1/*
2 * Copyright (C) 1993-2001 by Darren Reed.
3 *
4 * See the IPFILTER.LICENCE file for details on licencing.
5 */
6#if defined(__sgi) && (IRIX > 602)
7# include <sys/ptimers.h>
8#endif
--- 28 unchanged lines hidden (view full) ---
37# include <string.h>
38# include <stdlib.h>
39#endif
40#if !defined(__SVR4) && !defined(__svr4__)
41# ifndef linux
42# include <sys/mbuf.h>
43# endif
44#else
45# include <sys/byteorder.h>
46# if SOLARIS2 < 5
47# include <sys/dditypes.h>
48# endif
49# include <sys/stream.h>
50#endif
51#ifndef linux
52# include <sys/protosw.h>
--- 41 unchanged lines hidden (view full) ---
94# define MIN(a,b) (((a)<(b))?(a):(b))
95#endif
96#include "netinet/ipl.h"
97
98#include <machine/in_cksum.h>
99
100#if !defined(lint)
101static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed";
102static const char rcsid[] = "@(#)$FreeBSD: head/sys/contrib/ipfilter/netinet/fil.c 128019 2004-04-07 20:46:16Z imp $";
103#endif
104
105#ifndef _KERNEL
106# include "ipf.h"
107# include "ipt.h"
108extern int opts;
109
110# define FR_VERBOSE(verb_pr) verbose verb_pr
--- 30 unchanged lines hidden (view full) ---
141#endif
142char ipfilter_version[] = IPL_VERSION;
143
144fr_info_t frcache[2];
145
146static int frflushlist __P((int, minor_t, int *, frentry_t **));
147#ifdef _KERNEL
148static void frsynclist __P((frentry_t *));
149#endif
150
151
152/*
153 * bit values for identifying presence of individual IP options
154 */
155struct optlist ipopts[20] = {
156 { IPOPT_NOP, 0x000001 },
--- 32 unchanged lines hidden (view full) ---
189 { IPSO_CLASS_RES1, 0x80 }
190};
191
192
193/*
194 * compact the IP header into a structure which contains just the info.
195 * which is useful for comparing IP headers with.
196 */
197void fr_makefrip(hlen, ip, fin)
198int hlen;
199ip_t *ip;
200fr_info_t *fin;
201{
202 u_short optmsk = 0, secmsk = 0, auth = 0;
203 int i, mv, ol, off, p, plen, v;
204 fr_ip_t *fi = &fin->fin_fi;
205 struct optlist *op;
206 u_char *s, opt;
207 tcphdr_t *tcp;
208
209 fin->fin_rev = 0;
210 fin->fin_fr = NULL;
211 fin->fin_tcpf = 0;
212 fin->fin_data[0] = 0;
213 fin->fin_data[1] = 0;
214 fin->fin_rule = -1;
215 fin->fin_group = -1;
216 fin->fin_icode = ipl_unreach;
217 v = fin->fin_v;
218 fi->fi_v = v;
219 fin->fin_hlen = hlen;
220 if (v == 4) {
221 fin->fin_id = ip->ip_id;
222 fi->fi_tos = ip->ip_tos;
223 off = (ip->ip_off & IP_OFFMASK);
224 tcp = (tcphdr_t *)((char *)ip + hlen);
225 (*(((u_short *)fi) + 1)) = (*(((u_short *)ip) + 4));
226 fi->fi_src.i6[1] = 0;
227 fi->fi_src.i6[2] = 0;
228 fi->fi_src.i6[3] = 0;
229 fi->fi_dst.i6[1] = 0;
230 fi->fi_dst.i6[2] = 0;
231 fi->fi_dst.i6[3] = 0;
232 fi->fi_saddr = ip->ip_src.s_addr;
233 fi->fi_daddr = ip->ip_dst.s_addr;
234 p = ip->ip_p;
235 fi->fi_fl = (hlen > sizeof(ip_t)) ? FI_OPTIONS : 0;
236 if (ip->ip_off & (IP_MF|IP_OFFMASK))
237 fi->fi_fl |= FI_FRAG;
238 plen = ip->ip_len;
239 fin->fin_dlen = plen - hlen;
240 }
241#ifdef USE_INET6
242 else if (v == 6) {
243 ip6_t *ip6 = (ip6_t *)ip;
244
245 off = 0;
246 p = ip6->ip6_nxt;
247 fi->fi_p = p;
248 fi->fi_ttl = ip6->ip6_hlim;
249 tcp = (tcphdr_t *)(ip6 + 1);
250 fi->fi_src.in6 = ip6->ip6_src;
251 fi->fi_dst.in6 = ip6->ip6_dst;
252 fin->fin_id = (u_short)(ip6->ip6_flow & 0xffff);
253 fi->fi_tos = 0;
254 fi->fi_fl = 0;
255 plen = ntohs(ip6->ip6_plen);
256 fin->fin_dlen = plen;
257 plen += sizeof(*ip6);
258 }
259#endif
260 else
261 return;
262
263 fin->fin_off = off;
264 fin->fin_plen = plen;
265 fin->fin_dp = (char *)tcp;
266 fin->fin_misc = 0;
267 off <<= 3;
268
269 switch (p)
270 {
271#ifdef USE_INET6
272 case IPPROTO_ICMPV6 :
273 {
274 int minicmpsz = sizeof(struct icmp6_hdr);
275 struct icmp6_hdr *icmp6;
276
277 if (fin->fin_dlen > 1) {
278 fin->fin_data[0] = *(u_short *)tcp;
279
280 icmp6 = (struct icmp6_hdr *)tcp;
281
282 switch (icmp6->icmp6_type)
283 {
284 case ICMP6_ECHO_REPLY :
285 case ICMP6_ECHO_REQUEST :
286 minicmpsz = ICMP6_MINLEN;
287 break;
288 case ICMP6_DST_UNREACH :
289 case ICMP6_PACKET_TOO_BIG :
290 case ICMP6_TIME_EXCEEDED :
291 case ICMP6_PARAM_PROB :
292 minicmpsz = ICMP6ERR_IPICMPHLEN;
293 break;
294 default :
295 break;
296 }
297 }
298
299 if (!(plen >= minicmpsz))
300 fi->fi_fl |= FI_SHORT;
301
302 break;
303 }
304#endif
305 case IPPROTO_ICMP :
306 {
307 int minicmpsz = sizeof(struct icmp);
308 icmphdr_t *icmp;
309
310 if (!off && (fin->fin_dlen > 1)) {
311 fin->fin_data[0] = *(u_short *)tcp;
312
313 icmp = (icmphdr_t *)tcp;
314
315 switch (icmp->icmp_type)
316 {
317 case ICMP_ECHOREPLY :
318 case ICMP_ECHO :
319 /* Router discovery messages - RFC 1256 */
320 case ICMP_ROUTERADVERT :
321 case ICMP_ROUTERSOLICIT :
322 minicmpsz = ICMP_MINLEN;
323 break;
324 /*
325 * type(1) + code(1) + cksum(2) + id(2) seq(2) +
326 * 3*timestamp(3*4)
327 */
328 case ICMP_TSTAMP :
329 case ICMP_TSTAMPREPLY :
330 minicmpsz = 20;
331 break;
332 /*
333 * type(1) + code(1) + cksum(2) + id(2) seq(2) +
334 * mask(4)
335 */
336 case ICMP_MASKREQ :
337 case ICMP_MASKREPLY :
338 minicmpsz = 12;
339 break;
340 default :
341 break;
342 }
343 }
344
345 if ((!(plen >= hlen + minicmpsz) && !off) ||
346 (off && off < sizeof(struct icmp)))
347 fi->fi_fl |= FI_SHORT;
348
349 break;
350 }
351 case IPPROTO_TCP :
352 fi->fi_fl |= FI_TCPUDP;
353#ifdef USE_INET6
354 if (v == 6) {
355 if (plen < sizeof(struct tcphdr))
356 fi->fi_fl |= FI_SHORT;
357 } else
358#endif
359 if (v == 4) {
360 if ((!IPMINLEN(ip, tcphdr) && !off) ||
361 (off && off < sizeof(struct tcphdr)))
362 fi->fi_fl |= FI_SHORT;
363 }
364 if (!(fi->fi_fl & FI_SHORT) && !off)
365 fin->fin_tcpf = tcp->th_flags;
366 goto getports;
367 case IPPROTO_UDP :
368 fi->fi_fl |= FI_TCPUDP;
369#ifdef USE_INET6
370 if (v == 6) {
371 if (plen < sizeof(struct udphdr))
--- 23 unchanged lines hidden (view full) ---
395 (off && off < 8))
396 fi->fi_fl |= FI_SHORT;
397 }
398 break;
399 default :
400 break;
401 }
402
403#ifdef USE_INET6
404 if (v == 6) {
405 fi->fi_optmsk = 0;
406 fi->fi_secmsk = 0;
407 fi->fi_auth = 0;
408 return;
409 }
410#endif
411
412 for (s = (u_char *)(ip + 1), hlen -= (int)sizeof(*ip); hlen > 0; ) {
413 opt = *s;
414 if (opt == '\0')
415 break;
416 else if (opt == IPOPT_NOP)
--- 40 unchanged lines hidden (view full) ---
457 hlen -= ol;
458 s += ol;
459 }
460 if (auth && !(auth & 0x0100))
461 auth &= 0xff00;
462 fi->fi_optmsk = optmsk;
463 fi->fi_secmsk = secmsk;
464 fi->fi_auth = auth;
465}
466
467
468/*
469 * check an IP packet for TCP/UDP characteristics such as ports and flags.
470 */
471int fr_tcpudpchk(ft, fin)
472frtuc_t *ft;
--- 271 unchanged lines hidden (view full) ---
744 ATOMIC_INCL(frstats[fin->fin_out].fr_skip);
745 }
746 ATOMIC_INCL(frstats[fin->fin_out].fr_pkl);
747 logged = 1;
748 }
749#endif /* IPFILTER_LOG */
750 ATOMIC_INCL(fr->fr_hits);
751 if (passt & FR_ACCOUNT)
752 fr->fr_bytes += (U_QUAD_T)ip->ip_len;
753 else
754 fin->fin_icode = fr->fr_icode;
755 fin->fin_rule = rulen;
756 fin->fin_group = fr->fr_group;
757 if (fr->fr_grp != NULL) {
758 fin->fin_fr = fr->fr_grp;
759 passt = fr_scanlist(passt, ip, fin, m);
760 if (fin->fin_fr == NULL) {
--- 46 unchanged lines hidden (view full) ---
807#if !SOLARIS || !defined(_KERNEL)
808 register mb_t *m = *mp;
809#endif
810
811#ifdef _KERNEL
812 int p, len, drop = 0, logit = 0;
813 mb_t *mc = NULL;
814# if !defined(__SVR4) && !defined(__svr4__)
815# ifdef __sgi
816 char hbuf[128];
817# endif
818 int up;
819
820# if !SOLARIS && !defined(NETBSD_PF) && \
821 ((defined(__FreeBSD__) && (__FreeBSD_version < 500011)) || \
822 defined(__OpenBSD__) || defined(_BSDI_VERSION))
823 if (fr_checkp != fr_check && fr_running > 0) {
824 static int counter = 0;
825
826 if (counter == 0) {
827 printf("WARNING: fr_checkp corrupt: value %lx\n",
828 (u_long)fr_checkp);
--- 21 unchanged lines hidden (view full) ---
850 * disable delayed checksums.
851 */
852 if ((out != 0) && (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA)) {
853 in_delayed_cksum(m);
854 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
855 }
856# endif /* CSUM_DELAY_DATA */
857
858# ifdef USE_INET6
859 if (v == 6) {
860 len = ntohs(((ip6_t*)ip)->ip6_plen);
861 if (!len)
862 return -1; /* potential jumbo gram */
863 len += sizeof(ip6_t);
864 p = ((ip6_t *)ip)->ip6_nxt;
865 } else
866# endif
867 {
868 p = ip->ip_p;
869 len = ip->ip_len;
870 }
871
872 if ((p == IPPROTO_TCP || p == IPPROTO_UDP ||
873 (v == 4 && p == IPPROTO_ICMP)
874# ifdef USE_INET6
875 || (v == 6 && p == IPPROTO_ICMPV6)
876# endif
877 )) {
878 int plen = 0;
879
880 if ((v == 6) || (ip->ip_off & IP_OFFMASK) == 0)
881 switch(p)
882 {
883 case IPPROTO_TCP:
884 plen = sizeof(tcphdr_t);
885 break;
886 case IPPROTO_UDP:
887 plen = sizeof(udphdr_t);
888 break;
889 /* 96 - enough for complete ICMP error IP header */
890 case IPPROTO_ICMP:
891 plen = ICMPERR_MAXPKTLEN - sizeof(ip_t);
892 break;
893 case IPPROTO_ESP:
894 plen = 8;
895 break;
896# ifdef USE_INET6
897 case IPPROTO_ICMPV6 :
898 /*
899 * XXX does not take intermediate header
900 * into account
901 */
902 plen = ICMP6ERR_MINPKTLEN + 8 - sizeof(ip6_t);
903 break;
904# endif
905 }
906 up = MIN(hlen + plen, len);
907
908 if (up > m->m_len) {
909# ifdef __sgi
910 /* Under IRIX, avoid m_pullup as it makes ping <hostname> panic */
911 if ((up > sizeof(hbuf)) || (m_length(m) < up)) {
912 ATOMIC_INCL(frstats[out].fr_pull[1]);
913 return -1;
914 }
915 m_copydata(m, 0, up, hbuf);
916 ATOMIC_INCL(frstats[out].fr_pull[0]);
917 ip = (ip_t *)hbuf;
918# else /* __ sgi */
919# ifndef linux
920 if ((*mp = m_pullup(m, up)) == 0) {
921 ATOMIC_INCL(frstats[out].fr_pull[1]);
922 return -1;
923 } else {
924 ATOMIC_INCL(frstats[out].fr_pull[0]);
925 m = *mp;
926 ip = mtod(m, ip_t *);
927 }
928# endif /* !linux */
929# endif /* __sgi */
930 } else
931 up = 0;
932 } else
933 up = 0;
934# endif /* !defined(__SVR4) && !defined(__svr4__) */
935# if SOLARIS
936 mb_t *m = qif->qf_m;
937
938 if ((u_int)ip & 0x3)
939 return 2;
940 fin->fin_qfm = m;
941 fin->fin_qif = qif;
942# endif
943#endif /* _KERNEL */
944
945#ifndef __FreeBSD__
946 /*
947 * Be careful here: ip_id is in network byte order when called
948 * from ip_output()
949 */
950 if ((out) && (v == 4))
951 ip->ip_id = ntohs(ip->ip_id);
952#endif
953
954 changed = 0;
955 fin->fin_ifp = ifp;
956 fin->fin_v = v;
957 fin->fin_out = out;
958 fin->fin_mp = mp;
959 fr_makefrip(hlen, ip, fin);
960
961#ifdef _KERNEL
962# ifdef USE_INET6
963 if (v == 6) {
964 ATOMIC_INCL(frstats[0].fr_ipv6[out]);
965 if (((ip6_t *)ip)->ip6_hlim < fr_minttl) {
966 ATOMIC_INCL(frstats[0].fr_badttl);
967 if (fr_minttllog & 1)
--- 147 unchanged lines hidden (view full) ---
1115 }
1116 } else {
1117 ATOMIC_INCL(frstats[out].fr_cfr);
1118 }
1119 }
1120 if (pass & FR_KEEPSTATE) {
1121 if (fr_addstate(ip, fin, NULL, 0) == NULL) {
1122 ATOMIC_INCL(frstats[out].fr_bads);
1123 } else {
1124 ATOMIC_INCL(frstats[out].fr_ads);
1125 }
1126 }
1127 } else if (fr != NULL) {
1128 pass = fr->fr_flags;
1129 if (pass & FR_LOGFIRST)
1130 pass &= ~(FR_LOGFIRST|FR_LOG);
--- 170 unchanged lines hidden (view full) ---
1301 if (((pass & FR_FASTROUTE) && !out) ||
1302 (fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1))
1303 (void) ipfr_fastroute(ip, m, mp, fin, fdp);
1304
1305 if (mc != NULL)
1306 (void) ipfr_fastroute(ip, mc, &mc, fin, &fr->fr_dif);
1307 }
1308# endif /* !SOLARIS */
1309 return (pass & FR_PASS) ? 0 : error;
1310#else /* _KERNEL */
1311 if (pass & FR_NOMATCH)
1312 return 1;
1313 if (pass & FR_PASS)
1314 return 0;
1315 if (pass & FR_AUTH)
1316 return -2;
--- 81 unchanged lines hidden (view full) ---
1398# if BSD >= 199306
1399 m->m_data -= hlen;
1400# else
1401 m->m_off -= hlen;
1402# endif
1403 /*
1404 * Both sum and sum2 are partial sums, so combine them together.
1405 */
1406 sum = (sum & 0xffff) + (sum >> 16);
1407 sum = ~sum & 0xffff;
1408 sum2 += sum;
1409 sum2 = (sum2 & 0xffff) + (sum2 >> 16);
1410# else /* defined(BSD) || defined(sun) */
1411{
1412 union {
1413 u_char c[2];
1414 u_short s;
1415 } bytes;
1416 u_short len = ip->ip_len;
1417# if defined(__sgi)
--- 120 unchanged lines hidden (view full) ---
1538 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
1539 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
1540 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
1541 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
1542 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
1543 * SUCH DAMAGE.
1544 *
1545 * @(#)uipc_mbuf.c 8.2 (Berkeley) 1/4/94
1546 * $Id: fil.c,v 2.35.2.67 2002/12/06 13:28:05 darrenr Exp $
1547 */
1548/*
1549 * Copy data from an mbuf chain starting "off" bytes from the beginning,
1550 * continuing for "len" bytes, into the indicated buffer.
1551 */
1552void
1553m_copydata(m, off, len, cp)
1554 register mb_t *m;
--- 415 unchanged lines hidden (view full) ---
1970# endif /* SOLARIS */
1971 return 0;
1972}
1973
1974
1975static void frsynclist(fr)
1976register frentry_t *fr;
1977{
1978 for (; fr; fr = fr->fr_next) {
1979 if (fr->fr_ifa != NULL) {
1980 fr->fr_ifa = GETUNIT(fr->fr_ifname, fr->fr_ip.fi_v);
1981 if (fr->fr_ifa == NULL)
1982 fr->fr_ifa = (void *)-1;
1983 }
1984 if (fr->fr_grp)
1985 frsynclist(fr->fr_grp);
1986 }
1987}
1988
1989
1990void frsync()
1991{
--- 16 unchanged lines hidden (view full) ---
2008 {
2009 ip_natsync(ifp);
2010 ip_statesync(ifp);
2011 }
2012# if defined(__FreeBSD_version) && (__FreeBSD_version >= 500043)
2013 IFNET_RUNLOCK();
2014# endif
2015 ip_natsync((struct ifnet *)-1);
2016# endif /* !SOLARIS */
2017
2018 WRITE_ENTER(&ipf_mutex);
2019 frsynclist(ipacct[0][fr_active]);
2020 frsynclist(ipacct[1][fr_active]);
2021 frsynclist(ipfilter[0][fr_active]);
2022 frsynclist(ipfilter[1][fr_active]);
2023#ifdef USE_INET6
--- 212 unchanged lines hidden (view full) ---
2236mb_t *buf;
2237{
2238 ip_t *ip;
2239
2240 ip = (ip_t *)buf;
2241 return ip->ip_len;
2242}
2243#endif
2 * Copyright (C) 1993-2001 by Darren Reed.
3 *
4 * See the IPFILTER.LICENCE file for details on licencing.
5 */
6#if defined(__sgi) && (IRIX > 602)
7# include <sys/ptimers.h>
8#endif
--- 28 unchanged lines hidden (view full) ---
37# include <string.h>
38# include <stdlib.h>
39#endif
40#if !defined(__SVR4) && !defined(__svr4__)
41# ifndef linux
42# include <sys/mbuf.h>
43# endif
44#else
45# include <sys/byteorder.h>
46# if SOLARIS2 < 5
47# include <sys/dditypes.h>
48# endif
49# include <sys/stream.h>
50#endif
51#ifndef linux
52# include <sys/protosw.h>
--- 41 unchanged lines hidden (view full) ---
94# define MIN(a,b) (((a)<(b))?(a):(b))
95#endif
96#include "netinet/ipl.h"
97
98#include <machine/in_cksum.h>
99
100#if !defined(lint)
101static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed";
102static const char rcsid[] = "@(#)$FreeBSD: head/sys/contrib/ipfilter/netinet/fil.c 128019 2004-04-07 20:46:16Z imp $";
103#endif
104
105#ifndef _KERNEL
106# include "ipf.h"
107# include "ipt.h"
108extern int opts;
109
110# define FR_VERBOSE(verb_pr) verbose verb_pr
--- 30 unchanged lines hidden (view full) ---
141#endif
142char ipfilter_version[] = IPL_VERSION;
143
144fr_info_t frcache[2];
145
146static int frflushlist __P((int, minor_t, int *, frentry_t **));
147#ifdef _KERNEL
148static void frsynclist __P((frentry_t *));
149#endif
150
151
152/*
153 * bit values for identifying presence of individual IP options
154 */
155struct optlist ipopts[20] = {
156 { IPOPT_NOP, 0x000001 },
--- 32 unchanged lines hidden (view full) ---
189 { IPSO_CLASS_RES1, 0x80 }
190};
191
192
193/*
194 * compact the IP header into a structure which contains just the info.
195 * which is useful for comparing IP headers with.
196 */
197void fr_makefrip(hlen, ip, fin)
198int hlen;
199ip_t *ip;
200fr_info_t *fin;
201{
202 u_short optmsk = 0, secmsk = 0, auth = 0;
203 int i, mv, ol, off, p, plen, v;
204 fr_ip_t *fi = &fin->fin_fi;
205 struct optlist *op;
206 u_char *s, opt;
207 tcphdr_t *tcp;
208
209 fin->fin_rev = 0;
210 fin->fin_fr = NULL;
211 fin->fin_tcpf = 0;
212 fin->fin_data[0] = 0;
213 fin->fin_data[1] = 0;
214 fin->fin_rule = -1;
215 fin->fin_group = -1;
216 fin->fin_icode = ipl_unreach;
217 v = fin->fin_v;
218 fi->fi_v = v;
219 fin->fin_hlen = hlen;
220 if (v == 4) {
221 fin->fin_id = ip->ip_id;
222 fi->fi_tos = ip->ip_tos;
223 off = (ip->ip_off & IP_OFFMASK);
224 tcp = (tcphdr_t *)((char *)ip + hlen);
225 (*(((u_short *)fi) + 1)) = (*(((u_short *)ip) + 4));
226 fi->fi_src.i6[1] = 0;
227 fi->fi_src.i6[2] = 0;
228 fi->fi_src.i6[3] = 0;
229 fi->fi_dst.i6[1] = 0;
230 fi->fi_dst.i6[2] = 0;
231 fi->fi_dst.i6[3] = 0;
232 fi->fi_saddr = ip->ip_src.s_addr;
233 fi->fi_daddr = ip->ip_dst.s_addr;
234 p = ip->ip_p;
235 fi->fi_fl = (hlen > sizeof(ip_t)) ? FI_OPTIONS : 0;
236 if (ip->ip_off & (IP_MF|IP_OFFMASK))
237 fi->fi_fl |= FI_FRAG;
238 plen = ip->ip_len;
239 fin->fin_dlen = plen - hlen;
240 }
241#ifdef USE_INET6
242 else if (v == 6) {
243 ip6_t *ip6 = (ip6_t *)ip;
244
245 off = 0;
246 p = ip6->ip6_nxt;
247 fi->fi_p = p;
248 fi->fi_ttl = ip6->ip6_hlim;
249 tcp = (tcphdr_t *)(ip6 + 1);
250 fi->fi_src.in6 = ip6->ip6_src;
251 fi->fi_dst.in6 = ip6->ip6_dst;
252 fin->fin_id = (u_short)(ip6->ip6_flow & 0xffff);
253 fi->fi_tos = 0;
254 fi->fi_fl = 0;
255 plen = ntohs(ip6->ip6_plen);
256 fin->fin_dlen = plen;
257 plen += sizeof(*ip6);
258 }
259#endif
260 else
261 return;
262
263 fin->fin_off = off;
264 fin->fin_plen = plen;
265 fin->fin_dp = (char *)tcp;
266 fin->fin_misc = 0;
267 off <<= 3;
268
269 switch (p)
270 {
271#ifdef USE_INET6
272 case IPPROTO_ICMPV6 :
273 {
274 int minicmpsz = sizeof(struct icmp6_hdr);
275 struct icmp6_hdr *icmp6;
276
277 if (fin->fin_dlen > 1) {
278 fin->fin_data[0] = *(u_short *)tcp;
279
280 icmp6 = (struct icmp6_hdr *)tcp;
281
282 switch (icmp6->icmp6_type)
283 {
284 case ICMP6_ECHO_REPLY :
285 case ICMP6_ECHO_REQUEST :
286 minicmpsz = ICMP6_MINLEN;
287 break;
288 case ICMP6_DST_UNREACH :
289 case ICMP6_PACKET_TOO_BIG :
290 case ICMP6_TIME_EXCEEDED :
291 case ICMP6_PARAM_PROB :
292 minicmpsz = ICMP6ERR_IPICMPHLEN;
293 break;
294 default :
295 break;
296 }
297 }
298
299 if (!(plen >= minicmpsz))
300 fi->fi_fl |= FI_SHORT;
301
302 break;
303 }
304#endif
305 case IPPROTO_ICMP :
306 {
307 int minicmpsz = sizeof(struct icmp);
308 icmphdr_t *icmp;
309
310 if (!off && (fin->fin_dlen > 1)) {
311 fin->fin_data[0] = *(u_short *)tcp;
312
313 icmp = (icmphdr_t *)tcp;
314
315 switch (icmp->icmp_type)
316 {
317 case ICMP_ECHOREPLY :
318 case ICMP_ECHO :
319 /* Router discovery messages - RFC 1256 */
320 case ICMP_ROUTERADVERT :
321 case ICMP_ROUTERSOLICIT :
322 minicmpsz = ICMP_MINLEN;
323 break;
324 /*
325 * type(1) + code(1) + cksum(2) + id(2) seq(2) +
326 * 3*timestamp(3*4)
327 */
328 case ICMP_TSTAMP :
329 case ICMP_TSTAMPREPLY :
330 minicmpsz = 20;
331 break;
332 /*
333 * type(1) + code(1) + cksum(2) + id(2) seq(2) +
334 * mask(4)
335 */
336 case ICMP_MASKREQ :
337 case ICMP_MASKREPLY :
338 minicmpsz = 12;
339 break;
340 default :
341 break;
342 }
343 }
344
345 if ((!(plen >= hlen + minicmpsz) && !off) ||
346 (off && off < sizeof(struct icmp)))
347 fi->fi_fl |= FI_SHORT;
348
349 break;
350 }
351 case IPPROTO_TCP :
352 fi->fi_fl |= FI_TCPUDP;
353#ifdef USE_INET6
354 if (v == 6) {
355 if (plen < sizeof(struct tcphdr))
356 fi->fi_fl |= FI_SHORT;
357 } else
358#endif
359 if (v == 4) {
360 if ((!IPMINLEN(ip, tcphdr) && !off) ||
361 (off && off < sizeof(struct tcphdr)))
362 fi->fi_fl |= FI_SHORT;
363 }
364 if (!(fi->fi_fl & FI_SHORT) && !off)
365 fin->fin_tcpf = tcp->th_flags;
366 goto getports;
367 case IPPROTO_UDP :
368 fi->fi_fl |= FI_TCPUDP;
369#ifdef USE_INET6
370 if (v == 6) {
371 if (plen < sizeof(struct udphdr))
--- 23 unchanged lines hidden (view full) ---
395 (off && off < 8))
396 fi->fi_fl |= FI_SHORT;
397 }
398 break;
399 default :
400 break;
401 }
402
403#ifdef USE_INET6
404 if (v == 6) {
405 fi->fi_optmsk = 0;
406 fi->fi_secmsk = 0;
407 fi->fi_auth = 0;
408 return;
409 }
410#endif
411
412 for (s = (u_char *)(ip + 1), hlen -= (int)sizeof(*ip); hlen > 0; ) {
413 opt = *s;
414 if (opt == '\0')
415 break;
416 else if (opt == IPOPT_NOP)
--- 40 unchanged lines hidden (view full) ---
457 hlen -= ol;
458 s += ol;
459 }
460 if (auth && !(auth & 0x0100))
461 auth &= 0xff00;
462 fi->fi_optmsk = optmsk;
463 fi->fi_secmsk = secmsk;
464 fi->fi_auth = auth;
465}
466
467
468/*
469 * check an IP packet for TCP/UDP characteristics such as ports and flags.
470 */
471int fr_tcpudpchk(ft, fin)
472frtuc_t *ft;
--- 271 unchanged lines hidden (view full) ---
744 ATOMIC_INCL(frstats[fin->fin_out].fr_skip);
745 }
746 ATOMIC_INCL(frstats[fin->fin_out].fr_pkl);
747 logged = 1;
748 }
749#endif /* IPFILTER_LOG */
750 ATOMIC_INCL(fr->fr_hits);
751 if (passt & FR_ACCOUNT)
752 fr->fr_bytes += (U_QUAD_T)ip->ip_len;
753 else
754 fin->fin_icode = fr->fr_icode;
755 fin->fin_rule = rulen;
756 fin->fin_group = fr->fr_group;
757 if (fr->fr_grp != NULL) {
758 fin->fin_fr = fr->fr_grp;
759 passt = fr_scanlist(passt, ip, fin, m);
760 if (fin->fin_fr == NULL) {
--- 46 unchanged lines hidden (view full) ---
807#if !SOLARIS || !defined(_KERNEL)
808 register mb_t *m = *mp;
809#endif
810
811#ifdef _KERNEL
812 int p, len, drop = 0, logit = 0;
813 mb_t *mc = NULL;
814# if !defined(__SVR4) && !defined(__svr4__)
815# ifdef __sgi
816 char hbuf[128];
817# endif
818 int up;
819
820# if !SOLARIS && !defined(NETBSD_PF) && \
821 ((defined(__FreeBSD__) && (__FreeBSD_version < 500011)) || \
822 defined(__OpenBSD__) || defined(_BSDI_VERSION))
823 if (fr_checkp != fr_check && fr_running > 0) {
824 static int counter = 0;
825
826 if (counter == 0) {
827 printf("WARNING: fr_checkp corrupt: value %lx\n",
828 (u_long)fr_checkp);
--- 21 unchanged lines hidden (view full) ---
850 * disable delayed checksums.
851 */
852 if ((out != 0) && (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA)) {
853 in_delayed_cksum(m);
854 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
855 }
856# endif /* CSUM_DELAY_DATA */
857
858# ifdef USE_INET6
859 if (v == 6) {
860 len = ntohs(((ip6_t*)ip)->ip6_plen);
861 if (!len)
862 return -1; /* potential jumbo gram */
863 len += sizeof(ip6_t);
864 p = ((ip6_t *)ip)->ip6_nxt;
865 } else
866# endif
867 {
868 p = ip->ip_p;
869 len = ip->ip_len;
870 }
871
872 if ((p == IPPROTO_TCP || p == IPPROTO_UDP ||
873 (v == 4 && p == IPPROTO_ICMP)
874# ifdef USE_INET6
875 || (v == 6 && p == IPPROTO_ICMPV6)
876# endif
877 )) {
878 int plen = 0;
879
880 if ((v == 6) || (ip->ip_off & IP_OFFMASK) == 0)
881 switch(p)
882 {
883 case IPPROTO_TCP:
884 plen = sizeof(tcphdr_t);
885 break;
886 case IPPROTO_UDP:
887 plen = sizeof(udphdr_t);
888 break;
889 /* 96 - enough for complete ICMP error IP header */
890 case IPPROTO_ICMP:
891 plen = ICMPERR_MAXPKTLEN - sizeof(ip_t);
892 break;
893 case IPPROTO_ESP:
894 plen = 8;
895 break;
896# ifdef USE_INET6
897 case IPPROTO_ICMPV6 :
898 /*
899 * XXX does not take intermediate header
900 * into account
901 */
902 plen = ICMP6ERR_MINPKTLEN + 8 - sizeof(ip6_t);
903 break;
904# endif
905 }
906 up = MIN(hlen + plen, len);
907
908 if (up > m->m_len) {
909# ifdef __sgi
910 /* Under IRIX, avoid m_pullup as it makes ping <hostname> panic */
911 if ((up > sizeof(hbuf)) || (m_length(m) < up)) {
912 ATOMIC_INCL(frstats[out].fr_pull[1]);
913 return -1;
914 }
915 m_copydata(m, 0, up, hbuf);
916 ATOMIC_INCL(frstats[out].fr_pull[0]);
917 ip = (ip_t *)hbuf;
918# else /* __ sgi */
919# ifndef linux
920 if ((*mp = m_pullup(m, up)) == 0) {
921 ATOMIC_INCL(frstats[out].fr_pull[1]);
922 return -1;
923 } else {
924 ATOMIC_INCL(frstats[out].fr_pull[0]);
925 m = *mp;
926 ip = mtod(m, ip_t *);
927 }
928# endif /* !linux */
929# endif /* __sgi */
930 } else
931 up = 0;
932 } else
933 up = 0;
934# endif /* !defined(__SVR4) && !defined(__svr4__) */
935# if SOLARIS
936 mb_t *m = qif->qf_m;
937
938 if ((u_int)ip & 0x3)
939 return 2;
940 fin->fin_qfm = m;
941 fin->fin_qif = qif;
942# endif
943#endif /* _KERNEL */
944
945#ifndef __FreeBSD__
946 /*
947 * Be careful here: ip_id is in network byte order when called
948 * from ip_output()
949 */
950 if ((out) && (v == 4))
951 ip->ip_id = ntohs(ip->ip_id);
952#endif
953
954 changed = 0;
955 fin->fin_ifp = ifp;
956 fin->fin_v = v;
957 fin->fin_out = out;
958 fin->fin_mp = mp;
959 fr_makefrip(hlen, ip, fin);
960
961#ifdef _KERNEL
962# ifdef USE_INET6
963 if (v == 6) {
964 ATOMIC_INCL(frstats[0].fr_ipv6[out]);
965 if (((ip6_t *)ip)->ip6_hlim < fr_minttl) {
966 ATOMIC_INCL(frstats[0].fr_badttl);
967 if (fr_minttllog & 1)
--- 147 unchanged lines hidden (view full) ---
1115 }
1116 } else {
1117 ATOMIC_INCL(frstats[out].fr_cfr);
1118 }
1119 }
1120 if (pass & FR_KEEPSTATE) {
1121 if (fr_addstate(ip, fin, NULL, 0) == NULL) {
1122 ATOMIC_INCL(frstats[out].fr_bads);
1123 } else {
1124 ATOMIC_INCL(frstats[out].fr_ads);
1125 }
1126 }
1127 } else if (fr != NULL) {
1128 pass = fr->fr_flags;
1129 if (pass & FR_LOGFIRST)
1130 pass &= ~(FR_LOGFIRST|FR_LOG);
--- 170 unchanged lines hidden (view full) ---
1301 if (((pass & FR_FASTROUTE) && !out) ||
1302 (fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1))
1303 (void) ipfr_fastroute(ip, m, mp, fin, fdp);
1304
1305 if (mc != NULL)
1306 (void) ipfr_fastroute(ip, mc, &mc, fin, &fr->fr_dif);
1307 }
1308# endif /* !SOLARIS */
1309 return (pass & FR_PASS) ? 0 : error;
1310#else /* _KERNEL */
1311 if (pass & FR_NOMATCH)
1312 return 1;
1313 if (pass & FR_PASS)
1314 return 0;
1315 if (pass & FR_AUTH)
1316 return -2;
--- 81 unchanged lines hidden (view full) ---
1398# if BSD >= 199306
1399 m->m_data -= hlen;
1400# else
1401 m->m_off -= hlen;
1402# endif
1403 /*
1404 * Both sum and sum2 are partial sums, so combine them together.
1405 */
1406 sum = (sum & 0xffff) + (sum >> 16);
1407 sum = ~sum & 0xffff;
1408 sum2 += sum;
1409 sum2 = (sum2 & 0xffff) + (sum2 >> 16);
1410# else /* defined(BSD) || defined(sun) */
1411{
1412 union {
1413 u_char c[2];
1414 u_short s;
1415 } bytes;
1416 u_short len = ip->ip_len;
1417# if defined(__sgi)
--- 120 unchanged lines hidden (view full) ---
1538 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
1539 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
1540 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
1541 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
1542 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
1543 * SUCH DAMAGE.
1544 *
1545 * @(#)uipc_mbuf.c 8.2 (Berkeley) 1/4/94
1546 * $Id: fil.c,v 2.35.2.67 2002/12/06 13:28:05 darrenr Exp $
1547 */
1548/*
1549 * Copy data from an mbuf chain starting "off" bytes from the beginning,
1550 * continuing for "len" bytes, into the indicated buffer.
1551 */
1552void
1553m_copydata(m, off, len, cp)
1554 register mb_t *m;
--- 415 unchanged lines hidden (view full) ---
1970# endif /* SOLARIS */
1971 return 0;
1972}
1973
1974
1975static void frsynclist(fr)
1976register frentry_t *fr;
1977{
1978 for (; fr; fr = fr->fr_next) {
1979 if (fr->fr_ifa != NULL) {
1980 fr->fr_ifa = GETUNIT(fr->fr_ifname, fr->fr_ip.fi_v);
1981 if (fr->fr_ifa == NULL)
1982 fr->fr_ifa = (void *)-1;
1983 }
1984 if (fr->fr_grp)
1985 frsynclist(fr->fr_grp);
1986 }
1987}
1988
1989
1990void frsync()
1991{
--- 16 unchanged lines hidden (view full) ---
2008 {
2009 ip_natsync(ifp);
2010 ip_statesync(ifp);
2011 }
2012# if defined(__FreeBSD_version) && (__FreeBSD_version >= 500043)
2013 IFNET_RUNLOCK();
2014# endif
2015 ip_natsync((struct ifnet *)-1);
2016# endif /* !SOLARIS */
2017
2018 WRITE_ENTER(&ipf_mutex);
2019 frsynclist(ipacct[0][fr_active]);
2020 frsynclist(ipacct[1][fr_active]);
2021 frsynclist(ipfilter[0][fr_active]);
2022 frsynclist(ipfilter[1][fr_active]);
2023#ifdef USE_INET6
--- 212 unchanged lines hidden (view full) ---
2236mb_t *buf;
2237{
2238 ip_t *ip;
2239
2240 ip = (ip_t *)buf;
2241 return ip->ip_len;
2242}
2243#endif