saw the last fragment already */ 949 if (frag != NULL && (frag->fr_flags & PFFRAG_SEENLAST) && 950 frmax > frag->fr_max) 951 goto bad; 952 953 /* Get an entry for the fragment queue */ 954 frent = pool_get(&pf_frent_pl, PR_NOWAIT); 955 if (frent == NULL) { 956 REASON_SET(reason, PFRES_MEMORY); 957 return (PF_DROP); 958 } 959 pf_nfrents++; 960 frent->fr_ip = h; 961 frent->fr_m = m; 962 963 /* Might return a completely reassembled mbuf, or NULL */ 964 DPFPRINTF(("reass frag %d @ %d-%d\n", h->ip_id, fragoff, frmax)); 965 *m0 = m = pf_reassemble(m0, &frag, frent, mff); 966 967 if (m == NULL) 968 return (PF_DROP); 969 970 if (frag != NULL && (frag->fr_flags & PFFRAG_DROP)) 971 goto drop; 972 973 h = mtod(m, struct ip *); 974 } else { 975 /* non-buffering fragment cache (drops or masks overlaps) */ 976 int nomem = 0; 977 978 #ifdef __NetBSD__ 979 struct pf_mtag *pf_mtag = pf_find_mtag(m); 980 KASSERT(pf_mtag != NULL); 981 982 if (dir == PF_OUT && pf_mtag->flags & PF_TAG_FRAGCACHE) { 983 #else 984 if (dir == PF_OUT && m->m_pkthdr.pf.flags & PF_TAG_FRAGCACHE) { 985 #endif /* !__NetBSD__ */ 986 /* 987 * Already passed the fragment cache in the 988 * input direction. If we continued, it would 989 * appear to be a dup and would be dropped. 990 */ 991 goto fragment_pass; 992 } 993 994 frag = pf_find_fragment(h, &pf_cache_tree); 995 996 /* Check if we saw the last fragment already */ 997 if (frag != NULL && (frag->fr_flags & PFFRAG_SEENLAST) && 998 frmax > frag->fr_max) { 999 if (r->rule_flag & PFRULE_FRAGDROP) 1000 frag->fr_flags |= PFFRAG_DROP; 1001 goto bad; 1002 } 1003 1004 *m0 = m = pf_fragcache(m0, h, &frag, mff, 1005 (r->rule_flag & PFRULE_FRAGDROP) ? 1 : 0, &nomem); 1006 if (m == NULL) { 1007 if (nomem) 1008 goto no_mem; 1009 goto drop; 1010 } 1011 1012 if (dir == PF_IN) 1013 #ifdef __NetBSD__ 1014 { 1015 pf_mtag = pf_find_mtag(m); 1016 KASSERT(pf_mtag != NULL); 1017 1018 pf_mtag->flags |= PF_TAG_FRAGCACHE; 1019 } 1020 #else 1021 m->m_pkthdr.pf.flags |= PF_TAG_FRAGCACHE; 1022 #endif /* !__NetBSD__ */ 1023 1024 if (frag != NULL && (frag->fr_flags & PFFRAG_DROP)) 1025 goto drop; 1026 goto fragment_pass; 1027 } 1028 1029 no_fragment: 1030 /* At this point, only IP_DF is allowed in ip_off */ 1031 if (h->ip_off & ~htons(IP_DF)) { 1032 u_int16_t off = h->ip_off; 1033 1034 h->ip_off &= htons(IP_DF); 1035 h->ip_sum = pf_cksum_fixup(h->ip_sum, off, h->ip_off, 0); 1036 } 1037 1038 /* Enforce a minimum ttl, may cause endless packet loops */ 1039 if (r->min_ttl && h->ip_ttl < r->min_ttl) { 1040 u_int16_t ip_ttl = h->ip_ttl; 1041 1042 h->ip_ttl = r->min_ttl; 1043 h->ip_sum = pf_cksum_fixup(h->ip_sum, ip_ttl, h->ip_ttl, 0); 1044 } 1045 1046 if (r->rule_flag & PFRULE_RANDOMID) { 1047 u_int16_t id = h->ip_id; 1048 1049 h->ip_id = ip_randomid(); 1050 h->ip_sum = pf_cksum_fixup(h->ip_sum, id, h->ip_id, 0); 1051 } 1052 if ((r->rule_flag & (PFRULE_FRAGCROP|PFRULE_FRAGDROP)) == 0) 1053 pd->flags |= PFDESC_IP_REAS; 1054 1055 return (PF_PASS); 1056 1057 fragment_pass: 1058 /* Enforce a minimum ttl, may cause endless packet loops */ 1059 if (r->min_ttl && h->ip_ttl < r->min_ttl) { 1060 u_int16_t ip_ttl = h->ip_ttl; 1061 1062 h->ip_ttl = r->min_ttl; 1063 h->ip_sum = pf_cksum_fixup(h->ip_sum, ip_ttl, h->ip_ttl, 0); 1064 } 1065 if ((r->rule_flag & (PFRULE_FRAGCROP|PFRULE_FRAGDROP)) == 0) 1066 pd->flags |= PFDESC_IP_REAS; 1067 return (PF_PASS); 1068 1069 no_mem: 1070 REASON_SET(reason, PFRES_MEMORY); 1071 if (r != NULL && r->log) 1072 PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL, pd); 1073 return (PF_DROP); 1074 1075 drop: 1076 REASON_SET(reason, PFRES_NORM); 1077 if (r != NULL && r->log) 1078 PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL, pd); 1079 return (PF_DROP); 1080 1081 bad: 1082 DPFPRINTF(("dropping bad fragment\n")); 1083 1084 /* Free associated fragments */ 1085 if (frag != NULL) 1086 pf_free_fragment(frag); 1087 1088 REASON_SET(reason, PFRES_FRAG); 1089 if (r != NULL && r->log) 1090 PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL, pd); 1091 1092 return (PF_DROP); 1093 } 1094 1095 #ifdef INET6 1096 int 1097 pf_normalize_ip6(struct mbuf **m0, int dir, struct pfi_kif *kif, 1098 u_short *reason, struct pf_pdesc *pd) 1099 { 1100 struct mbuf *m = *m0; 1101 struct pf_rule *r; 1102 struct ip6_hdr *h = mtod(m, struct ip6_hdr *); 1103 int off; 1104 struct ip6_ext ext; 1105 struct ip6_opt opt; 1106 struct ip6_opt_jumbo jumbo; 1107 struct ip6_frag frag; 1108 u_int32_t jumbolen = 0, plen; 1109 u_int16_t fragoff = 0; 1110 int optend; 1111 int ooff; 1112 u_int8_t proto; 1113 int terminal; 1114 1115 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr); 1116 while (r != NULL) { 1117 r->evaluations++; 1118 if (pfi_kif_match(r->kif, kif) == r->ifnot) 1119 r = r->skip[PF_SKIP_IFP].ptr; 1120 else if (r->direction && r->direction != dir) 1121 r = r->skip[PF_SKIP_DIR].ptr; 1122 else if (r->af && r->af != AF_INET6) 1123 r = r->skip[PF_SKIP_AF].ptr; 1124 #if 0 /* header chain! */ 1125 else if (r->proto && r->proto != h->ip6_nxt) 1126 r = r->skip[PF_SKIP_PROTO].ptr; 1127 #endif 1128 else if (PF_MISMATCHAW(&r->src.addr, 1129 (struct pf_addr *)&h->ip6_src, AF_INET6, 1130 r->src.neg, kif)) 1131 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 1132 else if (PF_MISMATCHAW(&r->dst.addr, 1133 (struct pf_addr *)&h->ip6_dst, AF_INET6, 1134 r->dst.neg, NULL)) 1135 r = r->skip[PF_SKIP_DST_ADDR].ptr; 1136 else 1137 break; 1138 } 1139 1140 if (r == NULL || r->action == PF_NOSCRUB) 1141 return (PF_PASS); 1142 else { 1143 r->packets[dir == PF_OUT]++; 1144 r->bytes[dir == PF_OUT] += pd->tot_len; 1145 } 1146 1147 /* Check for illegal packets */ 1148 if (sizeof(struct ip6_hdr) + IPV6_MAXPACKET < m->m_pkthdr.len) 1149 goto drop; 1150 1151 off = sizeof(struct ip6_hdr); 1152 proto = h->ip6_nxt; 1153 terminal = 0; 1154 do { 1155 switch (proto) { 1156 case IPPROTO_FRAGMENT: 1157 goto fragment; 1158 break; 1159 case IPPROTO_AH: 1160 case IPPROTO_ROUTING: 1161 case IPPROTO_DSTOPTS: 1162 if (!pf_pull_hdr(m, off, &ext, sizeof(ext), NULL, 1163 NULL, AF_INET6)) 1164 goto shortpkt; 1165 if (proto == IPPROTO_AH) 1166 off += (ext.ip6e_len + 2) * 4; 1167 else 1168 off += (ext.ip6e_len + 1) * 8; 1169 proto = ext.ip6e_nxt; 1170 break; 1171 case IPPROTO_HOPOPTS: 1172 if (!pf_pull_hdr(m, off, &ext, sizeof(ext), NULL, 1173 NULL, AF_INET6)) 1174 goto shortpkt; 1175 optend = off + (ext.ip6e_len + 1) * 8; 1176 ooff = off + sizeof(ext); 1177 do { 1178 if (!pf_pull_hdr(m, ooff, &opt.ip6o_type, 1179 sizeof(opt.ip6o_type), NULL, NULL, 1180 AF_INET6)) 1181 goto shortpkt; 1182 if (opt.ip6o_type == IP6OPT_PAD1) { 1183 ooff++; 1184 continue; 1185 } 1186 if (!pf_pull_hdr(m, ooff, &opt, sizeof(opt), 1187 NULL, NULL, AF_INET6)) 1188 goto shortpkt; 1189 if (ooff + sizeof(opt) + opt.ip6o_len > optend) 1190 goto drop; 1191 switch (opt.ip6o_type) { 1192 case IP6OPT_JUMBO: 1193 if (h->ip6_plen != 0) 1194 goto drop; 1195 if (!pf_pull_hdr(m, ooff, &jumbo, 1196 sizeof(jumbo), NULL, NULL, 1197 AF_INET6)) 1198 goto shortpkt; 1199 memcpy(&jumbolen, jumbo.ip6oj_jumbo_len, 1200 sizeof(jumbolen)); 1201 jumbolen = ntohl(jumbolen); 1202 if (jumbolen <= IPV6_MAXPACKET) 1203 goto drop; 1204 if (sizeof(struct ip6_hdr) + jumbolen != 1205 m->m_pkthdr.len) 1206 goto drop; 1207 break; 1208 default: 1209 break; 1210 } 1211 ooff += sizeof(opt) + opt.ip6o_len; 1212 } while (ooff < optend); 1213 1214 off = optend; 1215 proto = ext.ip6e_nxt; 1216 break; 1217 default: 1218 terminal = 1; 1219 break; 1220 } 1221 } while (!terminal); 1222 1223 /* jumbo payload option must be present, or plen > 0 */ 1224 if (ntohs(h->ip6_plen) == 0) 1225 plen = jumbolen; 1226 else 1227 plen = ntohs(h->ip6_plen); 1228 if (plen == 0) 1229 goto drop; 1230 if (sizeof(struct ip6_hdr) + plen > m->m_pkthdr.len) 1231 goto shortpkt; 1232 1233 /* Enforce a minimum ttl, may cause endless packet loops */ 1234 if (r->min_ttl && h->ip6_hlim < r->min_ttl) 1235 h->ip6_hlim = r->min_ttl; 1236 1237 return (PF_PASS); 1238 1239 fragment: 1240 if (ntohs(h->ip6_plen) == 0 || jumbolen) 1241 goto drop; 1242 plen = ntohs(h->ip6_plen); 1243 1244 if (!pf_pull_hdr(m, off, &frag, sizeof(frag), NULL, NULL, AF_INET6)) 1245 goto shortpkt; 1246 fragoff = ntohs(frag.ip6f_offlg & IP6F_OFF_MASK); 1247 if (fragoff + (plen - off - sizeof(frag)) > IPV6_MAXPACKET) 1248 goto badfrag; 1249 1250 /* do something about it */ 1251 /* remember to set pd->flags |= PFDESC_IP_REAS */ 1252 return (PF_PASS); 1253 1254 shortpkt: 1255 REASON_SET(reason, PFRES_SHORT); 1256 if (r != NULL && r->log) 1257 PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL, pd); 1258 return (PF_DROP); 1259 1260 drop: 1261 REASON_SET(reason, PFRES_NORM); 1262 if (r != NULL && r->log) 1263 PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL, pd); 1264 return (PF_DROP); 1265 1266 badfrag: 1267 REASON_SET(reason, PFRES_FRAG); 1268 if (r != NULL && r->log) 1269 PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL, pd); 1270 return (PF_DROP); 1271 } 1272 #endif /* INET6 */ 1273 1274 int 1275 pf_normalize_tcp(int dir, struct pfi_kif *kif, struct mbuf *m, 1276 int ipoff, int off, void *h, struct pf_pdesc *pd) 1277 { 1278 struct pf_rule *r, *rm = NULL; 1279 struct tcphdr *th = pd->hdr.tcp; 1280 int rewrite = 0; 1281 u_short reason; 1282 u_int8_t flags; 1283 sa_family_t af = pd->af; 1284 1285 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr); 1286 while (r != NULL) { 1287 r->evaluations++; 1288 if (pfi_kif_match(r->kif, kif) == r->ifnot) 1289 r = r->skip[PF_SKIP_IFP].ptr; 1290 else if (r->direction && r->direction != dir) 1291 r = r->skip[PF_SKIP_DIR].ptr; 1292 else if (r->af && r->af != af) 1293 r = r->skip[PF_SKIP_AF].ptr; 1294 else if (r->proto && r->proto != pd->proto) 1295 r = r->skip[PF_SKIP_PROTO].ptr; 1296 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af, 1297 r->src.neg, kif)) 1298 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 1299 else if (r->src.port_op && !pf_match_port(r->src.port_op, 1300 r->src.port[0], r->src.port[1], th->th_sport)) 1301 r = r->skip[PF_SKIP_SRC_PORT].ptr; 1302 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af, 1303 r->dst.neg, NULL)) 1304 r = r->skip[PF_SKIP_DST_ADDR].ptr; 1305 else if (r->dst.port_op && !pf_match_port(r->dst.port_op, 1306 r->dst.port[0], r->dst.port[1], th->th_dport)) 1307 r = r->skip[PF_SKIP_DST_PORT].ptr; 1308 else if (r->os_fingerprint != PF_OSFP_ANY && !pf_osfp_match( 1309 pf_osfp_fingerprint(pd, m, off, th), 1310 r->os_fingerprint)) 1311 r = TAILQ_NEXT(r, entries); 1312 else { 1313 rm = r; 1314 break; 1315 } 1316 } 1317 1318 if (rm == NULL || rm->action == PF_NOSCRUB) 1319 return (PF_PASS); 1320 else { 1321 r->packets[dir == PF_OUT]++; 1322 r->bytes[dir == PF_OUT] += pd->tot_len; 1323 } 1324 1325 if (rm->rule_flag & PFRULE_REASSEMBLE_TCP) 1326 pd->flags |= PFDESC_TCP_NORM; 1327 1328 flags = th->th_flags; 1329 if (flags & TH_SYN) { 1330 /* Illegal packet */ 1331 if (flags & TH_RST) 1332 goto tcp_drop; 1333 1334 if (flags & TH_FIN) 1335 flags &= ~TH_FIN; 1336 } else { 1337 /* Illegal packet */ 1338 if (!(flags & (TH_ACK|TH_RST))) 1339 goto tcp_drop; 1340 } 1341 1342 if (!(flags & TH_ACK)) { 1343 /* These flags are only valid if ACK is set */ 1344 if ((flags & TH_FIN) || (flags & TH_PUSH) || (flags & TH_URG)) 1345 goto tcp_drop; 1346 } 1347 1348 /* Check for illegal header length */ 1349 if (th->th_off < (sizeof(struct tcphdr) >> 2)) 1350 goto tcp_drop; 1351 1352 /* If flags changed, or reserved data set, then adjust */ 1353 if (flags != th->th_flags || th->th_x2 != 0) { 1354 u_int16_t ov, nv; 1355 1356 ov = *(u_int16_t *)(&th->th_ack + 1); 1357 th->th_flags = flags; 1358 th->th_x2 = 0; 1359 nv = *(u_int16_t *)(&th->th_ack + 1); 1360 1361 th->th_sum = pf_cksum_fixup(th->th_sum, ov, nv, 0); 1362 rewrite = 1; 1363 } 1364 1365 /* Remove urgent pointer, if TH_URG is not set */ 1366 if (!(flags & TH_URG) && th->th_urp) { 1367 th->th_sum = pf_cksum_fixup(th->th_sum, th->th_urp, 0, 0); 1368 th->th_urp = 0; 1369 rewrite = 1; 1370 } 1371 1372 /* Process options */ 1373 if (r->max_mss && pf_normalize_tcpopt(r, m, th, off)) 1374 rewrite = 1; 1375 1376 /* copy back packet headers if we sanitized */ 1377 if (rewrite) 1378 m_copyback(m, off, sizeof(*th), th); 1379 1380 return (PF_PASS); 1381 1382 tcp_drop: 1383 REASON_SET_NOPTR(&reason, PFRES_NORM); 1384 if (rm != NULL && r->log) 1385 PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, r, NULL, NULL, pd); 1386 return (PF_DROP); 1387 } 1388 1389 int 1390 pf_normalize_tcp_init(struct mbuf *m, int off, struct pf_pdesc *pd, 1391 struct tcphdr *th, struct pf_state_peer *src, 1392 struct pf_state_peer *dst) 1393 { 1394 u_int32_t tsval, tsecr; 1395 u_int8_t hdr[60]; 1396 u_int8_t *opt; 1397 1398 KASSERT(src->scrub == NULL); 1399 1400 src->scrub = pool_get(&pf_state_scrub_pl, PR_NOWAIT); 1401 if (src->scrub == NULL) 1402 return (1); 1403 bzero(src->scrub, sizeof(*src->scrub)); 1404 1405 switch (pd->af) { 1406 #ifdef INET 1407 case AF_INET: { 1408 struct ip *h = mtod(m, struct ip *); 1409 src->scrub->pfss_ttl = h->ip_ttl; 1410 break; 1411 } 1412 #endif /* INET */ 1413 #ifdef INET6 1414 case AF_INET6: { 1415 struct ip6_hdr *h = mtod(m, struct ip6_hdr *); 1416 src->scrub->pfss_ttl = h->ip6_hlim; 1417 break; 1418 } 1419 #endif /* INET6 */ 1420 } 1421 1422 1423 /* 1424 * All normalizations below are only begun if we see the start of 1425 * the connections. They must all set an enabled bit in pfss_flags 1426 */ 1427 if ((th->th_flags & TH_SYN) == 0) 1428 return (0); 1429 1430 1431 if (th->th_off > (sizeof(struct tcphdr) >> 2) && src->scrub && 1432 pf_pull_hdr(m, off, hdr, th->th_off << 2, NULL, NULL, pd->af)) { 1433 /* Diddle with TCP options */ 1434 int hlen; 1435 opt = hdr + sizeof(struct tcphdr); 1436 hlen = (th->th_off << 2) - sizeof(struct tcphdr); 1437 while (hlen >= TCPOLEN_TIMESTAMP) { 1438 switch (*opt) { 1439 case TCPOPT_EOL: /* FALLTHROUGH */ 1440 case TCPOPT_NOP: 1441 opt++; 1442 hlen--; 1443 break; 1444 case TCPOPT_TIMESTAMP: 1445 if (opt[1] >= TCPOLEN_TIMESTAMP) { 1446 src->scrub->pfss_flags |= 1447 PFSS_TIMESTAMP; 1448 src->scrub->pfss_ts_mod = 1449 htonl(cprng_fast32()); 1450 1451 /* note PFSS_PAWS not set yet */ 1452 memcpy(&tsval, &opt[2], 1453 sizeof(u_int32_t)); 1454 memcpy(&tsecr, &opt[6], 1455 sizeof(u_int32_t)); 1456 src->scrub->pfss_tsval0 = ntohl(tsval); 1457 src->scrub->pfss_tsval = ntohl(tsval); 1458 src->scrub->pfss_tsecr = ntohl(tsecr); 1459 getmicrouptime(&src->scrub->pfss_last); 1460 } 1461 /* FALLTHROUGH */ 1462 default: 1463 hlen -= MAX(opt[1], 2); 1464 opt += MAX(opt[1], 2); 1465 break; 1466 } 1467 } 1468 } 1469 1470 return (0); 1471 } 1472 1473 void 1474 pf_normalize_tcp_cleanup(struct pf_state *state) 1475 { 1476 if (state->src.scrub) 1477 pool_put(&pf_state_scrub_pl, state->src.scrub); 1478 if (state->dst.scrub) 1479 pool_put(&pf_state_scrub_pl, state->dst.scrub); 1480 1481 /* Someday... flush the TCP segment reassembly descriptors. */ 1482 } 1483 1484 int 1485 pf_normalize_tcp_stateful(struct mbuf *m, int off, struct pf_pdesc *pd, 1486 u_short *reason, struct tcphdr *th, struct pf_state *state, 1487 struct pf_state_peer *src, struct pf_state_peer *dst, int *writeback) 1488 { 1489 struct timeval uptime; 1490 u_int32_t tsval = 0, tsecr = 0; 1491 u_int tsval_from_last; 1492 u_int8_t hdr[60]; 1493 u_int8_t *opt; 1494 int copyback = 0; 1495 int got_ts = 0; 1496 1497 KASSERT(src->scrub || dst->scrub); 1498 1499 /* 1500 * Enforce the minimum TTL seen for this connection. Negate a common 1501 * technique to evade an intrusion detection system and confuse 1502 * firewall state code. 1503 */ 1504 switch (pd->af) { 1505 #ifdef INET 1506 case AF_INET: { 1507 if (src->scrub) { 1508 struct ip *h = mtod(m, struct ip *); 1509 if (h->ip_ttl > src->scrub->pfss_ttl) 1510 src->scrub->pfss_ttl = h->ip_ttl; 1511 h->ip_ttl = src->scrub->pfss_ttl; 1512 } 1513 break; 1514 } 1515 #endif /* INET */ 1516 #ifdef INET6 1517 case AF_INET6: { 1518 if (src->scrub) { 1519 struct ip6_hdr *h = mtod(m, struct ip6_hdr *); 1520 if (h->ip6_hlim > src->scrub->pfss_ttl) 1521 src->scrub->pfss_ttl = h->ip6_hlim; 1522 h->ip6_hlim = src->scrub->pfss_ttl; 1523 } 1524 break; 1525 } 1526 #endif /* INET6 */ 1527 } 1528 1529 if (th->th_off > (sizeof(struct tcphdr) >> 2) && 1530 ((src->scrub && (src->scrub->pfss_flags & PFSS_TIMESTAMP)) || 1531 (dst->scrub && (dst->scrub->pfss_flags & PFSS_TIMESTAMP))) && 1532 pf_pull_hdr(m, off, hdr, th->th_off << 2, NULL, NULL, pd->af)) { 1533 /* Diddle with TCP options */ 1534 int hlen; 1535 opt = hdr + sizeof(struct tcphdr); 1536 hlen = (th->th_off << 2) - sizeof(struct tcphdr); 1537 while (hlen >= TCPOLEN_TIMESTAMP) { 1538 switch (*opt) { 1539 case TCPOPT_EOL: /* FALLTHROUGH */ 1540 case TCPOPT_NOP: 1541 opt++; 1542 hlen--; 1543 break; 1544 case TCPOPT_TIMESTAMP: 1545 /* Modulate the timestamps. Can be used for 1546 * NAT detection, OS uptime determination or 1547 * reboot detection. 1548 */ 1549 1550 if (got_ts) { 1551 /* Huh? Multiple timestamps!? */ 1552 if (pf_status.debug >= PF_DEBUG_MISC) { 1553 DPFPRINTF(("multiple TS??")); 1554 pf_print_state(state); 1555 printf("\n"); 1556 } 1557 REASON_SET(reason, PFRES_TS); 1558 return (PF_DROP); 1559 } 1560 if (opt[1] >= TCPOLEN_TIMESTAMP) { 1561 memcpy(&tsval, &opt[2], 1562 sizeof(u_int32_t)); 1563 if (tsval && src->scrub && 1564 (src->scrub->pfss_flags & 1565 PFSS_TIMESTAMP)) { 1566 tsval = ntohl(tsval); 1567 pf_change_a(&opt[2], 1568 &th->th_sum, 1569 htonl(tsval + 1570 src->scrub->pfss_ts_mod), 1571 0); 1572 copyback = 1; 1573 } 1574 1575 /* Modulate TS reply iff valid (!0) */ 1576 memcpy(&tsecr, &opt[6], 1577 sizeof(u_int32_t)); 1578 if (tsecr && dst->scrub && 1579 (dst->scrub->pfss_flags & 1580 PFSS_TIMESTAMP)) { 1581 tsecr = ntohl(tsecr) 1582 - dst->scrub->pfss_ts_mod; 1583 pf_change_a(&opt[6], 1584 &th->th_sum, htonl(tsecr), 1585 0); 1586 copyback = 1; 1587 } 1588 got_ts = 1; 1589 } 1590 /* FALLTHROUGH */ 1591 default: 1592 hlen -= MAX(opt[1], 2); 1593 opt += MAX(opt[1], 2); 1594 break; 1595 } 1596 } 1597 if (copyback) { 1598 /* Copyback the options, caller copys back header */ 1599 *writeback = 1; 1600 m_copyback(m, off + sizeof(struct tcphdr), 1601 (th->th_off << 2) - sizeof(struct tcphdr), hdr + 1602 sizeof(struct tcphdr)); 1603 } 1604 } 1605 1606 1607 /* 1608 * Must invalidate PAWS checks on connections idle for too long. 1609 * The fastest allowed timestamp clock is 1ms. That turns out to 1610 * be about 24 days before it wraps. XXX Right now our lowerbound 1611 * TS echo check only works for the first 12 days of a connection 1612 * when the TS has exhausted half its 32bit space 1613 */ 1614 #define TS_MAX_IDLE (24*24*60*60) 1615 #define TS_MAX_CONN (12*24*60*60) /* XXX remove when better tsecr check */ 1616 1617 getmicrouptime(&uptime); 1618 if (src->scrub && (src->scrub->pfss_flags & PFSS_PAWS) && 1619 (uptime.tv_sec - src->scrub->pfss_last.tv_sec > TS_MAX_IDLE || 1620 time_second - state->creation > TS_MAX_CONN)) { 1621 if (pf_status.debug >= PF_DEBUG_MISC) { 1622 DPFPRINTF(("src idled out of PAWS\n")); 1623 pf_print_state(state); 1624 printf("\n"); 1625 } 1626 src->scrub->pfss_flags = (src->scrub->pfss_flags & ~PFSS_PAWS) 1627 | PFSS_PAWS_IDLED; 1628 } 1629 if (dst->scrub && (dst->scrub->pfss_flags & PFSS_PAWS) && 1630 uptime.tv_sec - dst->scrub->pfss_last.tv_sec > TS_MAX_IDLE) { 1631 if (pf_status.debug >= PF_DEBUG_MISC) { 1632 DPFPRINTF(("dst idled out of PAWS\n")); 1633 pf_print_state(state); 1634 printf("\n"); 1635 } 1636 dst->scrub->pfss_flags = (dst->scrub->pfss_flags & ~PFSS_PAWS) 1637 | PFSS_PAWS_IDLED; 1638 } 1639 1640 if (got_ts && src->scrub && dst->scrub && 1641 (src->scrub->pfss_flags & PFSS_PAWS) && 1642 (dst->scrub->pfss_flags & PFSS_PAWS)) { 1643 /* Validate that the timestamps are "in-window". 1644 * RFC1323 describes TCP Timestamp options that allow 1645 * measurement of RTT (round trip time) and PAWS 1646 * (protection against wrapped sequence numbers). PAWS 1647 * gives us a set of rules for rejecting packets on 1648 * long fat pipes (packets that were somehow delayed 1649 * in transit longer than the time it took to send the 1650 * full TCP sequence space of 4Gb). We can use these 1651 * rules and infer a few others that will let us treat 1652 * the 32bit timestamp and the 32bit echoed timestamp 1653 * as sequence numbers to prevent a blind attacker from 1654 * inserting packets into a connection. 1655 * 1656 * RFC1323 tells us: 1657 * - The timestamp on this packet must be greater than 1658 * or equal to the last value echoed by the other 1659 * endpoint. The RFC says those will be discarded 1660 * since it is a dup that has already been acked. 1661 * This gives us a lowerbound on the timestamp. 1662 * timestamp >= other last echoed timestamp 1663 * - The timestamp will be less than or equal to 1664 * the last timestamp plus the time between the 1665 * last packet and now. The RFC defines the max 1666 * clock rate as 1ms. We will allow clocks to be 1667 * up to 10% fast and will allow a total difference 1668 * or 30 seconds due to a route change. And this 1669 * gives us an upperbound on the timestamp. 1670 * timestamp <= last timestamp + max ticks 1671 * We have to be careful here. Windows will send an 1672 * initial timestamp of zero and then initialize it 1673 * to a random value after the 3whs; presumably to 1674 * avoid a DoS by having to call an expensive RNG 1675 * during a SYN flood. Proof MS has at least one 1676 * good security geek. 1677 * 1678 * - The TCP timestamp option must also echo the other 1679 * endpoints timestamp. The timestamp echoed is the 1680 * one carried on the earliest unacknowledged segment 1681 * on the left edge of the sequence window. The RFC 1682 * states that the host will reject any echoed 1683 * timestamps that were larger than any ever sent. 1684 * This gives us an upperbound on the TS echo. 1685 * tescr <= largest_tsval 1686 * - The lowerbound on the TS echo is a little more 1687 * tricky to determine. The other endpoint's echoed 1688 * values will not decrease. But there may be 1689 * network conditions that re-order packets and 1690 * cause our view of them to decrease. For now the 1691 * only lowerbound we can safely determine is that 1692 * the TS echo will never be less than the original 1693 * TS. XXX There is probably a better lowerbound. 1694 * Remove TS_MAX_CONN with better lowerbound check. 1695 * tescr >= other original TS 1696 * 1697 * It is also important to note that the fastest 1698 * timestamp clock of 1ms will wrap its 32bit space in 1699 * 24 days. So we just disable TS checking after 24 1700 * days of idle time. We actually must use a 12d 1701 * connection limit until we can come up with a better 1702 * lowerbound to the TS echo check. 1703 */ 1704 struct timeval delta_ts; 1705 int ts_fudge; 1706 1707 1708 /* 1709 * PFTM_TS_DIFF is how many seconds of leeway to allow 1710 * a host's timestamp. This can happen if the previous 1711 * packet got delayed in transit for much longer than 1712 * this packet. 1713 */ 1714 if ((ts_fudge = state->rule.ptr->timeout[PFTM_TS_DIFF]) == 0) 1715 ts_fudge = pf_default_rule.timeout[PFTM_TS_DIFF]; 1716 1717 1718 /* Calculate max ticks since the last timestamp */ 1719 #define TS_MAXFREQ 1100 /* RFC max TS freq of 1 kHz + 10% skew */ 1720 #define TS_MICROSECS 1000000 /* microseconds per second */ 1721 timersub(&uptime, &src->scrub->pfss_last, &delta_ts); 1722 tsval_from_last = (delta_ts.tv_sec + ts_fudge) * TS_MAXFREQ; 1723 tsval_from_last += delta_ts.tv_usec / (TS_MICROSECS/TS_MAXFREQ); 1724 1725 1726 if ((src->state >= TCPS_ESTABLISHED && 1727 dst->state >= TCPS_ESTABLISHED) && 1728 (SEQ_LT(tsval, dst->scrub->pfss_tsecr) || 1729 SEQ_GT(tsval, src->scrub->pfss_tsval + tsval_from_last) || 1730 (tsecr && (SEQ_GT(tsecr, dst->scrub->pfss_tsval) || 1731 SEQ_LT(tsecr, dst->scrub->pfss_tsval0))))) { 1732 /* Bad RFC1323 implementation or an insertion attack. 1733 * 1734 * - Solaris 2.6 and 2.7 are known to send another ACK 1735 * after the FIN,FIN|ACK,ACK closing that carries 1736 * an old timestamp. 1737 */ 1738 1739 DPFPRINTF(("Timestamp failed %c%c%c%c\n", 1740 SEQ_LT(tsval, dst->scrub->pfss_tsecr) ? '0' : ' ', 1741 SEQ_GT(tsval, src->scrub->pfss_tsval + 1742 tsval_from_last) ? '1' : ' ', 1743 SEQ_GT(tsecr, dst->scrub->pfss_tsval) ? '2' : ' ', 1744 SEQ_LT(tsecr, dst->scrub->pfss_tsval0)? '3' : ' ')); 1745 DPFPRINTF((" tsval: %" PRIu32 " tsecr: %" PRIu32 1746 " +ticks: %" PRIu32 " idle: %"PRIx64"s %ums\n", 1747 tsval, tsecr, tsval_from_last, delta_ts.tv_sec, 1748 delta_ts.tv_usec / 1000U)); 1749 DPFPRINTF((" src->tsval: %" PRIu32 " tsecr: %" PRIu32 1750 "\n", 1751 src->scrub->pfss_tsval, src->scrub->pfss_tsecr)); 1752 DPFPRINTF((" dst->tsval: %" PRIu32 " tsecr: %" PRIu32 1753 " tsval0: %" PRIu32 "\n", 1754 dst->scrub->pfss_tsval, 1755 dst->scrub->pfss_tsecr, dst->scrub->pfss_tsval0)); 1756 if (pf_status.debug >= PF_DEBUG_MISC) { 1757 pf_print_state(state); 1758 pf_print_flags(th->th_flags); 1759 printf("\n"); 1760 } 1761 REASON_SET(reason, PFRES_TS); 1762 return (PF_DROP); 1763 } 1764 1765 /* XXX I'd really like to require tsecr but it's optional */ 1766 1767 } else if (!got_ts && (th->th_flags & TH_RST) == 0 && 1768 ((src->state == TCPS_ESTABLISHED && dst->state == TCPS_ESTABLISHED) 1769 || pd->p_len > 0 || (th->th_flags & TH_SYN)) && 1770 src->scrub && dst->scrub && 1771 (src->scrub->pfss_flags & PFSS_PAWS) && 1772 (dst->scrub->pfss_flags & PFSS_PAWS)) { 1773 /* Didn't send a timestamp. Timestamps aren't really useful 1774 * when: 1775 * - connection opening or closing (often not even sent). 1776 * but we must not let an attacker to put a FIN on a 1777 * data packet to sneak it through our ESTABLISHED check. 1778 * - on a TCP reset. RFC suggests not even looking at TS. 1779 * - on an empty ACK. The TS will not be echoed so it will 1780 * probably not help keep the RTT calculation in sync and 1781 * there isn't as much danger when the sequence numbers 1782 * got wrapped. So some stacks don't include TS on empty 1783 * ACKs :-( 1784 * 1785 * To minimize the disruption to mostly RFC1323 conformant 1786 * stacks, we will only require timestamps on data packets. 1787 * 1788 * And what do ya know, we cannot require timestamps on data 1789 * packets. There appear to be devices that do legitimate 1790 * TCP connection hijacking. There are HTTP devices that allow 1791 * a 3whs (with timestamps) and then buffer the HTTP request. 1792 * If the intermediate device has the HTTP response cache, it 1793 * will spoof the response but not bother timestamping its 1794 * packets. So we can look for the presence of a timestamp in 1795 * the first data packet and if there, require it in all future 1796 * packets. 1797 */ 1798 1799 if (pd->p_len > 0 && (src->scrub->pfss_flags & PFSS_DATA_TS)) { 1800 /* 1801 * Hey! Someone tried to sneak a packet in. Or the 1802 * stack changed its RFC1323 behavior?!?! 1803 */ 1804 if (pf_status.debug >= PF_DEBUG_MISC) { 1805 DPFPRINTF(("Did not receive expected RFC1323 " 1806 "timestamp\n")); 1807 pf_print_state(state); 1808 pf_print_flags(th->th_flags); 1809 printf("\n"); 1810 } 1811 REASON_SET(reason, PFRES_TS); 1812 return (PF_DROP); 1813 } 1814 } 1815 1816 1817 /* 1818 * We will note if a host sends his data packets with or without 1819 * timestamps. And require all data packets to contain a timestamp 1820 * if the first does. PAWS implicitly requires that all data packets be 1821 * timestamped. But I think there are middle-man devices that hijack 1822 * TCP streams immediately after the 3whs and don't timestamp their 1823 * packets (seen in a WWW accelerator or cache). 1824 */ 1825 if (pd->p_len > 0 && src->scrub && (src->scrub->pfss_flags & 1826 (PFSS_TIMESTAMP|PFSS_DATA_TS|PFSS_DATA_NOTS)) == PFSS_TIMESTAMP) { 1827 if (got_ts) 1828 src->scrub->pfss_flags |= PFSS_DATA_TS; 1829 else { 1830 src->scrub->pfss_flags |= PFSS_DATA_NOTS; 1831 if (pf_status.debug >= PF_DEBUG_MISC && dst->scrub && 1832 (dst->scrub->pfss_flags & PFSS_TIMESTAMP)) { 1833 /* Don't warn if other host rejected RFC1323 */ 1834 DPFPRINTF(("Broken RFC1323 stack did not " 1835 "timestamp data packet. Disabled PAWS " 1836 "security.\n")); 1837 pf_print_state(state); 1838 pf_print_flags(th->th_flags); 1839 printf("\n"); 1840 } 1841 } 1842 } 1843 1844 1845 /* 1846 * Update PAWS values 1847 */ 1848 if (got_ts && src->scrub && PFSS_TIMESTAMP == (src->scrub->pfss_flags & 1849 (PFSS_PAWS_IDLED|PFSS_TIMESTAMP))) { 1850 getmicrouptime(&src->scrub->pfss_last); 1851 if (SEQ_GEQ(tsval, src->scrub->pfss_tsval) || 1852 (src->scrub->pfss_flags & PFSS_PAWS) == 0) 1853 src->scrub->pfss_tsval = tsval; 1854 1855 if (tsecr) { 1856 if (SEQ_GEQ(tsecr, src->scrub->pfss_tsecr) || 1857 (src->scrub->pfss_flags & PFSS_PAWS) == 0) 1858 src->scrub->pfss_tsecr = tsecr; 1859 1860 if ((src->scrub->pfss_flags & PFSS_PAWS) == 0 && 1861 (SEQ_LT(tsval, src->scrub->pfss_tsval0) || 1862 src->scrub->pfss_tsval0 == 0)) { 1863 /* tsval0 MUST be the lowest timestamp */ 1864 src->scrub->pfss_tsval0 = tsval; 1865 } 1866 1867 /* Only fully initialized after a TS gets echoed */ 1868 if ((src->scrub->pfss_flags & PFSS_PAWS) == 0) 1869 src->scrub->pfss_flags |= PFSS_PAWS; 1870 } 1871 } 1872 1873 /* I have a dream.... TCP segment reassembly.... */ 1874 return (0); 1875 } 1876 1877 int 1878 pf_normalize_tcpopt(struct pf_rule *r, struct mbuf *m, struct tcphdr *th, 1879 int off) 1880 { 1881 u_int16_t *mss; 1882 int thoff; 1883 int opt, cnt, optlen = 0; 1884 int rewrite = 0; 1885 u_char *optp; 1886 1887 thoff = th->th_off << 2; 1888 cnt = thoff - sizeof(struct tcphdr); 1889 optp = mtod(m, u_char *) + off + sizeof(struct tcphdr); 1890 1891 for (; cnt > 0; cnt -= optlen, optp += optlen) { 1892 opt = optp[0]; 1893 if (opt == TCPOPT_EOL) 1894 break; 1895 if (opt == TCPOPT_NOP) 1896 optlen = 1; 1897 else { 1898 if (cnt < 2) 1899 break; 1900 optlen = optp[1]; 1901 if (optlen < 2 || optlen > cnt) 1902 break; 1903 } 1904 switch (opt) { 1905 case TCPOPT_MAXSEG: 1906 mss = (u_int16_t *)(optp + 2); 1907 if ((ntohs(*mss)) > r->max_mss) { 1908 th->th_sum = pf_cksum_fixup(th->th_sum, 1909 *mss, htons(r->max_mss), 0); 1910 *mss = htons(r->max_mss); 1911 rewrite = 1; 1912 } 1913 break; 1914 default: 1915 break; 1916 } 1917 } 1918 1919 return (rewrite); 1920 } 1921
Indexes created Sun Sep 21 16:09:51 GMT 2025