fil.c revision 317434
1/* $FreeBSD: stable/11/sys/contrib/ipfilter/netinet/fil.c 317434 2017-04-26 02:37:25Z cy $ */ 2 3/* 4 * Copyright (C) 2012 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 * 8 * Copyright 2008 Sun Microsystems. 9 * 10 * $Id$ 11 * 12 */ 13#if defined(KERNEL) || defined(_KERNEL) 14# undef KERNEL 15# undef _KERNEL 16# define KERNEL 1 17# define _KERNEL 1 18#endif 19#include <sys/errno.h> 20#include <sys/types.h> 21#include <sys/param.h> 22#include <sys/time.h> 23#if defined(_KERNEL) && defined(__FreeBSD_version) && \ 24 (__FreeBSD_version >= 220000) 25# if (__FreeBSD_version >= 400000) 26# if !defined(IPFILTER_LKM) 27# include "opt_inet6.h" 28# endif 29# if (__FreeBSD_version == 400019) 30# define CSUM_DELAY_DATA 31# endif 32# endif 33# include <sys/filio.h> 34#else 35# include <sys/ioctl.h> 36#endif 37#if (defined(__SVR4) || defined(__svr4__)) && defined(sun) 38# include <sys/filio.h> 39#endif 40#if !defined(_AIX51) 41# include <sys/fcntl.h> 42#endif 43#if defined(_KERNEL) 44# include <sys/systm.h> 45# include <sys/file.h> 46#else 47# include <stdio.h> 48# include <string.h> 49# include <stdlib.h> 50# include <stddef.h> 51# include <sys/file.h> 52# define _KERNEL 53# ifdef __OpenBSD__ 54struct file; 55# endif 56# include <sys/uio.h> 57# undef _KERNEL 58#endif 59#if !defined(__SVR4) && !defined(__svr4__) && !defined(__hpux) && \ 60 !defined(linux) 61# include <sys/mbuf.h> 62#else 63# if !defined(linux) 64# include <sys/byteorder.h> 65# endif 66# if (SOLARIS2 < 5) && defined(sun) 67# include <sys/dditypes.h> 68# endif 69#endif 70#ifdef __hpux 71# define _NET_ROUTE_INCLUDED 72#endif 73#if !defined(linux) 74# include <sys/protosw.h> 75#endif 76#include <sys/socket.h> 77#include <net/if.h> 78#ifdef sun 79# include <net/af.h> 80#endif 81#include <netinet/in.h> 82#include <netinet/in_systm.h> 83#include <netinet/ip.h> 84#if defined(__sgi) && defined(IFF_DRVRLOCK) /* IRIX 6 */ 85# include <sys/hashing.h> 86# include <netinet/in_var.h> 87#endif 88#include <netinet/tcp.h> 89#if (!defined(__sgi) && !defined(AIX)) || defined(_KERNEL) 90# include <netinet/udp.h> 91# include <netinet/ip_icmp.h> 92#endif 93#ifdef __hpux 94# undef _NET_ROUTE_INCLUDED 95#endif 96#ifdef __osf__ 97# undef _RADIX_H_ 98#endif 99#include "netinet/ip_compat.h" 100#ifdef USE_INET6 101# include <netinet/icmp6.h> 102# if !SOLARIS && defined(_KERNEL) && !defined(__osf__) && !defined(__hpux) 103# include <netinet6/in6_var.h> 104# endif 105#endif 106#include "netinet/ip_fil.h" 107#include "netinet/ip_nat.h" 108#include "netinet/ip_frag.h" 109#include "netinet/ip_state.h" 110#include "netinet/ip_proxy.h" 111#include "netinet/ip_auth.h" 112#ifdef IPFILTER_SCAN 113# include "netinet/ip_scan.h" 114#endif 115#include "netinet/ip_sync.h" 116#include "netinet/ip_lookup.h" 117#include "netinet/ip_pool.h" 118#include "netinet/ip_htable.h" 119#ifdef IPFILTER_COMPILED 120# include "netinet/ip_rules.h" 121#endif 122#if defined(IPFILTER_BPF) && defined(_KERNEL) 123# include <net/bpf.h> 124#endif 125#if defined(__FreeBSD_version) && (__FreeBSD_version >= 300000) 126# include <sys/malloc.h> 127#endif 128#include "netinet/ipl.h" 129 130#if defined(__NetBSD__) && (__NetBSD_Version__ >= 104230000) 131# include <sys/callout.h> 132extern struct callout ipf_slowtimer_ch; 133#endif 134#if defined(__OpenBSD__) 135# include <sys/timeout.h> 136extern struct timeout ipf_slowtimer_ch; 137#endif 138/* END OF INCLUDES */ 139 140#if !defined(lint) 141static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed"; 142static const char rcsid[] = "@(#)$FreeBSD: stable/11/sys/contrib/ipfilter/netinet/fil.c 317434 2017-04-26 02:37:25Z cy $"; 143/* static const char rcsid[] = "@(#)$Id: fil.c,v 2.243.2.125 2007/10/10 09:27:20 darrenr Exp $"; */ 144#endif 145 146#ifndef _KERNEL 147# include "ipf.h" 148# include "ipt.h" 149extern int opts; 150extern int blockreason; 151#endif /* _KERNEL */ 152 153#define LBUMP(x) softc->x++ 154#define LBUMPD(x, y) do { softc->x.y++; DT(y); } while (0) 155 156static INLINE int ipf_check_ipf __P((fr_info_t *, frentry_t *, int)); 157static u_32_t ipf_checkcipso __P((fr_info_t *, u_char *, int)); 158static u_32_t ipf_checkripso __P((u_char *)); 159static u_32_t ipf_decaps __P((fr_info_t *, u_32_t, int)); 160#ifdef IPFILTER_LOG 161static frentry_t *ipf_dolog __P((fr_info_t *, u_32_t *)); 162#endif 163static int ipf_flushlist __P((ipf_main_softc_t *, int *, 164 frentry_t **)); 165static int ipf_flush_groups __P((ipf_main_softc_t *, frgroup_t **, 166 int)); 167static ipfunc_t ipf_findfunc __P((ipfunc_t)); 168static void *ipf_findlookup __P((ipf_main_softc_t *, int, 169 frentry_t *, 170 i6addr_t *, i6addr_t *)); 171static frentry_t *ipf_firewall __P((fr_info_t *, u_32_t *)); 172static int ipf_fr_matcharray __P((fr_info_t *, int *)); 173static int ipf_frruleiter __P((ipf_main_softc_t *, void *, int, 174 void *)); 175static void ipf_funcfini __P((ipf_main_softc_t *, frentry_t *)); 176static int ipf_funcinit __P((ipf_main_softc_t *, frentry_t *)); 177static int ipf_geniter __P((ipf_main_softc_t *, ipftoken_t *, 178 ipfgeniter_t *)); 179static void ipf_getstat __P((ipf_main_softc_t *, 180 struct friostat *, int)); 181static int ipf_group_flush __P((ipf_main_softc_t *, frgroup_t *)); 182static void ipf_group_free __P((frgroup_t *)); 183static int ipf_grpmapfini __P((struct ipf_main_softc_s *, 184 frentry_t *)); 185static int ipf_grpmapinit __P((struct ipf_main_softc_s *, 186 frentry_t *)); 187static frentry_t *ipf_nextrule __P((ipf_main_softc_t *, int, int, 188 frentry_t *, int)); 189static int ipf_portcheck __P((frpcmp_t *, u_32_t)); 190static INLINE int ipf_pr_ah __P((fr_info_t *)); 191static INLINE void ipf_pr_esp __P((fr_info_t *)); 192static INLINE void ipf_pr_gre __P((fr_info_t *)); 193static INLINE void ipf_pr_udp __P((fr_info_t *)); 194static INLINE void ipf_pr_tcp __P((fr_info_t *)); 195static INLINE void ipf_pr_icmp __P((fr_info_t *)); 196static INLINE void ipf_pr_ipv4hdr __P((fr_info_t *)); 197static INLINE void ipf_pr_short __P((fr_info_t *, int)); 198static INLINE int ipf_pr_tcpcommon __P((fr_info_t *)); 199static INLINE int ipf_pr_udpcommon __P((fr_info_t *)); 200static void ipf_rule_delete __P((ipf_main_softc_t *, frentry_t *f, 201 int, int)); 202static void ipf_rule_expire_insert __P((ipf_main_softc_t *, 203 frentry_t *, int)); 204static int ipf_synclist __P((ipf_main_softc_t *, frentry_t *, 205 void *)); 206static void ipf_token_flush __P((ipf_main_softc_t *)); 207static void ipf_token_unlink __P((ipf_main_softc_t *, 208 ipftoken_t *)); 209static ipftuneable_t *ipf_tune_findbyname __P((ipftuneable_t *, 210 const char *)); 211static ipftuneable_t *ipf_tune_findbycookie __P((ipftuneable_t **, void *, 212 void **)); 213static int ipf_updateipid __P((fr_info_t *)); 214static int ipf_settimeout __P((struct ipf_main_softc_s *, 215 struct ipftuneable *, 216 ipftuneval_t *)); 217#if !defined(_KERNEL) || (!defined(__NetBSD__) && !defined(__OpenBSD__) && \ 218 !defined(__FreeBSD__)) || \ 219 FREEBSD_LT_REV(501000) || NETBSD_LT_REV(105000000) || \ 220 OPENBSD_LT_REV(200006) 221static int ppsratecheck(struct timeval *, int *, int); 222#endif 223 224 225/* 226 * bit values for identifying presence of individual IP options 227 * All of these tables should be ordered by increasing key value on the left 228 * hand side to allow for binary searching of the array and include a trailer 229 * with a 0 for the bitmask for linear searches to easily find the end with. 230 */ 231static const struct optlist ipopts[20] = { 232 { IPOPT_NOP, 0x000001 }, 233 { IPOPT_RR, 0x000002 }, 234 { IPOPT_ZSU, 0x000004 }, 235 { IPOPT_MTUP, 0x000008 }, 236 { IPOPT_MTUR, 0x000010 }, 237 { IPOPT_ENCODE, 0x000020 }, 238 { IPOPT_TS, 0x000040 }, 239 { IPOPT_TR, 0x000080 }, 240 { IPOPT_SECURITY, 0x000100 }, 241 { IPOPT_LSRR, 0x000200 }, 242 { IPOPT_E_SEC, 0x000400 }, 243 { IPOPT_CIPSO, 0x000800 }, 244 { IPOPT_SATID, 0x001000 }, 245 { IPOPT_SSRR, 0x002000 }, 246 { IPOPT_ADDEXT, 0x004000 }, 247 { IPOPT_VISA, 0x008000 }, 248 { IPOPT_IMITD, 0x010000 }, 249 { IPOPT_EIP, 0x020000 }, 250 { IPOPT_FINN, 0x040000 }, 251 { 0, 0x000000 } 252}; 253 254#ifdef USE_INET6 255static const struct optlist ip6exthdr[] = { 256 { IPPROTO_HOPOPTS, 0x000001 }, 257 { IPPROTO_IPV6, 0x000002 }, 258 { IPPROTO_ROUTING, 0x000004 }, 259 { IPPROTO_FRAGMENT, 0x000008 }, 260 { IPPROTO_ESP, 0x000010 }, 261 { IPPROTO_AH, 0x000020 }, 262 { IPPROTO_NONE, 0x000040 }, 263 { IPPROTO_DSTOPTS, 0x000080 }, 264 { IPPROTO_MOBILITY, 0x000100 }, 265 { 0, 0 } 266}; 267#endif 268 269/* 270 * bit values for identifying presence of individual IP security options 271 */ 272static const struct optlist secopt[8] = { 273 { IPSO_CLASS_RES4, 0x01 }, 274 { IPSO_CLASS_TOPS, 0x02 }, 275 { IPSO_CLASS_SECR, 0x04 }, 276 { IPSO_CLASS_RES3, 0x08 }, 277 { IPSO_CLASS_CONF, 0x10 }, 278 { IPSO_CLASS_UNCL, 0x20 }, 279 { IPSO_CLASS_RES2, 0x40 }, 280 { IPSO_CLASS_RES1, 0x80 } 281}; 282 283char ipfilter_version[] = IPL_VERSION; 284 285int ipf_features = 0 286#ifdef IPFILTER_LKM 287 | IPF_FEAT_LKM 288#endif 289#ifdef IPFILTER_LOG 290 | IPF_FEAT_LOG 291#endif 292 | IPF_FEAT_LOOKUP 293#ifdef IPFILTER_BPF 294 | IPF_FEAT_BPF 295#endif 296#ifdef IPFILTER_COMPILED 297 | IPF_FEAT_COMPILED 298#endif 299#ifdef IPFILTER_CKSUM 300 | IPF_FEAT_CKSUM 301#endif 302 | IPF_FEAT_SYNC 303#ifdef IPFILTER_SCAN 304 | IPF_FEAT_SCAN 305#endif 306#ifdef USE_INET6 307 | IPF_FEAT_IPV6 308#endif 309 ; 310 311 312/* 313 * Table of functions available for use with call rules. 314 */ 315static ipfunc_resolve_t ipf_availfuncs[] = { 316 { "srcgrpmap", ipf_srcgrpmap, ipf_grpmapinit, ipf_grpmapfini }, 317 { "dstgrpmap", ipf_dstgrpmap, ipf_grpmapinit, ipf_grpmapfini }, 318 { "", NULL, NULL, NULL } 319}; 320 321static ipftuneable_t ipf_main_tuneables[] = { 322 { { (void *)offsetof(struct ipf_main_softc_s, ipf_flags) }, 323 "ipf_flags", 0, 0xffffffff, 324 stsizeof(ipf_main_softc_t, ipf_flags), 325 0, NULL, NULL }, 326 { { (void *)offsetof(struct ipf_main_softc_s, ipf_active) }, 327 "active", 0, 0, 328 stsizeof(ipf_main_softc_t, ipf_active), 329 IPFT_RDONLY, NULL, NULL }, 330 { { (void *)offsetof(ipf_main_softc_t, ipf_control_forwarding) }, 331 "control_forwarding", 0, 1, 332 stsizeof(ipf_main_softc_t, ipf_control_forwarding), 333 0, NULL, NULL }, 334 { { (void *)offsetof(ipf_main_softc_t, ipf_update_ipid) }, 335 "update_ipid", 0, 1, 336 stsizeof(ipf_main_softc_t, ipf_update_ipid), 337 0, NULL, NULL }, 338 { { (void *)offsetof(ipf_main_softc_t, ipf_chksrc) }, 339 "chksrc", 0, 1, 340 stsizeof(ipf_main_softc_t, ipf_chksrc), 341 0, NULL, NULL }, 342 { { (void *)offsetof(ipf_main_softc_t, ipf_minttl) }, 343 "min_ttl", 0, 1, 344 stsizeof(ipf_main_softc_t, ipf_minttl), 345 0, NULL, NULL }, 346 { { (void *)offsetof(ipf_main_softc_t, ipf_icmpminfragmtu) }, 347 "icmp_minfragmtu", 0, 1, 348 stsizeof(ipf_main_softc_t, ipf_icmpminfragmtu), 349 0, NULL, NULL }, 350 { { (void *)offsetof(ipf_main_softc_t, ipf_pass) }, 351 "default_pass", 0, 0xffffffff, 352 stsizeof(ipf_main_softc_t, ipf_pass), 353 0, NULL, NULL }, 354 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpidletimeout) }, 355 "tcp_idle_timeout", 1, 0x7fffffff, 356 stsizeof(ipf_main_softc_t, ipf_tcpidletimeout), 357 0, NULL, ipf_settimeout }, 358 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpclosewait) }, 359 "tcp_close_wait", 1, 0x7fffffff, 360 stsizeof(ipf_main_softc_t, ipf_tcpclosewait), 361 0, NULL, ipf_settimeout }, 362 { { (void *)offsetof(ipf_main_softc_t, ipf_tcplastack) }, 363 "tcp_last_ack", 1, 0x7fffffff, 364 stsizeof(ipf_main_softc_t, ipf_tcplastack), 365 0, NULL, ipf_settimeout }, 366 { { (void *)offsetof(ipf_main_softc_t, ipf_tcptimeout) }, 367 "tcp_timeout", 1, 0x7fffffff, 368 stsizeof(ipf_main_softc_t, ipf_tcptimeout), 369 0, NULL, ipf_settimeout }, 370 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpsynsent) }, 371 "tcp_syn_sent", 1, 0x7fffffff, 372 stsizeof(ipf_main_softc_t, ipf_tcpsynsent), 373 0, NULL, ipf_settimeout }, 374 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpsynrecv) }, 375 "tcp_syn_received", 1, 0x7fffffff, 376 stsizeof(ipf_main_softc_t, ipf_tcpsynrecv), 377 0, NULL, ipf_settimeout }, 378 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpclosed) }, 379 "tcp_closed", 1, 0x7fffffff, 380 stsizeof(ipf_main_softc_t, ipf_tcpclosed), 381 0, NULL, ipf_settimeout }, 382 { { (void *)offsetof(ipf_main_softc_t, ipf_tcphalfclosed) }, 383 "tcp_half_closed", 1, 0x7fffffff, 384 stsizeof(ipf_main_softc_t, ipf_tcphalfclosed), 385 0, NULL, ipf_settimeout }, 386 { { (void *)offsetof(ipf_main_softc_t, ipf_tcptimewait) }, 387 "tcp_time_wait", 1, 0x7fffffff, 388 stsizeof(ipf_main_softc_t, ipf_tcptimewait), 389 0, NULL, ipf_settimeout }, 390 { { (void *)offsetof(ipf_main_softc_t, ipf_udptimeout) }, 391 "udp_timeout", 1, 0x7fffffff, 392 stsizeof(ipf_main_softc_t, ipf_udptimeout), 393 0, NULL, ipf_settimeout }, 394 { { (void *)offsetof(ipf_main_softc_t, ipf_udpacktimeout) }, 395 "udp_ack_timeout", 1, 0x7fffffff, 396 stsizeof(ipf_main_softc_t, ipf_udpacktimeout), 397 0, NULL, ipf_settimeout }, 398 { { (void *)offsetof(ipf_main_softc_t, ipf_icmptimeout) }, 399 "icmp_timeout", 1, 0x7fffffff, 400 stsizeof(ipf_main_softc_t, ipf_icmptimeout), 401 0, NULL, ipf_settimeout }, 402 { { (void *)offsetof(ipf_main_softc_t, ipf_icmpacktimeout) }, 403 "icmp_ack_timeout", 1, 0x7fffffff, 404 stsizeof(ipf_main_softc_t, ipf_icmpacktimeout), 405 0, NULL, ipf_settimeout }, 406 { { (void *)offsetof(ipf_main_softc_t, ipf_iptimeout) }, 407 "ip_timeout", 1, 0x7fffffff, 408 stsizeof(ipf_main_softc_t, ipf_iptimeout), 409 0, NULL, ipf_settimeout }, 410#if defined(INSTANCES) && defined(_KERNEL) 411 { { (void *)offsetof(ipf_main_softc_t, ipf_get_loopback) }, 412 "intercept_loopback", 0, 1, 413 stsizeof(ipf_main_softc_t, ipf_get_loopback), 414 0, NULL, ipf_set_loopback }, 415#endif 416 { { 0 }, 417 NULL, 0, 0, 418 0, 419 0, NULL, NULL } 420}; 421 422 423/* 424 * The next section of code is a a collection of small routines that set 425 * fields in the fr_info_t structure passed based on properties of the 426 * current packet. There are different routines for the same protocol 427 * for each of IPv4 and IPv6. Adding a new protocol, for which there 428 * will "special" inspection for setup, is now more easily done by adding 429 * a new routine and expanding the ipf_pr_ipinit*() function rather than by 430 * adding more code to a growing switch statement. 431 */ 432#ifdef USE_INET6 433static INLINE int ipf_pr_ah6 __P((fr_info_t *)); 434static INLINE void ipf_pr_esp6 __P((fr_info_t *)); 435static INLINE void ipf_pr_gre6 __P((fr_info_t *)); 436static INLINE void ipf_pr_udp6 __P((fr_info_t *)); 437static INLINE void ipf_pr_tcp6 __P((fr_info_t *)); 438static INLINE void ipf_pr_icmp6 __P((fr_info_t *)); 439static INLINE void ipf_pr_ipv6hdr __P((fr_info_t *)); 440static INLINE void ipf_pr_short6 __P((fr_info_t *, int)); 441static INLINE int ipf_pr_hopopts6 __P((fr_info_t *)); 442static INLINE int ipf_pr_mobility6 __P((fr_info_t *)); 443static INLINE int ipf_pr_routing6 __P((fr_info_t *)); 444static INLINE int ipf_pr_dstopts6 __P((fr_info_t *)); 445static INLINE int ipf_pr_fragment6 __P((fr_info_t *)); 446static INLINE struct ip6_ext *ipf_pr_ipv6exthdr __P((fr_info_t *, int, int)); 447 448 449/* ------------------------------------------------------------------------ */ 450/* Function: ipf_pr_short6 */ 451/* Returns: void */ 452/* Parameters: fin(I) - pointer to packet information */ 453/* xmin(I) - minimum header size */ 454/* */ 455/* IPv6 Only */ 456/* This is function enforces the 'is a packet too short to be legit' rule */ 457/* for IPv6 and marks the packet with FI_SHORT if so. See function comment */ 458/* for ipf_pr_short() for more details. */ 459/* ------------------------------------------------------------------------ */ 460static INLINE void 461ipf_pr_short6(fin, xmin) 462 fr_info_t *fin; 463 int xmin; 464{ 465 466 if (fin->fin_dlen < xmin) 467 fin->fin_flx |= FI_SHORT; 468} 469 470 471/* ------------------------------------------------------------------------ */ 472/* Function: ipf_pr_ipv6hdr */ 473/* Returns: void */ 474/* Parameters: fin(I) - pointer to packet information */ 475/* */ 476/* IPv6 Only */ 477/* Copy values from the IPv6 header into the fr_info_t struct and call the */ 478/* per-protocol analyzer if it exists. In validating the packet, a protocol*/ 479/* analyzer may pullup or free the packet itself so we need to be vigiliant */ 480/* of that possibility arising. */ 481/* ------------------------------------------------------------------------ */ 482static INLINE void 483ipf_pr_ipv6hdr(fin) 484 fr_info_t *fin; 485{ 486 ip6_t *ip6 = (ip6_t *)fin->fin_ip; 487 int p, go = 1, i, hdrcount; 488 fr_ip_t *fi = &fin->fin_fi; 489 490 fin->fin_off = 0; 491 492 fi->fi_tos = 0; 493 fi->fi_optmsk = 0; 494 fi->fi_secmsk = 0; 495 fi->fi_auth = 0; 496 497 p = ip6->ip6_nxt; 498 fin->fin_crc = p; 499 fi->fi_ttl = ip6->ip6_hlim; 500 fi->fi_src.in6 = ip6->ip6_src; 501 fin->fin_crc += fi->fi_src.i6[0]; 502 fin->fin_crc += fi->fi_src.i6[1]; 503 fin->fin_crc += fi->fi_src.i6[2]; 504 fin->fin_crc += fi->fi_src.i6[3]; 505 fi->fi_dst.in6 = ip6->ip6_dst; 506 fin->fin_crc += fi->fi_dst.i6[0]; 507 fin->fin_crc += fi->fi_dst.i6[1]; 508 fin->fin_crc += fi->fi_dst.i6[2]; 509 fin->fin_crc += fi->fi_dst.i6[3]; 510 fin->fin_id = 0; 511 if (IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6)) 512 fin->fin_flx |= FI_MULTICAST|FI_MBCAST; 513 514 hdrcount = 0; 515 while (go && !(fin->fin_flx & FI_SHORT)) { 516 switch (p) 517 { 518 case IPPROTO_UDP : 519 ipf_pr_udp6(fin); 520 go = 0; 521 break; 522 523 case IPPROTO_TCP : 524 ipf_pr_tcp6(fin); 525 go = 0; 526 break; 527 528 case IPPROTO_ICMPV6 : 529 ipf_pr_icmp6(fin); 530 go = 0; 531 break; 532 533 case IPPROTO_GRE : 534 ipf_pr_gre6(fin); 535 go = 0; 536 break; 537 538 case IPPROTO_HOPOPTS : 539 p = ipf_pr_hopopts6(fin); 540 break; 541 542 case IPPROTO_MOBILITY : 543 p = ipf_pr_mobility6(fin); 544 break; 545 546 case IPPROTO_DSTOPTS : 547 p = ipf_pr_dstopts6(fin); 548 break; 549 550 case IPPROTO_ROUTING : 551 p = ipf_pr_routing6(fin); 552 break; 553 554 case IPPROTO_AH : 555 p = ipf_pr_ah6(fin); 556 break; 557 558 case IPPROTO_ESP : 559 ipf_pr_esp6(fin); 560 go = 0; 561 break; 562 563 case IPPROTO_IPV6 : 564 for (i = 0; ip6exthdr[i].ol_bit != 0; i++) 565 if (ip6exthdr[i].ol_val == p) { 566 fin->fin_flx |= ip6exthdr[i].ol_bit; 567 break; 568 } 569 go = 0; 570 break; 571 572 case IPPROTO_NONE : 573 go = 0; 574 break; 575 576 case IPPROTO_FRAGMENT : 577 p = ipf_pr_fragment6(fin); 578 /* 579 * Given that the only fragments we want to let through 580 * (where fin_off != 0) are those where the non-first 581 * fragments only have data, we can safely stop looking 582 * at headers if this is a non-leading fragment. 583 */ 584 if (fin->fin_off != 0) 585 go = 0; 586 break; 587 588 default : 589 go = 0; 590 break; 591 } 592 hdrcount++; 593 594 /* 595 * It is important to note that at this point, for the 596 * extension headers (go != 0), the entire header may not have 597 * been pulled up when the code gets to this point. This is 598 * only done for "go != 0" because the other header handlers 599 * will all pullup their complete header. The other indicator 600 * of an incomplete packet is that this was just an extension 601 * header. 602 */ 603 if ((go != 0) && (p != IPPROTO_NONE) && 604 (ipf_pr_pullup(fin, 0) == -1)) { 605 p = IPPROTO_NONE; 606 break; 607 } 608 } 609 610 /* 611 * Some of the above functions, like ipf_pr_esp6(), can call ipf_pullup 612 * and destroy whatever packet was here. The caller of this function 613 * expects us to return if there is a problem with ipf_pullup. 614 */ 615 if (fin->fin_m == NULL) { 616 ipf_main_softc_t *softc = fin->fin_main_soft; 617 618 LBUMPD(ipf_stats[fin->fin_out], fr_v6_bad); 619 return; 620 } 621 622 fi->fi_p = p; 623 624 /* 625 * IPv6 fragment case 1 - see comment for ipf_pr_fragment6(). 626 * "go != 0" imples the above loop hasn't arrived at a layer 4 header. 627 */ 628 if ((go != 0) && (fin->fin_flx & FI_FRAG) && (fin->fin_off == 0)) { 629 ipf_main_softc_t *softc = fin->fin_main_soft; 630 631 fin->fin_flx |= FI_BAD; 632 DT2(ipf_fi_bad_ipv6_frag_1, fr_info_t *, fin, int, go); 633 LBUMPD(ipf_stats[fin->fin_out], fr_v6_badfrag); 634 LBUMP(ipf_stats[fin->fin_out].fr_v6_bad); 635 } 636} 637 638 639/* ------------------------------------------------------------------------ */ 640/* Function: ipf_pr_ipv6exthdr */ 641/* Returns: struct ip6_ext * - pointer to the start of the next header */ 642/* or NULL if there is a prolblem. */ 643/* Parameters: fin(I) - pointer to packet information */ 644/* multiple(I) - flag indicating yes/no if multiple occurances */ 645/* of this extension header are allowed. */ 646/* proto(I) - protocol number for this extension header */ 647/* */ 648/* IPv6 Only */ 649/* This function embodies a number of common checks that all IPv6 extension */ 650/* headers must be subjected to. For example, making sure the packet is */ 651/* big enough for it to be in, checking if it is repeated and setting a */ 652/* flag to indicate its presence. */ 653/* ------------------------------------------------------------------------ */ 654static INLINE struct ip6_ext * 655ipf_pr_ipv6exthdr(fin, multiple, proto) 656 fr_info_t *fin; 657 int multiple, proto; 658{ 659 ipf_main_softc_t *softc = fin->fin_main_soft; 660 struct ip6_ext *hdr; 661 u_short shift; 662 int i; 663 664 fin->fin_flx |= FI_V6EXTHDR; 665 666 /* 8 is default length of extension hdr */ 667 if ((fin->fin_dlen - 8) < 0) { 668 fin->fin_flx |= FI_SHORT; 669 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_short); 670 return NULL; 671 } 672 673 if (ipf_pr_pullup(fin, 8) == -1) { 674 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_pullup); 675 return NULL; 676 } 677 678 hdr = fin->fin_dp; 679 switch (proto) 680 { 681 case IPPROTO_FRAGMENT : 682 shift = 8; 683 break; 684 default : 685 shift = 8 + (hdr->ip6e_len << 3); 686 break; 687 } 688 689 if (shift > fin->fin_dlen) { /* Nasty extension header length? */ 690 fin->fin_flx |= FI_BAD; 691 DT3(ipf_fi_bad_pr_ipv6exthdr_len, fr_info_t *, fin, u_short, shift, u_short, fin->fin_dlen); 692 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_hlen); 693 return NULL; 694 } 695 696 fin->fin_dp = (char *)fin->fin_dp + shift; 697 fin->fin_dlen -= shift; 698 699 /* 700 * If we have seen a fragment header, do not set any flags to indicate 701 * the presence of this extension header as it has no impact on the 702 * end result until after it has been defragmented. 703 */ 704 if (fin->fin_flx & FI_FRAG) 705 return hdr; 706 707 for (i = 0; ip6exthdr[i].ol_bit != 0; i++) 708 if (ip6exthdr[i].ol_val == proto) { 709 /* 710 * Most IPv6 extension headers are only allowed once. 711 */ 712 if ((multiple == 0) && 713 ((fin->fin_optmsk & ip6exthdr[i].ol_bit) != 0)) { 714 fin->fin_flx |= FI_BAD; 715 DT2(ipf_fi_bad_ipv6exthdr_once, fr_info_t *, fin, u_int, (fin->fin_optmsk & ip6exthdr[i].ol_bit)); 716 } else 717 fin->fin_optmsk |= ip6exthdr[i].ol_bit; 718 break; 719 } 720 721 return hdr; 722} 723 724 725/* ------------------------------------------------------------------------ */ 726/* Function: ipf_pr_hopopts6 */ 727/* Returns: int - value of the next header or IPPROTO_NONE if error */ 728/* Parameters: fin(I) - pointer to packet information */ 729/* */ 730/* IPv6 Only */ 731/* This is function checks pending hop by hop options extension header */ 732/* ------------------------------------------------------------------------ */ 733static INLINE int 734ipf_pr_hopopts6(fin) 735 fr_info_t *fin; 736{ 737 struct ip6_ext *hdr; 738 739 hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_HOPOPTS); 740 if (hdr == NULL) 741 return IPPROTO_NONE; 742 return hdr->ip6e_nxt; 743} 744 745 746/* ------------------------------------------------------------------------ */ 747/* Function: ipf_pr_mobility6 */ 748/* Returns: int - value of the next header or IPPROTO_NONE if error */ 749/* Parameters: fin(I) - pointer to packet information */ 750/* */ 751/* IPv6 Only */ 752/* This is function checks the IPv6 mobility extension header */ 753/* ------------------------------------------------------------------------ */ 754static INLINE int 755ipf_pr_mobility6(fin) 756 fr_info_t *fin; 757{ 758 struct ip6_ext *hdr; 759 760 hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_MOBILITY); 761 if (hdr == NULL) 762 return IPPROTO_NONE; 763 return hdr->ip6e_nxt; 764} 765 766 767/* ------------------------------------------------------------------------ */ 768/* Function: ipf_pr_routing6 */ 769/* Returns: int - value of the next header or IPPROTO_NONE if error */ 770/* Parameters: fin(I) - pointer to packet information */ 771/* */ 772/* IPv6 Only */ 773/* This is function checks pending routing extension header */ 774/* ------------------------------------------------------------------------ */ 775static INLINE int 776ipf_pr_routing6(fin) 777 fr_info_t *fin; 778{ 779 struct ip6_routing *hdr; 780 781 hdr = (struct ip6_routing *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_ROUTING); 782 if (hdr == NULL) 783 return IPPROTO_NONE; 784 785 switch (hdr->ip6r_type) 786 { 787 case 0 : 788 /* 789 * Nasty extension header length? 790 */ 791 if (((hdr->ip6r_len >> 1) < hdr->ip6r_segleft) || 792 (hdr->ip6r_segleft && (hdr->ip6r_len & 1))) { 793 ipf_main_softc_t *softc = fin->fin_main_soft; 794 795 fin->fin_flx |= FI_BAD; 796 DT1(ipf_fi_bad_routing6, fr_info_t *, fin); 797 LBUMPD(ipf_stats[fin->fin_out], fr_v6_rh_bad); 798 return IPPROTO_NONE; 799 } 800 break; 801 802 default : 803 break; 804 } 805 806 return hdr->ip6r_nxt; 807} 808 809 810/* ------------------------------------------------------------------------ */ 811/* Function: ipf_pr_fragment6 */ 812/* Returns: int - value of the next header or IPPROTO_NONE if error */ 813/* Parameters: fin(I) - pointer to packet information */ 814/* */ 815/* IPv6 Only */ 816/* Examine the IPv6 fragment header and extract fragment offset information.*/ 817/* */ 818/* Fragments in IPv6 are extraordinarily difficult to deal with - much more */ 819/* so than in IPv4. There are 5 cases of fragments with IPv6 that all */ 820/* packets with a fragment header can fit into. They are as follows: */ 821/* */ 822/* 1. [IPv6][0-n EH][FH][0-n EH] (no L4HDR present) */ 823/* 2. [IPV6][0-n EH][FH][0-n EH][L4HDR part] (short) */ 824/* 3. [IPV6][0-n EH][FH][L4HDR part][0-n data] (short) */ 825/* 4. [IPV6][0-n EH][FH][0-n EH][L4HDR][0-n data] */ 826/* 5. [IPV6][0-n EH][FH][data] */ 827/* */ 828/* IPV6 = IPv6 header, FH = Fragment Header, */ 829/* 0-n EH = 0 or more extension headers, 0-n data = 0 or more bytes of data */ 830/* */ 831/* Packets that match 1, 2, 3 will be dropped as the only reasonable */ 832/* scenario in which they happen is in extreme circumstances that are most */ 833/* likely to be an indication of an attack rather than normal traffic. */ 834/* A type 3 packet may be sent by an attacked after a type 4 packet. There */ 835/* are two rules that can be used to guard against type 3 packets: L4 */ 836/* headers must always be in a packet that has the offset field set to 0 */ 837/* and no packet is allowed to overlay that where offset = 0. */ 838/* ------------------------------------------------------------------------ */ 839static INLINE int 840ipf_pr_fragment6(fin) 841 fr_info_t *fin; 842{ 843 ipf_main_softc_t *softc = fin->fin_main_soft; 844 struct ip6_frag *frag; 845 846 fin->fin_flx |= FI_FRAG; 847 848 frag = (struct ip6_frag *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_FRAGMENT); 849 if (frag == NULL) { 850 LBUMPD(ipf_stats[fin->fin_out], fr_v6_frag_bad); 851 return IPPROTO_NONE; 852 } 853 854 if ((frag->ip6f_offlg & IP6F_MORE_FRAG) != 0) { 855 /* 856 * Any fragment that isn't the last fragment must have its 857 * length as a multiple of 8. 858 */ 859 if ((fin->fin_plen & 7) != 0) { 860 fin->fin_flx |= FI_BAD; 861 DT2(ipf_fi_bad_frag_not_8, fr_info_t *, fin, u_int, (fin->fin_plen & 7)); 862 } 863 } 864 865 fin->fin_fraghdr = frag; 866 fin->fin_id = frag->ip6f_ident; 867 fin->fin_off = ntohs(frag->ip6f_offlg & IP6F_OFF_MASK); 868 if (fin->fin_off != 0) 869 fin->fin_flx |= FI_FRAGBODY; 870 871 /* 872 * Jumbograms aren't handled, so the max. length is 64k 873 */ 874 if ((fin->fin_off << 3) + fin->fin_dlen > 65535) { 875 fin->fin_flx |= FI_BAD; 876 DT2(ipf_fi_bad_jumbogram, fr_info_t *, fin, u_int, ((fin->fin_off << 3) + fin->fin_dlen)); 877 } 878 879 /* 880 * We don't know where the transport layer header (or whatever is next 881 * is), as it could be behind destination options (amongst others) so 882 * return the fragment header as the type of packet this is. Note that 883 * this effectively disables the fragment cache for > 1 protocol at a 884 * time. 885 */ 886 return frag->ip6f_nxt; 887} 888 889 890/* ------------------------------------------------------------------------ */ 891/* Function: ipf_pr_dstopts6 */ 892/* Returns: int - value of the next header or IPPROTO_NONE if error */ 893/* Parameters: fin(I) - pointer to packet information */ 894/* */ 895/* IPv6 Only */ 896/* This is function checks pending destination options extension header */ 897/* ------------------------------------------------------------------------ */ 898static INLINE int 899ipf_pr_dstopts6(fin) 900 fr_info_t *fin; 901{ 902 ipf_main_softc_t *softc = fin->fin_main_soft; 903 struct ip6_ext *hdr; 904 905 hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_DSTOPTS); 906 if (hdr == NULL) { 907 LBUMPD(ipf_stats[fin->fin_out], fr_v6_dst_bad); 908 return IPPROTO_NONE; 909 } 910 return hdr->ip6e_nxt; 911} 912 913 914/* ------------------------------------------------------------------------ */ 915/* Function: ipf_pr_icmp6 */ 916/* Returns: void */ 917/* Parameters: fin(I) - pointer to packet information */ 918/* */ 919/* IPv6 Only */ 920/* This routine is mainly concerned with determining the minimum valid size */ 921/* for an ICMPv6 packet. */ 922/* ------------------------------------------------------------------------ */ 923static INLINE void 924ipf_pr_icmp6(fin) 925 fr_info_t *fin; 926{ 927 int minicmpsz = sizeof(struct icmp6_hdr); 928 struct icmp6_hdr *icmp6; 929 930 if (ipf_pr_pullup(fin, ICMP6ERR_MINPKTLEN - sizeof(ip6_t)) == -1) { 931 ipf_main_softc_t *softc = fin->fin_main_soft; 932 933 LBUMPD(ipf_stats[fin->fin_out], fr_v6_icmp6_pullup); 934 return; 935 } 936 937 if (fin->fin_dlen > 1) { 938 ip6_t *ip6; 939 940 icmp6 = fin->fin_dp; 941 942 fin->fin_data[0] = *(u_short *)icmp6; 943 944 if ((icmp6->icmp6_type & ICMP6_INFOMSG_MASK) != 0) 945 fin->fin_flx |= FI_ICMPQUERY; 946 947 switch (icmp6->icmp6_type) 948 { 949 case ICMP6_ECHO_REPLY : 950 case ICMP6_ECHO_REQUEST : 951 if (fin->fin_dlen >= 6) 952 fin->fin_data[1] = icmp6->icmp6_id; 953 minicmpsz = ICMP6ERR_MINPKTLEN - sizeof(ip6_t); 954 break; 955 956 case ICMP6_DST_UNREACH : 957 case ICMP6_PACKET_TOO_BIG : 958 case ICMP6_TIME_EXCEEDED : 959 case ICMP6_PARAM_PROB : 960 fin->fin_flx |= FI_ICMPERR; 961 minicmpsz = ICMP6ERR_IPICMPHLEN - sizeof(ip6_t); 962 if (fin->fin_plen < ICMP6ERR_IPICMPHLEN) 963 break; 964 965 if (M_LEN(fin->fin_m) < fin->fin_plen) { 966 if (ipf_coalesce(fin) != 1) 967 return; 968 } 969 970 if (ipf_pr_pullup(fin, ICMP6ERR_MINPKTLEN) == -1) 971 return; 972 973 /* 974 * If the destination of this packet doesn't match the 975 * source of the original packet then this packet is 976 * not correct. 977 */ 978 icmp6 = fin->fin_dp; 979 ip6 = (ip6_t *)((char *)icmp6 + ICMPERR_ICMPHLEN); 980 if (IP6_NEQ(&fin->fin_fi.fi_dst, 981 (i6addr_t *)&ip6->ip6_src)) { 982 fin->fin_flx |= FI_BAD; 983 DT1(ipf_fi_bad_icmp6, fr_info_t *, fin); 984 } 985 break; 986 default : 987 break; 988 } 989 } 990 991 ipf_pr_short6(fin, minicmpsz); 992 if ((fin->fin_flx & (FI_SHORT|FI_BAD)) == 0) { 993 u_char p = fin->fin_p; 994 995 fin->fin_p = IPPROTO_ICMPV6; 996 ipf_checkv6sum(fin); 997 fin->fin_p = p; 998 } 999} 1000 1001 1002/* ------------------------------------------------------------------------ */ 1003/* Function: ipf_pr_udp6 */ 1004/* Returns: void */ 1005/* Parameters: fin(I) - pointer to packet information */ 1006/* */ 1007/* IPv6 Only */ 1008/* Analyse the packet for IPv6/UDP properties. */ 1009/* Is not expected to be called for fragmented packets. */ 1010/* ------------------------------------------------------------------------ */ 1011static INLINE void 1012ipf_pr_udp6(fin) 1013 fr_info_t *fin; 1014{ 1015 1016 if (ipf_pr_udpcommon(fin) == 0) { 1017 u_char p = fin->fin_p; 1018 1019 fin->fin_p = IPPROTO_UDP; 1020 ipf_checkv6sum(fin); 1021 fin->fin_p = p; 1022 } 1023} 1024 1025 1026/* ------------------------------------------------------------------------ */ 1027/* Function: ipf_pr_tcp6 */ 1028/* Returns: void */ 1029/* Parameters: fin(I) - pointer to packet information */ 1030/* */ 1031/* IPv6 Only */ 1032/* Analyse the packet for IPv6/TCP properties. */ 1033/* Is not expected to be called for fragmented packets. */ 1034/* ------------------------------------------------------------------------ */ 1035static INLINE void 1036ipf_pr_tcp6(fin) 1037 fr_info_t *fin; 1038{ 1039 1040 if (ipf_pr_tcpcommon(fin) == 0) { 1041 u_char p = fin->fin_p; 1042 1043 fin->fin_p = IPPROTO_TCP; 1044 ipf_checkv6sum(fin); 1045 fin->fin_p = p; 1046 } 1047} 1048 1049 1050/* ------------------------------------------------------------------------ */ 1051/* Function: ipf_pr_esp6 */ 1052/* Returns: void */ 1053/* Parameters: fin(I) - pointer to packet information */ 1054/* */ 1055/* IPv6 Only */ 1056/* Analyse the packet for ESP properties. */ 1057/* The minimum length is taken to be the SPI (32bits) plus a tail (32bits) */ 1058/* even though the newer ESP packets must also have a sequence number that */ 1059/* is 32bits as well, it is not possible(?) to determine the version from a */ 1060/* simple packet header. */ 1061/* ------------------------------------------------------------------------ */ 1062static INLINE void 1063ipf_pr_esp6(fin) 1064 fr_info_t *fin; 1065{ 1066 1067 if ((fin->fin_off == 0) && (ipf_pr_pullup(fin, 8) == -1)) { 1068 ipf_main_softc_t *softc = fin->fin_main_soft; 1069 1070 LBUMPD(ipf_stats[fin->fin_out], fr_v6_esp_pullup); 1071 return; 1072 } 1073} 1074 1075 1076/* ------------------------------------------------------------------------ */ 1077/* Function: ipf_pr_ah6 */ 1078/* Returns: int - value of the next header or IPPROTO_NONE if error */ 1079/* Parameters: fin(I) - pointer to packet information */ 1080/* */ 1081/* IPv6 Only */ 1082/* Analyse the packet for AH properties. */ 1083/* The minimum length is taken to be the combination of all fields in the */ 1084/* header being present and no authentication data (null algorithm used.) */ 1085/* ------------------------------------------------------------------------ */ 1086static INLINE int 1087ipf_pr_ah6(fin) 1088 fr_info_t *fin; 1089{ 1090 authhdr_t *ah; 1091 1092 fin->fin_flx |= FI_AH; 1093 1094 ah = (authhdr_t *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_HOPOPTS); 1095 if (ah == NULL) { 1096 ipf_main_softc_t *softc = fin->fin_main_soft; 1097 1098 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ah_bad); 1099 return IPPROTO_NONE; 1100 } 1101 1102 ipf_pr_short6(fin, sizeof(*ah)); 1103 1104 /* 1105 * No need for another pullup, ipf_pr_ipv6exthdr() will pullup 1106 * enough data to satisfy ah_next (the very first one.) 1107 */ 1108 return ah->ah_next; 1109} 1110 1111 1112/* ------------------------------------------------------------------------ */ 1113/* Function: ipf_pr_gre6 */ 1114/* Returns: void */ 1115/* Parameters: fin(I) - pointer to packet information */ 1116/* */ 1117/* Analyse the packet for GRE properties. */ 1118/* ------------------------------------------------------------------------ */ 1119static INLINE void 1120ipf_pr_gre6(fin) 1121 fr_info_t *fin; 1122{ 1123 grehdr_t *gre; 1124 1125 if (ipf_pr_pullup(fin, sizeof(grehdr_t)) == -1) { 1126 ipf_main_softc_t *softc = fin->fin_main_soft; 1127 1128 LBUMPD(ipf_stats[fin->fin_out], fr_v6_gre_pullup); 1129 return; 1130 } 1131 1132 gre = fin->fin_dp; 1133 if (GRE_REV(gre->gr_flags) == 1) 1134 fin->fin_data[0] = gre->gr_call; 1135} 1136#endif /* USE_INET6 */ 1137 1138 1139/* ------------------------------------------------------------------------ */ 1140/* Function: ipf_pr_pullup */ 1141/* Returns: int - 0 == pullup succeeded, -1 == failure */ 1142/* Parameters: fin(I) - pointer to packet information */ 1143/* plen(I) - length (excluding L3 header) to pullup */ 1144/* */ 1145/* Short inline function to cut down on code duplication to perform a call */ 1146/* to ipf_pullup to ensure there is the required amount of data, */ 1147/* consecutively in the packet buffer. */ 1148/* */ 1149/* This function pulls up 'extra' data at the location of fin_dp. fin_dp */ 1150/* points to the first byte after the complete layer 3 header, which will */ 1151/* include all of the known extension headers for IPv6 or options for IPv4. */ 1152/* */ 1153/* Since fr_pullup() expects the total length of bytes to be pulled up, it */ 1154/* is necessary to add those we can already assume to be pulled up (fin_dp */ 1155/* - fin_ip) to what is passed through. */ 1156/* ------------------------------------------------------------------------ */ 1157int 1158ipf_pr_pullup(fin, plen) 1159 fr_info_t *fin; 1160 int plen; 1161{ 1162 ipf_main_softc_t *softc = fin->fin_main_soft; 1163 1164 if (fin->fin_m != NULL) { 1165 if (fin->fin_dp != NULL) 1166 plen += (char *)fin->fin_dp - 1167 ((char *)fin->fin_ip + fin->fin_hlen); 1168 plen += fin->fin_hlen; 1169 if (M_LEN(fin->fin_m) < plen + fin->fin_ipoff) { 1170#if defined(_KERNEL) 1171 if (ipf_pullup(fin->fin_m, fin, plen) == NULL) { 1172 DT(ipf_pullup_fail); 1173 LBUMP(ipf_stats[fin->fin_out].fr_pull[1]); 1174 return -1; 1175 } 1176 LBUMP(ipf_stats[fin->fin_out].fr_pull[0]); 1177#else 1178 LBUMP(ipf_stats[fin->fin_out].fr_pull[1]); 1179 /* 1180 * Fake ipf_pullup failing 1181 */ 1182 fin->fin_reason = FRB_PULLUP; 1183 *fin->fin_mp = NULL; 1184 fin->fin_m = NULL; 1185 fin->fin_ip = NULL; 1186 return -1; 1187#endif 1188 } 1189 } 1190 return 0; 1191} 1192 1193 1194/* ------------------------------------------------------------------------ */ 1195/* Function: ipf_pr_short */ 1196/* Returns: void */ 1197/* Parameters: fin(I) - pointer to packet information */ 1198/* xmin(I) - minimum header size */ 1199/* */ 1200/* Check if a packet is "short" as defined by xmin. The rule we are */ 1201/* applying here is that the packet must not be fragmented within the layer */ 1202/* 4 header. That is, it must not be a fragment that has its offset set to */ 1203/* start within the layer 4 header (hdrmin) or if it is at offset 0, the */ 1204/* entire layer 4 header must be present (min). */ 1205/* ------------------------------------------------------------------------ */ 1206static INLINE void 1207ipf_pr_short(fin, xmin) 1208 fr_info_t *fin; 1209 int xmin; 1210{ 1211 1212 if (fin->fin_off == 0) { 1213 if (fin->fin_dlen < xmin) 1214 fin->fin_flx |= FI_SHORT; 1215 } else if (fin->fin_off < xmin) { 1216 fin->fin_flx |= FI_SHORT; 1217 } 1218} 1219 1220 1221/* ------------------------------------------------------------------------ */ 1222/* Function: ipf_pr_icmp */ 1223/* Returns: void */ 1224/* Parameters: fin(I) - pointer to packet information */ 1225/* */ 1226/* IPv4 Only */ 1227/* Do a sanity check on the packet for ICMP (v4). In nearly all cases, */ 1228/* except extrememly bad packets, both type and code will be present. */ 1229/* The expected minimum size of an ICMP packet is very much dependent on */ 1230/* the type of it. */ 1231/* */ 1232/* XXX - other ICMP sanity checks? */ 1233/* ------------------------------------------------------------------------ */ 1234static INLINE void 1235ipf_pr_icmp(fin) 1236 fr_info_t *fin; 1237{ 1238 ipf_main_softc_t *softc = fin->fin_main_soft; 1239 int minicmpsz = sizeof(struct icmp); 1240 icmphdr_t *icmp; 1241 ip_t *oip; 1242 1243 ipf_pr_short(fin, ICMPERR_ICMPHLEN); 1244 1245 if (fin->fin_off != 0) { 1246 LBUMPD(ipf_stats[fin->fin_out], fr_v4_icmp_frag); 1247 return; 1248 } 1249 1250 if (ipf_pr_pullup(fin, ICMPERR_ICMPHLEN) == -1) { 1251 LBUMPD(ipf_stats[fin->fin_out], fr_v4_icmp_pullup); 1252 return; 1253 } 1254 1255 icmp = fin->fin_dp; 1256 1257 fin->fin_data[0] = *(u_short *)icmp; 1258 fin->fin_data[1] = icmp->icmp_id; 1259 1260 switch (icmp->icmp_type) 1261 { 1262 case ICMP_ECHOREPLY : 1263 case ICMP_ECHO : 1264 /* Router discovery messaes - RFC 1256 */ 1265 case ICMP_ROUTERADVERT : 1266 case ICMP_ROUTERSOLICIT : 1267 fin->fin_flx |= FI_ICMPQUERY; 1268 minicmpsz = ICMP_MINLEN; 1269 break; 1270 /* 1271 * type(1) + code(1) + cksum(2) + id(2) seq(2) + 1272 * 3 * timestamp(3 * 4) 1273 */ 1274 case ICMP_TSTAMP : 1275 case ICMP_TSTAMPREPLY : 1276 fin->fin_flx |= FI_ICMPQUERY; 1277 minicmpsz = 20; 1278 break; 1279 /* 1280 * type(1) + code(1) + cksum(2) + id(2) seq(2) + 1281 * mask(4) 1282 */ 1283 case ICMP_IREQ : 1284 case ICMP_IREQREPLY : 1285 case ICMP_MASKREQ : 1286 case ICMP_MASKREPLY : 1287 fin->fin_flx |= FI_ICMPQUERY; 1288 minicmpsz = 12; 1289 break; 1290 /* 1291 * type(1) + code(1) + cksum(2) + id(2) seq(2) + ip(20+) 1292 */ 1293 case ICMP_UNREACH : 1294#ifdef icmp_nextmtu 1295 if (icmp->icmp_code == ICMP_UNREACH_NEEDFRAG) { 1296 if (icmp->icmp_nextmtu < softc->ipf_icmpminfragmtu) { 1297 fin->fin_flx |= FI_BAD; 1298 DT3(ipf_fi_bad_icmp_nextmtu, fr_info_t *, fin, u_int, icmp->icmp_nextmtu, u_int, softc->ipf_icmpminfragmtu); 1299 } 1300 } 1301#endif 1302 case ICMP_SOURCEQUENCH : 1303 case ICMP_REDIRECT : 1304 case ICMP_TIMXCEED : 1305 case ICMP_PARAMPROB : 1306 fin->fin_flx |= FI_ICMPERR; 1307 if (ipf_coalesce(fin) != 1) { 1308 LBUMPD(ipf_stats[fin->fin_out], fr_icmp_coalesce); 1309 return; 1310 } 1311 1312 /* 1313 * ICMP error packets should not be generated for IP 1314 * packets that are a fragment that isn't the first 1315 * fragment. 1316 */ 1317 oip = (ip_t *)((char *)fin->fin_dp + ICMPERR_ICMPHLEN); 1318 if ((ntohs(oip->ip_off) & IP_OFFMASK) != 0) { 1319 fin->fin_flx |= FI_BAD; 1320 DT2(ipf_fi_bad_icmp_err, fr_info_t, fin, u_int, (ntohs(oip->ip_off) & IP_OFFMASK)); 1321 } 1322 1323 /* 1324 * If the destination of this packet doesn't match the 1325 * source of the original packet then this packet is 1326 * not correct. 1327 */ 1328 if (oip->ip_src.s_addr != fin->fin_daddr) { 1329 fin->fin_flx |= FI_BAD; 1330 DT1(ipf_fi_bad_src_ne_dst, fr_info_t *, fin); 1331 } 1332 break; 1333 default : 1334 break; 1335 } 1336 1337 ipf_pr_short(fin, minicmpsz); 1338 1339 ipf_checkv4sum(fin); 1340} 1341 1342 1343/* ------------------------------------------------------------------------ */ 1344/* Function: ipf_pr_tcpcommon */ 1345/* Returns: int - 0 = header ok, 1 = bad packet, -1 = buffer error */ 1346/* Parameters: fin(I) - pointer to packet information */ 1347/* */ 1348/* TCP header sanity checking. Look for bad combinations of TCP flags, */ 1349/* and make some checks with how they interact with other fields. */ 1350/* If compiled with IPFILTER_CKSUM, check to see if the TCP checksum is */ 1351/* valid and mark the packet as bad if not. */ 1352/* ------------------------------------------------------------------------ */ 1353static INLINE int 1354ipf_pr_tcpcommon(fin) 1355 fr_info_t *fin; 1356{ 1357 ipf_main_softc_t *softc = fin->fin_main_soft; 1358 int flags, tlen; 1359 tcphdr_t *tcp; 1360 1361 fin->fin_flx |= FI_TCPUDP; 1362 if (fin->fin_off != 0) { 1363 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_frag); 1364 return 0; 1365 } 1366 1367 if (ipf_pr_pullup(fin, sizeof(*tcp)) == -1) { 1368 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_pullup); 1369 return -1; 1370 } 1371 1372 tcp = fin->fin_dp; 1373 if (fin->fin_dlen > 3) { 1374 fin->fin_sport = ntohs(tcp->th_sport); 1375 fin->fin_dport = ntohs(tcp->th_dport); 1376 } 1377 1378 if ((fin->fin_flx & FI_SHORT) != 0) { 1379 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_short); 1380 return 1; 1381 } 1382 1383 /* 1384 * Use of the TCP data offset *must* result in a value that is at 1385 * least the same size as the TCP header. 1386 */ 1387 tlen = TCP_OFF(tcp) << 2; 1388 if (tlen < sizeof(tcphdr_t)) { 1389 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_small); 1390 fin->fin_flx |= FI_BAD; 1391 DT3(ipf_fi_bad_tlen, fr_info_t, fin, u_int, tlen, u_int, sizeof(tcphdr_t)); 1392 return 1; 1393 } 1394 1395 flags = tcp->th_flags; 1396 fin->fin_tcpf = tcp->th_flags; 1397 1398 /* 1399 * If the urgent flag is set, then the urgent pointer must 1400 * also be set and vice versa. Good TCP packets do not have 1401 * just one of these set. 1402 */ 1403 if ((flags & TH_URG) != 0 && (tcp->th_urp == 0)) { 1404 fin->fin_flx |= FI_BAD; 1405 DT3(ipf_fi_bad_th_urg, fr_info_t*, fin, u_int, (flags & TH_URG), u_int, tcp->th_urp); 1406#if 0 1407 } else if ((flags & TH_URG) == 0 && (tcp->th_urp != 0)) { 1408 /* 1409 * Ignore this case (#if 0) as it shows up in "real" 1410 * traffic with bogus values in the urgent pointer field. 1411 */ 1412 fin->fin_flx |= FI_BAD; 1413 DT3(ipf_fi_bad_th_urg0, fr_info_t *, fin, u_int, (flags & TH_URG), u_int, tcp->th_urp); 1414#endif 1415 } else if (((flags & (TH_SYN|TH_FIN)) != 0) && 1416 ((flags & (TH_RST|TH_ACK)) == TH_RST)) { 1417 /* TH_FIN|TH_RST|TH_ACK seems to appear "naturally" */ 1418 fin->fin_flx |= FI_BAD; 1419 DT1(ipf_fi_bad_th_fin_rst_ack, fr_info_t, fin); 1420#if 1 1421 } else if (((flags & TH_SYN) != 0) && 1422 ((flags & (TH_URG|TH_PUSH)) != 0)) { 1423 /* 1424 * SYN with URG and PUSH set is not for normal TCP but it is 1425 * possible(?) with T/TCP...but who uses T/TCP? 1426 */ 1427 fin->fin_flx |= FI_BAD; 1428 DT1(ipf_fi_bad_th_syn_urg_psh, fr_info_t *, fin); 1429#endif 1430 } else if (!(flags & TH_ACK)) { 1431 /* 1432 * If the ack bit isn't set, then either the SYN or 1433 * RST bit must be set. If the SYN bit is set, then 1434 * we expect the ACK field to be 0. If the ACK is 1435 * not set and if URG, PSH or FIN are set, consdier 1436 * that to indicate a bad TCP packet. 1437 */ 1438 if ((flags == TH_SYN) && (tcp->th_ack != 0)) { 1439 /* 1440 * Cisco PIX sets the ACK field to a random value. 1441 * In light of this, do not set FI_BAD until a patch 1442 * is available from Cisco to ensure that 1443 * interoperability between existing systems is 1444 * achieved. 1445 */ 1446 /*fin->fin_flx |= FI_BAD*/; 1447 /*DT1(ipf_fi_bad_th_syn_ack, fr_info_t *, fin);*/ 1448 } else if (!(flags & (TH_RST|TH_SYN))) { 1449 fin->fin_flx |= FI_BAD; 1450 DT1(ipf_fi_bad_th_rst_syn, fr_info_t *, fin); 1451 } else if ((flags & (TH_URG|TH_PUSH|TH_FIN)) != 0) { 1452 fin->fin_flx |= FI_BAD; 1453 DT1(ipf_fi_bad_th_urg_push_fin, fr_info_t *, fin); 1454 } 1455 } 1456 if (fin->fin_flx & FI_BAD) { 1457 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_bad_flags); 1458 return 1; 1459 } 1460 1461 /* 1462 * At this point, it's not exactly clear what is to be gained by 1463 * marking up which TCP options are and are not present. The one we 1464 * are most interested in is the TCP window scale. This is only in 1465 * a SYN packet [RFC1323] so we don't need this here...? 1466 * Now if we were to analyse the header for passive fingerprinting, 1467 * then that might add some weight to adding this... 1468 */ 1469 if (tlen == sizeof(tcphdr_t)) { 1470 return 0; 1471 } 1472 1473 if (ipf_pr_pullup(fin, tlen) == -1) { 1474 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_pullup); 1475 return -1; 1476 } 1477 1478#if 0 1479 tcp = fin->fin_dp; 1480 ip = fin->fin_ip; 1481 s = (u_char *)(tcp + 1); 1482 off = IP_HL(ip) << 2; 1483# ifdef _KERNEL 1484 if (fin->fin_mp != NULL) { 1485 mb_t *m = *fin->fin_mp; 1486 1487 if (off + tlen > M_LEN(m)) 1488 return; 1489 } 1490# endif 1491 for (tlen -= (int)sizeof(*tcp); tlen > 0; ) { 1492 opt = *s; 1493 if (opt == '\0') 1494 break; 1495 else if (opt == TCPOPT_NOP) 1496 ol = 1; 1497 else { 1498 if (tlen < 2) 1499 break; 1500 ol = (int)*(s + 1); 1501 if (ol < 2 || ol > tlen) 1502 break; 1503 } 1504 1505 for (i = 9, mv = 4; mv >= 0; ) { 1506 op = ipopts + i; 1507 if (opt == (u_char)op->ol_val) { 1508 optmsk |= op->ol_bit; 1509 break; 1510 } 1511 } 1512 tlen -= ol; 1513 s += ol; 1514 } 1515#endif /* 0 */ 1516 1517 return 0; 1518} 1519 1520 1521 1522/* ------------------------------------------------------------------------ */ 1523/* Function: ipf_pr_udpcommon */ 1524/* Returns: int - 0 = header ok, 1 = bad packet */ 1525/* Parameters: fin(I) - pointer to packet information */ 1526/* */ 1527/* Extract the UDP source and destination ports, if present. If compiled */ 1528/* with IPFILTER_CKSUM, check to see if the UDP checksum is valid. */ 1529/* ------------------------------------------------------------------------ */ 1530static INLINE int 1531ipf_pr_udpcommon(fin) 1532 fr_info_t *fin; 1533{ 1534 udphdr_t *udp; 1535 1536 fin->fin_flx |= FI_TCPUDP; 1537 1538 if (!fin->fin_off && (fin->fin_dlen > 3)) { 1539 if (ipf_pr_pullup(fin, sizeof(*udp)) == -1) { 1540 ipf_main_softc_t *softc = fin->fin_main_soft; 1541 1542 fin->fin_flx |= FI_SHORT; 1543 LBUMPD(ipf_stats[fin->fin_out], fr_udp_pullup); 1544 return 1; 1545 } 1546 1547 udp = fin->fin_dp; 1548 1549 fin->fin_sport = ntohs(udp->uh_sport); 1550 fin->fin_dport = ntohs(udp->uh_dport); 1551 } 1552 1553 return 0; 1554} 1555 1556 1557/* ------------------------------------------------------------------------ */ 1558/* Function: ipf_pr_tcp */ 1559/* Returns: void */ 1560/* Parameters: fin(I) - pointer to packet information */ 1561/* */ 1562/* IPv4 Only */ 1563/* Analyse the packet for IPv4/TCP properties. */ 1564/* ------------------------------------------------------------------------ */ 1565static INLINE void 1566ipf_pr_tcp(fin) 1567 fr_info_t *fin; 1568{ 1569 1570 ipf_pr_short(fin, sizeof(tcphdr_t)); 1571 1572 if (ipf_pr_tcpcommon(fin) == 0) 1573 ipf_checkv4sum(fin); 1574} 1575 1576 1577/* ------------------------------------------------------------------------ */ 1578/* Function: ipf_pr_udp */ 1579/* Returns: void */ 1580/* Parameters: fin(I) - pointer to packet information */ 1581/* */ 1582/* IPv4 Only */ 1583/* Analyse the packet for IPv4/UDP properties. */ 1584/* ------------------------------------------------------------------------ */ 1585static INLINE void 1586ipf_pr_udp(fin) 1587 fr_info_t *fin; 1588{ 1589 1590 ipf_pr_short(fin, sizeof(udphdr_t)); 1591 1592 if (ipf_pr_udpcommon(fin) == 0) 1593 ipf_checkv4sum(fin); 1594} 1595 1596 1597/* ------------------------------------------------------------------------ */ 1598/* Function: ipf_pr_esp */ 1599/* Returns: void */ 1600/* Parameters: fin(I) - pointer to packet information */ 1601/* */ 1602/* Analyse the packet for ESP properties. */ 1603/* The minimum length is taken to be the SPI (32bits) plus a tail (32bits) */ 1604/* even though the newer ESP packets must also have a sequence number that */ 1605/* is 32bits as well, it is not possible(?) to determine the version from a */ 1606/* simple packet header. */ 1607/* ------------------------------------------------------------------------ */ 1608static INLINE void 1609ipf_pr_esp(fin) 1610 fr_info_t *fin; 1611{ 1612 1613 if (fin->fin_off == 0) { 1614 ipf_pr_short(fin, 8); 1615 if (ipf_pr_pullup(fin, 8) == -1) { 1616 ipf_main_softc_t *softc = fin->fin_main_soft; 1617 1618 LBUMPD(ipf_stats[fin->fin_out], fr_v4_esp_pullup); 1619 } 1620 } 1621} 1622 1623 1624/* ------------------------------------------------------------------------ */ 1625/* Function: ipf_pr_ah */ 1626/* Returns: int - value of the next header or IPPROTO_NONE if error */ 1627/* Parameters: fin(I) - pointer to packet information */ 1628/* */ 1629/* Analyse the packet for AH properties. */ 1630/* The minimum length is taken to be the combination of all fields in the */ 1631/* header being present and no authentication data (null algorithm used.) */ 1632/* ------------------------------------------------------------------------ */ 1633static INLINE int 1634ipf_pr_ah(fin) 1635 fr_info_t *fin; 1636{ 1637 ipf_main_softc_t *softc = fin->fin_main_soft; 1638 authhdr_t *ah; 1639 int len; 1640 1641 fin->fin_flx |= FI_AH; 1642 ipf_pr_short(fin, sizeof(*ah)); 1643 1644 if (((fin->fin_flx & FI_SHORT) != 0) || (fin->fin_off != 0)) { 1645 LBUMPD(ipf_stats[fin->fin_out], fr_v4_ah_bad); 1646 return IPPROTO_NONE; 1647 } 1648 1649 if (ipf_pr_pullup(fin, sizeof(*ah)) == -1) { 1650 DT(fr_v4_ah_pullup_1); 1651 LBUMP(ipf_stats[fin->fin_out].fr_v4_ah_pullup); 1652 return IPPROTO_NONE; 1653 } 1654 1655 ah = (authhdr_t *)fin->fin_dp; 1656 1657 len = (ah->ah_plen + 2) << 2; 1658 ipf_pr_short(fin, len); 1659 if (ipf_pr_pullup(fin, len) == -1) { 1660 DT(fr_v4_ah_pullup_2); 1661 LBUMP(ipf_stats[fin->fin_out].fr_v4_ah_pullup); 1662 return IPPROTO_NONE; 1663 } 1664 1665 /* 1666 * Adjust fin_dp and fin_dlen for skipping over the authentication 1667 * header. 1668 */ 1669 fin->fin_dp = (char *)fin->fin_dp + len; 1670 fin->fin_dlen -= len; 1671 return ah->ah_next; 1672} 1673 1674 1675/* ------------------------------------------------------------------------ */ 1676/* Function: ipf_pr_gre */ 1677/* Returns: void */ 1678/* Parameters: fin(I) - pointer to packet information */ 1679/* */ 1680/* Analyse the packet for GRE properties. */ 1681/* ------------------------------------------------------------------------ */ 1682static INLINE void 1683ipf_pr_gre(fin) 1684 fr_info_t *fin; 1685{ 1686 ipf_main_softc_t *softc = fin->fin_main_soft; 1687 grehdr_t *gre; 1688 1689 ipf_pr_short(fin, sizeof(grehdr_t)); 1690 1691 if (fin->fin_off != 0) { 1692 LBUMPD(ipf_stats[fin->fin_out], fr_v4_gre_frag); 1693 return; 1694 } 1695 1696 if (ipf_pr_pullup(fin, sizeof(grehdr_t)) == -1) { 1697 LBUMPD(ipf_stats[fin->fin_out], fr_v4_gre_pullup); 1698 return; 1699 } 1700 1701 gre = fin->fin_dp; 1702 if (GRE_REV(gre->gr_flags) == 1) 1703 fin->fin_data[0] = gre->gr_call; 1704} 1705 1706 1707/* ------------------------------------------------------------------------ */ 1708/* Function: ipf_pr_ipv4hdr */ 1709/* Returns: void */ 1710/* Parameters: fin(I) - pointer to packet information */ 1711/* */ 1712/* IPv4 Only */ 1713/* Analyze the IPv4 header and set fields in the fr_info_t structure. */ 1714/* Check all options present and flag their presence if any exist. */ 1715/* ------------------------------------------------------------------------ */ 1716static INLINE void 1717ipf_pr_ipv4hdr(fin) 1718 fr_info_t *fin; 1719{ 1720 u_short optmsk = 0, secmsk = 0, auth = 0; 1721 int hlen, ol, mv, p, i; 1722 const struct optlist *op; 1723 u_char *s, opt; 1724 u_short off; 1725 fr_ip_t *fi; 1726 ip_t *ip; 1727 1728 fi = &fin->fin_fi; 1729 hlen = fin->fin_hlen; 1730 1731 ip = fin->fin_ip; 1732 p = ip->ip_p; 1733 fi->fi_p = p; 1734 fin->fin_crc = p; 1735 fi->fi_tos = ip->ip_tos; 1736 fin->fin_id = ip->ip_id; 1737 off = ntohs(ip->ip_off); 1738 1739 /* Get both TTL and protocol */ 1740 fi->fi_p = ip->ip_p; 1741 fi->fi_ttl = ip->ip_ttl; 1742 1743 /* Zero out bits not used in IPv6 address */ 1744 fi->fi_src.i6[1] = 0; 1745 fi->fi_src.i6[2] = 0; 1746 fi->fi_src.i6[3] = 0; 1747 fi->fi_dst.i6[1] = 0; 1748 fi->fi_dst.i6[2] = 0; 1749 fi->fi_dst.i6[3] = 0; 1750 1751 fi->fi_saddr = ip->ip_src.s_addr; 1752 fin->fin_crc += fi->fi_saddr; 1753 fi->fi_daddr = ip->ip_dst.s_addr; 1754 fin->fin_crc += fi->fi_daddr; 1755 if (IN_CLASSD(ntohl(fi->fi_daddr))) 1756 fin->fin_flx |= FI_MULTICAST|FI_MBCAST; 1757 1758 /* 1759 * set packet attribute flags based on the offset and 1760 * calculate the byte offset that it represents. 1761 */ 1762 off &= IP_MF|IP_OFFMASK; 1763 if (off != 0) { 1764 int morefrag = off & IP_MF; 1765 1766 fi->fi_flx |= FI_FRAG; 1767 off &= IP_OFFMASK; 1768 if (off != 0) { 1769 fin->fin_flx |= FI_FRAGBODY; 1770 off <<= 3; 1771 if ((off + fin->fin_dlen > 65535) || 1772 (fin->fin_dlen == 0) || 1773 ((morefrag != 0) && ((fin->fin_dlen & 7) != 0))) { 1774 /* 1775 * The length of the packet, starting at its 1776 * offset cannot exceed 65535 (0xffff) as the 1777 * length of an IP packet is only 16 bits. 1778 * 1779 * Any fragment that isn't the last fragment 1780 * must have a length greater than 0 and it 1781 * must be an even multiple of 8. 1782 */ 1783 fi->fi_flx |= FI_BAD; 1784 DT1(ipf_fi_bad_fragbody_gt_65535, fr_info_t *, fin); 1785 } 1786 } 1787 } 1788 fin->fin_off = off; 1789 1790 /* 1791 * Call per-protocol setup and checking 1792 */ 1793 if (p == IPPROTO_AH) { 1794 /* 1795 * Treat AH differently because we expect there to be another 1796 * layer 4 header after it. 1797 */ 1798 p = ipf_pr_ah(fin); 1799 } 1800 1801 switch (p) 1802 { 1803 case IPPROTO_UDP : 1804 ipf_pr_udp(fin); 1805 break; 1806 case IPPROTO_TCP : 1807 ipf_pr_tcp(fin); 1808 break; 1809 case IPPROTO_ICMP : 1810 ipf_pr_icmp(fin); 1811 break; 1812 case IPPROTO_ESP : 1813 ipf_pr_esp(fin); 1814 break; 1815 case IPPROTO_GRE : 1816 ipf_pr_gre(fin); 1817 break; 1818 } 1819 1820 ip = fin->fin_ip; 1821 if (ip == NULL) 1822 return; 1823 1824 /* 1825 * If it is a standard IP header (no options), set the flag fields 1826 * which relate to options to 0. 1827 */ 1828 if (hlen == sizeof(*ip)) { 1829 fi->fi_optmsk = 0; 1830 fi->fi_secmsk = 0; 1831 fi->fi_auth = 0; 1832 return; 1833 } 1834 1835 /* 1836 * So the IP header has some IP options attached. Walk the entire 1837 * list of options present with this packet and set flags to indicate 1838 * which ones are here and which ones are not. For the somewhat out 1839 * of date and obscure security classification options, set a flag to 1840 * represent which classification is present. 1841 */ 1842 fi->fi_flx |= FI_OPTIONS; 1843 1844 for (s = (u_char *)(ip + 1), hlen -= (int)sizeof(*ip); hlen > 0; ) { 1845 opt = *s; 1846 if (opt == '\0') 1847 break; 1848 else if (opt == IPOPT_NOP) 1849 ol = 1; 1850 else { 1851 if (hlen < 2) 1852 break; 1853 ol = (int)*(s + 1); 1854 if (ol < 2 || ol > hlen) 1855 break; 1856 } 1857 for (i = 9, mv = 4; mv >= 0; ) { 1858 op = ipopts + i; 1859 1860 if ((opt == (u_char)op->ol_val) && (ol > 4)) { 1861 u_32_t doi; 1862 1863 switch (opt) 1864 { 1865 case IPOPT_SECURITY : 1866 if (optmsk & op->ol_bit) { 1867 fin->fin_flx |= FI_BAD; 1868 DT2(ipf_fi_bad_ipopt_security, fr_info_t *, fin, u_short, (optmsk & op->ol_bit)); 1869 } else { 1870 doi = ipf_checkripso(s); 1871 secmsk = doi >> 16; 1872 auth = doi & 0xffff; 1873 } 1874 break; 1875 1876 case IPOPT_CIPSO : 1877 1878 if (optmsk & op->ol_bit) { 1879 fin->fin_flx |= FI_BAD; 1880 DT2(ipf_fi_bad_ipopt_cipso, fr_info_t *, fin, u_short, (optmsk & op->ol_bit)); 1881 } else { 1882 doi = ipf_checkcipso(fin, 1883 s, ol); 1884 secmsk = doi >> 16; 1885 auth = doi & 0xffff; 1886 } 1887 break; 1888 } 1889 optmsk |= op->ol_bit; 1890 } 1891 1892 if (opt < op->ol_val) 1893 i -= mv; 1894 else 1895 i += mv; 1896 mv--; 1897 } 1898 hlen -= ol; 1899 s += ol; 1900 } 1901 1902 /* 1903 * 1904 */ 1905 if (auth && !(auth & 0x0100)) 1906 auth &= 0xff00; 1907 fi->fi_optmsk = optmsk; 1908 fi->fi_secmsk = secmsk; 1909 fi->fi_auth = auth; 1910} 1911 1912 1913/* ------------------------------------------------------------------------ */ 1914/* Function: ipf_checkripso */ 1915/* Returns: void */ 1916/* Parameters: s(I) - pointer to start of RIPSO option */ 1917/* */ 1918/* ------------------------------------------------------------------------ */ 1919static u_32_t 1920ipf_checkripso(s) 1921 u_char *s; 1922{ 1923 const struct optlist *sp; 1924 u_short secmsk = 0, auth = 0; 1925 u_char sec; 1926 int j, m; 1927 1928 sec = *(s + 2); /* classification */ 1929 for (j = 3, m = 2; m >= 0; ) { 1930 sp = secopt + j; 1931 if (sec == sp->ol_val) { 1932 secmsk |= sp->ol_bit; 1933 auth = *(s + 3); 1934 auth *= 256; 1935 auth += *(s + 4); 1936 break; 1937 } 1938 if (sec < sp->ol_val) 1939 j -= m; 1940 else 1941 j += m; 1942 m--; 1943 } 1944 1945 return (secmsk << 16) | auth; 1946} 1947 1948 1949/* ------------------------------------------------------------------------ */ 1950/* Function: ipf_checkcipso */ 1951/* Returns: u_32_t - 0 = failure, else the doi from the header */ 1952/* Parameters: fin(IO) - pointer to packet information */ 1953/* s(I) - pointer to start of CIPSO option */ 1954/* ol(I) - length of CIPSO option field */ 1955/* */ 1956/* This function returns the domain of integrity (DOI) field from the CIPSO */ 1957/* header and returns that whilst also storing the highest sensitivity */ 1958/* value found in the fr_info_t structure. */ 1959/* */ 1960/* No attempt is made to extract the category bitmaps as these are defined */ 1961/* by the user (rather than the protocol) and can be rather numerous on the */ 1962/* end nodes. */ 1963/* ------------------------------------------------------------------------ */ 1964static u_32_t 1965ipf_checkcipso(fin, s, ol) 1966 fr_info_t *fin; 1967 u_char *s; 1968 int ol; 1969{ 1970 ipf_main_softc_t *softc = fin->fin_main_soft; 1971 fr_ip_t *fi; 1972 u_32_t doi; 1973 u_char *t, tag, tlen, sensitivity; 1974 int len; 1975 1976 if (ol < 6 || ol > 40) { 1977 LBUMPD(ipf_stats[fin->fin_out], fr_v4_cipso_bad); 1978 fin->fin_flx |= FI_BAD; 1979 DT2(ipf_fi_bad_checkcipso_ol, fr_info_t *, fin, u_int, ol); 1980 return 0; 1981 } 1982 1983 fi = &fin->fin_fi; 1984 fi->fi_sensitivity = 0; 1985 /* 1986 * The DOI field MUST be there. 1987 */ 1988 bcopy(s + 2, &doi, sizeof(doi)); 1989 1990 t = (u_char *)s + 6; 1991 for (len = ol - 6; len >= 2; len -= tlen, t+= tlen) { 1992 tag = *t; 1993 tlen = *(t + 1); 1994 if (tlen > len || tlen < 4 || tlen > 34) { 1995 LBUMPD(ipf_stats[fin->fin_out], fr_v4_cipso_tlen); 1996 fin->fin_flx |= FI_BAD; 1997 DT2(ipf_fi_bad_checkcipso_tlen, fr_info_t *, fin, u_int, tlen); 1998 return 0; 1999 } 2000 2001 sensitivity = 0; 2002 /* 2003 * Tag numbers 0, 1, 2, 5 are laid out in the CIPSO Internet 2004 * draft (16 July 1992) that has expired. 2005 */ 2006 if (tag == 0) { 2007 fin->fin_flx |= FI_BAD; 2008 DT2(ipf_fi_bad_checkcipso_tag, fr_info_t *, fin, u_int, tag); 2009 continue; 2010 } else if (tag == 1) { 2011 if (*(t + 2) != 0) { 2012 fin->fin_flx |= FI_BAD; 2013 DT2(ipf_fi_bad_checkcipso_tag1_t2, fr_info_t *, fin, u_int, (*t + 2)); 2014 continue; 2015 } 2016 sensitivity = *(t + 3); 2017 /* Category bitmap for categories 0-239 */ 2018 2019 } else if (tag == 4) { 2020 if (*(t + 2) != 0) { 2021 fin->fin_flx |= FI_BAD; 2022 DT2(ipf_fi_bad_checkcipso_tag4_t2, fr_info_t *, fin, u_int, (*t + 2)); 2023 continue; 2024 } 2025 sensitivity = *(t + 3); 2026 /* Enumerated categories, 16bits each, upto 15 */ 2027 2028 } else if (tag == 5) { 2029 if (*(t + 2) != 0) { 2030 fin->fin_flx |= FI_BAD; 2031 DT2(ipf_fi_bad_checkcipso_tag5_t2, fr_info_t *, fin, u_int, (*t + 2)); 2032 continue; 2033 } 2034 sensitivity = *(t + 3); 2035 /* Range of categories (2*16bits), up to 7 pairs */ 2036 2037 } else if (tag > 127) { 2038 /* Custom defined DOI */ 2039 ; 2040 } else { 2041 fin->fin_flx |= FI_BAD; 2042 DT2(ipf_fi_bad_checkcipso_tag127, fr_info_t *, fin, u_int, tag); 2043 continue; 2044 } 2045 2046 if (sensitivity > fi->fi_sensitivity) 2047 fi->fi_sensitivity = sensitivity; 2048 } 2049 2050 return doi; 2051} 2052 2053 2054/* ------------------------------------------------------------------------ */ 2055/* Function: ipf_makefrip */ 2056/* Returns: int - 0 == packet ok, -1 == packet freed */ 2057/* Parameters: hlen(I) - length of IP packet header */ 2058/* ip(I) - pointer to the IP header */ 2059/* fin(IO) - pointer to packet information */ 2060/* */ 2061/* Compact the IP header into a structure which contains just the info. */ 2062/* which is useful for comparing IP headers with and store this information */ 2063/* in the fr_info_t structure pointer to by fin. At present, it is assumed */ 2064/* this function will be called with either an IPv4 or IPv6 packet. */ 2065/* ------------------------------------------------------------------------ */ 2066int 2067ipf_makefrip(hlen, ip, fin) 2068 int hlen; 2069 ip_t *ip; 2070 fr_info_t *fin; 2071{ 2072 ipf_main_softc_t *softc = fin->fin_main_soft; 2073 int v; 2074 2075 fin->fin_depth = 0; 2076 fin->fin_hlen = (u_short)hlen; 2077 fin->fin_ip = ip; 2078 fin->fin_rule = 0xffffffff; 2079 fin->fin_group[0] = -1; 2080 fin->fin_group[1] = '\0'; 2081 fin->fin_dp = (char *)ip + hlen; 2082 2083 v = fin->fin_v; 2084 if (v == 4) { 2085 fin->fin_plen = ntohs(ip->ip_len); 2086 fin->fin_dlen = fin->fin_plen - hlen; 2087 ipf_pr_ipv4hdr(fin); 2088#ifdef USE_INET6 2089 } else if (v == 6) { 2090 fin->fin_plen = ntohs(((ip6_t *)ip)->ip6_plen); 2091 fin->fin_dlen = fin->fin_plen; 2092 fin->fin_plen += hlen; 2093 2094 ipf_pr_ipv6hdr(fin); 2095#endif 2096 } 2097 if (fin->fin_ip == NULL) { 2098 LBUMP(ipf_stats[fin->fin_out].fr_ip_freed); 2099 return -1; 2100 } 2101 return 0; 2102} 2103 2104 2105/* ------------------------------------------------------------------------ */ 2106/* Function: ipf_portcheck */ 2107/* Returns: int - 1 == port matched, 0 == port match failed */ 2108/* Parameters: frp(I) - pointer to port check `expression' */ 2109/* pop(I) - port number to evaluate */ 2110/* */ 2111/* Perform a comparison of a port number against some other(s), using a */ 2112/* structure with compare information stored in it. */ 2113/* ------------------------------------------------------------------------ */ 2114static INLINE int 2115ipf_portcheck(frp, pop) 2116 frpcmp_t *frp; 2117 u_32_t pop; 2118{ 2119 int err = 1; 2120 u_32_t po; 2121 2122 po = frp->frp_port; 2123 2124 /* 2125 * Do opposite test to that required and continue if that succeeds. 2126 */ 2127 switch (frp->frp_cmp) 2128 { 2129 case FR_EQUAL : 2130 if (pop != po) /* EQUAL */ 2131 err = 0; 2132 break; 2133 case FR_NEQUAL : 2134 if (pop == po) /* NOTEQUAL */ 2135 err = 0; 2136 break; 2137 case FR_LESST : 2138 if (pop >= po) /* LESSTHAN */ 2139 err = 0; 2140 break; 2141 case FR_GREATERT : 2142 if (pop <= po) /* GREATERTHAN */ 2143 err = 0; 2144 break; 2145 case FR_LESSTE : 2146 if (pop > po) /* LT or EQ */ 2147 err = 0; 2148 break; 2149 case FR_GREATERTE : 2150 if (pop < po) /* GT or EQ */ 2151 err = 0; 2152 break; 2153 case FR_OUTRANGE : 2154 if (pop >= po && pop <= frp->frp_top) /* Out of range */ 2155 err = 0; 2156 break; 2157 case FR_INRANGE : 2158 if (pop <= po || pop >= frp->frp_top) /* In range */ 2159 err = 0; 2160 break; 2161 case FR_INCRANGE : 2162 if (pop < po || pop > frp->frp_top) /* Inclusive range */ 2163 err = 0; 2164 break; 2165 default : 2166 break; 2167 } 2168 return err; 2169} 2170 2171 2172/* ------------------------------------------------------------------------ */ 2173/* Function: ipf_tcpudpchk */ 2174/* Returns: int - 1 == protocol matched, 0 == check failed */ 2175/* Parameters: fda(I) - pointer to packet information */ 2176/* ft(I) - pointer to structure with comparison data */ 2177/* */ 2178/* Compares the current pcket (assuming it is TCP/UDP) information with a */ 2179/* structure containing information that we want to match against. */ 2180/* ------------------------------------------------------------------------ */ 2181int 2182ipf_tcpudpchk(fi, ft) 2183 fr_ip_t *fi; 2184 frtuc_t *ft; 2185{ 2186 int err = 1; 2187 2188 /* 2189 * Both ports should *always* be in the first fragment. 2190 * So far, I cannot find any cases where they can not be. 2191 * 2192 * compare destination ports 2193 */ 2194 if (ft->ftu_dcmp) 2195 err = ipf_portcheck(&ft->ftu_dst, fi->fi_ports[1]); 2196 2197 /* 2198 * compare source ports 2199 */ 2200 if (err && ft->ftu_scmp) 2201 err = ipf_portcheck(&ft->ftu_src, fi->fi_ports[0]); 2202 2203 /* 2204 * If we don't have all the TCP/UDP header, then how can we 2205 * expect to do any sort of match on it ? If we were looking for 2206 * TCP flags, then NO match. If not, then match (which should 2207 * satisfy the "short" class too). 2208 */ 2209 if (err && (fi->fi_p == IPPROTO_TCP)) { 2210 if (fi->fi_flx & FI_SHORT) 2211 return !(ft->ftu_tcpf | ft->ftu_tcpfm); 2212 /* 2213 * Match the flags ? If not, abort this match. 2214 */ 2215 if (ft->ftu_tcpfm && 2216 ft->ftu_tcpf != (fi->fi_tcpf & ft->ftu_tcpfm)) { 2217 FR_DEBUG(("f. %#x & %#x != %#x\n", fi->fi_tcpf, 2218 ft->ftu_tcpfm, ft->ftu_tcpf)); 2219 err = 0; 2220 } 2221 } 2222 return err; 2223} 2224 2225 2226/* ------------------------------------------------------------------------ */ 2227/* Function: ipf_check_ipf */ 2228/* Returns: int - 0 == match, else no match */ 2229/* Parameters: fin(I) - pointer to packet information */ 2230/* fr(I) - pointer to filter rule */ 2231/* portcmp(I) - flag indicating whether to attempt matching on */ 2232/* TCP/UDP port data. */ 2233/* */ 2234/* Check to see if a packet matches an IPFilter rule. Checks of addresses, */ 2235/* port numbers, etc, for "standard" IPFilter rules are all orchestrated in */ 2236/* this function. */ 2237/* ------------------------------------------------------------------------ */ 2238static INLINE int 2239ipf_check_ipf(fin, fr, portcmp) 2240 fr_info_t *fin; 2241 frentry_t *fr; 2242 int portcmp; 2243{ 2244 u_32_t *ld, *lm, *lip; 2245 fripf_t *fri; 2246 fr_ip_t *fi; 2247 int i; 2248 2249 fi = &fin->fin_fi; 2250 fri = fr->fr_ipf; 2251 lip = (u_32_t *)fi; 2252 lm = (u_32_t *)&fri->fri_mip; 2253 ld = (u_32_t *)&fri->fri_ip; 2254 2255 /* 2256 * first 32 bits to check coversion: 2257 * IP version, TOS, TTL, protocol 2258 */ 2259 i = ((*lip & *lm) != *ld); 2260 FR_DEBUG(("0. %#08x & %#08x != %#08x\n", 2261 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2262 if (i) 2263 return 1; 2264 2265 /* 2266 * Next 32 bits is a constructed bitmask indicating which IP options 2267 * are present (if any) in this packet. 2268 */ 2269 lip++, lm++, ld++; 2270 i = ((*lip & *lm) != *ld); 2271 FR_DEBUG(("1. %#08x & %#08x != %#08x\n", 2272 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2273 if (i != 0) 2274 return 1; 2275 2276 lip++, lm++, ld++; 2277 /* 2278 * Unrolled loops (4 each, for 32 bits) for address checks. 2279 */ 2280 /* 2281 * Check the source address. 2282 */ 2283 if (fr->fr_satype == FRI_LOOKUP) { 2284 i = (*fr->fr_srcfunc)(fin->fin_main_soft, fr->fr_srcptr, 2285 fi->fi_v, lip, fin->fin_plen); 2286 if (i == -1) 2287 return 1; 2288 lip += 3; 2289 lm += 3; 2290 ld += 3; 2291 } else { 2292 i = ((*lip & *lm) != *ld); 2293 FR_DEBUG(("2a. %#08x & %#08x != %#08x\n", 2294 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2295 if (fi->fi_v == 6) { 2296 lip++, lm++, ld++; 2297 i |= ((*lip & *lm) != *ld); 2298 FR_DEBUG(("2b. %#08x & %#08x != %#08x\n", 2299 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2300 lip++, lm++, ld++; 2301 i |= ((*lip & *lm) != *ld); 2302 FR_DEBUG(("2c. %#08x & %#08x != %#08x\n", 2303 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2304 lip++, lm++, ld++; 2305 i |= ((*lip & *lm) != *ld); 2306 FR_DEBUG(("2d. %#08x & %#08x != %#08x\n", 2307 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2308 } else { 2309 lip += 3; 2310 lm += 3; 2311 ld += 3; 2312 } 2313 } 2314 i ^= (fr->fr_flags & FR_NOTSRCIP) >> 6; 2315 if (i != 0) 2316 return 1; 2317 2318 /* 2319 * Check the destination address. 2320 */ 2321 lip++, lm++, ld++; 2322 if (fr->fr_datype == FRI_LOOKUP) { 2323 i = (*fr->fr_dstfunc)(fin->fin_main_soft, fr->fr_dstptr, 2324 fi->fi_v, lip, fin->fin_plen); 2325 if (i == -1) 2326 return 1; 2327 lip += 3; 2328 lm += 3; 2329 ld += 3; 2330 } else { 2331 i = ((*lip & *lm) != *ld); 2332 FR_DEBUG(("3a. %#08x & %#08x != %#08x\n", 2333 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2334 if (fi->fi_v == 6) { 2335 lip++, lm++, ld++; 2336 i |= ((*lip & *lm) != *ld); 2337 FR_DEBUG(("3b. %#08x & %#08x != %#08x\n", 2338 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2339 lip++, lm++, ld++; 2340 i |= ((*lip & *lm) != *ld); 2341 FR_DEBUG(("3c. %#08x & %#08x != %#08x\n", 2342 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2343 lip++, lm++, ld++; 2344 i |= ((*lip & *lm) != *ld); 2345 FR_DEBUG(("3d. %#08x & %#08x != %#08x\n", 2346 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2347 } else { 2348 lip += 3; 2349 lm += 3; 2350 ld += 3; 2351 } 2352 } 2353 i ^= (fr->fr_flags & FR_NOTDSTIP) >> 7; 2354 if (i != 0) 2355 return 1; 2356 /* 2357 * IP addresses matched. The next 32bits contains: 2358 * mast of old IP header security & authentication bits. 2359 */ 2360 lip++, lm++, ld++; 2361 i = (*ld - (*lip & *lm)); 2362 FR_DEBUG(("4. %#08x & %#08x != %#08x\n", *lip, *lm, *ld)); 2363 2364 /* 2365 * Next we have 32 bits of packet flags. 2366 */ 2367 lip++, lm++, ld++; 2368 i |= (*ld - (*lip & *lm)); 2369 FR_DEBUG(("5. %#08x & %#08x != %#08x\n", *lip, *lm, *ld)); 2370 2371 if (i == 0) { 2372 /* 2373 * If a fragment, then only the first has what we're 2374 * looking for here... 2375 */ 2376 if (portcmp) { 2377 if (!ipf_tcpudpchk(&fin->fin_fi, &fr->fr_tuc)) 2378 i = 1; 2379 } else { 2380 if (fr->fr_dcmp || fr->fr_scmp || 2381 fr->fr_tcpf || fr->fr_tcpfm) 2382 i = 1; 2383 if (fr->fr_icmpm || fr->fr_icmp) { 2384 if (((fi->fi_p != IPPROTO_ICMP) && 2385 (fi->fi_p != IPPROTO_ICMPV6)) || 2386 fin->fin_off || (fin->fin_dlen < 2)) 2387 i = 1; 2388 else if ((fin->fin_data[0] & fr->fr_icmpm) != 2389 fr->fr_icmp) { 2390 FR_DEBUG(("i. %#x & %#x != %#x\n", 2391 fin->fin_data[0], 2392 fr->fr_icmpm, fr->fr_icmp)); 2393 i = 1; 2394 } 2395 } 2396 } 2397 } 2398 return i; 2399} 2400 2401 2402/* ------------------------------------------------------------------------ */ 2403/* Function: ipf_scanlist */ 2404/* Returns: int - result flags of scanning filter list */ 2405/* Parameters: fin(I) - pointer to packet information */ 2406/* pass(I) - default result to return for filtering */ 2407/* */ 2408/* Check the input/output list of rules for a match to the current packet. */ 2409/* If a match is found, the value of fr_flags from the rule becomes the */ 2410/* return value and fin->fin_fr points to the matched rule. */ 2411/* */ 2412/* This function may be called recusively upto 16 times (limit inbuilt.) */ 2413/* When unwinding, it should finish up with fin_depth as 0. */ 2414/* */ 2415/* Could be per interface, but this gets real nasty when you don't have, */ 2416/* or can't easily change, the kernel source code to . */ 2417/* ------------------------------------------------------------------------ */ 2418int 2419ipf_scanlist(fin, pass) 2420 fr_info_t *fin; 2421 u_32_t pass; 2422{ 2423 ipf_main_softc_t *softc = fin->fin_main_soft; 2424 int rulen, portcmp, off, skip; 2425 struct frentry *fr, *fnext; 2426 u_32_t passt, passo; 2427 2428 /* 2429 * Do not allow nesting deeper than 16 levels. 2430 */ 2431 if (fin->fin_depth >= 16) 2432 return pass; 2433 2434 fr = fin->fin_fr; 2435 2436 /* 2437 * If there are no rules in this list, return now. 2438 */ 2439 if (fr == NULL) 2440 return pass; 2441 2442 skip = 0; 2443 portcmp = 0; 2444 fin->fin_depth++; 2445 fin->fin_fr = NULL; 2446 off = fin->fin_off; 2447 2448 if ((fin->fin_flx & FI_TCPUDP) && (fin->fin_dlen > 3) && !off) 2449 portcmp = 1; 2450 2451 for (rulen = 0; fr; fr = fnext, rulen++) { 2452 fnext = fr->fr_next; 2453 if (skip != 0) { 2454 FR_VERBOSE(("SKIP %d (%#x)\n", skip, fr->fr_flags)); 2455 skip--; 2456 continue; 2457 } 2458 2459 /* 2460 * In all checks below, a null (zero) value in the 2461 * filter struture is taken to mean a wildcard. 2462 * 2463 * check that we are working for the right interface 2464 */ 2465#ifdef _KERNEL 2466 if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp) 2467 continue; 2468#else 2469 if (opts & (OPT_VERBOSE|OPT_DEBUG)) 2470 printf("\n"); 2471 FR_VERBOSE(("%c", FR_ISSKIP(pass) ? 's' : 2472 FR_ISPASS(pass) ? 'p' : 2473 FR_ISACCOUNT(pass) ? 'A' : 2474 FR_ISAUTH(pass) ? 'a' : 2475 (pass & FR_NOMATCH) ? 'n' :'b')); 2476 if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp) 2477 continue; 2478 FR_VERBOSE((":i")); 2479#endif 2480 2481 switch (fr->fr_type) 2482 { 2483 case FR_T_IPF : 2484 case FR_T_IPF_BUILTIN : 2485 if (ipf_check_ipf(fin, fr, portcmp)) 2486 continue; 2487 break; 2488#if defined(IPFILTER_BPF) 2489 case FR_T_BPFOPC : 2490 case FR_T_BPFOPC_BUILTIN : 2491 { 2492 u_char *mc; 2493 int wlen; 2494 2495 if (*fin->fin_mp == NULL) 2496 continue; 2497 if (fin->fin_family != fr->fr_family) 2498 continue; 2499 mc = (u_char *)fin->fin_m; 2500 wlen = fin->fin_dlen + fin->fin_hlen; 2501 if (!bpf_filter(fr->fr_data, mc, wlen, 0)) 2502 continue; 2503 break; 2504 } 2505#endif 2506 case FR_T_CALLFUNC_BUILTIN : 2507 { 2508 frentry_t *f; 2509 2510 f = (*fr->fr_func)(fin, &pass); 2511 if (f != NULL) 2512 fr = f; 2513 else 2514 continue; 2515 break; 2516 } 2517 2518 case FR_T_IPFEXPR : 2519 case FR_T_IPFEXPR_BUILTIN : 2520 if (fin->fin_family != fr->fr_family) 2521 continue; 2522 if (ipf_fr_matcharray(fin, fr->fr_data) == 0) 2523 continue; 2524 break; 2525 2526 default : 2527 break; 2528 } 2529 2530 if ((fin->fin_out == 0) && (fr->fr_nattag.ipt_num[0] != 0)) { 2531 if (fin->fin_nattag == NULL) 2532 continue; 2533 if (ipf_matchtag(&fr->fr_nattag, fin->fin_nattag) == 0) 2534 continue; 2535 } 2536 FR_VERBOSE(("=%d/%d.%d *", fr->fr_grhead, fr->fr_group, rulen)); 2537 2538 passt = fr->fr_flags; 2539 2540 /* 2541 * If the rule is a "call now" rule, then call the function 2542 * in the rule, if it exists and use the results from that. 2543 * If the function pointer is bad, just make like we ignore 2544 * it, except for increasing the hit counter. 2545 */ 2546 if ((passt & FR_CALLNOW) != 0) { 2547 frentry_t *frs; 2548 2549 ATOMIC_INC64(fr->fr_hits); 2550 if ((fr->fr_func == NULL) || 2551 (fr->fr_func == (ipfunc_t)-1)) 2552 continue; 2553 2554 frs = fin->fin_fr; 2555 fin->fin_fr = fr; 2556 fr = (*fr->fr_func)(fin, &passt); 2557 if (fr == NULL) { 2558 fin->fin_fr = frs; 2559 continue; 2560 } 2561 passt = fr->fr_flags; 2562 } 2563 fin->fin_fr = fr; 2564 2565#ifdef IPFILTER_LOG 2566 /* 2567 * Just log this packet... 2568 */ 2569 if ((passt & FR_LOGMASK) == FR_LOG) { 2570 if (ipf_log_pkt(fin, passt) == -1) { 2571 if (passt & FR_LOGORBLOCK) { 2572 DT(frb_logfail); 2573 passt &= ~FR_CMDMASK; 2574 passt |= FR_BLOCK|FR_QUICK; 2575 fin->fin_reason = FRB_LOGFAIL; 2576 } 2577 } 2578 } 2579#endif /* IPFILTER_LOG */ 2580 2581 MUTEX_ENTER(&fr->fr_lock); 2582 fr->fr_bytes += (U_QUAD_T)fin->fin_plen; 2583 fr->fr_hits++; 2584 MUTEX_EXIT(&fr->fr_lock); 2585 fin->fin_rule = rulen; 2586 2587 passo = pass; 2588 if (FR_ISSKIP(passt)) { 2589 skip = fr->fr_arg; 2590 continue; 2591 } else if (((passt & FR_LOGMASK) != FR_LOG) && 2592 ((passt & FR_LOGMASK) != FR_DECAPSULATE)) { 2593 pass = passt; 2594 } 2595 2596 if (passt & (FR_RETICMP|FR_FAKEICMP)) 2597 fin->fin_icode = fr->fr_icode; 2598 2599 if (fr->fr_group != -1) { 2600 (void) strncpy(fin->fin_group, 2601 FR_NAME(fr, fr_group), 2602 strlen(FR_NAME(fr, fr_group))); 2603 } else { 2604 fin->fin_group[0] = '\0'; 2605 } 2606 2607 FR_DEBUG(("pass %#x/%#x/%x\n", passo, pass, passt)); 2608 2609 if (fr->fr_grphead != NULL) { 2610 fin->fin_fr = fr->fr_grphead->fg_start; 2611 FR_VERBOSE(("group %s\n", FR_NAME(fr, fr_grhead))); 2612 2613 if (FR_ISDECAPS(passt)) 2614 passt = ipf_decaps(fin, pass, fr->fr_icode); 2615 else 2616 passt = ipf_scanlist(fin, pass); 2617 2618 if (fin->fin_fr == NULL) { 2619 fin->fin_rule = rulen; 2620 if (fr->fr_group != -1) 2621 (void) strncpy(fin->fin_group, 2622 fr->fr_names + 2623 fr->fr_group, 2624 strlen(fr->fr_names + 2625 fr->fr_group)); 2626 fin->fin_fr = fr; 2627 passt = pass; 2628 } 2629 pass = passt; 2630 } 2631 2632 if (pass & FR_QUICK) { 2633 /* 2634 * Finally, if we've asked to track state for this 2635 * packet, set it up. Add state for "quick" rules 2636 * here so that if the action fails we can consider 2637 * the rule to "not match" and keep on processing 2638 * filter rules. 2639 */ 2640 if ((pass & FR_KEEPSTATE) && !FR_ISAUTH(pass) && 2641 !(fin->fin_flx & FI_STATE)) { 2642 int out = fin->fin_out; 2643 2644 fin->fin_fr = fr; 2645 if (ipf_state_add(softc, fin, NULL, 0) == 0) { 2646 LBUMPD(ipf_stats[out], fr_ads); 2647 } else { 2648 LBUMPD(ipf_stats[out], fr_bads); 2649 pass = passo; 2650 continue; 2651 } 2652 } 2653 break; 2654 } 2655 } 2656 fin->fin_depth--; 2657 return pass; 2658} 2659 2660 2661/* ------------------------------------------------------------------------ */ 2662/* Function: ipf_acctpkt */ 2663/* Returns: frentry_t* - always returns NULL */ 2664/* Parameters: fin(I) - pointer to packet information */ 2665/* passp(IO) - pointer to current/new filter decision (unused) */ 2666/* */ 2667/* Checks a packet against accounting rules, if there are any for the given */ 2668/* IP protocol version. */ 2669/* */ 2670/* N.B.: this function returns NULL to match the prototype used by other */ 2671/* functions called from the IPFilter "mainline" in ipf_check(). */ 2672/* ------------------------------------------------------------------------ */ 2673frentry_t * 2674ipf_acctpkt(fin, passp) 2675 fr_info_t *fin; 2676 u_32_t *passp; 2677{ 2678 ipf_main_softc_t *softc = fin->fin_main_soft; 2679 char group[FR_GROUPLEN]; 2680 frentry_t *fr, *frsave; 2681 u_32_t pass, rulen; 2682 2683 passp = passp; 2684 fr = softc->ipf_acct[fin->fin_out][softc->ipf_active]; 2685 2686 if (fr != NULL) { 2687 frsave = fin->fin_fr; 2688 bcopy(fin->fin_group, group, FR_GROUPLEN); 2689 rulen = fin->fin_rule; 2690 fin->fin_fr = fr; 2691 pass = ipf_scanlist(fin, FR_NOMATCH); 2692 if (FR_ISACCOUNT(pass)) { 2693 LBUMPD(ipf_stats[0], fr_acct); 2694 } 2695 fin->fin_fr = frsave; 2696 bcopy(group, fin->fin_group, FR_GROUPLEN); 2697 fin->fin_rule = rulen; 2698 } 2699 return NULL; 2700} 2701 2702 2703/* ------------------------------------------------------------------------ */ 2704/* Function: ipf_firewall */ 2705/* Returns: frentry_t* - returns pointer to matched rule, if no matches */ 2706/* were found, returns NULL. */ 2707/* Parameters: fin(I) - pointer to packet information */ 2708/* passp(IO) - pointer to current/new filter decision (unused) */ 2709/* */ 2710/* Applies an appropriate set of firewall rules to the packet, to see if */ 2711/* there are any matches. The first check is to see if a match can be seen */ 2712/* in the cache. If not, then search an appropriate list of rules. Once a */ 2713/* matching rule is found, take any appropriate actions as defined by the */ 2714/* rule - except logging. */ 2715/* ------------------------------------------------------------------------ */ 2716static frentry_t * 2717ipf_firewall(fin, passp) 2718 fr_info_t *fin; 2719 u_32_t *passp; 2720{ 2721 ipf_main_softc_t *softc = fin->fin_main_soft; 2722 frentry_t *fr; 2723 u_32_t pass; 2724 int out; 2725 2726 out = fin->fin_out; 2727 pass = *passp; 2728 2729 /* 2730 * This rule cache will only affect packets that are not being 2731 * statefully filtered. 2732 */ 2733 fin->fin_fr = softc->ipf_rules[out][softc->ipf_active]; 2734 if (fin->fin_fr != NULL) 2735 pass = ipf_scanlist(fin, softc->ipf_pass); 2736 2737 if ((pass & FR_NOMATCH)) { 2738 LBUMPD(ipf_stats[out], fr_nom); 2739 } 2740 fr = fin->fin_fr; 2741 2742 /* 2743 * Apply packets per second rate-limiting to a rule as required. 2744 */ 2745 if ((fr != NULL) && (fr->fr_pps != 0) && 2746 !ppsratecheck(&fr->fr_lastpkt, &fr->fr_curpps, fr->fr_pps)) { 2747 DT2(frb_ppsrate, fr_info_t *, fin, frentry_t *, fr); 2748 pass &= ~(FR_CMDMASK|FR_RETICMP|FR_RETRST); 2749 pass |= FR_BLOCK; 2750 LBUMPD(ipf_stats[out], fr_ppshit); 2751 fin->fin_reason = FRB_PPSRATE; 2752 } 2753 2754 /* 2755 * If we fail to add a packet to the authorization queue, then we 2756 * drop the packet later. However, if it was added then pretend 2757 * we've dropped it already. 2758 */ 2759 if (FR_ISAUTH(pass)) { 2760 if (ipf_auth_new(fin->fin_m, fin) != 0) { 2761 DT1(frb_authnew, fr_info_t *, fin); 2762 fin->fin_m = *fin->fin_mp = NULL; 2763 fin->fin_reason = FRB_AUTHNEW; 2764 fin->fin_error = 0; 2765 } else { 2766 IPFERROR(1); 2767 fin->fin_error = ENOSPC; 2768 } 2769 } 2770 2771 if ((fr != NULL) && (fr->fr_func != NULL) && 2772 (fr->fr_func != (ipfunc_t)-1) && !(pass & FR_CALLNOW)) 2773 (void) (*fr->fr_func)(fin, &pass); 2774 2775 /* 2776 * If a rule is a pre-auth rule, check again in the list of rules 2777 * loaded for authenticated use. It does not particulary matter 2778 * if this search fails because a "preauth" result, from a rule, 2779 * is treated as "not a pass", hence the packet is blocked. 2780 */ 2781 if (FR_ISPREAUTH(pass)) { 2782 pass = ipf_auth_pre_scanlist(softc, fin, pass); 2783 } 2784 2785 /* 2786 * If the rule has "keep frag" and the packet is actually a fragment, 2787 * then create a fragment state entry. 2788 */ 2789 if (pass & FR_KEEPFRAG) { 2790 if (fin->fin_flx & FI_FRAG) { 2791 if (ipf_frag_new(softc, fin, pass) == -1) { 2792 LBUMP(ipf_stats[out].fr_bnfr); 2793 } else { 2794 LBUMP(ipf_stats[out].fr_nfr); 2795 } 2796 } else { 2797 LBUMP(ipf_stats[out].fr_cfr); 2798 } 2799 } 2800 2801 fr = fin->fin_fr; 2802 *passp = pass; 2803 2804 return fr; 2805} 2806 2807 2808/* ------------------------------------------------------------------------ */ 2809/* Function: ipf_check */ 2810/* Returns: int - 0 == packet allowed through, */ 2811/* User space: */ 2812/* -1 == packet blocked */ 2813/* 1 == packet not matched */ 2814/* -2 == requires authentication */ 2815/* Kernel: */ 2816/* > 0 == filter error # for packet */ 2817/* Parameters: ip(I) - pointer to start of IPv4/6 packet */ 2818/* hlen(I) - length of header */ 2819/* ifp(I) - pointer to interface this packet is on */ 2820/* out(I) - 0 == packet going in, 1 == packet going out */ 2821/* mp(IO) - pointer to caller's buffer pointer that holds this */ 2822/* IP packet. */ 2823/* Solaris & HP-UX ONLY : */ 2824/* qpi(I) - pointer to STREAMS queue information for this */ 2825/* interface & direction. */ 2826/* */ 2827/* ipf_check() is the master function for all IPFilter packet processing. */ 2828/* It orchestrates: Network Address Translation (NAT), checking for packet */ 2829/* authorisation (or pre-authorisation), presence of related state info., */ 2830/* generating log entries, IP packet accounting, routing of packets as */ 2831/* directed by firewall rules and of course whether or not to allow the */ 2832/* packet to be further processed by the kernel. */ 2833/* */ 2834/* For packets blocked, the contents of "mp" will be NULL'd and the buffer */ 2835/* freed. Packets passed may be returned with the pointer pointed to by */ 2836/* by "mp" changed to a new buffer. */ 2837/* ------------------------------------------------------------------------ */ 2838int 2839ipf_check(ctx, ip, hlen, ifp, out 2840#if defined(_KERNEL) && defined(MENTAT) 2841 , qif, mp) 2842 void *qif; 2843#else 2844 , mp) 2845#endif 2846 mb_t **mp; 2847 ip_t *ip; 2848 int hlen; 2849 void *ifp; 2850 int out; 2851 void *ctx; 2852{ 2853 /* 2854 * The above really sucks, but short of writing a diff 2855 */ 2856 ipf_main_softc_t *softc = ctx; 2857 fr_info_t frinfo; 2858 fr_info_t *fin = &frinfo; 2859 u_32_t pass = softc->ipf_pass; 2860 frentry_t *fr = NULL; 2861 int v = IP_V(ip); 2862 mb_t *mc = NULL; 2863 mb_t *m; 2864 /* 2865 * The first part of ipf_check() deals with making sure that what goes 2866 * into the filtering engine makes some sense. Information about the 2867 * the packet is distilled, collected into a fr_info_t structure and 2868 * the an attempt to ensure the buffer the packet is in is big enough 2869 * to hold all the required packet headers. 2870 */ 2871#ifdef _KERNEL 2872# ifdef MENTAT 2873 qpktinfo_t *qpi = qif; 2874 2875# ifdef __sparc 2876 if ((u_int)ip & 0x3) 2877 return 2; 2878# endif 2879# else 2880 SPL_INT(s); 2881# endif 2882 2883 if (softc->ipf_running <= 0) { 2884 return 0; 2885 } 2886 2887 bzero((char *)fin, sizeof(*fin)); 2888 2889# ifdef MENTAT 2890 if (qpi->qpi_flags & QF_BROADCAST) 2891 fin->fin_flx |= FI_MBCAST|FI_BROADCAST; 2892 if (qpi->qpi_flags & QF_MULTICAST) 2893 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2894 m = qpi->qpi_m; 2895 fin->fin_qfm = m; 2896 fin->fin_qpi = qpi; 2897# else /* MENTAT */ 2898 2899 m = *mp; 2900 2901# if defined(M_MCAST) 2902 if ((m->m_flags & M_MCAST) != 0) 2903 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2904# endif 2905# if defined(M_MLOOP) 2906 if ((m->m_flags & M_MLOOP) != 0) 2907 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2908# endif 2909# if defined(M_BCAST) 2910 if ((m->m_flags & M_BCAST) != 0) 2911 fin->fin_flx |= FI_MBCAST|FI_BROADCAST; 2912# endif 2913# ifdef M_CANFASTFWD 2914 /* 2915 * XXX For now, IP Filter and fast-forwarding of cached flows 2916 * XXX are mutually exclusive. Eventually, IP Filter should 2917 * XXX get a "can-fast-forward" filter rule. 2918 */ 2919 m->m_flags &= ~M_CANFASTFWD; 2920# endif /* M_CANFASTFWD */ 2921# if defined(CSUM_DELAY_DATA) && (!defined(__FreeBSD_version) || \ 2922 (__FreeBSD_version < 501108)) 2923 /* 2924 * disable delayed checksums. 2925 */ 2926 if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) { 2927 in_delayed_cksum(m); 2928 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA; 2929 } 2930# endif /* CSUM_DELAY_DATA */ 2931# endif /* MENTAT */ 2932#else 2933 bzero((char *)fin, sizeof(*fin)); 2934 m = *mp; 2935# if defined(M_MCAST) 2936 if ((m->m_flags & M_MCAST) != 0) 2937 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2938# endif 2939# if defined(M_MLOOP) 2940 if ((m->m_flags & M_MLOOP) != 0) 2941 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2942# endif 2943# if defined(M_BCAST) 2944 if ((m->m_flags & M_BCAST) != 0) 2945 fin->fin_flx |= FI_MBCAST|FI_BROADCAST; 2946# endif 2947#endif /* _KERNEL */ 2948 2949 fin->fin_v = v; 2950 fin->fin_m = m; 2951 fin->fin_ip = ip; 2952 fin->fin_mp = mp; 2953 fin->fin_out = out; 2954 fin->fin_ifp = ifp; 2955 fin->fin_error = ENETUNREACH; 2956 fin->fin_hlen = (u_short)hlen; 2957 fin->fin_dp = (char *)ip + hlen; 2958 fin->fin_main_soft = softc; 2959 2960 fin->fin_ipoff = (char *)ip - MTOD(m, char *); 2961 2962 SPL_NET(s); 2963 2964#ifdef USE_INET6 2965 if (v == 6) { 2966 LBUMP(ipf_stats[out].fr_ipv6); 2967 /* 2968 * Jumbo grams are quite likely too big for internal buffer 2969 * structures to handle comfortably, for now, so just drop 2970 * them. 2971 */ 2972 if (((ip6_t *)ip)->ip6_plen == 0) { 2973 DT1(frb_jumbo, ip6_t *, (ip6_t *)ip); 2974 pass = FR_BLOCK|FR_NOMATCH; 2975 fin->fin_reason = FRB_JUMBO; 2976 goto finished; 2977 } 2978 fin->fin_family = AF_INET6; 2979 } else 2980#endif 2981 { 2982 fin->fin_family = AF_INET; 2983 } 2984 2985 if (ipf_makefrip(hlen, ip, fin) == -1) { 2986 DT1(frb_makefrip, fr_info_t *, fin); 2987 pass = FR_BLOCK|FR_NOMATCH; 2988 fin->fin_reason = FRB_MAKEFRIP; 2989 goto finished; 2990 } 2991 2992 /* 2993 * For at least IPv6 packets, if a m_pullup() fails then this pointer 2994 * becomes NULL and so we have no packet to free. 2995 */ 2996 if (*fin->fin_mp == NULL) 2997 goto finished; 2998 2999 if (!out) { 3000 if (v == 4) { 3001 if (softc->ipf_chksrc && !ipf_verifysrc(fin)) { 3002 LBUMPD(ipf_stats[0], fr_v4_badsrc); 3003 fin->fin_flx |= FI_BADSRC; 3004 } 3005 if (fin->fin_ip->ip_ttl < softc->ipf_minttl) { 3006 LBUMPD(ipf_stats[0], fr_v4_badttl); 3007 fin->fin_flx |= FI_LOWTTL; 3008 } 3009 } 3010#ifdef USE_INET6 3011 else if (v == 6) { 3012 if (((ip6_t *)ip)->ip6_hlim < softc->ipf_minttl) { 3013 LBUMPD(ipf_stats[0], fr_v6_badttl); 3014 fin->fin_flx |= FI_LOWTTL; 3015 } 3016 } 3017#endif 3018 } 3019 3020 if (fin->fin_flx & FI_SHORT) { 3021 LBUMPD(ipf_stats[out], fr_short); 3022 } 3023 3024 READ_ENTER(&softc->ipf_mutex); 3025 3026 if (!out) { 3027 switch (fin->fin_v) 3028 { 3029 case 4 : 3030 if (ipf_nat_checkin(fin, &pass) == -1) { 3031 goto filterdone; 3032 } 3033 break; 3034#ifdef USE_INET6 3035 case 6 : 3036 if (ipf_nat6_checkin(fin, &pass) == -1) { 3037 goto filterdone; 3038 } 3039 break; 3040#endif 3041 default : 3042 break; 3043 } 3044 } 3045 /* 3046 * Check auth now. 3047 * If a packet is found in the auth table, then skip checking 3048 * the access lists for permission but we do need to consider 3049 * the result as if it were from the ACL's. In addition, being 3050 * found in the auth table means it has been seen before, so do 3051 * not pass it through accounting (again), lest it be counted twice. 3052 */ 3053 fr = ipf_auth_check(fin, &pass); 3054 if (!out && (fr == NULL)) 3055 (void) ipf_acctpkt(fin, NULL); 3056 3057 if (fr == NULL) { 3058 if ((fin->fin_flx & FI_FRAG) != 0) 3059 fr = ipf_frag_known(fin, &pass); 3060 3061 if (fr == NULL) 3062 fr = ipf_state_check(fin, &pass); 3063 } 3064 3065 if ((pass & FR_NOMATCH) || (fr == NULL)) 3066 fr = ipf_firewall(fin, &pass); 3067 3068 /* 3069 * If we've asked to track state for this packet, set it up. 3070 * Here rather than ipf_firewall because ipf_checkauth may decide 3071 * to return a packet for "keep state" 3072 */ 3073 if ((pass & FR_KEEPSTATE) && (fin->fin_m != NULL) && 3074 !(fin->fin_flx & FI_STATE)) { 3075 if (ipf_state_add(softc, fin, NULL, 0) == 0) { 3076 LBUMP(ipf_stats[out].fr_ads); 3077 } else { 3078 LBUMP(ipf_stats[out].fr_bads); 3079 if (FR_ISPASS(pass)) { 3080 DT(frb_stateadd); 3081 pass &= ~FR_CMDMASK; 3082 pass |= FR_BLOCK; 3083 fin->fin_reason = FRB_STATEADD; 3084 } 3085 } 3086 } 3087 3088 fin->fin_fr = fr; 3089 if ((fr != NULL) && !(fin->fin_flx & FI_STATE)) { 3090 fin->fin_dif = &fr->fr_dif; 3091 fin->fin_tif = &fr->fr_tifs[fin->fin_rev]; 3092 } 3093 3094 /* 3095 * Only count/translate packets which will be passed on, out the 3096 * interface. 3097 */ 3098 if (out && FR_ISPASS(pass)) { 3099 (void) ipf_acctpkt(fin, NULL); 3100 3101 switch (fin->fin_v) 3102 { 3103 case 4 : 3104 if (ipf_nat_checkout(fin, &pass) == -1) { 3105 ; 3106 } else if ((softc->ipf_update_ipid != 0) && (v == 4)) { 3107 if (ipf_updateipid(fin) == -1) { 3108 DT(frb_updateipid); 3109 LBUMP(ipf_stats[1].fr_ipud); 3110 pass &= ~FR_CMDMASK; 3111 pass |= FR_BLOCK; 3112 fin->fin_reason = FRB_UPDATEIPID; 3113 } else { 3114 LBUMP(ipf_stats[0].fr_ipud); 3115 } 3116 } 3117 break; 3118#ifdef USE_INET6 3119 case 6 : 3120 (void) ipf_nat6_checkout(fin, &pass); 3121 break; 3122#endif 3123 default : 3124 break; 3125 } 3126 } 3127 3128filterdone: 3129#ifdef IPFILTER_LOG 3130 if ((softc->ipf_flags & FF_LOGGING) || (pass & FR_LOGMASK)) { 3131 (void) ipf_dolog(fin, &pass); 3132 } 3133#endif 3134 3135 /* 3136 * The FI_STATE flag is cleared here so that calling ipf_state_check 3137 * will work when called from inside of fr_fastroute. Although 3138 * there is a similar flag, FI_NATED, for NAT, it does have the same 3139 * impact on code execution. 3140 */ 3141 fin->fin_flx &= ~FI_STATE; 3142 3143#if defined(FASTROUTE_RECURSION) 3144 /* 3145 * Up the reference on fr_lock and exit ipf_mutex. The generation of 3146 * a packet below can sometimes cause a recursive call into IPFilter. 3147 * On those platforms where that does happen, we need to hang onto 3148 * the filter rule just in case someone decides to remove or flush it 3149 * in the meantime. 3150 */ 3151 if (fr != NULL) { 3152 MUTEX_ENTER(&fr->fr_lock); 3153 fr->fr_ref++; 3154 MUTEX_EXIT(&fr->fr_lock); 3155 } 3156 3157 RWLOCK_EXIT(&softc->ipf_mutex); 3158#endif 3159 3160 if ((pass & FR_RETMASK) != 0) { 3161 /* 3162 * Should we return an ICMP packet to indicate error 3163 * status passing through the packet filter ? 3164 * WARNING: ICMP error packets AND TCP RST packets should 3165 * ONLY be sent in repsonse to incoming packets. Sending 3166 * them in response to outbound packets can result in a 3167 * panic on some operating systems. 3168 */ 3169 if (!out) { 3170 if (pass & FR_RETICMP) { 3171 int dst; 3172 3173 if ((pass & FR_RETMASK) == FR_FAKEICMP) 3174 dst = 1; 3175 else 3176 dst = 0; 3177 (void) ipf_send_icmp_err(ICMP_UNREACH, fin, 3178 dst); 3179 LBUMP(ipf_stats[0].fr_ret); 3180 } else if (((pass & FR_RETMASK) == FR_RETRST) && 3181 !(fin->fin_flx & FI_SHORT)) { 3182 if (((fin->fin_flx & FI_OOW) != 0) || 3183 (ipf_send_reset(fin) == 0)) { 3184 LBUMP(ipf_stats[1].fr_ret); 3185 } 3186 } 3187 3188 /* 3189 * When using return-* with auth rules, the auth code 3190 * takes over disposing of this packet. 3191 */ 3192 if (FR_ISAUTH(pass) && (fin->fin_m != NULL)) { 3193 DT1(frb_authcapture, fr_info_t *, fin); 3194 fin->fin_m = *fin->fin_mp = NULL; 3195 fin->fin_reason = FRB_AUTHCAPTURE; 3196 m = NULL; 3197 } 3198 } else { 3199 if (pass & FR_RETRST) { 3200 fin->fin_error = ECONNRESET; 3201 } 3202 } 3203 } 3204 3205 /* 3206 * After the above so that ICMP unreachables and TCP RSTs get 3207 * created properly. 3208 */ 3209 if (FR_ISBLOCK(pass) && (fin->fin_flx & FI_NEWNAT)) 3210 ipf_nat_uncreate(fin); 3211 3212 /* 3213 * If we didn't drop off the bottom of the list of rules (and thus 3214 * the 'current' rule fr is not NULL), then we may have some extra 3215 * instructions about what to do with a packet. 3216 * Once we're finished return to our caller, freeing the packet if 3217 * we are dropping it. 3218 */ 3219 if (fr != NULL) { 3220 frdest_t *fdp; 3221 3222 /* 3223 * Generate a duplicated packet first because ipf_fastroute 3224 * can lead to fin_m being free'd... not good. 3225 */ 3226 fdp = fin->fin_dif; 3227 if ((fdp != NULL) && (fdp->fd_ptr != NULL) && 3228 (fdp->fd_ptr != (void *)-1)) { 3229 mc = M_COPY(fin->fin_m); 3230 if (mc != NULL) 3231 ipf_fastroute(mc, &mc, fin, fdp); 3232 } 3233 3234 fdp = fin->fin_tif; 3235 if (!out && (pass & FR_FASTROUTE)) { 3236 /* 3237 * For fastroute rule, no destination interface defined 3238 * so pass NULL as the frdest_t parameter 3239 */ 3240 (void) ipf_fastroute(fin->fin_m, mp, fin, NULL); 3241 m = *mp = NULL; 3242 } else if ((fdp != NULL) && (fdp->fd_ptr != NULL) && 3243 (fdp->fd_ptr != (struct ifnet *)-1)) { 3244 /* this is for to rules: */ 3245 ipf_fastroute(fin->fin_m, mp, fin, fdp); 3246 m = *mp = NULL; 3247 } 3248 3249#if defined(FASTROUTE_RECURSION) 3250 (void) ipf_derefrule(softc, &fr); 3251#endif 3252 } 3253#if !defined(FASTROUTE_RECURSION) 3254 RWLOCK_EXIT(&softc->ipf_mutex); 3255#endif 3256 3257finished: 3258 if (!FR_ISPASS(pass)) { 3259 LBUMP(ipf_stats[out].fr_block); 3260 if (*mp != NULL) { 3261#ifdef _KERNEL 3262 FREE_MB_T(*mp); 3263#endif 3264 m = *mp = NULL; 3265 } 3266 } else { 3267 LBUMP(ipf_stats[out].fr_pass); 3268#if defined(_KERNEL) && defined(__sgi) 3269 if ((fin->fin_hbuf != NULL) && 3270 (mtod(fin->fin_m, struct ip *) != fin->fin_ip)) { 3271 COPYBACK(fin->fin_m, 0, fin->fin_plen, fin->fin_hbuf); 3272 } 3273#endif 3274 } 3275 3276 SPL_X(s); 3277 3278#ifdef _KERNEL 3279 if (FR_ISPASS(pass)) 3280 return 0; 3281 LBUMP(ipf_stats[out].fr_blocked[fin->fin_reason]); 3282 return fin->fin_error; 3283#else /* _KERNEL */ 3284 if (*mp != NULL) 3285 (*mp)->mb_ifp = fin->fin_ifp; 3286 blockreason = fin->fin_reason; 3287 FR_VERBOSE(("fin_flx %#x pass %#x ", fin->fin_flx, pass)); 3288 /*if ((pass & FR_CMDMASK) == (softc->ipf_pass & FR_CMDMASK))*/ 3289 if ((pass & FR_NOMATCH) != 0) 3290 return 1; 3291 3292 if ((pass & FR_RETMASK) != 0) 3293 switch (pass & FR_RETMASK) 3294 { 3295 case FR_RETRST : 3296 return 3; 3297 case FR_RETICMP : 3298 return 4; 3299 case FR_FAKEICMP : 3300 return 5; 3301 } 3302 3303 switch (pass & FR_CMDMASK) 3304 { 3305 case FR_PASS : 3306 return 0; 3307 case FR_BLOCK : 3308 return -1; 3309 case FR_AUTH : 3310 return -2; 3311 case FR_ACCOUNT : 3312 return -3; 3313 case FR_PREAUTH : 3314 return -4; 3315 } 3316 return 2; 3317#endif /* _KERNEL */ 3318} 3319 3320 3321#ifdef IPFILTER_LOG 3322/* ------------------------------------------------------------------------ */ 3323/* Function: ipf_dolog */ 3324/* Returns: frentry_t* - returns contents of fin_fr (no change made) */ 3325/* Parameters: fin(I) - pointer to packet information */ 3326/* passp(IO) - pointer to current/new filter decision (unused) */ 3327/* */ 3328/* Checks flags set to see how a packet should be logged, if it is to be */ 3329/* logged. Adjust statistics based on its success or not. */ 3330/* ------------------------------------------------------------------------ */ 3331frentry_t * 3332ipf_dolog(fin, passp) 3333 fr_info_t *fin; 3334 u_32_t *passp; 3335{ 3336 ipf_main_softc_t *softc = fin->fin_main_soft; 3337 u_32_t pass; 3338 int out; 3339 3340 out = fin->fin_out; 3341 pass = *passp; 3342 3343 if ((softc->ipf_flags & FF_LOGNOMATCH) && (pass & FR_NOMATCH)) { 3344 pass |= FF_LOGNOMATCH; 3345 LBUMPD(ipf_stats[out], fr_npkl); 3346 goto logit; 3347 3348 } else if (((pass & FR_LOGMASK) == FR_LOGP) || 3349 (FR_ISPASS(pass) && (softc->ipf_flags & FF_LOGPASS))) { 3350 if ((pass & FR_LOGMASK) != FR_LOGP) 3351 pass |= FF_LOGPASS; 3352 LBUMPD(ipf_stats[out], fr_ppkl); 3353 goto logit; 3354 3355 } else if (((pass & FR_LOGMASK) == FR_LOGB) || 3356 (FR_ISBLOCK(pass) && (softc->ipf_flags & FF_LOGBLOCK))) { 3357 if ((pass & FR_LOGMASK) != FR_LOGB) 3358 pass |= FF_LOGBLOCK; 3359 LBUMPD(ipf_stats[out], fr_bpkl); 3360 3361logit: 3362 if (ipf_log_pkt(fin, pass) == -1) { 3363 /* 3364 * If the "or-block" option has been used then 3365 * block the packet if we failed to log it. 3366 */ 3367 if ((pass & FR_LOGORBLOCK) && FR_ISPASS(pass)) { 3368 DT1(frb_logfail2, u_int, pass); 3369 pass &= ~FR_CMDMASK; 3370 pass |= FR_BLOCK; 3371 fin->fin_reason = FRB_LOGFAIL2; 3372 } 3373 } 3374 *passp = pass; 3375 } 3376 3377 return fin->fin_fr; 3378} 3379#endif /* IPFILTER_LOG */ 3380 3381 3382/* ------------------------------------------------------------------------ */ 3383/* Function: ipf_cksum */ 3384/* Returns: u_short - IP header checksum */ 3385/* Parameters: addr(I) - pointer to start of buffer to checksum */ 3386/* len(I) - length of buffer in bytes */ 3387/* */ 3388/* Calculate the two's complement 16 bit checksum of the buffer passed. */ 3389/* */ 3390/* N.B.: addr should be 16bit aligned. */ 3391/* ------------------------------------------------------------------------ */ 3392u_short 3393ipf_cksum(addr, len) 3394 u_short *addr; 3395 int len; 3396{ 3397 u_32_t sum = 0; 3398 3399 for (sum = 0; len > 1; len -= 2) 3400 sum += *addr++; 3401 3402 /* mop up an odd byte, if necessary */ 3403 if (len == 1) 3404 sum += *(u_char *)addr; 3405 3406 /* 3407 * add back carry outs from top 16 bits to low 16 bits 3408 */ 3409 sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */ 3410 sum += (sum >> 16); /* add carry */ 3411 return (u_short)(~sum); 3412} 3413 3414 3415/* ------------------------------------------------------------------------ */ 3416/* Function: fr_cksum */ 3417/* Returns: u_short - layer 4 checksum */ 3418/* Parameters: fin(I) - pointer to packet information */ 3419/* ip(I) - pointer to IP header */ 3420/* l4proto(I) - protocol to caclulate checksum for */ 3421/* l4hdr(I) - pointer to layer 4 header */ 3422/* */ 3423/* Calculates the TCP checksum for the packet held in "m", using the data */ 3424/* in the IP header "ip" to seed it. */ 3425/* */ 3426/* NB: This function assumes we've pullup'd enough for all of the IP header */ 3427/* and the TCP header. We also assume that data blocks aren't allocated in */ 3428/* odd sizes. */ 3429/* */ 3430/* Expects ip_len and ip_off to be in network byte order when called. */ 3431/* ------------------------------------------------------------------------ */ 3432u_short 3433fr_cksum(fin, ip, l4proto, l4hdr) 3434 fr_info_t *fin; 3435 ip_t *ip; 3436 int l4proto; 3437 void *l4hdr; 3438{ 3439 u_short *sp, slen, sumsave, *csump; 3440 u_int sum, sum2; 3441 int hlen; 3442 int off; 3443#ifdef USE_INET6 3444 ip6_t *ip6; 3445#endif 3446 3447 csump = NULL; 3448 sumsave = 0; 3449 sp = NULL; 3450 slen = 0; 3451 hlen = 0; 3452 sum = 0; 3453 3454 sum = htons((u_short)l4proto); 3455 /* 3456 * Add up IP Header portion 3457 */ 3458#ifdef USE_INET6 3459 if (IP_V(ip) == 4) { 3460#endif 3461 hlen = IP_HL(ip) << 2; 3462 off = hlen; 3463 sp = (u_short *)&ip->ip_src; 3464 sum += *sp++; /* ip_src */ 3465 sum += *sp++; 3466 sum += *sp++; /* ip_dst */ 3467 sum += *sp++; 3468#ifdef USE_INET6 3469 } else if (IP_V(ip) == 6) { 3470 ip6 = (ip6_t *)ip; 3471 hlen = sizeof(*ip6); 3472 off = ((char *)fin->fin_dp - (char *)fin->fin_ip); 3473 sp = (u_short *)&ip6->ip6_src; 3474 sum += *sp++; /* ip6_src */ 3475 sum += *sp++; 3476 sum += *sp++; 3477 sum += *sp++; 3478 sum += *sp++; 3479 sum += *sp++; 3480 sum += *sp++; 3481 sum += *sp++; 3482 /* This needs to be routing header aware. */ 3483 sum += *sp++; /* ip6_dst */ 3484 sum += *sp++; 3485 sum += *sp++; 3486 sum += *sp++; 3487 sum += *sp++; 3488 sum += *sp++; 3489 sum += *sp++; 3490 sum += *sp++; 3491 } else { 3492 return 0xffff; 3493 } 3494#endif 3495 slen = fin->fin_plen - off; 3496 sum += htons(slen); 3497 3498 switch (l4proto) 3499 { 3500 case IPPROTO_UDP : 3501 csump = &((udphdr_t *)l4hdr)->uh_sum; 3502 break; 3503 3504 case IPPROTO_TCP : 3505 csump = &((tcphdr_t *)l4hdr)->th_sum; 3506 break; 3507 case IPPROTO_ICMP : 3508 csump = &((icmphdr_t *)l4hdr)->icmp_cksum; 3509 sum = 0; /* Pseudo-checksum is not included */ 3510 break; 3511#ifdef USE_INET6 3512 case IPPROTO_ICMPV6 : 3513 csump = &((struct icmp6_hdr *)l4hdr)->icmp6_cksum; 3514 break; 3515#endif 3516 default : 3517 break; 3518 } 3519 3520 if (csump != NULL) { 3521 sumsave = *csump; 3522 *csump = 0; 3523 } 3524 3525 sum2 = ipf_pcksum(fin, off, sum); 3526 if (csump != NULL) 3527 *csump = sumsave; 3528 return sum2; 3529} 3530 3531 3532/* ------------------------------------------------------------------------ */ 3533/* Function: ipf_findgroup */ 3534/* Returns: frgroup_t * - NULL = group not found, else pointer to group */ 3535/* Parameters: softc(I) - pointer to soft context main structure */ 3536/* group(I) - group name to search for */ 3537/* unit(I) - device to which this group belongs */ 3538/* set(I) - which set of rules (inactive/inactive) this is */ 3539/* fgpp(O) - pointer to place to store pointer to the pointer */ 3540/* to where to add the next (last) group or where */ 3541/* to delete group from. */ 3542/* */ 3543/* Search amongst the defined groups for a particular group number. */ 3544/* ------------------------------------------------------------------------ */ 3545frgroup_t * 3546ipf_findgroup(softc, group, unit, set, fgpp) 3547 ipf_main_softc_t *softc; 3548 char *group; 3549 minor_t unit; 3550 int set; 3551 frgroup_t ***fgpp; 3552{ 3553 frgroup_t *fg, **fgp; 3554 3555 /* 3556 * Which list of groups to search in is dependent on which list of 3557 * rules are being operated on. 3558 */ 3559 fgp = &softc->ipf_groups[unit][set]; 3560 3561 while ((fg = *fgp) != NULL) { 3562 if (strncmp(group, fg->fg_name, FR_GROUPLEN) == 0) 3563 break; 3564 else 3565 fgp = &fg->fg_next; 3566 } 3567 if (fgpp != NULL) 3568 *fgpp = fgp; 3569 return fg; 3570} 3571 3572 3573/* ------------------------------------------------------------------------ */ 3574/* Function: ipf_group_add */ 3575/* Returns: frgroup_t * - NULL == did not create group, */ 3576/* != NULL == pointer to the group */ 3577/* Parameters: softc(I) - pointer to soft context main structure */ 3578/* num(I) - group number to add */ 3579/* head(I) - rule pointer that is using this as the head */ 3580/* flags(I) - rule flags which describe the type of rule it is */ 3581/* unit(I) - device to which this group will belong to */ 3582/* set(I) - which set of rules (inactive/inactive) this is */ 3583/* Write Locks: ipf_mutex */ 3584/* */ 3585/* Add a new group head, or if it already exists, increase the reference */ 3586/* count to it. */ 3587/* ------------------------------------------------------------------------ */ 3588frgroup_t * 3589ipf_group_add(softc, group, head, flags, unit, set) 3590 ipf_main_softc_t *softc; 3591 char *group; 3592 void *head; 3593 u_32_t flags; 3594 minor_t unit; 3595 int set; 3596{ 3597 frgroup_t *fg, **fgp; 3598 u_32_t gflags; 3599 3600 if (group == NULL) 3601 return NULL; 3602 3603 if (unit == IPL_LOGIPF && *group == '\0') 3604 return NULL; 3605 3606 fgp = NULL; 3607 gflags = flags & FR_INOUT; 3608 3609 fg = ipf_findgroup(softc, group, unit, set, &fgp); 3610 if (fg != NULL) { 3611 if (fg->fg_head == NULL && head != NULL) 3612 fg->fg_head = head; 3613 if (fg->fg_flags == 0) 3614 fg->fg_flags = gflags; 3615 else if (gflags != fg->fg_flags) 3616 return NULL; 3617 fg->fg_ref++; 3618 return fg; 3619 } 3620 3621 KMALLOC(fg, frgroup_t *); 3622 if (fg != NULL) { 3623 fg->fg_head = head; 3624 fg->fg_start = NULL; 3625 fg->fg_next = *fgp; 3626 bcopy(group, fg->fg_name, strlen(group) + 1); 3627 fg->fg_flags = gflags; 3628 fg->fg_ref = 1; 3629 fg->fg_set = &softc->ipf_groups[unit][set]; 3630 *fgp = fg; 3631 } 3632 return fg; 3633} 3634 3635 3636/* ------------------------------------------------------------------------ */ 3637/* Function: ipf_group_del */ 3638/* Returns: int - number of rules deleted */ 3639/* Parameters: softc(I) - pointer to soft context main structure */ 3640/* group(I) - group name to delete */ 3641/* fr(I) - filter rule from which group is referenced */ 3642/* Write Locks: ipf_mutex */ 3643/* */ 3644/* This function is called whenever a reference to a group is to be dropped */ 3645/* and thus its reference count needs to be lowered and the group free'd if */ 3646/* the reference count reaches zero. Passing in fr is really for the sole */ 3647/* purpose of knowing when the head rule is being deleted. */ 3648/* ------------------------------------------------------------------------ */ 3649void 3650ipf_group_del(softc, group, fr) 3651 ipf_main_softc_t *softc; 3652 frgroup_t *group; 3653 frentry_t *fr; 3654{ 3655 3656 if (group->fg_head == fr) 3657 group->fg_head = NULL; 3658 3659 group->fg_ref--; 3660 if ((group->fg_ref == 0) && (group->fg_start == NULL)) 3661 ipf_group_free(group); 3662} 3663 3664 3665/* ------------------------------------------------------------------------ */ 3666/* Function: ipf_group_free */ 3667/* Returns: Nil */ 3668/* Parameters: group(I) - pointer to filter rule group */ 3669/* */ 3670/* Remove the group from the list of groups and free it. */ 3671/* ------------------------------------------------------------------------ */ 3672static void 3673ipf_group_free(group) 3674 frgroup_t *group; 3675{ 3676 frgroup_t **gp; 3677 3678 for (gp = group->fg_set; *gp != NULL; gp = &(*gp)->fg_next) { 3679 if (*gp == group) { 3680 *gp = group->fg_next; 3681 break; 3682 } 3683 } 3684 KFREE(group); 3685} 3686 3687 3688/* ------------------------------------------------------------------------ */ 3689/* Function: ipf_group_flush */ 3690/* Returns: int - number of rules flush from group */ 3691/* Parameters: softc(I) - pointer to soft context main structure */ 3692/* Parameters: group(I) - pointer to filter rule group */ 3693/* */ 3694/* Remove all of the rules that currently are listed under the given group. */ 3695/* ------------------------------------------------------------------------ */ 3696static int 3697ipf_group_flush(softc, group) 3698 ipf_main_softc_t *softc; 3699 frgroup_t *group; 3700{ 3701 int gone = 0; 3702 3703 (void) ipf_flushlist(softc, &gone, &group->fg_start); 3704 3705 return gone; 3706} 3707 3708 3709/* ------------------------------------------------------------------------ */ 3710/* Function: ipf_getrulen */ 3711/* Returns: frentry_t * - NULL == not found, else pointer to rule n */ 3712/* Parameters: softc(I) - pointer to soft context main structure */ 3713/* Parameters: unit(I) - device for which to count the rule's number */ 3714/* flags(I) - which set of rules to find the rule in */ 3715/* group(I) - group name */ 3716/* n(I) - rule number to find */ 3717/* */ 3718/* Find rule # n in group # g and return a pointer to it. Return NULl if */ 3719/* group # g doesn't exist or there are less than n rules in the group. */ 3720/* ------------------------------------------------------------------------ */ 3721frentry_t * 3722ipf_getrulen(softc, unit, group, n) 3723 ipf_main_softc_t *softc; 3724 int unit; 3725 char *group; 3726 u_32_t n; 3727{ 3728 frentry_t *fr; 3729 frgroup_t *fg; 3730 3731 fg = ipf_findgroup(softc, group, unit, softc->ipf_active, NULL); 3732 if (fg == NULL) 3733 return NULL; 3734 for (fr = fg->fg_start; fr && n; fr = fr->fr_next, n--) 3735 ; 3736 if (n != 0) 3737 return NULL; 3738 return fr; 3739} 3740 3741 3742/* ------------------------------------------------------------------------ */ 3743/* Function: ipf_flushlist */ 3744/* Returns: int - >= 0 - number of flushed rules */ 3745/* Parameters: softc(I) - pointer to soft context main structure */ 3746/* nfreedp(O) - pointer to int where flush count is stored */ 3747/* listp(I) - pointer to list to flush pointer */ 3748/* Write Locks: ipf_mutex */ 3749/* */ 3750/* Recursively flush rules from the list, descending groups as they are */ 3751/* encountered. if a rule is the head of a group and it has lost all its */ 3752/* group members, then also delete the group reference. nfreedp is needed */ 3753/* to store the accumulating count of rules removed, whereas the returned */ 3754/* value is just the number removed from the current list. The latter is */ 3755/* needed to correctly adjust reference counts on rules that define groups. */ 3756/* */ 3757/* NOTE: Rules not loaded from user space cannot be flushed. */ 3758/* ------------------------------------------------------------------------ */ 3759static int 3760ipf_flushlist(softc, nfreedp, listp) 3761 ipf_main_softc_t *softc; 3762 int *nfreedp; 3763 frentry_t **listp; 3764{ 3765 int freed = 0; 3766 frentry_t *fp; 3767 3768 while ((fp = *listp) != NULL) { 3769 if ((fp->fr_type & FR_T_BUILTIN) || 3770 !(fp->fr_flags & FR_COPIED)) { 3771 listp = &fp->fr_next; 3772 continue; 3773 } 3774 *listp = fp->fr_next; 3775 if (fp->fr_next != NULL) 3776 fp->fr_next->fr_pnext = fp->fr_pnext; 3777 fp->fr_pnext = NULL; 3778 3779 if (fp->fr_grphead != NULL) { 3780 freed += ipf_group_flush(softc, fp->fr_grphead); 3781 fp->fr_names[fp->fr_grhead] = '\0'; 3782 } 3783 3784 if (fp->fr_icmpgrp != NULL) { 3785 freed += ipf_group_flush(softc, fp->fr_icmpgrp); 3786 fp->fr_names[fp->fr_icmphead] = '\0'; 3787 } 3788 3789 if (fp->fr_srctrack.ht_max_nodes) 3790 ipf_rb_ht_flush(&fp->fr_srctrack); 3791 3792 fp->fr_next = NULL; 3793 3794 ASSERT(fp->fr_ref > 0); 3795 if (ipf_derefrule(softc, &fp) == 0) 3796 freed++; 3797 } 3798 *nfreedp += freed; 3799 return freed; 3800} 3801 3802 3803/* ------------------------------------------------------------------------ */ 3804/* Function: ipf_flush */ 3805/* Returns: int - >= 0 - number of flushed rules */ 3806/* Parameters: softc(I) - pointer to soft context main structure */ 3807/* unit(I) - device for which to flush rules */ 3808/* flags(I) - which set of rules to flush */ 3809/* */ 3810/* Calls flushlist() for all filter rules (accounting, firewall - both IPv4 */ 3811/* and IPv6) as defined by the value of flags. */ 3812/* ------------------------------------------------------------------------ */ 3813int 3814ipf_flush(softc, unit, flags) 3815 ipf_main_softc_t *softc; 3816 minor_t unit; 3817 int flags; 3818{ 3819 int flushed = 0, set; 3820 3821 WRITE_ENTER(&softc->ipf_mutex); 3822 3823 set = softc->ipf_active; 3824 if ((flags & FR_INACTIVE) == FR_INACTIVE) 3825 set = 1 - set; 3826 3827 if (flags & FR_OUTQUE) { 3828 ipf_flushlist(softc, &flushed, &softc->ipf_rules[1][set]); 3829 ipf_flushlist(softc, &flushed, &softc->ipf_acct[1][set]); 3830 } 3831 if (flags & FR_INQUE) { 3832 ipf_flushlist(softc, &flushed, &softc->ipf_rules[0][set]); 3833 ipf_flushlist(softc, &flushed, &softc->ipf_acct[0][set]); 3834 } 3835 3836 flushed += ipf_flush_groups(softc, &softc->ipf_groups[unit][set], 3837 flags & (FR_INQUE|FR_OUTQUE)); 3838 3839 RWLOCK_EXIT(&softc->ipf_mutex); 3840 3841 if (unit == IPL_LOGIPF) { 3842 int tmp; 3843 3844 tmp = ipf_flush(softc, IPL_LOGCOUNT, flags); 3845 if (tmp >= 0) 3846 flushed += tmp; 3847 } 3848 return flushed; 3849} 3850 3851 3852/* ------------------------------------------------------------------------ */ 3853/* Function: ipf_flush_groups */ 3854/* Returns: int - >= 0 - number of flushed rules */ 3855/* Parameters: softc(I) - soft context pointerto work with */ 3856/* grhead(I) - pointer to the start of the group list to flush */ 3857/* flags(I) - which set of rules to flush */ 3858/* */ 3859/* Walk through all of the groups under the given group head and remove all */ 3860/* of those that match the flags passed in. The for loop here is bit more */ 3861/* complicated than usual because the removal of a rule with ipf_derefrule */ 3862/* may end up removing not only the structure pointed to by "fg" but also */ 3863/* what is fg_next and fg_next after that. So if a filter rule is actually */ 3864/* removed from the group then it is necessary to start again. */ 3865/* ------------------------------------------------------------------------ */ 3866static int 3867ipf_flush_groups(softc, grhead, flags) 3868 ipf_main_softc_t *softc; 3869 frgroup_t **grhead; 3870 int flags; 3871{ 3872 frentry_t *fr, **frp; 3873 frgroup_t *fg, **fgp; 3874 int flushed = 0; 3875 int removed = 0; 3876 3877 for (fgp = grhead; (fg = *fgp) != NULL; ) { 3878 while ((fg != NULL) && ((fg->fg_flags & flags) == 0)) 3879 fg = fg->fg_next; 3880 if (fg == NULL) 3881 break; 3882 removed = 0; 3883 frp = &fg->fg_start; 3884 while ((removed == 0) && ((fr = *frp) != NULL)) { 3885 if ((fr->fr_flags & flags) == 0) { 3886 frp = &fr->fr_next; 3887 } else { 3888 if (fr->fr_next != NULL) 3889 fr->fr_next->fr_pnext = fr->fr_pnext; 3890 *frp = fr->fr_next; 3891 fr->fr_pnext = NULL; 3892 fr->fr_next = NULL; 3893 (void) ipf_derefrule(softc, &fr); 3894 flushed++; 3895 removed++; 3896 } 3897 } 3898 if (removed == 0) 3899 fgp = &fg->fg_next; 3900 } 3901 return flushed; 3902} 3903 3904 3905/* ------------------------------------------------------------------------ */ 3906/* Function: memstr */ 3907/* Returns: char * - NULL if failed, != NULL pointer to matching bytes */ 3908/* Parameters: src(I) - pointer to byte sequence to match */ 3909/* dst(I) - pointer to byte sequence to search */ 3910/* slen(I) - match length */ 3911/* dlen(I) - length available to search in */ 3912/* */ 3913/* Search dst for a sequence of bytes matching those at src and extend for */ 3914/* slen bytes. */ 3915/* ------------------------------------------------------------------------ */ 3916char * 3917memstr(src, dst, slen, dlen) 3918 const char *src; 3919 char *dst; 3920 size_t slen, dlen; 3921{ 3922 char *s = NULL; 3923 3924 while (dlen >= slen) { 3925 if (bcmp(src, dst, slen) == 0) { 3926 s = dst; 3927 break; 3928 } 3929 dst++; 3930 dlen--; 3931 } 3932 return s; 3933} 3934/* ------------------------------------------------------------------------ */ 3935/* Function: ipf_fixskip */ 3936/* Returns: Nil */ 3937/* Parameters: listp(IO) - pointer to start of list with skip rule */ 3938/* rp(I) - rule added/removed with skip in it. */ 3939/* addremove(I) - adjustment (-1/+1) to make to skip count, */ 3940/* depending on whether a rule was just added */ 3941/* or removed. */ 3942/* */ 3943/* Adjust all the rules in a list which would have skip'd past the position */ 3944/* where we are inserting to skip to the right place given the change. */ 3945/* ------------------------------------------------------------------------ */ 3946void 3947ipf_fixskip(listp, rp, addremove) 3948 frentry_t **listp, *rp; 3949 int addremove; 3950{ 3951 int rules, rn; 3952 frentry_t *fp; 3953 3954 rules = 0; 3955 for (fp = *listp; (fp != NULL) && (fp != rp); fp = fp->fr_next) 3956 rules++; 3957 3958 if (!fp) 3959 return; 3960 3961 for (rn = 0, fp = *listp; fp && (fp != rp); fp = fp->fr_next, rn++) 3962 if (FR_ISSKIP(fp->fr_flags) && (rn + fp->fr_arg >= rules)) 3963 fp->fr_arg += addremove; 3964} 3965 3966 3967#ifdef _KERNEL 3968/* ------------------------------------------------------------------------ */ 3969/* Function: count4bits */ 3970/* Returns: int - >= 0 - number of consecutive bits in input */ 3971/* Parameters: ip(I) - 32bit IP address */ 3972/* */ 3973/* IPv4 ONLY */ 3974/* count consecutive 1's in bit mask. If the mask generated by counting */ 3975/* consecutive 1's is different to that passed, return -1, else return # */ 3976/* of bits. */ 3977/* ------------------------------------------------------------------------ */ 3978int 3979count4bits(ip) 3980 u_32_t ip; 3981{ 3982 u_32_t ipn; 3983 int cnt = 0, i, j; 3984 3985 ip = ipn = ntohl(ip); 3986 for (i = 32; i; i--, ipn *= 2) 3987 if (ipn & 0x80000000) 3988 cnt++; 3989 else 3990 break; 3991 ipn = 0; 3992 for (i = 32, j = cnt; i; i--, j--) { 3993 ipn *= 2; 3994 if (j > 0) 3995 ipn++; 3996 } 3997 if (ipn == ip) 3998 return cnt; 3999 return -1; 4000} 4001 4002 4003/* ------------------------------------------------------------------------ */ 4004/* Function: count6bits */ 4005/* Returns: int - >= 0 - number of consecutive bits in input */ 4006/* Parameters: msk(I) - pointer to start of IPv6 bitmask */ 4007/* */ 4008/* IPv6 ONLY */ 4009/* count consecutive 1's in bit mask. */ 4010/* ------------------------------------------------------------------------ */ 4011# ifdef USE_INET6 4012int 4013count6bits(msk) 4014 u_32_t *msk; 4015{ 4016 int i = 0, k; 4017 u_32_t j; 4018 4019 for (k = 3; k >= 0; k--) 4020 if (msk[k] == 0xffffffff) 4021 i += 32; 4022 else { 4023 for (j = msk[k]; j; j <<= 1) 4024 if (j & 0x80000000) 4025 i++; 4026 } 4027 return i; 4028} 4029# endif 4030#endif /* _KERNEL */ 4031 4032 4033/* ------------------------------------------------------------------------ */ 4034/* Function: ipf_synclist */ 4035/* Returns: int - 0 = no failures, else indication of first failure */ 4036/* Parameters: fr(I) - start of filter list to sync interface names for */ 4037/* ifp(I) - interface pointer for limiting sync lookups */ 4038/* Write Locks: ipf_mutex */ 4039/* */ 4040/* Walk through a list of filter rules and resolve any interface names into */ 4041/* pointers. Where dynamic addresses are used, also update the IP address */ 4042/* used in the rule. The interface pointer is used to limit the lookups to */ 4043/* a specific set of matching names if it is non-NULL. */ 4044/* Errors can occur when resolving the destination name of to/dup-to fields */ 4045/* when the name points to a pool and that pool doest not exist. If this */ 4046/* does happen then it is necessary to check if there are any lookup refs */ 4047/* that need to be dropped before returning with an error. */ 4048/* ------------------------------------------------------------------------ */ 4049static int 4050ipf_synclist(softc, fr, ifp) 4051 ipf_main_softc_t *softc; 4052 frentry_t *fr; 4053 void *ifp; 4054{ 4055 frentry_t *frt, *start = fr; 4056 frdest_t *fdp; 4057 char *name; 4058 int error; 4059 void *ifa; 4060 int v, i; 4061 4062 error = 0; 4063 4064 for (; fr; fr = fr->fr_next) { 4065 if (fr->fr_family == AF_INET) 4066 v = 4; 4067 else if (fr->fr_family == AF_INET6) 4068 v = 6; 4069 else 4070 v = 0; 4071 4072 /* 4073 * Lookup all the interface names that are part of the rule. 4074 */ 4075 for (i = 0; i < 4; i++) { 4076 if ((ifp != NULL) && (fr->fr_ifas[i] != ifp)) 4077 continue; 4078 if (fr->fr_ifnames[i] == -1) 4079 continue; 4080 name = FR_NAME(fr, fr_ifnames[i]); 4081 fr->fr_ifas[i] = ipf_resolvenic(softc, name, v); 4082 } 4083 4084 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) { 4085 if (fr->fr_satype != FRI_NORMAL && 4086 fr->fr_satype != FRI_LOOKUP) { 4087 ifa = ipf_resolvenic(softc, fr->fr_names + 4088 fr->fr_sifpidx, v); 4089 ipf_ifpaddr(softc, v, fr->fr_satype, ifa, 4090 &fr->fr_src6, &fr->fr_smsk6); 4091 } 4092 if (fr->fr_datype != FRI_NORMAL && 4093 fr->fr_datype != FRI_LOOKUP) { 4094 ifa = ipf_resolvenic(softc, fr->fr_names + 4095 fr->fr_sifpidx, v); 4096 ipf_ifpaddr(softc, v, fr->fr_datype, ifa, 4097 &fr->fr_dst6, &fr->fr_dmsk6); 4098 } 4099 } 4100 4101 fdp = &fr->fr_tifs[0]; 4102 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) { 4103 error = ipf_resolvedest(softc, fr->fr_names, fdp, v); 4104 if (error != 0) 4105 goto unwind; 4106 } 4107 4108 fdp = &fr->fr_tifs[1]; 4109 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) { 4110 error = ipf_resolvedest(softc, fr->fr_names, fdp, v); 4111 if (error != 0) 4112 goto unwind; 4113 } 4114 4115 fdp = &fr->fr_dif; 4116 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) { 4117 error = ipf_resolvedest(softc, fr->fr_names, fdp, v); 4118 if (error != 0) 4119 goto unwind; 4120 } 4121 4122 if (((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4123 (fr->fr_satype == FRI_LOOKUP) && (fr->fr_srcptr == NULL)) { 4124 fr->fr_srcptr = ipf_lookup_res_num(softc, 4125 fr->fr_srctype, 4126 IPL_LOGIPF, 4127 fr->fr_srcnum, 4128 &fr->fr_srcfunc); 4129 } 4130 if (((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4131 (fr->fr_datype == FRI_LOOKUP) && (fr->fr_dstptr == NULL)) { 4132 fr->fr_dstptr = ipf_lookup_res_num(softc, 4133 fr->fr_dsttype, 4134 IPL_LOGIPF, 4135 fr->fr_dstnum, 4136 &fr->fr_dstfunc); 4137 } 4138 } 4139 return 0; 4140 4141unwind: 4142 for (frt = start; frt != fr; fr = fr->fr_next) { 4143 if (((frt->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4144 (frt->fr_satype == FRI_LOOKUP) && (frt->fr_srcptr != NULL)) 4145 ipf_lookup_deref(softc, frt->fr_srctype, 4146 frt->fr_srcptr); 4147 if (((frt->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4148 (frt->fr_datype == FRI_LOOKUP) && (frt->fr_dstptr != NULL)) 4149 ipf_lookup_deref(softc, frt->fr_dsttype, 4150 frt->fr_dstptr); 4151 } 4152 return error; 4153} 4154 4155 4156/* ------------------------------------------------------------------------ */ 4157/* Function: ipf_sync */ 4158/* Returns: void */ 4159/* Parameters: Nil */ 4160/* */ 4161/* ipf_sync() is called when we suspect that the interface list or */ 4162/* information about interfaces (like IP#) has changed. Go through all */ 4163/* filter rules, NAT entries and the state table and check if anything */ 4164/* needs to be changed/updated. */ 4165/* ------------------------------------------------------------------------ */ 4166int 4167ipf_sync(softc, ifp) 4168 ipf_main_softc_t *softc; 4169 void *ifp; 4170{ 4171 int i; 4172 4173# if !SOLARIS 4174 ipf_nat_sync(softc, ifp); 4175 ipf_state_sync(softc, ifp); 4176 ipf_lookup_sync(softc, ifp); 4177# endif 4178 4179 WRITE_ENTER(&softc->ipf_mutex); 4180 (void) ipf_synclist(softc, softc->ipf_acct[0][softc->ipf_active], ifp); 4181 (void) ipf_synclist(softc, softc->ipf_acct[1][softc->ipf_active], ifp); 4182 (void) ipf_synclist(softc, softc->ipf_rules[0][softc->ipf_active], ifp); 4183 (void) ipf_synclist(softc, softc->ipf_rules[1][softc->ipf_active], ifp); 4184 4185 for (i = 0; i < IPL_LOGSIZE; i++) { 4186 frgroup_t *g; 4187 4188 for (g = softc->ipf_groups[i][0]; g != NULL; g = g->fg_next) 4189 (void) ipf_synclist(softc, g->fg_start, ifp); 4190 for (g = softc->ipf_groups[i][1]; g != NULL; g = g->fg_next) 4191 (void) ipf_synclist(softc, g->fg_start, ifp); 4192 } 4193 RWLOCK_EXIT(&softc->ipf_mutex); 4194 4195 return 0; 4196} 4197 4198 4199/* 4200 * In the functions below, bcopy() is called because the pointer being 4201 * copied _from_ in this instance is a pointer to a char buf (which could 4202 * end up being unaligned) and on the kernel's local stack. 4203 */ 4204/* ------------------------------------------------------------------------ */ 4205/* Function: copyinptr */ 4206/* Returns: int - 0 = success, else failure */ 4207/* Parameters: src(I) - pointer to the source address */ 4208/* dst(I) - destination address */ 4209/* size(I) - number of bytes to copy */ 4210/* */ 4211/* Copy a block of data in from user space, given a pointer to the pointer */ 4212/* to start copying from (src) and a pointer to where to store it (dst). */ 4213/* NB: src - pointer to user space pointer, dst - kernel space pointer */ 4214/* ------------------------------------------------------------------------ */ 4215int 4216copyinptr(softc, src, dst, size) 4217 ipf_main_softc_t *softc; 4218 void *src, *dst; 4219 size_t size; 4220{ 4221 caddr_t ca; 4222 int error; 4223 4224# if SOLARIS 4225 error = COPYIN(src, &ca, sizeof(ca)); 4226 if (error != 0) 4227 return error; 4228# else 4229 bcopy(src, (caddr_t)&ca, sizeof(ca)); 4230# endif 4231 error = COPYIN(ca, dst, size); 4232 if (error != 0) { 4233 IPFERROR(3); 4234 error = EFAULT; 4235 } 4236 return error; 4237} 4238 4239 4240/* ------------------------------------------------------------------------ */ 4241/* Function: copyoutptr */ 4242/* Returns: int - 0 = success, else failure */ 4243/* Parameters: src(I) - pointer to the source address */ 4244/* dst(I) - destination address */ 4245/* size(I) - number of bytes to copy */ 4246/* */ 4247/* Copy a block of data out to user space, given a pointer to the pointer */ 4248/* to start copying from (src) and a pointer to where to store it (dst). */ 4249/* NB: src - kernel space pointer, dst - pointer to user space pointer. */ 4250/* ------------------------------------------------------------------------ */ 4251int 4252copyoutptr(softc, src, dst, size) 4253 ipf_main_softc_t *softc; 4254 void *src, *dst; 4255 size_t size; 4256{ 4257 caddr_t ca; 4258 int error; 4259 4260 bcopy(dst, (caddr_t)&ca, sizeof(ca)); 4261 error = COPYOUT(src, ca, size); 4262 if (error != 0) { 4263 IPFERROR(4); 4264 error = EFAULT; 4265 } 4266 return error; 4267} 4268#ifdef _KERNEL 4269#endif 4270 4271 4272/* ------------------------------------------------------------------------ */ 4273/* Function: ipf_lock */ 4274/* Returns: int - 0 = success, else error */ 4275/* Parameters: data(I) - pointer to lock value to set */ 4276/* lockp(O) - pointer to location to store old lock value */ 4277/* */ 4278/* Get the new value for the lock integer, set it and return the old value */ 4279/* in *lockp. */ 4280/* ------------------------------------------------------------------------ */ 4281int 4282ipf_lock(data, lockp) 4283 caddr_t data; 4284 int *lockp; 4285{ 4286 int arg, err; 4287 4288 err = BCOPYIN(data, &arg, sizeof(arg)); 4289 if (err != 0) 4290 return EFAULT; 4291 err = BCOPYOUT(lockp, data, sizeof(*lockp)); 4292 if (err != 0) 4293 return EFAULT; 4294 *lockp = arg; 4295 return 0; 4296} 4297 4298 4299/* ------------------------------------------------------------------------ */ 4300/* Function: ipf_getstat */ 4301/* Returns: Nil */ 4302/* Parameters: softc(I) - pointer to soft context main structure */ 4303/* fiop(I) - pointer to ipfilter stats structure */ 4304/* rev(I) - version claim by program doing ioctl */ 4305/* */ 4306/* Stores a copy of current pointers, counters, etc, in the friostat */ 4307/* structure. */ 4308/* If IPFILTER_COMPAT is compiled, we pretend to be whatever version the */ 4309/* program is looking for. This ensure that validation of the version it */ 4310/* expects will always succeed. Thus kernels with IPFILTER_COMPAT will */ 4311/* allow older binaries to work but kernels without it will not. */ 4312/* ------------------------------------------------------------------------ */ 4313/*ARGSUSED*/ 4314static void 4315ipf_getstat(softc, fiop, rev) 4316 ipf_main_softc_t *softc; 4317 friostat_t *fiop; 4318 int rev; 4319{ 4320 int i; 4321 4322 bcopy((char *)softc->ipf_stats, (char *)fiop->f_st, 4323 sizeof(ipf_statistics_t) * 2); 4324 fiop->f_locks[IPL_LOGSTATE] = -1; 4325 fiop->f_locks[IPL_LOGNAT] = -1; 4326 fiop->f_locks[IPL_LOGIPF] = -1; 4327 fiop->f_locks[IPL_LOGAUTH] = -1; 4328 4329 fiop->f_ipf[0][0] = softc->ipf_rules[0][0]; 4330 fiop->f_acct[0][0] = softc->ipf_acct[0][0]; 4331 fiop->f_ipf[0][1] = softc->ipf_rules[0][1]; 4332 fiop->f_acct[0][1] = softc->ipf_acct[0][1]; 4333 fiop->f_ipf[1][0] = softc->ipf_rules[1][0]; 4334 fiop->f_acct[1][0] = softc->ipf_acct[1][0]; 4335 fiop->f_ipf[1][1] = softc->ipf_rules[1][1]; 4336 fiop->f_acct[1][1] = softc->ipf_acct[1][1]; 4337 4338 fiop->f_ticks = softc->ipf_ticks; 4339 fiop->f_active = softc->ipf_active; 4340 fiop->f_froute[0] = softc->ipf_frouteok[0]; 4341 fiop->f_froute[1] = softc->ipf_frouteok[1]; 4342 fiop->f_rb_no_mem = softc->ipf_rb_no_mem; 4343 fiop->f_rb_node_max = softc->ipf_rb_node_max; 4344 4345 fiop->f_running = softc->ipf_running; 4346 for (i = 0; i < IPL_LOGSIZE; i++) { 4347 fiop->f_groups[i][0] = softc->ipf_groups[i][0]; 4348 fiop->f_groups[i][1] = softc->ipf_groups[i][1]; 4349 } 4350#ifdef IPFILTER_LOG 4351 fiop->f_log_ok = ipf_log_logok(softc, IPL_LOGIPF); 4352 fiop->f_log_fail = ipf_log_failures(softc, IPL_LOGIPF); 4353 fiop->f_logging = 1; 4354#else 4355 fiop->f_log_ok = 0; 4356 fiop->f_log_fail = 0; 4357 fiop->f_logging = 0; 4358#endif 4359 fiop->f_defpass = softc->ipf_pass; 4360 fiop->f_features = ipf_features; 4361 4362#ifdef IPFILTER_COMPAT 4363 sprintf(fiop->f_version, "IP Filter: v%d.%d.%d", 4364 (rev / 1000000) % 100, 4365 (rev / 10000) % 100, 4366 (rev / 100) % 100); 4367#else 4368 rev = rev; 4369 (void) strncpy(fiop->f_version, ipfilter_version, 4370 sizeof(fiop->f_version)); 4371#endif 4372} 4373 4374 4375#ifdef USE_INET6 4376int icmptoicmp6types[ICMP_MAXTYPE+1] = { 4377 ICMP6_ECHO_REPLY, /* 0: ICMP_ECHOREPLY */ 4378 -1, /* 1: UNUSED */ 4379 -1, /* 2: UNUSED */ 4380 ICMP6_DST_UNREACH, /* 3: ICMP_UNREACH */ 4381 -1, /* 4: ICMP_SOURCEQUENCH */ 4382 ND_REDIRECT, /* 5: ICMP_REDIRECT */ 4383 -1, /* 6: UNUSED */ 4384 -1, /* 7: UNUSED */ 4385 ICMP6_ECHO_REQUEST, /* 8: ICMP_ECHO */ 4386 -1, /* 9: UNUSED */ 4387 -1, /* 10: UNUSED */ 4388 ICMP6_TIME_EXCEEDED, /* 11: ICMP_TIMXCEED */ 4389 ICMP6_PARAM_PROB, /* 12: ICMP_PARAMPROB */ 4390 -1, /* 13: ICMP_TSTAMP */ 4391 -1, /* 14: ICMP_TSTAMPREPLY */ 4392 -1, /* 15: ICMP_IREQ */ 4393 -1, /* 16: ICMP_IREQREPLY */ 4394 -1, /* 17: ICMP_MASKREQ */ 4395 -1, /* 18: ICMP_MASKREPLY */ 4396}; 4397 4398 4399int icmptoicmp6unreach[ICMP_MAX_UNREACH] = { 4400 ICMP6_DST_UNREACH_ADDR, /* 0: ICMP_UNREACH_NET */ 4401 ICMP6_DST_UNREACH_ADDR, /* 1: ICMP_UNREACH_HOST */ 4402 -1, /* 2: ICMP_UNREACH_PROTOCOL */ 4403 ICMP6_DST_UNREACH_NOPORT, /* 3: ICMP_UNREACH_PORT */ 4404 -1, /* 4: ICMP_UNREACH_NEEDFRAG */ 4405 ICMP6_DST_UNREACH_NOTNEIGHBOR, /* 5: ICMP_UNREACH_SRCFAIL */ 4406 ICMP6_DST_UNREACH_ADDR, /* 6: ICMP_UNREACH_NET_UNKNOWN */ 4407 ICMP6_DST_UNREACH_ADDR, /* 7: ICMP_UNREACH_HOST_UNKNOWN */ 4408 -1, /* 8: ICMP_UNREACH_ISOLATED */ 4409 ICMP6_DST_UNREACH_ADMIN, /* 9: ICMP_UNREACH_NET_PROHIB */ 4410 ICMP6_DST_UNREACH_ADMIN, /* 10: ICMP_UNREACH_HOST_PROHIB */ 4411 -1, /* 11: ICMP_UNREACH_TOSNET */ 4412 -1, /* 12: ICMP_UNREACH_TOSHOST */ 4413 ICMP6_DST_UNREACH_ADMIN, /* 13: ICMP_UNREACH_ADMIN_PROHIBIT */ 4414}; 4415int icmpreplytype6[ICMP6_MAXTYPE + 1]; 4416#endif 4417 4418int icmpreplytype4[ICMP_MAXTYPE + 1]; 4419 4420 4421/* ------------------------------------------------------------------------ */ 4422/* Function: ipf_matchicmpqueryreply */ 4423/* Returns: int - 1 if "icmp" is a valid reply to "ic" else 0. */ 4424/* Parameters: v(I) - IP protocol version (4 or 6) */ 4425/* ic(I) - ICMP information */ 4426/* icmp(I) - ICMP packet header */ 4427/* rev(I) - direction (0 = forward/1 = reverse) of packet */ 4428/* */ 4429/* Check if the ICMP packet defined by the header pointed to by icmp is a */ 4430/* reply to one as described by what's in ic. If it is a match, return 1, */ 4431/* else return 0 for no match. */ 4432/* ------------------------------------------------------------------------ */ 4433int 4434ipf_matchicmpqueryreply(v, ic, icmp, rev) 4435 int v; 4436 icmpinfo_t *ic; 4437 icmphdr_t *icmp; 4438 int rev; 4439{ 4440 int ictype; 4441 4442 ictype = ic->ici_type; 4443 4444 if (v == 4) { 4445 /* 4446 * If we matched its type on the way in, then when going out 4447 * it will still be the same type. 4448 */ 4449 if ((!rev && (icmp->icmp_type == ictype)) || 4450 (rev && (icmpreplytype4[ictype] == icmp->icmp_type))) { 4451 if (icmp->icmp_type != ICMP_ECHOREPLY) 4452 return 1; 4453 if (icmp->icmp_id == ic->ici_id) 4454 return 1; 4455 } 4456 } 4457#ifdef USE_INET6 4458 else if (v == 6) { 4459 if ((!rev && (icmp->icmp_type == ictype)) || 4460 (rev && (icmpreplytype6[ictype] == icmp->icmp_type))) { 4461 if (icmp->icmp_type != ICMP6_ECHO_REPLY) 4462 return 1; 4463 if (icmp->icmp_id == ic->ici_id) 4464 return 1; 4465 } 4466 } 4467#endif 4468 return 0; 4469} 4470 4471 4472/* ------------------------------------------------------------------------ */ 4473/* Function: ipf_rule_compare */ 4474/* Parameters: fr1(I) - first rule structure to compare */ 4475/* fr2(I) - second rule structure to compare */ 4476/* Returns: int - 0 == rules are the same, else mismatch */ 4477/* */ 4478/* Compare two rules and return 0 if they match or a number indicating */ 4479/* which of the individual checks failed. */ 4480/* ------------------------------------------------------------------------ */ 4481static int 4482ipf_rule_compare(frentry_t *fr1, frentry_t *fr2) 4483{ 4484 if (fr1->fr_cksum != fr2->fr_cksum) 4485 return 1; 4486 if (fr1->fr_size != fr2->fr_size) 4487 return 2; 4488 if (fr1->fr_dsize != fr2->fr_dsize) 4489 return 3; 4490 if (bcmp((char *)&fr1->fr_func, (char *)&fr2->fr_func, 4491 fr1->fr_size - offsetof(struct frentry, fr_func)) != 0) 4492 return 4; 4493 if (fr1->fr_data && !fr2->fr_data) 4494 return 5; 4495 if (!fr1->fr_data && fr2->fr_data) 4496 return 6; 4497 if (fr1->fr_data) { 4498 if (bcmp(fr1->fr_caddr, fr2->fr_caddr, fr1->fr_dsize)) 4499 return 7; 4500 } 4501 return 0; 4502} 4503 4504 4505/* ------------------------------------------------------------------------ */ 4506/* Function: frrequest */ 4507/* Returns: int - 0 == success, > 0 == errno value */ 4508/* Parameters: unit(I) - device for which this is for */ 4509/* req(I) - ioctl command (SIOC*) */ 4510/* data(I) - pointr to ioctl data */ 4511/* set(I) - 1 or 0 (filter set) */ 4512/* makecopy(I) - flag indicating whether data points to a rule */ 4513/* in kernel space & hence doesn't need copying. */ 4514/* */ 4515/* This function handles all the requests which operate on the list of */ 4516/* filter rules. This includes adding, deleting, insertion. It is also */ 4517/* responsible for creating groups when a "head" rule is loaded. Interface */ 4518/* names are resolved here and other sanity checks are made on the content */ 4519/* of the rule structure being loaded. If a rule has user defined timeouts */ 4520/* then make sure they are created and initialised before exiting. */ 4521/* ------------------------------------------------------------------------ */ 4522int 4523frrequest(softc, unit, req, data, set, makecopy) 4524 ipf_main_softc_t *softc; 4525 int unit; 4526 ioctlcmd_t req; 4527 int set, makecopy; 4528 caddr_t data; 4529{ 4530 int error = 0, in, family, addrem, need_free = 0; 4531 frentry_t frd, *fp, *f, **fprev, **ftail; 4532 void *ptr, *uptr, *cptr; 4533 u_int *p, *pp; 4534 frgroup_t *fg; 4535 char *group; 4536 4537 ptr = NULL; 4538 cptr = NULL; 4539 fg = NULL; 4540 fp = &frd; 4541 if (makecopy != 0) { 4542 bzero(fp, sizeof(frd)); 4543 error = ipf_inobj(softc, data, NULL, fp, IPFOBJ_FRENTRY); 4544 if (error) { 4545 return error; 4546 } 4547 if ((fp->fr_type & FR_T_BUILTIN) != 0) { 4548 IPFERROR(6); 4549 return EINVAL; 4550 } 4551 KMALLOCS(f, frentry_t *, fp->fr_size); 4552 if (f == NULL) { 4553 IPFERROR(131); 4554 return ENOMEM; 4555 } 4556 bzero(f, fp->fr_size); 4557 error = ipf_inobjsz(softc, data, f, IPFOBJ_FRENTRY, 4558 fp->fr_size); 4559 if (error) { 4560 KFREES(f, fp->fr_size); 4561 return error; 4562 } 4563 4564 fp = f; 4565 f = NULL; 4566 fp->fr_next = NULL; 4567 fp->fr_dnext = NULL; 4568 fp->fr_pnext = NULL; 4569 fp->fr_pdnext = NULL; 4570 fp->fr_grp = NULL; 4571 fp->fr_grphead = NULL; 4572 fp->fr_icmpgrp = NULL; 4573 fp->fr_isc = (void *)-1; 4574 fp->fr_ptr = NULL; 4575 fp->fr_ref = 0; 4576 fp->fr_flags |= FR_COPIED; 4577 } else { 4578 fp = (frentry_t *)data; 4579 if ((fp->fr_type & FR_T_BUILTIN) == 0) { 4580 IPFERROR(7); 4581 return EINVAL; 4582 } 4583 fp->fr_flags &= ~FR_COPIED; 4584 } 4585 4586 if (((fp->fr_dsize == 0) && (fp->fr_data != NULL)) || 4587 ((fp->fr_dsize != 0) && (fp->fr_data == NULL))) { 4588 IPFERROR(8); 4589 error = EINVAL; 4590 goto donenolock; 4591 } 4592 4593 family = fp->fr_family; 4594 uptr = fp->fr_data; 4595 4596 if (req == (ioctlcmd_t)SIOCINAFR || req == (ioctlcmd_t)SIOCINIFR || 4597 req == (ioctlcmd_t)SIOCADAFR || req == (ioctlcmd_t)SIOCADIFR) 4598 addrem = 0; 4599 else if (req == (ioctlcmd_t)SIOCRMAFR || req == (ioctlcmd_t)SIOCRMIFR) 4600 addrem = 1; 4601 else if (req == (ioctlcmd_t)SIOCZRLST) 4602 addrem = 2; 4603 else { 4604 IPFERROR(9); 4605 error = EINVAL; 4606 goto donenolock; 4607 } 4608 4609 /* 4610 * Only filter rules for IPv4 or IPv6 are accepted. 4611 */ 4612 if (family == AF_INET) { 4613 /*EMPTY*/; 4614#ifdef USE_INET6 4615 } else if (family == AF_INET6) { 4616 /*EMPTY*/; 4617#endif 4618 } else if (family != 0) { 4619 IPFERROR(10); 4620 error = EINVAL; 4621 goto donenolock; 4622 } 4623 4624 /* 4625 * If the rule is being loaded from user space, i.e. we had to copy it 4626 * into kernel space, then do not trust the function pointer in the 4627 * rule. 4628 */ 4629 if ((makecopy == 1) && (fp->fr_func != NULL)) { 4630 if (ipf_findfunc(fp->fr_func) == NULL) { 4631 IPFERROR(11); 4632 error = ESRCH; 4633 goto donenolock; 4634 } 4635 4636 if (addrem == 0) { 4637 error = ipf_funcinit(softc, fp); 4638 if (error != 0) 4639 goto donenolock; 4640 } 4641 } 4642 if ((fp->fr_flags & FR_CALLNOW) && 4643 ((fp->fr_func == NULL) || (fp->fr_func == (ipfunc_t)-1))) { 4644 IPFERROR(142); 4645 error = ESRCH; 4646 goto donenolock; 4647 } 4648 if (((fp->fr_flags & FR_CMDMASK) == FR_CALL) && 4649 ((fp->fr_func == NULL) || (fp->fr_func == (ipfunc_t)-1))) { 4650 IPFERROR(143); 4651 error = ESRCH; 4652 goto donenolock; 4653 } 4654 4655 ptr = NULL; 4656 cptr = NULL; 4657 4658 if (FR_ISACCOUNT(fp->fr_flags)) 4659 unit = IPL_LOGCOUNT; 4660 4661 /* 4662 * Check that each group name in the rule has a start index that 4663 * is valid. 4664 */ 4665 if (fp->fr_icmphead != -1) { 4666 if ((fp->fr_icmphead < 0) || 4667 (fp->fr_icmphead >= fp->fr_namelen)) { 4668 IPFERROR(136); 4669 error = EINVAL; 4670 goto donenolock; 4671 } 4672 if (!strcmp(FR_NAME(fp, fr_icmphead), "0")) 4673 fp->fr_names[fp->fr_icmphead] = '\0'; 4674 } 4675 4676 if (fp->fr_grhead != -1) { 4677 if ((fp->fr_grhead < 0) || 4678 (fp->fr_grhead >= fp->fr_namelen)) { 4679 IPFERROR(137); 4680 error = EINVAL; 4681 goto donenolock; 4682 } 4683 if (!strcmp(FR_NAME(fp, fr_grhead), "0")) 4684 fp->fr_names[fp->fr_grhead] = '\0'; 4685 } 4686 4687 if (fp->fr_group != -1) { 4688 if ((fp->fr_group < 0) || 4689 (fp->fr_group >= fp->fr_namelen)) { 4690 IPFERROR(138); 4691 error = EINVAL; 4692 goto donenolock; 4693 } 4694 if ((req != (int)SIOCZRLST) && (fp->fr_group != -1)) { 4695 /* 4696 * Allow loading rules that are in groups to cause 4697 * them to be created if they don't already exit. 4698 */ 4699 group = FR_NAME(fp, fr_group); 4700 if (addrem == 0) { 4701 fg = ipf_group_add(softc, group, NULL, 4702 fp->fr_flags, unit, set); 4703 fp->fr_grp = fg; 4704 } else { 4705 fg = ipf_findgroup(softc, group, unit, 4706 set, NULL); 4707 if (fg == NULL) { 4708 IPFERROR(12); 4709 error = ESRCH; 4710 goto donenolock; 4711 } 4712 } 4713 4714 if (fg->fg_flags == 0) { 4715 fg->fg_flags = fp->fr_flags & FR_INOUT; 4716 } else if (fg->fg_flags != (fp->fr_flags & FR_INOUT)) { 4717 IPFERROR(13); 4718 error = ESRCH; 4719 goto donenolock; 4720 } 4721 } 4722 } else { 4723 /* 4724 * If a rule is going to be part of a group then it does 4725 * not matter whether it is an in or out rule, but if it 4726 * isn't in a group, then it does... 4727 */ 4728 if ((fp->fr_flags & (FR_INQUE|FR_OUTQUE)) == 0) { 4729 IPFERROR(14); 4730 error = EINVAL; 4731 goto donenolock; 4732 } 4733 } 4734 in = (fp->fr_flags & FR_INQUE) ? 0 : 1; 4735 4736 /* 4737 * Work out which rule list this change is being applied to. 4738 */ 4739 ftail = NULL; 4740 fprev = NULL; 4741 if (unit == IPL_LOGAUTH) { 4742 if ((fp->fr_tifs[0].fd_ptr != NULL) || 4743 (fp->fr_tifs[1].fd_ptr != NULL) || 4744 (fp->fr_dif.fd_ptr != NULL) || 4745 (fp->fr_flags & FR_FASTROUTE)) { 4746 softc->ipf_interror = 145; 4747 error = EINVAL; 4748 goto donenolock; 4749 } 4750 fprev = ipf_auth_rulehead(softc); 4751 } else { 4752 if (FR_ISACCOUNT(fp->fr_flags)) 4753 fprev = &softc->ipf_acct[in][set]; 4754 else if ((fp->fr_flags & (FR_OUTQUE|FR_INQUE)) != 0) 4755 fprev = &softc->ipf_rules[in][set]; 4756 } 4757 if (fprev == NULL) { 4758 IPFERROR(15); 4759 error = ESRCH; 4760 goto donenolock; 4761 } 4762 4763 if (fg != NULL) 4764 fprev = &fg->fg_start; 4765 4766 /* 4767 * Copy in extra data for the rule. 4768 */ 4769 if (fp->fr_dsize != 0) { 4770 if (makecopy != 0) { 4771 KMALLOCS(ptr, void *, fp->fr_dsize); 4772 if (ptr == NULL) { 4773 IPFERROR(16); 4774 error = ENOMEM; 4775 goto donenolock; 4776 } 4777 4778 /* 4779 * The bcopy case is for when the data is appended 4780 * to the rule by ipf_in_compat(). 4781 */ 4782 if (uptr >= (void *)fp && 4783 uptr < (void *)((char *)fp + fp->fr_size)) { 4784 bcopy(uptr, ptr, fp->fr_dsize); 4785 error = 0; 4786 } else { 4787 error = COPYIN(uptr, ptr, fp->fr_dsize); 4788 if (error != 0) { 4789 IPFERROR(17); 4790 error = EFAULT; 4791 goto donenolock; 4792 } 4793 } 4794 } else { 4795 ptr = uptr; 4796 } 4797 fp->fr_data = ptr; 4798 } else { 4799 fp->fr_data = NULL; 4800 } 4801 4802 /* 4803 * Perform per-rule type sanity checks of their members. 4804 * All code after this needs to be aware that allocated memory 4805 * may need to be free'd before exiting. 4806 */ 4807 switch (fp->fr_type & ~FR_T_BUILTIN) 4808 { 4809#if defined(IPFILTER_BPF) 4810 case FR_T_BPFOPC : 4811 if (fp->fr_dsize == 0) { 4812 IPFERROR(19); 4813 error = EINVAL; 4814 break; 4815 } 4816 if (!bpf_validate(ptr, fp->fr_dsize/sizeof(struct bpf_insn))) { 4817 IPFERROR(20); 4818 error = EINVAL; 4819 break; 4820 } 4821 break; 4822#endif 4823 case FR_T_IPF : 4824 /* 4825 * Preparation for error case at the bottom of this function. 4826 */ 4827 if (fp->fr_datype == FRI_LOOKUP) 4828 fp->fr_dstptr = NULL; 4829 if (fp->fr_satype == FRI_LOOKUP) 4830 fp->fr_srcptr = NULL; 4831 4832 if (fp->fr_dsize != sizeof(fripf_t)) { 4833 IPFERROR(21); 4834 error = EINVAL; 4835 break; 4836 } 4837 4838 /* 4839 * Allowing a rule with both "keep state" and "with oow" is 4840 * pointless because adding a state entry to the table will 4841 * fail with the out of window (oow) flag set. 4842 */ 4843 if ((fp->fr_flags & FR_KEEPSTATE) && (fp->fr_flx & FI_OOW)) { 4844 IPFERROR(22); 4845 error = EINVAL; 4846 break; 4847 } 4848 4849 switch (fp->fr_satype) 4850 { 4851 case FRI_BROADCAST : 4852 case FRI_DYNAMIC : 4853 case FRI_NETWORK : 4854 case FRI_NETMASKED : 4855 case FRI_PEERADDR : 4856 if (fp->fr_sifpidx < 0) { 4857 IPFERROR(23); 4858 error = EINVAL; 4859 } 4860 break; 4861 case FRI_LOOKUP : 4862 fp->fr_srcptr = ipf_findlookup(softc, unit, fp, 4863 &fp->fr_src6, 4864 &fp->fr_smsk6); 4865 if (fp->fr_srcfunc == NULL) { 4866 IPFERROR(132); 4867 error = ESRCH; 4868 break; 4869 } 4870 break; 4871 case FRI_NORMAL : 4872 break; 4873 default : 4874 IPFERROR(133); 4875 error = EINVAL; 4876 break; 4877 } 4878 if (error != 0) 4879 break; 4880 4881 switch (fp->fr_datype) 4882 { 4883 case FRI_BROADCAST : 4884 case FRI_DYNAMIC : 4885 case FRI_NETWORK : 4886 case FRI_NETMASKED : 4887 case FRI_PEERADDR : 4888 if (fp->fr_difpidx < 0) { 4889 IPFERROR(24); 4890 error = EINVAL; 4891 } 4892 break; 4893 case FRI_LOOKUP : 4894 fp->fr_dstptr = ipf_findlookup(softc, unit, fp, 4895 &fp->fr_dst6, 4896 &fp->fr_dmsk6); 4897 if (fp->fr_dstfunc == NULL) { 4898 IPFERROR(134); 4899 error = ESRCH; 4900 } 4901 break; 4902 case FRI_NORMAL : 4903 break; 4904 default : 4905 IPFERROR(135); 4906 error = EINVAL; 4907 } 4908 break; 4909 4910 case FR_T_NONE : 4911 case FR_T_CALLFUNC : 4912 case FR_T_COMPIPF : 4913 break; 4914 4915 case FR_T_IPFEXPR : 4916 if (ipf_matcharray_verify(fp->fr_data, fp->fr_dsize) == -1) { 4917 IPFERROR(25); 4918 error = EINVAL; 4919 } 4920 break; 4921 4922 default : 4923 IPFERROR(26); 4924 error = EINVAL; 4925 break; 4926 } 4927 if (error != 0) 4928 goto donenolock; 4929 4930 if (fp->fr_tif.fd_name != -1) { 4931 if ((fp->fr_tif.fd_name < 0) || 4932 (fp->fr_tif.fd_name >= fp->fr_namelen)) { 4933 IPFERROR(139); 4934 error = EINVAL; 4935 goto donenolock; 4936 } 4937 } 4938 4939 if (fp->fr_dif.fd_name != -1) { 4940 if ((fp->fr_dif.fd_name < 0) || 4941 (fp->fr_dif.fd_name >= fp->fr_namelen)) { 4942 IPFERROR(140); 4943 error = EINVAL; 4944 goto donenolock; 4945 } 4946 } 4947 4948 if (fp->fr_rif.fd_name != -1) { 4949 if ((fp->fr_rif.fd_name < 0) || 4950 (fp->fr_rif.fd_name >= fp->fr_namelen)) { 4951 IPFERROR(141); 4952 error = EINVAL; 4953 goto donenolock; 4954 } 4955 } 4956 4957 /* 4958 * Lookup all the interface names that are part of the rule. 4959 */ 4960 error = ipf_synclist(softc, fp, NULL); 4961 if (error != 0) 4962 goto donenolock; 4963 fp->fr_statecnt = 0; 4964 if (fp->fr_srctrack.ht_max_nodes != 0) 4965 ipf_rb_ht_init(&fp->fr_srctrack); 4966 4967 /* 4968 * Look for an existing matching filter rule, but don't include the 4969 * next or interface pointer in the comparison (fr_next, fr_ifa). 4970 * This elminates rules which are indentical being loaded. Checksum 4971 * the constant part of the filter rule to make comparisons quicker 4972 * (this meaning no pointers are included). 4973 */ 4974 for (fp->fr_cksum = 0, p = (u_int *)&fp->fr_func, pp = &fp->fr_cksum; 4975 p < pp; p++) 4976 fp->fr_cksum += *p; 4977 pp = (u_int *)(fp->fr_caddr + fp->fr_dsize); 4978 for (p = (u_int *)fp->fr_data; p < pp; p++) 4979 fp->fr_cksum += *p; 4980 4981 WRITE_ENTER(&softc->ipf_mutex); 4982 4983 /* 4984 * Now that the filter rule lists are locked, we can walk the 4985 * chain of them without fear. 4986 */ 4987 ftail = fprev; 4988 for (f = *ftail; (f = *ftail) != NULL; ftail = &f->fr_next) { 4989 if (fp->fr_collect <= f->fr_collect) { 4990 ftail = fprev; 4991 f = NULL; 4992 break; 4993 } 4994 fprev = ftail; 4995 } 4996 4997 for (; (f = *ftail) != NULL; ftail = &f->fr_next) { 4998 if (ipf_rule_compare(fp, f) == 0) 4999 break; 5000 } 5001 5002 /* 5003 * If zero'ing statistics, copy current to caller and zero. 5004 */ 5005 if (addrem == 2) { 5006 if (f == NULL) { 5007 IPFERROR(27); 5008 error = ESRCH; 5009 } else { 5010 /* 5011 * Copy and reduce lock because of impending copyout. 5012 * Well we should, but if we do then the atomicity of 5013 * this call and the correctness of fr_hits and 5014 * fr_bytes cannot be guaranteed. As it is, this code 5015 * only resets them to 0 if they are successfully 5016 * copied out into user space. 5017 */ 5018 bcopy((char *)f, (char *)fp, f->fr_size); 5019 /* MUTEX_DOWNGRADE(&softc->ipf_mutex); */ 5020 5021 /* 5022 * When we copy this rule back out, set the data 5023 * pointer to be what it was in user space. 5024 */ 5025 fp->fr_data = uptr; 5026 error = ipf_outobj(softc, data, fp, IPFOBJ_FRENTRY); 5027 5028 if (error == 0) { 5029 if ((f->fr_dsize != 0) && (uptr != NULL)) 5030 error = COPYOUT(f->fr_data, uptr, 5031 f->fr_dsize); 5032 if (error != 0) { 5033 IPFERROR(28); 5034 error = EFAULT; 5035 } 5036 if (error == 0) { 5037 f->fr_hits = 0; 5038 f->fr_bytes = 0; 5039 } 5040 } 5041 } 5042 5043 if (makecopy != 0) { 5044 if (ptr != NULL) { 5045 KFREES(ptr, fp->fr_dsize); 5046 } 5047 KFREES(fp, fp->fr_size); 5048 } 5049 RWLOCK_EXIT(&softc->ipf_mutex); 5050 return error; 5051 } 5052 5053 if (!f) { 5054 /* 5055 * At the end of this, ftail must point to the place where the 5056 * new rule is to be saved/inserted/added. 5057 * For SIOCAD*FR, this should be the last rule in the group of 5058 * rules that have equal fr_collect fields. 5059 * For SIOCIN*FR, ... 5060 */ 5061 if (req == (ioctlcmd_t)SIOCADAFR || 5062 req == (ioctlcmd_t)SIOCADIFR) { 5063 5064 for (ftail = fprev; (f = *ftail) != NULL; ) { 5065 if (f->fr_collect > fp->fr_collect) 5066 break; 5067 ftail = &f->fr_next; 5068 fprev = ftail; 5069 } 5070 ftail = fprev; 5071 f = NULL; 5072 ptr = NULL; 5073 } else if (req == (ioctlcmd_t)SIOCINAFR || 5074 req == (ioctlcmd_t)SIOCINIFR) { 5075 while ((f = *fprev) != NULL) { 5076 if (f->fr_collect >= fp->fr_collect) 5077 break; 5078 fprev = &f->fr_next; 5079 } 5080 ftail = fprev; 5081 if (fp->fr_hits != 0) { 5082 while (fp->fr_hits && (f = *ftail)) { 5083 if (f->fr_collect != fp->fr_collect) 5084 break; 5085 fprev = ftail; 5086 ftail = &f->fr_next; 5087 fp->fr_hits--; 5088 } 5089 } 5090 f = NULL; 5091 ptr = NULL; 5092 } 5093 } 5094 5095 /* 5096 * Request to remove a rule. 5097 */ 5098 if (addrem == 1) { 5099 if (!f) { 5100 IPFERROR(29); 5101 error = ESRCH; 5102 } else { 5103 /* 5104 * Do not allow activity from user space to interfere 5105 * with rules not loaded that way. 5106 */ 5107 if ((makecopy == 1) && !(f->fr_flags & FR_COPIED)) { 5108 IPFERROR(30); 5109 error = EPERM; 5110 goto done; 5111 } 5112 5113 /* 5114 * Return EBUSY if the rule is being reference by 5115 * something else (eg state information.) 5116 */ 5117 if (f->fr_ref > 1) { 5118 IPFERROR(31); 5119 error = EBUSY; 5120 goto done; 5121 } 5122#ifdef IPFILTER_SCAN 5123 if (f->fr_isctag != -1 && 5124 (f->fr_isc != (struct ipscan *)-1)) 5125 ipf_scan_detachfr(f); 5126#endif 5127 5128 if (unit == IPL_LOGAUTH) { 5129 error = ipf_auth_precmd(softc, req, f, ftail); 5130 goto done; 5131 } 5132 5133 ipf_rule_delete(softc, f, unit, set); 5134 5135 need_free = makecopy; 5136 } 5137 } else { 5138 /* 5139 * Not removing, so we must be adding/inserting a rule. 5140 */ 5141 if (f != NULL) { 5142 IPFERROR(32); 5143 error = EEXIST; 5144 goto done; 5145 } 5146 if (unit == IPL_LOGAUTH) { 5147 error = ipf_auth_precmd(softc, req, fp, ftail); 5148 goto done; 5149 } 5150 5151 MUTEX_NUKE(&fp->fr_lock); 5152 MUTEX_INIT(&fp->fr_lock, "filter rule lock"); 5153 if (fp->fr_die != 0) 5154 ipf_rule_expire_insert(softc, fp, set); 5155 5156 fp->fr_hits = 0; 5157 if (makecopy != 0) 5158 fp->fr_ref = 1; 5159 fp->fr_pnext = ftail; 5160 fp->fr_next = *ftail; 5161 if (fp->fr_next != NULL) 5162 fp->fr_next->fr_pnext = &fp->fr_next; 5163 *ftail = fp; 5164 if (addrem == 0) 5165 ipf_fixskip(ftail, fp, 1); 5166 5167 fp->fr_icmpgrp = NULL; 5168 if (fp->fr_icmphead != -1) { 5169 group = FR_NAME(fp, fr_icmphead); 5170 fg = ipf_group_add(softc, group, fp, 0, unit, set); 5171 fp->fr_icmpgrp = fg; 5172 } 5173 5174 fp->fr_grphead = NULL; 5175 if (fp->fr_grhead != -1) { 5176 group = FR_NAME(fp, fr_grhead); 5177 fg = ipf_group_add(softc, group, fp, fp->fr_flags, 5178 unit, set); 5179 fp->fr_grphead = fg; 5180 } 5181 } 5182done: 5183 RWLOCK_EXIT(&softc->ipf_mutex); 5184donenolock: 5185 if (need_free || (error != 0)) { 5186 if ((fp->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) { 5187 if ((fp->fr_satype == FRI_LOOKUP) && 5188 (fp->fr_srcptr != NULL)) 5189 ipf_lookup_deref(softc, fp->fr_srctype, 5190 fp->fr_srcptr); 5191 if ((fp->fr_datype == FRI_LOOKUP) && 5192 (fp->fr_dstptr != NULL)) 5193 ipf_lookup_deref(softc, fp->fr_dsttype, 5194 fp->fr_dstptr); 5195 } 5196 if (fp->fr_grp != NULL) { 5197 WRITE_ENTER(&softc->ipf_mutex); 5198 ipf_group_del(softc, fp->fr_grp, fp); 5199 RWLOCK_EXIT(&softc->ipf_mutex); 5200 } 5201 if ((ptr != NULL) && (makecopy != 0)) { 5202 KFREES(ptr, fp->fr_dsize); 5203 } 5204 KFREES(fp, fp->fr_size); 5205 } 5206 return (error); 5207} 5208 5209 5210/* ------------------------------------------------------------------------ */ 5211/* Function: ipf_rule_delete */ 5212/* Returns: Nil */ 5213/* Parameters: softc(I) - pointer to soft context main structure */ 5214/* f(I) - pointer to the rule being deleted */ 5215/* ftail(I) - pointer to the pointer to f */ 5216/* unit(I) - device for which this is for */ 5217/* set(I) - 1 or 0 (filter set) */ 5218/* */ 5219/* This function attempts to do what it can to delete a filter rule: remove */ 5220/* it from any linked lists and remove any groups it is responsible for. */ 5221/* But in the end, removing a rule can only drop the reference count - we */ 5222/* must use that as the guide for whether or not it can be freed. */ 5223/* ------------------------------------------------------------------------ */ 5224static void 5225ipf_rule_delete(softc, f, unit, set) 5226 ipf_main_softc_t *softc; 5227 frentry_t *f; 5228 int unit, set; 5229{ 5230 5231 /* 5232 * If fr_pdnext is set, then the rule is on the expire list, so 5233 * remove it from there. 5234 */ 5235 if (f->fr_pdnext != NULL) { 5236 *f->fr_pdnext = f->fr_dnext; 5237 if (f->fr_dnext != NULL) 5238 f->fr_dnext->fr_pdnext = f->fr_pdnext; 5239 f->fr_pdnext = NULL; 5240 f->fr_dnext = NULL; 5241 } 5242 5243 ipf_fixskip(f->fr_pnext, f, -1); 5244 if (f->fr_pnext != NULL) 5245 *f->fr_pnext = f->fr_next; 5246 if (f->fr_next != NULL) 5247 f->fr_next->fr_pnext = f->fr_pnext; 5248 f->fr_pnext = NULL; 5249 f->fr_next = NULL; 5250 5251 (void) ipf_derefrule(softc, &f); 5252} 5253 5254/* ------------------------------------------------------------------------ */ 5255/* Function: ipf_rule_expire_insert */ 5256/* Returns: Nil */ 5257/* Parameters: softc(I) - pointer to soft context main structure */ 5258/* f(I) - pointer to rule to be added to expire list */ 5259/* set(I) - 1 or 0 (filter set) */ 5260/* */ 5261/* If the new rule has a given expiration time, insert it into the list of */ 5262/* expiring rules with the ones to be removed first added to the front of */ 5263/* the list. The insertion is O(n) but it is kept sorted for quick scans at */ 5264/* expiration interval checks. */ 5265/* ------------------------------------------------------------------------ */ 5266static void 5267ipf_rule_expire_insert(softc, f, set) 5268 ipf_main_softc_t *softc; 5269 frentry_t *f; 5270 int set; 5271{ 5272 frentry_t *fr; 5273 5274 /* 5275 */ 5276 5277 f->fr_die = softc->ipf_ticks + IPF_TTLVAL(f->fr_die); 5278 for (fr = softc->ipf_rule_explist[set]; fr != NULL; 5279 fr = fr->fr_dnext) { 5280 if (f->fr_die < fr->fr_die) 5281 break; 5282 if (fr->fr_dnext == NULL) { 5283 /* 5284 * We've got to the last rule and everything 5285 * wanted to be expired before this new node, 5286 * so we have to tack it on the end... 5287 */ 5288 fr->fr_dnext = f; 5289 f->fr_pdnext = &fr->fr_dnext; 5290 fr = NULL; 5291 break; 5292 } 5293 } 5294 5295 if (softc->ipf_rule_explist[set] == NULL) { 5296 softc->ipf_rule_explist[set] = f; 5297 f->fr_pdnext = &softc->ipf_rule_explist[set]; 5298 } else if (fr != NULL) { 5299 f->fr_dnext = fr; 5300 f->fr_pdnext = fr->fr_pdnext; 5301 fr->fr_pdnext = &f->fr_dnext; 5302 } 5303} 5304 5305 5306/* ------------------------------------------------------------------------ */ 5307/* Function: ipf_findlookup */ 5308/* Returns: NULL = failure, else success */ 5309/* Parameters: softc(I) - pointer to soft context main structure */ 5310/* unit(I) - ipf device we want to find match for */ 5311/* fp(I) - rule for which lookup is for */ 5312/* addrp(I) - pointer to lookup information in address struct */ 5313/* maskp(O) - pointer to lookup information for storage */ 5314/* */ 5315/* When using pools and hash tables to store addresses for matching in */ 5316/* rules, it is necessary to resolve both the object referred to by the */ 5317/* name or address (and return that pointer) and also provide the means by */ 5318/* which to determine if an address belongs to that object to make the */ 5319/* packet matching quicker. */ 5320/* ------------------------------------------------------------------------ */ 5321static void * 5322ipf_findlookup(softc, unit, fr, addrp, maskp) 5323 ipf_main_softc_t *softc; 5324 int unit; 5325 frentry_t *fr; 5326 i6addr_t *addrp, *maskp; 5327{ 5328 void *ptr = NULL; 5329 5330 switch (addrp->iplookupsubtype) 5331 { 5332 case 0 : 5333 ptr = ipf_lookup_res_num(softc, unit, addrp->iplookuptype, 5334 addrp->iplookupnum, 5335 &maskp->iplookupfunc); 5336 break; 5337 case 1 : 5338 if (addrp->iplookupname < 0) 5339 break; 5340 if (addrp->iplookupname >= fr->fr_namelen) 5341 break; 5342 ptr = ipf_lookup_res_name(softc, unit, addrp->iplookuptype, 5343 fr->fr_names + addrp->iplookupname, 5344 &maskp->iplookupfunc); 5345 break; 5346 default : 5347 break; 5348 } 5349 5350 return ptr; 5351} 5352 5353 5354/* ------------------------------------------------------------------------ */ 5355/* Function: ipf_funcinit */ 5356/* Returns: int - 0 == success, else ESRCH: cannot resolve rule details */ 5357/* Parameters: softc(I) - pointer to soft context main structure */ 5358/* fr(I) - pointer to filter rule */ 5359/* */ 5360/* If a rule is a call rule, then check if the function it points to needs */ 5361/* an init function to be called now the rule has been loaded. */ 5362/* ------------------------------------------------------------------------ */ 5363static int 5364ipf_funcinit(softc, fr) 5365 ipf_main_softc_t *softc; 5366 frentry_t *fr; 5367{ 5368 ipfunc_resolve_t *ft; 5369 int err; 5370 5371 IPFERROR(34); 5372 err = ESRCH; 5373 5374 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5375 if (ft->ipfu_addr == fr->fr_func) { 5376 err = 0; 5377 if (ft->ipfu_init != NULL) 5378 err = (*ft->ipfu_init)(softc, fr); 5379 break; 5380 } 5381 return err; 5382} 5383 5384 5385/* ------------------------------------------------------------------------ */ 5386/* Function: ipf_funcfini */ 5387/* Returns: Nil */ 5388/* Parameters: softc(I) - pointer to soft context main structure */ 5389/* fr(I) - pointer to filter rule */ 5390/* */ 5391/* For a given filter rule, call the matching "fini" function if the rule */ 5392/* is using a known function that would have resulted in the "init" being */ 5393/* called for ealier. */ 5394/* ------------------------------------------------------------------------ */ 5395static void 5396ipf_funcfini(softc, fr) 5397 ipf_main_softc_t *softc; 5398 frentry_t *fr; 5399{ 5400 ipfunc_resolve_t *ft; 5401 5402 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5403 if (ft->ipfu_addr == fr->fr_func) { 5404 if (ft->ipfu_fini != NULL) 5405 (void) (*ft->ipfu_fini)(softc, fr); 5406 break; 5407 } 5408} 5409 5410 5411/* ------------------------------------------------------------------------ */ 5412/* Function: ipf_findfunc */ 5413/* Returns: ipfunc_t - pointer to function if found, else NULL */ 5414/* Parameters: funcptr(I) - function pointer to lookup */ 5415/* */ 5416/* Look for a function in the table of known functions. */ 5417/* ------------------------------------------------------------------------ */ 5418static ipfunc_t 5419ipf_findfunc(funcptr) 5420 ipfunc_t funcptr; 5421{ 5422 ipfunc_resolve_t *ft; 5423 5424 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5425 if (ft->ipfu_addr == funcptr) 5426 return funcptr; 5427 return NULL; 5428} 5429 5430 5431/* ------------------------------------------------------------------------ */ 5432/* Function: ipf_resolvefunc */ 5433/* Returns: int - 0 == success, else error */ 5434/* Parameters: data(IO) - ioctl data pointer to ipfunc_resolve_t struct */ 5435/* */ 5436/* Copy in a ipfunc_resolve_t structure and then fill in the missing field. */ 5437/* This will either be the function name (if the pointer is set) or the */ 5438/* function pointer if the name is set. When found, fill in the other one */ 5439/* so that the entire, complete, structure can be copied back to user space.*/ 5440/* ------------------------------------------------------------------------ */ 5441int 5442ipf_resolvefunc(softc, data) 5443 ipf_main_softc_t *softc; 5444 void *data; 5445{ 5446 ipfunc_resolve_t res, *ft; 5447 int error; 5448 5449 error = BCOPYIN(data, &res, sizeof(res)); 5450 if (error != 0) { 5451 IPFERROR(123); 5452 return EFAULT; 5453 } 5454 5455 if (res.ipfu_addr == NULL && res.ipfu_name[0] != '\0') { 5456 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5457 if (strncmp(res.ipfu_name, ft->ipfu_name, 5458 sizeof(res.ipfu_name)) == 0) { 5459 res.ipfu_addr = ft->ipfu_addr; 5460 res.ipfu_init = ft->ipfu_init; 5461 if (COPYOUT(&res, data, sizeof(res)) != 0) { 5462 IPFERROR(35); 5463 return EFAULT; 5464 } 5465 return 0; 5466 } 5467 } 5468 if (res.ipfu_addr != NULL && res.ipfu_name[0] == '\0') { 5469 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5470 if (ft->ipfu_addr == res.ipfu_addr) { 5471 (void) strncpy(res.ipfu_name, ft->ipfu_name, 5472 sizeof(res.ipfu_name)); 5473 res.ipfu_init = ft->ipfu_init; 5474 if (COPYOUT(&res, data, sizeof(res)) != 0) { 5475 IPFERROR(36); 5476 return EFAULT; 5477 } 5478 return 0; 5479 } 5480 } 5481 IPFERROR(37); 5482 return ESRCH; 5483} 5484 5485 5486#if !defined(_KERNEL) || (!defined(__NetBSD__) && !defined(__OpenBSD__) && \ 5487 !defined(__FreeBSD__)) || \ 5488 FREEBSD_LT_REV(501000) || NETBSD_LT_REV(105000000) || \ 5489 OPENBSD_LT_REV(200006) 5490/* 5491 * From: NetBSD 5492 * ppsratecheck(): packets (or events) per second limitation. 5493 */ 5494int 5495ppsratecheck(lasttime, curpps, maxpps) 5496 struct timeval *lasttime; 5497 int *curpps; 5498 int maxpps; /* maximum pps allowed */ 5499{ 5500 struct timeval tv, delta; 5501 int rv; 5502 5503 GETKTIME(&tv); 5504 5505 delta.tv_sec = tv.tv_sec - lasttime->tv_sec; 5506 delta.tv_usec = tv.tv_usec - lasttime->tv_usec; 5507 if (delta.tv_usec < 0) { 5508 delta.tv_sec--; 5509 delta.tv_usec += 1000000; 5510 } 5511 5512 /* 5513 * check for 0,0 is so that the message will be seen at least once. 5514 * if more than one second have passed since the last update of 5515 * lasttime, reset the counter. 5516 * 5517 * we do increment *curpps even in *curpps < maxpps case, as some may 5518 * try to use *curpps for stat purposes as well. 5519 */ 5520 if ((lasttime->tv_sec == 0 && lasttime->tv_usec == 0) || 5521 delta.tv_sec >= 1) { 5522 *lasttime = tv; 5523 *curpps = 0; 5524 rv = 1; 5525 } else if (maxpps < 0) 5526 rv = 1; 5527 else if (*curpps < maxpps) 5528 rv = 1; 5529 else 5530 rv = 0; 5531 *curpps = *curpps + 1; 5532 5533 return (rv); 5534} 5535#endif 5536 5537 5538/* ------------------------------------------------------------------------ */ 5539/* Function: ipf_derefrule */ 5540/* Returns: int - 0 == rule freed up, else rule not freed */ 5541/* Parameters: fr(I) - pointer to filter rule */ 5542/* */ 5543/* Decrement the reference counter to a rule by one. If it reaches zero, */ 5544/* free it and any associated storage space being used by it. */ 5545/* ------------------------------------------------------------------------ */ 5546int 5547ipf_derefrule(softc, frp) 5548 ipf_main_softc_t *softc; 5549 frentry_t **frp; 5550{ 5551 frentry_t *fr; 5552 frdest_t *fdp; 5553 5554 fr = *frp; 5555 *frp = NULL; 5556 5557 MUTEX_ENTER(&fr->fr_lock); 5558 fr->fr_ref--; 5559 if (fr->fr_ref == 0) { 5560 MUTEX_EXIT(&fr->fr_lock); 5561 MUTEX_DESTROY(&fr->fr_lock); 5562 5563 ipf_funcfini(softc, fr); 5564 5565 fdp = &fr->fr_tif; 5566 if (fdp->fd_type == FRD_DSTLIST) 5567 ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr); 5568 5569 fdp = &fr->fr_rif; 5570 if (fdp->fd_type == FRD_DSTLIST) 5571 ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr); 5572 5573 fdp = &fr->fr_dif; 5574 if (fdp->fd_type == FRD_DSTLIST) 5575 ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr); 5576 5577 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF && 5578 fr->fr_satype == FRI_LOOKUP) 5579 ipf_lookup_deref(softc, fr->fr_srctype, fr->fr_srcptr); 5580 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF && 5581 fr->fr_datype == FRI_LOOKUP) 5582 ipf_lookup_deref(softc, fr->fr_dsttype, fr->fr_dstptr); 5583 5584 if (fr->fr_grp != NULL) 5585 ipf_group_del(softc, fr->fr_grp, fr); 5586 5587 if (fr->fr_grphead != NULL) 5588 ipf_group_del(softc, fr->fr_grphead, fr); 5589 5590 if (fr->fr_icmpgrp != NULL) 5591 ipf_group_del(softc, fr->fr_icmpgrp, fr); 5592 5593 if ((fr->fr_flags & FR_COPIED) != 0) { 5594 if (fr->fr_dsize) { 5595 KFREES(fr->fr_data, fr->fr_dsize); 5596 } 5597 KFREES(fr, fr->fr_size); 5598 return 0; 5599 } 5600 return 1; 5601 } else { 5602 MUTEX_EXIT(&fr->fr_lock); 5603 } 5604 return -1; 5605} 5606 5607 5608/* ------------------------------------------------------------------------ */ 5609/* Function: ipf_grpmapinit */ 5610/* Returns: int - 0 == success, else ESRCH because table entry not found*/ 5611/* Parameters: fr(I) - pointer to rule to find hash table for */ 5612/* */ 5613/* Looks for group hash table fr_arg and stores a pointer to it in fr_ptr. */ 5614/* fr_ptr is later used by ipf_srcgrpmap and ipf_dstgrpmap. */ 5615/* ------------------------------------------------------------------------ */ 5616static int 5617ipf_grpmapinit(softc, fr) 5618 ipf_main_softc_t *softc; 5619 frentry_t *fr; 5620{ 5621 char name[FR_GROUPLEN]; 5622 iphtable_t *iph; 5623 5624#if defined(SNPRINTF) && defined(_KERNEL) 5625 SNPRINTF(name, sizeof(name), "%d", fr->fr_arg); 5626#else 5627 (void) sprintf(name, "%d", fr->fr_arg); 5628#endif 5629 iph = ipf_lookup_find_htable(softc, IPL_LOGIPF, name); 5630 if (iph == NULL) { 5631 IPFERROR(38); 5632 return ESRCH; 5633 } 5634 if ((iph->iph_flags & FR_INOUT) != (fr->fr_flags & FR_INOUT)) { 5635 IPFERROR(39); 5636 return ESRCH; 5637 } 5638 iph->iph_ref++; 5639 fr->fr_ptr = iph; 5640 return 0; 5641} 5642 5643 5644/* ------------------------------------------------------------------------ */ 5645/* Function: ipf_grpmapfini */ 5646/* Returns: int - 0 == success, else ESRCH because table entry not found*/ 5647/* Parameters: softc(I) - pointer to soft context main structure */ 5648/* fr(I) - pointer to rule to release hash table for */ 5649/* */ 5650/* For rules that have had ipf_grpmapinit called, ipf_lookup_deref needs to */ 5651/* be called to undo what ipf_grpmapinit caused to be done. */ 5652/* ------------------------------------------------------------------------ */ 5653static int 5654ipf_grpmapfini(softc, fr) 5655 ipf_main_softc_t *softc; 5656 frentry_t *fr; 5657{ 5658 iphtable_t *iph; 5659 iph = fr->fr_ptr; 5660 if (iph != NULL) 5661 ipf_lookup_deref(softc, IPLT_HASH, iph); 5662 return 0; 5663} 5664 5665 5666/* ------------------------------------------------------------------------ */ 5667/* Function: ipf_srcgrpmap */ 5668/* Returns: frentry_t * - pointer to "new last matching" rule or NULL */ 5669/* Parameters: fin(I) - pointer to packet information */ 5670/* passp(IO) - pointer to current/new filter decision (unused) */ 5671/* */ 5672/* Look for a rule group head in a hash table, using the source address as */ 5673/* the key, and descend into that group and continue matching rules against */ 5674/* the packet. */ 5675/* ------------------------------------------------------------------------ */ 5676frentry_t * 5677ipf_srcgrpmap(fin, passp) 5678 fr_info_t *fin; 5679 u_32_t *passp; 5680{ 5681 frgroup_t *fg; 5682 void *rval; 5683 5684 rval = ipf_iphmfindgroup(fin->fin_main_soft, fin->fin_fr->fr_ptr, 5685 &fin->fin_src); 5686 if (rval == NULL) 5687 return NULL; 5688 5689 fg = rval; 5690 fin->fin_fr = fg->fg_start; 5691 (void) ipf_scanlist(fin, *passp); 5692 return fin->fin_fr; 5693} 5694 5695 5696/* ------------------------------------------------------------------------ */ 5697/* Function: ipf_dstgrpmap */ 5698/* Returns: frentry_t * - pointer to "new last matching" rule or NULL */ 5699/* Parameters: fin(I) - pointer to packet information */ 5700/* passp(IO) - pointer to current/new filter decision (unused) */ 5701/* */ 5702/* Look for a rule group head in a hash table, using the destination */ 5703/* address as the key, and descend into that group and continue matching */ 5704/* rules against the packet. */ 5705/* ------------------------------------------------------------------------ */ 5706frentry_t * 5707ipf_dstgrpmap(fin, passp) 5708 fr_info_t *fin; 5709 u_32_t *passp; 5710{ 5711 frgroup_t *fg; 5712 void *rval; 5713 5714 rval = ipf_iphmfindgroup(fin->fin_main_soft, fin->fin_fr->fr_ptr, 5715 &fin->fin_dst); 5716 if (rval == NULL) 5717 return NULL; 5718 5719 fg = rval; 5720 fin->fin_fr = fg->fg_start; 5721 (void) ipf_scanlist(fin, *passp); 5722 return fin->fin_fr; 5723} 5724 5725/* 5726 * Queue functions 5727 * =============== 5728 * These functions manage objects on queues for efficient timeouts. There 5729 * are a number of system defined queues as well as user defined timeouts. 5730 * It is expected that a lock is held in the domain in which the queue 5731 * belongs (i.e. either state or NAT) when calling any of these functions 5732 * that prevents ipf_freetimeoutqueue() from being called at the same time 5733 * as any other. 5734 */ 5735 5736 5737/* ------------------------------------------------------------------------ */ 5738/* Function: ipf_addtimeoutqueue */ 5739/* Returns: struct ifqtq * - NULL if malloc fails, else pointer to */ 5740/* timeout queue with given interval. */ 5741/* Parameters: parent(I) - pointer to pointer to parent node of this list */ 5742/* of interface queues. */ 5743/* seconds(I) - timeout value in seconds for this queue. */ 5744/* */ 5745/* This routine first looks for a timeout queue that matches the interval */ 5746/* being requested. If it finds one, increments the reference counter and */ 5747/* returns a pointer to it. If none are found, it allocates a new one and */ 5748/* inserts it at the top of the list. */ 5749/* */ 5750/* Locking. */ 5751/* It is assumed that the caller of this function has an appropriate lock */ 5752/* held (exclusively) in the domain that encompases 'parent'. */ 5753/* ------------------------------------------------------------------------ */ 5754ipftq_t * 5755ipf_addtimeoutqueue(softc, parent, seconds) 5756 ipf_main_softc_t *softc; 5757 ipftq_t **parent; 5758 u_int seconds; 5759{ 5760 ipftq_t *ifq; 5761 u_int period; 5762 5763 period = seconds * IPF_HZ_DIVIDE; 5764 5765 MUTEX_ENTER(&softc->ipf_timeoutlock); 5766 for (ifq = *parent; ifq != NULL; ifq = ifq->ifq_next) { 5767 if (ifq->ifq_ttl == period) { 5768 /* 5769 * Reset the delete flag, if set, so the structure 5770 * gets reused rather than freed and reallocated. 5771 */ 5772 MUTEX_ENTER(&ifq->ifq_lock); 5773 ifq->ifq_flags &= ~IFQF_DELETE; 5774 ifq->ifq_ref++; 5775 MUTEX_EXIT(&ifq->ifq_lock); 5776 MUTEX_EXIT(&softc->ipf_timeoutlock); 5777 5778 return ifq; 5779 } 5780 } 5781 5782 KMALLOC(ifq, ipftq_t *); 5783 if (ifq != NULL) { 5784 MUTEX_NUKE(&ifq->ifq_lock); 5785 IPFTQ_INIT(ifq, period, "ipftq mutex"); 5786 ifq->ifq_next = *parent; 5787 ifq->ifq_pnext = parent; 5788 ifq->ifq_flags = IFQF_USER; 5789 ifq->ifq_ref++; 5790 *parent = ifq; 5791 softc->ipf_userifqs++; 5792 } 5793 MUTEX_EXIT(&softc->ipf_timeoutlock); 5794 return ifq; 5795} 5796 5797 5798/* ------------------------------------------------------------------------ */ 5799/* Function: ipf_deletetimeoutqueue */ 5800/* Returns: int - new reference count value of the timeout queue */ 5801/* Parameters: ifq(I) - timeout queue which is losing a reference. */ 5802/* Locks: ifq->ifq_lock */ 5803/* */ 5804/* This routine must be called when we're discarding a pointer to a timeout */ 5805/* queue object, taking care of the reference counter. */ 5806/* */ 5807/* Now that this just sets a DELETE flag, it requires the expire code to */ 5808/* check the list of user defined timeout queues and call the free function */ 5809/* below (currently commented out) to stop memory leaking. It is done this */ 5810/* way because the locking may not be sufficient to safely do a free when */ 5811/* this function is called. */ 5812/* ------------------------------------------------------------------------ */ 5813int 5814ipf_deletetimeoutqueue(ifq) 5815 ipftq_t *ifq; 5816{ 5817 5818 ifq->ifq_ref--; 5819 if ((ifq->ifq_ref == 0) && ((ifq->ifq_flags & IFQF_USER) != 0)) { 5820 ifq->ifq_flags |= IFQF_DELETE; 5821 } 5822 5823 return ifq->ifq_ref; 5824} 5825 5826 5827/* ------------------------------------------------------------------------ */ 5828/* Function: ipf_freetimeoutqueue */ 5829/* Parameters: ifq(I) - timeout queue which is losing a reference. */ 5830/* Returns: Nil */ 5831/* */ 5832/* Locking: */ 5833/* It is assumed that the caller of this function has an appropriate lock */ 5834/* held (exclusively) in the domain that encompases the callers "domain". */ 5835/* The ifq_lock for this structure should not be held. */ 5836/* */ 5837/* Remove a user defined timeout queue from the list of queues it is in and */ 5838/* tidy up after this is done. */ 5839/* ------------------------------------------------------------------------ */ 5840void 5841ipf_freetimeoutqueue(softc, ifq) 5842 ipf_main_softc_t *softc; 5843 ipftq_t *ifq; 5844{ 5845 5846 if (((ifq->ifq_flags & IFQF_DELETE) == 0) || (ifq->ifq_ref != 0) || 5847 ((ifq->ifq_flags & IFQF_USER) == 0)) { 5848 printf("ipf_freetimeoutqueue(%lx) flags 0x%x ttl %d ref %d\n", 5849 (u_long)ifq, ifq->ifq_flags, ifq->ifq_ttl, 5850 ifq->ifq_ref); 5851 return; 5852 } 5853 5854 /* 5855 * Remove from its position in the list. 5856 */ 5857 *ifq->ifq_pnext = ifq->ifq_next; 5858 if (ifq->ifq_next != NULL) 5859 ifq->ifq_next->ifq_pnext = ifq->ifq_pnext; 5860 ifq->ifq_next = NULL; 5861 ifq->ifq_pnext = NULL; 5862 5863 MUTEX_DESTROY(&ifq->ifq_lock); 5864 ATOMIC_DEC(softc->ipf_userifqs); 5865 KFREE(ifq); 5866} 5867 5868 5869/* ------------------------------------------------------------------------ */ 5870/* Function: ipf_deletequeueentry */ 5871/* Returns: Nil */ 5872/* Parameters: tqe(I) - timeout queue entry to delete */ 5873/* */ 5874/* Remove a tail queue entry from its queue and make it an orphan. */ 5875/* ipf_deletetimeoutqueue is called to make sure the reference count on the */ 5876/* queue is correct. We can't, however, call ipf_freetimeoutqueue because */ 5877/* the correct lock(s) may not be held that would make it safe to do so. */ 5878/* ------------------------------------------------------------------------ */ 5879void 5880ipf_deletequeueentry(tqe) 5881 ipftqent_t *tqe; 5882{ 5883 ipftq_t *ifq; 5884 5885 ifq = tqe->tqe_ifq; 5886 5887 MUTEX_ENTER(&ifq->ifq_lock); 5888 5889 if (tqe->tqe_pnext != NULL) { 5890 *tqe->tqe_pnext = tqe->tqe_next; 5891 if (tqe->tqe_next != NULL) 5892 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5893 else /* we must be the tail anyway */ 5894 ifq->ifq_tail = tqe->tqe_pnext; 5895 5896 tqe->tqe_pnext = NULL; 5897 tqe->tqe_ifq = NULL; 5898 } 5899 5900 (void) ipf_deletetimeoutqueue(ifq); 5901 ASSERT(ifq->ifq_ref > 0); 5902 5903 MUTEX_EXIT(&ifq->ifq_lock); 5904} 5905 5906 5907/* ------------------------------------------------------------------------ */ 5908/* Function: ipf_queuefront */ 5909/* Returns: Nil */ 5910/* Parameters: tqe(I) - pointer to timeout queue entry */ 5911/* */ 5912/* Move a queue entry to the front of the queue, if it isn't already there. */ 5913/* ------------------------------------------------------------------------ */ 5914void 5915ipf_queuefront(tqe) 5916 ipftqent_t *tqe; 5917{ 5918 ipftq_t *ifq; 5919 5920 ifq = tqe->tqe_ifq; 5921 if (ifq == NULL) 5922 return; 5923 5924 MUTEX_ENTER(&ifq->ifq_lock); 5925 if (ifq->ifq_head != tqe) { 5926 *tqe->tqe_pnext = tqe->tqe_next; 5927 if (tqe->tqe_next) 5928 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5929 else 5930 ifq->ifq_tail = tqe->tqe_pnext; 5931 5932 tqe->tqe_next = ifq->ifq_head; 5933 ifq->ifq_head->tqe_pnext = &tqe->tqe_next; 5934 ifq->ifq_head = tqe; 5935 tqe->tqe_pnext = &ifq->ifq_head; 5936 } 5937 MUTEX_EXIT(&ifq->ifq_lock); 5938} 5939 5940 5941/* ------------------------------------------------------------------------ */ 5942/* Function: ipf_queueback */ 5943/* Returns: Nil */ 5944/* Parameters: ticks(I) - ipf tick time to use with this call */ 5945/* tqe(I) - pointer to timeout queue entry */ 5946/* */ 5947/* Move a queue entry to the back of the queue, if it isn't already there. */ 5948/* We use use ticks to calculate the expiration and mark for when we last */ 5949/* touched the structure. */ 5950/* ------------------------------------------------------------------------ */ 5951void 5952ipf_queueback(ticks, tqe) 5953 u_long ticks; 5954 ipftqent_t *tqe; 5955{ 5956 ipftq_t *ifq; 5957 5958 ifq = tqe->tqe_ifq; 5959 if (ifq == NULL) 5960 return; 5961 tqe->tqe_die = ticks + ifq->ifq_ttl; 5962 tqe->tqe_touched = ticks; 5963 5964 MUTEX_ENTER(&ifq->ifq_lock); 5965 if (tqe->tqe_next != NULL) { /* at the end already ? */ 5966 /* 5967 * Remove from list 5968 */ 5969 *tqe->tqe_pnext = tqe->tqe_next; 5970 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5971 5972 /* 5973 * Make it the last entry. 5974 */ 5975 tqe->tqe_next = NULL; 5976 tqe->tqe_pnext = ifq->ifq_tail; 5977 *ifq->ifq_tail = tqe; 5978 ifq->ifq_tail = &tqe->tqe_next; 5979 } 5980 MUTEX_EXIT(&ifq->ifq_lock); 5981} 5982 5983 5984/* ------------------------------------------------------------------------ */ 5985/* Function: ipf_queueappend */ 5986/* Returns: Nil */ 5987/* Parameters: ticks(I) - ipf tick time to use with this call */ 5988/* tqe(I) - pointer to timeout queue entry */ 5989/* ifq(I) - pointer to timeout queue */ 5990/* parent(I) - owing object pointer */ 5991/* */ 5992/* Add a new item to this queue and put it on the very end. */ 5993/* We use use ticks to calculate the expiration and mark for when we last */ 5994/* touched the structure. */ 5995/* ------------------------------------------------------------------------ */ 5996void 5997ipf_queueappend(ticks, tqe, ifq, parent) 5998 u_long ticks; 5999 ipftqent_t *tqe; 6000 ipftq_t *ifq; 6001 void *parent; 6002{ 6003 6004 MUTEX_ENTER(&ifq->ifq_lock); 6005 tqe->tqe_parent = parent; 6006 tqe->tqe_pnext = ifq->ifq_tail; 6007 *ifq->ifq_tail = tqe; 6008 ifq->ifq_tail = &tqe->tqe_next; 6009 tqe->tqe_next = NULL; 6010 tqe->tqe_ifq = ifq; 6011 tqe->tqe_die = ticks + ifq->ifq_ttl; 6012 tqe->tqe_touched = ticks; 6013 ifq->ifq_ref++; 6014 MUTEX_EXIT(&ifq->ifq_lock); 6015} 6016 6017 6018/* ------------------------------------------------------------------------ */ 6019/* Function: ipf_movequeue */ 6020/* Returns: Nil */ 6021/* Parameters: tq(I) - pointer to timeout queue information */ 6022/* oifp(I) - old timeout queue entry was on */ 6023/* nifp(I) - new timeout queue to put entry on */ 6024/* */ 6025/* Move a queue entry from one timeout queue to another timeout queue. */ 6026/* If it notices that the current entry is already last and does not need */ 6027/* to move queue, the return. */ 6028/* ------------------------------------------------------------------------ */ 6029void 6030ipf_movequeue(ticks, tqe, oifq, nifq) 6031 u_long ticks; 6032 ipftqent_t *tqe; 6033 ipftq_t *oifq, *nifq; 6034{ 6035 6036 /* 6037 * If the queue hasn't changed and we last touched this entry at the 6038 * same ipf time, then we're not going to achieve anything by either 6039 * changing the ttl or moving it on the queue. 6040 */ 6041 if (oifq == nifq && tqe->tqe_touched == ticks) 6042 return; 6043 6044 /* 6045 * For any of this to be outside the lock, there is a risk that two 6046 * packets entering simultaneously, with one changing to a different 6047 * queue and one not, could end up with things in a bizarre state. 6048 */ 6049 MUTEX_ENTER(&oifq->ifq_lock); 6050 6051 tqe->tqe_touched = ticks; 6052 tqe->tqe_die = ticks + nifq->ifq_ttl; 6053 /* 6054 * Is the operation here going to be a no-op ? 6055 */ 6056 if (oifq == nifq) { 6057 if ((tqe->tqe_next == NULL) || 6058 (tqe->tqe_next->tqe_die == tqe->tqe_die)) { 6059 MUTEX_EXIT(&oifq->ifq_lock); 6060 return; 6061 } 6062 } 6063 6064 /* 6065 * Remove from the old queue 6066 */ 6067 *tqe->tqe_pnext = tqe->tqe_next; 6068 if (tqe->tqe_next) 6069 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 6070 else 6071 oifq->ifq_tail = tqe->tqe_pnext; 6072 tqe->tqe_next = NULL; 6073 6074 /* 6075 * If we're moving from one queue to another, release the 6076 * lock on the old queue and get a lock on the new queue. 6077 * For user defined queues, if we're moving off it, call 6078 * delete in case it can now be freed. 6079 */ 6080 if (oifq != nifq) { 6081 tqe->tqe_ifq = NULL; 6082 6083 (void) ipf_deletetimeoutqueue(oifq); 6084 6085 MUTEX_EXIT(&oifq->ifq_lock); 6086 6087 MUTEX_ENTER(&nifq->ifq_lock); 6088 6089 tqe->tqe_ifq = nifq; 6090 nifq->ifq_ref++; 6091 } 6092 6093 /* 6094 * Add to the bottom of the new queue 6095 */ 6096 tqe->tqe_pnext = nifq->ifq_tail; 6097 *nifq->ifq_tail = tqe; 6098 nifq->ifq_tail = &tqe->tqe_next; 6099 MUTEX_EXIT(&nifq->ifq_lock); 6100} 6101 6102 6103/* ------------------------------------------------------------------------ */ 6104/* Function: ipf_updateipid */ 6105/* Returns: int - 0 == success, -1 == error (packet should be droppped) */ 6106/* Parameters: fin(I) - pointer to packet information */ 6107/* */ 6108/* When we are doing NAT, change the IP of every packet to represent a */ 6109/* single sequence of packets coming from the host, hiding any host */ 6110/* specific sequencing that might otherwise be revealed. If the packet is */ 6111/* a fragment, then store the 'new' IPid in the fragment cache and look up */ 6112/* the fragment cache for non-leading fragments. If a non-leading fragment */ 6113/* has no match in the cache, return an error. */ 6114/* ------------------------------------------------------------------------ */ 6115static int 6116ipf_updateipid(fin) 6117 fr_info_t *fin; 6118{ 6119 u_short id, ido, sums; 6120 u_32_t sumd, sum; 6121 ip_t *ip; 6122 6123 ip = fin->fin_ip; 6124 ido = ntohs(ip->ip_id); 6125 if (fin->fin_off != 0) { 6126 sum = ipf_frag_ipidknown(fin); 6127 if (sum == 0xffffffff) 6128 return -1; 6129 sum &= 0xffff; 6130 id = (u_short)sum; 6131 ip->ip_id = htons(id); 6132 } else { 6133 ip_fillid(ip); 6134 id = ntohs(ip->ip_id); 6135 if ((fin->fin_flx & FI_FRAG) != 0) 6136 (void) ipf_frag_ipidnew(fin, (u_32_t)id); 6137 } 6138 6139 if (id == ido) 6140 return 0; 6141 CALC_SUMD(ido, id, sumd); /* DESTRUCTIVE MACRO! id,ido change */ 6142 sum = (~ntohs(ip->ip_sum)) & 0xffff; 6143 sum += sumd; 6144 sum = (sum >> 16) + (sum & 0xffff); 6145 sum = (sum >> 16) + (sum & 0xffff); 6146 sums = ~(u_short)sum; 6147 ip->ip_sum = htons(sums); 6148 return 0; 6149} 6150 6151 6152#ifdef NEED_FRGETIFNAME 6153/* ------------------------------------------------------------------------ */ 6154/* Function: ipf_getifname */ 6155/* Returns: char * - pointer to interface name */ 6156/* Parameters: ifp(I) - pointer to network interface */ 6157/* buffer(O) - pointer to where to store interface name */ 6158/* */ 6159/* Constructs an interface name in the buffer passed. The buffer passed is */ 6160/* expected to be at least LIFNAMSIZ in bytes big. If buffer is passed in */ 6161/* as a NULL pointer then return a pointer to a static array. */ 6162/* ------------------------------------------------------------------------ */ 6163char * 6164ipf_getifname(ifp, buffer) 6165 struct ifnet *ifp; 6166 char *buffer; 6167{ 6168 static char namebuf[LIFNAMSIZ]; 6169# if defined(MENTAT) || defined(__FreeBSD__) || defined(__osf__) || \ 6170 defined(__sgi) || defined(linux) || defined(_AIX51) || \ 6171 (defined(sun) && !defined(__SVR4) && !defined(__svr4__)) 6172 int unit, space; 6173 char temp[20]; 6174 char *s; 6175# endif 6176 6177 if (buffer == NULL) 6178 buffer = namebuf; 6179 (void) strncpy(buffer, ifp->if_name, LIFNAMSIZ); 6180 buffer[LIFNAMSIZ - 1] = '\0'; 6181# if defined(MENTAT) || defined(__FreeBSD__) || defined(__osf__) || \ 6182 defined(__sgi) || defined(_AIX51) || \ 6183 (defined(sun) && !defined(__SVR4) && !defined(__svr4__)) 6184 for (s = buffer; *s; s++) 6185 ; 6186 unit = ifp->if_unit; 6187 space = LIFNAMSIZ - (s - buffer); 6188 if ((space > 0) && (unit >= 0)) { 6189# if defined(SNPRINTF) && defined(_KERNEL) 6190 SNPRINTF(temp, sizeof(temp), "%d", unit); 6191# else 6192 (void) sprintf(temp, "%d", unit); 6193# endif 6194 (void) strncpy(s, temp, space); 6195 } 6196# endif 6197 return buffer; 6198} 6199#endif 6200 6201 6202/* ------------------------------------------------------------------------ */ 6203/* Function: ipf_ioctlswitch */ 6204/* Returns: int - -1 continue processing, else ioctl return value */ 6205/* Parameters: unit(I) - device unit opened */ 6206/* data(I) - pointer to ioctl data */ 6207/* cmd(I) - ioctl command */ 6208/* mode(I) - mode value */ 6209/* uid(I) - uid making the ioctl call */ 6210/* ctx(I) - pointer to context data */ 6211/* */ 6212/* Based on the value of unit, call the appropriate ioctl handler or return */ 6213/* EIO if ipfilter is not running. Also checks if write perms are req'd */ 6214/* for the device in order to execute the ioctl. A special case is made */ 6215/* SIOCIPFINTERROR so that the same code isn't required in every handler. */ 6216/* The context data pointer is passed through as this is used as the key */ 6217/* for locating a matching token for continued access for walking lists, */ 6218/* etc. */ 6219/* ------------------------------------------------------------------------ */ 6220int 6221ipf_ioctlswitch(softc, unit, data, cmd, mode, uid, ctx) 6222 ipf_main_softc_t *softc; 6223 int unit, mode, uid; 6224 ioctlcmd_t cmd; 6225 void *data, *ctx; 6226{ 6227 int error = 0; 6228 6229 switch (cmd) 6230 { 6231 case SIOCIPFINTERROR : 6232 error = BCOPYOUT(&softc->ipf_interror, data, 6233 sizeof(softc->ipf_interror)); 6234 if (error != 0) { 6235 IPFERROR(40); 6236 error = EFAULT; 6237 } 6238 return error; 6239 default : 6240 break; 6241 } 6242 6243 switch (unit) 6244 { 6245 case IPL_LOGIPF : 6246 error = ipf_ipf_ioctl(softc, data, cmd, mode, uid, ctx); 6247 break; 6248 case IPL_LOGNAT : 6249 if (softc->ipf_running > 0) { 6250 error = ipf_nat_ioctl(softc, data, cmd, mode, 6251 uid, ctx); 6252 } else { 6253 IPFERROR(42); 6254 error = EIO; 6255 } 6256 break; 6257 case IPL_LOGSTATE : 6258 if (softc->ipf_running > 0) { 6259 error = ipf_state_ioctl(softc, data, cmd, mode, 6260 uid, ctx); 6261 } else { 6262 IPFERROR(43); 6263 error = EIO; 6264 } 6265 break; 6266 case IPL_LOGAUTH : 6267 if (softc->ipf_running > 0) { 6268 error = ipf_auth_ioctl(softc, data, cmd, mode, 6269 uid, ctx); 6270 } else { 6271 IPFERROR(44); 6272 error = EIO; 6273 } 6274 break; 6275 case IPL_LOGSYNC : 6276 if (softc->ipf_running > 0) { 6277 error = ipf_sync_ioctl(softc, data, cmd, mode, 6278 uid, ctx); 6279 } else { 6280 error = EIO; 6281 IPFERROR(45); 6282 } 6283 break; 6284 case IPL_LOGSCAN : 6285#ifdef IPFILTER_SCAN 6286 if (softc->ipf_running > 0) 6287 error = ipf_scan_ioctl(softc, data, cmd, mode, 6288 uid, ctx); 6289 else 6290#endif 6291 { 6292 error = EIO; 6293 IPFERROR(46); 6294 } 6295 break; 6296 case IPL_LOGLOOKUP : 6297 if (softc->ipf_running > 0) { 6298 error = ipf_lookup_ioctl(softc, data, cmd, mode, 6299 uid, ctx); 6300 } else { 6301 error = EIO; 6302 IPFERROR(47); 6303 } 6304 break; 6305 default : 6306 IPFERROR(48); 6307 error = EIO; 6308 break; 6309 } 6310 6311 return error; 6312} 6313 6314 6315/* 6316 * This array defines the expected size of objects coming into the kernel 6317 * for the various recognised object types. The first column is flags (see 6318 * below), 2nd column is current size, 3rd column is the version number of 6319 * when the current size became current. 6320 * Flags: 6321 * 1 = minimum size, not absolute size 6322 */ 6323static int ipf_objbytes[IPFOBJ_COUNT][3] = { 6324 { 1, sizeof(struct frentry), 5010000 }, /* 0 */ 6325 { 1, sizeof(struct friostat), 5010000 }, 6326 { 0, sizeof(struct fr_info), 5010000 }, 6327 { 0, sizeof(struct ipf_authstat), 4010100 }, 6328 { 0, sizeof(struct ipfrstat), 5010000 }, 6329 { 1, sizeof(struct ipnat), 5010000 }, /* 5 */ 6330 { 0, sizeof(struct natstat), 5010000 }, 6331 { 0, sizeof(struct ipstate_save), 5010000 }, 6332 { 1, sizeof(struct nat_save), 5010000 }, 6333 { 0, sizeof(struct natlookup), 5010000 }, 6334 { 1, sizeof(struct ipstate), 5010000 }, /* 10 */ 6335 { 0, sizeof(struct ips_stat), 5010000 }, 6336 { 0, sizeof(struct frauth), 5010000 }, 6337 { 0, sizeof(struct ipftune), 4010100 }, 6338 { 0, sizeof(struct nat), 5010000 }, 6339 { 0, sizeof(struct ipfruleiter), 4011400 }, /* 15 */ 6340 { 0, sizeof(struct ipfgeniter), 4011400 }, 6341 { 0, sizeof(struct ipftable), 4011400 }, 6342 { 0, sizeof(struct ipflookupiter), 4011400 }, 6343 { 0, sizeof(struct ipftq) * IPF_TCP_NSTATES }, 6344 { 1, 0, 0 }, /* IPFEXPR */ 6345 { 0, 0, 0 }, /* PROXYCTL */ 6346 { 0, sizeof (struct fripf), 5010000 } 6347}; 6348 6349 6350/* ------------------------------------------------------------------------ */ 6351/* Function: ipf_inobj */ 6352/* Returns: int - 0 = success, else failure */ 6353/* Parameters: softc(I) - soft context pointerto work with */ 6354/* data(I) - pointer to ioctl data */ 6355/* objp(O) - where to store ipfobj structure */ 6356/* ptr(I) - pointer to data to copy out */ 6357/* type(I) - type of structure being moved */ 6358/* */ 6359/* Copy in the contents of what the ipfobj_t points to. In future, we */ 6360/* add things to check for version numbers, sizes, etc, to make it backward */ 6361/* compatible at the ABI for user land. */ 6362/* If objp is not NULL then we assume that the caller wants to see what is */ 6363/* in the ipfobj_t structure being copied in. As an example, this can tell */ 6364/* the caller what version of ipfilter the ioctl program was written to. */ 6365/* ------------------------------------------------------------------------ */ 6366int 6367ipf_inobj(softc, data, objp, ptr, type) 6368 ipf_main_softc_t *softc; 6369 void *data; 6370 ipfobj_t *objp; 6371 void *ptr; 6372 int type; 6373{ 6374 ipfobj_t obj; 6375 int error; 6376 int size; 6377 6378 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6379 IPFERROR(49); 6380 return EINVAL; 6381 } 6382 6383 if (objp == NULL) 6384 objp = &obj; 6385 error = BCOPYIN(data, objp, sizeof(*objp)); 6386 if (error != 0) { 6387 IPFERROR(124); 6388 return EFAULT; 6389 } 6390 6391 if (objp->ipfo_type != type) { 6392 IPFERROR(50); 6393 return EINVAL; 6394 } 6395 6396 if (objp->ipfo_rev >= ipf_objbytes[type][2]) { 6397 if ((ipf_objbytes[type][0] & 1) != 0) { 6398 if (objp->ipfo_size < ipf_objbytes[type][1]) { 6399 IPFERROR(51); 6400 return EINVAL; 6401 } 6402 size = ipf_objbytes[type][1]; 6403 } else if (objp->ipfo_size == ipf_objbytes[type][1]) { 6404 size = objp->ipfo_size; 6405 } else { 6406 IPFERROR(52); 6407 return EINVAL; 6408 } 6409 error = COPYIN(objp->ipfo_ptr, ptr, size); 6410 if (error != 0) { 6411 IPFERROR(55); 6412 error = EFAULT; 6413 } 6414 } else { 6415#ifdef IPFILTER_COMPAT 6416 error = ipf_in_compat(softc, objp, ptr, 0); 6417#else 6418 IPFERROR(54); 6419 error = EINVAL; 6420#endif 6421 } 6422 return error; 6423} 6424 6425 6426/* ------------------------------------------------------------------------ */ 6427/* Function: ipf_inobjsz */ 6428/* Returns: int - 0 = success, else failure */ 6429/* Parameters: softc(I) - soft context pointerto work with */ 6430/* data(I) - pointer to ioctl data */ 6431/* ptr(I) - pointer to store real data in */ 6432/* type(I) - type of structure being moved */ 6433/* sz(I) - size of data to copy */ 6434/* */ 6435/* As per ipf_inobj, except the size of the object to copy in is passed in */ 6436/* but it must not be smaller than the size defined for the type and the */ 6437/* type must allow for varied sized objects. The extra requirement here is */ 6438/* that sz must match the size of the object being passed in - this is not */ 6439/* not possible nor required in ipf_inobj(). */ 6440/* ------------------------------------------------------------------------ */ 6441int 6442ipf_inobjsz(softc, data, ptr, type, sz) 6443 ipf_main_softc_t *softc; 6444 void *data; 6445 void *ptr; 6446 int type, sz; 6447{ 6448 ipfobj_t obj; 6449 int error; 6450 6451 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6452 IPFERROR(56); 6453 return EINVAL; 6454 } 6455 6456 error = BCOPYIN(data, &obj, sizeof(obj)); 6457 if (error != 0) { 6458 IPFERROR(125); 6459 return EFAULT; 6460 } 6461 6462 if (obj.ipfo_type != type) { 6463 IPFERROR(58); 6464 return EINVAL; 6465 } 6466 6467 if (obj.ipfo_rev >= ipf_objbytes[type][2]) { 6468 if (((ipf_objbytes[type][0] & 1) == 0) || 6469 (sz < ipf_objbytes[type][1])) { 6470 IPFERROR(57); 6471 return EINVAL; 6472 } 6473 error = COPYIN(obj.ipfo_ptr, ptr, sz); 6474 if (error != 0) { 6475 IPFERROR(61); 6476 error = EFAULT; 6477 } 6478 } else { 6479#ifdef IPFILTER_COMPAT 6480 error = ipf_in_compat(softc, &obj, ptr, sz); 6481#else 6482 IPFERROR(60); 6483 error = EINVAL; 6484#endif 6485 } 6486 return error; 6487} 6488 6489 6490/* ------------------------------------------------------------------------ */ 6491/* Function: ipf_outobjsz */ 6492/* Returns: int - 0 = success, else failure */ 6493/* Parameters: data(I) - pointer to ioctl data */ 6494/* ptr(I) - pointer to store real data in */ 6495/* type(I) - type of structure being moved */ 6496/* sz(I) - size of data to copy */ 6497/* */ 6498/* As per ipf_outobj, except the size of the object to copy out is passed in*/ 6499/* but it must not be smaller than the size defined for the type and the */ 6500/* type must allow for varied sized objects. The extra requirement here is */ 6501/* that sz must match the size of the object being passed in - this is not */ 6502/* not possible nor required in ipf_outobj(). */ 6503/* ------------------------------------------------------------------------ */ 6504int 6505ipf_outobjsz(softc, data, ptr, type, sz) 6506 ipf_main_softc_t *softc; 6507 void *data; 6508 void *ptr; 6509 int type, sz; 6510{ 6511 ipfobj_t obj; 6512 int error; 6513 6514 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6515 IPFERROR(62); 6516 return EINVAL; 6517 } 6518 6519 error = BCOPYIN(data, &obj, sizeof(obj)); 6520 if (error != 0) { 6521 IPFERROR(127); 6522 return EFAULT; 6523 } 6524 6525 if (obj.ipfo_type != type) { 6526 IPFERROR(63); 6527 return EINVAL; 6528 } 6529 6530 if (obj.ipfo_rev >= ipf_objbytes[type][2]) { 6531 if (((ipf_objbytes[type][0] & 1) == 0) || 6532 (sz < ipf_objbytes[type][1])) { 6533 IPFERROR(146); 6534 return EINVAL; 6535 } 6536 error = COPYOUT(ptr, obj.ipfo_ptr, sz); 6537 if (error != 0) { 6538 IPFERROR(66); 6539 error = EFAULT; 6540 } 6541 } else { 6542#ifdef IPFILTER_COMPAT 6543 error = ipf_out_compat(softc, &obj, ptr); 6544#else 6545 IPFERROR(65); 6546 error = EINVAL; 6547#endif 6548 } 6549 return error; 6550} 6551 6552 6553/* ------------------------------------------------------------------------ */ 6554/* Function: ipf_outobj */ 6555/* Returns: int - 0 = success, else failure */ 6556/* Parameters: data(I) - pointer to ioctl data */ 6557/* ptr(I) - pointer to store real data in */ 6558/* type(I) - type of structure being moved */ 6559/* */ 6560/* Copy out the contents of what ptr is to where ipfobj points to. In */ 6561/* future, we add things to check for version numbers, sizes, etc, to make */ 6562/* it backward compatible at the ABI for user land. */ 6563/* ------------------------------------------------------------------------ */ 6564int 6565ipf_outobj(softc, data, ptr, type) 6566 ipf_main_softc_t *softc; 6567 void *data; 6568 void *ptr; 6569 int type; 6570{ 6571 ipfobj_t obj; 6572 int error; 6573 6574 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6575 IPFERROR(67); 6576 return EINVAL; 6577 } 6578 6579 error = BCOPYIN(data, &obj, sizeof(obj)); 6580 if (error != 0) { 6581 IPFERROR(126); 6582 return EFAULT; 6583 } 6584 6585 if (obj.ipfo_type != type) { 6586 IPFERROR(68); 6587 return EINVAL; 6588 } 6589 6590 if (obj.ipfo_rev >= ipf_objbytes[type][2]) { 6591 if ((ipf_objbytes[type][0] & 1) != 0) { 6592 if (obj.ipfo_size < ipf_objbytes[type][1]) { 6593 IPFERROR(69); 6594 return EINVAL; 6595 } 6596 } else if (obj.ipfo_size != ipf_objbytes[type][1]) { 6597 IPFERROR(70); 6598 return EINVAL; 6599 } 6600 6601 error = COPYOUT(ptr, obj.ipfo_ptr, obj.ipfo_size); 6602 if (error != 0) { 6603 IPFERROR(73); 6604 error = EFAULT; 6605 } 6606 } else { 6607#ifdef IPFILTER_COMPAT 6608 error = ipf_out_compat(softc, &obj, ptr); 6609#else 6610 IPFERROR(72); 6611 error = EINVAL; 6612#endif 6613 } 6614 return error; 6615} 6616 6617 6618/* ------------------------------------------------------------------------ */ 6619/* Function: ipf_outobjk */ 6620/* Returns: int - 0 = success, else failure */ 6621/* Parameters: obj(I) - pointer to data description structure */ 6622/* ptr(I) - pointer to kernel data to copy out */ 6623/* */ 6624/* In the above functions, the ipfobj_t structure is copied into the kernel,*/ 6625/* telling ipfilter how to copy out data. In this instance, the ipfobj_t is */ 6626/* already populated with information and now we just need to use it. */ 6627/* There is no need for this function to have a "type" parameter as there */ 6628/* is no point in validating information that comes from the kernel with */ 6629/* itself. */ 6630/* ------------------------------------------------------------------------ */ 6631int 6632ipf_outobjk(softc, obj, ptr) 6633 ipf_main_softc_t *softc; 6634 ipfobj_t *obj; 6635 void *ptr; 6636{ 6637 int type = obj->ipfo_type; 6638 int error; 6639 6640 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6641 IPFERROR(147); 6642 return EINVAL; 6643 } 6644 6645 if (obj->ipfo_rev >= ipf_objbytes[type][2]) { 6646 if ((ipf_objbytes[type][0] & 1) != 0) { 6647 if (obj->ipfo_size < ipf_objbytes[type][1]) { 6648 IPFERROR(148); 6649 return EINVAL; 6650 } 6651 6652 } else if (obj->ipfo_size != ipf_objbytes[type][1]) { 6653 IPFERROR(149); 6654 return EINVAL; 6655 } 6656 6657 error = COPYOUT(ptr, obj->ipfo_ptr, obj->ipfo_size); 6658 if (error != 0) { 6659 IPFERROR(150); 6660 error = EFAULT; 6661 } 6662 } else { 6663#ifdef IPFILTER_COMPAT 6664 error = ipf_out_compat(softc, obj, ptr); 6665#else 6666 IPFERROR(151); 6667 error = EINVAL; 6668#endif 6669 } 6670 return error; 6671} 6672 6673 6674/* ------------------------------------------------------------------------ */ 6675/* Function: ipf_checkl4sum */ 6676/* Returns: int - 0 = good, -1 = bad, 1 = cannot check */ 6677/* Parameters: fin(I) - pointer to packet information */ 6678/* */ 6679/* If possible, calculate the layer 4 checksum for the packet. If this is */ 6680/* not possible, return without indicating a failure or success but in a */ 6681/* way that is ditinguishable. This function should only be called by the */ 6682/* ipf_checkv6sum() for each platform. */ 6683/* ------------------------------------------------------------------------ */ 6684INLINE int 6685ipf_checkl4sum(fin) 6686 fr_info_t *fin; 6687{ 6688 u_short sum, hdrsum, *csump; 6689 udphdr_t *udp; 6690 int dosum; 6691 6692 /* 6693 * If the TCP packet isn't a fragment, isn't too short and otherwise 6694 * isn't already considered "bad", then validate the checksum. If 6695 * this check fails then considered the packet to be "bad". 6696 */ 6697 if ((fin->fin_flx & (FI_FRAG|FI_SHORT|FI_BAD)) != 0) 6698 return 1; 6699 6700 csump = NULL; 6701 hdrsum = 0; 6702 dosum = 0; 6703 sum = 0; 6704 6705 switch (fin->fin_p) 6706 { 6707 case IPPROTO_TCP : 6708 csump = &((tcphdr_t *)fin->fin_dp)->th_sum; 6709 dosum = 1; 6710 break; 6711 6712 case IPPROTO_UDP : 6713 udp = fin->fin_dp; 6714 if (udp->uh_sum != 0) { 6715 csump = &udp->uh_sum; 6716 dosum = 1; 6717 } 6718 break; 6719 6720#ifdef USE_INET6 6721 case IPPROTO_ICMPV6 : 6722 csump = &((struct icmp6_hdr *)fin->fin_dp)->icmp6_cksum; 6723 dosum = 1; 6724 break; 6725#endif 6726 6727 case IPPROTO_ICMP : 6728 csump = &((struct icmp *)fin->fin_dp)->icmp_cksum; 6729 dosum = 1; 6730 break; 6731 6732 default : 6733 return 1; 6734 /*NOTREACHED*/ 6735 } 6736 6737 if (csump != NULL) 6738 hdrsum = *csump; 6739 6740 if (dosum) { 6741 sum = fr_cksum(fin, fin->fin_ip, fin->fin_p, fin->fin_dp); 6742 } 6743#if !defined(_KERNEL) 6744 if (sum == hdrsum) { 6745 FR_DEBUG(("checkl4sum: %hx == %hx\n", sum, hdrsum)); 6746 } else { 6747 FR_DEBUG(("checkl4sum: %hx != %hx\n", sum, hdrsum)); 6748 } 6749#endif 6750 DT2(l4sums, u_short, hdrsum, u_short, sum); 6751 if (hdrsum == sum) { 6752 fin->fin_cksum = FI_CK_SUMOK; 6753 return 0; 6754 } 6755 fin->fin_cksum = FI_CK_BAD; 6756 return -1; 6757} 6758 6759 6760/* ------------------------------------------------------------------------ */ 6761/* Function: ipf_ifpfillv4addr */ 6762/* Returns: int - 0 = address update, -1 = address not updated */ 6763/* Parameters: atype(I) - type of network address update to perform */ 6764/* sin(I) - pointer to source of address information */ 6765/* mask(I) - pointer to source of netmask information */ 6766/* inp(I) - pointer to destination address store */ 6767/* inpmask(I) - pointer to destination netmask store */ 6768/* */ 6769/* Given a type of network address update (atype) to perform, copy */ 6770/* information from sin/mask into inp/inpmask. If ipnmask is NULL then no */ 6771/* netmask update is performed unless FRI_NETMASKED is passed as atype, in */ 6772/* which case the operation fails. For all values of atype other than */ 6773/* FRI_NETMASKED, if inpmask is non-NULL then the mask is set to an all 1s */ 6774/* value. */ 6775/* ------------------------------------------------------------------------ */ 6776int 6777ipf_ifpfillv4addr(atype, sin, mask, inp, inpmask) 6778 int atype; 6779 struct sockaddr_in *sin, *mask; 6780 struct in_addr *inp, *inpmask; 6781{ 6782 if (inpmask != NULL && atype != FRI_NETMASKED) 6783 inpmask->s_addr = 0xffffffff; 6784 6785 if (atype == FRI_NETWORK || atype == FRI_NETMASKED) { 6786 if (atype == FRI_NETMASKED) { 6787 if (inpmask == NULL) 6788 return -1; 6789 inpmask->s_addr = mask->sin_addr.s_addr; 6790 } 6791 inp->s_addr = sin->sin_addr.s_addr & mask->sin_addr.s_addr; 6792 } else { 6793 inp->s_addr = sin->sin_addr.s_addr; 6794 } 6795 return 0; 6796} 6797 6798 6799#ifdef USE_INET6 6800/* ------------------------------------------------------------------------ */ 6801/* Function: ipf_ifpfillv6addr */ 6802/* Returns: int - 0 = address update, -1 = address not updated */ 6803/* Parameters: atype(I) - type of network address update to perform */ 6804/* sin(I) - pointer to source of address information */ 6805/* mask(I) - pointer to source of netmask information */ 6806/* inp(I) - pointer to destination address store */ 6807/* inpmask(I) - pointer to destination netmask store */ 6808/* */ 6809/* Given a type of network address update (atype) to perform, copy */ 6810/* information from sin/mask into inp/inpmask. If ipnmask is NULL then no */ 6811/* netmask update is performed unless FRI_NETMASKED is passed as atype, in */ 6812/* which case the operation fails. For all values of atype other than */ 6813/* FRI_NETMASKED, if inpmask is non-NULL then the mask is set to an all 1s */ 6814/* value. */ 6815/* ------------------------------------------------------------------------ */ 6816int 6817ipf_ifpfillv6addr(atype, sin, mask, inp, inpmask) 6818 int atype; 6819 struct sockaddr_in6 *sin, *mask; 6820 i6addr_t *inp, *inpmask; 6821{ 6822 i6addr_t *src, *and; 6823 6824 src = (i6addr_t *)&sin->sin6_addr; 6825 and = (i6addr_t *)&mask->sin6_addr; 6826 6827 if (inpmask != NULL && atype != FRI_NETMASKED) { 6828 inpmask->i6[0] = 0xffffffff; 6829 inpmask->i6[1] = 0xffffffff; 6830 inpmask->i6[2] = 0xffffffff; 6831 inpmask->i6[3] = 0xffffffff; 6832 } 6833 6834 if (atype == FRI_NETWORK || atype == FRI_NETMASKED) { 6835 if (atype == FRI_NETMASKED) { 6836 if (inpmask == NULL) 6837 return -1; 6838 inpmask->i6[0] = and->i6[0]; 6839 inpmask->i6[1] = and->i6[1]; 6840 inpmask->i6[2] = and->i6[2]; 6841 inpmask->i6[3] = and->i6[3]; 6842 } 6843 6844 inp->i6[0] = src->i6[0] & and->i6[0]; 6845 inp->i6[1] = src->i6[1] & and->i6[1]; 6846 inp->i6[2] = src->i6[2] & and->i6[2]; 6847 inp->i6[3] = src->i6[3] & and->i6[3]; 6848 } else { 6849 inp->i6[0] = src->i6[0]; 6850 inp->i6[1] = src->i6[1]; 6851 inp->i6[2] = src->i6[2]; 6852 inp->i6[3] = src->i6[3]; 6853 } 6854 return 0; 6855} 6856#endif 6857 6858 6859/* ------------------------------------------------------------------------ */ 6860/* Function: ipf_matchtag */ 6861/* Returns: 0 == mismatch, 1 == match. */ 6862/* Parameters: tag1(I) - pointer to first tag to compare */ 6863/* tag2(I) - pointer to second tag to compare */ 6864/* */ 6865/* Returns true (non-zero) or false(0) if the two tag structures can be */ 6866/* considered to be a match or not match, respectively. The tag is 16 */ 6867/* bytes long (16 characters) but that is overlayed with 4 32bit ints so */ 6868/* compare the ints instead, for speed. tag1 is the master of the */ 6869/* comparison. This function should only be called with both tag1 and tag2 */ 6870/* as non-NULL pointers. */ 6871/* ------------------------------------------------------------------------ */ 6872int 6873ipf_matchtag(tag1, tag2) 6874 ipftag_t *tag1, *tag2; 6875{ 6876 if (tag1 == tag2) 6877 return 1; 6878 6879 if ((tag1->ipt_num[0] == 0) && (tag2->ipt_num[0] == 0)) 6880 return 1; 6881 6882 if ((tag1->ipt_num[0] == tag2->ipt_num[0]) && 6883 (tag1->ipt_num[1] == tag2->ipt_num[1]) && 6884 (tag1->ipt_num[2] == tag2->ipt_num[2]) && 6885 (tag1->ipt_num[3] == tag2->ipt_num[3])) 6886 return 1; 6887 return 0; 6888} 6889 6890 6891/* ------------------------------------------------------------------------ */ 6892/* Function: ipf_coalesce */ 6893/* Returns: 1 == success, -1 == failure, 0 == no change */ 6894/* Parameters: fin(I) - pointer to packet information */ 6895/* */ 6896/* Attempt to get all of the packet data into a single, contiguous buffer. */ 6897/* If this call returns a failure then the buffers have also been freed. */ 6898/* ------------------------------------------------------------------------ */ 6899int 6900ipf_coalesce(fin) 6901 fr_info_t *fin; 6902{ 6903 6904 if ((fin->fin_flx & FI_COALESCE) != 0) 6905 return 1; 6906 6907 /* 6908 * If the mbuf pointers indicate that there is no mbuf to work with, 6909 * return but do not indicate success or failure. 6910 */ 6911 if (fin->fin_m == NULL || fin->fin_mp == NULL) 6912 return 0; 6913 6914#if defined(_KERNEL) 6915 if (ipf_pullup(fin->fin_m, fin, fin->fin_plen) == NULL) { 6916 ipf_main_softc_t *softc = fin->fin_main_soft; 6917 6918 DT1(frb_coalesce, fr_info_t *, fin); 6919 LBUMP(ipf_stats[fin->fin_out].fr_badcoalesces); 6920# ifdef MENTAT 6921 FREE_MB_T(*fin->fin_mp); 6922# endif 6923 fin->fin_reason = FRB_COALESCE; 6924 *fin->fin_mp = NULL; 6925 fin->fin_m = NULL; 6926 return -1; 6927 } 6928#else 6929 fin = fin; /* LINT */ 6930#endif 6931 return 1; 6932} 6933 6934 6935/* 6936 * The following table lists all of the tunable variables that can be 6937 * accessed via SIOCIPFGET/SIOCIPFSET/SIOCIPFGETNEXt. The format of each row 6938 * in the table below is as follows: 6939 * 6940 * pointer to value, name of value, minimum, maximum, size of the value's 6941 * container, value attribute flags 6942 * 6943 * For convienience, IPFT_RDONLY means the value is read-only, IPFT_WRDISABLED 6944 * means the value can only be written to when IPFilter is loaded but disabled. 6945 * The obvious implication is if neither of these are set then the value can be 6946 * changed at any time without harm. 6947 */ 6948 6949 6950/* ------------------------------------------------------------------------ */ 6951/* Function: ipf_tune_findbycookie */ 6952/* Returns: NULL = search failed, else pointer to tune struct */ 6953/* Parameters: cookie(I) - cookie value to search for amongst tuneables */ 6954/* next(O) - pointer to place to store the cookie for the */ 6955/* "next" tuneable, if it is desired. */ 6956/* */ 6957/* This function is used to walk through all of the existing tunables with */ 6958/* successive calls. It searches the known tunables for the one which has */ 6959/* a matching value for "cookie" - ie its address. When returning a match, */ 6960/* the next one to be found may be returned inside next. */ 6961/* ------------------------------------------------------------------------ */ 6962static ipftuneable_t * 6963ipf_tune_findbycookie(ptop, cookie, next) 6964 ipftuneable_t **ptop; 6965 void *cookie, **next; 6966{ 6967 ipftuneable_t *ta, **tap; 6968 6969 for (ta = *ptop; ta->ipft_name != NULL; ta++) 6970 if (ta == cookie) { 6971 if (next != NULL) { 6972 /* 6973 * If the next entry in the array has a name 6974 * present, then return a pointer to it for 6975 * where to go next, else return a pointer to 6976 * the dynaminc list as a key to search there 6977 * next. This facilitates a weak linking of 6978 * the two "lists" together. 6979 */ 6980 if ((ta + 1)->ipft_name != NULL) 6981 *next = ta + 1; 6982 else 6983 *next = ptop; 6984 } 6985 return ta; 6986 } 6987 6988 for (tap = ptop; (ta = *tap) != NULL; tap = &ta->ipft_next) 6989 if (tap == cookie) { 6990 if (next != NULL) 6991 *next = &ta->ipft_next; 6992 return ta; 6993 } 6994 6995 if (next != NULL) 6996 *next = NULL; 6997 return NULL; 6998} 6999 7000 7001/* ------------------------------------------------------------------------ */ 7002/* Function: ipf_tune_findbyname */ 7003/* Returns: NULL = search failed, else pointer to tune struct */ 7004/* Parameters: name(I) - name of the tuneable entry to find. */ 7005/* */ 7006/* Search the static array of tuneables and the list of dynamic tuneables */ 7007/* for an entry with a matching name. If we can find one, return a pointer */ 7008/* to the matching structure. */ 7009/* ------------------------------------------------------------------------ */ 7010static ipftuneable_t * 7011ipf_tune_findbyname(top, name) 7012 ipftuneable_t *top; 7013 const char *name; 7014{ 7015 ipftuneable_t *ta; 7016 7017 for (ta = top; ta != NULL; ta = ta->ipft_next) 7018 if (!strcmp(ta->ipft_name, name)) { 7019 return ta; 7020 } 7021 7022 return NULL; 7023} 7024 7025 7026/* ------------------------------------------------------------------------ */ 7027/* Function: ipf_tune_add_array */ 7028/* Returns: int - 0 == success, else failure */ 7029/* Parameters: newtune - pointer to new tune array to add to tuneables */ 7030/* */ 7031/* Appends tune structures from the array passed in (newtune) to the end of */ 7032/* the current list of "dynamic" tuneable parameters. */ 7033/* If any entry to be added is already present (by name) then the operation */ 7034/* is aborted - entries that have been added are removed before returning. */ 7035/* An entry with no name (NULL) is used as the indication that the end of */ 7036/* the array has been reached. */ 7037/* ------------------------------------------------------------------------ */ 7038int 7039ipf_tune_add_array(softc, newtune) 7040 ipf_main_softc_t *softc; 7041 ipftuneable_t *newtune; 7042{ 7043 ipftuneable_t *nt, *dt; 7044 int error = 0; 7045 7046 for (nt = newtune; nt->ipft_name != NULL; nt++) { 7047 error = ipf_tune_add(softc, nt); 7048 if (error != 0) { 7049 for (dt = newtune; dt != nt; dt++) { 7050 (void) ipf_tune_del(softc, dt); 7051 } 7052 } 7053 } 7054 7055 return error; 7056} 7057 7058 7059/* ------------------------------------------------------------------------ */ 7060/* Function: ipf_tune_array_link */ 7061/* Returns: 0 == success, -1 == failure */ 7062/* Parameters: softc(I) - soft context pointerto work with */ 7063/* array(I) - pointer to an array of tuneables */ 7064/* */ 7065/* Given an array of tunables (array), append them to the current list of */ 7066/* tuneables for this context (softc->ipf_tuners.) To properly prepare the */ 7067/* the array for being appended to the list, initialise all of the next */ 7068/* pointers so we don't need to walk parts of it with ++ and others with */ 7069/* next. The array is expected to have an entry with a NULL name as the */ 7070/* terminator. Trying to add an array with no non-NULL names will return as */ 7071/* a failure. */ 7072/* ------------------------------------------------------------------------ */ 7073int 7074ipf_tune_array_link(softc, array) 7075 ipf_main_softc_t *softc; 7076 ipftuneable_t *array; 7077{ 7078 ipftuneable_t *t, **p; 7079 7080 t = array; 7081 if (t->ipft_name == NULL) 7082 return -1; 7083 7084 for (; t[1].ipft_name != NULL; t++) 7085 t[0].ipft_next = &t[1]; 7086 t->ipft_next = NULL; 7087 7088 /* 7089 * Since a pointer to the last entry isn't kept, we need to find it 7090 * each time we want to add new variables to the list. 7091 */ 7092 for (p = &softc->ipf_tuners; (t = *p) != NULL; p = &t->ipft_next) 7093 if (t->ipft_name == NULL) 7094 break; 7095 *p = array; 7096 7097 return 0; 7098} 7099 7100 7101/* ------------------------------------------------------------------------ */ 7102/* Function: ipf_tune_array_unlink */ 7103/* Returns: 0 == success, -1 == failure */ 7104/* Parameters: softc(I) - soft context pointerto work with */ 7105/* array(I) - pointer to an array of tuneables */ 7106/* */ 7107/* ------------------------------------------------------------------------ */ 7108int 7109ipf_tune_array_unlink(softc, array) 7110 ipf_main_softc_t *softc; 7111 ipftuneable_t *array; 7112{ 7113 ipftuneable_t *t, **p; 7114 7115 for (p = &softc->ipf_tuners; (t = *p) != NULL; p = &t->ipft_next) 7116 if (t == array) 7117 break; 7118 if (t == NULL) 7119 return -1; 7120 7121 for (; t[1].ipft_name != NULL; t++) 7122 ; 7123 7124 *p = t->ipft_next; 7125 7126 return 0; 7127} 7128 7129 7130/* ------------------------------------------------------------------------ */ 7131/* Function: ipf_tune_array_copy */ 7132/* Returns: NULL = failure, else pointer to new array */ 7133/* Parameters: base(I) - pointer to structure base */ 7134/* size(I) - size of the array at template */ 7135/* template(I) - original array to copy */ 7136/* */ 7137/* Allocate memory for a new set of tuneable values and copy everything */ 7138/* from template into the new region of memory. The new region is full of */ 7139/* uninitialised pointers (ipft_next) so set them up. Now, ipftp_offset... */ 7140/* */ 7141/* NOTE: the following assumes that sizeof(long) == sizeof(void *) */ 7142/* In the array template, ipftp_offset is the offset (in bytes) of the */ 7143/* location of the tuneable value inside the structure pointed to by base. */ 7144/* As ipftp_offset is a union over the pointers to the tuneable values, if */ 7145/* we add base to the copy's ipftp_offset, copy ends up with a pointer in */ 7146/* ipftp_void that points to the stored value. */ 7147/* ------------------------------------------------------------------------ */ 7148ipftuneable_t * 7149ipf_tune_array_copy(base, size, template) 7150 void *base; 7151 size_t size; 7152 ipftuneable_t *template; 7153{ 7154 ipftuneable_t *copy; 7155 int i; 7156 7157 7158 KMALLOCS(copy, ipftuneable_t *, size); 7159 if (copy == NULL) { 7160 return NULL; 7161 } 7162 bcopy(template, copy, size); 7163 7164 for (i = 0; copy[i].ipft_name; i++) { 7165 copy[i].ipft_una.ipftp_offset += (u_long)base; 7166 copy[i].ipft_next = copy + i + 1; 7167 } 7168 7169 return copy; 7170} 7171 7172 7173/* ------------------------------------------------------------------------ */ 7174/* Function: ipf_tune_add */ 7175/* Returns: int - 0 == success, else failure */ 7176/* Parameters: newtune - pointer to new tune entry to add to tuneables */ 7177/* */ 7178/* Appends tune structures from the array passed in (newtune) to the end of */ 7179/* the current list of "dynamic" tuneable parameters. Once added, the */ 7180/* owner of the object is not expected to ever change "ipft_next". */ 7181/* ------------------------------------------------------------------------ */ 7182int 7183ipf_tune_add(softc, newtune) 7184 ipf_main_softc_t *softc; 7185 ipftuneable_t *newtune; 7186{ 7187 ipftuneable_t *ta, **tap; 7188 7189 ta = ipf_tune_findbyname(softc->ipf_tuners, newtune->ipft_name); 7190 if (ta != NULL) { 7191 IPFERROR(74); 7192 return EEXIST; 7193 } 7194 7195 for (tap = &softc->ipf_tuners; *tap != NULL; tap = &(*tap)->ipft_next) 7196 ; 7197 7198 newtune->ipft_next = NULL; 7199 *tap = newtune; 7200 return 0; 7201} 7202 7203 7204/* ------------------------------------------------------------------------ */ 7205/* Function: ipf_tune_del */ 7206/* Returns: int - 0 == success, else failure */ 7207/* Parameters: oldtune - pointer to tune entry to remove from the list of */ 7208/* current dynamic tuneables */ 7209/* */ 7210/* Search for the tune structure, by pointer, in the list of those that are */ 7211/* dynamically added at run time. If found, adjust the list so that this */ 7212/* structure is no longer part of it. */ 7213/* ------------------------------------------------------------------------ */ 7214int 7215ipf_tune_del(softc, oldtune) 7216 ipf_main_softc_t *softc; 7217 ipftuneable_t *oldtune; 7218{ 7219 ipftuneable_t *ta, **tap; 7220 int error = 0; 7221 7222 for (tap = &softc->ipf_tuners; (ta = *tap) != NULL; 7223 tap = &ta->ipft_next) { 7224 if (ta == oldtune) { 7225 *tap = oldtune->ipft_next; 7226 oldtune->ipft_next = NULL; 7227 break; 7228 } 7229 } 7230 7231 if (ta == NULL) { 7232 error = ESRCH; 7233 IPFERROR(75); 7234 } 7235 return error; 7236} 7237 7238 7239/* ------------------------------------------------------------------------ */ 7240/* Function: ipf_tune_del_array */ 7241/* Returns: int - 0 == success, else failure */ 7242/* Parameters: oldtune - pointer to tuneables array */ 7243/* */ 7244/* Remove each tuneable entry in the array from the list of "dynamic" */ 7245/* tunables. If one entry should fail to be found, an error will be */ 7246/* returned and no further ones removed. */ 7247/* An entry with a NULL name is used as the indicator of the last entry in */ 7248/* the array. */ 7249/* ------------------------------------------------------------------------ */ 7250int 7251ipf_tune_del_array(softc, oldtune) 7252 ipf_main_softc_t *softc; 7253 ipftuneable_t *oldtune; 7254{ 7255 ipftuneable_t *ot; 7256 int error = 0; 7257 7258 for (ot = oldtune; ot->ipft_name != NULL; ot++) { 7259 error = ipf_tune_del(softc, ot); 7260 if (error != 0) 7261 break; 7262 } 7263 7264 return error; 7265 7266} 7267 7268 7269/* ------------------------------------------------------------------------ */ 7270/* Function: ipf_tune */ 7271/* Returns: int - 0 == success, else failure */ 7272/* Parameters: cmd(I) - ioctl command number */ 7273/* data(I) - pointer to ioctl data structure */ 7274/* */ 7275/* Implement handling of SIOCIPFGETNEXT, SIOCIPFGET and SIOCIPFSET. These */ 7276/* three ioctls provide the means to access and control global variables */ 7277/* within IPFilter, allowing (for example) timeouts and table sizes to be */ 7278/* changed without rebooting, reloading or recompiling. The initialisation */ 7279/* and 'destruction' routines of the various components of ipfilter are all */ 7280/* each responsible for handling their own values being too big. */ 7281/* ------------------------------------------------------------------------ */ 7282int 7283ipf_ipftune(softc, cmd, data) 7284 ipf_main_softc_t *softc; 7285 ioctlcmd_t cmd; 7286 void *data; 7287{ 7288 ipftuneable_t *ta; 7289 ipftune_t tu; 7290 void *cookie; 7291 int error; 7292 7293 error = ipf_inobj(softc, data, NULL, &tu, IPFOBJ_TUNEABLE); 7294 if (error != 0) 7295 return error; 7296 7297 tu.ipft_name[sizeof(tu.ipft_name) - 1] = '\0'; 7298 cookie = tu.ipft_cookie; 7299 ta = NULL; 7300 7301 switch (cmd) 7302 { 7303 case SIOCIPFGETNEXT : 7304 /* 7305 * If cookie is non-NULL, assume it to be a pointer to the last 7306 * entry we looked at, so find it (if possible) and return a 7307 * pointer to the next one after it. The last entry in the 7308 * the table is a NULL entry, so when we get to it, set cookie 7309 * to NULL and return that, indicating end of list, erstwhile 7310 * if we come in with cookie set to NULL, we are starting anew 7311 * at the front of the list. 7312 */ 7313 if (cookie != NULL) { 7314 ta = ipf_tune_findbycookie(&softc->ipf_tuners, 7315 cookie, &tu.ipft_cookie); 7316 } else { 7317 ta = softc->ipf_tuners; 7318 tu.ipft_cookie = ta + 1; 7319 } 7320 if (ta != NULL) { 7321 /* 7322 * Entry found, but does the data pointed to by that 7323 * row fit in what we can return? 7324 */ 7325 if (ta->ipft_sz > sizeof(tu.ipft_un)) { 7326 IPFERROR(76); 7327 return EINVAL; 7328 } 7329 7330 tu.ipft_vlong = 0; 7331 if (ta->ipft_sz == sizeof(u_long)) 7332 tu.ipft_vlong = *ta->ipft_plong; 7333 else if (ta->ipft_sz == sizeof(u_int)) 7334 tu.ipft_vint = *ta->ipft_pint; 7335 else if (ta->ipft_sz == sizeof(u_short)) 7336 tu.ipft_vshort = *ta->ipft_pshort; 7337 else if (ta->ipft_sz == sizeof(u_char)) 7338 tu.ipft_vchar = *ta->ipft_pchar; 7339 7340 tu.ipft_sz = ta->ipft_sz; 7341 tu.ipft_min = ta->ipft_min; 7342 tu.ipft_max = ta->ipft_max; 7343 tu.ipft_flags = ta->ipft_flags; 7344 bcopy(ta->ipft_name, tu.ipft_name, 7345 MIN(sizeof(tu.ipft_name), 7346 strlen(ta->ipft_name) + 1)); 7347 } 7348 error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE); 7349 break; 7350 7351 case SIOCIPFGET : 7352 case SIOCIPFSET : 7353 /* 7354 * Search by name or by cookie value for a particular entry 7355 * in the tuning paramter table. 7356 */ 7357 IPFERROR(77); 7358 error = ESRCH; 7359 if (cookie != NULL) { 7360 ta = ipf_tune_findbycookie(&softc->ipf_tuners, 7361 cookie, NULL); 7362 if (ta != NULL) 7363 error = 0; 7364 } else if (tu.ipft_name[0] != '\0') { 7365 ta = ipf_tune_findbyname(softc->ipf_tuners, 7366 tu.ipft_name); 7367 if (ta != NULL) 7368 error = 0; 7369 } 7370 if (error != 0) 7371 break; 7372 7373 if (cmd == (ioctlcmd_t)SIOCIPFGET) { 7374 /* 7375 * Fetch the tuning parameters for a particular value 7376 */ 7377 tu.ipft_vlong = 0; 7378 if (ta->ipft_sz == sizeof(u_long)) 7379 tu.ipft_vlong = *ta->ipft_plong; 7380 else if (ta->ipft_sz == sizeof(u_int)) 7381 tu.ipft_vint = *ta->ipft_pint; 7382 else if (ta->ipft_sz == sizeof(u_short)) 7383 tu.ipft_vshort = *ta->ipft_pshort; 7384 else if (ta->ipft_sz == sizeof(u_char)) 7385 tu.ipft_vchar = *ta->ipft_pchar; 7386 tu.ipft_cookie = ta; 7387 tu.ipft_sz = ta->ipft_sz; 7388 tu.ipft_min = ta->ipft_min; 7389 tu.ipft_max = ta->ipft_max; 7390 tu.ipft_flags = ta->ipft_flags; 7391 error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE); 7392 7393 } else if (cmd == (ioctlcmd_t)SIOCIPFSET) { 7394 /* 7395 * Set an internal parameter. The hard part here is 7396 * getting the new value safely and correctly out of 7397 * the kernel (given we only know its size, not type.) 7398 */ 7399 u_long in; 7400 7401 if (((ta->ipft_flags & IPFT_WRDISABLED) != 0) && 7402 (softc->ipf_running > 0)) { 7403 IPFERROR(78); 7404 error = EBUSY; 7405 break; 7406 } 7407 7408 in = tu.ipft_vlong; 7409 if (in < ta->ipft_min || in > ta->ipft_max) { 7410 IPFERROR(79); 7411 error = EINVAL; 7412 break; 7413 } 7414 7415 if (ta->ipft_func != NULL) { 7416 SPL_INT(s); 7417 7418 SPL_NET(s); 7419 error = (*ta->ipft_func)(softc, ta, 7420 &tu.ipft_un); 7421 SPL_X(s); 7422 7423 } else if (ta->ipft_sz == sizeof(u_long)) { 7424 tu.ipft_vlong = *ta->ipft_plong; 7425 *ta->ipft_plong = in; 7426 7427 } else if (ta->ipft_sz == sizeof(u_int)) { 7428 tu.ipft_vint = *ta->ipft_pint; 7429 *ta->ipft_pint = (u_int)(in & 0xffffffff); 7430 7431 } else if (ta->ipft_sz == sizeof(u_short)) { 7432 tu.ipft_vshort = *ta->ipft_pshort; 7433 *ta->ipft_pshort = (u_short)(in & 0xffff); 7434 7435 } else if (ta->ipft_sz == sizeof(u_char)) { 7436 tu.ipft_vchar = *ta->ipft_pchar; 7437 *ta->ipft_pchar = (u_char)(in & 0xff); 7438 } 7439 error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE); 7440 } 7441 break; 7442 7443 default : 7444 IPFERROR(80); 7445 error = EINVAL; 7446 break; 7447 } 7448 7449 return error; 7450} 7451 7452 7453/* ------------------------------------------------------------------------ */ 7454/* Function: ipf_zerostats */ 7455/* Returns: int - 0 = success, else failure */ 7456/* Parameters: data(O) - pointer to pointer for copying data back to */ 7457/* */ 7458/* Copies the current statistics out to userspace and then zero's the */ 7459/* current ones in the kernel. The lock is only held across the bzero() as */ 7460/* the copyout may result in paging (ie network activity.) */ 7461/* ------------------------------------------------------------------------ */ 7462int 7463ipf_zerostats(softc, data) 7464 ipf_main_softc_t *softc; 7465 caddr_t data; 7466{ 7467 friostat_t fio; 7468 ipfobj_t obj; 7469 int error; 7470 7471 error = ipf_inobj(softc, data, &obj, &fio, IPFOBJ_IPFSTAT); 7472 if (error != 0) 7473 return error; 7474 ipf_getstat(softc, &fio, obj.ipfo_rev); 7475 error = ipf_outobj(softc, data, &fio, IPFOBJ_IPFSTAT); 7476 if (error != 0) 7477 return error; 7478 7479 WRITE_ENTER(&softc->ipf_mutex); 7480 bzero(&softc->ipf_stats, sizeof(softc->ipf_stats)); 7481 RWLOCK_EXIT(&softc->ipf_mutex); 7482 7483 return 0; 7484} 7485 7486 7487/* ------------------------------------------------------------------------ */ 7488/* Function: ipf_resolvedest */ 7489/* Returns: Nil */ 7490/* Parameters: softc(I) - pointer to soft context main structure */ 7491/* base(I) - where strings are stored */ 7492/* fdp(IO) - pointer to destination information to resolve */ 7493/* v(I) - IP protocol version to match */ 7494/* */ 7495/* Looks up an interface name in the frdest structure pointed to by fdp and */ 7496/* if a matching name can be found for the particular IP protocol version */ 7497/* then store the interface pointer in the frdest struct. If no match is */ 7498/* found, then set the interface pointer to be -1 as NULL is considered to */ 7499/* indicate there is no information at all in the structure. */ 7500/* ------------------------------------------------------------------------ */ 7501int 7502ipf_resolvedest(softc, base, fdp, v) 7503 ipf_main_softc_t *softc; 7504 char *base; 7505 frdest_t *fdp; 7506 int v; 7507{ 7508 int errval = 0; 7509 void *ifp; 7510 7511 ifp = NULL; 7512 7513 if (fdp->fd_name != -1) { 7514 if (fdp->fd_type == FRD_DSTLIST) { 7515 ifp = ipf_lookup_res_name(softc, IPL_LOGIPF, 7516 IPLT_DSTLIST, 7517 base + fdp->fd_name, 7518 NULL); 7519 if (ifp == NULL) { 7520 IPFERROR(144); 7521 errval = ESRCH; 7522 } 7523 } else { 7524 ifp = GETIFP(base + fdp->fd_name, v); 7525 if (ifp == NULL) 7526 ifp = (void *)-1; 7527 } 7528 } 7529 fdp->fd_ptr = ifp; 7530 7531 if ((ifp != NULL) && (ifp != (void *)-1)) { 7532 fdp->fd_local = ipf_deliverlocal(softc, v, ifp, &fdp->fd_ip6); 7533 } 7534 7535 return errval; 7536} 7537 7538 7539/* ------------------------------------------------------------------------ */ 7540/* Function: ipf_resolvenic */ 7541/* Returns: void* - NULL = wildcard name, -1 = failed to find NIC, else */ 7542/* pointer to interface structure for NIC */ 7543/* Parameters: softc(I)- pointer to soft context main structure */ 7544/* name(I) - complete interface name */ 7545/* v(I) - IP protocol version */ 7546/* */ 7547/* Look for a network interface structure that firstly has a matching name */ 7548/* to that passed in and that is also being used for that IP protocol */ 7549/* version (necessary on some platforms where there are separate listings */ 7550/* for both IPv4 and IPv6 on the same physical NIC. */ 7551/* ------------------------------------------------------------------------ */ 7552void * 7553ipf_resolvenic(softc, name, v) 7554 ipf_main_softc_t *softc; 7555 char *name; 7556 int v; 7557{ 7558 void *nic; 7559 7560 softc = softc; /* gcc -Wextra */ 7561 if (name[0] == '\0') 7562 return NULL; 7563 7564 if ((name[1] == '\0') && ((name[0] == '-') || (name[0] == '*'))) { 7565 return NULL; 7566 } 7567 7568 nic = GETIFP(name, v); 7569 if (nic == NULL) 7570 nic = (void *)-1; 7571 return nic; 7572} 7573 7574 7575/* ------------------------------------------------------------------------ */ 7576/* Function: ipf_token_expire */ 7577/* Returns: None. */ 7578/* Parameters: softc(I) - pointer to soft context main structure */ 7579/* */ 7580/* This function is run every ipf tick to see if there are any tokens that */ 7581/* have been held for too long and need to be freed up. */ 7582/* ------------------------------------------------------------------------ */ 7583void 7584ipf_token_expire(softc) 7585 ipf_main_softc_t *softc; 7586{ 7587 ipftoken_t *it; 7588 7589 WRITE_ENTER(&softc->ipf_tokens); 7590 while ((it = softc->ipf_token_head) != NULL) { 7591 if (it->ipt_die > softc->ipf_ticks) 7592 break; 7593 7594 ipf_token_deref(softc, it); 7595 } 7596 RWLOCK_EXIT(&softc->ipf_tokens); 7597} 7598 7599 7600/* ------------------------------------------------------------------------ */ 7601/* Function: ipf_token_flush */ 7602/* Returns: None. */ 7603/* Parameters: softc(I) - pointer to soft context main structure */ 7604/* */ 7605/* Loop through all of the existing tokens and call deref to see if they */ 7606/* can be freed. Normally a function like this might just loop on */ 7607/* ipf_token_head but there is a chance that a token might have a ref count */ 7608/* of greater than one and in that case the the reference would drop twice */ 7609/* by code that is only entitled to drop it once. */ 7610/* ------------------------------------------------------------------------ */ 7611static void 7612ipf_token_flush(softc) 7613 ipf_main_softc_t *softc; 7614{ 7615 ipftoken_t *it, *next; 7616 7617 WRITE_ENTER(&softc->ipf_tokens); 7618 for (it = softc->ipf_token_head; it != NULL; it = next) { 7619 next = it->ipt_next; 7620 (void) ipf_token_deref(softc, it); 7621 } 7622 RWLOCK_EXIT(&softc->ipf_tokens); 7623} 7624 7625 7626/* ------------------------------------------------------------------------ */ 7627/* Function: ipf_token_del */ 7628/* Returns: int - 0 = success, else error */ 7629/* Parameters: softc(I)- pointer to soft context main structure */ 7630/* type(I) - the token type to match */ 7631/* uid(I) - uid owning the token */ 7632/* ptr(I) - context pointer for the token */ 7633/* */ 7634/* This function looks for a a token in the current list that matches up */ 7635/* the fields (type, uid, ptr). If none is found, ESRCH is returned, else */ 7636/* call ipf_token_dewref() to remove it from the list. In the event that */ 7637/* the token has a reference held elsewhere, setting ipt_complete to 2 */ 7638/* enables debugging to distinguish between the two paths that ultimately */ 7639/* lead to a token to be deleted. */ 7640/* ------------------------------------------------------------------------ */ 7641int 7642ipf_token_del(softc, type, uid, ptr) 7643 ipf_main_softc_t *softc; 7644 int type, uid; 7645 void *ptr; 7646{ 7647 ipftoken_t *it; 7648 int error; 7649 7650 IPFERROR(82); 7651 error = ESRCH; 7652 7653 WRITE_ENTER(&softc->ipf_tokens); 7654 for (it = softc->ipf_token_head; it != NULL; it = it->ipt_next) { 7655 if (ptr == it->ipt_ctx && type == it->ipt_type && 7656 uid == it->ipt_uid) { 7657 it->ipt_complete = 2; 7658 ipf_token_deref(softc, it); 7659 error = 0; 7660 break; 7661 } 7662 } 7663 RWLOCK_EXIT(&softc->ipf_tokens); 7664 7665 return error; 7666} 7667 7668 7669/* ------------------------------------------------------------------------ */ 7670/* Function: ipf_token_mark_complete */ 7671/* Returns: None. */ 7672/* Parameters: token(I) - pointer to token structure */ 7673/* */ 7674/* Mark a token as being ineligable for being found with ipf_token_find. */ 7675/* ------------------------------------------------------------------------ */ 7676void 7677ipf_token_mark_complete(token) 7678 ipftoken_t *token; 7679{ 7680 if (token->ipt_complete == 0) 7681 token->ipt_complete = 1; 7682} 7683 7684 7685/* ------------------------------------------------------------------------ */ 7686/* Function: ipf_token_find */ 7687/* Returns: ipftoken_t * - NULL if no memory, else pointer to token */ 7688/* Parameters: softc(I)- pointer to soft context main structure */ 7689/* type(I) - the token type to match */ 7690/* uid(I) - uid owning the token */ 7691/* ptr(I) - context pointer for the token */ 7692/* */ 7693/* This function looks for a live token in the list of current tokens that */ 7694/* matches the tuple (type, uid, ptr). If one cannot be found then one is */ 7695/* allocated. If one is found then it is moved to the top of the list of */ 7696/* currently active tokens. */ 7697/* ------------------------------------------------------------------------ */ 7698ipftoken_t * 7699ipf_token_find(softc, type, uid, ptr) 7700 ipf_main_softc_t *softc; 7701 int type, uid; 7702 void *ptr; 7703{ 7704 ipftoken_t *it, *new; 7705 7706 KMALLOC(new, ipftoken_t *); 7707 if (new != NULL) 7708 bzero((char *)new, sizeof(*new)); 7709 7710 WRITE_ENTER(&softc->ipf_tokens); 7711 for (it = softc->ipf_token_head; it != NULL; it = it->ipt_next) { 7712 if ((ptr == it->ipt_ctx) && (type == it->ipt_type) && 7713 (uid == it->ipt_uid) && (it->ipt_complete < 2)) 7714 break; 7715 } 7716 7717 if (it == NULL) { 7718 it = new; 7719 new = NULL; 7720 if (it == NULL) { 7721 RWLOCK_EXIT(&softc->ipf_tokens); 7722 return NULL; 7723 } 7724 it->ipt_ctx = ptr; 7725 it->ipt_uid = uid; 7726 it->ipt_type = type; 7727 it->ipt_ref = 1; 7728 } else { 7729 if (new != NULL) { 7730 KFREE(new); 7731 new = NULL; 7732 } 7733 7734 if (it->ipt_complete > 0) 7735 it = NULL; 7736 else 7737 ipf_token_unlink(softc, it); 7738 } 7739 7740 if (it != NULL) { 7741 it->ipt_pnext = softc->ipf_token_tail; 7742 *softc->ipf_token_tail = it; 7743 softc->ipf_token_tail = &it->ipt_next; 7744 it->ipt_next = NULL; 7745 it->ipt_ref++; 7746 7747 it->ipt_die = softc->ipf_ticks + 20; 7748 } 7749 7750 RWLOCK_EXIT(&softc->ipf_tokens); 7751 7752 return it; 7753} 7754 7755 7756/* ------------------------------------------------------------------------ */ 7757/* Function: ipf_token_unlink */ 7758/* Returns: None. */ 7759/* Parameters: softc(I) - pointer to soft context main structure */ 7760/* token(I) - pointer to token structure */ 7761/* Write Locks: ipf_tokens */ 7762/* */ 7763/* This function unlinks a token structure from the linked list of tokens */ 7764/* that "own" it. The head pointer never needs to be explicitly adjusted */ 7765/* but the tail does due to the linked list implementation. */ 7766/* ------------------------------------------------------------------------ */ 7767static void 7768ipf_token_unlink(softc, token) 7769 ipf_main_softc_t *softc; 7770 ipftoken_t *token; 7771{ 7772 7773 if (softc->ipf_token_tail == &token->ipt_next) 7774 softc->ipf_token_tail = token->ipt_pnext; 7775 7776 *token->ipt_pnext = token->ipt_next; 7777 if (token->ipt_next != NULL) 7778 token->ipt_next->ipt_pnext = token->ipt_pnext; 7779 token->ipt_next = NULL; 7780 token->ipt_pnext = NULL; 7781} 7782 7783 7784/* ------------------------------------------------------------------------ */ 7785/* Function: ipf_token_deref */ 7786/* Returns: int - 0 == token freed, else reference count */ 7787/* Parameters: softc(I) - pointer to soft context main structure */ 7788/* token(I) - pointer to token structure */ 7789/* Write Locks: ipf_tokens */ 7790/* */ 7791/* Drop the reference count on the token structure and if it drops to zero, */ 7792/* call the dereference function for the token type because it is then */ 7793/* possible to free the token data structure. */ 7794/* ------------------------------------------------------------------------ */ 7795int 7796ipf_token_deref(softc, token) 7797 ipf_main_softc_t *softc; 7798 ipftoken_t *token; 7799{ 7800 void *data, **datap; 7801 7802 ASSERT(token->ipt_ref > 0); 7803 token->ipt_ref--; 7804 if (token->ipt_ref > 0) 7805 return token->ipt_ref; 7806 7807 data = token->ipt_data; 7808 datap = &data; 7809 7810 if ((data != NULL) && (data != (void *)-1)) { 7811 switch (token->ipt_type) 7812 { 7813 case IPFGENITER_IPF : 7814 (void) ipf_derefrule(softc, (frentry_t **)datap); 7815 break; 7816 case IPFGENITER_IPNAT : 7817 WRITE_ENTER(&softc->ipf_nat); 7818 ipf_nat_rule_deref(softc, (ipnat_t **)datap); 7819 RWLOCK_EXIT(&softc->ipf_nat); 7820 break; 7821 case IPFGENITER_NAT : 7822 ipf_nat_deref(softc, (nat_t **)datap); 7823 break; 7824 case IPFGENITER_STATE : 7825 ipf_state_deref(softc, (ipstate_t **)datap); 7826 break; 7827 case IPFGENITER_FRAG : 7828 ipf_frag_pkt_deref(softc, (ipfr_t **)datap); 7829 break; 7830 case IPFGENITER_NATFRAG : 7831 ipf_frag_nat_deref(softc, (ipfr_t **)datap); 7832 break; 7833 case IPFGENITER_HOSTMAP : 7834 WRITE_ENTER(&softc->ipf_nat); 7835 ipf_nat_hostmapdel(softc, (hostmap_t **)datap); 7836 RWLOCK_EXIT(&softc->ipf_nat); 7837 break; 7838 default : 7839 ipf_lookup_iterderef(softc, token->ipt_type, data); 7840 break; 7841 } 7842 } 7843 7844 ipf_token_unlink(softc, token); 7845 KFREE(token); 7846 return 0; 7847} 7848 7849 7850/* ------------------------------------------------------------------------ */ 7851/* Function: ipf_nextrule */ 7852/* Returns: frentry_t * - NULL == no more rules, else pointer to next */ 7853/* Parameters: softc(I) - pointer to soft context main structure */ 7854/* fr(I) - pointer to filter rule */ 7855/* out(I) - 1 == out rules, 0 == input rules */ 7856/* */ 7857/* Starting with "fr", find the next rule to visit. This includes visiting */ 7858/* the list of rule groups if either fr is NULL (empty list) or it is the */ 7859/* last rule in the list. When walking rule lists, it is either input or */ 7860/* output rules that are returned, never both. */ 7861/* ------------------------------------------------------------------------ */ 7862static frentry_t * 7863ipf_nextrule(softc, active, unit, fr, out) 7864 ipf_main_softc_t *softc; 7865 int active, unit; 7866 frentry_t *fr; 7867 int out; 7868{ 7869 frentry_t *next; 7870 frgroup_t *fg; 7871 7872 if (fr != NULL && fr->fr_group != -1) { 7873 fg = ipf_findgroup(softc, fr->fr_names + fr->fr_group, 7874 unit, active, NULL); 7875 if (fg != NULL) 7876 fg = fg->fg_next; 7877 } else { 7878 fg = softc->ipf_groups[unit][active]; 7879 } 7880 7881 while (fg != NULL) { 7882 next = fg->fg_start; 7883 while (next != NULL) { 7884 if (out) { 7885 if (next->fr_flags & FR_OUTQUE) 7886 return next; 7887 } else if (next->fr_flags & FR_INQUE) { 7888 return next; 7889 } 7890 next = next->fr_next; 7891 } 7892 if (next == NULL) 7893 fg = fg->fg_next; 7894 } 7895 7896 return NULL; 7897} 7898 7899/* ------------------------------------------------------------------------ */ 7900/* Function: ipf_getnextrule */ 7901/* Returns: int - 0 = success, else error */ 7902/* Parameters: softc(I)- pointer to soft context main structure */ 7903/* t(I) - pointer to destination information to resolve */ 7904/* ptr(I) - pointer to ipfobj_t to copyin from user space */ 7905/* */ 7906/* This function's first job is to bring in the ipfruleiter_t structure via */ 7907/* the ipfobj_t structure to determine what should be the next rule to */ 7908/* return. Once the ipfruleiter_t has been brought in, it then tries to */ 7909/* find the 'next rule'. This may include searching rule group lists or */ 7910/* just be as simple as looking at the 'next' field in the rule structure. */ 7911/* When we have found the rule to return, increase its reference count and */ 7912/* if we used an existing rule to get here, decrease its reference count. */ 7913/* ------------------------------------------------------------------------ */ 7914int 7915ipf_getnextrule(softc, t, ptr) 7916 ipf_main_softc_t *softc; 7917 ipftoken_t *t; 7918 void *ptr; 7919{ 7920 frentry_t *fr, *next, zero; 7921 ipfruleiter_t it; 7922 int error, out; 7923 frgroup_t *fg; 7924 ipfobj_t obj; 7925 int predict; 7926 char *dst; 7927 int unit; 7928 7929 if (t == NULL || ptr == NULL) { 7930 IPFERROR(84); 7931 return EFAULT; 7932 } 7933 7934 error = ipf_inobj(softc, ptr, &obj, &it, IPFOBJ_IPFITER); 7935 if (error != 0) 7936 return error; 7937 7938 if ((it.iri_inout < 0) || (it.iri_inout > 3)) { 7939 IPFERROR(85); 7940 return EINVAL; 7941 } 7942 if ((it.iri_active != 0) && (it.iri_active != 1)) { 7943 IPFERROR(86); 7944 return EINVAL; 7945 } 7946 if (it.iri_nrules == 0) { 7947 IPFERROR(87); 7948 return ENOSPC; 7949 } 7950 if (it.iri_rule == NULL) { 7951 IPFERROR(88); 7952 return EFAULT; 7953 } 7954 7955 fg = NULL; 7956 fr = t->ipt_data; 7957 if ((it.iri_inout & F_OUT) != 0) 7958 out = 1; 7959 else 7960 out = 0; 7961 if ((it.iri_inout & F_ACIN) != 0) 7962 unit = IPL_LOGCOUNT; 7963 else 7964 unit = IPL_LOGIPF; 7965 7966 READ_ENTER(&softc->ipf_mutex); 7967 if (fr == NULL) { 7968 if (*it.iri_group == '\0') { 7969 if (unit == IPL_LOGCOUNT) { 7970 next = softc->ipf_acct[out][it.iri_active]; 7971 } else { 7972 next = softc->ipf_rules[out][it.iri_active]; 7973 } 7974 if (next == NULL) 7975 next = ipf_nextrule(softc, it.iri_active, 7976 unit, NULL, out); 7977 } else { 7978 fg = ipf_findgroup(softc, it.iri_group, unit, 7979 it.iri_active, NULL); 7980 if (fg != NULL) 7981 next = fg->fg_start; 7982 else 7983 next = NULL; 7984 } 7985 } else { 7986 next = fr->fr_next; 7987 if (next == NULL) 7988 next = ipf_nextrule(softc, it.iri_active, unit, 7989 fr, out); 7990 } 7991 7992 if (next != NULL && next->fr_next != NULL) 7993 predict = 1; 7994 else if (ipf_nextrule(softc, it.iri_active, unit, next, out) != NULL) 7995 predict = 1; 7996 else 7997 predict = 0; 7998 7999 if (fr != NULL) 8000 (void) ipf_derefrule(softc, &fr); 8001 8002 obj.ipfo_type = IPFOBJ_FRENTRY; 8003 dst = (char *)it.iri_rule; 8004 8005 if (next != NULL) { 8006 obj.ipfo_size = next->fr_size; 8007 MUTEX_ENTER(&next->fr_lock); 8008 next->fr_ref++; 8009 MUTEX_EXIT(&next->fr_lock); 8010 t->ipt_data = next; 8011 } else { 8012 obj.ipfo_size = sizeof(frentry_t); 8013 bzero(&zero, sizeof(zero)); 8014 next = &zero; 8015 t->ipt_data = NULL; 8016 } 8017 it.iri_rule = predict ? next : NULL; 8018 if (predict == 0) 8019 ipf_token_mark_complete(t); 8020 8021 RWLOCK_EXIT(&softc->ipf_mutex); 8022 8023 obj.ipfo_ptr = dst; 8024 error = ipf_outobjk(softc, &obj, next); 8025 if (error == 0 && t->ipt_data != NULL) { 8026 dst += obj.ipfo_size; 8027 if (next->fr_data != NULL) { 8028 ipfobj_t dobj; 8029 8030 if (next->fr_type == FR_T_IPFEXPR) 8031 dobj.ipfo_type = IPFOBJ_IPFEXPR; 8032 else 8033 dobj.ipfo_type = IPFOBJ_FRIPF; 8034 dobj.ipfo_size = next->fr_dsize; 8035 dobj.ipfo_rev = obj.ipfo_rev; 8036 dobj.ipfo_ptr = dst; 8037 error = ipf_outobjk(softc, &dobj, next->fr_data); 8038 } 8039 } 8040 8041 if ((fr != NULL) && (next == &zero)) 8042 (void) ipf_derefrule(softc, &fr); 8043 8044 return error; 8045} 8046 8047 8048/* ------------------------------------------------------------------------ */ 8049/* Function: ipf_frruleiter */ 8050/* Returns: int - 0 = success, else error */ 8051/* Parameters: softc(I)- pointer to soft context main structure */ 8052/* data(I) - the token type to match */ 8053/* uid(I) - uid owning the token */ 8054/* ptr(I) - context pointer for the token */ 8055/* */ 8056/* This function serves as a stepping stone between ipf_ipf_ioctl and */ 8057/* ipf_getnextrule. It's role is to find the right token in the kernel for */ 8058/* the process doing the ioctl and use that to ask for the next rule. */ 8059/* ------------------------------------------------------------------------ */ 8060static int 8061ipf_frruleiter(softc, data, uid, ctx) 8062 ipf_main_softc_t *softc; 8063 void *data, *ctx; 8064 int uid; 8065{ 8066 ipftoken_t *token; 8067 ipfruleiter_t it; 8068 ipfobj_t obj; 8069 int error; 8070 8071 token = ipf_token_find(softc, IPFGENITER_IPF, uid, ctx); 8072 if (token != NULL) { 8073 error = ipf_getnextrule(softc, token, data); 8074 WRITE_ENTER(&softc->ipf_tokens); 8075 ipf_token_deref(softc, token); 8076 RWLOCK_EXIT(&softc->ipf_tokens); 8077 } else { 8078 error = ipf_inobj(softc, data, &obj, &it, IPFOBJ_IPFITER); 8079 if (error != 0) 8080 return error; 8081 it.iri_rule = NULL; 8082 error = ipf_outobj(softc, data, &it, IPFOBJ_IPFITER); 8083 } 8084 8085 return error; 8086} 8087 8088 8089/* ------------------------------------------------------------------------ */ 8090/* Function: ipf_geniter */ 8091/* Returns: int - 0 = success, else error */ 8092/* Parameters: softc(I) - pointer to soft context main structure */ 8093/* token(I) - pointer to ipftoken_t structure */ 8094/* itp(I) - pointer to iterator data */ 8095/* */ 8096/* Decide which iterator function to call using information passed through */ 8097/* the ipfgeniter_t structure at itp. */ 8098/* ------------------------------------------------------------------------ */ 8099static int 8100ipf_geniter(softc, token, itp) 8101 ipf_main_softc_t *softc; 8102 ipftoken_t *token; 8103 ipfgeniter_t *itp; 8104{ 8105 int error; 8106 8107 switch (itp->igi_type) 8108 { 8109 case IPFGENITER_FRAG : 8110 error = ipf_frag_pkt_next(softc, token, itp); 8111 break; 8112 default : 8113 IPFERROR(92); 8114 error = EINVAL; 8115 break; 8116 } 8117 8118 return error; 8119} 8120 8121 8122/* ------------------------------------------------------------------------ */ 8123/* Function: ipf_genericiter */ 8124/* Returns: int - 0 = success, else error */ 8125/* Parameters: softc(I)- pointer to soft context main structure */ 8126/* data(I) - the token type to match */ 8127/* uid(I) - uid owning the token */ 8128/* ptr(I) - context pointer for the token */ 8129/* */ 8130/* Handle the SIOCGENITER ioctl for the ipfilter device. The primary role */ 8131/* ------------------------------------------------------------------------ */ 8132int 8133ipf_genericiter(softc, data, uid, ctx) 8134 ipf_main_softc_t *softc; 8135 void *data, *ctx; 8136 int uid; 8137{ 8138 ipftoken_t *token; 8139 ipfgeniter_t iter; 8140 int error; 8141 8142 error = ipf_inobj(softc, data, NULL, &iter, IPFOBJ_GENITER); 8143 if (error != 0) 8144 return error; 8145 8146 token = ipf_token_find(softc, iter.igi_type, uid, ctx); 8147 if (token != NULL) { 8148 token->ipt_subtype = iter.igi_type; 8149 error = ipf_geniter(softc, token, &iter); 8150 WRITE_ENTER(&softc->ipf_tokens); 8151 ipf_token_deref(softc, token); 8152 RWLOCK_EXIT(&softc->ipf_tokens); 8153 } else { 8154 IPFERROR(93); 8155 error = 0; 8156 } 8157 8158 return error; 8159} 8160 8161 8162/* ------------------------------------------------------------------------ */ 8163/* Function: ipf_ipf_ioctl */ 8164/* Returns: int - 0 = success, else error */ 8165/* Parameters: softc(I)- pointer to soft context main structure */ 8166/* data(I) - the token type to match */ 8167/* cmd(I) - the ioctl command number */ 8168/* mode(I) - mode flags for the ioctl */ 8169/* uid(I) - uid owning the token */ 8170/* ptr(I) - context pointer for the token */ 8171/* */ 8172/* This function handles all of the ioctl command that are actually isssued */ 8173/* to the /dev/ipl device. */ 8174/* ------------------------------------------------------------------------ */ 8175int 8176ipf_ipf_ioctl(softc, data, cmd, mode, uid, ctx) 8177 ipf_main_softc_t *softc; 8178 caddr_t data; 8179 ioctlcmd_t cmd; 8180 int mode, uid; 8181 void *ctx; 8182{ 8183 friostat_t fio; 8184 int error, tmp; 8185 ipfobj_t obj; 8186 SPL_INT(s); 8187 8188 switch (cmd) 8189 { 8190 case SIOCFRENB : 8191 if (!(mode & FWRITE)) { 8192 IPFERROR(94); 8193 error = EPERM; 8194 } else { 8195 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8196 if (error != 0) { 8197 IPFERROR(95); 8198 error = EFAULT; 8199 break; 8200 } 8201 8202 WRITE_ENTER(&softc->ipf_global); 8203 if (tmp) { 8204 if (softc->ipf_running > 0) 8205 error = 0; 8206 else 8207 error = ipfattach(softc); 8208 if (error == 0) 8209 softc->ipf_running = 1; 8210 else 8211 (void) ipfdetach(softc); 8212 } else { 8213 if (softc->ipf_running == 1) 8214 error = ipfdetach(softc); 8215 else 8216 error = 0; 8217 if (error == 0) 8218 softc->ipf_running = -1; 8219 } 8220 RWLOCK_EXIT(&softc->ipf_global); 8221 } 8222 break; 8223 8224 case SIOCIPFSET : 8225 if (!(mode & FWRITE)) { 8226 IPFERROR(96); 8227 error = EPERM; 8228 break; 8229 } 8230 /* FALLTHRU */ 8231 case SIOCIPFGETNEXT : 8232 case SIOCIPFGET : 8233 error = ipf_ipftune(softc, cmd, (void *)data); 8234 break; 8235 8236 case SIOCSETFF : 8237 if (!(mode & FWRITE)) { 8238 IPFERROR(97); 8239 error = EPERM; 8240 } else { 8241 error = BCOPYIN(data, &softc->ipf_flags, 8242 sizeof(softc->ipf_flags)); 8243 if (error != 0) { 8244 IPFERROR(98); 8245 error = EFAULT; 8246 } 8247 } 8248 break; 8249 8250 case SIOCGETFF : 8251 error = BCOPYOUT(&softc->ipf_flags, data, 8252 sizeof(softc->ipf_flags)); 8253 if (error != 0) { 8254 IPFERROR(99); 8255 error = EFAULT; 8256 } 8257 break; 8258 8259 case SIOCFUNCL : 8260 error = ipf_resolvefunc(softc, (void *)data); 8261 break; 8262 8263 case SIOCINAFR : 8264 case SIOCRMAFR : 8265 case SIOCADAFR : 8266 case SIOCZRLST : 8267 if (!(mode & FWRITE)) { 8268 IPFERROR(100); 8269 error = EPERM; 8270 } else { 8271 error = frrequest(softc, IPL_LOGIPF, cmd, (caddr_t)data, 8272 softc->ipf_active, 1); 8273 } 8274 break; 8275 8276 case SIOCINIFR : 8277 case SIOCRMIFR : 8278 case SIOCADIFR : 8279 if (!(mode & FWRITE)) { 8280 IPFERROR(101); 8281 error = EPERM; 8282 } else { 8283 error = frrequest(softc, IPL_LOGIPF, cmd, (caddr_t)data, 8284 1 - softc->ipf_active, 1); 8285 } 8286 break; 8287 8288 case SIOCSWAPA : 8289 if (!(mode & FWRITE)) { 8290 IPFERROR(102); 8291 error = EPERM; 8292 } else { 8293 WRITE_ENTER(&softc->ipf_mutex); 8294 error = BCOPYOUT(&softc->ipf_active, data, 8295 sizeof(softc->ipf_active)); 8296 if (error != 0) { 8297 IPFERROR(103); 8298 error = EFAULT; 8299 } else { 8300 softc->ipf_active = 1 - softc->ipf_active; 8301 } 8302 RWLOCK_EXIT(&softc->ipf_mutex); 8303 } 8304 break; 8305 8306 case SIOCGETFS : 8307 error = ipf_inobj(softc, (void *)data, &obj, &fio, 8308 IPFOBJ_IPFSTAT); 8309 if (error != 0) 8310 break; 8311 ipf_getstat(softc, &fio, obj.ipfo_rev); 8312 error = ipf_outobj(softc, (void *)data, &fio, IPFOBJ_IPFSTAT); 8313 break; 8314 8315 case SIOCFRZST : 8316 if (!(mode & FWRITE)) { 8317 IPFERROR(104); 8318 error = EPERM; 8319 } else 8320 error = ipf_zerostats(softc, (caddr_t)data); 8321 break; 8322 8323 case SIOCIPFFL : 8324 if (!(mode & FWRITE)) { 8325 IPFERROR(105); 8326 error = EPERM; 8327 } else { 8328 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8329 if (!error) { 8330 tmp = ipf_flush(softc, IPL_LOGIPF, tmp); 8331 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8332 if (error != 0) { 8333 IPFERROR(106); 8334 error = EFAULT; 8335 } 8336 } else { 8337 IPFERROR(107); 8338 error = EFAULT; 8339 } 8340 } 8341 break; 8342 8343#ifdef USE_INET6 8344 case SIOCIPFL6 : 8345 if (!(mode & FWRITE)) { 8346 IPFERROR(108); 8347 error = EPERM; 8348 } else { 8349 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8350 if (!error) { 8351 tmp = ipf_flush(softc, IPL_LOGIPF, tmp); 8352 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8353 if (error != 0) { 8354 IPFERROR(109); 8355 error = EFAULT; 8356 } 8357 } else { 8358 IPFERROR(110); 8359 error = EFAULT; 8360 } 8361 } 8362 break; 8363#endif 8364 8365 case SIOCSTLCK : 8366 if (!(mode & FWRITE)) { 8367 IPFERROR(122); 8368 error = EPERM; 8369 } else { 8370 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8371 if (error == 0) { 8372 ipf_state_setlock(softc->ipf_state_soft, tmp); 8373 ipf_nat_setlock(softc->ipf_nat_soft, tmp); 8374 ipf_frag_setlock(softc->ipf_frag_soft, tmp); 8375 ipf_auth_setlock(softc->ipf_auth_soft, tmp); 8376 } else { 8377 IPFERROR(111); 8378 error = EFAULT; 8379 } 8380 } 8381 break; 8382 8383#ifdef IPFILTER_LOG 8384 case SIOCIPFFB : 8385 if (!(mode & FWRITE)) { 8386 IPFERROR(112); 8387 error = EPERM; 8388 } else { 8389 tmp = ipf_log_clear(softc, IPL_LOGIPF); 8390 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8391 if (error) { 8392 IPFERROR(113); 8393 error = EFAULT; 8394 } 8395 } 8396 break; 8397#endif /* IPFILTER_LOG */ 8398 8399 case SIOCFRSYN : 8400 if (!(mode & FWRITE)) { 8401 IPFERROR(114); 8402 error = EPERM; 8403 } else { 8404 WRITE_ENTER(&softc->ipf_global); 8405#if (defined(MENTAT) && defined(_KERNEL)) && !defined(INSTANCES) 8406 error = ipfsync(); 8407#else 8408 ipf_sync(softc, NULL); 8409 error = 0; 8410#endif 8411 RWLOCK_EXIT(&softc->ipf_global); 8412 8413 } 8414 break; 8415 8416 case SIOCGFRST : 8417 error = ipf_outobj(softc, (void *)data, 8418 ipf_frag_stats(softc->ipf_frag_soft), 8419 IPFOBJ_FRAGSTAT); 8420 break; 8421 8422#ifdef IPFILTER_LOG 8423 case FIONREAD : 8424 tmp = ipf_log_bytesused(softc, IPL_LOGIPF); 8425 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8426 break; 8427#endif 8428 8429 case SIOCIPFITER : 8430 SPL_SCHED(s); 8431 error = ipf_frruleiter(softc, data, uid, ctx); 8432 SPL_X(s); 8433 break; 8434 8435 case SIOCGENITER : 8436 SPL_SCHED(s); 8437 error = ipf_genericiter(softc, data, uid, ctx); 8438 SPL_X(s); 8439 break; 8440 8441 case SIOCIPFDELTOK : 8442 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8443 if (error == 0) { 8444 SPL_SCHED(s); 8445 error = ipf_token_del(softc, tmp, uid, ctx); 8446 SPL_X(s); 8447 } 8448 break; 8449 8450 default : 8451 IPFERROR(115); 8452 error = EINVAL; 8453 break; 8454 } 8455 8456 return error; 8457} 8458 8459 8460/* ------------------------------------------------------------------------ */ 8461/* Function: ipf_decaps */ 8462/* Returns: int - -1 == decapsulation failed, else bit mask of */ 8463/* flags indicating packet filtering decision. */ 8464/* Parameters: fin(I) - pointer to packet information */ 8465/* pass(I) - IP protocol version to match */ 8466/* l5proto(I) - layer 5 protocol to decode UDP data as. */ 8467/* */ 8468/* This function is called for packets that are wrapt up in other packets, */ 8469/* for example, an IP packet that is the entire data segment for another IP */ 8470/* packet. If the basic constraints for this are satisfied, change the */ 8471/* buffer to point to the start of the inner packet and start processing */ 8472/* rules belonging to the head group this rule specifies. */ 8473/* ------------------------------------------------------------------------ */ 8474u_32_t 8475ipf_decaps(fin, pass, l5proto) 8476 fr_info_t *fin; 8477 u_32_t pass; 8478 int l5proto; 8479{ 8480 fr_info_t fin2, *fino = NULL; 8481 int elen, hlen, nh; 8482 grehdr_t gre; 8483 ip_t *ip; 8484 mb_t *m; 8485 8486 if ((fin->fin_flx & FI_COALESCE) == 0) 8487 if (ipf_coalesce(fin) == -1) 8488 goto cantdecaps; 8489 8490 m = fin->fin_m; 8491 hlen = fin->fin_hlen; 8492 8493 switch (fin->fin_p) 8494 { 8495 case IPPROTO_UDP : 8496 /* 8497 * In this case, the specific protocol being decapsulated 8498 * inside UDP frames comes from the rule. 8499 */ 8500 nh = fin->fin_fr->fr_icode; 8501 break; 8502 8503 case IPPROTO_GRE : /* 47 */ 8504 bcopy(fin->fin_dp, (char *)&gre, sizeof(gre)); 8505 hlen += sizeof(grehdr_t); 8506 if (gre.gr_R|gre.gr_s) 8507 goto cantdecaps; 8508 if (gre.gr_C) 8509 hlen += 4; 8510 if (gre.gr_K) 8511 hlen += 4; 8512 if (gre.gr_S) 8513 hlen += 4; 8514 8515 nh = IPPROTO_IP; 8516 8517 /* 8518 * If the routing options flag is set, validate that it is 8519 * there and bounce over it. 8520 */ 8521#if 0 8522 /* This is really heavy weight and lots of room for error, */ 8523 /* so for now, put it off and get the simple stuff right. */ 8524 if (gre.gr_R) { 8525 u_char off, len, *s; 8526 u_short af; 8527 int end; 8528 8529 end = 0; 8530 s = fin->fin_dp; 8531 s += hlen; 8532 aplen = fin->fin_plen - hlen; 8533 while (aplen > 3) { 8534 af = (s[0] << 8) | s[1]; 8535 off = s[2]; 8536 len = s[3]; 8537 aplen -= 4; 8538 s += 4; 8539 if (af == 0 && len == 0) { 8540 end = 1; 8541 break; 8542 } 8543 if (aplen < len) 8544 break; 8545 s += len; 8546 aplen -= len; 8547 } 8548 if (end != 1) 8549 goto cantdecaps; 8550 hlen = s - (u_char *)fin->fin_dp; 8551 } 8552#endif 8553 break; 8554 8555#ifdef IPPROTO_IPIP 8556 case IPPROTO_IPIP : /* 4 */ 8557#endif 8558 nh = IPPROTO_IP; 8559 break; 8560 8561 default : /* Includes ESP, AH is special for IPv4 */ 8562 goto cantdecaps; 8563 } 8564 8565 switch (nh) 8566 { 8567 case IPPROTO_IP : 8568 case IPPROTO_IPV6 : 8569 break; 8570 default : 8571 goto cantdecaps; 8572 } 8573 8574 bcopy((char *)fin, (char *)&fin2, sizeof(fin2)); 8575 fino = fin; 8576 fin = &fin2; 8577 elen = hlen; 8578#if defined(MENTAT) && defined(_KERNEL) 8579 m->b_rptr += elen; 8580#else 8581 m->m_data += elen; 8582 m->m_len -= elen; 8583#endif 8584 fin->fin_plen -= elen; 8585 8586 ip = (ip_t *)((char *)fin->fin_ip + elen); 8587 8588 /* 8589 * Make sure we have at least enough data for the network layer 8590 * header. 8591 */ 8592 if (IP_V(ip) == 4) 8593 hlen = IP_HL(ip) << 2; 8594#ifdef USE_INET6 8595 else if (IP_V(ip) == 6) 8596 hlen = sizeof(ip6_t); 8597#endif 8598 else 8599 goto cantdecaps2; 8600 8601 if (fin->fin_plen < hlen) 8602 goto cantdecaps2; 8603 8604 fin->fin_dp = (char *)ip + hlen; 8605 8606 if (IP_V(ip) == 4) { 8607 /* 8608 * Perform IPv4 header checksum validation. 8609 */ 8610 if (ipf_cksum((u_short *)ip, hlen)) 8611 goto cantdecaps2; 8612 } 8613 8614 if (ipf_makefrip(hlen, ip, fin) == -1) { 8615cantdecaps2: 8616 if (m != NULL) { 8617#if defined(MENTAT) && defined(_KERNEL) 8618 m->b_rptr -= elen; 8619#else 8620 m->m_data -= elen; 8621 m->m_len += elen; 8622#endif 8623 } 8624cantdecaps: 8625 DT1(frb_decapfrip, fr_info_t *, fin); 8626 pass &= ~FR_CMDMASK; 8627 pass |= FR_BLOCK|FR_QUICK; 8628 fin->fin_reason = FRB_DECAPFRIP; 8629 return -1; 8630 } 8631 8632 pass = ipf_scanlist(fin, pass); 8633 8634 /* 8635 * Copy the packet filter "result" fields out of the fr_info_t struct 8636 * that is local to the decapsulation processing and back into the 8637 * one we were called with. 8638 */ 8639 fino->fin_flx = fin->fin_flx; 8640 fino->fin_rev = fin->fin_rev; 8641 fino->fin_icode = fin->fin_icode; 8642 fino->fin_rule = fin->fin_rule; 8643 (void) strncpy(fino->fin_group, fin->fin_group, FR_GROUPLEN); 8644 fino->fin_fr = fin->fin_fr; 8645 fino->fin_error = fin->fin_error; 8646 fino->fin_mp = fin->fin_mp; 8647 fino->fin_m = fin->fin_m; 8648 m = fin->fin_m; 8649 if (m != NULL) { 8650#if defined(MENTAT) && defined(_KERNEL) 8651 m->b_rptr -= elen; 8652#else 8653 m->m_data -= elen; 8654 m->m_len += elen; 8655#endif 8656 } 8657 return pass; 8658} 8659 8660 8661/* ------------------------------------------------------------------------ */ 8662/* Function: ipf_matcharray_load */ 8663/* Returns: int - 0 = success, else error */ 8664/* Parameters: softc(I) - pointer to soft context main structure */ 8665/* data(I) - pointer to ioctl data */ 8666/* objp(I) - ipfobj_t structure to load data into */ 8667/* arrayptr(I) - pointer to location to store array pointer */ 8668/* */ 8669/* This function loads in a mathing array through the ipfobj_t struct that */ 8670/* describes it. Sanity checking and array size limitations are enforced */ 8671/* in this function to prevent userspace from trying to load in something */ 8672/* that is insanely big. Once the size of the array is known, the memory */ 8673/* required is malloc'd and returned through changing *arrayptr. The */ 8674/* contents of the array are verified before returning. Only in the event */ 8675/* of a successful call is the caller required to free up the malloc area. */ 8676/* ------------------------------------------------------------------------ */ 8677int 8678ipf_matcharray_load(softc, data, objp, arrayptr) 8679 ipf_main_softc_t *softc; 8680 caddr_t data; 8681 ipfobj_t *objp; 8682 int **arrayptr; 8683{ 8684 int arraysize, *array, error; 8685 8686 *arrayptr = NULL; 8687 8688 error = BCOPYIN(data, objp, sizeof(*objp)); 8689 if (error != 0) { 8690 IPFERROR(116); 8691 return EFAULT; 8692 } 8693 8694 if (objp->ipfo_type != IPFOBJ_IPFEXPR) { 8695 IPFERROR(117); 8696 return EINVAL; 8697 } 8698 8699 if (((objp->ipfo_size & 3) != 0) || (objp->ipfo_size == 0) || 8700 (objp->ipfo_size > 1024)) { 8701 IPFERROR(118); 8702 return EINVAL; 8703 } 8704 8705 arraysize = objp->ipfo_size * sizeof(*array); 8706 KMALLOCS(array, int *, arraysize); 8707 if (array == NULL) { 8708 IPFERROR(119); 8709 return ENOMEM; 8710 } 8711 8712 error = COPYIN(objp->ipfo_ptr, array, arraysize); 8713 if (error != 0) { 8714 KFREES(array, arraysize); 8715 IPFERROR(120); 8716 return EFAULT; 8717 } 8718 8719 if (ipf_matcharray_verify(array, arraysize) != 0) { 8720 KFREES(array, arraysize); 8721 IPFERROR(121); 8722 return EINVAL; 8723 } 8724 8725 *arrayptr = array; 8726 return 0; 8727} 8728 8729 8730/* ------------------------------------------------------------------------ */ 8731/* Function: ipf_matcharray_verify */ 8732/* Returns: Nil */ 8733/* Parameters: array(I) - pointer to matching array */ 8734/* arraysize(I) - number of elements in the array */ 8735/* */ 8736/* Verify the contents of a matching array by stepping through each element */ 8737/* in it. The actual commands in the array are not verified for */ 8738/* correctness, only that all of the sizes are correctly within limits. */ 8739/* ------------------------------------------------------------------------ */ 8740int 8741ipf_matcharray_verify(array, arraysize) 8742 int *array, arraysize; 8743{ 8744 int i, nelem, maxidx; 8745 ipfexp_t *e; 8746 8747 nelem = arraysize / sizeof(*array); 8748 8749 /* 8750 * Currently, it makes no sense to have an array less than 6 8751 * elements long - the initial size at the from, a single operation 8752 * (minimum 4 in length) and a trailer, for a total of 6. 8753 */ 8754 if ((array[0] < 6) || (arraysize < 24) || (arraysize > 4096)) { 8755 return -1; 8756 } 8757 8758 /* 8759 * Verify the size of data pointed to by array with how long 8760 * the array claims to be itself. 8761 */ 8762 if (array[0] * sizeof(*array) != arraysize) { 8763 return -1; 8764 } 8765 8766 maxidx = nelem - 1; 8767 /* 8768 * The last opcode in this array should be an IPF_EXP_END. 8769 */ 8770 if (array[maxidx] != IPF_EXP_END) { 8771 return -1; 8772 } 8773 8774 for (i = 1; i < maxidx; ) { 8775 e = (ipfexp_t *)(array + i); 8776 8777 /* 8778 * The length of the bits to check must be at least 1 8779 * (or else there is nothing to comapre with!) and it 8780 * cannot exceed the length of the data present. 8781 */ 8782 if ((e->ipfe_size < 1 ) || 8783 (e->ipfe_size + i > maxidx)) { 8784 return -1; 8785 } 8786 i += e->ipfe_size; 8787 } 8788 return 0; 8789} 8790 8791 8792/* ------------------------------------------------------------------------ */ 8793/* Function: ipf_fr_matcharray */ 8794/* Returns: int - 0 = match failed, else positive match */ 8795/* Parameters: fin(I) - pointer to packet information */ 8796/* array(I) - pointer to matching array */ 8797/* */ 8798/* This function is used to apply a matching array against a packet and */ 8799/* return an indication of whether or not the packet successfully matches */ 8800/* all of the commands in it. */ 8801/* ------------------------------------------------------------------------ */ 8802static int 8803ipf_fr_matcharray(fin, array) 8804 fr_info_t *fin; 8805 int *array; 8806{ 8807 int i, n, *x, rv, p; 8808 ipfexp_t *e; 8809 8810 rv = 0; 8811 n = array[0]; 8812 x = array + 1; 8813 8814 for (; n > 0; x += 3 + x[3], rv = 0) { 8815 e = (ipfexp_t *)x; 8816 if (e->ipfe_cmd == IPF_EXP_END) 8817 break; 8818 n -= e->ipfe_size; 8819 8820 /* 8821 * The upper 16 bits currently store the protocol value. 8822 * This is currently used with TCP and UDP port compares and 8823 * allows "tcp.port = 80" without requiring an explicit 8824 " "ip.pr = tcp" first. 8825 */ 8826 p = e->ipfe_cmd >> 16; 8827 if ((p != 0) && (p != fin->fin_p)) 8828 break; 8829 8830 switch (e->ipfe_cmd) 8831 { 8832 case IPF_EXP_IP_PR : 8833 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8834 rv |= (fin->fin_p == e->ipfe_arg0[i]); 8835 } 8836 break; 8837 8838 case IPF_EXP_IP_SRCADDR : 8839 if (fin->fin_v != 4) 8840 break; 8841 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8842 rv |= ((fin->fin_saddr & 8843 e->ipfe_arg0[i * 2 + 1]) == 8844 e->ipfe_arg0[i * 2]); 8845 } 8846 break; 8847 8848 case IPF_EXP_IP_DSTADDR : 8849 if (fin->fin_v != 4) 8850 break; 8851 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8852 rv |= ((fin->fin_daddr & 8853 e->ipfe_arg0[i * 2 + 1]) == 8854 e->ipfe_arg0[i * 2]); 8855 } 8856 break; 8857 8858 case IPF_EXP_IP_ADDR : 8859 if (fin->fin_v != 4) 8860 break; 8861 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8862 rv |= ((fin->fin_saddr & 8863 e->ipfe_arg0[i * 2 + 1]) == 8864 e->ipfe_arg0[i * 2]) || 8865 ((fin->fin_daddr & 8866 e->ipfe_arg0[i * 2 + 1]) == 8867 e->ipfe_arg0[i * 2]); 8868 } 8869 break; 8870 8871#ifdef USE_INET6 8872 case IPF_EXP_IP6_SRCADDR : 8873 if (fin->fin_v != 6) 8874 break; 8875 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8876 rv |= IP6_MASKEQ(&fin->fin_src6, 8877 &e->ipfe_arg0[i * 8 + 4], 8878 &e->ipfe_arg0[i * 8]); 8879 } 8880 break; 8881 8882 case IPF_EXP_IP6_DSTADDR : 8883 if (fin->fin_v != 6) 8884 break; 8885 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8886 rv |= IP6_MASKEQ(&fin->fin_dst6, 8887 &e->ipfe_arg0[i * 8 + 4], 8888 &e->ipfe_arg0[i * 8]); 8889 } 8890 break; 8891 8892 case IPF_EXP_IP6_ADDR : 8893 if (fin->fin_v != 6) 8894 break; 8895 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8896 rv |= IP6_MASKEQ(&fin->fin_src6, 8897 &e->ipfe_arg0[i * 8 + 4], 8898 &e->ipfe_arg0[i * 8]) || 8899 IP6_MASKEQ(&fin->fin_dst6, 8900 &e->ipfe_arg0[i * 8 + 4], 8901 &e->ipfe_arg0[i * 8]); 8902 } 8903 break; 8904#endif 8905 8906 case IPF_EXP_UDP_PORT : 8907 case IPF_EXP_TCP_PORT : 8908 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8909 rv |= (fin->fin_sport == e->ipfe_arg0[i]) || 8910 (fin->fin_dport == e->ipfe_arg0[i]); 8911 } 8912 break; 8913 8914 case IPF_EXP_UDP_SPORT : 8915 case IPF_EXP_TCP_SPORT : 8916 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8917 rv |= (fin->fin_sport == e->ipfe_arg0[i]); 8918 } 8919 break; 8920 8921 case IPF_EXP_UDP_DPORT : 8922 case IPF_EXP_TCP_DPORT : 8923 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8924 rv |= (fin->fin_dport == e->ipfe_arg0[i]); 8925 } 8926 break; 8927 8928 case IPF_EXP_TCP_FLAGS : 8929 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8930 rv |= ((fin->fin_tcpf & 8931 e->ipfe_arg0[i * 2 + 1]) == 8932 e->ipfe_arg0[i * 2]); 8933 } 8934 break; 8935 } 8936 rv ^= e->ipfe_not; 8937 8938 if (rv == 0) 8939 break; 8940 } 8941 8942 return rv; 8943} 8944 8945 8946/* ------------------------------------------------------------------------ */ 8947/* Function: ipf_queueflush */ 8948/* Returns: int - number of entries flushed (0 = none) */ 8949/* Parameters: softc(I) - pointer to soft context main structure */ 8950/* deletefn(I) - function to call to delete entry */ 8951/* ipfqs(I) - top of the list of ipf internal queues */ 8952/* userqs(I) - top of the list of user defined timeouts */ 8953/* */ 8954/* This fucntion gets called when the state/NAT hash tables fill up and we */ 8955/* need to try a bit harder to free up some space. The algorithm used here */ 8956/* split into two parts but both halves have the same goal: to reduce the */ 8957/* number of connections considered to be "active" to the low watermark. */ 8958/* There are two steps in doing this: */ 8959/* 1) Remove any TCP connections that are already considered to be "closed" */ 8960/* but have not yet been removed from the state table. The two states */ 8961/* TCPS_TIME_WAIT and TCPS_CLOSED are considered to be the perfect */ 8962/* candidates for this style of removal. If freeing up entries in */ 8963/* CLOSED or both CLOSED and TIME_WAIT brings us to the low watermark, */ 8964/* we do not go on to step 2. */ 8965/* */ 8966/* 2) Look for the oldest entries on each timeout queue and free them if */ 8967/* they are within the given window we are considering. Where the */ 8968/* window starts and the steps taken to increase its size depend upon */ 8969/* how long ipf has been running (ipf_ticks.) Anything modified in the */ 8970/* last 30 seconds is not touched. */ 8971/* touched */ 8972/* die ipf_ticks 30*1.5 1800*1.5 | 43200*1.5 */ 8973/* | | | | | | */ 8974/* future <--+----------+--------+-----------+-----+-----+-----------> past */ 8975/* now \_int=30s_/ \_int=1hr_/ \_int=12hr */ 8976/* */ 8977/* Points to note: */ 8978/* - tqe_die is the time, in the future, when entries die. */ 8979/* - tqe_die - ipf_ticks is how long left the connection has to live in ipf */ 8980/* ticks. */ 8981/* - tqe_touched is when the entry was last used by NAT/state */ 8982/* - the closer tqe_touched is to ipf_ticks, the further tqe_die will be */ 8983/* ipf_ticks any given timeout queue and vice versa. */ 8984/* - both tqe_die and tqe_touched increase over time */ 8985/* - timeout queues are sorted with the highest value of tqe_die at the */ 8986/* bottom and therefore the smallest values of each are at the top */ 8987/* - the pointer passed in as ipfqs should point to an array of timeout */ 8988/* queues representing each of the TCP states */ 8989/* */ 8990/* We start by setting up a maximum range to scan for things to move of */ 8991/* iend (newest) to istart (oldest) in chunks of "interval". If nothing is */ 8992/* found in that range, "interval" is adjusted (so long as it isn't 30) and */ 8993/* we start again with a new value for "iend" and "istart". This is */ 8994/* continued until we either finish the scan of 30 second intervals or the */ 8995/* low water mark is reached. */ 8996/* ------------------------------------------------------------------------ */ 8997int 8998ipf_queueflush(softc, deletefn, ipfqs, userqs, activep, size, low) 8999 ipf_main_softc_t *softc; 9000 ipftq_delete_fn_t deletefn; 9001 ipftq_t *ipfqs, *userqs; 9002 u_int *activep; 9003 int size, low; 9004{ 9005 u_long interval, istart, iend; 9006 ipftq_t *ifq, *ifqnext; 9007 ipftqent_t *tqe, *tqn; 9008 int removed = 0; 9009 9010 for (tqn = ipfqs[IPF_TCPS_CLOSED].ifq_head; ((tqe = tqn) != NULL); ) { 9011 tqn = tqe->tqe_next; 9012 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 9013 removed++; 9014 } 9015 if ((*activep * 100 / size) > low) { 9016 for (tqn = ipfqs[IPF_TCPS_TIME_WAIT].ifq_head; 9017 ((tqe = tqn) != NULL); ) { 9018 tqn = tqe->tqe_next; 9019 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 9020 removed++; 9021 } 9022 } 9023 9024 if ((*activep * 100 / size) <= low) { 9025 return removed; 9026 } 9027 9028 /* 9029 * NOTE: Use of "* 15 / 10" is required here because if "* 1.5" is 9030 * used then the operations are upgraded to floating point 9031 * and kernels don't like floating point... 9032 */ 9033 if (softc->ipf_ticks > IPF_TTLVAL(43200 * 15 / 10)) { 9034 istart = IPF_TTLVAL(86400 * 4); 9035 interval = IPF_TTLVAL(43200); 9036 } else if (softc->ipf_ticks > IPF_TTLVAL(1800 * 15 / 10)) { 9037 istart = IPF_TTLVAL(43200); 9038 interval = IPF_TTLVAL(1800); 9039 } else if (softc->ipf_ticks > IPF_TTLVAL(30 * 15 / 10)) { 9040 istart = IPF_TTLVAL(1800); 9041 interval = IPF_TTLVAL(30); 9042 } else { 9043 return 0; 9044 } 9045 if (istart > softc->ipf_ticks) { 9046 if (softc->ipf_ticks - interval < interval) 9047 istart = interval; 9048 else 9049 istart = (softc->ipf_ticks / interval) * interval; 9050 } 9051 9052 iend = softc->ipf_ticks - interval; 9053 9054 while ((*activep * 100 / size) > low) { 9055 u_long try; 9056 9057 try = softc->ipf_ticks - istart; 9058 9059 for (ifq = ipfqs; ifq != NULL; ifq = ifq->ifq_next) { 9060 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 9061 if (try < tqe->tqe_touched) 9062 break; 9063 tqn = tqe->tqe_next; 9064 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 9065 removed++; 9066 } 9067 } 9068 9069 for (ifq = userqs; ifq != NULL; ifq = ifqnext) { 9070 ifqnext = ifq->ifq_next; 9071 9072 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 9073 if (try < tqe->tqe_touched) 9074 break; 9075 tqn = tqe->tqe_next; 9076 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 9077 removed++; 9078 } 9079 } 9080 9081 if (try >= iend) { 9082 if (interval == IPF_TTLVAL(43200)) { 9083 interval = IPF_TTLVAL(1800); 9084 } else if (interval == IPF_TTLVAL(1800)) { 9085 interval = IPF_TTLVAL(30); 9086 } else { 9087 break; 9088 } 9089 if (interval >= softc->ipf_ticks) 9090 break; 9091 9092 iend = softc->ipf_ticks - interval; 9093 } 9094 istart -= interval; 9095 } 9096 9097 return removed; 9098} 9099 9100 9101/* ------------------------------------------------------------------------ */ 9102/* Function: ipf_deliverlocal */ 9103/* Returns: int - 1 = local address, 0 = non-local address */ 9104/* Parameters: softc(I) - pointer to soft context main structure */ 9105/* ipversion(I) - IP protocol version (4 or 6) */ 9106/* ifp(I) - network interface pointer */ 9107/* ipaddr(I) - IPv4/6 destination address */ 9108/* */ 9109/* This fucntion is used to determine in the address "ipaddr" belongs to */ 9110/* the network interface represented by ifp. */ 9111/* ------------------------------------------------------------------------ */ 9112int 9113ipf_deliverlocal(softc, ipversion, ifp, ipaddr) 9114 ipf_main_softc_t *softc; 9115 int ipversion; 9116 void *ifp; 9117 i6addr_t *ipaddr; 9118{ 9119 i6addr_t addr; 9120 int islocal = 0; 9121 9122 if (ipversion == 4) { 9123 if (ipf_ifpaddr(softc, 4, FRI_NORMAL, ifp, &addr, NULL) == 0) { 9124 if (addr.in4.s_addr == ipaddr->in4.s_addr) 9125 islocal = 1; 9126 } 9127 9128#ifdef USE_INET6 9129 } else if (ipversion == 6) { 9130 if (ipf_ifpaddr(softc, 6, FRI_NORMAL, ifp, &addr, NULL) == 0) { 9131 if (IP6_EQ(&addr, ipaddr)) 9132 islocal = 1; 9133 } 9134#endif 9135 } 9136 9137 return islocal; 9138} 9139 9140 9141/* ------------------------------------------------------------------------ */ 9142/* Function: ipf_settimeout */ 9143/* Returns: int - 0 = success, -1 = failure */ 9144/* Parameters: softc(I) - pointer to soft context main structure */ 9145/* t(I) - pointer to tuneable array entry */ 9146/* p(I) - pointer to values passed in to apply */ 9147/* */ 9148/* This function is called to set the timeout values for each distinct */ 9149/* queue timeout that is available. When called, it calls into both the */ 9150/* state and NAT code, telling them to update their timeout queues. */ 9151/* ------------------------------------------------------------------------ */ 9152static int 9153ipf_settimeout(softc, t, p) 9154 struct ipf_main_softc_s *softc; 9155 ipftuneable_t *t; 9156 ipftuneval_t *p; 9157{ 9158 9159 /* 9160 * ipf_interror should be set by the functions called here, not 9161 * by this function - it's just a middle man. 9162 */ 9163 if (ipf_state_settimeout(softc, t, p) == -1) 9164 return -1; 9165 if (ipf_nat_settimeout(softc, t, p) == -1) 9166 return -1; 9167 return 0; 9168} 9169 9170 9171/* ------------------------------------------------------------------------ */ 9172/* Function: ipf_apply_timeout */ 9173/* Returns: int - 0 = success, -1 = failure */ 9174/* Parameters: head(I) - pointer to tuneable array entry */ 9175/* seconds(I) - pointer to values passed in to apply */ 9176/* */ 9177/* This function applies a timeout of "seconds" to the timeout queue that */ 9178/* is pointed to by "head". All entries on this list have an expiration */ 9179/* set to be the current tick value of ipf plus the ttl. Given that this */ 9180/* function should only be called when the delta is non-zero, the task is */ 9181/* to walk the entire list and apply the change. The sort order will not */ 9182/* change. The only catch is that this is O(n) across the list, so if the */ 9183/* queue has lots of entries (10s of thousands or 100s of thousands), it */ 9184/* could take a relatively long time to work through them all. */ 9185/* ------------------------------------------------------------------------ */ 9186void 9187ipf_apply_timeout(head, seconds) 9188 ipftq_t *head; 9189 u_int seconds; 9190{ 9191 u_int oldtimeout, newtimeout; 9192 ipftqent_t *tqe; 9193 int delta; 9194 9195 MUTEX_ENTER(&head->ifq_lock); 9196 oldtimeout = head->ifq_ttl; 9197 newtimeout = IPF_TTLVAL(seconds); 9198 delta = oldtimeout - newtimeout; 9199 9200 head->ifq_ttl = newtimeout; 9201 9202 for (tqe = head->ifq_head; tqe != NULL; tqe = tqe->tqe_next) { 9203 tqe->tqe_die += delta; 9204 } 9205 MUTEX_EXIT(&head->ifq_lock); 9206} 9207 9208 9209/* ------------------------------------------------------------------------ */ 9210/* Function: ipf_settimeout_tcp */ 9211/* Returns: int - 0 = successfully applied, -1 = failed */ 9212/* Parameters: t(I) - pointer to tuneable to change */ 9213/* p(I) - pointer to new timeout information */ 9214/* tab(I) - pointer to table of TCP queues */ 9215/* */ 9216/* This function applies the new timeout (p) to the TCP tunable (t) and */ 9217/* updates all of the entries on the relevant timeout queue by calling */ 9218/* ipf_apply_timeout(). */ 9219/* ------------------------------------------------------------------------ */ 9220int 9221ipf_settimeout_tcp(t, p, tab) 9222 ipftuneable_t *t; 9223 ipftuneval_t *p; 9224 ipftq_t *tab; 9225{ 9226 if (!strcmp(t->ipft_name, "tcp_idle_timeout") || 9227 !strcmp(t->ipft_name, "tcp_established")) { 9228 ipf_apply_timeout(&tab[IPF_TCPS_ESTABLISHED], p->ipftu_int); 9229 } else if (!strcmp(t->ipft_name, "tcp_close_wait")) { 9230 ipf_apply_timeout(&tab[IPF_TCPS_CLOSE_WAIT], p->ipftu_int); 9231 } else if (!strcmp(t->ipft_name, "tcp_last_ack")) { 9232 ipf_apply_timeout(&tab[IPF_TCPS_LAST_ACK], p->ipftu_int); 9233 } else if (!strcmp(t->ipft_name, "tcp_timeout")) { 9234 ipf_apply_timeout(&tab[IPF_TCPS_LISTEN], p->ipftu_int); 9235 ipf_apply_timeout(&tab[IPF_TCPS_HALF_ESTAB], p->ipftu_int); 9236 ipf_apply_timeout(&tab[IPF_TCPS_CLOSING], p->ipftu_int); 9237 } else if (!strcmp(t->ipft_name, "tcp_listen")) { 9238 ipf_apply_timeout(&tab[IPF_TCPS_LISTEN], p->ipftu_int); 9239 } else if (!strcmp(t->ipft_name, "tcp_half_established")) { 9240 ipf_apply_timeout(&tab[IPF_TCPS_HALF_ESTAB], p->ipftu_int); 9241 } else if (!strcmp(t->ipft_name, "tcp_closing")) { 9242 ipf_apply_timeout(&tab[IPF_TCPS_CLOSING], p->ipftu_int); 9243 } else if (!strcmp(t->ipft_name, "tcp_syn_received")) { 9244 ipf_apply_timeout(&tab[IPF_TCPS_SYN_RECEIVED], p->ipftu_int); 9245 } else if (!strcmp(t->ipft_name, "tcp_syn_sent")) { 9246 ipf_apply_timeout(&tab[IPF_TCPS_SYN_SENT], p->ipftu_int); 9247 } else if (!strcmp(t->ipft_name, "tcp_closed")) { 9248 ipf_apply_timeout(&tab[IPF_TCPS_CLOSED], p->ipftu_int); 9249 } else if (!strcmp(t->ipft_name, "tcp_half_closed")) { 9250 ipf_apply_timeout(&tab[IPF_TCPS_CLOSED], p->ipftu_int); 9251 } else if (!strcmp(t->ipft_name, "tcp_time_wait")) { 9252 ipf_apply_timeout(&tab[IPF_TCPS_TIME_WAIT], p->ipftu_int); 9253 } else { 9254 /* 9255 * ipf_interror isn't set here because it should be set 9256 * by whatever called this function. 9257 */ 9258 return -1; 9259 } 9260 return 0; 9261} 9262 9263 9264/* ------------------------------------------------------------------------ */ 9265/* Function: ipf_main_soft_create */ 9266/* Returns: NULL = failure, else success */ 9267/* Parameters: arg(I) - pointer to soft context structure if already allocd */ 9268/* */ 9269/* Create the foundation soft context structure. In circumstances where it */ 9270/* is not required to dynamically allocate the context, a pointer can be */ 9271/* passed in (rather than NULL) to a structure to be initialised. */ 9272/* The main thing of interest is that a number of locks are initialised */ 9273/* here instead of in the where might be expected - in the relevant create */ 9274/* function elsewhere. This is done because the current locking design has */ 9275/* some areas where these locks are used outside of their module. */ 9276/* Possibly the most important exercise that is done here is setting of all */ 9277/* the timeout values, allowing them to be changed before init(). */ 9278/* ------------------------------------------------------------------------ */ 9279void * 9280ipf_main_soft_create(arg) 9281 void *arg; 9282{ 9283 ipf_main_softc_t *softc; 9284 9285 if (arg == NULL) { 9286 KMALLOC(softc, ipf_main_softc_t *); 9287 if (softc == NULL) 9288 return NULL; 9289 } else { 9290 softc = arg; 9291 } 9292 9293 bzero((char *)softc, sizeof(*softc)); 9294 9295 /* 9296 * This serves as a flag as to whether or not the softc should be 9297 * free'd when _destroy is called. 9298 */ 9299 softc->ipf_dynamic_softc = (arg == NULL) ? 1 : 0; 9300 9301 softc->ipf_tuners = ipf_tune_array_copy(softc, 9302 sizeof(ipf_main_tuneables), 9303 ipf_main_tuneables); 9304 if (softc->ipf_tuners == NULL) { 9305 ipf_main_soft_destroy(softc); 9306 return NULL; 9307 } 9308 9309 MUTEX_INIT(&softc->ipf_rw, "ipf rw mutex"); 9310 MUTEX_INIT(&softc->ipf_timeoutlock, "ipf timeout lock"); 9311 RWLOCK_INIT(&softc->ipf_global, "ipf filter load/unload mutex"); 9312 RWLOCK_INIT(&softc->ipf_mutex, "ipf filter rwlock"); 9313 RWLOCK_INIT(&softc->ipf_tokens, "ipf token rwlock"); 9314 RWLOCK_INIT(&softc->ipf_state, "ipf state rwlock"); 9315 RWLOCK_INIT(&softc->ipf_nat, "ipf IP NAT rwlock"); 9316 RWLOCK_INIT(&softc->ipf_poolrw, "ipf pool rwlock"); 9317 RWLOCK_INIT(&softc->ipf_frag, "ipf frag rwlock"); 9318 9319 softc->ipf_token_head = NULL; 9320 softc->ipf_token_tail = &softc->ipf_token_head; 9321 9322 softc->ipf_tcpidletimeout = FIVE_DAYS; 9323 softc->ipf_tcpclosewait = IPF_TTLVAL(2 * TCP_MSL); 9324 softc->ipf_tcplastack = IPF_TTLVAL(30); 9325 softc->ipf_tcptimewait = IPF_TTLVAL(2 * TCP_MSL); 9326 softc->ipf_tcptimeout = IPF_TTLVAL(2 * TCP_MSL); 9327 softc->ipf_tcpsynsent = IPF_TTLVAL(2 * TCP_MSL); 9328 softc->ipf_tcpsynrecv = IPF_TTLVAL(2 * TCP_MSL); 9329 softc->ipf_tcpclosed = IPF_TTLVAL(30); 9330 softc->ipf_tcphalfclosed = IPF_TTLVAL(2 * 3600); 9331 softc->ipf_udptimeout = IPF_TTLVAL(120); 9332 softc->ipf_udpacktimeout = IPF_TTLVAL(12); 9333 softc->ipf_icmptimeout = IPF_TTLVAL(60); 9334 softc->ipf_icmpacktimeout = IPF_TTLVAL(6); 9335 softc->ipf_iptimeout = IPF_TTLVAL(60); 9336 9337#if defined(IPFILTER_DEFAULT_BLOCK) 9338 softc->ipf_pass = FR_BLOCK|FR_NOMATCH; 9339#else 9340 softc->ipf_pass = (IPF_DEFAULT_PASS)|FR_NOMATCH; 9341#endif 9342 softc->ipf_minttl = 4; 9343 softc->ipf_icmpminfragmtu = 68; 9344 softc->ipf_flags = IPF_LOGGING; 9345 9346 return softc; 9347} 9348 9349/* ------------------------------------------------------------------------ */ 9350/* Function: ipf_main_soft_init */ 9351/* Returns: 0 = success, -1 = failure */ 9352/* Parameters: softc(I) - pointer to soft context main structure */ 9353/* */ 9354/* A null-op function that exists as a placeholder so that the flow in */ 9355/* other functions is obvious. */ 9356/* ------------------------------------------------------------------------ */ 9357/*ARGSUSED*/ 9358int 9359ipf_main_soft_init(softc) 9360 ipf_main_softc_t *softc; 9361{ 9362 return 0; 9363} 9364 9365 9366/* ------------------------------------------------------------------------ */ 9367/* Function: ipf_main_soft_destroy */ 9368/* Returns: void */ 9369/* Parameters: softc(I) - pointer to soft context main structure */ 9370/* */ 9371/* Undo everything that we did in ipf_main_soft_create. */ 9372/* */ 9373/* The most important check that needs to be made here is whether or not */ 9374/* the structure was allocated by ipf_main_soft_create() by checking what */ 9375/* value is stored in ipf_dynamic_main. */ 9376/* ------------------------------------------------------------------------ */ 9377/*ARGSUSED*/ 9378void 9379ipf_main_soft_destroy(softc) 9380 ipf_main_softc_t *softc; 9381{ 9382 9383 RW_DESTROY(&softc->ipf_frag); 9384 RW_DESTROY(&softc->ipf_poolrw); 9385 RW_DESTROY(&softc->ipf_nat); 9386 RW_DESTROY(&softc->ipf_state); 9387 RW_DESTROY(&softc->ipf_tokens); 9388 RW_DESTROY(&softc->ipf_mutex); 9389 RW_DESTROY(&softc->ipf_global); 9390 MUTEX_DESTROY(&softc->ipf_timeoutlock); 9391 MUTEX_DESTROY(&softc->ipf_rw); 9392 9393 if (softc->ipf_tuners != NULL) { 9394 KFREES(softc->ipf_tuners, sizeof(ipf_main_tuneables)); 9395 } 9396 if (softc->ipf_dynamic_softc == 1) { 9397 KFREE(softc); 9398 } 9399} 9400 9401 9402/* ------------------------------------------------------------------------ */ 9403/* Function: ipf_main_soft_fini */ 9404/* Returns: 0 = success, -1 = failure */ 9405/* Parameters: softc(I) - pointer to soft context main structure */ 9406/* */ 9407/* Clean out the rules which have been added since _init was last called, */ 9408/* the only dynamic part of the mainline. */ 9409/* ------------------------------------------------------------------------ */ 9410int 9411ipf_main_soft_fini(softc) 9412 ipf_main_softc_t *softc; 9413{ 9414 (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE|FR_INACTIVE); 9415 (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE); 9416 (void) ipf_flush(softc, IPL_LOGCOUNT, FR_INQUE|FR_OUTQUE|FR_INACTIVE); 9417 (void) ipf_flush(softc, IPL_LOGCOUNT, FR_INQUE|FR_OUTQUE); 9418 9419 return 0; 9420} 9421 9422 9423/* ------------------------------------------------------------------------ */ 9424/* Function: ipf_main_load */ 9425/* Returns: 0 = success, -1 = failure */ 9426/* Parameters: none */ 9427/* */ 9428/* Handle global initialisation that needs to be done for the base part of */ 9429/* IPFilter. At present this just amounts to initialising some ICMP lookup */ 9430/* arrays that get used by the state/NAT code. */ 9431/* ------------------------------------------------------------------------ */ 9432int 9433ipf_main_load() 9434{ 9435 int i; 9436 9437 /* fill icmp reply type table */ 9438 for (i = 0; i <= ICMP_MAXTYPE; i++) 9439 icmpreplytype4[i] = -1; 9440 icmpreplytype4[ICMP_ECHO] = ICMP_ECHOREPLY; 9441 icmpreplytype4[ICMP_TSTAMP] = ICMP_TSTAMPREPLY; 9442 icmpreplytype4[ICMP_IREQ] = ICMP_IREQREPLY; 9443 icmpreplytype4[ICMP_MASKREQ] = ICMP_MASKREPLY; 9444 9445#ifdef USE_INET6 9446 /* fill icmp reply type table */ 9447 for (i = 0; i <= ICMP6_MAXTYPE; i++) 9448 icmpreplytype6[i] = -1; 9449 icmpreplytype6[ICMP6_ECHO_REQUEST] = ICMP6_ECHO_REPLY; 9450 icmpreplytype6[ICMP6_MEMBERSHIP_QUERY] = ICMP6_MEMBERSHIP_REPORT; 9451 icmpreplytype6[ICMP6_NI_QUERY] = ICMP6_NI_REPLY; 9452 icmpreplytype6[ND_ROUTER_SOLICIT] = ND_ROUTER_ADVERT; 9453 icmpreplytype6[ND_NEIGHBOR_SOLICIT] = ND_NEIGHBOR_ADVERT; 9454#endif 9455 9456 return 0; 9457} 9458 9459 9460/* ------------------------------------------------------------------------ */ 9461/* Function: ipf_main_unload */ 9462/* Returns: 0 = success, -1 = failure */ 9463/* Parameters: none */ 9464/* */ 9465/* A null-op function that exists as a placeholder so that the flow in */ 9466/* other functions is obvious. */ 9467/* ------------------------------------------------------------------------ */ 9468int 9469ipf_main_unload() 9470{ 9471 return 0; 9472} 9473 9474 9475/* ------------------------------------------------------------------------ */ 9476/* Function: ipf_load_all */ 9477/* Returns: 0 = success, -1 = failure */ 9478/* Parameters: none */ 9479/* */ 9480/* Work through all of the subsystems inside IPFilter and call the load */ 9481/* function for each in an order that won't lead to a crash :) */ 9482/* ------------------------------------------------------------------------ */ 9483int 9484ipf_load_all() 9485{ 9486 if (ipf_main_load() == -1) 9487 return -1; 9488 9489 if (ipf_state_main_load() == -1) 9490 return -1; 9491 9492 if (ipf_nat_main_load() == -1) 9493 return -1; 9494 9495 if (ipf_frag_main_load() == -1) 9496 return -1; 9497 9498 if (ipf_auth_main_load() == -1) 9499 return -1; 9500 9501 if (ipf_proxy_main_load() == -1) 9502 return -1; 9503 9504 return 0; 9505} 9506 9507 9508/* ------------------------------------------------------------------------ */ 9509/* Function: ipf_unload_all */ 9510/* Returns: 0 = success, -1 = failure */ 9511/* Parameters: none */ 9512/* */ 9513/* Work through all of the subsystems inside IPFilter and call the unload */ 9514/* function for each in an order that won't lead to a crash :) */ 9515/* ------------------------------------------------------------------------ */ 9516int 9517ipf_unload_all() 9518{ 9519 if (ipf_proxy_main_unload() == -1) 9520 return -1; 9521 9522 if (ipf_auth_main_unload() == -1) 9523 return -1; 9524 9525 if (ipf_frag_main_unload() == -1) 9526 return -1; 9527 9528 if (ipf_nat_main_unload() == -1) 9529 return -1; 9530 9531 if (ipf_state_main_unload() == -1) 9532 return -1; 9533 9534 if (ipf_main_unload() == -1) 9535 return -1; 9536 9537 return 0; 9538} 9539 9540 9541/* ------------------------------------------------------------------------ */ 9542/* Function: ipf_create_all */ 9543/* Returns: NULL = failure, else success */ 9544/* Parameters: arg(I) - pointer to soft context main structure */ 9545/* */ 9546/* Work through all of the subsystems inside IPFilter and call the create */ 9547/* function for each in an order that won't lead to a crash :) */ 9548/* ------------------------------------------------------------------------ */ 9549ipf_main_softc_t * 9550ipf_create_all(arg) 9551 void *arg; 9552{ 9553 ipf_main_softc_t *softc; 9554 9555 softc = ipf_main_soft_create(arg); 9556 if (softc == NULL) 9557 return NULL; 9558 9559#ifdef IPFILTER_LOG 9560 softc->ipf_log_soft = ipf_log_soft_create(softc); 9561 if (softc->ipf_log_soft == NULL) { 9562 ipf_destroy_all(softc); 9563 return NULL; 9564 } 9565#endif 9566 9567 softc->ipf_lookup_soft = ipf_lookup_soft_create(softc); 9568 if (softc->ipf_lookup_soft == NULL) { 9569 ipf_destroy_all(softc); 9570 return NULL; 9571 } 9572 9573 softc->ipf_sync_soft = ipf_sync_soft_create(softc); 9574 if (softc->ipf_sync_soft == NULL) { 9575 ipf_destroy_all(softc); 9576 return NULL; 9577 } 9578 9579 softc->ipf_state_soft = ipf_state_soft_create(softc); 9580 if (softc->ipf_state_soft == NULL) { 9581 ipf_destroy_all(softc); 9582 return NULL; 9583 } 9584 9585 softc->ipf_nat_soft = ipf_nat_soft_create(softc); 9586 if (softc->ipf_nat_soft == NULL) { 9587 ipf_destroy_all(softc); 9588 return NULL; 9589 } 9590 9591 softc->ipf_frag_soft = ipf_frag_soft_create(softc); 9592 if (softc->ipf_frag_soft == NULL) { 9593 ipf_destroy_all(softc); 9594 return NULL; 9595 } 9596 9597 softc->ipf_auth_soft = ipf_auth_soft_create(softc); 9598 if (softc->ipf_auth_soft == NULL) { 9599 ipf_destroy_all(softc); 9600 return NULL; 9601 } 9602 9603 softc->ipf_proxy_soft = ipf_proxy_soft_create(softc); 9604 if (softc->ipf_proxy_soft == NULL) { 9605 ipf_destroy_all(softc); 9606 return NULL; 9607 } 9608 9609 return softc; 9610} 9611 9612 9613/* ------------------------------------------------------------------------ */ 9614/* Function: ipf_destroy_all */ 9615/* Returns: void */ 9616/* Parameters: softc(I) - pointer to soft context main structure */ 9617/* */ 9618/* Work through all of the subsystems inside IPFilter and call the destroy */ 9619/* function for each in an order that won't lead to a crash :) */ 9620/* */ 9621/* Every one of these functions is expected to succeed, so there is no */ 9622/* checking of return values. */ 9623/* ------------------------------------------------------------------------ */ 9624void 9625ipf_destroy_all(softc) 9626 ipf_main_softc_t *softc; 9627{ 9628 9629 if (softc->ipf_state_soft != NULL) { 9630 ipf_state_soft_destroy(softc, softc->ipf_state_soft); 9631 softc->ipf_state_soft = NULL; 9632 } 9633 9634 if (softc->ipf_nat_soft != NULL) { 9635 ipf_nat_soft_destroy(softc, softc->ipf_nat_soft); 9636 softc->ipf_nat_soft = NULL; 9637 } 9638 9639 if (softc->ipf_frag_soft != NULL) { 9640 ipf_frag_soft_destroy(softc, softc->ipf_frag_soft); 9641 softc->ipf_frag_soft = NULL; 9642 } 9643 9644 if (softc->ipf_auth_soft != NULL) { 9645 ipf_auth_soft_destroy(softc, softc->ipf_auth_soft); 9646 softc->ipf_auth_soft = NULL; 9647 } 9648 9649 if (softc->ipf_proxy_soft != NULL) { 9650 ipf_proxy_soft_destroy(softc, softc->ipf_proxy_soft); 9651 softc->ipf_proxy_soft = NULL; 9652 } 9653 9654 if (softc->ipf_sync_soft != NULL) { 9655 ipf_sync_soft_destroy(softc, softc->ipf_sync_soft); 9656 softc->ipf_sync_soft = NULL; 9657 } 9658 9659 if (softc->ipf_lookup_soft != NULL) { 9660 ipf_lookup_soft_destroy(softc, softc->ipf_lookup_soft); 9661 softc->ipf_lookup_soft = NULL; 9662 } 9663 9664#ifdef IPFILTER_LOG 9665 if (softc->ipf_log_soft != NULL) { 9666 ipf_log_soft_destroy(softc, softc->ipf_log_soft); 9667 softc->ipf_log_soft = NULL; 9668 } 9669#endif 9670 9671 ipf_main_soft_destroy(softc); 9672} 9673 9674 9675/* ------------------------------------------------------------------------ */ 9676/* Function: ipf_init_all */ 9677/* Returns: 0 = success, -1 = failure */ 9678/* Parameters: softc(I) - pointer to soft context main structure */ 9679/* */ 9680/* Work through all of the subsystems inside IPFilter and call the init */ 9681/* function for each in an order that won't lead to a crash :) */ 9682/* ------------------------------------------------------------------------ */ 9683int 9684ipf_init_all(softc) 9685 ipf_main_softc_t *softc; 9686{ 9687 9688 if (ipf_main_soft_init(softc) == -1) 9689 return -1; 9690 9691#ifdef IPFILTER_LOG 9692 if (ipf_log_soft_init(softc, softc->ipf_log_soft) == -1) 9693 return -1; 9694#endif 9695 9696 if (ipf_lookup_soft_init(softc, softc->ipf_lookup_soft) == -1) 9697 return -1; 9698 9699 if (ipf_sync_soft_init(softc, softc->ipf_sync_soft) == -1) 9700 return -1; 9701 9702 if (ipf_state_soft_init(softc, softc->ipf_state_soft) == -1) 9703 return -1; 9704 9705 if (ipf_nat_soft_init(softc, softc->ipf_nat_soft) == -1) 9706 return -1; 9707 9708 if (ipf_frag_soft_init(softc, softc->ipf_frag_soft) == -1) 9709 return -1; 9710 9711 if (ipf_auth_soft_init(softc, softc->ipf_auth_soft) == -1) 9712 return -1; 9713 9714 if (ipf_proxy_soft_init(softc, softc->ipf_proxy_soft) == -1) 9715 return -1; 9716 9717 return 0; 9718} 9719 9720 9721/* ------------------------------------------------------------------------ */ 9722/* Function: ipf_fini_all */ 9723/* Returns: 0 = success, -1 = failure */ 9724/* Parameters: softc(I) - pointer to soft context main structure */ 9725/* */ 9726/* Work through all of the subsystems inside IPFilter and call the fini */ 9727/* function for each in an order that won't lead to a crash :) */ 9728/* ------------------------------------------------------------------------ */ 9729int 9730ipf_fini_all(softc) 9731 ipf_main_softc_t *softc; 9732{ 9733 9734 ipf_token_flush(softc); 9735 9736 if (ipf_proxy_soft_fini(softc, softc->ipf_proxy_soft) == -1) 9737 return -1; 9738 9739 if (ipf_auth_soft_fini(softc, softc->ipf_auth_soft) == -1) 9740 return -1; 9741 9742 if (ipf_frag_soft_fini(softc, softc->ipf_frag_soft) == -1) 9743 return -1; 9744 9745 if (ipf_nat_soft_fini(softc, softc->ipf_nat_soft) == -1) 9746 return -1; 9747 9748 if (ipf_state_soft_fini(softc, softc->ipf_state_soft) == -1) 9749 return -1; 9750 9751 if (ipf_sync_soft_fini(softc, softc->ipf_sync_soft) == -1) 9752 return -1; 9753 9754 if (ipf_lookup_soft_fini(softc, softc->ipf_lookup_soft) == -1) 9755 return -1; 9756 9757#ifdef IPFILTER_LOG 9758 if (ipf_log_soft_fini(softc, softc->ipf_log_soft) == -1) 9759 return -1; 9760#endif 9761 9762 if (ipf_main_soft_fini(softc) == -1) 9763 return -1; 9764 9765 return 0; 9766} 9767 9768 9769/* ------------------------------------------------------------------------ */ 9770/* Function: ipf_rule_expire */ 9771/* Returns: Nil */ 9772/* Parameters: softc(I) - pointer to soft context main structure */ 9773/* */ 9774/* At present this function exists just to support temporary addition of */ 9775/* firewall rules. Both inactive and active lists are scanned for items to */ 9776/* purge, as by rights, the expiration is computed as soon as the rule is */ 9777/* loaded in. */ 9778/* ------------------------------------------------------------------------ */ 9779void 9780ipf_rule_expire(softc) 9781 ipf_main_softc_t *softc; 9782{ 9783 frentry_t *fr; 9784 9785 if ((softc->ipf_rule_explist[0] == NULL) && 9786 (softc->ipf_rule_explist[1] == NULL)) 9787 return; 9788 9789 WRITE_ENTER(&softc->ipf_mutex); 9790 9791 while ((fr = softc->ipf_rule_explist[0]) != NULL) { 9792 /* 9793 * Because the list is kept sorted on insertion, the fist 9794 * one that dies in the future means no more work to do. 9795 */ 9796 if (fr->fr_die > softc->ipf_ticks) 9797 break; 9798 ipf_rule_delete(softc, fr, IPL_LOGIPF, 0); 9799 } 9800 9801 while ((fr = softc->ipf_rule_explist[1]) != NULL) { 9802 /* 9803 * Because the list is kept sorted on insertion, the fist 9804 * one that dies in the future means no more work to do. 9805 */ 9806 if (fr->fr_die > softc->ipf_ticks) 9807 break; 9808 ipf_rule_delete(softc, fr, IPL_LOGIPF, 1); 9809 } 9810 9811 RWLOCK_EXIT(&softc->ipf_mutex); 9812} 9813 9814 9815static int ipf_ht_node_cmp __P((struct host_node_s *, struct host_node_s *)); 9816static void ipf_ht_node_make_key __P((host_track_t *, host_node_t *, int, 9817 i6addr_t *)); 9818 9819host_node_t RBI_ZERO(ipf_rb); 9820RBI_CODE(ipf_rb, host_node_t, hn_entry, ipf_ht_node_cmp) 9821 9822 9823/* ------------------------------------------------------------------------ */ 9824/* Function: ipf_ht_node_cmp */ 9825/* Returns: int - 0 == nodes are the same, .. */ 9826/* Parameters: k1(I) - pointer to first key to compare */ 9827/* k2(I) - pointer to second key to compare */ 9828/* */ 9829/* The "key" for the node is a combination of two fields: the address */ 9830/* family and the address itself. */ 9831/* */ 9832/* Because we're not actually interpreting the address data, it isn't */ 9833/* necessary to convert them to/from network/host byte order. The mask is */ 9834/* just used to remove bits that aren't significant - it doesn't matter */ 9835/* where they are, as long as they're always in the same place. */ 9836/* */ 9837/* As with IP6_EQ, comparing IPv6 addresses starts at the bottom because */ 9838/* this is where individual ones will differ the most - but not true for */ 9839/* for /48's, etc. */ 9840/* ------------------------------------------------------------------------ */ 9841static int 9842ipf_ht_node_cmp(k1, k2) 9843 struct host_node_s *k1, *k2; 9844{ 9845 int i; 9846 9847 i = (k2->hn_addr.adf_family - k1->hn_addr.adf_family); 9848 if (i != 0) 9849 return i; 9850 9851 if (k1->hn_addr.adf_family == AF_INET) 9852 return (k2->hn_addr.adf_addr.in4.s_addr - 9853 k1->hn_addr.adf_addr.in4.s_addr); 9854 9855 i = k2->hn_addr.adf_addr.i6[3] - k1->hn_addr.adf_addr.i6[3]; 9856 if (i != 0) 9857 return i; 9858 i = k2->hn_addr.adf_addr.i6[2] - k1->hn_addr.adf_addr.i6[2]; 9859 if (i != 0) 9860 return i; 9861 i = k2->hn_addr.adf_addr.i6[1] - k1->hn_addr.adf_addr.i6[1]; 9862 if (i != 0) 9863 return i; 9864 i = k2->hn_addr.adf_addr.i6[0] - k1->hn_addr.adf_addr.i6[0]; 9865 return i; 9866} 9867 9868 9869/* ------------------------------------------------------------------------ */ 9870/* Function: ipf_ht_node_make_key */ 9871/* Returns: Nil */ 9872/* parameters: htp(I) - pointer to address tracking structure */ 9873/* key(I) - where to store masked address for lookup */ 9874/* family(I) - protocol family of address */ 9875/* addr(I) - pointer to network address */ 9876/* */ 9877/* Using the "netmask" (number of bits) stored parent host tracking struct, */ 9878/* copy the address passed in into the key structure whilst masking out the */ 9879/* bits that we don't want. */ 9880/* */ 9881/* Because the parser will set ht_netmask to 128 if there is no protocol */ 9882/* specified (the parser doesn't know if it should be a v4 or v6 rule), we */ 9883/* have to be wary of that and not allow 32-128 to happen. */ 9884/* ------------------------------------------------------------------------ */ 9885static void 9886ipf_ht_node_make_key(htp, key, family, addr) 9887 host_track_t *htp; 9888 host_node_t *key; 9889 int family; 9890 i6addr_t *addr; 9891{ 9892 key->hn_addr.adf_family = family; 9893 if (family == AF_INET) { 9894 u_32_t mask; 9895 int bits; 9896 9897 key->hn_addr.adf_len = sizeof(key->hn_addr.adf_addr.in4); 9898 bits = htp->ht_netmask; 9899 if (bits >= 32) { 9900 mask = 0xffffffff; 9901 } else { 9902 mask = htonl(0xffffffff << (32 - bits)); 9903 } 9904 key->hn_addr.adf_addr.in4.s_addr = addr->in4.s_addr & mask; 9905#ifdef USE_INET6 9906 } else { 9907 int bits = htp->ht_netmask; 9908 9909 key->hn_addr.adf_len = sizeof(key->hn_addr.adf_addr.in6); 9910 if (bits > 96) { 9911 key->hn_addr.adf_addr.i6[3] = addr->i6[3] & 9912 htonl(0xffffffff << (128 - bits)); 9913 key->hn_addr.adf_addr.i6[2] = addr->i6[2]; 9914 key->hn_addr.adf_addr.i6[1] = addr->i6[2]; 9915 key->hn_addr.adf_addr.i6[0] = addr->i6[2]; 9916 } else if (bits > 64) { 9917 key->hn_addr.adf_addr.i6[3] = 0; 9918 key->hn_addr.adf_addr.i6[2] = addr->i6[2] & 9919 htonl(0xffffffff << (96 - bits)); 9920 key->hn_addr.adf_addr.i6[1] = addr->i6[1]; 9921 key->hn_addr.adf_addr.i6[0] = addr->i6[0]; 9922 } else if (bits > 32) { 9923 key->hn_addr.adf_addr.i6[3] = 0; 9924 key->hn_addr.adf_addr.i6[2] = 0; 9925 key->hn_addr.adf_addr.i6[1] = addr->i6[1] & 9926 htonl(0xffffffff << (64 - bits)); 9927 key->hn_addr.adf_addr.i6[0] = addr->i6[0]; 9928 } else { 9929 key->hn_addr.adf_addr.i6[3] = 0; 9930 key->hn_addr.adf_addr.i6[2] = 0; 9931 key->hn_addr.adf_addr.i6[1] = 0; 9932 key->hn_addr.adf_addr.i6[0] = addr->i6[0] & 9933 htonl(0xffffffff << (32 - bits)); 9934 } 9935#endif 9936 } 9937} 9938 9939 9940/* ------------------------------------------------------------------------ */ 9941/* Function: ipf_ht_node_add */ 9942/* Returns: int - 0 == success, -1 == failure */ 9943/* Parameters: softc(I) - pointer to soft context main structure */ 9944/* htp(I) - pointer to address tracking structure */ 9945/* family(I) - protocol family of address */ 9946/* addr(I) - pointer to network address */ 9947/* */ 9948/* NOTE: THIS FUNCTION MUST BE CALLED WITH AN EXCLUSIVE LOCK THAT PREVENTS */ 9949/* ipf_ht_node_del FROM RUNNING CONCURRENTLY ON THE SAME htp. */ 9950/* */ 9951/* After preparing the key with the address information to find, look in */ 9952/* the red-black tree to see if the address is known. A successful call to */ 9953/* this function can mean one of two things: a new node was added to the */ 9954/* tree or a matching node exists and we're able to bump up its activity. */ 9955/* ------------------------------------------------------------------------ */ 9956int 9957ipf_ht_node_add(softc, htp, family, addr) 9958 ipf_main_softc_t *softc; 9959 host_track_t *htp; 9960 int family; 9961 i6addr_t *addr; 9962{ 9963 host_node_t *h; 9964 host_node_t k; 9965 9966 ipf_ht_node_make_key(htp, &k, family, addr); 9967 9968 h = RBI_SEARCH(ipf_rb, &htp->ht_root, &k); 9969 if (h == NULL) { 9970 if (htp->ht_cur_nodes >= htp->ht_max_nodes) 9971 return -1; 9972 KMALLOC(h, host_node_t *); 9973 if (h == NULL) { 9974 DT(ipf_rb_no_mem); 9975 LBUMP(ipf_rb_no_mem); 9976 return -1; 9977 } 9978 9979 /* 9980 * If there was a macro to initialise the RB node then that 9981 * would get used here, but there isn't... 9982 */ 9983 bzero((char *)h, sizeof(*h)); 9984 h->hn_addr = k.hn_addr; 9985 h->hn_addr.adf_family = k.hn_addr.adf_family; 9986 RBI_INSERT(ipf_rb, &htp->ht_root, h); 9987 htp->ht_cur_nodes++; 9988 } else { 9989 if ((htp->ht_max_per_node != 0) && 9990 (h->hn_active >= htp->ht_max_per_node)) { 9991 DT(ipf_rb_node_max); 9992 LBUMP(ipf_rb_node_max); 9993 return -1; 9994 } 9995 } 9996 9997 h->hn_active++; 9998 9999 return 0; 10000} 10001 10002 10003/* ------------------------------------------------------------------------ */ 10004/* Function: ipf_ht_node_del */ 10005/* Returns: int - 0 == success, -1 == failure */ 10006/* parameters: htp(I) - pointer to address tracking structure */ 10007/* family(I) - protocol family of address */ 10008/* addr(I) - pointer to network address */ 10009/* */ 10010/* NOTE: THIS FUNCTION MUST BE CALLED WITH AN EXCLUSIVE LOCK THAT PREVENTS */ 10011/* ipf_ht_node_add FROM RUNNING CONCURRENTLY ON THE SAME htp. */ 10012/* */ 10013/* Try and find the address passed in amongst the leavese on this tree to */ 10014/* be friend. If found then drop the active account for that node drops by */ 10015/* one. If that count reaches 0, it is time to free it all up. */ 10016/* ------------------------------------------------------------------------ */ 10017int 10018ipf_ht_node_del(htp, family, addr) 10019 host_track_t *htp; 10020 int family; 10021 i6addr_t *addr; 10022{ 10023 host_node_t *h; 10024 host_node_t k; 10025 10026 ipf_ht_node_make_key(htp, &k, family, addr); 10027 10028 h = RBI_SEARCH(ipf_rb, &htp->ht_root, &k); 10029 if (h == NULL) { 10030 return -1; 10031 } else { 10032 h->hn_active--; 10033 if (h->hn_active == 0) { 10034 (void) RBI_DELETE(ipf_rb, &htp->ht_root, h); 10035 htp->ht_cur_nodes--; 10036 KFREE(h); 10037 } 10038 } 10039 10040 return 0; 10041} 10042 10043 10044/* ------------------------------------------------------------------------ */ 10045/* Function: ipf_rb_ht_init */ 10046/* Returns: Nil */ 10047/* Parameters: head(I) - pointer to host tracking structure */ 10048/* */ 10049/* Initialise the host tracking structure to be ready for use above. */ 10050/* ------------------------------------------------------------------------ */ 10051void 10052ipf_rb_ht_init(head) 10053 host_track_t *head; 10054{ 10055 RBI_INIT(ipf_rb, &head->ht_root); 10056} 10057 10058 10059/* ------------------------------------------------------------------------ */ 10060/* Function: ipf_rb_ht_freenode */ 10061/* Returns: Nil */ 10062/* Parameters: head(I) - pointer to host tracking structure */ 10063/* arg(I) - additional argument from walk caller */ 10064/* */ 10065/* Free an actual host_node_t structure. */ 10066/* ------------------------------------------------------------------------ */ 10067void 10068ipf_rb_ht_freenode(node, arg) 10069 host_node_t *node; 10070 void *arg; 10071{ 10072 KFREE(node); 10073} 10074 10075 10076/* ------------------------------------------------------------------------ */ 10077/* Function: ipf_rb_ht_flush */ 10078/* Returns: Nil */ 10079/* Parameters: head(I) - pointer to host tracking structure */ 10080/* */ 10081/* Remove all of the nodes in the tree tracking hosts by calling a walker */ 10082/* and free'ing each one. */ 10083/* ------------------------------------------------------------------------ */ 10084void 10085ipf_rb_ht_flush(head) 10086 host_track_t *head; 10087{ 10088 RBI_WALK(ipf_rb, &head->ht_root, ipf_rb_ht_freenode, NULL); 10089} 10090 10091 10092/* ------------------------------------------------------------------------ */ 10093/* Function: ipf_slowtimer */ 10094/* Returns: Nil */ 10095/* Parameters: ptr(I) - pointer to main ipf soft context structure */ 10096/* */ 10097/* Slowly expire held state for fragments. Timeouts are set * in */ 10098/* expectation of this being called twice per second. */ 10099/* ------------------------------------------------------------------------ */ 10100void 10101ipf_slowtimer(softc) 10102 ipf_main_softc_t *softc; 10103{ 10104 10105 ipf_token_expire(softc); 10106 ipf_frag_expire(softc); 10107 ipf_state_expire(softc); 10108 ipf_nat_expire(softc); 10109 ipf_auth_expire(softc); 10110 ipf_lookup_expire(softc); 10111 ipf_rule_expire(softc); 10112 ipf_sync_expire(softc); 10113 softc->ipf_ticks++; 10114# if defined(__OpenBSD__) 10115 timeout_add(&ipf_slowtimer_ch, hz/2); 10116# endif 10117} 10118 10119 10120/* ------------------------------------------------------------------------ */ 10121/* Function: ipf_inet_mask_add */ 10122/* Returns: Nil */ 10123/* Parameters: bits(I) - pointer to nat context information */ 10124/* mtab(I) - pointer to mask hash table structure */ 10125/* */ 10126/* When called, bits represents the mask of a new NAT rule that has just */ 10127/* been added. This function inserts a bitmask into the array of masks to */ 10128/* search when searching for a matching NAT rule for a packet. */ 10129/* Prevention of duplicate masks is achieved by checking the use count for */ 10130/* a given netmask. */ 10131/* ------------------------------------------------------------------------ */ 10132void 10133ipf_inet_mask_add(bits, mtab) 10134 int bits; 10135 ipf_v4_masktab_t *mtab; 10136{ 10137 u_32_t mask; 10138 int i, j; 10139 10140 mtab->imt4_masks[bits]++; 10141 if (mtab->imt4_masks[bits] > 1) 10142 return; 10143 10144 if (bits == 0) 10145 mask = 0; 10146 else 10147 mask = 0xffffffff << (32 - bits); 10148 10149 for (i = 0; i < 33; i++) { 10150 if (ntohl(mtab->imt4_active[i]) < mask) { 10151 for (j = 32; j > i; j--) 10152 mtab->imt4_active[j] = mtab->imt4_active[j - 1]; 10153 mtab->imt4_active[i] = htonl(mask); 10154 break; 10155 } 10156 } 10157 mtab->imt4_max++; 10158} 10159 10160 10161/* ------------------------------------------------------------------------ */ 10162/* Function: ipf_inet_mask_del */ 10163/* Returns: Nil */ 10164/* Parameters: bits(I) - number of bits set in the netmask */ 10165/* mtab(I) - pointer to mask hash table structure */ 10166/* */ 10167/* Remove the 32bit bitmask represented by "bits" from the collection of */ 10168/* netmasks stored inside of mtab. */ 10169/* ------------------------------------------------------------------------ */ 10170void 10171ipf_inet_mask_del(bits, mtab) 10172 int bits; 10173 ipf_v4_masktab_t *mtab; 10174{ 10175 u_32_t mask; 10176 int i, j; 10177 10178 mtab->imt4_masks[bits]--; 10179 if (mtab->imt4_masks[bits] > 0) 10180 return; 10181 10182 mask = htonl(0xffffffff << (32 - bits)); 10183 for (i = 0; i < 33; i++) { 10184 if (mtab->imt4_active[i] == mask) { 10185 for (j = i + 1; j < 33; j++) 10186 mtab->imt4_active[j - 1] = mtab->imt4_active[j]; 10187 break; 10188 } 10189 } 10190 mtab->imt4_max--; 10191 ASSERT(mtab->imt4_max >= 0); 10192} 10193 10194 10195#ifdef USE_INET6 10196/* ------------------------------------------------------------------------ */ 10197/* Function: ipf_inet6_mask_add */ 10198/* Returns: Nil */ 10199/* Parameters: bits(I) - number of bits set in mask */ 10200/* mask(I) - pointer to mask to add */ 10201/* mtab(I) - pointer to mask hash table structure */ 10202/* */ 10203/* When called, bitcount represents the mask of a IPv6 NAT map rule that */ 10204/* has just been added. This function inserts a bitmask into the array of */ 10205/* masks to search when searching for a matching NAT rule for a packet. */ 10206/* Prevention of duplicate masks is achieved by checking the use count for */ 10207/* a given netmask. */ 10208/* ------------------------------------------------------------------------ */ 10209void 10210ipf_inet6_mask_add(bits, mask, mtab) 10211 int bits; 10212 i6addr_t *mask; 10213 ipf_v6_masktab_t *mtab; 10214{ 10215 i6addr_t zero; 10216 int i, j; 10217 10218 mtab->imt6_masks[bits]++; 10219 if (mtab->imt6_masks[bits] > 1) 10220 return; 10221 10222 if (bits == 0) { 10223 mask = &zero; 10224 zero.i6[0] = 0; 10225 zero.i6[1] = 0; 10226 zero.i6[2] = 0; 10227 zero.i6[3] = 0; 10228 } 10229 10230 for (i = 0; i < 129; i++) { 10231 if (IP6_LT(&mtab->imt6_active[i], mask)) { 10232 for (j = 128; j > i; j--) 10233 mtab->imt6_active[j] = mtab->imt6_active[j - 1]; 10234 mtab->imt6_active[i] = *mask; 10235 break; 10236 } 10237 } 10238 mtab->imt6_max++; 10239} 10240 10241 10242/* ------------------------------------------------------------------------ */ 10243/* Function: ipf_inet6_mask_del */ 10244/* Returns: Nil */ 10245/* Parameters: bits(I) - number of bits set in mask */ 10246/* mask(I) - pointer to mask to remove */ 10247/* mtab(I) - pointer to mask hash table structure */ 10248/* */ 10249/* Remove the 128bit bitmask represented by "bits" from the collection of */ 10250/* netmasks stored inside of mtab. */ 10251/* ------------------------------------------------------------------------ */ 10252void 10253ipf_inet6_mask_del(bits, mask, mtab) 10254 int bits; 10255 i6addr_t *mask; 10256 ipf_v6_masktab_t *mtab; 10257{ 10258 i6addr_t zero; 10259 int i, j; 10260 10261 mtab->imt6_masks[bits]--; 10262 if (mtab->imt6_masks[bits] > 0) 10263 return; 10264 10265 if (bits == 0) 10266 mask = &zero; 10267 zero.i6[0] = 0; 10268 zero.i6[1] = 0; 10269 zero.i6[2] = 0; 10270 zero.i6[3] = 0; 10271 10272 for (i = 0; i < 129; i++) { 10273 if (IP6_EQ(&mtab->imt6_active[i], mask)) { 10274 for (j = i + 1; j < 129; j++) { 10275 mtab->imt6_active[j - 1] = mtab->imt6_active[j]; 10276 if (IP6_EQ(&mtab->imt6_active[j - 1], &zero)) 10277 break; 10278 } 10279 break; 10280 } 10281 } 10282 mtab->imt6_max--; 10283 ASSERT(mtab->imt6_max >= 0); 10284} 10285#endif 10286