ip_fil_netbsd.c revision 1.2.2.2
1 1.2.2.2 joerg /* $NetBSD: ip_fil_netbsd.c,v 1.2.2.2 2012/04/17 19:25:18 joerg Exp $ */ 2 1.2.2.2 joerg 3 1.2.2.2 joerg /* 4 1.2.2.2 joerg * Copyright (C) 2012 by Darren Reed. 5 1.2.2.2 joerg * 6 1.2.2.2 joerg * See the IPFILTER.LICENCE file for details on licencing. 7 1.2.2.2 joerg */ 8 1.2.2.2 joerg #if !defined(lint) 9 1.2.2.2 joerg #if defined(__NetBSD__) 10 1.2.2.2 joerg #include <sys/cdefs.h> 11 1.2.2.2 joerg __KERNEL_RCSID(0, "$NetBSD: ip_fil_netbsd.c,v 1.2.2.2 2012/04/17 19:25:18 joerg Exp $"); 12 1.2.2.2 joerg #else 13 1.2.2.2 joerg static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-2000 Darren Reed"; 14 1.2.2.2 joerg static const char rcsid[] = "@(#)Id: ip_fil_netbsd.c,v 2.144.2.10 2012/01/29 05:30:36 darrenr Exp"; 15 1.2.2.2 joerg #endif 16 1.2.2.2 joerg #endif 17 1.2.2.2 joerg 18 1.2.2.2 joerg #if defined(KERNEL) || defined(_KERNEL) 19 1.2.2.2 joerg # undef KERNEL 20 1.2.2.2 joerg # undef _KERNEL 21 1.2.2.2 joerg # define KERNEL 1 22 1.2.2.2 joerg # define _KERNEL 1 23 1.2.2.2 joerg #endif 24 1.2.2.2 joerg #include <sys/param.h> 25 1.2.2.2 joerg #if (NetBSD >= 199905) && !defined(IPFILTER_LKM) 26 1.2.2.2 joerg # include "opt_pfil_hooks.h" 27 1.2.2.2 joerg # include "opt_ipsec.h" 28 1.2.2.2 joerg #endif 29 1.2.2.2 joerg #include <sys/errno.h> 30 1.2.2.2 joerg #include <sys/types.h> 31 1.2.2.2 joerg #include <sys/file.h> 32 1.2.2.2 joerg #include <sys/ioctl.h> 33 1.2.2.2 joerg #include <sys/time.h> 34 1.2.2.2 joerg #include <sys/systm.h> 35 1.2.2.2 joerg #include <sys/select.h> 36 1.2.2.2 joerg #if (NetBSD > 199609) 37 1.2.2.2 joerg # include <sys/dirent.h> 38 1.2.2.2 joerg #else 39 1.2.2.2 joerg # include <sys/dir.h> 40 1.2.2.2 joerg #endif 41 1.2.2.2 joerg #if (__NetBSD_Version__ >= 599005900) 42 1.2.2.2 joerg # include <sys/cprng.h> 43 1.2.2.2 joerg #endif 44 1.2.2.2 joerg #include <sys/mbuf.h> 45 1.2.2.2 joerg #include <sys/protosw.h> 46 1.2.2.2 joerg #include <sys/socket.h> 47 1.2.2.2 joerg #include <sys/poll.h> 48 1.2.2.2 joerg #if (__NetBSD_Version__ >= 399002000) 49 1.2.2.2 joerg # include <sys/kauth.h> 50 1.2.2.2 joerg #endif 51 1.2.2.2 joerg 52 1.2.2.2 joerg #include <net/if.h> 53 1.2.2.2 joerg #include <net/route.h> 54 1.2.2.2 joerg #include <netinet/in.h> 55 1.2.2.2 joerg #include <netinet/in_var.h> 56 1.2.2.2 joerg #include <netinet/in_systm.h> 57 1.2.2.2 joerg #include <netinet/ip.h> 58 1.2.2.2 joerg #include <netinet/ip_var.h> 59 1.2.2.2 joerg #include <netinet/tcp.h> 60 1.2.2.2 joerg #if __NetBSD_Version__ >= 105190000 /* 1.5T */ 61 1.2.2.2 joerg # include <netinet/tcp_timer.h> 62 1.2.2.2 joerg # include <netinet/tcp_var.h> 63 1.2.2.2 joerg #endif 64 1.2.2.2 joerg #include <netinet/udp.h> 65 1.2.2.2 joerg #include <netinet/tcpip.h> 66 1.2.2.2 joerg #include <netinet/ip_icmp.h> 67 1.2.2.2 joerg #include "netinet/ip_compat.h" 68 1.2.2.2 joerg #ifdef USE_INET6 69 1.2.2.2 joerg # include <netinet/icmp6.h> 70 1.2.2.2 joerg # if (__NetBSD_Version__ >= 106000000) 71 1.2.2.2 joerg # include <netinet6/nd6.h> 72 1.2.2.2 joerg # endif 73 1.2.2.2 joerg #endif 74 1.2.2.2 joerg #include "netinet/ip_fil.h" 75 1.2.2.2 joerg #include "netinet/ip_nat.h" 76 1.2.2.2 joerg #include "netinet/ip_frag.h" 77 1.2.2.2 joerg #include "netinet/ip_state.h" 78 1.2.2.2 joerg #include "netinet/ip_proxy.h" 79 1.2.2.2 joerg #include "netinet/ip_auth.h" 80 1.2.2.2 joerg #include "netinet/ip_sync.h" 81 1.2.2.2 joerg #include "netinet/ip_lookup.h" 82 1.2.2.2 joerg #include "netinet/ip_dstlist.h" 83 1.2.2.2 joerg #ifdef IPFILTER_SCAN 84 1.2.2.2 joerg #include "netinet/ip_scan.h" 85 1.2.2.2 joerg #endif 86 1.2.2.2 joerg #include <sys/md5.h> 87 1.2.2.2 joerg #include <sys/kernel.h> 88 1.2.2.2 joerg #include <sys/conf.h> 89 1.2.2.2 joerg #ifdef INET 90 1.2.2.2 joerg extern int ip_optcopy (struct ip *, struct ip *); 91 1.2.2.2 joerg #endif 92 1.2.2.2 joerg 93 1.2.2.2 joerg #ifdef IPFILTER_M_IPFILTER 94 1.2.2.2 joerg MALLOC_DEFINE(M_IPFILTER, "IP Filter", "IP Filter packet filter data structures"); 95 1.2.2.2 joerg #endif 96 1.2.2.2 joerg 97 1.2.2.2 joerg #if __NetBSD_Version__ >= 105009999 98 1.2.2.2 joerg # define csuminfo csum_flags 99 1.2.2.2 joerg #endif 100 1.2.2.2 joerg 101 1.2.2.2 joerg #if __NetBSD_Version__ < 200000000 102 1.2.2.2 joerg extern struct protosw inetsw[]; 103 1.2.2.2 joerg #endif 104 1.2.2.2 joerg 105 1.2.2.2 joerg #if (__NetBSD_Version__ >= 599002000) 106 1.2.2.2 joerg static kauth_listener_t ipf_listener; 107 1.2.2.2 joerg #endif 108 1.2.2.2 joerg 109 1.2.2.2 joerg #if (__NetBSD_Version__ < 399001400) 110 1.2.2.2 joerg extern int ip6_getpmtu (struct route_in6 *, struct route_in6 *, 111 1.2.2.2 joerg struct ifnet *, struct in6_addr *, u_long *, 112 1.2.2.2 joerg int *); 113 1.2.2.2 joerg #endif 114 1.2.2.2 joerg #if (NetBSD >= 199511) 115 1.2.2.2 joerg static int ipfopen(dev_t dev, int flags, int devtype, PROC_T *p); 116 1.2.2.2 joerg static int ipfclose(dev_t dev, int flags, int devtype, PROC_T *p); 117 1.2.2.2 joerg #else 118 1.2.2.2 joerg # if (__NetBSD_Version__ >= 399001400) 119 1.2.2.2 joerg static int ipfopen(dev_t dev, int flags, struct lwp *); 120 1.2.2.2 joerg static int ipfclose(dev_t dev, int flags, struct lwp *); 121 1.2.2.2 joerg # else 122 1.2.2.2 joerg static int ipfopen(dev_t dev, int flags); 123 1.2.2.2 joerg static int ipfclose(dev_t dev, int flags); 124 1.2.2.2 joerg # endif /* __NetBSD_Version__ >= 399001400 */ 125 1.2.2.2 joerg #endif 126 1.2.2.2 joerg static int ipfread(dev_t, struct uio *, int ioflag); 127 1.2.2.2 joerg static int ipfwrite(dev_t, struct uio *, int ioflag); 128 1.2.2.2 joerg static int ipfpoll(dev_t, int events, PROC_T *); 129 1.2.2.2 joerg static void ipf_timer_func(void *ptr); 130 1.2.2.2 joerg 131 1.2.2.2 joerg const struct cdevsw ipl_cdevsw = { 132 1.2.2.2 joerg ipfopen, ipfclose, ipfread, ipfwrite, ipfioctl, 133 1.2.2.2 joerg nostop, notty, ipfpoll, nommap, 134 1.2.2.2 joerg #if (__NetBSD_Version__ >= 200000000) 135 1.2.2.2 joerg nokqfilter, 136 1.2.2.2 joerg #endif 137 1.2.2.2 joerg #ifdef D_OTHER 138 1.2.2.2 joerg D_OTHER, 139 1.2.2.2 joerg #endif 140 1.2.2.2 joerg }; 141 1.2.2.2 joerg 142 1.2.2.2 joerg ipf_main_softc_t ipfmain; 143 1.2.2.2 joerg 144 1.2.2.2 joerg static u_short ipid = 0; 145 1.2.2.2 joerg static int (*ipf_savep)(void *, ip_t *, int, void *, int, struct mbuf **); 146 1.2.2.2 joerg static int ipf_send_ip(fr_info_t *, mb_t *); 147 1.2.2.2 joerg #ifdef USE_INET6 148 1.2.2.2 joerg static int ipf_fastroute6(struct mbuf *, struct mbuf **, 149 1.2.2.2 joerg fr_info_t *, frdest_t *); 150 1.2.2.2 joerg #endif 151 1.2.2.2 joerg 152 1.2.2.2 joerg #if defined(NETBSD_PF) 153 1.2.2.2 joerg # include <net/pfil.h> 154 1.2.2.2 joerg /* 155 1.2.2.2 joerg * We provide the ipf_checkp name just to minimize changes later. 156 1.2.2.2 joerg */ 157 1.2.2.2 joerg int (*ipf_checkp)(void *, ip_t *ip, int hlen, void *ifp, int out, mb_t **mp); 158 1.2.2.2 joerg #endif /* NETBSD_PF */ 159 1.2.2.2 joerg 160 1.2.2.2 joerg #if defined(__NetBSD_Version__) && (__NetBSD_Version__ >= 105110000) 161 1.2.2.2 joerg # include <net/pfil.h> 162 1.2.2.2 joerg 163 1.2.2.2 joerg static int ipf_check_wrapper(void *, struct mbuf **, struct ifnet *, int ); 164 1.2.2.2 joerg 165 1.2.2.2 joerg static int 166 1.2.2.2 joerg ipf_check_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 167 1.2.2.2 joerg { 168 1.2.2.2 joerg struct ip *ip; 169 1.2.2.2 joerg int rv, hlen; 170 1.2.2.2 joerg 171 1.2.2.2 joerg #if __NetBSD_Version__ >= 200080000 172 1.2.2.2 joerg /* 173 1.2.2.2 joerg * ensure that mbufs are writable beforehand 174 1.2.2.2 joerg * as it's assumed by ipf code. 175 1.2.2.2 joerg * XXX inefficient 176 1.2.2.2 joerg */ 177 1.2.2.2 joerg int error = m_makewritable(mp, 0, M_COPYALL, M_DONTWAIT); 178 1.2.2.2 joerg 179 1.2.2.2 joerg if (error) { 180 1.2.2.2 joerg m_freem(*mp); 181 1.2.2.2 joerg *mp = NULL; 182 1.2.2.2 joerg return error; 183 1.2.2.2 joerg } 184 1.2.2.2 joerg #endif 185 1.2.2.2 joerg ip = mtod(*mp, struct ip *); 186 1.2.2.2 joerg hlen = ip->ip_hl << 2; 187 1.2.2.2 joerg 188 1.2.2.2 joerg #ifdef INET 189 1.2.2.2 joerg #if defined(M_CSUM_TCPv4) 190 1.2.2.2 joerg /* 191 1.2.2.2 joerg * If the packet is out-bound, we can't delay checksums 192 1.2.2.2 joerg * here. For in-bound, the checksum has already been 193 1.2.2.2 joerg * validated. 194 1.2.2.2 joerg */ 195 1.2.2.2 joerg if (dir == PFIL_OUT) { 196 1.2.2.2 joerg if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 197 1.2.2.2 joerg in_delayed_cksum(*mp); 198 1.2.2.2 joerg (*mp)->m_pkthdr.csum_flags &= 199 1.2.2.2 joerg ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 200 1.2.2.2 joerg } 201 1.2.2.2 joerg } 202 1.2.2.2 joerg #endif /* M_CSUM_TCPv4 */ 203 1.2.2.2 joerg #endif /* INET */ 204 1.2.2.2 joerg 205 1.2.2.2 joerg /* 206 1.2.2.2 joerg * Note, we don't need to update the checksum, because 207 1.2.2.2 joerg * it has already been verified. 208 1.2.2.2 joerg */ 209 1.2.2.2 joerg rv = ipf_check(&ipfmain, ip, hlen, ifp, (dir == PFIL_OUT), mp); 210 1.2.2.2 joerg 211 1.2.2.2 joerg return (rv); 212 1.2.2.2 joerg } 213 1.2.2.2 joerg 214 1.2.2.2 joerg # ifdef USE_INET6 215 1.2.2.2 joerg # include <netinet/ip6.h> 216 1.2.2.2 joerg 217 1.2.2.2 joerg static int ipf_check_wrapper6(void *, struct mbuf **, struct ifnet *, int ); 218 1.2.2.2 joerg 219 1.2.2.2 joerg static int 220 1.2.2.2 joerg ipf_check_wrapper6(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 221 1.2.2.2 joerg { 222 1.2.2.2 joerg #if defined(INET6) 223 1.2.2.2 joerg # if defined(M_CSUM_TCPv6) && (__NetBSD_Version__ > 200000000) 224 1.2.2.2 joerg /* 225 1.2.2.2 joerg * If the packet is out-bound, we can't delay checksums 226 1.2.2.2 joerg * here. For in-bound, the checksum has already been 227 1.2.2.2 joerg * validated. 228 1.2.2.2 joerg */ 229 1.2.2.2 joerg if (dir == PFIL_OUT) { 230 1.2.2.2 joerg if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv6|M_CSUM_UDPv6)) { 231 1.2.2.2 joerg # if (__NetBSD_Version__ > 399000600) 232 1.2.2.2 joerg in6_delayed_cksum(*mp); 233 1.2.2.2 joerg # endif 234 1.2.2.2 joerg (*mp)->m_pkthdr.csum_flags &= ~(M_CSUM_TCPv6| 235 1.2.2.2 joerg M_CSUM_UDPv6); 236 1.2.2.2 joerg } 237 1.2.2.2 joerg } 238 1.2.2.2 joerg # endif 239 1.2.2.2 joerg #endif /* INET6 */ 240 1.2.2.2 joerg 241 1.2.2.2 joerg return (ipf_check(&ipfmain, mtod(*mp, struct ip *), sizeof(struct ip6_hdr), 242 1.2.2.2 joerg ifp, (dir == PFIL_OUT), mp)); 243 1.2.2.2 joerg } 244 1.2.2.2 joerg # endif 245 1.2.2.2 joerg 246 1.2.2.2 joerg 247 1.2.2.2 joerg # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 248 1.2.2.2 joerg static int ipf_pfilsync(void *, struct mbuf **, struct ifnet *, int); 249 1.2.2.2 joerg 250 1.2.2.2 joerg static int 251 1.2.2.2 joerg ipf_pfilsync(void *hdr, struct mbuf **mp, struct ifnet *ifp, int dir) 252 1.2.2.2 joerg { 253 1.2.2.2 joerg /* 254 1.2.2.2 joerg * The interface pointer is useless for create (we have nothing to 255 1.2.2.2 joerg * compare it to) and at detach, the interface name is still in the 256 1.2.2.2 joerg * list of active NICs (albeit, down, but that's not any real 257 1.2.2.2 joerg * indicator) and doing ifunit() on the name will still return the 258 1.2.2.2 joerg * pointer, so it's not much use then, either. 259 1.2.2.2 joerg */ 260 1.2.2.2 joerg ipf_sync(&ipfmain, NULL); 261 1.2.2.2 joerg return 0; 262 1.2.2.2 joerg } 263 1.2.2.2 joerg # endif 264 1.2.2.2 joerg 265 1.2.2.2 joerg #endif /* __NetBSD_Version__ >= 105110000 */ 266 1.2.2.2 joerg 267 1.2.2.2 joerg 268 1.2.2.2 joerg #if defined(IPFILTER_LKM) 269 1.2.2.2 joerg int 270 1.2.2.2 joerg ipf_identify(s) 271 1.2.2.2 joerg char *s; 272 1.2.2.2 joerg { 273 1.2.2.2 joerg if (strcmp(s, "ipl") == 0) 274 1.2.2.2 joerg return 1; 275 1.2.2.2 joerg return 0; 276 1.2.2.2 joerg } 277 1.2.2.2 joerg #endif /* IPFILTER_LKM */ 278 1.2.2.2 joerg 279 1.2.2.2 joerg #if (__NetBSD_Version__ >= 599002000) 280 1.2.2.2 joerg static int 281 1.2.2.2 joerg ipf_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie, 282 1.2.2.2 joerg void *arg0, void *arg1, void *arg2, void *arg3) 283 1.2.2.2 joerg { 284 1.2.2.2 joerg int result; 285 1.2.2.2 joerg enum kauth_network_req req; 286 1.2.2.2 joerg 287 1.2.2.2 joerg result = KAUTH_RESULT_DEFER; 288 1.2.2.2 joerg req = (enum kauth_network_req)arg0; 289 1.2.2.2 joerg 290 1.2.2.2 joerg if (action != KAUTH_NETWORK_FIREWALL) 291 1.2.2.2 joerg return result; 292 1.2.2.2 joerg 293 1.2.2.2 joerg /* These must have came from device context. */ 294 1.2.2.2 joerg if ((req == KAUTH_REQ_NETWORK_FIREWALL_FW) || 295 1.2.2.2 joerg (req == KAUTH_REQ_NETWORK_FIREWALL_NAT)) 296 1.2.2.2 joerg result = KAUTH_RESULT_ALLOW; 297 1.2.2.2 joerg 298 1.2.2.2 joerg return result; 299 1.2.2.2 joerg } 300 1.2.2.2 joerg #endif 301 1.2.2.2 joerg 302 1.2.2.2 joerg /* 303 1.2.2.2 joerg * Try to detect the case when compiling for NetBSD with pseudo-device 304 1.2.2.2 joerg */ 305 1.2.2.2 joerg void 306 1.2.2.2 joerg ipfilterattach(int count) 307 1.2.2.2 joerg { 308 1.2.2.2 joerg 309 1.2.2.2 joerg #if (__NetBSD_Version__ >= 599002000) 310 1.2.2.2 joerg ipf_listener = kauth_listen_scope(KAUTH_SCOPE_NETWORK, 311 1.2.2.2 joerg ipf_listener_cb, NULL); 312 1.2.2.2 joerg #endif 313 1.2.2.2 joerg 314 1.2.2.2 joerg if (ipf_load_all() == 0) 315 1.2.2.2 joerg (void) ipf_create_all(&ipfmain); 316 1.2.2.2 joerg } 317 1.2.2.2 joerg 318 1.2.2.2 joerg 319 1.2.2.2 joerg int 320 1.2.2.2 joerg ipfattach(ipf_main_softc_t *softc) 321 1.2.2.2 joerg { 322 1.2.2.2 joerg SPL_INT(s); 323 1.2.2.2 joerg #if (__NetBSD_Version__ >= 499005500) 324 1.2.2.2 joerg int i; 325 1.2.2.2 joerg #endif 326 1.2.2.2 joerg #if defined(NETBSD_PF) && (__NetBSD_Version__ >= 104200000) 327 1.2.2.2 joerg int error = 0; 328 1.2.2.2 joerg # if defined(__NetBSD_Version__) && (__NetBSD_Version__ >= 105110000) 329 1.2.2.2 joerg struct pfil_head *ph_inet; 330 1.2.2.2 joerg # ifdef USE_INET6 331 1.2.2.2 joerg struct pfil_head *ph_inet6; 332 1.2.2.2 joerg # endif 333 1.2.2.2 joerg # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 334 1.2.2.2 joerg struct pfil_head *ph_ifsync; 335 1.2.2.2 joerg # endif 336 1.2.2.2 joerg # endif 337 1.2.2.2 joerg #endif 338 1.2.2.2 joerg 339 1.2.2.2 joerg SPL_NET(s); 340 1.2.2.2 joerg if ((softc->ipf_running > 0) || (ipf_checkp == ipf_check)) { 341 1.2.2.2 joerg printf("IP Filter: already initialized\n"); 342 1.2.2.2 joerg SPL_X(s); 343 1.2.2.2 joerg IPFERROR(130017); 344 1.2.2.2 joerg return EBUSY; 345 1.2.2.2 joerg } 346 1.2.2.2 joerg 347 1.2.2.2 joerg if (ipf_init_all(softc) < 0) { 348 1.2.2.2 joerg SPL_X(s); 349 1.2.2.2 joerg IPFERROR(130015); 350 1.2.2.2 joerg return EIO; 351 1.2.2.2 joerg } 352 1.2.2.2 joerg 353 1.2.2.2 joerg #ifdef NETBSD_PF 354 1.2.2.2 joerg # if (__NetBSD_Version__ >= 104200000) 355 1.2.2.2 joerg # if __NetBSD_Version__ >= 105110000 356 1.2.2.2 joerg ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 357 1.2.2.2 joerg # ifdef USE_INET6 358 1.2.2.2 joerg ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 359 1.2.2.2 joerg # endif 360 1.2.2.2 joerg # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 361 1.2.2.2 joerg ph_ifsync = pfil_head_get(PFIL_TYPE_IFNET, 0); 362 1.2.2.2 joerg # endif 363 1.2.2.2 joerg 364 1.2.2.2 joerg if (ph_inet == NULL 365 1.2.2.2 joerg # ifdef USE_INET6 366 1.2.2.2 joerg && ph_inet6 == NULL 367 1.2.2.2 joerg # endif 368 1.2.2.2 joerg # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 369 1.2.2.2 joerg && ph_ifsync == NULL 370 1.2.2.2 joerg # endif 371 1.2.2.2 joerg ) { 372 1.2.2.2 joerg SPL_X(s); 373 1.2.2.2 joerg IPFERROR(130016); 374 1.2.2.2 joerg return ENODEV; 375 1.2.2.2 joerg } 376 1.2.2.2 joerg 377 1.2.2.2 joerg if (ph_inet != NULL) 378 1.2.2.2 joerg error = pfil_add_hook((void *)ipf_check_wrapper, NULL, 379 1.2.2.2 joerg PFIL_IN|PFIL_OUT, ph_inet); 380 1.2.2.2 joerg else 381 1.2.2.2 joerg error = 0; 382 1.2.2.2 joerg # else 383 1.2.2.2 joerg error = pfil_add_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 384 1.2.2.2 joerg &inetsw[ip_protox[IPPROTO_IP]].pr_pfh); 385 1.2.2.2 joerg # endif 386 1.2.2.2 joerg if (error) { 387 1.2.2.2 joerg IPFERROR(130013); 388 1.2.2.2 joerg goto pfil_error; 389 1.2.2.2 joerg } 390 1.2.2.2 joerg # else 391 1.2.2.2 joerg pfil_add_hook((void *)ipf_check, PFIL_IN|PFIL_OUT); 392 1.2.2.2 joerg # endif 393 1.2.2.2 joerg 394 1.2.2.2 joerg # ifdef USE_INET6 395 1.2.2.2 joerg # if __NetBSD_Version__ >= 105110000 396 1.2.2.2 joerg if (ph_inet6 != NULL) 397 1.2.2.2 joerg error = pfil_add_hook((void *)ipf_check_wrapper6, NULL, 398 1.2.2.2 joerg PFIL_IN|PFIL_OUT, ph_inet6); 399 1.2.2.2 joerg else 400 1.2.2.2 joerg error = 0; 401 1.2.2.2 joerg if (error) { 402 1.2.2.2 joerg pfil_remove_hook((void *)ipf_check_wrapper6, NULL, 403 1.2.2.2 joerg PFIL_IN|PFIL_OUT, ph_inet6); 404 1.2.2.2 joerg ipfmain.ipf_interror = 130014; 405 1.2.2.2 joerg goto pfil_error; 406 1.2.2.2 joerg } 407 1.2.2.2 joerg # else 408 1.2.2.2 joerg error = pfil_add_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 409 1.2.2.2 joerg &inetsw[ip_protox[IPPROTO_IPV6]].pr_pfh); 410 1.2.2.2 joerg if (error) { 411 1.2.2.2 joerg pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 412 1.2.2.2 joerg &inetsw[ip_protox[IPPROTO_IP]].pr_pfh); 413 1.2.2.2 joerg IPFERROR(130014); 414 1.2.2.2 joerg goto pfil_error; 415 1.2.2.2 joerg } 416 1.2.2.2 joerg # endif 417 1.2.2.2 joerg # endif 418 1.2.2.2 joerg 419 1.2.2.2 joerg # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 420 1.2.2.2 joerg if (ph_ifsync != NULL) 421 1.2.2.2 joerg (void) pfil_add_hook((void *)ipf_pfilsync, NULL, 422 1.2.2.2 joerg PFIL_IFNET, ph_ifsync); 423 1.2.2.2 joerg # endif 424 1.2.2.2 joerg #endif 425 1.2.2.2 joerg 426 1.2.2.2 joerg #if (__NetBSD_Version__ >= 499005500) 427 1.2.2.2 joerg for (i = 0; i < IPL_LOGSIZE; i++) 428 1.2.2.2 joerg selinit(&ipfmain.ipf_selwait[i]); 429 1.2.2.2 joerg #else 430 1.2.2.2 joerg bzero((char *)ipfmain.ipf_selwait, sizeof(ipfmain.ipf_selwait)); 431 1.2.2.2 joerg #endif 432 1.2.2.2 joerg ipf_savep = ipf_checkp; 433 1.2.2.2 joerg ipf_checkp = ipf_check; 434 1.2.2.2 joerg 435 1.2.2.2 joerg #ifdef INET 436 1.2.2.2 joerg if (softc->ipf_control_forwarding & 1) 437 1.2.2.2 joerg ipforwarding = 1; 438 1.2.2.2 joerg #endif 439 1.2.2.2 joerg 440 1.2.2.2 joerg ipid = 0; 441 1.2.2.2 joerg 442 1.2.2.2 joerg SPL_X(s); 443 1.2.2.2 joerg 444 1.2.2.2 joerg #if (__NetBSD_Version__ >= 104010000) 445 1.2.2.2 joerg # if (__NetBSD_Version__ >= 499002000) 446 1.2.2.2 joerg callout_init(&softc->ipf_slow_ch, 0); 447 1.2.2.2 joerg # else 448 1.2.2.2 joerg callout_init(&softc->ipf_slow_ch); 449 1.2.2.2 joerg # endif 450 1.2.2.2 joerg callout_reset(&softc->ipf_slow_ch, (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT, 451 1.2.2.2 joerg ipf_timer_func, softc); 452 1.2.2.2 joerg #else 453 1.2.2.2 joerg timeout(ipf_timer_func, softc, (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT); 454 1.2.2.2 joerg #endif 455 1.2.2.2 joerg 456 1.2.2.2 joerg return 0; 457 1.2.2.2 joerg 458 1.2.2.2 joerg #if __NetBSD_Version__ >= 105110000 459 1.2.2.2 joerg pfil_error: 460 1.2.2.2 joerg SPL_X(s); 461 1.2.2.2 joerg ipf_fini_all(softc); 462 1.2.2.2 joerg return error; 463 1.2.2.2 joerg #endif 464 1.2.2.2 joerg } 465 1.2.2.2 joerg 466 1.2.2.2 joerg static void 467 1.2.2.2 joerg ipf_timer_func(void *ptr) 468 1.2.2.2 joerg { 469 1.2.2.2 joerg ipf_main_softc_t *softc = ptr; 470 1.2.2.2 joerg SPL_INT(s); 471 1.2.2.2 joerg 472 1.2.2.2 joerg SPL_NET(s); 473 1.2.2.2 joerg READ_ENTER(&softc->ipf_global); 474 1.2.2.2 joerg 475 1.2.2.2 joerg if (softc->ipf_running > 0) 476 1.2.2.2 joerg ipf_slowtimer(softc); 477 1.2.2.2 joerg 478 1.2.2.2 joerg if (softc->ipf_running == -1 || softc->ipf_running == 1) { 479 1.2.2.2 joerg #if NETBSD_GE_REV(104240000) 480 1.2.2.2 joerg callout_reset(&softc->ipf_slow_ch, hz / 2, 481 1.2.2.2 joerg ipf_timer_func, softc); 482 1.2.2.2 joerg #else 483 1.2.2.2 joerg timeout(ipf_timer_func, softc, 484 1.2.2.2 joerg (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT); 485 1.2.2.2 joerg #endif 486 1.2.2.2 joerg } 487 1.2.2.2 joerg RWLOCK_EXIT(&softc->ipf_global); 488 1.2.2.2 joerg SPL_X(s); 489 1.2.2.2 joerg } 490 1.2.2.2 joerg 491 1.2.2.2 joerg 492 1.2.2.2 joerg /* 493 1.2.2.2 joerg * Disable the filter by removing the hooks from the IP input/output 494 1.2.2.2 joerg * stream. 495 1.2.2.2 joerg */ 496 1.2.2.2 joerg int 497 1.2.2.2 joerg ipfdetach(ipf_main_softc_t *softc) 498 1.2.2.2 joerg { 499 1.2.2.2 joerg SPL_INT(s); 500 1.2.2.2 joerg #if (__NetBSD_Version__ >= 499005500) 501 1.2.2.2 joerg int i; 502 1.2.2.2 joerg #endif 503 1.2.2.2 joerg #if defined(NETBSD_PF) && (__NetBSD_Version__ >= 104200000) 504 1.2.2.2 joerg int error = 0; 505 1.2.2.2 joerg # if __NetBSD_Version__ >= 105150000 506 1.2.2.2 joerg struct pfil_head *ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 507 1.2.2.2 joerg # ifdef USE_INET6 508 1.2.2.2 joerg struct pfil_head *ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 509 1.2.2.2 joerg # endif 510 1.2.2.2 joerg # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 511 1.2.2.2 joerg struct pfil_head *ph_ifsync = pfil_head_get(PFIL_TYPE_IFNET, 0); 512 1.2.2.2 joerg # endif 513 1.2.2.2 joerg # endif 514 1.2.2.2 joerg #endif 515 1.2.2.2 joerg 516 1.2.2.2 joerg SPL_NET(s); 517 1.2.2.2 joerg 518 1.2.2.2 joerg #if (__NetBSD_Version__ >= 104010000) 519 1.2.2.2 joerg if (softc->ipf_running > 0) 520 1.2.2.2 joerg callout_stop(&softc->ipf_slow_ch); 521 1.2.2.2 joerg #else 522 1.2.2.2 joerg untimeout(ipf_slowtimer, NULL); 523 1.2.2.2 joerg #endif /* NetBSD */ 524 1.2.2.2 joerg 525 1.2.2.2 joerg ipf_checkp = ipf_savep; 526 1.2.2.2 joerg (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE|FR_INACTIVE); 527 1.2.2.2 joerg (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE); 528 1.2.2.2 joerg 529 1.2.2.2 joerg #ifdef INET 530 1.2.2.2 joerg if (softc->ipf_control_forwarding & 2) 531 1.2.2.2 joerg ipforwarding = 0; 532 1.2.2.2 joerg #endif 533 1.2.2.2 joerg 534 1.2.2.2 joerg #ifdef NETBSD_PF 535 1.2.2.2 joerg # if (__NetBSD_Version__ >= 104200000) 536 1.2.2.2 joerg # if __NetBSD_Version__ >= 105110000 537 1.2.2.2 joerg # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 538 1.2.2.2 joerg (void) pfil_remove_hook((void *)ipf_pfilsync, NULL, 539 1.2.2.2 joerg PFIL_IFNET, ph_ifsync); 540 1.2.2.2 joerg # endif 541 1.2.2.2 joerg 542 1.2.2.2 joerg if (ph_inet != NULL) 543 1.2.2.2 joerg error = pfil_remove_hook((void *)ipf_check_wrapper, NULL, 544 1.2.2.2 joerg PFIL_IN|PFIL_OUT, ph_inet); 545 1.2.2.2 joerg else 546 1.2.2.2 joerg error = 0; 547 1.2.2.2 joerg # else 548 1.2.2.2 joerg error = pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 549 1.2.2.2 joerg &inetsw[ip_protox[IPPROTO_IP]].pr_pfh); 550 1.2.2.2 joerg # endif 551 1.2.2.2 joerg if (error) { 552 1.2.2.2 joerg SPL_X(s); 553 1.2.2.2 joerg IPFERROR(130011); 554 1.2.2.2 joerg return error; 555 1.2.2.2 joerg } 556 1.2.2.2 joerg # else 557 1.2.2.2 joerg pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT); 558 1.2.2.2 joerg # endif 559 1.2.2.2 joerg # ifdef USE_INET6 560 1.2.2.2 joerg # if __NetBSD_Version__ >= 105110000 561 1.2.2.2 joerg if (ph_inet6 != NULL) 562 1.2.2.2 joerg error = pfil_remove_hook((void *)ipf_check_wrapper6, NULL, 563 1.2.2.2 joerg PFIL_IN|PFIL_OUT, ph_inet6); 564 1.2.2.2 joerg else 565 1.2.2.2 joerg error = 0; 566 1.2.2.2 joerg # else 567 1.2.2.2 joerg error = pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 568 1.2.2.2 joerg &inetsw[ip_protox[IPPROTO_IPV6]].pr_pfh); 569 1.2.2.2 joerg # endif 570 1.2.2.2 joerg if (error) { 571 1.2.2.2 joerg SPL_X(s); 572 1.2.2.2 joerg IPFERROR(130012); 573 1.2.2.2 joerg return error; 574 1.2.2.2 joerg } 575 1.2.2.2 joerg # endif 576 1.2.2.2 joerg #endif 577 1.2.2.2 joerg SPL_X(s); 578 1.2.2.2 joerg 579 1.2.2.2 joerg #if (__NetBSD_Version__ >= 499005500) 580 1.2.2.2 joerg for (i = 0; i < IPL_LOGSIZE; i++) 581 1.2.2.2 joerg seldestroy(&ipfmain.ipf_selwait[i]); 582 1.2.2.2 joerg #endif 583 1.2.2.2 joerg 584 1.2.2.2 joerg ipf_fini_all(softc); 585 1.2.2.2 joerg 586 1.2.2.2 joerg return 0; 587 1.2.2.2 joerg } 588 1.2.2.2 joerg 589 1.2.2.2 joerg 590 1.2.2.2 joerg /* 591 1.2.2.2 joerg * Filter ioctl interface. 592 1.2.2.2 joerg */ 593 1.2.2.2 joerg int 594 1.2.2.2 joerg ipfioctl(dev_t dev, u_long cmd, 595 1.2.2.2 joerg #if (__NetBSD_Version__ >= 499001000) 596 1.2.2.2 joerg void *data, 597 1.2.2.2 joerg #else 598 1.2.2.2 joerg caddr_t data, 599 1.2.2.2 joerg #endif 600 1.2.2.2 joerg int mode 601 1.2.2.2 joerg #if (NetBSD >= 199511) 602 1.2.2.2 joerg # if (__NetBSD_Version__ >= 399001400) 603 1.2.2.2 joerg , struct lwp *p 604 1.2.2.2 joerg # if (__NetBSD_Version__ >= 399002000) 605 1.2.2.2 joerg # define UID(l) kauth_cred_getuid((l)->l_cred) 606 1.2.2.2 joerg # else 607 1.2.2.2 joerg # define UID(l) ((l)->l_proc->p_cred->p_ruid) 608 1.2.2.2 joerg # endif 609 1.2.2.2 joerg # else 610 1.2.2.2 joerg , struct proc *p 611 1.2.2.2 joerg # define UID(p) ((p)->p_cred->p_ruid) 612 1.2.2.2 joerg # endif 613 1.2.2.2 joerg #endif 614 1.2.2.2 joerg ) 615 1.2.2.2 joerg { 616 1.2.2.2 joerg int error = 0, unit = 0; 617 1.2.2.2 joerg SPL_INT(s); 618 1.2.2.2 joerg 619 1.2.2.2 joerg #if (__NetBSD_Version__ >= 399002000) 620 1.2.2.2 joerg if ((mode & FWRITE) && 621 1.2.2.2 joerg kauth_authorize_network(p->l_cred, KAUTH_NETWORK_FIREWALL, 622 1.2.2.2 joerg KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, 623 1.2.2.2 joerg NULL, NULL)) { 624 1.2.2.2 joerg ipfmain.ipf_interror = 130005; 625 1.2.2.2 joerg return EPERM; 626 1.2.2.2 joerg } 627 1.2.2.2 joerg #else 628 1.2.2.2 joerg if ((securelevel >= 2) && (mode & FWRITE)) { 629 1.2.2.2 joerg ipfmain.ipf_interror = 130001; 630 1.2.2.2 joerg return EPERM; 631 1.2.2.2 joerg } 632 1.2.2.2 joerg #endif 633 1.2.2.2 joerg 634 1.2.2.2 joerg unit = GET_MINOR(dev); 635 1.2.2.2 joerg if ((IPL_LOGMAX < unit) || (unit < 0)) { 636 1.2.2.2 joerg ipfmain.ipf_interror = 130002; 637 1.2.2.2 joerg return ENXIO; 638 1.2.2.2 joerg } 639 1.2.2.2 joerg 640 1.2.2.2 joerg if (ipfmain.ipf_running <= 0) { 641 1.2.2.2 joerg if (unit != IPL_LOGIPF && cmd != SIOCIPFINTERROR) { 642 1.2.2.2 joerg ipfmain.ipf_interror = 130003; 643 1.2.2.2 joerg return EIO; 644 1.2.2.2 joerg } 645 1.2.2.2 joerg if (cmd != SIOCIPFGETNEXT && cmd != SIOCIPFGET && 646 1.2.2.2 joerg cmd != SIOCIPFSET && cmd != SIOCFRENB && 647 1.2.2.2 joerg cmd != SIOCGETFS && cmd != SIOCGETFF && 648 1.2.2.2 joerg cmd != SIOCIPFINTERROR) { 649 1.2.2.2 joerg ipfmain.ipf_interror = 130004; 650 1.2.2.2 joerg return EIO; 651 1.2.2.2 joerg } 652 1.2.2.2 joerg } 653 1.2.2.2 joerg 654 1.2.2.2 joerg SPL_NET(s); 655 1.2.2.2 joerg 656 1.2.2.2 joerg error = ipf_ioctlswitch(&ipfmain, unit, data, cmd, mode, UID(p), p); 657 1.2.2.2 joerg if (error != -1) { 658 1.2.2.2 joerg SPL_X(s); 659 1.2.2.2 joerg return error; 660 1.2.2.2 joerg } 661 1.2.2.2 joerg 662 1.2.2.2 joerg SPL_X(s); 663 1.2.2.2 joerg return error; 664 1.2.2.2 joerg } 665 1.2.2.2 joerg 666 1.2.2.2 joerg 667 1.2.2.2 joerg /* 668 1.2.2.2 joerg * ipf_send_reset - this could conceivably be a call to tcp_respond(), but that 669 1.2.2.2 joerg * requires a large amount of setting up and isn't any more efficient. 670 1.2.2.2 joerg */ 671 1.2.2.2 joerg int 672 1.2.2.2 joerg ipf_send_reset(fr_info_t *fin) 673 1.2.2.2 joerg { 674 1.2.2.2 joerg struct tcphdr *tcp, *tcp2; 675 1.2.2.2 joerg int tlen = 0, hlen; 676 1.2.2.2 joerg struct mbuf *m; 677 1.2.2.2 joerg #ifdef USE_INET6 678 1.2.2.2 joerg ip6_t *ip6; 679 1.2.2.2 joerg #endif 680 1.2.2.2 joerg ip_t *ip; 681 1.2.2.2 joerg 682 1.2.2.2 joerg tcp = fin->fin_dp; 683 1.2.2.2 joerg if (tcp->th_flags & TH_RST) 684 1.2.2.2 joerg return -1; /* feedback loop */ 685 1.2.2.2 joerg 686 1.2.2.2 joerg if (ipf_checkl4sum(fin) == -1) 687 1.2.2.2 joerg return -1; 688 1.2.2.2 joerg 689 1.2.2.2 joerg tlen = fin->fin_dlen - (TCP_OFF(tcp) << 2) + 690 1.2.2.2 joerg ((tcp->th_flags & TH_SYN) ? 1 : 0) + 691 1.2.2.2 joerg ((tcp->th_flags & TH_FIN) ? 1 : 0); 692 1.2.2.2 joerg 693 1.2.2.2 joerg #ifdef USE_INET6 694 1.2.2.2 joerg hlen = (fin->fin_v == 6) ? sizeof(ip6_t) : sizeof(ip_t); 695 1.2.2.2 joerg #else 696 1.2.2.2 joerg hlen = sizeof(ip_t); 697 1.2.2.2 joerg #endif 698 1.2.2.2 joerg #ifdef MGETHDR 699 1.2.2.2 joerg MGETHDR(m, M_DONTWAIT, MT_HEADER); 700 1.2.2.2 joerg #else 701 1.2.2.2 joerg MGET(m, M_DONTWAIT, MT_HEADER); 702 1.2.2.2 joerg #endif 703 1.2.2.2 joerg if (m == NULL) 704 1.2.2.2 joerg return -1; 705 1.2.2.2 joerg if (sizeof(*tcp2) + hlen > MHLEN) { 706 1.2.2.2 joerg MCLGET(m, M_DONTWAIT); 707 1.2.2.2 joerg if (m == NULL) 708 1.2.2.2 joerg return -1; 709 1.2.2.2 joerg if ((m->m_flags & M_EXT) == 0) { 710 1.2.2.2 joerg FREE_MB_T(m); 711 1.2.2.2 joerg return -1; 712 1.2.2.2 joerg } 713 1.2.2.2 joerg } 714 1.2.2.2 joerg 715 1.2.2.2 joerg m->m_len = sizeof(*tcp2) + hlen; 716 1.2.2.2 joerg m->m_data += max_linkhdr; 717 1.2.2.2 joerg m->m_pkthdr.len = m->m_len; 718 1.2.2.2 joerg m->m_pkthdr.rcvif = (struct ifnet *)0; 719 1.2.2.2 joerg ip = mtod(m, struct ip *); 720 1.2.2.2 joerg bzero((char *)ip, hlen); 721 1.2.2.2 joerg #ifdef USE_INET6 722 1.2.2.2 joerg ip6 = (ip6_t *)ip; 723 1.2.2.2 joerg #endif 724 1.2.2.2 joerg bzero((char *)ip, sizeof(*tcp2) + hlen); 725 1.2.2.2 joerg tcp2 = (struct tcphdr *)((char *)ip + hlen); 726 1.2.2.2 joerg tcp2->th_sport = tcp->th_dport; 727 1.2.2.2 joerg tcp2->th_dport = tcp->th_sport; 728 1.2.2.2 joerg 729 1.2.2.2 joerg if (tcp->th_flags & TH_ACK) { 730 1.2.2.2 joerg tcp2->th_seq = tcp->th_ack; 731 1.2.2.2 joerg tcp2->th_flags = TH_RST; 732 1.2.2.2 joerg tcp2->th_ack = 0; 733 1.2.2.2 joerg } else { 734 1.2.2.2 joerg tcp2->th_seq = 0; 735 1.2.2.2 joerg tcp2->th_ack = ntohl(tcp->th_seq); 736 1.2.2.2 joerg tcp2->th_ack += tlen; 737 1.2.2.2 joerg tcp2->th_ack = htonl(tcp2->th_ack); 738 1.2.2.2 joerg tcp2->th_flags = TH_RST|TH_ACK; 739 1.2.2.2 joerg } 740 1.2.2.2 joerg tcp2->th_x2 = 0; 741 1.2.2.2 joerg TCP_OFF_A(tcp2, sizeof(*tcp2) >> 2); 742 1.2.2.2 joerg tcp2->th_win = tcp->th_win; 743 1.2.2.2 joerg tcp2->th_sum = 0; 744 1.2.2.2 joerg tcp2->th_urp = 0; 745 1.2.2.2 joerg 746 1.2.2.2 joerg #ifdef USE_INET6 747 1.2.2.2 joerg if (fin->fin_v == 6) { 748 1.2.2.2 joerg ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow; 749 1.2.2.2 joerg ip6->ip6_plen = htons(sizeof(struct tcphdr)); 750 1.2.2.2 joerg ip6->ip6_nxt = IPPROTO_TCP; 751 1.2.2.2 joerg ip6->ip6_hlim = 0; 752 1.2.2.2 joerg ip6->ip6_src = fin->fin_dst6.in6; 753 1.2.2.2 joerg ip6->ip6_dst = fin->fin_src6.in6; 754 1.2.2.2 joerg tcp2->th_sum = in6_cksum(m, IPPROTO_TCP, 755 1.2.2.2 joerg sizeof(*ip6), sizeof(*tcp2)); 756 1.2.2.2 joerg return ipf_send_ip(fin, m); 757 1.2.2.2 joerg } 758 1.2.2.2 joerg #endif 759 1.2.2.2 joerg #ifdef INET 760 1.2.2.2 joerg ip->ip_p = IPPROTO_TCP; 761 1.2.2.2 joerg ip->ip_len = htons(sizeof(struct tcphdr)); 762 1.2.2.2 joerg ip->ip_src.s_addr = fin->fin_daddr; 763 1.2.2.2 joerg ip->ip_dst.s_addr = fin->fin_saddr; 764 1.2.2.2 joerg tcp2->th_sum = in_cksum(m, hlen + sizeof(*tcp2)); 765 1.2.2.2 joerg ip->ip_len = hlen + sizeof(*tcp2); 766 1.2.2.2 joerg return ipf_send_ip(fin, m); 767 1.2.2.2 joerg #else 768 1.2.2.2 joerg return 0; 769 1.2.2.2 joerg #endif 770 1.2.2.2 joerg } 771 1.2.2.2 joerg 772 1.2.2.2 joerg 773 1.2.2.2 joerg /* 774 1.2.2.2 joerg * Expects ip_len to be in host byte order when called. 775 1.2.2.2 joerg */ 776 1.2.2.2 joerg static int 777 1.2.2.2 joerg ipf_send_ip(fr_info_t *fin, mb_t *m) 778 1.2.2.2 joerg { 779 1.2.2.2 joerg fr_info_t fnew; 780 1.2.2.2 joerg #ifdef INET 781 1.2.2.2 joerg ip_t *oip; 782 1.2.2.2 joerg #endif 783 1.2.2.2 joerg ip_t *ip; 784 1.2.2.2 joerg int hlen; 785 1.2.2.2 joerg 786 1.2.2.2 joerg ip = mtod(m, ip_t *); 787 1.2.2.2 joerg bzero((char *)&fnew, sizeof(fnew)); 788 1.2.2.2 joerg fnew.fin_main_soft = fin->fin_main_soft; 789 1.2.2.2 joerg 790 1.2.2.2 joerg IP_V_A(ip, fin->fin_v); 791 1.2.2.2 joerg switch (fin->fin_v) 792 1.2.2.2 joerg { 793 1.2.2.2 joerg #ifdef INET 794 1.2.2.2 joerg case 4 : 795 1.2.2.2 joerg oip = fin->fin_ip; 796 1.2.2.2 joerg hlen = sizeof(*oip); 797 1.2.2.2 joerg fnew.fin_v = 4; 798 1.2.2.2 joerg fnew.fin_p = ip->ip_p; 799 1.2.2.2 joerg fnew.fin_plen = ntohs(ip->ip_len); 800 1.2.2.2 joerg HTONS(ip->ip_len); 801 1.2.2.2 joerg IP_HL_A(ip, sizeof(*oip) >> 2); 802 1.2.2.2 joerg ip->ip_tos = oip->ip_tos; 803 1.2.2.2 joerg ip->ip_id = ipf_nextipid(fin); 804 1.2.2.2 joerg ip->ip_off = htons(ip_mtudisc ? IP_DF : 0); 805 1.2.2.2 joerg ip->ip_ttl = ip_defttl; 806 1.2.2.2 joerg ip->ip_sum = 0; 807 1.2.2.2 joerg break; 808 1.2.2.2 joerg #endif 809 1.2.2.2 joerg #ifdef USE_INET6 810 1.2.2.2 joerg case 6 : 811 1.2.2.2 joerg { 812 1.2.2.2 joerg ip6_t *ip6 = (ip6_t *)ip; 813 1.2.2.2 joerg 814 1.2.2.2 joerg ip6->ip6_vfc = 0x60; 815 1.2.2.2 joerg ip6->ip6_hlim = IPDEFTTL; 816 1.2.2.2 joerg 817 1.2.2.2 joerg hlen = sizeof(*ip6); 818 1.2.2.2 joerg fnew.fin_p = ip6->ip6_nxt; 819 1.2.2.2 joerg fnew.fin_v = 6; 820 1.2.2.2 joerg fnew.fin_plen = ntohs(ip6->ip6_plen) + hlen; 821 1.2.2.2 joerg break; 822 1.2.2.2 joerg } 823 1.2.2.2 joerg #endif 824 1.2.2.2 joerg default : 825 1.2.2.2 joerg return EINVAL; 826 1.2.2.2 joerg } 827 1.2.2.2 joerg #ifdef KAME_IPSEC 828 1.2.2.2 joerg m->m_pkthdr.rcvif = NULL; 829 1.2.2.2 joerg #endif 830 1.2.2.2 joerg 831 1.2.2.2 joerg fnew.fin_ifp = fin->fin_ifp; 832 1.2.2.2 joerg fnew.fin_flx = FI_NOCKSUM; 833 1.2.2.2 joerg fnew.fin_m = m; 834 1.2.2.2 joerg fnew.fin_ip = ip; 835 1.2.2.2 joerg fnew.fin_mp = &m; 836 1.2.2.2 joerg fnew.fin_hlen = hlen; 837 1.2.2.2 joerg fnew.fin_dp = (char *)ip + hlen; 838 1.2.2.2 joerg (void) ipf_makefrip(hlen, ip, &fnew); 839 1.2.2.2 joerg 840 1.2.2.2 joerg return ipf_fastroute(m, &m, &fnew, NULL); 841 1.2.2.2 joerg } 842 1.2.2.2 joerg 843 1.2.2.2 joerg 844 1.2.2.2 joerg int 845 1.2.2.2 joerg ipf_send_icmp_err(int type, fr_info_t *fin, int dst) 846 1.2.2.2 joerg { 847 1.2.2.2 joerg int err, hlen, xtra, iclen, ohlen, avail, code; 848 1.2.2.2 joerg struct in_addr dst4; 849 1.2.2.2 joerg struct icmp *icmp; 850 1.2.2.2 joerg struct mbuf *m; 851 1.2.2.2 joerg i6addr_t dst6; 852 1.2.2.2 joerg void *ifp; 853 1.2.2.2 joerg #ifdef USE_INET6 854 1.2.2.2 joerg ip6_t *ip6; 855 1.2.2.2 joerg #endif 856 1.2.2.2 joerg ip_t *ip, *ip2; 857 1.2.2.2 joerg 858 1.2.2.2 joerg if ((type < 0) || (type > ICMP_MAXTYPE)) 859 1.2.2.2 joerg return -1; 860 1.2.2.2 joerg 861 1.2.2.2 joerg code = fin->fin_icode; 862 1.2.2.2 joerg #ifdef USE_INET6 863 1.2.2.2 joerg if ((code < 0) || (code > sizeof(icmptoicmp6unreach)/sizeof(int))) 864 1.2.2.2 joerg return -1; 865 1.2.2.2 joerg #endif 866 1.2.2.2 joerg 867 1.2.2.2 joerg if (ipf_checkl4sum(fin) == -1) 868 1.2.2.2 joerg return -1; 869 1.2.2.2 joerg #ifdef MGETHDR 870 1.2.2.2 joerg MGETHDR(m, M_DONTWAIT, MT_HEADER); 871 1.2.2.2 joerg #else 872 1.2.2.2 joerg MGET(m, M_DONTWAIT, MT_HEADER); 873 1.2.2.2 joerg #endif 874 1.2.2.2 joerg if (m == NULL) 875 1.2.2.2 joerg return -1; 876 1.2.2.2 joerg avail = MHLEN; 877 1.2.2.2 joerg 878 1.2.2.2 joerg xtra = 0; 879 1.2.2.2 joerg hlen = 0; 880 1.2.2.2 joerg ohlen = 0; 881 1.2.2.2 joerg dst4.s_addr = 0; 882 1.2.2.2 joerg ifp = fin->fin_ifp; 883 1.2.2.2 joerg if (fin->fin_v == 4) { 884 1.2.2.2 joerg if ((fin->fin_p == IPPROTO_ICMP) && !(fin->fin_flx & FI_SHORT)) 885 1.2.2.2 joerg switch (ntohs(fin->fin_data[0]) >> 8) 886 1.2.2.2 joerg { 887 1.2.2.2 joerg case ICMP_ECHO : 888 1.2.2.2 joerg case ICMP_TSTAMP : 889 1.2.2.2 joerg case ICMP_IREQ : 890 1.2.2.2 joerg case ICMP_MASKREQ : 891 1.2.2.2 joerg break; 892 1.2.2.2 joerg default : 893 1.2.2.2 joerg FREE_MB_T(m); 894 1.2.2.2 joerg return 0; 895 1.2.2.2 joerg } 896 1.2.2.2 joerg 897 1.2.2.2 joerg if (dst == 0) { 898 1.2.2.2 joerg if (ipf_ifpaddr(&ipfmain, 4, FRI_NORMAL, ifp, 899 1.2.2.2 joerg &dst6, NULL) == -1) { 900 1.2.2.2 joerg FREE_MB_T(m); 901 1.2.2.2 joerg return -1; 902 1.2.2.2 joerg } 903 1.2.2.2 joerg dst4 = dst6.in4; 904 1.2.2.2 joerg } else 905 1.2.2.2 joerg dst4.s_addr = fin->fin_daddr; 906 1.2.2.2 joerg 907 1.2.2.2 joerg hlen = sizeof(ip_t); 908 1.2.2.2 joerg ohlen = fin->fin_hlen; 909 1.2.2.2 joerg iclen = hlen + offsetof(struct icmp, icmp_ip) + ohlen; 910 1.2.2.2 joerg if (fin->fin_hlen < fin->fin_plen) 911 1.2.2.2 joerg xtra = MIN(fin->fin_dlen, 8); 912 1.2.2.2 joerg else 913 1.2.2.2 joerg xtra = 0; 914 1.2.2.2 joerg } 915 1.2.2.2 joerg 916 1.2.2.2 joerg #ifdef USE_INET6 917 1.2.2.2 joerg else if (fin->fin_v == 6) { 918 1.2.2.2 joerg hlen = sizeof(ip6_t); 919 1.2.2.2 joerg ohlen = sizeof(ip6_t); 920 1.2.2.2 joerg iclen = hlen + offsetof(struct icmp, icmp_ip) + ohlen; 921 1.2.2.2 joerg type = icmptoicmp6types[type]; 922 1.2.2.2 joerg if (type == ICMP6_DST_UNREACH) 923 1.2.2.2 joerg code = icmptoicmp6unreach[code]; 924 1.2.2.2 joerg 925 1.2.2.2 joerg if (iclen + max_linkhdr + fin->fin_plen > avail) { 926 1.2.2.2 joerg MCLGET(m, M_DONTWAIT); 927 1.2.2.2 joerg if (m == NULL) 928 1.2.2.2 joerg return -1; 929 1.2.2.2 joerg if ((m->m_flags & M_EXT) == 0) { 930 1.2.2.2 joerg FREE_MB_T(m); 931 1.2.2.2 joerg return -1; 932 1.2.2.2 joerg } 933 1.2.2.2 joerg avail = MCLBYTES; 934 1.2.2.2 joerg } 935 1.2.2.2 joerg xtra = MIN(fin->fin_plen, avail - iclen - max_linkhdr); 936 1.2.2.2 joerg xtra = MIN(xtra, IPV6_MMTU - iclen); 937 1.2.2.2 joerg if (dst == 0) { 938 1.2.2.2 joerg if (ipf_ifpaddr(&ipfmain, 6, FRI_NORMAL, ifp, 939 1.2.2.2 joerg &dst6, NULL) == -1) { 940 1.2.2.2 joerg FREE_MB_T(m); 941 1.2.2.2 joerg return -1; 942 1.2.2.2 joerg } 943 1.2.2.2 joerg } else 944 1.2.2.2 joerg dst6 = fin->fin_dst6; 945 1.2.2.2 joerg } 946 1.2.2.2 joerg #endif 947 1.2.2.2 joerg else { 948 1.2.2.2 joerg FREE_MB_T(m); 949 1.2.2.2 joerg return -1; 950 1.2.2.2 joerg } 951 1.2.2.2 joerg 952 1.2.2.2 joerg avail -= (max_linkhdr + iclen); 953 1.2.2.2 joerg if (avail < 0) { 954 1.2.2.2 joerg FREE_MB_T(m); 955 1.2.2.2 joerg return -1; 956 1.2.2.2 joerg } 957 1.2.2.2 joerg if (xtra > avail) 958 1.2.2.2 joerg xtra = avail; 959 1.2.2.2 joerg iclen += xtra; 960 1.2.2.2 joerg m->m_data += max_linkhdr; 961 1.2.2.2 joerg m->m_pkthdr.rcvif = (struct ifnet *)0; 962 1.2.2.2 joerg m->m_pkthdr.len = iclen; 963 1.2.2.2 joerg m->m_len = iclen; 964 1.2.2.2 joerg ip = mtod(m, ip_t *); 965 1.2.2.2 joerg icmp = (struct icmp *)((char *)ip + hlen); 966 1.2.2.2 joerg ip2 = (ip_t *)&icmp->icmp_ip; 967 1.2.2.2 joerg 968 1.2.2.2 joerg icmp->icmp_type = type; 969 1.2.2.2 joerg icmp->icmp_code = fin->fin_icode; 970 1.2.2.2 joerg icmp->icmp_cksum = 0; 971 1.2.2.2 joerg #ifdef icmp_nextmtu 972 1.2.2.2 joerg if (type == ICMP_UNREACH && fin->fin_icode == ICMP_UNREACH_NEEDFRAG) { 973 1.2.2.2 joerg if (fin->fin_mtu != 0) { 974 1.2.2.2 joerg icmp->icmp_nextmtu = htons(fin->fin_mtu); 975 1.2.2.2 joerg 976 1.2.2.2 joerg } else if (ifp != NULL) { 977 1.2.2.2 joerg icmp->icmp_nextmtu = htons(GETIFMTU_4(ifp)); 978 1.2.2.2 joerg 979 1.2.2.2 joerg } else { /* make up a number... */ 980 1.2.2.2 joerg icmp->icmp_nextmtu = htons(fin->fin_plen - 20); 981 1.2.2.2 joerg } 982 1.2.2.2 joerg } 983 1.2.2.2 joerg #endif 984 1.2.2.2 joerg 985 1.2.2.2 joerg bcopy((char *)fin->fin_ip, (char *)ip2, ohlen); 986 1.2.2.2 joerg 987 1.2.2.2 joerg #if defined(M_CSUM_IPv4) 988 1.2.2.2 joerg /* 989 1.2.2.2 joerg * Clear any in-bound checksum flags for this packet. 990 1.2.2.2 joerg */ 991 1.2.2.2 joerg m->m_pkthdr.csuminfo = 0; 992 1.2.2.2 joerg #endif /* __NetBSD__ && M_CSUM_IPv4 */ 993 1.2.2.2 joerg 994 1.2.2.2 joerg #ifdef USE_INET6 995 1.2.2.2 joerg ip6 = (ip6_t *)ip; 996 1.2.2.2 joerg if (fin->fin_v == 6) { 997 1.2.2.2 joerg ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow; 998 1.2.2.2 joerg ip6->ip6_plen = htons(iclen - hlen); 999 1.2.2.2 joerg ip6->ip6_nxt = IPPROTO_ICMPV6; 1000 1.2.2.2 joerg ip6->ip6_hlim = 0; 1001 1.2.2.2 joerg ip6->ip6_src = dst6.in6; 1002 1.2.2.2 joerg ip6->ip6_dst = fin->fin_src6.in6; 1003 1.2.2.2 joerg if (xtra > 0) 1004 1.2.2.2 joerg bcopy((char *)fin->fin_ip + ohlen, 1005 1.2.2.2 joerg (char *)&icmp->icmp_ip + ohlen, xtra); 1006 1.2.2.2 joerg icmp->icmp_cksum = in6_cksum(m, IPPROTO_ICMPV6, 1007 1.2.2.2 joerg sizeof(*ip6), iclen - hlen); 1008 1.2.2.2 joerg } else 1009 1.2.2.2 joerg #endif 1010 1.2.2.2 joerg { 1011 1.2.2.2 joerg ip->ip_p = IPPROTO_ICMP; 1012 1.2.2.2 joerg ip->ip_src.s_addr = dst4.s_addr; 1013 1.2.2.2 joerg ip->ip_dst.s_addr = fin->fin_saddr; 1014 1.2.2.2 joerg 1015 1.2.2.2 joerg if (xtra > 0) 1016 1.2.2.2 joerg bcopy((char *)fin->fin_ip + ohlen, 1017 1.2.2.2 joerg (char *)&icmp->icmp_ip + ohlen, xtra); 1018 1.2.2.2 joerg icmp->icmp_cksum = ipf_cksum((u_short *)icmp, 1019 1.2.2.2 joerg sizeof(*icmp) + 8); 1020 1.2.2.2 joerg ip->ip_len = iclen; 1021 1.2.2.2 joerg ip->ip_p = IPPROTO_ICMP; 1022 1.2.2.2 joerg } 1023 1.2.2.2 joerg err = ipf_send_ip(fin, m); 1024 1.2.2.2 joerg return err; 1025 1.2.2.2 joerg } 1026 1.2.2.2 joerg 1027 1.2.2.2 joerg 1028 1.2.2.2 joerg /* 1029 1.2.2.2 joerg * m0 - pointer to mbuf where the IP packet starts 1030 1.2.2.2 joerg * mpp - pointer to the mbuf pointer that is the start of the mbuf chain 1031 1.2.2.2 joerg */ 1032 1.2.2.2 joerg int 1033 1.2.2.2 joerg ipf_fastroute(mb_t *m0, mb_t **mpp, fr_info_t *fin, frdest_t *fdp) 1034 1.2.2.2 joerg { 1035 1.2.2.2 joerg register struct ip *ip, *mhip; 1036 1.2.2.2 joerg register struct mbuf *m = *mpp; 1037 1.2.2.2 joerg register struct route *ro; 1038 1.2.2.2 joerg int len, off, error = 0, hlen, code; 1039 1.2.2.2 joerg struct ifnet *ifp, *sifp; 1040 1.2.2.2 joerg ipf_main_softc_t *softc; 1041 1.2.2.2 joerg #if __NetBSD_Version__ >= 499001100 1042 1.2.2.2 joerg union { 1043 1.2.2.2 joerg struct sockaddr dst; 1044 1.2.2.2 joerg struct sockaddr_in dst4; 1045 1.2.2.2 joerg } u; 1046 1.2.2.2 joerg #else 1047 1.2.2.2 joerg struct sockaddr_in *dst4; 1048 1.2.2.2 joerg #endif 1049 1.2.2.2 joerg struct sockaddr *dst; 1050 1.2.2.2 joerg u_short ip_off, ip_len; 1051 1.2.2.2 joerg struct route iproute; 1052 1.2.2.2 joerg struct rtentry *rt; 1053 1.2.2.2 joerg frdest_t node; 1054 1.2.2.2 joerg frentry_t *fr; 1055 1.2.2.2 joerg 1056 1.2.2.2 joerg if (fin->fin_v == 6) { 1057 1.2.2.2 joerg #ifdef USE_INET6 1058 1.2.2.2 joerg error = ipf_fastroute6(m0, mpp, fin, fdp); 1059 1.2.2.2 joerg #else 1060 1.2.2.2 joerg error = EPROTONOSUPPORT; 1061 1.2.2.2 joerg #endif 1062 1.2.2.2 joerg if ((error != 0) && (*mpp != NULL)) 1063 1.2.2.2 joerg FREE_MB_T(*mpp); 1064 1.2.2.2 joerg return error; 1065 1.2.2.2 joerg } 1066 1.2.2.2 joerg #ifndef INET 1067 1.2.2.2 joerg FREE_MB_T(*mpp); 1068 1.2.2.2 joerg return EPROTONOSUPPORT; 1069 1.2.2.2 joerg #else 1070 1.2.2.2 joerg 1071 1.2.2.2 joerg hlen = fin->fin_hlen; 1072 1.2.2.2 joerg ip = mtod(m0, struct ip *); 1073 1.2.2.2 joerg softc = fin->fin_main_soft; 1074 1.2.2.2 joerg rt = NULL; 1075 1.2.2.2 joerg ifp = NULL; 1076 1.2.2.2 joerg 1077 1.2.2.2 joerg # if defined(M_CSUM_IPv4) 1078 1.2.2.2 joerg /* 1079 1.2.2.2 joerg * Clear any in-bound checksum flags for this packet. 1080 1.2.2.2 joerg */ 1081 1.2.2.2 joerg m0->m_pkthdr.csuminfo = 0; 1082 1.2.2.2 joerg # endif /* __NetBSD__ && M_CSUM_IPv4 */ 1083 1.2.2.2 joerg 1084 1.2.2.2 joerg /* 1085 1.2.2.2 joerg * Route packet. 1086 1.2.2.2 joerg */ 1087 1.2.2.2 joerg ro = &iproute; 1088 1.2.2.2 joerg memset(ro, 0, sizeof(*ro)); 1089 1.2.2.2 joerg fr = fin->fin_fr; 1090 1.2.2.2 joerg 1091 1.2.2.2 joerg if ((fr != NULL) && !(fr->fr_flags & FR_KEEPSTATE) && (fdp != NULL) && 1092 1.2.2.2 joerg (fdp->fd_type == FRD_DSTLIST)) { 1093 1.2.2.2 joerg if (ipf_dstlist_select_node(fin, fdp->fd_ptr, NULL, &node) == 0) 1094 1.2.2.2 joerg fdp = &node; 1095 1.2.2.2 joerg } 1096 1.2.2.2 joerg if (fdp != NULL) 1097 1.2.2.2 joerg ifp = fdp->fd_ptr; 1098 1.2.2.2 joerg else 1099 1.2.2.2 joerg ifp = fin->fin_ifp; 1100 1.2.2.2 joerg 1101 1.2.2.2 joerg if ((ifp == NULL) && ((fr == NULL) || !(fr->fr_flags & FR_FASTROUTE))) { 1102 1.2.2.2 joerg error = -2; 1103 1.2.2.2 joerg goto bad; 1104 1.2.2.2 joerg } 1105 1.2.2.2 joerg 1106 1.2.2.2 joerg # if __NetBSD_Version__ >= 499001100 1107 1.2.2.2 joerg if ((fdp != NULL) && (fdp->fd_ip.s_addr != 0)) 1108 1.2.2.2 joerg sockaddr_in_init(&u.dst4, &fdp->fd_ip, 0); 1109 1.2.2.2 joerg else 1110 1.2.2.2 joerg sockaddr_in_init(&u.dst4, &ip->ip_dst, 0); 1111 1.2.2.2 joerg dst = &u.dst; 1112 1.2.2.2 joerg rtcache_setdst(ro, dst); 1113 1.2.2.2 joerg rt = rtcache_init(ro); 1114 1.2.2.2 joerg # else 1115 1.2.2.2 joerg dst4 = (struct sockaddr_in *)&ro->ro_dst; 1116 1.2.2.2 joerg dst = (struct sockaddr *)dst4; 1117 1.2.2.2 joerg dst4->sin_family = AF_INET; 1118 1.2.2.2 joerg dst4->sin_addr = ip->ip_dst; 1119 1.2.2.2 joerg 1120 1.2.2.2 joerg if ((fdp != NULL) && (fdp->fd_ip.s_addr != 0)) 1121 1.2.2.2 joerg dst4->sin_addr = fdp->fd_ip; 1122 1.2.2.2 joerg 1123 1.2.2.2 joerg dst4->sin_len = sizeof(*dst); 1124 1.2.2.2 joerg rtalloc(ro); 1125 1.2.2.2 joerg rt = ro->ro_rt; 1126 1.2.2.2 joerg # endif 1127 1.2.2.2 joerg if ((ifp == NULL) && (rt != NULL)) 1128 1.2.2.2 joerg ifp = rt->rt_ifp; 1129 1.2.2.2 joerg if ((rt == NULL) || (ifp == NULL)) { 1130 1.2.2.2 joerg #ifdef INET 1131 1.2.2.2 joerg if (in_localaddr(ip->ip_dst)) 1132 1.2.2.2 joerg error = EHOSTUNREACH; 1133 1.2.2.2 joerg else 1134 1.2.2.2 joerg #endif 1135 1.2.2.2 joerg error = ENETUNREACH; 1136 1.2.2.2 joerg goto bad; 1137 1.2.2.2 joerg } 1138 1.2.2.2 joerg 1139 1.2.2.2 joerg 1140 1.2.2.2 joerg if (rt->rt_flags & RTF_GATEWAY) 1141 1.2.2.2 joerg dst = rt->rt_gateway; 1142 1.2.2.2 joerg 1143 1.2.2.2 joerg rt->rt_use++; 1144 1.2.2.2 joerg 1145 1.2.2.2 joerg /* 1146 1.2.2.2 joerg * For input packets which are being "fastrouted", they won't 1147 1.2.2.2 joerg * go back through output filtering and miss their chance to get 1148 1.2.2.2 joerg * NAT'd and counted. Duplicated packets aren't considered to be 1149 1.2.2.2 joerg * part of the normal packet stream, so do not NAT them or pass 1150 1.2.2.2 joerg * them through stateful checking, etc. 1151 1.2.2.2 joerg */ 1152 1.2.2.2 joerg if ((fdp != &fr->fr_dif) && (fin->fin_out == 0)) { 1153 1.2.2.2 joerg sifp = fin->fin_ifp; 1154 1.2.2.2 joerg fin->fin_ifp = ifp; 1155 1.2.2.2 joerg fin->fin_out = 1; 1156 1.2.2.2 joerg (void) ipf_acctpkt(fin, NULL); 1157 1.2.2.2 joerg fin->fin_fr = NULL; 1158 1.2.2.2 joerg if (!fr || !(fr->fr_flags & FR_RETMASK)) { 1159 1.2.2.2 joerg u_32_t pass; 1160 1.2.2.2 joerg 1161 1.2.2.2 joerg (void) ipf_state_check(fin, &pass); 1162 1.2.2.2 joerg } 1163 1.2.2.2 joerg 1164 1.2.2.2 joerg switch (ipf_nat_checkout(fin, NULL)) 1165 1.2.2.2 joerg { 1166 1.2.2.2 joerg case 0 : 1167 1.2.2.2 joerg break; 1168 1.2.2.2 joerg case 1 : 1169 1.2.2.2 joerg ip->ip_sum = 0; 1170 1.2.2.2 joerg break; 1171 1.2.2.2 joerg case -1 : 1172 1.2.2.2 joerg error = -1; 1173 1.2.2.2 joerg goto bad; 1174 1.2.2.2 joerg break; 1175 1.2.2.2 joerg } 1176 1.2.2.2 joerg 1177 1.2.2.2 joerg fin->fin_ifp = sifp; 1178 1.2.2.2 joerg fin->fin_out = 0; 1179 1.2.2.2 joerg } else 1180 1.2.2.2 joerg ip->ip_sum = 0; 1181 1.2.2.2 joerg /* 1182 1.2.2.2 joerg * If small enough for interface, can just send directly. 1183 1.2.2.2 joerg */ 1184 1.2.2.2 joerg m->m_pkthdr.rcvif = ifp; 1185 1.2.2.2 joerg 1186 1.2.2.2 joerg ip_len = ntohs(ip->ip_len); 1187 1.2.2.2 joerg if (ip_len <= ifp->if_mtu) { 1188 1.2.2.2 joerg # if defined(M_CSUM_IPv4) 1189 1.2.2.2 joerg # if (__NetBSD_Version__ >= 105009999) 1190 1.2.2.2 joerg if (ifp->if_csum_flags_tx & M_CSUM_IPv4) 1191 1.2.2.2 joerg m->m_pkthdr.csuminfo |= M_CSUM_IPv4; 1192 1.2.2.2 joerg # else 1193 1.2.2.2 joerg if (ifp->if_capabilities & IFCAP_CSUM_IPv4) 1194 1.2.2.2 joerg m->m_pkthdr.csuminfo |= M_CSUM_IPv4; 1195 1.2.2.2 joerg # endif /* (__NetBSD_Version__ >= 105009999) */ 1196 1.2.2.2 joerg else if (ip->ip_sum == 0) 1197 1.2.2.2 joerg ip->ip_sum = in_cksum(m, hlen); 1198 1.2.2.2 joerg # else 1199 1.2.2.2 joerg if (!ip->ip_sum) 1200 1.2.2.2 joerg ip->ip_sum = in_cksum(m, hlen); 1201 1.2.2.2 joerg # endif /* M_CSUM_IPv4 */ 1202 1.2.2.2 joerg 1203 1.2.2.2 joerg error = (*ifp->if_output)(ifp, m, dst, rt); 1204 1.2.2.2 joerg goto done; 1205 1.2.2.2 joerg } 1206 1.2.2.2 joerg 1207 1.2.2.2 joerg /* 1208 1.2.2.2 joerg * Too large for interface; fragment if possible. 1209 1.2.2.2 joerg * Must be able to put at least 8 bytes per fragment. 1210 1.2.2.2 joerg */ 1211 1.2.2.2 joerg ip_off = ntohs(ip->ip_off); 1212 1.2.2.2 joerg if (ip_off & IP_DF) { 1213 1.2.2.2 joerg error = EMSGSIZE; 1214 1.2.2.2 joerg goto bad; 1215 1.2.2.2 joerg } 1216 1.2.2.2 joerg len = (ifp->if_mtu - hlen) &~ 7; 1217 1.2.2.2 joerg if (len < 8) { 1218 1.2.2.2 joerg error = EMSGSIZE; 1219 1.2.2.2 joerg goto bad; 1220 1.2.2.2 joerg } 1221 1.2.2.2 joerg 1222 1.2.2.2 joerg { 1223 1.2.2.2 joerg int mhlen, firstlen = len; 1224 1.2.2.2 joerg struct mbuf **mnext = &m->m_act; 1225 1.2.2.2 joerg 1226 1.2.2.2 joerg /* 1227 1.2.2.2 joerg * Loop through length of segment after first fragment, 1228 1.2.2.2 joerg * make new header and copy data of each part and link onto chain. 1229 1.2.2.2 joerg */ 1230 1.2.2.2 joerg m0 = m; 1231 1.2.2.2 joerg mhlen = sizeof (struct ip); 1232 1.2.2.2 joerg for (off = hlen + len; off < ip_len; off += len) { 1233 1.2.2.2 joerg # ifdef MGETHDR 1234 1.2.2.2 joerg MGETHDR(m, M_DONTWAIT, MT_HEADER); 1235 1.2.2.2 joerg # else 1236 1.2.2.2 joerg MGET(m, M_DONTWAIT, MT_HEADER); 1237 1.2.2.2 joerg # endif 1238 1.2.2.2 joerg if (m == 0) { 1239 1.2.2.2 joerg m = m0; 1240 1.2.2.2 joerg error = ENOBUFS; 1241 1.2.2.2 joerg goto bad; 1242 1.2.2.2 joerg } 1243 1.2.2.2 joerg m->m_data += max_linkhdr; 1244 1.2.2.2 joerg mhip = mtod(m, struct ip *); 1245 1.2.2.2 joerg bcopy((char *)ip, (char *)mhip, sizeof(*ip)); 1246 1.2.2.2 joerg #ifdef INET 1247 1.2.2.2 joerg if (hlen > sizeof (struct ip)) { 1248 1.2.2.2 joerg mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip); 1249 1.2.2.2 joerg IP_HL_A(mhip, mhlen >> 2); 1250 1.2.2.2 joerg } 1251 1.2.2.2 joerg #endif 1252 1.2.2.2 joerg m->m_len = mhlen; 1253 1.2.2.2 joerg mhip->ip_off = ((off - hlen) >> 3) + ip_off; 1254 1.2.2.2 joerg if (off + len >= ip_len) 1255 1.2.2.2 joerg len = ip_len - off; 1256 1.2.2.2 joerg else 1257 1.2.2.2 joerg mhip->ip_off |= IP_MF; 1258 1.2.2.2 joerg mhip->ip_len = htons((u_short)(len + mhlen)); 1259 1.2.2.2 joerg m->m_next = m_copy(m0, off, len); 1260 1.2.2.2 joerg if (m->m_next == 0) { 1261 1.2.2.2 joerg error = ENOBUFS; /* ??? */ 1262 1.2.2.2 joerg goto sendorfree; 1263 1.2.2.2 joerg } 1264 1.2.2.2 joerg m->m_pkthdr.len = mhlen + len; 1265 1.2.2.2 joerg m->m_pkthdr.rcvif = NULL; 1266 1.2.2.2 joerg mhip->ip_off = htons((u_short)mhip->ip_off); 1267 1.2.2.2 joerg mhip->ip_sum = 0; 1268 1.2.2.2 joerg #ifdef INET 1269 1.2.2.2 joerg mhip->ip_sum = in_cksum(m, mhlen); 1270 1.2.2.2 joerg #endif 1271 1.2.2.2 joerg *mnext = m; 1272 1.2.2.2 joerg mnext = &m->m_act; 1273 1.2.2.2 joerg } 1274 1.2.2.2 joerg /* 1275 1.2.2.2 joerg * Update first fragment by trimming what's been copied out 1276 1.2.2.2 joerg * and updating header, then send each fragment (in order). 1277 1.2.2.2 joerg */ 1278 1.2.2.2 joerg m_adj(m0, hlen + firstlen - ip_len); 1279 1.2.2.2 joerg ip->ip_len = htons((u_short)(hlen + firstlen)); 1280 1.2.2.2 joerg ip->ip_off = htons((u_short)IP_MF); 1281 1.2.2.2 joerg ip->ip_sum = 0; 1282 1.2.2.2 joerg #ifdef INET 1283 1.2.2.2 joerg ip->ip_sum = in_cksum(m0, hlen); 1284 1.2.2.2 joerg #endif 1285 1.2.2.2 joerg sendorfree: 1286 1.2.2.2 joerg for (m = m0; m; m = m0) { 1287 1.2.2.2 joerg m0 = m->m_act; 1288 1.2.2.2 joerg m->m_act = 0; 1289 1.2.2.2 joerg if (error == 0) { 1290 1.2.2.2 joerg error = (*ifp->if_output)(ifp, m, dst, rt); 1291 1.2.2.2 joerg } else { 1292 1.2.2.2 joerg FREE_MB_T(m); 1293 1.2.2.2 joerg } 1294 1.2.2.2 joerg } 1295 1.2.2.2 joerg } 1296 1.2.2.2 joerg done: 1297 1.2.2.2 joerg if (!error) 1298 1.2.2.2 joerg softc->ipf_frouteok[0]++; 1299 1.2.2.2 joerg else 1300 1.2.2.2 joerg softc->ipf_frouteok[1]++; 1301 1.2.2.2 joerg 1302 1.2.2.2 joerg # if __NetBSD_Version__ >= 499001100 1303 1.2.2.2 joerg rtcache_free(ro); 1304 1.2.2.2 joerg # else 1305 1.2.2.2 joerg if (rt) { 1306 1.2.2.2 joerg RTFREE(rt); 1307 1.2.2.2 joerg } 1308 1.2.2.2 joerg # endif 1309 1.2.2.2 joerg return error; 1310 1.2.2.2 joerg bad: 1311 1.2.2.2 joerg if (error == EMSGSIZE) { 1312 1.2.2.2 joerg sifp = fin->fin_ifp; 1313 1.2.2.2 joerg code = fin->fin_icode; 1314 1.2.2.2 joerg fin->fin_icode = ICMP_UNREACH_NEEDFRAG; 1315 1.2.2.2 joerg fin->fin_ifp = ifp; 1316 1.2.2.2 joerg (void) ipf_send_icmp_err(ICMP_UNREACH, fin, 1); 1317 1.2.2.2 joerg fin->fin_ifp = sifp; 1318 1.2.2.2 joerg fin->fin_icode = code; 1319 1.2.2.2 joerg } 1320 1.2.2.2 joerg FREE_MB_T(m); 1321 1.2.2.2 joerg goto done; 1322 1.2.2.2 joerg #endif /* INET */ 1323 1.2.2.2 joerg } 1324 1.2.2.2 joerg 1325 1.2.2.2 joerg 1326 1.2.2.2 joerg #if defined(USE_INET6) 1327 1.2.2.2 joerg /* 1328 1.2.2.2 joerg * This is the IPv6 specific fastroute code. It doesn't clean up the mbuf's 1329 1.2.2.2 joerg * or ensure that it is an IPv6 packet that is being forwarded, those are 1330 1.2.2.2 joerg * expected to be done by the called (ipf_fastroute). 1331 1.2.2.2 joerg */ 1332 1.2.2.2 joerg static int 1333 1.2.2.2 joerg ipf_fastroute6(struct mbuf *m0, struct mbuf **mpp, fr_info_t *fin, 1334 1.2.2.2 joerg frdest_t *fdp) 1335 1.2.2.2 joerg { 1336 1.2.2.2 joerg # if __NetBSD_Version__ >= 499001100 1337 1.2.2.2 joerg struct route ip6route; 1338 1.2.2.2 joerg const struct sockaddr *dst; 1339 1.2.2.2 joerg union { 1340 1.2.2.2 joerg struct sockaddr dst; 1341 1.2.2.2 joerg struct sockaddr_in6 dst6; 1342 1.2.2.2 joerg } u; 1343 1.2.2.2 joerg struct route *ro; 1344 1.2.2.2 joerg # else 1345 1.2.2.2 joerg struct route_in6 ip6route; 1346 1.2.2.2 joerg struct sockaddr_in6 *dst6; 1347 1.2.2.2 joerg struct route_in6 *ro; 1348 1.2.2.2 joerg # endif 1349 1.2.2.2 joerg struct rtentry *rt; 1350 1.2.2.2 joerg struct ifnet *ifp; 1351 1.2.2.2 joerg frentry_t *fr; 1352 1.2.2.2 joerg u_long mtu; 1353 1.2.2.2 joerg int error; 1354 1.2.2.2 joerg 1355 1.2.2.2 joerg error = 0; 1356 1.2.2.2 joerg ro = &ip6route; 1357 1.2.2.2 joerg fr = fin->fin_fr; 1358 1.2.2.2 joerg 1359 1.2.2.2 joerg if (fdp != NULL) 1360 1.2.2.2 joerg ifp = fdp->fd_ptr; 1361 1.2.2.2 joerg else 1362 1.2.2.2 joerg ifp = fin->fin_ifp; 1363 1.2.2.2 joerg memset(ro, 0, sizeof(*ro)); 1364 1.2.2.2 joerg # if __NetBSD_Version__ >= 499001100 1365 1.2.2.2 joerg if (fdp != NULL && IP6_NOTZERO(&fdp->fd_ip6)) 1366 1.2.2.2 joerg sockaddr_in6_init(&u.dst6, &fdp->fd_ip6.in6, 0, 0, 0); 1367 1.2.2.2 joerg else 1368 1.2.2.2 joerg sockaddr_in6_init(&u.dst6, &fin->fin_fi.fi_dst.in6, 0, 0, 0); 1369 1.2.2.2 joerg dst = &u.dst; 1370 1.2.2.2 joerg rtcache_setdst(ro, dst); 1371 1.2.2.2 joerg 1372 1.2.2.2 joerg rt = rtcache_init(ro); 1373 1.2.2.2 joerg if ((ifp == NULL) && (rt != NULL)) 1374 1.2.2.2 joerg ifp = rt->rt_ifp; 1375 1.2.2.2 joerg # else 1376 1.2.2.2 joerg dst6 = (struct sockaddr_in6 *)&ro->ro_dst; 1377 1.2.2.2 joerg dst6->sin6_family = AF_INET6; 1378 1.2.2.2 joerg dst6->sin6_len = sizeof(struct sockaddr_in6); 1379 1.2.2.2 joerg dst6->sin6_addr = fin->fin_fi.fi_dst.in6; 1380 1.2.2.2 joerg 1381 1.2.2.2 joerg if (fdp != NULL) { 1382 1.2.2.2 joerg if (IP6_NOTZERO(&fdp->fd_ip6)) 1383 1.2.2.2 joerg dst6->sin6_addr = fdp->fd_ip6.in6; 1384 1.2.2.2 joerg } 1385 1.2.2.2 joerg 1386 1.2.2.2 joerg rtalloc((struct route *)ro); 1387 1.2.2.2 joerg 1388 1.2.2.2 joerg if ((ifp == NULL) && (ro->ro_rt != NULL)) 1389 1.2.2.2 joerg ifp = ro->ro_rt->rt_ifp; 1390 1.2.2.2 joerg rt = ro->ro_rt; 1391 1.2.2.2 joerg # endif 1392 1.2.2.2 joerg if ((rt == NULL) || (ifp == NULL)) { 1393 1.2.2.2 joerg 1394 1.2.2.2 joerg error = EHOSTUNREACH; 1395 1.2.2.2 joerg goto bad; 1396 1.2.2.2 joerg } 1397 1.2.2.2 joerg 1398 1.2.2.2 joerg /* KAME */ 1399 1.2.2.2 joerg # if __NetBSD_Version__ >= 499001100 1400 1.2.2.2 joerg if (IN6_IS_ADDR_LINKLOCAL(&u.dst6.sin6_addr)) 1401 1.2.2.2 joerg u.dst6.sin6_addr.s6_addr16[1] = htons(ifp->if_index); 1402 1.2.2.2 joerg # else 1403 1.2.2.2 joerg if (IN6_IS_ADDR_LINKLOCAL(&dst6->sin6_addr)) 1404 1.2.2.2 joerg dst6->sin6_addr.s6_addr16[1] = htons(ifp->if_index); 1405 1.2.2.2 joerg # endif 1406 1.2.2.2 joerg 1407 1.2.2.2 joerg { 1408 1.2.2.2 joerg # if (__NetBSD_Version__ >= 106010000) 1409 1.2.2.2 joerg struct in6_ifextra *ife; 1410 1.2.2.2 joerg # endif 1411 1.2.2.2 joerg if (rt->rt_flags & RTF_GATEWAY) 1412 1.2.2.2 joerg # if __NetBSD_Version__ >= 499001100 1413 1.2.2.2 joerg dst = rt->rt_gateway; 1414 1.2.2.2 joerg # else 1415 1.2.2.2 joerg dst6 = (struct sockaddr_in6 *)rt->rt_gateway; 1416 1.2.2.2 joerg # endif 1417 1.2.2.2 joerg rt->rt_use++; 1418 1.2.2.2 joerg 1419 1.2.2.2 joerg /* Determine path MTU. */ 1420 1.2.2.2 joerg # if (__NetBSD_Version__ <= 106009999) 1421 1.2.2.2 joerg mtu = nd_ifinfo[ifp->if_index].linkmtu; 1422 1.2.2.2 joerg # else 1423 1.2.2.2 joerg ife = (struct in6_ifextra *)(ifp)->if_afdata[AF_INET6]; 1424 1.2.2.2 joerg # ifdef IN6_LINKMTU 1425 1.2.2.2 joerg mtu = IN6_LINKMTU(ifp); 1426 1.2.2.2 joerg # else 1427 1.2.2.2 joerg mtu = ife->nd_ifinfo[ifp->if_index].linkmtu; 1428 1.2.2.2 joerg # endif 1429 1.2.2.2 joerg # endif 1430 1.2.2.2 joerg if ((error == 0) && (m0->m_pkthdr.len <= mtu)) { 1431 1.2.2.2 joerg # if __NetBSD_Version__ >= 499001100 1432 1.2.2.2 joerg error = nd6_output(ifp, ifp, m0, satocsin6(dst), rt); 1433 1.2.2.2 joerg # else 1434 1.2.2.2 joerg error = nd6_output(ifp, ifp, m0, dst6, rt); 1435 1.2.2.2 joerg # endif 1436 1.2.2.2 joerg } else { 1437 1.2.2.2 joerg error = EMSGSIZE; 1438 1.2.2.2 joerg } 1439 1.2.2.2 joerg } 1440 1.2.2.2 joerg bad: 1441 1.2.2.2 joerg # if __NetBSD_Version__ >= 499001100 1442 1.2.2.2 joerg rtcache_free(ro); 1443 1.2.2.2 joerg # else 1444 1.2.2.2 joerg if (ro->ro_rt != NULL) { 1445 1.2.2.2 joerg RTFREE(((struct route *)ro)->ro_rt); 1446 1.2.2.2 joerg } 1447 1.2.2.2 joerg # endif 1448 1.2.2.2 joerg return error; 1449 1.2.2.2 joerg } 1450 1.2.2.2 joerg #endif /* INET6 */ 1451 1.2.2.2 joerg 1452 1.2.2.2 joerg 1453 1.2.2.2 joerg int 1454 1.2.2.2 joerg ipf_verifysrc(fr_info_t *fin) 1455 1.2.2.2 joerg { 1456 1.2.2.2 joerg #if __NetBSD_Version__ >= 499001100 1457 1.2.2.2 joerg union { 1458 1.2.2.2 joerg struct sockaddr dst; 1459 1.2.2.2 joerg struct sockaddr_in dst4; 1460 1.2.2.2 joerg } u; 1461 1.2.2.2 joerg struct rtentry *rt; 1462 1.2.2.2 joerg #else 1463 1.2.2.2 joerg struct sockaddr_in *dst; 1464 1.2.2.2 joerg #endif 1465 1.2.2.2 joerg struct route iproute; 1466 1.2.2.2 joerg int rc; 1467 1.2.2.2 joerg 1468 1.2.2.2 joerg #if __NetBSD_Version__ >= 499001100 1469 1.2.2.2 joerg sockaddr_in_init(&u.dst4, &fin->fin_src, 0); 1470 1.2.2.2 joerg rtcache_setdst(&iproute, &u.dst); 1471 1.2.2.2 joerg rt = rtcache_init(&iproute); 1472 1.2.2.2 joerg if (rt == NULL) 1473 1.2.2.2 joerg rc = 0; 1474 1.2.2.2 joerg else 1475 1.2.2.2 joerg rc = (fin->fin_ifp == rt->rt_ifp); 1476 1.2.2.2 joerg rtcache_free(&iproute); 1477 1.2.2.2 joerg #else 1478 1.2.2.2 joerg dst = (struct sockaddr_in *)&iproute.ro_dst; 1479 1.2.2.2 joerg dst->sin_len = sizeof(*dst); 1480 1.2.2.2 joerg dst->sin_family = AF_INET; 1481 1.2.2.2 joerg dst->sin_addr = fin->fin_src; 1482 1.2.2.2 joerg rtalloc(&iproute); 1483 1.2.2.2 joerg if (iproute.ro_rt == NULL) 1484 1.2.2.2 joerg return 0; 1485 1.2.2.2 joerg rc = (fin->fin_ifp == iproute.ro_rt->rt_ifp); 1486 1.2.2.2 joerg RTFREE(iproute.ro_rt); 1487 1.2.2.2 joerg #endif 1488 1.2.2.2 joerg return rc; 1489 1.2.2.2 joerg } 1490 1.2.2.2 joerg 1491 1.2.2.2 joerg 1492 1.2.2.2 joerg /* 1493 1.2.2.2 joerg * return the first IP Address associated with an interface 1494 1.2.2.2 joerg */ 1495 1.2.2.2 joerg int 1496 1.2.2.2 joerg ipf_ifpaddr(ipf_main_softc_t *softc, int v, int atype, void *ifptr, 1497 1.2.2.2 joerg i6addr_t *inp, i6addr_t *inpmask) 1498 1.2.2.2 joerg { 1499 1.2.2.2 joerg #ifdef USE_INET6 1500 1.2.2.2 joerg struct in6_addr *inp6 = NULL; 1501 1.2.2.2 joerg #endif 1502 1.2.2.2 joerg struct sockaddr *sock, *mask; 1503 1.2.2.2 joerg struct sockaddr_in *sin; 1504 1.2.2.2 joerg struct ifaddr *ifa; 1505 1.2.2.2 joerg struct ifnet *ifp; 1506 1.2.2.2 joerg 1507 1.2.2.2 joerg if ((ifptr == NULL) || (ifptr == (void *)-1)) 1508 1.2.2.2 joerg return -1; 1509 1.2.2.2 joerg 1510 1.2.2.2 joerg ifp = ifptr; 1511 1.2.2.2 joerg mask = NULL; 1512 1.2.2.2 joerg 1513 1.2.2.2 joerg if (v == 4) 1514 1.2.2.2 joerg inp->in4.s_addr = 0; 1515 1.2.2.2 joerg #ifdef USE_INET6 1516 1.2.2.2 joerg else if (v == 6) 1517 1.2.2.2 joerg bzero((char *)inp, sizeof(*inp)); 1518 1.2.2.2 joerg #endif 1519 1.2.2.2 joerg 1520 1.2.2.2 joerg ifa = IFADDR_FIRST(ifp); 1521 1.2.2.2 joerg sock = ifa ? ifa->ifa_addr : NULL; 1522 1.2.2.2 joerg while (sock != NULL && ifa != NULL) { 1523 1.2.2.2 joerg sin = (struct sockaddr_in *)sock; 1524 1.2.2.2 joerg if ((v == 4) && (sin->sin_family == AF_INET)) 1525 1.2.2.2 joerg break; 1526 1.2.2.2 joerg #ifdef USE_INET6 1527 1.2.2.2 joerg if ((v == 6) && (sin->sin_family == AF_INET6)) { 1528 1.2.2.2 joerg inp6 = &((struct sockaddr_in6 *)sin)->sin6_addr; 1529 1.2.2.2 joerg if (!IN6_IS_ADDR_LINKLOCAL(inp6) && 1530 1.2.2.2 joerg !IN6_IS_ADDR_LOOPBACK(inp6)) 1531 1.2.2.2 joerg break; 1532 1.2.2.2 joerg } 1533 1.2.2.2 joerg #endif 1534 1.2.2.2 joerg ifa = IFADDR_NEXT(ifa); 1535 1.2.2.2 joerg if (ifa != NULL) 1536 1.2.2.2 joerg sock = ifa->ifa_addr; 1537 1.2.2.2 joerg } 1538 1.2.2.2 joerg if (ifa == NULL || sock == NULL) 1539 1.2.2.2 joerg return -1; 1540 1.2.2.2 joerg 1541 1.2.2.2 joerg mask = ifa->ifa_netmask; 1542 1.2.2.2 joerg if (atype == FRI_BROADCAST) 1543 1.2.2.2 joerg sock = ifa->ifa_broadaddr; 1544 1.2.2.2 joerg else if (atype == FRI_PEERADDR) 1545 1.2.2.2 joerg sock = ifa->ifa_dstaddr; 1546 1.2.2.2 joerg 1547 1.2.2.2 joerg #ifdef USE_INET6 1548 1.2.2.2 joerg if (v == 6) 1549 1.2.2.2 joerg return ipf_ifpfillv6addr(atype, (struct sockaddr_in6 *)sock, 1550 1.2.2.2 joerg (struct sockaddr_in6 *)mask, 1551 1.2.2.2 joerg inp, inpmask); 1552 1.2.2.2 joerg #endif 1553 1.2.2.2 joerg return ipf_ifpfillv4addr(atype, (struct sockaddr_in *)sock, 1554 1.2.2.2 joerg (struct sockaddr_in *)mask, 1555 1.2.2.2 joerg &inp->in4, &inpmask->in4); 1556 1.2.2.2 joerg } 1557 1.2.2.2 joerg 1558 1.2.2.2 joerg 1559 1.2.2.2 joerg u_32_t 1560 1.2.2.2 joerg ipf_newisn(fr_info_t *fin) 1561 1.2.2.2 joerg { 1562 1.2.2.2 joerg #if __NetBSD_Version__ >= 105190000 /* 1.5T */ 1563 1.2.2.2 joerg size_t asz; 1564 1.2.2.2 joerg 1565 1.2.2.2 joerg if (fin->fin_v == 4) 1566 1.2.2.2 joerg asz = sizeof(struct in_addr); 1567 1.2.2.2 joerg else if (fin->fin_v == 6) 1568 1.2.2.2 joerg asz = sizeof(fin->fin_src); 1569 1.2.2.2 joerg else /* XXX: no way to return error */ 1570 1.2.2.2 joerg return 0; 1571 1.2.2.2 joerg #ifdef INET 1572 1.2.2.2 joerg return tcp_new_iss1((void *)&fin->fin_src, (void *)&fin->fin_dst, 1573 1.2.2.2 joerg fin->fin_sport, fin->fin_dport, asz, 0); 1574 1.2.2.2 joerg #else 1575 1.2.2.2 joerg return ENOSYS; 1576 1.2.2.2 joerg #endif 1577 1.2.2.2 joerg #else 1578 1.2.2.2 joerg static int iss_seq_off = 0; 1579 1.2.2.2 joerg u_char hash[16]; 1580 1.2.2.2 joerg u_32_t newiss; 1581 1.2.2.2 joerg MD5_CTX ctx; 1582 1.2.2.2 joerg 1583 1.2.2.2 joerg /* 1584 1.2.2.2 joerg * Compute the base value of the ISS. It is a hash 1585 1.2.2.2 joerg * of (saddr, sport, daddr, dport, secret). 1586 1.2.2.2 joerg */ 1587 1.2.2.2 joerg MD5Init(&ctx); 1588 1.2.2.2 joerg 1589 1.2.2.2 joerg MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_src, 1590 1.2.2.2 joerg sizeof(fin->fin_fi.fi_src)); 1591 1.2.2.2 joerg MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_dst, 1592 1.2.2.2 joerg sizeof(fin->fin_fi.fi_dst)); 1593 1.2.2.2 joerg MD5Update(&ctx, (u_char *) &fin->fin_dat, sizeof(fin->fin_dat)); 1594 1.2.2.2 joerg 1595 1.2.2.2 joerg MD5Update(&ctx, ipf_iss_secret, sizeof(ipf_iss_secret)); 1596 1.2.2.2 joerg 1597 1.2.2.2 joerg MD5Final(hash, &ctx); 1598 1.2.2.2 joerg 1599 1.2.2.2 joerg memcpy(&newiss, hash, sizeof(newiss)); 1600 1.2.2.2 joerg 1601 1.2.2.2 joerg /* 1602 1.2.2.2 joerg * Now increment our "timer", and add it in to 1603 1.2.2.2 joerg * the computed value. 1604 1.2.2.2 joerg * 1605 1.2.2.2 joerg * XXX Use `addin'? 1606 1.2.2.2 joerg * XXX TCP_ISSINCR too large to use? 1607 1.2.2.2 joerg */ 1608 1.2.2.2 joerg iss_seq_off += 0x00010000; 1609 1.2.2.2 joerg newiss += iss_seq_off; 1610 1.2.2.2 joerg return newiss; 1611 1.2.2.2 joerg #endif 1612 1.2.2.2 joerg } 1613 1.2.2.2 joerg 1614 1.2.2.2 joerg 1615 1.2.2.2 joerg /* ------------------------------------------------------------------------ */ 1616 1.2.2.2 joerg /* Function: ipf_nextipid */ 1617 1.2.2.2 joerg /* Returns: int - 0 == success, -1 == error (packet should be droppped) */ 1618 1.2.2.2 joerg /* Parameters: fin(I) - pointer to packet information */ 1619 1.2.2.2 joerg /* */ 1620 1.2.2.2 joerg /* Returns the next IPv4 ID to use for this packet. */ 1621 1.2.2.2 joerg /* ------------------------------------------------------------------------ */ 1622 1.2.2.2 joerg u_short 1623 1.2.2.2 joerg ipf_nextipid(fr_info_t *fin) 1624 1.2.2.2 joerg { 1625 1.2.2.2 joerg #ifdef USE_MUTEXES 1626 1.2.2.2 joerg ipf_main_softc_t *softc = fin->fin_main_soft; 1627 1.2.2.2 joerg #endif 1628 1.2.2.2 joerg u_short id; 1629 1.2.2.2 joerg 1630 1.2.2.2 joerg MUTEX_ENTER(&softc->ipf_rw); 1631 1.2.2.2 joerg id = ipid++; 1632 1.2.2.2 joerg MUTEX_EXIT(&softc->ipf_rw); 1633 1.2.2.2 joerg 1634 1.2.2.2 joerg return id; 1635 1.2.2.2 joerg } 1636 1.2.2.2 joerg 1637 1.2.2.2 joerg 1638 1.2.2.2 joerg EXTERN_INLINE int 1639 1.2.2.2 joerg ipf_checkv4sum(fr_info_t *fin) 1640 1.2.2.2 joerg { 1641 1.2.2.2 joerg #ifdef M_CSUM_TCP_UDP_BAD 1642 1.2.2.2 joerg int manual, pflag, cflags, active; 1643 1.2.2.2 joerg mb_t *m; 1644 1.2.2.2 joerg 1645 1.2.2.2 joerg if ((fin->fin_flx & FI_NOCKSUM) != 0) 1646 1.2.2.2 joerg return 0; 1647 1.2.2.2 joerg 1648 1.2.2.2 joerg if ((fin->fin_flx & FI_SHORT) != 0) 1649 1.2.2.2 joerg return 1; 1650 1.2.2.2 joerg 1651 1.2.2.2 joerg if (fin->fin_cksum != 0) 1652 1.2.2.2 joerg return (fin->fin_cksum == 1) ? 0 : -1; 1653 1.2.2.2 joerg 1654 1.2.2.2 joerg manual = 0; 1655 1.2.2.2 joerg m = fin->fin_m; 1656 1.2.2.2 joerg if (m == NULL) { 1657 1.2.2.2 joerg manual = 1; 1658 1.2.2.2 joerg goto skipauto; 1659 1.2.2.2 joerg } 1660 1.2.2.2 joerg 1661 1.2.2.2 joerg switch (fin->fin_p) 1662 1.2.2.2 joerg { 1663 1.2.2.2 joerg case IPPROTO_UDP : 1664 1.2.2.2 joerg pflag = M_CSUM_UDPv4; 1665 1.2.2.2 joerg break; 1666 1.2.2.2 joerg case IPPROTO_TCP : 1667 1.2.2.2 joerg pflag = M_CSUM_TCPv4; 1668 1.2.2.2 joerg break; 1669 1.2.2.2 joerg default : 1670 1.2.2.2 joerg pflag = 0; 1671 1.2.2.2 joerg manual = 1; 1672 1.2.2.2 joerg break; 1673 1.2.2.2 joerg } 1674 1.2.2.2 joerg 1675 1.2.2.2 joerg active = ((struct ifnet *)fin->fin_ifp)->if_csum_flags_rx & pflag; 1676 1.2.2.2 joerg active |= M_CSUM_TCP_UDP_BAD | M_CSUM_DATA; 1677 1.2.2.2 joerg cflags = m->m_pkthdr.csum_flags & active; 1678 1.2.2.2 joerg 1679 1.2.2.2 joerg if (pflag != 0) { 1680 1.2.2.2 joerg if (cflags == (pflag | M_CSUM_TCP_UDP_BAD)) { 1681 1.2.2.2 joerg fin->fin_flx |= FI_BAD; 1682 1.2.2.2 joerg fin->fin_cksum = -1; 1683 1.2.2.2 joerg } else if (cflags == (pflag | M_CSUM_DATA)) { 1684 1.2.2.2 joerg if ((m->m_pkthdr.csum_data ^ 0xffff) != 0) { 1685 1.2.2.2 joerg fin->fin_flx |= FI_BAD; 1686 1.2.2.2 joerg fin->fin_cksum = -1; 1687 1.2.2.2 joerg } else { 1688 1.2.2.2 joerg fin->fin_cksum = 1; 1689 1.2.2.2 joerg } 1690 1.2.2.2 joerg } else if (cflags == pflag) { 1691 1.2.2.2 joerg fin->fin_cksum = 1; 1692 1.2.2.2 joerg } else { 1693 1.2.2.2 joerg manual = 1; 1694 1.2.2.2 joerg } 1695 1.2.2.2 joerg } 1696 1.2.2.2 joerg skipauto: 1697 1.2.2.2 joerg if (manual != 0) { 1698 1.2.2.2 joerg if (ipf_checkl4sum(fin) == -1) { 1699 1.2.2.2 joerg fin->fin_flx |= FI_BAD; 1700 1.2.2.2 joerg return -1; 1701 1.2.2.2 joerg } 1702 1.2.2.2 joerg } 1703 1.2.2.2 joerg #else 1704 1.2.2.2 joerg if (ipf_checkl4sum(fin) == -1) { 1705 1.2.2.2 joerg fin->fin_flx |= FI_BAD; 1706 1.2.2.2 joerg return -1; 1707 1.2.2.2 joerg } 1708 1.2.2.2 joerg #endif 1709 1.2.2.2 joerg return 0; 1710 1.2.2.2 joerg } 1711 1.2.2.2 joerg 1712 1.2.2.2 joerg 1713 1.2.2.2 joerg #ifdef USE_INET6 1714 1.2.2.2 joerg EXTERN_INLINE int 1715 1.2.2.2 joerg ipf_checkv6sum(fr_info_t *fin) 1716 1.2.2.2 joerg { 1717 1.2.2.2 joerg # ifdef M_CSUM_TCP_UDP_BAD 1718 1.2.2.2 joerg int manual, pflag, cflags, active; 1719 1.2.2.2 joerg mb_t *m; 1720 1.2.2.2 joerg 1721 1.2.2.2 joerg if ((fin->fin_flx & FI_NOCKSUM) != 0) 1722 1.2.2.2 joerg return 0; 1723 1.2.2.2 joerg 1724 1.2.2.2 joerg if ((fin->fin_flx & FI_SHORT) != 0) 1725 1.2.2.2 joerg return 1; 1726 1.2.2.2 joerg 1727 1.2.2.2 joerg if (fin->fin_cksum != 0) 1728 1.2.2.2 joerg return (fin->fin_cksum == 1) ? 0 : -1; 1729 1.2.2.2 joerg 1730 1.2.2.2 joerg 1731 1.2.2.2 joerg manual = 0; 1732 1.2.2.2 joerg m = fin->fin_m; 1733 1.2.2.2 joerg 1734 1.2.2.2 joerg switch (fin->fin_p) 1735 1.2.2.2 joerg { 1736 1.2.2.2 joerg case IPPROTO_UDP : 1737 1.2.2.2 joerg pflag = M_CSUM_UDPv6; 1738 1.2.2.2 joerg break; 1739 1.2.2.2 joerg case IPPROTO_TCP : 1740 1.2.2.2 joerg pflag = M_CSUM_TCPv6; 1741 1.2.2.2 joerg break; 1742 1.2.2.2 joerg default : 1743 1.2.2.2 joerg pflag = 0; 1744 1.2.2.2 joerg manual = 1; 1745 1.2.2.2 joerg break; 1746 1.2.2.2 joerg } 1747 1.2.2.2 joerg 1748 1.2.2.2 joerg active = ((struct ifnet *)fin->fin_ifp)->if_csum_flags_rx & pflag; 1749 1.2.2.2 joerg active |= M_CSUM_TCP_UDP_BAD | M_CSUM_DATA; 1750 1.2.2.2 joerg cflags = m->m_pkthdr.csum_flags & active; 1751 1.2.2.2 joerg 1752 1.2.2.2 joerg if (pflag != 0) { 1753 1.2.2.2 joerg if (cflags == (pflag | M_CSUM_TCP_UDP_BAD)) { 1754 1.2.2.2 joerg fin->fin_flx |= FI_BAD; 1755 1.2.2.2 joerg } else if (cflags == (pflag | M_CSUM_DATA)) { 1756 1.2.2.2 joerg if ((m->m_pkthdr.csum_data ^ 0xffff) != 0) 1757 1.2.2.2 joerg fin->fin_flx |= FI_BAD; 1758 1.2.2.2 joerg } else if (cflags == pflag) { 1759 1.2.2.2 joerg ; 1760 1.2.2.2 joerg } else { 1761 1.2.2.2 joerg manual = 1; 1762 1.2.2.2 joerg } 1763 1.2.2.2 joerg } 1764 1.2.2.2 joerg if (manual != 0) { 1765 1.2.2.2 joerg if (ipf_checkl4sum(fin) == -1) { 1766 1.2.2.2 joerg fin->fin_flx |= FI_BAD; 1767 1.2.2.2 joerg return -1; 1768 1.2.2.2 joerg } 1769 1.2.2.2 joerg } 1770 1.2.2.2 joerg # else 1771 1.2.2.2 joerg if (ipf_checkl4sum(fin) == -1) { 1772 1.2.2.2 joerg fin->fin_flx |= FI_BAD; 1773 1.2.2.2 joerg return -1; 1774 1.2.2.2 joerg } 1775 1.2.2.2 joerg # endif 1776 1.2.2.2 joerg return 0; 1777 1.2.2.2 joerg } 1778 1.2.2.2 joerg #endif /* USE_INET6 */ 1779 1.2.2.2 joerg 1780 1.2.2.2 joerg 1781 1.2.2.2 joerg size_t 1782 1.2.2.2 joerg mbufchainlen(struct mbuf *m0) 1783 1.2.2.2 joerg { 1784 1.2.2.2 joerg size_t len; 1785 1.2.2.2 joerg 1786 1.2.2.2 joerg if ((m0->m_flags & M_PKTHDR) != 0) { 1787 1.2.2.2 joerg len = m0->m_pkthdr.len; 1788 1.2.2.2 joerg } else { 1789 1.2.2.2 joerg struct mbuf *m; 1790 1.2.2.2 joerg 1791 1.2.2.2 joerg for (m = m0, len = 0; m != NULL; m = m->m_next) 1792 1.2.2.2 joerg len += m->m_len; 1793 1.2.2.2 joerg } 1794 1.2.2.2 joerg return len; 1795 1.2.2.2 joerg } 1796 1.2.2.2 joerg 1797 1.2.2.2 joerg 1798 1.2.2.2 joerg /* ------------------------------------------------------------------------ */ 1799 1.2.2.2 joerg /* Function: ipf_pullup */ 1800 1.2.2.2 joerg /* Returns: NULL == pullup failed, else pointer to protocol header */ 1801 1.2.2.2 joerg /* Parameters: xmin(I)- pointer to buffer where data packet starts */ 1802 1.2.2.2 joerg /* fin(I) - pointer to packet information */ 1803 1.2.2.2 joerg /* len(I) - number of bytes to pullup */ 1804 1.2.2.2 joerg /* */ 1805 1.2.2.2 joerg /* Attempt to move at least len bytes (from the start of the buffer) into a */ 1806 1.2.2.2 joerg /* single buffer for ease of access. Operating system native functions are */ 1807 1.2.2.2 joerg /* used to manage buffers - if necessary. If the entire packet ends up in */ 1808 1.2.2.2 joerg /* a single buffer, set the FI_COALESCE flag even though ipf_coalesce() has */ 1809 1.2.2.2 joerg /* not been called. Both fin_ip and fin_dp are updated before exiting _IF_ */ 1810 1.2.2.2 joerg /* and ONLY if the pullup succeeds. */ 1811 1.2.2.2 joerg /* */ 1812 1.2.2.2 joerg /* We assume that 'xmin' is a pointer to a buffer that is part of the chain */ 1813 1.2.2.2 joerg /* of buffers that starts at *fin->fin_mp. */ 1814 1.2.2.2 joerg /* ------------------------------------------------------------------------ */ 1815 1.2.2.2 joerg void * 1816 1.2.2.2 joerg ipf_pullup(mb_t *xmin, fr_info_t *fin, int len) 1817 1.2.2.2 joerg { 1818 1.2.2.2 joerg int dpoff, ipoff; 1819 1.2.2.2 joerg mb_t *m = xmin; 1820 1.2.2.2 joerg char *ip; 1821 1.2.2.2 joerg 1822 1.2.2.2 joerg if (m == NULL) 1823 1.2.2.2 joerg return NULL; 1824 1.2.2.2 joerg 1825 1.2.2.2 joerg ip = (char *)fin->fin_ip; 1826 1.2.2.2 joerg if ((fin->fin_flx & FI_COALESCE) != 0) 1827 1.2.2.2 joerg return ip; 1828 1.2.2.2 joerg 1829 1.2.2.2 joerg ipoff = fin->fin_ipoff; 1830 1.2.2.2 joerg if (fin->fin_dp != NULL) 1831 1.2.2.2 joerg dpoff = (char *)fin->fin_dp - (char *)ip; 1832 1.2.2.2 joerg else 1833 1.2.2.2 joerg dpoff = 0; 1834 1.2.2.2 joerg 1835 1.2.2.2 joerg if (M_LEN(m) < len) { 1836 1.2.2.2 joerg mb_t *n = *fin->fin_mp; 1837 1.2.2.2 joerg /* 1838 1.2.2.2 joerg * Assume that M_PKTHDR is set and just work with what is left 1839 1.2.2.2 joerg * rather than check.. 1840 1.2.2.2 joerg * Should not make any real difference, anyway. 1841 1.2.2.2 joerg */ 1842 1.2.2.2 joerg if (m != n) { 1843 1.2.2.2 joerg /* 1844 1.2.2.2 joerg * Record the mbuf that points to the mbuf that we're 1845 1.2.2.2 joerg * about to go to work on so that we can update the 1846 1.2.2.2 joerg * m_next appropriately later. 1847 1.2.2.2 joerg */ 1848 1.2.2.2 joerg for (; n->m_next != m; n = n->m_next) 1849 1.2.2.2 joerg ; 1850 1.2.2.2 joerg } else { 1851 1.2.2.2 joerg n = NULL; 1852 1.2.2.2 joerg } 1853 1.2.2.2 joerg 1854 1.2.2.2 joerg #ifdef MHLEN 1855 1.2.2.2 joerg if (len > MHLEN) 1856 1.2.2.2 joerg #else 1857 1.2.2.2 joerg if (len > MLEN) 1858 1.2.2.2 joerg #endif 1859 1.2.2.2 joerg { 1860 1.2.2.2 joerg #ifdef HAVE_M_PULLDOWN 1861 1.2.2.2 joerg if (m_pulldown(m, 0, len, NULL) == NULL) 1862 1.2.2.2 joerg m = NULL; 1863 1.2.2.2 joerg #else 1864 1.2.2.2 joerg FREE_MB_T(*fin->fin_mp); 1865 1.2.2.2 joerg m = NULL; 1866 1.2.2.2 joerg n = NULL; 1867 1.2.2.2 joerg #endif 1868 1.2.2.2 joerg } else 1869 1.2.2.2 joerg { 1870 1.2.2.2 joerg m = m_pullup(m, len); 1871 1.2.2.2 joerg } 1872 1.2.2.2 joerg if (n != NULL) 1873 1.2.2.2 joerg n->m_next = m; 1874 1.2.2.2 joerg if (m == NULL) { 1875 1.2.2.2 joerg /* 1876 1.2.2.2 joerg * When n is non-NULL, it indicates that m pointed to 1877 1.2.2.2 joerg * a sub-chain (tail) of the mbuf and that the head 1878 1.2.2.2 joerg * of this chain has not yet been free'd. 1879 1.2.2.2 joerg */ 1880 1.2.2.2 joerg if (n != NULL) { 1881 1.2.2.2 joerg FREE_MB_T(*fin->fin_mp); 1882 1.2.2.2 joerg } 1883 1.2.2.2 joerg 1884 1.2.2.2 joerg *fin->fin_mp = NULL; 1885 1.2.2.2 joerg fin->fin_m = NULL; 1886 1.2.2.2 joerg return NULL; 1887 1.2.2.2 joerg } 1888 1.2.2.2 joerg 1889 1.2.2.2 joerg if (n == NULL) 1890 1.2.2.2 joerg *fin->fin_mp = m; 1891 1.2.2.2 joerg 1892 1.2.2.2 joerg while (M_LEN(m) == 0) { 1893 1.2.2.2 joerg m = m->m_next; 1894 1.2.2.2 joerg } 1895 1.2.2.2 joerg fin->fin_m = m; 1896 1.2.2.2 joerg ip = MTOD(m, char *) + ipoff; 1897 1.2.2.2 joerg 1898 1.2.2.2 joerg fin->fin_ip = (ip_t *)ip; 1899 1.2.2.2 joerg if (fin->fin_dp != NULL) 1900 1.2.2.2 joerg fin->fin_dp = (char *)fin->fin_ip + dpoff; 1901 1.2.2.2 joerg } 1902 1.2.2.2 joerg 1903 1.2.2.2 joerg if (len == fin->fin_plen) 1904 1.2.2.2 joerg fin->fin_flx |= FI_COALESCE; 1905 1.2.2.2 joerg return ip; 1906 1.2.2.2 joerg } 1907 1.2.2.2 joerg 1908 1.2.2.2 joerg 1909 1.2.2.2 joerg int 1910 1.2.2.2 joerg ipf_inject(fr_info_t *fin, mb_t *m) 1911 1.2.2.2 joerg { 1912 1.2.2.2 joerg int error; 1913 1.2.2.2 joerg 1914 1.2.2.2 joerg if (fin->fin_out == 0) { 1915 1.2.2.2 joerg struct ifqueue *ifq; 1916 1.2.2.2 joerg 1917 1.2.2.2 joerg ifq = &ipintrq; 1918 1.2.2.2 joerg 1919 1.2.2.2 joerg if (IF_QFULL(ifq)) { 1920 1.2.2.2 joerg IF_DROP(ifq); 1921 1.2.2.2 joerg FREE_MB_T(m); 1922 1.2.2.2 joerg error = ENOBUFS; 1923 1.2.2.2 joerg } else { 1924 1.2.2.2 joerg IF_ENQUEUE(ifq, m); 1925 1.2.2.2 joerg error = 0; 1926 1.2.2.2 joerg } 1927 1.2.2.2 joerg } else { 1928 1.2.2.2 joerg error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL); 1929 1.2.2.2 joerg } 1930 1.2.2.2 joerg 1931 1.2.2.2 joerg return error; 1932 1.2.2.2 joerg } 1933 1.2.2.2 joerg 1934 1.2.2.2 joerg 1935 1.2.2.2 joerg u_32_t 1936 1.2.2.2 joerg ipf_random(void) 1937 1.2.2.2 joerg { 1938 1.2.2.2 joerg int number; 1939 1.2.2.2 joerg 1940 1.2.2.2 joerg #ifdef _CPRNG_H 1941 1.2.2.2 joerg number = cprng_fast32(); 1942 1.2.2.2 joerg #else 1943 1.2.2.2 joerg number = arc4random(); 1944 1.2.2.2 joerg #endif 1945 1.2.2.2 joerg return number; 1946 1.2.2.2 joerg } 1947 1.2.2.2 joerg 1948 1.2.2.2 joerg 1949 1.2.2.2 joerg /* 1950 1.2.2.2 joerg * routines below for saving IP headers to buffer 1951 1.2.2.2 joerg */ 1952 1.2.2.2 joerg static int ipfopen(dev_t dev, int flags 1953 1.2.2.2 joerg #if (NetBSD >= 199511) 1954 1.2.2.2 joerg , int devtype, PROC_T *p 1955 1.2.2.2 joerg #endif 1956 1.2.2.2 joerg ) 1957 1.2.2.2 joerg { 1958 1.2.2.2 joerg u_int unit = GET_MINOR(dev); 1959 1.2.2.2 joerg int error; 1960 1.2.2.2 joerg 1961 1.2.2.2 joerg if (IPL_LOGMAX < unit) { 1962 1.2.2.2 joerg error = ENXIO; 1963 1.2.2.2 joerg } else { 1964 1.2.2.2 joerg switch (unit) 1965 1.2.2.2 joerg { 1966 1.2.2.2 joerg case IPL_LOGIPF : 1967 1.2.2.2 joerg case IPL_LOGNAT : 1968 1.2.2.2 joerg case IPL_LOGSTATE : 1969 1.2.2.2 joerg case IPL_LOGAUTH : 1970 1.2.2.2 joerg case IPL_LOGLOOKUP : 1971 1.2.2.2 joerg case IPL_LOGSYNC : 1972 1.2.2.2 joerg #ifdef IPFILTER_SCAN 1973 1.2.2.2 joerg case IPL_LOGSCAN : 1974 1.2.2.2 joerg #endif 1975 1.2.2.2 joerg error = 0; 1976 1.2.2.2 joerg break; 1977 1.2.2.2 joerg default : 1978 1.2.2.2 joerg error = ENXIO; 1979 1.2.2.2 joerg break; 1980 1.2.2.2 joerg } 1981 1.2.2.2 joerg } 1982 1.2.2.2 joerg return error; 1983 1.2.2.2 joerg } 1984 1.2.2.2 joerg 1985 1.2.2.2 joerg 1986 1.2.2.2 joerg static int ipfclose(dev_t dev, int flags 1987 1.2.2.2 joerg #if (NetBSD >= 199511) 1988 1.2.2.2 joerg , int devtype, PROC_T *p 1989 1.2.2.2 joerg #endif 1990 1.2.2.2 joerg ) 1991 1.2.2.2 joerg { 1992 1.2.2.2 joerg u_int unit = GET_MINOR(dev); 1993 1.2.2.2 joerg 1994 1.2.2.2 joerg if (IPL_LOGMAX < unit) 1995 1.2.2.2 joerg unit = ENXIO; 1996 1.2.2.2 joerg else 1997 1.2.2.2 joerg unit = 0; 1998 1.2.2.2 joerg return unit; 1999 1.2.2.2 joerg } 2000 1.2.2.2 joerg 2001 1.2.2.2 joerg /* 2002 1.2.2.2 joerg * ipfread/ipflog 2003 1.2.2.2 joerg * both of these must operate with at least splnet() lest they be 2004 1.2.2.2 joerg * called during packet processing and cause an inconsistancy to appear in 2005 1.2.2.2 joerg * the filter lists. 2006 1.2.2.2 joerg */ 2007 1.2.2.2 joerg static int ipfread(dev_t dev, struct uio *uio, int ioflag) 2008 1.2.2.2 joerg { 2009 1.2.2.2 joerg 2010 1.2.2.2 joerg if (ipfmain.ipf_running < 1) { 2011 1.2.2.2 joerg ipfmain.ipf_interror = 130006; 2012 1.2.2.2 joerg return EIO; 2013 1.2.2.2 joerg } 2014 1.2.2.2 joerg 2015 1.2.2.2 joerg if (GET_MINOR(dev) == IPL_LOGSYNC) 2016 1.2.2.2 joerg return ipf_sync_read(&ipfmain, uio); 2017 1.2.2.2 joerg 2018 1.2.2.2 joerg #ifdef IPFILTER_LOG 2019 1.2.2.2 joerg return ipf_log_read(&ipfmain, GET_MINOR(dev), uio); 2020 1.2.2.2 joerg #else 2021 1.2.2.2 joerg ipfmain.ipf_interror = 130007; 2022 1.2.2.2 joerg return ENXIO; 2023 1.2.2.2 joerg #endif 2024 1.2.2.2 joerg } 2025 1.2.2.2 joerg 2026 1.2.2.2 joerg 2027 1.2.2.2 joerg /* 2028 1.2.2.2 joerg * ipfwrite 2029 1.2.2.2 joerg * both of these must operate with at least splnet() lest they be 2030 1.2.2.2 joerg * called during packet processing and cause an inconsistancy to appear in 2031 1.2.2.2 joerg * the filter lists. 2032 1.2.2.2 joerg */ 2033 1.2.2.2 joerg static int ipfwrite(dev_t dev, struct uio *uio, int ioflag) 2034 1.2.2.2 joerg { 2035 1.2.2.2 joerg 2036 1.2.2.2 joerg if (ipfmain.ipf_running < 1) { 2037 1.2.2.2 joerg ipfmain.ipf_interror = 130008; 2038 1.2.2.2 joerg return EIO; 2039 1.2.2.2 joerg } 2040 1.2.2.2 joerg 2041 1.2.2.2 joerg if (GET_MINOR(dev) == IPL_LOGSYNC) 2042 1.2.2.2 joerg return ipf_sync_write(&ipfmain, uio); 2043 1.2.2.2 joerg ipfmain.ipf_interror = 130009; 2044 1.2.2.2 joerg return ENXIO; 2045 1.2.2.2 joerg } 2046 1.2.2.2 joerg 2047 1.2.2.2 joerg 2048 1.2.2.2 joerg static int ipfpoll(dev_t dev, int events, PROC_T *p) 2049 1.2.2.2 joerg { 2050 1.2.2.2 joerg u_int unit = GET_MINOR(dev); 2051 1.2.2.2 joerg int revents = 0; 2052 1.2.2.2 joerg 2053 1.2.2.2 joerg if (IPL_LOGMAX < unit) { 2054 1.2.2.2 joerg ipfmain.ipf_interror = 130010; 2055 1.2.2.2 joerg return ENXIO; 2056 1.2.2.2 joerg } 2057 1.2.2.2 joerg 2058 1.2.2.2 joerg switch (unit) 2059 1.2.2.2 joerg { 2060 1.2.2.2 joerg case IPL_LOGIPF : 2061 1.2.2.2 joerg case IPL_LOGNAT : 2062 1.2.2.2 joerg case IPL_LOGSTATE : 2063 1.2.2.2 joerg #ifdef IPFILTER_LOG 2064 1.2.2.2 joerg if ((events & (POLLIN | POLLRDNORM)) && 2065 1.2.2.2 joerg ipf_log_canread(&ipfmain, unit)) 2066 1.2.2.2 joerg revents |= events & (POLLIN | POLLRDNORM); 2067 1.2.2.2 joerg #endif 2068 1.2.2.2 joerg break; 2069 1.2.2.2 joerg case IPL_LOGAUTH : 2070 1.2.2.2 joerg if ((events & (POLLIN | POLLRDNORM)) && 2071 1.2.2.2 joerg ipf_auth_waiting(&ipfmain)) 2072 1.2.2.2 joerg revents |= events & (POLLIN | POLLRDNORM); 2073 1.2.2.2 joerg break; 2074 1.2.2.2 joerg case IPL_LOGSYNC : 2075 1.2.2.2 joerg if ((events & (POLLIN | POLLRDNORM)) && 2076 1.2.2.2 joerg ipf_sync_canread(&ipfmain)) 2077 1.2.2.2 joerg revents |= events & (POLLIN | POLLRDNORM); 2078 1.2.2.2 joerg if ((events & (POLLOUT | POLLWRNORM)) && 2079 1.2.2.2 joerg ipf_sync_canwrite(&ipfmain)) 2080 1.2.2.2 joerg revents |= events & (POLLOUT | POLLWRNORM); 2081 1.2.2.2 joerg break; 2082 1.2.2.2 joerg case IPL_LOGSCAN : 2083 1.2.2.2 joerg case IPL_LOGLOOKUP : 2084 1.2.2.2 joerg default : 2085 1.2.2.2 joerg break; 2086 1.2.2.2 joerg } 2087 1.2.2.2 joerg 2088 1.2.2.2 joerg if ((revents == 0) && (((events & (POLLIN|POLLRDNORM)) != 0))) 2089 1.2.2.2 joerg selrecord(p, &ipfmain.ipf_selwait[unit]); 2090 1.2.2.2 joerg return revents; 2091 1.2.2.2 joerg } 2092 1.2.2.2 joerg 2093 1.2.2.2 joerg u_int 2094 1.2.2.2 joerg ipf_pcksum(fr_info_t *fin, int hlen, u_int sum) 2095 1.2.2.2 joerg { 2096 1.2.2.2 joerg struct mbuf *m; 2097 1.2.2.2 joerg u_int sum2; 2098 1.2.2.2 joerg int off; 2099 1.2.2.2 joerg 2100 1.2.2.2 joerg m = fin->fin_m; 2101 1.2.2.2 joerg off = (char *)fin->fin_dp - (char *)fin->fin_ip; 2102 1.2.2.2 joerg m->m_data += hlen; 2103 1.2.2.2 joerg m->m_len -= hlen; 2104 1.2.2.2 joerg sum2 = in_cksum(fin->fin_m, fin->fin_plen - off); 2105 1.2.2.2 joerg m->m_len += hlen; 2106 1.2.2.2 joerg m->m_data -= hlen; 2107 1.2.2.2 joerg 2108 1.2.2.2 joerg /* 2109 1.2.2.2 joerg * Both sum and sum2 are partial sums, so combine them together. 2110 1.2.2.2 joerg */ 2111 1.2.2.2 joerg sum += ~sum2 & 0xffff; 2112 1.2.2.2 joerg while (sum > 0xffff) 2113 1.2.2.2 joerg sum = (sum & 0xffff) + (sum >> 16); 2114 1.2.2.2 joerg sum2 = ~sum & 0xffff; 2115 1.2.2.2 joerg return sum2; 2116 1.2.2.2 joerg } 2117
Indexes created Sun Oct 12 02:09:55 GMT 2025