netpfil/pf/pf.c

2618 	struct mbuf *m0;
2626 	if ((m0 = m_copypacket(m, M_NOWAIT)) == NULL) {
2631 	if ((pf_mtag = pf_get_mtag(m0)) == NULL) {
2636 	m0->m_flags |= M_SKIP_FIREWALL;
2639 		M_SETFIB(m0, r->rtableid);
2645 		pf_mtag->hdr = mtod(m0, struct ip *);
2661 	pfse->pfse_m = m0;
5483 	struct mbuf		*m0, *m1;
5499 		m0 = *m;
5505 		if ((m0 = m_dup(*m, M_NOWAIT)) == NULL) {
5516 		m0 = *m;
5519 	ip = mtod(m0, struct ip *);
5532 		if (fib4_lookup_nh_basic(M_GETFIB(m0), ip->ip_dst, 0,
5533 		    m0->m_pkthdr.flowid, &nh4) != 0) {
5568 		if (pf_test(PF_OUT, 0, ifp, &m0, inp) != PF_PASS)
5570 		else if (m0 == NULL)
5572 		if (m0->m_len < sizeof(struct ip)) {
5574 			    ("%s: m0->m_len < sizeof(struct ip)\n", __func__));
5577 		ip = mtod(m0, struct ip *);
5581 		m0->m_flags |= M_SKIP_FIREWALL;
5587 	m0->m_pkthdr.csum_flags |= CSUM_IP;
5588 	if (m0->m_pkthdr.csum_flags & CSUM_DELAY_DATA & ~ifp->if_hwassist) {
5589 		in_delayed_cksum(m0);
5590 		m0->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
5593 	if (m0->m_pkthdr.csum_flags & CSUM_SCTP & ~ifp->if_hwassist) {
5595 		m0->m_pkthdr.csum_flags &= ~CSUM_SCTP;
5604 	    (m0->m_pkthdr.csum_flags & ifp->if_hwassist & CSUM_TSO) != 0) {
5606 		if (m0->m_pkthdr.csum_flags & CSUM_IP & ~ifp->if_hwassist) {
5607 			ip->ip_sum = in_cksum(m0, ip->ip_hl << 2);
5608 			m0->m_pkthdr.csum_flags &= ~CSUM_IP;
5610 		m_clrprotoflags(m0);	/* Avoid confusing lower layers. */
5611 		error = (*ifp->if_output)(ifp, m0, sintosa(&dst), NULL);
5616 	if ((ip_off & IP_DF) || (m0->m_pkthdr.csum_flags & CSUM_TSO)) {
5620 			icmp_error(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 0,
5627 	error = ip_fragment(ip, &m0, ifp->if_mtu, ifp->if_hwassist);
5631 	for (; m0; m0 = m1) {
5632 		m1 = m0->m_nextpkt;
5633 		m0->m_nextpkt = NULL;
5635 			m_clrprotoflags(m0);
5636 			error = (*ifp->if_output)(ifp, m0, sintosa(&dst), NULL);
5638 			m_freem(m0);
5653 	m_freem(m0);
5663 	struct mbuf		*m0;
5677 		m0 = *m;
5683 		if ((m0 = m_dup(*m, M_NOWAIT)) == NULL) {
5694 		m0 = *m;
5697 	ip6 = mtod(m0, struct ip6_hdr *);
5708 		m0->m_flags |= M_SKIP_FIREWALL;
5709 		ip6_output(m0, NULL, NULL, 0, NULL, NULL, NULL);
5742 		if (pf_test6(PF_OUT, PFIL_FWD, ifp, &m0, inp) != PF_PASS)
5744 		else if (m0 == NULL)
5746 		if (m0->m_len < sizeof(struct ip6_hdr)) {
5748 			    ("%s: m0->m_len < sizeof(struct ip6_hdr)\n",
5752 		ip6 = mtod(m0, struct ip6_hdr *);
5756 		m0->m_flags |= M_SKIP_FIREWALL;
5758 	if (m0->m_pkthdr.csum_flags & CSUM_DELAY_DATA_IPV6 &
5760 		uint32_t plen = m0->m_pkthdr.len - sizeof(*ip6);
5761 		in6_delayed_cksum(m0, plen, sizeof(struct ip6_hdr));
5762 		m0->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6;
5771 	if ((u_long)m0->m_pkthdr.len <= ifp->if_mtu)
5772 		nd6_output_ifp(ifp, ifp, m0, &dst, NULL);
5776 			icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu);
5790 	m_freem(m0);
5932 pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp)
5936 	struct mbuf		*m = *m0;
5987 	} else if (pf_normalize_ip(m0, dir, kif, &reason, &pd) != PF_PASS) {
5992 	m = *m0;	/* pf_normalize messes with m0 */
6219 			ip_divert_ptr(*m0, dir ==  PF_IN ? DIR_IN : DIR_OUT);
6220 			*m0 = NULL;
6295 		m_freem(*m0);
6297 		*m0 = NULL;
6301 		m_freem(*m0);
6302 		*m0 = NULL;
6307 			pf_route(m0, r, dir, kif->pfik_ifp, s, &pd, inp);
6321 pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp)
6325 	struct mbuf		*m = *m0, *n = NULL;
6361 	if (pf_normalize_ip6(m0, dir, kif, &reason, &pd) != PF_PASS) {
6365 	m = *m0;	/* pf_normalize messes with m0 */
6692 		m_freem(*m0);
6694 		*m0 = NULL;
6698 		m_freem(*m0);
6699 		*m0 = NULL;
6704 			pf_route6(m0, r, dir, kif->pfik_ifp, s, &pd, inp);
6714 	if (action == PF_PASS && *m0 && (pflags & PFIL_FWD) &&
6716 		action = pf_refragment6(ifp, m0, mtag);