fil.c revision 349927
1/* $FreeBSD: stable/10/sys/contrib/ipfilter/netinet/fil.c 349927 2019-07-12 00:50:33Z cy $ */ 2 3/* 4 * Copyright (C) 2012 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 * 8 * Copyright 2008 Sun Microsystems. 9 * 10 * $Id$ 11 * 12 */ 13#if defined(KERNEL) || defined(_KERNEL) 14# undef KERNEL 15# undef _KERNEL 16# define KERNEL 1 17# define _KERNEL 1 18#endif 19#include <sys/errno.h> 20#include <sys/types.h> 21#include <sys/param.h> 22#include <sys/time.h> 23#if defined(_KERNEL) && defined(__FreeBSD_version) && \ 24 (__FreeBSD_version >= 220000) 25# if (__FreeBSD_version >= 400000) 26# if !defined(IPFILTER_LKM) 27# include "opt_inet6.h" 28# endif 29# if (__FreeBSD_version == 400019) 30# define CSUM_DELAY_DATA 31# endif 32# endif 33# include <sys/filio.h> 34#else 35# include <sys/ioctl.h> 36#endif 37#if (defined(__SVR4) || defined(__svr4__)) && defined(sun) 38# include <sys/filio.h> 39#endif 40#if !defined(_AIX51) 41# include <sys/fcntl.h> 42#endif 43#if defined(_KERNEL) 44# include <sys/systm.h> 45# include <sys/file.h> 46#else 47# include <stdio.h> 48# include <string.h> 49# include <stdlib.h> 50# include <stddef.h> 51# include <sys/file.h> 52# define _KERNEL 53# ifdef __OpenBSD__ 54struct file; 55# endif 56# include <sys/uio.h> 57# undef _KERNEL 58#endif 59#if !defined(__SVR4) && !defined(__svr4__) && !defined(__hpux) && \ 60 !defined(linux) 61# include <sys/mbuf.h> 62#else 63# if !defined(linux) 64# include <sys/byteorder.h> 65# endif 66# if (SOLARIS2 < 5) && defined(sun) 67# include <sys/dditypes.h> 68# endif 69#endif 70#ifdef __hpux 71# define _NET_ROUTE_INCLUDED 72#endif 73#if !defined(linux) 74# include <sys/protosw.h> 75#endif 76#include <sys/socket.h> 77#include <net/if.h> 78#ifdef sun 79# include <net/af.h> 80#endif 81#include <netinet/in.h> 82#include <netinet/in_systm.h> 83#include <netinet/ip.h> 84#if defined(__sgi) && defined(IFF_DRVRLOCK) /* IRIX 6 */ 85# include <sys/hashing.h> 86# include <netinet/in_var.h> 87#endif 88#include <netinet/tcp.h> 89#if (!defined(__sgi) && !defined(AIX)) || defined(_KERNEL) 90# include <netinet/udp.h> 91# include <netinet/ip_icmp.h> 92#endif 93#ifdef __hpux 94# undef _NET_ROUTE_INCLUDED 95#endif 96#ifdef __osf__ 97# undef _RADIX_H_ 98#endif 99#include "netinet/ip_compat.h" 100#ifdef USE_INET6 101# include <netinet/icmp6.h> 102# if !SOLARIS && defined(_KERNEL) && !defined(__osf__) && !defined(__hpux) 103# include <netinet6/in6_var.h> 104# endif 105#endif 106#include "netinet/ip_fil.h" 107#include "netinet/ip_nat.h" 108#include "netinet/ip_frag.h" 109#include "netinet/ip_state.h" 110#include "netinet/ip_proxy.h" 111#include "netinet/ip_auth.h" 112#ifdef IPFILTER_SCAN 113# include "netinet/ip_scan.h" 114#endif 115#include "netinet/ip_sync.h" 116#include "netinet/ip_lookup.h" 117#include "netinet/ip_pool.h" 118#include "netinet/ip_htable.h" 119#ifdef IPFILTER_COMPILED 120# include "netinet/ip_rules.h" 121#endif 122#if defined(IPFILTER_BPF) && defined(_KERNEL) 123# include <net/bpf.h> 124#endif 125#if defined(__FreeBSD_version) && (__FreeBSD_version >= 300000) 126# include <sys/malloc.h> 127#endif 128#include "netinet/ipl.h" 129 130#if defined(__NetBSD__) && (__NetBSD_Version__ >= 104230000) 131# include <sys/callout.h> 132extern struct callout ipf_slowtimer_ch; 133#endif 134#if defined(__OpenBSD__) 135# include <sys/timeout.h> 136extern struct timeout ipf_slowtimer_ch; 137#endif 138/* END OF INCLUDES */ 139 140#if !defined(lint) 141static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed"; 142static const char rcsid[] = "@(#)$FreeBSD: stable/10/sys/contrib/ipfilter/netinet/fil.c 349927 2019-07-12 00:50:33Z cy $"; 143/* static const char rcsid[] = "@(#)$Id: fil.c,v 2.243.2.125 2007/10/10 09:27:20 darrenr Exp $"; */ 144#endif 145 146#ifndef _KERNEL 147# include "ipf.h" 148# include "ipt.h" 149extern int opts; 150extern int blockreason; 151#endif /* _KERNEL */ 152 153#define LBUMP(x) softc->x++ 154#define LBUMPD(x, y) do { softc->x.y++; DT(y); } while (0) 155 156static INLINE int ipf_check_ipf __P((fr_info_t *, frentry_t *, int)); 157static u_32_t ipf_checkcipso __P((fr_info_t *, u_char *, int)); 158static u_32_t ipf_checkripso __P((u_char *)); 159static u_32_t ipf_decaps __P((fr_info_t *, u_32_t, int)); 160#ifdef IPFILTER_LOG 161static frentry_t *ipf_dolog __P((fr_info_t *, u_32_t *)); 162#endif 163static int ipf_flushlist __P((ipf_main_softc_t *, int *, 164 frentry_t **)); 165static int ipf_flush_groups __P((ipf_main_softc_t *, frgroup_t **, 166 int)); 167static ipfunc_t ipf_findfunc __P((ipfunc_t)); 168static void *ipf_findlookup __P((ipf_main_softc_t *, int, 169 frentry_t *, 170 i6addr_t *, i6addr_t *)); 171static frentry_t *ipf_firewall __P((fr_info_t *, u_32_t *)); 172static int ipf_fr_matcharray __P((fr_info_t *, int *)); 173static int ipf_frruleiter __P((ipf_main_softc_t *, void *, int, 174 void *)); 175static void ipf_funcfini __P((ipf_main_softc_t *, frentry_t *)); 176static int ipf_funcinit __P((ipf_main_softc_t *, frentry_t *)); 177static int ipf_geniter __P((ipf_main_softc_t *, ipftoken_t *, 178 ipfgeniter_t *)); 179static void ipf_getstat __P((ipf_main_softc_t *, 180 struct friostat *, int)); 181static int ipf_group_flush __P((ipf_main_softc_t *, frgroup_t *)); 182static void ipf_group_free __P((frgroup_t *)); 183static int ipf_grpmapfini __P((struct ipf_main_softc_s *, 184 frentry_t *)); 185static int ipf_grpmapinit __P((struct ipf_main_softc_s *, 186 frentry_t *)); 187static frentry_t *ipf_nextrule __P((ipf_main_softc_t *, int, int, 188 frentry_t *, int)); 189static int ipf_portcheck __P((frpcmp_t *, u_32_t)); 190static INLINE int ipf_pr_ah __P((fr_info_t *)); 191static INLINE void ipf_pr_esp __P((fr_info_t *)); 192static INLINE void ipf_pr_gre __P((fr_info_t *)); 193static INLINE void ipf_pr_udp __P((fr_info_t *)); 194static INLINE void ipf_pr_tcp __P((fr_info_t *)); 195static INLINE void ipf_pr_icmp __P((fr_info_t *)); 196static INLINE void ipf_pr_ipv4hdr __P((fr_info_t *)); 197static INLINE void ipf_pr_short __P((fr_info_t *, int)); 198static INLINE int ipf_pr_tcpcommon __P((fr_info_t *)); 199static INLINE int ipf_pr_udpcommon __P((fr_info_t *)); 200static void ipf_rule_delete __P((ipf_main_softc_t *, frentry_t *f, 201 int, int)); 202static void ipf_rule_expire_insert __P((ipf_main_softc_t *, 203 frentry_t *, int)); 204static int ipf_synclist __P((ipf_main_softc_t *, frentry_t *, 205 void *)); 206static void ipf_token_flush __P((ipf_main_softc_t *)); 207static void ipf_token_unlink __P((ipf_main_softc_t *, 208 ipftoken_t *)); 209static ipftuneable_t *ipf_tune_findbyname __P((ipftuneable_t *, 210 const char *)); 211static ipftuneable_t *ipf_tune_findbycookie __P((ipftuneable_t **, void *, 212 void **)); 213static int ipf_updateipid __P((fr_info_t *)); 214static int ipf_settimeout __P((struct ipf_main_softc_s *, 215 struct ipftuneable *, 216 ipftuneval_t *)); 217#if !defined(_KERNEL) || (!defined(__NetBSD__) && !defined(__OpenBSD__) && \ 218 !defined(__FreeBSD__)) || \ 219 FREEBSD_LT_REV(501000) || NETBSD_LT_REV(105000000) || \ 220 OPENBSD_LT_REV(200006) 221static int ppsratecheck(struct timeval *, int *, int); 222#endif 223 224 225/* 226 * bit values for identifying presence of individual IP options 227 * All of these tables should be ordered by increasing key value on the left 228 * hand side to allow for binary searching of the array and include a trailer 229 * with a 0 for the bitmask for linear searches to easily find the end with. 230 */ 231static const struct optlist ipopts[20] = { 232 { IPOPT_NOP, 0x000001 }, 233 { IPOPT_RR, 0x000002 }, 234 { IPOPT_ZSU, 0x000004 }, 235 { IPOPT_MTUP, 0x000008 }, 236 { IPOPT_MTUR, 0x000010 }, 237 { IPOPT_ENCODE, 0x000020 }, 238 { IPOPT_TS, 0x000040 }, 239 { IPOPT_TR, 0x000080 }, 240 { IPOPT_SECURITY, 0x000100 }, 241 { IPOPT_LSRR, 0x000200 }, 242 { IPOPT_E_SEC, 0x000400 }, 243 { IPOPT_CIPSO, 0x000800 }, 244 { IPOPT_SATID, 0x001000 }, 245 { IPOPT_SSRR, 0x002000 }, 246 { IPOPT_ADDEXT, 0x004000 }, 247 { IPOPT_VISA, 0x008000 }, 248 { IPOPT_IMITD, 0x010000 }, 249 { IPOPT_EIP, 0x020000 }, 250 { IPOPT_FINN, 0x040000 }, 251 { 0, 0x000000 } 252}; 253 254#ifdef USE_INET6 255static const struct optlist ip6exthdr[] = { 256 { IPPROTO_HOPOPTS, 0x000001 }, 257 { IPPROTO_IPV6, 0x000002 }, 258 { IPPROTO_ROUTING, 0x000004 }, 259 { IPPROTO_FRAGMENT, 0x000008 }, 260 { IPPROTO_ESP, 0x000010 }, 261 { IPPROTO_AH, 0x000020 }, 262 { IPPROTO_NONE, 0x000040 }, 263 { IPPROTO_DSTOPTS, 0x000080 }, 264 { IPPROTO_MOBILITY, 0x000100 }, 265 { 0, 0 } 266}; 267#endif 268 269/* 270 * bit values for identifying presence of individual IP security options 271 */ 272static const struct optlist secopt[8] = { 273 { IPSO_CLASS_RES4, 0x01 }, 274 { IPSO_CLASS_TOPS, 0x02 }, 275 { IPSO_CLASS_SECR, 0x04 }, 276 { IPSO_CLASS_RES3, 0x08 }, 277 { IPSO_CLASS_CONF, 0x10 }, 278 { IPSO_CLASS_UNCL, 0x20 }, 279 { IPSO_CLASS_RES2, 0x40 }, 280 { IPSO_CLASS_RES1, 0x80 } 281}; 282 283char ipfilter_version[] = IPL_VERSION; 284 285int ipf_features = 0 286#ifdef IPFILTER_LKM 287 | IPF_FEAT_LKM 288#endif 289#ifdef IPFILTER_LOG 290 | IPF_FEAT_LOG 291#endif 292 | IPF_FEAT_LOOKUP 293#ifdef IPFILTER_BPF 294 | IPF_FEAT_BPF 295#endif 296#ifdef IPFILTER_COMPILED 297 | IPF_FEAT_COMPILED 298#endif 299#ifdef IPFILTER_CKSUM 300 | IPF_FEAT_CKSUM 301#endif 302 | IPF_FEAT_SYNC 303#ifdef IPFILTER_SCAN 304 | IPF_FEAT_SCAN 305#endif 306#ifdef USE_INET6 307 | IPF_FEAT_IPV6 308#endif 309 ; 310 311 312/* 313 * Table of functions available for use with call rules. 314 */ 315static ipfunc_resolve_t ipf_availfuncs[] = { 316 { "srcgrpmap", ipf_srcgrpmap, ipf_grpmapinit, ipf_grpmapfini }, 317 { "dstgrpmap", ipf_dstgrpmap, ipf_grpmapinit, ipf_grpmapfini }, 318 { "", NULL, NULL, NULL } 319}; 320 321static ipftuneable_t ipf_main_tuneables[] = { 322 { { (void *)offsetof(struct ipf_main_softc_s, ipf_flags) }, 323 "ipf_flags", 0, 0xffffffff, 324 stsizeof(ipf_main_softc_t, ipf_flags), 325 0, NULL, NULL }, 326 { { (void *)offsetof(struct ipf_main_softc_s, ipf_active) }, 327 "active", 0, 0, 328 stsizeof(ipf_main_softc_t, ipf_active), 329 IPFT_RDONLY, NULL, NULL }, 330 { { (void *)offsetof(ipf_main_softc_t, ipf_control_forwarding) }, 331 "control_forwarding", 0, 1, 332 stsizeof(ipf_main_softc_t, ipf_control_forwarding), 333 0, NULL, NULL }, 334 { { (void *)offsetof(ipf_main_softc_t, ipf_update_ipid) }, 335 "update_ipid", 0, 1, 336 stsizeof(ipf_main_softc_t, ipf_update_ipid), 337 0, NULL, NULL }, 338 { { (void *)offsetof(ipf_main_softc_t, ipf_chksrc) }, 339 "chksrc", 0, 1, 340 stsizeof(ipf_main_softc_t, ipf_chksrc), 341 0, NULL, NULL }, 342 { { (void *)offsetof(ipf_main_softc_t, ipf_minttl) }, 343 "min_ttl", 0, 1, 344 stsizeof(ipf_main_softc_t, ipf_minttl), 345 0, NULL, NULL }, 346 { { (void *)offsetof(ipf_main_softc_t, ipf_icmpminfragmtu) }, 347 "icmp_minfragmtu", 0, 1, 348 stsizeof(ipf_main_softc_t, ipf_icmpminfragmtu), 349 0, NULL, NULL }, 350 { { (void *)offsetof(ipf_main_softc_t, ipf_pass) }, 351 "default_pass", 0, 0xffffffff, 352 stsizeof(ipf_main_softc_t, ipf_pass), 353 0, NULL, NULL }, 354 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpidletimeout) }, 355 "tcp_idle_timeout", 1, 0x7fffffff, 356 stsizeof(ipf_main_softc_t, ipf_tcpidletimeout), 357 0, NULL, ipf_settimeout }, 358 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpclosewait) }, 359 "tcp_close_wait", 1, 0x7fffffff, 360 stsizeof(ipf_main_softc_t, ipf_tcpclosewait), 361 0, NULL, ipf_settimeout }, 362 { { (void *)offsetof(ipf_main_softc_t, ipf_tcplastack) }, 363 "tcp_last_ack", 1, 0x7fffffff, 364 stsizeof(ipf_main_softc_t, ipf_tcplastack), 365 0, NULL, ipf_settimeout }, 366 { { (void *)offsetof(ipf_main_softc_t, ipf_tcptimeout) }, 367 "tcp_timeout", 1, 0x7fffffff, 368 stsizeof(ipf_main_softc_t, ipf_tcptimeout), 369 0, NULL, ipf_settimeout }, 370 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpsynsent) }, 371 "tcp_syn_sent", 1, 0x7fffffff, 372 stsizeof(ipf_main_softc_t, ipf_tcpsynsent), 373 0, NULL, ipf_settimeout }, 374 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpsynrecv) }, 375 "tcp_syn_received", 1, 0x7fffffff, 376 stsizeof(ipf_main_softc_t, ipf_tcpsynrecv), 377 0, NULL, ipf_settimeout }, 378 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpclosed) }, 379 "tcp_closed", 1, 0x7fffffff, 380 stsizeof(ipf_main_softc_t, ipf_tcpclosed), 381 0, NULL, ipf_settimeout }, 382 { { (void *)offsetof(ipf_main_softc_t, ipf_tcphalfclosed) }, 383 "tcp_half_closed", 1, 0x7fffffff, 384 stsizeof(ipf_main_softc_t, ipf_tcphalfclosed), 385 0, NULL, ipf_settimeout }, 386 { { (void *)offsetof(ipf_main_softc_t, ipf_tcptimewait) }, 387 "tcp_time_wait", 1, 0x7fffffff, 388 stsizeof(ipf_main_softc_t, ipf_tcptimewait), 389 0, NULL, ipf_settimeout }, 390 { { (void *)offsetof(ipf_main_softc_t, ipf_udptimeout) }, 391 "udp_timeout", 1, 0x7fffffff, 392 stsizeof(ipf_main_softc_t, ipf_udptimeout), 393 0, NULL, ipf_settimeout }, 394 { { (void *)offsetof(ipf_main_softc_t, ipf_udpacktimeout) }, 395 "udp_ack_timeout", 1, 0x7fffffff, 396 stsizeof(ipf_main_softc_t, ipf_udpacktimeout), 397 0, NULL, ipf_settimeout }, 398 { { (void *)offsetof(ipf_main_softc_t, ipf_icmptimeout) }, 399 "icmp_timeout", 1, 0x7fffffff, 400 stsizeof(ipf_main_softc_t, ipf_icmptimeout), 401 0, NULL, ipf_settimeout }, 402 { { (void *)offsetof(ipf_main_softc_t, ipf_icmpacktimeout) }, 403 "icmp_ack_timeout", 1, 0x7fffffff, 404 stsizeof(ipf_main_softc_t, ipf_icmpacktimeout), 405 0, NULL, ipf_settimeout }, 406 { { (void *)offsetof(ipf_main_softc_t, ipf_iptimeout) }, 407 "ip_timeout", 1, 0x7fffffff, 408 stsizeof(ipf_main_softc_t, ipf_iptimeout), 409 0, NULL, ipf_settimeout }, 410#if defined(INSTANCES) && defined(_KERNEL) 411 { { (void *)offsetof(ipf_main_softc_t, ipf_get_loopback) }, 412 "intercept_loopback", 0, 1, 413 stsizeof(ipf_main_softc_t, ipf_get_loopback), 414 0, NULL, ipf_set_loopback }, 415#endif 416 { { 0 }, 417 NULL, 0, 0, 418 0, 419 0, NULL, NULL } 420}; 421 422 423/* 424 * The next section of code is a a collection of small routines that set 425 * fields in the fr_info_t structure passed based on properties of the 426 * current packet. There are different routines for the same protocol 427 * for each of IPv4 and IPv6. Adding a new protocol, for which there 428 * will "special" inspection for setup, is now more easily done by adding 429 * a new routine and expanding the ipf_pr_ipinit*() function rather than by 430 * adding more code to a growing switch statement. 431 */ 432#ifdef USE_INET6 433static INLINE int ipf_pr_ah6 __P((fr_info_t *)); 434static INLINE void ipf_pr_esp6 __P((fr_info_t *)); 435static INLINE void ipf_pr_gre6 __P((fr_info_t *)); 436static INLINE void ipf_pr_udp6 __P((fr_info_t *)); 437static INLINE void ipf_pr_tcp6 __P((fr_info_t *)); 438static INLINE void ipf_pr_icmp6 __P((fr_info_t *)); 439static INLINE void ipf_pr_ipv6hdr __P((fr_info_t *)); 440static INLINE void ipf_pr_short6 __P((fr_info_t *, int)); 441static INLINE int ipf_pr_hopopts6 __P((fr_info_t *)); 442static INLINE int ipf_pr_mobility6 __P((fr_info_t *)); 443static INLINE int ipf_pr_routing6 __P((fr_info_t *)); 444static INLINE int ipf_pr_dstopts6 __P((fr_info_t *)); 445static INLINE int ipf_pr_fragment6 __P((fr_info_t *)); 446static INLINE struct ip6_ext *ipf_pr_ipv6exthdr __P((fr_info_t *, int, int)); 447 448 449/* ------------------------------------------------------------------------ */ 450/* Function: ipf_pr_short6 */ 451/* Returns: void */ 452/* Parameters: fin(I) - pointer to packet information */ 453/* xmin(I) - minimum header size */ 454/* */ 455/* IPv6 Only */ 456/* This is function enforces the 'is a packet too short to be legit' rule */ 457/* for IPv6 and marks the packet with FI_SHORT if so. See function comment */ 458/* for ipf_pr_short() for more details. */ 459/* ------------------------------------------------------------------------ */ 460static INLINE void 461ipf_pr_short6(fin, xmin) 462 fr_info_t *fin; 463 int xmin; 464{ 465 466 if (fin->fin_dlen < xmin) 467 fin->fin_flx |= FI_SHORT; 468} 469 470 471/* ------------------------------------------------------------------------ */ 472/* Function: ipf_pr_ipv6hdr */ 473/* Returns: void */ 474/* Parameters: fin(I) - pointer to packet information */ 475/* */ 476/* IPv6 Only */ 477/* Copy values from the IPv6 header into the fr_info_t struct and call the */ 478/* per-protocol analyzer if it exists. In validating the packet, a protocol*/ 479/* analyzer may pullup or free the packet itself so we need to be vigiliant */ 480/* of that possibility arising. */ 481/* ------------------------------------------------------------------------ */ 482static INLINE void 483ipf_pr_ipv6hdr(fin) 484 fr_info_t *fin; 485{ 486 ip6_t *ip6 = (ip6_t *)fin->fin_ip; 487 int p, go = 1, i, hdrcount; 488 fr_ip_t *fi = &fin->fin_fi; 489 490 fin->fin_off = 0; 491 492 fi->fi_tos = 0; 493 fi->fi_optmsk = 0; 494 fi->fi_secmsk = 0; 495 fi->fi_auth = 0; 496 497 p = ip6->ip6_nxt; 498 fin->fin_crc = p; 499 fi->fi_ttl = ip6->ip6_hlim; 500 fi->fi_src.in6 = ip6->ip6_src; 501 fin->fin_crc += fi->fi_src.i6[0]; 502 fin->fin_crc += fi->fi_src.i6[1]; 503 fin->fin_crc += fi->fi_src.i6[2]; 504 fin->fin_crc += fi->fi_src.i6[3]; 505 fi->fi_dst.in6 = ip6->ip6_dst; 506 fin->fin_crc += fi->fi_dst.i6[0]; 507 fin->fin_crc += fi->fi_dst.i6[1]; 508 fin->fin_crc += fi->fi_dst.i6[2]; 509 fin->fin_crc += fi->fi_dst.i6[3]; 510 fin->fin_id = 0; 511 if (IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6)) 512 fin->fin_flx |= FI_MULTICAST|FI_MBCAST; 513 514 hdrcount = 0; 515 while (go && !(fin->fin_flx & FI_SHORT)) { 516 switch (p) 517 { 518 case IPPROTO_UDP : 519 ipf_pr_udp6(fin); 520 go = 0; 521 break; 522 523 case IPPROTO_TCP : 524 ipf_pr_tcp6(fin); 525 go = 0; 526 break; 527 528 case IPPROTO_ICMPV6 : 529 ipf_pr_icmp6(fin); 530 go = 0; 531 break; 532 533 case IPPROTO_GRE : 534 ipf_pr_gre6(fin); 535 go = 0; 536 break; 537 538 case IPPROTO_HOPOPTS : 539 p = ipf_pr_hopopts6(fin); 540 break; 541 542 case IPPROTO_MOBILITY : 543 p = ipf_pr_mobility6(fin); 544 break; 545 546 case IPPROTO_DSTOPTS : 547 p = ipf_pr_dstopts6(fin); 548 break; 549 550 case IPPROTO_ROUTING : 551 p = ipf_pr_routing6(fin); 552 break; 553 554 case IPPROTO_AH : 555 p = ipf_pr_ah6(fin); 556 break; 557 558 case IPPROTO_ESP : 559 ipf_pr_esp6(fin); 560 go = 0; 561 break; 562 563 case IPPROTO_IPV6 : 564 for (i = 0; ip6exthdr[i].ol_bit != 0; i++) 565 if (ip6exthdr[i].ol_val == p) { 566 fin->fin_flx |= ip6exthdr[i].ol_bit; 567 break; 568 } 569 go = 0; 570 break; 571 572 case IPPROTO_NONE : 573 go = 0; 574 break; 575 576 case IPPROTO_FRAGMENT : 577 p = ipf_pr_fragment6(fin); 578 /* 579 * Given that the only fragments we want to let through 580 * (where fin_off != 0) are those where the non-first 581 * fragments only have data, we can safely stop looking 582 * at headers if this is a non-leading fragment. 583 */ 584 if (fin->fin_off != 0) 585 go = 0; 586 break; 587 588 default : 589 go = 0; 590 break; 591 } 592 hdrcount++; 593 594 /* 595 * It is important to note that at this point, for the 596 * extension headers (go != 0), the entire header may not have 597 * been pulled up when the code gets to this point. This is 598 * only done for "go != 0" because the other header handlers 599 * will all pullup their complete header. The other indicator 600 * of an incomplete packet is that this was just an extension 601 * header. 602 */ 603 if ((go != 0) && (p != IPPROTO_NONE) && 604 (ipf_pr_pullup(fin, 0) == -1)) { 605 p = IPPROTO_NONE; 606 break; 607 } 608 } 609 610 /* 611 * Some of the above functions, like ipf_pr_esp6(), can call ipf_pullup 612 * and destroy whatever packet was here. The caller of this function 613 * expects us to return if there is a problem with ipf_pullup. 614 */ 615 if (fin->fin_m == NULL) { 616 ipf_main_softc_t *softc = fin->fin_main_soft; 617 618 LBUMPD(ipf_stats[fin->fin_out], fr_v6_bad); 619 return; 620 } 621 622 fi->fi_p = p; 623 624 /* 625 * IPv6 fragment case 1 - see comment for ipf_pr_fragment6(). 626 * "go != 0" imples the above loop hasn't arrived at a layer 4 header. 627 */ 628 if ((go != 0) && (fin->fin_flx & FI_FRAG) && (fin->fin_off == 0)) { 629 ipf_main_softc_t *softc = fin->fin_main_soft; 630 631 fin->fin_flx |= FI_BAD; 632 LBUMPD(ipf_stats[fin->fin_out], fr_v6_badfrag); 633 LBUMP(ipf_stats[fin->fin_out].fr_v6_bad); 634 } 635} 636 637 638/* ------------------------------------------------------------------------ */ 639/* Function: ipf_pr_ipv6exthdr */ 640/* Returns: struct ip6_ext * - pointer to the start of the next header */ 641/* or NULL if there is a prolblem. */ 642/* Parameters: fin(I) - pointer to packet information */ 643/* multiple(I) - flag indicating yes/no if multiple occurances */ 644/* of this extension header are allowed. */ 645/* proto(I) - protocol number for this extension header */ 646/* */ 647/* IPv6 Only */ 648/* This function embodies a number of common checks that all IPv6 extension */ 649/* headers must be subjected to. For example, making sure the packet is */ 650/* big enough for it to be in, checking if it is repeated and setting a */ 651/* flag to indicate its presence. */ 652/* ------------------------------------------------------------------------ */ 653static INLINE struct ip6_ext * 654ipf_pr_ipv6exthdr(fin, multiple, proto) 655 fr_info_t *fin; 656 int multiple, proto; 657{ 658 ipf_main_softc_t *softc = fin->fin_main_soft; 659 struct ip6_ext *hdr; 660 u_short shift; 661 int i; 662 663 fin->fin_flx |= FI_V6EXTHDR; 664 665 /* 8 is default length of extension hdr */ 666 if ((fin->fin_dlen - 8) < 0) { 667 fin->fin_flx |= FI_SHORT; 668 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_short); 669 return NULL; 670 } 671 672 if (ipf_pr_pullup(fin, 8) == -1) { 673 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_pullup); 674 return NULL; 675 } 676 677 hdr = fin->fin_dp; 678 switch (proto) 679 { 680 case IPPROTO_FRAGMENT : 681 shift = 8; 682 break; 683 default : 684 shift = 8 + (hdr->ip6e_len << 3); 685 break; 686 } 687 688 if (shift > fin->fin_dlen) { /* Nasty extension header length? */ 689 fin->fin_flx |= FI_BAD; 690 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_hlen); 691 return NULL; 692 } 693 694 fin->fin_dp = (char *)fin->fin_dp + shift; 695 fin->fin_dlen -= shift; 696 697 /* 698 * If we have seen a fragment header, do not set any flags to indicate 699 * the presence of this extension header as it has no impact on the 700 * end result until after it has been defragmented. 701 */ 702 if (fin->fin_flx & FI_FRAG) 703 return hdr; 704 705 for (i = 0; ip6exthdr[i].ol_bit != 0; i++) 706 if (ip6exthdr[i].ol_val == proto) { 707 /* 708 * Most IPv6 extension headers are only allowed once. 709 */ 710 if ((multiple == 0) && 711 ((fin->fin_optmsk & ip6exthdr[i].ol_bit) != 0)) 712 fin->fin_flx |= FI_BAD; 713 else 714 fin->fin_optmsk |= ip6exthdr[i].ol_bit; 715 break; 716 } 717 718 return hdr; 719} 720 721 722/* ------------------------------------------------------------------------ */ 723/* Function: ipf_pr_hopopts6 */ 724/* Returns: int - value of the next header or IPPROTO_NONE if error */ 725/* Parameters: fin(I) - pointer to packet information */ 726/* */ 727/* IPv6 Only */ 728/* This is function checks pending hop by hop options extension header */ 729/* ------------------------------------------------------------------------ */ 730static INLINE int 731ipf_pr_hopopts6(fin) 732 fr_info_t *fin; 733{ 734 struct ip6_ext *hdr; 735 736 hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_HOPOPTS); 737 if (hdr == NULL) 738 return IPPROTO_NONE; 739 return hdr->ip6e_nxt; 740} 741 742 743/* ------------------------------------------------------------------------ */ 744/* Function: ipf_pr_mobility6 */ 745/* Returns: int - value of the next header or IPPROTO_NONE if error */ 746/* Parameters: fin(I) - pointer to packet information */ 747/* */ 748/* IPv6 Only */ 749/* This is function checks the IPv6 mobility extension header */ 750/* ------------------------------------------------------------------------ */ 751static INLINE int 752ipf_pr_mobility6(fin) 753 fr_info_t *fin; 754{ 755 struct ip6_ext *hdr; 756 757 hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_MOBILITY); 758 if (hdr == NULL) 759 return IPPROTO_NONE; 760 return hdr->ip6e_nxt; 761} 762 763 764/* ------------------------------------------------------------------------ */ 765/* Function: ipf_pr_routing6 */ 766/* Returns: int - value of the next header or IPPROTO_NONE if error */ 767/* Parameters: fin(I) - pointer to packet information */ 768/* */ 769/* IPv6 Only */ 770/* This is function checks pending routing extension header */ 771/* ------------------------------------------------------------------------ */ 772static INLINE int 773ipf_pr_routing6(fin) 774 fr_info_t *fin; 775{ 776 struct ip6_routing *hdr; 777 778 hdr = (struct ip6_routing *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_ROUTING); 779 if (hdr == NULL) 780 return IPPROTO_NONE; 781 782 switch (hdr->ip6r_type) 783 { 784 case 0 : 785 /* 786 * Nasty extension header length? 787 */ 788 if (((hdr->ip6r_len >> 1) < hdr->ip6r_segleft) || 789 (hdr->ip6r_segleft && (hdr->ip6r_len & 1))) { 790 ipf_main_softc_t *softc = fin->fin_main_soft; 791 792 fin->fin_flx |= FI_BAD; 793 LBUMPD(ipf_stats[fin->fin_out], fr_v6_rh_bad); 794 return IPPROTO_NONE; 795 } 796 break; 797 798 default : 799 break; 800 } 801 802 return hdr->ip6r_nxt; 803} 804 805 806/* ------------------------------------------------------------------------ */ 807/* Function: ipf_pr_fragment6 */ 808/* Returns: int - value of the next header or IPPROTO_NONE if error */ 809/* Parameters: fin(I) - pointer to packet information */ 810/* */ 811/* IPv6 Only */ 812/* Examine the IPv6 fragment header and extract fragment offset information.*/ 813/* */ 814/* Fragments in IPv6 are extraordinarily difficult to deal with - much more */ 815/* so than in IPv4. There are 5 cases of fragments with IPv6 that all */ 816/* packets with a fragment header can fit into. They are as follows: */ 817/* */ 818/* 1. [IPv6][0-n EH][FH][0-n EH] (no L4HDR present) */ 819/* 2. [IPV6][0-n EH][FH][0-n EH][L4HDR part] (short) */ 820/* 3. [IPV6][0-n EH][FH][L4HDR part][0-n data] (short) */ 821/* 4. [IPV6][0-n EH][FH][0-n EH][L4HDR][0-n data] */ 822/* 5. [IPV6][0-n EH][FH][data] */ 823/* */ 824/* IPV6 = IPv6 header, FH = Fragment Header, */ 825/* 0-n EH = 0 or more extension headers, 0-n data = 0 or more bytes of data */ 826/* */ 827/* Packets that match 1, 2, 3 will be dropped as the only reasonable */ 828/* scenario in which they happen is in extreme circumstances that are most */ 829/* likely to be an indication of an attack rather than normal traffic. */ 830/* A type 3 packet may be sent by an attacked after a type 4 packet. There */ 831/* are two rules that can be used to guard against type 3 packets: L4 */ 832/* headers must always be in a packet that has the offset field set to 0 */ 833/* and no packet is allowed to overlay that where offset = 0. */ 834/* ------------------------------------------------------------------------ */ 835static INLINE int 836ipf_pr_fragment6(fin) 837 fr_info_t *fin; 838{ 839 ipf_main_softc_t *softc = fin->fin_main_soft; 840 struct ip6_frag *frag; 841 842 fin->fin_flx |= FI_FRAG; 843 844 frag = (struct ip6_frag *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_FRAGMENT); 845 if (frag == NULL) { 846 LBUMPD(ipf_stats[fin->fin_out], fr_v6_frag_bad); 847 return IPPROTO_NONE; 848 } 849 850 if ((frag->ip6f_offlg & IP6F_MORE_FRAG) != 0) { 851 /* 852 * Any fragment that isn't the last fragment must have its 853 * length as a multiple of 8. 854 */ 855 if ((fin->fin_plen & 7) != 0) 856 fin->fin_flx |= FI_BAD; 857 } 858 859 fin->fin_fraghdr = frag; 860 fin->fin_id = frag->ip6f_ident; 861 fin->fin_off = ntohs(frag->ip6f_offlg & IP6F_OFF_MASK); 862 if (fin->fin_off != 0) 863 fin->fin_flx |= FI_FRAGBODY; 864 865 /* 866 * Jumbograms aren't handled, so the max. length is 64k 867 */ 868 if ((fin->fin_off << 3) + fin->fin_dlen > 65535) 869 fin->fin_flx |= FI_BAD; 870 871 /* 872 * We don't know where the transport layer header (or whatever is next 873 * is), as it could be behind destination options (amongst others) so 874 * return the fragment header as the type of packet this is. Note that 875 * this effectively disables the fragment cache for > 1 protocol at a 876 * time. 877 */ 878 return frag->ip6f_nxt; 879} 880 881 882/* ------------------------------------------------------------------------ */ 883/* Function: ipf_pr_dstopts6 */ 884/* Returns: int - value of the next header or IPPROTO_NONE if error */ 885/* Parameters: fin(I) - pointer to packet information */ 886/* */ 887/* IPv6 Only */ 888/* This is function checks pending destination options extension header */ 889/* ------------------------------------------------------------------------ */ 890static INLINE int 891ipf_pr_dstopts6(fin) 892 fr_info_t *fin; 893{ 894 ipf_main_softc_t *softc = fin->fin_main_soft; 895 struct ip6_ext *hdr; 896 897 hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_DSTOPTS); 898 if (hdr == NULL) { 899 LBUMPD(ipf_stats[fin->fin_out], fr_v6_dst_bad); 900 return IPPROTO_NONE; 901 } 902 return hdr->ip6e_nxt; 903} 904 905 906/* ------------------------------------------------------------------------ */ 907/* Function: ipf_pr_icmp6 */ 908/* Returns: void */ 909/* Parameters: fin(I) - pointer to packet information */ 910/* */ 911/* IPv6 Only */ 912/* This routine is mainly concerned with determining the minimum valid size */ 913/* for an ICMPv6 packet. */ 914/* ------------------------------------------------------------------------ */ 915static INLINE void 916ipf_pr_icmp6(fin) 917 fr_info_t *fin; 918{ 919 int minicmpsz = sizeof(struct icmp6_hdr); 920 struct icmp6_hdr *icmp6; 921 922 if (ipf_pr_pullup(fin, ICMP6ERR_MINPKTLEN - sizeof(ip6_t)) == -1) { 923 ipf_main_softc_t *softc = fin->fin_main_soft; 924 925 LBUMPD(ipf_stats[fin->fin_out], fr_v6_icmp6_pullup); 926 return; 927 } 928 929 if (fin->fin_dlen > 1) { 930 ip6_t *ip6; 931 932 icmp6 = fin->fin_dp; 933 934 fin->fin_data[0] = *(u_short *)icmp6; 935 936 if ((icmp6->icmp6_type & ICMP6_INFOMSG_MASK) != 0) 937 fin->fin_flx |= FI_ICMPQUERY; 938 939 switch (icmp6->icmp6_type) 940 { 941 case ICMP6_ECHO_REPLY : 942 case ICMP6_ECHO_REQUEST : 943 if (fin->fin_dlen >= 6) 944 fin->fin_data[1] = icmp6->icmp6_id; 945 minicmpsz = ICMP6ERR_MINPKTLEN - sizeof(ip6_t); 946 break; 947 948 case ICMP6_DST_UNREACH : 949 case ICMP6_PACKET_TOO_BIG : 950 case ICMP6_TIME_EXCEEDED : 951 case ICMP6_PARAM_PROB : 952 fin->fin_flx |= FI_ICMPERR; 953 minicmpsz = ICMP6ERR_IPICMPHLEN - sizeof(ip6_t); 954 if (fin->fin_plen < ICMP6ERR_IPICMPHLEN) 955 break; 956 957 if (M_LEN(fin->fin_m) < fin->fin_plen) { 958 if (ipf_coalesce(fin) != 1) 959 return; 960 } 961 962 if (ipf_pr_pullup(fin, ICMP6ERR_MINPKTLEN) == -1) 963 return; 964 965 /* 966 * If the destination of this packet doesn't match the 967 * source of the original packet then this packet is 968 * not correct. 969 */ 970 icmp6 = fin->fin_dp; 971 ip6 = (ip6_t *)((char *)icmp6 + ICMPERR_ICMPHLEN); 972 if (IP6_NEQ(&fin->fin_fi.fi_dst, 973 (i6addr_t *)&ip6->ip6_src)) 974 fin->fin_flx |= FI_BAD; 975 break; 976 default : 977 break; 978 } 979 } 980 981 ipf_pr_short6(fin, minicmpsz); 982 if ((fin->fin_flx & (FI_SHORT|FI_BAD)) == 0) { 983 u_char p = fin->fin_p; 984 985 fin->fin_p = IPPROTO_ICMPV6; 986 ipf_checkv6sum(fin); 987 fin->fin_p = p; 988 } 989} 990 991 992/* ------------------------------------------------------------------------ */ 993/* Function: ipf_pr_udp6 */ 994/* Returns: void */ 995/* Parameters: fin(I) - pointer to packet information */ 996/* */ 997/* IPv6 Only */ 998/* Analyse the packet for IPv6/UDP properties. */ 999/* Is not expected to be called for fragmented packets. */ 1000/* ------------------------------------------------------------------------ */ 1001static INLINE void 1002ipf_pr_udp6(fin) 1003 fr_info_t *fin; 1004{ 1005 1006 if (ipf_pr_udpcommon(fin) == 0) { 1007 u_char p = fin->fin_p; 1008 1009 fin->fin_p = IPPROTO_UDP; 1010 ipf_checkv6sum(fin); 1011 fin->fin_p = p; 1012 } 1013} 1014 1015 1016/* ------------------------------------------------------------------------ */ 1017/* Function: ipf_pr_tcp6 */ 1018/* Returns: void */ 1019/* Parameters: fin(I) - pointer to packet information */ 1020/* */ 1021/* IPv6 Only */ 1022/* Analyse the packet for IPv6/TCP properties. */ 1023/* Is not expected to be called for fragmented packets. */ 1024/* ------------------------------------------------------------------------ */ 1025static INLINE void 1026ipf_pr_tcp6(fin) 1027 fr_info_t *fin; 1028{ 1029 1030 if (ipf_pr_tcpcommon(fin) == 0) { 1031 u_char p = fin->fin_p; 1032 1033 fin->fin_p = IPPROTO_TCP; 1034 ipf_checkv6sum(fin); 1035 fin->fin_p = p; 1036 } 1037} 1038 1039 1040/* ------------------------------------------------------------------------ */ 1041/* Function: ipf_pr_esp6 */ 1042/* Returns: void */ 1043/* Parameters: fin(I) - pointer to packet information */ 1044/* */ 1045/* IPv6 Only */ 1046/* Analyse the packet for ESP properties. */ 1047/* The minimum length is taken to be the SPI (32bits) plus a tail (32bits) */ 1048/* even though the newer ESP packets must also have a sequence number that */ 1049/* is 32bits as well, it is not possible(?) to determine the version from a */ 1050/* simple packet header. */ 1051/* ------------------------------------------------------------------------ */ 1052static INLINE void 1053ipf_pr_esp6(fin) 1054 fr_info_t *fin; 1055{ 1056 1057 if ((fin->fin_off == 0) && (ipf_pr_pullup(fin, 8) == -1)) { 1058 ipf_main_softc_t *softc = fin->fin_main_soft; 1059 1060 LBUMPD(ipf_stats[fin->fin_out], fr_v6_esp_pullup); 1061 return; 1062 } 1063} 1064 1065 1066/* ------------------------------------------------------------------------ */ 1067/* Function: ipf_pr_ah6 */ 1068/* Returns: int - value of the next header or IPPROTO_NONE if error */ 1069/* Parameters: fin(I) - pointer to packet information */ 1070/* */ 1071/* IPv6 Only */ 1072/* Analyse the packet for AH properties. */ 1073/* The minimum length is taken to be the combination of all fields in the */ 1074/* header being present and no authentication data (null algorithm used.) */ 1075/* ------------------------------------------------------------------------ */ 1076static INLINE int 1077ipf_pr_ah6(fin) 1078 fr_info_t *fin; 1079{ 1080 authhdr_t *ah; 1081 1082 fin->fin_flx |= FI_AH; 1083 1084 ah = (authhdr_t *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_HOPOPTS); 1085 if (ah == NULL) { 1086 ipf_main_softc_t *softc = fin->fin_main_soft; 1087 1088 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ah_bad); 1089 return IPPROTO_NONE; 1090 } 1091 1092 ipf_pr_short6(fin, sizeof(*ah)); 1093 1094 /* 1095 * No need for another pullup, ipf_pr_ipv6exthdr() will pullup 1096 * enough data to satisfy ah_next (the very first one.) 1097 */ 1098 return ah->ah_next; 1099} 1100 1101 1102/* ------------------------------------------------------------------------ */ 1103/* Function: ipf_pr_gre6 */ 1104/* Returns: void */ 1105/* Parameters: fin(I) - pointer to packet information */ 1106/* */ 1107/* Analyse the packet for GRE properties. */ 1108/* ------------------------------------------------------------------------ */ 1109static INLINE void 1110ipf_pr_gre6(fin) 1111 fr_info_t *fin; 1112{ 1113 grehdr_t *gre; 1114 1115 if (ipf_pr_pullup(fin, sizeof(grehdr_t)) == -1) { 1116 ipf_main_softc_t *softc = fin->fin_main_soft; 1117 1118 LBUMPD(ipf_stats[fin->fin_out], fr_v6_gre_pullup); 1119 return; 1120 } 1121 1122 gre = fin->fin_dp; 1123 if (GRE_REV(gre->gr_flags) == 1) 1124 fin->fin_data[0] = gre->gr_call; 1125} 1126#endif /* USE_INET6 */ 1127 1128 1129/* ------------------------------------------------------------------------ */ 1130/* Function: ipf_pr_pullup */ 1131/* Returns: int - 0 == pullup succeeded, -1 == failure */ 1132/* Parameters: fin(I) - pointer to packet information */ 1133/* plen(I) - length (excluding L3 header) to pullup */ 1134/* */ 1135/* Short inline function to cut down on code duplication to perform a call */ 1136/* to ipf_pullup to ensure there is the required amount of data, */ 1137/* consecutively in the packet buffer. */ 1138/* */ 1139/* This function pulls up 'extra' data at the location of fin_dp. fin_dp */ 1140/* points to the first byte after the complete layer 3 header, which will */ 1141/* include all of the known extension headers for IPv6 or options for IPv4. */ 1142/* */ 1143/* Since fr_pullup() expects the total length of bytes to be pulled up, it */ 1144/* is necessary to add those we can already assume to be pulled up (fin_dp */ 1145/* - fin_ip) to what is passed through. */ 1146/* ------------------------------------------------------------------------ */ 1147int 1148ipf_pr_pullup(fin, plen) 1149 fr_info_t *fin; 1150 int plen; 1151{ 1152 ipf_main_softc_t *softc = fin->fin_main_soft; 1153 1154 if (fin->fin_m != NULL) { 1155 if (fin->fin_dp != NULL) 1156 plen += (char *)fin->fin_dp - 1157 ((char *)fin->fin_ip + fin->fin_hlen); 1158 plen += fin->fin_hlen; 1159 if (M_LEN(fin->fin_m) < plen + fin->fin_ipoff) { 1160#if defined(_KERNEL) 1161 if (ipf_pullup(fin->fin_m, fin, plen) == NULL) { 1162 DT(ipf_pullup_fail); 1163 LBUMP(ipf_stats[fin->fin_out].fr_pull[1]); 1164 return -1; 1165 } 1166 LBUMP(ipf_stats[fin->fin_out].fr_pull[0]); 1167#else 1168 LBUMP(ipf_stats[fin->fin_out].fr_pull[1]); 1169 /* 1170 * Fake ipf_pullup failing 1171 */ 1172 fin->fin_reason = FRB_PULLUP; 1173 *fin->fin_mp = NULL; 1174 fin->fin_m = NULL; 1175 fin->fin_ip = NULL; 1176 return -1; 1177#endif 1178 } 1179 } 1180 return 0; 1181} 1182 1183 1184/* ------------------------------------------------------------------------ */ 1185/* Function: ipf_pr_short */ 1186/* Returns: void */ 1187/* Parameters: fin(I) - pointer to packet information */ 1188/* xmin(I) - minimum header size */ 1189/* */ 1190/* Check if a packet is "short" as defined by xmin. The rule we are */ 1191/* applying here is that the packet must not be fragmented within the layer */ 1192/* 4 header. That is, it must not be a fragment that has its offset set to */ 1193/* start within the layer 4 header (hdrmin) or if it is at offset 0, the */ 1194/* entire layer 4 header must be present (min). */ 1195/* ------------------------------------------------------------------------ */ 1196static INLINE void 1197ipf_pr_short(fin, xmin) 1198 fr_info_t *fin; 1199 int xmin; 1200{ 1201 1202 if (fin->fin_off == 0) { 1203 if (fin->fin_dlen < xmin) 1204 fin->fin_flx |= FI_SHORT; 1205 } else if (fin->fin_off < xmin) { 1206 fin->fin_flx |= FI_SHORT; 1207 } 1208} 1209 1210 1211/* ------------------------------------------------------------------------ */ 1212/* Function: ipf_pr_icmp */ 1213/* Returns: void */ 1214/* Parameters: fin(I) - pointer to packet information */ 1215/* */ 1216/* IPv4 Only */ 1217/* Do a sanity check on the packet for ICMP (v4). In nearly all cases, */ 1218/* except extrememly bad packets, both type and code will be present. */ 1219/* The expected minimum size of an ICMP packet is very much dependent on */ 1220/* the type of it. */ 1221/* */ 1222/* XXX - other ICMP sanity checks? */ 1223/* ------------------------------------------------------------------------ */ 1224static INLINE void 1225ipf_pr_icmp(fin) 1226 fr_info_t *fin; 1227{ 1228 ipf_main_softc_t *softc = fin->fin_main_soft; 1229 int minicmpsz = sizeof(struct icmp); 1230 icmphdr_t *icmp; 1231 ip_t *oip; 1232 1233 ipf_pr_short(fin, ICMPERR_ICMPHLEN); 1234 1235 if (fin->fin_off != 0) { 1236 LBUMPD(ipf_stats[fin->fin_out], fr_v4_icmp_frag); 1237 return; 1238 } 1239 1240 if (ipf_pr_pullup(fin, ICMPERR_ICMPHLEN) == -1) { 1241 LBUMPD(ipf_stats[fin->fin_out], fr_v4_icmp_pullup); 1242 return; 1243 } 1244 1245 icmp = fin->fin_dp; 1246 1247 fin->fin_data[0] = *(u_short *)icmp; 1248 fin->fin_data[1] = icmp->icmp_id; 1249 1250 switch (icmp->icmp_type) 1251 { 1252 case ICMP_ECHOREPLY : 1253 case ICMP_ECHO : 1254 /* Router discovery messaes - RFC 1256 */ 1255 case ICMP_ROUTERADVERT : 1256 case ICMP_ROUTERSOLICIT : 1257 fin->fin_flx |= FI_ICMPQUERY; 1258 minicmpsz = ICMP_MINLEN; 1259 break; 1260 /* 1261 * type(1) + code(1) + cksum(2) + id(2) seq(2) + 1262 * 3 * timestamp(3 * 4) 1263 */ 1264 case ICMP_TSTAMP : 1265 case ICMP_TSTAMPREPLY : 1266 fin->fin_flx |= FI_ICMPQUERY; 1267 minicmpsz = 20; 1268 break; 1269 /* 1270 * type(1) + code(1) + cksum(2) + id(2) seq(2) + 1271 * mask(4) 1272 */ 1273 case ICMP_IREQ : 1274 case ICMP_IREQREPLY : 1275 case ICMP_MASKREQ : 1276 case ICMP_MASKREPLY : 1277 fin->fin_flx |= FI_ICMPQUERY; 1278 minicmpsz = 12; 1279 break; 1280 /* 1281 * type(1) + code(1) + cksum(2) + id(2) seq(2) + ip(20+) 1282 */ 1283 case ICMP_UNREACH : 1284#ifdef icmp_nextmtu 1285 if (icmp->icmp_code == ICMP_UNREACH_NEEDFRAG) { 1286 if (icmp->icmp_nextmtu < softc->ipf_icmpminfragmtu) 1287 fin->fin_flx |= FI_BAD; 1288 } 1289#endif 1290 /* FALLTHROUGH */ 1291 case ICMP_SOURCEQUENCH : 1292 case ICMP_REDIRECT : 1293 case ICMP_TIMXCEED : 1294 case ICMP_PARAMPROB : 1295 fin->fin_flx |= FI_ICMPERR; 1296 if (ipf_coalesce(fin) != 1) { 1297 LBUMPD(ipf_stats[fin->fin_out], fr_icmp_coalesce); 1298 return; 1299 } 1300 1301 /* 1302 * ICMP error packets should not be generated for IP 1303 * packets that are a fragment that isn't the first 1304 * fragment. 1305 */ 1306 oip = (ip_t *)((char *)fin->fin_dp + ICMPERR_ICMPHLEN); 1307 if ((ntohs(oip->ip_off) & IP_OFFMASK) != 0) 1308 fin->fin_flx |= FI_BAD; 1309 1310 /* 1311 * If the destination of this packet doesn't match the 1312 * source of the original packet then this packet is 1313 * not correct. 1314 */ 1315 if (oip->ip_src.s_addr != fin->fin_daddr) 1316 fin->fin_flx |= FI_BAD; 1317 break; 1318 default : 1319 break; 1320 } 1321 1322 ipf_pr_short(fin, minicmpsz); 1323 1324 ipf_checkv4sum(fin); 1325} 1326 1327 1328/* ------------------------------------------------------------------------ */ 1329/* Function: ipf_pr_tcpcommon */ 1330/* Returns: int - 0 = header ok, 1 = bad packet, -1 = buffer error */ 1331/* Parameters: fin(I) - pointer to packet information */ 1332/* */ 1333/* TCP header sanity checking. Look for bad combinations of TCP flags, */ 1334/* and make some checks with how they interact with other fields. */ 1335/* If compiled with IPFILTER_CKSUM, check to see if the TCP checksum is */ 1336/* valid and mark the packet as bad if not. */ 1337/* ------------------------------------------------------------------------ */ 1338static INLINE int 1339ipf_pr_tcpcommon(fin) 1340 fr_info_t *fin; 1341{ 1342 ipf_main_softc_t *softc = fin->fin_main_soft; 1343 int flags, tlen; 1344 tcphdr_t *tcp; 1345 1346 fin->fin_flx |= FI_TCPUDP; 1347 if (fin->fin_off != 0) { 1348 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_frag); 1349 return 0; 1350 } 1351 1352 if (ipf_pr_pullup(fin, sizeof(*tcp)) == -1) { 1353 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_pullup); 1354 return -1; 1355 } 1356 1357 tcp = fin->fin_dp; 1358 if (fin->fin_dlen > 3) { 1359 fin->fin_sport = ntohs(tcp->th_sport); 1360 fin->fin_dport = ntohs(tcp->th_dport); 1361 } 1362 1363 if ((fin->fin_flx & FI_SHORT) != 0) { 1364 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_short); 1365 return 1; 1366 } 1367 1368 /* 1369 * Use of the TCP data offset *must* result in a value that is at 1370 * least the same size as the TCP header. 1371 */ 1372 tlen = TCP_OFF(tcp) << 2; 1373 if (tlen < sizeof(tcphdr_t)) { 1374 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_small); 1375 fin->fin_flx |= FI_BAD; 1376 return 1; 1377 } 1378 1379 flags = tcp->th_flags; 1380 fin->fin_tcpf = tcp->th_flags; 1381 1382 /* 1383 * If the urgent flag is set, then the urgent pointer must 1384 * also be set and vice versa. Good TCP packets do not have 1385 * just one of these set. 1386 */ 1387 if ((flags & TH_URG) != 0 && (tcp->th_urp == 0)) { 1388 fin->fin_flx |= FI_BAD; 1389#if 0 1390 } else if ((flags & TH_URG) == 0 && (tcp->th_urp != 0)) { 1391 /* 1392 * Ignore this case (#if 0) as it shows up in "real" 1393 * traffic with bogus values in the urgent pointer field. 1394 */ 1395 fin->fin_flx |= FI_BAD; 1396#endif 1397 } else if (((flags & (TH_SYN|TH_FIN)) != 0) && 1398 ((flags & (TH_RST|TH_ACK)) == TH_RST)) { 1399 /* TH_FIN|TH_RST|TH_ACK seems to appear "naturally" */ 1400 fin->fin_flx |= FI_BAD; 1401#if 1 1402 } else if (((flags & TH_SYN) != 0) && 1403 ((flags & (TH_URG|TH_PUSH)) != 0)) { 1404 /* 1405 * SYN with URG and PUSH set is not for normal TCP but it is 1406 * possible(?) with T/TCP...but who uses T/TCP? 1407 */ 1408 fin->fin_flx |= FI_BAD; 1409#endif 1410 } else if (!(flags & TH_ACK)) { 1411 /* 1412 * If the ack bit isn't set, then either the SYN or 1413 * RST bit must be set. If the SYN bit is set, then 1414 * we expect the ACK field to be 0. If the ACK is 1415 * not set and if URG, PSH or FIN are set, consdier 1416 * that to indicate a bad TCP packet. 1417 */ 1418 if ((flags == TH_SYN) && (tcp->th_ack != 0)) { 1419 /* 1420 * Cisco PIX sets the ACK field to a random value. 1421 * In light of this, do not set FI_BAD until a patch 1422 * is available from Cisco to ensure that 1423 * interoperability between existing systems is 1424 * achieved. 1425 */ 1426 /*fin->fin_flx |= FI_BAD*/; 1427 } else if (!(flags & (TH_RST|TH_SYN))) { 1428 fin->fin_flx |= FI_BAD; 1429 } else if ((flags & (TH_URG|TH_PUSH|TH_FIN)) != 0) { 1430 fin->fin_flx |= FI_BAD; 1431 } 1432 } 1433 if (fin->fin_flx & FI_BAD) { 1434 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_bad_flags); 1435 return 1; 1436 } 1437 1438 /* 1439 * At this point, it's not exactly clear what is to be gained by 1440 * marking up which TCP options are and are not present. The one we 1441 * are most interested in is the TCP window scale. This is only in 1442 * a SYN packet [RFC1323] so we don't need this here...? 1443 * Now if we were to analyse the header for passive fingerprinting, 1444 * then that might add some weight to adding this... 1445 */ 1446 if (tlen == sizeof(tcphdr_t)) { 1447 return 0; 1448 } 1449 1450 if (ipf_pr_pullup(fin, tlen) == -1) { 1451 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_pullup); 1452 return -1; 1453 } 1454 1455#if 0 1456 tcp = fin->fin_dp; 1457 ip = fin->fin_ip; 1458 s = (u_char *)(tcp + 1); 1459 off = IP_HL(ip) << 2; 1460# ifdef _KERNEL 1461 if (fin->fin_mp != NULL) { 1462 mb_t *m = *fin->fin_mp; 1463 1464 if (off + tlen > M_LEN(m)) 1465 return; 1466 } 1467# endif 1468 for (tlen -= (int)sizeof(*tcp); tlen > 0; ) { 1469 opt = *s; 1470 if (opt == '\0') 1471 break; 1472 else if (opt == TCPOPT_NOP) 1473 ol = 1; 1474 else { 1475 if (tlen < 2) 1476 break; 1477 ol = (int)*(s + 1); 1478 if (ol < 2 || ol > tlen) 1479 break; 1480 } 1481 1482 for (i = 9, mv = 4; mv >= 0; ) { 1483 op = ipopts + i; 1484 if (opt == (u_char)op->ol_val) { 1485 optmsk |= op->ol_bit; 1486 break; 1487 } 1488 } 1489 tlen -= ol; 1490 s += ol; 1491 } 1492#endif /* 0 */ 1493 1494 return 0; 1495} 1496 1497 1498 1499/* ------------------------------------------------------------------------ */ 1500/* Function: ipf_pr_udpcommon */ 1501/* Returns: int - 0 = header ok, 1 = bad packet */ 1502/* Parameters: fin(I) - pointer to packet information */ 1503/* */ 1504/* Extract the UDP source and destination ports, if present. If compiled */ 1505/* with IPFILTER_CKSUM, check to see if the UDP checksum is valid. */ 1506/* ------------------------------------------------------------------------ */ 1507static INLINE int 1508ipf_pr_udpcommon(fin) 1509 fr_info_t *fin; 1510{ 1511 udphdr_t *udp; 1512 1513 fin->fin_flx |= FI_TCPUDP; 1514 1515 if (!fin->fin_off && (fin->fin_dlen > 3)) { 1516 if (ipf_pr_pullup(fin, sizeof(*udp)) == -1) { 1517 ipf_main_softc_t *softc = fin->fin_main_soft; 1518 1519 fin->fin_flx |= FI_SHORT; 1520 LBUMPD(ipf_stats[fin->fin_out], fr_udp_pullup); 1521 return 1; 1522 } 1523 1524 udp = fin->fin_dp; 1525 1526 fin->fin_sport = ntohs(udp->uh_sport); 1527 fin->fin_dport = ntohs(udp->uh_dport); 1528 } 1529 1530 return 0; 1531} 1532 1533 1534/* ------------------------------------------------------------------------ */ 1535/* Function: ipf_pr_tcp */ 1536/* Returns: void */ 1537/* Parameters: fin(I) - pointer to packet information */ 1538/* */ 1539/* IPv4 Only */ 1540/* Analyse the packet for IPv4/TCP properties. */ 1541/* ------------------------------------------------------------------------ */ 1542static INLINE void 1543ipf_pr_tcp(fin) 1544 fr_info_t *fin; 1545{ 1546 1547 ipf_pr_short(fin, sizeof(tcphdr_t)); 1548 1549 if (ipf_pr_tcpcommon(fin) == 0) 1550 ipf_checkv4sum(fin); 1551} 1552 1553 1554/* ------------------------------------------------------------------------ */ 1555/* Function: ipf_pr_udp */ 1556/* Returns: void */ 1557/* Parameters: fin(I) - pointer to packet information */ 1558/* */ 1559/* IPv4 Only */ 1560/* Analyse the packet for IPv4/UDP properties. */ 1561/* ------------------------------------------------------------------------ */ 1562static INLINE void 1563ipf_pr_udp(fin) 1564 fr_info_t *fin; 1565{ 1566 1567 ipf_pr_short(fin, sizeof(udphdr_t)); 1568 1569 if (ipf_pr_udpcommon(fin) == 0) 1570 ipf_checkv4sum(fin); 1571} 1572 1573 1574/* ------------------------------------------------------------------------ */ 1575/* Function: ipf_pr_esp */ 1576/* Returns: void */ 1577/* Parameters: fin(I) - pointer to packet information */ 1578/* */ 1579/* Analyse the packet for ESP properties. */ 1580/* The minimum length is taken to be the SPI (32bits) plus a tail (32bits) */ 1581/* even though the newer ESP packets must also have a sequence number that */ 1582/* is 32bits as well, it is not possible(?) to determine the version from a */ 1583/* simple packet header. */ 1584/* ------------------------------------------------------------------------ */ 1585static INLINE void 1586ipf_pr_esp(fin) 1587 fr_info_t *fin; 1588{ 1589 1590 if (fin->fin_off == 0) { 1591 ipf_pr_short(fin, 8); 1592 if (ipf_pr_pullup(fin, 8) == -1) { 1593 ipf_main_softc_t *softc = fin->fin_main_soft; 1594 1595 LBUMPD(ipf_stats[fin->fin_out], fr_v4_esp_pullup); 1596 } 1597 } 1598} 1599 1600 1601/* ------------------------------------------------------------------------ */ 1602/* Function: ipf_pr_ah */ 1603/* Returns: int - value of the next header or IPPROTO_NONE if error */ 1604/* Parameters: fin(I) - pointer to packet information */ 1605/* */ 1606/* Analyse the packet for AH properties. */ 1607/* The minimum length is taken to be the combination of all fields in the */ 1608/* header being present and no authentication data (null algorithm used.) */ 1609/* ------------------------------------------------------------------------ */ 1610static INLINE int 1611ipf_pr_ah(fin) 1612 fr_info_t *fin; 1613{ 1614 ipf_main_softc_t *softc = fin->fin_main_soft; 1615 authhdr_t *ah; 1616 int len; 1617 1618 fin->fin_flx |= FI_AH; 1619 ipf_pr_short(fin, sizeof(*ah)); 1620 1621 if (((fin->fin_flx & FI_SHORT) != 0) || (fin->fin_off != 0)) { 1622 LBUMPD(ipf_stats[fin->fin_out], fr_v4_ah_bad); 1623 return IPPROTO_NONE; 1624 } 1625 1626 if (ipf_pr_pullup(fin, sizeof(*ah)) == -1) { 1627 DT(fr_v4_ah_pullup_1); 1628 LBUMP(ipf_stats[fin->fin_out].fr_v4_ah_pullup); 1629 return IPPROTO_NONE; 1630 } 1631 1632 ah = (authhdr_t *)fin->fin_dp; 1633 1634 len = (ah->ah_plen + 2) << 2; 1635 ipf_pr_short(fin, len); 1636 if (ipf_pr_pullup(fin, len) == -1) { 1637 DT(fr_v4_ah_pullup_2); 1638 LBUMP(ipf_stats[fin->fin_out].fr_v4_ah_pullup); 1639 return IPPROTO_NONE; 1640 } 1641 1642 /* 1643 * Adjust fin_dp and fin_dlen for skipping over the authentication 1644 * header. 1645 */ 1646 fin->fin_dp = (char *)fin->fin_dp + len; 1647 fin->fin_dlen -= len; 1648 return ah->ah_next; 1649} 1650 1651 1652/* ------------------------------------------------------------------------ */ 1653/* Function: ipf_pr_gre */ 1654/* Returns: void */ 1655/* Parameters: fin(I) - pointer to packet information */ 1656/* */ 1657/* Analyse the packet for GRE properties. */ 1658/* ------------------------------------------------------------------------ */ 1659static INLINE void 1660ipf_pr_gre(fin) 1661 fr_info_t *fin; 1662{ 1663 ipf_main_softc_t *softc = fin->fin_main_soft; 1664 grehdr_t *gre; 1665 1666 ipf_pr_short(fin, sizeof(grehdr_t)); 1667 1668 if (fin->fin_off != 0) { 1669 LBUMPD(ipf_stats[fin->fin_out], fr_v4_gre_frag); 1670 return; 1671 } 1672 1673 if (ipf_pr_pullup(fin, sizeof(grehdr_t)) == -1) { 1674 LBUMPD(ipf_stats[fin->fin_out], fr_v4_gre_pullup); 1675 return; 1676 } 1677 1678 gre = fin->fin_dp; 1679 if (GRE_REV(gre->gr_flags) == 1) 1680 fin->fin_data[0] = gre->gr_call; 1681} 1682 1683 1684/* ------------------------------------------------------------------------ */ 1685/* Function: ipf_pr_ipv4hdr */ 1686/* Returns: void */ 1687/* Parameters: fin(I) - pointer to packet information */ 1688/* */ 1689/* IPv4 Only */ 1690/* Analyze the IPv4 header and set fields in the fr_info_t structure. */ 1691/* Check all options present and flag their presence if any exist. */ 1692/* ------------------------------------------------------------------------ */ 1693static INLINE void 1694ipf_pr_ipv4hdr(fin) 1695 fr_info_t *fin; 1696{ 1697 u_short optmsk = 0, secmsk = 0, auth = 0; 1698 int hlen, ol, mv, p, i; 1699 const struct optlist *op; 1700 u_char *s, opt; 1701 u_short off; 1702 fr_ip_t *fi; 1703 ip_t *ip; 1704 1705 fi = &fin->fin_fi; 1706 hlen = fin->fin_hlen; 1707 1708 ip = fin->fin_ip; 1709 p = ip->ip_p; 1710 fi->fi_p = p; 1711 fin->fin_crc = p; 1712 fi->fi_tos = ip->ip_tos; 1713 fin->fin_id = ip->ip_id; 1714 off = ntohs(ip->ip_off); 1715 1716 /* Get both TTL and protocol */ 1717 fi->fi_p = ip->ip_p; 1718 fi->fi_ttl = ip->ip_ttl; 1719 1720 /* Zero out bits not used in IPv6 address */ 1721 fi->fi_src.i6[1] = 0; 1722 fi->fi_src.i6[2] = 0; 1723 fi->fi_src.i6[3] = 0; 1724 fi->fi_dst.i6[1] = 0; 1725 fi->fi_dst.i6[2] = 0; 1726 fi->fi_dst.i6[3] = 0; 1727 1728 fi->fi_saddr = ip->ip_src.s_addr; 1729 fin->fin_crc += fi->fi_saddr; 1730 fi->fi_daddr = ip->ip_dst.s_addr; 1731 fin->fin_crc += fi->fi_daddr; 1732 if (IN_CLASSD(ntohl(fi->fi_daddr))) 1733 fin->fin_flx |= FI_MULTICAST|FI_MBCAST; 1734 1735 /* 1736 * set packet attribute flags based on the offset and 1737 * calculate the byte offset that it represents. 1738 */ 1739 off &= IP_MF|IP_OFFMASK; 1740 if (off != 0) { 1741 int morefrag = off & IP_MF; 1742 1743 fi->fi_flx |= FI_FRAG; 1744 off &= IP_OFFMASK; 1745 if (off != 0) { 1746 fin->fin_flx |= FI_FRAGBODY; 1747 off <<= 3; 1748 if ((off + fin->fin_dlen > 65535) || 1749 (fin->fin_dlen == 0) || 1750 ((morefrag != 0) && ((fin->fin_dlen & 7) != 0))) { 1751 /* 1752 * The length of the packet, starting at its 1753 * offset cannot exceed 65535 (0xffff) as the 1754 * length of an IP packet is only 16 bits. 1755 * 1756 * Any fragment that isn't the last fragment 1757 * must have a length greater than 0 and it 1758 * must be an even multiple of 8. 1759 */ 1760 fi->fi_flx |= FI_BAD; 1761 } 1762 } 1763 } 1764 fin->fin_off = off; 1765 1766 /* 1767 * Call per-protocol setup and checking 1768 */ 1769 if (p == IPPROTO_AH) { 1770 /* 1771 * Treat AH differently because we expect there to be another 1772 * layer 4 header after it. 1773 */ 1774 p = ipf_pr_ah(fin); 1775 } 1776 1777 switch (p) 1778 { 1779 case IPPROTO_UDP : 1780 ipf_pr_udp(fin); 1781 break; 1782 case IPPROTO_TCP : 1783 ipf_pr_tcp(fin); 1784 break; 1785 case IPPROTO_ICMP : 1786 ipf_pr_icmp(fin); 1787 break; 1788 case IPPROTO_ESP : 1789 ipf_pr_esp(fin); 1790 break; 1791 case IPPROTO_GRE : 1792 ipf_pr_gre(fin); 1793 break; 1794 } 1795 1796 ip = fin->fin_ip; 1797 if (ip == NULL) 1798 return; 1799 1800 /* 1801 * If it is a standard IP header (no options), set the flag fields 1802 * which relate to options to 0. 1803 */ 1804 if (hlen == sizeof(*ip)) { 1805 fi->fi_optmsk = 0; 1806 fi->fi_secmsk = 0; 1807 fi->fi_auth = 0; 1808 return; 1809 } 1810 1811 /* 1812 * So the IP header has some IP options attached. Walk the entire 1813 * list of options present with this packet and set flags to indicate 1814 * which ones are here and which ones are not. For the somewhat out 1815 * of date and obscure security classification options, set a flag to 1816 * represent which classification is present. 1817 */ 1818 fi->fi_flx |= FI_OPTIONS; 1819 1820 for (s = (u_char *)(ip + 1), hlen -= (int)sizeof(*ip); hlen > 0; ) { 1821 opt = *s; 1822 if (opt == '\0') 1823 break; 1824 else if (opt == IPOPT_NOP) 1825 ol = 1; 1826 else { 1827 if (hlen < 2) 1828 break; 1829 ol = (int)*(s + 1); 1830 if (ol < 2 || ol > hlen) 1831 break; 1832 } 1833 for (i = 9, mv = 4; mv >= 0; ) { 1834 op = ipopts + i; 1835 1836 if ((opt == (u_char)op->ol_val) && (ol > 4)) { 1837 u_32_t doi; 1838 1839 switch (opt) 1840 { 1841 case IPOPT_SECURITY : 1842 if (optmsk & op->ol_bit) { 1843 fin->fin_flx |= FI_BAD; 1844 } else { 1845 doi = ipf_checkripso(s); 1846 secmsk = doi >> 16; 1847 auth = doi & 0xffff; 1848 } 1849 break; 1850 1851 case IPOPT_CIPSO : 1852 1853 if (optmsk & op->ol_bit) { 1854 fin->fin_flx |= FI_BAD; 1855 } else { 1856 doi = ipf_checkcipso(fin, 1857 s, ol); 1858 secmsk = doi >> 16; 1859 auth = doi & 0xffff; 1860 } 1861 break; 1862 } 1863 optmsk |= op->ol_bit; 1864 } 1865 1866 if (opt < op->ol_val) 1867 i -= mv; 1868 else 1869 i += mv; 1870 mv--; 1871 } 1872 hlen -= ol; 1873 s += ol; 1874 } 1875 1876 /* 1877 * 1878 */ 1879 if (auth && !(auth & 0x0100)) 1880 auth &= 0xff00; 1881 fi->fi_optmsk = optmsk; 1882 fi->fi_secmsk = secmsk; 1883 fi->fi_auth = auth; 1884} 1885 1886 1887/* ------------------------------------------------------------------------ */ 1888/* Function: ipf_checkripso */ 1889/* Returns: void */ 1890/* Parameters: s(I) - pointer to start of RIPSO option */ 1891/* */ 1892/* ------------------------------------------------------------------------ */ 1893static u_32_t 1894ipf_checkripso(s) 1895 u_char *s; 1896{ 1897 const struct optlist *sp; 1898 u_short secmsk = 0, auth = 0; 1899 u_char sec; 1900 int j, m; 1901 1902 sec = *(s + 2); /* classification */ 1903 for (j = 3, m = 2; m >= 0; ) { 1904 sp = secopt + j; 1905 if (sec == sp->ol_val) { 1906 secmsk |= sp->ol_bit; 1907 auth = *(s + 3); 1908 auth *= 256; 1909 auth += *(s + 4); 1910 break; 1911 } 1912 if (sec < sp->ol_val) 1913 j -= m; 1914 else 1915 j += m; 1916 m--; 1917 } 1918 1919 return (secmsk << 16) | auth; 1920} 1921 1922 1923/* ------------------------------------------------------------------------ */ 1924/* Function: ipf_checkcipso */ 1925/* Returns: u_32_t - 0 = failure, else the doi from the header */ 1926/* Parameters: fin(IO) - pointer to packet information */ 1927/* s(I) - pointer to start of CIPSO option */ 1928/* ol(I) - length of CIPSO option field */ 1929/* */ 1930/* This function returns the domain of integrity (DOI) field from the CIPSO */ 1931/* header and returns that whilst also storing the highest sensitivity */ 1932/* value found in the fr_info_t structure. */ 1933/* */ 1934/* No attempt is made to extract the category bitmaps as these are defined */ 1935/* by the user (rather than the protocol) and can be rather numerous on the */ 1936/* end nodes. */ 1937/* ------------------------------------------------------------------------ */ 1938static u_32_t 1939ipf_checkcipso(fin, s, ol) 1940 fr_info_t *fin; 1941 u_char *s; 1942 int ol; 1943{ 1944 ipf_main_softc_t *softc = fin->fin_main_soft; 1945 fr_ip_t *fi; 1946 u_32_t doi; 1947 u_char *t, tag, tlen, sensitivity; 1948 int len; 1949 1950 if (ol < 6 || ol > 40) { 1951 LBUMPD(ipf_stats[fin->fin_out], fr_v4_cipso_bad); 1952 fin->fin_flx |= FI_BAD; 1953 return 0; 1954 } 1955 1956 fi = &fin->fin_fi; 1957 fi->fi_sensitivity = 0; 1958 /* 1959 * The DOI field MUST be there. 1960 */ 1961 bcopy(s + 2, &doi, sizeof(doi)); 1962 1963 t = (u_char *)s + 6; 1964 for (len = ol - 6; len >= 2; len -= tlen, t+= tlen) { 1965 tag = *t; 1966 tlen = *(t + 1); 1967 if (tlen > len || tlen < 4 || tlen > 34) { 1968 LBUMPD(ipf_stats[fin->fin_out], fr_v4_cipso_tlen); 1969 fin->fin_flx |= FI_BAD; 1970 return 0; 1971 } 1972 1973 sensitivity = 0; 1974 /* 1975 * Tag numbers 0, 1, 2, 5 are laid out in the CIPSO Internet 1976 * draft (16 July 1992) that has expired. 1977 */ 1978 if (tag == 0) { 1979 fin->fin_flx |= FI_BAD; 1980 continue; 1981 } else if (tag == 1) { 1982 if (*(t + 2) != 0) { 1983 fin->fin_flx |= FI_BAD; 1984 continue; 1985 } 1986 sensitivity = *(t + 3); 1987 /* Category bitmap for categories 0-239 */ 1988 1989 } else if (tag == 4) { 1990 if (*(t + 2) != 0) { 1991 fin->fin_flx |= FI_BAD; 1992 continue; 1993 } 1994 sensitivity = *(t + 3); 1995 /* Enumerated categories, 16bits each, upto 15 */ 1996 1997 } else if (tag == 5) { 1998 if (*(t + 2) != 0) { 1999 fin->fin_flx |= FI_BAD; 2000 continue; 2001 } 2002 sensitivity = *(t + 3); 2003 /* Range of categories (2*16bits), up to 7 pairs */ 2004 2005 } else if (tag > 127) { 2006 /* Custom defined DOI */ 2007 ; 2008 } else { 2009 fin->fin_flx |= FI_BAD; 2010 continue; 2011 } 2012 2013 if (sensitivity > fi->fi_sensitivity) 2014 fi->fi_sensitivity = sensitivity; 2015 } 2016 2017 return doi; 2018} 2019 2020 2021/* ------------------------------------------------------------------------ */ 2022/* Function: ipf_makefrip */ 2023/* Returns: int - 0 == packet ok, -1 == packet freed */ 2024/* Parameters: hlen(I) - length of IP packet header */ 2025/* ip(I) - pointer to the IP header */ 2026/* fin(IO) - pointer to packet information */ 2027/* */ 2028/* Compact the IP header into a structure which contains just the info. */ 2029/* which is useful for comparing IP headers with and store this information */ 2030/* in the fr_info_t structure pointer to by fin. At present, it is assumed */ 2031/* this function will be called with either an IPv4 or IPv6 packet. */ 2032/* ------------------------------------------------------------------------ */ 2033int 2034ipf_makefrip(hlen, ip, fin) 2035 int hlen; 2036 ip_t *ip; 2037 fr_info_t *fin; 2038{ 2039 ipf_main_softc_t *softc = fin->fin_main_soft; 2040 int v; 2041 2042 fin->fin_depth = 0; 2043 fin->fin_hlen = (u_short)hlen; 2044 fin->fin_ip = ip; 2045 fin->fin_rule = 0xffffffff; 2046 fin->fin_group[0] = -1; 2047 fin->fin_group[1] = '\0'; 2048 fin->fin_dp = (char *)ip + hlen; 2049 2050 v = fin->fin_v; 2051 if (v == 4) { 2052 fin->fin_plen = ntohs(ip->ip_len); 2053 fin->fin_dlen = fin->fin_plen - hlen; 2054 ipf_pr_ipv4hdr(fin); 2055#ifdef USE_INET6 2056 } else if (v == 6) { 2057 fin->fin_plen = ntohs(((ip6_t *)ip)->ip6_plen); 2058 fin->fin_dlen = fin->fin_plen; 2059 fin->fin_plen += hlen; 2060 2061 ipf_pr_ipv6hdr(fin); 2062#endif 2063 } 2064 if (fin->fin_ip == NULL) { 2065 LBUMP(ipf_stats[fin->fin_out].fr_ip_freed); 2066 return -1; 2067 } 2068 return 0; 2069} 2070 2071 2072/* ------------------------------------------------------------------------ */ 2073/* Function: ipf_portcheck */ 2074/* Returns: int - 1 == port matched, 0 == port match failed */ 2075/* Parameters: frp(I) - pointer to port check `expression' */ 2076/* pop(I) - port number to evaluate */ 2077/* */ 2078/* Perform a comparison of a port number against some other(s), using a */ 2079/* structure with compare information stored in it. */ 2080/* ------------------------------------------------------------------------ */ 2081static INLINE int 2082ipf_portcheck(frp, pop) 2083 frpcmp_t *frp; 2084 u_32_t pop; 2085{ 2086 int err = 1; 2087 u_32_t po; 2088 2089 po = frp->frp_port; 2090 2091 /* 2092 * Do opposite test to that required and continue if that succeeds. 2093 */ 2094 switch (frp->frp_cmp) 2095 { 2096 case FR_EQUAL : 2097 if (pop != po) /* EQUAL */ 2098 err = 0; 2099 break; 2100 case FR_NEQUAL : 2101 if (pop == po) /* NOTEQUAL */ 2102 err = 0; 2103 break; 2104 case FR_LESST : 2105 if (pop >= po) /* LESSTHAN */ 2106 err = 0; 2107 break; 2108 case FR_GREATERT : 2109 if (pop <= po) /* GREATERTHAN */ 2110 err = 0; 2111 break; 2112 case FR_LESSTE : 2113 if (pop > po) /* LT or EQ */ 2114 err = 0; 2115 break; 2116 case FR_GREATERTE : 2117 if (pop < po) /* GT or EQ */ 2118 err = 0; 2119 break; 2120 case FR_OUTRANGE : 2121 if (pop >= po && pop <= frp->frp_top) /* Out of range */ 2122 err = 0; 2123 break; 2124 case FR_INRANGE : 2125 if (pop <= po || pop >= frp->frp_top) /* In range */ 2126 err = 0; 2127 break; 2128 case FR_INCRANGE : 2129 if (pop < po || pop > frp->frp_top) /* Inclusive range */ 2130 err = 0; 2131 break; 2132 default : 2133 break; 2134 } 2135 return err; 2136} 2137 2138 2139/* ------------------------------------------------------------------------ */ 2140/* Function: ipf_tcpudpchk */ 2141/* Returns: int - 1 == protocol matched, 0 == check failed */ 2142/* Parameters: fda(I) - pointer to packet information */ 2143/* ft(I) - pointer to structure with comparison data */ 2144/* */ 2145/* Compares the current pcket (assuming it is TCP/UDP) information with a */ 2146/* structure containing information that we want to match against. */ 2147/* ------------------------------------------------------------------------ */ 2148int 2149ipf_tcpudpchk(fi, ft) 2150 fr_ip_t *fi; 2151 frtuc_t *ft; 2152{ 2153 int err = 1; 2154 2155 /* 2156 * Both ports should *always* be in the first fragment. 2157 * So far, I cannot find any cases where they can not be. 2158 * 2159 * compare destination ports 2160 */ 2161 if (ft->ftu_dcmp) 2162 err = ipf_portcheck(&ft->ftu_dst, fi->fi_ports[1]); 2163 2164 /* 2165 * compare source ports 2166 */ 2167 if (err && ft->ftu_scmp) 2168 err = ipf_portcheck(&ft->ftu_src, fi->fi_ports[0]); 2169 2170 /* 2171 * If we don't have all the TCP/UDP header, then how can we 2172 * expect to do any sort of match on it ? If we were looking for 2173 * TCP flags, then NO match. If not, then match (which should 2174 * satisfy the "short" class too). 2175 */ 2176 if (err && (fi->fi_p == IPPROTO_TCP)) { 2177 if (fi->fi_flx & FI_SHORT) 2178 return !(ft->ftu_tcpf | ft->ftu_tcpfm); 2179 /* 2180 * Match the flags ? If not, abort this match. 2181 */ 2182 if (ft->ftu_tcpfm && 2183 ft->ftu_tcpf != (fi->fi_tcpf & ft->ftu_tcpfm)) { 2184 FR_DEBUG(("f. %#x & %#x != %#x\n", fi->fi_tcpf, 2185 ft->ftu_tcpfm, ft->ftu_tcpf)); 2186 err = 0; 2187 } 2188 } 2189 return err; 2190} 2191 2192 2193/* ------------------------------------------------------------------------ */ 2194/* Function: ipf_check_ipf */ 2195/* Returns: int - 0 == match, else no match */ 2196/* Parameters: fin(I) - pointer to packet information */ 2197/* fr(I) - pointer to filter rule */ 2198/* portcmp(I) - flag indicating whether to attempt matching on */ 2199/* TCP/UDP port data. */ 2200/* */ 2201/* Check to see if a packet matches an IPFilter rule. Checks of addresses, */ 2202/* port numbers, etc, for "standard" IPFilter rules are all orchestrated in */ 2203/* this function. */ 2204/* ------------------------------------------------------------------------ */ 2205static INLINE int 2206ipf_check_ipf(fin, fr, portcmp) 2207 fr_info_t *fin; 2208 frentry_t *fr; 2209 int portcmp; 2210{ 2211 u_32_t *ld, *lm, *lip; 2212 fripf_t *fri; 2213 fr_ip_t *fi; 2214 int i; 2215 2216 fi = &fin->fin_fi; 2217 fri = fr->fr_ipf; 2218 lip = (u_32_t *)fi; 2219 lm = (u_32_t *)&fri->fri_mip; 2220 ld = (u_32_t *)&fri->fri_ip; 2221 2222 /* 2223 * first 32 bits to check coversion: 2224 * IP version, TOS, TTL, protocol 2225 */ 2226 i = ((*lip & *lm) != *ld); 2227 FR_DEBUG(("0. %#08x & %#08x != %#08x\n", 2228 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2229 if (i) 2230 return 1; 2231 2232 /* 2233 * Next 32 bits is a constructed bitmask indicating which IP options 2234 * are present (if any) in this packet. 2235 */ 2236 lip++, lm++, ld++; 2237 i = ((*lip & *lm) != *ld); 2238 FR_DEBUG(("1. %#08x & %#08x != %#08x\n", 2239 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2240 if (i != 0) 2241 return 1; 2242 2243 lip++, lm++, ld++; 2244 /* 2245 * Unrolled loops (4 each, for 32 bits) for address checks. 2246 */ 2247 /* 2248 * Check the source address. 2249 */ 2250 if (fr->fr_satype == FRI_LOOKUP) { 2251 i = (*fr->fr_srcfunc)(fin->fin_main_soft, fr->fr_srcptr, 2252 fi->fi_v, lip, fin->fin_plen); 2253 if (i == -1) 2254 return 1; 2255 lip += 3; 2256 lm += 3; 2257 ld += 3; 2258 } else { 2259 i = ((*lip & *lm) != *ld); 2260 FR_DEBUG(("2a. %#08x & %#08x != %#08x\n", 2261 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2262 if (fi->fi_v == 6) { 2263 lip++, lm++, ld++; 2264 i |= ((*lip & *lm) != *ld); 2265 FR_DEBUG(("2b. %#08x & %#08x != %#08x\n", 2266 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2267 lip++, lm++, ld++; 2268 i |= ((*lip & *lm) != *ld); 2269 FR_DEBUG(("2c. %#08x & %#08x != %#08x\n", 2270 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2271 lip++, lm++, ld++; 2272 i |= ((*lip & *lm) != *ld); 2273 FR_DEBUG(("2d. %#08x & %#08x != %#08x\n", 2274 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2275 } else { 2276 lip += 3; 2277 lm += 3; 2278 ld += 3; 2279 } 2280 } 2281 i ^= (fr->fr_flags & FR_NOTSRCIP) >> 6; 2282 if (i != 0) 2283 return 1; 2284 2285 /* 2286 * Check the destination address. 2287 */ 2288 lip++, lm++, ld++; 2289 if (fr->fr_datype == FRI_LOOKUP) { 2290 i = (*fr->fr_dstfunc)(fin->fin_main_soft, fr->fr_dstptr, 2291 fi->fi_v, lip, fin->fin_plen); 2292 if (i == -1) 2293 return 1; 2294 lip += 3; 2295 lm += 3; 2296 ld += 3; 2297 } else { 2298 i = ((*lip & *lm) != *ld); 2299 FR_DEBUG(("3a. %#08x & %#08x != %#08x\n", 2300 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2301 if (fi->fi_v == 6) { 2302 lip++, lm++, ld++; 2303 i |= ((*lip & *lm) != *ld); 2304 FR_DEBUG(("3b. %#08x & %#08x != %#08x\n", 2305 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2306 lip++, lm++, ld++; 2307 i |= ((*lip & *lm) != *ld); 2308 FR_DEBUG(("3c. %#08x & %#08x != %#08x\n", 2309 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2310 lip++, lm++, ld++; 2311 i |= ((*lip & *lm) != *ld); 2312 FR_DEBUG(("3d. %#08x & %#08x != %#08x\n", 2313 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2314 } else { 2315 lip += 3; 2316 lm += 3; 2317 ld += 3; 2318 } 2319 } 2320 i ^= (fr->fr_flags & FR_NOTDSTIP) >> 7; 2321 if (i != 0) 2322 return 1; 2323 /* 2324 * IP addresses matched. The next 32bits contains: 2325 * mast of old IP header security & authentication bits. 2326 */ 2327 lip++, lm++, ld++; 2328 i = (*ld - (*lip & *lm)); 2329 FR_DEBUG(("4. %#08x & %#08x != %#08x\n", *lip, *lm, *ld)); 2330 2331 /* 2332 * Next we have 32 bits of packet flags. 2333 */ 2334 lip++, lm++, ld++; 2335 i |= (*ld - (*lip & *lm)); 2336 FR_DEBUG(("5. %#08x & %#08x != %#08x\n", *lip, *lm, *ld)); 2337 2338 if (i == 0) { 2339 /* 2340 * If a fragment, then only the first has what we're 2341 * looking for here... 2342 */ 2343 if (portcmp) { 2344 if (!ipf_tcpudpchk(&fin->fin_fi, &fr->fr_tuc)) 2345 i = 1; 2346 } else { 2347 if (fr->fr_dcmp || fr->fr_scmp || 2348 fr->fr_tcpf || fr->fr_tcpfm) 2349 i = 1; 2350 if (fr->fr_icmpm || fr->fr_icmp) { 2351 if (((fi->fi_p != IPPROTO_ICMP) && 2352 (fi->fi_p != IPPROTO_ICMPV6)) || 2353 fin->fin_off || (fin->fin_dlen < 2)) 2354 i = 1; 2355 else if ((fin->fin_data[0] & fr->fr_icmpm) != 2356 fr->fr_icmp) { 2357 FR_DEBUG(("i. %#x & %#x != %#x\n", 2358 fin->fin_data[0], 2359 fr->fr_icmpm, fr->fr_icmp)); 2360 i = 1; 2361 } 2362 } 2363 } 2364 } 2365 return i; 2366} 2367 2368 2369/* ------------------------------------------------------------------------ */ 2370/* Function: ipf_scanlist */ 2371/* Returns: int - result flags of scanning filter list */ 2372/* Parameters: fin(I) - pointer to packet information */ 2373/* pass(I) - default result to return for filtering */ 2374/* */ 2375/* Check the input/output list of rules for a match to the current packet. */ 2376/* If a match is found, the value of fr_flags from the rule becomes the */ 2377/* return value and fin->fin_fr points to the matched rule. */ 2378/* */ 2379/* This function may be called recusively upto 16 times (limit inbuilt.) */ 2380/* When unwinding, it should finish up with fin_depth as 0. */ 2381/* */ 2382/* Could be per interface, but this gets real nasty when you don't have, */ 2383/* or can't easily change, the kernel source code to . */ 2384/* ------------------------------------------------------------------------ */ 2385int 2386ipf_scanlist(fin, pass) 2387 fr_info_t *fin; 2388 u_32_t pass; 2389{ 2390 ipf_main_softc_t *softc = fin->fin_main_soft; 2391 int rulen, portcmp, off, skip; 2392 struct frentry *fr, *fnext; 2393 u_32_t passt, passo; 2394 2395 /* 2396 * Do not allow nesting deeper than 16 levels. 2397 */ 2398 if (fin->fin_depth >= 16) 2399 return pass; 2400 2401 fr = fin->fin_fr; 2402 2403 /* 2404 * If there are no rules in this list, return now. 2405 */ 2406 if (fr == NULL) 2407 return pass; 2408 2409 skip = 0; 2410 portcmp = 0; 2411 fin->fin_depth++; 2412 fin->fin_fr = NULL; 2413 off = fin->fin_off; 2414 2415 if ((fin->fin_flx & FI_TCPUDP) && (fin->fin_dlen > 3) && !off) 2416 portcmp = 1; 2417 2418 for (rulen = 0; fr; fr = fnext, rulen++) { 2419 fnext = fr->fr_next; 2420 if (skip != 0) { 2421 FR_VERBOSE(("SKIP %d (%#x)\n", skip, fr->fr_flags)); 2422 skip--; 2423 continue; 2424 } 2425 2426 /* 2427 * In all checks below, a null (zero) value in the 2428 * filter struture is taken to mean a wildcard. 2429 * 2430 * check that we are working for the right interface 2431 */ 2432#ifdef _KERNEL 2433 if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp) 2434 continue; 2435#else 2436 if (opts & (OPT_VERBOSE|OPT_DEBUG)) 2437 printf("\n"); 2438 FR_VERBOSE(("%c", FR_ISSKIP(pass) ? 's' : 2439 FR_ISPASS(pass) ? 'p' : 2440 FR_ISACCOUNT(pass) ? 'A' : 2441 FR_ISAUTH(pass) ? 'a' : 2442 (pass & FR_NOMATCH) ? 'n' :'b')); 2443 if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp) 2444 continue; 2445 FR_VERBOSE((":i")); 2446#endif 2447 2448 switch (fr->fr_type) 2449 { 2450 case FR_T_IPF : 2451 case FR_T_IPF_BUILTIN : 2452 if (ipf_check_ipf(fin, fr, portcmp)) 2453 continue; 2454 break; 2455#if defined(IPFILTER_BPF) 2456 case FR_T_BPFOPC : 2457 case FR_T_BPFOPC_BUILTIN : 2458 { 2459 u_char *mc; 2460 int wlen; 2461 2462 if (*fin->fin_mp == NULL) 2463 continue; 2464 if (fin->fin_family != fr->fr_family) 2465 continue; 2466 mc = (u_char *)fin->fin_m; 2467 wlen = fin->fin_dlen + fin->fin_hlen; 2468 if (!bpf_filter(fr->fr_data, mc, wlen, 0)) 2469 continue; 2470 break; 2471 } 2472#endif 2473 case FR_T_CALLFUNC_BUILTIN : 2474 { 2475 frentry_t *f; 2476 2477 f = (*fr->fr_func)(fin, &pass); 2478 if (f != NULL) 2479 fr = f; 2480 else 2481 continue; 2482 break; 2483 } 2484 2485 case FR_T_IPFEXPR : 2486 case FR_T_IPFEXPR_BUILTIN : 2487 if (fin->fin_family != fr->fr_family) 2488 continue; 2489 if (ipf_fr_matcharray(fin, fr->fr_data) == 0) 2490 continue; 2491 break; 2492 2493 default : 2494 break; 2495 } 2496 2497 if ((fin->fin_out == 0) && (fr->fr_nattag.ipt_num[0] != 0)) { 2498 if (fin->fin_nattag == NULL) 2499 continue; 2500 if (ipf_matchtag(&fr->fr_nattag, fin->fin_nattag) == 0) 2501 continue; 2502 } 2503 FR_VERBOSE(("=%d/%d.%d *", fr->fr_grhead, fr->fr_group, rulen)); 2504 2505 passt = fr->fr_flags; 2506 2507 /* 2508 * If the rule is a "call now" rule, then call the function 2509 * in the rule, if it exists and use the results from that. 2510 * If the function pointer is bad, just make like we ignore 2511 * it, except for increasing the hit counter. 2512 */ 2513 if ((passt & FR_CALLNOW) != 0) { 2514 frentry_t *frs; 2515 2516 ATOMIC_INC64(fr->fr_hits); 2517 if ((fr->fr_func == NULL) || 2518 (fr->fr_func == (ipfunc_t)-1)) 2519 continue; 2520 2521 frs = fin->fin_fr; 2522 fin->fin_fr = fr; 2523 fr = (*fr->fr_func)(fin, &passt); 2524 if (fr == NULL) { 2525 fin->fin_fr = frs; 2526 continue; 2527 } 2528 passt = fr->fr_flags; 2529 } 2530 fin->fin_fr = fr; 2531 2532#ifdef IPFILTER_LOG 2533 /* 2534 * Just log this packet... 2535 */ 2536 if ((passt & FR_LOGMASK) == FR_LOG) { 2537 if (ipf_log_pkt(fin, passt) == -1) { 2538 if (passt & FR_LOGORBLOCK) { 2539 DT(frb_logfail); 2540 passt &= ~FR_CMDMASK; 2541 passt |= FR_BLOCK|FR_QUICK; 2542 fin->fin_reason = FRB_LOGFAIL; 2543 } 2544 } 2545 } 2546#endif /* IPFILTER_LOG */ 2547 2548 MUTEX_ENTER(&fr->fr_lock); 2549 fr->fr_bytes += (U_QUAD_T)fin->fin_plen; 2550 fr->fr_hits++; 2551 MUTEX_EXIT(&fr->fr_lock); 2552 fin->fin_rule = rulen; 2553 2554 passo = pass; 2555 if (FR_ISSKIP(passt)) { 2556 skip = fr->fr_arg; 2557 continue; 2558 } else if (((passt & FR_LOGMASK) != FR_LOG) && 2559 ((passt & FR_LOGMASK) != FR_DECAPSULATE)) { 2560 pass = passt; 2561 } 2562 2563 if (passt & (FR_RETICMP|FR_FAKEICMP)) 2564 fin->fin_icode = fr->fr_icode; 2565 2566 if (fr->fr_group != -1) { 2567 (void) strncpy(fin->fin_group, 2568 FR_NAME(fr, fr_group), 2569 strlen(FR_NAME(fr, fr_group))); 2570 } else { 2571 fin->fin_group[0] = '\0'; 2572 } 2573 2574 FR_DEBUG(("pass %#x/%#x/%x\n", passo, pass, passt)); 2575 2576 if (fr->fr_grphead != NULL) { 2577 fin->fin_fr = fr->fr_grphead->fg_start; 2578 FR_VERBOSE(("group %s\n", FR_NAME(fr, fr_grhead))); 2579 2580 if (FR_ISDECAPS(passt)) 2581 passt = ipf_decaps(fin, pass, fr->fr_icode); 2582 else 2583 passt = ipf_scanlist(fin, pass); 2584 2585 if (fin->fin_fr == NULL) { 2586 fin->fin_rule = rulen; 2587 if (fr->fr_group != -1) 2588 (void) strncpy(fin->fin_group, 2589 fr->fr_names + 2590 fr->fr_group, 2591 strlen(fr->fr_names + 2592 fr->fr_group)); 2593 fin->fin_fr = fr; 2594 passt = pass; 2595 } 2596 pass = passt; 2597 } 2598 2599 if (pass & FR_QUICK) { 2600 /* 2601 * Finally, if we've asked to track state for this 2602 * packet, set it up. Add state for "quick" rules 2603 * here so that if the action fails we can consider 2604 * the rule to "not match" and keep on processing 2605 * filter rules. 2606 */ 2607 if ((pass & FR_KEEPSTATE) && !FR_ISAUTH(pass) && 2608 !(fin->fin_flx & FI_STATE)) { 2609 int out = fin->fin_out; 2610 2611 fin->fin_fr = fr; 2612 if (ipf_state_add(softc, fin, NULL, 0) == 0) { 2613 LBUMPD(ipf_stats[out], fr_ads); 2614 } else { 2615 LBUMPD(ipf_stats[out], fr_bads); 2616 pass = passo; 2617 continue; 2618 } 2619 } 2620 break; 2621 } 2622 } 2623 fin->fin_depth--; 2624 return pass; 2625} 2626 2627 2628/* ------------------------------------------------------------------------ */ 2629/* Function: ipf_acctpkt */ 2630/* Returns: frentry_t* - always returns NULL */ 2631/* Parameters: fin(I) - pointer to packet information */ 2632/* passp(IO) - pointer to current/new filter decision (unused) */ 2633/* */ 2634/* Checks a packet against accounting rules, if there are any for the given */ 2635/* IP protocol version. */ 2636/* */ 2637/* N.B.: this function returns NULL to match the prototype used by other */ 2638/* functions called from the IPFilter "mainline" in ipf_check(). */ 2639/* ------------------------------------------------------------------------ */ 2640frentry_t * 2641ipf_acctpkt(fin, passp) 2642 fr_info_t *fin; 2643 u_32_t *passp; 2644{ 2645 ipf_main_softc_t *softc = fin->fin_main_soft; 2646 char group[FR_GROUPLEN]; 2647 frentry_t *fr, *frsave; 2648 u_32_t pass, rulen; 2649 2650 passp = passp; 2651 fr = softc->ipf_acct[fin->fin_out][softc->ipf_active]; 2652 2653 if (fr != NULL) { 2654 frsave = fin->fin_fr; 2655 bcopy(fin->fin_group, group, FR_GROUPLEN); 2656 rulen = fin->fin_rule; 2657 fin->fin_fr = fr; 2658 pass = ipf_scanlist(fin, FR_NOMATCH); 2659 if (FR_ISACCOUNT(pass)) { 2660 LBUMPD(ipf_stats[0], fr_acct); 2661 } 2662 fin->fin_fr = frsave; 2663 bcopy(group, fin->fin_group, FR_GROUPLEN); 2664 fin->fin_rule = rulen; 2665 } 2666 return NULL; 2667} 2668 2669 2670/* ------------------------------------------------------------------------ */ 2671/* Function: ipf_firewall */ 2672/* Returns: frentry_t* - returns pointer to matched rule, if no matches */ 2673/* were found, returns NULL. */ 2674/* Parameters: fin(I) - pointer to packet information */ 2675/* passp(IO) - pointer to current/new filter decision (unused) */ 2676/* */ 2677/* Applies an appropriate set of firewall rules to the packet, to see if */ 2678/* there are any matches. The first check is to see if a match can be seen */ 2679/* in the cache. If not, then search an appropriate list of rules. Once a */ 2680/* matching rule is found, take any appropriate actions as defined by the */ 2681/* rule - except logging. */ 2682/* ------------------------------------------------------------------------ */ 2683static frentry_t * 2684ipf_firewall(fin, passp) 2685 fr_info_t *fin; 2686 u_32_t *passp; 2687{ 2688 ipf_main_softc_t *softc = fin->fin_main_soft; 2689 frentry_t *fr; 2690 u_32_t pass; 2691 int out; 2692 2693 out = fin->fin_out; 2694 pass = *passp; 2695 2696 /* 2697 * This rule cache will only affect packets that are not being 2698 * statefully filtered. 2699 */ 2700 fin->fin_fr = softc->ipf_rules[out][softc->ipf_active]; 2701 if (fin->fin_fr != NULL) 2702 pass = ipf_scanlist(fin, softc->ipf_pass); 2703 2704 if ((pass & FR_NOMATCH)) { 2705 LBUMPD(ipf_stats[out], fr_nom); 2706 } 2707 fr = fin->fin_fr; 2708 2709 /* 2710 * Apply packets per second rate-limiting to a rule as required. 2711 */ 2712 if ((fr != NULL) && (fr->fr_pps != 0) && 2713 !ppsratecheck(&fr->fr_lastpkt, &fr->fr_curpps, fr->fr_pps)) { 2714 DT2(frb_ppsrate, fr_info_t *, fin, frentry_t *, fr); 2715 pass &= ~(FR_CMDMASK|FR_RETICMP|FR_RETRST); 2716 pass |= FR_BLOCK; 2717 LBUMPD(ipf_stats[out], fr_ppshit); 2718 fin->fin_reason = FRB_PPSRATE; 2719 } 2720 2721 /* 2722 * If we fail to add a packet to the authorization queue, then we 2723 * drop the packet later. However, if it was added then pretend 2724 * we've dropped it already. 2725 */ 2726 if (FR_ISAUTH(pass)) { 2727 if (ipf_auth_new(fin->fin_m, fin) != 0) { 2728 DT1(frb_authnew, fr_info_t *, fin); 2729 fin->fin_m = *fin->fin_mp = NULL; 2730 fin->fin_reason = FRB_AUTHNEW; 2731 fin->fin_error = 0; 2732 } else { 2733 IPFERROR(1); 2734 fin->fin_error = ENOSPC; 2735 } 2736 } 2737 2738 if ((fr != NULL) && (fr->fr_func != NULL) && 2739 (fr->fr_func != (ipfunc_t)-1) && !(pass & FR_CALLNOW)) 2740 (void) (*fr->fr_func)(fin, &pass); 2741 2742 /* 2743 * If a rule is a pre-auth rule, check again in the list of rules 2744 * loaded for authenticated use. It does not particulary matter 2745 * if this search fails because a "preauth" result, from a rule, 2746 * is treated as "not a pass", hence the packet is blocked. 2747 */ 2748 if (FR_ISPREAUTH(pass)) { 2749 pass = ipf_auth_pre_scanlist(softc, fin, pass); 2750 } 2751 2752 /* 2753 * If the rule has "keep frag" and the packet is actually a fragment, 2754 * then create a fragment state entry. 2755 */ 2756 if (pass & FR_KEEPFRAG) { 2757 if (fin->fin_flx & FI_FRAG) { 2758 if (ipf_frag_new(softc, fin, pass) == -1) { 2759 LBUMP(ipf_stats[out].fr_bnfr); 2760 } else { 2761 LBUMP(ipf_stats[out].fr_nfr); 2762 } 2763 } else { 2764 LBUMP(ipf_stats[out].fr_cfr); 2765 } 2766 } 2767 2768 fr = fin->fin_fr; 2769 *passp = pass; 2770 2771 return fr; 2772} 2773 2774 2775/* ------------------------------------------------------------------------ */ 2776/* Function: ipf_check */ 2777/* Returns: int - 0 == packet allowed through, */ 2778/* User space: */ 2779/* -1 == packet blocked */ 2780/* 1 == packet not matched */ 2781/* -2 == requires authentication */ 2782/* Kernel: */ 2783/* > 0 == filter error # for packet */ 2784/* Parameters: ctx(I) - pointer to the instance context */ 2785/* ip(I) - pointer to start of IPv4/6 packet */ 2786/* hlen(I) - length of header */ 2787/* ifp(I) - pointer to interface this packet is on */ 2788/* out(I) - 0 == packet going in, 1 == packet going out */ 2789/* mp(IO) - pointer to caller's buffer pointer that holds this */ 2790/* IP packet. */ 2791/* Solaris & HP-UX ONLY : */ 2792/* qpi(I) - pointer to STREAMS queue information for this */ 2793/* interface & direction. */ 2794/* */ 2795/* ipf_check() is the master function for all IPFilter packet processing. */ 2796/* It orchestrates: Network Address Translation (NAT), checking for packet */ 2797/* authorisation (or pre-authorisation), presence of related state info., */ 2798/* generating log entries, IP packet accounting, routing of packets as */ 2799/* directed by firewall rules and of course whether or not to allow the */ 2800/* packet to be further processed by the kernel. */ 2801/* */ 2802/* For packets blocked, the contents of "mp" will be NULL'd and the buffer */ 2803/* freed. Packets passed may be returned with the pointer pointed to by */ 2804/* by "mp" changed to a new buffer. */ 2805/* ------------------------------------------------------------------------ */ 2806int 2807ipf_check(ctx, ip, hlen, ifp, out 2808#if defined(_KERNEL) && defined(MENTAT) 2809 , qif, mp) 2810 void *qif; 2811#else 2812 , mp) 2813#endif 2814 mb_t **mp; 2815 ip_t *ip; 2816 int hlen; 2817 void *ifp; 2818 int out; 2819 void *ctx; 2820{ 2821 /* 2822 * The above really sucks, but short of writing a diff 2823 */ 2824 ipf_main_softc_t *softc = ctx; 2825 fr_info_t frinfo; 2826 fr_info_t *fin = &frinfo; 2827 u_32_t pass = softc->ipf_pass; 2828 frentry_t *fr = NULL; 2829 int v = IP_V(ip); 2830 mb_t *mc = NULL; 2831 mb_t *m; 2832 /* 2833 * The first part of ipf_check() deals with making sure that what goes 2834 * into the filtering engine makes some sense. Information about the 2835 * the packet is distilled, collected into a fr_info_t structure and 2836 * the an attempt to ensure the buffer the packet is in is big enough 2837 * to hold all the required packet headers. 2838 */ 2839#ifdef _KERNEL 2840# ifdef MENTAT 2841 qpktinfo_t *qpi = qif; 2842 2843# ifdef __sparc 2844 if ((u_int)ip & 0x3) 2845 return 2; 2846# endif 2847# else 2848 SPL_INT(s); 2849# endif 2850 2851 if (softc->ipf_running <= 0) { 2852 return 0; 2853 } 2854 2855 bzero((char *)fin, sizeof(*fin)); 2856 2857# ifdef MENTAT 2858 if (qpi->qpi_flags & QF_BROADCAST) 2859 fin->fin_flx |= FI_MBCAST|FI_BROADCAST; 2860 if (qpi->qpi_flags & QF_MULTICAST) 2861 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2862 m = qpi->qpi_m; 2863 fin->fin_qfm = m; 2864 fin->fin_qpi = qpi; 2865# else /* MENTAT */ 2866 2867 m = *mp; 2868 2869# if defined(M_MCAST) 2870 if ((m->m_flags & M_MCAST) != 0) 2871 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2872# endif 2873# if defined(M_MLOOP) 2874 if ((m->m_flags & M_MLOOP) != 0) 2875 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2876# endif 2877# if defined(M_BCAST) 2878 if ((m->m_flags & M_BCAST) != 0) 2879 fin->fin_flx |= FI_MBCAST|FI_BROADCAST; 2880# endif 2881# ifdef M_CANFASTFWD 2882 /* 2883 * XXX For now, IP Filter and fast-forwarding of cached flows 2884 * XXX are mutually exclusive. Eventually, IP Filter should 2885 * XXX get a "can-fast-forward" filter rule. 2886 */ 2887 m->m_flags &= ~M_CANFASTFWD; 2888# endif /* M_CANFASTFWD */ 2889# if defined(CSUM_DELAY_DATA) && (!defined(__FreeBSD_version) || \ 2890 (__FreeBSD_version < 501108)) 2891 /* 2892 * disable delayed checksums. 2893 */ 2894 if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) { 2895 in_delayed_cksum(m); 2896 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA; 2897 } 2898# endif /* CSUM_DELAY_DATA */ 2899# endif /* MENTAT */ 2900#else 2901 bzero((char *)fin, sizeof(*fin)); 2902 m = *mp; 2903# if defined(M_MCAST) 2904 if ((m->m_flags & M_MCAST) != 0) 2905 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2906# endif 2907# if defined(M_MLOOP) 2908 if ((m->m_flags & M_MLOOP) != 0) 2909 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2910# endif 2911# if defined(M_BCAST) 2912 if ((m->m_flags & M_BCAST) != 0) 2913 fin->fin_flx |= FI_MBCAST|FI_BROADCAST; 2914# endif 2915#endif /* _KERNEL */ 2916 2917 fin->fin_v = v; 2918 fin->fin_m = m; 2919 fin->fin_ip = ip; 2920 fin->fin_mp = mp; 2921 fin->fin_out = out; 2922 fin->fin_ifp = ifp; 2923 fin->fin_error = ENETUNREACH; 2924 fin->fin_hlen = (u_short)hlen; 2925 fin->fin_dp = (char *)ip + hlen; 2926 fin->fin_main_soft = softc; 2927 2928 fin->fin_ipoff = (char *)ip - MTOD(m, char *); 2929 2930 SPL_NET(s); 2931 2932#ifdef USE_INET6 2933 if (v == 6) { 2934 LBUMP(ipf_stats[out].fr_ipv6); 2935 /* 2936 * Jumbo grams are quite likely too big for internal buffer 2937 * structures to handle comfortably, for now, so just drop 2938 * them. 2939 */ 2940 if (((ip6_t *)ip)->ip6_plen == 0) { 2941 DT1(frb_jumbo, ip6_t *, (ip6_t *)ip); 2942 pass = FR_BLOCK|FR_NOMATCH; 2943 fin->fin_reason = FRB_JUMBO; 2944 goto finished; 2945 } 2946 fin->fin_family = AF_INET6; 2947 } else 2948#endif 2949 { 2950 fin->fin_family = AF_INET; 2951 } 2952 2953 if (ipf_makefrip(hlen, ip, fin) == -1) { 2954 DT1(frb_makefrip, fr_info_t *, fin); 2955 pass = FR_BLOCK|FR_NOMATCH; 2956 fin->fin_reason = FRB_MAKEFRIP; 2957 goto finished; 2958 } 2959 2960 /* 2961 * For at least IPv6 packets, if a m_pullup() fails then this pointer 2962 * becomes NULL and so we have no packet to free. 2963 */ 2964 if (*fin->fin_mp == NULL) 2965 goto finished; 2966 2967 if (!out) { 2968 if (v == 4) { 2969 if (softc->ipf_chksrc && !ipf_verifysrc(fin)) { 2970 LBUMPD(ipf_stats[0], fr_v4_badsrc); 2971 fin->fin_flx |= FI_BADSRC; 2972 } 2973 if (fin->fin_ip->ip_ttl < softc->ipf_minttl) { 2974 LBUMPD(ipf_stats[0], fr_v4_badttl); 2975 fin->fin_flx |= FI_LOWTTL; 2976 } 2977 } 2978#ifdef USE_INET6 2979 else if (v == 6) { 2980 if (((ip6_t *)ip)->ip6_hlim < softc->ipf_minttl) { 2981 LBUMPD(ipf_stats[0], fr_v6_badttl); 2982 fin->fin_flx |= FI_LOWTTL; 2983 } 2984 } 2985#endif 2986 } 2987 2988 if (fin->fin_flx & FI_SHORT) { 2989 LBUMPD(ipf_stats[out], fr_short); 2990 } 2991 2992 READ_ENTER(&softc->ipf_mutex); 2993 2994 if (!out) { 2995 switch (fin->fin_v) 2996 { 2997 case 4 : 2998 if (ipf_nat_checkin(fin, &pass) == -1) { 2999 goto filterdone; 3000 } 3001 break; 3002#ifdef USE_INET6 3003 case 6 : 3004 if (ipf_nat6_checkin(fin, &pass) == -1) { 3005 goto filterdone; 3006 } 3007 break; 3008#endif 3009 default : 3010 break; 3011 } 3012 } 3013 /* 3014 * Check auth now. 3015 * If a packet is found in the auth table, then skip checking 3016 * the access lists for permission but we do need to consider 3017 * the result as if it were from the ACL's. In addition, being 3018 * found in the auth table means it has been seen before, so do 3019 * not pass it through accounting (again), lest it be counted twice. 3020 */ 3021 fr = ipf_auth_check(fin, &pass); 3022 if (!out && (fr == NULL)) 3023 (void) ipf_acctpkt(fin, NULL); 3024 3025 if (fr == NULL) { 3026 if ((fin->fin_flx & FI_FRAG) != 0) 3027 fr = ipf_frag_known(fin, &pass); 3028 3029 if (fr == NULL) 3030 fr = ipf_state_check(fin, &pass); 3031 } 3032 3033 if ((pass & FR_NOMATCH) || (fr == NULL)) 3034 fr = ipf_firewall(fin, &pass); 3035 3036 /* 3037 * If we've asked to track state for this packet, set it up. 3038 * Here rather than ipf_firewall because ipf_checkauth may decide 3039 * to return a packet for "keep state" 3040 */ 3041 if ((pass & FR_KEEPSTATE) && (fin->fin_m != NULL) && 3042 !(fin->fin_flx & FI_STATE)) { 3043 if (ipf_state_add(softc, fin, NULL, 0) == 0) { 3044 LBUMP(ipf_stats[out].fr_ads); 3045 } else { 3046 LBUMP(ipf_stats[out].fr_bads); 3047 if (FR_ISPASS(pass)) { 3048 DT(frb_stateadd); 3049 pass &= ~FR_CMDMASK; 3050 pass |= FR_BLOCK; 3051 fin->fin_reason = FRB_STATEADD; 3052 } 3053 } 3054 } 3055 3056 fin->fin_fr = fr; 3057 if ((fr != NULL) && !(fin->fin_flx & FI_STATE)) { 3058 fin->fin_dif = &fr->fr_dif; 3059 fin->fin_tif = &fr->fr_tifs[fin->fin_rev]; 3060 } 3061 3062 /* 3063 * Only count/translate packets which will be passed on, out the 3064 * interface. 3065 */ 3066 if (out && FR_ISPASS(pass)) { 3067 (void) ipf_acctpkt(fin, NULL); 3068 3069 switch (fin->fin_v) 3070 { 3071 case 4 : 3072 if (ipf_nat_checkout(fin, &pass) == -1) { 3073 ; 3074 } else if ((softc->ipf_update_ipid != 0) && (v == 4)) { 3075 if (ipf_updateipid(fin) == -1) { 3076 DT(frb_updateipid); 3077 LBUMP(ipf_stats[1].fr_ipud); 3078 pass &= ~FR_CMDMASK; 3079 pass |= FR_BLOCK; 3080 fin->fin_reason = FRB_UPDATEIPID; 3081 } else { 3082 LBUMP(ipf_stats[0].fr_ipud); 3083 } 3084 } 3085 break; 3086#ifdef USE_INET6 3087 case 6 : 3088 (void) ipf_nat6_checkout(fin, &pass); 3089 break; 3090#endif 3091 default : 3092 break; 3093 } 3094 } 3095 3096filterdone: 3097#ifdef IPFILTER_LOG 3098 if ((softc->ipf_flags & FF_LOGGING) || (pass & FR_LOGMASK)) { 3099 (void) ipf_dolog(fin, &pass); 3100 } 3101#endif 3102 3103 /* 3104 * The FI_STATE flag is cleared here so that calling ipf_state_check 3105 * will work when called from inside of fr_fastroute. Although 3106 * there is a similar flag, FI_NATED, for NAT, it does have the same 3107 * impact on code execution. 3108 */ 3109 fin->fin_flx &= ~FI_STATE; 3110 3111#if defined(FASTROUTE_RECURSION) 3112 /* 3113 * Up the reference on fr_lock and exit ipf_mutex. The generation of 3114 * a packet below can sometimes cause a recursive call into IPFilter. 3115 * On those platforms where that does happen, we need to hang onto 3116 * the filter rule just in case someone decides to remove or flush it 3117 * in the meantime. 3118 */ 3119 if (fr != NULL) { 3120 MUTEX_ENTER(&fr->fr_lock); 3121 fr->fr_ref++; 3122 MUTEX_EXIT(&fr->fr_lock); 3123 } 3124 3125 RWLOCK_EXIT(&softc->ipf_mutex); 3126#endif 3127 3128 if ((pass & FR_RETMASK) != 0) { 3129 /* 3130 * Should we return an ICMP packet to indicate error 3131 * status passing through the packet filter ? 3132 * WARNING: ICMP error packets AND TCP RST packets should 3133 * ONLY be sent in repsonse to incoming packets. Sending 3134 * them in response to outbound packets can result in a 3135 * panic on some operating systems. 3136 */ 3137 if (!out) { 3138 if (pass & FR_RETICMP) { 3139 int dst; 3140 3141 if ((pass & FR_RETMASK) == FR_FAKEICMP) 3142 dst = 1; 3143 else 3144 dst = 0; 3145 (void) ipf_send_icmp_err(ICMP_UNREACH, fin, 3146 dst); 3147 LBUMP(ipf_stats[0].fr_ret); 3148 } else if (((pass & FR_RETMASK) == FR_RETRST) && 3149 !(fin->fin_flx & FI_SHORT)) { 3150 if (((fin->fin_flx & FI_OOW) != 0) || 3151 (ipf_send_reset(fin) == 0)) { 3152 LBUMP(ipf_stats[1].fr_ret); 3153 } 3154 } 3155 3156 /* 3157 * When using return-* with auth rules, the auth code 3158 * takes over disposing of this packet. 3159 */ 3160 if (FR_ISAUTH(pass) && (fin->fin_m != NULL)) { 3161 DT1(frb_authcapture, fr_info_t *, fin); 3162 fin->fin_m = *fin->fin_mp = NULL; 3163 fin->fin_reason = FRB_AUTHCAPTURE; 3164 m = NULL; 3165 } 3166 } else { 3167 if (pass & FR_RETRST) { 3168 fin->fin_error = ECONNRESET; 3169 } 3170 } 3171 } 3172 3173 /* 3174 * After the above so that ICMP unreachables and TCP RSTs get 3175 * created properly. 3176 */ 3177 if (FR_ISBLOCK(pass) && (fin->fin_flx & FI_NEWNAT)) 3178 ipf_nat_uncreate(fin); 3179 3180 /* 3181 * If we didn't drop off the bottom of the list of rules (and thus 3182 * the 'current' rule fr is not NULL), then we may have some extra 3183 * instructions about what to do with a packet. 3184 * Once we're finished return to our caller, freeing the packet if 3185 * we are dropping it. 3186 */ 3187 if (fr != NULL) { 3188 frdest_t *fdp; 3189 3190 /* 3191 * Generate a duplicated packet first because ipf_fastroute 3192 * can lead to fin_m being free'd... not good. 3193 */ 3194 fdp = fin->fin_dif; 3195 if ((fdp != NULL) && (fdp->fd_ptr != NULL) && 3196 (fdp->fd_ptr != (void *)-1)) { 3197 mc = M_COPY(fin->fin_m); 3198 if (mc != NULL) 3199 ipf_fastroute(mc, &mc, fin, fdp); 3200 } 3201 3202 fdp = fin->fin_tif; 3203 if (!out && (pass & FR_FASTROUTE)) { 3204 /* 3205 * For fastroute rule, no destination interface defined 3206 * so pass NULL as the frdest_t parameter 3207 */ 3208 (void) ipf_fastroute(fin->fin_m, mp, fin, NULL); 3209 m = *mp = NULL; 3210 } else if ((fdp != NULL) && (fdp->fd_ptr != NULL) && 3211 (fdp->fd_ptr != (struct ifnet *)-1)) { 3212 /* this is for to rules: */ 3213 ipf_fastroute(fin->fin_m, mp, fin, fdp); 3214 m = *mp = NULL; 3215 } 3216 3217#if defined(FASTROUTE_RECURSION) 3218 (void) ipf_derefrule(softc, &fr); 3219#endif 3220 } 3221#if !defined(FASTROUTE_RECURSION) 3222 RWLOCK_EXIT(&softc->ipf_mutex); 3223#endif 3224 3225finished: 3226 if (!FR_ISPASS(pass)) { 3227 LBUMP(ipf_stats[out].fr_block); 3228 if (*mp != NULL) { 3229#ifdef _KERNEL 3230 FREE_MB_T(*mp); 3231#endif 3232 m = *mp = NULL; 3233 } 3234 } else { 3235 LBUMP(ipf_stats[out].fr_pass); 3236#if defined(_KERNEL) && defined(__sgi) 3237 if ((fin->fin_hbuf != NULL) && 3238 (mtod(fin->fin_m, struct ip *) != fin->fin_ip)) { 3239 COPYBACK(fin->fin_m, 0, fin->fin_plen, fin->fin_hbuf); 3240 } 3241#endif 3242 } 3243 3244 SPL_X(s); 3245 3246#ifdef _KERNEL 3247 if (FR_ISPASS(pass)) 3248 return 0; 3249 LBUMP(ipf_stats[out].fr_blocked[fin->fin_reason]); 3250 return fin->fin_error; 3251#else /* _KERNEL */ 3252 if (*mp != NULL) 3253 (*mp)->mb_ifp = fin->fin_ifp; 3254 blockreason = fin->fin_reason; 3255 FR_VERBOSE(("fin_flx %#x pass %#x ", fin->fin_flx, pass)); 3256 /*if ((pass & FR_CMDMASK) == (softc->ipf_pass & FR_CMDMASK))*/ 3257 if ((pass & FR_NOMATCH) != 0) 3258 return 1; 3259 3260 if ((pass & FR_RETMASK) != 0) 3261 switch (pass & FR_RETMASK) 3262 { 3263 case FR_RETRST : 3264 return 3; 3265 case FR_RETICMP : 3266 return 4; 3267 case FR_FAKEICMP : 3268 return 5; 3269 } 3270 3271 switch (pass & FR_CMDMASK) 3272 { 3273 case FR_PASS : 3274 return 0; 3275 case FR_BLOCK : 3276 return -1; 3277 case FR_AUTH : 3278 return -2; 3279 case FR_ACCOUNT : 3280 return -3; 3281 case FR_PREAUTH : 3282 return -4; 3283 } 3284 return 2; 3285#endif /* _KERNEL */ 3286} 3287 3288 3289#ifdef IPFILTER_LOG 3290/* ------------------------------------------------------------------------ */ 3291/* Function: ipf_dolog */ 3292/* Returns: frentry_t* - returns contents of fin_fr (no change made) */ 3293/* Parameters: fin(I) - pointer to packet information */ 3294/* passp(IO) - pointer to current/new filter decision (unused) */ 3295/* */ 3296/* Checks flags set to see how a packet should be logged, if it is to be */ 3297/* logged. Adjust statistics based on its success or not. */ 3298/* ------------------------------------------------------------------------ */ 3299frentry_t * 3300ipf_dolog(fin, passp) 3301 fr_info_t *fin; 3302 u_32_t *passp; 3303{ 3304 ipf_main_softc_t *softc = fin->fin_main_soft; 3305 u_32_t pass; 3306 int out; 3307 3308 out = fin->fin_out; 3309 pass = *passp; 3310 3311 if ((softc->ipf_flags & FF_LOGNOMATCH) && (pass & FR_NOMATCH)) { 3312 pass |= FF_LOGNOMATCH; 3313 LBUMPD(ipf_stats[out], fr_npkl); 3314 goto logit; 3315 3316 } else if (((pass & FR_LOGMASK) == FR_LOGP) || 3317 (FR_ISPASS(pass) && (softc->ipf_flags & FF_LOGPASS))) { 3318 if ((pass & FR_LOGMASK) != FR_LOGP) 3319 pass |= FF_LOGPASS; 3320 LBUMPD(ipf_stats[out], fr_ppkl); 3321 goto logit; 3322 3323 } else if (((pass & FR_LOGMASK) == FR_LOGB) || 3324 (FR_ISBLOCK(pass) && (softc->ipf_flags & FF_LOGBLOCK))) { 3325 if ((pass & FR_LOGMASK) != FR_LOGB) 3326 pass |= FF_LOGBLOCK; 3327 LBUMPD(ipf_stats[out], fr_bpkl); 3328 3329logit: 3330 if (ipf_log_pkt(fin, pass) == -1) { 3331 /* 3332 * If the "or-block" option has been used then 3333 * block the packet if we failed to log it. 3334 */ 3335 if ((pass & FR_LOGORBLOCK) && FR_ISPASS(pass)) { 3336 DT1(frb_logfail2, u_int, pass); 3337 pass &= ~FR_CMDMASK; 3338 pass |= FR_BLOCK; 3339 fin->fin_reason = FRB_LOGFAIL2; 3340 } 3341 } 3342 *passp = pass; 3343 } 3344 3345 return fin->fin_fr; 3346} 3347#endif /* IPFILTER_LOG */ 3348 3349 3350/* ------------------------------------------------------------------------ */ 3351/* Function: ipf_cksum */ 3352/* Returns: u_short - IP header checksum */ 3353/* Parameters: addr(I) - pointer to start of buffer to checksum */ 3354/* len(I) - length of buffer in bytes */ 3355/* */ 3356/* Calculate the two's complement 16 bit checksum of the buffer passed. */ 3357/* */ 3358/* N.B.: addr should be 16bit aligned. */ 3359/* ------------------------------------------------------------------------ */ 3360u_short 3361ipf_cksum(addr, len) 3362 u_short *addr; 3363 int len; 3364{ 3365 u_32_t sum = 0; 3366 3367 for (sum = 0; len > 1; len -= 2) 3368 sum += *addr++; 3369 3370 /* mop up an odd byte, if necessary */ 3371 if (len == 1) 3372 sum += *(u_char *)addr; 3373 3374 /* 3375 * add back carry outs from top 16 bits to low 16 bits 3376 */ 3377 sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */ 3378 sum += (sum >> 16); /* add carry */ 3379 return (u_short)(~sum); 3380} 3381 3382 3383/* ------------------------------------------------------------------------ */ 3384/* Function: fr_cksum */ 3385/* Returns: u_short - layer 4 checksum */ 3386/* Parameters: fin(I) - pointer to packet information */ 3387/* ip(I) - pointer to IP header */ 3388/* l4proto(I) - protocol to caclulate checksum for */ 3389/* l4hdr(I) - pointer to layer 4 header */ 3390/* */ 3391/* Calculates the TCP checksum for the packet held in "m", using the data */ 3392/* in the IP header "ip" to seed it. */ 3393/* */ 3394/* NB: This function assumes we've pullup'd enough for all of the IP header */ 3395/* and the TCP header. We also assume that data blocks aren't allocated in */ 3396/* odd sizes. */ 3397/* */ 3398/* Expects ip_len and ip_off to be in network byte order when called. */ 3399/* ------------------------------------------------------------------------ */ 3400u_short 3401fr_cksum(fin, ip, l4proto, l4hdr) 3402 fr_info_t *fin; 3403 ip_t *ip; 3404 int l4proto; 3405 void *l4hdr; 3406{ 3407 u_short *sp, slen, sumsave, *csump; 3408 u_int sum, sum2; 3409 int hlen; 3410 int off; 3411#ifdef USE_INET6 3412 ip6_t *ip6; 3413#endif 3414 3415 csump = NULL; 3416 sumsave = 0; 3417 sp = NULL; 3418 slen = 0; 3419 hlen = 0; 3420 sum = 0; 3421 3422 sum = htons((u_short)l4proto); 3423 /* 3424 * Add up IP Header portion 3425 */ 3426#ifdef USE_INET6 3427 if (IP_V(ip) == 4) { 3428#endif 3429 hlen = IP_HL(ip) << 2; 3430 off = hlen; 3431 sp = (u_short *)&ip->ip_src; 3432 sum += *sp++; /* ip_src */ 3433 sum += *sp++; 3434 sum += *sp++; /* ip_dst */ 3435 sum += *sp++; 3436 slen = fin->fin_plen - off; 3437 sum += htons(slen); 3438#ifdef USE_INET6 3439 } else if (IP_V(ip) == 6) { 3440 mb_t *m; 3441 3442 m = fin->fin_m; 3443 ip6 = (ip6_t *)ip; 3444 off = ((caddr_t)ip6 - m->m_data) + sizeof(struct ip6_hdr); 3445 int len = ntohs(ip6->ip6_plen) - (off - sizeof(*ip6)); 3446 return(ipf_pcksum6(fin, ip6, off, len)); 3447 } else { 3448 return 0xffff; 3449 } 3450#endif 3451 3452 switch (l4proto) 3453 { 3454 case IPPROTO_UDP : 3455 csump = &((udphdr_t *)l4hdr)->uh_sum; 3456 break; 3457 3458 case IPPROTO_TCP : 3459 csump = &((tcphdr_t *)l4hdr)->th_sum; 3460 break; 3461 case IPPROTO_ICMP : 3462 csump = &((icmphdr_t *)l4hdr)->icmp_cksum; 3463 sum = 0; /* Pseudo-checksum is not included */ 3464 break; 3465#ifdef USE_INET6 3466 case IPPROTO_ICMPV6 : 3467 csump = &((struct icmp6_hdr *)l4hdr)->icmp6_cksum; 3468 break; 3469#endif 3470 default : 3471 break; 3472 } 3473 3474 if (csump != NULL) { 3475 sumsave = *csump; 3476 *csump = 0; 3477 } 3478 3479 sum2 = ipf_pcksum(fin, off, sum); 3480 if (csump != NULL) 3481 *csump = sumsave; 3482 return sum2; 3483} 3484 3485 3486/* ------------------------------------------------------------------------ */ 3487/* Function: ipf_findgroup */ 3488/* Returns: frgroup_t * - NULL = group not found, else pointer to group */ 3489/* Parameters: softc(I) - pointer to soft context main structure */ 3490/* group(I) - group name to search for */ 3491/* unit(I) - device to which this group belongs */ 3492/* set(I) - which set of rules (inactive/inactive) this is */ 3493/* fgpp(O) - pointer to place to store pointer to the pointer */ 3494/* to where to add the next (last) group or where */ 3495/* to delete group from. */ 3496/* */ 3497/* Search amongst the defined groups for a particular group number. */ 3498/* ------------------------------------------------------------------------ */ 3499frgroup_t * 3500ipf_findgroup(softc, group, unit, set, fgpp) 3501 ipf_main_softc_t *softc; 3502 char *group; 3503 minor_t unit; 3504 int set; 3505 frgroup_t ***fgpp; 3506{ 3507 frgroup_t *fg, **fgp; 3508 3509 /* 3510 * Which list of groups to search in is dependent on which list of 3511 * rules are being operated on. 3512 */ 3513 fgp = &softc->ipf_groups[unit][set]; 3514 3515 while ((fg = *fgp) != NULL) { 3516 if (strncmp(group, fg->fg_name, FR_GROUPLEN) == 0) 3517 break; 3518 else 3519 fgp = &fg->fg_next; 3520 } 3521 if (fgpp != NULL) 3522 *fgpp = fgp; 3523 return fg; 3524} 3525 3526 3527/* ------------------------------------------------------------------------ */ 3528/* Function: ipf_group_add */ 3529/* Returns: frgroup_t * - NULL == did not create group, */ 3530/* != NULL == pointer to the group */ 3531/* Parameters: softc(I) - pointer to soft context main structure */ 3532/* num(I) - group number to add */ 3533/* head(I) - rule pointer that is using this as the head */ 3534/* flags(I) - rule flags which describe the type of rule it is */ 3535/* unit(I) - device to which this group will belong to */ 3536/* set(I) - which set of rules (inactive/inactive) this is */ 3537/* Write Locks: ipf_mutex */ 3538/* */ 3539/* Add a new group head, or if it already exists, increase the reference */ 3540/* count to it. */ 3541/* ------------------------------------------------------------------------ */ 3542frgroup_t * 3543ipf_group_add(softc, group, head, flags, unit, set) 3544 ipf_main_softc_t *softc; 3545 char *group; 3546 void *head; 3547 u_32_t flags; 3548 minor_t unit; 3549 int set; 3550{ 3551 frgroup_t *fg, **fgp; 3552 u_32_t gflags; 3553 3554 if (group == NULL) 3555 return NULL; 3556 3557 if (unit == IPL_LOGIPF && *group == '\0') 3558 return NULL; 3559 3560 fgp = NULL; 3561 gflags = flags & FR_INOUT; 3562 3563 fg = ipf_findgroup(softc, group, unit, set, &fgp); 3564 if (fg != NULL) { 3565 if (fg->fg_head == NULL && head != NULL) 3566 fg->fg_head = head; 3567 if (fg->fg_flags == 0) 3568 fg->fg_flags = gflags; 3569 else if (gflags != fg->fg_flags) 3570 return NULL; 3571 fg->fg_ref++; 3572 return fg; 3573 } 3574 3575 KMALLOC(fg, frgroup_t *); 3576 if (fg != NULL) { 3577 fg->fg_head = head; 3578 fg->fg_start = NULL; 3579 fg->fg_next = *fgp; 3580 bcopy(group, fg->fg_name, strlen(group) + 1); 3581 fg->fg_flags = gflags; 3582 fg->fg_ref = 1; 3583 fg->fg_set = &softc->ipf_groups[unit][set]; 3584 *fgp = fg; 3585 } 3586 return fg; 3587} 3588 3589 3590/* ------------------------------------------------------------------------ */ 3591/* Function: ipf_group_del */ 3592/* Returns: int - number of rules deleted */ 3593/* Parameters: softc(I) - pointer to soft context main structure */ 3594/* group(I) - group name to delete */ 3595/* fr(I) - filter rule from which group is referenced */ 3596/* Write Locks: ipf_mutex */ 3597/* */ 3598/* This function is called whenever a reference to a group is to be dropped */ 3599/* and thus its reference count needs to be lowered and the group free'd if */ 3600/* the reference count reaches zero. Passing in fr is really for the sole */ 3601/* purpose of knowing when the head rule is being deleted. */ 3602/* ------------------------------------------------------------------------ */ 3603void 3604ipf_group_del(softc, group, fr) 3605 ipf_main_softc_t *softc; 3606 frgroup_t *group; 3607 frentry_t *fr; 3608{ 3609 3610 if (group->fg_head == fr) 3611 group->fg_head = NULL; 3612 3613 group->fg_ref--; 3614 if ((group->fg_ref == 0) && (group->fg_start == NULL)) 3615 ipf_group_free(group); 3616} 3617 3618 3619/* ------------------------------------------------------------------------ */ 3620/* Function: ipf_group_free */ 3621/* Returns: Nil */ 3622/* Parameters: group(I) - pointer to filter rule group */ 3623/* */ 3624/* Remove the group from the list of groups and free it. */ 3625/* ------------------------------------------------------------------------ */ 3626static void 3627ipf_group_free(group) 3628 frgroup_t *group; 3629{ 3630 frgroup_t **gp; 3631 3632 for (gp = group->fg_set; *gp != NULL; gp = &(*gp)->fg_next) { 3633 if (*gp == group) { 3634 *gp = group->fg_next; 3635 break; 3636 } 3637 } 3638 KFREE(group); 3639} 3640 3641 3642/* ------------------------------------------------------------------------ */ 3643/* Function: ipf_group_flush */ 3644/* Returns: int - number of rules flush from group */ 3645/* Parameters: softc(I) - pointer to soft context main structure */ 3646/* Parameters: group(I) - pointer to filter rule group */ 3647/* */ 3648/* Remove all of the rules that currently are listed under the given group. */ 3649/* ------------------------------------------------------------------------ */ 3650static int 3651ipf_group_flush(softc, group) 3652 ipf_main_softc_t *softc; 3653 frgroup_t *group; 3654{ 3655 int gone = 0; 3656 3657 (void) ipf_flushlist(softc, &gone, &group->fg_start); 3658 3659 return gone; 3660} 3661 3662 3663/* ------------------------------------------------------------------------ */ 3664/* Function: ipf_getrulen */ 3665/* Returns: frentry_t * - NULL == not found, else pointer to rule n */ 3666/* Parameters: softc(I) - pointer to soft context main structure */ 3667/* Parameters: unit(I) - device for which to count the rule's number */ 3668/* flags(I) - which set of rules to find the rule in */ 3669/* group(I) - group name */ 3670/* n(I) - rule number to find */ 3671/* */ 3672/* Find rule # n in group # g and return a pointer to it. Return NULl if */ 3673/* group # g doesn't exist or there are less than n rules in the group. */ 3674/* ------------------------------------------------------------------------ */ 3675frentry_t * 3676ipf_getrulen(softc, unit, group, n) 3677 ipf_main_softc_t *softc; 3678 int unit; 3679 char *group; 3680 u_32_t n; 3681{ 3682 frentry_t *fr; 3683 frgroup_t *fg; 3684 3685 fg = ipf_findgroup(softc, group, unit, softc->ipf_active, NULL); 3686 if (fg == NULL) 3687 return NULL; 3688 for (fr = fg->fg_start; fr && n; fr = fr->fr_next, n--) 3689 ; 3690 if (n != 0) 3691 return NULL; 3692 return fr; 3693} 3694 3695 3696/* ------------------------------------------------------------------------ */ 3697/* Function: ipf_flushlist */ 3698/* Returns: int - >= 0 - number of flushed rules */ 3699/* Parameters: softc(I) - pointer to soft context main structure */ 3700/* nfreedp(O) - pointer to int where flush count is stored */ 3701/* listp(I) - pointer to list to flush pointer */ 3702/* Write Locks: ipf_mutex */ 3703/* */ 3704/* Recursively flush rules from the list, descending groups as they are */ 3705/* encountered. if a rule is the head of a group and it has lost all its */ 3706/* group members, then also delete the group reference. nfreedp is needed */ 3707/* to store the accumulating count of rules removed, whereas the returned */ 3708/* value is just the number removed from the current list. The latter is */ 3709/* needed to correctly adjust reference counts on rules that define groups. */ 3710/* */ 3711/* NOTE: Rules not loaded from user space cannot be flushed. */ 3712/* ------------------------------------------------------------------------ */ 3713static int 3714ipf_flushlist(softc, nfreedp, listp) 3715 ipf_main_softc_t *softc; 3716 int *nfreedp; 3717 frentry_t **listp; 3718{ 3719 int freed = 0; 3720 frentry_t *fp; 3721 3722 while ((fp = *listp) != NULL) { 3723 if ((fp->fr_type & FR_T_BUILTIN) || 3724 !(fp->fr_flags & FR_COPIED)) { 3725 listp = &fp->fr_next; 3726 continue; 3727 } 3728 *listp = fp->fr_next; 3729 if (fp->fr_next != NULL) 3730 fp->fr_next->fr_pnext = fp->fr_pnext; 3731 fp->fr_pnext = NULL; 3732 3733 if (fp->fr_grphead != NULL) { 3734 freed += ipf_group_flush(softc, fp->fr_grphead); 3735 fp->fr_names[fp->fr_grhead] = '\0'; 3736 } 3737 3738 if (fp->fr_icmpgrp != NULL) { 3739 freed += ipf_group_flush(softc, fp->fr_icmpgrp); 3740 fp->fr_names[fp->fr_icmphead] = '\0'; 3741 } 3742 3743 if (fp->fr_srctrack.ht_max_nodes) 3744 ipf_rb_ht_flush(&fp->fr_srctrack); 3745 3746 fp->fr_next = NULL; 3747 3748 ASSERT(fp->fr_ref > 0); 3749 if (ipf_derefrule(softc, &fp) == 0) 3750 freed++; 3751 } 3752 *nfreedp += freed; 3753 return freed; 3754} 3755 3756 3757/* ------------------------------------------------------------------------ */ 3758/* Function: ipf_flush */ 3759/* Returns: int - >= 0 - number of flushed rules */ 3760/* Parameters: softc(I) - pointer to soft context main structure */ 3761/* unit(I) - device for which to flush rules */ 3762/* flags(I) - which set of rules to flush */ 3763/* */ 3764/* Calls flushlist() for all filter rules (accounting, firewall - both IPv4 */ 3765/* and IPv6) as defined by the value of flags. */ 3766/* ------------------------------------------------------------------------ */ 3767int 3768ipf_flush(softc, unit, flags) 3769 ipf_main_softc_t *softc; 3770 minor_t unit; 3771 int flags; 3772{ 3773 int flushed = 0, set; 3774 3775 WRITE_ENTER(&softc->ipf_mutex); 3776 3777 set = softc->ipf_active; 3778 if ((flags & FR_INACTIVE) == FR_INACTIVE) 3779 set = 1 - set; 3780 3781 if (flags & FR_OUTQUE) { 3782 ipf_flushlist(softc, &flushed, &softc->ipf_rules[1][set]); 3783 ipf_flushlist(softc, &flushed, &softc->ipf_acct[1][set]); 3784 } 3785 if (flags & FR_INQUE) { 3786 ipf_flushlist(softc, &flushed, &softc->ipf_rules[0][set]); 3787 ipf_flushlist(softc, &flushed, &softc->ipf_acct[0][set]); 3788 } 3789 3790 flushed += ipf_flush_groups(softc, &softc->ipf_groups[unit][set], 3791 flags & (FR_INQUE|FR_OUTQUE)); 3792 3793 RWLOCK_EXIT(&softc->ipf_mutex); 3794 3795 if (unit == IPL_LOGIPF) { 3796 int tmp; 3797 3798 tmp = ipf_flush(softc, IPL_LOGCOUNT, flags); 3799 if (tmp >= 0) 3800 flushed += tmp; 3801 } 3802 return flushed; 3803} 3804 3805 3806/* ------------------------------------------------------------------------ */ 3807/* Function: ipf_flush_groups */ 3808/* Returns: int - >= 0 - number of flushed rules */ 3809/* Parameters: softc(I) - soft context pointerto work with */ 3810/* grhead(I) - pointer to the start of the group list to flush */ 3811/* flags(I) - which set of rules to flush */ 3812/* */ 3813/* Walk through all of the groups under the given group head and remove all */ 3814/* of those that match the flags passed in. The for loop here is bit more */ 3815/* complicated than usual because the removal of a rule with ipf_derefrule */ 3816/* may end up removing not only the structure pointed to by "fg" but also */ 3817/* what is fg_next and fg_next after that. So if a filter rule is actually */ 3818/* removed from the group then it is necessary to start again. */ 3819/* ------------------------------------------------------------------------ */ 3820static int 3821ipf_flush_groups(softc, grhead, flags) 3822 ipf_main_softc_t *softc; 3823 frgroup_t **grhead; 3824 int flags; 3825{ 3826 frentry_t *fr, **frp; 3827 frgroup_t *fg, **fgp; 3828 int flushed = 0; 3829 int removed = 0; 3830 3831 for (fgp = grhead; (fg = *fgp) != NULL; ) { 3832 while ((fg != NULL) && ((fg->fg_flags & flags) == 0)) 3833 fg = fg->fg_next; 3834 if (fg == NULL) 3835 break; 3836 removed = 0; 3837 frp = &fg->fg_start; 3838 while ((removed == 0) && ((fr = *frp) != NULL)) { 3839 if ((fr->fr_flags & flags) == 0) { 3840 frp = &fr->fr_next; 3841 } else { 3842 if (fr->fr_next != NULL) 3843 fr->fr_next->fr_pnext = fr->fr_pnext; 3844 *frp = fr->fr_next; 3845 fr->fr_pnext = NULL; 3846 fr->fr_next = NULL; 3847 (void) ipf_derefrule(softc, &fr); 3848 flushed++; 3849 removed++; 3850 } 3851 } 3852 if (removed == 0) 3853 fgp = &fg->fg_next; 3854 } 3855 return flushed; 3856} 3857 3858 3859/* ------------------------------------------------------------------------ */ 3860/* Function: memstr */ 3861/* Returns: char * - NULL if failed, != NULL pointer to matching bytes */ 3862/* Parameters: src(I) - pointer to byte sequence to match */ 3863/* dst(I) - pointer to byte sequence to search */ 3864/* slen(I) - match length */ 3865/* dlen(I) - length available to search in */ 3866/* */ 3867/* Search dst for a sequence of bytes matching those at src and extend for */ 3868/* slen bytes. */ 3869/* ------------------------------------------------------------------------ */ 3870char * 3871memstr(src, dst, slen, dlen) 3872 const char *src; 3873 char *dst; 3874 size_t slen, dlen; 3875{ 3876 char *s = NULL; 3877 3878 while (dlen >= slen) { 3879 if (bcmp(src, dst, slen) == 0) { 3880 s = dst; 3881 break; 3882 } 3883 dst++; 3884 dlen--; 3885 } 3886 return s; 3887} 3888/* ------------------------------------------------------------------------ */ 3889/* Function: ipf_fixskip */ 3890/* Returns: Nil */ 3891/* Parameters: listp(IO) - pointer to start of list with skip rule */ 3892/* rp(I) - rule added/removed with skip in it. */ 3893/* addremove(I) - adjustment (-1/+1) to make to skip count, */ 3894/* depending on whether a rule was just added */ 3895/* or removed. */ 3896/* */ 3897/* Adjust all the rules in a list which would have skip'd past the position */ 3898/* where we are inserting to skip to the right place given the change. */ 3899/* ------------------------------------------------------------------------ */ 3900void 3901ipf_fixskip(listp, rp, addremove) 3902 frentry_t **listp, *rp; 3903 int addremove; 3904{ 3905 int rules, rn; 3906 frentry_t *fp; 3907 3908 rules = 0; 3909 for (fp = *listp; (fp != NULL) && (fp != rp); fp = fp->fr_next) 3910 rules++; 3911 3912 if (!fp) 3913 return; 3914 3915 for (rn = 0, fp = *listp; fp && (fp != rp); fp = fp->fr_next, rn++) 3916 if (FR_ISSKIP(fp->fr_flags) && (rn + fp->fr_arg >= rules)) 3917 fp->fr_arg += addremove; 3918} 3919 3920 3921#ifdef _KERNEL 3922/* ------------------------------------------------------------------------ */ 3923/* Function: count4bits */ 3924/* Returns: int - >= 0 - number of consecutive bits in input */ 3925/* Parameters: ip(I) - 32bit IP address */ 3926/* */ 3927/* IPv4 ONLY */ 3928/* count consecutive 1's in bit mask. If the mask generated by counting */ 3929/* consecutive 1's is different to that passed, return -1, else return # */ 3930/* of bits. */ 3931/* ------------------------------------------------------------------------ */ 3932int 3933count4bits(ip) 3934 u_32_t ip; 3935{ 3936 u_32_t ipn; 3937 int cnt = 0, i, j; 3938 3939 ip = ipn = ntohl(ip); 3940 for (i = 32; i; i--, ipn *= 2) 3941 if (ipn & 0x80000000) 3942 cnt++; 3943 else 3944 break; 3945 ipn = 0; 3946 for (i = 32, j = cnt; i; i--, j--) { 3947 ipn *= 2; 3948 if (j > 0) 3949 ipn++; 3950 } 3951 if (ipn == ip) 3952 return cnt; 3953 return -1; 3954} 3955 3956 3957/* ------------------------------------------------------------------------ */ 3958/* Function: count6bits */ 3959/* Returns: int - >= 0 - number of consecutive bits in input */ 3960/* Parameters: msk(I) - pointer to start of IPv6 bitmask */ 3961/* */ 3962/* IPv6 ONLY */ 3963/* count consecutive 1's in bit mask. */ 3964/* ------------------------------------------------------------------------ */ 3965# ifdef USE_INET6 3966int 3967count6bits(msk) 3968 u_32_t *msk; 3969{ 3970 int i = 0, k; 3971 u_32_t j; 3972 3973 for (k = 3; k >= 0; k--) 3974 if (msk[k] == 0xffffffff) 3975 i += 32; 3976 else { 3977 for (j = msk[k]; j; j <<= 1) 3978 if (j & 0x80000000) 3979 i++; 3980 } 3981 return i; 3982} 3983# endif 3984#endif /* _KERNEL */ 3985 3986 3987/* ------------------------------------------------------------------------ */ 3988/* Function: ipf_synclist */ 3989/* Returns: int - 0 = no failures, else indication of first failure */ 3990/* Parameters: fr(I) - start of filter list to sync interface names for */ 3991/* ifp(I) - interface pointer for limiting sync lookups */ 3992/* Write Locks: ipf_mutex */ 3993/* */ 3994/* Walk through a list of filter rules and resolve any interface names into */ 3995/* pointers. Where dynamic addresses are used, also update the IP address */ 3996/* used in the rule. The interface pointer is used to limit the lookups to */ 3997/* a specific set of matching names if it is non-NULL. */ 3998/* Errors can occur when resolving the destination name of to/dup-to fields */ 3999/* when the name points to a pool and that pool doest not exist. If this */ 4000/* does happen then it is necessary to check if there are any lookup refs */ 4001/* that need to be dropped before returning with an error. */ 4002/* ------------------------------------------------------------------------ */ 4003static int 4004ipf_synclist(softc, fr, ifp) 4005 ipf_main_softc_t *softc; 4006 frentry_t *fr; 4007 void *ifp; 4008{ 4009 frentry_t *frt, *start = fr; 4010 frdest_t *fdp; 4011 char *name; 4012 int error; 4013 void *ifa; 4014 int v, i; 4015 4016 error = 0; 4017 4018 for (; fr; fr = fr->fr_next) { 4019 if (fr->fr_family == AF_INET) 4020 v = 4; 4021 else if (fr->fr_family == AF_INET6) 4022 v = 6; 4023 else 4024 v = 0; 4025 4026 /* 4027 * Lookup all the interface names that are part of the rule. 4028 */ 4029 for (i = 0; i < 4; i++) { 4030 if ((ifp != NULL) && (fr->fr_ifas[i] != ifp)) 4031 continue; 4032 if (fr->fr_ifnames[i] == -1) 4033 continue; 4034 name = FR_NAME(fr, fr_ifnames[i]); 4035 fr->fr_ifas[i] = ipf_resolvenic(softc, name, v); 4036 } 4037 4038 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) { 4039 if (fr->fr_satype != FRI_NORMAL && 4040 fr->fr_satype != FRI_LOOKUP) { 4041 ifa = ipf_resolvenic(softc, fr->fr_names + 4042 fr->fr_sifpidx, v); 4043 ipf_ifpaddr(softc, v, fr->fr_satype, ifa, 4044 &fr->fr_src6, &fr->fr_smsk6); 4045 } 4046 if (fr->fr_datype != FRI_NORMAL && 4047 fr->fr_datype != FRI_LOOKUP) { 4048 ifa = ipf_resolvenic(softc, fr->fr_names + 4049 fr->fr_sifpidx, v); 4050 ipf_ifpaddr(softc, v, fr->fr_datype, ifa, 4051 &fr->fr_dst6, &fr->fr_dmsk6); 4052 } 4053 } 4054 4055 fdp = &fr->fr_tifs[0]; 4056 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) { 4057 error = ipf_resolvedest(softc, fr->fr_names, fdp, v); 4058 if (error != 0) 4059 goto unwind; 4060 } 4061 4062 fdp = &fr->fr_tifs[1]; 4063 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) { 4064 error = ipf_resolvedest(softc, fr->fr_names, fdp, v); 4065 if (error != 0) 4066 goto unwind; 4067 } 4068 4069 fdp = &fr->fr_dif; 4070 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) { 4071 error = ipf_resolvedest(softc, fr->fr_names, fdp, v); 4072 if (error != 0) 4073 goto unwind; 4074 } 4075 4076 if (((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4077 (fr->fr_satype == FRI_LOOKUP) && (fr->fr_srcptr == NULL)) { 4078 fr->fr_srcptr = ipf_lookup_res_num(softc, 4079 fr->fr_srctype, 4080 IPL_LOGIPF, 4081 fr->fr_srcnum, 4082 &fr->fr_srcfunc); 4083 } 4084 if (((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4085 (fr->fr_datype == FRI_LOOKUP) && (fr->fr_dstptr == NULL)) { 4086 fr->fr_dstptr = ipf_lookup_res_num(softc, 4087 fr->fr_dsttype, 4088 IPL_LOGIPF, 4089 fr->fr_dstnum, 4090 &fr->fr_dstfunc); 4091 } 4092 } 4093 return 0; 4094 4095unwind: 4096 for (frt = start; frt != fr; fr = fr->fr_next) { 4097 if (((frt->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4098 (frt->fr_satype == FRI_LOOKUP) && (frt->fr_srcptr != NULL)) 4099 ipf_lookup_deref(softc, frt->fr_srctype, 4100 frt->fr_srcptr); 4101 if (((frt->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4102 (frt->fr_datype == FRI_LOOKUP) && (frt->fr_dstptr != NULL)) 4103 ipf_lookup_deref(softc, frt->fr_dsttype, 4104 frt->fr_dstptr); 4105 } 4106 return error; 4107} 4108 4109 4110/* ------------------------------------------------------------------------ */ 4111/* Function: ipf_sync */ 4112/* Returns: void */ 4113/* Parameters: Nil */ 4114/* */ 4115/* ipf_sync() is called when we suspect that the interface list or */ 4116/* information about interfaces (like IP#) has changed. Go through all */ 4117/* filter rules, NAT entries and the state table and check if anything */ 4118/* needs to be changed/updated. */ 4119/* ------------------------------------------------------------------------ */ 4120int 4121ipf_sync(softc, ifp) 4122 ipf_main_softc_t *softc; 4123 void *ifp; 4124{ 4125 int i; 4126 4127# if !SOLARIS 4128 ipf_nat_sync(softc, ifp); 4129 ipf_state_sync(softc, ifp); 4130 ipf_lookup_sync(softc, ifp); 4131# endif 4132 4133 WRITE_ENTER(&softc->ipf_mutex); 4134 (void) ipf_synclist(softc, softc->ipf_acct[0][softc->ipf_active], ifp); 4135 (void) ipf_synclist(softc, softc->ipf_acct[1][softc->ipf_active], ifp); 4136 (void) ipf_synclist(softc, softc->ipf_rules[0][softc->ipf_active], ifp); 4137 (void) ipf_synclist(softc, softc->ipf_rules[1][softc->ipf_active], ifp); 4138 4139 for (i = 0; i < IPL_LOGSIZE; i++) { 4140 frgroup_t *g; 4141 4142 for (g = softc->ipf_groups[i][0]; g != NULL; g = g->fg_next) 4143 (void) ipf_synclist(softc, g->fg_start, ifp); 4144 for (g = softc->ipf_groups[i][1]; g != NULL; g = g->fg_next) 4145 (void) ipf_synclist(softc, g->fg_start, ifp); 4146 } 4147 RWLOCK_EXIT(&softc->ipf_mutex); 4148 4149 return 0; 4150} 4151 4152 4153/* 4154 * In the functions below, bcopy() is called because the pointer being 4155 * copied _from_ in this instance is a pointer to a char buf (which could 4156 * end up being unaligned) and on the kernel's local stack. 4157 */ 4158/* ------------------------------------------------------------------------ */ 4159/* Function: copyinptr */ 4160/* Returns: int - 0 = success, else failure */ 4161/* Parameters: src(I) - pointer to the source address */ 4162/* dst(I) - destination address */ 4163/* size(I) - number of bytes to copy */ 4164/* */ 4165/* Copy a block of data in from user space, given a pointer to the pointer */ 4166/* to start copying from (src) and a pointer to where to store it (dst). */ 4167/* NB: src - pointer to user space pointer, dst - kernel space pointer */ 4168/* ------------------------------------------------------------------------ */ 4169int 4170copyinptr(softc, src, dst, size) 4171 ipf_main_softc_t *softc; 4172 void *src, *dst; 4173 size_t size; 4174{ 4175 caddr_t ca; 4176 int error; 4177 4178# if SOLARIS 4179 error = COPYIN(src, &ca, sizeof(ca)); 4180 if (error != 0) 4181 return error; 4182# else 4183 bcopy(src, (caddr_t)&ca, sizeof(ca)); 4184# endif 4185 error = COPYIN(ca, dst, size); 4186 if (error != 0) { 4187 IPFERROR(3); 4188 error = EFAULT; 4189 } 4190 return error; 4191} 4192 4193 4194/* ------------------------------------------------------------------------ */ 4195/* Function: copyoutptr */ 4196/* Returns: int - 0 = success, else failure */ 4197/* Parameters: src(I) - pointer to the source address */ 4198/* dst(I) - destination address */ 4199/* size(I) - number of bytes to copy */ 4200/* */ 4201/* Copy a block of data out to user space, given a pointer to the pointer */ 4202/* to start copying from (src) and a pointer to where to store it (dst). */ 4203/* NB: src - kernel space pointer, dst - pointer to user space pointer. */ 4204/* ------------------------------------------------------------------------ */ 4205int 4206copyoutptr(softc, src, dst, size) 4207 ipf_main_softc_t *softc; 4208 void *src, *dst; 4209 size_t size; 4210{ 4211 caddr_t ca; 4212 int error; 4213 4214 bcopy(dst, (caddr_t)&ca, sizeof(ca)); 4215 error = COPYOUT(src, ca, size); 4216 if (error != 0) { 4217 IPFERROR(4); 4218 error = EFAULT; 4219 } 4220 return error; 4221} 4222 4223 4224/* ------------------------------------------------------------------------ */ 4225/* Function: ipf_lock */ 4226/* Returns: int - 0 = success, else error */ 4227/* Parameters: data(I) - pointer to lock value to set */ 4228/* lockp(O) - pointer to location to store old lock value */ 4229/* */ 4230/* Get the new value for the lock integer, set it and return the old value */ 4231/* in *lockp. */ 4232/* ------------------------------------------------------------------------ */ 4233int 4234ipf_lock(data, lockp) 4235 caddr_t data; 4236 int *lockp; 4237{ 4238 int arg, err; 4239 4240 err = BCOPYIN(data, &arg, sizeof(arg)); 4241 if (err != 0) 4242 return EFAULT; 4243 err = BCOPYOUT(lockp, data, sizeof(*lockp)); 4244 if (err != 0) 4245 return EFAULT; 4246 *lockp = arg; 4247 return 0; 4248} 4249 4250 4251/* ------------------------------------------------------------------------ */ 4252/* Function: ipf_getstat */ 4253/* Returns: Nil */ 4254/* Parameters: softc(I) - pointer to soft context main structure */ 4255/* fiop(I) - pointer to ipfilter stats structure */ 4256/* rev(I) - version claim by program doing ioctl */ 4257/* */ 4258/* Stores a copy of current pointers, counters, etc, in the friostat */ 4259/* structure. */ 4260/* If IPFILTER_COMPAT is compiled, we pretend to be whatever version the */ 4261/* program is looking for. This ensure that validation of the version it */ 4262/* expects will always succeed. Thus kernels with IPFILTER_COMPAT will */ 4263/* allow older binaries to work but kernels without it will not. */ 4264/* ------------------------------------------------------------------------ */ 4265/*ARGSUSED*/ 4266static void 4267ipf_getstat(softc, fiop, rev) 4268 ipf_main_softc_t *softc; 4269 friostat_t *fiop; 4270 int rev; 4271{ 4272 int i; 4273 4274 bcopy((char *)softc->ipf_stats, (char *)fiop->f_st, 4275 sizeof(ipf_statistics_t) * 2); 4276 fiop->f_locks[IPL_LOGSTATE] = -1; 4277 fiop->f_locks[IPL_LOGNAT] = -1; 4278 fiop->f_locks[IPL_LOGIPF] = -1; 4279 fiop->f_locks[IPL_LOGAUTH] = -1; 4280 4281 fiop->f_ipf[0][0] = softc->ipf_rules[0][0]; 4282 fiop->f_acct[0][0] = softc->ipf_acct[0][0]; 4283 fiop->f_ipf[0][1] = softc->ipf_rules[0][1]; 4284 fiop->f_acct[0][1] = softc->ipf_acct[0][1]; 4285 fiop->f_ipf[1][0] = softc->ipf_rules[1][0]; 4286 fiop->f_acct[1][0] = softc->ipf_acct[1][0]; 4287 fiop->f_ipf[1][1] = softc->ipf_rules[1][1]; 4288 fiop->f_acct[1][1] = softc->ipf_acct[1][1]; 4289 4290 fiop->f_ticks = softc->ipf_ticks; 4291 fiop->f_active = softc->ipf_active; 4292 fiop->f_froute[0] = softc->ipf_frouteok[0]; 4293 fiop->f_froute[1] = softc->ipf_frouteok[1]; 4294 fiop->f_rb_no_mem = softc->ipf_rb_no_mem; 4295 fiop->f_rb_node_max = softc->ipf_rb_node_max; 4296 4297 fiop->f_running = softc->ipf_running; 4298 for (i = 0; i < IPL_LOGSIZE; i++) { 4299 fiop->f_groups[i][0] = softc->ipf_groups[i][0]; 4300 fiop->f_groups[i][1] = softc->ipf_groups[i][1]; 4301 } 4302#ifdef IPFILTER_LOG 4303 fiop->f_log_ok = ipf_log_logok(softc, IPL_LOGIPF); 4304 fiop->f_log_fail = ipf_log_failures(softc, IPL_LOGIPF); 4305 fiop->f_logging = 1; 4306#else 4307 fiop->f_log_ok = 0; 4308 fiop->f_log_fail = 0; 4309 fiop->f_logging = 0; 4310#endif 4311 fiop->f_defpass = softc->ipf_pass; 4312 fiop->f_features = ipf_features; 4313 4314#ifdef IPFILTER_COMPAT 4315 sprintf(fiop->f_version, "IP Filter: v%d.%d.%d", 4316 (rev / 1000000) % 100, 4317 (rev / 10000) % 100, 4318 (rev / 100) % 100); 4319#else 4320 rev = rev; 4321 (void) strncpy(fiop->f_version, ipfilter_version, 4322 sizeof(fiop->f_version)); 4323#endif 4324} 4325 4326 4327#ifdef USE_INET6 4328int icmptoicmp6types[ICMP_MAXTYPE+1] = { 4329 ICMP6_ECHO_REPLY, /* 0: ICMP_ECHOREPLY */ 4330 -1, /* 1: UNUSED */ 4331 -1, /* 2: UNUSED */ 4332 ICMP6_DST_UNREACH, /* 3: ICMP_UNREACH */ 4333 -1, /* 4: ICMP_SOURCEQUENCH */ 4334 ND_REDIRECT, /* 5: ICMP_REDIRECT */ 4335 -1, /* 6: UNUSED */ 4336 -1, /* 7: UNUSED */ 4337 ICMP6_ECHO_REQUEST, /* 8: ICMP_ECHO */ 4338 -1, /* 9: UNUSED */ 4339 -1, /* 10: UNUSED */ 4340 ICMP6_TIME_EXCEEDED, /* 11: ICMP_TIMXCEED */ 4341 ICMP6_PARAM_PROB, /* 12: ICMP_PARAMPROB */ 4342 -1, /* 13: ICMP_TSTAMP */ 4343 -1, /* 14: ICMP_TSTAMPREPLY */ 4344 -1, /* 15: ICMP_IREQ */ 4345 -1, /* 16: ICMP_IREQREPLY */ 4346 -1, /* 17: ICMP_MASKREQ */ 4347 -1, /* 18: ICMP_MASKREPLY */ 4348}; 4349 4350 4351int icmptoicmp6unreach[ICMP_MAX_UNREACH] = { 4352 ICMP6_DST_UNREACH_ADDR, /* 0: ICMP_UNREACH_NET */ 4353 ICMP6_DST_UNREACH_ADDR, /* 1: ICMP_UNREACH_HOST */ 4354 -1, /* 2: ICMP_UNREACH_PROTOCOL */ 4355 ICMP6_DST_UNREACH_NOPORT, /* 3: ICMP_UNREACH_PORT */ 4356 -1, /* 4: ICMP_UNREACH_NEEDFRAG */ 4357 ICMP6_DST_UNREACH_NOTNEIGHBOR, /* 5: ICMP_UNREACH_SRCFAIL */ 4358 ICMP6_DST_UNREACH_ADDR, /* 6: ICMP_UNREACH_NET_UNKNOWN */ 4359 ICMP6_DST_UNREACH_ADDR, /* 7: ICMP_UNREACH_HOST_UNKNOWN */ 4360 -1, /* 8: ICMP_UNREACH_ISOLATED */ 4361 ICMP6_DST_UNREACH_ADMIN, /* 9: ICMP_UNREACH_NET_PROHIB */ 4362 ICMP6_DST_UNREACH_ADMIN, /* 10: ICMP_UNREACH_HOST_PROHIB */ 4363 -1, /* 11: ICMP_UNREACH_TOSNET */ 4364 -1, /* 12: ICMP_UNREACH_TOSHOST */ 4365 ICMP6_DST_UNREACH_ADMIN, /* 13: ICMP_UNREACH_ADMIN_PROHIBIT */ 4366}; 4367int icmpreplytype6[ICMP6_MAXTYPE + 1]; 4368#endif 4369 4370int icmpreplytype4[ICMP_MAXTYPE + 1]; 4371 4372 4373/* ------------------------------------------------------------------------ */ 4374/* Function: ipf_matchicmpqueryreply */ 4375/* Returns: int - 1 if "icmp" is a valid reply to "ic" else 0. */ 4376/* Parameters: v(I) - IP protocol version (4 or 6) */ 4377/* ic(I) - ICMP information */ 4378/* icmp(I) - ICMP packet header */ 4379/* rev(I) - direction (0 = forward/1 = reverse) of packet */ 4380/* */ 4381/* Check if the ICMP packet defined by the header pointed to by icmp is a */ 4382/* reply to one as described by what's in ic. If it is a match, return 1, */ 4383/* else return 0 for no match. */ 4384/* ------------------------------------------------------------------------ */ 4385int 4386ipf_matchicmpqueryreply(v, ic, icmp, rev) 4387 int v; 4388 icmpinfo_t *ic; 4389 icmphdr_t *icmp; 4390 int rev; 4391{ 4392 int ictype; 4393 4394 ictype = ic->ici_type; 4395 4396 if (v == 4) { 4397 /* 4398 * If we matched its type on the way in, then when going out 4399 * it will still be the same type. 4400 */ 4401 if ((!rev && (icmp->icmp_type == ictype)) || 4402 (rev && (icmpreplytype4[ictype] == icmp->icmp_type))) { 4403 if (icmp->icmp_type != ICMP_ECHOREPLY) 4404 return 1; 4405 if (icmp->icmp_id == ic->ici_id) 4406 return 1; 4407 } 4408 } 4409#ifdef USE_INET6 4410 else if (v == 6) { 4411 if ((!rev && (icmp->icmp_type == ictype)) || 4412 (rev && (icmpreplytype6[ictype] == icmp->icmp_type))) { 4413 if (icmp->icmp_type != ICMP6_ECHO_REPLY) 4414 return 1; 4415 if (icmp->icmp_id == ic->ici_id) 4416 return 1; 4417 } 4418 } 4419#endif 4420 return 0; 4421} 4422 4423 4424/* ------------------------------------------------------------------------ */ 4425/* Function: ipf_rule_compare */ 4426/* Parameters: fr1(I) - first rule structure to compare */ 4427/* fr2(I) - second rule structure to compare */ 4428/* Returns: int - 0 == rules are the same, else mismatch */ 4429/* */ 4430/* Compare two rules and return 0 if they match or a number indicating */ 4431/* which of the individual checks failed. */ 4432/* ------------------------------------------------------------------------ */ 4433static int 4434ipf_rule_compare(frentry_t *fr1, frentry_t *fr2) 4435{ 4436 if (fr1->fr_cksum != fr2->fr_cksum) 4437 return 1; 4438 if (fr1->fr_size != fr2->fr_size) 4439 return 2; 4440 if (fr1->fr_dsize != fr2->fr_dsize) 4441 return 3; 4442 if (bcmp((char *)&fr1->fr_func, (char *)&fr2->fr_func, 4443 fr1->fr_size - offsetof(struct frentry, fr_func)) != 0) 4444 return 4; 4445 if (fr1->fr_data && !fr2->fr_data) 4446 return 5; 4447 if (!fr1->fr_data && fr2->fr_data) 4448 return 6; 4449 if (fr1->fr_data) { 4450 if (bcmp(fr1->fr_caddr, fr2->fr_caddr, fr1->fr_dsize)) 4451 return 7; 4452 } 4453 return 0; 4454} 4455 4456 4457/* ------------------------------------------------------------------------ */ 4458/* Function: frrequest */ 4459/* Returns: int - 0 == success, > 0 == errno value */ 4460/* Parameters: unit(I) - device for which this is for */ 4461/* req(I) - ioctl command (SIOC*) */ 4462/* data(I) - pointr to ioctl data */ 4463/* set(I) - 1 or 0 (filter set) */ 4464/* makecopy(I) - flag indicating whether data points to a rule */ 4465/* in kernel space & hence doesn't need copying. */ 4466/* */ 4467/* This function handles all the requests which operate on the list of */ 4468/* filter rules. This includes adding, deleting, insertion. It is also */ 4469/* responsible for creating groups when a "head" rule is loaded. Interface */ 4470/* names are resolved here and other sanity checks are made on the content */ 4471/* of the rule structure being loaded. If a rule has user defined timeouts */ 4472/* then make sure they are created and initialised before exiting. */ 4473/* ------------------------------------------------------------------------ */ 4474int 4475frrequest(softc, unit, req, data, set, makecopy) 4476 ipf_main_softc_t *softc; 4477 int unit; 4478 ioctlcmd_t req; 4479 int set, makecopy; 4480 caddr_t data; 4481{ 4482 int error = 0, in, family, addrem, need_free = 0; 4483 frentry_t frd, *fp, *f, **fprev, **ftail; 4484 void *ptr, *uptr, *cptr; 4485 u_int *p, *pp; 4486 frgroup_t *fg; 4487 char *group; 4488 4489 ptr = NULL; 4490 cptr = NULL; 4491 fg = NULL; 4492 fp = &frd; 4493 if (makecopy != 0) { 4494 bzero(fp, sizeof(frd)); 4495 error = ipf_inobj(softc, data, NULL, fp, IPFOBJ_FRENTRY); 4496 if (error) { 4497 return error; 4498 } 4499 if ((fp->fr_type & FR_T_BUILTIN) != 0) { 4500 IPFERROR(6); 4501 return EINVAL; 4502 } 4503 KMALLOCS(f, frentry_t *, fp->fr_size); 4504 if (f == NULL) { 4505 IPFERROR(131); 4506 return ENOMEM; 4507 } 4508 bzero(f, fp->fr_size); 4509 error = ipf_inobjsz(softc, data, f, IPFOBJ_FRENTRY, 4510 fp->fr_size); 4511 if (error) { 4512 KFREES(f, fp->fr_size); 4513 return error; 4514 } 4515 4516 fp = f; 4517 f = NULL; 4518 fp->fr_next = NULL; 4519 fp->fr_dnext = NULL; 4520 fp->fr_pnext = NULL; 4521 fp->fr_pdnext = NULL; 4522 fp->fr_grp = NULL; 4523 fp->fr_grphead = NULL; 4524 fp->fr_icmpgrp = NULL; 4525 fp->fr_isc = (void *)-1; 4526 fp->fr_ptr = NULL; 4527 fp->fr_ref = 0; 4528 fp->fr_flags |= FR_COPIED; 4529 } else { 4530 fp = (frentry_t *)data; 4531 if ((fp->fr_type & FR_T_BUILTIN) == 0) { 4532 IPFERROR(7); 4533 return EINVAL; 4534 } 4535 fp->fr_flags &= ~FR_COPIED; 4536 } 4537 4538 if (((fp->fr_dsize == 0) && (fp->fr_data != NULL)) || 4539 ((fp->fr_dsize != 0) && (fp->fr_data == NULL))) { 4540 IPFERROR(8); 4541 error = EINVAL; 4542 goto donenolock; 4543 } 4544 4545 family = fp->fr_family; 4546 uptr = fp->fr_data; 4547 4548 if (req == (ioctlcmd_t)SIOCINAFR || req == (ioctlcmd_t)SIOCINIFR || 4549 req == (ioctlcmd_t)SIOCADAFR || req == (ioctlcmd_t)SIOCADIFR) 4550 addrem = 0; 4551 else if (req == (ioctlcmd_t)SIOCRMAFR || req == (ioctlcmd_t)SIOCRMIFR) 4552 addrem = 1; 4553 else if (req == (ioctlcmd_t)SIOCZRLST) 4554 addrem = 2; 4555 else { 4556 IPFERROR(9); 4557 error = EINVAL; 4558 goto donenolock; 4559 } 4560 4561 /* 4562 * Only filter rules for IPv4 or IPv6 are accepted. 4563 */ 4564 if (family == AF_INET) { 4565 /*EMPTY*/; 4566#ifdef USE_INET6 4567 } else if (family == AF_INET6) { 4568 /*EMPTY*/; 4569#endif 4570 } else if (family != 0) { 4571 IPFERROR(10); 4572 error = EINVAL; 4573 goto donenolock; 4574 } 4575 4576 /* 4577 * If the rule is being loaded from user space, i.e. we had to copy it 4578 * into kernel space, then do not trust the function pointer in the 4579 * rule. 4580 */ 4581 if ((makecopy == 1) && (fp->fr_func != NULL)) { 4582 if (ipf_findfunc(fp->fr_func) == NULL) { 4583 IPFERROR(11); 4584 error = ESRCH; 4585 goto donenolock; 4586 } 4587 4588 if (addrem == 0) { 4589 error = ipf_funcinit(softc, fp); 4590 if (error != 0) 4591 goto donenolock; 4592 } 4593 } 4594 if ((fp->fr_flags & FR_CALLNOW) && 4595 ((fp->fr_func == NULL) || (fp->fr_func == (ipfunc_t)-1))) { 4596 IPFERROR(142); 4597 error = ESRCH; 4598 goto donenolock; 4599 } 4600 if (((fp->fr_flags & FR_CMDMASK) == FR_CALL) && 4601 ((fp->fr_func == NULL) || (fp->fr_func == (ipfunc_t)-1))) { 4602 IPFERROR(143); 4603 error = ESRCH; 4604 goto donenolock; 4605 } 4606 4607 ptr = NULL; 4608 cptr = NULL; 4609 4610 if (FR_ISACCOUNT(fp->fr_flags)) 4611 unit = IPL_LOGCOUNT; 4612 4613 /* 4614 * Check that each group name in the rule has a start index that 4615 * is valid. 4616 */ 4617 if (fp->fr_icmphead != -1) { 4618 if ((fp->fr_icmphead < 0) || 4619 (fp->fr_icmphead >= fp->fr_namelen)) { 4620 IPFERROR(136); 4621 error = EINVAL; 4622 goto donenolock; 4623 } 4624 if (!strcmp(FR_NAME(fp, fr_icmphead), "0")) 4625 fp->fr_names[fp->fr_icmphead] = '\0'; 4626 } 4627 4628 if (fp->fr_grhead != -1) { 4629 if ((fp->fr_grhead < 0) || 4630 (fp->fr_grhead >= fp->fr_namelen)) { 4631 IPFERROR(137); 4632 error = EINVAL; 4633 goto donenolock; 4634 } 4635 if (!strcmp(FR_NAME(fp, fr_grhead), "0")) 4636 fp->fr_names[fp->fr_grhead] = '\0'; 4637 } 4638 4639 if (fp->fr_group != -1) { 4640 if ((fp->fr_group < 0) || 4641 (fp->fr_group >= fp->fr_namelen)) { 4642 IPFERROR(138); 4643 error = EINVAL; 4644 goto donenolock; 4645 } 4646 if ((req != (int)SIOCZRLST) && (fp->fr_group != -1)) { 4647 /* 4648 * Allow loading rules that are in groups to cause 4649 * them to be created if they don't already exit. 4650 */ 4651 group = FR_NAME(fp, fr_group); 4652 if (addrem == 0) { 4653 fg = ipf_group_add(softc, group, NULL, 4654 fp->fr_flags, unit, set); 4655 fp->fr_grp = fg; 4656 } else { 4657 fg = ipf_findgroup(softc, group, unit, 4658 set, NULL); 4659 if (fg == NULL) { 4660 IPFERROR(12); 4661 error = ESRCH; 4662 goto donenolock; 4663 } 4664 } 4665 4666 if (fg->fg_flags == 0) { 4667 fg->fg_flags = fp->fr_flags & FR_INOUT; 4668 } else if (fg->fg_flags != (fp->fr_flags & FR_INOUT)) { 4669 IPFERROR(13); 4670 error = ESRCH; 4671 goto donenolock; 4672 } 4673 } 4674 } else { 4675 /* 4676 * If a rule is going to be part of a group then it does 4677 * not matter whether it is an in or out rule, but if it 4678 * isn't in a group, then it does... 4679 */ 4680 if ((fp->fr_flags & (FR_INQUE|FR_OUTQUE)) == 0) { 4681 IPFERROR(14); 4682 error = EINVAL; 4683 goto donenolock; 4684 } 4685 } 4686 in = (fp->fr_flags & FR_INQUE) ? 0 : 1; 4687 4688 /* 4689 * Work out which rule list this change is being applied to. 4690 */ 4691 ftail = NULL; 4692 fprev = NULL; 4693 if (unit == IPL_LOGAUTH) { 4694 if ((fp->fr_tifs[0].fd_ptr != NULL) || 4695 (fp->fr_tifs[1].fd_ptr != NULL) || 4696 (fp->fr_dif.fd_ptr != NULL) || 4697 (fp->fr_flags & FR_FASTROUTE)) { 4698 softc->ipf_interror = 145; 4699 error = EINVAL; 4700 goto donenolock; 4701 } 4702 fprev = ipf_auth_rulehead(softc); 4703 } else { 4704 if (FR_ISACCOUNT(fp->fr_flags)) 4705 fprev = &softc->ipf_acct[in][set]; 4706 else if ((fp->fr_flags & (FR_OUTQUE|FR_INQUE)) != 0) 4707 fprev = &softc->ipf_rules[in][set]; 4708 } 4709 if (fprev == NULL) { 4710 IPFERROR(15); 4711 error = ESRCH; 4712 goto donenolock; 4713 } 4714 4715 if (fg != NULL) 4716 fprev = &fg->fg_start; 4717 4718 /* 4719 * Copy in extra data for the rule. 4720 */ 4721 if (fp->fr_dsize != 0) { 4722 if (makecopy != 0) { 4723 KMALLOCS(ptr, void *, fp->fr_dsize); 4724 if (ptr == NULL) { 4725 IPFERROR(16); 4726 error = ENOMEM; 4727 goto donenolock; 4728 } 4729 4730 /* 4731 * The bcopy case is for when the data is appended 4732 * to the rule by ipf_in_compat(). 4733 */ 4734 if (uptr >= (void *)fp && 4735 uptr < (void *)((char *)fp + fp->fr_size)) { 4736 bcopy(uptr, ptr, fp->fr_dsize); 4737 error = 0; 4738 } else { 4739 error = COPYIN(uptr, ptr, fp->fr_dsize); 4740 if (error != 0) { 4741 IPFERROR(17); 4742 error = EFAULT; 4743 goto donenolock; 4744 } 4745 } 4746 } else { 4747 ptr = uptr; 4748 } 4749 fp->fr_data = ptr; 4750 } else { 4751 fp->fr_data = NULL; 4752 } 4753 4754 /* 4755 * Perform per-rule type sanity checks of their members. 4756 * All code after this needs to be aware that allocated memory 4757 * may need to be free'd before exiting. 4758 */ 4759 switch (fp->fr_type & ~FR_T_BUILTIN) 4760 { 4761#if defined(IPFILTER_BPF) 4762 case FR_T_BPFOPC : 4763 if (fp->fr_dsize == 0) { 4764 IPFERROR(19); 4765 error = EINVAL; 4766 break; 4767 } 4768 if (!bpf_validate(ptr, fp->fr_dsize/sizeof(struct bpf_insn))) { 4769 IPFERROR(20); 4770 error = EINVAL; 4771 break; 4772 } 4773 break; 4774#endif 4775 case FR_T_IPF : 4776 /* 4777 * Preparation for error case at the bottom of this function. 4778 */ 4779 if (fp->fr_datype == FRI_LOOKUP) 4780 fp->fr_dstptr = NULL; 4781 if (fp->fr_satype == FRI_LOOKUP) 4782 fp->fr_srcptr = NULL; 4783 4784 if (fp->fr_dsize != sizeof(fripf_t)) { 4785 IPFERROR(21); 4786 error = EINVAL; 4787 break; 4788 } 4789 4790 /* 4791 * Allowing a rule with both "keep state" and "with oow" is 4792 * pointless because adding a state entry to the table will 4793 * fail with the out of window (oow) flag set. 4794 */ 4795 if ((fp->fr_flags & FR_KEEPSTATE) && (fp->fr_flx & FI_OOW)) { 4796 IPFERROR(22); 4797 error = EINVAL; 4798 break; 4799 } 4800 4801 switch (fp->fr_satype) 4802 { 4803 case FRI_BROADCAST : 4804 case FRI_DYNAMIC : 4805 case FRI_NETWORK : 4806 case FRI_NETMASKED : 4807 case FRI_PEERADDR : 4808 if (fp->fr_sifpidx < 0) { 4809 IPFERROR(23); 4810 error = EINVAL; 4811 } 4812 break; 4813 case FRI_LOOKUP : 4814 fp->fr_srcptr = ipf_findlookup(softc, unit, fp, 4815 &fp->fr_src6, 4816 &fp->fr_smsk6); 4817 if (fp->fr_srcfunc == NULL) { 4818 IPFERROR(132); 4819 error = ESRCH; 4820 break; 4821 } 4822 break; 4823 case FRI_NORMAL : 4824 break; 4825 default : 4826 IPFERROR(133); 4827 error = EINVAL; 4828 break; 4829 } 4830 if (error != 0) 4831 break; 4832 4833 switch (fp->fr_datype) 4834 { 4835 case FRI_BROADCAST : 4836 case FRI_DYNAMIC : 4837 case FRI_NETWORK : 4838 case FRI_NETMASKED : 4839 case FRI_PEERADDR : 4840 if (fp->fr_difpidx < 0) { 4841 IPFERROR(24); 4842 error = EINVAL; 4843 } 4844 break; 4845 case FRI_LOOKUP : 4846 fp->fr_dstptr = ipf_findlookup(softc, unit, fp, 4847 &fp->fr_dst6, 4848 &fp->fr_dmsk6); 4849 if (fp->fr_dstfunc == NULL) { 4850 IPFERROR(134); 4851 error = ESRCH; 4852 } 4853 break; 4854 case FRI_NORMAL : 4855 break; 4856 default : 4857 IPFERROR(135); 4858 error = EINVAL; 4859 } 4860 break; 4861 4862 case FR_T_NONE : 4863 case FR_T_CALLFUNC : 4864 case FR_T_COMPIPF : 4865 break; 4866 4867 case FR_T_IPFEXPR : 4868 if (ipf_matcharray_verify(fp->fr_data, fp->fr_dsize) == -1) { 4869 IPFERROR(25); 4870 error = EINVAL; 4871 } 4872 break; 4873 4874 default : 4875 IPFERROR(26); 4876 error = EINVAL; 4877 break; 4878 } 4879 if (error != 0) 4880 goto donenolock; 4881 4882 if (fp->fr_tif.fd_name != -1) { 4883 if ((fp->fr_tif.fd_name < 0) || 4884 (fp->fr_tif.fd_name >= fp->fr_namelen)) { 4885 IPFERROR(139); 4886 error = EINVAL; 4887 goto donenolock; 4888 } 4889 } 4890 4891 if (fp->fr_dif.fd_name != -1) { 4892 if ((fp->fr_dif.fd_name < 0) || 4893 (fp->fr_dif.fd_name >= fp->fr_namelen)) { 4894 IPFERROR(140); 4895 error = EINVAL; 4896 goto donenolock; 4897 } 4898 } 4899 4900 if (fp->fr_rif.fd_name != -1) { 4901 if ((fp->fr_rif.fd_name < 0) || 4902 (fp->fr_rif.fd_name >= fp->fr_namelen)) { 4903 IPFERROR(141); 4904 error = EINVAL; 4905 goto donenolock; 4906 } 4907 } 4908 4909 /* 4910 * Lookup all the interface names that are part of the rule. 4911 */ 4912 error = ipf_synclist(softc, fp, NULL); 4913 if (error != 0) 4914 goto donenolock; 4915 fp->fr_statecnt = 0; 4916 if (fp->fr_srctrack.ht_max_nodes != 0) 4917 ipf_rb_ht_init(&fp->fr_srctrack); 4918 4919 /* 4920 * Look for an existing matching filter rule, but don't include the 4921 * next or interface pointer in the comparison (fr_next, fr_ifa). 4922 * This elminates rules which are indentical being loaded. Checksum 4923 * the constant part of the filter rule to make comparisons quicker 4924 * (this meaning no pointers are included). 4925 */ 4926 for (fp->fr_cksum = 0, p = (u_int *)&fp->fr_func, pp = &fp->fr_cksum; 4927 p < pp; p++) 4928 fp->fr_cksum += *p; 4929 pp = (u_int *)(fp->fr_caddr + fp->fr_dsize); 4930 for (p = (u_int *)fp->fr_data; p < pp; p++) 4931 fp->fr_cksum += *p; 4932 4933 WRITE_ENTER(&softc->ipf_mutex); 4934 4935 /* 4936 * Now that the filter rule lists are locked, we can walk the 4937 * chain of them without fear. 4938 */ 4939 ftail = fprev; 4940 for (f = *ftail; (f = *ftail) != NULL; ftail = &f->fr_next) { 4941 if (fp->fr_collect <= f->fr_collect) { 4942 ftail = fprev; 4943 f = NULL; 4944 break; 4945 } 4946 fprev = ftail; 4947 } 4948 4949 for (; (f = *ftail) != NULL; ftail = &f->fr_next) { 4950 if (ipf_rule_compare(fp, f) == 0) 4951 break; 4952 } 4953 4954 /* 4955 * If zero'ing statistics, copy current to caller and zero. 4956 */ 4957 if (addrem == 2) { 4958 if (f == NULL) { 4959 IPFERROR(27); 4960 error = ESRCH; 4961 } else { 4962 /* 4963 * Copy and reduce lock because of impending copyout. 4964 * Well we should, but if we do then the atomicity of 4965 * this call and the correctness of fr_hits and 4966 * fr_bytes cannot be guaranteed. As it is, this code 4967 * only resets them to 0 if they are successfully 4968 * copied out into user space. 4969 */ 4970 bcopy((char *)f, (char *)fp, f->fr_size); 4971 /* MUTEX_DOWNGRADE(&softc->ipf_mutex); */ 4972 4973 /* 4974 * When we copy this rule back out, set the data 4975 * pointer to be what it was in user space. 4976 */ 4977 fp->fr_data = uptr; 4978 error = ipf_outobj(softc, data, fp, IPFOBJ_FRENTRY); 4979 4980 if (error == 0) { 4981 if ((f->fr_dsize != 0) && (uptr != NULL)) 4982 error = COPYOUT(f->fr_data, uptr, 4983 f->fr_dsize); 4984 if (error != 0) { 4985 IPFERROR(28); 4986 error = EFAULT; 4987 } 4988 if (error == 0) { 4989 f->fr_hits = 0; 4990 f->fr_bytes = 0; 4991 } 4992 } 4993 } 4994 4995 if (makecopy != 0) { 4996 if (ptr != NULL) { 4997 KFREES(ptr, fp->fr_dsize); 4998 } 4999 KFREES(fp, fp->fr_size); 5000 } 5001 RWLOCK_EXIT(&softc->ipf_mutex); 5002 return error; 5003 } 5004 5005 if (!f) { 5006 /* 5007 * At the end of this, ftail must point to the place where the 5008 * new rule is to be saved/inserted/added. 5009 * For SIOCAD*FR, this should be the last rule in the group of 5010 * rules that have equal fr_collect fields. 5011 * For SIOCIN*FR, ... 5012 */ 5013 if (req == (ioctlcmd_t)SIOCADAFR || 5014 req == (ioctlcmd_t)SIOCADIFR) { 5015 5016 for (ftail = fprev; (f = *ftail) != NULL; ) { 5017 if (f->fr_collect > fp->fr_collect) 5018 break; 5019 ftail = &f->fr_next; 5020 fprev = ftail; 5021 } 5022 ftail = fprev; 5023 f = NULL; 5024 ptr = NULL; 5025 } else if (req == (ioctlcmd_t)SIOCINAFR || 5026 req == (ioctlcmd_t)SIOCINIFR) { 5027 while ((f = *fprev) != NULL) { 5028 if (f->fr_collect >= fp->fr_collect) 5029 break; 5030 fprev = &f->fr_next; 5031 } 5032 ftail = fprev; 5033 if (fp->fr_hits != 0) { 5034 while (fp->fr_hits && (f = *ftail)) { 5035 if (f->fr_collect != fp->fr_collect) 5036 break; 5037 fprev = ftail; 5038 ftail = &f->fr_next; 5039 fp->fr_hits--; 5040 } 5041 } 5042 f = NULL; 5043 ptr = NULL; 5044 } 5045 } 5046 5047 /* 5048 * Request to remove a rule. 5049 */ 5050 if (addrem == 1) { 5051 if (!f) { 5052 IPFERROR(29); 5053 error = ESRCH; 5054 } else { 5055 /* 5056 * Do not allow activity from user space to interfere 5057 * with rules not loaded that way. 5058 */ 5059 if ((makecopy == 1) && !(f->fr_flags & FR_COPIED)) { 5060 IPFERROR(30); 5061 error = EPERM; 5062 goto done; 5063 } 5064 5065 /* 5066 * Return EBUSY if the rule is being reference by 5067 * something else (eg state information.) 5068 */ 5069 if (f->fr_ref > 1) { 5070 IPFERROR(31); 5071 error = EBUSY; 5072 goto done; 5073 } 5074#ifdef IPFILTER_SCAN 5075 if (f->fr_isctag != -1 && 5076 (f->fr_isc != (struct ipscan *)-1)) 5077 ipf_scan_detachfr(f); 5078#endif 5079 5080 if (unit == IPL_LOGAUTH) { 5081 error = ipf_auth_precmd(softc, req, f, ftail); 5082 goto done; 5083 } 5084 5085 ipf_rule_delete(softc, f, unit, set); 5086 5087 need_free = makecopy; 5088 } 5089 } else { 5090 /* 5091 * Not removing, so we must be adding/inserting a rule. 5092 */ 5093 if (f != NULL) { 5094 IPFERROR(32); 5095 error = EEXIST; 5096 goto done; 5097 } 5098 if (unit == IPL_LOGAUTH) { 5099 error = ipf_auth_precmd(softc, req, fp, ftail); 5100 goto done; 5101 } 5102 5103 MUTEX_NUKE(&fp->fr_lock); 5104 MUTEX_INIT(&fp->fr_lock, "filter rule lock"); 5105 if (fp->fr_die != 0) 5106 ipf_rule_expire_insert(softc, fp, set); 5107 5108 fp->fr_hits = 0; 5109 if (makecopy != 0) 5110 fp->fr_ref = 1; 5111 fp->fr_pnext = ftail; 5112 fp->fr_next = *ftail; 5113 if (fp->fr_next != NULL) 5114 fp->fr_next->fr_pnext = &fp->fr_next; 5115 *ftail = fp; 5116 if (addrem == 0) 5117 ipf_fixskip(ftail, fp, 1); 5118 5119 fp->fr_icmpgrp = NULL; 5120 if (fp->fr_icmphead != -1) { 5121 group = FR_NAME(fp, fr_icmphead); 5122 fg = ipf_group_add(softc, group, fp, 0, unit, set); 5123 fp->fr_icmpgrp = fg; 5124 } 5125 5126 fp->fr_grphead = NULL; 5127 if (fp->fr_grhead != -1) { 5128 group = FR_NAME(fp, fr_grhead); 5129 fg = ipf_group_add(softc, group, fp, fp->fr_flags, 5130 unit, set); 5131 fp->fr_grphead = fg; 5132 } 5133 } 5134done: 5135 RWLOCK_EXIT(&softc->ipf_mutex); 5136donenolock: 5137 if (need_free || (error != 0)) { 5138 if ((fp->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) { 5139 if ((fp->fr_satype == FRI_LOOKUP) && 5140 (fp->fr_srcptr != NULL)) 5141 ipf_lookup_deref(softc, fp->fr_srctype, 5142 fp->fr_srcptr); 5143 if ((fp->fr_datype == FRI_LOOKUP) && 5144 (fp->fr_dstptr != NULL)) 5145 ipf_lookup_deref(softc, fp->fr_dsttype, 5146 fp->fr_dstptr); 5147 } 5148 if (fp->fr_grp != NULL) { 5149 WRITE_ENTER(&softc->ipf_mutex); 5150 ipf_group_del(softc, fp->fr_grp, fp); 5151 RWLOCK_EXIT(&softc->ipf_mutex); 5152 } 5153 if ((ptr != NULL) && (makecopy != 0)) { 5154 KFREES(ptr, fp->fr_dsize); 5155 } 5156 KFREES(fp, fp->fr_size); 5157 } 5158 return (error); 5159} 5160 5161 5162/* ------------------------------------------------------------------------ */ 5163/* Function: ipf_rule_delete */ 5164/* Returns: Nil */ 5165/* Parameters: softc(I) - pointer to soft context main structure */ 5166/* f(I) - pointer to the rule being deleted */ 5167/* ftail(I) - pointer to the pointer to f */ 5168/* unit(I) - device for which this is for */ 5169/* set(I) - 1 or 0 (filter set) */ 5170/* */ 5171/* This function attempts to do what it can to delete a filter rule: remove */ 5172/* it from any linked lists and remove any groups it is responsible for. */ 5173/* But in the end, removing a rule can only drop the reference count - we */ 5174/* must use that as the guide for whether or not it can be freed. */ 5175/* ------------------------------------------------------------------------ */ 5176static void 5177ipf_rule_delete(softc, f, unit, set) 5178 ipf_main_softc_t *softc; 5179 frentry_t *f; 5180 int unit, set; 5181{ 5182 5183 /* 5184 * If fr_pdnext is set, then the rule is on the expire list, so 5185 * remove it from there. 5186 */ 5187 if (f->fr_pdnext != NULL) { 5188 *f->fr_pdnext = f->fr_dnext; 5189 if (f->fr_dnext != NULL) 5190 f->fr_dnext->fr_pdnext = f->fr_pdnext; 5191 f->fr_pdnext = NULL; 5192 f->fr_dnext = NULL; 5193 } 5194 5195 ipf_fixskip(f->fr_pnext, f, -1); 5196 if (f->fr_pnext != NULL) 5197 *f->fr_pnext = f->fr_next; 5198 if (f->fr_next != NULL) 5199 f->fr_next->fr_pnext = f->fr_pnext; 5200 f->fr_pnext = NULL; 5201 f->fr_next = NULL; 5202 5203 (void) ipf_derefrule(softc, &f); 5204} 5205 5206/* ------------------------------------------------------------------------ */ 5207/* Function: ipf_rule_expire_insert */ 5208/* Returns: Nil */ 5209/* Parameters: softc(I) - pointer to soft context main structure */ 5210/* f(I) - pointer to rule to be added to expire list */ 5211/* set(I) - 1 or 0 (filter set) */ 5212/* */ 5213/* If the new rule has a given expiration time, insert it into the list of */ 5214/* expiring rules with the ones to be removed first added to the front of */ 5215/* the list. The insertion is O(n) but it is kept sorted for quick scans at */ 5216/* expiration interval checks. */ 5217/* ------------------------------------------------------------------------ */ 5218static void 5219ipf_rule_expire_insert(softc, f, set) 5220 ipf_main_softc_t *softc; 5221 frentry_t *f; 5222 int set; 5223{ 5224 frentry_t *fr; 5225 5226 /* 5227 */ 5228 5229 f->fr_die = softc->ipf_ticks + IPF_TTLVAL(f->fr_die); 5230 for (fr = softc->ipf_rule_explist[set]; fr != NULL; 5231 fr = fr->fr_dnext) { 5232 if (f->fr_die < fr->fr_die) 5233 break; 5234 if (fr->fr_dnext == NULL) { 5235 /* 5236 * We've got to the last rule and everything 5237 * wanted to be expired before this new node, 5238 * so we have to tack it on the end... 5239 */ 5240 fr->fr_dnext = f; 5241 f->fr_pdnext = &fr->fr_dnext; 5242 fr = NULL; 5243 break; 5244 } 5245 } 5246 5247 if (softc->ipf_rule_explist[set] == NULL) { 5248 softc->ipf_rule_explist[set] = f; 5249 f->fr_pdnext = &softc->ipf_rule_explist[set]; 5250 } else if (fr != NULL) { 5251 f->fr_dnext = fr; 5252 f->fr_pdnext = fr->fr_pdnext; 5253 fr->fr_pdnext = &f->fr_dnext; 5254 } 5255} 5256 5257 5258/* ------------------------------------------------------------------------ */ 5259/* Function: ipf_findlookup */ 5260/* Returns: NULL = failure, else success */ 5261/* Parameters: softc(I) - pointer to soft context main structure */ 5262/* unit(I) - ipf device we want to find match for */ 5263/* fp(I) - rule for which lookup is for */ 5264/* addrp(I) - pointer to lookup information in address struct */ 5265/* maskp(O) - pointer to lookup information for storage */ 5266/* */ 5267/* When using pools and hash tables to store addresses for matching in */ 5268/* rules, it is necessary to resolve both the object referred to by the */ 5269/* name or address (and return that pointer) and also provide the means by */ 5270/* which to determine if an address belongs to that object to make the */ 5271/* packet matching quicker. */ 5272/* ------------------------------------------------------------------------ */ 5273static void * 5274ipf_findlookup(softc, unit, fr, addrp, maskp) 5275 ipf_main_softc_t *softc; 5276 int unit; 5277 frentry_t *fr; 5278 i6addr_t *addrp, *maskp; 5279{ 5280 void *ptr = NULL; 5281 5282 switch (addrp->iplookupsubtype) 5283 { 5284 case 0 : 5285 ptr = ipf_lookup_res_num(softc, unit, addrp->iplookuptype, 5286 addrp->iplookupnum, 5287 &maskp->iplookupfunc); 5288 break; 5289 case 1 : 5290 if (addrp->iplookupname < 0) 5291 break; 5292 if (addrp->iplookupname >= fr->fr_namelen) 5293 break; 5294 ptr = ipf_lookup_res_name(softc, unit, addrp->iplookuptype, 5295 fr->fr_names + addrp->iplookupname, 5296 &maskp->iplookupfunc); 5297 break; 5298 default : 5299 break; 5300 } 5301 5302 return ptr; 5303} 5304 5305 5306/* ------------------------------------------------------------------------ */ 5307/* Function: ipf_funcinit */ 5308/* Returns: int - 0 == success, else ESRCH: cannot resolve rule details */ 5309/* Parameters: softc(I) - pointer to soft context main structure */ 5310/* fr(I) - pointer to filter rule */ 5311/* */ 5312/* If a rule is a call rule, then check if the function it points to needs */ 5313/* an init function to be called now the rule has been loaded. */ 5314/* ------------------------------------------------------------------------ */ 5315static int 5316ipf_funcinit(softc, fr) 5317 ipf_main_softc_t *softc; 5318 frentry_t *fr; 5319{ 5320 ipfunc_resolve_t *ft; 5321 int err; 5322 5323 IPFERROR(34); 5324 err = ESRCH; 5325 5326 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5327 if (ft->ipfu_addr == fr->fr_func) { 5328 err = 0; 5329 if (ft->ipfu_init != NULL) 5330 err = (*ft->ipfu_init)(softc, fr); 5331 break; 5332 } 5333 return err; 5334} 5335 5336 5337/* ------------------------------------------------------------------------ */ 5338/* Function: ipf_funcfini */ 5339/* Returns: Nil */ 5340/* Parameters: softc(I) - pointer to soft context main structure */ 5341/* fr(I) - pointer to filter rule */ 5342/* */ 5343/* For a given filter rule, call the matching "fini" function if the rule */ 5344/* is using a known function that would have resulted in the "init" being */ 5345/* called for ealier. */ 5346/* ------------------------------------------------------------------------ */ 5347static void 5348ipf_funcfini(softc, fr) 5349 ipf_main_softc_t *softc; 5350 frentry_t *fr; 5351{ 5352 ipfunc_resolve_t *ft; 5353 5354 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5355 if (ft->ipfu_addr == fr->fr_func) { 5356 if (ft->ipfu_fini != NULL) 5357 (void) (*ft->ipfu_fini)(softc, fr); 5358 break; 5359 } 5360} 5361 5362 5363/* ------------------------------------------------------------------------ */ 5364/* Function: ipf_findfunc */ 5365/* Returns: ipfunc_t - pointer to function if found, else NULL */ 5366/* Parameters: funcptr(I) - function pointer to lookup */ 5367/* */ 5368/* Look for a function in the table of known functions. */ 5369/* ------------------------------------------------------------------------ */ 5370static ipfunc_t 5371ipf_findfunc(funcptr) 5372 ipfunc_t funcptr; 5373{ 5374 ipfunc_resolve_t *ft; 5375 5376 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5377 if (ft->ipfu_addr == funcptr) 5378 return funcptr; 5379 return NULL; 5380} 5381 5382 5383/* ------------------------------------------------------------------------ */ 5384/* Function: ipf_resolvefunc */ 5385/* Returns: int - 0 == success, else error */ 5386/* Parameters: data(IO) - ioctl data pointer to ipfunc_resolve_t struct */ 5387/* */ 5388/* Copy in a ipfunc_resolve_t structure and then fill in the missing field. */ 5389/* This will either be the function name (if the pointer is set) or the */ 5390/* function pointer if the name is set. When found, fill in the other one */ 5391/* so that the entire, complete, structure can be copied back to user space.*/ 5392/* ------------------------------------------------------------------------ */ 5393int 5394ipf_resolvefunc(softc, data) 5395 ipf_main_softc_t *softc; 5396 void *data; 5397{ 5398 ipfunc_resolve_t res, *ft; 5399 int error; 5400 5401 error = BCOPYIN(data, &res, sizeof(res)); 5402 if (error != 0) { 5403 IPFERROR(123); 5404 return EFAULT; 5405 } 5406 5407 if (res.ipfu_addr == NULL && res.ipfu_name[0] != '\0') { 5408 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5409 if (strncmp(res.ipfu_name, ft->ipfu_name, 5410 sizeof(res.ipfu_name)) == 0) { 5411 res.ipfu_addr = ft->ipfu_addr; 5412 res.ipfu_init = ft->ipfu_init; 5413 if (COPYOUT(&res, data, sizeof(res)) != 0) { 5414 IPFERROR(35); 5415 return EFAULT; 5416 } 5417 return 0; 5418 } 5419 } 5420 if (res.ipfu_addr != NULL && res.ipfu_name[0] == '\0') { 5421 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5422 if (ft->ipfu_addr == res.ipfu_addr) { 5423 (void) strncpy(res.ipfu_name, ft->ipfu_name, 5424 sizeof(res.ipfu_name)); 5425 res.ipfu_init = ft->ipfu_init; 5426 if (COPYOUT(&res, data, sizeof(res)) != 0) { 5427 IPFERROR(36); 5428 return EFAULT; 5429 } 5430 return 0; 5431 } 5432 } 5433 IPFERROR(37); 5434 return ESRCH; 5435} 5436 5437 5438#if !defined(_KERNEL) || (!defined(__NetBSD__) && !defined(__OpenBSD__) && \ 5439 !defined(__FreeBSD__)) || \ 5440 FREEBSD_LT_REV(501000) || NETBSD_LT_REV(105000000) || \ 5441 OPENBSD_LT_REV(200006) 5442/* 5443 * From: NetBSD 5444 * ppsratecheck(): packets (or events) per second limitation. 5445 */ 5446int 5447ppsratecheck(lasttime, curpps, maxpps) 5448 struct timeval *lasttime; 5449 int *curpps; 5450 int maxpps; /* maximum pps allowed */ 5451{ 5452 struct timeval tv, delta; 5453 int rv; 5454 5455 GETKTIME(&tv); 5456 5457 delta.tv_sec = tv.tv_sec - lasttime->tv_sec; 5458 delta.tv_usec = tv.tv_usec - lasttime->tv_usec; 5459 if (delta.tv_usec < 0) { 5460 delta.tv_sec--; 5461 delta.tv_usec += 1000000; 5462 } 5463 5464 /* 5465 * check for 0,0 is so that the message will be seen at least once. 5466 * if more than one second have passed since the last update of 5467 * lasttime, reset the counter. 5468 * 5469 * we do increment *curpps even in *curpps < maxpps case, as some may 5470 * try to use *curpps for stat purposes as well. 5471 */ 5472 if ((lasttime->tv_sec == 0 && lasttime->tv_usec == 0) || 5473 delta.tv_sec >= 1) { 5474 *lasttime = tv; 5475 *curpps = 0; 5476 rv = 1; 5477 } else if (maxpps < 0) 5478 rv = 1; 5479 else if (*curpps < maxpps) 5480 rv = 1; 5481 else 5482 rv = 0; 5483 *curpps = *curpps + 1; 5484 5485 return (rv); 5486} 5487#endif 5488 5489 5490/* ------------------------------------------------------------------------ */ 5491/* Function: ipf_derefrule */ 5492/* Returns: int - 0 == rule freed up, else rule not freed */ 5493/* Parameters: fr(I) - pointer to filter rule */ 5494/* */ 5495/* Decrement the reference counter to a rule by one. If it reaches zero, */ 5496/* free it and any associated storage space being used by it. */ 5497/* ------------------------------------------------------------------------ */ 5498int 5499ipf_derefrule(softc, frp) 5500 ipf_main_softc_t *softc; 5501 frentry_t **frp; 5502{ 5503 frentry_t *fr; 5504 frdest_t *fdp; 5505 5506 fr = *frp; 5507 *frp = NULL; 5508 5509 MUTEX_ENTER(&fr->fr_lock); 5510 fr->fr_ref--; 5511 if (fr->fr_ref == 0) { 5512 MUTEX_EXIT(&fr->fr_lock); 5513 MUTEX_DESTROY(&fr->fr_lock); 5514 5515 ipf_funcfini(softc, fr); 5516 5517 fdp = &fr->fr_tif; 5518 if (fdp->fd_type == FRD_DSTLIST) 5519 ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr); 5520 5521 fdp = &fr->fr_rif; 5522 if (fdp->fd_type == FRD_DSTLIST) 5523 ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr); 5524 5525 fdp = &fr->fr_dif; 5526 if (fdp->fd_type == FRD_DSTLIST) 5527 ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr); 5528 5529 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF && 5530 fr->fr_satype == FRI_LOOKUP) 5531 ipf_lookup_deref(softc, fr->fr_srctype, fr->fr_srcptr); 5532 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF && 5533 fr->fr_datype == FRI_LOOKUP) 5534 ipf_lookup_deref(softc, fr->fr_dsttype, fr->fr_dstptr); 5535 5536 if (fr->fr_grp != NULL) 5537 ipf_group_del(softc, fr->fr_grp, fr); 5538 5539 if (fr->fr_grphead != NULL) 5540 ipf_group_del(softc, fr->fr_grphead, fr); 5541 5542 if (fr->fr_icmpgrp != NULL) 5543 ipf_group_del(softc, fr->fr_icmpgrp, fr); 5544 5545 if ((fr->fr_flags & FR_COPIED) != 0) { 5546 if (fr->fr_dsize) { 5547 KFREES(fr->fr_data, fr->fr_dsize); 5548 } 5549 KFREES(fr, fr->fr_size); 5550 return 0; 5551 } 5552 return 1; 5553 } else { 5554 MUTEX_EXIT(&fr->fr_lock); 5555 } 5556 return -1; 5557} 5558 5559 5560/* ------------------------------------------------------------------------ */ 5561/* Function: ipf_grpmapinit */ 5562/* Returns: int - 0 == success, else ESRCH because table entry not found*/ 5563/* Parameters: fr(I) - pointer to rule to find hash table for */ 5564/* */ 5565/* Looks for group hash table fr_arg and stores a pointer to it in fr_ptr. */ 5566/* fr_ptr is later used by ipf_srcgrpmap and ipf_dstgrpmap. */ 5567/* ------------------------------------------------------------------------ */ 5568static int 5569ipf_grpmapinit(softc, fr) 5570 ipf_main_softc_t *softc; 5571 frentry_t *fr; 5572{ 5573 char name[FR_GROUPLEN]; 5574 iphtable_t *iph; 5575 5576#if defined(SNPRINTF) && defined(_KERNEL) 5577 SNPRINTF(name, sizeof(name), "%d", fr->fr_arg); 5578#else 5579 (void) sprintf(name, "%d", fr->fr_arg); 5580#endif 5581 iph = ipf_lookup_find_htable(softc, IPL_LOGIPF, name); 5582 if (iph == NULL) { 5583 IPFERROR(38); 5584 return ESRCH; 5585 } 5586 if ((iph->iph_flags & FR_INOUT) != (fr->fr_flags & FR_INOUT)) { 5587 IPFERROR(39); 5588 return ESRCH; 5589 } 5590 iph->iph_ref++; 5591 fr->fr_ptr = iph; 5592 return 0; 5593} 5594 5595 5596/* ------------------------------------------------------------------------ */ 5597/* Function: ipf_grpmapfini */ 5598/* Returns: int - 0 == success, else ESRCH because table entry not found*/ 5599/* Parameters: softc(I) - pointer to soft context main structure */ 5600/* fr(I) - pointer to rule to release hash table for */ 5601/* */ 5602/* For rules that have had ipf_grpmapinit called, ipf_lookup_deref needs to */ 5603/* be called to undo what ipf_grpmapinit caused to be done. */ 5604/* ------------------------------------------------------------------------ */ 5605static int 5606ipf_grpmapfini(softc, fr) 5607 ipf_main_softc_t *softc; 5608 frentry_t *fr; 5609{ 5610 iphtable_t *iph; 5611 iph = fr->fr_ptr; 5612 if (iph != NULL) 5613 ipf_lookup_deref(softc, IPLT_HASH, iph); 5614 return 0; 5615} 5616 5617 5618/* ------------------------------------------------------------------------ */ 5619/* Function: ipf_srcgrpmap */ 5620/* Returns: frentry_t * - pointer to "new last matching" rule or NULL */ 5621/* Parameters: fin(I) - pointer to packet information */ 5622/* passp(IO) - pointer to current/new filter decision (unused) */ 5623/* */ 5624/* Look for a rule group head in a hash table, using the source address as */ 5625/* the key, and descend into that group and continue matching rules against */ 5626/* the packet. */ 5627/* ------------------------------------------------------------------------ */ 5628frentry_t * 5629ipf_srcgrpmap(fin, passp) 5630 fr_info_t *fin; 5631 u_32_t *passp; 5632{ 5633 frgroup_t *fg; 5634 void *rval; 5635 5636 rval = ipf_iphmfindgroup(fin->fin_main_soft, fin->fin_fr->fr_ptr, 5637 &fin->fin_src); 5638 if (rval == NULL) 5639 return NULL; 5640 5641 fg = rval; 5642 fin->fin_fr = fg->fg_start; 5643 (void) ipf_scanlist(fin, *passp); 5644 return fin->fin_fr; 5645} 5646 5647 5648/* ------------------------------------------------------------------------ */ 5649/* Function: ipf_dstgrpmap */ 5650/* Returns: frentry_t * - pointer to "new last matching" rule or NULL */ 5651/* Parameters: fin(I) - pointer to packet information */ 5652/* passp(IO) - pointer to current/new filter decision (unused) */ 5653/* */ 5654/* Look for a rule group head in a hash table, using the destination */ 5655/* address as the key, and descend into that group and continue matching */ 5656/* rules against the packet. */ 5657/* ------------------------------------------------------------------------ */ 5658frentry_t * 5659ipf_dstgrpmap(fin, passp) 5660 fr_info_t *fin; 5661 u_32_t *passp; 5662{ 5663 frgroup_t *fg; 5664 void *rval; 5665 5666 rval = ipf_iphmfindgroup(fin->fin_main_soft, fin->fin_fr->fr_ptr, 5667 &fin->fin_dst); 5668 if (rval == NULL) 5669 return NULL; 5670 5671 fg = rval; 5672 fin->fin_fr = fg->fg_start; 5673 (void) ipf_scanlist(fin, *passp); 5674 return fin->fin_fr; 5675} 5676 5677/* 5678 * Queue functions 5679 * =============== 5680 * These functions manage objects on queues for efficient timeouts. There 5681 * are a number of system defined queues as well as user defined timeouts. 5682 * It is expected that a lock is held in the domain in which the queue 5683 * belongs (i.e. either state or NAT) when calling any of these functions 5684 * that prevents ipf_freetimeoutqueue() from being called at the same time 5685 * as any other. 5686 */ 5687 5688 5689/* ------------------------------------------------------------------------ */ 5690/* Function: ipf_addtimeoutqueue */ 5691/* Returns: struct ifqtq * - NULL if malloc fails, else pointer to */ 5692/* timeout queue with given interval. */ 5693/* Parameters: parent(I) - pointer to pointer to parent node of this list */ 5694/* of interface queues. */ 5695/* seconds(I) - timeout value in seconds for this queue. */ 5696/* */ 5697/* This routine first looks for a timeout queue that matches the interval */ 5698/* being requested. If it finds one, increments the reference counter and */ 5699/* returns a pointer to it. If none are found, it allocates a new one and */ 5700/* inserts it at the top of the list. */ 5701/* */ 5702/* Locking. */ 5703/* It is assumed that the caller of this function has an appropriate lock */ 5704/* held (exclusively) in the domain that encompases 'parent'. */ 5705/* ------------------------------------------------------------------------ */ 5706ipftq_t * 5707ipf_addtimeoutqueue(softc, parent, seconds) 5708 ipf_main_softc_t *softc; 5709 ipftq_t **parent; 5710 u_int seconds; 5711{ 5712 ipftq_t *ifq; 5713 u_int period; 5714 5715 period = seconds * IPF_HZ_DIVIDE; 5716 5717 MUTEX_ENTER(&softc->ipf_timeoutlock); 5718 for (ifq = *parent; ifq != NULL; ifq = ifq->ifq_next) { 5719 if (ifq->ifq_ttl == period) { 5720 /* 5721 * Reset the delete flag, if set, so the structure 5722 * gets reused rather than freed and reallocated. 5723 */ 5724 MUTEX_ENTER(&ifq->ifq_lock); 5725 ifq->ifq_flags &= ~IFQF_DELETE; 5726 ifq->ifq_ref++; 5727 MUTEX_EXIT(&ifq->ifq_lock); 5728 MUTEX_EXIT(&softc->ipf_timeoutlock); 5729 5730 return ifq; 5731 } 5732 } 5733 5734 KMALLOC(ifq, ipftq_t *); 5735 if (ifq != NULL) { 5736 MUTEX_NUKE(&ifq->ifq_lock); 5737 IPFTQ_INIT(ifq, period, "ipftq mutex"); 5738 ifq->ifq_next = *parent; 5739 ifq->ifq_pnext = parent; 5740 ifq->ifq_flags = IFQF_USER; 5741 ifq->ifq_ref++; 5742 *parent = ifq; 5743 softc->ipf_userifqs++; 5744 } 5745 MUTEX_EXIT(&softc->ipf_timeoutlock); 5746 return ifq; 5747} 5748 5749 5750/* ------------------------------------------------------------------------ */ 5751/* Function: ipf_deletetimeoutqueue */ 5752/* Returns: int - new reference count value of the timeout queue */ 5753/* Parameters: ifq(I) - timeout queue which is losing a reference. */ 5754/* Locks: ifq->ifq_lock */ 5755/* */ 5756/* This routine must be called when we're discarding a pointer to a timeout */ 5757/* queue object, taking care of the reference counter. */ 5758/* */ 5759/* Now that this just sets a DELETE flag, it requires the expire code to */ 5760/* check the list of user defined timeout queues and call the free function */ 5761/* below (currently commented out) to stop memory leaking. It is done this */ 5762/* way because the locking may not be sufficient to safely do a free when */ 5763/* this function is called. */ 5764/* ------------------------------------------------------------------------ */ 5765int 5766ipf_deletetimeoutqueue(ifq) 5767 ipftq_t *ifq; 5768{ 5769 5770 ifq->ifq_ref--; 5771 if ((ifq->ifq_ref == 0) && ((ifq->ifq_flags & IFQF_USER) != 0)) { 5772 ifq->ifq_flags |= IFQF_DELETE; 5773 } 5774 5775 return ifq->ifq_ref; 5776} 5777 5778 5779/* ------------------------------------------------------------------------ */ 5780/* Function: ipf_freetimeoutqueue */ 5781/* Parameters: ifq(I) - timeout queue which is losing a reference. */ 5782/* Returns: Nil */ 5783/* */ 5784/* Locking: */ 5785/* It is assumed that the caller of this function has an appropriate lock */ 5786/* held (exclusively) in the domain that encompases the callers "domain". */ 5787/* The ifq_lock for this structure should not be held. */ 5788/* */ 5789/* Remove a user defined timeout queue from the list of queues it is in and */ 5790/* tidy up after this is done. */ 5791/* ------------------------------------------------------------------------ */ 5792void 5793ipf_freetimeoutqueue(softc, ifq) 5794 ipf_main_softc_t *softc; 5795 ipftq_t *ifq; 5796{ 5797 5798 if (((ifq->ifq_flags & IFQF_DELETE) == 0) || (ifq->ifq_ref != 0) || 5799 ((ifq->ifq_flags & IFQF_USER) == 0)) { 5800 printf("ipf_freetimeoutqueue(%lx) flags 0x%x ttl %d ref %d\n", 5801 (u_long)ifq, ifq->ifq_flags, ifq->ifq_ttl, 5802 ifq->ifq_ref); 5803 return; 5804 } 5805 5806 /* 5807 * Remove from its position in the list. 5808 */ 5809 *ifq->ifq_pnext = ifq->ifq_next; 5810 if (ifq->ifq_next != NULL) 5811 ifq->ifq_next->ifq_pnext = ifq->ifq_pnext; 5812 ifq->ifq_next = NULL; 5813 ifq->ifq_pnext = NULL; 5814 5815 MUTEX_DESTROY(&ifq->ifq_lock); 5816 ATOMIC_DEC(softc->ipf_userifqs); 5817 KFREE(ifq); 5818} 5819 5820 5821/* ------------------------------------------------------------------------ */ 5822/* Function: ipf_deletequeueentry */ 5823/* Returns: Nil */ 5824/* Parameters: tqe(I) - timeout queue entry to delete */ 5825/* */ 5826/* Remove a tail queue entry from its queue and make it an orphan. */ 5827/* ipf_deletetimeoutqueue is called to make sure the reference count on the */ 5828/* queue is correct. We can't, however, call ipf_freetimeoutqueue because */ 5829/* the correct lock(s) may not be held that would make it safe to do so. */ 5830/* ------------------------------------------------------------------------ */ 5831void 5832ipf_deletequeueentry(tqe) 5833 ipftqent_t *tqe; 5834{ 5835 ipftq_t *ifq; 5836 5837 ifq = tqe->tqe_ifq; 5838 5839 MUTEX_ENTER(&ifq->ifq_lock); 5840 5841 if (tqe->tqe_pnext != NULL) { 5842 *tqe->tqe_pnext = tqe->tqe_next; 5843 if (tqe->tqe_next != NULL) 5844 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5845 else /* we must be the tail anyway */ 5846 ifq->ifq_tail = tqe->tqe_pnext; 5847 5848 tqe->tqe_pnext = NULL; 5849 tqe->tqe_ifq = NULL; 5850 } 5851 5852 (void) ipf_deletetimeoutqueue(ifq); 5853 ASSERT(ifq->ifq_ref > 0); 5854 5855 MUTEX_EXIT(&ifq->ifq_lock); 5856} 5857 5858 5859/* ------------------------------------------------------------------------ */ 5860/* Function: ipf_queuefront */ 5861/* Returns: Nil */ 5862/* Parameters: tqe(I) - pointer to timeout queue entry */ 5863/* */ 5864/* Move a queue entry to the front of the queue, if it isn't already there. */ 5865/* ------------------------------------------------------------------------ */ 5866void 5867ipf_queuefront(tqe) 5868 ipftqent_t *tqe; 5869{ 5870 ipftq_t *ifq; 5871 5872 ifq = tqe->tqe_ifq; 5873 if (ifq == NULL) 5874 return; 5875 5876 MUTEX_ENTER(&ifq->ifq_lock); 5877 if (ifq->ifq_head != tqe) { 5878 *tqe->tqe_pnext = tqe->tqe_next; 5879 if (tqe->tqe_next) 5880 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5881 else 5882 ifq->ifq_tail = tqe->tqe_pnext; 5883 5884 tqe->tqe_next = ifq->ifq_head; 5885 ifq->ifq_head->tqe_pnext = &tqe->tqe_next; 5886 ifq->ifq_head = tqe; 5887 tqe->tqe_pnext = &ifq->ifq_head; 5888 } 5889 MUTEX_EXIT(&ifq->ifq_lock); 5890} 5891 5892 5893/* ------------------------------------------------------------------------ */ 5894/* Function: ipf_queueback */ 5895/* Returns: Nil */ 5896/* Parameters: ticks(I) - ipf tick time to use with this call */ 5897/* tqe(I) - pointer to timeout queue entry */ 5898/* */ 5899/* Move a queue entry to the back of the queue, if it isn't already there. */ 5900/* We use use ticks to calculate the expiration and mark for when we last */ 5901/* touched the structure. */ 5902/* ------------------------------------------------------------------------ */ 5903void 5904ipf_queueback(ticks, tqe) 5905 u_long ticks; 5906 ipftqent_t *tqe; 5907{ 5908 ipftq_t *ifq; 5909 5910 ifq = tqe->tqe_ifq; 5911 if (ifq == NULL) 5912 return; 5913 tqe->tqe_die = ticks + ifq->ifq_ttl; 5914 tqe->tqe_touched = ticks; 5915 5916 MUTEX_ENTER(&ifq->ifq_lock); 5917 if (tqe->tqe_next != NULL) { /* at the end already ? */ 5918 /* 5919 * Remove from list 5920 */ 5921 *tqe->tqe_pnext = tqe->tqe_next; 5922 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5923 5924 /* 5925 * Make it the last entry. 5926 */ 5927 tqe->tqe_next = NULL; 5928 tqe->tqe_pnext = ifq->ifq_tail; 5929 *ifq->ifq_tail = tqe; 5930 ifq->ifq_tail = &tqe->tqe_next; 5931 } 5932 MUTEX_EXIT(&ifq->ifq_lock); 5933} 5934 5935 5936/* ------------------------------------------------------------------------ */ 5937/* Function: ipf_queueappend */ 5938/* Returns: Nil */ 5939/* Parameters: ticks(I) - ipf tick time to use with this call */ 5940/* tqe(I) - pointer to timeout queue entry */ 5941/* ifq(I) - pointer to timeout queue */ 5942/* parent(I) - owing object pointer */ 5943/* */ 5944/* Add a new item to this queue and put it on the very end. */ 5945/* We use use ticks to calculate the expiration and mark for when we last */ 5946/* touched the structure. */ 5947/* ------------------------------------------------------------------------ */ 5948void 5949ipf_queueappend(ticks, tqe, ifq, parent) 5950 u_long ticks; 5951 ipftqent_t *tqe; 5952 ipftq_t *ifq; 5953 void *parent; 5954{ 5955 5956 MUTEX_ENTER(&ifq->ifq_lock); 5957 tqe->tqe_parent = parent; 5958 tqe->tqe_pnext = ifq->ifq_tail; 5959 *ifq->ifq_tail = tqe; 5960 ifq->ifq_tail = &tqe->tqe_next; 5961 tqe->tqe_next = NULL; 5962 tqe->tqe_ifq = ifq; 5963 tqe->tqe_die = ticks + ifq->ifq_ttl; 5964 tqe->tqe_touched = ticks; 5965 ifq->ifq_ref++; 5966 MUTEX_EXIT(&ifq->ifq_lock); 5967} 5968 5969 5970/* ------------------------------------------------------------------------ */ 5971/* Function: ipf_movequeue */ 5972/* Returns: Nil */ 5973/* Parameters: tq(I) - pointer to timeout queue information */ 5974/* oifp(I) - old timeout queue entry was on */ 5975/* nifp(I) - new timeout queue to put entry on */ 5976/* */ 5977/* Move a queue entry from one timeout queue to another timeout queue. */ 5978/* If it notices that the current entry is already last and does not need */ 5979/* to move queue, the return. */ 5980/* ------------------------------------------------------------------------ */ 5981void 5982ipf_movequeue(ticks, tqe, oifq, nifq) 5983 u_long ticks; 5984 ipftqent_t *tqe; 5985 ipftq_t *oifq, *nifq; 5986{ 5987 5988 /* 5989 * If the queue hasn't changed and we last touched this entry at the 5990 * same ipf time, then we're not going to achieve anything by either 5991 * changing the ttl or moving it on the queue. 5992 */ 5993 if (oifq == nifq && tqe->tqe_touched == ticks) 5994 return; 5995 5996 /* 5997 * For any of this to be outside the lock, there is a risk that two 5998 * packets entering simultaneously, with one changing to a different 5999 * queue and one not, could end up with things in a bizarre state. 6000 */ 6001 MUTEX_ENTER(&oifq->ifq_lock); 6002 6003 tqe->tqe_touched = ticks; 6004 tqe->tqe_die = ticks + nifq->ifq_ttl; 6005 /* 6006 * Is the operation here going to be a no-op ? 6007 */ 6008 if (oifq == nifq) { 6009 if ((tqe->tqe_next == NULL) || 6010 (tqe->tqe_next->tqe_die == tqe->tqe_die)) { 6011 MUTEX_EXIT(&oifq->ifq_lock); 6012 return; 6013 } 6014 } 6015 6016 /* 6017 * Remove from the old queue 6018 */ 6019 *tqe->tqe_pnext = tqe->tqe_next; 6020 if (tqe->tqe_next) 6021 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 6022 else 6023 oifq->ifq_tail = tqe->tqe_pnext; 6024 tqe->tqe_next = NULL; 6025 6026 /* 6027 * If we're moving from one queue to another, release the 6028 * lock on the old queue and get a lock on the new queue. 6029 * For user defined queues, if we're moving off it, call 6030 * delete in case it can now be freed. 6031 */ 6032 if (oifq != nifq) { 6033 tqe->tqe_ifq = NULL; 6034 6035 (void) ipf_deletetimeoutqueue(oifq); 6036 6037 MUTEX_EXIT(&oifq->ifq_lock); 6038 6039 MUTEX_ENTER(&nifq->ifq_lock); 6040 6041 tqe->tqe_ifq = nifq; 6042 nifq->ifq_ref++; 6043 } 6044 6045 /* 6046 * Add to the bottom of the new queue 6047 */ 6048 tqe->tqe_pnext = nifq->ifq_tail; 6049 *nifq->ifq_tail = tqe; 6050 nifq->ifq_tail = &tqe->tqe_next; 6051 MUTEX_EXIT(&nifq->ifq_lock); 6052} 6053 6054 6055/* ------------------------------------------------------------------------ */ 6056/* Function: ipf_updateipid */ 6057/* Returns: int - 0 == success, -1 == error (packet should be droppped) */ 6058/* Parameters: fin(I) - pointer to packet information */ 6059/* */ 6060/* When we are doing NAT, change the IP of every packet to represent a */ 6061/* single sequence of packets coming from the host, hiding any host */ 6062/* specific sequencing that might otherwise be revealed. If the packet is */ 6063/* a fragment, then store the 'new' IPid in the fragment cache and look up */ 6064/* the fragment cache for non-leading fragments. If a non-leading fragment */ 6065/* has no match in the cache, return an error. */ 6066/* ------------------------------------------------------------------------ */ 6067static int 6068ipf_updateipid(fin) 6069 fr_info_t *fin; 6070{ 6071 u_short id, ido, sums; 6072 u_32_t sumd, sum; 6073 ip_t *ip; 6074 6075 if (fin->fin_off != 0) { 6076 sum = ipf_frag_ipidknown(fin); 6077 if (sum == 0xffffffff) 6078 return -1; 6079 sum &= 0xffff; 6080 id = (u_short)sum; 6081 } else { 6082 id = ipf_nextipid(fin); 6083 if (fin->fin_off == 0 && (fin->fin_flx & FI_FRAG) != 0) 6084 (void) ipf_frag_ipidnew(fin, (u_32_t)id); 6085 } 6086 6087 ip = fin->fin_ip; 6088 ido = ntohs(ip->ip_id); 6089 if (id == ido) 6090 return 0; 6091 ip->ip_id = htons(id); 6092 CALC_SUMD(ido, id, sumd); /* DESTRUCTIVE MACRO! id,ido change */ 6093 sum = (~ntohs(ip->ip_sum)) & 0xffff; 6094 sum += sumd; 6095 sum = (sum >> 16) + (sum & 0xffff); 6096 sum = (sum >> 16) + (sum & 0xffff); 6097 sums = ~(u_short)sum; 6098 ip->ip_sum = htons(sums); 6099 return 0; 6100} 6101 6102 6103#ifdef NEED_FRGETIFNAME 6104/* ------------------------------------------------------------------------ */ 6105/* Function: ipf_getifname */ 6106/* Returns: char * - pointer to interface name */ 6107/* Parameters: ifp(I) - pointer to network interface */ 6108/* buffer(O) - pointer to where to store interface name */ 6109/* */ 6110/* Constructs an interface name in the buffer passed. The buffer passed is */ 6111/* expected to be at least LIFNAMSIZ in bytes big. If buffer is passed in */ 6112/* as a NULL pointer then return a pointer to a static array. */ 6113/* ------------------------------------------------------------------------ */ 6114char * 6115ipf_getifname(ifp, buffer) 6116 struct ifnet *ifp; 6117 char *buffer; 6118{ 6119 static char namebuf[LIFNAMSIZ]; 6120# if defined(MENTAT) || defined(__FreeBSD__) || defined(__osf__) || \ 6121 defined(__sgi) || defined(linux) || defined(_AIX51) || \ 6122 (defined(sun) && !defined(__SVR4) && !defined(__svr4__)) 6123 int unit, space; 6124 char temp[20]; 6125 char *s; 6126# endif 6127 6128 if (buffer == NULL) 6129 buffer = namebuf; 6130 (void) strncpy(buffer, ifp->if_name, LIFNAMSIZ); 6131 buffer[LIFNAMSIZ - 1] = '\0'; 6132# if defined(MENTAT) || defined(__FreeBSD__) || defined(__osf__) || \ 6133 defined(__sgi) || defined(_AIX51) || \ 6134 (defined(sun) && !defined(__SVR4) && !defined(__svr4__)) 6135 for (s = buffer; *s; s++) 6136 ; 6137 unit = ifp->if_unit; 6138 space = LIFNAMSIZ - (s - buffer); 6139 if ((space > 0) && (unit >= 0)) { 6140# if defined(SNPRINTF) && defined(_KERNEL) 6141 SNPRINTF(temp, sizeof(temp), "%d", unit); 6142# else 6143 (void) sprintf(temp, "%d", unit); 6144# endif 6145 (void) strncpy(s, temp, space); 6146 } 6147# endif 6148 return buffer; 6149} 6150#endif 6151 6152 6153/* ------------------------------------------------------------------------ */ 6154/* Function: ipf_ioctlswitch */ 6155/* Returns: int - -1 continue processing, else ioctl return value */ 6156/* Parameters: unit(I) - device unit opened */ 6157/* data(I) - pointer to ioctl data */ 6158/* cmd(I) - ioctl command */ 6159/* mode(I) - mode value */ 6160/* uid(I) - uid making the ioctl call */ 6161/* ctx(I) - pointer to context data */ 6162/* */ 6163/* Based on the value of unit, call the appropriate ioctl handler or return */ 6164/* EIO if ipfilter is not running. Also checks if write perms are req'd */ 6165/* for the device in order to execute the ioctl. A special case is made */ 6166/* SIOCIPFINTERROR so that the same code isn't required in every handler. */ 6167/* The context data pointer is passed through as this is used as the key */ 6168/* for locating a matching token for continued access for walking lists, */ 6169/* etc. */ 6170/* ------------------------------------------------------------------------ */ 6171int 6172ipf_ioctlswitch(softc, unit, data, cmd, mode, uid, ctx) 6173 ipf_main_softc_t *softc; 6174 int unit, mode, uid; 6175 ioctlcmd_t cmd; 6176 void *data, *ctx; 6177{ 6178 int error = 0; 6179 6180 switch (cmd) 6181 { 6182 case SIOCIPFINTERROR : 6183 error = BCOPYOUT(&softc->ipf_interror, data, 6184 sizeof(softc->ipf_interror)); 6185 if (error != 0) { 6186 IPFERROR(40); 6187 error = EFAULT; 6188 } 6189 return error; 6190 default : 6191 break; 6192 } 6193 6194 switch (unit) 6195 { 6196 case IPL_LOGIPF : 6197 error = ipf_ipf_ioctl(softc, data, cmd, mode, uid, ctx); 6198 break; 6199 case IPL_LOGNAT : 6200 if (softc->ipf_running > 0) { 6201 error = ipf_nat_ioctl(softc, data, cmd, mode, 6202 uid, ctx); 6203 } else { 6204 IPFERROR(42); 6205 error = EIO; 6206 } 6207 break; 6208 case IPL_LOGSTATE : 6209 if (softc->ipf_running > 0) { 6210 error = ipf_state_ioctl(softc, data, cmd, mode, 6211 uid, ctx); 6212 } else { 6213 IPFERROR(43); 6214 error = EIO; 6215 } 6216 break; 6217 case IPL_LOGAUTH : 6218 if (softc->ipf_running > 0) { 6219 error = ipf_auth_ioctl(softc, data, cmd, mode, 6220 uid, ctx); 6221 } else { 6222 IPFERROR(44); 6223 error = EIO; 6224 } 6225 break; 6226 case IPL_LOGSYNC : 6227 if (softc->ipf_running > 0) { 6228 error = ipf_sync_ioctl(softc, data, cmd, mode, 6229 uid, ctx); 6230 } else { 6231 error = EIO; 6232 IPFERROR(45); 6233 } 6234 break; 6235 case IPL_LOGSCAN : 6236#ifdef IPFILTER_SCAN 6237 if (softc->ipf_running > 0) 6238 error = ipf_scan_ioctl(softc, data, cmd, mode, 6239 uid, ctx); 6240 else 6241#endif 6242 { 6243 error = EIO; 6244 IPFERROR(46); 6245 } 6246 break; 6247 case IPL_LOGLOOKUP : 6248 if (softc->ipf_running > 0) { 6249 error = ipf_lookup_ioctl(softc, data, cmd, mode, 6250 uid, ctx); 6251 } else { 6252 error = EIO; 6253 IPFERROR(47); 6254 } 6255 break; 6256 default : 6257 IPFERROR(48); 6258 error = EIO; 6259 break; 6260 } 6261 6262 return error; 6263} 6264 6265 6266/* 6267 * This array defines the expected size of objects coming into the kernel 6268 * for the various recognised object types. The first column is flags (see 6269 * below), 2nd column is current size, 3rd column is the version number of 6270 * when the current size became current. 6271 * Flags: 6272 * 1 = minimum size, not absolute size 6273 */ 6274static int ipf_objbytes[IPFOBJ_COUNT][3] = { 6275 { 1, sizeof(struct frentry), 5010000 }, /* 0 */ 6276 { 1, sizeof(struct friostat), 5010000 }, 6277 { 0, sizeof(struct fr_info), 5010000 }, 6278 { 0, sizeof(struct ipf_authstat), 4010100 }, 6279 { 0, sizeof(struct ipfrstat), 5010000 }, 6280 { 1, sizeof(struct ipnat), 5010000 }, /* 5 */ 6281 { 0, sizeof(struct natstat), 5010000 }, 6282 { 0, sizeof(struct ipstate_save), 5010000 }, 6283 { 1, sizeof(struct nat_save), 5010000 }, 6284 { 0, sizeof(struct natlookup), 5010000 }, 6285 { 1, sizeof(struct ipstate), 5010000 }, /* 10 */ 6286 { 0, sizeof(struct ips_stat), 5010000 }, 6287 { 0, sizeof(struct frauth), 5010000 }, 6288 { 0, sizeof(struct ipftune), 4010100 }, 6289 { 0, sizeof(struct nat), 5010000 }, 6290 { 0, sizeof(struct ipfruleiter), 4011400 }, /* 15 */ 6291 { 0, sizeof(struct ipfgeniter), 4011400 }, 6292 { 0, sizeof(struct ipftable), 4011400 }, 6293 { 0, sizeof(struct ipflookupiter), 4011400 }, 6294 { 0, sizeof(struct ipftq) * IPF_TCP_NSTATES }, 6295 { 1, 0, 0 }, /* IPFEXPR */ 6296 { 0, 0, 0 }, /* PROXYCTL */ 6297 { 0, sizeof (struct fripf), 5010000 } 6298}; 6299 6300 6301/* ------------------------------------------------------------------------ */ 6302/* Function: ipf_inobj */ 6303/* Returns: int - 0 = success, else failure */ 6304/* Parameters: softc(I) - soft context pointerto work with */ 6305/* data(I) - pointer to ioctl data */ 6306/* objp(O) - where to store ipfobj structure */ 6307/* ptr(I) - pointer to data to copy out */ 6308/* type(I) - type of structure being moved */ 6309/* */ 6310/* Copy in the contents of what the ipfobj_t points to. In future, we */ 6311/* add things to check for version numbers, sizes, etc, to make it backward */ 6312/* compatible at the ABI for user land. */ 6313/* If objp is not NULL then we assume that the caller wants to see what is */ 6314/* in the ipfobj_t structure being copied in. As an example, this can tell */ 6315/* the caller what version of ipfilter the ioctl program was written to. */ 6316/* ------------------------------------------------------------------------ */ 6317int 6318ipf_inobj(softc, data, objp, ptr, type) 6319 ipf_main_softc_t *softc; 6320 void *data; 6321 ipfobj_t *objp; 6322 void *ptr; 6323 int type; 6324{ 6325 ipfobj_t obj; 6326 int error; 6327 int size; 6328 6329 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6330 IPFERROR(49); 6331 return EINVAL; 6332 } 6333 6334 if (objp == NULL) 6335 objp = &obj; 6336 error = BCOPYIN(data, objp, sizeof(*objp)); 6337 if (error != 0) { 6338 IPFERROR(124); 6339 return EFAULT; 6340 } 6341 6342 if (objp->ipfo_type != type) { 6343 IPFERROR(50); 6344 return EINVAL; 6345 } 6346 6347 if (objp->ipfo_rev >= ipf_objbytes[type][2]) { 6348 if ((ipf_objbytes[type][0] & 1) != 0) { 6349 if (objp->ipfo_size < ipf_objbytes[type][1]) { 6350 IPFERROR(51); 6351 return EINVAL; 6352 } 6353 size = ipf_objbytes[type][1]; 6354 } else if (objp->ipfo_size == ipf_objbytes[type][1]) { 6355 size = objp->ipfo_size; 6356 } else { 6357 IPFERROR(52); 6358 return EINVAL; 6359 } 6360 error = COPYIN(objp->ipfo_ptr, ptr, size); 6361 if (error != 0) { 6362 IPFERROR(55); 6363 error = EFAULT; 6364 } 6365 } else { 6366#ifdef IPFILTER_COMPAT 6367 error = ipf_in_compat(softc, objp, ptr, 0); 6368#else 6369 IPFERROR(54); 6370 error = EINVAL; 6371#endif 6372 } 6373 return error; 6374} 6375 6376 6377/* ------------------------------------------------------------------------ */ 6378/* Function: ipf_inobjsz */ 6379/* Returns: int - 0 = success, else failure */ 6380/* Parameters: softc(I) - soft context pointerto work with */ 6381/* data(I) - pointer to ioctl data */ 6382/* ptr(I) - pointer to store real data in */ 6383/* type(I) - type of structure being moved */ 6384/* sz(I) - size of data to copy */ 6385/* */ 6386/* As per ipf_inobj, except the size of the object to copy in is passed in */ 6387/* but it must not be smaller than the size defined for the type and the */ 6388/* type must allow for varied sized objects. The extra requirement here is */ 6389/* that sz must match the size of the object being passed in - this is not */ 6390/* not possible nor required in ipf_inobj(). */ 6391/* ------------------------------------------------------------------------ */ 6392int 6393ipf_inobjsz(softc, data, ptr, type, sz) 6394 ipf_main_softc_t *softc; 6395 void *data; 6396 void *ptr; 6397 int type, sz; 6398{ 6399 ipfobj_t obj; 6400 int error; 6401 6402 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6403 IPFERROR(56); 6404 return EINVAL; 6405 } 6406 6407 error = BCOPYIN(data, &obj, sizeof(obj)); 6408 if (error != 0) { 6409 IPFERROR(125); 6410 return EFAULT; 6411 } 6412 6413 if (obj.ipfo_type != type) { 6414 IPFERROR(58); 6415 return EINVAL; 6416 } 6417 6418 if (obj.ipfo_rev >= ipf_objbytes[type][2]) { 6419 if (((ipf_objbytes[type][0] & 1) == 0) || 6420 (sz < ipf_objbytes[type][1])) { 6421 IPFERROR(57); 6422 return EINVAL; 6423 } 6424 error = COPYIN(obj.ipfo_ptr, ptr, sz); 6425 if (error != 0) { 6426 IPFERROR(61); 6427 error = EFAULT; 6428 } 6429 } else { 6430#ifdef IPFILTER_COMPAT 6431 error = ipf_in_compat(softc, &obj, ptr, sz); 6432#else 6433 IPFERROR(60); 6434 error = EINVAL; 6435#endif 6436 } 6437 return error; 6438} 6439 6440 6441/* ------------------------------------------------------------------------ */ 6442/* Function: ipf_outobjsz */ 6443/* Returns: int - 0 = success, else failure */ 6444/* Parameters: data(I) - pointer to ioctl data */ 6445/* ptr(I) - pointer to store real data in */ 6446/* type(I) - type of structure being moved */ 6447/* sz(I) - size of data to copy */ 6448/* */ 6449/* As per ipf_outobj, except the size of the object to copy out is passed in*/ 6450/* but it must not be smaller than the size defined for the type and the */ 6451/* type must allow for varied sized objects. The extra requirement here is */ 6452/* that sz must match the size of the object being passed in - this is not */ 6453/* not possible nor required in ipf_outobj(). */ 6454/* ------------------------------------------------------------------------ */ 6455int 6456ipf_outobjsz(softc, data, ptr, type, sz) 6457 ipf_main_softc_t *softc; 6458 void *data; 6459 void *ptr; 6460 int type, sz; 6461{ 6462 ipfobj_t obj; 6463 int error; 6464 6465 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6466 IPFERROR(62); 6467 return EINVAL; 6468 } 6469 6470 error = BCOPYIN(data, &obj, sizeof(obj)); 6471 if (error != 0) { 6472 IPFERROR(127); 6473 return EFAULT; 6474 } 6475 6476 if (obj.ipfo_type != type) { 6477 IPFERROR(63); 6478 return EINVAL; 6479 } 6480 6481 if (obj.ipfo_rev >= ipf_objbytes[type][2]) { 6482 if (((ipf_objbytes[type][0] & 1) == 0) || 6483 (sz < ipf_objbytes[type][1])) { 6484 IPFERROR(146); 6485 return EINVAL; 6486 } 6487 error = COPYOUT(ptr, obj.ipfo_ptr, sz); 6488 if (error != 0) { 6489 IPFERROR(66); 6490 error = EFAULT; 6491 } 6492 } else { 6493#ifdef IPFILTER_COMPAT 6494 error = ipf_out_compat(softc, &obj, ptr); 6495#else 6496 IPFERROR(65); 6497 error = EINVAL; 6498#endif 6499 } 6500 return error; 6501} 6502 6503 6504/* ------------------------------------------------------------------------ */ 6505/* Function: ipf_outobj */ 6506/* Returns: int - 0 = success, else failure */ 6507/* Parameters: data(I) - pointer to ioctl data */ 6508/* ptr(I) - pointer to store real data in */ 6509/* type(I) - type of structure being moved */ 6510/* */ 6511/* Copy out the contents of what ptr is to where ipfobj points to. In */ 6512/* future, we add things to check for version numbers, sizes, etc, to make */ 6513/* it backward compatible at the ABI for user land. */ 6514/* ------------------------------------------------------------------------ */ 6515int 6516ipf_outobj(softc, data, ptr, type) 6517 ipf_main_softc_t *softc; 6518 void *data; 6519 void *ptr; 6520 int type; 6521{ 6522 ipfobj_t obj; 6523 int error; 6524 6525 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6526 IPFERROR(67); 6527 return EINVAL; 6528 } 6529 6530 error = BCOPYIN(data, &obj, sizeof(obj)); 6531 if (error != 0) { 6532 IPFERROR(126); 6533 return EFAULT; 6534 } 6535 6536 if (obj.ipfo_type != type) { 6537 IPFERROR(68); 6538 return EINVAL; 6539 } 6540 6541 if (obj.ipfo_rev >= ipf_objbytes[type][2]) { 6542 if ((ipf_objbytes[type][0] & 1) != 0) { 6543 if (obj.ipfo_size < ipf_objbytes[type][1]) { 6544 IPFERROR(69); 6545 return EINVAL; 6546 } 6547 } else if (obj.ipfo_size != ipf_objbytes[type][1]) { 6548 IPFERROR(70); 6549 return EINVAL; 6550 } 6551 6552 error = COPYOUT(ptr, obj.ipfo_ptr, obj.ipfo_size); 6553 if (error != 0) { 6554 IPFERROR(73); 6555 error = EFAULT; 6556 } 6557 } else { 6558#ifdef IPFILTER_COMPAT 6559 error = ipf_out_compat(softc, &obj, ptr); 6560#else 6561 IPFERROR(72); 6562 error = EINVAL; 6563#endif 6564 } 6565 return error; 6566} 6567 6568 6569/* ------------------------------------------------------------------------ */ 6570/* Function: ipf_outobjk */ 6571/* Returns: int - 0 = success, else failure */ 6572/* Parameters: obj(I) - pointer to data description structure */ 6573/* ptr(I) - pointer to kernel data to copy out */ 6574/* */ 6575/* In the above functions, the ipfobj_t structure is copied into the kernel,*/ 6576/* telling ipfilter how to copy out data. In this instance, the ipfobj_t is */ 6577/* already populated with information and now we just need to use it. */ 6578/* There is no need for this function to have a "type" parameter as there */ 6579/* is no point in validating information that comes from the kernel with */ 6580/* itself. */ 6581/* ------------------------------------------------------------------------ */ 6582int 6583ipf_outobjk(softc, obj, ptr) 6584 ipf_main_softc_t *softc; 6585 ipfobj_t *obj; 6586 void *ptr; 6587{ 6588 int type = obj->ipfo_type; 6589 int error; 6590 6591 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6592 IPFERROR(147); 6593 return EINVAL; 6594 } 6595 6596 if (obj->ipfo_rev >= ipf_objbytes[type][2]) { 6597 if ((ipf_objbytes[type][0] & 1) != 0) { 6598 if (obj->ipfo_size < ipf_objbytes[type][1]) { 6599 IPFERROR(148); 6600 return EINVAL; 6601 } 6602 6603 } else if (obj->ipfo_size != ipf_objbytes[type][1]) { 6604 IPFERROR(149); 6605 return EINVAL; 6606 } 6607 6608 error = COPYOUT(ptr, obj->ipfo_ptr, obj->ipfo_size); 6609 if (error != 0) { 6610 IPFERROR(150); 6611 error = EFAULT; 6612 } 6613 } else { 6614#ifdef IPFILTER_COMPAT 6615 error = ipf_out_compat(softc, obj, ptr); 6616#else 6617 IPFERROR(151); 6618 error = EINVAL; 6619#endif 6620 } 6621 return error; 6622} 6623 6624 6625/* ------------------------------------------------------------------------ */ 6626/* Function: ipf_checkl4sum */ 6627/* Returns: int - 0 = good, -1 = bad, 1 = cannot check */ 6628/* Parameters: fin(I) - pointer to packet information */ 6629/* */ 6630/* If possible, calculate the layer 4 checksum for the packet. If this is */ 6631/* not possible, return without indicating a failure or success but in a */ 6632/* way that is ditinguishable. This function should only be called by the */ 6633/* ipf_checkv6sum() for each platform. */ 6634/* ------------------------------------------------------------------------ */ 6635INLINE int 6636ipf_checkl4sum(fin) 6637 fr_info_t *fin; 6638{ 6639 u_short sum, hdrsum, *csump; 6640 udphdr_t *udp; 6641 int dosum; 6642 6643 /* 6644 * If the TCP packet isn't a fragment, isn't too short and otherwise 6645 * isn't already considered "bad", then validate the checksum. If 6646 * this check fails then considered the packet to be "bad". 6647 */ 6648 if ((fin->fin_flx & (FI_FRAG|FI_SHORT|FI_BAD)) != 0) 6649 return 1; 6650 6651 DT2(l4sumo, int, fin->fin_out, int, (int)fin->fin_p); 6652 if (fin->fin_out == 1) { 6653 fin->fin_cksum = FI_CK_SUMOK; 6654 return 0; 6655 } 6656 6657 csump = NULL; 6658 hdrsum = 0; 6659 dosum = 0; 6660 sum = 0; 6661 6662 switch (fin->fin_p) 6663 { 6664 case IPPROTO_TCP : 6665 csump = &((tcphdr_t *)fin->fin_dp)->th_sum; 6666 dosum = 1; 6667 break; 6668 6669 case IPPROTO_UDP : 6670 udp = fin->fin_dp; 6671 if (udp->uh_sum != 0) { 6672 csump = &udp->uh_sum; 6673 dosum = 1; 6674 } 6675 break; 6676 6677#ifdef USE_INET6 6678 case IPPROTO_ICMPV6 : 6679 csump = &((struct icmp6_hdr *)fin->fin_dp)->icmp6_cksum; 6680 dosum = 1; 6681 break; 6682#endif 6683 6684 case IPPROTO_ICMP : 6685 csump = &((struct icmp *)fin->fin_dp)->icmp_cksum; 6686 dosum = 1; 6687 break; 6688 6689 default : 6690 return 1; 6691 /*NOTREACHED*/ 6692 } 6693 6694 if (csump != NULL) 6695 hdrsum = *csump; 6696 6697 if (dosum) { 6698 sum = fr_cksum(fin, fin->fin_ip, fin->fin_p, fin->fin_dp); 6699 } 6700#if !defined(_KERNEL) 6701 if (sum == hdrsum) { 6702 FR_DEBUG(("checkl4sum: %hx == %hx\n", sum, hdrsum)); 6703 } else { 6704 FR_DEBUG(("checkl4sum: %hx != %hx\n", sum, hdrsum)); 6705 } 6706#endif 6707 DT2(l4sums, u_short, hdrsum, u_short, sum); 6708#ifdef USE_INET6 6709 if (hdrsum == sum || (sum == 0 && fin->fin_p == IPPROTO_ICMPV6)) { 6710#else 6711 if (hdrsum == sum) { 6712#endif 6713 fin->fin_cksum = FI_CK_SUMOK; 6714 return 0; 6715 } 6716 fin->fin_cksum = FI_CK_BAD; 6717 return -1; 6718} 6719 6720 6721/* ------------------------------------------------------------------------ */ 6722/* Function: ipf_ifpfillv4addr */ 6723/* Returns: int - 0 = address update, -1 = address not updated */ 6724/* Parameters: atype(I) - type of network address update to perform */ 6725/* sin(I) - pointer to source of address information */ 6726/* mask(I) - pointer to source of netmask information */ 6727/* inp(I) - pointer to destination address store */ 6728/* inpmask(I) - pointer to destination netmask store */ 6729/* */ 6730/* Given a type of network address update (atype) to perform, copy */ 6731/* information from sin/mask into inp/inpmask. If ipnmask is NULL then no */ 6732/* netmask update is performed unless FRI_NETMASKED is passed as atype, in */ 6733/* which case the operation fails. For all values of atype other than */ 6734/* FRI_NETMASKED, if inpmask is non-NULL then the mask is set to an all 1s */ 6735/* value. */ 6736/* ------------------------------------------------------------------------ */ 6737int 6738ipf_ifpfillv4addr(atype, sin, mask, inp, inpmask) 6739 int atype; 6740 struct sockaddr_in *sin, *mask; 6741 struct in_addr *inp, *inpmask; 6742{ 6743 if (inpmask != NULL && atype != FRI_NETMASKED) 6744 inpmask->s_addr = 0xffffffff; 6745 6746 if (atype == FRI_NETWORK || atype == FRI_NETMASKED) { 6747 if (atype == FRI_NETMASKED) { 6748 if (inpmask == NULL) 6749 return -1; 6750 inpmask->s_addr = mask->sin_addr.s_addr; 6751 } 6752 inp->s_addr = sin->sin_addr.s_addr & mask->sin_addr.s_addr; 6753 } else { 6754 inp->s_addr = sin->sin_addr.s_addr; 6755 } 6756 return 0; 6757} 6758 6759 6760#ifdef USE_INET6 6761/* ------------------------------------------------------------------------ */ 6762/* Function: ipf_ifpfillv6addr */ 6763/* Returns: int - 0 = address update, -1 = address not updated */ 6764/* Parameters: atype(I) - type of network address update to perform */ 6765/* sin(I) - pointer to source of address information */ 6766/* mask(I) - pointer to source of netmask information */ 6767/* inp(I) - pointer to destination address store */ 6768/* inpmask(I) - pointer to destination netmask store */ 6769/* */ 6770/* Given a type of network address update (atype) to perform, copy */ 6771/* information from sin/mask into inp/inpmask. If ipnmask is NULL then no */ 6772/* netmask update is performed unless FRI_NETMASKED is passed as atype, in */ 6773/* which case the operation fails. For all values of atype other than */ 6774/* FRI_NETMASKED, if inpmask is non-NULL then the mask is set to an all 1s */ 6775/* value. */ 6776/* ------------------------------------------------------------------------ */ 6777int 6778ipf_ifpfillv6addr(atype, sin, mask, inp, inpmask) 6779 int atype; 6780 struct sockaddr_in6 *sin, *mask; 6781 i6addr_t *inp, *inpmask; 6782{ 6783 i6addr_t *src, *and; 6784 6785 src = (i6addr_t *)&sin->sin6_addr; 6786 and = (i6addr_t *)&mask->sin6_addr; 6787 6788 if (inpmask != NULL && atype != FRI_NETMASKED) { 6789 inpmask->i6[0] = 0xffffffff; 6790 inpmask->i6[1] = 0xffffffff; 6791 inpmask->i6[2] = 0xffffffff; 6792 inpmask->i6[3] = 0xffffffff; 6793 } 6794 6795 if (atype == FRI_NETWORK || atype == FRI_NETMASKED) { 6796 if (atype == FRI_NETMASKED) { 6797 if (inpmask == NULL) 6798 return -1; 6799 inpmask->i6[0] = and->i6[0]; 6800 inpmask->i6[1] = and->i6[1]; 6801 inpmask->i6[2] = and->i6[2]; 6802 inpmask->i6[3] = and->i6[3]; 6803 } 6804 6805 inp->i6[0] = src->i6[0] & and->i6[0]; 6806 inp->i6[1] = src->i6[1] & and->i6[1]; 6807 inp->i6[2] = src->i6[2] & and->i6[2]; 6808 inp->i6[3] = src->i6[3] & and->i6[3]; 6809 } else { 6810 inp->i6[0] = src->i6[0]; 6811 inp->i6[1] = src->i6[1]; 6812 inp->i6[2] = src->i6[2]; 6813 inp->i6[3] = src->i6[3]; 6814 } 6815 return 0; 6816} 6817#endif 6818 6819 6820/* ------------------------------------------------------------------------ */ 6821/* Function: ipf_matchtag */ 6822/* Returns: 0 == mismatch, 1 == match. */ 6823/* Parameters: tag1(I) - pointer to first tag to compare */ 6824/* tag2(I) - pointer to second tag to compare */ 6825/* */ 6826/* Returns true (non-zero) or false(0) if the two tag structures can be */ 6827/* considered to be a match or not match, respectively. The tag is 16 */ 6828/* bytes long (16 characters) but that is overlayed with 4 32bit ints so */ 6829/* compare the ints instead, for speed. tag1 is the master of the */ 6830/* comparison. This function should only be called with both tag1 and tag2 */ 6831/* as non-NULL pointers. */ 6832/* ------------------------------------------------------------------------ */ 6833int 6834ipf_matchtag(tag1, tag2) 6835 ipftag_t *tag1, *tag2; 6836{ 6837 if (tag1 == tag2) 6838 return 1; 6839 6840 if ((tag1->ipt_num[0] == 0) && (tag2->ipt_num[0] == 0)) 6841 return 1; 6842 6843 if ((tag1->ipt_num[0] == tag2->ipt_num[0]) && 6844 (tag1->ipt_num[1] == tag2->ipt_num[1]) && 6845 (tag1->ipt_num[2] == tag2->ipt_num[2]) && 6846 (tag1->ipt_num[3] == tag2->ipt_num[3])) 6847 return 1; 6848 return 0; 6849} 6850 6851 6852/* ------------------------------------------------------------------------ */ 6853/* Function: ipf_coalesce */ 6854/* Returns: 1 == success, -1 == failure, 0 == no change */ 6855/* Parameters: fin(I) - pointer to packet information */ 6856/* */ 6857/* Attempt to get all of the packet data into a single, contiguous buffer. */ 6858/* If this call returns a failure then the buffers have also been freed. */ 6859/* ------------------------------------------------------------------------ */ 6860int 6861ipf_coalesce(fin) 6862 fr_info_t *fin; 6863{ 6864 6865 if ((fin->fin_flx & FI_COALESCE) != 0) 6866 return 1; 6867 6868 /* 6869 * If the mbuf pointers indicate that there is no mbuf to work with, 6870 * return but do not indicate success or failure. 6871 */ 6872 if (fin->fin_m == NULL || fin->fin_mp == NULL) 6873 return 0; 6874 6875#if defined(_KERNEL) 6876 if (ipf_pullup(fin->fin_m, fin, fin->fin_plen) == NULL) { 6877 ipf_main_softc_t *softc = fin->fin_main_soft; 6878 6879 DT1(frb_coalesce, fr_info_t *, fin); 6880 LBUMP(ipf_stats[fin->fin_out].fr_badcoalesces); 6881# ifdef MENTAT 6882 FREE_MB_T(*fin->fin_mp); 6883# endif 6884 fin->fin_reason = FRB_COALESCE; 6885 *fin->fin_mp = NULL; 6886 fin->fin_m = NULL; 6887 return -1; 6888 } 6889#else 6890 fin = fin; /* LINT */ 6891#endif 6892 return 1; 6893} 6894 6895 6896/* 6897 * The following table lists all of the tunable variables that can be 6898 * accessed via SIOCIPFGET/SIOCIPFSET/SIOCIPFGETNEXt. The format of each row 6899 * in the table below is as follows: 6900 * 6901 * pointer to value, name of value, minimum, maximum, size of the value's 6902 * container, value attribute flags 6903 * 6904 * For convienience, IPFT_RDONLY means the value is read-only, IPFT_WRDISABLED 6905 * means the value can only be written to when IPFilter is loaded but disabled. 6906 * The obvious implication is if neither of these are set then the value can be 6907 * changed at any time without harm. 6908 */ 6909 6910 6911/* ------------------------------------------------------------------------ */ 6912/* Function: ipf_tune_findbycookie */ 6913/* Returns: NULL = search failed, else pointer to tune struct */ 6914/* Parameters: cookie(I) - cookie value to search for amongst tuneables */ 6915/* next(O) - pointer to place to store the cookie for the */ 6916/* "next" tuneable, if it is desired. */ 6917/* */ 6918/* This function is used to walk through all of the existing tunables with */ 6919/* successive calls. It searches the known tunables for the one which has */ 6920/* a matching value for "cookie" - ie its address. When returning a match, */ 6921/* the next one to be found may be returned inside next. */ 6922/* ------------------------------------------------------------------------ */ 6923static ipftuneable_t * 6924ipf_tune_findbycookie(ptop, cookie, next) 6925 ipftuneable_t **ptop; 6926 void *cookie, **next; 6927{ 6928 ipftuneable_t *ta, **tap; 6929 6930 for (ta = *ptop; ta->ipft_name != NULL; ta++) 6931 if (ta == cookie) { 6932 if (next != NULL) { 6933 /* 6934 * If the next entry in the array has a name 6935 * present, then return a pointer to it for 6936 * where to go next, else return a pointer to 6937 * the dynaminc list as a key to search there 6938 * next. This facilitates a weak linking of 6939 * the two "lists" together. 6940 */ 6941 if ((ta + 1)->ipft_name != NULL) 6942 *next = ta + 1; 6943 else 6944 *next = ptop; 6945 } 6946 return ta; 6947 } 6948 6949 for (tap = ptop; (ta = *tap) != NULL; tap = &ta->ipft_next) 6950 if (tap == cookie) { 6951 if (next != NULL) 6952 *next = &ta->ipft_next; 6953 return ta; 6954 } 6955 6956 if (next != NULL) 6957 *next = NULL; 6958 return NULL; 6959} 6960 6961 6962/* ------------------------------------------------------------------------ */ 6963/* Function: ipf_tune_findbyname */ 6964/* Returns: NULL = search failed, else pointer to tune struct */ 6965/* Parameters: name(I) - name of the tuneable entry to find. */ 6966/* */ 6967/* Search the static array of tuneables and the list of dynamic tuneables */ 6968/* for an entry with a matching name. If we can find one, return a pointer */ 6969/* to the matching structure. */ 6970/* ------------------------------------------------------------------------ */ 6971static ipftuneable_t * 6972ipf_tune_findbyname(top, name) 6973 ipftuneable_t *top; 6974 const char *name; 6975{ 6976 ipftuneable_t *ta; 6977 6978 for (ta = top; ta != NULL; ta = ta->ipft_next) 6979 if (!strcmp(ta->ipft_name, name)) { 6980 return ta; 6981 } 6982 6983 return NULL; 6984} 6985 6986 6987/* ------------------------------------------------------------------------ */ 6988/* Function: ipf_tune_add_array */ 6989/* Returns: int - 0 == success, else failure */ 6990/* Parameters: newtune - pointer to new tune array to add to tuneables */ 6991/* */ 6992/* Appends tune structures from the array passed in (newtune) to the end of */ 6993/* the current list of "dynamic" tuneable parameters. */ 6994/* If any entry to be added is already present (by name) then the operation */ 6995/* is aborted - entries that have been added are removed before returning. */ 6996/* An entry with no name (NULL) is used as the indication that the end of */ 6997/* the array has been reached. */ 6998/* ------------------------------------------------------------------------ */ 6999int 7000ipf_tune_add_array(softc, newtune) 7001 ipf_main_softc_t *softc; 7002 ipftuneable_t *newtune; 7003{ 7004 ipftuneable_t *nt, *dt; 7005 int error = 0; 7006 7007 for (nt = newtune; nt->ipft_name != NULL; nt++) { 7008 error = ipf_tune_add(softc, nt); 7009 if (error != 0) { 7010 for (dt = newtune; dt != nt; dt++) { 7011 (void) ipf_tune_del(softc, dt); 7012 } 7013 } 7014 } 7015 7016 return error; 7017} 7018 7019 7020/* ------------------------------------------------------------------------ */ 7021/* Function: ipf_tune_array_link */ 7022/* Returns: 0 == success, -1 == failure */ 7023/* Parameters: softc(I) - soft context pointerto work with */ 7024/* array(I) - pointer to an array of tuneables */ 7025/* */ 7026/* Given an array of tunables (array), append them to the current list of */ 7027/* tuneables for this context (softc->ipf_tuners.) To properly prepare the */ 7028/* the array for being appended to the list, initialise all of the next */ 7029/* pointers so we don't need to walk parts of it with ++ and others with */ 7030/* next. The array is expected to have an entry with a NULL name as the */ 7031/* terminator. Trying to add an array with no non-NULL names will return as */ 7032/* a failure. */ 7033/* ------------------------------------------------------------------------ */ 7034int 7035ipf_tune_array_link(softc, array) 7036 ipf_main_softc_t *softc; 7037 ipftuneable_t *array; 7038{ 7039 ipftuneable_t *t, **p; 7040 7041 t = array; 7042 if (t->ipft_name == NULL) 7043 return -1; 7044 7045 for (; t[1].ipft_name != NULL; t++) 7046 t[0].ipft_next = &t[1]; 7047 t->ipft_next = NULL; 7048 7049 /* 7050 * Since a pointer to the last entry isn't kept, we need to find it 7051 * each time we want to add new variables to the list. 7052 */ 7053 for (p = &softc->ipf_tuners; (t = *p) != NULL; p = &t->ipft_next) 7054 if (t->ipft_name == NULL) 7055 break; 7056 *p = array; 7057 7058 return 0; 7059} 7060 7061 7062/* ------------------------------------------------------------------------ */ 7063/* Function: ipf_tune_array_unlink */ 7064/* Returns: 0 == success, -1 == failure */ 7065/* Parameters: softc(I) - soft context pointerto work with */ 7066/* array(I) - pointer to an array of tuneables */ 7067/* */ 7068/* ------------------------------------------------------------------------ */ 7069int 7070ipf_tune_array_unlink(softc, array) 7071 ipf_main_softc_t *softc; 7072 ipftuneable_t *array; 7073{ 7074 ipftuneable_t *t, **p; 7075 7076 for (p = &softc->ipf_tuners; (t = *p) != NULL; p = &t->ipft_next) 7077 if (t == array) 7078 break; 7079 if (t == NULL) 7080 return -1; 7081 7082 for (; t[1].ipft_name != NULL; t++) 7083 ; 7084 7085 *p = t->ipft_next; 7086 7087 return 0; 7088} 7089 7090 7091/* ------------------------------------------------------------------------ */ 7092/* Function: ipf_tune_array_copy */ 7093/* Returns: NULL = failure, else pointer to new array */ 7094/* Parameters: base(I) - pointer to structure base */ 7095/* size(I) - size of the array at template */ 7096/* template(I) - original array to copy */ 7097/* */ 7098/* Allocate memory for a new set of tuneable values and copy everything */ 7099/* from template into the new region of memory. The new region is full of */ 7100/* uninitialised pointers (ipft_next) so set them up. Now, ipftp_offset... */ 7101/* */ 7102/* NOTE: the following assumes that sizeof(long) == sizeof(void *) */ 7103/* In the array template, ipftp_offset is the offset (in bytes) of the */ 7104/* location of the tuneable value inside the structure pointed to by base. */ 7105/* As ipftp_offset is a union over the pointers to the tuneable values, if */ 7106/* we add base to the copy's ipftp_offset, copy ends up with a pointer in */ 7107/* ipftp_void that points to the stored value. */ 7108/* ------------------------------------------------------------------------ */ 7109ipftuneable_t * 7110ipf_tune_array_copy(base, size, template) 7111 void *base; 7112 size_t size; 7113 ipftuneable_t *template; 7114{ 7115 ipftuneable_t *copy; 7116 int i; 7117 7118 7119 KMALLOCS(copy, ipftuneable_t *, size); 7120 if (copy == NULL) { 7121 return NULL; 7122 } 7123 bcopy(template, copy, size); 7124 7125 for (i = 0; copy[i].ipft_name; i++) { 7126 copy[i].ipft_una.ipftp_offset += (u_long)base; 7127 copy[i].ipft_next = copy + i + 1; 7128 } 7129 7130 return copy; 7131} 7132 7133 7134/* ------------------------------------------------------------------------ */ 7135/* Function: ipf_tune_add */ 7136/* Returns: int - 0 == success, else failure */ 7137/* Parameters: newtune - pointer to new tune entry to add to tuneables */ 7138/* */ 7139/* Appends tune structures from the array passed in (newtune) to the end of */ 7140/* the current list of "dynamic" tuneable parameters. Once added, the */ 7141/* owner of the object is not expected to ever change "ipft_next". */ 7142/* ------------------------------------------------------------------------ */ 7143int 7144ipf_tune_add(softc, newtune) 7145 ipf_main_softc_t *softc; 7146 ipftuneable_t *newtune; 7147{ 7148 ipftuneable_t *ta, **tap; 7149 7150 ta = ipf_tune_findbyname(softc->ipf_tuners, newtune->ipft_name); 7151 if (ta != NULL) { 7152 IPFERROR(74); 7153 return EEXIST; 7154 } 7155 7156 for (tap = &softc->ipf_tuners; *tap != NULL; tap = &(*tap)->ipft_next) 7157 ; 7158 7159 newtune->ipft_next = NULL; 7160 *tap = newtune; 7161 return 0; 7162} 7163 7164 7165/* ------------------------------------------------------------------------ */ 7166/* Function: ipf_tune_del */ 7167/* Returns: int - 0 == success, else failure */ 7168/* Parameters: oldtune - pointer to tune entry to remove from the list of */ 7169/* current dynamic tuneables */ 7170/* */ 7171/* Search for the tune structure, by pointer, in the list of those that are */ 7172/* dynamically added at run time. If found, adjust the list so that this */ 7173/* structure is no longer part of it. */ 7174/* ------------------------------------------------------------------------ */ 7175int 7176ipf_tune_del(softc, oldtune) 7177 ipf_main_softc_t *softc; 7178 ipftuneable_t *oldtune; 7179{ 7180 ipftuneable_t *ta, **tap; 7181 int error = 0; 7182 7183 for (tap = &softc->ipf_tuners; (ta = *tap) != NULL; 7184 tap = &ta->ipft_next) { 7185 if (ta == oldtune) { 7186 *tap = oldtune->ipft_next; 7187 oldtune->ipft_next = NULL; 7188 break; 7189 } 7190 } 7191 7192 if (ta == NULL) { 7193 error = ESRCH; 7194 IPFERROR(75); 7195 } 7196 return error; 7197} 7198 7199 7200/* ------------------------------------------------------------------------ */ 7201/* Function: ipf_tune_del_array */ 7202/* Returns: int - 0 == success, else failure */ 7203/* Parameters: oldtune - pointer to tuneables array */ 7204/* */ 7205/* Remove each tuneable entry in the array from the list of "dynamic" */ 7206/* tunables. If one entry should fail to be found, an error will be */ 7207/* returned and no further ones removed. */ 7208/* An entry with a NULL name is used as the indicator of the last entry in */ 7209/* the array. */ 7210/* ------------------------------------------------------------------------ */ 7211int 7212ipf_tune_del_array(softc, oldtune) 7213 ipf_main_softc_t *softc; 7214 ipftuneable_t *oldtune; 7215{ 7216 ipftuneable_t *ot; 7217 int error = 0; 7218 7219 for (ot = oldtune; ot->ipft_name != NULL; ot++) { 7220 error = ipf_tune_del(softc, ot); 7221 if (error != 0) 7222 break; 7223 } 7224 7225 return error; 7226 7227} 7228 7229 7230/* ------------------------------------------------------------------------ */ 7231/* Function: ipf_tune */ 7232/* Returns: int - 0 == success, else failure */ 7233/* Parameters: cmd(I) - ioctl command number */ 7234/* data(I) - pointer to ioctl data structure */ 7235/* */ 7236/* Implement handling of SIOCIPFGETNEXT, SIOCIPFGET and SIOCIPFSET. These */ 7237/* three ioctls provide the means to access and control global variables */ 7238/* within IPFilter, allowing (for example) timeouts and table sizes to be */ 7239/* changed without rebooting, reloading or recompiling. The initialisation */ 7240/* and 'destruction' routines of the various components of ipfilter are all */ 7241/* each responsible for handling their own values being too big. */ 7242/* ------------------------------------------------------------------------ */ 7243int 7244ipf_ipftune(softc, cmd, data) 7245 ipf_main_softc_t *softc; 7246 ioctlcmd_t cmd; 7247 void *data; 7248{ 7249 ipftuneable_t *ta; 7250 ipftune_t tu; 7251 void *cookie; 7252 int error; 7253 7254 error = ipf_inobj(softc, data, NULL, &tu, IPFOBJ_TUNEABLE); 7255 if (error != 0) 7256 return error; 7257 7258 tu.ipft_name[sizeof(tu.ipft_name) - 1] = '\0'; 7259 cookie = tu.ipft_cookie; 7260 ta = NULL; 7261 7262 switch (cmd) 7263 { 7264 case SIOCIPFGETNEXT : 7265 /* 7266 * If cookie is non-NULL, assume it to be a pointer to the last 7267 * entry we looked at, so find it (if possible) and return a 7268 * pointer to the next one after it. The last entry in the 7269 * the table is a NULL entry, so when we get to it, set cookie 7270 * to NULL and return that, indicating end of list, erstwhile 7271 * if we come in with cookie set to NULL, we are starting anew 7272 * at the front of the list. 7273 */ 7274 if (cookie != NULL) { 7275 ta = ipf_tune_findbycookie(&softc->ipf_tuners, 7276 cookie, &tu.ipft_cookie); 7277 } else { 7278 ta = softc->ipf_tuners; 7279 tu.ipft_cookie = ta + 1; 7280 } 7281 if (ta != NULL) { 7282 /* 7283 * Entry found, but does the data pointed to by that 7284 * row fit in what we can return? 7285 */ 7286 if (ta->ipft_sz > sizeof(tu.ipft_un)) { 7287 IPFERROR(76); 7288 return EINVAL; 7289 } 7290 7291 tu.ipft_vlong = 0; 7292 if (ta->ipft_sz == sizeof(u_long)) 7293 tu.ipft_vlong = *ta->ipft_plong; 7294 else if (ta->ipft_sz == sizeof(u_int)) 7295 tu.ipft_vint = *ta->ipft_pint; 7296 else if (ta->ipft_sz == sizeof(u_short)) 7297 tu.ipft_vshort = *ta->ipft_pshort; 7298 else if (ta->ipft_sz == sizeof(u_char)) 7299 tu.ipft_vchar = *ta->ipft_pchar; 7300 7301 tu.ipft_sz = ta->ipft_sz; 7302 tu.ipft_min = ta->ipft_min; 7303 tu.ipft_max = ta->ipft_max; 7304 tu.ipft_flags = ta->ipft_flags; 7305 bcopy(ta->ipft_name, tu.ipft_name, 7306 MIN(sizeof(tu.ipft_name), 7307 strlen(ta->ipft_name) + 1)); 7308 } 7309 error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE); 7310 break; 7311 7312 case SIOCIPFGET : 7313 case SIOCIPFSET : 7314 /* 7315 * Search by name or by cookie value for a particular entry 7316 * in the tuning paramter table. 7317 */ 7318 IPFERROR(77); 7319 error = ESRCH; 7320 if (cookie != NULL) { 7321 ta = ipf_tune_findbycookie(&softc->ipf_tuners, 7322 cookie, NULL); 7323 if (ta != NULL) 7324 error = 0; 7325 } else if (tu.ipft_name[0] != '\0') { 7326 ta = ipf_tune_findbyname(softc->ipf_tuners, 7327 tu.ipft_name); 7328 if (ta != NULL) 7329 error = 0; 7330 } 7331 if (error != 0) 7332 break; 7333 7334 if (cmd == (ioctlcmd_t)SIOCIPFGET) { 7335 /* 7336 * Fetch the tuning parameters for a particular value 7337 */ 7338 tu.ipft_vlong = 0; 7339 if (ta->ipft_sz == sizeof(u_long)) 7340 tu.ipft_vlong = *ta->ipft_plong; 7341 else if (ta->ipft_sz == sizeof(u_int)) 7342 tu.ipft_vint = *ta->ipft_pint; 7343 else if (ta->ipft_sz == sizeof(u_short)) 7344 tu.ipft_vshort = *ta->ipft_pshort; 7345 else if (ta->ipft_sz == sizeof(u_char)) 7346 tu.ipft_vchar = *ta->ipft_pchar; 7347 tu.ipft_cookie = ta; 7348 tu.ipft_sz = ta->ipft_sz; 7349 tu.ipft_min = ta->ipft_min; 7350 tu.ipft_max = ta->ipft_max; 7351 tu.ipft_flags = ta->ipft_flags; 7352 error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE); 7353 7354 } else if (cmd == (ioctlcmd_t)SIOCIPFSET) { 7355 /* 7356 * Set an internal parameter. The hard part here is 7357 * getting the new value safely and correctly out of 7358 * the kernel (given we only know its size, not type.) 7359 */ 7360 u_long in; 7361 7362 if (((ta->ipft_flags & IPFT_WRDISABLED) != 0) && 7363 (softc->ipf_running > 0)) { 7364 IPFERROR(78); 7365 error = EBUSY; 7366 break; 7367 } 7368 7369 in = tu.ipft_vlong; 7370 if (in < ta->ipft_min || in > ta->ipft_max) { 7371 IPFERROR(79); 7372 error = EINVAL; 7373 break; 7374 } 7375 7376 if (ta->ipft_func != NULL) { 7377 SPL_INT(s); 7378 7379 SPL_NET(s); 7380 error = (*ta->ipft_func)(softc, ta, 7381 &tu.ipft_un); 7382 SPL_X(s); 7383 7384 } else if (ta->ipft_sz == sizeof(u_long)) { 7385 tu.ipft_vlong = *ta->ipft_plong; 7386 *ta->ipft_plong = in; 7387 7388 } else if (ta->ipft_sz == sizeof(u_int)) { 7389 tu.ipft_vint = *ta->ipft_pint; 7390 *ta->ipft_pint = (u_int)(in & 0xffffffff); 7391 7392 } else if (ta->ipft_sz == sizeof(u_short)) { 7393 tu.ipft_vshort = *ta->ipft_pshort; 7394 *ta->ipft_pshort = (u_short)(in & 0xffff); 7395 7396 } else if (ta->ipft_sz == sizeof(u_char)) { 7397 tu.ipft_vchar = *ta->ipft_pchar; 7398 *ta->ipft_pchar = (u_char)(in & 0xff); 7399 } 7400 error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE); 7401 } 7402 break; 7403 7404 default : 7405 IPFERROR(80); 7406 error = EINVAL; 7407 break; 7408 } 7409 7410 return error; 7411} 7412 7413 7414/* ------------------------------------------------------------------------ */ 7415/* Function: ipf_zerostats */ 7416/* Returns: int - 0 = success, else failure */ 7417/* Parameters: data(O) - pointer to pointer for copying data back to */ 7418/* */ 7419/* Copies the current statistics out to userspace and then zero's the */ 7420/* current ones in the kernel. The lock is only held across the bzero() as */ 7421/* the copyout may result in paging (ie network activity.) */ 7422/* ------------------------------------------------------------------------ */ 7423int 7424ipf_zerostats(softc, data) 7425 ipf_main_softc_t *softc; 7426 caddr_t data; 7427{ 7428 friostat_t fio; 7429 ipfobj_t obj; 7430 int error; 7431 7432 error = ipf_inobj(softc, data, &obj, &fio, IPFOBJ_IPFSTAT); 7433 if (error != 0) 7434 return error; 7435 ipf_getstat(softc, &fio, obj.ipfo_rev); 7436 error = ipf_outobj(softc, data, &fio, IPFOBJ_IPFSTAT); 7437 if (error != 0) 7438 return error; 7439 7440 WRITE_ENTER(&softc->ipf_mutex); 7441 bzero(&softc->ipf_stats, sizeof(softc->ipf_stats)); 7442 RWLOCK_EXIT(&softc->ipf_mutex); 7443 7444 return 0; 7445} 7446 7447 7448/* ------------------------------------------------------------------------ */ 7449/* Function: ipf_resolvedest */ 7450/* Returns: Nil */ 7451/* Parameters: softc(I) - pointer to soft context main structure */ 7452/* base(I) - where strings are stored */ 7453/* fdp(IO) - pointer to destination information to resolve */ 7454/* v(I) - IP protocol version to match */ 7455/* */ 7456/* Looks up an interface name in the frdest structure pointed to by fdp and */ 7457/* if a matching name can be found for the particular IP protocol version */ 7458/* then store the interface pointer in the frdest struct. If no match is */ 7459/* found, then set the interface pointer to be -1 as NULL is considered to */ 7460/* indicate there is no information at all in the structure. */ 7461/* ------------------------------------------------------------------------ */ 7462int 7463ipf_resolvedest(softc, base, fdp, v) 7464 ipf_main_softc_t *softc; 7465 char *base; 7466 frdest_t *fdp; 7467 int v; 7468{ 7469 int errval = 0; 7470 void *ifp; 7471 7472 ifp = NULL; 7473 7474 if (fdp->fd_name != -1) { 7475 if (fdp->fd_type == FRD_DSTLIST) { 7476 ifp = ipf_lookup_res_name(softc, IPL_LOGIPF, 7477 IPLT_DSTLIST, 7478 base + fdp->fd_name, 7479 NULL); 7480 if (ifp == NULL) { 7481 IPFERROR(144); 7482 errval = ESRCH; 7483 } 7484 } else { 7485 ifp = GETIFP(base + fdp->fd_name, v); 7486 if (ifp == NULL) 7487 ifp = (void *)-1; 7488 } 7489 } 7490 fdp->fd_ptr = ifp; 7491 7492 if ((ifp != NULL) && (ifp != (void *)-1)) { 7493 fdp->fd_local = ipf_deliverlocal(softc, v, ifp, &fdp->fd_ip6); 7494 } 7495 7496 return errval; 7497} 7498 7499 7500/* ------------------------------------------------------------------------ */ 7501/* Function: ipf_resolvenic */ 7502/* Returns: void* - NULL = wildcard name, -1 = failed to find NIC, else */ 7503/* pointer to interface structure for NIC */ 7504/* Parameters: softc(I)- pointer to soft context main structure */ 7505/* name(I) - complete interface name */ 7506/* v(I) - IP protocol version */ 7507/* */ 7508/* Look for a network interface structure that firstly has a matching name */ 7509/* to that passed in and that is also being used for that IP protocol */ 7510/* version (necessary on some platforms where there are separate listings */ 7511/* for both IPv4 and IPv6 on the same physical NIC. */ 7512/* ------------------------------------------------------------------------ */ 7513void * 7514ipf_resolvenic(softc, name, v) 7515 ipf_main_softc_t *softc; 7516 char *name; 7517 int v; 7518{ 7519 void *nic; 7520 7521 softc = softc; /* gcc -Wextra */ 7522 if (name[0] == '\0') 7523 return NULL; 7524 7525 if ((name[1] == '\0') && ((name[0] == '-') || (name[0] == '*'))) { 7526 return NULL; 7527 } 7528 7529 nic = GETIFP(name, v); 7530 if (nic == NULL) 7531 nic = (void *)-1; 7532 return nic; 7533} 7534 7535 7536/* ------------------------------------------------------------------------ */ 7537/* Function: ipf_token_expire */ 7538/* Returns: None. */ 7539/* Parameters: softc(I) - pointer to soft context main structure */ 7540/* */ 7541/* This function is run every ipf tick to see if there are any tokens that */ 7542/* have been held for too long and need to be freed up. */ 7543/* ------------------------------------------------------------------------ */ 7544void 7545ipf_token_expire(softc) 7546 ipf_main_softc_t *softc; 7547{ 7548 ipftoken_t *it; 7549 7550 WRITE_ENTER(&softc->ipf_tokens); 7551 while ((it = softc->ipf_token_head) != NULL) { 7552 if (it->ipt_die > softc->ipf_ticks) 7553 break; 7554 7555 ipf_token_deref(softc, it); 7556 } 7557 RWLOCK_EXIT(&softc->ipf_tokens); 7558} 7559 7560 7561/* ------------------------------------------------------------------------ */ 7562/* Function: ipf_token_flush */ 7563/* Returns: None. */ 7564/* Parameters: softc(I) - pointer to soft context main structure */ 7565/* */ 7566/* Loop through all of the existing tokens and call deref to see if they */ 7567/* can be freed. Normally a function like this might just loop on */ 7568/* ipf_token_head but there is a chance that a token might have a ref count */ 7569/* of greater than one and in that case the the reference would drop twice */ 7570/* by code that is only entitled to drop it once. */ 7571/* ------------------------------------------------------------------------ */ 7572static void 7573ipf_token_flush(softc) 7574 ipf_main_softc_t *softc; 7575{ 7576 ipftoken_t *it, *next; 7577 7578 WRITE_ENTER(&softc->ipf_tokens); 7579 for (it = softc->ipf_token_head; it != NULL; it = next) { 7580 next = it->ipt_next; 7581 (void) ipf_token_deref(softc, it); 7582 } 7583 RWLOCK_EXIT(&softc->ipf_tokens); 7584} 7585 7586 7587/* ------------------------------------------------------------------------ */ 7588/* Function: ipf_token_del */ 7589/* Returns: int - 0 = success, else error */ 7590/* Parameters: softc(I)- pointer to soft context main structure */ 7591/* type(I) - the token type to match */ 7592/* uid(I) - uid owning the token */ 7593/* ptr(I) - context pointer for the token */ 7594/* */ 7595/* This function looks for a a token in the current list that matches up */ 7596/* the fields (type, uid, ptr). If none is found, ESRCH is returned, else */ 7597/* call ipf_token_dewref() to remove it from the list. In the event that */ 7598/* the token has a reference held elsewhere, setting ipt_complete to 2 */ 7599/* enables debugging to distinguish between the two paths that ultimately */ 7600/* lead to a token to be deleted. */ 7601/* ------------------------------------------------------------------------ */ 7602int 7603ipf_token_del(softc, type, uid, ptr) 7604 ipf_main_softc_t *softc; 7605 int type, uid; 7606 void *ptr; 7607{ 7608 ipftoken_t *it; 7609 int error; 7610 7611 IPFERROR(82); 7612 error = ESRCH; 7613 7614 WRITE_ENTER(&softc->ipf_tokens); 7615 for (it = softc->ipf_token_head; it != NULL; it = it->ipt_next) { 7616 if (ptr == it->ipt_ctx && type == it->ipt_type && 7617 uid == it->ipt_uid) { 7618 it->ipt_complete = 2; 7619 ipf_token_deref(softc, it); 7620 error = 0; 7621 break; 7622 } 7623 } 7624 RWLOCK_EXIT(&softc->ipf_tokens); 7625 7626 return error; 7627} 7628 7629 7630/* ------------------------------------------------------------------------ */ 7631/* Function: ipf_token_mark_complete */ 7632/* Returns: None. */ 7633/* Parameters: token(I) - pointer to token structure */ 7634/* */ 7635/* Mark a token as being ineligable for being found with ipf_token_find. */ 7636/* ------------------------------------------------------------------------ */ 7637void 7638ipf_token_mark_complete(token) 7639 ipftoken_t *token; 7640{ 7641 if (token->ipt_complete == 0) 7642 token->ipt_complete = 1; 7643} 7644 7645 7646/* ------------------------------------------------------------------------ */ 7647/* Function: ipf_token_find */ 7648/* Returns: ipftoken_t * - NULL if no memory, else pointer to token */ 7649/* Parameters: softc(I)- pointer to soft context main structure */ 7650/* type(I) - the token type to match */ 7651/* uid(I) - uid owning the token */ 7652/* ptr(I) - context pointer for the token */ 7653/* */ 7654/* This function looks for a live token in the list of current tokens that */ 7655/* matches the tuple (type, uid, ptr). If one cannot be found then one is */ 7656/* allocated. If one is found then it is moved to the top of the list of */ 7657/* currently active tokens. */ 7658/* ------------------------------------------------------------------------ */ 7659ipftoken_t * 7660ipf_token_find(softc, type, uid, ptr) 7661 ipf_main_softc_t *softc; 7662 int type, uid; 7663 void *ptr; 7664{ 7665 ipftoken_t *it, *new; 7666 7667 KMALLOC(new, ipftoken_t *); 7668 if (new != NULL) 7669 bzero((char *)new, sizeof(*new)); 7670 7671 WRITE_ENTER(&softc->ipf_tokens); 7672 for (it = softc->ipf_token_head; it != NULL; it = it->ipt_next) { 7673 if ((ptr == it->ipt_ctx) && (type == it->ipt_type) && 7674 (uid == it->ipt_uid) && (it->ipt_complete < 2)) 7675 break; 7676 } 7677 7678 if (it == NULL) { 7679 it = new; 7680 new = NULL; 7681 if (it == NULL) { 7682 RWLOCK_EXIT(&softc->ipf_tokens); 7683 return NULL; 7684 } 7685 it->ipt_ctx = ptr; 7686 it->ipt_uid = uid; 7687 it->ipt_type = type; 7688 it->ipt_ref = 1; 7689 } else { 7690 if (new != NULL) { 7691 KFREE(new); 7692 new = NULL; 7693 } 7694 7695 if (it->ipt_complete > 0) 7696 it = NULL; 7697 else 7698 ipf_token_unlink(softc, it); 7699 } 7700 7701 if (it != NULL) { 7702 it->ipt_pnext = softc->ipf_token_tail; 7703 *softc->ipf_token_tail = it; 7704 softc->ipf_token_tail = &it->ipt_next; 7705 it->ipt_next = NULL; 7706 it->ipt_ref++; 7707 7708 it->ipt_die = softc->ipf_ticks + 20; 7709 } 7710 7711 RWLOCK_EXIT(&softc->ipf_tokens); 7712 7713 return it; 7714} 7715 7716 7717/* ------------------------------------------------------------------------ */ 7718/* Function: ipf_token_unlink */ 7719/* Returns: None. */ 7720/* Parameters: softc(I) - pointer to soft context main structure */ 7721/* token(I) - pointer to token structure */ 7722/* Write Locks: ipf_tokens */ 7723/* */ 7724/* This function unlinks a token structure from the linked list of tokens */ 7725/* that "own" it. The head pointer never needs to be explicitly adjusted */ 7726/* but the tail does due to the linked list implementation. */ 7727/* ------------------------------------------------------------------------ */ 7728static void 7729ipf_token_unlink(softc, token) 7730 ipf_main_softc_t *softc; 7731 ipftoken_t *token; 7732{ 7733 7734 if (softc->ipf_token_tail == &token->ipt_next) 7735 softc->ipf_token_tail = token->ipt_pnext; 7736 7737 *token->ipt_pnext = token->ipt_next; 7738 if (token->ipt_next != NULL) 7739 token->ipt_next->ipt_pnext = token->ipt_pnext; 7740 token->ipt_next = NULL; 7741 token->ipt_pnext = NULL; 7742} 7743 7744 7745/* ------------------------------------------------------------------------ */ 7746/* Function: ipf_token_deref */ 7747/* Returns: int - 0 == token freed, else reference count */ 7748/* Parameters: softc(I) - pointer to soft context main structure */ 7749/* token(I) - pointer to token structure */ 7750/* Write Locks: ipf_tokens */ 7751/* */ 7752/* Drop the reference count on the token structure and if it drops to zero, */ 7753/* call the dereference function for the token type because it is then */ 7754/* possible to free the token data structure. */ 7755/* ------------------------------------------------------------------------ */ 7756int 7757ipf_token_deref(softc, token) 7758 ipf_main_softc_t *softc; 7759 ipftoken_t *token; 7760{ 7761 void *data, **datap; 7762 7763 ASSERT(token->ipt_ref > 0); 7764 token->ipt_ref--; 7765 if (token->ipt_ref > 0) 7766 return token->ipt_ref; 7767 7768 data = token->ipt_data; 7769 datap = &data; 7770 7771 if ((data != NULL) && (data != (void *)-1)) { 7772 switch (token->ipt_type) 7773 { 7774 case IPFGENITER_IPF : 7775 (void) ipf_derefrule(softc, (frentry_t **)datap); 7776 break; 7777 case IPFGENITER_IPNAT : 7778 WRITE_ENTER(&softc->ipf_nat); 7779 ipf_nat_rule_deref(softc, (ipnat_t **)datap); 7780 RWLOCK_EXIT(&softc->ipf_nat); 7781 break; 7782 case IPFGENITER_NAT : 7783 ipf_nat_deref(softc, (nat_t **)datap); 7784 break; 7785 case IPFGENITER_STATE : 7786 ipf_state_deref(softc, (ipstate_t **)datap); 7787 break; 7788 case IPFGENITER_FRAG : 7789 ipf_frag_pkt_deref(softc, (ipfr_t **)datap); 7790 break; 7791 case IPFGENITER_NATFRAG : 7792 ipf_frag_nat_deref(softc, (ipfr_t **)datap); 7793 break; 7794 case IPFGENITER_HOSTMAP : 7795 WRITE_ENTER(&softc->ipf_nat); 7796 ipf_nat_hostmapdel(softc, (hostmap_t **)datap); 7797 RWLOCK_EXIT(&softc->ipf_nat); 7798 break; 7799 default : 7800 ipf_lookup_iterderef(softc, token->ipt_type, data); 7801 break; 7802 } 7803 } 7804 7805 ipf_token_unlink(softc, token); 7806 KFREE(token); 7807 return 0; 7808} 7809 7810 7811/* ------------------------------------------------------------------------ */ 7812/* Function: ipf_nextrule */ 7813/* Returns: frentry_t * - NULL == no more rules, else pointer to next */ 7814/* Parameters: softc(I) - pointer to soft context main structure */ 7815/* fr(I) - pointer to filter rule */ 7816/* out(I) - 1 == out rules, 0 == input rules */ 7817/* */ 7818/* Starting with "fr", find the next rule to visit. This includes visiting */ 7819/* the list of rule groups if either fr is NULL (empty list) or it is the */ 7820/* last rule in the list. When walking rule lists, it is either input or */ 7821/* output rules that are returned, never both. */ 7822/* ------------------------------------------------------------------------ */ 7823static frentry_t * 7824ipf_nextrule(softc, active, unit, fr, out) 7825 ipf_main_softc_t *softc; 7826 int active, unit; 7827 frentry_t *fr; 7828 int out; 7829{ 7830 frentry_t *next; 7831 frgroup_t *fg; 7832 7833 if (fr != NULL && fr->fr_group != -1) { 7834 fg = ipf_findgroup(softc, fr->fr_names + fr->fr_group, 7835 unit, active, NULL); 7836 if (fg != NULL) 7837 fg = fg->fg_next; 7838 } else { 7839 fg = softc->ipf_groups[unit][active]; 7840 } 7841 7842 while (fg != NULL) { 7843 next = fg->fg_start; 7844 while (next != NULL) { 7845 if (out) { 7846 if (next->fr_flags & FR_OUTQUE) 7847 return next; 7848 } else if (next->fr_flags & FR_INQUE) { 7849 return next; 7850 } 7851 next = next->fr_next; 7852 } 7853 if (next == NULL) 7854 fg = fg->fg_next; 7855 } 7856 7857 return NULL; 7858} 7859 7860/* ------------------------------------------------------------------------ */ 7861/* Function: ipf_getnextrule */ 7862/* Returns: int - 0 = success, else error */ 7863/* Parameters: softc(I)- pointer to soft context main structure */ 7864/* t(I) - pointer to destination information to resolve */ 7865/* ptr(I) - pointer to ipfobj_t to copyin from user space */ 7866/* */ 7867/* This function's first job is to bring in the ipfruleiter_t structure via */ 7868/* the ipfobj_t structure to determine what should be the next rule to */ 7869/* return. Once the ipfruleiter_t has been brought in, it then tries to */ 7870/* find the 'next rule'. This may include searching rule group lists or */ 7871/* just be as simple as looking at the 'next' field in the rule structure. */ 7872/* When we have found the rule to return, increase its reference count and */ 7873/* if we used an existing rule to get here, decrease its reference count. */ 7874/* ------------------------------------------------------------------------ */ 7875int 7876ipf_getnextrule(softc, t, ptr) 7877 ipf_main_softc_t *softc; 7878 ipftoken_t *t; 7879 void *ptr; 7880{ 7881 frentry_t *fr, *next, zero; 7882 ipfruleiter_t it; 7883 int error, out; 7884 frgroup_t *fg; 7885 ipfobj_t obj; 7886 int predict; 7887 char *dst; 7888 int unit; 7889 7890 if (t == NULL || ptr == NULL) { 7891 IPFERROR(84); 7892 return EFAULT; 7893 } 7894 7895 error = ipf_inobj(softc, ptr, &obj, &it, IPFOBJ_IPFITER); 7896 if (error != 0) 7897 return error; 7898 7899 if ((it.iri_inout < 0) || (it.iri_inout > 3)) { 7900 IPFERROR(85); 7901 return EINVAL; 7902 } 7903 if ((it.iri_active != 0) && (it.iri_active != 1)) { 7904 IPFERROR(86); 7905 return EINVAL; 7906 } 7907 if (it.iri_nrules == 0) { 7908 IPFERROR(87); 7909 return ENOSPC; 7910 } 7911 if (it.iri_rule == NULL) { 7912 IPFERROR(88); 7913 return EFAULT; 7914 } 7915 7916 fg = NULL; 7917 fr = t->ipt_data; 7918 if ((it.iri_inout & F_OUT) != 0) 7919 out = 1; 7920 else 7921 out = 0; 7922 if ((it.iri_inout & F_ACIN) != 0) 7923 unit = IPL_LOGCOUNT; 7924 else 7925 unit = IPL_LOGIPF; 7926 7927 READ_ENTER(&softc->ipf_mutex); 7928 if (fr == NULL) { 7929 if (*it.iri_group == '\0') { 7930 if (unit == IPL_LOGCOUNT) { 7931 next = softc->ipf_acct[out][it.iri_active]; 7932 } else { 7933 next = softc->ipf_rules[out][it.iri_active]; 7934 } 7935 if (next == NULL) 7936 next = ipf_nextrule(softc, it.iri_active, 7937 unit, NULL, out); 7938 } else { 7939 fg = ipf_findgroup(softc, it.iri_group, unit, 7940 it.iri_active, NULL); 7941 if (fg != NULL) 7942 next = fg->fg_start; 7943 else 7944 next = NULL; 7945 } 7946 } else { 7947 next = fr->fr_next; 7948 if (next == NULL) 7949 next = ipf_nextrule(softc, it.iri_active, unit, 7950 fr, out); 7951 } 7952 7953 if (next != NULL && next->fr_next != NULL) 7954 predict = 1; 7955 else if (ipf_nextrule(softc, it.iri_active, unit, next, out) != NULL) 7956 predict = 1; 7957 else 7958 predict = 0; 7959 7960 if (fr != NULL) 7961 (void) ipf_derefrule(softc, &fr); 7962 7963 obj.ipfo_type = IPFOBJ_FRENTRY; 7964 dst = (char *)it.iri_rule; 7965 7966 if (next != NULL) { 7967 obj.ipfo_size = next->fr_size; 7968 MUTEX_ENTER(&next->fr_lock); 7969 next->fr_ref++; 7970 MUTEX_EXIT(&next->fr_lock); 7971 t->ipt_data = next; 7972 } else { 7973 obj.ipfo_size = sizeof(frentry_t); 7974 bzero(&zero, sizeof(zero)); 7975 next = &zero; 7976 t->ipt_data = NULL; 7977 } 7978 it.iri_rule = predict ? next : NULL; 7979 if (predict == 0) 7980 ipf_token_mark_complete(t); 7981 7982 RWLOCK_EXIT(&softc->ipf_mutex); 7983 7984 obj.ipfo_ptr = dst; 7985 error = ipf_outobjk(softc, &obj, next); 7986 if (error == 0 && t->ipt_data != NULL) { 7987 dst += obj.ipfo_size; 7988 if (next->fr_data != NULL) { 7989 ipfobj_t dobj; 7990 7991 if (next->fr_type == FR_T_IPFEXPR) 7992 dobj.ipfo_type = IPFOBJ_IPFEXPR; 7993 else 7994 dobj.ipfo_type = IPFOBJ_FRIPF; 7995 dobj.ipfo_size = next->fr_dsize; 7996 dobj.ipfo_rev = obj.ipfo_rev; 7997 dobj.ipfo_ptr = dst; 7998 error = ipf_outobjk(softc, &dobj, next->fr_data); 7999 } 8000 } 8001 8002 if ((fr != NULL) && (next == &zero)) 8003 (void) ipf_derefrule(softc, &fr); 8004 8005 return error; 8006} 8007 8008 8009/* ------------------------------------------------------------------------ */ 8010/* Function: ipf_frruleiter */ 8011/* Returns: int - 0 = success, else error */ 8012/* Parameters: softc(I)- pointer to soft context main structure */ 8013/* data(I) - the token type to match */ 8014/* uid(I) - uid owning the token */ 8015/* ptr(I) - context pointer for the token */ 8016/* */ 8017/* This function serves as a stepping stone between ipf_ipf_ioctl and */ 8018/* ipf_getnextrule. It's role is to find the right token in the kernel for */ 8019/* the process doing the ioctl and use that to ask for the next rule. */ 8020/* ------------------------------------------------------------------------ */ 8021static int 8022ipf_frruleiter(softc, data, uid, ctx) 8023 ipf_main_softc_t *softc; 8024 void *data, *ctx; 8025 int uid; 8026{ 8027 ipftoken_t *token; 8028 ipfruleiter_t it; 8029 ipfobj_t obj; 8030 int error; 8031 8032 token = ipf_token_find(softc, IPFGENITER_IPF, uid, ctx); 8033 if (token != NULL) { 8034 error = ipf_getnextrule(softc, token, data); 8035 WRITE_ENTER(&softc->ipf_tokens); 8036 ipf_token_deref(softc, token); 8037 RWLOCK_EXIT(&softc->ipf_tokens); 8038 } else { 8039 error = ipf_inobj(softc, data, &obj, &it, IPFOBJ_IPFITER); 8040 if (error != 0) 8041 return error; 8042 it.iri_rule = NULL; 8043 error = ipf_outobj(softc, data, &it, IPFOBJ_IPFITER); 8044 } 8045 8046 return error; 8047} 8048 8049 8050/* ------------------------------------------------------------------------ */ 8051/* Function: ipf_geniter */ 8052/* Returns: int - 0 = success, else error */ 8053/* Parameters: softc(I) - pointer to soft context main structure */ 8054/* token(I) - pointer to ipftoken_t structure */ 8055/* itp(I) - pointer to iterator data */ 8056/* */ 8057/* Decide which iterator function to call using information passed through */ 8058/* the ipfgeniter_t structure at itp. */ 8059/* ------------------------------------------------------------------------ */ 8060static int 8061ipf_geniter(softc, token, itp) 8062 ipf_main_softc_t *softc; 8063 ipftoken_t *token; 8064 ipfgeniter_t *itp; 8065{ 8066 int error; 8067 8068 switch (itp->igi_type) 8069 { 8070 case IPFGENITER_FRAG : 8071 error = ipf_frag_pkt_next(softc, token, itp); 8072 break; 8073 default : 8074 IPFERROR(92); 8075 error = EINVAL; 8076 break; 8077 } 8078 8079 return error; 8080} 8081 8082 8083/* ------------------------------------------------------------------------ */ 8084/* Function: ipf_genericiter */ 8085/* Returns: int - 0 = success, else error */ 8086/* Parameters: softc(I)- pointer to soft context main structure */ 8087/* data(I) - the token type to match */ 8088/* uid(I) - uid owning the token */ 8089/* ptr(I) - context pointer for the token */ 8090/* */ 8091/* Handle the SIOCGENITER ioctl for the ipfilter device. The primary role */ 8092/* ------------------------------------------------------------------------ */ 8093int 8094ipf_genericiter(softc, data, uid, ctx) 8095 ipf_main_softc_t *softc; 8096 void *data, *ctx; 8097 int uid; 8098{ 8099 ipftoken_t *token; 8100 ipfgeniter_t iter; 8101 int error; 8102 8103 error = ipf_inobj(softc, data, NULL, &iter, IPFOBJ_GENITER); 8104 if (error != 0) 8105 return error; 8106 8107 token = ipf_token_find(softc, iter.igi_type, uid, ctx); 8108 if (token != NULL) { 8109 token->ipt_subtype = iter.igi_type; 8110 error = ipf_geniter(softc, token, &iter); 8111 WRITE_ENTER(&softc->ipf_tokens); 8112 ipf_token_deref(softc, token); 8113 RWLOCK_EXIT(&softc->ipf_tokens); 8114 } else { 8115 IPFERROR(93); 8116 error = 0; 8117 } 8118 8119 return error; 8120} 8121 8122 8123/* ------------------------------------------------------------------------ */ 8124/* Function: ipf_ipf_ioctl */ 8125/* Returns: int - 0 = success, else error */ 8126/* Parameters: softc(I)- pointer to soft context main structure */ 8127/* data(I) - the token type to match */ 8128/* cmd(I) - the ioctl command number */ 8129/* mode(I) - mode flags for the ioctl */ 8130/* uid(I) - uid owning the token */ 8131/* ptr(I) - context pointer for the token */ 8132/* */ 8133/* This function handles all of the ioctl command that are actually isssued */ 8134/* to the /dev/ipl device. */ 8135/* ------------------------------------------------------------------------ */ 8136int 8137ipf_ipf_ioctl(softc, data, cmd, mode, uid, ctx) 8138 ipf_main_softc_t *softc; 8139 caddr_t data; 8140 ioctlcmd_t cmd; 8141 int mode, uid; 8142 void *ctx; 8143{ 8144 friostat_t fio; 8145 int error, tmp; 8146 ipfobj_t obj; 8147 SPL_INT(s); 8148 8149 switch (cmd) 8150 { 8151 case SIOCFRENB : 8152 if (!(mode & FWRITE)) { 8153 IPFERROR(94); 8154 error = EPERM; 8155 } else { 8156 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8157 if (error != 0) { 8158 IPFERROR(95); 8159 error = EFAULT; 8160 break; 8161 } 8162 8163 WRITE_ENTER(&softc->ipf_global); 8164 if (tmp) { 8165 if (softc->ipf_running > 0) 8166 error = 0; 8167 else 8168 error = ipfattach(softc); 8169 if (error == 0) 8170 softc->ipf_running = 1; 8171 else 8172 (void) ipfdetach(softc); 8173 } else { 8174 if (softc->ipf_running == 1) 8175 error = ipfdetach(softc); 8176 else 8177 error = 0; 8178 if (error == 0) 8179 softc->ipf_running = -1; 8180 } 8181 RWLOCK_EXIT(&softc->ipf_global); 8182 } 8183 break; 8184 8185 case SIOCIPFSET : 8186 if (!(mode & FWRITE)) { 8187 IPFERROR(96); 8188 error = EPERM; 8189 break; 8190 } 8191 /* FALLTHRU */ 8192 case SIOCIPFGETNEXT : 8193 case SIOCIPFGET : 8194 error = ipf_ipftune(softc, cmd, (void *)data); 8195 break; 8196 8197 case SIOCSETFF : 8198 if (!(mode & FWRITE)) { 8199 IPFERROR(97); 8200 error = EPERM; 8201 } else { 8202 error = BCOPYIN(data, &softc->ipf_flags, 8203 sizeof(softc->ipf_flags)); 8204 if (error != 0) { 8205 IPFERROR(98); 8206 error = EFAULT; 8207 } 8208 } 8209 break; 8210 8211 case SIOCGETFF : 8212 error = BCOPYOUT(&softc->ipf_flags, data, 8213 sizeof(softc->ipf_flags)); 8214 if (error != 0) { 8215 IPFERROR(99); 8216 error = EFAULT; 8217 } 8218 break; 8219 8220 case SIOCFUNCL : 8221 error = ipf_resolvefunc(softc, (void *)data); 8222 break; 8223 8224 case SIOCINAFR : 8225 case SIOCRMAFR : 8226 case SIOCADAFR : 8227 case SIOCZRLST : 8228 if (!(mode & FWRITE)) { 8229 IPFERROR(100); 8230 error = EPERM; 8231 } else { 8232 error = frrequest(softc, IPL_LOGIPF, cmd, (caddr_t)data, 8233 softc->ipf_active, 1); 8234 } 8235 break; 8236 8237 case SIOCINIFR : 8238 case SIOCRMIFR : 8239 case SIOCADIFR : 8240 if (!(mode & FWRITE)) { 8241 IPFERROR(101); 8242 error = EPERM; 8243 } else { 8244 error = frrequest(softc, IPL_LOGIPF, cmd, (caddr_t)data, 8245 1 - softc->ipf_active, 1); 8246 } 8247 break; 8248 8249 case SIOCSWAPA : 8250 if (!(mode & FWRITE)) { 8251 IPFERROR(102); 8252 error = EPERM; 8253 } else { 8254 WRITE_ENTER(&softc->ipf_mutex); 8255 error = BCOPYOUT(&softc->ipf_active, data, 8256 sizeof(softc->ipf_active)); 8257 if (error != 0) { 8258 IPFERROR(103); 8259 error = EFAULT; 8260 } else { 8261 softc->ipf_active = 1 - softc->ipf_active; 8262 } 8263 RWLOCK_EXIT(&softc->ipf_mutex); 8264 } 8265 break; 8266 8267 case SIOCGETFS : 8268 error = ipf_inobj(softc, (void *)data, &obj, &fio, 8269 IPFOBJ_IPFSTAT); 8270 if (error != 0) 8271 break; 8272 ipf_getstat(softc, &fio, obj.ipfo_rev); 8273 error = ipf_outobj(softc, (void *)data, &fio, IPFOBJ_IPFSTAT); 8274 break; 8275 8276 case SIOCFRZST : 8277 if (!(mode & FWRITE)) { 8278 IPFERROR(104); 8279 error = EPERM; 8280 } else 8281 error = ipf_zerostats(softc, (caddr_t)data); 8282 break; 8283 8284 case SIOCIPFFL : 8285 if (!(mode & FWRITE)) { 8286 IPFERROR(105); 8287 error = EPERM; 8288 } else { 8289 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8290 if (!error) { 8291 tmp = ipf_flush(softc, IPL_LOGIPF, tmp); 8292 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8293 if (error != 0) { 8294 IPFERROR(106); 8295 error = EFAULT; 8296 } 8297 } else { 8298 IPFERROR(107); 8299 error = EFAULT; 8300 } 8301 } 8302 break; 8303 8304#ifdef USE_INET6 8305 case SIOCIPFL6 : 8306 if (!(mode & FWRITE)) { 8307 IPFERROR(108); 8308 error = EPERM; 8309 } else { 8310 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8311 if (!error) { 8312 tmp = ipf_flush(softc, IPL_LOGIPF, tmp); 8313 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8314 if (error != 0) { 8315 IPFERROR(109); 8316 error = EFAULT; 8317 } 8318 } else { 8319 IPFERROR(110); 8320 error = EFAULT; 8321 } 8322 } 8323 break; 8324#endif 8325 8326 case SIOCSTLCK : 8327 if (!(mode & FWRITE)) { 8328 IPFERROR(122); 8329 error = EPERM; 8330 } else { 8331 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8332 if (error == 0) { 8333 ipf_state_setlock(softc->ipf_state_soft, tmp); 8334 ipf_nat_setlock(softc->ipf_nat_soft, tmp); 8335 ipf_frag_setlock(softc->ipf_frag_soft, tmp); 8336 ipf_auth_setlock(softc->ipf_auth_soft, tmp); 8337 } else { 8338 IPFERROR(111); 8339 error = EFAULT; 8340 } 8341 } 8342 break; 8343 8344#ifdef IPFILTER_LOG 8345 case SIOCIPFFB : 8346 if (!(mode & FWRITE)) { 8347 IPFERROR(112); 8348 error = EPERM; 8349 } else { 8350 tmp = ipf_log_clear(softc, IPL_LOGIPF); 8351 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8352 if (error) { 8353 IPFERROR(113); 8354 error = EFAULT; 8355 } 8356 } 8357 break; 8358#endif /* IPFILTER_LOG */ 8359 8360 case SIOCFRSYN : 8361 if (!(mode & FWRITE)) { 8362 IPFERROR(114); 8363 error = EPERM; 8364 } else { 8365 WRITE_ENTER(&softc->ipf_global); 8366#if (defined(MENTAT) && defined(_KERNEL)) && !defined(INSTANCES) 8367 error = ipfsync(); 8368#else 8369 ipf_sync(softc, NULL); 8370 error = 0; 8371#endif 8372 RWLOCK_EXIT(&softc->ipf_global); 8373 8374 } 8375 break; 8376 8377 case SIOCGFRST : 8378 error = ipf_outobj(softc, (void *)data, 8379 ipf_frag_stats(softc->ipf_frag_soft), 8380 IPFOBJ_FRAGSTAT); 8381 break; 8382 8383#ifdef IPFILTER_LOG 8384 case FIONREAD : 8385 tmp = ipf_log_bytesused(softc, IPL_LOGIPF); 8386 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8387 break; 8388#endif 8389 8390 case SIOCIPFITER : 8391 SPL_SCHED(s); 8392 error = ipf_frruleiter(softc, data, uid, ctx); 8393 SPL_X(s); 8394 break; 8395 8396 case SIOCGENITER : 8397 SPL_SCHED(s); 8398 error = ipf_genericiter(softc, data, uid, ctx); 8399 SPL_X(s); 8400 break; 8401 8402 case SIOCIPFDELTOK : 8403 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8404 if (error == 0) { 8405 SPL_SCHED(s); 8406 error = ipf_token_del(softc, tmp, uid, ctx); 8407 SPL_X(s); 8408 } 8409 break; 8410 8411 default : 8412 IPFERROR(115); 8413 error = EINVAL; 8414 break; 8415 } 8416 8417 return error; 8418} 8419 8420 8421/* ------------------------------------------------------------------------ */ 8422/* Function: ipf_decaps */ 8423/* Returns: int - -1 == decapsulation failed, else bit mask of */ 8424/* flags indicating packet filtering decision. */ 8425/* Parameters: fin(I) - pointer to packet information */ 8426/* pass(I) - IP protocol version to match */ 8427/* l5proto(I) - layer 5 protocol to decode UDP data as. */ 8428/* */ 8429/* This function is called for packets that are wrapt up in other packets, */ 8430/* for example, an IP packet that is the entire data segment for another IP */ 8431/* packet. If the basic constraints for this are satisfied, change the */ 8432/* buffer to point to the start of the inner packet and start processing */ 8433/* rules belonging to the head group this rule specifies. */ 8434/* ------------------------------------------------------------------------ */ 8435u_32_t 8436ipf_decaps(fin, pass, l5proto) 8437 fr_info_t *fin; 8438 u_32_t pass; 8439 int l5proto; 8440{ 8441 fr_info_t fin2, *fino = NULL; 8442 int elen, hlen, nh; 8443 grehdr_t gre; 8444 ip_t *ip; 8445 mb_t *m; 8446 8447 if ((fin->fin_flx & FI_COALESCE) == 0) 8448 if (ipf_coalesce(fin) == -1) 8449 goto cantdecaps; 8450 8451 m = fin->fin_m; 8452 hlen = fin->fin_hlen; 8453 8454 switch (fin->fin_p) 8455 { 8456 case IPPROTO_UDP : 8457 /* 8458 * In this case, the specific protocol being decapsulated 8459 * inside UDP frames comes from the rule. 8460 */ 8461 nh = fin->fin_fr->fr_icode; 8462 break; 8463 8464 case IPPROTO_GRE : /* 47 */ 8465 bcopy(fin->fin_dp, (char *)&gre, sizeof(gre)); 8466 hlen += sizeof(grehdr_t); 8467 if (gre.gr_R|gre.gr_s) 8468 goto cantdecaps; 8469 if (gre.gr_C) 8470 hlen += 4; 8471 if (gre.gr_K) 8472 hlen += 4; 8473 if (gre.gr_S) 8474 hlen += 4; 8475 8476 nh = IPPROTO_IP; 8477 8478 /* 8479 * If the routing options flag is set, validate that it is 8480 * there and bounce over it. 8481 */ 8482#if 0 8483 /* This is really heavy weight and lots of room for error, */ 8484 /* so for now, put it off and get the simple stuff right. */ 8485 if (gre.gr_R) { 8486 u_char off, len, *s; 8487 u_short af; 8488 int end; 8489 8490 end = 0; 8491 s = fin->fin_dp; 8492 s += hlen; 8493 aplen = fin->fin_plen - hlen; 8494 while (aplen > 3) { 8495 af = (s[0] << 8) | s[1]; 8496 off = s[2]; 8497 len = s[3]; 8498 aplen -= 4; 8499 s += 4; 8500 if (af == 0 && len == 0) { 8501 end = 1; 8502 break; 8503 } 8504 if (aplen < len) 8505 break; 8506 s += len; 8507 aplen -= len; 8508 } 8509 if (end != 1) 8510 goto cantdecaps; 8511 hlen = s - (u_char *)fin->fin_dp; 8512 } 8513#endif 8514 break; 8515 8516#ifdef IPPROTO_IPIP 8517 case IPPROTO_IPIP : /* 4 */ 8518#endif 8519 nh = IPPROTO_IP; 8520 break; 8521 8522 default : /* Includes ESP, AH is special for IPv4 */ 8523 goto cantdecaps; 8524 } 8525 8526 switch (nh) 8527 { 8528 case IPPROTO_IP : 8529 case IPPROTO_IPV6 : 8530 break; 8531 default : 8532 goto cantdecaps; 8533 } 8534 8535 bcopy((char *)fin, (char *)&fin2, sizeof(fin2)); 8536 fino = fin; 8537 fin = &fin2; 8538 elen = hlen; 8539#if defined(MENTAT) && defined(_KERNEL) 8540 m->b_rptr += elen; 8541#else 8542 m->m_data += elen; 8543 m->m_len -= elen; 8544#endif 8545 fin->fin_plen -= elen; 8546 8547 ip = (ip_t *)((char *)fin->fin_ip + elen); 8548 8549 /* 8550 * Make sure we have at least enough data for the network layer 8551 * header. 8552 */ 8553 if (IP_V(ip) == 4) 8554 hlen = IP_HL(ip) << 2; 8555#ifdef USE_INET6 8556 else if (IP_V(ip) == 6) 8557 hlen = sizeof(ip6_t); 8558#endif 8559 else 8560 goto cantdecaps2; 8561 8562 if (fin->fin_plen < hlen) 8563 goto cantdecaps2; 8564 8565 fin->fin_dp = (char *)ip + hlen; 8566 8567 if (IP_V(ip) == 4) { 8568 /* 8569 * Perform IPv4 header checksum validation. 8570 */ 8571 if (ipf_cksum((u_short *)ip, hlen)) 8572 goto cantdecaps2; 8573 } 8574 8575 if (ipf_makefrip(hlen, ip, fin) == -1) { 8576cantdecaps2: 8577 if (m != NULL) { 8578#if defined(MENTAT) && defined(_KERNEL) 8579 m->b_rptr -= elen; 8580#else 8581 m->m_data -= elen; 8582 m->m_len += elen; 8583#endif 8584 } 8585cantdecaps: 8586 DT1(frb_decapfrip, fr_info_t *, fin); 8587 pass &= ~FR_CMDMASK; 8588 pass |= FR_BLOCK|FR_QUICK; 8589 fin->fin_reason = FRB_DECAPFRIP; 8590 return -1; 8591 } 8592 8593 pass = ipf_scanlist(fin, pass); 8594 8595 /* 8596 * Copy the packet filter "result" fields out of the fr_info_t struct 8597 * that is local to the decapsulation processing and back into the 8598 * one we were called with. 8599 */ 8600 fino->fin_flx = fin->fin_flx; 8601 fino->fin_rev = fin->fin_rev; 8602 fino->fin_icode = fin->fin_icode; 8603 fino->fin_rule = fin->fin_rule; 8604 (void) strncpy(fino->fin_group, fin->fin_group, FR_GROUPLEN); 8605 fino->fin_fr = fin->fin_fr; 8606 fino->fin_error = fin->fin_error; 8607 fino->fin_mp = fin->fin_mp; 8608 fino->fin_m = fin->fin_m; 8609 m = fin->fin_m; 8610 if (m != NULL) { 8611#if defined(MENTAT) && defined(_KERNEL) 8612 m->b_rptr -= elen; 8613#else 8614 m->m_data -= elen; 8615 m->m_len += elen; 8616#endif 8617 } 8618 return pass; 8619} 8620 8621 8622/* ------------------------------------------------------------------------ */ 8623/* Function: ipf_matcharray_load */ 8624/* Returns: int - 0 = success, else error */ 8625/* Parameters: softc(I) - pointer to soft context main structure */ 8626/* data(I) - pointer to ioctl data */ 8627/* objp(I) - ipfobj_t structure to load data into */ 8628/* arrayptr(I) - pointer to location to store array pointer */ 8629/* */ 8630/* This function loads in a mathing array through the ipfobj_t struct that */ 8631/* describes it. Sanity checking and array size limitations are enforced */ 8632/* in this function to prevent userspace from trying to load in something */ 8633/* that is insanely big. Once the size of the array is known, the memory */ 8634/* required is malloc'd and returned through changing *arrayptr. The */ 8635/* contents of the array are verified before returning. Only in the event */ 8636/* of a successful call is the caller required to free up the malloc area. */ 8637/* ------------------------------------------------------------------------ */ 8638int 8639ipf_matcharray_load(softc, data, objp, arrayptr) 8640 ipf_main_softc_t *softc; 8641 caddr_t data; 8642 ipfobj_t *objp; 8643 int **arrayptr; 8644{ 8645 int arraysize, *array, error; 8646 8647 *arrayptr = NULL; 8648 8649 error = BCOPYIN(data, objp, sizeof(*objp)); 8650 if (error != 0) { 8651 IPFERROR(116); 8652 return EFAULT; 8653 } 8654 8655 if (objp->ipfo_type != IPFOBJ_IPFEXPR) { 8656 IPFERROR(117); 8657 return EINVAL; 8658 } 8659 8660 if (((objp->ipfo_size & 3) != 0) || (objp->ipfo_size == 0) || 8661 (objp->ipfo_size > 1024)) { 8662 IPFERROR(118); 8663 return EINVAL; 8664 } 8665 8666 arraysize = objp->ipfo_size * sizeof(*array); 8667 KMALLOCS(array, int *, arraysize); 8668 if (array == NULL) { 8669 IPFERROR(119); 8670 return ENOMEM; 8671 } 8672 8673 error = COPYIN(objp->ipfo_ptr, array, arraysize); 8674 if (error != 0) { 8675 KFREES(array, arraysize); 8676 IPFERROR(120); 8677 return EFAULT; 8678 } 8679 8680 if (ipf_matcharray_verify(array, arraysize) != 0) { 8681 KFREES(array, arraysize); 8682 IPFERROR(121); 8683 return EINVAL; 8684 } 8685 8686 *arrayptr = array; 8687 return 0; 8688} 8689 8690 8691/* ------------------------------------------------------------------------ */ 8692/* Function: ipf_matcharray_verify */ 8693/* Returns: Nil */ 8694/* Parameters: array(I) - pointer to matching array */ 8695/* arraysize(I) - number of elements in the array */ 8696/* */ 8697/* Verify the contents of a matching array by stepping through each element */ 8698/* in it. The actual commands in the array are not verified for */ 8699/* correctness, only that all of the sizes are correctly within limits. */ 8700/* ------------------------------------------------------------------------ */ 8701int 8702ipf_matcharray_verify(array, arraysize) 8703 int *array, arraysize; 8704{ 8705 int i, nelem, maxidx; 8706 ipfexp_t *e; 8707 8708 nelem = arraysize / sizeof(*array); 8709 8710 /* 8711 * Currently, it makes no sense to have an array less than 6 8712 * elements long - the initial size at the from, a single operation 8713 * (minimum 4 in length) and a trailer, for a total of 6. 8714 */ 8715 if ((array[0] < 6) || (arraysize < 24) || (arraysize > 4096)) { 8716 return -1; 8717 } 8718 8719 /* 8720 * Verify the size of data pointed to by array with how long 8721 * the array claims to be itself. 8722 */ 8723 if (array[0] * sizeof(*array) != arraysize) { 8724 return -1; 8725 } 8726 8727 maxidx = nelem - 1; 8728 /* 8729 * The last opcode in this array should be an IPF_EXP_END. 8730 */ 8731 if (array[maxidx] != IPF_EXP_END) { 8732 return -1; 8733 } 8734 8735 for (i = 1; i < maxidx; ) { 8736 e = (ipfexp_t *)(array + i); 8737 8738 /* 8739 * The length of the bits to check must be at least 1 8740 * (or else there is nothing to comapre with!) and it 8741 * cannot exceed the length of the data present. 8742 */ 8743 if ((e->ipfe_size < 1 ) || 8744 (e->ipfe_size + i > maxidx)) { 8745 return -1; 8746 } 8747 i += e->ipfe_size; 8748 } 8749 return 0; 8750} 8751 8752 8753/* ------------------------------------------------------------------------ */ 8754/* Function: ipf_fr_matcharray */ 8755/* Returns: int - 0 = match failed, else positive match */ 8756/* Parameters: fin(I) - pointer to packet information */ 8757/* array(I) - pointer to matching array */ 8758/* */ 8759/* This function is used to apply a matching array against a packet and */ 8760/* return an indication of whether or not the packet successfully matches */ 8761/* all of the commands in it. */ 8762/* ------------------------------------------------------------------------ */ 8763static int 8764ipf_fr_matcharray(fin, array) 8765 fr_info_t *fin; 8766 int *array; 8767{ 8768 int i, n, *x, rv, p; 8769 ipfexp_t *e; 8770 8771 rv = 0; 8772 n = array[0]; 8773 x = array + 1; 8774 8775 for (; n > 0; x += 3 + x[3], rv = 0) { 8776 e = (ipfexp_t *)x; 8777 if (e->ipfe_cmd == IPF_EXP_END) 8778 break; 8779 n -= e->ipfe_size; 8780 8781 /* 8782 * The upper 16 bits currently store the protocol value. 8783 * This is currently used with TCP and UDP port compares and 8784 * allows "tcp.port = 80" without requiring an explicit 8785 " "ip.pr = tcp" first. 8786 */ 8787 p = e->ipfe_cmd >> 16; 8788 if ((p != 0) && (p != fin->fin_p)) 8789 break; 8790 8791 switch (e->ipfe_cmd) 8792 { 8793 case IPF_EXP_IP_PR : 8794 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8795 rv |= (fin->fin_p == e->ipfe_arg0[i]); 8796 } 8797 break; 8798 8799 case IPF_EXP_IP_SRCADDR : 8800 if (fin->fin_v != 4) 8801 break; 8802 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8803 rv |= ((fin->fin_saddr & 8804 e->ipfe_arg0[i * 2 + 1]) == 8805 e->ipfe_arg0[i * 2]); 8806 } 8807 break; 8808 8809 case IPF_EXP_IP_DSTADDR : 8810 if (fin->fin_v != 4) 8811 break; 8812 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8813 rv |= ((fin->fin_daddr & 8814 e->ipfe_arg0[i * 2 + 1]) == 8815 e->ipfe_arg0[i * 2]); 8816 } 8817 break; 8818 8819 case IPF_EXP_IP_ADDR : 8820 if (fin->fin_v != 4) 8821 break; 8822 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8823 rv |= ((fin->fin_saddr & 8824 e->ipfe_arg0[i * 2 + 1]) == 8825 e->ipfe_arg0[i * 2]) || 8826 ((fin->fin_daddr & 8827 e->ipfe_arg0[i * 2 + 1]) == 8828 e->ipfe_arg0[i * 2]); 8829 } 8830 break; 8831 8832#ifdef USE_INET6 8833 case IPF_EXP_IP6_SRCADDR : 8834 if (fin->fin_v != 6) 8835 break; 8836 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8837 rv |= IP6_MASKEQ(&fin->fin_src6, 8838 &e->ipfe_arg0[i * 8 + 4], 8839 &e->ipfe_arg0[i * 8]); 8840 } 8841 break; 8842 8843 case IPF_EXP_IP6_DSTADDR : 8844 if (fin->fin_v != 6) 8845 break; 8846 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8847 rv |= IP6_MASKEQ(&fin->fin_dst6, 8848 &e->ipfe_arg0[i * 8 + 4], 8849 &e->ipfe_arg0[i * 8]); 8850 } 8851 break; 8852 8853 case IPF_EXP_IP6_ADDR : 8854 if (fin->fin_v != 6) 8855 break; 8856 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8857 rv |= IP6_MASKEQ(&fin->fin_src6, 8858 &e->ipfe_arg0[i * 8 + 4], 8859 &e->ipfe_arg0[i * 8]) || 8860 IP6_MASKEQ(&fin->fin_dst6, 8861 &e->ipfe_arg0[i * 8 + 4], 8862 &e->ipfe_arg0[i * 8]); 8863 } 8864 break; 8865#endif 8866 8867 case IPF_EXP_UDP_PORT : 8868 case IPF_EXP_TCP_PORT : 8869 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8870 rv |= (fin->fin_sport == e->ipfe_arg0[i]) || 8871 (fin->fin_dport == e->ipfe_arg0[i]); 8872 } 8873 break; 8874 8875 case IPF_EXP_UDP_SPORT : 8876 case IPF_EXP_TCP_SPORT : 8877 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8878 rv |= (fin->fin_sport == e->ipfe_arg0[i]); 8879 } 8880 break; 8881 8882 case IPF_EXP_UDP_DPORT : 8883 case IPF_EXP_TCP_DPORT : 8884 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8885 rv |= (fin->fin_dport == e->ipfe_arg0[i]); 8886 } 8887 break; 8888 8889 case IPF_EXP_TCP_FLAGS : 8890 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8891 rv |= ((fin->fin_tcpf & 8892 e->ipfe_arg0[i * 2 + 1]) == 8893 e->ipfe_arg0[i * 2]); 8894 } 8895 break; 8896 } 8897 rv ^= e->ipfe_not; 8898 8899 if (rv == 0) 8900 break; 8901 } 8902 8903 return rv; 8904} 8905 8906 8907/* ------------------------------------------------------------------------ */ 8908/* Function: ipf_queueflush */ 8909/* Returns: int - number of entries flushed (0 = none) */ 8910/* Parameters: softc(I) - pointer to soft context main structure */ 8911/* deletefn(I) - function to call to delete entry */ 8912/* ipfqs(I) - top of the list of ipf internal queues */ 8913/* userqs(I) - top of the list of user defined timeouts */ 8914/* */ 8915/* This fucntion gets called when the state/NAT hash tables fill up and we */ 8916/* need to try a bit harder to free up some space. The algorithm used here */ 8917/* split into two parts but both halves have the same goal: to reduce the */ 8918/* number of connections considered to be "active" to the low watermark. */ 8919/* There are two steps in doing this: */ 8920/* 1) Remove any TCP connections that are already considered to be "closed" */ 8921/* but have not yet been removed from the state table. The two states */ 8922/* TCPS_TIME_WAIT and TCPS_CLOSED are considered to be the perfect */ 8923/* candidates for this style of removal. If freeing up entries in */ 8924/* CLOSED or both CLOSED and TIME_WAIT brings us to the low watermark, */ 8925/* we do not go on to step 2. */ 8926/* */ 8927/* 2) Look for the oldest entries on each timeout queue and free them if */ 8928/* they are within the given window we are considering. Where the */ 8929/* window starts and the steps taken to increase its size depend upon */ 8930/* how long ipf has been running (ipf_ticks.) Anything modified in the */ 8931/* last 30 seconds is not touched. */ 8932/* touched */ 8933/* die ipf_ticks 30*1.5 1800*1.5 | 43200*1.5 */ 8934/* | | | | | | */ 8935/* future <--+----------+--------+-----------+-----+-----+-----------> past */ 8936/* now \_int=30s_/ \_int=1hr_/ \_int=12hr */ 8937/* */ 8938/* Points to note: */ 8939/* - tqe_die is the time, in the future, when entries die. */ 8940/* - tqe_die - ipf_ticks is how long left the connection has to live in ipf */ 8941/* ticks. */ 8942/* - tqe_touched is when the entry was last used by NAT/state */ 8943/* - the closer tqe_touched is to ipf_ticks, the further tqe_die will be */ 8944/* ipf_ticks any given timeout queue and vice versa. */ 8945/* - both tqe_die and tqe_touched increase over time */ 8946/* - timeout queues are sorted with the highest value of tqe_die at the */ 8947/* bottom and therefore the smallest values of each are at the top */ 8948/* - the pointer passed in as ipfqs should point to an array of timeout */ 8949/* queues representing each of the TCP states */ 8950/* */ 8951/* We start by setting up a maximum range to scan for things to move of */ 8952/* iend (newest) to istart (oldest) in chunks of "interval". If nothing is */ 8953/* found in that range, "interval" is adjusted (so long as it isn't 30) and */ 8954/* we start again with a new value for "iend" and "istart". This is */ 8955/* continued until we either finish the scan of 30 second intervals or the */ 8956/* low water mark is reached. */ 8957/* ------------------------------------------------------------------------ */ 8958int 8959ipf_queueflush(softc, deletefn, ipfqs, userqs, activep, size, low) 8960 ipf_main_softc_t *softc; 8961 ipftq_delete_fn_t deletefn; 8962 ipftq_t *ipfqs, *userqs; 8963 u_int *activep; 8964 int size, low; 8965{ 8966 u_long interval, istart, iend; 8967 ipftq_t *ifq, *ifqnext; 8968 ipftqent_t *tqe, *tqn; 8969 int removed = 0; 8970 8971 for (tqn = ipfqs[IPF_TCPS_CLOSED].ifq_head; ((tqe = tqn) != NULL); ) { 8972 tqn = tqe->tqe_next; 8973 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 8974 removed++; 8975 } 8976 if ((*activep * 100 / size) > low) { 8977 for (tqn = ipfqs[IPF_TCPS_TIME_WAIT].ifq_head; 8978 ((tqe = tqn) != NULL); ) { 8979 tqn = tqe->tqe_next; 8980 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 8981 removed++; 8982 } 8983 } 8984 8985 if ((*activep * 100 / size) <= low) { 8986 return removed; 8987 } 8988 8989 /* 8990 * NOTE: Use of "* 15 / 10" is required here because if "* 1.5" is 8991 * used then the operations are upgraded to floating point 8992 * and kernels don't like floating point... 8993 */ 8994 if (softc->ipf_ticks > IPF_TTLVAL(43200 * 15 / 10)) { 8995 istart = IPF_TTLVAL(86400 * 4); 8996 interval = IPF_TTLVAL(43200); 8997 } else if (softc->ipf_ticks > IPF_TTLVAL(1800 * 15 / 10)) { 8998 istart = IPF_TTLVAL(43200); 8999 interval = IPF_TTLVAL(1800); 9000 } else if (softc->ipf_ticks > IPF_TTLVAL(30 * 15 / 10)) { 9001 istart = IPF_TTLVAL(1800); 9002 interval = IPF_TTLVAL(30); 9003 } else { 9004 return 0; 9005 } 9006 if (istart > softc->ipf_ticks) { 9007 if (softc->ipf_ticks - interval < interval) 9008 istart = interval; 9009 else 9010 istart = (softc->ipf_ticks / interval) * interval; 9011 } 9012 9013 iend = softc->ipf_ticks - interval; 9014 9015 while ((*activep * 100 / size) > low) { 9016 u_long try; 9017 9018 try = softc->ipf_ticks - istart; 9019 9020 for (ifq = ipfqs; ifq != NULL; ifq = ifq->ifq_next) { 9021 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 9022 if (try < tqe->tqe_touched) 9023 break; 9024 tqn = tqe->tqe_next; 9025 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 9026 removed++; 9027 } 9028 } 9029 9030 for (ifq = userqs; ifq != NULL; ifq = ifqnext) { 9031 ifqnext = ifq->ifq_next; 9032 9033 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 9034 if (try < tqe->tqe_touched) 9035 break; 9036 tqn = tqe->tqe_next; 9037 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 9038 removed++; 9039 } 9040 } 9041 9042 if (try >= iend) { 9043 if (interval == IPF_TTLVAL(43200)) { 9044 interval = IPF_TTLVAL(1800); 9045 } else if (interval == IPF_TTLVAL(1800)) { 9046 interval = IPF_TTLVAL(30); 9047 } else { 9048 break; 9049 } 9050 if (interval >= softc->ipf_ticks) 9051 break; 9052 9053 iend = softc->ipf_ticks - interval; 9054 } 9055 istart -= interval; 9056 } 9057 9058 return removed; 9059} 9060 9061 9062/* ------------------------------------------------------------------------ */ 9063/* Function: ipf_deliverlocal */ 9064/* Returns: int - 1 = local address, 0 = non-local address */ 9065/* Parameters: softc(I) - pointer to soft context main structure */ 9066/* ipversion(I) - IP protocol version (4 or 6) */ 9067/* ifp(I) - network interface pointer */ 9068/* ipaddr(I) - IPv4/6 destination address */ 9069/* */ 9070/* This fucntion is used to determine in the address "ipaddr" belongs to */ 9071/* the network interface represented by ifp. */ 9072/* ------------------------------------------------------------------------ */ 9073int 9074ipf_deliverlocal(softc, ipversion, ifp, ipaddr) 9075 ipf_main_softc_t *softc; 9076 int ipversion; 9077 void *ifp; 9078 i6addr_t *ipaddr; 9079{ 9080 i6addr_t addr; 9081 int islocal = 0; 9082 9083 if (ipversion == 4) { 9084 if (ipf_ifpaddr(softc, 4, FRI_NORMAL, ifp, &addr, NULL) == 0) { 9085 if (addr.in4.s_addr == ipaddr->in4.s_addr) 9086 islocal = 1; 9087 } 9088 9089#ifdef USE_INET6 9090 } else if (ipversion == 6) { 9091 if (ipf_ifpaddr(softc, 6, FRI_NORMAL, ifp, &addr, NULL) == 0) { 9092 if (IP6_EQ(&addr, ipaddr)) 9093 islocal = 1; 9094 } 9095#endif 9096 } 9097 9098 return islocal; 9099} 9100 9101 9102/* ------------------------------------------------------------------------ */ 9103/* Function: ipf_settimeout */ 9104/* Returns: int - 0 = success, -1 = failure */ 9105/* Parameters: softc(I) - pointer to soft context main structure */ 9106/* t(I) - pointer to tuneable array entry */ 9107/* p(I) - pointer to values passed in to apply */ 9108/* */ 9109/* This function is called to set the timeout values for each distinct */ 9110/* queue timeout that is available. When called, it calls into both the */ 9111/* state and NAT code, telling them to update their timeout queues. */ 9112/* ------------------------------------------------------------------------ */ 9113static int 9114ipf_settimeout(softc, t, p) 9115 struct ipf_main_softc_s *softc; 9116 ipftuneable_t *t; 9117 ipftuneval_t *p; 9118{ 9119 9120 /* 9121 * ipf_interror should be set by the functions called here, not 9122 * by this function - it's just a middle man. 9123 */ 9124 if (ipf_state_settimeout(softc, t, p) == -1) 9125 return -1; 9126 if (ipf_nat_settimeout(softc, t, p) == -1) 9127 return -1; 9128 return 0; 9129} 9130 9131 9132/* ------------------------------------------------------------------------ */ 9133/* Function: ipf_apply_timeout */ 9134/* Returns: int - 0 = success, -1 = failure */ 9135/* Parameters: head(I) - pointer to tuneable array entry */ 9136/* seconds(I) - pointer to values passed in to apply */ 9137/* */ 9138/* This function applies a timeout of "seconds" to the timeout queue that */ 9139/* is pointed to by "head". All entries on this list have an expiration */ 9140/* set to be the current tick value of ipf plus the ttl. Given that this */ 9141/* function should only be called when the delta is non-zero, the task is */ 9142/* to walk the entire list and apply the change. The sort order will not */ 9143/* change. The only catch is that this is O(n) across the list, so if the */ 9144/* queue has lots of entries (10s of thousands or 100s of thousands), it */ 9145/* could take a relatively long time to work through them all. */ 9146/* ------------------------------------------------------------------------ */ 9147void 9148ipf_apply_timeout(head, seconds) 9149 ipftq_t *head; 9150 u_int seconds; 9151{ 9152 u_int oldtimeout, newtimeout; 9153 ipftqent_t *tqe; 9154 int delta; 9155 9156 MUTEX_ENTER(&head->ifq_lock); 9157 oldtimeout = head->ifq_ttl; 9158 newtimeout = IPF_TTLVAL(seconds); 9159 delta = oldtimeout - newtimeout; 9160 9161 head->ifq_ttl = newtimeout; 9162 9163 for (tqe = head->ifq_head; tqe != NULL; tqe = tqe->tqe_next) { 9164 tqe->tqe_die += delta; 9165 } 9166 MUTEX_EXIT(&head->ifq_lock); 9167} 9168 9169 9170/* ------------------------------------------------------------------------ */ 9171/* Function: ipf_settimeout_tcp */ 9172/* Returns: int - 0 = successfully applied, -1 = failed */ 9173/* Parameters: t(I) - pointer to tuneable to change */ 9174/* p(I) - pointer to new timeout information */ 9175/* tab(I) - pointer to table of TCP queues */ 9176/* */ 9177/* This function applies the new timeout (p) to the TCP tunable (t) and */ 9178/* updates all of the entries on the relevant timeout queue by calling */ 9179/* ipf_apply_timeout(). */ 9180/* ------------------------------------------------------------------------ */ 9181int 9182ipf_settimeout_tcp(t, p, tab) 9183 ipftuneable_t *t; 9184 ipftuneval_t *p; 9185 ipftq_t *tab; 9186{ 9187 if (!strcmp(t->ipft_name, "tcp_idle_timeout") || 9188 !strcmp(t->ipft_name, "tcp_established")) { 9189 ipf_apply_timeout(&tab[IPF_TCPS_ESTABLISHED], p->ipftu_int); 9190 } else if (!strcmp(t->ipft_name, "tcp_close_wait")) { 9191 ipf_apply_timeout(&tab[IPF_TCPS_CLOSE_WAIT], p->ipftu_int); 9192 } else if (!strcmp(t->ipft_name, "tcp_last_ack")) { 9193 ipf_apply_timeout(&tab[IPF_TCPS_LAST_ACK], p->ipftu_int); 9194 } else if (!strcmp(t->ipft_name, "tcp_timeout")) { 9195 ipf_apply_timeout(&tab[IPF_TCPS_LISTEN], p->ipftu_int); 9196 ipf_apply_timeout(&tab[IPF_TCPS_HALF_ESTAB], p->ipftu_int); 9197 ipf_apply_timeout(&tab[IPF_TCPS_CLOSING], p->ipftu_int); 9198 } else if (!strcmp(t->ipft_name, "tcp_listen")) { 9199 ipf_apply_timeout(&tab[IPF_TCPS_LISTEN], p->ipftu_int); 9200 } else if (!strcmp(t->ipft_name, "tcp_half_established")) { 9201 ipf_apply_timeout(&tab[IPF_TCPS_HALF_ESTAB], p->ipftu_int); 9202 } else if (!strcmp(t->ipft_name, "tcp_closing")) { 9203 ipf_apply_timeout(&tab[IPF_TCPS_CLOSING], p->ipftu_int); 9204 } else if (!strcmp(t->ipft_name, "tcp_syn_received")) { 9205 ipf_apply_timeout(&tab[IPF_TCPS_SYN_RECEIVED], p->ipftu_int); 9206 } else if (!strcmp(t->ipft_name, "tcp_syn_sent")) { 9207 ipf_apply_timeout(&tab[IPF_TCPS_SYN_SENT], p->ipftu_int); 9208 } else if (!strcmp(t->ipft_name, "tcp_closed")) { 9209 ipf_apply_timeout(&tab[IPF_TCPS_CLOSED], p->ipftu_int); 9210 } else if (!strcmp(t->ipft_name, "tcp_half_closed")) { 9211 ipf_apply_timeout(&tab[IPF_TCPS_CLOSED], p->ipftu_int); 9212 } else if (!strcmp(t->ipft_name, "tcp_time_wait")) { 9213 ipf_apply_timeout(&tab[IPF_TCPS_TIME_WAIT], p->ipftu_int); 9214 } else { 9215 /* 9216 * ipf_interror isn't set here because it should be set 9217 * by whatever called this function. 9218 */ 9219 return -1; 9220 } 9221 return 0; 9222} 9223 9224 9225/* ------------------------------------------------------------------------ */ 9226/* Function: ipf_main_soft_create */ 9227/* Returns: NULL = failure, else success */ 9228/* Parameters: arg(I) - pointer to soft context structure if already allocd */ 9229/* */ 9230/* Create the foundation soft context structure. In circumstances where it */ 9231/* is not required to dynamically allocate the context, a pointer can be */ 9232/* passed in (rather than NULL) to a structure to be initialised. */ 9233/* The main thing of interest is that a number of locks are initialised */ 9234/* here instead of in the where might be expected - in the relevant create */ 9235/* function elsewhere. This is done because the current locking design has */ 9236/* some areas where these locks are used outside of their module. */ 9237/* Possibly the most important exercise that is done here is setting of all */ 9238/* the timeout values, allowing them to be changed before init(). */ 9239/* ------------------------------------------------------------------------ */ 9240void * 9241ipf_main_soft_create(arg) 9242 void *arg; 9243{ 9244 ipf_main_softc_t *softc; 9245 9246 if (arg == NULL) { 9247 KMALLOC(softc, ipf_main_softc_t *); 9248 if (softc == NULL) 9249 return NULL; 9250 } else { 9251 softc = arg; 9252 } 9253 9254 bzero((char *)softc, sizeof(*softc)); 9255 9256 /* 9257 * This serves as a flag as to whether or not the softc should be 9258 * free'd when _destroy is called. 9259 */ 9260 softc->ipf_dynamic_softc = (arg == NULL) ? 1 : 0; 9261 9262 softc->ipf_tuners = ipf_tune_array_copy(softc, 9263 sizeof(ipf_main_tuneables), 9264 ipf_main_tuneables); 9265 if (softc->ipf_tuners == NULL) { 9266 ipf_main_soft_destroy(softc); 9267 return NULL; 9268 } 9269 9270 MUTEX_INIT(&softc->ipf_rw, "ipf rw mutex"); 9271 MUTEX_INIT(&softc->ipf_timeoutlock, "ipf timeout lock"); 9272 RWLOCK_INIT(&softc->ipf_global, "ipf filter load/unload mutex"); 9273 RWLOCK_INIT(&softc->ipf_mutex, "ipf filter rwlock"); 9274 RWLOCK_INIT(&softc->ipf_tokens, "ipf token rwlock"); 9275 RWLOCK_INIT(&softc->ipf_state, "ipf state rwlock"); 9276 RWLOCK_INIT(&softc->ipf_nat, "ipf IP NAT rwlock"); 9277 RWLOCK_INIT(&softc->ipf_poolrw, "ipf pool rwlock"); 9278 RWLOCK_INIT(&softc->ipf_frag, "ipf frag rwlock"); 9279 9280 softc->ipf_token_head = NULL; 9281 softc->ipf_token_tail = &softc->ipf_token_head; 9282 9283 softc->ipf_tcpidletimeout = FIVE_DAYS; 9284 softc->ipf_tcpclosewait = IPF_TTLVAL(2 * TCP_MSL); 9285 softc->ipf_tcplastack = IPF_TTLVAL(30); 9286 softc->ipf_tcptimewait = IPF_TTLVAL(2 * TCP_MSL); 9287 softc->ipf_tcptimeout = IPF_TTLVAL(2 * TCP_MSL); 9288 softc->ipf_tcpsynsent = IPF_TTLVAL(2 * TCP_MSL); 9289 softc->ipf_tcpsynrecv = IPF_TTLVAL(2 * TCP_MSL); 9290 softc->ipf_tcpclosed = IPF_TTLVAL(30); 9291 softc->ipf_tcphalfclosed = IPF_TTLVAL(2 * 3600); 9292 softc->ipf_udptimeout = IPF_TTLVAL(120); 9293 softc->ipf_udpacktimeout = IPF_TTLVAL(12); 9294 softc->ipf_icmptimeout = IPF_TTLVAL(60); 9295 softc->ipf_icmpacktimeout = IPF_TTLVAL(6); 9296 softc->ipf_iptimeout = IPF_TTLVAL(60); 9297 9298#if defined(IPFILTER_DEFAULT_BLOCK) 9299 softc->ipf_pass = FR_BLOCK|FR_NOMATCH; 9300#else 9301 softc->ipf_pass = (IPF_DEFAULT_PASS)|FR_NOMATCH; 9302#endif 9303 softc->ipf_minttl = 4; 9304 softc->ipf_icmpminfragmtu = 68; 9305 softc->ipf_flags = IPF_LOGGING; 9306 9307 return softc; 9308} 9309 9310/* ------------------------------------------------------------------------ */ 9311/* Function: ipf_main_soft_init */ 9312/* Returns: 0 = success, -1 = failure */ 9313/* Parameters: softc(I) - pointer to soft context main structure */ 9314/* */ 9315/* A null-op function that exists as a placeholder so that the flow in */ 9316/* other functions is obvious. */ 9317/* ------------------------------------------------------------------------ */ 9318/*ARGSUSED*/ 9319int 9320ipf_main_soft_init(softc) 9321 ipf_main_softc_t *softc; 9322{ 9323 return 0; 9324} 9325 9326 9327/* ------------------------------------------------------------------------ */ 9328/* Function: ipf_main_soft_destroy */ 9329/* Returns: void */ 9330/* Parameters: softc(I) - pointer to soft context main structure */ 9331/* */ 9332/* Undo everything that we did in ipf_main_soft_create. */ 9333/* */ 9334/* The most important check that needs to be made here is whether or not */ 9335/* the structure was allocated by ipf_main_soft_create() by checking what */ 9336/* value is stored in ipf_dynamic_main. */ 9337/* ------------------------------------------------------------------------ */ 9338/*ARGSUSED*/ 9339void 9340ipf_main_soft_destroy(softc) 9341 ipf_main_softc_t *softc; 9342{ 9343 9344 RW_DESTROY(&softc->ipf_frag); 9345 RW_DESTROY(&softc->ipf_poolrw); 9346 RW_DESTROY(&softc->ipf_nat); 9347 RW_DESTROY(&softc->ipf_state); 9348 RW_DESTROY(&softc->ipf_tokens); 9349 RW_DESTROY(&softc->ipf_mutex); 9350 RW_DESTROY(&softc->ipf_global); 9351 MUTEX_DESTROY(&softc->ipf_timeoutlock); 9352 MUTEX_DESTROY(&softc->ipf_rw); 9353 9354 if (softc->ipf_tuners != NULL) { 9355 KFREES(softc->ipf_tuners, sizeof(ipf_main_tuneables)); 9356 } 9357 if (softc->ipf_dynamic_softc == 1) { 9358 KFREE(softc); 9359 } 9360} 9361 9362 9363/* ------------------------------------------------------------------------ */ 9364/* Function: ipf_main_soft_fini */ 9365/* Returns: 0 = success, -1 = failure */ 9366/* Parameters: softc(I) - pointer to soft context main structure */ 9367/* */ 9368/* Clean out the rules which have been added since _init was last called, */ 9369/* the only dynamic part of the mainline. */ 9370/* ------------------------------------------------------------------------ */ 9371int 9372ipf_main_soft_fini(softc) 9373 ipf_main_softc_t *softc; 9374{ 9375 (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE|FR_INACTIVE); 9376 (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE); 9377 (void) ipf_flush(softc, IPL_LOGCOUNT, FR_INQUE|FR_OUTQUE|FR_INACTIVE); 9378 (void) ipf_flush(softc, IPL_LOGCOUNT, FR_INQUE|FR_OUTQUE); 9379 9380 return 0; 9381} 9382 9383 9384/* ------------------------------------------------------------------------ */ 9385/* Function: ipf_main_load */ 9386/* Returns: 0 = success, -1 = failure */ 9387/* Parameters: none */ 9388/* */ 9389/* Handle global initialisation that needs to be done for the base part of */ 9390/* IPFilter. At present this just amounts to initialising some ICMP lookup */ 9391/* arrays that get used by the state/NAT code. */ 9392/* ------------------------------------------------------------------------ */ 9393int 9394ipf_main_load() 9395{ 9396 int i; 9397 9398 /* fill icmp reply type table */ 9399 for (i = 0; i <= ICMP_MAXTYPE; i++) 9400 icmpreplytype4[i] = -1; 9401 icmpreplytype4[ICMP_ECHO] = ICMP_ECHOREPLY; 9402 icmpreplytype4[ICMP_TSTAMP] = ICMP_TSTAMPREPLY; 9403 icmpreplytype4[ICMP_IREQ] = ICMP_IREQREPLY; 9404 icmpreplytype4[ICMP_MASKREQ] = ICMP_MASKREPLY; 9405 9406#ifdef USE_INET6 9407 /* fill icmp reply type table */ 9408 for (i = 0; i <= ICMP6_MAXTYPE; i++) 9409 icmpreplytype6[i] = -1; 9410 icmpreplytype6[ICMP6_ECHO_REQUEST] = ICMP6_ECHO_REPLY; 9411 icmpreplytype6[ICMP6_MEMBERSHIP_QUERY] = ICMP6_MEMBERSHIP_REPORT; 9412 icmpreplytype6[ICMP6_NI_QUERY] = ICMP6_NI_REPLY; 9413 icmpreplytype6[ND_ROUTER_SOLICIT] = ND_ROUTER_ADVERT; 9414 icmpreplytype6[ND_NEIGHBOR_SOLICIT] = ND_NEIGHBOR_ADVERT; 9415#endif 9416 9417 return 0; 9418} 9419 9420 9421/* ------------------------------------------------------------------------ */ 9422/* Function: ipf_main_unload */ 9423/* Returns: 0 = success, -1 = failure */ 9424/* Parameters: none */ 9425/* */ 9426/* A null-op function that exists as a placeholder so that the flow in */ 9427/* other functions is obvious. */ 9428/* ------------------------------------------------------------------------ */ 9429int 9430ipf_main_unload() 9431{ 9432 return 0; 9433} 9434 9435 9436/* ------------------------------------------------------------------------ */ 9437/* Function: ipf_load_all */ 9438/* Returns: 0 = success, -1 = failure */ 9439/* Parameters: none */ 9440/* */ 9441/* Work through all of the subsystems inside IPFilter and call the load */ 9442/* function for each in an order that won't lead to a crash :) */ 9443/* ------------------------------------------------------------------------ */ 9444int 9445ipf_load_all() 9446{ 9447 if (ipf_main_load() == -1) 9448 return -1; 9449 9450 if (ipf_state_main_load() == -1) 9451 return -1; 9452 9453 if (ipf_nat_main_load() == -1) 9454 return -1; 9455 9456 if (ipf_frag_main_load() == -1) 9457 return -1; 9458 9459 if (ipf_auth_main_load() == -1) 9460 return -1; 9461 9462 if (ipf_proxy_main_load() == -1) 9463 return -1; 9464 9465 return 0; 9466} 9467 9468 9469/* ------------------------------------------------------------------------ */ 9470/* Function: ipf_unload_all */ 9471/* Returns: 0 = success, -1 = failure */ 9472/* Parameters: none */ 9473/* */ 9474/* Work through all of the subsystems inside IPFilter and call the unload */ 9475/* function for each in an order that won't lead to a crash :) */ 9476/* ------------------------------------------------------------------------ */ 9477int 9478ipf_unload_all() 9479{ 9480 if (ipf_proxy_main_unload() == -1) 9481 return -1; 9482 9483 if (ipf_auth_main_unload() == -1) 9484 return -1; 9485 9486 if (ipf_frag_main_unload() == -1) 9487 return -1; 9488 9489 if (ipf_nat_main_unload() == -1) 9490 return -1; 9491 9492 if (ipf_state_main_unload() == -1) 9493 return -1; 9494 9495 if (ipf_main_unload() == -1) 9496 return -1; 9497 9498 return 0; 9499} 9500 9501 9502/* ------------------------------------------------------------------------ */ 9503/* Function: ipf_create_all */ 9504/* Returns: NULL = failure, else success */ 9505/* Parameters: arg(I) - pointer to soft context main structure */ 9506/* */ 9507/* Work through all of the subsystems inside IPFilter and call the create */ 9508/* function for each in an order that won't lead to a crash :) */ 9509/* ------------------------------------------------------------------------ */ 9510ipf_main_softc_t * 9511ipf_create_all(arg) 9512 void *arg; 9513{ 9514 ipf_main_softc_t *softc; 9515 9516 softc = ipf_main_soft_create(arg); 9517 if (softc == NULL) 9518 return NULL; 9519 9520#ifdef IPFILTER_LOG 9521 softc->ipf_log_soft = ipf_log_soft_create(softc); 9522 if (softc->ipf_log_soft == NULL) { 9523 ipf_destroy_all(softc); 9524 return NULL; 9525 } 9526#endif 9527 9528 softc->ipf_lookup_soft = ipf_lookup_soft_create(softc); 9529 if (softc->ipf_lookup_soft == NULL) { 9530 ipf_destroy_all(softc); 9531 return NULL; 9532 } 9533 9534 softc->ipf_sync_soft = ipf_sync_soft_create(softc); 9535 if (softc->ipf_sync_soft == NULL) { 9536 ipf_destroy_all(softc); 9537 return NULL; 9538 } 9539 9540 softc->ipf_state_soft = ipf_state_soft_create(softc); 9541 if (softc->ipf_state_soft == NULL) { 9542 ipf_destroy_all(softc); 9543 return NULL; 9544 } 9545 9546 softc->ipf_nat_soft = ipf_nat_soft_create(softc); 9547 if (softc->ipf_nat_soft == NULL) { 9548 ipf_destroy_all(softc); 9549 return NULL; 9550 } 9551 9552 softc->ipf_frag_soft = ipf_frag_soft_create(softc); 9553 if (softc->ipf_frag_soft == NULL) { 9554 ipf_destroy_all(softc); 9555 return NULL; 9556 } 9557 9558 softc->ipf_auth_soft = ipf_auth_soft_create(softc); 9559 if (softc->ipf_auth_soft == NULL) { 9560 ipf_destroy_all(softc); 9561 return NULL; 9562 } 9563 9564 softc->ipf_proxy_soft = ipf_proxy_soft_create(softc); 9565 if (softc->ipf_proxy_soft == NULL) { 9566 ipf_destroy_all(softc); 9567 return NULL; 9568 } 9569 9570 return softc; 9571} 9572 9573 9574/* ------------------------------------------------------------------------ */ 9575/* Function: ipf_destroy_all */ 9576/* Returns: void */ 9577/* Parameters: softc(I) - pointer to soft context main structure */ 9578/* */ 9579/* Work through all of the subsystems inside IPFilter and call the destroy */ 9580/* function for each in an order that won't lead to a crash :) */ 9581/* */ 9582/* Every one of these functions is expected to succeed, so there is no */ 9583/* checking of return values. */ 9584/* ------------------------------------------------------------------------ */ 9585void 9586ipf_destroy_all(softc) 9587 ipf_main_softc_t *softc; 9588{ 9589 9590 if (softc->ipf_state_soft != NULL) { 9591 ipf_state_soft_destroy(softc, softc->ipf_state_soft); 9592 softc->ipf_state_soft = NULL; 9593 } 9594 9595 if (softc->ipf_nat_soft != NULL) { 9596 ipf_nat_soft_destroy(softc, softc->ipf_nat_soft); 9597 softc->ipf_nat_soft = NULL; 9598 } 9599 9600 if (softc->ipf_frag_soft != NULL) { 9601 ipf_frag_soft_destroy(softc, softc->ipf_frag_soft); 9602 softc->ipf_frag_soft = NULL; 9603 } 9604 9605 if (softc->ipf_auth_soft != NULL) { 9606 ipf_auth_soft_destroy(softc, softc->ipf_auth_soft); 9607 softc->ipf_auth_soft = NULL; 9608 } 9609 9610 if (softc->ipf_proxy_soft != NULL) { 9611 ipf_proxy_soft_destroy(softc, softc->ipf_proxy_soft); 9612 softc->ipf_proxy_soft = NULL; 9613 } 9614 9615 if (softc->ipf_sync_soft != NULL) { 9616 ipf_sync_soft_destroy(softc, softc->ipf_sync_soft); 9617 softc->ipf_sync_soft = NULL; 9618 } 9619 9620 if (softc->ipf_lookup_soft != NULL) { 9621 ipf_lookup_soft_destroy(softc, softc->ipf_lookup_soft); 9622 softc->ipf_lookup_soft = NULL; 9623 } 9624 9625#ifdef IPFILTER_LOG 9626 if (softc->ipf_log_soft != NULL) { 9627 ipf_log_soft_destroy(softc, softc->ipf_log_soft); 9628 softc->ipf_log_soft = NULL; 9629 } 9630#endif 9631 9632 ipf_main_soft_destroy(softc); 9633} 9634 9635 9636/* ------------------------------------------------------------------------ */ 9637/* Function: ipf_init_all */ 9638/* Returns: 0 = success, -1 = failure */ 9639/* Parameters: softc(I) - pointer to soft context main structure */ 9640/* */ 9641/* Work through all of the subsystems inside IPFilter and call the init */ 9642/* function for each in an order that won't lead to a crash :) */ 9643/* ------------------------------------------------------------------------ */ 9644int 9645ipf_init_all(softc) 9646 ipf_main_softc_t *softc; 9647{ 9648 9649 if (ipf_main_soft_init(softc) == -1) 9650 return -1; 9651 9652#ifdef IPFILTER_LOG 9653 if (ipf_log_soft_init(softc, softc->ipf_log_soft) == -1) 9654 return -1; 9655#endif 9656 9657 if (ipf_lookup_soft_init(softc, softc->ipf_lookup_soft) == -1) 9658 return -1; 9659 9660 if (ipf_sync_soft_init(softc, softc->ipf_sync_soft) == -1) 9661 return -1; 9662 9663 if (ipf_state_soft_init(softc, softc->ipf_state_soft) == -1) 9664 return -1; 9665 9666 if (ipf_nat_soft_init(softc, softc->ipf_nat_soft) == -1) 9667 return -1; 9668 9669 if (ipf_frag_soft_init(softc, softc->ipf_frag_soft) == -1) 9670 return -1; 9671 9672 if (ipf_auth_soft_init(softc, softc->ipf_auth_soft) == -1) 9673 return -1; 9674 9675 if (ipf_proxy_soft_init(softc, softc->ipf_proxy_soft) == -1) 9676 return -1; 9677 9678 return 0; 9679} 9680 9681 9682/* ------------------------------------------------------------------------ */ 9683/* Function: ipf_fini_all */ 9684/* Returns: 0 = success, -1 = failure */ 9685/* Parameters: softc(I) - pointer to soft context main structure */ 9686/* */ 9687/* Work through all of the subsystems inside IPFilter and call the fini */ 9688/* function for each in an order that won't lead to a crash :) */ 9689/* ------------------------------------------------------------------------ */ 9690int 9691ipf_fini_all(softc) 9692 ipf_main_softc_t *softc; 9693{ 9694 9695 ipf_token_flush(softc); 9696 9697 if (ipf_proxy_soft_fini(softc, softc->ipf_proxy_soft) == -1) 9698 return -1; 9699 9700 if (ipf_auth_soft_fini(softc, softc->ipf_auth_soft) == -1) 9701 return -1; 9702 9703 if (ipf_frag_soft_fini(softc, softc->ipf_frag_soft) == -1) 9704 return -1; 9705 9706 if (ipf_nat_soft_fini(softc, softc->ipf_nat_soft) == -1) 9707 return -1; 9708 9709 if (ipf_state_soft_fini(softc, softc->ipf_state_soft) == -1) 9710 return -1; 9711 9712 if (ipf_sync_soft_fini(softc, softc->ipf_sync_soft) == -1) 9713 return -1; 9714 9715 if (ipf_lookup_soft_fini(softc, softc->ipf_lookup_soft) == -1) 9716 return -1; 9717 9718#ifdef IPFILTER_LOG 9719 if (ipf_log_soft_fini(softc, softc->ipf_log_soft) == -1) 9720 return -1; 9721#endif 9722 9723 if (ipf_main_soft_fini(softc) == -1) 9724 return -1; 9725 9726 return 0; 9727} 9728 9729 9730/* ------------------------------------------------------------------------ */ 9731/* Function: ipf_rule_expire */ 9732/* Returns: Nil */ 9733/* Parameters: softc(I) - pointer to soft context main structure */ 9734/* */ 9735/* At present this function exists just to support temporary addition of */ 9736/* firewall rules. Both inactive and active lists are scanned for items to */ 9737/* purge, as by rights, the expiration is computed as soon as the rule is */ 9738/* loaded in. */ 9739/* ------------------------------------------------------------------------ */ 9740void 9741ipf_rule_expire(softc) 9742 ipf_main_softc_t *softc; 9743{ 9744 frentry_t *fr; 9745 9746 if ((softc->ipf_rule_explist[0] == NULL) && 9747 (softc->ipf_rule_explist[1] == NULL)) 9748 return; 9749 9750 WRITE_ENTER(&softc->ipf_mutex); 9751 9752 while ((fr = softc->ipf_rule_explist[0]) != NULL) { 9753 /* 9754 * Because the list is kept sorted on insertion, the fist 9755 * one that dies in the future means no more work to do. 9756 */ 9757 if (fr->fr_die > softc->ipf_ticks) 9758 break; 9759 ipf_rule_delete(softc, fr, IPL_LOGIPF, 0); 9760 } 9761 9762 while ((fr = softc->ipf_rule_explist[1]) != NULL) { 9763 /* 9764 * Because the list is kept sorted on insertion, the fist 9765 * one that dies in the future means no more work to do. 9766 */ 9767 if (fr->fr_die > softc->ipf_ticks) 9768 break; 9769 ipf_rule_delete(softc, fr, IPL_LOGIPF, 1); 9770 } 9771 9772 RWLOCK_EXIT(&softc->ipf_mutex); 9773} 9774 9775 9776static int ipf_ht_node_cmp __P((struct host_node_s *, struct host_node_s *)); 9777static void ipf_ht_node_make_key __P((host_track_t *, host_node_t *, int, 9778 i6addr_t *)); 9779 9780host_node_t RBI_ZERO(ipf_rb); 9781RBI_CODE(ipf_rb, host_node_t, hn_entry, ipf_ht_node_cmp) 9782 9783 9784/* ------------------------------------------------------------------------ */ 9785/* Function: ipf_ht_node_cmp */ 9786/* Returns: int - 0 == nodes are the same, .. */ 9787/* Parameters: k1(I) - pointer to first key to compare */ 9788/* k2(I) - pointer to second key to compare */ 9789/* */ 9790/* The "key" for the node is a combination of two fields: the address */ 9791/* family and the address itself. */ 9792/* */ 9793/* Because we're not actually interpreting the address data, it isn't */ 9794/* necessary to convert them to/from network/host byte order. The mask is */ 9795/* just used to remove bits that aren't significant - it doesn't matter */ 9796/* where they are, as long as they're always in the same place. */ 9797/* */ 9798/* As with IP6_EQ, comparing IPv6 addresses starts at the bottom because */ 9799/* this is where individual ones will differ the most - but not true for */ 9800/* for /48's, etc. */ 9801/* ------------------------------------------------------------------------ */ 9802static int 9803ipf_ht_node_cmp(k1, k2) 9804 struct host_node_s *k1, *k2; 9805{ 9806 int i; 9807 9808 i = (k2->hn_addr.adf_family - k1->hn_addr.adf_family); 9809 if (i != 0) 9810 return i; 9811 9812 if (k1->hn_addr.adf_family == AF_INET) 9813 return (k2->hn_addr.adf_addr.in4.s_addr - 9814 k1->hn_addr.adf_addr.in4.s_addr); 9815 9816 i = k2->hn_addr.adf_addr.i6[3] - k1->hn_addr.adf_addr.i6[3]; 9817 if (i != 0) 9818 return i; 9819 i = k2->hn_addr.adf_addr.i6[2] - k1->hn_addr.adf_addr.i6[2]; 9820 if (i != 0) 9821 return i; 9822 i = k2->hn_addr.adf_addr.i6[1] - k1->hn_addr.adf_addr.i6[1]; 9823 if (i != 0) 9824 return i; 9825 i = k2->hn_addr.adf_addr.i6[0] - k1->hn_addr.adf_addr.i6[0]; 9826 return i; 9827} 9828 9829 9830/* ------------------------------------------------------------------------ */ 9831/* Function: ipf_ht_node_make_key */ 9832/* Returns: Nil */ 9833/* parameters: htp(I) - pointer to address tracking structure */ 9834/* key(I) - where to store masked address for lookup */ 9835/* family(I) - protocol family of address */ 9836/* addr(I) - pointer to network address */ 9837/* */ 9838/* Using the "netmask" (number of bits) stored parent host tracking struct, */ 9839/* copy the address passed in into the key structure whilst masking out the */ 9840/* bits that we don't want. */ 9841/* */ 9842/* Because the parser will set ht_netmask to 128 if there is no protocol */ 9843/* specified (the parser doesn't know if it should be a v4 or v6 rule), we */ 9844/* have to be wary of that and not allow 32-128 to happen. */ 9845/* ------------------------------------------------------------------------ */ 9846static void 9847ipf_ht_node_make_key(htp, key, family, addr) 9848 host_track_t *htp; 9849 host_node_t *key; 9850 int family; 9851 i6addr_t *addr; 9852{ 9853 key->hn_addr.adf_family = family; 9854 if (family == AF_INET) { 9855 u_32_t mask; 9856 int bits; 9857 9858 key->hn_addr.adf_len = sizeof(key->hn_addr.adf_addr.in4); 9859 bits = htp->ht_netmask; 9860 if (bits >= 32) { 9861 mask = 0xffffffff; 9862 } else { 9863 mask = htonl(0xffffffff << (32 - bits)); 9864 } 9865 key->hn_addr.adf_addr.in4.s_addr = addr->in4.s_addr & mask; 9866#ifdef USE_INET6 9867 } else { 9868 int bits = htp->ht_netmask; 9869 9870 key->hn_addr.adf_len = sizeof(key->hn_addr.adf_addr.in6); 9871 if (bits > 96) { 9872 key->hn_addr.adf_addr.i6[3] = addr->i6[3] & 9873 htonl(0xffffffff << (128 - bits)); 9874 key->hn_addr.adf_addr.i6[2] = addr->i6[2]; 9875 key->hn_addr.adf_addr.i6[1] = addr->i6[2]; 9876 key->hn_addr.adf_addr.i6[0] = addr->i6[2]; 9877 } else if (bits > 64) { 9878 key->hn_addr.adf_addr.i6[3] = 0; 9879 key->hn_addr.adf_addr.i6[2] = addr->i6[2] & 9880 htonl(0xffffffff << (96 - bits)); 9881 key->hn_addr.adf_addr.i6[1] = addr->i6[1]; 9882 key->hn_addr.adf_addr.i6[0] = addr->i6[0]; 9883 } else if (bits > 32) { 9884 key->hn_addr.adf_addr.i6[3] = 0; 9885 key->hn_addr.adf_addr.i6[2] = 0; 9886 key->hn_addr.adf_addr.i6[1] = addr->i6[1] & 9887 htonl(0xffffffff << (64 - bits)); 9888 key->hn_addr.adf_addr.i6[0] = addr->i6[0]; 9889 } else { 9890 key->hn_addr.adf_addr.i6[3] = 0; 9891 key->hn_addr.adf_addr.i6[2] = 0; 9892 key->hn_addr.adf_addr.i6[1] = 0; 9893 key->hn_addr.adf_addr.i6[0] = addr->i6[0] & 9894 htonl(0xffffffff << (32 - bits)); 9895 } 9896#endif 9897 } 9898} 9899 9900 9901/* ------------------------------------------------------------------------ */ 9902/* Function: ipf_ht_node_add */ 9903/* Returns: int - 0 == success, -1 == failure */ 9904/* Parameters: softc(I) - pointer to soft context main structure */ 9905/* htp(I) - pointer to address tracking structure */ 9906/* family(I) - protocol family of address */ 9907/* addr(I) - pointer to network address */ 9908/* */ 9909/* NOTE: THIS FUNCTION MUST BE CALLED WITH AN EXCLUSIVE LOCK THAT PREVENTS */ 9910/* ipf_ht_node_del FROM RUNNING CONCURRENTLY ON THE SAME htp. */ 9911/* */ 9912/* After preparing the key with the address information to find, look in */ 9913/* the red-black tree to see if the address is known. A successful call to */ 9914/* this function can mean one of two things: a new node was added to the */ 9915/* tree or a matching node exists and we're able to bump up its activity. */ 9916/* ------------------------------------------------------------------------ */ 9917int 9918ipf_ht_node_add(softc, htp, family, addr) 9919 ipf_main_softc_t *softc; 9920 host_track_t *htp; 9921 int family; 9922 i6addr_t *addr; 9923{ 9924 host_node_t *h; 9925 host_node_t k; 9926 9927 ipf_ht_node_make_key(htp, &k, family, addr); 9928 9929 h = RBI_SEARCH(ipf_rb, &htp->ht_root, &k); 9930 if (h == NULL) { 9931 if (htp->ht_cur_nodes >= htp->ht_max_nodes) 9932 return -1; 9933 KMALLOC(h, host_node_t *); 9934 if (h == NULL) { 9935 DT(ipf_rb_no_mem); 9936 LBUMP(ipf_rb_no_mem); 9937 return -1; 9938 } 9939 9940 /* 9941 * If there was a macro to initialise the RB node then that 9942 * would get used here, but there isn't... 9943 */ 9944 bzero((char *)h, sizeof(*h)); 9945 h->hn_addr = k.hn_addr; 9946 h->hn_addr.adf_family = k.hn_addr.adf_family; 9947 RBI_INSERT(ipf_rb, &htp->ht_root, h); 9948 htp->ht_cur_nodes++; 9949 } else { 9950 if ((htp->ht_max_per_node != 0) && 9951 (h->hn_active >= htp->ht_max_per_node)) { 9952 DT(ipf_rb_node_max); 9953 LBUMP(ipf_rb_node_max); 9954 return -1; 9955 } 9956 } 9957 9958 h->hn_active++; 9959 9960 return 0; 9961} 9962 9963 9964/* ------------------------------------------------------------------------ */ 9965/* Function: ipf_ht_node_del */ 9966/* Returns: int - 0 == success, -1 == failure */ 9967/* parameters: htp(I) - pointer to address tracking structure */ 9968/* family(I) - protocol family of address */ 9969/* addr(I) - pointer to network address */ 9970/* */ 9971/* NOTE: THIS FUNCTION MUST BE CALLED WITH AN EXCLUSIVE LOCK THAT PREVENTS */ 9972/* ipf_ht_node_add FROM RUNNING CONCURRENTLY ON THE SAME htp. */ 9973/* */ 9974/* Try and find the address passed in amongst the leavese on this tree to */ 9975/* be friend. If found then drop the active account for that node drops by */ 9976/* one. If that count reaches 0, it is time to free it all up. */ 9977/* ------------------------------------------------------------------------ */ 9978int 9979ipf_ht_node_del(htp, family, addr) 9980 host_track_t *htp; 9981 int family; 9982 i6addr_t *addr; 9983{ 9984 host_node_t *h; 9985 host_node_t k; 9986 9987 ipf_ht_node_make_key(htp, &k, family, addr); 9988 9989 h = RBI_SEARCH(ipf_rb, &htp->ht_root, &k); 9990 if (h == NULL) { 9991 return -1; 9992 } else { 9993 h->hn_active--; 9994 if (h->hn_active == 0) { 9995 (void) RBI_DELETE(ipf_rb, &htp->ht_root, h); 9996 htp->ht_cur_nodes--; 9997 KFREE(h); 9998 } 9999 } 10000 10001 return 0; 10002} 10003 10004 10005/* ------------------------------------------------------------------------ */ 10006/* Function: ipf_rb_ht_init */ 10007/* Returns: Nil */ 10008/* Parameters: head(I) - pointer to host tracking structure */ 10009/* */ 10010/* Initialise the host tracking structure to be ready for use above. */ 10011/* ------------------------------------------------------------------------ */ 10012void 10013ipf_rb_ht_init(head) 10014 host_track_t *head; 10015{ 10016 RBI_INIT(ipf_rb, &head->ht_root); 10017} 10018 10019 10020/* ------------------------------------------------------------------------ */ 10021/* Function: ipf_rb_ht_freenode */ 10022/* Returns: Nil */ 10023/* Parameters: head(I) - pointer to host tracking structure */ 10024/* arg(I) - additional argument from walk caller */ 10025/* */ 10026/* Free an actual host_node_t structure. */ 10027/* ------------------------------------------------------------------------ */ 10028void 10029ipf_rb_ht_freenode(node, arg) 10030 host_node_t *node; 10031 void *arg; 10032{ 10033 KFREE(node); 10034} 10035 10036 10037/* ------------------------------------------------------------------------ */ 10038/* Function: ipf_rb_ht_flush */ 10039/* Returns: Nil */ 10040/* Parameters: head(I) - pointer to host tracking structure */ 10041/* */ 10042/* Remove all of the nodes in the tree tracking hosts by calling a walker */ 10043/* and free'ing each one. */ 10044/* ------------------------------------------------------------------------ */ 10045void 10046ipf_rb_ht_flush(head) 10047 host_track_t *head; 10048{ 10049 RBI_WALK(ipf_rb, &head->ht_root, ipf_rb_ht_freenode, NULL); 10050} 10051 10052 10053/* ------------------------------------------------------------------------ */ 10054/* Function: ipf_slowtimer */ 10055/* Returns: Nil */ 10056/* Parameters: ptr(I) - pointer to main ipf soft context structure */ 10057/* */ 10058/* Slowly expire held state for fragments. Timeouts are set * in */ 10059/* expectation of this being called twice per second. */ 10060/* ------------------------------------------------------------------------ */ 10061void 10062ipf_slowtimer(softc) 10063 ipf_main_softc_t *softc; 10064{ 10065 10066 ipf_token_expire(softc); 10067 ipf_frag_expire(softc); 10068 ipf_state_expire(softc); 10069 ipf_nat_expire(softc); 10070 ipf_auth_expire(softc); 10071 ipf_lookup_expire(softc); 10072 ipf_rule_expire(softc); 10073 ipf_sync_expire(softc); 10074 softc->ipf_ticks++; 10075# if defined(__OpenBSD__) 10076 timeout_add(&ipf_slowtimer_ch, hz/2); 10077# endif 10078} 10079 10080 10081/* ------------------------------------------------------------------------ */ 10082/* Function: ipf_inet_mask_add */ 10083/* Returns: Nil */ 10084/* Parameters: bits(I) - pointer to nat context information */ 10085/* mtab(I) - pointer to mask hash table structure */ 10086/* */ 10087/* When called, bits represents the mask of a new NAT rule that has just */ 10088/* been added. This function inserts a bitmask into the array of masks to */ 10089/* search when searching for a matching NAT rule for a packet. */ 10090/* Prevention of duplicate masks is achieved by checking the use count for */ 10091/* a given netmask. */ 10092/* ------------------------------------------------------------------------ */ 10093void 10094ipf_inet_mask_add(bits, mtab) 10095 int bits; 10096 ipf_v4_masktab_t *mtab; 10097{ 10098 u_32_t mask; 10099 int i, j; 10100 10101 mtab->imt4_masks[bits]++; 10102 if (mtab->imt4_masks[bits] > 1) 10103 return; 10104 10105 if (bits == 0) 10106 mask = 0; 10107 else 10108 mask = 0xffffffff << (32 - bits); 10109 10110 for (i = 0; i < 33; i++) { 10111 if (ntohl(mtab->imt4_active[i]) < mask) { 10112 for (j = 32; j > i; j--) 10113 mtab->imt4_active[j] = mtab->imt4_active[j - 1]; 10114 mtab->imt4_active[i] = htonl(mask); 10115 break; 10116 } 10117 } 10118 mtab->imt4_max++; 10119} 10120 10121 10122/* ------------------------------------------------------------------------ */ 10123/* Function: ipf_inet_mask_del */ 10124/* Returns: Nil */ 10125/* Parameters: bits(I) - number of bits set in the netmask */ 10126/* mtab(I) - pointer to mask hash table structure */ 10127/* */ 10128/* Remove the 32bit bitmask represented by "bits" from the collection of */ 10129/* netmasks stored inside of mtab. */ 10130/* ------------------------------------------------------------------------ */ 10131void 10132ipf_inet_mask_del(bits, mtab) 10133 int bits; 10134 ipf_v4_masktab_t *mtab; 10135{ 10136 u_32_t mask; 10137 int i, j; 10138 10139 mtab->imt4_masks[bits]--; 10140 if (mtab->imt4_masks[bits] > 0) 10141 return; 10142 10143 mask = htonl(0xffffffff << (32 - bits)); 10144 for (i = 0; i < 33; i++) { 10145 if (mtab->imt4_active[i] == mask) { 10146 for (j = i + 1; j < 33; j++) 10147 mtab->imt4_active[j - 1] = mtab->imt4_active[j]; 10148 break; 10149 } 10150 } 10151 mtab->imt4_max--; 10152 ASSERT(mtab->imt4_max >= 0); 10153} 10154 10155 10156#ifdef USE_INET6 10157/* ------------------------------------------------------------------------ */ 10158/* Function: ipf_inet6_mask_add */ 10159/* Returns: Nil */ 10160/* Parameters: bits(I) - number of bits set in mask */ 10161/* mask(I) - pointer to mask to add */ 10162/* mtab(I) - pointer to mask hash table structure */ 10163/* */ 10164/* When called, bitcount represents the mask of a IPv6 NAT map rule that */ 10165/* has just been added. This function inserts a bitmask into the array of */ 10166/* masks to search when searching for a matching NAT rule for a packet. */ 10167/* Prevention of duplicate masks is achieved by checking the use count for */ 10168/* a given netmask. */ 10169/* ------------------------------------------------------------------------ */ 10170void 10171ipf_inet6_mask_add(bits, mask, mtab) 10172 int bits; 10173 i6addr_t *mask; 10174 ipf_v6_masktab_t *mtab; 10175{ 10176 i6addr_t zero; 10177 int i, j; 10178 10179 mtab->imt6_masks[bits]++; 10180 if (mtab->imt6_masks[bits] > 1) 10181 return; 10182 10183 if (bits == 0) { 10184 mask = &zero; 10185 zero.i6[0] = 0; 10186 zero.i6[1] = 0; 10187 zero.i6[2] = 0; 10188 zero.i6[3] = 0; 10189 } 10190 10191 for (i = 0; i < 129; i++) { 10192 if (IP6_LT(&mtab->imt6_active[i], mask)) { 10193 for (j = 128; j > i; j--) 10194 mtab->imt6_active[j] = mtab->imt6_active[j - 1]; 10195 mtab->imt6_active[i] = *mask; 10196 break; 10197 } 10198 } 10199 mtab->imt6_max++; 10200} 10201 10202 10203/* ------------------------------------------------------------------------ */ 10204/* Function: ipf_inet6_mask_del */ 10205/* Returns: Nil */ 10206/* Parameters: bits(I) - number of bits set in mask */ 10207/* mask(I) - pointer to mask to remove */ 10208/* mtab(I) - pointer to mask hash table structure */ 10209/* */ 10210/* Remove the 128bit bitmask represented by "bits" from the collection of */ 10211/* netmasks stored inside of mtab. */ 10212/* ------------------------------------------------------------------------ */ 10213void 10214ipf_inet6_mask_del(bits, mask, mtab) 10215 int bits; 10216 i6addr_t *mask; 10217 ipf_v6_masktab_t *mtab; 10218{ 10219 i6addr_t zero; 10220 int i, j; 10221 10222 mtab->imt6_masks[bits]--; 10223 if (mtab->imt6_masks[bits] > 0) 10224 return; 10225 10226 if (bits == 0) 10227 mask = &zero; 10228 zero.i6[0] = 0; 10229 zero.i6[1] = 0; 10230 zero.i6[2] = 0; 10231 zero.i6[3] = 0; 10232 10233 for (i = 0; i < 129; i++) { 10234 if (IP6_EQ(&mtab->imt6_active[i], mask)) { 10235 for (j = i + 1; j < 129; j++) { 10236 mtab->imt6_active[j - 1] = mtab->imt6_active[j]; 10237 if (IP6_EQ(&mtab->imt6_active[j - 1], &zero)) 10238 break; 10239 } 10240 break; 10241 } 10242 } 10243 mtab->imt6_max--; 10244 ASSERT(mtab->imt6_max >= 0); 10245} 10246#endif 10247