1 /* 2 * Copyright (c) 2004 The DragonFly Project. All rights reserved. 3 * 4 * Copyright (c) 1982, 1986, 1991, 1993 5 * The Regents of the University of California. All rights reserved. 6 * (c) UNIX System Laboratories, Inc. 7 * All or some portions of this file are derived from material licensed 8 * to the University of California by American Telephone and Telegraph 9 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 10 * the permission of UNIX System Laboratories, Inc. 11 * 12 * Redistribution and use in source and binary forms, with or without 13 * modification, are permitted provided that the following conditions 14 * are met: 15 * 1. Redistributions of source code must retain the above copyright 16 * notice, this list of conditions and the following disclaimer. 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 3. Neither the name of the University nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * 36 * @(#)kern_subr.c 8.3 (Berkeley) 1/21/94 37 */ 38 39 #include <sys/param.h> 40 #include <sys/systm.h> 41 #include <sys/socket.h> 42 #include <sys/socketvar.h> 43 #include <sys/proc.h> 44 #include <sys/malloc.h> 45 #include <sys/queue.h> 46 #include <sys/kernel.h> 47 #include <sys/resourcevar.h> 48 49 #include <net/if.h> 50 51 #include <netinet/in.h> 52 #include <netinet/in_var.h> 53 #include <netinet/tcp.h> 54 55 #include <net/pf/pfvar.h> 56 #include <sys/md5.h> 57 #include <sys/random.h> 58 59 /* 60 * This implements additional functions used by pf which can not be ported 61 * easyly. At this point it boils down to mostly the Net/OpenBSD hook 62 * implementation. 63 * 64 * BEWARE: this is not locked! Required locking is done by the caller. 65 */ 66 67 void * 68 hook_establish(struct hook_desc_head *head, int tail, void (*fn)(void *), 69 void *arg) 70 { 71 struct hook_desc *hdp; 72 73 hdp = kmalloc(sizeof (*hdp), M_DEVBUF, M_WAITOK); 74 if (hdp == NULL) 75 return (NULL); 76 77 hdp->hd_fn = fn; 78 hdp->hd_arg = arg; 79 if (tail) 80 TAILQ_INSERT_TAIL(head, hdp, hd_list); 81 else 82 TAILQ_INSERT_HEAD(head, hdp, hd_list); 83 84 return (hdp); 85 } 86 87 void 88 hook_disestablish(struct hook_desc_head *head, void *vhook) 89 { 90 struct hook_desc *hdp; 91 92 #ifdef DIAGNOSTIC 93 for (hdp = TAILQ_FIRST(head); hdp != NULL; 94 hdp = TAILQ_NEXT(hdp, hd_list)) 95 if (hdp == vhook) 96 break; 97 if (hdp == NULL) 98 panic("hook_disestablish: hook not established"); 99 #endif 100 hdp = vhook; 101 TAILQ_REMOVE(head, hdp, hd_list); 102 kfree(hdp, M_DEVBUF); 103 } 104 105 /* 106 * Run hooks. Startup hooks are invoked right after scheduler_start but 107 * before root is mounted. Shutdown hooks are invoked immediately before the 108 * system is halted or rebooted, i.e. after file systems unmounted, 109 * after crash dump done, etc. 110 */ 111 void 112 dohooks(struct hook_desc_head *head, int flags) 113 { 114 struct hook_desc *hdp; 115 116 if ((flags & HOOK_REMOVE) == 0) { 117 TAILQ_FOREACH(hdp, head, hd_list) { 118 (*hdp->hd_fn)(hdp->hd_arg); 119 } 120 } else { 121 while ((hdp = TAILQ_FIRST(head)) != NULL) { 122 TAILQ_REMOVE(head, hdp, hd_list); 123 (*hdp->hd_fn)(hdp->hd_arg); 124 if ((flags & HOOK_FREE) != 0) 125 kfree(hdp, M_DEVBUF); 126 } 127 } 128 } 129 130 131 /* 132 * Following is where TCP initial sequence number generation occurs. 133 * 134 * There are two places where we must use initial sequence numbers: 135 * 1. In SYN-ACK packets. 136 * 2. In SYN packets. 137 * 138 * All ISNs for SYN-ACK packets are generated by the syncache. See 139 * tcp_syncache.c for details. 140 * 141 * The ISNs in SYN packets must be monotonic; TIME_WAIT recycling 142 * depends on this property. In addition, these ISNs should be 143 * unguessable so as to prevent connection hijacking. To satisfy 144 * the requirements of this situation, the algorithm outlined in 145 * RFC 1948 is used, with only small modifications. 146 * 147 * Implementation details: 148 * 149 * Time is based off the system timer, and is corrected so that it 150 * increases by one megabyte per second. This allows for proper 151 * recycling on high speed LANs while still leaving over an hour 152 * before rollover. 153 * 154 * As reading the *exact* system time is too expensive to be done 155 * whenever setting up a TCP connection, we increment the time 156 * offset in two ways. First, a small random positive increment 157 * is added to isn_offset for each connection that is set up. 158 * Second, the function tcp_isn_tick fires once per clock tick 159 * and increments isn_offset as necessary so that sequence numbers 160 * are incremented at approximately ISN_BYTES_PER_SECOND. The 161 * random positive increments serve only to ensure that the same 162 * exact sequence number is never sent out twice (as could otherwise 163 * happen when a port is recycled in less than the system tick 164 * interval.) 165 * 166 * net.inet.tcp.isn_reseed_interval controls the number of seconds 167 * between seeding of isn_secret. This is normally set to zero, 168 * as reseeding should not be necessary. 169 * 170 * Locking of the global variables isn_secret, isn_last_reseed, isn_offset, 171 * isn_offset_old, and isn_ctx is performed using the TCP pcbinfo lock. In 172 * general, this means holding an exclusive (write) lock. 173 */ 174 175 #define ISN_BYTES_PER_SECOND 1048576 176 #define ISN_STATIC_INCREMENT 4096 177 #define ISN_RANDOM_INCREMENT (4096 - 1) 178