inet/ipf/fil.c

1843 /*              pass(I) - default result to return for filtering            */
1855 int fr_scanlist(fin, pass)
1857 u_32_t pass;
1868 		return pass;
1876 		return pass;
1908 		FR_VERBOSE(("%c", FR_ISSKIP(pass) ? 's' :
1909 				  FR_ISPASS(pass) ? 'p' :
1910 				  FR_ISACCOUNT(pass) ? 'A' :
1911 				  FR_ISAUTH(pass) ? 'a' :
1912 				  (pass & FR_NOMATCH) ? 'n' :'b'));
1945 			f = (*fr->fr_func)(fin, &pass);
2018 		passo = pass;
2022 			pass = passt;
2025 		FR_DEBUG(("pass %#x\n", pass));
2030 			pass = fr_scanlist(fin, pass);
2041 		if (pass & FR_QUICK) {
2049 			if ((pass & FR_KEEPSTATE) &&
2057 					pass = passo;
2067 	return pass;
2089 	u_32_t pass, rulen;
2105 		pass = fr_scanlist(fin, FR_NOMATCH);
2106 		if (FR_ISACCOUNT(pass)) {
2136 	u_32_t pass;
2141 	pass = *passp;
2155 		if ((pass & FR_NOMATCH)) {
2175 			pass = fr->fr_flags;
2180 		pass = fr_scanlist(fin, ifs->ifs_fr_pass);
2182 		if (((pass & FR_KEEPSTATE) == 0) &&
2192 	if ((pass & FR_NOMATCH)) {
2201 		pass &= ~(FR_CMDMASK|FR_DUP|FR_RETICMP|FR_RETRST);
2202 		pass |= FR_BLOCK;
2211 	if (FR_ISAUTH(pass)) {
2224 	    (fr->fr_func != (ipfunc_t)-1) && !(pass & FR_CALLNOW))
2225 		(void) (*fr->fr_func)(fin, &pass);
2231 	 * is treated as "not a pass", hence the packet is blocked.
2233 	if (FR_ISPREAUTH(pass)) {
2235 			pass = fr_scanlist(fin, ifs->ifs_fr_pass);
2242 	if ((pass & (FR_KEEPFRAG|FR_KEEPSTATE)) == FR_KEEPFRAG) {
2244 			if (fr_newfrag(fin, pass) == -1) {
2257 	if ((pass & FR_KEEPSTATE) && !(fin->fin_flx & FI_STATE)) {
2262 			if (FR_ISPASS(pass)) {
2263 				pass &= ~FR_CMDMASK;
2264 				pass |= FR_BLOCK;
2272 		*passp = pass;
2326 	u_32_t pass;
2341 	pass = ifs->ifs_fr_pass;
2435 			pass = FR_BLOCK|FR_NOMATCH;
2451 		pass = FR_BLOCK;
2505 	fr = fr_checkauth(fin, &pass);
2510 			if (fr_checknatin(fin, &pass) == -1) {
2517 			if (fr_checknat6in(fin, &pass) == -1) {
2532 			fr = fr_knownfrag(fin, &pass);
2534 		fr = fr_checkstate(fin, &pass);
2536 	if ((pass & FR_NOMATCH) || (fr == NULL))
2537 		fr = fr_firewall(fin, &pass);
2545 	if (out && FR_ISPASS(pass)) {
2551 			if (fr_checknatout(fin, &pass) == -1) {
2558 			if (fr_checknat6out(fin, &pass) == -1) {
2571 				pass &= ~FR_CMDMASK;
2572 				pass |= FR_BLOCK;
2580 	if ((ifs->ifs_fr_flags & FF_LOGGING) || (pass & FR_LOGMASK)) {
2581 		(void) fr_dolog(fin, &pass);
2599 	if ((fr != NULL) && (pass & FR_DUP)) {
2612 	if ((pass & (FR_RETRST|FR_RETICMP)) && ((fin->fin_flx & FI_OOW) == 0)) {
2622 			if (pass & FR_RETICMP) {
2625 				if ((pass & FR_RETMASK) == FR_FAKEICMP)
2632 				 * 	pass return-icmp in proto udp ...
2638 				    FR_ISBLOCK(pass)) {
2664 			} else if (((pass & FR_RETMASK) == FR_RETRST) &&
2670 				 * 	pass return-rst in proto tcp ...
2676 				    FR_ISBLOCK(pass)) {
2702 			if (pass & FR_RETRST)
2723 		if (!out && (pass & FR_FASTROUTE)) {
2726 			 * so pass NULL as the frdest_t parameter
2755 	if (FR_ISBLOCK(pass) && (fin->fin_flx & FI_NEWNAT))
2764 	if (!FR_ISPASS(pass)) {
2784 	if (FR_ISPASS(pass) && (v == 4)) {
2790 	return (FR_ISPASS(pass)) ? 0 : fin->fin_error;
2792 	FR_VERBOSE(("fin_flx %#x pass %#x ", fin->fin_flx, pass));
2793 	if ((pass & FR_NOMATCH) != 0)
2796 	if ((pass & FR_RETMASK) != 0)
2797 		switch (pass & FR_RETMASK)
2807 	switch (pass & FR_CMDMASK)
2839 	u_32_t pass;
2844 	pass = *passp;
2846 	if ((ifs->ifs_fr_flags & FF_LOGNOMATCH) && (pass & FR_NOMATCH)) {
2847 		pass |= FF_LOGNOMATCH;
2850 	} else if (((pass & FR_LOGMASK) == FR_LOGP) ||
2851 	    (FR_ISPASS(pass) && (ifs->ifs_fr_flags & FF_LOGPASS))) {
2852 		if ((pass & FR_LOGMASK) != FR_LOGP)
2853 			pass |= FF_LOGPASS;
2856 	} else if (((pass & FR_LOGMASK) == FR_LOGB) ||
2857 		   (FR_ISBLOCK(pass) && (ifs->ifs_fr_flags & FF_LOGBLOCK))) {
2858 		if ((pass & FR_LOGMASK) != FR_LOGB)
2859 			pass |= FF_LOGBLOCK;
2862 		if (ipflog(fin, pass) == -1) {
2869 			if ((pass & FR_LOGORBLOCK) &&
2870 			    FR_ISPASS(pass)) {
2871 				pass &= ~FR_CMDMASK;
2872 				pass |= FR_BLOCK;
2875 		*passp = pass;