fil.c revision 1.1
1 /* $NetBSD: fil.c,v 1.1 2012/03/23 20:36:52 christos Exp $ */ 2 3 /* 4 * Copyright (C) 2012 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 * 8 * Copyright 2008 Sun Microsystems. 9 * 10 * Id 11 * 12 */ 13 #if defined(KERNEL) || defined(_KERNEL) 14 # undef KERNEL 15 # undef _KERNEL 16 # define KERNEL 1 17 # define _KERNEL 1 18 #endif 19 #include <sys/errno.h> 20 #include <sys/types.h> 21 #include <sys/param.h> 22 #include <sys/time.h> 23 #if defined(_KERNEL) && defined(__FreeBSD_version) && \ 24 (__FreeBSD_version >= 220000) 25 # if (__FreeBSD_version >= 400000) 26 # if !defined(IPFILTER_LKM) 27 # include "opt_inet6.h" 28 # endif 29 # if (__FreeBSD_version == 400019) 30 # define CSUM_DELAY_DATA 31 # endif 32 # endif 33 # include <sys/filio.h> 34 #else 35 # include <sys/ioctl.h> 36 #endif 37 #if (defined(__SVR4) || defined(__svr4__)) && defined(sun) 38 # include <sys/filio.h> 39 #endif 40 #if !defined(_AIX51) 41 # include <sys/fcntl.h> 42 #endif 43 #if defined(_KERNEL) 44 # include <sys/systm.h> 45 # include <sys/file.h> 46 #else 47 # include <stdio.h> 48 # include <string.h> 49 # include <stdlib.h> 50 # include <stddef.h> 51 # include <sys/file.h> 52 # define _KERNEL 53 # ifdef __OpenBSD__ 54 struct file; 55 # endif 56 # include <sys/uio.h> 57 # undef _KERNEL 58 #endif 59 #if !defined(__SVR4) && !defined(__svr4__) && !defined(__hpux) && \ 60 !defined(linux) 61 # include <sys/mbuf.h> 62 #else 63 # if !defined(linux) 64 # include <sys/byteorder.h> 65 # endif 66 # if (SOLARIS2 < 5) && defined(sun) 67 # include <sys/dditypes.h> 68 # endif 69 #endif 70 #ifdef __hpux 71 # define _NET_ROUTE_INCLUDED 72 #endif 73 #if !defined(linux) 74 # include <sys/protosw.h> 75 #endif 76 #include <sys/socket.h> 77 #include <net/if.h> 78 #ifdef sun 79 # include <net/af.h> 80 #endif 81 #include <netinet/in.h> 82 #include <netinet/in_systm.h> 83 #include <netinet/ip.h> 84 #if defined(__sgi) && defined(IFF_DRVRLOCK) /* IRIX 6 */ 85 # include <sys/hashing.h> 86 # include <netinet/in_var.h> 87 #endif 88 #include <netinet/tcp.h> 89 #if (!defined(__sgi) && !defined(AIX)) || defined(_KERNEL) 90 # include <netinet/udp.h> 91 # include <netinet/ip_icmp.h> 92 #endif 93 #ifdef __hpux 94 # undef _NET_ROUTE_INCLUDED 95 #endif 96 #ifdef __osf__ 97 # undef _RADIX_H_ 98 #endif 99 #include "netinet/ip_compat.h" 100 #ifdef USE_INET6 101 # include <netinet/icmp6.h> 102 # if !SOLARIS && defined(_KERNEL) && !defined(__osf__) && !defined(__hpux) 103 # include <netinet6/in6_var.h> 104 # endif 105 #endif 106 #include "netinet/ip_fil.h" 107 #include "netinet/ip_nat.h" 108 #include "netinet/ip_frag.h" 109 #include "netinet/ip_state.h" 110 #include "netinet/ip_proxy.h" 111 #include "netinet/ip_auth.h" 112 #ifdef IPFILTER_SCAN 113 # include "netinet/ip_scan.h" 114 #endif 115 #include "netinet/ip_sync.h" 116 #include "netinet/ip_lookup.h" 117 #include "netinet/ip_pool.h" 118 #include "netinet/ip_htable.h" 119 #ifdef IPFILTER_COMPILED 120 # include "netinet/ip_rules.h" 121 #endif 122 #if defined(IPFILTER_BPF) && defined(_KERNEL) 123 # include <net/bpf.h> 124 #endif 125 #if defined(__FreeBSD_version) && (__FreeBSD_version >= 300000) 126 # include <sys/malloc.h> 127 #endif 128 #include "netinet/ipl.h" 129 130 #if defined(__NetBSD__) && (__NetBSD_Version__ >= 104230000) 131 # include <sys/callout.h> 132 extern struct callout ipf_slowtimer_ch; 133 #endif 134 #if defined(__OpenBSD__) 135 # include <sys/timeout.h> 136 extern struct timeout ipf_slowtimer_ch; 137 #endif 138 /* END OF INCLUDES */ 139 140 #if !defined(lint) 141 static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed"; 142 static const char rcsid[] = "@(#)Id"; 143 #endif 144 145 #ifndef _KERNEL 146 # include "ipf.h" 147 # include "ipt.h" 148 extern int opts; 149 extern int blockreason; 150 #endif /* _KERNEL */ 151 152 #define LBUMP(x) softc->x++ 153 #define LBUMPD(x, y) do { softc->x.y++; DT(y); } while (0) 154 155 static INLINE int ipf_check_ipf __P((fr_info_t *, frentry_t *, int)); 156 static u_32_t ipf_checkcipso __P((fr_info_t *, u_char *, int)); 157 static u_32_t ipf_checkripso __P((u_char *)); 158 static u_32_t ipf_decaps __P((fr_info_t *, u_32_t, int)); 159 static frentry_t *ipf_dolog __P((fr_info_t *, u_32_t *)); 160 static int ipf_flushlist __P((ipf_main_softc_t *, int, minor_t, 161 int *, frentry_t **)); 162 static int ipf_flush_groups __P((ipf_main_softc_t *, 163 int, int, int)); 164 static ipfunc_t ipf_findfunc __P((ipfunc_t)); 165 static void *ipf_findlookup __P((ipf_main_softc_t *, int, 166 frentry_t *, 167 i6addr_t *, i6addr_t *)); 168 static frentry_t *ipf_firewall __P((fr_info_t *, u_32_t *)); 169 static int ipf_fr_matcharray __P((fr_info_t *, int *)); 170 static int ipf_frruleiter __P((ipf_main_softc_t *, void *, int, 171 void *)); 172 static void ipf_funcfini __P((ipf_main_softc_t *, frentry_t *));; 173 static int ipf_funcinit __P((ipf_main_softc_t *, frentry_t *)); 174 static int ipf_geniter __P((ipf_main_softc_t *, ipftoken_t *, 175 ipfgeniter_t *)); 176 static void ipf_getstat __P((ipf_main_softc_t *, 177 struct friostat *, int)); 178 static int ipf_grpmapfini __P((struct ipf_main_softc_s *, 179 frentry_t *)); 180 static int ipf_grpmapinit __P((struct ipf_main_softc_s *, 181 frentry_t *)); 182 static int ipf_portcheck __P((frpcmp_t *, u_32_t)); 183 static INLINE int ipf_pr_ah __P((fr_info_t *)); 184 static INLINE void ipf_pr_esp __P((fr_info_t *)); 185 static INLINE void ipf_pr_gre __P((fr_info_t *)); 186 static INLINE void ipf_pr_udp __P((fr_info_t *)); 187 static INLINE void ipf_pr_tcp __P((fr_info_t *)); 188 static INLINE void ipf_pr_icmp __P((fr_info_t *)); 189 static INLINE void ipf_pr_ipv4hdr __P((fr_info_t *)); 190 static INLINE void ipf_pr_short __P((fr_info_t *, int)); 191 static INLINE int ipf_pr_tcpcommon __P((fr_info_t *)); 192 static INLINE int ipf_pr_udpcommon __P((fr_info_t *)); 193 static void ipf_rule_delete __P((ipf_main_softc_t *, frentry_t *f, 194 int, int)); 195 static void ipf_rule_expire_insert __P((ipf_main_softc_t *, 196 frentry_t *, int)); 197 static int ipf_synclist __P((ipf_main_softc_t *, frentry_t *, 198 void *)); 199 static ipftuneable_t *ipf_tune_findbyname __P((ipftuneable_t *, 200 const char *)); 201 static ipftuneable_t *ipf_tune_findbycookie __P((ipftuneable_t **, void *, 202 void **)); 203 static void ipf_token_unlink __P((ipf_main_softc_t *, 204 ipftoken_t *)); 205 static int ipf_updateipid __P((fr_info_t *)); 206 static int ipf_settimeout __P((struct ipf_main_softc_s *, 207 struct ipftuneable *, 208 ipftuneval_t *)); 209 210 211 /* 212 * bit values for identifying presence of individual IP options 213 * All of these tables should be ordered by increasing key value on the left 214 * hand side to allow for binary searching of the array and include a trailer 215 * with a 0 for the bitmask for linear searches to easily find the end with. 216 */ 217 static const struct optlist ipopts[20] = { 218 { IPOPT_NOP, 0x000001 }, 219 { IPOPT_RR, 0x000002 }, 220 { IPOPT_ZSU, 0x000004 }, 221 { IPOPT_MTUP, 0x000008 }, 222 { IPOPT_MTUR, 0x000010 }, 223 { IPOPT_ENCODE, 0x000020 }, 224 { IPOPT_TS, 0x000040 }, 225 { IPOPT_TR, 0x000080 }, 226 { IPOPT_SECURITY, 0x000100 }, 227 { IPOPT_LSRR, 0x000200 }, 228 { IPOPT_E_SEC, 0x000400 }, 229 { IPOPT_CIPSO, 0x000800 }, 230 { IPOPT_SATID, 0x001000 }, 231 { IPOPT_SSRR, 0x002000 }, 232 { IPOPT_ADDEXT, 0x004000 }, 233 { IPOPT_VISA, 0x008000 }, 234 { IPOPT_IMITD, 0x010000 }, 235 { IPOPT_EIP, 0x020000 }, 236 { IPOPT_FINN, 0x040000 }, 237 { 0, 0x000000 } 238 }; 239 240 #ifdef USE_INET6 241 static struct optlist ip6exthdr[] = { 242 { IPPROTO_HOPOPTS, 0x000001 }, 243 { IPPROTO_IPV6, 0x000002 }, 244 { IPPROTO_ROUTING, 0x000004 }, 245 { IPPROTO_FRAGMENT, 0x000008 }, 246 { IPPROTO_ESP, 0x000010 }, 247 { IPPROTO_AH, 0x000020 }, 248 { IPPROTO_NONE, 0x000040 }, 249 { IPPROTO_DSTOPTS, 0x000080 }, 250 { IPPROTO_MOBILITY, 0x000100 }, 251 { 0, 0 } 252 }; 253 #endif 254 255 /* 256 * bit values for identifying presence of individual IP security options 257 */ 258 static const struct optlist secopt[8] = { 259 { IPSO_CLASS_RES4, 0x01 }, 260 { IPSO_CLASS_TOPS, 0x02 }, 261 { IPSO_CLASS_SECR, 0x04 }, 262 { IPSO_CLASS_RES3, 0x08 }, 263 { IPSO_CLASS_CONF, 0x10 }, 264 { IPSO_CLASS_UNCL, 0x20 }, 265 { IPSO_CLASS_RES2, 0x40 }, 266 { IPSO_CLASS_RES1, 0x80 } 267 }; 268 269 char ipfilter_version[] = IPL_VERSION; 270 271 int ipf_features = 0 272 #ifdef IPFILTER_LKM 273 | IPF_FEAT_LKM 274 #endif 275 #ifdef IPFILTER_LOG 276 | IPF_FEAT_LOG 277 #endif 278 | IPF_FEAT_LOOKUP 279 #ifdef IPFILTER_BPF 280 | IPF_FEAT_BPF 281 #endif 282 #ifdef IPFILTER_COMPILED 283 | IPF_FEAT_COMPILED 284 #endif 285 #ifdef IPFILTER_CKSUM 286 | IPF_FEAT_CKSUM 287 #endif 288 | IPF_FEAT_SYNC 289 #ifdef IPFILTER_SCAN 290 | IPF_FEAT_SCAN 291 #endif 292 #ifdef USE_INET6 293 | IPF_FEAT_IPV6 294 #endif 295 ; 296 297 298 /* 299 * Table of functions available for use with call rules. 300 */ 301 static ipfunc_resolve_t ipf_availfuncs[] = { 302 { "srcgrpmap", ipf_srcgrpmap, ipf_grpmapinit, ipf_grpmapfini }, 303 { "dstgrpmap", ipf_dstgrpmap, ipf_grpmapinit, ipf_grpmapfini }, 304 { "", NULL, NULL, NULL } 305 }; 306 307 static ipftuneable_t ipf_main_tuneables[] = { 308 { { (void *)offsetof(struct ipf_main_softc_s, ipf_flags) }, 309 "ipf_flags", 0, 0xffffffff, 310 stsizeof(ipf_main_softc_t, ipf_flags), 311 0, NULL, NULL }, 312 { { (void *)offsetof(struct ipf_main_softc_s, ipf_active) }, 313 "active", 0, 0, 314 stsizeof(ipf_main_softc_t, ipf_active), 315 IPFT_RDONLY, NULL, NULL }, 316 { { (void *)offsetof(ipf_main_softc_t, ipf_control_forwarding) }, 317 "control_forwarding", 0, 1, 318 stsizeof(ipf_main_softc_t, ipf_control_forwarding), 319 0, NULL, NULL }, 320 { { (void *)offsetof(ipf_main_softc_t, ipf_update_ipid) }, 321 "update_ipid", 0, 1, 322 stsizeof(ipf_main_softc_t, ipf_update_ipid), 323 0, NULL, NULL }, 324 { { (void *)offsetof(ipf_main_softc_t, ipf_chksrc) }, 325 "chksrc", 0, 1, 326 stsizeof(ipf_main_softc_t, ipf_chksrc), 327 0, NULL, NULL }, 328 { { (void *)offsetof(ipf_main_softc_t, ipf_minttl) }, 329 "min_ttl", 0, 1, 330 stsizeof(ipf_main_softc_t, ipf_minttl), 331 0, NULL, NULL }, 332 { { (void *)offsetof(ipf_main_softc_t, ipf_icmpminfragmtu) }, 333 "icmp_minfragmtu", 0, 1, 334 stsizeof(ipf_main_softc_t, ipf_icmpminfragmtu), 335 0, NULL, NULL }, 336 { { (void *)offsetof(ipf_main_softc_t, ipf_pass) }, 337 "default_pass", 0, 0xffffffff, 338 stsizeof(ipf_main_softc_t, ipf_pass), 339 0, NULL, NULL }, 340 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpidletimeout) }, 341 "tcp_idle_timeout", 1, 0x7fffffff, 342 stsizeof(ipf_main_softc_t, ipf_tcpidletimeout), 343 0, NULL, ipf_settimeout }, 344 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpclosewait) }, 345 "tcp_close_wait", 1, 0x7fffffff, 346 stsizeof(ipf_main_softc_t, ipf_tcpclosewait), 347 0, NULL, ipf_settimeout }, 348 { { (void *)offsetof(ipf_main_softc_t, ipf_tcplastack) }, 349 "tcp_last_ack", 1, 0x7fffffff, 350 stsizeof(ipf_main_softc_t, ipf_tcplastack), 351 0, NULL, ipf_settimeout }, 352 { { (void *)offsetof(ipf_main_softc_t, ipf_tcptimeout) }, 353 "tcp_timeout", 1, 0x7fffffff, 354 stsizeof(ipf_main_softc_t, ipf_tcptimeout), 355 0, NULL, ipf_settimeout }, 356 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpsynsent) }, 357 "tcp_syn_sent", 1, 0x7fffffff, 358 stsizeof(ipf_main_softc_t, ipf_tcpsynsent), 359 0, NULL, ipf_settimeout }, 360 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpsynrecv) }, 361 "tcp_syn_received", 1, 0x7fffffff, 362 stsizeof(ipf_main_softc_t, ipf_tcpsynrecv), 363 0, NULL, ipf_settimeout }, 364 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpclosed) }, 365 "tcp_closed", 1, 0x7fffffff, 366 stsizeof(ipf_main_softc_t, ipf_tcpclosed), 367 0, NULL, ipf_settimeout }, 368 { { (void *)offsetof(ipf_main_softc_t, ipf_tcphalfclosed) }, 369 "tcp_half_closed", 1, 0x7fffffff, 370 stsizeof(ipf_main_softc_t, ipf_tcphalfclosed), 371 0, NULL, ipf_settimeout }, 372 { { (void *)offsetof(ipf_main_softc_t, ipf_tcptimewait) }, 373 "tcp_time_wait", 1, 0x7fffffff, 374 stsizeof(ipf_main_softc_t, ipf_tcptimewait), 375 0, NULL, ipf_settimeout }, 376 { { (void *)offsetof(ipf_main_softc_t, ipf_udptimeout) }, 377 "udp_timeout", 1, 0x7fffffff, 378 stsizeof(ipf_main_softc_t, ipf_udptimeout), 379 0, NULL, ipf_settimeout }, 380 { { (void *)offsetof(ipf_main_softc_t, ipf_udpacktimeout) }, 381 "udp_ack_timeout", 1, 0x7fffffff, 382 stsizeof(ipf_main_softc_t, ipf_udpacktimeout), 383 0, NULL, ipf_settimeout }, 384 { { (void *)offsetof(ipf_main_softc_t, ipf_icmptimeout) }, 385 "icmp_timeout", 1, 0x7fffffff, 386 stsizeof(ipf_main_softc_t, ipf_icmptimeout), 387 0, NULL, ipf_settimeout }, 388 { { (void *)offsetof(ipf_main_softc_t, ipf_icmpacktimeout) }, 389 "icmp_ack_timeout", 1, 0x7fffffff, 390 stsizeof(ipf_main_softc_t, ipf_icmpacktimeout), 391 0, NULL, ipf_settimeout }, 392 { { (void *)offsetof(ipf_main_softc_t, ipf_iptimeout) }, 393 "ip_timeout", 1, 0x7fffffff, 394 stsizeof(ipf_main_softc_t, ipf_iptimeout), 395 0, NULL, ipf_settimeout }, 396 #if defined(INSTANCES) && defined(_KERNEL) 397 { { (void *)offsetof(ipf_main_softc_t, ipf_get_loopback) }, 398 "intercept_loopback", 0, 1, 399 stsizeof(ipf_main_softc_t, ipf_get_loopback), 400 0, NULL, ipf_set_loopback }, 401 #endif 402 { { 0 }, 403 NULL, 0, 0, 404 0, 405 0, NULL, NULL } 406 }; 407 408 409 /* 410 * The next section of code is a a collection of small routines that set 411 * fields in the fr_info_t structure passed based on properties of the 412 * current packet. There are different routines for the same protocol 413 * for each of IPv4 and IPv6. Adding a new protocol, for which there 414 * will "special" inspection for setup, is now more easily done by adding 415 * a new routine and expanding the ipf_pr_ipinit*() function rather than by 416 * adding more code to a growing switch statement. 417 */ 418 #ifdef USE_INET6 419 static INLINE int ipf_pr_ah6 __P((fr_info_t *)); 420 static INLINE void ipf_pr_esp6 __P((fr_info_t *)); 421 static INLINE void ipf_pr_gre6 __P((fr_info_t *)); 422 static INLINE void ipf_pr_udp6 __P((fr_info_t *)); 423 static INLINE void ipf_pr_tcp6 __P((fr_info_t *)); 424 static INLINE void ipf_pr_icmp6 __P((fr_info_t *)); 425 static INLINE void ipf_pr_ipv6hdr __P((fr_info_t *)); 426 static INLINE void ipf_pr_short6 __P((fr_info_t *, int)); 427 static INLINE int ipf_pr_hopopts6 __P((fr_info_t *)); 428 static INLINE int ipf_pr_mobility6 __P((fr_info_t *)); 429 static INLINE int ipf_pr_routing6 __P((fr_info_t *)); 430 static INLINE int ipf_pr_dstopts6 __P((fr_info_t *)); 431 static INLINE int ipf_pr_fragment6 __P((fr_info_t *)); 432 static INLINE struct ip6_ext *ipf_pr_ipv6exthdr __P((fr_info_t *, int, int)); 433 434 435 /* ------------------------------------------------------------------------ */ 436 /* Function: ipf_pr_short6 */ 437 /* Returns: void */ 438 /* Parameters: fin(I) - pointer to packet information */ 439 /* xmin(I) - minimum header size */ 440 /* */ 441 /* IPv6 Only */ 442 /* This is function enforces the 'is a packet too short to be legit' rule */ 443 /* for IPv6 and marks the packet with FI_SHORT if so. See function comment */ 444 /* for ipf_pr_short() for more details. */ 445 /* ------------------------------------------------------------------------ */ 446 static INLINE void 447 ipf_pr_short6(fin, xmin) 448 fr_info_t *fin; 449 int xmin; 450 { 451 452 if (fin->fin_dlen < xmin) 453 fin->fin_flx |= FI_SHORT; 454 } 455 456 457 /* ------------------------------------------------------------------------ */ 458 /* Function: ipf_pr_ipv6hdr */ 459 /* Returns: void */ 460 /* Parameters: fin(I) - pointer to packet information */ 461 /* */ 462 /* IPv6 Only */ 463 /* Copy values from the IPv6 header into the fr_info_t struct and call the */ 464 /* per-protocol analyzer if it exists. In validating the packet, a protocol*/ 465 /* analyzer may pullup or free the packet itself so we need to be vigiliant */ 466 /* of that possibility arising. */ 467 /* ------------------------------------------------------------------------ */ 468 static INLINE void 469 ipf_pr_ipv6hdr(fin) 470 fr_info_t *fin; 471 { 472 ip6_t *ip6 = (ip6_t *)fin->fin_ip; 473 int p, go = 1, i, hdrcount; 474 fr_ip_t *fi = &fin->fin_fi; 475 476 fin->fin_off = 0; 477 478 fi->fi_tos = 0; 479 fi->fi_optmsk = 0; 480 fi->fi_secmsk = 0; 481 fi->fi_auth = 0; 482 483 p = ip6->ip6_nxt; 484 fin->fin_crc = p; 485 fi->fi_ttl = ip6->ip6_hlim; 486 fi->fi_src.in6 = ip6->ip6_src; 487 fin->fin_crc += fi->fi_src.i6[0]; 488 fin->fin_crc += fi->fi_src.i6[1]; 489 fin->fin_crc += fi->fi_src.i6[2]; 490 fin->fin_crc += fi->fi_src.i6[3]; 491 fi->fi_dst.in6 = ip6->ip6_dst; 492 fin->fin_crc += fi->fi_dst.i6[0]; 493 fin->fin_crc += fi->fi_dst.i6[1]; 494 fin->fin_crc += fi->fi_dst.i6[2]; 495 fin->fin_crc += fi->fi_dst.i6[3]; 496 fin->fin_id = 0; 497 if (IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6)) 498 fin->fin_flx |= FI_MULTICAST|FI_MBCAST; 499 500 hdrcount = 0; 501 while (go && !(fin->fin_flx & FI_SHORT)) { 502 switch (p) 503 { 504 case IPPROTO_UDP : 505 ipf_pr_udp6(fin); 506 go = 0; 507 break; 508 509 case IPPROTO_TCP : 510 ipf_pr_tcp6(fin); 511 go = 0; 512 break; 513 514 case IPPROTO_ICMPV6 : 515 ipf_pr_icmp6(fin); 516 go = 0; 517 break; 518 519 case IPPROTO_GRE : 520 ipf_pr_gre6(fin); 521 go = 0; 522 break; 523 524 case IPPROTO_HOPOPTS : 525 p = ipf_pr_hopopts6(fin); 526 break; 527 528 case IPPROTO_MOBILITY : 529 p = ipf_pr_mobility6(fin); 530 break; 531 532 case IPPROTO_DSTOPTS : 533 p = ipf_pr_dstopts6(fin); 534 break; 535 536 case IPPROTO_ROUTING : 537 p = ipf_pr_routing6(fin); 538 break; 539 540 case IPPROTO_AH : 541 p = ipf_pr_ah6(fin); 542 break; 543 544 case IPPROTO_ESP : 545 ipf_pr_esp6(fin); 546 go = 0; 547 break; 548 549 case IPPROTO_IPV6 : 550 for (i = 0; ip6exthdr[i].ol_bit != 0; i++) 551 if (ip6exthdr[i].ol_val == p) { 552 fin->fin_flx |= ip6exthdr[i].ol_bit; 553 break; 554 } 555 go = 0; 556 break; 557 558 case IPPROTO_NONE : 559 go = 0; 560 break; 561 562 case IPPROTO_FRAGMENT : 563 p = ipf_pr_fragment6(fin); 564 /* 565 * Given that the only fragments we want to let through 566 * (where fin_off != 0) are those where the non-first 567 * fragments only have data, we can safely stop looking 568 * at headers if this is a non-leading fragment. 569 */ 570 if (fin->fin_off != 0) 571 go = 0; 572 break; 573 574 default : 575 go = 0; 576 break; 577 } 578 hdrcount++; 579 580 /* 581 * It is important to note that at this point, for the 582 * extension headers (go != 0), the entire header may not have 583 * been pulled up when the code gets to this point. This is 584 * only done for "go != 0" because the other header handlers 585 * will all pullup their complete header. The other indicator 586 * of an incomplete packet is that this was just an extension 587 * header. 588 */ 589 if ((go != 0) && (p != IPPROTO_NONE) && 590 (ipf_pr_pullup(fin, 0) == -1)) { 591 p = IPPROTO_NONE; 592 break; 593 } 594 } 595 596 /* 597 * Some of the above functions, like ipf_pr_esp6(), can call ipf_pullup 598 * and destroy whatever packet was here. The caller of this function 599 * expects us to return if there is a problem with ipf_pullup. 600 */ 601 if (fin->fin_m == NULL) { 602 ipf_main_softc_t *softc = fin->fin_main_soft; 603 604 LBUMPD(ipf_stats[fin->fin_out], fr_v6_bad); 605 return; 606 } 607 608 fi->fi_p = p; 609 610 /* 611 * IPv6 fragment case 1 - see comment for ipf_pr_fragment6(). 612 * "go != 0" imples the above loop hasn't arrived at a layer 4 header. 613 */ 614 if ((go != 0) && (fin->fin_flx & FI_FRAG) && (fin->fin_off == 0)) { 615 ipf_main_softc_t *softc = fin->fin_main_soft; 616 617 fin->fin_flx |= FI_BAD; 618 LBUMPD(ipf_stats[fin->fin_out], fr_v6_badfrag); 619 LBUMP(ipf_stats[fin->fin_out].fr_v6_bad); 620 } 621 } 622 623 624 /* ------------------------------------------------------------------------ */ 625 /* Function: ipf_pr_ipv6exthdr */ 626 /* Returns: struct ip6_ext * - pointer to the start of the next header */ 627 /* or NULL if there is a prolblem. */ 628 /* Parameters: fin(I) - pointer to packet information */ 629 /* multiple(I) - flag indicating yes/no if multiple occurances */ 630 /* of this extension header are allowed. */ 631 /* proto(I) - protocol number for this extension header */ 632 /* */ 633 /* IPv6 Only */ 634 /* This function embodies a number of common checks that all IPv6 extension */ 635 /* headers must be subjected to. For example, making sure the packet is */ 636 /* big enough for it to be in, checking if it is repeated and setting a */ 637 /* flag to indicate its presence. */ 638 /* ------------------------------------------------------------------------ */ 639 static INLINE struct ip6_ext * 640 ipf_pr_ipv6exthdr(fin, multiple, proto) 641 fr_info_t *fin; 642 int multiple, proto; 643 { 644 ipf_main_softc_t *softc = fin->fin_main_soft; 645 struct ip6_ext *hdr; 646 u_short shift; 647 int i; 648 649 fin->fin_flx |= FI_V6EXTHDR; 650 651 /* 8 is default length of extension hdr */ 652 if ((fin->fin_dlen - 8) < 0) { 653 fin->fin_flx |= FI_SHORT; 654 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_short); 655 return NULL; 656 } 657 658 if (ipf_pr_pullup(fin, 8) == -1) { 659 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_pullup); 660 return NULL; 661 } 662 663 hdr = fin->fin_dp; 664 switch (proto) 665 { 666 case IPPROTO_FRAGMENT : 667 shift = 8; 668 break; 669 default : 670 shift = 8 + (hdr->ip6e_len << 3); 671 break; 672 } 673 674 if (shift > fin->fin_dlen) { /* Nasty extension header length? */ 675 fin->fin_flx |= FI_BAD; 676 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_hlen); 677 return NULL; 678 } 679 680 fin->fin_dp = (char *)fin->fin_dp + shift; 681 fin->fin_dlen -= shift; 682 683 /* 684 * If we have seen a fragment header, do not set any flags to indicate 685 * the presence of this extension header as it has no impact on the 686 * end result until after it has been defragmented. 687 */ 688 if (fin->fin_flx & FI_FRAG) 689 return hdr; 690 691 for (i = 0; ip6exthdr[i].ol_bit != 0; i++) 692 if (ip6exthdr[i].ol_val == proto) { 693 /* 694 * Most IPv6 extension headers are only allowed once. 695 */ 696 if ((multiple == 0) && 697 ((fin->fin_optmsk & ip6exthdr[i].ol_bit) != 0)) 698 fin->fin_flx |= FI_BAD; 699 else 700 fin->fin_optmsk |= ip6exthdr[i].ol_bit; 701 break; 702 } 703 704 return hdr; 705 } 706 707 708 /* ------------------------------------------------------------------------ */ 709 /* Function: ipf_pr_hopopts6 */ 710 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 711 /* Parameters: fin(I) - pointer to packet information */ 712 /* */ 713 /* IPv6 Only */ 714 /* This is function checks pending hop by hop options extension header */ 715 /* ------------------------------------------------------------------------ */ 716 static INLINE int 717 ipf_pr_hopopts6(fin) 718 fr_info_t *fin; 719 { 720 struct ip6_ext *hdr; 721 722 hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_HOPOPTS); 723 if (hdr == NULL) 724 return IPPROTO_NONE; 725 return hdr->ip6e_nxt; 726 } 727 728 729 /* ------------------------------------------------------------------------ */ 730 /* Function: ipf_pr_mobility6 */ 731 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 732 /* Parameters: fin(I) - pointer to packet information */ 733 /* */ 734 /* IPv6 Only */ 735 /* This is function checks the IPv6 mobility extension header */ 736 /* ------------------------------------------------------------------------ */ 737 static INLINE int 738 ipf_pr_mobility6(fin) 739 fr_info_t *fin; 740 { 741 struct ip6_ext *hdr; 742 743 hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_MOBILITY); 744 if (hdr == NULL) 745 return IPPROTO_NONE; 746 return hdr->ip6e_nxt; 747 } 748 749 750 /* ------------------------------------------------------------------------ */ 751 /* Function: ipf_pr_routing6 */ 752 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 753 /* Parameters: fin(I) - pointer to packet information */ 754 /* */ 755 /* IPv6 Only */ 756 /* This is function checks pending routing extension header */ 757 /* ------------------------------------------------------------------------ */ 758 static INLINE int 759 ipf_pr_routing6(fin) 760 fr_info_t *fin; 761 { 762 struct ip6_routing *hdr; 763 764 hdr = (struct ip6_routing *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_ROUTING); 765 if (hdr == NULL) 766 return IPPROTO_NONE; 767 768 switch (hdr->ip6r_type) 769 { 770 case 0 : 771 /* 772 * Nasty extension header length? 773 */ 774 if (((hdr->ip6r_len >> 1) < hdr->ip6r_segleft) || 775 (hdr->ip6r_segleft && (hdr->ip6r_len & 1))) { 776 ipf_main_softc_t *softc = fin->fin_main_soft; 777 778 fin->fin_flx |= FI_BAD; 779 LBUMPD(ipf_stats[fin->fin_out], fr_v6_rh_bad); 780 return IPPROTO_NONE; 781 } 782 break; 783 784 default : 785 break; 786 } 787 788 return hdr->ip6r_nxt; 789 } 790 791 792 /* ------------------------------------------------------------------------ */ 793 /* Function: ipf_pr_fragment6 */ 794 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 795 /* Parameters: fin(I) - pointer to packet information */ 796 /* */ 797 /* IPv6 Only */ 798 /* Examine the IPv6 fragment header and extract fragment offset information.*/ 799 /* */ 800 /* Fragments in IPv6 are extraordinarily difficult to deal with - much more */ 801 /* so than in IPv4. There are 5 cases of fragments with IPv6 that all */ 802 /* packets with a fragment header can fit into. They are as follows: */ 803 /* */ 804 /* 1. [IPv6][0-n EH][FH][0-n EH] (no L4HDR present) */ 805 /* 2. [IPV6][0-n EH][FH][0-n EH][L4HDR part] (short) */ 806 /* 3. [IPV6][0-n EH][FH][L4HDR part][0-n data] (short) */ 807 /* 4. [IPV6][0-n EH][FH][0-n EH][L4HDR][0-n data] */ 808 /* 5. [IPV6][0-n EH][FH][data] */ 809 /* */ 810 /* IPV6 = IPv6 header, FH = Fragment Header, */ 811 /* 0-n EH = 0 or more extension headers, 0-n data = 0 or more bytes of data */ 812 /* */ 813 /* Packets that match 1, 2, 3 will be dropped as the only reasonable */ 814 /* scenario in which they happen is in extreme circumstances that are most */ 815 /* likely to be an indication of an attack rather than normal traffic. */ 816 /* A type 3 packet may be sent by an attacked after a type 4 packet. There */ 817 /* are two rules that can be used to guard against type 3 packets: L4 */ 818 /* headers must always be in a packet that has the offset field set to 0 */ 819 /* and no packet is allowed to overlay that where offset = 0. */ 820 /* ------------------------------------------------------------------------ */ 821 static INLINE int 822 ipf_pr_fragment6(fin) 823 fr_info_t *fin; 824 { 825 ipf_main_softc_t *softc = fin->fin_main_soft; 826 struct ip6_frag *frag; 827 828 fin->fin_flx |= FI_FRAG; 829 830 frag = (struct ip6_frag *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_FRAGMENT); 831 if (frag == NULL) { 832 LBUMPD(ipf_stats[fin->fin_out], fr_v6_frag_bad); 833 return IPPROTO_NONE; 834 } 835 836 if ((frag->ip6f_offlg & IP6F_MORE_FRAG) != 0) { 837 /* 838 * Any fragment that isn't the last fragment must have its 839 * length as a multiple of 8. 840 */ 841 if ((fin->fin_plen & 7) != 0) 842 fin->fin_flx |= FI_BAD; 843 } 844 845 fin->fin_fraghdr = frag; 846 fin->fin_id = frag->ip6f_ident; 847 fin->fin_off = ntohs(frag->ip6f_offlg & IP6F_OFF_MASK); 848 if (fin->fin_off != 0) 849 fin->fin_flx |= FI_FRAGBODY; 850 851 /* 852 * Jumbograms aren't handled, so the max. length is 64k 853 */ 854 if ((fin->fin_off << 3) + fin->fin_dlen > 65535) 855 fin->fin_flx |= FI_BAD; 856 857 /* 858 * We don't know where the transport layer header (or whatever is next 859 * is), as it could be behind destination options (amongst others) so 860 * return the fragment header as the type of packet this is. Note that 861 * this effectively disables the fragment cache for > 1 protocol at a 862 * time. 863 */ 864 return frag->ip6f_nxt; 865 } 866 867 868 /* ------------------------------------------------------------------------ */ 869 /* Function: ipf_pr_dstopts6 */ 870 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 871 /* Parameters: fin(I) - pointer to packet information */ 872 /* */ 873 /* IPv6 Only */ 874 /* This is function checks pending destination options extension header */ 875 /* ------------------------------------------------------------------------ */ 876 static INLINE int 877 ipf_pr_dstopts6(fin) 878 fr_info_t *fin; 879 { 880 ipf_main_softc_t *softc = fin->fin_main_soft; 881 struct ip6_ext *hdr; 882 883 hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_DSTOPTS); 884 if (hdr == NULL) { 885 LBUMPD(ipf_stats[fin->fin_out], fr_v6_dst_bad); 886 return IPPROTO_NONE; 887 } 888 return hdr->ip6e_nxt; 889 } 890 891 892 /* ------------------------------------------------------------------------ */ 893 /* Function: ipf_pr_icmp6 */ 894 /* Returns: void */ 895 /* Parameters: fin(I) - pointer to packet information */ 896 /* */ 897 /* IPv6 Only */ 898 /* This routine is mainly concerned with determining the minimum valid size */ 899 /* for an ICMPv6 packet. */ 900 /* ------------------------------------------------------------------------ */ 901 static INLINE void 902 ipf_pr_icmp6(fin) 903 fr_info_t *fin; 904 { 905 int minicmpsz = sizeof(struct icmp6_hdr); 906 struct icmp6_hdr *icmp6; 907 908 if (ipf_pr_pullup(fin, ICMP6ERR_MINPKTLEN - sizeof(ip6_t)) == -1) { 909 ipf_main_softc_t *softc = fin->fin_main_soft; 910 911 LBUMPD(ipf_stats[fin->fin_out], fr_v6_icmp6_pullup); 912 return; 913 } 914 915 if (fin->fin_dlen > 1) { 916 ip6_t *ip6; 917 918 icmp6 = fin->fin_dp; 919 920 fin->fin_data[0] = *(u_short *)icmp6; 921 922 if ((icmp6->icmp6_type & ICMP6_INFOMSG_MASK) != 0) 923 fin->fin_flx |= FI_ICMPQUERY; 924 925 switch (icmp6->icmp6_type) 926 { 927 case ICMP6_ECHO_REPLY : 928 case ICMP6_ECHO_REQUEST : 929 if (fin->fin_dlen >= 6) 930 fin->fin_data[1] = icmp6->icmp6_id; 931 minicmpsz = ICMP6ERR_MINPKTLEN - sizeof(ip6_t); 932 break; 933 934 case ICMP6_DST_UNREACH : 935 case ICMP6_PACKET_TOO_BIG : 936 case ICMP6_TIME_EXCEEDED : 937 case ICMP6_PARAM_PROB : 938 fin->fin_flx |= FI_ICMPERR; 939 minicmpsz = ICMP6ERR_IPICMPHLEN - sizeof(ip6_t); 940 if (fin->fin_plen < ICMP6ERR_IPICMPHLEN) 941 break; 942 943 if (M_LEN(fin->fin_m) < fin->fin_plen) { 944 if (ipf_coalesce(fin) != 1) 945 return; 946 } 947 948 if (ipf_pr_pullup(fin, ICMP6ERR_MINPKTLEN) == -1) 949 return; 950 951 /* 952 * If the destination of this packet doesn't match the 953 * source of the original packet then this packet is 954 * not correct. 955 */ 956 icmp6 = fin->fin_dp; 957 ip6 = (ip6_t *)((char *)icmp6 + ICMPERR_ICMPHLEN); 958 if (IP6_NEQ(&fin->fin_fi.fi_dst, 959 (i6addr_t *)&ip6->ip6_src)) 960 fin->fin_flx |= FI_BAD; 961 break; 962 default : 963 break; 964 } 965 } 966 967 ipf_pr_short6(fin, minicmpsz); 968 } 969 970 971 /* ------------------------------------------------------------------------ */ 972 /* Function: ipf_pr_udp6 */ 973 /* Returns: void */ 974 /* Parameters: fin(I) - pointer to packet information */ 975 /* */ 976 /* IPv6 Only */ 977 /* Analyse the packet for IPv6/UDP properties. */ 978 /* Is not expected to be called for fragmented packets. */ 979 /* ------------------------------------------------------------------------ */ 980 static INLINE void 981 ipf_pr_udp6(fin) 982 fr_info_t *fin; 983 { 984 985 if (ipf_pr_udpcommon(fin) == 0) { 986 u_char p = fin->fin_p; 987 988 fin->fin_p = IPPROTO_UDP; 989 ipf_checkv6sum(fin); 990 fin->fin_p = p; 991 } 992 } 993 994 995 /* ------------------------------------------------------------------------ */ 996 /* Function: ipf_pr_tcp6 */ 997 /* Returns: void */ 998 /* Parameters: fin(I) - pointer to packet information */ 999 /* */ 1000 /* IPv6 Only */ 1001 /* Analyse the packet for IPv6/TCP properties. */ 1002 /* Is not expected to be called for fragmented packets. */ 1003 /* ------------------------------------------------------------------------ */ 1004 static INLINE void 1005 ipf_pr_tcp6(fin) 1006 fr_info_t *fin; 1007 { 1008 1009 if (ipf_pr_tcpcommon(fin) == 0) { 1010 u_char p = fin->fin_p; 1011 1012 fin->fin_p = IPPROTO_UDP; 1013 ipf_checkv6sum(fin); 1014 fin->fin_p = p; 1015 } 1016 } 1017 1018 1019 /* ------------------------------------------------------------------------ */ 1020 /* Function: ipf_pr_esp6 */ 1021 /* Returns: void */ 1022 /* Parameters: fin(I) - pointer to packet information */ 1023 /* */ 1024 /* IPv6 Only */ 1025 /* Analyse the packet for ESP properties. */ 1026 /* The minimum length is taken to be the SPI (32bits) plus a tail (32bits) */ 1027 /* even though the newer ESP packets must also have a sequence number that */ 1028 /* is 32bits as well, it is not possible(?) to determine the version from a */ 1029 /* simple packet header. */ 1030 /* ------------------------------------------------------------------------ */ 1031 static INLINE void 1032 ipf_pr_esp6(fin) 1033 fr_info_t *fin; 1034 { 1035 1036 if ((fin->fin_off == 0) && (ipf_pr_pullup(fin, 8) == -1)) { 1037 ipf_main_softc_t *softc = fin->fin_main_soft; 1038 1039 LBUMPD(ipf_stats[fin->fin_out], fr_v6_esp_pullup); 1040 return; 1041 } 1042 } 1043 1044 1045 /* ------------------------------------------------------------------------ */ 1046 /* Function: ipf_pr_ah6 */ 1047 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 1048 /* Parameters: fin(I) - pointer to packet information */ 1049 /* */ 1050 /* IPv6 Only */ 1051 /* Analyse the packet for AH properties. */ 1052 /* The minimum length is taken to be the combination of all fields in the */ 1053 /* header being present and no authentication data (null algorithm used.) */ 1054 /* ------------------------------------------------------------------------ */ 1055 static INLINE int 1056 ipf_pr_ah6(fin) 1057 fr_info_t *fin; 1058 { 1059 authhdr_t *ah; 1060 1061 fin->fin_flx |= FI_AH; 1062 1063 ah = (authhdr_t *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_HOPOPTS); 1064 if (ah == NULL) { 1065 ipf_main_softc_t *softc = fin->fin_main_soft; 1066 1067 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ah_bad); 1068 return IPPROTO_NONE; 1069 } 1070 1071 ipf_pr_short6(fin, sizeof(*ah)); 1072 1073 /* 1074 * No need for another pullup, ipf_pr_ipv6exthdr() will pullup 1075 * enough data to satisfy ah_next (the very first one.) 1076 */ 1077 return ah->ah_next; 1078 } 1079 1080 1081 /* ------------------------------------------------------------------------ */ 1082 /* Function: ipf_pr_gre6 */ 1083 /* Returns: void */ 1084 /* Parameters: fin(I) - pointer to packet information */ 1085 /* */ 1086 /* Analyse the packet for GRE properties. */ 1087 /* ------------------------------------------------------------------------ */ 1088 static INLINE void 1089 ipf_pr_gre6(fin) 1090 fr_info_t *fin; 1091 { 1092 grehdr_t *gre; 1093 1094 if (ipf_pr_pullup(fin, sizeof(grehdr_t)) == -1) { 1095 ipf_main_softc_t *softc = fin->fin_main_soft; 1096 1097 LBUMPD(ipf_stats[fin->fin_out], fr_v6_gre_pullup); 1098 return; 1099 } 1100 1101 gre = fin->fin_dp; 1102 if (GRE_REV(gre->gr_flags) == 1) 1103 fin->fin_data[0] = gre->gr_call; 1104 } 1105 #endif /* USE_INET6 */ 1106 1107 1108 /* ------------------------------------------------------------------------ */ 1109 /* Function: ipf_pr_pullup */ 1110 /* Returns: int - 0 == pullup succeeded, -1 == failure */ 1111 /* Parameters: fin(I) - pointer to packet information */ 1112 /* plen(I) - length (excluding L3 header) to pullup */ 1113 /* */ 1114 /* Short inline function to cut down on code duplication to perform a call */ 1115 /* to ipf_pullup to ensure there is the required amount of data, */ 1116 /* consecutively in the packet buffer. */ 1117 /* */ 1118 /* This function pulls up 'extra' data at the location of fin_dp. fin_dp */ 1119 /* points to the first byte after the complete layer 3 header, which will */ 1120 /* include all of the known extension headers for IPv6 or options for IPv4. */ 1121 /* */ 1122 /* Since fr_pullup() expects the total length of bytes to be pulled up, it */ 1123 /* is necessary to add those we can already assume to be pulled up (fin_dp */ 1124 /* - fin_ip) to what is passed through. */ 1125 /* ------------------------------------------------------------------------ */ 1126 int 1127 ipf_pr_pullup(fin, plen) 1128 fr_info_t *fin; 1129 int plen; 1130 { 1131 ipf_main_softc_t *softc = fin->fin_main_soft; 1132 1133 if (fin->fin_m != NULL) { 1134 if (fin->fin_dp != NULL) 1135 plen += (char *)fin->fin_dp - 1136 ((char *)fin->fin_ip + fin->fin_hlen); 1137 plen += fin->fin_hlen; 1138 if (M_LEN(fin->fin_m) < plen) { 1139 #if defined(_KERNEL) 1140 if (ipf_pullup(fin->fin_m, fin, plen) == NULL) { 1141 DT(ipf_pullup_fail); 1142 LBUMP(ipf_stats[fin->fin_out].fr_pull[1]); 1143 return -1; 1144 } 1145 LBUMP(ipf_stats[fin->fin_out].fr_pull[0]); 1146 #else 1147 LBUMP(ipf_stats[fin->fin_out].fr_pull[1]); 1148 /* 1149 * Fake ipf_pullup failing 1150 */ 1151 fin->fin_reason = FRB_PULLUP; 1152 *fin->fin_mp = NULL; 1153 fin->fin_m = NULL; 1154 fin->fin_ip = NULL; 1155 return -1; 1156 #endif 1157 } 1158 } 1159 return 0; 1160 } 1161 1162 1163 /* ------------------------------------------------------------------------ */ 1164 /* Function: ipf_pr_short */ 1165 /* Returns: void */ 1166 /* Parameters: fin(I) - pointer to packet information */ 1167 /* xmin(I) - minimum header size */ 1168 /* */ 1169 /* Check if a packet is "short" as defined by xmin. The rule we are */ 1170 /* applying here is that the packet must not be fragmented within the layer */ 1171 /* 4 header. That is, it must not be a fragment that has its offset set to */ 1172 /* start within the layer 4 header (hdrmin) or if it is at offset 0, the */ 1173 /* entire layer 4 header must be present (min). */ 1174 /* ------------------------------------------------------------------------ */ 1175 static INLINE void 1176 ipf_pr_short(fin, xmin) 1177 fr_info_t *fin; 1178 int xmin; 1179 { 1180 1181 if (fin->fin_off == 0) { 1182 if (fin->fin_dlen < xmin) 1183 fin->fin_flx |= FI_SHORT; 1184 } else if (fin->fin_off < xmin) { 1185 fin->fin_flx |= FI_SHORT; 1186 } 1187 } 1188 1189 1190 /* ------------------------------------------------------------------------ */ 1191 /* Function: ipf_pr_icmp */ 1192 /* Returns: void */ 1193 /* Parameters: fin(I) - pointer to packet information */ 1194 /* */ 1195 /* IPv4 Only */ 1196 /* Do a sanity check on the packet for ICMP (v4). In nearly all cases, */ 1197 /* except extrememly bad packets, both type and code will be present. */ 1198 /* The expected minimum size of an ICMP packet is very much dependent on */ 1199 /* the type of it. */ 1200 /* */ 1201 /* XXX - other ICMP sanity checks? */ 1202 /* ------------------------------------------------------------------------ */ 1203 static INLINE void 1204 ipf_pr_icmp(fin) 1205 fr_info_t *fin; 1206 { 1207 ipf_main_softc_t *softc = fin->fin_main_soft; 1208 int minicmpsz = sizeof(struct icmp); 1209 icmphdr_t *icmp; 1210 ip_t *oip; 1211 1212 ipf_pr_short(fin, ICMPERR_ICMPHLEN); 1213 1214 if (fin->fin_off != 0) { 1215 LBUMPD(ipf_stats[fin->fin_out], fr_v4_icmp_frag); 1216 return; 1217 } 1218 1219 if (ipf_pr_pullup(fin, ICMPERR_ICMPHLEN) == -1) { 1220 LBUMPD(ipf_stats[fin->fin_out], fr_v4_icmp_pullup); 1221 return; 1222 } 1223 1224 icmp = fin->fin_dp; 1225 1226 fin->fin_data[0] = *(u_short *)icmp; 1227 fin->fin_data[1] = icmp->icmp_id; 1228 1229 switch (icmp->icmp_type) 1230 { 1231 case ICMP_ECHOREPLY : 1232 case ICMP_ECHO : 1233 /* Router discovery messaes - RFC 1256 */ 1234 case ICMP_ROUTERADVERT : 1235 case ICMP_ROUTERSOLICIT : 1236 fin->fin_flx |= FI_ICMPQUERY; 1237 minicmpsz = ICMP_MINLEN; 1238 break; 1239 /* 1240 * type(1) + code(1) + cksum(2) + id(2) seq(2) + 1241 * 3 * timestamp(3 * 4) 1242 */ 1243 case ICMP_TSTAMP : 1244 case ICMP_TSTAMPREPLY : 1245 fin->fin_flx |= FI_ICMPQUERY; 1246 minicmpsz = 20; 1247 break; 1248 /* 1249 * type(1) + code(1) + cksum(2) + id(2) seq(2) + 1250 * mask(4) 1251 */ 1252 case ICMP_IREQ : 1253 case ICMP_IREQREPLY : 1254 case ICMP_MASKREQ : 1255 case ICMP_MASKREPLY : 1256 fin->fin_flx |= FI_ICMPQUERY; 1257 minicmpsz = 12; 1258 break; 1259 /* 1260 * type(1) + code(1) + cksum(2) + id(2) seq(2) + ip(20+) 1261 */ 1262 case ICMP_UNREACH : 1263 #ifdef icmp_nextmtu 1264 if (icmp->icmp_code == ICMP_UNREACH_NEEDFRAG) { 1265 if (icmp->icmp_nextmtu < softc->ipf_icmpminfragmtu) 1266 fin->fin_flx |= FI_BAD; 1267 } 1268 #endif 1269 case ICMP_SOURCEQUENCH : 1270 case ICMP_REDIRECT : 1271 case ICMP_TIMXCEED : 1272 case ICMP_PARAMPROB : 1273 fin->fin_flx |= FI_ICMPERR; 1274 if (ipf_coalesce(fin) != 1) { 1275 LBUMPD(ipf_stats[fin->fin_out], fr_icmp_coalesce); 1276 return; 1277 } 1278 1279 /* 1280 * ICMP error packets should not be generated for IP 1281 * packets that are a fragment that isn't the first 1282 * fragment. 1283 */ 1284 oip = (ip_t *)((char *)fin->fin_dp + ICMPERR_ICMPHLEN); 1285 if ((ntohs(oip->ip_off) & IP_OFFMASK) != 0) 1286 fin->fin_flx |= FI_BAD; 1287 1288 /* 1289 * If the destination of this packet doesn't match the 1290 * source of the original packet then this packet is 1291 * not correct. 1292 */ 1293 if (oip->ip_src.s_addr != fin->fin_daddr) 1294 fin->fin_flx |= FI_BAD; 1295 break; 1296 default : 1297 break; 1298 } 1299 1300 ipf_pr_short(fin, minicmpsz); 1301 1302 ipf_checkv4sum(fin); 1303 } 1304 1305 1306 /* ------------------------------------------------------------------------ */ 1307 /* Function: ipf_pr_tcpcommon */ 1308 /* Returns: int - 0 = header ok, 1 = bad packet, -1 = buffer error */ 1309 /* Parameters: fin(I) - pointer to packet information */ 1310 /* */ 1311 /* TCP header sanity checking. Look for bad combinations of TCP flags, */ 1312 /* and make some checks with how they interact with other fields. */ 1313 /* If compiled with IPFILTER_CKSUM, check to see if the TCP checksum is */ 1314 /* valid and mark the packet as bad if not. */ 1315 /* ------------------------------------------------------------------------ */ 1316 static INLINE int 1317 ipf_pr_tcpcommon(fin) 1318 fr_info_t *fin; 1319 { 1320 ipf_main_softc_t *softc = fin->fin_main_soft; 1321 int flags, tlen; 1322 tcphdr_t *tcp; 1323 1324 fin->fin_flx |= FI_TCPUDP; 1325 if (fin->fin_off != 0) { 1326 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_frag); 1327 return 0; 1328 } 1329 1330 if (ipf_pr_pullup(fin, sizeof(*tcp)) == -1) { 1331 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_pullup); 1332 return -1; 1333 } 1334 1335 tcp = fin->fin_dp; 1336 if (fin->fin_dlen > 3) { 1337 fin->fin_sport = ntohs(tcp->th_sport); 1338 fin->fin_dport = ntohs(tcp->th_dport); 1339 } 1340 1341 if ((fin->fin_flx & FI_SHORT) != 0) { 1342 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_short); 1343 return 1; 1344 } 1345 1346 /* 1347 * Use of the TCP data offset *must* result in a value that is at 1348 * least the same size as the TCP header. 1349 */ 1350 tlen = TCP_OFF(tcp) << 2; 1351 if (tlen < sizeof(tcphdr_t)) { 1352 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_small); 1353 fin->fin_flx |= FI_BAD; 1354 return 1; 1355 } 1356 1357 flags = tcp->th_flags; 1358 fin->fin_tcpf = tcp->th_flags; 1359 1360 /* 1361 * If the urgent flag is set, then the urgent pointer must 1362 * also be set and vice versa. Good TCP packets do not have 1363 * just one of these set. 1364 */ 1365 if ((flags & TH_URG) != 0 && (tcp->th_urp == 0)) { 1366 fin->fin_flx |= FI_BAD; 1367 #if 0 1368 } else if ((flags & TH_URG) == 0 && (tcp->th_urp != 0)) { 1369 /* 1370 * Ignore this case (#if 0) as it shows up in "real" 1371 * traffic with bogus values in the urgent pointer field. 1372 */ 1373 fin->fin_flx |= FI_BAD; 1374 #endif 1375 } else if (((flags & (TH_SYN|TH_FIN)) != 0) && 1376 ((flags & (TH_RST|TH_ACK)) == TH_RST)) { 1377 /* TH_FIN|TH_RST|TH_ACK seems to appear "naturally" */ 1378 fin->fin_flx |= FI_BAD; 1379 #if 1 1380 } else if (((flags & TH_SYN) != 0) && 1381 ((flags & (TH_URG|TH_PUSH)) != 0)) { 1382 /* 1383 * SYN with URG and PUSH set is not for normal TCP but it is 1384 * possible(?) with T/TCP...but who uses T/TCP? 1385 */ 1386 fin->fin_flx |= FI_BAD; 1387 #endif 1388 } else if (!(flags & TH_ACK)) { 1389 /* 1390 * If the ack bit isn't set, then either the SYN or 1391 * RST bit must be set. If the SYN bit is set, then 1392 * we expect the ACK field to be 0. If the ACK is 1393 * not set and if URG, PSH or FIN are set, consdier 1394 * that to indicate a bad TCP packet. 1395 */ 1396 if ((flags == TH_SYN) && (tcp->th_ack != 0)) { 1397 /* 1398 * Cisco PIX sets the ACK field to a random value. 1399 * In light of this, do not set FI_BAD until a patch 1400 * is available from Cisco to ensure that 1401 * interoperability between existing systems is 1402 * achieved. 1403 */ 1404 /*fin->fin_flx |= FI_BAD*/; 1405 } else if (!(flags & (TH_RST|TH_SYN))) { 1406 fin->fin_flx |= FI_BAD; 1407 } else if ((flags & (TH_URG|TH_PUSH|TH_FIN)) != 0) { 1408 fin->fin_flx |= FI_BAD; 1409 } 1410 } 1411 if (fin->fin_flx & FI_BAD) { 1412 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_bad_flags); 1413 return 1; 1414 } 1415 1416 /* 1417 * At this point, it's not exactly clear what is to be gained by 1418 * marking up which TCP options are and are not present. The one we 1419 * are most interested in is the TCP window scale. This is only in 1420 * a SYN packet [RFC1323] so we don't need this here...? 1421 * Now if we were to analyse the header for passive fingerprinting, 1422 * then that might add some weight to adding this... 1423 */ 1424 if (tlen == sizeof(tcphdr_t)) { 1425 return 0; 1426 } 1427 1428 if (ipf_pr_pullup(fin, tlen) == -1) { 1429 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_pullup); 1430 return -1; 1431 } 1432 1433 #if 0 1434 tcp = fin->fin_dp; 1435 ip = fin->fin_ip; 1436 s = (u_char *)(tcp + 1); 1437 off = IP_HL(ip) << 2; 1438 # ifdef _KERNEL 1439 if (fin->fin_mp != NULL) { 1440 mb_t *m = *fin->fin_mp; 1441 1442 if (off + tlen > M_LEN(m)) 1443 return; 1444 } 1445 # endif 1446 for (tlen -= (int)sizeof(*tcp); tlen > 0; ) { 1447 opt = *s; 1448 if (opt == '\0') 1449 break; 1450 else if (opt == TCPOPT_NOP) 1451 ol = 1; 1452 else { 1453 if (tlen < 2) 1454 break; 1455 ol = (int)*(s + 1); 1456 if (ol < 2 || ol > tlen) 1457 break; 1458 } 1459 1460 for (i = 9, mv = 4; mv >= 0; ) { 1461 op = ipopts + i; 1462 if (opt == (u_char)op->ol_val) { 1463 optmsk |= op->ol_bit; 1464 break; 1465 } 1466 } 1467 tlen -= ol; 1468 s += ol; 1469 } 1470 #endif /* 0 */ 1471 1472 return 0; 1473 } 1474 1475 1476 1477 /* ------------------------------------------------------------------------ */ 1478 /* Function: ipf_pr_udpcommon */ 1479 /* Returns: int - 0 = header ok, 1 = bad packet */ 1480 /* Parameters: fin(I) - pointer to packet information */ 1481 /* */ 1482 /* Extract the UDP source and destination ports, if present. If compiled */ 1483 /* with IPFILTER_CKSUM, check to see if the UDP checksum is valid. */ 1484 /* ------------------------------------------------------------------------ */ 1485 static INLINE int 1486 ipf_pr_udpcommon(fin) 1487 fr_info_t *fin; 1488 { 1489 udphdr_t *udp; 1490 1491 fin->fin_flx |= FI_TCPUDP; 1492 1493 if (!fin->fin_off && (fin->fin_dlen > 3)) { 1494 if (ipf_pr_pullup(fin, sizeof(*udp)) == -1) { 1495 ipf_main_softc_t *softc = fin->fin_main_soft; 1496 1497 fin->fin_flx |= FI_SHORT; 1498 LBUMPD(ipf_stats[fin->fin_out], fr_udp_pullup); 1499 return 1; 1500 } 1501 1502 udp = fin->fin_dp; 1503 1504 fin->fin_sport = ntohs(udp->uh_sport); 1505 fin->fin_dport = ntohs(udp->uh_dport); 1506 } 1507 1508 return 0; 1509 } 1510 1511 1512 /* ------------------------------------------------------------------------ */ 1513 /* Function: ipf_pr_tcp */ 1514 /* Returns: void */ 1515 /* Parameters: fin(I) - pointer to packet information */ 1516 /* */ 1517 /* IPv4 Only */ 1518 /* Analyse the packet for IPv4/TCP properties. */ 1519 /* ------------------------------------------------------------------------ */ 1520 static INLINE void 1521 ipf_pr_tcp(fin) 1522 fr_info_t *fin; 1523 { 1524 1525 ipf_pr_short(fin, sizeof(tcphdr_t)); 1526 1527 if (ipf_pr_tcpcommon(fin) == 0) 1528 ipf_checkv4sum(fin); 1529 } 1530 1531 1532 /* ------------------------------------------------------------------------ */ 1533 /* Function: ipf_pr_udp */ 1534 /* Returns: void */ 1535 /* Parameters: fin(I) - pointer to packet information */ 1536 /* */ 1537 /* IPv4 Only */ 1538 /* Analyse the packet for IPv4/UDP properties. */ 1539 /* ------------------------------------------------------------------------ */ 1540 static INLINE void 1541 ipf_pr_udp(fin) 1542 fr_info_t *fin; 1543 { 1544 1545 ipf_pr_short(fin, sizeof(udphdr_t)); 1546 1547 if (ipf_pr_udpcommon(fin) == 0) 1548 ipf_checkv4sum(fin); 1549 } 1550 1551 1552 /* ------------------------------------------------------------------------ */ 1553 /* Function: ipf_pr_esp */ 1554 /* Returns: void */ 1555 /* Parameters: fin(I) - pointer to packet information */ 1556 /* */ 1557 /* Analyse the packet for ESP properties. */ 1558 /* The minimum length is taken to be the SPI (32bits) plus a tail (32bits) */ 1559 /* even though the newer ESP packets must also have a sequence number that */ 1560 /* is 32bits as well, it is not possible(?) to determine the version from a */ 1561 /* simple packet header. */ 1562 /* ------------------------------------------------------------------------ */ 1563 static INLINE void 1564 ipf_pr_esp(fin) 1565 fr_info_t *fin; 1566 { 1567 1568 if (fin->fin_off == 0) { 1569 ipf_pr_short(fin, 8); 1570 if (ipf_pr_pullup(fin, 8) == -1) { 1571 ipf_main_softc_t *softc = fin->fin_main_soft; 1572 1573 LBUMPD(ipf_stats[fin->fin_out], fr_v4_esp_pullup); 1574 } 1575 } 1576 } 1577 1578 1579 /* ------------------------------------------------------------------------ */ 1580 /* Function: ipf_pr_ah */ 1581 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 1582 /* Parameters: fin(I) - pointer to packet information */ 1583 /* */ 1584 /* Analyse the packet for AH properties. */ 1585 /* The minimum length is taken to be the combination of all fields in the */ 1586 /* header being present and no authentication data (null algorithm used.) */ 1587 /* ------------------------------------------------------------------------ */ 1588 static INLINE int 1589 ipf_pr_ah(fin) 1590 fr_info_t *fin; 1591 { 1592 ipf_main_softc_t *softc = fin->fin_main_soft; 1593 authhdr_t *ah; 1594 int len; 1595 1596 fin->fin_flx |= FI_AH; 1597 ipf_pr_short(fin, sizeof(*ah)); 1598 1599 if (((fin->fin_flx & FI_SHORT) != 0) || (fin->fin_off != 0)) { 1600 LBUMPD(ipf_stats[fin->fin_out], fr_v4_ah_bad); 1601 return IPPROTO_NONE; 1602 } 1603 1604 if (ipf_pr_pullup(fin, sizeof(*ah)) == -1) { 1605 DT(fr_v4_ah_pullup_1); 1606 LBUMP(ipf_stats[fin->fin_out].fr_v4_ah_pullup); 1607 return IPPROTO_NONE; 1608 } 1609 1610 ah = (authhdr_t *)fin->fin_dp; 1611 1612 len = (ah->ah_plen + 2) << 2; 1613 ipf_pr_short(fin, len); 1614 if (ipf_pr_pullup(fin, len) == -1) { 1615 DT(fr_v4_ah_pullup_2); 1616 LBUMP(ipf_stats[fin->fin_out].fr_v4_ah_pullup); 1617 return IPPROTO_NONE; 1618 } 1619 1620 /* 1621 * Adjust fin_dp and fin_dlen for skipping over the authentication 1622 * header. 1623 */ 1624 fin->fin_dp = (char *)fin->fin_dp + len; 1625 fin->fin_dlen -= len; 1626 return ah->ah_next; 1627 } 1628 1629 1630 /* ------------------------------------------------------------------------ */ 1631 /* Function: ipf_pr_gre */ 1632 /* Returns: void */ 1633 /* Parameters: fin(I) - pointer to packet information */ 1634 /* */ 1635 /* Analyse the packet for GRE properties. */ 1636 /* ------------------------------------------------------------------------ */ 1637 static INLINE void 1638 ipf_pr_gre(fin) 1639 fr_info_t *fin; 1640 { 1641 ipf_main_softc_t *softc = fin->fin_main_soft; 1642 grehdr_t *gre; 1643 1644 ipf_pr_short(fin, sizeof(grehdr_t)); 1645 1646 if (fin->fin_off != 0) { 1647 LBUMPD(ipf_stats[fin->fin_out], fr_v4_gre_frag); 1648 return; 1649 } 1650 1651 if (ipf_pr_pullup(fin, sizeof(grehdr_t)) == -1) { 1652 LBUMPD(ipf_stats[fin->fin_out], fr_v4_gre_pullup); 1653 return; 1654 } 1655 1656 gre = fin->fin_dp; 1657 if (GRE_REV(gre->gr_flags) == 1) 1658 fin->fin_data[0] = gre->gr_call; 1659 } 1660 1661 1662 /* ------------------------------------------------------------------------ */ 1663 /* Function: ipf_pr_ipv4hdr */ 1664 /* Returns: void */ 1665 /* Parameters: fin(I) - pointer to packet information */ 1666 /* */ 1667 /* IPv4 Only */ 1668 /* Analyze the IPv4 header and set fields in the fr_info_t structure. */ 1669 /* Check all options present and flag their presence if any exist. */ 1670 /* ------------------------------------------------------------------------ */ 1671 static INLINE void 1672 ipf_pr_ipv4hdr(fin) 1673 fr_info_t *fin; 1674 { 1675 u_short optmsk = 0, secmsk = 0, auth = 0; 1676 int hlen, ol, mv, p, i; 1677 const struct optlist *op; 1678 u_char *s, opt; 1679 u_short off; 1680 fr_ip_t *fi; 1681 ip_t *ip; 1682 1683 fi = &fin->fin_fi; 1684 hlen = fin->fin_hlen; 1685 1686 ip = fin->fin_ip; 1687 p = ip->ip_p; 1688 fi->fi_p = p; 1689 fin->fin_crc = p; 1690 fi->fi_tos = ip->ip_tos; 1691 fin->fin_id = ip->ip_id; 1692 off = ntohs(ip->ip_off); 1693 1694 /* Get both TTL and protocol */ 1695 fi->fi_p = ip->ip_p; 1696 fi->fi_ttl = ip->ip_ttl; 1697 1698 /* Zero out bits not used in IPv6 address */ 1699 fi->fi_src.i6[1] = 0; 1700 fi->fi_src.i6[2] = 0; 1701 fi->fi_src.i6[3] = 0; 1702 fi->fi_dst.i6[1] = 0; 1703 fi->fi_dst.i6[2] = 0; 1704 fi->fi_dst.i6[3] = 0; 1705 1706 fi->fi_saddr = ip->ip_src.s_addr; 1707 fin->fin_crc += fi->fi_saddr; 1708 fi->fi_daddr = ip->ip_dst.s_addr; 1709 fin->fin_crc += fi->fi_daddr; 1710 if (IN_CLASSD(fi->fi_daddr)) 1711 fin->fin_flx |= FI_MULTICAST|FI_MBCAST; 1712 1713 /* 1714 * set packet attribute flags based on the offset and 1715 * calculate the byte offset that it represents. 1716 */ 1717 off &= IP_MF|IP_OFFMASK; 1718 if (off != 0) { 1719 int morefrag = off & IP_MF; 1720 1721 fi->fi_flx |= FI_FRAG; 1722 off &= IP_OFFMASK; 1723 if (off != 0) { 1724 fin->fin_flx |= FI_FRAGBODY; 1725 off <<= 3; 1726 if ((off + fin->fin_dlen > 65535) || 1727 (fin->fin_dlen == 0) || 1728 ((morefrag != 0) && ((fin->fin_dlen & 7) != 0))) { 1729 /* 1730 * The length of the packet, starting at its 1731 * offset cannot exceed 65535 (0xffff) as the 1732 * length of an IP packet is only 16 bits. 1733 * 1734 * Any fragment that isn't the last fragment 1735 * must have a length greater than 0 and it 1736 * must be an even multiple of 8. 1737 */ 1738 fi->fi_flx |= FI_BAD; 1739 } 1740 } 1741 } 1742 fin->fin_off = off; 1743 1744 /* 1745 * Call per-protocol setup and checking 1746 */ 1747 if (p == IPPROTO_AH) { 1748 /* 1749 * Treat AH differently because we expect there to be another 1750 * layer 4 header after it. 1751 */ 1752 p = ipf_pr_ah(fin); 1753 } 1754 1755 switch (p) 1756 { 1757 case IPPROTO_UDP : 1758 ipf_pr_udp(fin); 1759 break; 1760 case IPPROTO_TCP : 1761 ipf_pr_tcp(fin); 1762 break; 1763 case IPPROTO_ICMP : 1764 ipf_pr_icmp(fin); 1765 break; 1766 case IPPROTO_ESP : 1767 ipf_pr_esp(fin); 1768 break; 1769 case IPPROTO_GRE : 1770 ipf_pr_gre(fin); 1771 break; 1772 } 1773 1774 ip = fin->fin_ip; 1775 if (ip == NULL) 1776 return; 1777 1778 /* 1779 * If it is a standard IP header (no options), set the flag fields 1780 * which relate to options to 0. 1781 */ 1782 if (hlen == sizeof(*ip)) { 1783 fi->fi_optmsk = 0; 1784 fi->fi_secmsk = 0; 1785 fi->fi_auth = 0; 1786 return; 1787 } 1788 1789 /* 1790 * So the IP header has some IP options attached. Walk the entire 1791 * list of options present with this packet and set flags to indicate 1792 * which ones are here and which ones are not. For the somewhat out 1793 * of date and obscure security classification options, set a flag to 1794 * represent which classification is present. 1795 */ 1796 fi->fi_flx |= FI_OPTIONS; 1797 1798 for (s = (u_char *)(ip + 1), hlen -= (int)sizeof(*ip); hlen > 0; ) { 1799 opt = *s; 1800 if (opt == '\0') 1801 break; 1802 else if (opt == IPOPT_NOP) 1803 ol = 1; 1804 else { 1805 if (hlen < 2) 1806 break; 1807 ol = (int)*(s + 1); 1808 if (ol < 2 || ol > hlen) 1809 break; 1810 } 1811 for (i = 9, mv = 4; mv >= 0; ) { 1812 op = ipopts + i; 1813 1814 if ((opt == (u_char)op->ol_val) && (ol > 4)) { 1815 u_32_t doi; 1816 1817 switch (opt) 1818 { 1819 case IPOPT_SECURITY : 1820 if (optmsk & op->ol_bit) { 1821 fin->fin_flx |= FI_BAD; 1822 } else { 1823 doi = ipf_checkripso(s); 1824 secmsk = doi >> 16; 1825 auth = doi & 0xffff; 1826 } 1827 break; 1828 1829 case IPOPT_CIPSO : 1830 1831 if (optmsk & op->ol_bit) { 1832 fin->fin_flx |= FI_BAD; 1833 } else { 1834 doi = ipf_checkcipso(fin, 1835 s, ol); 1836 secmsk = doi >> 16; 1837 auth = doi & 0xffff; 1838 } 1839 break; 1840 } 1841 optmsk |= op->ol_bit; 1842 } 1843 1844 if (opt < op->ol_val) 1845 i -= mv; 1846 else 1847 i += mv; 1848 mv--; 1849 } 1850 hlen -= ol; 1851 s += ol; 1852 } 1853 1854 /* 1855 * 1856 */ 1857 if (auth && !(auth & 0x0100)) 1858 auth &= 0xff00; 1859 fi->fi_optmsk = optmsk; 1860 fi->fi_secmsk = secmsk; 1861 fi->fi_auth = auth; 1862 } 1863 1864 1865 /* ------------------------------------------------------------------------ */ 1866 /* Function: ipf_checkripso */ 1867 /* Returns: void */ 1868 /* Parameters: s(I) - pointer to start of RIPSO option */ 1869 /* */ 1870 /* ------------------------------------------------------------------------ */ 1871 static u_32_t 1872 ipf_checkripso(s) 1873 u_char *s; 1874 { 1875 const struct optlist *sp; 1876 u_short secmsk = 0, auth = 0; 1877 u_char sec; 1878 int j, m; 1879 1880 sec = *(s + 2); /* classification */ 1881 for (j = 3, m = 2; m >= 0; ) { 1882 sp = secopt + j; 1883 if (sec == sp->ol_val) { 1884 secmsk |= sp->ol_bit; 1885 auth = *(s + 3); 1886 auth *= 256; 1887 auth += *(s + 4); 1888 break; 1889 } 1890 if (sec < sp->ol_val) 1891 j -= m; 1892 else 1893 j += m; 1894 m--; 1895 } 1896 1897 return (secmsk << 16) | auth; 1898 } 1899 1900 1901 /* ------------------------------------------------------------------------ */ 1902 /* Function: ipf_checkcipso */ 1903 /* Returns: u_32_t - 0 = failure, else the doi from the header */ 1904 /* Parameters: fin(IO) - pointer to packet information */ 1905 /* s(I) - pointer to start of CIPSO option */ 1906 /* ol(I) - length of CIPSO option field */ 1907 /* */ 1908 /* This function returns the domain of integrity (DOI) field from the CIPSO */ 1909 /* header and returns that whilst also storing the highest sensitivity */ 1910 /* value found in the fr_info_t structure. */ 1911 /* */ 1912 /* No attempt is made to extract the category bitmaps as these are defined */ 1913 /* by the user (rather than the protocol) and can be rather numerous on the */ 1914 /* end nodes. */ 1915 /* ------------------------------------------------------------------------ */ 1916 static u_32_t 1917 ipf_checkcipso(fin, s, ol) 1918 fr_info_t *fin; 1919 u_char *s; 1920 int ol; 1921 { 1922 ipf_main_softc_t *softc = fin->fin_main_soft; 1923 fr_ip_t *fi; 1924 u_32_t doi; 1925 u_char *t, tag, tlen, sensitivity; 1926 int len; 1927 1928 if (ol < 6 || ol > 40) { 1929 LBUMPD(ipf_stats[fin->fin_out], fr_v4_cipso_bad); 1930 fin->fin_flx |= FI_BAD; 1931 return 0; 1932 } 1933 1934 fi = &fin->fin_fi; 1935 fi->fi_sensitivity = 0; 1936 /* 1937 * The DOI field MUST be there. 1938 */ 1939 bcopy(s + 2, &doi, sizeof(doi)); 1940 1941 t = (u_char *)s + 6; 1942 for (len = ol - 6; len >= 2; len -= tlen, t+= tlen) { 1943 tag = *t; 1944 tlen = *(t + 1); 1945 if (tlen > len || tlen < 4 || tlen > 34) { 1946 LBUMPD(ipf_stats[fin->fin_out], fr_v4_cipso_tlen); 1947 fin->fin_flx |= FI_BAD; 1948 return 0; 1949 } 1950 1951 sensitivity = 0; 1952 /* 1953 * Tag numbers 0, 1, 2, 5 are laid out in the CIPSO Internet 1954 * draft (16 July 1992) that has expired. 1955 */ 1956 if (tag == 0) { 1957 fin->fin_flx |= FI_BAD; 1958 continue; 1959 } else if (tag == 1) { 1960 if (*(t + 2) != 0) { 1961 fin->fin_flx |= FI_BAD; 1962 continue; 1963 } 1964 sensitivity = *(t + 3); 1965 /* Category bitmap for categories 0-239 */ 1966 1967 } else if (tag == 4) { 1968 if (*(t + 2) != 0) { 1969 fin->fin_flx |= FI_BAD; 1970 continue; 1971 } 1972 sensitivity = *(t + 3); 1973 /* Enumerated categories, 16bits each, upto 15 */ 1974 1975 } else if (tag == 5) { 1976 if (*(t + 2) != 0) { 1977 fin->fin_flx |= FI_BAD; 1978 continue; 1979 } 1980 sensitivity = *(t + 3); 1981 /* Range of categories (2*16bits), up to 7 pairs */ 1982 1983 } else if (tag > 127) { 1984 /* Custom defined DOI */ 1985 ; 1986 } else { 1987 fin->fin_flx |= FI_BAD; 1988 continue; 1989 } 1990 1991 if (sensitivity > fi->fi_sensitivity) 1992 fi->fi_sensitivity = sensitivity; 1993 } 1994 1995 return doi; 1996 } 1997 1998 1999 /* ------------------------------------------------------------------------ */ 2000 /* Function: ipf_makefrip */ 2001 /* Returns: int - 0 == packet ok, -1 == packet freed */ 2002 /* Parameters: hlen(I) - length of IP packet header */ 2003 /* ip(I) - pointer to the IP header */ 2004 /* fin(IO) - pointer to packet information */ 2005 /* */ 2006 /* Compact the IP header into a structure which contains just the info. */ 2007 /* which is useful for comparing IP headers with and store this information */ 2008 /* in the fr_info_t structure pointer to by fin. At present, it is assumed */ 2009 /* this function will be called with either an IPv4 or IPv6 packet. */ 2010 /* ------------------------------------------------------------------------ */ 2011 int 2012 ipf_makefrip(hlen, ip, fin) 2013 int hlen; 2014 ip_t *ip; 2015 fr_info_t *fin; 2016 { 2017 ipf_main_softc_t *softc = fin->fin_main_soft; 2018 int v; 2019 2020 fin->fin_depth = 0; 2021 fin->fin_hlen = (u_short)hlen; 2022 fin->fin_ip = ip; 2023 fin->fin_rule = 0xffffffff; 2024 fin->fin_group[0] = -1; 2025 fin->fin_group[1] = '\0'; 2026 fin->fin_dp = (char *)ip + hlen; 2027 2028 v = fin->fin_v; 2029 if (v == 4) { 2030 fin->fin_plen = ntohs(ip->ip_len); 2031 fin->fin_dlen = fin->fin_plen - hlen; 2032 ipf_pr_ipv4hdr(fin); 2033 #ifdef USE_INET6 2034 } else if (v == 6) { 2035 fin->fin_plen = ntohs(((ip6_t *)ip)->ip6_plen); 2036 fin->fin_dlen = fin->fin_plen; 2037 fin->fin_plen += hlen; 2038 2039 ipf_pr_ipv6hdr(fin); 2040 #endif 2041 } 2042 if (fin->fin_ip == NULL) { 2043 LBUMP(ipf_stats[fin->fin_out].fr_ip_freed); 2044 return -1; 2045 } 2046 return 0; 2047 } 2048 2049 2050 /* ------------------------------------------------------------------------ */ 2051 /* Function: ipf_portcheck */ 2052 /* Returns: int - 1 == port matched, 0 == port match failed */ 2053 /* Parameters: frp(I) - pointer to port check `expression' */ 2054 /* pop(I) - port number to evaluate */ 2055 /* */ 2056 /* Perform a comparison of a port number against some other(s), using a */ 2057 /* structure with compare information stored in it. */ 2058 /* ------------------------------------------------------------------------ */ 2059 static INLINE int 2060 ipf_portcheck(frp, pop) 2061 frpcmp_t *frp; 2062 u_32_t pop; 2063 { 2064 int err = 1; 2065 u_32_t po; 2066 2067 po = frp->frp_port; 2068 2069 /* 2070 * Do opposite test to that required and continue if that succeeds. 2071 */ 2072 switch (frp->frp_cmp) 2073 { 2074 case FR_EQUAL : 2075 if (pop != po) /* EQUAL */ 2076 err = 0; 2077 break; 2078 case FR_NEQUAL : 2079 if (pop == po) /* NOTEQUAL */ 2080 err = 0; 2081 break; 2082 case FR_LESST : 2083 if (pop >= po) /* LESSTHAN */ 2084 err = 0; 2085 break; 2086 case FR_GREATERT : 2087 if (pop <= po) /* GREATERTHAN */ 2088 err = 0; 2089 break; 2090 case FR_LESSTE : 2091 if (pop > po) /* LT or EQ */ 2092 err = 0; 2093 break; 2094 case FR_GREATERTE : 2095 if (pop < po) /* GT or EQ */ 2096 err = 0; 2097 break; 2098 case FR_OUTRANGE : 2099 if (pop >= po && pop <= frp->frp_top) /* Out of range */ 2100 err = 0; 2101 break; 2102 case FR_INRANGE : 2103 if (pop <= po || pop >= frp->frp_top) /* In range */ 2104 err = 0; 2105 break; 2106 case FR_INCRANGE : 2107 if (pop < po || pop > frp->frp_top) /* Inclusive range */ 2108 err = 0; 2109 break; 2110 default : 2111 break; 2112 } 2113 return err; 2114 } 2115 2116 2117 /* ------------------------------------------------------------------------ */ 2118 /* Function: ipf_tcpudpchk */ 2119 /* Returns: int - 1 == protocol matched, 0 == check failed */ 2120 /* Parameters: fda(I) - pointer to packet information */ 2121 /* ft(I) - pointer to structure with comparison data */ 2122 /* */ 2123 /* Compares the current pcket (assuming it is TCP/UDP) information with a */ 2124 /* structure containing information that we want to match against. */ 2125 /* ------------------------------------------------------------------------ */ 2126 int 2127 ipf_tcpudpchk(fi, ft) 2128 fr_ip_t *fi; 2129 frtuc_t *ft; 2130 { 2131 int err = 1; 2132 2133 /* 2134 * Both ports should *always* be in the first fragment. 2135 * So far, I cannot find any cases where they can not be. 2136 * 2137 * compare destination ports 2138 */ 2139 if (ft->ftu_dcmp) 2140 err = ipf_portcheck(&ft->ftu_dst, fi->fi_ports[1]); 2141 2142 /* 2143 * compare source ports 2144 */ 2145 if (err && ft->ftu_scmp) 2146 err = ipf_portcheck(&ft->ftu_src, fi->fi_ports[0]); 2147 2148 /* 2149 * If we don't have all the TCP/UDP header, then how can we 2150 * expect to do any sort of match on it ? If we were looking for 2151 * TCP flags, then NO match. If not, then match (which should 2152 * satisfy the "short" class too). 2153 */ 2154 if (err && (fi->fi_p == IPPROTO_TCP)) { 2155 if (fi->fi_flx & FI_SHORT) 2156 return !(ft->ftu_tcpf | ft->ftu_tcpfm); 2157 /* 2158 * Match the flags ? If not, abort this match. 2159 */ 2160 if (ft->ftu_tcpfm && 2161 ft->ftu_tcpf != (fi->fi_tcpf & ft->ftu_tcpfm)) { 2162 FR_DEBUG(("f. %#x & %#x != %#x\n", fi->fi_tcpf, 2163 ft->ftu_tcpfm, ft->ftu_tcpf)); 2164 err = 0; 2165 } 2166 } 2167 return err; 2168 } 2169 2170 2171 /* ------------------------------------------------------------------------ */ 2172 /* Function: ipf_check_ipf */ 2173 /* Returns: int - 0 == match, else no match */ 2174 /* Parameters: fin(I) - pointer to packet information */ 2175 /* fr(I) - pointer to filter rule */ 2176 /* portcmp(I) - flag indicating whether to attempt matching on */ 2177 /* TCP/UDP port data. */ 2178 /* */ 2179 /* Check to see if a packet matches an IPFilter rule. Checks of addresses, */ 2180 /* port numbers, etc, for "standard" IPFilter rules are all orchestrated in */ 2181 /* this function. */ 2182 /* ------------------------------------------------------------------------ */ 2183 static INLINE int 2184 ipf_check_ipf(fin, fr, portcmp) 2185 fr_info_t *fin; 2186 frentry_t *fr; 2187 int portcmp; 2188 { 2189 u_32_t *ld, *lm, *lip; 2190 fripf_t *fri; 2191 fr_ip_t *fi; 2192 int i; 2193 2194 fi = &fin->fin_fi; 2195 fri = fr->fr_ipf; 2196 lip = (u_32_t *)fi; 2197 lm = (u_32_t *)&fri->fri_mip; 2198 ld = (u_32_t *)&fri->fri_ip; 2199 2200 /* 2201 * first 32 bits to check coversion: 2202 * IP version, TOS, TTL, protocol 2203 */ 2204 i = ((*lip & *lm) != *ld); 2205 FR_DEBUG(("0. %#08x & %#08x != %#08x\n", 2206 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2207 if (i) 2208 return 1; 2209 2210 /* 2211 * Next 32 bits is a constructed bitmask indicating which IP options 2212 * are present (if any) in this packet. 2213 */ 2214 lip++, lm++, ld++; 2215 i = ((*lip & *lm) != *ld); 2216 FR_DEBUG(("1. %#08x & %#08x != %#08x\n", 2217 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2218 if (i != 0) 2219 return 1; 2220 2221 lip++, lm++, ld++; 2222 /* 2223 * Unrolled loops (4 each, for 32 bits) for address checks. 2224 */ 2225 /* 2226 * Check the source address. 2227 */ 2228 if (fr->fr_satype == FRI_LOOKUP) { 2229 i = (*fr->fr_srcfunc)(fin->fin_main_soft, fr->fr_srcptr, 2230 fi->fi_v, lip, fin->fin_plen); 2231 if (i == -1) 2232 return 1; 2233 lip += 3; 2234 lm += 3; 2235 ld += 3; 2236 } else { 2237 i = ((*lip & *lm) != *ld); 2238 FR_DEBUG(("2a. %#08x & %#08x != %#08x\n", 2239 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2240 if (fi->fi_v == 6) { 2241 lip++, lm++, ld++; 2242 i |= ((*lip & *lm) != *ld); 2243 FR_DEBUG(("2b. %#08x & %#08x != %#08x\n", 2244 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2245 lip++, lm++, ld++; 2246 i |= ((*lip & *lm) != *ld); 2247 FR_DEBUG(("2c. %#08x & %#08x != %#08x\n", 2248 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2249 lip++, lm++, ld++; 2250 i |= ((*lip & *lm) != *ld); 2251 FR_DEBUG(("2d. %#08x & %#08x != %#08x\n", 2252 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2253 } else { 2254 lip += 3; 2255 lm += 3; 2256 ld += 3; 2257 } 2258 } 2259 i ^= (fr->fr_flags & FR_NOTSRCIP) >> 6; 2260 if (i != 0) 2261 return 1; 2262 2263 /* 2264 * Check the destination address. 2265 */ 2266 lip++, lm++, ld++; 2267 if (fr->fr_datype == FRI_LOOKUP) { 2268 i = (*fr->fr_dstfunc)(fin->fin_main_soft, fr->fr_dstptr, 2269 fi->fi_v, lip, fin->fin_plen); 2270 if (i == -1) 2271 return 1; 2272 lip += 3; 2273 lm += 3; 2274 ld += 3; 2275 } else { 2276 i = ((*lip & *lm) != *ld); 2277 FR_DEBUG(("3a. %#08x & %#08x != %#08x\n", 2278 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2279 if (fi->fi_v == 6) { 2280 lip++, lm++, ld++; 2281 i |= ((*lip & *lm) != *ld); 2282 FR_DEBUG(("3b. %#08x & %#08x != %#08x\n", 2283 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2284 lip++, lm++, ld++; 2285 i |= ((*lip & *lm) != *ld); 2286 FR_DEBUG(("3c. %#08x & %#08x != %#08x\n", 2287 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2288 lip++, lm++, ld++; 2289 i |= ((*lip & *lm) != *ld); 2290 FR_DEBUG(("3d. %#08x & %#08x != %#08x\n", 2291 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2292 } else { 2293 lip += 3; 2294 lm += 3; 2295 ld += 3; 2296 } 2297 } 2298 i ^= (fr->fr_flags & FR_NOTDSTIP) >> 7; 2299 if (i != 0) 2300 return 1; 2301 /* 2302 * IP addresses matched. The next 32bits contains: 2303 * mast of old IP header security & authentication bits. 2304 */ 2305 lip++, lm++, ld++; 2306 i = (*ld - (*lip & *lm)); 2307 FR_DEBUG(("4. %#08x & %#08x != %#08x\n", *lip, *lm, *ld)); 2308 2309 /* 2310 * Next we have 32 bits of packet flags. 2311 */ 2312 lip++, lm++, ld++; 2313 i |= (*ld - (*lip & *lm)); 2314 FR_DEBUG(("5. %#08x & %#08x != %#08x\n", *lip, *lm, *ld)); 2315 2316 if (i == 0) { 2317 /* 2318 * If a fragment, then only the first has what we're 2319 * looking for here... 2320 */ 2321 if (portcmp) { 2322 if (!ipf_tcpudpchk(&fin->fin_fi, &fr->fr_tuc)) 2323 i = 1; 2324 } else { 2325 if (fr->fr_dcmp || fr->fr_scmp || 2326 fr->fr_tcpf || fr->fr_tcpfm) 2327 i = 1; 2328 if (fr->fr_icmpm || fr->fr_icmp) { 2329 if (((fi->fi_p != IPPROTO_ICMP) && 2330 (fi->fi_p != IPPROTO_ICMPV6)) || 2331 fin->fin_off || (fin->fin_dlen < 2)) 2332 i = 1; 2333 else if ((fin->fin_data[0] & fr->fr_icmpm) != 2334 fr->fr_icmp) { 2335 FR_DEBUG(("i. %#x & %#x != %#x\n", 2336 fin->fin_data[0], 2337 fr->fr_icmpm, fr->fr_icmp)); 2338 i = 1; 2339 } 2340 } 2341 } 2342 } 2343 return i; 2344 } 2345 2346 2347 /* ------------------------------------------------------------------------ */ 2348 /* Function: ipf_scanlist */ 2349 /* Returns: int - result flags of scanning filter list */ 2350 /* Parameters: fin(I) - pointer to packet information */ 2351 /* pass(I) - default result to return for filtering */ 2352 /* */ 2353 /* Check the input/output list of rules for a match to the current packet. */ 2354 /* If a match is found, the value of fr_flags from the rule becomes the */ 2355 /* return value and fin->fin_fr points to the matched rule. */ 2356 /* */ 2357 /* This function may be called recusively upto 16 times (limit inbuilt.) */ 2358 /* When unwinding, it should finish up with fin_depth as 0. */ 2359 /* */ 2360 /* Could be per interface, but this gets real nasty when you don't have, */ 2361 /* or can't easily change, the kernel source code to . */ 2362 /* ------------------------------------------------------------------------ */ 2363 int 2364 ipf_scanlist(fin, pass) 2365 fr_info_t *fin; 2366 u_32_t pass; 2367 { 2368 ipf_main_softc_t *softc = fin->fin_main_soft; 2369 int rulen, portcmp, off, skip; 2370 struct frentry *fr, *fnext; 2371 u_32_t passt, passo; 2372 2373 /* 2374 * Do not allow nesting deeper than 16 levels. 2375 */ 2376 if (fin->fin_depth >= 16) 2377 return pass; 2378 2379 fr = fin->fin_fr; 2380 2381 /* 2382 * If there are no rules in this list, return now. 2383 */ 2384 if (fr == NULL) 2385 return pass; 2386 2387 skip = 0; 2388 portcmp = 0; 2389 fin->fin_depth++; 2390 fin->fin_fr = NULL; 2391 off = fin->fin_off; 2392 2393 if ((fin->fin_flx & FI_TCPUDP) && (fin->fin_dlen > 3) && !off) 2394 portcmp = 1; 2395 2396 for (rulen = 0; fr; fr = fnext, rulen++) { 2397 fnext = fr->fr_next; 2398 if (skip != 0) { 2399 FR_VERBOSE(("SKIP %d (%#x)\n", skip, fr->fr_flags)); 2400 skip--; 2401 continue; 2402 } 2403 2404 /* 2405 * In all checks below, a null (zero) value in the 2406 * filter struture is taken to mean a wildcard. 2407 * 2408 * check that we are working for the right interface 2409 */ 2410 #ifdef _KERNEL 2411 if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp) 2412 continue; 2413 #else 2414 if (opts & (OPT_VERBOSE|OPT_DEBUG)) 2415 printf("\n"); 2416 FR_VERBOSE(("%c", FR_ISSKIP(pass) ? 's' : 2417 FR_ISPASS(pass) ? 'p' : 2418 FR_ISACCOUNT(pass) ? 'A' : 2419 FR_ISAUTH(pass) ? 'a' : 2420 (pass & FR_NOMATCH) ? 'n' :'b')); 2421 if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp) 2422 continue; 2423 FR_VERBOSE((":i")); 2424 #endif 2425 2426 switch (fr->fr_type) 2427 { 2428 case FR_T_IPF : 2429 case FR_T_IPF_BUILTIN : 2430 if (ipf_check_ipf(fin, fr, portcmp)) 2431 continue; 2432 break; 2433 #if defined(IPFILTER_BPF) 2434 case FR_T_BPFOPC : 2435 case FR_T_BPFOPC_BUILTIN : 2436 { 2437 u_char *mc; 2438 int wlen; 2439 2440 if (*fin->fin_mp == NULL) 2441 continue; 2442 if (fin->fin_family != fr->fr_family) 2443 continue; 2444 mc = (u_char *)fin->fin_m; 2445 wlen = fin->fin_dlen + fin->fin_hlen; 2446 if (!bpf_filter(fr->fr_data, mc, wlen, 0)) 2447 continue; 2448 break; 2449 } 2450 #endif 2451 case FR_T_CALLFUNC_BUILTIN : 2452 { 2453 frentry_t *f; 2454 2455 f = (*fr->fr_func)(fin, &pass); 2456 if (f != NULL) 2457 fr = f; 2458 else 2459 continue; 2460 break; 2461 } 2462 2463 case FR_T_IPFEXPR : 2464 case FR_T_IPFEXPR_BUILTIN : 2465 if (fin->fin_family != fr->fr_family) 2466 continue; 2467 if (ipf_fr_matcharray(fin, fr->fr_data) == 0) 2468 continue; 2469 break; 2470 2471 default : 2472 break; 2473 } 2474 2475 if ((fin->fin_out == 0) && (fr->fr_nattag.ipt_num[0] != 0)) { 2476 if (fin->fin_nattag == NULL) 2477 continue; 2478 if (ipf_matchtag(&fr->fr_nattag, fin->fin_nattag) == 0) 2479 continue; 2480 } 2481 FR_VERBOSE(("=%d/%d.%d *", fr->fr_grhead, fr->fr_group, rulen)); 2482 2483 passt = fr->fr_flags; 2484 2485 /* 2486 * If the rule is a "call now" rule, then call the function 2487 * in the rule, if it exists and use the results from that. 2488 * If the function pointer is bad, just make like we ignore 2489 * it, except for increasing the hit counter. 2490 */ 2491 if ((passt & FR_CALLNOW) != 0) { 2492 frentry_t *frs; 2493 2494 ATOMIC_INC64(fr->fr_hits); 2495 if ((fr->fr_func == NULL) || 2496 (fr->fr_func == (ipfunc_t)-1)) 2497 continue; 2498 2499 frs = fin->fin_fr; 2500 fin->fin_fr = fr; 2501 fr = (*fr->fr_func)(fin, &passt); 2502 if (fr == NULL) { 2503 fin->fin_fr = frs; 2504 continue; 2505 } 2506 passt = fr->fr_flags; 2507 } 2508 fin->fin_fr = fr; 2509 2510 #ifdef IPFILTER_LOG 2511 /* 2512 * Just log this packet... 2513 */ 2514 if ((passt & FR_LOGMASK) == FR_LOG) { 2515 if (ipf_log_pkt(fin, passt) == -1) { 2516 if (passt & FR_LOGORBLOCK) { 2517 DT(frb_logfail); 2518 passt &= ~FR_CMDMASK; 2519 passt |= FR_BLOCK|FR_QUICK; 2520 fin->fin_reason = FRB_LOGFAIL; 2521 } 2522 } 2523 } 2524 #endif /* IPFILTER_LOG */ 2525 2526 MUTEX_ENTER(&fr->fr_lock); 2527 fr->fr_bytes += (U_QUAD_T)fin->fin_plen; 2528 fr->fr_hits++; 2529 MUTEX_EXIT(&fr->fr_lock); 2530 fin->fin_rule = rulen; 2531 2532 passo = pass; 2533 if (FR_ISSKIP(passt)) { 2534 skip = fr->fr_arg; 2535 continue; 2536 } else if ((passt & FR_LOGMASK) != FR_LOG) { 2537 pass = passt; 2538 } 2539 2540 if (passt & (FR_RETICMP|FR_FAKEICMP)) 2541 fin->fin_icode = fr->fr_icode; 2542 2543 if (fr->fr_group != -1) { 2544 (void) strncpy(fin->fin_group, 2545 FR_NAME(fr, fr_group), 2546 strlen(FR_NAME(fr, fr_group))); 2547 } else { 2548 fin->fin_group[0] = '\0'; 2549 } 2550 2551 FR_DEBUG(("pass %#x\n", pass)); 2552 2553 if (fr->fr_grp != NULL) { 2554 2555 fin->fin_fr = *fr->fr_grp; 2556 FR_VERBOSE(("group %s\n", FR_NAME(fr, fr_grhead))); 2557 2558 if (FR_ISDECAPS(pass)) 2559 passt = ipf_decaps(fin, pass, fr->fr_icode); 2560 else 2561 passt = ipf_scanlist(fin, pass); 2562 2563 if (fin->fin_fr == NULL) { 2564 fin->fin_rule = rulen; 2565 if (fr->fr_group != -1) 2566 (void) strncpy(fin->fin_group, 2567 fr->fr_names + 2568 fr->fr_group, 2569 strlen(fr->fr_names + 2570 fr->fr_group)); 2571 fin->fin_fr = fr; 2572 passt = pass; 2573 } 2574 pass = passt; 2575 } 2576 2577 if (pass & FR_QUICK) { 2578 /* 2579 * Finally, if we've asked to track state for this 2580 * packet, set it up. Add state for "quick" rules 2581 * here so that if the action fails we can consider 2582 * the rule to "not match" and keep on processing 2583 * filter rules. 2584 */ 2585 if ((pass & FR_KEEPSTATE) && !FR_ISAUTH(pass) && 2586 !(fin->fin_flx & FI_STATE)) { 2587 int out = fin->fin_out; 2588 2589 fin->fin_fr = fr; 2590 if (ipf_state_add(softc, fin, NULL, 0) == 0) { 2591 LBUMPD(ipf_stats[out], fr_ads); 2592 } else { 2593 LBUMPD(ipf_stats[out], fr_bads); 2594 pass = passo; 2595 continue; 2596 } 2597 } 2598 break; 2599 } 2600 } 2601 fin->fin_depth--; 2602 return pass; 2603 } 2604 2605 2606 /* ------------------------------------------------------------------------ */ 2607 /* Function: ipf_acctpkt */ 2608 /* Returns: frentry_t* - always returns NULL */ 2609 /* Parameters: fin(I) - pointer to packet information */ 2610 /* passp(IO) - pointer to current/new filter decision (unused) */ 2611 /* */ 2612 /* Checks a packet against accounting rules, if there are any for the given */ 2613 /* IP protocol version. */ 2614 /* */ 2615 /* N.B.: this function returns NULL to match the prototype used by other */ 2616 /* functions called from the IPFilter "mainline" in ipf_check(). */ 2617 /* ------------------------------------------------------------------------ */ 2618 frentry_t * 2619 ipf_acctpkt(fin, passp) 2620 fr_info_t *fin; 2621 u_32_t *passp; 2622 { 2623 ipf_main_softc_t *softc = fin->fin_main_soft; 2624 char group[FR_GROUPLEN]; 2625 frentry_t *fr, *frsave; 2626 u_32_t pass, rulen; 2627 2628 passp = passp; 2629 fr = softc->ipf_acct[fin->fin_out][softc->ipf_active]; 2630 2631 if (fr != NULL) { 2632 frsave = fin->fin_fr; 2633 bcopy(fin->fin_group, group, FR_GROUPLEN); 2634 rulen = fin->fin_rule; 2635 fin->fin_fr = fr; 2636 pass = ipf_scanlist(fin, FR_NOMATCH); 2637 if (FR_ISACCOUNT(pass)) { 2638 LBUMPD(ipf_stats[0], fr_acct); 2639 } 2640 fin->fin_fr = frsave; 2641 bcopy(group, fin->fin_group, FR_GROUPLEN); 2642 fin->fin_rule = rulen; 2643 } 2644 return NULL; 2645 } 2646 2647 2648 /* ------------------------------------------------------------------------ */ 2649 /* Function: ipf_firewall */ 2650 /* Returns: frentry_t* - returns pointer to matched rule, if no matches */ 2651 /* were found, returns NULL. */ 2652 /* Parameters: fin(I) - pointer to packet information */ 2653 /* passp(IO) - pointer to current/new filter decision (unused) */ 2654 /* */ 2655 /* Applies an appropriate set of firewall rules to the packet, to see if */ 2656 /* there are any matches. The first check is to see if a match can be seen */ 2657 /* in the cache. If not, then search an appropriate list of rules. Once a */ 2658 /* matching rule is found, take any appropriate actions as defined by the */ 2659 /* rule - except logging. */ 2660 /* ------------------------------------------------------------------------ */ 2661 static frentry_t * 2662 ipf_firewall(fin, passp) 2663 fr_info_t *fin; 2664 u_32_t *passp; 2665 { 2666 ipf_main_softc_t *softc = fin->fin_main_soft; 2667 frentry_t *fr; 2668 u_32_t pass; 2669 int out; 2670 2671 out = fin->fin_out; 2672 pass = *passp; 2673 2674 /* 2675 * This rule cache will only affect packets that are not being 2676 * statefully filtered. 2677 */ 2678 fin->fin_fr = softc->ipf_rules[out][softc->ipf_active]; 2679 if (fin->fin_fr != NULL) 2680 pass = ipf_scanlist(fin, softc->ipf_pass); 2681 2682 if ((pass & FR_NOMATCH)) { 2683 LBUMPD(ipf_stats[out], fr_nom); 2684 } 2685 fr = fin->fin_fr; 2686 2687 /* 2688 * Apply packets per second rate-limiting to a rule as required. 2689 */ 2690 if ((fr != NULL) && (fr->fr_pps != 0) && 2691 !ppsratecheck(&fr->fr_lastpkt, &fr->fr_curpps, fr->fr_pps)) { 2692 DT2(frb_ppsrate, fr_info_t *, fin, frentry_t *, fr); 2693 pass &= ~(FR_CMDMASK|FR_RETICMP|FR_RETRST); 2694 pass |= FR_BLOCK; 2695 LBUMPD(ipf_stats[out], fr_ppshit); 2696 fin->fin_reason = FRB_PPSRATE; 2697 } 2698 2699 /* 2700 * If we fail to add a packet to the authorization queue, then we 2701 * drop the packet later. However, if it was added then pretend 2702 * we've dropped it already. 2703 */ 2704 if (FR_ISAUTH(pass)) { 2705 if (ipf_auth_new(fin->fin_m, fin) != 0) { 2706 DT1(frb_authnew, fr_info_t *, fin); 2707 fin->fin_m = *fin->fin_mp = NULL; 2708 fin->fin_reason = FRB_AUTHNEW; 2709 fin->fin_error = 0; 2710 } else { 2711 IPFERROR(1); 2712 fin->fin_error = ENOSPC; 2713 } 2714 } 2715 2716 if ((fr != NULL) && (fr->fr_func != NULL) && 2717 (fr->fr_func != (ipfunc_t)-1) && !(pass & FR_CALLNOW)) 2718 (void) (*fr->fr_func)(fin, &pass); 2719 2720 /* 2721 * If a rule is a pre-auth rule, check again in the list of rules 2722 * loaded for authenticated use. It does not particulary matter 2723 * if this search fails because a "preauth" result, from a rule, 2724 * is treated as "not a pass", hence the packet is blocked. 2725 */ 2726 if (FR_ISPREAUTH(pass)) { 2727 pass = ipf_auth_pre_scanlist(softc, fin, pass); 2728 } 2729 2730 /* 2731 * If the rule has "keep frag" and the packet is actually a fragment, 2732 * then create a fragment state entry. 2733 */ 2734 if ((pass & (FR_KEEPFRAG|FR_KEEPSTATE)) == FR_KEEPFRAG) { 2735 if (fin->fin_flx & FI_FRAG) { 2736 if (ipf_frag_new(softc, fin, pass) == -1) { 2737 LBUMP(ipf_stats[out].fr_bnfr); 2738 } else { 2739 LBUMP(ipf_stats[out].fr_nfr); 2740 } 2741 } else { 2742 LBUMP(ipf_stats[out].fr_cfr); 2743 } 2744 } 2745 2746 fr = fin->fin_fr; 2747 *passp = pass; 2748 2749 return fr; 2750 } 2751 2752 2753 /* ------------------------------------------------------------------------ */ 2754 /* Function: ipf_check */ 2755 /* Returns: int - 0 == packet allowed through, */ 2756 /* User space: */ 2757 /* -1 == packet blocked */ 2758 /* 1 == packet not matched */ 2759 /* -2 == requires authentication */ 2760 /* Kernel: */ 2761 /* > 0 == filter error # for packet */ 2762 /* Parameters: ip(I) - pointer to start of IPv4/6 packet */ 2763 /* hlen(I) - length of header */ 2764 /* ifp(I) - pointer to interface this packet is on */ 2765 /* out(I) - 0 == packet going in, 1 == packet going out */ 2766 /* mp(IO) - pointer to caller's buffer pointer that holds this */ 2767 /* IP packet. */ 2768 /* Solaris & HP-UX ONLY : */ 2769 /* qpi(I) - pointer to STREAMS queue information for this */ 2770 /* interface & direction. */ 2771 /* */ 2772 /* ipf_check() is the master function for all IPFilter packet processing. */ 2773 /* It orchestrates: Network Address Translation (NAT), checking for packet */ 2774 /* authorisation (or pre-authorisation), presence of related state info., */ 2775 /* generating log entries, IP packet accounting, routing of packets as */ 2776 /* directed by firewall rules and of course whether or not to allow the */ 2777 /* packet to be further processed by the kernel. */ 2778 /* */ 2779 /* For packets blocked, the contents of "mp" will be NULL'd and the buffer */ 2780 /* freed. Packets passed may be returned with the pointer pointed to by */ 2781 /* by "mp" changed to a new buffer. */ 2782 /* ------------------------------------------------------------------------ */ 2783 int 2784 ipf_check(ctx, ip, hlen, ifp, out 2785 #if defined(_KERNEL) && defined(MENTAT) 2786 , qif, mp) 2787 void *qif; 2788 #else 2789 , mp) 2790 #endif 2791 mb_t **mp; 2792 ip_t *ip; 2793 int hlen; 2794 void *ifp; 2795 int out; 2796 void *ctx; 2797 { 2798 /* 2799 * The above really sucks, but short of writing a diff 2800 */ 2801 ipf_main_softc_t *softc = ctx; 2802 fr_info_t frinfo; 2803 fr_info_t *fin = &frinfo; 2804 u_32_t pass = softc->ipf_pass; 2805 frentry_t *fr = NULL; 2806 int v = IP_V(ip); 2807 mb_t *mc = NULL; 2808 mb_t *m; 2809 /* 2810 * The first part of ipf_check() deals with making sure that what goes 2811 * into the filtering engine makes some sense. Information about the 2812 * the packet is distilled, collected into a fr_info_t structure and 2813 * the an attempt to ensure the buffer the packet is in is big enough 2814 * to hold all the required packet headers. 2815 */ 2816 #ifdef _KERNEL 2817 # ifdef MENTAT 2818 qpktinfo_t *qpi = qif; 2819 2820 # ifdef __sparc 2821 if ((u_int)ip & 0x3) 2822 return 2; 2823 # endif 2824 # else 2825 SPL_INT(s); 2826 # endif 2827 2828 if (softc->ipf_running <= 0) { 2829 return 0; 2830 } 2831 2832 bzero((char *)fin, sizeof(*fin)); 2833 2834 # ifdef MENTAT 2835 if (qpi->qpi_flags & QF_GROUP) 2836 fin->fin_flx |= FI_MBCAST; 2837 m = qpi->qpi_m; 2838 fin->fin_qfm = m; 2839 fin->fin_qpi = qpi; 2840 # else /* MENTAT */ 2841 2842 m = *mp; 2843 2844 # if defined(M_MCAST) 2845 if ((m->m_flags & M_MCAST) != 0) 2846 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2847 # endif 2848 # if defined(M_MLOOP) 2849 if ((m->m_flags & M_MLOOP) != 0) 2850 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2851 # endif 2852 # if defined(M_BCAST) 2853 if ((m->m_flags & M_BCAST) != 0) 2854 fin->fin_flx |= FI_MBCAST|FI_BROADCAST; 2855 # endif 2856 # ifdef M_CANFASTFWD 2857 /* 2858 * XXX For now, IP Filter and fast-forwarding of cached flows 2859 * XXX are mutually exclusive. Eventually, IP Filter should 2860 * XXX get a "can-fast-forward" filter rule. 2861 */ 2862 m->m_flags &= ~M_CANFASTFWD; 2863 # endif /* M_CANFASTFWD */ 2864 # if defined(CSUM_DELAY_DATA) && (!defined(__FreeBSD_version) || \ 2865 (__FreeBSD_version < 501108)) 2866 /* 2867 * disable delayed checksums. 2868 */ 2869 if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) { 2870 in_delayed_cksum(m); 2871 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA; 2872 } 2873 # endif /* CSUM_DELAY_DATA */ 2874 # endif /* MENTAT */ 2875 #else 2876 bzero((char *)fin, sizeof(*fin)); 2877 m = *mp; 2878 # if defined(M_MCAST) 2879 if ((m->m_flags & M_MCAST) != 0) 2880 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2881 # endif 2882 # if defined(M_MLOOP) 2883 if ((m->m_flags & M_MLOOP) != 0) 2884 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2885 # endif 2886 # if defined(M_BCAST) 2887 if ((m->m_flags & M_BCAST) != 0) 2888 fin->fin_flx |= FI_MBCAST|FI_BROADCAST; 2889 # endif 2890 #endif /* _KERNEL */ 2891 2892 fin->fin_v = v; 2893 fin->fin_m = m; 2894 fin->fin_ip = ip; 2895 fin->fin_mp = mp; 2896 fin->fin_out = out; 2897 fin->fin_ifp = ifp; 2898 fin->fin_error = ENETUNREACH; 2899 fin->fin_hlen = (u_short)hlen; 2900 fin->fin_dp = (char *)ip + hlen; 2901 fin->fin_main_soft = softc; 2902 2903 fin->fin_ipoff = (char *)ip - MTOD(m, char *); 2904 2905 SPL_NET(s); 2906 2907 #ifdef USE_INET6 2908 if (v == 6) { 2909 LBUMP(ipf_stats[out].fr_ipv6); 2910 /* 2911 * Jumbo grams are quite likely too big for internal buffer 2912 * structures to handle comfortably, for now, so just drop 2913 * them. 2914 */ 2915 if (((ip6_t *)ip)->ip6_plen == 0) { 2916 DT1(frb_jumbo, ip6_t *, (ip6_t *)ip); 2917 pass = FR_BLOCK|FR_NOMATCH; 2918 fin->fin_reason = FRB_JUMBO; 2919 goto finished; 2920 } 2921 fin->fin_family = AF_INET6; 2922 } else 2923 #endif 2924 { 2925 fin->fin_family = AF_INET; 2926 } 2927 2928 if (ipf_makefrip(hlen, ip, fin) == -1) { 2929 DT1(frb_makefrip, fr_info_t *, fin); 2930 pass = FR_BLOCK|FR_NOMATCH; 2931 fin->fin_reason = FRB_MAKEFRIP; 2932 goto finished; 2933 } 2934 2935 /* 2936 * For at least IPv6 packets, if a m_pullup() fails then this pointer 2937 * becomes NULL and so we have no packet to free. 2938 */ 2939 if (*fin->fin_mp == NULL) 2940 goto finished; 2941 2942 if (!out) { 2943 if (v == 4) { 2944 if (softc->ipf_chksrc && !ipf_verifysrc(fin)) { 2945 LBUMPD(ipf_stats[0], fr_v4_badsrc); 2946 fin->fin_flx |= FI_BADSRC; 2947 } 2948 if (fin->fin_ip->ip_ttl < softc->ipf_minttl) { 2949 LBUMPD(ipf_stats[0], fr_v4_badttl); 2950 fin->fin_flx |= FI_LOWTTL; 2951 } 2952 } 2953 #ifdef USE_INET6 2954 else if (v == 6) { 2955 if (((ip6_t *)ip)->ip6_hlim < softc->ipf_minttl) { 2956 LBUMPD(ipf_stats[0], fr_v6_badttl); 2957 fin->fin_flx |= FI_LOWTTL; 2958 } 2959 } 2960 #endif 2961 } 2962 2963 if (fin->fin_flx & FI_SHORT) { 2964 LBUMPD(ipf_stats[out], fr_short); 2965 } 2966 2967 READ_ENTER(&softc->ipf_mutex); 2968 2969 if (!out) { 2970 switch (fin->fin_v) 2971 { 2972 case 4 : 2973 if (ipf_nat_checkin(fin, &pass) == -1) { 2974 goto filterdone; 2975 } 2976 break; 2977 #ifdef USE_INET6 2978 case 6 : 2979 if (ipf_nat6_checkin(fin, &pass) == -1) { 2980 goto filterdone; 2981 } 2982 break; 2983 #endif 2984 default : 2985 break; 2986 } 2987 } 2988 /* 2989 * Check auth now. 2990 * If a packet is found in the auth table, then skip checking 2991 * the access lists for permission but we do need to consider 2992 * the result as if it were from the ACL's. In addition, being 2993 * found in the auth table means it has been seen before, so do 2994 * not pass it through accounting (again), lest it be counted twice. 2995 */ 2996 fr = ipf_auth_check(fin, &pass); 2997 if (!out && (fr == NULL)) 2998 (void) ipf_acctpkt(fin, NULL); 2999 3000 if (fr == NULL) { 3001 if ((fin->fin_flx & FI_FRAG) != 0) 3002 fr = ipf_frag_known(fin, &pass); 3003 3004 if (fr == NULL) 3005 fr = ipf_state_check(fin, &pass); 3006 } 3007 3008 if ((pass & FR_NOMATCH) || (fr == NULL)) 3009 fr = ipf_firewall(fin, &pass); 3010 3011 /* 3012 * If we've asked to track state for this packet, set it up. 3013 * Here rather than ipf_firewall because ipf_checkauth may decide 3014 * to return a packet for "keep state" 3015 */ 3016 if ((pass & FR_KEEPSTATE) && (fin->fin_m != NULL) && 3017 !(fin->fin_flx & FI_STATE)) { 3018 if (ipf_state_add(softc, fin, NULL, 0) == 0) { 3019 LBUMP(ipf_stats[out].fr_ads); 3020 } else { 3021 LBUMP(ipf_stats[out].fr_bads); 3022 if (FR_ISPASS(pass)) { 3023 DT(frb_stateadd); 3024 pass &= ~FR_CMDMASK; 3025 pass |= FR_BLOCK; 3026 fin->fin_reason = FRB_STATEADD; 3027 } 3028 } 3029 } 3030 3031 fin->fin_fr = fr; 3032 if ((fr != NULL) && !(fin->fin_flx & FI_STATE)) { 3033 fin->fin_dif = &fr->fr_dif; 3034 fin->fin_tif = &fr->fr_tifs[fin->fin_rev]; 3035 } 3036 3037 /* 3038 * Only count/translate packets which will be passed on, out the 3039 * interface. 3040 */ 3041 if (out && FR_ISPASS(pass)) { 3042 (void) ipf_acctpkt(fin, NULL); 3043 3044 switch (fin->fin_v) 3045 { 3046 case 4 : 3047 if (ipf_nat_checkout(fin, &pass) == -1) { 3048 ; 3049 } else if ((softc->ipf_update_ipid != 0) && (v == 4)) { 3050 if (ipf_updateipid(fin) == -1) { 3051 DT(frb_updateipid); 3052 LBUMP(ipf_stats[1].fr_ipud); 3053 pass &= ~FR_CMDMASK; 3054 pass |= FR_BLOCK; 3055 fin->fin_reason = FRB_UPDATEIPID; 3056 } else { 3057 LBUMP(ipf_stats[0].fr_ipud); 3058 } 3059 } 3060 break; 3061 #ifdef USE_INET6 3062 case 6 : 3063 (void) ipf_nat6_checkout(fin, &pass); 3064 break; 3065 #endif 3066 default : 3067 break; 3068 } 3069 } 3070 3071 filterdone: 3072 #ifdef IPFILTER_LOG 3073 if ((softc->ipf_flags & FF_LOGGING) || (pass & FR_LOGMASK)) { 3074 (void) ipf_dolog(fin, &pass); 3075 } 3076 #endif 3077 3078 /* 3079 * The FI_STATE flag is cleared here so that calling ipf_state_check 3080 * will work when called from inside of fr_fastroute. Although 3081 * there is a similar flag, FI_NATED, for NAT, it does have the same 3082 * impact on code execution. 3083 */ 3084 fin->fin_flx &= ~FI_STATE; 3085 3086 #if defined(FASTROUTE_RECURSION) 3087 /* 3088 * Up the reference on fr_lock and exit ipf_mutex. The generation of 3089 * a packet below can sometimes cause a recursive call into IPFilter. 3090 * On those platforms where that does happen, we need to hang onto 3091 * the filter rule just in case someone decides to remove or flush it 3092 * in the meantime. 3093 */ 3094 if (fr != NULL) { 3095 MUTEX_ENTER(&fr->fr_lock); 3096 fr->fr_ref++; 3097 MUTEX_EXIT(&fr->fr_lock); 3098 } 3099 3100 RWLOCK_EXIT(&softc->ipf_mutex); 3101 #endif 3102 3103 if ((pass & FR_RETMASK) != 0) { 3104 /* 3105 * Should we return an ICMP packet to indicate error 3106 * status passing through the packet filter ? 3107 * WARNING: ICMP error packets AND TCP RST packets should 3108 * ONLY be sent in repsonse to incoming packets. Sending 3109 * them in response to outbound packets can result in a 3110 * panic on some operating systems. 3111 */ 3112 if (!out) { 3113 if (pass & FR_RETICMP) { 3114 int dst; 3115 3116 if ((pass & FR_RETMASK) == FR_FAKEICMP) 3117 dst = 1; 3118 else 3119 dst = 0; 3120 (void) ipf_send_icmp_err(ICMP_UNREACH, fin, 3121 dst); 3122 LBUMP(ipf_stats[0].fr_ret); 3123 } else if (((pass & FR_RETMASK) == FR_RETRST) && 3124 !(fin->fin_flx & FI_SHORT)) { 3125 if (((fin->fin_flx & FI_OOW) != 0) || 3126 (ipf_send_reset(fin) == 0)) { 3127 LBUMP(ipf_stats[1].fr_ret); 3128 } 3129 } 3130 3131 /* 3132 * When using return-* with auth rules, the auth code 3133 * takes over disposing of this packet. 3134 */ 3135 if (FR_ISAUTH(pass) && (fin->fin_m != NULL)) { 3136 DT1(frb_authcapture, fr_info_t *, fin); 3137 fin->fin_m = *fin->fin_mp = NULL; 3138 fin->fin_reason = FRB_AUTHCAPTURE; 3139 m = NULL; 3140 } 3141 } else { 3142 if (pass & FR_RETRST) { 3143 fin->fin_error = ECONNRESET; 3144 } 3145 } 3146 } 3147 3148 /* 3149 * After the above so that ICMP unreachables and TCP RSTs get 3150 * created properly. 3151 */ 3152 if (FR_ISBLOCK(pass) && (fin->fin_flx & FI_NEWNAT)) 3153 ipf_nat_uncreate(fin); 3154 3155 /* 3156 * If we didn't drop off the bottom of the list of rules (and thus 3157 * the 'current' rule fr is not NULL), then we may have some extra 3158 * instructions about what to do with a packet. 3159 * Once we're finished return to our caller, freeing the packet if 3160 * we are dropping it. 3161 */ 3162 if (fr != NULL) { 3163 frdest_t *fdp; 3164 3165 /* 3166 * Generate a duplicated packet first because ipf_fastroute 3167 * can lead to fin_m being free'd... not good. 3168 */ 3169 fdp = fin->fin_dif; 3170 if ((fdp != NULL) && (fdp->fd_ptr != NULL) && 3171 (fdp->fd_ptr != (void *)-1)) { 3172 mc = M_COPY(fin->fin_m); 3173 if (mc != NULL) 3174 ipf_fastroute(mc, &mc, fin, fdp); 3175 } 3176 3177 fdp = fin->fin_tif; 3178 if (!out && (pass & FR_FASTROUTE)) { 3179 /* 3180 * For fastroute rule, no destination interface defined 3181 * so pass NULL as the frdest_t parameter 3182 */ 3183 (void) ipf_fastroute(fin->fin_m, mp, fin, NULL); 3184 m = *mp = NULL; 3185 } else if ((fdp != NULL) && (fdp->fd_ptr != NULL) && 3186 (fdp->fd_ptr != (struct ifnet *)-1)) { 3187 /* this is for to rules: */ 3188 ipf_fastroute(fin->fin_m, mp, fin, fdp); 3189 m = *mp = NULL; 3190 } 3191 3192 #if defined(FASTROUTE_RECURSION) 3193 (void) ipf_derefrule(softc, &fr); 3194 #endif 3195 } 3196 #if !defined(FASTROUTE_RECURSION) 3197 RWLOCK_EXIT(&softc->ipf_mutex); 3198 #endif 3199 3200 finished: 3201 if (!FR_ISPASS(pass)) { 3202 LBUMP(ipf_stats[out].fr_block); 3203 if (*mp != NULL) { 3204 FREE_MB_T(*mp); 3205 m = *mp = NULL; 3206 } 3207 } else { 3208 LBUMP(ipf_stats[out].fr_pass); 3209 #if defined(_KERNEL) && defined(__sgi) 3210 if ((fin->fin_hbuf != NULL) && 3211 (mtod(fin->fin_m, struct ip *) != fin->fin_ip)) { 3212 COPYBACK(fin->fin_m, 0, fin->fin_plen, fin->fin_hbuf); 3213 } 3214 #endif 3215 } 3216 3217 SPL_X(s); 3218 3219 #ifdef _KERNEL 3220 return (FR_ISPASS(pass)) ? 0 : fin->fin_error; 3221 #else /* _KERNEL */ 3222 if (*mp != NULL) 3223 (*mp)->mb_ifp = fin->fin_ifp; 3224 blockreason = fin->fin_reason; 3225 FR_VERBOSE(("fin_flx %#x pass %#x ", fin->fin_flx, pass)); 3226 /*if ((pass & FR_CMDMASK) == (softc->ipf_pass & FR_CMDMASK))*/ 3227 if ((pass & FR_NOMATCH) != 0) 3228 return 1; 3229 3230 if ((pass & FR_RETMASK) != 0) 3231 switch (pass & FR_RETMASK) 3232 { 3233 case FR_RETRST : 3234 return 3; 3235 case FR_RETICMP : 3236 return 4; 3237 case FR_FAKEICMP : 3238 return 5; 3239 } 3240 3241 switch (pass & FR_CMDMASK) 3242 { 3243 case FR_PASS : 3244 return 0; 3245 case FR_BLOCK : 3246 return -1; 3247 case FR_AUTH : 3248 return -2; 3249 case FR_ACCOUNT : 3250 return -3; 3251 case FR_PREAUTH : 3252 return -4; 3253 } 3254 return 2; 3255 #endif /* _KERNEL */ 3256 } 3257 3258 3259 #ifdef IPFILTER_LOG 3260 /* ------------------------------------------------------------------------ */ 3261 /* Function: ipf_dolog */ 3262 /* Returns: frentry_t* - returns contents of fin_fr (no change made) */ 3263 /* Parameters: fin(I) - pointer to packet information */ 3264 /* passp(IO) - pointer to current/new filter decision (unused) */ 3265 /* */ 3266 /* Checks flags set to see how a packet should be logged, if it is to be */ 3267 /* logged. Adjust statistics based on its success or not. */ 3268 /* ------------------------------------------------------------------------ */ 3269 frentry_t * 3270 ipf_dolog(fin, passp) 3271 fr_info_t *fin; 3272 u_32_t *passp; 3273 { 3274 ipf_main_softc_t *softc = fin->fin_main_soft; 3275 u_32_t pass; 3276 int out; 3277 3278 out = fin->fin_out; 3279 pass = *passp; 3280 3281 if ((softc->ipf_flags & FF_LOGNOMATCH) && (pass & FR_NOMATCH)) { 3282 pass |= FF_LOGNOMATCH; 3283 LBUMPD(ipf_stats[out], fr_npkl); 3284 goto logit; 3285 3286 } else if (((pass & FR_LOGMASK) == FR_LOGP) || 3287 (FR_ISPASS(pass) && (softc->ipf_flags & FF_LOGPASS))) { 3288 if ((pass & FR_LOGMASK) != FR_LOGP) 3289 pass |= FF_LOGPASS; 3290 LBUMPD(ipf_stats[out], fr_ppkl); 3291 goto logit; 3292 3293 } else if (((pass & FR_LOGMASK) == FR_LOGB) || 3294 (FR_ISBLOCK(pass) && (softc->ipf_flags & FF_LOGBLOCK))) { 3295 if ((pass & FR_LOGMASK) != FR_LOGB) 3296 pass |= FF_LOGBLOCK; 3297 LBUMPD(ipf_stats[out], fr_bpkl); 3298 3299 logit: 3300 if (ipf_log_pkt(fin, pass) == -1) { 3301 /* 3302 * If the "or-block" option has been used then 3303 * block the packet if we failed to log it. 3304 */ 3305 if ((pass & FR_LOGORBLOCK) && FR_ISPASS(pass)) { 3306 DT1(frb_logfail2, u_int, pass); 3307 pass &= ~FR_CMDMASK; 3308 pass |= FR_BLOCK; 3309 fin->fin_reason = FRB_LOGFAIL2; 3310 } 3311 } 3312 *passp = pass; 3313 } 3314 3315 return fin->fin_fr; 3316 } 3317 #endif /* IPFILTER_LOG */ 3318 3319 3320 /* ------------------------------------------------------------------------ */ 3321 /* Function: ipf_cksum */ 3322 /* Returns: u_short - IP header checksum */ 3323 /* Parameters: addr(I) - pointer to start of buffer to checksum */ 3324 /* len(I) - length of buffer in bytes */ 3325 /* */ 3326 /* Calculate the two's complement 16 bit checksum of the buffer passed. */ 3327 /* */ 3328 /* N.B.: addr should be 16bit aligned. */ 3329 /* ------------------------------------------------------------------------ */ 3330 u_short 3331 ipf_cksum(addr, len) 3332 u_short *addr; 3333 int len; 3334 { 3335 u_32_t sum = 0; 3336 3337 for (sum = 0; len > 1; len -= 2) 3338 sum += *addr++; 3339 3340 /* mop up an odd byte, if necessary */ 3341 if (len == 1) 3342 sum += *(u_char *)addr; 3343 3344 /* 3345 * add back carry outs from top 16 bits to low 16 bits 3346 */ 3347 sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */ 3348 sum += (sum >> 16); /* add carry */ 3349 return (u_short)(~sum); 3350 } 3351 3352 3353 /* ------------------------------------------------------------------------ */ 3354 /* Function: fr_cksum */ 3355 /* Returns: u_short - layer 4 checksum */ 3356 /* Parameters: fin(I) - pointer to packet information */ 3357 /* ip(I) - pointer to IP header */ 3358 /* l4proto(I) - protocol to caclulate checksum for */ 3359 /* l4hdr(I) - pointer to layer 4 header */ 3360 /* */ 3361 /* Calculates the TCP checksum for the packet held in "m", using the data */ 3362 /* in the IP header "ip" to seed it. */ 3363 /* */ 3364 /* NB: This function assumes we've pullup'd enough for all of the IP header */ 3365 /* and the TCP header. We also assume that data blocks aren't allocated in */ 3366 /* odd sizes. */ 3367 /* */ 3368 /* Expects ip_len and ip_off to be in network byte order when called. */ 3369 /* ------------------------------------------------------------------------ */ 3370 u_short 3371 fr_cksum(fin, ip, l4proto, l4hdr) 3372 fr_info_t *fin; 3373 ip_t *ip; 3374 int l4proto; 3375 void *l4hdr; 3376 { 3377 u_short *sp, slen, sumsave, *csump; 3378 u_int sum, sum2; 3379 int hlen; 3380 int off; 3381 #ifdef USE_INET6 3382 ip6_t *ip6; 3383 #endif 3384 3385 csump = NULL; 3386 sumsave = 0; 3387 sp = NULL; 3388 slen = 0; 3389 hlen = 0; 3390 sum = 0; 3391 3392 sum = htons((u_short)l4proto); 3393 /* 3394 * Add up IP Header portion 3395 */ 3396 #ifdef USE_INET6 3397 if (IP_V(ip) == 4) { 3398 #endif 3399 hlen = IP_HL(ip) << 2; 3400 off = hlen; 3401 sp = (u_short *)&ip->ip_src; 3402 sum += *sp++; /* ip_src */ 3403 sum += *sp++; 3404 sum += *sp++; /* ip_dst */ 3405 sum += *sp++; 3406 #ifdef USE_INET6 3407 } else if (IP_V(ip) == 6) { 3408 ip6 = (ip6_t *)ip; 3409 hlen = sizeof(*ip6); 3410 off = ((char *)fin->fin_dp - (char *)fin->fin_ip); 3411 sp = (u_short *)&ip6->ip6_src; 3412 sum += *sp++; /* ip6_src */ 3413 sum += *sp++; 3414 sum += *sp++; 3415 sum += *sp++; 3416 sum += *sp++; 3417 sum += *sp++; 3418 sum += *sp++; 3419 sum += *sp++; 3420 sum += *sp++; /* ip6_dst */ 3421 sum += *sp++; 3422 sum += *sp++; 3423 sum += *sp++; 3424 sum += *sp++; 3425 sum += *sp++; 3426 sum += *sp++; 3427 sum += *sp++; 3428 } else { 3429 return 0xffff; 3430 } 3431 #endif 3432 slen = fin->fin_plen - off; 3433 sum += htons(slen); 3434 3435 switch (l4proto) 3436 { 3437 case IPPROTO_UDP : 3438 csump = &((udphdr_t *)l4hdr)->uh_sum; 3439 break; 3440 3441 case IPPROTO_TCP : 3442 csump = &((tcphdr_t *)l4hdr)->th_sum; 3443 break; 3444 case IPPROTO_ICMP : 3445 csump = &((icmphdr_t *)l4hdr)->icmp_cksum; 3446 sum = 0; /* Pseudo-checksum is not included */ 3447 break; 3448 default : 3449 break; 3450 } 3451 3452 if (csump != NULL) { 3453 sumsave = *csump; 3454 *csump = 0; 3455 } 3456 3457 sum2 = ipf_pcksum(fin, off, sum); 3458 if (csump != NULL) 3459 *csump = sumsave; 3460 return sum2; 3461 } 3462 3463 3464 /* ------------------------------------------------------------------------ */ 3465 /* Function: ipf_findgroup */ 3466 /* Returns: frgroup_t * - NULL = group not found, else pointer to group */ 3467 /* Parameters: group(I) - group name to search for */ 3468 /* unit(I) - device to which this group belongs */ 3469 /* set(I) - which set of rules (inactive/inactive) this is */ 3470 /* fgpp(O) - pointer to place to store pointer to the pointer */ 3471 /* to where to add the next (last) group or where */ 3472 /* to delete group from. */ 3473 /* */ 3474 /* Search amongst the defined groups for a particular group number. */ 3475 /* ------------------------------------------------------------------------ */ 3476 frgroup_t * 3477 ipf_findgroup(softc, group, unit, set, fgpp) 3478 ipf_main_softc_t *softc; 3479 char *group; 3480 minor_t unit; 3481 int set; 3482 frgroup_t ***fgpp; 3483 { 3484 frgroup_t *fg, **fgp; 3485 3486 /* 3487 * Which list of groups to search in is dependent on which list of 3488 * rules are being operated on. 3489 */ 3490 fgp = &softc->ipf_groups[unit][set]; 3491 3492 while ((fg = *fgp) != NULL) { 3493 if (strncmp(group, fg->fg_name, FR_GROUPLEN) == 0) 3494 break; 3495 else 3496 fgp = &fg->fg_next; 3497 } 3498 if (fgpp != NULL) 3499 *fgpp = fgp; 3500 return fg; 3501 } 3502 3503 3504 /* ------------------------------------------------------------------------ */ 3505 /* Function: ipf_group_add */ 3506 /* Returns: frgroup_t * - NULL == did not create group, */ 3507 /* != NULL == pointer to the group */ 3508 /* Parameters: num(I) - group number to add */ 3509 /* head(I) - rule pointer that is using this as the head */ 3510 /* flags(I) - rule flags which describe the type of rule it is */ 3511 /* unit(I) - device to which this group will belong to */ 3512 /* set(I) - which set of rules (inactive/inactive) this is */ 3513 /* Write Locks: ipf_mutex */ 3514 /* */ 3515 /* Add a new group head, or if it already exists, increase the reference */ 3516 /* count to it. */ 3517 /* ------------------------------------------------------------------------ */ 3518 frgroup_t * 3519 ipf_group_add(softc, group, head, flags, unit, set) 3520 ipf_main_softc_t *softc; 3521 char *group; 3522 void *head; 3523 u_32_t flags; 3524 minor_t unit; 3525 int set; 3526 { 3527 frgroup_t *fg, **fgp; 3528 u_32_t gflags; 3529 3530 if (group == NULL) 3531 return NULL; 3532 3533 if (unit == IPL_LOGIPF && *group == '\0') 3534 return NULL; 3535 3536 fgp = NULL; 3537 gflags = flags & FR_INOUT; 3538 3539 fg = ipf_findgroup(softc, group, unit, set, &fgp); 3540 if (fg != NULL) { 3541 if (fg->fg_flags == 0) 3542 fg->fg_flags = gflags; 3543 else if (gflags != fg->fg_flags) 3544 return NULL; 3545 fg->fg_ref++; 3546 return fg; 3547 } 3548 3549 KMALLOC(fg, frgroup_t *); 3550 if (fg != NULL) { 3551 fg->fg_head = head; 3552 fg->fg_start = NULL; 3553 fg->fg_next = *fgp; 3554 bcopy(group, fg->fg_name, strlen(group) + 1); 3555 fg->fg_flags = gflags; 3556 fg->fg_ref = 1; 3557 *fgp = fg; 3558 } 3559 return fg; 3560 } 3561 3562 3563 /* ------------------------------------------------------------------------ */ 3564 /* Function: ipf_group_del */ 3565 /* Returns: int - number of rules deleted */ 3566 /* Parameters: group(I) - group name to delete */ 3567 /* unit(I) - device to which this group belongs */ 3568 /* set(I) - which set of rules (inactive/inactive) this is */ 3569 /* Write Locks: ipf_mutex */ 3570 /* */ 3571 /* Attempt to delete a group head. */ 3572 /* Only do this when its reference count reaches 0. */ 3573 /* ------------------------------------------------------------------------ */ 3574 int 3575 ipf_group_del(softc, group, unit, set) 3576 ipf_main_softc_t *softc; 3577 char *group; 3578 minor_t unit; 3579 int set; 3580 { 3581 frgroup_t *fg, **fgp; 3582 int gone = 0; 3583 3584 fg = ipf_findgroup(softc, group, unit, set, &fgp); 3585 if (fg == NULL) 3586 return 0; 3587 3588 fg->fg_ref--; 3589 if (fg->fg_ref == 0) { 3590 3591 (void) ipf_flushlist(softc, set, unit, &gone, &fg->fg_start); 3592 *fgp = fg->fg_next; 3593 KFREE(fg); 3594 } 3595 3596 return gone; 3597 } 3598 3599 3600 /* ------------------------------------------------------------------------ */ 3601 /* Function: ipf_getrulen */ 3602 /* Returns: frentry_t * - NULL == not found, else pointer to rule n */ 3603 /* Parameters: unit(I) - device for which to count the rule's number */ 3604 /* flags(I) - which set of rules to find the rule in */ 3605 /* group(I) - group name */ 3606 /* n(I) - rule number to find */ 3607 /* */ 3608 /* Find rule # n in group # g and return a pointer to it. Return NULl if */ 3609 /* group # g doesn't exist or there are less than n rules in the group. */ 3610 /* ------------------------------------------------------------------------ */ 3611 frentry_t * 3612 ipf_getrulen(softc, unit, group, n) 3613 ipf_main_softc_t *softc; 3614 int unit; 3615 char *group; 3616 u_32_t n; 3617 { 3618 frentry_t *fr; 3619 frgroup_t *fg; 3620 3621 fg = ipf_findgroup(softc, group, unit, softc->ipf_active, NULL); 3622 if (fg == NULL) 3623 return NULL; 3624 for (fr = fg->fg_start; fr && n; fr = fr->fr_next, n--) 3625 ; 3626 if (n != 0) 3627 return NULL; 3628 return fr; 3629 } 3630 3631 3632 /* ------------------------------------------------------------------------ */ 3633 /* Function: ipf_flushlist */ 3634 /* Returns: int - >= 0 - number of flushed rules */ 3635 /* Parameters: set(I) - which set of rules (inactive/inactive) this is */ 3636 /* unit(I) - device for which to flush rules */ 3637 /* flags(I) - which set of rules to flush */ 3638 /* nfreedp(O) - pointer to int where flush count is stored */ 3639 /* listp(I) - pointer to list to flush pointer */ 3640 /* Write Locks: ipf_mutex */ 3641 /* */ 3642 /* Recursively flush rules from the list, descending groups as they are */ 3643 /* encountered. if a rule is the head of a group and it has lost all its */ 3644 /* group members, then also delete the group reference. nfreedp is needed */ 3645 /* to store the accumulating count of rules removed, whereas the returned */ 3646 /* value is just the number removed from the current list. The latter is */ 3647 /* needed to correctly adjust reference counts on rules that define groups. */ 3648 /* */ 3649 /* NOTE: Rules not loaded from user space cannot be flushed. */ 3650 /* ------------------------------------------------------------------------ */ 3651 static int 3652 ipf_flushlist(softc, set, unit, nfreedp, listp) 3653 ipf_main_softc_t *softc; 3654 int set; 3655 minor_t unit; 3656 int *nfreedp; 3657 frentry_t **listp; 3658 { 3659 int freed = 0; 3660 frentry_t *fp; 3661 3662 while ((fp = *listp) != NULL) { 3663 if ((fp->fr_type & FR_T_BUILTIN) || 3664 !(fp->fr_flags & FR_COPIED)) { 3665 listp = &fp->fr_next; 3666 continue; 3667 } 3668 *listp = fp->fr_next; 3669 if (fp->fr_next != NULL) 3670 fp->fr_next->fr_pnext = fp->fr_pnext; 3671 fp->fr_pnext = NULL; 3672 3673 if (fp->fr_grp != NULL) { 3674 ipf_flushlist(softc, set, unit, nfreedp, fp->fr_grp); 3675 } 3676 if (fp->fr_icmpgrp != NULL) { 3677 ipf_flushlist(softc, set, unit, nfreedp, 3678 fp->fr_icmpgrp); 3679 } 3680 3681 if (fp->fr_grhead != -1) { 3682 freed += ipf_group_del(softc, 3683 FR_NAME(fp, fr_grhead), 3684 unit, set); 3685 fp->fr_names[fp->fr_grhead] = '\0'; 3686 } 3687 3688 if (fp->fr_icmphead != -1) { 3689 freed += ipf_group_del(softc, 3690 FR_NAME(fp, fr_icmphead), 3691 unit, set); 3692 fp->fr_names[fp->fr_icmphead] = '\0'; 3693 } 3694 3695 if (fp->fr_srctrack.ht_max_nodes) 3696 ipf_rb_ht_flush(&fp->fr_srctrack); 3697 3698 fp->fr_next = NULL; 3699 3700 ASSERT(fp->fr_ref > 0); 3701 if (ipf_derefrule(softc, &fp) == 0) 3702 freed++; 3703 } 3704 *nfreedp += freed; 3705 return freed; 3706 } 3707 3708 3709 /* ------------------------------------------------------------------------ */ 3710 /* Function: ipf_flush */ 3711 /* Returns: int - >= 0 - number of flushed rules */ 3712 /* Parameters: unit(I) - device for which to flush rules */ 3713 /* flags(I) - which set of rules to flush */ 3714 /* */ 3715 /* Calls flushlist() for all filter rules (accounting, firewall - both IPv4 */ 3716 /* and IPv6) as defined by the value of flags. */ 3717 /* ------------------------------------------------------------------------ */ 3718 int 3719 ipf_flush(softc, unit, flags) 3720 ipf_main_softc_t *softc; 3721 minor_t unit; 3722 int flags; 3723 { 3724 int flushed = 0, set; 3725 3726 WRITE_ENTER(&softc->ipf_mutex); 3727 3728 set = softc->ipf_active; 3729 if ((flags & FR_INACTIVE) == FR_INACTIVE) 3730 set = 1 - set; 3731 3732 if (flags & FR_OUTQUE) { 3733 ipf_flushlist(softc, set, unit, &flushed, 3734 &softc->ipf_rules[1][set]); 3735 ipf_flushlist(softc, set, unit, &flushed, 3736 &softc->ipf_acct[1][set]); 3737 } 3738 if (flags & FR_INQUE) { 3739 ipf_flushlist(softc, set, unit, &flushed, 3740 &softc->ipf_rules[0][set]); 3741 ipf_flushlist(softc, set, unit, &flushed, 3742 &softc->ipf_acct[0][set]); 3743 } 3744 3745 flushed += ipf_flush_groups(softc, unit, set, 3746 flags & (FR_INQUE|FR_OUTQUE)); 3747 3748 RWLOCK_EXIT(&softc->ipf_mutex); 3749 3750 if (unit == IPL_LOGIPF) { 3751 int tmp; 3752 3753 tmp = ipf_flush(softc, IPL_LOGCOUNT, flags); 3754 if (tmp >= 0) 3755 flushed += tmp; 3756 } 3757 return flushed; 3758 } 3759 3760 3761 /* ------------------------------------------------------------------------ */ 3762 /* Function: ipf_flush_groups */ 3763 /* Returns: int - >= 0 - number of flushed rules */ 3764 /* Parameters: softc(I) - soft context pointerto work with */ 3765 /* unit(I) - device for which to flush rules */ 3766 /* set(I) - 1 or 0 (filter set) */ 3767 /* flags(I) - which set of rules to flush */ 3768 /* */ 3769 /* Walk through all of the groups for the given unit and remove those that */ 3770 /* match the flags passed in the correct set. Which set (either 1 or 0) is */ 3771 /* determined from a combination of softc->ipf_active and whether or not */ 3772 /* we are flushing active/inactive. */ 3773 /* ------------------------------------------------------------------------ */ 3774 static int 3775 ipf_flush_groups(softc, unit, set, flags) 3776 ipf_main_softc_t *softc; 3777 int unit, set, flags; 3778 { 3779 frgroup_t *fg, **fgp; 3780 frentry_t *fr, **frp; 3781 int flushed = 0; 3782 3783 fgp = &softc->ipf_groups[unit][set]; 3784 while ((fg = *fgp) != NULL) { 3785 frp = &fg->fg_start; 3786 while ((fr = *frp) != NULL) { 3787 if ((fr->fr_flags & flags) == 0) { 3788 frp = &fr->fr_next; 3789 continue; 3790 } 3791 if (fr->fr_next != NULL) 3792 fr->fr_next->fr_pnext = fr->fr_pnext; 3793 fr->fr_pnext = NULL; 3794 *frp = fr->fr_next; 3795 (void) ipf_derefrule(softc, &fr); 3796 flushed++; 3797 } 3798 3799 if (fg->fg_head != NULL) { 3800 if (fg->fg_head->fr_grp == &fg->fg_start) 3801 fg->fg_head->fr_grp = NULL; 3802 if (fg->fg_head->fr_icmpgrp == &fg->fg_start) 3803 fg->fg_head->fr_icmpgrp = NULL; 3804 } 3805 *fgp = fg->fg_next; 3806 KFREE(fg); 3807 } 3808 return flushed; 3809 } 3810 3811 3812 /* ------------------------------------------------------------------------ */ 3813 /* Function: memstr */ 3814 /* Returns: char * - NULL if failed, != NULL pointer to matching bytes */ 3815 /* Parameters: src(I) - pointer to byte sequence to match */ 3816 /* dst(I) - pointer to byte sequence to search */ 3817 /* slen(I) - match length */ 3818 /* dlen(I) - length available to search in */ 3819 /* */ 3820 /* Search dst for a sequence of bytes matching those at src and extend for */ 3821 /* slen bytes. */ 3822 /* ------------------------------------------------------------------------ */ 3823 char * 3824 memstr(src, dst, slen, dlen) 3825 const char *src; 3826 char *dst; 3827 size_t slen, dlen; 3828 { 3829 char *s = NULL; 3830 3831 while (dlen >= slen) { 3832 if (bcmp(src, dst, slen) == 0) { 3833 s = dst; 3834 break; 3835 } 3836 dst++; 3837 dlen--; 3838 } 3839 return s; 3840 } 3841 /* ------------------------------------------------------------------------ */ 3842 /* Function: ipf_fixskip */ 3843 /* Returns: Nil */ 3844 /* Parameters: listp(IO) - pointer to start of list with skip rule */ 3845 /* rp(I) - rule added/removed with skip in it. */ 3846 /* addremove(I) - adjustment (-1/+1) to make to skip count, */ 3847 /* depending on whether a rule was just added */ 3848 /* or removed. */ 3849 /* */ 3850 /* Adjust all the rules in a list which would have skip'd past the position */ 3851 /* where we are inserting to skip to the right place given the change. */ 3852 /* ------------------------------------------------------------------------ */ 3853 void 3854 ipf_fixskip(listp, rp, addremove) 3855 frentry_t **listp, *rp; 3856 int addremove; 3857 { 3858 int rules, rn; 3859 frentry_t *fp; 3860 3861 rules = 0; 3862 for (fp = *listp; (fp != NULL) && (fp != rp); fp = fp->fr_next) 3863 rules++; 3864 3865 if (!fp) 3866 return; 3867 3868 for (rn = 0, fp = *listp; fp && (fp != rp); fp = fp->fr_next, rn++) 3869 if (FR_ISSKIP(fp->fr_flags) && (rn + fp->fr_arg >= rules)) 3870 fp->fr_arg += addremove; 3871 } 3872 3873 3874 #ifdef _KERNEL 3875 /* ------------------------------------------------------------------------ */ 3876 /* Function: count4bits */ 3877 /* Returns: int - >= 0 - number of consecutive bits in input */ 3878 /* Parameters: ip(I) - 32bit IP address */ 3879 /* */ 3880 /* IPv4 ONLY */ 3881 /* count consecutive 1's in bit mask. If the mask generated by counting */ 3882 /* consecutive 1's is different to that passed, return -1, else return # */ 3883 /* of bits. */ 3884 /* ------------------------------------------------------------------------ */ 3885 int 3886 count4bits(ip) 3887 u_32_t ip; 3888 { 3889 u_32_t ipn; 3890 int cnt = 0, i, j; 3891 3892 ip = ipn = ntohl(ip); 3893 for (i = 32; i; i--, ipn *= 2) 3894 if (ipn & 0x80000000) 3895 cnt++; 3896 else 3897 break; 3898 ipn = 0; 3899 for (i = 32, j = cnt; i; i--, j--) { 3900 ipn *= 2; 3901 if (j > 0) 3902 ipn++; 3903 } 3904 if (ipn == ip) 3905 return cnt; 3906 return -1; 3907 } 3908 3909 3910 /* ------------------------------------------------------------------------ */ 3911 /* Function: count6bits */ 3912 /* Returns: int - >= 0 - number of consecutive bits in input */ 3913 /* Parameters: msk(I) - pointer to start of IPv6 bitmask */ 3914 /* */ 3915 /* IPv6 ONLY */ 3916 /* count consecutive 1's in bit mask. */ 3917 /* ------------------------------------------------------------------------ */ 3918 # ifdef USE_INET6 3919 int 3920 count6bits(msk) 3921 u_32_t *msk; 3922 { 3923 int i = 0, k; 3924 u_32_t j; 3925 3926 for (k = 3; k >= 0; k--) 3927 if (msk[k] == 0xffffffff) 3928 i += 32; 3929 else { 3930 for (j = msk[k]; j; j <<= 1) 3931 if (j & 0x80000000) 3932 i++; 3933 } 3934 return i; 3935 } 3936 # endif 3937 #endif /* _KERNEL */ 3938 3939 3940 /* ------------------------------------------------------------------------ */ 3941 /* Function: ipf_synclist */ 3942 /* Returns: int - 0 = no failures, else indication of first failure */ 3943 /* Parameters: fr(I) - start of filter list to sync interface names for */ 3944 /* ifp(I) - interface pointer for limiting sync lookups */ 3945 /* Write Locks: ipf_mutex */ 3946 /* */ 3947 /* Walk through a list of filter rules and resolve any interface names into */ 3948 /* pointers. Where dynamic addresses are used, also update the IP address */ 3949 /* used in the rule. The interface pointer is used to limit the lookups to */ 3950 /* a specific set of matching names if it is non-NULL. */ 3951 /* Errors can occur when resolving the destination name of to/dup-to fields */ 3952 /* when the name points to a pool and that pool doest not exist. If this */ 3953 /* does happen then it is necessary to check if there are any lookup refs */ 3954 /* that need to be dropped before returning with an error. */ 3955 /* ------------------------------------------------------------------------ */ 3956 static int 3957 ipf_synclist(softc, fr, ifp) 3958 ipf_main_softc_t *softc; 3959 frentry_t *fr; 3960 void *ifp; 3961 { 3962 frentry_t *frt, *start = fr; 3963 frdest_t *fdp; 3964 char *name; 3965 int error; 3966 void *ifa; 3967 int v, i; 3968 3969 error = 0; 3970 3971 for (; fr; fr = fr->fr_next) { 3972 if (fr->fr_family == AF_INET) 3973 v = 4; 3974 else if (fr->fr_family == AF_INET6) 3975 v = 6; 3976 else 3977 v = 0; 3978 3979 /* 3980 * Lookup all the interface names that are part of the rule. 3981 */ 3982 for (i = 0; i < 4; i++) { 3983 if ((ifp != NULL) && (fr->fr_ifas[i] != ifp)) 3984 continue; 3985 if (fr->fr_ifnames[i] == -1) 3986 continue; 3987 name = FR_NAME(fr, fr_ifnames[i]); 3988 fr->fr_ifas[i] = ipf_resolvenic(softc, name, v); 3989 } 3990 3991 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) { 3992 if (fr->fr_satype != FRI_NORMAL && 3993 fr->fr_satype != FRI_LOOKUP) { 3994 ifa = ipf_resolvenic(softc, fr->fr_names + 3995 fr->fr_sifpidx, v); 3996 ipf_ifpaddr(softc, v, fr->fr_satype, ifa, 3997 &fr->fr_src6, &fr->fr_smsk6); 3998 } 3999 if (fr->fr_datype != FRI_NORMAL && 4000 fr->fr_datype != FRI_LOOKUP) { 4001 ifa = ipf_resolvenic(softc, fr->fr_names + 4002 fr->fr_sifpidx, v); 4003 ipf_ifpaddr(softc, v, fr->fr_datype, ifa, 4004 &fr->fr_dst6, &fr->fr_dmsk6); 4005 } 4006 } 4007 4008 fdp = &fr->fr_tifs[0]; 4009 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) { 4010 error = ipf_resolvedest(softc, fr->fr_names, fdp, v); 4011 if (error != 0) 4012 goto unwind; 4013 } 4014 4015 fdp = &fr->fr_tifs[1]; 4016 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) { 4017 error = ipf_resolvedest(softc, fr->fr_names, fdp, v); 4018 if (error != 0) 4019 goto unwind; 4020 } 4021 4022 fdp = &fr->fr_dif; 4023 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) { 4024 error = ipf_resolvedest(softc, fr->fr_names, fdp, v); 4025 if (error != 0) 4026 goto unwind; 4027 } 4028 4029 if (((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4030 (fr->fr_satype == FRI_LOOKUP) && (fr->fr_srcptr == NULL)) { 4031 fr->fr_srcptr = ipf_lookup_res_num(softc, 4032 fr->fr_srctype, 4033 IPL_LOGIPF, 4034 fr->fr_srcnum, 4035 &fr->fr_srcfunc); 4036 } 4037 if (((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4038 (fr->fr_datype == FRI_LOOKUP) && (fr->fr_dstptr == NULL)) { 4039 fr->fr_dstptr = ipf_lookup_res_num(softc, 4040 fr->fr_dsttype, 4041 IPL_LOGIPF, 4042 fr->fr_dstnum, 4043 &fr->fr_dstfunc); 4044 } 4045 } 4046 return 0; 4047 4048 unwind: 4049 for (frt = start; frt != fr; fr = fr->fr_next) { 4050 if (((frt->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4051 (frt->fr_satype == FRI_LOOKUP) && (frt->fr_srcptr != NULL)) 4052 ipf_lookup_deref(softc, frt->fr_srctype, 4053 frt->fr_srcptr); 4054 if (((frt->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4055 (frt->fr_datype == FRI_LOOKUP) && (frt->fr_dstptr != NULL)) 4056 ipf_lookup_deref(softc, frt->fr_dsttype, 4057 frt->fr_dstptr); 4058 } 4059 return error; 4060 } 4061 4062 4063 /* ------------------------------------------------------------------------ */ 4064 /* Function: ipf_sync */ 4065 /* Returns: void */ 4066 /* Parameters: Nil */ 4067 /* */ 4068 /* ipf_sync() is called when we suspect that the interface list or */ 4069 /* information about interfaces (like IP#) has changed. Go through all */ 4070 /* filter rules, NAT entries and the state table and check if anything */ 4071 /* needs to be changed/updated. */ 4072 /* ------------------------------------------------------------------------ */ 4073 int 4074 ipf_sync(softc, ifp) 4075 ipf_main_softc_t *softc; 4076 void *ifp; 4077 { 4078 int i; 4079 4080 # if !SOLARIS 4081 ipf_nat_sync(softc, ifp); 4082 ipf_state_sync(softc, ifp); 4083 ipf_lookup_sync(softc, ifp); 4084 # endif 4085 4086 WRITE_ENTER(&softc->ipf_mutex); 4087 (void) ipf_synclist(softc, softc->ipf_acct[0][softc->ipf_active], ifp); 4088 (void) ipf_synclist(softc, softc->ipf_acct[1][softc->ipf_active], ifp); 4089 (void) ipf_synclist(softc, softc->ipf_rules[0][softc->ipf_active], ifp); 4090 (void) ipf_synclist(softc, softc->ipf_rules[1][softc->ipf_active], ifp); 4091 4092 for (i = 0; i < IPL_LOGSIZE; i++) { 4093 frgroup_t *g; 4094 4095 for (g = softc->ipf_groups[i][0]; g != NULL; g = g->fg_next) 4096 (void) ipf_synclist(softc, g->fg_start, ifp); 4097 for (g = softc->ipf_groups[i][1]; g != NULL; g = g->fg_next) 4098 (void) ipf_synclist(softc, g->fg_start, ifp); 4099 } 4100 RWLOCK_EXIT(&softc->ipf_mutex); 4101 4102 return 0; 4103 } 4104 4105 4106 /* 4107 * In the functions below, bcopy() is called because the pointer being 4108 * copied _from_ in this instance is a pointer to a char buf (which could 4109 * end up being unaligned) and on the kernel's local stack. 4110 */ 4111 /* ------------------------------------------------------------------------ */ 4112 /* Function: copyinptr */ 4113 /* Returns: int - 0 = success, else failure */ 4114 /* Parameters: src(I) - pointer to the source address */ 4115 /* dst(I) - destination address */ 4116 /* size(I) - number of bytes to copy */ 4117 /* */ 4118 /* Copy a block of data in from user space, given a pointer to the pointer */ 4119 /* to start copying from (src) and a pointer to where to store it (dst). */ 4120 /* NB: src - pointer to user space pointer, dst - kernel space pointer */ 4121 /* ------------------------------------------------------------------------ */ 4122 int 4123 copyinptr(softc, src, dst, size) 4124 ipf_main_softc_t *softc; 4125 void *src, *dst; 4126 size_t size; 4127 { 4128 caddr_t ca; 4129 int error; 4130 4131 # if SOLARIS 4132 error = COPYIN(src, &ca, sizeof(ca)); 4133 if (error != 0) 4134 return error; 4135 # else 4136 bcopy(src, (caddr_t)&ca, sizeof(ca)); 4137 # endif 4138 error = COPYIN(ca, dst, size); 4139 if (error != 0) { 4140 IPFERROR(3); 4141 error = EFAULT; 4142 } 4143 return error; 4144 } 4145 4146 4147 /* ------------------------------------------------------------------------ */ 4148 /* Function: copyoutptr */ 4149 /* Returns: int - 0 = success, else failure */ 4150 /* Parameters: src(I) - pointer to the source address */ 4151 /* dst(I) - destination address */ 4152 /* size(I) - number of bytes to copy */ 4153 /* */ 4154 /* Copy a block of data out to user space, given a pointer to the pointer */ 4155 /* to start copying from (src) and a pointer to where to store it (dst). */ 4156 /* NB: src - kernel space pointer, dst - pointer to user space pointer. */ 4157 /* ------------------------------------------------------------------------ */ 4158 int 4159 copyoutptr(softc, src, dst, size) 4160 ipf_main_softc_t *softc; 4161 void *src, *dst; 4162 size_t size; 4163 { 4164 caddr_t ca; 4165 int error; 4166 4167 bcopy(dst, (caddr_t)&ca, sizeof(ca)); 4168 error = COPYOUT(src, ca, size); 4169 if (error != 0) { 4170 IPFERROR(4); 4171 error = EFAULT; 4172 } 4173 return error; 4174 } 4175 #ifdef _KERNEL 4176 #endif 4177 4178 4179 /* ------------------------------------------------------------------------ */ 4180 /* Function: ipf_lock */ 4181 /* Returns: int - 0 = success, else error */ 4182 /* Parameters: data(I) - pointer to lock value to set */ 4183 /* lockp(O) - pointer to location to store old lock value */ 4184 /* */ 4185 /* Get the new value for the lock integer, set it and return the old value */ 4186 /* in *lockp. */ 4187 /* ------------------------------------------------------------------------ */ 4188 int 4189 ipf_lock(data, lockp) 4190 caddr_t data; 4191 int *lockp; 4192 { 4193 int arg, err; 4194 4195 err = BCOPYIN(data, &arg, sizeof(arg)); 4196 if (err != 0) 4197 return EFAULT; 4198 err = BCOPYOUT(lockp, data, sizeof(*lockp)); 4199 if (err != 0) 4200 return EFAULT; 4201 *lockp = arg; 4202 return 0; 4203 } 4204 4205 4206 /* ------------------------------------------------------------------------ */ 4207 /* Function: ipf_getstat */ 4208 /* Returns: Nil */ 4209 /* Parameters: softc(I) - pointer to soft context main structure */ 4210 /* fiop(I) - pointer to ipfilter stats structure */ 4211 /* rev(I) - version claim by program doing ioctl */ 4212 /* */ 4213 /* Stores a copy of current pointers, counters, etc, in the friostat */ 4214 /* structure. */ 4215 /* If IPFILTER_COMPAT is compiled, we pretend to be whatever version the */ 4216 /* program is looking for. This ensure that validation of the version it */ 4217 /* expects will always succeed. Thus kernels with IPFILTER_COMPAT will */ 4218 /* allow older binaries to work but kernels without it will not. */ 4219 /* ------------------------------------------------------------------------ */ 4220 /*ARGSUSED*/ 4221 static void 4222 ipf_getstat(softc, fiop, rev) 4223 ipf_main_softc_t *softc; 4224 friostat_t *fiop; 4225 int rev; 4226 { 4227 int i; 4228 4229 bcopy((char *)softc->ipf_stats, (char *)fiop->f_st, 4230 sizeof(ipf_statistics_t) * 2); 4231 fiop->f_locks[IPL_LOGSTATE] = -1; 4232 fiop->f_locks[IPL_LOGNAT] = -1; 4233 fiop->f_locks[IPL_LOGIPF] = -1; 4234 fiop->f_locks[IPL_LOGAUTH] = -1; 4235 4236 fiop->f_ipf[0][0] = softc->ipf_rules[0][0]; 4237 fiop->f_acct[0][0] = softc->ipf_acct[0][0]; 4238 fiop->f_ipf[0][1] = softc->ipf_rules[0][1]; 4239 fiop->f_acct[0][1] = softc->ipf_acct[0][1]; 4240 fiop->f_ipf[1][0] = softc->ipf_rules[1][0]; 4241 fiop->f_acct[1][0] = softc->ipf_acct[1][0]; 4242 fiop->f_ipf[1][1] = softc->ipf_rules[1][1]; 4243 fiop->f_acct[1][1] = softc->ipf_acct[1][1]; 4244 4245 fiop->f_ticks = softc->ipf_ticks; 4246 fiop->f_active = softc->ipf_active; 4247 fiop->f_froute[0] = softc->ipf_frouteok[0]; 4248 fiop->f_froute[1] = softc->ipf_frouteok[1]; 4249 fiop->f_rb_no_mem = softc->ipf_rb_no_mem; 4250 fiop->f_rb_node_max = softc->ipf_rb_node_max; 4251 4252 fiop->f_running = softc->ipf_running; 4253 for (i = 0; i < IPL_LOGSIZE; i++) { 4254 fiop->f_groups[i][0] = softc->ipf_groups[i][0]; 4255 fiop->f_groups[i][1] = softc->ipf_groups[i][1]; 4256 } 4257 #ifdef IPFILTER_LOG 4258 fiop->f_log_ok = ipf_log_logok(softc, IPL_LOGIPF); 4259 fiop->f_log_fail = ipf_log_failures(softc, IPL_LOGIPF); 4260 fiop->f_logging = 1; 4261 #else 4262 fiop->f_log_ok = 0; 4263 fiop->f_log_fail = 0; 4264 fiop->f_logging = 0; 4265 #endif 4266 fiop->f_defpass = softc->ipf_pass; 4267 fiop->f_features = ipf_features; 4268 4269 #ifdef IPFILTER_COMPAT 4270 sprintf(fiop->f_version, "IP Filter: v%d.%d.%d", 4271 (rev / 1000000) % 100, 4272 (rev / 10000) % 100, 4273 (rev / 100) % 100); 4274 #else 4275 rev = rev; 4276 (void) strncpy(fiop->f_version, ipfilter_version, 4277 sizeof(fiop->f_version)); 4278 #endif 4279 } 4280 4281 4282 #ifdef USE_INET6 4283 int icmptoicmp6types[ICMP_MAXTYPE+1] = { 4284 ICMP6_ECHO_REPLY, /* 0: ICMP_ECHOREPLY */ 4285 -1, /* 1: UNUSED */ 4286 -1, /* 2: UNUSED */ 4287 ICMP6_DST_UNREACH, /* 3: ICMP_UNREACH */ 4288 -1, /* 4: ICMP_SOURCEQUENCH */ 4289 ND_REDIRECT, /* 5: ICMP_REDIRECT */ 4290 -1, /* 6: UNUSED */ 4291 -1, /* 7: UNUSED */ 4292 ICMP6_ECHO_REQUEST, /* 8: ICMP_ECHO */ 4293 -1, /* 9: UNUSED */ 4294 -1, /* 10: UNUSED */ 4295 ICMP6_TIME_EXCEEDED, /* 11: ICMP_TIMXCEED */ 4296 ICMP6_PARAM_PROB, /* 12: ICMP_PARAMPROB */ 4297 -1, /* 13: ICMP_TSTAMP */ 4298 -1, /* 14: ICMP_TSTAMPREPLY */ 4299 -1, /* 15: ICMP_IREQ */ 4300 -1, /* 16: ICMP_IREQREPLY */ 4301 -1, /* 17: ICMP_MASKREQ */ 4302 -1, /* 18: ICMP_MASKREPLY */ 4303 }; 4304 4305 4306 int icmptoicmp6unreach[ICMP_MAX_UNREACH] = { 4307 ICMP6_DST_UNREACH_ADDR, /* 0: ICMP_UNREACH_NET */ 4308 ICMP6_DST_UNREACH_ADDR, /* 1: ICMP_UNREACH_HOST */ 4309 -1, /* 2: ICMP_UNREACH_PROTOCOL */ 4310 ICMP6_DST_UNREACH_NOPORT, /* 3: ICMP_UNREACH_PORT */ 4311 -1, /* 4: ICMP_UNREACH_NEEDFRAG */ 4312 ICMP6_DST_UNREACH_NOTNEIGHBOR, /* 5: ICMP_UNREACH_SRCFAIL */ 4313 ICMP6_DST_UNREACH_ADDR, /* 6: ICMP_UNREACH_NET_UNKNOWN */ 4314 ICMP6_DST_UNREACH_ADDR, /* 7: ICMP_UNREACH_HOST_UNKNOWN */ 4315 -1, /* 8: ICMP_UNREACH_ISOLATED */ 4316 ICMP6_DST_UNREACH_ADMIN, /* 9: ICMP_UNREACH_NET_PROHIB */ 4317 ICMP6_DST_UNREACH_ADMIN, /* 10: ICMP_UNREACH_HOST_PROHIB */ 4318 -1, /* 11: ICMP_UNREACH_TOSNET */ 4319 -1, /* 12: ICMP_UNREACH_TOSHOST */ 4320 ICMP6_DST_UNREACH_ADMIN, /* 13: ICMP_UNREACH_ADMIN_PROHIBIT */ 4321 }; 4322 int icmpreplytype6[ICMP6_MAXTYPE + 1]; 4323 #endif 4324 4325 int icmpreplytype4[ICMP_MAXTYPE + 1]; 4326 4327 4328 /* ------------------------------------------------------------------------ */ 4329 /* Function: ipf_matchicmpqueryreply */ 4330 /* Returns: int - 1 if "icmp" is a valid reply to "ic" else 0. */ 4331 /* Parameters: v(I) - IP protocol version (4 or 6) */ 4332 /* ic(I) - ICMP information */ 4333 /* icmp(I) - ICMP packet header */ 4334 /* rev(I) - direction (0 = forward/1 = reverse) of packet */ 4335 /* */ 4336 /* Check if the ICMP packet defined by the header pointed to by icmp is a */ 4337 /* reply to one as described by what's in ic. If it is a match, return 1, */ 4338 /* else return 0 for no match. */ 4339 /* ------------------------------------------------------------------------ */ 4340 int 4341 ipf_matchicmpqueryreply(v, ic, icmp, rev) 4342 int v; 4343 icmpinfo_t *ic; 4344 icmphdr_t *icmp; 4345 int rev; 4346 { 4347 int ictype; 4348 4349 ictype = ic->ici_type; 4350 4351 if (v == 4) { 4352 /* 4353 * If we matched its type on the way in, then when going out 4354 * it will still be the same type. 4355 */ 4356 if ((!rev && (icmp->icmp_type == ictype)) || 4357 (rev && (icmpreplytype4[ictype] == icmp->icmp_type))) { 4358 if (icmp->icmp_type != ICMP_ECHOREPLY) 4359 return 1; 4360 if (icmp->icmp_id == ic->ici_id) 4361 return 1; 4362 } 4363 } 4364 #ifdef USE_INET6 4365 else if (v == 6) { 4366 if ((!rev && (icmp->icmp_type == ictype)) || 4367 (rev && (icmpreplytype6[ictype] == icmp->icmp_type))) { 4368 if (icmp->icmp_type != ICMP6_ECHO_REPLY) 4369 return 1; 4370 if (icmp->icmp_id == ic->ici_id) 4371 return 1; 4372 } 4373 } 4374 #endif 4375 return 0; 4376 } 4377 4378 4379 /* ------------------------------------------------------------------------ */ 4380 /* Function: frrequest */ 4381 /* Returns: int - 0 == success, > 0 == errno value */ 4382 /* Parameters: unit(I) - device for which this is for */ 4383 /* req(I) - ioctl command (SIOC*) */ 4384 /* data(I) - pointr to ioctl data */ 4385 /* set(I) - 1 or 0 (filter set) */ 4386 /* makecopy(I) - flag indicating whether data points to a rule */ 4387 /* in kernel space & hence doesn't need copying. */ 4388 /* */ 4389 /* This function handles all the requests which operate on the list of */ 4390 /* filter rules. This includes adding, deleting, insertion. It is also */ 4391 /* responsible for creating groups when a "head" rule is loaded. Interface */ 4392 /* names are resolved here and other sanity checks are made on the content */ 4393 /* of the rule structure being loaded. If a rule has user defined timeouts */ 4394 /* then make sure they are created and initialised before exiting. */ 4395 /* ------------------------------------------------------------------------ */ 4396 int 4397 frrequest(softc, unit, req, data, set, makecopy) 4398 ipf_main_softc_t *softc; 4399 int unit; 4400 ioctlcmd_t req; 4401 int set, makecopy; 4402 caddr_t data; 4403 { 4404 int error = 0, in, family, addrem, need_free = 0; 4405 frentry_t frd, *fp, *f, **fprev, **ftail; 4406 void *ptr, *uptr, *cptr; 4407 u_int *p, *pp; 4408 frgroup_t *fg; 4409 char *group; 4410 4411 ptr = NULL; 4412 cptr = NULL; 4413 fg = NULL; 4414 fp = &frd; 4415 if (makecopy != 0) { 4416 bzero(fp, sizeof(frd)); 4417 error = ipf_inobj(softc, data, NULL, fp, IPFOBJ_FRENTRY); 4418 if (error) { 4419 return error; 4420 } 4421 if ((fp->fr_type & FR_T_BUILTIN) != 0) { 4422 IPFERROR(6); 4423 return EINVAL; 4424 } 4425 KMALLOCS(f, frentry_t *, fp->fr_size); 4426 if (f == NULL) { 4427 IPFERROR(131); 4428 return ENOMEM; 4429 } 4430 bzero(f, fp->fr_size); 4431 error = ipf_inobjsz(softc, data, f, IPFOBJ_FRENTRY, 4432 fp->fr_size); 4433 if (error) { 4434 KFREES(f, fp->fr_size); 4435 return error; 4436 } 4437 4438 fp = f; 4439 f = NULL; 4440 fp->fr_dnext = NULL; 4441 fp->fr_ref = 0; 4442 fp->fr_flags |= FR_COPIED; 4443 } else { 4444 fp = (frentry_t *)data; 4445 if ((fp->fr_type & FR_T_BUILTIN) == 0) { 4446 IPFERROR(7); 4447 return EINVAL; 4448 } 4449 fp->fr_flags &= ~FR_COPIED; 4450 } 4451 4452 if (((fp->fr_dsize == 0) && (fp->fr_data != NULL)) || 4453 ((fp->fr_dsize != 0) && (fp->fr_data == NULL))) { 4454 IPFERROR(8); 4455 error = EINVAL; 4456 goto donenolock; 4457 } 4458 4459 family = fp->fr_family; 4460 uptr = fp->fr_data; 4461 4462 if (req == (ioctlcmd_t)SIOCINAFR || req == (ioctlcmd_t)SIOCINIFR || 4463 req == (ioctlcmd_t)SIOCADAFR || req == (ioctlcmd_t)SIOCADIFR) 4464 addrem = 0; 4465 else if (req == (ioctlcmd_t)SIOCRMAFR || req == (ioctlcmd_t)SIOCRMIFR) 4466 addrem = 1; 4467 else if (req == (ioctlcmd_t)SIOCZRLST) 4468 addrem = 2; 4469 else { 4470 IPFERROR(9); 4471 error = EINVAL; 4472 goto donenolock; 4473 } 4474 4475 /* 4476 * Only filter rules for IPv4 or IPv6 are accepted. 4477 */ 4478 if (family == AF_INET) { 4479 /*EMPTY*/; 4480 #ifdef USE_INET6 4481 } else if (family == AF_INET6) { 4482 /*EMPTY*/; 4483 #endif 4484 } else if (family != 0) { 4485 IPFERROR(10); 4486 error = EINVAL; 4487 goto donenolock; 4488 } 4489 4490 /* 4491 * If the rule is being loaded from user space, i.e. we had to copy it 4492 * into kernel space, then do not trust the function pointer in the 4493 * rule. 4494 */ 4495 if ((makecopy == 1) && (fp->fr_func != NULL)) { 4496 if (ipf_findfunc(fp->fr_func) == NULL) { 4497 IPFERROR(11); 4498 error = ESRCH; 4499 goto donenolock; 4500 } 4501 4502 if (addrem == 0) { 4503 error = ipf_funcinit(softc, fp); 4504 if (error != 0) 4505 goto donenolock; 4506 } 4507 } 4508 if ((fp->fr_flags & FR_CALLNOW) && 4509 ((fp->fr_func == NULL) || (fp->fr_func == (void *)-1))) { 4510 IPFERROR(142); 4511 error = ESRCH; 4512 goto donenolock; 4513 } 4514 if (((fp->fr_flags & FR_CMDMASK) == FR_CALL) && 4515 ((fp->fr_func == NULL) || (fp->fr_func == (void *)-1))) { 4516 IPFERROR(143); 4517 error = ESRCH; 4518 goto donenolock; 4519 } 4520 4521 ptr = NULL; 4522 cptr = NULL; 4523 4524 if (FR_ISACCOUNT(fp->fr_flags)) 4525 unit = IPL_LOGCOUNT; 4526 4527 /* 4528 * Check that each group name in the rule has a start index that 4529 * is valid. 4530 */ 4531 if (fp->fr_icmphead != -1) { 4532 if ((fp->fr_icmphead < 0) || 4533 (fp->fr_icmphead >= fp->fr_namelen)) { 4534 IPFERROR(136); 4535 error = EINVAL; 4536 goto donenolock; 4537 } 4538 if (!strcmp(FR_NAME(fp, fr_icmphead), "0")) 4539 fp->fr_names[fp->fr_icmphead] = '\0'; 4540 } 4541 4542 if (fp->fr_grhead != -1) { 4543 if ((fp->fr_grhead < 0) || 4544 (fp->fr_grhead >= fp->fr_namelen)) { 4545 IPFERROR(137); 4546 error = EINVAL; 4547 goto donenolock; 4548 } 4549 if (!strcmp(FR_NAME(fp, fr_grhead), "0")) 4550 fp->fr_names[fp->fr_grhead] = '\0'; 4551 } 4552 4553 if (fp->fr_group != -1) { 4554 if ((fp->fr_group < 0) || 4555 (fp->fr_group >= fp->fr_namelen)) { 4556 IPFERROR(138); 4557 error = EINVAL; 4558 goto donenolock; 4559 } 4560 if ((req != (int)SIOCZRLST) && (fp->fr_group != -1)) { 4561 /* 4562 * Allow loading rules that are in groups to cause 4563 * them to be created if they don't already exit. 4564 */ 4565 group = FR_NAME(fp, fr_group); 4566 fg = ipf_findgroup(softc, group, unit, set, NULL); 4567 if (fg == NULL) { 4568 if (addrem == 0) { 4569 fg = ipf_group_add(softc, group, NULL, 4570 fp->fr_flags, unit, 4571 set); 4572 } 4573 if (fg == NULL) { 4574 IPFERROR(12); 4575 error = ESRCH; 4576 goto donenolock; 4577 } 4578 } 4579 if (fg->fg_flags == 0) 4580 fg->fg_flags = fp->fr_flags & FR_INOUT; 4581 else if (fg->fg_flags != (fp->fr_flags & FR_INOUT)) { 4582 IPFERROR(13); 4583 error = ESRCH; 4584 goto donenolock; 4585 } 4586 } 4587 } else { 4588 /* 4589 * If a rule is going to be part of a group then it does 4590 * not matter whether it is an in or out rule, but if it 4591 * isn't in a group, then it does... 4592 */ 4593 if ((fp->fr_flags & (FR_INQUE|FR_OUTQUE)) == 0) { 4594 IPFERROR(14); 4595 error = EINVAL; 4596 goto donenolock; 4597 } 4598 } 4599 in = (fp->fr_flags & FR_INQUE) ? 0 : 1; 4600 4601 /* 4602 * Work out which rule list this change is being applied to. 4603 */ 4604 ftail = NULL; 4605 fprev = NULL; 4606 if (unit == IPL_LOGAUTH) { 4607 if ((fp->fr_tifs[0].fd_ptr != NULL) || 4608 (fp->fr_tifs[1].fd_ptr != NULL) || 4609 (fp->fr_dif.fd_ptr != NULL) || 4610 (fp->fr_flags & FR_FASTROUTE)) { 4611 softc->ipf_interror = 145; 4612 error = EINVAL; 4613 goto donenolock; 4614 } 4615 fprev = ipf_auth_rulehead(softc); 4616 } else { 4617 if (FR_ISACCOUNT(fp->fr_flags)) 4618 fprev = &softc->ipf_acct[in][set]; 4619 else if ((fp->fr_flags & (FR_OUTQUE|FR_INQUE)) != 0) 4620 fprev = &softc->ipf_rules[in][set]; 4621 } 4622 if (fprev == NULL) { 4623 IPFERROR(15); 4624 error = ESRCH; 4625 goto donenolock; 4626 } 4627 4628 if (fg != NULL) 4629 fprev = &fg->fg_start; 4630 4631 /* 4632 * Copy in extra data for the rule. 4633 */ 4634 if (fp->fr_dsize != 0) { 4635 if (makecopy != 0) { 4636 KMALLOCS(ptr, void *, fp->fr_dsize); 4637 if (ptr == NULL) { 4638 IPFERROR(16); 4639 error = ENOMEM; 4640 goto donenolock; 4641 } 4642 4643 /* 4644 * The bcopy case is for when the data is appended 4645 * to the rule by ipf_in_compat(). 4646 */ 4647 if (uptr >= (void *)fp && 4648 uptr < (void *)((char *)fp + fp->fr_size)) { 4649 bcopy(uptr, ptr, fp->fr_dsize); 4650 error = 0; 4651 } else { 4652 error = COPYIN(uptr, ptr, fp->fr_dsize); 4653 if (error != 0) { 4654 IPFERROR(17); 4655 error = EFAULT; 4656 goto donenolock; 4657 } 4658 } 4659 } else { 4660 ptr = uptr; 4661 } 4662 fp->fr_data = ptr; 4663 } else { 4664 fp->fr_data = NULL; 4665 } 4666 4667 /* 4668 * Perform per-rule type sanity checks of their members. 4669 * All code after this needs to be aware that allocated memory 4670 * may need to be free'd before exiting. 4671 */ 4672 switch (fp->fr_type & ~FR_T_BUILTIN) 4673 { 4674 #if defined(IPFILTER_BPF) 4675 case FR_T_BPFOPC : 4676 if (fp->fr_dsize == 0) { 4677 IPFERROR(19); 4678 error = EINVAL; 4679 break; 4680 } 4681 if (!bpf_validate(ptr, fp->fr_dsize/sizeof(struct bpf_insn))) { 4682 IPFERROR(20); 4683 error = EINVAL; 4684 break; 4685 } 4686 break; 4687 #endif 4688 case FR_T_IPF : 4689 /* 4690 * Preparation for error case at the bottom of this function. 4691 */ 4692 if (fp->fr_datype == FRI_LOOKUP) 4693 fp->fr_dstptr = NULL; 4694 if (fp->fr_satype == FRI_LOOKUP) 4695 fp->fr_srcptr = NULL; 4696 4697 if (fp->fr_dsize != sizeof(fripf_t)) { 4698 IPFERROR(21); 4699 error = EINVAL; 4700 break; 4701 } 4702 4703 /* 4704 * Allowing a rule with both "keep state" and "with oow" is 4705 * pointless because adding a state entry to the table will 4706 * fail with the out of window (oow) flag set. 4707 */ 4708 if ((fp->fr_flags & FR_KEEPSTATE) && (fp->fr_flx & FI_OOW)) { 4709 IPFERROR(22); 4710 error = EINVAL; 4711 break; 4712 } 4713 4714 switch (fp->fr_satype) 4715 { 4716 case FRI_BROADCAST : 4717 case FRI_DYNAMIC : 4718 case FRI_NETWORK : 4719 case FRI_NETMASKED : 4720 case FRI_PEERADDR : 4721 if (fp->fr_sifpidx < 0) { 4722 IPFERROR(23); 4723 error = EINVAL; 4724 } 4725 break; 4726 case FRI_LOOKUP : 4727 fp->fr_srcptr = ipf_findlookup(softc, unit, fp, 4728 &fp->fr_src6, 4729 &fp->fr_smsk6); 4730 if (fp->fr_srcfunc == NULL) { 4731 IPFERROR(132); 4732 error = ESRCH; 4733 break; 4734 } 4735 break; 4736 case FRI_NORMAL : 4737 break; 4738 default : 4739 IPFERROR(133); 4740 error = EINVAL; 4741 break; 4742 } 4743 if (error != 0) 4744 break; 4745 4746 switch (fp->fr_datype) 4747 { 4748 case FRI_BROADCAST : 4749 case FRI_DYNAMIC : 4750 case FRI_NETWORK : 4751 case FRI_NETMASKED : 4752 case FRI_PEERADDR : 4753 if (fp->fr_difpidx < 0) { 4754 IPFERROR(24); 4755 error = EINVAL; 4756 } 4757 break; 4758 case FRI_LOOKUP : 4759 fp->fr_dstptr = ipf_findlookup(softc, unit, fp, 4760 &fp->fr_dst6, 4761 &fp->fr_dmsk6); 4762 if (fp->fr_dstfunc == NULL) { 4763 IPFERROR(134); 4764 error = ESRCH; 4765 } 4766 break; 4767 case FRI_NORMAL : 4768 break; 4769 default : 4770 IPFERROR(135); 4771 error = EINVAL; 4772 } 4773 break; 4774 4775 case FR_T_NONE : 4776 case FR_T_CALLFUNC : 4777 case FR_T_COMPIPF : 4778 break; 4779 4780 case FR_T_IPFEXPR : 4781 if (ipf_matcharray_verify(fp->fr_data, fp->fr_dsize) == -1) { 4782 IPFERROR(25); 4783 error = EINVAL; 4784 } 4785 break; 4786 4787 default : 4788 IPFERROR(26); 4789 error = EINVAL; 4790 break; 4791 } 4792 if (error != 0) 4793 goto donenolock; 4794 4795 if (fp->fr_tif.fd_name != -1) { 4796 if ((fp->fr_tif.fd_name < 0) || 4797 (fp->fr_tif.fd_name >= fp->fr_namelen)) { 4798 IPFERROR(139); 4799 error = EINVAL; 4800 goto donenolock; 4801 } 4802 } 4803 4804 if (fp->fr_dif.fd_name != -1) { 4805 if ((fp->fr_dif.fd_name < 0) || 4806 (fp->fr_dif.fd_name >= fp->fr_namelen)) { 4807 IPFERROR(140); 4808 error = EINVAL; 4809 goto donenolock; 4810 } 4811 } 4812 4813 if (fp->fr_rif.fd_name != -1) { 4814 if ((fp->fr_rif.fd_name < 0) || 4815 (fp->fr_rif.fd_name >= fp->fr_namelen)) { 4816 IPFERROR(141); 4817 error = EINVAL; 4818 goto donenolock; 4819 } 4820 } 4821 4822 /* 4823 * Lookup all the interface names that are part of the rule. 4824 */ 4825 error = ipf_synclist(softc, fp, NULL); 4826 if (error != 0) 4827 goto donenolock; 4828 fp->fr_statecnt = 0; 4829 if (fp->fr_srctrack.ht_max_nodes != 0) 4830 ipf_rb_ht_init(&fp->fr_srctrack); 4831 4832 /* 4833 * Look for an existing matching filter rule, but don't include the 4834 * next or interface pointer in the comparison (fr_next, fr_ifa). 4835 * This elminates rules which are indentical being loaded. Checksum 4836 * the constant part of the filter rule to make comparisons quicker 4837 * (this meaning no pointers are included). 4838 */ 4839 for (fp->fr_cksum = 0, p = (u_int *)&fp->fr_func, pp = &fp->fr_cksum; 4840 p < pp; p++) 4841 fp->fr_cksum += *p; 4842 pp = (u_int *)(fp->fr_caddr + fp->fr_dsize); 4843 for (p = (u_int *)fp->fr_data; p < pp; p++) 4844 fp->fr_cksum += *p; 4845 4846 WRITE_ENTER(&softc->ipf_mutex); 4847 4848 /* 4849 * Now that the filter rule lists are locked, we can walk the 4850 * chain of them without fear. 4851 */ 4852 ftail = fprev; 4853 for (f = *ftail; (f = *ftail) != NULL; ftail = &f->fr_next) { 4854 if (fp->fr_collect <= f->fr_collect) { 4855 ftail = fprev; 4856 f = NULL; 4857 break; 4858 } 4859 fprev = ftail; 4860 } 4861 4862 for (; (f = *ftail) != NULL; ftail = &f->fr_next) { 4863 if ((fp->fr_cksum != f->fr_cksum) || 4864 (f->fr_dsize != fp->fr_dsize)) 4865 continue; 4866 if (bcmp((char *)&f->fr_func, (char *)&fp->fr_func, FR_CMPSIZ)) 4867 continue; 4868 if ((!ptr && !f->fr_data) || 4869 (ptr && f->fr_data && 4870 !bcmp((char *)ptr, (char *)f->fr_data, f->fr_dsize))) 4871 break; 4872 } 4873 4874 /* 4875 * If zero'ing statistics, copy current to caller and zero. 4876 */ 4877 if (addrem == 2) { 4878 if (f == NULL) { 4879 IPFERROR(27); 4880 error = ESRCH; 4881 } else { 4882 /* 4883 * Copy and reduce lock because of impending copyout. 4884 * Well we should, but if we do then the atomicity of 4885 * this call and the correctness of fr_hits and 4886 * fr_bytes cannot be guaranteed. As it is, this code 4887 * only resets them to 0 if they are successfully 4888 * copied out into user space. 4889 */ 4890 bcopy((char *)f, (char *)fp, f->fr_size); 4891 /* MUTEX_DOWNGRADE(&softc->ipf_mutex); */ 4892 4893 /* 4894 * When we copy this rule back out, set the data 4895 * pointer to be what it was in user space. 4896 */ 4897 fp->fr_data = uptr; 4898 error = ipf_outobj(softc, data, fp, IPFOBJ_FRENTRY); 4899 4900 if (error == 0) { 4901 if ((f->fr_dsize != 0) && (uptr != NULL)) 4902 error = COPYOUT(f->fr_data, uptr, 4903 f->fr_dsize); 4904 if (error != 0) { 4905 IPFERROR(28); 4906 error = EFAULT; 4907 } 4908 if (error == 0) { 4909 f->fr_hits = 0; 4910 f->fr_bytes = 0; 4911 } 4912 } 4913 } 4914 4915 if (makecopy != 0) { 4916 if (ptr != NULL) { 4917 KFREES(ptr, fp->fr_dsize); 4918 } 4919 KFREES(fp, fp->fr_size); 4920 } 4921 RWLOCK_EXIT(&softc->ipf_mutex); 4922 return error; 4923 } 4924 4925 if (!f) { 4926 /* 4927 * At the end of this, ftail must point to the place where the 4928 * new rule is to be saved/inserted/added. 4929 * For SIOCAD*FR, this should be the last rule in the group of 4930 * rules that have equal fr_collect fields. 4931 * For SIOCIN*FR, ... 4932 */ 4933 if (req == (ioctlcmd_t)SIOCADAFR || 4934 req == (ioctlcmd_t)SIOCADIFR) { 4935 4936 for (ftail = fprev; (f = *ftail) != NULL; ) { 4937 if (f->fr_collect > fp->fr_collect) 4938 break; 4939 ftail = &f->fr_next; 4940 } 4941 f = NULL; 4942 ptr = NULL; 4943 } else if (req == (ioctlcmd_t)SIOCINAFR || 4944 req == (ioctlcmd_t)SIOCINIFR) { 4945 while ((f = *fprev) != NULL) { 4946 if (f->fr_collect >= fp->fr_collect) 4947 break; 4948 fprev = &f->fr_next; 4949 } 4950 ftail = fprev; 4951 if (fp->fr_hits != 0) { 4952 while (fp->fr_hits && (f = *ftail)) { 4953 if (f->fr_collect != fp->fr_collect) 4954 break; 4955 fprev = ftail; 4956 ftail = &f->fr_next; 4957 fp->fr_hits--; 4958 } 4959 } 4960 f = NULL; 4961 ptr = NULL; 4962 } 4963 } 4964 4965 /* 4966 * Request to remove a rule. 4967 */ 4968 if (addrem == 1) { 4969 if (!f) { 4970 IPFERROR(29); 4971 error = ESRCH; 4972 } else { 4973 /* 4974 * Do not allow activity from user space to interfere 4975 * with rules not loaded that way. 4976 */ 4977 if ((makecopy == 1) && !(f->fr_flags & FR_COPIED)) { 4978 IPFERROR(30); 4979 error = EPERM; 4980 goto done; 4981 } 4982 4983 /* 4984 * Return EBUSY if the rule is being reference by 4985 * something else (eg state information.) 4986 */ 4987 if (f->fr_ref > 1) { 4988 IPFERROR(31); 4989 error = EBUSY; 4990 goto done; 4991 } 4992 #ifdef IPFILTER_SCAN 4993 if (f->fr_isctag != -1 && 4994 (f->fr_isc != (struct ipscan *)-1)) 4995 ipf_scan_detachfr(f); 4996 #endif 4997 4998 if (unit == IPL_LOGAUTH) { 4999 error = ipf_auth_precmd(softc, req, f, ftail); 5000 goto done; 5001 } 5002 5003 ipf_rule_delete(softc, f, unit, set); 5004 5005 need_free = makecopy; 5006 } 5007 } else { 5008 /* 5009 * Not removing, so we must be adding/inserting a rule. 5010 */ 5011 if (f != NULL) { 5012 IPFERROR(32); 5013 error = EEXIST; 5014 goto done; 5015 } 5016 if (unit == IPL_LOGAUTH) { 5017 error = ipf_auth_precmd(softc, req, fp, ftail); 5018 goto done; 5019 } 5020 5021 MUTEX_NUKE(&fp->fr_lock); 5022 MUTEX_INIT(&fp->fr_lock, "filter rule lock"); 5023 if (fp->fr_die != 0) 5024 ipf_rule_expire_insert(softc, fp, set); 5025 5026 fp->fr_hits = 0; 5027 if (makecopy != 0) 5028 fp->fr_ref = 1; 5029 fp->fr_pnext = ftail; 5030 fp->fr_next = *ftail; 5031 *ftail = fp; 5032 if (addrem == 0) 5033 ipf_fixskip(ftail, fp, 1); 5034 5035 fp->fr_icmpgrp = NULL; 5036 if (fp->fr_icmphead != -1) { 5037 group = FR_NAME(fp, fr_icmphead); 5038 fg = ipf_group_add(softc, group, fp, 0, unit, set); 5039 if (fg != NULL) 5040 fp->fr_icmpgrp = &fg->fg_start; 5041 } 5042 5043 fp->fr_grp = NULL; 5044 if (fp->fr_grhead != -1) { 5045 group = FR_NAME(fp, fr_grhead); 5046 fg = ipf_group_add(softc, group, fp, fp->fr_flags, 5047 unit, set); 5048 if (fg != NULL) 5049 fp->fr_grp = &fg->fg_start; 5050 } 5051 } 5052 done: 5053 RWLOCK_EXIT(&softc->ipf_mutex); 5054 donenolock: 5055 if (need_free || (error != 0)) { 5056 if ((fp->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) { 5057 if ((fp->fr_satype == FRI_LOOKUP) && 5058 (fp->fr_srcptr != NULL)) 5059 ipf_lookup_deref(softc, fp->fr_srctype, 5060 fp->fr_srcptr); 5061 if ((fp->fr_datype == FRI_LOOKUP) && 5062 (fp->fr_dstptr != NULL)) 5063 ipf_lookup_deref(softc, fp->fr_dsttype, 5064 fp->fr_dstptr); 5065 } 5066 if ((ptr != NULL) && (makecopy != 0)) { 5067 KFREES(ptr, fp->fr_dsize); 5068 } 5069 KFREES(fp, fp->fr_size); 5070 } 5071 return (error); 5072 } 5073 5074 5075 /* ------------------------------------------------------------------------ */ 5076 /* Function: ipf_rule_delete */ 5077 /* Returns: Nil */ 5078 /* Parameters: softc(I) - pointer to soft context main structure */ 5079 /* f(I) - pointer to the rule being deleted */ 5080 /* ftail(I) - pointer to the pointer to f */ 5081 /* unit(I) - device for which this is for */ 5082 /* set(I) - 1 or 0 (filter set) */ 5083 /* */ 5084 /* This function attempts to do what it can to delete a filter rule: remove */ 5085 /* it from any linked lists and remove any groups it is responsible for. */ 5086 /* But in the end, removing a rule can only drop the reference count - we */ 5087 /* must use that as the guide for whether or not it can be freed. */ 5088 /* ------------------------------------------------------------------------ */ 5089 static void 5090 ipf_rule_delete(softc, f, unit, set) 5091 ipf_main_softc_t *softc; 5092 frentry_t *f; 5093 int unit, set; 5094 { 5095 5096 if (f->fr_grhead != -1) 5097 ipf_group_del(softc, FR_NAME(f, fr_grhead), unit, set); 5098 5099 if (f->fr_icmphead != -1) 5100 ipf_group_del(softc, FR_NAME(f, fr_icmphead), unit, set); 5101 5102 /* 5103 * If fr_pdnext is set, then the rule is on the expire list, so 5104 * remove it from there. 5105 */ 5106 if (f->fr_pdnext != NULL) { 5107 *f->fr_pdnext = f->fr_dnext; 5108 if (f->fr_dnext != NULL) 5109 f->fr_dnext->fr_pdnext = f->fr_pdnext; 5110 f->fr_pdnext = NULL; 5111 f->fr_dnext = NULL; 5112 } 5113 5114 ipf_fixskip(f->fr_pnext, f, -1); 5115 if (f->fr_pnext != NULL) 5116 *f->fr_pnext = f->fr_next; 5117 if (f->fr_next != NULL) 5118 f->fr_next->fr_pnext = f->fr_pnext; 5119 f->fr_pnext = NULL; 5120 f->fr_next = NULL; 5121 5122 (void) ipf_derefrule(softc, &f); 5123 } 5124 5125 /* ------------------------------------------------------------------------ */ 5126 /* Function: ipf_rule_expire_insert */ 5127 /* Returns: Nil */ 5128 /* Parameters: softc(I) - pointer to soft context main structure */ 5129 /* f(I) - pointer to rule to be added to expire list */ 5130 /* set(I) - 1 or 0 (filter set) */ 5131 /* */ 5132 /* If the new rule has a given expiration time, insert it into the list of */ 5133 /* expiring rules with the ones to be removed first added to the front of */ 5134 /* the list. The insertion is O(n) but it is kept sorted for quick scans at */ 5135 /* expiration interval checks. */ 5136 /* ------------------------------------------------------------------------ */ 5137 static void 5138 ipf_rule_expire_insert(softc, f, set) 5139 ipf_main_softc_t *softc; 5140 frentry_t *f; 5141 int set; 5142 { 5143 frentry_t *fr; 5144 5145 /* 5146 */ 5147 5148 f->fr_die = softc->ipf_ticks + IPF_TTLVAL(f->fr_die); 5149 for (fr = softc->ipf_rule_explist[set]; fr != NULL; 5150 fr = fr->fr_dnext) { 5151 if (f->fr_die < fr->fr_die) 5152 break; 5153 if (fr->fr_dnext == NULL) { 5154 /* 5155 * We've got to the last rule and everything 5156 * wanted to be expired before this new node, 5157 * so we have to tack it on the end... 5158 */ 5159 fr->fr_dnext = f; 5160 f->fr_pdnext = &fr->fr_dnext; 5161 fr = NULL; 5162 break; 5163 } 5164 } 5165 5166 if (softc->ipf_rule_explist[set] == NULL) { 5167 softc->ipf_rule_explist[set] = f; 5168 f->fr_pdnext = &softc->ipf_rule_explist[set]; 5169 } else if (fr != NULL) { 5170 f->fr_dnext = fr; 5171 f->fr_pdnext = fr->fr_pdnext; 5172 fr->fr_pdnext = &f->fr_dnext; 5173 } 5174 } 5175 5176 5177 /* ------------------------------------------------------------------------ */ 5178 /* Function: ipf_findlookup */ 5179 /* Returns: NULL = failure, else success */ 5180 /* Parameters: softc(I) - pointer to soft context main structure */ 5181 /* unit(I) - ipf device we want to find match for */ 5182 /* fp(I) - rule for which lookup is for */ 5183 /* addrp(I) - pointer to lookup information in address struct */ 5184 /* maskp(O) - pointer to lookup information for storage */ 5185 /* */ 5186 /* When using pools and hash tables to store addresses for matching in */ 5187 /* rules, it is necessary to resolve both the object referred to by the */ 5188 /* name or address (and return that pointer) and also provide the means by */ 5189 /* which to determine if an address belongs to that object to make the */ 5190 /* packet matching quicker. */ 5191 /* ------------------------------------------------------------------------ */ 5192 static void * 5193 ipf_findlookup(softc, unit, fr, addrp, maskp) 5194 ipf_main_softc_t *softc; 5195 int unit; 5196 frentry_t *fr; 5197 i6addr_t *addrp, *maskp; 5198 { 5199 void *ptr = NULL; 5200 5201 switch (addrp->iplookupsubtype) 5202 { 5203 case 0 : 5204 ptr = ipf_lookup_res_num(softc, unit, addrp->iplookuptype, 5205 addrp->iplookupnum, 5206 &maskp->iplookupfunc); 5207 break; 5208 case 1 : 5209 if (addrp->iplookupname < 0) 5210 break; 5211 if (addrp->iplookupname >= fr->fr_namelen) 5212 break; 5213 ptr = ipf_lookup_res_name(softc, unit, addrp->iplookuptype, 5214 fr->fr_names + addrp->iplookupname, 5215 &maskp->iplookupfunc); 5216 break; 5217 default : 5218 break; 5219 } 5220 5221 return ptr; 5222 } 5223 5224 5225 /* ------------------------------------------------------------------------ */ 5226 /* Function: ipf_funcinit */ 5227 /* Returns: int - 0 == success, else ESRCH: cannot resolve rule details */ 5228 /* Parameters: softc(I) - pointer to soft context main structure */ 5229 /* fr(I) - pointer to filter rule */ 5230 /* */ 5231 /* If a rule is a call rule, then check if the function it points to needs */ 5232 /* an init function to be called now the rule has been loaded. */ 5233 /* ------------------------------------------------------------------------ */ 5234 static int 5235 ipf_funcinit(softc, fr) 5236 ipf_main_softc_t *softc; 5237 frentry_t *fr; 5238 { 5239 ipfunc_resolve_t *ft; 5240 int err; 5241 5242 IPFERROR(34); 5243 err = ESRCH; 5244 5245 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5246 if (ft->ipfu_addr == fr->fr_func) { 5247 err = 0; 5248 if (ft->ipfu_init != NULL) 5249 err = (*ft->ipfu_init)(softc, fr); 5250 break; 5251 } 5252 return err; 5253 } 5254 5255 5256 /* ------------------------------------------------------------------------ */ 5257 /* Function: ipf_funcfini */ 5258 /* Returns: Nil */ 5259 /* Parameters: softc(I) - pointer to soft context main structure */ 5260 /* fr(I) - pointer to filter rule */ 5261 /* */ 5262 /* For a given filter rule, call the matching "fini" function if the rule */ 5263 /* is using a known function that would have resulted in the "init" being */ 5264 /* called for ealier. */ 5265 /* ------------------------------------------------------------------------ */ 5266 static void 5267 ipf_funcfini(softc, fr) 5268 ipf_main_softc_t *softc; 5269 frentry_t *fr; 5270 { 5271 ipfunc_resolve_t *ft; 5272 5273 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5274 if (ft->ipfu_addr == fr->fr_func) { 5275 if (ft->ipfu_fini != NULL) 5276 (void) (*ft->ipfu_fini)(softc, fr); 5277 break; 5278 } 5279 } 5280 5281 5282 /* ------------------------------------------------------------------------ */ 5283 /* Function: ipf_findfunc */ 5284 /* Returns: ipfunc_t - pointer to function if found, else NULL */ 5285 /* Parameters: funcptr(I) - function pointer to lookup */ 5286 /* */ 5287 /* Look for a function in the table of known functions. */ 5288 /* ------------------------------------------------------------------------ */ 5289 static ipfunc_t 5290 ipf_findfunc(funcptr) 5291 ipfunc_t funcptr; 5292 { 5293 ipfunc_resolve_t *ft; 5294 5295 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5296 if (ft->ipfu_addr == funcptr) 5297 return funcptr; 5298 return NULL; 5299 } 5300 5301 5302 /* ------------------------------------------------------------------------ */ 5303 /* Function: ipf_resolvefunc */ 5304 /* Returns: int - 0 == success, else error */ 5305 /* Parameters: data(IO) - ioctl data pointer to ipfunc_resolve_t struct */ 5306 /* */ 5307 /* Copy in a ipfunc_resolve_t structure and then fill in the missing field. */ 5308 /* This will either be the function name (if the pointer is set) or the */ 5309 /* function pointer if the name is set. When found, fill in the other one */ 5310 /* so that the entire, complete, structure can be copied back to user space.*/ 5311 /* ------------------------------------------------------------------------ */ 5312 int 5313 ipf_resolvefunc(softc, data) 5314 ipf_main_softc_t *softc; 5315 void *data; 5316 { 5317 ipfunc_resolve_t res, *ft; 5318 int error; 5319 5320 error = BCOPYIN(data, &res, sizeof(res)); 5321 if (error != 0) { 5322 IPFERROR(123); 5323 return EFAULT; 5324 } 5325 5326 if (res.ipfu_addr == NULL && res.ipfu_name[0] != '\0') { 5327 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5328 if (strncmp(res.ipfu_name, ft->ipfu_name, 5329 sizeof(res.ipfu_name)) == 0) { 5330 res.ipfu_addr = ft->ipfu_addr; 5331 res.ipfu_init = ft->ipfu_init; 5332 if (COPYOUT(&res, data, sizeof(res)) != 0) { 5333 IPFERROR(35); 5334 return EFAULT; 5335 } 5336 return 0; 5337 } 5338 } 5339 if (res.ipfu_addr != NULL && res.ipfu_name[0] == '\0') { 5340 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5341 if (ft->ipfu_addr == res.ipfu_addr) { 5342 (void) strncpy(res.ipfu_name, ft->ipfu_name, 5343 sizeof(res.ipfu_name)); 5344 res.ipfu_init = ft->ipfu_init; 5345 if (COPYOUT(&res, data, sizeof(res)) != 0) { 5346 IPFERROR(36); 5347 return EFAULT; 5348 } 5349 return 0; 5350 } 5351 } 5352 IPFERROR(37); 5353 return ESRCH; 5354 } 5355 5356 5357 #if !defined(_KERNEL) || (!defined(__NetBSD__) && !defined(__OpenBSD__) && \ 5358 !defined(__FreeBSD__)) || \ 5359 FREEBSD_LT_REV(501000) || NETBSD_LT_REV(105000000) || \ 5360 OPENBSD_LT_REV(200006) 5361 /* 5362 * From: NetBSD 5363 * ppsratecheck(): packets (or events) per second limitation. 5364 */ 5365 int 5366 ppsratecheck(lasttime, curpps, maxpps) 5367 struct timeval *lasttime; 5368 int *curpps; 5369 int maxpps; /* maximum pps allowed */ 5370 { 5371 struct timeval tv, delta; 5372 int rv; 5373 5374 GETKTIME(&tv); 5375 5376 delta.tv_sec = tv.tv_sec - lasttime->tv_sec; 5377 delta.tv_usec = tv.tv_usec - lasttime->tv_usec; 5378 if (delta.tv_usec < 0) { 5379 delta.tv_sec--; 5380 delta.tv_usec += 1000000; 5381 } 5382 5383 /* 5384 * check for 0,0 is so that the message will be seen at least once. 5385 * if more than one second have passed since the last update of 5386 * lasttime, reset the counter. 5387 * 5388 * we do increment *curpps even in *curpps < maxpps case, as some may 5389 * try to use *curpps for stat purposes as well. 5390 */ 5391 if ((lasttime->tv_sec == 0 && lasttime->tv_usec == 0) || 5392 delta.tv_sec >= 1) { 5393 *lasttime = tv; 5394 *curpps = 0; 5395 rv = 1; 5396 } else if (maxpps < 0) 5397 rv = 1; 5398 else if (*curpps < maxpps) 5399 rv = 1; 5400 else 5401 rv = 0; 5402 *curpps = *curpps + 1; 5403 5404 return (rv); 5405 } 5406 #endif 5407 5408 5409 /* ------------------------------------------------------------------------ */ 5410 /* Function: ipf_derefrule */ 5411 /* Returns: int - 0 == rule freed up, else rule not freed */ 5412 /* Parameters: fr(I) - pointer to filter rule */ 5413 /* */ 5414 /* Decrement the reference counter to a rule by one. If it reaches zero, */ 5415 /* free it and any associated storage space being used by it. */ 5416 /* ------------------------------------------------------------------------ */ 5417 int 5418 ipf_derefrule(softc, frp) 5419 ipf_main_softc_t *softc; 5420 frentry_t **frp; 5421 { 5422 frentry_t *fr; 5423 frdest_t *fdp; 5424 5425 fr = *frp; 5426 *frp = NULL; 5427 5428 MUTEX_ENTER(&fr->fr_lock); 5429 fr->fr_ref--; 5430 if (fr->fr_ref == 0) { 5431 MUTEX_EXIT(&fr->fr_lock); 5432 MUTEX_DESTROY(&fr->fr_lock); 5433 5434 ipf_funcfini(softc, fr); 5435 5436 fdp = &fr->fr_tif; 5437 if (fdp->fd_type == FRD_DSTLIST) 5438 ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr); 5439 5440 fdp = &fr->fr_rif; 5441 if (fdp->fd_type == FRD_DSTLIST) 5442 ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr); 5443 5444 fdp = &fr->fr_dif; 5445 if (fdp->fd_type == FRD_DSTLIST) 5446 ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr); 5447 5448 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF && 5449 fr->fr_satype == FRI_LOOKUP) 5450 ipf_lookup_deref(softc, fr->fr_srctype, fr->fr_srcptr); 5451 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF && 5452 fr->fr_datype == FRI_LOOKUP) 5453 ipf_lookup_deref(softc, fr->fr_dsttype, fr->fr_dstptr); 5454 5455 if ((fr->fr_flags & FR_COPIED) != 0) { 5456 if (fr->fr_dsize) { 5457 KFREES(fr->fr_data, fr->fr_dsize); 5458 } 5459 KFREES(fr, fr->fr_size); 5460 return 0; 5461 } 5462 return 1; 5463 } else { 5464 MUTEX_EXIT(&fr->fr_lock); 5465 } 5466 return -1; 5467 } 5468 5469 5470 /* ------------------------------------------------------------------------ */ 5471 /* Function: ipf_grpmapinit */ 5472 /* Returns: int - 0 == success, else ESRCH because table entry not found*/ 5473 /* Parameters: fr(I) - pointer to rule to find hash table for */ 5474 /* */ 5475 /* Looks for group hash table fr_arg and stores a pointer to it in fr_ptr. */ 5476 /* fr_ptr is later used by ipf_srcgrpmap and ipf_dstgrpmap. */ 5477 /* ------------------------------------------------------------------------ */ 5478 static int 5479 ipf_grpmapinit(softc, fr) 5480 ipf_main_softc_t *softc; 5481 frentry_t *fr; 5482 { 5483 char name[FR_GROUPLEN]; 5484 iphtable_t *iph; 5485 5486 #if defined(SNPRINTF) && defined(_KERNEL) 5487 SNPRINTF(name, sizeof(name), "%d", fr->fr_arg); 5488 #else 5489 (void) sprintf(name, "%d", fr->fr_arg); 5490 #endif 5491 iph = ipf_lookup_find_htable(softc, IPL_LOGIPF, name); 5492 if (iph == NULL) { 5493 IPFERROR(38); 5494 return ESRCH; 5495 } 5496 if ((iph->iph_flags & FR_INOUT) != (fr->fr_flags & FR_INOUT)) { 5497 IPFERROR(39); 5498 return ESRCH; 5499 } 5500 iph->iph_ref++; 5501 fr->fr_ptr = iph; 5502 return 0; 5503 } 5504 5505 5506 /* ------------------------------------------------------------------------ */ 5507 /* Function: ipf_grpmapfini */ 5508 /* Returns: int - 0 == success, else ESRCH because table entry not found*/ 5509 /* Parameters: softc(I) - pointer to soft context main structure */ 5510 /* fr(I) - pointer to rule to release hash table for */ 5511 /* */ 5512 /* For rules that have had ipf_grpmapinit called, ipf_lookup_deref needs to */ 5513 /* be called to undo what ipf_grpmapinit caused to be done. */ 5514 /* ------------------------------------------------------------------------ */ 5515 static int 5516 ipf_grpmapfini(softc, fr) 5517 ipf_main_softc_t *softc; 5518 frentry_t *fr; 5519 { 5520 iphtable_t *iph; 5521 iph = fr->fr_ptr; 5522 if (iph != NULL) 5523 ipf_lookup_deref(softc, IPLT_HASH, iph); 5524 return 0; 5525 } 5526 5527 5528 /* ------------------------------------------------------------------------ */ 5529 /* Function: ipf_srcgrpmap */ 5530 /* Returns: frentry_t * - pointer to "new last matching" rule or NULL */ 5531 /* Parameters: fin(I) - pointer to packet information */ 5532 /* passp(IO) - pointer to current/new filter decision (unused) */ 5533 /* */ 5534 /* Look for a rule group head in a hash table, using the source address as */ 5535 /* the key, and descend into that group and continue matching rules against */ 5536 /* the packet. */ 5537 /* ------------------------------------------------------------------------ */ 5538 frentry_t * 5539 ipf_srcgrpmap(fin, passp) 5540 fr_info_t *fin; 5541 u_32_t *passp; 5542 { 5543 frgroup_t *fg; 5544 void *rval; 5545 5546 rval = ipf_iphmfindgroup(fin->fin_main_soft, fin->fin_fr->fr_ptr, 5547 &fin->fin_src); 5548 if (rval == NULL) 5549 return NULL; 5550 5551 fg = rval; 5552 fin->fin_fr = fg->fg_start; 5553 (void) ipf_scanlist(fin, *passp); 5554 return fin->fin_fr; 5555 } 5556 5557 5558 /* ------------------------------------------------------------------------ */ 5559 /* Function: ipf_dstgrpmap */ 5560 /* Returns: frentry_t * - pointer to "new last matching" rule or NULL */ 5561 /* Parameters: fin(I) - pointer to packet information */ 5562 /* passp(IO) - pointer to current/new filter decision (unused) */ 5563 /* */ 5564 /* Look for a rule group head in a hash table, using the destination */ 5565 /* address as the key, and descend into that group and continue matching */ 5566 /* rules against the packet. */ 5567 /* ------------------------------------------------------------------------ */ 5568 frentry_t * 5569 ipf_dstgrpmap(fin, passp) 5570 fr_info_t *fin; 5571 u_32_t *passp; 5572 { 5573 frgroup_t *fg; 5574 void *rval; 5575 5576 rval = ipf_iphmfindgroup(fin->fin_main_soft, fin->fin_fr->fr_ptr, 5577 &fin->fin_dst); 5578 if (rval == NULL) 5579 return NULL; 5580 5581 fg = rval; 5582 fin->fin_fr = fg->fg_start; 5583 (void) ipf_scanlist(fin, *passp); 5584 return fin->fin_fr; 5585 } 5586 5587 /* 5588 * Queue functions 5589 * =============== 5590 * These functions manage objects on queues for efficient timeouts. There 5591 * are a number of system defined queues as well as user defined timeouts. 5592 * It is expected that a lock is held in the domain in which the queue 5593 * belongs (i.e. either state or NAT) when calling any of these functions 5594 * that prevents ipf_freetimeoutqueue() from being called at the same time 5595 * as any other. 5596 */ 5597 5598 5599 /* ------------------------------------------------------------------------ */ 5600 /* Function: ipf_addtimeoutqueue */ 5601 /* Returns: struct ifqtq * - NULL if malloc fails, else pointer to */ 5602 /* timeout queue with given interval. */ 5603 /* Parameters: parent(I) - pointer to pointer to parent node of this list */ 5604 /* of interface queues. */ 5605 /* seconds(I) - timeout value in seconds for this queue. */ 5606 /* */ 5607 /* This routine first looks for a timeout queue that matches the interval */ 5608 /* being requested. If it finds one, increments the reference counter and */ 5609 /* returns a pointer to it. If none are found, it allocates a new one and */ 5610 /* inserts it at the top of the list. */ 5611 /* */ 5612 /* Locking. */ 5613 /* It is assumed that the caller of this function has an appropriate lock */ 5614 /* held (exclusively) in the domain that encompases 'parent'. */ 5615 /* ------------------------------------------------------------------------ */ 5616 ipftq_t * 5617 ipf_addtimeoutqueue(softc, parent, seconds) 5618 ipf_main_softc_t *softc; 5619 ipftq_t **parent; 5620 u_int seconds; 5621 { 5622 ipftq_t *ifq; 5623 u_int period; 5624 5625 period = seconds * IPF_HZ_DIVIDE; 5626 5627 MUTEX_ENTER(&softc->ipf_timeoutlock); 5628 for (ifq = *parent; ifq != NULL; ifq = ifq->ifq_next) { 5629 if (ifq->ifq_ttl == period) { 5630 /* 5631 * Reset the delete flag, if set, so the structure 5632 * gets reused rather than freed and reallocated. 5633 */ 5634 MUTEX_ENTER(&ifq->ifq_lock); 5635 ifq->ifq_flags &= ~IFQF_DELETE; 5636 ifq->ifq_ref++; 5637 MUTEX_EXIT(&ifq->ifq_lock); 5638 MUTEX_EXIT(&softc->ipf_timeoutlock); 5639 5640 return ifq; 5641 } 5642 } 5643 5644 KMALLOC(ifq, ipftq_t *); 5645 if (ifq != NULL) { 5646 MUTEX_NUKE(&ifq->ifq_lock); 5647 IPFTQ_INIT(ifq, period, "ipftq mutex"); 5648 ifq->ifq_next = *parent; 5649 ifq->ifq_pnext = parent; 5650 ifq->ifq_flags = IFQF_USER; 5651 ifq->ifq_ref++; 5652 *parent = ifq; 5653 softc->ipf_userifqs++; 5654 } 5655 MUTEX_EXIT(&softc->ipf_timeoutlock); 5656 return ifq; 5657 } 5658 5659 5660 /* ------------------------------------------------------------------------ */ 5661 /* Function: ipf_deletetimeoutqueue */ 5662 /* Returns: int - new reference count value of the timeout queue */ 5663 /* Parameters: ifq(I) - timeout queue which is losing a reference. */ 5664 /* Locks: ifq->ifq_lock */ 5665 /* */ 5666 /* This routine must be called when we're discarding a pointer to a timeout */ 5667 /* queue object, taking care of the reference counter. */ 5668 /* */ 5669 /* Now that this just sets a DELETE flag, it requires the expire code to */ 5670 /* check the list of user defined timeout queues and call the free function */ 5671 /* below (currently commented out) to stop memory leaking. It is done this */ 5672 /* way because the locking may not be sufficient to safely do a free when */ 5673 /* this function is called. */ 5674 /* ------------------------------------------------------------------------ */ 5675 int 5676 ipf_deletetimeoutqueue(ifq) 5677 ipftq_t *ifq; 5678 { 5679 5680 ifq->ifq_ref--; 5681 if ((ifq->ifq_ref == 0) && ((ifq->ifq_flags & IFQF_USER) != 0)) { 5682 ifq->ifq_flags |= IFQF_DELETE; 5683 } 5684 5685 return ifq->ifq_ref; 5686 } 5687 5688 5689 /* ------------------------------------------------------------------------ */ 5690 /* Function: ipf_freetimeoutqueue */ 5691 /* Parameters: ifq(I) - timeout queue which is losing a reference. */ 5692 /* Returns: Nil */ 5693 /* */ 5694 /* Locking: */ 5695 /* It is assumed that the caller of this function has an appropriate lock */ 5696 /* held (exclusively) in the domain that encompases the callers "domain". */ 5697 /* The ifq_lock for this structure should not be held. */ 5698 /* */ 5699 /* Remove a user defined timeout queue from the list of queues it is in and */ 5700 /* tidy up after this is done. */ 5701 /* ------------------------------------------------------------------------ */ 5702 void 5703 ipf_freetimeoutqueue(softc, ifq) 5704 ipf_main_softc_t *softc; 5705 ipftq_t *ifq; 5706 { 5707 5708 if (((ifq->ifq_flags & IFQF_DELETE) == 0) || (ifq->ifq_ref != 0) || 5709 ((ifq->ifq_flags & IFQF_USER) == 0)) { 5710 printf("ipf_freetimeoutqueue(%lx) flags 0x%x ttl %d ref %d\n", 5711 (u_long)ifq, ifq->ifq_flags, ifq->ifq_ttl, 5712 ifq->ifq_ref); 5713 return; 5714 } 5715 5716 /* 5717 * Remove from its position in the list. 5718 */ 5719 *ifq->ifq_pnext = ifq->ifq_next; 5720 if (ifq->ifq_next != NULL) 5721 ifq->ifq_next->ifq_pnext = ifq->ifq_pnext; 5722 ifq->ifq_next = NULL; 5723 ifq->ifq_pnext = NULL; 5724 5725 MUTEX_DESTROY(&ifq->ifq_lock); 5726 ATOMIC_DEC(softc->ipf_userifqs); 5727 KFREE(ifq); 5728 } 5729 5730 5731 /* ------------------------------------------------------------------------ */ 5732 /* Function: ipf_deletequeueentry */ 5733 /* Returns: Nil */ 5734 /* Parameters: tqe(I) - timeout queue entry to delete */ 5735 /* */ 5736 /* Remove a tail queue entry from its queue and make it an orphan. */ 5737 /* ipf_deletetimeoutqueue is called to make sure the reference count on the */ 5738 /* queue is correct. We can't, however, call ipf_freetimeoutqueue because */ 5739 /* the correct lock(s) may not be held that would make it safe to do so. */ 5740 /* ------------------------------------------------------------------------ */ 5741 void 5742 ipf_deletequeueentry(tqe) 5743 ipftqent_t *tqe; 5744 { 5745 ipftq_t *ifq; 5746 5747 ifq = tqe->tqe_ifq; 5748 5749 MUTEX_ENTER(&ifq->ifq_lock); 5750 5751 if (tqe->tqe_pnext != NULL) { 5752 *tqe->tqe_pnext = tqe->tqe_next; 5753 if (tqe->tqe_next != NULL) 5754 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5755 else /* we must be the tail anyway */ 5756 ifq->ifq_tail = tqe->tqe_pnext; 5757 5758 tqe->tqe_pnext = NULL; 5759 tqe->tqe_ifq = NULL; 5760 } 5761 5762 (void) ipf_deletetimeoutqueue(ifq); 5763 ASSERT(ifq->ifq_ref > 0); 5764 5765 MUTEX_EXIT(&ifq->ifq_lock); 5766 } 5767 5768 5769 /* ------------------------------------------------------------------------ */ 5770 /* Function: ipf_queuefront */ 5771 /* Returns: Nil */ 5772 /* Parameters: tqe(I) - pointer to timeout queue entry */ 5773 /* */ 5774 /* Move a queue entry to the front of the queue, if it isn't already there. */ 5775 /* ------------------------------------------------------------------------ */ 5776 void 5777 ipf_queuefront(tqe) 5778 ipftqent_t *tqe; 5779 { 5780 ipftq_t *ifq; 5781 5782 ifq = tqe->tqe_ifq; 5783 if (ifq == NULL) 5784 return; 5785 5786 MUTEX_ENTER(&ifq->ifq_lock); 5787 if (ifq->ifq_head != tqe) { 5788 *tqe->tqe_pnext = tqe->tqe_next; 5789 if (tqe->tqe_next) 5790 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5791 else 5792 ifq->ifq_tail = tqe->tqe_pnext; 5793 5794 tqe->tqe_next = ifq->ifq_head; 5795 ifq->ifq_head->tqe_pnext = &tqe->tqe_next; 5796 ifq->ifq_head = tqe; 5797 tqe->tqe_pnext = &ifq->ifq_head; 5798 } 5799 MUTEX_EXIT(&ifq->ifq_lock); 5800 } 5801 5802 5803 /* ------------------------------------------------------------------------ */ 5804 /* Function: ipf_queueback */ 5805 /* Returns: Nil */ 5806 /* Parameters: ticks(I) - ipf tick time to use with this call */ 5807 /* tqe(I) - pointer to timeout queue entry */ 5808 /* */ 5809 /* Move a queue entry to the back of the queue, if it isn't already there. */ 5810 /* We use use ticks to calculate the expiration and mark for when we last */ 5811 /* touched the structure. */ 5812 /* ------------------------------------------------------------------------ */ 5813 void 5814 ipf_queueback(ticks, tqe) 5815 u_long ticks; 5816 ipftqent_t *tqe; 5817 { 5818 ipftq_t *ifq; 5819 5820 ifq = tqe->tqe_ifq; 5821 if (ifq == NULL) 5822 return; 5823 tqe->tqe_die = ticks + ifq->ifq_ttl; 5824 tqe->tqe_touched = ticks; 5825 5826 MUTEX_ENTER(&ifq->ifq_lock); 5827 if (tqe->tqe_next != NULL) { /* at the end already ? */ 5828 /* 5829 * Remove from list 5830 */ 5831 *tqe->tqe_pnext = tqe->tqe_next; 5832 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5833 5834 /* 5835 * Make it the last entry. 5836 */ 5837 tqe->tqe_next = NULL; 5838 tqe->tqe_pnext = ifq->ifq_tail; 5839 *ifq->ifq_tail = tqe; 5840 ifq->ifq_tail = &tqe->tqe_next; 5841 } 5842 MUTEX_EXIT(&ifq->ifq_lock); 5843 } 5844 5845 5846 /* ------------------------------------------------------------------------ */ 5847 /* Function: ipf_queueappend */ 5848 /* Returns: Nil */ 5849 /* Parameters: ticks(I) - ipf tick time to use with this call */ 5850 /* tqe(I) - pointer to timeout queue entry */ 5851 /* ifq(I) - pointer to timeout queue */ 5852 /* parent(I) - owing object pointer */ 5853 /* */ 5854 /* Add a new item to this queue and put it on the very end. */ 5855 /* We use use ticks to calculate the expiration and mark for when we last */ 5856 /* touched the structure. */ 5857 /* ------------------------------------------------------------------------ */ 5858 void 5859 ipf_queueappend(ticks, tqe, ifq, parent) 5860 u_long ticks; 5861 ipftqent_t *tqe; 5862 ipftq_t *ifq; 5863 void *parent; 5864 { 5865 5866 MUTEX_ENTER(&ifq->ifq_lock); 5867 tqe->tqe_parent = parent; 5868 tqe->tqe_pnext = ifq->ifq_tail; 5869 *ifq->ifq_tail = tqe; 5870 ifq->ifq_tail = &tqe->tqe_next; 5871 tqe->tqe_next = NULL; 5872 tqe->tqe_ifq = ifq; 5873 tqe->tqe_die = ticks + ifq->ifq_ttl; 5874 tqe->tqe_touched = ticks; 5875 ifq->ifq_ref++; 5876 MUTEX_EXIT(&ifq->ifq_lock); 5877 } 5878 5879 5880 /* ------------------------------------------------------------------------ */ 5881 /* Function: ipf_movequeue */ 5882 /* Returns: Nil */ 5883 /* Parameters: tq(I) - pointer to timeout queue information */ 5884 /* oifp(I) - old timeout queue entry was on */ 5885 /* nifp(I) - new timeout queue to put entry on */ 5886 /* */ 5887 /* Move a queue entry from one timeout queue to another timeout queue. */ 5888 /* If it notices that the current entry is already last and does not need */ 5889 /* to move queue, the return. */ 5890 /* ------------------------------------------------------------------------ */ 5891 void 5892 ipf_movequeue(ticks, tqe, oifq, nifq) 5893 u_long ticks; 5894 ipftqent_t *tqe; 5895 ipftq_t *oifq, *nifq; 5896 { 5897 5898 /* 5899 * If the queue hasn't changed and we last touched this entry at the 5900 * same ipf time, then we're not going to achieve anything by either 5901 * changing the ttl or moving it on the queue. 5902 */ 5903 if (oifq == nifq && tqe->tqe_touched == ticks) 5904 return; 5905 5906 /* 5907 * For any of this to be outside the lock, there is a risk that two 5908 * packets entering simultaneously, with one changing to a different 5909 * queue and one not, could end up with things in a bizarre state. 5910 */ 5911 MUTEX_ENTER(&oifq->ifq_lock); 5912 5913 tqe->tqe_touched = ticks; 5914 tqe->tqe_die = ticks + nifq->ifq_ttl; 5915 /* 5916 * Is the operation here going to be a no-op ? 5917 */ 5918 if (oifq == nifq) { 5919 if ((tqe->tqe_next == NULL) || 5920 (tqe->tqe_next->tqe_die == tqe->tqe_die)) { 5921 MUTEX_EXIT(&oifq->ifq_lock); 5922 return; 5923 } 5924 } 5925 5926 /* 5927 * Remove from the old queue 5928 */ 5929 *tqe->tqe_pnext = tqe->tqe_next; 5930 if (tqe->tqe_next) 5931 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5932 else 5933 oifq->ifq_tail = tqe->tqe_pnext; 5934 tqe->tqe_next = NULL; 5935 5936 /* 5937 * If we're moving from one queue to another, release the 5938 * lock on the old queue and get a lock on the new queue. 5939 * For user defined queues, if we're moving off it, call 5940 * delete in case it can now be freed. 5941 */ 5942 if (oifq != nifq) { 5943 tqe->tqe_ifq = NULL; 5944 5945 (void) ipf_deletetimeoutqueue(oifq); 5946 5947 MUTEX_EXIT(&oifq->ifq_lock); 5948 5949 MUTEX_ENTER(&nifq->ifq_lock); 5950 5951 tqe->tqe_ifq = nifq; 5952 nifq->ifq_ref++; 5953 } 5954 5955 /* 5956 * Add to the bottom of the new queue 5957 */ 5958 tqe->tqe_pnext = nifq->ifq_tail; 5959 *nifq->ifq_tail = tqe; 5960 nifq->ifq_tail = &tqe->tqe_next; 5961 MUTEX_EXIT(&nifq->ifq_lock); 5962 } 5963 5964 5965 /* ------------------------------------------------------------------------ */ 5966 /* Function: ipf_updateipid */ 5967 /* Returns: int - 0 == success, -1 == error (packet should be droppped) */ 5968 /* Parameters: fin(I) - pointer to packet information */ 5969 /* */ 5970 /* When we are doing NAT, change the IP of every packet to represent a */ 5971 /* single sequence of packets coming from the host, hiding any host */ 5972 /* specific sequencing that might otherwise be revealed. If the packet is */ 5973 /* a fragment, then store the 'new' IPid in the fragment cache and look up */ 5974 /* the fragment cache for non-leading fragments. If a non-leading fragment */ 5975 /* has no match in the cache, return an error. */ 5976 /* ------------------------------------------------------------------------ */ 5977 static int 5978 ipf_updateipid(fin) 5979 fr_info_t *fin; 5980 { 5981 u_short id, ido, sums; 5982 u_32_t sumd, sum; 5983 ip_t *ip; 5984 5985 if (fin->fin_off != 0) { 5986 sum = ipf_frag_ipidknown(fin); 5987 if (sum == 0xffffffff) 5988 return -1; 5989 sum &= 0xffff; 5990 id = (u_short)sum; 5991 } else { 5992 id = ipf_nextipid(fin); 5993 if (fin->fin_off == 0 && (fin->fin_flx & FI_FRAG) != 0) 5994 (void) ipf_frag_ipidnew(fin, (u_32_t)id); 5995 } 5996 5997 ip = fin->fin_ip; 5998 ido = ntohs(ip->ip_id); 5999 if (id == ido) 6000 return 0; 6001 ip->ip_id = htons(id); 6002 CALC_SUMD(ido, id, sumd); /* DESTRUCTIVE MACRO! id,ido change */ 6003 sum = (~ntohs(ip->ip_sum)) & 0xffff; 6004 sum += sumd; 6005 sum = (sum >> 16) + (sum & 0xffff); 6006 sum = (sum >> 16) + (sum & 0xffff); 6007 sums = ~(u_short)sum; 6008 ip->ip_sum = htons(sums); 6009 return 0; 6010 } 6011 6012 6013 #ifdef NEED_FRGETIFNAME 6014 /* ------------------------------------------------------------------------ */ 6015 /* Function: ipf_getifname */ 6016 /* Returns: char * - pointer to interface name */ 6017 /* Parameters: ifp(I) - pointer to network interface */ 6018 /* buffer(O) - pointer to where to store interface name */ 6019 /* */ 6020 /* Constructs an interface name in the buffer passed. The buffer passed is */ 6021 /* expected to be at least LIFNAMSIZ in bytes big. If buffer is passed in */ 6022 /* as a NULL pointer then return a pointer to a static array. */ 6023 /* ------------------------------------------------------------------------ */ 6024 char * 6025 ipf_getifname(ifp, buffer) 6026 struct ifnet *ifp; 6027 char *buffer; 6028 { 6029 static char namebuf[LIFNAMSIZ]; 6030 # if defined(MENTAT) || defined(__FreeBSD__) || defined(__osf__) || \ 6031 defined(__sgi) || defined(linux) || defined(_AIX51) || \ 6032 (defined(sun) && !defined(__SVR4) && !defined(__svr4__)) 6033 int unit, space; 6034 char temp[20]; 6035 char *s; 6036 # endif 6037 6038 if (buffer == NULL) 6039 buffer = namebuf; 6040 (void) strncpy(buffer, ifp->if_name, LIFNAMSIZ); 6041 buffer[LIFNAMSIZ - 1] = '\0'; 6042 # if defined(MENTAT) || defined(__FreeBSD__) || defined(__osf__) || \ 6043 defined(__sgi) || defined(_AIX51) || \ 6044 (defined(sun) && !defined(__SVR4) && !defined(__svr4__)) 6045 for (s = buffer; *s; s++) 6046 ; 6047 unit = ifp->if_unit; 6048 space = LIFNAMSIZ - (s - buffer); 6049 if ((space > 0) && (unit >= 0)) { 6050 # if defined(SNPRINTF) && defined(_KERNEL) 6051 SNPRINTF(temp, sizeof(temp), "%d", unit); 6052 # else 6053 (void) sprintf(temp, "%d", unit); 6054 # endif 6055 (void) strncpy(s, temp, space); 6056 } 6057 # endif 6058 return buffer; 6059 } 6060 #endif 6061 6062 6063 /* ------------------------------------------------------------------------ */ 6064 /* Function: ipf_ioctlswitch */ 6065 /* Returns: int - -1 continue processing, else ioctl return value */ 6066 /* Parameters: unit(I) - device unit opened */ 6067 /* data(I) - pointer to ioctl data */ 6068 /* cmd(I) - ioctl command */ 6069 /* mode(I) - mode value */ 6070 /* uid(I) - uid making the ioctl call */ 6071 /* ctx(I) - pointer to context data */ 6072 /* */ 6073 /* Based on the value of unit, call the appropriate ioctl handler or return */ 6074 /* EIO if ipfilter is not running. Also checks if write perms are req'd */ 6075 /* for the device in order to execute the ioctl. A special case is made */ 6076 /* SIOCIPFINTERROR so that the same code isn't required in every handler. */ 6077 /* ------------------------------------------------------------------------ */ 6078 int 6079 ipf_ioctlswitch(softc, unit, data, cmd, mode, uid, ctx) 6080 ipf_main_softc_t *softc; 6081 int unit, mode, uid; 6082 ioctlcmd_t cmd; 6083 void *data, *ctx; 6084 { 6085 int error = 0; 6086 6087 switch (cmd) 6088 { 6089 case SIOCIPFINTERROR : 6090 error = BCOPYOUT(&softc->ipf_interror, data, 6091 sizeof(softc->ipf_interror)); 6092 if (error != 0) { 6093 IPFERROR(40); 6094 error = EFAULT; 6095 } 6096 return error; 6097 default : 6098 break; 6099 } 6100 6101 switch (unit) 6102 { 6103 case IPL_LOGIPF : 6104 error = ipf_ipf_ioctl(softc, data, cmd, mode, uid, ctx); 6105 break; 6106 case IPL_LOGNAT : 6107 if (softc->ipf_running > 0) { 6108 error = ipf_nat_ioctl(softc, data, cmd, mode, 6109 uid, ctx); 6110 } else { 6111 IPFERROR(42); 6112 error = EIO; 6113 } 6114 break; 6115 case IPL_LOGSTATE : 6116 if (softc->ipf_running > 0) { 6117 error = ipf_state_ioctl(softc, data, cmd, mode, 6118 uid, ctx); 6119 } else { 6120 IPFERROR(43); 6121 error = EIO; 6122 } 6123 break; 6124 case IPL_LOGAUTH : 6125 if (softc->ipf_running > 0) { 6126 error = ipf_auth_ioctl(softc, data, cmd, mode, 6127 uid, ctx); 6128 } else { 6129 IPFERROR(44); 6130 error = EIO; 6131 } 6132 break; 6133 case IPL_LOGSYNC : 6134 if (softc->ipf_running > 0) { 6135 error = ipf_sync_ioctl(softc, data, cmd, mode, 6136 uid, ctx); 6137 } else { 6138 error = EIO; 6139 IPFERROR(45); 6140 } 6141 break; 6142 case IPL_LOGSCAN : 6143 #ifdef IPFILTER_SCAN 6144 if (softc->ipf_running > 0) 6145 error = ipf_scan_ioctl(softc, data, cmd, mode, 6146 uid, ctx); 6147 else 6148 #endif 6149 { 6150 error = EIO; 6151 IPFERROR(46); 6152 } 6153 break; 6154 case IPL_LOGLOOKUP : 6155 if (softc->ipf_running > 0) { 6156 error = ipf_lookup_ioctl(softc, data, cmd, mode, 6157 uid, ctx); 6158 } else { 6159 error = EIO; 6160 IPFERROR(47); 6161 } 6162 break; 6163 default : 6164 IPFERROR(48); 6165 error = EIO; 6166 break; 6167 } 6168 6169 return error; 6170 } 6171 6172 6173 /* 6174 * This array defines the expected size of objects coming into the kernel 6175 * for the various recognised object types. The first column is flags (see 6176 * below), 2nd column is current size, 3rd column is the version number of 6177 * when the current size became current. 6178 * Flags: 6179 * 1 = minimum size, not absolute size 6180 */ 6181 static int ipf_objbytes[IPFOBJ_COUNT][3] = { 6182 { 1, sizeof(struct frentry), 5010000 }, 6183 { 1, sizeof(struct friostat), 5010000 }, 6184 { 0, sizeof(struct fr_info), 5010000 }, 6185 { 0, sizeof(struct ipf_authstat), 4010100 }, 6186 { 0, sizeof(struct ipfrstat), 5010000 }, 6187 { 1, sizeof(struct ipnat), 5010000 }, 6188 { 0, sizeof(struct natstat), 5010000 }, 6189 { 0, sizeof(struct ipstate_save), 5010000 }, 6190 { 1, sizeof(struct nat_save), 5010000 }, 6191 { 0, sizeof(struct natlookup), 5010000 }, 6192 { 1, sizeof(struct ipstate), 5010000 }, 6193 { 0, sizeof(struct ips_stat), 5010000 }, 6194 { 0, sizeof(struct frauth), 5010000 }, 6195 { 0, sizeof(struct ipftune), 4010100 }, 6196 { 0, sizeof(struct nat), 5010000 }, 6197 { 0, sizeof(struct ipfruleiter), 4011400 }, 6198 { 0, sizeof(struct ipfgeniter), 4011400 }, 6199 { 0, sizeof(struct ipftable), 4011400 }, 6200 { 0, sizeof(struct ipflookupiter), 4011400 }, 6201 { 0, sizeof(struct ipftq) * IPF_TCP_NSTATES }, 6202 { 0, 0, 0 }, /* IPFEXPR */ 6203 { 0, 0, 0 }, /* PROXYCTL */ 6204 { 0, sizeof (struct fripf), 5010000 } 6205 }; 6206 6207 6208 /* ------------------------------------------------------------------------ */ 6209 /* Function: ipf_inobj */ 6210 /* Returns: int - 0 = success, else failure */ 6211 /* Parameters: softc(I) - soft context pointerto work with */ 6212 /* data(I) - pointer to ioctl data */ 6213 /* objp(O) - where to store ipfobj structure */ 6214 /* ptr(I) - pointer to data to copy out */ 6215 /* type(I) - type of structure being moved */ 6216 /* */ 6217 /* Copy in the contents of what the ipfobj_t points to. In future, we */ 6218 /* add things to check for version numbers, sizes, etc, to make it backward */ 6219 /* compatible at the ABI for user land. */ 6220 /* If objp is not NULL then we assume that the caller wants to see what is */ 6221 /* in the ipfobj_t structure being copied in. As an example, this can tell */ 6222 /* the caller what version of ipfilter the ioctl program was written to. */ 6223 /* ------------------------------------------------------------------------ */ 6224 int 6225 ipf_inobj(softc, data, objp, ptr, type) 6226 ipf_main_softc_t *softc; 6227 void *data; 6228 ipfobj_t *objp; 6229 void *ptr; 6230 int type; 6231 { 6232 ipfobj_t obj; 6233 int error; 6234 int size; 6235 6236 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6237 IPFERROR(49); 6238 return EINVAL; 6239 } 6240 6241 if (objp == NULL) 6242 objp = &obj; 6243 error = BCOPYIN(data, objp, sizeof(*objp)); 6244 if (error != 0) { 6245 IPFERROR(124); 6246 return EFAULT; 6247 } 6248 6249 if (objp->ipfo_type != type) { 6250 IPFERROR(50); 6251 return EINVAL; 6252 } 6253 6254 if (objp->ipfo_rev >= ipf_objbytes[type][2]) { 6255 if ((ipf_objbytes[type][0] & 1) != 0) { 6256 if (objp->ipfo_size < ipf_objbytes[type][1]) { 6257 IPFERROR(51); 6258 return EINVAL; 6259 } 6260 size = ipf_objbytes[type][1]; 6261 } else if (objp->ipfo_size == ipf_objbytes[type][1]) { 6262 size = objp->ipfo_size; 6263 } else { 6264 IPFERROR(52); 6265 return EINVAL; 6266 } 6267 error = COPYIN(objp->ipfo_ptr, ptr, size); 6268 if (error != 0) { 6269 IPFERROR(55); 6270 error = EFAULT; 6271 } 6272 } else { 6273 #ifdef IPFILTER_COMPAT 6274 error = ipf_in_compat(softc, objp, ptr, 0); 6275 #else 6276 IPFERROR(54); 6277 error = EINVAL; 6278 #endif 6279 } 6280 return error; 6281 } 6282 6283 6284 /* ------------------------------------------------------------------------ */ 6285 /* Function: ipf_inobjsz */ 6286 /* Returns: int - 0 = success, else failure */ 6287 /* Parameters: softc(I) - soft context pointerto work with */ 6288 /* data(I) - pointer to ioctl data */ 6289 /* ptr(I) - pointer to store real data in */ 6290 /* type(I) - type of structure being moved */ 6291 /* sz(I) - size of data to copy */ 6292 /* */ 6293 /* As per ipf_inobj, except the size of the object to copy in is passed in */ 6294 /* but it must not be smaller than the size defined for the type and the */ 6295 /* type must allow for varied sized objects. The extra requirement here is */ 6296 /* that sz must match the size of the object being passed in - this is not */ 6297 /* not possible nor required in ipf_inobj(). */ 6298 /* ------------------------------------------------------------------------ */ 6299 int 6300 ipf_inobjsz(softc, data, ptr, type, sz) 6301 ipf_main_softc_t *softc; 6302 void *data; 6303 void *ptr; 6304 int type, sz; 6305 { 6306 ipfobj_t obj; 6307 int error; 6308 6309 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6310 IPFERROR(56); 6311 return EINVAL; 6312 } 6313 6314 error = BCOPYIN(data, &obj, sizeof(obj)); 6315 if (error != 0) { 6316 IPFERROR(125); 6317 return EFAULT; 6318 } 6319 6320 if (obj.ipfo_type != type) { 6321 IPFERROR(58); 6322 return EINVAL; 6323 } 6324 6325 if (obj.ipfo_rev >= ipf_objbytes[type][2]) { 6326 if (((ipf_objbytes[type][0] & 1) == 0) || 6327 (sz < ipf_objbytes[type][1])) { 6328 IPFERROR(57); 6329 return EINVAL; 6330 } 6331 error = COPYIN(obj.ipfo_ptr, ptr, sz); 6332 if (error != 0) { 6333 IPFERROR(61); 6334 error = EFAULT; 6335 } 6336 } else { 6337 #ifdef IPFILTER_COMPAT 6338 error = ipf_in_compat(softc, &obj, ptr, sz); 6339 #else 6340 IPFERROR(60); 6341 error = EINVAL; 6342 #endif 6343 } 6344 return error; 6345 } 6346 6347 6348 /* ------------------------------------------------------------------------ */ 6349 /* Function: ipf_outobjsz */ 6350 /* Returns: int - 0 = success, else failure */ 6351 /* Parameters: data(I) - pointer to ioctl data */ 6352 /* ptr(I) - pointer to store real data in */ 6353 /* type(I) - type of structure being moved */ 6354 /* sz(I) - size of data to copy */ 6355 /* */ 6356 /* As per ipf_outobj, except the size of the object to copy out is passed in*/ 6357 /* but it must not be smaller than the size defined for the type and the */ 6358 /* type must allow for varied sized objects. The extra requirement here is */ 6359 /* that sz must match the size of the object being passed in - this is not */ 6360 /* not possible nor required in ipf_outobj(). */ 6361 /* ------------------------------------------------------------------------ */ 6362 int 6363 ipf_outobjsz(softc, data, ptr, type, sz) 6364 ipf_main_softc_t *softc; 6365 void *data; 6366 void *ptr; 6367 int type, sz; 6368 { 6369 ipfobj_t obj; 6370 int error; 6371 6372 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6373 IPFERROR(62); 6374 return EINVAL; 6375 } 6376 6377 error = BCOPYIN(data, &obj, sizeof(obj)); 6378 if (error != 0) { 6379 IPFERROR(127); 6380 return EFAULT; 6381 } 6382 6383 if (obj.ipfo_type != type) { 6384 IPFERROR(63); 6385 return EINVAL; 6386 } 6387 6388 if (obj.ipfo_rev >= ipf_objbytes[type][2]) { 6389 if (((ipf_objbytes[type][0] & 1) == 0) || 6390 (sz < ipf_objbytes[type][1])) { 6391 IPFERROR(146); 6392 return EINVAL; 6393 } 6394 error = COPYOUT(ptr, obj.ipfo_ptr, sz); 6395 if (error != 0) { 6396 IPFERROR(66); 6397 error = EFAULT; 6398 } 6399 } else { 6400 #ifdef IPFILTER_COMPAT 6401 error = ipf_out_compat(softc, &obj, ptr); 6402 #else 6403 IPFERROR(65); 6404 error = EINVAL; 6405 #endif 6406 } 6407 return error; 6408 } 6409 6410 6411 /* ------------------------------------------------------------------------ */ 6412 /* Function: ipf_outobj */ 6413 /* Returns: int - 0 = success, else failure */ 6414 /* Parameters: data(I) - pointer to ioctl data */ 6415 /* ptr(I) - pointer to store real data in */ 6416 /* type(I) - type of structure being moved */ 6417 /* */ 6418 /* Copy out the contents of what ptr is to where ipfobj points to. In */ 6419 /* future, we add things to check for version numbers, sizes, etc, to make */ 6420 /* it backward compatible at the ABI for user land. */ 6421 /* ------------------------------------------------------------------------ */ 6422 int 6423 ipf_outobj(softc, data, ptr, type) 6424 ipf_main_softc_t *softc; 6425 void *data; 6426 void *ptr; 6427 int type; 6428 { 6429 ipfobj_t obj; 6430 int error; 6431 6432 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6433 IPFERROR(67); 6434 return EINVAL; 6435 } 6436 6437 error = BCOPYIN(data, &obj, sizeof(obj)); 6438 if (error != 0) { 6439 IPFERROR(126); 6440 return EFAULT; 6441 } 6442 6443 if (obj.ipfo_type != type) { 6444 IPFERROR(68); 6445 return EINVAL; 6446 } 6447 6448 if (obj.ipfo_rev >= ipf_objbytes[type][2]) { 6449 if ((ipf_objbytes[type][0] & 1) != 0) { 6450 if (obj.ipfo_size < ipf_objbytes[type][1]) { 6451 IPFERROR(69); 6452 return EINVAL; 6453 } 6454 } else if (obj.ipfo_size != ipf_objbytes[type][1]) { 6455 IPFERROR(70); 6456 return EINVAL; 6457 } 6458 6459 error = COPYOUT(ptr, obj.ipfo_ptr, obj.ipfo_size); 6460 if (error != 0) { 6461 IPFERROR(73); 6462 error = EFAULT; 6463 } 6464 } else { 6465 #ifdef IPFILTER_COMPAT 6466 error = ipf_out_compat(softc, &obj, ptr); 6467 #else 6468 IPFERROR(72); 6469 error = EINVAL; 6470 #endif 6471 } 6472 return error; 6473 } 6474 6475 6476 /* ------------------------------------------------------------------------ */ 6477 /* Function: ipf_outobjk */ 6478 /* Returns: int - 0 = success, else failure */ 6479 /* Parameters: obj(I) - pointer to data description structure */ 6480 /* ptr(I) - pointer to kernel data to copy out */ 6481 /* */ 6482 /* In the above functions, the ipfobj_t structure is copied into the kernel,*/ 6483 /* telling ipfilter how to copy out data. In this instance, the ipfobj_t is */ 6484 /* already populated with information and now we just need to use it. */ 6485 /* There is no need for this function to have a "type" parameter as there */ 6486 /* is no point in validating information that comes from the kernel with */ 6487 /* itself. */ 6488 /* ------------------------------------------------------------------------ */ 6489 int ipf_outobjk(softc, obj, ptr) 6490 ipf_main_softc_t *softc; 6491 ipfobj_t *obj; 6492 void *ptr; 6493 { 6494 int type = obj->ipfo_type; 6495 int error; 6496 6497 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6498 IPFERROR(147); 6499 return EINVAL; 6500 } 6501 6502 if (obj->ipfo_rev >= ipf_objbytes[type][2]) { 6503 if ((ipf_objbytes[type][0] & 1) != 0) { 6504 if (obj->ipfo_size < ipf_objbytes[type][1]) { 6505 IPFERROR(148); 6506 return EINVAL; 6507 } 6508 6509 } else if (obj->ipfo_size != ipf_objbytes[type][1]) { 6510 IPFERROR(149); 6511 return EINVAL; 6512 } 6513 6514 error = COPYOUT(ptr, obj->ipfo_ptr, obj->ipfo_size); 6515 if (error != 0) { 6516 IPFERROR(150); 6517 error = EFAULT; 6518 } 6519 } else { 6520 #ifdef IPFILTER_COMPAT 6521 error = ipf_out_compat(softc, obj, ptr); 6522 #else 6523 IPFERROR(151); 6524 error = EINVAL; 6525 #endif 6526 } 6527 return error; 6528 } 6529 6530 6531 /* ------------------------------------------------------------------------ */ 6532 /* Function: ipf_checkl4sum */ 6533 /* Returns: int - 0 = good, -1 = bad, 1 = cannot check */ 6534 /* Parameters: fin(I) - pointer to packet information */ 6535 /* */ 6536 /* If possible, calculate the layer 4 checksum for the packet. If this is */ 6537 /* not possible, return without indicating a failure or success but in a */ 6538 /* way that is ditinguishable. */ 6539 /* ------------------------------------------------------------------------ */ 6540 int 6541 ipf_checkl4sum(fin) 6542 fr_info_t *fin; 6543 { 6544 u_short sum, hdrsum, *csump; 6545 udphdr_t *udp; 6546 int dosum; 6547 6548 if ((fin->fin_flx & FI_NOCKSUM) != 0) 6549 return 0; 6550 6551 if (fin->fin_cksum == -1) 6552 return -1; 6553 6554 if (fin->fin_cksum == 1) 6555 return 0; 6556 6557 /* 6558 * If the TCP packet isn't a fragment, isn't too short and otherwise 6559 * isn't already considered "bad", then validate the checksum. If 6560 * this check fails then considered the packet to be "bad". 6561 */ 6562 if ((fin->fin_flx & (FI_FRAG|FI_SHORT|FI_BAD)) != 0) 6563 return 1; 6564 6565 csump = NULL; 6566 hdrsum = 0; 6567 dosum = 0; 6568 sum = 0; 6569 6570 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) && defined(ICK_VALID) 6571 if (dohwcksum && ((*fin->fin_mp)->b_ick_flag == ICK_VALID)) { 6572 hdrsum = 0; 6573 sum = 0; 6574 } else { 6575 #endif 6576 switch (fin->fin_p) 6577 { 6578 case IPPROTO_TCP : 6579 csump = &((tcphdr_t *)fin->fin_dp)->th_sum; 6580 dosum = 1; 6581 break; 6582 6583 case IPPROTO_UDP : 6584 udp = fin->fin_dp; 6585 if (udp->uh_sum != 0) { 6586 csump = &udp->uh_sum; 6587 dosum = 1; 6588 } 6589 break; 6590 6591 case IPPROTO_ICMP : 6592 csump = &((struct icmp *)fin->fin_dp)->icmp_cksum; 6593 dosum = 1; 6594 break; 6595 6596 default : 6597 return 1; 6598 /*NOTREACHED*/ 6599 } 6600 6601 if (csump != NULL) 6602 hdrsum = *csump; 6603 6604 if (dosum) { 6605 sum = fr_cksum(fin, fin->fin_ip, 6606 fin->fin_p, fin->fin_dp); 6607 } 6608 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) && defined(ICK_VALID) 6609 } 6610 #endif 6611 #if !defined(_KERNEL) 6612 if (sum == hdrsum) { 6613 FR_DEBUG(("checkl4sum: %hx == %hx\n", sum, hdrsum)); 6614 } else { 6615 FR_DEBUG(("checkl4sum: %hx != %hx\n", sum, hdrsum)); 6616 } 6617 #endif 6618 if (hdrsum == sum) { 6619 fin->fin_cksum = 1; 6620 return 0; 6621 } 6622 fin->fin_cksum = -1; 6623 return -1; 6624 } 6625 6626 6627 /* ------------------------------------------------------------------------ */ 6628 /* Function: ipf_ifpfillv4addr */ 6629 /* Returns: int - 0 = address update, -1 = address not updated */ 6630 /* Parameters: atype(I) - type of network address update to perform */ 6631 /* sin(I) - pointer to source of address information */ 6632 /* mask(I) - pointer to source of netmask information */ 6633 /* inp(I) - pointer to destination address store */ 6634 /* inpmask(I) - pointer to destination netmask store */ 6635 /* */ 6636 /* Given a type of network address update (atype) to perform, copy */ 6637 /* information from sin/mask into inp/inpmask. If ipnmask is NULL then no */ 6638 /* netmask update is performed unless FRI_NETMASKED is passed as atype, in */ 6639 /* which case the operation fails. For all values of atype other than */ 6640 /* FRI_NETMASKED, if inpmask is non-NULL then the mask is set to an all 1s */ 6641 /* value. */ 6642 /* ------------------------------------------------------------------------ */ 6643 int 6644 ipf_ifpfillv4addr(atype, sin, mask, inp, inpmask) 6645 int atype; 6646 struct sockaddr_in *sin, *mask; 6647 struct in_addr *inp, *inpmask; 6648 { 6649 if (inpmask != NULL && atype != FRI_NETMASKED) 6650 inpmask->s_addr = 0xffffffff; 6651 6652 if (atype == FRI_NETWORK || atype == FRI_NETMASKED) { 6653 if (atype == FRI_NETMASKED) { 6654 if (inpmask == NULL) 6655 return -1; 6656 inpmask->s_addr = mask->sin_addr.s_addr; 6657 } 6658 inp->s_addr = sin->sin_addr.s_addr & mask->sin_addr.s_addr; 6659 } else { 6660 inp->s_addr = sin->sin_addr.s_addr; 6661 } 6662 return 0; 6663 } 6664 6665 6666 #ifdef USE_INET6 6667 /* ------------------------------------------------------------------------ */ 6668 /* Function: ipf_ifpfillv6addr */ 6669 /* Returns: int - 0 = address update, -1 = address not updated */ 6670 /* Parameters: atype(I) - type of network address update to perform */ 6671 /* sin(I) - pointer to source of address information */ 6672 /* mask(I) - pointer to source of netmask information */ 6673 /* inp(I) - pointer to destination address store */ 6674 /* inpmask(I) - pointer to destination netmask store */ 6675 /* */ 6676 /* Given a type of network address update (atype) to perform, copy */ 6677 /* information from sin/mask into inp/inpmask. If ipnmask is NULL then no */ 6678 /* netmask update is performed unless FRI_NETMASKED is passed as atype, in */ 6679 /* which case the operation fails. For all values of atype other than */ 6680 /* FRI_NETMASKED, if inpmask is non-NULL then the mask is set to an all 1s */ 6681 /* value. */ 6682 /* ------------------------------------------------------------------------ */ 6683 int 6684 ipf_ifpfillv6addr(atype, sin, mask, inp, inpmask) 6685 int atype; 6686 struct sockaddr_in6 *sin, *mask; 6687 i6addr_t *inp, *inpmask; 6688 { 6689 i6addr_t *src, *and; 6690 6691 src = (i6addr_t *)&sin->sin6_addr; 6692 and = (i6addr_t *)&mask->sin6_addr; 6693 6694 if (inpmask != NULL && atype != FRI_NETMASKED) { 6695 inpmask->i6[0] = 0xffffffff; 6696 inpmask->i6[1] = 0xffffffff; 6697 inpmask->i6[2] = 0xffffffff; 6698 inpmask->i6[3] = 0xffffffff; 6699 } 6700 6701 if (atype == FRI_NETWORK || atype == FRI_NETMASKED) { 6702 if (atype == FRI_NETMASKED) { 6703 if (inpmask == NULL) 6704 return -1; 6705 inpmask->i6[0] = and->i6[0]; 6706 inpmask->i6[1] = and->i6[1]; 6707 inpmask->i6[2] = and->i6[2]; 6708 inpmask->i6[3] = and->i6[3]; 6709 } 6710 6711 inp->i6[0] = src->i6[0] & and->i6[0]; 6712 inp->i6[1] = src->i6[1] & and->i6[1]; 6713 inp->i6[2] = src->i6[2] & and->i6[2]; 6714 inp->i6[3] = src->i6[3] & and->i6[3]; 6715 } else { 6716 inp->i6[0] = src->i6[0]; 6717 inp->i6[1] = src->i6[1]; 6718 inp->i6[2] = src->i6[2]; 6719 inp->i6[3] = src->i6[3]; 6720 } 6721 return 0; 6722 } 6723 #endif 6724 6725 6726 /* ------------------------------------------------------------------------ */ 6727 /* Function: ipf_matchtag */ 6728 /* Returns: 0 == mismatch, 1 == match. */ 6729 /* Parameters: tag1(I) - pointer to first tag to compare */ 6730 /* tag2(I) - pointer to second tag to compare */ 6731 /* */ 6732 /* Returns true (non-zero) or false(0) if the two tag structures can be */ 6733 /* considered to be a match or not match, respectively. The tag is 16 */ 6734 /* bytes long (16 characters) but that is overlayed with 4 32bit ints so */ 6735 /* compare the ints instead, for speed. tag1 is the master of the */ 6736 /* comparison. This function should only be called with both tag1 and tag2 */ 6737 /* as non-NULL pointers. */ 6738 /* ------------------------------------------------------------------------ */ 6739 int 6740 ipf_matchtag(tag1, tag2) 6741 ipftag_t *tag1, *tag2; 6742 { 6743 if (tag1 == tag2) 6744 return 1; 6745 6746 if ((tag1->ipt_num[0] == 0) && (tag2->ipt_num[0] == 0)) 6747 return 1; 6748 6749 if ((tag1->ipt_num[0] == tag2->ipt_num[0]) && 6750 (tag1->ipt_num[1] == tag2->ipt_num[1]) && 6751 (tag1->ipt_num[2] == tag2->ipt_num[2]) && 6752 (tag1->ipt_num[3] == tag2->ipt_num[3])) 6753 return 1; 6754 return 0; 6755 } 6756 6757 6758 /* ------------------------------------------------------------------------ */ 6759 /* Function: ipf_coalesce */ 6760 /* Returns: 1 == success, -1 == failure, 0 == no change */ 6761 /* Parameters: fin(I) - pointer to packet information */ 6762 /* */ 6763 /* Attempt to get all of the packet data into a single, contiguous buffer. */ 6764 /* If this call returns a failure then the buffers have also been freed. */ 6765 /* ------------------------------------------------------------------------ */ 6766 int 6767 ipf_coalesce(fin) 6768 fr_info_t *fin; 6769 { 6770 6771 if ((fin->fin_flx & FI_COALESCE) != 0) 6772 return 1; 6773 6774 /* 6775 * If the mbuf pointers indicate that there is no mbuf to work with, 6776 * return but do not indicate success or failure. 6777 */ 6778 if (fin->fin_m == NULL || fin->fin_mp == NULL) 6779 return 0; 6780 6781 #if defined(_KERNEL) 6782 if (ipf_pullup(fin->fin_m, fin, fin->fin_plen) == NULL) { 6783 ipf_main_softc_t *softc = fin->fin_main_soft; 6784 6785 DT1(frb_coalesce, fr_info_t *, fin); 6786 LBUMP(ipf_stats[fin->fin_out].fr_badcoalesces); 6787 # ifdef MENTAT 6788 FREE_MB_T(*fin->fin_mp); 6789 # endif 6790 fin->fin_reason = FRB_COALESCE; 6791 *fin->fin_mp = NULL; 6792 fin->fin_m = NULL; 6793 return -1; 6794 } 6795 #else 6796 fin = fin; /* LINT */ 6797 #endif 6798 return 1; 6799 } 6800 6801 6802 /* 6803 * The following table lists all of the tunable variables that can be 6804 * accessed via SIOCIPFGET/SIOCIPFSET/SIOCIPFGETNEXt. The format of each row 6805 * in the table below is as follows: 6806 * 6807 * pointer to value, name of value, minimum, maximum, size of the value's 6808 * container, value attribute flags 6809 * 6810 * For convienience, IPFT_RDONLY means the value is read-only, IPFT_WRDISABLED 6811 * means the value can only be written to when IPFilter is loaded but disabled. 6812 * The obvious implication is if neither of these are set then the value can be 6813 * changed at any time without harm. 6814 */ 6815 6816 6817 /* ------------------------------------------------------------------------ */ 6818 /* Function: ipf_tune_findbycookie */ 6819 /* Returns: NULL = search failed, else pointer to tune struct */ 6820 /* Parameters: cookie(I) - cookie value to search for amongst tuneables */ 6821 /* next(O) - pointer to place to store the cookie for the */ 6822 /* "next" tuneable, if it is desired. */ 6823 /* */ 6824 /* This function is used to walk through all of the existing tunables with */ 6825 /* successive calls. It searches the known tunables for the one which has */ 6826 /* a matching value for "cookie" - ie its address. When returning a match, */ 6827 /* the next one to be found may be returned inside next. */ 6828 /* ------------------------------------------------------------------------ */ 6829 static ipftuneable_t * 6830 ipf_tune_findbycookie(ptop, cookie, next) 6831 ipftuneable_t **ptop; 6832 void *cookie, **next; 6833 { 6834 ipftuneable_t *ta, **tap; 6835 6836 for (ta = *ptop; ta->ipft_name != NULL; ta++) 6837 if (ta == cookie) { 6838 if (next != NULL) { 6839 /* 6840 * If the next entry in the array has a name 6841 * present, then return a pointer to it for 6842 * where to go next, else return a pointer to 6843 * the dynaminc list as a key to search there 6844 * next. This facilitates a weak linking of 6845 * the two "lists" together. 6846 */ 6847 if ((ta + 1)->ipft_name != NULL) 6848 *next = ta + 1; 6849 else 6850 *next = ptop; 6851 } 6852 return ta; 6853 } 6854 6855 for (tap = ptop; (ta = *tap) != NULL; tap = &ta->ipft_next) 6856 if (tap == cookie) { 6857 if (next != NULL) 6858 *next = &ta->ipft_next; 6859 return ta; 6860 } 6861 6862 if (next != NULL) 6863 *next = NULL; 6864 return NULL; 6865 } 6866 6867 6868 /* ------------------------------------------------------------------------ */ 6869 /* Function: ipf_tune_findbyname */ 6870 /* Returns: NULL = search failed, else pointer to tune struct */ 6871 /* Parameters: name(I) - name of the tuneable entry to find. */ 6872 /* */ 6873 /* Search the static array of tuneables and the list of dynamic tuneables */ 6874 /* for an entry with a matching name. If we can find one, return a pointer */ 6875 /* to the matching structure. */ 6876 /* ------------------------------------------------------------------------ */ 6877 static ipftuneable_t * 6878 ipf_tune_findbyname(top, name) 6879 ipftuneable_t *top; 6880 const char *name; 6881 { 6882 ipftuneable_t *ta; 6883 6884 for (ta = top; ta != NULL; ta = ta->ipft_next) 6885 if (!strcmp(ta->ipft_name, name)) { 6886 return ta; 6887 } 6888 6889 return NULL; 6890 } 6891 6892 6893 /* ------------------------------------------------------------------------ */ 6894 /* Function: ipf_tune_add_array */ 6895 /* Returns: int - 0 == success, else failure */ 6896 /* Parameters: newtune - pointer to new tune array to add to tuneables */ 6897 /* */ 6898 /* Appends tune structures from the array passed in (newtune) to the end of */ 6899 /* the current list of "dynamic" tuneable parameters. */ 6900 /* If any entry to be added is already present (by name) then the operation */ 6901 /* is aborted - entries that have been added are removed before returning. */ 6902 /* An entry with no name (NULL) is used as the indication that the end of */ 6903 /* the array has been reached. */ 6904 /* ------------------------------------------------------------------------ */ 6905 int 6906 ipf_tune_add_array(softc, newtune) 6907 ipf_main_softc_t *softc; 6908 ipftuneable_t *newtune; 6909 { 6910 ipftuneable_t *nt, *dt; 6911 int error = 0; 6912 6913 for (nt = newtune; nt->ipft_name != NULL; nt++) { 6914 error = ipf_tune_add(softc, nt); 6915 if (error != 0) { 6916 for (dt = newtune; dt != nt; dt++) { 6917 (void) ipf_tune_del(softc, dt); 6918 } 6919 } 6920 } 6921 6922 return error; 6923 } 6924 6925 6926 /* ------------------------------------------------------------------------ */ 6927 /* Function: ipf_tune_array_link */ 6928 /* Returns: 0 == success, -1 == failure */ 6929 /* Parameters: softc(I) - soft context pointerto work with */ 6930 /* array(I) - pointer to an array of tuneables */ 6931 /* */ 6932 /* Given an array of tunables (array), append them to the current list of */ 6933 /* tuneables for this context (softc->ipf_tuners.) To properly prepare the */ 6934 /* the array for being appended to the list, initialise all of the next */ 6935 /* pointers so we don't need to walk parts of it with ++ and others with */ 6936 /* next. The array is expected to have an entry with a NULL name as the */ 6937 /* terminator. Trying to add an array with no non-NULL names will return as */ 6938 /* a failure. */ 6939 /* ------------------------------------------------------------------------ */ 6940 int 6941 ipf_tune_array_link(softc, array) 6942 ipf_main_softc_t *softc; 6943 ipftuneable_t *array; 6944 { 6945 ipftuneable_t *t, **p; 6946 6947 t = array; 6948 if (t->ipft_name == NULL) 6949 return -1; 6950 6951 for (; t[1].ipft_name != NULL; t++) 6952 t[0].ipft_next = &t[1]; 6953 t->ipft_next = NULL; 6954 6955 /* 6956 * Since a pointer to the last entry isn't kept, we need to find it 6957 * each time we want to add new variables to the list. 6958 */ 6959 for (p = &softc->ipf_tuners; (t = *p) != NULL; p = &t->ipft_next) 6960 if (t->ipft_name == NULL) 6961 break; 6962 *p = array; 6963 6964 return 0; 6965 } 6966 6967 6968 /* ------------------------------------------------------------------------ */ 6969 /* Function: ipf_tune_array_unlink */ 6970 /* Returns: 0 == success, -1 == failure */ 6971 /* Parameters: softc(I) - soft context pointerto work with */ 6972 /* array(I) - pointer to an array of tuneables */ 6973 /* */ 6974 /* ------------------------------------------------------------------------ */ 6975 int 6976 ipf_tune_array_unlink(softc, array) 6977 ipf_main_softc_t *softc; 6978 ipftuneable_t *array; 6979 { 6980 ipftuneable_t *t, **p; 6981 6982 for (p = &softc->ipf_tuners; (t = *p) != NULL; p = &t->ipft_next) 6983 if (t == array) 6984 break; 6985 if (t == NULL) 6986 return -1; 6987 6988 for (; t[1].ipft_name != NULL; t++) 6989 ; 6990 6991 *p = t->ipft_next; 6992 6993 return 0; 6994 } 6995 6996 6997 /* ------------------------------------------------------------------------ */ 6998 /* Function: ipf_tune_array_copy */ 6999 /* Returns: NULL = failure, else pointer to new array */ 7000 /* Parameters: base(I) - pointer to structure base */ 7001 /* size(I) - size of the array at template */ 7002 /* template(I) - original array to copy */ 7003 /* */ 7004 /* Allocate memory for a new set of tuneable values and copy everything */ 7005 /* from template into the new region of memory. The new region is full of */ 7006 /* uninitialised pointers (ipft_next) so set them up. Now, ipftp_offset... */ 7007 /* */ 7008 /* NOTE: the following assumes that sizeof(long) == sizeof(void *) */ 7009 /* In the array template, ipftp_offset is the offset (in bytes) of the */ 7010 /* location of the tuneable value inside the structure pointed to by base. */ 7011 /* As ipftp_offset is a union over the pointers to the tuneable values, if */ 7012 /* we add base to the copy's ipftp_offset, copy ends up with a pointer in */ 7013 /* ipftp_void that points to the stored value. */ 7014 /* ------------------------------------------------------------------------ */ 7015 ipftuneable_t * 7016 ipf_tune_array_copy(base, size, template) 7017 void *base; 7018 size_t size; 7019 ipftuneable_t *template; 7020 { 7021 ipftuneable_t *copy; 7022 int i; 7023 7024 7025 KMALLOCS(copy, ipftuneable_t *, size); 7026 if (copy == NULL) { 7027 return NULL; 7028 } 7029 bcopy(template, copy, size); 7030 7031 for (i = 0; copy[i].ipft_name; i++) { 7032 copy[i].ipft_una.ipftp_offset += (u_long)base; 7033 copy[i].ipft_next = copy + i + 1; 7034 } 7035 7036 return copy; 7037 } 7038 7039 7040 /* ------------------------------------------------------------------------ */ 7041 /* Function: ipf_tune_add */ 7042 /* Returns: int - 0 == success, else failure */ 7043 /* Parameters: newtune - pointer to new tune entry to add to tuneables */ 7044 /* */ 7045 /* Appends tune structures from the array passed in (newtune) to the end of */ 7046 /* the current list of "dynamic" tuneable parameters. Once added, the */ 7047 /* owner of the object is not expected to ever change "ipft_next". */ 7048 /* ------------------------------------------------------------------------ */ 7049 int 7050 ipf_tune_add(softc, newtune) 7051 ipf_main_softc_t *softc; 7052 ipftuneable_t *newtune; 7053 { 7054 ipftuneable_t *ta, **tap; 7055 7056 ta = ipf_tune_findbyname(softc->ipf_tuners, newtune->ipft_name); 7057 if (ta != NULL) { 7058 IPFERROR(74); 7059 return EEXIST; 7060 } 7061 7062 for (tap = &softc->ipf_tuners; *tap != NULL; tap = &(*tap)->ipft_next) 7063 ; 7064 7065 newtune->ipft_next = NULL; 7066 *tap = newtune; 7067 return 0; 7068 } 7069 7070 7071 /* ------------------------------------------------------------------------ */ 7072 /* Function: ipf_tune_del */ 7073 /* Returns: int - 0 == success, else failure */ 7074 /* Parameters: oldtune - pointer to tune entry to remove from the list of */ 7075 /* current dynamic tuneables */ 7076 /* */ 7077 /* Search for the tune structure, by pointer, in the list of those that are */ 7078 /* dynamically added at run time. If found, adjust the list so that this */ 7079 /* structure is no longer part of it. */ 7080 /* ------------------------------------------------------------------------ */ 7081 int 7082 ipf_tune_del(softc, oldtune) 7083 ipf_main_softc_t *softc; 7084 ipftuneable_t *oldtune; 7085 { 7086 ipftuneable_t *ta, **tap; 7087 int error = 0; 7088 7089 for (tap = &softc->ipf_tuners; (ta = *tap) != NULL; 7090 tap = &ta->ipft_next) { 7091 if (ta == oldtune) { 7092 *tap = oldtune->ipft_next; 7093 oldtune->ipft_next = NULL; 7094 break; 7095 } 7096 } 7097 7098 if (ta == NULL) { 7099 error = ESRCH; 7100 IPFERROR(75); 7101 } 7102 return error; 7103 } 7104 7105 7106 /* ------------------------------------------------------------------------ */ 7107 /* Function: ipf_tune_del_array */ 7108 /* Returns: int - 0 == success, else failure */ 7109 /* Parameters: oldtune - pointer to tuneables array */ 7110 /* */ 7111 /* Remove each tuneable entry in the array from the list of "dynamic" */ 7112 /* tunables. If one entry should fail to be found, an error will be */ 7113 /* returned and no further ones removed. */ 7114 /* An entry with a NULL name is used as the indicator of the last entry in */ 7115 /* the array. */ 7116 /* ------------------------------------------------------------------------ */ 7117 int 7118 ipf_tune_del_array(softc, oldtune) 7119 ipf_main_softc_t *softc; 7120 ipftuneable_t *oldtune; 7121 { 7122 ipftuneable_t *ot; 7123 int error = 0; 7124 7125 for (ot = oldtune; ot->ipft_name != NULL; ot++) { 7126 error = ipf_tune_del(softc, ot); 7127 if (error != 0) 7128 break; 7129 } 7130 7131 return error; 7132 7133 } 7134 7135 7136 /* ------------------------------------------------------------------------ */ 7137 /* Function: ipf_tune */ 7138 /* Returns: int - 0 == success, else failure */ 7139 /* Parameters: cmd(I) - ioctl command number */ 7140 /* data(I) - pointer to ioctl data structure */ 7141 /* */ 7142 /* Implement handling of SIOCIPFGETNEXT, SIOCIPFGET and SIOCIPFSET. These */ 7143 /* three ioctls provide the means to access and control global variables */ 7144 /* within IPFilter, allowing (for example) timeouts and table sizes to be */ 7145 /* changed without rebooting, reloading or recompiling. The initialisation */ 7146 /* and 'destruction' routines of the various components of ipfilter are all */ 7147 /* each responsible for handling their own values being too big. */ 7148 /* ------------------------------------------------------------------------ */ 7149 int 7150 ipf_ipftune(softc, cmd, data) 7151 ipf_main_softc_t *softc; 7152 ioctlcmd_t cmd; 7153 void *data; 7154 { 7155 ipftuneable_t *ta; 7156 ipftune_t tu; 7157 void *cookie; 7158 int error; 7159 7160 error = ipf_inobj(softc, data, NULL, &tu, IPFOBJ_TUNEABLE); 7161 if (error != 0) 7162 return error; 7163 7164 tu.ipft_name[sizeof(tu.ipft_name) - 1] = '\0'; 7165 cookie = tu.ipft_cookie; 7166 ta = NULL; 7167 7168 switch (cmd) 7169 { 7170 case SIOCIPFGETNEXT : 7171 /* 7172 * If cookie is non-NULL, assume it to be a pointer to the last 7173 * entry we looked at, so find it (if possible) and return a 7174 * pointer to the next one after it. The last entry in the 7175 * the table is a NULL entry, so when we get to it, set cookie 7176 * to NULL and return that, indicating end of list, erstwhile 7177 * if we come in with cookie set to NULL, we are starting anew 7178 * at the front of the list. 7179 */ 7180 if (cookie != NULL) { 7181 ta = ipf_tune_findbycookie(&softc->ipf_tuners, 7182 cookie, &tu.ipft_cookie); 7183 } else { 7184 ta = softc->ipf_tuners; 7185 tu.ipft_cookie = ta + 1; 7186 } 7187 if (ta != NULL) { 7188 /* 7189 * Entry found, but does the data pointed to by that 7190 * row fit in what we can return? 7191 */ 7192 if (ta->ipft_sz > sizeof(tu.ipft_un)) { 7193 IPFERROR(76); 7194 return EINVAL; 7195 } 7196 7197 tu.ipft_vlong = 0; 7198 if (ta->ipft_sz == sizeof(u_long)) 7199 tu.ipft_vlong = *ta->ipft_plong; 7200 else if (ta->ipft_sz == sizeof(u_int)) 7201 tu.ipft_vint = *ta->ipft_pint; 7202 else if (ta->ipft_sz == sizeof(u_short)) 7203 tu.ipft_vshort = *ta->ipft_pshort; 7204 else if (ta->ipft_sz == sizeof(u_char)) 7205 tu.ipft_vchar = *ta->ipft_pchar; 7206 7207 tu.ipft_sz = ta->ipft_sz; 7208 tu.ipft_min = ta->ipft_min; 7209 tu.ipft_max = ta->ipft_max; 7210 tu.ipft_flags = ta->ipft_flags; 7211 bcopy(ta->ipft_name, tu.ipft_name, 7212 MIN(sizeof(tu.ipft_name), 7213 strlen(ta->ipft_name) + 1)); 7214 } 7215 error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE); 7216 break; 7217 7218 case SIOCIPFGET : 7219 case SIOCIPFSET : 7220 /* 7221 * Search by name or by cookie value for a particular entry 7222 * in the tuning paramter table. 7223 */ 7224 IPFERROR(77); 7225 error = ESRCH; 7226 if (cookie != NULL) { 7227 ta = ipf_tune_findbycookie(&softc->ipf_tuners, 7228 cookie, NULL); 7229 if (ta != NULL) 7230 error = 0; 7231 } else if (tu.ipft_name[0] != '\0') { 7232 ta = ipf_tune_findbyname(softc->ipf_tuners, 7233 tu.ipft_name); 7234 if (ta != NULL) 7235 error = 0; 7236 } 7237 if (error != 0) 7238 break; 7239 7240 if (cmd == (ioctlcmd_t)SIOCIPFGET) { 7241 /* 7242 * Fetch the tuning parameters for a particular value 7243 */ 7244 tu.ipft_vlong = 0; 7245 if (ta->ipft_sz == sizeof(u_long)) 7246 tu.ipft_vlong = *ta->ipft_plong; 7247 else if (ta->ipft_sz == sizeof(u_int)) 7248 tu.ipft_vint = *ta->ipft_pint; 7249 else if (ta->ipft_sz == sizeof(u_short)) 7250 tu.ipft_vshort = *ta->ipft_pshort; 7251 else if (ta->ipft_sz == sizeof(u_char)) 7252 tu.ipft_vchar = *ta->ipft_pchar; 7253 tu.ipft_cookie = ta; 7254 tu.ipft_sz = ta->ipft_sz; 7255 tu.ipft_min = ta->ipft_min; 7256 tu.ipft_max = ta->ipft_max; 7257 tu.ipft_flags = ta->ipft_flags; 7258 error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE); 7259 7260 } else if (cmd == (ioctlcmd_t)SIOCIPFSET) { 7261 /* 7262 * Set an internal parameter. The hard part here is 7263 * getting the new value safely and correctly out of 7264 * the kernel (given we only know its size, not type.) 7265 */ 7266 u_long in; 7267 7268 if (((ta->ipft_flags & IPFT_WRDISABLED) != 0) && 7269 (softc->ipf_running > 0)) { 7270 IPFERROR(78); 7271 error = EBUSY; 7272 break; 7273 } 7274 7275 in = tu.ipft_vlong; 7276 if (in < ta->ipft_min || in > ta->ipft_max) { 7277 IPFERROR(79); 7278 error = EINVAL; 7279 break; 7280 } 7281 7282 if (ta->ipft_func != NULL) { 7283 SPL_INT(s); 7284 7285 SPL_NET(s); 7286 error = (*ta->ipft_func)(softc, ta, 7287 &tu.ipft_un); 7288 SPL_X(s); 7289 7290 } else if (ta->ipft_sz == sizeof(u_long)) { 7291 tu.ipft_vlong = *ta->ipft_plong; 7292 *ta->ipft_plong = in; 7293 7294 } else if (ta->ipft_sz == sizeof(u_int)) { 7295 tu.ipft_vint = *ta->ipft_pint; 7296 *ta->ipft_pint = (u_int)(in & 0xffffffff); 7297 7298 } else if (ta->ipft_sz == sizeof(u_short)) { 7299 tu.ipft_vshort = *ta->ipft_pshort; 7300 *ta->ipft_pshort = (u_short)(in & 0xffff); 7301 7302 } else if (ta->ipft_sz == sizeof(u_char)) { 7303 tu.ipft_vchar = *ta->ipft_pchar; 7304 *ta->ipft_pchar = (u_char)(in & 0xff); 7305 } 7306 error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE); 7307 } 7308 break; 7309 7310 default : 7311 IPFERROR(80); 7312 error = EINVAL; 7313 break; 7314 } 7315 7316 return error; 7317 } 7318 7319 7320 /* ------------------------------------------------------------------------ */ 7321 /* Function: ipf_zerostats */ 7322 /* Returns: int - 0 = success, else failure */ 7323 /* Parameters: data(O) - pointer to pointer for copying data back to */ 7324 /* */ 7325 /* Copies the current statistics out to userspace and then zero's the */ 7326 /* current ones in the kernel. The lock is only held across the bzero() as */ 7327 /* the copyout may result in paging (ie network activity.) */ 7328 /* ------------------------------------------------------------------------ */ 7329 int 7330 ipf_zerostats(softc, data) 7331 ipf_main_softc_t *softc; 7332 caddr_t data; 7333 { 7334 friostat_t fio; 7335 ipfobj_t obj; 7336 int error; 7337 7338 error = ipf_inobj(softc, data, &obj, &fio, IPFOBJ_IPFSTAT); 7339 if (error != 0) 7340 return error; 7341 ipf_getstat(softc, &fio, obj.ipfo_rev); 7342 error = ipf_outobj(softc, data, &fio, IPFOBJ_IPFSTAT); 7343 if (error != 0) 7344 return error; 7345 7346 WRITE_ENTER(&softc->ipf_mutex); 7347 bzero(&softc->ipf_stats, sizeof(softc->ipf_stats)); 7348 RWLOCK_EXIT(&softc->ipf_mutex); 7349 7350 return 0; 7351 } 7352 7353 7354 /* ------------------------------------------------------------------------ */ 7355 /* Function: ipf_resolvedest */ 7356 /* Returns: Nil */ 7357 /* Parameters: softc(I) - pointer to soft context main structure */ 7358 /* base(I) - where strings are stored */ 7359 /* fdp(IO) - pointer to destination information to resolve */ 7360 /* v(I) - IP protocol version to match */ 7361 /* */ 7362 /* Looks up an interface name in the frdest structure pointed to by fdp and */ 7363 /* if a matching name can be found for the particular IP protocol version */ 7364 /* then store the interface pointer in the frdest struct. If no match is */ 7365 /* found, then set the interface pointer to be -1 as NULL is considered to */ 7366 /* indicate there is no information at all in the structure. */ 7367 /* ------------------------------------------------------------------------ */ 7368 int 7369 ipf_resolvedest(softc, base, fdp, v) 7370 ipf_main_softc_t *softc; 7371 char *base; 7372 frdest_t *fdp; 7373 int v; 7374 { 7375 int errval = 0; 7376 void *ifp; 7377 7378 ifp = NULL; 7379 7380 if (fdp->fd_name != -1) { 7381 if (fdp->fd_type == FRD_DSTLIST) { 7382 ifp = ipf_lookup_res_name(softc, IPL_LOGIPF, 7383 IPLT_DSTLIST, 7384 base + fdp->fd_name, 7385 NULL); 7386 if (ifp == NULL) { 7387 IPFERROR(144); 7388 errval = ESRCH; 7389 } 7390 } else { 7391 ifp = GETIFP(base + fdp->fd_name, v); 7392 if (ifp == NULL) 7393 ifp = (void *)-1; 7394 } 7395 } 7396 fdp->fd_ptr = ifp; 7397 7398 if ((ifp != NULL) && (ifp != (void *)-1)) { 7399 fdp->fd_local = ipf_deliverlocal(softc, v, ifp, &fdp->fd_ip6); 7400 } 7401 7402 return errval; 7403 } 7404 7405 7406 /* ------------------------------------------------------------------------ */ 7407 /* Function: ipf_resolvenic */ 7408 /* Returns: void* - NULL = wildcard name, -1 = failed to find NIC, else */ 7409 /* pointer to interface structure for NIC */ 7410 /* Parameters: softc(I)- pointer to soft context main structure */ 7411 /* name(I) - complete interface name */ 7412 /* v(I) - IP protocol version */ 7413 /* */ 7414 /* Look for a network interface structure that firstly has a matching name */ 7415 /* to that passed in and that is also being used for that IP protocol */ 7416 /* version (necessary on some platforms where there are separate listings */ 7417 /* for both IPv4 and IPv6 on the same physical NIC. */ 7418 /* ------------------------------------------------------------------------ */ 7419 void * 7420 ipf_resolvenic(softc, name, v) 7421 ipf_main_softc_t *softc; 7422 char *name; 7423 int v; 7424 { 7425 void *nic; 7426 7427 if (name[0] == '\0') 7428 return NULL; 7429 7430 if ((name[1] == '\0') && ((name[0] == '-') || (name[0] == '*'))) { 7431 return NULL; 7432 } 7433 7434 nic = GETIFP(name, v); 7435 if (nic == NULL) 7436 nic = (void *)-1; 7437 return nic; 7438 } 7439 7440 7441 /* ------------------------------------------------------------------------ */ 7442 /* Function: ipf_token_expire */ 7443 /* Returns: None. */ 7444 /* Parameters: softc(I) - pointer to soft context main structure */ 7445 /* */ 7446 /* This function is run every ipf tick to see if there are any tokens that */ 7447 /* have been held for too long and need to be freed up. */ 7448 /* ------------------------------------------------------------------------ */ 7449 void 7450 ipf_token_expire(softc) 7451 ipf_main_softc_t *softc; 7452 { 7453 ipftoken_t *it; 7454 7455 WRITE_ENTER(&softc->ipf_tokens); 7456 while ((it = softc->ipf_token_head) != NULL) { 7457 if (it->ipt_die > softc->ipf_ticks) 7458 break; 7459 7460 ipf_token_free(softc, it); 7461 } 7462 RWLOCK_EXIT(&softc->ipf_tokens); 7463 } 7464 7465 7466 /* ------------------------------------------------------------------------ */ 7467 /* Function: ipf_token_del */ 7468 /* Returns: int - 0 = success, else error */ 7469 /* Parameters: softc(I)- pointer to soft context main structure */ 7470 /* type(I) - the token type to match */ 7471 /* uid(I) - uid owning the token */ 7472 /* ptr(I) - context pointer for the token */ 7473 /* */ 7474 /* This function looks for a a token in the current list that matches up */ 7475 /* the fields (type, uid, ptr). If none is found, ESRCH is returned, else */ 7476 /* call ipf_token_free() to remove it from the list. */ 7477 /* ------------------------------------------------------------------------ */ 7478 int 7479 ipf_token_del(softc, type, uid, ptr) 7480 ipf_main_softc_t *softc; 7481 int type, uid; 7482 void *ptr; 7483 { 7484 ipftoken_t *it; 7485 int error; 7486 7487 IPFERROR(82); 7488 error = ESRCH; 7489 7490 WRITE_ENTER(&softc->ipf_tokens); 7491 for (it = softc->ipf_token_head; it != NULL; it = it->ipt_next) 7492 if (ptr == it->ipt_ctx && type == it->ipt_type && 7493 uid == it->ipt_uid) { 7494 ipf_token_free(softc, it); 7495 IPFERROR(83); 7496 error = 0; 7497 break; 7498 } 7499 RWLOCK_EXIT(&softc->ipf_tokens); 7500 7501 return error; 7502 } 7503 7504 7505 /* ------------------------------------------------------------------------ */ 7506 /* Function: ipf_token_mark_complete */ 7507 /* Returns: None. */ 7508 /* Parameters: token(I) - pointer to token structure */ 7509 /* */ 7510 /* Mark a token as being ineligable for being found with ipf_token_find */ 7511 /* ------------------------------------------------------------------------ */ 7512 void 7513 ipf_token_mark_complete(token) 7514 ipftoken_t *token; 7515 { 7516 token->ipt_complete = 1; 7517 } 7518 7519 7520 /* ------------------------------------------------------------------------ */ 7521 /* Function: ipf_token_find */ 7522 /* Returns: ipftoken_t * - NULL if no memory, else pointer to token */ 7523 /* Parameters: softc(I)- pointer to soft context main structure */ 7524 /* type(I) - the token type to match */ 7525 /* uid(I) - uid owning the token */ 7526 /* ptr(I) - context pointer for the token */ 7527 /* */ 7528 /* This function looks for a live token in the list of current tokens that */ 7529 /* matches the tuple (type, uid, ptr). If one cannot be found then one is */ 7530 /* allocated. If one is found then it is moved to the top of the list of */ 7531 /* currently active tokens. */ 7532 /* ------------------------------------------------------------------------ */ 7533 ipftoken_t * 7534 ipf_token_find(softc, type, uid, ptr) 7535 ipf_main_softc_t *softc; 7536 int type, uid; 7537 void *ptr; 7538 { 7539 ipftoken_t *it, *new; 7540 7541 KMALLOC(new, ipftoken_t *); 7542 7543 WRITE_ENTER(&softc->ipf_tokens); 7544 for (it = softc->ipf_token_head; it != NULL; it = it->ipt_next) { 7545 if (ptr == it->ipt_ctx && type == it->ipt_type && 7546 uid == it->ipt_uid) 7547 break; 7548 } 7549 7550 if (it == NULL) { 7551 it = new; 7552 new = NULL; 7553 if (it == NULL) { 7554 RWLOCK_EXIT(&softc->ipf_tokens); 7555 return NULL; 7556 } 7557 it->ipt_data = NULL; 7558 it->ipt_ctx = ptr; 7559 it->ipt_uid = uid; 7560 it->ipt_type = type; 7561 it->ipt_next = NULL; 7562 it->ipt_ref = 2; 7563 it->ipt_complete = 0; 7564 } else { 7565 if (new != NULL) { 7566 KFREE(new); 7567 new = NULL; 7568 } 7569 7570 ipf_token_unlink(softc, it); 7571 it->ipt_ref++; 7572 } 7573 7574 if (it->ipt_complete == 0) { 7575 it->ipt_pnext = softc->ipf_token_tail; 7576 *softc->ipf_token_tail = it; 7577 softc->ipf_token_tail = &it->ipt_next; 7578 it->ipt_next = NULL; 7579 7580 it->ipt_die = softc->ipf_ticks + 20; 7581 } else { 7582 it = NULL; 7583 } 7584 7585 RWLOCK_EXIT(&softc->ipf_tokens); 7586 7587 return it; 7588 } 7589 7590 7591 /* ------------------------------------------------------------------------ */ 7592 /* Function: ipf_token_unlink */ 7593 /* Returns: None. */ 7594 /* Parameters: softc(I) - pointer to soft context main structure */ 7595 /* token(I) - pointer to token structure */ 7596 /* Write Locks: ipf_tokens */ 7597 /* */ 7598 /* This function unlinks a token structure from the linked list of tokens */ 7599 /* that "own" it. The head pointer never needs to be explicitly adjusted */ 7600 /* but the tail does due to the linked list implementation. */ 7601 /* ------------------------------------------------------------------------ */ 7602 static void 7603 ipf_token_unlink(softc, token) 7604 ipf_main_softc_t *softc; 7605 ipftoken_t *token; 7606 { 7607 7608 if (softc->ipf_token_tail == &token->ipt_next) 7609 softc->ipf_token_tail = token->ipt_pnext; 7610 7611 *token->ipt_pnext = token->ipt_next; 7612 if (token->ipt_next != NULL) 7613 token->ipt_next->ipt_pnext = token->ipt_pnext; 7614 } 7615 7616 7617 /* ------------------------------------------------------------------------ */ 7618 /* Function: ipf_token_deref */ 7619 /* Returns: None. */ 7620 /* Parameters: softc(I) - pointer to soft context main structure */ 7621 /* token(I) - pointer to token structure */ 7622 /* Write Locks: ipf_tokens */ 7623 /* */ 7624 /* Drop the reference count on the token structure and if it drops to zero, */ 7625 /* call the dereference function for the token type because it is then */ 7626 /* possible to free the token data structure. */ 7627 /* ------------------------------------------------------------------------ */ 7628 void 7629 ipf_token_deref(softc, token) 7630 ipf_main_softc_t *softc; 7631 ipftoken_t *token; 7632 { 7633 void *data, **datap; 7634 7635 token->ipt_ref--; 7636 if (token->ipt_ref > 0) 7637 return; 7638 7639 data = token->ipt_data; 7640 datap = &data; 7641 7642 if ((data != NULL) && (data != (void *)-1)) { 7643 switch (token->ipt_type) 7644 { 7645 case IPFGENITER_IPF : 7646 (void) ipf_derefrule(softc, (frentry_t **)datap); 7647 break; 7648 case IPFGENITER_IPNAT : 7649 WRITE_ENTER(&softc->ipf_nat); 7650 ipf_nat_rulederef(softc, (ipnat_t **)datap); 7651 RWLOCK_EXIT(&softc->ipf_nat); 7652 break; 7653 case IPFGENITER_NAT : 7654 ipf_nat_deref(softc, (nat_t **)datap); 7655 break; 7656 case IPFGENITER_STATE : 7657 ipf_state_deref(softc, (ipstate_t **)datap); 7658 break; 7659 case IPFGENITER_FRAG : 7660 ipf_frag_pkt_deref(softc, (ipfr_t **)datap); 7661 break; 7662 case IPFGENITER_NATFRAG : 7663 ipf_frag_nat_deref(softc, (ipfr_t **)datap); 7664 break; 7665 case IPFGENITER_HOSTMAP : 7666 WRITE_ENTER(&softc->ipf_nat); 7667 ipf_nat_hostmapdel((hostmap_t **)datap); 7668 RWLOCK_EXIT(&softc->ipf_nat); 7669 break; 7670 default : 7671 ipf_lookup_iterderef(softc, token->ipt_type, data); 7672 break; 7673 } 7674 } 7675 7676 KFREE(token); 7677 } 7678 7679 7680 /* ------------------------------------------------------------------------ */ 7681 /* Function: ipf_token_free */ 7682 /* Returns: None. */ 7683 /* Parameters: softc(I) - pointer to soft context main structure */ 7684 /* token(I) - pointer to token structure */ 7685 /* Write Locks: ipf_tokens */ 7686 /* */ 7687 /* This function unlinks a token from the linked list and does a dereference*/ 7688 /* on it to encourage it to be freed. */ 7689 /* ------------------------------------------------------------------------ */ 7690 void 7691 ipf_token_free(softc, token) 7692 ipf_main_softc_t *softc; 7693 ipftoken_t *token; 7694 { 7695 7696 ipf_token_unlink(softc, token); 7697 7698 ipf_token_deref(softc, token); 7699 } 7700 7701 7702 /* ------------------------------------------------------------------------ */ 7703 /* Function: ipf_getnextrule */ 7704 /* Returns: int - 0 = success, else error */ 7705 /* Parameters: softc(I)- pointer to soft context main structure */ 7706 /* t(I) - pointer to destination information to resolve */ 7707 /* ptr(I) - pointer to ipfobj_t to copyin from user space */ 7708 /* */ 7709 /* This function's first job is to bring in the ipfruleiter_t structure via */ 7710 /* the ipfobj_t structure to determine what should be the next rule to */ 7711 /* return. Once the ipfruleiter_t has been brought in, it then tries to */ 7712 /* find the 'next rule'. This may include searching rule group lists or */ 7713 /* just be as simple as looking at the 'next' field in the rule structure. */ 7714 /* When we have found the rule to return, increase its reference count and */ 7715 /* if we used an existing rule to get here, decrease its reference count. */ 7716 /* ------------------------------------------------------------------------ */ 7717 int 7718 ipf_getnextrule(softc, t, ptr) 7719 ipf_main_softc_t *softc; 7720 ipftoken_t *t; 7721 void *ptr; 7722 { 7723 frentry_t *fr, *next, zero; 7724 ipfruleiter_t it; 7725 int error, out; 7726 frgroup_t *fg; 7727 ipfobj_t obj; 7728 char *dst; 7729 7730 if (t == NULL || ptr == NULL) { 7731 IPFERROR(84); 7732 return EFAULT; 7733 } 7734 7735 error = ipf_inobj(softc, ptr, &obj, &it, IPFOBJ_IPFITER); 7736 if (error != 0) 7737 return error; 7738 7739 if ((it.iri_inout < 0) || (it.iri_inout > 3)) { 7740 IPFERROR(85); 7741 return EINVAL; 7742 } 7743 if ((it.iri_active != 0) && (it.iri_active != 1)) { 7744 IPFERROR(86); 7745 return EINVAL; 7746 } 7747 if (it.iri_nrules == 0) { 7748 IPFERROR(87); 7749 return ENOSPC; 7750 } 7751 if (it.iri_rule == NULL) { 7752 IPFERROR(88); 7753 return EFAULT; 7754 } 7755 7756 fg = NULL; 7757 fr = t->ipt_data; 7758 out = it.iri_inout & F_OUT; 7759 7760 READ_ENTER(&softc->ipf_mutex); 7761 if (fr == NULL) { 7762 if (*it.iri_group == '\0') { 7763 if ((it.iri_inout & F_ACIN) != 0) 7764 next = softc->ipf_acct[out][it.iri_active]; 7765 else 7766 next = softc->ipf_rules[out][it.iri_active]; 7767 } else { 7768 fg = ipf_findgroup(softc, it.iri_group, IPL_LOGIPF, 7769 it.iri_active, NULL); 7770 if (fg != NULL) 7771 next = fg->fg_start; 7772 else 7773 next = NULL; 7774 } 7775 } else { 7776 next = fr->fr_next; 7777 } 7778 7779 obj.ipfo_type = IPFOBJ_FRENTRY; 7780 dst = (char *)it.iri_rule; 7781 7782 if (next != NULL) { 7783 obj.ipfo_size = next->fr_size; 7784 MUTEX_ENTER(&next->fr_lock); 7785 next->fr_ref++; 7786 MUTEX_EXIT(&next->fr_lock); 7787 t->ipt_data = next; 7788 } else { 7789 obj.ipfo_size = sizeof(frentry_t); 7790 bzero(&zero, sizeof(zero)); 7791 next = &zero; 7792 t->ipt_data = NULL; 7793 } 7794 if (next->fr_next == NULL) 7795 ipf_token_mark_complete(t); 7796 7797 RWLOCK_EXIT(&softc->ipf_mutex); 7798 7799 obj.ipfo_ptr = dst; 7800 error = ipf_outobjk(softc, &obj, next); 7801 if (error == 0 && t->ipt_data != NULL) { 7802 dst += obj.ipfo_size; 7803 if (next->fr_data != NULL) { 7804 ipfobj_t dobj; 7805 7806 dobj.ipfo_type = IPFOBJ_FRIPF; 7807 dobj.ipfo_size = next->fr_dsize; 7808 dobj.ipfo_rev = obj.ipfo_rev; 7809 dobj.ipfo_ptr = dst; 7810 error = ipf_outobjk(softc, &dobj, next->fr_data); 7811 if (error != 0) 7812 IPFERROR(90); 7813 } 7814 } 7815 7816 if ((fr != NULL) && (next == &zero)) 7817 (void) ipf_derefrule(softc, &fr); 7818 7819 return error; 7820 } 7821 7822 7823 /* ------------------------------------------------------------------------ */ 7824 /* Function: ipf_frruleiter */ 7825 /* Returns: int - 0 = success, else error */ 7826 /* Parameters: softc(I)- pointer to soft context main structure */ 7827 /* data(I) - the token type to match */ 7828 /* uid(I) - uid owning the token */ 7829 /* ptr(I) - context pointer for the token */ 7830 /* */ 7831 /* This function serves as a stepping stone between ipf_ipf_ioctl and */ 7832 /* ipf_getnextrule. It's role is to find the right token in the kernel for */ 7833 /* the process doing the ioctl and use that to ask for the next rule. */ 7834 /* ------------------------------------------------------------------------ */ 7835 static int 7836 ipf_frruleiter(softc, data, uid, ctx) 7837 ipf_main_softc_t *softc; 7838 void *data, *ctx; 7839 int uid; 7840 { 7841 ipftoken_t *token; 7842 int error; 7843 7844 token = ipf_token_find(softc, IPFGENITER_IPF, uid, ctx); 7845 if (token != NULL) { 7846 error = ipf_getnextrule(softc, token, data); 7847 WRITE_ENTER(&softc->ipf_tokens); 7848 if (token->ipt_data == NULL) 7849 ipf_token_free(softc, token); 7850 else 7851 ipf_token_deref(softc, token); 7852 RWLOCK_EXIT(&softc->ipf_tokens); 7853 } else { 7854 IPFERROR(91); 7855 error = 0; 7856 } 7857 7858 return error; 7859 } 7860 7861 7862 /* ------------------------------------------------------------------------ */ 7863 /* Function: ipf_geniter */ 7864 /* Returns: int - 0 = success, else error */ 7865 /* Parameters: softc(I) - pointer to soft context main structure */ 7866 /* token(I) - pointer to ipftoken_t structure */ 7867 /* itp(I) - pointer to iterator data */ 7868 /* */ 7869 /* Decide which iterator function to call using information passed through */ 7870 /* the ipfgeniter_t structure at itp. */ 7871 /* ------------------------------------------------------------------------ */ 7872 static int 7873 ipf_geniter(softc, token, itp) 7874 ipf_main_softc_t *softc; 7875 ipftoken_t *token; 7876 ipfgeniter_t *itp; 7877 { 7878 int error; 7879 7880 switch (itp->igi_type) 7881 { 7882 case IPFGENITER_FRAG : 7883 error = ipf_frag_pkt_next(softc, token, itp); 7884 break; 7885 default : 7886 IPFERROR(92); 7887 error = EINVAL; 7888 break; 7889 } 7890 7891 return error; 7892 } 7893 7894 7895 /* ------------------------------------------------------------------------ */ 7896 /* Function: ipf_genericiter */ 7897 /* Returns: int - 0 = success, else error */ 7898 /* Parameters: softc(I)- pointer to soft context main structure */ 7899 /* data(I) - the token type to match */ 7900 /* uid(I) - uid owning the token */ 7901 /* ptr(I) - context pointer for the token */ 7902 /* */ 7903 /* Handle the SIOCGENITER ioctl for the ipfilter device. The primary role */ 7904 /* ------------------------------------------------------------------------ */ 7905 int 7906 ipf_genericiter(softc, data, uid, ctx) 7907 ipf_main_softc_t *softc; 7908 void *data, *ctx; 7909 int uid; 7910 { 7911 ipftoken_t *token; 7912 ipfgeniter_t iter; 7913 int error; 7914 7915 error = ipf_inobj(softc, data, NULL, &iter, IPFOBJ_GENITER); 7916 if (error != 0) 7917 return error; 7918 7919 token = ipf_token_find(softc, iter.igi_type, uid, ctx); 7920 if (token != NULL) { 7921 token->ipt_subtype = iter.igi_type; 7922 error = ipf_geniter(softc, token, &iter); 7923 WRITE_ENTER(&softc->ipf_tokens); 7924 if (token->ipt_data == NULL) 7925 ipf_token_free(softc, token); 7926 else 7927 ipf_token_deref(softc, token); 7928 RWLOCK_EXIT(&softc->ipf_tokens); 7929 } else { 7930 IPFERROR(93); 7931 error = 0; 7932 } 7933 7934 return error; 7935 } 7936 7937 7938 /* ------------------------------------------------------------------------ */ 7939 /* Function: ipf_ipf_ioctl */ 7940 /* Returns: int - 0 = success, else error */ 7941 /* Parameters: softc(I)- pointer to soft context main structure */ 7942 /* data(I) - the token type to match */ 7943 /* cmd(I) - the ioctl command number */ 7944 /* mode(I) - mode flags for the ioctl */ 7945 /* uid(I) - uid owning the token */ 7946 /* ptr(I) - context pointer for the token */ 7947 /* */ 7948 /* This function handles all of the ioctl command that are actually isssued */ 7949 /* to the /dev/ipl device. */ 7950 /* ------------------------------------------------------------------------ */ 7951 int 7952 ipf_ipf_ioctl(softc, data, cmd, mode, uid, ctx) 7953 ipf_main_softc_t *softc; 7954 caddr_t data; 7955 ioctlcmd_t cmd; 7956 int mode, uid; 7957 void *ctx; 7958 { 7959 friostat_t fio; 7960 int error, tmp; 7961 ipfobj_t obj; 7962 SPL_INT(s); 7963 7964 switch (cmd) 7965 { 7966 case SIOCFRENB : 7967 if (!(mode & FWRITE)) { 7968 IPFERROR(94); 7969 error = EPERM; 7970 } else { 7971 error = BCOPYIN(data, &tmp, sizeof(tmp)); 7972 if (error != 0) { 7973 IPFERROR(95); 7974 error = EFAULT; 7975 break; 7976 } 7977 7978 WRITE_ENTER(&softc->ipf_global); 7979 if (tmp) { 7980 if (softc->ipf_running > 0) 7981 error = 0; 7982 else 7983 error = ipfattach(softc); 7984 if (error == 0) 7985 softc->ipf_running = 1; 7986 else 7987 (void) ipfdetach(softc); 7988 } else { 7989 if (softc->ipf_running == 1) 7990 error = ipfdetach(softc); 7991 else 7992 error = 0; 7993 if (error == 0) 7994 softc->ipf_running = -1; 7995 } 7996 RWLOCK_EXIT(&softc->ipf_global); 7997 } 7998 break; 7999 8000 case SIOCIPFSET : 8001 if (!(mode & FWRITE)) { 8002 IPFERROR(96); 8003 error = EPERM; 8004 break; 8005 } 8006 /* FALLTHRU */ 8007 case SIOCIPFGETNEXT : 8008 case SIOCIPFGET : 8009 error = ipf_ipftune(softc, cmd, (void *)data); 8010 break; 8011 8012 case SIOCSETFF : 8013 if (!(mode & FWRITE)) { 8014 IPFERROR(97); 8015 error = EPERM; 8016 } else { 8017 error = BCOPYIN(data, &softc->ipf_flags, 8018 sizeof(softc->ipf_flags)); 8019 if (error != 0) { 8020 IPFERROR(98); 8021 error = EFAULT; 8022 } 8023 } 8024 break; 8025 8026 case SIOCGETFF : 8027 error = BCOPYOUT(&softc->ipf_flags, data, 8028 sizeof(softc->ipf_flags)); 8029 if (error != 0) { 8030 IPFERROR(99); 8031 error = EFAULT; 8032 } 8033 break; 8034 8035 case SIOCFUNCL : 8036 error = ipf_resolvefunc(softc, (void *)data); 8037 break; 8038 8039 case SIOCINAFR : 8040 case SIOCRMAFR : 8041 case SIOCADAFR : 8042 case SIOCZRLST : 8043 if (!(mode & FWRITE)) { 8044 IPFERROR(100); 8045 error = EPERM; 8046 } else { 8047 error = frrequest(softc, IPL_LOGIPF, cmd, (caddr_t)data, 8048 softc->ipf_active, 1); 8049 } 8050 break; 8051 8052 case SIOCINIFR : 8053 case SIOCRMIFR : 8054 case SIOCADIFR : 8055 if (!(mode & FWRITE)) { 8056 IPFERROR(101); 8057 error = EPERM; 8058 } else { 8059 error = frrequest(softc, IPL_LOGIPF, cmd, (caddr_t)data, 8060 1 - softc->ipf_active, 1); 8061 } 8062 break; 8063 8064 case SIOCSWAPA : 8065 if (!(mode & FWRITE)) { 8066 IPFERROR(102); 8067 error = EPERM; 8068 } else { 8069 WRITE_ENTER(&softc->ipf_mutex); 8070 error = BCOPYOUT(&softc->ipf_active, data, 8071 sizeof(softc->ipf_active)); 8072 if (error != 0) { 8073 IPFERROR(103); 8074 error = EFAULT; 8075 } else { 8076 softc->ipf_active = 1 - softc->ipf_active; 8077 } 8078 RWLOCK_EXIT(&softc->ipf_mutex); 8079 } 8080 break; 8081 8082 case SIOCGETFS : 8083 error = ipf_inobj(softc, (void *)data, &obj, &fio, 8084 IPFOBJ_IPFSTAT); 8085 if (error != 0) 8086 break; 8087 ipf_getstat(softc, &fio, obj.ipfo_rev); 8088 error = ipf_outobj(softc, (void *)data, &fio, IPFOBJ_IPFSTAT); 8089 break; 8090 8091 case SIOCFRZST : 8092 if (!(mode & FWRITE)) { 8093 IPFERROR(104); 8094 error = EPERM; 8095 } else 8096 error = ipf_zerostats(softc, (caddr_t)data); 8097 break; 8098 8099 case SIOCIPFFL : 8100 if (!(mode & FWRITE)) { 8101 IPFERROR(105); 8102 error = EPERM; 8103 } else { 8104 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8105 if (!error) { 8106 tmp = ipf_flush(softc, IPL_LOGIPF, tmp); 8107 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8108 if (error != 0) { 8109 IPFERROR(106); 8110 error = EFAULT; 8111 } 8112 } else { 8113 IPFERROR(107); 8114 error = EFAULT; 8115 } 8116 } 8117 break; 8118 8119 #ifdef USE_INET6 8120 case SIOCIPFL6 : 8121 if (!(mode & FWRITE)) { 8122 IPFERROR(108); 8123 error = EPERM; 8124 } else { 8125 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8126 if (!error) { 8127 tmp = ipf_flush(softc, IPL_LOGIPF, tmp); 8128 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8129 if (error != 0) { 8130 IPFERROR(109); 8131 error = EFAULT; 8132 } 8133 } else { 8134 IPFERROR(110); 8135 error = EFAULT; 8136 } 8137 } 8138 break; 8139 #endif 8140 8141 case SIOCSTLCK : 8142 if (!(mode & FWRITE)) { 8143 IPFERROR(122); 8144 error = EPERM; 8145 } else { 8146 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8147 if (error == 0) { 8148 ipf_state_setlock(softc->ipf_state_soft, tmp); 8149 ipf_nat_setlock(softc->ipf_nat_soft, tmp); 8150 ipf_frag_setlock(softc->ipf_frag_soft, tmp); 8151 ipf_auth_setlock(softc->ipf_auth_soft, tmp); 8152 } else { 8153 IPFERROR(111); 8154 error = EFAULT; 8155 } 8156 } 8157 break; 8158 8159 #ifdef IPFILTER_LOG 8160 case SIOCIPFFB : 8161 if (!(mode & FWRITE)) { 8162 IPFERROR(112); 8163 error = EPERM; 8164 } else { 8165 tmp = ipf_log_clear(softc, IPL_LOGIPF); 8166 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8167 if (error) { 8168 IPFERROR(113); 8169 error = EFAULT; 8170 } 8171 } 8172 break; 8173 #endif /* IPFILTER_LOG */ 8174 8175 case SIOCFRSYN : 8176 if (!(mode & FWRITE)) { 8177 IPFERROR(114); 8178 error = EPERM; 8179 } else { 8180 WRITE_ENTER(&softc->ipf_global); 8181 #if (defined(MENTAT) && defined(_KERNEL)) && !defined(INSTANCES) 8182 error = ipfsync(); 8183 #else 8184 ipf_sync(softc, NULL); 8185 error = 0; 8186 #endif 8187 RWLOCK_EXIT(&softc->ipf_global); 8188 8189 } 8190 break; 8191 8192 case SIOCGFRST : 8193 error = ipf_outobj(softc, (void *)data, 8194 ipf_frag_stats(softc->ipf_frag_soft), 8195 IPFOBJ_FRAGSTAT); 8196 break; 8197 8198 #ifdef IPFILTER_LOG 8199 case FIONREAD : 8200 tmp = ipf_log_bytesused(softc, IPL_LOGIPF); 8201 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8202 break; 8203 #endif 8204 8205 case SIOCIPFITER : 8206 SPL_SCHED(s); 8207 error = ipf_frruleiter(softc, data, uid, ctx); 8208 SPL_X(s); 8209 break; 8210 8211 case SIOCGENITER : 8212 SPL_SCHED(s); 8213 error = ipf_genericiter(softc, data, uid, ctx); 8214 SPL_X(s); 8215 break; 8216 8217 case SIOCIPFDELTOK : 8218 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8219 if (error == 0) { 8220 SPL_SCHED(s); 8221 error = ipf_token_del(softc, tmp, uid, ctx); 8222 SPL_X(s); 8223 } 8224 break; 8225 8226 default : 8227 IPFERROR(115); 8228 error = EINVAL; 8229 break; 8230 } 8231 8232 return error; 8233 } 8234 8235 8236 /* ------------------------------------------------------------------------ */ 8237 /* Function: ipf_decaps */ 8238 /* Returns: int - -1 == decapsulation failed, else bit mask of */ 8239 /* flags indicating packet filtering decision. */ 8240 /* Parameters: fin(I) - pointer to packet information */ 8241 /* pass(I) - IP protocol version to match */ 8242 /* l5proto(I) - layer 5 protocol to decode UDP data as. */ 8243 /* */ 8244 /* This function is called for packets that are wrapt up in other packets, */ 8245 /* for example, an IP packet that is the entire data segment for another IP */ 8246 /* packet. If the basic constraints for this are satisfied, change the */ 8247 /* buffer to point to the start of the inner packet and start processing */ 8248 /* rules belonging to the head group this rule specifies. */ 8249 /* ------------------------------------------------------------------------ */ 8250 u_32_t 8251 ipf_decaps(fin, pass, l5proto) 8252 fr_info_t *fin; 8253 u_32_t pass; 8254 int l5proto; 8255 { 8256 fr_info_t fin2, *fino = NULL; 8257 int elen, hlen, nh; 8258 grehdr_t gre; 8259 ip_t *ip; 8260 mb_t *m; 8261 8262 if ((fin->fin_flx & FI_COALESCE) == 0) 8263 if (ipf_coalesce(fin) == -1) 8264 goto cantdecaps; 8265 8266 m = fin->fin_m; 8267 hlen = fin->fin_hlen; 8268 8269 switch (fin->fin_p) 8270 { 8271 case IPPROTO_UDP : 8272 /* 8273 * In this case, the specific protocol being decapsulated 8274 * inside UDP frames comes from the rule. 8275 */ 8276 nh = fin->fin_fr->fr_icode; 8277 break; 8278 8279 case IPPROTO_GRE : /* 47 */ 8280 bcopy(fin->fin_dp, (char *)&gre, sizeof(gre)); 8281 hlen += sizeof(grehdr_t); 8282 if (gre.gr_R|gre.gr_s) 8283 goto cantdecaps; 8284 if (gre.gr_C) 8285 hlen += 4; 8286 if (gre.gr_K) 8287 hlen += 4; 8288 if (gre.gr_S) 8289 hlen += 4; 8290 8291 nh = IPPROTO_IP; 8292 8293 /* 8294 * If the routing options flag is set, validate that it is 8295 * there and bounce over it. 8296 */ 8297 #if 0 8298 /* This is really heavy weight and lots of room for error, */ 8299 /* so for now, put it off and get the simple stuff right. */ 8300 if (gre.gr_R) { 8301 u_char off, len, *s; 8302 u_short af; 8303 int end; 8304 8305 end = 0; 8306 s = fin->fin_dp; 8307 s += hlen; 8308 aplen = fin->fin_plen - hlen; 8309 while (aplen > 3) { 8310 af = (s[0] << 8) | s[1]; 8311 off = s[2]; 8312 len = s[3]; 8313 aplen -= 4; 8314 s += 4; 8315 if (af == 0 && len == 0) { 8316 end = 1; 8317 break; 8318 } 8319 if (aplen < len) 8320 break; 8321 s += len; 8322 aplen -= len; 8323 } 8324 if (end != 1) 8325 goto cantdecaps; 8326 hlen = s - (u_char *)fin->fin_dp; 8327 } 8328 #endif 8329 break; 8330 8331 #ifdef IPPROTO_IPIP 8332 case IPPROTO_IPIP : /* 4 */ 8333 #endif 8334 nh = IPPROTO_IP; 8335 break; 8336 8337 default : /* Includes ESP, AH is special for IPv4 */ 8338 goto cantdecaps; 8339 } 8340 8341 switch (nh) 8342 { 8343 case IPPROTO_IP : 8344 case IPPROTO_IPV6 : 8345 break; 8346 default : 8347 goto cantdecaps; 8348 } 8349 8350 bcopy((char *)fin, (char *)&fin2, sizeof(fin2)); 8351 fino = fin; 8352 fin = &fin2; 8353 elen = hlen; 8354 #if defined(MENTAT) && defined(_KERNEL) 8355 m->b_rptr += elen; 8356 #else 8357 m->m_data += elen; 8358 m->m_len -= elen; 8359 #endif 8360 fin->fin_plen -= elen; 8361 fin->fin_ipoff += elen; 8362 8363 ip = (ip_t *)((char *)fin->fin_ip + elen); 8364 8365 /* 8366 * Make sure we have at least enough data for the network layer 8367 * header. 8368 */ 8369 if (IP_V(ip) == 4) 8370 hlen = IP_HL(ip) << 2; 8371 #ifdef USE_INET6 8372 else if (IP_V(ip) == 6) 8373 hlen = sizeof(ip6_t); 8374 #endif 8375 else 8376 goto cantdecaps2; 8377 8378 if (fin->fin_plen < hlen) 8379 goto cantdecaps2; 8380 8381 fin->fin_dp = (char *)ip + hlen; 8382 8383 if (IP_V(ip) == 4) { 8384 /* 8385 * Perform IPv4 header checksum validation. 8386 */ 8387 if (ipf_cksum((u_short *)ip, hlen)) 8388 goto cantdecaps2; 8389 } 8390 8391 if (ipf_makefrip(hlen, ip, fin) == -1) { 8392 cantdecaps2: 8393 if (m != NULL) { 8394 #if defined(MENTAT) && defined(_KERNEL) 8395 m->b_rptr -= elen; 8396 #else 8397 m->m_data -= elen; 8398 m->m_len += elen; 8399 #endif 8400 } 8401 cantdecaps: 8402 DT1(frb_decapfrip, fr_info_t *, fin); 8403 pass &= ~FR_CMDMASK; 8404 pass |= FR_BLOCK|FR_QUICK; 8405 fin->fin_reason = FRB_DECAPFRIP; 8406 return -1; 8407 } 8408 8409 /*fin->fin_fr = *fr->fr_grp;*/ 8410 pass = ipf_scanlist(fin, pass); 8411 8412 /* 8413 * Copy the packet filter "result" fields out of the fr_info_t struct 8414 * that is local to the decapsulation processing and back into the 8415 * one we were called with. 8416 */ 8417 fino->fin_flx = fin->fin_flx; 8418 fino->fin_rev = fin->fin_rev; 8419 fino->fin_icode = fin->fin_icode; 8420 fino->fin_rule = fin->fin_rule; 8421 (void) strncpy(fino->fin_group, fin->fin_group, FR_GROUPLEN); 8422 fino->fin_fr = fin->fin_fr; 8423 fino->fin_error = fin->fin_error; 8424 fino->fin_mp = fin->fin_mp; 8425 fino->fin_m = fin->fin_m; 8426 m = fin->fin_m; 8427 if (m != NULL) { 8428 #if defined(MENTAT) && defined(_KERNEL) 8429 m->b_rptr -= elen; 8430 #else 8431 m->m_data -= elen; 8432 m->m_len += elen; 8433 #endif 8434 } 8435 return pass; 8436 } 8437 8438 8439 /* ------------------------------------------------------------------------ */ 8440 /* Function: ipf_matcharray_load */ 8441 /* Returns: int - 0 = success, else error */ 8442 /* Parameters: softc(I) - pointer to soft context main structure */ 8443 /* data(I) - pointer to ioctl data */ 8444 /* objp(I) - ipfobj_t structure to load data into */ 8445 /* arrayptr(I) - pointer to location to store array pointer */ 8446 /* */ 8447 /* This function loads in a mathing array through the ipfobj_t struct that */ 8448 /* describes it. Sanity checking and array size limitations are enforced */ 8449 /* in this function to prevent userspace from trying to load in something */ 8450 /* that is insanely big. Once the size of the array is known, the memory */ 8451 /* required is malloc'd and returned through changing *arrayptr. The */ 8452 /* contents of the array are verified before returning. Only in the event */ 8453 /* of a successful call is the caller required to free up the malloc area. */ 8454 /* ------------------------------------------------------------------------ */ 8455 int 8456 ipf_matcharray_load(softc, data, objp, arrayptr) 8457 ipf_main_softc_t *softc; 8458 caddr_t data; 8459 ipfobj_t *objp; 8460 int **arrayptr; 8461 { 8462 int arraysize, *array, error; 8463 8464 *arrayptr = NULL; 8465 8466 error = BCOPYIN(data, objp, sizeof(*objp)); 8467 if (error != 0) { 8468 IPFERROR(116); 8469 return EFAULT; 8470 } 8471 8472 if (objp->ipfo_type != IPFOBJ_IPFEXPR) { 8473 IPFERROR(117); 8474 return EINVAL; 8475 } 8476 8477 if (((objp->ipfo_size & 3) != 0) || (objp->ipfo_size == 0) || 8478 (objp->ipfo_size > 1024)) { 8479 IPFERROR(118); 8480 return EINVAL; 8481 } 8482 8483 arraysize = objp->ipfo_size * sizeof(*array); 8484 KMALLOCS(array, int *, arraysize); 8485 if (array == NULL) { 8486 IPFERROR(119); 8487 return ENOMEM; 8488 } 8489 8490 error = COPYIN(objp->ipfo_ptr, array, arraysize); 8491 if (error != 0) { 8492 KFREES(array, arraysize); 8493 IPFERROR(120); 8494 return EFAULT; 8495 } 8496 8497 if (ipf_matcharray_verify(array, arraysize) != 0) { 8498 KFREES(array, arraysize); 8499 IPFERROR(121); 8500 return EINVAL; 8501 } 8502 8503 *arrayptr = array; 8504 return 0; 8505 } 8506 8507 8508 /* ------------------------------------------------------------------------ */ 8509 /* Function: ipf_matcharray_verify */ 8510 /* Returns: Nil */ 8511 /* Parameters: array(I) - pointer to matching array */ 8512 /* arraysize(I) - number of elements in the array */ 8513 /* */ 8514 /* Verify the contents of a matching array by stepping through each element */ 8515 /* in it. The actual commands in the array are not verified for */ 8516 /* correctness, only that all of the sizes are correctly within limits. */ 8517 /* ------------------------------------------------------------------------ */ 8518 int 8519 ipf_matcharray_verify(array, arraysize) 8520 int *array, arraysize; 8521 { 8522 int i, nelem, maxidx, len; 8523 8524 nelem = arraysize / sizeof(*array); 8525 8526 /* 8527 * Currently, it makes no sense to have an array less than 6 8528 * elements long - the initial size at the from, a single operation 8529 * (minimum 4 in length) and a trailer, for a total of 6. 8530 */ 8531 if ((array[0] < 6) || (arraysize < 24) || (arraysize > 4096)) { 8532 return -1; 8533 } 8534 8535 /* 8536 * Verify the size of data pointed to by array with how long 8537 * the array claims to be itself. 8538 */ 8539 if (array[0] * sizeof(*array) != arraysize) { 8540 return -1; 8541 } 8542 8543 maxidx = nelem - 1; 8544 /* 8545 * The last opcode in this array should be an IPF_EXP_END. 8546 */ 8547 if (array[maxidx] != IPF_EXP_END) { 8548 return -1; 8549 } 8550 8551 for (i = 1; i < maxidx; ) { 8552 len = array[i + 2]; 8553 8554 /* 8555 * The length of the bits to check must be at least 1 8556 * (or else there is nothing to comapre with!) and it 8557 * cannot exceed the length of the data present. 8558 */ 8559 if ((len < 1) || (i + 3 + len > maxidx)) { 8560 return -1; 8561 } 8562 i += 3 + len; 8563 } 8564 return 0; 8565 } 8566 8567 8568 /* ------------------------------------------------------------------------ */ 8569 /* Function: ipf_fr_matcharray */ 8570 /* Returns: int - 0 = match failed, else positive match */ 8571 /* Parameters: fin(I) - pointer to packet information */ 8572 /* array(I) - pointer to matching array */ 8573 /* */ 8574 /* This function is used to apply a matching array against a packet and */ 8575 /* return an indication of whether or not the packet successfully matches */ 8576 /* all of the commands in it. */ 8577 /* ------------------------------------------------------------------------ */ 8578 static int 8579 ipf_fr_matcharray(fin, array) 8580 fr_info_t *fin; 8581 int *array; 8582 { 8583 int i, n, *x, e, p; 8584 8585 e = 0; 8586 n = array[0]; 8587 x = array + 1; 8588 8589 for (; n > 0; x += 3 + x[3], e = 0) { 8590 n -= x[3] + 3; 8591 8592 /* 8593 * The upper 16 bits currently store the protocol value. 8594 * This is currently used with TCP and UDP port compares and 8595 * allows "tcp.port = 80" without requiring an explicit 8596 " "ip.pr = tcp" first. 8597 */ 8598 p = x[0] >> 16; 8599 if ((p != 0) && (p != fin->fin_p)) 8600 break; 8601 8602 switch (x[0]) 8603 { 8604 case IPF_EXP_IP_PR : 8605 for (i = 0; !e && i < x[3]; i++) { 8606 e |= (fin->fin_p == x[i + 3]); 8607 } 8608 break; 8609 8610 case IPF_EXP_IP_SRCADDR : 8611 if (fin->fin_v != 4) 8612 break; 8613 for (i = 0; !e && i < x[3]; i++) { 8614 e |= ((fin->fin_saddr & x[i + 4]) == 8615 x[i + 3]); 8616 } 8617 break; 8618 8619 case IPF_EXP_IP_DSTADDR : 8620 if (fin->fin_v != 4) 8621 break; 8622 for (i = 0; !e && i < x[3]; i++) { 8623 e |= ((fin->fin_daddr & x[i + 4]) == 8624 x[i + 3]); 8625 } 8626 break; 8627 8628 case IPF_EXP_IP_ADDR : 8629 if (fin->fin_v != 4) 8630 break; 8631 for (i = 0; !e && i < x[3]; i++) { 8632 e |= ((fin->fin_saddr & x[i + 4]) == 8633 x[i + 3]) || 8634 ((fin->fin_daddr & x[i + 4]) == 8635 x[i + 3]); 8636 } 8637 break; 8638 8639 #ifdef USE_INET6 8640 case IPF_EXP_IP6_SRCADDR : 8641 if (fin->fin_v != 6) 8642 break; 8643 for (i = 0; !e && i < x[3]; i++) { 8644 e |= IP6_MASKEQ(&fin->fin_src6, x + i + 7, 8645 x + i + 3); 8646 } 8647 break; 8648 8649 case IPF_EXP_IP6_DSTADDR : 8650 if (fin->fin_v != 6) 8651 break; 8652 for (i = 0; !e && i < x[3]; i++) { 8653 e |= IP6_MASKEQ(&fin->fin_dst6, x + i + 7, 8654 x + i + 3); 8655 } 8656 break; 8657 8658 case IPF_EXP_IP6_ADDR : 8659 if (fin->fin_v != 6) 8660 break; 8661 for (i = 0; !e && i < x[3]; i++) { 8662 e |= IP6_MASKEQ(&fin->fin_src6, x + i + 7, 8663 x + i + 3) || 8664 IP6_MASKEQ(&fin->fin_dst6, x + i + 7, 8665 x + i + 3); 8666 } 8667 break; 8668 #endif 8669 8670 case IPF_EXP_UDP_PORT : 8671 case IPF_EXP_TCP_PORT : 8672 for (i = 0; !e && i < x[3]; i++) { 8673 e |= (fin->fin_sport == x[i + 3]) || 8674 (fin->fin_dport == x[i + 3]); 8675 } 8676 break; 8677 8678 case IPF_EXP_UDP_SPORT : 8679 case IPF_EXP_TCP_SPORT : 8680 for (i = 0; !e && i < x[3]; i++) { 8681 e |= (fin->fin_sport == x[i + 3]); 8682 } 8683 break; 8684 8685 case IPF_EXP_UDP_DPORT : 8686 case IPF_EXP_TCP_DPORT : 8687 for (i = 0; !e && i < x[3]; i++) { 8688 e |= (fin->fin_dport == x[i + 3]); 8689 } 8690 break; 8691 8692 case IPF_EXP_TCP_FLAGS : 8693 for (i = 0; !e && i < x[3]; i++) { 8694 e |= ((fin->fin_tcpf & x[i + 4]) == x[i + 3]); 8695 } 8696 break; 8697 } 8698 e ^= x[1]; 8699 8700 if (!e) 8701 break; 8702 } 8703 8704 return e; 8705 } 8706 8707 8708 /* ------------------------------------------------------------------------ */ 8709 /* Function: ipf_queueflush */ 8710 /* Returns: int - number of entries flushed (0 = none) */ 8711 /* Parameters: softc(I) - pointer to soft context main structure */ 8712 /* deletefn(I) - function to call to delete entry */ 8713 /* ipfqs(I) - top of the list of ipf internal queues */ 8714 /* userqs(I) - top of the list of user defined timeouts */ 8715 /* */ 8716 /* This fucntion gets called when the state/NAT hash tables fill up and we */ 8717 /* need to try a bit harder to free up some space. The algorithm used here */ 8718 /* split into two parts but both halves have the same goal: to reduce the */ 8719 /* number of connections considered to be "active" to the low watermark. */ 8720 /* There are two steps in doing this: */ 8721 /* 1) Remove any TCP connections that are already considered to be "closed" */ 8722 /* but have not yet been removed from the state table. The two states */ 8723 /* TCPS_TIME_WAIT and TCPS_CLOSED are considered to be the perfect */ 8724 /* candidates for this style of removal. If freeing up entries in */ 8725 /* CLOSED or both CLOSED and TIME_WAIT brings us to the low watermark, */ 8726 /* we do not go on to step 2. */ 8727 /* */ 8728 /* 2) Look for the oldest entries on each timeout queue and free them if */ 8729 /* they are within the given window we are considering. Where the */ 8730 /* window starts and the steps taken to increase its size depend upon */ 8731 /* how long ipf has been running (ipf_ticks.) Anything modified in the */ 8732 /* last 30 seconds is not touched. */ 8733 /* touched */ 8734 /* die ipf_ticks 30*1.5 1800*1.5 | 43200*1.5 */ 8735 /* | | | | | | */ 8736 /* future <--+----------+--------+-----------+-----+-----+-----------> past */ 8737 /* now \_int=30s_/ \_int=1hr_/ \_int=12hr */ 8738 /* */ 8739 /* Points to note: */ 8740 /* - tqe_die is the time, in the future, when entries die. */ 8741 /* - tqe_die - ipf_ticks is how long left the connection has to live in ipf */ 8742 /* ticks. */ 8743 /* - tqe_touched is when the entry was last used by NAT/state */ 8744 /* - the closer tqe_touched is to ipf_ticks, the further tqe_die will be */ 8745 /* ipf_ticks any given timeout queue and vice versa. */ 8746 /* - both tqe_die and tqe_touched increase over time */ 8747 /* - timeout queues are sorted with the highest value of tqe_die at the */ 8748 /* bottom and therefore the smallest values of each are at the top */ 8749 /* - the pointer passed in as ipfqs should point to an array of timeout */ 8750 /* queues representing each of the TCP states */ 8751 /* */ 8752 /* We start by setting up a maximum range to scan for things to move of */ 8753 /* iend (newest) to istart (oldest) in chunks of "interval". If nothing is */ 8754 /* found in that range, "interval" is adjusted (so long as it isn't 30) and */ 8755 /* we start again with a new value for "iend" and "istart". This is */ 8756 /* continued until we either finish the scan of 30 second intervals or the */ 8757 /* low water mark is reached. */ 8758 /* ------------------------------------------------------------------------ */ 8759 int 8760 ipf_queueflush(softc, deletefn, ipfqs, userqs, activep, size, low) 8761 ipf_main_softc_t *softc; 8762 ipftq_delete_fn_t deletefn; 8763 ipftq_t *ipfqs, *userqs; 8764 u_int *activep; 8765 int size, low; 8766 { 8767 u_long interval, istart, iend; 8768 ipftq_t *ifq, *ifqnext; 8769 ipftqent_t *tqe, *tqn; 8770 int removed = 0; 8771 8772 for (tqn = ipfqs[IPF_TCPS_CLOSED].ifq_head; ((tqe = tqn) != NULL); ) { 8773 tqn = tqe->tqe_next; 8774 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 8775 removed++; 8776 } 8777 if ((*activep * 100 / size) > low) { 8778 for (tqn = ipfqs[IPF_TCPS_TIME_WAIT].ifq_head; 8779 ((tqe = tqn) != NULL); ) { 8780 tqn = tqe->tqe_next; 8781 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 8782 removed++; 8783 } 8784 } 8785 8786 if ((*activep * 100 / size) <= low) { 8787 return removed; 8788 } 8789 8790 /* 8791 * NOTE: Use of "* 15 / 10" is required here because if "* 1.5" is 8792 * used then the operations are upgraded to floating point 8793 * and kernels don't like floating point... 8794 */ 8795 if (softc->ipf_ticks > IPF_TTLVAL(43200 * 15 / 10)) { 8796 istart = IPF_TTLVAL(86400 * 4); 8797 interval = IPF_TTLVAL(43200); 8798 } else if (softc->ipf_ticks > IPF_TTLVAL(1800 * 15 / 10)) { 8799 istart = IPF_TTLVAL(43200); 8800 interval = IPF_TTLVAL(1800); 8801 } else if (softc->ipf_ticks > IPF_TTLVAL(30 * 15 / 10)) { 8802 istart = IPF_TTLVAL(1800); 8803 interval = IPF_TTLVAL(30); 8804 } else { 8805 return 0; 8806 } 8807 if (istart > softc->ipf_ticks) { 8808 if (softc->ipf_ticks - interval < interval) 8809 istart = interval; 8810 else 8811 istart = (softc->ipf_ticks / interval) * interval; 8812 } 8813 8814 iend = softc->ipf_ticks - interval; 8815 8816 while ((*activep * 100 / size) > low) { 8817 u_long try; 8818 8819 try = softc->ipf_ticks - istart; 8820 8821 for (ifq = ipfqs; ifq != NULL; ifq = ifq->ifq_next) { 8822 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 8823 if (try < tqe->tqe_touched) 8824 break; 8825 tqn = tqe->tqe_next; 8826 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 8827 removed++; 8828 } 8829 } 8830 8831 for (ifq = userqs; ifq != NULL; ifq = ifqnext) { 8832 ifqnext = ifq->ifq_next; 8833 8834 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 8835 if (try < tqe->tqe_touched) 8836 break; 8837 tqn = tqe->tqe_next; 8838 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 8839 removed++; 8840 } 8841 } 8842 8843 if (try >= iend) { 8844 if (interval == IPF_TTLVAL(43200)) { 8845 interval = IPF_TTLVAL(1800); 8846 } else if (interval == IPF_TTLVAL(1800)) { 8847 interval = IPF_TTLVAL(30); 8848 } else { 8849 break; 8850 } 8851 if (interval >= softc->ipf_ticks) 8852 break; 8853 8854 iend = softc->ipf_ticks - interval; 8855 } 8856 istart -= interval; 8857 } 8858 8859 return removed; 8860 } 8861 8862 8863 /* ------------------------------------------------------------------------ */ 8864 /* Function: ipf_deliverlocal */ 8865 /* Returns: int - 1 = local address, 0 = non-local address */ 8866 /* Parameters: softc(I) - pointer to soft context main structure */ 8867 /* ipversion(I) - IP protocol version (4 or 6) */ 8868 /* ifp(I) - network interface pointer */ 8869 /* ipaddr(I) - IPv4/6 destination address */ 8870 /* */ 8871 /* This fucntion is used to determine in the address "ipaddr" belongs to */ 8872 /* the network interface represented by ifp. */ 8873 /* ------------------------------------------------------------------------ */ 8874 int 8875 ipf_deliverlocal(softc, ipversion, ifp, ipaddr) 8876 ipf_main_softc_t *softc; 8877 int ipversion; 8878 void *ifp; 8879 i6addr_t *ipaddr; 8880 { 8881 i6addr_t addr; 8882 int islocal = 0; 8883 8884 if (ipversion == 4) { 8885 if (ipf_ifpaddr(softc, 4, FRI_NORMAL, ifp, &addr, NULL) == 0) { 8886 if (addr.in4.s_addr == ipaddr->in4.s_addr) 8887 islocal = 1; 8888 } 8889 8890 #ifdef USE_INET6 8891 } else if (ipversion == 6) { 8892 if (ipf_ifpaddr(softc, 6, FRI_NORMAL, ifp, &addr, NULL) == 0) { 8893 if (IP6_EQ(&addr, ipaddr)) 8894 islocal = 1; 8895 } 8896 #endif 8897 } 8898 8899 return islocal; 8900 } 8901 8902 8903 /* ------------------------------------------------------------------------ */ 8904 /* Function: ipf_settimeout */ 8905 /* Returns: int - 0 = success, -1 = failure */ 8906 /* Parameters: softc(I) - pointer to soft context main structure */ 8907 /* t(I) - pointer to tuneable array entry */ 8908 /* p(I) - pointer to values passed in to apply */ 8909 /* */ 8910 /* This function is called to set the timeout values for each distinct */ 8911 /* queue timeout that is available. When called, it calls into both the */ 8912 /* state and NAT code, telling them to update their timeout queues. */ 8913 /* ------------------------------------------------------------------------ */ 8914 static int 8915 ipf_settimeout(softc, t, p) 8916 struct ipf_main_softc_s *softc; 8917 ipftuneable_t *t; 8918 ipftuneval_t *p; 8919 { 8920 8921 /* 8922 * ipf_interror should be set by the functions called here, not 8923 * by this function - it's just a middle man. 8924 */ 8925 if (ipf_state_settimeout(softc, t, p) == -1) 8926 return -1; 8927 if (ipf_nat_settimeout(softc, t, p) == -1) 8928 return -1; 8929 return 0; 8930 } 8931 8932 8933 /* ------------------------------------------------------------------------ */ 8934 /* Function: ipf_apply_timeout */ 8935 /* Returns: int - 0 = success, -1 = failure */ 8936 /* Parameters: head(I) - pointer to tuneable array entry */ 8937 /* seconds(I) - pointer to values passed in to apply */ 8938 /* */ 8939 /* This function applies a timeout of "seconds" to the timeout queue that */ 8940 /* is pointed to by "head". All entries on this list have an expiration */ 8941 /* set to be the current tick value of ipf plus the ttl. Given that this */ 8942 /* function should only be called when the delta is non-zero, the task is */ 8943 /* to walk the entire list and apply the change. The sort order will not */ 8944 /* change. The only catch is that this is O(n) across the list, so if the */ 8945 /* queue has lots of entries (10s of thousands or 100s of thousands), it */ 8946 /* could take a relatively long time to work through them all. */ 8947 /* ------------------------------------------------------------------------ */ 8948 void 8949 ipf_apply_timeout(head, seconds) 8950 ipftq_t *head; 8951 u_int seconds; 8952 { 8953 u_int oldtimeout, newtimeout; 8954 ipftqent_t *tqe; 8955 int delta; 8956 8957 MUTEX_ENTER(&head->ifq_lock); 8958 oldtimeout = head->ifq_ttl; 8959 newtimeout = IPF_TTLVAL(seconds); 8960 delta = oldtimeout - newtimeout; 8961 8962 head->ifq_ttl = newtimeout; 8963 8964 for (tqe = head->ifq_head; tqe != NULL; tqe = tqe->tqe_next) { 8965 tqe->tqe_die += delta; 8966 } 8967 MUTEX_EXIT(&head->ifq_lock); 8968 } 8969 8970 8971 /* ------------------------------------------------------------------------ */ 8972 /* Function: ipf_settimeout_tcp */ 8973 /* Returns: int - 0 = successfully applied, -1 = failed */ 8974 /* Parameters: t(I) - pointer to tuneable to change */ 8975 /* p(I) - pointer to new timeout information */ 8976 /* tab(I) - pointer to table of TCP queues */ 8977 /* */ 8978 /* This function applies the new timeout (p) to the TCP tunable (t) and */ 8979 /* updates all of the entries on the relevant timeout queue by calling */ 8980 /* ipf_apply_timeout(). */ 8981 /* ------------------------------------------------------------------------ */ 8982 int 8983 ipf_settimeout_tcp(t, p, tab) 8984 ipftuneable_t *t; 8985 ipftuneval_t *p; 8986 ipftq_t *tab; 8987 { 8988 if (!strcmp(t->ipft_name, "tcp_idle_timeout") || 8989 !strcmp(t->ipft_name, "tcp_established")) { 8990 ipf_apply_timeout(&tab[IPF_TCPS_ESTABLISHED], p->ipftu_int); 8991 } else if (!strcmp(t->ipft_name, "tcp_close_wait")) { 8992 ipf_apply_timeout(&tab[IPF_TCPS_CLOSE_WAIT], p->ipftu_int); 8993 } else if (!strcmp(t->ipft_name, "tcp_last_ack")) { 8994 ipf_apply_timeout(&tab[IPF_TCPS_LAST_ACK], p->ipftu_int); 8995 } else if (!strcmp(t->ipft_name, "tcp_timeout")) { 8996 ipf_apply_timeout(&tab[IPF_TCPS_LISTEN], p->ipftu_int); 8997 ipf_apply_timeout(&tab[IPF_TCPS_HALF_ESTAB], p->ipftu_int); 8998 ipf_apply_timeout(&tab[IPF_TCPS_CLOSING], p->ipftu_int); 8999 } else if (!strcmp(t->ipft_name, "tcp_listen")) { 9000 ipf_apply_timeout(&tab[IPF_TCPS_LISTEN], p->ipftu_int); 9001 } else if (!strcmp(t->ipft_name, "tcp_half_established")) { 9002 ipf_apply_timeout(&tab[IPF_TCPS_HALF_ESTAB], p->ipftu_int); 9003 } else if (!strcmp(t->ipft_name, "tcp_closing")) { 9004 ipf_apply_timeout(&tab[IPF_TCPS_CLOSING], p->ipftu_int); 9005 } else if (!strcmp(t->ipft_name, "tcp_syn_received")) { 9006 ipf_apply_timeout(&tab[IPF_TCPS_SYN_RECEIVED], p->ipftu_int); 9007 } else if (!strcmp(t->ipft_name, "tcp_syn_sent")) { 9008 ipf_apply_timeout(&tab[IPF_TCPS_SYN_SENT], p->ipftu_int); 9009 } else if (!strcmp(t->ipft_name, "tcp_closed")) { 9010 ipf_apply_timeout(&tab[IPF_TCPS_CLOSED], p->ipftu_int); 9011 } else if (!strcmp(t->ipft_name, "tcp_half_closed")) { 9012 ipf_apply_timeout(&tab[IPF_TCPS_CLOSED], p->ipftu_int); 9013 } else if (!strcmp(t->ipft_name, "tcp_time_wait")) { 9014 ipf_apply_timeout(&tab[IPF_TCPS_TIME_WAIT], p->ipftu_int); 9015 } else { 9016 /* 9017 * ipf_interror isn't set here because it should be set 9018 * by whatever called this function. 9019 */ 9020 return -1; 9021 } 9022 return 0; 9023 } 9024 9025 9026 /* ------------------------------------------------------------------------ */ 9027 /* Function: ipf_main_soft_create */ 9028 /* Returns: NULL = failure, else success */ 9029 /* Parameters: arg(I) - pointer to soft context structure if already allocd */ 9030 /* */ 9031 /* Create the foundation soft context structure. In circumstances where it */ 9032 /* is not required to dynamically allocate the context, a pointer can be */ 9033 /* passed in (rather than NULL) to a structure to be initialised. */ 9034 /* The main thing of interest is that a number of locks are initialised */ 9035 /* here instead of in the where might be expected - in the relevant create */ 9036 /* function elsewhere. This is done because the current locking design has */ 9037 /* some areas where these locks are used outside of their module. */ 9038 /* Possibly the most important exercise that is done here is setting of all */ 9039 /* the timeout values, allowing them to be changed before init(). */ 9040 /* ------------------------------------------------------------------------ */ 9041 void * 9042 ipf_main_soft_create(arg) 9043 void *arg; 9044 { 9045 ipf_main_softc_t *softc; 9046 9047 if (arg == NULL) { 9048 KMALLOC(softc, ipf_main_softc_t *); 9049 if (softc == NULL) 9050 return NULL; 9051 } else { 9052 softc = arg; 9053 } 9054 9055 bzero((char *)softc, sizeof(*softc)); 9056 9057 /* 9058 * This serves as a flag as to whether or not the softc should be 9059 * free'd when _destroy is called. 9060 */ 9061 softc->ipf_dynamic_softc = (arg == NULL) ? 1 : 0; 9062 9063 softc->ipf_tuners = ipf_tune_array_copy(softc, 9064 sizeof(ipf_main_tuneables), 9065 ipf_main_tuneables); 9066 if (softc->ipf_tuners == NULL) { 9067 ipf_main_soft_destroy(softc, NULL); 9068 return NULL; 9069 } 9070 9071 MUTEX_INIT(&softc->ipf_rw, "ipf rw mutex"); 9072 MUTEX_INIT(&softc->ipf_timeoutlock, "ipf timeout lock"); 9073 RWLOCK_INIT(&softc->ipf_global, "ipf filter load/unload mutex"); 9074 RWLOCK_INIT(&softc->ipf_mutex, "ipf filter rwlock"); 9075 RWLOCK_INIT(&softc->ipf_tokens, "ipf token rwlock"); 9076 RWLOCK_INIT(&softc->ipf_state, "ipf state rwlock"); 9077 RWLOCK_INIT(&softc->ipf_nat, "ipf IP NAT rwlock"); 9078 RWLOCK_INIT(&softc->ipf_poolrw, "ipf pool rwlock"); 9079 RWLOCK_INIT(&softc->ipf_frag, "ipf frag rwlock"); 9080 9081 softc->ipf_token_head = NULL; 9082 softc->ipf_token_tail = &softc->ipf_token_head; 9083 9084 softc->ipf_tcpidletimeout = FIVE_DAYS; 9085 softc->ipf_tcpclosewait = IPF_TTLVAL(2 * TCP_MSL); 9086 softc->ipf_tcplastack = IPF_TTLVAL(30); 9087 softc->ipf_tcptimewait = IPF_TTLVAL(2 * TCP_MSL); 9088 softc->ipf_tcptimeout = IPF_TTLVAL(2 * TCP_MSL); 9089 softc->ipf_tcpsynsent = IPF_TTLVAL(2 * TCP_MSL); 9090 softc->ipf_tcpsynrecv = IPF_TTLVAL(2 * TCP_MSL); 9091 softc->ipf_tcpclosed = IPF_TTLVAL(30); 9092 softc->ipf_tcphalfclosed = IPF_TTLVAL(2 * 3600); 9093 softc->ipf_udptimeout = IPF_TTLVAL(120); 9094 softc->ipf_udpacktimeout = IPF_TTLVAL(12); 9095 softc->ipf_icmptimeout = IPF_TTLVAL(60); 9096 softc->ipf_icmpacktimeout = IPF_TTLVAL(6); 9097 softc->ipf_iptimeout = IPF_TTLVAL(60); 9098 9099 #if defined(IPFILTER_DEFAULT_BLOCK) 9100 softc->ipf_pass = FR_BLOCK|FR_NOMATCH; 9101 #else 9102 softc->ipf_pass = (IPF_DEFAULT_PASS)|FR_NOMATCH; 9103 #endif 9104 softc->ipf_minttl = 4; 9105 softc->ipf_icmpminfragmtu = 68; 9106 softc->ipf_flags = IPF_LOGGING; 9107 9108 return softc; 9109 } 9110 9111 /* ------------------------------------------------------------------------ */ 9112 /* Function: ipf_main_soft_init */ 9113 /* Returns: 0 = success, -1 = failure */ 9114 /* Parameters: softc(I) - pointer to soft context main structure */ 9115 /* */ 9116 /* A null-op function that exists as a placeholder so that the flow in */ 9117 /* other functions is obvious. */ 9118 /* ------------------------------------------------------------------------ */ 9119 /*ARGSUSED*/ 9120 int 9121 ipf_main_soft_init(softc) 9122 ipf_main_softc_t *softc; 9123 { 9124 return 0; 9125 } 9126 9127 9128 /* ------------------------------------------------------------------------ */ 9129 /* Function: ipf_main_soft_destroy */ 9130 /* Returns: void */ 9131 /* Parameters: softc(I) - pointer to soft context main structure */ 9132 /* arg(I) - not used (present for symmetry.) */ 9133 /* */ 9134 /* Undo everything that we did in ipf_main_soft_create. */ 9135 /* */ 9136 /* The most important check that needs to be made here is whether or not */ 9137 /* the structure was allocated by ipf_main_soft_create() by checking what */ 9138 /* value is stored in ipf_dynamic_main. */ 9139 /* ------------------------------------------------------------------------ */ 9140 /*ARGSUSED*/ 9141 void 9142 ipf_main_soft_destroy(softc, arg) 9143 ipf_main_softc_t *softc; 9144 void *arg; 9145 { 9146 9147 RW_DESTROY(&softc->ipf_frag); 9148 RW_DESTROY(&softc->ipf_poolrw); 9149 RW_DESTROY(&softc->ipf_nat); 9150 RW_DESTROY(&softc->ipf_state); 9151 RW_DESTROY(&softc->ipf_tokens); 9152 RW_DESTROY(&softc->ipf_mutex); 9153 RW_DESTROY(&softc->ipf_global); 9154 MUTEX_DESTROY(&softc->ipf_timeoutlock); 9155 MUTEX_DESTROY(&softc->ipf_rw); 9156 9157 if (softc->ipf_tuners != NULL) { 9158 KFREES(softc->ipf_tuners, sizeof(ipf_main_tuneables)); 9159 } 9160 if (softc->ipf_dynamic_softc == 1) { 9161 KFREE(softc); 9162 } 9163 } 9164 9165 9166 /* ------------------------------------------------------------------------ */ 9167 /* Function: ipf_main_soft_fini */ 9168 /* Returns: 0 = success, -1 = failure */ 9169 /* Parameters: softc(I) - pointer to soft context main structure */ 9170 /* */ 9171 /* Clean out the rules which have been added since _init was last called, */ 9172 /* the only dynamic part of the mainline. */ 9173 /* ------------------------------------------------------------------------ */ 9174 int 9175 ipf_main_soft_fini(softc) 9176 ipf_main_softc_t *softc; 9177 { 9178 (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE|FR_INACTIVE); 9179 (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE); 9180 (void) ipf_flush(softc, IPL_LOGCOUNT, FR_INQUE|FR_OUTQUE|FR_INACTIVE); 9181 (void) ipf_flush(softc, IPL_LOGCOUNT, FR_INQUE|FR_OUTQUE); 9182 9183 return 0; 9184 } 9185 9186 9187 /* ------------------------------------------------------------------------ */ 9188 /* Function: ipf_main_load */ 9189 /* Returns: 0 = success, -1 = failure */ 9190 /* Parameters: none */ 9191 /* */ 9192 /* Handle global initialisation that needs to be done for the base part of */ 9193 /* IPFilter. At present this just amounts to initialising some ICMP lookup */ 9194 /* arrays that get used by the state/NAT code. */ 9195 /* ------------------------------------------------------------------------ */ 9196 int 9197 ipf_main_load() 9198 { 9199 int i; 9200 9201 /* fill icmp reply type table */ 9202 for (i = 0; i <= ICMP_MAXTYPE; i++) 9203 icmpreplytype4[i] = -1; 9204 icmpreplytype4[ICMP_ECHO] = ICMP_ECHOREPLY; 9205 icmpreplytype4[ICMP_TSTAMP] = ICMP_TSTAMPREPLY; 9206 icmpreplytype4[ICMP_IREQ] = ICMP_IREQREPLY; 9207 icmpreplytype4[ICMP_MASKREQ] = ICMP_MASKREPLY; 9208 9209 #ifdef USE_INET6 9210 /* fill icmp reply type table */ 9211 for (i = 0; i <= ICMP6_MAXTYPE; i++) 9212 icmpreplytype6[i] = -1; 9213 icmpreplytype6[ICMP6_ECHO_REQUEST] = ICMP6_ECHO_REPLY; 9214 icmpreplytype6[ICMP6_MEMBERSHIP_QUERY] = ICMP6_MEMBERSHIP_REPORT; 9215 icmpreplytype6[ICMP6_NI_QUERY] = ICMP6_NI_REPLY; 9216 icmpreplytype6[ND_ROUTER_SOLICIT] = ND_ROUTER_ADVERT; 9217 icmpreplytype6[ND_NEIGHBOR_SOLICIT] = ND_NEIGHBOR_ADVERT; 9218 #endif 9219 9220 return 0; 9221 } 9222 9223 9224 /* ------------------------------------------------------------------------ */ 9225 /* Function: ipf_main_unload */ 9226 /* Returns: 0 = success, -1 = failure */ 9227 /* Parameters: none */ 9228 /* */ 9229 /* A null-op function that exists as a placeholder so that the flow in */ 9230 /* other functions is obvious. */ 9231 /* ------------------------------------------------------------------------ */ 9232 int 9233 ipf_main_unload() 9234 { 9235 return 0; 9236 } 9237 9238 9239 /* ------------------------------------------------------------------------ */ 9240 /* Function: ipf_load_all */ 9241 /* Returns: 0 = success, -1 = failure */ 9242 /* Parameters: none */ 9243 /* */ 9244 /* Work through all of the subsystems inside IPFilter and call the load */ 9245 /* function for each in an order that won't lead to a crash :) */ 9246 /* ------------------------------------------------------------------------ */ 9247 int 9248 ipf_load_all() 9249 { 9250 if (ipf_main_load() == -1) 9251 return -1; 9252 9253 if (ipf_state_main_load() == -1) 9254 return -1; 9255 9256 if (ipf_nat_main_load() == -1) 9257 return -1; 9258 9259 if (ipf_frag_main_load() == -1) 9260 return -1; 9261 9262 if (ipf_auth_main_load() == -1) 9263 return -1; 9264 9265 if (ipf_proxy_main_load() == -1) 9266 return -1; 9267 9268 return 0; 9269 } 9270 9271 9272 /* ------------------------------------------------------------------------ */ 9273 /* Function: ipf_unload_all */ 9274 /* Returns: 0 = success, -1 = failure */ 9275 /* Parameters: none */ 9276 /* */ 9277 /* Work through all of the subsystems inside IPFilter and call the unload */ 9278 /* function for each in an order that won't lead to a crash :) */ 9279 /* ------------------------------------------------------------------------ */ 9280 int 9281 ipf_unload_all() 9282 { 9283 if (ipf_proxy_main_unload() == -1) 9284 return -1; 9285 9286 if (ipf_auth_main_unload() == -1) 9287 return -1; 9288 9289 if (ipf_frag_main_unload() == -1) 9290 return -1; 9291 9292 if (ipf_nat_main_unload() == -1) 9293 return -1; 9294 9295 if (ipf_state_main_unload() == -1) 9296 return -1; 9297 9298 if (ipf_main_unload() == -1) 9299 return -1; 9300 9301 return 0; 9302 } 9303 9304 9305 /* ------------------------------------------------------------------------ */ 9306 /* Function: ipf_create_all */ 9307 /* Returns: NULL = failure, else success */ 9308 /* Parameters: arg(I) - pointer to soft context main structure */ 9309 /* */ 9310 /* Work through all of the subsystems inside IPFilter and call the create */ 9311 /* function for each in an order that won't lead to a crash :) */ 9312 /* ------------------------------------------------------------------------ */ 9313 ipf_main_softc_t * 9314 ipf_create_all(arg) 9315 void *arg; 9316 { 9317 ipf_main_softc_t *softc; 9318 9319 softc = ipf_main_soft_create(arg); 9320 if (softc == NULL) 9321 return NULL; 9322 9323 softc->ipf_log_soft = ipf_log_soft_create(softc); 9324 if (softc->ipf_log_soft == NULL) { 9325 ipf_destroy_all(softc); 9326 return NULL; 9327 } 9328 9329 softc->ipf_lookup_soft = ipf_lookup_soft_create(softc); 9330 if (softc->ipf_lookup_soft == NULL) { 9331 ipf_destroy_all(softc); 9332 return NULL; 9333 } 9334 9335 softc->ipf_sync_soft = ipf_sync_soft_create(softc); 9336 if (softc->ipf_sync_soft == NULL) { 9337 ipf_destroy_all(softc); 9338 return NULL; 9339 } 9340 9341 softc->ipf_state_soft = ipf_state_soft_create(softc); 9342 if (softc->ipf_state_soft == NULL) { 9343 ipf_destroy_all(softc); 9344 return NULL; 9345 } 9346 9347 softc->ipf_nat_soft = ipf_nat_soft_create(softc); 9348 if (softc->ipf_nat_soft == NULL) { 9349 ipf_destroy_all(softc); 9350 return NULL; 9351 } 9352 9353 softc->ipf_frag_soft = ipf_frag_soft_create(softc); 9354 if (softc->ipf_frag_soft == NULL) { 9355 ipf_destroy_all(softc); 9356 return NULL; 9357 } 9358 9359 softc->ipf_auth_soft = ipf_auth_soft_create(softc); 9360 if (softc->ipf_auth_soft == NULL) { 9361 ipf_destroy_all(softc); 9362 return NULL; 9363 } 9364 9365 softc->ipf_proxy_soft = ipf_proxy_soft_create(softc); 9366 if (softc->ipf_proxy_soft == NULL) { 9367 ipf_destroy_all(softc); 9368 return NULL; 9369 } 9370 9371 return softc; 9372 } 9373 9374 9375 /* ------------------------------------------------------------------------ */ 9376 /* Function: ipf_destroy_all */ 9377 /* Returns: void */ 9378 /* Parameters: softc(I) - pointer to soft context main structure */ 9379 /* */ 9380 /* Work through all of the subsystems inside IPFilter and call the destroy */ 9381 /* function for each in an order that won't lead to a crash :) */ 9382 /* */ 9383 /* Every one of these functions is expected to succeed, so there is no */ 9384 /* checking of return values. */ 9385 /* ------------------------------------------------------------------------ */ 9386 void 9387 ipf_destroy_all(softc) 9388 ipf_main_softc_t *softc; 9389 { 9390 9391 if (softc->ipf_state_soft != NULL) { 9392 ipf_state_soft_destroy(softc, softc->ipf_state_soft); 9393 softc->ipf_state_soft = NULL; 9394 } 9395 9396 if (softc->ipf_nat_soft != NULL) { 9397 ipf_nat_soft_destroy(softc, softc->ipf_nat_soft); 9398 softc->ipf_nat_soft = NULL; 9399 } 9400 9401 if (softc->ipf_frag_soft != NULL) { 9402 ipf_frag_soft_destroy(softc, softc->ipf_frag_soft); 9403 softc->ipf_frag_soft = NULL; 9404 } 9405 9406 if (softc->ipf_auth_soft != NULL) { 9407 ipf_auth_soft_destroy(softc, softc->ipf_auth_soft); 9408 softc->ipf_auth_soft = NULL; 9409 } 9410 9411 if (softc->ipf_proxy_soft != NULL) { 9412 ipf_proxy_soft_destroy(softc, softc->ipf_proxy_soft); 9413 softc->ipf_proxy_soft = NULL; 9414 } 9415 9416 if (softc->ipf_sync_soft != NULL) { 9417 ipf_sync_soft_destroy(softc, softc->ipf_sync_soft); 9418 softc->ipf_sync_soft = NULL; 9419 } 9420 9421 if (softc->ipf_lookup_soft != NULL) { 9422 ipf_lookup_soft_destroy(softc, softc->ipf_lookup_soft); 9423 softc->ipf_lookup_soft = NULL; 9424 } 9425 9426 if (softc->ipf_log_soft != NULL) { 9427 ipf_log_soft_destroy(softc, softc->ipf_log_soft); 9428 softc->ipf_log_soft = NULL; 9429 } 9430 9431 ipf_main_soft_destroy(softc, NULL); 9432 } 9433 9434 9435 /* ------------------------------------------------------------------------ */ 9436 /* Function: ipf_init_all */ 9437 /* Returns: 0 = success, -1 = failure */ 9438 /* Parameters: softc(I) - pointer to soft context main structure */ 9439 /* */ 9440 /* Work through all of the subsystems inside IPFilter and call the init */ 9441 /* function for each in an order that won't lead to a crash :) */ 9442 /* ------------------------------------------------------------------------ */ 9443 int 9444 ipf_init_all(softc) 9445 ipf_main_softc_t *softc; 9446 { 9447 9448 if (ipf_main_soft_init(softc) == -1) 9449 return -1; 9450 9451 if (ipf_log_soft_init(softc, softc->ipf_log_soft) == -1) 9452 return -1; 9453 9454 if (ipf_lookup_soft_init(softc, softc->ipf_lookup_soft) == -1) 9455 return -1; 9456 9457 if (ipf_sync_soft_init(softc, softc->ipf_sync_soft) == -1) 9458 return -1; 9459 9460 if (ipf_state_soft_init(softc, softc->ipf_state_soft) == -1) 9461 return -1; 9462 9463 if (ipf_nat_soft_init(softc, softc->ipf_nat_soft) == -1) 9464 return -1; 9465 9466 if (ipf_frag_soft_init(softc, softc->ipf_frag_soft) == -1) 9467 return -1; 9468 9469 if (ipf_auth_soft_init(softc, softc->ipf_auth_soft) == -1) 9470 return -1; 9471 9472 if (ipf_proxy_soft_init(softc, softc->ipf_proxy_soft) == -1) 9473 return -1; 9474 9475 return 0; 9476 } 9477 9478 9479 /* ------------------------------------------------------------------------ */ 9480 /* Function: ipf_fini_all */ 9481 /* Returns: 0 = success, -1 = failure */ 9482 /* Parameters: softc(I) - pointer to soft context main structure */ 9483 /* */ 9484 /* Work through all of the subsystems inside IPFilter and call the fini */ 9485 /* function for each in an order that won't lead to a crash :) */ 9486 /* ------------------------------------------------------------------------ */ 9487 int 9488 ipf_fini_all(softc) 9489 ipf_main_softc_t *softc; 9490 { 9491 9492 if (ipf_proxy_soft_fini(softc, softc->ipf_proxy_soft) == -1) 9493 return -1; 9494 9495 if (ipf_auth_soft_fini(softc, softc->ipf_auth_soft) == -1) 9496 return -1; 9497 9498 if (ipf_frag_soft_fini(softc, softc->ipf_frag_soft) == -1) 9499 return -1; 9500 9501 if (ipf_nat_soft_fini(softc, softc->ipf_nat_soft) == -1) 9502 return -1; 9503 9504 if (ipf_state_soft_fini(softc, softc->ipf_state_soft) == -1) 9505 return -1; 9506 9507 if (ipf_sync_soft_fini(softc, softc->ipf_sync_soft) == -1) 9508 return -1; 9509 9510 if (ipf_lookup_soft_fini(softc, softc->ipf_lookup_soft) == -1) 9511 return -1; 9512 9513 if (ipf_log_soft_fini(softc, softc->ipf_log_soft) == -1) 9514 return -1; 9515 9516 if (ipf_main_soft_fini(softc) == -1) 9517 return -1; 9518 9519 return 0; 9520 } 9521 9522 9523 /* ------------------------------------------------------------------------ */ 9524 /* Function: ipf_rule_expire */ 9525 /* Returns: Nil */ 9526 /* Parameters: softc(I) - pointer to soft context main structure */ 9527 /* */ 9528 /* At present this function exists just to support temporary addition of */ 9529 /* firewall rules. Both inactive and active lists are scanned for items to */ 9530 /* purge, as by rights, the expiration is computed as soon as the rule is */ 9531 /* loaded in. */ 9532 /* ------------------------------------------------------------------------ */ 9533 void 9534 ipf_rule_expire(softc) 9535 ipf_main_softc_t *softc; 9536 { 9537 frentry_t *fr; 9538 9539 if ((softc->ipf_rule_explist[0] == NULL) && 9540 (softc->ipf_rule_explist[1] == NULL)) 9541 return; 9542 9543 WRITE_ENTER(&softc->ipf_mutex); 9544 9545 while ((fr = softc->ipf_rule_explist[0]) != NULL) { 9546 /* 9547 * Because the list is kept sorted on insertion, the fist 9548 * one that dies in the future means no more work to do. 9549 */ 9550 if (fr->fr_die > softc->ipf_ticks) 9551 break; 9552 ipf_rule_delete(softc, fr, IPL_LOGIPF, 0); 9553 } 9554 9555 while ((fr = softc->ipf_rule_explist[1]) != NULL) { 9556 /* 9557 * Because the list is kept sorted on insertion, the fist 9558 * one that dies in the future means no more work to do. 9559 */ 9560 if (fr->fr_die > softc->ipf_ticks) 9561 break; 9562 ipf_rule_delete(softc, fr, IPL_LOGIPF, 1); 9563 } 9564 9565 RWLOCK_EXIT(&softc->ipf_mutex); 9566 } 9567 9568 9569 static int ipf_ht_node_cmp __P((struct host_node_s *, struct host_node_s *)); 9570 static void ipf_ht_node_make_key __P((host_track_t *, host_node_t *, int, 9571 i6addr_t *)); 9572 9573 host_node_t RBI_ZERO(ipf_rb); 9574 RBI_CODE(ipf_rb, host_node_t, hn_entry, ipf_ht_node_cmp); 9575 9576 9577 /* ------------------------------------------------------------------------ */ 9578 /* Function: ipf_ht_node_cmp */ 9579 /* Returns: int - 0 == nodes are the same, .. */ 9580 /* Parameters: k1(I) - pointer to first key to compare */ 9581 /* k2(I) - pointer to second key to compare */ 9582 /* */ 9583 /* The "key" for the node is a combination of two fields: the address */ 9584 /* family and the address itself. */ 9585 /* */ 9586 /* Because we're not actually interpreting the address data, it isn't */ 9587 /* necessary to convert them to/from network/host byte order. The mask is */ 9588 /* just used to remove bits that aren't significant - it doesn't matter */ 9589 /* where they are, as long as they're always in the same place. */ 9590 /* */ 9591 /* As with IP6_EQ, comparing IPv6 addresses starts at the bottom because */ 9592 /* this is where individual ones will differ the most - but not true for */ 9593 /* for /48's, etc. */ 9594 /* ------------------------------------------------------------------------ */ 9595 static int 9596 ipf_ht_node_cmp(k1, k2) 9597 struct host_node_s *k1, *k2; 9598 { 9599 int i; 9600 9601 i = (k2->hn_addr.adf_family - k1->hn_addr.adf_family); 9602 if (i != 0) 9603 return i; 9604 9605 if (k1->hn_addr.adf_family == AF_INET) 9606 return (k2->hn_addr.adf_addr.in4.s_addr - 9607 k1->hn_addr.adf_addr.in4.s_addr); 9608 9609 i = k2->hn_addr.adf_addr.i6[3] - k1->hn_addr.adf_addr.i6[3]; 9610 if (i != 0) 9611 return i; 9612 i = k2->hn_addr.adf_addr.i6[2] - k1->hn_addr.adf_addr.i6[2]; 9613 if (i != 0) 9614 return i; 9615 i = k2->hn_addr.adf_addr.i6[1] - k1->hn_addr.adf_addr.i6[1]; 9616 if (i != 0) 9617 return i; 9618 i = k2->hn_addr.adf_addr.i6[0] - k1->hn_addr.adf_addr.i6[0]; 9619 return i; 9620 } 9621 9622 9623 /* ------------------------------------------------------------------------ */ 9624 /* Function: ipf_ht_node_make_key */ 9625 /* Returns: Nil */ 9626 /* parameters: htp(I) - pointer to address tracking structure */ 9627 /* key(I) - where to store masked address for lookup */ 9628 /* family(I) - protocol family of address */ 9629 /* addr(I) - pointer to network address */ 9630 /* */ 9631 /* Using the "netmask" (number of bits) stored parent host tracking struct, */ 9632 /* copy the address passed in into the key structure whilst masking out the */ 9633 /* bits that we don't want. */ 9634 /* */ 9635 /* Because the parser will set ht_netmask to 128 if there is no protocol */ 9636 /* specified (the parser doesn't know if it should be a v4 or v6 rule), we */ 9637 /* have to be wary of that and not allow 32-128 to happen. */ 9638 /* ------------------------------------------------------------------------ */ 9639 static void 9640 ipf_ht_node_make_key(htp, key, family, addr) 9641 host_track_t *htp; 9642 host_node_t *key; 9643 int family; 9644 i6addr_t *addr; 9645 { 9646 key->hn_addr.adf_family = family; 9647 if (family == AF_INET) { 9648 u_32_t mask; 9649 int bits; 9650 9651 key->hn_addr.adf_len = sizeof(key->hn_addr.adf_addr.in4); 9652 bits = htp->ht_netmask; 9653 if (bits >= 32) { 9654 mask = 0xffffffff; 9655 } else { 9656 mask = htonl(0xffffffff << (32 - bits)); 9657 } 9658 key->hn_addr.adf_addr.in4.s_addr = addr->in4.s_addr & mask; 9659 } else { 9660 int bits = htp->ht_netmask; 9661 9662 key->hn_addr.adf_len = sizeof(key->hn_addr.adf_addr.in6); 9663 if (bits > 96) { 9664 key->hn_addr.adf_addr.i6[3] = addr->i6[3] & 9665 htonl(0xffffffff << (128 - bits)); 9666 key->hn_addr.adf_addr.i6[2] = addr->i6[2]; 9667 key->hn_addr.adf_addr.i6[1] = addr->i6[2]; 9668 key->hn_addr.adf_addr.i6[0] = addr->i6[2]; 9669 } else if (bits > 64) { 9670 key->hn_addr.adf_addr.i6[3] = 0; 9671 key->hn_addr.adf_addr.i6[2] = addr->i6[2] & 9672 htonl(0xffffffff << (96 - bits)); 9673 key->hn_addr.adf_addr.i6[1] = addr->i6[1]; 9674 key->hn_addr.adf_addr.i6[0] = addr->i6[0]; 9675 } else if (bits > 32) { 9676 key->hn_addr.adf_addr.i6[3] = 0; 9677 key->hn_addr.adf_addr.i6[2] = 0; 9678 key->hn_addr.adf_addr.i6[1] = addr->i6[1] & 9679 htonl(0xffffffff << (64 - bits)); 9680 key->hn_addr.adf_addr.i6[0] = addr->i6[0]; 9681 } else { 9682 key->hn_addr.adf_addr.i6[3] = 0; 9683 key->hn_addr.adf_addr.i6[2] = 0; 9684 key->hn_addr.adf_addr.i6[1] = 0; 9685 key->hn_addr.adf_addr.i6[0] = addr->i6[0] & 9686 htonl(0xffffffff << (32 - bits)); 9687 } 9688 } 9689 } 9690 9691 9692 /* ------------------------------------------------------------------------ */ 9693 /* Function: ipf_ht_node_add */ 9694 /* Returns: int - 0 == success, -1 == failure */ 9695 /* Parameters: softc(I) - pointer to soft context main structure */ 9696 /* htp(I) - pointer to address tracking structure */ 9697 /* family(I) - protocol family of address */ 9698 /* addr(I) - pointer to network address */ 9699 /* */ 9700 /* NOTE: THIS FUNCTION MUST BE CALLED WITH AN EXCLUSIVE LOCK THAT PREVENTS */ 9701 /* ipf_ht_node_del FROM RUNNING CONCURRENTLY ON THE SAME htp. */ 9702 /* */ 9703 /* After preparing the key with the address information to find, look in */ 9704 /* the red-black tree to see if the address is known. A successful call to */ 9705 /* this function can mean one of two things: a new node was added to the */ 9706 /* tree or a matching node exists and we're able to bump up its activity. */ 9707 /* ------------------------------------------------------------------------ */ 9708 int 9709 ipf_ht_node_add(softc, htp, family, addr) 9710 ipf_main_softc_t *softc; 9711 host_track_t *htp; 9712 int family; 9713 i6addr_t *addr; 9714 { 9715 host_node_t *h; 9716 host_node_t k; 9717 9718 ipf_ht_node_make_key(htp, &k, family, addr); 9719 9720 h = RBI_SEARCH(ipf_rb, &htp->ht_root, &k); 9721 if (h == NULL) { 9722 if (htp->ht_cur_nodes >= htp->ht_max_nodes) 9723 return -1; 9724 KMALLOC(h, host_node_t *); 9725 if (h == NULL) { 9726 DT(ipf_rb_no_mem); 9727 LBUMP(ipf_rb_no_mem); 9728 return -1; 9729 } 9730 9731 /* 9732 * If there was a macro to initialise the RB node then that 9733 * would get used here, but there isn't... 9734 */ 9735 bzero((char *)h, sizeof(*h)); 9736 h->hn_addr = k.hn_addr; 9737 h->hn_addr.adf_family = k.hn_addr.adf_family; 9738 RBI_INSERT(ipf_rb, &htp->ht_root, h); 9739 htp->ht_cur_nodes++; 9740 } else { 9741 if ((htp->ht_max_per_node != 0) && 9742 (h->hn_active >= htp->ht_max_per_node)) { 9743 DT(ipf_rb_node_max); 9744 LBUMP(ipf_rb_node_max); 9745 return -1; 9746 } 9747 } 9748 9749 h->hn_active++; 9750 9751 return 0; 9752 } 9753 9754 9755 /* ------------------------------------------------------------------------ */ 9756 /* Function: ipf_ht_node_del */ 9757 /* Returns: int - 0 == success, -1 == failure */ 9758 /* parameters: htp(I) - pointer to address tracking structure */ 9759 /* family(I) - protocol family of address */ 9760 /* addr(I) - pointer to network address */ 9761 /* */ 9762 /* NOTE: THIS FUNCTION MUST BE CALLED WITH AN EXCLUSIVE LOCK THAT PREVENTS */ 9763 /* ipf_ht_node_add FROM RUNNING CONCURRENTLY ON THE SAME htp. */ 9764 /* */ 9765 /* Try and find the address passed in amongst the leavese on this tree to */ 9766 /* be friend. If found then drop the active account for that node drops by */ 9767 /* one. If that count reaches 0, it is time to free it all up. */ 9768 /* ------------------------------------------------------------------------ */ 9769 int 9770 ipf_ht_node_del(htp, family, addr) 9771 host_track_t *htp; 9772 int family; 9773 i6addr_t *addr; 9774 { 9775 host_node_t *h; 9776 host_node_t k; 9777 9778 ipf_ht_node_make_key(htp, &k, family, addr); 9779 9780 h = RBI_SEARCH(ipf_rb, &htp->ht_root, &k); 9781 if (h == NULL) { 9782 return -1; 9783 } else { 9784 h->hn_active--; 9785 if (h->hn_active == 0) { 9786 (void) RBI_DELETE(ipf_rb, &htp->ht_root, h); 9787 htp->ht_cur_nodes--; 9788 KFREE(h); 9789 } 9790 } 9791 9792 return 0; 9793 } 9794 9795 9796 /* ------------------------------------------------------------------------ */ 9797 /* Function: ipf_rb_ht_init */ 9798 /* Returns: Nil */ 9799 /* Parameters: head(I) - pointer to host tracking structure */ 9800 /* */ 9801 /* Initialise the host tracking structure to be ready for use above. */ 9802 /* ------------------------------------------------------------------------ */ 9803 void 9804 ipf_rb_ht_init(head) 9805 host_track_t *head; 9806 { 9807 RBI_INIT(ipf_rb, &head->ht_root); 9808 } 9809 9810 9811 /* ------------------------------------------------------------------------ */ 9812 /* Function: ipf_rb_ht_freenode */ 9813 /* Returns: Nil */ 9814 /* Parameters: head(I) - pointer to host tracking structure */ 9815 /* arg(I) - additional argument from walk caller */ 9816 /* */ 9817 /* Free an actual host_node_t structure. */ 9818 /* ------------------------------------------------------------------------ */ 9819 void 9820 ipf_rb_ht_freenode(node, arg) 9821 host_node_t *node; 9822 void *arg; 9823 { 9824 KFREE(node); 9825 } 9826 9827 9828 /* ------------------------------------------------------------------------ */ 9829 /* Function: ipf_rb_ht_flush */ 9830 /* Returns: Nil */ 9831 /* Parameters: head(I) - pointer to host tracking structure */ 9832 /* */ 9833 /* Remove all of the nodes in the tree tracking hosts by calling a walker */ 9834 /* and free'ing each one. */ 9835 /* ------------------------------------------------------------------------ */ 9836 void 9837 ipf_rb_ht_flush(head) 9838 host_track_t *head; 9839 { 9840 RBI_WALK(ipf_rb, &head->ht_root, ipf_rb_ht_freenode, NULL); 9841 } 9842 9843 9844 /* ------------------------------------------------------------------------ */ 9845 /* Function: ipf_slowtimer */ 9846 /* Returns: Nil */ 9847 /* Parameters: ptr(I) - pointer to main ipf soft context structure */ 9848 /* */ 9849 /* Slowly expire held state for fragments. Timeouts are set * in */ 9850 /* expectation of this being called twice per second. */ 9851 /* ------------------------------------------------------------------------ */ 9852 void 9853 ipf_slowtimer(softc) 9854 ipf_main_softc_t *softc; 9855 { 9856 9857 ipf_token_expire(softc); 9858 ipf_frag_expire(softc); 9859 ipf_state_expire(softc); 9860 ipf_nat_expire(softc); 9861 ipf_auth_expire(softc); 9862 ipf_lookup_expire(softc); 9863 ipf_rule_expire(softc); 9864 ipf_sync_expire(softc); 9865 softc->ipf_ticks++; 9866 # if defined(__OpenBSD__) 9867 timeout_add(&ipf_slowtimer_ch, hz/2); 9868 # endif 9869 } 9870
Indexes created Wed Sep 24 05:09:52 GMT 2025