pf_norm.c revision 1.3.2.5
1 1.3.2.5 skrll /* $NetBSD: pf_norm.c,v 1.3.2.5 2004/11/29 07:24:33 skrll Exp $ */ 2 1.3.2.5 skrll /* $OpenBSD: pf_norm.c,v 1.96 2004/07/17 00:17:27 frantzen Exp $ */ 3 1.3.2.2 skrll 4 1.3.2.2 skrll /* 5 1.3.2.2 skrll * Copyright 2001 Niels Provos <provos (at) citi.umich.edu> 6 1.3.2.2 skrll * All rights reserved. 7 1.3.2.2 skrll * 8 1.3.2.2 skrll * Redistribution and use in source and binary forms, with or without 9 1.3.2.2 skrll * modification, are permitted provided that the following conditions 10 1.3.2.2 skrll * are met: 11 1.3.2.2 skrll * 1. Redistributions of source code must retain the above copyright 12 1.3.2.2 skrll * notice, this list of conditions and the following disclaimer. 13 1.3.2.2 skrll * 2. Redistributions in binary form must reproduce the above copyright 14 1.3.2.2 skrll * notice, this list of conditions and the following disclaimer in the 15 1.3.2.2 skrll * documentation and/or other materials provided with the distribution. 16 1.3.2.2 skrll * 17 1.3.2.2 skrll * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 1.3.2.2 skrll * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 1.3.2.2 skrll * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 1.3.2.2 skrll * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 1.3.2.2 skrll * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 1.3.2.2 skrll * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 1.3.2.2 skrll * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 1.3.2.2 skrll * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 1.3.2.2 skrll * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 1.3.2.2 skrll * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 1.3.2.2 skrll */ 28 1.3.2.2 skrll 29 1.3.2.2 skrll #ifdef _KERNEL_OPT 30 1.3.2.2 skrll #include "opt_inet.h" 31 1.3.2.2 skrll #endif 32 1.3.2.2 skrll 33 1.3.2.2 skrll #include "pflog.h" 34 1.3.2.2 skrll 35 1.3.2.2 skrll #include <sys/param.h> 36 1.3.2.2 skrll #include <sys/systm.h> 37 1.3.2.2 skrll #include <sys/mbuf.h> 38 1.3.2.2 skrll #include <sys/filio.h> 39 1.3.2.2 skrll #include <sys/fcntl.h> 40 1.3.2.2 skrll #include <sys/socket.h> 41 1.3.2.2 skrll #include <sys/kernel.h> 42 1.3.2.2 skrll #include <sys/time.h> 43 1.3.2.2 skrll #include <sys/pool.h> 44 1.3.2.2 skrll 45 1.3.2.2 skrll #ifdef __OpenBSD__ 46 1.3.2.2 skrll #include <dev/rndvar.h> 47 1.3.2.2 skrll #else 48 1.3.2.2 skrll #include <sys/rnd.h> 49 1.3.2.2 skrll #endif 50 1.3.2.2 skrll #include <net/if.h> 51 1.3.2.2 skrll #include <net/if_types.h> 52 1.3.2.2 skrll #include <net/bpf.h> 53 1.3.2.2 skrll #include <net/route.h> 54 1.3.2.2 skrll #include <net/if_pflog.h> 55 1.3.2.2 skrll 56 1.3.2.2 skrll #include <netinet/in.h> 57 1.3.2.2 skrll #include <netinet/in_var.h> 58 1.3.2.2 skrll #include <netinet/in_systm.h> 59 1.3.2.2 skrll #include <netinet/ip.h> 60 1.3.2.2 skrll #include <netinet/ip_var.h> 61 1.3.2.2 skrll #include <netinet/tcp.h> 62 1.3.2.2 skrll #include <netinet/tcp_seq.h> 63 1.3.2.2 skrll #include <netinet/udp.h> 64 1.3.2.2 skrll #include <netinet/ip_icmp.h> 65 1.3.2.2 skrll 66 1.3.2.2 skrll #ifdef INET6 67 1.3.2.2 skrll #include <netinet/ip6.h> 68 1.3.2.2 skrll #endif /* INET6 */ 69 1.3.2.2 skrll 70 1.3.2.2 skrll #include <net/pfvar.h> 71 1.3.2.2 skrll 72 1.3.2.2 skrll struct pf_frent { 73 1.3.2.2 skrll LIST_ENTRY(pf_frent) fr_next; 74 1.3.2.2 skrll struct ip *fr_ip; 75 1.3.2.2 skrll struct mbuf *fr_m; 76 1.3.2.2 skrll }; 77 1.3.2.2 skrll 78 1.3.2.2 skrll struct pf_frcache { 79 1.3.2.2 skrll LIST_ENTRY(pf_frcache) fr_next; 80 1.3.2.2 skrll uint16_t fr_off; 81 1.3.2.2 skrll uint16_t fr_end; 82 1.3.2.2 skrll }; 83 1.3.2.2 skrll 84 1.3.2.2 skrll #define PFFRAG_SEENLAST 0x0001 /* Seen the last fragment for this */ 85 1.3.2.2 skrll #define PFFRAG_NOBUFFER 0x0002 /* Non-buffering fragment cache */ 86 1.3.2.2 skrll #define PFFRAG_DROP 0x0004 /* Drop all fragments */ 87 1.3.2.2 skrll #define BUFFER_FRAGMENTS(fr) (!((fr)->fr_flags & PFFRAG_NOBUFFER)) 88 1.3.2.2 skrll 89 1.3.2.2 skrll struct pf_fragment { 90 1.3.2.2 skrll RB_ENTRY(pf_fragment) fr_entry; 91 1.3.2.2 skrll TAILQ_ENTRY(pf_fragment) frag_next; 92 1.3.2.2 skrll struct in_addr fr_src; 93 1.3.2.2 skrll struct in_addr fr_dst; 94 1.3.2.2 skrll u_int8_t fr_p; /* protocol of this fragment */ 95 1.3.2.2 skrll u_int8_t fr_flags; /* status flags */ 96 1.3.2.2 skrll u_int16_t fr_id; /* fragment id for reassemble */ 97 1.3.2.2 skrll u_int16_t fr_max; /* fragment data max */ 98 1.3.2.2 skrll u_int32_t fr_timeout; 99 1.3.2.2 skrll #define fr_queue fr_u.fru_queue 100 1.3.2.2 skrll #define fr_cache fr_u.fru_cache 101 1.3.2.2 skrll union { 102 1.3.2.2 skrll LIST_HEAD(pf_fragq, pf_frent) fru_queue; /* buffering */ 103 1.3.2.2 skrll LIST_HEAD(pf_cacheq, pf_frcache) fru_cache; /* non-buf */ 104 1.3.2.2 skrll } fr_u; 105 1.3.2.2 skrll }; 106 1.3.2.2 skrll 107 1.3.2.2 skrll TAILQ_HEAD(pf_fragqueue, pf_fragment) pf_fragqueue; 108 1.3.2.2 skrll TAILQ_HEAD(pf_cachequeue, pf_fragment) pf_cachequeue; 109 1.3.2.2 skrll 110 1.3.2.2 skrll static __inline int pf_frag_compare(struct pf_fragment *, 111 1.3.2.2 skrll struct pf_fragment *); 112 1.3.2.2 skrll RB_HEAD(pf_frag_tree, pf_fragment) pf_frag_tree, pf_cache_tree; 113 1.3.2.2 skrll RB_PROTOTYPE(pf_frag_tree, pf_fragment, fr_entry, pf_frag_compare); 114 1.3.2.2 skrll RB_GENERATE(pf_frag_tree, pf_fragment, fr_entry, pf_frag_compare); 115 1.3.2.2 skrll 116 1.3.2.2 skrll /* Private prototypes */ 117 1.3.2.2 skrll void pf_ip2key(struct pf_fragment *, struct ip *); 118 1.3.2.2 skrll void pf_remove_fragment(struct pf_fragment *); 119 1.3.2.2 skrll void pf_flush_fragments(void); 120 1.3.2.2 skrll void pf_free_fragment(struct pf_fragment *); 121 1.3.2.2 skrll struct pf_fragment *pf_find_fragment(struct ip *, struct pf_frag_tree *); 122 1.3.2.2 skrll struct mbuf *pf_reassemble(struct mbuf **, struct pf_fragment **, 123 1.3.2.2 skrll struct pf_frent *, int); 124 1.3.2.2 skrll struct mbuf *pf_fragcache(struct mbuf **, struct ip*, 125 1.3.2.2 skrll struct pf_fragment **, int, int, int *); 126 1.3.2.2 skrll int pf_normalize_tcpopt(struct pf_rule *, struct mbuf *, 127 1.3.2.2 skrll struct tcphdr *, int); 128 1.3.2.2 skrll 129 1.3.2.5 skrll #define DPFPRINTF(x) do { \ 130 1.3.2.5 skrll if (pf_status.debug >= PF_DEBUG_MISC) { \ 131 1.3.2.5 skrll printf("%s: ", __func__); \ 132 1.3.2.5 skrll printf x ; \ 133 1.3.2.5 skrll } \ 134 1.3.2.5 skrll } while(0) 135 1.3.2.2 skrll 136 1.3.2.2 skrll /* Globals */ 137 1.3.2.2 skrll struct pool pf_frent_pl, pf_frag_pl, pf_cache_pl, pf_cent_pl; 138 1.3.2.2 skrll struct pool pf_state_scrub_pl; 139 1.3.2.2 skrll int pf_nfrents, pf_ncache; 140 1.3.2.2 skrll 141 1.3.2.2 skrll void 142 1.3.2.2 skrll pf_normalize_init(void) 143 1.3.2.2 skrll { 144 1.3.2.2 skrll pool_init(&pf_frent_pl, sizeof(struct pf_frent), 0, 0, 0, "pffrent", 145 1.3.2.2 skrll NULL); 146 1.3.2.2 skrll pool_init(&pf_frag_pl, sizeof(struct pf_fragment), 0, 0, 0, "pffrag", 147 1.3.2.2 skrll NULL); 148 1.3.2.2 skrll pool_init(&pf_cache_pl, sizeof(struct pf_fragment), 0, 0, 0, 149 1.3.2.2 skrll "pffrcache", NULL); 150 1.3.2.2 skrll pool_init(&pf_cent_pl, sizeof(struct pf_frcache), 0, 0, 0, "pffrcent", 151 1.3.2.2 skrll NULL); 152 1.3.2.2 skrll pool_init(&pf_state_scrub_pl, sizeof(struct pf_state_scrub), 0, 0, 0, 153 1.3.2.2 skrll "pfstscr", NULL); 154 1.3.2.2 skrll 155 1.3.2.2 skrll pool_sethiwat(&pf_frag_pl, PFFRAG_FRAG_HIWAT); 156 1.3.2.2 skrll pool_sethardlimit(&pf_frent_pl, PFFRAG_FRENT_HIWAT, NULL, 0); 157 1.3.2.2 skrll pool_sethardlimit(&pf_cache_pl, PFFRAG_FRCACHE_HIWAT, NULL, 0); 158 1.3.2.2 skrll pool_sethardlimit(&pf_cent_pl, PFFRAG_FRCENT_HIWAT, NULL, 0); 159 1.3.2.2 skrll 160 1.3.2.2 skrll TAILQ_INIT(&pf_fragqueue); 161 1.3.2.2 skrll TAILQ_INIT(&pf_cachequeue); 162 1.3.2.2 skrll } 163 1.3.2.2 skrll 164 1.3.2.2 skrll #ifdef _LKM 165 1.3.2.2 skrll #define TAILQ_DRAIN(list, element) \ 166 1.3.2.2 skrll do { \ 167 1.3.2.2 skrll while ((element = TAILQ_FIRST(list)) != NULL) \ 168 1.3.2.2 skrll TAILQ_REMOVE(list, element, frag_next); \ 169 1.3.2.2 skrll } while (0) 170 1.3.2.2 skrll 171 1.3.2.2 skrll void 172 1.3.2.2 skrll pf_normalize_destroy(void) 173 1.3.2.2 skrll { 174 1.3.2.2 skrll struct pf_fragment *fragment_e; 175 1.3.2.2 skrll 176 1.3.2.2 skrll TAILQ_DRAIN(&pf_fragqueue, fragment_e); 177 1.3.2.2 skrll TAILQ_DRAIN(&pf_cachequeue, fragment_e); 178 1.3.2.2 skrll 179 1.3.2.2 skrll pool_destroy(&pf_state_scrub_pl); 180 1.3.2.2 skrll pool_destroy(&pf_cent_pl); 181 1.3.2.2 skrll pool_destroy(&pf_cache_pl); 182 1.3.2.2 skrll pool_destroy(&pf_frag_pl); 183 1.3.2.2 skrll pool_destroy(&pf_frent_pl); 184 1.3.2.2 skrll } 185 1.3.2.2 skrll #endif 186 1.3.2.2 skrll 187 1.3.2.2 skrll static __inline int 188 1.3.2.2 skrll pf_frag_compare(struct pf_fragment *a, struct pf_fragment *b) 189 1.3.2.2 skrll { 190 1.3.2.2 skrll int diff; 191 1.3.2.2 skrll 192 1.3.2.2 skrll if ((diff = a->fr_id - b->fr_id)) 193 1.3.2.2 skrll return (diff); 194 1.3.2.2 skrll else if ((diff = a->fr_p - b->fr_p)) 195 1.3.2.2 skrll return (diff); 196 1.3.2.2 skrll else if (a->fr_src.s_addr < b->fr_src.s_addr) 197 1.3.2.2 skrll return (-1); 198 1.3.2.2 skrll else if (a->fr_src.s_addr > b->fr_src.s_addr) 199 1.3.2.2 skrll return (1); 200 1.3.2.2 skrll else if (a->fr_dst.s_addr < b->fr_dst.s_addr) 201 1.3.2.2 skrll return (-1); 202 1.3.2.2 skrll else if (a->fr_dst.s_addr > b->fr_dst.s_addr) 203 1.3.2.2 skrll return (1); 204 1.3.2.2 skrll return (0); 205 1.3.2.2 skrll } 206 1.3.2.2 skrll 207 1.3.2.2 skrll void 208 1.3.2.2 skrll pf_purge_expired_fragments(void) 209 1.3.2.2 skrll { 210 1.3.2.2 skrll struct pf_fragment *frag; 211 1.3.2.5 skrll u_int32_t expire = time_second - 212 1.3.2.2 skrll pf_default_rule.timeout[PFTM_FRAG]; 213 1.3.2.2 skrll 214 1.3.2.2 skrll while ((frag = TAILQ_LAST(&pf_fragqueue, pf_fragqueue)) != NULL) { 215 1.3.2.2 skrll KASSERT(BUFFER_FRAGMENTS(frag)); 216 1.3.2.2 skrll if (frag->fr_timeout > expire) 217 1.3.2.2 skrll break; 218 1.3.2.2 skrll 219 1.3.2.2 skrll DPFPRINTF(("expiring %d(%p)\n", frag->fr_id, frag)); 220 1.3.2.2 skrll pf_free_fragment(frag); 221 1.3.2.2 skrll } 222 1.3.2.2 skrll 223 1.3.2.2 skrll while ((frag = TAILQ_LAST(&pf_cachequeue, pf_cachequeue)) != NULL) { 224 1.3.2.2 skrll KASSERT(!BUFFER_FRAGMENTS(frag)); 225 1.3.2.2 skrll if (frag->fr_timeout > expire) 226 1.3.2.2 skrll break; 227 1.3.2.2 skrll 228 1.3.2.2 skrll DPFPRINTF(("expiring %d(%p)\n", frag->fr_id, frag)); 229 1.3.2.2 skrll pf_free_fragment(frag); 230 1.3.2.2 skrll KASSERT(TAILQ_EMPTY(&pf_cachequeue) || 231 1.3.2.2 skrll TAILQ_LAST(&pf_cachequeue, pf_cachequeue) != frag); 232 1.3.2.2 skrll } 233 1.3.2.2 skrll } 234 1.3.2.2 skrll 235 1.3.2.2 skrll /* 236 1.3.2.2 skrll * Try to flush old fragments to make space for new ones 237 1.3.2.2 skrll */ 238 1.3.2.2 skrll 239 1.3.2.2 skrll void 240 1.3.2.2 skrll pf_flush_fragments(void) 241 1.3.2.2 skrll { 242 1.3.2.2 skrll struct pf_fragment *frag; 243 1.3.2.2 skrll int goal; 244 1.3.2.2 skrll 245 1.3.2.2 skrll goal = pf_nfrents * 9 / 10; 246 1.3.2.2 skrll DPFPRINTF(("trying to free > %d frents\n", 247 1.3.2.2 skrll pf_nfrents - goal)); 248 1.3.2.2 skrll while (goal < pf_nfrents) { 249 1.3.2.2 skrll frag = TAILQ_LAST(&pf_fragqueue, pf_fragqueue); 250 1.3.2.2 skrll if (frag == NULL) 251 1.3.2.2 skrll break; 252 1.3.2.2 skrll pf_free_fragment(frag); 253 1.3.2.2 skrll } 254 1.3.2.2 skrll 255 1.3.2.2 skrll 256 1.3.2.2 skrll goal = pf_ncache * 9 / 10; 257 1.3.2.2 skrll DPFPRINTF(("trying to free > %d cache entries\n", 258 1.3.2.2 skrll pf_ncache - goal)); 259 1.3.2.2 skrll while (goal < pf_ncache) { 260 1.3.2.2 skrll frag = TAILQ_LAST(&pf_cachequeue, pf_cachequeue); 261 1.3.2.2 skrll if (frag == NULL) 262 1.3.2.2 skrll break; 263 1.3.2.2 skrll pf_free_fragment(frag); 264 1.3.2.2 skrll } 265 1.3.2.2 skrll } 266 1.3.2.2 skrll 267 1.3.2.2 skrll /* Frees the fragments and all associated entries */ 268 1.3.2.2 skrll 269 1.3.2.2 skrll void 270 1.3.2.2 skrll pf_free_fragment(struct pf_fragment *frag) 271 1.3.2.2 skrll { 272 1.3.2.2 skrll struct pf_frent *frent; 273 1.3.2.2 skrll struct pf_frcache *frcache; 274 1.3.2.2 skrll 275 1.3.2.2 skrll /* Free all fragments */ 276 1.3.2.2 skrll if (BUFFER_FRAGMENTS(frag)) { 277 1.3.2.2 skrll for (frent = LIST_FIRST(&frag->fr_queue); frent; 278 1.3.2.2 skrll frent = LIST_FIRST(&frag->fr_queue)) { 279 1.3.2.2 skrll LIST_REMOVE(frent, fr_next); 280 1.3.2.2 skrll 281 1.3.2.2 skrll m_freem(frent->fr_m); 282 1.3.2.2 skrll pool_put(&pf_frent_pl, frent); 283 1.3.2.2 skrll pf_nfrents--; 284 1.3.2.2 skrll } 285 1.3.2.2 skrll } else { 286 1.3.2.2 skrll for (frcache = LIST_FIRST(&frag->fr_cache); frcache; 287 1.3.2.2 skrll frcache = LIST_FIRST(&frag->fr_cache)) { 288 1.3.2.2 skrll LIST_REMOVE(frcache, fr_next); 289 1.3.2.2 skrll 290 1.3.2.2 skrll KASSERT(LIST_EMPTY(&frag->fr_cache) || 291 1.3.2.2 skrll LIST_FIRST(&frag->fr_cache)->fr_off > 292 1.3.2.2 skrll frcache->fr_end); 293 1.3.2.2 skrll 294 1.3.2.2 skrll pool_put(&pf_cent_pl, frcache); 295 1.3.2.2 skrll pf_ncache--; 296 1.3.2.2 skrll } 297 1.3.2.2 skrll } 298 1.3.2.2 skrll 299 1.3.2.2 skrll pf_remove_fragment(frag); 300 1.3.2.2 skrll } 301 1.3.2.2 skrll 302 1.3.2.2 skrll void 303 1.3.2.2 skrll pf_ip2key(struct pf_fragment *key, struct ip *ip) 304 1.3.2.2 skrll { 305 1.3.2.2 skrll key->fr_p = ip->ip_p; 306 1.3.2.2 skrll key->fr_id = ip->ip_id; 307 1.3.2.2 skrll key->fr_src.s_addr = ip->ip_src.s_addr; 308 1.3.2.2 skrll key->fr_dst.s_addr = ip->ip_dst.s_addr; 309 1.3.2.2 skrll } 310 1.3.2.2 skrll 311 1.3.2.2 skrll struct pf_fragment * 312 1.3.2.2 skrll pf_find_fragment(struct ip *ip, struct pf_frag_tree *tree) 313 1.3.2.2 skrll { 314 1.3.2.2 skrll struct pf_fragment key; 315 1.3.2.2 skrll struct pf_fragment *frag; 316 1.3.2.2 skrll 317 1.3.2.2 skrll pf_ip2key(&key, ip); 318 1.3.2.2 skrll 319 1.3.2.2 skrll frag = RB_FIND(pf_frag_tree, tree, &key); 320 1.3.2.2 skrll if (frag != NULL) { 321 1.3.2.2 skrll /* XXX Are we sure we want to update the timeout? */ 322 1.3.2.5 skrll frag->fr_timeout = time_second; 323 1.3.2.2 skrll if (BUFFER_FRAGMENTS(frag)) { 324 1.3.2.2 skrll TAILQ_REMOVE(&pf_fragqueue, frag, frag_next); 325 1.3.2.2 skrll TAILQ_INSERT_HEAD(&pf_fragqueue, frag, frag_next); 326 1.3.2.2 skrll } else { 327 1.3.2.2 skrll TAILQ_REMOVE(&pf_cachequeue, frag, frag_next); 328 1.3.2.2 skrll TAILQ_INSERT_HEAD(&pf_cachequeue, frag, frag_next); 329 1.3.2.2 skrll } 330 1.3.2.2 skrll } 331 1.3.2.2 skrll 332 1.3.2.2 skrll return (frag); 333 1.3.2.2 skrll } 334 1.3.2.2 skrll 335 1.3.2.2 skrll /* Removes a fragment from the fragment queue and frees the fragment */ 336 1.3.2.2 skrll 337 1.3.2.2 skrll void 338 1.3.2.2 skrll pf_remove_fragment(struct pf_fragment *frag) 339 1.3.2.2 skrll { 340 1.3.2.2 skrll if (BUFFER_FRAGMENTS(frag)) { 341 1.3.2.2 skrll RB_REMOVE(pf_frag_tree, &pf_frag_tree, frag); 342 1.3.2.2 skrll TAILQ_REMOVE(&pf_fragqueue, frag, frag_next); 343 1.3.2.2 skrll pool_put(&pf_frag_pl, frag); 344 1.3.2.2 skrll } else { 345 1.3.2.2 skrll RB_REMOVE(pf_frag_tree, &pf_cache_tree, frag); 346 1.3.2.2 skrll TAILQ_REMOVE(&pf_cachequeue, frag, frag_next); 347 1.3.2.2 skrll pool_put(&pf_cache_pl, frag); 348 1.3.2.2 skrll } 349 1.3.2.2 skrll } 350 1.3.2.2 skrll 351 1.3.2.2 skrll #define FR_IP_OFF(fr) ((ntohs((fr)->fr_ip->ip_off) & IP_OFFMASK) << 3) 352 1.3.2.2 skrll struct mbuf * 353 1.3.2.2 skrll pf_reassemble(struct mbuf **m0, struct pf_fragment **frag, 354 1.3.2.2 skrll struct pf_frent *frent, int mff) 355 1.3.2.2 skrll { 356 1.3.2.2 skrll struct mbuf *m = *m0, *m2; 357 1.3.2.2 skrll struct pf_frent *frea, *next; 358 1.3.2.2 skrll struct pf_frent *frep = NULL; 359 1.3.2.2 skrll struct ip *ip = frent->fr_ip; 360 1.3.2.2 skrll int hlen = ip->ip_hl << 2; 361 1.3.2.2 skrll u_int16_t off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3; 362 1.3.2.2 skrll u_int16_t ip_len = ntohs(ip->ip_len) - ip->ip_hl * 4; 363 1.3.2.2 skrll u_int16_t max = ip_len + off; 364 1.3.2.2 skrll 365 1.3.2.2 skrll KASSERT(*frag == NULL || BUFFER_FRAGMENTS(*frag)); 366 1.3.2.2 skrll 367 1.3.2.2 skrll /* Strip off ip header */ 368 1.3.2.2 skrll m->m_data += hlen; 369 1.3.2.2 skrll m->m_len -= hlen; 370 1.3.2.2 skrll 371 1.3.2.2 skrll /* Create a new reassembly queue for this packet */ 372 1.3.2.2 skrll if (*frag == NULL) { 373 1.3.2.2 skrll *frag = pool_get(&pf_frag_pl, PR_NOWAIT); 374 1.3.2.2 skrll if (*frag == NULL) { 375 1.3.2.2 skrll pf_flush_fragments(); 376 1.3.2.2 skrll *frag = pool_get(&pf_frag_pl, PR_NOWAIT); 377 1.3.2.2 skrll if (*frag == NULL) 378 1.3.2.2 skrll goto drop_fragment; 379 1.3.2.2 skrll } 380 1.3.2.2 skrll 381 1.3.2.2 skrll (*frag)->fr_flags = 0; 382 1.3.2.2 skrll (*frag)->fr_max = 0; 383 1.3.2.2 skrll (*frag)->fr_src = frent->fr_ip->ip_src; 384 1.3.2.2 skrll (*frag)->fr_dst = frent->fr_ip->ip_dst; 385 1.3.2.2 skrll (*frag)->fr_p = frent->fr_ip->ip_p; 386 1.3.2.2 skrll (*frag)->fr_id = frent->fr_ip->ip_id; 387 1.3.2.5 skrll (*frag)->fr_timeout = time_second; 388 1.3.2.2 skrll LIST_INIT(&(*frag)->fr_queue); 389 1.3.2.2 skrll 390 1.3.2.2 skrll RB_INSERT(pf_frag_tree, &pf_frag_tree, *frag); 391 1.3.2.2 skrll TAILQ_INSERT_HEAD(&pf_fragqueue, *frag, frag_next); 392 1.3.2.2 skrll 393 1.3.2.2 skrll /* We do not have a previous fragment */ 394 1.3.2.2 skrll frep = NULL; 395 1.3.2.2 skrll goto insert; 396 1.3.2.2 skrll } 397 1.3.2.2 skrll 398 1.3.2.2 skrll /* 399 1.3.2.2 skrll * Find a fragment after the current one: 400 1.3.2.2 skrll * - off contains the real shifted offset. 401 1.3.2.2 skrll */ 402 1.3.2.2 skrll LIST_FOREACH(frea, &(*frag)->fr_queue, fr_next) { 403 1.3.2.2 skrll if (FR_IP_OFF(frea) > off) 404 1.3.2.2 skrll break; 405 1.3.2.2 skrll frep = frea; 406 1.3.2.2 skrll } 407 1.3.2.2 skrll 408 1.3.2.2 skrll KASSERT(frep != NULL || frea != NULL); 409 1.3.2.2 skrll 410 1.3.2.2 skrll if (frep != NULL && 411 1.3.2.2 skrll FR_IP_OFF(frep) + ntohs(frep->fr_ip->ip_len) - frep->fr_ip->ip_hl * 412 1.3.2.2 skrll 4 > off) 413 1.3.2.2 skrll { 414 1.3.2.2 skrll u_int16_t precut; 415 1.3.2.2 skrll 416 1.3.2.2 skrll precut = FR_IP_OFF(frep) + ntohs(frep->fr_ip->ip_len) - 417 1.3.2.2 skrll frep->fr_ip->ip_hl * 4 - off; 418 1.3.2.2 skrll if (precut >= ip_len) 419 1.3.2.2 skrll goto drop_fragment; 420 1.3.2.2 skrll m_adj(frent->fr_m, precut); 421 1.3.2.2 skrll DPFPRINTF(("overlap -%d\n", precut)); 422 1.3.2.2 skrll /* Enforce 8 byte boundaries */ 423 1.3.2.2 skrll ip->ip_off = htons(ntohs(ip->ip_off) + (precut >> 3)); 424 1.3.2.2 skrll off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3; 425 1.3.2.2 skrll ip_len -= precut; 426 1.3.2.2 skrll ip->ip_len = htons(ip_len); 427 1.3.2.2 skrll } 428 1.3.2.2 skrll 429 1.3.2.2 skrll for (; frea != NULL && ip_len + off > FR_IP_OFF(frea); 430 1.3.2.2 skrll frea = next) 431 1.3.2.2 skrll { 432 1.3.2.2 skrll u_int16_t aftercut; 433 1.3.2.2 skrll 434 1.3.2.2 skrll aftercut = ip_len + off - FR_IP_OFF(frea); 435 1.3.2.2 skrll DPFPRINTF(("adjust overlap %d\n", aftercut)); 436 1.3.2.2 skrll if (aftercut < ntohs(frea->fr_ip->ip_len) - frea->fr_ip->ip_hl 437 1.3.2.2 skrll * 4) 438 1.3.2.2 skrll { 439 1.3.2.2 skrll frea->fr_ip->ip_len = 440 1.3.2.2 skrll htons(ntohs(frea->fr_ip->ip_len) - aftercut); 441 1.3.2.2 skrll frea->fr_ip->ip_off = htons(ntohs(frea->fr_ip->ip_off) + 442 1.3.2.2 skrll (aftercut >> 3)); 443 1.3.2.2 skrll m_adj(frea->fr_m, aftercut); 444 1.3.2.2 skrll break; 445 1.3.2.2 skrll } 446 1.3.2.2 skrll 447 1.3.2.2 skrll /* This fragment is completely overlapped, loose it */ 448 1.3.2.2 skrll next = LIST_NEXT(frea, fr_next); 449 1.3.2.2 skrll m_freem(frea->fr_m); 450 1.3.2.2 skrll LIST_REMOVE(frea, fr_next); 451 1.3.2.2 skrll pool_put(&pf_frent_pl, frea); 452 1.3.2.2 skrll pf_nfrents--; 453 1.3.2.2 skrll } 454 1.3.2.2 skrll 455 1.3.2.2 skrll insert: 456 1.3.2.2 skrll /* Update maximum data size */ 457 1.3.2.2 skrll if ((*frag)->fr_max < max) 458 1.3.2.2 skrll (*frag)->fr_max = max; 459 1.3.2.2 skrll /* This is the last segment */ 460 1.3.2.2 skrll if (!mff) 461 1.3.2.2 skrll (*frag)->fr_flags |= PFFRAG_SEENLAST; 462 1.3.2.2 skrll 463 1.3.2.2 skrll if (frep == NULL) 464 1.3.2.2 skrll LIST_INSERT_HEAD(&(*frag)->fr_queue, frent, fr_next); 465 1.3.2.2 skrll else 466 1.3.2.2 skrll LIST_INSERT_AFTER(frep, frent, fr_next); 467 1.3.2.2 skrll 468 1.3.2.2 skrll /* Check if we are completely reassembled */ 469 1.3.2.2 skrll if (!((*frag)->fr_flags & PFFRAG_SEENLAST)) 470 1.3.2.2 skrll return (NULL); 471 1.3.2.2 skrll 472 1.3.2.2 skrll /* Check if we have all the data */ 473 1.3.2.2 skrll off = 0; 474 1.3.2.2 skrll for (frep = LIST_FIRST(&(*frag)->fr_queue); frep; frep = next) { 475 1.3.2.2 skrll next = LIST_NEXT(frep, fr_next); 476 1.3.2.2 skrll 477 1.3.2.2 skrll off += ntohs(frep->fr_ip->ip_len) - frep->fr_ip->ip_hl * 4; 478 1.3.2.2 skrll if (off < (*frag)->fr_max && 479 1.3.2.2 skrll (next == NULL || FR_IP_OFF(next) != off)) 480 1.3.2.2 skrll { 481 1.3.2.2 skrll DPFPRINTF(("missing fragment at %d, next %d, max %d\n", 482 1.3.2.2 skrll off, next == NULL ? -1 : FR_IP_OFF(next), 483 1.3.2.2 skrll (*frag)->fr_max)); 484 1.3.2.2 skrll return (NULL); 485 1.3.2.2 skrll } 486 1.3.2.2 skrll } 487 1.3.2.2 skrll DPFPRINTF(("%d < %d?\n", off, (*frag)->fr_max)); 488 1.3.2.2 skrll if (off < (*frag)->fr_max) 489 1.3.2.2 skrll return (NULL); 490 1.3.2.2 skrll 491 1.3.2.2 skrll /* We have all the data */ 492 1.3.2.2 skrll frent = LIST_FIRST(&(*frag)->fr_queue); 493 1.3.2.2 skrll KASSERT(frent != NULL); 494 1.3.2.2 skrll if ((frent->fr_ip->ip_hl << 2) + off > IP_MAXPACKET) { 495 1.3.2.2 skrll DPFPRINTF(("drop: too big: %d\n", off)); 496 1.3.2.2 skrll pf_free_fragment(*frag); 497 1.3.2.2 skrll *frag = NULL; 498 1.3.2.2 skrll return (NULL); 499 1.3.2.2 skrll } 500 1.3.2.2 skrll next = LIST_NEXT(frent, fr_next); 501 1.3.2.2 skrll 502 1.3.2.2 skrll /* Magic from ip_input */ 503 1.3.2.2 skrll ip = frent->fr_ip; 504 1.3.2.2 skrll m = frent->fr_m; 505 1.3.2.2 skrll m2 = m->m_next; 506 1.3.2.2 skrll m->m_next = NULL; 507 1.3.2.2 skrll m_cat(m, m2); 508 1.3.2.2 skrll pool_put(&pf_frent_pl, frent); 509 1.3.2.2 skrll pf_nfrents--; 510 1.3.2.2 skrll for (frent = next; frent != NULL; frent = next) { 511 1.3.2.2 skrll next = LIST_NEXT(frent, fr_next); 512 1.3.2.2 skrll 513 1.3.2.2 skrll m2 = frent->fr_m; 514 1.3.2.2 skrll pool_put(&pf_frent_pl, frent); 515 1.3.2.2 skrll pf_nfrents--; 516 1.3.2.2 skrll m_cat(m, m2); 517 1.3.2.2 skrll } 518 1.3.2.2 skrll 519 1.3.2.2 skrll ip->ip_src = (*frag)->fr_src; 520 1.3.2.2 skrll ip->ip_dst = (*frag)->fr_dst; 521 1.3.2.2 skrll 522 1.3.2.2 skrll /* Remove from fragment queue */ 523 1.3.2.2 skrll pf_remove_fragment(*frag); 524 1.3.2.2 skrll *frag = NULL; 525 1.3.2.2 skrll 526 1.3.2.2 skrll hlen = ip->ip_hl << 2; 527 1.3.2.2 skrll ip->ip_len = htons(off + hlen); 528 1.3.2.2 skrll m->m_len += hlen; 529 1.3.2.2 skrll m->m_data -= hlen; 530 1.3.2.2 skrll 531 1.3.2.2 skrll /* some debugging cruft by sklower, below, will go away soon */ 532 1.3.2.2 skrll /* XXX this should be done elsewhere */ 533 1.3.2.2 skrll if (m->m_flags & M_PKTHDR) { 534 1.3.2.2 skrll int plen = 0; 535 1.3.2.2 skrll for (m2 = m; m2; m2 = m2->m_next) 536 1.3.2.2 skrll plen += m2->m_len; 537 1.3.2.2 skrll m->m_pkthdr.len = plen; 538 1.3.2.2 skrll } 539 1.3.2.2 skrll 540 1.3.2.2 skrll DPFPRINTF(("complete: %p(%d)\n", m, ntohs(ip->ip_len))); 541 1.3.2.2 skrll return (m); 542 1.3.2.2 skrll 543 1.3.2.2 skrll drop_fragment: 544 1.3.2.2 skrll /* Oops - fail safe - drop packet */ 545 1.3.2.2 skrll pool_put(&pf_frent_pl, frent); 546 1.3.2.2 skrll pf_nfrents--; 547 1.3.2.2 skrll m_freem(m); 548 1.3.2.2 skrll return (NULL); 549 1.3.2.2 skrll } 550 1.3.2.2 skrll 551 1.3.2.2 skrll struct mbuf * 552 1.3.2.2 skrll pf_fragcache(struct mbuf **m0, struct ip *h, struct pf_fragment **frag, int mff, 553 1.3.2.2 skrll int drop, int *nomem) 554 1.3.2.2 skrll { 555 1.3.2.2 skrll struct mbuf *m = *m0; 556 1.3.2.2 skrll struct pf_frcache *frp, *fra, *cur = NULL; 557 1.3.2.2 skrll int ip_len = ntohs(h->ip_len) - (h->ip_hl << 2); 558 1.3.2.2 skrll u_int16_t off = ntohs(h->ip_off) << 3; 559 1.3.2.2 skrll u_int16_t max = ip_len + off; 560 1.3.2.2 skrll int hosed = 0; 561 1.3.2.2 skrll 562 1.3.2.2 skrll KASSERT(*frag == NULL || !BUFFER_FRAGMENTS(*frag)); 563 1.3.2.2 skrll 564 1.3.2.2 skrll /* Create a new range queue for this packet */ 565 1.3.2.2 skrll if (*frag == NULL) { 566 1.3.2.2 skrll *frag = pool_get(&pf_cache_pl, PR_NOWAIT); 567 1.3.2.2 skrll if (*frag == NULL) { 568 1.3.2.2 skrll pf_flush_fragments(); 569 1.3.2.2 skrll *frag = pool_get(&pf_cache_pl, PR_NOWAIT); 570 1.3.2.2 skrll if (*frag == NULL) 571 1.3.2.2 skrll goto no_mem; 572 1.3.2.2 skrll } 573 1.3.2.2 skrll 574 1.3.2.2 skrll /* Get an entry for the queue */ 575 1.3.2.2 skrll cur = pool_get(&pf_cent_pl, PR_NOWAIT); 576 1.3.2.2 skrll if (cur == NULL) { 577 1.3.2.2 skrll pool_put(&pf_cache_pl, *frag); 578 1.3.2.2 skrll *frag = NULL; 579 1.3.2.2 skrll goto no_mem; 580 1.3.2.2 skrll } 581 1.3.2.2 skrll pf_ncache++; 582 1.3.2.2 skrll 583 1.3.2.2 skrll (*frag)->fr_flags = PFFRAG_NOBUFFER; 584 1.3.2.2 skrll (*frag)->fr_max = 0; 585 1.3.2.2 skrll (*frag)->fr_src = h->ip_src; 586 1.3.2.2 skrll (*frag)->fr_dst = h->ip_dst; 587 1.3.2.2 skrll (*frag)->fr_p = h->ip_p; 588 1.3.2.2 skrll (*frag)->fr_id = h->ip_id; 589 1.3.2.5 skrll (*frag)->fr_timeout = time_second; 590 1.3.2.2 skrll 591 1.3.2.2 skrll cur->fr_off = off; 592 1.3.2.2 skrll cur->fr_end = max; 593 1.3.2.2 skrll LIST_INIT(&(*frag)->fr_cache); 594 1.3.2.2 skrll LIST_INSERT_HEAD(&(*frag)->fr_cache, cur, fr_next); 595 1.3.2.2 skrll 596 1.3.2.2 skrll RB_INSERT(pf_frag_tree, &pf_cache_tree, *frag); 597 1.3.2.2 skrll TAILQ_INSERT_HEAD(&pf_cachequeue, *frag, frag_next); 598 1.3.2.2 skrll 599 1.3.2.2 skrll DPFPRINTF(("fragcache[%d]: new %d-%d\n", h->ip_id, off, max)); 600 1.3.2.2 skrll 601 1.3.2.2 skrll goto pass; 602 1.3.2.2 skrll } 603 1.3.2.2 skrll 604 1.3.2.2 skrll /* 605 1.3.2.2 skrll * Find a fragment after the current one: 606 1.3.2.2 skrll * - off contains the real shifted offset. 607 1.3.2.2 skrll */ 608 1.3.2.2 skrll frp = NULL; 609 1.3.2.2 skrll LIST_FOREACH(fra, &(*frag)->fr_cache, fr_next) { 610 1.3.2.2 skrll if (fra->fr_off > off) 611 1.3.2.2 skrll break; 612 1.3.2.2 skrll frp = fra; 613 1.3.2.2 skrll } 614 1.3.2.2 skrll 615 1.3.2.2 skrll KASSERT(frp != NULL || fra != NULL); 616 1.3.2.2 skrll 617 1.3.2.2 skrll if (frp != NULL) { 618 1.3.2.2 skrll int precut; 619 1.3.2.2 skrll 620 1.3.2.2 skrll precut = frp->fr_end - off; 621 1.3.2.2 skrll if (precut >= ip_len) { 622 1.3.2.2 skrll /* Fragment is entirely a duplicate */ 623 1.3.2.2 skrll DPFPRINTF(("fragcache[%d]: dead (%d-%d) %d-%d\n", 624 1.3.2.2 skrll h->ip_id, frp->fr_off, frp->fr_end, off, max)); 625 1.3.2.2 skrll goto drop_fragment; 626 1.3.2.2 skrll } 627 1.3.2.2 skrll if (precut == 0) { 628 1.3.2.2 skrll /* They are adjacent. Fixup cache entry */ 629 1.3.2.2 skrll DPFPRINTF(("fragcache[%d]: adjacent (%d-%d) %d-%d\n", 630 1.3.2.2 skrll h->ip_id, frp->fr_off, frp->fr_end, off, max)); 631 1.3.2.2 skrll frp->fr_end = max; 632 1.3.2.2 skrll } else if (precut > 0) { 633 1.3.2.2 skrll /* The first part of this payload overlaps with a 634 1.3.2.2 skrll * fragment that has already been passed. 635 1.3.2.2 skrll * Need to trim off the first part of the payload. 636 1.3.2.2 skrll * But to do so easily, we need to create another 637 1.3.2.2 skrll * mbuf to throw the original header into. 638 1.3.2.2 skrll */ 639 1.3.2.2 skrll 640 1.3.2.2 skrll DPFPRINTF(("fragcache[%d]: chop %d (%d-%d) %d-%d\n", 641 1.3.2.2 skrll h->ip_id, precut, frp->fr_off, frp->fr_end, off, 642 1.3.2.2 skrll max)); 643 1.3.2.2 skrll 644 1.3.2.2 skrll off += precut; 645 1.3.2.2 skrll max -= precut; 646 1.3.2.2 skrll /* Update the previous frag to encompass this one */ 647 1.3.2.2 skrll frp->fr_end = max; 648 1.3.2.2 skrll 649 1.3.2.2 skrll if (!drop) { 650 1.3.2.2 skrll /* XXX Optimization opportunity 651 1.3.2.2 skrll * This is a very heavy way to trim the payload. 652 1.3.2.2 skrll * we could do it much faster by diddling mbuf 653 1.3.2.2 skrll * internals but that would be even less legible 654 1.3.2.2 skrll * than this mbuf magic. For my next trick, 655 1.3.2.2 skrll * I'll pull a rabbit out of my laptop. 656 1.3.2.2 skrll */ 657 1.3.2.2 skrll #ifdef __OpenBSD__ 658 1.3.2.2 skrll *m0 = m_copym2(m, 0, h->ip_hl << 2, M_NOWAIT); 659 1.3.2.2 skrll #else 660 1.3.2.2 skrll *m0 = m_dup(m, 0, h->ip_hl << 2, M_NOWAIT); 661 1.3.2.2 skrll #endif 662 1.3.2.2 skrll if (*m0 == NULL) 663 1.3.2.2 skrll goto no_mem; 664 1.3.2.2 skrll KASSERT((*m0)->m_next == NULL); 665 1.3.2.2 skrll m_adj(m, precut + (h->ip_hl << 2)); 666 1.3.2.2 skrll m_cat(*m0, m); 667 1.3.2.2 skrll m = *m0; 668 1.3.2.2 skrll if (m->m_flags & M_PKTHDR) { 669 1.3.2.2 skrll int plen = 0; 670 1.3.2.2 skrll struct mbuf *t; 671 1.3.2.2 skrll for (t = m; t; t = t->m_next) 672 1.3.2.2 skrll plen += t->m_len; 673 1.3.2.2 skrll m->m_pkthdr.len = plen; 674 1.3.2.2 skrll } 675 1.3.2.2 skrll 676 1.3.2.2 skrll 677 1.3.2.2 skrll h = mtod(m, struct ip *); 678 1.3.2.2 skrll 679 1.3.2.2 skrll 680 1.3.2.2 skrll KASSERT((int)m->m_len == 681 1.3.2.2 skrll ntohs(h->ip_len) - precut); 682 1.3.2.2 skrll h->ip_off = htons(ntohs(h->ip_off) + 683 1.3.2.2 skrll (precut >> 3)); 684 1.3.2.2 skrll h->ip_len = htons(ntohs(h->ip_len) - precut); 685 1.3.2.2 skrll } else { 686 1.3.2.2 skrll hosed++; 687 1.3.2.2 skrll } 688 1.3.2.2 skrll } else { 689 1.3.2.2 skrll /* There is a gap between fragments */ 690 1.3.2.2 skrll 691 1.3.2.2 skrll DPFPRINTF(("fragcache[%d]: gap %d (%d-%d) %d-%d\n", 692 1.3.2.2 skrll h->ip_id, -precut, frp->fr_off, frp->fr_end, off, 693 1.3.2.2 skrll max)); 694 1.3.2.2 skrll 695 1.3.2.2 skrll cur = pool_get(&pf_cent_pl, PR_NOWAIT); 696 1.3.2.2 skrll if (cur == NULL) 697 1.3.2.2 skrll goto no_mem; 698 1.3.2.2 skrll pf_ncache++; 699 1.3.2.2 skrll 700 1.3.2.2 skrll cur->fr_off = off; 701 1.3.2.2 skrll cur->fr_end = max; 702 1.3.2.2 skrll LIST_INSERT_AFTER(frp, cur, fr_next); 703 1.3.2.2 skrll } 704 1.3.2.2 skrll } 705 1.3.2.2 skrll 706 1.3.2.2 skrll if (fra != NULL) { 707 1.3.2.2 skrll int aftercut; 708 1.3.2.2 skrll int merge = 0; 709 1.3.2.2 skrll 710 1.3.2.2 skrll aftercut = max - fra->fr_off; 711 1.3.2.2 skrll if (aftercut == 0) { 712 1.3.2.2 skrll /* Adjacent fragments */ 713 1.3.2.2 skrll DPFPRINTF(("fragcache[%d]: adjacent %d-%d (%d-%d)\n", 714 1.3.2.2 skrll h->ip_id, off, max, fra->fr_off, fra->fr_end)); 715 1.3.2.2 skrll fra->fr_off = off; 716 1.3.2.2 skrll merge = 1; 717 1.3.2.2 skrll } else if (aftercut > 0) { 718 1.3.2.2 skrll /* Need to chop off the tail of this fragment */ 719 1.3.2.2 skrll DPFPRINTF(("fragcache[%d]: chop %d %d-%d (%d-%d)\n", 720 1.3.2.2 skrll h->ip_id, aftercut, off, max, fra->fr_off, 721 1.3.2.2 skrll fra->fr_end)); 722 1.3.2.2 skrll fra->fr_off = off; 723 1.3.2.2 skrll max -= aftercut; 724 1.3.2.2 skrll 725 1.3.2.2 skrll merge = 1; 726 1.3.2.2 skrll 727 1.3.2.2 skrll if (!drop) { 728 1.3.2.2 skrll m_adj(m, -aftercut); 729 1.3.2.2 skrll if (m->m_flags & M_PKTHDR) { 730 1.3.2.2 skrll int plen = 0; 731 1.3.2.2 skrll struct mbuf *t; 732 1.3.2.2 skrll for (t = m; t; t = t->m_next) 733 1.3.2.2 skrll plen += t->m_len; 734 1.3.2.2 skrll m->m_pkthdr.len = plen; 735 1.3.2.2 skrll } 736 1.3.2.2 skrll h = mtod(m, struct ip *); 737 1.3.2.2 skrll KASSERT((int)m->m_len == 738 1.3.2.2 skrll ntohs(h->ip_len) - aftercut); 739 1.3.2.2 skrll h->ip_len = htons(ntohs(h->ip_len) - aftercut); 740 1.3.2.2 skrll } else { 741 1.3.2.2 skrll hosed++; 742 1.3.2.2 skrll } 743 1.3.2.2 skrll } else { 744 1.3.2.2 skrll /* There is a gap between fragments */ 745 1.3.2.2 skrll DPFPRINTF(("fragcache[%d]: gap %d %d-%d (%d-%d)\n", 746 1.3.2.2 skrll h->ip_id, -aftercut, off, max, fra->fr_off, 747 1.3.2.2 skrll fra->fr_end)); 748 1.3.2.2 skrll 749 1.3.2.2 skrll cur = pool_get(&pf_cent_pl, PR_NOWAIT); 750 1.3.2.2 skrll if (cur == NULL) 751 1.3.2.2 skrll goto no_mem; 752 1.3.2.2 skrll pf_ncache++; 753 1.3.2.2 skrll 754 1.3.2.2 skrll cur->fr_off = off; 755 1.3.2.2 skrll cur->fr_end = max; 756 1.3.2.2 skrll LIST_INSERT_BEFORE(fra, cur, fr_next); 757 1.3.2.2 skrll } 758 1.3.2.2 skrll 759 1.3.2.2 skrll 760 1.3.2.2 skrll /* Need to glue together two separate fragment descriptors */ 761 1.3.2.2 skrll if (merge) { 762 1.3.2.2 skrll if (cur && fra->fr_off <= cur->fr_end) { 763 1.3.2.2 skrll /* Need to merge in a previous 'cur' */ 764 1.3.2.2 skrll DPFPRINTF(("fragcache[%d]: adjacent(merge " 765 1.3.2.2 skrll "%d-%d) %d-%d (%d-%d)\n", 766 1.3.2.2 skrll h->ip_id, cur->fr_off, cur->fr_end, off, 767 1.3.2.2 skrll max, fra->fr_off, fra->fr_end)); 768 1.3.2.2 skrll fra->fr_off = cur->fr_off; 769 1.3.2.2 skrll LIST_REMOVE(cur, fr_next); 770 1.3.2.2 skrll pool_put(&pf_cent_pl, cur); 771 1.3.2.2 skrll pf_ncache--; 772 1.3.2.2 skrll cur = NULL; 773 1.3.2.2 skrll 774 1.3.2.2 skrll } else if (frp && fra->fr_off <= frp->fr_end) { 775 1.3.2.2 skrll /* Need to merge in a modified 'frp' */ 776 1.3.2.2 skrll KASSERT(cur == NULL); 777 1.3.2.2 skrll DPFPRINTF(("fragcache[%d]: adjacent(merge " 778 1.3.2.2 skrll "%d-%d) %d-%d (%d-%d)\n", 779 1.3.2.2 skrll h->ip_id, frp->fr_off, frp->fr_end, off, 780 1.3.2.2 skrll max, fra->fr_off, fra->fr_end)); 781 1.3.2.2 skrll fra->fr_off = frp->fr_off; 782 1.3.2.2 skrll LIST_REMOVE(frp, fr_next); 783 1.3.2.2 skrll pool_put(&pf_cent_pl, frp); 784 1.3.2.2 skrll pf_ncache--; 785 1.3.2.2 skrll frp = NULL; 786 1.3.2.2 skrll 787 1.3.2.2 skrll } 788 1.3.2.2 skrll } 789 1.3.2.2 skrll } 790 1.3.2.2 skrll 791 1.3.2.2 skrll if (hosed) { 792 1.3.2.2 skrll /* 793 1.3.2.2 skrll * We must keep tracking the overall fragment even when 794 1.3.2.2 skrll * we're going to drop it anyway so that we know when to 795 1.3.2.2 skrll * free the overall descriptor. Thus we drop the frag late. 796 1.3.2.2 skrll */ 797 1.3.2.2 skrll goto drop_fragment; 798 1.3.2.2 skrll } 799 1.3.2.2 skrll 800 1.3.2.2 skrll 801 1.3.2.2 skrll pass: 802 1.3.2.2 skrll /* Update maximum data size */ 803 1.3.2.2 skrll if ((*frag)->fr_max < max) 804 1.3.2.2 skrll (*frag)->fr_max = max; 805 1.3.2.2 skrll 806 1.3.2.2 skrll /* This is the last segment */ 807 1.3.2.2 skrll if (!mff) 808 1.3.2.2 skrll (*frag)->fr_flags |= PFFRAG_SEENLAST; 809 1.3.2.2 skrll 810 1.3.2.2 skrll /* Check if we are completely reassembled */ 811 1.3.2.2 skrll if (((*frag)->fr_flags & PFFRAG_SEENLAST) && 812 1.3.2.2 skrll LIST_FIRST(&(*frag)->fr_cache)->fr_off == 0 && 813 1.3.2.2 skrll LIST_FIRST(&(*frag)->fr_cache)->fr_end == (*frag)->fr_max) { 814 1.3.2.2 skrll /* Remove from fragment queue */ 815 1.3.2.2 skrll DPFPRINTF(("fragcache[%d]: done 0-%d\n", h->ip_id, 816 1.3.2.2 skrll (*frag)->fr_max)); 817 1.3.2.2 skrll pf_free_fragment(*frag); 818 1.3.2.2 skrll *frag = NULL; 819 1.3.2.2 skrll } 820 1.3.2.2 skrll 821 1.3.2.2 skrll return (m); 822 1.3.2.2 skrll 823 1.3.2.2 skrll no_mem: 824 1.3.2.2 skrll *nomem = 1; 825 1.3.2.2 skrll 826 1.3.2.2 skrll /* Still need to pay attention to !IP_MF */ 827 1.3.2.2 skrll if (!mff && *frag != NULL) 828 1.3.2.2 skrll (*frag)->fr_flags |= PFFRAG_SEENLAST; 829 1.3.2.2 skrll 830 1.3.2.2 skrll m_freem(m); 831 1.3.2.2 skrll return (NULL); 832 1.3.2.2 skrll 833 1.3.2.2 skrll drop_fragment: 834 1.3.2.2 skrll 835 1.3.2.2 skrll /* Still need to pay attention to !IP_MF */ 836 1.3.2.2 skrll if (!mff && *frag != NULL) 837 1.3.2.2 skrll (*frag)->fr_flags |= PFFRAG_SEENLAST; 838 1.3.2.2 skrll 839 1.3.2.2 skrll if (drop) { 840 1.3.2.2 skrll /* This fragment has been deemed bad. Don't reass */ 841 1.3.2.2 skrll if (((*frag)->fr_flags & PFFRAG_DROP) == 0) 842 1.3.2.2 skrll DPFPRINTF(("fragcache[%d]: dropping overall fragment\n", 843 1.3.2.2 skrll h->ip_id)); 844 1.3.2.2 skrll (*frag)->fr_flags |= PFFRAG_DROP; 845 1.3.2.2 skrll } 846 1.3.2.2 skrll 847 1.3.2.2 skrll m_freem(m); 848 1.3.2.2 skrll return (NULL); 849 1.3.2.2 skrll } 850 1.3.2.2 skrll 851 1.3.2.2 skrll int 852 1.3.2.5 skrll pf_normalize_ip(struct mbuf **m0, int dir, struct pfi_kif *kif, u_short *reason, 853 1.3.2.5 skrll struct pf_pdesc *pd) 854 1.3.2.2 skrll { 855 1.3.2.2 skrll struct mbuf *m = *m0; 856 1.3.2.2 skrll struct pf_rule *r; 857 1.3.2.2 skrll struct pf_frent *frent; 858 1.3.2.2 skrll struct pf_fragment *frag = NULL; 859 1.3.2.2 skrll struct ip *h = mtod(m, struct ip *); 860 1.3.2.2 skrll int mff = (ntohs(h->ip_off) & IP_MF); 861 1.3.2.2 skrll int hlen = h->ip_hl << 2; 862 1.3.2.2 skrll u_int16_t fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3; 863 1.3.2.2 skrll u_int16_t max; 864 1.3.2.2 skrll int ip_len; 865 1.3.2.2 skrll int ip_off; 866 1.3.2.2 skrll 867 1.3.2.2 skrll r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr); 868 1.3.2.2 skrll while (r != NULL) { 869 1.3.2.2 skrll r->evaluations++; 870 1.3.2.2 skrll if (r->kif != NULL && 871 1.3.2.2 skrll (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 872 1.3.2.2 skrll r = r->skip[PF_SKIP_IFP].ptr; 873 1.3.2.2 skrll else if (r->direction && r->direction != dir) 874 1.3.2.2 skrll r = r->skip[PF_SKIP_DIR].ptr; 875 1.3.2.2 skrll else if (r->af && r->af != AF_INET) 876 1.3.2.2 skrll r = r->skip[PF_SKIP_AF].ptr; 877 1.3.2.2 skrll else if (r->proto && r->proto != h->ip_p) 878 1.3.2.2 skrll r = r->skip[PF_SKIP_PROTO].ptr; 879 1.3.2.2 skrll else if (PF_MISMATCHAW(&r->src.addr, 880 1.3.2.5 skrll (struct pf_addr *)&h->ip_src.s_addr, AF_INET, r->src.neg)) 881 1.3.2.2 skrll r = r->skip[PF_SKIP_SRC_ADDR].ptr; 882 1.3.2.2 skrll else if (PF_MISMATCHAW(&r->dst.addr, 883 1.3.2.5 skrll (struct pf_addr *)&h->ip_dst.s_addr, AF_INET, r->dst.neg)) 884 1.3.2.2 skrll r = r->skip[PF_SKIP_DST_ADDR].ptr; 885 1.3.2.2 skrll else 886 1.3.2.2 skrll break; 887 1.3.2.2 skrll } 888 1.3.2.2 skrll 889 1.3.2.2 skrll if (r == NULL) 890 1.3.2.2 skrll return (PF_PASS); 891 1.3.2.2 skrll else 892 1.3.2.2 skrll r->packets++; 893 1.3.2.2 skrll 894 1.3.2.2 skrll /* Check for illegal packets */ 895 1.3.2.2 skrll if (hlen < (int)sizeof(struct ip)) 896 1.3.2.2 skrll goto drop; 897 1.3.2.2 skrll 898 1.3.2.2 skrll if (hlen > ntohs(h->ip_len)) 899 1.3.2.2 skrll goto drop; 900 1.3.2.2 skrll 901 1.3.2.2 skrll /* Clear IP_DF if the rule uses the no-df option */ 902 1.3.2.2 skrll if (r->rule_flag & PFRULE_NODF) 903 1.3.2.2 skrll h->ip_off &= htons(~IP_DF); 904 1.3.2.2 skrll 905 1.3.2.2 skrll /* We will need other tests here */ 906 1.3.2.2 skrll if (!fragoff && !mff) 907 1.3.2.2 skrll goto no_fragment; 908 1.3.2.2 skrll 909 1.3.2.2 skrll /* We're dealing with a fragment now. Don't allow fragments 910 1.3.2.2 skrll * with IP_DF to enter the cache. If the flag was cleared by 911 1.3.2.2 skrll * no-df above, fine. Otherwise drop it. 912 1.3.2.2 skrll */ 913 1.3.2.2 skrll if (h->ip_off & htons(IP_DF)) { 914 1.3.2.2 skrll DPFPRINTF(("IP_DF\n")); 915 1.3.2.2 skrll goto bad; 916 1.3.2.2 skrll } 917 1.3.2.2 skrll 918 1.3.2.2 skrll ip_len = ntohs(h->ip_len) - hlen; 919 1.3.2.2 skrll ip_off = (ntohs(h->ip_off) & IP_OFFMASK) << 3; 920 1.3.2.2 skrll 921 1.3.2.2 skrll /* All fragments are 8 byte aligned */ 922 1.3.2.2 skrll if (mff && (ip_len & 0x7)) { 923 1.3.2.2 skrll DPFPRINTF(("mff and %d\n", ip_len)); 924 1.3.2.2 skrll goto bad; 925 1.3.2.2 skrll } 926 1.3.2.2 skrll 927 1.3.2.2 skrll /* Respect maximum length */ 928 1.3.2.2 skrll if (fragoff + ip_len > IP_MAXPACKET) { 929 1.3.2.2 skrll DPFPRINTF(("max packet %d\n", fragoff + ip_len)); 930 1.3.2.2 skrll goto bad; 931 1.3.2.2 skrll } 932 1.3.2.2 skrll max = fragoff + ip_len; 933 1.3.2.2 skrll 934 1.3.2.2 skrll if ((r->rule_flag & (PFRULE_FRAGCROP|PFRULE_FRAGDROP)) == 0) { 935 1.3.2.2 skrll /* Fully buffer all of the fragments */ 936 1.3.2.2 skrll 937 1.3.2.2 skrll frag = pf_find_fragment(h, &pf_frag_tree); 938 1.3.2.2 skrll 939 1.3.2.2 skrll /* Check if we saw the last fragment already */ 940 1.3.2.2 skrll if (frag != NULL && (frag->fr_flags & PFFRAG_SEENLAST) && 941 1.3.2.2 skrll max > frag->fr_max) 942 1.3.2.2 skrll goto bad; 943 1.3.2.2 skrll 944 1.3.2.2 skrll /* Get an entry for the fragment queue */ 945 1.3.2.2 skrll frent = pool_get(&pf_frent_pl, PR_NOWAIT); 946 1.3.2.2 skrll if (frent == NULL) { 947 1.3.2.2 skrll REASON_SET(reason, PFRES_MEMORY); 948 1.3.2.2 skrll return (PF_DROP); 949 1.3.2.2 skrll } 950 1.3.2.2 skrll pf_nfrents++; 951 1.3.2.2 skrll frent->fr_ip = h; 952 1.3.2.2 skrll frent->fr_m = m; 953 1.3.2.2 skrll 954 1.3.2.2 skrll /* Might return a completely reassembled mbuf, or NULL */ 955 1.3.2.2 skrll DPFPRINTF(("reass frag %d @ %d-%d\n", h->ip_id, fragoff, max)); 956 1.3.2.2 skrll *m0 = m = pf_reassemble(m0, &frag, frent, mff); 957 1.3.2.2 skrll 958 1.3.2.2 skrll if (m == NULL) 959 1.3.2.2 skrll return (PF_DROP); 960 1.3.2.2 skrll 961 1.3.2.2 skrll if (frag != NULL && (frag->fr_flags & PFFRAG_DROP)) 962 1.3.2.2 skrll goto drop; 963 1.3.2.2 skrll 964 1.3.2.2 skrll h = mtod(m, struct ip *); 965 1.3.2.2 skrll } else { 966 1.3.2.2 skrll /* non-buffering fragment cache (drops or masks overlaps) */ 967 1.3.2.2 skrll int nomem = 0; 968 1.3.2.2 skrll 969 1.3.2.2 skrll if (dir == PF_OUT) { 970 1.3.2.2 skrll if (m_tag_find(m, PACKET_TAG_PF_FRAGCACHE, NULL) != 971 1.3.2.2 skrll NULL) { 972 1.3.2.2 skrll /* Already passed the fragment cache in the 973 1.3.2.2 skrll * input direction. If we continued, it would 974 1.3.2.2 skrll * appear to be a dup and would be dropped. 975 1.3.2.2 skrll */ 976 1.3.2.2 skrll goto fragment_pass; 977 1.3.2.2 skrll } 978 1.3.2.2 skrll } 979 1.3.2.2 skrll 980 1.3.2.2 skrll frag = pf_find_fragment(h, &pf_cache_tree); 981 1.3.2.2 skrll 982 1.3.2.2 skrll /* Check if we saw the last fragment already */ 983 1.3.2.2 skrll if (frag != NULL && (frag->fr_flags & PFFRAG_SEENLAST) && 984 1.3.2.2 skrll max > frag->fr_max) { 985 1.3.2.2 skrll if (r->rule_flag & PFRULE_FRAGDROP) 986 1.3.2.2 skrll frag->fr_flags |= PFFRAG_DROP; 987 1.3.2.2 skrll goto bad; 988 1.3.2.2 skrll } 989 1.3.2.2 skrll 990 1.3.2.2 skrll *m0 = m = pf_fragcache(m0, h, &frag, mff, 991 1.3.2.2 skrll (r->rule_flag & PFRULE_FRAGDROP) ? 1 : 0, &nomem); 992 1.3.2.2 skrll if (m == NULL) { 993 1.3.2.2 skrll if (nomem) 994 1.3.2.2 skrll goto no_mem; 995 1.3.2.2 skrll goto drop; 996 1.3.2.2 skrll } 997 1.3.2.2 skrll 998 1.3.2.2 skrll if (dir == PF_IN) { 999 1.3.2.2 skrll struct m_tag *mtag; 1000 1.3.2.2 skrll 1001 1.3.2.2 skrll mtag = m_tag_get(PACKET_TAG_PF_FRAGCACHE, 0, M_NOWAIT); 1002 1.3.2.2 skrll if (mtag == NULL) 1003 1.3.2.2 skrll goto no_mem; 1004 1.3.2.2 skrll m_tag_prepend(m, mtag); 1005 1.3.2.2 skrll } 1006 1.3.2.2 skrll if (frag != NULL && (frag->fr_flags & PFFRAG_DROP)) 1007 1.3.2.2 skrll goto drop; 1008 1.3.2.2 skrll goto fragment_pass; 1009 1.3.2.2 skrll } 1010 1.3.2.2 skrll 1011 1.3.2.2 skrll no_fragment: 1012 1.3.2.2 skrll /* At this point, only IP_DF is allowed in ip_off */ 1013 1.3.2.2 skrll h->ip_off &= htons(IP_DF); 1014 1.3.2.2 skrll 1015 1.3.2.2 skrll /* Enforce a minimum ttl, may cause endless packet loops */ 1016 1.3.2.2 skrll if (r->min_ttl && h->ip_ttl < r->min_ttl) 1017 1.3.2.2 skrll h->ip_ttl = r->min_ttl; 1018 1.3.2.2 skrll 1019 1.3.2.5 skrll if (r->rule_flag & PFRULE_RANDOMID) { 1020 1.3.2.5 skrll u_int16_t ip_id = h->ip_id; 1021 1.3.2.5 skrll 1022 1.3.2.2 skrll h->ip_id = ip_randomid(); 1023 1.3.2.5 skrll h->ip_sum = pf_cksum_fixup(h->ip_sum, ip_id, h->ip_id, 0); 1024 1.3.2.5 skrll } 1025 1.3.2.5 skrll if ((r->rule_flag & (PFRULE_FRAGCROP|PFRULE_FRAGDROP)) == 0) 1026 1.3.2.5 skrll pd->flags |= PFDESC_IP_REAS; 1027 1.3.2.2 skrll 1028 1.3.2.2 skrll return (PF_PASS); 1029 1.3.2.2 skrll 1030 1.3.2.2 skrll fragment_pass: 1031 1.3.2.2 skrll /* Enforce a minimum ttl, may cause endless packet loops */ 1032 1.3.2.2 skrll if (r->min_ttl && h->ip_ttl < r->min_ttl) 1033 1.3.2.2 skrll h->ip_ttl = r->min_ttl; 1034 1.3.2.5 skrll if ((r->rule_flag & (PFRULE_FRAGCROP|PFRULE_FRAGDROP)) == 0) 1035 1.3.2.5 skrll pd->flags |= PFDESC_IP_REAS; 1036 1.3.2.2 skrll return (PF_PASS); 1037 1.3.2.2 skrll 1038 1.3.2.2 skrll no_mem: 1039 1.3.2.2 skrll REASON_SET(reason, PFRES_MEMORY); 1040 1.3.2.2 skrll if (r != NULL && r->log) 1041 1.3.2.2 skrll PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL); 1042 1.3.2.2 skrll return (PF_DROP); 1043 1.3.2.2 skrll 1044 1.3.2.2 skrll drop: 1045 1.3.2.2 skrll REASON_SET(reason, PFRES_NORM); 1046 1.3.2.2 skrll if (r != NULL && r->log) 1047 1.3.2.2 skrll PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL); 1048 1.3.2.2 skrll return (PF_DROP); 1049 1.3.2.2 skrll 1050 1.3.2.2 skrll bad: 1051 1.3.2.2 skrll DPFPRINTF(("dropping bad fragment\n")); 1052 1.3.2.2 skrll 1053 1.3.2.2 skrll /* Free associated fragments */ 1054 1.3.2.2 skrll if (frag != NULL) 1055 1.3.2.2 skrll pf_free_fragment(frag); 1056 1.3.2.2 skrll 1057 1.3.2.2 skrll REASON_SET(reason, PFRES_FRAG); 1058 1.3.2.2 skrll if (r != NULL && r->log) 1059 1.3.2.2 skrll PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL); 1060 1.3.2.2 skrll 1061 1.3.2.2 skrll return (PF_DROP); 1062 1.3.2.2 skrll } 1063 1.3.2.2 skrll 1064 1.3.2.2 skrll #ifdef INET6 1065 1.3.2.2 skrll int 1066 1.3.2.2 skrll pf_normalize_ip6(struct mbuf **m0, int dir, struct pfi_kif *kif, 1067 1.3.2.5 skrll u_short *reason, struct pf_pdesc *pd) 1068 1.3.2.2 skrll { 1069 1.3.2.2 skrll struct mbuf *m = *m0; 1070 1.3.2.2 skrll struct pf_rule *r; 1071 1.3.2.2 skrll struct ip6_hdr *h = mtod(m, struct ip6_hdr *); 1072 1.3.2.2 skrll int off; 1073 1.3.2.2 skrll struct ip6_ext ext; 1074 1.3.2.2 skrll struct ip6_opt opt; 1075 1.3.2.2 skrll struct ip6_opt_jumbo jumbo; 1076 1.3.2.2 skrll struct ip6_frag frag; 1077 1.3.2.2 skrll u_int32_t jumbolen = 0, plen; 1078 1.3.2.2 skrll u_int16_t fragoff = 0; 1079 1.3.2.2 skrll int optend; 1080 1.3.2.2 skrll int ooff; 1081 1.3.2.2 skrll u_int8_t proto; 1082 1.3.2.2 skrll int terminal; 1083 1.3.2.2 skrll 1084 1.3.2.2 skrll r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr); 1085 1.3.2.2 skrll while (r != NULL) { 1086 1.3.2.2 skrll r->evaluations++; 1087 1.3.2.2 skrll if (r->kif != NULL && 1088 1.3.2.2 skrll (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 1089 1.3.2.2 skrll r = r->skip[PF_SKIP_IFP].ptr; 1090 1.3.2.2 skrll else if (r->direction && r->direction != dir) 1091 1.3.2.2 skrll r = r->skip[PF_SKIP_DIR].ptr; 1092 1.3.2.2 skrll else if (r->af && r->af != AF_INET6) 1093 1.3.2.2 skrll r = r->skip[PF_SKIP_AF].ptr; 1094 1.3.2.2 skrll #if 0 /* header chain! */ 1095 1.3.2.2 skrll else if (r->proto && r->proto != h->ip6_nxt) 1096 1.3.2.2 skrll r = r->skip[PF_SKIP_PROTO].ptr; 1097 1.3.2.2 skrll #endif 1098 1.3.2.2 skrll else if (PF_MISMATCHAW(&r->src.addr, 1099 1.3.2.5 skrll (struct pf_addr *)&h->ip6_src, AF_INET6, r->src.neg)) 1100 1.3.2.2 skrll r = r->skip[PF_SKIP_SRC_ADDR].ptr; 1101 1.3.2.2 skrll else if (PF_MISMATCHAW(&r->dst.addr, 1102 1.3.2.5 skrll (struct pf_addr *)&h->ip6_dst, AF_INET6, r->dst.neg)) 1103 1.3.2.2 skrll r = r->skip[PF_SKIP_DST_ADDR].ptr; 1104 1.3.2.2 skrll else 1105 1.3.2.2 skrll break; 1106 1.3.2.2 skrll } 1107 1.3.2.2 skrll 1108 1.3.2.2 skrll if (r == NULL) 1109 1.3.2.2 skrll return (PF_PASS); 1110 1.3.2.2 skrll else 1111 1.3.2.2 skrll r->packets++; 1112 1.3.2.2 skrll 1113 1.3.2.2 skrll /* Check for illegal packets */ 1114 1.3.2.2 skrll if (sizeof(struct ip6_hdr) + IPV6_MAXPACKET < m->m_pkthdr.len) 1115 1.3.2.2 skrll goto drop; 1116 1.3.2.2 skrll 1117 1.3.2.2 skrll off = sizeof(struct ip6_hdr); 1118 1.3.2.2 skrll proto = h->ip6_nxt; 1119 1.3.2.2 skrll terminal = 0; 1120 1.3.2.2 skrll do { 1121 1.3.2.2 skrll switch (proto) { 1122 1.3.2.2 skrll case IPPROTO_FRAGMENT: 1123 1.3.2.2 skrll goto fragment; 1124 1.3.2.2 skrll break; 1125 1.3.2.2 skrll case IPPROTO_AH: 1126 1.3.2.2 skrll case IPPROTO_ROUTING: 1127 1.3.2.2 skrll case IPPROTO_DSTOPTS: 1128 1.3.2.2 skrll if (!pf_pull_hdr(m, off, &ext, sizeof(ext), NULL, 1129 1.3.2.2 skrll NULL, AF_INET6)) 1130 1.3.2.2 skrll goto shortpkt; 1131 1.3.2.2 skrll if (proto == IPPROTO_AH) 1132 1.3.2.2 skrll off += (ext.ip6e_len + 2) * 4; 1133 1.3.2.2 skrll else 1134 1.3.2.2 skrll off += (ext.ip6e_len + 1) * 8; 1135 1.3.2.2 skrll proto = ext.ip6e_nxt; 1136 1.3.2.2 skrll break; 1137 1.3.2.2 skrll case IPPROTO_HOPOPTS: 1138 1.3.2.2 skrll if (!pf_pull_hdr(m, off, &ext, sizeof(ext), NULL, 1139 1.3.2.2 skrll NULL, AF_INET6)) 1140 1.3.2.2 skrll goto shortpkt; 1141 1.3.2.2 skrll optend = off + (ext.ip6e_len + 1) * 8; 1142 1.3.2.2 skrll ooff = off + sizeof(ext); 1143 1.3.2.2 skrll do { 1144 1.3.2.2 skrll if (!pf_pull_hdr(m, ooff, &opt.ip6o_type, 1145 1.3.2.2 skrll sizeof(opt.ip6o_type), NULL, NULL, 1146 1.3.2.2 skrll AF_INET6)) 1147 1.3.2.2 skrll goto shortpkt; 1148 1.3.2.2 skrll if (opt.ip6o_type == IP6OPT_PAD1) { 1149 1.3.2.2 skrll ooff++; 1150 1.3.2.2 skrll continue; 1151 1.3.2.2 skrll } 1152 1.3.2.2 skrll if (!pf_pull_hdr(m, ooff, &opt, sizeof(opt), 1153 1.3.2.2 skrll NULL, NULL, AF_INET6)) 1154 1.3.2.2 skrll goto shortpkt; 1155 1.3.2.2 skrll if (ooff + sizeof(opt) + opt.ip6o_len > optend) 1156 1.3.2.2 skrll goto drop; 1157 1.3.2.2 skrll switch (opt.ip6o_type) { 1158 1.3.2.2 skrll case IP6OPT_JUMBO: 1159 1.3.2.2 skrll if (h->ip6_plen != 0) 1160 1.3.2.2 skrll goto drop; 1161 1.3.2.2 skrll if (!pf_pull_hdr(m, ooff, &jumbo, 1162 1.3.2.2 skrll sizeof(jumbo), NULL, NULL, 1163 1.3.2.2 skrll AF_INET6)) 1164 1.3.2.2 skrll goto shortpkt; 1165 1.3.2.2 skrll memcpy(&jumbolen, jumbo.ip6oj_jumbo_len, 1166 1.3.2.2 skrll sizeof(jumbolen)); 1167 1.3.2.2 skrll jumbolen = ntohl(jumbolen); 1168 1.3.2.2 skrll if (jumbolen <= IPV6_MAXPACKET) 1169 1.3.2.2 skrll goto drop; 1170 1.3.2.2 skrll if (sizeof(struct ip6_hdr) + jumbolen != 1171 1.3.2.2 skrll m->m_pkthdr.len) 1172 1.3.2.2 skrll goto drop; 1173 1.3.2.2 skrll break; 1174 1.3.2.2 skrll default: 1175 1.3.2.2 skrll break; 1176 1.3.2.2 skrll } 1177 1.3.2.2 skrll ooff += sizeof(opt) + opt.ip6o_len; 1178 1.3.2.2 skrll } while (ooff < optend); 1179 1.3.2.2 skrll 1180 1.3.2.2 skrll off = optend; 1181 1.3.2.2 skrll proto = ext.ip6e_nxt; 1182 1.3.2.2 skrll break; 1183 1.3.2.2 skrll default: 1184 1.3.2.2 skrll terminal = 1; 1185 1.3.2.2 skrll break; 1186 1.3.2.2 skrll } 1187 1.3.2.2 skrll } while (!terminal); 1188 1.3.2.2 skrll 1189 1.3.2.2 skrll /* jumbo payload option must be present, or plen > 0 */ 1190 1.3.2.2 skrll if (ntohs(h->ip6_plen) == 0) 1191 1.3.2.2 skrll plen = jumbolen; 1192 1.3.2.2 skrll else 1193 1.3.2.2 skrll plen = ntohs(h->ip6_plen); 1194 1.3.2.2 skrll if (plen == 0) 1195 1.3.2.2 skrll goto drop; 1196 1.3.2.2 skrll if (sizeof(struct ip6_hdr) + plen > m->m_pkthdr.len) 1197 1.3.2.2 skrll goto shortpkt; 1198 1.3.2.2 skrll 1199 1.3.2.2 skrll /* Enforce a minimum ttl, may cause endless packet loops */ 1200 1.3.2.2 skrll if (r->min_ttl && h->ip6_hlim < r->min_ttl) 1201 1.3.2.2 skrll h->ip6_hlim = r->min_ttl; 1202 1.3.2.2 skrll 1203 1.3.2.2 skrll return (PF_PASS); 1204 1.3.2.2 skrll 1205 1.3.2.2 skrll fragment: 1206 1.3.2.2 skrll if (ntohs(h->ip6_plen) == 0 || jumbolen) 1207 1.3.2.2 skrll goto drop; 1208 1.3.2.2 skrll plen = ntohs(h->ip6_plen); 1209 1.3.2.2 skrll 1210 1.3.2.2 skrll if (!pf_pull_hdr(m, off, &frag, sizeof(frag), NULL, NULL, AF_INET6)) 1211 1.3.2.2 skrll goto shortpkt; 1212 1.3.2.2 skrll fragoff = ntohs(frag.ip6f_offlg & IP6F_OFF_MASK); 1213 1.3.2.2 skrll if (fragoff + (plen - off - sizeof(frag)) > IPV6_MAXPACKET) 1214 1.3.2.2 skrll goto badfrag; 1215 1.3.2.2 skrll 1216 1.3.2.2 skrll /* do something about it */ 1217 1.3.2.5 skrll /* remember to set pd->flags |= PFDESC_IP_REAS */ 1218 1.3.2.2 skrll return (PF_PASS); 1219 1.3.2.2 skrll 1220 1.3.2.2 skrll shortpkt: 1221 1.3.2.2 skrll REASON_SET(reason, PFRES_SHORT); 1222 1.3.2.2 skrll if (r != NULL && r->log) 1223 1.3.2.2 skrll PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL); 1224 1.3.2.2 skrll return (PF_DROP); 1225 1.3.2.2 skrll 1226 1.3.2.2 skrll drop: 1227 1.3.2.2 skrll REASON_SET(reason, PFRES_NORM); 1228 1.3.2.2 skrll if (r != NULL && r->log) 1229 1.3.2.2 skrll PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL); 1230 1.3.2.2 skrll return (PF_DROP); 1231 1.3.2.2 skrll 1232 1.3.2.2 skrll badfrag: 1233 1.3.2.2 skrll REASON_SET(reason, PFRES_FRAG); 1234 1.3.2.2 skrll if (r != NULL && r->log) 1235 1.3.2.2 skrll PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL); 1236 1.3.2.2 skrll return (PF_DROP); 1237 1.3.2.2 skrll } 1238 1.3.2.5 skrll #endif /* INET6 */ 1239 1.3.2.2 skrll 1240 1.3.2.2 skrll int 1241 1.3.2.2 skrll pf_normalize_tcp(int dir, struct pfi_kif *kif, struct mbuf *m, int ipoff, 1242 1.3.2.2 skrll int off, void *h, struct pf_pdesc *pd) 1243 1.3.2.2 skrll { 1244 1.3.2.2 skrll struct pf_rule *r, *rm = NULL; 1245 1.3.2.2 skrll struct tcphdr *th = pd->hdr.tcp; 1246 1.3.2.2 skrll int rewrite = 0; 1247 1.3.2.2 skrll u_short reason; 1248 1.3.2.2 skrll u_int8_t flags; 1249 1.3.2.2 skrll sa_family_t af = pd->af; 1250 1.3.2.2 skrll 1251 1.3.2.2 skrll r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr); 1252 1.3.2.2 skrll while (r != NULL) { 1253 1.3.2.2 skrll r->evaluations++; 1254 1.3.2.2 skrll if (r->kif != NULL && 1255 1.3.2.2 skrll (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 1256 1.3.2.2 skrll r = r->skip[PF_SKIP_IFP].ptr; 1257 1.3.2.2 skrll else if (r->direction && r->direction != dir) 1258 1.3.2.2 skrll r = r->skip[PF_SKIP_DIR].ptr; 1259 1.3.2.2 skrll else if (r->af && r->af != af) 1260 1.3.2.2 skrll r = r->skip[PF_SKIP_AF].ptr; 1261 1.3.2.2 skrll else if (r->proto && r->proto != pd->proto) 1262 1.3.2.2 skrll r = r->skip[PF_SKIP_PROTO].ptr; 1263 1.3.2.5 skrll else if (PF_MISMATCHAW(&r->src.addr, pd->src, af, r->src.neg)) 1264 1.3.2.2 skrll r = r->skip[PF_SKIP_SRC_ADDR].ptr; 1265 1.3.2.2 skrll else if (r->src.port_op && !pf_match_port(r->src.port_op, 1266 1.3.2.2 skrll r->src.port[0], r->src.port[1], th->th_sport)) 1267 1.3.2.2 skrll r = r->skip[PF_SKIP_SRC_PORT].ptr; 1268 1.3.2.5 skrll else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af, r->dst.neg)) 1269 1.3.2.2 skrll r = r->skip[PF_SKIP_DST_ADDR].ptr; 1270 1.3.2.2 skrll else if (r->dst.port_op && !pf_match_port(r->dst.port_op, 1271 1.3.2.2 skrll r->dst.port[0], r->dst.port[1], th->th_dport)) 1272 1.3.2.2 skrll r = r->skip[PF_SKIP_DST_PORT].ptr; 1273 1.3.2.2 skrll else if (r->os_fingerprint != PF_OSFP_ANY && !pf_osfp_match( 1274 1.3.2.2 skrll pf_osfp_fingerprint(pd, m, off, th), 1275 1.3.2.2 skrll r->os_fingerprint)) 1276 1.3.2.2 skrll r = TAILQ_NEXT(r, entries); 1277 1.3.2.2 skrll else { 1278 1.3.2.2 skrll rm = r; 1279 1.3.2.2 skrll break; 1280 1.3.2.2 skrll } 1281 1.3.2.2 skrll } 1282 1.3.2.2 skrll 1283 1.3.2.2 skrll if (rm == NULL) 1284 1.3.2.2 skrll return (PF_PASS); 1285 1.3.2.2 skrll else 1286 1.3.2.2 skrll r->packets++; 1287 1.3.2.2 skrll 1288 1.3.2.2 skrll if (rm->rule_flag & PFRULE_REASSEMBLE_TCP) 1289 1.3.2.2 skrll pd->flags |= PFDESC_TCP_NORM; 1290 1.3.2.2 skrll 1291 1.3.2.2 skrll flags = th->th_flags; 1292 1.3.2.2 skrll if (flags & TH_SYN) { 1293 1.3.2.2 skrll /* Illegal packet */ 1294 1.3.2.2 skrll if (flags & TH_RST) 1295 1.3.2.2 skrll goto tcp_drop; 1296 1.3.2.2 skrll 1297 1.3.2.2 skrll if (flags & TH_FIN) 1298 1.3.2.2 skrll flags &= ~TH_FIN; 1299 1.3.2.2 skrll } else { 1300 1.3.2.2 skrll /* Illegal packet */ 1301 1.3.2.2 skrll if (!(flags & (TH_ACK|TH_RST))) 1302 1.3.2.2 skrll goto tcp_drop; 1303 1.3.2.2 skrll } 1304 1.3.2.2 skrll 1305 1.3.2.2 skrll if (!(flags & TH_ACK)) { 1306 1.3.2.2 skrll /* These flags are only valid if ACK is set */ 1307 1.3.2.2 skrll if ((flags & TH_FIN) || (flags & TH_PUSH) || (flags & TH_URG)) 1308 1.3.2.2 skrll goto tcp_drop; 1309 1.3.2.2 skrll } 1310 1.3.2.2 skrll 1311 1.3.2.2 skrll /* Check for illegal header length */ 1312 1.3.2.2 skrll if (th->th_off < (sizeof(struct tcphdr) >> 2)) 1313 1.3.2.2 skrll goto tcp_drop; 1314 1.3.2.2 skrll 1315 1.3.2.2 skrll /* If flags changed, or reserved data set, then adjust */ 1316 1.3.2.2 skrll if (flags != th->th_flags || th->th_x2 != 0) { 1317 1.3.2.2 skrll u_int16_t ov, nv; 1318 1.3.2.2 skrll 1319 1.3.2.2 skrll ov = *(u_int16_t *)(&th->th_ack + 1); 1320 1.3.2.2 skrll th->th_flags = flags; 1321 1.3.2.2 skrll th->th_x2 = 0; 1322 1.3.2.2 skrll nv = *(u_int16_t *)(&th->th_ack + 1); 1323 1.3.2.2 skrll 1324 1.3.2.5 skrll th->th_sum = pf_cksum_fixup(th->th_sum, ov, nv, 0); 1325 1.3.2.2 skrll rewrite = 1; 1326 1.3.2.2 skrll } 1327 1.3.2.2 skrll 1328 1.3.2.2 skrll /* Remove urgent pointer, if TH_URG is not set */ 1329 1.3.2.2 skrll if (!(flags & TH_URG) && th->th_urp) { 1330 1.3.2.5 skrll th->th_sum = pf_cksum_fixup(th->th_sum, th->th_urp, 0, 0); 1331 1.3.2.2 skrll th->th_urp = 0; 1332 1.3.2.2 skrll rewrite = 1; 1333 1.3.2.2 skrll } 1334 1.3.2.2 skrll 1335 1.3.2.2 skrll /* Process options */ 1336 1.3.2.2 skrll if (r->max_mss && pf_normalize_tcpopt(r, m, th, off)) 1337 1.3.2.2 skrll rewrite = 1; 1338 1.3.2.2 skrll 1339 1.3.2.2 skrll /* copy back packet headers if we sanitized */ 1340 1.3.2.2 skrll if (rewrite) 1341 1.3.2.3 skrll m_copyback(m, off, sizeof(*th), th); 1342 1.3.2.2 skrll 1343 1.3.2.2 skrll return (PF_PASS); 1344 1.3.2.2 skrll 1345 1.3.2.2 skrll tcp_drop: 1346 1.3.2.2 skrll REASON_SET(&reason, PFRES_NORM); 1347 1.3.2.2 skrll if (rm != NULL && r->log) 1348 1.3.2.2 skrll PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, r, NULL, NULL); 1349 1.3.2.2 skrll return (PF_DROP); 1350 1.3.2.2 skrll } 1351 1.3.2.2 skrll 1352 1.3.2.2 skrll int 1353 1.3.2.2 skrll pf_normalize_tcp_init(struct mbuf *m, int off, struct pf_pdesc *pd, 1354 1.3.2.2 skrll struct tcphdr *th, struct pf_state_peer *src, struct pf_state_peer *dst) 1355 1.3.2.2 skrll { 1356 1.3.2.5 skrll u_int32_t tsval, tsecr; 1357 1.3.2.2 skrll u_int8_t hdr[60]; 1358 1.3.2.2 skrll u_int8_t *opt; 1359 1.3.2.2 skrll 1360 1.3.2.2 skrll KASSERT(src->scrub == NULL); 1361 1.3.2.2 skrll 1362 1.3.2.2 skrll src->scrub = pool_get(&pf_state_scrub_pl, PR_NOWAIT); 1363 1.3.2.2 skrll if (src->scrub == NULL) 1364 1.3.2.2 skrll return (1); 1365 1.3.2.2 skrll bzero(src->scrub, sizeof(*src->scrub)); 1366 1.3.2.2 skrll 1367 1.3.2.2 skrll switch (pd->af) { 1368 1.3.2.2 skrll #ifdef INET 1369 1.3.2.2 skrll case AF_INET: { 1370 1.3.2.2 skrll struct ip *h = mtod(m, struct ip *); 1371 1.3.2.2 skrll src->scrub->pfss_ttl = h->ip_ttl; 1372 1.3.2.2 skrll break; 1373 1.3.2.2 skrll } 1374 1.3.2.2 skrll #endif /* INET */ 1375 1.3.2.2 skrll #ifdef INET6 1376 1.3.2.2 skrll case AF_INET6: { 1377 1.3.2.2 skrll struct ip6_hdr *h = mtod(m, struct ip6_hdr *); 1378 1.3.2.2 skrll src->scrub->pfss_ttl = h->ip6_hlim; 1379 1.3.2.2 skrll break; 1380 1.3.2.2 skrll } 1381 1.3.2.2 skrll #endif /* INET6 */ 1382 1.3.2.2 skrll } 1383 1.3.2.2 skrll 1384 1.3.2.2 skrll 1385 1.3.2.2 skrll /* 1386 1.3.2.2 skrll * All normalizations below are only begun if we see the start of 1387 1.3.2.2 skrll * the connections. They must all set an enabled bit in pfss_flags 1388 1.3.2.2 skrll */ 1389 1.3.2.2 skrll if ((th->th_flags & TH_SYN) == 0) 1390 1.3.2.2 skrll return (0); 1391 1.3.2.2 skrll 1392 1.3.2.2 skrll 1393 1.3.2.2 skrll if (th->th_off > (sizeof(struct tcphdr) >> 2) && src->scrub && 1394 1.3.2.2 skrll pf_pull_hdr(m, off, hdr, th->th_off << 2, NULL, NULL, pd->af)) { 1395 1.3.2.2 skrll /* Diddle with TCP options */ 1396 1.3.2.2 skrll int hlen; 1397 1.3.2.2 skrll opt = hdr + sizeof(struct tcphdr); 1398 1.3.2.2 skrll hlen = (th->th_off << 2) - sizeof(struct tcphdr); 1399 1.3.2.2 skrll while (hlen >= TCPOLEN_TIMESTAMP) { 1400 1.3.2.2 skrll switch (*opt) { 1401 1.3.2.2 skrll case TCPOPT_EOL: /* FALLTHROUGH */ 1402 1.3.2.2 skrll case TCPOPT_NOP: 1403 1.3.2.2 skrll opt++; 1404 1.3.2.2 skrll hlen--; 1405 1.3.2.2 skrll break; 1406 1.3.2.2 skrll case TCPOPT_TIMESTAMP: 1407 1.3.2.2 skrll if (opt[1] >= TCPOLEN_TIMESTAMP) { 1408 1.3.2.2 skrll src->scrub->pfss_flags |= 1409 1.3.2.2 skrll PFSS_TIMESTAMP; 1410 1.3.2.5 skrll src->scrub->pfss_ts_mod = 1411 1.3.2.5 skrll htonl(arc4random()); 1412 1.3.2.5 skrll 1413 1.3.2.5 skrll /* note PFSS_PAWS not set yet */ 1414 1.3.2.5 skrll memcpy(&tsval, &opt[2], 1415 1.3.2.5 skrll sizeof(u_int32_t)); 1416 1.3.2.5 skrll memcpy(&tsecr, &opt[6], 1417 1.3.2.5 skrll sizeof(u_int32_t)); 1418 1.3.2.5 skrll src->scrub->pfss_tsval0 = ntohl(tsval); 1419 1.3.2.5 skrll src->scrub->pfss_tsval = ntohl(tsval); 1420 1.3.2.5 skrll src->scrub->pfss_tsecr = ntohl(tsecr); 1421 1.3.2.5 skrll getmicrouptime(&src->scrub->pfss_last); 1422 1.3.2.2 skrll } 1423 1.3.2.2 skrll /* FALLTHROUGH */ 1424 1.3.2.2 skrll default: 1425 1.3.2.5 skrll hlen -= MAX(opt[1], 2); 1426 1.3.2.5 skrll opt += MAX(opt[1], 2); 1427 1.3.2.2 skrll break; 1428 1.3.2.2 skrll } 1429 1.3.2.2 skrll } 1430 1.3.2.2 skrll } 1431 1.3.2.2 skrll 1432 1.3.2.2 skrll return (0); 1433 1.3.2.2 skrll } 1434 1.3.2.2 skrll 1435 1.3.2.2 skrll void 1436 1.3.2.2 skrll pf_normalize_tcp_cleanup(struct pf_state *state) 1437 1.3.2.2 skrll { 1438 1.3.2.2 skrll if (state->src.scrub) 1439 1.3.2.2 skrll pool_put(&pf_state_scrub_pl, state->src.scrub); 1440 1.3.2.2 skrll if (state->dst.scrub) 1441 1.3.2.2 skrll pool_put(&pf_state_scrub_pl, state->dst.scrub); 1442 1.3.2.2 skrll 1443 1.3.2.2 skrll /* Someday... flush the TCP segment reassembly descriptors. */ 1444 1.3.2.2 skrll } 1445 1.3.2.2 skrll 1446 1.3.2.2 skrll int 1447 1.3.2.2 skrll pf_normalize_tcp_stateful(struct mbuf *m, int off, struct pf_pdesc *pd, 1448 1.3.2.5 skrll u_short *reason, struct tcphdr *th, struct pf_state *state, 1449 1.3.2.5 skrll struct pf_state_peer *src, struct pf_state_peer *dst, int *writeback) 1450 1.3.2.2 skrll { 1451 1.3.2.5 skrll struct timeval uptime; 1452 1.3.2.5 skrll u_int32_t tsval, tsecr; 1453 1.3.2.5 skrll u_int tsval_from_last; 1454 1.3.2.2 skrll u_int8_t hdr[60]; 1455 1.3.2.2 skrll u_int8_t *opt; 1456 1.3.2.2 skrll int copyback = 0; 1457 1.3.2.5 skrll int got_ts = 0; 1458 1.3.2.2 skrll 1459 1.3.2.2 skrll KASSERT(src->scrub || dst->scrub); 1460 1.3.2.2 skrll 1461 1.3.2.2 skrll /* 1462 1.3.2.2 skrll * Enforce the minimum TTL seen for this connection. Negate a common 1463 1.3.2.2 skrll * technique to evade an intrusion detection system and confuse 1464 1.3.2.2 skrll * firewall state code. 1465 1.3.2.2 skrll */ 1466 1.3.2.2 skrll switch (pd->af) { 1467 1.3.2.2 skrll #ifdef INET 1468 1.3.2.2 skrll case AF_INET: { 1469 1.3.2.2 skrll if (src->scrub) { 1470 1.3.2.2 skrll struct ip *h = mtod(m, struct ip *); 1471 1.3.2.2 skrll if (h->ip_ttl > src->scrub->pfss_ttl) 1472 1.3.2.2 skrll src->scrub->pfss_ttl = h->ip_ttl; 1473 1.3.2.2 skrll h->ip_ttl = src->scrub->pfss_ttl; 1474 1.3.2.2 skrll } 1475 1.3.2.2 skrll break; 1476 1.3.2.2 skrll } 1477 1.3.2.2 skrll #endif /* INET */ 1478 1.3.2.2 skrll #ifdef INET6 1479 1.3.2.2 skrll case AF_INET6: { 1480 1.3.2.2 skrll if (src->scrub) { 1481 1.3.2.2 skrll struct ip6_hdr *h = mtod(m, struct ip6_hdr *); 1482 1.3.2.2 skrll if (h->ip6_hlim > src->scrub->pfss_ttl) 1483 1.3.2.2 skrll src->scrub->pfss_ttl = h->ip6_hlim; 1484 1.3.2.2 skrll h->ip6_hlim = src->scrub->pfss_ttl; 1485 1.3.2.2 skrll } 1486 1.3.2.2 skrll break; 1487 1.3.2.2 skrll } 1488 1.3.2.2 skrll #endif /* INET6 */ 1489 1.3.2.2 skrll } 1490 1.3.2.2 skrll 1491 1.3.2.2 skrll if (th->th_off > (sizeof(struct tcphdr) >> 2) && 1492 1.3.2.2 skrll ((src->scrub && (src->scrub->pfss_flags & PFSS_TIMESTAMP)) || 1493 1.3.2.2 skrll (dst->scrub && (dst->scrub->pfss_flags & PFSS_TIMESTAMP))) && 1494 1.3.2.2 skrll pf_pull_hdr(m, off, hdr, th->th_off << 2, NULL, NULL, pd->af)) { 1495 1.3.2.2 skrll /* Diddle with TCP options */ 1496 1.3.2.2 skrll int hlen; 1497 1.3.2.2 skrll opt = hdr + sizeof(struct tcphdr); 1498 1.3.2.2 skrll hlen = (th->th_off << 2) - sizeof(struct tcphdr); 1499 1.3.2.2 skrll while (hlen >= TCPOLEN_TIMESTAMP) { 1500 1.3.2.2 skrll switch (*opt) { 1501 1.3.2.2 skrll case TCPOPT_EOL: /* FALLTHROUGH */ 1502 1.3.2.2 skrll case TCPOPT_NOP: 1503 1.3.2.2 skrll opt++; 1504 1.3.2.2 skrll hlen--; 1505 1.3.2.2 skrll break; 1506 1.3.2.2 skrll case TCPOPT_TIMESTAMP: 1507 1.3.2.2 skrll /* Modulate the timestamps. Can be used for 1508 1.3.2.2 skrll * NAT detection, OS uptime determination or 1509 1.3.2.2 skrll * reboot detection. 1510 1.3.2.2 skrll */ 1511 1.3.2.5 skrll 1512 1.3.2.5 skrll if (got_ts) { 1513 1.3.2.5 skrll /* Huh? Multiple timestamps!? */ 1514 1.3.2.5 skrll if (pf_status.debug >= PF_DEBUG_MISC) { 1515 1.3.2.5 skrll DPFPRINTF(("multiple TS??")); 1516 1.3.2.5 skrll pf_print_state(state); 1517 1.3.2.5 skrll printf("\n"); 1518 1.3.2.5 skrll } 1519 1.3.2.5 skrll REASON_SET(reason, PFRES_TS); 1520 1.3.2.5 skrll return (PF_DROP); 1521 1.3.2.5 skrll } 1522 1.3.2.2 skrll if (opt[1] >= TCPOLEN_TIMESTAMP) { 1523 1.3.2.5 skrll memcpy(&tsval, &opt[2], 1524 1.3.2.5 skrll sizeof(u_int32_t)); 1525 1.3.2.5 skrll if (tsval && src->scrub && 1526 1.3.2.2 skrll (src->scrub->pfss_flags & 1527 1.3.2.2 skrll PFSS_TIMESTAMP)) { 1528 1.3.2.5 skrll tsval = ntohl(tsval); 1529 1.3.2.2 skrll pf_change_a(&opt[2], 1530 1.3.2.5 skrll &th->th_sum, 1531 1.3.2.5 skrll htonl(tsval + 1532 1.3.2.5 skrll src->scrub->pfss_ts_mod), 1533 1.3.2.5 skrll 0); 1534 1.3.2.2 skrll copyback = 1; 1535 1.3.2.2 skrll } 1536 1.3.2.2 skrll 1537 1.3.2.2 skrll /* Modulate TS reply iff valid (!0) */ 1538 1.3.2.5 skrll memcpy(&tsecr, &opt[6], 1539 1.3.2.2 skrll sizeof(u_int32_t)); 1540 1.3.2.5 skrll if (tsecr && dst->scrub && 1541 1.3.2.2 skrll (dst->scrub->pfss_flags & 1542 1.3.2.2 skrll PFSS_TIMESTAMP)) { 1543 1.3.2.5 skrll tsecr = ntohl(tsecr) 1544 1.3.2.5 skrll - dst->scrub->pfss_ts_mod; 1545 1.3.2.2 skrll pf_change_a(&opt[6], 1546 1.3.2.5 skrll &th->th_sum, htonl(tsecr), 1547 1.3.2.5 skrll 0); 1548 1.3.2.2 skrll copyback = 1; 1549 1.3.2.2 skrll } 1550 1.3.2.5 skrll got_ts = 1; 1551 1.3.2.2 skrll } 1552 1.3.2.2 skrll /* FALLTHROUGH */ 1553 1.3.2.2 skrll default: 1554 1.3.2.5 skrll hlen -= MAX(opt[1], 2); 1555 1.3.2.5 skrll opt += MAX(opt[1], 2); 1556 1.3.2.2 skrll break; 1557 1.3.2.2 skrll } 1558 1.3.2.2 skrll } 1559 1.3.2.2 skrll if (copyback) { 1560 1.3.2.2 skrll /* Copyback the options, caller copys back header */ 1561 1.3.2.2 skrll *writeback = 1; 1562 1.3.2.2 skrll m_copyback(m, off + sizeof(struct tcphdr), 1563 1.3.2.3 skrll (th->th_off << 2) - sizeof(struct tcphdr), hdr + 1564 1.3.2.3 skrll sizeof(struct tcphdr)); 1565 1.3.2.2 skrll } 1566 1.3.2.2 skrll } 1567 1.3.2.2 skrll 1568 1.3.2.2 skrll 1569 1.3.2.5 skrll /* 1570 1.3.2.5 skrll * Must invalidate PAWS checks on connections idle for too long. 1571 1.3.2.5 skrll * The fastest allowed timestamp clock is 1ms. That turns out to 1572 1.3.2.5 skrll * be about 24 days before it wraps. XXX Right now our lowerbound 1573 1.3.2.5 skrll * TS echo check only works for the first 12 days of a connection 1574 1.3.2.5 skrll * when the TS has exhausted half its 32bit space 1575 1.3.2.5 skrll */ 1576 1.3.2.5 skrll #define TS_MAX_IDLE (24*24*60*60) 1577 1.3.2.5 skrll #define TS_MAX_CONN (12*24*60*60) /* XXX remove when better tsecr check */ 1578 1.3.2.5 skrll 1579 1.3.2.5 skrll getmicrouptime(&uptime); 1580 1.3.2.5 skrll if (src->scrub && (src->scrub->pfss_flags & PFSS_PAWS) && 1581 1.3.2.5 skrll (uptime.tv_sec - src->scrub->pfss_last.tv_sec > TS_MAX_IDLE || 1582 1.3.2.5 skrll time_second - state->creation > TS_MAX_CONN)) { 1583 1.3.2.5 skrll if (pf_status.debug >= PF_DEBUG_MISC) { 1584 1.3.2.5 skrll DPFPRINTF(("src idled out of PAWS\n")); 1585 1.3.2.5 skrll pf_print_state(state); 1586 1.3.2.5 skrll printf("\n"); 1587 1.3.2.5 skrll } 1588 1.3.2.5 skrll src->scrub->pfss_flags = (src->scrub->pfss_flags & ~PFSS_PAWS) 1589 1.3.2.5 skrll | PFSS_PAWS_IDLED; 1590 1.3.2.5 skrll } 1591 1.3.2.5 skrll if (dst->scrub && (dst->scrub->pfss_flags & PFSS_PAWS) && 1592 1.3.2.5 skrll uptime.tv_sec - dst->scrub->pfss_last.tv_sec > TS_MAX_IDLE) { 1593 1.3.2.5 skrll if (pf_status.debug >= PF_DEBUG_MISC) { 1594 1.3.2.5 skrll DPFPRINTF(("dst idled out of PAWS\n")); 1595 1.3.2.5 skrll pf_print_state(state); 1596 1.3.2.5 skrll printf("\n"); 1597 1.3.2.5 skrll } 1598 1.3.2.5 skrll dst->scrub->pfss_flags = (dst->scrub->pfss_flags & ~PFSS_PAWS) 1599 1.3.2.5 skrll | PFSS_PAWS_IDLED; 1600 1.3.2.5 skrll } 1601 1.3.2.5 skrll 1602 1.3.2.5 skrll if (got_ts && src->scrub && dst->scrub && 1603 1.3.2.5 skrll (src->scrub->pfss_flags & PFSS_PAWS) && 1604 1.3.2.5 skrll (dst->scrub->pfss_flags & PFSS_PAWS)) { 1605 1.3.2.5 skrll /* Validate that the timestamps are "in-window". 1606 1.3.2.5 skrll * RFC1323 describes TCP Timestamp options that allow 1607 1.3.2.5 skrll * measurement of RTT (round trip time) and PAWS 1608 1.3.2.5 skrll * (protection against wrapped sequence numbers). PAWS 1609 1.3.2.5 skrll * gives us a set of rules for rejecting packets on 1610 1.3.2.5 skrll * long fat pipes (packets that were somehow delayed 1611 1.3.2.5 skrll * in transit longer than the time it took to send the 1612 1.3.2.5 skrll * full TCP sequence space of 4Gb). We can use these 1613 1.3.2.5 skrll * rules and infer a few others that will let us treat 1614 1.3.2.5 skrll * the 32bit timestamp and the 32bit echoed timestamp 1615 1.3.2.5 skrll * as sequence numbers to prevent a blind attacker from 1616 1.3.2.5 skrll * inserting packets into a connection. 1617 1.3.2.5 skrll * 1618 1.3.2.5 skrll * RFC1323 tells us: 1619 1.3.2.5 skrll * - The timestamp on this packet must be greater than 1620 1.3.2.5 skrll * or equal to the last value echoed by the other 1621 1.3.2.5 skrll * endpoint. The RFC says those will be discarded 1622 1.3.2.5 skrll * since it is a dup that has already been acked. 1623 1.3.2.5 skrll * This gives us a lowerbound on the timestamp. 1624 1.3.2.5 skrll * timestamp >= other last echoed timestamp 1625 1.3.2.5 skrll * - The timestamp will be less than or equal to 1626 1.3.2.5 skrll * the last timestamp plus the time between the 1627 1.3.2.5 skrll * last packet and now. The RFC defines the max 1628 1.3.2.5 skrll * clock rate as 1ms. We will allow clocks to be 1629 1.3.2.5 skrll * up to 10% fast and will allow a total difference 1630 1.3.2.5 skrll * or 30 seconds due to a route change. And this 1631 1.3.2.5 skrll * gives us an upperbound on the timestamp. 1632 1.3.2.5 skrll * timestamp <= last timestamp + max ticks 1633 1.3.2.5 skrll * We have to be careful here. Windows will send an 1634 1.3.2.5 skrll * initial timestamp of zero and then initialize it 1635 1.3.2.5 skrll * to a random value after the 3whs; presumably to 1636 1.3.2.5 skrll * avoid a DoS by having to call an expensive RNG 1637 1.3.2.5 skrll * during a SYN flood. Proof MS has at least one 1638 1.3.2.5 skrll * good security geek. 1639 1.3.2.5 skrll * 1640 1.3.2.5 skrll * - The TCP timestamp option must also echo the other 1641 1.3.2.5 skrll * endpoints timestamp. The timestamp echoed is the 1642 1.3.2.5 skrll * one carried on the earliest unacknowledged segment 1643 1.3.2.5 skrll * on the left edge of the sequence window. The RFC 1644 1.3.2.5 skrll * states that the host will reject any echoed 1645 1.3.2.5 skrll * timestamps that were larger than any ever sent. 1646 1.3.2.5 skrll * This gives us an upperbound on the TS echo. 1647 1.3.2.5 skrll * tescr <= largest_tsval 1648 1.3.2.5 skrll * - The lowerbound on the TS echo is a little more 1649 1.3.2.5 skrll * tricky to determine. The other endpoint's echoed 1650 1.3.2.5 skrll * values will not decrease. But there may be 1651 1.3.2.5 skrll * network conditions that re-order packets and 1652 1.3.2.5 skrll * cause our view of them to decrease. For now the 1653 1.3.2.5 skrll * only lowerbound we can safely determine is that 1654 1.3.2.5 skrll * the TS echo will never be less than the orginal 1655 1.3.2.5 skrll * TS. XXX There is probably a better lowerbound. 1656 1.3.2.5 skrll * Remove TS_MAX_CONN with better lowerbound check. 1657 1.3.2.5 skrll * tescr >= other original TS 1658 1.3.2.5 skrll * 1659 1.3.2.5 skrll * It is also important to note that the fastest 1660 1.3.2.5 skrll * timestamp clock of 1ms will wrap its 32bit space in 1661 1.3.2.5 skrll * 24 days. So we just disable TS checking after 24 1662 1.3.2.5 skrll * days of idle time. We actually must use a 12d 1663 1.3.2.5 skrll * connection limit until we can come up with a better 1664 1.3.2.5 skrll * lowerbound to the TS echo check. 1665 1.3.2.5 skrll */ 1666 1.3.2.5 skrll struct timeval delta_ts; 1667 1.3.2.5 skrll int ts_fudge; 1668 1.3.2.5 skrll 1669 1.3.2.5 skrll 1670 1.3.2.5 skrll /* 1671 1.3.2.5 skrll * PFTM_TS_DIFF is how many seconds of leeway to allow 1672 1.3.2.5 skrll * a host's timestamp. This can happen if the previous 1673 1.3.2.5 skrll * packet got delayed in transit for much longer than 1674 1.3.2.5 skrll * this packet. 1675 1.3.2.5 skrll */ 1676 1.3.2.5 skrll if ((ts_fudge = state->rule.ptr->timeout[PFTM_TS_DIFF]) == 0) 1677 1.3.2.5 skrll ts_fudge = pf_default_rule.timeout[PFTM_TS_DIFF]; 1678 1.3.2.5 skrll 1679 1.3.2.5 skrll 1680 1.3.2.5 skrll /* Calculate max ticks since the last timestamp */ 1681 1.3.2.5 skrll #define TS_MAXFREQ 1100 /* RFC max TS freq of 1Khz + 10% skew */ 1682 1.3.2.5 skrll #define TS_MICROSECS 1000000 /* microseconds per second */ 1683 1.3.2.5 skrll timersub(&uptime, &src->scrub->pfss_last, &delta_ts); 1684 1.3.2.5 skrll tsval_from_last = (delta_ts.tv_sec + ts_fudge) * TS_MAXFREQ; 1685 1.3.2.5 skrll tsval_from_last += delta_ts.tv_usec / (TS_MICROSECS/TS_MAXFREQ); 1686 1.3.2.5 skrll 1687 1.3.2.5 skrll 1688 1.3.2.5 skrll if ((src->state >= TCPS_ESTABLISHED && 1689 1.3.2.5 skrll dst->state >= TCPS_ESTABLISHED) && 1690 1.3.2.5 skrll (SEQ_LT(tsval, dst->scrub->pfss_tsecr) || 1691 1.3.2.5 skrll SEQ_GT(tsval, src->scrub->pfss_tsval + tsval_from_last) || 1692 1.3.2.5 skrll (tsecr && (SEQ_GT(tsecr, dst->scrub->pfss_tsval) || 1693 1.3.2.5 skrll SEQ_LT(tsecr, dst->scrub->pfss_tsval0))))) { 1694 1.3.2.5 skrll /* Bad RFC1323 implementation or an insertion attack. 1695 1.3.2.5 skrll * 1696 1.3.2.5 skrll * - Solaris 2.6 and 2.7 are known to send another ACK 1697 1.3.2.5 skrll * after the FIN,FIN|ACK,ACK closing that carries 1698 1.3.2.5 skrll * an old timestamp. 1699 1.3.2.5 skrll */ 1700 1.3.2.5 skrll 1701 1.3.2.5 skrll DPFPRINTF(("Timestamp failed %c%c%c%c\n", 1702 1.3.2.5 skrll SEQ_LT(tsval, dst->scrub->pfss_tsecr) ? '0' : ' ', 1703 1.3.2.5 skrll SEQ_GT(tsval, src->scrub->pfss_tsval + 1704 1.3.2.5 skrll tsval_from_last) ? '1' : ' ', 1705 1.3.2.5 skrll SEQ_GT(tsecr, dst->scrub->pfss_tsval) ? '2' : ' ', 1706 1.3.2.5 skrll SEQ_LT(tsecr, dst->scrub->pfss_tsval0)? '3' : ' ')); 1707 1.3.2.5 skrll DPFPRINTF((" tsval: %" PRIu32 " tsecr: %" PRIu32 1708 1.3.2.5 skrll " +ticks: %" PRIu32 " idle: %lus %lums\n", 1709 1.3.2.5 skrll tsval, tsecr, tsval_from_last, delta_ts.tv_sec, 1710 1.3.2.5 skrll delta_ts.tv_usec / 1000)); 1711 1.3.2.5 skrll DPFPRINTF((" src->tsval: %" PRIu32 " tsecr: %" PRIu32 1712 1.3.2.5 skrll "\n", 1713 1.3.2.5 skrll src->scrub->pfss_tsval, src->scrub->pfss_tsecr)); 1714 1.3.2.5 skrll DPFPRINTF((" dst->tsval: %" PRIu32 " tsecr: %" PRIu32 1715 1.3.2.5 skrll " tsval0: %" PRIu32 "\n", 1716 1.3.2.5 skrll dst->scrub->pfss_tsval, 1717 1.3.2.5 skrll dst->scrub->pfss_tsecr, dst->scrub->pfss_tsval0)); 1718 1.3.2.5 skrll if (pf_status.debug >= PF_DEBUG_MISC) { 1719 1.3.2.5 skrll pf_print_state(state); 1720 1.3.2.5 skrll pf_print_flags(th->th_flags); 1721 1.3.2.5 skrll printf("\n"); 1722 1.3.2.5 skrll } 1723 1.3.2.5 skrll REASON_SET(reason, PFRES_TS); 1724 1.3.2.5 skrll return (PF_DROP); 1725 1.3.2.5 skrll } 1726 1.3.2.5 skrll 1727 1.3.2.5 skrll /* XXX I'd really like to require tsecr but it's optional */ 1728 1.3.2.5 skrll 1729 1.3.2.5 skrll } else if (!got_ts && (th->th_flags & TH_RST) == 0 && 1730 1.3.2.5 skrll ((src->state == TCPS_ESTABLISHED && dst->state == TCPS_ESTABLISHED) 1731 1.3.2.5 skrll || pd->p_len > 0 || (th->th_flags & TH_SYN)) && 1732 1.3.2.5 skrll src->scrub && dst->scrub && 1733 1.3.2.5 skrll (src->scrub->pfss_flags & PFSS_PAWS) && 1734 1.3.2.5 skrll (dst->scrub->pfss_flags & PFSS_PAWS)) { 1735 1.3.2.5 skrll /* Didn't send a timestamp. Timestamps aren't really useful 1736 1.3.2.5 skrll * when: 1737 1.3.2.5 skrll * - connection opening or closing (often not even sent). 1738 1.3.2.5 skrll * but we must not let an attacker to put a FIN on a 1739 1.3.2.5 skrll * data packet to sneak it through our ESTABLISHED check. 1740 1.3.2.5 skrll * - on a TCP reset. RFC suggests not even looking at TS. 1741 1.3.2.5 skrll * - on an empty ACK. The TS will not be echoed so it will 1742 1.3.2.5 skrll * probably not help keep the RTT calculation in sync and 1743 1.3.2.5 skrll * there isn't as much danger when the sequence numbers 1744 1.3.2.5 skrll * got wrapped. So some stacks don't include TS on empty 1745 1.3.2.5 skrll * ACKs :-( 1746 1.3.2.5 skrll * 1747 1.3.2.5 skrll * To minimize the disruption to mostly RFC1323 conformant 1748 1.3.2.5 skrll * stacks, we will only require timestamps on data packets. 1749 1.3.2.5 skrll * 1750 1.3.2.5 skrll * And what do ya know, we cannot require timestamps on data 1751 1.3.2.5 skrll * packets. There appear to be devices that do legitimate 1752 1.3.2.5 skrll * TCP connection hijacking. There are HTTP devices that allow 1753 1.3.2.5 skrll * a 3whs (with timestamps) and then buffer the HTTP request. 1754 1.3.2.5 skrll * If the intermediate device has the HTTP response cache, it 1755 1.3.2.5 skrll * will spoof the response but not bother timestamping its 1756 1.3.2.5 skrll * packets. So we can look for the presence of a timestamp in 1757 1.3.2.5 skrll * the first data packet and if there, require it in all future 1758 1.3.2.5 skrll * packets. 1759 1.3.2.5 skrll */ 1760 1.3.2.5 skrll 1761 1.3.2.5 skrll if (pd->p_len > 0 && (src->scrub->pfss_flags & PFSS_DATA_TS)) { 1762 1.3.2.5 skrll /* 1763 1.3.2.5 skrll * Hey! Someone tried to sneak a packet in. Or the 1764 1.3.2.5 skrll * stack changed its RFC1323 behavior?!?! 1765 1.3.2.5 skrll */ 1766 1.3.2.5 skrll if (pf_status.debug >= PF_DEBUG_MISC) { 1767 1.3.2.5 skrll DPFPRINTF(("Did not receive expected RFC1323 " 1768 1.3.2.5 skrll "timestamp\n")); 1769 1.3.2.5 skrll pf_print_state(state); 1770 1.3.2.5 skrll pf_print_flags(th->th_flags); 1771 1.3.2.5 skrll printf("\n"); 1772 1.3.2.5 skrll } 1773 1.3.2.5 skrll REASON_SET(reason, PFRES_TS); 1774 1.3.2.5 skrll return (PF_DROP); 1775 1.3.2.5 skrll } 1776 1.3.2.5 skrll } 1777 1.3.2.5 skrll 1778 1.3.2.5 skrll 1779 1.3.2.5 skrll /* 1780 1.3.2.5 skrll * We will note if a host sends his data packets with or without 1781 1.3.2.5 skrll * timestamps. And require all data packets to contain a timestamp 1782 1.3.2.5 skrll * if the first does. PAWS implicitly requires that all data packets be 1783 1.3.2.5 skrll * timestamped. But I think there are middle-man devices that hijack 1784 1.3.2.5 skrll * TCP streams immedietly after the 3whs and don't timestamp their 1785 1.3.2.5 skrll * packets (seen in a WWW accelerator or cache). 1786 1.3.2.5 skrll */ 1787 1.3.2.5 skrll if (pd->p_len > 0 && src->scrub && (src->scrub->pfss_flags & 1788 1.3.2.5 skrll (PFSS_TIMESTAMP|PFSS_DATA_TS|PFSS_DATA_NOTS)) == PFSS_TIMESTAMP) { 1789 1.3.2.5 skrll if (got_ts) 1790 1.3.2.5 skrll src->scrub->pfss_flags |= PFSS_DATA_TS; 1791 1.3.2.5 skrll else { 1792 1.3.2.5 skrll src->scrub->pfss_flags |= PFSS_DATA_NOTS; 1793 1.3.2.5 skrll if (pf_status.debug >= PF_DEBUG_MISC && dst->scrub && 1794 1.3.2.5 skrll (dst->scrub->pfss_flags & PFSS_TIMESTAMP)) { 1795 1.3.2.5 skrll /* Don't warn if other host rejected RFC1323 */ 1796 1.3.2.5 skrll DPFPRINTF(("Broken RFC1323 stack did not " 1797 1.3.2.5 skrll "timestamp data packet. Disabled PAWS " 1798 1.3.2.5 skrll "security.\n")); 1799 1.3.2.5 skrll pf_print_state(state); 1800 1.3.2.5 skrll pf_print_flags(th->th_flags); 1801 1.3.2.5 skrll printf("\n"); 1802 1.3.2.5 skrll } 1803 1.3.2.5 skrll } 1804 1.3.2.5 skrll } 1805 1.3.2.5 skrll 1806 1.3.2.5 skrll 1807 1.3.2.5 skrll /* 1808 1.3.2.5 skrll * Update PAWS values 1809 1.3.2.5 skrll */ 1810 1.3.2.5 skrll if (got_ts && src->scrub && PFSS_TIMESTAMP == (src->scrub->pfss_flags & 1811 1.3.2.5 skrll (PFSS_PAWS_IDLED|PFSS_TIMESTAMP))) { 1812 1.3.2.5 skrll getmicrouptime(&src->scrub->pfss_last); 1813 1.3.2.5 skrll if (SEQ_GEQ(tsval, src->scrub->pfss_tsval) || 1814 1.3.2.5 skrll (src->scrub->pfss_flags & PFSS_PAWS) == 0) 1815 1.3.2.5 skrll src->scrub->pfss_tsval = tsval; 1816 1.3.2.5 skrll 1817 1.3.2.5 skrll if (tsecr) { 1818 1.3.2.5 skrll if (SEQ_GEQ(tsecr, src->scrub->pfss_tsecr) || 1819 1.3.2.5 skrll (src->scrub->pfss_flags & PFSS_PAWS) == 0) 1820 1.3.2.5 skrll src->scrub->pfss_tsecr = tsecr; 1821 1.3.2.5 skrll 1822 1.3.2.5 skrll if ((src->scrub->pfss_flags & PFSS_PAWS) == 0 && 1823 1.3.2.5 skrll (SEQ_LT(tsval, src->scrub->pfss_tsval0) || 1824 1.3.2.5 skrll src->scrub->pfss_tsval0 == 0)) { 1825 1.3.2.5 skrll /* tsval0 MUST be the lowest timestamp */ 1826 1.3.2.5 skrll src->scrub->pfss_tsval0 = tsval; 1827 1.3.2.5 skrll } 1828 1.3.2.5 skrll 1829 1.3.2.5 skrll /* Only fully initialized after a TS gets echoed */ 1830 1.3.2.5 skrll if ((src->scrub->pfss_flags & PFSS_PAWS) == 0) 1831 1.3.2.5 skrll src->scrub->pfss_flags |= PFSS_PAWS; 1832 1.3.2.5 skrll } 1833 1.3.2.5 skrll } 1834 1.3.2.5 skrll 1835 1.3.2.2 skrll /* I have a dream.... TCP segment reassembly.... */ 1836 1.3.2.2 skrll return (0); 1837 1.3.2.2 skrll } 1838 1.3.2.5 skrll 1839 1.3.2.2 skrll int 1840 1.3.2.2 skrll pf_normalize_tcpopt(struct pf_rule *r, struct mbuf *m, struct tcphdr *th, 1841 1.3.2.2 skrll int off) 1842 1.3.2.2 skrll { 1843 1.3.2.2 skrll u_int16_t *mss; 1844 1.3.2.2 skrll int thoff; 1845 1.3.2.2 skrll int opt, cnt, optlen = 0; 1846 1.3.2.2 skrll int rewrite = 0; 1847 1.3.2.2 skrll u_char *optp; 1848 1.3.2.2 skrll 1849 1.3.2.2 skrll thoff = th->th_off << 2; 1850 1.3.2.2 skrll cnt = thoff - sizeof(struct tcphdr); 1851 1.3.2.2 skrll optp = mtod(m, caddr_t) + off + sizeof(struct tcphdr); 1852 1.3.2.2 skrll 1853 1.3.2.2 skrll for (; cnt > 0; cnt -= optlen, optp += optlen) { 1854 1.3.2.2 skrll opt = optp[0]; 1855 1.3.2.2 skrll if (opt == TCPOPT_EOL) 1856 1.3.2.2 skrll break; 1857 1.3.2.2 skrll if (opt == TCPOPT_NOP) 1858 1.3.2.2 skrll optlen = 1; 1859 1.3.2.2 skrll else { 1860 1.3.2.2 skrll if (cnt < 2) 1861 1.3.2.2 skrll break; 1862 1.3.2.2 skrll optlen = optp[1]; 1863 1.3.2.2 skrll if (optlen < 2 || optlen > cnt) 1864 1.3.2.2 skrll break; 1865 1.3.2.2 skrll } 1866 1.3.2.2 skrll switch (opt) { 1867 1.3.2.2 skrll case TCPOPT_MAXSEG: 1868 1.3.2.2 skrll mss = (u_int16_t *)(optp + 2); 1869 1.3.2.2 skrll if ((ntohs(*mss)) > r->max_mss) { 1870 1.3.2.2 skrll th->th_sum = pf_cksum_fixup(th->th_sum, 1871 1.3.2.5 skrll *mss, htons(r->max_mss), 0); 1872 1.3.2.2 skrll *mss = htons(r->max_mss); 1873 1.3.2.2 skrll rewrite = 1; 1874 1.3.2.2 skrll } 1875 1.3.2.2 skrll break; 1876 1.3.2.2 skrll default: 1877 1.3.2.2 skrll break; 1878 1.3.2.2 skrll } 1879 1.3.2.2 skrll } 1880 1.3.2.2 skrll 1881 1.3.2.2 skrll return (rewrite); 1882 1.3.2.2 skrll } 1883
Indexes created Sat Oct 18 21:09:54 GMT 2025