bsd/net/pf.c

2322     struct tcphdr *th, struct pf_state_peer *dst)
2324 	int hlen = (th->th_off << 2) - sizeof (*th), thoptlen = hlen;
2331 	    !pf_pull_hdr(m, off + sizeof (*th), opts, hlen, NULL, NULL, pd->af))
2349 					pf_change_a(&sack.start, &th->th_sum,
2352 					pf_change_a(&sack.end, &th->th_sum,
2357 				copyback = off + sizeof (*th) + thoptlen;
2372 		m_copyback(m, off + sizeof (*th), thoptlen, opts);
2393 	struct tcphdr	*th = NULL;
2478 		th = (struct tcphdr *)(void *)((caddr_t)h + sizeof (struct ip));
2491 		th = (struct tcphdr *)(void *)
2498 	th->th_sport = sport;
2499 	th->th_dport = dport;
2500 	th->th_seq = htonl(seq);
2501 	th->th_ack = htonl(ack);
2502 	th->th_off = tlen >> 2;
2503 	th->th_flags = flags;
2504 	th->th_win = htons(win);
2507 		opt = (char *)(th + 1);
2522 		th->th_sum = in_cksum(m, len);
2547 		th->th_sum = in6_cksum(m, IPPROTO_TCP,
4061 	struct tcphdr		*th = pd->hdr.tcp;
4090 		sxport.port = th->th_sport;
4091 		dxport.port = th->th_dport;
4092 		hdrlen = sizeof (*th);
4158 				    &th->th_sport, pd->ip_sum, &th->th_sum,
4160 				sxport.port = th->th_sport;
4256 				    &th->th_dport, pd->ip_sum, &th->th_sum,
4258 				dxport.port = th->th_dport;
4365 		    th->th_sport))
4376 		    th->th_dport))
4396 		    (r->flagset & th->th_flags) != r->flags)
4416 		    pf_osfp_fingerprint(pd, m, off, th),
4473 					    &th->th_sport, pd->ip_sum,
4474 					    &th->th_sum, &pd->baddr,
4476 					sxport.port = th->th_sport;
4546 					    &th->th_dport, pd->ip_sum,
4547 					    &th->th_sum, &pd->baddr,
4549 					dxport.port = th->th_dport;
4623 		    !(th->th_flags & TH_RST)) {
4624 			u_int32_t	 ack = ntohl(th->th_seq) + pd->p_len;
4648 				if (th->th_flags & TH_SYN)
4650 				if (th->th_flags & TH_FIN)
4653 				    pd->src, th->th_dport, th->th_sport,
4654 				    ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0,
4873 			s->src.seqlo = ntohl(th->th_seq);
4875 			if ((th->th_flags & (TH_SYN|TH_ACK)) ==
4881 				pf_change_a(&th->th_seq, &th->th_sum,
4883 				rewrite = off + sizeof (*th);
4886 			if (th->th_flags & TH_SYN) {
4889 				    th->th_off, af);
4891 			s->src.max_win = MAX(ntohs(th->th_win), 1);
4899 			if (th->th_flags & TH_FIN)
4950 			    pf_normalize_tcp_init(m, off, pd, th, &s->src,
4960 			    th, s, &s->src, &s->dst, &rewrite)) {
5058 		    (th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN &&
5064 					    &th->th_sport, pd->ip_sum,
5065 					    &th->th_sum, &pd->baddr,
5067 					sxport.port = th->th_sport;
5070 					    &th->th_dport, pd->ip_sum,
5071 					    &th->th_sum, &pd->baddr,
5073 					sxport.port = th->th_dport;
5078 			mss = pf_get_mss(m, off, th->th_off, af);
5082 			pf_send_tcp(r, af, daddr, saddr, th->th_dport,
5083 			    th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1,
5094 				offx += th->th_off << 2;
5152 	struct tcphdr		*th = pd->hdr.tcp;
5183 			hdrlen = sizeof (*th);
5239 		    th->th_sport)))))
5251 		    th->th_dport)))
5269 		    (r->flagset & th->th_flags) != r->flags))
5503 	struct tcphdr *th;
5733 	th = pd->hdr.tcp;
5738 			th->th_sum = pf_cksum_fixup(th->th_sum,
5742 			th->th_sum = pf_cksum_fixup(th->th_sum,
5851 	struct tcphdr		*th = pd->hdr.tcp;
5852 	u_int16_t		 win = ntohs(th->th_win);
5865 		key.ext.xport.port = th->th_sport;
5866 		key.gwy.xport.port = th->th_dport;
5870 		key.lan.xport.port = th->th_sport;
5871 		key.ext.xport.port = th->th_dport;
5889 		if (th->th_flags & TH_SYN) {
5890 			if (ntohl(th->th_seq) != (*state)->src.seqlo) {
5895 			    pd->src, th->th_dport, th->th_sport,
5896 			    (*state)->src.seqhi, ntohl(th->th_seq) + 1,
5901 		} else if (!(th->th_flags & TH_ACK) ||
5902 		    (ntohl(th->th_ack) != (*state)->src.seqhi + 1) ||
5903 		    (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) {
5924 			if (((th->th_flags & (TH_SYN|TH_ACK)) != TH_ACK) ||
5925 			    (ntohl(th->th_ack) != (*state)->src.seqhi + 1) ||
5926 			    (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) {
5930 			(*state)->src.max_win = MAX(ntohs(th->th_win), 1);
5939 		} else if (((th->th_flags & (TH_SYN|TH_ACK)) !=
5941 		    (ntohl(th->th_ack) != (*state)->dst.seqhi + 1)) {
5945 			(*state)->dst.max_win = MAX(ntohs(th->th_win), 1);
5946 			(*state)->dst.seqlo = ntohl(th->th_seq);
5948 			    pd->src, th->th_dport, th->th_sport,
5949 			    ntohl(th->th_ack), ntohl(th->th_seq) + 1,
5973 	if (((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN) &&
5979 			pf_print_flags(th->th_flags);
5989 	if ((th->th_flags & TH_SYN) == 0) {
6004 	orig_seq = seq = ntohl(th->th_seq);
6010 			if (pf_normalize_tcp_init(m, off, pd, th, src, dst)) {
6021 			ack = ntohl(th->th_ack) - dst->seqdiff;
6022 			pf_change_a(&th->th_seq, &th->th_sum, htonl(seq +
6024 			pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0);
6025 			copyback = off + sizeof (*th);
6027 			ack = ntohl(th->th_ack);
6031 		if (th->th_flags & TH_SYN) {
6034 				src->wscale = pf_get_wscale(m, off, th->th_off,
6065 		if (th->th_flags & TH_FIN)
6085 		ack = ntohl(th->th_ack) - dst->seqdiff;
6088 			pf_change_a(&th->th_seq, &th->th_sum, htonl(seq +
6090 			pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0);
6091 			copyback = off+ sizeof (*th);
6094 		if (th->th_flags & TH_SYN)
6096 		if (th->th_flags & TH_FIN)
6100 	if ((th->th_flags & TH_ACK) == 0) {
6104 	    (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) ||
6135 	if (dst->seqdiff && (th->th_off << 2) > (int)sizeof (struct tcphdr)) {
6136 		copyback = pf_modulate_sack(m, off, pd, th, dst);
6155 	    ((th->th_flags & TH_RST) == 0 || orig_seq == src->seqlo ||
6161 			if (pf_normalize_tcp_stateful(m, off, pd, reason, th,
6179 		if (th->th_flags & TH_SYN)
6182 		if (th->th_flags & TH_FIN)
6185 		if (th->th_flags & TH_ACK) {
6197 		if (th->th_flags & TH_RST)
6250 			pf_print_flags(th->th_flags);
6261 			if (pf_normalize_tcp_stateful(m, off, pd, reason, th,
6282 		if (th->th_flags & TH_FIN)
6285 		if (th->th_flags & TH_RST)
6294 			if (!(th->th_flags & TH_RST))
6296 				    pd->dst, pd->src, th->th_dport,
6297 				    th->th_sport, ntohl(th->th_ack), 0,
6307 			pf_print_flags(th->th_flags);
6335 		    off + (th->th_off << 2), pd, kif);
6346 			pf_change_ap(direction, pd->mp, pd->src, &th->th_sport,
6347 			    pd->ip_sum, &th->th_sum,
6351 			pf_change_ap(direction, pd->mp, pd->dst, &th->th_dport,
6352 			    pd->ip_sum, &th->th_sum,
6355 		copyback = off + sizeof (*th);
6366 		m_copyback(m, off, sizeof (*th), th);
6779 			struct tcphdr		 th;
6790 			if (!pf_pull_hdr(m, off2, &th, 8, NULL, reason,
6803 				key.ext.xport.port = th.th_dport;
6804 				key.gwy.xport.port = th.th_sport;
6808 				key.lan.xport.port = th.th_dport;
6809 				key.ext.xport.port = th.th_sport;
6828 			seq = ntohl(th.th_seq) - src->seqdiff;
6830 				pf_change_a(&th.th_seq, icmpsum,
6854 					pf_change_icmp(pd2.src, &th.th_sport,
6860 					pf_change_icmp(pd2.dst, &th.th_dport,
6892 				m_copyback(m, off2, 8, &th);
8217 		struct tcphdr	th;
8218 		pd.hdr.tcp = &th;
8219 		if (!pf_pull_hdr(m, off, &th, sizeof (th),
8224 		pd.p_len = pd.tot_len - off - (th.th_off << 2);
8225 		if ((th.th_flags & TH_ACK) && pd.p_len == 0)
8808 		struct tcphdr	th;
8810 		pd.hdr.tcp = &th;
8811 		if (!pf_pull_hdr(m, off, &th, sizeof (th),
8816 		pd.p_len = pd.tot_len - off - (th.th_off << 2);