pf.c revision 138387
1/* $FreeBSD: head/sys/contrib/pf/net/pf.c 138387 2004-12-05 12:15:43Z dhartmei $ */ 2/* $OpenBSD: pf.c,v 1.433.2.2 2004/07/17 03:22:34 brad Exp $ */ 3/* add $OpenBSD: pf.c,v 1.448 2004/05/11 07:34:11 dhartmei Exp $ */ 4 5/* 6 * Copyright (c) 2001 Daniel Hartmeier 7 * Copyright (c) 2002,2003 Henning Brauer 8 * All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 14 * - Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * - Redistributions in binary form must reproduce the above 17 * copyright notice, this list of conditions and the following 18 * disclaimer in the documentation and/or other materials provided 19 * with the distribution. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 22 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 23 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 24 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 25 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 26 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 27 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 28 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 29 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 31 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 32 * POSSIBILITY OF SUCH DAMAGE. 33 * 34 * Effort sponsored in part by the Defense Advanced Research Projects 35 * Agency (DARPA) and Air Force Research Laboratory, Air Force 36 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 37 * 38 */ 39 40#ifdef __FreeBSD__ 41#include "opt_inet.h" 42#include "opt_inet6.h" 43#endif 44 45#ifdef __FreeBSD__ 46#include "opt_bpf.h" 47#include "opt_pf.h" 48#define NBPFILTER DEV_BPF 49#define NPFLOG DEV_PFLOG 50#define NPFSYNC DEV_PFSYNC 51#else 52#include "bpfilter.h" 53#include "pflog.h" 54#include "pfsync.h" 55#endif 56 57#include <sys/param.h> 58#include <sys/systm.h> 59#include <sys/mbuf.h> 60#include <sys/filio.h> 61#include <sys/socket.h> 62#include <sys/socketvar.h> 63#include <sys/kernel.h> 64#include <sys/time.h> 65#ifdef __FreeBSD__ 66#include <sys/sysctl.h> 67#include <sys/endian.h> 68#else 69#include <sys/pool.h> 70#endif 71 72#include <net/if.h> 73#include <net/if_types.h> 74#include <net/bpf.h> 75#include <net/route.h> 76 77#include <netinet/in.h> 78#include <netinet/in_var.h> 79#include <netinet/in_systm.h> 80#include <netinet/ip.h> 81#include <netinet/ip_var.h> 82#include <netinet/tcp.h> 83#include <netinet/tcp_seq.h> 84#include <netinet/udp.h> 85#include <netinet/ip_icmp.h> 86#include <netinet/in_pcb.h> 87#include <netinet/tcp_timer.h> 88#include <netinet/tcp_var.h> 89#include <netinet/udp_var.h> 90#include <netinet/icmp_var.h> 91 92#ifndef __FreeBSD__ 93#include <dev/rndvar.h> 94#endif 95#include <net/pfvar.h> 96#include <net/if_pflog.h> 97 98#if NPFSYNC > 0 99#include <net/if_pfsync.h> 100#endif /* NPFSYNC > 0 */ 101 102#ifdef INET6 103#include <netinet/ip6.h> 104#include <netinet/in_pcb.h> 105#include <netinet/icmp6.h> 106#include <netinet6/nd6.h> 107#ifdef __FreeBSD__ 108#include <netinet6/ip6_var.h> 109#include <netinet6/in6_pcb.h> 110#endif 111#endif /* INET6 */ 112 113#ifdef __FreeBSD__ 114#include <machine/in_cksum.h> 115#include <sys/limits.h> 116#include <sys/ucred.h> 117 118extern int ip_optcopy(struct ip *, struct ip *); 119#endif 120 121#define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x 122 123/* 124 * Global variables 125 */ 126 127struct pf_anchorqueue pf_anchors; 128struct pf_ruleset pf_main_ruleset; 129struct pf_altqqueue pf_altqs[2]; 130struct pf_palist pf_pabuf; 131struct pf_altqqueue *pf_altqs_active; 132struct pf_altqqueue *pf_altqs_inactive; 133struct pf_status pf_status; 134 135u_int32_t ticket_altqs_active; 136u_int32_t ticket_altqs_inactive; 137int altqs_inactive_open; 138u_int32_t ticket_pabuf; 139 140#ifdef __FreeBSD__ 141struct callout pf_expire_to; /* expire timeout */ 142#else 143struct timeout pf_expire_to; /* expire timeout */ 144#endif 145 146 147#ifdef __FreeBSD__ 148uma_zone_t pf_src_tree_pl, pf_rule_pl; 149uma_zone_t pf_state_pl, pf_altq_pl, pf_pooladdr_pl; 150#else 151struct pool pf_src_tree_pl, pf_rule_pl; 152struct pool pf_state_pl, pf_altq_pl, pf_pooladdr_pl; 153#endif 154 155void pf_print_host(struct pf_addr *, u_int16_t, u_int8_t); 156void pf_print_state(struct pf_state *); 157void pf_print_flags(u_int8_t); 158 159void pf_change_ap(struct pf_addr *, u_int16_t *, 160 u_int16_t *, u_int16_t *, struct pf_addr *, 161 u_int16_t, u_int8_t, sa_family_t); 162#ifdef INET6 163void pf_change_a6(struct pf_addr *, u_int16_t *, 164 struct pf_addr *, u_int8_t); 165#endif /* INET6 */ 166void pf_change_icmp(struct pf_addr *, u_int16_t *, 167 struct pf_addr *, struct pf_addr *, u_int16_t, 168 u_int16_t *, u_int16_t *, u_int16_t *, 169 u_int16_t *, u_int8_t, sa_family_t); 170void pf_send_tcp(const struct pf_rule *, sa_family_t, 171 const struct pf_addr *, const struct pf_addr *, 172 u_int16_t, u_int16_t, u_int32_t, u_int32_t, 173 u_int8_t, u_int16_t, u_int16_t, u_int8_t); 174void pf_send_icmp(struct mbuf *, u_int8_t, u_int8_t, 175 sa_family_t, struct pf_rule *); 176struct pf_rule *pf_match_translation(struct pf_pdesc *, struct mbuf *, 177 int, int, struct pfi_kif *, 178 struct pf_addr *, u_int16_t, struct pf_addr *, 179 u_int16_t, int); 180struct pf_rule *pf_get_translation(struct pf_pdesc *, struct mbuf *, 181 int, int, struct pfi_kif *, struct pf_src_node **, 182 struct pf_addr *, u_int16_t, 183 struct pf_addr *, u_int16_t, 184 struct pf_addr *, u_int16_t *); 185int pf_test_tcp(struct pf_rule **, struct pf_state **, 186 int, struct pfi_kif *, struct mbuf *, int, 187 void *, struct pf_pdesc *, struct pf_rule **, 188#ifdef __FreeBSD__ 189 struct pf_ruleset **, struct inpcb *); 190#else 191 struct pf_ruleset **); 192#endif 193int pf_test_udp(struct pf_rule **, struct pf_state **, 194 int, struct pfi_kif *, struct mbuf *, int, 195 void *, struct pf_pdesc *, struct pf_rule **, 196#ifdef __FreeBSD__ 197 struct pf_ruleset **, struct inpcb *); 198#else 199 struct pf_ruleset **); 200#endif 201int pf_test_icmp(struct pf_rule **, struct pf_state **, 202 int, struct pfi_kif *, struct mbuf *, int, 203 void *, struct pf_pdesc *, struct pf_rule **, 204 struct pf_ruleset **); 205int pf_test_other(struct pf_rule **, struct pf_state **, 206 int, struct pfi_kif *, struct mbuf *, int, void *, 207 struct pf_pdesc *, struct pf_rule **, 208 struct pf_ruleset **); 209int pf_test_fragment(struct pf_rule **, int, 210 struct pfi_kif *, struct mbuf *, void *, 211 struct pf_pdesc *, struct pf_rule **, 212 struct pf_ruleset **); 213int pf_test_state_tcp(struct pf_state **, int, 214 struct pfi_kif *, struct mbuf *, int, 215 void *, struct pf_pdesc *, u_short *); 216int pf_test_state_udp(struct pf_state **, int, 217 struct pfi_kif *, struct mbuf *, int, 218 void *, struct pf_pdesc *); 219int pf_test_state_icmp(struct pf_state **, int, 220 struct pfi_kif *, struct mbuf *, int, 221 void *, struct pf_pdesc *); 222int pf_test_state_other(struct pf_state **, int, 223 struct pfi_kif *, struct pf_pdesc *); 224struct pf_tag *pf_get_tag(struct mbuf *); 225int pf_match_tag(struct mbuf *, struct pf_rule *, 226 struct pf_rule *, struct pf_tag *, int *); 227void pf_hash(struct pf_addr *, struct pf_addr *, 228 struct pf_poolhashkey *, sa_family_t); 229int pf_map_addr(u_int8_t, struct pf_rule *, 230 struct pf_addr *, struct pf_addr *, 231 struct pf_addr *, struct pf_src_node **); 232int pf_get_sport(sa_family_t, u_int8_t, struct pf_rule *, 233 struct pf_addr *, struct pf_addr *, u_int16_t, 234 struct pf_addr *, u_int16_t*, u_int16_t, u_int16_t, 235 struct pf_src_node **); 236void pf_route(struct mbuf **, struct pf_rule *, int, 237 struct ifnet *, struct pf_state *); 238void pf_route6(struct mbuf **, struct pf_rule *, int, 239 struct ifnet *, struct pf_state *); 240#ifdef __FreeBSD__ 241int pf_socket_lookup(uid_t *, gid_t *, 242 int, struct pf_pdesc *, struct inpcb *); 243#else 244int pf_socket_lookup(uid_t *, gid_t *, 245 int, struct pf_pdesc *); 246#endif 247u_int8_t pf_get_wscale(struct mbuf *, int, u_int16_t, 248 sa_family_t); 249u_int16_t pf_get_mss(struct mbuf *, int, u_int16_t, 250 sa_family_t); 251u_int16_t pf_calc_mss(struct pf_addr *, sa_family_t, 252 u_int16_t); 253void pf_set_rt_ifp(struct pf_state *, 254 struct pf_addr *); 255int pf_check_proto_cksum(struct mbuf *, int, int, 256 u_int8_t, sa_family_t); 257int pf_addr_wrap_neq(struct pf_addr_wrap *, 258 struct pf_addr_wrap *); 259static int pf_add_mbuf_tag(struct mbuf *, u_int); 260struct pf_state *pf_find_state_recurse(struct pfi_kif *, 261 struct pf_state *, u_int8_t); 262 263#ifdef __FreeBSD__ 264int in4_cksum(struct mbuf *m, u_int8_t nxt, int off, int len); 265 266struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX]; 267#else 268struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX] = { 269 { &pf_state_pl, PFSTATE_HIWAT }, 270 { &pf_src_tree_pl, PFSNODE_HIWAT }, 271 { &pf_frent_pl, PFFRAG_FRENT_HIWAT } 272}; 273#endif 274 275#define STATE_LOOKUP() \ 276 do { \ 277 if (direction == PF_IN) \ 278 *state = pf_find_state_recurse( \ 279 kif, &key, PF_EXT_GWY); \ 280 else \ 281 *state = pf_find_state_recurse( \ 282 kif, &key, PF_LAN_EXT); \ 283 if (*state == NULL) \ 284 return (PF_DROP); \ 285 if (direction == PF_OUT && \ 286 (((*state)->rule.ptr->rt == PF_ROUTETO && \ 287 (*state)->rule.ptr->direction == PF_OUT) || \ 288 ((*state)->rule.ptr->rt == PF_REPLYTO && \ 289 (*state)->rule.ptr->direction == PF_IN)) && \ 290 (*state)->rt_kif != NULL && \ 291 (*state)->rt_kif != kif) \ 292 return (PF_PASS); \ 293 } while (0) 294 295#define STATE_TRANSLATE(s) \ 296 (s)->lan.addr.addr32[0] != (s)->gwy.addr.addr32[0] || \ 297 ((s)->af == AF_INET6 && \ 298 ((s)->lan.addr.addr32[1] != (s)->gwy.addr.addr32[1] || \ 299 (s)->lan.addr.addr32[2] != (s)->gwy.addr.addr32[2] || \ 300 (s)->lan.addr.addr32[3] != (s)->gwy.addr.addr32[3])) || \ 301 (s)->lan.port != (s)->gwy.port 302 303#define BOUND_IFACE(r, k) (((r)->rule_flag & PFRULE_IFBOUND) ? (k) : \ 304 ((r)->rule_flag & PFRULE_GRBOUND) ? (k)->pfik_parent : \ 305 (k)->pfik_parent->pfik_parent) 306 307#ifndef __FreeBSD__ 308static __inline int pf_src_compare(struct pf_src_node *, struct pf_src_node *); 309static __inline int pf_state_compare_lan_ext(struct pf_state *, 310 struct pf_state *); 311static __inline int pf_state_compare_ext_gwy(struct pf_state *, 312 struct pf_state *); 313static __inline int pf_state_compare_id(struct pf_state *, 314 struct pf_state *); 315#else 316static int pf_src_compare(struct pf_src_node *, struct pf_src_node *); 317static int pf_state_compare_lan_ext(struct pf_state *, 318 struct pf_state *); 319static int pf_state_compare_ext_gwy(struct pf_state *, 320 struct pf_state *); 321static int pf_state_compare_id(struct pf_state *, 322 struct pf_state *); 323#endif 324 325struct pf_src_tree tree_src_tracking; 326 327struct pf_state_tree_id tree_id; 328struct pf_state_queue state_updates; 329 330RB_GENERATE(pf_src_tree, pf_src_node, entry, pf_src_compare); 331RB_GENERATE(pf_state_tree_lan_ext, pf_state, 332 u.s.entry_lan_ext, pf_state_compare_lan_ext); 333RB_GENERATE(pf_state_tree_ext_gwy, pf_state, 334 u.s.entry_ext_gwy, pf_state_compare_ext_gwy); 335RB_GENERATE(pf_state_tree_id, pf_state, 336 u.s.entry_id, pf_state_compare_id); 337 338#ifdef __FreeBSD__ 339static int 340#else 341static __inline int 342#endif 343pf_src_compare(struct pf_src_node *a, struct pf_src_node *b) 344{ 345 int diff; 346 347 if (a->rule.ptr > b->rule.ptr) 348 return (1); 349 if (a->rule.ptr < b->rule.ptr) 350 return (-1); 351 if ((diff = a->af - b->af) != 0) 352 return (diff); 353 switch (a->af) { 354#ifdef INET 355 case AF_INET: 356 if (a->addr.addr32[0] > b->addr.addr32[0]) 357 return (1); 358 if (a->addr.addr32[0] < b->addr.addr32[0]) 359 return (-1); 360 break; 361#endif /* INET */ 362#ifdef INET6 363 case AF_INET6: 364 if (a->addr.addr32[3] > b->addr.addr32[3]) 365 return (1); 366 if (a->addr.addr32[3] < b->addr.addr32[3]) 367 return (-1); 368 if (a->addr.addr32[2] > b->addr.addr32[2]) 369 return (1); 370 if (a->addr.addr32[2] < b->addr.addr32[2]) 371 return (-1); 372 if (a->addr.addr32[1] > b->addr.addr32[1]) 373 return (1); 374 if (a->addr.addr32[1] < b->addr.addr32[1]) 375 return (-1); 376 if (a->addr.addr32[0] > b->addr.addr32[0]) 377 return (1); 378 if (a->addr.addr32[0] < b->addr.addr32[0]) 379 return (-1); 380 break; 381#endif /* INET6 */ 382 } 383 return (0); 384} 385 386#ifdef __FreeBSD__ 387static int 388#else 389static __inline int 390#endif 391pf_state_compare_lan_ext(struct pf_state *a, struct pf_state *b) 392{ 393 int diff; 394 395 if ((diff = a->proto - b->proto) != 0) 396 return (diff); 397 if ((diff = a->af - b->af) != 0) 398 return (diff); 399 switch (a->af) { 400#ifdef INET 401 case AF_INET: 402 if (a->lan.addr.addr32[0] > b->lan.addr.addr32[0]) 403 return (1); 404 if (a->lan.addr.addr32[0] < b->lan.addr.addr32[0]) 405 return (-1); 406 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0]) 407 return (1); 408 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0]) 409 return (-1); 410 break; 411#endif /* INET */ 412#ifdef INET6 413 case AF_INET6: 414 if (a->lan.addr.addr32[3] > b->lan.addr.addr32[3]) 415 return (1); 416 if (a->lan.addr.addr32[3] < b->lan.addr.addr32[3]) 417 return (-1); 418 if (a->ext.addr.addr32[3] > b->ext.addr.addr32[3]) 419 return (1); 420 if (a->ext.addr.addr32[3] < b->ext.addr.addr32[3]) 421 return (-1); 422 if (a->lan.addr.addr32[2] > b->lan.addr.addr32[2]) 423 return (1); 424 if (a->lan.addr.addr32[2] < b->lan.addr.addr32[2]) 425 return (-1); 426 if (a->ext.addr.addr32[2] > b->ext.addr.addr32[2]) 427 return (1); 428 if (a->ext.addr.addr32[2] < b->ext.addr.addr32[2]) 429 return (-1); 430 if (a->lan.addr.addr32[1] > b->lan.addr.addr32[1]) 431 return (1); 432 if (a->lan.addr.addr32[1] < b->lan.addr.addr32[1]) 433 return (-1); 434 if (a->ext.addr.addr32[1] > b->ext.addr.addr32[1]) 435 return (1); 436 if (a->ext.addr.addr32[1] < b->ext.addr.addr32[1]) 437 return (-1); 438 if (a->lan.addr.addr32[0] > b->lan.addr.addr32[0]) 439 return (1); 440 if (a->lan.addr.addr32[0] < b->lan.addr.addr32[0]) 441 return (-1); 442 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0]) 443 return (1); 444 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0]) 445 return (-1); 446 break; 447#endif /* INET6 */ 448 } 449 450 if ((diff = a->lan.port - b->lan.port) != 0) 451 return (diff); 452 if ((diff = a->ext.port - b->ext.port) != 0) 453 return (diff); 454 455 return (0); 456} 457 458#ifdef __FreeBSD__ 459static int 460#else 461static __inline int 462#endif 463pf_state_compare_ext_gwy(struct pf_state *a, struct pf_state *b) 464{ 465 int diff; 466 467 if ((diff = a->proto - b->proto) != 0) 468 return (diff); 469 if ((diff = a->af - b->af) != 0) 470 return (diff); 471 switch (a->af) { 472#ifdef INET 473 case AF_INET: 474 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0]) 475 return (1); 476 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0]) 477 return (-1); 478 if (a->gwy.addr.addr32[0] > b->gwy.addr.addr32[0]) 479 return (1); 480 if (a->gwy.addr.addr32[0] < b->gwy.addr.addr32[0]) 481 return (-1); 482 break; 483#endif /* INET */ 484#ifdef INET6 485 case AF_INET6: 486 if (a->ext.addr.addr32[3] > b->ext.addr.addr32[3]) 487 return (1); 488 if (a->ext.addr.addr32[3] < b->ext.addr.addr32[3]) 489 return (-1); 490 if (a->gwy.addr.addr32[3] > b->gwy.addr.addr32[3]) 491 return (1); 492 if (a->gwy.addr.addr32[3] < b->gwy.addr.addr32[3]) 493 return (-1); 494 if (a->ext.addr.addr32[2] > b->ext.addr.addr32[2]) 495 return (1); 496 if (a->ext.addr.addr32[2] < b->ext.addr.addr32[2]) 497 return (-1); 498 if (a->gwy.addr.addr32[2] > b->gwy.addr.addr32[2]) 499 return (1); 500 if (a->gwy.addr.addr32[2] < b->gwy.addr.addr32[2]) 501 return (-1); 502 if (a->ext.addr.addr32[1] > b->ext.addr.addr32[1]) 503 return (1); 504 if (a->ext.addr.addr32[1] < b->ext.addr.addr32[1]) 505 return (-1); 506 if (a->gwy.addr.addr32[1] > b->gwy.addr.addr32[1]) 507 return (1); 508 if (a->gwy.addr.addr32[1] < b->gwy.addr.addr32[1]) 509 return (-1); 510 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0]) 511 return (1); 512 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0]) 513 return (-1); 514 if (a->gwy.addr.addr32[0] > b->gwy.addr.addr32[0]) 515 return (1); 516 if (a->gwy.addr.addr32[0] < b->gwy.addr.addr32[0]) 517 return (-1); 518 break; 519#endif /* INET6 */ 520 } 521 522 if ((diff = a->ext.port - b->ext.port) != 0) 523 return (diff); 524 if ((diff = a->gwy.port - b->gwy.port) != 0) 525 return (diff); 526 527 return (0); 528} 529 530#ifdef __FreeBSD__ 531static int 532#else 533static __inline int 534#endif 535pf_state_compare_id(struct pf_state *a, struct pf_state *b) 536{ 537 if (a->id > b->id) 538 return (1); 539 if (a->id < b->id) 540 return (-1); 541 if (a->creatorid > b->creatorid) 542 return (1); 543 if (a->creatorid < b->creatorid) 544 return (-1); 545 546 return (0); 547} 548 549#ifdef INET6 550void 551pf_addrcpy(struct pf_addr *dst, struct pf_addr *src, sa_family_t af) 552{ 553 switch (af) { 554#ifdef INET 555 case AF_INET: 556 dst->addr32[0] = src->addr32[0]; 557 break; 558#endif /* INET */ 559 case AF_INET6: 560 dst->addr32[0] = src->addr32[0]; 561 dst->addr32[1] = src->addr32[1]; 562 dst->addr32[2] = src->addr32[2]; 563 dst->addr32[3] = src->addr32[3]; 564 break; 565 } 566} 567#endif 568 569struct pf_state * 570pf_find_state_byid(struct pf_state *key) 571{ 572 pf_status.fcounters[FCNT_STATE_SEARCH]++; 573 return (RB_FIND(pf_state_tree_id, &tree_id, key)); 574} 575 576struct pf_state * 577pf_find_state_recurse(struct pfi_kif *kif, struct pf_state *key, u_int8_t tree) 578{ 579 struct pf_state *s; 580 581 pf_status.fcounters[FCNT_STATE_SEARCH]++; 582 583 switch (tree) { 584 case PF_LAN_EXT: 585 for (; kif != NULL; kif = kif->pfik_parent) { 586 s = RB_FIND(pf_state_tree_lan_ext, 587 &kif->pfik_lan_ext, key); 588 if (s != NULL) 589 return (s); 590 } 591 return (NULL); 592 case PF_EXT_GWY: 593 for (; kif != NULL; kif = kif->pfik_parent) { 594 s = RB_FIND(pf_state_tree_ext_gwy, 595 &kif->pfik_ext_gwy, key); 596 if (s != NULL) 597 return (s); 598 } 599 return (NULL); 600 default: 601 panic("pf_find_state_recurse"); 602 } 603} 604 605struct pf_state * 606pf_find_state_all(struct pf_state *key, u_int8_t tree, int *more) 607{ 608 struct pf_state *s, *ss = NULL; 609 struct pfi_kif *kif; 610 611 pf_status.fcounters[FCNT_STATE_SEARCH]++; 612 613 switch (tree) { 614 case PF_LAN_EXT: 615 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) { 616 s = RB_FIND(pf_state_tree_lan_ext, 617 &kif->pfik_lan_ext, key); 618 if (s == NULL) 619 continue; 620 if (more == NULL) 621 return (s); 622 ss = s; 623 (*more)++; 624 } 625 return (ss); 626 case PF_EXT_GWY: 627 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) { 628 s = RB_FIND(pf_state_tree_ext_gwy, 629 &kif->pfik_ext_gwy, key); 630 if (s == NULL) 631 continue; 632 if (more == NULL) 633 return (s); 634 ss = s; 635 (*more)++; 636 } 637 return (ss); 638 default: 639 panic("pf_find_state_all"); 640 } 641} 642 643int 644pf_insert_src_node(struct pf_src_node **sn, struct pf_rule *rule, 645 struct pf_addr *src, sa_family_t af) 646{ 647 struct pf_src_node k; 648 649 if (*sn == NULL) { 650 k.af = af; 651 PF_ACPY(&k.addr, src, af); 652 if (rule->rule_flag & PFRULE_RULESRCTRACK || 653 rule->rpool.opts & PF_POOL_STICKYADDR) 654 k.rule.ptr = rule; 655 else 656 k.rule.ptr = NULL; 657 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++; 658 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k); 659 } 660 if (*sn == NULL) { 661 if (!rule->max_src_nodes || 662 rule->src_nodes < rule->max_src_nodes) 663 (*sn) = pool_get(&pf_src_tree_pl, PR_NOWAIT); 664 if ((*sn) == NULL) 665 return (-1); 666 bzero(*sn, sizeof(struct pf_src_node)); 667 (*sn)->af = af; 668 if (rule->rule_flag & PFRULE_RULESRCTRACK || 669 rule->rpool.opts & PF_POOL_STICKYADDR) 670 (*sn)->rule.ptr = rule; 671 else 672 (*sn)->rule.ptr = NULL; 673 PF_ACPY(&(*sn)->addr, src, af); 674 if (RB_INSERT(pf_src_tree, 675 &tree_src_tracking, *sn) != NULL) { 676 if (pf_status.debug >= PF_DEBUG_MISC) { 677 printf("pf: src_tree insert failed: "); 678 pf_print_host(&(*sn)->addr, 0, af); 679 printf("\n"); 680 } 681 pool_put(&pf_src_tree_pl, *sn); 682 return (-1); 683 } 684#ifdef __FreeBSD__ 685 (*sn)->creation = time_second; 686#else 687 (*sn)->creation = time.tv_sec; 688#endif 689 (*sn)->ruletype = rule->action; 690 if ((*sn)->rule.ptr != NULL) 691 (*sn)->rule.ptr->src_nodes++; 692 pf_status.scounters[SCNT_SRC_NODE_INSERT]++; 693 pf_status.src_nodes++; 694 } else { 695 if (rule->max_src_states && 696 (*sn)->states >= rule->max_src_states) 697 return (-1); 698 } 699 return (0); 700} 701 702int 703pf_insert_state(struct pfi_kif *kif, struct pf_state *state) 704{ 705 /* Thou MUST NOT insert multiple duplicate keys */ 706 state->u.s.kif = kif; 707 if (RB_INSERT(pf_state_tree_lan_ext, &kif->pfik_lan_ext, state)) { 708 if (pf_status.debug >= PF_DEBUG_MISC) { 709 printf("pf: state insert failed: tree_lan_ext"); 710 printf(" lan: "); 711 pf_print_host(&state->lan.addr, state->lan.port, 712 state->af); 713 printf(" gwy: "); 714 pf_print_host(&state->gwy.addr, state->gwy.port, 715 state->af); 716 printf(" ext: "); 717 pf_print_host(&state->ext.addr, state->ext.port, 718 state->af); 719 if (state->sync_flags & PFSTATE_FROMSYNC) 720 printf(" (from sync)"); 721 printf("\n"); 722 } 723 return (-1); 724 } 725 726 if (RB_INSERT(pf_state_tree_ext_gwy, &kif->pfik_ext_gwy, state)) { 727 if (pf_status.debug >= PF_DEBUG_MISC) { 728 printf("pf: state insert failed: tree_ext_gwy"); 729 printf(" lan: "); 730 pf_print_host(&state->lan.addr, state->lan.port, 731 state->af); 732 printf(" gwy: "); 733 pf_print_host(&state->gwy.addr, state->gwy.port, 734 state->af); 735 printf(" ext: "); 736 pf_print_host(&state->ext.addr, state->ext.port, 737 state->af); 738 if (state->sync_flags & PFSTATE_FROMSYNC) 739 printf(" (from sync)"); 740 printf("\n"); 741 } 742 RB_REMOVE(pf_state_tree_lan_ext, &kif->pfik_lan_ext, state); 743 return (-1); 744 } 745 746 if (state->id == 0 && state->creatorid == 0) { 747 state->id = htobe64(pf_status.stateid++); 748 state->creatorid = pf_status.hostid; 749 } 750 if (RB_INSERT(pf_state_tree_id, &tree_id, state) != NULL) { 751 if (pf_status.debug >= PF_DEBUG_MISC) { 752#ifdef __FreeBSD__ 753 printf("pf: state insert failed: " 754 "id: %016llx creatorid: %08x", 755 (long long)be64toh(state->id), 756 ntohl(state->creatorid)); 757#else 758 printf("pf: state insert failed: " 759 "id: %016llx creatorid: %08x", 760 betoh64(state->id), ntohl(state->creatorid)); 761#endif 762 if (state->sync_flags & PFSTATE_FROMSYNC) 763 printf(" (from sync)"); 764 printf("\n"); 765 } 766 RB_REMOVE(pf_state_tree_lan_ext, &kif->pfik_lan_ext, state); 767 RB_REMOVE(pf_state_tree_ext_gwy, &kif->pfik_ext_gwy, state); 768 return (-1); 769 } 770 TAILQ_INSERT_HEAD(&state_updates, state, u.s.entry_updates); 771 772 pf_status.fcounters[FCNT_STATE_INSERT]++; 773 pf_status.states++; 774 pfi_attach_state(kif); 775#if NPFSYNC 776 pfsync_insert_state(state); 777#endif 778 return (0); 779} 780 781void 782pf_purge_timeout(void *arg) 783{ 784#ifdef __FreeBSD__ 785 struct callout *to = arg; 786#else 787 struct timeout *to = arg; 788#endif 789 int s; 790 791#ifdef __FreeBSD__ 792 PF_LOCK(); 793#endif 794 s = splsoftnet(); 795 pf_purge_expired_states(); 796 pf_purge_expired_fragments(); 797 pf_purge_expired_src_nodes(); 798 splx(s); 799#ifdef __FreeBSD__ 800 PF_UNLOCK(); 801#endif 802 803#ifdef __FreeBSD__ 804 callout_reset(to, pf_default_rule.timeout[PFTM_INTERVAL] * hz, 805 pf_purge_timeout, to); 806#else 807 timeout_add(to, pf_default_rule.timeout[PFTM_INTERVAL] * hz); 808#endif 809} 810 811u_int32_t 812pf_state_expires(const struct pf_state *state) 813{ 814 u_int32_t timeout; 815 u_int32_t start; 816 u_int32_t end; 817 u_int32_t states; 818 819 /* handle all PFTM_* > PFTM_MAX here */ 820 if (state->timeout == PFTM_PURGE) 821#ifdef __FreeBSD__ 822 return (time_second); 823#else 824 return (time.tv_sec); 825#endif 826 if (state->timeout == PFTM_UNTIL_PACKET) 827 return (0); 828#ifdef __FreeBSD__ 829 KASSERT((state->timeout < PFTM_MAX), 830 ("pf_state_expires: timeout > PFTM_MAX")); 831#else 832 KASSERT(state->timeout < PFTM_MAX); 833#endif 834 timeout = state->rule.ptr->timeout[state->timeout]; 835 if (!timeout) 836 timeout = pf_default_rule.timeout[state->timeout]; 837 start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START]; 838 if (start) { 839 end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END]; 840 states = state->rule.ptr->states; 841 } else { 842 start = pf_default_rule.timeout[PFTM_ADAPTIVE_START]; 843 end = pf_default_rule.timeout[PFTM_ADAPTIVE_END]; 844 states = pf_status.states; 845 } 846 if (end && states > start && start < end) { 847 if (states < end) 848 return (state->expire + timeout * (end - states) / 849 (end - start)); 850 else 851#ifdef __FreeBSD__ 852 return (time_second); 853#else 854 return (time.tv_sec); 855#endif 856 } 857 return (state->expire + timeout); 858} 859 860void 861pf_purge_expired_src_nodes(void) 862{ 863 struct pf_src_node *cur, *next; 864 865 for (cur = RB_MIN(pf_src_tree, &tree_src_tracking); cur; cur = next) { 866 next = RB_NEXT(pf_src_tree, &tree_src_tracking, cur); 867 868#ifdef __FreeBSD__ 869 if (cur->states <= 0 && cur->expire <= time_second) { 870#else 871 if (cur->states <= 0 && cur->expire <= time.tv_sec) { 872#endif 873 if (cur->rule.ptr != NULL) { 874 cur->rule.ptr->src_nodes--; 875 if (cur->rule.ptr->states <= 0 && 876 cur->rule.ptr->max_src_nodes <= 0) 877 pf_rm_rule(NULL, cur->rule.ptr); 878 } 879 RB_REMOVE(pf_src_tree, &tree_src_tracking, cur); 880 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 881 pf_status.src_nodes--; 882 pool_put(&pf_src_tree_pl, cur); 883 } 884 } 885} 886 887void 888pf_src_tree_remove_state(struct pf_state *s) 889{ 890 u_int32_t timeout; 891 892 if (s->src_node != NULL) { 893 if (--s->src_node->states <= 0) { 894 timeout = s->rule.ptr->timeout[PFTM_SRC_NODE]; 895 if (!timeout) 896 timeout = 897 pf_default_rule.timeout[PFTM_SRC_NODE]; 898#ifdef __FreeBSD__ 899 s->src_node->expire = time_second + timeout; 900#else 901 s->src_node->expire = time.tv_sec + timeout; 902#endif 903 } 904 } 905 if (s->nat_src_node != s->src_node && s->nat_src_node != NULL) { 906 if (--s->nat_src_node->states <= 0) { 907 timeout = s->rule.ptr->timeout[PFTM_SRC_NODE]; 908 if (!timeout) 909 timeout = 910 pf_default_rule.timeout[PFTM_SRC_NODE]; 911#ifdef __FreeBSD__ 912 s->nat_src_node->expire = time_second + timeout; 913#else 914 s->nat_src_node->expire = time.tv_sec + timeout; 915#endif 916 } 917 } 918 s->src_node = s->nat_src_node = NULL; 919} 920 921void 922pf_purge_expired_states(void) 923{ 924 struct pf_state *cur, *next; 925 926 for (cur = RB_MIN(pf_state_tree_id, &tree_id); 927 cur; cur = next) { 928 next = RB_NEXT(pf_state_tree_id, &tree_id, cur); 929 930#ifdef __FreeBSD__ 931 if (pf_state_expires(cur) <= time_second) { 932#else 933 if (pf_state_expires(cur) <= time.tv_sec) { 934#endif 935 if (cur->src.state == PF_TCPS_PROXY_DST) 936 pf_send_tcp(cur->rule.ptr, cur->af, 937 &cur->ext.addr, &cur->lan.addr, 938 cur->ext.port, cur->lan.port, 939 cur->src.seqhi, cur->src.seqlo + 1, 0, 940 TH_RST|TH_ACK, 0, 0); 941 RB_REMOVE(pf_state_tree_ext_gwy, 942 &cur->u.s.kif->pfik_ext_gwy, cur); 943 RB_REMOVE(pf_state_tree_lan_ext, 944 &cur->u.s.kif->pfik_lan_ext, cur); 945 RB_REMOVE(pf_state_tree_id, &tree_id, cur); 946#if NPFSYNC 947 pfsync_delete_state(cur); 948#endif 949 pf_src_tree_remove_state(cur); 950 if (--cur->rule.ptr->states <= 0 && 951 cur->rule.ptr->src_nodes <= 0) 952 pf_rm_rule(NULL, cur->rule.ptr); 953 if (cur->nat_rule.ptr != NULL) 954 if (--cur->nat_rule.ptr->states <= 0 && 955 cur->nat_rule.ptr->src_nodes <= 0) 956 pf_rm_rule(NULL, cur->nat_rule.ptr); 957 if (cur->anchor.ptr != NULL) 958 if (--cur->anchor.ptr->states <= 0) 959 pf_rm_rule(NULL, cur->anchor.ptr); 960 pf_normalize_tcp_cleanup(cur); 961 pfi_detach_state(cur->u.s.kif); 962 TAILQ_REMOVE(&state_updates, cur, u.s.entry_updates); 963 pool_put(&pf_state_pl, cur); 964 pf_status.fcounters[FCNT_STATE_REMOVALS]++; 965 pf_status.states--; 966 } 967 } 968} 969 970int 971pf_tbladdr_setup(struct pf_ruleset *rs, struct pf_addr_wrap *aw) 972{ 973 if (aw->type != PF_ADDR_TABLE) 974 return (0); 975 if ((aw->p.tbl = pfr_attach_table(rs, aw->v.tblname)) == NULL) 976 return (1); 977 return (0); 978} 979 980void 981pf_tbladdr_remove(struct pf_addr_wrap *aw) 982{ 983 if (aw->type != PF_ADDR_TABLE || aw->p.tbl == NULL) 984 return; 985 pfr_detach_table(aw->p.tbl); 986 aw->p.tbl = NULL; 987} 988 989void 990pf_tbladdr_copyout(struct pf_addr_wrap *aw) 991{ 992 struct pfr_ktable *kt = aw->p.tbl; 993 994 if (aw->type != PF_ADDR_TABLE || kt == NULL) 995 return; 996 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 997 kt = kt->pfrkt_root; 998 aw->p.tbl = NULL; 999 aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ? 1000 kt->pfrkt_cnt : -1; 1001} 1002 1003void 1004pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af) 1005{ 1006 switch (af) { 1007#ifdef INET 1008 case AF_INET: { 1009 u_int32_t a = ntohl(addr->addr32[0]); 1010 printf("%u.%u.%u.%u", (a>>24)&255, (a>>16)&255, 1011 (a>>8)&255, a&255); 1012 if (p) { 1013 p = ntohs(p); 1014 printf(":%u", p); 1015 } 1016 break; 1017 } 1018#endif /* INET */ 1019#ifdef INET6 1020 case AF_INET6: { 1021 u_int16_t b; 1022 u_int8_t i, curstart = 255, curend = 0, 1023 maxstart = 0, maxend = 0; 1024 for (i = 0; i < 8; i++) { 1025 if (!addr->addr16[i]) { 1026 if (curstart == 255) 1027 curstart = i; 1028 else 1029 curend = i; 1030 } else { 1031 if (curstart) { 1032 if ((curend - curstart) > 1033 (maxend - maxstart)) { 1034 maxstart = curstart; 1035 maxend = curend; 1036 curstart = 255; 1037 } 1038 } 1039 } 1040 } 1041 for (i = 0; i < 8; i++) { 1042 if (i >= maxstart && i <= maxend) { 1043 if (maxend != 7) { 1044 if (i == maxstart) 1045 printf(":"); 1046 } else { 1047 if (i == maxend) 1048 printf(":"); 1049 } 1050 } else { 1051 b = ntohs(addr->addr16[i]); 1052 printf("%x", b); 1053 if (i < 7) 1054 printf(":"); 1055 } 1056 } 1057 if (p) { 1058 p = ntohs(p); 1059 printf("[%u]", p); 1060 } 1061 break; 1062 } 1063#endif /* INET6 */ 1064 } 1065} 1066 1067void 1068pf_print_state(struct pf_state *s) 1069{ 1070 switch (s->proto) { 1071 case IPPROTO_TCP: 1072 printf("TCP "); 1073 break; 1074 case IPPROTO_UDP: 1075 printf("UDP "); 1076 break; 1077 case IPPROTO_ICMP: 1078 printf("ICMP "); 1079 break; 1080 case IPPROTO_ICMPV6: 1081 printf("ICMPV6 "); 1082 break; 1083 default: 1084 printf("%u ", s->proto); 1085 break; 1086 } 1087 pf_print_host(&s->lan.addr, s->lan.port, s->af); 1088 printf(" "); 1089 pf_print_host(&s->gwy.addr, s->gwy.port, s->af); 1090 printf(" "); 1091 pf_print_host(&s->ext.addr, s->ext.port, s->af); 1092 printf(" [lo=%u high=%u win=%u modulator=%u", s->src.seqlo, 1093 s->src.seqhi, s->src.max_win, s->src.seqdiff); 1094 if (s->src.wscale && s->dst.wscale) 1095 printf(" wscale=%u", s->src.wscale & PF_WSCALE_MASK); 1096 printf("]"); 1097 printf(" [lo=%u high=%u win=%u modulator=%u", s->dst.seqlo, 1098 s->dst.seqhi, s->dst.max_win, s->dst.seqdiff); 1099 if (s->src.wscale && s->dst.wscale) 1100 printf(" wscale=%u", s->dst.wscale & PF_WSCALE_MASK); 1101 printf("]"); 1102 printf(" %u:%u", s->src.state, s->dst.state); 1103} 1104 1105void 1106pf_print_flags(u_int8_t f) 1107{ 1108 if (f) 1109 printf(" "); 1110 if (f & TH_FIN) 1111 printf("F"); 1112 if (f & TH_SYN) 1113 printf("S"); 1114 if (f & TH_RST) 1115 printf("R"); 1116 if (f & TH_PUSH) 1117 printf("P"); 1118 if (f & TH_ACK) 1119 printf("A"); 1120 if (f & TH_URG) 1121 printf("U"); 1122 if (f & TH_ECE) 1123 printf("E"); 1124 if (f & TH_CWR) 1125 printf("W"); 1126} 1127 1128#define PF_SET_SKIP_STEPS(i) \ 1129 do { \ 1130 while (head[i] != cur) { \ 1131 head[i]->skip[i].ptr = cur; \ 1132 head[i] = TAILQ_NEXT(head[i], entries); \ 1133 } \ 1134 } while (0) 1135 1136void 1137pf_calc_skip_steps(struct pf_rulequeue *rules) 1138{ 1139 struct pf_rule *cur, *prev, *head[PF_SKIP_COUNT]; 1140 int i; 1141 1142 cur = TAILQ_FIRST(rules); 1143 prev = cur; 1144 for (i = 0; i < PF_SKIP_COUNT; ++i) 1145 head[i] = cur; 1146 while (cur != NULL) { 1147 1148 if (cur->kif != prev->kif || cur->ifnot != prev->ifnot) 1149 PF_SET_SKIP_STEPS(PF_SKIP_IFP); 1150 if (cur->direction != prev->direction) 1151 PF_SET_SKIP_STEPS(PF_SKIP_DIR); 1152 if (cur->af != prev->af) 1153 PF_SET_SKIP_STEPS(PF_SKIP_AF); 1154 if (cur->proto != prev->proto) 1155 PF_SET_SKIP_STEPS(PF_SKIP_PROTO); 1156 if (cur->src.not != prev->src.not || 1157 pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr)) 1158 PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR); 1159 if (cur->src.port[0] != prev->src.port[0] || 1160 cur->src.port[1] != prev->src.port[1] || 1161 cur->src.port_op != prev->src.port_op) 1162 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT); 1163 if (cur->dst.not != prev->dst.not || 1164 pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr)) 1165 PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR); 1166 if (cur->dst.port[0] != prev->dst.port[0] || 1167 cur->dst.port[1] != prev->dst.port[1] || 1168 cur->dst.port_op != prev->dst.port_op) 1169 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT); 1170 1171 prev = cur; 1172 cur = TAILQ_NEXT(cur, entries); 1173 } 1174 for (i = 0; i < PF_SKIP_COUNT; ++i) 1175 PF_SET_SKIP_STEPS(i); 1176} 1177 1178int 1179pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2) 1180{ 1181 if (aw1->type != aw2->type) 1182 return (1); 1183 switch (aw1->type) { 1184 case PF_ADDR_ADDRMASK: 1185 if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, 0)) 1186 return (1); 1187 if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, 0)) 1188 return (1); 1189 return (0); 1190 case PF_ADDR_DYNIFTL: 1191 return (aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt); 1192 case PF_ADDR_NOROUTE: 1193 return (0); 1194 case PF_ADDR_TABLE: 1195 return (aw1->p.tbl != aw2->p.tbl); 1196 default: 1197 printf("invalid address type: %d\n", aw1->type); 1198 return (1); 1199 } 1200} 1201 1202void 1203pf_update_anchor_rules() 1204{ 1205 struct pf_rule *rule; 1206 int i; 1207 1208 for (i = 0; i < PF_RULESET_MAX; ++i) 1209 TAILQ_FOREACH(rule, pf_main_ruleset.rules[i].active.ptr, 1210 entries) 1211 if (rule->anchorname[0]) 1212 rule->anchor = pf_find_anchor(rule->anchorname); 1213 else 1214 rule->anchor = NULL; 1215} 1216 1217u_int16_t 1218pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp) 1219{ 1220 u_int32_t l; 1221 1222 if (udp && !cksum) 1223 return (0x0000); 1224 l = cksum + old - new; 1225 l = (l >> 16) + (l & 65535); 1226 l = l & 65535; 1227 if (udp && !l) 1228 return (0xFFFF); 1229 return (l); 1230} 1231 1232void 1233pf_change_ap(struct pf_addr *a, u_int16_t *p, u_int16_t *ic, u_int16_t *pc, 1234 struct pf_addr *an, u_int16_t pn, u_int8_t u, sa_family_t af) 1235{ 1236 struct pf_addr ao; 1237 u_int16_t po = *p; 1238 1239 PF_ACPY(&ao, a, af); 1240 PF_ACPY(a, an, af); 1241 1242 *p = pn; 1243 1244 switch (af) { 1245#ifdef INET 1246 case AF_INET: 1247 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic, 1248 ao.addr16[0], an->addr16[0], 0), 1249 ao.addr16[1], an->addr16[1], 0); 1250 *p = pn; 1251 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc, 1252 ao.addr16[0], an->addr16[0], u), 1253 ao.addr16[1], an->addr16[1], u), 1254 po, pn, u); 1255 break; 1256#endif /* INET */ 1257#ifdef INET6 1258 case AF_INET6: 1259 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1260 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1261 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc, 1262 ao.addr16[0], an->addr16[0], u), 1263 ao.addr16[1], an->addr16[1], u), 1264 ao.addr16[2], an->addr16[2], u), 1265 ao.addr16[3], an->addr16[3], u), 1266 ao.addr16[4], an->addr16[4], u), 1267 ao.addr16[5], an->addr16[5], u), 1268 ao.addr16[6], an->addr16[6], u), 1269 ao.addr16[7], an->addr16[7], u), 1270 po, pn, u); 1271 break; 1272#endif /* INET6 */ 1273 } 1274} 1275 1276 1277/* Changes a u_int32_t. Uses a void * so there are no align restrictions */ 1278void 1279pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u) 1280{ 1281 u_int32_t ao; 1282 1283 memcpy(&ao, a, sizeof(ao)); 1284 memcpy(a, &an, sizeof(u_int32_t)); 1285 *c = pf_cksum_fixup(pf_cksum_fixup(*c, ao / 65536, an / 65536, u), 1286 ao % 65536, an % 65536, u); 1287} 1288 1289#ifdef INET6 1290void 1291pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u) 1292{ 1293 struct pf_addr ao; 1294 1295 PF_ACPY(&ao, a, AF_INET6); 1296 PF_ACPY(a, an, AF_INET6); 1297 1298 *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1299 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1300 pf_cksum_fixup(pf_cksum_fixup(*c, 1301 ao.addr16[0], an->addr16[0], u), 1302 ao.addr16[1], an->addr16[1], u), 1303 ao.addr16[2], an->addr16[2], u), 1304 ao.addr16[3], an->addr16[3], u), 1305 ao.addr16[4], an->addr16[4], u), 1306 ao.addr16[5], an->addr16[5], u), 1307 ao.addr16[6], an->addr16[6], u), 1308 ao.addr16[7], an->addr16[7], u); 1309} 1310#endif /* INET6 */ 1311 1312void 1313pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa, 1314 struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c, 1315 u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af) 1316{ 1317 struct pf_addr oia, ooa; 1318 1319 PF_ACPY(&oia, ia, af); 1320 PF_ACPY(&ooa, oa, af); 1321 1322 /* Change inner protocol port, fix inner protocol checksum. */ 1323 if (ip != NULL) { 1324 u_int16_t oip = *ip; 1325 u_int32_t opc = 0; /* make the compiler happy */ 1326 1327 if (pc != NULL) 1328 opc = *pc; 1329 *ip = np; 1330 if (pc != NULL) 1331 *pc = pf_cksum_fixup(*pc, oip, *ip, u); 1332 *ic = pf_cksum_fixup(*ic, oip, *ip, 0); 1333 if (pc != NULL) 1334 *ic = pf_cksum_fixup(*ic, opc, *pc, 0); 1335 } 1336 /* Change inner ip address, fix inner ip and icmp checksums. */ 1337 PF_ACPY(ia, na, af); 1338 switch (af) { 1339#ifdef INET 1340 case AF_INET: { 1341 u_int32_t oh2c = *h2c; 1342 1343 *h2c = pf_cksum_fixup(pf_cksum_fixup(*h2c, 1344 oia.addr16[0], ia->addr16[0], 0), 1345 oia.addr16[1], ia->addr16[1], 0); 1346 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic, 1347 oia.addr16[0], ia->addr16[0], 0), 1348 oia.addr16[1], ia->addr16[1], 0); 1349 *ic = pf_cksum_fixup(*ic, oh2c, *h2c, 0); 1350 break; 1351 } 1352#endif /* INET */ 1353#ifdef INET6 1354 case AF_INET6: 1355 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1356 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1357 pf_cksum_fixup(pf_cksum_fixup(*ic, 1358 oia.addr16[0], ia->addr16[0], u), 1359 oia.addr16[1], ia->addr16[1], u), 1360 oia.addr16[2], ia->addr16[2], u), 1361 oia.addr16[3], ia->addr16[3], u), 1362 oia.addr16[4], ia->addr16[4], u), 1363 oia.addr16[5], ia->addr16[5], u), 1364 oia.addr16[6], ia->addr16[6], u), 1365 oia.addr16[7], ia->addr16[7], u); 1366 break; 1367#endif /* INET6 */ 1368 } 1369 /* Change outer ip address, fix outer ip or icmpv6 checksum. */ 1370 PF_ACPY(oa, na, af); 1371 switch (af) { 1372#ifdef INET 1373 case AF_INET: 1374 *hc = pf_cksum_fixup(pf_cksum_fixup(*hc, 1375 ooa.addr16[0], oa->addr16[0], 0), 1376 ooa.addr16[1], oa->addr16[1], 0); 1377 break; 1378#endif /* INET */ 1379#ifdef INET6 1380 case AF_INET6: 1381 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1382 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1383 pf_cksum_fixup(pf_cksum_fixup(*ic, 1384 ooa.addr16[0], oa->addr16[0], u), 1385 ooa.addr16[1], oa->addr16[1], u), 1386 ooa.addr16[2], oa->addr16[2], u), 1387 ooa.addr16[3], oa->addr16[3], u), 1388 ooa.addr16[4], oa->addr16[4], u), 1389 ooa.addr16[5], oa->addr16[5], u), 1390 ooa.addr16[6], oa->addr16[6], u), 1391 ooa.addr16[7], oa->addr16[7], u); 1392 break; 1393#endif /* INET6 */ 1394 } 1395} 1396 1397void 1398pf_send_tcp(const struct pf_rule *r, sa_family_t af, 1399 const struct pf_addr *saddr, const struct pf_addr *daddr, 1400 u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack, 1401 u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl) 1402{ 1403 struct mbuf *m; 1404#ifdef ALTQ 1405 struct m_tag *mtag; 1406#endif 1407 int len = 0, tlen; /* make the compiler happy */ 1408#ifdef INET 1409 struct ip *h = NULL; /* make the compiler happy */ 1410#endif /* INET */ 1411#ifdef INET6 1412 struct ip6_hdr *h6 = NULL; /* make the compiler happy */ 1413#endif /* INET6 */ 1414 struct tcphdr *th = NULL; /* make the compiler happy */ 1415#ifdef __FreeBSD__ 1416 struct ip *ip; 1417#endif 1418 char *opt; 1419 1420 /* maximum segment size tcp option */ 1421 tlen = sizeof(struct tcphdr); 1422 if (mss) 1423 tlen += 4; 1424 1425 switch (af) { 1426#ifdef INET 1427 case AF_INET: 1428 len = sizeof(struct ip) + tlen; 1429 break; 1430#endif /* INET */ 1431#ifdef INET6 1432 case AF_INET6: 1433 len = sizeof(struct ip6_hdr) + tlen; 1434 break; 1435#endif /* INET6 */ 1436 } 1437 1438 /* create outgoing mbuf */ 1439#ifdef __FreeBSD__ 1440 m = m_gethdr(M_DONTWAIT, MT_HEADER); 1441 if (m == NULL) 1442 return; 1443 m->m_flags |= M_SKIP_FIREWALL; 1444#else 1445 mtag = m_tag_get(PACKET_TAG_PF_GENERATED, 0, M_NOWAIT); 1446 if (mtag == NULL) 1447 return; 1448 m = m_gethdr(M_DONTWAIT, MT_HEADER); 1449 if (m == NULL) { 1450 m_tag_free(mtag); 1451 return; 1452 } 1453 m_tag_prepend(m, mtag); 1454#endif 1455#ifdef ALTQ 1456 if (r != NULL && r->qid) { 1457 struct altq_tag *atag; 1458 1459 mtag = m_tag_get(PACKET_TAG_PF_QID, sizeof(*atag), M_NOWAIT); 1460 if (mtag != NULL) { 1461 atag = (struct altq_tag *)(mtag + 1); 1462 atag->qid = r->qid; 1463 /* add hints for ecn */ 1464 atag->af = af; 1465 atag->hdr = mtod(m, struct ip *); 1466 m_tag_prepend(m, mtag); 1467 } 1468 } 1469#endif 1470 m->m_data += max_linkhdr; 1471 m->m_pkthdr.len = m->m_len = len; 1472 m->m_pkthdr.rcvif = NULL; 1473 bzero(m->m_data, len); 1474 switch (af) { 1475#ifdef INET 1476 case AF_INET: 1477 h = mtod(m, struct ip *); 1478 1479 /* IP header fields included in the TCP checksum */ 1480 h->ip_p = IPPROTO_TCP; 1481 h->ip_len = htons(tlen); 1482 h->ip_src.s_addr = saddr->v4.s_addr; 1483 h->ip_dst.s_addr = daddr->v4.s_addr; 1484 1485 th = (struct tcphdr *)((caddr_t)h + sizeof(struct ip)); 1486 break; 1487#endif /* INET */ 1488#ifdef INET6 1489 case AF_INET6: 1490 h6 = mtod(m, struct ip6_hdr *); 1491 1492 /* IP header fields included in the TCP checksum */ 1493 h6->ip6_nxt = IPPROTO_TCP; 1494 h6->ip6_plen = htons(tlen); 1495 memcpy(&h6->ip6_src, &saddr->v6, sizeof(struct in6_addr)); 1496 memcpy(&h6->ip6_dst, &daddr->v6, sizeof(struct in6_addr)); 1497 1498 th = (struct tcphdr *)((caddr_t)h6 + sizeof(struct ip6_hdr)); 1499 break; 1500#endif /* INET6 */ 1501 } 1502 1503 /* TCP header */ 1504 th->th_sport = sport; 1505 th->th_dport = dport; 1506 th->th_seq = htonl(seq); 1507 th->th_ack = htonl(ack); 1508 th->th_off = tlen >> 2; 1509 th->th_flags = flags; 1510 th->th_win = htons(win); 1511 1512 if (mss) { 1513 opt = (char *)(th + 1); 1514 opt[0] = TCPOPT_MAXSEG; 1515 opt[1] = 4; 1516 HTONS(mss); 1517 bcopy((caddr_t)&mss, (caddr_t)(opt + 2), 2); 1518 } 1519 1520 switch (af) { 1521#ifdef INET 1522 case AF_INET: 1523 /* TCP checksum */ 1524 th->th_sum = in_cksum(m, len); 1525 1526 /* Finish the IP header */ 1527 h->ip_v = 4; 1528 h->ip_hl = sizeof(*h) >> 2; 1529 h->ip_tos = IPTOS_LOWDELAY; 1530#ifdef __FreeBSD__ 1531 h->ip_off = path_mtu_discovery ? IP_DF : 0; 1532 h->ip_len = len; 1533#else 1534 h->ip_off = htons(ip_mtudisc ? IP_DF : 0); 1535 h->ip_len = htons(len); 1536#endif 1537 h->ip_ttl = ttl ? ttl : ip_defttl; 1538 h->ip_sum = 0; 1539#ifdef __FreeBSD__ 1540 ip = mtod(m, struct ip *); 1541 PF_UNLOCK(); 1542 ip_output(m, (void *)NULL, (void *)NULL, 0, (void *)NULL, 1543 (void *)NULL); 1544 PF_LOCK(); 1545#else /* ! __FreeBSD__ */ 1546 ip_output(m, (void *)NULL, (void *)NULL, 0, (void *)NULL, 1547 (void *)NULL); 1548#endif 1549 break; 1550#endif /* INET */ 1551#ifdef INET6 1552 case AF_INET6: 1553 /* TCP checksum */ 1554 th->th_sum = in6_cksum(m, IPPROTO_TCP, 1555 sizeof(struct ip6_hdr), tlen); 1556 1557 h6->ip6_vfc |= IPV6_VERSION; 1558 h6->ip6_hlim = IPV6_DEFHLIM; 1559 1560#ifdef __FreeBSD__ 1561 PF_UNLOCK(); 1562 ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL); 1563 PF_LOCK(); 1564#else 1565 ip6_output(m, NULL, NULL, 0, NULL, NULL); 1566#endif 1567 break; 1568#endif /* INET6 */ 1569 } 1570} 1571 1572void 1573pf_send_icmp(struct mbuf *m, u_int8_t type, u_int8_t code, sa_family_t af, 1574 struct pf_rule *r) 1575{ 1576#ifdef ALTQ 1577 struct m_tag *mtag; 1578#endif 1579 struct mbuf *m0; 1580#ifdef __FreeBSD__ 1581 struct ip *ip; 1582#endif 1583 1584#ifdef __FreeBSD__ 1585 m0 = m_copypacket(m, M_DONTWAIT); 1586 if (m0 == NULL) 1587 return; 1588 m0->m_flags |= M_SKIP_FIREWALL; 1589#else 1590 mtag = m_tag_get(PACKET_TAG_PF_GENERATED, 0, M_NOWAIT); 1591 if (mtag == NULL) 1592 return; 1593 m0 = m_copy(m, 0, M_COPYALL); 1594 if (m0 == NULL) { 1595 m_tag_free(mtag); 1596 return; 1597 } 1598 m_tag_prepend(m0, mtag); 1599#endif 1600 1601#ifdef ALTQ 1602 if (r->qid) { 1603 struct altq_tag *atag; 1604 1605 mtag = m_tag_get(PACKET_TAG_PF_QID, sizeof(*atag), M_NOWAIT); 1606 if (mtag != NULL) { 1607 atag = (struct altq_tag *)(mtag + 1); 1608 atag->qid = r->qid; 1609 /* add hints for ecn */ 1610 atag->af = af; 1611 atag->hdr = mtod(m0, struct ip *); 1612 m_tag_prepend(m0, mtag); 1613 } 1614 } 1615#endif 1616 1617 switch (af) { 1618#ifdef INET 1619 case AF_INET: 1620#ifdef __FreeBSD__ 1621 /* icmp_error() expects host byte ordering */ 1622 ip = mtod(m0, struct ip *); 1623 NTOHS(ip->ip_len); 1624 NTOHS(ip->ip_off); 1625 PF_UNLOCK(); 1626#endif 1627 icmp_error(m0, type, code, 0, (void *)NULL); 1628#ifdef __FreeBSD__ 1629 PF_LOCK(); 1630#endif 1631 break; 1632#endif /* INET */ 1633#ifdef INET6 1634 case AF_INET6: 1635#ifdef __FreeBSD__ 1636 PF_UNLOCK(); 1637#endif 1638 icmp6_error(m0, type, code, 0); 1639#ifdef __FreeBSD__ 1640 PF_LOCK(); 1641#endif 1642 break; 1643#endif /* INET6 */ 1644 } 1645} 1646 1647/* 1648 * Return 1 if the addresses a and b match (with mask m), otherwise return 0. 1649 * If n is 0, they match if they are equal. If n is != 0, they match if they 1650 * are different. 1651 */ 1652int 1653pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m, 1654 struct pf_addr *b, sa_family_t af) 1655{ 1656 int match = 0; 1657 1658 switch (af) { 1659#ifdef INET 1660 case AF_INET: 1661 if ((a->addr32[0] & m->addr32[0]) == 1662 (b->addr32[0] & m->addr32[0])) 1663 match++; 1664 break; 1665#endif /* INET */ 1666#ifdef INET6 1667 case AF_INET6: 1668 if (((a->addr32[0] & m->addr32[0]) == 1669 (b->addr32[0] & m->addr32[0])) && 1670 ((a->addr32[1] & m->addr32[1]) == 1671 (b->addr32[1] & m->addr32[1])) && 1672 ((a->addr32[2] & m->addr32[2]) == 1673 (b->addr32[2] & m->addr32[2])) && 1674 ((a->addr32[3] & m->addr32[3]) == 1675 (b->addr32[3] & m->addr32[3]))) 1676 match++; 1677 break; 1678#endif /* INET6 */ 1679 } 1680 if (match) { 1681 if (n) 1682 return (0); 1683 else 1684 return (1); 1685 } else { 1686 if (n) 1687 return (1); 1688 else 1689 return (0); 1690 } 1691} 1692 1693int 1694pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p) 1695{ 1696 switch (op) { 1697 case PF_OP_IRG: 1698 return ((p > a1) && (p < a2)); 1699 case PF_OP_XRG: 1700 return ((p < a1) || (p > a2)); 1701 case PF_OP_RRG: 1702 return ((p >= a1) && (p <= a2)); 1703 case PF_OP_EQ: 1704 return (p == a1); 1705 case PF_OP_NE: 1706 return (p != a1); 1707 case PF_OP_LT: 1708 return (p < a1); 1709 case PF_OP_LE: 1710 return (p <= a1); 1711 case PF_OP_GT: 1712 return (p > a1); 1713 case PF_OP_GE: 1714 return (p >= a1); 1715 } 1716 return (0); /* never reached */ 1717} 1718 1719int 1720pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p) 1721{ 1722 NTOHS(a1); 1723 NTOHS(a2); 1724 NTOHS(p); 1725 return (pf_match(op, a1, a2, p)); 1726} 1727 1728int 1729pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u) 1730{ 1731 if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE) 1732 return (0); 1733 return (pf_match(op, a1, a2, u)); 1734} 1735 1736int 1737pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g) 1738{ 1739 if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE) 1740 return (0); 1741 return (pf_match(op, a1, a2, g)); 1742} 1743 1744struct pf_tag * 1745pf_get_tag(struct mbuf *m) 1746{ 1747 struct m_tag *mtag; 1748 1749 if ((mtag = m_tag_find(m, PACKET_TAG_PF_TAG, NULL)) != NULL) 1750 return ((struct pf_tag *)(mtag + 1)); 1751 else 1752 return (NULL); 1753} 1754 1755int 1756pf_match_tag(struct mbuf *m, struct pf_rule *r, struct pf_rule *nat_rule, 1757 struct pf_tag *pftag, int *tag) 1758{ 1759 if (*tag == -1) { /* find mbuf tag */ 1760 pftag = pf_get_tag(m); 1761 if (pftag != NULL) 1762 *tag = pftag->tag; 1763 else 1764 *tag = 0; 1765 if (nat_rule != NULL && nat_rule->tag) 1766 *tag = nat_rule->tag; 1767 } 1768 1769 return ((!r->match_tag_not && r->match_tag == *tag) || 1770 (r->match_tag_not && r->match_tag != *tag)); 1771} 1772 1773int 1774pf_tag_packet(struct mbuf *m, struct pf_tag *pftag, int tag) 1775{ 1776 struct m_tag *mtag; 1777 1778 if (tag <= 0) 1779 return (0); 1780 1781 if (pftag == NULL) { 1782 mtag = m_tag_get(PACKET_TAG_PF_TAG, sizeof(*pftag), M_NOWAIT); 1783 if (mtag == NULL) 1784 return (1); 1785 ((struct pf_tag *)(mtag + 1))->tag = tag; 1786 m_tag_prepend(m, mtag); 1787 } else 1788 pftag->tag = tag; 1789 1790 return (0); 1791} 1792 1793#define PF_STEP_INTO_ANCHOR(r, a, s, n) \ 1794 do { \ 1795 if ((r) == NULL || (r)->anchor == NULL || \ 1796 (s) != NULL || (a) != NULL) \ 1797 panic("PF_STEP_INTO_ANCHOR"); \ 1798 (a) = (r); \ 1799 (s) = TAILQ_FIRST(&(r)->anchor->rulesets); \ 1800 (r) = NULL; \ 1801 while ((s) != NULL && ((r) = \ 1802 TAILQ_FIRST((s)->rules[n].active.ptr)) == NULL) \ 1803 (s) = TAILQ_NEXT((s), entries); \ 1804 if ((r) == NULL) { \ 1805 (r) = TAILQ_NEXT((a), entries); \ 1806 (a) = NULL; \ 1807 } \ 1808 } while (0) 1809 1810#define PF_STEP_OUT_OF_ANCHOR(r, a, s, n) \ 1811 do { \ 1812 if ((r) != NULL || (a) == NULL || (s) == NULL) \ 1813 panic("PF_STEP_OUT_OF_ANCHOR"); \ 1814 (s) = TAILQ_NEXT((s), entries); \ 1815 while ((s) != NULL && ((r) = \ 1816 TAILQ_FIRST((s)->rules[n].active.ptr)) == NULL) \ 1817 (s) = TAILQ_NEXT((s), entries); \ 1818 if ((r) == NULL) { \ 1819 (r) = TAILQ_NEXT((a), entries); \ 1820 (a) = NULL; \ 1821 } \ 1822 } while (0) 1823 1824#ifdef INET6 1825void 1826pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr, 1827 struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af) 1828{ 1829 switch (af) { 1830#ifdef INET 1831 case AF_INET: 1832 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) | 1833 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]); 1834 break; 1835#endif /* INET */ 1836 case AF_INET6: 1837 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) | 1838 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]); 1839 naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) | 1840 ((rmask->addr32[1] ^ 0xffffffff ) & saddr->addr32[1]); 1841 naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) | 1842 ((rmask->addr32[2] ^ 0xffffffff ) & saddr->addr32[2]); 1843 naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) | 1844 ((rmask->addr32[3] ^ 0xffffffff ) & saddr->addr32[3]); 1845 break; 1846 } 1847} 1848 1849void 1850pf_addr_inc(struct pf_addr *addr, sa_family_t af) 1851{ 1852 switch (af) { 1853#ifdef INET 1854 case AF_INET: 1855 addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1); 1856 break; 1857#endif /* INET */ 1858 case AF_INET6: 1859 if (addr->addr32[3] == 0xffffffff) { 1860 addr->addr32[3] = 0; 1861 if (addr->addr32[2] == 0xffffffff) { 1862 addr->addr32[2] = 0; 1863 if (addr->addr32[1] == 0xffffffff) { 1864 addr->addr32[1] = 0; 1865 addr->addr32[0] = 1866 htonl(ntohl(addr->addr32[0]) + 1); 1867 } else 1868 addr->addr32[1] = 1869 htonl(ntohl(addr->addr32[1]) + 1); 1870 } else 1871 addr->addr32[2] = 1872 htonl(ntohl(addr->addr32[2]) + 1); 1873 } else 1874 addr->addr32[3] = 1875 htonl(ntohl(addr->addr32[3]) + 1); 1876 break; 1877 } 1878} 1879#endif /* INET6 */ 1880 1881#define mix(a,b,c) \ 1882 do { \ 1883 a -= b; a -= c; a ^= (c >> 13); \ 1884 b -= c; b -= a; b ^= (a << 8); \ 1885 c -= a; c -= b; c ^= (b >> 13); \ 1886 a -= b; a -= c; a ^= (c >> 12); \ 1887 b -= c; b -= a; b ^= (a << 16); \ 1888 c -= a; c -= b; c ^= (b >> 5); \ 1889 a -= b; a -= c; a ^= (c >> 3); \ 1890 b -= c; b -= a; b ^= (a << 10); \ 1891 c -= a; c -= b; c ^= (b >> 15); \ 1892 } while (0) 1893 1894/* 1895 * hash function based on bridge_hash in if_bridge.c 1896 */ 1897void 1898pf_hash(struct pf_addr *inaddr, struct pf_addr *hash, 1899 struct pf_poolhashkey *key, sa_family_t af) 1900{ 1901 u_int32_t a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0]; 1902 1903 switch (af) { 1904#ifdef INET 1905 case AF_INET: 1906 a += inaddr->addr32[0]; 1907 b += key->key32[1]; 1908 mix(a, b, c); 1909 hash->addr32[0] = c + key->key32[2]; 1910 break; 1911#endif /* INET */ 1912#ifdef INET6 1913 case AF_INET6: 1914 a += inaddr->addr32[0]; 1915 b += inaddr->addr32[2]; 1916 mix(a, b, c); 1917 hash->addr32[0] = c; 1918 a += inaddr->addr32[1]; 1919 b += inaddr->addr32[3]; 1920 c += key->key32[1]; 1921 mix(a, b, c); 1922 hash->addr32[1] = c; 1923 a += inaddr->addr32[2]; 1924 b += inaddr->addr32[1]; 1925 c += key->key32[2]; 1926 mix(a, b, c); 1927 hash->addr32[2] = c; 1928 a += inaddr->addr32[3]; 1929 b += inaddr->addr32[0]; 1930 c += key->key32[3]; 1931 mix(a, b, c); 1932 hash->addr32[3] = c; 1933 break; 1934#endif /* INET6 */ 1935 } 1936} 1937 1938int 1939pf_map_addr(sa_family_t af, struct pf_rule *r, struct pf_addr *saddr, 1940 struct pf_addr *naddr, struct pf_addr *init_addr, struct pf_src_node **sn) 1941{ 1942 unsigned char hash[16]; 1943 struct pf_pool *rpool = &r->rpool; 1944 struct pf_addr *raddr = &rpool->cur->addr.v.a.addr; 1945 struct pf_addr *rmask = &rpool->cur->addr.v.a.mask; 1946 struct pf_pooladdr *acur = rpool->cur; 1947 struct pf_src_node k; 1948 1949 if (*sn == NULL && r->rpool.opts & PF_POOL_STICKYADDR && 1950 (r->rpool.opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) { 1951 k.af = af; 1952 PF_ACPY(&k.addr, saddr, af); 1953 if (r->rule_flag & PFRULE_RULESRCTRACK || 1954 r->rpool.opts & PF_POOL_STICKYADDR) 1955 k.rule.ptr = r; 1956 else 1957 k.rule.ptr = NULL; 1958 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++; 1959 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k); 1960 if (*sn != NULL && !PF_AZERO(&(*sn)->raddr, af)) { 1961 PF_ACPY(naddr, &(*sn)->raddr, af); 1962 if (pf_status.debug >= PF_DEBUG_MISC) { 1963 printf("pf_map_addr: src tracking maps "); 1964 pf_print_host(&k.addr, 0, af); 1965 printf(" to "); 1966 pf_print_host(naddr, 0, af); 1967 printf("\n"); 1968 } 1969 return (0); 1970 } 1971 } 1972 1973 if (rpool->cur->addr.type == PF_ADDR_NOROUTE) 1974 return (1); 1975 if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { 1976 if (af == AF_INET) { 1977 if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 && 1978 (rpool->opts & PF_POOL_TYPEMASK) != 1979 PF_POOL_ROUNDROBIN) 1980 return (1); 1981 raddr = &rpool->cur->addr.p.dyn->pfid_addr4; 1982 rmask = &rpool->cur->addr.p.dyn->pfid_mask4; 1983 } else { 1984 if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 && 1985 (rpool->opts & PF_POOL_TYPEMASK) != 1986 PF_POOL_ROUNDROBIN) 1987 return (1); 1988 raddr = &rpool->cur->addr.p.dyn->pfid_addr6; 1989 rmask = &rpool->cur->addr.p.dyn->pfid_mask6; 1990 } 1991 } else if (rpool->cur->addr.type == PF_ADDR_TABLE) { 1992 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN) 1993 return (1); /* unsupported */ 1994 } else { 1995 raddr = &rpool->cur->addr.v.a.addr; 1996 rmask = &rpool->cur->addr.v.a.mask; 1997 } 1998 1999 switch (rpool->opts & PF_POOL_TYPEMASK) { 2000 case PF_POOL_NONE: 2001 PF_ACPY(naddr, raddr, af); 2002 break; 2003 case PF_POOL_BITMASK: 2004 PF_POOLMASK(naddr, raddr, rmask, saddr, af); 2005 break; 2006 case PF_POOL_RANDOM: 2007 if (init_addr != NULL && PF_AZERO(init_addr, af)) { 2008 switch (af) { 2009#ifdef INET 2010 case AF_INET: 2011 rpool->counter.addr32[0] = arc4random(); 2012 break; 2013#endif /* INET */ 2014#ifdef INET6 2015 case AF_INET6: 2016 if (rmask->addr32[3] != 0xffffffff) 2017 rpool->counter.addr32[3] = arc4random(); 2018 else 2019 break; 2020 if (rmask->addr32[2] != 0xffffffff) 2021 rpool->counter.addr32[2] = arc4random(); 2022 else 2023 break; 2024 if (rmask->addr32[1] != 0xffffffff) 2025 rpool->counter.addr32[1] = arc4random(); 2026 else 2027 break; 2028 if (rmask->addr32[0] != 0xffffffff) 2029 rpool->counter.addr32[0] = arc4random(); 2030 break; 2031#endif /* INET6 */ 2032 } 2033 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af); 2034 PF_ACPY(init_addr, naddr, af); 2035 2036 } else { 2037 PF_AINC(&rpool->counter, af); 2038 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af); 2039 } 2040 break; 2041 case PF_POOL_SRCHASH: 2042 pf_hash(saddr, (struct pf_addr *)&hash, &rpool->key, af); 2043 PF_POOLMASK(naddr, raddr, rmask, (struct pf_addr *)&hash, af); 2044 break; 2045 case PF_POOL_ROUNDROBIN: 2046 if (rpool->cur->addr.type == PF_ADDR_TABLE) { 2047 if (!pfr_pool_get(rpool->cur->addr.p.tbl, 2048 &rpool->tblidx, &rpool->counter, 2049 &raddr, &rmask, af)) 2050 goto get_addr; 2051 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { 2052 if (!pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt, 2053 &rpool->tblidx, &rpool->counter, 2054 &raddr, &rmask, af)) 2055 goto get_addr; 2056 } else if (pf_match_addr(0, raddr, rmask, &rpool->counter, af)) 2057 goto get_addr; 2058 2059 try_next: 2060 if ((rpool->cur = TAILQ_NEXT(rpool->cur, entries)) == NULL) 2061 rpool->cur = TAILQ_FIRST(&rpool->list); 2062 if (rpool->cur->addr.type == PF_ADDR_TABLE) { 2063 rpool->tblidx = -1; 2064 if (pfr_pool_get(rpool->cur->addr.p.tbl, 2065 &rpool->tblidx, &rpool->counter, 2066 &raddr, &rmask, af)) { 2067 /* table contains no address of type 'af' */ 2068 if (rpool->cur != acur) 2069 goto try_next; 2070 return (1); 2071 } 2072 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { 2073 rpool->tblidx = -1; 2074 if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt, 2075 &rpool->tblidx, &rpool->counter, 2076 &raddr, &rmask, af)) { 2077 /* table contains no address of type 'af' */ 2078 if (rpool->cur != acur) 2079 goto try_next; 2080 return (1); 2081 } 2082 } else { 2083 raddr = &rpool->cur->addr.v.a.addr; 2084 rmask = &rpool->cur->addr.v.a.mask; 2085 PF_ACPY(&rpool->counter, raddr, af); 2086 } 2087 2088 get_addr: 2089 PF_ACPY(naddr, &rpool->counter, af); 2090 PF_AINC(&rpool->counter, af); 2091 break; 2092 } 2093 if (*sn != NULL) 2094 PF_ACPY(&(*sn)->raddr, naddr, af); 2095 2096 if (pf_status.debug >= PF_DEBUG_MISC && 2097 (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) { 2098 printf("pf_map_addr: selected address "); 2099 pf_print_host(naddr, 0, af); 2100 printf("\n"); 2101 } 2102 2103 return (0); 2104} 2105 2106int 2107pf_get_sport(sa_family_t af, u_int8_t proto, struct pf_rule *r, 2108 struct pf_addr *saddr, struct pf_addr *daddr, u_int16_t dport, 2109 struct pf_addr *naddr, u_int16_t *nport, u_int16_t low, u_int16_t high, 2110 struct pf_src_node **sn) 2111{ 2112 struct pf_state key; 2113 struct pf_addr init_addr; 2114 u_int16_t cut; 2115 2116 bzero(&init_addr, sizeof(init_addr)); 2117 if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn)) 2118 return (1); 2119 2120 do { 2121 key.af = af; 2122 key.proto = proto; 2123 PF_ACPY(&key.ext.addr, daddr, key.af); 2124 PF_ACPY(&key.gwy.addr, naddr, key.af); 2125 key.ext.port = dport; 2126 2127 /* 2128 * port search; start random, step; 2129 * similar 2 portloop in in_pcbbind 2130 */ 2131 if (!(proto == IPPROTO_TCP || proto == IPPROTO_UDP)) { 2132 key.gwy.port = 0; 2133 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL) 2134 return (0); 2135 } else if (low == 0 && high == 0) { 2136 key.gwy.port = *nport; 2137 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL) 2138 return (0); 2139 } else if (low == high) { 2140 key.gwy.port = htons(low); 2141 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL) { 2142 *nport = htons(low); 2143 return (0); 2144 } 2145 } else { 2146 u_int16_t tmp; 2147 2148 if (low > high) { 2149 tmp = low; 2150 low = high; 2151 high = tmp; 2152 } 2153 /* low < high */ 2154 cut = arc4random() % (1 + high - low) + low; 2155 /* low <= cut <= high */ 2156 for (tmp = cut; tmp <= high; ++(tmp)) { 2157 key.gwy.port = htons(tmp); 2158 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == 2159 NULL) { 2160 *nport = htons(tmp); 2161 return (0); 2162 } 2163 } 2164 for (tmp = cut - 1; tmp >= low; --(tmp)) { 2165 key.gwy.port = htons(tmp); 2166 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == 2167 NULL) { 2168 *nport = htons(tmp); 2169 return (0); 2170 } 2171 } 2172 } 2173 2174 switch (r->rpool.opts & PF_POOL_TYPEMASK) { 2175 case PF_POOL_RANDOM: 2176 case PF_POOL_ROUNDROBIN: 2177 if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn)) 2178 return (1); 2179 break; 2180 case PF_POOL_NONE: 2181 case PF_POOL_SRCHASH: 2182 case PF_POOL_BITMASK: 2183 default: 2184 return (1); 2185 } 2186 } while (! PF_AEQ(&init_addr, naddr, af) ); 2187 2188 return (1); /* none available */ 2189} 2190 2191struct pf_rule * 2192pf_match_translation(struct pf_pdesc *pd, struct mbuf *m, int off, 2193 int direction, struct pfi_kif *kif, struct pf_addr *saddr, u_int16_t sport, 2194 struct pf_addr *daddr, u_int16_t dport, int rs_num) 2195{ 2196 struct pf_rule *r, *rm = NULL, *anchorrule = NULL; 2197 struct pf_ruleset *ruleset = NULL; 2198 2199 r = TAILQ_FIRST(pf_main_ruleset.rules[rs_num].active.ptr); 2200 while (r && rm == NULL) { 2201 struct pf_rule_addr *src = NULL, *dst = NULL; 2202 struct pf_addr_wrap *xdst = NULL; 2203 2204 if (r->action == PF_BINAT && direction == PF_IN) { 2205 src = &r->dst; 2206 if (r->rpool.cur != NULL) 2207 xdst = &r->rpool.cur->addr; 2208 } else { 2209 src = &r->src; 2210 dst = &r->dst; 2211 } 2212 2213 r->evaluations++; 2214 if (r->kif != NULL && 2215 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 2216 r = r->skip[PF_SKIP_IFP].ptr; 2217 else if (r->direction && r->direction != direction) 2218 r = r->skip[PF_SKIP_DIR].ptr; 2219 else if (r->af && r->af != pd->af) 2220 r = r->skip[PF_SKIP_AF].ptr; 2221 else if (r->proto && r->proto != pd->proto) 2222 r = r->skip[PF_SKIP_PROTO].ptr; 2223 else if (PF_MISMATCHAW(&src->addr, saddr, pd->af, src->not)) 2224 r = r->skip[src == &r->src ? PF_SKIP_SRC_ADDR : 2225 PF_SKIP_DST_ADDR].ptr; 2226 else if (src->port_op && !pf_match_port(src->port_op, 2227 src->port[0], src->port[1], sport)) 2228 r = r->skip[src == &r->src ? PF_SKIP_SRC_PORT : 2229 PF_SKIP_DST_PORT].ptr; 2230 else if (dst != NULL && 2231 PF_MISMATCHAW(&dst->addr, daddr, pd->af, dst->not)) 2232 r = r->skip[PF_SKIP_DST_ADDR].ptr; 2233 else if (xdst != NULL && PF_MISMATCHAW(xdst, daddr, pd->af, 0)) 2234 r = TAILQ_NEXT(r, entries); 2235 else if (dst != NULL && dst->port_op && 2236 !pf_match_port(dst->port_op, dst->port[0], 2237 dst->port[1], dport)) 2238 r = r->skip[PF_SKIP_DST_PORT].ptr; 2239 else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto != 2240 IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, m, 2241 off, pd->hdr.tcp), r->os_fingerprint))) 2242 r = TAILQ_NEXT(r, entries); 2243 else if (r->anchorname[0] && r->anchor == NULL) 2244 r = TAILQ_NEXT(r, entries); 2245 else if (r->anchor == NULL) 2246 rm = r; 2247 else 2248 PF_STEP_INTO_ANCHOR(r, anchorrule, ruleset, rs_num); 2249 if (r == NULL && anchorrule != NULL) 2250 PF_STEP_OUT_OF_ANCHOR(r, anchorrule, ruleset, 2251 rs_num); 2252 } 2253 if (rm != NULL && (rm->action == PF_NONAT || 2254 rm->action == PF_NORDR || rm->action == PF_NOBINAT)) 2255 return (NULL); 2256 return (rm); 2257} 2258 2259struct pf_rule * 2260pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off, int direction, 2261 struct pfi_kif *kif, struct pf_src_node **sn, 2262 struct pf_addr *saddr, u_int16_t sport, 2263 struct pf_addr *daddr, u_int16_t dport, 2264 struct pf_addr *naddr, u_int16_t *nport) 2265{ 2266 struct pf_rule *r = NULL; 2267 2268 if (direction == PF_OUT) { 2269 r = pf_match_translation(pd, m, off, direction, kif, saddr, 2270 sport, daddr, dport, PF_RULESET_BINAT); 2271 if (r == NULL) 2272 r = pf_match_translation(pd, m, off, direction, kif, 2273 saddr, sport, daddr, dport, PF_RULESET_NAT); 2274 } else { 2275 r = pf_match_translation(pd, m, off, direction, kif, saddr, 2276 sport, daddr, dport, PF_RULESET_RDR); 2277 if (r == NULL) 2278 r = pf_match_translation(pd, m, off, direction, kif, 2279 saddr, sport, daddr, dport, PF_RULESET_BINAT); 2280 } 2281 2282 if (r != NULL) { 2283 switch (r->action) { 2284 case PF_NONAT: 2285 case PF_NOBINAT: 2286 case PF_NORDR: 2287 return (NULL); 2288 case PF_NAT: 2289 if (pf_get_sport(pd->af, pd->proto, r, saddr, 2290 daddr, dport, naddr, nport, r->rpool.proxy_port[0], 2291 r->rpool.proxy_port[1], sn)) { 2292 DPFPRINTF(PF_DEBUG_MISC, 2293 ("pf: NAT proxy port allocation " 2294 "(%u-%u) failed\n", 2295 r->rpool.proxy_port[0], 2296 r->rpool.proxy_port[1])); 2297 return (NULL); 2298 } 2299 break; 2300 case PF_BINAT: 2301 switch (direction) { 2302 case PF_OUT: 2303 if (r->rpool.cur->addr.type == PF_ADDR_DYNIFTL){ 2304 if (pd->af == AF_INET) { 2305 if (r->rpool.cur->addr.p.dyn-> 2306 pfid_acnt4 < 1) 2307 return (NULL); 2308 PF_POOLMASK(naddr, 2309 &r->rpool.cur->addr.p.dyn-> 2310 pfid_addr4, 2311 &r->rpool.cur->addr.p.dyn-> 2312 pfid_mask4, 2313 saddr, AF_INET); 2314 } else { 2315 if (r->rpool.cur->addr.p.dyn-> 2316 pfid_acnt6 < 1) 2317 return (NULL); 2318 PF_POOLMASK(naddr, 2319 &r->rpool.cur->addr.p.dyn-> 2320 pfid_addr6, 2321 &r->rpool.cur->addr.p.dyn-> 2322 pfid_mask6, 2323 saddr, AF_INET6); 2324 } 2325 } else 2326 PF_POOLMASK(naddr, 2327 &r->rpool.cur->addr.v.a.addr, 2328 &r->rpool.cur->addr.v.a.mask, 2329 saddr, pd->af); 2330 break; 2331 case PF_IN: 2332 if (r->src.addr.type == PF_ADDR_DYNIFTL) { 2333 if (pd->af == AF_INET) { 2334 if (r->src.addr.p.dyn-> 2335 pfid_acnt4 < 1) 2336 return (NULL); 2337 PF_POOLMASK(naddr, 2338 &r->src.addr.p.dyn-> 2339 pfid_addr4, 2340 &r->src.addr.p.dyn-> 2341 pfid_mask4, 2342 daddr, AF_INET); 2343 } else { 2344 if (r->src.addr.p.dyn-> 2345 pfid_acnt6 < 1) 2346 return (NULL); 2347 PF_POOLMASK(naddr, 2348 &r->src.addr.p.dyn-> 2349 pfid_addr6, 2350 &r->src.addr.p.dyn-> 2351 pfid_mask6, 2352 daddr, AF_INET6); 2353 } 2354 } else 2355 PF_POOLMASK(naddr, 2356 &r->src.addr.v.a.addr, 2357 &r->src.addr.v.a.mask, daddr, 2358 pd->af); 2359 break; 2360 } 2361 break; 2362 case PF_RDR: { 2363 if (pf_map_addr(r->af, r, saddr, naddr, NULL, sn)) 2364 return (NULL); 2365 2366 if (r->rpool.proxy_port[1]) { 2367 u_int32_t tmp_nport; 2368 2369 tmp_nport = ((ntohs(dport) - 2370 ntohs(r->dst.port[0])) % 2371 (r->rpool.proxy_port[1] - 2372 r->rpool.proxy_port[0] + 1)) + 2373 r->rpool.proxy_port[0]; 2374 2375 /* wrap around if necessary */ 2376 if (tmp_nport > 65535) 2377 tmp_nport -= 65535; 2378 *nport = htons((u_int16_t)tmp_nport); 2379 } else if (r->rpool.proxy_port[0]) 2380 *nport = htons(r->rpool.proxy_port[0]); 2381 break; 2382 } 2383 default: 2384 return (NULL); 2385 } 2386 } 2387 2388 return (r); 2389} 2390 2391int 2392#ifdef __FreeBSD__ 2393pf_socket_lookup(uid_t *uid, gid_t *gid, int direction, struct pf_pdesc *pd, 2394 struct inpcb *inp_arg) 2395#else 2396pf_socket_lookup(uid_t *uid, gid_t *gid, int direction, struct pf_pdesc *pd) 2397#endif 2398{ 2399 struct pf_addr *saddr, *daddr; 2400 u_int16_t sport, dport; 2401#ifdef __FreeBSD__ 2402 struct inpcbinfo *pi; 2403#else 2404 struct inpcbtable *tb; 2405#endif 2406 struct inpcb *inp; 2407 2408 *uid = UID_MAX; 2409 *gid = GID_MAX; 2410#ifdef __FreeBSD__ 2411 if (inp_arg != NULL) { 2412 INP_LOCK_ASSERT(inp_arg); 2413 if (inp_arg->inp_socket) { 2414 *uid = inp_arg->inp_socket->so_cred->cr_uid; 2415 *gid = inp_arg->inp_socket->so_cred->cr_groups[0]; 2416 return (1); 2417 } else 2418 return (0); 2419 } 2420#endif 2421 switch (pd->proto) { 2422 case IPPROTO_TCP: 2423 sport = pd->hdr.tcp->th_sport; 2424 dport = pd->hdr.tcp->th_dport; 2425#ifdef __FreeBSD__ 2426 pi = &tcbinfo; 2427#else 2428 tb = &tcbtable; 2429#endif 2430 break; 2431 case IPPROTO_UDP: 2432 sport = pd->hdr.udp->uh_sport; 2433 dport = pd->hdr.udp->uh_dport; 2434#ifdef __FreeBSD__ 2435 pi = &udbinfo; 2436#else 2437 tb = &udbtable; 2438#endif 2439 break; 2440 default: 2441 return (0); 2442 } 2443 if (direction == PF_IN) { 2444 saddr = pd->src; 2445 daddr = pd->dst; 2446 } else { 2447 u_int16_t p; 2448 2449 p = sport; 2450 sport = dport; 2451 dport = p; 2452 saddr = pd->dst; 2453 daddr = pd->src; 2454 } 2455 switch (pd->af) { 2456 case AF_INET: 2457#ifdef __FreeBSD__ 2458 INP_INFO_RLOCK(pi); /* XXX LOR */ 2459 inp = in_pcblookup_hash(pi, saddr->v4, sport, daddr->v4, 2460 dport, 0, NULL); 2461 if (inp == NULL) { 2462 inp = in_pcblookup_hash(pi, saddr->v4, sport, 2463 daddr->v4, dport, INPLOOKUP_WILDCARD, NULL); 2464 if(inp == NULL) { 2465 INP_INFO_RUNLOCK(pi); 2466 return (0); 2467 } 2468 } 2469#else 2470 inp = in_pcbhashlookup(tb, saddr->v4, sport, daddr->v4, dport); 2471 if (inp == NULL) { 2472 inp = in_pcblookup_listen(tb, daddr->v4, dport, 0); 2473 if (inp == NULL) 2474 return (0); 2475 } 2476#endif 2477 break; 2478#ifdef INET6 2479 case AF_INET6: 2480#ifdef __FreeBSD__ 2481 INP_INFO_RLOCK(pi); 2482 inp = in6_pcblookup_hash(pi, &saddr->v6, sport, 2483 &daddr->v6, dport, 0, NULL); 2484 if (inp == NULL) { 2485 inp = in6_pcblookup_hash(pi, &saddr->v6, sport, 2486 &daddr->v6, dport, INPLOOKUP_WILDCARD, NULL); 2487 if (inp == NULL) { 2488 INP_INFO_RUNLOCK(pi); 2489 return (0); 2490 } 2491 } 2492#else 2493 inp = in6_pcbhashlookup(tb, &saddr->v6, sport, &daddr->v6, 2494 dport); 2495 if (inp == NULL) { 2496 inp = in6_pcblookup_listen(tb, &daddr->v6, dport, 0); 2497 if (inp == NULL) 2498 return (0); 2499 } 2500#endif 2501 break; 2502#endif /* INET6 */ 2503 2504 default: 2505 return (0); 2506 } 2507#ifdef __FreeBSD__ 2508 INP_LOCK(inp); 2509 if ((inp->inp_socket == NULL) || (inp->inp_socket->so_cred == NULL)) { 2510 INP_UNLOCK(inp); 2511 INP_INFO_RUNLOCK(pi); 2512 return (0); 2513 } 2514 *uid = inp->inp_socket->so_cred->cr_uid; 2515 *gid = inp->inp_socket->so_cred->cr_groups[0]; 2516 INP_UNLOCK(inp); 2517 INP_INFO_RUNLOCK(pi); 2518#else 2519 *uid = inp->inp_socket->so_euid; 2520 *gid = inp->inp_socket->so_egid; 2521#endif 2522 return (1); 2523} 2524 2525u_int8_t 2526pf_get_wscale(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af) 2527{ 2528 int hlen; 2529 u_int8_t hdr[60]; 2530 u_int8_t *opt, optlen; 2531 u_int8_t wscale = 0; 2532 2533 hlen = th_off << 2; /* hlen <= sizeof(hdr) */ 2534 if (hlen <= sizeof(struct tcphdr)) 2535 return (0); 2536 if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af)) 2537 return (0); 2538 opt = hdr + sizeof(struct tcphdr); 2539 hlen -= sizeof(struct tcphdr); 2540 while (hlen >= 3) { 2541 switch (*opt) { 2542 case TCPOPT_EOL: 2543 case TCPOPT_NOP: 2544 ++opt; 2545 --hlen; 2546 break; 2547 case TCPOPT_WINDOW: 2548 wscale = opt[2]; 2549 if (wscale > TCP_MAX_WINSHIFT) 2550 wscale = TCP_MAX_WINSHIFT; 2551 wscale |= PF_WSCALE_FLAG; 2552 /* FALLTHROUGH */ 2553 default: 2554 optlen = opt[1]; 2555 if (optlen < 2) 2556 optlen = 2; 2557 hlen -= optlen; 2558 opt += optlen; 2559 break; 2560 } 2561 } 2562 return (wscale); 2563} 2564 2565u_int16_t 2566pf_get_mss(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af) 2567{ 2568 int hlen; 2569 u_int8_t hdr[60]; 2570 u_int8_t *opt, optlen; 2571 u_int16_t mss = tcp_mssdflt; 2572 2573 hlen = th_off << 2; /* hlen <= sizeof(hdr) */ 2574 if (hlen <= sizeof(struct tcphdr)) 2575 return (0); 2576 if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af)) 2577 return (0); 2578 opt = hdr + sizeof(struct tcphdr); 2579 hlen -= sizeof(struct tcphdr); 2580 while (hlen >= TCPOLEN_MAXSEG) { 2581 switch (*opt) { 2582 case TCPOPT_EOL: 2583 case TCPOPT_NOP: 2584 ++opt; 2585 --hlen; 2586 break; 2587 case TCPOPT_MAXSEG: 2588 bcopy((caddr_t)(opt + 2), (caddr_t)&mss, 2); 2589 /* FALLTHROUGH */ 2590 default: 2591 optlen = opt[1]; 2592 if (optlen < 2) 2593 optlen = 2; 2594 hlen -= optlen; 2595 opt += optlen; 2596 break; 2597 } 2598 } 2599 return (mss); 2600} 2601 2602u_int16_t 2603pf_calc_mss(struct pf_addr *addr, sa_family_t af, u_int16_t offer) 2604{ 2605#ifdef INET 2606 struct sockaddr_in *dst; 2607 struct route ro; 2608#endif /* INET */ 2609#ifdef INET6 2610 struct sockaddr_in6 *dst6; 2611 struct route_in6 ro6; 2612#endif /* INET6 */ 2613 struct rtentry *rt = NULL; 2614 int hlen = 0; /* make the compiler happy */ 2615 u_int16_t mss = tcp_mssdflt; 2616 2617 switch (af) { 2618#ifdef INET 2619 case AF_INET: 2620 hlen = sizeof(struct ip); 2621 bzero(&ro, sizeof(ro)); 2622 dst = (struct sockaddr_in *)&ro.ro_dst; 2623 dst->sin_family = AF_INET; 2624 dst->sin_len = sizeof(*dst); 2625 dst->sin_addr = addr->v4; 2626#ifdef __FreeBSD__ 2627#ifdef RTF_PRCLONING 2628 rtalloc_ign(&ro, (RTF_CLONING | RTF_PRCLONING)); 2629#else /* !RTF_PRCLONING */ 2630 rtalloc_ign(&ro, RTF_CLONING); 2631#endif 2632#else /* ! __FreeBSD__ */ 2633 rtalloc_noclone(&ro, NO_CLONING); 2634#endif 2635 rt = ro.ro_rt; 2636 break; 2637#endif /* INET */ 2638#ifdef INET6 2639 case AF_INET6: 2640 hlen = sizeof(struct ip6_hdr); 2641 bzero(&ro6, sizeof(ro6)); 2642 dst6 = (struct sockaddr_in6 *)&ro6.ro_dst; 2643 dst6->sin6_family = AF_INET6; 2644 dst6->sin6_len = sizeof(*dst6); 2645 dst6->sin6_addr = addr->v6; 2646#ifdef __FreeBSD__ 2647#ifdef RTF_PRCLONING 2648 rtalloc_ign((struct route *)&ro6, 2649 (RTF_CLONING | RTF_PRCLONING)); 2650#else /* !RTF_PRCLONING */ 2651 rtalloc_ign((struct route *)&ro6, RTF_CLONING); 2652#endif 2653#else /* ! __FreeBSD__ */ 2654 rtalloc_noclone((struct route *)&ro6, NO_CLONING); 2655#endif 2656 rt = ro6.ro_rt; 2657 break; 2658#endif /* INET6 */ 2659 } 2660 2661 if (rt && rt->rt_ifp) { 2662 mss = rt->rt_ifp->if_mtu - hlen - sizeof(struct tcphdr); 2663 mss = max(tcp_mssdflt, mss); 2664 RTFREE(rt); 2665 } 2666 mss = min(mss, offer); 2667 mss = max(mss, 64); /* sanity - at least max opt space */ 2668 return (mss); 2669} 2670 2671void 2672pf_set_rt_ifp(struct pf_state *s, struct pf_addr *saddr) 2673{ 2674 struct pf_rule *r = s->rule.ptr; 2675 2676 s->rt_kif = NULL; 2677 if (!r->rt || r->rt == PF_FASTROUTE) 2678 return; 2679 switch (s->af) { 2680#ifdef INET 2681 case AF_INET: 2682 pf_map_addr(AF_INET, r, saddr, &s->rt_addr, NULL, 2683 &s->nat_src_node); 2684 s->rt_kif = r->rpool.cur->kif; 2685 break; 2686#endif /* INET */ 2687#ifdef INET6 2688 case AF_INET6: 2689 pf_map_addr(AF_INET6, r, saddr, &s->rt_addr, NULL, 2690 &s->nat_src_node); 2691 s->rt_kif = r->rpool.cur->kif; 2692 break; 2693#endif /* INET6 */ 2694 } 2695} 2696 2697int 2698pf_test_tcp(struct pf_rule **rm, struct pf_state **sm, int direction, 2699 struct pfi_kif *kif, struct mbuf *m, int off, void *h, 2700#ifdef __FreeBSD__ 2701 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm, 2702 struct inpcb *inp) 2703#else 2704 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm) 2705#endif 2706{ 2707 struct pf_rule *nr = NULL; 2708 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 2709 struct tcphdr *th = pd->hdr.tcp; 2710 u_int16_t bport, nport = 0; 2711 sa_family_t af = pd->af; 2712 int lookup = -1; 2713 uid_t uid; 2714 gid_t gid; 2715 struct pf_rule *r, *a = NULL; 2716 struct pf_ruleset *ruleset = NULL; 2717 struct pf_src_node *nsn = NULL; 2718 u_short reason; 2719 int rewrite = 0; 2720 struct pf_tag *pftag = NULL; 2721 int tag = -1; 2722 u_int16_t mss = tcp_mssdflt; 2723 2724 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 2725 2726 if (direction == PF_OUT) { 2727 bport = nport = th->th_sport; 2728 /* check outgoing packet for BINAT/NAT */ 2729 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn, 2730 saddr, th->th_sport, daddr, th->th_dport, 2731 &pd->naddr, &nport)) != NULL) { 2732 PF_ACPY(&pd->baddr, saddr, af); 2733 pf_change_ap(saddr, &th->th_sport, pd->ip_sum, 2734 &th->th_sum, &pd->naddr, nport, 0, af); 2735 rewrite++; 2736 if (nr->natpass) 2737 r = NULL; 2738 pd->nat_rule = nr; 2739 } 2740 } else { 2741 bport = nport = th->th_dport; 2742 /* check incoming packet for BINAT/RDR */ 2743 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn, 2744 saddr, th->th_sport, daddr, th->th_dport, 2745 &pd->naddr, &nport)) != NULL) { 2746 PF_ACPY(&pd->baddr, daddr, af); 2747 pf_change_ap(daddr, &th->th_dport, pd->ip_sum, 2748 &th->th_sum, &pd->naddr, nport, 0, af); 2749 rewrite++; 2750 if (nr->natpass) 2751 r = NULL; 2752 pd->nat_rule = nr; 2753 } 2754 } 2755 2756 while (r != NULL) { 2757 r->evaluations++; 2758 if (r->kif != NULL && 2759 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 2760 r = r->skip[PF_SKIP_IFP].ptr; 2761 else if (r->direction && r->direction != direction) 2762 r = r->skip[PF_SKIP_DIR].ptr; 2763 else if (r->af && r->af != af) 2764 r = r->skip[PF_SKIP_AF].ptr; 2765 else if (r->proto && r->proto != IPPROTO_TCP) 2766 r = r->skip[PF_SKIP_PROTO].ptr; 2767 else if (PF_MISMATCHAW(&r->src.addr, saddr, af, r->src.not)) 2768 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 2769 else if (r->src.port_op && !pf_match_port(r->src.port_op, 2770 r->src.port[0], r->src.port[1], th->th_sport)) 2771 r = r->skip[PF_SKIP_SRC_PORT].ptr; 2772 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af, r->dst.not)) 2773 r = r->skip[PF_SKIP_DST_ADDR].ptr; 2774 else if (r->dst.port_op && !pf_match_port(r->dst.port_op, 2775 r->dst.port[0], r->dst.port[1], th->th_dport)) 2776 r = r->skip[PF_SKIP_DST_PORT].ptr; 2777 else if (r->tos && !(r->tos & pd->tos)) 2778 r = TAILQ_NEXT(r, entries); 2779 else if (r->rule_flag & PFRULE_FRAGMENT) 2780 r = TAILQ_NEXT(r, entries); 2781 else if ((r->flagset & th->th_flags) != r->flags) 2782 r = TAILQ_NEXT(r, entries); 2783 else if (r->uid.op && (lookup != -1 || (lookup = 2784#ifdef __FreeBSD__ 2785 pf_socket_lookup(&uid, &gid, direction, pd, inp), 1)) && 2786#else 2787 pf_socket_lookup(&uid, &gid, direction, pd), 1)) && 2788#endif 2789 !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1], 2790 uid)) 2791 r = TAILQ_NEXT(r, entries); 2792 else if (r->gid.op && (lookup != -1 || (lookup = 2793#ifdef __FreeBSD__ 2794 pf_socket_lookup(&uid, &gid, direction, pd, inp), 1)) && 2795#else 2796 pf_socket_lookup(&uid, &gid, direction, pd), 1)) && 2797#endif 2798 !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1], 2799 gid)) 2800 r = TAILQ_NEXT(r, entries); 2801 else if (r->match_tag && !pf_match_tag(m, r, nr, pftag, &tag)) 2802 r = TAILQ_NEXT(r, entries); 2803 else if (r->anchorname[0] && r->anchor == NULL) 2804 r = TAILQ_NEXT(r, entries); 2805 else if (r->os_fingerprint != PF_OSFP_ANY && !pf_osfp_match( 2806 pf_osfp_fingerprint(pd, m, off, th), r->os_fingerprint)) 2807 r = TAILQ_NEXT(r, entries); 2808 else { 2809 if (r->tag) 2810 tag = r->tag; 2811 if (r->anchor == NULL) { 2812 *rm = r; 2813 *am = a; 2814 *rsm = ruleset; 2815 if ((*rm)->quick) 2816 break; 2817 r = TAILQ_NEXT(r, entries); 2818 } else 2819 PF_STEP_INTO_ANCHOR(r, a, ruleset, 2820 PF_RULESET_FILTER); 2821 } 2822 if (r == NULL && a != NULL) 2823 PF_STEP_OUT_OF_ANCHOR(r, a, ruleset, 2824 PF_RULESET_FILTER); 2825 } 2826 r = *rm; 2827 a = *am; 2828 ruleset = *rsm; 2829 2830 REASON_SET(&reason, PFRES_MATCH); 2831 2832 if (r->log) { 2833 if (rewrite) 2834 m_copyback(m, off, sizeof(*th), (caddr_t)th); 2835 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset); 2836 } 2837 2838 if ((r->action == PF_DROP) && 2839 ((r->rule_flag & PFRULE_RETURNRST) || 2840 (r->rule_flag & PFRULE_RETURNICMP) || 2841 (r->rule_flag & PFRULE_RETURN))) { 2842 /* undo NAT changes, if they have taken place */ 2843 if (nr != NULL) { 2844 if (direction == PF_OUT) { 2845 pf_change_ap(saddr, &th->th_sport, pd->ip_sum, 2846 &th->th_sum, &pd->baddr, bport, 0, af); 2847 rewrite++; 2848 } else { 2849 pf_change_ap(daddr, &th->th_dport, pd->ip_sum, 2850 &th->th_sum, &pd->baddr, bport, 0, af); 2851 rewrite++; 2852 } 2853 } 2854 if (((r->rule_flag & PFRULE_RETURNRST) || 2855 (r->rule_flag & PFRULE_RETURN)) && 2856 !(th->th_flags & TH_RST)) { 2857 u_int32_t ack = ntohl(th->th_seq) + pd->p_len; 2858 2859 if (th->th_flags & TH_SYN) 2860 ack++; 2861 if (th->th_flags & TH_FIN) 2862 ack++; 2863 pf_send_tcp(r, af, pd->dst, 2864 pd->src, th->th_dport, th->th_sport, 2865 ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0, 2866 r->return_ttl); 2867 } else if ((af == AF_INET) && r->return_icmp) 2868 pf_send_icmp(m, r->return_icmp >> 8, 2869 r->return_icmp & 255, af, r); 2870 else if ((af == AF_INET6) && r->return_icmp6) 2871 pf_send_icmp(m, r->return_icmp6 >> 8, 2872 r->return_icmp6 & 255, af, r); 2873 } 2874 2875 if (r->action == PF_DROP) 2876 return (PF_DROP); 2877 2878 if (pf_tag_packet(m, pftag, tag)) { 2879 REASON_SET(&reason, PFRES_MEMORY); 2880 return (PF_DROP); 2881 } 2882 2883 if (r->keep_state || nr != NULL || 2884 (pd->flags & PFDESC_TCP_NORM)) { 2885 /* create new state */ 2886 u_int16_t len; 2887 struct pf_state *s = NULL; 2888 struct pf_src_node *sn = NULL; 2889 2890 len = pd->tot_len - off - (th->th_off << 2); 2891 2892 /* check maximums */ 2893 if (r->max_states && (r->states >= r->max_states)) 2894 goto cleanup; 2895 /* src node for flter rule */ 2896 if ((r->rule_flag & PFRULE_SRCTRACK || 2897 r->rpool.opts & PF_POOL_STICKYADDR) && 2898 pf_insert_src_node(&sn, r, saddr, af) != 0) 2899 goto cleanup; 2900 /* src node for translation rule */ 2901 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) && 2902 ((direction == PF_OUT && 2903 pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) || 2904 (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) 2905 goto cleanup; 2906 s = pool_get(&pf_state_pl, PR_NOWAIT); 2907 if (s == NULL) { 2908cleanup: 2909 if (sn != NULL && sn->states == 0 && sn->expire == 0) { 2910 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn); 2911 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 2912 pf_status.src_nodes--; 2913 pool_put(&pf_src_tree_pl, sn); 2914 } 2915 if (nsn != sn && nsn != NULL && nsn->states == 0 && 2916 nsn->expire == 0) { 2917 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn); 2918 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 2919 pf_status.src_nodes--; 2920 pool_put(&pf_src_tree_pl, nsn); 2921 } 2922 REASON_SET(&reason, PFRES_MEMORY); 2923 return (PF_DROP); 2924 } 2925 bzero(s, sizeof(*s)); 2926 r->states++; 2927 if (a != NULL) 2928 a->states++; 2929 s->rule.ptr = r; 2930 s->nat_rule.ptr = nr; 2931 if (s->nat_rule.ptr != NULL) 2932 s->nat_rule.ptr->states++; 2933 s->anchor.ptr = a; 2934 s->allow_opts = r->allow_opts; 2935 s->log = r->log & 2; 2936 s->proto = IPPROTO_TCP; 2937 s->direction = direction; 2938 s->af = af; 2939 if (direction == PF_OUT) { 2940 PF_ACPY(&s->gwy.addr, saddr, af); 2941 s->gwy.port = th->th_sport; /* sport */ 2942 PF_ACPY(&s->ext.addr, daddr, af); 2943 s->ext.port = th->th_dport; 2944 if (nr != NULL) { 2945 PF_ACPY(&s->lan.addr, &pd->baddr, af); 2946 s->lan.port = bport; 2947 } else { 2948 PF_ACPY(&s->lan.addr, &s->gwy.addr, af); 2949 s->lan.port = s->gwy.port; 2950 } 2951 } else { 2952 PF_ACPY(&s->lan.addr, daddr, af); 2953 s->lan.port = th->th_dport; 2954 PF_ACPY(&s->ext.addr, saddr, af); 2955 s->ext.port = th->th_sport; 2956 if (nr != NULL) { 2957 PF_ACPY(&s->gwy.addr, &pd->baddr, af); 2958 s->gwy.port = bport; 2959 } else { 2960 PF_ACPY(&s->gwy.addr, &s->lan.addr, af); 2961 s->gwy.port = s->lan.port; 2962 } 2963 } 2964 2965 s->src.seqlo = ntohl(th->th_seq); 2966 s->src.seqhi = s->src.seqlo + len + 1; 2967 if ((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN && 2968 r->keep_state == PF_STATE_MODULATE) { 2969 /* Generate sequence number modulator */ 2970 while ((s->src.seqdiff = arc4random()) == 0) 2971 ; 2972 pf_change_a(&th->th_seq, &th->th_sum, 2973 htonl(s->src.seqlo + s->src.seqdiff), 0); 2974 rewrite = 1; 2975 } else 2976 s->src.seqdiff = 0; 2977 if (th->th_flags & TH_SYN) { 2978 s->src.seqhi++; 2979 s->src.wscale = pf_get_wscale(m, off, th->th_off, af); 2980 } 2981 s->src.max_win = MAX(ntohs(th->th_win), 1); 2982 if (s->src.wscale & PF_WSCALE_MASK) { 2983 /* Remove scale factor from initial window */ 2984 int win = s->src.max_win; 2985 win += 1 << (s->src.wscale & PF_WSCALE_MASK); 2986 s->src.max_win = (win - 1) >> 2987 (s->src.wscale & PF_WSCALE_MASK); 2988 } 2989 if (th->th_flags & TH_FIN) 2990 s->src.seqhi++; 2991 s->dst.seqhi = 1; 2992 s->dst.max_win = 1; 2993 s->src.state = TCPS_SYN_SENT; 2994 s->dst.state = TCPS_CLOSED; 2995#ifdef __FreeBSD__ 2996 s->creation = time_second; 2997 s->expire = time_second; 2998#else 2999 s->creation = time.tv_sec; 3000 s->expire = time.tv_sec; 3001#endif 3002 s->timeout = PFTM_TCP_FIRST_PACKET; 3003 pf_set_rt_ifp(s, saddr); 3004 if (sn != NULL) { 3005 s->src_node = sn; 3006 s->src_node->states++; 3007 } 3008 if (nsn != NULL) { 3009 PF_ACPY(&nsn->raddr, &pd->naddr, af); 3010 s->nat_src_node = nsn; 3011 s->nat_src_node->states++; 3012 } 3013 if ((pd->flags & PFDESC_TCP_NORM) && pf_normalize_tcp_init(m, 3014 off, pd, th, &s->src, &s->dst)) { 3015 REASON_SET(&reason, PFRES_MEMORY); 3016 pf_src_tree_remove_state(s); 3017 pool_put(&pf_state_pl, s); 3018 return (PF_DROP); 3019 } 3020 if ((pd->flags & PFDESC_TCP_NORM) && s->src.scrub && 3021 pf_normalize_tcp_stateful(m, off, pd, &reason, th, &s->src, 3022 &s->dst, &rewrite)) { 3023 pf_normalize_tcp_cleanup(s); 3024 pf_src_tree_remove_state(s); 3025 pool_put(&pf_state_pl, s); 3026 return (PF_DROP); 3027 } 3028 if (pf_insert_state(BOUND_IFACE(r, kif), s)) { 3029 pf_normalize_tcp_cleanup(s); 3030 REASON_SET(&reason, PFRES_MEMORY); 3031 pf_src_tree_remove_state(s); 3032 pool_put(&pf_state_pl, s); 3033 return (PF_DROP); 3034 } else 3035 *sm = s; 3036 if ((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN && 3037 r->keep_state == PF_STATE_SYNPROXY) { 3038 s->src.state = PF_TCPS_PROXY_SRC; 3039 if (nr != NULL) { 3040 if (direction == PF_OUT) { 3041 pf_change_ap(saddr, &th->th_sport, 3042 pd->ip_sum, &th->th_sum, &pd->baddr, 3043 bport, 0, af); 3044 } else { 3045 pf_change_ap(daddr, &th->th_dport, 3046 pd->ip_sum, &th->th_sum, &pd->baddr, 3047 bport, 0, af); 3048 } 3049 } 3050 s->src.seqhi = arc4random(); 3051 /* Find mss option */ 3052 mss = pf_get_mss(m, off, th->th_off, af); 3053 mss = pf_calc_mss(saddr, af, mss); 3054 mss = pf_calc_mss(daddr, af, mss); 3055 s->src.mss = mss; 3056 pf_send_tcp(r, af, daddr, saddr, th->th_dport, 3057 th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1, 3058 TH_SYN|TH_ACK, 0, s->src.mss, 0); 3059 return (PF_SYNPROXY_DROP); 3060 } 3061 } 3062 3063 /* copy back packet headers if we performed NAT operations */ 3064 if (rewrite) 3065 m_copyback(m, off, sizeof(*th), (caddr_t)th); 3066 3067 return (PF_PASS); 3068} 3069 3070int 3071pf_test_udp(struct pf_rule **rm, struct pf_state **sm, int direction, 3072 struct pfi_kif *kif, struct mbuf *m, int off, void *h, 3073#ifdef __FreeBSD__ 3074 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm, 3075 struct inpcb *inp) 3076#else 3077 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm) 3078#endif 3079{ 3080 struct pf_rule *nr = NULL; 3081 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 3082 struct udphdr *uh = pd->hdr.udp; 3083 u_int16_t bport, nport = 0; 3084 sa_family_t af = pd->af; 3085 int lookup = -1; 3086 uid_t uid; 3087 gid_t gid; 3088 struct pf_rule *r, *a = NULL; 3089 struct pf_ruleset *ruleset = NULL; 3090 struct pf_src_node *nsn = NULL; 3091 u_short reason; 3092 int rewrite = 0; 3093 struct pf_tag *pftag = NULL; 3094 int tag = -1; 3095 3096 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 3097 3098 if (direction == PF_OUT) { 3099 bport = nport = uh->uh_sport; 3100 /* check outgoing packet for BINAT/NAT */ 3101 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn, 3102 saddr, uh->uh_sport, daddr, uh->uh_dport, 3103 &pd->naddr, &nport)) != NULL) { 3104 PF_ACPY(&pd->baddr, saddr, af); 3105 pf_change_ap(saddr, &uh->uh_sport, pd->ip_sum, 3106 &uh->uh_sum, &pd->naddr, nport, 1, af); 3107 rewrite++; 3108 if (nr->natpass) 3109 r = NULL; 3110 pd->nat_rule = nr; 3111 } 3112 } else { 3113 bport = nport = uh->uh_dport; 3114 /* check incoming packet for BINAT/RDR */ 3115 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn, 3116 saddr, uh->uh_sport, daddr, uh->uh_dport, &pd->naddr, 3117 &nport)) != NULL) { 3118 PF_ACPY(&pd->baddr, daddr, af); 3119 pf_change_ap(daddr, &uh->uh_dport, pd->ip_sum, 3120 &uh->uh_sum, &pd->naddr, nport, 1, af); 3121 rewrite++; 3122 if (nr->natpass) 3123 r = NULL; 3124 pd->nat_rule = nr; 3125 } 3126 } 3127 3128 while (r != NULL) { 3129 r->evaluations++; 3130 if (r->kif != NULL && 3131 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 3132 r = r->skip[PF_SKIP_IFP].ptr; 3133 else if (r->direction && r->direction != direction) 3134 r = r->skip[PF_SKIP_DIR].ptr; 3135 else if (r->af && r->af != af) 3136 r = r->skip[PF_SKIP_AF].ptr; 3137 else if (r->proto && r->proto != IPPROTO_UDP) 3138 r = r->skip[PF_SKIP_PROTO].ptr; 3139 else if (PF_MISMATCHAW(&r->src.addr, saddr, af, r->src.not)) 3140 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 3141 else if (r->src.port_op && !pf_match_port(r->src.port_op, 3142 r->src.port[0], r->src.port[1], uh->uh_sport)) 3143 r = r->skip[PF_SKIP_SRC_PORT].ptr; 3144 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af, r->dst.not)) 3145 r = r->skip[PF_SKIP_DST_ADDR].ptr; 3146 else if (r->dst.port_op && !pf_match_port(r->dst.port_op, 3147 r->dst.port[0], r->dst.port[1], uh->uh_dport)) 3148 r = r->skip[PF_SKIP_DST_PORT].ptr; 3149 else if (r->tos && !(r->tos & pd->tos)) 3150 r = TAILQ_NEXT(r, entries); 3151 else if (r->rule_flag & PFRULE_FRAGMENT) 3152 r = TAILQ_NEXT(r, entries); 3153 else if (r->uid.op && (lookup != -1 || (lookup = 3154#ifdef __FreeBSD__ 3155 pf_socket_lookup(&uid, &gid, direction, pd, inp), 1)) && 3156#else 3157 pf_socket_lookup(&uid, &gid, direction, pd), 1)) && 3158#endif 3159 !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1], 3160 uid)) 3161 r = TAILQ_NEXT(r, entries); 3162 else if (r->gid.op && (lookup != -1 || (lookup = 3163#ifdef __FreeBSD__ 3164 pf_socket_lookup(&uid, &gid, direction, pd, inp), 1)) && 3165#else 3166 pf_socket_lookup(&uid, &gid, direction, pd), 1)) && 3167#endif 3168 !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1], 3169 gid)) 3170 r = TAILQ_NEXT(r, entries); 3171 else if (r->match_tag && !pf_match_tag(m, r, nr, pftag, &tag)) 3172 r = TAILQ_NEXT(r, entries); 3173 else if (r->anchorname[0] && r->anchor == NULL) 3174 r = TAILQ_NEXT(r, entries); 3175 else if (r->os_fingerprint != PF_OSFP_ANY) 3176 r = TAILQ_NEXT(r, entries); 3177 else { 3178 if (r->tag) 3179 tag = r->tag; 3180 if (r->anchor == NULL) { 3181 *rm = r; 3182 *am = a; 3183 *rsm = ruleset; 3184 if ((*rm)->quick) 3185 break; 3186 r = TAILQ_NEXT(r, entries); 3187 } else 3188 PF_STEP_INTO_ANCHOR(r, a, ruleset, 3189 PF_RULESET_FILTER); 3190 } 3191 if (r == NULL && a != NULL) 3192 PF_STEP_OUT_OF_ANCHOR(r, a, ruleset, 3193 PF_RULESET_FILTER); 3194 } 3195 r = *rm; 3196 a = *am; 3197 ruleset = *rsm; 3198 3199 REASON_SET(&reason, PFRES_MATCH); 3200 3201 if (r->log) { 3202 if (rewrite) 3203 m_copyback(m, off, sizeof(*uh), (caddr_t)uh); 3204 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset); 3205 } 3206 3207 if ((r->action == PF_DROP) && 3208 ((r->rule_flag & PFRULE_RETURNICMP) || 3209 (r->rule_flag & PFRULE_RETURN))) { 3210 /* undo NAT changes, if they have taken place */ 3211 if (nr != NULL) { 3212 if (direction == PF_OUT) { 3213 pf_change_ap(saddr, &uh->uh_sport, pd->ip_sum, 3214 &uh->uh_sum, &pd->baddr, bport, 1, af); 3215 rewrite++; 3216 } else { 3217 pf_change_ap(daddr, &uh->uh_dport, pd->ip_sum, 3218 &uh->uh_sum, &pd->baddr, bport, 1, af); 3219 rewrite++; 3220 } 3221 } 3222 if ((af == AF_INET) && r->return_icmp) 3223 pf_send_icmp(m, r->return_icmp >> 8, 3224 r->return_icmp & 255, af, r); 3225 else if ((af == AF_INET6) && r->return_icmp6) 3226 pf_send_icmp(m, r->return_icmp6 >> 8, 3227 r->return_icmp6 & 255, af, r); 3228 } 3229 3230 if (r->action == PF_DROP) 3231 return (PF_DROP); 3232 3233 if (pf_tag_packet(m, pftag, tag)) { 3234 REASON_SET(&reason, PFRES_MEMORY); 3235 return (PF_DROP); 3236 } 3237 3238 if (r->keep_state || nr != NULL) { 3239 /* create new state */ 3240 struct pf_state *s = NULL; 3241 struct pf_src_node *sn = NULL; 3242 3243 /* check maximums */ 3244 if (r->max_states && (r->states >= r->max_states)) 3245 goto cleanup; 3246 /* src node for flter rule */ 3247 if ((r->rule_flag & PFRULE_SRCTRACK || 3248 r->rpool.opts & PF_POOL_STICKYADDR) && 3249 pf_insert_src_node(&sn, r, saddr, af) != 0) 3250 goto cleanup; 3251 /* src node for translation rule */ 3252 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) && 3253 ((direction == PF_OUT && 3254 pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) || 3255 (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) 3256 goto cleanup; 3257 s = pool_get(&pf_state_pl, PR_NOWAIT); 3258 if (s == NULL) { 3259cleanup: 3260 if (sn != NULL && sn->states == 0 && sn->expire == 0) { 3261 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn); 3262 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3263 pf_status.src_nodes--; 3264 pool_put(&pf_src_tree_pl, sn); 3265 } 3266 if (nsn != sn && nsn != NULL && nsn->states == 0 && 3267 nsn->expire == 0) { 3268 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn); 3269 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3270 pf_status.src_nodes--; 3271 pool_put(&pf_src_tree_pl, nsn); 3272 } 3273 REASON_SET(&reason, PFRES_MEMORY); 3274 return (PF_DROP); 3275 } 3276 bzero(s, sizeof(*s)); 3277 r->states++; 3278 if (a != NULL) 3279 a->states++; 3280 s->rule.ptr = r; 3281 s->nat_rule.ptr = nr; 3282 if (s->nat_rule.ptr != NULL) 3283 s->nat_rule.ptr->states++; 3284 s->anchor.ptr = a; 3285 s->allow_opts = r->allow_opts; 3286 s->log = r->log & 2; 3287 s->proto = IPPROTO_UDP; 3288 s->direction = direction; 3289 s->af = af; 3290 if (direction == PF_OUT) { 3291 PF_ACPY(&s->gwy.addr, saddr, af); 3292 s->gwy.port = uh->uh_sport; 3293 PF_ACPY(&s->ext.addr, daddr, af); 3294 s->ext.port = uh->uh_dport; 3295 if (nr != NULL) { 3296 PF_ACPY(&s->lan.addr, &pd->baddr, af); 3297 s->lan.port = bport; 3298 } else { 3299 PF_ACPY(&s->lan.addr, &s->gwy.addr, af); 3300 s->lan.port = s->gwy.port; 3301 } 3302 } else { 3303 PF_ACPY(&s->lan.addr, daddr, af); 3304 s->lan.port = uh->uh_dport; 3305 PF_ACPY(&s->ext.addr, saddr, af); 3306 s->ext.port = uh->uh_sport; 3307 if (nr != NULL) { 3308 PF_ACPY(&s->gwy.addr, &pd->baddr, af); 3309 s->gwy.port = bport; 3310 } else { 3311 PF_ACPY(&s->gwy.addr, &s->lan.addr, af); 3312 s->gwy.port = s->lan.port; 3313 } 3314 } 3315 s->src.state = PFUDPS_SINGLE; 3316 s->dst.state = PFUDPS_NO_TRAFFIC; 3317#ifdef __FreeBSD__ 3318 s->creation = time_second; 3319 s->expire = time_second; 3320#else 3321 s->creation = time.tv_sec; 3322 s->expire = time.tv_sec; 3323#endif 3324 s->timeout = PFTM_UDP_FIRST_PACKET; 3325 pf_set_rt_ifp(s, saddr); 3326 if (sn != NULL) { 3327 s->src_node = sn; 3328 s->src_node->states++; 3329 } 3330 if (nsn != NULL) { 3331 PF_ACPY(&nsn->raddr, &pd->naddr, af); 3332 s->nat_src_node = nsn; 3333 s->nat_src_node->states++; 3334 } 3335 if (pf_insert_state(BOUND_IFACE(r, kif), s)) { 3336 REASON_SET(&reason, PFRES_MEMORY); 3337 pf_src_tree_remove_state(s); 3338 pool_put(&pf_state_pl, s); 3339 return (PF_DROP); 3340 } else 3341 *sm = s; 3342 } 3343 3344 /* copy back packet headers if we performed NAT operations */ 3345 if (rewrite) 3346 m_copyback(m, off, sizeof(*uh), (caddr_t)uh); 3347 3348 return (PF_PASS); 3349} 3350 3351int 3352pf_test_icmp(struct pf_rule **rm, struct pf_state **sm, int direction, 3353 struct pfi_kif *kif, struct mbuf *m, int off, void *h, 3354 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm) 3355{ 3356 struct pf_rule *nr = NULL; 3357 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 3358 struct pf_rule *r, *a = NULL; 3359 struct pf_ruleset *ruleset = NULL; 3360 struct pf_src_node *nsn = NULL; 3361 u_short reason; 3362 u_int16_t icmpid = 0; /* make the compiler happy */ 3363 sa_family_t af = pd->af; 3364 u_int8_t icmptype = 0; /* make the compiler happy */ 3365 u_int8_t icmpcode = 0; /* make the compiler happy */ 3366 int state_icmp = 0; 3367 struct pf_tag *pftag = NULL; 3368 int tag = -1; 3369#ifdef INET6 3370 int rewrite = 0; 3371#endif /* INET6 */ 3372 3373 switch (pd->proto) { 3374#ifdef INET 3375 case IPPROTO_ICMP: 3376 icmptype = pd->hdr.icmp->icmp_type; 3377 icmpcode = pd->hdr.icmp->icmp_code; 3378 icmpid = pd->hdr.icmp->icmp_id; 3379 3380 if (icmptype == ICMP_UNREACH || 3381 icmptype == ICMP_SOURCEQUENCH || 3382 icmptype == ICMP_REDIRECT || 3383 icmptype == ICMP_TIMXCEED || 3384 icmptype == ICMP_PARAMPROB) 3385 state_icmp++; 3386 break; 3387#endif /* INET */ 3388#ifdef INET6 3389 case IPPROTO_ICMPV6: 3390 icmptype = pd->hdr.icmp6->icmp6_type; 3391 icmpcode = pd->hdr.icmp6->icmp6_code; 3392 icmpid = pd->hdr.icmp6->icmp6_id; 3393 3394 if (icmptype == ICMP6_DST_UNREACH || 3395 icmptype == ICMP6_PACKET_TOO_BIG || 3396 icmptype == ICMP6_TIME_EXCEEDED || 3397 icmptype == ICMP6_PARAM_PROB) 3398 state_icmp++; 3399 break; 3400#endif /* INET6 */ 3401 } 3402 3403 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 3404 3405 if (direction == PF_OUT) { 3406 /* check outgoing packet for BINAT/NAT */ 3407 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn, 3408 saddr, 0, daddr, 0, &pd->naddr, NULL)) != NULL) { 3409 PF_ACPY(&pd->baddr, saddr, af); 3410 switch (af) { 3411#ifdef INET 3412 case AF_INET: 3413 pf_change_a(&saddr->v4.s_addr, pd->ip_sum, 3414 pd->naddr.v4.s_addr, 0); 3415 break; 3416#endif /* INET */ 3417#ifdef INET6 3418 case AF_INET6: 3419 pf_change_a6(saddr, &pd->hdr.icmp6->icmp6_cksum, 3420 &pd->naddr, 0); 3421 rewrite++; 3422 break; 3423#endif /* INET6 */ 3424 } 3425 if (nr->natpass) 3426 r = NULL; 3427 pd->nat_rule = nr; 3428 } 3429 } else { 3430 /* check incoming packet for BINAT/RDR */ 3431 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn, 3432 saddr, 0, daddr, 0, &pd->naddr, NULL)) != NULL) { 3433 PF_ACPY(&pd->baddr, daddr, af); 3434 switch (af) { 3435#ifdef INET 3436 case AF_INET: 3437 pf_change_a(&daddr->v4.s_addr, 3438 pd->ip_sum, pd->naddr.v4.s_addr, 0); 3439 break; 3440#endif /* INET */ 3441#ifdef INET6 3442 case AF_INET6: 3443 pf_change_a6(daddr, &pd->hdr.icmp6->icmp6_cksum, 3444 &pd->naddr, 0); 3445 rewrite++; 3446 break; 3447#endif /* INET6 */ 3448 } 3449 if (nr->natpass) 3450 r = NULL; 3451 pd->nat_rule = nr; 3452 } 3453 } 3454 3455 while (r != NULL) { 3456 r->evaluations++; 3457 if (r->kif != NULL && 3458 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 3459 r = r->skip[PF_SKIP_IFP].ptr; 3460 else if (r->direction && r->direction != direction) 3461 r = r->skip[PF_SKIP_DIR].ptr; 3462 else if (r->af && r->af != af) 3463 r = r->skip[PF_SKIP_AF].ptr; 3464 else if (r->proto && r->proto != pd->proto) 3465 r = r->skip[PF_SKIP_PROTO].ptr; 3466 else if (PF_MISMATCHAW(&r->src.addr, saddr, af, r->src.not)) 3467 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 3468 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af, r->dst.not)) 3469 r = r->skip[PF_SKIP_DST_ADDR].ptr; 3470 else if (r->type && r->type != icmptype + 1) 3471 r = TAILQ_NEXT(r, entries); 3472 else if (r->code && r->code != icmpcode + 1) 3473 r = TAILQ_NEXT(r, entries); 3474 else if (r->tos && !(r->tos & pd->tos)) 3475 r = TAILQ_NEXT(r, entries); 3476 else if (r->rule_flag & PFRULE_FRAGMENT) 3477 r = TAILQ_NEXT(r, entries); 3478 else if (r->match_tag && !pf_match_tag(m, r, nr, pftag, &tag)) 3479 r = TAILQ_NEXT(r, entries); 3480 else if (r->anchorname[0] && r->anchor == NULL) 3481 r = TAILQ_NEXT(r, entries); 3482 else if (r->os_fingerprint != PF_OSFP_ANY) 3483 r = TAILQ_NEXT(r, entries); 3484 else { 3485 if (r->tag) 3486 tag = r->tag; 3487 if (r->anchor == NULL) { 3488 *rm = r; 3489 *am = a; 3490 *rsm = ruleset; 3491 if ((*rm)->quick) 3492 break; 3493 r = TAILQ_NEXT(r, entries); 3494 } else 3495 PF_STEP_INTO_ANCHOR(r, a, ruleset, 3496 PF_RULESET_FILTER); 3497 } 3498 if (r == NULL && a != NULL) 3499 PF_STEP_OUT_OF_ANCHOR(r, a, ruleset, 3500 PF_RULESET_FILTER); 3501 } 3502 r = *rm; 3503 a = *am; 3504 ruleset = *rsm; 3505 3506 REASON_SET(&reason, PFRES_MATCH); 3507 3508 if (r->log) { 3509#ifdef INET6 3510 if (rewrite) 3511 m_copyback(m, off, sizeof(struct icmp6_hdr), 3512 (caddr_t)pd->hdr.icmp6); 3513#endif /* INET6 */ 3514 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset); 3515 } 3516 3517 if (r->action != PF_PASS) 3518 return (PF_DROP); 3519 3520 if (pf_tag_packet(m, pftag, tag)) { 3521 REASON_SET(&reason, PFRES_MEMORY); 3522 return (PF_DROP); 3523 } 3524 3525 if (!state_icmp && (r->keep_state || nr != NULL)) { 3526 /* create new state */ 3527 struct pf_state *s = NULL; 3528 struct pf_src_node *sn = NULL; 3529 3530 /* check maximums */ 3531 if (r->max_states && (r->states >= r->max_states)) 3532 goto cleanup; 3533 /* src node for flter rule */ 3534 if ((r->rule_flag & PFRULE_SRCTRACK || 3535 r->rpool.opts & PF_POOL_STICKYADDR) && 3536 pf_insert_src_node(&sn, r, saddr, af) != 0) 3537 goto cleanup; 3538 /* src node for translation rule */ 3539 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) && 3540 ((direction == PF_OUT && 3541 pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) || 3542 (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) 3543 goto cleanup; 3544 s = pool_get(&pf_state_pl, PR_NOWAIT); 3545 if (s == NULL) { 3546cleanup: 3547 if (sn != NULL && sn->states == 0 && sn->expire == 0) { 3548 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn); 3549 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3550 pf_status.src_nodes--; 3551 pool_put(&pf_src_tree_pl, sn); 3552 } 3553 if (nsn != sn && nsn != NULL && nsn->states == 0 && 3554 nsn->expire == 0) { 3555 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn); 3556 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3557 pf_status.src_nodes--; 3558 pool_put(&pf_src_tree_pl, nsn); 3559 } 3560 REASON_SET(&reason, PFRES_MEMORY); 3561 return (PF_DROP); 3562 } 3563 bzero(s, sizeof(*s)); 3564 r->states++; 3565 if (a != NULL) 3566 a->states++; 3567 s->rule.ptr = r; 3568 s->nat_rule.ptr = nr; 3569 if (s->nat_rule.ptr != NULL) 3570 s->nat_rule.ptr->states++; 3571 s->anchor.ptr = a; 3572 s->allow_opts = r->allow_opts; 3573 s->log = r->log & 2; 3574 s->proto = pd->proto; 3575 s->direction = direction; 3576 s->af = af; 3577 if (direction == PF_OUT) { 3578 PF_ACPY(&s->gwy.addr, saddr, af); 3579 s->gwy.port = icmpid; 3580 PF_ACPY(&s->ext.addr, daddr, af); 3581 s->ext.port = icmpid; 3582 if (nr != NULL) 3583 PF_ACPY(&s->lan.addr, &pd->baddr, af); 3584 else 3585 PF_ACPY(&s->lan.addr, &s->gwy.addr, af); 3586 s->lan.port = icmpid; 3587 } else { 3588 PF_ACPY(&s->lan.addr, daddr, af); 3589 s->lan.port = icmpid; 3590 PF_ACPY(&s->ext.addr, saddr, af); 3591 s->ext.port = icmpid; 3592 if (nr != NULL) 3593 PF_ACPY(&s->gwy.addr, &pd->baddr, af); 3594 else 3595 PF_ACPY(&s->gwy.addr, &s->lan.addr, af); 3596 s->gwy.port = icmpid; 3597 } 3598#ifdef __FreeBSD__ 3599 s->creation = time_second; 3600 s->expire = time_second; 3601#else 3602 s->creation = time.tv_sec; 3603 s->expire = time.tv_sec; 3604#endif 3605 s->timeout = PFTM_ICMP_FIRST_PACKET; 3606 pf_set_rt_ifp(s, saddr); 3607 if (sn != NULL) { 3608 s->src_node = sn; 3609 s->src_node->states++; 3610 } 3611 if (nsn != NULL) { 3612 PF_ACPY(&nsn->raddr, &pd->naddr, af); 3613 s->nat_src_node = nsn; 3614 s->nat_src_node->states++; 3615 } 3616 if (pf_insert_state(BOUND_IFACE(r, kif), s)) { 3617 REASON_SET(&reason, PFRES_MEMORY); 3618 pf_src_tree_remove_state(s); 3619 pool_put(&pf_state_pl, s); 3620 return (PF_DROP); 3621 } else 3622 *sm = s; 3623 } 3624 3625#ifdef INET6 3626 /* copy back packet headers if we performed IPv6 NAT operations */ 3627 if (rewrite) 3628 m_copyback(m, off, sizeof(struct icmp6_hdr), 3629 (caddr_t)pd->hdr.icmp6); 3630#endif /* INET6 */ 3631 3632 return (PF_PASS); 3633} 3634 3635int 3636pf_test_other(struct pf_rule **rm, struct pf_state **sm, int direction, 3637 struct pfi_kif *kif, struct mbuf *m, int off, void *h, struct pf_pdesc *pd, 3638 struct pf_rule **am, struct pf_ruleset **rsm) 3639{ 3640 struct pf_rule *nr = NULL; 3641 struct pf_rule *r, *a = NULL; 3642 struct pf_ruleset *ruleset = NULL; 3643 struct pf_src_node *nsn = NULL; 3644 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 3645 sa_family_t af = pd->af; 3646 u_short reason; 3647 struct pf_tag *pftag = NULL; 3648 int tag = -1; 3649 3650 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 3651 3652 if (direction == PF_OUT) { 3653 /* check outgoing packet for BINAT/NAT */ 3654 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn, 3655 saddr, 0, daddr, 0, &pd->naddr, NULL)) != NULL) { 3656 PF_ACPY(&pd->baddr, saddr, af); 3657 switch (af) { 3658#ifdef INET 3659 case AF_INET: 3660 pf_change_a(&saddr->v4.s_addr, pd->ip_sum, 3661 pd->naddr.v4.s_addr, 0); 3662 break; 3663#endif /* INET */ 3664#ifdef INET6 3665 case AF_INET6: 3666 PF_ACPY(saddr, &pd->naddr, af); 3667 break; 3668#endif /* INET6 */ 3669 } 3670 if (nr->natpass) 3671 r = NULL; 3672 pd->nat_rule = nr; 3673 } 3674 } else { 3675 /* check incoming packet for BINAT/RDR */ 3676 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn, 3677 saddr, 0, daddr, 0, &pd->naddr, NULL)) != NULL) { 3678 PF_ACPY(&pd->baddr, daddr, af); 3679 switch (af) { 3680#ifdef INET 3681 case AF_INET: 3682 pf_change_a(&daddr->v4.s_addr, 3683 pd->ip_sum, pd->naddr.v4.s_addr, 0); 3684 break; 3685#endif /* INET */ 3686#ifdef INET6 3687 case AF_INET6: 3688 PF_ACPY(daddr, &pd->naddr, af); 3689 break; 3690#endif /* INET6 */ 3691 } 3692 if (nr->natpass) 3693 r = NULL; 3694 pd->nat_rule = nr; 3695 } 3696 } 3697 3698 while (r != NULL) { 3699 r->evaluations++; 3700 if (r->kif != NULL && 3701 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 3702 r = r->skip[PF_SKIP_IFP].ptr; 3703 else if (r->direction && r->direction != direction) 3704 r = r->skip[PF_SKIP_DIR].ptr; 3705 else if (r->af && r->af != af) 3706 r = r->skip[PF_SKIP_AF].ptr; 3707 else if (r->proto && r->proto != pd->proto) 3708 r = r->skip[PF_SKIP_PROTO].ptr; 3709 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af, r->src.not)) 3710 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 3711 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af, r->dst.not)) 3712 r = r->skip[PF_SKIP_DST_ADDR].ptr; 3713 else if (r->tos && !(r->tos & pd->tos)) 3714 r = TAILQ_NEXT(r, entries); 3715 else if (r->rule_flag & PFRULE_FRAGMENT) 3716 r = TAILQ_NEXT(r, entries); 3717 else if (r->match_tag && !pf_match_tag(m, r, nr, pftag, &tag)) 3718 r = TAILQ_NEXT(r, entries); 3719 else if (r->anchorname[0] && r->anchor == NULL) 3720 r = TAILQ_NEXT(r, entries); 3721 else if (r->os_fingerprint != PF_OSFP_ANY) 3722 r = TAILQ_NEXT(r, entries); 3723 else { 3724 if (r->tag) 3725 tag = r->tag; 3726 if (r->anchor == NULL) { 3727 *rm = r; 3728 *am = a; 3729 *rsm = ruleset; 3730 if ((*rm)->quick) 3731 break; 3732 r = TAILQ_NEXT(r, entries); 3733 } else 3734 PF_STEP_INTO_ANCHOR(r, a, ruleset, 3735 PF_RULESET_FILTER); 3736 } 3737 if (r == NULL && a != NULL) 3738 PF_STEP_OUT_OF_ANCHOR(r, a, ruleset, 3739 PF_RULESET_FILTER); 3740 } 3741 r = *rm; 3742 a = *am; 3743 ruleset = *rsm; 3744 3745 REASON_SET(&reason, PFRES_MATCH); 3746 3747 if (r->log) 3748 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset); 3749 3750 if ((r->action == PF_DROP) && 3751 ((r->rule_flag & PFRULE_RETURNICMP) || 3752 (r->rule_flag & PFRULE_RETURN))) { 3753 struct pf_addr *a = NULL; 3754 3755 if (nr != NULL) { 3756 if (direction == PF_OUT) 3757 a = saddr; 3758 else 3759 a = daddr; 3760 } 3761 if (a != NULL) { 3762 switch (af) { 3763#ifdef INET 3764 case AF_INET: 3765 pf_change_a(&a->v4.s_addr, pd->ip_sum, 3766 pd->baddr.v4.s_addr, 0); 3767 break; 3768#endif /* INET */ 3769#ifdef INET6 3770 case AF_INET6: 3771 PF_ACPY(a, &pd->baddr, af); 3772 break; 3773#endif /* INET6 */ 3774 } 3775 } 3776 if ((af == AF_INET) && r->return_icmp) 3777 pf_send_icmp(m, r->return_icmp >> 8, 3778 r->return_icmp & 255, af, r); 3779 else if ((af == AF_INET6) && r->return_icmp6) 3780 pf_send_icmp(m, r->return_icmp6 >> 8, 3781 r->return_icmp6 & 255, af, r); 3782 } 3783 3784 if (r->action != PF_PASS) 3785 return (PF_DROP); 3786 3787 if (pf_tag_packet(m, pftag, tag)) { 3788 REASON_SET(&reason, PFRES_MEMORY); 3789 return (PF_DROP); 3790 } 3791 3792 if (r->keep_state || nr != NULL) { 3793 /* create new state */ 3794 struct pf_state *s = NULL; 3795 struct pf_src_node *sn = NULL; 3796 3797 /* check maximums */ 3798 if (r->max_states && (r->states >= r->max_states)) 3799 goto cleanup; 3800 /* src node for flter rule */ 3801 if ((r->rule_flag & PFRULE_SRCTRACK || 3802 r->rpool.opts & PF_POOL_STICKYADDR) && 3803 pf_insert_src_node(&sn, r, saddr, af) != 0) 3804 goto cleanup; 3805 /* src node for translation rule */ 3806 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) && 3807 ((direction == PF_OUT && 3808 pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) || 3809 (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) 3810 goto cleanup; 3811 s = pool_get(&pf_state_pl, PR_NOWAIT); 3812 if (s == NULL) { 3813cleanup: 3814 if (sn != NULL && sn->states == 0 && sn->expire == 0) { 3815 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn); 3816 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3817 pf_status.src_nodes--; 3818 pool_put(&pf_src_tree_pl, sn); 3819 } 3820 if (nsn != sn && nsn != NULL && nsn->states == 0 && 3821 nsn->expire == 0) { 3822 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn); 3823 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3824 pf_status.src_nodes--; 3825 pool_put(&pf_src_tree_pl, nsn); 3826 } 3827 REASON_SET(&reason, PFRES_MEMORY); 3828 return (PF_DROP); 3829 } 3830 bzero(s, sizeof(*s)); 3831 r->states++; 3832 if (a != NULL) 3833 a->states++; 3834 s->rule.ptr = r; 3835 s->nat_rule.ptr = nr; 3836 if (s->nat_rule.ptr != NULL) 3837 s->nat_rule.ptr->states++; 3838 s->anchor.ptr = a; 3839 s->allow_opts = r->allow_opts; 3840 s->log = r->log & 2; 3841 s->proto = pd->proto; 3842 s->direction = direction; 3843 s->af = af; 3844 if (direction == PF_OUT) { 3845 PF_ACPY(&s->gwy.addr, saddr, af); 3846 PF_ACPY(&s->ext.addr, daddr, af); 3847 if (nr != NULL) 3848 PF_ACPY(&s->lan.addr, &pd->baddr, af); 3849 else 3850 PF_ACPY(&s->lan.addr, &s->gwy.addr, af); 3851 } else { 3852 PF_ACPY(&s->lan.addr, daddr, af); 3853 PF_ACPY(&s->ext.addr, saddr, af); 3854 if (nr != NULL) 3855 PF_ACPY(&s->gwy.addr, &pd->baddr, af); 3856 else 3857 PF_ACPY(&s->gwy.addr, &s->lan.addr, af); 3858 } 3859 s->src.state = PFOTHERS_SINGLE; 3860 s->dst.state = PFOTHERS_NO_TRAFFIC; 3861#ifdef __FreeBSD__ 3862 s->creation = time_second; 3863 s->expire = time_second; 3864#else 3865 s->creation = time.tv_sec; 3866 s->expire = time.tv_sec; 3867#endif 3868 s->timeout = PFTM_OTHER_FIRST_PACKET; 3869 pf_set_rt_ifp(s, saddr); 3870 if (sn != NULL) { 3871 s->src_node = sn; 3872 s->src_node->states++; 3873 } 3874 if (nsn != NULL) { 3875 PF_ACPY(&nsn->raddr, &pd->naddr, af); 3876 s->nat_src_node = nsn; 3877 s->nat_src_node->states++; 3878 } 3879 if (pf_insert_state(BOUND_IFACE(r, kif), s)) { 3880 REASON_SET(&reason, PFRES_MEMORY); 3881 pf_src_tree_remove_state(s); 3882 pool_put(&pf_state_pl, s); 3883 return (PF_DROP); 3884 } else 3885 *sm = s; 3886 } 3887 3888 return (PF_PASS); 3889} 3890 3891int 3892pf_test_fragment(struct pf_rule **rm, int direction, struct pfi_kif *kif, 3893 struct mbuf *m, void *h, struct pf_pdesc *pd, struct pf_rule **am, 3894 struct pf_ruleset **rsm) 3895{ 3896 struct pf_rule *r, *a = NULL; 3897 struct pf_ruleset *ruleset = NULL; 3898 sa_family_t af = pd->af; 3899 u_short reason; 3900 struct pf_tag *pftag = NULL; 3901 int tag = -1; 3902 3903 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 3904 while (r != NULL) { 3905 r->evaluations++; 3906 if (r->kif != NULL && 3907 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 3908 r = r->skip[PF_SKIP_IFP].ptr; 3909 else if (r->direction && r->direction != direction) 3910 r = r->skip[PF_SKIP_DIR].ptr; 3911 else if (r->af && r->af != af) 3912 r = r->skip[PF_SKIP_AF].ptr; 3913 else if (r->proto && r->proto != pd->proto) 3914 r = r->skip[PF_SKIP_PROTO].ptr; 3915 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af, r->src.not)) 3916 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 3917 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af, r->dst.not)) 3918 r = r->skip[PF_SKIP_DST_ADDR].ptr; 3919 else if (r->tos && !(r->tos & pd->tos)) 3920 r = TAILQ_NEXT(r, entries); 3921 else if (r->src.port_op || r->dst.port_op || 3922 r->flagset || r->type || r->code || 3923 r->os_fingerprint != PF_OSFP_ANY) 3924 r = TAILQ_NEXT(r, entries); 3925 else if (r->match_tag && !pf_match_tag(m, r, NULL, pftag, &tag)) 3926 r = TAILQ_NEXT(r, entries); 3927 else if (r->anchorname[0] && r->anchor == NULL) 3928 r = TAILQ_NEXT(r, entries); 3929 else { 3930 if (r->anchor == NULL) { 3931 *rm = r; 3932 *am = a; 3933 *rsm = ruleset; 3934 if ((*rm)->quick) 3935 break; 3936 r = TAILQ_NEXT(r, entries); 3937 } else 3938 PF_STEP_INTO_ANCHOR(r, a, ruleset, 3939 PF_RULESET_FILTER); 3940 } 3941 if (r == NULL && a != NULL) 3942 PF_STEP_OUT_OF_ANCHOR(r, a, ruleset, 3943 PF_RULESET_FILTER); 3944 } 3945 r = *rm; 3946 a = *am; 3947 ruleset = *rsm; 3948 3949 REASON_SET(&reason, PFRES_MATCH); 3950 3951 if (r->log) 3952 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset); 3953 3954 if (r->action != PF_PASS) 3955 return (PF_DROP); 3956 3957 if (pf_tag_packet(m, pftag, tag)) { 3958 REASON_SET(&reason, PFRES_MEMORY); 3959 return (PF_DROP); 3960 } 3961 3962 return (PF_PASS); 3963} 3964 3965int 3966pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif, 3967 struct mbuf *m, int off, void *h, struct pf_pdesc *pd, 3968 u_short *reason) 3969{ 3970 struct pf_state key; 3971 struct tcphdr *th = pd->hdr.tcp; 3972 u_int16_t win = ntohs(th->th_win); 3973 u_int32_t ack, end, seq; 3974 u_int8_t sws, dws; 3975 int ackskew; 3976 int copyback = 0; 3977 struct pf_state_peer *src, *dst; 3978 3979 key.af = pd->af; 3980 key.proto = IPPROTO_TCP; 3981 if (direction == PF_IN) { 3982 PF_ACPY(&key.ext.addr, pd->src, key.af); 3983 PF_ACPY(&key.gwy.addr, pd->dst, key.af); 3984 key.ext.port = th->th_sport; 3985 key.gwy.port = th->th_dport; 3986 } else { 3987 PF_ACPY(&key.lan.addr, pd->src, key.af); 3988 PF_ACPY(&key.ext.addr, pd->dst, key.af); 3989 key.lan.port = th->th_sport; 3990 key.ext.port = th->th_dport; 3991 } 3992 3993 STATE_LOOKUP(); 3994 3995 if (direction == (*state)->direction) { 3996 src = &(*state)->src; 3997 dst = &(*state)->dst; 3998 } else { 3999 src = &(*state)->dst; 4000 dst = &(*state)->src; 4001 } 4002 4003 if ((*state)->src.state == PF_TCPS_PROXY_SRC) { 4004 if (direction != (*state)->direction) 4005 return (PF_SYNPROXY_DROP); 4006 if (th->th_flags & TH_SYN) { 4007 if (ntohl(th->th_seq) != (*state)->src.seqlo) 4008 return (PF_DROP); 4009 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst, 4010 pd->src, th->th_dport, th->th_sport, 4011 (*state)->src.seqhi, ntohl(th->th_seq) + 1, 4012 TH_SYN|TH_ACK, 0, (*state)->src.mss, 0); 4013 return (PF_SYNPROXY_DROP); 4014 } else if (!(th->th_flags & TH_ACK) || 4015 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) || 4016 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) 4017 return (PF_DROP); 4018 else 4019 (*state)->src.state = PF_TCPS_PROXY_DST; 4020 } 4021 if ((*state)->src.state == PF_TCPS_PROXY_DST) { 4022 struct pf_state_host *src, *dst; 4023 4024 if (direction == PF_OUT) { 4025 src = &(*state)->gwy; 4026 dst = &(*state)->ext; 4027 } else { 4028 src = &(*state)->ext; 4029 dst = &(*state)->lan; 4030 } 4031 if (direction == (*state)->direction) { 4032 if (((th->th_flags & (TH_SYN|TH_ACK)) != TH_ACK) || 4033 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) || 4034 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) 4035 return (PF_DROP); 4036 (*state)->src.max_win = MAX(ntohs(th->th_win), 1); 4037 if ((*state)->dst.seqhi == 1) 4038 (*state)->dst.seqhi = arc4random(); 4039 pf_send_tcp((*state)->rule.ptr, pd->af, &src->addr, 4040 &dst->addr, src->port, dst->port, 4041 (*state)->dst.seqhi, 0, TH_SYN, 0, 4042 (*state)->src.mss, 0); 4043 return (PF_SYNPROXY_DROP); 4044 } else if (((th->th_flags & (TH_SYN|TH_ACK)) != 4045 (TH_SYN|TH_ACK)) || 4046 (ntohl(th->th_ack) != (*state)->dst.seqhi + 1)) 4047 return (PF_DROP); 4048 else { 4049 (*state)->dst.max_win = MAX(ntohs(th->th_win), 1); 4050 (*state)->dst.seqlo = ntohl(th->th_seq); 4051 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst, 4052 pd->src, th->th_dport, th->th_sport, 4053 ntohl(th->th_ack), ntohl(th->th_seq) + 1, 4054 TH_ACK, (*state)->src.max_win, 0, 0); 4055 pf_send_tcp((*state)->rule.ptr, pd->af, &src->addr, 4056 &dst->addr, src->port, dst->port, 4057 (*state)->src.seqhi + 1, (*state)->src.seqlo + 1, 4058 TH_ACK, (*state)->dst.max_win, 0, 0); 4059 (*state)->src.seqdiff = (*state)->dst.seqhi - 4060 (*state)->src.seqlo; 4061 (*state)->dst.seqdiff = (*state)->src.seqhi - 4062 (*state)->dst.seqlo; 4063 (*state)->src.seqhi = (*state)->src.seqlo + 4064 (*state)->src.max_win; 4065 (*state)->dst.seqhi = (*state)->dst.seqlo + 4066 (*state)->dst.max_win; 4067 (*state)->src.wscale = (*state)->dst.wscale = 0; 4068 (*state)->src.state = (*state)->dst.state = 4069 TCPS_ESTABLISHED; 4070 return (PF_SYNPROXY_DROP); 4071 } 4072 } 4073 4074 if (src->wscale && dst->wscale && !(th->th_flags & TH_SYN)) { 4075 sws = src->wscale & PF_WSCALE_MASK; 4076 dws = dst->wscale & PF_WSCALE_MASK; 4077 } else 4078 sws = dws = 0; 4079 4080 /* 4081 * Sequence tracking algorithm from Guido van Rooij's paper: 4082 * http://www.madison-gurkha.com/publications/tcp_filtering/ 4083 * tcp_filtering.ps 4084 */ 4085 4086 seq = ntohl(th->th_seq); 4087 if (src->seqlo == 0) { 4088 /* First packet from this end. Set its state */ 4089 4090 if ((pd->flags & PFDESC_TCP_NORM || dst->scrub) && 4091 src->scrub == NULL) { 4092 if (pf_normalize_tcp_init(m, off, pd, th, src, dst)) { 4093 REASON_SET(reason, PFRES_MEMORY); 4094 return (PF_DROP); 4095 } 4096 } 4097 4098 /* Deferred generation of sequence number modulator */ 4099 if (dst->seqdiff && !src->seqdiff) { 4100 while ((src->seqdiff = arc4random()) == 0) 4101 ; 4102 ack = ntohl(th->th_ack) - dst->seqdiff; 4103 pf_change_a(&th->th_seq, &th->th_sum, htonl(seq + 4104 src->seqdiff), 0); 4105 pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0); 4106 copyback = 1; 4107 } else { 4108 ack = ntohl(th->th_ack); 4109 } 4110 4111 end = seq + pd->p_len; 4112 if (th->th_flags & TH_SYN) { 4113 end++; 4114 if (dst->wscale & PF_WSCALE_FLAG) { 4115 src->wscale = pf_get_wscale(m, off, th->th_off, 4116 pd->af); 4117 if (src->wscale & PF_WSCALE_FLAG) { 4118 /* Remove scale factor from initial 4119 * window */ 4120 sws = src->wscale & PF_WSCALE_MASK; 4121 win = ((u_int32_t)win + (1 << sws) - 1) 4122 >> sws; 4123 dws = dst->wscale & PF_WSCALE_MASK; 4124 } else { 4125 /* fixup other window */ 4126 dst->max_win <<= dst->wscale & 4127 PF_WSCALE_MASK; 4128 /* in case of a retrans SYN|ACK */ 4129 dst->wscale = 0; 4130 } 4131 } 4132 } 4133 if (th->th_flags & TH_FIN) 4134 end++; 4135 4136 src->seqlo = seq; 4137 if (src->state < TCPS_SYN_SENT) 4138 src->state = TCPS_SYN_SENT; 4139 4140 /* 4141 * May need to slide the window (seqhi may have been set by 4142 * the crappy stack check or if we picked up the connection 4143 * after establishment) 4144 */ 4145 if (src->seqhi == 1 || 4146 SEQ_GEQ(end + MAX(1, dst->max_win << dws), src->seqhi)) 4147 src->seqhi = end + MAX(1, dst->max_win << dws); 4148 if (win > src->max_win) 4149 src->max_win = win; 4150 4151 } else { 4152 ack = ntohl(th->th_ack) - dst->seqdiff; 4153 if (src->seqdiff) { 4154 /* Modulate sequence numbers */ 4155 pf_change_a(&th->th_seq, &th->th_sum, htonl(seq + 4156 src->seqdiff), 0); 4157 pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0); 4158 copyback = 1; 4159 } 4160 end = seq + pd->p_len; 4161 if (th->th_flags & TH_SYN) 4162 end++; 4163 if (th->th_flags & TH_FIN) 4164 end++; 4165 } 4166 4167 if ((th->th_flags & TH_ACK) == 0) { 4168 /* Let it pass through the ack skew check */ 4169 ack = dst->seqlo; 4170 } else if ((ack == 0 && 4171 (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) || 4172 /* broken tcp stacks do not set ack */ 4173 (dst->state < TCPS_SYN_SENT)) { 4174 /* 4175 * Many stacks (ours included) will set the ACK number in an 4176 * FIN|ACK if the SYN times out -- no sequence to ACK. 4177 */ 4178 ack = dst->seqlo; 4179 } 4180 4181 if (seq == end) { 4182 /* Ease sequencing restrictions on no data packets */ 4183 seq = src->seqlo; 4184 end = seq; 4185 } 4186 4187 ackskew = dst->seqlo - ack; 4188 4189#define MAXACKWINDOW (0xffff + 1500) /* 1500 is an arbitrary fudge factor */ 4190 if (SEQ_GEQ(src->seqhi, end) && 4191 /* Last octet inside other's window space */ 4192 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) && 4193 /* Retrans: not more than one window back */ 4194 (ackskew >= -MAXACKWINDOW) && 4195 /* Acking not more than one reassembled fragment backwards */ 4196 (ackskew <= (MAXACKWINDOW << sws))) { 4197 /* Acking not more than one window forward */ 4198 4199 /* update max window */ 4200 if (src->max_win < win) 4201 src->max_win = win; 4202 /* synchronize sequencing */ 4203 if (SEQ_GT(end, src->seqlo)) 4204 src->seqlo = end; 4205 /* slide the window of what the other end can send */ 4206 if (SEQ_GEQ(ack + (win << sws), dst->seqhi)) 4207 dst->seqhi = ack + MAX((win << sws), 1); 4208 4209 4210 /* update states */ 4211 if (th->th_flags & TH_SYN) 4212 if (src->state < TCPS_SYN_SENT) 4213 src->state = TCPS_SYN_SENT; 4214 if (th->th_flags & TH_FIN) 4215 if (src->state < TCPS_CLOSING) 4216 src->state = TCPS_CLOSING; 4217 if (th->th_flags & TH_ACK) { 4218 if (dst->state == TCPS_SYN_SENT) 4219 dst->state = TCPS_ESTABLISHED; 4220 else if (dst->state == TCPS_CLOSING) 4221 dst->state = TCPS_FIN_WAIT_2; 4222 } 4223 if (th->th_flags & TH_RST) 4224 src->state = dst->state = TCPS_TIME_WAIT; 4225 4226 /* update expire time */ 4227#ifdef __FreeBSD__ 4228 (*state)->expire = time_second; 4229#else 4230 (*state)->expire = time.tv_sec; 4231#endif 4232 if (src->state >= TCPS_FIN_WAIT_2 && 4233 dst->state >= TCPS_FIN_WAIT_2) 4234 (*state)->timeout = PFTM_TCP_CLOSED; 4235 else if (src->state >= TCPS_FIN_WAIT_2 || 4236 dst->state >= TCPS_FIN_WAIT_2) 4237 (*state)->timeout = PFTM_TCP_FIN_WAIT; 4238 else if (src->state < TCPS_ESTABLISHED || 4239 dst->state < TCPS_ESTABLISHED) 4240 (*state)->timeout = PFTM_TCP_OPENING; 4241 else if (src->state >= TCPS_CLOSING || 4242 dst->state >= TCPS_CLOSING) 4243 (*state)->timeout = PFTM_TCP_CLOSING; 4244 else 4245 (*state)->timeout = PFTM_TCP_ESTABLISHED; 4246 4247 /* Fall through to PASS packet */ 4248 4249 } else if ((dst->state < TCPS_SYN_SENT || 4250 dst->state >= TCPS_FIN_WAIT_2 || 4251 src->state >= TCPS_FIN_WAIT_2) && 4252 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) && 4253 /* Within a window forward of the originating packet */ 4254 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW)) { 4255 /* Within a window backward of the originating packet */ 4256 4257 /* 4258 * This currently handles three situations: 4259 * 1) Stupid stacks will shotgun SYNs before their peer 4260 * replies. 4261 * 2) When PF catches an already established stream (the 4262 * firewall rebooted, the state table was flushed, routes 4263 * changed...) 4264 * 3) Packets get funky immediately after the connection 4265 * closes (this should catch Solaris spurious ACK|FINs 4266 * that web servers like to spew after a close) 4267 * 4268 * This must be a little more careful than the above code 4269 * since packet floods will also be caught here. We don't 4270 * update the TTL here to mitigate the damage of a packet 4271 * flood and so the same code can handle awkward establishment 4272 * and a loosened connection close. 4273 * In the establishment case, a correct peer response will 4274 * validate the connection, go through the normal state code 4275 * and keep updating the state TTL. 4276 */ 4277 4278 if (pf_status.debug >= PF_DEBUG_MISC) { 4279 printf("pf: loose state match: "); 4280 pf_print_state(*state); 4281 pf_print_flags(th->th_flags); 4282 printf(" seq=%u ack=%u len=%u ackskew=%d pkts=%d:%d\n", 4283 seq, ack, pd->p_len, ackskew, 4284 (*state)->packets[0], (*state)->packets[1]); 4285 } 4286 4287 /* update max window */ 4288 if (src->max_win < win) 4289 src->max_win = win; 4290 /* synchronize sequencing */ 4291 if (SEQ_GT(end, src->seqlo)) 4292 src->seqlo = end; 4293 /* slide the window of what the other end can send */ 4294 if (SEQ_GEQ(ack + (win << sws), dst->seqhi)) 4295 dst->seqhi = ack + MAX((win << sws), 1); 4296 4297 /* 4298 * Cannot set dst->seqhi here since this could be a shotgunned 4299 * SYN and not an already established connection. 4300 */ 4301 4302 if (th->th_flags & TH_FIN) 4303 if (src->state < TCPS_CLOSING) 4304 src->state = TCPS_CLOSING; 4305 if (th->th_flags & TH_RST) 4306 src->state = dst->state = TCPS_TIME_WAIT; 4307 4308 /* Fall through to PASS packet */ 4309 4310 } else { 4311 if ((*state)->dst.state == TCPS_SYN_SENT && 4312 (*state)->src.state == TCPS_SYN_SENT) { 4313 /* Send RST for state mismatches during handshake */ 4314 if (!(th->th_flags & TH_RST)) { 4315 u_int32_t ack = ntohl(th->th_seq) + pd->p_len; 4316 4317 if (th->th_flags & TH_SYN) 4318 ack++; 4319 if (th->th_flags & TH_FIN) 4320 ack++; 4321 pf_send_tcp((*state)->rule.ptr, pd->af, 4322 pd->dst, pd->src, th->th_dport, 4323 th->th_sport, ntohl(th->th_ack), ack, 4324 TH_RST|TH_ACK, 0, 0, 4325 (*state)->rule.ptr->return_ttl); 4326 } 4327 src->seqlo = 0; 4328 src->seqhi = 1; 4329 src->max_win = 1; 4330 } else if (pf_status.debug >= PF_DEBUG_MISC) { 4331 printf("pf: BAD state: "); 4332 pf_print_state(*state); 4333 pf_print_flags(th->th_flags); 4334 printf(" seq=%u ack=%u len=%u ackskew=%d pkts=%d:%d " 4335 "dir=%s,%s\n", seq, ack, pd->p_len, ackskew, 4336 (*state)->packets[0], (*state)->packets[1], 4337 direction == PF_IN ? "in" : "out", 4338 direction == (*state)->direction ? "fwd" : "rev"); 4339 printf("pf: State failure on: %c %c %c %c | %c %c\n", 4340 SEQ_GEQ(src->seqhi, end) ? ' ' : '1', 4341 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) ? 4342 ' ': '2', 4343 (ackskew >= -MAXACKWINDOW) ? ' ' : '3', 4344 (ackskew <= (MAXACKWINDOW << sws)) ? ' ' : '4', 4345 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) ?' ' :'5', 4346 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW) ?' ' :'6'); 4347 } 4348 return (PF_DROP); 4349 } 4350 4351 if (dst->scrub || src->scrub) { 4352 if (pf_normalize_tcp_stateful(m, off, pd, reason, th, 4353 src, dst, ©back)) 4354 return (PF_DROP); 4355 } 4356 4357 /* Any packets which have gotten here are to be passed */ 4358 4359 /* translate source/destination address, if necessary */ 4360 if (STATE_TRANSLATE(*state)) { 4361 if (direction == PF_OUT) 4362 pf_change_ap(pd->src, &th->th_sport, pd->ip_sum, 4363 &th->th_sum, &(*state)->gwy.addr, 4364 (*state)->gwy.port, 0, pd->af); 4365 else 4366 pf_change_ap(pd->dst, &th->th_dport, pd->ip_sum, 4367 &th->th_sum, &(*state)->lan.addr, 4368 (*state)->lan.port, 0, pd->af); 4369 m_copyback(m, off, sizeof(*th), (caddr_t)th); 4370 } else if (copyback) { 4371 /* Copyback sequence modulation or stateful scrub changes */ 4372 m_copyback(m, off, sizeof(*th), (caddr_t)th); 4373 } 4374 4375 return (PF_PASS); 4376} 4377 4378int 4379pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif, 4380 struct mbuf *m, int off, void *h, struct pf_pdesc *pd) 4381{ 4382 struct pf_state_peer *src, *dst; 4383 struct pf_state key; 4384 struct udphdr *uh = pd->hdr.udp; 4385 4386 key.af = pd->af; 4387 key.proto = IPPROTO_UDP; 4388 if (direction == PF_IN) { 4389 PF_ACPY(&key.ext.addr, pd->src, key.af); 4390 PF_ACPY(&key.gwy.addr, pd->dst, key.af); 4391 key.ext.port = uh->uh_sport; 4392 key.gwy.port = uh->uh_dport; 4393 } else { 4394 PF_ACPY(&key.lan.addr, pd->src, key.af); 4395 PF_ACPY(&key.ext.addr, pd->dst, key.af); 4396 key.lan.port = uh->uh_sport; 4397 key.ext.port = uh->uh_dport; 4398 } 4399 4400 STATE_LOOKUP(); 4401 4402 if (direction == (*state)->direction) { 4403 src = &(*state)->src; 4404 dst = &(*state)->dst; 4405 } else { 4406 src = &(*state)->dst; 4407 dst = &(*state)->src; 4408 } 4409 4410 /* update states */ 4411 if (src->state < PFUDPS_SINGLE) 4412 src->state = PFUDPS_SINGLE; 4413 if (dst->state == PFUDPS_SINGLE) 4414 dst->state = PFUDPS_MULTIPLE; 4415 4416 /* update expire time */ 4417#ifdef __FreeBSD__ 4418 (*state)->expire = time_second; 4419#else 4420 (*state)->expire = time.tv_sec; 4421#endif 4422 if (src->state == PFUDPS_MULTIPLE && dst->state == PFUDPS_MULTIPLE) 4423 (*state)->timeout = PFTM_UDP_MULTIPLE; 4424 else 4425 (*state)->timeout = PFTM_UDP_SINGLE; 4426 4427 /* translate source/destination address, if necessary */ 4428 if (STATE_TRANSLATE(*state)) { 4429 if (direction == PF_OUT) 4430 pf_change_ap(pd->src, &uh->uh_sport, pd->ip_sum, 4431 &uh->uh_sum, &(*state)->gwy.addr, 4432 (*state)->gwy.port, 1, pd->af); 4433 else 4434 pf_change_ap(pd->dst, &uh->uh_dport, pd->ip_sum, 4435 &uh->uh_sum, &(*state)->lan.addr, 4436 (*state)->lan.port, 1, pd->af); 4437 m_copyback(m, off, sizeof(*uh), (caddr_t)uh); 4438 } 4439 4440 return (PF_PASS); 4441} 4442 4443int 4444pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif, 4445 struct mbuf *m, int off, void *h, struct pf_pdesc *pd) 4446{ 4447 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 4448 u_int16_t icmpid = 0; /* make the compiler happy */ 4449 u_int16_t *icmpsum = NULL; /* make the compiler happy */ 4450 u_int8_t icmptype = 0; /* make the compiler happy */ 4451 int state_icmp = 0; 4452 4453 switch (pd->proto) { 4454#ifdef INET 4455 case IPPROTO_ICMP: 4456 icmptype = pd->hdr.icmp->icmp_type; 4457 icmpid = pd->hdr.icmp->icmp_id; 4458 icmpsum = &pd->hdr.icmp->icmp_cksum; 4459 4460 if (icmptype == ICMP_UNREACH || 4461 icmptype == ICMP_SOURCEQUENCH || 4462 icmptype == ICMP_REDIRECT || 4463 icmptype == ICMP_TIMXCEED || 4464 icmptype == ICMP_PARAMPROB) 4465 state_icmp++; 4466 break; 4467#endif /* INET */ 4468#ifdef INET6 4469 case IPPROTO_ICMPV6: 4470 icmptype = pd->hdr.icmp6->icmp6_type; 4471 icmpid = pd->hdr.icmp6->icmp6_id; 4472 icmpsum = &pd->hdr.icmp6->icmp6_cksum; 4473 4474 if (icmptype == ICMP6_DST_UNREACH || 4475 icmptype == ICMP6_PACKET_TOO_BIG || 4476 icmptype == ICMP6_TIME_EXCEEDED || 4477 icmptype == ICMP6_PARAM_PROB) 4478 state_icmp++; 4479 break; 4480#endif /* INET6 */ 4481 } 4482 4483 if (!state_icmp) { 4484 4485 /* 4486 * ICMP query/reply message not related to a TCP/UDP packet. 4487 * Search for an ICMP state. 4488 */ 4489 struct pf_state key; 4490 4491 key.af = pd->af; 4492 key.proto = pd->proto; 4493 if (direction == PF_IN) { 4494 PF_ACPY(&key.ext.addr, pd->src, key.af); 4495 PF_ACPY(&key.gwy.addr, pd->dst, key.af); 4496 key.ext.port = icmpid; 4497 key.gwy.port = icmpid; 4498 } else { 4499 PF_ACPY(&key.lan.addr, pd->src, key.af); 4500 PF_ACPY(&key.ext.addr, pd->dst, key.af); 4501 key.lan.port = icmpid; 4502 key.ext.port = icmpid; 4503 } 4504 4505 STATE_LOOKUP(); 4506 4507#ifdef __FreeBSD__ 4508 (*state)->expire = time_second; 4509#else 4510 (*state)->expire = time.tv_sec; 4511#endif 4512 (*state)->timeout = PFTM_ICMP_ERROR_REPLY; 4513 4514 /* translate source/destination address, if necessary */ 4515 if (PF_ANEQ(&(*state)->lan.addr, &(*state)->gwy.addr, pd->af)) { 4516 if (direction == PF_OUT) { 4517 switch (pd->af) { 4518#ifdef INET 4519 case AF_INET: 4520 pf_change_a(&saddr->v4.s_addr, 4521 pd->ip_sum, 4522 (*state)->gwy.addr.v4.s_addr, 0); 4523 break; 4524#endif /* INET */ 4525#ifdef INET6 4526 case AF_INET6: 4527 pf_change_a6(saddr, 4528 &pd->hdr.icmp6->icmp6_cksum, 4529 &(*state)->gwy.addr, 0); 4530 m_copyback(m, off, 4531 sizeof(struct icmp6_hdr), 4532 (caddr_t)pd->hdr.icmp6); 4533 break; 4534#endif /* INET6 */ 4535 } 4536 } else { 4537 switch (pd->af) { 4538#ifdef INET 4539 case AF_INET: 4540 pf_change_a(&daddr->v4.s_addr, 4541 pd->ip_sum, 4542 (*state)->lan.addr.v4.s_addr, 0); 4543 break; 4544#endif /* INET */ 4545#ifdef INET6 4546 case AF_INET6: 4547 pf_change_a6(daddr, 4548 &pd->hdr.icmp6->icmp6_cksum, 4549 &(*state)->lan.addr, 0); 4550 m_copyback(m, off, 4551 sizeof(struct icmp6_hdr), 4552 (caddr_t)pd->hdr.icmp6); 4553 break; 4554#endif /* INET6 */ 4555 } 4556 } 4557 } 4558 4559 return (PF_PASS); 4560 4561 } else { 4562 /* 4563 * ICMP error message in response to a TCP/UDP packet. 4564 * Extract the inner TCP/UDP header and search for that state. 4565 */ 4566 4567 struct pf_pdesc pd2; 4568#ifdef INET 4569 struct ip h2; 4570#endif /* INET */ 4571#ifdef INET6 4572 struct ip6_hdr h2_6; 4573 int terminal = 0; 4574#endif /* INET6 */ 4575 int ipoff2 = 0; /* make the compiler happy */ 4576 int off2 = 0; /* make the compiler happy */ 4577 4578 pd2.af = pd->af; 4579 switch (pd->af) { 4580#ifdef INET 4581 case AF_INET: 4582 /* offset of h2 in mbuf chain */ 4583 ipoff2 = off + ICMP_MINLEN; 4584 4585 if (!pf_pull_hdr(m, ipoff2, &h2, sizeof(h2), 4586 NULL, NULL, pd2.af)) { 4587 DPFPRINTF(PF_DEBUG_MISC, 4588 ("pf: ICMP error message too short " 4589 "(ip)\n")); 4590 return (PF_DROP); 4591 } 4592 /* 4593 * ICMP error messages don't refer to non-first 4594 * fragments 4595 */ 4596 if (h2.ip_off & htons(IP_OFFMASK)) 4597 return (PF_DROP); 4598 4599 /* offset of protocol header that follows h2 */ 4600 off2 = ipoff2 + (h2.ip_hl << 2); 4601 4602 pd2.proto = h2.ip_p; 4603 pd2.src = (struct pf_addr *)&h2.ip_src; 4604 pd2.dst = (struct pf_addr *)&h2.ip_dst; 4605 pd2.ip_sum = &h2.ip_sum; 4606 break; 4607#endif /* INET */ 4608#ifdef INET6 4609 case AF_INET6: 4610 ipoff2 = off + sizeof(struct icmp6_hdr); 4611 4612 if (!pf_pull_hdr(m, ipoff2, &h2_6, sizeof(h2_6), 4613 NULL, NULL, pd2.af)) { 4614 DPFPRINTF(PF_DEBUG_MISC, 4615 ("pf: ICMP error message too short " 4616 "(ip6)\n")); 4617 return (PF_DROP); 4618 } 4619 pd2.proto = h2_6.ip6_nxt; 4620 pd2.src = (struct pf_addr *)&h2_6.ip6_src; 4621 pd2.dst = (struct pf_addr *)&h2_6.ip6_dst; 4622 pd2.ip_sum = NULL; 4623 off2 = ipoff2 + sizeof(h2_6); 4624 do { 4625 switch (pd2.proto) { 4626 case IPPROTO_FRAGMENT: 4627 /* 4628 * ICMPv6 error messages for 4629 * non-first fragments 4630 */ 4631 return (PF_DROP); 4632 case IPPROTO_AH: 4633 case IPPROTO_HOPOPTS: 4634 case IPPROTO_ROUTING: 4635 case IPPROTO_DSTOPTS: { 4636 /* get next header and header length */ 4637 struct ip6_ext opt6; 4638 4639 if (!pf_pull_hdr(m, off2, &opt6, 4640 sizeof(opt6), NULL, NULL, pd2.af)) { 4641 DPFPRINTF(PF_DEBUG_MISC, 4642 ("pf: ICMPv6 short opt\n")); 4643 return (PF_DROP); 4644 } 4645 if (pd2.proto == IPPROTO_AH) 4646 off2 += (opt6.ip6e_len + 2) * 4; 4647 else 4648 off2 += (opt6.ip6e_len + 1) * 8; 4649 pd2.proto = opt6.ip6e_nxt; 4650 /* goto the next header */ 4651 break; 4652 } 4653 default: 4654 terminal++; 4655 break; 4656 } 4657 } while (!terminal); 4658 break; 4659#endif /* INET6 */ 4660 } 4661 4662 switch (pd2.proto) { 4663 case IPPROTO_TCP: { 4664 struct tcphdr th; 4665 u_int32_t seq; 4666 struct pf_state key; 4667 struct pf_state_peer *src, *dst; 4668 u_int8_t dws; 4669 int copyback = 0; 4670 4671 /* 4672 * Only the first 8 bytes of the TCP header can be 4673 * expected. Don't access any TCP header fields after 4674 * th_seq, an ackskew test is not possible. 4675 */ 4676 if (!pf_pull_hdr(m, off2, &th, 8, NULL, NULL, pd2.af)) { 4677 DPFPRINTF(PF_DEBUG_MISC, 4678 ("pf: ICMP error message too short " 4679 "(tcp)\n")); 4680 return (PF_DROP); 4681 } 4682 4683 key.af = pd2.af; 4684 key.proto = IPPROTO_TCP; 4685 if (direction == PF_IN) { 4686 PF_ACPY(&key.ext.addr, pd2.dst, key.af); 4687 PF_ACPY(&key.gwy.addr, pd2.src, key.af); 4688 key.ext.port = th.th_dport; 4689 key.gwy.port = th.th_sport; 4690 } else { 4691 PF_ACPY(&key.lan.addr, pd2.dst, key.af); 4692 PF_ACPY(&key.ext.addr, pd2.src, key.af); 4693 key.lan.port = th.th_dport; 4694 key.ext.port = th.th_sport; 4695 } 4696 4697 STATE_LOOKUP(); 4698 4699 if (direction == (*state)->direction) { 4700 src = &(*state)->dst; 4701 dst = &(*state)->src; 4702 } else { 4703 src = &(*state)->src; 4704 dst = &(*state)->dst; 4705 } 4706 4707 if (src->wscale && dst->wscale && 4708 !(th.th_flags & TH_SYN)) 4709 dws = dst->wscale & PF_WSCALE_MASK; 4710 else 4711 dws = 0; 4712 4713 /* Demodulate sequence number */ 4714 seq = ntohl(th.th_seq) - src->seqdiff; 4715 if (src->seqdiff) { 4716 pf_change_a(&th.th_seq, icmpsum, 4717 htonl(seq), 0); 4718 copyback = 1; 4719 } 4720 4721 if (!SEQ_GEQ(src->seqhi, seq) || 4722 !SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws))) { 4723 if (pf_status.debug >= PF_DEBUG_MISC) { 4724 printf("pf: BAD ICMP %d:%d ", 4725 icmptype, pd->hdr.icmp->icmp_code); 4726 pf_print_host(pd->src, 0, pd->af); 4727 printf(" -> "); 4728 pf_print_host(pd->dst, 0, pd->af); 4729 printf(" state: "); 4730 pf_print_state(*state); 4731 printf(" seq=%u\n", seq); 4732 } 4733 return (PF_DROP); 4734 } 4735 4736 if (STATE_TRANSLATE(*state)) { 4737 if (direction == PF_IN) { 4738 pf_change_icmp(pd2.src, &th.th_sport, 4739 daddr, &(*state)->lan.addr, 4740 (*state)->lan.port, NULL, 4741 pd2.ip_sum, icmpsum, 4742 pd->ip_sum, 0, pd2.af); 4743 } else { 4744 pf_change_icmp(pd2.dst, &th.th_dport, 4745 saddr, &(*state)->gwy.addr, 4746 (*state)->gwy.port, NULL, 4747 pd2.ip_sum, icmpsum, 4748 pd->ip_sum, 0, pd2.af); 4749 } 4750 copyback = 1; 4751 } 4752 4753 if (copyback) { 4754 switch (pd2.af) { 4755#ifdef INET 4756 case AF_INET: 4757 m_copyback(m, off, ICMP_MINLEN, 4758 (caddr_t)pd->hdr.icmp); 4759 m_copyback(m, ipoff2, sizeof(h2), 4760 (caddr_t)&h2); 4761 break; 4762#endif /* INET */ 4763#ifdef INET6 4764 case AF_INET6: 4765 m_copyback(m, off, 4766 sizeof(struct icmp6_hdr), 4767 (caddr_t)pd->hdr.icmp6); 4768 m_copyback(m, ipoff2, sizeof(h2_6), 4769 (caddr_t)&h2_6); 4770 break; 4771#endif /* INET6 */ 4772 } 4773 m_copyback(m, off2, 8, (caddr_t)&th); 4774 } 4775 4776 return (PF_PASS); 4777 break; 4778 } 4779 case IPPROTO_UDP: { 4780 struct udphdr uh; 4781 struct pf_state key; 4782 4783 if (!pf_pull_hdr(m, off2, &uh, sizeof(uh), 4784 NULL, NULL, pd2.af)) { 4785 DPFPRINTF(PF_DEBUG_MISC, 4786 ("pf: ICMP error message too short " 4787 "(udp)\n")); 4788 return (PF_DROP); 4789 } 4790 4791 key.af = pd2.af; 4792 key.proto = IPPROTO_UDP; 4793 if (direction == PF_IN) { 4794 PF_ACPY(&key.ext.addr, pd2.dst, key.af); 4795 PF_ACPY(&key.gwy.addr, pd2.src, key.af); 4796 key.ext.port = uh.uh_dport; 4797 key.gwy.port = uh.uh_sport; 4798 } else { 4799 PF_ACPY(&key.lan.addr, pd2.dst, key.af); 4800 PF_ACPY(&key.ext.addr, pd2.src, key.af); 4801 key.lan.port = uh.uh_dport; 4802 key.ext.port = uh.uh_sport; 4803 } 4804 4805 STATE_LOOKUP(); 4806 4807 if (STATE_TRANSLATE(*state)) { 4808 if (direction == PF_IN) { 4809 pf_change_icmp(pd2.src, &uh.uh_sport, 4810 daddr, &(*state)->lan.addr, 4811 (*state)->lan.port, &uh.uh_sum, 4812 pd2.ip_sum, icmpsum, 4813 pd->ip_sum, 1, pd2.af); 4814 } else { 4815 pf_change_icmp(pd2.dst, &uh.uh_dport, 4816 saddr, &(*state)->gwy.addr, 4817 (*state)->gwy.port, &uh.uh_sum, 4818 pd2.ip_sum, icmpsum, 4819 pd->ip_sum, 1, pd2.af); 4820 } 4821 switch (pd2.af) { 4822#ifdef INET 4823 case AF_INET: 4824 m_copyback(m, off, ICMP_MINLEN, 4825 (caddr_t)pd->hdr.icmp); 4826 m_copyback(m, ipoff2, sizeof(h2), 4827 (caddr_t)&h2); 4828 break; 4829#endif /* INET */ 4830#ifdef INET6 4831 case AF_INET6: 4832 m_copyback(m, off, 4833 sizeof(struct icmp6_hdr), 4834 (caddr_t)pd->hdr.icmp6); 4835 m_copyback(m, ipoff2, sizeof(h2_6), 4836 (caddr_t)&h2_6); 4837 break; 4838#endif /* INET6 */ 4839 } 4840 m_copyback(m, off2, sizeof(uh), 4841 (caddr_t)&uh); 4842 } 4843 4844 return (PF_PASS); 4845 break; 4846 } 4847#ifdef INET 4848 case IPPROTO_ICMP: { 4849 struct icmp iih; 4850 struct pf_state key; 4851 4852 if (!pf_pull_hdr(m, off2, &iih, ICMP_MINLEN, 4853 NULL, NULL, pd2.af)) { 4854 DPFPRINTF(PF_DEBUG_MISC, 4855 ("pf: ICMP error message too short i" 4856 "(icmp)\n")); 4857 return (PF_DROP); 4858 } 4859 4860 key.af = pd2.af; 4861 key.proto = IPPROTO_ICMP; 4862 if (direction == PF_IN) { 4863 PF_ACPY(&key.ext.addr, pd2.dst, key.af); 4864 PF_ACPY(&key.gwy.addr, pd2.src, key.af); 4865 key.ext.port = iih.icmp_id; 4866 key.gwy.port = iih.icmp_id; 4867 } else { 4868 PF_ACPY(&key.lan.addr, pd2.dst, key.af); 4869 PF_ACPY(&key.ext.addr, pd2.src, key.af); 4870 key.lan.port = iih.icmp_id; 4871 key.ext.port = iih.icmp_id; 4872 } 4873 4874 STATE_LOOKUP(); 4875 4876 if (STATE_TRANSLATE(*state)) { 4877 if (direction == PF_IN) { 4878 pf_change_icmp(pd2.src, &iih.icmp_id, 4879 daddr, &(*state)->lan.addr, 4880 (*state)->lan.port, NULL, 4881 pd2.ip_sum, icmpsum, 4882 pd->ip_sum, 0, AF_INET); 4883 } else { 4884 pf_change_icmp(pd2.dst, &iih.icmp_id, 4885 saddr, &(*state)->gwy.addr, 4886 (*state)->gwy.port, NULL, 4887 pd2.ip_sum, icmpsum, 4888 pd->ip_sum, 0, AF_INET); 4889 } 4890 m_copyback(m, off, ICMP_MINLEN, 4891 (caddr_t)pd->hdr.icmp); 4892 m_copyback(m, ipoff2, sizeof(h2), 4893 (caddr_t)&h2); 4894 m_copyback(m, off2, ICMP_MINLEN, 4895 (caddr_t)&iih); 4896 } 4897 4898 return (PF_PASS); 4899 break; 4900 } 4901#endif /* INET */ 4902#ifdef INET6 4903 case IPPROTO_ICMPV6: { 4904 struct icmp6_hdr iih; 4905 struct pf_state key; 4906 4907 if (!pf_pull_hdr(m, off2, &iih, 4908 sizeof(struct icmp6_hdr), NULL, NULL, pd2.af)) { 4909 DPFPRINTF(PF_DEBUG_MISC, 4910 ("pf: ICMP error message too short " 4911 "(icmp6)\n")); 4912 return (PF_DROP); 4913 } 4914 4915 key.af = pd2.af; 4916 key.proto = IPPROTO_ICMPV6; 4917 if (direction == PF_IN) { 4918 PF_ACPY(&key.ext.addr, pd2.dst, key.af); 4919 PF_ACPY(&key.gwy.addr, pd2.src, key.af); 4920 key.ext.port = iih.icmp6_id; 4921 key.gwy.port = iih.icmp6_id; 4922 } else { 4923 PF_ACPY(&key.lan.addr, pd2.dst, key.af); 4924 PF_ACPY(&key.ext.addr, pd2.src, key.af); 4925 key.lan.port = iih.icmp6_id; 4926 key.ext.port = iih.icmp6_id; 4927 } 4928 4929 STATE_LOOKUP(); 4930 4931 if (STATE_TRANSLATE(*state)) { 4932 if (direction == PF_IN) { 4933 pf_change_icmp(pd2.src, &iih.icmp6_id, 4934 daddr, &(*state)->lan.addr, 4935 (*state)->lan.port, NULL, 4936 pd2.ip_sum, icmpsum, 4937 pd->ip_sum, 0, AF_INET6); 4938 } else { 4939 pf_change_icmp(pd2.dst, &iih.icmp6_id, 4940 saddr, &(*state)->gwy.addr, 4941 (*state)->gwy.port, NULL, 4942 pd2.ip_sum, icmpsum, 4943 pd->ip_sum, 0, AF_INET6); 4944 } 4945 m_copyback(m, off, sizeof(struct icmp6_hdr), 4946 (caddr_t)pd->hdr.icmp6); 4947 m_copyback(m, ipoff2, sizeof(h2_6), 4948 (caddr_t)&h2_6); 4949 m_copyback(m, off2, sizeof(struct icmp6_hdr), 4950 (caddr_t)&iih); 4951 } 4952 4953 return (PF_PASS); 4954 break; 4955 } 4956#endif /* INET6 */ 4957 default: { 4958 struct pf_state key; 4959 4960 key.af = pd2.af; 4961 key.proto = pd2.proto; 4962 if (direction == PF_IN) { 4963 PF_ACPY(&key.ext.addr, pd2.dst, key.af); 4964 PF_ACPY(&key.gwy.addr, pd2.src, key.af); 4965 key.ext.port = 0; 4966 key.gwy.port = 0; 4967 } else { 4968 PF_ACPY(&key.lan.addr, pd2.dst, key.af); 4969 PF_ACPY(&key.ext.addr, pd2.src, key.af); 4970 key.lan.port = 0; 4971 key.ext.port = 0; 4972 } 4973 4974 STATE_LOOKUP(); 4975 4976 if (STATE_TRANSLATE(*state)) { 4977 if (direction == PF_IN) { 4978 pf_change_icmp(pd2.src, NULL, 4979 daddr, &(*state)->lan.addr, 4980 0, NULL, 4981 pd2.ip_sum, icmpsum, 4982 pd->ip_sum, 0, pd2.af); 4983 } else { 4984 pf_change_icmp(pd2.dst, NULL, 4985 saddr, &(*state)->gwy.addr, 4986 0, NULL, 4987 pd2.ip_sum, icmpsum, 4988 pd->ip_sum, 0, pd2.af); 4989 } 4990 switch (pd2.af) { 4991#ifdef INET 4992 case AF_INET: 4993 m_copyback(m, off, ICMP_MINLEN, 4994 (caddr_t)pd->hdr.icmp); 4995 m_copyback(m, ipoff2, sizeof(h2), 4996 (caddr_t)&h2); 4997 break; 4998#endif /* INET */ 4999#ifdef INET6 5000 case AF_INET6: 5001 m_copyback(m, off, 5002 sizeof(struct icmp6_hdr), 5003 (caddr_t)pd->hdr.icmp6); 5004 m_copyback(m, ipoff2, sizeof(h2_6), 5005 (caddr_t)&h2_6); 5006 break; 5007#endif /* INET6 */ 5008 } 5009 } 5010 5011 return (PF_PASS); 5012 break; 5013 } 5014 } 5015 } 5016} 5017 5018int 5019pf_test_state_other(struct pf_state **state, int direction, struct pfi_kif *kif, 5020 struct pf_pdesc *pd) 5021{ 5022 struct pf_state_peer *src, *dst; 5023 struct pf_state key; 5024 5025 key.af = pd->af; 5026 key.proto = pd->proto; 5027 if (direction == PF_IN) { 5028 PF_ACPY(&key.ext.addr, pd->src, key.af); 5029 PF_ACPY(&key.gwy.addr, pd->dst, key.af); 5030 key.ext.port = 0; 5031 key.gwy.port = 0; 5032 } else { 5033 PF_ACPY(&key.lan.addr, pd->src, key.af); 5034 PF_ACPY(&key.ext.addr, pd->dst, key.af); 5035 key.lan.port = 0; 5036 key.ext.port = 0; 5037 } 5038 5039 STATE_LOOKUP(); 5040 5041 if (direction == (*state)->direction) { 5042 src = &(*state)->src; 5043 dst = &(*state)->dst; 5044 } else { 5045 src = &(*state)->dst; 5046 dst = &(*state)->src; 5047 } 5048 5049 /* update states */ 5050 if (src->state < PFOTHERS_SINGLE) 5051 src->state = PFOTHERS_SINGLE; 5052 if (dst->state == PFOTHERS_SINGLE) 5053 dst->state = PFOTHERS_MULTIPLE; 5054 5055 /* update expire time */ 5056#ifdef __FreeBSD__ 5057 (*state)->expire = time_second; 5058#else 5059 (*state)->expire = time.tv_sec; 5060#endif 5061 if (src->state == PFOTHERS_MULTIPLE && dst->state == PFOTHERS_MULTIPLE) 5062 (*state)->timeout = PFTM_OTHER_MULTIPLE; 5063 else 5064 (*state)->timeout = PFTM_OTHER_SINGLE; 5065 5066 /* translate source/destination address, if necessary */ 5067 if (STATE_TRANSLATE(*state)) { 5068 if (direction == PF_OUT) 5069 switch (pd->af) { 5070#ifdef INET 5071 case AF_INET: 5072 pf_change_a(&pd->src->v4.s_addr, 5073 pd->ip_sum, (*state)->gwy.addr.v4.s_addr, 5074 0); 5075 break; 5076#endif /* INET */ 5077#ifdef INET6 5078 case AF_INET6: 5079 PF_ACPY(pd->src, &(*state)->gwy.addr, pd->af); 5080 break; 5081#endif /* INET6 */ 5082 } 5083 else 5084 switch (pd->af) { 5085#ifdef INET 5086 case AF_INET: 5087 pf_change_a(&pd->dst->v4.s_addr, 5088 pd->ip_sum, (*state)->lan.addr.v4.s_addr, 5089 0); 5090 break; 5091#endif /* INET */ 5092#ifdef INET6 5093 case AF_INET6: 5094 PF_ACPY(pd->dst, &(*state)->lan.addr, pd->af); 5095 break; 5096#endif /* INET6 */ 5097 } 5098 } 5099 5100 return (PF_PASS); 5101} 5102 5103/* 5104 * ipoff and off are measured from the start of the mbuf chain. 5105 * h must be at "ipoff" on the mbuf chain. 5106 */ 5107void * 5108pf_pull_hdr(struct mbuf *m, int off, void *p, int len, 5109 u_short *actionp, u_short *reasonp, sa_family_t af) 5110{ 5111 switch (af) { 5112#ifdef INET 5113 case AF_INET: { 5114 struct ip *h = mtod(m, struct ip *); 5115 u_int16_t fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3; 5116 5117 if (fragoff) { 5118 if (fragoff >= len) 5119 ACTION_SET(actionp, PF_PASS); 5120 else { 5121 ACTION_SET(actionp, PF_DROP); 5122 REASON_SET(reasonp, PFRES_FRAG); 5123 } 5124 return (NULL); 5125 } 5126 if (m->m_pkthdr.len < off + len || 5127 ntohs(h->ip_len) < off + len) { 5128 ACTION_SET(actionp, PF_DROP); 5129 REASON_SET(reasonp, PFRES_SHORT); 5130 return (NULL); 5131 } 5132 break; 5133 } 5134#endif /* INET */ 5135#ifdef INET6 5136 case AF_INET6: { 5137 struct ip6_hdr *h = mtod(m, struct ip6_hdr *); 5138 5139 if (m->m_pkthdr.len < off + len || 5140 (ntohs(h->ip6_plen) + sizeof(struct ip6_hdr)) < 5141 (unsigned)(off + len)) { 5142 ACTION_SET(actionp, PF_DROP); 5143 REASON_SET(reasonp, PFRES_SHORT); 5144 return (NULL); 5145 } 5146 break; 5147 } 5148#endif /* INET6 */ 5149 } 5150 m_copydata(m, off, len, p); 5151 return (p); 5152} 5153 5154int 5155pf_routable(struct pf_addr *addr, sa_family_t af) 5156{ 5157 struct sockaddr_in *dst; 5158 struct route ro; 5159 int ret = 0; 5160 5161 bzero(&ro, sizeof(ro)); 5162 dst = satosin(&ro.ro_dst); 5163 dst->sin_family = af; 5164 dst->sin_len = sizeof(*dst); 5165 dst->sin_addr = addr->v4; 5166#ifdef __FreeBSD__ 5167#ifdef RTF_PRCLONING 5168 rtalloc_ign(&ro, (RTF_CLONING|RTF_PRCLONING)); 5169#else /* !RTF_PRCLONING */ 5170 rtalloc_ign(&ro, RTF_CLONING); 5171#endif 5172#else /* ! __FreeBSD__ */ 5173 rtalloc_noclone(&ro, NO_CLONING); 5174#endif 5175 5176 if (ro.ro_rt != NULL) { 5177 ret = 1; 5178 RTFREE(ro.ro_rt); 5179 } 5180 5181 return (ret); 5182} 5183 5184#ifdef INET 5185 5186void 5187pf_route(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp, 5188 struct pf_state *s) 5189{ 5190 struct mbuf *m0, *m1; 5191 struct m_tag *mtag; 5192 struct route iproute; 5193 struct route *ro = NULL; /* XXX: was uninitialized */ 5194 struct sockaddr_in *dst; 5195 struct ip *ip; 5196 struct ifnet *ifp = NULL; 5197 struct pf_addr naddr; 5198 struct pf_src_node *sn = NULL; 5199 int error = 0; 5200#ifdef __FreeBSD__ 5201 int sw_csum; 5202#endif 5203 5204 if (m == NULL || *m == NULL || r == NULL || 5205 (dir != PF_IN && dir != PF_OUT) || oifp == NULL) 5206 panic("pf_route: invalid parameters"); 5207 5208 if ((mtag = m_tag_find(*m, PACKET_TAG_PF_ROUTED, NULL)) == NULL) { 5209 if ((mtag = m_tag_get(PACKET_TAG_PF_ROUTED, 1, M_NOWAIT)) == 5210 NULL) { 5211 m0 = *m; 5212 *m = NULL; 5213 goto bad; 5214 } 5215 *(char *)(mtag + 1) = 1; 5216 m_tag_prepend(*m, mtag); 5217 } else { 5218 if (*(char *)(mtag + 1) > 3) { 5219 m0 = *m; 5220 *m = NULL; 5221 goto bad; 5222 } 5223 (*(char *)(mtag + 1))++; 5224 } 5225 5226 if (r->rt == PF_DUPTO) { 5227#ifdef __FreeBSD__ 5228 if ((m0 = m_dup(*m, M_DONTWAIT)) == NULL) 5229#else 5230 if ((m0 = m_copym2(*m, 0, M_COPYALL, M_NOWAIT)) == NULL) 5231#endif 5232 return; 5233#ifdef __FreeBSD__ 5234 if ((mtag = m_tag_copy(mtag, M_DONTWAIT)) == NULL) 5235#else 5236 if ((mtag = m_tag_copy(mtag)) == NULL) 5237#endif 5238 goto bad; 5239 m_tag_prepend(m0, mtag); 5240 } else { 5241 if ((r->rt == PF_REPLYTO) == (r->direction == dir)) 5242 return; 5243 m0 = *m; 5244 } 5245 5246 if (m0->m_len < sizeof(struct ip)) 5247 panic("pf_route: m0->m_len < sizeof(struct ip)"); 5248 ip = mtod(m0, struct ip *); 5249 5250 ro = &iproute; 5251 bzero((caddr_t)ro, sizeof(*ro)); 5252 dst = satosin(&ro->ro_dst); 5253 dst->sin_family = AF_INET; 5254 dst->sin_len = sizeof(*dst); 5255 dst->sin_addr = ip->ip_dst; 5256 5257 if (r->rt == PF_FASTROUTE) { 5258 rtalloc(ro); 5259 if (ro->ro_rt == 0) { 5260 ipstat.ips_noroute++; 5261 goto bad; 5262 } 5263 5264 ifp = ro->ro_rt->rt_ifp; 5265 ro->ro_rt->rt_use++; 5266 5267 if (ro->ro_rt->rt_flags & RTF_GATEWAY) 5268 dst = satosin(ro->ro_rt->rt_gateway); 5269 } else { 5270 if (TAILQ_EMPTY(&r->rpool.list)) 5271 panic("pf_route: TAILQ_EMPTY(&r->rpool.list)"); 5272 if (s == NULL) { 5273 pf_map_addr(AF_INET, r, (struct pf_addr *)&ip->ip_src, 5274 &naddr, NULL, &sn); 5275 if (!PF_AZERO(&naddr, AF_INET)) 5276 dst->sin_addr.s_addr = naddr.v4.s_addr; 5277 ifp = r->rpool.cur->kif ? 5278 r->rpool.cur->kif->pfik_ifp : NULL; 5279 } else { 5280 if (!PF_AZERO(&s->rt_addr, AF_INET)) 5281 dst->sin_addr.s_addr = 5282 s->rt_addr.v4.s_addr; 5283 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL; 5284 } 5285 } 5286 if (ifp == NULL) 5287 goto bad; 5288 5289 if (oifp != ifp) { 5290#ifdef __FreeBSD__ 5291 PF_UNLOCK(); 5292 if (pf_test(PF_OUT, ifp, &m0, NULL) != PF_PASS) { 5293 PF_LOCK(); 5294 goto bad; 5295 } else if (m0 == NULL) { 5296 PF_LOCK(); 5297 goto done; 5298 } 5299 PF_LOCK(); 5300#else 5301 if (pf_test(PF_OUT, ifp, &m0) != PF_PASS) 5302 goto bad; 5303 else if (m0 == NULL) 5304 goto done; 5305#endif 5306 if (m0->m_len < sizeof(struct ip)) 5307 panic("pf_route: m0->m_len < sizeof(struct ip)"); 5308 ip = mtod(m0, struct ip *); 5309 } 5310 5311#ifdef __FreeBSD__ 5312 /* Copied from FreeBSD 5.1-CURRENT ip_output. */ 5313 m0->m_pkthdr.csum_flags |= CSUM_IP; 5314 sw_csum = m0->m_pkthdr.csum_flags & ~ifp->if_hwassist; 5315 if (sw_csum & CSUM_DELAY_DATA) { 5316 /* 5317 * XXX: in_delayed_cksum assumes HBO for ip->ip_len (at least) 5318 */ 5319 NTOHS(ip->ip_len); 5320 NTOHS(ip->ip_off); /* XXX: needed? */ 5321 in_delayed_cksum(m0); 5322 HTONS(ip->ip_len); 5323 HTONS(ip->ip_off); 5324 sw_csum &= ~CSUM_DELAY_DATA; 5325 } 5326 m0->m_pkthdr.csum_flags &= ifp->if_hwassist; 5327 5328 if (ntohs(ip->ip_len) <= ifp->if_mtu || 5329 (ifp->if_hwassist & CSUM_FRAGMENT && 5330 ((ip->ip_off & htons(IP_DF)) == 0))) { 5331 /* 5332 * ip->ip_len = htons(ip->ip_len); 5333 * ip->ip_off = htons(ip->ip_off); 5334 */ 5335 ip->ip_sum = 0; 5336 if (sw_csum & CSUM_DELAY_IP) { 5337 /* From KAME */ 5338 if (ip->ip_v == IPVERSION && 5339 (ip->ip_hl << 2) == sizeof(*ip)) { 5340 ip->ip_sum = in_cksum_hdr(ip); 5341 } else { 5342 ip->ip_sum = in_cksum(m0, ip->ip_hl << 2); 5343 } 5344 } 5345 PF_UNLOCK(); 5346 error = (*ifp->if_output)(ifp, m0, sintosa(dst), ro->ro_rt); 5347 PF_LOCK(); 5348 goto done; 5349 } 5350 5351#else 5352 /* Copied from ip_output. */ 5353#ifdef IPSEC 5354 /* 5355 * If deferred crypto processing is needed, check that the 5356 * interface supports it. 5357 */ 5358 if ((mtag = m_tag_find(m0, PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED, NULL)) 5359 != NULL && (ifp->if_capabilities & IFCAP_IPSEC) == 0) { 5360 /* Notify IPsec to do its own crypto. */ 5361 ipsp_skipcrypto_unmark((struct tdb_ident *)(mtag + 1)); 5362 goto bad; 5363 } 5364#endif /* IPSEC */ 5365 5366 /* Catch routing changes wrt. hardware checksumming for TCP or UDP. */ 5367 if (m0->m_pkthdr.csum & M_TCPV4_CSUM_OUT) { 5368 if (!(ifp->if_capabilities & IFCAP_CSUM_TCPv4) || 5369 ifp->if_bridge != NULL) { 5370 in_delayed_cksum(m0); 5371 m0->m_pkthdr.csum &= ~M_TCPV4_CSUM_OUT; /* Clear */ 5372 } 5373 } else if (m0->m_pkthdr.csum & M_UDPV4_CSUM_OUT) { 5374 if (!(ifp->if_capabilities & IFCAP_CSUM_UDPv4) || 5375 ifp->if_bridge != NULL) { 5376 in_delayed_cksum(m0); 5377 m0->m_pkthdr.csum &= ~M_UDPV4_CSUM_OUT; /* Clear */ 5378 } 5379 } 5380 5381 if (ntohs(ip->ip_len) <= ifp->if_mtu) { 5382 if ((ifp->if_capabilities & IFCAP_CSUM_IPv4) && 5383 ifp->if_bridge == NULL) { 5384 m0->m_pkthdr.csum |= M_IPV4_CSUM_OUT; 5385 ipstat.ips_outhwcsum++; 5386 } else { 5387 ip->ip_sum = 0; 5388 ip->ip_sum = in_cksum(m0, ip->ip_hl << 2); 5389 } 5390 /* Update relevant hardware checksum stats for TCP/UDP */ 5391 if (m0->m_pkthdr.csum & M_TCPV4_CSUM_OUT) 5392 tcpstat.tcps_outhwcsum++; 5393 else if (m0->m_pkthdr.csum & M_UDPV4_CSUM_OUT) 5394 udpstat.udps_outhwcsum++; 5395 error = (*ifp->if_output)(ifp, m0, sintosa(dst), NULL); 5396 goto done; 5397 } 5398#endif 5399 /* 5400 * Too large for interface; fragment if possible. 5401 * Must be able to put at least 8 bytes per fragment. 5402 */ 5403 if (ip->ip_off & htons(IP_DF)) { 5404 ipstat.ips_cantfrag++; 5405 if (r->rt != PF_DUPTO) { 5406#ifdef __FreeBSD__ 5407 /* icmp_error() expects host byte ordering */ 5408 NTOHS(ip->ip_len); 5409 NTOHS(ip->ip_off); 5410 PF_UNLOCK(); 5411#endif 5412 icmp_error(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 0, 5413 ifp); 5414#ifdef __FreeBSD__ 5415 PF_LOCK(); 5416#endif 5417 goto done; 5418 } else 5419 goto bad; 5420 } 5421 5422 m1 = m0; 5423#ifdef __FreeBSD__ 5424 /* 5425 * XXX: is cheaper + less error prone than own function 5426 */ 5427 NTOHS(ip->ip_len); 5428 NTOHS(ip->ip_off); 5429 error = ip_fragment(ip, &m0, ifp->if_mtu, ifp->if_hwassist, sw_csum); 5430#else 5431 error = ip_fragment(m0, ifp, ifp->if_mtu); 5432#endif 5433 if (error) { 5434#ifndef __FreeBSD__ /* ip_fragment does not do m_freem() on FreeBSD */ 5435 m0 = NULL; 5436#endif 5437 goto bad; 5438 } 5439 5440 for (m0 = m1; m0; m0 = m1) { 5441 m1 = m0->m_nextpkt; 5442 m0->m_nextpkt = 0; 5443#ifdef __FreeBSD__ 5444 if (error == 0) { 5445 PF_UNLOCK(); 5446 error = (*ifp->if_output)(ifp, m0, sintosa(dst), 5447 NULL); 5448 PF_LOCK(); 5449 } else 5450#else 5451 if (error == 0) 5452 error = (*ifp->if_output)(ifp, m0, sintosa(dst), 5453 NULL); 5454 else 5455#endif 5456 m_freem(m0); 5457 } 5458 5459 if (error == 0) 5460 ipstat.ips_fragmented++; 5461 5462done: 5463 if (r->rt != PF_DUPTO) 5464 *m = NULL; 5465 if (ro == &iproute && ro->ro_rt) 5466 RTFREE(ro->ro_rt); 5467 return; 5468 5469bad: 5470 m_freem(m0); 5471 goto done; 5472} 5473#endif /* INET */ 5474 5475#ifdef INET6 5476void 5477pf_route6(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp, 5478 struct pf_state *s) 5479{ 5480 struct mbuf *m0; 5481 struct m_tag *mtag; 5482 struct route_in6 ip6route; 5483 struct route_in6 *ro; 5484 struct sockaddr_in6 *dst; 5485 struct ip6_hdr *ip6; 5486 struct ifnet *ifp = NULL; 5487 struct pf_addr naddr; 5488 struct pf_src_node *sn = NULL; 5489 int error = 0; 5490 5491 if (m == NULL || *m == NULL || r == NULL || 5492 (dir != PF_IN && dir != PF_OUT) || oifp == NULL) 5493 panic("pf_route6: invalid parameters"); 5494 5495 if ((mtag = m_tag_find(*m, PACKET_TAG_PF_ROUTED, NULL)) == NULL) { 5496 if ((mtag = m_tag_get(PACKET_TAG_PF_ROUTED, 1, M_NOWAIT)) == 5497 NULL) { 5498 m0 = *m; 5499 *m = NULL; 5500 goto bad; 5501 } 5502 *(char *)(mtag + 1) = 1; 5503 m_tag_prepend(*m, mtag); 5504 } else { 5505 if (*(char *)(mtag + 1) > 3) { 5506 m0 = *m; 5507 *m = NULL; 5508 goto bad; 5509 } 5510 (*(char *)(mtag + 1))++; 5511 } 5512 5513 if (r->rt == PF_DUPTO) { 5514#ifdef __FreeBSD__ 5515 if ((m0 = m_dup(*m, M_DONTWAIT)) == NULL) 5516#else 5517 if ((m0 = m_copym2(*m, 0, M_COPYALL, M_NOWAIT)) == NULL) 5518#endif 5519 return; 5520#ifdef __FreeBSD__ 5521 if ((mtag = m_tag_copy(mtag, M_DONTWAIT)) == NULL) 5522#else 5523 if ((mtag = m_tag_copy(mtag)) == NULL) 5524#endif 5525 goto bad; 5526 m_tag_prepend(m0, mtag); 5527 } else { 5528 if ((r->rt == PF_REPLYTO) == (r->direction == dir)) 5529 return; 5530 m0 = *m; 5531 } 5532 5533 if (m0->m_len < sizeof(struct ip6_hdr)) 5534 panic("pf_route6: m0->m_len < sizeof(struct ip6_hdr)"); 5535 ip6 = mtod(m0, struct ip6_hdr *); 5536 5537 ro = &ip6route; 5538 bzero((caddr_t)ro, sizeof(*ro)); 5539 dst = (struct sockaddr_in6 *)&ro->ro_dst; 5540 dst->sin6_family = AF_INET6; 5541 dst->sin6_len = sizeof(*dst); 5542 dst->sin6_addr = ip6->ip6_dst; 5543 5544 /* Cheat. */ 5545 if (r->rt == PF_FASTROUTE) { 5546#ifdef __FreeBSD__ 5547 m0->m_flags |= M_SKIP_FIREWALL; 5548 PF_UNLOCK(); 5549 ip6_output(m0, NULL, NULL, 0, NULL, NULL, NULL); 5550 PF_LOCK(); 5551#else 5552 mtag = m_tag_get(PACKET_TAG_PF_GENERATED, 0, M_NOWAIT); 5553 if (mtag == NULL) 5554 goto bad; 5555 m_tag_prepend(m0, mtag); 5556 ip6_output(m0, NULL, NULL, 0, NULL, NULL); 5557#endif 5558 return; 5559 } 5560 5561 if (TAILQ_EMPTY(&r->rpool.list)) 5562 panic("pf_route6: TAILQ_EMPTY(&r->rpool.list)"); 5563 if (s == NULL) { 5564 pf_map_addr(AF_INET6, r, (struct pf_addr *)&ip6->ip6_src, 5565 &naddr, NULL, &sn); 5566 if (!PF_AZERO(&naddr, AF_INET6)) 5567 PF_ACPY((struct pf_addr *)&dst->sin6_addr, 5568 &naddr, AF_INET6); 5569 ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL; 5570 } else { 5571 if (!PF_AZERO(&s->rt_addr, AF_INET6)) 5572 PF_ACPY((struct pf_addr *)&dst->sin6_addr, 5573 &s->rt_addr, AF_INET6); 5574 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL; 5575 } 5576 if (ifp == NULL) 5577 goto bad; 5578 5579 if (oifp != ifp) { 5580#ifdef __FreeBSD__ 5581 PF_UNLOCK(); 5582 if (pf_test6(PF_OUT, ifp, &m0, NULL) != PF_PASS) { 5583 PF_LOCK(); 5584 goto bad; 5585 } else if (m0 == NULL) { 5586 PF_LOCK(); 5587 goto done; 5588 } 5589 PF_LOCK(); 5590#else 5591 if (pf_test6(PF_OUT, ifp, &m0) != PF_PASS) 5592 goto bad; 5593 else if (m0 == NULL) 5594 goto done; 5595#endif 5596 if (m0->m_len < sizeof(struct ip6_hdr)) 5597 panic("pf_route6: m0->m_len < sizeof(struct ip6_hdr)"); 5598 ip6 = mtod(m0, struct ip6_hdr *); 5599 } 5600 5601 /* 5602 * If the packet is too large for the outgoing interface, 5603 * send back an icmp6 error. 5604 */ 5605 if (IN6_IS_ADDR_LINKLOCAL(&dst->sin6_addr)) 5606 dst->sin6_addr.s6_addr16[1] = htons(ifp->if_index); 5607 if ((u_long)m0->m_pkthdr.len <= ifp->if_mtu) { 5608#ifdef __FreeBSD__ 5609 PF_UNLOCK(); 5610#endif 5611 error = nd6_output(ifp, ifp, m0, dst, NULL); 5612#ifdef __FreeBSD__ 5613 PF_LOCK(); 5614#endif 5615 } else { 5616 in6_ifstat_inc(ifp, ifs6_in_toobig); 5617#ifdef __FreeBSD__ 5618 if (r->rt != PF_DUPTO) { 5619 PF_UNLOCK(); 5620 icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu); 5621 PF_LOCK(); 5622 } else 5623#else 5624 if (r->rt != PF_DUPTO) 5625 icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu); 5626 else 5627#endif 5628 goto bad; 5629 } 5630 5631done: 5632 if (r->rt != PF_DUPTO) 5633 *m = NULL; 5634 return; 5635 5636bad: 5637 m_freem(m0); 5638 goto done; 5639} 5640#endif /* INET6 */ 5641 5642 5643#ifdef __FreeBSD__ 5644/* 5645 * FreeBSD supports cksum offloads for the following drivers. 5646 * em(4), fxp(4), ixgb(4), lge(4), ndis(4), nge(4), re(4), 5647 * ti(4), txp(4), xl(4) 5648 * 5649 * CSUM_DATA_VALID | CSUM_PSEUDO_HDR : 5650 * network driver performed cksum including pseudo header, need to verify 5651 * csum_data 5652 * CSUM_DATA_VALID : 5653 * network driver performed cksum, needs to additional pseudo header 5654 * cksum computation with partial csum_data(i.e. lack of H/W support for 5655 * pseudo header, for instance hme(4), sk(4) and possibly gem(4)) 5656 * 5657 * After validating the cksum of packet, set both flag CSUM_DATA_VALID and 5658 * CSUM_PSEUDO_HDR in order to avoid recomputation of the cksum in upper 5659 * TCP/UDP layer. 5660 * Also, set csum_data to 0xffff to force cksum validation. 5661 */ 5662int 5663pf_check_proto_cksum(struct mbuf *m, int off, int len, u_int8_t p, sa_family_t af) 5664{ 5665 u_int16_t sum = 0; 5666 int hw_assist = 0; 5667 struct ip *ip; 5668 5669 if (off < sizeof(struct ip) || len < sizeof(struct udphdr)) 5670 return (1); 5671 if (m->m_pkthdr.len < off + len) 5672 return (1); 5673 5674 switch (p) { 5675 case IPPROTO_TCP: 5676 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) { 5677 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) { 5678 sum = m->m_pkthdr.csum_data; 5679 } else { 5680 ip = mtod(m, struct ip *); 5681 sum = in_pseudo(ip->ip_src.s_addr, 5682 ip->ip_dst.s_addr, htonl((u_short)len + 5683 m->m_pkthdr.csum_data + IPPROTO_TCP)); 5684 } 5685 sum ^= 0xffff; 5686 ++hw_assist; 5687 } 5688 break; 5689 case IPPROTO_UDP: 5690 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) { 5691 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) { 5692 sum = m->m_pkthdr.csum_data; 5693 } else { 5694 ip = mtod(m, struct ip *); 5695 sum = in_pseudo(ip->ip_src.s_addr, 5696 ip->ip_dst.s_addr, htonl((u_short)len + 5697 m->m_pkthdr.csum_data + IPPROTO_UDP)); 5698 } 5699 sum ^= 0xffff; 5700 ++hw_assist; 5701 } 5702 break; 5703 case IPPROTO_ICMP: 5704#ifdef INET6 5705 case IPPROTO_ICMPV6: 5706#endif /* INET6 */ 5707 break; 5708 default: 5709 return (1); 5710 } 5711 5712 if (!hw_assist) { 5713 switch (af) { 5714 case AF_INET: 5715 if (p == IPPROTO_ICMP) { 5716 if (m->m_len < off) 5717 return (1); 5718 m->m_data += off; 5719 m->m_len -= off; 5720 sum = in_cksum(m, len); 5721 m->m_data -= off; 5722 m->m_len += off; 5723 } else { 5724 if (m->m_len < sizeof(struct ip)) 5725 return (1); 5726 sum = in4_cksum(m, p, off, len); 5727 } 5728 break; 5729#ifdef INET6 5730 case AF_INET6: 5731 if (m->m_len < sizeof(struct ip6_hdr)) 5732 return (1); 5733 sum = in6_cksum(m, p, off, len); 5734 break; 5735#endif /* INET6 */ 5736 default: 5737 return (1); 5738 } 5739 } 5740 if (sum) { 5741 switch (p) { 5742 case IPPROTO_TCP: 5743 tcpstat.tcps_rcvbadsum++; 5744 break; 5745 case IPPROTO_UDP: 5746 udpstat.udps_badsum++; 5747 break; 5748 case IPPROTO_ICMP: 5749 icmpstat.icps_checksum++; 5750 break; 5751#ifdef INET6 5752 case IPPROTO_ICMPV6: 5753 icmp6stat.icp6s_checksum++; 5754 break; 5755#endif /* INET6 */ 5756 } 5757 return (1); 5758 } else { 5759 if (p == IPPROTO_TCP || p == IPPROTO_UDP) { 5760 m->m_pkthdr.csum_flags |= 5761 (CSUM_DATA_VALID | CSUM_PSEUDO_HDR); 5762 m->m_pkthdr.csum_data = 0xffff; 5763 } 5764 } 5765 return (0); 5766} 5767#else 5768/* 5769 * check protocol (tcp/udp/icmp/icmp6) checksum and set mbuf flag 5770 * off is the offset where the protocol header starts 5771 * len is the total length of protocol header plus payload 5772 * returns 0 when the checksum is valid, otherwise returns 1. 5773 */ 5774int 5775pf_check_proto_cksum(struct mbuf *m, int off, int len, u_int8_t p, 5776 sa_family_t af) 5777{ 5778 u_int16_t flag_ok, flag_bad; 5779 u_int16_t sum; 5780 5781 switch (p) { 5782 case IPPROTO_TCP: 5783 flag_ok = M_TCP_CSUM_IN_OK; 5784 flag_bad = M_TCP_CSUM_IN_BAD; 5785 break; 5786 case IPPROTO_UDP: 5787 flag_ok = M_UDP_CSUM_IN_OK; 5788 flag_bad = M_UDP_CSUM_IN_BAD; 5789 break; 5790 case IPPROTO_ICMP: 5791#ifdef INET6 5792 case IPPROTO_ICMPV6: 5793#endif /* INET6 */ 5794 flag_ok = flag_bad = 0; 5795 break; 5796 default: 5797 return (1); 5798 } 5799 if (m->m_pkthdr.csum & flag_ok) 5800 return (0); 5801 if (m->m_pkthdr.csum & flag_bad) 5802 return (1); 5803 if (off < sizeof(struct ip) || len < sizeof(struct udphdr)) 5804 return (1); 5805 if (m->m_pkthdr.len < off + len) 5806 return (1); 5807 switch (af) { 5808 case AF_INET: 5809 if (p == IPPROTO_ICMP) { 5810 if (m->m_len < off) 5811 return (1); 5812 m->m_data += off; 5813 m->m_len -= off; 5814 sum = in_cksum(m, len); 5815 m->m_data -= off; 5816 m->m_len += off; 5817 } else { 5818 if (m->m_len < sizeof(struct ip)) 5819 return (1); 5820 sum = in4_cksum(m, p, off, len); 5821 } 5822 break; 5823#ifdef INET6 5824 case AF_INET6: 5825 if (m->m_len < sizeof(struct ip6_hdr)) 5826 return (1); 5827 sum = in6_cksum(m, p, off, len); 5828 break; 5829#endif /* INET6 */ 5830 default: 5831 return (1); 5832 } 5833 if (sum) { 5834 m->m_pkthdr.csum |= flag_bad; 5835 switch (p) { 5836 case IPPROTO_TCP: 5837 tcpstat.tcps_rcvbadsum++; 5838 break; 5839 case IPPROTO_UDP: 5840 udpstat.udps_badsum++; 5841 break; 5842 case IPPROTO_ICMP: 5843 icmpstat.icps_checksum++; 5844 break; 5845#ifdef INET6 5846 case IPPROTO_ICMPV6: 5847 icmp6stat.icp6s_checksum++; 5848 break; 5849#endif /* INET6 */ 5850 } 5851 return (1); 5852 } 5853 m->m_pkthdr.csum |= flag_ok; 5854 return (0); 5855} 5856#endif 5857 5858static int 5859pf_add_mbuf_tag(struct mbuf *m, u_int tag) 5860{ 5861 struct m_tag *mtag; 5862 5863 if (m_tag_find(m, tag, NULL) != NULL) 5864 return (0); 5865 mtag = m_tag_get(tag, 0, M_NOWAIT); 5866 if (mtag == NULL) 5867 return (1); 5868 m_tag_prepend(m, mtag); 5869 return (0); 5870} 5871 5872#ifdef INET 5873int 5874#ifdef __FreeBSD__ 5875pf_test(int dir, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp) 5876#else 5877pf_test(int dir, struct ifnet *ifp, struct mbuf **m0) 5878#endif 5879{ 5880 struct pfi_kif *kif; 5881 u_short action, reason = 0, log = 0; 5882 struct mbuf *m = *m0; 5883 struct ip *h = NULL; /* make the compiler happy */ 5884 struct pf_rule *a = NULL, *r = &pf_default_rule, *tr, *nr; 5885 struct pf_state *s = NULL; 5886 struct pf_ruleset *ruleset = NULL; 5887 struct pf_pdesc pd; 5888 int off, dirndx, pqid = 0; 5889 5890#ifdef __FreeBSD__ 5891 PF_LOCK(); 5892#endif 5893 if (!pf_status.running || 5894#ifdef __FreeBSD__ 5895 (m->m_flags & M_SKIP_FIREWALL)) { 5896 PF_UNLOCK(); 5897#else 5898 (m_tag_find(m, PACKET_TAG_PF_GENERATED, NULL) != NULL)) { 5899#endif 5900 return (PF_PASS); 5901 } 5902 5903 kif = pfi_index2kif[ifp->if_index]; 5904 if (kif == NULL) { 5905#ifdef __FreeBSD__ 5906 PF_UNLOCK(); 5907#endif 5908 return (PF_DROP); 5909 } 5910 5911#ifdef __FreeBSD__ 5912 M_ASSERTPKTHDR(m); 5913#else 5914#ifdef DIAGNOSTIC 5915 if ((m->m_flags & M_PKTHDR) == 0) 5916 panic("non-M_PKTHDR is passed to pf_test"); 5917#endif 5918#endif 5919 5920 memset(&pd, 0, sizeof(pd)); 5921 if (m->m_pkthdr.len < (int)sizeof(*h)) { 5922 action = PF_DROP; 5923 REASON_SET(&reason, PFRES_SHORT); 5924 log = 1; 5925 goto done; 5926 } 5927 5928 /* We do IP header normalization and packet reassembly here */ 5929 if (pf_normalize_ip(m0, dir, kif, &reason) != PF_PASS) { 5930 action = PF_DROP; 5931 goto done; 5932 } 5933 m = *m0; 5934 h = mtod(m, struct ip *); 5935 5936 off = h->ip_hl << 2; 5937 if (off < (int)sizeof(*h)) { 5938 action = PF_DROP; 5939 REASON_SET(&reason, PFRES_SHORT); 5940 log = 1; 5941 goto done; 5942 } 5943 5944 pd.src = (struct pf_addr *)&h->ip_src; 5945 pd.dst = (struct pf_addr *)&h->ip_dst; 5946 PF_ACPY(&pd.baddr, dir == PF_OUT ? pd.src : pd.dst, AF_INET); 5947 pd.ip_sum = &h->ip_sum; 5948 pd.proto = h->ip_p; 5949 pd.af = AF_INET; 5950 pd.tos = h->ip_tos; 5951 pd.tot_len = ntohs(h->ip_len); 5952 5953 /* handle fragments that didn't get reassembled by normalization */ 5954 if (h->ip_off & htons(IP_MF | IP_OFFMASK)) { 5955 action = pf_test_fragment(&r, dir, kif, m, h, 5956 &pd, &a, &ruleset); 5957 goto done; 5958 } 5959 5960 switch (h->ip_p) { 5961 5962 case IPPROTO_TCP: { 5963 struct tcphdr th; 5964 5965 pd.hdr.tcp = &th; 5966 if (!pf_pull_hdr(m, off, &th, sizeof(th), 5967 &action, &reason, AF_INET)) { 5968 log = action != PF_PASS; 5969 goto done; 5970 } 5971 if (dir == PF_IN && pf_check_proto_cksum(m, off, 5972 ntohs(h->ip_len) - off, IPPROTO_TCP, AF_INET)) { 5973 action = PF_DROP; 5974 goto done; 5975 } 5976 pd.p_len = pd.tot_len - off - (th.th_off << 2); 5977 if ((th.th_flags & TH_ACK) && pd.p_len == 0) 5978 pqid = 1; 5979 action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd); 5980 if (action == PF_DROP) 5981 goto done; 5982 action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd, 5983 &reason); 5984 if (action == PF_PASS) { 5985#if NPFSYNC 5986 pfsync_update_state(s); 5987#endif 5988 r = s->rule.ptr; 5989 a = s->anchor.ptr; 5990 log = s->log; 5991 } else if (s == NULL) 5992#ifdef __FreeBSD__ 5993 action = pf_test_tcp(&r, &s, dir, kif, 5994 m, off, h, &pd, &a, &ruleset, inp); 5995#else 5996 action = pf_test_tcp(&r, &s, dir, kif, 5997 m, off, h, &pd, &a, &ruleset); 5998#endif 5999 break; 6000 } 6001 6002 case IPPROTO_UDP: { 6003 struct udphdr uh; 6004 6005 pd.hdr.udp = &uh; 6006 if (!pf_pull_hdr(m, off, &uh, sizeof(uh), 6007 &action, &reason, AF_INET)) { 6008 log = action != PF_PASS; 6009 goto done; 6010 } 6011 if (dir == PF_IN && uh.uh_sum && pf_check_proto_cksum(m, 6012 off, ntohs(h->ip_len) - off, IPPROTO_UDP, AF_INET)) { 6013 action = PF_DROP; 6014 goto done; 6015 } 6016 if (uh.uh_dport == 0 || 6017 ntohs(uh.uh_ulen) > m->m_pkthdr.len - off || 6018 ntohs(uh.uh_ulen) < sizeof(struct udphdr)) { 6019 action = PF_DROP; 6020 goto done; 6021 } 6022 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd); 6023 if (action == PF_PASS) { 6024#if NPFSYNC 6025 pfsync_update_state(s); 6026#endif 6027 r = s->rule.ptr; 6028 a = s->anchor.ptr; 6029 log = s->log; 6030 } else if (s == NULL) 6031#ifdef __FreeBSD__ 6032 action = pf_test_udp(&r, &s, dir, kif, 6033 m, off, h, &pd, &a, &ruleset, inp); 6034#else 6035 action = pf_test_udp(&r, &s, dir, kif, 6036 m, off, h, &pd, &a, &ruleset); 6037#endif 6038 break; 6039 } 6040 6041 case IPPROTO_ICMP: { 6042 struct icmp ih; 6043 6044 pd.hdr.icmp = &ih; 6045 if (!pf_pull_hdr(m, off, &ih, ICMP_MINLEN, 6046 &action, &reason, AF_INET)) { 6047 log = action != PF_PASS; 6048 goto done; 6049 } 6050 if (dir == PF_IN && pf_check_proto_cksum(m, off, 6051 ntohs(h->ip_len) - off, IPPROTO_ICMP, AF_INET)) { 6052 action = PF_DROP; 6053 goto done; 6054 } 6055 action = pf_test_state_icmp(&s, dir, kif, m, off, h, &pd); 6056 if (action == PF_PASS) { 6057#if NPFSYNC 6058 pfsync_update_state(s); 6059#endif 6060 r = s->rule.ptr; 6061 a = s->anchor.ptr; 6062 log = s->log; 6063 } else if (s == NULL) 6064 action = pf_test_icmp(&r, &s, dir, kif, 6065 m, off, h, &pd, &a, &ruleset); 6066 break; 6067 } 6068 6069 default: 6070 action = pf_test_state_other(&s, dir, kif, &pd); 6071 if (action == PF_PASS) { 6072#if NPFSYNC 6073 pfsync_update_state(s); 6074#endif 6075 r = s->rule.ptr; 6076 a = s->anchor.ptr; 6077 log = s->log; 6078 } else if (s == NULL) 6079 action = pf_test_other(&r, &s, dir, kif, m, off, h, 6080 &pd, &a, &ruleset); 6081 break; 6082 } 6083 6084done: 6085 if (action == PF_PASS && h->ip_hl > 5 && 6086 !((s && s->allow_opts) || r->allow_opts)) { 6087 action = PF_DROP; 6088 REASON_SET(&reason, PFRES_SHORT); 6089 log = 1; 6090 DPFPRINTF(PF_DEBUG_MISC, 6091 ("pf: dropping packet with ip options\n")); 6092 } 6093 6094#ifdef ALTQ 6095 if (action == PF_PASS && r->qid) { 6096 struct m_tag *mtag; 6097 struct altq_tag *atag; 6098 6099 mtag = m_tag_get(PACKET_TAG_PF_QID, sizeof(*atag), M_NOWAIT); 6100 if (mtag != NULL) { 6101 atag = (struct altq_tag *)(mtag + 1); 6102 if (pqid || pd.tos == IPTOS_LOWDELAY) 6103 atag->qid = r->pqid; 6104 else 6105 atag->qid = r->qid; 6106 /* add hints for ecn */ 6107 atag->af = AF_INET; 6108 atag->hdr = h; 6109 m_tag_prepend(m, mtag); 6110 } 6111 } 6112#endif 6113 6114 /* 6115 * connections redirected to loopback should not match sockets 6116 * bound specifically to loopback due to security implications, 6117 * see tcp_input() and in_pcblookup_listen(). 6118 */ 6119 if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP || 6120 pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL && 6121 (s->nat_rule.ptr->action == PF_RDR || 6122 s->nat_rule.ptr->action == PF_BINAT) && 6123 (ntohl(pd.dst->v4.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET && 6124 pf_add_mbuf_tag(m, PACKET_TAG_PF_TRANSLATE_LOCALHOST)) { 6125 action = PF_DROP; 6126 REASON_SET(&reason, PFRES_MEMORY); 6127 } 6128 6129 if (log) 6130 PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, r, a, ruleset); 6131 6132 kif->pfik_bytes[0][dir == PF_OUT][action != PF_PASS] += pd.tot_len; 6133 kif->pfik_packets[0][dir == PF_OUT][action != PF_PASS]++; 6134 6135 if (action == PF_PASS || r->action == PF_DROP) { 6136 r->packets++; 6137 r->bytes += pd.tot_len; 6138 if (a != NULL) { 6139 a->packets++; 6140 a->bytes += pd.tot_len; 6141 } 6142 if (s != NULL) { 6143 dirndx = (dir == s->direction) ? 0 : 1; 6144 s->packets[dirndx]++; 6145 s->bytes[dirndx] += pd.tot_len; 6146 if (s->nat_rule.ptr != NULL) { 6147 s->nat_rule.ptr->packets++; 6148 s->nat_rule.ptr->bytes += pd.tot_len; 6149 } 6150 if (s->src_node != NULL) { 6151 s->src_node->packets++; 6152 s->src_node->bytes += pd.tot_len; 6153 } 6154 if (s->nat_src_node != NULL) { 6155 s->nat_src_node->packets++; 6156 s->nat_src_node->bytes += pd.tot_len; 6157 } 6158 } 6159 tr = r; 6160 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule; 6161 if (nr != NULL) { 6162 struct pf_addr *x; 6163 /* 6164 * XXX: we need to make sure that the addresses 6165 * passed to pfr_update_stats() are the same than 6166 * the addresses used during matching (pfr_match) 6167 */ 6168 if (r == &pf_default_rule) { 6169 tr = nr; 6170 x = (s == NULL || s->direction == dir) ? 6171 &pd.baddr : &pd.naddr; 6172 } else 6173 x = (s == NULL || s->direction == dir) ? 6174 &pd.naddr : &pd.baddr; 6175 if (x == &pd.baddr || s == NULL) { 6176 /* we need to change the address */ 6177 if (dir == PF_OUT) 6178 pd.src = x; 6179 else 6180 pd.dst = x; 6181 } 6182 } 6183 if (tr->src.addr.type == PF_ADDR_TABLE) 6184 pfr_update_stats(tr->src.addr.p.tbl, (s == NULL || 6185 s->direction == dir) ? pd.src : pd.dst, pd.af, 6186 pd.tot_len, dir == PF_OUT, r->action == PF_PASS, 6187 tr->src.not); 6188 if (tr->dst.addr.type == PF_ADDR_TABLE) 6189 pfr_update_stats(tr->dst.addr.p.tbl, (s == NULL || 6190 s->direction == dir) ? pd.dst : pd.src, pd.af, 6191 pd.tot_len, dir == PF_OUT, r->action == PF_PASS, 6192 tr->dst.not); 6193 } 6194 6195 6196 if (action == PF_SYNPROXY_DROP) { 6197 m_freem(*m0); 6198 *m0 = NULL; 6199 action = PF_PASS; 6200 } else if (r->rt) 6201 /* pf_route can free the mbuf causing *m0 to become NULL */ 6202 pf_route(m0, r, dir, ifp, s); 6203 6204#ifdef __FreeBSD__ 6205 PF_UNLOCK(); 6206#endif 6207 6208 return (action); 6209} 6210#endif /* INET */ 6211 6212#ifdef INET6 6213int 6214#ifdef __FreeBSD__ 6215pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp) 6216#else 6217pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0) 6218#endif 6219{ 6220 struct pfi_kif *kif; 6221 u_short action, reason = 0, log = 0; 6222 struct mbuf *m = *m0; 6223 struct ip6_hdr *h = NULL; /* make the compiler happy */ 6224 struct pf_rule *a = NULL, *r = &pf_default_rule, *tr, *nr; 6225 struct pf_state *s = NULL; 6226 struct pf_ruleset *ruleset = NULL; 6227 struct pf_pdesc pd; 6228 int off, terminal = 0, dirndx; 6229 6230#ifdef __FreeBSD__ 6231 PF_LOCK(); 6232#endif 6233 6234 if (!pf_status.running || 6235#ifdef __FreeBSD__ 6236 (m->m_flags & M_SKIP_FIREWALL)) { 6237 PF_UNLOCK(); 6238#else 6239 (m_tag_find(m, PACKET_TAG_PF_GENERATED, NULL) != NULL)) { 6240#endif 6241 return (PF_PASS); 6242 } 6243 6244 kif = pfi_index2kif[ifp->if_index]; 6245 if (kif == NULL) { 6246#ifdef __FreeBSD__ 6247 PF_UNLOCK(); 6248#endif 6249 return (PF_DROP); 6250 } 6251 6252#ifdef __FreeBSD__ 6253 M_ASSERTPKTHDR(m); 6254#else 6255#ifdef DIAGNOSTIC 6256 if ((m->m_flags & M_PKTHDR) == 0) 6257 panic("non-M_PKTHDR is passed to pf_test"); 6258#endif 6259#endif 6260 6261 memset(&pd, 0, sizeof(pd)); 6262 if (m->m_pkthdr.len < (int)sizeof(*h)) { 6263 action = PF_DROP; 6264 REASON_SET(&reason, PFRES_SHORT); 6265 log = 1; 6266 goto done; 6267 } 6268 6269 /* We do IP header normalization and packet reassembly here */ 6270 if (pf_normalize_ip6(m0, dir, kif, &reason) != PF_PASS) { 6271 action = PF_DROP; 6272 goto done; 6273 } 6274 m = *m0; 6275 h = mtod(m, struct ip6_hdr *); 6276 6277 pd.src = (struct pf_addr *)&h->ip6_src; 6278 pd.dst = (struct pf_addr *)&h->ip6_dst; 6279 PF_ACPY(&pd.baddr, dir == PF_OUT ? pd.src : pd.dst, AF_INET6); 6280 pd.ip_sum = NULL; 6281 pd.af = AF_INET6; 6282 pd.tos = 0; 6283 pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr); 6284 6285 off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr); 6286 pd.proto = h->ip6_nxt; 6287 do { 6288 switch (pd.proto) { 6289 case IPPROTO_FRAGMENT: 6290 action = pf_test_fragment(&r, dir, kif, m, h, 6291 &pd, &a, &ruleset); 6292 if (action == PF_DROP) 6293 REASON_SET(&reason, PFRES_FRAG); 6294 goto done; 6295 case IPPROTO_AH: 6296 case IPPROTO_HOPOPTS: 6297 case IPPROTO_ROUTING: 6298 case IPPROTO_DSTOPTS: { 6299 /* get next header and header length */ 6300 struct ip6_ext opt6; 6301 6302 if (!pf_pull_hdr(m, off, &opt6, sizeof(opt6), 6303 NULL, NULL, pd.af)) { 6304 DPFPRINTF(PF_DEBUG_MISC, 6305 ("pf: IPv6 short opt\n")); 6306 action = PF_DROP; 6307 REASON_SET(&reason, PFRES_SHORT); 6308 log = 1; 6309 goto done; 6310 } 6311 if (pd.proto == IPPROTO_AH) 6312 off += (opt6.ip6e_len + 2) * 4; 6313 else 6314 off += (opt6.ip6e_len + 1) * 8; 6315 pd.proto = opt6.ip6e_nxt; 6316 /* goto the next header */ 6317 break; 6318 } 6319 default: 6320 terminal++; 6321 break; 6322 } 6323 } while (!terminal); 6324 6325 switch (pd.proto) { 6326 6327 case IPPROTO_TCP: { 6328 struct tcphdr th; 6329 6330 pd.hdr.tcp = &th; 6331 if (!pf_pull_hdr(m, off, &th, sizeof(th), 6332 &action, &reason, AF_INET6)) { 6333 log = action != PF_PASS; 6334 goto done; 6335 } 6336 if (dir == PF_IN && pf_check_proto_cksum(m, off, 6337 ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)), 6338 IPPROTO_TCP, AF_INET6)) { 6339 action = PF_DROP; 6340 goto done; 6341 } 6342 pd.p_len = pd.tot_len - off - (th.th_off << 2); 6343 action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd); 6344 if (action == PF_DROP) 6345 goto done; 6346 action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd, 6347 &reason); 6348 if (action == PF_PASS) { 6349#if NPFSYNC 6350 pfsync_update_state(s); 6351#endif 6352 r = s->rule.ptr; 6353 a = s->anchor.ptr; 6354 log = s->log; 6355 } else if (s == NULL) 6356#ifdef __FreeBSD__ 6357 action = pf_test_tcp(&r, &s, dir, kif, 6358 m, off, h, &pd, &a, &ruleset, inp); 6359#else 6360 action = pf_test_tcp(&r, &s, dir, kif, 6361 m, off, h, &pd, &a, &ruleset); 6362#endif 6363 break; 6364 } 6365 6366 case IPPROTO_UDP: { 6367 struct udphdr uh; 6368 6369 pd.hdr.udp = &uh; 6370 if (!pf_pull_hdr(m, off, &uh, sizeof(uh), 6371 &action, &reason, AF_INET6)) { 6372 log = action != PF_PASS; 6373 goto done; 6374 } 6375 if (dir == PF_IN && uh.uh_sum && pf_check_proto_cksum(m, 6376 off, ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)), 6377 IPPROTO_UDP, AF_INET6)) { 6378 action = PF_DROP; 6379 goto done; 6380 } 6381 if (uh.uh_dport == 0 || 6382 ntohs(uh.uh_ulen) > m->m_pkthdr.len - off || 6383 ntohs(uh.uh_ulen) < sizeof(struct udphdr)) { 6384 action = PF_DROP; 6385 goto done; 6386 } 6387 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd); 6388 if (action == PF_PASS) { 6389#if NPFSYNC 6390 pfsync_update_state(s); 6391#endif 6392 r = s->rule.ptr; 6393 a = s->anchor.ptr; 6394 log = s->log; 6395 } else if (s == NULL) 6396#ifdef __FreeBSD__ 6397 action = pf_test_udp(&r, &s, dir, kif, 6398 m, off, h, &pd, &a, &ruleset, inp); 6399#else 6400 action = pf_test_udp(&r, &s, dir, kif, 6401 m, off, h, &pd, &a, &ruleset); 6402#endif 6403 break; 6404 } 6405 6406 case IPPROTO_ICMPV6: { 6407 struct icmp6_hdr ih; 6408 6409 pd.hdr.icmp6 = &ih; 6410 if (!pf_pull_hdr(m, off, &ih, sizeof(ih), 6411 &action, &reason, AF_INET6)) { 6412 log = action != PF_PASS; 6413 goto done; 6414 } 6415 if (dir == PF_IN && pf_check_proto_cksum(m, off, 6416 ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)), 6417 IPPROTO_ICMPV6, AF_INET6)) { 6418 action = PF_DROP; 6419 goto done; 6420 } 6421 action = pf_test_state_icmp(&s, dir, kif, 6422 m, off, h, &pd); 6423 if (action == PF_PASS) { 6424#if NPFSYNC 6425 pfsync_update_state(s); 6426#endif 6427 r = s->rule.ptr; 6428 a = s->anchor.ptr; 6429 log = s->log; 6430 } else if (s == NULL) 6431 action = pf_test_icmp(&r, &s, dir, kif, 6432 m, off, h, &pd, &a, &ruleset); 6433 break; 6434 } 6435 6436 default: 6437 action = pf_test_state_other(&s, dir, kif, &pd); 6438 if (action == PF_PASS) { 6439 r = s->rule.ptr; 6440 a = s->anchor.ptr; 6441 log = s->log; 6442 } else if (s == NULL) 6443 action = pf_test_other(&r, &s, dir, kif, m, off, h, 6444 &pd, &a, &ruleset); 6445 break; 6446 } 6447 6448done: 6449 /* XXX handle IPv6 options, if not allowed. not implemented. */ 6450 6451#ifdef ALTQ 6452 if (action == PF_PASS && r->qid) { 6453 struct m_tag *mtag; 6454 struct altq_tag *atag; 6455 6456 mtag = m_tag_get(PACKET_TAG_PF_QID, sizeof(*atag), M_NOWAIT); 6457 if (mtag != NULL) { 6458 atag = (struct altq_tag *)(mtag + 1); 6459 if (pd.tos == IPTOS_LOWDELAY) 6460 atag->qid = r->pqid; 6461 else 6462 atag->qid = r->qid; 6463 /* add hints for ecn */ 6464 atag->af = AF_INET6; 6465 atag->hdr = h; 6466 m_tag_prepend(m, mtag); 6467 } 6468 } 6469#endif 6470 6471 if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP || 6472 pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL && 6473 (s->nat_rule.ptr->action == PF_RDR || 6474 s->nat_rule.ptr->action == PF_BINAT) && 6475 IN6_IS_ADDR_LOOPBACK(&pd.dst->v6) && 6476 pf_add_mbuf_tag(m, PACKET_TAG_PF_TRANSLATE_LOCALHOST)) { 6477 action = PF_DROP; 6478 REASON_SET(&reason, PFRES_MEMORY); 6479 } 6480 6481 if (log) 6482 PFLOG_PACKET(kif, h, m, AF_INET6, dir, reason, r, a, ruleset); 6483 6484 kif->pfik_bytes[1][dir == PF_OUT][action != PF_PASS] += pd.tot_len; 6485 kif->pfik_packets[1][dir == PF_OUT][action != PF_PASS]++; 6486 6487 if (action == PF_PASS || r->action == PF_DROP) { 6488 r->packets++; 6489 r->bytes += pd.tot_len; 6490 if (a != NULL) { 6491 a->packets++; 6492 a->bytes += pd.tot_len; 6493 } 6494 if (s != NULL) { 6495 dirndx = (dir == s->direction) ? 0 : 1; 6496 s->packets[dirndx]++; 6497 s->bytes[dirndx] += pd.tot_len; 6498 if (s->nat_rule.ptr != NULL) { 6499 s->nat_rule.ptr->packets++; 6500 s->nat_rule.ptr->bytes += pd.tot_len; 6501 } 6502 if (s->src_node != NULL) { 6503 s->src_node->packets++; 6504 s->src_node->bytes += pd.tot_len; 6505 } 6506 if (s->nat_src_node != NULL) { 6507 s->nat_src_node->packets++; 6508 s->nat_src_node->bytes += pd.tot_len; 6509 } 6510 } 6511 tr = r; 6512 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule; 6513 if (nr != NULL) { 6514 struct pf_addr *x; 6515 /* 6516 * XXX: we need to make sure that the addresses 6517 * passed to pfr_update_stats() are the same than 6518 * the addresses used during matching (pfr_match) 6519 */ 6520 if (r == &pf_default_rule) { 6521 tr = nr; 6522 x = (s == NULL || s->direction == dir) ? 6523 &pd.baddr : &pd.naddr; 6524 } else { 6525 x = (s == NULL || s->direction == dir) ? 6526 &pd.naddr : &pd.baddr; 6527 } 6528 if (x == &pd.baddr || s == NULL) { 6529 if (dir == PF_OUT) 6530 pd.src = x; 6531 else 6532 pd.dst = x; 6533 } 6534 } 6535 if (tr->src.addr.type == PF_ADDR_TABLE) 6536 pfr_update_stats(tr->src.addr.p.tbl, (s == NULL || 6537 s->direction == dir) ? pd.src : pd.dst, pd.af, 6538 pd.tot_len, dir == PF_OUT, r->action == PF_PASS, 6539 tr->src.not); 6540 if (tr->dst.addr.type == PF_ADDR_TABLE) 6541 pfr_update_stats(tr->dst.addr.p.tbl, (s == NULL || 6542 s->direction == dir) ? pd.dst : pd.src, pd.af, 6543 pd.tot_len, dir == PF_OUT, r->action == PF_PASS, 6544 tr->dst.not); 6545 } 6546 6547 6548 if (action == PF_SYNPROXY_DROP) { 6549 m_freem(*m0); 6550 *m0 = NULL; 6551 action = PF_PASS; 6552 } else if (r->rt) 6553 /* pf_route6 can free the mbuf causing *m0 to become NULL */ 6554 pf_route6(m0, r, dir, ifp, s); 6555 6556#ifdef __FreeBSD__ 6557 PF_UNLOCK(); 6558#endif 6559 return (action); 6560} 6561#endif /* INET6 */ 6562