Deleted Added
sdiff udiff text old ( 72006 ) new ( 80482 )
full compact
fil.c (72006) fil.c (80482)
1/*
1/*
2 * Copyright (C) 1993-2000 by Darren Reed.
2 * Copyright (C) 1993-2001 by Darren Reed.
3 *
3 *
4 * Redistribution and use in source and binary forms are permitted
5 * provided that this notice is preserved and due credit is given
6 * to the original author and the contributors.
4 * See the IPFILTER.LICENCE file for details on licencing.
7 */
5 */
8#if !defined(lint)
9static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed";
10/* static const char rcsid[] = "@(#)$Id: fil.c,v 2.3.2.16 2000/01/27 08:49:37 darrenr Exp $"; */
11static const char rcsid[] = "@(#)$FreeBSD: head/sys/contrib/ipfilter/netinet/fil.c 72006 2001-02-04 14:26:56Z darrenr $";
12#endif
13
14#include <sys/errno.h>
15#include <sys/types.h>
16#include <sys/param.h>
17#include <sys/time.h>
18#include <sys/file.h>
19#if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \
20 defined(_KERNEL)
21# include "opt_ipfilter_log.h"

--- 76 unchanged lines hidden (view full) ---

98# endif
99#ifndef MIN
100# define MIN(a,b) (((a)<(b))?(a):(b))
101#endif
102#include "netinet/ipl.h"
103
104#include <machine/in_cksum.h>
105
6#include <sys/errno.h>
7#include <sys/types.h>
8#include <sys/param.h>
9#include <sys/time.h>
10#include <sys/file.h>
11#if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \
12 defined(_KERNEL)
13# include "opt_ipfilter_log.h"

--- 76 unchanged lines hidden (view full) ---

90# endif
91#ifndef MIN
92# define MIN(a,b) (((a)<(b))?(a):(b))
93#endif
94#include "netinet/ipl.h"
95
96#include <machine/in_cksum.h>
97
98#if !defined(lint)
99static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed";
100/* static const char rcsid[] = "@(#)$Id: fil.c,v 2.35.2.39 2001/07/18 13:30:32 darrenr Exp $"; */
101static const char rcsid[] = "@(#)$FreeBSD: head/sys/contrib/ipfilter/netinet/fil.c 80482 2001-07-28 11:58:26Z darrenr $";
102#endif
103
106#ifndef _KERNEL
107# include "ipf.h"
108# include "ipt.h"
109extern int opts;
110
111# define FR_VERBOSE(verb_pr) verbose verb_pr
112# define FR_DEBUG(verb_pr) debug verb_pr
113# define IPLLOG(a, c, d, e) ipllog()
114#else /* #ifndef _KERNEL */
115# define FR_VERBOSE(verb_pr)
116# define FR_DEBUG(verb_pr)
117# define IPLLOG(a, c, d, e) ipflog(a, c, d, e)
118# if SOLARIS || defined(__sgi)
119extern KRWLOCK_T ipf_mutex, ipf_auth, ipf_nat;
120extern kmutex_t ipf_rw;
104#ifndef _KERNEL
105# include "ipf.h"
106# include "ipt.h"
107extern int opts;
108
109# define FR_VERBOSE(verb_pr) verbose verb_pr
110# define FR_DEBUG(verb_pr) debug verb_pr
111# define IPLLOG(a, c, d, e) ipllog()
112#else /* #ifndef _KERNEL */
113# define FR_VERBOSE(verb_pr)
114# define FR_DEBUG(verb_pr)
115# define IPLLOG(a, c, d, e) ipflog(a, c, d, e)
116# if SOLARIS || defined(__sgi)
117extern KRWLOCK_T ipf_mutex, ipf_auth, ipf_nat;
118extern kmutex_t ipf_rw;
121# endif
122# if SOLARIS
123# define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, \
124 ip, qif)
125# else /* SOLARIS */
126# define FR_NEWAUTH(m, fi, ip, qif) fr_newauth((mb_t *)m, fi, ip)
127# endif /* SOLARIS || __sgi */
128#endif /* _KERNEL */
129
130
131struct filterstats frstats[2] = {{0,0,0,0,0},{0,0,0,0,0}};
132struct frentry *ipfilter[2][2] = { { NULL, NULL }, { NULL, NULL } },
133#ifdef USE_INET6
134 *ipfilter6[2][2] = { { NULL, NULL }, { NULL, NULL } },

--- 89 unchanged lines hidden (view full) ---

224 fin->fin_icode = ipl_unreach;
225#endif
226 v = fin->fin_v;
227 fi->fi_v = v;
228 fin->fin_hlen = hlen;
229 if (v == 4) {
230 fin->fin_id = ip->ip_id;
231 fi->fi_tos = ip->ip_tos;
119# endif /* SOLARIS || __sgi */
120#endif /* _KERNEL */
121
122
123struct filterstats frstats[2] = {{0,0,0,0,0},{0,0,0,0,0}};
124struct frentry *ipfilter[2][2] = { { NULL, NULL }, { NULL, NULL } },
125#ifdef USE_INET6
126 *ipfilter6[2][2] = { { NULL, NULL }, { NULL, NULL } },

--- 89 unchanged lines hidden (view full) ---

216 fin->fin_icode = ipl_unreach;
217#endif
218 v = fin->fin_v;
219 fi->fi_v = v;
220 fin->fin_hlen = hlen;
221 if (v == 4) {
222 fin->fin_id = ip->ip_id;
223 fi->fi_tos = ip->ip_tos;
232 off = (ip->ip_off & IP_OFFMASK) << 3;
224 off = (ip->ip_off & IP_OFFMASK);
233 tcp = (tcphdr_t *)((char *)ip + hlen);
234 (*(((u_short *)fi) + 1)) = (*(((u_short *)ip) + 4));
235 fi->fi_src.i6[1] = 0;
236 fi->fi_src.i6[2] = 0;
237 fi->fi_src.i6[3] = 0;
238 fi->fi_dst.i6[1] = 0;
239 fi->fi_dst.i6[2] = 0;
240 fi->fi_dst.i6[3] = 0;
241 fi->fi_saddr = ip->ip_src.s_addr;
242 fi->fi_daddr = ip->ip_dst.s_addr;
243 p = ip->ip_p;
244 fi->fi_fl = (hlen > sizeof(ip_t)) ? FI_OPTIONS : 0;
225 tcp = (tcphdr_t *)((char *)ip + hlen);
226 (*(((u_short *)fi) + 1)) = (*(((u_short *)ip) + 4));
227 fi->fi_src.i6[1] = 0;
228 fi->fi_src.i6[2] = 0;
229 fi->fi_src.i6[3] = 0;
230 fi->fi_dst.i6[1] = 0;
231 fi->fi_dst.i6[2] = 0;
232 fi->fi_dst.i6[3] = 0;
233 fi->fi_saddr = ip->ip_src.s_addr;
234 fi->fi_daddr = ip->ip_dst.s_addr;
235 p = ip->ip_p;
236 fi->fi_fl = (hlen > sizeof(ip_t)) ? FI_OPTIONS : 0;
245 if (ip->ip_off & 0x3fff)
237 if (ip->ip_off & (IP_MF|IP_OFFMASK))
246 fi->fi_fl |= FI_FRAG;
247 plen = ip->ip_len;
248 fin->fin_dlen = plen - hlen;
249 }
250#ifdef USE_INET6
251 else if (v == 6) {
252 ip6_t *ip6 = (ip6_t *)ip;
253

--- 4 unchanged lines hidden (view full) ---

258 tcp = (tcphdr_t *)(ip6 + 1);
259 fi->fi_src.in6 = ip6->ip6_src;
260 fi->fi_dst.in6 = ip6->ip6_dst;
261 fin->fin_id = (u_short)(ip6->ip6_flow & 0xffff);
262 fi->fi_tos = 0;
263 fi->fi_fl = 0;
264 plen = ntohs(ip6->ip6_plen);
265 fin->fin_dlen = plen;
238 fi->fi_fl |= FI_FRAG;
239 plen = ip->ip_len;
240 fin->fin_dlen = plen - hlen;
241 }
242#ifdef USE_INET6
243 else if (v == 6) {
244 ip6_t *ip6 = (ip6_t *)ip;
245

--- 4 unchanged lines hidden (view full) ---

250 tcp = (tcphdr_t *)(ip6 + 1);
251 fi->fi_src.in6 = ip6->ip6_src;
252 fi->fi_dst.in6 = ip6->ip6_dst;
253 fin->fin_id = (u_short)(ip6->ip6_flow & 0xffff);
254 fi->fi_tos = 0;
255 fi->fi_fl = 0;
256 plen = ntohs(ip6->ip6_plen);
257 fin->fin_dlen = plen;
258 plen += sizeof(*ip6);
266 }
267#endif
268 else
269 return;
270
271 fin->fin_off = off;
272 fin->fin_plen = plen;
273 fin->fin_dp = (void *)tcp;
259 }
260#endif
261 else
262 return;
263
264 fin->fin_off = off;
265 fin->fin_plen = plen;
266 fin->fin_dp = (void *)tcp;
267 off <<= 3;
274
275 switch (p)
276 {
277#ifdef USE_INET6
278 case IPPROTO_ICMPV6 :
279 {
280 int minicmpsz = sizeof(struct icmp6_hdr);
281 struct icmp6_hdr *icmp6;

--- 31 unchanged lines hidden (view full) ---

313 int minicmpsz = sizeof(struct icmp);
314 icmphdr_t *icmp;
315
316 if (!off && (fin->fin_dlen > 1)) {
317 fin->fin_data[0] = *(u_short *)tcp;
318
319 icmp = (icmphdr_t *)tcp;
320
268
269 switch (p)
270 {
271#ifdef USE_INET6
272 case IPPROTO_ICMPV6 :
273 {
274 int minicmpsz = sizeof(struct icmp6_hdr);
275 struct icmp6_hdr *icmp6;

--- 31 unchanged lines hidden (view full) ---

307 int minicmpsz = sizeof(struct icmp);
308 icmphdr_t *icmp;
309
310 if (!off && (fin->fin_dlen > 1)) {
311 fin->fin_data[0] = *(u_short *)tcp;
312
313 icmp = (icmphdr_t *)tcp;
314
321 if (icmp->icmp_type == ICMP_ECHOREPLY ||
322 icmp->icmp_type == ICMP_ECHO)
315 switch (icmp->icmp_type)
316 {
317 case ICMP_ECHOREPLY :
318 case ICMP_ECHO :
319 /* Router discovery messages - RFC 1256 */
320 case ICMP_ROUTERADVERT :
321 case ICMP_ROUTERSOLICIT :
323 minicmpsz = ICMP_MINLEN;
322 minicmpsz = ICMP_MINLEN;
324
323 break;
325 /*
326 * type(1) + code(1) + cksum(2) + id(2) seq(2) +
327 * 3*timestamp(3*4)
328 */
324 /*
325 * type(1) + code(1) + cksum(2) + id(2) seq(2) +
326 * 3*timestamp(3*4)
327 */
329 else if (icmp->icmp_type == ICMP_TSTAMP ||
330 icmp->icmp_type == ICMP_TSTAMPREPLY)
328 case ICMP_TSTAMP :
329 case ICMP_TSTAMPREPLY :
331 minicmpsz = 20;
330 minicmpsz = 20;
332
331 break;
333 /*
334 * type(1) + code(1) + cksum(2) + id(2) seq(2) +
335 * mask(4)
336 */
332 /*
333 * type(1) + code(1) + cksum(2) + id(2) seq(2) +
334 * mask(4)
335 */
337 else if (icmp->icmp_type == ICMP_MASKREQ ||
338 icmp->icmp_type == ICMP_MASKREPLY)
336 case ICMP_MASKREQ :
337 case ICMP_MASKREPLY :
339 minicmpsz = 12;
338 minicmpsz = 12;
339 break;
340 default :
341 break;
342 }
340 }
341
342 if ((!(plen >= hlen + minicmpsz) && !off) ||
343 (off && off < sizeof(struct icmp)))
344 fi->fi_fl |= FI_SHORT;
345
346 break;
347 }

--- 172 unchanged lines hidden (view full) ---

520
521 /*
522 * If we don't have all the TCP/UDP header, then how can we
523 * expect to do any sort of match on it ? If we were looking for
524 * TCP flags, then NO match. If not, then match (which should
525 * satisfy the "short" class too).
526 */
527 if (err && (fin->fin_fi.fi_p == IPPROTO_TCP)) {
343 }
344
345 if ((!(plen >= hlen + minicmpsz) && !off) ||
346 (off && off < sizeof(struct icmp)))
347 fi->fi_fl |= FI_SHORT;
348
349 break;
350 }

--- 172 unchanged lines hidden (view full) ---

523
524 /*
525 * If we don't have all the TCP/UDP header, then how can we
526 * expect to do any sort of match on it ? If we were looking for
527 * TCP flags, then NO match. If not, then match (which should
528 * satisfy the "short" class too).
529 */
530 if (err && (fin->fin_fi.fi_p == IPPROTO_TCP)) {
528 if (fin->fin_fi.fi_fl & FI_SHORT)
531 if (fin->fin_fl & FI_SHORT)
529 return !(ft->ftu_tcpf | ft->ftu_tcpfm);
530 /*
531 * Match the flags ? If not, abort this match.
532 */
533 if (ft->ftu_tcpfm &&
534 ft->ftu_tcpf != (fin->fin_tcpf & ft->ftu_tcpfm)) {
535 FR_DEBUG(("f. %#x & %#x != %#x\n", fin->fin_tcpf,
536 ft->ftu_tcpfm, ft->ftu_tcpf));

--- 18 unchanged lines hidden (view full) ---

555 register fr_ip_t *fi = &fin->fin_fi;
556 int rulen, portcmp = 0, off, skip = 0, logged = 0;
557 u_32_t passt;
558
559 fr = fin->fin_fr;
560 fin->fin_fr = NULL;
561 fin->fin_rule = 0;
562 fin->fin_group = 0;
532 return !(ft->ftu_tcpf | ft->ftu_tcpfm);
533 /*
534 * Match the flags ? If not, abort this match.
535 */
536 if (ft->ftu_tcpfm &&
537 ft->ftu_tcpf != (fin->fin_tcpf & ft->ftu_tcpfm)) {
538 FR_DEBUG(("f. %#x & %#x != %#x\n", fin->fin_tcpf,
539 ft->ftu_tcpfm, ft->ftu_tcpf));

--- 18 unchanged lines hidden (view full) ---

558 register fr_ip_t *fi = &fin->fin_fi;
559 int rulen, portcmp = 0, off, skip = 0, logged = 0;
560 u_32_t passt;
561
562 fr = fin->fin_fr;
563 fin->fin_fr = NULL;
564 fin->fin_rule = 0;
565 fin->fin_group = 0;
563 if (fin->fin_v == 4)
564 off = ip->ip_off & IP_OFFMASK;
565 else
566 off = 0;
566 off = fin->fin_off;
567 pass |= (fi->fi_fl << 24);
568
569 if ((fi->fi_fl & FI_TCPUDP) && (fin->fin_dlen > 3) && !off)
570 portcmp = 1;
571
572 for (rulen = 0; fr; fr = fr->fr_next, rulen++) {
573 if (skip) {
574 skip--;

--- 210 unchanged lines hidden (view full) ---

785 register mb_t *m = *mp;
786#endif
787
788#ifdef _KERNEL
789 int p, len, drop = 0, logit = 0;
790 mb_t *mc = NULL;
791# if !defined(__SVR4) && !defined(__svr4__)
792# ifdef __sgi
567 pass |= (fi->fi_fl << 24);
568
569 if ((fi->fi_fl & FI_TCPUDP) && (fin->fin_dlen > 3) && !off)
570 portcmp = 1;
571
572 for (rulen = 0; fr; fr = fr->fr_next, rulen++) {
573 if (skip) {
574 skip--;

--- 210 unchanged lines hidden (view full) ---

785 register mb_t *m = *mp;
786#endif
787
788#ifdef _KERNEL
789 int p, len, drop = 0, logit = 0;
790 mb_t *mc = NULL;
791# if !defined(__SVR4) && !defined(__svr4__)
792# ifdef __sgi
793 char hbuf[(0xf << 2) + sizeof(struct icmp) + sizeof(ip_t) + 8];
793 char hbuf[128];
794# endif
795 int up;
796
797# ifdef M_CANFASTFWD
798 /*
799 * XXX For now, IP Filter and fast-forwarding of cached flows
800 * XXX are mutually exclusive. Eventually, IP Filter should
801 * XXX get a "can-fast-forward" filter rule.

--- 8 unchanged lines hidden (view full) ---

810 in_delayed_cksum(m);
811 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
812 }
813# endif /* CSUM_DELAY_DATA */
814
815# ifdef USE_INET6
816 if (v == 6) {
817 len = ntohs(((ip6_t*)ip)->ip6_plen);
794# endif
795 int up;
796
797# ifdef M_CANFASTFWD
798 /*
799 * XXX For now, IP Filter and fast-forwarding of cached flows
800 * XXX are mutually exclusive. Eventually, IP Filter should
801 * XXX get a "can-fast-forward" filter rule.

--- 8 unchanged lines hidden (view full) ---

810 in_delayed_cksum(m);
811 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
812 }
813# endif /* CSUM_DELAY_DATA */
814
815# ifdef USE_INET6
816 if (v == 6) {
817 len = ntohs(((ip6_t*)ip)->ip6_plen);
818 if (!len)
819 return -1; /* potential jumbo gram */
820 len += sizeof(ip6_t);
818 p = ((ip6_t *)ip)->ip6_nxt;
819 } else
820# endif
821 {
822 p = ip->ip_p;
823 len = ip->ip_len;
824 }
825
821 p = ((ip6_t *)ip)->ip6_nxt;
822 } else
823# endif
824 {
825 p = ip->ip_p;
826 len = ip->ip_len;
827 }
828
826 if ((p == IPPROTO_TCP || p == IPPROTO_UDP || p == IPPROTO_ICMP
829 if ((p == IPPROTO_TCP || p == IPPROTO_UDP ||
830 (v == 4 && p == IPPROTO_ICMP)
827# ifdef USE_INET6
828 || (v == 6 && p == IPPROTO_ICMPV6)
829# endif
830 )) {
831 int plen = 0;
832
833 if ((v == 6) || (ip->ip_off & IP_OFFMASK) == 0)
834 switch(p)

--- 105 unchanged lines hidden (view full) ---

940# endif
941# if !SOLARIS
942 m_freem(m);
943# endif
944 return error;
945 }
946#endif
947 pass = fr_pass;
831# ifdef USE_INET6
832 || (v == 6 && p == IPPROTO_ICMPV6)
833# endif
834 )) {
835 int plen = 0;
836
837 if ((v == 6) || (ip->ip_off & IP_OFFMASK) == 0)
838 switch(p)

--- 105 unchanged lines hidden (view full) ---

944# endif
945# if !SOLARIS
946 m_freem(m);
947# endif
948 return error;
949 }
950#endif
951 pass = fr_pass;
948 if (fin->fin_fi.fi_fl & FI_SHORT) {
952 if (fin->fin_fl & FI_SHORT) {
949 ATOMIC_INCL(frstats[out].fr_short);
950 }
951
952 READ_ENTER(&ipf_mutex);
953
953 ATOMIC_INCL(frstats[out].fr_short);
954 }
955
956 READ_ENTER(&ipf_mutex);
957
954 if (fin->fin_fi.fi_fl & FI_SHORT)
955 ATOMIC_INCL(frstats[out].fr_short);
956
957 /*
958 * Check auth now. This, combined with the check below to see if apass
959 * is 0 is to ensure that we don't count the packet twice, which can
960 * otherwise occur when we reprocess it. As it is, we only count it
961 * after it has no auth. table matchup. This also stops NAT from
962 * occuring until after the packet has been auth'd.
963 */
964 apass = fr_checkauth(ip, fin);

--- 7 unchanged lines hidden (view full) ---

972 list = ipacct[0][fr_active];
973 changed = ip_natin(ip, fin);
974 if (!apass && (fin->fin_fr = list) &&
975 (fr_scanlist(FR_NOMATCH, ip, fin, m) & FR_ACCOUNT)) {
976 ATOMIC_INCL(frstats[0].fr_acct);
977 }
978 }
979
958 /*
959 * Check auth now. This, combined with the check below to see if apass
960 * is 0 is to ensure that we don't count the packet twice, which can
961 * otherwise occur when we reprocess it. As it is, we only count it
962 * after it has no auth. table matchup. This also stops NAT from
963 * occuring until after the packet has been auth'd.
964 */
965 apass = fr_checkauth(ip, fin);

--- 7 unchanged lines hidden (view full) ---

973 list = ipacct[0][fr_active];
974 changed = ip_natin(ip, fin);
975 if (!apass && (fin->fin_fr = list) &&
976 (fr_scanlist(FR_NOMATCH, ip, fin, m) & FR_ACCOUNT)) {
977 ATOMIC_INCL(frstats[0].fr_acct);
978 }
979 }
980
980 if (apass || (!(fr = ipfr_knownfrag(ip, fin)) &&
981 !(fr = fr_checkstate(ip, fin)))) {
981 if (!apass) {
982 if ((fin->fin_fl & FI_FRAG) == FI_FRAG)
983 fr = ipfr_knownfrag(ip, fin);
984 if (!fr && !(fin->fin_fl & FI_SHORT))
985 fr = fr_checkstate(ip, fin);
986 if (fr != NULL)
987 pass = fr->fr_flags;
988 if (fr && (pass & FR_LOGFIRST))
989 pass &= ~(FR_LOGFIRST|FR_LOG);
990 }
991
992 if (apass || !fr) {
982 /*
983 * If a packet is found in the auth table, then skip checking
984 * the access lists for permission but we do need to consider
985 * the result as if it were from the ACL's.
986 */
987 if (!apass) {
988 fc = frcache + out;
989 if (!bcmp((char *)fin, (char *)fc, FI_CSIZE)) {

--- 18 unchanged lines hidden (view full) ---

1008 pass = fr_scanlist(fr_pass, ip, fin, m);
1009 if (!(pass & (FR_KEEPSTATE|FR_DONTCACHE)))
1010 bcopy((char *)fin, (char *)fc,
1011 FI_COPYSIZE);
1012 if (pass & FR_NOMATCH) {
1013 ATOMIC_INCL(frstats[out].fr_nom);
1014 }
1015 }
993 /*
994 * If a packet is found in the auth table, then skip checking
995 * the access lists for permission but we do need to consider
996 * the result as if it were from the ACL's.
997 */
998 if (!apass) {
999 fc = frcache + out;
1000 if (!bcmp((char *)fin, (char *)fc, FI_CSIZE)) {

--- 18 unchanged lines hidden (view full) ---

1019 pass = fr_scanlist(fr_pass, ip, fin, m);
1020 if (!(pass & (FR_KEEPSTATE|FR_DONTCACHE)))
1021 bcopy((char *)fin, (char *)fc,
1022 FI_COPYSIZE);
1023 if (pass & FR_NOMATCH) {
1024 ATOMIC_INCL(frstats[out].fr_nom);
1025 }
1026 }
1016 fr = fin->fin_fr;
1017 } else
1018 pass = apass;
1027 } else
1028 pass = apass;
1029 fr = fin->fin_fr;
1019
1020 /*
1021 * If we fail to add a packet to the authorization queue,
1022 * then we drop the packet later. However, if it was added
1023 * then pretend we've dropped it already.
1024 */
1030
1031 /*
1032 * If we fail to add a packet to the authorization queue,
1033 * then we drop the packet later. However, if it was added
1034 * then pretend we've dropped it already.
1035 */
1025 if ((pass & FR_AUTH))
1026 if (fr_newauth((mb_t *)m, fin, ip) != 0)
1036 if ((pass & FR_AUTH)) {
1037 if (fr_newauth((mb_t *)m, fin, ip) != 0) {
1027#ifdef _KERNEL
1028 m = *mp = NULL;
1029#else
1030 ;
1031#endif
1038#ifdef _KERNEL
1039 m = *mp = NULL;
1040#else
1041 ;
1042#endif
1043 error = 0;
1044 } else
1045 error = ENOSPC;
1046 }
1032
1033 if (pass & FR_PREAUTH) {
1034 READ_ENTER(&ipf_auth);
1035 if ((fin->fin_fr = ipauth) &&
1036 (pass = fr_scanlist(0, ip, fin, m))) {
1037 ATOMIC_INCL(fr_authstats.fas_hits);
1038 } else {
1039 ATOMIC_INCL(fr_authstats.fas_miss);
1040 }
1041 RWLOCK_EXIT(&ipf_auth);
1042 }
1043
1044 fin->fin_fr = fr;
1045 if ((pass & (FR_KEEPFRAG|FR_KEEPSTATE)) == FR_KEEPFRAG) {
1047
1048 if (pass & FR_PREAUTH) {
1049 READ_ENTER(&ipf_auth);
1050 if ((fin->fin_fr = ipauth) &&
1051 (pass = fr_scanlist(0, ip, fin, m))) {
1052 ATOMIC_INCL(fr_authstats.fas_hits);
1053 } else {
1054 ATOMIC_INCL(fr_authstats.fas_miss);
1055 }
1056 RWLOCK_EXIT(&ipf_auth);
1057 }
1058
1059 fin->fin_fr = fr;
1060 if ((pass & (FR_KEEPFRAG|FR_KEEPSTATE)) == FR_KEEPFRAG) {
1046 if (fin->fin_fi.fi_fl & FI_FRAG) {
1061 if (fin->fin_fl & FI_FRAG) {
1047 if (ipfr_newfrag(ip, fin, pass) == -1) {
1048 ATOMIC_INCL(frstats[out].fr_bnfr);
1049 } else {
1050 ATOMIC_INCL(frstats[out].fr_nfr);
1051 }
1052 } else {
1053 ATOMIC_INCL(frstats[out].fr_cfr);
1054 }

--- 107 unchanged lines hidden (view full) ---

1162
1163 if ((pass & FR_RETMASK) == FR_FAKEICMP)
1164 dst = 1;
1165 else
1166 dst = 0;
1167 send_icmp_err(ip, ICMP_UNREACH, fin, dst);
1168 ATOMIC_INCL(frstats[0].fr_ret);
1169 } else if (((pass & FR_RETMASK) == FR_RETRST) &&
1062 if (ipfr_newfrag(ip, fin, pass) == -1) {
1063 ATOMIC_INCL(frstats[out].fr_bnfr);
1064 } else {
1065 ATOMIC_INCL(frstats[out].fr_nfr);
1066 }
1067 } else {
1068 ATOMIC_INCL(frstats[out].fr_cfr);
1069 }

--- 107 unchanged lines hidden (view full) ---

1177
1178 if ((pass & FR_RETMASK) == FR_FAKEICMP)
1179 dst = 1;
1180 else
1181 dst = 0;
1182 send_icmp_err(ip, ICMP_UNREACH, fin, dst);
1183 ATOMIC_INCL(frstats[0].fr_ret);
1184 } else if (((pass & FR_RETMASK) == FR_RETRST) &&
1170 !(fin->fin_fi.fi_fl & FI_SHORT)) {
1185 !(fin->fin_fl & FI_SHORT)) {
1171 if (send_reset(ip, fin) == 0) {
1172 ATOMIC_INCL(frstats[1].fr_ret);
1173 }
1174 }
1175#else
1176 if ((pass & FR_RETMASK) == FR_RETICMP) {
1177 verbose("- ICMP unreachable sent\n");
1178 ATOMIC_INCL(frstats[0].fr_ret);
1179 } else if ((pass & FR_RETMASK) == FR_FAKEICMP) {
1180 verbose("- forged ICMP unreachable sent\n");
1181 ATOMIC_INCL(frstats[0].fr_ret);
1182 } else if (((pass & FR_RETMASK) == FR_RETRST) &&
1186 if (send_reset(ip, fin) == 0) {
1187 ATOMIC_INCL(frstats[1].fr_ret);
1188 }
1189 }
1190#else
1191 if ((pass & FR_RETMASK) == FR_RETICMP) {
1192 verbose("- ICMP unreachable sent\n");
1193 ATOMIC_INCL(frstats[0].fr_ret);
1194 } else if ((pass & FR_RETMASK) == FR_FAKEICMP) {
1195 verbose("- forged ICMP unreachable sent\n");
1196 ATOMIC_INCL(frstats[0].fr_ret);
1197 } else if (((pass & FR_RETMASK) == FR_RETRST) &&
1183 !(fin->fin_fi.fi_fl & FI_SHORT)) {
1198 !(fin->fin_fl & FI_SHORT)) {
1184 verbose("- TCP RST sent\n");
1185 ATOMIC_INCL(frstats[1].fr_ret);
1186 }
1187#endif
1188 } else {
1189 if (pass & FR_RETRST)
1190 error = ECONNRESET;
1191 }

--- 12 unchanged lines hidden (view full) ---

1204 }
1205#if defined(_KERNEL)
1206# if !SOLARIS
1207# if !defined(linux)
1208 if (fr) {
1209 frdest_t *fdp = &fr->fr_tif;
1210
1211 if (((pass & FR_FASTROUTE) && !out) ||
1199 verbose("- TCP RST sent\n");
1200 ATOMIC_INCL(frstats[1].fr_ret);
1201 }
1202#endif
1203 } else {
1204 if (pass & FR_RETRST)
1205 error = ECONNRESET;
1206 }

--- 12 unchanged lines hidden (view full) ---

1219 }
1220#if defined(_KERNEL)
1221# if !SOLARIS
1222# if !defined(linux)
1223 if (fr) {
1224 frdest_t *fdp = &fr->fr_tif;
1225
1226 if (((pass & FR_FASTROUTE) && !out) ||
1212 (fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1)) {
1213 if (ipfr_fastroute(m, fin, fdp) == 0)
1214 m = *mp = NULL;
1215 }
1216 if (mc)
1217 ipfr_fastroute(mc, fin, &fr->fr_dif);
1227 (fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1))
1228 (void) ipfr_fastroute(m, mp, fin, fdp);
1229
1230 if (mc != NULL)
1231 (void) ipfr_fastroute(mc, &mc, fin, &fr->fr_dif);
1218 }
1232 }
1219 if (!(pass & FR_PASS) && m)
1233
1234 if (!(pass & FR_PASS) && m) {
1220 m_freem(m);
1235 m_freem(m);
1236 m = *mp = NULL;
1237 }
1221# ifdef __sgi
1222 else if (changed && up && m)
1223 m_copyback(m, 0, up, hbuf);
1224# endif
1225# endif /* !linux */
1226# else /* !SOLARIS */
1227 if (fr) {
1228 frdest_t *fdp = &fr->fr_tif;
1229
1230 if (((pass & FR_FASTROUTE) && !out) ||
1238# ifdef __sgi
1239 else if (changed && up && m)
1240 m_copyback(m, 0, up, hbuf);
1241# endif
1242# endif /* !linux */
1243# else /* !SOLARIS */
1244 if (fr) {
1245 frdest_t *fdp = &fr->fr_tif;
1246
1247 if (((pass & FR_FASTROUTE) && !out) ||
1231 (fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1)) {
1232 if (ipfr_fastroute(ip, m, mp, fin, fdp) == 0)
1233 m = *mp = NULL;
1234 }
1235 if (mc)
1236 ipfr_fastroute(ip, mc, mp, fin, &fr->fr_dif);
1248 (fdp->fd_ifp && fdp->fd_ifp != (struct ifnet *)-1))
1249 (void) ipfr_fastroute(ip, m, mp, fin, fdp);
1250
1251 if (mc != NULL)
1252 (void) ipfr_fastroute(ip, mc, &mc, fin, &fr->fr_dif);
1237 }
1238# endif /* !SOLARIS */
1239 return (pass & FR_PASS) ? 0 : error;
1240#else /* _KERNEL */
1241 if (pass & FR_NOMATCH)
1242 return 1;
1243 if (pass & FR_PASS)
1244 return 0;

--- 215 unchanged lines hidden (view full) ---

1460 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
1461 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
1462 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
1463 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
1464 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
1465 * SUCH DAMAGE.
1466 *
1467 * @(#)uipc_mbuf.c 8.2 (Berkeley) 1/4/94
1253 }
1254# endif /* !SOLARIS */
1255 return (pass & FR_PASS) ? 0 : error;
1256#else /* _KERNEL */
1257 if (pass & FR_NOMATCH)
1258 return 1;
1259 if (pass & FR_PASS)
1260 return 0;

--- 215 unchanged lines hidden (view full) ---

1476 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
1477 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
1478 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
1479 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
1480 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
1481 * SUCH DAMAGE.
1482 *
1483 * @(#)uipc_mbuf.c 8.2 (Berkeley) 1/4/94
1468 * $Id: fil.c,v 2.35.2.30 2000/12/17 05:49:22 darrenr Exp $
1484 * $Id: fil.c,v 2.35.2.39 2001/07/18 13:30:32 darrenr Exp $
1469 */
1470/*
1471 * Copy data from an mbuf chain starting "off" bytes from the beginning,
1472 * continuing for "len" bytes, into the indicated buffer.
1473 */
1474void
1475m_copydata(m, off, len, cp)
1476 register mb_t *m;

--- 432 unchanged lines hidden (view full) ---

1909# else
1910 for (ifp = ifnet; ifp; ifp = ifp->if_next)
1911# endif
1912 {
1913 ip_natsync(ifp);
1914 ip_statesync(ifp);
1915 }
1916 ip_natsync((struct ifnet *)-1);
1485 */
1486/*
1487 * Copy data from an mbuf chain starting "off" bytes from the beginning,
1488 * continuing for "len" bytes, into the indicated buffer.
1489 */
1490void
1491m_copydata(m, off, len, cp)
1492 register mb_t *m;

--- 432 unchanged lines hidden (view full) ---

1925# else
1926 for (ifp = ifnet; ifp; ifp = ifp->if_next)
1927# endif
1928 {
1929 ip_natsync(ifp);
1930 ip_statesync(ifp);
1931 }
1932 ip_natsync((struct ifnet *)-1);
1917# endif
1933# endif /* !SOLARIS */
1918
1919 WRITE_ENTER(&ipf_mutex);
1920 frsynclist(ipacct[0][fr_active]);
1921 frsynclist(ipacct[1][fr_active]);
1922 frsynclist(ipfilter[0][fr_active]);
1923 frsynclist(ipfilter[1][fr_active]);
1924#ifdef USE_INET6
1925 frsynclist(ipacct6[0][fr_active]);

--- 207 unchanged lines hidden --- 		1934
1935 WRITE_ENTER(&ipf_mutex);
1936 frsynclist(ipacct[0][fr_active]);
1937 frsynclist(ipacct[1][fr_active]);
1938 frsynclist(ipfilter[0][fr_active]);
1939 frsynclist(ipfilter[1][fr_active]);
1940#ifdef USE_INET6
1941 frsynclist(ipacct6[0][fr_active]);

--- 207 unchanged lines hidden ---