1287984Scy/* $FreeBSD: stable/10/sys/contrib/ipfilter/netinet/ip_state.c 328274 2018-01-23 04:01:48Z cy $ */ 2145522Sdarrenr 353642Sguido/* 4255332Scy * Copyright (C) 2012 by Darren Reed. 553642Sguido * 680482Sdarrenr * See the IPFILTER.LICENCE file for details on licencing. 7255332Scy * 8255332Scy * Copyright 2008 Sun Microsystems. 9255332Scy * 10255332Scy * $Id$ 1153642Sguido */ 12145522Sdarrenr#if defined(KERNEL) || defined(_KERNEL) 13145522Sdarrenr# undef KERNEL 14145522Sdarrenr# undef _KERNEL 15145522Sdarrenr# define KERNEL 1 16145522Sdarrenr# define _KERNEL 1 1792685Sdarrenr#endif 1853642Sguido#include <sys/errno.h> 1953642Sguido#include <sys/types.h> 2053642Sguido#include <sys/param.h> 2153642Sguido#include <sys/file.h> 2260854Sdarrenr#if defined(_KERNEL) && defined(__FreeBSD_version) && \ 2360854Sdarrenr (__FreeBSD_version >= 400000) && !defined(KLD_MODULE) 2460854Sdarrenr#include "opt_inet6.h" 2560854Sdarrenr#endif 26145522Sdarrenr#if !defined(_KERNEL) && !defined(__KERNEL__) 2753642Sguido# include <stdio.h> 2853642Sguido# include <stdlib.h> 2953642Sguido# include <string.h> 30145522Sdarrenr# define _KERNEL 31145522Sdarrenr# ifdef __OpenBSD__ 32145522Sdarrenrstruct file; 3353642Sguido# endif 34145522Sdarrenr# include <sys/uio.h> 35145522Sdarrenr# undef _KERNEL 3653642Sguido#endif 37145522Sdarrenr#if defined(_KERNEL) && (__FreeBSD_version >= 220000) 3853642Sguido# include <sys/filio.h> 3953642Sguido# include <sys/fcntl.h> 4053642Sguido#else 4153642Sguido# include <sys/ioctl.h> 4253642Sguido#endif 4353642Sguido#include <sys/time.h> 44145522Sdarrenr#if !defined(linux) 4553642Sguido# include <sys/protosw.h> 4653642Sguido#endif 4753642Sguido#include <sys/socket.h> 48145522Sdarrenr#if defined(_KERNEL) 4953642Sguido# include <sys/systm.h> 50145522Sdarrenr# if !defined(__SVR4) && !defined(__svr4__) 5153642Sguido# include <sys/mbuf.h> 5253642Sguido# endif 53145522Sdarrenr#endif 54145522Sdarrenr#if defined(__SVR4) || defined(__svr4__) 5553642Sguido# include <sys/filio.h> 5653642Sguido# include <sys/byteorder.h> 5753642Sguido# ifdef _KERNEL 5853642Sguido# include <sys/dditypes.h> 5953642Sguido# endif 6053642Sguido# include <sys/stream.h> 6153642Sguido# include <sys/kmem.h> 6253642Sguido#endif 6353642Sguido 6453642Sguido#include <net/if.h> 6553642Sguido#ifdef sun 6653642Sguido# include <net/af.h> 6753642Sguido#endif 6853642Sguido#include <netinet/in.h> 6953642Sguido#include <netinet/in_systm.h> 7053642Sguido#include <netinet/ip.h> 7153642Sguido#include <netinet/tcp.h> 72145522Sdarrenr#if !defined(__hpux) && !defined(linux) 7353642Sguido# include <netinet/tcp_fsm.h> 7453642Sguido#endif 7553642Sguido#include <netinet/udp.h> 7653642Sguido#include <netinet/ip_icmp.h> 77255332Scy#if !defined(_KERNEL) 78255332Scy# include "ipf.h" 79255332Scy#endif 8053642Sguido#include "netinet/ip_compat.h" 8153642Sguido#include "netinet/ip_fil.h" 8253642Sguido#include "netinet/ip_nat.h" 8353642Sguido#include "netinet/ip_frag.h" 8453642Sguido#include "netinet/ip_state.h" 85145522Sdarrenr#include "netinet/ip_proxy.h" 86255332Scy#include "netinet/ip_lookup.h" 87255332Scy#include "netinet/ip_dstlist.h" 88145522Sdarrenr#include "netinet/ip_sync.h" 8960854Sdarrenr#ifdef USE_INET6 9060854Sdarrenr#include <netinet/icmp6.h> 9160854Sdarrenr#endif 92255332Scy#if FREEBSD_GE_REV(300000) 9353642Sguido# include <sys/malloc.h> 94145522Sdarrenr# if defined(_KERNEL) && !defined(IPFILTER_LKM) 9553642Sguido# include <sys/libkern.h> 9653642Sguido# include <sys/systm.h> 9753642Sguido# endif 9853642Sguido#endif 99145522Sdarrenr/* END OF INCLUDES */ 10053642Sguido 101145522Sdarrenr 10280482Sdarrenr#if !defined(lint) 10380482Sdarrenrstatic const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed"; 104255332Scystatic const char rcsid[] = "@(#)$Id$"; 10580482Sdarrenr#endif 10680482Sdarrenr 10753642Sguido 108255332Scystatic ipftuneable_t ipf_state_tuneables[] = { 109255332Scy { { (void *)offsetof(ipf_state_softc_t, ipf_state_max) }, 110255332Scy "state_max", 1, 0x7fffffff, 111255332Scy stsizeof(ipf_state_softc_t, ipf_state_max), 112255332Scy 0, NULL, NULL }, 113255332Scy { { (void *)offsetof(ipf_state_softc_t, ipf_state_size) }, 114255332Scy "state_size", 1, 0x7fffffff, 115255332Scy stsizeof(ipf_state_softc_t, ipf_state_size), 116255332Scy 0, NULL, ipf_state_rehash }, 117255332Scy { { (void *)offsetof(ipf_state_softc_t, ipf_state_lock) }, 118255332Scy "state_lock", 0, 1, 119255332Scy stsizeof(ipf_state_softc_t, ipf_state_lock), 120255332Scy IPFT_RDONLY, NULL, NULL }, 121255332Scy { { (void *)offsetof(ipf_state_softc_t, ipf_state_maxbucket) }, 122255332Scy "state_maxbucket", 1, 0x7fffffff, 123255332Scy stsizeof(ipf_state_softc_t, ipf_state_maxbucket), 124255332Scy 0, NULL, NULL }, 125255332Scy { { (void *)offsetof(ipf_state_softc_t, ipf_state_logging) }, 126255332Scy "state_logging",0, 1, 127255332Scy stsizeof(ipf_state_softc_t, ipf_state_logging), 128255332Scy 0, NULL, NULL }, 129255332Scy { { (void *)offsetof(ipf_state_softc_t, ipf_state_wm_high) }, 130255332Scy "state_wm_high",2, 100, 131255332Scy stsizeof(ipf_state_softc_t, ipf_state_wm_high), 132255332Scy 0, NULL, NULL }, 133255332Scy { { (void *)offsetof(ipf_state_softc_t, ipf_state_wm_low) }, 134255332Scy "state_wm_low", 1, 99, 135255332Scy stsizeof(ipf_state_softc_t, ipf_state_wm_low), 136255332Scy 0, NULL, NULL }, 137255332Scy { { (void *)offsetof(ipf_state_softc_t, ipf_state_wm_freq) }, 138255332Scy "state_wm_freq",2, 999999, 139255332Scy stsizeof(ipf_state_softc_t, ipf_state_wm_freq), 140255332Scy 0, NULL, NULL }, 141255332Scy { { NULL }, 142255332Scy NULL, 0, 0, 143255332Scy 0, 144255332Scy 0, NULL, NULL } 145255332Scy}; 146255332Scy 147255332Scy#define SINCL(x) ATOMIC_INCL(softs->x) 148255332Scy#define SBUMP(x) (softs->x)++ 149255332Scy#define SBUMPD(x, y) do { (softs->x.y)++; DT(y); } while (0) 150255332Scy#define SBUMPDX(x, y, z)do { (softs->x.y)++; DT(z); } while (0) 151255332Scy 15260854Sdarrenr#ifdef USE_INET6 153255332Scystatic ipstate_t *ipf_checkicmp6matchingstate __P((fr_info_t *)); 15460854Sdarrenr#endif 155255332Scystatic int ipf_allowstateicmp __P((fr_info_t *, ipstate_t *, i6addr_t *)); 156255332Scystatic ipstate_t *ipf_matchsrcdst __P((fr_info_t *, ipstate_t *, i6addr_t *, 157145522Sdarrenr i6addr_t *, tcphdr_t *, u_32_t)); 158255332Scystatic ipstate_t *ipf_checkicmpmatchingstate __P((fr_info_t *)); 159255332Scystatic int ipf_state_flush_entry __P((ipf_main_softc_t *, void *)); 160255332Scystatic ips_stat_t *ipf_state_stats __P((ipf_main_softc_t *)); 161255332Scystatic int ipf_state_del __P((ipf_main_softc_t *, ipstate_t *, int)); 162255332Scystatic int ipf_state_remove __P((ipf_main_softc_t *, caddr_t)); 163255332Scystatic int ipf_state_match __P((ipstate_t *is1, ipstate_t *is2)); 164255332Scystatic int ipf_state_matchaddresses __P((ipstate_t *is1, ipstate_t *is2)); 165255332Scystatic int ipf_state_matchipv4addrs __P((ipstate_t *is1, ipstate_t *is2)); 166255332Scystatic int ipf_state_matchipv6addrs __P((ipstate_t *is1, ipstate_t *is2)); 167255332Scystatic int ipf_state_matchisps __P((ipstate_t *is1, ipstate_t *is2)); 168255332Scystatic int ipf_state_matchports __P((udpinfo_t *is1, udpinfo_t *is2)); 169255332Scystatic int ipf_state_matcharray __P((ipstate_t *, int *, u_long)); 170255332Scystatic void ipf_ipsmove __P((ipf_state_softc_t *, ipstate_t *, u_int)); 171255332Scystatic int ipf_state_tcp __P((ipf_main_softc_t *, ipf_state_softc_t *, 172255332Scy fr_info_t *, tcphdr_t *, ipstate_t *)); 173255332Scystatic int ipf_tcpoptions __P((ipf_state_softc_t *, fr_info_t *, 174255332Scy tcphdr_t *, tcpdata_t *)); 175255332Scystatic ipstate_t *ipf_state_clone __P((fr_info_t *, tcphdr_t *, ipstate_t *)); 176255332Scystatic void ipf_fixinisn __P((fr_info_t *, ipstate_t *)); 177255332Scystatic void ipf_fixoutisn __P((fr_info_t *, ipstate_t *)); 178255332Scystatic void ipf_checknewisn __P((fr_info_t *, ipstate_t *)); 179255332Scystatic int ipf_state_iter __P((ipf_main_softc_t *, ipftoken_t *, 180255332Scy ipfgeniter_t *, ipfobj_t *)); 181255332Scystatic int ipf_state_gettable __P((ipf_main_softc_t *, ipf_state_softc_t *, 182255332Scy char *)); 183255332Scystatic int ipf_state_tcpinwindow __P((struct fr_info *, struct tcpdata *, 184255332Scy struct tcpdata *, tcphdr_t *, int)); 185145522Sdarrenr 186255332Scystatic int ipf_state_getent __P((ipf_main_softc_t *, ipf_state_softc_t *, 187255332Scy caddr_t)); 188255332Scystatic int ipf_state_putent __P((ipf_main_softc_t *, ipf_state_softc_t *, 189255332Scy caddr_t)); 19053642Sguido 191145522Sdarrenr#define ONE_DAY IPF_TTLVAL(1 * 86400) /* 1 day */ 192145522Sdarrenr#define FIVE_DAYS (5 * ONE_DAY) 193255332Scy#define DOUBLE_HASH(x) (((x) + softs->ipf_state_seed[(x) % \ 194255332Scy softs->ipf_state_size]) % softs->ipf_state_size) 19553642Sguido 196255332Scy 197255332Scy/* ------------------------------------------------------------------------ */ 198255332Scy/* Function: ipf_state_main_load */ 199255332Scy/* Returns: int - 0 == success, -1 == failure */ 200255332Scy/* Parameters: Nil */ 201255332Scy/* */ 202255332Scy/* A null-op function that exists as a placeholder so that the flow in */ 203255332Scy/* other functions is obvious. */ 204255332Scy/* ------------------------------------------------------------------------ */ 205255332Scyint 206255332Scyipf_state_main_load() 207255332Scy{ 208255332Scy return 0; 209255332Scy} 210255332Scy 211255332Scy 212255332Scy/* ------------------------------------------------------------------------ */ 213255332Scy/* Function: ipf_state_main_unload */ 214255332Scy/* Returns: int - 0 == success, -1 == failure */ 215255332Scy/* Parameters: Nil */ 216255332Scy/* */ 217255332Scy/* A null-op function that exists as a placeholder so that the flow in */ 218255332Scy/* other functions is obvious. */ 219255332Scy/* ------------------------------------------------------------------------ */ 220255332Scyint 221255332Scyipf_state_main_unload() 222255332Scy{ 223255332Scy return 0; 224255332Scy} 225255332Scy 226255332Scy 227255332Scy/* ------------------------------------------------------------------------ */ 228255332Scy/* Function: ipf_state_soft_create */ 229255332Scy/* Returns: void * - NULL = failure, else pointer to soft context */ 230255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 231255332Scy/* */ 232255332Scy/* Create a new state soft context structure and populate it with the list */ 233255332Scy/* of tunables and other default settings. */ 234255332Scy/* ------------------------------------------------------------------------ */ 235255332Scyvoid * 236255332Scyipf_state_soft_create(softc) 237255332Scy ipf_main_softc_t *softc; 238255332Scy{ 239255332Scy ipf_state_softc_t *softs; 240255332Scy 241255332Scy KMALLOC(softs, ipf_state_softc_t *); 242255332Scy if (softs == NULL) 243255332Scy return NULL; 244255332Scy 245255332Scy bzero((char *)softs, sizeof(*softs)); 246255332Scy 247255332Scy softs->ipf_state_tune = ipf_tune_array_copy(softs, 248255332Scy sizeof(ipf_state_tuneables), 249255332Scy ipf_state_tuneables); 250255332Scy if (softs->ipf_state_tune == NULL) { 251255332Scy ipf_state_soft_destroy(softc, softs); 252255332Scy return NULL; 253255332Scy } 254255332Scy if (ipf_tune_array_link(softc, softs->ipf_state_tune) == -1) { 255255332Scy ipf_state_soft_destroy(softc, softs); 256255332Scy return NULL; 257255332Scy } 258255332Scy 259145522Sdarrenr#ifdef IPFILTER_LOG 260255332Scy softs->ipf_state_logging = 1; 261145522Sdarrenr#else 262255332Scy softs->ipf_state_logging = 0; 263145522Sdarrenr#endif 264255332Scy softs->ipf_state_size = IPSTATE_SIZE, 265255332Scy softs->ipf_state_maxbucket = 0; 266255332Scy softs->ipf_state_wm_freq = IPF_TTLVAL(10); 267255332Scy softs->ipf_state_max = IPSTATE_MAX; 268255332Scy softs->ipf_state_wm_last = 0; 269255332Scy softs->ipf_state_wm_high = 99; 270255332Scy softs->ipf_state_wm_low = 90; 271255332Scy softs->ipf_state_inited = 0; 272255332Scy softs->ipf_state_lock = 0; 273255332Scy softs->ipf_state_doflush = 0; 27453642Sguido 275255332Scy return softs; 276255332Scy} 27753642Sguido 278255332Scy 279145522Sdarrenr/* ------------------------------------------------------------------------ */ 280255332Scy/* Function: ipf_state_soft_destroy */ 281255332Scy/* Returns: Nil */ 282255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 283255332Scy/* arg(I) - pointer to local context to use */ 284145522Sdarrenr/* */ 285255332Scy/* Undo only what we did in soft create: unlink and free the tunables and */ 286255332Scy/* free the soft context structure itself. */ 287145522Sdarrenr/* ------------------------------------------------------------------------ */ 288255332Scyvoid 289255332Scyipf_state_soft_destroy(softc, arg) 290255332Scy ipf_main_softc_t *softc; 291255332Scy void *arg; 29253642Sguido{ 293255332Scy ipf_state_softc_t *softs = arg; 294255332Scy 295255332Scy if (softs->ipf_state_tune != NULL) { 296255332Scy ipf_tune_array_unlink(softc, softs->ipf_state_tune); 297255332Scy KFREES(softs->ipf_state_tune, sizeof(ipf_state_tuneables)); 298255332Scy softs->ipf_state_tune = NULL; 299255332Scy } 300255332Scy 301255332Scy KFREE(softs); 302255332Scy} 303255332Scy 304328274Scystatic void * 305328274Scyipf_state_seed_alloc(u_int state_size, u_int state_max) 306328274Scy{ 307328274Scy u_int i; 308328274Scy u_long *state_seed; 309328274Scy KMALLOCS(state_seed, u_long *, state_size * sizeof(*state_seed)); 310328274Scy if (state_seed == NULL) 311328274Scy return NULL; 312255332Scy 313328274Scy for (i = 0; i < state_size; i++) { 314328274Scy /* 315328274Scy * XXX - ipf_state_seed[X] should be a random number of sorts. 316328274Scy */ 317328274Scy#if FREEBSD_GE_REV(400000) 318328274Scy state_seed[i] = arc4random(); 319328274Scy#else 320328274Scy state_seed[i] = ((u_long)state_seed + i) * state_size; 321328274Scy state_seed[i] ^= 0xa5a55a5a; 322328274Scy state_seed[i] *= (u_long)state_seed; 323328274Scy state_seed[i] ^= 0x5a5aa5a5; 324328274Scy state_seed[i] *= state_max; 325328274Scy#endif 326328274Scy } 327328274Scy return state_seed; 328328274Scy} 329328274Scy 330328274Scy 331255332Scy/* ------------------------------------------------------------------------ */ 332255332Scy/* Function: ipf_state_soft_init */ 333255332Scy/* Returns: int - 0 == success, -1 == failure */ 334255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 335255332Scy/* arg(I) - pointer to local context to use */ 336255332Scy/* */ 337255332Scy/* Initialise the state soft context structure so it is ready for use. */ 338255332Scy/* This involves: */ 339255332Scy/* - allocating a hash table and zero'ing it out */ 340255332Scy/* - building a secondary table of seeds for double hashing to make it more */ 341255332Scy/* difficult to attempt to attack the hash table itself (for DoS) */ 342255332Scy/* - initialise all of the timeout queues, including a table for TCP, some */ 343255332Scy/* pairs of query/response for UDP and other IP protocols (typically the */ 344255332Scy/* reply queue has a shorter timeout than the query) */ 345255332Scy/* ------------------------------------------------------------------------ */ 346255332Scyint 347255332Scyipf_state_soft_init(softc, arg) 348255332Scy ipf_main_softc_t *softc; 349255332Scy void *arg; 350255332Scy{ 351255332Scy ipf_state_softc_t *softs = arg; 35260854Sdarrenr int i; 35360854Sdarrenr 354255332Scy KMALLOCS(softs->ipf_state_table, 355255332Scy ipstate_t **, softs->ipf_state_size * sizeof(ipstate_t *)); 356255332Scy if (softs->ipf_state_table == NULL) 35753642Sguido return -1; 35860854Sdarrenr 359255332Scy bzero((char *)softs->ipf_state_table, 360255332Scy softs->ipf_state_size * sizeof(ipstate_t *)); 361255332Scy 362328274Scy softs->ipf_state_seed = ipf_state_seed_alloc(softs->ipf_state_size, 363328274Scy softs->ipf_state_max); 364255332Scy if (softs->ipf_state_seed == NULL) 365145522Sdarrenr return -2; 366255332Scy 367255332Scy KMALLOCS(softs->ipf_state_stats.iss_bucketlen, u_int *, 368255332Scy softs->ipf_state_size * sizeof(u_int)); 369255332Scy if (softs->ipf_state_stats.iss_bucketlen == NULL) 370255332Scy return -3; 37160854Sdarrenr 372255332Scy bzero((char *)softs->ipf_state_stats.iss_bucketlen, 373255332Scy softs->ipf_state_size * sizeof(u_int)); 374145522Sdarrenr 375255332Scy if (softs->ipf_state_maxbucket == 0) { 376255332Scy for (i = softs->ipf_state_size; i > 0; i >>= 1) 377255332Scy softs->ipf_state_maxbucket++; 378255332Scy softs->ipf_state_maxbucket *= 2; 379145522Sdarrenr } 380145522Sdarrenr 381255332Scy ipf_sttab_init(softc, softs->ipf_state_tcptq); 382255332Scy softs->ipf_state_stats.iss_tcptab = softs->ipf_state_tcptq; 383255332Scy softs->ipf_state_tcptq[IPF_TCP_NSTATES - 1].ifq_next = 384255332Scy &softs->ipf_state_udptq; 385145522Sdarrenr 386255332Scy IPFTQ_INIT(&softs->ipf_state_udptq, softc->ipf_udptimeout, 387255332Scy "ipftq udp tab"); 388255332Scy softs->ipf_state_udptq.ifq_next = &softs->ipf_state_udpacktq; 389145522Sdarrenr 390255332Scy IPFTQ_INIT(&softs->ipf_state_udpacktq, softc->ipf_udpacktimeout, 391255332Scy "ipftq udpack tab"); 392255332Scy softs->ipf_state_udpacktq.ifq_next = &softs->ipf_state_icmptq; 393255332Scy 394255332Scy IPFTQ_INIT(&softs->ipf_state_icmptq, softc->ipf_icmptimeout, 395255332Scy "ipftq icmp tab"); 396255332Scy softs->ipf_state_icmptq.ifq_next = &softs->ipf_state_icmpacktq; 397255332Scy 398255332Scy IPFTQ_INIT(&softs->ipf_state_icmpacktq, softc->ipf_icmpacktimeout, 399255332Scy "ipftq icmpack tab"); 400255332Scy softs->ipf_state_icmpacktq.ifq_next = &softs->ipf_state_iptq; 401255332Scy 402255332Scy IPFTQ_INIT(&softs->ipf_state_iptq, softc->ipf_iptimeout, 403255332Scy "ipftq iptimeout tab"); 404255332Scy softs->ipf_state_iptq.ifq_next = &softs->ipf_state_pending; 405255332Scy 406255332Scy IPFTQ_INIT(&softs->ipf_state_pending, IPF_HZ_DIVIDE, "ipftq pending"); 407255332Scy softs->ipf_state_pending.ifq_next = &softs->ipf_state_deletetq; 408255332Scy 409255332Scy IPFTQ_INIT(&softs->ipf_state_deletetq, 1, "ipftq delete"); 410255332Scy softs->ipf_state_deletetq.ifq_next = NULL; 411255332Scy 412255332Scy MUTEX_INIT(&softs->ipf_stinsert, "ipf state insert mutex"); 413255332Scy 414255332Scy 415255332Scy softs->ipf_state_wm_last = softc->ipf_ticks; 416255332Scy softs->ipf_state_inited = 1; 417255332Scy 41853642Sguido return 0; 41953642Sguido} 42053642Sguido 42153642Sguido 422145522Sdarrenr/* ------------------------------------------------------------------------ */ 423255332Scy/* Function: ipf_state_soft_fini */ 424255332Scy/* Returns: int - 0 = success, -1 = failure */ 425255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 426255332Scy/* arg(I) - pointer to local context to use */ 427145522Sdarrenr/* */ 428145522Sdarrenr/* Release and destroy any resources acquired or initialised so that */ 429145522Sdarrenr/* IPFilter can be unloaded or re-initialised. */ 430145522Sdarrenr/* ------------------------------------------------------------------------ */ 431255332Scyint 432255332Scyipf_state_soft_fini(softc, arg) 433255332Scy ipf_main_softc_t *softc; 434255332Scy void *arg; 43553642Sguido{ 436255332Scy ipf_state_softc_t *softs = arg; 437145522Sdarrenr ipftq_t *ifq, *ifqnext; 438145522Sdarrenr ipstate_t *is; 43953642Sguido 440255332Scy while ((is = softs->ipf_state_list) != NULL) 441255332Scy ipf_state_del(softc, is, ISL_UNLOAD); 44253642Sguido 443145522Sdarrenr /* 444145522Sdarrenr * Proxy timeout queues are not cleaned here because although they 445255332Scy * exist on the state list, appr_unload is called after 446255332Scy * ipf_state_unload and the proxies actually are responsible for them 447255332Scy * being created. Should the proxy timeouts have their own list? 448255332Scy * There's no real justification as this is the only complication. 449145522Sdarrenr */ 450255332Scy for (ifq = softs->ipf_state_usertq; ifq != NULL; ifq = ifqnext) { 451145522Sdarrenr ifqnext = ifq->ifq_next; 452255332Scy 453255332Scy if (ipf_deletetimeoutqueue(ifq) == 0) 454255332Scy ipf_freetimeoutqueue(softc, ifq); 455145522Sdarrenr } 45653642Sguido 457255332Scy softs->ipf_state_stats.iss_inuse = 0; 458255332Scy softs->ipf_state_stats.iss_active = 0; 45953642Sguido 460255332Scy if (softs->ipf_state_inited == 1) { 461255332Scy softs->ipf_state_inited = 0; 462255332Scy ipf_sttab_destroy(softs->ipf_state_tcptq); 463255332Scy MUTEX_DESTROY(&softs->ipf_state_udptq.ifq_lock); 464255332Scy MUTEX_DESTROY(&softs->ipf_state_icmptq.ifq_lock); 465255332Scy MUTEX_DESTROY(&softs->ipf_state_udpacktq.ifq_lock); 466255332Scy MUTEX_DESTROY(&softs->ipf_state_icmpacktq.ifq_lock); 467255332Scy MUTEX_DESTROY(&softs->ipf_state_iptq.ifq_lock); 468255332Scy MUTEX_DESTROY(&softs->ipf_state_deletetq.ifq_lock); 469255332Scy MUTEX_DESTROY(&softs->ipf_state_pending.ifq_lock); 470255332Scy MUTEX_DESTROY(&softs->ipf_stinsert); 471145522Sdarrenr } 472110916Sdarrenr 473255332Scy if (softs->ipf_state_table != NULL) { 474255332Scy KFREES(softs->ipf_state_table, 475255332Scy softs->ipf_state_size * sizeof(*softs->ipf_state_table)); 476255332Scy softs->ipf_state_table = NULL; 477145522Sdarrenr } 47853642Sguido 479255332Scy if (softs->ipf_state_seed != NULL) { 480255332Scy KFREES(softs->ipf_state_seed, 481255332Scy softs->ipf_state_size * sizeof(*softs->ipf_state_seed)); 482255332Scy softs->ipf_state_seed = NULL; 48360854Sdarrenr } 48492685Sdarrenr 485255332Scy if (softs->ipf_state_stats.iss_bucketlen != NULL) { 486255332Scy KFREES(softs->ipf_state_stats.iss_bucketlen, 487255332Scy softs->ipf_state_size * sizeof(u_int)); 488255332Scy softs->ipf_state_stats.iss_bucketlen = NULL; 48992685Sdarrenr } 49092685Sdarrenr 491255332Scy return 0; 492255332Scy} 493145522Sdarrenr 494255332Scy 495255332Scy/* ------------------------------------------------------------------------ */ 496327717Scy/* Function: ipf_state_setlock */ 497255332Scy/* Returns: Nil */ 498255332Scy/* Parameters: arg(I) - pointer to local context to use */ 499255332Scy/* tmp(I) - new value for lock */ 500255332Scy/* */ 501255332Scy/* Stub function that allows for external manipulation of ipf_state_lock */ 502255332Scy/* ------------------------------------------------------------------------ */ 503255332Scyvoid 504255332Scyipf_state_setlock(arg, tmp) 505255332Scy void *arg; 506255332Scy int tmp; 507255332Scy{ 508255332Scy ipf_state_softc_t *softs = arg; 509255332Scy 510255332Scy softs->ipf_state_lock = tmp; 51153642Sguido} 51253642Sguido 51353642Sguido 514145522Sdarrenr/* ------------------------------------------------------------------------ */ 515255332Scy/* Function: ipf_state_stats */ 516145522Sdarrenr/* Returns: ips_state_t* - pointer to state stats structure */ 517255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 518145522Sdarrenr/* */ 519145522Sdarrenr/* Put all the current numbers and pointers into a single struct and return */ 520145522Sdarrenr/* a pointer to it. */ 521145522Sdarrenr/* ------------------------------------------------------------------------ */ 522255332Scystatic ips_stat_t * 523255332Scyipf_state_stats(softc) 524255332Scy ipf_main_softc_t *softc; 525145522Sdarrenr{ 526255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 527255332Scy ips_stat_t *issp = &softs->ipf_state_stats; 528255332Scy 529255332Scy issp->iss_state_size = softs->ipf_state_size; 530255332Scy issp->iss_state_max = softs->ipf_state_max; 531255332Scy issp->iss_table = softs->ipf_state_table; 532255332Scy issp->iss_list = softs->ipf_state_list; 533255332Scy issp->iss_ticks = softc->ipf_ticks; 534255332Scy 535255332Scy#ifdef IPFILTER_LOGGING 536255332Scy issp->iss_log_ok = ipf_log_logok(softc, IPF_LOGSTATE); 537255332Scy issp->iss_log_fail = ipf_log_failures(softc, IPF_LOGSTATE); 538255332Scy#else 539255332Scy issp->iss_log_ok = 0; 540255332Scy issp->iss_log_fail = 0; 541255332Scy#endif 542255332Scy return issp; 543145522Sdarrenr} 544145522Sdarrenr 545145522Sdarrenr/* ------------------------------------------------------------------------ */ 546255332Scy/* Function: ipf_state_remove */ 547145522Sdarrenr/* Returns: int - 0 == success, != 0 == failure */ 548255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 549255332Scy/* data(I) - pointer to state structure to delete from table */ 550145522Sdarrenr/* */ 551145522Sdarrenr/* Search for a state structure that matches the one passed, according to */ 552145522Sdarrenr/* the IP addresses and other protocol specific information. */ 553145522Sdarrenr/* ------------------------------------------------------------------------ */ 554255332Scystatic int 555255332Scyipf_state_remove(softc, data) 556255332Scy ipf_main_softc_t *softc; 557255332Scy caddr_t data; 55860854Sdarrenr{ 559255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 56060854Sdarrenr ipstate_t *sp, st; 56160854Sdarrenr int error; 56260854Sdarrenr 56360854Sdarrenr sp = &st; 564255332Scy error = ipf_inobj(softc, data, NULL, &st, IPFOBJ_IPSTATE); 56560854Sdarrenr if (error) 56660854Sdarrenr return EFAULT; 56760854Sdarrenr 568255332Scy WRITE_ENTER(&softc->ipf_state); 569255332Scy for (sp = softs->ipf_state_list; sp; sp = sp->is_next) 57060854Sdarrenr if ((sp->is_p == st.is_p) && (sp->is_v == st.is_v) && 571145522Sdarrenr !bcmp((caddr_t)&sp->is_src, (caddr_t)&st.is_src, 57267614Sdarrenr sizeof(st.is_src)) && 573255332Scy !bcmp((caddr_t)&sp->is_dst, (caddr_t)&st.is_dst, 57467614Sdarrenr sizeof(st.is_dst)) && 575145522Sdarrenr !bcmp((caddr_t)&sp->is_ps, (caddr_t)&st.is_ps, 57667614Sdarrenr sizeof(st.is_ps))) { 577255332Scy ipf_state_del(softc, sp, ISL_REMOVE); 578255332Scy RWLOCK_EXIT(&softc->ipf_state); 57960854Sdarrenr return 0; 58060854Sdarrenr } 581255332Scy RWLOCK_EXIT(&softc->ipf_state); 582255332Scy 583255332Scy IPFERROR(100001); 58460854Sdarrenr return ESRCH; 58560854Sdarrenr} 58660854Sdarrenr 58760854Sdarrenr 588145522Sdarrenr/* ------------------------------------------------------------------------ */ 589255332Scy/* Function: ipf_state_ioctl */ 590145522Sdarrenr/* Returns: int - 0 == success, != 0 == failure */ 591255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 592255332Scy/* data(I) - pointer to ioctl data */ 593255332Scy/* cmd(I) - ioctl command integer */ 594255332Scy/* mode(I) - file mode bits used with open */ 595255332Scy/* uid(I) - uid of process making the ioctl call */ 596255332Scy/* ctx(I) - pointer specific to context of the call */ 597145522Sdarrenr/* */ 598145522Sdarrenr/* Processes an ioctl call made to operate on the IP Filter state device. */ 599145522Sdarrenr/* ------------------------------------------------------------------------ */ 600255332Scyint 601255332Scyipf_state_ioctl(softc, data, cmd, mode, uid, ctx) 602255332Scy ipf_main_softc_t *softc; 603255332Scy caddr_t data; 604255332Scy ioctlcmd_t cmd; 605255332Scy int mode, uid; 606255332Scy void *ctx; 60753642Sguido{ 608255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 60960854Sdarrenr int arg, ret, error = 0; 610170268Sdarrenr SPL_INT(s); 61153642Sguido 61253642Sguido switch (cmd) 61353642Sguido { 614145522Sdarrenr /* 615145522Sdarrenr * Delete an entry from the state table. 616145522Sdarrenr */ 61760854Sdarrenr case SIOCDELST : 618255332Scy error = ipf_state_remove(softc, data); 61960854Sdarrenr break; 620170268Sdarrenr 621145522Sdarrenr /* 622145522Sdarrenr * Flush the state table 623145522Sdarrenr */ 62453642Sguido case SIOCIPFFL : 625255332Scy error = BCOPYIN(data, &arg, sizeof(arg)); 626170268Sdarrenr if (error != 0) { 627255332Scy IPFERROR(100002); 628170268Sdarrenr error = EFAULT; 629255332Scy 630170268Sdarrenr } else { 631255332Scy WRITE_ENTER(&softc->ipf_state); 632255332Scy ret = ipf_state_flush(softc, arg, 4); 633255332Scy RWLOCK_EXIT(&softc->ipf_state); 634255332Scy 635255332Scy error = BCOPYOUT(&ret, data, sizeof(ret)); 636255332Scy if (error != 0) { 637255332Scy IPFERROR(100003); 638170268Sdarrenr error = EFAULT; 639255332Scy } 640170268Sdarrenr } 64153642Sguido break; 642170268Sdarrenr 643145522Sdarrenr#ifdef USE_INET6 644110916Sdarrenr case SIOCIPFL6 : 645255332Scy error = BCOPYIN(data, &arg, sizeof(arg)); 646170268Sdarrenr if (error != 0) { 647255332Scy IPFERROR(100004); 648170268Sdarrenr error = EFAULT; 649255332Scy 650170268Sdarrenr } else { 651255332Scy WRITE_ENTER(&softc->ipf_state); 652255332Scy ret = ipf_state_flush(softc, arg, 6); 653255332Scy RWLOCK_EXIT(&softc->ipf_state); 654255332Scy 655255332Scy error = BCOPYOUT(&ret, data, sizeof(ret)); 656255332Scy if (error != 0) { 657255332Scy IPFERROR(100005); 658170268Sdarrenr error = EFAULT; 659255332Scy } 660170268Sdarrenr } 661110916Sdarrenr break; 662110916Sdarrenr#endif 663255332Scy 664255332Scy case SIOCMATCHFLUSH : 665255332Scy WRITE_ENTER(&softc->ipf_state); 666255332Scy error = ipf_state_matchflush(softc, data); 667255332Scy RWLOCK_EXIT(&softc->ipf_state); 668255332Scy break; 669255332Scy 67055929Sguido#ifdef IPFILTER_LOG 671145522Sdarrenr /* 672145522Sdarrenr * Flush the state log. 673145522Sdarrenr */ 67455929Sguido case SIOCIPFFB : 675255332Scy if (!(mode & FWRITE)) { 676255332Scy IPFERROR(100008); 67755929Sguido error = EPERM; 678255332Scy } else { 67960854Sdarrenr int tmp; 68060854Sdarrenr 681255332Scy tmp = ipf_log_clear(softc, IPL_LOGSTATE); 682255332Scy error = BCOPYOUT(&tmp, data, sizeof(tmp)); 683255332Scy if (error != 0) { 684255332Scy IPFERROR(100009); 685170268Sdarrenr error = EFAULT; 686255332Scy } 68760854Sdarrenr } 68855929Sguido break; 689170268Sdarrenr 690145522Sdarrenr /* 691145522Sdarrenr * Turn logging of state information on/off. 692145522Sdarrenr */ 693145522Sdarrenr case SIOCSETLG : 694255332Scy if (!(mode & FWRITE)) { 695255332Scy IPFERROR(100010); 696145522Sdarrenr error = EPERM; 697255332Scy } else { 698255332Scy error = BCOPYIN(data, &softs->ipf_state_logging, 699255332Scy sizeof(softs->ipf_state_logging)); 700255332Scy if (error != 0) { 701255332Scy IPFERROR(100011); 702170268Sdarrenr error = EFAULT; 703255332Scy } 704145522Sdarrenr } 70553642Sguido break; 706170268Sdarrenr 707145522Sdarrenr /* 708145522Sdarrenr * Return the current state of logging. 709145522Sdarrenr */ 710145522Sdarrenr case SIOCGETLG : 711255332Scy error = BCOPYOUT(&softs->ipf_state_logging, data, 712255332Scy sizeof(softs->ipf_state_logging)); 713255332Scy if (error != 0) { 714255332Scy IPFERROR(100012); 715170268Sdarrenr error = EFAULT; 716255332Scy } 717145522Sdarrenr break; 718170268Sdarrenr 719145522Sdarrenr /* 720145522Sdarrenr * Return the number of bytes currently waiting to be read. 721145522Sdarrenr */ 72253642Sguido case FIONREAD : 723255332Scy arg = ipf_log_bytesused(softc, IPL_LOGSTATE); 724255332Scy error = BCOPYOUT(&arg, data, sizeof(arg)); 725255332Scy if (error != 0) { 726255332Scy IPFERROR(100013); 727170268Sdarrenr error = EFAULT; 728255332Scy } 729145522Sdarrenr break; 73053642Sguido#endif 731170268Sdarrenr 732145522Sdarrenr /* 733145522Sdarrenr * Get the current state statistics. 734145522Sdarrenr */ 735145522Sdarrenr case SIOCGETFS : 736255332Scy error = ipf_outobj(softc, data, ipf_state_stats(softc), 737255332Scy IPFOBJ_STATESTAT); 73853642Sguido break; 739170268Sdarrenr 740145522Sdarrenr /* 741145522Sdarrenr * Lock/Unlock the state table. (Locking prevents any changes, which 742145522Sdarrenr * means no packets match). 743145522Sdarrenr */ 74460854Sdarrenr case SIOCSTLCK : 745153876Sguido if (!(mode & FWRITE)) { 746255332Scy IPFERROR(100014); 747153876Sguido error = EPERM; 748153876Sguido } else { 749255332Scy error = ipf_lock(data, &softs->ipf_state_lock); 750153876Sguido } 75160854Sdarrenr break; 752170268Sdarrenr 753145522Sdarrenr /* 754145522Sdarrenr * Add an entry to the current state table. 755145522Sdarrenr */ 75660854Sdarrenr case SIOCSTPUT : 757255332Scy if (!softs->ipf_state_lock || !(mode &FWRITE)) { 758255332Scy IPFERROR(100015); 75960854Sdarrenr error = EACCES; 76060854Sdarrenr break; 76160854Sdarrenr } 762255332Scy error = ipf_state_putent(softc, softs, data); 76360854Sdarrenr break; 764170268Sdarrenr 765145522Sdarrenr /* 766145522Sdarrenr * Get a state table entry. 767145522Sdarrenr */ 76860854Sdarrenr case SIOCSTGET : 769255332Scy if (!softs->ipf_state_lock) { 770255332Scy IPFERROR(100016); 77160854Sdarrenr error = EACCES; 77260854Sdarrenr break; 77360854Sdarrenr } 774255332Scy error = ipf_state_getent(softc, softs, data); 77560854Sdarrenr break; 776170268Sdarrenr 777170268Sdarrenr /* 778170268Sdarrenr * Return a copy of the hash table bucket lengths 779170268Sdarrenr */ 780170268Sdarrenr case SIOCSTAT1 : 781255332Scy error = BCOPYOUT(softs->ipf_state_stats.iss_bucketlen, data, 782255332Scy softs->ipf_state_size * sizeof(u_int)); 783255332Scy if (error != 0) { 784255332Scy IPFERROR(100017); 785170268Sdarrenr error = EFAULT; 786255332Scy } 787170268Sdarrenr break; 788170268Sdarrenr 789170268Sdarrenr case SIOCGENITER : 790170268Sdarrenr { 791170268Sdarrenr ipftoken_t *token; 792170268Sdarrenr ipfgeniter_t iter; 793255332Scy ipfobj_t obj; 794170268Sdarrenr 795255332Scy error = ipf_inobj(softc, data, &obj, &iter, IPFOBJ_GENITER); 796170268Sdarrenr if (error != 0) 797170268Sdarrenr break; 798170268Sdarrenr 799170268Sdarrenr SPL_SCHED(s); 800255332Scy token = ipf_token_find(softc, IPFGENITER_STATE, uid, ctx); 801255332Scy if (token != NULL) { 802255332Scy error = ipf_state_iter(softc, token, &iter, &obj); 803255332Scy WRITE_ENTER(&softc->ipf_tokens); 804255332Scy ipf_token_deref(softc, token); 805255332Scy RWLOCK_EXIT(&softc->ipf_tokens); 806255332Scy } else { 807255332Scy IPFERROR(100018); 808170268Sdarrenr error = ESRCH; 809255332Scy } 810170268Sdarrenr SPL_X(s); 811170268Sdarrenr break; 812170268Sdarrenr } 813170268Sdarrenr 814170268Sdarrenr case SIOCGTABL : 815255332Scy error = ipf_state_gettable(softc, softs, data); 816170268Sdarrenr break; 817170268Sdarrenr 818170268Sdarrenr case SIOCIPFDELTOK : 819255332Scy error = BCOPYIN(data, &arg, sizeof(arg)); 820170268Sdarrenr if (error != 0) { 821255332Scy IPFERROR(100019); 822170268Sdarrenr error = EFAULT; 823170268Sdarrenr } else { 824170268Sdarrenr SPL_SCHED(s); 825255332Scy error = ipf_token_del(softc, arg, uid, ctx); 826170268Sdarrenr SPL_X(s); 827170268Sdarrenr } 828170268Sdarrenr break; 829170268Sdarrenr 830170268Sdarrenr case SIOCGTQTAB : 831255332Scy error = ipf_outobj(softc, data, softs->ipf_state_tcptq, 832255332Scy IPFOBJ_STATETQTAB); 833170268Sdarrenr break; 834170268Sdarrenr 83553642Sguido default : 836255332Scy IPFERROR(100020); 83753642Sguido error = EINVAL; 83853642Sguido break; 83953642Sguido } 84053642Sguido return error; 84153642Sguido} 84253642Sguido 84353642Sguido 844145522Sdarrenr/* ------------------------------------------------------------------------ */ 845255332Scy/* Function: ipf_state_getent */ 846145522Sdarrenr/* Returns: int - 0 == success, != 0 == failure */ 847255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 848255332Scy/* softs(I) - pointer to state context structure */ 849255332Scy/* data(I) - pointer to state structure to retrieve from table*/ 850145522Sdarrenr/* */ 851145522Sdarrenr/* Copy out state information from the kernel to a user space process. If */ 852145522Sdarrenr/* there is a filter rule associated with the state entry, copy that out */ 853145522Sdarrenr/* as well. The entry to copy out is taken from the value of "ips_next" in */ 854145522Sdarrenr/* the struct passed in and if not null and not found in the list of current*/ 855145522Sdarrenr/* state entries, the retrieval fails. */ 856145522Sdarrenr/* ------------------------------------------------------------------------ */ 857255332Scystatic int 858255332Scyipf_state_getent(softc, softs, data) 859255332Scy ipf_main_softc_t *softc; 860255332Scy ipf_state_softc_t *softs; 861255332Scy caddr_t data; 86260854Sdarrenr{ 863145522Sdarrenr ipstate_t *is, *isn; 86492685Sdarrenr ipstate_save_t ips; 86560854Sdarrenr int error; 86660854Sdarrenr 867255332Scy error = ipf_inobj(softc, data, NULL, &ips, IPFOBJ_STATESAVE); 868255332Scy if (error) 869255332Scy return EFAULT; 87060854Sdarrenr 871255332Scy READ_ENTER(&softc->ipf_state); 87260854Sdarrenr isn = ips.ips_next; 873145522Sdarrenr if (isn == NULL) { 874255332Scy isn = softs->ipf_state_list; 87560854Sdarrenr if (isn == NULL) { 876255332Scy if (ips.ips_next == NULL) { 877255332Scy RWLOCK_EXIT(&softc->ipf_state); 878255332Scy IPFERROR(100021); 87960854Sdarrenr return ENOENT; 880255332Scy } 88160854Sdarrenr return 0; 88260854Sdarrenr } 88360854Sdarrenr } else { 88460854Sdarrenr /* 88560854Sdarrenr * Make sure the pointer we're copying from exists in the 88660854Sdarrenr * current list of entries. Security precaution to prevent 88760854Sdarrenr * copying of random kernel data. 88860854Sdarrenr */ 889255332Scy for (is = softs->ipf_state_list; is; is = is->is_next) 89060854Sdarrenr if (is == isn) 89160854Sdarrenr break; 892255332Scy if (!is) { 893255332Scy RWLOCK_EXIT(&softc->ipf_state); 894255332Scy IPFERROR(100022); 89560854Sdarrenr return ESRCH; 896173181Sdarrenr } 89760854Sdarrenr } 89860854Sdarrenr ips.ips_next = isn->is_next; 89960854Sdarrenr bcopy((char *)isn, (char *)&ips.ips_is, sizeof(ips.ips_is)); 900145522Sdarrenr ips.ips_rule = isn->is_rule; 901145522Sdarrenr if (isn->is_rule != NULL) 90260854Sdarrenr bcopy((char *)isn->is_rule, (char *)&ips.ips_fr, 90360854Sdarrenr sizeof(ips.ips_fr)); 904255332Scy RWLOCK_EXIT(&softc->ipf_state); 905255332Scy error = ipf_outobj(softc, data, &ips, IPFOBJ_STATESAVE); 906172776Sdarrenr return error; 90760854Sdarrenr} 90860854Sdarrenr 90960854Sdarrenr 910145522Sdarrenr/* ------------------------------------------------------------------------ */ 911255332Scy/* Function: ipf_state_putent */ 912145522Sdarrenr/* Returns: int - 0 == success, != 0 == failure */ 913255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 914255332Scy/* softs(I) - pointer to state context structure */ 915255332Scy/* data(I) - pointer to state information struct */ 916145522Sdarrenr/* */ 917145522Sdarrenr/* This function implements the SIOCSTPUT ioctl: insert a state entry into */ 918145522Sdarrenr/* the state table. If the state info. includes a pointer to a filter rule */ 919145522Sdarrenr/* then also add in an orphaned rule (will not show up in any "ipfstat -io" */ 920145522Sdarrenr/* output. */ 921145522Sdarrenr/* ------------------------------------------------------------------------ */ 922255332Scyint 923255332Scyipf_state_putent(softc, softs, data) 924255332Scy ipf_main_softc_t *softc; 925255332Scy ipf_state_softc_t *softs; 926255332Scy caddr_t data; 92760854Sdarrenr{ 928145522Sdarrenr ipstate_t *is, *isn; 92992685Sdarrenr ipstate_save_t ips; 93092685Sdarrenr int error, out, i; 93160854Sdarrenr frentry_t *fr; 93292685Sdarrenr char *name; 93360854Sdarrenr 934255332Scy error = ipf_inobj(softc, data, NULL, &ips, IPFOBJ_STATESAVE); 935255332Scy if (error != 0) 936255332Scy return error; 93760854Sdarrenr 93860854Sdarrenr KMALLOC(isn, ipstate_t *); 939255332Scy if (isn == NULL) { 940255332Scy IPFERROR(100023); 94160854Sdarrenr return ENOMEM; 942255332Scy } 94360854Sdarrenr 94460854Sdarrenr bcopy((char *)&ips.ips_is, (char *)isn, sizeof(*isn)); 945145522Sdarrenr bzero((char *)isn, offsetof(struct ipstate, is_pkts)); 946145522Sdarrenr isn->is_sti.tqe_pnext = NULL; 947145522Sdarrenr isn->is_sti.tqe_next = NULL; 948145522Sdarrenr isn->is_sti.tqe_ifq = NULL; 949145522Sdarrenr isn->is_sti.tqe_parent = isn; 950145522Sdarrenr isn->is_ifp[0] = NULL; 951145522Sdarrenr isn->is_ifp[1] = NULL; 952145522Sdarrenr isn->is_ifp[2] = NULL; 953145522Sdarrenr isn->is_ifp[3] = NULL; 954145522Sdarrenr isn->is_sync = NULL; 955145522Sdarrenr fr = ips.ips_rule; 95692685Sdarrenr 957145522Sdarrenr if (fr == NULL) { 958255332Scy int inserr; 959255332Scy 960255332Scy READ_ENTER(&softc->ipf_state); 961255332Scy inserr = ipf_state_insert(softc, isn, 0); 962153876Sguido MUTEX_EXIT(&isn->is_lock); 963255332Scy RWLOCK_EXIT(&softc->ipf_state); 964255332Scy 965255332Scy return inserr; 966145522Sdarrenr } 967145522Sdarrenr 968145522Sdarrenr if (isn->is_flags & SI_NEWFR) { 969145522Sdarrenr KMALLOC(fr, frentry_t *); 970145522Sdarrenr if (fr == NULL) { 971145522Sdarrenr KFREE(isn); 972255332Scy IPFERROR(100024); 973145522Sdarrenr return ENOMEM; 974145522Sdarrenr } 975145522Sdarrenr bcopy((char *)&ips.ips_fr, (char *)fr, sizeof(*fr)); 976145522Sdarrenr out = fr->fr_flags & FR_OUTQUE ? 1 : 0; 977145522Sdarrenr isn->is_rule = fr; 978145522Sdarrenr ips.ips_is.is_rule = fr; 979145522Sdarrenr MUTEX_NUKE(&fr->fr_lock); 980145522Sdarrenr MUTEX_INIT(&fr->fr_lock, "state filter rule lock"); 981145522Sdarrenr 982145522Sdarrenr /* 983145522Sdarrenr * Look up all the interface names in the rule. 984145522Sdarrenr */ 985145522Sdarrenr for (i = 0; i < 4; i++) { 986255332Scy if (fr->fr_ifnames[i] == -1) { 987255332Scy fr->fr_ifas[i] = NULL; 988255332Scy continue; 989255332Scy } 990255332Scy name = fr->fr_names + fr->fr_ifnames[i]; 991255332Scy fr->fr_ifas[i] = ipf_resolvenic(softc, name, 992255332Scy fr->fr_family); 993255332Scy } 994255332Scy 995255332Scy for (i = 0; i < 4; i++) { 996145522Sdarrenr name = isn->is_ifname[i]; 997255332Scy isn->is_ifp[i] = ipf_resolvenic(softc, name, 998255332Scy isn->is_v); 999145522Sdarrenr } 1000145522Sdarrenr 1001145522Sdarrenr fr->fr_ref = 0; 1002145522Sdarrenr fr->fr_dsize = 0; 1003145522Sdarrenr fr->fr_data = NULL; 1004161356Sguido fr->fr_type = FR_T_NONE; 1005145522Sdarrenr 1006255332Scy (void) ipf_resolvedest(softc, fr->fr_names, &fr->fr_tifs[0], 1007255332Scy fr->fr_family); 1008255332Scy (void) ipf_resolvedest(softc, fr->fr_names, &fr->fr_tifs[1], 1009255332Scy fr->fr_family); 1010255332Scy (void) ipf_resolvedest(softc, fr->fr_names, &fr->fr_dif, 1011255332Scy fr->fr_family); 1012145522Sdarrenr 1013145522Sdarrenr /* 1014145522Sdarrenr * send a copy back to userland of what we ended up 1015145522Sdarrenr * to allow for verification. 1016145522Sdarrenr */ 1017255332Scy error = ipf_outobj(softc, data, &ips, IPFOBJ_STATESAVE); 1018255332Scy if (error != 0) { 1019145522Sdarrenr KFREE(isn); 1020145522Sdarrenr MUTEX_DESTROY(&fr->fr_lock); 1021145522Sdarrenr KFREE(fr); 1022255332Scy IPFERROR(100025); 1023145522Sdarrenr return EFAULT; 1024145522Sdarrenr } 1025255332Scy READ_ENTER(&softc->ipf_state); 1026255332Scy error = ipf_state_insert(softc, isn, 0); 1027153876Sguido MUTEX_EXIT(&isn->is_lock); 1028255332Scy RWLOCK_EXIT(&softc->ipf_state); 1029145522Sdarrenr 1030145522Sdarrenr } else { 1031255332Scy READ_ENTER(&softc->ipf_state); 1032255332Scy for (is = softs->ipf_state_list; is; is = is->is_next) 1033145522Sdarrenr if (is->is_rule == fr) { 1034255332Scy error = ipf_state_insert(softc, isn, 0); 1035153876Sguido MUTEX_EXIT(&isn->is_lock); 1036145522Sdarrenr break; 103792685Sdarrenr } 103892685Sdarrenr 1039145522Sdarrenr if (is == NULL) { 1040145522Sdarrenr KFREE(isn); 1041145522Sdarrenr isn = NULL; 104260854Sdarrenr } 1043255332Scy RWLOCK_EXIT(&softc->ipf_state); 1044145522Sdarrenr 1045255332Scy if (isn == NULL) { 1046255332Scy IPFERROR(100033); 1047255332Scy error = ESRCH; 1048255332Scy } 104960854Sdarrenr } 1050145522Sdarrenr 1051255332Scy return error; 105260854Sdarrenr} 105360854Sdarrenr 105460854Sdarrenr 1055145522Sdarrenr/* ------------------------------------------------------------------------ */ 1056255332Scy/* Function: ipf_state_insert */ 1057255332Scy/* Returns: int - 0 == success, -1 == failure */ 1058255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 1059255332Scy/* Parameters: is(I) - pointer to state structure */ 1060255332Scy/* rev(I) - flag indicating direction of packet */ 1061145522Sdarrenr/* */ 1062145522Sdarrenr/* Inserts a state structure into the hash table (for lookups) and the list */ 1063145522Sdarrenr/* of state entries (for enumeration). Resolves all of the interface names */ 1064145522Sdarrenr/* to pointers and adjusts running stats for the hash table as appropriate. */ 1065145522Sdarrenr/* */ 1066255332Scy/* This function can fail if the filter rule has had a population policy of */ 1067287984Scy/* IP addresses used with stateful filtering assigned to it. */ 1068255332Scy/* */ 1069145522Sdarrenr/* Locking: it is assumed that some kind of lock on ipf_state is held. */ 1070255332Scy/* Exits with is_lock initialised and held - *EVEN IF ERROR*. */ 1071145522Sdarrenr/* ------------------------------------------------------------------------ */ 1072255332Scyint 1073255332Scyipf_state_insert(softc, is, rev) 1074255332Scy ipf_main_softc_t *softc; 1075255332Scy ipstate_t *is; 1076255332Scy int rev; 107760854Sdarrenr{ 1078255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 1079145522Sdarrenr frentry_t *fr; 1080145522Sdarrenr u_int hv; 108192685Sdarrenr int i; 108260854Sdarrenr 108392685Sdarrenr /* 108492685Sdarrenr * Look up all the interface names in the state entry. 108592685Sdarrenr */ 108692685Sdarrenr for (i = 0; i < 4; i++) { 1087145522Sdarrenr if (is->is_ifp[i] != NULL) 1088145522Sdarrenr continue; 1089255332Scy is->is_ifp[i] = ipf_resolvenic(softc, is->is_ifname[i], 1090255332Scy is->is_v); 109160854Sdarrenr } 109260854Sdarrenr 1093145522Sdarrenr /* 1094287984Scy * If we could trust is_hv, then the modulus would not be needed, 1095255332Scy * but when running with IPFILTER_SYNC, this stops bad values. 1096145522Sdarrenr */ 1097255332Scy hv = is->is_hv % softs->ipf_state_size; 1098255332Scy /* TRACE is, hv */ 1099145522Sdarrenr is->is_hv = hv; 110092685Sdarrenr 110160854Sdarrenr /* 1102145522Sdarrenr * We need to get both of these locks...the first because it is 1103145522Sdarrenr * possible that once the insert is complete another packet might 1104145522Sdarrenr * come along, match the entry and want to update it. 1105145522Sdarrenr */ 1106255332Scy MUTEX_INIT(&is->is_lock, "ipf state entry"); 1107145522Sdarrenr MUTEX_ENTER(&is->is_lock); 1108255332Scy MUTEX_ENTER(&softs->ipf_stinsert); 1109145522Sdarrenr 1110255332Scy fr = is->is_rule; 1111255332Scy if (fr != NULL) { 1112255332Scy if ((fr->fr_srctrack.ht_max_nodes != 0) && 1113255332Scy (ipf_ht_node_add(softc, &fr->fr_srctrack, 1114255332Scy is->is_family, &is->is_src) == -1)) { 1115255332Scy SBUMPD(ipf_state_stats, iss_max_track); 1116255332Scy MUTEX_EXIT(&softs->ipf_stinsert); 1117255332Scy return -1; 1118255332Scy } 1119255332Scy 1120255332Scy MUTEX_ENTER(&fr->fr_lock); 1121255332Scy fr->fr_ref++; 1122255332Scy MUTEX_EXIT(&fr->fr_lock); 1123255332Scy fr->fr_statecnt++; 1124255332Scy } 1125255332Scy 1126255332Scy if (is->is_flags & (SI_WILDP|SI_WILDA)) { 1127255332Scy DT(iss_wild_plus_one); 1128255332Scy SINCL(ipf_state_stats.iss_wild); 1129255332Scy } 1130255332Scy 1131255332Scy SBUMP(ipf_state_stats.iss_proto[is->is_p]); 1132255332Scy SBUMP(ipf_state_stats.iss_active_proto[is->is_p]); 1133255332Scy 1134145522Sdarrenr /* 113560854Sdarrenr * add into list table. 113660854Sdarrenr */ 1137255332Scy if (softs->ipf_state_list != NULL) 1138255332Scy softs->ipf_state_list->is_pnext = &is->is_next; 1139255332Scy is->is_pnext = &softs->ipf_state_list; 1140255332Scy is->is_next = softs->ipf_state_list; 1141255332Scy softs->ipf_state_list = is; 1142145522Sdarrenr 1143255332Scy if (softs->ipf_state_table[hv] != NULL) 1144255332Scy softs->ipf_state_table[hv]->is_phnext = &is->is_hnext; 114560854Sdarrenr else 1146255332Scy softs->ipf_state_stats.iss_inuse++; 1147255332Scy is->is_phnext = softs->ipf_state_table + hv; 1148255332Scy is->is_hnext = softs->ipf_state_table[hv]; 1149255332Scy softs->ipf_state_table[hv] = is; 1150255332Scy softs->ipf_state_stats.iss_bucketlen[hv]++; 1151255332Scy softs->ipf_state_stats.iss_active++; 1152255332Scy MUTEX_EXIT(&softs->ipf_stinsert); 1153145522Sdarrenr 1154255332Scy ipf_state_setqueue(softc, is, rev); 1155255332Scy 1156255332Scy return 0; 115760854Sdarrenr} 115860854Sdarrenr 115960854Sdarrenr 1160145522Sdarrenr/* ------------------------------------------------------------------------ */ 1161255332Scy/* Function: ipf_state_matchipv4addrs */ 1162255332Scy/* Returns: int - 2 addresses match (strong match), 1 reverse match, */ 1163255332Scy/* 0 no match */ 1164255332Scy/* Parameters: is1, is2 pointers to states we are checking */ 1165255332Scy/* */ 1166255332Scy/* Function matches IPv4 addresses it returns strong match for ICMP proto */ 1167255332Scy/* even there is only reverse match */ 1168255332Scy/* ------------------------------------------------------------------------ */ 1169255332Scystatic int 1170255332Scyipf_state_matchipv4addrs(is1, is2) 1171255332Scy ipstate_t *is1, *is2; 1172255332Scy{ 1173255332Scy int rv; 1174255332Scy 1175255332Scy if (is1->is_saddr == is2->is_saddr && is1->is_daddr == is2->is_daddr) 1176255332Scy rv = 2; 1177255332Scy else if (is1->is_saddr == is2->is_daddr && 1178255332Scy is1->is_daddr == is2->is_saddr) { 1179255332Scy /* force strong match for ICMP protocol */ 1180255332Scy rv = (is1->is_p == IPPROTO_ICMP) ? 2 : 1; 1181255332Scy } 1182255332Scy else 1183255332Scy rv = 0; 1184255332Scy 1185255332Scy return (rv); 1186255332Scy} 1187255332Scy 1188255332Scy 1189255332Scy/* ------------------------------------------------------------------------ */ 1190255332Scy/* Function: ipf_state_matchipv6addrs */ 1191255332Scy/* Returns: int - 2 addresses match (strong match), 1 reverse match, */ 1192255332Scy/* 0 no match */ 1193255332Scy/* Parameters: is1, is2 pointers to states we are checking */ 1194255332Scy/* */ 1195255332Scy/* Function matches IPv6 addresses it returns strong match for ICMP proto */ 1196255332Scy/* even there is only reverse match */ 1197255332Scy/* ------------------------------------------------------------------------ */ 1198255332Scystatic int 1199255332Scyipf_state_matchipv6addrs(is1, is2) 1200255332Scy ipstate_t *is1, *is2; 1201255332Scy{ 1202255332Scy int rv; 1203255332Scy 1204255332Scy if (IP6_EQ(&is1->is_src, &is2->is_src) && 1205255332Scy IP6_EQ(&is1->is_dst, &is2->is_dst)) 1206255332Scy rv = 2; 1207255332Scy else if (IP6_EQ(&is1->is_src, &is2->is_dst) && 1208255332Scy IP6_EQ(&is1->is_dst, &is2->is_src)) { 1209255332Scy /* force strong match for ICMPv6 protocol */ 1210255332Scy rv = (is1->is_p == IPPROTO_ICMPV6) ? 2 : 1; 1211255332Scy } 1212255332Scy else 1213255332Scy rv = 0; 1214255332Scy 1215255332Scy return (rv); 1216255332Scy} 1217255332Scy 1218255332Scy 1219255332Scy/* ------------------------------------------------------------------------ */ 1220255332Scy/* Function: ipf_state_matchaddresses */ 1221255332Scy/* Returns: int - 2 addresses match, 1 reverse match, zero no match */ 1222255332Scy/* Parameters: is1, is2 pointers to states we are checking */ 1223255332Scy/* */ 1224255332Scy/* function retruns true if two pairs of addresses belong to single */ 1225255332Scy/* connection. suppose there are two endpoints: */ 1226255332Scy/* endpoint1 1.1.1.1 */ 1227255332Scy/* endpoint2 1.1.1.2 */ 1228255332Scy/* */ 1229255332Scy/* the state is established by packet flying from .1 to .2 so we see: */ 1230255332Scy/* is1->src = 1.1.1.1 */ 1231255332Scy/* is1->dst = 1.1.1.2 */ 1232255332Scy/* now endpoint 1.1.1.2 sends answer */ 1233255332Scy/* retreives is1 record created by first packat and compares it with is2 */ 1234255332Scy/* temporal record, is2 is initialized as follows: */ 1235255332Scy/* is2->src = 1.1.1.2 */ 1236255332Scy/* is2->dst = 1.1.1.1 */ 1237255332Scy/* in this case 1 will be returned */ 1238255332Scy/* */ 1239255332Scy/* the ipf_matchaddresses() assumes those two records to be same. of course */ 1240255332Scy/* the ipf_matchaddresses() also assume records are same in case you pass */ 1241255332Scy/* identical arguments (i.e. ipf_matchaddress(is1, is1) would return 2 */ 1242255332Scy/* ------------------------------------------------------------------------ */ 1243255332Scystatic int 1244255332Scyipf_state_matchaddresses(is1, is2) 1245255332Scy ipstate_t *is1, *is2; 1246255332Scy{ 1247255332Scy int rv; 1248255332Scy 1249255332Scy if (is1->is_v == 4) { 1250255332Scy rv = ipf_state_matchipv4addrs(is1, is2); 1251255332Scy } 1252255332Scy else { 1253255332Scy rv = ipf_state_matchipv6addrs(is1, is2); 1254255332Scy } 1255255332Scy 1256255332Scy return (rv); 1257255332Scy} 1258255332Scy 1259255332Scy 1260255332Scy/* ------------------------------------------------------------------------ */ 1261255332Scy/* Function: ipf_matchports */ 1262255332Scy/* Returns: int - 2 match, 1 rverse match, 0 no match */ 1263255332Scy/* Parameters: ppairs1, ppairs - src, dst ports we want to match */ 1264255332Scy/* */ 1265255332Scy/* performs the same match for isps members as for addresses */ 1266255332Scy/* ------------------------------------------------------------------------ */ 1267255332Scystatic int 1268255332Scyipf_state_matchports(ppairs1, ppairs2) 1269255332Scy udpinfo_t *ppairs1, *ppairs2; 1270255332Scy{ 1271255332Scy int rv; 1272255332Scy 1273255332Scy if (ppairs1->us_sport == ppairs2->us_sport && 1274255332Scy ppairs1->us_dport == ppairs2->us_dport) 1275255332Scy rv = 2; 1276255332Scy else if (ppairs1->us_sport == ppairs2->us_dport && 1277255332Scy ppairs1->us_dport == ppairs2->us_sport) 1278255332Scy rv = 1; 1279255332Scy else 1280255332Scy rv = 0; 1281255332Scy 1282255332Scy return (rv); 1283255332Scy} 1284255332Scy 1285255332Scy 1286255332Scy/* ------------------------------------------------------------------------ */ 1287255332Scy/* Function: ipf_matchisps */ 1288255332Scy/* Returns: int - nonzero if isps members match, 0 nomatch */ 1289255332Scy/* Parameters: is1, is2 - states we want to match */ 1290255332Scy/* */ 1291255332Scy/* performs the same match for isps members as for addresses */ 1292255332Scy/* ------------------------------------------------------------------------ */ 1293255332Scystatic int 1294255332Scyipf_state_matchisps(is1, is2) 1295255332Scy ipstate_t *is1, *is2; 1296255332Scy{ 1297255332Scy int rv; 1298255332Scy 1299255332Scy if (is1->is_p == is2->is_p) { 1300255332Scy switch (is1->is_p) 1301255332Scy { 1302255332Scy case IPPROTO_TCP : 1303255332Scy case IPPROTO_UDP : 1304255332Scy case IPPROTO_GRE : 1305255332Scy /* greinfo_t can be also interprted as port pair */ 1306255332Scy rv = ipf_state_matchports(&is1->is_ps.is_us, 1307255332Scy &is2->is_ps.is_us); 1308255332Scy break; 1309255332Scy 1310255332Scy case IPPROTO_ICMP : 1311255332Scy case IPPROTO_ICMPV6 : 1312255332Scy /* force strong match for ICMP datagram. */ 1313255332Scy if (bcmp(&is1->is_ps, &is2->is_ps, 1314255332Scy sizeof(icmpinfo_t)) == 0) { 1315255332Scy rv = 2; 1316255332Scy } else { 1317255332Scy rv = 0; 1318255332Scy } 1319255332Scy break; 1320255332Scy 1321255332Scy default: 1322255332Scy rv = 0; 1323255332Scy } 1324255332Scy } else { 1325255332Scy rv = 0; 1326255332Scy } 1327255332Scy 1328255332Scy return (rv); 1329255332Scy} 1330255332Scy 1331255332Scy 1332255332Scy/* ------------------------------------------------------------------------ */ 1333255332Scy/* Function: ipf_state_match */ 1334255332Scy/* Returns: int - nonzero match, zero no match */ 1335255332Scy/* Parameters: is1, is2 - states we want to match */ 1336255332Scy/* */ 1337255332Scy/* ------------------------------------------------------------------------ */ 1338255332Scystatic int 1339255332Scyipf_state_match(is1, is2) 1340255332Scy ipstate_t *is1, *is2; 1341255332Scy{ 1342255332Scy int rv; 1343255332Scy int amatch; 1344255332Scy int pomatch; 1345255332Scy 1346255332Scy if (bcmp(&is1->is_pass, &is2->is_pass, 1347255332Scy offsetof(struct ipstate, is_authmsk) - 1348255332Scy offsetof(struct ipstate, is_pass)) == 0) { 1349255332Scy 1350255332Scy pomatch = ipf_state_matchisps(is1, is2); 1351255332Scy amatch = ipf_state_matchaddresses(is1, is2); 1352255332Scy rv = (amatch != 0) && (amatch == pomatch); 1353255332Scy } else { 1354255332Scy rv = 0; 1355255332Scy } 1356255332Scy 1357255332Scy return (rv); 1358255332Scy} 1359255332Scy 1360255332Scy/* ------------------------------------------------------------------------ */ 1361255332Scy/* Function: ipf_state_add */ 1362255332Scy/* Returns: ipstate_t - 0 = success */ 1363255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 1364255332Scy/* fin(I) - pointer to packet information */ 1365145522Sdarrenr/* stsave(O) - pointer to place to save pointer to created */ 1366145522Sdarrenr/* state structure. */ 1367145522Sdarrenr/* flags(I) - flags to use when creating the structure */ 1368145522Sdarrenr/* */ 1369145522Sdarrenr/* Creates a new IP state structure from the packet information collected. */ 1370145522Sdarrenr/* Inserts it into the state table and appends to the bottom of the active */ 1371145522Sdarrenr/* list. If the capacity of the table has reached the maximum allowed then */ 1372145522Sdarrenr/* the call will fail and a flush is scheduled for the next timeout call. */ 1373161356Sguido/* */ 1374161356Sguido/* NOTE: The use of stsave to point to nat_state will result in memory */ 1375161356Sguido/* corruption. It should only be used to point to objects that will */ 1376161356Sguido/* either outlive this (not expired) or will deref the ip_state_t */ 1377161356Sguido/* when they are deleted. */ 1378145522Sdarrenr/* ------------------------------------------------------------------------ */ 1379255332Scyint 1380255332Scyipf_state_add(softc, fin, stsave, flags) 1381255332Scy ipf_main_softc_t *softc; 1382255332Scy fr_info_t *fin; 1383255332Scy ipstate_t **stsave; 1384255332Scy u_int flags; 138553642Sguido{ 1386255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 1387145522Sdarrenr ipstate_t *is, ips; 138892685Sdarrenr struct icmp *ic; 1389145522Sdarrenr u_int pass, hv; 1390145522Sdarrenr frentry_t *fr; 1391145522Sdarrenr tcphdr_t *tcp; 1392255332Scy frdest_t *fdp; 1393145522Sdarrenr int out; 139453642Sguido 1395255332Scy /* 1396323694Scy * If a locally created packet is trying to egress but it 1397323694Scy * does not match because of this lock, it is likely that 1398323694Scy * the policy will block it and return network unreachable further 1399323694Scy * up the stack. To mitigate this error, EAGAIN is returned instead, 1400255332Scy * telling the IP stack to try sending this packet again later. 1401255332Scy */ 1402255332Scy if (softs->ipf_state_lock) { 1403255332Scy SBUMPD(ipf_state_stats, iss_add_locked); 1404255332Scy fin->fin_error = EAGAIN; 1405255332Scy return -1; 1406255332Scy } 1407145522Sdarrenr 1408255332Scy if (fin->fin_flx & (FI_SHORT|FI_STATE|FI_FRAGBODY|FI_BAD)) { 1409255332Scy SBUMPD(ipf_state_stats, iss_add_bad); 1410255332Scy return -1; 1411255332Scy } 1412145522Sdarrenr 1413255332Scy if ((fin->fin_flx & FI_OOW) && !(fin->fin_tcpf & TH_SYN)) { 1414255332Scy SBUMPD(ipf_state_stats, iss_add_oow); 1415255332Scy return -1; 1416255332Scy } 1417255332Scy 1418255332Scy if ((softs->ipf_state_stats.iss_active * 100 / softs->ipf_state_max) > 1419255332Scy softs->ipf_state_wm_high) { 1420255332Scy softs->ipf_state_doflush = 1; 1421255332Scy } 1422255332Scy 1423145522Sdarrenr /* 1424145522Sdarrenr * If a "keep state" rule has reached the maximum number of references 1425145522Sdarrenr * to it, then schedule an automatic flush in case we can clear out 1426161356Sguido * some "dead old wood". Note that because the lock isn't held on 1427161356Sguido * fr it is possible that we could overflow. The cost of overflowing 1428161356Sguido * is being ignored here as the number by which it can overflow is 1429161356Sguido * a product of the number of simultaneous threads that could be 1430161356Sguido * executing in here, so a limit of 100 won't result in 200, but could 1431161356Sguido * result in 101 or 102. 1432145522Sdarrenr */ 1433161356Sguido fr = fin->fin_fr; 1434161356Sguido if (fr != NULL) { 1435255332Scy if ((softs->ipf_state_stats.iss_active >= 1436255332Scy softs->ipf_state_max) && (fr->fr_statemax == 0)) { 1437255332Scy SBUMPD(ipf_state_stats, iss_max); 1438255332Scy return 1; 1439161356Sguido } 1440161356Sguido if ((fr->fr_statemax != 0) && 1441161356Sguido (fr->fr_statecnt >= fr->fr_statemax)) { 1442255332Scy SBUMPD(ipf_state_stats, iss_max_ref); 1443255332Scy return 2; 1444161356Sguido } 1445145522Sdarrenr } 1446145522Sdarrenr 1447255332Scy is = &ips; 1448255332Scy if (fr == NULL) { 1449255332Scy pass = softc->ipf_flags; 1450255332Scy is->is_tag = FR_NOLOGTAG; 1451255332Scy } else { 1452255332Scy pass = fr->fr_flags; 1453255332Scy } 1454145522Sdarrenr 1455145522Sdarrenr ic = NULL; 1456145522Sdarrenr tcp = NULL; 145760854Sdarrenr out = fin->fin_out; 145853642Sguido bzero((char *)is, sizeof(*is)); 1459255332Scy is->is_die = 1 + softc->ipf_ticks; 1460255332Scy /* 1461255332Scy * We want to check everything that is a property of this packet, 1462323842Scy * but we don't (automatically) care about its fragment status as 1463255332Scy * this may change. 1464255332Scy */ 1465255332Scy is->is_pass = pass; 1466255332Scy is->is_v = fin->fin_v; 1467255332Scy is->is_sec = fin->fin_secmsk; 1468255332Scy is->is_secmsk = 0xffff; 1469255332Scy is->is_auth = fin->fin_auth; 1470255332Scy is->is_authmsk = 0xffff; 1471255332Scy is->is_family = fin->fin_family; 1472255332Scy is->is_opt[0] = fin->fin_optmsk; 1473255332Scy is->is_optmsk[0] = 0xffffffff; 1474255332Scy if (is->is_v == 6) { 1475255332Scy is->is_opt[0] &= ~0x8; 1476255332Scy is->is_optmsk[0] &= ~0x8; 1477255332Scy } 1478145522Sdarrenr 147953642Sguido /* 148053642Sguido * Copy and calculate... 148153642Sguido */ 148260854Sdarrenr hv = (is->is_p = fin->fin_fi.fi_p); 148360854Sdarrenr is->is_src = fin->fin_fi.fi_src; 148460854Sdarrenr hv += is->is_saddr; 148560854Sdarrenr is->is_dst = fin->fin_fi.fi_dst; 148660854Sdarrenr hv += is->is_daddr; 148760854Sdarrenr#ifdef USE_INET6 148860854Sdarrenr if (fin->fin_v == 6) { 1489145522Sdarrenr /* 1490145522Sdarrenr * For ICMPv6, we check to see if the destination address is 1491145522Sdarrenr * a multicast address. If it is, do not include it in the 1492145522Sdarrenr * calculation of the hash because the correct reply will come 1493145522Sdarrenr * back from a real address, not a multicast address. 1494145522Sdarrenr */ 149592685Sdarrenr if ((is->is_p == IPPROTO_ICMPV6) && 149692685Sdarrenr IN6_IS_ADDR_MULTICAST(&is->is_dst.in6)) { 149792685Sdarrenr /* 149892685Sdarrenr * So you can do keep state with neighbour discovery. 1499145522Sdarrenr * 1500145522Sdarrenr * Here we could use the address from the neighbour 1501145522Sdarrenr * solicit message to put in the state structure and 1502145522Sdarrenr * we could use that without a wildcard flag too... 150392685Sdarrenr */ 1504145522Sdarrenr flags |= SI_W_DADDR; 150592685Sdarrenr hv -= is->is_daddr; 150692685Sdarrenr } else { 150792685Sdarrenr hv += is->is_dst.i6[1]; 150892685Sdarrenr hv += is->is_dst.i6[2]; 150992685Sdarrenr hv += is->is_dst.i6[3]; 151060854Sdarrenr } 151192685Sdarrenr hv += is->is_src.i6[1]; 151292685Sdarrenr hv += is->is_src.i6[2]; 151392685Sdarrenr hv += is->is_src.i6[3]; 151460854Sdarrenr } 151560854Sdarrenr#endif 1516172776Sdarrenr if ((fin->fin_v == 4) && 1517172776Sdarrenr (fin->fin_flx & (FI_MULTICAST|FI_BROADCAST|FI_MBCAST))) { 1518255332Scy flags |= SI_W_DADDR; 1519255332Scy hv -= is->is_daddr; 1520172776Sdarrenr } 152153642Sguido 152260854Sdarrenr switch (is->is_p) 152353642Sguido { 152460854Sdarrenr#ifdef USE_INET6 152560854Sdarrenr case IPPROTO_ICMPV6 : 1526145522Sdarrenr ic = fin->fin_dp; 152753642Sguido 152853642Sguido switch (ic->icmp_type) 152953642Sguido { 153060854Sdarrenr case ICMP6_ECHO_REQUEST : 1531145522Sdarrenr hv += (is->is_icmp.ici_id = ic->icmp_id); 1532255332Scy /*FALLTHROUGH*/ 153360854Sdarrenr case ICMP6_MEMBERSHIP_QUERY : 153460854Sdarrenr case ND_ROUTER_SOLICIT : 153560854Sdarrenr case ND_NEIGHBOR_SOLICIT : 153692685Sdarrenr case ICMP6_NI_QUERY : 1537145522Sdarrenr is->is_icmp.ici_type = ic->icmp_type; 153860854Sdarrenr break; 153992685Sdarrenr default : 1540255332Scy SBUMPD(ipf_state_stats, iss_icmp6_notquery); 1541255332Scy return -2; 154292685Sdarrenr } 154392685Sdarrenr break; 154460854Sdarrenr#endif 154592685Sdarrenr case IPPROTO_ICMP : 1546145522Sdarrenr ic = fin->fin_dp; 154792685Sdarrenr 154892685Sdarrenr switch (ic->icmp_type) 154992685Sdarrenr { 155060854Sdarrenr case ICMP_ECHO : 155153642Sguido case ICMP_TSTAMP : 155253642Sguido case ICMP_IREQ : 155353642Sguido case ICMP_MASKREQ : 1554145522Sdarrenr is->is_icmp.ici_type = ic->icmp_type; 1555145522Sdarrenr hv += (is->is_icmp.ici_id = ic->icmp_id); 155653642Sguido break; 155753642Sguido default : 1558255332Scy SBUMPD(ipf_state_stats, iss_icmp_notquery); 1559255332Scy return -3; 156053642Sguido } 156153642Sguido break; 1562145522Sdarrenr 1563255332Scy#if 0 1564145522Sdarrenr case IPPROTO_GRE : 1565145522Sdarrenr gre = fin->fin_dp; 1566145522Sdarrenr 1567145522Sdarrenr is->is_gre.gs_flags = gre->gr_flags; 1568145522Sdarrenr is->is_gre.gs_ptype = gre->gr_ptype; 1569145522Sdarrenr if (GRE_REV(is->is_gre.gs_flags) == 1) { 1570145522Sdarrenr is->is_call[0] = fin->fin_data[0]; 1571145522Sdarrenr is->is_call[1] = fin->fin_data[1]; 1572145522Sdarrenr } 1573145522Sdarrenr break; 1574255332Scy#endif 1575145522Sdarrenr 157653642Sguido case IPPROTO_TCP : 1577145522Sdarrenr tcp = fin->fin_dp; 157853642Sguido 1579255332Scy if (tcp->th_flags & TH_RST) { 1580255332Scy SBUMPD(ipf_state_stats, iss_tcp_rstadd); 1581255332Scy return -4; 1582255332Scy } 1583255332Scy 1584255332Scy /* TRACE is, flags, hv */ 1585255332Scy 158653642Sguido /* 158753642Sguido * The endian of the ports doesn't matter, but the ack and 158853642Sguido * sequence numbers do as we do mathematics on them later. 158953642Sguido */ 159092685Sdarrenr is->is_sport = htons(fin->fin_data[0]); 159192685Sdarrenr is->is_dport = htons(fin->fin_data[1]); 1592145522Sdarrenr if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) { 159392685Sdarrenr hv += is->is_sport; 159492685Sdarrenr hv += is->is_dport; 159553642Sguido } 1596145522Sdarrenr 1597255332Scy /* TRACE is, flags, hv */ 1598255332Scy 1599145522Sdarrenr /* 1600145522Sdarrenr * If this is a real packet then initialise fields in the 1601145522Sdarrenr * state information structure from the TCP header information. 1602145522Sdarrenr */ 1603145522Sdarrenr 1604145522Sdarrenr is->is_maxdwin = 1; 1605145522Sdarrenr is->is_maxswin = ntohs(tcp->th_win); 1606145522Sdarrenr if (is->is_maxswin == 0) 1607145522Sdarrenr is->is_maxswin = 1; 1608145522Sdarrenr 1609145522Sdarrenr if ((fin->fin_flx & FI_IGNORE) == 0) { 161095563Sdarrenr is->is_send = ntohl(tcp->th_seq) + fin->fin_dlen - 1611145522Sdarrenr (TCP_OFF(tcp) << 2) + 161295563Sdarrenr ((tcp->th_flags & TH_SYN) ? 1 : 0) + 161395563Sdarrenr ((tcp->th_flags & TH_FIN) ? 1 : 0); 161495563Sdarrenr is->is_maxsend = is->is_send; 161595563Sdarrenr 1616145522Sdarrenr /* 1617145522Sdarrenr * Window scale option is only present in 1618145522Sdarrenr * SYN/SYN-ACK packet. 1619145522Sdarrenr */ 1620145522Sdarrenr if ((tcp->th_flags & ~(TH_FIN|TH_ACK|TH_ECNALL)) == 1621145522Sdarrenr TH_SYN && 1622145522Sdarrenr (TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) { 1623255332Scy if (ipf_tcpoptions(softs, fin, tcp, 1624255332Scy &is->is_tcp.ts_data[0]) == -1) 1625153876Sguido fin->fin_flx |= FI_BAD; 162698004Sdarrenr } 162795563Sdarrenr 1628145522Sdarrenr if ((fin->fin_out != 0) && (pass & FR_NEWISN) != 0) { 1629255332Scy ipf_checknewisn(fin, is); 1630255332Scy ipf_fixoutisn(fin, is); 1631145522Sdarrenr } 163295418Sdarrenr 1633145522Sdarrenr if ((tcp->th_flags & TH_OPENING) == TH_SYN) 1634145522Sdarrenr flags |= IS_TCPFSM; 1635145522Sdarrenr else { 1636145522Sdarrenr is->is_maxdwin = is->is_maxswin * 2; 1637145522Sdarrenr is->is_dend = ntohl(tcp->th_ack); 1638145522Sdarrenr is->is_maxdend = ntohl(tcp->th_ack); 1639145522Sdarrenr is->is_maxdwin *= 2; 1640145522Sdarrenr } 1641145522Sdarrenr } 164295418Sdarrenr 164353642Sguido /* 1644255332Scy * If we're creating state for a starting connection, start 1645255332Scy * the timer on it as we'll never see an error if it fails 1646255332Scy * to connect. 164753642Sguido */ 164853642Sguido break; 164992685Sdarrenr 165053642Sguido case IPPROTO_UDP : 1651145522Sdarrenr tcp = fin->fin_dp; 165253642Sguido 165392685Sdarrenr is->is_sport = htons(fin->fin_data[0]); 165492685Sdarrenr is->is_dport = htons(fin->fin_data[1]); 1655145522Sdarrenr if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) { 1656145522Sdarrenr hv += tcp->th_dport; 1657145522Sdarrenr hv += tcp->th_sport; 165853642Sguido } 165953642Sguido break; 1660145522Sdarrenr 166153642Sguido default : 166292685Sdarrenr break; 166353642Sguido } 1664145522Sdarrenr hv = DOUBLE_HASH(hv); 1665145522Sdarrenr is->is_hv = hv; 166653642Sguido 1667145522Sdarrenr /* 1668145522Sdarrenr * Look for identical state. 1669145522Sdarrenr */ 1670255332Scy for (is = softs->ipf_state_table[hv % softs->ipf_state_size]; 1671255332Scy is != NULL; is = is->is_hnext) { 1672255332Scy if (ipf_state_match(&ips, is) == 1) 1673145522Sdarrenr break; 1674145522Sdarrenr } 1675255332Scy if (is != NULL) { 1676255332Scy SBUMPD(ipf_state_stats, iss_add_dup); 1677255332Scy return 3; 1678255332Scy } 1679145522Sdarrenr 1680255332Scy if (softs->ipf_state_stats.iss_bucketlen[hv] >= 1681255332Scy softs->ipf_state_maxbucket) { 1682255332Scy SBUMPD(ipf_state_stats, iss_bucket_full); 1683255332Scy return 4; 1684145522Sdarrenr } 1685287984Scy 1686287984Scy /* 1687287984Scy * No existing state; create new 1688287984Scy */ 168953642Sguido KMALLOC(is, ipstate_t *); 169053642Sguido if (is == NULL) { 1691255332Scy SBUMPD(ipf_state_stats, iss_nomem); 1692255332Scy return 5; 169353642Sguido } 169453642Sguido bcopy((char *)&ips, (char *)is, sizeof(*is)); 1695255332Scy is->is_flags = flags & IS_INHERITED; 1696255332Scy is->is_rulen = fin->fin_rule; 1697255332Scy is->is_rule = fr; 1698255332Scy 1699145522Sdarrenr /* 1700287984Scy * Do not do the modulus here, it is done in ipf_state_insert(). 1701145522Sdarrenr */ 1702145522Sdarrenr if (fr != NULL) { 1703255332Scy ipftq_t *tq; 1704255332Scy 1705255332Scy (void) strncpy(is->is_group, FR_NAME(fr, fr_group), 1706255332Scy FR_GROUPLEN); 1707145522Sdarrenr if (fr->fr_age[0] != 0) { 1708255332Scy tq = ipf_addtimeoutqueue(softc, 1709255332Scy &softs->ipf_state_usertq, 1710255332Scy fr->fr_age[0]); 1711255332Scy is->is_tqehead[0] = tq; 1712145522Sdarrenr is->is_sti.tqe_flags |= TQE_RULEBASED; 1713145522Sdarrenr } 1714145522Sdarrenr if (fr->fr_age[1] != 0) { 1715255332Scy tq = ipf_addtimeoutqueue(softc, 1716255332Scy &softs->ipf_state_usertq, 1717255332Scy fr->fr_age[1]); 1718255332Scy is->is_tqehead[1] = tq; 1719145522Sdarrenr is->is_sti.tqe_flags |= TQE_RULEBASED; 1720145522Sdarrenr } 172192685Sdarrenr 1722145522Sdarrenr is->is_tag = fr->fr_logtag; 1723145522Sdarrenr } 172492685Sdarrenr 1725145522Sdarrenr /* 1726255332Scy * It may seem strange to set is_ref to 2, but if stsave is not NULL 1727255332Scy * then a copy of the pointer is being stored somewhere else and in 1728287984Scy * the end, it will expect to be able to do something with it. 1729145522Sdarrenr */ 1730255332Scy is->is_me = stsave; 1731255332Scy if (stsave != NULL) { 1732255332Scy *stsave = is; 1733255332Scy is->is_ref = 2; 1734255332Scy } else { 1735255332Scy is->is_ref = 1; 1736255332Scy } 1737145522Sdarrenr is->is_pkts[0] = 0, is->is_bytes[0] = 0; 1738145522Sdarrenr is->is_pkts[1] = 0, is->is_bytes[1] = 0; 1739145522Sdarrenr is->is_pkts[2] = 0, is->is_bytes[2] = 0; 1740145522Sdarrenr is->is_pkts[3] = 0, is->is_bytes[3] = 0; 1741145522Sdarrenr if ((fin->fin_flx & FI_IGNORE) == 0) { 1742145522Sdarrenr is->is_pkts[out] = 1; 1743255332Scy fin->fin_pktnum = 1; 1744145522Sdarrenr is->is_bytes[out] = fin->fin_plen; 1745145522Sdarrenr is->is_flx[out][0] = fin->fin_flx & FI_CMP; 1746145522Sdarrenr is->is_flx[out][0] &= ~FI_OOW; 174792685Sdarrenr } 1748145522Sdarrenr 1749255332Scy if (pass & FR_STLOOSE) 1750255332Scy is->is_flags |= IS_LOOSE; 1751255332Scy 1752145522Sdarrenr if (pass & FR_STSTRICT) 1753145522Sdarrenr is->is_flags |= IS_STRICT; 1754145522Sdarrenr 1755145522Sdarrenr if (pass & FR_STATESYNC) 1756145522Sdarrenr is->is_flags |= IS_STATESYNC; 1757145522Sdarrenr 1758255332Scy if (pass & FR_LOGFIRST) 1759255332Scy is->is_pass &= ~(FR_LOGFIRST|FR_LOG); 1760255332Scy 1761255332Scy READ_ENTER(&softc->ipf_state); 1762255332Scy 1763255332Scy if (ipf_state_insert(softc, is, fin->fin_rev) == -1) { 1764255332Scy RWLOCK_EXIT(&softc->ipf_state); 1765255332Scy /* 1766255332Scy * This is a bit more manual than it should be but 1767255332Scy * ipf_state_del cannot be called. 1768255332Scy */ 1769255332Scy MUTEX_EXIT(&is->is_lock); 1770255332Scy MUTEX_DESTROY(&is->is_lock); 1771255332Scy if (is->is_tqehead[0] != NULL) { 1772255332Scy if (ipf_deletetimeoutqueue(is->is_tqehead[0]) == 0) 1773255332Scy ipf_freetimeoutqueue(softc, is->is_tqehead[0]); 1774255332Scy is->is_tqehead[0] = NULL; 1775255332Scy } 1776255332Scy if (is->is_tqehead[1] != NULL) { 1777255332Scy if (ipf_deletetimeoutqueue(is->is_tqehead[1]) == 0) 1778255332Scy ipf_freetimeoutqueue(softc, is->is_tqehead[1]); 1779255332Scy is->is_tqehead[1] = NULL; 1780255332Scy } 1781255332Scy KFREE(is); 1782255332Scy return -1; 1783255332Scy } 1784255332Scy 178553642Sguido /* 1786255332Scy * Filling in the interface name is after the insert so that an 1787255332Scy * event (such as add/delete) of an interface that is referenced 1788255332Scy * by this rule will see this state entry. 178953642Sguido */ 1790255332Scy if (fr != NULL) { 1791255332Scy /* 1792255332Scy * The name '-' is special for network interfaces and causes 1793255332Scy * a NULL name to be present, always, allowing packets to 1794255332Scy * match it, regardless of their interface. 1795255332Scy */ 1796255332Scy if ((fin->fin_ifp == NULL) || 1797255332Scy (fr->fr_ifnames[out << 1] != -1 && 1798255332Scy fr->fr_names[fr->fr_ifnames[out << 1] + 0] == '-' && 1799255332Scy fr->fr_names[fr->fr_ifnames[out << 1] + 1] == '\0')) { 1800255332Scy is->is_ifp[out << 1] = fr->fr_ifas[0]; 1801255332Scy strncpy(is->is_ifname[out << 1], 1802255332Scy fr->fr_names + fr->fr_ifnames[0], 1803255332Scy sizeof(fr->fr_ifnames[0])); 1804255332Scy } else { 1805255332Scy is->is_ifp[out << 1] = fin->fin_ifp; 1806255332Scy COPYIFNAME(fin->fin_v, fin->fin_ifp, 1807255332Scy is->is_ifname[out << 1]); 1808255332Scy } 180992685Sdarrenr 1810255332Scy is->is_ifp[(out << 1) + 1] = fr->fr_ifas[1]; 1811255332Scy if (fr->fr_ifnames[1] != -1) { 1812255332Scy strncpy(is->is_ifname[(out << 1) + 1], 1813255332Scy fr->fr_names + fr->fr_ifnames[1], 1814255332Scy sizeof(fr->fr_ifnames[1])); 1815255332Scy } 1816145522Sdarrenr 1817255332Scy is->is_ifp[(1 - out) << 1] = fr->fr_ifas[2]; 1818255332Scy if (fr->fr_ifnames[2] != -1) { 1819255332Scy strncpy(is->is_ifname[((1 - out) << 1)], 1820255332Scy fr->fr_names + fr->fr_ifnames[2], 1821255332Scy sizeof(fr->fr_ifnames[2])); 1822255332Scy } 1823145522Sdarrenr 1824255332Scy is->is_ifp[((1 - out) << 1) + 1] = fr->fr_ifas[3]; 1825255332Scy if (fr->fr_ifnames[3] != -1) { 1826255332Scy strncpy(is->is_ifname[((1 - out) << 1) + 1], 1827255332Scy fr->fr_names + fr->fr_ifnames[3], 1828255332Scy sizeof(fr->fr_ifnames[3])); 1829255332Scy } 1830255332Scy } else { 1831255332Scy if (fin->fin_ifp != NULL) { 1832255332Scy is->is_ifp[out << 1] = fin->fin_ifp; 1833255332Scy COPYIFNAME(fin->fin_v, fin->fin_ifp, 1834255332Scy is->is_ifname[out << 1]); 1835255332Scy } 1836255332Scy } 1837145522Sdarrenr 1838145522Sdarrenr if (fin->fin_p == IPPROTO_TCP) { 1839145522Sdarrenr /* 1840145522Sdarrenr * If we're creating state for a starting connection, start the 1841145522Sdarrenr * timer on it as we'll never see an error if it fails to 1842145522Sdarrenr * connect. 1843145522Sdarrenr */ 1844255332Scy (void) ipf_tcp_age(&is->is_sti, fin, softs->ipf_state_tcptq, 1845255332Scy is->is_flags, 2); 184660854Sdarrenr } 1847255332Scy MUTEX_EXIT(&is->is_lock); 1848145522Sdarrenr if ((is->is_flags & IS_STATESYNC) && ((is->is_flags & SI_CLONE) == 0)) 1849255332Scy is->is_sync = ipf_sync_new(softc, SMC_STATE, fin, is); 1850255332Scy if (softs->ipf_state_logging) 1851255332Scy ipf_state_log(softc, is, ISL_NEW); 1852145522Sdarrenr 1853255332Scy RWLOCK_EXIT(&softc->ipf_state); 1854255332Scy 1855145522Sdarrenr fin->fin_flx |= FI_STATE; 1856145522Sdarrenr if (fin->fin_flx & FI_FRAG) 1857255332Scy (void) ipf_frag_new(softc, fin, pass); 1858145522Sdarrenr 1859255332Scy fdp = &fr->fr_tifs[0]; 1860255332Scy if (fdp->fd_type == FRD_DSTLIST) { 1861255332Scy ipf_dstlist_select_node(fin, fdp->fd_ptr, NULL, 1862255332Scy &is->is_tifs[0]); 1863255332Scy } else { 1864255332Scy bcopy(fdp, &is->is_tifs[0], sizeof(*fdp)); 1865255332Scy } 1866255332Scy 1867255332Scy fdp = &fr->fr_tifs[1]; 1868255332Scy if (fdp->fd_type == FRD_DSTLIST) { 1869255332Scy ipf_dstlist_select_node(fin, fdp->fd_ptr, NULL, 1870255332Scy &is->is_tifs[1]); 1871255332Scy } else { 1872255332Scy bcopy(fdp, &is->is_tifs[1], sizeof(*fdp)); 1873255332Scy } 1874255332Scy fin->fin_tif = &is->is_tifs[fin->fin_rev]; 1875255332Scy 1876255332Scy fdp = &fr->fr_dif; 1877255332Scy if (fdp->fd_type == FRD_DSTLIST) { 1878255332Scy ipf_dstlist_select_node(fin, fdp->fd_ptr, NULL, 1879255332Scy &is->is_dif); 1880255332Scy } else { 1881255332Scy bcopy(fdp, &is->is_dif, sizeof(*fdp)); 1882255332Scy } 1883255332Scy fin->fin_dif = &is->is_dif; 1884255332Scy 1885255332Scy return 0; 188653642Sguido} 188753642Sguido 188853642Sguido 1889145522Sdarrenr/* ------------------------------------------------------------------------ */ 1890255332Scy/* Function: ipf_tcpoptions */ 1891153876Sguido/* Returns: int - 1 == packet matches state entry, 0 == it does not, */ 1892153876Sguido/* -1 == packet has bad TCP options data */ 1893255332Scy/* Parameters: softs(I) - pointer to state context structure */ 1894255332Scy/* fin(I) - pointer to packet information */ 1895145522Sdarrenr/* tcp(I) - pointer to TCP packet header */ 1896145522Sdarrenr/* td(I) - pointer to TCP data held as part of the state */ 1897145522Sdarrenr/* */ 1898145522Sdarrenr/* Look after the TCP header for any options and deal with those that are */ 1899145522Sdarrenr/* present. Record details about those that we recogise. */ 1900145522Sdarrenr/* ------------------------------------------------------------------------ */ 1901255332Scystatic int 1902255332Scyipf_tcpoptions(softs, fin, tcp, td) 1903255332Scy ipf_state_softc_t *softs; 1904255332Scy fr_info_t *fin; 1905255332Scy tcphdr_t *tcp; 1906255332Scy tcpdata_t *td; 190795418Sdarrenr{ 1908145522Sdarrenr int off, mlen, ol, i, len, retval; 1909145522Sdarrenr char buf[64], *s, opt; 1910145522Sdarrenr mb_t *m = NULL; 191153642Sguido 1912153876Sguido len = (TCP_OFF(tcp) << 2); 1913255332Scy if (fin->fin_dlen < len) { 1914255332Scy SBUMPD(ipf_state_stats, iss_tcp_toosmall); 1915145522Sdarrenr return 0; 1916255332Scy } 1917153876Sguido len -= sizeof(*tcp); 191895418Sdarrenr 1919153876Sguido off = fin->fin_plen - fin->fin_dlen + sizeof(*tcp) + fin->fin_ipoff; 1920153876Sguido 1921145522Sdarrenr m = fin->fin_m; 1922145522Sdarrenr mlen = MSGDSIZE(m) - off; 1923145522Sdarrenr if (len > mlen) { 1924145522Sdarrenr len = mlen; 1925145522Sdarrenr retval = 0; 1926145522Sdarrenr } else { 1927145522Sdarrenr retval = 1; 1928145522Sdarrenr } 192995418Sdarrenr 1930145522Sdarrenr COPYDATA(m, off, len, buf); 1931145522Sdarrenr 1932145522Sdarrenr for (s = buf; len > 0; ) { 1933145522Sdarrenr opt = *s; 1934145522Sdarrenr if (opt == TCPOPT_EOL) 193595418Sdarrenr break; 1936145522Sdarrenr else if (opt == TCPOPT_NOP) 1937145522Sdarrenr ol = 1; 1938145522Sdarrenr else { 1939145522Sdarrenr if (len < 2) 194095418Sdarrenr break; 1941145522Sdarrenr ol = (int)*(s + 1); 1942145522Sdarrenr if (ol < 2 || ol > len) 1943145522Sdarrenr break; 1944145522Sdarrenr 1945145522Sdarrenr /* 1946145522Sdarrenr * Extract the TCP options we are interested in out of 1947145522Sdarrenr * the header and store them in the the tcpdata struct. 1948145522Sdarrenr */ 1949145522Sdarrenr switch (opt) 1950145522Sdarrenr { 1951145522Sdarrenr case TCPOPT_WINDOW : 1952145522Sdarrenr if (ol == TCPOLEN_WINDOW) { 1953145522Sdarrenr i = (int)*(s + 2); 1954145522Sdarrenr if (i > TCP_WSCALE_MAX) 1955145522Sdarrenr i = TCP_WSCALE_MAX; 1956145522Sdarrenr else if (i < 0) 1957145522Sdarrenr i = 0; 1958145522Sdarrenr td->td_winscale = i; 1959153876Sguido td->td_winflags |= TCP_WSCALE_SEEN| 1960153876Sguido TCP_WSCALE_FIRST; 1961153876Sguido } else 1962153876Sguido retval = -1; 1963145522Sdarrenr break; 1964145522Sdarrenr case TCPOPT_MAXSEG : 1965145522Sdarrenr /* 1966145522Sdarrenr * So, if we wanted to set the TCP MAXSEG, 1967145522Sdarrenr * it should be done here... 1968145522Sdarrenr */ 1969145522Sdarrenr if (ol == TCPOLEN_MAXSEG) { 1970145522Sdarrenr i = (int)*(s + 2); 1971145522Sdarrenr i <<= 8; 1972145522Sdarrenr i += (int)*(s + 3); 1973145522Sdarrenr td->td_maxseg = i; 1974153876Sguido } else 1975153876Sguido retval = -1; 1976145522Sdarrenr break; 1977153876Sguido case TCPOPT_SACK_PERMITTED : 1978153876Sguido if (ol == TCPOLEN_SACK_PERMITTED) 1979153876Sguido td->td_winflags |= TCP_SACK_PERMIT; 1980153876Sguido else 1981153876Sguido retval = -1; 1982153876Sguido break; 1983145522Sdarrenr } 198495418Sdarrenr } 1985145522Sdarrenr len -= ol; 1986145522Sdarrenr s += ol; 198795418Sdarrenr } 1988255332Scy if (retval == -1) { 1989255332Scy SBUMPD(ipf_state_stats, iss_tcp_badopt); 1990255332Scy } 1991145522Sdarrenr return retval; 199295418Sdarrenr} 199395418Sdarrenr 199495418Sdarrenr 1995145522Sdarrenr/* ------------------------------------------------------------------------ */ 1996255332Scy/* Function: ipf_state_tcp */ 1997145522Sdarrenr/* Returns: int - 1 == packet matches state entry, 0 == it does not */ 1998255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 1999255332Scy/* softs(I) - pointer to state context structure */ 2000255332Scy/* fin(I) - pointer to packet information */ 2001145522Sdarrenr/* tcp(I) - pointer to TCP packet header */ 2002145522Sdarrenr/* is(I) - pointer to master state structure */ 2003145522Sdarrenr/* */ 2004145522Sdarrenr/* Check to see if a packet with TCP headers fits within the TCP window. */ 2005145522Sdarrenr/* Change timeout depending on whether new packet is a SYN-ACK returning */ 2006145522Sdarrenr/* for a SYN or a RST or FIN which indicate time to close up shop. */ 2007145522Sdarrenr/* ------------------------------------------------------------------------ */ 2008255332Scystatic int 2009255332Scyipf_state_tcp(softc, softs, fin, tcp, is) 2010255332Scy ipf_main_softc_t *softc; 2011255332Scy ipf_state_softc_t *softs; 2012255332Scy fr_info_t *fin; 2013255332Scy tcphdr_t *tcp; 2014255332Scy ipstate_t *is; 201553642Sguido{ 201653642Sguido tcpdata_t *fdata, *tdata; 2017255332Scy int source, ret, flags; 201853642Sguido 2019145522Sdarrenr source = !fin->fin_rev; 2020255332Scy if (((is->is_flags & IS_TCPFSM) != 0) && (source == 1) && 2021145522Sdarrenr (ntohs(is->is_sport) != fin->fin_data[0])) 2022145522Sdarrenr source = 0; 2023145522Sdarrenr fdata = &is->is_tcp.ts_data[!source]; 2024145522Sdarrenr tdata = &is->is_tcp.ts_data[source]; 2025145522Sdarrenr 2026145522Sdarrenr MUTEX_ENTER(&is->is_lock); 2027170268Sdarrenr 2028170268Sdarrenr /* 2029170268Sdarrenr * If a SYN packet is received for a connection that is on the way out 2030170268Sdarrenr * but hasn't yet departed then advance this session along the way. 2031170268Sdarrenr */ 2032170268Sdarrenr if ((tcp->th_flags & TH_OPENING) == TH_SYN) { 2033170268Sdarrenr if ((is->is_state[0] > IPF_TCPS_ESTABLISHED) && 2034170268Sdarrenr (is->is_state[1] > IPF_TCPS_ESTABLISHED)) { 2035170268Sdarrenr is->is_state[!source] = IPF_TCPS_CLOSED; 2036255332Scy ipf_movequeue(softc->ipf_ticks, &is->is_sti, 2037255332Scy is->is_sti.tqe_ifq, 2038255332Scy &softs->ipf_state_deletetq); 2039172776Sdarrenr MUTEX_EXIT(&is->is_lock); 2040255332Scy DT1(iss_tcp_closing, ipstate_t *, is); 2041255332Scy SBUMP(ipf_state_stats.iss_tcp_closing); 2042170268Sdarrenr return 0; 2043170268Sdarrenr } 2044170268Sdarrenr } 2045170268Sdarrenr 2046255332Scy if (is->is_flags & IS_LOOSE) 2047255332Scy ret = 1; 2048255332Scy else 2049255332Scy ret = ipf_state_tcpinwindow(fin, fdata, tdata, tcp, 2050255332Scy is->is_flags); 2051172776Sdarrenr if (ret > 0) { 2052145522Sdarrenr /* 2053145522Sdarrenr * Nearing end of connection, start timeout. 2054145522Sdarrenr */ 2055255332Scy ret = ipf_tcp_age(&is->is_sti, fin, softs->ipf_state_tcptq, 2056255332Scy is->is_flags, ret); 2057145522Sdarrenr if (ret == 0) { 2058145522Sdarrenr MUTEX_EXIT(&is->is_lock); 2059255332Scy DT2(iss_tcp_fsm, fr_info_t *, fin, ipstate_t *, is); 2060255332Scy SBUMP(ipf_state_stats.iss_tcp_fsm); 2061145522Sdarrenr return 0; 2062145522Sdarrenr } 2063145522Sdarrenr 2064255332Scy if (softs->ipf_state_logging > 4) 2065255332Scy ipf_state_log(softc, is, ISL_STATECHANGE); 2066255332Scy 2067145522Sdarrenr /* 2068145522Sdarrenr * set s0's as appropriate. Use syn-ack packet as it 2069145522Sdarrenr * contains both pieces of required information. 2070145522Sdarrenr */ 2071145522Sdarrenr /* 2072145522Sdarrenr * Window scale option is only present in SYN/SYN-ACK packet. 2073145522Sdarrenr * Compare with ~TH_FIN to mask out T/TCP setups. 2074145522Sdarrenr */ 2075145522Sdarrenr flags = tcp->th_flags & ~(TH_FIN|TH_ECNALL); 2076145522Sdarrenr if (flags == (TH_SYN|TH_ACK)) { 2077145522Sdarrenr is->is_s0[source] = ntohl(tcp->th_ack); 2078145522Sdarrenr is->is_s0[!source] = ntohl(tcp->th_seq) + 1; 2079165515Sdarrenr if ((TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) { 2080255332Scy if (ipf_tcpoptions(softs, fin, tcp, 2081255332Scy fdata) == -1) 2082153876Sguido fin->fin_flx |= FI_BAD; 2083145522Sdarrenr } 2084145522Sdarrenr if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN)) 2085255332Scy ipf_checknewisn(fin, is); 2086145522Sdarrenr } else if (flags == TH_SYN) { 2087145522Sdarrenr is->is_s0[source] = ntohl(tcp->th_seq) + 1; 2088153876Sguido if ((TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) { 2089255332Scy if (ipf_tcpoptions(softs, fin, tcp, 2090255332Scy fdata) == -1) 2091153876Sguido fin->fin_flx |= FI_BAD; 2092153876Sguido } 2093145522Sdarrenr 2094145522Sdarrenr if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN)) 2095255332Scy ipf_checknewisn(fin, is); 2096145522Sdarrenr 2097145522Sdarrenr } 2098145522Sdarrenr ret = 1; 2099170268Sdarrenr } else { 2100255332Scy DT2(iss_tcp_oow, fr_info_t *, fin, ipstate_t *, is); 2101255332Scy SBUMP(ipf_state_stats.iss_tcp_oow); 2102255332Scy ret = 0; 2103170268Sdarrenr } 2104145522Sdarrenr MUTEX_EXIT(&is->is_lock); 2105145522Sdarrenr return ret; 2106145522Sdarrenr} 2107145522Sdarrenr 2108145522Sdarrenr 2109145522Sdarrenr/* ------------------------------------------------------------------------ */ 2110255332Scy/* Function: ipf_checknewisn */ 2111145522Sdarrenr/* Returns: Nil */ 2112145522Sdarrenr/* Parameters: fin(I) - pointer to packet information */ 2113145522Sdarrenr/* is(I) - pointer to master state structure */ 2114145522Sdarrenr/* */ 2115145522Sdarrenr/* Check to see if this TCP connection is expecting and needs a new */ 2116145522Sdarrenr/* sequence number for a particular direction of the connection. */ 2117145522Sdarrenr/* */ 2118145522Sdarrenr/* NOTE: This does not actually change the sequence numbers, only gets new */ 2119145522Sdarrenr/* one ready. */ 2120145522Sdarrenr/* ------------------------------------------------------------------------ */ 2121255332Scystatic void 2122255332Scyipf_checknewisn(fin, is) 2123255332Scy fr_info_t *fin; 2124255332Scy ipstate_t *is; 2125145522Sdarrenr{ 2126145522Sdarrenr u_32_t sumd, old, new; 2127145522Sdarrenr tcphdr_t *tcp; 2128145522Sdarrenr int i; 2129145522Sdarrenr 2130145522Sdarrenr i = fin->fin_rev; 2131145522Sdarrenr tcp = fin->fin_dp; 2132145522Sdarrenr 2133145522Sdarrenr if (((i == 0) && !(is->is_flags & IS_ISNSYN)) || 2134145522Sdarrenr ((i == 1) && !(is->is_flags & IS_ISNACK))) { 2135145522Sdarrenr old = ntohl(tcp->th_seq); 2136255332Scy new = ipf_newisn(fin); 2137145522Sdarrenr is->is_isninc[i] = new - old; 2138145522Sdarrenr CALC_SUMD(old, new, sumd); 2139145522Sdarrenr is->is_sumd[i] = (sumd & 0xffff) + (sumd >> 16); 2140145522Sdarrenr 2141145522Sdarrenr is->is_flags |= ((i == 0) ? IS_ISNSYN : IS_ISNACK); 2142145522Sdarrenr } 2143145522Sdarrenr} 2144145522Sdarrenr 2145145522Sdarrenr 2146145522Sdarrenr/* ------------------------------------------------------------------------ */ 2147255332Scy/* Function: ipf_state_tcpinwindow */ 2148255332Scy/* Returns: int - 1 == packet inside TCP "window", 0 == not inside. */ 2149145522Sdarrenr/* Parameters: fin(I) - pointer to packet information */ 2150145522Sdarrenr/* fdata(I) - pointer to tcp state informatio (forward) */ 2151145522Sdarrenr/* tdata(I) - pointer to tcp state informatio (reverse) */ 2152145522Sdarrenr/* tcp(I) - pointer to TCP packet header */ 2153145522Sdarrenr/* */ 2154145522Sdarrenr/* Given a packet has matched addresses and ports, check to see if it is */ 2155145522Sdarrenr/* within the TCP data window. In a show of generosity, allow packets that */ 2156145522Sdarrenr/* are within the window space behind the current sequence # as well. */ 2157145522Sdarrenr/* ------------------------------------------------------------------------ */ 2158255332Scystatic int 2159255332Scyipf_state_tcpinwindow(fin, fdata, tdata, tcp, flags) 2160255332Scy fr_info_t *fin; 2161255332Scy tcpdata_t *fdata, *tdata; 2162255332Scy tcphdr_t *tcp; 2163255332Scy int flags; 2164145522Sdarrenr{ 2165255332Scy ipf_main_softc_t *softc = fin->fin_main_soft; 2166255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 2167145522Sdarrenr tcp_seq seq, ack, end; 2168145522Sdarrenr int ackskew, tcpflags; 2169145522Sdarrenr u_32_t win, maxwin; 2170153876Sguido int dsize, inseq; 2171145522Sdarrenr 217253642Sguido /* 217353642Sguido * Find difference between last checked packet and this packet. 217453642Sguido */ 2175145522Sdarrenr tcpflags = tcp->th_flags; 217653642Sguido seq = ntohl(tcp->th_seq); 217753642Sguido ack = ntohl(tcp->th_ack); 2178145522Sdarrenr if (tcpflags & TH_SYN) 2179145522Sdarrenr win = ntohs(tcp->th_win); 218095418Sdarrenr else 2181145522Sdarrenr win = ntohs(tcp->th_win) << fdata->td_winscale; 2182153876Sguido 2183153876Sguido /* 2184153876Sguido * A window of 0 produces undesirable behaviour from this function. 2185153876Sguido */ 2186145522Sdarrenr if (win == 0) 2187145522Sdarrenr win = 1; 218895418Sdarrenr 2189153876Sguido dsize = fin->fin_dlen - (TCP_OFF(tcp) << 2) + 2190153876Sguido ((tcpflags & TH_SYN) ? 1 : 0) + ((tcpflags & TH_FIN) ? 1 : 0); 2191153876Sguido 2192145522Sdarrenr /* 2193145522Sdarrenr * if window scaling is present, the scaling is only allowed 2194145522Sdarrenr * for windows not in the first SYN packet. In that packet the 2195145522Sdarrenr * window is 65535 to specify the largest window possible 2196145522Sdarrenr * for receivers not implementing the window scale option. 2197145522Sdarrenr * Currently, we do not assume TTCP here. That means that 2198145522Sdarrenr * if we see a second packet from a host (after the initial 2199145522Sdarrenr * SYN), we can assume that the receiver of the SYN did 2200145522Sdarrenr * already send back the SYN/ACK (and thus that we know if 2201145522Sdarrenr * the receiver also does window scaling) 2202145522Sdarrenr */ 2203145522Sdarrenr if (!(tcpflags & TH_SYN) && (fdata->td_winflags & TCP_WSCALE_FIRST)) { 2204165515Sdarrenr fdata->td_winflags &= ~TCP_WSCALE_FIRST; 2205165515Sdarrenr fdata->td_maxwin = win; 2206145522Sdarrenr } 220795418Sdarrenr 2208153876Sguido end = seq + dsize; 220995418Sdarrenr 221095418Sdarrenr if ((fdata->td_end == 0) && 2211145522Sdarrenr (!(flags & IS_TCPFSM) || 2212145522Sdarrenr ((tcpflags & TH_OPENING) == TH_OPENING))) { 221353642Sguido /* 221453642Sguido * Must be a (outgoing) SYN-ACK in reply to a SYN. 221553642Sguido */ 2216153876Sguido fdata->td_end = end - 1; 221753642Sguido fdata->td_maxwin = 1; 221898004Sdarrenr fdata->td_maxend = end + win; 221953642Sguido } 222053642Sguido 2221145522Sdarrenr if (!(tcpflags & TH_ACK)) { /* Pretend an ack was sent */ 222253642Sguido ack = tdata->td_end; 2223145522Sdarrenr } else if (((tcpflags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) && 222453642Sguido (ack == 0)) { 222553642Sguido /* gross hack to get around certain broken tcp stacks */ 222653642Sguido ack = tdata->td_end; 222753642Sguido } 222853642Sguido 222953642Sguido maxwin = tdata->td_maxwin; 223053642Sguido ackskew = tdata->td_end - ack; 223153642Sguido 2232145522Sdarrenr /* 2233145522Sdarrenr * Strict sequencing only allows in-order delivery. 2234145522Sdarrenr */ 2235255332Scy if ((flags & IS_STRICT) != 0) { 2236255332Scy if (seq != fdata->td_end) { 2237255332Scy DT2(iss_tcp_struct, tcpdata_t *, fdata, int, seq); 2238255332Scy SBUMP(ipf_state_stats.iss_tcp_strict); 2239255332Scy fin->fin_flx |= FI_OOW; 2240145522Sdarrenr return 0; 2241145522Sdarrenr } 2242145522Sdarrenr } 2243145522Sdarrenr 2244255332Scy#define SEQ_GE(a,b) ((int)((a) - (b)) >= 0) 2245255332Scy#define SEQ_GT(a,b) ((int)((a) - (b)) > 0) 2246153876Sguido inseq = 0; 2247153876Sguido if ((SEQ_GE(fdata->td_maxend, end)) && 224857096Sguido (SEQ_GE(seq, fdata->td_end - maxwin)) && 224953642Sguido/* XXX what about big packets */ 225053642Sguido#define MAXACKWINDOW 66000 2251165515Sdarrenr (-ackskew <= (MAXACKWINDOW)) && 2252145522Sdarrenr ( ackskew <= (MAXACKWINDOW << fdata->td_winscale))) { 2253153876Sguido inseq = 1; 2254153876Sguido /* 2255153876Sguido * Microsoft Windows will send the next packet to the right of the 2256153876Sguido * window if SACK is in use. 2257153876Sguido */ 2258153876Sguido } else if ((seq == fdata->td_maxend) && (ackskew == 0) && 2259153876Sguido (fdata->td_winflags & TCP_SACK_PERMIT) && 2260153876Sguido (tdata->td_winflags & TCP_SACK_PERMIT)) { 2261255332Scy DT2(iss_sinsack, tcpdata_t *, fdata, int, seq); 2262255332Scy SBUMP(ipf_state_stats.iss_winsack); 2263153876Sguido inseq = 1; 2264161356Sguido /* 2265161356Sguido * Sometimes a TCP RST will be generated with only the ACK field 2266161356Sguido * set to non-zero. 2267161356Sguido */ 2268161356Sguido } else if ((seq == 0) && (tcpflags == (TH_RST|TH_ACK)) && 2269161356Sguido (ackskew >= -1) && (ackskew <= 1)) { 2270161356Sguido inseq = 1; 2271161356Sguido } else if (!(flags & IS_TCPFSM)) { 2272161356Sguido int i; 2273161356Sguido 2274161356Sguido i = (fin->fin_rev << 1) + fin->fin_out; 2275161356Sguido 2276161356Sguido#if 0 2277161356Sguido if (is_pkts[i]0 == 0) { 2278161356Sguido /* 2279161356Sguido * Picking up a connection in the middle, the "next" 2280161356Sguido * packet seen from a direction that is new should be 2281161356Sguido * accepted, even if it appears out of sequence. 2282161356Sguido */ 2283161356Sguido inseq = 1; 2284255332Scy } else 2285161356Sguido#endif 2286161356Sguido if (!(fdata->td_winflags & 2287161356Sguido (TCP_WSCALE_SEEN|TCP_WSCALE_FIRST))) { 2288161356Sguido /* 2289161356Sguido * No TCPFSM and no window scaling, so make some 2290161356Sguido * extra guesses. 2291161356Sguido */ 2292161356Sguido if ((seq == fdata->td_maxend) && (ackskew == 0)) 2293161356Sguido inseq = 1; 2294161356Sguido else if (SEQ_GE(seq + maxwin, fdata->td_end - maxwin)) 2295161356Sguido inseq = 1; 2296161356Sguido } 2297153876Sguido } 2298130886Sdarrenr 2299165515Sdarrenr /* TRACE(inseq, fdata, tdata, seq, end, ack, ackskew, win, maxwin) */ 2300165515Sdarrenr 2301153876Sguido if (inseq) { 2302130886Sdarrenr /* if ackskew < 0 then this should be due to fragmented 230353642Sguido * packets. There is no way to know the length of the 230453642Sguido * total packet in advance. 230553642Sguido * We do know the total length from the fragment cache though. 230653642Sguido * Note however that there might be more sessions with 2307130886Sdarrenr * exactly the same source and destination parameters in the 230853642Sguido * state cache (and source and destination is the only stuff 230953642Sguido * that is saved in the fragment cache). Note further that 231053642Sguido * some TCP connections in the state cache are hashed with 231153642Sguido * sport and dport as well which makes it not worthwhile to 231253642Sguido * look for them. 231353642Sguido * Thus, when ackskew is negative but still seems to belong 231453642Sguido * to this session, we bump up the destinations end value. 231553642Sguido */ 2316145522Sdarrenr if (ackskew < 0) 2317145522Sdarrenr tdata->td_end = ack; 231895418Sdarrenr 2319145522Sdarrenr /* update max window seen */ 2320145522Sdarrenr if (fdata->td_maxwin < win) 2321145522Sdarrenr fdata->td_maxwin = win; 2322145522Sdarrenr if (SEQ_GT(end, fdata->td_end)) 2323145522Sdarrenr fdata->td_end = end; 2324145522Sdarrenr if (SEQ_GE(ack + win, tdata->td_maxend)) 2325145522Sdarrenr tdata->td_maxend = ack + win; 2326145522Sdarrenr return 1; 2327145522Sdarrenr } 2328255332Scy SBUMP(ipf_state_stats.iss_oow); 2329255332Scy fin->fin_flx |= FI_OOW; 2330145522Sdarrenr return 0; 2331145522Sdarrenr} 233295418Sdarrenr 2333145522Sdarrenr 2334145522Sdarrenr/* ------------------------------------------------------------------------ */ 2335255332Scy/* Function: ipf_state_clone */ 2336145522Sdarrenr/* Returns: ipstate_t* - NULL == cloning failed, */ 2337145522Sdarrenr/* else pointer to new state structure */ 2338145522Sdarrenr/* Parameters: fin(I) - pointer to packet information */ 2339145522Sdarrenr/* tcp(I) - pointer to TCP/UDP header */ 2340145522Sdarrenr/* is(I) - pointer to master state structure */ 2341145522Sdarrenr/* */ 2342145522Sdarrenr/* Create a "duplcate" state table entry from the master. */ 2343145522Sdarrenr/* ------------------------------------------------------------------------ */ 2344255332Scystatic ipstate_t * 2345255332Scyipf_state_clone(fin, tcp, is) 2346255332Scy fr_info_t *fin; 2347255332Scy tcphdr_t *tcp; 2348255332Scy ipstate_t *is; 2349145522Sdarrenr{ 2350255332Scy ipf_main_softc_t *softc = fin->fin_main_soft; 2351255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 2352145522Sdarrenr ipstate_t *clone; 2353145522Sdarrenr u_32_t send; 2354145522Sdarrenr 2355255332Scy if (softs->ipf_state_stats.iss_active == softs->ipf_state_max) { 2356255332Scy SBUMPD(ipf_state_stats, iss_max); 2357255332Scy softs->ipf_state_doflush = 1; 2358145522Sdarrenr return NULL; 235953642Sguido } 2360145522Sdarrenr KMALLOC(clone, ipstate_t *); 2361255332Scy if (clone == NULL) { 2362255332Scy SBUMPD(ipf_state_stats, iss_clone_nomem); 2363145522Sdarrenr return NULL; 2364255332Scy } 2365145522Sdarrenr bcopy((char *)is, (char *)clone, sizeof(*clone)); 2366145522Sdarrenr 2367145522Sdarrenr MUTEX_NUKE(&clone->is_lock); 2368255332Scy /* 2369255332Scy * It has not yet been placed on any timeout queue, so make sure 2370255332Scy * all of that data is zero'd out. 2371255332Scy */ 2372255332Scy clone->is_sti.tqe_pnext = NULL; 2373255332Scy clone->is_sti.tqe_next = NULL; 2374255332Scy clone->is_sti.tqe_ifq = NULL; 2375255332Scy clone->is_sti.tqe_parent = clone; 2376145522Sdarrenr 2377255332Scy clone->is_die = ONE_DAY + softc->ipf_ticks; 2378145522Sdarrenr clone->is_state[0] = 0; 2379145522Sdarrenr clone->is_state[1] = 0; 2380145522Sdarrenr send = ntohl(tcp->th_seq) + fin->fin_dlen - (TCP_OFF(tcp) << 2) + 2381145522Sdarrenr ((tcp->th_flags & TH_SYN) ? 1 : 0) + 2382145522Sdarrenr ((tcp->th_flags & TH_FIN) ? 1 : 0); 2383145522Sdarrenr 2384145522Sdarrenr if (fin->fin_rev == 1) { 2385145522Sdarrenr clone->is_dend = send; 2386145522Sdarrenr clone->is_maxdend = send; 2387145522Sdarrenr clone->is_send = 0; 2388145522Sdarrenr clone->is_maxswin = 1; 2389145522Sdarrenr clone->is_maxdwin = ntohs(tcp->th_win); 2390145522Sdarrenr if (clone->is_maxdwin == 0) 2391145522Sdarrenr clone->is_maxdwin = 1; 2392145522Sdarrenr } else { 2393145522Sdarrenr clone->is_send = send; 2394145522Sdarrenr clone->is_maxsend = send; 2395145522Sdarrenr clone->is_dend = 0; 2396145522Sdarrenr clone->is_maxdwin = 1; 2397145522Sdarrenr clone->is_maxswin = ntohs(tcp->th_win); 2398145522Sdarrenr if (clone->is_maxswin == 0) 2399145522Sdarrenr clone->is_maxswin = 1; 2400145522Sdarrenr } 2401145522Sdarrenr 2402145522Sdarrenr clone->is_flags &= ~SI_CLONE; 2403145522Sdarrenr clone->is_flags |= SI_CLONED; 2404255332Scy if (ipf_state_insert(softc, clone, fin->fin_rev) == -1) { 2405255332Scy KFREE(clone); 2406255332Scy return NULL; 2407255332Scy } 2408255332Scy 2409255332Scy clone->is_ref = 1; 2410145522Sdarrenr if (clone->is_p == IPPROTO_TCP) { 2411255332Scy (void) ipf_tcp_age(&clone->is_sti, fin, softs->ipf_state_tcptq, 2412255332Scy clone->is_flags, 2); 2413145522Sdarrenr } 2414145522Sdarrenr MUTEX_EXIT(&clone->is_lock); 2415145522Sdarrenr if (is->is_flags & IS_STATESYNC) 2416255332Scy clone->is_sync = ipf_sync_new(softc, SMC_STATE, fin, clone); 2417255332Scy DT2(iss_clone, ipstate_t *, is, ipstate_t *, clone); 2418255332Scy SBUMP(ipf_state_stats.iss_cloned); 2419145522Sdarrenr return clone; 242053642Sguido} 242153642Sguido 242253642Sguido 2423145522Sdarrenr/* ------------------------------------------------------------------------ */ 2424255332Scy/* Function: ipf_matchsrcdst */ 2425145522Sdarrenr/* Returns: Nil */ 2426255332Scy/* Parameters: fin(I) - pointer to packet information */ 2427255332Scy/* is(I) - pointer to state structure */ 2428255332Scy/* src(I) - pointer to source address */ 2429255332Scy/* dst(I) - pointer to destination address */ 2430255332Scy/* tcp(I) - pointer to TCP/UDP header */ 2431255332Scy/* cmask(I) - mask of FI_* bits to check */ 2432145522Sdarrenr/* */ 2433145522Sdarrenr/* Match a state table entry against an IP packet. The logic below is that */ 2434145522Sdarrenr/* ret gets set to one if the match succeeds, else remains 0. If it is */ 2435145522Sdarrenr/* still 0 after the test. no match. */ 2436145522Sdarrenr/* ------------------------------------------------------------------------ */ 2437255332Scystatic ipstate_t * 2438255332Scyipf_matchsrcdst(fin, is, src, dst, tcp, cmask) 2439255332Scy fr_info_t *fin; 2440255332Scy ipstate_t *is; 2441255332Scy i6addr_t *src, *dst; 2442255332Scy tcphdr_t *tcp; 2443255332Scy u_32_t cmask; 244453642Sguido{ 2445255332Scy ipf_main_softc_t *softc = fin->fin_main_soft; 2446255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 2447145522Sdarrenr int ret = 0, rev, out, flags, flx = 0, idx; 244853642Sguido u_short sp, dp; 2449145522Sdarrenr u_32_t cflx; 245053642Sguido void *ifp; 245153642Sguido 2452255332Scy /* 2453255332Scy * If a connection is about to be deleted, no packets 2454255332Scy * are allowed to match it. 2455255332Scy */ 2456255332Scy if (is->is_sti.tqe_ifq == &softs->ipf_state_deletetq) 2457255332Scy return NULL; 2458255332Scy 2459145522Sdarrenr rev = IP6_NEQ(&is->is_dst, dst); 246053642Sguido ifp = fin->fin_ifp; 246153642Sguido out = fin->fin_out; 2462145522Sdarrenr flags = is->is_flags; 246392685Sdarrenr sp = 0; 246492685Sdarrenr dp = 0; 246553642Sguido 246653642Sguido if (tcp != NULL) { 2467145522Sdarrenr sp = htons(fin->fin_sport); 2468145522Sdarrenr dp = ntohs(fin->fin_dport); 2469145522Sdarrenr } 2470145522Sdarrenr if (!rev) { 2471145522Sdarrenr if (tcp != NULL) { 2472145522Sdarrenr if (!(flags & SI_W_SPORT) && (sp != is->is_sport)) 247380482Sdarrenr rev = 1; 2474145522Sdarrenr else if (!(flags & SI_W_DPORT) && (dp != is->is_dport)) 247580482Sdarrenr rev = 1; 247680482Sdarrenr } 247753642Sguido } 247853642Sguido 247992685Sdarrenr idx = (out << 1) + rev; 248092685Sdarrenr 2481145522Sdarrenr /* 2482145522Sdarrenr * If the interface for this 'direction' is set, make sure it matches. 2483145522Sdarrenr * An interface name that is not set matches any, as does a name of *. 2484145522Sdarrenr */ 2485170268Sdarrenr if ((is->is_ifp[idx] == ifp) || (is->is_ifp[idx] == NULL && 2486170268Sdarrenr (*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '-' || 2487170268Sdarrenr *is->is_ifname[idx] == '*'))) 248892685Sdarrenr ret = 1; 248992685Sdarrenr 2490255332Scy if (ret == 0) { 2491255332Scy DT2(iss_lookup_badifp, fr_info_t *, fin, ipstate_t *, is); 2492255332Scy SBUMP(ipf_state_stats.iss_lookup_badifp); 2493255332Scy /* TRACE is, out, rev, idx */ 2494145522Sdarrenr return NULL; 2495255332Scy } 249653642Sguido ret = 0; 249753642Sguido 2498145522Sdarrenr /* 2499145522Sdarrenr * Match addresses and ports. 2500145522Sdarrenr */ 250153642Sguido if (rev == 0) { 2502145522Sdarrenr if ((IP6_EQ(&is->is_dst, dst) || (flags & SI_W_DADDR)) && 2503145522Sdarrenr (IP6_EQ(&is->is_src, src) || (flags & SI_W_SADDR))) { 2504145522Sdarrenr if (tcp) { 2505255332Scy if ((sp == is->is_sport || flags & SI_W_SPORT) 2506255332Scy && 2507145522Sdarrenr (dp == is->is_dport || flags & SI_W_DPORT)) 2508145522Sdarrenr ret = 1; 2509145522Sdarrenr } else { 2510145522Sdarrenr ret = 1; 2511145522Sdarrenr } 251253642Sguido } 251353642Sguido } else { 2514145522Sdarrenr if ((IP6_EQ(&is->is_dst, src) || (flags & SI_W_DADDR)) && 2515145522Sdarrenr (IP6_EQ(&is->is_src, dst) || (flags & SI_W_SADDR))) { 2516145522Sdarrenr if (tcp) { 2517255332Scy if ((dp == is->is_sport || flags & SI_W_SPORT) 2518255332Scy && 2519145522Sdarrenr (sp == is->is_dport || flags & SI_W_DPORT)) 2520145522Sdarrenr ret = 1; 2521145522Sdarrenr } else { 2522145522Sdarrenr ret = 1; 2523145522Sdarrenr } 252453642Sguido } 252553642Sguido } 2526145522Sdarrenr 2527255332Scy if (ret == 0) { 2528255332Scy SBUMP(ipf_state_stats.iss_lookup_badport); 2529255332Scy DT2(iss_lookup_badport, fr_info_t *, fin, ipstate_t *, is); 2530255332Scy /* TRACE rev, is, sp, dp, src, dst */ 2531145522Sdarrenr return NULL; 2532255332Scy } 253353642Sguido 253453642Sguido /* 253553642Sguido * Whether or not this should be here, is questionable, but the aim 253653642Sguido * is to get this out of the main line. 253753642Sguido */ 253853642Sguido if (tcp == NULL) 2539145522Sdarrenr flags = is->is_flags & ~(SI_WILDP|SI_NEWFR|SI_CLONE|SI_CLONED); 254053642Sguido 2541145522Sdarrenr /* 2542145522Sdarrenr * Only one of the source or destination address can be flaged as a 2543145522Sdarrenr * wildcard. Fill in the missing address, if set. 2544145522Sdarrenr * For IPv6, if the address being copied in is multicast, then 2545145522Sdarrenr * don't reset the wild flag - multicast causes it to be set in the 2546145522Sdarrenr * first place! 2547145522Sdarrenr */ 2548145522Sdarrenr if ((flags & (SI_W_SADDR|SI_W_DADDR))) { 2549145522Sdarrenr fr_ip_t *fi = &fin->fin_fi; 255053642Sguido 2551145522Sdarrenr if ((flags & SI_W_SADDR) != 0) { 255292685Sdarrenr if (rev == 0) { 2553255332Scy is->is_src = fi->fi_src; 2554255332Scy is->is_flags &= ~SI_W_SADDR; 255592685Sdarrenr } else { 2556255332Scy if (!(fin->fin_flx & (FI_MULTICAST|FI_MBCAST))){ 2557145522Sdarrenr is->is_src = fi->fi_dst; 2558145522Sdarrenr is->is_flags &= ~SI_W_SADDR; 2559145522Sdarrenr } 256092685Sdarrenr } 2561145522Sdarrenr } else if ((flags & SI_W_DADDR) != 0) { 256292685Sdarrenr if (rev == 0) { 2563255332Scy if (!(fin->fin_flx & (FI_MULTICAST|FI_MBCAST))){ 2564145522Sdarrenr is->is_dst = fi->fi_dst; 2565145522Sdarrenr is->is_flags &= ~SI_W_DADDR; 2566145522Sdarrenr } 256792685Sdarrenr } else { 2568255332Scy is->is_dst = fi->fi_src; 2569255332Scy is->is_flags &= ~SI_W_DADDR; 257092685Sdarrenr } 257192685Sdarrenr } 2572145522Sdarrenr if ((is->is_flags & (SI_WILDA|SI_WILDP)) == 0) { 2573255332Scy ATOMIC_DECL(softs->ipf_state_stats.iss_wild); 2574145522Sdarrenr } 257592685Sdarrenr } 257692685Sdarrenr 2577145522Sdarrenr flx = fin->fin_flx & cmask; 2578145522Sdarrenr cflx = is->is_flx[out][rev]; 2579145522Sdarrenr 2580145522Sdarrenr /* 2581145522Sdarrenr * Match up any flags set from IP options. 2582145522Sdarrenr */ 2583145522Sdarrenr if ((cflx && (flx != (cflx & cmask))) || 2584153876Sguido ((fin->fin_optmsk & is->is_optmsk[rev]) != is->is_opt[rev]) || 2585145522Sdarrenr ((fin->fin_secmsk & is->is_secmsk) != is->is_sec) || 2586255332Scy ((fin->fin_auth & is->is_authmsk) != is->is_auth)) { 2587255332Scy SBUMPD(ipf_state_stats, iss_miss_mask); 2588145522Sdarrenr return NULL; 2589255332Scy } 2590145522Sdarrenr 2591255332Scy if ((fin->fin_flx & FI_IGNORE) != 0) { 2592255332Scy fin->fin_rev = rev; 2593255332Scy return is; 2594255332Scy } 2595255332Scy 2596145522Sdarrenr /* 2597145522Sdarrenr * Only one of the source or destination port can be flagged as a 2598145522Sdarrenr * wildcard. When filling it in, fill in a copy of the matched entry 2599145522Sdarrenr * if it has the cloning flag set. 2600145522Sdarrenr */ 2601145522Sdarrenr if ((flags & (SI_W_SPORT|SI_W_DPORT))) { 2602145522Sdarrenr if ((flags & SI_CLONE) != 0) { 2603153876Sguido ipstate_t *clone; 2604153876Sguido 2605255332Scy clone = ipf_state_clone(fin, tcp, is); 2606153876Sguido if (clone == NULL) 2607145522Sdarrenr return NULL; 2608153876Sguido is = clone; 2609145522Sdarrenr } else { 2610255332Scy ATOMIC_DECL(softs->ipf_state_stats.iss_wild); 2611145522Sdarrenr } 2612145522Sdarrenr 2613145522Sdarrenr if ((flags & SI_W_SPORT) != 0) { 261453642Sguido if (rev == 0) { 261553642Sguido is->is_sport = sp; 2616145522Sdarrenr is->is_send = ntohl(tcp->th_seq); 261753642Sguido } else { 261853642Sguido is->is_sport = dp; 2619145522Sdarrenr is->is_send = ntohl(tcp->th_ack); 262053642Sguido } 262153642Sguido is->is_maxsend = is->is_send + 1; 2622145522Sdarrenr } else if ((flags & SI_W_DPORT) != 0) { 262353642Sguido if (rev == 0) { 262453642Sguido is->is_dport = dp; 2625145522Sdarrenr is->is_dend = ntohl(tcp->th_ack); 262653642Sguido } else { 262753642Sguido is->is_dport = sp; 2628145522Sdarrenr is->is_dend = ntohl(tcp->th_seq); 262953642Sguido } 263053642Sguido is->is_maxdend = is->is_dend + 1; 263153642Sguido } 2632145522Sdarrenr is->is_flags &= ~(SI_W_SPORT|SI_W_DPORT); 2633255332Scy if ((flags & SI_CLONED) && softs->ipf_state_logging) 2634255332Scy ipf_state_log(softc, is, ISL_CLONE); 263553642Sguido } 263653642Sguido 263760854Sdarrenr ret = -1; 263860854Sdarrenr 2639153876Sguido if (is->is_flx[out][rev] == 0) { 2640145522Sdarrenr is->is_flx[out][rev] = flx; 2641255332Scy if (rev == 1 && is->is_optmsk[1] == 0) { 2642255332Scy is->is_opt[1] = fin->fin_optmsk; 2643255332Scy is->is_optmsk[1] = 0xffffffff; 2644255332Scy if (is->is_v == 6) { 2645255332Scy is->is_opt[1] &= ~0x8; 2646255332Scy is->is_optmsk[1] &= ~0x8; 2647255332Scy } 2648153876Sguido } 2649153876Sguido } 2650145522Sdarrenr 2651145522Sdarrenr /* 2652145522Sdarrenr * Check if the interface name for this "direction" is set and if not, 2653145522Sdarrenr * fill it in. 2654145522Sdarrenr */ 265592685Sdarrenr if (is->is_ifp[idx] == NULL && 2656145522Sdarrenr (*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '*')) { 2657145522Sdarrenr is->is_ifp[idx] = ifp; 2658255332Scy COPYIFNAME(fin->fin_v, ifp, is->is_ifname[idx]); 265960854Sdarrenr } 266080482Sdarrenr fin->fin_rev = rev; 2661145522Sdarrenr return is; 266253642Sguido} 266353642Sguido 266460854Sdarrenr 2665145522Sdarrenr/* ------------------------------------------------------------------------ */ 2666255332Scy/* Function: ipf_checkicmpmatchingstate */ 2667145522Sdarrenr/* Returns: Nil */ 2668145522Sdarrenr/* Parameters: fin(I) - pointer to packet information */ 2669145522Sdarrenr/* */ 2670145522Sdarrenr/* If we've got an ICMP error message, using the information stored in the */ 2671145522Sdarrenr/* ICMP packet, look for a matching state table entry. */ 2672145522Sdarrenr/* */ 2673145522Sdarrenr/* If we return NULL then no lock on ipf_state is held. */ 2674145522Sdarrenr/* If we return non-null then a read-lock on ipf_state is held. */ 2675145522Sdarrenr/* ------------------------------------------------------------------------ */ 2676255332Scystatic ipstate_t * 2677255332Scyipf_checkicmpmatchingstate(fin) 2678255332Scy fr_info_t *fin; 267953642Sguido{ 2680255332Scy ipf_main_softc_t *softc = fin->fin_main_soft; 2681255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 2682145522Sdarrenr ipstate_t *is, **isp; 2683145522Sdarrenr i6addr_t dst, src; 268453642Sguido struct icmp *ic; 2685145522Sdarrenr u_short savelen; 268664580Sdarrenr icmphdr_t *icmp; 268753642Sguido fr_info_t ofin; 2688145522Sdarrenr tcphdr_t *tcp; 268964580Sdarrenr int type, len; 2690255332Scy u_char pr; 269153642Sguido ip_t *oip; 269255929Sguido u_int hv; 269353642Sguido 269457096Sguido /* 269557096Sguido * Does it at least have the return (basic) IP header ? 2696153876Sguido * Is it an actual recognised ICMP error type? 269753642Sguido * Only a basic IP header (no options) should be with 269853642Sguido * an ICMP error header. 269953642Sguido */ 2700145522Sdarrenr if ((fin->fin_v != 4) || (fin->fin_hlen != sizeof(ip_t)) || 2701153876Sguido (fin->fin_plen < ICMPERR_MINPKTLEN) || 2702255332Scy !(fin->fin_flx & FI_ICMPERR)) { 2703255332Scy SBUMPD(ipf_state_stats, iss_icmp_bad); 270453642Sguido return NULL; 2705255332Scy } 2706145522Sdarrenr ic = fin->fin_dp; 270753642Sguido type = ic->icmp_type; 270853642Sguido 270960854Sdarrenr oip = (ip_t *)((char *)ic + ICMPERR_ICMPHLEN); 2710130886Sdarrenr /* 2711130886Sdarrenr * Check if the at least the old IP header (with options) and 2712130886Sdarrenr * 8 bytes of payload is present. 2713130886Sdarrenr */ 2714255332Scy if (fin->fin_plen < ICMPERR_MAXPKTLEN + ((IP_HL(oip) - 5) << 2)) { 2715255332Scy SBUMPDX(ipf_state_stats, iss_icmp_short, iss_icmp_short_1); 271653642Sguido return NULL; 2717255332Scy } 271855929Sguido 271964580Sdarrenr /* 2720145522Sdarrenr * Sanity Checks. 272164580Sdarrenr */ 272264580Sdarrenr len = fin->fin_dlen - ICMPERR_ICMPHLEN; 2723255332Scy if ((len <= 0) || ((IP_HL(oip) << 2) > len)) { 2724255332Scy DT2(iss_icmp_len, fr_info_t *, fin, struct ip*, oip); 2725255332Scy SBUMPDX(ipf_state_stats, iss_icmp_short, iss_icmp_short_1); 272664580Sdarrenr return NULL; 2727255332Scy } 272864580Sdarrenr 272964580Sdarrenr /* 273064580Sdarrenr * Is the buffer big enough for all of it ? It's the size of the IP 273164580Sdarrenr * header claimed in the encapsulated part which is of concern. It 273264580Sdarrenr * may be too big to be in this buffer but not so big that it's 273364580Sdarrenr * outside the ICMP packet, leading to TCP deref's causing problems. 273464580Sdarrenr * This is possible because we don't know how big oip_hl is when we 2735255332Scy * do the pullup early in ipf_check() and thus can't guarantee it is 273664580Sdarrenr * all here now. 273764580Sdarrenr */ 273864580Sdarrenr#ifdef _KERNEL 273964580Sdarrenr { 274064580Sdarrenr mb_t *m; 274164580Sdarrenr 2742145522Sdarrenr m = fin->fin_m; 2743145522Sdarrenr# if defined(MENTAT) 2744255332Scy if ((char *)oip + len > (char *)m->b_wptr) { 2745255332Scy SBUMPDX(ipf_state_stats, iss_icmp_short, iss_icmp_short_2); 274664580Sdarrenr return NULL; 2747255332Scy } 274864580Sdarrenr# else 2749255332Scy if ((char *)oip + len > (char *)fin->fin_ip + m->m_len) { 2750255332Scy SBUMPDX(ipf_state_stats, iss_icmp_short, iss_icmp_short_3); 275164580Sdarrenr return NULL; 2752255332Scy } 275364580Sdarrenr# endif 275464580Sdarrenr } 275564580Sdarrenr#endif 2756255332Scy 2757170268Sdarrenr bcopy((char *)fin, (char *)&ofin, sizeof(*fin)); 275864580Sdarrenr 275964580Sdarrenr /* 276064580Sdarrenr * in the IPv4 case we must zero the i6addr union otherwise 2761145522Sdarrenr * the IP6_EQ and IP6_NEQ macros produce the wrong results because 276264580Sdarrenr * of the 'junk' in the unused part of the union 276364580Sdarrenr */ 276467614Sdarrenr bzero((char *)&src, sizeof(src)); 276567614Sdarrenr bzero((char *)&dst, sizeof(dst)); 2766145522Sdarrenr 2767130886Sdarrenr /* 2768145522Sdarrenr * we make an fin entry to be able to feed it to 2769145522Sdarrenr * matchsrcdst note that not all fields are encessary 2770145522Sdarrenr * but this is the cleanest way. Note further we fill 2771145522Sdarrenr * in fin_mp such that if someone uses it we'll get 2772255332Scy * a kernel panic. ipf_matchsrcdst does not use this. 2773145522Sdarrenr * 2774130886Sdarrenr * watch out here, as ip is in host order and oip in network 2775130886Sdarrenr * order. Any change we make must be undone afterwards, like 2776255332Scy * oip->ip_len. 2777130886Sdarrenr */ 2778130886Sdarrenr savelen = oip->ip_len; 2779255332Scy oip->ip_len = htons(len); 2780145522Sdarrenr 2781145522Sdarrenr ofin.fin_flx = FI_NOCKSUM; 2782145522Sdarrenr ofin.fin_v = 4; 2783145522Sdarrenr ofin.fin_ip = oip; 2784145522Sdarrenr ofin.fin_m = NULL; /* if dereferenced, panic XXX */ 2785145522Sdarrenr ofin.fin_mp = NULL; /* if dereferenced, panic XXX */ 2786255332Scy (void) ipf_makefrip(IP_HL(oip) << 2, oip, &ofin); 2787145522Sdarrenr ofin.fin_ifp = fin->fin_ifp; 2788145522Sdarrenr ofin.fin_out = !fin->fin_out; 2789255332Scy 2790255332Scy hv = (pr = oip->ip_p); 2791255332Scy src.in4 = oip->ip_src; 2792255332Scy hv += src.in4.s_addr; 2793255332Scy dst.in4 = oip->ip_dst; 2794255332Scy hv += dst.in4.s_addr; 2795255332Scy 2796130886Sdarrenr /* 2797255332Scy * Reset the short and bad flag here because in ipf_matchsrcdst() 2798145522Sdarrenr * the flags for the current packet (fin_flx) are compared against 2799145522Sdarrenr * those for the existing session. 2800130886Sdarrenr */ 2801145522Sdarrenr ofin.fin_flx &= ~(FI_BAD|FI_SHORT); 2802130886Sdarrenr 2803130886Sdarrenr /* 2804255332Scy * Put old values of ip_len back as we don't know 2805255332Scy * if we have to forward the packet or process it again. 2806130886Sdarrenr */ 2807130886Sdarrenr oip->ip_len = savelen; 2808130886Sdarrenr 280992685Sdarrenr switch (oip->ip_p) 281092685Sdarrenr { 281192685Sdarrenr case IPPROTO_ICMP : 281255929Sguido /* 2813130886Sdarrenr * an ICMP error can only be generated as a result of an 281455929Sguido * ICMP query, not as the response on an ICMP error 281555929Sguido * 281655929Sguido * XXX theoretically ICMP_ECHOREP and the other reply's are 281755929Sguido * ICMP query's as well, but adding them here seems strange XXX 281855929Sguido */ 2819255332Scy if ((ofin.fin_flx & FI_ICMPERR) != 0) { 2820255332Scy DT1(iss_icmp_icmperr, fr_info_t *, &ofin); 2821255332Scy SBUMP(ipf_state_stats.iss_icmp_icmperr); 282255929Sguido return NULL; 2823255332Scy } 282455929Sguido 282557096Sguido /* 282655929Sguido * perform a lookup of the ICMP packet in the state table 282755929Sguido */ 2828153876Sguido icmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 282960854Sdarrenr hv += icmp->icmp_id; 2830145522Sdarrenr hv = DOUBLE_HASH(hv); 283155929Sguido 2832255332Scy READ_ENTER(&softc->ipf_state); 2833255332Scy for (isp = &softs->ipf_state_table[hv]; 2834255332Scy ((is = *isp) != NULL); ) { 2835145522Sdarrenr isp = &is->is_hnext; 2836145522Sdarrenr if ((is->is_p != pr) || (is->is_v != 4)) 2837145522Sdarrenr continue; 2838145522Sdarrenr if (is->is_pass & FR_NOICMPERR) 2839145522Sdarrenr continue; 2840255332Scy 2841255332Scy is = ipf_matchsrcdst(&ofin, is, &src, &dst, 2842145522Sdarrenr NULL, FI_ICMPCMP); 2843255332Scy if ((is != NULL) && !ipf_allowstateicmp(fin, is, &src)) 2844145522Sdarrenr return is; 2845145522Sdarrenr } 2846255332Scy RWLOCK_EXIT(&softc->ipf_state); 2847255332Scy SBUMPDX(ipf_state_stats, iss_icmp_miss, iss_icmp_miss_1); 2848145522Sdarrenr return NULL; 284992685Sdarrenr case IPPROTO_TCP : 285092685Sdarrenr case IPPROTO_UDP : 285192685Sdarrenr break; 285292685Sdarrenr default : 2853255332Scy SBUMPDX(ipf_state_stats, iss_icmp_miss, iss_icmp_miss_2); 285455929Sguido return NULL; 285592685Sdarrenr } 285655929Sguido 2857145522Sdarrenr tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 285853642Sguido 2859255332Scy hv += tcp->th_dport;; 2860255332Scy hv += tcp->th_sport;; 2861145522Sdarrenr hv = DOUBLE_HASH(hv); 2862130886Sdarrenr 2863255332Scy READ_ENTER(&softc->ipf_state); 2864255332Scy for (isp = &softs->ipf_state_table[hv]; ((is = *isp) != NULL); ) { 2865145522Sdarrenr isp = &is->is_hnext; 286653642Sguido /* 286753642Sguido * Only allow this icmp though if the 286853642Sguido * encapsulated packet was allowed through the 286953642Sguido * other way around. Note that the minimal amount 287053642Sguido * of info present does not allow for checking against 2871145522Sdarrenr * tcp internals such as seq and ack numbers. Only the 2872130886Sdarrenr * ports are known to be present and can be even if the 2873130886Sdarrenr * short flag is set. 287453642Sguido */ 287560854Sdarrenr if ((is->is_p == pr) && (is->is_v == 4) && 2876255332Scy (is = ipf_matchsrcdst(&ofin, is, &src, &dst, 2877255332Scy tcp, FI_ICMPCMP))) { 2878255332Scy if (ipf_allowstateicmp(fin, is, &src) == 0) 2879255332Scy return is; 288053642Sguido } 288153642Sguido } 2882255332Scy RWLOCK_EXIT(&softc->ipf_state); 2883255332Scy SBUMPDX(ipf_state_stats, iss_icmp_miss, iss_icmp_miss_3); 2884145522Sdarrenr return NULL; 288553642Sguido} 288653642Sguido 288767614Sdarrenr 2888145522Sdarrenr/* ------------------------------------------------------------------------ */ 2889255332Scy/* Function: ipf_allowstateicmp */ 2890255332Scy/* Returns: int - 1 = packet denied, 0 = packet allowed */ 2891255332Scy/* Parameters: fin(I) - pointer to packet information */ 2892255332Scy/* is(I) - pointer to state table entry */ 2893255332Scy/* src(I) - source address to check permission for */ 2894255332Scy/* */ 2895255332Scy/* For an ICMP packet that has so far matched a state table entry, check if */ 2896255332Scy/* there are any further refinements that might mean we want to block this */ 2897255332Scy/* packet. This code isn't specific to either IPv4 or IPv6. */ 2898255332Scy/* ------------------------------------------------------------------------ */ 2899255332Scystatic int 2900255332Scyipf_allowstateicmp(fin, is, src) 2901255332Scy fr_info_t *fin; 2902255332Scy ipstate_t *is; 2903255332Scy i6addr_t *src; 2904255332Scy{ 2905255332Scy ipf_main_softc_t *softc = fin->fin_main_soft; 2906255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 2907255332Scy frentry_t *savefr; 2908255332Scy frentry_t *fr; 2909255332Scy u_32_t ipass; 2910255332Scy int backward; 2911255332Scy int oi; 2912255332Scy int i; 2913255332Scy 2914255332Scy fr = is->is_rule; 2915255332Scy if (fr != NULL && fr->fr_icmpgrp != NULL) { 2916255332Scy savefr = fin->fin_fr; 2917255332Scy fin->fin_fr = fr->fr_icmpgrp->fg_start; 2918255332Scy 2919255332Scy ipass = ipf_scanlist(fin, softc->ipf_pass); 2920255332Scy fin->fin_fr = savefr; 2921255332Scy if (FR_ISBLOCK(ipass)) { 2922255332Scy SBUMPD(ipf_state_stats, iss_icmp_headblock); 2923255332Scy return 1; 2924255332Scy } 2925255332Scy } 2926255332Scy 2927255332Scy /* 2928255332Scy * i : the index of this packet (the icmp unreachable) 2929255332Scy * oi : the index of the original packet found in the 2930255332Scy * icmp header (i.e. the packet causing this icmp) 2931255332Scy * backward : original packet was backward compared to 2932255332Scy * the state 2933255332Scy */ 2934255332Scy backward = IP6_NEQ(&is->is_src, src); 2935255332Scy fin->fin_rev = !backward; 2936255332Scy i = (!backward << 1) + fin->fin_out; 2937255332Scy oi = (backward << 1) + !fin->fin_out; 2938255332Scy 2939255332Scy if (is->is_pass & FR_NOICMPERR) { 2940255332Scy SBUMPD(ipf_state_stats, iss_icmp_banned); 2941255332Scy return 1; 2942255332Scy } 2943255332Scy if (is->is_icmppkts[i] > is->is_pkts[oi]) { 2944255332Scy SBUMPD(ipf_state_stats, iss_icmp_toomany); 2945255332Scy return 1; 2946255332Scy } 2947255332Scy 2948255332Scy DT2(iss_icmp_hits, fr_info_t *, fin, ipstate_t *, is); 2949255332Scy SBUMP(ipf_state_stats.iss_icmp_hits); 2950255332Scy is->is_icmppkts[i]++; 2951255332Scy 2952255332Scy /* 2953255332Scy * we deliberately do not touch the timeouts 2954255332Scy * for the accompanying state table entry. 2955255332Scy * It remains to be seen if that is correct. XXX 2956255332Scy */ 2957255332Scy return 0; 2958255332Scy} 2959255332Scy 2960255332Scy 2961255332Scy/* ------------------------------------------------------------------------ */ 2962255332Scy/* Function: ipf_ipsmove */ 2963145522Sdarrenr/* Returns: Nil */ 2964145522Sdarrenr/* Parameters: is(I) - pointer to state table entry */ 2965145522Sdarrenr/* hv(I) - new hash value for state table entry */ 2966145522Sdarrenr/* Write Locks: ipf_state */ 2967145522Sdarrenr/* */ 2968145522Sdarrenr/* Move a state entry from one position in the hash table to another. */ 2969145522Sdarrenr/* ------------------------------------------------------------------------ */ 2970255332Scystatic void 2971255332Scyipf_ipsmove(softs, is, hv) 2972255332Scy ipf_state_softc_t *softs; 2973255332Scy ipstate_t *is; 2974255332Scy u_int hv; 297567614Sdarrenr{ 2976145522Sdarrenr ipstate_t **isp; 297767614Sdarrenr u_int hvm; 297867614Sdarrenr 297967614Sdarrenr hvm = is->is_hv; 2980255332Scy 2981255332Scy /* TRACE is, is_hv, hvm */ 2982255332Scy 298367614Sdarrenr /* 298467614Sdarrenr * Remove the hash from the old location... 298567614Sdarrenr */ 2986145522Sdarrenr isp = is->is_phnext; 298767614Sdarrenr if (is->is_hnext) 298867614Sdarrenr is->is_hnext->is_phnext = isp; 298967614Sdarrenr *isp = is->is_hnext; 2990255332Scy if (softs->ipf_state_table[hvm] == NULL) 2991255332Scy softs->ipf_state_stats.iss_inuse--; 2992255332Scy softs->ipf_state_stats.iss_bucketlen[hvm]--; 299367614Sdarrenr 299467614Sdarrenr /* 299567614Sdarrenr * ...and put the hash in the new one. 299667614Sdarrenr */ 2997145522Sdarrenr hvm = DOUBLE_HASH(hv); 299867853Sdarrenr is->is_hv = hvm; 2999255332Scy 3000255332Scy /* TRACE is, hv, is_hv, hvm */ 3001255332Scy 3002255332Scy isp = &softs->ipf_state_table[hvm]; 300367614Sdarrenr if (*isp) 300467614Sdarrenr (*isp)->is_phnext = &is->is_hnext; 300567614Sdarrenr else 3006255332Scy softs->ipf_state_stats.iss_inuse++; 3007255332Scy softs->ipf_state_stats.iss_bucketlen[hvm]++; 300867614Sdarrenr is->is_phnext = isp; 300967614Sdarrenr is->is_hnext = *isp; 301067614Sdarrenr *isp = is; 301167614Sdarrenr} 301267614Sdarrenr 301367614Sdarrenr 3014145522Sdarrenr/* ------------------------------------------------------------------------ */ 3015255332Scy/* Function: ipf_state_lookup */ 3016145522Sdarrenr/* Returns: ipstate_t* - NULL == no matching state found, */ 3017145522Sdarrenr/* else pointer to state information is returned */ 3018255332Scy/* Parameters: fin(I) - pointer to packet information */ 3019255332Scy/* tcp(I) - pointer to TCP/UDP header. */ 3020255332Scy/* ifqp(O) - pointer for storing tailq timeout */ 3021145522Sdarrenr/* */ 3022145522Sdarrenr/* Search the state table for a matching entry to the packet described by */ 3023255332Scy/* the contents of *fin. For certain protocols, when a match is found the */ 3024255332Scy/* timeout queue is also selected and stored in ifpq if it is non-NULL. */ 3025145522Sdarrenr/* */ 3026145522Sdarrenr/* If we return NULL then no lock on ipf_state is held. */ 3027145522Sdarrenr/* If we return non-null then a read-lock on ipf_state is held. */ 3028145522Sdarrenr/* ------------------------------------------------------------------------ */ 3029255332Scyipstate_t * 3030255332Scyipf_state_lookup(fin, tcp, ifqp) 3031255332Scy fr_info_t *fin; 3032255332Scy tcphdr_t *tcp; 3033255332Scy ipftq_t **ifqp; 303453642Sguido{ 3035255332Scy ipf_main_softc_t *softc = fin->fin_main_soft; 3036255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 3037145522Sdarrenr u_int hv, hvm, pr, v, tryagain; 3038145522Sdarrenr ipstate_t *is, **isp; 3039145522Sdarrenr u_short dport, sport; 3040145522Sdarrenr i6addr_t src, dst; 304153642Sguido struct icmp *ic; 3042145522Sdarrenr ipftq_t *ifq; 3043145522Sdarrenr int oow; 304453642Sguido 304553642Sguido is = NULL; 3046145522Sdarrenr ifq = NULL; 3047145522Sdarrenr tcp = fin->fin_dp; 304853642Sguido ic = (struct icmp *)tcp; 304960854Sdarrenr hv = (pr = fin->fin_fi.fi_p); 305060854Sdarrenr src = fin->fin_fi.fi_src; 305160854Sdarrenr dst = fin->fin_fi.fi_dst; 305260854Sdarrenr hv += src.in4.s_addr; 305360854Sdarrenr hv += dst.in4.s_addr; 305453642Sguido 305560854Sdarrenr v = fin->fin_fi.fi_v; 305692685Sdarrenr#ifdef USE_INET6 305792685Sdarrenr if (v == 6) { 3058145522Sdarrenr hv += fin->fin_fi.fi_src.i6[1]; 3059145522Sdarrenr hv += fin->fin_fi.fi_src.i6[2]; 3060145522Sdarrenr hv += fin->fin_fi.fi_src.i6[3]; 306192685Sdarrenr 306292685Sdarrenr if ((fin->fin_p == IPPROTO_ICMPV6) && 306392685Sdarrenr IN6_IS_ADDR_MULTICAST(&fin->fin_fi.fi_dst.in6)) { 306492685Sdarrenr hv -= dst.in4.s_addr; 306592685Sdarrenr } else { 306692685Sdarrenr hv += fin->fin_fi.fi_dst.i6[1]; 306792685Sdarrenr hv += fin->fin_fi.fi_dst.i6[2]; 306892685Sdarrenr hv += fin->fin_fi.fi_dst.i6[3]; 306992685Sdarrenr } 307092685Sdarrenr } 307192685Sdarrenr#endif 3072172776Sdarrenr if ((v == 4) && 3073172776Sdarrenr (fin->fin_flx & (FI_MULTICAST|FI_BROADCAST|FI_MBCAST))) { 3074172776Sdarrenr if (fin->fin_out == 0) { 3075172776Sdarrenr hv -= src.in4.s_addr; 3076172776Sdarrenr } else { 3077172776Sdarrenr hv -= dst.in4.s_addr; 3078172776Sdarrenr } 3079172776Sdarrenr } 308092685Sdarrenr 3081255332Scy /* TRACE fin_saddr, fin_daddr, hv */ 3082255332Scy 3083145522Sdarrenr /* 3084145522Sdarrenr * Search the hash table for matching packet header info. 3085145522Sdarrenr */ 3086145522Sdarrenr switch (pr) 308753642Sguido { 308860854Sdarrenr#ifdef USE_INET6 308960854Sdarrenr case IPPROTO_ICMPV6 : 309092685Sdarrenr tryagain = 0; 309160854Sdarrenr if (v == 6) { 309260854Sdarrenr if ((ic->icmp_type == ICMP6_ECHO_REQUEST) || 309360854Sdarrenr (ic->icmp_type == ICMP6_ECHO_REPLY)) { 309460854Sdarrenr hv += ic->icmp_id; 309560854Sdarrenr } 309660854Sdarrenr } 3097255332Scy READ_ENTER(&softc->ipf_state); 309892685Sdarrenricmp6again: 3099145522Sdarrenr hvm = DOUBLE_HASH(hv); 3100255332Scy for (isp = &softs->ipf_state_table[hvm]; 3101255332Scy ((is = *isp) != NULL); ) { 3102145522Sdarrenr isp = &is->is_hnext; 3103145522Sdarrenr if ((is->is_p != pr) || (is->is_v != v)) 3104145522Sdarrenr continue; 3105255332Scy is = ipf_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP); 3106145522Sdarrenr if (is != NULL && 3107255332Scy ipf_matchicmpqueryreply(v, &is->is_icmp, 3108145522Sdarrenr ic, fin->fin_rev)) { 3109145522Sdarrenr if (fin->fin_rev) 3110255332Scy ifq = &softs->ipf_state_icmpacktq; 311192685Sdarrenr else 3112255332Scy ifq = &softs->ipf_state_icmptq; 311392685Sdarrenr break; 311492685Sdarrenr } 3115145522Sdarrenr } 311692685Sdarrenr 311792685Sdarrenr if (is != NULL) { 3118145522Sdarrenr if ((tryagain != 0) && !(is->is_flags & SI_W_DADDR)) { 311992685Sdarrenr hv += fin->fin_fi.fi_src.i6[0]; 312092685Sdarrenr hv += fin->fin_fi.fi_src.i6[1]; 312192685Sdarrenr hv += fin->fin_fi.fi_src.i6[2]; 312292685Sdarrenr hv += fin->fin_fi.fi_src.i6[3]; 3123255332Scy ipf_ipsmove(softs, is, hv); 3124255332Scy MUTEX_DOWNGRADE(&softc->ipf_state); 312592685Sdarrenr } 312692685Sdarrenr break; 312792685Sdarrenr } 3128255332Scy RWLOCK_EXIT(&softc->ipf_state); 312992685Sdarrenr 313092685Sdarrenr /* 313192685Sdarrenr * No matching icmp state entry. Perhaps this is a 313292685Sdarrenr * response to another state entry. 3133145522Sdarrenr * 3134145522Sdarrenr * XXX With some ICMP6 packets, the "other" address is already 3135145522Sdarrenr * in the packet, after the ICMP6 header, and this could be 3136145522Sdarrenr * used in place of the multicast address. However, taking 3137145522Sdarrenr * advantage of this requires some significant code changes 3138145522Sdarrenr * to handle the specific types where that is the case. 313992685Sdarrenr */ 3140255332Scy if ((softs->ipf_state_stats.iss_wild != 0) && 3141255332Scy ((fin->fin_flx & FI_NOWILD) == 0) && 3142255332Scy (v == 6) && (tryagain == 0)) { 314392685Sdarrenr hv -= fin->fin_fi.fi_src.i6[0]; 314492685Sdarrenr hv -= fin->fin_fi.fi_src.i6[1]; 314592685Sdarrenr hv -= fin->fin_fi.fi_src.i6[2]; 314692685Sdarrenr hv -= fin->fin_fi.fi_src.i6[3]; 314792685Sdarrenr tryagain = 1; 3148255332Scy WRITE_ENTER(&softc->ipf_state); 314992685Sdarrenr goto icmp6again; 315092685Sdarrenr } 315192685Sdarrenr 3152255332Scy is = ipf_checkicmp6matchingstate(fin); 3153145522Sdarrenr if (is != NULL) 3154145522Sdarrenr return is; 315592685Sdarrenr break; 315660854Sdarrenr#endif 3157145522Sdarrenr 315853642Sguido case IPPROTO_ICMP : 315960854Sdarrenr if (v == 4) { 316055929Sguido hv += ic->icmp_id; 316155929Sguido } 3162145522Sdarrenr hv = DOUBLE_HASH(hv); 3163255332Scy READ_ENTER(&softc->ipf_state); 3164255332Scy for (isp = &softs->ipf_state_table[hv]; 3165255332Scy ((is = *isp) != NULL); ) { 3166145522Sdarrenr isp = &is->is_hnext; 3167145522Sdarrenr if ((is->is_p != pr) || (is->is_v != v)) 3168145522Sdarrenr continue; 3169255332Scy is = ipf_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP); 3170161356Sguido if ((is != NULL) && 3171161356Sguido (ic->icmp_id == is->is_icmp.ici_id) && 3172255332Scy ipf_matchicmpqueryreply(v, &is->is_icmp, 3173145522Sdarrenr ic, fin->fin_rev)) { 3174145522Sdarrenr if (fin->fin_rev) 3175255332Scy ifq = &softs->ipf_state_icmpacktq; 317680482Sdarrenr else 3177255332Scy ifq = &softs->ipf_state_icmptq; 317853642Sguido break; 317953642Sguido } 3180145522Sdarrenr } 3181145522Sdarrenr if (is == NULL) { 3182255332Scy RWLOCK_EXIT(&softc->ipf_state); 3183145522Sdarrenr } 3184145522Sdarrenr break; 318592685Sdarrenr 318653642Sguido case IPPROTO_TCP : 318767614Sdarrenr case IPPROTO_UDP : 3188145522Sdarrenr ifqp = NULL; 3189145522Sdarrenr sport = htons(fin->fin_data[0]); 3190145522Sdarrenr hv += sport; 3191145522Sdarrenr dport = htons(fin->fin_data[1]); 3192145522Sdarrenr hv += dport; 3193145522Sdarrenr oow = 0; 319453642Sguido tryagain = 0; 3195255332Scy READ_ENTER(&softc->ipf_state); 319667614Sdarrenrretry_tcpudp: 3197145522Sdarrenr hvm = DOUBLE_HASH(hv); 3198255332Scy 3199255332Scy /* TRACE hv, hvm */ 3200255332Scy 3201255332Scy for (isp = &softs->ipf_state_table[hvm]; 3202255332Scy ((is = *isp) != NULL); ) { 3203145522Sdarrenr isp = &is->is_hnext; 3204145522Sdarrenr if ((is->is_p != pr) || (is->is_v != v)) 3205145522Sdarrenr continue; 3206145522Sdarrenr fin->fin_flx &= ~FI_OOW; 3207255332Scy is = ipf_matchsrcdst(fin, is, &src, &dst, tcp, FI_CMP); 3208145522Sdarrenr if (is != NULL) { 3209145522Sdarrenr if (pr == IPPROTO_TCP) { 3210255332Scy if (!ipf_state_tcp(softc, softs, fin, 3211255332Scy tcp, is)) { 3212145522Sdarrenr oow |= fin->fin_flx & FI_OOW; 3213145522Sdarrenr continue; 3214145522Sdarrenr } 321567614Sdarrenr } 321653642Sguido break; 321753642Sguido } 3218145522Sdarrenr } 321967614Sdarrenr if (is != NULL) { 322067614Sdarrenr if (tryagain && 3221145522Sdarrenr !(is->is_flags & (SI_CLONE|SI_WILDP|SI_WILDA))) { 322267614Sdarrenr hv += dport; 322367614Sdarrenr hv += sport; 3224255332Scy ipf_ipsmove(softs, is, hv); 3225255332Scy MUTEX_DOWNGRADE(&softc->ipf_state); 322667614Sdarrenr } 322753642Sguido break; 322867614Sdarrenr } 3229255332Scy RWLOCK_EXIT(&softc->ipf_state); 323095418Sdarrenr 3231255332Scy if ((softs->ipf_state_stats.iss_wild != 0) && 3232255332Scy ((fin->fin_flx & FI_NOWILD) == 0)) { 3233172776Sdarrenr if (tryagain == 0) { 3234172776Sdarrenr hv -= dport; 3235172776Sdarrenr hv -= sport; 3236172776Sdarrenr } else if (tryagain == 1) { 3237172776Sdarrenr hv = fin->fin_fi.fi_p; 3238172776Sdarrenr /* 3239172776Sdarrenr * If we try to pretend this is a reply to a 3240172776Sdarrenr * multicast/broadcast packet then we need to 3241172776Sdarrenr * exclude part of the address from the hash 3242172776Sdarrenr * calculation. 3243172776Sdarrenr */ 3244172776Sdarrenr if (fin->fin_out == 0) { 3245172776Sdarrenr hv += src.in4.s_addr; 3246172776Sdarrenr } else { 3247172776Sdarrenr hv += dst.in4.s_addr; 3248172776Sdarrenr } 3249172776Sdarrenr hv += dport; 3250172776Sdarrenr hv += sport; 3251172776Sdarrenr } 3252172776Sdarrenr tryagain++; 3253172776Sdarrenr if (tryagain <= 2) { 3254255332Scy WRITE_ENTER(&softc->ipf_state); 3255172776Sdarrenr goto retry_tcpudp; 3256172776Sdarrenr } 325753642Sguido } 3258145522Sdarrenr fin->fin_flx |= oow; 325953642Sguido break; 3260145522Sdarrenr 3261145522Sdarrenr#if 0 3262145522Sdarrenr case IPPROTO_GRE : 3263145522Sdarrenr gre = fin->fin_dp; 3264145522Sdarrenr if (GRE_REV(gre->gr_flags) == 1) { 3265145522Sdarrenr hv += gre->gr_call; 3266145522Sdarrenr } 3267145522Sdarrenr /* FALLTHROUGH */ 3268145522Sdarrenr#endif 326953642Sguido default : 3270145522Sdarrenr ifqp = NULL; 3271145522Sdarrenr hvm = DOUBLE_HASH(hv); 3272255332Scy READ_ENTER(&softc->ipf_state); 3273255332Scy for (isp = &softs->ipf_state_table[hvm]; 3274255332Scy ((is = *isp) != NULL); ) { 3275145522Sdarrenr isp = &is->is_hnext; 3276145522Sdarrenr if ((is->is_p != pr) || (is->is_v != v)) 3277145522Sdarrenr continue; 3278255332Scy is = ipf_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP); 3279145522Sdarrenr if (is != NULL) { 3280255332Scy ifq = &softs->ipf_state_iptq; 328192685Sdarrenr break; 328292685Sdarrenr } 328392685Sdarrenr } 328492685Sdarrenr if (is == NULL) { 3285255332Scy RWLOCK_EXIT(&softc->ipf_state); 328692685Sdarrenr } 328753642Sguido break; 328853642Sguido } 328992685Sdarrenr 3290161356Sguido if (is != NULL) { 3291161356Sguido if (((is->is_sti.tqe_flags & TQE_RULEBASED) != 0) && 3292161356Sguido (is->is_tqehead[fin->fin_rev] != NULL)) 3293161356Sguido ifq = is->is_tqehead[fin->fin_rev]; 3294161356Sguido if (ifq != NULL && ifqp != NULL) 3295161356Sguido *ifqp = ifq; 3296255332Scy } else { 3297255332Scy SBUMP(ipf_state_stats.iss_lookup_miss); 3298161356Sguido } 3299145522Sdarrenr return is; 3300145522Sdarrenr} 3301145522Sdarrenr 3302145522Sdarrenr 3303145522Sdarrenr/* ------------------------------------------------------------------------ */ 3304255332Scy/* Function: ipf_state_check */ 3305145522Sdarrenr/* Returns: frentry_t* - NULL == search failed, */ 3306145522Sdarrenr/* else pointer to rule for matching state */ 3307255332Scy/* Parameters: fin(I) - pointer to packet information */ 3308145522Sdarrenr/* passp(I) - pointer to filtering result flags */ 3309145522Sdarrenr/* */ 3310145522Sdarrenr/* Check if a packet is associated with an entry in the state table. */ 3311145522Sdarrenr/* ------------------------------------------------------------------------ */ 3312255332Scyfrentry_t * 3313255332Scyipf_state_check(fin, passp) 3314255332Scy fr_info_t *fin; 3315255332Scy u_32_t *passp; 3316145522Sdarrenr{ 3317255332Scy ipf_main_softc_t *softc = fin->fin_main_soft; 3318255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 3319255332Scy ipftqent_t *tqe; 3320145522Sdarrenr ipstate_t *is; 3321145522Sdarrenr frentry_t *fr; 3322145522Sdarrenr tcphdr_t *tcp; 3323145522Sdarrenr ipftq_t *ifq; 3324145522Sdarrenr u_int pass; 3325255332Scy int inout; 3326145522Sdarrenr 3327255332Scy if (softs->ipf_state_lock || (softs->ipf_state_list == NULL)) 3328145522Sdarrenr return NULL; 3329145522Sdarrenr 3330255332Scy if (fin->fin_flx & (FI_SHORT|FI_FRAGBODY|FI_BAD)) { 3331255332Scy SBUMPD(ipf_state_stats, iss_check_bad); 3332255332Scy return NULL; 3333255332Scy } 3334255332Scy 3335145522Sdarrenr if ((fin->fin_flx & FI_TCPUDP) || 3336145522Sdarrenr (fin->fin_fi.fi_p == IPPROTO_ICMP) 3337145522Sdarrenr#ifdef USE_INET6 3338145522Sdarrenr || (fin->fin_fi.fi_p == IPPROTO_ICMPV6) 3339145522Sdarrenr#endif 3340145522Sdarrenr ) 3341145522Sdarrenr tcp = fin->fin_dp; 3342145522Sdarrenr else 3343145522Sdarrenr tcp = NULL; 3344145522Sdarrenr 3345255332Scy ifq = NULL; 3346145522Sdarrenr /* 3347145522Sdarrenr * Search the hash table for matching packet header info. 3348145522Sdarrenr */ 3349255332Scy is = ipf_state_lookup(fin, tcp, &ifq); 3350255332Scy 3351145522Sdarrenr switch (fin->fin_p) 3352145522Sdarrenr { 3353145522Sdarrenr#ifdef USE_INET6 3354145522Sdarrenr case IPPROTO_ICMPV6 : 3355145522Sdarrenr if (is != NULL) 3356145522Sdarrenr break; 3357145522Sdarrenr if (fin->fin_v == 6) { 3358255332Scy is = ipf_checkicmp6matchingstate(fin); 3359145522Sdarrenr } 3360145522Sdarrenr break; 3361145522Sdarrenr#endif 3362145522Sdarrenr case IPPROTO_ICMP : 3363145522Sdarrenr if (is != NULL) 3364145522Sdarrenr break; 3365145522Sdarrenr /* 3366145522Sdarrenr * No matching icmp state entry. Perhaps this is a 3367145522Sdarrenr * response to another state entry. 3368145522Sdarrenr */ 3369255332Scy is = ipf_checkicmpmatchingstate(fin); 3370145522Sdarrenr break; 3371255332Scy 3372145522Sdarrenr case IPPROTO_TCP : 3373145522Sdarrenr if (is == NULL) 3374145522Sdarrenr break; 3375145522Sdarrenr 3376145522Sdarrenr if (is->is_pass & FR_NEWISN) { 3377145522Sdarrenr if (fin->fin_out == 0) 3378255332Scy ipf_fixinisn(fin, is); 3379145522Sdarrenr else if (fin->fin_out == 1) 3380255332Scy ipf_fixoutisn(fin, is); 3381145522Sdarrenr } 3382145522Sdarrenr break; 3383145522Sdarrenr default : 3384145522Sdarrenr if (fin->fin_rev) 3385255332Scy ifq = &softs->ipf_state_udpacktq; 3386145522Sdarrenr else 3387255332Scy ifq = &softs->ipf_state_udptq; 3388145522Sdarrenr break; 3389145522Sdarrenr } 339053642Sguido if (is == NULL) { 3391255332Scy SBUMP(ipf_state_stats.iss_check_miss); 339253642Sguido return NULL; 339353642Sguido } 339492685Sdarrenr 339553642Sguido fr = is->is_rule; 339692685Sdarrenr if (fr != NULL) { 3397145522Sdarrenr if ((fin->fin_out == 0) && (fr->fr_nattag.ipt_num[0] != 0)) { 3398255332Scy if (fin->fin_nattag == NULL) { 3399255332Scy RWLOCK_EXIT(&softc->ipf_state); 3400255332Scy SBUMPD(ipf_state_stats, iss_check_notag); 3401145522Sdarrenr return NULL; 3402255332Scy } 3403255332Scy if (ipf_matchtag(&fr->fr_nattag, fin->fin_nattag)!=0) { 3404255332Scy RWLOCK_EXIT(&softc->ipf_state); 3405255332Scy SBUMPD(ipf_state_stats, iss_check_nattag); 3406145522Sdarrenr return NULL; 3407255332Scy } 3408145522Sdarrenr } 3409255332Scy (void) strncpy(fin->fin_group, FR_NAME(fr, fr_group), 3410255332Scy FR_GROUPLEN); 341192685Sdarrenr fin->fin_icode = fr->fr_icode; 341292685Sdarrenr } 3413145522Sdarrenr 3414145522Sdarrenr fin->fin_rule = is->is_rulen; 3415255332Scy fin->fin_fr = fr; 3416145522Sdarrenr 3417255332Scy /* 3418255332Scy * If this packet is a fragment and the rule says to track fragments, 3419255332Scy * then create a new fragment cache entry. 3420255332Scy */ 3421317434Scy if (fin->fin_flx & FI_FRAG && FR_ISPASS(is->is_pass) && 3422317434Scy is->is_pass & FR_KEEPFRAG) 3423255332Scy (void) ipf_frag_new(softc, fin, is->is_pass); 3424255332Scy 3425255332Scy /* 3426255332Scy * For TCP packets, ifq == NULL. For all others, check if this new 3427255332Scy * queue is different to the last one it was on and move it if so. 3428255332Scy */ 3429255332Scy tqe = &is->is_sti; 3430255332Scy if ((tqe->tqe_flags & TQE_RULEBASED) != 0) 3431255332Scy ifq = is->is_tqehead[fin->fin_rev]; 3432255332Scy 3433145522Sdarrenr MUTEX_ENTER(&is->is_lock); 3434255332Scy 3435255332Scy if (ifq != NULL) 3436255332Scy ipf_movequeue(softc->ipf_ticks, tqe, tqe->tqe_ifq, ifq); 3437255332Scy 3438255332Scy inout = (fin->fin_rev << 1) + fin->fin_out; 3439255332Scy is->is_pkts[inout]++; 3440255332Scy is->is_bytes[inout] += fin->fin_plen; 3441255332Scy fin->fin_pktnum = is->is_pkts[inout] + is->is_icmppkts[inout]; 3442255332Scy 3443145522Sdarrenr MUTEX_EXIT(&is->is_lock); 3444255332Scy 3445255332Scy pass = is->is_pass; 3446255332Scy 3447255332Scy if (is->is_flags & IS_STATESYNC) 3448255332Scy ipf_sync_update(softc, SMC_STATE, fin, is->is_sync); 3449255332Scy 3450255332Scy RWLOCK_EXIT(&softc->ipf_state); 3451255332Scy 3452255332Scy SBUMP(ipf_state_stats.iss_hits); 3453255332Scy 3454255332Scy fin->fin_dif = &is->is_dif; 3455255332Scy fin->fin_tif = &is->is_tifs[fin->fin_rev]; 3456145522Sdarrenr fin->fin_flx |= FI_STATE; 3457145522Sdarrenr if ((pass & FR_LOGFIRST) != 0) 3458145522Sdarrenr pass &= ~(FR_LOGFIRST|FR_LOG); 3459145522Sdarrenr *passp = pass; 346053642Sguido return fr; 346153642Sguido} 346253642Sguido 346353642Sguido 3464145522Sdarrenr/* ------------------------------------------------------------------------ */ 3465255332Scy/* Function: ipf_fixoutisn */ 3466145522Sdarrenr/* Returns: Nil */ 3467255332Scy/* Parameters: fin(I) - pointer to packet information */ 3468145522Sdarrenr/* is(I) - pointer to master state structure */ 3469145522Sdarrenr/* */ 3470145522Sdarrenr/* Called only for outbound packets, adjusts the sequence number and the */ 3471145522Sdarrenr/* TCP checksum to match that change. */ 3472145522Sdarrenr/* ------------------------------------------------------------------------ */ 3473255332Scystatic void 3474255332Scyipf_fixoutisn(fin, is) 3475255332Scy fr_info_t *fin; 3476255332Scy ipstate_t *is; 3477145522Sdarrenr{ 3478145522Sdarrenr tcphdr_t *tcp; 3479145522Sdarrenr int rev; 3480145522Sdarrenr u_32_t seq; 3481145522Sdarrenr 3482145522Sdarrenr tcp = fin->fin_dp; 3483145522Sdarrenr rev = fin->fin_rev; 3484145522Sdarrenr if ((is->is_flags & IS_ISNSYN) != 0) { 3485255332Scy if ((rev == 0) && (fin->fin_cksum < FI_CK_L4PART)) { 3486145522Sdarrenr seq = ntohl(tcp->th_seq); 3487145522Sdarrenr seq += is->is_isninc[0]; 3488145522Sdarrenr tcp->th_seq = htonl(seq); 3489255332Scy ipf_fix_outcksum(0, &tcp->th_sum, is->is_sumd[0], 0); 3490145522Sdarrenr } 3491145522Sdarrenr } 3492145522Sdarrenr if ((is->is_flags & IS_ISNACK) != 0) { 3493255332Scy if ((rev == 1) && (fin->fin_cksum < FI_CK_L4PART)) { 3494145522Sdarrenr seq = ntohl(tcp->th_seq); 3495145522Sdarrenr seq += is->is_isninc[1]; 3496145522Sdarrenr tcp->th_seq = htonl(seq); 3497255332Scy ipf_fix_outcksum(0, &tcp->th_sum, is->is_sumd[1], 0); 3498145522Sdarrenr } 3499145522Sdarrenr } 3500145522Sdarrenr} 3501145522Sdarrenr 3502145522Sdarrenr 3503145522Sdarrenr/* ------------------------------------------------------------------------ */ 3504255332Scy/* Function: ipf_fixinisn */ 3505145522Sdarrenr/* Returns: Nil */ 3506145522Sdarrenr/* Parameters: fin(I) - pointer to packet information */ 3507145522Sdarrenr/* is(I) - pointer to master state structure */ 3508145522Sdarrenr/* */ 3509145522Sdarrenr/* Called only for inbound packets, adjusts the acknowledge number and the */ 3510145522Sdarrenr/* TCP checksum to match that change. */ 3511145522Sdarrenr/* ------------------------------------------------------------------------ */ 3512255332Scystatic void 3513255332Scyipf_fixinisn(fin, is) 3514255332Scy fr_info_t *fin; 3515255332Scy ipstate_t *is; 3516145522Sdarrenr{ 3517145522Sdarrenr tcphdr_t *tcp; 3518145522Sdarrenr int rev; 3519145522Sdarrenr u_32_t ack; 3520145522Sdarrenr 3521145522Sdarrenr tcp = fin->fin_dp; 3522145522Sdarrenr rev = fin->fin_rev; 3523145522Sdarrenr if ((is->is_flags & IS_ISNSYN) != 0) { 3524255332Scy if ((rev == 1) && (fin->fin_cksum < FI_CK_L4PART)) { 3525145522Sdarrenr ack = ntohl(tcp->th_ack); 3526145522Sdarrenr ack -= is->is_isninc[0]; 3527145522Sdarrenr tcp->th_ack = htonl(ack); 3528255332Scy ipf_fix_incksum(0, &tcp->th_sum, is->is_sumd[0], 0); 3529145522Sdarrenr } 3530145522Sdarrenr } 3531145522Sdarrenr if ((is->is_flags & IS_ISNACK) != 0) { 3532255332Scy if ((rev == 0) && (fin->fin_cksum < FI_CK_L4PART)) { 3533145522Sdarrenr ack = ntohl(tcp->th_ack); 3534145522Sdarrenr ack -= is->is_isninc[1]; 3535145522Sdarrenr tcp->th_ack = htonl(ack); 3536255332Scy ipf_fix_incksum(0, &tcp->th_sum, is->is_sumd[1], 0); 3537145522Sdarrenr } 3538145522Sdarrenr } 3539145522Sdarrenr} 3540145522Sdarrenr 3541145522Sdarrenr 3542145522Sdarrenr/* ------------------------------------------------------------------------ */ 3543255332Scy/* Function: ipf_state_sync */ 3544145522Sdarrenr/* Returns: Nil */ 3545255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 3546255332Scy/* ifp(I) - pointer to interface */ 3547145522Sdarrenr/* */ 3548145522Sdarrenr/* Walk through all state entries and if an interface pointer match is */ 3549145522Sdarrenr/* found then look it up again, based on its name in case the pointer has */ 3550145522Sdarrenr/* changed since last time. */ 3551145522Sdarrenr/* */ 3552145522Sdarrenr/* If ifp is passed in as being non-null then we are only doing updates for */ 3553145522Sdarrenr/* existing, matching, uses of it. */ 3554145522Sdarrenr/* ------------------------------------------------------------------------ */ 3555255332Scyvoid 3556255332Scyipf_state_sync(softc, ifp) 3557255332Scy ipf_main_softc_t *softc; 3558255332Scy void *ifp; 355960854Sdarrenr{ 3560255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 3561145522Sdarrenr ipstate_t *is; 356292685Sdarrenr int i; 356360854Sdarrenr 3564255332Scy if (softc->ipf_running <= 0) 3565145522Sdarrenr return; 3566145522Sdarrenr 3567255332Scy WRITE_ENTER(&softc->ipf_state); 3568145522Sdarrenr 3569255332Scy if (softc->ipf_running <= 0) { 3570255332Scy RWLOCK_EXIT(&softc->ipf_state); 3571145522Sdarrenr return; 3572145522Sdarrenr } 3573145522Sdarrenr 3574255332Scy for (is = softs->ipf_state_list; is; is = is->is_next) { 3575145522Sdarrenr /* 3576145522Sdarrenr * Look up all the interface names in the state entry. 3577145522Sdarrenr */ 357892685Sdarrenr for (i = 0; i < 4; i++) { 3579145522Sdarrenr if (ifp == NULL || ifp == is->is_ifp[i]) 3580255332Scy is->is_ifp[i] = ipf_resolvenic(softc, 3581255332Scy is->is_ifname[i], 3582145522Sdarrenr is->is_v); 358360854Sdarrenr } 358460854Sdarrenr } 3585255332Scy RWLOCK_EXIT(&softc->ipf_state); 358660854Sdarrenr} 358760854Sdarrenr 358860854Sdarrenr 3589145522Sdarrenr/* ------------------------------------------------------------------------ */ 3590255332Scy/* Function: ipf_state_del */ 3591255332Scy/* Returns: int - 0 = deleted, else refernce count on active struct */ 3592255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 3593255332Scy/* is(I) - pointer to state structure to delete */ 3594145522Sdarrenr/* why(I) - if not 0, log reason why it was deleted */ 3595145522Sdarrenr/* Write Locks: ipf_state */ 3596145522Sdarrenr/* */ 3597145522Sdarrenr/* Deletes a state entry from the enumerated list as well as the hash table */ 3598145522Sdarrenr/* and timeout queue lists. Make adjustments to hash table statistics and */ 3599145522Sdarrenr/* global counters as required. */ 3600145522Sdarrenr/* ------------------------------------------------------------------------ */ 3601255332Scystatic int 3602255332Scyipf_state_del(softc, is, why) 3603255332Scy ipf_main_softc_t *softc; 3604255332Scy ipstate_t *is; 3605255332Scy int why; 360653642Sguido{ 3607255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 3608255332Scy int orphan = 1; 3609255332Scy frentry_t *fr; 361053642Sguido 3611145522Sdarrenr /* 3612145522Sdarrenr * Since we want to delete this, remove it from the state table, 3613145522Sdarrenr * where it can be found & used, first. 3614145522Sdarrenr */ 3615145522Sdarrenr if (is->is_phnext != NULL) { 3616145522Sdarrenr *is->is_phnext = is->is_hnext; 3617145522Sdarrenr if (is->is_hnext != NULL) 3618145522Sdarrenr is->is_hnext->is_phnext = is->is_phnext; 3619255332Scy if (softs->ipf_state_table[is->is_hv] == NULL) 3620255332Scy softs->ipf_state_stats.iss_inuse--; 3621255332Scy softs->ipf_state_stats.iss_bucketlen[is->is_hv]--; 3622145522Sdarrenr 3623145522Sdarrenr is->is_phnext = NULL; 3624145522Sdarrenr is->is_hnext = NULL; 3625255332Scy orphan = 0; 3626145522Sdarrenr } 3627145522Sdarrenr 3628145522Sdarrenr /* 3629255332Scy * Because ipf_state_stats.iss_wild is a count of entries in the state 3630145522Sdarrenr * table that have wildcard flags set, only decerement it once 3631145522Sdarrenr * and do it here. 3632145522Sdarrenr */ 3633145522Sdarrenr if (is->is_flags & (SI_WILDP|SI_WILDA)) { 3634145522Sdarrenr if (!(is->is_flags & SI_CLONED)) { 3635255332Scy ATOMIC_DECL(softs->ipf_state_stats.iss_wild); 363672006Sdarrenr } 3637145522Sdarrenr is->is_flags &= ~(SI_WILDP|SI_WILDA); 363853642Sguido } 3639145522Sdarrenr 3640145522Sdarrenr /* 3641145522Sdarrenr * Next, remove it from the timeout queue it is in. 3642145522Sdarrenr */ 3643170268Sdarrenr if (is->is_sti.tqe_ifq != NULL) 3644255332Scy ipf_deletequeueentry(&is->is_sti); 3645145522Sdarrenr 3646145522Sdarrenr /* 3647145522Sdarrenr * If it is still in use by something else, do not go any further, 3648170268Sdarrenr * but note that at this point it is now an orphan. How can this 3649255332Scy * be? ipf_state_flush() calls ipf_delete() directly because it wants 3650170268Sdarrenr * to empty the table out and if something has a hold on a state 3651170268Sdarrenr * entry (such as ipfstat), it'll do the deref path that'll bring 3652170268Sdarrenr * us back here to do the real delete & free. 3653145522Sdarrenr */ 3654172776Sdarrenr MUTEX_ENTER(&is->is_lock); 3655255332Scy if (is->is_me != NULL) { 3656255332Scy *is->is_me = NULL; 3657255332Scy is->is_me = NULL; 3658255332Scy is->is_ref--; 3659255332Scy } 3660288250Scy is->is_ref--; 3661288250Scy if (is->is_ref > 0) { 3662255332Scy int refs; 3663255332Scy 3664255332Scy refs = is->is_ref; 3665172776Sdarrenr MUTEX_EXIT(&is->is_lock); 3666255332Scy if (!orphan) 3667255332Scy softs->ipf_state_stats.iss_orphan++; 3668255332Scy return refs; 3669172776Sdarrenr } 3670145522Sdarrenr 3671255332Scy fr = is->is_rule; 3672255332Scy is->is_rule = NULL; 3673255332Scy if (fr != NULL) { 3674255332Scy if (fr->fr_srctrack.ht_max_nodes != 0) { 3675255332Scy (void) ipf_ht_node_del(&fr->fr_srctrack, 3676255332Scy is->is_family, &is->is_src); 3677255332Scy } 3678255332Scy } 3679255332Scy 3680289628Scy ASSERT(is->is_ref == 0); 3681287984Scy MUTEX_EXIT(&is->is_lock); 3682172776Sdarrenr 3683145522Sdarrenr if (is->is_tqehead[0] != NULL) { 3684255332Scy if (ipf_deletetimeoutqueue(is->is_tqehead[0]) == 0) 3685255332Scy ipf_freetimeoutqueue(softc, is->is_tqehead[0]); 3686145522Sdarrenr } 3687145522Sdarrenr if (is->is_tqehead[1] != NULL) { 3688255332Scy if (ipf_deletetimeoutqueue(is->is_tqehead[1]) == 0) 3689255332Scy ipf_freetimeoutqueue(softc, is->is_tqehead[1]); 3690145522Sdarrenr } 3691145522Sdarrenr 3692145522Sdarrenr if (is->is_sync) 3693255332Scy ipf_sync_del_state(softc->ipf_sync_soft, is->is_sync); 3694145522Sdarrenr 3695170268Sdarrenr /* 3696170268Sdarrenr * Now remove it from the linked list of known states 3697170268Sdarrenr */ 3698170268Sdarrenr if (is->is_pnext != NULL) { 3699170268Sdarrenr *is->is_pnext = is->is_next; 3700170268Sdarrenr 3701170268Sdarrenr if (is->is_next != NULL) 3702170268Sdarrenr is->is_next->is_pnext = is->is_pnext; 3703170268Sdarrenr 3704170268Sdarrenr is->is_pnext = NULL; 3705170268Sdarrenr is->is_next = NULL; 3706170268Sdarrenr } 3707170268Sdarrenr 3708255332Scy if (softs->ipf_state_logging != 0 && why != 0) 3709255332Scy ipf_state_log(softc, is, why); 3710145522Sdarrenr 3711153876Sguido if (is->is_p == IPPROTO_TCP) 3712255332Scy softs->ipf_state_stats.iss_fin++; 3713153876Sguido else 3714255332Scy softs->ipf_state_stats.iss_expire++; 3715255332Scy if (orphan) 3716255332Scy softs->ipf_state_stats.iss_orphan--; 3717153876Sguido 3718255332Scy if (fr != NULL) { 3719255332Scy fr->fr_statecnt--; 3720255332Scy (void) ipf_derefrule(softc, &fr); 3721145522Sdarrenr } 3722145522Sdarrenr 3723255332Scy softs->ipf_state_stats.iss_active_proto[is->is_p]--; 3724180778Sdarrenr 372560854Sdarrenr MUTEX_DESTROY(&is->is_lock); 372653642Sguido KFREE(is); 3727255332Scy softs->ipf_state_stats.iss_active--; 3728170268Sdarrenr 3729170268Sdarrenr return 0; 373053642Sguido} 373153642Sguido 373253642Sguido 3733145522Sdarrenr/* ------------------------------------------------------------------------ */ 3734255332Scy/* Function: ipf_state_expire */ 3735145522Sdarrenr/* Returns: Nil */ 3736255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 3737145522Sdarrenr/* */ 3738145522Sdarrenr/* Slowly expire held state for thingslike UDP and ICMP. The algorithm */ 3739145522Sdarrenr/* used here is to keep the queue sorted with the oldest things at the top */ 3740145522Sdarrenr/* and the youngest at the bottom. So if the top one doesn't need to be */ 3741145522Sdarrenr/* expired then neither will any under it. */ 3742145522Sdarrenr/* ------------------------------------------------------------------------ */ 3743255332Scyvoid 3744255332Scyipf_state_expire(softc) 3745255332Scy ipf_main_softc_t *softc; 374653642Sguido{ 3747255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 3748145522Sdarrenr ipftq_t *ifq, *ifqnext; 3749145522Sdarrenr ipftqent_t *tqe, *tqn; 3750145522Sdarrenr ipstate_t *is; 3751153876Sguido SPL_INT(s); 375253642Sguido 3753145522Sdarrenr SPL_NET(s); 3754255332Scy WRITE_ENTER(&softc->ipf_state); 3755255332Scy for (ifq = softs->ipf_state_tcptq; ifq != NULL; ifq = ifq->ifq_next) 3756145522Sdarrenr for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 3757255332Scy if (tqe->tqe_die > softc->ipf_ticks) 3758145522Sdarrenr break; 3759145522Sdarrenr tqn = tqe->tqe_next; 3760145522Sdarrenr is = tqe->tqe_parent; 3761255332Scy ipf_state_del(softc, is, ISL_EXPIRE); 3762145522Sdarrenr } 3763145522Sdarrenr 3764255332Scy for (ifq = softs->ipf_state_usertq; ifq != NULL; ifq = ifqnext) { 3765145522Sdarrenr ifqnext = ifq->ifq_next; 3766145522Sdarrenr 3767145522Sdarrenr for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 3768255332Scy if (tqe->tqe_die > softc->ipf_ticks) 3769145522Sdarrenr break; 3770145522Sdarrenr tqn = tqe->tqe_next; 3771145522Sdarrenr is = tqe->tqe_parent; 3772255332Scy ipf_state_del(softc, is, ISL_EXPIRE); 3773145522Sdarrenr } 3774145522Sdarrenr } 3775145522Sdarrenr 3776255332Scy for (ifq = softs->ipf_state_usertq; ifq != NULL; ifq = ifqnext) { 3777145522Sdarrenr ifqnext = ifq->ifq_next; 3778145522Sdarrenr 3779145522Sdarrenr if (((ifq->ifq_flags & IFQF_DELETE) != 0) && 3780145522Sdarrenr (ifq->ifq_ref == 0)) { 3781255332Scy ipf_freetimeoutqueue(softc, ifq); 3782145522Sdarrenr } 3783145522Sdarrenr } 3784145522Sdarrenr 3785255332Scy if (softs->ipf_state_doflush) { 3786255332Scy (void) ipf_state_flush(softc, 2, 0); 3787255332Scy softs->ipf_state_doflush = 0; 3788255332Scy softs->ipf_state_wm_last = softc->ipf_ticks; 3789145522Sdarrenr } 3790145522Sdarrenr 3791255332Scy RWLOCK_EXIT(&softc->ipf_state); 3792145522Sdarrenr SPL_X(s); 379353642Sguido} 379453642Sguido 379553642Sguido 3796145522Sdarrenr/* ------------------------------------------------------------------------ */ 3797255332Scy/* Function: ipf_state_flush */ 3798145522Sdarrenr/* Returns: int - 0 == success, -1 == failure */ 3799255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 3800255332Scy/* which(I) - which flush action to perform */ 3801255332Scy/* proto(I) - which protocol to flush (0 == ALL) */ 3802145522Sdarrenr/* Write Locks: ipf_state */ 3803145522Sdarrenr/* */ 3804145522Sdarrenr/* Flush state tables. Three actions currently defined: */ 3805145522Sdarrenr/* which == 0 : flush all state table entries */ 3806145522Sdarrenr/* which == 1 : flush TCP connections which have started to close but are */ 3807145522Sdarrenr/* stuck for some reason. */ 3808145522Sdarrenr/* which == 2 : flush TCP connections which have been idle for a long time, */ 3809145522Sdarrenr/* starting at > 4 days idle and working back in successive half-*/ 3810145522Sdarrenr/* days to at most 12 hours old. If this fails to free enough */ 3811145522Sdarrenr/* slots then work backwards in half hour slots to 30 minutes. */ 3812145522Sdarrenr/* If that too fails, then work backwards in 30 second intervals */ 3813145522Sdarrenr/* for the last 30 minutes to at worst 30 seconds idle. */ 3814145522Sdarrenr/* ------------------------------------------------------------------------ */ 3815255332Scyint 3816255332Scyipf_state_flush(softc, which, proto) 3817255332Scy ipf_main_softc_t *softc; 3818255332Scy int which, proto; 381953642Sguido{ 3820255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 3821145522Sdarrenr ipftqent_t *tqe, *tqn; 3822145522Sdarrenr ipstate_t *is, **isp; 3823255332Scy ipftq_t *ifq; 3824170268Sdarrenr int removed; 3825153876Sguido SPL_INT(s); 382653642Sguido 3827145522Sdarrenr removed = 0; 3828145522Sdarrenr 382953642Sguido SPL_NET(s); 3830145522Sdarrenr 3831170268Sdarrenr switch (which) 3832170268Sdarrenr { 3833170268Sdarrenr case 0 : 3834255332Scy SBUMP(ipf_state_stats.iss_flush_all); 3835170268Sdarrenr /* 3836170268Sdarrenr * Style 0 flush removes everything... 3837170268Sdarrenr */ 3838255332Scy for (isp = &softs->ipf_state_list; ((is = *isp) != NULL); ) { 3839170268Sdarrenr if ((proto != 0) && (is->is_v != proto)) { 3840170268Sdarrenr isp = &is->is_next; 3841170268Sdarrenr continue; 3842170268Sdarrenr } 3843255332Scy if (ipf_state_del(softc, is, ISL_FLUSH) == 0) 3844170268Sdarrenr removed++; 3845170268Sdarrenr else 3846170268Sdarrenr isp = &is->is_next; 3847145522Sdarrenr } 3848170268Sdarrenr break; 3849145522Sdarrenr 3850170268Sdarrenr case 1 : 3851255332Scy SBUMP(ipf_state_stats.iss_flush_closing); 3852170268Sdarrenr /* 3853170268Sdarrenr * Since we're only interested in things that are closing, 3854170268Sdarrenr * we can start with the appropriate timeout queue. 3855170268Sdarrenr */ 3856255332Scy for (ifq = softs->ipf_state_tcptq + IPF_TCPS_CLOSE_WAIT; 3857255332Scy ifq != NULL; ifq = ifq->ifq_next) { 3858170268Sdarrenr 3859170268Sdarrenr for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 3860170268Sdarrenr tqn = tqe->tqe_next; 3861170268Sdarrenr is = tqe->tqe_parent; 3862170268Sdarrenr if (is->is_p != IPPROTO_TCP) 3863170268Sdarrenr break; 3864255332Scy if (ipf_state_del(softc, is, ISL_FLUSH) == 0) 3865170268Sdarrenr removed++; 3866170268Sdarrenr } 3867145522Sdarrenr } 3868145522Sdarrenr 3869170268Sdarrenr /* 3870170268Sdarrenr * Also need to look through the user defined queues. 3871170268Sdarrenr */ 3872255332Scy for (ifq = softs->ipf_state_usertq; ifq != NULL; 3873255332Scy ifq = ifq->ifq_next) { 3874170268Sdarrenr for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 3875170268Sdarrenr tqn = tqe->tqe_next; 3876170268Sdarrenr is = tqe->tqe_parent; 3877170268Sdarrenr if (is->is_p != IPPROTO_TCP) 3878170268Sdarrenr continue; 3879170268Sdarrenr 3880170268Sdarrenr if ((is->is_state[0] > IPF_TCPS_ESTABLISHED) && 3881170268Sdarrenr (is->is_state[1] > IPF_TCPS_ESTABLISHED)) { 3882255332Scy if (ipf_state_del(softc, is, 3883255332Scy ISL_FLUSH) == 0) 3884170268Sdarrenr removed++; 3885170268Sdarrenr } 3886170268Sdarrenr } 3887170268Sdarrenr } 3888170268Sdarrenr break; 3889170268Sdarrenr 3890170268Sdarrenr case 2 : 3891170268Sdarrenr break; 3892170268Sdarrenr 3893255332Scy /* 3894170268Sdarrenr * Args 5-11 correspond to flushing those particular states 3895170268Sdarrenr * for TCP connections. 3896170268Sdarrenr */ 3897170268Sdarrenr case IPF_TCPS_CLOSE_WAIT : 3898170268Sdarrenr case IPF_TCPS_FIN_WAIT_1 : 3899170268Sdarrenr case IPF_TCPS_CLOSING : 3900170268Sdarrenr case IPF_TCPS_LAST_ACK : 3901170268Sdarrenr case IPF_TCPS_FIN_WAIT_2 : 3902170268Sdarrenr case IPF_TCPS_TIME_WAIT : 3903170268Sdarrenr case IPF_TCPS_CLOSED : 3904255332Scy SBUMP(ipf_state_stats.iss_flush_queue); 3905255332Scy tqn = softs->ipf_state_tcptq[which].ifq_head; 3906170268Sdarrenr while (tqn != NULL) { 3907170268Sdarrenr tqe = tqn; 3908170268Sdarrenr tqn = tqe->tqe_next; 3909170268Sdarrenr is = tqe->tqe_parent; 3910255332Scy if (ipf_state_del(softc, is, ISL_FLUSH) == 0) 3911170268Sdarrenr removed++; 3912170268Sdarrenr } 3913170268Sdarrenr break; 3914170268Sdarrenr 3915170268Sdarrenr default : 3916170268Sdarrenr if (which < 30) 3917170268Sdarrenr break; 3918170268Sdarrenr 3919255332Scy SBUMP(ipf_state_stats.iss_flush_state); 3920255332Scy /* 3921170268Sdarrenr * Take a large arbitrary number to mean the number of seconds 3922170268Sdarrenr * for which which consider to be the maximum value we'll allow 3923170268Sdarrenr * the expiration to be. 3924170268Sdarrenr */ 3925170268Sdarrenr which = IPF_TTLVAL(which); 3926255332Scy for (isp = &softs->ipf_state_list; ((is = *isp) != NULL); ) { 3927170268Sdarrenr if ((proto == 0) || (is->is_v == proto)) { 3928255332Scy if (softc->ipf_ticks - is->is_touched > which) { 3929255332Scy if (ipf_state_del(softc, is, 3930255332Scy ISL_FLUSH) == 0) { 3931170268Sdarrenr removed++; 3932170268Sdarrenr continue; 3933170268Sdarrenr } 3934170268Sdarrenr } 3935170268Sdarrenr } 393660854Sdarrenr isp = &is->is_next; 3937170268Sdarrenr } 3938170268Sdarrenr break; 393955929Sguido } 394053642Sguido 3941145522Sdarrenr if (which != 2) { 3942145522Sdarrenr SPL_X(s); 3943145522Sdarrenr return removed; 3944145522Sdarrenr } 394553642Sguido 3946255332Scy SBUMP(ipf_state_stats.iss_flush_timeout); 3947145522Sdarrenr /* 3948255332Scy * Asked to remove inactive entries because the table is full, try 3949255332Scy * again, 3 times, if first attempt failed with a different criteria 3950255332Scy * each time. The order tried in must be in decreasing age. 3951255332Scy * Another alternative is to implement random drop and drop N entries 3952255332Scy * at random until N have been freed up. 3953145522Sdarrenr */ 3954255332Scy if (softc->ipf_ticks - softs->ipf_state_wm_last > 3955255332Scy softs->ipf_state_wm_freq) { 3956255332Scy removed = ipf_queueflush(softc, ipf_state_flush_entry, 3957255332Scy softs->ipf_state_tcptq, 3958255332Scy softs->ipf_state_usertq, 3959255332Scy &softs->ipf_state_stats.iss_active, 3960255332Scy softs->ipf_state_size, 3961255332Scy softs->ipf_state_wm_low); 3962255332Scy softs->ipf_state_wm_last = softc->ipf_ticks; 3963170268Sdarrenr } 396453642Sguido 3965145522Sdarrenr SPL_X(s); 3966145522Sdarrenr return removed; 3967145522Sdarrenr} 396864580Sdarrenr 396964580Sdarrenr 3970170268Sdarrenr/* ------------------------------------------------------------------------ */ 3971255332Scy/* Function: ipf_state_flush_entry */ 3972170268Sdarrenr/* Returns: int - 0 = entry deleted, else not deleted */ 3973255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 3974255332Scy/* entry(I) - pointer to state structure to delete */ 3975170268Sdarrenr/* Write Locks: ipf_state */ 3976170268Sdarrenr/* */ 3977170268Sdarrenr/* This function is a stepping stone between ipf_queueflush() and */ 3978255332Scy/* ipf_state_del(). It is used so we can provide a uniform interface via */ 3979255332Scy/* the ipf_queueflush() function. */ 3980170268Sdarrenr/* ------------------------------------------------------------------------ */ 3981255332Scystatic int 3982255332Scyipf_state_flush_entry(softc, entry) 3983255332Scy ipf_main_softc_t *softc; 3984255332Scy void *entry; 3985170268Sdarrenr{ 3986255332Scy return ipf_state_del(softc, entry, ISL_FLUSH); 3987255332Scy} 398864580Sdarrenr 3989170268Sdarrenr 3990145522Sdarrenr/* ------------------------------------------------------------------------ */ 3991255332Scy/* Function: ipf_tcp_age */ 3992145522Sdarrenr/* Returns: int - 1 == state transition made, 0 == no change (rejected) */ 3993255332Scy/* Parameters: tqe(I) - pointer to timeout queue information */ 3994145522Sdarrenr/* fin(I) - pointer to packet information */ 3995145522Sdarrenr/* tqtab(I) - TCP timeout queue table this is in */ 3996145522Sdarrenr/* flags(I) - flags from state/NAT entry */ 3997255332Scy/* ok(I) - can we advance state */ 3998145522Sdarrenr/* */ 3999145522Sdarrenr/* Rewritten by Arjan de Vet <Arjan.deVet@adv.iae.nl>, 2000-07-29: */ 4000145522Sdarrenr/* */ 4001145522Sdarrenr/* - (try to) base state transitions on real evidence only, */ 4002145522Sdarrenr/* i.e. packets that are sent and have been received by ipfilter; */ 4003145522Sdarrenr/* diagram 18.12 of TCP/IP volume 1 by W. Richard Stevens was used. */ 4004145522Sdarrenr/* */ 4005145522Sdarrenr/* - deal with half-closed connections correctly; */ 4006145522Sdarrenr/* */ 4007145522Sdarrenr/* - store the state of the source in state[0] such that ipfstat */ 4008145522Sdarrenr/* displays the state as source/dest instead of dest/source; the calls */ 4009255332Scy/* to ipf_tcp_age have been changed accordingly. */ 4010145522Sdarrenr/* */ 4011145522Sdarrenr/* Internal Parameters: */ 4012145522Sdarrenr/* */ 4013145522Sdarrenr/* state[0] = state of source (host that initiated connection) */ 4014145522Sdarrenr/* state[1] = state of dest (host that accepted the connection) */ 4015145522Sdarrenr/* */ 4016145522Sdarrenr/* dir == 0 : a packet from source to dest */ 4017145522Sdarrenr/* dir == 1 : a packet from dest to source */ 4018145522Sdarrenr/* */ 4019170268Sdarrenr/* A typical procession for a connection is as follows: */ 4020170268Sdarrenr/* */ 4021170268Sdarrenr/* +--------------+-------------------+ */ 4022170268Sdarrenr/* | Side '0' | Side '1' | */ 4023170268Sdarrenr/* +--------------+-------------------+ */ 4024170268Sdarrenr/* | 0 -> 1 (SYN) | | */ 4025170268Sdarrenr/* | | 0 -> 2 (SYN-ACK) | */ 4026170268Sdarrenr/* | 1 -> 3 (ACK) | | */ 4027170268Sdarrenr/* | | 2 -> 4 (ACK-PUSH) | */ 4028170268Sdarrenr/* | 3 -> 4 (ACK) | | */ 4029170268Sdarrenr/* | ... | ... | */ 4030170268Sdarrenr/* | | 4 -> 6 (FIN-ACK) | */ 4031170268Sdarrenr/* | 4 -> 5 (ACK) | | */ 4032170268Sdarrenr/* | | 6 -> 6 (ACK-PUSH) | */ 4033170268Sdarrenr/* | 5 -> 5 (ACK) | | */ 4034170268Sdarrenr/* | 5 -> 8 (FIN) | | */ 4035170268Sdarrenr/* | | 6 -> 10 (ACK) | */ 4036170268Sdarrenr/* +--------------+-------------------+ */ 4037170268Sdarrenr/* */ 4038145522Sdarrenr/* Locking: it is assumed that the parent of the tqe structure is locked. */ 4039145522Sdarrenr/* ------------------------------------------------------------------------ */ 4040255332Scyint 4041255332Scyipf_tcp_age(tqe, fin, tqtab, flags, ok) 4042255332Scy ipftqent_t *tqe; 4043255332Scy fr_info_t *fin; 4044255332Scy ipftq_t *tqtab; 4045255332Scy int flags, ok; 4046145522Sdarrenr{ 4047255332Scy ipf_main_softc_t *softc = fin->fin_main_soft; 4048145522Sdarrenr int dlen, ostate, nstate, rval, dir; 4049145522Sdarrenr u_char tcpflags; 4050145522Sdarrenr tcphdr_t *tcp; 4051145522Sdarrenr 4052145522Sdarrenr tcp = fin->fin_dp; 4053145522Sdarrenr 4054145522Sdarrenr rval = 0; 4055145522Sdarrenr dir = fin->fin_rev; 4056145522Sdarrenr tcpflags = tcp->th_flags; 4057153876Sguido dlen = fin->fin_dlen - (TCP_OFF(tcp) << 2); 4058255332Scy ostate = tqe->tqe_state[1 - dir]; 4059255332Scy nstate = tqe->tqe_state[dir]; 4060145522Sdarrenr 4061145522Sdarrenr if (tcpflags & TH_RST) { 4062145522Sdarrenr if (!(tcpflags & TH_PUSH) && !dlen) 4063145522Sdarrenr nstate = IPF_TCPS_CLOSED; 4064145522Sdarrenr else 4065145522Sdarrenr nstate = IPF_TCPS_CLOSE_WAIT; 4066255332Scy 4067255332Scy if (ostate <= IPF_TCPS_ESTABLISHED) { 4068255332Scy tqe->tqe_state[1 - dir] = IPF_TCPS_CLOSE_WAIT; 4069255332Scy } 4070145522Sdarrenr rval = 1; 4071145522Sdarrenr } else { 4072145522Sdarrenr switch (nstate) 4073145522Sdarrenr { 4074170268Sdarrenr case IPF_TCPS_LISTEN: /* 0 */ 4075145522Sdarrenr if ((tcpflags & TH_OPENING) == TH_OPENING) { 4076145522Sdarrenr /* 4077145522Sdarrenr * 'dir' received an S and sends SA in 4078170268Sdarrenr * response, LISTEN -> SYN_RECEIVED 4079145522Sdarrenr */ 4080145522Sdarrenr nstate = IPF_TCPS_SYN_RECEIVED; 4081145522Sdarrenr rval = 1; 4082145522Sdarrenr } else if ((tcpflags & TH_OPENING) == TH_SYN) { 4083170268Sdarrenr /* 'dir' sent S, LISTEN -> SYN_SENT */ 4084145522Sdarrenr nstate = IPF_TCPS_SYN_SENT; 4085145522Sdarrenr rval = 1; 4086145522Sdarrenr } 408764580Sdarrenr /* 4088145522Sdarrenr * the next piece of code makes it possible to get 4089145522Sdarrenr * already established connections into the state table 4090145522Sdarrenr * after a restart or reload of the filter rules; this 4091145522Sdarrenr * does not work when a strict 'flags S keep state' is 4092145522Sdarrenr * used for tcp connections of course 409364580Sdarrenr */ 4094145522Sdarrenr if (((flags & IS_TCPFSM) == 0) && 4095145522Sdarrenr ((tcpflags & TH_ACKMASK) == TH_ACK)) { 4096145522Sdarrenr /* 4097145522Sdarrenr * we saw an A, guess 'dir' is in ESTABLISHED 4098145522Sdarrenr * mode 4099145522Sdarrenr */ 4100145522Sdarrenr switch (ostate) 4101145522Sdarrenr { 4102170268Sdarrenr case IPF_TCPS_LISTEN : 4103145522Sdarrenr case IPF_TCPS_SYN_RECEIVED : 4104145522Sdarrenr nstate = IPF_TCPS_HALF_ESTAB; 4105145522Sdarrenr rval = 1; 4106145522Sdarrenr break; 4107145522Sdarrenr case IPF_TCPS_HALF_ESTAB : 4108145522Sdarrenr case IPF_TCPS_ESTABLISHED : 4109145522Sdarrenr nstate = IPF_TCPS_ESTABLISHED; 4110145522Sdarrenr rval = 1; 4111145522Sdarrenr break; 4112145522Sdarrenr default : 4113145522Sdarrenr break; 4114145522Sdarrenr } 4115145522Sdarrenr } 411695563Sdarrenr /* 4117145522Sdarrenr * TODO: besides regular ACK packets we can have other 4118145522Sdarrenr * packets as well; it is yet to be determined how we 4119145522Sdarrenr * should initialize the states in those cases 412095563Sdarrenr */ 4121145522Sdarrenr break; 412264580Sdarrenr 4123170268Sdarrenr case IPF_TCPS_SYN_SENT: /* 1 */ 4124145522Sdarrenr if ((tcpflags & ~(TH_ECN|TH_CWR)) == TH_SYN) { 412564580Sdarrenr /* 4126145522Sdarrenr * A retransmitted SYN packet. We do not reset 4127255332Scy * the timeout here to ipf_tcptimeout because a 4128145522Sdarrenr * connection connect timeout does not renew 4129145522Sdarrenr * after every packet that is sent. We need to 4130145522Sdarrenr * set rval so as to indicate the packet has 4131145522Sdarrenr * passed the check for its flags being valid 4132145522Sdarrenr * in the TCP FSM. Setting rval to 2 has the 4133145522Sdarrenr * result of not resetting the timeout. 413464580Sdarrenr */ 4135145522Sdarrenr rval = 2; 4136145522Sdarrenr } else if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) == 4137145522Sdarrenr TH_ACK) { 413864580Sdarrenr /* 4139145522Sdarrenr * we see an A from 'dir' which is in SYN_SENT 4140145522Sdarrenr * state: 'dir' sent an A in response to an SA 4141145522Sdarrenr * which it received, SYN_SENT -> ESTABLISHED 414264580Sdarrenr */ 4143145522Sdarrenr nstate = IPF_TCPS_ESTABLISHED; 4144145522Sdarrenr rval = 1; 4145145522Sdarrenr } else if (tcpflags & TH_FIN) { 4146145522Sdarrenr /* 4147145522Sdarrenr * we see an F from 'dir' which is in SYN_SENT 4148145522Sdarrenr * state and wants to close its side of the 4149145522Sdarrenr * connection; SYN_SENT -> FIN_WAIT_1 4150145522Sdarrenr */ 4151145522Sdarrenr nstate = IPF_TCPS_FIN_WAIT_1; 4152145522Sdarrenr rval = 1; 4153145522Sdarrenr } else if ((tcpflags & TH_OPENING) == TH_OPENING) { 4154145522Sdarrenr /* 4155145522Sdarrenr * we see an SA from 'dir' which is already in 4156145522Sdarrenr * SYN_SENT state, this means we have a 4157145522Sdarrenr * simultaneous open; SYN_SENT -> SYN_RECEIVED 4158145522Sdarrenr */ 4159145522Sdarrenr nstate = IPF_TCPS_SYN_RECEIVED; 4160145522Sdarrenr rval = 1; 4161145522Sdarrenr } 4162145522Sdarrenr break; 416364580Sdarrenr 4164170268Sdarrenr case IPF_TCPS_SYN_RECEIVED: /* 2 */ 4165145522Sdarrenr if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) == TH_ACK) { 4166145522Sdarrenr /* 4167145522Sdarrenr * we see an A from 'dir' which was in 4168145522Sdarrenr * SYN_RECEIVED state so it must now be in 4169145522Sdarrenr * established state, SYN_RECEIVED -> 4170145522Sdarrenr * ESTABLISHED 4171145522Sdarrenr */ 4172145522Sdarrenr nstate = IPF_TCPS_ESTABLISHED; 4173145522Sdarrenr rval = 1; 4174145522Sdarrenr } else if ((tcpflags & ~(TH_ECN|TH_CWR)) == 4175145522Sdarrenr TH_OPENING) { 4176145522Sdarrenr /* 4177145522Sdarrenr * We see an SA from 'dir' which is already in 4178145522Sdarrenr * SYN_RECEIVED state. 4179145522Sdarrenr */ 4180145522Sdarrenr rval = 2; 4181145522Sdarrenr } else if (tcpflags & TH_FIN) { 4182145522Sdarrenr /* 4183145522Sdarrenr * we see an F from 'dir' which is in 4184145522Sdarrenr * SYN_RECEIVED state and wants to close its 4185145522Sdarrenr * side of the connection; SYN_RECEIVED -> 4186145522Sdarrenr * FIN_WAIT_1 4187145522Sdarrenr */ 4188145522Sdarrenr nstate = IPF_TCPS_FIN_WAIT_1; 4189145522Sdarrenr rval = 1; 4190145522Sdarrenr } 4191145522Sdarrenr break; 419264580Sdarrenr 4193170268Sdarrenr case IPF_TCPS_HALF_ESTAB: /* 3 */ 4194153876Sguido if (tcpflags & TH_FIN) { 4195153876Sguido nstate = IPF_TCPS_FIN_WAIT_1; 4196153876Sguido rval = 1; 4197153876Sguido } else if ((tcpflags & TH_ACKMASK) == TH_ACK) { 4198153876Sguido /* 4199153876Sguido * If we've picked up a connection in mid 4200153876Sguido * flight, we could be looking at a follow on 4201153876Sguido * packet from the same direction as the one 4202153876Sguido * that created this state. Recognise it but 4203153876Sguido * do not advance the entire connection's 4204153876Sguido * state. 4205153876Sguido */ 4206153876Sguido switch (ostate) 4207153876Sguido { 4208170268Sdarrenr case IPF_TCPS_LISTEN : 4209153876Sguido case IPF_TCPS_SYN_SENT : 4210153876Sguido case IPF_TCPS_SYN_RECEIVED : 4211153876Sguido rval = 1; 4212153876Sguido break; 4213153876Sguido case IPF_TCPS_HALF_ESTAB : 4214153876Sguido case IPF_TCPS_ESTABLISHED : 4215145522Sdarrenr nstate = IPF_TCPS_ESTABLISHED; 4216145522Sdarrenr rval = 1; 4217153876Sguido break; 4218153876Sguido default : 4219153876Sguido break; 4220145522Sdarrenr } 4221145522Sdarrenr } 4222145522Sdarrenr break; 422364580Sdarrenr 4224170268Sdarrenr case IPF_TCPS_ESTABLISHED: /* 4 */ 4225145522Sdarrenr rval = 1; 4226145522Sdarrenr if (tcpflags & TH_FIN) { 4227145522Sdarrenr /* 4228145522Sdarrenr * 'dir' closed its side of the connection; 4229145522Sdarrenr * this gives us a half-closed connection; 4230145522Sdarrenr * ESTABLISHED -> FIN_WAIT_1 4231145522Sdarrenr */ 4232170268Sdarrenr if (ostate == IPF_TCPS_FIN_WAIT_1) { 4233170268Sdarrenr nstate = IPF_TCPS_CLOSING; 4234170268Sdarrenr } else { 4235170268Sdarrenr nstate = IPF_TCPS_FIN_WAIT_1; 4236170268Sdarrenr } 4237145522Sdarrenr } else if (tcpflags & TH_ACK) { 4238145522Sdarrenr /* 4239145522Sdarrenr * an ACK, should we exclude other flags here? 4240145522Sdarrenr */ 4241145522Sdarrenr if (ostate == IPF_TCPS_FIN_WAIT_1) { 4242145522Sdarrenr /* 4243145522Sdarrenr * We know the other side did an active 4244145522Sdarrenr * close, so we are ACKing the recvd 4245145522Sdarrenr * FIN packet (does the window matching 4246145522Sdarrenr * code guarantee this?) and go into 4247145522Sdarrenr * CLOSE_WAIT state; this gives us a 4248145522Sdarrenr * half-closed connection 4249145522Sdarrenr */ 4250145522Sdarrenr nstate = IPF_TCPS_CLOSE_WAIT; 4251145522Sdarrenr } else if (ostate < IPF_TCPS_CLOSE_WAIT) { 4252145522Sdarrenr /* 4253145522Sdarrenr * still a fully established 4254145522Sdarrenr * connection reset timeout 4255145522Sdarrenr */ 4256145522Sdarrenr nstate = IPF_TCPS_ESTABLISHED; 4257145522Sdarrenr } 4258145522Sdarrenr } 4259145522Sdarrenr break; 426064580Sdarrenr 4261170268Sdarrenr case IPF_TCPS_CLOSE_WAIT: /* 5 */ 4262145522Sdarrenr rval = 1; 4263145522Sdarrenr if (tcpflags & TH_FIN) { 426464580Sdarrenr /* 4265145522Sdarrenr * application closed and 'dir' sent a FIN, 4266145522Sdarrenr * we're now going into LAST_ACK state 426764580Sdarrenr */ 4268145522Sdarrenr nstate = IPF_TCPS_LAST_ACK; 4269145522Sdarrenr } else { 4270145522Sdarrenr /* 4271145522Sdarrenr * we remain in CLOSE_WAIT because the other 4272145522Sdarrenr * side has closed already and we did not 4273145522Sdarrenr * close our side yet; reset timeout 4274145522Sdarrenr */ 4275145522Sdarrenr nstate = IPF_TCPS_CLOSE_WAIT; 4276145522Sdarrenr } 4277145522Sdarrenr break; 427864580Sdarrenr 4279170268Sdarrenr case IPF_TCPS_FIN_WAIT_1: /* 6 */ 4280145522Sdarrenr rval = 1; 4281145522Sdarrenr if ((tcpflags & TH_ACK) && 4282145522Sdarrenr ostate > IPF_TCPS_CLOSE_WAIT) { 4283145522Sdarrenr /* 4284145522Sdarrenr * if the other side is not active anymore 4285145522Sdarrenr * it has sent us a FIN packet that we are 4286145522Sdarrenr * ack'ing now with an ACK; this means both 4287145522Sdarrenr * sides have now closed the connection and 4288145522Sdarrenr * we go into TIME_WAIT 4289145522Sdarrenr */ 4290145522Sdarrenr /* 4291145522Sdarrenr * XXX: how do we know we really are ACKing 4292145522Sdarrenr * the FIN packet here? does the window code 4293145522Sdarrenr * guarantee that? 4294145522Sdarrenr */ 4295255332Scy nstate = IPF_TCPS_LAST_ACK; 4296145522Sdarrenr } else { 4297145522Sdarrenr /* 4298145522Sdarrenr * we closed our side of the connection 4299145522Sdarrenr * already but the other side is still active 4300145522Sdarrenr * (ESTABLISHED/CLOSE_WAIT); continue with 4301145522Sdarrenr * this half-closed connection 4302145522Sdarrenr */ 4303145522Sdarrenr nstate = IPF_TCPS_FIN_WAIT_1; 4304145522Sdarrenr } 4305145522Sdarrenr break; 430664580Sdarrenr 4307170268Sdarrenr case IPF_TCPS_CLOSING: /* 7 */ 4308170268Sdarrenr if ((tcpflags & (TH_FIN|TH_ACK)) == TH_ACK) { 4309170268Sdarrenr nstate = IPF_TCPS_TIME_WAIT; 4310170268Sdarrenr } 4311255332Scy rval = 1; 4312145522Sdarrenr break; 4313145522Sdarrenr 4314170268Sdarrenr case IPF_TCPS_LAST_ACK: /* 8 */ 4315145522Sdarrenr if (tcpflags & TH_ACK) { 4316255332Scy rval = 1; 4317145522Sdarrenr } 4318145522Sdarrenr /* 4319255332Scy * we cannot detect when we go out of LAST_ACK state 4320255332Scy * to CLOSED because that is based on the reception 4321255332Scy * of ACK packets; ipfilter can only detect that a 4322255332Scy * packet has been sent by a host 4323145522Sdarrenr */ 4324145522Sdarrenr break; 4325145522Sdarrenr 4326170268Sdarrenr case IPF_TCPS_FIN_WAIT_2: /* 9 */ 4327170268Sdarrenr /* NOT USED */ 4328145522Sdarrenr break; 4329145522Sdarrenr 4330170268Sdarrenr case IPF_TCPS_TIME_WAIT: /* 10 */ 4331145522Sdarrenr /* we're in 2MSL timeout now */ 4332170268Sdarrenr if (ostate == IPF_TCPS_LAST_ACK) { 4333170268Sdarrenr nstate = IPF_TCPS_CLOSED; 4334255332Scy rval = 1; 4335255332Scy } else { 4336255332Scy rval = 2; 4337170268Sdarrenr } 4338145522Sdarrenr break; 4339145522Sdarrenr 4340170268Sdarrenr case IPF_TCPS_CLOSED: /* 11 */ 4341170268Sdarrenr rval = 2; 4342170268Sdarrenr break; 4343170268Sdarrenr 4344145522Sdarrenr default : 4345255332Scy#if !defined(_KERNEL) 4346145522Sdarrenr abort(); 4347145522Sdarrenr#endif 4348145522Sdarrenr break; 4349145522Sdarrenr } 435053642Sguido } 435195418Sdarrenr 4352145522Sdarrenr /* 4353145522Sdarrenr * If rval == 2 then do not update the queue position, but treat the 4354145522Sdarrenr * packet as being ok. 4355145522Sdarrenr */ 4356145522Sdarrenr if (rval == 2) 4357145522Sdarrenr rval = 1; 4358145522Sdarrenr else if (rval == 1) { 4359255332Scy if (ok) 4360255332Scy tqe->tqe_state[dir] = nstate; 4361145522Sdarrenr if ((tqe->tqe_flags & TQE_RULEBASED) == 0) 4362255332Scy ipf_movequeue(softc->ipf_ticks, tqe, tqe->tqe_ifq, 4363255332Scy tqtab + nstate); 436495418Sdarrenr } 4365145522Sdarrenr 4366145522Sdarrenr return rval; 436753642Sguido} 436853642Sguido 436953642Sguido 4370145522Sdarrenr/* ------------------------------------------------------------------------ */ 4371255332Scy/* Function: ipf_state_log */ 4372145522Sdarrenr/* Returns: Nil */ 4373255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 4374255332Scy/* is(I) - pointer to state structure */ 4375255332Scy/* type(I) - type of log entry to create */ 4376145522Sdarrenr/* */ 4377145522Sdarrenr/* Creates a state table log entry using the state structure and type info. */ 4378145522Sdarrenr/* passed in. Log packet/byte counts, source/destination address and other */ 4379145522Sdarrenr/* protocol specific information. */ 4380145522Sdarrenr/* ------------------------------------------------------------------------ */ 4381255332Scyvoid 4382255332Scyipf_state_log(softc, is, type) 4383255332Scy ipf_main_softc_t *softc; 4384255332Scy struct ipstate *is; 4385255332Scy u_int type; 438653642Sguido{ 4387145522Sdarrenr#ifdef IPFILTER_LOG 438853642Sguido struct ipslog ipsl; 4389145522Sdarrenr size_t sizes[1]; 439053642Sguido void *items[1]; 439153642Sguido int types[1]; 439253642Sguido 4393145522Sdarrenr /* 4394145522Sdarrenr * Copy information out of the ipstate_t structure and into the 4395145522Sdarrenr * structure used for logging. 4396145522Sdarrenr */ 439753642Sguido ipsl.isl_type = type; 4398145522Sdarrenr ipsl.isl_pkts[0] = is->is_pkts[0] + is->is_icmppkts[0]; 4399145522Sdarrenr ipsl.isl_bytes[0] = is->is_bytes[0]; 4400145522Sdarrenr ipsl.isl_pkts[1] = is->is_pkts[1] + is->is_icmppkts[1]; 4401145522Sdarrenr ipsl.isl_bytes[1] = is->is_bytes[1]; 4402145522Sdarrenr ipsl.isl_pkts[2] = is->is_pkts[2] + is->is_icmppkts[2]; 4403145522Sdarrenr ipsl.isl_bytes[2] = is->is_bytes[2]; 4404145522Sdarrenr ipsl.isl_pkts[3] = is->is_pkts[3] + is->is_icmppkts[3]; 4405145522Sdarrenr ipsl.isl_bytes[3] = is->is_bytes[3]; 440653642Sguido ipsl.isl_src = is->is_src; 440753642Sguido ipsl.isl_dst = is->is_dst; 440853642Sguido ipsl.isl_p = is->is_p; 440960854Sdarrenr ipsl.isl_v = is->is_v; 441053642Sguido ipsl.isl_flags = is->is_flags; 4411145522Sdarrenr ipsl.isl_tag = is->is_tag; 4412102520Sdarrenr ipsl.isl_rulen = is->is_rulen; 4413145522Sdarrenr (void) strncpy(ipsl.isl_group, is->is_group, FR_GROUPLEN); 4414145522Sdarrenr 441553642Sguido if (ipsl.isl_p == IPPROTO_TCP || ipsl.isl_p == IPPROTO_UDP) { 441653642Sguido ipsl.isl_sport = is->is_sport; 441753642Sguido ipsl.isl_dport = is->is_dport; 441853642Sguido if (ipsl.isl_p == IPPROTO_TCP) { 441953642Sguido ipsl.isl_state[0] = is->is_state[0]; 442053642Sguido ipsl.isl_state[1] = is->is_state[1]; 442153642Sguido } 442292685Sdarrenr } else if (ipsl.isl_p == IPPROTO_ICMP) { 4423145522Sdarrenr ipsl.isl_itype = is->is_icmp.ici_type; 442492685Sdarrenr } else if (ipsl.isl_p == IPPROTO_ICMPV6) { 4425145522Sdarrenr ipsl.isl_itype = is->is_icmp.ici_type; 442692685Sdarrenr } else { 442753642Sguido ipsl.isl_ps.isl_filler[0] = 0; 442853642Sguido ipsl.isl_ps.isl_filler[1] = 0; 442953642Sguido } 4430145522Sdarrenr 443153642Sguido items[0] = &ipsl; 443253642Sguido sizes[0] = sizeof(ipsl); 443353642Sguido types[0] = 0; 443453642Sguido 4435255332Scy (void) ipf_log_items(softc, IPL_LOGSTATE, NULL, items, sizes, types, 1); 4436145522Sdarrenr#endif 443753642Sguido} 443857096Sguido 443957096Sguido 444060854Sdarrenr#ifdef USE_INET6 4441145522Sdarrenr/* ------------------------------------------------------------------------ */ 4442255332Scy/* Function: ipf_checkicmp6matchingstate */ 4443145522Sdarrenr/* Returns: ipstate_t* - NULL == no match found, */ 4444145522Sdarrenr/* else pointer to matching state entry */ 4445145522Sdarrenr/* Parameters: fin(I) - pointer to packet information */ 4446145522Sdarrenr/* Locks: NULL == no locks, else Read Lock on ipf_state */ 4447145522Sdarrenr/* */ 4448145522Sdarrenr/* If we've got an ICMPv6 error message, using the information stored in */ 4449145522Sdarrenr/* the ICMPv6 packet, look for a matching state table entry. */ 4450145522Sdarrenr/* ------------------------------------------------------------------------ */ 4451255332Scystatic ipstate_t * 4452255332Scyipf_checkicmp6matchingstate(fin) 4453255332Scy fr_info_t *fin; 445457096Sguido{ 4455255332Scy ipf_main_softc_t *softc = fin->fin_main_soft; 4456255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 4457145522Sdarrenr struct icmp6_hdr *ic6, *oic; 4458145522Sdarrenr ipstate_t *is, **isp; 4459145522Sdarrenr u_short sport, dport; 4460145522Sdarrenr i6addr_t dst, src; 446160854Sdarrenr u_short savelen; 4462145522Sdarrenr icmpinfo_t *ic; 446360854Sdarrenr fr_info_t ofin; 446460854Sdarrenr tcphdr_t *tcp; 4465145522Sdarrenr ip6_t *oip6; 4466255332Scy u_char pr; 446760854Sdarrenr u_int hv; 4468255332Scy int type; 446957096Sguido 447060854Sdarrenr /* 447160854Sdarrenr * Does it at least have the return (basic) IP header ? 4472153876Sguido * Is it an actual recognised ICMP error type? 447360854Sdarrenr * Only a basic IP header (no options) should be with 447460854Sdarrenr * an ICMP error header. 447560854Sdarrenr */ 4476153876Sguido if ((fin->fin_v != 6) || (fin->fin_plen < ICMP6ERR_MINPKTLEN) || 4477255332Scy !(fin->fin_flx & FI_ICMPERR)) { 4478255332Scy SBUMPD(ipf_state_stats, iss_icmp_bad); 447960854Sdarrenr return NULL; 4480255332Scy } 4481145522Sdarrenr 4482145522Sdarrenr ic6 = fin->fin_dp; 4483145522Sdarrenr type = ic6->icmp6_type; 448460854Sdarrenr 4485145522Sdarrenr oip6 = (ip6_t *)((char *)ic6 + ICMPERR_ICMPHLEN); 4486255332Scy if (fin->fin_plen < sizeof(*oip6)) { 4487255332Scy SBUMPD(ipf_state_stats, iss_icmp_short); 448860854Sdarrenr return NULL; 4489255332Scy } 449060854Sdarrenr 4491170268Sdarrenr bcopy((char *)fin, (char *)&ofin, sizeof(*fin)); 4492145522Sdarrenr ofin.fin_v = 6; 4493145522Sdarrenr ofin.fin_ifp = fin->fin_ifp; 4494145522Sdarrenr ofin.fin_out = !fin->fin_out; 4495145522Sdarrenr ofin.fin_m = NULL; /* if dereferenced, panic XXX */ 4496145522Sdarrenr ofin.fin_mp = NULL; /* if dereferenced, panic XXX */ 449795563Sdarrenr 4498130886Sdarrenr /* 4499130886Sdarrenr * We make a fin entry to be able to feed it to 4500130886Sdarrenr * matchsrcdst. Note that not all fields are necessary 4501130886Sdarrenr * but this is the cleanest way. Note further we fill 4502130886Sdarrenr * in fin_mp such that if someone uses it we'll get 4503255332Scy * a kernel panic. ipf_matchsrcdst does not use this. 4504130886Sdarrenr * 4505145522Sdarrenr * watch out here, as ip is in host order and oip6 in network 4506130886Sdarrenr * order. Any change we make must be undone afterwards. 4507130886Sdarrenr */ 4508145522Sdarrenr savelen = oip6->ip6_plen; 4509255332Scy oip6->ip6_plen = htons(fin->fin_dlen - ICMPERR_ICMPHLEN); 4510145522Sdarrenr ofin.fin_flx = FI_NOCKSUM; 4511145522Sdarrenr ofin.fin_ip = (ip_t *)oip6; 4512255332Scy (void) ipf_makefrip(sizeof(*oip6), (ip_t *)oip6, &ofin); 4513145522Sdarrenr ofin.fin_flx &= ~(FI_BAD|FI_SHORT); 4514145522Sdarrenr oip6->ip6_plen = savelen; 4515255332Scy pr = ofin.fin_p; 451695563Sdarrenr 4517255332Scy /* 4518255332Scy * an ICMP error can never generate an ICMP error in response. 4519255332Scy */ 4520255332Scy if (ofin.fin_flx & FI_ICMPERR) { 4521255332Scy DT1(iss_icmp6_icmperr, fr_info_t *, &ofin); 4522255332Scy SBUMP(ipf_state_stats.iss_icmp6_icmperr); 4523255332Scy return NULL; 4524255332Scy } 4525255332Scy 4526145522Sdarrenr if (oip6->ip6_nxt == IPPROTO_ICMPV6) { 4527255332Scy oic = ofin.fin_dp; 452860854Sdarrenr /* 4529130886Sdarrenr * an ICMP error can only be generated as a result of an 453060854Sdarrenr * ICMP query, not as the response on an ICMP error 453160854Sdarrenr * 453260854Sdarrenr * XXX theoretically ICMP_ECHOREP and the other reply's are 453360854Sdarrenr * ICMP query's as well, but adding them here seems strange XXX 453460854Sdarrenr */ 4535255332Scy if (!(oic->icmp6_type & ICMP6_INFOMSG_MASK)) { 4536255332Scy DT1(iss_icmp6_notinfo, fr_info_t *, &ofin); 4537255332Scy SBUMP(ipf_state_stats.iss_icmp6_notinfo); 4538255332Scy return NULL; 4539255332Scy } 454060854Sdarrenr 454160854Sdarrenr /* 454260854Sdarrenr * perform a lookup of the ICMP packet in the state table 454360854Sdarrenr */ 4544145522Sdarrenr hv = (pr = oip6->ip6_nxt); 4545145522Sdarrenr src.in6 = oip6->ip6_src; 454660854Sdarrenr hv += src.in4.s_addr; 4547145522Sdarrenr dst.in6 = oip6->ip6_dst; 454860854Sdarrenr hv += dst.in4.s_addr; 454960854Sdarrenr hv += oic->icmp6_id; 455060854Sdarrenr hv += oic->icmp6_seq; 4551145522Sdarrenr hv = DOUBLE_HASH(hv); 455260854Sdarrenr 4553255332Scy READ_ENTER(&softc->ipf_state); 4554255332Scy for (isp = &softs->ipf_state_table[hv]; 4555255332Scy ((is = *isp) != NULL); ) { 4556145522Sdarrenr ic = &is->is_icmp; 4557145522Sdarrenr isp = &is->is_hnext; 455860854Sdarrenr if ((is->is_p == pr) && 4559145522Sdarrenr !(is->is_pass & FR_NOICMPERR) && 4560145522Sdarrenr (oic->icmp6_id == ic->ici_id) && 4561145522Sdarrenr (oic->icmp6_seq == ic->ici_seq) && 4562255332Scy (is = ipf_matchsrcdst(&ofin, is, &src, 4563145522Sdarrenr &dst, NULL, FI_ICMPCMP))) { 456460854Sdarrenr /* 456560854Sdarrenr * in the state table ICMP query's are stored 456660854Sdarrenr * with the type of the corresponding ICMP 456760854Sdarrenr * response. Correct here 456860854Sdarrenr */ 4569145522Sdarrenr if (((ic->ici_type == ICMP6_ECHO_REPLY) && 457060854Sdarrenr (oic->icmp6_type == ICMP6_ECHO_REQUEST)) || 4571145522Sdarrenr (ic->ici_type - 1 == oic->icmp6_type )) { 4572255332Scy if (!ipf_allowstateicmp(fin, is, &src)) 4573255332Scy return is; 457460854Sdarrenr } 457560854Sdarrenr } 4576145522Sdarrenr } 4577255332Scy RWLOCK_EXIT(&softc->ipf_state); 4578255332Scy SBUMPD(ipf_state_stats, iss_icmp6_miss); 457960854Sdarrenr return NULL; 458095563Sdarrenr } 458160854Sdarrenr 4582145522Sdarrenr hv = (pr = oip6->ip6_nxt); 4583145522Sdarrenr src.in6 = oip6->ip6_src; 4584145522Sdarrenr hv += src.i6[0]; 458595418Sdarrenr hv += src.i6[1]; 458695418Sdarrenr hv += src.i6[2]; 458795418Sdarrenr hv += src.i6[3]; 4588145522Sdarrenr dst.in6 = oip6->ip6_dst; 4589145522Sdarrenr hv += dst.i6[0]; 459095418Sdarrenr hv += dst.i6[1]; 459195418Sdarrenr hv += dst.i6[2]; 459295418Sdarrenr hv += dst.i6[3]; 4593130886Sdarrenr 4594255332Scy tcp = NULL; 4595255332Scy 4596255332Scy switch (oip6->ip6_nxt) 4597255332Scy { 4598255332Scy case IPPROTO_TCP : 4599255332Scy case IPPROTO_UDP : 4600145522Sdarrenr tcp = (tcphdr_t *)(oip6 + 1); 4601145522Sdarrenr dport = tcp->th_dport; 4602145522Sdarrenr sport = tcp->th_sport; 4603145522Sdarrenr hv += dport; 4604145522Sdarrenr hv += sport; 4605255332Scy break; 4606255332Scy 4607255332Scy case IPPROTO_ICMPV6 : 4608255332Scy oic = (struct icmp6_hdr *)(oip6 + 1); 4609255332Scy hv += oic->icmp6_id; 4610255332Scy hv += oic->icmp6_seq; 4611255332Scy break; 4612255332Scy 4613255332Scy default : 4614255332Scy break; 4615255332Scy } 4616255332Scy 4617145522Sdarrenr hv = DOUBLE_HASH(hv); 4618145522Sdarrenr 4619255332Scy READ_ENTER(&softc->ipf_state); 4620255332Scy for (isp = &softs->ipf_state_table[hv]; ((is = *isp) != NULL); ) { 4621145522Sdarrenr isp = &is->is_hnext; 462260854Sdarrenr /* 462360854Sdarrenr * Only allow this icmp though if the 462460854Sdarrenr * encapsulated packet was allowed through the 462560854Sdarrenr * other way around. Note that the minimal amount 462660854Sdarrenr * of info present does not allow for checking against 462760854Sdarrenr * tcp internals such as seq and ack numbers. 462860854Sdarrenr */ 4629145522Sdarrenr if ((is->is_p != pr) || (is->is_v != 6) || 4630145522Sdarrenr (is->is_pass & FR_NOICMPERR)) 4631145522Sdarrenr continue; 4632255332Scy is = ipf_matchsrcdst(&ofin, is, &src, &dst, tcp, FI_ICMPCMP); 4633255332Scy if ((is != NULL) && (ipf_allowstateicmp(fin, is, &src) == 0)) 4634145522Sdarrenr return is; 463560854Sdarrenr } 4636255332Scy RWLOCK_EXIT(&softc->ipf_state); 4637255332Scy SBUMPD(ipf_state_stats, iss_icmp_miss); 463860854Sdarrenr return NULL; 463957096Sguido} 464060854Sdarrenr#endif 4641145522Sdarrenr 4642145522Sdarrenr 4643145522Sdarrenr/* ------------------------------------------------------------------------ */ 4644255332Scy/* Function: ipf_sttab_init */ 4645145522Sdarrenr/* Returns: Nil */ 4646255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 4647255332Scy/* tqp(I) - pointer to an array of timeout queues for TCP */ 4648145522Sdarrenr/* */ 4649145522Sdarrenr/* Initialise the array of timeout queues for TCP. */ 4650145522Sdarrenr/* ------------------------------------------------------------------------ */ 4651255332Scyvoid 4652255332Scyipf_sttab_init(softc, tqp) 4653255332Scy ipf_main_softc_t *softc; 4654255332Scy ipftq_t *tqp; 4655145522Sdarrenr{ 4656145522Sdarrenr int i; 4657145522Sdarrenr 4658145522Sdarrenr for (i = IPF_TCP_NSTATES - 1; i >= 0; i--) { 4659255332Scy IPFTQ_INIT(&tqp[i], 0, "ipftq tcp tab"); 4660145522Sdarrenr tqp[i].ifq_next = tqp + i + 1; 4661145522Sdarrenr } 4662145522Sdarrenr tqp[IPF_TCP_NSTATES - 1].ifq_next = NULL; 4663255332Scy tqp[IPF_TCPS_CLOSED].ifq_ttl = softc->ipf_tcpclosed; 4664255332Scy tqp[IPF_TCPS_LISTEN].ifq_ttl = softc->ipf_tcptimeout; 4665255332Scy tqp[IPF_TCPS_SYN_SENT].ifq_ttl = softc->ipf_tcpsynsent; 4666255332Scy tqp[IPF_TCPS_SYN_RECEIVED].ifq_ttl = softc->ipf_tcpsynrecv; 4667255332Scy tqp[IPF_TCPS_ESTABLISHED].ifq_ttl = softc->ipf_tcpidletimeout; 4668255332Scy tqp[IPF_TCPS_CLOSE_WAIT].ifq_ttl = softc->ipf_tcphalfclosed; 4669255332Scy tqp[IPF_TCPS_FIN_WAIT_1].ifq_ttl = softc->ipf_tcphalfclosed; 4670255332Scy tqp[IPF_TCPS_CLOSING].ifq_ttl = softc->ipf_tcptimeout; 4671255332Scy tqp[IPF_TCPS_LAST_ACK].ifq_ttl = softc->ipf_tcplastack; 4672255332Scy tqp[IPF_TCPS_FIN_WAIT_2].ifq_ttl = softc->ipf_tcpclosewait; 4673255332Scy tqp[IPF_TCPS_TIME_WAIT].ifq_ttl = softc->ipf_tcptimewait; 4674255332Scy tqp[IPF_TCPS_HALF_ESTAB].ifq_ttl = softc->ipf_tcptimeout; 4675145522Sdarrenr} 4676145522Sdarrenr 4677145522Sdarrenr 4678145522Sdarrenr/* ------------------------------------------------------------------------ */ 4679255332Scy/* Function: ipf_sttab_destroy */ 4680145522Sdarrenr/* Returns: Nil */ 4681145522Sdarrenr/* Parameters: tqp(I) - pointer to an array of timeout queues for TCP */ 4682145522Sdarrenr/* */ 4683145522Sdarrenr/* Do whatever is necessary to "destroy" each of the entries in the array */ 4684145522Sdarrenr/* of timeout queues for TCP. */ 4685145522Sdarrenr/* ------------------------------------------------------------------------ */ 4686255332Scyvoid 4687255332Scyipf_sttab_destroy(tqp) 4688255332Scy ipftq_t *tqp; 4689145522Sdarrenr{ 4690145522Sdarrenr int i; 4691145522Sdarrenr 4692145522Sdarrenr for (i = IPF_TCP_NSTATES - 1; i >= 0; i--) 4693145522Sdarrenr MUTEX_DESTROY(&tqp[i].ifq_lock); 4694145522Sdarrenr} 4695145522Sdarrenr 4696145522Sdarrenr 4697145522Sdarrenr/* ------------------------------------------------------------------------ */ 4698255332Scy/* Function: ipf_state_deref */ 4699145522Sdarrenr/* Returns: Nil */ 4700255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 4701255332Scy/* isp(I) - pointer to pointer to state table entry */ 4702145522Sdarrenr/* */ 4703145522Sdarrenr/* Decrement the reference counter for this state table entry and free it */ 4704145522Sdarrenr/* if there are no more things using it. */ 4705145522Sdarrenr/* */ 4706172776Sdarrenr/* This function is only called when cleaning up after increasing is_ref by */ 4707172776Sdarrenr/* one earlier in the 'code path' so if is_ref is 1 when entering, we do */ 4708172776Sdarrenr/* have an orphan, otherwise not. However there is a possible race between */ 4709172776Sdarrenr/* the entry being deleted via flushing with an ioctl call (that calls the */ 4710172776Sdarrenr/* delete function directly) and the tail end of packet processing so we */ 4711172776Sdarrenr/* need to grab is_lock before doing the check to synchronise the two code */ 4712172776Sdarrenr/* paths. */ 4713172776Sdarrenr/* */ 4714145522Sdarrenr/* When operating in userland (ipftest), we have no timers to clear a state */ 4715145522Sdarrenr/* entry. Therefore, we make a few simple tests before deleting an entry */ 4716145522Sdarrenr/* outright. We compare states on each side looking for a combination of */ 4717145522Sdarrenr/* TIME_WAIT (should really be FIN_WAIT_2?) and LAST_ACK. Then we factor */ 4718145522Sdarrenr/* in packet direction with the interface list to make sure we don't */ 4719145522Sdarrenr/* prematurely delete an entry on a final inbound packet that's we're also */ 4720145522Sdarrenr/* supposed to route elsewhere. */ 4721145522Sdarrenr/* */ 4722145522Sdarrenr/* Internal parameters: */ 4723145522Sdarrenr/* state[0] = state of source (host that initiated connection) */ 4724145522Sdarrenr/* state[1] = state of dest (host that accepted the connection) */ 4725145522Sdarrenr/* */ 4726145522Sdarrenr/* dir == 0 : a packet from source to dest */ 4727145522Sdarrenr/* dir == 1 : a packet from dest to source */ 4728145522Sdarrenr/* ------------------------------------------------------------------------ */ 4729255332Scyvoid 4730255332Scyipf_state_deref(softc, isp) 4731255332Scy ipf_main_softc_t *softc; 4732255332Scy ipstate_t **isp; 4733145522Sdarrenr{ 4734255332Scy ipstate_t *is = *isp; 4735145522Sdarrenr 4736145522Sdarrenr is = *isp; 4737145522Sdarrenr *isp = NULL; 4738172776Sdarrenr 4739172776Sdarrenr MUTEX_ENTER(&is->is_lock); 4740172776Sdarrenr if (is->is_ref > 1) { 4741172776Sdarrenr is->is_ref--; 4742172776Sdarrenr MUTEX_EXIT(&is->is_lock); 4743145522Sdarrenr#ifndef _KERNEL 4744172776Sdarrenr if ((is->is_sti.tqe_state[0] > IPF_TCPS_ESTABLISHED) || 4745255332Scy (is->is_sti.tqe_state[1] > IPF_TCPS_ESTABLISHED)) { 4746255332Scy ipf_state_del(softc, is, ISL_EXPIRE); 4747172776Sdarrenr } 4748145522Sdarrenr#endif 4749172776Sdarrenr return; 4750145522Sdarrenr } 4751172776Sdarrenr MUTEX_EXIT(&is->is_lock); 4752172776Sdarrenr 4753255332Scy WRITE_ENTER(&softc->ipf_state); 4754255332Scy ipf_state_del(softc, is, ISL_ORPHAN); 4755255332Scy RWLOCK_EXIT(&softc->ipf_state); 4756145522Sdarrenr} 4757145522Sdarrenr 4758145522Sdarrenr 4759145522Sdarrenr/* ------------------------------------------------------------------------ */ 4760255332Scy/* Function: ipf_state_setqueue */ 4761145522Sdarrenr/* Returns: Nil */ 4762255332Scy/* Parameters: softc(I) - pointer to soft context main structure */ 4763255332Scy/* is(I) - pointer to state structure */ 4764255332Scy/* rev(I) - forward(0) or reverse(1) direction */ 4765145522Sdarrenr/* Locks: ipf_state (read or write) */ 4766145522Sdarrenr/* */ 4767145522Sdarrenr/* Put the state entry on its default queue entry, using rev as a helped in */ 4768145522Sdarrenr/* determining which queue it should be placed on. */ 4769145522Sdarrenr/* ------------------------------------------------------------------------ */ 4770255332Scyvoid 4771255332Scyipf_state_setqueue(softc, is, rev) 4772255332Scy ipf_main_softc_t *softc; 4773255332Scy ipstate_t *is; 4774255332Scy int rev; 4775145522Sdarrenr{ 4776255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 4777145522Sdarrenr ipftq_t *oifq, *nifq; 4778145522Sdarrenr 4779145522Sdarrenr if ((is->is_sti.tqe_flags & TQE_RULEBASED) != 0) 4780145522Sdarrenr nifq = is->is_tqehead[rev]; 4781145522Sdarrenr else 4782145522Sdarrenr nifq = NULL; 4783145522Sdarrenr 4784145522Sdarrenr if (nifq == NULL) { 4785145522Sdarrenr switch (is->is_p) 4786145522Sdarrenr { 4787145522Sdarrenr#ifdef USE_INET6 4788145522Sdarrenr case IPPROTO_ICMPV6 : 4789145522Sdarrenr if (rev == 1) 4790255332Scy nifq = &softs->ipf_state_icmpacktq; 4791145522Sdarrenr else 4792255332Scy nifq = &softs->ipf_state_icmptq; 4793145522Sdarrenr break; 4794145522Sdarrenr#endif 4795145522Sdarrenr case IPPROTO_ICMP : 4796145522Sdarrenr if (rev == 1) 4797255332Scy nifq = &softs->ipf_state_icmpacktq; 4798145522Sdarrenr else 4799255332Scy nifq = &softs->ipf_state_icmptq; 4800145522Sdarrenr break; 4801145522Sdarrenr case IPPROTO_TCP : 4802255332Scy nifq = softs->ipf_state_tcptq + is->is_state[rev]; 4803145522Sdarrenr break; 4804145522Sdarrenr 4805145522Sdarrenr case IPPROTO_UDP : 4806145522Sdarrenr if (rev == 1) 4807255332Scy nifq = &softs->ipf_state_udpacktq; 4808145522Sdarrenr else 4809255332Scy nifq = &softs->ipf_state_udptq; 4810145522Sdarrenr break; 4811145522Sdarrenr 4812145522Sdarrenr default : 4813255332Scy nifq = &softs->ipf_state_iptq; 4814145522Sdarrenr break; 4815145522Sdarrenr } 4816145522Sdarrenr } 4817145522Sdarrenr 4818145522Sdarrenr oifq = is->is_sti.tqe_ifq; 4819145522Sdarrenr /* 4820145522Sdarrenr * If it's currently on a timeout queue, move it from one queue to 4821145522Sdarrenr * another, else put it on the end of the newly determined queue. 4822145522Sdarrenr */ 4823145522Sdarrenr if (oifq != NULL) 4824255332Scy ipf_movequeue(softc->ipf_ticks, &is->is_sti, oifq, nifq); 4825145522Sdarrenr else 4826255332Scy ipf_queueappend(softc->ipf_ticks, &is->is_sti, nifq, is); 4827145522Sdarrenr return; 4828145522Sdarrenr} 4829170268Sdarrenr 4830170268Sdarrenr 4831170268Sdarrenr/* ------------------------------------------------------------------------ */ 4832255332Scy/* Function: ipf_state_iter */ 4833170268Sdarrenr/* Returns: int - 0 == success, else error */ 4834255332Scy/* Parameters: softc(I) - pointer to main soft context */ 4835255332Scy/* token(I) - pointer to ipftoken structure */ 4836170268Sdarrenr/* itp(I) - pointer to ipfgeniter structure */ 4837255332Scy/* obj(I) - pointer to data description structure */ 4838170268Sdarrenr/* */ 4839170268Sdarrenr/* This function handles the SIOCGENITER ioctl for the state tables and */ 4840255332Scy/* walks through the list of entries in the state table list (softs->ipf_state_list.) */ 4841170268Sdarrenr/* ------------------------------------------------------------------------ */ 4842255332Scystatic int 4843255332Scyipf_state_iter(softc, token, itp, obj) 4844255332Scy ipf_main_softc_t *softc; 4845255332Scy ipftoken_t *token; 4846255332Scy ipfgeniter_t *itp; 4847255332Scy ipfobj_t *obj; 4848170268Sdarrenr{ 4849255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 4850170268Sdarrenr ipstate_t *is, *next, zero; 4851255332Scy int error; 4852170268Sdarrenr 4853255332Scy if (itp->igi_data == NULL) { 4854255332Scy IPFERROR(100026); 4855170268Sdarrenr return EFAULT; 4856255332Scy } 4857170268Sdarrenr 4858255332Scy if (itp->igi_nitems < 1) { 4859255332Scy IPFERROR(100027); 4860170268Sdarrenr return ENOSPC; 4861255332Scy } 4862170268Sdarrenr 4863255332Scy if (itp->igi_type != IPFGENITER_STATE) { 4864255332Scy IPFERROR(100028); 4865170268Sdarrenr return EINVAL; 4866255332Scy } 4867170268Sdarrenr 4868170268Sdarrenr is = token->ipt_data; 4869170268Sdarrenr if (is == (void *)-1) { 4870255332Scy IPFERROR(100029); 4871170268Sdarrenr return ESRCH; 4872170268Sdarrenr } 4873170268Sdarrenr 4874170268Sdarrenr error = 0; 4875255332Scy obj->ipfo_type = IPFOBJ_IPSTATE; 4876255332Scy obj->ipfo_size = sizeof(ipstate_t); 4877170268Sdarrenr 4878255332Scy READ_ENTER(&softc->ipf_state); 4879255332Scy 4880255332Scy is = token->ipt_data; 4881170268Sdarrenr if (is == NULL) { 4882255332Scy next = softs->ipf_state_list; 4883170268Sdarrenr } else { 4884170268Sdarrenr next = is->is_next; 4885170268Sdarrenr } 4886170268Sdarrenr 4887255332Scy /* 4888255332Scy * If we find a state entry to use, bump its reference count so that 4889255332Scy * it can be used for is_next when we come back. 4890255332Scy */ 4891255332Scy if (next != NULL) { 4892255332Scy MUTEX_ENTER(&next->is_lock); 4893255332Scy next->is_ref++; 4894255332Scy MUTEX_EXIT(&next->is_lock); 4895255332Scy token->ipt_data = next; 4896255332Scy } else { 4897255332Scy bzero(&zero, sizeof(zero)); 4898255332Scy next = &zero; 4899255332Scy token->ipt_data = NULL; 4900255332Scy } 4901255332Scy if (next->is_next == NULL) 4902255332Scy ipf_token_mark_complete(token); 4903170268Sdarrenr 4904255332Scy RWLOCK_EXIT(&softc->ipf_state); 4905170268Sdarrenr 4906255332Scy obj->ipfo_ptr = itp->igi_data; 4907255332Scy error = ipf_outobjk(softc, obj, next); 4908255332Scy if (is != NULL) 4909255332Scy ipf_state_deref(softc, &is); 4910172776Sdarrenr 4911170268Sdarrenr return error; 4912170268Sdarrenr} 4913170268Sdarrenr 4914170268Sdarrenr 4915170268Sdarrenr/* ------------------------------------------------------------------------ */ 4916255332Scy/* Function: ipf_state_gettable */ 4917170268Sdarrenr/* Returns: int - 0 = success, else error */ 4918255332Scy/* Parameters: softc(I) - pointer to main soft context */ 4919255332Scy/* softs(I) - pointer to state context structure */ 4920255332Scy/* data(I) - pointer to ioctl data */ 4921170268Sdarrenr/* */ 4922170268Sdarrenr/* This function handles ioctl requests for tables of state information. */ 4923170268Sdarrenr/* At present the only table it deals with is the hash bucket statistics. */ 4924170268Sdarrenr/* ------------------------------------------------------------------------ */ 4925255332Scystatic int 4926255332Scyipf_state_gettable(softc, softs, data) 4927255332Scy ipf_main_softc_t *softc; 4928255332Scy ipf_state_softc_t *softs; 4929255332Scy char *data; 4930170268Sdarrenr{ 4931170268Sdarrenr ipftable_t table; 4932170268Sdarrenr int error; 4933170268Sdarrenr 4934255332Scy error = ipf_inobj(softc, data, NULL, &table, IPFOBJ_GTABLE); 4935170268Sdarrenr if (error != 0) 4936170268Sdarrenr return error; 4937170268Sdarrenr 4938255332Scy if (table.ita_type != IPFTABLE_BUCKETS) { 4939255332Scy IPFERROR(100031); 4940170268Sdarrenr return EINVAL; 4941255332Scy } 4942170268Sdarrenr 4943255332Scy error = COPYOUT(softs->ipf_state_stats.iss_bucketlen, table.ita_table, 4944255332Scy softs->ipf_state_size * sizeof(u_int)); 4945255332Scy if (error != 0) { 4946255332Scy IPFERROR(100032); 4947170268Sdarrenr error = EFAULT; 4948255332Scy } 4949170268Sdarrenr return error; 4950170268Sdarrenr} 4951255332Scy 4952255332Scy 4953255332Scy/* ------------------------------------------------------------------------ */ 4954255332Scy/* Function: ipf_state_setpending */ 4955255332Scy/* Returns: Nil */ 4956255332Scy/* Parameters: softc(I) - pointer to main soft context */ 4957255332Scy/* is(I) - pointer to state structure */ 4958255332Scy/* Locks: ipf_state (read or write) */ 4959255332Scy/* */ 4960255332Scy/* Put the state entry on to the pending queue - this queue has a very */ 4961255332Scy/* short lifetime where items are put that can't be deleted straight away */ 4962255332Scy/* because of locking issues but we want to delete them ASAP, anyway. */ 4963255332Scy/* ------------------------------------------------------------------------ */ 4964255332Scyvoid 4965255332Scyipf_state_setpending(softc, is) 4966255332Scy ipf_main_softc_t *softc; 4967255332Scy ipstate_t *is; 4968255332Scy{ 4969255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 4970255332Scy ipftq_t *oifq; 4971255332Scy 4972255332Scy oifq = is->is_sti.tqe_ifq; 4973255332Scy if (oifq != NULL) 4974255332Scy ipf_movequeue(softc->ipf_ticks, &is->is_sti, oifq, 4975255332Scy &softs->ipf_state_pending); 4976255332Scy else 4977255332Scy ipf_queueappend(softc->ipf_ticks, &is->is_sti, 4978255332Scy &softs->ipf_state_pending, is); 4979255332Scy 4980255332Scy MUTEX_ENTER(&is->is_lock); 4981255332Scy if (is->is_me != NULL) { 4982255332Scy *is->is_me = NULL; 4983255332Scy is->is_me = NULL; 4984255332Scy is->is_ref--; 4985255332Scy } 4986255332Scy MUTEX_EXIT(&is->is_lock); 4987255332Scy} 4988255332Scy 4989255332Scy 4990255332Scy/* ------------------------------------------------------------------------ */ 4991255332Scy/* Function: ipf_state_matchflush */ 4992255332Scy/* Returns: Nil */ 4993255332Scy/* Parameters: softc(I) - pointer to main soft context */ 4994255332Scy/* data(I) - pointer to state structure */ 4995255332Scy/* Locks: ipf_state (read or write) */ 4996255332Scy/* */ 4997255332Scy/* Flush all entries from the list of state entries that match the */ 4998255332Scy/* properties in the array loaded. */ 4999255332Scy/* ------------------------------------------------------------------------ */ 5000255332Scyint 5001255332Scyipf_state_matchflush(softc, data) 5002255332Scy ipf_main_softc_t *softc; 5003255332Scy caddr_t data; 5004255332Scy{ 5005255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 5006255332Scy int *array, flushed, error; 5007255332Scy ipstate_t *state, *statenext; 5008255332Scy ipfobj_t obj; 5009255332Scy 5010255332Scy error = ipf_matcharray_load(softc, data, &obj, &array); 5011255332Scy if (error != 0) 5012255332Scy return error; 5013255332Scy 5014255332Scy flushed = 0; 5015255332Scy 5016255332Scy for (state = softs->ipf_state_list; state != NULL; state = statenext) { 5017255332Scy statenext = state->is_next; 5018255332Scy if (ipf_state_matcharray(state, array, softc->ipf_ticks) == 0) { 5019255332Scy ipf_state_del(softc, state, ISL_FLUSH); 5020255332Scy flushed++; 5021255332Scy } 5022255332Scy } 5023255332Scy 5024255332Scy obj.ipfo_retval = flushed; 5025255332Scy error = BCOPYOUT(&obj, data, sizeof(obj)); 5026255332Scy 5027255332Scy KFREES(array, array[0] * sizeof(*array)); 5028255332Scy 5029255332Scy return error; 5030255332Scy} 5031255332Scy 5032255332Scy 5033255332Scy/* ------------------------------------------------------------------------ */ 5034255332Scy/* Function: ipf_state_matcharray */ 5035255332Scy/* Returns: int - 0 = no match, 1 = match */ 5036255332Scy/* Parameters: state(I) - pointer to state structure */ 5037255332Scy/* array(I) - pointer to ipf matching expression */ 5038255332Scy/* ticks(I) - current value of ipfilter tick timer */ 5039255332Scy/* Locks: ipf_state (read or write) */ 5040255332Scy/* */ 5041255332Scy/* Compare a state entry with the match array passed in and return a value */ 5042255332Scy/* to indicate whether or not the matching was successful. */ 5043255332Scy/* ------------------------------------------------------------------------ */ 5044255332Scystatic int 5045255332Scyipf_state_matcharray(state, array, ticks) 5046255332Scy ipstate_t *state; 5047255332Scy int *array; 5048255332Scy u_long ticks; 5049255332Scy{ 5050255332Scy int i, n, *x, rv, p; 5051255332Scy ipfexp_t *e; 5052255332Scy 5053255332Scy rv = 0; 5054255332Scy n = array[0]; 5055255332Scy x = array + 1; 5056255332Scy 5057255332Scy for (; n > 0; x += 3 + x[3], rv = 0) { 5058255332Scy e = (ipfexp_t *)x; 5059255332Scy n -= e->ipfe_size; 5060255332Scy if (x[0] == IPF_EXP_END) 5061255332Scy break; 5062255332Scy 5063255332Scy /* 5064255332Scy * If we need to match the protocol and that doesn't match, 5065255332Scy * don't even both with the instruction array. 5066255332Scy */ 5067255332Scy p = e->ipfe_cmd >> 16; 5068255332Scy if ((p != 0) && (p != state->is_p)) 5069255332Scy break; 5070255332Scy 5071255332Scy switch (e->ipfe_cmd) 5072255332Scy { 5073255332Scy case IPF_EXP_IP_PR : 5074255332Scy for (i = 0; !rv && i < e->ipfe_narg; i++) { 5075255332Scy rv |= (state->is_p == e->ipfe_arg0[i]); 5076255332Scy } 5077255332Scy break; 5078255332Scy 5079255332Scy case IPF_EXP_IP_SRCADDR : 5080255332Scy if (state->is_v != 4) 5081255332Scy break; 5082255332Scy for (i = 0; !rv && i < e->ipfe_narg; i++) { 5083255332Scy rv |= ((state->is_saddr & 5084255332Scy e->ipfe_arg0[i * 2 + 1]) == 5085255332Scy e->ipfe_arg0[i * 2]); 5086255332Scy } 5087255332Scy break; 5088255332Scy 5089255332Scy case IPF_EXP_IP_DSTADDR : 5090255332Scy if (state->is_v != 4) 5091255332Scy break; 5092255332Scy for (i = 0; !rv && i < e->ipfe_narg; i++) { 5093255332Scy rv |= ((state->is_daddr & 5094255332Scy e->ipfe_arg0[i * 2 + 1]) == 5095255332Scy e->ipfe_arg0[i * 2]); 5096255332Scy } 5097255332Scy break; 5098255332Scy 5099255332Scy case IPF_EXP_IP_ADDR : 5100255332Scy if (state->is_v != 4) 5101255332Scy break; 5102255332Scy for (i = 0; !rv && i < e->ipfe_narg; i++) { 5103255332Scy rv |= ((state->is_saddr & 5104255332Scy e->ipfe_arg0[i * 2 + 1]) == 5105255332Scy e->ipfe_arg0[i * 2]) || 5106255332Scy ((state->is_daddr & 5107255332Scy e->ipfe_arg0[i * 2 + 1]) == 5108255332Scy e->ipfe_arg0[i * 2]); 5109255332Scy } 5110255332Scy break; 5111255332Scy 5112255332Scy#ifdef USE_INET6 5113255332Scy case IPF_EXP_IP6_SRCADDR : 5114255332Scy if (state->is_v != 6) 5115255332Scy break; 5116255332Scy for (i = 0; !rv && i < x[3]; i++) { 5117255332Scy rv |= IP6_MASKEQ(&state->is_src.in6, 5118255332Scy &e->ipfe_arg0[i * 8 + 4], 5119255332Scy &e->ipfe_arg0[i * 8]); 5120255332Scy } 5121255332Scy break; 5122255332Scy 5123255332Scy case IPF_EXP_IP6_DSTADDR : 5124255332Scy if (state->is_v != 6) 5125255332Scy break; 5126255332Scy for (i = 0; !rv && i < x[3]; i++) { 5127255332Scy rv |= IP6_MASKEQ(&state->is_dst.in6, 5128255332Scy &e->ipfe_arg0[i * 8 + 4], 5129255332Scy &e->ipfe_arg0[i * 8]); 5130255332Scy } 5131255332Scy break; 5132255332Scy 5133255332Scy case IPF_EXP_IP6_ADDR : 5134255332Scy if (state->is_v != 6) 5135255332Scy break; 5136255332Scy for (i = 0; !rv && i < x[3]; i++) { 5137255332Scy rv |= IP6_MASKEQ(&state->is_src.in6, 5138255332Scy &e->ipfe_arg0[i * 8 + 4], 5139255332Scy &e->ipfe_arg0[i * 8]) || 5140255332Scy IP6_MASKEQ(&state->is_dst.in6, 5141255332Scy &e->ipfe_arg0[i * 8 + 4], 5142255332Scy &e->ipfe_arg0[i * 8]); 5143255332Scy } 5144255332Scy break; 5145255332Scy#endif 5146255332Scy 5147255332Scy case IPF_EXP_UDP_PORT : 5148255332Scy case IPF_EXP_TCP_PORT : 5149255332Scy for (i = 0; !rv && i < e->ipfe_narg; i++) { 5150255332Scy rv |= (state->is_sport == e->ipfe_arg0[i]) || 5151255332Scy (state->is_dport == e->ipfe_arg0[i]); 5152255332Scy } 5153255332Scy break; 5154255332Scy 5155255332Scy case IPF_EXP_UDP_SPORT : 5156255332Scy case IPF_EXP_TCP_SPORT : 5157255332Scy for (i = 0; !rv && i < e->ipfe_narg; i++) { 5158255332Scy rv |= (state->is_sport == e->ipfe_arg0[i]); 5159255332Scy } 5160255332Scy break; 5161255332Scy 5162255332Scy case IPF_EXP_UDP_DPORT : 5163255332Scy case IPF_EXP_TCP_DPORT : 5164255332Scy for (i = 0; !rv && i < e->ipfe_narg; i++) { 5165255332Scy rv |= (state->is_dport == e->ipfe_arg0[i]); 5166255332Scy } 5167255332Scy break; 5168255332Scy 5169255332Scy case IPF_EXP_TCP_STATE : 5170255332Scy for (i = 0; !rv && i < e->ipfe_narg; i++) { 5171255332Scy rv |= (state->is_state[0] == e->ipfe_arg0[i]) || 5172255332Scy (state->is_state[1] == e->ipfe_arg0[i]); 5173255332Scy } 5174255332Scy break; 5175255332Scy 5176255332Scy case IPF_EXP_IDLE_GT : 5177255332Scy rv |= (ticks - state->is_touched > e->ipfe_arg0[0]); 5178255332Scy break; 5179255332Scy } 5180255332Scy 5181255332Scy /* 5182255332Scy * Factor in doing a negative match. 5183255332Scy */ 5184255332Scy rv ^= e->ipfe_not; 5185255332Scy 5186255332Scy if (rv == 0) 5187255332Scy break; 5188255332Scy } 5189255332Scy 5190255332Scy return rv; 5191255332Scy} 5192255332Scy 5193255332Scy 5194255332Scy/* ------------------------------------------------------------------------ */ 5195255332Scy/* Function: ipf_state_settimeout */ 5196255332Scy/* Returns: int 0 = success, else failure */ 5197255332Scy/* Parameters: softc(I) - pointer to main soft context */ 5198255332Scy/* t(I) - pointer to tuneable being changed */ 5199255332Scy/* p(I) - pointer to the new value */ 5200255332Scy/* */ 5201255332Scy/* Sets a timeout value for one of the many timeout queues. We find the */ 5202255332Scy/* correct queue using a somewhat manual process of comparing the timeout */ 5203255332Scy/* names for each specific value available and calling ipf_apply_timeout on */ 5204255332Scy/* that queue so that all of the items on it are updated accordingly. */ 5205255332Scy/* ------------------------------------------------------------------------ */ 5206255332Scyint 5207255332Scyipf_state_settimeout(softc, t, p) 5208255332Scy struct ipf_main_softc_s *softc; 5209255332Scy ipftuneable_t *t; 5210255332Scy ipftuneval_t *p; 5211255332Scy{ 5212255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 5213255332Scy 5214255332Scy /* 5215255332Scy * In case there is nothing to do... 5216255332Scy */ 5217255332Scy if (*t->ipft_pint == p->ipftu_int) 5218255332Scy return 0; 5219255332Scy 5220255332Scy if (!strncmp(t->ipft_name, "tcp_", 4)) 5221255332Scy return ipf_settimeout_tcp(t, p, softs->ipf_state_tcptq); 5222255332Scy 5223255332Scy if (!strcmp(t->ipft_name, "udp_timeout")) { 5224255332Scy ipf_apply_timeout(&softs->ipf_state_udptq, p->ipftu_int); 5225255332Scy } else if (!strcmp(t->ipft_name, "udp_ack_timeout")) { 5226255332Scy ipf_apply_timeout(&softs->ipf_state_udpacktq, p->ipftu_int); 5227255332Scy } else if (!strcmp(t->ipft_name, "icmp_timeout")) { 5228255332Scy ipf_apply_timeout(&softs->ipf_state_icmptq, p->ipftu_int); 5229255332Scy } else if (!strcmp(t->ipft_name, "icmp_ack_timeout")) { 5230255332Scy ipf_apply_timeout(&softs->ipf_state_icmpacktq, p->ipftu_int); 5231255332Scy } else if (!strcmp(t->ipft_name, "ip_timeout")) { 5232255332Scy ipf_apply_timeout(&softs->ipf_state_iptq, p->ipftu_int); 5233255332Scy } else { 5234255332Scy IPFERROR(100034); 5235255332Scy return ESRCH; 5236255332Scy } 5237255332Scy 5238255332Scy /* 5239255332Scy * Update the tuneable being set. 5240255332Scy */ 5241255332Scy *t->ipft_pint = p->ipftu_int; 5242255332Scy 5243255332Scy return 0; 5244255332Scy} 5245255332Scy 5246255332Scy 5247255332Scy/* ------------------------------------------------------------------------ */ 5248255332Scy/* Function: ipf_state_rehash */ 5249255332Scy/* Returns: int 0 = success, else failure */ 5250255332Scy/* Parameters: softc(I) - pointer to main soft context */ 5251255332Scy/* t(I) - pointer to tuneable being changed */ 5252255332Scy/* p(I) - pointer to the new value */ 5253255332Scy/* */ 5254255332Scy/* To change the size of the state hash table at runtime, a new table has */ 5255255332Scy/* to be allocated and then all of the existing entries put in it, bumping */ 5256255332Scy/* up the bucketlength for it as we go along. */ 5257255332Scy/* ------------------------------------------------------------------------ */ 5258255332Scyint 5259255332Scyipf_state_rehash(softc, t, p) 5260255332Scy ipf_main_softc_t *softc; 5261255332Scy ipftuneable_t *t; 5262255332Scy ipftuneval_t *p; 5263255332Scy{ 5264255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 5265255332Scy ipstate_t **newtab, *is; 5266328274Scy u_long *newseed; 5267255332Scy u_int *bucketlens; 5268255332Scy u_int maxbucket; 5269255332Scy u_int newsize; 5270255332Scy u_int hv; 5271255332Scy int i; 5272255332Scy 5273255332Scy newsize = p->ipftu_int; 5274255332Scy /* 5275255332Scy * In case there is nothing to do... 5276255332Scy */ 5277255332Scy if (newsize == softs->ipf_state_size) 5278255332Scy return 0; 5279255332Scy 5280255332Scy KMALLOCS(newtab, ipstate_t **, newsize * sizeof(ipstate_t *)); 5281255332Scy if (newtab == NULL) { 5282255332Scy IPFERROR(100035); 5283255332Scy return ENOMEM; 5284255332Scy } 5285255332Scy 5286255332Scy KMALLOCS(bucketlens, u_int *, newsize * sizeof(u_int)); 5287255332Scy if (bucketlens == NULL) { 5288255332Scy KFREES(newtab, newsize * sizeof(*softs->ipf_state_table)); 5289255332Scy IPFERROR(100036); 5290255332Scy return ENOMEM; 5291255332Scy } 5292255332Scy 5293328274Scy newseed = ipf_state_seed_alloc(newsize, softs->ipf_state_max); 5294328274Scy if (newseed == NULL) { 5295328274Scy KFREES(bucketlens, newsize * sizeof(*bucketlens)); 5296328274Scy KFREES(newtab, newsize * sizeof(*newtab)); 5297328274Scy IPFERROR(100037); 5298328274Scy return ENOMEM; 5299328274Scy } 5300328274Scy 5301255332Scy for (maxbucket = 0, i = newsize; i > 0; i >>= 1) 5302255332Scy maxbucket++; 5303255332Scy maxbucket *= 2; 5304255332Scy 5305255332Scy bzero((char *)newtab, newsize * sizeof(ipstate_t *)); 5306255332Scy bzero((char *)bucketlens, newsize * sizeof(u_int)); 5307255332Scy 5308255332Scy WRITE_ENTER(&softc->ipf_state); 5309255332Scy 5310255332Scy if (softs->ipf_state_table != NULL) { 5311255332Scy KFREES(softs->ipf_state_table, 5312255332Scy softs->ipf_state_size * sizeof(*softs->ipf_state_table)); 5313255332Scy } 5314255332Scy softs->ipf_state_table = newtab; 5315255332Scy 5316328274Scy if (softs->ipf_state_seed != NULL) { 5317328274Scy KFREES(softs->ipf_state_seed, 5318328274Scy softs->ipf_state_size * sizeof(*softs->ipf_state_seed)); 5319328274Scy } 5320328274Scy softs->ipf_state_seed = newseed; 5321328274Scy 5322255332Scy if (softs->ipf_state_stats.iss_bucketlen != NULL) { 5323255332Scy KFREES(softs->ipf_state_stats.iss_bucketlen, 5324255332Scy softs->ipf_state_size * sizeof(u_int)); 5325255332Scy } 5326255332Scy softs->ipf_state_stats.iss_bucketlen = bucketlens; 5327255332Scy softs->ipf_state_maxbucket = maxbucket; 5328255332Scy softs->ipf_state_size = newsize; 5329255332Scy 5330255332Scy /* 5331255332Scy * Walk through the entire list of state table entries and put them 5332255332Scy * in the new state table, somewhere. Because we have a new table, 5333255332Scy * we need to restart the counter of how many chains are in use. 5334255332Scy */ 5335255332Scy softs->ipf_state_stats.iss_inuse = 0; 5336255332Scy for (is = softs->ipf_state_list; is != NULL; is = is->is_next) { 5337255332Scy is->is_hnext = NULL; 5338255332Scy is->is_phnext = NULL; 5339255332Scy hv = is->is_hv % softs->ipf_state_size; 5340255332Scy 5341255332Scy if (softs->ipf_state_table[hv] != NULL) 5342255332Scy softs->ipf_state_table[hv]->is_phnext = &is->is_hnext; 5343255332Scy else 5344255332Scy softs->ipf_state_stats.iss_inuse++; 5345255332Scy is->is_phnext = softs->ipf_state_table + hv; 5346255332Scy is->is_hnext = softs->ipf_state_table[hv]; 5347255332Scy softs->ipf_state_table[hv] = is; 5348255332Scy softs->ipf_state_stats.iss_bucketlen[hv]++; 5349255332Scy } 5350255332Scy RWLOCK_EXIT(&softc->ipf_state); 5351255332Scy 5352255332Scy return 0; 5353255332Scy} 5354255332Scy 5355255332Scy 5356255332Scy/* ------------------------------------------------------------------------ */ 5357255332Scy/* Function: ipf_state_add_tq */ 5358255332Scy/* Returns: ipftq_t * - NULL = failure, else pointer to new timeout */ 5359255332Scy/* queue */ 5360255332Scy/* Parameters: softc(I) - pointer to main soft context */ 5361255332Scy/* ttl(I) - pointer to the ttl for the new queue */ 5362255332Scy/* */ 5363255332Scy/* Request a pointer to a timeout queue that has a ttl as given by the */ 5364255332Scy/* value being passed in. The timeout queue is added tot the list of those */ 5365255332Scy/* used internally for stateful filtering. */ 5366255332Scy/* ------------------------------------------------------------------------ */ 5367255332Scyipftq_t * 5368255332Scyipf_state_add_tq(softc, ttl) 5369255332Scy ipf_main_softc_t *softc; 5370255332Scy int ttl; 5371255332Scy{ 5372255332Scy ipf_state_softc_t *softs = softc->ipf_state_soft; 5373255332Scy 5374255332Scy return ipf_addtimeoutqueue(softc, &softs->ipf_state_usertq, ttl); 5375255332Scy} 5376255332Scy 5377255332Scy 5378255332Scy#ifndef _KERNEL 5379255332Scy/* 5380255332Scy * Display the built up state table rules and mapping entries. 5381255332Scy */ 5382255332Scyvoid 5383255332Scyipf_state_dump(softc, arg) 5384255332Scy ipf_main_softc_t *softc; 5385255332Scy void *arg; 5386255332Scy{ 5387255332Scy ipf_state_softc_t *softs = arg; 5388255332Scy ipstate_t *ips; 5389255332Scy 5390255332Scy printf("List of active state sessions:\n"); 5391255332Scy for (ips = softs->ipf_state_list; ips != NULL; ) 5392255332Scy ips = printstate(ips, opts & (OPT_DEBUG|OPT_VERBOSE), 5393255332Scy softc->ipf_ticks); 5394255332Scy} 5395255332Scy#endif 5396