ip_fil_netbsd.c revision 1.11
1 /* $NetBSD: ip_fil_netbsd.c,v 1.11 2014/07/25 08:10:39 dholland Exp $ */ 2 3 /* 4 * Copyright (C) 2012 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 */ 8 #if !defined(lint) 9 #if defined(__NetBSD__) 10 #include <sys/cdefs.h> 11 __KERNEL_RCSID(0, "$NetBSD: ip_fil_netbsd.c,v 1.11 2014/07/25 08:10:39 dholland Exp $"); 12 #else 13 static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-2000 Darren Reed"; 14 static const char rcsid[] = "@(#)Id: ip_fil_netbsd.c,v 1.1.1.2 2012/07/22 13:45:17 darrenr Exp"; 15 #endif 16 #endif 17 18 #if defined(KERNEL) || defined(_KERNEL) 19 # undef KERNEL 20 # undef _KERNEL 21 # define KERNEL 1 22 # define _KERNEL 1 23 #endif 24 #include <sys/param.h> 25 #if (NetBSD >= 199905) && !defined(IPFILTER_LKM) 26 # include "opt_ipsec.h" 27 #endif 28 #include <sys/errno.h> 29 #include <sys/types.h> 30 #include <sys/file.h> 31 #include <sys/ioctl.h> 32 #include <sys/time.h> 33 #include <sys/systm.h> 34 #include <sys/select.h> 35 #if (NetBSD > 199609) 36 # include <sys/dirent.h> 37 #else 38 # include <sys/dir.h> 39 #endif 40 #if (__NetBSD_Version__ >= 599005900) 41 # include <sys/cprng.h> 42 #endif 43 #include <sys/mbuf.h> 44 #include <sys/protosw.h> 45 #include <sys/socket.h> 46 #include <sys/poll.h> 47 #if (__NetBSD_Version__ >= 399002000) 48 # include <sys/kauth.h> 49 #endif 50 51 #include <net/if.h> 52 #include <net/route.h> 53 #include <netinet/in.h> 54 #include <netinet/in_var.h> 55 #include <netinet/in_systm.h> 56 #include <netinet/ip.h> 57 #include <netinet/ip_var.h> 58 #include <netinet/tcp.h> 59 #if __NetBSD_Version__ >= 105190000 /* 1.5T */ 60 # include <netinet/tcp_timer.h> 61 # include <netinet/tcp_var.h> 62 #endif 63 #include <netinet/udp.h> 64 #include <netinet/tcpip.h> 65 #include <netinet/ip_icmp.h> 66 #include "netinet/ip_compat.h" 67 #ifdef USE_INET6 68 # include <netinet/icmp6.h> 69 # if (__NetBSD_Version__ >= 106000000) 70 # include <netinet6/nd6.h> 71 # endif 72 #endif 73 #include "netinet/ip_fil.h" 74 #include "netinet/ip_nat.h" 75 #include "netinet/ip_frag.h" 76 #include "netinet/ip_state.h" 77 #include "netinet/ip_proxy.h" 78 #include "netinet/ip_auth.h" 79 #include "netinet/ip_sync.h" 80 #include "netinet/ip_lookup.h" 81 #include "netinet/ip_dstlist.h" 82 #ifdef IPFILTER_SCAN 83 #include "netinet/ip_scan.h" 84 #endif 85 #include <sys/md5.h> 86 #include <sys/kernel.h> 87 #include <sys/conf.h> 88 #ifdef INET 89 extern int ip_optcopy (struct ip *, struct ip *); 90 #endif 91 92 #ifdef IPFILTER_M_IPFILTER 93 MALLOC_DEFINE(M_IPFILTER, "IP Filter", "IP Filter packet filter data structures"); 94 #endif 95 96 #if __NetBSD_Version__ >= 105009999 97 # define csuminfo csum_flags 98 #endif 99 100 #if __NetBSD_Version__ < 200000000 101 extern struct protosw inetsw[]; 102 #endif 103 104 #if (__NetBSD_Version__ >= 599002000) 105 static kauth_listener_t ipf_listener; 106 #endif 107 108 #if (__NetBSD_Version__ < 399001400) 109 extern int ip6_getpmtu (struct route_in6 *, struct route_in6 *, 110 struct ifnet *, struct in6_addr *, u_long *, 111 int *); 112 #endif 113 #if (NetBSD >= 199511) 114 static int ipfopen(dev_t dev, int flags, int devtype, PROC_T *p); 115 static int ipfclose(dev_t dev, int flags, int devtype, PROC_T *p); 116 #else 117 # if (__NetBSD_Version__ >= 399001400) 118 static int ipfopen(dev_t dev, int flags, struct lwp *); 119 static int ipfclose(dev_t dev, int flags, struct lwp *); 120 # else 121 static int ipfopen(dev_t dev, int flags); 122 static int ipfclose(dev_t dev, int flags); 123 # endif /* __NetBSD_Version__ >= 399001400 */ 124 #endif 125 static int ipfread(dev_t, struct uio *, int ioflag); 126 static int ipfwrite(dev_t, struct uio *, int ioflag); 127 static int ipfpoll(dev_t, int events, PROC_T *); 128 static void ipf_timer_func(void *ptr); 129 130 const struct cdevsw ipl_cdevsw = { 131 .d_open = ipfopen, 132 .d_close = ipfclose, 133 .d_read = ipfread, 134 .d_write = ipfwrite, 135 .d_ioctl = ipfioctl, 136 .d_stop = nostop, 137 .d_tty = notty, 138 .d_poll = ipfpoll, 139 .d_mmap = nommap, 140 #if (__NetBSD_Version__ >= 200000000) 141 .d_kqfilter = nokqfilter, 142 #endif 143 .d_discard = nodiscard, 144 #ifdef D_OTHER 145 .d_flag = D_OTHER 146 #else 147 .d_flag = 0 148 #endif 149 }; 150 151 ipf_main_softc_t ipfmain; 152 153 static u_short ipid = 0; 154 static int (*ipf_savep)(void *, ip_t *, int, void *, int, struct mbuf **); 155 static int ipf_send_ip(fr_info_t *, mb_t *); 156 #ifdef USE_INET6 157 static int ipf_fastroute6(struct mbuf *, struct mbuf **, 158 fr_info_t *, frdest_t *); 159 #endif 160 161 #if defined(NETBSD_PF) 162 # include <net/pfil.h> 163 /* 164 * We provide the ipf_checkp name just to minimize changes later. 165 */ 166 int (*ipf_checkp)(void *, ip_t *ip, int hlen, void *ifp, int out, mb_t **mp); 167 #endif /* NETBSD_PF */ 168 169 #if defined(__NetBSD_Version__) && (__NetBSD_Version__ >= 105110000) 170 # include <net/pfil.h> 171 172 static int ipf_check_wrapper(void *, struct mbuf **, struct ifnet *, int ); 173 174 static int 175 ipf_check_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 176 { 177 struct ip *ip; 178 int rv, hlen; 179 180 #if __NetBSD_Version__ >= 200080000 181 /* 182 * ensure that mbufs are writable beforehand 183 * as it's assumed by ipf code. 184 * XXX inefficient 185 */ 186 int error = m_makewritable(mp, 0, M_COPYALL, M_DONTWAIT); 187 188 if (error) { 189 m_freem(*mp); 190 *mp = NULL; 191 return error; 192 } 193 #endif 194 ip = mtod(*mp, struct ip *); 195 hlen = ip->ip_hl << 2; 196 197 #ifdef INET 198 #if defined(M_CSUM_TCPv4) 199 /* 200 * If the packet is out-bound, we can't delay checksums 201 * here. For in-bound, the checksum has already been 202 * validated. 203 */ 204 if (dir == PFIL_OUT) { 205 if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 206 in_delayed_cksum(*mp); 207 (*mp)->m_pkthdr.csum_flags &= 208 ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 209 } 210 } 211 #endif /* M_CSUM_TCPv4 */ 212 #endif /* INET */ 213 214 /* 215 * Note, we don't need to update the checksum, because 216 * it has already been verified. 217 */ 218 rv = ipf_check(&ipfmain, ip, hlen, ifp, (dir == PFIL_OUT), mp); 219 220 return (rv); 221 } 222 223 # ifdef USE_INET6 224 # include <netinet/ip6.h> 225 226 static int ipf_check_wrapper6(void *, struct mbuf **, struct ifnet *, int ); 227 228 static int 229 ipf_check_wrapper6(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 230 { 231 #if defined(INET6) 232 # if defined(M_CSUM_TCPv6) && (__NetBSD_Version__ > 200000000) 233 /* 234 * If the packet is out-bound, we can't delay checksums 235 * here. For in-bound, the checksum has already been 236 * validated. 237 */ 238 if (dir == PFIL_OUT) { 239 if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv6|M_CSUM_UDPv6)) { 240 # if (__NetBSD_Version__ > 399000600) 241 in6_delayed_cksum(*mp); 242 # endif 243 (*mp)->m_pkthdr.csum_flags &= ~(M_CSUM_TCPv6| 244 M_CSUM_UDPv6); 245 } 246 } 247 # endif 248 #endif /* INET6 */ 249 250 return (ipf_check(&ipfmain, mtod(*mp, struct ip *), sizeof(struct ip6_hdr), 251 ifp, (dir == PFIL_OUT), mp)); 252 } 253 # endif 254 255 256 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 257 static int ipf_pfilsync(void *, struct mbuf **, struct ifnet *, int); 258 259 static int 260 ipf_pfilsync(void *hdr, struct mbuf **mp, struct ifnet *ifp, int dir) 261 { 262 /* 263 * The interface pointer is useless for create (we have nothing to 264 * compare it to) and at detach, the interface name is still in the 265 * list of active NICs (albeit, down, but that's not any real 266 * indicator) and doing ifunit() on the name will still return the 267 * pointer, so it's not much use then, either. 268 */ 269 ipf_sync(&ipfmain, NULL); 270 return 0; 271 } 272 # endif 273 274 #endif /* __NetBSD_Version__ >= 105110000 */ 275 276 277 #if defined(IPFILTER_LKM) 278 int 279 ipf_identify(s) 280 char *s; 281 { 282 if (strcmp(s, "ipl") == 0) 283 return 1; 284 return 0; 285 } 286 #endif /* IPFILTER_LKM */ 287 288 #if (__NetBSD_Version__ >= 599002000) 289 static int 290 ipf_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie, 291 void *arg0, void *arg1, void *arg2, void *arg3) 292 { 293 int result; 294 enum kauth_network_req req; 295 296 result = KAUTH_RESULT_DEFER; 297 req = (enum kauth_network_req)arg0; 298 299 if (action != KAUTH_NETWORK_FIREWALL) 300 return result; 301 302 /* These must have came from device context. */ 303 if ((req == KAUTH_REQ_NETWORK_FIREWALL_FW) || 304 (req == KAUTH_REQ_NETWORK_FIREWALL_NAT)) 305 result = KAUTH_RESULT_ALLOW; 306 307 return result; 308 } 309 #endif 310 311 /* 312 * Try to detect the case when compiling for NetBSD with pseudo-device 313 */ 314 void 315 ipfilterattach(int count) 316 { 317 318 #if (__NetBSD_Version__ >= 599002000) 319 ipf_listener = kauth_listen_scope(KAUTH_SCOPE_NETWORK, 320 ipf_listener_cb, NULL); 321 #endif 322 323 if (ipf_load_all() == 0) 324 (void) ipf_create_all(&ipfmain); 325 } 326 327 328 int 329 ipfattach(ipf_main_softc_t *softc) 330 { 331 SPL_INT(s); 332 #if (__NetBSD_Version__ >= 499005500) 333 int i; 334 #endif 335 #if defined(NETBSD_PF) && (__NetBSD_Version__ >= 104200000) 336 int error = 0; 337 # if defined(__NetBSD_Version__) && (__NetBSD_Version__ >= 105110000) 338 pfil_head_t *ph_inet; 339 # ifdef USE_INET6 340 pfil_head_t *ph_inet6; 341 # endif 342 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 343 pfil_head_t *ph_ifsync; 344 # endif 345 # endif 346 #endif 347 348 SPL_NET(s); 349 if ((softc->ipf_running > 0) || (ipf_checkp == ipf_check)) { 350 printf("IP Filter: already initialized\n"); 351 SPL_X(s); 352 IPFERROR(130017); 353 return EBUSY; 354 } 355 356 if (ipf_init_all(softc) < 0) { 357 SPL_X(s); 358 IPFERROR(130015); 359 return EIO; 360 } 361 362 #ifdef NETBSD_PF 363 # if (__NetBSD_Version__ >= 104200000) 364 # if __NetBSD_Version__ >= 105110000 365 ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET); 366 # ifdef USE_INET6 367 ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6); 368 # endif 369 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 370 ph_ifsync = pfil_head_get(PFIL_TYPE_IFNET, 0); 371 # endif 372 373 if (ph_inet == NULL 374 # ifdef USE_INET6 375 && ph_inet6 == NULL 376 # endif 377 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 378 && ph_ifsync == NULL 379 # endif 380 ) { 381 SPL_X(s); 382 IPFERROR(130016); 383 return ENODEV; 384 } 385 386 if (ph_inet != NULL) 387 error = pfil_add_hook((void *)ipf_check_wrapper, NULL, 388 PFIL_IN|PFIL_OUT, ph_inet); 389 else 390 error = 0; 391 # else 392 error = pfil_add_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 393 &inetsw[ip_protox[IPPROTO_IP]].pr_pfh); 394 # endif 395 if (error) { 396 IPFERROR(130013); 397 goto pfil_error; 398 } 399 # else 400 pfil_add_hook((void *)ipf_check, PFIL_IN|PFIL_OUT); 401 # endif 402 403 # ifdef USE_INET6 404 # if __NetBSD_Version__ >= 105110000 405 if (ph_inet6 != NULL) 406 error = pfil_add_hook((void *)ipf_check_wrapper6, NULL, 407 PFIL_IN|PFIL_OUT, ph_inet6); 408 else 409 error = 0; 410 if (error) { 411 pfil_remove_hook((void *)ipf_check_wrapper6, NULL, 412 PFIL_IN|PFIL_OUT, ph_inet6); 413 ipfmain.ipf_interror = 130014; 414 goto pfil_error; 415 } 416 # else 417 error = pfil_add_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 418 &inetsw[ip_protox[IPPROTO_IPV6]].pr_pfh); 419 if (error) { 420 pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 421 &inetsw[ip_protox[IPPROTO_IP]].pr_pfh); 422 IPFERROR(130014); 423 goto pfil_error; 424 } 425 # endif 426 # endif 427 428 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 429 if (ph_ifsync != NULL) 430 (void) pfil_add_hook((void *)ipf_pfilsync, NULL, 431 PFIL_IFNET, ph_ifsync); 432 # endif 433 #endif 434 435 #if (__NetBSD_Version__ >= 499005500) 436 for (i = 0; i < IPL_LOGSIZE; i++) 437 selinit(&ipfmain.ipf_selwait[i]); 438 #else 439 bzero((char *)ipfmain.ipf_selwait, sizeof(ipfmain.ipf_selwait)); 440 #endif 441 ipf_savep = ipf_checkp; 442 ipf_checkp = ipf_check; 443 444 #ifdef INET 445 if (softc->ipf_control_forwarding & 1) 446 ipforwarding = 1; 447 #endif 448 449 ipid = 0; 450 451 SPL_X(s); 452 453 #if (__NetBSD_Version__ >= 104010000) 454 # if (__NetBSD_Version__ >= 499002000) 455 callout_init(&softc->ipf_slow_ch, 0); 456 # else 457 callout_init(&softc->ipf_slow_ch); 458 # endif 459 callout_reset(&softc->ipf_slow_ch, (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT, 460 ipf_timer_func, softc); 461 #else 462 timeout(ipf_timer_func, softc, (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT); 463 #endif 464 465 return 0; 466 467 #if __NetBSD_Version__ >= 105110000 468 pfil_error: 469 SPL_X(s); 470 ipf_fini_all(softc); 471 return error; 472 #endif 473 } 474 475 static void 476 ipf_timer_func(void *ptr) 477 { 478 ipf_main_softc_t *softc = ptr; 479 SPL_INT(s); 480 481 SPL_NET(s); 482 READ_ENTER(&softc->ipf_global); 483 484 if (softc->ipf_running > 0) 485 ipf_slowtimer(softc); 486 487 if (softc->ipf_running == -1 || softc->ipf_running == 1) { 488 #if NETBSD_GE_REV(104240000) 489 callout_reset(&softc->ipf_slow_ch, hz / 2, 490 ipf_timer_func, softc); 491 #else 492 timeout(ipf_timer_func, softc, 493 (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT); 494 #endif 495 } 496 RWLOCK_EXIT(&softc->ipf_global); 497 SPL_X(s); 498 } 499 500 501 /* 502 * Disable the filter by removing the hooks from the IP input/output 503 * stream. 504 */ 505 int 506 ipfdetach(ipf_main_softc_t *softc) 507 { 508 SPL_INT(s); 509 #if (__NetBSD_Version__ >= 499005500) 510 int i; 511 #endif 512 #if defined(NETBSD_PF) && (__NetBSD_Version__ >= 104200000) 513 int error = 0; 514 # if __NetBSD_Version__ >= 105150000 515 pfil_head_t *ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET); 516 # ifdef USE_INET6 517 pfil_head_t *ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6); 518 # endif 519 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 520 struct pfil_head *ph_ifsync = pfil_head_get(PFIL_TYPE_IFNET, 0); 521 # endif 522 # endif 523 #endif 524 525 SPL_NET(s); 526 527 #if (__NetBSD_Version__ >= 104010000) 528 if (softc->ipf_running > 0) 529 callout_stop(&softc->ipf_slow_ch); 530 #else 531 untimeout(ipf_slowtimer, NULL); 532 #endif /* NetBSD */ 533 534 ipf_checkp = ipf_savep; 535 (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE|FR_INACTIVE); 536 (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE); 537 538 #ifdef INET 539 if (softc->ipf_control_forwarding & 2) 540 ipforwarding = 0; 541 #endif 542 543 #ifdef NETBSD_PF 544 # if (__NetBSD_Version__ >= 104200000) 545 # if __NetBSD_Version__ >= 105110000 546 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 547 (void) pfil_remove_hook((void *)ipf_pfilsync, NULL, 548 PFIL_IFNET, ph_ifsync); 549 # endif 550 551 if (ph_inet != NULL) 552 error = pfil_remove_hook((void *)ipf_check_wrapper, NULL, 553 PFIL_IN|PFIL_OUT, ph_inet); 554 else 555 error = 0; 556 # else 557 error = pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 558 &inetsw[ip_protox[IPPROTO_IP]].pr_pfh); 559 # endif 560 if (error) { 561 SPL_X(s); 562 IPFERROR(130011); 563 return error; 564 } 565 # else 566 pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT); 567 # endif 568 # ifdef USE_INET6 569 # if __NetBSD_Version__ >= 105110000 570 if (ph_inet6 != NULL) 571 error = pfil_remove_hook((void *)ipf_check_wrapper6, NULL, 572 PFIL_IN|PFIL_OUT, ph_inet6); 573 else 574 error = 0; 575 # else 576 error = pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 577 &inetsw[ip_protox[IPPROTO_IPV6]].pr_pfh); 578 # endif 579 if (error) { 580 SPL_X(s); 581 IPFERROR(130012); 582 return error; 583 } 584 # endif 585 #endif 586 SPL_X(s); 587 588 #if (__NetBSD_Version__ >= 499005500) 589 for (i = 0; i < IPL_LOGSIZE; i++) 590 seldestroy(&ipfmain.ipf_selwait[i]); 591 #endif 592 593 ipf_fini_all(softc); 594 595 return 0; 596 } 597 598 599 /* 600 * Filter ioctl interface. 601 */ 602 int 603 ipfioctl(dev_t dev, u_long cmd, 604 #if (__NetBSD_Version__ >= 499001000) 605 void *data, 606 #else 607 caddr_t data, 608 #endif 609 int mode 610 #if (NetBSD >= 199511) 611 # if (__NetBSD_Version__ >= 399001400) 612 , struct lwp *p 613 # if (__NetBSD_Version__ >= 399002000) 614 # define UID(l) kauth_cred_getuid((l)->l_cred) 615 # else 616 # define UID(l) ((l)->l_proc->p_cred->p_ruid) 617 # endif 618 # else 619 , struct proc *p 620 # define UID(p) ((p)->p_cred->p_ruid) 621 # endif 622 #endif 623 ) 624 { 625 int error = 0, unit = 0; 626 SPL_INT(s); 627 628 #if (__NetBSD_Version__ >= 399002000) 629 if ((mode & FWRITE) && 630 kauth_authorize_network(p->l_cred, KAUTH_NETWORK_FIREWALL, 631 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, 632 NULL, NULL)) { 633 ipfmain.ipf_interror = 130005; 634 return EPERM; 635 } 636 #else 637 if ((securelevel >= 2) && (mode & FWRITE)) { 638 ipfmain.ipf_interror = 130001; 639 return EPERM; 640 } 641 #endif 642 643 unit = GET_MINOR(dev); 644 if ((IPL_LOGMAX < unit) || (unit < 0)) { 645 ipfmain.ipf_interror = 130002; 646 return ENXIO; 647 } 648 649 if (ipfmain.ipf_running <= 0) { 650 if (unit != IPL_LOGIPF && cmd != SIOCIPFINTERROR) { 651 ipfmain.ipf_interror = 130003; 652 return EIO; 653 } 654 if (cmd != SIOCIPFGETNEXT && cmd != SIOCIPFGET && 655 cmd != SIOCIPFSET && cmd != SIOCFRENB && 656 cmd != SIOCGETFS && cmd != SIOCGETFF && 657 cmd != SIOCIPFINTERROR) { 658 ipfmain.ipf_interror = 130004; 659 return EIO; 660 } 661 } 662 663 SPL_NET(s); 664 665 error = ipf_ioctlswitch(&ipfmain, unit, data, cmd, mode, UID(p), p); 666 if (error != -1) { 667 SPL_X(s); 668 return error; 669 } 670 671 SPL_X(s); 672 return error; 673 } 674 675 676 /* 677 * ipf_send_reset - this could conceivably be a call to tcp_respond(), but that 678 * requires a large amount of setting up and isn't any more efficient. 679 */ 680 int 681 ipf_send_reset(fr_info_t *fin) 682 { 683 struct tcphdr *tcp, *tcp2; 684 int tlen = 0, hlen; 685 struct mbuf *m; 686 #ifdef USE_INET6 687 ip6_t *ip6; 688 #endif 689 ip_t *ip; 690 691 tcp = fin->fin_dp; 692 if (tcp->th_flags & TH_RST) 693 return -1; /* feedback loop */ 694 695 if (ipf_checkl4sum(fin) == -1) 696 return -1; 697 698 tlen = fin->fin_dlen - (TCP_OFF(tcp) << 2) + 699 ((tcp->th_flags & TH_SYN) ? 1 : 0) + 700 ((tcp->th_flags & TH_FIN) ? 1 : 0); 701 702 #ifdef USE_INET6 703 hlen = (fin->fin_v == 6) ? sizeof(ip6_t) : sizeof(ip_t); 704 #else 705 hlen = sizeof(ip_t); 706 #endif 707 #ifdef MGETHDR 708 MGETHDR(m, M_DONTWAIT, MT_HEADER); 709 #else 710 MGET(m, M_DONTWAIT, MT_HEADER); 711 #endif 712 if (m == NULL) 713 return -1; 714 if (sizeof(*tcp2) + hlen > MHLEN) { 715 MCLGET(m, M_DONTWAIT); 716 if (m == NULL) 717 return -1; 718 if ((m->m_flags & M_EXT) == 0) { 719 FREE_MB_T(m); 720 return -1; 721 } 722 } 723 724 m->m_len = sizeof(*tcp2) + hlen; 725 m->m_data += max_linkhdr; 726 m->m_pkthdr.len = m->m_len; 727 m->m_pkthdr.rcvif = (struct ifnet *)0; 728 ip = mtod(m, struct ip *); 729 bzero((char *)ip, hlen); 730 #ifdef USE_INET6 731 ip6 = (ip6_t *)ip; 732 #endif 733 bzero((char *)ip, sizeof(*tcp2) + hlen); 734 tcp2 = (struct tcphdr *)((char *)ip + hlen); 735 tcp2->th_sport = tcp->th_dport; 736 tcp2->th_dport = tcp->th_sport; 737 738 if (tcp->th_flags & TH_ACK) { 739 tcp2->th_seq = tcp->th_ack; 740 tcp2->th_flags = TH_RST; 741 tcp2->th_ack = 0; 742 } else { 743 tcp2->th_seq = 0; 744 tcp2->th_ack = ntohl(tcp->th_seq); 745 tcp2->th_ack += tlen; 746 tcp2->th_ack = htonl(tcp2->th_ack); 747 tcp2->th_flags = TH_RST|TH_ACK; 748 } 749 tcp2->th_x2 = 0; 750 TCP_OFF_A(tcp2, sizeof(*tcp2) >> 2); 751 tcp2->th_win = tcp->th_win; 752 tcp2->th_sum = 0; 753 tcp2->th_urp = 0; 754 755 #ifdef USE_INET6 756 if (fin->fin_v == 6) { 757 ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow; 758 ip6->ip6_plen = htons(sizeof(struct tcphdr)); 759 ip6->ip6_nxt = IPPROTO_TCP; 760 ip6->ip6_hlim = 0; 761 ip6->ip6_src = fin->fin_dst6.in6; 762 ip6->ip6_dst = fin->fin_src6.in6; 763 tcp2->th_sum = in6_cksum(m, IPPROTO_TCP, 764 sizeof(*ip6), sizeof(*tcp2)); 765 return ipf_send_ip(fin, m); 766 } 767 #endif 768 #ifdef INET 769 ip->ip_p = IPPROTO_TCP; 770 ip->ip_len = htons(sizeof(struct tcphdr)); 771 ip->ip_src.s_addr = fin->fin_daddr; 772 ip->ip_dst.s_addr = fin->fin_saddr; 773 tcp2->th_sum = in_cksum(m, hlen + sizeof(*tcp2)); 774 ip->ip_len = hlen + sizeof(*tcp2); 775 return ipf_send_ip(fin, m); 776 #else 777 return 0; 778 #endif 779 } 780 781 782 /* 783 * Expects ip_len to be in host byte order when called. 784 */ 785 static int 786 ipf_send_ip(fr_info_t *fin, mb_t *m) 787 { 788 fr_info_t fnew; 789 #ifdef INET 790 ip_t *oip; 791 #endif 792 ip_t *ip; 793 int hlen; 794 795 ip = mtod(m, ip_t *); 796 bzero((char *)&fnew, sizeof(fnew)); 797 fnew.fin_main_soft = fin->fin_main_soft; 798 799 IP_V_A(ip, fin->fin_v); 800 switch (fin->fin_v) 801 { 802 #ifdef INET 803 case 4 : 804 oip = fin->fin_ip; 805 hlen = sizeof(*oip); 806 fnew.fin_v = 4; 807 fnew.fin_p = ip->ip_p; 808 fnew.fin_plen = ntohs(ip->ip_len); 809 HTONS(ip->ip_len); 810 IP_HL_A(ip, sizeof(*oip) >> 2); 811 ip->ip_tos = oip->ip_tos; 812 ip->ip_id = ipf_nextipid(fin); 813 ip->ip_off = htons(ip_mtudisc ? IP_DF : 0); 814 ip->ip_ttl = ip_defttl; 815 ip->ip_sum = 0; 816 break; 817 #endif 818 #ifdef USE_INET6 819 case 6 : 820 { 821 ip6_t *ip6 = (ip6_t *)ip; 822 823 ip6->ip6_vfc = 0x60; 824 ip6->ip6_hlim = IPDEFTTL; 825 826 hlen = sizeof(*ip6); 827 fnew.fin_p = ip6->ip6_nxt; 828 fnew.fin_v = 6; 829 fnew.fin_plen = ntohs(ip6->ip6_plen) + hlen; 830 break; 831 } 832 #endif 833 default : 834 return EINVAL; 835 } 836 #ifdef KAME_IPSEC 837 m->m_pkthdr.rcvif = NULL; 838 #endif 839 840 fnew.fin_ifp = fin->fin_ifp; 841 fnew.fin_flx = FI_NOCKSUM; 842 fnew.fin_m = m; 843 fnew.fin_ip = ip; 844 fnew.fin_mp = &m; 845 fnew.fin_hlen = hlen; 846 fnew.fin_dp = (char *)ip + hlen; 847 (void) ipf_makefrip(hlen, ip, &fnew); 848 849 return ipf_fastroute(m, &m, &fnew, NULL); 850 } 851 852 853 int 854 ipf_send_icmp_err(int type, fr_info_t *fin, int dst) 855 { 856 int err, hlen, xtra, iclen, ohlen, avail; 857 struct in_addr dst4; 858 struct icmp *icmp; 859 struct mbuf *m; 860 i6addr_t dst6; 861 void *ifp; 862 #ifdef USE_INET6 863 int code; 864 ip6_t *ip6; 865 #endif 866 ip_t *ip, *ip2; 867 868 if ((type < 0) || (type > ICMP_MAXTYPE)) 869 return -1; 870 871 #ifdef USE_INET6 872 code = fin->fin_icode; 873 if ((code < 0) || (code >= sizeof(icmptoicmp6unreach)/sizeof(int))) 874 return -1; 875 #endif 876 877 if (ipf_checkl4sum(fin) == -1) 878 return -1; 879 #ifdef MGETHDR 880 MGETHDR(m, M_DONTWAIT, MT_HEADER); 881 #else 882 MGET(m, M_DONTWAIT, MT_HEADER); 883 #endif 884 if (m == NULL) 885 return -1; 886 avail = MHLEN; 887 888 xtra = 0; 889 hlen = 0; 890 ohlen = 0; 891 dst4.s_addr = 0; 892 ifp = fin->fin_ifp; 893 if (fin->fin_v == 4) { 894 if ((fin->fin_p == IPPROTO_ICMP) && !(fin->fin_flx & FI_SHORT)) 895 switch (ntohs(fin->fin_data[0]) >> 8) 896 { 897 case ICMP_ECHO : 898 case ICMP_TSTAMP : 899 case ICMP_IREQ : 900 case ICMP_MASKREQ : 901 break; 902 default : 903 FREE_MB_T(m); 904 return 0; 905 } 906 907 if (dst == 0) { 908 if (ipf_ifpaddr(&ipfmain, 4, FRI_NORMAL, ifp, 909 &dst6, NULL) == -1) { 910 FREE_MB_T(m); 911 return -1; 912 } 913 dst4 = dst6.in4; 914 } else 915 dst4.s_addr = fin->fin_daddr; 916 917 hlen = sizeof(ip_t); 918 ohlen = fin->fin_hlen; 919 iclen = hlen + offsetof(struct icmp, icmp_ip) + ohlen; 920 if (fin->fin_hlen < fin->fin_plen) 921 xtra = MIN(fin->fin_dlen, 8); 922 else 923 xtra = 0; 924 } 925 926 #ifdef USE_INET6 927 else if (fin->fin_v == 6) { 928 hlen = sizeof(ip6_t); 929 ohlen = sizeof(ip6_t); 930 iclen = hlen + offsetof(struct icmp, icmp_ip) + ohlen; 931 type = icmptoicmp6types[type]; 932 if (type == ICMP6_DST_UNREACH) 933 code = icmptoicmp6unreach[code]; 934 935 if (iclen + max_linkhdr + fin->fin_plen > avail) { 936 MCLGET(m, M_DONTWAIT); 937 if (m == NULL) 938 return -1; 939 if ((m->m_flags & M_EXT) == 0) { 940 FREE_MB_T(m); 941 return -1; 942 } 943 avail = MCLBYTES; 944 } 945 xtra = MIN(fin->fin_plen, avail - iclen - max_linkhdr); 946 xtra = MIN(xtra, IPV6_MMTU - iclen); 947 if (dst == 0) { 948 if (ipf_ifpaddr(&ipfmain, 6, FRI_NORMAL, ifp, 949 &dst6, NULL) == -1) { 950 FREE_MB_T(m); 951 return -1; 952 } 953 } else 954 dst6 = fin->fin_dst6; 955 } 956 #endif 957 else { 958 FREE_MB_T(m); 959 return -1; 960 } 961 962 avail -= (max_linkhdr + iclen); 963 if (avail < 0) { 964 FREE_MB_T(m); 965 return -1; 966 } 967 if (xtra > avail) 968 xtra = avail; 969 iclen += xtra; 970 m->m_data += max_linkhdr; 971 m->m_pkthdr.rcvif = (struct ifnet *)0; 972 m->m_pkthdr.len = iclen; 973 m->m_len = iclen; 974 ip = mtod(m, ip_t *); 975 icmp = (struct icmp *)((char *)ip + hlen); 976 ip2 = (ip_t *)&icmp->icmp_ip; 977 978 icmp->icmp_type = type; 979 icmp->icmp_code = fin->fin_icode; 980 icmp->icmp_cksum = 0; 981 #ifdef icmp_nextmtu 982 if (type == ICMP_UNREACH && fin->fin_icode == ICMP_UNREACH_NEEDFRAG) { 983 if (fin->fin_mtu != 0) { 984 icmp->icmp_nextmtu = htons(fin->fin_mtu); 985 986 } else if (ifp != NULL) { 987 icmp->icmp_nextmtu = htons(GETIFMTU_4(ifp)); 988 989 } else { /* make up a number... */ 990 icmp->icmp_nextmtu = htons(fin->fin_plen - 20); 991 } 992 } 993 #endif 994 995 bcopy((char *)fin->fin_ip, (char *)ip2, ohlen); 996 997 #if defined(M_CSUM_IPv4) 998 /* 999 * Clear any in-bound checksum flags for this packet. 1000 */ 1001 m->m_pkthdr.csuminfo = 0; 1002 #endif /* __NetBSD__ && M_CSUM_IPv4 */ 1003 1004 #ifdef USE_INET6 1005 ip6 = (ip6_t *)ip; 1006 if (fin->fin_v == 6) { 1007 ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow; 1008 ip6->ip6_plen = htons(iclen - hlen); 1009 ip6->ip6_nxt = IPPROTO_ICMPV6; 1010 ip6->ip6_hlim = 0; 1011 ip6->ip6_src = dst6.in6; 1012 ip6->ip6_dst = fin->fin_src6.in6; 1013 if (xtra > 0) 1014 bcopy((char *)fin->fin_ip + ohlen, 1015 (char *)&icmp->icmp_ip + ohlen, xtra); 1016 icmp->icmp_cksum = in6_cksum(m, IPPROTO_ICMPV6, 1017 sizeof(*ip6), iclen - hlen); 1018 } else 1019 #endif 1020 { 1021 ip->ip_p = IPPROTO_ICMP; 1022 ip->ip_src.s_addr = dst4.s_addr; 1023 ip->ip_dst.s_addr = fin->fin_saddr; 1024 1025 if (xtra > 0) 1026 bcopy((char *)fin->fin_ip + ohlen, 1027 (char *)&icmp->icmp_ip + ohlen, xtra); 1028 icmp->icmp_cksum = ipf_cksum((u_short *)icmp, 1029 sizeof(*icmp) + 8); 1030 ip->ip_len = iclen; 1031 ip->ip_p = IPPROTO_ICMP; 1032 } 1033 err = ipf_send_ip(fin, m); 1034 return err; 1035 } 1036 1037 1038 /* 1039 * m0 - pointer to mbuf where the IP packet starts 1040 * mpp - pointer to the mbuf pointer that is the start of the mbuf chain 1041 */ 1042 int 1043 ipf_fastroute(mb_t *m0, mb_t **mpp, fr_info_t *fin, frdest_t *fdp) 1044 { 1045 register struct ip *ip, *mhip; 1046 register struct mbuf *m = *mpp; 1047 register struct route *ro; 1048 int len, off, error = 0, hlen, code; 1049 struct ifnet *ifp, *sifp; 1050 ipf_main_softc_t *softc; 1051 #if __NetBSD_Version__ >= 499001100 1052 union { 1053 struct sockaddr dst; 1054 struct sockaddr_in dst4; 1055 } u; 1056 #else 1057 struct sockaddr_in *dst4; 1058 #endif 1059 struct sockaddr *dst; 1060 u_short ip_off, ip_len; 1061 struct route iproute; 1062 struct rtentry *rt; 1063 frdest_t node; 1064 frentry_t *fr; 1065 1066 if (fin->fin_v == 6) { 1067 #ifdef USE_INET6 1068 error = ipf_fastroute6(m0, mpp, fin, fdp); 1069 #else 1070 error = EPROTONOSUPPORT; 1071 #endif 1072 if ((error != 0) && (*mpp != NULL)) 1073 FREE_MB_T(*mpp); 1074 return error; 1075 } 1076 #ifndef INET 1077 FREE_MB_T(*mpp); 1078 return EPROTONOSUPPORT; 1079 #else 1080 1081 hlen = fin->fin_hlen; 1082 ip = mtod(m0, struct ip *); 1083 softc = fin->fin_main_soft; 1084 rt = NULL; 1085 ifp = NULL; 1086 1087 # if defined(M_CSUM_IPv4) 1088 /* 1089 * Clear any in-bound checksum flags for this packet. 1090 */ 1091 m0->m_pkthdr.csuminfo = 0; 1092 # endif /* __NetBSD__ && M_CSUM_IPv4 */ 1093 1094 /* 1095 * Route packet. 1096 */ 1097 ro = &iproute; 1098 memset(ro, 0, sizeof(*ro)); 1099 fr = fin->fin_fr; 1100 1101 if ((fr != NULL) && !(fr->fr_flags & FR_KEEPSTATE) && (fdp != NULL) && 1102 (fdp->fd_type == FRD_DSTLIST)) { 1103 if (ipf_dstlist_select_node(fin, fdp->fd_ptr, NULL, &node) == 0) 1104 fdp = &node; 1105 } 1106 if (fdp != NULL) 1107 ifp = fdp->fd_ptr; 1108 else 1109 ifp = fin->fin_ifp; 1110 1111 if ((ifp == NULL) && ((fr == NULL) || !(fr->fr_flags & FR_FASTROUTE))) { 1112 error = -2; 1113 goto bad; 1114 } 1115 1116 # if __NetBSD_Version__ >= 499001100 1117 if ((fdp != NULL) && (fdp->fd_ip.s_addr != 0)) 1118 sockaddr_in_init(&u.dst4, &fdp->fd_ip, 0); 1119 else 1120 sockaddr_in_init(&u.dst4, &ip->ip_dst, 0); 1121 dst = &u.dst; 1122 rtcache_setdst(ro, dst); 1123 rt = rtcache_init(ro); 1124 # else 1125 dst4 = (struct sockaddr_in *)&ro->ro_dst; 1126 dst = (struct sockaddr *)dst4; 1127 dst4->sin_family = AF_INET; 1128 dst4->sin_addr = ip->ip_dst; 1129 1130 if ((fdp != NULL) && (fdp->fd_ip.s_addr != 0)) 1131 dst4->sin_addr = fdp->fd_ip; 1132 1133 dst4->sin_len = sizeof(*dst); 1134 rtalloc(ro); 1135 rt = ro->ro_rt; 1136 # endif 1137 if ((ifp == NULL) && (rt != NULL)) 1138 ifp = rt->rt_ifp; 1139 if ((rt == NULL) || (ifp == NULL)) { 1140 #ifdef INET 1141 if (in_localaddr(ip->ip_dst)) 1142 error = EHOSTUNREACH; 1143 else 1144 #endif 1145 error = ENETUNREACH; 1146 goto bad; 1147 } 1148 1149 1150 if (rt->rt_flags & RTF_GATEWAY) 1151 dst = rt->rt_gateway; 1152 1153 rt->rt_use++; 1154 1155 /* 1156 * For input packets which are being "fastrouted", they won't 1157 * go back through output filtering and miss their chance to get 1158 * NAT'd and counted. Duplicated packets aren't considered to be 1159 * part of the normal packet stream, so do not NAT them or pass 1160 * them through stateful checking, etc. 1161 */ 1162 if ((fdp != &fr->fr_dif) && (fin->fin_out == 0)) { 1163 sifp = fin->fin_ifp; 1164 fin->fin_ifp = ifp; 1165 fin->fin_out = 1; 1166 (void) ipf_acctpkt(fin, NULL); 1167 fin->fin_fr = NULL; 1168 if (!fr || !(fr->fr_flags & FR_RETMASK)) { 1169 u_32_t pass; 1170 1171 (void) ipf_state_check(fin, &pass); 1172 } 1173 1174 switch (ipf_nat_checkout(fin, NULL)) 1175 { 1176 case 0 : 1177 break; 1178 case 1 : 1179 ip->ip_sum = 0; 1180 break; 1181 case -1 : 1182 error = -1; 1183 goto bad; 1184 break; 1185 } 1186 1187 fin->fin_ifp = sifp; 1188 fin->fin_out = 0; 1189 } else 1190 ip->ip_sum = 0; 1191 /* 1192 * If small enough for interface, can just send directly. 1193 */ 1194 m->m_pkthdr.rcvif = ifp; 1195 1196 ip_len = ntohs(ip->ip_len); 1197 if (ip_len <= ifp->if_mtu) { 1198 # if defined(M_CSUM_IPv4) 1199 # if (__NetBSD_Version__ >= 105009999) 1200 if (ifp->if_csum_flags_tx & M_CSUM_IPv4) 1201 m->m_pkthdr.csuminfo |= M_CSUM_IPv4; 1202 # else 1203 if (ifp->if_capabilities & IFCAP_CSUM_IPv4) 1204 m->m_pkthdr.csuminfo |= M_CSUM_IPv4; 1205 # endif /* (__NetBSD_Version__ >= 105009999) */ 1206 else if (ip->ip_sum == 0) 1207 ip->ip_sum = in_cksum(m, hlen); 1208 # else 1209 if (!ip->ip_sum) 1210 ip->ip_sum = in_cksum(m, hlen); 1211 # endif /* M_CSUM_IPv4 */ 1212 1213 KERNEL_LOCK(1, NULL); 1214 error = (*ifp->if_output)(ifp, m, dst, rt); 1215 KERNEL_UNLOCK_ONE(NULL); 1216 goto done; 1217 } 1218 1219 /* 1220 * Too large for interface; fragment if possible. 1221 * Must be able to put at least 8 bytes per fragment. 1222 */ 1223 ip_off = ntohs(ip->ip_off); 1224 if (ip_off & IP_DF) { 1225 error = EMSGSIZE; 1226 goto bad; 1227 } 1228 len = (ifp->if_mtu - hlen) &~ 7; 1229 if (len < 8) { 1230 error = EMSGSIZE; 1231 goto bad; 1232 } 1233 1234 { 1235 int mhlen, firstlen = len; 1236 struct mbuf **mnext = &m->m_act; 1237 1238 /* 1239 * Loop through length of segment after first fragment, 1240 * make new header and copy data of each part and link onto chain. 1241 */ 1242 m0 = m; 1243 mhlen = sizeof (struct ip); 1244 for (off = hlen + len; off < ip_len; off += len) { 1245 # ifdef MGETHDR 1246 MGETHDR(m, M_DONTWAIT, MT_HEADER); 1247 # else 1248 MGET(m, M_DONTWAIT, MT_HEADER); 1249 # endif 1250 if (m == 0) { 1251 m = m0; 1252 error = ENOBUFS; 1253 goto bad; 1254 } 1255 m->m_data += max_linkhdr; 1256 mhip = mtod(m, struct ip *); 1257 bcopy((char *)ip, (char *)mhip, sizeof(*ip)); 1258 #ifdef INET 1259 if (hlen > sizeof (struct ip)) { 1260 mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip); 1261 IP_HL_A(mhip, mhlen >> 2); 1262 } 1263 #endif 1264 m->m_len = mhlen; 1265 mhip->ip_off = ((off - hlen) >> 3) + ip_off; 1266 if (off + len >= ip_len) 1267 len = ip_len - off; 1268 else 1269 mhip->ip_off |= IP_MF; 1270 mhip->ip_len = htons((u_short)(len + mhlen)); 1271 m->m_next = m_copy(m0, off, len); 1272 if (m->m_next == 0) { 1273 error = ENOBUFS; /* ??? */ 1274 goto sendorfree; 1275 } 1276 m->m_pkthdr.len = mhlen + len; 1277 m->m_pkthdr.rcvif = NULL; 1278 mhip->ip_off = htons((u_short)mhip->ip_off); 1279 mhip->ip_sum = 0; 1280 #ifdef INET 1281 mhip->ip_sum = in_cksum(m, mhlen); 1282 #endif 1283 *mnext = m; 1284 mnext = &m->m_act; 1285 } 1286 /* 1287 * Update first fragment by trimming what's been copied out 1288 * and updating header, then send each fragment (in order). 1289 */ 1290 m_adj(m0, hlen + firstlen - ip_len); 1291 ip->ip_len = htons((u_short)(hlen + firstlen)); 1292 ip->ip_off = htons((u_short)IP_MF); 1293 ip->ip_sum = 0; 1294 #ifdef INET 1295 ip->ip_sum = in_cksum(m0, hlen); 1296 #endif 1297 sendorfree: 1298 for (m = m0; m; m = m0) { 1299 m0 = m->m_act; 1300 m->m_act = 0; 1301 if (error == 0) { 1302 KERNEL_LOCK(1, NULL); 1303 error = (*ifp->if_output)(ifp, m, dst, rt); 1304 KERNEL_UNLOCK_ONE(NULL); 1305 } else { 1306 FREE_MB_T(m); 1307 } 1308 } 1309 } 1310 done: 1311 if (!error) 1312 softc->ipf_frouteok[0]++; 1313 else 1314 softc->ipf_frouteok[1]++; 1315 1316 # if __NetBSD_Version__ >= 499001100 1317 rtcache_free(ro); 1318 # else 1319 if (rt) { 1320 RTFREE(rt); 1321 } 1322 # endif 1323 return error; 1324 bad: 1325 if (error == EMSGSIZE) { 1326 sifp = fin->fin_ifp; 1327 code = fin->fin_icode; 1328 fin->fin_icode = ICMP_UNREACH_NEEDFRAG; 1329 fin->fin_ifp = ifp; 1330 (void) ipf_send_icmp_err(ICMP_UNREACH, fin, 1); 1331 fin->fin_ifp = sifp; 1332 fin->fin_icode = code; 1333 } 1334 FREE_MB_T(m); 1335 goto done; 1336 #endif /* INET */ 1337 } 1338 1339 1340 #if defined(USE_INET6) 1341 /* 1342 * This is the IPv6 specific fastroute code. It doesn't clean up the mbuf's 1343 * or ensure that it is an IPv6 packet that is being forwarded, those are 1344 * expected to be done by the called (ipf_fastroute). 1345 */ 1346 static int 1347 ipf_fastroute6(struct mbuf *m0, struct mbuf **mpp, fr_info_t *fin, 1348 frdest_t *fdp) 1349 { 1350 # if __NetBSD_Version__ >= 499001100 1351 struct route ip6route; 1352 const struct sockaddr *dst; 1353 union { 1354 struct sockaddr dst; 1355 struct sockaddr_in6 dst6; 1356 } u; 1357 struct route *ro; 1358 # else 1359 struct route_in6 ip6route; 1360 struct sockaddr_in6 *dst6; 1361 struct route_in6 *ro; 1362 # endif 1363 struct rtentry *rt; 1364 struct ifnet *ifp; 1365 u_long mtu; 1366 int error; 1367 1368 error = 0; 1369 ro = &ip6route; 1370 1371 if (fdp != NULL) 1372 ifp = fdp->fd_ptr; 1373 else 1374 ifp = fin->fin_ifp; 1375 memset(ro, 0, sizeof(*ro)); 1376 # if __NetBSD_Version__ >= 499001100 1377 if (fdp != NULL && IP6_NOTZERO(&fdp->fd_ip6)) 1378 sockaddr_in6_init(&u.dst6, &fdp->fd_ip6.in6, 0, 0, 0); 1379 else 1380 sockaddr_in6_init(&u.dst6, &fin->fin_fi.fi_dst.in6, 0, 0, 0); 1381 dst = &u.dst; 1382 rtcache_setdst(ro, dst); 1383 1384 rt = rtcache_init(ro); 1385 if ((ifp == NULL) && (rt != NULL)) 1386 ifp = rt->rt_ifp; 1387 # else 1388 dst6 = (struct sockaddr_in6 *)&ro->ro_dst; 1389 dst6->sin6_family = AF_INET6; 1390 dst6->sin6_len = sizeof(struct sockaddr_in6); 1391 dst6->sin6_addr = fin->fin_fi.fi_dst.in6; 1392 1393 if (fdp != NULL) { 1394 if (IP6_NOTZERO(&fdp->fd_ip6)) 1395 dst6->sin6_addr = fdp->fd_ip6.in6; 1396 } 1397 1398 rtalloc((struct route *)ro); 1399 1400 if ((ifp == NULL) && (ro->ro_rt != NULL)) 1401 ifp = ro->ro_rt->rt_ifp; 1402 rt = ro->ro_rt; 1403 # endif 1404 if ((rt == NULL) || (ifp == NULL)) { 1405 1406 error = EHOSTUNREACH; 1407 goto bad; 1408 } 1409 1410 /* KAME */ 1411 # if __NetBSD_Version__ >= 499001100 1412 if (IN6_IS_ADDR_LINKLOCAL(&u.dst6.sin6_addr)) 1413 u.dst6.sin6_addr.s6_addr16[1] = htons(ifp->if_index); 1414 # else 1415 if (IN6_IS_ADDR_LINKLOCAL(&dst6->sin6_addr)) 1416 dst6->sin6_addr.s6_addr16[1] = htons(ifp->if_index); 1417 # endif 1418 1419 { 1420 # if (__NetBSD_Version__ >= 106010000) && !defined(IN6_LINKMTU) 1421 struct in6_ifextra *ife; 1422 # endif 1423 if (rt->rt_flags & RTF_GATEWAY) 1424 # if __NetBSD_Version__ >= 499001100 1425 dst = rt->rt_gateway; 1426 # else 1427 dst6 = (struct sockaddr_in6 *)rt->rt_gateway; 1428 # endif 1429 rt->rt_use++; 1430 1431 /* Determine path MTU. */ 1432 # if (__NetBSD_Version__ <= 106009999) 1433 mtu = nd_ifinfo[ifp->if_index].linkmtu; 1434 # else 1435 # ifdef IN6_LINKMTU 1436 mtu = IN6_LINKMTU(ifp); 1437 # else 1438 ife = (struct in6_ifextra *)(ifp)->if_afdata[AF_INET6]; 1439 mtu = ife->nd_ifinfo[ifp->if_index].linkmtu; 1440 # endif 1441 # endif 1442 if ((error == 0) && (m0->m_pkthdr.len <= mtu)) { 1443 # if __NetBSD_Version__ >= 499001100 1444 error = nd6_output(ifp, ifp, m0, satocsin6(dst), rt); 1445 # else 1446 error = nd6_output(ifp, ifp, m0, dst6, rt); 1447 # endif 1448 } else { 1449 error = EMSGSIZE; 1450 } 1451 } 1452 bad: 1453 # if __NetBSD_Version__ >= 499001100 1454 rtcache_free(ro); 1455 # else 1456 if (ro->ro_rt != NULL) { 1457 RTFREE(((struct route *)ro)->ro_rt); 1458 } 1459 # endif 1460 return error; 1461 } 1462 #endif /* INET6 */ 1463 1464 1465 int 1466 ipf_verifysrc(fr_info_t *fin) 1467 { 1468 #if __NetBSD_Version__ >= 499001100 1469 union { 1470 struct sockaddr dst; 1471 struct sockaddr_in dst4; 1472 } u; 1473 struct rtentry *rt; 1474 #else 1475 struct sockaddr_in *dst; 1476 #endif 1477 struct route iproute; 1478 int rc; 1479 1480 #if __NetBSD_Version__ >= 499001100 1481 sockaddr_in_init(&u.dst4, &fin->fin_src, 0); 1482 rtcache_setdst(&iproute, &u.dst); 1483 rt = rtcache_init(&iproute); 1484 if (rt == NULL) 1485 rc = 0; 1486 else 1487 rc = (fin->fin_ifp == rt->rt_ifp); 1488 rtcache_free(&iproute); 1489 #else 1490 dst = (struct sockaddr_in *)&iproute.ro_dst; 1491 dst->sin_len = sizeof(*dst); 1492 dst->sin_family = AF_INET; 1493 dst->sin_addr = fin->fin_src; 1494 rtalloc(&iproute); 1495 if (iproute.ro_rt == NULL) 1496 return 0; 1497 rc = (fin->fin_ifp == iproute.ro_rt->rt_ifp); 1498 RTFREE(iproute.ro_rt); 1499 #endif 1500 return rc; 1501 } 1502 1503 1504 /* 1505 * return the first IP Address associated with an interface 1506 */ 1507 int 1508 ipf_ifpaddr(ipf_main_softc_t *softc, int v, int atype, void *ifptr, 1509 i6addr_t *inp, i6addr_t *inpmask) 1510 { 1511 #ifdef USE_INET6 1512 struct in6_addr *inp6 = NULL; 1513 #endif 1514 struct sockaddr *sock, *mask; 1515 struct sockaddr_in *sin; 1516 struct ifaddr *ifa; 1517 struct ifnet *ifp; 1518 1519 if ((ifptr == NULL) || (ifptr == (void *)-1)) 1520 return -1; 1521 1522 ifp = ifptr; 1523 mask = NULL; 1524 1525 if (v == 4) 1526 inp->in4.s_addr = 0; 1527 #ifdef USE_INET6 1528 else if (v == 6) 1529 bzero((char *)inp, sizeof(*inp)); 1530 #endif 1531 1532 ifa = IFADDR_FIRST(ifp); 1533 sock = ifa ? ifa->ifa_addr : NULL; 1534 while (sock != NULL && ifa != NULL) { 1535 sin = (struct sockaddr_in *)sock; 1536 if ((v == 4) && (sin->sin_family == AF_INET)) 1537 break; 1538 #ifdef USE_INET6 1539 if ((v == 6) && (sin->sin_family == AF_INET6)) { 1540 inp6 = &((struct sockaddr_in6 *)sin)->sin6_addr; 1541 if (!IN6_IS_ADDR_LINKLOCAL(inp6) && 1542 !IN6_IS_ADDR_LOOPBACK(inp6)) 1543 break; 1544 } 1545 #endif 1546 ifa = IFADDR_NEXT(ifa); 1547 if (ifa != NULL) 1548 sock = ifa->ifa_addr; 1549 } 1550 if (ifa == NULL || sock == NULL) 1551 return -1; 1552 1553 mask = ifa->ifa_netmask; 1554 if (atype == FRI_BROADCAST) 1555 sock = ifa->ifa_broadaddr; 1556 else if (atype == FRI_PEERADDR) 1557 sock = ifa->ifa_dstaddr; 1558 1559 #ifdef USE_INET6 1560 if (v == 6) 1561 return ipf_ifpfillv6addr(atype, (struct sockaddr_in6 *)sock, 1562 (struct sockaddr_in6 *)mask, 1563 inp, inpmask); 1564 #endif 1565 return ipf_ifpfillv4addr(atype, (struct sockaddr_in *)sock, 1566 (struct sockaddr_in *)mask, 1567 &inp->in4, &inpmask->in4); 1568 } 1569 1570 1571 u_32_t 1572 ipf_newisn(fr_info_t *fin) 1573 { 1574 #if __NetBSD_Version__ >= 105190000 /* 1.5T */ 1575 size_t asz; 1576 1577 if (fin->fin_v == 4) 1578 asz = sizeof(struct in_addr); 1579 else if (fin->fin_v == 6) 1580 asz = sizeof(fin->fin_src); 1581 else /* XXX: no way to return error */ 1582 return 0; 1583 #ifdef INET 1584 return tcp_new_iss1((void *)&fin->fin_src, (void *)&fin->fin_dst, 1585 fin->fin_sport, fin->fin_dport, asz, 0); 1586 #else 1587 return ENOSYS; 1588 #endif 1589 #else 1590 static int iss_seq_off = 0; 1591 u_char hash[16]; 1592 u_32_t newiss; 1593 MD5_CTX ctx; 1594 1595 /* 1596 * Compute the base value of the ISS. It is a hash 1597 * of (saddr, sport, daddr, dport, secret). 1598 */ 1599 MD5Init(&ctx); 1600 1601 MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_src, 1602 sizeof(fin->fin_fi.fi_src)); 1603 MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_dst, 1604 sizeof(fin->fin_fi.fi_dst)); 1605 MD5Update(&ctx, (u_char *) &fin->fin_dat, sizeof(fin->fin_dat)); 1606 1607 MD5Update(&ctx, ipf_iss_secret, sizeof(ipf_iss_secret)); 1608 1609 MD5Final(hash, &ctx); 1610 1611 memcpy(&newiss, hash, sizeof(newiss)); 1612 1613 /* 1614 * Now increment our "timer", and add it in to 1615 * the computed value. 1616 * 1617 * XXX Use `addin'? 1618 * XXX TCP_ISSINCR too large to use? 1619 */ 1620 iss_seq_off += 0x00010000; 1621 newiss += iss_seq_off; 1622 return newiss; 1623 #endif 1624 } 1625 1626 1627 /* ------------------------------------------------------------------------ */ 1628 /* Function: ipf_nextipid */ 1629 /* Returns: int - 0 == success, -1 == error (packet should be droppped) */ 1630 /* Parameters: fin(I) - pointer to packet information */ 1631 /* */ 1632 /* Returns the next IPv4 ID to use for this packet. */ 1633 /* ------------------------------------------------------------------------ */ 1634 u_short 1635 ipf_nextipid(fr_info_t *fin) 1636 { 1637 #ifdef USE_MUTEXES 1638 ipf_main_softc_t *softc = fin->fin_main_soft; 1639 #endif 1640 u_short id; 1641 1642 MUTEX_ENTER(&softc->ipf_rw); 1643 id = ipid++; 1644 MUTEX_EXIT(&softc->ipf_rw); 1645 1646 return id; 1647 } 1648 1649 1650 EXTERN_INLINE int 1651 ipf_checkv4sum(fr_info_t *fin) 1652 { 1653 #ifdef M_CSUM_TCP_UDP_BAD 1654 int manual, pflag, cflags, active; 1655 mb_t *m; 1656 1657 if ((fin->fin_flx & FI_NOCKSUM) != 0) 1658 return 0; 1659 1660 if ((fin->fin_flx & FI_SHORT) != 0) 1661 return 1; 1662 1663 if (fin->fin_cksum != FI_CK_NEEDED) 1664 return (fin->fin_cksum > FI_CK_NEEDED) ? 0 : -1; 1665 1666 manual = 0; 1667 m = fin->fin_m; 1668 if (m == NULL) { 1669 manual = 1; 1670 goto skipauto; 1671 } 1672 1673 switch (fin->fin_p) 1674 { 1675 case IPPROTO_UDP : 1676 pflag = M_CSUM_UDPv4; 1677 break; 1678 case IPPROTO_TCP : 1679 pflag = M_CSUM_TCPv4; 1680 break; 1681 default : 1682 pflag = 0; 1683 manual = 1; 1684 break; 1685 } 1686 1687 active = ((struct ifnet *)fin->fin_ifp)->if_csum_flags_rx & pflag; 1688 active |= M_CSUM_TCP_UDP_BAD | M_CSUM_DATA; 1689 cflags = m->m_pkthdr.csum_flags & active; 1690 1691 if (pflag != 0) { 1692 if (cflags == (pflag | M_CSUM_TCP_UDP_BAD)) { 1693 fin->fin_flx |= FI_BAD; 1694 fin->fin_cksum = FI_CK_BAD; 1695 } else if (cflags == (pflag | M_CSUM_DATA)) { 1696 if ((m->m_pkthdr.csum_data ^ 0xffff) != 0) { 1697 fin->fin_flx |= FI_BAD; 1698 fin->fin_cksum = FI_CK_BAD; 1699 } else { 1700 fin->fin_cksum = FI_CK_SUMOK; 1701 } 1702 } else if (cflags == pflag) { 1703 fin->fin_cksum = FI_CK_SUMOK; 1704 } else { 1705 manual = 1; 1706 } 1707 } 1708 skipauto: 1709 if (manual != 0) { 1710 if (ipf_checkl4sum(fin) == -1) { 1711 fin->fin_flx |= FI_BAD; 1712 return -1; 1713 } 1714 } 1715 #else 1716 if (ipf_checkl4sum(fin) == -1) { 1717 fin->fin_flx |= FI_BAD; 1718 return -1; 1719 } 1720 #endif 1721 return 0; 1722 } 1723 1724 1725 #ifdef USE_INET6 1726 EXTERN_INLINE int 1727 ipf_checkv6sum(fr_info_t *fin) 1728 { 1729 # ifdef M_CSUM_TCP_UDP_BAD 1730 int manual, pflag, cflags, active; 1731 mb_t *m; 1732 1733 if ((fin->fin_flx & FI_NOCKSUM) != 0) 1734 return 0; 1735 1736 if ((fin->fin_flx & FI_SHORT) != 0) 1737 return 1; 1738 1739 if (fin->fin_cksum != FI_CK_SUMOK) 1740 return (fin->fin_cksum > FI_CK_NEEDED) ? 0 : -1; 1741 1742 1743 manual = 0; 1744 m = fin->fin_m; 1745 1746 switch (fin->fin_p) 1747 { 1748 case IPPROTO_UDP : 1749 pflag = M_CSUM_UDPv6; 1750 break; 1751 case IPPROTO_TCP : 1752 pflag = M_CSUM_TCPv6; 1753 break; 1754 default : 1755 pflag = 0; 1756 manual = 1; 1757 break; 1758 } 1759 1760 active = ((struct ifnet *)fin->fin_ifp)->if_csum_flags_rx & pflag; 1761 active |= M_CSUM_TCP_UDP_BAD | M_CSUM_DATA; 1762 cflags = m->m_pkthdr.csum_flags & active; 1763 1764 if (pflag != 0) { 1765 if (cflags == (pflag | M_CSUM_TCP_UDP_BAD)) { 1766 fin->fin_flx |= FI_BAD; 1767 } else if (cflags == (pflag | M_CSUM_DATA)) { 1768 if ((m->m_pkthdr.csum_data ^ 0xffff) != 0) 1769 fin->fin_flx |= FI_BAD; 1770 } else if (cflags == pflag) { 1771 ; 1772 } else { 1773 manual = 1; 1774 } 1775 } 1776 if (manual != 0) { 1777 if (ipf_checkl4sum(fin) == -1) { 1778 fin->fin_flx |= FI_BAD; 1779 return -1; 1780 } 1781 } 1782 # else 1783 if (ipf_checkl4sum(fin) == -1) { 1784 fin->fin_flx |= FI_BAD; 1785 return -1; 1786 } 1787 # endif 1788 return 0; 1789 } 1790 #endif /* USE_INET6 */ 1791 1792 1793 size_t 1794 mbufchainlen(struct mbuf *m0) 1795 { 1796 size_t len; 1797 1798 if ((m0->m_flags & M_PKTHDR) != 0) { 1799 len = m0->m_pkthdr.len; 1800 } else { 1801 struct mbuf *m; 1802 1803 for (m = m0, len = 0; m != NULL; m = m->m_next) 1804 len += m->m_len; 1805 } 1806 return len; 1807 } 1808 1809 1810 /* ------------------------------------------------------------------------ */ 1811 /* Function: ipf_pullup */ 1812 /* Returns: NULL == pullup failed, else pointer to protocol header */ 1813 /* Parameters: xmin(I)- pointer to buffer where data packet starts */ 1814 /* fin(I) - pointer to packet information */ 1815 /* len(I) - number of bytes to pullup */ 1816 /* */ 1817 /* Attempt to move at least len bytes (from the start of the buffer) into a */ 1818 /* single buffer for ease of access. Operating system native functions are */ 1819 /* used to manage buffers - if necessary. If the entire packet ends up in */ 1820 /* a single buffer, set the FI_COALESCE flag even though ipf_coalesce() has */ 1821 /* not been called. Both fin_ip and fin_dp are updated before exiting _IF_ */ 1822 /* and ONLY if the pullup succeeds. */ 1823 /* */ 1824 /* We assume that 'xmin' is a pointer to a buffer that is part of the chain */ 1825 /* of buffers that starts at *fin->fin_mp. */ 1826 /* ------------------------------------------------------------------------ */ 1827 void * 1828 ipf_pullup(mb_t *xmin, fr_info_t *fin, int len) 1829 { 1830 int dpoff, ipoff; 1831 mb_t *m = xmin; 1832 char *ip; 1833 1834 if (m == NULL) 1835 return NULL; 1836 1837 ip = (char *)fin->fin_ip; 1838 if ((fin->fin_flx & FI_COALESCE) != 0) 1839 return ip; 1840 1841 ipoff = fin->fin_ipoff; 1842 if (fin->fin_dp != NULL) 1843 dpoff = (char *)fin->fin_dp - (char *)ip; 1844 else 1845 dpoff = 0; 1846 1847 if (M_LEN(m) < len) { 1848 mb_t *n = *fin->fin_mp; 1849 /* 1850 * Assume that M_PKTHDR is set and just work with what is left 1851 * rather than check.. 1852 * Should not make any real difference, anyway. 1853 */ 1854 if (m != n) { 1855 /* 1856 * Record the mbuf that points to the mbuf that we're 1857 * about to go to work on so that we can update the 1858 * m_next appropriately later. 1859 */ 1860 for (; n->m_next != m; n = n->m_next) 1861 ; 1862 } else { 1863 n = NULL; 1864 } 1865 1866 #ifdef MHLEN 1867 if (len > MHLEN) 1868 #else 1869 if (len > MLEN) 1870 #endif 1871 { 1872 #ifdef HAVE_M_PULLDOWN 1873 if (m_pulldown(m, 0, len, NULL) == NULL) 1874 m = NULL; 1875 #else 1876 FREE_MB_T(*fin->fin_mp); 1877 m = NULL; 1878 n = NULL; 1879 #endif 1880 } else 1881 { 1882 m = m_pullup(m, len); 1883 } 1884 if (n != NULL) 1885 n->m_next = m; 1886 if (m == NULL) { 1887 /* 1888 * When n is non-NULL, it indicates that m pointed to 1889 * a sub-chain (tail) of the mbuf and that the head 1890 * of this chain has not yet been free'd. 1891 */ 1892 if (n != NULL) { 1893 FREE_MB_T(*fin->fin_mp); 1894 } 1895 1896 *fin->fin_mp = NULL; 1897 fin->fin_m = NULL; 1898 return NULL; 1899 } 1900 1901 if (n == NULL) 1902 *fin->fin_mp = m; 1903 1904 while (M_LEN(m) == 0) { 1905 m = m->m_next; 1906 } 1907 fin->fin_m = m; 1908 ip = MTOD(m, char *) + ipoff; 1909 1910 fin->fin_ip = (ip_t *)ip; 1911 if (fin->fin_dp != NULL) 1912 fin->fin_dp = (char *)fin->fin_ip + dpoff; 1913 if (fin->fin_fraghdr != NULL) 1914 fin->fin_fraghdr = (char *)ip + 1915 ((char *)fin->fin_fraghdr - 1916 (char *)fin->fin_ip); 1917 } 1918 1919 if (len == fin->fin_plen) 1920 fin->fin_flx |= FI_COALESCE; 1921 return ip; 1922 } 1923 1924 1925 int 1926 ipf_inject(fr_info_t *fin, mb_t *m) 1927 { 1928 int error; 1929 1930 if (fin->fin_out == 0) { 1931 if (__predict_false(!pktq_enqueue(ip_pktq, m, 0))) { 1932 FREE_MB_T(m); 1933 error = ENOBUFS; 1934 } else { 1935 error = 0; 1936 } 1937 } else { 1938 error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL); 1939 } 1940 return error; 1941 } 1942 1943 1944 u_32_t 1945 ipf_random(void) 1946 { 1947 int number; 1948 1949 #ifdef _CPRNG_H 1950 number = cprng_fast32(); 1951 #else 1952 number = arc4random(); 1953 #endif 1954 return number; 1955 } 1956 1957 1958 /* 1959 * routines below for saving IP headers to buffer 1960 */ 1961 static int ipfopen(dev_t dev, int flags 1962 #if (NetBSD >= 199511) 1963 , int devtype, PROC_T *p 1964 #endif 1965 ) 1966 { 1967 u_int unit = GET_MINOR(dev); 1968 int error; 1969 1970 if (IPL_LOGMAX < unit) { 1971 error = ENXIO; 1972 } else { 1973 switch (unit) 1974 { 1975 case IPL_LOGIPF : 1976 case IPL_LOGNAT : 1977 case IPL_LOGSTATE : 1978 case IPL_LOGAUTH : 1979 case IPL_LOGLOOKUP : 1980 case IPL_LOGSYNC : 1981 #ifdef IPFILTER_SCAN 1982 case IPL_LOGSCAN : 1983 #endif 1984 error = 0; 1985 break; 1986 default : 1987 error = ENXIO; 1988 break; 1989 } 1990 } 1991 return error; 1992 } 1993 1994 1995 static int ipfclose(dev_t dev, int flags 1996 #if (NetBSD >= 199511) 1997 , int devtype, PROC_T *p 1998 #endif 1999 ) 2000 { 2001 u_int unit = GET_MINOR(dev); 2002 2003 if (IPL_LOGMAX < unit) 2004 unit = ENXIO; 2005 else 2006 unit = 0; 2007 return unit; 2008 } 2009 2010 /* 2011 * ipfread/ipflog 2012 * both of these must operate with at least splnet() lest they be 2013 * called during packet processing and cause an inconsistancy to appear in 2014 * the filter lists. 2015 */ 2016 static int ipfread(dev_t dev, struct uio *uio, int ioflag) 2017 { 2018 2019 if (ipfmain.ipf_running < 1) { 2020 ipfmain.ipf_interror = 130006; 2021 return EIO; 2022 } 2023 2024 if (GET_MINOR(dev) == IPL_LOGSYNC) 2025 return ipf_sync_read(&ipfmain, uio); 2026 2027 #ifdef IPFILTER_LOG 2028 return ipf_log_read(&ipfmain, GET_MINOR(dev), uio); 2029 #else 2030 ipfmain.ipf_interror = 130007; 2031 return ENXIO; 2032 #endif 2033 } 2034 2035 2036 /* 2037 * ipfwrite 2038 * both of these must operate with at least splnet() lest they be 2039 * called during packet processing and cause an inconsistancy to appear in 2040 * the filter lists. 2041 */ 2042 static int ipfwrite(dev_t dev, struct uio *uio, int ioflag) 2043 { 2044 2045 if (ipfmain.ipf_running < 1) { 2046 ipfmain.ipf_interror = 130008; 2047 return EIO; 2048 } 2049 2050 if (GET_MINOR(dev) == IPL_LOGSYNC) 2051 return ipf_sync_write(&ipfmain, uio); 2052 ipfmain.ipf_interror = 130009; 2053 return ENXIO; 2054 } 2055 2056 2057 static int ipfpoll(dev_t dev, int events, PROC_T *p) 2058 { 2059 u_int unit = GET_MINOR(dev); 2060 int revents = 0; 2061 2062 if (IPL_LOGMAX < unit) { 2063 ipfmain.ipf_interror = 130010; 2064 return ENXIO; 2065 } 2066 2067 switch (unit) 2068 { 2069 case IPL_LOGIPF : 2070 case IPL_LOGNAT : 2071 case IPL_LOGSTATE : 2072 #ifdef IPFILTER_LOG 2073 if ((events & (POLLIN | POLLRDNORM)) && 2074 ipf_log_canread(&ipfmain, unit)) 2075 revents |= events & (POLLIN | POLLRDNORM); 2076 #endif 2077 break; 2078 case IPL_LOGAUTH : 2079 if ((events & (POLLIN | POLLRDNORM)) && 2080 ipf_auth_waiting(&ipfmain)) 2081 revents |= events & (POLLIN | POLLRDNORM); 2082 break; 2083 case IPL_LOGSYNC : 2084 if ((events & (POLLIN | POLLRDNORM)) && 2085 ipf_sync_canread(&ipfmain)) 2086 revents |= events & (POLLIN | POLLRDNORM); 2087 if ((events & (POLLOUT | POLLWRNORM)) && 2088 ipf_sync_canwrite(&ipfmain)) 2089 revents |= events & (POLLOUT | POLLWRNORM); 2090 break; 2091 case IPL_LOGSCAN : 2092 case IPL_LOGLOOKUP : 2093 default : 2094 break; 2095 } 2096 2097 if ((revents == 0) && (((events & (POLLIN|POLLRDNORM)) != 0))) 2098 selrecord(p, &ipfmain.ipf_selwait[unit]); 2099 return revents; 2100 } 2101 2102 u_int 2103 ipf_pcksum(fr_info_t *fin, int hlen, u_int sum) 2104 { 2105 struct mbuf *m; 2106 u_int sum2; 2107 int off; 2108 2109 m = fin->fin_m; 2110 off = (char *)fin->fin_dp - (char *)fin->fin_ip; 2111 m->m_data += hlen; 2112 m->m_len -= hlen; 2113 sum2 = in_cksum(fin->fin_m, fin->fin_plen - off); 2114 m->m_len += hlen; 2115 m->m_data -= hlen; 2116 2117 /* 2118 * Both sum and sum2 are partial sums, so combine them together. 2119 */ 2120 sum += ~sum2 & 0xffff; 2121 while (sum > 0xffff) 2122 sum = (sum & 0xffff) + (sum >> 16); 2123 sum2 = ~sum & 0xffff; 2124 return sum2; 2125 } 2126
Indexes created Fri Sep 26 08:10:20 GMT 2025