ip_scan.c revision 1.2.4.3
1 1.2.4.3 yamt /* $NetBSD: ip_scan.c,v 1.2.4.3 2012/10/30 17:22:20 yamt Exp $ */ 2 1.2.4.2 yamt 3 1.2.4.2 yamt /* 4 1.2.4.3 yamt * Copyright (C) 2012 by Darren Reed. 5 1.2.4.2 yamt * 6 1.2.4.2 yamt * See the IPFILTER.LICENCE file for details on licencing. 7 1.2.4.2 yamt */ 8 1.2.4.2 yamt #if defined(KERNEL) || defined(_KERNEL) 9 1.2.4.2 yamt # undef KERNEL 10 1.2.4.2 yamt # undef _KERNEL 11 1.2.4.2 yamt # define KERNEL 1 12 1.2.4.2 yamt # define _KERNEL 1 13 1.2.4.2 yamt #endif 14 1.2.4.2 yamt #include <sys/param.h> 15 1.2.4.2 yamt #if defined(__hpux) && (HPUXREV >= 1111) && !defined(_KERNEL) 16 1.2.4.2 yamt # include <sys/kern_svcs.h> 17 1.2.4.2 yamt #endif 18 1.2.4.2 yamt #include <sys/types.h> 19 1.2.4.2 yamt #include <sys/time.h> 20 1.2.4.2 yamt #include <sys/errno.h> 21 1.2.4.2 yamt #if !defined(_KERNEL) 22 1.2.4.2 yamt # include <stdlib.h> 23 1.2.4.2 yamt # include <string.h> 24 1.2.4.2 yamt # define _KERNEL 25 1.2.4.2 yamt # ifdef __OpenBSD__ 26 1.2.4.2 yamt struct file; 27 1.2.4.2 yamt # endif 28 1.2.4.2 yamt # include <sys/uio.h> 29 1.2.4.2 yamt # undef _KERNEL 30 1.2.4.2 yamt #else 31 1.2.4.2 yamt # include <sys/systm.h> 32 1.2.4.2 yamt # if !defined(__svr4__) && !defined(__SVR4) 33 1.2.4.2 yamt # include <sys/mbuf.h> 34 1.2.4.2 yamt # endif 35 1.2.4.2 yamt #endif 36 1.2.4.2 yamt #include <sys/socket.h> 37 1.2.4.2 yamt #if !defined(__hpux) && !defined(__osf__) && !defined(linux) && !defined(AIX) 38 1.2.4.2 yamt # include <sys/ioccom.h> 39 1.2.4.2 yamt #endif 40 1.2.4.2 yamt #ifdef __FreeBSD__ 41 1.2.4.2 yamt # include <sys/filio.h> 42 1.2.4.2 yamt # include <sys/malloc.h> 43 1.2.4.2 yamt #else 44 1.2.4.2 yamt # include <sys/ioctl.h> 45 1.2.4.2 yamt #endif 46 1.2.4.2 yamt 47 1.2.4.2 yamt #include <netinet/in.h> 48 1.2.4.2 yamt #include <netinet/in_systm.h> 49 1.2.4.2 yamt #include <netinet/ip.h> 50 1.2.4.2 yamt #include <netinet/tcp.h> 51 1.2.4.2 yamt 52 1.2.4.2 yamt #include <net/if.h> 53 1.2.4.2 yamt 54 1.2.4.2 yamt 55 1.2.4.2 yamt #include "netinet/ip_compat.h" 56 1.2.4.2 yamt #include "netinet/ip_fil.h" 57 1.2.4.2 yamt #include "netinet/ip_state.h" 58 1.2.4.2 yamt #include "netinet/ip_scan.h" 59 1.2.4.2 yamt /* END OF INCLUDES */ 60 1.2.4.2 yamt 61 1.2.4.2 yamt #if !defined(lint) 62 1.2.4.2 yamt #if defined(__NetBSD__) 63 1.2.4.2 yamt #include <sys/cdefs.h> 64 1.2.4.3 yamt __KERNEL_RCSID(0, "$NetBSD: ip_scan.c,v 1.2.4.3 2012/10/30 17:22:20 yamt Exp $"); 65 1.2.4.2 yamt #else 66 1.2.4.2 yamt static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed"; 67 1.2.4.3 yamt static const char rcsid[] = "@(#)Id: ip_scan.c,v 1.1.1.2 2012/07/22 13:45:34 darrenr Exp"; 68 1.2.4.2 yamt #endif 69 1.2.4.2 yamt #endif 70 1.2.4.2 yamt 71 1.2.4.2 yamt #ifdef IPFILTER_SCAN /* endif at bottom of file */ 72 1.2.4.2 yamt 73 1.2.4.2 yamt 74 1.2.4.2 yamt ipscan_t *ipf_scan_list = NULL, 75 1.2.4.2 yamt *ipf_scan_tail = NULL; 76 1.2.4.2 yamt ipscanstat_t ipf_scan_stat; 77 1.2.4.2 yamt # ifdef USE_MUTEXES 78 1.2.4.2 yamt ipfrwlock_t ipf_scan_rwlock; 79 1.2.4.2 yamt # endif 80 1.2.4.2 yamt 81 1.2.4.2 yamt # ifndef isalpha 82 1.2.4.2 yamt # define isalpha(x) (((x) >= 'A' && 'Z' >= (x)) || \ 83 1.2.4.2 yamt ((x) >= 'a' && 'z' >= (x))) 84 1.2.4.2 yamt # endif 85 1.2.4.2 yamt 86 1.2.4.2 yamt 87 1.2.4.2 yamt int ipf_scan_add(void *); 88 1.2.4.2 yamt int ipf_scan_remove(void *); 89 1.2.4.2 yamt struct ipscan *ipf_scan_lookup(char *); 90 1.2.4.2 yamt int ipf_scan_matchstr(sinfo_t *, char *, int); 91 1.2.4.2 yamt int ipf_scan_matchisc(ipscan_t *, ipstate_t *, int, int, int *); 92 1.2.4.2 yamt int ipf_scan_match(ipstate_t *); 93 1.2.4.2 yamt 94 1.2.4.2 yamt static int ipf_scan_inited = 0; 95 1.2.4.2 yamt 96 1.2.4.2 yamt 97 1.2.4.2 yamt int 98 1.2.4.2 yamt ipf_scan_init() 99 1.2.4.2 yamt { 100 1.2.4.2 yamt RWLOCK_INIT(&ipf_scan_rwlock, "ip scan rwlock"); 101 1.2.4.2 yamt ipf_scan_inited = 1; 102 1.2.4.2 yamt return 0; 103 1.2.4.2 yamt } 104 1.2.4.2 yamt 105 1.2.4.2 yamt 106 1.2.4.2 yamt void 107 1.2.4.2 yamt ipf_scan_unload(void *arg) 108 1.2.4.2 yamt { 109 1.2.4.2 yamt if (ipf_scan_inited == 1) { 110 1.2.4.2 yamt RW_DESTROY(&ipf_scan_rwlock); 111 1.2.4.2 yamt ipf_scan_inited = 0; 112 1.2.4.2 yamt } 113 1.2.4.2 yamt } 114 1.2.4.2 yamt 115 1.2.4.2 yamt 116 1.2.4.2 yamt int 117 1.2.4.2 yamt ipf_scan_add(data) 118 1.2.4.2 yamt void *data; 119 1.2.4.2 yamt { 120 1.2.4.2 yamt ipscan_t *i, *isc; 121 1.2.4.2 yamt int err; 122 1.2.4.2 yamt 123 1.2.4.2 yamt KMALLOC(isc, ipscan_t *); 124 1.2.4.2 yamt if (!isc) { 125 1.2.4.2 yamt ipf_interror = 90001; 126 1.2.4.2 yamt return ENOMEM; 127 1.2.4.2 yamt } 128 1.2.4.2 yamt 129 1.2.4.2 yamt err = copyinptr(data, isc, sizeof(*isc)); 130 1.2.4.2 yamt if (err) { 131 1.2.4.2 yamt KFREE(isc); 132 1.2.4.2 yamt return err; 133 1.2.4.2 yamt } 134 1.2.4.2 yamt 135 1.2.4.2 yamt WRITE_ENTER(&ipf_scan_rwlock); 136 1.2.4.2 yamt 137 1.2.4.2 yamt i = ipf_scan_lookup(isc->ipsc_tag); 138 1.2.4.2 yamt if (i != NULL) { 139 1.2.4.2 yamt RWLOCK_EXIT(&ipf_scan_rwlock); 140 1.2.4.2 yamt KFREE(isc); 141 1.2.4.2 yamt ipf_interror = 90002; 142 1.2.4.2 yamt return EEXIST; 143 1.2.4.2 yamt } 144 1.2.4.2 yamt 145 1.2.4.2 yamt if (ipf_scan_tail) { 146 1.2.4.2 yamt ipf_scan_tail->ipsc_next = isc; 147 1.2.4.2 yamt isc->ipsc_pnext = &ipf_scan_tail->ipsc_next; 148 1.2.4.2 yamt ipf_scan_tail = isc; 149 1.2.4.2 yamt } else { 150 1.2.4.2 yamt ipf_scan_list = isc; 151 1.2.4.2 yamt ipf_scan_tail = isc; 152 1.2.4.2 yamt isc->ipsc_pnext = &ipf_scan_list; 153 1.2.4.2 yamt } 154 1.2.4.2 yamt isc->ipsc_next = NULL; 155 1.2.4.2 yamt 156 1.2.4.2 yamt isc->ipsc_hits = 0; 157 1.2.4.2 yamt isc->ipsc_fref = 0; 158 1.2.4.2 yamt isc->ipsc_sref = 0; 159 1.2.4.2 yamt isc->ipsc_active = 0; 160 1.2.4.2 yamt 161 1.2.4.2 yamt ipf_scan_stat.iscs_entries++; 162 1.2.4.2 yamt RWLOCK_EXIT(&ipf_scan_rwlock); 163 1.2.4.2 yamt return 0; 164 1.2.4.2 yamt } 165 1.2.4.2 yamt 166 1.2.4.2 yamt 167 1.2.4.2 yamt int 168 1.2.4.2 yamt ipf_scan_remove(data) 169 1.2.4.2 yamt void *data; 170 1.2.4.2 yamt { 171 1.2.4.2 yamt ipscan_t isc, *i; 172 1.2.4.2 yamt int err; 173 1.2.4.2 yamt 174 1.2.4.2 yamt err = copyinptr(data, &isc, sizeof(isc)); 175 1.2.4.2 yamt if (err) 176 1.2.4.2 yamt return err; 177 1.2.4.2 yamt 178 1.2.4.2 yamt WRITE_ENTER(&ipf_scan_rwlock); 179 1.2.4.2 yamt 180 1.2.4.2 yamt i = ipf_scan_lookup(isc.ipsc_tag); 181 1.2.4.2 yamt if (i == NULL) 182 1.2.4.2 yamt err = ENOENT; 183 1.2.4.2 yamt else { 184 1.2.4.2 yamt if (i->ipsc_fref) { 185 1.2.4.2 yamt RWLOCK_EXIT(&ipf_scan_rwlock); 186 1.2.4.2 yamt ipf_interror = 90003; 187 1.2.4.2 yamt return EBUSY; 188 1.2.4.2 yamt } 189 1.2.4.2 yamt 190 1.2.4.2 yamt *i->ipsc_pnext = i->ipsc_next; 191 1.2.4.2 yamt if (i->ipsc_next) 192 1.2.4.2 yamt i->ipsc_next->ipsc_pnext = i->ipsc_pnext; 193 1.2.4.2 yamt else { 194 1.2.4.2 yamt if (i->ipsc_pnext == &ipf_scan_list) 195 1.2.4.2 yamt ipf_scan_tail = NULL; 196 1.2.4.2 yamt else 197 1.2.4.2 yamt ipf_scan_tail = *(*i->ipsc_pnext)->ipsc_pnext; 198 1.2.4.2 yamt } 199 1.2.4.2 yamt 200 1.2.4.2 yamt ipf_scan_stat.iscs_entries--; 201 1.2.4.2 yamt KFREE(i); 202 1.2.4.2 yamt } 203 1.2.4.2 yamt RWLOCK_EXIT(&ipf_scan_rwlock); 204 1.2.4.2 yamt return err; 205 1.2.4.2 yamt } 206 1.2.4.2 yamt 207 1.2.4.2 yamt 208 1.2.4.2 yamt struct ipscan * 209 1.2.4.2 yamt ipf_scan_lookup(tag) 210 1.2.4.2 yamt char *tag; 211 1.2.4.2 yamt { 212 1.2.4.2 yamt ipscan_t *i; 213 1.2.4.2 yamt 214 1.2.4.2 yamt for (i = ipf_scan_list; i; i = i->ipsc_next) 215 1.2.4.2 yamt if (!strcmp(i->ipsc_tag, tag)) 216 1.2.4.2 yamt return i; 217 1.2.4.2 yamt return NULL; 218 1.2.4.2 yamt } 219 1.2.4.2 yamt 220 1.2.4.2 yamt 221 1.2.4.2 yamt int 222 1.2.4.2 yamt ipf_scan_attachfr(fr) 223 1.2.4.2 yamt struct frentry *fr; 224 1.2.4.2 yamt { 225 1.2.4.2 yamt ipscan_t *i; 226 1.2.4.2 yamt 227 1.2.4.2 yamt if (fr->fr_isctag != -1) { 228 1.2.4.2 yamt READ_ENTER(&ipf_scan_rwlock); 229 1.2.4.2 yamt i = ipf_scan_lookup(fr->fr_isctag + fr->fr_names); 230 1.2.4.2 yamt if (i != NULL) { 231 1.2.4.2 yamt ATOMIC_INC32(i->ipsc_fref); 232 1.2.4.2 yamt } 233 1.2.4.2 yamt RWLOCK_EXIT(&ipf_scan_rwlock); 234 1.2.4.2 yamt if (i == NULL) { 235 1.2.4.2 yamt ipf_interror = 90004; 236 1.2.4.2 yamt return ENOENT; 237 1.2.4.2 yamt } 238 1.2.4.2 yamt fr->fr_isc = i; 239 1.2.4.2 yamt } 240 1.2.4.2 yamt return 0; 241 1.2.4.2 yamt } 242 1.2.4.2 yamt 243 1.2.4.2 yamt 244 1.2.4.2 yamt int 245 1.2.4.2 yamt ipf_scan_attachis(is) 246 1.2.4.2 yamt struct ipstate *is; 247 1.2.4.2 yamt { 248 1.2.4.2 yamt frentry_t *fr; 249 1.2.4.2 yamt ipscan_t *i; 250 1.2.4.2 yamt 251 1.2.4.2 yamt READ_ENTER(&ipf_scan_rwlock); 252 1.2.4.2 yamt fr = is->is_rule; 253 1.2.4.2 yamt if (fr != NULL) { 254 1.2.4.2 yamt i = fr->fr_isc; 255 1.2.4.2 yamt if ((i != NULL) && (i != (ipscan_t *)-1)) { 256 1.2.4.2 yamt is->is_isc = i; 257 1.2.4.2 yamt ATOMIC_INC32(i->ipsc_sref); 258 1.2.4.2 yamt if (i->ipsc_clen) 259 1.2.4.2 yamt is->is_flags |= IS_SC_CLIENT; 260 1.2.4.2 yamt else 261 1.2.4.2 yamt is->is_flags |= IS_SC_MATCHC; 262 1.2.4.2 yamt if (i->ipsc_slen) 263 1.2.4.2 yamt is->is_flags |= IS_SC_SERVER; 264 1.2.4.2 yamt else 265 1.2.4.2 yamt is->is_flags |= IS_SC_MATCHS; 266 1.2.4.2 yamt } 267 1.2.4.2 yamt } 268 1.2.4.2 yamt RWLOCK_EXIT(&ipf_scan_rwlock); 269 1.2.4.2 yamt return 0; 270 1.2.4.2 yamt } 271 1.2.4.2 yamt 272 1.2.4.2 yamt 273 1.2.4.2 yamt int 274 1.2.4.2 yamt ipf_scan_detachfr(fr) 275 1.2.4.2 yamt struct frentry *fr; 276 1.2.4.2 yamt { 277 1.2.4.2 yamt ipscan_t *i; 278 1.2.4.2 yamt 279 1.2.4.2 yamt i = fr->fr_isc; 280 1.2.4.2 yamt if (i != NULL) { 281 1.2.4.2 yamt ATOMIC_DEC32(i->ipsc_fref); 282 1.2.4.2 yamt } 283 1.2.4.2 yamt return 0; 284 1.2.4.2 yamt } 285 1.2.4.2 yamt 286 1.2.4.2 yamt 287 1.2.4.2 yamt int 288 1.2.4.2 yamt ipf_scan_detachis(is) 289 1.2.4.2 yamt struct ipstate *is; 290 1.2.4.2 yamt { 291 1.2.4.2 yamt ipscan_t *i; 292 1.2.4.2 yamt 293 1.2.4.2 yamt READ_ENTER(&ipf_scan_rwlock); 294 1.2.4.2 yamt if ((i = is->is_isc) && (i != (ipscan_t *)-1)) { 295 1.2.4.2 yamt ATOMIC_DEC32(i->ipsc_sref); 296 1.2.4.2 yamt is->is_isc = NULL; 297 1.2.4.2 yamt is->is_flags &= ~(IS_SC_CLIENT|IS_SC_SERVER); 298 1.2.4.2 yamt } 299 1.2.4.2 yamt RWLOCK_EXIT(&ipf_scan_rwlock); 300 1.2.4.2 yamt return 0; 301 1.2.4.2 yamt } 302 1.2.4.2 yamt 303 1.2.4.2 yamt 304 1.2.4.2 yamt /* 305 1.2.4.2 yamt * 'string' compare for scanning 306 1.2.4.2 yamt */ 307 1.2.4.2 yamt int 308 1.2.4.2 yamt ipf_scan_matchstr(sp, str, n) 309 1.2.4.2 yamt sinfo_t *sp; 310 1.2.4.2 yamt char *str; 311 1.2.4.2 yamt int n; 312 1.2.4.2 yamt { 313 1.2.4.2 yamt char *s, *t, *up; 314 1.2.4.2 yamt int i = n; 315 1.2.4.2 yamt 316 1.2.4.2 yamt if (i > sp->s_len) 317 1.2.4.2 yamt i = sp->s_len; 318 1.2.4.2 yamt up = str; 319 1.2.4.2 yamt 320 1.2.4.2 yamt for (s = sp->s_txt, t = sp->s_msk; i; i--, s++, t++, up++) 321 1.2.4.2 yamt switch ((int)*t) 322 1.2.4.2 yamt { 323 1.2.4.2 yamt case '.' : 324 1.2.4.2 yamt if (*s != *up) 325 1.2.4.2 yamt return 1; 326 1.2.4.2 yamt break; 327 1.2.4.2 yamt case '?' : 328 1.2.4.2 yamt if (!ISALPHA(*up) || ((*s & 0x5f) != (*up & 0x5f))) 329 1.2.4.2 yamt return 1; 330 1.2.4.2 yamt break; 331 1.2.4.2 yamt case '*' : 332 1.2.4.2 yamt break; 333 1.2.4.2 yamt } 334 1.2.4.2 yamt return 0; 335 1.2.4.2 yamt } 336 1.2.4.2 yamt 337 1.2.4.2 yamt 338 1.2.4.2 yamt /* 339 1.2.4.2 yamt * Returns 3 if both server and client match, 2 if just server, 340 1.2.4.2 yamt * 1 if just client 341 1.2.4.2 yamt */ 342 1.2.4.2 yamt int 343 1.2.4.2 yamt ipf_scan_matchisc(isc, is, cl, sl, maxm) 344 1.2.4.2 yamt ipscan_t *isc; 345 1.2.4.2 yamt ipstate_t *is; 346 1.2.4.2 yamt int cl, sl, maxm[2]; 347 1.2.4.2 yamt { 348 1.2.4.2 yamt int i, j, k, n, ret = 0, flags; 349 1.2.4.2 yamt 350 1.2.4.2 yamt flags = is->is_flags; 351 1.2.4.2 yamt 352 1.2.4.2 yamt /* 353 1.2.4.2 yamt * If we've already matched more than what is on offer, then 354 1.2.4.2 yamt * assume we have a better match already and forget this one. 355 1.2.4.2 yamt */ 356 1.2.4.2 yamt if (maxm != NULL) { 357 1.2.4.2 yamt if (isc->ipsc_clen < maxm[0]) 358 1.2.4.2 yamt return 0; 359 1.2.4.2 yamt if (isc->ipsc_slen < maxm[1]) 360 1.2.4.2 yamt return 0; 361 1.2.4.2 yamt j = maxm[0]; 362 1.2.4.2 yamt k = maxm[1]; 363 1.2.4.2 yamt } else { 364 1.2.4.2 yamt j = 0; 365 1.2.4.2 yamt k = 0; 366 1.2.4.2 yamt } 367 1.2.4.2 yamt 368 1.2.4.2 yamt if (!isc->ipsc_clen) 369 1.2.4.2 yamt ret = 1; 370 1.2.4.2 yamt else if (((flags & (IS_SC_MATCHC|IS_SC_CLIENT)) == IS_SC_CLIENT) && 371 1.2.4.2 yamt cl && isc->ipsc_clen) { 372 1.2.4.2 yamt i = 0; 373 1.2.4.2 yamt n = MIN(cl, isc->ipsc_clen); 374 1.2.4.2 yamt if ((n > 0) && (!maxm || (n >= maxm[1]))) { 375 1.2.4.2 yamt if (!ipf_scan_matchstr(&isc->ipsc_cl, 376 1.2.4.2 yamt is->is_sbuf[0], n)) { 377 1.2.4.2 yamt i++; 378 1.2.4.2 yamt ret |= 1; 379 1.2.4.2 yamt if (n > j) 380 1.2.4.2 yamt j = n; 381 1.2.4.2 yamt } 382 1.2.4.2 yamt } 383 1.2.4.2 yamt } 384 1.2.4.2 yamt 385 1.2.4.2 yamt if (!isc->ipsc_slen) 386 1.2.4.2 yamt ret |= 2; 387 1.2.4.2 yamt else if (((flags & (IS_SC_MATCHS|IS_SC_SERVER)) == IS_SC_SERVER) && 388 1.2.4.2 yamt sl && isc->ipsc_slen) { 389 1.2.4.2 yamt i = 0; 390 1.2.4.2 yamt n = MIN(cl, isc->ipsc_slen); 391 1.2.4.2 yamt if ((n > 0) && (!maxm || (n >= maxm[1]))) { 392 1.2.4.2 yamt if (!ipf_scan_matchstr(&isc->ipsc_sl, 393 1.2.4.2 yamt is->is_sbuf[1], n)) { 394 1.2.4.2 yamt i++; 395 1.2.4.2 yamt ret |= 2; 396 1.2.4.2 yamt if (n > k) 397 1.2.4.2 yamt k = n; 398 1.2.4.2 yamt } 399 1.2.4.2 yamt } 400 1.2.4.2 yamt } 401 1.2.4.2 yamt 402 1.2.4.2 yamt if (maxm && (ret == 3)) { 403 1.2.4.2 yamt maxm[0] = j; 404 1.2.4.2 yamt maxm[1] = k; 405 1.2.4.2 yamt } 406 1.2.4.2 yamt return ret; 407 1.2.4.2 yamt } 408 1.2.4.2 yamt 409 1.2.4.2 yamt 410 1.2.4.2 yamt int 411 1.2.4.2 yamt ipf_scan_match(is) 412 1.2.4.2 yamt ipstate_t *is; 413 1.2.4.2 yamt { 414 1.2.4.2 yamt int i, j, k, n, cl, sl, maxm[2]; 415 1.2.4.2 yamt ipscan_t *isc, *lm; 416 1.2.4.2 yamt tcpdata_t *t; 417 1.2.4.2 yamt 418 1.2.4.2 yamt for (cl = 0, n = is->is_smsk[0]; n & 1; n >>= 1) 419 1.2.4.2 yamt cl++; 420 1.2.4.2 yamt for (sl = 0, n = is->is_smsk[1]; n & 1; n >>= 1) 421 1.2.4.2 yamt sl++; 422 1.2.4.2 yamt 423 1.2.4.2 yamt j = 0; 424 1.2.4.2 yamt isc = is->is_isc; 425 1.2.4.2 yamt if (isc != NULL) { 426 1.2.4.2 yamt /* 427 1.2.4.2 yamt * Known object to scan for. 428 1.2.4.2 yamt */ 429 1.2.4.2 yamt i = ipf_scan_matchisc(isc, is, cl, sl, NULL); 430 1.2.4.2 yamt if (i & 1) { 431 1.2.4.2 yamt is->is_flags |= IS_SC_MATCHC; 432 1.2.4.2 yamt is->is_flags &= ~IS_SC_CLIENT; 433 1.2.4.2 yamt } else if (cl >= isc->ipsc_clen) 434 1.2.4.2 yamt is->is_flags &= ~IS_SC_CLIENT; 435 1.2.4.2 yamt if (i & 2) { 436 1.2.4.2 yamt is->is_flags |= IS_SC_MATCHS; 437 1.2.4.2 yamt is->is_flags &= ~IS_SC_SERVER; 438 1.2.4.2 yamt } else if (sl >= isc->ipsc_slen) 439 1.2.4.2 yamt is->is_flags &= ~IS_SC_SERVER; 440 1.2.4.2 yamt } else { 441 1.2.4.2 yamt i = 0; 442 1.2.4.2 yamt lm = NULL; 443 1.2.4.2 yamt maxm[0] = 0; 444 1.2.4.2 yamt maxm[1] = 0; 445 1.2.4.2 yamt for (k = 0, isc = ipf_scan_list; isc; isc = isc->ipsc_next) { 446 1.2.4.2 yamt i = ipf_scan_matchisc(isc, is, cl, sl, maxm); 447 1.2.4.2 yamt if (i) { 448 1.2.4.2 yamt /* 449 1.2.4.2 yamt * We only want to remember the best match 450 1.2.4.2 yamt * and the number of times we get a best 451 1.2.4.2 yamt * match. 452 1.2.4.2 yamt */ 453 1.2.4.2 yamt if ((j == 3) && (i < 3)) 454 1.2.4.2 yamt continue; 455 1.2.4.2 yamt if ((i == 3) && (j != 3)) 456 1.2.4.2 yamt k = 1; 457 1.2.4.2 yamt else 458 1.2.4.2 yamt k++; 459 1.2.4.2 yamt j = i; 460 1.2.4.2 yamt lm = isc; 461 1.2.4.2 yamt } 462 1.2.4.2 yamt } 463 1.2.4.2 yamt if (k == 1) 464 1.2.4.2 yamt isc = lm; 465 1.2.4.2 yamt if (isc == NULL) 466 1.2.4.2 yamt return 0; 467 1.2.4.2 yamt 468 1.2.4.2 yamt /* 469 1.2.4.2 yamt * No matches or partial matches, so reset the respective 470 1.2.4.2 yamt * search flag. 471 1.2.4.2 yamt */ 472 1.2.4.2 yamt if (!(j & 1)) 473 1.2.4.2 yamt is->is_flags &= ~IS_SC_CLIENT; 474 1.2.4.2 yamt 475 1.2.4.2 yamt if (!(j & 2)) 476 1.2.4.2 yamt is->is_flags &= ~IS_SC_SERVER; 477 1.2.4.2 yamt 478 1.2.4.2 yamt /* 479 1.2.4.2 yamt * If we found the best match, then set flags appropriately. 480 1.2.4.2 yamt */ 481 1.2.4.2 yamt if ((j == 3) && (k == 1)) { 482 1.2.4.2 yamt is->is_flags &= ~(IS_SC_SERVER|IS_SC_CLIENT); 483 1.2.4.2 yamt is->is_flags |= (IS_SC_MATCHS|IS_SC_MATCHC); 484 1.2.4.2 yamt } 485 1.2.4.2 yamt } 486 1.2.4.2 yamt 487 1.2.4.2 yamt /* 488 1.2.4.2 yamt * If the acknowledged side of a connection has moved past the data in 489 1.2.4.2 yamt * which we are interested, then reset respective flag. 490 1.2.4.2 yamt */ 491 1.2.4.2 yamt t = &is->is_tcp.ts_data[0]; 492 1.2.4.2 yamt if (t->td_end > is->is_s0[0] + 15) 493 1.2.4.2 yamt is->is_flags &= ~IS_SC_CLIENT; 494 1.2.4.2 yamt 495 1.2.4.2 yamt t = &is->is_tcp.ts_data[1]; 496 1.2.4.2 yamt if (t->td_end > is->is_s0[1] + 15) 497 1.2.4.2 yamt is->is_flags &= ~IS_SC_SERVER; 498 1.2.4.2 yamt 499 1.2.4.2 yamt /* 500 1.2.4.2 yamt * Matching complete ? 501 1.2.4.2 yamt */ 502 1.2.4.2 yamt j = ISC_A_NONE; 503 1.2.4.2 yamt if ((is->is_flags & IS_SC_MATCHALL) == IS_SC_MATCHALL) { 504 1.2.4.2 yamt j = isc->ipsc_action; 505 1.2.4.2 yamt ipf_scan_stat.iscs_acted++; 506 1.2.4.2 yamt } else if ((is->is_isc != NULL) && 507 1.2.4.2 yamt ((is->is_flags & IS_SC_MATCHALL) != IS_SC_MATCHALL) && 508 1.2.4.2 yamt !(is->is_flags & (IS_SC_CLIENT|IS_SC_SERVER))) { 509 1.2.4.2 yamt /* 510 1.2.4.2 yamt * Matching failed... 511 1.2.4.2 yamt */ 512 1.2.4.2 yamt j = isc->ipsc_else; 513 1.2.4.2 yamt ipf_scan_stat.iscs_else++; 514 1.2.4.2 yamt } 515 1.2.4.2 yamt 516 1.2.4.2 yamt switch (j) 517 1.2.4.2 yamt { 518 1.2.4.2 yamt case ISC_A_CLOSE : 519 1.2.4.2 yamt /* 520 1.2.4.2 yamt * If as a result of a successful match we are to 521 1.2.4.2 yamt * close a connection, change the "keep state" info. 522 1.2.4.2 yamt * to block packets and generate TCP RST's. 523 1.2.4.2 yamt */ 524 1.2.4.2 yamt is->is_pass &= ~FR_RETICMP; 525 1.2.4.2 yamt is->is_pass |= FR_RETRST; 526 1.2.4.2 yamt break; 527 1.2.4.2 yamt default : 528 1.2.4.2 yamt break; 529 1.2.4.2 yamt } 530 1.2.4.2 yamt 531 1.2.4.2 yamt return i; 532 1.2.4.2 yamt } 533 1.2.4.2 yamt 534 1.2.4.2 yamt 535 1.2.4.2 yamt /* 536 1.2.4.2 yamt * check if a packet matches what we're scanning for 537 1.2.4.2 yamt */ 538 1.2.4.2 yamt int 539 1.2.4.2 yamt ipf_scan_packet(fin, is) 540 1.2.4.2 yamt fr_info_t *fin; 541 1.2.4.2 yamt ipstate_t *is; 542 1.2.4.2 yamt { 543 1.2.4.2 yamt int i, j, rv, dlen, off, thoff; 544 1.2.4.2 yamt u_32_t seq, s0; 545 1.2.4.2 yamt tcphdr_t *tcp; 546 1.2.4.2 yamt 547 1.2.4.2 yamt rv = !IP6_EQ(&fin->fin_fi.fi_src, &is->is_src); 548 1.2.4.2 yamt tcp = fin->fin_dp; 549 1.2.4.2 yamt seq = ntohl(tcp->th_seq); 550 1.2.4.2 yamt 551 1.2.4.2 yamt if (!is->is_s0[rv]) 552 1.2.4.2 yamt return 1; 553 1.2.4.2 yamt 554 1.2.4.2 yamt /* 555 1.2.4.2 yamt * check if this packet has more data that falls within the first 556 1.2.4.2 yamt * 16 bytes sent in either direction. 557 1.2.4.2 yamt */ 558 1.2.4.2 yamt s0 = is->is_s0[rv]; 559 1.2.4.2 yamt off = seq - s0; 560 1.2.4.2 yamt if ((off > 15) || (off < 0)) 561 1.2.4.2 yamt return 1; 562 1.2.4.2 yamt thoff = TCP_OFF(tcp) << 2; 563 1.2.4.2 yamt dlen = fin->fin_dlen - thoff; 564 1.2.4.2 yamt if (dlen <= 0) 565 1.2.4.2 yamt return 1; 566 1.2.4.2 yamt if (dlen > 16) 567 1.2.4.2 yamt dlen = 16; 568 1.2.4.2 yamt if (off + dlen > 16) 569 1.2.4.2 yamt dlen = 16 - off; 570 1.2.4.2 yamt 571 1.2.4.2 yamt j = 0xffff >> (16 - dlen); 572 1.2.4.2 yamt i = (0xffff & j) << off; 573 1.2.4.2 yamt #ifdef _KERNEL 574 1.2.4.2 yamt COPYDATA(*(mb_t **)fin->fin_mp, fin->fin_plen - fin->fin_dlen + thoff, 575 1.2.4.2 yamt dlen, (void *)is->is_sbuf[rv] + off); 576 1.2.4.2 yamt #endif 577 1.2.4.2 yamt is->is_smsk[rv] |= i; 578 1.2.4.2 yamt for (j = 0, i = is->is_smsk[rv]; i & 1; i >>= 1) 579 1.2.4.2 yamt j++; 580 1.2.4.2 yamt if (j == 0) 581 1.2.4.2 yamt return 1; 582 1.2.4.2 yamt 583 1.2.4.2 yamt (void) ipf_scan_match(is); 584 1.2.4.2 yamt #if 0 585 1.2.4.2 yamt /* 586 1.2.4.2 yamt * There is the potential here for plain text passwords to get 587 1.2.4.2 yamt * buffered and stored for some time... 588 1.2.4.2 yamt */ 589 1.2.4.2 yamt if (!(is->is_flags & IS_SC_CLIENT)) 590 1.2.4.2 yamt bzero(is->is_sbuf[0], sizeof(is->is_sbuf[0])); 591 1.2.4.2 yamt if (!(is->is_flags & IS_SC_SERVER)) 592 1.2.4.2 yamt bzero(is->is_sbuf[1], sizeof(is->is_sbuf[1])); 593 1.2.4.2 yamt #endif 594 1.2.4.2 yamt return 0; 595 1.2.4.2 yamt } 596 1.2.4.2 yamt 597 1.2.4.2 yamt 598 1.2.4.2 yamt int 599 1.2.4.2 yamt ipf_scan_ioctl(data, cmd, mode, uid, ctx) 600 1.2.4.2 yamt void *data; 601 1.2.4.2 yamt ioctlcmd_t cmd; 602 1.2.4.2 yamt int mode, uid; 603 1.2.4.2 yamt void *ctx; 604 1.2.4.2 yamt { 605 1.2.4.2 yamt ipscanstat_t ipscs; 606 1.2.4.2 yamt int err = 0; 607 1.2.4.2 yamt 608 1.2.4.2 yamt switch (cmd) 609 1.2.4.2 yamt { 610 1.2.4.2 yamt case SIOCADSCA : 611 1.2.4.2 yamt err = ipf_scan_add(data); 612 1.2.4.2 yamt break; 613 1.2.4.2 yamt case SIOCRMSCA : 614 1.2.4.2 yamt err = ipf_scan_remove(data); 615 1.2.4.2 yamt break; 616 1.2.4.2 yamt case SIOCGSCST : 617 1.2.4.2 yamt bcopy((char *)&ipf_scan_stat, (char *)&ipscs, sizeof(ipscs)); 618 1.2.4.2 yamt ipscs.iscs_list = ipf_scan_list; 619 1.2.4.2 yamt err = BCOPYOUT(&ipscs, data, sizeof(ipscs)); 620 1.2.4.2 yamt if (err != 0) { 621 1.2.4.2 yamt ipf_interror = 90005; 622 1.2.4.2 yamt err = EFAULT; 623 1.2.4.2 yamt } 624 1.2.4.2 yamt break; 625 1.2.4.2 yamt default : 626 1.2.4.2 yamt err = EINVAL; 627 1.2.4.2 yamt break; 628 1.2.4.2 yamt } 629 1.2.4.2 yamt 630 1.2.4.2 yamt return err; 631 1.2.4.2 yamt } 632 1.2.4.2 yamt #endif /* IPFILTER_SCAN */ 633
Indexes created Mon Oct 20 16:09:52 GMT 2025