ip_fil_netbsd.c revision 1.4.2.2
1 /* $NetBSD: ip_fil_netbsd.c,v 1.4.2.2 2014/05/18 17:46:03 rmind Exp $ */ 2 3 /* 4 * Copyright (C) 2012 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 */ 8 #if !defined(lint) 9 #if defined(__NetBSD__) 10 #include <sys/cdefs.h> 11 __KERNEL_RCSID(0, "$NetBSD: ip_fil_netbsd.c,v 1.4.2.2 2014/05/18 17:46:03 rmind Exp $"); 12 #else 13 static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-2000 Darren Reed"; 14 static const char rcsid[] = "@(#)Id: ip_fil_netbsd.c,v 1.1.1.2 2012/07/22 13:45:17 darrenr Exp"; 15 #endif 16 #endif 17 18 #if defined(KERNEL) || defined(_KERNEL) 19 # undef KERNEL 20 # undef _KERNEL 21 # define KERNEL 1 22 # define _KERNEL 1 23 #endif 24 #include <sys/param.h> 25 #if (NetBSD >= 199905) && !defined(IPFILTER_LKM) 26 # include "opt_ipsec.h" 27 #endif 28 #include <sys/errno.h> 29 #include <sys/types.h> 30 #include <sys/file.h> 31 #include <sys/ioctl.h> 32 #include <sys/time.h> 33 #include <sys/systm.h> 34 #include <sys/select.h> 35 #if (NetBSD > 199609) 36 # include <sys/dirent.h> 37 #else 38 # include <sys/dir.h> 39 #endif 40 #if (__NetBSD_Version__ >= 599005900) 41 # include <sys/cprng.h> 42 #endif 43 #include <sys/mbuf.h> 44 #include <sys/protosw.h> 45 #include <sys/socket.h> 46 #include <sys/poll.h> 47 #if (__NetBSD_Version__ >= 399002000) 48 # include <sys/kauth.h> 49 #endif 50 51 #include <net/if.h> 52 #include <net/route.h> 53 #include <netinet/in.h> 54 #include <netinet/in_var.h> 55 #include <netinet/in_systm.h> 56 #include <netinet/ip.h> 57 #include <netinet/ip_var.h> 58 #include <netinet/tcp.h> 59 #if __NetBSD_Version__ >= 105190000 /* 1.5T */ 60 # include <netinet/tcp_timer.h> 61 # include <netinet/tcp_var.h> 62 #endif 63 #include <netinet/udp.h> 64 #include <netinet/tcpip.h> 65 #include <netinet/ip_icmp.h> 66 #include "netinet/ip_compat.h" 67 #ifdef USE_INET6 68 # include <netinet/icmp6.h> 69 # if (__NetBSD_Version__ >= 106000000) 70 # include <netinet6/nd6.h> 71 # endif 72 #endif 73 #include "netinet/ip_fil.h" 74 #include "netinet/ip_nat.h" 75 #include "netinet/ip_frag.h" 76 #include "netinet/ip_state.h" 77 #include "netinet/ip_proxy.h" 78 #include "netinet/ip_auth.h" 79 #include "netinet/ip_sync.h" 80 #include "netinet/ip_lookup.h" 81 #include "netinet/ip_dstlist.h" 82 #ifdef IPFILTER_SCAN 83 #include "netinet/ip_scan.h" 84 #endif 85 #include <sys/md5.h> 86 #include <sys/kernel.h> 87 #include <sys/conf.h> 88 #ifdef INET 89 extern int ip_optcopy (struct ip *, struct ip *); 90 #endif 91 92 #ifdef IPFILTER_M_IPFILTER 93 MALLOC_DEFINE(M_IPFILTER, "IP Filter", "IP Filter packet filter data structures"); 94 #endif 95 96 #if __NetBSD_Version__ >= 105009999 97 # define csuminfo csum_flags 98 #endif 99 100 #if __NetBSD_Version__ < 200000000 101 extern struct protosw inetsw[]; 102 #endif 103 104 #if (__NetBSD_Version__ >= 599002000) 105 static kauth_listener_t ipf_listener; 106 #endif 107 108 #if (__NetBSD_Version__ < 399001400) 109 extern int ip6_getpmtu (struct route_in6 *, struct route_in6 *, 110 struct ifnet *, struct in6_addr *, u_long *, 111 int *); 112 #endif 113 #if (NetBSD >= 199511) 114 static int ipfopen(dev_t dev, int flags, int devtype, PROC_T *p); 115 static int ipfclose(dev_t dev, int flags, int devtype, PROC_T *p); 116 #else 117 # if (__NetBSD_Version__ >= 399001400) 118 static int ipfopen(dev_t dev, int flags, struct lwp *); 119 static int ipfclose(dev_t dev, int flags, struct lwp *); 120 # else 121 static int ipfopen(dev_t dev, int flags); 122 static int ipfclose(dev_t dev, int flags); 123 # endif /* __NetBSD_Version__ >= 399001400 */ 124 #endif 125 static int ipfread(dev_t, struct uio *, int ioflag); 126 static int ipfwrite(dev_t, struct uio *, int ioflag); 127 static int ipfpoll(dev_t, int events, PROC_T *); 128 static void ipf_timer_func(void *ptr); 129 130 const struct cdevsw ipl_cdevsw = { 131 .d_open = ipfopen, 132 .d_close = ipfclose, 133 .d_read = ipfread, 134 .d_write = ipfwrite, 135 .d_ioctl = ipfioctl, 136 .d_stop = nostop, 137 .d_tty = notty, 138 .d_poll = ipfpoll, 139 .d_mmap = nommap, 140 #if (__NetBSD_Version__ >= 200000000) 141 .d_kqfilter = nokqfilter, 142 #endif 143 #ifdef D_OTHER 144 .d_flag = D_OTHER 145 #else 146 .d_flag = 0 147 #endif 148 }; 149 150 ipf_main_softc_t ipfmain; 151 152 static u_short ipid = 0; 153 static int (*ipf_savep)(void *, ip_t *, int, void *, int, struct mbuf **); 154 static int ipf_send_ip(fr_info_t *, mb_t *); 155 #ifdef USE_INET6 156 static int ipf_fastroute6(struct mbuf *, struct mbuf **, 157 fr_info_t *, frdest_t *); 158 #endif 159 160 #if defined(NETBSD_PF) 161 # include <net/pfil.h> 162 /* 163 * We provide the ipf_checkp name just to minimize changes later. 164 */ 165 int (*ipf_checkp)(void *, ip_t *ip, int hlen, void *ifp, int out, mb_t **mp); 166 #endif /* NETBSD_PF */ 167 168 #if defined(__NetBSD_Version__) && (__NetBSD_Version__ >= 105110000) 169 # include <net/pfil.h> 170 171 static int ipf_check_wrapper(void *, struct mbuf **, struct ifnet *, int ); 172 173 static int 174 ipf_check_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 175 { 176 struct ip *ip; 177 int rv, hlen; 178 179 #if __NetBSD_Version__ >= 200080000 180 /* 181 * ensure that mbufs are writable beforehand 182 * as it's assumed by ipf code. 183 * XXX inefficient 184 */ 185 int error = m_makewritable(mp, 0, M_COPYALL, M_DONTWAIT); 186 187 if (error) { 188 m_freem(*mp); 189 *mp = NULL; 190 return error; 191 } 192 #endif 193 ip = mtod(*mp, struct ip *); 194 hlen = ip->ip_hl << 2; 195 196 #ifdef INET 197 #if defined(M_CSUM_TCPv4) 198 /* 199 * If the packet is out-bound, we can't delay checksums 200 * here. For in-bound, the checksum has already been 201 * validated. 202 */ 203 if (dir == PFIL_OUT) { 204 if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 205 in_delayed_cksum(*mp); 206 (*mp)->m_pkthdr.csum_flags &= 207 ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 208 } 209 } 210 #endif /* M_CSUM_TCPv4 */ 211 #endif /* INET */ 212 213 /* 214 * Note, we don't need to update the checksum, because 215 * it has already been verified. 216 */ 217 rv = ipf_check(&ipfmain, ip, hlen, ifp, (dir == PFIL_OUT), mp); 218 219 return (rv); 220 } 221 222 # ifdef USE_INET6 223 # include <netinet/ip6.h> 224 225 static int ipf_check_wrapper6(void *, struct mbuf **, struct ifnet *, int ); 226 227 static int 228 ipf_check_wrapper6(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 229 { 230 #if defined(INET6) 231 # if defined(M_CSUM_TCPv6) && (__NetBSD_Version__ > 200000000) 232 /* 233 * If the packet is out-bound, we can't delay checksums 234 * here. For in-bound, the checksum has already been 235 * validated. 236 */ 237 if (dir == PFIL_OUT) { 238 if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv6|M_CSUM_UDPv6)) { 239 # if (__NetBSD_Version__ > 399000600) 240 in6_delayed_cksum(*mp); 241 # endif 242 (*mp)->m_pkthdr.csum_flags &= ~(M_CSUM_TCPv6| 243 M_CSUM_UDPv6); 244 } 245 } 246 # endif 247 #endif /* INET6 */ 248 249 return (ipf_check(&ipfmain, mtod(*mp, struct ip *), sizeof(struct ip6_hdr), 250 ifp, (dir == PFIL_OUT), mp)); 251 } 252 # endif 253 254 255 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 256 static int ipf_pfilsync(void *, struct mbuf **, struct ifnet *, int); 257 258 static int 259 ipf_pfilsync(void *hdr, struct mbuf **mp, struct ifnet *ifp, int dir) 260 { 261 /* 262 * The interface pointer is useless for create (we have nothing to 263 * compare it to) and at detach, the interface name is still in the 264 * list of active NICs (albeit, down, but that's not any real 265 * indicator) and doing ifunit() on the name will still return the 266 * pointer, so it's not much use then, either. 267 */ 268 ipf_sync(&ipfmain, NULL); 269 return 0; 270 } 271 # endif 272 273 #endif /* __NetBSD_Version__ >= 105110000 */ 274 275 276 #if defined(IPFILTER_LKM) 277 int 278 ipf_identify(s) 279 char *s; 280 { 281 if (strcmp(s, "ipl") == 0) 282 return 1; 283 return 0; 284 } 285 #endif /* IPFILTER_LKM */ 286 287 #if (__NetBSD_Version__ >= 599002000) 288 static int 289 ipf_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie, 290 void *arg0, void *arg1, void *arg2, void *arg3) 291 { 292 int result; 293 enum kauth_network_req req; 294 295 result = KAUTH_RESULT_DEFER; 296 req = (enum kauth_network_req)arg0; 297 298 if (action != KAUTH_NETWORK_FIREWALL) 299 return result; 300 301 /* These must have came from device context. */ 302 if ((req == KAUTH_REQ_NETWORK_FIREWALL_FW) || 303 (req == KAUTH_REQ_NETWORK_FIREWALL_NAT)) 304 result = KAUTH_RESULT_ALLOW; 305 306 return result; 307 } 308 #endif 309 310 /* 311 * Try to detect the case when compiling for NetBSD with pseudo-device 312 */ 313 void 314 ipfilterattach(int count) 315 { 316 317 #if (__NetBSD_Version__ >= 599002000) 318 ipf_listener = kauth_listen_scope(KAUTH_SCOPE_NETWORK, 319 ipf_listener_cb, NULL); 320 #endif 321 322 if (ipf_load_all() == 0) 323 (void) ipf_create_all(&ipfmain); 324 } 325 326 327 int 328 ipfattach(ipf_main_softc_t *softc) 329 { 330 SPL_INT(s); 331 #if (__NetBSD_Version__ >= 499005500) 332 int i; 333 #endif 334 #if defined(NETBSD_PF) && (__NetBSD_Version__ >= 104200000) 335 int error = 0; 336 # if defined(__NetBSD_Version__) && (__NetBSD_Version__ >= 105110000) 337 pfil_head_t *ph_inet; 338 # ifdef USE_INET6 339 pfil_head_t *ph_inet6; 340 # endif 341 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 342 pfil_head_t *ph_ifsync; 343 # endif 344 # endif 345 #endif 346 347 SPL_NET(s); 348 if ((softc->ipf_running > 0) || (ipf_checkp == ipf_check)) { 349 printf("IP Filter: already initialized\n"); 350 SPL_X(s); 351 IPFERROR(130017); 352 return EBUSY; 353 } 354 355 if (ipf_init_all(softc) < 0) { 356 SPL_X(s); 357 IPFERROR(130015); 358 return EIO; 359 } 360 361 #ifdef NETBSD_PF 362 # if (__NetBSD_Version__ >= 104200000) 363 # if __NetBSD_Version__ >= 105110000 364 ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET); 365 # ifdef USE_INET6 366 ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6); 367 # endif 368 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 369 ph_ifsync = pfil_head_get(PFIL_TYPE_IFNET, 0); 370 # endif 371 372 if (ph_inet == NULL 373 # ifdef USE_INET6 374 && ph_inet6 == NULL 375 # endif 376 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 377 && ph_ifsync == NULL 378 # endif 379 ) { 380 SPL_X(s); 381 IPFERROR(130016); 382 return ENODEV; 383 } 384 385 if (ph_inet != NULL) 386 error = pfil_add_hook((void *)ipf_check_wrapper, NULL, 387 PFIL_IN|PFIL_OUT, ph_inet); 388 else 389 error = 0; 390 # else 391 error = pfil_add_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 392 &inetsw[ip_protox[IPPROTO_IP]].pr_pfh); 393 # endif 394 if (error) { 395 IPFERROR(130013); 396 goto pfil_error; 397 } 398 # else 399 pfil_add_hook((void *)ipf_check, PFIL_IN|PFIL_OUT); 400 # endif 401 402 # ifdef USE_INET6 403 # if __NetBSD_Version__ >= 105110000 404 if (ph_inet6 != NULL) 405 error = pfil_add_hook((void *)ipf_check_wrapper6, NULL, 406 PFIL_IN|PFIL_OUT, ph_inet6); 407 else 408 error = 0; 409 if (error) { 410 pfil_remove_hook((void *)ipf_check_wrapper6, NULL, 411 PFIL_IN|PFIL_OUT, ph_inet6); 412 ipfmain.ipf_interror = 130014; 413 goto pfil_error; 414 } 415 # else 416 error = pfil_add_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 417 &inetsw[ip_protox[IPPROTO_IPV6]].pr_pfh); 418 if (error) { 419 pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 420 &inetsw[ip_protox[IPPROTO_IP]].pr_pfh); 421 IPFERROR(130014); 422 goto pfil_error; 423 } 424 # endif 425 # endif 426 427 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 428 if (ph_ifsync != NULL) 429 (void) pfil_add_hook((void *)ipf_pfilsync, NULL, 430 PFIL_IFNET, ph_ifsync); 431 # endif 432 #endif 433 434 #if (__NetBSD_Version__ >= 499005500) 435 for (i = 0; i < IPL_LOGSIZE; i++) 436 selinit(&ipfmain.ipf_selwait[i]); 437 #else 438 bzero((char *)ipfmain.ipf_selwait, sizeof(ipfmain.ipf_selwait)); 439 #endif 440 ipf_savep = ipf_checkp; 441 ipf_checkp = ipf_check; 442 443 #ifdef INET 444 if (softc->ipf_control_forwarding & 1) 445 ipforwarding = 1; 446 #endif 447 448 ipid = 0; 449 450 SPL_X(s); 451 452 #if (__NetBSD_Version__ >= 104010000) 453 # if (__NetBSD_Version__ >= 499002000) 454 callout_init(&softc->ipf_slow_ch, 0); 455 # else 456 callout_init(&softc->ipf_slow_ch); 457 # endif 458 callout_reset(&softc->ipf_slow_ch, (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT, 459 ipf_timer_func, softc); 460 #else 461 timeout(ipf_timer_func, softc, (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT); 462 #endif 463 464 return 0; 465 466 #if __NetBSD_Version__ >= 105110000 467 pfil_error: 468 SPL_X(s); 469 ipf_fini_all(softc); 470 return error; 471 #endif 472 } 473 474 static void 475 ipf_timer_func(void *ptr) 476 { 477 ipf_main_softc_t *softc = ptr; 478 SPL_INT(s); 479 480 SPL_NET(s); 481 READ_ENTER(&softc->ipf_global); 482 483 if (softc->ipf_running > 0) 484 ipf_slowtimer(softc); 485 486 if (softc->ipf_running == -1 || softc->ipf_running == 1) { 487 #if NETBSD_GE_REV(104240000) 488 callout_reset(&softc->ipf_slow_ch, hz / 2, 489 ipf_timer_func, softc); 490 #else 491 timeout(ipf_timer_func, softc, 492 (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT); 493 #endif 494 } 495 RWLOCK_EXIT(&softc->ipf_global); 496 SPL_X(s); 497 } 498 499 500 /* 501 * Disable the filter by removing the hooks from the IP input/output 502 * stream. 503 */ 504 int 505 ipfdetach(ipf_main_softc_t *softc) 506 { 507 SPL_INT(s); 508 #if (__NetBSD_Version__ >= 499005500) 509 int i; 510 #endif 511 #if defined(NETBSD_PF) && (__NetBSD_Version__ >= 104200000) 512 int error = 0; 513 # if __NetBSD_Version__ >= 105150000 514 pfil_head_t *ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET); 515 # ifdef USE_INET6 516 pfil_head_t *ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6); 517 # endif 518 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 519 struct pfil_head *ph_ifsync = pfil_head_get(PFIL_TYPE_IFNET, 0); 520 # endif 521 # endif 522 #endif 523 524 SPL_NET(s); 525 526 #if (__NetBSD_Version__ >= 104010000) 527 if (softc->ipf_running > 0) 528 callout_stop(&softc->ipf_slow_ch); 529 #else 530 untimeout(ipf_slowtimer, NULL); 531 #endif /* NetBSD */ 532 533 ipf_checkp = ipf_savep; 534 (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE|FR_INACTIVE); 535 (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE); 536 537 #ifdef INET 538 if (softc->ipf_control_forwarding & 2) 539 ipforwarding = 0; 540 #endif 541 542 #ifdef NETBSD_PF 543 # if (__NetBSD_Version__ >= 104200000) 544 # if __NetBSD_Version__ >= 105110000 545 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 546 (void) pfil_remove_hook((void *)ipf_pfilsync, NULL, 547 PFIL_IFNET, ph_ifsync); 548 # endif 549 550 if (ph_inet != NULL) 551 error = pfil_remove_hook((void *)ipf_check_wrapper, NULL, 552 PFIL_IN|PFIL_OUT, ph_inet); 553 else 554 error = 0; 555 # else 556 error = pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 557 &inetsw[ip_protox[IPPROTO_IP]].pr_pfh); 558 # endif 559 if (error) { 560 SPL_X(s); 561 IPFERROR(130011); 562 return error; 563 } 564 # else 565 pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT); 566 # endif 567 # ifdef USE_INET6 568 # if __NetBSD_Version__ >= 105110000 569 if (ph_inet6 != NULL) 570 error = pfil_remove_hook((void *)ipf_check_wrapper6, NULL, 571 PFIL_IN|PFIL_OUT, ph_inet6); 572 else 573 error = 0; 574 # else 575 error = pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 576 &inetsw[ip_protox[IPPROTO_IPV6]].pr_pfh); 577 # endif 578 if (error) { 579 SPL_X(s); 580 IPFERROR(130012); 581 return error; 582 } 583 # endif 584 #endif 585 SPL_X(s); 586 587 #if (__NetBSD_Version__ >= 499005500) 588 for (i = 0; i < IPL_LOGSIZE; i++) 589 seldestroy(&ipfmain.ipf_selwait[i]); 590 #endif 591 592 ipf_fini_all(softc); 593 594 return 0; 595 } 596 597 598 /* 599 * Filter ioctl interface. 600 */ 601 int 602 ipfioctl(dev_t dev, u_long cmd, 603 #if (__NetBSD_Version__ >= 499001000) 604 void *data, 605 #else 606 caddr_t data, 607 #endif 608 int mode 609 #if (NetBSD >= 199511) 610 # if (__NetBSD_Version__ >= 399001400) 611 , struct lwp *p 612 # if (__NetBSD_Version__ >= 399002000) 613 # define UID(l) kauth_cred_getuid((l)->l_cred) 614 # else 615 # define UID(l) ((l)->l_proc->p_cred->p_ruid) 616 # endif 617 # else 618 , struct proc *p 619 # define UID(p) ((p)->p_cred->p_ruid) 620 # endif 621 #endif 622 ) 623 { 624 int error = 0, unit = 0; 625 SPL_INT(s); 626 627 #if (__NetBSD_Version__ >= 399002000) 628 if ((mode & FWRITE) && 629 kauth_authorize_network(p->l_cred, KAUTH_NETWORK_FIREWALL, 630 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, 631 NULL, NULL)) { 632 ipfmain.ipf_interror = 130005; 633 return EPERM; 634 } 635 #else 636 if ((securelevel >= 2) && (mode & FWRITE)) { 637 ipfmain.ipf_interror = 130001; 638 return EPERM; 639 } 640 #endif 641 642 unit = GET_MINOR(dev); 643 if ((IPL_LOGMAX < unit) || (unit < 0)) { 644 ipfmain.ipf_interror = 130002; 645 return ENXIO; 646 } 647 648 if (ipfmain.ipf_running <= 0) { 649 if (unit != IPL_LOGIPF && cmd != SIOCIPFINTERROR) { 650 ipfmain.ipf_interror = 130003; 651 return EIO; 652 } 653 if (cmd != SIOCIPFGETNEXT && cmd != SIOCIPFGET && 654 cmd != SIOCIPFSET && cmd != SIOCFRENB && 655 cmd != SIOCGETFS && cmd != SIOCGETFF && 656 cmd != SIOCIPFINTERROR) { 657 ipfmain.ipf_interror = 130004; 658 return EIO; 659 } 660 } 661 662 SPL_NET(s); 663 664 error = ipf_ioctlswitch(&ipfmain, unit, data, cmd, mode, UID(p), p); 665 if (error != -1) { 666 SPL_X(s); 667 return error; 668 } 669 670 SPL_X(s); 671 return error; 672 } 673 674 675 /* 676 * ipf_send_reset - this could conceivably be a call to tcp_respond(), but that 677 * requires a large amount of setting up and isn't any more efficient. 678 */ 679 int 680 ipf_send_reset(fr_info_t *fin) 681 { 682 struct tcphdr *tcp, *tcp2; 683 int tlen = 0, hlen; 684 struct mbuf *m; 685 #ifdef USE_INET6 686 ip6_t *ip6; 687 #endif 688 ip_t *ip; 689 690 tcp = fin->fin_dp; 691 if (tcp->th_flags & TH_RST) 692 return -1; /* feedback loop */ 693 694 if (ipf_checkl4sum(fin) == -1) 695 return -1; 696 697 tlen = fin->fin_dlen - (TCP_OFF(tcp) << 2) + 698 ((tcp->th_flags & TH_SYN) ? 1 : 0) + 699 ((tcp->th_flags & TH_FIN) ? 1 : 0); 700 701 #ifdef USE_INET6 702 hlen = (fin->fin_v == 6) ? sizeof(ip6_t) : sizeof(ip_t); 703 #else 704 hlen = sizeof(ip_t); 705 #endif 706 #ifdef MGETHDR 707 MGETHDR(m, M_DONTWAIT, MT_HEADER); 708 #else 709 MGET(m, M_DONTWAIT, MT_HEADER); 710 #endif 711 if (m == NULL) 712 return -1; 713 if (sizeof(*tcp2) + hlen > MHLEN) { 714 MCLGET(m, M_DONTWAIT); 715 if (m == NULL) 716 return -1; 717 if ((m->m_flags & M_EXT) == 0) { 718 FREE_MB_T(m); 719 return -1; 720 } 721 } 722 723 m->m_len = sizeof(*tcp2) + hlen; 724 m->m_data += max_linkhdr; 725 m->m_pkthdr.len = m->m_len; 726 m->m_pkthdr.rcvif = (struct ifnet *)0; 727 ip = mtod(m, struct ip *); 728 bzero((char *)ip, hlen); 729 #ifdef USE_INET6 730 ip6 = (ip6_t *)ip; 731 #endif 732 bzero((char *)ip, sizeof(*tcp2) + hlen); 733 tcp2 = (struct tcphdr *)((char *)ip + hlen); 734 tcp2->th_sport = tcp->th_dport; 735 tcp2->th_dport = tcp->th_sport; 736 737 if (tcp->th_flags & TH_ACK) { 738 tcp2->th_seq = tcp->th_ack; 739 tcp2->th_flags = TH_RST; 740 tcp2->th_ack = 0; 741 } else { 742 tcp2->th_seq = 0; 743 tcp2->th_ack = ntohl(tcp->th_seq); 744 tcp2->th_ack += tlen; 745 tcp2->th_ack = htonl(tcp2->th_ack); 746 tcp2->th_flags = TH_RST|TH_ACK; 747 } 748 tcp2->th_x2 = 0; 749 TCP_OFF_A(tcp2, sizeof(*tcp2) >> 2); 750 tcp2->th_win = tcp->th_win; 751 tcp2->th_sum = 0; 752 tcp2->th_urp = 0; 753 754 #ifdef USE_INET6 755 if (fin->fin_v == 6) { 756 ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow; 757 ip6->ip6_plen = htons(sizeof(struct tcphdr)); 758 ip6->ip6_nxt = IPPROTO_TCP; 759 ip6->ip6_hlim = 0; 760 ip6->ip6_src = fin->fin_dst6.in6; 761 ip6->ip6_dst = fin->fin_src6.in6; 762 tcp2->th_sum = in6_cksum(m, IPPROTO_TCP, 763 sizeof(*ip6), sizeof(*tcp2)); 764 return ipf_send_ip(fin, m); 765 } 766 #endif 767 #ifdef INET 768 ip->ip_p = IPPROTO_TCP; 769 ip->ip_len = htons(sizeof(struct tcphdr)); 770 ip->ip_src.s_addr = fin->fin_daddr; 771 ip->ip_dst.s_addr = fin->fin_saddr; 772 tcp2->th_sum = in_cksum(m, hlen + sizeof(*tcp2)); 773 ip->ip_len = hlen + sizeof(*tcp2); 774 return ipf_send_ip(fin, m); 775 #else 776 return 0; 777 #endif 778 } 779 780 781 /* 782 * Expects ip_len to be in host byte order when called. 783 */ 784 static int 785 ipf_send_ip(fr_info_t *fin, mb_t *m) 786 { 787 fr_info_t fnew; 788 #ifdef INET 789 ip_t *oip; 790 #endif 791 ip_t *ip; 792 int hlen; 793 794 ip = mtod(m, ip_t *); 795 bzero((char *)&fnew, sizeof(fnew)); 796 fnew.fin_main_soft = fin->fin_main_soft; 797 798 IP_V_A(ip, fin->fin_v); 799 switch (fin->fin_v) 800 { 801 #ifdef INET 802 case 4 : 803 oip = fin->fin_ip; 804 hlen = sizeof(*oip); 805 fnew.fin_v = 4; 806 fnew.fin_p = ip->ip_p; 807 fnew.fin_plen = ntohs(ip->ip_len); 808 HTONS(ip->ip_len); 809 IP_HL_A(ip, sizeof(*oip) >> 2); 810 ip->ip_tos = oip->ip_tos; 811 ip->ip_id = ipf_nextipid(fin); 812 ip->ip_off = htons(ip_mtudisc ? IP_DF : 0); 813 ip->ip_ttl = ip_defttl; 814 ip->ip_sum = 0; 815 break; 816 #endif 817 #ifdef USE_INET6 818 case 6 : 819 { 820 ip6_t *ip6 = (ip6_t *)ip; 821 822 ip6->ip6_vfc = 0x60; 823 ip6->ip6_hlim = IPDEFTTL; 824 825 hlen = sizeof(*ip6); 826 fnew.fin_p = ip6->ip6_nxt; 827 fnew.fin_v = 6; 828 fnew.fin_plen = ntohs(ip6->ip6_plen) + hlen; 829 break; 830 } 831 #endif 832 default : 833 return EINVAL; 834 } 835 #ifdef KAME_IPSEC 836 m->m_pkthdr.rcvif = NULL; 837 #endif 838 839 fnew.fin_ifp = fin->fin_ifp; 840 fnew.fin_flx = FI_NOCKSUM; 841 fnew.fin_m = m; 842 fnew.fin_ip = ip; 843 fnew.fin_mp = &m; 844 fnew.fin_hlen = hlen; 845 fnew.fin_dp = (char *)ip + hlen; 846 (void) ipf_makefrip(hlen, ip, &fnew); 847 848 return ipf_fastroute(m, &m, &fnew, NULL); 849 } 850 851 852 int 853 ipf_send_icmp_err(int type, fr_info_t *fin, int dst) 854 { 855 int err, hlen, xtra, iclen, ohlen, avail; 856 struct in_addr dst4; 857 struct icmp *icmp; 858 struct mbuf *m; 859 i6addr_t dst6; 860 void *ifp; 861 #ifdef USE_INET6 862 int code; 863 ip6_t *ip6; 864 #endif 865 ip_t *ip, *ip2; 866 867 if ((type < 0) || (type > ICMP_MAXTYPE)) 868 return -1; 869 870 #ifdef USE_INET6 871 code = fin->fin_icode; 872 if ((code < 0) || (code >= sizeof(icmptoicmp6unreach)/sizeof(int))) 873 return -1; 874 #endif 875 876 if (ipf_checkl4sum(fin) == -1) 877 return -1; 878 #ifdef MGETHDR 879 MGETHDR(m, M_DONTWAIT, MT_HEADER); 880 #else 881 MGET(m, M_DONTWAIT, MT_HEADER); 882 #endif 883 if (m == NULL) 884 return -1; 885 avail = MHLEN; 886 887 xtra = 0; 888 hlen = 0; 889 ohlen = 0; 890 dst4.s_addr = 0; 891 ifp = fin->fin_ifp; 892 if (fin->fin_v == 4) { 893 if ((fin->fin_p == IPPROTO_ICMP) && !(fin->fin_flx & FI_SHORT)) 894 switch (ntohs(fin->fin_data[0]) >> 8) 895 { 896 case ICMP_ECHO : 897 case ICMP_TSTAMP : 898 case ICMP_IREQ : 899 case ICMP_MASKREQ : 900 break; 901 default : 902 FREE_MB_T(m); 903 return 0; 904 } 905 906 if (dst == 0) { 907 if (ipf_ifpaddr(&ipfmain, 4, FRI_NORMAL, ifp, 908 &dst6, NULL) == -1) { 909 FREE_MB_T(m); 910 return -1; 911 } 912 dst4 = dst6.in4; 913 } else 914 dst4.s_addr = fin->fin_daddr; 915 916 hlen = sizeof(ip_t); 917 ohlen = fin->fin_hlen; 918 iclen = hlen + offsetof(struct icmp, icmp_ip) + ohlen; 919 if (fin->fin_hlen < fin->fin_plen) 920 xtra = MIN(fin->fin_dlen, 8); 921 else 922 xtra = 0; 923 } 924 925 #ifdef USE_INET6 926 else if (fin->fin_v == 6) { 927 hlen = sizeof(ip6_t); 928 ohlen = sizeof(ip6_t); 929 iclen = hlen + offsetof(struct icmp, icmp_ip) + ohlen; 930 type = icmptoicmp6types[type]; 931 if (type == ICMP6_DST_UNREACH) 932 code = icmptoicmp6unreach[code]; 933 934 if (iclen + max_linkhdr + fin->fin_plen > avail) { 935 MCLGET(m, M_DONTWAIT); 936 if (m == NULL) 937 return -1; 938 if ((m->m_flags & M_EXT) == 0) { 939 FREE_MB_T(m); 940 return -1; 941 } 942 avail = MCLBYTES; 943 } 944 xtra = MIN(fin->fin_plen, avail - iclen - max_linkhdr); 945 xtra = MIN(xtra, IPV6_MMTU - iclen); 946 if (dst == 0) { 947 if (ipf_ifpaddr(&ipfmain, 6, FRI_NORMAL, ifp, 948 &dst6, NULL) == -1) { 949 FREE_MB_T(m); 950 return -1; 951 } 952 } else 953 dst6 = fin->fin_dst6; 954 } 955 #endif 956 else { 957 FREE_MB_T(m); 958 return -1; 959 } 960 961 avail -= (max_linkhdr + iclen); 962 if (avail < 0) { 963 FREE_MB_T(m); 964 return -1; 965 } 966 if (xtra > avail) 967 xtra = avail; 968 iclen += xtra; 969 m->m_data += max_linkhdr; 970 m->m_pkthdr.rcvif = (struct ifnet *)0; 971 m->m_pkthdr.len = iclen; 972 m->m_len = iclen; 973 ip = mtod(m, ip_t *); 974 icmp = (struct icmp *)((char *)ip + hlen); 975 ip2 = (ip_t *)&icmp->icmp_ip; 976 977 icmp->icmp_type = type; 978 icmp->icmp_code = fin->fin_icode; 979 icmp->icmp_cksum = 0; 980 #ifdef icmp_nextmtu 981 if (type == ICMP_UNREACH && fin->fin_icode == ICMP_UNREACH_NEEDFRAG) { 982 if (fin->fin_mtu != 0) { 983 icmp->icmp_nextmtu = htons(fin->fin_mtu); 984 985 } else if (ifp != NULL) { 986 icmp->icmp_nextmtu = htons(GETIFMTU_4(ifp)); 987 988 } else { /* make up a number... */ 989 icmp->icmp_nextmtu = htons(fin->fin_plen - 20); 990 } 991 } 992 #endif 993 994 bcopy((char *)fin->fin_ip, (char *)ip2, ohlen); 995 996 #if defined(M_CSUM_IPv4) 997 /* 998 * Clear any in-bound checksum flags for this packet. 999 */ 1000 m->m_pkthdr.csuminfo = 0; 1001 #endif /* __NetBSD__ && M_CSUM_IPv4 */ 1002 1003 #ifdef USE_INET6 1004 ip6 = (ip6_t *)ip; 1005 if (fin->fin_v == 6) { 1006 ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow; 1007 ip6->ip6_plen = htons(iclen - hlen); 1008 ip6->ip6_nxt = IPPROTO_ICMPV6; 1009 ip6->ip6_hlim = 0; 1010 ip6->ip6_src = dst6.in6; 1011 ip6->ip6_dst = fin->fin_src6.in6; 1012 if (xtra > 0) 1013 bcopy((char *)fin->fin_ip + ohlen, 1014 (char *)&icmp->icmp_ip + ohlen, xtra); 1015 icmp->icmp_cksum = in6_cksum(m, IPPROTO_ICMPV6, 1016 sizeof(*ip6), iclen - hlen); 1017 } else 1018 #endif 1019 { 1020 ip->ip_p = IPPROTO_ICMP; 1021 ip->ip_src.s_addr = dst4.s_addr; 1022 ip->ip_dst.s_addr = fin->fin_saddr; 1023 1024 if (xtra > 0) 1025 bcopy((char *)fin->fin_ip + ohlen, 1026 (char *)&icmp->icmp_ip + ohlen, xtra); 1027 icmp->icmp_cksum = ipf_cksum((u_short *)icmp, 1028 sizeof(*icmp) + 8); 1029 ip->ip_len = iclen; 1030 ip->ip_p = IPPROTO_ICMP; 1031 } 1032 err = ipf_send_ip(fin, m); 1033 return err; 1034 } 1035 1036 1037 /* 1038 * m0 - pointer to mbuf where the IP packet starts 1039 * mpp - pointer to the mbuf pointer that is the start of the mbuf chain 1040 */ 1041 int 1042 ipf_fastroute(mb_t *m0, mb_t **mpp, fr_info_t *fin, frdest_t *fdp) 1043 { 1044 register struct ip *ip, *mhip; 1045 register struct mbuf *m = *mpp; 1046 register struct route *ro; 1047 int len, off, error = 0, hlen, code; 1048 struct ifnet *ifp, *sifp; 1049 ipf_main_softc_t *softc; 1050 #if __NetBSD_Version__ >= 499001100 1051 union { 1052 struct sockaddr dst; 1053 struct sockaddr_in dst4; 1054 } u; 1055 #else 1056 struct sockaddr_in *dst4; 1057 #endif 1058 struct sockaddr *dst; 1059 u_short ip_off, ip_len; 1060 struct route iproute; 1061 struct rtentry *rt; 1062 frdest_t node; 1063 frentry_t *fr; 1064 1065 if (fin->fin_v == 6) { 1066 #ifdef USE_INET6 1067 error = ipf_fastroute6(m0, mpp, fin, fdp); 1068 #else 1069 error = EPROTONOSUPPORT; 1070 #endif 1071 if ((error != 0) && (*mpp != NULL)) 1072 FREE_MB_T(*mpp); 1073 return error; 1074 } 1075 #ifndef INET 1076 FREE_MB_T(*mpp); 1077 return EPROTONOSUPPORT; 1078 #else 1079 1080 hlen = fin->fin_hlen; 1081 ip = mtod(m0, struct ip *); 1082 softc = fin->fin_main_soft; 1083 rt = NULL; 1084 ifp = NULL; 1085 1086 # if defined(M_CSUM_IPv4) 1087 /* 1088 * Clear any in-bound checksum flags for this packet. 1089 */ 1090 m0->m_pkthdr.csuminfo = 0; 1091 # endif /* __NetBSD__ && M_CSUM_IPv4 */ 1092 1093 /* 1094 * Route packet. 1095 */ 1096 ro = &iproute; 1097 memset(ro, 0, sizeof(*ro)); 1098 fr = fin->fin_fr; 1099 1100 if ((fr != NULL) && !(fr->fr_flags & FR_KEEPSTATE) && (fdp != NULL) && 1101 (fdp->fd_type == FRD_DSTLIST)) { 1102 if (ipf_dstlist_select_node(fin, fdp->fd_ptr, NULL, &node) == 0) 1103 fdp = &node; 1104 } 1105 if (fdp != NULL) 1106 ifp = fdp->fd_ptr; 1107 else 1108 ifp = fin->fin_ifp; 1109 1110 if ((ifp == NULL) && ((fr == NULL) || !(fr->fr_flags & FR_FASTROUTE))) { 1111 error = -2; 1112 goto bad; 1113 } 1114 1115 # if __NetBSD_Version__ >= 499001100 1116 if ((fdp != NULL) && (fdp->fd_ip.s_addr != 0)) 1117 sockaddr_in_init(&u.dst4, &fdp->fd_ip, 0); 1118 else 1119 sockaddr_in_init(&u.dst4, &ip->ip_dst, 0); 1120 dst = &u.dst; 1121 rtcache_setdst(ro, dst); 1122 rt = rtcache_init(ro); 1123 # else 1124 dst4 = (struct sockaddr_in *)&ro->ro_dst; 1125 dst = (struct sockaddr *)dst4; 1126 dst4->sin_family = AF_INET; 1127 dst4->sin_addr = ip->ip_dst; 1128 1129 if ((fdp != NULL) && (fdp->fd_ip.s_addr != 0)) 1130 dst4->sin_addr = fdp->fd_ip; 1131 1132 dst4->sin_len = sizeof(*dst); 1133 rtalloc(ro); 1134 rt = ro->ro_rt; 1135 # endif 1136 if ((ifp == NULL) && (rt != NULL)) 1137 ifp = rt->rt_ifp; 1138 if ((rt == NULL) || (ifp == NULL)) { 1139 #ifdef INET 1140 if (in_localaddr(ip->ip_dst)) 1141 error = EHOSTUNREACH; 1142 else 1143 #endif 1144 error = ENETUNREACH; 1145 goto bad; 1146 } 1147 1148 1149 if (rt->rt_flags & RTF_GATEWAY) 1150 dst = rt->rt_gateway; 1151 1152 rt->rt_use++; 1153 1154 /* 1155 * For input packets which are being "fastrouted", they won't 1156 * go back through output filtering and miss their chance to get 1157 * NAT'd and counted. Duplicated packets aren't considered to be 1158 * part of the normal packet stream, so do not NAT them or pass 1159 * them through stateful checking, etc. 1160 */ 1161 if ((fdp != &fr->fr_dif) && (fin->fin_out == 0)) { 1162 sifp = fin->fin_ifp; 1163 fin->fin_ifp = ifp; 1164 fin->fin_out = 1; 1165 (void) ipf_acctpkt(fin, NULL); 1166 fin->fin_fr = NULL; 1167 if (!fr || !(fr->fr_flags & FR_RETMASK)) { 1168 u_32_t pass; 1169 1170 (void) ipf_state_check(fin, &pass); 1171 } 1172 1173 switch (ipf_nat_checkout(fin, NULL)) 1174 { 1175 case 0 : 1176 break; 1177 case 1 : 1178 ip->ip_sum = 0; 1179 break; 1180 case -1 : 1181 error = -1; 1182 goto bad; 1183 break; 1184 } 1185 1186 fin->fin_ifp = sifp; 1187 fin->fin_out = 0; 1188 } else 1189 ip->ip_sum = 0; 1190 /* 1191 * If small enough for interface, can just send directly. 1192 */ 1193 m->m_pkthdr.rcvif = ifp; 1194 1195 ip_len = ntohs(ip->ip_len); 1196 if (ip_len <= ifp->if_mtu) { 1197 # if defined(M_CSUM_IPv4) 1198 # if (__NetBSD_Version__ >= 105009999) 1199 if (ifp->if_csum_flags_tx & M_CSUM_IPv4) 1200 m->m_pkthdr.csuminfo |= M_CSUM_IPv4; 1201 # else 1202 if (ifp->if_capabilities & IFCAP_CSUM_IPv4) 1203 m->m_pkthdr.csuminfo |= M_CSUM_IPv4; 1204 # endif /* (__NetBSD_Version__ >= 105009999) */ 1205 else if (ip->ip_sum == 0) 1206 ip->ip_sum = in_cksum(m, hlen); 1207 # else 1208 if (!ip->ip_sum) 1209 ip->ip_sum = in_cksum(m, hlen); 1210 # endif /* M_CSUM_IPv4 */ 1211 1212 KERNEL_LOCK(1, NULL); 1213 error = (*ifp->if_output)(ifp, m, dst, rt); 1214 KERNEL_UNLOCK_ONE(NULL); 1215 goto done; 1216 } 1217 1218 /* 1219 * Too large for interface; fragment if possible. 1220 * Must be able to put at least 8 bytes per fragment. 1221 */ 1222 ip_off = ntohs(ip->ip_off); 1223 if (ip_off & IP_DF) { 1224 error = EMSGSIZE; 1225 goto bad; 1226 } 1227 len = (ifp->if_mtu - hlen) &~ 7; 1228 if (len < 8) { 1229 error = EMSGSIZE; 1230 goto bad; 1231 } 1232 1233 { 1234 int mhlen, firstlen = len; 1235 struct mbuf **mnext = &m->m_act; 1236 1237 /* 1238 * Loop through length of segment after first fragment, 1239 * make new header and copy data of each part and link onto chain. 1240 */ 1241 m0 = m; 1242 mhlen = sizeof (struct ip); 1243 for (off = hlen + len; off < ip_len; off += len) { 1244 # ifdef MGETHDR 1245 MGETHDR(m, M_DONTWAIT, MT_HEADER); 1246 # else 1247 MGET(m, M_DONTWAIT, MT_HEADER); 1248 # endif 1249 if (m == 0) { 1250 m = m0; 1251 error = ENOBUFS; 1252 goto bad; 1253 } 1254 m->m_data += max_linkhdr; 1255 mhip = mtod(m, struct ip *); 1256 bcopy((char *)ip, (char *)mhip, sizeof(*ip)); 1257 #ifdef INET 1258 if (hlen > sizeof (struct ip)) { 1259 mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip); 1260 IP_HL_A(mhip, mhlen >> 2); 1261 } 1262 #endif 1263 m->m_len = mhlen; 1264 mhip->ip_off = ((off - hlen) >> 3) + ip_off; 1265 if (off + len >= ip_len) 1266 len = ip_len - off; 1267 else 1268 mhip->ip_off |= IP_MF; 1269 mhip->ip_len = htons((u_short)(len + mhlen)); 1270 m->m_next = m_copy(m0, off, len); 1271 if (m->m_next == 0) { 1272 error = ENOBUFS; /* ??? */ 1273 goto sendorfree; 1274 } 1275 m->m_pkthdr.len = mhlen + len; 1276 m->m_pkthdr.rcvif = NULL; 1277 mhip->ip_off = htons((u_short)mhip->ip_off); 1278 mhip->ip_sum = 0; 1279 #ifdef INET 1280 mhip->ip_sum = in_cksum(m, mhlen); 1281 #endif 1282 *mnext = m; 1283 mnext = &m->m_act; 1284 } 1285 /* 1286 * Update first fragment by trimming what's been copied out 1287 * and updating header, then send each fragment (in order). 1288 */ 1289 m_adj(m0, hlen + firstlen - ip_len); 1290 ip->ip_len = htons((u_short)(hlen + firstlen)); 1291 ip->ip_off = htons((u_short)IP_MF); 1292 ip->ip_sum = 0; 1293 #ifdef INET 1294 ip->ip_sum = in_cksum(m0, hlen); 1295 #endif 1296 sendorfree: 1297 for (m = m0; m; m = m0) { 1298 m0 = m->m_act; 1299 m->m_act = 0; 1300 if (error == 0) { 1301 KERNEL_LOCK(1, NULL); 1302 error = (*ifp->if_output)(ifp, m, dst, rt); 1303 KERNEL_UNLOCK_ONE(NULL); 1304 } else { 1305 FREE_MB_T(m); 1306 } 1307 } 1308 } 1309 done: 1310 if (!error) 1311 softc->ipf_frouteok[0]++; 1312 else 1313 softc->ipf_frouteok[1]++; 1314 1315 # if __NetBSD_Version__ >= 499001100 1316 rtcache_free(ro); 1317 # else 1318 if (rt) { 1319 RTFREE(rt); 1320 } 1321 # endif 1322 return error; 1323 bad: 1324 if (error == EMSGSIZE) { 1325 sifp = fin->fin_ifp; 1326 code = fin->fin_icode; 1327 fin->fin_icode = ICMP_UNREACH_NEEDFRAG; 1328 fin->fin_ifp = ifp; 1329 (void) ipf_send_icmp_err(ICMP_UNREACH, fin, 1); 1330 fin->fin_ifp = sifp; 1331 fin->fin_icode = code; 1332 } 1333 FREE_MB_T(m); 1334 goto done; 1335 #endif /* INET */ 1336 } 1337 1338 1339 #if defined(USE_INET6) 1340 /* 1341 * This is the IPv6 specific fastroute code. It doesn't clean up the mbuf's 1342 * or ensure that it is an IPv6 packet that is being forwarded, those are 1343 * expected to be done by the called (ipf_fastroute). 1344 */ 1345 static int 1346 ipf_fastroute6(struct mbuf *m0, struct mbuf **mpp, fr_info_t *fin, 1347 frdest_t *fdp) 1348 { 1349 # if __NetBSD_Version__ >= 499001100 1350 struct route ip6route; 1351 const struct sockaddr *dst; 1352 union { 1353 struct sockaddr dst; 1354 struct sockaddr_in6 dst6; 1355 } u; 1356 struct route *ro; 1357 # else 1358 struct route_in6 ip6route; 1359 struct sockaddr_in6 *dst6; 1360 struct route_in6 *ro; 1361 # endif 1362 struct rtentry *rt; 1363 struct ifnet *ifp; 1364 u_long mtu; 1365 int error; 1366 1367 error = 0; 1368 ro = &ip6route; 1369 1370 if (fdp != NULL) 1371 ifp = fdp->fd_ptr; 1372 else 1373 ifp = fin->fin_ifp; 1374 memset(ro, 0, sizeof(*ro)); 1375 # if __NetBSD_Version__ >= 499001100 1376 if (fdp != NULL && IP6_NOTZERO(&fdp->fd_ip6)) 1377 sockaddr_in6_init(&u.dst6, &fdp->fd_ip6.in6, 0, 0, 0); 1378 else 1379 sockaddr_in6_init(&u.dst6, &fin->fin_fi.fi_dst.in6, 0, 0, 0); 1380 dst = &u.dst; 1381 rtcache_setdst(ro, dst); 1382 1383 rt = rtcache_init(ro); 1384 if ((ifp == NULL) && (rt != NULL)) 1385 ifp = rt->rt_ifp; 1386 # else 1387 dst6 = (struct sockaddr_in6 *)&ro->ro_dst; 1388 dst6->sin6_family = AF_INET6; 1389 dst6->sin6_len = sizeof(struct sockaddr_in6); 1390 dst6->sin6_addr = fin->fin_fi.fi_dst.in6; 1391 1392 if (fdp != NULL) { 1393 if (IP6_NOTZERO(&fdp->fd_ip6)) 1394 dst6->sin6_addr = fdp->fd_ip6.in6; 1395 } 1396 1397 rtalloc((struct route *)ro); 1398 1399 if ((ifp == NULL) && (ro->ro_rt != NULL)) 1400 ifp = ro->ro_rt->rt_ifp; 1401 rt = ro->ro_rt; 1402 # endif 1403 if ((rt == NULL) || (ifp == NULL)) { 1404 1405 error = EHOSTUNREACH; 1406 goto bad; 1407 } 1408 1409 /* KAME */ 1410 # if __NetBSD_Version__ >= 499001100 1411 if (IN6_IS_ADDR_LINKLOCAL(&u.dst6.sin6_addr)) 1412 u.dst6.sin6_addr.s6_addr16[1] = htons(ifp->if_index); 1413 # else 1414 if (IN6_IS_ADDR_LINKLOCAL(&dst6->sin6_addr)) 1415 dst6->sin6_addr.s6_addr16[1] = htons(ifp->if_index); 1416 # endif 1417 1418 { 1419 # if (__NetBSD_Version__ >= 106010000) && !defined(IN6_LINKMTU) 1420 struct in6_ifextra *ife; 1421 # endif 1422 if (rt->rt_flags & RTF_GATEWAY) 1423 # if __NetBSD_Version__ >= 499001100 1424 dst = rt->rt_gateway; 1425 # else 1426 dst6 = (struct sockaddr_in6 *)rt->rt_gateway; 1427 # endif 1428 rt->rt_use++; 1429 1430 /* Determine path MTU. */ 1431 # if (__NetBSD_Version__ <= 106009999) 1432 mtu = nd_ifinfo[ifp->if_index].linkmtu; 1433 # else 1434 # ifdef IN6_LINKMTU 1435 mtu = IN6_LINKMTU(ifp); 1436 # else 1437 ife = (struct in6_ifextra *)(ifp)->if_afdata[AF_INET6]; 1438 mtu = ife->nd_ifinfo[ifp->if_index].linkmtu; 1439 # endif 1440 # endif 1441 if ((error == 0) && (m0->m_pkthdr.len <= mtu)) { 1442 # if __NetBSD_Version__ >= 499001100 1443 error = nd6_output(ifp, ifp, m0, satocsin6(dst), rt); 1444 # else 1445 error = nd6_output(ifp, ifp, m0, dst6, rt); 1446 # endif 1447 } else { 1448 error = EMSGSIZE; 1449 } 1450 } 1451 bad: 1452 # if __NetBSD_Version__ >= 499001100 1453 rtcache_free(ro); 1454 # else 1455 if (ro->ro_rt != NULL) { 1456 RTFREE(((struct route *)ro)->ro_rt); 1457 } 1458 # endif 1459 return error; 1460 } 1461 #endif /* INET6 */ 1462 1463 1464 int 1465 ipf_verifysrc(fr_info_t *fin) 1466 { 1467 #if __NetBSD_Version__ >= 499001100 1468 union { 1469 struct sockaddr dst; 1470 struct sockaddr_in dst4; 1471 } u; 1472 struct rtentry *rt; 1473 #else 1474 struct sockaddr_in *dst; 1475 #endif 1476 struct route iproute; 1477 int rc; 1478 1479 #if __NetBSD_Version__ >= 499001100 1480 sockaddr_in_init(&u.dst4, &fin->fin_src, 0); 1481 rtcache_setdst(&iproute, &u.dst); 1482 rt = rtcache_init(&iproute); 1483 if (rt == NULL) 1484 rc = 0; 1485 else 1486 rc = (fin->fin_ifp == rt->rt_ifp); 1487 rtcache_free(&iproute); 1488 #else 1489 dst = (struct sockaddr_in *)&iproute.ro_dst; 1490 dst->sin_len = sizeof(*dst); 1491 dst->sin_family = AF_INET; 1492 dst->sin_addr = fin->fin_src; 1493 rtalloc(&iproute); 1494 if (iproute.ro_rt == NULL) 1495 return 0; 1496 rc = (fin->fin_ifp == iproute.ro_rt->rt_ifp); 1497 RTFREE(iproute.ro_rt); 1498 #endif 1499 return rc; 1500 } 1501 1502 1503 /* 1504 * return the first IP Address associated with an interface 1505 */ 1506 int 1507 ipf_ifpaddr(ipf_main_softc_t *softc, int v, int atype, void *ifptr, 1508 i6addr_t *inp, i6addr_t *inpmask) 1509 { 1510 #ifdef USE_INET6 1511 struct in6_addr *inp6 = NULL; 1512 #endif 1513 struct sockaddr *sock, *mask; 1514 struct sockaddr_in *sin; 1515 struct ifaddr *ifa; 1516 struct ifnet *ifp; 1517 1518 if ((ifptr == NULL) || (ifptr == (void *)-1)) 1519 return -1; 1520 1521 ifp = ifptr; 1522 mask = NULL; 1523 1524 if (v == 4) 1525 inp->in4.s_addr = 0; 1526 #ifdef USE_INET6 1527 else if (v == 6) 1528 bzero((char *)inp, sizeof(*inp)); 1529 #endif 1530 1531 ifa = IFADDR_FIRST(ifp); 1532 sock = ifa ? ifa->ifa_addr : NULL; 1533 while (sock != NULL && ifa != NULL) { 1534 sin = (struct sockaddr_in *)sock; 1535 if ((v == 4) && (sin->sin_family == AF_INET)) 1536 break; 1537 #ifdef USE_INET6 1538 if ((v == 6) && (sin->sin_family == AF_INET6)) { 1539 inp6 = &((struct sockaddr_in6 *)sin)->sin6_addr; 1540 if (!IN6_IS_ADDR_LINKLOCAL(inp6) && 1541 !IN6_IS_ADDR_LOOPBACK(inp6)) 1542 break; 1543 } 1544 #endif 1545 ifa = IFADDR_NEXT(ifa); 1546 if (ifa != NULL) 1547 sock = ifa->ifa_addr; 1548 } 1549 if (ifa == NULL || sock == NULL) 1550 return -1; 1551 1552 mask = ifa->ifa_netmask; 1553 if (atype == FRI_BROADCAST) 1554 sock = ifa->ifa_broadaddr; 1555 else if (atype == FRI_PEERADDR) 1556 sock = ifa->ifa_dstaddr; 1557 1558 #ifdef USE_INET6 1559 if (v == 6) 1560 return ipf_ifpfillv6addr(atype, (struct sockaddr_in6 *)sock, 1561 (struct sockaddr_in6 *)mask, 1562 inp, inpmask); 1563 #endif 1564 return ipf_ifpfillv4addr(atype, (struct sockaddr_in *)sock, 1565 (struct sockaddr_in *)mask, 1566 &inp->in4, &inpmask->in4); 1567 } 1568 1569 1570 u_32_t 1571 ipf_newisn(fr_info_t *fin) 1572 { 1573 #if __NetBSD_Version__ >= 105190000 /* 1.5T */ 1574 size_t asz; 1575 1576 if (fin->fin_v == 4) 1577 asz = sizeof(struct in_addr); 1578 else if (fin->fin_v == 6) 1579 asz = sizeof(fin->fin_src); 1580 else /* XXX: no way to return error */ 1581 return 0; 1582 #ifdef INET 1583 return tcp_new_iss1((void *)&fin->fin_src, (void *)&fin->fin_dst, 1584 fin->fin_sport, fin->fin_dport, asz, 0); 1585 #else 1586 return ENOSYS; 1587 #endif 1588 #else 1589 static int iss_seq_off = 0; 1590 u_char hash[16]; 1591 u_32_t newiss; 1592 MD5_CTX ctx; 1593 1594 /* 1595 * Compute the base value of the ISS. It is a hash 1596 * of (saddr, sport, daddr, dport, secret). 1597 */ 1598 MD5Init(&ctx); 1599 1600 MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_src, 1601 sizeof(fin->fin_fi.fi_src)); 1602 MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_dst, 1603 sizeof(fin->fin_fi.fi_dst)); 1604 MD5Update(&ctx, (u_char *) &fin->fin_dat, sizeof(fin->fin_dat)); 1605 1606 MD5Update(&ctx, ipf_iss_secret, sizeof(ipf_iss_secret)); 1607 1608 MD5Final(hash, &ctx); 1609 1610 memcpy(&newiss, hash, sizeof(newiss)); 1611 1612 /* 1613 * Now increment our "timer", and add it in to 1614 * the computed value. 1615 * 1616 * XXX Use `addin'? 1617 * XXX TCP_ISSINCR too large to use? 1618 */ 1619 iss_seq_off += 0x00010000; 1620 newiss += iss_seq_off; 1621 return newiss; 1622 #endif 1623 } 1624 1625 1626 /* ------------------------------------------------------------------------ */ 1627 /* Function: ipf_nextipid */ 1628 /* Returns: int - 0 == success, -1 == error (packet should be droppped) */ 1629 /* Parameters: fin(I) - pointer to packet information */ 1630 /* */ 1631 /* Returns the next IPv4 ID to use for this packet. */ 1632 /* ------------------------------------------------------------------------ */ 1633 u_short 1634 ipf_nextipid(fr_info_t *fin) 1635 { 1636 #ifdef USE_MUTEXES 1637 ipf_main_softc_t *softc = fin->fin_main_soft; 1638 #endif 1639 u_short id; 1640 1641 MUTEX_ENTER(&softc->ipf_rw); 1642 id = ipid++; 1643 MUTEX_EXIT(&softc->ipf_rw); 1644 1645 return id; 1646 } 1647 1648 1649 EXTERN_INLINE int 1650 ipf_checkv4sum(fr_info_t *fin) 1651 { 1652 #ifdef M_CSUM_TCP_UDP_BAD 1653 int manual, pflag, cflags, active; 1654 mb_t *m; 1655 1656 if ((fin->fin_flx & FI_NOCKSUM) != 0) 1657 return 0; 1658 1659 if ((fin->fin_flx & FI_SHORT) != 0) 1660 return 1; 1661 1662 if (fin->fin_cksum != FI_CK_NEEDED) 1663 return (fin->fin_cksum > FI_CK_NEEDED) ? 0 : -1; 1664 1665 manual = 0; 1666 m = fin->fin_m; 1667 if (m == NULL) { 1668 manual = 1; 1669 goto skipauto; 1670 } 1671 1672 switch (fin->fin_p) 1673 { 1674 case IPPROTO_UDP : 1675 pflag = M_CSUM_UDPv4; 1676 break; 1677 case IPPROTO_TCP : 1678 pflag = M_CSUM_TCPv4; 1679 break; 1680 default : 1681 pflag = 0; 1682 manual = 1; 1683 break; 1684 } 1685 1686 active = ((struct ifnet *)fin->fin_ifp)->if_csum_flags_rx & pflag; 1687 active |= M_CSUM_TCP_UDP_BAD | M_CSUM_DATA; 1688 cflags = m->m_pkthdr.csum_flags & active; 1689 1690 if (pflag != 0) { 1691 if (cflags == (pflag | M_CSUM_TCP_UDP_BAD)) { 1692 fin->fin_flx |= FI_BAD; 1693 fin->fin_cksum = FI_CK_BAD; 1694 } else if (cflags == (pflag | M_CSUM_DATA)) { 1695 if ((m->m_pkthdr.csum_data ^ 0xffff) != 0) { 1696 fin->fin_flx |= FI_BAD; 1697 fin->fin_cksum = FI_CK_BAD; 1698 } else { 1699 fin->fin_cksum = FI_CK_SUMOK; 1700 } 1701 } else if (cflags == pflag) { 1702 fin->fin_cksum = FI_CK_SUMOK; 1703 } else { 1704 manual = 1; 1705 } 1706 } 1707 skipauto: 1708 if (manual != 0) { 1709 if (ipf_checkl4sum(fin) == -1) { 1710 fin->fin_flx |= FI_BAD; 1711 return -1; 1712 } 1713 } 1714 #else 1715 if (ipf_checkl4sum(fin) == -1) { 1716 fin->fin_flx |= FI_BAD; 1717 return -1; 1718 } 1719 #endif 1720 return 0; 1721 } 1722 1723 1724 #ifdef USE_INET6 1725 EXTERN_INLINE int 1726 ipf_checkv6sum(fr_info_t *fin) 1727 { 1728 # ifdef M_CSUM_TCP_UDP_BAD 1729 int manual, pflag, cflags, active; 1730 mb_t *m; 1731 1732 if ((fin->fin_flx & FI_NOCKSUM) != 0) 1733 return 0; 1734 1735 if ((fin->fin_flx & FI_SHORT) != 0) 1736 return 1; 1737 1738 if (fin->fin_cksum != FI_CK_SUMOK) 1739 return (fin->fin_cksum > FI_CK_NEEDED) ? 0 : -1; 1740 1741 1742 manual = 0; 1743 m = fin->fin_m; 1744 1745 switch (fin->fin_p) 1746 { 1747 case IPPROTO_UDP : 1748 pflag = M_CSUM_UDPv6; 1749 break; 1750 case IPPROTO_TCP : 1751 pflag = M_CSUM_TCPv6; 1752 break; 1753 default : 1754 pflag = 0; 1755 manual = 1; 1756 break; 1757 } 1758 1759 active = ((struct ifnet *)fin->fin_ifp)->if_csum_flags_rx & pflag; 1760 active |= M_CSUM_TCP_UDP_BAD | M_CSUM_DATA; 1761 cflags = m->m_pkthdr.csum_flags & active; 1762 1763 if (pflag != 0) { 1764 if (cflags == (pflag | M_CSUM_TCP_UDP_BAD)) { 1765 fin->fin_flx |= FI_BAD; 1766 } else if (cflags == (pflag | M_CSUM_DATA)) { 1767 if ((m->m_pkthdr.csum_data ^ 0xffff) != 0) 1768 fin->fin_flx |= FI_BAD; 1769 } else if (cflags == pflag) { 1770 ; 1771 } else { 1772 manual = 1; 1773 } 1774 } 1775 if (manual != 0) { 1776 if (ipf_checkl4sum(fin) == -1) { 1777 fin->fin_flx |= FI_BAD; 1778 return -1; 1779 } 1780 } 1781 # else 1782 if (ipf_checkl4sum(fin) == -1) { 1783 fin->fin_flx |= FI_BAD; 1784 return -1; 1785 } 1786 # endif 1787 return 0; 1788 } 1789 #endif /* USE_INET6 */ 1790 1791 1792 size_t 1793 mbufchainlen(struct mbuf *m0) 1794 { 1795 size_t len; 1796 1797 if ((m0->m_flags & M_PKTHDR) != 0) { 1798 len = m0->m_pkthdr.len; 1799 } else { 1800 struct mbuf *m; 1801 1802 for (m = m0, len = 0; m != NULL; m = m->m_next) 1803 len += m->m_len; 1804 } 1805 return len; 1806 } 1807 1808 1809 /* ------------------------------------------------------------------------ */ 1810 /* Function: ipf_pullup */ 1811 /* Returns: NULL == pullup failed, else pointer to protocol header */ 1812 /* Parameters: xmin(I)- pointer to buffer where data packet starts */ 1813 /* fin(I) - pointer to packet information */ 1814 /* len(I) - number of bytes to pullup */ 1815 /* */ 1816 /* Attempt to move at least len bytes (from the start of the buffer) into a */ 1817 /* single buffer for ease of access. Operating system native functions are */ 1818 /* used to manage buffers - if necessary. If the entire packet ends up in */ 1819 /* a single buffer, set the FI_COALESCE flag even though ipf_coalesce() has */ 1820 /* not been called. Both fin_ip and fin_dp are updated before exiting _IF_ */ 1821 /* and ONLY if the pullup succeeds. */ 1822 /* */ 1823 /* We assume that 'xmin' is a pointer to a buffer that is part of the chain */ 1824 /* of buffers that starts at *fin->fin_mp. */ 1825 /* ------------------------------------------------------------------------ */ 1826 void * 1827 ipf_pullup(mb_t *xmin, fr_info_t *fin, int len) 1828 { 1829 int dpoff, ipoff; 1830 mb_t *m = xmin; 1831 char *ip; 1832 1833 if (m == NULL) 1834 return NULL; 1835 1836 ip = (char *)fin->fin_ip; 1837 if ((fin->fin_flx & FI_COALESCE) != 0) 1838 return ip; 1839 1840 ipoff = fin->fin_ipoff; 1841 if (fin->fin_dp != NULL) 1842 dpoff = (char *)fin->fin_dp - (char *)ip; 1843 else 1844 dpoff = 0; 1845 1846 if (M_LEN(m) < len) { 1847 mb_t *n = *fin->fin_mp; 1848 /* 1849 * Assume that M_PKTHDR is set and just work with what is left 1850 * rather than check.. 1851 * Should not make any real difference, anyway. 1852 */ 1853 if (m != n) { 1854 /* 1855 * Record the mbuf that points to the mbuf that we're 1856 * about to go to work on so that we can update the 1857 * m_next appropriately later. 1858 */ 1859 for (; n->m_next != m; n = n->m_next) 1860 ; 1861 } else { 1862 n = NULL; 1863 } 1864 1865 #ifdef MHLEN 1866 if (len > MHLEN) 1867 #else 1868 if (len > MLEN) 1869 #endif 1870 { 1871 #ifdef HAVE_M_PULLDOWN 1872 if (m_pulldown(m, 0, len, NULL) == NULL) 1873 m = NULL; 1874 #else 1875 FREE_MB_T(*fin->fin_mp); 1876 m = NULL; 1877 n = NULL; 1878 #endif 1879 } else 1880 { 1881 m = m_pullup(m, len); 1882 } 1883 if (n != NULL) 1884 n->m_next = m; 1885 if (m == NULL) { 1886 /* 1887 * When n is non-NULL, it indicates that m pointed to 1888 * a sub-chain (tail) of the mbuf and that the head 1889 * of this chain has not yet been free'd. 1890 */ 1891 if (n != NULL) { 1892 FREE_MB_T(*fin->fin_mp); 1893 } 1894 1895 *fin->fin_mp = NULL; 1896 fin->fin_m = NULL; 1897 return NULL; 1898 } 1899 1900 if (n == NULL) 1901 *fin->fin_mp = m; 1902 1903 while (M_LEN(m) == 0) { 1904 m = m->m_next; 1905 } 1906 fin->fin_m = m; 1907 ip = MTOD(m, char *) + ipoff; 1908 1909 fin->fin_ip = (ip_t *)ip; 1910 if (fin->fin_dp != NULL) 1911 fin->fin_dp = (char *)fin->fin_ip + dpoff; 1912 if (fin->fin_fraghdr != NULL) 1913 fin->fin_fraghdr = (char *)ip + 1914 ((char *)fin->fin_fraghdr - 1915 (char *)fin->fin_ip); 1916 } 1917 1918 if (len == fin->fin_plen) 1919 fin->fin_flx |= FI_COALESCE; 1920 return ip; 1921 } 1922 1923 1924 int 1925 ipf_inject(fr_info_t *fin, mb_t *m) 1926 { 1927 int error; 1928 1929 if (fin->fin_out == 0) { 1930 struct ifqueue *ifq; 1931 1932 ifq = &ipintrq; 1933 1934 if (IF_QFULL(ifq)) { 1935 IF_DROP(ifq); 1936 FREE_MB_T(m); 1937 error = ENOBUFS; 1938 } else { 1939 IF_ENQUEUE(ifq, m); 1940 error = 0; 1941 } 1942 } else { 1943 error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL); 1944 } 1945 1946 return error; 1947 } 1948 1949 1950 u_32_t 1951 ipf_random(void) 1952 { 1953 int number; 1954 1955 #ifdef _CPRNG_H 1956 number = cprng_fast32(); 1957 #else 1958 number = arc4random(); 1959 #endif 1960 return number; 1961 } 1962 1963 1964 /* 1965 * routines below for saving IP headers to buffer 1966 */ 1967 static int ipfopen(dev_t dev, int flags 1968 #if (NetBSD >= 199511) 1969 , int devtype, PROC_T *p 1970 #endif 1971 ) 1972 { 1973 u_int unit = GET_MINOR(dev); 1974 int error; 1975 1976 if (IPL_LOGMAX < unit) { 1977 error = ENXIO; 1978 } else { 1979 switch (unit) 1980 { 1981 case IPL_LOGIPF : 1982 case IPL_LOGNAT : 1983 case IPL_LOGSTATE : 1984 case IPL_LOGAUTH : 1985 case IPL_LOGLOOKUP : 1986 case IPL_LOGSYNC : 1987 #ifdef IPFILTER_SCAN 1988 case IPL_LOGSCAN : 1989 #endif 1990 error = 0; 1991 break; 1992 default : 1993 error = ENXIO; 1994 break; 1995 } 1996 } 1997 return error; 1998 } 1999 2000 2001 static int ipfclose(dev_t dev, int flags 2002 #if (NetBSD >= 199511) 2003 , int devtype, PROC_T *p 2004 #endif 2005 ) 2006 { 2007 u_int unit = GET_MINOR(dev); 2008 2009 if (IPL_LOGMAX < unit) 2010 unit = ENXIO; 2011 else 2012 unit = 0; 2013 return unit; 2014 } 2015 2016 /* 2017 * ipfread/ipflog 2018 * both of these must operate with at least splnet() lest they be 2019 * called during packet processing and cause an inconsistancy to appear in 2020 * the filter lists. 2021 */ 2022 static int ipfread(dev_t dev, struct uio *uio, int ioflag) 2023 { 2024 2025 if (ipfmain.ipf_running < 1) { 2026 ipfmain.ipf_interror = 130006; 2027 return EIO; 2028 } 2029 2030 if (GET_MINOR(dev) == IPL_LOGSYNC) 2031 return ipf_sync_read(&ipfmain, uio); 2032 2033 #ifdef IPFILTER_LOG 2034 return ipf_log_read(&ipfmain, GET_MINOR(dev), uio); 2035 #else 2036 ipfmain.ipf_interror = 130007; 2037 return ENXIO; 2038 #endif 2039 } 2040 2041 2042 /* 2043 * ipfwrite 2044 * both of these must operate with at least splnet() lest they be 2045 * called during packet processing and cause an inconsistancy to appear in 2046 * the filter lists. 2047 */ 2048 static int ipfwrite(dev_t dev, struct uio *uio, int ioflag) 2049 { 2050 2051 if (ipfmain.ipf_running < 1) { 2052 ipfmain.ipf_interror = 130008; 2053 return EIO; 2054 } 2055 2056 if (GET_MINOR(dev) == IPL_LOGSYNC) 2057 return ipf_sync_write(&ipfmain, uio); 2058 ipfmain.ipf_interror = 130009; 2059 return ENXIO; 2060 } 2061 2062 2063 static int ipfpoll(dev_t dev, int events, PROC_T *p) 2064 { 2065 u_int unit = GET_MINOR(dev); 2066 int revents = 0; 2067 2068 if (IPL_LOGMAX < unit) { 2069 ipfmain.ipf_interror = 130010; 2070 return ENXIO; 2071 } 2072 2073 switch (unit) 2074 { 2075 case IPL_LOGIPF : 2076 case IPL_LOGNAT : 2077 case IPL_LOGSTATE : 2078 #ifdef IPFILTER_LOG 2079 if ((events & (POLLIN | POLLRDNORM)) && 2080 ipf_log_canread(&ipfmain, unit)) 2081 revents |= events & (POLLIN | POLLRDNORM); 2082 #endif 2083 break; 2084 case IPL_LOGAUTH : 2085 if ((events & (POLLIN | POLLRDNORM)) && 2086 ipf_auth_waiting(&ipfmain)) 2087 revents |= events & (POLLIN | POLLRDNORM); 2088 break; 2089 case IPL_LOGSYNC : 2090 if ((events & (POLLIN | POLLRDNORM)) && 2091 ipf_sync_canread(&ipfmain)) 2092 revents |= events & (POLLIN | POLLRDNORM); 2093 if ((events & (POLLOUT | POLLWRNORM)) && 2094 ipf_sync_canwrite(&ipfmain)) 2095 revents |= events & (POLLOUT | POLLWRNORM); 2096 break; 2097 case IPL_LOGSCAN : 2098 case IPL_LOGLOOKUP : 2099 default : 2100 break; 2101 } 2102 2103 if ((revents == 0) && (((events & (POLLIN|POLLRDNORM)) != 0))) 2104 selrecord(p, &ipfmain.ipf_selwait[unit]); 2105 return revents; 2106 } 2107 2108 u_int 2109 ipf_pcksum(fr_info_t *fin, int hlen, u_int sum) 2110 { 2111 struct mbuf *m; 2112 u_int sum2; 2113 int off; 2114 2115 m = fin->fin_m; 2116 off = (char *)fin->fin_dp - (char *)fin->fin_ip; 2117 m->m_data += hlen; 2118 m->m_len -= hlen; 2119 sum2 = in_cksum(fin->fin_m, fin->fin_plen - off); 2120 m->m_len += hlen; 2121 m->m_data -= hlen; 2122 2123 /* 2124 * Both sum and sum2 are partial sums, so combine them together. 2125 */ 2126 sum += ~sum2 & 0xffff; 2127 while (sum > 0xffff) 2128 sum = (sum & 0xffff) + (sum >> 16); 2129 sum2 = ~sum & 0xffff; 2130 return sum2; 2131 } 2132
Indexes created Sat Oct 11 08:10:02 GMT 2025