ip_fil_netbsd.c revision 1.8
1 /* $NetBSD: ip_fil_netbsd.c,v 1.8 2014/03/16 05:20:30 dholland Exp $ */ 2 3 /* 4 * Copyright (C) 2012 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 */ 8 #if !defined(lint) 9 #if defined(__NetBSD__) 10 #include <sys/cdefs.h> 11 __KERNEL_RCSID(0, "$NetBSD: ip_fil_netbsd.c,v 1.8 2014/03/16 05:20:30 dholland Exp $"); 12 #else 13 static const char sccsid[] = "@(#)ip_fil.c 2.41 6/5/96 (C) 1993-2000 Darren Reed"; 14 static const char rcsid[] = "@(#)Id: ip_fil_netbsd.c,v 1.1.1.2 2012/07/22 13:45:17 darrenr Exp"; 15 #endif 16 #endif 17 18 #if defined(KERNEL) || defined(_KERNEL) 19 # undef KERNEL 20 # undef _KERNEL 21 # define KERNEL 1 22 # define _KERNEL 1 23 #endif 24 #include <sys/param.h> 25 #if (NetBSD >= 199905) && !defined(IPFILTER_LKM) 26 # include "opt_ipsec.h" 27 #endif 28 #include <sys/errno.h> 29 #include <sys/types.h> 30 #include <sys/file.h> 31 #include <sys/ioctl.h> 32 #include <sys/time.h> 33 #include <sys/systm.h> 34 #include <sys/select.h> 35 #if (NetBSD > 199609) 36 # include <sys/dirent.h> 37 #else 38 # include <sys/dir.h> 39 #endif 40 #if (__NetBSD_Version__ >= 599005900) 41 # include <sys/cprng.h> 42 #endif 43 #include <sys/mbuf.h> 44 #include <sys/protosw.h> 45 #include <sys/socket.h> 46 #include <sys/poll.h> 47 #if (__NetBSD_Version__ >= 399002000) 48 # include <sys/kauth.h> 49 #endif 50 51 #include <net/if.h> 52 #include <net/route.h> 53 #include <netinet/in.h> 54 #include <netinet/in_var.h> 55 #include <netinet/in_systm.h> 56 #include <netinet/ip.h> 57 #include <netinet/ip_var.h> 58 #include <netinet/tcp.h> 59 #if __NetBSD_Version__ >= 105190000 /* 1.5T */ 60 # include <netinet/tcp_timer.h> 61 # include <netinet/tcp_var.h> 62 #endif 63 #include <netinet/udp.h> 64 #include <netinet/tcpip.h> 65 #include <netinet/ip_icmp.h> 66 #include "netinet/ip_compat.h" 67 #ifdef USE_INET6 68 # include <netinet/icmp6.h> 69 # if (__NetBSD_Version__ >= 106000000) 70 # include <netinet6/nd6.h> 71 # endif 72 #endif 73 #include "netinet/ip_fil.h" 74 #include "netinet/ip_nat.h" 75 #include "netinet/ip_frag.h" 76 #include "netinet/ip_state.h" 77 #include "netinet/ip_proxy.h" 78 #include "netinet/ip_auth.h" 79 #include "netinet/ip_sync.h" 80 #include "netinet/ip_lookup.h" 81 #include "netinet/ip_dstlist.h" 82 #ifdef IPFILTER_SCAN 83 #include "netinet/ip_scan.h" 84 #endif 85 #include <sys/md5.h> 86 #include <sys/kernel.h> 87 #include <sys/conf.h> 88 #ifdef INET 89 extern int ip_optcopy (struct ip *, struct ip *); 90 #endif 91 92 #ifdef IPFILTER_M_IPFILTER 93 MALLOC_DEFINE(M_IPFILTER, "IP Filter", "IP Filter packet filter data structures"); 94 #endif 95 96 #if __NetBSD_Version__ >= 105009999 97 # define csuminfo csum_flags 98 #endif 99 100 #if __NetBSD_Version__ < 200000000 101 extern struct protosw inetsw[]; 102 #endif 103 104 #if (__NetBSD_Version__ >= 599002000) 105 static kauth_listener_t ipf_listener; 106 #endif 107 108 #if (__NetBSD_Version__ < 399001400) 109 extern int ip6_getpmtu (struct route_in6 *, struct route_in6 *, 110 struct ifnet *, struct in6_addr *, u_long *, 111 int *); 112 #endif 113 #if (NetBSD >= 199511) 114 static int ipfopen(dev_t dev, int flags, int devtype, PROC_T *p); 115 static int ipfclose(dev_t dev, int flags, int devtype, PROC_T *p); 116 #else 117 # if (__NetBSD_Version__ >= 399001400) 118 static int ipfopen(dev_t dev, int flags, struct lwp *); 119 static int ipfclose(dev_t dev, int flags, struct lwp *); 120 # else 121 static int ipfopen(dev_t dev, int flags); 122 static int ipfclose(dev_t dev, int flags); 123 # endif /* __NetBSD_Version__ >= 399001400 */ 124 #endif 125 static int ipfread(dev_t, struct uio *, int ioflag); 126 static int ipfwrite(dev_t, struct uio *, int ioflag); 127 static int ipfpoll(dev_t, int events, PROC_T *); 128 static void ipf_timer_func(void *ptr); 129 130 const struct cdevsw ipl_cdevsw = { 131 .d_open = ipfopen, 132 .d_close = ipfclose, 133 .d_read = ipfread, 134 .d_write = ipfwrite, 135 .d_ioctl = ipfioctl, 136 .d_stop = nostop, 137 .d_tty = notty, 138 .d_poll = ipfpoll, 139 .d_mmap = nommap, 140 #if (__NetBSD_Version__ >= 200000000) 141 .d_kqfilter = nokqfilter, 142 #endif 143 #ifdef D_OTHER 144 .d_flag = D_OTHER 145 #else 146 .d_flag = 0 147 #endif 148 }; 149 150 ipf_main_softc_t ipfmain; 151 152 static u_short ipid = 0; 153 static int (*ipf_savep)(void *, ip_t *, int, void *, int, struct mbuf **); 154 static int ipf_send_ip(fr_info_t *, mb_t *); 155 #ifdef USE_INET6 156 static int ipf_fastroute6(struct mbuf *, struct mbuf **, 157 fr_info_t *, frdest_t *); 158 #endif 159 160 #if defined(NETBSD_PF) 161 # include <net/pfil.h> 162 /* 163 * We provide the ipf_checkp name just to minimize changes later. 164 */ 165 int (*ipf_checkp)(void *, ip_t *ip, int hlen, void *ifp, int out, mb_t **mp); 166 #endif /* NETBSD_PF */ 167 168 #if defined(__NetBSD_Version__) && (__NetBSD_Version__ >= 105110000) 169 # include <net/pfil.h> 170 171 static int ipf_check_wrapper(void *, struct mbuf **, struct ifnet *, int ); 172 173 static int 174 ipf_check_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 175 { 176 struct ip *ip; 177 int rv, hlen; 178 179 #if __NetBSD_Version__ >= 200080000 180 /* 181 * ensure that mbufs are writable beforehand 182 * as it's assumed by ipf code. 183 * XXX inefficient 184 */ 185 int error = m_makewritable(mp, 0, M_COPYALL, M_DONTWAIT); 186 187 if (error) { 188 m_freem(*mp); 189 *mp = NULL; 190 return error; 191 } 192 #endif 193 ip = mtod(*mp, struct ip *); 194 hlen = ip->ip_hl << 2; 195 196 #ifdef INET 197 #if defined(M_CSUM_TCPv4) 198 /* 199 * If the packet is out-bound, we can't delay checksums 200 * here. For in-bound, the checksum has already been 201 * validated. 202 */ 203 if (dir == PFIL_OUT) { 204 if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 205 in_delayed_cksum(*mp); 206 (*mp)->m_pkthdr.csum_flags &= 207 ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 208 } 209 } 210 #endif /* M_CSUM_TCPv4 */ 211 #endif /* INET */ 212 213 /* 214 * Note, we don't need to update the checksum, because 215 * it has already been verified. 216 */ 217 rv = ipf_check(&ipfmain, ip, hlen, ifp, (dir == PFIL_OUT), mp); 218 219 return (rv); 220 } 221 222 # ifdef USE_INET6 223 # include <netinet/ip6.h> 224 225 static int ipf_check_wrapper6(void *, struct mbuf **, struct ifnet *, int ); 226 227 static int 228 ipf_check_wrapper6(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 229 { 230 #if defined(INET6) 231 # if defined(M_CSUM_TCPv6) && (__NetBSD_Version__ > 200000000) 232 /* 233 * If the packet is out-bound, we can't delay checksums 234 * here. For in-bound, the checksum has already been 235 * validated. 236 */ 237 if (dir == PFIL_OUT) { 238 if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv6|M_CSUM_UDPv6)) { 239 # if (__NetBSD_Version__ > 399000600) 240 in6_delayed_cksum(*mp); 241 # endif 242 (*mp)->m_pkthdr.csum_flags &= ~(M_CSUM_TCPv6| 243 M_CSUM_UDPv6); 244 } 245 } 246 # endif 247 #endif /* INET6 */ 248 249 return (ipf_check(&ipfmain, mtod(*mp, struct ip *), sizeof(struct ip6_hdr), 250 ifp, (dir == PFIL_OUT), mp)); 251 } 252 # endif 253 254 255 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 256 static int ipf_pfilsync(void *, struct mbuf **, struct ifnet *, int); 257 258 static int 259 ipf_pfilsync(void *hdr, struct mbuf **mp, struct ifnet *ifp, int dir) 260 { 261 /* 262 * The interface pointer is useless for create (we have nothing to 263 * compare it to) and at detach, the interface name is still in the 264 * list of active NICs (albeit, down, but that's not any real 265 * indicator) and doing ifunit() on the name will still return the 266 * pointer, so it's not much use then, either. 267 */ 268 ipf_sync(&ipfmain, NULL); 269 return 0; 270 } 271 # endif 272 273 #endif /* __NetBSD_Version__ >= 105110000 */ 274 275 276 #if defined(IPFILTER_LKM) 277 int 278 ipf_identify(s) 279 char *s; 280 { 281 if (strcmp(s, "ipl") == 0) 282 return 1; 283 return 0; 284 } 285 #endif /* IPFILTER_LKM */ 286 287 #if (__NetBSD_Version__ >= 599002000) 288 static int 289 ipf_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie, 290 void *arg0, void *arg1, void *arg2, void *arg3) 291 { 292 int result; 293 enum kauth_network_req req; 294 295 result = KAUTH_RESULT_DEFER; 296 req = (enum kauth_network_req)arg0; 297 298 if (action != KAUTH_NETWORK_FIREWALL) 299 return result; 300 301 /* These must have came from device context. */ 302 if ((req == KAUTH_REQ_NETWORK_FIREWALL_FW) || 303 (req == KAUTH_REQ_NETWORK_FIREWALL_NAT)) 304 result = KAUTH_RESULT_ALLOW; 305 306 return result; 307 } 308 #endif 309 310 /* 311 * Try to detect the case when compiling for NetBSD with pseudo-device 312 */ 313 void 314 ipfilterattach(int count) 315 { 316 317 #if (__NetBSD_Version__ >= 599002000) 318 ipf_listener = kauth_listen_scope(KAUTH_SCOPE_NETWORK, 319 ipf_listener_cb, NULL); 320 #endif 321 322 if (ipf_load_all() == 0) 323 (void) ipf_create_all(&ipfmain); 324 } 325 326 327 int 328 ipfattach(ipf_main_softc_t *softc) 329 { 330 SPL_INT(s); 331 #if (__NetBSD_Version__ >= 499005500) 332 int i; 333 #endif 334 #if defined(NETBSD_PF) && (__NetBSD_Version__ >= 104200000) 335 int error = 0; 336 # if defined(__NetBSD_Version__) && (__NetBSD_Version__ >= 105110000) 337 pfil_head_t *ph_inet; 338 # ifdef USE_INET6 339 pfil_head_t *ph_inet6; 340 # endif 341 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 342 pfil_head_t *ph_ifsync; 343 # endif 344 # endif 345 #endif 346 347 SPL_NET(s); 348 if ((softc->ipf_running > 0) || (ipf_checkp == ipf_check)) { 349 printf("IP Filter: already initialized\n"); 350 SPL_X(s); 351 IPFERROR(130017); 352 return EBUSY; 353 } 354 355 if (ipf_init_all(softc) < 0) { 356 SPL_X(s); 357 IPFERROR(130015); 358 return EIO; 359 } 360 361 #ifdef NETBSD_PF 362 # if (__NetBSD_Version__ >= 104200000) 363 # if __NetBSD_Version__ >= 105110000 364 ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET); 365 # ifdef USE_INET6 366 ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6); 367 # endif 368 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 369 ph_ifsync = pfil_head_get(PFIL_TYPE_IFNET, 0); 370 # endif 371 372 if (ph_inet == NULL 373 # ifdef USE_INET6 374 && ph_inet6 == NULL 375 # endif 376 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 377 && ph_ifsync == NULL 378 # endif 379 ) { 380 SPL_X(s); 381 IPFERROR(130016); 382 return ENODEV; 383 } 384 385 if (ph_inet != NULL) 386 error = pfil_add_hook((void *)ipf_check_wrapper, NULL, 387 PFIL_IN|PFIL_OUT, ph_inet); 388 else 389 error = 0; 390 # else 391 error = pfil_add_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 392 &inetsw[ip_protox[IPPROTO_IP]].pr_pfh); 393 # endif 394 if (error) { 395 IPFERROR(130013); 396 goto pfil_error; 397 } 398 # else 399 pfil_add_hook((void *)ipf_check, PFIL_IN|PFIL_OUT); 400 # endif 401 402 # ifdef USE_INET6 403 # if __NetBSD_Version__ >= 105110000 404 if (ph_inet6 != NULL) 405 error = pfil_add_hook((void *)ipf_check_wrapper6, NULL, 406 PFIL_IN|PFIL_OUT, ph_inet6); 407 else 408 error = 0; 409 if (error) { 410 pfil_remove_hook((void *)ipf_check_wrapper6, NULL, 411 PFIL_IN|PFIL_OUT, ph_inet6); 412 ipfmain.ipf_interror = 130014; 413 goto pfil_error; 414 } 415 # else 416 error = pfil_add_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 417 &inetsw[ip_protox[IPPROTO_IPV6]].pr_pfh); 418 if (error) { 419 pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 420 &inetsw[ip_protox[IPPROTO_IP]].pr_pfh); 421 IPFERROR(130014); 422 goto pfil_error; 423 } 424 # endif 425 # endif 426 427 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 428 if (ph_ifsync != NULL) 429 (void) pfil_add_hook((void *)ipf_pfilsync, NULL, 430 PFIL_IFNET, ph_ifsync); 431 # endif 432 #endif 433 434 #if (__NetBSD_Version__ >= 499005500) 435 for (i = 0; i < IPL_LOGSIZE; i++) 436 selinit(&ipfmain.ipf_selwait[i]); 437 #else 438 bzero((char *)ipfmain.ipf_selwait, sizeof(ipfmain.ipf_selwait)); 439 #endif 440 ipf_savep = ipf_checkp; 441 ipf_checkp = ipf_check; 442 443 #ifdef INET 444 if (softc->ipf_control_forwarding & 1) 445 ipforwarding = 1; 446 #endif 447 448 ipid = 0; 449 450 SPL_X(s); 451 452 #if (__NetBSD_Version__ >= 104010000) 453 # if (__NetBSD_Version__ >= 499002000) 454 callout_init(&softc->ipf_slow_ch, 0); 455 # else 456 callout_init(&softc->ipf_slow_ch); 457 # endif 458 callout_reset(&softc->ipf_slow_ch, (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT, 459 ipf_timer_func, softc); 460 #else 461 timeout(ipf_timer_func, softc, (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT); 462 #endif 463 464 return 0; 465 466 #if __NetBSD_Version__ >= 105110000 467 pfil_error: 468 SPL_X(s); 469 ipf_fini_all(softc); 470 return error; 471 #endif 472 } 473 474 static void 475 ipf_timer_func(void *ptr) 476 { 477 ipf_main_softc_t *softc = ptr; 478 SPL_INT(s); 479 480 SPL_NET(s); 481 READ_ENTER(&softc->ipf_global); 482 483 if (softc->ipf_running > 0) 484 ipf_slowtimer(softc); 485 486 if (softc->ipf_running == -1 || softc->ipf_running == 1) { 487 #if NETBSD_GE_REV(104240000) 488 callout_reset(&softc->ipf_slow_ch, hz / 2, 489 ipf_timer_func, softc); 490 #else 491 timeout(ipf_timer_func, softc, 492 (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT); 493 #endif 494 } 495 RWLOCK_EXIT(&softc->ipf_global); 496 SPL_X(s); 497 } 498 499 500 /* 501 * Disable the filter by removing the hooks from the IP input/output 502 * stream. 503 */ 504 int 505 ipfdetach(ipf_main_softc_t *softc) 506 { 507 SPL_INT(s); 508 #if (__NetBSD_Version__ >= 499005500) 509 int i; 510 #endif 511 #if defined(NETBSD_PF) && (__NetBSD_Version__ >= 104200000) 512 int error = 0; 513 # if __NetBSD_Version__ >= 105150000 514 pfil_head_t *ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET); 515 # ifdef USE_INET6 516 pfil_head_t *ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6); 517 # endif 518 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 519 struct pfil_head *ph_ifsync = pfil_head_get(PFIL_TYPE_IFNET, 0); 520 # endif 521 # endif 522 #endif 523 524 SPL_NET(s); 525 526 #if (__NetBSD_Version__ >= 104010000) 527 if (softc->ipf_running > 0) 528 callout_stop(&softc->ipf_slow_ch); 529 #else 530 untimeout(ipf_slowtimer, NULL); 531 #endif /* NetBSD */ 532 533 ipf_checkp = ipf_savep; 534 (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE|FR_INACTIVE); 535 (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE); 536 537 #ifdef INET 538 if (softc->ipf_control_forwarding & 2) 539 ipforwarding = 0; 540 #endif 541 542 #ifdef NETBSD_PF 543 # if (__NetBSD_Version__ >= 104200000) 544 # if __NetBSD_Version__ >= 105110000 545 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET) 546 (void) pfil_remove_hook((void *)ipf_pfilsync, NULL, 547 PFIL_IFNET, ph_ifsync); 548 # endif 549 550 if (ph_inet != NULL) 551 error = pfil_remove_hook((void *)ipf_check_wrapper, NULL, 552 PFIL_IN|PFIL_OUT, ph_inet); 553 else 554 error = 0; 555 # else 556 error = pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 557 &inetsw[ip_protox[IPPROTO_IP]].pr_pfh); 558 # endif 559 if (error) { 560 SPL_X(s); 561 IPFERROR(130011); 562 return error; 563 } 564 # else 565 pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT); 566 # endif 567 # ifdef USE_INET6 568 # if __NetBSD_Version__ >= 105110000 569 if (ph_inet6 != NULL) 570 error = pfil_remove_hook((void *)ipf_check_wrapper6, NULL, 571 PFIL_IN|PFIL_OUT, ph_inet6); 572 else 573 error = 0; 574 # else 575 error = pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT, 576 &inetsw[ip_protox[IPPROTO_IPV6]].pr_pfh); 577 # endif 578 if (error) { 579 SPL_X(s); 580 IPFERROR(130012); 581 return error; 582 } 583 # endif 584 #endif 585 SPL_X(s); 586 587 #if (__NetBSD_Version__ >= 499005500) 588 for (i = 0; i < IPL_LOGSIZE; i++) 589 seldestroy(&ipfmain.ipf_selwait[i]); 590 #endif 591 592 ipf_fini_all(softc); 593 594 return 0; 595 } 596 597 598 /* 599 * Filter ioctl interface. 600 */ 601 int 602 ipfioctl(dev_t dev, u_long cmd, 603 #if (__NetBSD_Version__ >= 499001000) 604 void *data, 605 #else 606 caddr_t data, 607 #endif 608 int mode 609 #if (NetBSD >= 199511) 610 # if (__NetBSD_Version__ >= 399001400) 611 , struct lwp *p 612 # if (__NetBSD_Version__ >= 399002000) 613 # define UID(l) kauth_cred_getuid((l)->l_cred) 614 # else 615 # define UID(l) ((l)->l_proc->p_cred->p_ruid) 616 # endif 617 # else 618 , struct proc *p 619 # define UID(p) ((p)->p_cred->p_ruid) 620 # endif 621 #endif 622 ) 623 { 624 int error = 0, unit = 0; 625 SPL_INT(s); 626 627 #if (__NetBSD_Version__ >= 399002000) 628 if ((mode & FWRITE) && 629 kauth_authorize_network(p->l_cred, KAUTH_NETWORK_FIREWALL, 630 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, 631 NULL, NULL)) { 632 ipfmain.ipf_interror = 130005; 633 return EPERM; 634 } 635 #else 636 if ((securelevel >= 2) && (mode & FWRITE)) { 637 ipfmain.ipf_interror = 130001; 638 return EPERM; 639 } 640 #endif 641 642 unit = GET_MINOR(dev); 643 if ((IPL_LOGMAX < unit) || (unit < 0)) { 644 ipfmain.ipf_interror = 130002; 645 return ENXIO; 646 } 647 648 if (ipfmain.ipf_running <= 0) { 649 if (unit != IPL_LOGIPF && cmd != SIOCIPFINTERROR) { 650 ipfmain.ipf_interror = 130003; 651 return EIO; 652 } 653 if (cmd != SIOCIPFGETNEXT && cmd != SIOCIPFGET && 654 cmd != SIOCIPFSET && cmd != SIOCFRENB && 655 cmd != SIOCGETFS && cmd != SIOCGETFF && 656 cmd != SIOCIPFINTERROR) { 657 ipfmain.ipf_interror = 130004; 658 return EIO; 659 } 660 } 661 662 SPL_NET(s); 663 664 error = ipf_ioctlswitch(&ipfmain, unit, data, cmd, mode, UID(p), p); 665 if (error != -1) { 666 SPL_X(s); 667 return error; 668 } 669 670 SPL_X(s); 671 return error; 672 } 673 674 675 /* 676 * ipf_send_reset - this could conceivably be a call to tcp_respond(), but that 677 * requires a large amount of setting up and isn't any more efficient. 678 */ 679 int 680 ipf_send_reset(fr_info_t *fin) 681 { 682 struct tcphdr *tcp, *tcp2; 683 int tlen = 0, hlen; 684 struct mbuf *m; 685 #ifdef USE_INET6 686 ip6_t *ip6; 687 #endif 688 ip_t *ip; 689 690 tcp = fin->fin_dp; 691 if (tcp->th_flags & TH_RST) 692 return -1; /* feedback loop */ 693 694 if (ipf_checkl4sum(fin) == -1) 695 return -1; 696 697 tlen = fin->fin_dlen - (TCP_OFF(tcp) << 2) + 698 ((tcp->th_flags & TH_SYN) ? 1 : 0) + 699 ((tcp->th_flags & TH_FIN) ? 1 : 0); 700 701 #ifdef USE_INET6 702 hlen = (fin->fin_v == 6) ? sizeof(ip6_t) : sizeof(ip_t); 703 #else 704 hlen = sizeof(ip_t); 705 #endif 706 #ifdef MGETHDR 707 MGETHDR(m, M_DONTWAIT, MT_HEADER); 708 #else 709 MGET(m, M_DONTWAIT, MT_HEADER); 710 #endif 711 if (m == NULL) 712 return -1; 713 if (sizeof(*tcp2) + hlen > MHLEN) { 714 MCLGET(m, M_DONTWAIT); 715 if (m == NULL) 716 return -1; 717 if ((m->m_flags & M_EXT) == 0) { 718 FREE_MB_T(m); 719 return -1; 720 } 721 } 722 723 m->m_len = sizeof(*tcp2) + hlen; 724 m->m_data += max_linkhdr; 725 m->m_pkthdr.len = m->m_len; 726 m->m_pkthdr.rcvif = (struct ifnet *)0; 727 ip = mtod(m, struct ip *); 728 bzero((char *)ip, hlen); 729 #ifdef USE_INET6 730 ip6 = (ip6_t *)ip; 731 #endif 732 bzero((char *)ip, sizeof(*tcp2) + hlen); 733 tcp2 = (struct tcphdr *)((char *)ip + hlen); 734 tcp2->th_sport = tcp->th_dport; 735 tcp2->th_dport = tcp->th_sport; 736 737 if (tcp->th_flags & TH_ACK) { 738 tcp2->th_seq = tcp->th_ack; 739 tcp2->th_flags = TH_RST; 740 tcp2->th_ack = 0; 741 } else { 742 tcp2->th_seq = 0; 743 tcp2->th_ack = ntohl(tcp->th_seq); 744 tcp2->th_ack += tlen; 745 tcp2->th_ack = htonl(tcp2->th_ack); 746 tcp2->th_flags = TH_RST|TH_ACK; 747 } 748 tcp2->th_x2 = 0; 749 TCP_OFF_A(tcp2, sizeof(*tcp2) >> 2); 750 tcp2->th_win = tcp->th_win; 751 tcp2->th_sum = 0; 752 tcp2->th_urp = 0; 753 754 #ifdef USE_INET6 755 if (fin->fin_v == 6) { 756 ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow; 757 ip6->ip6_plen = htons(sizeof(struct tcphdr)); 758 ip6->ip6_nxt = IPPROTO_TCP; 759 ip6->ip6_hlim = 0; 760 ip6->ip6_src = fin->fin_dst6.in6; 761 ip6->ip6_dst = fin->fin_src6.in6; 762 tcp2->th_sum = in6_cksum(m, IPPROTO_TCP, 763 sizeof(*ip6), sizeof(*tcp2)); 764 return ipf_send_ip(fin, m); 765 } 766 #endif 767 #ifdef INET 768 ip->ip_p = IPPROTO_TCP; 769 ip->ip_len = htons(sizeof(struct tcphdr)); 770 ip->ip_src.s_addr = fin->fin_daddr; 771 ip->ip_dst.s_addr = fin->fin_saddr; 772 tcp2->th_sum = in_cksum(m, hlen + sizeof(*tcp2)); 773 ip->ip_len = hlen + sizeof(*tcp2); 774 return ipf_send_ip(fin, m); 775 #else 776 return 0; 777 #endif 778 } 779 780 781 /* 782 * Expects ip_len to be in host byte order when called. 783 */ 784 static int 785 ipf_send_ip(fr_info_t *fin, mb_t *m) 786 { 787 fr_info_t fnew; 788 #ifdef INET 789 ip_t *oip; 790 #endif 791 ip_t *ip; 792 int hlen; 793 794 ip = mtod(m, ip_t *); 795 bzero((char *)&fnew, sizeof(fnew)); 796 fnew.fin_main_soft = fin->fin_main_soft; 797 798 IP_V_A(ip, fin->fin_v); 799 switch (fin->fin_v) 800 { 801 #ifdef INET 802 case 4 : 803 oip = fin->fin_ip; 804 hlen = sizeof(*oip); 805 fnew.fin_v = 4; 806 fnew.fin_p = ip->ip_p; 807 fnew.fin_plen = ntohs(ip->ip_len); 808 HTONS(ip->ip_len); 809 IP_HL_A(ip, sizeof(*oip) >> 2); 810 ip->ip_tos = oip->ip_tos; 811 ip->ip_id = ipf_nextipid(fin); 812 ip->ip_off = htons(ip_mtudisc ? IP_DF : 0); 813 ip->ip_ttl = ip_defttl; 814 ip->ip_sum = 0; 815 break; 816 #endif 817 #ifdef USE_INET6 818 case 6 : 819 { 820 ip6_t *ip6 = (ip6_t *)ip; 821 822 ip6->ip6_vfc = 0x60; 823 ip6->ip6_hlim = IPDEFTTL; 824 825 hlen = sizeof(*ip6); 826 fnew.fin_p = ip6->ip6_nxt; 827 fnew.fin_v = 6; 828 fnew.fin_plen = ntohs(ip6->ip6_plen) + hlen; 829 break; 830 } 831 #endif 832 default : 833 return EINVAL; 834 } 835 #ifdef KAME_IPSEC 836 m->m_pkthdr.rcvif = NULL; 837 #endif 838 839 fnew.fin_ifp = fin->fin_ifp; 840 fnew.fin_flx = FI_NOCKSUM; 841 fnew.fin_m = m; 842 fnew.fin_ip = ip; 843 fnew.fin_mp = &m; 844 fnew.fin_hlen = hlen; 845 fnew.fin_dp = (char *)ip + hlen; 846 (void) ipf_makefrip(hlen, ip, &fnew); 847 848 return ipf_fastroute(m, &m, &fnew, NULL); 849 } 850 851 852 int 853 ipf_send_icmp_err(int type, fr_info_t *fin, int dst) 854 { 855 int err, hlen, xtra, iclen, ohlen, avail; 856 struct in_addr dst4; 857 struct icmp *icmp; 858 struct mbuf *m; 859 i6addr_t dst6; 860 void *ifp; 861 #ifdef USE_INET6 862 int code; 863 ip6_t *ip6; 864 #endif 865 ip_t *ip, *ip2; 866 867 if ((type < 0) || (type > ICMP_MAXTYPE)) 868 return -1; 869 870 #ifdef USE_INET6 871 code = fin->fin_icode; 872 if ((code < 0) || (code >= sizeof(icmptoicmp6unreach)/sizeof(int))) 873 return -1; 874 #endif 875 876 if (ipf_checkl4sum(fin) == -1) 877 return -1; 878 #ifdef MGETHDR 879 MGETHDR(m, M_DONTWAIT, MT_HEADER); 880 #else 881 MGET(m, M_DONTWAIT, MT_HEADER); 882 #endif 883 if (m == NULL) 884 return -1; 885 avail = MHLEN; 886 887 xtra = 0; 888 hlen = 0; 889 ohlen = 0; 890 dst4.s_addr = 0; 891 ifp = fin->fin_ifp; 892 if (fin->fin_v == 4) { 893 if ((fin->fin_p == IPPROTO_ICMP) && !(fin->fin_flx & FI_SHORT)) 894 switch (ntohs(fin->fin_data[0]) >> 8) 895 { 896 case ICMP_ECHO : 897 case ICMP_TSTAMP : 898 case ICMP_IREQ : 899 case ICMP_MASKREQ : 900 break; 901 default : 902 FREE_MB_T(m); 903 return 0; 904 } 905 906 if (dst == 0) { 907 if (ipf_ifpaddr(&ipfmain, 4, FRI_NORMAL, ifp, 908 &dst6, NULL) == -1) { 909 FREE_MB_T(m); 910 return -1; 911 } 912 dst4 = dst6.in4; 913 } else 914 dst4.s_addr = fin->fin_daddr; 915 916 hlen = sizeof(ip_t); 917 ohlen = fin->fin_hlen; 918 iclen = hlen + offsetof(struct icmp, icmp_ip) + ohlen; 919 if (fin->fin_hlen < fin->fin_plen) 920 xtra = MIN(fin->fin_dlen, 8); 921 else 922 xtra = 0; 923 } 924 925 #ifdef USE_INET6 926 else if (fin->fin_v == 6) { 927 hlen = sizeof(ip6_t); 928 ohlen = sizeof(ip6_t); 929 iclen = hlen + offsetof(struct icmp, icmp_ip) + ohlen; 930 type = icmptoicmp6types[type]; 931 if (type == ICMP6_DST_UNREACH) 932 code = icmptoicmp6unreach[code]; 933 934 if (iclen + max_linkhdr + fin->fin_plen > avail) { 935 MCLGET(m, M_DONTWAIT); 936 if (m == NULL) 937 return -1; 938 if ((m->m_flags & M_EXT) == 0) { 939 FREE_MB_T(m); 940 return -1; 941 } 942 avail = MCLBYTES; 943 } 944 xtra = MIN(fin->fin_plen, avail - iclen - max_linkhdr); 945 xtra = MIN(xtra, IPV6_MMTU - iclen); 946 if (dst == 0) { 947 if (ipf_ifpaddr(&ipfmain, 6, FRI_NORMAL, ifp, 948 &dst6, NULL) == -1) { 949 FREE_MB_T(m); 950 return -1; 951 } 952 } else 953 dst6 = fin->fin_dst6; 954 } 955 #endif 956 else { 957 FREE_MB_T(m); 958 return -1; 959 } 960 961 avail -= (max_linkhdr + iclen); 962 if (avail < 0) { 963 FREE_MB_T(m); 964 return -1; 965 } 966 if (xtra > avail) 967 xtra = avail; 968 iclen += xtra; 969 m->m_data += max_linkhdr; 970 m->m_pkthdr.rcvif = (struct ifnet *)0; 971 m->m_pkthdr.len = iclen; 972 m->m_len = iclen; 973 ip = mtod(m, ip_t *); 974 icmp = (struct icmp *)((char *)ip + hlen); 975 ip2 = (ip_t *)&icmp->icmp_ip; 976 977 icmp->icmp_type = type; 978 icmp->icmp_code = fin->fin_icode; 979 icmp->icmp_cksum = 0; 980 #ifdef icmp_nextmtu 981 if (type == ICMP_UNREACH && fin->fin_icode == ICMP_UNREACH_NEEDFRAG) { 982 if (fin->fin_mtu != 0) { 983 icmp->icmp_nextmtu = htons(fin->fin_mtu); 984 985 } else if (ifp != NULL) { 986 icmp->icmp_nextmtu = htons(GETIFMTU_4(ifp)); 987 988 } else { /* make up a number... */ 989 icmp->icmp_nextmtu = htons(fin->fin_plen - 20); 990 } 991 } 992 #endif 993 994 bcopy((char *)fin->fin_ip, (char *)ip2, ohlen); 995 996 #if defined(M_CSUM_IPv4) 997 /* 998 * Clear any in-bound checksum flags for this packet. 999 */ 1000 m->m_pkthdr.csuminfo = 0; 1001 #endif /* __NetBSD__ && M_CSUM_IPv4 */ 1002 1003 #ifdef USE_INET6 1004 ip6 = (ip6_t *)ip; 1005 if (fin->fin_v == 6) { 1006 ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow; 1007 ip6->ip6_plen = htons(iclen - hlen); 1008 ip6->ip6_nxt = IPPROTO_ICMPV6; 1009 ip6->ip6_hlim = 0; 1010 ip6->ip6_src = dst6.in6; 1011 ip6->ip6_dst = fin->fin_src6.in6; 1012 if (xtra > 0) 1013 bcopy((char *)fin->fin_ip + ohlen, 1014 (char *)&icmp->icmp_ip + ohlen, xtra); 1015 icmp->icmp_cksum = in6_cksum(m, IPPROTO_ICMPV6, 1016 sizeof(*ip6), iclen - hlen); 1017 } else 1018 #endif 1019 { 1020 ip->ip_p = IPPROTO_ICMP; 1021 ip->ip_src.s_addr = dst4.s_addr; 1022 ip->ip_dst.s_addr = fin->fin_saddr; 1023 1024 if (xtra > 0) 1025 bcopy((char *)fin->fin_ip + ohlen, 1026 (char *)&icmp->icmp_ip + ohlen, xtra); 1027 icmp->icmp_cksum = ipf_cksum((u_short *)icmp, 1028 sizeof(*icmp) + 8); 1029 ip->ip_len = iclen; 1030 ip->ip_p = IPPROTO_ICMP; 1031 } 1032 err = ipf_send_ip(fin, m); 1033 return err; 1034 } 1035 1036 1037 /* 1038 * m0 - pointer to mbuf where the IP packet starts 1039 * mpp - pointer to the mbuf pointer that is the start of the mbuf chain 1040 */ 1041 int 1042 ipf_fastroute(mb_t *m0, mb_t **mpp, fr_info_t *fin, frdest_t *fdp) 1043 { 1044 register struct ip *ip, *mhip; 1045 register struct mbuf *m = *mpp; 1046 register struct route *ro; 1047 int len, off, error = 0, hlen, code; 1048 struct ifnet *ifp, *sifp; 1049 ipf_main_softc_t *softc; 1050 #if __NetBSD_Version__ >= 499001100 1051 union { 1052 struct sockaddr dst; 1053 struct sockaddr_in dst4; 1054 } u; 1055 #else 1056 struct sockaddr_in *dst4; 1057 #endif 1058 struct sockaddr *dst; 1059 u_short ip_off, ip_len; 1060 struct route iproute; 1061 struct rtentry *rt; 1062 frdest_t node; 1063 frentry_t *fr; 1064 1065 if (fin->fin_v == 6) { 1066 #ifdef USE_INET6 1067 error = ipf_fastroute6(m0, mpp, fin, fdp); 1068 #else 1069 error = EPROTONOSUPPORT; 1070 #endif 1071 if ((error != 0) && (*mpp != NULL)) 1072 FREE_MB_T(*mpp); 1073 return error; 1074 } 1075 #ifndef INET 1076 FREE_MB_T(*mpp); 1077 return EPROTONOSUPPORT; 1078 #else 1079 1080 hlen = fin->fin_hlen; 1081 ip = mtod(m0, struct ip *); 1082 softc = fin->fin_main_soft; 1083 rt = NULL; 1084 ifp = NULL; 1085 1086 # if defined(M_CSUM_IPv4) 1087 /* 1088 * Clear any in-bound checksum flags for this packet. 1089 */ 1090 m0->m_pkthdr.csuminfo = 0; 1091 # endif /* __NetBSD__ && M_CSUM_IPv4 */ 1092 1093 /* 1094 * Route packet. 1095 */ 1096 ro = &iproute; 1097 memset(ro, 0, sizeof(*ro)); 1098 fr = fin->fin_fr; 1099 1100 if ((fr != NULL) && !(fr->fr_flags & FR_KEEPSTATE) && (fdp != NULL) && 1101 (fdp->fd_type == FRD_DSTLIST)) { 1102 if (ipf_dstlist_select_node(fin, fdp->fd_ptr, NULL, &node) == 0) 1103 fdp = &node; 1104 } 1105 if (fdp != NULL) 1106 ifp = fdp->fd_ptr; 1107 else 1108 ifp = fin->fin_ifp; 1109 1110 if ((ifp == NULL) && ((fr == NULL) || !(fr->fr_flags & FR_FASTROUTE))) { 1111 error = -2; 1112 goto bad; 1113 } 1114 1115 # if __NetBSD_Version__ >= 499001100 1116 if ((fdp != NULL) && (fdp->fd_ip.s_addr != 0)) 1117 sockaddr_in_init(&u.dst4, &fdp->fd_ip, 0); 1118 else 1119 sockaddr_in_init(&u.dst4, &ip->ip_dst, 0); 1120 dst = &u.dst; 1121 rtcache_setdst(ro, dst); 1122 rt = rtcache_init(ro); 1123 # else 1124 dst4 = (struct sockaddr_in *)&ro->ro_dst; 1125 dst = (struct sockaddr *)dst4; 1126 dst4->sin_family = AF_INET; 1127 dst4->sin_addr = ip->ip_dst; 1128 1129 if ((fdp != NULL) && (fdp->fd_ip.s_addr != 0)) 1130 dst4->sin_addr = fdp->fd_ip; 1131 1132 dst4->sin_len = sizeof(*dst); 1133 rtalloc(ro); 1134 rt = ro->ro_rt; 1135 # endif 1136 if ((ifp == NULL) && (rt != NULL)) 1137 ifp = rt->rt_ifp; 1138 if ((rt == NULL) || (ifp == NULL)) { 1139 #ifdef INET 1140 if (in_localaddr(ip->ip_dst)) 1141 error = EHOSTUNREACH; 1142 else 1143 #endif 1144 error = ENETUNREACH; 1145 goto bad; 1146 } 1147 1148 1149 if (rt->rt_flags & RTF_GATEWAY) 1150 dst = rt->rt_gateway; 1151 1152 rt->rt_use++; 1153 1154 /* 1155 * For input packets which are being "fastrouted", they won't 1156 * go back through output filtering and miss their chance to get 1157 * NAT'd and counted. Duplicated packets aren't considered to be 1158 * part of the normal packet stream, so do not NAT them or pass 1159 * them through stateful checking, etc. 1160 */ 1161 if ((fdp != &fr->fr_dif) && (fin->fin_out == 0)) { 1162 sifp = fin->fin_ifp; 1163 fin->fin_ifp = ifp; 1164 fin->fin_out = 1; 1165 (void) ipf_acctpkt(fin, NULL); 1166 fin->fin_fr = NULL; 1167 if (!fr || !(fr->fr_flags & FR_RETMASK)) { 1168 u_32_t pass; 1169 1170 (void) ipf_state_check(fin, &pass); 1171 } 1172 1173 switch (ipf_nat_checkout(fin, NULL)) 1174 { 1175 case 0 : 1176 break; 1177 case 1 : 1178 ip->ip_sum = 0; 1179 break; 1180 case -1 : 1181 error = -1; 1182 goto bad; 1183 break; 1184 } 1185 1186 fin->fin_ifp = sifp; 1187 fin->fin_out = 0; 1188 } else 1189 ip->ip_sum = 0; 1190 /* 1191 * If small enough for interface, can just send directly. 1192 */ 1193 m->m_pkthdr.rcvif = ifp; 1194 1195 ip_len = ntohs(ip->ip_len); 1196 if (ip_len <= ifp->if_mtu) { 1197 # if defined(M_CSUM_IPv4) 1198 # if (__NetBSD_Version__ >= 105009999) 1199 if (ifp->if_csum_flags_tx & M_CSUM_IPv4) 1200 m->m_pkthdr.csuminfo |= M_CSUM_IPv4; 1201 # else 1202 if (ifp->if_capabilities & IFCAP_CSUM_IPv4) 1203 m->m_pkthdr.csuminfo |= M_CSUM_IPv4; 1204 # endif /* (__NetBSD_Version__ >= 105009999) */ 1205 else if (ip->ip_sum == 0) 1206 ip->ip_sum = in_cksum(m, hlen); 1207 # else 1208 if (!ip->ip_sum) 1209 ip->ip_sum = in_cksum(m, hlen); 1210 # endif /* M_CSUM_IPv4 */ 1211 1212 error = (*ifp->if_output)(ifp, m, dst, rt); 1213 goto done; 1214 } 1215 1216 /* 1217 * Too large for interface; fragment if possible. 1218 * Must be able to put at least 8 bytes per fragment. 1219 */ 1220 ip_off = ntohs(ip->ip_off); 1221 if (ip_off & IP_DF) { 1222 error = EMSGSIZE; 1223 goto bad; 1224 } 1225 len = (ifp->if_mtu - hlen) &~ 7; 1226 if (len < 8) { 1227 error = EMSGSIZE; 1228 goto bad; 1229 } 1230 1231 { 1232 int mhlen, firstlen = len; 1233 struct mbuf **mnext = &m->m_act; 1234 1235 /* 1236 * Loop through length of segment after first fragment, 1237 * make new header and copy data of each part and link onto chain. 1238 */ 1239 m0 = m; 1240 mhlen = sizeof (struct ip); 1241 for (off = hlen + len; off < ip_len; off += len) { 1242 # ifdef MGETHDR 1243 MGETHDR(m, M_DONTWAIT, MT_HEADER); 1244 # else 1245 MGET(m, M_DONTWAIT, MT_HEADER); 1246 # endif 1247 if (m == 0) { 1248 m = m0; 1249 error = ENOBUFS; 1250 goto bad; 1251 } 1252 m->m_data += max_linkhdr; 1253 mhip = mtod(m, struct ip *); 1254 bcopy((char *)ip, (char *)mhip, sizeof(*ip)); 1255 #ifdef INET 1256 if (hlen > sizeof (struct ip)) { 1257 mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip); 1258 IP_HL_A(mhip, mhlen >> 2); 1259 } 1260 #endif 1261 m->m_len = mhlen; 1262 mhip->ip_off = ((off - hlen) >> 3) + ip_off; 1263 if (off + len >= ip_len) 1264 len = ip_len - off; 1265 else 1266 mhip->ip_off |= IP_MF; 1267 mhip->ip_len = htons((u_short)(len + mhlen)); 1268 m->m_next = m_copy(m0, off, len); 1269 if (m->m_next == 0) { 1270 error = ENOBUFS; /* ??? */ 1271 goto sendorfree; 1272 } 1273 m->m_pkthdr.len = mhlen + len; 1274 m->m_pkthdr.rcvif = NULL; 1275 mhip->ip_off = htons((u_short)mhip->ip_off); 1276 mhip->ip_sum = 0; 1277 #ifdef INET 1278 mhip->ip_sum = in_cksum(m, mhlen); 1279 #endif 1280 *mnext = m; 1281 mnext = &m->m_act; 1282 } 1283 /* 1284 * Update first fragment by trimming what's been copied out 1285 * and updating header, then send each fragment (in order). 1286 */ 1287 m_adj(m0, hlen + firstlen - ip_len); 1288 ip->ip_len = htons((u_short)(hlen + firstlen)); 1289 ip->ip_off = htons((u_short)IP_MF); 1290 ip->ip_sum = 0; 1291 #ifdef INET 1292 ip->ip_sum = in_cksum(m0, hlen); 1293 #endif 1294 sendorfree: 1295 for (m = m0; m; m = m0) { 1296 m0 = m->m_act; 1297 m->m_act = 0; 1298 if (error == 0) { 1299 error = (*ifp->if_output)(ifp, m, dst, rt); 1300 } else { 1301 FREE_MB_T(m); 1302 } 1303 } 1304 } 1305 done: 1306 if (!error) 1307 softc->ipf_frouteok[0]++; 1308 else 1309 softc->ipf_frouteok[1]++; 1310 1311 # if __NetBSD_Version__ >= 499001100 1312 rtcache_free(ro); 1313 # else 1314 if (rt) { 1315 RTFREE(rt); 1316 } 1317 # endif 1318 return error; 1319 bad: 1320 if (error == EMSGSIZE) { 1321 sifp = fin->fin_ifp; 1322 code = fin->fin_icode; 1323 fin->fin_icode = ICMP_UNREACH_NEEDFRAG; 1324 fin->fin_ifp = ifp; 1325 (void) ipf_send_icmp_err(ICMP_UNREACH, fin, 1); 1326 fin->fin_ifp = sifp; 1327 fin->fin_icode = code; 1328 } 1329 FREE_MB_T(m); 1330 goto done; 1331 #endif /* INET */ 1332 } 1333 1334 1335 #if defined(USE_INET6) 1336 /* 1337 * This is the IPv6 specific fastroute code. It doesn't clean up the mbuf's 1338 * or ensure that it is an IPv6 packet that is being forwarded, those are 1339 * expected to be done by the called (ipf_fastroute). 1340 */ 1341 static int 1342 ipf_fastroute6(struct mbuf *m0, struct mbuf **mpp, fr_info_t *fin, 1343 frdest_t *fdp) 1344 { 1345 # if __NetBSD_Version__ >= 499001100 1346 struct route ip6route; 1347 const struct sockaddr *dst; 1348 union { 1349 struct sockaddr dst; 1350 struct sockaddr_in6 dst6; 1351 } u; 1352 struct route *ro; 1353 # else 1354 struct route_in6 ip6route; 1355 struct sockaddr_in6 *dst6; 1356 struct route_in6 *ro; 1357 # endif 1358 struct rtentry *rt; 1359 struct ifnet *ifp; 1360 u_long mtu; 1361 int error; 1362 1363 error = 0; 1364 ro = &ip6route; 1365 1366 if (fdp != NULL) 1367 ifp = fdp->fd_ptr; 1368 else 1369 ifp = fin->fin_ifp; 1370 memset(ro, 0, sizeof(*ro)); 1371 # if __NetBSD_Version__ >= 499001100 1372 if (fdp != NULL && IP6_NOTZERO(&fdp->fd_ip6)) 1373 sockaddr_in6_init(&u.dst6, &fdp->fd_ip6.in6, 0, 0, 0); 1374 else 1375 sockaddr_in6_init(&u.dst6, &fin->fin_fi.fi_dst.in6, 0, 0, 0); 1376 dst = &u.dst; 1377 rtcache_setdst(ro, dst); 1378 1379 rt = rtcache_init(ro); 1380 if ((ifp == NULL) && (rt != NULL)) 1381 ifp = rt->rt_ifp; 1382 # else 1383 dst6 = (struct sockaddr_in6 *)&ro->ro_dst; 1384 dst6->sin6_family = AF_INET6; 1385 dst6->sin6_len = sizeof(struct sockaddr_in6); 1386 dst6->sin6_addr = fin->fin_fi.fi_dst.in6; 1387 1388 if (fdp != NULL) { 1389 if (IP6_NOTZERO(&fdp->fd_ip6)) 1390 dst6->sin6_addr = fdp->fd_ip6.in6; 1391 } 1392 1393 rtalloc((struct route *)ro); 1394 1395 if ((ifp == NULL) && (ro->ro_rt != NULL)) 1396 ifp = ro->ro_rt->rt_ifp; 1397 rt = ro->ro_rt; 1398 # endif 1399 if ((rt == NULL) || (ifp == NULL)) { 1400 1401 error = EHOSTUNREACH; 1402 goto bad; 1403 } 1404 1405 /* KAME */ 1406 # if __NetBSD_Version__ >= 499001100 1407 if (IN6_IS_ADDR_LINKLOCAL(&u.dst6.sin6_addr)) 1408 u.dst6.sin6_addr.s6_addr16[1] = htons(ifp->if_index); 1409 # else 1410 if (IN6_IS_ADDR_LINKLOCAL(&dst6->sin6_addr)) 1411 dst6->sin6_addr.s6_addr16[1] = htons(ifp->if_index); 1412 # endif 1413 1414 { 1415 # if (__NetBSD_Version__ >= 106010000) && !defined(IN6_LINKMTU) 1416 struct in6_ifextra *ife; 1417 # endif 1418 if (rt->rt_flags & RTF_GATEWAY) 1419 # if __NetBSD_Version__ >= 499001100 1420 dst = rt->rt_gateway; 1421 # else 1422 dst6 = (struct sockaddr_in6 *)rt->rt_gateway; 1423 # endif 1424 rt->rt_use++; 1425 1426 /* Determine path MTU. */ 1427 # if (__NetBSD_Version__ <= 106009999) 1428 mtu = nd_ifinfo[ifp->if_index].linkmtu; 1429 # else 1430 # ifdef IN6_LINKMTU 1431 mtu = IN6_LINKMTU(ifp); 1432 # else 1433 ife = (struct in6_ifextra *)(ifp)->if_afdata[AF_INET6]; 1434 mtu = ife->nd_ifinfo[ifp->if_index].linkmtu; 1435 # endif 1436 # endif 1437 if ((error == 0) && (m0->m_pkthdr.len <= mtu)) { 1438 # if __NetBSD_Version__ >= 499001100 1439 error = nd6_output(ifp, ifp, m0, satocsin6(dst), rt); 1440 # else 1441 error = nd6_output(ifp, ifp, m0, dst6, rt); 1442 # endif 1443 } else { 1444 error = EMSGSIZE; 1445 } 1446 } 1447 bad: 1448 # if __NetBSD_Version__ >= 499001100 1449 rtcache_free(ro); 1450 # else 1451 if (ro->ro_rt != NULL) { 1452 RTFREE(((struct route *)ro)->ro_rt); 1453 } 1454 # endif 1455 return error; 1456 } 1457 #endif /* INET6 */ 1458 1459 1460 int 1461 ipf_verifysrc(fr_info_t *fin) 1462 { 1463 #if __NetBSD_Version__ >= 499001100 1464 union { 1465 struct sockaddr dst; 1466 struct sockaddr_in dst4; 1467 } u; 1468 struct rtentry *rt; 1469 #else 1470 struct sockaddr_in *dst; 1471 #endif 1472 struct route iproute; 1473 int rc; 1474 1475 #if __NetBSD_Version__ >= 499001100 1476 sockaddr_in_init(&u.dst4, &fin->fin_src, 0); 1477 rtcache_setdst(&iproute, &u.dst); 1478 rt = rtcache_init(&iproute); 1479 if (rt == NULL) 1480 rc = 0; 1481 else 1482 rc = (fin->fin_ifp == rt->rt_ifp); 1483 rtcache_free(&iproute); 1484 #else 1485 dst = (struct sockaddr_in *)&iproute.ro_dst; 1486 dst->sin_len = sizeof(*dst); 1487 dst->sin_family = AF_INET; 1488 dst->sin_addr = fin->fin_src; 1489 rtalloc(&iproute); 1490 if (iproute.ro_rt == NULL) 1491 return 0; 1492 rc = (fin->fin_ifp == iproute.ro_rt->rt_ifp); 1493 RTFREE(iproute.ro_rt); 1494 #endif 1495 return rc; 1496 } 1497 1498 1499 /* 1500 * return the first IP Address associated with an interface 1501 */ 1502 int 1503 ipf_ifpaddr(ipf_main_softc_t *softc, int v, int atype, void *ifptr, 1504 i6addr_t *inp, i6addr_t *inpmask) 1505 { 1506 #ifdef USE_INET6 1507 struct in6_addr *inp6 = NULL; 1508 #endif 1509 struct sockaddr *sock, *mask; 1510 struct sockaddr_in *sin; 1511 struct ifaddr *ifa; 1512 struct ifnet *ifp; 1513 1514 if ((ifptr == NULL) || (ifptr == (void *)-1)) 1515 return -1; 1516 1517 ifp = ifptr; 1518 mask = NULL; 1519 1520 if (v == 4) 1521 inp->in4.s_addr = 0; 1522 #ifdef USE_INET6 1523 else if (v == 6) 1524 bzero((char *)inp, sizeof(*inp)); 1525 #endif 1526 1527 ifa = IFADDR_FIRST(ifp); 1528 sock = ifa ? ifa->ifa_addr : NULL; 1529 while (sock != NULL && ifa != NULL) { 1530 sin = (struct sockaddr_in *)sock; 1531 if ((v == 4) && (sin->sin_family == AF_INET)) 1532 break; 1533 #ifdef USE_INET6 1534 if ((v == 6) && (sin->sin_family == AF_INET6)) { 1535 inp6 = &((struct sockaddr_in6 *)sin)->sin6_addr; 1536 if (!IN6_IS_ADDR_LINKLOCAL(inp6) && 1537 !IN6_IS_ADDR_LOOPBACK(inp6)) 1538 break; 1539 } 1540 #endif 1541 ifa = IFADDR_NEXT(ifa); 1542 if (ifa != NULL) 1543 sock = ifa->ifa_addr; 1544 } 1545 if (ifa == NULL || sock == NULL) 1546 return -1; 1547 1548 mask = ifa->ifa_netmask; 1549 if (atype == FRI_BROADCAST) 1550 sock = ifa->ifa_broadaddr; 1551 else if (atype == FRI_PEERADDR) 1552 sock = ifa->ifa_dstaddr; 1553 1554 #ifdef USE_INET6 1555 if (v == 6) 1556 return ipf_ifpfillv6addr(atype, (struct sockaddr_in6 *)sock, 1557 (struct sockaddr_in6 *)mask, 1558 inp, inpmask); 1559 #endif 1560 return ipf_ifpfillv4addr(atype, (struct sockaddr_in *)sock, 1561 (struct sockaddr_in *)mask, 1562 &inp->in4, &inpmask->in4); 1563 } 1564 1565 1566 u_32_t 1567 ipf_newisn(fr_info_t *fin) 1568 { 1569 #if __NetBSD_Version__ >= 105190000 /* 1.5T */ 1570 size_t asz; 1571 1572 if (fin->fin_v == 4) 1573 asz = sizeof(struct in_addr); 1574 else if (fin->fin_v == 6) 1575 asz = sizeof(fin->fin_src); 1576 else /* XXX: no way to return error */ 1577 return 0; 1578 #ifdef INET 1579 return tcp_new_iss1((void *)&fin->fin_src, (void *)&fin->fin_dst, 1580 fin->fin_sport, fin->fin_dport, asz, 0); 1581 #else 1582 return ENOSYS; 1583 #endif 1584 #else 1585 static int iss_seq_off = 0; 1586 u_char hash[16]; 1587 u_32_t newiss; 1588 MD5_CTX ctx; 1589 1590 /* 1591 * Compute the base value of the ISS. It is a hash 1592 * of (saddr, sport, daddr, dport, secret). 1593 */ 1594 MD5Init(&ctx); 1595 1596 MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_src, 1597 sizeof(fin->fin_fi.fi_src)); 1598 MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_dst, 1599 sizeof(fin->fin_fi.fi_dst)); 1600 MD5Update(&ctx, (u_char *) &fin->fin_dat, sizeof(fin->fin_dat)); 1601 1602 MD5Update(&ctx, ipf_iss_secret, sizeof(ipf_iss_secret)); 1603 1604 MD5Final(hash, &ctx); 1605 1606 memcpy(&newiss, hash, sizeof(newiss)); 1607 1608 /* 1609 * Now increment our "timer", and add it in to 1610 * the computed value. 1611 * 1612 * XXX Use `addin'? 1613 * XXX TCP_ISSINCR too large to use? 1614 */ 1615 iss_seq_off += 0x00010000; 1616 newiss += iss_seq_off; 1617 return newiss; 1618 #endif 1619 } 1620 1621 1622 /* ------------------------------------------------------------------------ */ 1623 /* Function: ipf_nextipid */ 1624 /* Returns: int - 0 == success, -1 == error (packet should be droppped) */ 1625 /* Parameters: fin(I) - pointer to packet information */ 1626 /* */ 1627 /* Returns the next IPv4 ID to use for this packet. */ 1628 /* ------------------------------------------------------------------------ */ 1629 u_short 1630 ipf_nextipid(fr_info_t *fin) 1631 { 1632 #ifdef USE_MUTEXES 1633 ipf_main_softc_t *softc = fin->fin_main_soft; 1634 #endif 1635 u_short id; 1636 1637 MUTEX_ENTER(&softc->ipf_rw); 1638 id = ipid++; 1639 MUTEX_EXIT(&softc->ipf_rw); 1640 1641 return id; 1642 } 1643 1644 1645 EXTERN_INLINE int 1646 ipf_checkv4sum(fr_info_t *fin) 1647 { 1648 #ifdef M_CSUM_TCP_UDP_BAD 1649 int manual, pflag, cflags, active; 1650 mb_t *m; 1651 1652 if ((fin->fin_flx & FI_NOCKSUM) != 0) 1653 return 0; 1654 1655 if ((fin->fin_flx & FI_SHORT) != 0) 1656 return 1; 1657 1658 if (fin->fin_cksum != FI_CK_NEEDED) 1659 return (fin->fin_cksum > FI_CK_NEEDED) ? 0 : -1; 1660 1661 manual = 0; 1662 m = fin->fin_m; 1663 if (m == NULL) { 1664 manual = 1; 1665 goto skipauto; 1666 } 1667 1668 switch (fin->fin_p) 1669 { 1670 case IPPROTO_UDP : 1671 pflag = M_CSUM_UDPv4; 1672 break; 1673 case IPPROTO_TCP : 1674 pflag = M_CSUM_TCPv4; 1675 break; 1676 default : 1677 pflag = 0; 1678 manual = 1; 1679 break; 1680 } 1681 1682 active = ((struct ifnet *)fin->fin_ifp)->if_csum_flags_rx & pflag; 1683 active |= M_CSUM_TCP_UDP_BAD | M_CSUM_DATA; 1684 cflags = m->m_pkthdr.csum_flags & active; 1685 1686 if (pflag != 0) { 1687 if (cflags == (pflag | M_CSUM_TCP_UDP_BAD)) { 1688 fin->fin_flx |= FI_BAD; 1689 fin->fin_cksum = FI_CK_BAD; 1690 } else if (cflags == (pflag | M_CSUM_DATA)) { 1691 if ((m->m_pkthdr.csum_data ^ 0xffff) != 0) { 1692 fin->fin_flx |= FI_BAD; 1693 fin->fin_cksum = FI_CK_BAD; 1694 } else { 1695 fin->fin_cksum = FI_CK_SUMOK; 1696 } 1697 } else if (cflags == pflag) { 1698 fin->fin_cksum = FI_CK_SUMOK; 1699 } else { 1700 manual = 1; 1701 } 1702 } 1703 skipauto: 1704 if (manual != 0) { 1705 if (ipf_checkl4sum(fin) == -1) { 1706 fin->fin_flx |= FI_BAD; 1707 return -1; 1708 } 1709 } 1710 #else 1711 if (ipf_checkl4sum(fin) == -1) { 1712 fin->fin_flx |= FI_BAD; 1713 return -1; 1714 } 1715 #endif 1716 return 0; 1717 } 1718 1719 1720 #ifdef USE_INET6 1721 EXTERN_INLINE int 1722 ipf_checkv6sum(fr_info_t *fin) 1723 { 1724 # ifdef M_CSUM_TCP_UDP_BAD 1725 int manual, pflag, cflags, active; 1726 mb_t *m; 1727 1728 if ((fin->fin_flx & FI_NOCKSUM) != 0) 1729 return 0; 1730 1731 if ((fin->fin_flx & FI_SHORT) != 0) 1732 return 1; 1733 1734 if (fin->fin_cksum != FI_CK_SUMOK) 1735 return (fin->fin_cksum > FI_CK_NEEDED) ? 0 : -1; 1736 1737 1738 manual = 0; 1739 m = fin->fin_m; 1740 1741 switch (fin->fin_p) 1742 { 1743 case IPPROTO_UDP : 1744 pflag = M_CSUM_UDPv6; 1745 break; 1746 case IPPROTO_TCP : 1747 pflag = M_CSUM_TCPv6; 1748 break; 1749 default : 1750 pflag = 0; 1751 manual = 1; 1752 break; 1753 } 1754 1755 active = ((struct ifnet *)fin->fin_ifp)->if_csum_flags_rx & pflag; 1756 active |= M_CSUM_TCP_UDP_BAD | M_CSUM_DATA; 1757 cflags = m->m_pkthdr.csum_flags & active; 1758 1759 if (pflag != 0) { 1760 if (cflags == (pflag | M_CSUM_TCP_UDP_BAD)) { 1761 fin->fin_flx |= FI_BAD; 1762 } else if (cflags == (pflag | M_CSUM_DATA)) { 1763 if ((m->m_pkthdr.csum_data ^ 0xffff) != 0) 1764 fin->fin_flx |= FI_BAD; 1765 } else if (cflags == pflag) { 1766 ; 1767 } else { 1768 manual = 1; 1769 } 1770 } 1771 if (manual != 0) { 1772 if (ipf_checkl4sum(fin) == -1) { 1773 fin->fin_flx |= FI_BAD; 1774 return -1; 1775 } 1776 } 1777 # else 1778 if (ipf_checkl4sum(fin) == -1) { 1779 fin->fin_flx |= FI_BAD; 1780 return -1; 1781 } 1782 # endif 1783 return 0; 1784 } 1785 #endif /* USE_INET6 */ 1786 1787 1788 size_t 1789 mbufchainlen(struct mbuf *m0) 1790 { 1791 size_t len; 1792 1793 if ((m0->m_flags & M_PKTHDR) != 0) { 1794 len = m0->m_pkthdr.len; 1795 } else { 1796 struct mbuf *m; 1797 1798 for (m = m0, len = 0; m != NULL; m = m->m_next) 1799 len += m->m_len; 1800 } 1801 return len; 1802 } 1803 1804 1805 /* ------------------------------------------------------------------------ */ 1806 /* Function: ipf_pullup */ 1807 /* Returns: NULL == pullup failed, else pointer to protocol header */ 1808 /* Parameters: xmin(I)- pointer to buffer where data packet starts */ 1809 /* fin(I) - pointer to packet information */ 1810 /* len(I) - number of bytes to pullup */ 1811 /* */ 1812 /* Attempt to move at least len bytes (from the start of the buffer) into a */ 1813 /* single buffer for ease of access. Operating system native functions are */ 1814 /* used to manage buffers - if necessary. If the entire packet ends up in */ 1815 /* a single buffer, set the FI_COALESCE flag even though ipf_coalesce() has */ 1816 /* not been called. Both fin_ip and fin_dp are updated before exiting _IF_ */ 1817 /* and ONLY if the pullup succeeds. */ 1818 /* */ 1819 /* We assume that 'xmin' is a pointer to a buffer that is part of the chain */ 1820 /* of buffers that starts at *fin->fin_mp. */ 1821 /* ------------------------------------------------------------------------ */ 1822 void * 1823 ipf_pullup(mb_t *xmin, fr_info_t *fin, int len) 1824 { 1825 int dpoff, ipoff; 1826 mb_t *m = xmin; 1827 char *ip; 1828 1829 if (m == NULL) 1830 return NULL; 1831 1832 ip = (char *)fin->fin_ip; 1833 if ((fin->fin_flx & FI_COALESCE) != 0) 1834 return ip; 1835 1836 ipoff = fin->fin_ipoff; 1837 if (fin->fin_dp != NULL) 1838 dpoff = (char *)fin->fin_dp - (char *)ip; 1839 else 1840 dpoff = 0; 1841 1842 if (M_LEN(m) < len) { 1843 mb_t *n = *fin->fin_mp; 1844 /* 1845 * Assume that M_PKTHDR is set and just work with what is left 1846 * rather than check.. 1847 * Should not make any real difference, anyway. 1848 */ 1849 if (m != n) { 1850 /* 1851 * Record the mbuf that points to the mbuf that we're 1852 * about to go to work on so that we can update the 1853 * m_next appropriately later. 1854 */ 1855 for (; n->m_next != m; n = n->m_next) 1856 ; 1857 } else { 1858 n = NULL; 1859 } 1860 1861 #ifdef MHLEN 1862 if (len > MHLEN) 1863 #else 1864 if (len > MLEN) 1865 #endif 1866 { 1867 #ifdef HAVE_M_PULLDOWN 1868 if (m_pulldown(m, 0, len, NULL) == NULL) 1869 m = NULL; 1870 #else 1871 FREE_MB_T(*fin->fin_mp); 1872 m = NULL; 1873 n = NULL; 1874 #endif 1875 } else 1876 { 1877 m = m_pullup(m, len); 1878 } 1879 if (n != NULL) 1880 n->m_next = m; 1881 if (m == NULL) { 1882 /* 1883 * When n is non-NULL, it indicates that m pointed to 1884 * a sub-chain (tail) of the mbuf and that the head 1885 * of this chain has not yet been free'd. 1886 */ 1887 if (n != NULL) { 1888 FREE_MB_T(*fin->fin_mp); 1889 } 1890 1891 *fin->fin_mp = NULL; 1892 fin->fin_m = NULL; 1893 return NULL; 1894 } 1895 1896 if (n == NULL) 1897 *fin->fin_mp = m; 1898 1899 while (M_LEN(m) == 0) { 1900 m = m->m_next; 1901 } 1902 fin->fin_m = m; 1903 ip = MTOD(m, char *) + ipoff; 1904 1905 fin->fin_ip = (ip_t *)ip; 1906 if (fin->fin_dp != NULL) 1907 fin->fin_dp = (char *)fin->fin_ip + dpoff; 1908 if (fin->fin_fraghdr != NULL) 1909 fin->fin_fraghdr = (char *)ip + 1910 ((char *)fin->fin_fraghdr - 1911 (char *)fin->fin_ip); 1912 } 1913 1914 if (len == fin->fin_plen) 1915 fin->fin_flx |= FI_COALESCE; 1916 return ip; 1917 } 1918 1919 1920 int 1921 ipf_inject(fr_info_t *fin, mb_t *m) 1922 { 1923 int error; 1924 1925 if (fin->fin_out == 0) { 1926 struct ifqueue *ifq; 1927 1928 ifq = &ipintrq; 1929 1930 if (IF_QFULL(ifq)) { 1931 IF_DROP(ifq); 1932 FREE_MB_T(m); 1933 error = ENOBUFS; 1934 } else { 1935 IF_ENQUEUE(ifq, m); 1936 error = 0; 1937 } 1938 } else { 1939 error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL); 1940 } 1941 1942 return error; 1943 } 1944 1945 1946 u_32_t 1947 ipf_random(void) 1948 { 1949 int number; 1950 1951 #ifdef _CPRNG_H 1952 number = cprng_fast32(); 1953 #else 1954 number = arc4random(); 1955 #endif 1956 return number; 1957 } 1958 1959 1960 /* 1961 * routines below for saving IP headers to buffer 1962 */ 1963 static int ipfopen(dev_t dev, int flags 1964 #if (NetBSD >= 199511) 1965 , int devtype, PROC_T *p 1966 #endif 1967 ) 1968 { 1969 u_int unit = GET_MINOR(dev); 1970 int error; 1971 1972 if (IPL_LOGMAX < unit) { 1973 error = ENXIO; 1974 } else { 1975 switch (unit) 1976 { 1977 case IPL_LOGIPF : 1978 case IPL_LOGNAT : 1979 case IPL_LOGSTATE : 1980 case IPL_LOGAUTH : 1981 case IPL_LOGLOOKUP : 1982 case IPL_LOGSYNC : 1983 #ifdef IPFILTER_SCAN 1984 case IPL_LOGSCAN : 1985 #endif 1986 error = 0; 1987 break; 1988 default : 1989 error = ENXIO; 1990 break; 1991 } 1992 } 1993 return error; 1994 } 1995 1996 1997 static int ipfclose(dev_t dev, int flags 1998 #if (NetBSD >= 199511) 1999 , int devtype, PROC_T *p 2000 #endif 2001 ) 2002 { 2003 u_int unit = GET_MINOR(dev); 2004 2005 if (IPL_LOGMAX < unit) 2006 unit = ENXIO; 2007 else 2008 unit = 0; 2009 return unit; 2010 } 2011 2012 /* 2013 * ipfread/ipflog 2014 * both of these must operate with at least splnet() lest they be 2015 * called during packet processing and cause an inconsistancy to appear in 2016 * the filter lists. 2017 */ 2018 static int ipfread(dev_t dev, struct uio *uio, int ioflag) 2019 { 2020 2021 if (ipfmain.ipf_running < 1) { 2022 ipfmain.ipf_interror = 130006; 2023 return EIO; 2024 } 2025 2026 if (GET_MINOR(dev) == IPL_LOGSYNC) 2027 return ipf_sync_read(&ipfmain, uio); 2028 2029 #ifdef IPFILTER_LOG 2030 return ipf_log_read(&ipfmain, GET_MINOR(dev), uio); 2031 #else 2032 ipfmain.ipf_interror = 130007; 2033 return ENXIO; 2034 #endif 2035 } 2036 2037 2038 /* 2039 * ipfwrite 2040 * both of these must operate with at least splnet() lest they be 2041 * called during packet processing and cause an inconsistancy to appear in 2042 * the filter lists. 2043 */ 2044 static int ipfwrite(dev_t dev, struct uio *uio, int ioflag) 2045 { 2046 2047 if (ipfmain.ipf_running < 1) { 2048 ipfmain.ipf_interror = 130008; 2049 return EIO; 2050 } 2051 2052 if (GET_MINOR(dev) == IPL_LOGSYNC) 2053 return ipf_sync_write(&ipfmain, uio); 2054 ipfmain.ipf_interror = 130009; 2055 return ENXIO; 2056 } 2057 2058 2059 static int ipfpoll(dev_t dev, int events, PROC_T *p) 2060 { 2061 u_int unit = GET_MINOR(dev); 2062 int revents = 0; 2063 2064 if (IPL_LOGMAX < unit) { 2065 ipfmain.ipf_interror = 130010; 2066 return ENXIO; 2067 } 2068 2069 switch (unit) 2070 { 2071 case IPL_LOGIPF : 2072 case IPL_LOGNAT : 2073 case IPL_LOGSTATE : 2074 #ifdef IPFILTER_LOG 2075 if ((events & (POLLIN | POLLRDNORM)) && 2076 ipf_log_canread(&ipfmain, unit)) 2077 revents |= events & (POLLIN | POLLRDNORM); 2078 #endif 2079 break; 2080 case IPL_LOGAUTH : 2081 if ((events & (POLLIN | POLLRDNORM)) && 2082 ipf_auth_waiting(&ipfmain)) 2083 revents |= events & (POLLIN | POLLRDNORM); 2084 break; 2085 case IPL_LOGSYNC : 2086 if ((events & (POLLIN | POLLRDNORM)) && 2087 ipf_sync_canread(&ipfmain)) 2088 revents |= events & (POLLIN | POLLRDNORM); 2089 if ((events & (POLLOUT | POLLWRNORM)) && 2090 ipf_sync_canwrite(&ipfmain)) 2091 revents |= events & (POLLOUT | POLLWRNORM); 2092 break; 2093 case IPL_LOGSCAN : 2094 case IPL_LOGLOOKUP : 2095 default : 2096 break; 2097 } 2098 2099 if ((revents == 0) && (((events & (POLLIN|POLLRDNORM)) != 0))) 2100 selrecord(p, &ipfmain.ipf_selwait[unit]); 2101 return revents; 2102 } 2103 2104 u_int 2105 ipf_pcksum(fr_info_t *fin, int hlen, u_int sum) 2106 { 2107 struct mbuf *m; 2108 u_int sum2; 2109 int off; 2110 2111 m = fin->fin_m; 2112 off = (char *)fin->fin_dp - (char *)fin->fin_ip; 2113 m->m_data += hlen; 2114 m->m_len -= hlen; 2115 sum2 = in_cksum(fin->fin_m, fin->fin_plen - off); 2116 m->m_len += hlen; 2117 m->m_data -= hlen; 2118 2119 /* 2120 * Both sum and sum2 are partial sums, so combine them together. 2121 */ 2122 sum += ~sum2 & 0xffff; 2123 while (sum > 0xffff) 2124 sum = (sum & 0xffff) + (sum >> 16); 2125 sum2 = ~sum & 0xffff; 2126 return sum2; 2127 } 2128
Indexes created Thu Sep 25 16:09:42 GMT 2025