xref: /dflybsd-src/sys/net/pf/pf.c (revision 93bffecadc0caefc46f12b736eab0e62c2b6f42e)
1 /*	$OpenBSD: pf.c,v 1.552.2.1 2007/11/27 16:37:57 henning Exp $ */
2 /* add $OpenBSD: pf.c,v 1.553 2007/08/23 11:15:49 dhartmei Exp $ */
3 /* add $OpenBSD: pf.c,v 1.554 2007/08/28 16:09:12 henning Exp $ */
4 
5 
6 /*
7  * Copyright (c) 2004 The DragonFly Project.  All rights reserved.
8  *
9  * Copyright (c) 2001 Daniel Hartmeier
10  * Copyright (c) 2002,2003 Henning Brauer
11  * All rights reserved.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  *
17  *    - Redistributions of source code must retain the above copyright
18  *      notice, this list of conditions and the following disclaimer.
19  *    - Redistributions in binary form must reproduce the above
20  *      copyright notice, this list of conditions and the following
21  *      disclaimer in the documentation and/or other materials provided
22  *      with the distribution.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
25  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
26  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
27  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
28  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
29  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
30  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
31  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
32  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
34  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35  * POSSIBILITY OF SUCH DAMAGE.
36  *
37  * Effort sponsored in part by the Defense Advanced Research Projects
38  * Agency (DARPA) and Air Force Research Laboratory, Air Force
39  * Materiel Command, USAF, under agreement number F30602-01-2-0537.
40  *
41  */
42 
43 #include "opt_inet.h"
44 #include "opt_inet6.h"
45 #include "use_pfsync.h"
46 
47 #include <sys/param.h>
48 #include <sys/systm.h>
49 #include <sys/malloc.h>
50 #include <sys/mbuf.h>
51 #include <sys/filio.h>
52 #include <sys/socket.h>
53 #include <sys/socketvar.h>
54 #include <sys/kernel.h>
55 #include <sys/time.h>
56 #include <sys/sysctl.h>
57 #include <sys/endian.h>
58 #include <vm/vm_zone.h>
59 #include <sys/proc.h>
60 #include <sys/kthread.h>
61 
62 #include <sys/mplock2.h>
63 
64 #include <machine/inttypes.h>
65 
66 #include <net/if.h>
67 #include <net/if_types.h>
68 #include <net/bpf.h>
69 #include <net/netisr.h>
70 #include <net/route.h>
71 
72 #include <netinet/in.h>
73 #include <netinet/in_var.h>
74 #include <netinet/in_systm.h>
75 #include <netinet/ip.h>
76 #include <netinet/ip_var.h>
77 #include <netinet/tcp.h>
78 #include <netinet/tcp_seq.h>
79 #include <netinet/udp.h>
80 #include <netinet/ip_icmp.h>
81 #include <netinet/in_pcb.h>
82 #include <netinet/tcp_timer.h>
83 #include <netinet/tcp_var.h>
84 #include <netinet/udp_var.h>
85 #include <netinet/icmp_var.h>
86 #include <netinet/if_ether.h>
87 
88 #include <net/pf/pfvar.h>
89 #include <net/pf/if_pflog.h>
90 
91 #if NPFSYNC > 0
92 #include <net/pf/if_pfsync.h>
93 #endif /* NPFSYNC > 0 */
94 
95 #ifdef INET6
96 #include <netinet/ip6.h>
97 #include <netinet/in_pcb.h>
98 #include <netinet/icmp6.h>
99 #include <netinet6/nd6.h>
100 #include <netinet6/ip6_var.h>
101 #include <netinet6/in6_pcb.h>
102 #endif /* INET6 */
103 
104 #include <sys/in_cksum.h>
105 #include <sys/ucred.h>
106 #include <machine/limits.h>
107 #include <sys/msgport2.h>
108 #include <net/netmsg2.h>
109 
110 extern int ip_optcopy(struct ip *, struct ip *);
111 extern int debug_pfugidhack;
112 
113 #define DPFPRINTF(n, x)	if (pf_status.debug >= (n)) kprintf x
114 
115 /*
116  * Global variables
117  */
118 
119 /* state tables */
120 struct pf_state_tree_lan_ext	 pf_statetbl_lan_ext;
121 struct pf_state_tree_ext_gwy	 pf_statetbl_ext_gwy;
122 
123 struct pf_altqqueue	 pf_altqs[2];
124 struct pf_palist	 pf_pabuf;
125 struct pf_altqqueue	*pf_altqs_active;
126 struct pf_altqqueue	*pf_altqs_inactive;
127 struct pf_status	 pf_status;
128 
129 u_int32_t		 ticket_altqs_active;
130 u_int32_t		 ticket_altqs_inactive;
131 int			 altqs_inactive_open;
132 u_int32_t		 ticket_pabuf;
133 
134 struct pf_anchor_stackframe {
135 	struct pf_ruleset			*rs;
136 	struct pf_rule				*r;
137 	struct pf_anchor_node			*parent;
138 	struct pf_anchor			*child;
139 } pf_anchor_stack[64];
140 
141 vm_zone_t		 pf_src_tree_pl, pf_rule_pl, pf_pooladdr_pl;
142 vm_zone_t		 pf_state_pl, pf_state_key_pl;
143 vm_zone_t		 pf_altq_pl;
144 
145 void			 pf_print_host(struct pf_addr *, u_int16_t, u_int8_t);
146 
147 void			 pf_init_threshold(struct pf_threshold *, u_int32_t,
148 			    u_int32_t);
149 void			 pf_add_threshold(struct pf_threshold *);
150 int			 pf_check_threshold(struct pf_threshold *);
151 
152 void			 pf_change_ap(struct pf_addr *, u_int16_t *,
153 			    u_int16_t *, u_int16_t *, struct pf_addr *,
154 			    u_int16_t, u_int8_t, sa_family_t);
155 int			 pf_modulate_sack(struct mbuf *, int, struct pf_pdesc *,
156 			    struct tcphdr *, struct pf_state_peer *);
157 #ifdef INET6
158 void			 pf_change_a6(struct pf_addr *, u_int16_t *,
159 			    struct pf_addr *, u_int8_t);
160 #endif /* INET6 */
161 void			 pf_change_icmp(struct pf_addr *, u_int16_t *,
162 			    struct pf_addr *, struct pf_addr *, u_int16_t,
163 			    u_int16_t *, u_int16_t *, u_int16_t *,
164 			    u_int16_t *, u_int8_t, sa_family_t);
165 void			 pf_send_tcp(const struct pf_rule *, sa_family_t,
166 			    const struct pf_addr *, const struct pf_addr *,
167 			    u_int16_t, u_int16_t, u_int32_t, u_int32_t,
168 			    u_int8_t, u_int16_t, u_int16_t, u_int8_t, int,
169 			    u_int16_t, struct ether_header *, struct ifnet *);
170 void			 pf_send_icmp(struct mbuf *, u_int8_t, u_int8_t,
171 			    sa_family_t, struct pf_rule *);
172 struct pf_rule		*pf_match_translation(struct pf_pdesc *, struct mbuf *,
173 			    int, int, struct pfi_kif *,
174 			    struct pf_addr *, u_int16_t, struct pf_addr *,
175 			    u_int16_t, int);
176 struct pf_rule		*pf_get_translation(struct pf_pdesc *, struct mbuf *,
177 			    int, int, struct pfi_kif *, struct pf_src_node **,
178 			    struct pf_addr *, u_int16_t,
179 			    struct pf_addr *, u_int16_t,
180 			    struct pf_addr *, u_int16_t *);
181 void			 pf_attach_state(struct pf_state_key *,
182 			    struct pf_state *, int);
183 void			 pf_detach_state(struct pf_state *, int);
184 int			 pf_test_rule(struct pf_rule **, struct pf_state **,
185 			    int, struct pfi_kif *, struct mbuf *, int,
186 			    void *, struct pf_pdesc *, struct pf_rule **,
187 			    struct pf_ruleset **, struct ifqueue *, struct inpcb *);
188 int			 pf_test_fragment(struct pf_rule **, int,
189 			    struct pfi_kif *, struct mbuf *, void *,
190 			    struct pf_pdesc *, struct pf_rule **,
191 			    struct pf_ruleset **);
192 int			 pf_test_state_tcp(struct pf_state **, int,
193 			    struct pfi_kif *, struct mbuf *, int,
194 			    void *, struct pf_pdesc *, u_short *);
195 int			 pf_test_state_udp(struct pf_state **, int,
196 			    struct pfi_kif *, struct mbuf *, int,
197 			    void *, struct pf_pdesc *);
198 int			 pf_test_state_icmp(struct pf_state **, int,
199 			    struct pfi_kif *, struct mbuf *, int,
200 			    void *, struct pf_pdesc *, u_short *);
201 int			 pf_test_state_other(struct pf_state **, int,
202 			    struct pfi_kif *, struct pf_pdesc *);
203 int			 pf_match_tag(struct mbuf *, struct pf_rule *, int *);
204 void			 pf_step_into_anchor(int *, struct pf_ruleset **, int,
205 			    struct pf_rule **, struct pf_rule **,  int *);
206 int			 pf_step_out_of_anchor(int *, struct pf_ruleset **,
207 			     int, struct pf_rule **, struct pf_rule **,
208 			     int *);
209 void			 pf_hash(struct pf_addr *, struct pf_addr *,
210 			    struct pf_poolhashkey *, sa_family_t);
211 int			 pf_map_addr(u_int8_t, struct pf_rule *,
212 			    struct pf_addr *, struct pf_addr *,
213 			    struct pf_addr *, struct pf_src_node **);
214 int			 pf_get_sport(sa_family_t, u_int8_t, struct pf_rule *,
215 			    struct pf_addr *, struct pf_addr *, u_int16_t,
216 			    struct pf_addr *, u_int16_t*, u_int16_t, u_int16_t,
217 			    struct pf_src_node **);
218 void			 pf_route(struct mbuf **, struct pf_rule *, int,
219 			    struct ifnet *, struct pf_state *,
220 			    struct pf_pdesc *);
221 void			 pf_route6(struct mbuf **, struct pf_rule *, int,
222 			    struct ifnet *, struct pf_state *,
223 			    struct pf_pdesc *);
224 u_int8_t		 pf_get_wscale(struct mbuf *, int, u_int16_t,
225 			    sa_family_t);
226 u_int16_t		 pf_get_mss(struct mbuf *, int, u_int16_t,
227 			    sa_family_t);
228 u_int16_t		 pf_calc_mss(struct pf_addr *, sa_family_t,
229 				u_int16_t);
230 void			 pf_set_rt_ifp(struct pf_state *,
231 			    struct pf_addr *);
232 int			 pf_check_proto_cksum(struct mbuf *, int, int,
233 			    u_int8_t, sa_family_t);
234 int			 pf_addr_wrap_neq(struct pf_addr_wrap *,
235 			    struct pf_addr_wrap *);
236 struct pf_state		*pf_find_state(struct pfi_kif *,
237 			    struct pf_state_key_cmp *, u_int8_t);
238 int			 pf_src_connlimit(struct pf_state **);
239 void			 pf_stateins_err(const char *, struct pf_state *,
240 			    struct pfi_kif *);
241 int			 pf_check_congestion(struct ifqueue *);
242 
243 extern int pf_end_threads;
244 
245 struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX] = {
246 	{ &pf_state_pl, PFSTATE_HIWAT },
247 	{ &pf_src_tree_pl, PFSNODE_HIWAT },
248 	{ &pf_frent_pl, PFFRAG_FRENT_HIWAT },
249 	{ &pfr_ktable_pl, PFR_KTABLE_HIWAT },
250 	{ &pfr_kentry_pl, PFR_KENTRY_HIWAT }
251 };
252 
253 #define STATE_LOOKUP()							\
254 	do {								\
255 		if (direction == PF_IN)					\
256 			*state = pf_find_state(kif, &key, PF_EXT_GWY);	\
257 		else							\
258 			*state = pf_find_state(kif, &key, PF_LAN_EXT);	\
259 		if (*state == NULL || (*state)->timeout == PFTM_PURGE)	\
260 			return (PF_DROP);				\
261 		if (direction == PF_OUT &&				\
262 		    (((*state)->rule.ptr->rt == PF_ROUTETO &&		\
263 		    (*state)->rule.ptr->direction == PF_OUT) ||		\
264 		    ((*state)->rule.ptr->rt == PF_REPLYTO &&		\
265 		    (*state)->rule.ptr->direction == PF_IN)) &&		\
266 		    (*state)->rt_kif != NULL &&				\
267 		    (*state)->rt_kif != kif)				\
268 			return (PF_PASS);				\
269 	} while (0)
270 
271 #define	STATE_TRANSLATE(sk) \
272 	(sk)->lan.addr.addr32[0] != (sk)->gwy.addr.addr32[0] || \
273 	((sk)->af == AF_INET6 && \
274 	((sk)->lan.addr.addr32[1] != (sk)->gwy.addr.addr32[1] || \
275 	(sk)->lan.addr.addr32[2] != (sk)->gwy.addr.addr32[2] || \
276 	(sk)->lan.addr.addr32[3] != (sk)->gwy.addr.addr32[3])) || \
277 	(sk)->lan.port != (sk)->gwy.port
278 
279 #define BOUND_IFACE(r, k) \
280 	((r)->rule_flag & PFRULE_IFBOUND) ? (k) : pfi_all
281 
282 #define STATE_INC_COUNTERS(s)				\
283 	do {						\
284 		s->rule.ptr->states++;			\
285 		if (s->anchor.ptr != NULL)		\
286 			s->anchor.ptr->states++;	\
287 		if (s->nat_rule.ptr != NULL)		\
288 			s->nat_rule.ptr->states++;	\
289 	} while (0)
290 
291 #define STATE_DEC_COUNTERS(s)				\
292 	do {						\
293 		if (s->nat_rule.ptr != NULL)		\
294 			s->nat_rule.ptr->states--;	\
295 		if (s->anchor.ptr != NULL)		\
296 			s->anchor.ptr->states--;	\
297 		s->rule.ptr->states--;			\
298 	} while (0)
299 
300 static __inline int pf_src_compare(struct pf_src_node *, struct pf_src_node *);
301 static __inline int pf_state_compare_lan_ext(struct pf_state_key *,
302 	struct pf_state_key *);
303 static __inline int pf_state_compare_ext_gwy(struct pf_state_key *,
304 	struct pf_state_key *);
305 static __inline int pf_state_compare_id(struct pf_state *,
306 	struct pf_state *);
307 
308 struct pf_src_tree tree_src_tracking;
309 
310 struct pf_state_tree_id tree_id;
311 struct pf_state_queue state_list;
312 
313 RB_GENERATE(pf_src_tree, pf_src_node, entry, pf_src_compare);
314 RB_GENERATE(pf_state_tree_lan_ext, pf_state_key,
315     entry_lan_ext, pf_state_compare_lan_ext);
316 RB_GENERATE(pf_state_tree_ext_gwy, pf_state_key,
317     entry_ext_gwy, pf_state_compare_ext_gwy);
318 RB_GENERATE(pf_state_tree_id, pf_state,
319     entry_id, pf_state_compare_id);
320 
321 #define	PF_DT_SKIP_LANEXT	0x01
322 #define	PF_DT_SKIP_EXTGWY	0x02
323 
324 static __inline int
325 pf_src_compare(struct pf_src_node *a, struct pf_src_node *b)
326 {
327 	int	diff;
328 
329 	if (a->rule.ptr > b->rule.ptr)
330 		return (1);
331 	if (a->rule.ptr < b->rule.ptr)
332 		return (-1);
333 	if ((diff = a->af - b->af) != 0)
334 		return (diff);
335 	switch (a->af) {
336 #ifdef INET
337 	case AF_INET:
338 		if (a->addr.addr32[0] > b->addr.addr32[0])
339 			return (1);
340 		if (a->addr.addr32[0] < b->addr.addr32[0])
341 			return (-1);
342 		break;
343 #endif /* INET */
344 #ifdef INET6
345 	case AF_INET6:
346 		if (a->addr.addr32[3] > b->addr.addr32[3])
347 			return (1);
348 		if (a->addr.addr32[3] < b->addr.addr32[3])
349 			return (-1);
350 		if (a->addr.addr32[2] > b->addr.addr32[2])
351 			return (1);
352 		if (a->addr.addr32[2] < b->addr.addr32[2])
353 			return (-1);
354 		if (a->addr.addr32[1] > b->addr.addr32[1])
355 			return (1);
356 		if (a->addr.addr32[1] < b->addr.addr32[1])
357 			return (-1);
358 		if (a->addr.addr32[0] > b->addr.addr32[0])
359 			return (1);
360 		if (a->addr.addr32[0] < b->addr.addr32[0])
361 			return (-1);
362 		break;
363 #endif /* INET6 */
364 	}
365 	return (0);
366 }
367 
368 u_int32_t
369 pf_state_hash(struct pf_state_key *sk)
370 {
371 	u_int32_t hv = (intptr_t)sk / sizeof(*sk);
372 
373 	hv ^= crc32(&sk->lan, sizeof(sk->lan));
374 	hv ^= crc32(&sk->gwy, sizeof(sk->gwy));
375 	hv ^= crc32(&sk->ext, sizeof(sk->ext));
376 	if (hv == 0)	/* disallow 0 */
377 		hv = 1;
378 	return(hv);
379 }
380 
381 static __inline int
382 pf_state_compare_lan_ext(struct pf_state_key *a, struct pf_state_key *b)
383 {
384 	int	diff;
385 
386 	if ((diff = a->proto - b->proto) != 0)
387 		return (diff);
388 	if ((diff = a->af - b->af) != 0)
389 		return (diff);
390 	switch (a->af) {
391 #ifdef INET
392 	case AF_INET:
393 		if (a->lan.addr.addr32[0] > b->lan.addr.addr32[0])
394 			return (1);
395 		if (a->lan.addr.addr32[0] < b->lan.addr.addr32[0])
396 			return (-1);
397 		if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
398 			return (1);
399 		if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
400 			return (-1);
401 		break;
402 #endif /* INET */
403 #ifdef INET6
404 	case AF_INET6:
405 		if (a->lan.addr.addr32[3] > b->lan.addr.addr32[3])
406 			return (1);
407 		if (a->lan.addr.addr32[3] < b->lan.addr.addr32[3])
408 			return (-1);
409 		if (a->ext.addr.addr32[3] > b->ext.addr.addr32[3])
410 			return (1);
411 		if (a->ext.addr.addr32[3] < b->ext.addr.addr32[3])
412 			return (-1);
413 		if (a->lan.addr.addr32[2] > b->lan.addr.addr32[2])
414 			return (1);
415 		if (a->lan.addr.addr32[2] < b->lan.addr.addr32[2])
416 			return (-1);
417 		if (a->ext.addr.addr32[2] > b->ext.addr.addr32[2])
418 			return (1);
419 		if (a->ext.addr.addr32[2] < b->ext.addr.addr32[2])
420 			return (-1);
421 		if (a->lan.addr.addr32[1] > b->lan.addr.addr32[1])
422 			return (1);
423 		if (a->lan.addr.addr32[1] < b->lan.addr.addr32[1])
424 			return (-1);
425 		if (a->ext.addr.addr32[1] > b->ext.addr.addr32[1])
426 			return (1);
427 		if (a->ext.addr.addr32[1] < b->ext.addr.addr32[1])
428 			return (-1);
429 		if (a->lan.addr.addr32[0] > b->lan.addr.addr32[0])
430 			return (1);
431 		if (a->lan.addr.addr32[0] < b->lan.addr.addr32[0])
432 			return (-1);
433 		if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
434 			return (1);
435 		if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
436 			return (-1);
437 		break;
438 #endif /* INET6 */
439 	}
440 
441 	if ((diff = a->lan.port - b->lan.port) != 0)
442 		return (diff);
443 	if ((diff = a->ext.port - b->ext.port) != 0)
444 		return (diff);
445 
446 	return (0);
447 }
448 
449 static __inline int
450 pf_state_compare_ext_gwy(struct pf_state_key *a, struct pf_state_key *b)
451 {
452 	int	diff;
453 
454 	if ((diff = a->proto - b->proto) != 0)
455 		return (diff);
456 	if ((diff = a->af - b->af) != 0)
457 		return (diff);
458 	switch (a->af) {
459 #ifdef INET
460 	case AF_INET:
461 		if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
462 			return (1);
463 		if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
464 			return (-1);
465 		if (a->gwy.addr.addr32[0] > b->gwy.addr.addr32[0])
466 			return (1);
467 		if (a->gwy.addr.addr32[0] < b->gwy.addr.addr32[0])
468 			return (-1);
469 		break;
470 #endif /* INET */
471 #ifdef INET6
472 	case AF_INET6:
473 		if (a->ext.addr.addr32[3] > b->ext.addr.addr32[3])
474 			return (1);
475 		if (a->ext.addr.addr32[3] < b->ext.addr.addr32[3])
476 			return (-1);
477 		if (a->gwy.addr.addr32[3] > b->gwy.addr.addr32[3])
478 			return (1);
479 		if (a->gwy.addr.addr32[3] < b->gwy.addr.addr32[3])
480 			return (-1);
481 		if (a->ext.addr.addr32[2] > b->ext.addr.addr32[2])
482 			return (1);
483 		if (a->ext.addr.addr32[2] < b->ext.addr.addr32[2])
484 			return (-1);
485 		if (a->gwy.addr.addr32[2] > b->gwy.addr.addr32[2])
486 			return (1);
487 		if (a->gwy.addr.addr32[2] < b->gwy.addr.addr32[2])
488 			return (-1);
489 		if (a->ext.addr.addr32[1] > b->ext.addr.addr32[1])
490 			return (1);
491 		if (a->ext.addr.addr32[1] < b->ext.addr.addr32[1])
492 			return (-1);
493 		if (a->gwy.addr.addr32[1] > b->gwy.addr.addr32[1])
494 			return (1);
495 		if (a->gwy.addr.addr32[1] < b->gwy.addr.addr32[1])
496 			return (-1);
497 		if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
498 			return (1);
499 		if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
500 			return (-1);
501 		if (a->gwy.addr.addr32[0] > b->gwy.addr.addr32[0])
502 			return (1);
503 		if (a->gwy.addr.addr32[0] < b->gwy.addr.addr32[0])
504 			return (-1);
505 		break;
506 #endif /* INET6 */
507 	}
508 
509 	if ((diff = a->ext.port - b->ext.port) != 0)
510 		return (diff);
511 	if ((diff = a->gwy.port - b->gwy.port) != 0)
512 		return (diff);
513 
514 	return (0);
515 }
516 
517 static __inline int
518 pf_state_compare_id(struct pf_state *a, struct pf_state *b)
519 {
520 	if (a->id > b->id)
521 		return (1);
522 	if (a->id < b->id)
523 		return (-1);
524 	if (a->creatorid > b->creatorid)
525 		return (1);
526 	if (a->creatorid < b->creatorid)
527 		return (-1);
528 
529 	return (0);
530 }
531 
532 #ifdef INET6
533 void
534 pf_addrcpy(struct pf_addr *dst, struct pf_addr *src, sa_family_t af)
535 {
536 	switch (af) {
537 #ifdef INET
538 	case AF_INET:
539 		dst->addr32[0] = src->addr32[0];
540 		break;
541 #endif /* INET */
542 	case AF_INET6:
543 		dst->addr32[0] = src->addr32[0];
544 		dst->addr32[1] = src->addr32[1];
545 		dst->addr32[2] = src->addr32[2];
546 		dst->addr32[3] = src->addr32[3];
547 		break;
548 	}
549 }
550 #endif /* INET6 */
551 
552 struct pf_state *
553 pf_find_state_byid(struct pf_state_cmp *key)
554 {
555 	pf_status.fcounters[FCNT_STATE_SEARCH]++;
556 
557 	return (RB_FIND(pf_state_tree_id, &tree_id, (struct pf_state *)key));
558 }
559 
560 struct pf_state *
561 pf_find_state(struct pfi_kif *kif, struct pf_state_key_cmp *key, u_int8_t tree)
562 {
563 	struct pf_state_key	*sk;
564 	struct pf_state		*s;
565 
566 	pf_status.fcounters[FCNT_STATE_SEARCH]++;
567 
568 	switch (tree) {
569 	case PF_LAN_EXT:
570 		sk = RB_FIND(pf_state_tree_lan_ext, &pf_statetbl_lan_ext,
571 		    (struct pf_state_key *)key);
572 		break;
573 	case PF_EXT_GWY:
574 		sk = RB_FIND(pf_state_tree_ext_gwy, &pf_statetbl_ext_gwy,
575 		    (struct pf_state_key *)key);
576 		break;
577 	default:
578 		panic("pf_find_state");
579 	}
580 
581 	/* list is sorted, if-bound states before floating ones */
582 	if (sk != NULL)
583 		TAILQ_FOREACH(s, &sk->states, next)
584 			if (s->kif == pfi_all || s->kif == kif)
585 				return (s);
586 
587 	return (NULL);
588 }
589 
590 struct pf_state *
591 pf_find_state_all(struct pf_state_key_cmp *key, u_int8_t tree, int *more)
592 {
593 	struct pf_state_key	*sk;
594 	struct pf_state		*s, *ret = NULL;
595 
596 	pf_status.fcounters[FCNT_STATE_SEARCH]++;
597 
598 	switch (tree) {
599 	case PF_LAN_EXT:
600 		sk = RB_FIND(pf_state_tree_lan_ext,
601 		    &pf_statetbl_lan_ext, (struct pf_state_key *)key);
602 		break;
603 	case PF_EXT_GWY:
604 		sk = RB_FIND(pf_state_tree_ext_gwy,
605 		    &pf_statetbl_ext_gwy, (struct pf_state_key *)key);
606 		break;
607 	default:
608 		panic("pf_find_state_all");
609 	}
610 
611 	if (sk != NULL) {
612 		ret = TAILQ_FIRST(&sk->states);
613 		if (more == NULL)
614 			return (ret);
615 
616 		TAILQ_FOREACH(s, &sk->states, next)
617 			(*more)++;
618 	}
619 
620 	return (ret);
621 }
622 
623 void
624 pf_init_threshold(struct pf_threshold *threshold,
625     u_int32_t limit, u_int32_t seconds)
626 {
627 	threshold->limit = limit * PF_THRESHOLD_MULT;
628 	threshold->seconds = seconds;
629 	threshold->count = 0;
630 	threshold->last = time_second;
631 }
632 
633 void
634 pf_add_threshold(struct pf_threshold *threshold)
635 {
636 	u_int32_t t = time_second, diff = t - threshold->last;
637 
638 	if (diff >= threshold->seconds)
639 		threshold->count = 0;
640 	else
641 		threshold->count -= threshold->count * diff /
642 		    threshold->seconds;
643 	threshold->count += PF_THRESHOLD_MULT;
644 	threshold->last = t;
645 }
646 
647 int
648 pf_check_threshold(struct pf_threshold *threshold)
649 {
650 	return (threshold->count > threshold->limit);
651 }
652 
653 int
654 pf_src_connlimit(struct pf_state **state)
655 {
656 	int bad = 0;
657 
658 	(*state)->src_node->conn++;
659 	(*state)->src.tcp_est = 1;
660 	pf_add_threshold(&(*state)->src_node->conn_rate);
661 
662 	if ((*state)->rule.ptr->max_src_conn &&
663 	    (*state)->rule.ptr->max_src_conn <
664 	    (*state)->src_node->conn) {
665 		pf_status.lcounters[LCNT_SRCCONN]++;
666 		bad++;
667 	}
668 
669 	if ((*state)->rule.ptr->max_src_conn_rate.limit &&
670 	    pf_check_threshold(&(*state)->src_node->conn_rate)) {
671 		pf_status.lcounters[LCNT_SRCCONNRATE]++;
672 		bad++;
673 	}
674 
675 	if (!bad)
676 		return (0);
677 
678 	if ((*state)->rule.ptr->overload_tbl) {
679 		struct pfr_addr p;
680 		u_int32_t	killed = 0;
681 
682 		pf_status.lcounters[LCNT_OVERLOAD_TABLE]++;
683 		if (pf_status.debug >= PF_DEBUG_MISC) {
684 			kprintf("pf_src_connlimit: blocking address ");
685 			pf_print_host(&(*state)->src_node->addr, 0,
686 			    (*state)->state_key->af);
687 		}
688 
689 		bzero(&p, sizeof(p));
690 		p.pfra_af = (*state)->state_key->af;
691 		switch ((*state)->state_key->af) {
692 #ifdef INET
693 		case AF_INET:
694 			p.pfra_net = 32;
695 			p.pfra_ip4addr = (*state)->src_node->addr.v4;
696 			break;
697 #endif /* INET */
698 #ifdef INET6
699 		case AF_INET6:
700 			p.pfra_net = 128;
701 			p.pfra_ip6addr = (*state)->src_node->addr.v6;
702 			break;
703 #endif /* INET6 */
704 		}
705 
706 		pfr_insert_kentry((*state)->rule.ptr->overload_tbl,
707 		    &p, time_second);
708 
709 		/* kill existing states if that's required. */
710 		if ((*state)->rule.ptr->flush) {
711 			struct pf_state_key *sk;
712 			struct pf_state *st;
713 
714 			pf_status.lcounters[LCNT_OVERLOAD_FLUSH]++;
715 			RB_FOREACH(st, pf_state_tree_id, &tree_id) {
716 				sk = st->state_key;
717 				/*
718 				 * Kill states from this source.  (Only those
719 				 * from the same rule if PF_FLUSH_GLOBAL is not
720 				 * set)
721 				 */
722 				if (sk->af ==
723 				    (*state)->state_key->af &&
724 				    (((*state)->state_key->direction ==
725 				        PF_OUT &&
726 				    PF_AEQ(&(*state)->src_node->addr,
727 				        &sk->lan.addr, sk->af)) ||
728 				    ((*state)->state_key->direction == PF_IN &&
729 				    PF_AEQ(&(*state)->src_node->addr,
730 				        &sk->ext.addr, sk->af))) &&
731 				    ((*state)->rule.ptr->flush &
732 				    PF_FLUSH_GLOBAL ||
733 				    (*state)->rule.ptr == st->rule.ptr)) {
734 					st->timeout = PFTM_PURGE;
735 					st->src.state = st->dst.state =
736 					    TCPS_CLOSED;
737 					killed++;
738 				}
739 			}
740 			if (pf_status.debug >= PF_DEBUG_MISC)
741 				kprintf(", %u states killed", killed);
742 		}
743 		if (pf_status.debug >= PF_DEBUG_MISC)
744 			kprintf("\n");
745 	}
746 
747 	/* kill this state */
748 	(*state)->timeout = PFTM_PURGE;
749 	(*state)->src.state = (*state)->dst.state = TCPS_CLOSED;
750 	return (1);
751 }
752 
753 int
754 pf_insert_src_node(struct pf_src_node **sn, struct pf_rule *rule,
755     struct pf_addr *src, sa_family_t af)
756 {
757 	struct pf_src_node	k;
758 
759 	if (*sn == NULL) {
760 		k.af = af;
761 		PF_ACPY(&k.addr, src, af);
762 		if (rule->rule_flag & PFRULE_RULESRCTRACK ||
763 		    rule->rpool.opts & PF_POOL_STICKYADDR)
764 			k.rule.ptr = rule;
765 		else
766 			k.rule.ptr = NULL;
767 		pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
768 		*sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k);
769 	}
770 	if (*sn == NULL) {
771 		if (!rule->max_src_nodes ||
772 		    rule->src_nodes < rule->max_src_nodes)
773 			(*sn) = pool_get(&pf_src_tree_pl, PR_NOWAIT);
774 		else
775 			pf_status.lcounters[LCNT_SRCNODES]++;
776 		if ((*sn) == NULL)
777 			return (-1);
778 		bzero(*sn, sizeof(struct pf_src_node));
779 
780 		pf_init_threshold(&(*sn)->conn_rate,
781 		    rule->max_src_conn_rate.limit,
782 		    rule->max_src_conn_rate.seconds);
783 
784 		(*sn)->af = af;
785 		if (rule->rule_flag & PFRULE_RULESRCTRACK ||
786 		    rule->rpool.opts & PF_POOL_STICKYADDR)
787 			(*sn)->rule.ptr = rule;
788 		else
789 			(*sn)->rule.ptr = NULL;
790 		PF_ACPY(&(*sn)->addr, src, af);
791 		if (RB_INSERT(pf_src_tree,
792 		    &tree_src_tracking, *sn) != NULL) {
793 			if (pf_status.debug >= PF_DEBUG_MISC) {
794 				kprintf("pf: src_tree insert failed: ");
795 				pf_print_host(&(*sn)->addr, 0, af);
796 				kprintf("\n");
797 			}
798 			pool_put(&pf_src_tree_pl, *sn);
799 			return (-1);
800 		}
801 		(*sn)->creation = time_second;
802 		(*sn)->ruletype = rule->action;
803 		if ((*sn)->rule.ptr != NULL)
804 			(*sn)->rule.ptr->src_nodes++;
805 		pf_status.scounters[SCNT_SRC_NODE_INSERT]++;
806 		pf_status.src_nodes++;
807 	} else {
808 		if (rule->max_src_states &&
809 		    (*sn)->states >= rule->max_src_states) {
810 			pf_status.lcounters[LCNT_SRCSTATES]++;
811 			return (-1);
812 		}
813 	}
814 	return (0);
815 }
816 
817 void
818 pf_stateins_err(const char *tree, struct pf_state *s, struct pfi_kif *kif)
819 {
820 	struct pf_state_key	*sk = s->state_key;
821 
822 	if (pf_status.debug >= PF_DEBUG_MISC) {
823 		kprintf("pf: state insert failed: %s %s", tree, kif->pfik_name);
824 		kprintf(" lan: ");
825 		pf_print_host(&sk->lan.addr, sk->lan.port,
826 		    sk->af);
827 		kprintf(" gwy: ");
828 		pf_print_host(&sk->gwy.addr, sk->gwy.port,
829 		    sk->af);
830 		kprintf(" ext: ");
831 		pf_print_host(&sk->ext.addr, sk->ext.port,
832 		    sk->af);
833 		if (s->sync_flags & PFSTATE_FROMSYNC)
834 			kprintf(" (from sync)");
835 		kprintf("\n");
836 	}
837 }
838 
839 int
840 pf_insert_state(struct pfi_kif *kif, struct pf_state *s)
841 {
842 	struct pf_state_key	*cur;
843 	struct pf_state		*sp;
844 
845 	KKASSERT(s->state_key != NULL);
846 	s->kif = kif;
847 
848 	if ((cur = RB_INSERT(pf_state_tree_lan_ext, &pf_statetbl_lan_ext,
849 	    s->state_key)) != NULL) {
850 		/* key exists. check for same kif, if none, add to key */
851 		TAILQ_FOREACH(sp, &cur->states, next)
852 			if (sp->kif == kif) {	/* collision! */
853 				pf_stateins_err("tree_lan_ext", s, kif);
854 				pf_detach_state(s,
855 				    PF_DT_SKIP_LANEXT|PF_DT_SKIP_EXTGWY);
856 				return (-1);
857 			}
858 		pf_detach_state(s, PF_DT_SKIP_LANEXT|PF_DT_SKIP_EXTGWY);
859 		pf_attach_state(cur, s, kif == pfi_all ? 1 : 0);
860 	}
861 
862 	/* if cur != NULL, we already found a state key and attached to it */
863 	if (cur == NULL && (cur = RB_INSERT(pf_state_tree_ext_gwy,
864 	    &pf_statetbl_ext_gwy, s->state_key)) != NULL) {
865 		/* must not happen. we must have found the sk above! */
866 		pf_stateins_err("tree_ext_gwy", s, kif);
867 		pf_detach_state(s, PF_DT_SKIP_EXTGWY);
868 		return (-1);
869 	}
870 
871 	if (s->id == 0 && s->creatorid == 0) {
872 		s->id = htobe64(pf_status.stateid++);
873 		s->creatorid = pf_status.hostid;
874 	}
875 	if (RB_INSERT(pf_state_tree_id, &tree_id, s) != NULL) {
876 		if (pf_status.debug >= PF_DEBUG_MISC) {
877 			kprintf("pf: state insert failed: "
878 			    "id: %016llx creatorid: %08x",
879 			    be64toh(s->id), ntohl(s->creatorid));
880 			if (s->sync_flags & PFSTATE_FROMSYNC)
881 				kprintf(" (from sync)");
882 			kprintf("\n");
883 		}
884 		pf_detach_state(s, 0);
885 		return (-1);
886 	}
887 	TAILQ_INSERT_TAIL(&state_list, s, entry_list);
888 	pf_status.fcounters[FCNT_STATE_INSERT]++;
889 	pf_status.states++;
890 	pfi_kif_ref(kif, PFI_KIF_REF_STATE);
891 #if NPFSYNC
892 	pfsync_insert_state(s);
893 #endif
894 	return (0);
895 }
896 
897 void
898 pf_purge_thread(void *v)
899 {
900 	int nloops = 0;
901 	int locked = 0;
902 
903 	get_mplock();
904 	for (;;) {
905 		tsleep(pf_purge_thread, PWAIT, "pftm", 1 * hz);
906 
907 		lockmgr(&pf_consistency_lock, LK_EXCLUSIVE);
908 
909 		if (pf_end_threads) {
910 			pf_purge_expired_states(pf_status.states, 1);
911 			pf_purge_expired_fragments();
912 			pf_purge_expired_src_nodes(1);
913 			pf_end_threads++;
914 
915 			lockmgr(&pf_consistency_lock, LK_RELEASE);
916 			wakeup(pf_purge_thread);
917 			kthread_exit();
918 		}
919 		crit_enter();
920 
921 		/* process a fraction of the state table every second */
922 		if(!pf_purge_expired_states(1 + (pf_status.states
923 		    / pf_default_rule.timeout[PFTM_INTERVAL]), 0)) {
924 
925 			pf_purge_expired_states(1 + (pf_status.states
926 			    / pf_default_rule.timeout[PFTM_INTERVAL]), 1);
927 		}
928 
929 		/* purge other expired types every PFTM_INTERVAL seconds */
930 		if (++nloops >= pf_default_rule.timeout[PFTM_INTERVAL]) {
931 			pf_purge_expired_fragments();
932 			if (!pf_purge_expired_src_nodes(locked)) {
933 				pf_purge_expired_src_nodes(1);
934 			}
935 			nloops = 0;
936 		}
937 		crit_exit();
938 		lockmgr(&pf_consistency_lock, LK_RELEASE);
939 	}
940 	rel_mplock();
941 }
942 
943 u_int32_t
944 pf_state_expires(const struct pf_state *state)
945 {
946 	u_int32_t	timeout;
947 	u_int32_t	start;
948 	u_int32_t	end;
949 	u_int32_t	states;
950 
951 	/* handle all PFTM_* > PFTM_MAX here */
952 	if (state->timeout == PFTM_PURGE)
953 		return (time_second);
954 	if (state->timeout == PFTM_UNTIL_PACKET)
955 		return (0);
956 	KKASSERT(state->timeout != PFTM_UNLINKED);
957 	KASSERT((state->timeout < PFTM_MAX),
958 		("pf_state_expires: timeout > PFTM_MAX"));
959 	timeout = state->rule.ptr->timeout[state->timeout];
960 	if (!timeout)
961 		timeout = pf_default_rule.timeout[state->timeout];
962 	start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START];
963 	if (start) {
964 		end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END];
965 		states = state->rule.ptr->states;
966 	} else {
967 		start = pf_default_rule.timeout[PFTM_ADAPTIVE_START];
968 		end = pf_default_rule.timeout[PFTM_ADAPTIVE_END];
969 		states = pf_status.states;
970 	}
971 	if (end && states > start && start < end) {
972 		if (states < end)
973 			return (state->expire + timeout * (end - states) /
974 			    (end - start));
975 		else
976 			return (time_second);
977 	}
978 	return (state->expire + timeout);
979 }
980 
981 int
982 pf_purge_expired_src_nodes(int waslocked)
983 {
984 	 struct pf_src_node		*cur, *next;
985 	 int				 locked = waslocked;
986 
987 	 for (cur = RB_MIN(pf_src_tree, &tree_src_tracking); cur; cur = next) {
988 		 next = RB_NEXT(pf_src_tree, &tree_src_tracking, cur);
989 
990 		 if (cur->states <= 0 && cur->expire <= time_second) {
991 			 if (! locked) {
992 				 lockmgr(&pf_consistency_lock, LK_EXCLUSIVE);
993 			 	 next = RB_NEXT(pf_src_tree,
994 				     &tree_src_tracking, cur);
995 				 locked = 1;
996 			 }
997 			 if (cur->rule.ptr != NULL) {
998 				 cur->rule.ptr->src_nodes--;
999 				 if (cur->rule.ptr->states <= 0 &&
1000 				     cur->rule.ptr->max_src_nodes <= 0)
1001 					 pf_rm_rule(NULL, cur->rule.ptr);
1002 			 }
1003 			 RB_REMOVE(pf_src_tree, &tree_src_tracking, cur);
1004 			 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
1005 			 pf_status.src_nodes--;
1006 			 pool_put(&pf_src_tree_pl, cur);
1007 		 }
1008 	 }
1009 
1010 	 if (locked && !waslocked)
1011 		lockmgr(&pf_consistency_lock, LK_RELEASE);
1012 	return(1);
1013 }
1014 
1015 void
1016 pf_src_tree_remove_state(struct pf_state *s)
1017 {
1018 	u_int32_t timeout;
1019 
1020 	if (s->src_node != NULL) {
1021 		if (s->src.tcp_est)
1022 			--s->src_node->conn;
1023 		if (--s->src_node->states <= 0) {
1024 			timeout = s->rule.ptr->timeout[PFTM_SRC_NODE];
1025 			if (!timeout)
1026 				timeout =
1027 				    pf_default_rule.timeout[PFTM_SRC_NODE];
1028 			s->src_node->expire = time_second + timeout;
1029 		}
1030 	}
1031 	if (s->nat_src_node != s->src_node && s->nat_src_node != NULL) {
1032 		if (--s->nat_src_node->states <= 0) {
1033 			timeout = s->rule.ptr->timeout[PFTM_SRC_NODE];
1034 			if (!timeout)
1035 				timeout =
1036 				    pf_default_rule.timeout[PFTM_SRC_NODE];
1037 			s->nat_src_node->expire = time_second + timeout;
1038 		}
1039 	}
1040 	s->src_node = s->nat_src_node = NULL;
1041 }
1042 
1043 /* callers should be at crit_enter() */
1044 void
1045 pf_unlink_state(struct pf_state *cur)
1046 {
1047 	if (cur->src.state == PF_TCPS_PROXY_DST) {
1048 		pf_send_tcp(cur->rule.ptr, cur->state_key->af,
1049 		    &cur->state_key->ext.addr, &cur->state_key->lan.addr,
1050 		    cur->state_key->ext.port, cur->state_key->lan.port,
1051 		    cur->src.seqhi, cur->src.seqlo + 1,
1052 		    TH_RST|TH_ACK, 0, 0, 0, 1, cur->tag, NULL, NULL);
1053 	}
1054 	RB_REMOVE(pf_state_tree_id, &tree_id, cur);
1055 #if NPFSYNC
1056 	if (cur->creatorid == pf_status.hostid)
1057 		pfsync_delete_state(cur);
1058 #endif
1059 	cur->timeout = PFTM_UNLINKED;
1060 	pf_src_tree_remove_state(cur);
1061 	pf_detach_state(cur, 0);
1062 }
1063 
1064 /* callers should be at crit_enter() and hold the
1065  * write_lock on pf_consistency_lock */
1066 void
1067 pf_free_state(struct pf_state *cur)
1068 {
1069 #if NPFSYNC
1070 	if (pfsyncif != NULL &&
1071 	    (pfsyncif->sc_bulk_send_next == cur ||
1072 	    pfsyncif->sc_bulk_terminator == cur))
1073 		return;
1074 #endif
1075 	KKASSERT(cur->timeout == PFTM_UNLINKED);
1076 	if (--cur->rule.ptr->states <= 0 &&
1077 	    cur->rule.ptr->src_nodes <= 0)
1078 		pf_rm_rule(NULL, cur->rule.ptr);
1079 	if (cur->nat_rule.ptr != NULL)
1080 		if (--cur->nat_rule.ptr->states <= 0 &&
1081 			cur->nat_rule.ptr->src_nodes <= 0)
1082 			pf_rm_rule(NULL, cur->nat_rule.ptr);
1083 	if (cur->anchor.ptr != NULL)
1084 		if (--cur->anchor.ptr->states <= 0)
1085 			pf_rm_rule(NULL, cur->anchor.ptr);
1086 	pf_normalize_tcp_cleanup(cur);
1087 	pfi_kif_unref(cur->kif, PFI_KIF_REF_STATE);
1088 	TAILQ_REMOVE(&state_list, cur, entry_list);
1089 	if (cur->tag)
1090 		pf_tag_unref(cur->tag);
1091 	pool_put(&pf_state_pl, cur);
1092 	pf_status.fcounters[FCNT_STATE_REMOVALS]++;
1093 	pf_status.states--;
1094 }
1095 
1096 int
1097 pf_purge_expired_states(u_int32_t maxcheck, int waslocked)
1098 {
1099 	static struct pf_state	*cur = NULL;
1100 	struct pf_state		*next;
1101 	int 			 locked = waslocked;
1102 
1103 	while (maxcheck--) {
1104 		/* wrap to start of list when we hit the end */
1105 		if (cur == NULL) {
1106 			cur = TAILQ_FIRST(&state_list);
1107 			if (cur == NULL)
1108 				break;	/* list empty */
1109 		}
1110 
1111 		/* get next state, as cur may get deleted */
1112 		next = TAILQ_NEXT(cur, entry_list);
1113 
1114 		if (cur->timeout == PFTM_UNLINKED) {
1115 			/* free unlinked state */
1116 			if (! locked) {
1117 				lockmgr(&pf_consistency_lock, LK_EXCLUSIVE);
1118 				locked = 1;
1119 			}
1120 			pf_free_state(cur);
1121 		} else if (pf_state_expires(cur) <= time_second) {
1122 			/* unlink and free expired state */
1123 			pf_unlink_state(cur);
1124 			if (! locked) {
1125 				if (!lockmgr(&pf_consistency_lock, LK_EXCLUSIVE))
1126 					return (0);
1127 				locked = 1;
1128 			}
1129 			pf_free_state(cur);
1130 		}
1131 		cur = next;
1132 	}
1133 
1134 	if (locked)
1135 		lockmgr(&pf_consistency_lock, LK_RELEASE);
1136 	return (1);
1137 }
1138 
1139 int
1140 pf_tbladdr_setup(struct pf_ruleset *rs, struct pf_addr_wrap *aw)
1141 {
1142 	if (aw->type != PF_ADDR_TABLE)
1143 		return (0);
1144 	if ((aw->p.tbl = pfr_attach_table(rs, aw->v.tblname)) == NULL)
1145 		return (1);
1146 	return (0);
1147 }
1148 
1149 void
1150 pf_tbladdr_remove(struct pf_addr_wrap *aw)
1151 {
1152 	if (aw->type != PF_ADDR_TABLE || aw->p.tbl == NULL)
1153 		return;
1154 	pfr_detach_table(aw->p.tbl);
1155 	aw->p.tbl = NULL;
1156 }
1157 
1158 void
1159 pf_tbladdr_copyout(struct pf_addr_wrap *aw)
1160 {
1161 	struct pfr_ktable *kt = aw->p.tbl;
1162 
1163 	if (aw->type != PF_ADDR_TABLE || kt == NULL)
1164 		return;
1165 	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1166 		kt = kt->pfrkt_root;
1167 	aw->p.tbl = NULL;
1168 	aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ?
1169 		kt->pfrkt_cnt : -1;
1170 }
1171 
1172 void
1173 pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af)
1174 {
1175 	switch (af) {
1176 #ifdef INET
1177 	case AF_INET: {
1178 		u_int32_t a = ntohl(addr->addr32[0]);
1179 		kprintf("%u.%u.%u.%u", (a>>24)&255, (a>>16)&255,
1180 		    (a>>8)&255, a&255);
1181 		if (p) {
1182 			p = ntohs(p);
1183 			kprintf(":%u", p);
1184 		}
1185 		break;
1186 	}
1187 #endif /* INET */
1188 #ifdef INET6
1189 	case AF_INET6: {
1190 		u_int16_t b;
1191 		u_int8_t i, curstart = 255, curend = 0,
1192 		    maxstart = 0, maxend = 0;
1193 		for (i = 0; i < 8; i++) {
1194 			if (!addr->addr16[i]) {
1195 				if (curstart == 255)
1196 					curstart = i;
1197 				else
1198 					curend = i;
1199 			} else {
1200 				if (curstart) {
1201 					if ((curend - curstart) >
1202 					    (maxend - maxstart)) {
1203 						maxstart = curstart;
1204 						maxend = curend;
1205 						curstart = 255;
1206 					}
1207 				}
1208 			}
1209 		}
1210 		for (i = 0; i < 8; i++) {
1211 			if (i >= maxstart && i <= maxend) {
1212 				if (maxend != 7) {
1213 					if (i == maxstart)
1214 						kprintf(":");
1215 				} else {
1216 					if (i == maxend)
1217 						kprintf(":");
1218 				}
1219 			} else {
1220 				b = ntohs(addr->addr16[i]);
1221 				kprintf("%x", b);
1222 				if (i < 7)
1223 					kprintf(":");
1224 			}
1225 		}
1226 		if (p) {
1227 			p = ntohs(p);
1228 			kprintf("[%u]", p);
1229 		}
1230 		break;
1231 	}
1232 #endif /* INET6 */
1233 	}
1234 }
1235 
1236 void
1237 pf_print_state(struct pf_state *s)
1238 {
1239 	struct pf_state_key *sk = s->state_key;
1240 	switch (sk->proto) {
1241 	case IPPROTO_TCP:
1242 		kprintf("TCP ");
1243 		break;
1244 	case IPPROTO_UDP:
1245 		kprintf("UDP ");
1246 		break;
1247 	case IPPROTO_ICMP:
1248 		kprintf("ICMP ");
1249 		break;
1250 	case IPPROTO_ICMPV6:
1251 		kprintf("ICMPV6 ");
1252 		break;
1253 	default:
1254 		kprintf("%u ", sk->proto);
1255 		break;
1256 	}
1257 	pf_print_host(&sk->lan.addr, sk->lan.port, sk->af);
1258 	kprintf(" ");
1259 	pf_print_host(&sk->gwy.addr, sk->gwy.port, sk->af);
1260 	kprintf(" ");
1261 	pf_print_host(&sk->ext.addr, sk->ext.port, sk->af);
1262 	kprintf(" [lo=%u high=%u win=%u modulator=%u", s->src.seqlo,
1263 	    s->src.seqhi, s->src.max_win, s->src.seqdiff);
1264 	if (s->src.wscale && s->dst.wscale)
1265 		kprintf(" wscale=%u", s->src.wscale & PF_WSCALE_MASK);
1266 	kprintf("]");
1267 	kprintf(" [lo=%u high=%u win=%u modulator=%u", s->dst.seqlo,
1268 	    s->dst.seqhi, s->dst.max_win, s->dst.seqdiff);
1269 	if (s->src.wscale && s->dst.wscale)
1270 		kprintf(" wscale=%u", s->dst.wscale & PF_WSCALE_MASK);
1271 	kprintf("]");
1272 	kprintf(" %u:%u", s->src.state, s->dst.state);
1273 }
1274 
1275 void
1276 pf_print_flags(u_int8_t f)
1277 {
1278 	if (f)
1279 		kprintf(" ");
1280 	if (f & TH_FIN)
1281 		kprintf("F");
1282 	if (f & TH_SYN)
1283 		kprintf("S");
1284 	if (f & TH_RST)
1285 		kprintf("R");
1286 	if (f & TH_PUSH)
1287 		kprintf("P");
1288 	if (f & TH_ACK)
1289 		kprintf("A");
1290 	if (f & TH_URG)
1291 		kprintf("U");
1292 	if (f & TH_ECE)
1293 		kprintf("E");
1294 	if (f & TH_CWR)
1295 		kprintf("W");
1296 }
1297 
1298 #define	PF_SET_SKIP_STEPS(i)					\
1299 	do {							\
1300 		while (head[i] != cur) {			\
1301 			head[i]->skip[i].ptr = cur;		\
1302 			head[i] = TAILQ_NEXT(head[i], entries);	\
1303 		}						\
1304 	} while (0)
1305 
1306 void
1307 pf_calc_skip_steps(struct pf_rulequeue *rules)
1308 {
1309 	struct pf_rule *cur, *prev, *head[PF_SKIP_COUNT];
1310 	int i;
1311 
1312 	cur = TAILQ_FIRST(rules);
1313 	prev = cur;
1314 	for (i = 0; i < PF_SKIP_COUNT; ++i)
1315 		head[i] = cur;
1316 	while (cur != NULL) {
1317 
1318 		if (cur->kif != prev->kif || cur->ifnot != prev->ifnot)
1319 			PF_SET_SKIP_STEPS(PF_SKIP_IFP);
1320 		if (cur->direction != prev->direction)
1321 			PF_SET_SKIP_STEPS(PF_SKIP_DIR);
1322 		if (cur->af != prev->af)
1323 			PF_SET_SKIP_STEPS(PF_SKIP_AF);
1324 		if (cur->proto != prev->proto)
1325 			PF_SET_SKIP_STEPS(PF_SKIP_PROTO);
1326 		if (cur->src.neg != prev->src.neg ||
1327 		    pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr))
1328 			PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR);
1329 		if (cur->src.port[0] != prev->src.port[0] ||
1330 		    cur->src.port[1] != prev->src.port[1] ||
1331 		    cur->src.port_op != prev->src.port_op)
1332 			PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT);
1333 		if (cur->dst.neg != prev->dst.neg ||
1334 		    pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr))
1335 			PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR);
1336 		if (cur->dst.port[0] != prev->dst.port[0] ||
1337 		    cur->dst.port[1] != prev->dst.port[1] ||
1338 		    cur->dst.port_op != prev->dst.port_op)
1339 			PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
1340 
1341 		prev = cur;
1342 		cur = TAILQ_NEXT(cur, entries);
1343 	}
1344 	for (i = 0; i < PF_SKIP_COUNT; ++i)
1345 		PF_SET_SKIP_STEPS(i);
1346 }
1347 
1348 int
1349 pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2)
1350 {
1351 	if (aw1->type != aw2->type)
1352 		return (1);
1353 	switch (aw1->type) {
1354 	case PF_ADDR_ADDRMASK:
1355 		if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, 0))
1356 			return (1);
1357 		if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, 0))
1358 			return (1);
1359 		return (0);
1360 	case PF_ADDR_DYNIFTL:
1361 		return (aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt);
1362 	case PF_ADDR_NOROUTE:
1363 	case PF_ADDR_URPFFAILED:
1364 		return (0);
1365 	case PF_ADDR_TABLE:
1366 		return (aw1->p.tbl != aw2->p.tbl);
1367 	case PF_ADDR_RTLABEL:
1368 		return (aw1->v.rtlabel != aw2->v.rtlabel);
1369 	default:
1370 		kprintf("invalid address type: %d\n", aw1->type);
1371 		return (1);
1372 	}
1373 }
1374 
1375 u_int16_t
1376 pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp)
1377 {
1378 	u_int32_t	l;
1379 
1380 	if (udp && !cksum)
1381 		return (0x0000);
1382 	l = cksum + old - new;
1383 	l = (l >> 16) + (l & 65535);
1384 	l = l & 65535;
1385 	if (udp && !l)
1386 		return (0xFFFF);
1387 	return (l);
1388 }
1389 
1390 void
1391 pf_change_ap(struct pf_addr *a, u_int16_t *p, u_int16_t *ic, u_int16_t *pc,
1392     struct pf_addr *an, u_int16_t pn, u_int8_t u, sa_family_t af)
1393 {
1394 	struct pf_addr	ao;
1395 	u_int16_t	po = *p;
1396 
1397 	PF_ACPY(&ao, a, af);
1398 	PF_ACPY(a, an, af);
1399 
1400 	*p = pn;
1401 
1402 	switch (af) {
1403 #ifdef INET
1404 	case AF_INET:
1405 		*ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
1406 		    ao.addr16[0], an->addr16[0], 0),
1407 		    ao.addr16[1], an->addr16[1], 0);
1408 		*p = pn;
1409 		*pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc,
1410 		    ao.addr16[0], an->addr16[0], u),
1411 		    ao.addr16[1], an->addr16[1], u),
1412 		    po, pn, u);
1413 		break;
1414 #endif /* INET */
1415 #ifdef INET6
1416 	case AF_INET6:
1417 		*pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1418 		    pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1419 		    pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc,
1420 		    ao.addr16[0], an->addr16[0], u),
1421 		    ao.addr16[1], an->addr16[1], u),
1422 		    ao.addr16[2], an->addr16[2], u),
1423 		    ao.addr16[3], an->addr16[3], u),
1424 		    ao.addr16[4], an->addr16[4], u),
1425 		    ao.addr16[5], an->addr16[5], u),
1426 		    ao.addr16[6], an->addr16[6], u),
1427 		    ao.addr16[7], an->addr16[7], u),
1428 		    po, pn, u);
1429 		break;
1430 #endif /* INET6 */
1431 	}
1432 }
1433 
1434 
1435 /* Changes a u_int32_t.  Uses a void * so there are no align restrictions */
1436 void
1437 pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u)
1438 {
1439 	u_int32_t	ao;
1440 
1441 	memcpy(&ao, a, sizeof(ao));
1442 	memcpy(a, &an, sizeof(u_int32_t));
1443 	*c = pf_cksum_fixup(pf_cksum_fixup(*c, ao / 65536, an / 65536, u),
1444 	    ao % 65536, an % 65536, u);
1445 }
1446 
1447 #ifdef INET6
1448 void
1449 pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u)
1450 {
1451 	struct pf_addr	ao;
1452 
1453 	PF_ACPY(&ao, a, AF_INET6);
1454 	PF_ACPY(a, an, AF_INET6);
1455 
1456 	*c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1457 	    pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1458 	    pf_cksum_fixup(pf_cksum_fixup(*c,
1459 	    ao.addr16[0], an->addr16[0], u),
1460 	    ao.addr16[1], an->addr16[1], u),
1461 	    ao.addr16[2], an->addr16[2], u),
1462 	    ao.addr16[3], an->addr16[3], u),
1463 	    ao.addr16[4], an->addr16[4], u),
1464 	    ao.addr16[5], an->addr16[5], u),
1465 	    ao.addr16[6], an->addr16[6], u),
1466 	    ao.addr16[7], an->addr16[7], u);
1467 }
1468 #endif /* INET6 */
1469 
1470 void
1471 pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa,
1472     struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c,
1473     u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af)
1474 {
1475 	struct pf_addr	oia, ooa;
1476 
1477 	PF_ACPY(&oia, ia, af);
1478 	PF_ACPY(&ooa, oa, af);
1479 
1480 	/* Change inner protocol port, fix inner protocol checksum. */
1481 	if (ip != NULL) {
1482 		u_int16_t	oip = *ip;
1483 		u_int32_t	opc = 0;
1484 
1485 		if (pc != NULL)
1486 			opc = *pc;
1487 		*ip = np;
1488 		if (pc != NULL)
1489 			*pc = pf_cksum_fixup(*pc, oip, *ip, u);
1490 		*ic = pf_cksum_fixup(*ic, oip, *ip, 0);
1491 		if (pc != NULL)
1492 			*ic = pf_cksum_fixup(*ic, opc, *pc, 0);
1493 	}
1494 	/* Change inner ip address, fix inner ip and icmp checksums. */
1495 	PF_ACPY(ia, na, af);
1496 	switch (af) {
1497 #ifdef INET
1498 	case AF_INET: {
1499 		u_int32_t	 oh2c = *h2c;
1500 
1501 		*h2c = pf_cksum_fixup(pf_cksum_fixup(*h2c,
1502 		    oia.addr16[0], ia->addr16[0], 0),
1503 		    oia.addr16[1], ia->addr16[1], 0);
1504 		*ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
1505 		    oia.addr16[0], ia->addr16[0], 0),
1506 		    oia.addr16[1], ia->addr16[1], 0);
1507 		*ic = pf_cksum_fixup(*ic, oh2c, *h2c, 0);
1508 		break;
1509 	}
1510 #endif /* INET */
1511 #ifdef INET6
1512 	case AF_INET6:
1513 		*ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1514 		    pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1515 		    pf_cksum_fixup(pf_cksum_fixup(*ic,
1516 		    oia.addr16[0], ia->addr16[0], u),
1517 		    oia.addr16[1], ia->addr16[1], u),
1518 		    oia.addr16[2], ia->addr16[2], u),
1519 		    oia.addr16[3], ia->addr16[3], u),
1520 		    oia.addr16[4], ia->addr16[4], u),
1521 		    oia.addr16[5], ia->addr16[5], u),
1522 		    oia.addr16[6], ia->addr16[6], u),
1523 		    oia.addr16[7], ia->addr16[7], u);
1524 		break;
1525 #endif /* INET6 */
1526 	}
1527 	/* Change outer ip address, fix outer ip or icmpv6 checksum. */
1528 	PF_ACPY(oa, na, af);
1529 	switch (af) {
1530 #ifdef INET
1531 	case AF_INET:
1532 		*hc = pf_cksum_fixup(pf_cksum_fixup(*hc,
1533 		    ooa.addr16[0], oa->addr16[0], 0),
1534 		    ooa.addr16[1], oa->addr16[1], 0);
1535 		break;
1536 #endif /* INET */
1537 #ifdef INET6
1538 	case AF_INET6:
1539 		*ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1540 		    pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1541 		    pf_cksum_fixup(pf_cksum_fixup(*ic,
1542 		    ooa.addr16[0], oa->addr16[0], u),
1543 		    ooa.addr16[1], oa->addr16[1], u),
1544 		    ooa.addr16[2], oa->addr16[2], u),
1545 		    ooa.addr16[3], oa->addr16[3], u),
1546 		    ooa.addr16[4], oa->addr16[4], u),
1547 		    ooa.addr16[5], oa->addr16[5], u),
1548 		    ooa.addr16[6], oa->addr16[6], u),
1549 		    ooa.addr16[7], oa->addr16[7], u);
1550 		break;
1551 #endif /* INET6 */
1552 	}
1553 }
1554 
1555 
1556 /*
1557  * Need to modulate the sequence numbers in the TCP SACK option
1558  * (credits to Krzysztof Pfaff for report and patch)
1559  */
1560 int
1561 pf_modulate_sack(struct mbuf *m, int off, struct pf_pdesc *pd,
1562     struct tcphdr *th, struct pf_state_peer *dst)
1563 {
1564 	int hlen = (th->th_off << 2) - sizeof(*th), thoptlen = hlen;
1565 	u_int8_t opts[TCP_MAXOLEN], *opt = opts;
1566 	int copyback = 0, i, olen;
1567 	struct raw_sackblock sack;
1568 
1569 #define TCPOLEN_SACKLEN	(TCPOLEN_SACK + 2)
1570 	if (hlen < TCPOLEN_SACKLEN ||
1571 	    !pf_pull_hdr(m, off + sizeof(*th), opts, hlen, NULL, NULL, pd->af))
1572 		return 0;
1573 
1574 	while (hlen >= TCPOLEN_SACKLEN) {
1575 		olen = opt[1];
1576 		switch (*opt) {
1577 		case TCPOPT_EOL:	/* FALLTHROUGH */
1578 		case TCPOPT_NOP:
1579 			opt++;
1580 			hlen--;
1581 			break;
1582 		case TCPOPT_SACK:
1583 			if (olen > hlen)
1584 				olen = hlen;
1585 			if (olen >= TCPOLEN_SACKLEN) {
1586 				for (i = 2; i + TCPOLEN_SACK <= olen;
1587 				    i += TCPOLEN_SACK) {
1588 					memcpy(&sack, &opt[i], sizeof(sack));
1589 					pf_change_a(&sack.rblk_start, &th->th_sum,
1590 					    htonl(sack.rblk_start -
1591 					    dst->seqdiff), 0);
1592 					pf_change_a(&sack.rblk_end, &th->th_sum,
1593 					    htonl(sack.rblk_end -
1594 					    dst->seqdiff), 0);
1595 					memcpy(&opt[i], &sack, sizeof(sack));
1596 				}
1597 				copyback = 1;
1598 			}
1599 			/* FALLTHROUGH */
1600 		default:
1601 			if (olen < 2)
1602 				olen = 2;
1603 			hlen -= olen;
1604 			opt += olen;
1605 		}
1606 	}
1607 
1608 	if (copyback)
1609 		m_copyback(m, off + sizeof(*th), thoptlen, opts);
1610 	return (copyback);
1611 }
1612 
1613 void
1614 pf_send_tcp(const struct pf_rule *r, sa_family_t af,
1615     const struct pf_addr *saddr, const struct pf_addr *daddr,
1616     u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack,
1617     u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl, int tag,
1618     u_int16_t rtag, struct ether_header *eh, struct ifnet *ifp)
1619 {
1620 	struct mbuf	*m;
1621 	int		 len = 0, tlen;
1622 #ifdef INET
1623 	struct ip	*h = NULL;
1624 #endif /* INET */
1625 #ifdef INET6
1626 	struct ip6_hdr	*h6 = NULL;
1627 #endif /* INET6 */
1628 	struct tcphdr	*th = NULL;
1629 	char		*opt;
1630 
1631 	/* maximum segment size tcp option */
1632 	tlen = sizeof(struct tcphdr);
1633 	if (mss)
1634 		tlen += 4;
1635 
1636 	switch (af) {
1637 #ifdef INET
1638 	case AF_INET:
1639 		len = sizeof(struct ip) + tlen;
1640 		break;
1641 #endif /* INET */
1642 #ifdef INET6
1643 	case AF_INET6:
1644 		len = sizeof(struct ip6_hdr) + tlen;
1645 		break;
1646 #endif /* INET6 */
1647 	}
1648 
1649 	/* create outgoing mbuf */
1650 	m = m_gethdr(MB_DONTWAIT, MT_HEADER);
1651 	if (m == NULL)
1652 		return;
1653 	if (tag)
1654 		m->m_pkthdr.pf.flags |= PF_TAG_GENERATED;
1655 	m->m_pkthdr.pf.tag = rtag;
1656 
1657 	if (r != NULL && r->rtableid >= 0)
1658 		m->m_pkthdr.pf.rtableid = r->rtableid;
1659 
1660 #ifdef ALTQ
1661 	if (r != NULL && r->qid) {
1662 		m->m_pkthdr.fw_flags |= PF_MBUF_STRUCTURE;
1663 		m->m_pkthdr.pf.qid = r->qid;
1664 		m->m_pkthdr.pf.ecn_af = af;
1665 		m->m_pkthdr.pf.hdr = mtod(m, struct ip *);
1666 	}
1667 #endif /* ALTQ */
1668 	m->m_data += max_linkhdr;
1669 	m->m_pkthdr.len = m->m_len = len;
1670 	m->m_pkthdr.rcvif = NULL;
1671 	bzero(m->m_data, len);
1672 	switch (af) {
1673 #ifdef INET
1674 	case AF_INET:
1675 		h = mtod(m, struct ip *);
1676 
1677 		/* IP header fields included in the TCP checksum */
1678 		h->ip_p = IPPROTO_TCP;
1679 		h->ip_len = tlen;
1680 		h->ip_src.s_addr = saddr->v4.s_addr;
1681 		h->ip_dst.s_addr = daddr->v4.s_addr;
1682 
1683 		th = (struct tcphdr *)((caddr_t)h + sizeof(struct ip));
1684 		break;
1685 #endif /* INET */
1686 #ifdef INET6
1687 	case AF_INET6:
1688 		h6 = mtod(m, struct ip6_hdr *);
1689 
1690 		/* IP header fields included in the TCP checksum */
1691 		h6->ip6_nxt = IPPROTO_TCP;
1692 		h6->ip6_plen = htons(tlen);
1693 		memcpy(&h6->ip6_src, &saddr->v6, sizeof(struct in6_addr));
1694 		memcpy(&h6->ip6_dst, &daddr->v6, sizeof(struct in6_addr));
1695 
1696 		th = (struct tcphdr *)((caddr_t)h6 + sizeof(struct ip6_hdr));
1697 		break;
1698 #endif /* INET6 */
1699 	}
1700 
1701 	/* TCP header */
1702 	th->th_sport = sport;
1703 	th->th_dport = dport;
1704 	th->th_seq = htonl(seq);
1705 	th->th_ack = htonl(ack);
1706 	th->th_off = tlen >> 2;
1707 	th->th_flags = flags;
1708 	th->th_win = htons(win);
1709 
1710 	if (mss) {
1711 		opt = (char *)(th + 1);
1712 		opt[0] = TCPOPT_MAXSEG;
1713 		opt[1] = 4;
1714 		mss = htons(mss);
1715 		bcopy((caddr_t)&mss, (caddr_t)(opt + 2), 2);
1716 	}
1717 
1718 	switch (af) {
1719 #ifdef INET
1720 	case AF_INET:
1721 		/* TCP checksum */
1722 		th->th_sum = in_cksum(m, len);
1723 
1724 		/* Finish the IP header */
1725 		h->ip_v = 4;
1726 		h->ip_hl = sizeof(*h) >> 2;
1727 		h->ip_tos = IPTOS_LOWDELAY;
1728 		h->ip_len = len;
1729 		h->ip_off = path_mtu_discovery ? IP_DF : 0;
1730 		h->ip_ttl = ttl ? ttl : ip_defttl;
1731 		h->ip_sum = 0;
1732 		if (eh == NULL) {
1733 			ip_output(m, NULL, NULL, 0, NULL, NULL);
1734 		} else {
1735 			struct route		 ro;
1736 			struct rtentry		 rt;
1737 			struct ether_header	*e = (void *)ro.ro_dst.sa_data;
1738 
1739 			if (ifp == NULL) {
1740 				m_freem(m);
1741 				return;
1742 			}
1743 			rt.rt_ifp = ifp;
1744 			ro.ro_rt = &rt;
1745 			ro.ro_dst.sa_len = sizeof(ro.ro_dst);
1746 			ro.ro_dst.sa_family = pseudo_AF_HDRCMPLT;
1747 			bcopy(eh->ether_dhost, e->ether_shost, ETHER_ADDR_LEN);
1748 			bcopy(eh->ether_shost, e->ether_dhost, ETHER_ADDR_LEN);
1749 			e->ether_type = eh->ether_type;
1750 			/* XXX_IMPORT: later */
1751 			ip_output(m, (void *)NULL, &ro, 0,
1752 			    (void *)NULL, (void *)NULL);
1753 		}
1754 		break;
1755 #endif /* INET */
1756 #ifdef INET6
1757 	case AF_INET6:
1758 		/* TCP checksum */
1759 		th->th_sum = in6_cksum(m, IPPROTO_TCP,
1760 		    sizeof(struct ip6_hdr), tlen);
1761 
1762 		h6->ip6_vfc |= IPV6_VERSION;
1763 		h6->ip6_hlim = IPV6_DEFHLIM;
1764 
1765 		ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
1766 		break;
1767 #endif /* INET6 */
1768 	}
1769 }
1770 
1771 void
1772 pf_send_icmp(struct mbuf *m, u_int8_t type, u_int8_t code, sa_family_t af,
1773     struct pf_rule *r)
1774 {
1775 	struct mbuf	*m0;
1776 
1777 	m0 = m_copy(m, 0, M_COPYALL);
1778 	m0->m_pkthdr.pf.flags |= PF_TAG_GENERATED;
1779 
1780 	if (r->rtableid >= 0)
1781 		m0->m_pkthdr.pf.rtableid = r->rtableid;
1782 
1783 #ifdef ALTQ
1784 	if (r->qid) {
1785 		m->m_pkthdr.fw_flags |= PF_MBUF_STRUCTURE;
1786 		m0->m_pkthdr.pf.qid = r->qid;
1787 		m0->m_pkthdr.pf.ecn_af = af;
1788 		m0->m_pkthdr.pf.hdr = mtod(m0, struct ip *);
1789 	}
1790 #endif /* ALTQ */
1791 
1792 	switch (af) {
1793 #ifdef INET
1794 	case AF_INET:
1795 		icmp_error(m0, type, code, 0, 0);
1796 		break;
1797 #endif /* INET */
1798 #ifdef INET6
1799 	case AF_INET6:
1800 		icmp6_error(m0, type, code, 0);
1801 		break;
1802 #endif /* INET6 */
1803 	}
1804 }
1805 
1806 /*
1807  * Return 1 if the addresses a and b match (with mask m), otherwise return 0.
1808  * If n is 0, they match if they are equal. If n is != 0, they match if they
1809  * are different.
1810  */
1811 int
1812 pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m,
1813     struct pf_addr *b, sa_family_t af)
1814 {
1815 	int	match = 0;
1816 
1817 	switch (af) {
1818 #ifdef INET
1819 	case AF_INET:
1820 		if ((a->addr32[0] & m->addr32[0]) ==
1821 		    (b->addr32[0] & m->addr32[0]))
1822 			match++;
1823 		break;
1824 #endif /* INET */
1825 #ifdef INET6
1826 	case AF_INET6:
1827 		if (((a->addr32[0] & m->addr32[0]) ==
1828 		     (b->addr32[0] & m->addr32[0])) &&
1829 		    ((a->addr32[1] & m->addr32[1]) ==
1830 		     (b->addr32[1] & m->addr32[1])) &&
1831 		    ((a->addr32[2] & m->addr32[2]) ==
1832 		     (b->addr32[2] & m->addr32[2])) &&
1833 		    ((a->addr32[3] & m->addr32[3]) ==
1834 		     (b->addr32[3] & m->addr32[3])))
1835 			match++;
1836 		break;
1837 #endif /* INET6 */
1838 	}
1839 	if (match) {
1840 		if (n)
1841 			return (0);
1842 		else
1843 			return (1);
1844 	} else {
1845 		if (n)
1846 			return (1);
1847 		else
1848 			return (0);
1849 	}
1850 }
1851 
1852 int
1853 pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p)
1854 {
1855 	switch (op) {
1856 	case PF_OP_IRG:
1857 		return ((p > a1) && (p < a2));
1858 	case PF_OP_XRG:
1859 		return ((p < a1) || (p > a2));
1860 	case PF_OP_RRG:
1861 		return ((p >= a1) && (p <= a2));
1862 	case PF_OP_EQ:
1863 		return (p == a1);
1864 	case PF_OP_NE:
1865 		return (p != a1);
1866 	case PF_OP_LT:
1867 		return (p < a1);
1868 	case PF_OP_LE:
1869 		return (p <= a1);
1870 	case PF_OP_GT:
1871 		return (p > a1);
1872 	case PF_OP_GE:
1873 		return (p >= a1);
1874 	}
1875 	return (0); /* never reached */
1876 }
1877 
1878 int
1879 pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p)
1880 {
1881 	a1 = ntohs(a1);
1882 	a2 = ntohs(a2);
1883 	p = ntohs(p);
1884 	return (pf_match(op, a1, a2, p));
1885 }
1886 
1887 int
1888 pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u)
1889 {
1890 	if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE)
1891 		return (0);
1892 	return (pf_match(op, a1, a2, u));
1893 }
1894 
1895 int
1896 pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g)
1897 {
1898 	if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE)
1899 		return (0);
1900 	return (pf_match(op, a1, a2, g));
1901 }
1902 
1903 int
1904 pf_match_tag(struct mbuf *m, struct pf_rule *r, int *tag)
1905 {
1906 	if (*tag == -1)
1907 		*tag = m->m_pkthdr.pf.tag;
1908 
1909 	return ((!r->match_tag_not && r->match_tag == *tag) ||
1910 	    (r->match_tag_not && r->match_tag != *tag));
1911 }
1912 
1913 int
1914 pf_tag_packet(struct mbuf *m, int tag, int rtableid)
1915 {
1916 	if (tag <= 0 && rtableid < 0)
1917 		return (0);
1918 
1919 	if (tag > 0)
1920 		m->m_pkthdr.pf.tag = tag;
1921 	if (rtableid >= 0)
1922 		m->m_pkthdr.pf.rtableid = rtableid;
1923 
1924 	return (0);
1925 }
1926 
1927 void
1928 pf_step_into_anchor(int *depth, struct pf_ruleset **rs, int n,
1929     struct pf_rule **r, struct pf_rule **a,  int *match)
1930 {
1931 	struct pf_anchor_stackframe	*f;
1932 
1933 	(*r)->anchor->match = 0;
1934 	if (match)
1935 		*match = 0;
1936 	if (*depth >= sizeof(pf_anchor_stack) /
1937 	    sizeof(pf_anchor_stack[0])) {
1938 		kprintf("pf_step_into_anchor: stack overflow\n");
1939 		*r = TAILQ_NEXT(*r, entries);
1940 		return;
1941 	} else if (*depth == 0 && a != NULL)
1942 		*a = *r;
1943 	f = pf_anchor_stack + (*depth)++;
1944 	f->rs = *rs;
1945 	f->r = *r;
1946 	if ((*r)->anchor_wildcard) {
1947 		f->parent = &(*r)->anchor->children;
1948 		if ((f->child = RB_MIN(pf_anchor_node, f->parent)) ==
1949 		    NULL) {
1950 			*r = NULL;
1951 			return;
1952 		}
1953 		*rs = &f->child->ruleset;
1954 	} else {
1955 		f->parent = NULL;
1956 		f->child = NULL;
1957 		*rs = &(*r)->anchor->ruleset;
1958 	}
1959 	*r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
1960 }
1961 
1962 int
1963 pf_step_out_of_anchor(int *depth, struct pf_ruleset **rs, int n,
1964     struct pf_rule **r, struct pf_rule **a, int *match)
1965 {
1966 	struct pf_anchor_stackframe	*f;
1967 	int quick = 0;
1968 
1969 	do {
1970 		if (*depth <= 0)
1971 			break;
1972 		f = pf_anchor_stack + *depth - 1;
1973 		if (f->parent != NULL && f->child != NULL) {
1974 			if (f->child->match ||
1975 			    (match != NULL && *match)) {
1976 				f->r->anchor->match = 1;
1977 				*match = 0;
1978 			}
1979 			f->child = RB_NEXT(pf_anchor_node, f->parent, f->child);
1980 			if (f->child != NULL) {
1981 				*rs = &f->child->ruleset;
1982 				*r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
1983 				if (*r == NULL)
1984 					continue;
1985 				else
1986 					break;
1987 			}
1988 		}
1989 		(*depth)--;
1990 		if (*depth == 0 && a != NULL)
1991 			*a = NULL;
1992 		*rs = f->rs;
1993 		if (f->r->anchor->match || (match  != NULL && *match))
1994 			quick = f->r->quick;
1995 		*r = TAILQ_NEXT(f->r, entries);
1996 	} while (*r == NULL);
1997 
1998 	return (quick);
1999 }
2000 
2001 #ifdef INET6
2002 void
2003 pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr,
2004     struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af)
2005 {
2006 	switch (af) {
2007 #ifdef INET
2008 	case AF_INET:
2009 		naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
2010 		((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]);
2011 		break;
2012 #endif /* INET */
2013 	case AF_INET6:
2014 		naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
2015 		((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]);
2016 		naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) |
2017 		((rmask->addr32[1] ^ 0xffffffff ) & saddr->addr32[1]);
2018 		naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) |
2019 		((rmask->addr32[2] ^ 0xffffffff ) & saddr->addr32[2]);
2020 		naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) |
2021 		((rmask->addr32[3] ^ 0xffffffff ) & saddr->addr32[3]);
2022 		break;
2023 	}
2024 }
2025 
2026 void
2027 pf_addr_inc(struct pf_addr *addr, sa_family_t af)
2028 {
2029 	switch (af) {
2030 #ifdef INET
2031 	case AF_INET:
2032 		addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1);
2033 		break;
2034 #endif /* INET */
2035 	case AF_INET6:
2036 		if (addr->addr32[3] == 0xffffffff) {
2037 			addr->addr32[3] = 0;
2038 			if (addr->addr32[2] == 0xffffffff) {
2039 				addr->addr32[2] = 0;
2040 				if (addr->addr32[1] == 0xffffffff) {
2041 					addr->addr32[1] = 0;
2042 					addr->addr32[0] =
2043 					    htonl(ntohl(addr->addr32[0]) + 1);
2044 				} else
2045 					addr->addr32[1] =
2046 					    htonl(ntohl(addr->addr32[1]) + 1);
2047 			} else
2048 				addr->addr32[2] =
2049 				    htonl(ntohl(addr->addr32[2]) + 1);
2050 		} else
2051 			addr->addr32[3] =
2052 			    htonl(ntohl(addr->addr32[3]) + 1);
2053 		break;
2054 	}
2055 }
2056 #endif /* INET6 */
2057 
2058 #define mix(a,b,c) \
2059 	do {					\
2060 		a -= b; a -= c; a ^= (c >> 13);	\
2061 		b -= c; b -= a; b ^= (a << 8);	\
2062 		c -= a; c -= b; c ^= (b >> 13);	\
2063 		a -= b; a -= c; a ^= (c >> 12);	\
2064 		b -= c; b -= a; b ^= (a << 16);	\
2065 		c -= a; c -= b; c ^= (b >> 5);	\
2066 		a -= b; a -= c; a ^= (c >> 3);	\
2067 		b -= c; b -= a; b ^= (a << 10);	\
2068 		c -= a; c -= b; c ^= (b >> 15);	\
2069 	} while (0)
2070 
2071 /*
2072  * hash function based on bridge_hash in if_bridge.c
2073  */
2074 void
2075 pf_hash(struct pf_addr *inaddr, struct pf_addr *hash,
2076     struct pf_poolhashkey *key, sa_family_t af)
2077 {
2078 	u_int32_t	a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0];
2079 
2080 	switch (af) {
2081 #ifdef INET
2082 	case AF_INET:
2083 		a += inaddr->addr32[0];
2084 		b += key->key32[1];
2085 		mix(a, b, c);
2086 		hash->addr32[0] = c + key->key32[2];
2087 		break;
2088 #endif /* INET */
2089 #ifdef INET6
2090 	case AF_INET6:
2091 		a += inaddr->addr32[0];
2092 		b += inaddr->addr32[2];
2093 		mix(a, b, c);
2094 		hash->addr32[0] = c;
2095 		a += inaddr->addr32[1];
2096 		b += inaddr->addr32[3];
2097 		c += key->key32[1];
2098 		mix(a, b, c);
2099 		hash->addr32[1] = c;
2100 		a += inaddr->addr32[2];
2101 		b += inaddr->addr32[1];
2102 		c += key->key32[2];
2103 		mix(a, b, c);
2104 		hash->addr32[2] = c;
2105 		a += inaddr->addr32[3];
2106 		b += inaddr->addr32[0];
2107 		c += key->key32[3];
2108 		mix(a, b, c);
2109 		hash->addr32[3] = c;
2110 		break;
2111 #endif /* INET6 */
2112 	}
2113 }
2114 
2115 int
2116 pf_map_addr(sa_family_t af, struct pf_rule *r, struct pf_addr *saddr,
2117     struct pf_addr *naddr, struct pf_addr *init_addr, struct pf_src_node **sn)
2118 {
2119 	unsigned char		 hash[16];
2120 	struct pf_pool		*rpool = &r->rpool;
2121 	struct pf_addr		*raddr = &rpool->cur->addr.v.a.addr;
2122 	struct pf_addr		*rmask = &rpool->cur->addr.v.a.mask;
2123 	struct pf_pooladdr	*acur = rpool->cur;
2124 	struct pf_src_node	 k;
2125 
2126 	if (*sn == NULL && r->rpool.opts & PF_POOL_STICKYADDR &&
2127 	    (r->rpool.opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
2128 		k.af = af;
2129 		PF_ACPY(&k.addr, saddr, af);
2130 		if (r->rule_flag & PFRULE_RULESRCTRACK ||
2131 		    r->rpool.opts & PF_POOL_STICKYADDR)
2132 			k.rule.ptr = r;
2133 		else
2134 			k.rule.ptr = NULL;
2135 		pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
2136 		*sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k);
2137 		if (*sn != NULL && !PF_AZERO(&(*sn)->raddr, af)) {
2138 			PF_ACPY(naddr, &(*sn)->raddr, af);
2139 			if (pf_status.debug >= PF_DEBUG_MISC) {
2140 				kprintf("pf_map_addr: src tracking maps ");
2141 				pf_print_host(&k.addr, 0, af);
2142 				kprintf(" to ");
2143 				pf_print_host(naddr, 0, af);
2144 				kprintf("\n");
2145 			}
2146 			return (0);
2147 		}
2148 	}
2149 
2150 	if (rpool->cur->addr.type == PF_ADDR_NOROUTE)
2151 		return (1);
2152 	if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
2153 		switch (af) {
2154 #ifdef INET
2155 		case AF_INET:
2156 			if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 &&
2157 			    (rpool->opts & PF_POOL_TYPEMASK) !=
2158 			    PF_POOL_ROUNDROBIN)
2159 				return (1);
2160 			 raddr = &rpool->cur->addr.p.dyn->pfid_addr4;
2161 			 rmask = &rpool->cur->addr.p.dyn->pfid_mask4;
2162 			break;
2163 #endif /* INET */
2164 #ifdef INET6
2165 		case AF_INET6:
2166 			if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 &&
2167 			    (rpool->opts & PF_POOL_TYPEMASK) !=
2168 			    PF_POOL_ROUNDROBIN)
2169 				return (1);
2170 			raddr = &rpool->cur->addr.p.dyn->pfid_addr6;
2171 			rmask = &rpool->cur->addr.p.dyn->pfid_mask6;
2172 			break;
2173 #endif /* INET6 */
2174 		}
2175 	} else if (rpool->cur->addr.type == PF_ADDR_TABLE) {
2176 		if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN)
2177 			return (1); /* unsupported */
2178 	} else {
2179 		raddr = &rpool->cur->addr.v.a.addr;
2180 		rmask = &rpool->cur->addr.v.a.mask;
2181 	}
2182 
2183 	switch (rpool->opts & PF_POOL_TYPEMASK) {
2184 	case PF_POOL_NONE:
2185 		PF_ACPY(naddr, raddr, af);
2186 		break;
2187 	case PF_POOL_BITMASK:
2188 		PF_POOLMASK(naddr, raddr, rmask, saddr, af);
2189 		break;
2190 	case PF_POOL_RANDOM:
2191 		if (init_addr != NULL && PF_AZERO(init_addr, af)) {
2192 			switch (af) {
2193 #ifdef INET
2194 			case AF_INET:
2195 				rpool->counter.addr32[0] = karc4random();
2196 				break;
2197 #endif /* INET */
2198 #ifdef INET6
2199 			case AF_INET6:
2200 				if (rmask->addr32[3] != 0xffffffff)
2201 					rpool->counter.addr32[3] =
2202 					    karc4random();
2203 				else
2204 					break;
2205 				if (rmask->addr32[2] != 0xffffffff)
2206 					rpool->counter.addr32[2] =
2207 					    karc4random();
2208 				else
2209 					break;
2210 				if (rmask->addr32[1] != 0xffffffff)
2211 					rpool->counter.addr32[1] =
2212 					    karc4random();
2213 				else
2214 					break;
2215 				if (rmask->addr32[0] != 0xffffffff)
2216 					rpool->counter.addr32[0] =
2217 					    karc4random();
2218 				break;
2219 #endif /* INET6 */
2220 			}
2221 			PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af);
2222 			PF_ACPY(init_addr, naddr, af);
2223 
2224 		} else {
2225 			PF_AINC(&rpool->counter, af);
2226 			PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af);
2227 		}
2228 		break;
2229 	case PF_POOL_SRCHASH:
2230 		pf_hash(saddr, (struct pf_addr *)&hash, &rpool->key, af);
2231 		PF_POOLMASK(naddr, raddr, rmask, (struct pf_addr *)&hash, af);
2232 		break;
2233 	case PF_POOL_ROUNDROBIN:
2234 		if (rpool->cur->addr.type == PF_ADDR_TABLE) {
2235 			if (!pfr_pool_get(rpool->cur->addr.p.tbl,
2236 			    &rpool->tblidx, &rpool->counter,
2237 			    &raddr, &rmask, af))
2238 				goto get_addr;
2239 		} else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
2240 			if (!pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
2241 			    &rpool->tblidx, &rpool->counter,
2242 			    &raddr, &rmask, af))
2243 				goto get_addr;
2244 		} else if (pf_match_addr(0, raddr, rmask, &rpool->counter, af))
2245 			goto get_addr;
2246 
2247 	try_next:
2248 		if ((rpool->cur = TAILQ_NEXT(rpool->cur, entries)) == NULL)
2249 			rpool->cur = TAILQ_FIRST(&rpool->list);
2250 		if (rpool->cur->addr.type == PF_ADDR_TABLE) {
2251 			rpool->tblidx = -1;
2252 			if (pfr_pool_get(rpool->cur->addr.p.tbl,
2253 			    &rpool->tblidx, &rpool->counter,
2254 			    &raddr, &rmask, af)) {
2255 				/* table contains no address of type 'af' */
2256 				if (rpool->cur != acur)
2257 					goto try_next;
2258 				return (1);
2259 			}
2260 		} else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
2261 			rpool->tblidx = -1;
2262 			if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
2263 			    &rpool->tblidx, &rpool->counter,
2264 			    &raddr, &rmask, af)) {
2265 				/* table contains no address of type 'af' */
2266 				if (rpool->cur != acur)
2267 					goto try_next;
2268 				return (1);
2269 			}
2270 		} else {
2271 			raddr = &rpool->cur->addr.v.a.addr;
2272 			rmask = &rpool->cur->addr.v.a.mask;
2273 			PF_ACPY(&rpool->counter, raddr, af);
2274 		}
2275 
2276 	get_addr:
2277 		PF_ACPY(naddr, &rpool->counter, af);
2278 		if (init_addr != NULL && PF_AZERO(init_addr, af))
2279 			PF_ACPY(init_addr, naddr, af);
2280 		PF_AINC(&rpool->counter, af);
2281 		break;
2282 	}
2283 	if (*sn != NULL)
2284 		PF_ACPY(&(*sn)->raddr, naddr, af);
2285 
2286 	if (pf_status.debug >= PF_DEBUG_MISC &&
2287 	    (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
2288 		kprintf("pf_map_addr: selected address ");
2289 		pf_print_host(naddr, 0, af);
2290 		kprintf("\n");
2291 	}
2292 
2293 	return (0);
2294 }
2295 
2296 int
2297 pf_get_sport(sa_family_t af, u_int8_t proto, struct pf_rule *r,
2298     struct pf_addr *saddr, struct pf_addr *daddr, u_int16_t dport,
2299     struct pf_addr *naddr, u_int16_t *nport, u_int16_t low, u_int16_t high,
2300     struct pf_src_node **sn)
2301 {
2302 	struct pf_state_key_cmp	key;
2303 	struct pf_addr		init_addr;
2304 	u_int16_t		cut;
2305 
2306 	bzero(&init_addr, sizeof(init_addr));
2307 	if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn))
2308 		return (1);
2309 
2310 	if (proto == IPPROTO_ICMP) {
2311 		low = 1;
2312 		high = 65535;
2313 	}
2314 
2315 	do {
2316 		key.af = af;
2317 		key.proto = proto;
2318 		PF_ACPY(&key.ext.addr, daddr, key.af);
2319 		PF_ACPY(&key.gwy.addr, naddr, key.af);
2320 		key.ext.port = dport;
2321 
2322 		/*
2323 		 * port search; start random, step;
2324 		 * similar 2 portloop in in_pcbbind
2325 		 */
2326 		if (!(proto == IPPROTO_TCP || proto == IPPROTO_UDP ||
2327 		    proto == IPPROTO_ICMP)) {
2328 			key.gwy.port = dport;
2329 			if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL)
2330 				return (0);
2331 		} else if (low == 0 && high == 0) {
2332 			key.gwy.port = *nport;
2333 			if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL)
2334 				return (0);
2335 		} else if (low == high) {
2336 			key.gwy.port = htons(low);
2337 			if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL) {
2338 				*nport = htons(low);
2339 				return (0);
2340 			}
2341 		} else {
2342 			u_int16_t tmp;
2343 
2344 			if (low > high) {
2345 				tmp = low;
2346 				low = high;
2347 				high = tmp;
2348 			}
2349 			/* low < high */
2350 			cut = karc4random() % (1 + high - low) + low;
2351 			/* low <= cut <= high */
2352 			for (tmp = cut; tmp <= high; ++(tmp)) {
2353 				key.gwy.port = htons(tmp);
2354 				if (pf_find_state_all(&key, PF_EXT_GWY, NULL) ==
2355 				    NULL) {
2356 					*nport = htons(tmp);
2357 					return (0);
2358 				}
2359 			}
2360 			for (tmp = cut - 1; tmp >= low; --(tmp)) {
2361 				key.gwy.port = htons(tmp);
2362 				if (pf_find_state_all(&key, PF_EXT_GWY, NULL) ==
2363 				    NULL) {
2364 					*nport = htons(tmp);
2365 					return (0);
2366 				}
2367 			}
2368 		}
2369 
2370 		switch (r->rpool.opts & PF_POOL_TYPEMASK) {
2371 		case PF_POOL_RANDOM:
2372 		case PF_POOL_ROUNDROBIN:
2373 			if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn))
2374 				return (1);
2375 			break;
2376 		case PF_POOL_NONE:
2377 		case PF_POOL_SRCHASH:
2378 		case PF_POOL_BITMASK:
2379 		default:
2380 			return (1);
2381 		}
2382 	} while (! PF_AEQ(&init_addr, naddr, af) );
2383 
2384 	return (1);					/* none available */
2385 }
2386 
2387 struct pf_rule *
2388 pf_match_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
2389     int direction, struct pfi_kif *kif, struct pf_addr *saddr, u_int16_t sport,
2390     struct pf_addr *daddr, u_int16_t dport, int rs_num)
2391 {
2392 	struct pf_rule		*r, *rm = NULL;
2393 	struct pf_ruleset	*ruleset = NULL;
2394 	int			 tag = -1;
2395 	int			 rtableid = -1;
2396 	int			 asd = 0;
2397 
2398 	r = TAILQ_FIRST(pf_main_ruleset.rules[rs_num].active.ptr);
2399 	while (r && rm == NULL) {
2400 		struct pf_rule_addr	*src = NULL, *dst = NULL;
2401 		struct pf_addr_wrap	*xdst = NULL;
2402 
2403 		if (r->action == PF_BINAT && direction == PF_IN) {
2404 			src = &r->dst;
2405 			if (r->rpool.cur != NULL)
2406 				xdst = &r->rpool.cur->addr;
2407 		} else {
2408 			src = &r->src;
2409 			dst = &r->dst;
2410 		}
2411 
2412 		r->evaluations++;
2413 		if (pfi_kif_match(r->kif, kif) == r->ifnot)
2414 			r = r->skip[PF_SKIP_IFP].ptr;
2415 		else if (r->direction && r->direction != direction)
2416 			r = r->skip[PF_SKIP_DIR].ptr;
2417 		else if (r->af && r->af != pd->af)
2418 			r = r->skip[PF_SKIP_AF].ptr;
2419 		else if (r->proto && r->proto != pd->proto)
2420 			r = r->skip[PF_SKIP_PROTO].ptr;
2421 		else if (PF_MISMATCHAW(&src->addr, saddr, pd->af,
2422 		    src->neg, kif))
2423 			r = r->skip[src == &r->src ? PF_SKIP_SRC_ADDR :
2424 			    PF_SKIP_DST_ADDR].ptr;
2425 		else if (src->port_op && !pf_match_port(src->port_op,
2426 		    src->port[0], src->port[1], sport))
2427 			r = r->skip[src == &r->src ? PF_SKIP_SRC_PORT :
2428 			    PF_SKIP_DST_PORT].ptr;
2429 		else if (dst != NULL &&
2430 		    PF_MISMATCHAW(&dst->addr, daddr, pd->af, dst->neg, NULL))
2431 			r = r->skip[PF_SKIP_DST_ADDR].ptr;
2432 		else if (xdst != NULL && PF_MISMATCHAW(xdst, daddr, pd->af,
2433 		    0, NULL))
2434 			r = TAILQ_NEXT(r, entries);
2435 		else if (dst != NULL && dst->port_op &&
2436 		    !pf_match_port(dst->port_op, dst->port[0],
2437 		    dst->port[1], dport))
2438 			r = r->skip[PF_SKIP_DST_PORT].ptr;
2439 		else if (r->match_tag && !pf_match_tag(m, r, &tag))
2440 			r = TAILQ_NEXT(r, entries);
2441 		else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto !=
2442 		    IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, m,
2443 		    off, pd->hdr.tcp), r->os_fingerprint)))
2444 			r = TAILQ_NEXT(r, entries);
2445 		else {
2446 			if (r->tag)
2447 				tag = r->tag;
2448 			if (r->rtableid >= 0)
2449 				rtableid = r->rtableid;
2450 			if (r->anchor == NULL) {
2451 				rm = r;
2452 			} else
2453 				pf_step_into_anchor(&asd, &ruleset, rs_num,
2454 				    &r, NULL, NULL);
2455 		}
2456 		if (r == NULL)
2457 			pf_step_out_of_anchor(&asd, &ruleset, rs_num, &r,
2458 			    NULL, NULL);
2459 	}
2460 	if (pf_tag_packet(m, tag, rtableid))
2461 		return (NULL);
2462 	if (rm != NULL && (rm->action == PF_NONAT ||
2463 	    rm->action == PF_NORDR || rm->action == PF_NOBINAT))
2464 		return (NULL);
2465 	return (rm);
2466 }
2467 
2468 struct pf_rule *
2469 pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off, int direction,
2470     struct pfi_kif *kif, struct pf_src_node **sn,
2471     struct pf_addr *saddr, u_int16_t sport,
2472     struct pf_addr *daddr, u_int16_t dport,
2473     struct pf_addr *naddr, u_int16_t *nport)
2474 {
2475 	struct pf_rule	*r = NULL;
2476 
2477 	if (direction == PF_OUT) {
2478 		r = pf_match_translation(pd, m, off, direction, kif, saddr,
2479 		    sport, daddr, dport, PF_RULESET_BINAT);
2480 		if (r == NULL)
2481 			r = pf_match_translation(pd, m, off, direction, kif,
2482 			    saddr, sport, daddr, dport, PF_RULESET_NAT);
2483 	} else {
2484 		r = pf_match_translation(pd, m, off, direction, kif, saddr,
2485 		    sport, daddr, dport, PF_RULESET_RDR);
2486 		if (r == NULL)
2487 			r = pf_match_translation(pd, m, off, direction, kif,
2488 			    saddr, sport, daddr, dport, PF_RULESET_BINAT);
2489 	}
2490 
2491 	if (r != NULL) {
2492 		switch (r->action) {
2493 		case PF_NONAT:
2494 		case PF_NOBINAT:
2495 		case PF_NORDR:
2496 			return (NULL);
2497 		case PF_NAT:
2498 			if (pf_get_sport(pd->af, pd->proto, r, saddr,
2499 			    daddr, dport, naddr, nport, r->rpool.proxy_port[0],
2500 			    r->rpool.proxy_port[1], sn)) {
2501 				DPFPRINTF(PF_DEBUG_MISC,
2502 				    ("pf: NAT proxy port allocation "
2503 				    "(%u-%u) failed\n",
2504 				    r->rpool.proxy_port[0],
2505 				    r->rpool.proxy_port[1]));
2506 				return (NULL);
2507 			}
2508 			break;
2509 		case PF_BINAT:
2510 			switch (direction) {
2511 			case PF_OUT:
2512 				if (r->rpool.cur->addr.type == PF_ADDR_DYNIFTL){
2513 					switch (pd->af) {
2514 #ifdef INET
2515 					case AF_INET:
2516 						if (r->rpool.cur->addr.p.dyn->
2517 						    pfid_acnt4 < 1)
2518 							return (NULL);
2519 						PF_POOLMASK(naddr,
2520 						    &r->rpool.cur->addr.p.dyn->
2521 						    pfid_addr4,
2522 						    &r->rpool.cur->addr.p.dyn->
2523 						    pfid_mask4,
2524 						    saddr, AF_INET);
2525 						break;
2526 #endif /* INET */
2527 #ifdef INET6
2528 					case AF_INET6:
2529 						if (r->rpool.cur->addr.p.dyn->
2530 						    pfid_acnt6 < 1)
2531 							return (NULL);
2532 						PF_POOLMASK(naddr,
2533 						    &r->rpool.cur->addr.p.dyn->
2534 						    pfid_addr6,
2535 						    &r->rpool.cur->addr.p.dyn->
2536 						    pfid_mask6,
2537 						    saddr, AF_INET6);
2538 						break;
2539 #endif /* INET6 */
2540 					}
2541 				} else
2542 					PF_POOLMASK(naddr,
2543 					    &r->rpool.cur->addr.v.a.addr,
2544 					    &r->rpool.cur->addr.v.a.mask,
2545 					    saddr, pd->af);
2546 				break;
2547 			case PF_IN:
2548 				if (r->src.addr.type == PF_ADDR_DYNIFTL) {
2549 					switch (pd->af) {
2550 #ifdef INET
2551 					case AF_INET:
2552 						if (r->src.addr.p.dyn->
2553 						    pfid_acnt4 < 1)
2554 							return (NULL);
2555 						PF_POOLMASK(naddr,
2556 						    &r->src.addr.p.dyn->
2557 						    pfid_addr4,
2558 						    &r->src.addr.p.dyn->
2559 						    pfid_mask4,
2560 						    daddr, AF_INET);
2561 						break;
2562 #endif /* INET */
2563 #ifdef INET6
2564 					case AF_INET6:
2565 						if (r->src.addr.p.dyn->
2566 						    pfid_acnt6 < 1)
2567 							return (NULL);
2568 						PF_POOLMASK(naddr,
2569 						    &r->src.addr.p.dyn->
2570 						    pfid_addr6,
2571 						    &r->src.addr.p.dyn->
2572 						    pfid_mask6,
2573 						    daddr, AF_INET6);
2574 						break;
2575 #endif /* INET6 */
2576 					}
2577 				} else
2578 					PF_POOLMASK(naddr,
2579 					    &r->src.addr.v.a.addr,
2580 					    &r->src.addr.v.a.mask, daddr,
2581 					    pd->af);
2582 				break;
2583 			}
2584 			break;
2585 		case PF_RDR: {
2586 			if (pf_map_addr(pd->af, r, saddr, naddr, NULL, sn))
2587 				return (NULL);
2588 			if ((r->rpool.opts & PF_POOL_TYPEMASK) ==
2589 			    PF_POOL_BITMASK)
2590 				PF_POOLMASK(naddr, naddr,
2591 				    &r->rpool.cur->addr.v.a.mask, daddr,
2592 				    pd->af);
2593 
2594 			if (r->rpool.proxy_port[1]) {
2595 				u_int32_t	tmp_nport;
2596 
2597 				tmp_nport = ((ntohs(dport) -
2598 				    ntohs(r->dst.port[0])) %
2599 				    (r->rpool.proxy_port[1] -
2600 				    r->rpool.proxy_port[0] + 1)) +
2601 				    r->rpool.proxy_port[0];
2602 
2603 				/* wrap around if necessary */
2604 				if (tmp_nport > 65535)
2605 					tmp_nport -= 65535;
2606 				*nport = htons((u_int16_t)tmp_nport);
2607 			} else if (r->rpool.proxy_port[0])
2608 				*nport = htons(r->rpool.proxy_port[0]);
2609 			break;
2610 		}
2611 		default:
2612 			return (NULL);
2613 		}
2614 	}
2615 
2616 	return (r);
2617 }
2618 
2619 #ifdef SMP
2620 struct netmsg_hashlookup {
2621 	struct netmsg		nm_netmsg;
2622 	struct inpcb		**nm_pinp;
2623 	struct inpcbinfo    	*nm_pcbinfo;
2624 	struct pf_addr		*nm_saddr;
2625 	struct pf_addr		*nm_daddr;
2626 	uint16_t		nm_sport;
2627 	uint16_t		nm_dport;
2628 	sa_family_t		nm_af;
2629 };
2630 
2631 static void
2632 in_pcblookup_hash_handler(struct netmsg *msg0)
2633 {
2634 	struct netmsg_hashlookup *msg = (struct netmsg_hashlookup *)msg0;
2635 
2636 	if (msg->nm_af == AF_INET)
2637 		*msg->nm_pinp = in_pcblookup_hash(msg->nm_pcbinfo,
2638 		    msg->nm_saddr->v4, msg->nm_sport, msg->nm_daddr->v4,
2639 		    msg->nm_dport, INPLOOKUP_WILDCARD, NULL);
2640 #ifdef INET6
2641 	else
2642 		*msg->nm_pinp = in6_pcblookup_hash(msg->nm_pcbinfo,
2643 		    &msg->nm_saddr->v6, msg->nm_sport, &msg->nm_daddr->v6,
2644 		    msg->nm_dport, INPLOOKUP_WILDCARD, NULL);
2645 #endif /* INET6 */
2646 	lwkt_replymsg(&msg->nm_netmsg.nm_lmsg, 0);
2647 }
2648 #endif /* SMP */
2649 
2650 int
2651 pf_socket_lookup(int direction, struct pf_pdesc *pd)
2652 {
2653 	struct pf_addr		*saddr, *daddr;
2654 	u_int16_t		 sport, dport;
2655 	struct inpcbinfo	*pi;
2656 	struct inpcb		*inp;
2657 #ifdef SMP
2658 	struct netmsg_hashlookup *msg = NULL;
2659 #endif
2660 	int			 pi_cpu = 0;
2661 
2662 	if (pd == NULL)
2663 		return (-1);
2664 	pd->lookup.uid = UID_MAX;
2665 	pd->lookup.gid = GID_MAX;
2666 	pd->lookup.pid = NO_PID;
2667 	if (direction == PF_IN) {
2668 		saddr = pd->src;
2669 		daddr = pd->dst;
2670 	} else {
2671 		saddr = pd->dst;
2672 		daddr = pd->src;
2673 	}
2674 	switch (pd->proto) {
2675 	case IPPROTO_TCP:
2676 		if (pd->hdr.tcp == NULL)
2677 			return (-1);
2678 		sport = pd->hdr.tcp->th_sport;
2679 		dport = pd->hdr.tcp->th_dport;
2680 
2681 		pi_cpu = tcp_addrcpu(saddr->v4.s_addr, sport, daddr->v4.s_addr, dport);
2682 		pi = &tcbinfo[pi_cpu];
2683 #ifdef SMP
2684 		/*
2685 		 * Our netstack runs lockless on MP systems
2686 		 * (only for TCP connections at the moment).
2687 		 *
2688 		 * As we are not allowed to read another CPU's tcbinfo,
2689 		 * we have to ask that CPU via remote call to search the
2690 		 * table for us.
2691 		 *
2692 		 * Prepare a msg iff data belongs to another CPU.
2693 		 */
2694 		if (pi_cpu != mycpu->gd_cpuid) {
2695 			msg = kmalloc(sizeof(*msg), M_LWKTMSG, M_INTWAIT);
2696 			netmsg_init(&msg->nm_netmsg, NULL, &netisr_afree_rport,
2697 				    0, in_pcblookup_hash_handler);
2698 			msg->nm_pinp = &inp;
2699 			msg->nm_pcbinfo = pi;
2700 			msg->nm_saddr = saddr;
2701 			msg->nm_sport = sport;
2702 			msg->nm_daddr = daddr;
2703 			msg->nm_dport = dport;
2704 			msg->nm_af = pd->af;
2705 		}
2706 #endif /* SMP */
2707 		break;
2708 	case IPPROTO_UDP:
2709 		if (pd->hdr.udp == NULL)
2710 			return (-1);
2711 		sport = pd->hdr.udp->uh_sport;
2712 		dport = pd->hdr.udp->uh_dport;
2713 		pi = &udbinfo;
2714 		break;
2715 	default:
2716 		return (-1);
2717 	}
2718 	if (direction != PF_IN) {
2719 		u_int16_t	p;
2720 
2721 		p = sport;
2722 		sport = dport;
2723 		dport = p;
2724 	}
2725 	switch (pd->af) {
2726 #ifdef INET6
2727 	case AF_INET6:
2728 #ifdef SMP
2729 		/*
2730 		 * Query other CPU, second part
2731 		 *
2732 		 * msg only gets initialized when:
2733 		 * 1) packet is TCP
2734 		 * 2) the info belongs to another CPU
2735 		 *
2736 		 * Use some switch/case magic to avoid code duplication.
2737 		 */
2738 		if (msg == NULL)
2739 #endif /* SMP */
2740 		{
2741 			inp = in6_pcblookup_hash(pi, &saddr->v6, sport,
2742 			    &daddr->v6, dport, INPLOOKUP_WILDCARD, NULL);
2743 
2744 			if (inp == NULL)
2745 				return (-1);
2746 			break;
2747 		}
2748 		/* FALLTHROUGH if SMP and on other CPU */
2749 #endif /* INET6 */
2750 	case AF_INET:
2751 #ifdef SMP
2752 		if (msg != NULL) {
2753 			lwkt_sendmsg(cpu_portfn(pi_cpu),
2754 				     &msg->nm_netmsg.nm_lmsg);
2755 		} else
2756 #endif /* SMP */
2757 		{
2758 			inp = in_pcblookup_hash(pi, saddr->v4, sport, daddr->v4,
2759 			    dport, INPLOOKUP_WILDCARD, NULL);
2760 		}
2761 		if (inp == NULL)
2762 			return (-1);
2763 		break;
2764 
2765 	default:
2766 		return (-1);
2767 	}
2768 	pd->lookup.uid = inp->inp_socket->so_cred->cr_uid;
2769 	pd->lookup.gid = inp->inp_socket->so_cred->cr_groups[0];
2770 	return (1);
2771 }
2772 
2773 u_int8_t
2774 pf_get_wscale(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af)
2775 {
2776 	int		 hlen;
2777 	u_int8_t	 hdr[60];
2778 	u_int8_t	*opt, optlen;
2779 	u_int8_t	 wscale = 0;
2780 
2781 	hlen = th_off << 2;		/* hlen <= sizeof(hdr) */
2782 	if (hlen <= sizeof(struct tcphdr))
2783 		return (0);
2784 	if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af))
2785 		return (0);
2786 	opt = hdr + sizeof(struct tcphdr);
2787 	hlen -= sizeof(struct tcphdr);
2788 	while (hlen >= 3) {
2789 		switch (*opt) {
2790 		case TCPOPT_EOL:
2791 		case TCPOPT_NOP:
2792 			++opt;
2793 			--hlen;
2794 			break;
2795 		case TCPOPT_WINDOW:
2796 			wscale = opt[2];
2797 			if (wscale > TCP_MAX_WINSHIFT)
2798 				wscale = TCP_MAX_WINSHIFT;
2799 			wscale |= PF_WSCALE_FLAG;
2800 			/* FALLTHROUGH */
2801 		default:
2802 			optlen = opt[1];
2803 			if (optlen < 2)
2804 				optlen = 2;
2805 			hlen -= optlen;
2806 			opt += optlen;
2807 			break;
2808 		}
2809 	}
2810 	return (wscale);
2811 }
2812 
2813 u_int16_t
2814 pf_get_mss(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af)
2815 {
2816 	int		 hlen;
2817 	u_int8_t	 hdr[60];
2818 	u_int8_t	*opt, optlen;
2819 	u_int16_t	 mss = tcp_mssdflt;
2820 
2821 	hlen = th_off << 2;	/* hlen <= sizeof(hdr) */
2822 	if (hlen <= sizeof(struct tcphdr))
2823 		return (0);
2824 	if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af))
2825 		return (0);
2826 	opt = hdr + sizeof(struct tcphdr);
2827 	hlen -= sizeof(struct tcphdr);
2828 	while (hlen >= TCPOLEN_MAXSEG) {
2829 		switch (*opt) {
2830 		case TCPOPT_EOL:
2831 		case TCPOPT_NOP:
2832 			++opt;
2833 			--hlen;
2834 			break;
2835 		case TCPOPT_MAXSEG:
2836 			bcopy((caddr_t)(opt + 2), (caddr_t)&mss, 2);
2837 			/* FALLTHROUGH */
2838 		default:
2839 			optlen = opt[1];
2840 			if (optlen < 2)
2841 				optlen = 2;
2842 			hlen -= optlen;
2843 			opt += optlen;
2844 			break;
2845 		}
2846 	}
2847 	return (mss);
2848 }
2849 
2850 u_int16_t
2851 pf_calc_mss(struct pf_addr *addr, sa_family_t af, u_int16_t offer)
2852 {
2853 #ifdef INET
2854 	struct sockaddr_in	*dst;
2855 	struct route		 ro;
2856 #endif /* INET */
2857 #ifdef INET6
2858 	struct sockaddr_in6	*dst6;
2859 	struct route_in6	 ro6;
2860 #endif /* INET6 */
2861 	struct rtentry		*rt = NULL;
2862 	int			 hlen = 0;
2863 	u_int16_t		 mss = tcp_mssdflt;
2864 
2865 	switch (af) {
2866 #ifdef INET
2867 	case AF_INET:
2868 		hlen = sizeof(struct ip);
2869 		bzero(&ro, sizeof(ro));
2870 		dst = (struct sockaddr_in *)&ro.ro_dst;
2871 		dst->sin_family = AF_INET;
2872 		dst->sin_len = sizeof(*dst);
2873 		dst->sin_addr = addr->v4;
2874 		rtalloc_ign(&ro, (RTF_CLONING | RTF_PRCLONING));
2875 		rt = ro.ro_rt;
2876 		break;
2877 #endif /* INET */
2878 #ifdef INET6
2879 	case AF_INET6:
2880 		hlen = sizeof(struct ip6_hdr);
2881 		bzero(&ro6, sizeof(ro6));
2882 		dst6 = (struct sockaddr_in6 *)&ro6.ro_dst;
2883 		dst6->sin6_family = AF_INET6;
2884 		dst6->sin6_len = sizeof(*dst6);
2885 		dst6->sin6_addr = addr->v6;
2886 		rtalloc_ign((struct route *)&ro6, (RTF_CLONING | RTF_PRCLONING));
2887 		rt = ro6.ro_rt;
2888 		break;
2889 #endif /* INET6 */
2890 	}
2891 
2892 	if (rt && rt->rt_ifp) {
2893 		mss = rt->rt_ifp->if_mtu - hlen - sizeof(struct tcphdr);
2894 		mss = max(tcp_mssdflt, mss);
2895 		RTFREE(rt);
2896 	}
2897 	mss = min(mss, offer);
2898 	mss = max(mss, 64);		/* sanity - at least max opt space */
2899 	return (mss);
2900 }
2901 
2902 void
2903 pf_set_rt_ifp(struct pf_state *s, struct pf_addr *saddr)
2904 {
2905 	struct pf_rule *r = s->rule.ptr;
2906 
2907 	s->rt_kif = NULL;
2908 	if (!r->rt || r->rt == PF_FASTROUTE)
2909 		return;
2910 	switch (s->state_key->af) {
2911 #ifdef INET
2912 	case AF_INET:
2913 		pf_map_addr(AF_INET, r, saddr, &s->rt_addr, NULL,
2914 		    &s->nat_src_node);
2915 		s->rt_kif = r->rpool.cur->kif;
2916 		break;
2917 #endif /* INET */
2918 #ifdef INET6
2919 	case AF_INET6:
2920 		pf_map_addr(AF_INET6, r, saddr, &s->rt_addr, NULL,
2921 		    &s->nat_src_node);
2922 		s->rt_kif = r->rpool.cur->kif;
2923 		break;
2924 #endif /* INET6 */
2925 	}
2926 }
2927 
2928 void
2929 pf_attach_state(struct pf_state_key *sk, struct pf_state *s, int tail)
2930 {
2931 	s->state_key = sk;
2932 	sk->refcnt++;
2933 
2934 	/* list is sorted, if-bound states before floating */
2935 	if (tail)
2936 		TAILQ_INSERT_TAIL(&sk->states, s, next);
2937 	else
2938 		TAILQ_INSERT_HEAD(&sk->states, s, next);
2939 }
2940 
2941 void
2942 pf_detach_state(struct pf_state *s, int flags)
2943 {
2944 	struct pf_state_key	*sk = s->state_key;
2945 
2946 	if (sk == NULL)
2947 		return;
2948 
2949 	s->state_key = NULL;
2950 	TAILQ_REMOVE(&sk->states, s, next);
2951 	if (--sk->refcnt == 0) {
2952 		if (!(flags & PF_DT_SKIP_EXTGWY))
2953 			RB_REMOVE(pf_state_tree_ext_gwy,
2954 			    &pf_statetbl_ext_gwy, sk);
2955 		if (!(flags & PF_DT_SKIP_LANEXT))
2956 			RB_REMOVE(pf_state_tree_lan_ext,
2957 			    &pf_statetbl_lan_ext, sk);
2958 		pool_put(&pf_state_key_pl, sk);
2959 	}
2960 }
2961 
2962 struct pf_state_key *
2963 pf_alloc_state_key(struct pf_state *s)
2964 {
2965 	struct pf_state_key	*sk;
2966 
2967 	if ((sk = pool_get(&pf_state_key_pl, PR_NOWAIT)) == NULL)
2968 		return (NULL);
2969 	bzero(sk, sizeof(*sk));
2970 	TAILQ_INIT(&sk->states);
2971 	pf_attach_state(sk, s, 0);
2972 
2973 	return (sk);
2974 }
2975 
2976 int
2977 pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
2978     struct pfi_kif *kif, struct mbuf *m, int off, void *h,
2979     struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm,
2980     struct ifqueue *ifq, struct inpcb *inp)
2981 {
2982 	struct pf_rule		*nr = NULL;
2983 	struct pf_addr		*saddr = pd->src, *daddr = pd->dst;
2984 	u_int16_t		 bport, nport = 0;
2985 	sa_family_t		 af = pd->af;
2986 	struct pf_rule		*r, *a = NULL;
2987 	struct pf_ruleset	*ruleset = NULL;
2988 	struct pf_src_node	*nsn = NULL;
2989 	struct tcphdr		*th = pd->hdr.tcp;
2990 	u_short			 reason;
2991 	int			 rewrite = 0, hdrlen = 0;
2992 	int			 tag = -1, rtableid = -1;
2993 	int			 asd = 0;
2994 	int			 match = 0;
2995 	int			 state_icmp = 0;
2996 	u_int16_t		 mss = tcp_mssdflt;
2997 	u_int16_t		 sport, dport;
2998 	u_int8_t		 icmptype = 0, icmpcode = 0;
2999 
3000 	if (direction == PF_IN && pf_check_congestion(ifq)) {
3001 		REASON_SET(&reason, PFRES_CONGEST);
3002 		return (PF_DROP);
3003 	}
3004 
3005 	if (inp != NULL)
3006 		pd->lookup.done = pf_socket_lookup(direction, pd);
3007 	else if (debug_pfugidhack) {
3008 		crit_exit();
3009 		DPFPRINTF(PF_DEBUG_MISC, ("pf: unlocked lookup\n"));
3010 		pd->lookup.done = pf_socket_lookup(direction, pd);
3011 		crit_enter();
3012 	}
3013 
3014 	sport = dport = hdrlen = 0;
3015 
3016 	switch (pd->proto) {
3017 	case IPPROTO_TCP:
3018 		sport = th->th_sport;
3019 		dport = th->th_dport;
3020 		hdrlen = sizeof(*th);
3021 		break;
3022 	case IPPROTO_UDP:
3023 		sport = pd->hdr.udp->uh_sport;
3024 		dport = pd->hdr.udp->uh_dport;
3025 		hdrlen = sizeof(*pd->hdr.udp);
3026 		break;
3027 #ifdef INET
3028 	case IPPROTO_ICMP:
3029 		if (pd->af != AF_INET)
3030 			break;
3031 		sport = dport = pd->hdr.icmp->icmp_id;
3032 		icmptype = pd->hdr.icmp->icmp_type;
3033 		icmpcode = pd->hdr.icmp->icmp_code;
3034 
3035 		if (icmptype == ICMP_UNREACH ||
3036 		    icmptype == ICMP_SOURCEQUENCH ||
3037 		    icmptype == ICMP_REDIRECT ||
3038 		    icmptype == ICMP_TIMXCEED ||
3039 		    icmptype == ICMP_PARAMPROB)
3040 			state_icmp++;
3041 		break;
3042 #endif /* INET */
3043 #ifdef INET6
3044 	case IPPROTO_ICMPV6:
3045 		if (pd->af != AF_INET6)
3046 			break;
3047 		sport = dport = pd->hdr.icmp6->icmp6_id;
3048 		hdrlen = sizeof(*pd->hdr.icmp6);
3049 		icmptype = pd->hdr.icmp6->icmp6_type;
3050 		icmpcode = pd->hdr.icmp6->icmp6_code;
3051 
3052 		if (icmptype == ICMP6_DST_UNREACH ||
3053 		    icmptype == ICMP6_PACKET_TOO_BIG ||
3054 		    icmptype == ICMP6_TIME_EXCEEDED ||
3055 		    icmptype == ICMP6_PARAM_PROB)
3056 			state_icmp++;
3057 		break;
3058 #endif /* INET6 */
3059 	}
3060 
3061 	r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
3062 
3063 	if (direction == PF_OUT) {
3064 		bport = nport = sport;
3065 		/* check outgoing packet for BINAT/NAT */
3066 		if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn,
3067 		    saddr, sport, daddr, dport, &pd->naddr, &nport)) != NULL) {
3068 			PF_ACPY(&pd->baddr, saddr, af);
3069 			switch (pd->proto) {
3070 			case IPPROTO_TCP:
3071 				pf_change_ap(saddr, &th->th_sport, pd->ip_sum,
3072 				    &th->th_sum, &pd->naddr, nport, 0, af);
3073 				sport = th->th_sport;
3074 				rewrite++;
3075 				break;
3076 			case IPPROTO_UDP:
3077 				pf_change_ap(saddr, &pd->hdr.udp->uh_sport,
3078 				    pd->ip_sum, &pd->hdr.udp->uh_sum,
3079 				    &pd->naddr, nport, 1, af);
3080 				sport = pd->hdr.udp->uh_sport;
3081 				rewrite++;
3082 				break;
3083 #ifdef INET
3084 			case IPPROTO_ICMP:
3085 				pf_change_a(&saddr->v4.s_addr, pd->ip_sum,
3086 				    pd->naddr.v4.s_addr, 0);
3087 				pd->hdr.icmp->icmp_cksum = pf_cksum_fixup(
3088 				    pd->hdr.icmp->icmp_cksum, sport, nport, 0);
3089 				pd->hdr.icmp->icmp_id = nport;
3090 				m_copyback(m, off, ICMP_MINLEN, (caddr_t)pd->hdr.icmp);
3091 				break;
3092 #endif /* INET */
3093 #ifdef INET6
3094 			case IPPROTO_ICMPV6:
3095 				pf_change_a6(saddr, &pd->hdr.icmp6->icmp6_cksum,
3096 				    &pd->naddr, 0);
3097 				rewrite++;
3098 				break;
3099 #endif /* INET */
3100 			default:
3101 				switch (af) {
3102 #ifdef INET
3103 				case AF_INET:
3104 					pf_change_a(&saddr->v4.s_addr,
3105 					    pd->ip_sum, pd->naddr.v4.s_addr, 0);
3106 					break;
3107 #endif /* INET */
3108 #ifdef INET6
3109 				case AF_INET6:
3110 					PF_ACPY(saddr, &pd->naddr, af);
3111 					break;
3112 #endif /* INET */
3113 				}
3114 				break;
3115 			}
3116 
3117 			if (nr->natpass)
3118 				r = NULL;
3119 			pd->nat_rule = nr;
3120 		}
3121 	} else {
3122 		bport = nport = dport;
3123 		/* check incoming packet for BINAT/RDR */
3124 		if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn,
3125 		    saddr, sport, daddr, dport, &pd->naddr, &nport)) != NULL) {
3126 			PF_ACPY(&pd->baddr, daddr, af);
3127 			switch (pd->proto) {
3128 			case IPPROTO_TCP:
3129 				pf_change_ap(daddr, &th->th_dport, pd->ip_sum,
3130 				    &th->th_sum, &pd->naddr, nport, 0, af);
3131 				dport = th->th_dport;
3132 				rewrite++;
3133 				break;
3134 			case IPPROTO_UDP:
3135 				pf_change_ap(daddr, &pd->hdr.udp->uh_dport,
3136 				    pd->ip_sum, &pd->hdr.udp->uh_sum,
3137 				    &pd->naddr, nport, 1, af);
3138 				dport = pd->hdr.udp->uh_dport;
3139 				rewrite++;
3140 				break;
3141 #ifdef INET
3142 			case IPPROTO_ICMP:
3143 				pf_change_a(&daddr->v4.s_addr, pd->ip_sum,
3144 				    pd->naddr.v4.s_addr, 0);
3145 				break;
3146 #endif /* INET */
3147 #ifdef INET6
3148 			case IPPROTO_ICMPV6:
3149 				pf_change_a6(daddr, &pd->hdr.icmp6->icmp6_cksum,
3150 				    &pd->naddr, 0);
3151 				rewrite++;
3152 				break;
3153 #endif /* INET6 */
3154 			default:
3155 				switch (af) {
3156 #ifdef INET
3157 				case AF_INET:
3158 					pf_change_a(&daddr->v4.s_addr,
3159 					    pd->ip_sum, pd->naddr.v4.s_addr, 0);
3160 					break;
3161 #endif /* INET */
3162 #ifdef INET6
3163 				case AF_INET6:
3164 					PF_ACPY(daddr, &pd->naddr, af);
3165 					break;
3166 #endif /* INET */
3167 				}
3168 				break;
3169 			}
3170 
3171 			if (nr->natpass)
3172 				r = NULL;
3173 			pd->nat_rule = nr;
3174 		}
3175 	}
3176 
3177 	while (r != NULL) {
3178 		r->evaluations++;
3179 		if (pfi_kif_match(r->kif, kif) == r->ifnot)
3180 			r = r->skip[PF_SKIP_IFP].ptr;
3181 		else if (r->direction && r->direction != direction)
3182 			r = r->skip[PF_SKIP_DIR].ptr;
3183 		else if (r->af && r->af != af)
3184 			r = r->skip[PF_SKIP_AF].ptr;
3185 		else if (r->proto && r->proto != pd->proto)
3186 			r = r->skip[PF_SKIP_PROTO].ptr;
3187 		else if (PF_MISMATCHAW(&r->src.addr, saddr, af,
3188 		    r->src.neg, kif))
3189 			r = r->skip[PF_SKIP_SRC_ADDR].ptr;
3190 		/* tcp/udp only. port_op always 0 in other cases */
3191 		else if (r->src.port_op && !pf_match_port(r->src.port_op,
3192 		    r->src.port[0], r->src.port[1], sport))
3193 			r = r->skip[PF_SKIP_SRC_PORT].ptr;
3194 		else if (PF_MISMATCHAW(&r->dst.addr, daddr, af,
3195 		    r->dst.neg, NULL))
3196 			r = r->skip[PF_SKIP_DST_ADDR].ptr;
3197 		/* tcp/udp only. port_op always 0 in other cases */
3198 		else if (r->dst.port_op && !pf_match_port(r->dst.port_op,
3199 		    r->dst.port[0], r->dst.port[1], dport))
3200 			r = r->skip[PF_SKIP_DST_PORT].ptr;
3201 		/* icmp only. type always 0 in other cases */
3202 		else if (r->type && r->type != icmptype + 1)
3203 			r = TAILQ_NEXT(r, entries);
3204 		/* icmp only. type always 0 in other cases */
3205 		else if (r->code && r->code != icmpcode + 1)
3206 			r = TAILQ_NEXT(r, entries);
3207 		else if (r->tos && !(r->tos == pd->tos))
3208 			r = TAILQ_NEXT(r, entries);
3209 		else if (r->rule_flag & PFRULE_FRAGMENT)
3210 			r = TAILQ_NEXT(r, entries);
3211 		else if (pd->proto == IPPROTO_TCP &&
3212 		    (r->flagset & th->th_flags) != r->flags)
3213 			r = TAILQ_NEXT(r, entries);
3214 		/* tcp/udp only. uid.op always 0 in other cases */
3215 		else if (r->uid.op && (pd->lookup.done || (pd->lookup.done =
3216 		    pf_socket_lookup(direction, pd), 1)) &&
3217 		    !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1],
3218 		    pd->lookup.uid))
3219 			r = TAILQ_NEXT(r, entries);
3220 		/* tcp/udp only. gid.op always 0 in other cases */
3221 		else if (r->gid.op && (pd->lookup.done || (pd->lookup.done =
3222 		    pf_socket_lookup(direction, pd), 1)) &&
3223 		    !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1],
3224 		    pd->lookup.gid))
3225 			r = TAILQ_NEXT(r, entries);
3226 		else if (r->prob && r->prob <= karc4random())
3227 			r = TAILQ_NEXT(r, entries);
3228 		else if (r->match_tag && !pf_match_tag(m, r, &tag))
3229 			r = TAILQ_NEXT(r, entries);
3230 		else if (r->os_fingerprint != PF_OSFP_ANY &&
3231 		    (pd->proto != IPPROTO_TCP || !pf_osfp_match(
3232 		    pf_osfp_fingerprint(pd, m, off, th),
3233 		    r->os_fingerprint)))
3234 			r = TAILQ_NEXT(r, entries);
3235 		else {
3236 			if (r->tag)
3237 				tag = r->tag;
3238 			if (r->rtableid >= 0)
3239 				rtableid = r->rtableid;
3240 			if (r->anchor == NULL) {
3241 				match = 1;
3242 				*rm = r;
3243 				*am = a;
3244 				*rsm = ruleset;
3245 				if ((*rm)->quick)
3246 					break;
3247 				r = TAILQ_NEXT(r, entries);
3248 			} else
3249 				pf_step_into_anchor(&asd, &ruleset,
3250 				    PF_RULESET_FILTER, &r, &a, &match);
3251 		}
3252 		if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset,
3253 		    PF_RULESET_FILTER, &r, &a, &match))
3254 			break;
3255 	}
3256 	r = *rm;
3257 	a = *am;
3258 	ruleset = *rsm;
3259 
3260 	REASON_SET(&reason, PFRES_MATCH);
3261 
3262 	if (r->log || (nr != NULL && nr->log)) {
3263 		if (rewrite)
3264 			m_copyback(m, off, hdrlen, pd->hdr.any);
3265 		PFLOG_PACKET(kif, h, m, af, direction, reason, r->log ? r : nr,
3266 		    a, ruleset, pd);
3267 	}
3268 
3269 	if ((r->action == PF_DROP) &&
3270 	    ((r->rule_flag & PFRULE_RETURNRST) ||
3271 	    (r->rule_flag & PFRULE_RETURNICMP) ||
3272 	    (r->rule_flag & PFRULE_RETURN))) {
3273 		/* undo NAT changes, if they have taken place */
3274 		if (nr != NULL) {
3275 			if (direction == PF_OUT) {
3276 				switch (pd->proto) {
3277 				case IPPROTO_TCP:
3278 					pf_change_ap(saddr, &th->th_sport,
3279 					    pd->ip_sum, &th->th_sum,
3280 					    &pd->baddr, bport, 0, af);
3281 					sport = th->th_sport;
3282 					rewrite++;
3283 					break;
3284 				case IPPROTO_UDP:
3285 					pf_change_ap(saddr,
3286 					    &pd->hdr.udp->uh_sport, pd->ip_sum,
3287 					    &pd->hdr.udp->uh_sum, &pd->baddr,
3288 					    bport, 1, af);
3289 					sport = pd->hdr.udp->uh_sport;
3290 					rewrite++;
3291 					break;
3292 				case IPPROTO_ICMP:
3293 #ifdef INET6
3294 				case IPPROTO_ICMPV6:
3295 #endif
3296 					/* nothing! */
3297 					break;
3298 				default:
3299 					switch (af) {
3300 					case AF_INET:
3301 						pf_change_a(&saddr->v4.s_addr,
3302 						    pd->ip_sum,
3303 						    pd->baddr.v4.s_addr, 0);
3304 						break;
3305 					case AF_INET6:
3306 						PF_ACPY(saddr, &pd->baddr, af);
3307 						break;
3308 					}
3309 				}
3310 			} else {
3311 				switch (pd->proto) {
3312 				case IPPROTO_TCP:
3313 					pf_change_ap(daddr, &th->th_dport,
3314 					    pd->ip_sum, &th->th_sum,
3315 					    &pd->baddr, bport, 0, af);
3316 					dport = th->th_dport;
3317 					rewrite++;
3318 					break;
3319 				case IPPROTO_UDP:
3320 					pf_change_ap(daddr,
3321 					    &pd->hdr.udp->uh_dport, pd->ip_sum,
3322 					    &pd->hdr.udp->uh_sum, &pd->baddr,
3323 					    bport, 1, af);
3324 					dport = pd->hdr.udp->uh_dport;
3325 					rewrite++;
3326 					break;
3327 				case IPPROTO_ICMP:
3328 #ifdef INET6
3329 				case IPPROTO_ICMPV6:
3330 #endif
3331 					/* nothing! */
3332 					break;
3333 				default:
3334 					switch (af) {
3335 					case AF_INET:
3336 						pf_change_a(&daddr->v4.s_addr,
3337 						    pd->ip_sum,
3338 						    pd->baddr.v4.s_addr, 0);
3339 						break;
3340 					case AF_INET6:
3341 						PF_ACPY(daddr, &pd->baddr, af);
3342 						break;
3343 					}
3344 				}
3345 			}
3346 		}
3347 		if (pd->proto == IPPROTO_TCP &&
3348 		    ((r->rule_flag & PFRULE_RETURNRST) ||
3349 		    (r->rule_flag & PFRULE_RETURN)) &&
3350 		    !(th->th_flags & TH_RST)) {
3351 			u_int32_t	 ack = ntohl(th->th_seq) + pd->p_len;
3352 			struct ip	*h = mtod(m, struct ip *);
3353 
3354 			if (pf_check_proto_cksum(m, off,
3355 			    h->ip_len - off, IPPROTO_TCP, AF_INET))
3356 				REASON_SET(&reason, PFRES_PROTCKSUM);
3357 			else {
3358 				if (th->th_flags & TH_SYN)
3359 					ack++;
3360 				if (th->th_flags & TH_FIN)
3361 					ack++;
3362 				pf_send_tcp(r, af, pd->dst,
3363 				    pd->src, th->th_dport, th->th_sport,
3364 				    ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0,
3365 				    r->return_ttl, 1, 0, pd->eh, kif->pfik_ifp);
3366 			}
3367 		} else if ((af == AF_INET) && r->return_icmp)
3368 			pf_send_icmp(m, r->return_icmp >> 8,
3369 			    r->return_icmp & 255, af, r);
3370 		else if ((af == AF_INET6) && r->return_icmp6)
3371 			pf_send_icmp(m, r->return_icmp6 >> 8,
3372 			    r->return_icmp6 & 255, af, r);
3373 	}
3374 
3375 	if (r->action == PF_DROP)
3376 		return (PF_DROP);
3377 
3378 	if (pf_tag_packet(m, tag, rtableid)) {
3379 		REASON_SET(&reason, PFRES_MEMORY);
3380 		return (PF_DROP);
3381 	}
3382 
3383 	if (!state_icmp && (r->keep_state || nr != NULL ||
3384 	    (pd->flags & PFDESC_TCP_NORM))) {
3385 		/* create new state */
3386 		u_int16_t	 len = 0;
3387 		struct pf_state	*s = NULL;
3388 		struct pf_state_key *sk = NULL;
3389 		struct pf_src_node *sn = NULL;
3390 
3391 		/* check maximums */
3392 		if (r->max_states && (r->states >= r->max_states)) {
3393 			pf_status.lcounters[LCNT_STATES]++;
3394 			REASON_SET(&reason, PFRES_MAXSTATES);
3395 			goto cleanup;
3396 		}
3397 		/* src node for filter rule */
3398 		if ((r->rule_flag & PFRULE_SRCTRACK ||
3399 		    r->rpool.opts & PF_POOL_STICKYADDR) &&
3400 		    pf_insert_src_node(&sn, r, saddr, af) != 0) {
3401 			REASON_SET(&reason, PFRES_SRCLIMIT);
3402 			goto cleanup;
3403 		}
3404 		/* src node for translation rule */
3405 		if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) &&
3406 		    ((direction == PF_OUT &&
3407 		    pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) ||
3408 		    (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) {
3409 			REASON_SET(&reason, PFRES_SRCLIMIT);
3410 			goto cleanup;
3411 		}
3412 		s = pool_get(&pf_state_pl, PR_NOWAIT);
3413 		if (s == NULL) {
3414 			REASON_SET(&reason, PFRES_MEMORY);
3415 cleanup:
3416 			if (sn != NULL && sn->states == 0 && sn->expire == 0) {
3417 				RB_REMOVE(pf_src_tree, &tree_src_tracking, sn);
3418 				pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
3419 				pf_status.src_nodes--;
3420 				pool_put(&pf_src_tree_pl, sn);
3421 			}
3422 			if (nsn != sn && nsn != NULL && nsn->states == 0 &&
3423 			    nsn->expire == 0) {
3424 				RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn);
3425 				pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
3426 				pf_status.src_nodes--;
3427 				pool_put(&pf_src_tree_pl, nsn);
3428 			}
3429 			if (sk != NULL) {
3430 				pool_put(&pf_state_key_pl, sk);
3431 			}
3432 			return (PF_DROP);
3433 		}
3434 		bzero(s, sizeof(*s));
3435 		s->rule.ptr = r;
3436 		s->nat_rule.ptr = nr;
3437 		s->anchor.ptr = a;
3438 		STATE_INC_COUNTERS(s);
3439 		s->allow_opts = r->allow_opts;
3440 		s->log = r->log & PF_LOG_ALL;
3441 		if (nr != NULL)
3442 			s->log |= nr->log & PF_LOG_ALL;
3443 		switch (pd->proto) {
3444 		case IPPROTO_TCP:
3445 			len = pd->tot_len - off - (th->th_off << 2);
3446 			s->src.seqlo = ntohl(th->th_seq);
3447 			s->src.seqhi = s->src.seqlo + len + 1;
3448 			if ((th->th_flags & (TH_SYN|TH_ACK)) ==
3449 			TH_SYN && r->keep_state == PF_STATE_MODULATE) {
3450 				/* Generate sequence number modulator */
3451 				while ((s->src.seqdiff =
3452 				    pf_new_isn(sk) - s->src.seqlo) == 0)
3453 					;
3454 				pf_change_a(&th->th_seq, &th->th_sum,
3455 				    htonl(s->src.seqlo + s->src.seqdiff), 0);
3456 				rewrite = 1;
3457 			} else
3458 				s->src.seqdiff = 0;
3459 			if (th->th_flags & TH_SYN) {
3460 				s->src.seqhi++;
3461 				s->src.wscale = pf_get_wscale(m, off,
3462 				    th->th_off, af);
3463 			}
3464 			s->src.max_win = MAX(ntohs(th->th_win), 1);
3465 			if (s->src.wscale & PF_WSCALE_MASK) {
3466 				/* Remove scale factor from initial window */
3467 				int win = s->src.max_win;
3468 				win += 1 << (s->src.wscale & PF_WSCALE_MASK);
3469 				s->src.max_win = (win - 1) >>
3470 				    (s->src.wscale & PF_WSCALE_MASK);
3471 			}
3472 			if (th->th_flags & TH_FIN)
3473 				s->src.seqhi++;
3474 			s->dst.seqhi = 1;
3475 			s->dst.max_win = 1;
3476 			s->src.state = TCPS_SYN_SENT;
3477 			s->dst.state = TCPS_CLOSED;
3478 			s->timeout = PFTM_TCP_FIRST_PACKET;
3479 			break;
3480 		case IPPROTO_UDP:
3481 			s->src.state = PFUDPS_SINGLE;
3482 			s->dst.state = PFUDPS_NO_TRAFFIC;
3483 			s->timeout = PFTM_UDP_FIRST_PACKET;
3484 			break;
3485 		case IPPROTO_ICMP:
3486 #ifdef INET6
3487 		case IPPROTO_ICMPV6:
3488 #endif
3489 			s->timeout = PFTM_ICMP_FIRST_PACKET;
3490 			break;
3491 		default:
3492 			s->src.state = PFOTHERS_SINGLE;
3493 			s->dst.state = PFOTHERS_NO_TRAFFIC;
3494 			s->timeout = PFTM_OTHER_FIRST_PACKET;
3495 		}
3496 
3497 		s->creation = time_second;
3498 		s->expire = time_second;
3499 
3500 		if (sn != NULL) {
3501 			s->src_node = sn;
3502 			s->src_node->states++;
3503 		}
3504 		if (nsn != NULL) {
3505 			PF_ACPY(&nsn->raddr, &pd->naddr, af);
3506 			s->nat_src_node = nsn;
3507 			s->nat_src_node->states++;
3508 		}
3509 		if (pd->proto == IPPROTO_TCP) {
3510 			if ((pd->flags & PFDESC_TCP_NORM) &&
3511 			    pf_normalize_tcp_init(m, off, pd, th, &s->src,
3512 			    &s->dst)) {
3513 				REASON_SET(&reason, PFRES_MEMORY);
3514 				pf_src_tree_remove_state(s);
3515 				STATE_DEC_COUNTERS(s);
3516 				pool_put(&pf_state_pl, s);
3517 				return (PF_DROP);
3518 			}
3519 			if ((pd->flags & PFDESC_TCP_NORM) && s->src.scrub &&
3520 			    pf_normalize_tcp_stateful(m, off, pd, &reason,
3521 			    th, s, &s->src, &s->dst, &rewrite)) {
3522 				/* This really shouldn't happen!!! */
3523 				DPFPRINTF(PF_DEBUG_URGENT,
3524 				    ("pf_normalize_tcp_stateful failed on "
3525 				    "first pkt"));
3526 				pf_normalize_tcp_cleanup(s);
3527 				pf_src_tree_remove_state(s);
3528 				STATE_DEC_COUNTERS(s);
3529 				pool_put(&pf_state_pl, s);
3530 				return (PF_DROP);
3531 			}
3532 		}
3533 
3534 		if ((sk = pf_alloc_state_key(s)) == NULL) {
3535 			REASON_SET(&reason, PFRES_MEMORY);
3536 			goto cleanup;
3537 		}
3538 
3539 		sk->proto = pd->proto;
3540 		sk->direction = direction;
3541 		sk->af = af;
3542 		if (direction == PF_OUT) {
3543 			PF_ACPY(&sk->gwy.addr, saddr, af);
3544 			PF_ACPY(&sk->ext.addr, daddr, af);
3545 			switch (pd->proto) {
3546 			case IPPROTO_ICMP:
3547 #ifdef INET6
3548 			case IPPROTO_ICMPV6:
3549 #endif
3550 				sk->gwy.port = nport;
3551 				sk->ext.port = 0;
3552 				break;
3553 			default:
3554 				sk->gwy.port = sport;
3555 				sk->ext.port = dport;
3556 			}
3557 			if (nr != NULL) {
3558 				PF_ACPY(&sk->lan.addr, &pd->baddr, af);
3559 				sk->lan.port = bport;
3560 			} else {
3561 				PF_ACPY(&sk->lan.addr, &sk->gwy.addr, af);
3562 				sk->lan.port = sk->gwy.port;
3563 			}
3564 		} else {
3565 			PF_ACPY(&sk->lan.addr, daddr, af);
3566 			PF_ACPY(&sk->ext.addr, saddr, af);
3567 			switch (pd->proto) {
3568 			case IPPROTO_ICMP:
3569 #ifdef INET6
3570 			case IPPROTO_ICMPV6:
3571 #endif
3572 				sk->lan.port = nport;
3573 				sk->ext.port = 0;
3574 				break;
3575 			default:
3576 				sk->lan.port = dport;
3577 				sk->ext.port = sport;
3578 			}
3579 			if (nr != NULL) {
3580 				PF_ACPY(&sk->gwy.addr, &pd->baddr, af);
3581 				sk->gwy.port = bport;
3582 			} else {
3583 				PF_ACPY(&sk->gwy.addr, &sk->lan.addr, af);
3584 				sk->gwy.port = sk->lan.port;
3585 			}
3586 		}
3587 
3588 		s->hash = pf_state_hash(sk);
3589 		s->pickup_mode = r->pickup_mode;
3590 
3591 		pf_set_rt_ifp(s, saddr);	/* needs s->state_key set */
3592 
3593 		if (pf_insert_state(BOUND_IFACE(r, kif), s)) {
3594 			if (pd->proto == IPPROTO_TCP)
3595 				pf_normalize_tcp_cleanup(s);
3596 			REASON_SET(&reason, PFRES_STATEINS);
3597 			pf_src_tree_remove_state(s);
3598 			STATE_DEC_COUNTERS(s);
3599 			pool_put(&pf_state_pl, s);
3600 			return (PF_DROP);
3601 		} else
3602 			*sm = s;
3603 		if (tag > 0) {
3604 			pf_tag_ref(tag);
3605 			s->tag = tag;
3606 		}
3607 		if (pd->proto == IPPROTO_TCP &&
3608 		    (th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN &&
3609 		    r->keep_state == PF_STATE_SYNPROXY) {
3610 			s->src.state = PF_TCPS_PROXY_SRC;
3611 			if (nr != NULL) {
3612 				if (direction == PF_OUT) {
3613 					pf_change_ap(saddr, &th->th_sport,
3614 					    pd->ip_sum, &th->th_sum, &pd->baddr,
3615 					    bport, 0, af);
3616 					sport = th->th_sport;
3617 				} else {
3618 					pf_change_ap(daddr, &th->th_dport,
3619 					    pd->ip_sum, &th->th_sum, &pd->baddr,
3620 					    bport, 0, af);
3621 					sport = th->th_dport;
3622 				}
3623 			}
3624 			s->src.seqhi = karc4random();
3625 			/* Find mss option */
3626 			mss = pf_get_mss(m, off, th->th_off, af);
3627 			mss = pf_calc_mss(saddr, af, mss);
3628 			mss = pf_calc_mss(daddr, af, mss);
3629 			s->src.mss = mss;
3630 			pf_send_tcp(r, af, daddr, saddr, th->th_dport,
3631 			    th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1,
3632 			    TH_SYN|TH_ACK, 0, s->src.mss, 0, 1, 0, NULL, NULL);
3633 			REASON_SET(&reason, PFRES_SYNPROXY);
3634 			return (PF_SYNPROXY_DROP);
3635 		}
3636 	}
3637 
3638 	/* copy back packet headers if we performed NAT operations */
3639 	if (rewrite)
3640 		m_copyback(m, off, hdrlen, pd->hdr.any);
3641 
3642 	return (PF_PASS);
3643 }
3644 
3645 int
3646 pf_test_fragment(struct pf_rule **rm, int direction, struct pfi_kif *kif,
3647     struct mbuf *m, void *h, struct pf_pdesc *pd, struct pf_rule **am,
3648     struct pf_ruleset **rsm)
3649 {
3650 	struct pf_rule		*r, *a = NULL;
3651 	struct pf_ruleset	*ruleset = NULL;
3652 	sa_family_t		 af = pd->af;
3653 	u_short			 reason;
3654 	int			 tag = -1;
3655 	int			 asd = 0;
3656 	int			 match = 0;
3657 
3658 	r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
3659 	while (r != NULL) {
3660 		r->evaluations++;
3661 		if (pfi_kif_match(r->kif, kif) == r->ifnot)
3662 			r = r->skip[PF_SKIP_IFP].ptr;
3663 		else if (r->direction && r->direction != direction)
3664 			r = r->skip[PF_SKIP_DIR].ptr;
3665 		else if (r->af && r->af != af)
3666 			r = r->skip[PF_SKIP_AF].ptr;
3667 		else if (r->proto && r->proto != pd->proto)
3668 			r = r->skip[PF_SKIP_PROTO].ptr;
3669 		else if (PF_MISMATCHAW(&r->src.addr, pd->src, af,
3670 		    r->src.neg, kif))
3671 			r = r->skip[PF_SKIP_SRC_ADDR].ptr;
3672 		else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af,
3673 		    r->dst.neg, NULL))
3674 			r = r->skip[PF_SKIP_DST_ADDR].ptr;
3675 		else if (r->tos && !(r->tos == pd->tos))
3676 			r = TAILQ_NEXT(r, entries);
3677 		else if (r->os_fingerprint != PF_OSFP_ANY)
3678 			r = TAILQ_NEXT(r, entries);
3679 		else if (pd->proto == IPPROTO_UDP &&
3680 		    (r->src.port_op || r->dst.port_op))
3681 			r = TAILQ_NEXT(r, entries);
3682 		else if (pd->proto == IPPROTO_TCP &&
3683 		    (r->src.port_op || r->dst.port_op || r->flagset))
3684 			r = TAILQ_NEXT(r, entries);
3685 		else if ((pd->proto == IPPROTO_ICMP ||
3686 		    pd->proto == IPPROTO_ICMPV6) &&
3687 		    (r->type || r->code))
3688 			r = TAILQ_NEXT(r, entries);
3689 		else if (r->prob && r->prob <= karc4random())
3690 			r = TAILQ_NEXT(r, entries);
3691 		else if (r->match_tag && !pf_match_tag(m, r, &tag))
3692 			r = TAILQ_NEXT(r, entries);
3693 		else {
3694 			if (r->anchor == NULL) {
3695 				match = 1;
3696 				*rm = r;
3697 				*am = a;
3698 				*rsm = ruleset;
3699 				if ((*rm)->quick)
3700 					break;
3701 				r = TAILQ_NEXT(r, entries);
3702 			} else
3703 				pf_step_into_anchor(&asd, &ruleset,
3704 				    PF_RULESET_FILTER, &r, &a, &match);
3705 		}
3706 		if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset,
3707 		    PF_RULESET_FILTER, &r, &a, &match))
3708 			break;
3709 	}
3710 	r = *rm;
3711 	a = *am;
3712 	ruleset = *rsm;
3713 
3714 	REASON_SET(&reason, PFRES_MATCH);
3715 
3716 	if (r->log)
3717 		PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset,
3718 		    pd);
3719 
3720 	if (r->action != PF_PASS)
3721 		return (PF_DROP);
3722 
3723 	if (pf_tag_packet(m, tag, -1)) {
3724 		REASON_SET(&reason, PFRES_MEMORY);
3725 		return (PF_DROP);
3726 	}
3727 
3728 	return (PF_PASS);
3729 }
3730 
3731 int
3732 pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif,
3733     struct mbuf *m, int off, void *h, struct pf_pdesc *pd,
3734     u_short *reason)
3735 {
3736 	struct pf_state_key_cmp	 key;
3737 	struct tcphdr		*th = pd->hdr.tcp;
3738 	u_int16_t		 win = ntohs(th->th_win);
3739 	u_int32_t		 ack, end, seq, orig_seq;
3740 	u_int8_t		 sws, dws;
3741 	int			 ackskew;
3742 	int			 copyback = 0;
3743 	struct pf_state_peer	*src, *dst;
3744 
3745 	key.af = pd->af;
3746 	key.proto = IPPROTO_TCP;
3747 	if (direction == PF_IN)	{
3748 		PF_ACPY(&key.ext.addr, pd->src, key.af);
3749 		PF_ACPY(&key.gwy.addr, pd->dst, key.af);
3750 		key.ext.port = th->th_sport;
3751 		key.gwy.port = th->th_dport;
3752 	} else {
3753 		PF_ACPY(&key.lan.addr, pd->src, key.af);
3754 		PF_ACPY(&key.ext.addr, pd->dst, key.af);
3755 		key.lan.port = th->th_sport;
3756 		key.ext.port = th->th_dport;
3757 	}
3758 
3759 	STATE_LOOKUP();
3760 
3761 	if (direction == (*state)->state_key->direction) {
3762 		src = &(*state)->src;
3763 		dst = &(*state)->dst;
3764 	} else {
3765 		src = &(*state)->dst;
3766 		dst = &(*state)->src;
3767 	}
3768 
3769 	if ((*state)->src.state == PF_TCPS_PROXY_SRC) {
3770 		if (direction != (*state)->state_key->direction) {
3771 			REASON_SET(reason, PFRES_SYNPROXY);
3772 			return (PF_SYNPROXY_DROP);
3773 		}
3774 		if (th->th_flags & TH_SYN) {
3775 			if (ntohl(th->th_seq) != (*state)->src.seqlo) {
3776 				REASON_SET(reason, PFRES_SYNPROXY);
3777 				return (PF_DROP);
3778 			}
3779 			pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst,
3780 			    pd->src, th->th_dport, th->th_sport,
3781 			    (*state)->src.seqhi, ntohl(th->th_seq) + 1,
3782 			    TH_SYN|TH_ACK, 0, (*state)->src.mss, 0, 1,
3783 			    0, NULL, NULL);
3784 			REASON_SET(reason, PFRES_SYNPROXY);
3785 			return (PF_SYNPROXY_DROP);
3786 		} else if (!(th->th_flags & TH_ACK) ||
3787 		    (ntohl(th->th_ack) != (*state)->src.seqhi + 1) ||
3788 		    (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) {
3789 			REASON_SET(reason, PFRES_SYNPROXY);
3790 			return (PF_DROP);
3791 		} else if ((*state)->src_node != NULL &&
3792 		    pf_src_connlimit(state)) {
3793 			REASON_SET(reason, PFRES_SRCLIMIT);
3794 			return (PF_DROP);
3795 		} else
3796 			(*state)->src.state = PF_TCPS_PROXY_DST;
3797 	}
3798 	if ((*state)->src.state == PF_TCPS_PROXY_DST) {
3799 		struct pf_state_host *src, *dst;
3800 
3801 		if (direction == PF_OUT) {
3802 			src = &(*state)->state_key->gwy;
3803 			dst = &(*state)->state_key->ext;
3804 		} else {
3805 			src = &(*state)->state_key->ext;
3806 			dst = &(*state)->state_key->lan;
3807 		}
3808 		if (direction == (*state)->state_key->direction) {
3809 			if (((th->th_flags & (TH_SYN|TH_ACK)) != TH_ACK) ||
3810 			    (ntohl(th->th_ack) != (*state)->src.seqhi + 1) ||
3811 			    (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) {
3812 				REASON_SET(reason, PFRES_SYNPROXY);
3813 				return (PF_DROP);
3814 			}
3815 			(*state)->src.max_win = MAX(ntohs(th->th_win), 1);
3816 			if ((*state)->dst.seqhi == 1)
3817 				(*state)->dst.seqhi = karc4random();
3818 			pf_send_tcp((*state)->rule.ptr, pd->af, &src->addr,
3819 			    &dst->addr, src->port, dst->port,
3820 			    (*state)->dst.seqhi, 0, TH_SYN, 0,
3821 			    (*state)->src.mss, 0, 0, (*state)->tag, NULL, NULL);
3822 			REASON_SET(reason, PFRES_SYNPROXY);
3823 			return (PF_SYNPROXY_DROP);
3824 		} else if (((th->th_flags & (TH_SYN|TH_ACK)) !=
3825 		    (TH_SYN|TH_ACK)) ||
3826 		    (ntohl(th->th_ack) != (*state)->dst.seqhi + 1)) {
3827 			REASON_SET(reason, PFRES_SYNPROXY);
3828 			return (PF_DROP);
3829 		} else {
3830 			(*state)->dst.max_win = MAX(ntohs(th->th_win), 1);
3831 			(*state)->dst.seqlo = ntohl(th->th_seq);
3832 			pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst,
3833 			    pd->src, th->th_dport, th->th_sport,
3834 			    ntohl(th->th_ack), ntohl(th->th_seq) + 1,
3835 			    TH_ACK, (*state)->src.max_win, 0, 0, 0,
3836 			    (*state)->tag, NULL, NULL);
3837 			pf_send_tcp((*state)->rule.ptr, pd->af, &src->addr,
3838 			    &dst->addr, src->port, dst->port,
3839 			    (*state)->src.seqhi + 1, (*state)->src.seqlo + 1,
3840 			    TH_ACK, (*state)->dst.max_win, 0, 0, 1,
3841 			    0, NULL, NULL);
3842 			(*state)->src.seqdiff = (*state)->dst.seqhi -
3843 			    (*state)->src.seqlo;
3844 			(*state)->dst.seqdiff = (*state)->src.seqhi -
3845 			    (*state)->dst.seqlo;
3846 			(*state)->src.seqhi = (*state)->src.seqlo +
3847 			    (*state)->dst.max_win;
3848 			(*state)->dst.seqhi = (*state)->dst.seqlo +
3849 			    (*state)->src.max_win;
3850 			(*state)->src.wscale = (*state)->dst.wscale = 0;
3851 			(*state)->src.state = (*state)->dst.state =
3852 			    TCPS_ESTABLISHED;
3853 			REASON_SET(reason, PFRES_SYNPROXY);
3854 			return (PF_SYNPROXY_DROP);
3855 		}
3856 	}
3857 
3858 	if (src->wscale && dst->wscale && !(th->th_flags & TH_SYN)) {
3859 		sws = src->wscale & PF_WSCALE_MASK;
3860 		dws = dst->wscale & PF_WSCALE_MASK;
3861 	} else
3862 		sws = dws = 0;
3863 
3864 	/*
3865 	 * Sequence tracking algorithm from Guido van Rooij's paper:
3866 	 *   http://www.madison-gurkha.com/publications/tcp_filtering/
3867 	 *	tcp_filtering.ps
3868 	 */
3869 
3870 	orig_seq = seq = ntohl(th->th_seq);
3871 	if (src->seqlo == 0) {
3872 		/* First packet from this end. Set its state */
3873 
3874 		if ((pd->flags & PFDESC_TCP_NORM || dst->scrub) &&
3875 		    src->scrub == NULL) {
3876 			if (pf_normalize_tcp_init(m, off, pd, th, src, dst)) {
3877 				REASON_SET(reason, PFRES_MEMORY);
3878 				return (PF_DROP);
3879 			}
3880 		}
3881 
3882 		/* Deferred generation of sequence number modulator */
3883 		if (dst->seqdiff && !src->seqdiff) {
3884 
3885 			while ((src->seqdiff = pf_new_isn((struct pf_state_key *)&key) - seq) == 0)
3886 				;
3887 			ack = ntohl(th->th_ack) - dst->seqdiff;
3888 			pf_change_a(&th->th_seq, &th->th_sum, htonl(seq +
3889 			    src->seqdiff), 0);
3890 			pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0);
3891 			copyback = 1;
3892 		} else {
3893 			ack = ntohl(th->th_ack);
3894 		}
3895 
3896 		end = seq + pd->p_len;
3897 		if (th->th_flags & TH_SYN) {
3898 			end++;
3899 			(*state)->sync_flags |= PFSTATE_GOT_SYN2;
3900 			if (dst->wscale & PF_WSCALE_FLAG) {
3901 				src->wscale = pf_get_wscale(m, off, th->th_off,
3902 				    pd->af);
3903 				if (src->wscale & PF_WSCALE_FLAG) {
3904 					/* Remove scale factor from initial
3905 					 * window */
3906 					sws = src->wscale & PF_WSCALE_MASK;
3907 					win = ((u_int32_t)win + (1 << sws) - 1)
3908 					    >> sws;
3909 					dws = dst->wscale & PF_WSCALE_MASK;
3910 				} else {
3911 					/* fixup other window */
3912 					dst->max_win <<= dst->wscale &
3913 					    PF_WSCALE_MASK;
3914 					/* in case of a retrans SYN|ACK */
3915 					dst->wscale = 0;
3916 				}
3917 			}
3918 		}
3919 		if (th->th_flags & TH_FIN)
3920 			end++;
3921 
3922 		src->seqlo = seq;
3923 		if (src->state < TCPS_SYN_SENT)
3924 			src->state = TCPS_SYN_SENT;
3925 
3926 		/*
3927 		 * May need to slide the window (seqhi may have been set by
3928 		 * the crappy stack check or if we picked up the connection
3929 		 * after establishment)
3930 		 */
3931 		if (src->seqhi == 1 ||
3932 		    SEQ_GEQ(end + MAX(1, dst->max_win << dws), src->seqhi))
3933 			src->seqhi = end + MAX(1, dst->max_win << dws);
3934 		if (win > src->max_win)
3935 			src->max_win = win;
3936 
3937 	} else {
3938 		ack = ntohl(th->th_ack) - dst->seqdiff;
3939 		if (src->seqdiff) {
3940 			/* Modulate sequence numbers */
3941 			pf_change_a(&th->th_seq, &th->th_sum, htonl(seq +
3942 			    src->seqdiff), 0);
3943 			pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0);
3944 			copyback = 1;
3945 		}
3946 		end = seq + pd->p_len;
3947 		if (th->th_flags & TH_SYN)
3948 			end++;
3949 		if (th->th_flags & TH_FIN)
3950 			end++;
3951 	}
3952 
3953 	if ((th->th_flags & TH_ACK) == 0) {
3954 		/* Let it pass through the ack skew check */
3955 		ack = dst->seqlo;
3956 	} else if ((ack == 0 &&
3957 	    (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) ||
3958 	    /* broken tcp stacks do not set ack */
3959 	    (dst->state < TCPS_SYN_SENT)) {
3960 		/*
3961 		 * Many stacks (ours included) will set the ACK number in an
3962 		 * FIN|ACK if the SYN times out -- no sequence to ACK.
3963 		 */
3964 		ack = dst->seqlo;
3965 	}
3966 
3967 	if (seq == end) {
3968 		/* Ease sequencing restrictions on no data packets */
3969 		seq = src->seqlo;
3970 		end = seq;
3971 	}
3972 
3973 	ackskew = dst->seqlo - ack;
3974 
3975 
3976 	/*
3977 	 * Need to demodulate the sequence numbers in any TCP SACK options
3978 	 * (Selective ACK). We could optionally validate the SACK values
3979 	 * against the current ACK window, either forwards or backwards, but
3980 	 * I'm not confident that SACK has been implemented properly
3981 	 * everywhere. It wouldn't surprise me if several stacks accidently
3982 	 * SACK too far backwards of previously ACKed data. There really aren't
3983 	 * any security implications of bad SACKing unless the target stack
3984 	 * doesn't validate the option length correctly. Someone trying to
3985 	 * spoof into a TCP connection won't bother blindly sending SACK
3986 	 * options anyway.
3987 	 */
3988 	if (dst->seqdiff && (th->th_off << 2) > sizeof(struct tcphdr)) {
3989 		if (pf_modulate_sack(m, off, pd, th, dst))
3990 			copyback = 1;
3991 	}
3992 
3993 
3994 #define MAXACKWINDOW (0xffff + 1500)	/* 1500 is an arbitrary fudge factor */
3995 	if (SEQ_GEQ(src->seqhi, end) &&
3996 	    /* Last octet inside other's window space */
3997 	    SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) &&
3998 	    /* Retrans: not more than one window back */
3999 	    (ackskew >= -MAXACKWINDOW) &&
4000 	    /* Acking not more than one reassembled fragment backwards */
4001 	    (ackskew <= (MAXACKWINDOW << sws)) &&
4002 	    /* Acking not more than one window forward */
4003 	    ((th->th_flags & TH_RST) == 0 || orig_seq == src->seqlo ||
4004 	    (orig_seq == src->seqlo + 1) || (orig_seq + 1 == src->seqlo) ||
4005 	    (pd->flags & PFDESC_IP_REAS) == 0)) {
4006 	    /* Require an exact/+1 sequence match on resets when possible */
4007 
4008 		if (dst->scrub || src->scrub) {
4009 			if (pf_normalize_tcp_stateful(m, off, pd, reason, th,
4010 			    *state, src, dst, &copyback))
4011 				return (PF_DROP);
4012 		}
4013 
4014 		/* update max window */
4015 		if (src->max_win < win)
4016 			src->max_win = win;
4017 		/* synchronize sequencing */
4018 		if (SEQ_GT(end, src->seqlo))
4019 			src->seqlo = end;
4020 		/* slide the window of what the other end can send */
4021 		if (SEQ_GEQ(ack + (win << sws), dst->seqhi))
4022 			dst->seqhi = ack + MAX((win << sws), 1);
4023 
4024 
4025 		/* update states */
4026 		if (th->th_flags & TH_SYN)
4027 			if (src->state < TCPS_SYN_SENT)
4028 				src->state = TCPS_SYN_SENT;
4029 		if (th->th_flags & TH_FIN)
4030 			if (src->state < TCPS_CLOSING)
4031 				src->state = TCPS_CLOSING;
4032 		if (th->th_flags & TH_ACK) {
4033 			if (dst->state == TCPS_SYN_SENT) {
4034 				dst->state = TCPS_ESTABLISHED;
4035 				if (src->state == TCPS_ESTABLISHED &&
4036 				    (*state)->src_node != NULL &&
4037 				    pf_src_connlimit(state)) {
4038 					REASON_SET(reason, PFRES_SRCLIMIT);
4039 					return (PF_DROP);
4040 				}
4041 			} else if (dst->state == TCPS_CLOSING)
4042 				dst->state = TCPS_FIN_WAIT_2;
4043 		}
4044 		if (th->th_flags & TH_RST)
4045 			src->state = dst->state = TCPS_TIME_WAIT;
4046 
4047 		/* update expire time */
4048 		(*state)->expire = time_second;
4049 		if (src->state >= TCPS_FIN_WAIT_2 &&
4050 		    dst->state >= TCPS_FIN_WAIT_2)
4051 			(*state)->timeout = PFTM_TCP_CLOSED;
4052 		else if (src->state >= TCPS_CLOSING &&
4053 		    dst->state >= TCPS_CLOSING)
4054 			(*state)->timeout = PFTM_TCP_FIN_WAIT;
4055 		else if (src->state < TCPS_ESTABLISHED ||
4056 		    dst->state < TCPS_ESTABLISHED)
4057 			(*state)->timeout = PFTM_TCP_OPENING;
4058 		else if (src->state >= TCPS_CLOSING ||
4059 		    dst->state >= TCPS_CLOSING)
4060 			(*state)->timeout = PFTM_TCP_CLOSING;
4061 		else
4062 			(*state)->timeout = PFTM_TCP_ESTABLISHED;
4063 
4064 		/* Fall through to PASS packet */
4065 
4066 	} else if ((dst->state < TCPS_SYN_SENT ||
4067 		dst->state >= TCPS_FIN_WAIT_2 ||
4068 		src->state >= TCPS_FIN_WAIT_2) &&
4069 	    SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) &&
4070 	    /* Within a window forward of the originating packet */
4071 	    SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW)) {
4072 	    /* Within a window backward of the originating packet */
4073 
4074 		/*
4075 		 * This currently handles three situations:
4076 		 *  1) Stupid stacks will shotgun SYNs before their peer
4077 		 *     replies.
4078 		 *  2) When PF catches an already established stream (the
4079 		 *     firewall rebooted, the state table was flushed, routes
4080 		 *     changed...)
4081 		 *  3) Packets get funky immediately after the connection
4082 		 *     closes (this should catch Solaris spurious ACK|FINs
4083 		 *     that web servers like to spew after a close)
4084 		 *
4085 		 * This must be a little more careful than the above code
4086 		 * since packet floods will also be caught here. We don't
4087 		 * update the TTL here to mitigate the damage of a packet
4088 		 * flood and so the same code can handle awkward establishment
4089 		 * and a loosened connection close.
4090 		 * In the establishment case, a correct peer response will
4091 		 * validate the connection, go through the normal state code
4092 		 * and keep updating the state TTL.
4093 		 */
4094 
4095 		if (pf_status.debug >= PF_DEBUG_MISC) {
4096 			kprintf("pf: loose state match: ");
4097 			pf_print_state(*state);
4098 			pf_print_flags(th->th_flags);
4099 			kprintf(" seq=%u (%u) ack=%u len=%u ackskew=%d "
4100 			    "pkts=%llu:%llu dir=%s,%s\n", seq, orig_seq, ack, pd->p_len,
4101 			    ackskew, (unsigned long long)(*state)->packets[0],
4102 			    (unsigned long long)(*state)->packets[1],
4103 			    direction == PF_IN ? "in" : "out",
4104 			    direction == (*state)->state_key->direction ?
4105 				"fwd" : "rev");
4106 		}
4107 
4108 		if (dst->scrub || src->scrub) {
4109 			if (pf_normalize_tcp_stateful(m, off, pd, reason, th,
4110 			    *state, src, dst, &copyback))
4111 				return (PF_DROP);
4112 		}
4113 
4114 		/* update max window */
4115 		if (src->max_win < win)
4116 			src->max_win = win;
4117 		/* synchronize sequencing */
4118 		if (SEQ_GT(end, src->seqlo))
4119 			src->seqlo = end;
4120 		/* slide the window of what the other end can send */
4121 		if (SEQ_GEQ(ack + (win << sws), dst->seqhi))
4122 			dst->seqhi = ack + MAX((win << sws), 1);
4123 
4124 		/*
4125 		 * Cannot set dst->seqhi here since this could be a shotgunned
4126 		 * SYN and not an already established connection.
4127 		 */
4128 
4129 		if (th->th_flags & TH_FIN)
4130 			if (src->state < TCPS_CLOSING)
4131 				src->state = TCPS_CLOSING;
4132 		if (th->th_flags & TH_RST)
4133 			src->state = dst->state = TCPS_TIME_WAIT;
4134 
4135 		/* Fall through to PASS packet */
4136 
4137 	} else if ((*state)->pickup_mode == PF_PICKUPS_HASHONLY ||
4138 		    ((*state)->pickup_mode == PF_PICKUPS_ENABLED &&
4139 		     ((*state)->sync_flags & PFSTATE_GOT_SYN_MASK) !=
4140 		      PFSTATE_GOT_SYN_MASK)) {
4141 		/*
4142 		 * If pickup mode is hash only, do not fail on sequence checks.
4143 		 *
4144 		 * If pickup mode is enabled and we did not see the SYN in
4145 		 * both direction, do not fail on sequence checks because
4146 		 * we do not have complete information on window scale.
4147 		 *
4148 		 * Adjust expiration and fall through to PASS packet.
4149 		 * XXX Add a FIN check to reduce timeout?
4150 		 */
4151 		(*state)->expire = time_second;
4152 	} else  {
4153 		/*
4154 		 * Failure processing
4155 		 */
4156 		if ((*state)->dst.state == TCPS_SYN_SENT &&
4157 		    (*state)->src.state == TCPS_SYN_SENT) {
4158 			/* Send RST for state mismatches during handshake */
4159 			if (!(th->th_flags & TH_RST))
4160 				pf_send_tcp((*state)->rule.ptr, pd->af,
4161 				    pd->dst, pd->src, th->th_dport,
4162 				    th->th_sport, ntohl(th->th_ack), 0,
4163 				    TH_RST, 0, 0,
4164 				    (*state)->rule.ptr->return_ttl, 1, 0,
4165 				    pd->eh, kif->pfik_ifp);
4166 			src->seqlo = 0;
4167 			src->seqhi = 1;
4168 			src->max_win = 1;
4169 		} else if (pf_status.debug >= PF_DEBUG_MISC) {
4170 			kprintf("pf: BAD state: ");
4171 			pf_print_state(*state);
4172 			pf_print_flags(th->th_flags);
4173 			kprintf(" seq=%u (%u) ack=%u len=%u ackskew=%d "
4174 			    "pkts=%llu:%llu dir=%s,%s\n",
4175 			    seq, orig_seq, ack, pd->p_len, ackskew,
4176 			    (unsigned long long)(*state)->packets[0],
4177 				(unsigned long long)(*state)->packets[1],
4178 			    direction == PF_IN ? "in" : "out",
4179 			    direction == (*state)->state_key->direction ?
4180 				"fwd" : "rev");
4181 			kprintf("pf: State failure on: %c %c %c %c | %c %c\n",
4182 			    SEQ_GEQ(src->seqhi, end) ? ' ' : '1',
4183 			    SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) ?
4184 			    ' ': '2',
4185 			    (ackskew >= -MAXACKWINDOW) ? ' ' : '3',
4186 			    (ackskew <= (MAXACKWINDOW << sws)) ? ' ' : '4',
4187 			    SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) ?' ' :'5',
4188 			    SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW) ?' ' :'6');
4189 		}
4190 		REASON_SET(reason, PFRES_BADSTATE);
4191 		return (PF_DROP);
4192 	}
4193 
4194 	/* Any packets which have gotten here are to be passed */
4195 
4196 	/* translate source/destination address, if necessary */
4197 	if (STATE_TRANSLATE((*state)->state_key)) {
4198 		if (direction == PF_OUT) {
4199 			pf_change_ap(pd->src, &th->th_sport, pd->ip_sum,
4200 			    &th->th_sum, &(*state)->state_key->gwy.addr,
4201 			    (*state)->state_key->gwy.port, 0, pd->af);
4202 		} else {
4203 			/*
4204 			 * If we don't redispatch the packet will go into
4205 			 * the protocol stack on the wrong cpu for the
4206 			 * post-translated address.
4207 			 */
4208 			m->m_pkthdr.fw_flags |= FW_MBUF_REDISPATCH;
4209 			pf_change_ap(pd->dst, &th->th_dport, pd->ip_sum,
4210 			    &th->th_sum, &(*state)->state_key->lan.addr,
4211 			    (*state)->state_key->lan.port, 0, pd->af);
4212 		}
4213 		m_copyback(m, off, sizeof(*th), (caddr_t)th);
4214 	} else if (copyback) {
4215 		/* Copyback sequence modulation or stateful scrub changes */
4216 		m_copyback(m, off, sizeof(*th), (caddr_t)th);
4217 	}
4218 
4219 	return (PF_PASS);
4220 }
4221 
4222 int
4223 pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif,
4224     struct mbuf *m, int off, void *h, struct pf_pdesc *pd)
4225 {
4226 	struct pf_state_peer	*src, *dst;
4227 	struct pf_state_key_cmp	 key;
4228 	struct udphdr		*uh = pd->hdr.udp;
4229 
4230 	key.af = pd->af;
4231 	key.proto = IPPROTO_UDP;
4232 	if (direction == PF_IN)	{
4233 		PF_ACPY(&key.ext.addr, pd->src, key.af);
4234 		PF_ACPY(&key.gwy.addr, pd->dst, key.af);
4235 		key.ext.port = uh->uh_sport;
4236 		key.gwy.port = uh->uh_dport;
4237 	} else {
4238 		PF_ACPY(&key.lan.addr, pd->src, key.af);
4239 		PF_ACPY(&key.ext.addr, pd->dst, key.af);
4240 		key.lan.port = uh->uh_sport;
4241 		key.ext.port = uh->uh_dport;
4242 	}
4243 
4244 	STATE_LOOKUP();
4245 
4246 	if (direction == (*state)->state_key->direction) {
4247 		src = &(*state)->src;
4248 		dst = &(*state)->dst;
4249 	} else {
4250 		src = &(*state)->dst;
4251 		dst = &(*state)->src;
4252 	}
4253 
4254 	/* update states */
4255 	if (src->state < PFUDPS_SINGLE)
4256 		src->state = PFUDPS_SINGLE;
4257 	if (dst->state == PFUDPS_SINGLE)
4258 		dst->state = PFUDPS_MULTIPLE;
4259 
4260 	/* update expire time */
4261 	(*state)->expire = time_second;
4262 	if (src->state == PFUDPS_MULTIPLE && dst->state == PFUDPS_MULTIPLE)
4263 		(*state)->timeout = PFTM_UDP_MULTIPLE;
4264 	else
4265 		(*state)->timeout = PFTM_UDP_SINGLE;
4266 
4267 	/* translate source/destination address, if necessary */
4268 	if (STATE_TRANSLATE((*state)->state_key)) {
4269 		if (direction == PF_OUT) {
4270 			pf_change_ap(pd->src, &uh->uh_sport, pd->ip_sum,
4271 			    &uh->uh_sum, &(*state)->state_key->gwy.addr,
4272 			    (*state)->state_key->gwy.port, 1, pd->af);
4273 		} else {
4274 			/*
4275 			 * If we don't redispatch the packet will go into
4276 			 * the protocol stack on the wrong cpu for the
4277 			 * post-translated address.
4278 			 */
4279 			m->m_pkthdr.fw_flags |= FW_MBUF_REDISPATCH;
4280 			pf_change_ap(pd->dst, &uh->uh_dport, pd->ip_sum,
4281 			    &uh->uh_sum, &(*state)->state_key->lan.addr,
4282 			    (*state)->state_key->lan.port, 1, pd->af);
4283 		}
4284 		m_copyback(m, off, sizeof(*uh), (caddr_t)uh);
4285 	}
4286 
4287 	return (PF_PASS);
4288 }
4289 
4290 int
4291 pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
4292     struct mbuf *m, int off, void *h, struct pf_pdesc *pd, u_short *reason)
4293 {
4294 	struct pf_addr	*saddr = pd->src, *daddr = pd->dst;
4295 	u_int16_t	 icmpid = 0, *icmpsum;
4296 	u_int8_t	 icmptype;
4297 	int		 state_icmp = 0;
4298 	struct pf_state_key_cmp key;
4299 
4300 	switch (pd->proto) {
4301 #ifdef INET
4302 	case IPPROTO_ICMP:
4303 		icmptype = pd->hdr.icmp->icmp_type;
4304 		icmpid = pd->hdr.icmp->icmp_id;
4305 		icmpsum = &pd->hdr.icmp->icmp_cksum;
4306 
4307 		if (icmptype == ICMP_UNREACH ||
4308 		    icmptype == ICMP_SOURCEQUENCH ||
4309 		    icmptype == ICMP_REDIRECT ||
4310 		    icmptype == ICMP_TIMXCEED ||
4311 		    icmptype == ICMP_PARAMPROB)
4312 			state_icmp++;
4313 		break;
4314 #endif /* INET */
4315 #ifdef INET6
4316 	case IPPROTO_ICMPV6:
4317 		icmptype = pd->hdr.icmp6->icmp6_type;
4318 		icmpid = pd->hdr.icmp6->icmp6_id;
4319 		icmpsum = &pd->hdr.icmp6->icmp6_cksum;
4320 
4321 		if (icmptype == ICMP6_DST_UNREACH ||
4322 		    icmptype == ICMP6_PACKET_TOO_BIG ||
4323 		    icmptype == ICMP6_TIME_EXCEEDED ||
4324 		    icmptype == ICMP6_PARAM_PROB)
4325 			state_icmp++;
4326 		break;
4327 #endif /* INET6 */
4328 	}
4329 
4330 	if (!state_icmp) {
4331 
4332 		/*
4333 		 * ICMP query/reply message not related to a TCP/UDP packet.
4334 		 * Search for an ICMP state.
4335 		 */
4336 		key.af = pd->af;
4337 		key.proto = pd->proto;
4338 		if (direction == PF_IN)	{
4339 			PF_ACPY(&key.ext.addr, pd->src, key.af);
4340 			PF_ACPY(&key.gwy.addr, pd->dst, key.af);
4341 			key.ext.port = 0;
4342 			key.gwy.port = icmpid;
4343 		} else {
4344 			PF_ACPY(&key.lan.addr, pd->src, key.af);
4345 			PF_ACPY(&key.ext.addr, pd->dst, key.af);
4346 			key.lan.port = icmpid;
4347 			key.ext.port = 0;
4348 		}
4349 
4350 		STATE_LOOKUP();
4351 
4352 		(*state)->expire = time_second;
4353 		(*state)->timeout = PFTM_ICMP_ERROR_REPLY;
4354 
4355 		/* translate source/destination address, if necessary */
4356 		if (STATE_TRANSLATE((*state)->state_key)) {
4357 			if (direction == PF_OUT) {
4358 				switch (pd->af) {
4359 #ifdef INET
4360 				case AF_INET:
4361 					pf_change_a(&saddr->v4.s_addr,
4362 					    pd->ip_sum,
4363 					    (*state)->state_key->gwy.addr.v4.s_addr, 0);
4364 					pd->hdr.icmp->icmp_cksum =
4365 					    pf_cksum_fixup(
4366 					    pd->hdr.icmp->icmp_cksum, icmpid,
4367 					    (*state)->state_key->gwy.port, 0);
4368 					pd->hdr.icmp->icmp_id =
4369 					    (*state)->state_key->gwy.port;
4370 					m_copyback(m, off, ICMP_MINLEN,
4371 					    (caddr_t)pd->hdr.icmp);
4372 					break;
4373 #endif /* INET */
4374 #ifdef INET6
4375 				case AF_INET6:
4376 					pf_change_a6(saddr,
4377 					    &pd->hdr.icmp6->icmp6_cksum,
4378 					    &(*state)->state_key->gwy.addr, 0);
4379 					m_copyback(m, off,
4380 					    sizeof(struct icmp6_hdr),
4381 					    (caddr_t)pd->hdr.icmp6);
4382 					break;
4383 #endif /* INET6 */
4384 				}
4385 			} else {
4386 				switch (pd->af) {
4387 #ifdef INET
4388 				case AF_INET:
4389 					pf_change_a(&daddr->v4.s_addr,
4390 					    pd->ip_sum,
4391 					    (*state)->state_key->lan.addr.v4.s_addr, 0);
4392 					pd->hdr.icmp->icmp_cksum =
4393 					    pf_cksum_fixup(
4394 					    pd->hdr.icmp->icmp_cksum, icmpid,
4395 					    (*state)->state_key->lan.port, 0);
4396 					pd->hdr.icmp->icmp_id =
4397 					    (*state)->state_key->lan.port;
4398 					m_copyback(m, off, ICMP_MINLEN,
4399 					    (caddr_t)pd->hdr.icmp);
4400 					break;
4401 #endif /* INET */
4402 #ifdef INET6
4403 				case AF_INET6:
4404 					pf_change_a6(daddr,
4405 					    &pd->hdr.icmp6->icmp6_cksum,
4406 					    &(*state)->state_key->lan.addr, 0);
4407 					m_copyback(m, off,
4408 					    sizeof(struct icmp6_hdr),
4409 					    (caddr_t)pd->hdr.icmp6);
4410 					break;
4411 #endif /* INET6 */
4412 				}
4413 			}
4414 		}
4415 
4416 		return (PF_PASS);
4417 
4418 	} else {
4419 		/*
4420 		 * ICMP error message in response to a TCP/UDP packet.
4421 		 * Extract the inner TCP/UDP header and search for that state.
4422 		 */
4423 
4424 		struct pf_pdesc	pd2;
4425 #ifdef INET
4426 		struct ip	h2;
4427 #endif /* INET */
4428 #ifdef INET6
4429 		struct ip6_hdr	h2_6;
4430 		int		terminal = 0;
4431 #endif /* INET6 */
4432 		int		ipoff2;
4433 		int		off2;
4434 
4435 		pd2.af = pd->af;
4436 		switch (pd->af) {
4437 #ifdef INET
4438 		case AF_INET:
4439 			/* offset of h2 in mbuf chain */
4440 			ipoff2 = off + ICMP_MINLEN;
4441 
4442 			if (!pf_pull_hdr(m, ipoff2, &h2, sizeof(h2),
4443 			    NULL, reason, pd2.af)) {
4444 				DPFPRINTF(PF_DEBUG_MISC,
4445 				    ("pf: ICMP error message too short "
4446 				    "(ip)\n"));
4447 				return (PF_DROP);
4448 			}
4449 			/*
4450 			 * ICMP error messages don't refer to non-first
4451 			 * fragments
4452 			 */
4453 			if (h2.ip_off & htons(IP_OFFMASK)) {
4454 				REASON_SET(reason, PFRES_FRAG);
4455 				return (PF_DROP);
4456 			}
4457 
4458 			/* offset of protocol header that follows h2 */
4459 			off2 = ipoff2 + (h2.ip_hl << 2);
4460 
4461 			pd2.proto = h2.ip_p;
4462 			pd2.src = (struct pf_addr *)&h2.ip_src;
4463 			pd2.dst = (struct pf_addr *)&h2.ip_dst;
4464 			pd2.ip_sum = &h2.ip_sum;
4465 			break;
4466 #endif /* INET */
4467 #ifdef INET6
4468 		case AF_INET6:
4469 			ipoff2 = off + sizeof(struct icmp6_hdr);
4470 
4471 			if (!pf_pull_hdr(m, ipoff2, &h2_6, sizeof(h2_6),
4472 			    NULL, reason, pd2.af)) {
4473 				DPFPRINTF(PF_DEBUG_MISC,
4474 				    ("pf: ICMP error message too short "
4475 				    "(ip6)\n"));
4476 				return (PF_DROP);
4477 			}
4478 			pd2.proto = h2_6.ip6_nxt;
4479 			pd2.src = (struct pf_addr *)&h2_6.ip6_src;
4480 			pd2.dst = (struct pf_addr *)&h2_6.ip6_dst;
4481 			pd2.ip_sum = NULL;
4482 			off2 = ipoff2 + sizeof(h2_6);
4483 			do {
4484 				switch (pd2.proto) {
4485 				case IPPROTO_FRAGMENT:
4486 					/*
4487 					 * ICMPv6 error messages for
4488 					 * non-first fragments
4489 					 */
4490 					REASON_SET(reason, PFRES_FRAG);
4491 					return (PF_DROP);
4492 				case IPPROTO_AH:
4493 				case IPPROTO_HOPOPTS:
4494 				case IPPROTO_ROUTING:
4495 				case IPPROTO_DSTOPTS: {
4496 					/* get next header and header length */
4497 					struct ip6_ext opt6;
4498 
4499 					if (!pf_pull_hdr(m, off2, &opt6,
4500 					    sizeof(opt6), NULL, reason,
4501 					    pd2.af)) {
4502 						DPFPRINTF(PF_DEBUG_MISC,
4503 						    ("pf: ICMPv6 short opt\n"));
4504 						return (PF_DROP);
4505 					}
4506 					if (pd2.proto == IPPROTO_AH)
4507 						off2 += (opt6.ip6e_len + 2) * 4;
4508 					else
4509 						off2 += (opt6.ip6e_len + 1) * 8;
4510 					pd2.proto = opt6.ip6e_nxt;
4511 					/* goto the next header */
4512 					break;
4513 				}
4514 				default:
4515 					terminal++;
4516 					break;
4517 				}
4518 			} while (!terminal);
4519 			break;
4520 #endif /* INET6 */
4521 		default:
4522 			DPFPRINTF(PF_DEBUG_MISC,
4523 			    ("pf: ICMP AF %d unknown (ip6)\n", pd->af));
4524 			return (PF_DROP);
4525 			break;
4526 		}
4527 
4528 		switch (pd2.proto) {
4529 		case IPPROTO_TCP: {
4530 			struct tcphdr		 th;
4531 			u_int32_t		 seq;
4532 			struct pf_state_peer	*src, *dst;
4533 			u_int8_t		 dws;
4534 			int			 copyback = 0;
4535 
4536 			/*
4537 			 * Only the first 8 bytes of the TCP header can be
4538 			 * expected. Don't access any TCP header fields after
4539 			 * th_seq, an ackskew test is not possible.
4540 			 */
4541 			if (!pf_pull_hdr(m, off2, &th, 8, NULL, reason,
4542 			    pd2.af)) {
4543 				DPFPRINTF(PF_DEBUG_MISC,
4544 				    ("pf: ICMP error message too short "
4545 				    "(tcp)\n"));
4546 				return (PF_DROP);
4547 			}
4548 
4549 			key.af = pd2.af;
4550 			key.proto = IPPROTO_TCP;
4551 			if (direction == PF_IN)	{
4552 				PF_ACPY(&key.ext.addr, pd2.dst, key.af);
4553 				PF_ACPY(&key.gwy.addr, pd2.src, key.af);
4554 				key.ext.port = th.th_dport;
4555 				key.gwy.port = th.th_sport;
4556 			} else {
4557 				PF_ACPY(&key.lan.addr, pd2.dst, key.af);
4558 				PF_ACPY(&key.ext.addr, pd2.src, key.af);
4559 				key.lan.port = th.th_dport;
4560 				key.ext.port = th.th_sport;
4561 			}
4562 
4563 			STATE_LOOKUP();
4564 
4565 			if (direction == (*state)->state_key->direction) {
4566 				src = &(*state)->dst;
4567 				dst = &(*state)->src;
4568 			} else {
4569 				src = &(*state)->src;
4570 				dst = &(*state)->dst;
4571 			}
4572 
4573 			if (src->wscale && dst->wscale)
4574 				dws = dst->wscale & PF_WSCALE_MASK;
4575 			else
4576 				dws = 0;
4577 
4578 			/* Demodulate sequence number */
4579 			seq = ntohl(th.th_seq) - src->seqdiff;
4580 			if (src->seqdiff) {
4581 				pf_change_a(&th.th_seq, icmpsum,
4582 				    htonl(seq), 0);
4583 				copyback = 1;
4584 			}
4585 
4586 			if (!SEQ_GEQ(src->seqhi, seq) ||
4587 			    !SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws))) {
4588 				if (pf_status.debug >= PF_DEBUG_MISC) {
4589 					kprintf("pf: BAD ICMP %d:%d ",
4590 					    icmptype, pd->hdr.icmp->icmp_code);
4591 					pf_print_host(pd->src, 0, pd->af);
4592 					kprintf(" -> ");
4593 					pf_print_host(pd->dst, 0, pd->af);
4594 					kprintf(" state: ");
4595 					pf_print_state(*state);
4596 					kprintf(" seq=%u\n", seq);
4597 				}
4598 				REASON_SET(reason, PFRES_BADSTATE);
4599 				return (PF_DROP);
4600 			}
4601 
4602 			if (STATE_TRANSLATE((*state)->state_key)) {
4603 				if (direction == PF_IN) {
4604 					pf_change_icmp(pd2.src, &th.th_sport,
4605 					    daddr, &(*state)->state_key->lan.addr,
4606 					    (*state)->state_key->lan.port, NULL,
4607 					    pd2.ip_sum, icmpsum,
4608 					    pd->ip_sum, 0, pd2.af);
4609 				} else {
4610 					pf_change_icmp(pd2.dst, &th.th_dport,
4611 					    saddr, &(*state)->state_key->gwy.addr,
4612 					    (*state)->state_key->gwy.port, NULL,
4613 					    pd2.ip_sum, icmpsum,
4614 					    pd->ip_sum, 0, pd2.af);
4615 				}
4616 				copyback = 1;
4617 			}
4618 
4619 			if (copyback) {
4620 				switch (pd2.af) {
4621 #ifdef INET
4622 				case AF_INET:
4623 					m_copyback(m, off, ICMP_MINLEN,
4624 					    (caddr_t)pd->hdr.icmp);
4625 					m_copyback(m, ipoff2, sizeof(h2),
4626 					    (caddr_t)&h2);
4627 					break;
4628 #endif /* INET */
4629 #ifdef INET6
4630 				case AF_INET6:
4631 					m_copyback(m, off,
4632 					    sizeof(struct icmp6_hdr),
4633 					    (caddr_t)pd->hdr.icmp6);
4634 					m_copyback(m, ipoff2, sizeof(h2_6),
4635 					    (caddr_t)&h2_6);
4636 					break;
4637 #endif /* INET6 */
4638 				}
4639 				m_copyback(m, off2, 8, (caddr_t)&th);
4640 			}
4641 
4642 			return (PF_PASS);
4643 			break;
4644 		}
4645 		case IPPROTO_UDP: {
4646 			struct udphdr		uh;
4647 
4648 			if (!pf_pull_hdr(m, off2, &uh, sizeof(uh),
4649 			    NULL, reason, pd2.af)) {
4650 				DPFPRINTF(PF_DEBUG_MISC,
4651 				    ("pf: ICMP error message too short "
4652 				    "(udp)\n"));
4653 				return (PF_DROP);
4654 			}
4655 
4656 			key.af = pd2.af;
4657 			key.proto = IPPROTO_UDP;
4658 			if (direction == PF_IN)	{
4659 				PF_ACPY(&key.ext.addr, pd2.dst, key.af);
4660 				PF_ACPY(&key.gwy.addr, pd2.src, key.af);
4661 				key.ext.port = uh.uh_dport;
4662 				key.gwy.port = uh.uh_sport;
4663 			} else {
4664 				PF_ACPY(&key.lan.addr, pd2.dst, key.af);
4665 				PF_ACPY(&key.ext.addr, pd2.src, key.af);
4666 				key.lan.port = uh.uh_dport;
4667 				key.ext.port = uh.uh_sport;
4668 			}
4669 
4670 			STATE_LOOKUP();
4671 
4672 			if (STATE_TRANSLATE((*state)->state_key)) {
4673 				if (direction == PF_IN) {
4674 					pf_change_icmp(pd2.src, &uh.uh_sport,
4675 					    daddr,
4676 					    &(*state)->state_key->lan.addr,
4677 					    (*state)->state_key->lan.port,
4678 					    &uh.uh_sum,
4679 					    pd2.ip_sum, icmpsum,
4680 					    pd->ip_sum, 1, pd2.af);
4681 				} else {
4682 					pf_change_icmp(pd2.dst, &uh.uh_dport,
4683 					    saddr,
4684 					    &(*state)->state_key->gwy.addr,
4685 					    (*state)->state_key->gwy.port, &uh.uh_sum,
4686 					    pd2.ip_sum, icmpsum,
4687 					    pd->ip_sum, 1, pd2.af);
4688 				}
4689 				switch (pd2.af) {
4690 #ifdef INET
4691 				case AF_INET:
4692 					m_copyback(m, off, ICMP_MINLEN,
4693 					    (caddr_t)pd->hdr.icmp);
4694 					m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2);
4695 					break;
4696 #endif /* INET */
4697 #ifdef INET6
4698 				case AF_INET6:
4699 					m_copyback(m, off,
4700 					    sizeof(struct icmp6_hdr),
4701 					    (caddr_t)pd->hdr.icmp6);
4702 					m_copyback(m, ipoff2, sizeof(h2_6),
4703 					    (caddr_t)&h2_6);
4704 					break;
4705 #endif /* INET6 */
4706 				}
4707 				m_copyback(m, off2, sizeof(uh), (caddr_t)&uh);
4708 			}
4709 
4710 			return (PF_PASS);
4711 			break;
4712 		}
4713 #ifdef INET
4714 		case IPPROTO_ICMP: {
4715 			struct icmp		iih;
4716 
4717 			if (!pf_pull_hdr(m, off2, &iih, ICMP_MINLEN,
4718 			    NULL, reason, pd2.af)) {
4719 				DPFPRINTF(PF_DEBUG_MISC,
4720 				    ("pf: ICMP error message too short i"
4721 				    "(icmp)\n"));
4722 				return (PF_DROP);
4723 			}
4724 
4725 			key.af = pd2.af;
4726 			key.proto = IPPROTO_ICMP;
4727 			if (direction == PF_IN)	{
4728 				PF_ACPY(&key.ext.addr, pd2.dst, key.af);
4729 				PF_ACPY(&key.gwy.addr, pd2.src, key.af);
4730 				key.ext.port = 0;
4731 				key.gwy.port = iih.icmp_id;
4732 			} else {
4733 				PF_ACPY(&key.lan.addr, pd2.dst, key.af);
4734 				PF_ACPY(&key.ext.addr, pd2.src, key.af);
4735 				key.lan.port = iih.icmp_id;
4736 				key.ext.port = 0;
4737 			}
4738 
4739 			STATE_LOOKUP();
4740 
4741 			if (STATE_TRANSLATE((*state)->state_key)) {
4742 				if (direction == PF_IN) {
4743 					pf_change_icmp(pd2.src, &iih.icmp_id,
4744 					    daddr,
4745 					    &(*state)->state_key->lan.addr,
4746 					    (*state)->state_key->lan.port, NULL,
4747 					    pd2.ip_sum, icmpsum,
4748 					    pd->ip_sum, 0, AF_INET);
4749 				} else {
4750 					pf_change_icmp(pd2.dst, &iih.icmp_id,
4751 					    saddr,
4752 					    &(*state)->state_key->gwy.addr,
4753 					    (*state)->state_key->gwy.port, NULL,
4754 					    pd2.ip_sum, icmpsum,
4755 					    pd->ip_sum, 0, AF_INET);
4756 				}
4757 				m_copyback(m, off, ICMP_MINLEN, (caddr_t)pd->hdr.icmp);
4758 				m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2);
4759 				m_copyback(m, off2, ICMP_MINLEN, (caddr_t)&iih);
4760 			}
4761 
4762 			return (PF_PASS);
4763 			break;
4764 		}
4765 #endif /* INET */
4766 #ifdef INET6
4767 		case IPPROTO_ICMPV6: {
4768 			struct icmp6_hdr	iih;
4769 
4770 			if (!pf_pull_hdr(m, off2, &iih,
4771 			    sizeof(struct icmp6_hdr), NULL, reason, pd2.af)) {
4772 				DPFPRINTF(PF_DEBUG_MISC,
4773 				    ("pf: ICMP error message too short "
4774 				    "(icmp6)\n"));
4775 				return (PF_DROP);
4776 			}
4777 
4778 			key.af = pd2.af;
4779 			key.proto = IPPROTO_ICMPV6;
4780 			if (direction == PF_IN)	{
4781 				PF_ACPY(&key.ext.addr, pd2.dst, key.af);
4782 				PF_ACPY(&key.gwy.addr, pd2.src, key.af);
4783 				key.ext.port = 0;
4784 				key.gwy.port = iih.icmp6_id;
4785 			} else {
4786 				PF_ACPY(&key.lan.addr, pd2.dst, key.af);
4787 				PF_ACPY(&key.ext.addr, pd2.src, key.af);
4788 				key.lan.port = iih.icmp6_id;
4789 				key.ext.port = 0;
4790 			}
4791 
4792 			STATE_LOOKUP();
4793 
4794 			if (STATE_TRANSLATE((*state)->state_key)) {
4795 				if (direction == PF_IN) {
4796 					pf_change_icmp(pd2.src, &iih.icmp6_id,
4797 					    daddr,
4798 					    &(*state)->state_key->lan.addr,
4799 					    (*state)->state_key->lan.port, NULL,
4800 					    pd2.ip_sum, icmpsum,
4801 					    pd->ip_sum, 0, AF_INET6);
4802 				} else {
4803 					pf_change_icmp(pd2.dst, &iih.icmp6_id,
4804 					    saddr, &(*state)->state_key->gwy.addr,
4805 					    (*state)->state_key->gwy.port, NULL,
4806 					    pd2.ip_sum, icmpsum,
4807 					    pd->ip_sum, 0, AF_INET6);
4808 				}
4809 				m_copyback(m, off, sizeof(struct icmp6_hdr),
4810 				    (caddr_t)pd->hdr.icmp6);
4811 				m_copyback(m, ipoff2, sizeof(h2_6), (caddr_t)&h2_6);
4812 				m_copyback(m, off2, sizeof(struct icmp6_hdr),
4813 				    (caddr_t)&iih);
4814 			}
4815 
4816 			return (PF_PASS);
4817 			break;
4818 		}
4819 #endif /* INET6 */
4820 		default: {
4821 			key.af = pd2.af;
4822 			key.proto = pd2.proto;
4823 			if (direction == PF_IN)	{
4824 				PF_ACPY(&key.ext.addr, pd2.dst, key.af);
4825 				PF_ACPY(&key.gwy.addr, pd2.src, key.af);
4826 				key.ext.port = 0;
4827 				key.gwy.port = 0;
4828 			} else {
4829 				PF_ACPY(&key.lan.addr, pd2.dst, key.af);
4830 				PF_ACPY(&key.ext.addr, pd2.src, key.af);
4831 				key.lan.port = 0;
4832 				key.ext.port = 0;
4833 			}
4834 
4835 			STATE_LOOKUP();
4836 
4837 			if (STATE_TRANSLATE((*state)->state_key)) {
4838 				if (direction == PF_IN) {
4839 					pf_change_icmp(pd2.src, NULL,
4840 					    daddr,
4841 					    &(*state)->state_key->lan.addr,
4842 					    0, NULL,
4843 					    pd2.ip_sum, icmpsum,
4844 					    pd->ip_sum, 0, pd2.af);
4845 				} else {
4846 					pf_change_icmp(pd2.dst, NULL,
4847 					    saddr,
4848 					    &(*state)->state_key->gwy.addr,
4849 					    0, NULL,
4850 					    pd2.ip_sum, icmpsum,
4851 					    pd->ip_sum, 0, pd2.af);
4852 				}
4853 				switch (pd2.af) {
4854 #ifdef INET
4855 				case AF_INET:
4856 					m_copyback(m, off, ICMP_MINLEN,
4857 					    (caddr_t)pd->hdr.icmp);
4858 					m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2);
4859 					break;
4860 #endif /* INET */
4861 #ifdef INET6
4862 				case AF_INET6:
4863 					m_copyback(m, off,
4864 					    sizeof(struct icmp6_hdr),
4865 					    (caddr_t)pd->hdr.icmp6);
4866 					m_copyback(m, ipoff2, sizeof(h2_6),
4867 					    (caddr_t)&h2_6);
4868 					break;
4869 #endif /* INET6 */
4870 				}
4871 			}
4872 
4873 			return (PF_PASS);
4874 			break;
4875 		}
4876 		}
4877 	}
4878 }
4879 
4880 int
4881 pf_test_state_other(struct pf_state **state, int direction, struct pfi_kif *kif,
4882     struct pf_pdesc *pd)
4883 {
4884 	struct pf_state_peer	*src, *dst;
4885 	struct pf_state_key_cmp	 key;
4886 
4887 	key.af = pd->af;
4888 	key.proto = pd->proto;
4889 	if (direction == PF_IN)	{
4890 		PF_ACPY(&key.ext.addr, pd->src, key.af);
4891 		PF_ACPY(&key.gwy.addr, pd->dst, key.af);
4892 		key.ext.port = 0;
4893 		key.gwy.port = 0;
4894 	} else {
4895 		PF_ACPY(&key.lan.addr, pd->src, key.af);
4896 		PF_ACPY(&key.ext.addr, pd->dst, key.af);
4897 		key.lan.port = 0;
4898 		key.ext.port = 0;
4899 	}
4900 
4901 	STATE_LOOKUP();
4902 
4903 	if (direction == (*state)->state_key->direction) {
4904 		src = &(*state)->src;
4905 		dst = &(*state)->dst;
4906 	} else {
4907 		src = &(*state)->dst;
4908 		dst = &(*state)->src;
4909 	}
4910 
4911 	/* update states */
4912 	if (src->state < PFOTHERS_SINGLE)
4913 		src->state = PFOTHERS_SINGLE;
4914 	if (dst->state == PFOTHERS_SINGLE)
4915 		dst->state = PFOTHERS_MULTIPLE;
4916 
4917 	/* update expire time */
4918 	(*state)->expire = time_second;
4919 	if (src->state == PFOTHERS_MULTIPLE && dst->state == PFOTHERS_MULTIPLE)
4920 		(*state)->timeout = PFTM_OTHER_MULTIPLE;
4921 	else
4922 		(*state)->timeout = PFTM_OTHER_SINGLE;
4923 
4924 	/* translate source/destination address, if necessary */
4925 	if (STATE_TRANSLATE((*state)->state_key)) {
4926 		if (direction == PF_OUT)
4927 			switch (pd->af) {
4928 #ifdef INET
4929 			case AF_INET:
4930 				pf_change_a(&pd->src->v4.s_addr,
4931 				    pd->ip_sum,
4932 				    (*state)->state_key->gwy.addr.v4.s_addr,
4933 				    0);
4934 				break;
4935 #endif /* INET */
4936 #ifdef INET6
4937 			case AF_INET6:
4938 				PF_ACPY(pd->src,
4939 				    &(*state)->state_key->gwy.addr, pd->af);
4940 				break;
4941 #endif /* INET6 */
4942 			}
4943 		else
4944 			switch (pd->af) {
4945 #ifdef INET
4946 			case AF_INET:
4947 				pf_change_a(&pd->dst->v4.s_addr,
4948 				    pd->ip_sum,
4949 				    (*state)->state_key->lan.addr.v4.s_addr,
4950 				    0);
4951 				break;
4952 #endif /* INET */
4953 #ifdef INET6
4954 			case AF_INET6:
4955 				PF_ACPY(pd->dst,
4956 				    &(*state)->state_key->lan.addr, pd->af);
4957 				break;
4958 #endif /* INET6 */
4959 			}
4960 	}
4961 
4962 	return (PF_PASS);
4963 }
4964 
4965 /*
4966  * ipoff and off are measured from the start of the mbuf chain.
4967  * h must be at "ipoff" on the mbuf chain.
4968  */
4969 void *
4970 pf_pull_hdr(struct mbuf *m, int off, void *p, int len,
4971     u_short *actionp, u_short *reasonp, sa_family_t af)
4972 {
4973 	switch (af) {
4974 #ifdef INET
4975 	case AF_INET: {
4976 		struct ip	*h = mtod(m, struct ip *);
4977 		u_int16_t	 fragoff = (h->ip_off & IP_OFFMASK) << 3;
4978 
4979 		if (fragoff) {
4980 			if (fragoff >= len)
4981 				ACTION_SET(actionp, PF_PASS);
4982 			else {
4983 				ACTION_SET(actionp, PF_DROP);
4984 				REASON_SET(reasonp, PFRES_FRAG);
4985 			}
4986 			return (NULL);
4987 		}
4988 		if (m->m_pkthdr.len < off + len ||
4989 		    h->ip_len < off + len) {
4990 			ACTION_SET(actionp, PF_DROP);
4991 			REASON_SET(reasonp, PFRES_SHORT);
4992 			return (NULL);
4993 		}
4994 		break;
4995 	}
4996 #endif /* INET */
4997 #ifdef INET6
4998 	case AF_INET6: {
4999 		struct ip6_hdr	*h = mtod(m, struct ip6_hdr *);
5000 
5001 		if (m->m_pkthdr.len < off + len ||
5002 		    (ntohs(h->ip6_plen) + sizeof(struct ip6_hdr)) <
5003 		    (unsigned)(off + len)) {
5004 			ACTION_SET(actionp, PF_DROP);
5005 			REASON_SET(reasonp, PFRES_SHORT);
5006 			return (NULL);
5007 		}
5008 		break;
5009 	}
5010 #endif /* INET6 */
5011 	}
5012 	m_copydata(m, off, len, p);
5013 	return (p);
5014 }
5015 
5016 int
5017 pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *kif)
5018 {
5019 	struct sockaddr_in	*dst;
5020 	int			 ret = 1;
5021 	int			 check_mpath;
5022 #ifdef INET6
5023 	struct sockaddr_in6	*dst6;
5024 	struct route_in6	 ro;
5025 #else
5026 	struct route		 ro;
5027 #endif
5028 	struct radix_node	*rn;
5029 	struct rtentry		*rt;
5030 	struct ifnet		*ifp;
5031 
5032 	check_mpath = 0;
5033 	bzero(&ro, sizeof(ro));
5034 	switch (af) {
5035 	case AF_INET:
5036 		dst = satosin(&ro.ro_dst);
5037 		dst->sin_family = AF_INET;
5038 		dst->sin_len = sizeof(*dst);
5039 		dst->sin_addr = addr->v4;
5040 		break;
5041 #ifdef INET6
5042 	case AF_INET6:
5043 		dst6 = (struct sockaddr_in6 *)&ro.ro_dst;
5044 		dst6->sin6_family = AF_INET6;
5045 		dst6->sin6_len = sizeof(*dst6);
5046 		dst6->sin6_addr = addr->v6;
5047 		break;
5048 #endif /* INET6 */
5049 	default:
5050 		return (0);
5051 	}
5052 
5053 	/* Skip checks for ipsec interfaces */
5054 	if (kif != NULL && kif->pfik_ifp->if_type == IFT_ENC)
5055 		goto out;
5056 
5057 	rtalloc_ign((struct route *)&ro, 0);
5058 
5059 	if (ro.ro_rt != NULL) {
5060 		/* No interface given, this is a no-route check */
5061 		if (kif == NULL)
5062 			goto out;
5063 
5064 		if (kif->pfik_ifp == NULL) {
5065 			ret = 0;
5066 			goto out;
5067 		}
5068 
5069 		/* Perform uRPF check if passed input interface */
5070 		ret = 0;
5071 		rn = (struct radix_node *)ro.ro_rt;
5072 		do {
5073 			rt = (struct rtentry *)rn;
5074 			ifp = rt->rt_ifp;
5075 
5076 			if (kif->pfik_ifp == ifp)
5077 				ret = 1;
5078 			rn = NULL;
5079 		} while (check_mpath == 1 && rn != NULL && ret == 0);
5080 	} else
5081 		ret = 0;
5082 out:
5083 	if (ro.ro_rt != NULL)
5084 		RTFREE(ro.ro_rt);
5085 	return (ret);
5086 }
5087 
5088 int
5089 pf_rtlabel_match(struct pf_addr *addr, sa_family_t af, struct pf_addr_wrap *aw)
5090 {
5091 	struct sockaddr_in	*dst;
5092 #ifdef INET6
5093 	struct sockaddr_in6	*dst6;
5094 	struct route_in6	 ro;
5095 #else
5096 	struct route		 ro;
5097 #endif
5098 	int			 ret = 0;
5099 
5100 	bzero(&ro, sizeof(ro));
5101 	switch (af) {
5102 	case AF_INET:
5103 		dst = satosin(&ro.ro_dst);
5104 		dst->sin_family = AF_INET;
5105 		dst->sin_len = sizeof(*dst);
5106 		dst->sin_addr = addr->v4;
5107 		break;
5108 #ifdef INET6
5109 	case AF_INET6:
5110 		dst6 = (struct sockaddr_in6 *)&ro.ro_dst;
5111 		dst6->sin6_family = AF_INET6;
5112 		dst6->sin6_len = sizeof(*dst6);
5113 		dst6->sin6_addr = addr->v6;
5114 		break;
5115 #endif /* INET6 */
5116 	default:
5117 		return (0);
5118 	}
5119 
5120 rtalloc_ign((struct route *)&ro, (RTF_CLONING | RTF_PRCLONING));
5121 
5122 	if (ro.ro_rt != NULL) {
5123 		RTFREE(ro.ro_rt);
5124 	}
5125 
5126 	return (ret);
5127 }
5128 
5129 #ifdef INET
5130 void
5131 pf_route(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp,
5132     struct pf_state *s, struct pf_pdesc *pd)
5133 {
5134 	struct mbuf		*m0, *m1;
5135 	struct route		 iproute;
5136 	struct route		*ro = NULL;
5137 	struct sockaddr_in	*dst;
5138 	struct ip		*ip;
5139 	struct ifnet		*ifp = NULL;
5140 	struct pf_addr		 naddr;
5141 	struct pf_src_node	*sn = NULL;
5142 	int			 error = 0;
5143 	int sw_csum;
5144 #ifdef IPSEC
5145 	struct m_tag		*mtag;
5146 #endif /* IPSEC */
5147 
5148 	if (m == NULL || *m == NULL || r == NULL ||
5149 	    (dir != PF_IN && dir != PF_OUT) || oifp == NULL)
5150 		panic("pf_route: invalid parameters");
5151 
5152 	if (((*m)->m_pkthdr.fw_flags & PF_MBUF_ROUTED) == 0) {
5153 		(*m)->m_pkthdr.fw_flags |= PF_MBUF_ROUTED;
5154 		(*m)->m_pkthdr.pf.routed = 1;
5155 	} else {
5156 		if ((*m)->m_pkthdr.pf.routed++ > 3) {
5157 			m0 = *m;
5158 			*m = NULL;
5159 			goto bad;
5160 		}
5161 	}
5162 
5163 	if (r->rt == PF_DUPTO) {
5164 		if ((m0 = m_dup(*m, MB_DONTWAIT)) == NULL)
5165 			return;
5166 	} else {
5167 		if ((r->rt == PF_REPLYTO) == (r->direction == dir))
5168 			return;
5169 		m0 = *m;
5170 	}
5171 
5172 	if (m0->m_len < sizeof(struct ip)) {
5173 		DPFPRINTF(PF_DEBUG_URGENT,
5174 		    ("pf_route: m0->m_len < sizeof(struct ip)\n"));
5175 		goto bad;
5176 	}
5177 
5178 	ip = mtod(m0, struct ip *);
5179 
5180 	ro = &iproute;
5181 	bzero((caddr_t)ro, sizeof(*ro));
5182 	dst = satosin(&ro->ro_dst);
5183 	dst->sin_family = AF_INET;
5184 	dst->sin_len = sizeof(*dst);
5185 	dst->sin_addr = ip->ip_dst;
5186 
5187 	if (r->rt == PF_FASTROUTE) {
5188 		rtalloc(ro);
5189 		if (ro->ro_rt == 0) {
5190 			ipstat.ips_noroute++;
5191 			goto bad;
5192 		}
5193 
5194 		ifp = ro->ro_rt->rt_ifp;
5195 		ro->ro_rt->rt_use++;
5196 
5197 		if (ro->ro_rt->rt_flags & RTF_GATEWAY)
5198 			dst = satosin(ro->ro_rt->rt_gateway);
5199 	} else {
5200 		if (TAILQ_EMPTY(&r->rpool.list)) {
5201 			DPFPRINTF(PF_DEBUG_URGENT,
5202 			    ("pf_route: TAILQ_EMPTY(&r->rpool.list)\n"));
5203 			goto bad;
5204 		}
5205 		if (s == NULL) {
5206 			pf_map_addr(AF_INET, r, (struct pf_addr *)&ip->ip_src,
5207 			    &naddr, NULL, &sn);
5208 			if (!PF_AZERO(&naddr, AF_INET))
5209 				dst->sin_addr.s_addr = naddr.v4.s_addr;
5210 			ifp = r->rpool.cur->kif ?
5211 			    r->rpool.cur->kif->pfik_ifp : NULL;
5212 		} else {
5213 			if (!PF_AZERO(&s->rt_addr, AF_INET))
5214 				dst->sin_addr.s_addr =
5215 				    s->rt_addr.v4.s_addr;
5216 			ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
5217 		}
5218 	}
5219 	if (ifp == NULL)
5220 		goto bad;
5221 
5222 	if (oifp != ifp) {
5223 		crit_exit();
5224 		if (pf_test(PF_OUT, ifp, &m0, NULL, NULL) != PF_PASS) {
5225 			crit_enter();
5226 			goto bad;
5227 		} else if (m0 == NULL) {
5228 			crit_enter();
5229 			goto done;
5230 		}
5231 		crit_enter();
5232 		if (m0->m_len < sizeof(struct ip)) {
5233 			DPFPRINTF(PF_DEBUG_URGENT,
5234 			    ("pf_route: m0->m_len < sizeof(struct ip)\n"));
5235 			goto bad;
5236 		}
5237 		ip = mtod(m0, struct ip *);
5238 	}
5239 
5240 	/* Copied from FreeBSD 5.1-CURRENT ip_output. */
5241 	m0->m_pkthdr.csum_flags |= CSUM_IP;
5242 	sw_csum = m0->m_pkthdr.csum_flags & ~ifp->if_hwassist;
5243 	if (sw_csum & CSUM_DELAY_DATA) {
5244 		in_delayed_cksum(m0);
5245 		sw_csum &= ~CSUM_DELAY_DATA;
5246 	}
5247 	m0->m_pkthdr.csum_flags &= ifp->if_hwassist;
5248 
5249 	if (ip->ip_len <= ifp->if_mtu ||
5250 	    (ifp->if_hwassist & CSUM_FRAGMENT &&
5251 		(ip->ip_off & IP_DF) == 0)) {
5252 		ip->ip_len = htons(ip->ip_len);
5253 		ip->ip_off = htons(ip->ip_off);
5254 		ip->ip_sum = 0;
5255 		if (sw_csum & CSUM_DELAY_IP) {
5256 			/* From KAME */
5257 			if (ip->ip_v == IPVERSION &&
5258 			    (ip->ip_hl << 2) == sizeof(*ip)) {
5259 				ip->ip_sum = in_cksum_hdr(ip);
5260 			} else {
5261 				ip->ip_sum = in_cksum(m0, ip->ip_hl << 2);
5262 			}
5263 		}
5264 		crit_exit();
5265 		error = ifp->if_output(ifp, m0, sintosa(dst), ro->ro_rt);
5266 		crit_enter();
5267 		goto done;
5268 	}
5269 
5270 	/*
5271 	 * Too large for interface; fragment if possible.
5272 	 * Must be able to put at least 8 bytes per fragment.
5273 	 */
5274 	if (ip->ip_off & IP_DF) {
5275 		ipstat.ips_cantfrag++;
5276 		if (r->rt != PF_DUPTO) {
5277 			crit_exit();
5278 			icmp_error(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 0,
5279 			    ifp->if_mtu);
5280 			crit_enter();
5281 			goto done;
5282 		} else
5283 			goto bad;
5284 	}
5285 
5286 	m1 = m0;
5287 	error = ip_fragment(ip, &m0, ifp->if_mtu, ifp->if_hwassist, sw_csum);
5288 	if (error) {
5289 		goto bad;
5290 	}
5291 
5292 	for (m0 = m1; m0; m0 = m1) {
5293 		m1 = m0->m_nextpkt;
5294 		m0->m_nextpkt = 0;
5295 		if (error == 0) {
5296 			crit_exit();
5297 			error = (*ifp->if_output)(ifp, m0, sintosa(dst),
5298 			    NULL);
5299 			crit_enter();
5300 		} else
5301 			m_freem(m0);
5302 	}
5303 
5304 	if (error == 0)
5305 		ipstat.ips_fragmented++;
5306 
5307 done:
5308 	if (r->rt != PF_DUPTO)
5309 		*m = NULL;
5310 	if (ro == &iproute && ro->ro_rt)
5311 		RTFREE(ro->ro_rt);
5312 	return;
5313 
5314 bad:
5315 	m_freem(m0);
5316 	goto done;
5317 }
5318 #endif /* INET */
5319 
5320 #ifdef INET6
5321 void
5322 pf_route6(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp,
5323     struct pf_state *s, struct pf_pdesc *pd)
5324 {
5325 	struct mbuf		*m0;
5326 	struct route_in6	 ip6route;
5327 	struct route_in6	*ro;
5328 	struct sockaddr_in6	*dst;
5329 	struct ip6_hdr		*ip6;
5330 	struct ifnet		*ifp = NULL;
5331 	struct pf_addr		 naddr;
5332 	struct pf_src_node	*sn = NULL;
5333 	int			 error = 0;
5334 
5335 	if (m == NULL || *m == NULL || r == NULL ||
5336 	    (dir != PF_IN && dir != PF_OUT) || oifp == NULL)
5337 		panic("pf_route6: invalid parameters");
5338 
5339 	if (((*m)->m_pkthdr.fw_flags & PF_MBUF_ROUTED) == 0) {
5340 		(*m)->m_pkthdr.fw_flags |= PF_MBUF_ROUTED;
5341 		(*m)->m_pkthdr.pf.routed = 1;
5342 	} else {
5343 		if ((*m)->m_pkthdr.pf.routed++ > 3) {
5344 			m0 = *m;
5345 			*m = NULL;
5346 			goto bad;
5347 		}
5348 	}
5349 
5350 	if (r->rt == PF_DUPTO) {
5351 		if ((m0 = m_dup(*m, MB_DONTWAIT)) == NULL)
5352 			return;
5353 	} else {
5354 		if ((r->rt == PF_REPLYTO) == (r->direction == dir))
5355 			return;
5356 		m0 = *m;
5357 	}
5358 
5359 	if (m0->m_len < sizeof(struct ip6_hdr)) {
5360 		DPFPRINTF(PF_DEBUG_URGENT,
5361 		    ("pf_route6: m0->m_len < sizeof(struct ip6_hdr)\n"));
5362 		goto bad;
5363 	}
5364 	ip6 = mtod(m0, struct ip6_hdr *);
5365 
5366 	ro = &ip6route;
5367 	bzero((caddr_t)ro, sizeof(*ro));
5368 	dst = (struct sockaddr_in6 *)&ro->ro_dst;
5369 	dst->sin6_family = AF_INET6;
5370 	dst->sin6_len = sizeof(*dst);
5371 	dst->sin6_addr = ip6->ip6_dst;
5372 
5373 	/* Cheat. XXX why only in the v6 case??? */
5374 	if (r->rt == PF_FASTROUTE) {
5375 		m0->m_pkthdr.pf.flags |= PF_TAG_GENERATED;
5376 		ip6_output(m0, NULL, NULL, 0, NULL, NULL, NULL);
5377 		crit_enter();
5378 		return;
5379 	}
5380 
5381 	if (TAILQ_EMPTY(&r->rpool.list)) {
5382 		DPFPRINTF(PF_DEBUG_URGENT,
5383 		    ("pf_route6: TAILQ_EMPTY(&r->rpool.list)\n"));
5384 		goto bad;
5385 	}
5386 	if (s == NULL) {
5387 		pf_map_addr(AF_INET6, r, (struct pf_addr *)&ip6->ip6_src,
5388 		    &naddr, NULL, &sn);
5389 		if (!PF_AZERO(&naddr, AF_INET6))
5390 			PF_ACPY((struct pf_addr *)&dst->sin6_addr,
5391 			    &naddr, AF_INET6);
5392 		ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL;
5393 	} else {
5394 		if (!PF_AZERO(&s->rt_addr, AF_INET6))
5395 			PF_ACPY((struct pf_addr *)&dst->sin6_addr,
5396 			    &s->rt_addr, AF_INET6);
5397 		ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
5398 	}
5399 	if (ifp == NULL)
5400 		goto bad;
5401 
5402 	if (oifp != ifp) {
5403 		crit_exit();
5404 		if (pf_test6(PF_OUT, ifp, &m0, NULL, NULL) != PF_PASS) {
5405 			crit_enter();
5406 			goto bad;
5407 		} else if (m0 == NULL) {
5408 			crit_enter();
5409 			goto done;
5410 		}
5411 		crit_enter();
5412 		if (m0->m_len < sizeof(struct ip6_hdr)) {
5413 			DPFPRINTF(PF_DEBUG_URGENT,
5414 			    ("pf_route6: m0->m_len < sizeof(struct ip6_hdr)\n"));
5415 			goto bad;
5416 		}
5417 		ip6 = mtod(m0, struct ip6_hdr *);
5418 	}
5419 
5420 	/*
5421 	 * If the packet is too large for the outgoing interface,
5422 	 * send back an icmp6 error.
5423 	 */
5424 	if (IN6_IS_ADDR_LINKLOCAL(&dst->sin6_addr))
5425 		dst->sin6_addr.s6_addr16[1] = htons(ifp->if_index);
5426 	if ((u_long)m0->m_pkthdr.len <= ifp->if_mtu) {
5427 		crit_exit();
5428 		error = nd6_output(ifp, ifp, m0, dst, NULL);
5429 		crit_enter();
5430 	} else {
5431 		in6_ifstat_inc(ifp, ifs6_in_toobig);
5432 		if (r->rt != PF_DUPTO) {
5433 			crit_exit();
5434 			icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu);
5435 			crit_enter();
5436 		 } else
5437 			goto bad;
5438 	}
5439 
5440 done:
5441 	if (r->rt != PF_DUPTO)
5442 		*m = NULL;
5443 	return;
5444 
5445 bad:
5446 	m_freem(m0);
5447 	goto done;
5448 }
5449 
5450 #endif /* INET6 */
5451 
5452 
5453 /*
5454  * check protocol (tcp/udp/icmp/icmp6) checksum and set mbuf flag
5455  *   off is the offset where the protocol header starts
5456  *   len is the total length of protocol header plus payload
5457  * returns 0 when the checksum is valid, otherwise returns 1.
5458  */
5459 /*
5460  * XXX
5461  * FreeBSD supports cksum offload for the following drivers.
5462  * em(4), gx(4), lge(4), nge(4), ti(4), xl(4)
5463  * If we can make full use of it we would outperform ipfw/ipfilter in
5464  * very heavy traffic.
5465  * I have not tested 'cause I don't have NICs that supports cksum offload.
5466  * (There might be problems. Typical phenomena would be
5467  *   1. No route message for UDP packet.
5468  *   2. No connection acceptance from external hosts regardless of rule set.)
5469  */
5470 int
5471 pf_check_proto_cksum(struct mbuf *m, int off, int len, u_int8_t p,
5472     sa_family_t af)
5473 {
5474 	u_int16_t sum = 0;
5475 	int hw_assist = 0;
5476 	struct ip *ip;
5477 
5478 	if (off < sizeof(struct ip) || len < sizeof(struct udphdr))
5479 		return (1);
5480 	if (m->m_pkthdr.len < off + len)
5481 		return (1);
5482 
5483 	switch (p) {
5484 	case IPPROTO_TCP:
5485 	case IPPROTO_UDP:
5486 		if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
5487 			if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
5488 				sum = m->m_pkthdr.csum_data;
5489 			} else {
5490 				ip = mtod(m, struct ip *);
5491 				sum = in_pseudo(ip->ip_src.s_addr,
5492 					ip->ip_dst.s_addr, htonl((u_short)len +
5493 					m->m_pkthdr.csum_data + p));
5494 			}
5495 			sum ^= 0xffff;
5496 			++hw_assist;
5497 		}
5498 		break;
5499 	case IPPROTO_ICMP:
5500 #ifdef INET6
5501 	case IPPROTO_ICMPV6:
5502 #endif /* INET6 */
5503 		break;
5504 	default:
5505 		return (1);
5506 	}
5507 
5508 	if (!hw_assist) {
5509 		switch (af) {
5510 		case AF_INET:
5511 			if (p == IPPROTO_ICMP) {
5512 				if (m->m_len < off)
5513 					return (1);
5514 				m->m_data += off;
5515 				m->m_len -= off;
5516 				sum = in_cksum(m, len);
5517 				m->m_data -= off;
5518 				m->m_len += off;
5519 			} else {
5520 				if (m->m_len < sizeof(struct ip))
5521 					return (1);
5522 				sum = in_cksum_range(m, p, off, len);
5523 				if (sum == 0) {
5524 					m->m_pkthdr.csum_flags |=
5525 					    (CSUM_DATA_VALID |
5526 					     CSUM_PSEUDO_HDR);
5527 					m->m_pkthdr.csum_data = 0xffff;
5528 				}
5529 			}
5530 			break;
5531 #ifdef INET6
5532 		case AF_INET6:
5533 			if (m->m_len < sizeof(struct ip6_hdr))
5534 				return (1);
5535 			sum = in6_cksum(m, p, off, len);
5536 			/*
5537 			 * XXX
5538 			 * IPv6 H/W cksum off-load not supported yet!
5539 			 *
5540 			 * if (sum == 0) {
5541 			 *	m->m_pkthdr.csum_flags |=
5542 			 *	    (CSUM_DATA_VALID|CSUM_PSEUDO_HDR);
5543 			 *	m->m_pkthdr.csum_data = 0xffff;
5544 			 *}
5545 			 */
5546 			break;
5547 #endif /* INET6 */
5548 		default:
5549 			return (1);
5550 		}
5551 	}
5552 	if (sum) {
5553 		switch (p) {
5554 		case IPPROTO_TCP:
5555 			tcpstat.tcps_rcvbadsum++;
5556 			break;
5557 		case IPPROTO_UDP:
5558 			udpstat.udps_badsum++;
5559 			break;
5560 		case IPPROTO_ICMP:
5561 			icmpstat.icps_checksum++;
5562 			break;
5563 #ifdef INET6
5564 		case IPPROTO_ICMPV6:
5565 			icmp6stat.icp6s_checksum++;
5566 			break;
5567 #endif /* INET6 */
5568 		}
5569 		return (1);
5570 	}
5571 	return (0);
5572 }
5573 
5574 #ifdef INET
5575 int
5576 pf_test(int dir, struct ifnet *ifp, struct mbuf **m0,
5577     struct ether_header *eh, struct inpcb *inp)
5578 {
5579 	struct pfi_kif		*kif;
5580 	u_short			 action, reason = 0, log = 0;
5581 	struct mbuf		*m = *m0;
5582 	struct ip		*h = NULL;
5583 	struct pf_rule		*a = NULL, *r = &pf_default_rule, *tr, *nr;
5584 	struct pf_state		*s = NULL;
5585 	struct pf_state_key	*sk = NULL;
5586 	struct pf_ruleset	*ruleset = NULL;
5587 	struct pf_pdesc		 pd;
5588 	int			 off, dirndx, pqid = 0;
5589 
5590 	if (!pf_status.running)
5591 		return (PF_PASS);
5592 
5593 	memset(&pd, 0, sizeof(pd));
5594 	if (ifp->if_type == IFT_CARP && ifp->if_carpdev)
5595 		kif = (struct pfi_kif *)ifp->if_carpdev->if_pf_kif;
5596 	else
5597 		kif = (struct pfi_kif *)ifp->if_pf_kif;
5598 
5599 	if (kif == NULL) {
5600 		DPFPRINTF(PF_DEBUG_URGENT,
5601 		    ("pf_test: kif == NULL, if_xname %s\n", ifp->if_xname));
5602 		return (PF_DROP);
5603 	}
5604 	if (kif->pfik_flags & PFI_IFLAG_SKIP)
5605 		return (PF_PASS);
5606 
5607 #ifdef DIAGNOSTIC
5608 	if ((m->m_flags & M_PKTHDR) == 0)
5609 		panic("non-M_PKTHDR is passed to pf_test");
5610 #endif /* DIAGNOSTIC */
5611 
5612 	if (m->m_pkthdr.len < (int)sizeof(*h)) {
5613 		action = PF_DROP;
5614 		REASON_SET(&reason, PFRES_SHORT);
5615 		log = 1;
5616 		goto done;
5617 	}
5618 
5619 	if (m->m_pkthdr.pf.flags & PF_TAG_GENERATED)
5620 		return (PF_PASS);
5621 
5622 	/* We do IP header normalization and packet reassembly here */
5623 	if (pf_normalize_ip(m0, dir, kif, &reason, &pd) != PF_PASS) {
5624 		action = PF_DROP;
5625 		goto done;
5626 	}
5627 	m = *m0;	/* pf_normalize messes with m0 */
5628 	h = mtod(m, struct ip *);
5629 
5630 	off = h->ip_hl << 2;
5631 	if (off < (int)sizeof(*h)) {
5632 		action = PF_DROP;
5633 		REASON_SET(&reason, PFRES_SHORT);
5634 		log = 1;
5635 		goto done;
5636 	}
5637 
5638 	pd.src = (struct pf_addr *)&h->ip_src;
5639 	pd.dst = (struct pf_addr *)&h->ip_dst;
5640 	PF_ACPY(&pd.baddr, dir == PF_OUT ? pd.src : pd.dst, AF_INET);
5641 	pd.ip_sum = &h->ip_sum;
5642 	pd.proto = h->ip_p;
5643 	pd.af = AF_INET;
5644 	pd.tos = h->ip_tos;
5645 	pd.tot_len = h->ip_len;
5646 	pd.eh = eh;
5647 
5648 	/* handle fragments that didn't get reassembled by normalization */
5649 	if (h->ip_off & (IP_MF | IP_OFFMASK)) {
5650 		action = pf_test_fragment(&r, dir, kif, m, h,
5651 		    &pd, &a, &ruleset);
5652 		goto done;
5653 	}
5654 
5655 	switch (h->ip_p) {
5656 
5657 	case IPPROTO_TCP: {
5658 		struct tcphdr	th;
5659 
5660 		pd.hdr.tcp = &th;
5661 		if (!pf_pull_hdr(m, off, &th, sizeof(th),
5662 		    &action, &reason, AF_INET)) {
5663 			log = action != PF_PASS;
5664 			goto done;
5665 		}
5666 		pd.p_len = pd.tot_len - off - (th.th_off << 2);
5667 		if ((th.th_flags & TH_ACK) && pd.p_len == 0)
5668 			pqid = 1;
5669 		action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
5670 		if (action == PF_DROP)
5671 			goto done;
5672 		action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd,
5673 		    &reason);
5674 		if (action == PF_PASS) {
5675 #if NPFSYNC
5676 			pfsync_update_state(s);
5677 #endif /* NPFSYNC */
5678 			r = s->rule.ptr;
5679 			a = s->anchor.ptr;
5680 			log = s->log;
5681 		} else if (s == NULL)
5682 			action = pf_test_rule(&r, &s, dir, kif,
5683 			    m, off, h, &pd, &a, &ruleset, NULL, inp);
5684 		break;
5685 	}
5686 
5687 	case IPPROTO_UDP: {
5688 		struct udphdr	uh;
5689 
5690 		pd.hdr.udp = &uh;
5691 		if (!pf_pull_hdr(m, off, &uh, sizeof(uh),
5692 		    &action, &reason, AF_INET)) {
5693 			log = action != PF_PASS;
5694 			goto done;
5695 		}
5696 		if (uh.uh_dport == 0 ||
5697 		    ntohs(uh.uh_ulen) > m->m_pkthdr.len - off ||
5698 		    ntohs(uh.uh_ulen) < sizeof(struct udphdr)) {
5699 			action = PF_DROP;
5700 			REASON_SET(&reason, PFRES_SHORT);
5701 			goto done;
5702 		}
5703 		action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd);
5704 		if (action == PF_PASS) {
5705 #if NPFSYNC
5706 			pfsync_update_state(s);
5707 #endif /* NPFSYNC */
5708 			r = s->rule.ptr;
5709 			a = s->anchor.ptr;
5710 			log = s->log;
5711 		} else if (s == NULL)
5712 			action = pf_test_rule(&r, &s, dir, kif,
5713 			    m, off, h, &pd, &a, &ruleset, NULL, inp);
5714 		break;
5715 	}
5716 
5717 	case IPPROTO_ICMP: {
5718 		struct icmp	ih;
5719 
5720 		pd.hdr.icmp = &ih;
5721 		if (!pf_pull_hdr(m, off, &ih, ICMP_MINLEN,
5722 		    &action, &reason, AF_INET)) {
5723 			log = action != PF_PASS;
5724 			goto done;
5725 		}
5726 		action = pf_test_state_icmp(&s, dir, kif, m, off, h, &pd,
5727 		    &reason);
5728 		if (action == PF_PASS) {
5729 #if NPFSYNC
5730 			pfsync_update_state(s);
5731 #endif /* NPFSYNC */
5732 			r = s->rule.ptr;
5733 			a = s->anchor.ptr;
5734 			log = s->log;
5735 		} else if (s == NULL)
5736 			action = pf_test_rule(&r, &s, dir, kif,
5737 			    m, off, h, &pd, &a, &ruleset, NULL, inp);
5738 		break;
5739 	}
5740 
5741 	default:
5742 		action = pf_test_state_other(&s, dir, kif, &pd);
5743 		if (action == PF_PASS) {
5744 #if NPFSYNC
5745 			pfsync_update_state(s);
5746 #endif /* NPFSYNC */
5747 			r = s->rule.ptr;
5748 			a = s->anchor.ptr;
5749 			log = s->log;
5750 		} else if (s == NULL)
5751 			action = pf_test_rule(&r, &s, dir, kif, m, off, h,
5752 			    &pd, &a, &ruleset, NULL, inp);
5753 		break;
5754 	}
5755 
5756 done:
5757 	if (action == PF_PASS && h->ip_hl > 5 &&
5758 	    !((s && s->allow_opts) || r->allow_opts)) {
5759 		action = PF_DROP;
5760 		REASON_SET(&reason, PFRES_IPOPTIONS);
5761 		log = 1;
5762 		DPFPRINTF(PF_DEBUG_MISC,
5763 		    ("pf: dropping packet with ip options\n"));
5764 	}
5765 
5766 	if ((s && s->tag) || r->rtableid)
5767 		pf_tag_packet(m, s ? s->tag : 0, r->rtableid);
5768 
5769 #ifdef ALTQ
5770 	if (action == PF_PASS && r->qid) {
5771 		m->m_pkthdr.fw_flags |= PF_MBUF_STRUCTURE;
5772 		if (pqid || (pd.tos & IPTOS_LOWDELAY))
5773 			m->m_pkthdr.pf.qid = r->pqid;
5774 		else
5775 			m->m_pkthdr.pf.qid = r->qid;
5776 		m->m_pkthdr.pf.ecn_af = AF_INET;
5777 		m->m_pkthdr.pf.hdr = h;
5778 		/* add connection hash for fairq */
5779 		if (s) {
5780 			/* for fairq */
5781 			m->m_pkthdr.pf.state_hash = s->hash;
5782 			m->m_pkthdr.pf.flags |= PF_TAG_STATE_HASHED;
5783 		}
5784 	}
5785 #endif /* ALTQ */
5786 
5787 	/*
5788 	 * connections redirected to loopback should not match sockets
5789 	 * bound specifically to loopback due to security implications,
5790 	 * see tcp_input() and in_pcblookup_listen().
5791 	 */
5792 	if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP ||
5793 	    pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL &&
5794 	    (s->nat_rule.ptr->action == PF_RDR ||
5795 	    s->nat_rule.ptr->action == PF_BINAT) &&
5796 	    (ntohl(pd.dst->v4.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET)
5797 		m->m_pkthdr.pf.flags |= PF_TAG_TRANSLATE_LOCALHOST;
5798 
5799 	if (log) {
5800 		struct pf_rule *lr;
5801 
5802 		if (s != NULL && s->nat_rule.ptr != NULL &&
5803 		    s->nat_rule.ptr->log & PF_LOG_ALL)
5804 			lr = s->nat_rule.ptr;
5805 		else
5806 			lr = r;
5807 		PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, lr, a, ruleset,
5808 		    &pd);
5809 	}
5810 
5811 	kif->pfik_bytes[0][dir == PF_OUT][action != PF_PASS] += pd.tot_len;
5812 	kif->pfik_packets[0][dir == PF_OUT][action != PF_PASS]++;
5813 
5814 	if (action == PF_PASS || r->action == PF_DROP) {
5815 		dirndx = (dir == PF_OUT);
5816 		r->packets[dirndx]++;
5817 		r->bytes[dirndx] += pd.tot_len;
5818 		if (a != NULL) {
5819 			a->packets[dirndx]++;
5820 			a->bytes[dirndx] += pd.tot_len;
5821 		}
5822 		if (s != NULL) {
5823 			sk = s->state_key;
5824 			if (s->nat_rule.ptr != NULL) {
5825 				s->nat_rule.ptr->packets[dirndx]++;
5826 				s->nat_rule.ptr->bytes[dirndx] += pd.tot_len;
5827 			}
5828 			if (s->src_node != NULL) {
5829 				s->src_node->packets[dirndx]++;
5830 				s->src_node->bytes[dirndx] += pd.tot_len;
5831 			}
5832 			if (s->nat_src_node != NULL) {
5833 				s->nat_src_node->packets[dirndx]++;
5834 				s->nat_src_node->bytes[dirndx] += pd.tot_len;
5835 			}
5836 			dirndx = (dir == sk->direction) ? 0 : 1;
5837 			s->packets[dirndx]++;
5838 			s->bytes[dirndx] += pd.tot_len;
5839 		}
5840 		tr = r;
5841 		nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule;
5842 		if (nr != NULL) {
5843 			struct pf_addr *x;
5844 			/*
5845 			 * XXX: we need to make sure that the addresses
5846 			 * passed to pfr_update_stats() are the same than
5847 			 * the addresses used during matching (pfr_match)
5848 			 */
5849 			if (r == &pf_default_rule) {
5850 				tr = nr;
5851 				x = (sk == NULL || sk->direction == dir) ?
5852 				    &pd.baddr : &pd.naddr;
5853 			} else
5854 				x = (sk == NULL || sk->direction == dir) ?
5855 				    &pd.naddr : &pd.baddr;
5856 			if (x == &pd.baddr || s == NULL) {
5857 				/* we need to change the address */
5858 				if (dir == PF_OUT)
5859 					pd.src = x;
5860 				else
5861 					pd.dst = x;
5862 			}
5863 		}
5864 		if (tr->src.addr.type == PF_ADDR_TABLE)
5865 			pfr_update_stats(tr->src.addr.p.tbl, (sk == NULL ||
5866 			    sk->direction == dir) ?
5867 			    pd.src : pd.dst, pd.af,
5868 			    pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
5869 			    tr->src.neg);
5870 		if (tr->dst.addr.type == PF_ADDR_TABLE)
5871 			pfr_update_stats(tr->dst.addr.p.tbl, (sk == NULL ||
5872 			    sk->direction == dir) ? pd.dst : pd.src, pd.af,
5873 			    pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
5874 			    tr->dst.neg);
5875 	}
5876 
5877 
5878 	if (action == PF_SYNPROXY_DROP) {
5879 		m_freem(*m0);
5880 		*m0 = NULL;
5881 		action = PF_PASS;
5882 	} else if (r->rt)
5883 		/* pf_route can free the mbuf causing *m0 to become NULL */
5884 		pf_route(m0, r, dir, kif->pfik_ifp, s, &pd);
5885 
5886 	return (action);
5887 }
5888 #endif /* INET */
5889 
5890 #ifdef INET6
5891 int
5892 pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0,
5893     struct ether_header *eh, struct inpcb *inp)
5894 {
5895 	struct pfi_kif		*kif;
5896 	u_short			 action, reason = 0, log = 0;
5897 	struct mbuf		*m = *m0, *n = NULL;
5898 	struct ip6_hdr		*h = NULL;
5899 	struct pf_rule		*a = NULL, *r = &pf_default_rule, *tr, *nr;
5900 	struct pf_state		*s = NULL;
5901 	struct pf_state_key	*sk = NULL;
5902 	struct pf_ruleset	*ruleset = NULL;
5903 	struct pf_pdesc		 pd;
5904 	int			 off, terminal = 0, dirndx, rh_cnt = 0;
5905 
5906 	if (!pf_status.running)
5907 		return (PF_PASS);
5908 
5909 	memset(&pd, 0, sizeof(pd));
5910 	if (ifp->if_type == IFT_CARP && ifp->if_carpdev)
5911 		kif = (struct pfi_kif *)ifp->if_carpdev->if_pf_kif;
5912 	else
5913 		kif = (struct pfi_kif *)ifp->if_pf_kif;
5914 
5915 	if (kif == NULL) {
5916 		DPFPRINTF(PF_DEBUG_URGENT,
5917 		    ("pf_test6: kif == NULL, if_xname %s\n", ifp->if_xname));
5918 		return (PF_DROP);
5919 	}
5920 	if (kif->pfik_flags & PFI_IFLAG_SKIP)
5921 		return (PF_PASS);
5922 
5923 #ifdef DIAGNOSTIC
5924 	if ((m->m_flags & M_PKTHDR) == 0)
5925 		panic("non-M_PKTHDR is passed to pf_test6");
5926 #endif /* DIAGNOSTIC */
5927 
5928 	if (m->m_pkthdr.len < (int)sizeof(*h)) {
5929 		action = PF_DROP;
5930 		REASON_SET(&reason, PFRES_SHORT);
5931 		log = 1;
5932 		goto done;
5933 	}
5934 
5935 	if (m->m_pkthdr.pf.flags & PF_TAG_GENERATED)
5936 		return (PF_PASS);
5937 
5938 	/* We do IP header normalization and packet reassembly here */
5939 	if (pf_normalize_ip6(m0, dir, kif, &reason, &pd) != PF_PASS) {
5940 		action = PF_DROP;
5941 		goto done;
5942 	}
5943 	m = *m0;	/* pf_normalize messes with m0 */
5944 	h = mtod(m, struct ip6_hdr *);
5945 
5946 #if 1
5947 	/*
5948 	 * we do not support jumbogram yet.  if we keep going, zero ip6_plen
5949 	 * will do something bad, so drop the packet for now.
5950 	 */
5951 	if (htons(h->ip6_plen) == 0) {
5952 		action = PF_DROP;
5953 		REASON_SET(&reason, PFRES_NORM);	/*XXX*/
5954 		goto done;
5955 	}
5956 #endif
5957 
5958 	pd.src = (struct pf_addr *)&h->ip6_src;
5959 	pd.dst = (struct pf_addr *)&h->ip6_dst;
5960 	PF_ACPY(&pd.baddr, dir == PF_OUT ? pd.src : pd.dst, AF_INET6);
5961 	pd.ip_sum = NULL;
5962 	pd.af = AF_INET6;
5963 	pd.tos = 0;
5964 	pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
5965 	pd.eh = eh;
5966 
5967 	off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
5968 	pd.proto = h->ip6_nxt;
5969 	do {
5970 		switch (pd.proto) {
5971 		case IPPROTO_FRAGMENT:
5972 			action = pf_test_fragment(&r, dir, kif, m, h,
5973 			    &pd, &a, &ruleset);
5974 			if (action == PF_DROP)
5975 				REASON_SET(&reason, PFRES_FRAG);
5976 			goto done;
5977 		case IPPROTO_ROUTING: {
5978 			struct ip6_rthdr rthdr;
5979 
5980 			if (rh_cnt++) {
5981 				DPFPRINTF(PF_DEBUG_MISC,
5982 				    ("pf: IPv6 more than one rthdr\n"));
5983 				action = PF_DROP;
5984 				REASON_SET(&reason, PFRES_IPOPTIONS);
5985 				log = 1;
5986 				goto done;
5987 			}
5988 			if (!pf_pull_hdr(m, off, &rthdr, sizeof(rthdr), NULL,
5989 			    &reason, pd.af)) {
5990 				DPFPRINTF(PF_DEBUG_MISC,
5991 				    ("pf: IPv6 short rthdr\n"));
5992 				action = PF_DROP;
5993 				REASON_SET(&reason, PFRES_SHORT);
5994 				log = 1;
5995 				goto done;
5996 			}
5997 			if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
5998 				DPFPRINTF(PF_DEBUG_MISC,
5999 				    ("pf: IPv6 rthdr0\n"));
6000 				action = PF_DROP;
6001 				REASON_SET(&reason, PFRES_IPOPTIONS);
6002 				log = 1;
6003 				goto done;
6004 			}
6005 			/* FALLTHROUGH */
6006 		}
6007 		case IPPROTO_AH:
6008 		case IPPROTO_HOPOPTS:
6009 		case IPPROTO_DSTOPTS: {
6010 			/* get next header and header length */
6011 			struct ip6_ext	opt6;
6012 
6013 			if (!pf_pull_hdr(m, off, &opt6, sizeof(opt6),
6014 			    NULL, &reason, pd.af)) {
6015 				DPFPRINTF(PF_DEBUG_MISC,
6016 				    ("pf: IPv6 short opt\n"));
6017 				action = PF_DROP;
6018 				log = 1;
6019 				goto done;
6020 			}
6021 			if (pd.proto == IPPROTO_AH)
6022 				off += (opt6.ip6e_len + 2) * 4;
6023 			else
6024 				off += (opt6.ip6e_len + 1) * 8;
6025 			pd.proto = opt6.ip6e_nxt;
6026 			/* goto the next header */
6027 			break;
6028 		}
6029 		default:
6030 			terminal++;
6031 			break;
6032 		}
6033 	} while (!terminal);
6034 
6035 	/* if there's no routing header, use unmodified mbuf for checksumming */
6036 	if (!n)
6037 		n = m;
6038 
6039 	switch (pd.proto) {
6040 
6041 	case IPPROTO_TCP: {
6042 		struct tcphdr	th;
6043 
6044 		pd.hdr.tcp = &th;
6045 		if (!pf_pull_hdr(m, off, &th, sizeof(th),
6046 		    &action, &reason, AF_INET6)) {
6047 			log = action != PF_PASS;
6048 			goto done;
6049 		}
6050 		pd.p_len = pd.tot_len - off - (th.th_off << 2);
6051 		action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
6052 		if (action == PF_DROP)
6053 			goto done;
6054 		action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd,
6055 		    &reason);
6056 		if (action == PF_PASS) {
6057 #if NPFSYNC
6058 			pfsync_update_state(s);
6059 #endif /* NPFSYNC */
6060 			r = s->rule.ptr;
6061 			a = s->anchor.ptr;
6062 			log = s->log;
6063 		} else if (s == NULL)
6064 			action = pf_test_rule(&r, &s, dir, kif,
6065 			    m, off, h, &pd, &a, &ruleset, NULL, inp);
6066 		break;
6067 	}
6068 
6069 	case IPPROTO_UDP: {
6070 		struct udphdr	uh;
6071 
6072 		pd.hdr.udp = &uh;
6073 		if (!pf_pull_hdr(m, off, &uh, sizeof(uh),
6074 		    &action, &reason, AF_INET6)) {
6075 			log = action != PF_PASS;
6076 			goto done;
6077 		}
6078 		if (uh.uh_dport == 0 ||
6079 		    ntohs(uh.uh_ulen) > m->m_pkthdr.len - off ||
6080 		    ntohs(uh.uh_ulen) < sizeof(struct udphdr)) {
6081 			action = PF_DROP;
6082 			REASON_SET(&reason, PFRES_SHORT);
6083 			goto done;
6084 		}
6085 		action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd);
6086 		if (action == PF_PASS) {
6087 #if NPFSYNC
6088 			pfsync_update_state(s);
6089 #endif /* NPFSYNC */
6090 			r = s->rule.ptr;
6091 			a = s->anchor.ptr;
6092 			log = s->log;
6093 		} else if (s == NULL)
6094 			action = pf_test_rule(&r, &s, dir, kif,
6095 			    m, off, h, &pd, &a, &ruleset, NULL, inp);
6096 		break;
6097 	}
6098 
6099 	case IPPROTO_ICMPV6: {
6100 		struct icmp6_hdr	ih;
6101 
6102 		pd.hdr.icmp6 = &ih;
6103 		if (!pf_pull_hdr(m, off, &ih, sizeof(ih),
6104 		    &action, &reason, AF_INET6)) {
6105 			log = action != PF_PASS;
6106 			goto done;
6107 		}
6108 		action = pf_test_state_icmp(&s, dir, kif,
6109 		    m, off, h, &pd, &reason);
6110 		if (action == PF_PASS) {
6111 #if NPFSYNC
6112 			pfsync_update_state(s);
6113 #endif /* NPFSYNC */
6114 			r = s->rule.ptr;
6115 			a = s->anchor.ptr;
6116 			log = s->log;
6117 		} else if (s == NULL)
6118 			action = pf_test_rule(&r, &s, dir, kif,
6119 			    m, off, h, &pd, &a, &ruleset, NULL, inp);
6120 		break;
6121 	}
6122 
6123 	default:
6124 		action = pf_test_state_other(&s, dir, kif, &pd);
6125 		if (action == PF_PASS) {
6126 #if NPFSYNC
6127 			pfsync_update_state(s);
6128 #endif /* NPFSYNC */
6129 			r = s->rule.ptr;
6130 			a = s->anchor.ptr;
6131 			log = s->log;
6132 		} else if (s == NULL)
6133 			action = pf_test_rule(&r, &s, dir, kif, m, off, h,
6134 			    &pd, &a, &ruleset, NULL, inp);
6135 		break;
6136 	}
6137 
6138 done:
6139 	if (n != m) {
6140 		m_freem(n);
6141 		n = NULL;
6142 	}
6143 
6144 	/* handle dangerous IPv6 extension headers. */
6145 	if (action == PF_PASS && rh_cnt &&
6146 	    !((s && s->allow_opts) || r->allow_opts)) {
6147 		action = PF_DROP;
6148 		REASON_SET(&reason, PFRES_IPOPTIONS);
6149 		log = 1;
6150 		DPFPRINTF(PF_DEBUG_MISC,
6151 		    ("pf: dropping packet with dangerous v6 headers\n"));
6152 	}
6153 
6154 	if ((s && s->tag) || r->rtableid)
6155 		pf_tag_packet(m, s ? s->tag : 0, r->rtableid);
6156 
6157 #ifdef ALTQ
6158 	if (action == PF_PASS && r->qid) {
6159 		m->m_pkthdr.fw_flags |= PF_MBUF_STRUCTURE;
6160 		if (pd.tos & IPTOS_LOWDELAY)
6161 			m->m_pkthdr.pf.qid = r->pqid;
6162 		else
6163 			m->m_pkthdr.pf.qid = r->qid;
6164 		m->m_pkthdr.pf.ecn_af = AF_INET6;
6165 		m->m_pkthdr.pf.hdr = h;
6166 		if (s) {
6167 			/* for fairq */
6168 			m->m_pkthdr.pf.state_hash = s->hash;
6169 			m->m_pkthdr.pf.flags |= PF_TAG_STATE_HASHED;
6170 		}
6171 	}
6172 #endif /* ALTQ */
6173 
6174 	if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP ||
6175 	    pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL &&
6176 	    (s->nat_rule.ptr->action == PF_RDR ||
6177 	    s->nat_rule.ptr->action == PF_BINAT) &&
6178 	    IN6_IS_ADDR_LOOPBACK(&pd.dst->v6))
6179 		m->m_pkthdr.pf.flags |= PF_TAG_TRANSLATE_LOCALHOST;
6180 
6181 	if (log) {
6182 		struct pf_rule *lr;
6183 
6184 		if (s != NULL && s->nat_rule.ptr != NULL &&
6185 		    s->nat_rule.ptr->log & PF_LOG_ALL)
6186 			lr = s->nat_rule.ptr;
6187 		else
6188 			lr = r;
6189 		PFLOG_PACKET(kif, h, m, AF_INET6, dir, reason, lr, a, ruleset,
6190 		    &pd);
6191 	}
6192 
6193 	kif->pfik_bytes[1][dir == PF_OUT][action != PF_PASS] += pd.tot_len;
6194 	kif->pfik_packets[1][dir == PF_OUT][action != PF_PASS]++;
6195 
6196 	if (action == PF_PASS || r->action == PF_DROP) {
6197 		dirndx = (dir == PF_OUT);
6198 		r->packets[dirndx]++;
6199 		r->bytes[dirndx] += pd.tot_len;
6200 		if (a != NULL) {
6201 			a->packets[dirndx]++;
6202 			a->bytes[dirndx] += pd.tot_len;
6203 		}
6204 		if (s != NULL) {
6205 			sk = s->state_key;
6206 			if (s->nat_rule.ptr != NULL) {
6207 				s->nat_rule.ptr->packets[dirndx]++;
6208 				s->nat_rule.ptr->bytes[dirndx] += pd.tot_len;
6209 			}
6210 			if (s->src_node != NULL) {
6211 				s->src_node->packets[dirndx]++;
6212 				s->src_node->bytes[dirndx] += pd.tot_len;
6213 			}
6214 			if (s->nat_src_node != NULL) {
6215 				s->nat_src_node->packets[dirndx]++;
6216 				s->nat_src_node->bytes[dirndx] += pd.tot_len;
6217 			}
6218 			dirndx = (dir == sk->direction) ? 0 : 1;
6219 			s->packets[dirndx]++;
6220 			s->bytes[dirndx] += pd.tot_len;
6221 		}
6222 		tr = r;
6223 		nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule;
6224 		if (nr != NULL) {
6225 			struct pf_addr *x;
6226 			/*
6227 			 * XXX: we need to make sure that the addresses
6228 			 * passed to pfr_update_stats() are the same than
6229 			 * the addresses used during matching (pfr_match)
6230 			 */
6231 			if (r == &pf_default_rule) {
6232 				tr = nr;
6233 				x = (s == NULL || sk->direction == dir) ?
6234 				    &pd.baddr : &pd.naddr;
6235 			} else {
6236 				x = (s == NULL || sk->direction == dir) ?
6237 				    &pd.naddr : &pd.baddr;
6238 			}
6239 			if (x == &pd.baddr || s == NULL) {
6240 				if (dir == PF_OUT)
6241 					pd.src = x;
6242 				else
6243 					pd.dst = x;
6244 			}
6245 		}
6246 		if (tr->src.addr.type == PF_ADDR_TABLE)
6247 			pfr_update_stats(tr->src.addr.p.tbl, (sk == NULL ||
6248 			    sk->direction == dir) ? pd.src : pd.dst, pd.af,
6249 			    pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
6250 			    tr->src.neg);
6251 		if (tr->dst.addr.type == PF_ADDR_TABLE)
6252 			pfr_update_stats(tr->dst.addr.p.tbl, (sk == NULL ||
6253 			    sk->direction == dir) ? pd.dst : pd.src, pd.af,
6254 			    pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
6255 			    tr->dst.neg);
6256 	}
6257 
6258 
6259 	if (action == PF_SYNPROXY_DROP) {
6260 		m_freem(*m0);
6261 		*m0 = NULL;
6262 		action = PF_PASS;
6263 	} else if (r->rt)
6264 		/* pf_route6 can free the mbuf causing *m0 to become NULL */
6265 		pf_route6(m0, r, dir, kif->pfik_ifp, s, &pd);
6266 
6267 	return (action);
6268 }
6269 #endif /* INET6 */
6270 
6271 int
6272 pf_check_congestion(struct ifqueue *ifq)
6273 {
6274 		return (0);
6275 }
6276