1 /* $NetBSD: pf.c,v 1.42 2007/12/11 11:08:20 lukem Exp $ */ 2 /* $OpenBSD: pf.c,v 1.487 2005/04/22 09:53:18 dhartmei Exp $ */ 3 4 /* 5 * Copyright (c) 2001 Daniel Hartmeier 6 * Copyright (c) 2002,2003 Henning Brauer 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * - Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * - Redistributions in binary form must reproduce the above 16 * copyright notice, this list of conditions and the following 17 * disclaimer in the documentation and/or other materials provided 18 * with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 * POSSIBILITY OF SUCH DAMAGE. 32 * 33 * Effort sponsored in part by the Defense Advanced Research Projects 34 * Agency (DARPA) and Air Force Research Laboratory, Air Force 35 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 36 * 37 */ 38 39 #include <sys/cdefs.h> 40 __KERNEL_RCSID(0, "$NetBSD: pf.c,v 1.42 2007/12/11 11:08:20 lukem Exp $"); 41 42 #include "bpfilter.h" 43 #include "pflog.h" 44 #ifdef __OpenBSD__ 45 #include "pfsync.h" 46 #else 47 #define NPFSYNC 0 48 #endif 49 50 #include <sys/param.h> 51 #include <sys/systm.h> 52 #include <sys/mbuf.h> 53 #include <sys/filio.h> 54 #include <sys/socket.h> 55 #include <sys/socketvar.h> 56 #include <sys/kernel.h> 57 #include <sys/time.h> 58 #include <sys/pool.h> 59 #ifdef __NetBSD__ 60 #include <sys/endian.h> 61 #endif 62 63 #include <net/if.h> 64 #include <net/if_types.h> 65 #include <net/bpf.h> 66 #include <net/route.h> 67 68 #include <netinet/in.h> 69 #include <netinet/in_offload.h> 70 #include <netinet/in_var.h> 71 #include <netinet/in_systm.h> 72 #include <netinet/ip.h> 73 #include <netinet/ip_var.h> 74 #include <netinet/tcp.h> 75 #include <netinet/tcp_seq.h> 76 #include <netinet/udp.h> 77 #include <netinet/ip_icmp.h> 78 #include <netinet/in_pcb.h> 79 #include <netinet/tcp_timer.h> 80 #include <netinet/tcp_var.h> 81 #include <netinet/udp_var.h> 82 #include <netinet/icmp_var.h> 83 #ifdef __OpenBSD__ 84 #include <netinet/if_ether.h> 85 #else 86 #include <net/if_ether.h> 87 #endif 88 89 #ifdef __OpenBSD__ 90 #include <dev/rndvar.h> 91 #else 92 #include <sys/rnd.h> 93 #endif 94 #include <net/pfvar.h> 95 #include <net/if_pflog.h> 96 97 #if NPFSYNC > 0 98 #include <net/if_pfsync.h> 99 #endif /* NPFSYNC > 0 */ 100 101 #ifdef INET6 102 #include <netinet/ip6.h> 103 #include <netinet6/ip6_var.h> 104 #ifdef __NetBSD__ 105 #include <netinet6/in6_pcb.h> 106 #endif 107 #include <netinet/icmp6.h> 108 #include <netinet6/nd6.h> 109 #endif /* INET6 */ 110 111 112 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x 113 114 /* 115 * Global variables 116 */ 117 118 struct pf_anchor_global pf_anchors; 119 struct pf_ruleset pf_main_ruleset; 120 struct pf_altqqueue pf_altqs[2]; 121 struct pf_palist pf_pabuf; 122 struct pf_altqqueue *pf_altqs_active; 123 struct pf_altqqueue *pf_altqs_inactive; 124 struct pf_status pf_status; 125 126 u_int32_t ticket_altqs_active; 127 u_int32_t ticket_altqs_inactive; 128 int altqs_inactive_open; 129 u_int32_t ticket_pabuf; 130 131 #ifdef __OpenBSD__ 132 struct timeout pf_expire_to; /* expire timeout */ 133 #else 134 struct callout pf_expire_to; /* expire timeout */ 135 #endif 136 137 struct pf_anchor_stackframe { 138 struct pf_ruleset *rs; 139 struct pf_rule *r; 140 struct pf_anchor_node *parent; 141 struct pf_anchor *child; 142 } pf_anchor_stack[64]; 143 144 struct pool pf_src_tree_pl, pf_rule_pl; 145 struct pool pf_state_pl, pf_altq_pl, pf_pooladdr_pl; 146 147 void pf_print_host(struct pf_addr *, u_int16_t, u_int8_t); 148 149 void pf_init_threshold(struct pf_threshold *, u_int32_t, 150 u_int32_t); 151 void pf_add_threshold(struct pf_threshold *); 152 int pf_check_threshold(struct pf_threshold *); 153 154 void pf_change_ap(struct pf_addr *, u_int16_t *, 155 u_int16_t *, u_int16_t *, struct pf_addr *, 156 u_int16_t, u_int8_t, sa_family_t); 157 #ifdef INET6 158 void pf_change_a6(struct pf_addr *, u_int16_t *, 159 struct pf_addr *, u_int8_t); 160 #endif /* INET6 */ 161 void pf_change_icmp(struct pf_addr *, u_int16_t *, 162 struct pf_addr *, struct pf_addr *, u_int16_t, 163 u_int16_t *, u_int16_t *, u_int16_t *, 164 u_int16_t *, u_int8_t, sa_family_t); 165 void pf_send_tcp(const struct pf_rule *, sa_family_t, 166 const struct pf_addr *, const struct pf_addr *, 167 u_int16_t, u_int16_t, u_int32_t, u_int32_t, 168 u_int8_t, u_int16_t, u_int16_t, u_int8_t, int, 169 u_int16_t, struct ether_header *, struct ifnet *); 170 void pf_send_icmp(struct mbuf *, u_int8_t, u_int8_t, 171 sa_family_t, struct pf_rule *); 172 struct pf_rule *pf_match_translation(struct pf_pdesc *, struct mbuf *, 173 int, int, struct pfi_kif *, 174 struct pf_addr *, u_int16_t, struct pf_addr *, 175 u_int16_t, int); 176 struct pf_rule *pf_get_translation(struct pf_pdesc *, struct mbuf *, 177 int, int, struct pfi_kif *, struct pf_src_node **, 178 struct pf_addr *, u_int16_t, 179 struct pf_addr *, u_int16_t, 180 struct pf_addr *, u_int16_t *); 181 int pf_test_tcp(struct pf_rule **, struct pf_state **, 182 int, struct pfi_kif *, struct mbuf *, int, 183 void *, struct pf_pdesc *, struct pf_rule **, 184 struct pf_ruleset **, struct ifqueue *); 185 int pf_test_udp(struct pf_rule **, struct pf_state **, 186 int, struct pfi_kif *, struct mbuf *, int, 187 void *, struct pf_pdesc *, struct pf_rule **, 188 struct pf_ruleset **, struct ifqueue *); 189 int pf_test_icmp(struct pf_rule **, struct pf_state **, 190 int, struct pfi_kif *, struct mbuf *, int, 191 void *, struct pf_pdesc *, struct pf_rule **, 192 struct pf_ruleset **, struct ifqueue *); 193 int pf_test_other(struct pf_rule **, struct pf_state **, 194 int, struct pfi_kif *, struct mbuf *, int, void *, 195 struct pf_pdesc *, struct pf_rule **, 196 struct pf_ruleset **, struct ifqueue *); 197 int pf_test_fragment(struct pf_rule **, int, 198 struct pfi_kif *, struct mbuf *, void *, 199 struct pf_pdesc *, struct pf_rule **, 200 struct pf_ruleset **); 201 int pf_test_state_tcp(struct pf_state **, int, 202 struct pfi_kif *, struct mbuf *, int, 203 void *, struct pf_pdesc *, u_short *); 204 int pf_test_state_udp(struct pf_state **, int, 205 struct pfi_kif *, struct mbuf *, int, 206 void *, struct pf_pdesc *); 207 int pf_test_state_icmp(struct pf_state **, int, 208 struct pfi_kif *, struct mbuf *, int, 209 void *, struct pf_pdesc *, u_short *); 210 int pf_test_state_other(struct pf_state **, int, 211 struct pfi_kif *, struct pf_pdesc *); 212 struct pf_tag *pf_get_tag(struct mbuf *); 213 int pf_match_tag(struct mbuf *, struct pf_rule *, 214 struct pf_tag **, int *); 215 void pf_hash(const struct pf_addr *, struct pf_addr *, 216 struct pf_poolhashkey *, sa_family_t); 217 int pf_map_addr(u_int8_t, struct pf_rule *, 218 const struct pf_addr *, struct pf_addr *, 219 struct pf_addr *, struct pf_src_node **); 220 int pf_get_sport(sa_family_t, u_int8_t, struct pf_rule *, 221 struct pf_addr *, struct pf_addr *, u_int16_t, 222 struct pf_addr *, u_int16_t*, u_int16_t, u_int16_t, 223 struct pf_src_node **); 224 void pf_route(struct mbuf **, struct pf_rule *, int, 225 struct ifnet *, struct pf_state *); 226 void pf_route6(struct mbuf **, struct pf_rule *, int, 227 struct ifnet *, struct pf_state *); 228 int pf_socket_lookup(uid_t *, gid_t *, 229 int, struct pf_pdesc *); 230 u_int8_t pf_get_wscale(struct mbuf *, int, u_int16_t, 231 sa_family_t); 232 u_int16_t pf_get_mss(struct mbuf *, int, u_int16_t, 233 sa_family_t); 234 u_int16_t pf_calc_mss(struct pf_addr *, sa_family_t, 235 u_int16_t); 236 void pf_set_rt_ifp(struct pf_state *, 237 struct pf_addr *); 238 int pf_check_proto_cksum(struct mbuf *, int, int, 239 u_int8_t, sa_family_t); 240 int pf_addr_wrap_neq(struct pf_addr_wrap *, 241 struct pf_addr_wrap *); 242 static int pf_add_mbuf_tag(struct mbuf *, u_int); 243 struct pf_state *pf_find_state_recurse(struct pfi_kif *, 244 struct pf_state *, u_int8_t); 245 int pf_src_connlimit(struct pf_state **); 246 int pf_check_congestion(struct ifqueue *); 247 248 struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX] = { 249 { &pf_state_pl, PFSTATE_HIWAT }, 250 { &pf_src_tree_pl, PFSNODE_HIWAT }, 251 { &pf_frent_pl, PFFRAG_FRENT_HIWAT } 252 }; 253 254 #define STATE_LOOKUP() \ 255 do { \ 256 if (direction == PF_IN) \ 257 *state = pf_find_state_recurse( \ 258 kif, &key, PF_EXT_GWY); \ 259 else \ 260 *state = pf_find_state_recurse( \ 261 kif, &key, PF_LAN_EXT); \ 262 if (*state == NULL || (*state)->timeout == PFTM_PURGE) \ 263 return (PF_DROP); \ 264 if (direction == PF_OUT && \ 265 (((*state)->rule.ptr->rt == PF_ROUTETO && \ 266 (*state)->rule.ptr->direction == PF_OUT) || \ 267 ((*state)->rule.ptr->rt == PF_REPLYTO && \ 268 (*state)->rule.ptr->direction == PF_IN)) && \ 269 (*state)->rt_kif != NULL && \ 270 (*state)->rt_kif != kif) \ 271 return (PF_PASS); \ 272 } while (0) 273 274 #define STATE_TRANSLATE(s) \ 275 (s)->lan.addr.addr32[0] != (s)->gwy.addr.addr32[0] || \ 276 ((s)->af == AF_INET6 && \ 277 ((s)->lan.addr.addr32[1] != (s)->gwy.addr.addr32[1] || \ 278 (s)->lan.addr.addr32[2] != (s)->gwy.addr.addr32[2] || \ 279 (s)->lan.addr.addr32[3] != (s)->gwy.addr.addr32[3])) || \ 280 (s)->lan.port != (s)->gwy.port 281 282 #define STATE_INC_COUNTERS(s) \ 283 do { \ 284 s->rule.ptr->states++; \ 285 if (s->anchor.ptr != NULL) \ 286 s->anchor.ptr->states++; \ 287 if (s->nat_rule.ptr != NULL) \ 288 s->nat_rule.ptr->states++; \ 289 } while (0) 290 291 #define STATE_DEC_COUNTERS(s) \ 292 do { \ 293 if (s->nat_rule.ptr != NULL) \ 294 s->nat_rule.ptr->states--; \ 295 if (s->anchor.ptr != NULL) \ 296 s->anchor.ptr->states--; \ 297 s->rule.ptr->states--; \ 298 } while (0) 299 300 static __inline int pf_src_compare(struct pf_src_node *, struct pf_src_node *); 301 static __inline int pf_state_compare_lan_ext(struct pf_state *, 302 struct pf_state *); 303 static __inline int pf_state_compare_ext_gwy(struct pf_state *, 304 struct pf_state *); 305 static __inline int pf_state_compare_id(struct pf_state *, 306 struct pf_state *); 307 static __inline int pf_anchor_compare(struct pf_anchor *, struct pf_anchor *); 308 309 struct pf_src_tree tree_src_tracking; 310 311 struct pf_state_tree_id tree_id; 312 struct pf_state_queue state_updates; 313 314 RB_GENERATE(pf_src_tree, pf_src_node, entry, pf_src_compare); 315 RB_GENERATE(pf_state_tree_lan_ext, pf_state, 316 u.s.entry_lan_ext, pf_state_compare_lan_ext); 317 RB_GENERATE(pf_state_tree_ext_gwy, pf_state, 318 u.s.entry_ext_gwy, pf_state_compare_ext_gwy); 319 RB_GENERATE(pf_state_tree_id, pf_state, 320 u.s.entry_id, pf_state_compare_id); 321 RB_GENERATE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare); 322 RB_GENERATE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare); 323 324 static inline struct pfi_kif * 325 bound_iface(const struct pf_rule *r, const struct pf_rule *nr, 326 struct pfi_kif *k) 327 { 328 uint32_t rule_flag; 329 330 rule_flag = r->rule_flag; 331 if (nr != NULL) 332 rule_flag |= nr->rule_flag; 333 334 if ((rule_flag & PFRULE_IFBOUND) != 0) 335 return k; 336 else if ((rule_flag & PFRULE_GRBOUND) != 0) 337 return k->pfik_parent; 338 else 339 return k->pfik_parent->pfik_parent; 340 } 341 342 static __inline int 343 pf_src_compare(struct pf_src_node *a, struct pf_src_node *b) 344 { 345 int diff; 346 347 if (a->rule.ptr > b->rule.ptr) 348 return (1); 349 if (a->rule.ptr < b->rule.ptr) 350 return (-1); 351 if ((diff = a->af - b->af) != 0) 352 return (diff); 353 switch (a->af) { 354 #ifdef INET 355 case AF_INET: 356 if (a->addr.addr32[0] > b->addr.addr32[0]) 357 return (1); 358 if (a->addr.addr32[0] < b->addr.addr32[0]) 359 return (-1); 360 break; 361 #endif /* INET */ 362 #ifdef INET6 363 case AF_INET6: 364 if (a->addr.addr32[3] > b->addr.addr32[3]) 365 return (1); 366 if (a->addr.addr32[3] < b->addr.addr32[3]) 367 return (-1); 368 if (a->addr.addr32[2] > b->addr.addr32[2]) 369 return (1); 370 if (a->addr.addr32[2] < b->addr.addr32[2]) 371 return (-1); 372 if (a->addr.addr32[1] > b->addr.addr32[1]) 373 return (1); 374 if (a->addr.addr32[1] < b->addr.addr32[1]) 375 return (-1); 376 if (a->addr.addr32[0] > b->addr.addr32[0]) 377 return (1); 378 if (a->addr.addr32[0] < b->addr.addr32[0]) 379 return (-1); 380 break; 381 #endif /* INET6 */ 382 } 383 return (0); 384 } 385 386 static __inline int 387 pf_state_compare_lan_ext(struct pf_state *a, struct pf_state *b) 388 { 389 int diff; 390 391 if ((diff = a->proto - b->proto) != 0) 392 return (diff); 393 if ((diff = a->af - b->af) != 0) 394 return (diff); 395 switch (a->af) { 396 #ifdef INET 397 case AF_INET: 398 if (a->lan.addr.addr32[0] > b->lan.addr.addr32[0]) 399 return (1); 400 if (a->lan.addr.addr32[0] < b->lan.addr.addr32[0]) 401 return (-1); 402 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0]) 403 return (1); 404 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0]) 405 return (-1); 406 break; 407 #endif /* INET */ 408 #ifdef INET6 409 case AF_INET6: 410 if (a->lan.addr.addr32[3] > b->lan.addr.addr32[3]) 411 return (1); 412 if (a->lan.addr.addr32[3] < b->lan.addr.addr32[3]) 413 return (-1); 414 if (a->ext.addr.addr32[3] > b->ext.addr.addr32[3]) 415 return (1); 416 if (a->ext.addr.addr32[3] < b->ext.addr.addr32[3]) 417 return (-1); 418 if (a->lan.addr.addr32[2] > b->lan.addr.addr32[2]) 419 return (1); 420 if (a->lan.addr.addr32[2] < b->lan.addr.addr32[2]) 421 return (-1); 422 if (a->ext.addr.addr32[2] > b->ext.addr.addr32[2]) 423 return (1); 424 if (a->ext.addr.addr32[2] < b->ext.addr.addr32[2]) 425 return (-1); 426 if (a->lan.addr.addr32[1] > b->lan.addr.addr32[1]) 427 return (1); 428 if (a->lan.addr.addr32[1] < b->lan.addr.addr32[1]) 429 return (-1); 430 if (a->ext.addr.addr32[1] > b->ext.addr.addr32[1]) 431 return (1); 432 if (a->ext.addr.addr32[1] < b->ext.addr.addr32[1]) 433 return (-1); 434 if (a->lan.addr.addr32[0] > b->lan.addr.addr32[0]) 435 return (1); 436 if (a->lan.addr.addr32[0] < b->lan.addr.addr32[0]) 437 return (-1); 438 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0]) 439 return (1); 440 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0]) 441 return (-1); 442 break; 443 #endif /* INET6 */ 444 } 445 446 if ((diff = a->lan.port - b->lan.port) != 0) 447 return (diff); 448 if ((diff = a->ext.port - b->ext.port) != 0) 449 return (diff); 450 451 return (0); 452 } 453 454 static __inline int 455 pf_state_compare_ext_gwy(struct pf_state *a, struct pf_state *b) 456 { 457 int diff; 458 459 if ((diff = a->proto - b->proto) != 0) 460 return (diff); 461 if ((diff = a->af - b->af) != 0) 462 return (diff); 463 switch (a->af) { 464 #ifdef INET 465 case AF_INET: 466 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0]) 467 return (1); 468 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0]) 469 return (-1); 470 if (a->gwy.addr.addr32[0] > b->gwy.addr.addr32[0]) 471 return (1); 472 if (a->gwy.addr.addr32[0] < b->gwy.addr.addr32[0]) 473 return (-1); 474 break; 475 #endif /* INET */ 476 #ifdef INET6 477 case AF_INET6: 478 if (a->ext.addr.addr32[3] > b->ext.addr.addr32[3]) 479 return (1); 480 if (a->ext.addr.addr32[3] < b->ext.addr.addr32[3]) 481 return (-1); 482 if (a->gwy.addr.addr32[3] > b->gwy.addr.addr32[3]) 483 return (1); 484 if (a->gwy.addr.addr32[3] < b->gwy.addr.addr32[3]) 485 return (-1); 486 if (a->ext.addr.addr32[2] > b->ext.addr.addr32[2]) 487 return (1); 488 if (a->ext.addr.addr32[2] < b->ext.addr.addr32[2]) 489 return (-1); 490 if (a->gwy.addr.addr32[2] > b->gwy.addr.addr32[2]) 491 return (1); 492 if (a->gwy.addr.addr32[2] < b->gwy.addr.addr32[2]) 493 return (-1); 494 if (a->ext.addr.addr32[1] > b->ext.addr.addr32[1]) 495 return (1); 496 if (a->ext.addr.addr32[1] < b->ext.addr.addr32[1]) 497 return (-1); 498 if (a->gwy.addr.addr32[1] > b->gwy.addr.addr32[1]) 499 return (1); 500 if (a->gwy.addr.addr32[1] < b->gwy.addr.addr32[1]) 501 return (-1); 502 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0]) 503 return (1); 504 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0]) 505 return (-1); 506 if (a->gwy.addr.addr32[0] > b->gwy.addr.addr32[0]) 507 return (1); 508 if (a->gwy.addr.addr32[0] < b->gwy.addr.addr32[0]) 509 return (-1); 510 break; 511 #endif /* INET6 */ 512 } 513 514 if ((diff = a->ext.port - b->ext.port) != 0) 515 return (diff); 516 if ((diff = a->gwy.port - b->gwy.port) != 0) 517 return (diff); 518 519 return (0); 520 } 521 522 static __inline int 523 pf_state_compare_id(struct pf_state *a, struct pf_state *b) 524 { 525 if (a->id > b->id) 526 return (1); 527 if (a->id < b->id) 528 return (-1); 529 if (a->creatorid > b->creatorid) 530 return (1); 531 if (a->creatorid < b->creatorid) 532 return (-1); 533 534 return (0); 535 } 536 537 static __inline int 538 pf_anchor_compare(struct pf_anchor *a, struct pf_anchor *b) 539 { 540 int c = strcmp(a->path, b->path); 541 542 return (c ? (c < 0 ? -1 : 1) : 0); 543 } 544 545 #ifdef INET6 546 void 547 pf_addrcpy(struct pf_addr *dst, const struct pf_addr *src, sa_family_t af) 548 { 549 switch (af) { 550 #ifdef INET 551 case AF_INET: 552 dst->addr32[0] = src->addr32[0]; 553 break; 554 #endif /* INET */ 555 case AF_INET6: 556 dst->addr32[0] = src->addr32[0]; 557 dst->addr32[1] = src->addr32[1]; 558 dst->addr32[2] = src->addr32[2]; 559 dst->addr32[3] = src->addr32[3]; 560 break; 561 } 562 } 563 #endif /* INET6 */ 564 565 struct pf_state * 566 pf_find_state_byid(struct pf_state *key) 567 { 568 pf_status.fcounters[FCNT_STATE_SEARCH]++; 569 return (RB_FIND(pf_state_tree_id, &tree_id, key)); 570 } 571 572 struct pf_state * 573 pf_find_state_recurse(struct pfi_kif *kif, struct pf_state *key, u_int8_t tree) 574 { 575 struct pf_state *s; 576 577 pf_status.fcounters[FCNT_STATE_SEARCH]++; 578 579 switch (tree) { 580 case PF_LAN_EXT: 581 for (; kif != NULL; kif = kif->pfik_parent) { 582 s = RB_FIND(pf_state_tree_lan_ext, 583 &kif->pfik_lan_ext, key); 584 if (s != NULL) 585 return (s); 586 } 587 return (NULL); 588 case PF_EXT_GWY: 589 for (; kif != NULL; kif = kif->pfik_parent) { 590 s = RB_FIND(pf_state_tree_ext_gwy, 591 &kif->pfik_ext_gwy, key); 592 if (s != NULL) 593 return (s); 594 } 595 return (NULL); 596 default: 597 panic("pf_find_state_recurse"); 598 } 599 } 600 601 struct pf_state * 602 pf_find_state_all(struct pf_state *key, u_int8_t tree, int *more) 603 { 604 struct pf_state *s, *ss = NULL; 605 struct pfi_kif *kif; 606 607 pf_status.fcounters[FCNT_STATE_SEARCH]++; 608 609 switch (tree) { 610 case PF_LAN_EXT: 611 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) { 612 s = RB_FIND(pf_state_tree_lan_ext, 613 &kif->pfik_lan_ext, key); 614 if (s == NULL) 615 continue; 616 if (more == NULL) 617 return (s); 618 ss = s; 619 (*more)++; 620 } 621 return (ss); 622 case PF_EXT_GWY: 623 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) { 624 s = RB_FIND(pf_state_tree_ext_gwy, 625 &kif->pfik_ext_gwy, key); 626 if (s == NULL) 627 continue; 628 if (more == NULL) 629 return (s); 630 ss = s; 631 (*more)++; 632 } 633 return (ss); 634 default: 635 panic("pf_find_state_all"); 636 } 637 } 638 639 void 640 pf_init_threshold(struct pf_threshold *threshold, 641 u_int32_t limit, u_int32_t seconds) 642 { 643 threshold->limit = limit * PF_THRESHOLD_MULT; 644 threshold->seconds = seconds; 645 threshold->count = 0; 646 threshold->last = time_second; 647 } 648 649 void 650 pf_add_threshold(struct pf_threshold *threshold) 651 { 652 u_int32_t t = time_second, diff = t - threshold->last; 653 654 if (diff >= threshold->seconds) 655 threshold->count = 0; 656 else 657 threshold->count -= threshold->count * diff / 658 threshold->seconds; 659 threshold->count += PF_THRESHOLD_MULT; 660 threshold->last = t; 661 } 662 663 int 664 pf_check_threshold(struct pf_threshold *threshold) 665 { 666 return (threshold->count > threshold->limit); 667 } 668 669 int 670 pf_src_connlimit(struct pf_state **state) 671 { 672 struct pf_state *s; 673 int bad = 0; 674 675 (*state)->src_node->conn++; 676 pf_add_threshold(&(*state)->src_node->conn_rate); 677 678 if ((*state)->rule.ptr->max_src_conn && 679 (*state)->rule.ptr->max_src_conn < 680 (*state)->src_node->conn) { 681 pf_status.lcounters[LCNT_SRCCONN]++; 682 bad++; 683 } 684 685 if ((*state)->rule.ptr->max_src_conn_rate.limit && 686 pf_check_threshold(&(*state)->src_node->conn_rate)) { 687 pf_status.lcounters[LCNT_SRCCONNRATE]++; 688 bad++; 689 } 690 691 if (!bad) 692 return (0); 693 694 if ((*state)->rule.ptr->overload_tbl) { 695 struct pfr_addr p; 696 u_int32_t killed = 0; 697 698 pf_status.lcounters[LCNT_OVERLOAD_TABLE]++; 699 if (pf_status.debug >= PF_DEBUG_MISC) { 700 printf("pf_src_connlimit: blocking address "); 701 pf_print_host(&(*state)->src_node->addr, 0, 702 (*state)->af); 703 } 704 705 bzero(&p, sizeof(p)); 706 p.pfra_af = (*state)->af; 707 switch ((*state)->af) { 708 #ifdef INET 709 case AF_INET: 710 p.pfra_net = 32; 711 p.pfra_ip4addr = (*state)->src_node->addr.v4; 712 break; 713 #endif /* INET */ 714 #ifdef INET6 715 case AF_INET6: 716 p.pfra_net = 128; 717 p.pfra_ip6addr = (*state)->src_node->addr.v6; 718 break; 719 #endif /* INET6 */ 720 } 721 722 pfr_insert_kentry((*state)->rule.ptr->overload_tbl, 723 &p, time_second); 724 725 /* kill existing states if that's required. */ 726 if ((*state)->rule.ptr->flush) { 727 pf_status.lcounters[LCNT_OVERLOAD_FLUSH]++; 728 729 RB_FOREACH(s, pf_state_tree_id, &tree_id) { 730 /* 731 * Kill states from this source. (Only those 732 * from the same rule if PF_FLUSH_GLOBAL is not 733 * set) 734 */ 735 if (s->af == (*state)->af && 736 (((*state)->direction == PF_OUT && 737 PF_AEQ(&(*state)->src_node->addr, 738 &s->lan.addr, s->af)) || 739 ((*state)->direction == PF_IN && 740 PF_AEQ(&(*state)->src_node->addr, 741 &s->ext.addr, s->af))) && 742 ((*state)->rule.ptr->flush & 743 PF_FLUSH_GLOBAL || 744 (*state)->rule.ptr == s->rule.ptr)) { 745 s->timeout = PFTM_PURGE; 746 s->src.state = s->dst.state = 747 TCPS_CLOSED; 748 killed++; 749 } 750 } 751 if (pf_status.debug >= PF_DEBUG_MISC) 752 printf(", %u states killed", killed); 753 } 754 if (pf_status.debug >= PF_DEBUG_MISC) 755 printf("\n"); 756 } 757 758 /* kill this state */ 759 (*state)->timeout = PFTM_PURGE; 760 (*state)->src.state = (*state)->dst.state = TCPS_CLOSED; 761 return (1); 762 } 763 764 int 765 pf_insert_src_node(struct pf_src_node **sn, struct pf_rule *rule, 766 struct pf_addr *src, sa_family_t af) 767 { 768 struct pf_src_node k; 769 770 if (*sn == NULL) { 771 k.af = af; 772 PF_ACPY(&k.addr, src, af); 773 if (rule->rule_flag & PFRULE_RULESRCTRACK || 774 rule->rpool.opts & PF_POOL_STICKYADDR) 775 k.rule.ptr = rule; 776 else 777 k.rule.ptr = NULL; 778 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++; 779 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k); 780 } 781 if (*sn == NULL) { 782 if (!rule->max_src_nodes || 783 rule->src_nodes < rule->max_src_nodes) 784 (*sn) = pool_get(&pf_src_tree_pl, PR_NOWAIT); 785 else 786 pf_status.lcounters[LCNT_SRCNODES]++; 787 if ((*sn) == NULL) 788 return (-1); 789 bzero(*sn, sizeof(struct pf_src_node)); 790 791 pf_init_threshold(&(*sn)->conn_rate, 792 rule->max_src_conn_rate.limit, 793 rule->max_src_conn_rate.seconds); 794 795 (*sn)->af = af; 796 if (rule->rule_flag & PFRULE_RULESRCTRACK || 797 rule->rpool.opts & PF_POOL_STICKYADDR) 798 (*sn)->rule.ptr = rule; 799 else 800 (*sn)->rule.ptr = NULL; 801 PF_ACPY(&(*sn)->addr, src, af); 802 if (RB_INSERT(pf_src_tree, 803 &tree_src_tracking, *sn) != NULL) { 804 if (pf_status.debug >= PF_DEBUG_MISC) { 805 printf("pf: src_tree insert failed: "); 806 pf_print_host(&(*sn)->addr, 0, af); 807 printf("\n"); 808 } 809 pool_put(&pf_src_tree_pl, *sn); 810 return (-1); 811 } 812 (*sn)->creation = time_second; 813 (*sn)->ruletype = rule->action; 814 if ((*sn)->rule.ptr != NULL) 815 (*sn)->rule.ptr->src_nodes++; 816 pf_status.scounters[SCNT_SRC_NODE_INSERT]++; 817 pf_status.src_nodes++; 818 } else { 819 if (rule->max_src_states && 820 (*sn)->states >= rule->max_src_states) { 821 pf_status.lcounters[LCNT_SRCSTATES]++; 822 return (-1); 823 } 824 } 825 return (0); 826 } 827 828 int 829 pf_insert_state(struct pfi_kif *kif, struct pf_state *state) 830 { 831 /* Thou MUST NOT insert multiple duplicate keys */ 832 state->u.s.kif = kif; 833 if (RB_INSERT(pf_state_tree_lan_ext, &kif->pfik_lan_ext, state)) { 834 if (pf_status.debug >= PF_DEBUG_MISC) { 835 printf("pf: state insert failed: tree_lan_ext"); 836 printf(" lan: "); 837 pf_print_host(&state->lan.addr, state->lan.port, 838 state->af); 839 printf(" gwy: "); 840 pf_print_host(&state->gwy.addr, state->gwy.port, 841 state->af); 842 printf(" ext: "); 843 pf_print_host(&state->ext.addr, state->ext.port, 844 state->af); 845 if (state->sync_flags & PFSTATE_FROMSYNC) 846 printf(" (from sync)"); 847 printf("\n"); 848 } 849 return (-1); 850 } 851 852 if (RB_INSERT(pf_state_tree_ext_gwy, &kif->pfik_ext_gwy, state)) { 853 if (pf_status.debug >= PF_DEBUG_MISC) { 854 printf("pf: state insert failed: tree_ext_gwy"); 855 printf(" lan: "); 856 pf_print_host(&state->lan.addr, state->lan.port, 857 state->af); 858 printf(" gwy: "); 859 pf_print_host(&state->gwy.addr, state->gwy.port, 860 state->af); 861 printf(" ext: "); 862 pf_print_host(&state->ext.addr, state->ext.port, 863 state->af); 864 if (state->sync_flags & PFSTATE_FROMSYNC) 865 printf(" (from sync)"); 866 printf("\n"); 867 } 868 RB_REMOVE(pf_state_tree_lan_ext, &kif->pfik_lan_ext, state); 869 return (-1); 870 } 871 872 if (state->id == 0 && state->creatorid == 0) { 873 state->id = htobe64(pf_status.stateid++); 874 state->creatorid = pf_status.hostid; 875 } 876 if (RB_INSERT(pf_state_tree_id, &tree_id, state) != NULL) { 877 if (pf_status.debug >= PF_DEBUG_MISC) { 878 #ifdef __OpenBSD__ 879 printf("pf: state insert failed: " 880 "id: %016llx creatorid: %08x", 881 betoh64(state->id), ntohl(state->creatorid)); 882 #else 883 printf("pf: state insert failed: " 884 "id: %016" PRIx64 " creatorid: %08x", 885 be64toh(state->id), ntohl(state->creatorid)); 886 #endif 887 if (state->sync_flags & PFSTATE_FROMSYNC) 888 printf(" (from sync)"); 889 printf("\n"); 890 } 891 RB_REMOVE(pf_state_tree_lan_ext, &kif->pfik_lan_ext, state); 892 RB_REMOVE(pf_state_tree_ext_gwy, &kif->pfik_ext_gwy, state); 893 return (-1); 894 } 895 TAILQ_INSERT_HEAD(&state_updates, state, u.s.entry_updates); 896 897 pf_status.fcounters[FCNT_STATE_INSERT]++; 898 pf_status.states++; 899 pfi_attach_state(kif); 900 #if NPFSYNC 901 pfsync_insert_state(state); 902 #endif 903 return (0); 904 } 905 906 void 907 pf_purge_timeout(void *arg) 908 { 909 #ifdef __OpenBSD__ 910 struct timeout *to = arg; 911 #else 912 struct callout *to = arg; 913 #endif 914 int s; 915 916 s = splsoftnet(); 917 pf_purge_expired_states(); 918 pf_purge_expired_fragments(); 919 pf_purge_expired_src_nodes(); 920 splx(s); 921 922 #ifdef __OpenBSD__ 923 timeout_add(to, pf_default_rule.timeout[PFTM_INTERVAL] * hz); 924 #else 925 callout_schedule(to, pf_default_rule.timeout[PFTM_INTERVAL] * hz); 926 #endif 927 } 928 929 u_int32_t 930 pf_state_expires(const struct pf_state *state) 931 { 932 u_int32_t timeout; 933 u_int32_t start; 934 u_int32_t end; 935 u_int32_t states; 936 937 /* handle all PFTM_* > PFTM_MAX here */ 938 if (state->timeout == PFTM_PURGE) 939 return (time_second); 940 if (state->timeout == PFTM_UNTIL_PACKET) 941 return (0); 942 KASSERT(state->timeout < PFTM_MAX); 943 timeout = state->rule.ptr->timeout[state->timeout]; 944 if (!timeout) 945 timeout = pf_default_rule.timeout[state->timeout]; 946 start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START]; 947 if (start) { 948 end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END]; 949 states = state->rule.ptr->states; 950 } else { 951 start = pf_default_rule.timeout[PFTM_ADAPTIVE_START]; 952 end = pf_default_rule.timeout[PFTM_ADAPTIVE_END]; 953 states = pf_status.states; 954 } 955 if (end && states > start && start < end) { 956 if (states < end) 957 return (state->expire + timeout * (end - states) / 958 (end - start)); 959 else 960 return (time_second); 961 } 962 return (state->expire + timeout); 963 } 964 965 void 966 pf_purge_expired_src_nodes(void) 967 { 968 struct pf_src_node *cur, *next; 969 970 for (cur = RB_MIN(pf_src_tree, &tree_src_tracking); cur; cur = next) { 971 next = RB_NEXT(pf_src_tree, &tree_src_tracking, cur); 972 973 if (cur->states <= 0 && cur->expire <= time_second) { 974 if (cur->rule.ptr != NULL) { 975 cur->rule.ptr->src_nodes--; 976 if (cur->rule.ptr->states <= 0 && 977 cur->rule.ptr->max_src_nodes <= 0) 978 pf_rm_rule(NULL, cur->rule.ptr); 979 } 980 RB_REMOVE(pf_src_tree, &tree_src_tracking, cur); 981 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 982 pf_status.src_nodes--; 983 pool_put(&pf_src_tree_pl, cur); 984 } 985 } 986 } 987 988 void 989 pf_src_tree_remove_state(struct pf_state *s) 990 { 991 u_int32_t timeout; 992 993 if (s->src_node != NULL) { 994 if (s->proto == IPPROTO_TCP) { 995 if (s->src.state == PF_TCPS_PROXY_DST || 996 s->timeout >= PFTM_TCP_ESTABLISHED) 997 --s->src_node->conn; 998 } 999 if (--s->src_node->states <= 0) { 1000 timeout = s->rule.ptr->timeout[PFTM_SRC_NODE]; 1001 if (!timeout) 1002 timeout = 1003 pf_default_rule.timeout[PFTM_SRC_NODE]; 1004 s->src_node->expire = time_second + timeout; 1005 } 1006 } 1007 if (s->nat_src_node != s->src_node && s->nat_src_node != NULL) { 1008 if (--s->nat_src_node->states <= 0) { 1009 timeout = s->rule.ptr->timeout[PFTM_SRC_NODE]; 1010 if (!timeout) 1011 timeout = 1012 pf_default_rule.timeout[PFTM_SRC_NODE]; 1013 s->nat_src_node->expire = time_second + timeout; 1014 } 1015 } 1016 s->src_node = s->nat_src_node = NULL; 1017 } 1018 1019 void 1020 pf_purge_expired_state(struct pf_state *cur) 1021 { 1022 if (cur->src.state == PF_TCPS_PROXY_DST) 1023 pf_send_tcp(cur->rule.ptr, cur->af, 1024 &cur->ext.addr, &cur->lan.addr, 1025 cur->ext.port, cur->lan.port, 1026 cur->src.seqhi, cur->src.seqlo + 1, 1027 TH_RST|TH_ACK, 0, 0, 0, 1, cur->tag, NULL, NULL); 1028 RB_REMOVE(pf_state_tree_ext_gwy, 1029 &cur->u.s.kif->pfik_ext_gwy, cur); 1030 RB_REMOVE(pf_state_tree_lan_ext, 1031 &cur->u.s.kif->pfik_lan_ext, cur); 1032 RB_REMOVE(pf_state_tree_id, &tree_id, cur); 1033 #if NPFSYNC 1034 pfsync_delete_state(cur); 1035 #endif 1036 pf_src_tree_remove_state(cur); 1037 if (--cur->rule.ptr->states <= 0 && 1038 cur->rule.ptr->src_nodes <= 0) 1039 pf_rm_rule(NULL, cur->rule.ptr); 1040 if (cur->nat_rule.ptr != NULL) 1041 if (--cur->nat_rule.ptr->states <= 0 && 1042 cur->nat_rule.ptr->src_nodes <= 0) 1043 pf_rm_rule(NULL, cur->nat_rule.ptr); 1044 if (cur->anchor.ptr != NULL) 1045 if (--cur->anchor.ptr->states <= 0) 1046 pf_rm_rule(NULL, cur->anchor.ptr); 1047 pf_normalize_tcp_cleanup(cur); 1048 pfi_detach_state(cur->u.s.kif); 1049 TAILQ_REMOVE(&state_updates, cur, u.s.entry_updates); 1050 if (cur->tag) 1051 pf_tag_unref(cur->tag); 1052 pool_put(&pf_state_pl, cur); 1053 pf_status.fcounters[FCNT_STATE_REMOVALS]++; 1054 pf_status.states--; 1055 } 1056 1057 void 1058 pf_purge_expired_states(void) 1059 { 1060 struct pf_state *cur, *next; 1061 1062 for (cur = RB_MIN(pf_state_tree_id, &tree_id); 1063 cur; cur = next) { 1064 next = RB_NEXT(pf_state_tree_id, &tree_id, cur); 1065 if (pf_state_expires(cur) <= time_second) 1066 pf_purge_expired_state(cur); 1067 } 1068 } 1069 1070 int 1071 pf_tbladdr_setup(struct pf_ruleset *rs, struct pf_addr_wrap *aw) 1072 { 1073 if (aw->type != PF_ADDR_TABLE) 1074 return (0); 1075 if ((aw->p.tbl = pfr_attach_table(rs, aw->v.tblname)) == NULL) 1076 return (1); 1077 return (0); 1078 } 1079 1080 void 1081 pf_tbladdr_remove(struct pf_addr_wrap *aw) 1082 { 1083 if (aw->type != PF_ADDR_TABLE || aw->p.tbl == NULL) 1084 return; 1085 pfr_detach_table(aw->p.tbl); 1086 aw->p.tbl = NULL; 1087 } 1088 1089 void 1090 pf_tbladdr_copyout(struct pf_addr_wrap *aw) 1091 { 1092 struct pfr_ktable *kt = aw->p.tbl; 1093 1094 if (aw->type != PF_ADDR_TABLE || kt == NULL) 1095 return; 1096 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 1097 kt = kt->pfrkt_root; 1098 aw->p.tbl = NULL; 1099 aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ? 1100 kt->pfrkt_cnt : -1; 1101 } 1102 1103 void 1104 pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af) 1105 { 1106 switch (af) { 1107 #ifdef INET 1108 case AF_INET: { 1109 u_int32_t a = ntohl(addr->addr32[0]); 1110 printf("%u.%u.%u.%u", (a>>24)&255, (a>>16)&255, 1111 (a>>8)&255, a&255); 1112 if (p) { 1113 p = ntohs(p); 1114 printf(":%u", p); 1115 } 1116 break; 1117 } 1118 #endif /* INET */ 1119 #ifdef INET6 1120 case AF_INET6: { 1121 u_int16_t b; 1122 u_int8_t i, curstart = 255, curend = 0, 1123 maxstart = 255, maxend = 255; 1124 for (i = 0; i < 8; i++) { 1125 if (!addr->addr16[i]) { 1126 if (curstart == 255) 1127 curstart = i; 1128 else 1129 curend = i; 1130 } else { 1131 if (curstart != 255) { 1132 if ((curend - curstart) > 1133 (maxend - maxstart)) { 1134 maxstart = curstart; 1135 maxend = curend; 1136 } 1137 curstart = 255; 1138 } 1139 } 1140 } 1141 for (i = 0; i < 8; i++) { 1142 if (i >= maxstart && i <= maxend) { 1143 if (maxstart == 0) { 1144 if (i < 2) 1145 printf(":"); 1146 } else if (maxend != 7) { 1147 if (i == maxstart) 1148 printf(":"); 1149 } else { 1150 if (i == maxend) 1151 printf(":"); 1152 } 1153 } else { 1154 b = ntohs(addr->addr16[i]); 1155 printf("%x", b); 1156 if (i < 7) 1157 printf(":"); 1158 } 1159 } 1160 if (p) { 1161 p = ntohs(p); 1162 printf("[%u]", p); 1163 } 1164 break; 1165 } 1166 #endif /* INET6 */ 1167 } 1168 } 1169 1170 void 1171 pf_print_state(struct pf_state *s) 1172 { 1173 switch (s->proto) { 1174 case IPPROTO_TCP: 1175 printf("TCP "); 1176 break; 1177 case IPPROTO_UDP: 1178 printf("UDP "); 1179 break; 1180 case IPPROTO_ICMP: 1181 printf("ICMP "); 1182 break; 1183 case IPPROTO_ICMPV6: 1184 printf("ICMPV6 "); 1185 break; 1186 default: 1187 printf("%u ", s->proto); 1188 break; 1189 } 1190 pf_print_host(&s->lan.addr, s->lan.port, s->af); 1191 printf(" "); 1192 pf_print_host(&s->gwy.addr, s->gwy.port, s->af); 1193 printf(" "); 1194 pf_print_host(&s->ext.addr, s->ext.port, s->af); 1195 printf(" [lo=%u high=%u win=%u modulator=%u", s->src.seqlo, 1196 s->src.seqhi, s->src.max_win, s->src.seqdiff); 1197 if (s->src.wscale && s->dst.wscale) 1198 printf(" wscale=%u", s->src.wscale & PF_WSCALE_MASK); 1199 printf("]"); 1200 printf(" [lo=%u high=%u win=%u modulator=%u", s->dst.seqlo, 1201 s->dst.seqhi, s->dst.max_win, s->dst.seqdiff); 1202 if (s->src.wscale && s->dst.wscale) 1203 printf(" wscale=%u", s->dst.wscale & PF_WSCALE_MASK); 1204 printf("]"); 1205 printf(" %u:%u", s->src.state, s->dst.state); 1206 } 1207 1208 void 1209 pf_print_flags(u_int8_t f) 1210 { 1211 if (f) 1212 printf(" "); 1213 if (f & TH_FIN) 1214 printf("F"); 1215 if (f & TH_SYN) 1216 printf("S"); 1217 if (f & TH_RST) 1218 printf("R"); 1219 if (f & TH_PUSH) 1220 printf("P"); 1221 if (f & TH_ACK) 1222 printf("A"); 1223 if (f & TH_URG) 1224 printf("U"); 1225 if (f & TH_ECE) 1226 printf("E"); 1227 if (f & TH_CWR) 1228 printf("W"); 1229 } 1230 1231 #define PF_SET_SKIP_STEPS(i) \ 1232 do { \ 1233 while (head[i] != cur) { \ 1234 head[i]->skip[i].ptr = cur; \ 1235 head[i] = TAILQ_NEXT(head[i], entries); \ 1236 } \ 1237 } while (0) 1238 1239 void 1240 pf_calc_skip_steps(struct pf_rulequeue *rules) 1241 { 1242 struct pf_rule *cur, *prev, *head[PF_SKIP_COUNT]; 1243 int i; 1244 1245 cur = TAILQ_FIRST(rules); 1246 prev = cur; 1247 for (i = 0; i < PF_SKIP_COUNT; ++i) 1248 head[i] = cur; 1249 while (cur != NULL) { 1250 1251 if (cur->kif != prev->kif || cur->ifnot != prev->ifnot) 1252 PF_SET_SKIP_STEPS(PF_SKIP_IFP); 1253 if (cur->direction != prev->direction) 1254 PF_SET_SKIP_STEPS(PF_SKIP_DIR); 1255 if (cur->af != prev->af) 1256 PF_SET_SKIP_STEPS(PF_SKIP_AF); 1257 if (cur->proto != prev->proto) 1258 PF_SET_SKIP_STEPS(PF_SKIP_PROTO); 1259 if (cur->src.neg != prev->src.neg || 1260 pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr)) 1261 PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR); 1262 if (cur->src.port[0] != prev->src.port[0] || 1263 cur->src.port[1] != prev->src.port[1] || 1264 cur->src.port_op != prev->src.port_op) 1265 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT); 1266 if (cur->dst.neg != prev->dst.neg || 1267 pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr)) 1268 PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR); 1269 if (cur->dst.port[0] != prev->dst.port[0] || 1270 cur->dst.port[1] != prev->dst.port[1] || 1271 cur->dst.port_op != prev->dst.port_op) 1272 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT); 1273 1274 prev = cur; 1275 cur = TAILQ_NEXT(cur, entries); 1276 } 1277 for (i = 0; i < PF_SKIP_COUNT; ++i) 1278 PF_SET_SKIP_STEPS(i); 1279 } 1280 1281 int 1282 pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2) 1283 { 1284 if (aw1->type != aw2->type) 1285 return (1); 1286 switch (aw1->type) { 1287 case PF_ADDR_ADDRMASK: 1288 if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, 0)) 1289 return (1); 1290 if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, 0)) 1291 return (1); 1292 return (0); 1293 case PF_ADDR_DYNIFTL: 1294 return (aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt); 1295 case PF_ADDR_NOROUTE: 1296 return (0); 1297 case PF_ADDR_TABLE: 1298 return (aw1->p.tbl != aw2->p.tbl); 1299 default: 1300 printf("invalid address type: %d\n", aw1->type); 1301 return (1); 1302 } 1303 } 1304 1305 u_int16_t 1306 pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp) 1307 { 1308 u_int32_t l; 1309 1310 if (udp && !cksum) 1311 return (0x0000); 1312 l = cksum + old - new; 1313 l = (l >> 16) + (l & 65535); 1314 l = l & 65535; 1315 if (udp && !l) 1316 return (0xFFFF); 1317 return (l); 1318 } 1319 1320 void 1321 pf_change_ap(struct pf_addr *a, u_int16_t *p, u_int16_t *ic, u_int16_t *pc, 1322 struct pf_addr *an, u_int16_t pn, u_int8_t u, sa_family_t af) 1323 { 1324 struct pf_addr ao; 1325 u_int16_t po = *p; 1326 1327 PF_ACPY(&ao, a, af); 1328 PF_ACPY(a, an, af); 1329 1330 *p = pn; 1331 1332 switch (af) { 1333 #ifdef INET 1334 case AF_INET: 1335 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic, 1336 ao.addr16[0], an->addr16[0], 0), 1337 ao.addr16[1], an->addr16[1], 0); 1338 *p = pn; 1339 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc, 1340 ao.addr16[0], an->addr16[0], u), 1341 ao.addr16[1], an->addr16[1], u), 1342 po, pn, u); 1343 break; 1344 #endif /* INET */ 1345 #ifdef INET6 1346 case AF_INET6: 1347 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1348 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1349 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc, 1350 ao.addr16[0], an->addr16[0], u), 1351 ao.addr16[1], an->addr16[1], u), 1352 ao.addr16[2], an->addr16[2], u), 1353 ao.addr16[3], an->addr16[3], u), 1354 ao.addr16[4], an->addr16[4], u), 1355 ao.addr16[5], an->addr16[5], u), 1356 ao.addr16[6], an->addr16[6], u), 1357 ao.addr16[7], an->addr16[7], u), 1358 po, pn, u); 1359 break; 1360 #endif /* INET6 */ 1361 } 1362 } 1363 1364 1365 /* Changes a u_int32_t. Uses a void *so there are no align restrictions */ 1366 void 1367 pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u) 1368 { 1369 u_int32_t ao; 1370 1371 memcpy(&ao, a, sizeof(ao)); 1372 memcpy(a, &an, sizeof(u_int32_t)); 1373 *c = pf_cksum_fixup(pf_cksum_fixup(*c, ao / 65536, an / 65536, u), 1374 ao % 65536, an % 65536, u); 1375 } 1376 1377 #ifdef INET6 1378 void 1379 pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u) 1380 { 1381 struct pf_addr ao; 1382 1383 PF_ACPY(&ao, a, AF_INET6); 1384 PF_ACPY(a, an, AF_INET6); 1385 1386 *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1387 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1388 pf_cksum_fixup(pf_cksum_fixup(*c, 1389 ao.addr16[0], an->addr16[0], u), 1390 ao.addr16[1], an->addr16[1], u), 1391 ao.addr16[2], an->addr16[2], u), 1392 ao.addr16[3], an->addr16[3], u), 1393 ao.addr16[4], an->addr16[4], u), 1394 ao.addr16[5], an->addr16[5], u), 1395 ao.addr16[6], an->addr16[6], u), 1396 ao.addr16[7], an->addr16[7], u); 1397 } 1398 #endif /* INET6 */ 1399 1400 void 1401 pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa, 1402 struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c, 1403 u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af) 1404 { 1405 struct pf_addr oia, ooa; 1406 1407 PF_ACPY(&oia, ia, af); 1408 PF_ACPY(&ooa, oa, af); 1409 1410 /* Change inner protocol port, fix inner protocol checksum. */ 1411 if (ip != NULL) { 1412 u_int16_t oip = *ip; 1413 u_int32_t opc = 0; 1414 1415 if (pc != NULL) 1416 opc = *pc; 1417 *ip = np; 1418 if (pc != NULL) 1419 *pc = pf_cksum_fixup(*pc, oip, *ip, u); 1420 *ic = pf_cksum_fixup(*ic, oip, *ip, 0); 1421 if (pc != NULL) 1422 *ic = pf_cksum_fixup(*ic, opc, *pc, 0); 1423 } 1424 /* Change inner ip address, fix inner ip and icmp checksums. */ 1425 PF_ACPY(ia, na, af); 1426 switch (af) { 1427 #ifdef INET 1428 case AF_INET: { 1429 u_int32_t oh2c = *h2c; 1430 1431 *h2c = pf_cksum_fixup(pf_cksum_fixup(*h2c, 1432 oia.addr16[0], ia->addr16[0], 0), 1433 oia.addr16[1], ia->addr16[1], 0); 1434 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic, 1435 oia.addr16[0], ia->addr16[0], 0), 1436 oia.addr16[1], ia->addr16[1], 0); 1437 *ic = pf_cksum_fixup(*ic, oh2c, *h2c, 0); 1438 break; 1439 } 1440 #endif /* INET */ 1441 #ifdef INET6 1442 case AF_INET6: 1443 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1444 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1445 pf_cksum_fixup(pf_cksum_fixup(*ic, 1446 oia.addr16[0], ia->addr16[0], u), 1447 oia.addr16[1], ia->addr16[1], u), 1448 oia.addr16[2], ia->addr16[2], u), 1449 oia.addr16[3], ia->addr16[3], u), 1450 oia.addr16[4], ia->addr16[4], u), 1451 oia.addr16[5], ia->addr16[5], u), 1452 oia.addr16[6], ia->addr16[6], u), 1453 oia.addr16[7], ia->addr16[7], u); 1454 break; 1455 #endif /* INET6 */ 1456 } 1457 /* Change outer ip address, fix outer ip or icmpv6 checksum. */ 1458 PF_ACPY(oa, na, af); 1459 switch (af) { 1460 #ifdef INET 1461 case AF_INET: 1462 *hc = pf_cksum_fixup(pf_cksum_fixup(*hc, 1463 ooa.addr16[0], oa->addr16[0], 0), 1464 ooa.addr16[1], oa->addr16[1], 0); 1465 break; 1466 #endif /* INET */ 1467 #ifdef INET6 1468 case AF_INET6: 1469 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1470 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1471 pf_cksum_fixup(pf_cksum_fixup(*ic, 1472 ooa.addr16[0], oa->addr16[0], u), 1473 ooa.addr16[1], oa->addr16[1], u), 1474 ooa.addr16[2], oa->addr16[2], u), 1475 ooa.addr16[3], oa->addr16[3], u), 1476 ooa.addr16[4], oa->addr16[4], u), 1477 ooa.addr16[5], oa->addr16[5], u), 1478 ooa.addr16[6], oa->addr16[6], u), 1479 ooa.addr16[7], oa->addr16[7], u); 1480 break; 1481 #endif /* INET6 */ 1482 } 1483 } 1484 1485 void 1486 pf_send_tcp(const struct pf_rule *r, sa_family_t af, 1487 const struct pf_addr *saddr, const struct pf_addr *daddr, 1488 u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack, 1489 u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl, int tag, 1490 u_int16_t rtag, struct ether_header *eh, struct ifnet *ifp) 1491 { 1492 struct mbuf *m; 1493 int len, tlen; 1494 #ifdef INET 1495 struct ip *h = NULL; 1496 #endif /* INET */ 1497 #ifdef INET6 1498 struct ip6_hdr *h6 = NULL; 1499 #endif /* INET6 */ 1500 struct tcphdr *th; 1501 char *opt; 1502 1503 /* maximum segment size tcp option */ 1504 tlen = sizeof(struct tcphdr); 1505 if (mss) 1506 tlen += 4; 1507 1508 switch (af) { 1509 #ifdef INET 1510 case AF_INET: 1511 len = sizeof(struct ip) + tlen; 1512 break; 1513 #endif /* INET */ 1514 #ifdef INET6 1515 case AF_INET6: 1516 len = sizeof(struct ip6_hdr) + tlen; 1517 break; 1518 #endif /* INET6 */ 1519 default: 1520 return; 1521 } 1522 1523 /* create outgoing mbuf */ 1524 m = m_gethdr(M_DONTWAIT, MT_HEADER); 1525 if (m == NULL) 1526 return; 1527 if (tag) { 1528 struct m_tag *mtag; 1529 1530 mtag = m_tag_get(PACKET_TAG_PF_GENERATED, 0, M_NOWAIT); 1531 if (mtag == NULL) { 1532 m_freem(m); 1533 return; 1534 } 1535 m_tag_prepend(m, mtag); 1536 } 1537 if (rtag) 1538 if (pf_tag_packet(m, NULL, rtag)) { 1539 m_freem(m); 1540 return; 1541 } 1542 #ifdef ALTQ 1543 if (r != NULL && r->qid) { 1544 struct m_tag *mtag; 1545 struct altq_tag *atag; 1546 1547 mtag = m_tag_get(PACKET_TAG_PF_QID, sizeof(*atag), M_NOWAIT); 1548 if (mtag != NULL) { 1549 atag = (struct altq_tag *)(mtag + 1); 1550 atag->qid = r->qid; 1551 /* add hints for ecn */ 1552 atag->af = af; 1553 atag->hdr = mtod(m, struct ip *); 1554 m_tag_prepend(m, mtag); 1555 } 1556 } 1557 #endif /* ALTQ */ 1558 m->m_data += max_linkhdr; 1559 m->m_pkthdr.len = m->m_len = len; 1560 m->m_pkthdr.rcvif = NULL; 1561 bzero(m->m_data, len); 1562 switch (af) { 1563 #ifdef INET 1564 case AF_INET: 1565 h = mtod(m, struct ip *); 1566 1567 /* IP header fields included in the TCP checksum */ 1568 h->ip_p = IPPROTO_TCP; 1569 h->ip_len = htons(tlen); 1570 h->ip_src.s_addr = saddr->v4.s_addr; 1571 h->ip_dst.s_addr = daddr->v4.s_addr; 1572 1573 th = (struct tcphdr *)((char *)h + sizeof(struct ip)); 1574 break; 1575 #endif /* INET */ 1576 #ifdef INET6 1577 case AF_INET6: 1578 h6 = mtod(m, struct ip6_hdr *); 1579 1580 /* IP header fields included in the TCP checksum */ 1581 h6->ip6_nxt = IPPROTO_TCP; 1582 h6->ip6_plen = htons(tlen); 1583 memcpy(&h6->ip6_src, &saddr->v6, sizeof(struct in6_addr)); 1584 memcpy(&h6->ip6_dst, &daddr->v6, sizeof(struct in6_addr)); 1585 1586 th = (struct tcphdr *)((char *)h6 + sizeof(struct ip6_hdr)); 1587 break; 1588 #endif /* INET6 */ 1589 default: 1590 m_freem(m); 1591 return; 1592 } 1593 1594 /* TCP header */ 1595 th->th_sport = sport; 1596 th->th_dport = dport; 1597 th->th_seq = htonl(seq); 1598 th->th_ack = htonl(ack); 1599 th->th_off = tlen >> 2; 1600 th->th_flags = flags; 1601 th->th_win = htons(win); 1602 1603 if (mss) { 1604 opt = (char *)(th + 1); 1605 opt[0] = TCPOPT_MAXSEG; 1606 opt[1] = 4; 1607 HTONS(mss); 1608 bcopy((void *)&mss, (void *)(opt + 2), 2); 1609 } 1610 1611 switch (af) { 1612 #ifdef INET 1613 case AF_INET: 1614 /* TCP checksum */ 1615 th->th_sum = in_cksum(m, len); 1616 1617 /* Finish the IP header */ 1618 h->ip_v = 4; 1619 h->ip_hl = sizeof(*h) >> 2; 1620 h->ip_tos = IPTOS_LOWDELAY; 1621 h->ip_len = htons(len); 1622 h->ip_off = htons(ip_mtudisc ? IP_DF : 0); 1623 h->ip_ttl = ttl ? ttl : ip_defttl; 1624 h->ip_sum = 0; 1625 if (eh == NULL) { 1626 ip_output(m, (void *)NULL, (void *)NULL, 0, 1627 (void *)NULL, (void *)NULL); 1628 } else { 1629 #ifdef __OpenBSD__ 1630 struct route ro; 1631 struct rtentry rt; 1632 struct ether_header *e = (void *)ro.ro_dst.sa_data; 1633 1634 if (ifp == NULL) { 1635 m_freem(m); 1636 return; 1637 } 1638 rt.rt_ifp = ifp; 1639 ro.ro_rt = &rt; 1640 ro.ro_dst.sa_len = sizeof(ro.ro_dst); 1641 ro.ro_dst.sa_family = pseudo_AF_HDRCMPLT; 1642 bcopy(eh->ether_dhost, e->ether_shost, ETHER_ADDR_LEN); 1643 bcopy(eh->ether_shost, e->ether_dhost, ETHER_ADDR_LEN); 1644 e->ether_type = eh->ether_type; 1645 ip_output(m, (void *)NULL, &ro, IP_ROUTETOETHER, 1646 (void *)NULL, (void *)NULL); 1647 #else 1648 /* 1649 * on netbsd, pf_test and pf_test6 are always called 1650 * with eh == NULL. 1651 */ 1652 panic("pf_send_tcp: eh != NULL"); 1653 #endif 1654 } 1655 break; 1656 #endif /* INET */ 1657 #ifdef INET6 1658 case AF_INET6: 1659 /* TCP checksum */ 1660 th->th_sum = in6_cksum(m, IPPROTO_TCP, 1661 sizeof(struct ip6_hdr), tlen); 1662 1663 h6->ip6_vfc |= IPV6_VERSION; 1664 h6->ip6_hlim = IPV6_DEFHLIM; 1665 1666 #ifdef __OpenBSD__ 1667 ip6_output(m, NULL, NULL, 0, NULL, NULL); 1668 #else 1669 ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL); 1670 #endif 1671 break; 1672 #endif /* INET6 */ 1673 } 1674 } 1675 1676 void 1677 pf_send_icmp(struct mbuf *m, u_int8_t type, u_int8_t code, sa_family_t af, 1678 struct pf_rule *r) 1679 { 1680 struct m_tag *mtag; 1681 struct mbuf *m0; 1682 1683 mtag = m_tag_get(PACKET_TAG_PF_GENERATED, 0, M_NOWAIT); 1684 if (mtag == NULL) 1685 return; 1686 m0 = m_copy(m, 0, M_COPYALL); 1687 if (m0 == NULL) { 1688 m_tag_free(mtag); 1689 return; 1690 } 1691 m_tag_prepend(m0, mtag); 1692 1693 #ifdef ALTQ 1694 if (r->qid) { 1695 struct altq_tag *atag; 1696 1697 mtag = m_tag_get(PACKET_TAG_PF_QID, sizeof(*atag), M_NOWAIT); 1698 if (mtag != NULL) { 1699 atag = (struct altq_tag *)(mtag + 1); 1700 atag->qid = r->qid; 1701 /* add hints for ecn */ 1702 atag->af = af; 1703 atag->hdr = mtod(m0, struct ip *); 1704 m_tag_prepend(m0, mtag); 1705 } 1706 } 1707 #endif /* ALTQ */ 1708 1709 switch (af) { 1710 #ifdef INET 1711 case AF_INET: 1712 icmp_error(m0, type, code, 0, 0); 1713 break; 1714 #endif /* INET */ 1715 #ifdef INET6 1716 case AF_INET6: 1717 icmp6_error(m0, type, code, 0); 1718 break; 1719 #endif /* INET6 */ 1720 } 1721 } 1722 1723 /* 1724 * Return 1 if the addresses a and b match (with mask m), otherwise return 0. 1725 * If n is 0, they match if they are equal. If n is != 0, they match if they 1726 * are different. 1727 */ 1728 int 1729 pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m, 1730 struct pf_addr *b, sa_family_t af) 1731 { 1732 int match = 0; 1733 1734 switch (af) { 1735 #ifdef INET 1736 case AF_INET: 1737 if ((a->addr32[0] & m->addr32[0]) == 1738 (b->addr32[0] & m->addr32[0])) 1739 match++; 1740 break; 1741 #endif /* INET */ 1742 #ifdef INET6 1743 case AF_INET6: 1744 if (((a->addr32[0] & m->addr32[0]) == 1745 (b->addr32[0] & m->addr32[0])) && 1746 ((a->addr32[1] & m->addr32[1]) == 1747 (b->addr32[1] & m->addr32[1])) && 1748 ((a->addr32[2] & m->addr32[2]) == 1749 (b->addr32[2] & m->addr32[2])) && 1750 ((a->addr32[3] & m->addr32[3]) == 1751 (b->addr32[3] & m->addr32[3]))) 1752 match++; 1753 break; 1754 #endif /* INET6 */ 1755 } 1756 if (match) { 1757 if (n) 1758 return (0); 1759 else 1760 return (1); 1761 } else { 1762 if (n) 1763 return (1); 1764 else 1765 return (0); 1766 } 1767 } 1768 1769 int 1770 pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p) 1771 { 1772 switch (op) { 1773 case PF_OP_IRG: 1774 return ((p > a1) && (p < a2)); 1775 case PF_OP_XRG: 1776 return ((p < a1) || (p > a2)); 1777 case PF_OP_RRG: 1778 return ((p >= a1) && (p <= a2)); 1779 case PF_OP_EQ: 1780 return (p == a1); 1781 case PF_OP_NE: 1782 return (p != a1); 1783 case PF_OP_LT: 1784 return (p < a1); 1785 case PF_OP_LE: 1786 return (p <= a1); 1787 case PF_OP_GT: 1788 return (p > a1); 1789 case PF_OP_GE: 1790 return (p >= a1); 1791 } 1792 return (0); /* never reached */ 1793 } 1794 1795 int 1796 pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p) 1797 { 1798 NTOHS(a1); 1799 NTOHS(a2); 1800 NTOHS(p); 1801 return (pf_match(op, a1, a2, p)); 1802 } 1803 1804 int 1805 pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u) 1806 { 1807 if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE) 1808 return (0); 1809 return (pf_match(op, a1, a2, u)); 1810 } 1811 1812 int 1813 pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g) 1814 { 1815 if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE) 1816 return (0); 1817 return (pf_match(op, a1, a2, g)); 1818 } 1819 1820 struct pf_tag * 1821 pf_get_tag(struct mbuf *m) 1822 { 1823 struct m_tag *mtag; 1824 1825 if ((mtag = m_tag_find(m, PACKET_TAG_PF_TAG, NULL)) != NULL) 1826 return ((struct pf_tag *)(mtag + 1)); 1827 else 1828 return (NULL); 1829 } 1830 1831 int 1832 pf_match_tag(struct mbuf *m, struct pf_rule *r, struct pf_tag **pftag, int *tag) 1833 { 1834 if (*tag == -1) { /* find mbuf tag */ 1835 *pftag = pf_get_tag(m); 1836 if (*pftag != NULL) 1837 *tag = (*pftag)->tag; 1838 else 1839 *tag = 0; 1840 } 1841 1842 return ((!r->match_tag_not && r->match_tag == *tag) || 1843 (r->match_tag_not && r->match_tag != *tag)); 1844 } 1845 1846 int 1847 pf_tag_packet(struct mbuf *m, struct pf_tag *pftag, int tag) 1848 { 1849 struct m_tag *mtag; 1850 1851 if (tag <= 0) 1852 return (0); 1853 1854 if (pftag == NULL) { 1855 mtag = m_tag_get(PACKET_TAG_PF_TAG, sizeof(*pftag), M_NOWAIT); 1856 if (mtag == NULL) 1857 return (1); 1858 ((struct pf_tag *)(mtag + 1))->tag = tag; 1859 m_tag_prepend(m, mtag); 1860 } else 1861 pftag->tag = tag; 1862 1863 return (0); 1864 } 1865 1866 static void 1867 pf_step_into_anchor(int *depth, struct pf_ruleset **rs, int n, 1868 struct pf_rule **r, struct pf_rule **a) 1869 { 1870 struct pf_anchor_stackframe *f; 1871 1872 if (*depth >= sizeof(pf_anchor_stack) / 1873 sizeof(pf_anchor_stack[0])) { 1874 printf("pf_step_into_anchor: stack overflow\n"); 1875 *r = TAILQ_NEXT(*r, entries); 1876 return; 1877 } else if (*depth == 0 && a != NULL) 1878 *a = *r; 1879 f = pf_anchor_stack + (*depth)++; 1880 f->rs = *rs; 1881 f->r = *r; 1882 if ((*r)->anchor_wildcard) { 1883 f->parent = &(*r)->anchor->children; 1884 if ((f->child = RB_MIN(pf_anchor_node, f->parent)) == 1885 NULL) { 1886 *r = NULL; 1887 return; 1888 } 1889 *rs = &f->child->ruleset; 1890 } else { 1891 f->parent = NULL; 1892 f->child = NULL; 1893 *rs = &(*r)->anchor->ruleset; 1894 } 1895 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr); 1896 } 1897 1898 static void 1899 pf_step_out_of_anchor(int *depth, struct pf_ruleset **rs, int n, 1900 struct pf_rule **r, struct pf_rule **a) 1901 { 1902 struct pf_anchor_stackframe *f; 1903 1904 do { 1905 if (*depth <= 0) 1906 break; 1907 f = pf_anchor_stack + *depth - 1; 1908 if (f->parent != NULL && f->child != NULL) { 1909 f->child = RB_NEXT(pf_anchor_node, f->parent, f->child); 1910 if (f->child != NULL) { 1911 *rs = &f->child->ruleset; 1912 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr); 1913 if (*r == NULL) 1914 continue; 1915 else 1916 break; 1917 } 1918 } 1919 (*depth)--; 1920 if (*depth == 0 && a != NULL) 1921 *a = NULL; 1922 *rs = f->rs; 1923 *r = TAILQ_NEXT(f->r, entries); 1924 } while (*r == NULL); 1925 } 1926 1927 #ifdef INET6 1928 void 1929 pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr, 1930 struct pf_addr *rmask, const struct pf_addr *saddr, sa_family_t af) 1931 { 1932 switch (af) { 1933 #ifdef INET 1934 case AF_INET: 1935 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) | 1936 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]); 1937 break; 1938 #endif /* INET */ 1939 case AF_INET6: 1940 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) | 1941 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]); 1942 naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) | 1943 ((rmask->addr32[1] ^ 0xffffffff ) & saddr->addr32[1]); 1944 naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) | 1945 ((rmask->addr32[2] ^ 0xffffffff ) & saddr->addr32[2]); 1946 naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) | 1947 ((rmask->addr32[3] ^ 0xffffffff ) & saddr->addr32[3]); 1948 break; 1949 } 1950 } 1951 1952 void 1953 pf_addr_inc(struct pf_addr *addr, sa_family_t af) 1954 { 1955 switch (af) { 1956 #ifdef INET 1957 case AF_INET: 1958 addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1); 1959 break; 1960 #endif /* INET */ 1961 case AF_INET6: 1962 if (addr->addr32[3] == 0xffffffff) { 1963 addr->addr32[3] = 0; 1964 if (addr->addr32[2] == 0xffffffff) { 1965 addr->addr32[2] = 0; 1966 if (addr->addr32[1] == 0xffffffff) { 1967 addr->addr32[1] = 0; 1968 addr->addr32[0] = 1969 htonl(ntohl(addr->addr32[0]) + 1); 1970 } else 1971 addr->addr32[1] = 1972 htonl(ntohl(addr->addr32[1]) + 1); 1973 } else 1974 addr->addr32[2] = 1975 htonl(ntohl(addr->addr32[2]) + 1); 1976 } else 1977 addr->addr32[3] = 1978 htonl(ntohl(addr->addr32[3]) + 1); 1979 break; 1980 } 1981 } 1982 #endif /* INET6 */ 1983 1984 #define mix(a,b,c) \ 1985 do { \ 1986 a -= b; a -= c; a ^= (c >> 13); \ 1987 b -= c; b -= a; b ^= (a << 8); \ 1988 c -= a; c -= b; c ^= (b >> 13); \ 1989 a -= b; a -= c; a ^= (c >> 12); \ 1990 b -= c; b -= a; b ^= (a << 16); \ 1991 c -= a; c -= b; c ^= (b >> 5); \ 1992 a -= b; a -= c; a ^= (c >> 3); \ 1993 b -= c; b -= a; b ^= (a << 10); \ 1994 c -= a; c -= b; c ^= (b >> 15); \ 1995 } while (0) 1996 1997 /* 1998 * hash function based on bridge_hash in if_bridge.c 1999 */ 2000 void 2001 pf_hash(const struct pf_addr *inaddr, struct pf_addr *hash, 2002 struct pf_poolhashkey *key, sa_family_t af) 2003 { 2004 u_int32_t a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0]; 2005 2006 switch (af) { 2007 #ifdef INET 2008 case AF_INET: 2009 a += inaddr->addr32[0]; 2010 b += key->key32[1]; 2011 mix(a, b, c); 2012 hash->addr32[0] = c + key->key32[2]; 2013 break; 2014 #endif /* INET */ 2015 #ifdef INET6 2016 case AF_INET6: 2017 a += inaddr->addr32[0]; 2018 b += inaddr->addr32[2]; 2019 mix(a, b, c); 2020 hash->addr32[0] = c; 2021 a += inaddr->addr32[1]; 2022 b += inaddr->addr32[3]; 2023 c += key->key32[1]; 2024 mix(a, b, c); 2025 hash->addr32[1] = c; 2026 a += inaddr->addr32[2]; 2027 b += inaddr->addr32[1]; 2028 c += key->key32[2]; 2029 mix(a, b, c); 2030 hash->addr32[2] = c; 2031 a += inaddr->addr32[3]; 2032 b += inaddr->addr32[0]; 2033 c += key->key32[3]; 2034 mix(a, b, c); 2035 hash->addr32[3] = c; 2036 break; 2037 #endif /* INET6 */ 2038 } 2039 } 2040 2041 int 2042 pf_map_addr(sa_family_t af, struct pf_rule *r, const struct pf_addr *saddr, 2043 struct pf_addr *naddr, struct pf_addr *init_addr, struct pf_src_node **sn) 2044 { 2045 unsigned char hash[16]; 2046 struct pf_pool *rpool = &r->rpool; 2047 struct pf_addr *raddr = &rpool->cur->addr.v.a.addr; 2048 struct pf_addr *rmask = &rpool->cur->addr.v.a.mask; 2049 struct pf_pooladdr *acur = rpool->cur; 2050 struct pf_src_node k; 2051 2052 if (*sn == NULL && r->rpool.opts & PF_POOL_STICKYADDR && 2053 (r->rpool.opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) { 2054 k.af = af; 2055 PF_ACPY(&k.addr, saddr, af); 2056 if (r->rule_flag & PFRULE_RULESRCTRACK || 2057 r->rpool.opts & PF_POOL_STICKYADDR) 2058 k.rule.ptr = r; 2059 else 2060 k.rule.ptr = NULL; 2061 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++; 2062 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k); 2063 if (*sn != NULL && !PF_AZERO(&(*sn)->raddr, af)) { 2064 PF_ACPY(naddr, &(*sn)->raddr, af); 2065 if (pf_status.debug >= PF_DEBUG_MISC) { 2066 printf("pf_map_addr: src tracking maps "); 2067 pf_print_host(&k.addr, 0, af); 2068 printf(" to "); 2069 pf_print_host(naddr, 0, af); 2070 printf("\n"); 2071 } 2072 return (0); 2073 } 2074 } 2075 2076 if (rpool->cur->addr.type == PF_ADDR_NOROUTE) 2077 return (1); 2078 if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { 2079 switch (af) { 2080 #ifdef INET 2081 case AF_INET: 2082 if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 && 2083 (rpool->opts & PF_POOL_TYPEMASK) != 2084 PF_POOL_ROUNDROBIN) 2085 return (1); 2086 raddr = &rpool->cur->addr.p.dyn->pfid_addr4; 2087 rmask = &rpool->cur->addr.p.dyn->pfid_mask4; 2088 break; 2089 #endif /* INET */ 2090 #ifdef INET6 2091 case AF_INET6: 2092 if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 && 2093 (rpool->opts & PF_POOL_TYPEMASK) != 2094 PF_POOL_ROUNDROBIN) 2095 return (1); 2096 raddr = &rpool->cur->addr.p.dyn->pfid_addr6; 2097 rmask = &rpool->cur->addr.p.dyn->pfid_mask6; 2098 break; 2099 #endif /* INET6 */ 2100 } 2101 } else if (rpool->cur->addr.type == PF_ADDR_TABLE) { 2102 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN) 2103 return (1); /* unsupported */ 2104 } else { 2105 raddr = &rpool->cur->addr.v.a.addr; 2106 rmask = &rpool->cur->addr.v.a.mask; 2107 } 2108 2109 switch (rpool->opts & PF_POOL_TYPEMASK) { 2110 case PF_POOL_NONE: 2111 PF_ACPY(naddr, raddr, af); 2112 break; 2113 case PF_POOL_BITMASK: 2114 PF_POOLMASK(naddr, raddr, rmask, saddr, af); 2115 break; 2116 case PF_POOL_RANDOM: 2117 if (init_addr != NULL && PF_AZERO(init_addr, af)) { 2118 switch (af) { 2119 #ifdef INET 2120 case AF_INET: 2121 rpool->counter.addr32[0] = htonl(arc4random()); 2122 break; 2123 #endif /* INET */ 2124 #ifdef INET6 2125 case AF_INET6: 2126 if (rmask->addr32[3] != 0xffffffff) 2127 rpool->counter.addr32[3] = 2128 htonl(arc4random()); 2129 else 2130 break; 2131 if (rmask->addr32[2] != 0xffffffff) 2132 rpool->counter.addr32[2] = 2133 htonl(arc4random()); 2134 else 2135 break; 2136 if (rmask->addr32[1] != 0xffffffff) 2137 rpool->counter.addr32[1] = 2138 htonl(arc4random()); 2139 else 2140 break; 2141 if (rmask->addr32[0] != 0xffffffff) 2142 rpool->counter.addr32[0] = 2143 htonl(arc4random()); 2144 break; 2145 #endif /* INET6 */ 2146 } 2147 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af); 2148 PF_ACPY(init_addr, naddr, af); 2149 2150 } else { 2151 PF_AINC(&rpool->counter, af); 2152 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af); 2153 } 2154 break; 2155 case PF_POOL_SRCHASH: 2156 pf_hash(saddr, (struct pf_addr *)&hash, &rpool->key, af); 2157 PF_POOLMASK(naddr, raddr, rmask, (struct pf_addr *)&hash, af); 2158 break; 2159 case PF_POOL_ROUNDROBIN: 2160 if (rpool->cur->addr.type == PF_ADDR_TABLE) { 2161 if (!pfr_pool_get(rpool->cur->addr.p.tbl, 2162 &rpool->tblidx, &rpool->counter, 2163 &raddr, &rmask, af)) 2164 goto get_addr; 2165 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { 2166 if (!pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt, 2167 &rpool->tblidx, &rpool->counter, 2168 &raddr, &rmask, af)) 2169 goto get_addr; 2170 } else if (pf_match_addr(0, raddr, rmask, &rpool->counter, af)) 2171 goto get_addr; 2172 2173 try_next: 2174 if ((rpool->cur = TAILQ_NEXT(rpool->cur, entries)) == NULL) 2175 rpool->cur = TAILQ_FIRST(&rpool->list); 2176 if (rpool->cur->addr.type == PF_ADDR_TABLE) { 2177 rpool->tblidx = -1; 2178 if (pfr_pool_get(rpool->cur->addr.p.tbl, 2179 &rpool->tblidx, &rpool->counter, 2180 &raddr, &rmask, af)) { 2181 /* table contains no address of type 'af' */ 2182 if (rpool->cur != acur) 2183 goto try_next; 2184 return (1); 2185 } 2186 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { 2187 rpool->tblidx = -1; 2188 if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt, 2189 &rpool->tblidx, &rpool->counter, 2190 &raddr, &rmask, af)) { 2191 /* table contains no address of type 'af' */ 2192 if (rpool->cur != acur) 2193 goto try_next; 2194 return (1); 2195 } 2196 } else { 2197 raddr = &rpool->cur->addr.v.a.addr; 2198 rmask = &rpool->cur->addr.v.a.mask; 2199 PF_ACPY(&rpool->counter, raddr, af); 2200 } 2201 2202 get_addr: 2203 PF_ACPY(naddr, &rpool->counter, af); 2204 if (init_addr != NULL && PF_AZERO(init_addr, af)) 2205 PF_ACPY(init_addr, naddr, af); 2206 PF_AINC(&rpool->counter, af); 2207 break; 2208 } 2209 if (*sn != NULL) 2210 PF_ACPY(&(*sn)->raddr, naddr, af); 2211 2212 if (pf_status.debug >= PF_DEBUG_MISC && 2213 (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) { 2214 printf("pf_map_addr: selected address "); 2215 pf_print_host(naddr, 0, af); 2216 printf("\n"); 2217 } 2218 2219 return (0); 2220 } 2221 2222 int 2223 pf_get_sport(sa_family_t af, u_int8_t proto, struct pf_rule *r, 2224 struct pf_addr *saddr, struct pf_addr *daddr, u_int16_t dport, 2225 struct pf_addr *naddr, u_int16_t *nport, u_int16_t low, u_int16_t high, 2226 struct pf_src_node **sn) 2227 { 2228 struct pf_state key; 2229 struct pf_addr init_addr; 2230 u_int16_t cut; 2231 2232 bzero(&init_addr, sizeof(init_addr)); 2233 if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn)) 2234 return (1); 2235 2236 do { 2237 key.af = af; 2238 key.proto = proto; 2239 PF_ACPY(&key.ext.addr, daddr, key.af); 2240 PF_ACPY(&key.gwy.addr, naddr, key.af); 2241 key.ext.port = dport; 2242 2243 /* 2244 * port search; start random, step; 2245 * similar 2 portloop in in_pcbbind 2246 */ 2247 if (!(proto == IPPROTO_TCP || proto == IPPROTO_UDP)) { 2248 key.gwy.port = dport; 2249 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL) 2250 return (0); 2251 } else if (low == 0 && high == 0) { 2252 key.gwy.port = *nport; 2253 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL) 2254 return (0); 2255 } else if (low == high) { 2256 key.gwy.port = htons(low); 2257 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL) { 2258 *nport = htons(low); 2259 return (0); 2260 } 2261 } else { 2262 u_int16_t tmp; 2263 2264 if (low > high) { 2265 tmp = low; 2266 low = high; 2267 high = tmp; 2268 } 2269 /* low < high */ 2270 cut = htonl(arc4random()) % (1 + high - low) + low; 2271 /* low <= cut <= high */ 2272 for (tmp = cut; tmp <= high; ++(tmp)) { 2273 key.gwy.port = htons(tmp); 2274 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == 2275 NULL) { 2276 *nport = htons(tmp); 2277 return (0); 2278 } 2279 } 2280 for (tmp = cut - 1; tmp >= low; --(tmp)) { 2281 key.gwy.port = htons(tmp); 2282 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == 2283 NULL) { 2284 *nport = htons(tmp); 2285 return (0); 2286 } 2287 } 2288 } 2289 2290 switch (r->rpool.opts & PF_POOL_TYPEMASK) { 2291 case PF_POOL_RANDOM: 2292 case PF_POOL_ROUNDROBIN: 2293 if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn)) 2294 return (1); 2295 break; 2296 case PF_POOL_NONE: 2297 case PF_POOL_SRCHASH: 2298 case PF_POOL_BITMASK: 2299 default: 2300 return (1); 2301 } 2302 } while (! PF_AEQ(&init_addr, naddr, af) ); 2303 2304 return (1); /* none available */ 2305 } 2306 2307 struct pf_rule * 2308 pf_match_translation(struct pf_pdesc *pd, struct mbuf *m, int off, 2309 int direction, struct pfi_kif *kif, struct pf_addr *saddr, u_int16_t sport, 2310 struct pf_addr *daddr, u_int16_t dport, int rs_num) 2311 { 2312 struct pf_rule *r, *rm = NULL; 2313 struct pf_ruleset *ruleset = NULL; 2314 struct pf_tag *pftag = NULL; 2315 int tag = -1; 2316 int asd = 0; 2317 2318 r = TAILQ_FIRST(pf_main_ruleset.rules[rs_num].active.ptr); 2319 while (r && rm == NULL) { 2320 struct pf_rule_addr *src = NULL, *dst = NULL; 2321 struct pf_addr_wrap *xdst = NULL; 2322 2323 if (r->action == PF_BINAT && direction == PF_IN) { 2324 src = &r->dst; 2325 if (r->rpool.cur != NULL) 2326 xdst = &r->rpool.cur->addr; 2327 } else { 2328 src = &r->src; 2329 dst = &r->dst; 2330 } 2331 2332 r->evaluations++; 2333 if (r->kif != NULL && 2334 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 2335 r = r->skip[PF_SKIP_IFP].ptr; 2336 else if (r->direction && r->direction != direction) 2337 r = r->skip[PF_SKIP_DIR].ptr; 2338 else if (r->af && r->af != pd->af) 2339 r = r->skip[PF_SKIP_AF].ptr; 2340 else if (r->proto && r->proto != pd->proto) 2341 r = r->skip[PF_SKIP_PROTO].ptr; 2342 else if (PF_MISMATCHAW(&src->addr, saddr, pd->af, src->neg)) 2343 r = r->skip[src == &r->src ? PF_SKIP_SRC_ADDR : 2344 PF_SKIP_DST_ADDR].ptr; 2345 else if (src->port_op && !pf_match_port(src->port_op, 2346 src->port[0], src->port[1], sport)) 2347 r = r->skip[src == &r->src ? PF_SKIP_SRC_PORT : 2348 PF_SKIP_DST_PORT].ptr; 2349 else if (dst != NULL && 2350 PF_MISMATCHAW(&dst->addr, daddr, pd->af, dst->neg)) 2351 r = r->skip[PF_SKIP_DST_ADDR].ptr; 2352 else if (xdst != NULL && PF_MISMATCHAW(xdst, daddr, pd->af, 0)) 2353 r = TAILQ_NEXT(r, entries); 2354 else if (dst != NULL && dst->port_op && 2355 !pf_match_port(dst->port_op, dst->port[0], 2356 dst->port[1], dport)) 2357 r = r->skip[PF_SKIP_DST_PORT].ptr; 2358 else if (r->match_tag && !pf_match_tag(m, r, &pftag, &tag)) 2359 r = TAILQ_NEXT(r, entries); 2360 else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto != 2361 IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, m, 2362 off, pd->hdr.tcp), r->os_fingerprint))) 2363 r = TAILQ_NEXT(r, entries); 2364 else { 2365 if (r->tag) 2366 tag = r->tag; 2367 if (r->anchor == NULL) { 2368 rm = r; 2369 } else 2370 pf_step_into_anchor(&asd, &ruleset, rs_num, &r, NULL); 2371 } 2372 if (r == NULL) 2373 pf_step_out_of_anchor(&asd, &ruleset, rs_num, &r, NULL); 2374 } 2375 if (pf_tag_packet(m, pftag, tag)) 2376 return (NULL); 2377 if (rm != NULL && (rm->action == PF_NONAT || 2378 rm->action == PF_NORDR || rm->action == PF_NOBINAT)) 2379 return (NULL); 2380 return (rm); 2381 } 2382 2383 struct pf_rule * 2384 pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off, int direction, 2385 struct pfi_kif *kif, struct pf_src_node **sn, 2386 struct pf_addr *saddr, u_int16_t sport, 2387 struct pf_addr *daddr, u_int16_t dport, 2388 struct pf_addr *naddr, u_int16_t *nport) 2389 { 2390 struct pf_rule *r = NULL; 2391 2392 if (direction == PF_OUT) { 2393 r = pf_match_translation(pd, m, off, direction, kif, saddr, 2394 sport, daddr, dport, PF_RULESET_BINAT); 2395 if (r == NULL) 2396 r = pf_match_translation(pd, m, off, direction, kif, 2397 saddr, sport, daddr, dport, PF_RULESET_NAT); 2398 } else { 2399 r = pf_match_translation(pd, m, off, direction, kif, saddr, 2400 sport, daddr, dport, PF_RULESET_RDR); 2401 if (r == NULL) 2402 r = pf_match_translation(pd, m, off, direction, kif, 2403 saddr, sport, daddr, dport, PF_RULESET_BINAT); 2404 } 2405 2406 if (r != NULL) { 2407 switch (r->action) { 2408 case PF_NONAT: 2409 case PF_NOBINAT: 2410 case PF_NORDR: 2411 return (NULL); 2412 case PF_NAT: 2413 if (pf_get_sport(pd->af, pd->proto, r, saddr, 2414 daddr, dport, naddr, nport, r->rpool.proxy_port[0], 2415 r->rpool.proxy_port[1], sn)) { 2416 DPFPRINTF(PF_DEBUG_MISC, 2417 ("pf: NAT proxy port allocation " 2418 "(%u-%u) failed\n", 2419 r->rpool.proxy_port[0], 2420 r->rpool.proxy_port[1])); 2421 return (NULL); 2422 } 2423 break; 2424 case PF_BINAT: 2425 switch (direction) { 2426 case PF_OUT: 2427 if (r->rpool.cur->addr.type == PF_ADDR_DYNIFTL){ 2428 switch (pd->af) { 2429 #ifdef INET 2430 case AF_INET: 2431 if (r->rpool.cur->addr.p.dyn-> 2432 pfid_acnt4 < 1) 2433 return (NULL); 2434 PF_POOLMASK(naddr, 2435 &r->rpool.cur->addr.p.dyn-> 2436 pfid_addr4, 2437 &r->rpool.cur->addr.p.dyn-> 2438 pfid_mask4, 2439 saddr, AF_INET); 2440 break; 2441 #endif /* INET */ 2442 #ifdef INET6 2443 case AF_INET6: 2444 if (r->rpool.cur->addr.p.dyn-> 2445 pfid_acnt6 < 1) 2446 return (NULL); 2447 PF_POOLMASK(naddr, 2448 &r->rpool.cur->addr.p.dyn-> 2449 pfid_addr6, 2450 &r->rpool.cur->addr.p.dyn-> 2451 pfid_mask6, 2452 saddr, AF_INET6); 2453 break; 2454 #endif /* INET6 */ 2455 } 2456 } else 2457 PF_POOLMASK(naddr, 2458 &r->rpool.cur->addr.v.a.addr, 2459 &r->rpool.cur->addr.v.a.mask, 2460 saddr, pd->af); 2461 break; 2462 case PF_IN: 2463 if (r->src.addr.type == PF_ADDR_DYNIFTL) { 2464 switch (pd->af) { 2465 #ifdef INET 2466 case AF_INET: 2467 if (r->src.addr.p.dyn-> 2468 pfid_acnt4 < 1) 2469 return (NULL); 2470 PF_POOLMASK(naddr, 2471 &r->src.addr.p.dyn-> 2472 pfid_addr4, 2473 &r->src.addr.p.dyn-> 2474 pfid_mask4, 2475 daddr, AF_INET); 2476 break; 2477 #endif /* INET */ 2478 #ifdef INET6 2479 case AF_INET6: 2480 if (r->src.addr.p.dyn-> 2481 pfid_acnt6 < 1) 2482 return (NULL); 2483 PF_POOLMASK(naddr, 2484 &r->src.addr.p.dyn-> 2485 pfid_addr6, 2486 &r->src.addr.p.dyn-> 2487 pfid_mask6, 2488 daddr, AF_INET6); 2489 break; 2490 #endif /* INET6 */ 2491 } 2492 } else 2493 PF_POOLMASK(naddr, 2494 &r->src.addr.v.a.addr, 2495 &r->src.addr.v.a.mask, daddr, 2496 pd->af); 2497 break; 2498 } 2499 break; 2500 case PF_RDR: { 2501 if (pf_map_addr(pd->af, r, saddr, naddr, NULL, sn)) 2502 return (NULL); 2503 2504 if (r->rpool.proxy_port[1]) { 2505 u_int32_t tmp_nport; 2506 2507 tmp_nport = ((ntohs(dport) - 2508 ntohs(r->dst.port[0])) % 2509 (r->rpool.proxy_port[1] - 2510 r->rpool.proxy_port[0] + 1)) + 2511 r->rpool.proxy_port[0]; 2512 2513 /* wrap around if necessary */ 2514 if (tmp_nport > 65535) 2515 tmp_nport -= 65535; 2516 *nport = htons((u_int16_t)tmp_nport); 2517 } else if (r->rpool.proxy_port[0]) 2518 *nport = htons(r->rpool.proxy_port[0]); 2519 break; 2520 } 2521 default: 2522 return (NULL); 2523 } 2524 } 2525 2526 return (r); 2527 } 2528 2529 int 2530 pf_socket_lookup(uid_t *uid, gid_t *gid, int direction, struct pf_pdesc *pd) 2531 { 2532 struct pf_addr *saddr, *daddr; 2533 u_int16_t sport, dport; 2534 struct inpcbtable *tb; 2535 struct inpcb *inp = NULL; 2536 #if defined(__NetBSD__) && defined(INET6) 2537 struct in6pcb *in6p = NULL; 2538 #endif 2539 2540 *uid = UID_MAX; 2541 *gid = GID_MAX; 2542 switch (pd->proto) { 2543 case IPPROTO_TCP: 2544 sport = pd->hdr.tcp->th_sport; 2545 dport = pd->hdr.tcp->th_dport; 2546 tb = &tcbtable; 2547 break; 2548 case IPPROTO_UDP: 2549 sport = pd->hdr.udp->uh_sport; 2550 dport = pd->hdr.udp->uh_dport; 2551 tb = &udbtable; 2552 break; 2553 default: 2554 return (0); 2555 } 2556 if (direction == PF_IN) { 2557 saddr = pd->src; 2558 daddr = pd->dst; 2559 } else { 2560 u_int16_t p; 2561 2562 p = sport; 2563 sport = dport; 2564 dport = p; 2565 saddr = pd->dst; 2566 daddr = pd->src; 2567 } 2568 switch (pd->af) { 2569 #ifdef INET 2570 case AF_INET: 2571 #ifdef __OpenBSD__ 2572 inp = in_pcbhashlookup(tb, saddr->v4, sport, daddr->v4, dport); 2573 if (inp == NULL) { 2574 inp = in_pcblookup_listen(tb, daddr->v4, dport, 0); 2575 if (inp == NULL) 2576 return (0); 2577 } 2578 #else 2579 inp = in_pcblookup_connect(tb, saddr->v4, sport, daddr->v4, 2580 dport); 2581 if (inp == NULL) { 2582 inp = in_pcblookup_bind(tb, daddr->v4, dport); 2583 if (inp == NULL) 2584 return (0); 2585 } 2586 #endif 2587 break; 2588 #endif /* INET */ 2589 #ifdef INET6 2590 case AF_INET6: 2591 #ifdef __OpenBSD__ 2592 inp = in6_pcbhashlookup(tb, &saddr->v6, sport, &daddr->v6, 2593 dport); 2594 if (inp == NULL) { 2595 inp = in6_pcblookup_listen(tb, &daddr->v6, dport, 0); 2596 if (inp == NULL) 2597 return (0); 2598 } 2599 #else 2600 in6p = in6_pcblookup_connect(tb, &saddr->v6, sport, &daddr->v6, 2601 dport, 0); 2602 if (in6p == NULL) { 2603 in6p = in6_pcblookup_bind(tb, &daddr->v6, dport, 0); 2604 if (in6p == NULL) 2605 return (0); 2606 } 2607 #endif 2608 break; 2609 #endif /* INET6 */ 2610 2611 default: 2612 return (0); 2613 } 2614 #ifdef __OpenBSD__ 2615 *uid = inp->inp_socket->so_euid; 2616 *gid = inp->inp_socket->so_egid; 2617 #else 2618 switch (pd->af) { 2619 case AF_INET: 2620 *uid = inp->inp_socket->so_uidinfo->ui_uid; 2621 /* XXX gid */ 2622 break; 2623 #ifdef INET6 2624 case AF_INET6: 2625 *uid = in6p->in6p_socket->so_uidinfo->ui_uid; 2626 /* XXX gid */ 2627 break; 2628 #endif 2629 } 2630 #endif 2631 return (1); 2632 } 2633 2634 u_int8_t 2635 pf_get_wscale(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af) 2636 { 2637 int hlen; 2638 u_int8_t hdr[60]; 2639 u_int8_t *opt, optlen; 2640 u_int8_t wscale = 0; 2641 2642 hlen = th_off << 2; /* hlen <= sizeof(hdr) */ 2643 if (hlen <= sizeof(struct tcphdr)) 2644 return (0); 2645 if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af)) 2646 return (0); 2647 opt = hdr + sizeof(struct tcphdr); 2648 hlen -= sizeof(struct tcphdr); 2649 while (hlen >= 3) { 2650 switch (*opt) { 2651 case TCPOPT_EOL: 2652 case TCPOPT_NOP: 2653 ++opt; 2654 --hlen; 2655 break; 2656 case TCPOPT_WINDOW: 2657 wscale = opt[2]; 2658 if (wscale > TCP_MAX_WINSHIFT) 2659 wscale = TCP_MAX_WINSHIFT; 2660 wscale |= PF_WSCALE_FLAG; 2661 /* FALLTHROUGH */ 2662 default: 2663 optlen = opt[1]; 2664 if (optlen < 2) 2665 optlen = 2; 2666 hlen -= optlen; 2667 opt += optlen; 2668 break; 2669 } 2670 } 2671 return (wscale); 2672 } 2673 2674 u_int16_t 2675 pf_get_mss(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af) 2676 { 2677 int hlen; 2678 u_int8_t hdr[60]; 2679 u_int8_t *opt, optlen; 2680 u_int16_t mss = tcp_mssdflt; 2681 2682 hlen = th_off << 2; /* hlen <= sizeof(hdr) */ 2683 if (hlen <= sizeof(struct tcphdr)) 2684 return (0); 2685 if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af)) 2686 return (0); 2687 opt = hdr + sizeof(struct tcphdr); 2688 hlen -= sizeof(struct tcphdr); 2689 while (hlen >= TCPOLEN_MAXSEG) { 2690 switch (*opt) { 2691 case TCPOPT_EOL: 2692 case TCPOPT_NOP: 2693 ++opt; 2694 --hlen; 2695 break; 2696 case TCPOPT_MAXSEG: 2697 bcopy((void *)(opt + 2), (void *)&mss, 2); 2698 NTOHS(mss); 2699 /* FALLTHROUGH */ 2700 default: 2701 optlen = opt[1]; 2702 if (optlen < 2) 2703 optlen = 2; 2704 hlen -= optlen; 2705 opt += optlen; 2706 break; 2707 } 2708 } 2709 return (mss); 2710 } 2711 2712 u_int16_t 2713 pf_calc_mss(struct pf_addr *addr, sa_family_t af, u_int16_t offer) 2714 { 2715 union { 2716 struct sockaddr dst; 2717 struct sockaddr_in dst4; 2718 struct sockaddr_in6 dst6; 2719 } u; 2720 struct route ro; 2721 struct route *rop = &ro; 2722 int hlen; 2723 u_int16_t mss = tcp_mssdflt; 2724 2725 hlen = 0; /* XXXGCC - -Wunitialized m68k */ 2726 2727 memset(&ro, 0, sizeof(ro)); 2728 switch (af) { 2729 #ifdef INET 2730 case AF_INET: 2731 hlen = sizeof(struct ip); 2732 sockaddr_in_init(&u.dst4, &addr->v4, 0); 2733 rtcache_setdst(rop, &u.dst); 2734 break; 2735 #endif /* INET */ 2736 #ifdef INET6 2737 case AF_INET6: 2738 hlen = sizeof(struct ip6_hdr); 2739 sockaddr_in6_init(&u.dst6, &addr->v6, 0, 0, 0); 2740 rtcache_setdst(rop, &u.dst); 2741 break; 2742 #endif /* INET6 */ 2743 } 2744 2745 #ifdef __OpenBSD__ 2746 rtalloc_noclone(rop, NO_CLONING); 2747 #else 2748 rtcache_init_noclone(rop); 2749 #endif 2750 if (rop->ro_rt != NULL) { 2751 mss = rop->ro_rt->rt_ifp->if_mtu - hlen - sizeof(struct tcphdr); 2752 mss = max(tcp_mssdflt, mss); 2753 } 2754 rtcache_free(rop); 2755 mss = min(mss, offer); 2756 mss = max(mss, 64); /* sanity - at least max opt space */ 2757 return (mss); 2758 } 2759 2760 void 2761 pf_set_rt_ifp(struct pf_state *s, struct pf_addr *saddr) 2762 { 2763 struct pf_rule *r = s->rule.ptr; 2764 2765 s->rt_kif = NULL; 2766 if (!r->rt || r->rt == PF_FASTROUTE) 2767 return; 2768 switch (s->af) { 2769 #ifdef INET 2770 case AF_INET: 2771 pf_map_addr(AF_INET, r, saddr, &s->rt_addr, NULL, 2772 &s->nat_src_node); 2773 s->rt_kif = r->rpool.cur->kif; 2774 break; 2775 #endif /* INET */ 2776 #ifdef INET6 2777 case AF_INET6: 2778 pf_map_addr(AF_INET6, r, saddr, &s->rt_addr, NULL, 2779 &s->nat_src_node); 2780 s->rt_kif = r->rpool.cur->kif; 2781 break; 2782 #endif /* INET6 */ 2783 } 2784 } 2785 2786 int 2787 pf_test_tcp(struct pf_rule **rm, struct pf_state **sm, int direction, 2788 struct pfi_kif *kif, struct mbuf *m, int off, void *h, 2789 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm, 2790 struct ifqueue *ifq) 2791 { 2792 struct pf_rule *nr = NULL; 2793 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 2794 struct tcphdr *th = pd->hdr.tcp; 2795 u_int16_t bport, nport = 0; 2796 sa_family_t af = pd->af; 2797 int lookup = -1; 2798 uid_t uid = 0; /* XXX: GCC */ 2799 gid_t gid = 0; /* XXX: GCC */ 2800 struct pf_rule *r, *a = NULL; 2801 struct pf_ruleset *ruleset = NULL; 2802 struct pf_src_node *nsn = NULL; 2803 u_short reason; 2804 int rewrite = 0; 2805 struct pf_tag *pftag = NULL; 2806 int tag = -1; 2807 u_int16_t mss = tcp_mssdflt; 2808 int asd = 0; 2809 2810 if (pf_check_congestion(ifq)) { 2811 REASON_SET(&reason, PFRES_CONGEST); 2812 return (PF_DROP); 2813 } 2814 2815 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 2816 2817 if (direction == PF_OUT) { 2818 bport = nport = th->th_sport; 2819 /* check outgoing packet for BINAT/NAT */ 2820 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn, 2821 saddr, th->th_sport, daddr, th->th_dport, 2822 &pd->naddr, &nport)) != NULL) { 2823 PF_ACPY(&pd->baddr, saddr, af); 2824 pf_change_ap(saddr, &th->th_sport, pd->ip_sum, 2825 &th->th_sum, &pd->naddr, nport, 0, af); 2826 rewrite++; 2827 if (nr->natpass) 2828 r = NULL; 2829 pd->nat_rule = nr; 2830 } 2831 } else { 2832 bport = nport = th->th_dport; 2833 /* check incoming packet for BINAT/RDR */ 2834 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn, 2835 saddr, th->th_sport, daddr, th->th_dport, 2836 &pd->naddr, &nport)) != NULL) { 2837 PF_ACPY(&pd->baddr, daddr, af); 2838 pf_change_ap(daddr, &th->th_dport, pd->ip_sum, 2839 &th->th_sum, &pd->naddr, nport, 0, af); 2840 rewrite++; 2841 if (nr->natpass) 2842 r = NULL; 2843 pd->nat_rule = nr; 2844 } 2845 } 2846 2847 while (r != NULL) { 2848 r->evaluations++; 2849 if (r->kif != NULL && 2850 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 2851 r = r->skip[PF_SKIP_IFP].ptr; 2852 else if (r->direction && r->direction != direction) 2853 r = r->skip[PF_SKIP_DIR].ptr; 2854 else if (r->af && r->af != af) 2855 r = r->skip[PF_SKIP_AF].ptr; 2856 else if (r->proto && r->proto != IPPROTO_TCP) 2857 r = r->skip[PF_SKIP_PROTO].ptr; 2858 else if (PF_MISMATCHAW(&r->src.addr, saddr, af, r->src.neg)) 2859 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 2860 else if (r->src.port_op && !pf_match_port(r->src.port_op, 2861 r->src.port[0], r->src.port[1], th->th_sport)) 2862 r = r->skip[PF_SKIP_SRC_PORT].ptr; 2863 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af, r->dst.neg)) 2864 r = r->skip[PF_SKIP_DST_ADDR].ptr; 2865 else if (r->dst.port_op && !pf_match_port(r->dst.port_op, 2866 r->dst.port[0], r->dst.port[1], th->th_dport)) 2867 r = r->skip[PF_SKIP_DST_PORT].ptr; 2868 else if (r->tos && !(r->tos & pd->tos)) 2869 r = TAILQ_NEXT(r, entries); 2870 else if (r->rule_flag & PFRULE_FRAGMENT) 2871 r = TAILQ_NEXT(r, entries); 2872 else if ((r->flagset & th->th_flags) != r->flags) 2873 r = TAILQ_NEXT(r, entries); 2874 else if (r->uid.op && (lookup != -1 || (lookup = 2875 pf_socket_lookup(&uid, &gid, direction, pd), 1)) && 2876 !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1], 2877 uid)) 2878 r = TAILQ_NEXT(r, entries); 2879 else if (r->gid.op && (lookup != -1 || (lookup = 2880 pf_socket_lookup(&uid, &gid, direction, pd), 1)) && 2881 !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1], 2882 gid)) 2883 r = TAILQ_NEXT(r, entries); 2884 else if (r->prob && r->prob <= arc4random()) 2885 r = TAILQ_NEXT(r, entries); 2886 else if (r->match_tag && !pf_match_tag(m, r, &pftag, &tag)) 2887 r = TAILQ_NEXT(r, entries); 2888 else if (r->os_fingerprint != PF_OSFP_ANY && !pf_osfp_match( 2889 pf_osfp_fingerprint(pd, m, off, th), r->os_fingerprint)) 2890 r = TAILQ_NEXT(r, entries); 2891 else { 2892 if (r->tag) 2893 tag = r->tag; 2894 if (r->anchor == NULL) { 2895 *rm = r; 2896 *am = a; 2897 *rsm = ruleset; 2898 if ((*rm)->quick) 2899 break; 2900 r = TAILQ_NEXT(r, entries); 2901 } else 2902 pf_step_into_anchor(&asd, &ruleset, 2903 PF_RULESET_FILTER, &r, &a); 2904 } 2905 if (r == NULL) 2906 pf_step_out_of_anchor(&asd, &ruleset, 2907 PF_RULESET_FILTER, &r, &a); 2908 } 2909 r = *rm; 2910 a = *am; 2911 ruleset = *rsm; 2912 2913 REASON_SET(&reason, PFRES_MATCH); 2914 2915 if (r->log) { 2916 if (rewrite) 2917 m_copyback(m, off, sizeof(*th), th); 2918 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset); 2919 } 2920 2921 if ((r->action == PF_DROP) && 2922 ((r->rule_flag & PFRULE_RETURNRST) || 2923 (r->rule_flag & PFRULE_RETURNICMP) || 2924 (r->rule_flag & PFRULE_RETURN))) { 2925 /* undo NAT changes, if they have taken place */ 2926 if (nr != NULL) { 2927 if (direction == PF_OUT) { 2928 pf_change_ap(saddr, &th->th_sport, pd->ip_sum, 2929 &th->th_sum, &pd->baddr, bport, 0, af); 2930 rewrite++; 2931 } else { 2932 pf_change_ap(daddr, &th->th_dport, pd->ip_sum, 2933 &th->th_sum, &pd->baddr, bport, 0, af); 2934 rewrite++; 2935 } 2936 } 2937 if (((r->rule_flag & PFRULE_RETURNRST) || 2938 (r->rule_flag & PFRULE_RETURN)) && 2939 !(th->th_flags & TH_RST)) { 2940 u_int32_t ack = ntohl(th->th_seq) + pd->p_len; 2941 2942 if (th->th_flags & TH_SYN) 2943 ack++; 2944 if (th->th_flags & TH_FIN) 2945 ack++; 2946 pf_send_tcp(r, af, pd->dst, 2947 pd->src, th->th_dport, th->th_sport, 2948 ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0, 2949 r->return_ttl, 1, 0, pd->eh, kif->pfik_ifp); 2950 } else if ((af == AF_INET) && r->return_icmp) 2951 pf_send_icmp(m, r->return_icmp >> 8, 2952 r->return_icmp & 255, af, r); 2953 else if ((af == AF_INET6) && r->return_icmp6) 2954 pf_send_icmp(m, r->return_icmp6 >> 8, 2955 r->return_icmp6 & 255, af, r); 2956 } 2957 2958 if (r->action == PF_DROP) 2959 return (PF_DROP); 2960 2961 if (pf_tag_packet(m, pftag, tag)) { 2962 REASON_SET(&reason, PFRES_MEMORY); 2963 return (PF_DROP); 2964 } 2965 2966 if (r->keep_state || nr != NULL || 2967 (pd->flags & PFDESC_TCP_NORM)) { 2968 /* create new state */ 2969 u_int16_t len; 2970 struct pf_state *s = NULL; 2971 struct pf_src_node *sn = NULL; 2972 2973 len = pd->tot_len - off - (th->th_off << 2); 2974 2975 /* check maximums */ 2976 if (r->max_states && (r->states >= r->max_states)) { 2977 pf_status.lcounters[LCNT_STATES]++; 2978 REASON_SET(&reason, PFRES_MAXSTATES); 2979 goto cleanup; 2980 } 2981 /* src node for flter rule */ 2982 if ((r->rule_flag & PFRULE_SRCTRACK || 2983 r->rpool.opts & PF_POOL_STICKYADDR) && 2984 pf_insert_src_node(&sn, r, saddr, af) != 0) { 2985 REASON_SET(&reason, PFRES_SRCLIMIT); 2986 goto cleanup; 2987 } 2988 /* src node for translation rule */ 2989 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) && 2990 ((direction == PF_OUT && 2991 pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) || 2992 (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) { 2993 REASON_SET(&reason, PFRES_SRCLIMIT); 2994 goto cleanup; 2995 } 2996 s = pool_get(&pf_state_pl, PR_NOWAIT); 2997 if (s == NULL) { 2998 REASON_SET(&reason, PFRES_MEMORY); 2999 cleanup: 3000 if (sn != NULL && sn->states == 0 && sn->expire == 0) { 3001 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn); 3002 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3003 pf_status.src_nodes--; 3004 pool_put(&pf_src_tree_pl, sn); 3005 } 3006 if (nsn != sn && nsn != NULL && nsn->states == 0 && 3007 nsn->expire == 0) { 3008 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn); 3009 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3010 pf_status.src_nodes--; 3011 pool_put(&pf_src_tree_pl, nsn); 3012 } 3013 return (PF_DROP); 3014 } 3015 bzero(s, sizeof(*s)); 3016 s->rule.ptr = r; 3017 s->nat_rule.ptr = nr; 3018 s->anchor.ptr = a; 3019 STATE_INC_COUNTERS(s); 3020 s->allow_opts = r->allow_opts; 3021 s->log = r->log & 2; 3022 s->proto = IPPROTO_TCP; 3023 s->direction = direction; 3024 s->af = af; 3025 if (direction == PF_OUT) { 3026 PF_ACPY(&s->gwy.addr, saddr, af); 3027 s->gwy.port = th->th_sport; /* sport */ 3028 PF_ACPY(&s->ext.addr, daddr, af); 3029 s->ext.port = th->th_dport; 3030 if (nr != NULL) { 3031 PF_ACPY(&s->lan.addr, &pd->baddr, af); 3032 s->lan.port = bport; 3033 } else { 3034 PF_ACPY(&s->lan.addr, &s->gwy.addr, af); 3035 s->lan.port = s->gwy.port; 3036 } 3037 } else { 3038 PF_ACPY(&s->lan.addr, daddr, af); 3039 s->lan.port = th->th_dport; 3040 PF_ACPY(&s->ext.addr, saddr, af); 3041 s->ext.port = th->th_sport; 3042 if (nr != NULL) { 3043 PF_ACPY(&s->gwy.addr, &pd->baddr, af); 3044 s->gwy.port = bport; 3045 } else { 3046 PF_ACPY(&s->gwy.addr, &s->lan.addr, af); 3047 s->gwy.port = s->lan.port; 3048 } 3049 } 3050 3051 s->src.seqlo = ntohl(th->th_seq); 3052 s->src.seqhi = s->src.seqlo + len + 1; 3053 if ((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN && 3054 r->keep_state == PF_STATE_MODULATE) { 3055 /* Generate sequence number modulator */ 3056 while ((s->src.seqdiff = htonl(arc4random())) == 0) 3057 ; 3058 pf_change_a(&th->th_seq, &th->th_sum, 3059 htonl(s->src.seqlo + s->src.seqdiff), 0); 3060 rewrite = 1; 3061 } else 3062 s->src.seqdiff = 0; 3063 s->src.max_win = MAX(ntohs(th->th_win), 1); 3064 if (th->th_flags & TH_SYN) { 3065 s->src.seqhi++; 3066 s->src.wscale = pf_get_wscale(m, off, th->th_off, af); 3067 } else if (s->src.wscale & PF_WSCALE_MASK) { 3068 /* Remove scale factor from initial window */ 3069 u_int win = s->src.max_win; 3070 win += 1 << (s->src.wscale & PF_WSCALE_MASK); 3071 s->src.max_win = (win - 1) >> 3072 (s->src.wscale & PF_WSCALE_MASK); 3073 } 3074 if (th->th_flags & TH_FIN) 3075 s->src.seqhi++; 3076 s->dst.seqhi = 1; 3077 s->dst.max_win = 1; 3078 s->src.state = TCPS_SYN_SENT; 3079 s->dst.state = TCPS_CLOSED; 3080 s->creation = time_second; 3081 s->expire = time_second; 3082 s->timeout = PFTM_TCP_FIRST_PACKET; 3083 pf_set_rt_ifp(s, saddr); 3084 if (sn != NULL) { 3085 s->src_node = sn; 3086 s->src_node->states++; 3087 } 3088 if (nsn != NULL) { 3089 PF_ACPY(&nsn->raddr, &pd->naddr, af); 3090 s->nat_src_node = nsn; 3091 s->nat_src_node->states++; 3092 } 3093 if ((pd->flags & PFDESC_TCP_NORM) && pf_normalize_tcp_init(m, 3094 off, pd, th, &s->src, &s->dst)) { 3095 REASON_SET(&reason, PFRES_MEMORY); 3096 pf_src_tree_remove_state(s); 3097 STATE_DEC_COUNTERS(s); 3098 pool_put(&pf_state_pl, s); 3099 return (PF_DROP); 3100 } 3101 if ((pd->flags & PFDESC_TCP_NORM) && s->src.scrub && 3102 pf_normalize_tcp_stateful(m, off, pd, &reason, th, s, 3103 &s->src, &s->dst, &rewrite)) { 3104 /* This really shouldn't happen!!! */ 3105 DPFPRINTF(PF_DEBUG_URGENT, 3106 ("pf_normalize_tcp_stateful failed on first pkt")); 3107 pf_normalize_tcp_cleanup(s); 3108 pf_src_tree_remove_state(s); 3109 STATE_DEC_COUNTERS(s); 3110 pool_put(&pf_state_pl, s); 3111 return (PF_DROP); 3112 } 3113 if (pf_insert_state(bound_iface(r, nr, kif), s)) { 3114 pf_normalize_tcp_cleanup(s); 3115 REASON_SET(&reason, PFRES_STATEINS); 3116 pf_src_tree_remove_state(s); 3117 STATE_DEC_COUNTERS(s); 3118 pool_put(&pf_state_pl, s); 3119 return (PF_DROP); 3120 } else 3121 *sm = s; 3122 if (tag > 0) { 3123 pf_tag_ref(tag); 3124 s->tag = tag; 3125 } 3126 if ((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN && 3127 r->keep_state == PF_STATE_SYNPROXY) { 3128 s->src.state = PF_TCPS_PROXY_SRC; 3129 if (nr != NULL) { 3130 if (direction == PF_OUT) { 3131 pf_change_ap(saddr, &th->th_sport, 3132 pd->ip_sum, &th->th_sum, &pd->baddr, 3133 bport, 0, af); 3134 } else { 3135 pf_change_ap(daddr, &th->th_dport, 3136 pd->ip_sum, &th->th_sum, &pd->baddr, 3137 bport, 0, af); 3138 } 3139 } 3140 s->src.seqhi = htonl(arc4random()); 3141 /* Find mss option */ 3142 mss = pf_get_mss(m, off, th->th_off, af); 3143 mss = pf_calc_mss(saddr, af, mss); 3144 mss = pf_calc_mss(daddr, af, mss); 3145 s->src.mss = mss; 3146 pf_send_tcp(r, af, daddr, saddr, th->th_dport, 3147 th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1, 3148 TH_SYN|TH_ACK, 0, s->src.mss, 0, 1, 0, NULL, NULL); 3149 REASON_SET(&reason, PFRES_SYNPROXY); 3150 return (PF_SYNPROXY_DROP); 3151 } 3152 } 3153 3154 /* copy back packet headers if we performed NAT operations */ 3155 if (rewrite) 3156 m_copyback(m, off, sizeof(*th), th); 3157 3158 return (PF_PASS); 3159 } 3160 3161 int 3162 pf_test_udp(struct pf_rule **rm, struct pf_state **sm, int direction, 3163 struct pfi_kif *kif, struct mbuf *m, int off, void *h, 3164 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm, 3165 struct ifqueue *ifq) 3166 { 3167 struct pf_rule *nr = NULL; 3168 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 3169 struct udphdr *uh = pd->hdr.udp; 3170 u_int16_t bport, nport = 0; 3171 sa_family_t af = pd->af; 3172 int lookup = -1; 3173 uid_t uid = 0; /* XXX: GCC */ 3174 gid_t gid = 0; /* XXX: GCC */ 3175 struct pf_rule *r, *a = NULL; 3176 struct pf_ruleset *ruleset = NULL; 3177 struct pf_src_node *nsn = NULL; 3178 u_short reason; 3179 int rewrite = 0; 3180 struct pf_tag *pftag = NULL; 3181 int tag = -1; 3182 int asd = 0; 3183 3184 if (pf_check_congestion(ifq)) { 3185 REASON_SET(&reason, PFRES_CONGEST); 3186 return (PF_DROP); 3187 } 3188 3189 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 3190 3191 if (direction == PF_OUT) { 3192 bport = nport = uh->uh_sport; 3193 /* check outgoing packet for BINAT/NAT */ 3194 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn, 3195 saddr, uh->uh_sport, daddr, uh->uh_dport, 3196 &pd->naddr, &nport)) != NULL) { 3197 PF_ACPY(&pd->baddr, saddr, af); 3198 pf_change_ap(saddr, &uh->uh_sport, pd->ip_sum, 3199 &uh->uh_sum, &pd->naddr, nport, 1, af); 3200 rewrite++; 3201 if (nr->natpass) 3202 r = NULL; 3203 pd->nat_rule = nr; 3204 } 3205 } else { 3206 bport = nport = uh->uh_dport; 3207 /* check incoming packet for BINAT/RDR */ 3208 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn, 3209 saddr, uh->uh_sport, daddr, uh->uh_dport, &pd->naddr, 3210 &nport)) != NULL) { 3211 PF_ACPY(&pd->baddr, daddr, af); 3212 pf_change_ap(daddr, &uh->uh_dport, pd->ip_sum, 3213 &uh->uh_sum, &pd->naddr, nport, 1, af); 3214 rewrite++; 3215 if (nr->natpass) 3216 r = NULL; 3217 pd->nat_rule = nr; 3218 } 3219 } 3220 3221 while (r != NULL) { 3222 r->evaluations++; 3223 if (r->kif != NULL && 3224 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 3225 r = r->skip[PF_SKIP_IFP].ptr; 3226 else if (r->direction && r->direction != direction) 3227 r = r->skip[PF_SKIP_DIR].ptr; 3228 else if (r->af && r->af != af) 3229 r = r->skip[PF_SKIP_AF].ptr; 3230 else if (r->proto && r->proto != IPPROTO_UDP) 3231 r = r->skip[PF_SKIP_PROTO].ptr; 3232 else if (PF_MISMATCHAW(&r->src.addr, saddr, af, r->src.neg)) 3233 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 3234 else if (r->src.port_op && !pf_match_port(r->src.port_op, 3235 r->src.port[0], r->src.port[1], uh->uh_sport)) 3236 r = r->skip[PF_SKIP_SRC_PORT].ptr; 3237 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af, r->dst.neg)) 3238 r = r->skip[PF_SKIP_DST_ADDR].ptr; 3239 else if (r->dst.port_op && !pf_match_port(r->dst.port_op, 3240 r->dst.port[0], r->dst.port[1], uh->uh_dport)) 3241 r = r->skip[PF_SKIP_DST_PORT].ptr; 3242 else if (r->tos && !(r->tos & pd->tos)) 3243 r = TAILQ_NEXT(r, entries); 3244 else if (r->rule_flag & PFRULE_FRAGMENT) 3245 r = TAILQ_NEXT(r, entries); 3246 else if (r->uid.op && (lookup != -1 || (lookup = 3247 pf_socket_lookup(&uid, &gid, direction, pd), 1)) && 3248 !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1], 3249 uid)) 3250 r = TAILQ_NEXT(r, entries); 3251 else if (r->gid.op && (lookup != -1 || (lookup = 3252 pf_socket_lookup(&uid, &gid, direction, pd), 1)) && 3253 !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1], 3254 gid)) 3255 r = TAILQ_NEXT(r, entries); 3256 else if (r->prob && r->prob <= arc4random()) 3257 r = TAILQ_NEXT(r, entries); 3258 else if (r->match_tag && !pf_match_tag(m, r, &pftag, &tag)) 3259 r = TAILQ_NEXT(r, entries); 3260 else if (r->os_fingerprint != PF_OSFP_ANY) 3261 r = TAILQ_NEXT(r, entries); 3262 else { 3263 if (r->tag) 3264 tag = r->tag; 3265 if (r->anchor == NULL) { 3266 *rm = r; 3267 *am = a; 3268 *rsm = ruleset; 3269 if ((*rm)->quick) 3270 break; 3271 r = TAILQ_NEXT(r, entries); 3272 } else 3273 pf_step_into_anchor(&asd, &ruleset, 3274 PF_RULESET_FILTER, &r, &a); 3275 } 3276 if (r == NULL) 3277 pf_step_out_of_anchor(&asd, &ruleset, 3278 PF_RULESET_FILTER, &r, &a); 3279 } 3280 r = *rm; 3281 a = *am; 3282 ruleset = *rsm; 3283 3284 REASON_SET(&reason, PFRES_MATCH); 3285 3286 if (r->log) { 3287 if (rewrite) 3288 m_copyback(m, off, sizeof(*uh), uh); 3289 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset); 3290 } 3291 3292 if ((r->action == PF_DROP) && 3293 ((r->rule_flag & PFRULE_RETURNICMP) || 3294 (r->rule_flag & PFRULE_RETURN))) { 3295 /* undo NAT changes, if they have taken place */ 3296 if (nr != NULL) { 3297 if (direction == PF_OUT) { 3298 pf_change_ap(saddr, &uh->uh_sport, pd->ip_sum, 3299 &uh->uh_sum, &pd->baddr, bport, 1, af); 3300 rewrite++; 3301 } else { 3302 pf_change_ap(daddr, &uh->uh_dport, pd->ip_sum, 3303 &uh->uh_sum, &pd->baddr, bport, 1, af); 3304 rewrite++; 3305 } 3306 } 3307 if ((af == AF_INET) && r->return_icmp) 3308 pf_send_icmp(m, r->return_icmp >> 8, 3309 r->return_icmp & 255, af, r); 3310 else if ((af == AF_INET6) && r->return_icmp6) 3311 pf_send_icmp(m, r->return_icmp6 >> 8, 3312 r->return_icmp6 & 255, af, r); 3313 } 3314 3315 if (r->action == PF_DROP) 3316 return (PF_DROP); 3317 3318 if (pf_tag_packet(m, pftag, tag)) { 3319 REASON_SET(&reason, PFRES_MEMORY); 3320 return (PF_DROP); 3321 } 3322 3323 if (r->keep_state || nr != NULL) { 3324 /* create new state */ 3325 struct pf_state *s = NULL; 3326 struct pf_src_node *sn = NULL; 3327 3328 /* check maximums */ 3329 if (r->max_states && (r->states >= r->max_states)) { 3330 pf_status.lcounters[LCNT_STATES]++; 3331 REASON_SET(&reason, PFRES_MAXSTATES); 3332 goto cleanup; 3333 } 3334 /* src node for flter rule */ 3335 if ((r->rule_flag & PFRULE_SRCTRACK || 3336 r->rpool.opts & PF_POOL_STICKYADDR) && 3337 pf_insert_src_node(&sn, r, saddr, af) != 0) { 3338 REASON_SET(&reason, PFRES_SRCLIMIT); 3339 goto cleanup; 3340 } 3341 /* src node for translation rule */ 3342 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) && 3343 ((direction == PF_OUT && 3344 pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) || 3345 (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) { 3346 REASON_SET(&reason, PFRES_SRCLIMIT); 3347 goto cleanup; 3348 } 3349 s = pool_get(&pf_state_pl, PR_NOWAIT); 3350 if (s == NULL) { 3351 REASON_SET(&reason, PFRES_MEMORY); 3352 cleanup: 3353 if (sn != NULL && sn->states == 0 && sn->expire == 0) { 3354 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn); 3355 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3356 pf_status.src_nodes--; 3357 pool_put(&pf_src_tree_pl, sn); 3358 } 3359 if (nsn != sn && nsn != NULL && nsn->states == 0 && 3360 nsn->expire == 0) { 3361 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn); 3362 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3363 pf_status.src_nodes--; 3364 pool_put(&pf_src_tree_pl, nsn); 3365 } 3366 return (PF_DROP); 3367 } 3368 bzero(s, sizeof(*s)); 3369 s->rule.ptr = r; 3370 s->nat_rule.ptr = nr; 3371 s->anchor.ptr = a; 3372 STATE_INC_COUNTERS(s); 3373 s->allow_opts = r->allow_opts; 3374 s->log = r->log & 2; 3375 s->proto = IPPROTO_UDP; 3376 s->direction = direction; 3377 s->af = af; 3378 if (direction == PF_OUT) { 3379 PF_ACPY(&s->gwy.addr, saddr, af); 3380 s->gwy.port = uh->uh_sport; 3381 PF_ACPY(&s->ext.addr, daddr, af); 3382 s->ext.port = uh->uh_dport; 3383 if (nr != NULL) { 3384 PF_ACPY(&s->lan.addr, &pd->baddr, af); 3385 s->lan.port = bport; 3386 } else { 3387 PF_ACPY(&s->lan.addr, &s->gwy.addr, af); 3388 s->lan.port = s->gwy.port; 3389 } 3390 } else { 3391 PF_ACPY(&s->lan.addr, daddr, af); 3392 s->lan.port = uh->uh_dport; 3393 PF_ACPY(&s->ext.addr, saddr, af); 3394 s->ext.port = uh->uh_sport; 3395 if (nr != NULL) { 3396 PF_ACPY(&s->gwy.addr, &pd->baddr, af); 3397 s->gwy.port = bport; 3398 } else { 3399 PF_ACPY(&s->gwy.addr, &s->lan.addr, af); 3400 s->gwy.port = s->lan.port; 3401 } 3402 } 3403 s->src.state = PFUDPS_SINGLE; 3404 s->dst.state = PFUDPS_NO_TRAFFIC; 3405 s->creation = time_second; 3406 s->expire = time_second; 3407 s->timeout = PFTM_UDP_FIRST_PACKET; 3408 pf_set_rt_ifp(s, saddr); 3409 if (sn != NULL) { 3410 s->src_node = sn; 3411 s->src_node->states++; 3412 } 3413 if (nsn != NULL) { 3414 PF_ACPY(&nsn->raddr, &pd->naddr, af); 3415 s->nat_src_node = nsn; 3416 s->nat_src_node->states++; 3417 } 3418 if (pf_insert_state(bound_iface(r, nr, kif), s)) { 3419 REASON_SET(&reason, PFRES_STATEINS); 3420 pf_src_tree_remove_state(s); 3421 STATE_DEC_COUNTERS(s); 3422 pool_put(&pf_state_pl, s); 3423 return (PF_DROP); 3424 } else 3425 *sm = s; 3426 if (tag > 0) { 3427 pf_tag_ref(tag); 3428 s->tag = tag; 3429 } 3430 } 3431 3432 /* copy back packet headers if we performed NAT operations */ 3433 if (rewrite) 3434 m_copyback(m, off, sizeof(*uh), uh); 3435 3436 return (PF_PASS); 3437 } 3438 3439 int 3440 pf_test_icmp(struct pf_rule **rm, struct pf_state **sm, int direction, 3441 struct pfi_kif *kif, struct mbuf *m, int off, void *h, 3442 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm, 3443 struct ifqueue *ifq) 3444 { 3445 struct pf_rule *nr = NULL; 3446 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 3447 struct pf_rule *r, *a = NULL; 3448 struct pf_ruleset *ruleset = NULL; 3449 struct pf_src_node *nsn = NULL; 3450 u_short reason; 3451 u_int16_t icmpid = 0; 3452 sa_family_t af = pd->af; 3453 u_int8_t icmptype = 0, icmpcode = 0; 3454 int state_icmp = 0; 3455 struct pf_tag *pftag = NULL; 3456 int tag = -1; 3457 #ifdef INET6 3458 int rewrite = 0; 3459 #endif /* INET6 */ 3460 int asd = 0; 3461 3462 if (pf_check_congestion(ifq)) { 3463 REASON_SET(&reason, PFRES_CONGEST); 3464 return (PF_DROP); 3465 } 3466 3467 switch (pd->proto) { 3468 #ifdef INET 3469 case IPPROTO_ICMP: 3470 icmptype = pd->hdr.icmp->icmp_type; 3471 icmpcode = pd->hdr.icmp->icmp_code; 3472 icmpid = pd->hdr.icmp->icmp_id; 3473 3474 if (icmptype == ICMP_UNREACH || 3475 icmptype == ICMP_SOURCEQUENCH || 3476 icmptype == ICMP_REDIRECT || 3477 icmptype == ICMP_TIMXCEED || 3478 icmptype == ICMP_PARAMPROB) 3479 state_icmp++; 3480 break; 3481 #endif /* INET */ 3482 #ifdef INET6 3483 case IPPROTO_ICMPV6: 3484 icmptype = pd->hdr.icmp6->icmp6_type; 3485 icmpcode = pd->hdr.icmp6->icmp6_code; 3486 icmpid = pd->hdr.icmp6->icmp6_id; 3487 3488 if (icmptype == ICMP6_DST_UNREACH || 3489 icmptype == ICMP6_PACKET_TOO_BIG || 3490 icmptype == ICMP6_TIME_EXCEEDED || 3491 icmptype == ICMP6_PARAM_PROB) 3492 state_icmp++; 3493 break; 3494 #endif /* INET6 */ 3495 } 3496 3497 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 3498 3499 if (direction == PF_OUT) { 3500 /* check outgoing packet for BINAT/NAT */ 3501 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn, 3502 saddr, icmpid, daddr, icmpid, &pd->naddr, NULL)) != NULL) { 3503 PF_ACPY(&pd->baddr, saddr, af); 3504 switch (af) { 3505 #ifdef INET 3506 case AF_INET: 3507 pf_change_a(&saddr->v4.s_addr, pd->ip_sum, 3508 pd->naddr.v4.s_addr, 0); 3509 break; 3510 #endif /* INET */ 3511 #ifdef INET6 3512 case AF_INET6: 3513 pf_change_a6(saddr, &pd->hdr.icmp6->icmp6_cksum, 3514 &pd->naddr, 0); 3515 rewrite++; 3516 break; 3517 #endif /* INET6 */ 3518 } 3519 if (nr->natpass) 3520 r = NULL; 3521 pd->nat_rule = nr; 3522 } 3523 } else { 3524 /* check incoming packet for BINAT/RDR */ 3525 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn, 3526 saddr, icmpid, daddr, icmpid, &pd->naddr, NULL)) != NULL) { 3527 PF_ACPY(&pd->baddr, daddr, af); 3528 switch (af) { 3529 #ifdef INET 3530 case AF_INET: 3531 pf_change_a(&daddr->v4.s_addr, 3532 pd->ip_sum, pd->naddr.v4.s_addr, 0); 3533 break; 3534 #endif /* INET */ 3535 #ifdef INET6 3536 case AF_INET6: 3537 pf_change_a6(daddr, &pd->hdr.icmp6->icmp6_cksum, 3538 &pd->naddr, 0); 3539 rewrite++; 3540 break; 3541 #endif /* INET6 */ 3542 } 3543 if (nr->natpass) 3544 r = NULL; 3545 pd->nat_rule = nr; 3546 } 3547 } 3548 3549 while (r != NULL) { 3550 r->evaluations++; 3551 if (r->kif != NULL && 3552 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 3553 r = r->skip[PF_SKIP_IFP].ptr; 3554 else if (r->direction && r->direction != direction) 3555 r = r->skip[PF_SKIP_DIR].ptr; 3556 else if (r->af && r->af != af) 3557 r = r->skip[PF_SKIP_AF].ptr; 3558 else if (r->proto && r->proto != pd->proto) 3559 r = r->skip[PF_SKIP_PROTO].ptr; 3560 else if (PF_MISMATCHAW(&r->src.addr, saddr, af, r->src.neg)) 3561 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 3562 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af, r->dst.neg)) 3563 r = r->skip[PF_SKIP_DST_ADDR].ptr; 3564 else if (r->type && r->type != icmptype + 1) 3565 r = TAILQ_NEXT(r, entries); 3566 else if (r->code && r->code != icmpcode + 1) 3567 r = TAILQ_NEXT(r, entries); 3568 else if (r->tos && !(r->tos & pd->tos)) 3569 r = TAILQ_NEXT(r, entries); 3570 else if (r->rule_flag & PFRULE_FRAGMENT) 3571 r = TAILQ_NEXT(r, entries); 3572 else if (r->prob && r->prob <= arc4random()) 3573 r = TAILQ_NEXT(r, entries); 3574 else if (r->match_tag && !pf_match_tag(m, r, &pftag, &tag)) 3575 r = TAILQ_NEXT(r, entries); 3576 else if (r->os_fingerprint != PF_OSFP_ANY) 3577 r = TAILQ_NEXT(r, entries); 3578 else { 3579 if (r->tag) 3580 tag = r->tag; 3581 if (r->anchor == NULL) { 3582 *rm = r; 3583 *am = a; 3584 *rsm = ruleset; 3585 if ((*rm)->quick) 3586 break; 3587 r = TAILQ_NEXT(r, entries); 3588 } else 3589 pf_step_into_anchor(&asd, &ruleset, 3590 PF_RULESET_FILTER, &r, &a); 3591 } 3592 if (r == NULL) 3593 pf_step_out_of_anchor(&asd, &ruleset, 3594 PF_RULESET_FILTER, &r, &a); 3595 } 3596 r = *rm; 3597 a = *am; 3598 ruleset = *rsm; 3599 3600 REASON_SET(&reason, PFRES_MATCH); 3601 3602 if (r->log) { 3603 #ifdef INET6 3604 if (rewrite) 3605 m_copyback(m, off, sizeof(struct icmp6_hdr), 3606 pd->hdr.icmp6); 3607 #endif /* INET6 */ 3608 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset); 3609 } 3610 3611 if (r->action != PF_PASS) 3612 return (PF_DROP); 3613 3614 if (pf_tag_packet(m, pftag, tag)) { 3615 REASON_SET(&reason, PFRES_MEMORY); 3616 return (PF_DROP); 3617 } 3618 3619 if (!state_icmp && (r->keep_state || nr != NULL)) { 3620 /* create new state */ 3621 struct pf_state *s = NULL; 3622 struct pf_src_node *sn = NULL; 3623 3624 /* check maximums */ 3625 if (r->max_states && (r->states >= r->max_states)) { 3626 pf_status.lcounters[LCNT_STATES]++; 3627 REASON_SET(&reason, PFRES_MAXSTATES); 3628 goto cleanup; 3629 } 3630 /* src node for flter rule */ 3631 if ((r->rule_flag & PFRULE_SRCTRACK || 3632 r->rpool.opts & PF_POOL_STICKYADDR) && 3633 pf_insert_src_node(&sn, r, saddr, af) != 0) { 3634 REASON_SET(&reason, PFRES_SRCLIMIT); 3635 goto cleanup; 3636 } 3637 /* src node for translation rule */ 3638 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) && 3639 ((direction == PF_OUT && 3640 pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) || 3641 (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) { 3642 REASON_SET(&reason, PFRES_SRCLIMIT); 3643 goto cleanup; 3644 } 3645 s = pool_get(&pf_state_pl, PR_NOWAIT); 3646 if (s == NULL) { 3647 REASON_SET(&reason, PFRES_MEMORY); 3648 cleanup: 3649 if (sn != NULL && sn->states == 0 && sn->expire == 0) { 3650 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn); 3651 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3652 pf_status.src_nodes--; 3653 pool_put(&pf_src_tree_pl, sn); 3654 } 3655 if (nsn != sn && nsn != NULL && nsn->states == 0 && 3656 nsn->expire == 0) { 3657 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn); 3658 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3659 pf_status.src_nodes--; 3660 pool_put(&pf_src_tree_pl, nsn); 3661 } 3662 return (PF_DROP); 3663 } 3664 bzero(s, sizeof(*s)); 3665 s->rule.ptr = r; 3666 s->nat_rule.ptr = nr; 3667 s->anchor.ptr = a; 3668 STATE_INC_COUNTERS(s); 3669 s->allow_opts = r->allow_opts; 3670 s->log = r->log & 2; 3671 s->proto = pd->proto; 3672 s->direction = direction; 3673 s->af = af; 3674 if (direction == PF_OUT) { 3675 PF_ACPY(&s->gwy.addr, saddr, af); 3676 s->gwy.port = icmpid; 3677 PF_ACPY(&s->ext.addr, daddr, af); 3678 s->ext.port = icmpid; 3679 if (nr != NULL) 3680 PF_ACPY(&s->lan.addr, &pd->baddr, af); 3681 else 3682 PF_ACPY(&s->lan.addr, &s->gwy.addr, af); 3683 s->lan.port = icmpid; 3684 } else { 3685 PF_ACPY(&s->lan.addr, daddr, af); 3686 s->lan.port = icmpid; 3687 PF_ACPY(&s->ext.addr, saddr, af); 3688 s->ext.port = icmpid; 3689 if (nr != NULL) 3690 PF_ACPY(&s->gwy.addr, &pd->baddr, af); 3691 else 3692 PF_ACPY(&s->gwy.addr, &s->lan.addr, af); 3693 s->gwy.port = icmpid; 3694 } 3695 s->creation = time_second; 3696 s->expire = time_second; 3697 s->timeout = PFTM_ICMP_FIRST_PACKET; 3698 pf_set_rt_ifp(s, saddr); 3699 if (sn != NULL) { 3700 s->src_node = sn; 3701 s->src_node->states++; 3702 } 3703 if (nsn != NULL) { 3704 PF_ACPY(&nsn->raddr, &pd->naddr, af); 3705 s->nat_src_node = nsn; 3706 s->nat_src_node->states++; 3707 } 3708 if (pf_insert_state(bound_iface(r, nr, kif), s)) { 3709 REASON_SET(&reason, PFRES_STATEINS); 3710 pf_src_tree_remove_state(s); 3711 STATE_DEC_COUNTERS(s); 3712 pool_put(&pf_state_pl, s); 3713 return (PF_DROP); 3714 } else 3715 *sm = s; 3716 if (tag > 0) { 3717 pf_tag_ref(tag); 3718 s->tag = tag; 3719 } 3720 } 3721 3722 #ifdef INET6 3723 /* copy back packet headers if we performed IPv6 NAT operations */ 3724 if (rewrite) 3725 m_copyback(m, off, sizeof(struct icmp6_hdr), 3726 pd->hdr.icmp6); 3727 #endif /* INET6 */ 3728 3729 return (PF_PASS); 3730 } 3731 3732 int 3733 pf_test_other(struct pf_rule **rm, struct pf_state **sm, int direction, 3734 struct pfi_kif *kif, struct mbuf *m, int off, void *h, 3735 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm, 3736 struct ifqueue *ifq) 3737 { 3738 struct pf_rule *nr = NULL; 3739 struct pf_rule *r, *a = NULL; 3740 struct pf_ruleset *ruleset = NULL; 3741 struct pf_src_node *nsn = NULL; 3742 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 3743 sa_family_t af = pd->af; 3744 u_short reason; 3745 struct pf_tag *pftag = NULL; 3746 int tag = -1; 3747 int asd = 0; 3748 3749 if (pf_check_congestion(ifq)) { 3750 REASON_SET(&reason, PFRES_CONGEST); 3751 return (PF_DROP); 3752 } 3753 3754 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 3755 3756 if (direction == PF_OUT) { 3757 /* check outgoing packet for BINAT/NAT */ 3758 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn, 3759 saddr, 0, daddr, 0, &pd->naddr, NULL)) != NULL) { 3760 PF_ACPY(&pd->baddr, saddr, af); 3761 switch (af) { 3762 #ifdef INET 3763 case AF_INET: 3764 pf_change_a(&saddr->v4.s_addr, pd->ip_sum, 3765 pd->naddr.v4.s_addr, 0); 3766 break; 3767 #endif /* INET */ 3768 #ifdef INET6 3769 case AF_INET6: 3770 PF_ACPY(saddr, &pd->naddr, af); 3771 break; 3772 #endif /* INET6 */ 3773 } 3774 if (nr->natpass) 3775 r = NULL; 3776 pd->nat_rule = nr; 3777 } 3778 } else { 3779 /* check incoming packet for BINAT/RDR */ 3780 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn, 3781 saddr, 0, daddr, 0, &pd->naddr, NULL)) != NULL) { 3782 PF_ACPY(&pd->baddr, daddr, af); 3783 switch (af) { 3784 #ifdef INET 3785 case AF_INET: 3786 pf_change_a(&daddr->v4.s_addr, 3787 pd->ip_sum, pd->naddr.v4.s_addr, 0); 3788 break; 3789 #endif /* INET */ 3790 #ifdef INET6 3791 case AF_INET6: 3792 PF_ACPY(daddr, &pd->naddr, af); 3793 break; 3794 #endif /* INET6 */ 3795 } 3796 if (nr->natpass) 3797 r = NULL; 3798 pd->nat_rule = nr; 3799 } 3800 } 3801 3802 while (r != NULL) { 3803 r->evaluations++; 3804 if (r->kif != NULL && 3805 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 3806 r = r->skip[PF_SKIP_IFP].ptr; 3807 else if (r->direction && r->direction != direction) 3808 r = r->skip[PF_SKIP_DIR].ptr; 3809 else if (r->af && r->af != af) 3810 r = r->skip[PF_SKIP_AF].ptr; 3811 else if (r->proto && r->proto != pd->proto) 3812 r = r->skip[PF_SKIP_PROTO].ptr; 3813 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af, r->src.neg)) 3814 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 3815 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af, r->dst.neg)) 3816 r = r->skip[PF_SKIP_DST_ADDR].ptr; 3817 else if (r->tos && !(r->tos & pd->tos)) 3818 r = TAILQ_NEXT(r, entries); 3819 else if (r->rule_flag & PFRULE_FRAGMENT) 3820 r = TAILQ_NEXT(r, entries); 3821 else if (r->prob && r->prob <= arc4random()) 3822 r = TAILQ_NEXT(r, entries); 3823 else if (r->match_tag && !pf_match_tag(m, r, &pftag, &tag)) 3824 r = TAILQ_NEXT(r, entries); 3825 else if (r->os_fingerprint != PF_OSFP_ANY) 3826 r = TAILQ_NEXT(r, entries); 3827 else { 3828 if (r->tag) 3829 tag = r->tag; 3830 if (r->anchor == NULL) { 3831 *rm = r; 3832 *am = a; 3833 *rsm = ruleset; 3834 if ((*rm)->quick) 3835 break; 3836 r = TAILQ_NEXT(r, entries); 3837 } else 3838 pf_step_into_anchor(&asd, &ruleset, 3839 PF_RULESET_FILTER, &r, &a); 3840 } 3841 if (r == NULL) 3842 pf_step_out_of_anchor(&asd, &ruleset, 3843 PF_RULESET_FILTER, &r, &a); 3844 } 3845 r = *rm; 3846 a = *am; 3847 ruleset = *rsm; 3848 3849 REASON_SET(&reason, PFRES_MATCH); 3850 3851 if (r->log) 3852 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset); 3853 3854 if ((r->action == PF_DROP) && 3855 ((r->rule_flag & PFRULE_RETURNICMP) || 3856 (r->rule_flag & PFRULE_RETURN))) { 3857 struct pf_addr *a = NULL; 3858 3859 if (nr != NULL) { 3860 if (direction == PF_OUT) 3861 a = saddr; 3862 else 3863 a = daddr; 3864 } 3865 if (a != NULL) { 3866 switch (af) { 3867 #ifdef INET 3868 case AF_INET: 3869 pf_change_a(&a->v4.s_addr, pd->ip_sum, 3870 pd->baddr.v4.s_addr, 0); 3871 break; 3872 #endif /* INET */ 3873 #ifdef INET6 3874 case AF_INET6: 3875 PF_ACPY(a, &pd->baddr, af); 3876 break; 3877 #endif /* INET6 */ 3878 } 3879 } 3880 if ((af == AF_INET) && r->return_icmp) 3881 pf_send_icmp(m, r->return_icmp >> 8, 3882 r->return_icmp & 255, af, r); 3883 else if ((af == AF_INET6) && r->return_icmp6) 3884 pf_send_icmp(m, r->return_icmp6 >> 8, 3885 r->return_icmp6 & 255, af, r); 3886 } 3887 3888 if (r->action != PF_PASS) 3889 return (PF_DROP); 3890 3891 if (pf_tag_packet(m, pftag, tag)) { 3892 REASON_SET(&reason, PFRES_MEMORY); 3893 return (PF_DROP); 3894 } 3895 3896 if (r->keep_state || nr != NULL) { 3897 /* create new state */ 3898 struct pf_state *s = NULL; 3899 struct pf_src_node *sn = NULL; 3900 3901 /* check maximums */ 3902 if (r->max_states && (r->states >= r->max_states)) { 3903 pf_status.lcounters[LCNT_STATES]++; 3904 REASON_SET(&reason, PFRES_MAXSTATES); 3905 goto cleanup; 3906 } 3907 /* src node for flter rule */ 3908 if ((r->rule_flag & PFRULE_SRCTRACK || 3909 r->rpool.opts & PF_POOL_STICKYADDR) && 3910 pf_insert_src_node(&sn, r, saddr, af) != 0) { 3911 REASON_SET(&reason, PFRES_SRCLIMIT); 3912 goto cleanup; 3913 } 3914 /* src node for translation rule */ 3915 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) && 3916 ((direction == PF_OUT && 3917 pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) || 3918 (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) { 3919 REASON_SET(&reason, PFRES_SRCLIMIT); 3920 goto cleanup; 3921 } 3922 s = pool_get(&pf_state_pl, PR_NOWAIT); 3923 if (s == NULL) { 3924 REASON_SET(&reason, PFRES_MEMORY); 3925 cleanup: 3926 if (sn != NULL && sn->states == 0 && sn->expire == 0) { 3927 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn); 3928 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3929 pf_status.src_nodes--; 3930 pool_put(&pf_src_tree_pl, sn); 3931 } 3932 if (nsn != sn && nsn != NULL && nsn->states == 0 && 3933 nsn->expire == 0) { 3934 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn); 3935 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3936 pf_status.src_nodes--; 3937 pool_put(&pf_src_tree_pl, nsn); 3938 } 3939 return (PF_DROP); 3940 } 3941 bzero(s, sizeof(*s)); 3942 s->rule.ptr = r; 3943 s->nat_rule.ptr = nr; 3944 s->anchor.ptr = a; 3945 STATE_INC_COUNTERS(s); 3946 s->allow_opts = r->allow_opts; 3947 s->log = r->log & 2; 3948 s->proto = pd->proto; 3949 s->direction = direction; 3950 s->af = af; 3951 if (direction == PF_OUT) { 3952 PF_ACPY(&s->gwy.addr, saddr, af); 3953 PF_ACPY(&s->ext.addr, daddr, af); 3954 if (nr != NULL) 3955 PF_ACPY(&s->lan.addr, &pd->baddr, af); 3956 else 3957 PF_ACPY(&s->lan.addr, &s->gwy.addr, af); 3958 } else { 3959 PF_ACPY(&s->lan.addr, daddr, af); 3960 PF_ACPY(&s->ext.addr, saddr, af); 3961 if (nr != NULL) 3962 PF_ACPY(&s->gwy.addr, &pd->baddr, af); 3963 else 3964 PF_ACPY(&s->gwy.addr, &s->lan.addr, af); 3965 } 3966 s->src.state = PFOTHERS_SINGLE; 3967 s->dst.state = PFOTHERS_NO_TRAFFIC; 3968 s->creation = time_second; 3969 s->expire = time_second; 3970 s->timeout = PFTM_OTHER_FIRST_PACKET; 3971 pf_set_rt_ifp(s, saddr); 3972 if (sn != NULL) { 3973 s->src_node = sn; 3974 s->src_node->states++; 3975 } 3976 if (nsn != NULL) { 3977 PF_ACPY(&nsn->raddr, &pd->naddr, af); 3978 s->nat_src_node = nsn; 3979 s->nat_src_node->states++; 3980 } 3981 if (pf_insert_state(bound_iface(r, nr, kif), s)) { 3982 REASON_SET(&reason, PFRES_STATEINS); 3983 pf_src_tree_remove_state(s); 3984 STATE_DEC_COUNTERS(s); 3985 pool_put(&pf_state_pl, s); 3986 return (PF_DROP); 3987 } else 3988 *sm = s; 3989 if (tag > 0) { 3990 pf_tag_ref(tag); 3991 s->tag = tag; 3992 } 3993 } 3994 3995 return (PF_PASS); 3996 } 3997 3998 int 3999 pf_test_fragment(struct pf_rule **rm, int direction, struct pfi_kif *kif, 4000 struct mbuf *m, void *h, struct pf_pdesc *pd, struct pf_rule **am, 4001 struct pf_ruleset **rsm) 4002 { 4003 struct pf_rule *r, *a = NULL; 4004 struct pf_ruleset *ruleset = NULL; 4005 sa_family_t af = pd->af; 4006 u_short reason; 4007 struct pf_tag *pftag = NULL; 4008 int tag = -1; 4009 int asd = 0; 4010 4011 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 4012 while (r != NULL) { 4013 r->evaluations++; 4014 if (r->kif != NULL && 4015 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 4016 r = r->skip[PF_SKIP_IFP].ptr; 4017 else if (r->direction && r->direction != direction) 4018 r = r->skip[PF_SKIP_DIR].ptr; 4019 else if (r->af && r->af != af) 4020 r = r->skip[PF_SKIP_AF].ptr; 4021 else if (r->proto && r->proto != pd->proto) 4022 r = r->skip[PF_SKIP_PROTO].ptr; 4023 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af, r->src.neg)) 4024 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 4025 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af, r->dst.neg)) 4026 r = r->skip[PF_SKIP_DST_ADDR].ptr; 4027 else if (r->tos && !(r->tos & pd->tos)) 4028 r = TAILQ_NEXT(r, entries); 4029 else if (r->src.port_op || r->dst.port_op || 4030 r->flagset || r->type || r->code || 4031 r->os_fingerprint != PF_OSFP_ANY) 4032 r = TAILQ_NEXT(r, entries); 4033 else if (r->prob && r->prob <= arc4random()) 4034 r = TAILQ_NEXT(r, entries); 4035 else if (r->match_tag && !pf_match_tag(m, r, &pftag, &tag)) 4036 r = TAILQ_NEXT(r, entries); 4037 else { 4038 if (r->anchor == NULL) { 4039 *rm = r; 4040 *am = a; 4041 *rsm = ruleset; 4042 if ((*rm)->quick) 4043 break; 4044 r = TAILQ_NEXT(r, entries); 4045 } else 4046 pf_step_into_anchor(&asd, &ruleset, 4047 PF_RULESET_FILTER, &r, &a); 4048 } 4049 if (r == NULL) 4050 pf_step_out_of_anchor(&asd, &ruleset, 4051 PF_RULESET_FILTER, &r, &a); 4052 } 4053 r = *rm; 4054 a = *am; 4055 ruleset = *rsm; 4056 4057 REASON_SET(&reason, PFRES_MATCH); 4058 4059 if (r->log) 4060 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset); 4061 4062 if (r->action != PF_PASS) 4063 return (PF_DROP); 4064 4065 if (pf_tag_packet(m, pftag, tag)) { 4066 REASON_SET(&reason, PFRES_MEMORY); 4067 return (PF_DROP); 4068 } 4069 4070 return (PF_PASS); 4071 } 4072 4073 int 4074 pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif, 4075 struct mbuf *m, int off, void *h, struct pf_pdesc *pd, 4076 u_short *reason) 4077 { 4078 struct pf_state key; 4079 struct tcphdr *th = pd->hdr.tcp; 4080 u_int16_t win = ntohs(th->th_win); 4081 u_int32_t ack, end, seq, orig_seq; 4082 u_int8_t sws, dws; 4083 int ackskew; 4084 int copyback = 0; 4085 struct pf_state_peer *src, *dst; 4086 4087 key.af = pd->af; 4088 key.proto = IPPROTO_TCP; 4089 if (direction == PF_IN) { 4090 PF_ACPY(&key.ext.addr, pd->src, key.af); 4091 PF_ACPY(&key.gwy.addr, pd->dst, key.af); 4092 key.ext.port = th->th_sport; 4093 key.gwy.port = th->th_dport; 4094 } else { 4095 PF_ACPY(&key.lan.addr, pd->src, key.af); 4096 PF_ACPY(&key.ext.addr, pd->dst, key.af); 4097 key.lan.port = th->th_sport; 4098 key.ext.port = th->th_dport; 4099 } 4100 4101 STATE_LOOKUP(); 4102 4103 if (direction == (*state)->direction) { 4104 src = &(*state)->src; 4105 dst = &(*state)->dst; 4106 } else { 4107 src = &(*state)->dst; 4108 dst = &(*state)->src; 4109 } 4110 4111 if ((*state)->src.state == PF_TCPS_PROXY_SRC) { 4112 if (direction != (*state)->direction) { 4113 REASON_SET(reason, PFRES_SYNPROXY); 4114 return (PF_SYNPROXY_DROP); 4115 } 4116 if (th->th_flags & TH_SYN) { 4117 if (ntohl(th->th_seq) != (*state)->src.seqlo) { 4118 REASON_SET(reason, PFRES_SYNPROXY); 4119 return (PF_DROP); 4120 } 4121 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst, 4122 pd->src, th->th_dport, th->th_sport, 4123 (*state)->src.seqhi, ntohl(th->th_seq) + 1, 4124 TH_SYN|TH_ACK, 0, (*state)->src.mss, 0, 1, 4125 0, NULL, NULL); 4126 REASON_SET(reason, PFRES_SYNPROXY); 4127 return (PF_SYNPROXY_DROP); 4128 } else if (!(th->th_flags & TH_ACK) || 4129 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) || 4130 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) { 4131 REASON_SET(reason, PFRES_SYNPROXY); 4132 return (PF_DROP); 4133 } else if ((*state)->src_node != NULL && 4134 pf_src_connlimit(state)) { 4135 REASON_SET(reason, PFRES_SRCLIMIT); 4136 return (PF_DROP); 4137 } else 4138 (*state)->src.state = PF_TCPS_PROXY_DST; 4139 } 4140 if ((*state)->src.state == PF_TCPS_PROXY_DST) { 4141 struct pf_state_host *src, *dst; 4142 4143 if (direction == PF_OUT) { 4144 src = &(*state)->gwy; 4145 dst = &(*state)->ext; 4146 } else { 4147 src = &(*state)->ext; 4148 dst = &(*state)->lan; 4149 } 4150 if (direction == (*state)->direction) { 4151 if (((th->th_flags & (TH_SYN|TH_ACK)) != TH_ACK) || 4152 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) || 4153 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) { 4154 REASON_SET(reason, PFRES_SYNPROXY); 4155 return (PF_DROP); 4156 } 4157 (*state)->src.max_win = MAX(ntohs(th->th_win), 1); 4158 if ((*state)->dst.seqhi == 1) 4159 (*state)->dst.seqhi = htonl(arc4random()); 4160 pf_send_tcp((*state)->rule.ptr, pd->af, &src->addr, 4161 &dst->addr, src->port, dst->port, 4162 (*state)->dst.seqhi, 0, TH_SYN, 0, 4163 (*state)->src.mss, 0, 0, (*state)->tag, NULL, NULL); 4164 REASON_SET(reason, PFRES_SYNPROXY); 4165 return (PF_SYNPROXY_DROP); 4166 } else if (((th->th_flags & (TH_SYN|TH_ACK)) != 4167 (TH_SYN|TH_ACK)) || 4168 (ntohl(th->th_ack) != (*state)->dst.seqhi + 1)) { 4169 REASON_SET(reason, PFRES_SYNPROXY); 4170 return (PF_DROP); 4171 } else { 4172 (*state)->dst.max_win = MAX(ntohs(th->th_win), 1); 4173 (*state)->dst.seqlo = ntohl(th->th_seq); 4174 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst, 4175 pd->src, th->th_dport, th->th_sport, 4176 ntohl(th->th_ack), ntohl(th->th_seq) + 1, 4177 TH_ACK, (*state)->src.max_win, 0, 0, 0, 4178 (*state)->tag, NULL, NULL); 4179 pf_send_tcp((*state)->rule.ptr, pd->af, &src->addr, 4180 &dst->addr, src->port, dst->port, 4181 (*state)->src.seqhi + 1, (*state)->src.seqlo + 1, 4182 TH_ACK, (*state)->dst.max_win, 0, 0, 1, 4183 0, NULL, NULL); 4184 (*state)->src.seqdiff = (*state)->dst.seqhi - 4185 (*state)->src.seqlo; 4186 (*state)->dst.seqdiff = (*state)->src.seqhi - 4187 (*state)->dst.seqlo; 4188 (*state)->src.seqhi = (*state)->src.seqlo + 4189 (*state)->dst.max_win; 4190 (*state)->dst.seqhi = (*state)->dst.seqlo + 4191 (*state)->src.max_win; 4192 (*state)->src.wscale = (*state)->dst.wscale = 0; 4193 (*state)->src.state = (*state)->dst.state = 4194 TCPS_ESTABLISHED; 4195 REASON_SET(reason, PFRES_SYNPROXY); 4196 return (PF_SYNPROXY_DROP); 4197 } 4198 } 4199 4200 if (src->wscale && dst->wscale && !(th->th_flags & TH_SYN)) { 4201 sws = src->wscale & PF_WSCALE_MASK; 4202 dws = dst->wscale & PF_WSCALE_MASK; 4203 } else 4204 sws = dws = 0; 4205 4206 /* 4207 * Sequence tracking algorithm from Guido van Rooij's paper: 4208 * http://www.madison-gurkha.com/publications/tcp_filtering/ 4209 * tcp_filtering.ps 4210 */ 4211 4212 orig_seq = seq = ntohl(th->th_seq); 4213 if (src->seqlo == 0) { 4214 /* First packet from this end. Set its state */ 4215 4216 if ((pd->flags & PFDESC_TCP_NORM || dst->scrub) && 4217 src->scrub == NULL) { 4218 if (pf_normalize_tcp_init(m, off, pd, th, src, dst)) { 4219 REASON_SET(reason, PFRES_MEMORY); 4220 return (PF_DROP); 4221 } 4222 } 4223 4224 /* Deferred generation of sequence number modulator */ 4225 if (dst->seqdiff && !src->seqdiff) { 4226 while ((src->seqdiff = htonl(arc4random())) == 0) 4227 ; 4228 ack = ntohl(th->th_ack) - dst->seqdiff; 4229 pf_change_a(&th->th_seq, &th->th_sum, htonl(seq + 4230 src->seqdiff), 0); 4231 pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0); 4232 copyback = 1; 4233 } else { 4234 ack = ntohl(th->th_ack); 4235 } 4236 4237 end = seq + pd->p_len; 4238 if (th->th_flags & TH_SYN) { 4239 end++; 4240 if (dst->wscale & PF_WSCALE_FLAG) { 4241 src->wscale = pf_get_wscale(m, off, th->th_off, 4242 pd->af); 4243 if (src->wscale & PF_WSCALE_FLAG) { 4244 /* Remove scale factor from initial 4245 * window */ 4246 sws = src->wscale & PF_WSCALE_MASK; 4247 win = ((u_int32_t)win + (1 << sws) - 1) 4248 >> sws; 4249 dws = dst->wscale & PF_WSCALE_MASK; 4250 } else { 4251 /* fixup other window */ 4252 dst->max_win <<= dst->wscale & 4253 PF_WSCALE_MASK; 4254 /* in case of a retrans SYN|ACK */ 4255 dst->wscale = 0; 4256 } 4257 } 4258 } 4259 if (th->th_flags & TH_FIN) 4260 end++; 4261 4262 src->seqlo = seq; 4263 if (src->state < TCPS_SYN_SENT) 4264 src->state = TCPS_SYN_SENT; 4265 4266 /* 4267 * May need to slide the window (seqhi may have been set by 4268 * the crappy stack check or if we picked up the connection 4269 * after establishment) 4270 */ 4271 if (src->seqhi == 1 || 4272 SEQ_GEQ(end + MAX(1, dst->max_win << dws), src->seqhi)) 4273 src->seqhi = end + MAX(1, dst->max_win << dws); 4274 if (win > src->max_win) 4275 src->max_win = win; 4276 4277 } else { 4278 ack = ntohl(th->th_ack) - dst->seqdiff; 4279 if (src->seqdiff) { 4280 /* Modulate sequence numbers */ 4281 pf_change_a(&th->th_seq, &th->th_sum, htonl(seq + 4282 src->seqdiff), 0); 4283 pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0); 4284 copyback = 1; 4285 } 4286 end = seq + pd->p_len; 4287 if (th->th_flags & TH_SYN) 4288 end++; 4289 if (th->th_flags & TH_FIN) 4290 end++; 4291 } 4292 4293 if ((th->th_flags & TH_ACK) == 0) { 4294 /* Let it pass through the ack skew check */ 4295 ack = dst->seqlo; 4296 } else if ((ack == 0 && 4297 (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) || 4298 /* broken tcp stacks do not set ack */ 4299 (dst->state < TCPS_SYN_SENT)) { 4300 /* 4301 * Many stacks (ours included) will set the ACK number in an 4302 * FIN|ACK if the SYN times out -- no sequence to ACK. 4303 */ 4304 ack = dst->seqlo; 4305 } 4306 4307 if (seq == end) { 4308 /* Ease sequencing restrictions on no data packets */ 4309 seq = src->seqlo; 4310 end = seq; 4311 } 4312 4313 ackskew = dst->seqlo - ack; 4314 4315 #define MAXACKWINDOW (0xffff + 1500) /* 1500 is an arbitrary fudge factor */ 4316 if (SEQ_GEQ(src->seqhi, end) && 4317 /* Last octet inside other's window space */ 4318 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) && 4319 /* Retrans: not more than one window back */ 4320 (ackskew >= -MAXACKWINDOW) && 4321 /* Acking not more than one reassembled fragment backwards */ 4322 (ackskew <= (MAXACKWINDOW << sws)) && 4323 /* Acking not more than one window forward */ 4324 ((th->th_flags & TH_RST) == 0 || orig_seq == src->seqlo || 4325 (pd->flags & PFDESC_IP_REAS) == 0)) { 4326 /* Require an exact sequence match on resets when possible */ 4327 4328 if (dst->scrub || src->scrub) { 4329 if (pf_normalize_tcp_stateful(m, off, pd, reason, th, 4330 *state, src, dst, ©back)) 4331 return (PF_DROP); 4332 } 4333 4334 /* update max window */ 4335 if (src->max_win < win) 4336 src->max_win = win; 4337 /* synchronize sequencing */ 4338 if (SEQ_GT(end, src->seqlo)) 4339 src->seqlo = end; 4340 /* slide the window of what the other end can send */ 4341 if (SEQ_GEQ(ack + (win << sws), dst->seqhi)) 4342 dst->seqhi = ack + MAX((win << sws), 1); 4343 4344 4345 /* update states */ 4346 if (th->th_flags & TH_SYN) 4347 if (src->state < TCPS_SYN_SENT) 4348 src->state = TCPS_SYN_SENT; 4349 if (th->th_flags & TH_FIN) 4350 if (src->state < TCPS_CLOSING) 4351 src->state = TCPS_CLOSING; 4352 if (th->th_flags & TH_ACK) { 4353 if (dst->state == TCPS_SYN_SENT) { 4354 dst->state = TCPS_ESTABLISHED; 4355 if (src->state == TCPS_ESTABLISHED && 4356 (*state)->src_node != NULL && 4357 pf_src_connlimit(state)) { 4358 REASON_SET(reason, PFRES_SRCLIMIT); 4359 return (PF_DROP); 4360 } 4361 } else if (dst->state == TCPS_CLOSING) 4362 dst->state = TCPS_FIN_WAIT_2; 4363 } 4364 if (th->th_flags & TH_RST) 4365 src->state = dst->state = TCPS_TIME_WAIT; 4366 4367 /* update expire time */ 4368 (*state)->expire = time_second; 4369 if (src->state >= TCPS_FIN_WAIT_2 && 4370 dst->state >= TCPS_FIN_WAIT_2) 4371 (*state)->timeout = PFTM_TCP_CLOSED; 4372 else if (src->state >= TCPS_FIN_WAIT_2 || 4373 dst->state >= TCPS_FIN_WAIT_2) 4374 (*state)->timeout = PFTM_TCP_FIN_WAIT; 4375 else if (src->state < TCPS_ESTABLISHED || 4376 dst->state < TCPS_ESTABLISHED) 4377 (*state)->timeout = PFTM_TCP_OPENING; 4378 else if (src->state >= TCPS_CLOSING || 4379 dst->state >= TCPS_CLOSING) 4380 (*state)->timeout = PFTM_TCP_CLOSING; 4381 else 4382 (*state)->timeout = PFTM_TCP_ESTABLISHED; 4383 4384 /* Fall through to PASS packet */ 4385 4386 } else if ((dst->state < TCPS_SYN_SENT || 4387 dst->state >= TCPS_FIN_WAIT_2 || 4388 src->state >= TCPS_FIN_WAIT_2) && 4389 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) && 4390 /* Within a window forward of the originating packet */ 4391 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW)) { 4392 /* Within a window backward of the originating packet */ 4393 4394 /* 4395 * This currently handles three situations: 4396 * 1) Stupid stacks will shotgun SYNs before their peer 4397 * replies. 4398 * 2) When PF catches an already established stream (the 4399 * firewall rebooted, the state table was flushed, routes 4400 * changed...) 4401 * 3) Packets get funky immediately after the connection 4402 * closes (this should catch Solaris spurious ACK|FINs 4403 * that web servers like to spew after a close) 4404 * 4405 * This must be a little more careful than the above code 4406 * since packet floods will also be caught here. We don't 4407 * update the TTL here to mitigate the damage of a packet 4408 * flood and so the same code can handle awkward establishment 4409 * and a loosened connection close. 4410 * In the establishment case, a correct peer response will 4411 * validate the connection, go through the normal state code 4412 * and keep updating the state TTL. 4413 */ 4414 4415 if (pf_status.debug >= PF_DEBUG_MISC) { 4416 printf("pf: loose state match: "); 4417 pf_print_state(*state); 4418 pf_print_flags(th->th_flags); 4419 printf(" seq=%u ack=%u len=%u ackskew=%d pkts=%d:%d\n", 4420 seq, ack, pd->p_len, ackskew, 4421 (*state)->packets[0], (*state)->packets[1]); 4422 } 4423 4424 if (dst->scrub || src->scrub) { 4425 if (pf_normalize_tcp_stateful(m, off, pd, reason, th, 4426 *state, src, dst, ©back)) 4427 return (PF_DROP); 4428 } 4429 4430 /* update max window */ 4431 if (src->max_win < win) 4432 src->max_win = win; 4433 /* synchronize sequencing */ 4434 if (SEQ_GT(end, src->seqlo)) 4435 src->seqlo = end; 4436 /* slide the window of what the other end can send */ 4437 if (SEQ_GEQ(ack + (win << sws), dst->seqhi)) 4438 dst->seqhi = ack + MAX((win << sws), 1); 4439 4440 /* 4441 * Cannot set dst->seqhi here since this could be a shotgunned 4442 * SYN and not an already established connection. 4443 */ 4444 4445 if (th->th_flags & TH_FIN) 4446 if (src->state < TCPS_CLOSING) 4447 src->state = TCPS_CLOSING; 4448 if (th->th_flags & TH_RST) 4449 src->state = dst->state = TCPS_TIME_WAIT; 4450 4451 /* Fall through to PASS packet */ 4452 4453 } else { 4454 if ((*state)->dst.state == TCPS_SYN_SENT && 4455 (*state)->src.state == TCPS_SYN_SENT) { 4456 /* Send RST for state mismatches during handshake */ 4457 if (!(th->th_flags & TH_RST)) 4458 pf_send_tcp((*state)->rule.ptr, pd->af, 4459 pd->dst, pd->src, th->th_dport, 4460 th->th_sport, ntohl(th->th_ack), 0, 4461 TH_RST, 0, 0, 4462 (*state)->rule.ptr->return_ttl, 1, 0, 4463 pd->eh, kif->pfik_ifp); 4464 src->seqlo = 0; 4465 src->seqhi = 1; 4466 src->max_win = 1; 4467 } else if (pf_status.debug >= PF_DEBUG_MISC) { 4468 printf("pf: BAD state: "); 4469 pf_print_state(*state); 4470 pf_print_flags(th->th_flags); 4471 printf(" seq=%u ack=%u len=%u ackskew=%d pkts=%d:%d " 4472 "dir=%s,%s\n", seq, ack, pd->p_len, ackskew, 4473 (*state)->packets[0], (*state)->packets[1], 4474 direction == PF_IN ? "in" : "out", 4475 direction == (*state)->direction ? "fwd" : "rev"); 4476 printf("pf: State failure on: %c %c %c %c | %c %c\n", 4477 SEQ_GEQ(src->seqhi, end) ? ' ' : '1', 4478 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) ? 4479 ' ': '2', 4480 (ackskew >= -MAXACKWINDOW) ? ' ' : '3', 4481 (ackskew <= (MAXACKWINDOW << sws)) ? ' ' : '4', 4482 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) ?' ' :'5', 4483 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW) ?' ' :'6'); 4484 } 4485 REASON_SET(reason, PFRES_BADSTATE); 4486 return (PF_DROP); 4487 } 4488 4489 /* Any packets which have gotten here are to be passed */ 4490 4491 /* translate source/destination address, if necessary */ 4492 if (STATE_TRANSLATE(*state)) { 4493 if (direction == PF_OUT) 4494 pf_change_ap(pd->src, &th->th_sport, pd->ip_sum, 4495 &th->th_sum, &(*state)->gwy.addr, 4496 (*state)->gwy.port, 0, pd->af); 4497 else 4498 pf_change_ap(pd->dst, &th->th_dport, pd->ip_sum, 4499 &th->th_sum, &(*state)->lan.addr, 4500 (*state)->lan.port, 0, pd->af); 4501 m_copyback(m, off, sizeof(*th), th); 4502 } else if (copyback) { 4503 /* Copyback sequence modulation or stateful scrub changes */ 4504 m_copyback(m, off, sizeof(*th), th); 4505 } 4506 4507 return (PF_PASS); 4508 } 4509 4510 int 4511 pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif, 4512 struct mbuf *m, int off, void *h, struct pf_pdesc *pd) 4513 { 4514 struct pf_state_peer *src, *dst; 4515 struct pf_state key; 4516 struct udphdr *uh = pd->hdr.udp; 4517 4518 key.af = pd->af; 4519 key.proto = IPPROTO_UDP; 4520 if (direction == PF_IN) { 4521 PF_ACPY(&key.ext.addr, pd->src, key.af); 4522 PF_ACPY(&key.gwy.addr, pd->dst, key.af); 4523 key.ext.port = uh->uh_sport; 4524 key.gwy.port = uh->uh_dport; 4525 } else { 4526 PF_ACPY(&key.lan.addr, pd->src, key.af); 4527 PF_ACPY(&key.ext.addr, pd->dst, key.af); 4528 key.lan.port = uh->uh_sport; 4529 key.ext.port = uh->uh_dport; 4530 } 4531 4532 STATE_LOOKUP(); 4533 4534 if (direction == (*state)->direction) { 4535 src = &(*state)->src; 4536 dst = &(*state)->dst; 4537 } else { 4538 src = &(*state)->dst; 4539 dst = &(*state)->src; 4540 } 4541 4542 /* update states */ 4543 if (src->state < PFUDPS_SINGLE) 4544 src->state = PFUDPS_SINGLE; 4545 if (dst->state == PFUDPS_SINGLE) 4546 dst->state = PFUDPS_MULTIPLE; 4547 4548 /* update expire time */ 4549 (*state)->expire = time_second; 4550 if (src->state == PFUDPS_MULTIPLE && dst->state == PFUDPS_MULTIPLE) 4551 (*state)->timeout = PFTM_UDP_MULTIPLE; 4552 else 4553 (*state)->timeout = PFTM_UDP_SINGLE; 4554 4555 /* translate source/destination address, if necessary */ 4556 if (STATE_TRANSLATE(*state)) { 4557 if (direction == PF_OUT) 4558 pf_change_ap(pd->src, &uh->uh_sport, pd->ip_sum, 4559 &uh->uh_sum, &(*state)->gwy.addr, 4560 (*state)->gwy.port, 1, pd->af); 4561 else 4562 pf_change_ap(pd->dst, &uh->uh_dport, pd->ip_sum, 4563 &uh->uh_sum, &(*state)->lan.addr, 4564 (*state)->lan.port, 1, pd->af); 4565 m_copyback(m, off, sizeof(*uh), uh); 4566 } 4567 4568 return (PF_PASS); 4569 } 4570 4571 int 4572 pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif, 4573 struct mbuf *m, int off, void *h, struct pf_pdesc *pd, 4574 u_short *reason) 4575 { 4576 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 4577 u_int16_t icmpid = 0, *icmpsum; 4578 u_int8_t icmptype; 4579 int state_icmp = 0; 4580 4581 icmpsum = NULL; /* XXXGCC -Wunitialized m68k */ 4582 icmptype = 0; /* XXXGCC -Wunitialized m68k */ 4583 4584 switch (pd->proto) { 4585 #ifdef INET 4586 case IPPROTO_ICMP: 4587 icmptype = pd->hdr.icmp->icmp_type; 4588 icmpid = pd->hdr.icmp->icmp_id; 4589 icmpsum = &pd->hdr.icmp->icmp_cksum; 4590 4591 if (icmptype == ICMP_UNREACH || 4592 icmptype == ICMP_SOURCEQUENCH || 4593 icmptype == ICMP_REDIRECT || 4594 icmptype == ICMP_TIMXCEED || 4595 icmptype == ICMP_PARAMPROB) 4596 state_icmp++; 4597 break; 4598 #endif /* INET */ 4599 #ifdef INET6 4600 case IPPROTO_ICMPV6: 4601 icmptype = pd->hdr.icmp6->icmp6_type; 4602 icmpid = pd->hdr.icmp6->icmp6_id; 4603 icmpsum = &pd->hdr.icmp6->icmp6_cksum; 4604 4605 if (icmptype == ICMP6_DST_UNREACH || 4606 icmptype == ICMP6_PACKET_TOO_BIG || 4607 icmptype == ICMP6_TIME_EXCEEDED || 4608 icmptype == ICMP6_PARAM_PROB) 4609 state_icmp++; 4610 break; 4611 #endif /* INET6 */ 4612 } 4613 4614 if (!state_icmp) { 4615 4616 /* 4617 * ICMP query/reply message not related to a TCP/UDP packet. 4618 * Search for an ICMP state. 4619 */ 4620 struct pf_state key; 4621 4622 key.af = pd->af; 4623 key.proto = pd->proto; 4624 if (direction == PF_IN) { 4625 PF_ACPY(&key.ext.addr, pd->src, key.af); 4626 PF_ACPY(&key.gwy.addr, pd->dst, key.af); 4627 key.ext.port = icmpid; 4628 key.gwy.port = icmpid; 4629 } else { 4630 PF_ACPY(&key.lan.addr, pd->src, key.af); 4631 PF_ACPY(&key.ext.addr, pd->dst, key.af); 4632 key.lan.port = icmpid; 4633 key.ext.port = icmpid; 4634 } 4635 4636 STATE_LOOKUP(); 4637 4638 (*state)->expire = time_second; 4639 (*state)->timeout = PFTM_ICMP_ERROR_REPLY; 4640 4641 /* translate source/destination address, if necessary */ 4642 if (PF_ANEQ(&(*state)->lan.addr, &(*state)->gwy.addr, pd->af)) { 4643 if (direction == PF_OUT) { 4644 switch (pd->af) { 4645 #ifdef INET 4646 case AF_INET: 4647 pf_change_a(&saddr->v4.s_addr, 4648 pd->ip_sum, 4649 (*state)->gwy.addr.v4.s_addr, 0); 4650 break; 4651 #endif /* INET */ 4652 #ifdef INET6 4653 case AF_INET6: 4654 pf_change_a6(saddr, 4655 &pd->hdr.icmp6->icmp6_cksum, 4656 &(*state)->gwy.addr, 0); 4657 m_copyback(m, off, 4658 sizeof(struct icmp6_hdr), 4659 pd->hdr.icmp6); 4660 break; 4661 #endif /* INET6 */ 4662 } 4663 } else { 4664 switch (pd->af) { 4665 #ifdef INET 4666 case AF_INET: 4667 pf_change_a(&daddr->v4.s_addr, 4668 pd->ip_sum, 4669 (*state)->lan.addr.v4.s_addr, 0); 4670 break; 4671 #endif /* INET */ 4672 #ifdef INET6 4673 case AF_INET6: 4674 pf_change_a6(daddr, 4675 &pd->hdr.icmp6->icmp6_cksum, 4676 &(*state)->lan.addr, 0); 4677 m_copyback(m, off, 4678 sizeof(struct icmp6_hdr), 4679 pd->hdr.icmp6); 4680 break; 4681 #endif /* INET6 */ 4682 } 4683 } 4684 } 4685 4686 return (PF_PASS); 4687 4688 } else { 4689 /* 4690 * ICMP error message in response to a TCP/UDP packet. 4691 * Extract the inner TCP/UDP header and search for that state. 4692 */ 4693 4694 struct pf_pdesc pd2; 4695 #ifdef INET 4696 struct ip h2; 4697 #endif /* INET */ 4698 #ifdef INET6 4699 struct ip6_hdr h2_6; 4700 int terminal = 0; 4701 #endif /* INET6 */ 4702 int ipoff2 = 0; 4703 int off2 = 0; 4704 4705 memset(&pd2, 0, sizeof pd2); /* XXX gcc */ 4706 4707 pd2.af = pd->af; 4708 switch (pd->af) { 4709 #ifdef INET 4710 case AF_INET: 4711 /* offset of h2 in mbuf chain */ 4712 ipoff2 = off + ICMP_MINLEN; 4713 4714 if (!pf_pull_hdr(m, ipoff2, &h2, sizeof(h2), 4715 NULL, reason, pd2.af)) { 4716 DPFPRINTF(PF_DEBUG_MISC, 4717 ("pf: ICMP error message too short " 4718 "(ip)\n")); 4719 return (PF_DROP); 4720 } 4721 /* 4722 * ICMP error messages don't refer to non-first 4723 * fragments 4724 */ 4725 if (h2.ip_off & htons(IP_OFFMASK)) { 4726 REASON_SET(reason, PFRES_FRAG); 4727 return (PF_DROP); 4728 } 4729 4730 /* offset of protocol header that follows h2 */ 4731 off2 = ipoff2 + (h2.ip_hl << 2); 4732 4733 pd2.proto = h2.ip_p; 4734 pd2.src = (struct pf_addr *)&h2.ip_src; 4735 pd2.dst = (struct pf_addr *)&h2.ip_dst; 4736 pd2.ip_sum = &h2.ip_sum; 4737 break; 4738 #endif /* INET */ 4739 #ifdef INET6 4740 case AF_INET6: 4741 ipoff2 = off + sizeof(struct icmp6_hdr); 4742 4743 if (!pf_pull_hdr(m, ipoff2, &h2_6, sizeof(h2_6), 4744 NULL, reason, pd2.af)) { 4745 DPFPRINTF(PF_DEBUG_MISC, 4746 ("pf: ICMP error message too short " 4747 "(ip6)\n")); 4748 return (PF_DROP); 4749 } 4750 pd2.proto = h2_6.ip6_nxt; 4751 pd2.src = (struct pf_addr *)&h2_6.ip6_src; 4752 pd2.dst = (struct pf_addr *)&h2_6.ip6_dst; 4753 pd2.ip_sum = NULL; 4754 off2 = ipoff2 + sizeof(h2_6); 4755 do { 4756 switch (pd2.proto) { 4757 case IPPROTO_FRAGMENT: 4758 /* 4759 * ICMPv6 error messages for 4760 * non-first fragments 4761 */ 4762 REASON_SET(reason, PFRES_FRAG); 4763 return (PF_DROP); 4764 case IPPROTO_AH: 4765 case IPPROTO_HOPOPTS: 4766 case IPPROTO_ROUTING: 4767 case IPPROTO_DSTOPTS: { 4768 /* get next header and header length */ 4769 struct ip6_ext opt6; 4770 4771 if (!pf_pull_hdr(m, off2, &opt6, 4772 sizeof(opt6), NULL, reason, 4773 pd2.af)) { 4774 DPFPRINTF(PF_DEBUG_MISC, 4775 ("pf: ICMPv6 short opt\n")); 4776 return (PF_DROP); 4777 } 4778 if (pd2.proto == IPPROTO_AH) 4779 off2 += (opt6.ip6e_len + 2) * 4; 4780 else 4781 off2 += (opt6.ip6e_len + 1) * 8; 4782 pd2.proto = opt6.ip6e_nxt; 4783 /* goto the next header */ 4784 break; 4785 } 4786 default: 4787 terminal++; 4788 break; 4789 } 4790 } while (!terminal); 4791 break; 4792 #endif /* INET6 */ 4793 } 4794 4795 switch (pd2.proto) { 4796 case IPPROTO_TCP: { 4797 struct tcphdr th; 4798 u_int32_t seq; 4799 struct pf_state key; 4800 struct pf_state_peer *src, *dst; 4801 u_int8_t dws; 4802 int copyback = 0; 4803 4804 /* 4805 * Only the first 8 bytes of the TCP header can be 4806 * expected. Don't access any TCP header fields after 4807 * th_seq, an ackskew test is not possible. 4808 */ 4809 if (!pf_pull_hdr(m, off2, &th, 8, NULL, reason, 4810 pd2.af)) { 4811 DPFPRINTF(PF_DEBUG_MISC, 4812 ("pf: ICMP error message too short " 4813 "(tcp)\n")); 4814 return (PF_DROP); 4815 } 4816 4817 key.af = pd2.af; 4818 key.proto = IPPROTO_TCP; 4819 if (direction == PF_IN) { 4820 PF_ACPY(&key.ext.addr, pd2.dst, key.af); 4821 PF_ACPY(&key.gwy.addr, pd2.src, key.af); 4822 key.ext.port = th.th_dport; 4823 key.gwy.port = th.th_sport; 4824 } else { 4825 PF_ACPY(&key.lan.addr, pd2.dst, key.af); 4826 PF_ACPY(&key.ext.addr, pd2.src, key.af); 4827 key.lan.port = th.th_dport; 4828 key.ext.port = th.th_sport; 4829 } 4830 4831 STATE_LOOKUP(); 4832 4833 if (direction == (*state)->direction) { 4834 src = &(*state)->dst; 4835 dst = &(*state)->src; 4836 } else { 4837 src = &(*state)->src; 4838 dst = &(*state)->dst; 4839 } 4840 4841 if (src->wscale && dst->wscale && 4842 !(th.th_flags & TH_SYN)) 4843 dws = dst->wscale & PF_WSCALE_MASK; 4844 else 4845 dws = 0; 4846 4847 /* Demodulate sequence number */ 4848 seq = ntohl(th.th_seq) - src->seqdiff; 4849 if (src->seqdiff) { 4850 pf_change_a(&th.th_seq, icmpsum, 4851 htonl(seq), 0); 4852 copyback = 1; 4853 } 4854 4855 if (!SEQ_GEQ(src->seqhi, seq) || 4856 !SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws))) { 4857 if (pf_status.debug >= PF_DEBUG_MISC) { 4858 printf("pf: BAD ICMP %d:%d ", 4859 icmptype, pd->hdr.icmp->icmp_code); 4860 pf_print_host(pd->src, 0, pd->af); 4861 printf(" -> "); 4862 pf_print_host(pd->dst, 0, pd->af); 4863 printf(" state: "); 4864 pf_print_state(*state); 4865 printf(" seq=%u\n", seq); 4866 } 4867 REASON_SET(reason, PFRES_BADSTATE); 4868 return (PF_DROP); 4869 } 4870 4871 if (STATE_TRANSLATE(*state)) { 4872 if (direction == PF_IN) { 4873 pf_change_icmp(pd2.src, &th.th_sport, 4874 daddr, &(*state)->lan.addr, 4875 (*state)->lan.port, NULL, 4876 pd2.ip_sum, icmpsum, 4877 pd->ip_sum, 0, pd2.af); 4878 } else { 4879 pf_change_icmp(pd2.dst, &th.th_dport, 4880 saddr, &(*state)->gwy.addr, 4881 (*state)->gwy.port, NULL, 4882 pd2.ip_sum, icmpsum, 4883 pd->ip_sum, 0, pd2.af); 4884 } 4885 copyback = 1; 4886 } 4887 4888 if (copyback) { 4889 switch (pd2.af) { 4890 #ifdef INET 4891 case AF_INET: 4892 m_copyback(m, off, ICMP_MINLEN, 4893 pd->hdr.icmp); 4894 m_copyback(m, ipoff2, sizeof(h2), 4895 &h2); 4896 break; 4897 #endif /* INET */ 4898 #ifdef INET6 4899 case AF_INET6: 4900 m_copyback(m, off, 4901 sizeof(struct icmp6_hdr), 4902 pd->hdr.icmp6); 4903 m_copyback(m, ipoff2, sizeof(h2_6), 4904 &h2_6); 4905 break; 4906 #endif /* INET6 */ 4907 } 4908 m_copyback(m, off2, 8, &th); 4909 } 4910 4911 return (PF_PASS); 4912 break; 4913 } 4914 case IPPROTO_UDP: { 4915 struct udphdr uh; 4916 struct pf_state key; 4917 4918 if (!pf_pull_hdr(m, off2, &uh, sizeof(uh), 4919 NULL, reason, pd2.af)) { 4920 DPFPRINTF(PF_DEBUG_MISC, 4921 ("pf: ICMP error message too short " 4922 "(udp)\n")); 4923 return (PF_DROP); 4924 } 4925 4926 key.af = pd2.af; 4927 key.proto = IPPROTO_UDP; 4928 if (direction == PF_IN) { 4929 PF_ACPY(&key.ext.addr, pd2.dst, key.af); 4930 PF_ACPY(&key.gwy.addr, pd2.src, key.af); 4931 key.ext.port = uh.uh_dport; 4932 key.gwy.port = uh.uh_sport; 4933 } else { 4934 PF_ACPY(&key.lan.addr, pd2.dst, key.af); 4935 PF_ACPY(&key.ext.addr, pd2.src, key.af); 4936 key.lan.port = uh.uh_dport; 4937 key.ext.port = uh.uh_sport; 4938 } 4939 4940 STATE_LOOKUP(); 4941 4942 if (STATE_TRANSLATE(*state)) { 4943 if (direction == PF_IN) { 4944 pf_change_icmp(pd2.src, &uh.uh_sport, 4945 daddr, &(*state)->lan.addr, 4946 (*state)->lan.port, &uh.uh_sum, 4947 pd2.ip_sum, icmpsum, 4948 pd->ip_sum, 1, pd2.af); 4949 } else { 4950 pf_change_icmp(pd2.dst, &uh.uh_dport, 4951 saddr, &(*state)->gwy.addr, 4952 (*state)->gwy.port, &uh.uh_sum, 4953 pd2.ip_sum, icmpsum, 4954 pd->ip_sum, 1, pd2.af); 4955 } 4956 switch (pd2.af) { 4957 #ifdef INET 4958 case AF_INET: 4959 m_copyback(m, off, ICMP_MINLEN, 4960 pd->hdr.icmp); 4961 m_copyback(m, ipoff2, sizeof(h2), &h2); 4962 break; 4963 #endif /* INET */ 4964 #ifdef INET6 4965 case AF_INET6: 4966 m_copyback(m, off, 4967 sizeof(struct icmp6_hdr), 4968 pd->hdr.icmp6); 4969 m_copyback(m, ipoff2, sizeof(h2_6), 4970 &h2_6); 4971 break; 4972 #endif /* INET6 */ 4973 } 4974 m_copyback(m, off2, sizeof(uh), &uh); 4975 } 4976 4977 return (PF_PASS); 4978 break; 4979 } 4980 #ifdef INET 4981 case IPPROTO_ICMP: { 4982 struct icmp iih; 4983 struct pf_state key; 4984 4985 if (!pf_pull_hdr(m, off2, &iih, ICMP_MINLEN, 4986 NULL, reason, pd2.af)) { 4987 DPFPRINTF(PF_DEBUG_MISC, 4988 ("pf: ICMP error message too short i" 4989 "(icmp)\n")); 4990 return (PF_DROP); 4991 } 4992 4993 key.af = pd2.af; 4994 key.proto = IPPROTO_ICMP; 4995 if (direction == PF_IN) { 4996 PF_ACPY(&key.ext.addr, pd2.dst, key.af); 4997 PF_ACPY(&key.gwy.addr, pd2.src, key.af); 4998 key.ext.port = iih.icmp_id; 4999 key.gwy.port = iih.icmp_id; 5000 } else { 5001 PF_ACPY(&key.lan.addr, pd2.dst, key.af); 5002 PF_ACPY(&key.ext.addr, pd2.src, key.af); 5003 key.lan.port = iih.icmp_id; 5004 key.ext.port = iih.icmp_id; 5005 } 5006 5007 STATE_LOOKUP(); 5008 5009 if (STATE_TRANSLATE(*state)) { 5010 if (direction == PF_IN) { 5011 pf_change_icmp(pd2.src, &iih.icmp_id, 5012 daddr, &(*state)->lan.addr, 5013 (*state)->lan.port, NULL, 5014 pd2.ip_sum, icmpsum, 5015 pd->ip_sum, 0, AF_INET); 5016 } else { 5017 pf_change_icmp(pd2.dst, &iih.icmp_id, 5018 saddr, &(*state)->gwy.addr, 5019 (*state)->gwy.port, NULL, 5020 pd2.ip_sum, icmpsum, 5021 pd->ip_sum, 0, AF_INET); 5022 } 5023 m_copyback(m, off, ICMP_MINLEN, pd->hdr.icmp); 5024 m_copyback(m, ipoff2, sizeof(h2), &h2); 5025 m_copyback(m, off2, ICMP_MINLEN, &iih); 5026 } 5027 5028 return (PF_PASS); 5029 break; 5030 } 5031 #endif /* INET */ 5032 #ifdef INET6 5033 case IPPROTO_ICMPV6: { 5034 struct icmp6_hdr iih; 5035 struct pf_state key; 5036 5037 if (!pf_pull_hdr(m, off2, &iih, 5038 sizeof(struct icmp6_hdr), NULL, reason, pd2.af)) { 5039 DPFPRINTF(PF_DEBUG_MISC, 5040 ("pf: ICMP error message too short " 5041 "(icmp6)\n")); 5042 return (PF_DROP); 5043 } 5044 5045 key.af = pd2.af; 5046 key.proto = IPPROTO_ICMPV6; 5047 if (direction == PF_IN) { 5048 PF_ACPY(&key.ext.addr, pd2.dst, key.af); 5049 PF_ACPY(&key.gwy.addr, pd2.src, key.af); 5050 key.ext.port = iih.icmp6_id; 5051 key.gwy.port = iih.icmp6_id; 5052 } else { 5053 PF_ACPY(&key.lan.addr, pd2.dst, key.af); 5054 PF_ACPY(&key.ext.addr, pd2.src, key.af); 5055 key.lan.port = iih.icmp6_id; 5056 key.ext.port = iih.icmp6_id; 5057 } 5058 5059 STATE_LOOKUP(); 5060 5061 if (STATE_TRANSLATE(*state)) { 5062 if (direction == PF_IN) { 5063 pf_change_icmp(pd2.src, &iih.icmp6_id, 5064 daddr, &(*state)->lan.addr, 5065 (*state)->lan.port, NULL, 5066 pd2.ip_sum, icmpsum, 5067 pd->ip_sum, 0, AF_INET6); 5068 } else { 5069 pf_change_icmp(pd2.dst, &iih.icmp6_id, 5070 saddr, &(*state)->gwy.addr, 5071 (*state)->gwy.port, NULL, 5072 pd2.ip_sum, icmpsum, 5073 pd->ip_sum, 0, AF_INET6); 5074 } 5075 m_copyback(m, off, sizeof(struct icmp6_hdr), 5076 pd->hdr.icmp6); 5077 m_copyback(m, ipoff2, sizeof(h2_6), &h2_6); 5078 m_copyback(m, off2, sizeof(struct icmp6_hdr), 5079 &iih); 5080 } 5081 5082 return (PF_PASS); 5083 break; 5084 } 5085 #endif /* INET6 */ 5086 default: { 5087 struct pf_state key; 5088 5089 key.af = pd2.af; 5090 key.proto = pd2.proto; 5091 if (direction == PF_IN) { 5092 PF_ACPY(&key.ext.addr, pd2.dst, key.af); 5093 PF_ACPY(&key.gwy.addr, pd2.src, key.af); 5094 key.ext.port = 0; 5095 key.gwy.port = 0; 5096 } else { 5097 PF_ACPY(&key.lan.addr, pd2.dst, key.af); 5098 PF_ACPY(&key.ext.addr, pd2.src, key.af); 5099 key.lan.port = 0; 5100 key.ext.port = 0; 5101 } 5102 5103 STATE_LOOKUP(); 5104 5105 if (STATE_TRANSLATE(*state)) { 5106 if (direction == PF_IN) { 5107 pf_change_icmp(pd2.src, NULL, 5108 daddr, &(*state)->lan.addr, 5109 0, NULL, 5110 pd2.ip_sum, icmpsum, 5111 pd->ip_sum, 0, pd2.af); 5112 } else { 5113 pf_change_icmp(pd2.dst, NULL, 5114 saddr, &(*state)->gwy.addr, 5115 0, NULL, 5116 pd2.ip_sum, icmpsum, 5117 pd->ip_sum, 0, pd2.af); 5118 } 5119 switch (pd2.af) { 5120 #ifdef INET 5121 case AF_INET: 5122 m_copyback(m, off, ICMP_MINLEN, 5123 pd->hdr.icmp); 5124 m_copyback(m, ipoff2, sizeof(h2), &h2); 5125 break; 5126 #endif /* INET */ 5127 #ifdef INET6 5128 case AF_INET6: 5129 m_copyback(m, off, 5130 sizeof(struct icmp6_hdr), 5131 pd->hdr.icmp6); 5132 m_copyback(m, ipoff2, sizeof(h2_6), 5133 &h2_6); 5134 break; 5135 #endif /* INET6 */ 5136 } 5137 } 5138 5139 return (PF_PASS); 5140 break; 5141 } 5142 } 5143 } 5144 } 5145 5146 int 5147 pf_test_state_other(struct pf_state **state, int direction, struct pfi_kif *kif, 5148 struct pf_pdesc *pd) 5149 { 5150 struct pf_state_peer *src, *dst; 5151 struct pf_state key; 5152 5153 key.af = pd->af; 5154 key.proto = pd->proto; 5155 if (direction == PF_IN) { 5156 PF_ACPY(&key.ext.addr, pd->src, key.af); 5157 PF_ACPY(&key.gwy.addr, pd->dst, key.af); 5158 key.ext.port = 0; 5159 key.gwy.port = 0; 5160 } else { 5161 PF_ACPY(&key.lan.addr, pd->src, key.af); 5162 PF_ACPY(&key.ext.addr, pd->dst, key.af); 5163 key.lan.port = 0; 5164 key.ext.port = 0; 5165 } 5166 5167 STATE_LOOKUP(); 5168 5169 if (direction == (*state)->direction) { 5170 src = &(*state)->src; 5171 dst = &(*state)->dst; 5172 } else { 5173 src = &(*state)->dst; 5174 dst = &(*state)->src; 5175 } 5176 5177 /* update states */ 5178 if (src->state < PFOTHERS_SINGLE) 5179 src->state = PFOTHERS_SINGLE; 5180 if (dst->state == PFOTHERS_SINGLE) 5181 dst->state = PFOTHERS_MULTIPLE; 5182 5183 /* update expire time */ 5184 (*state)->expire = time_second; 5185 if (src->state == PFOTHERS_MULTIPLE && dst->state == PFOTHERS_MULTIPLE) 5186 (*state)->timeout = PFTM_OTHER_MULTIPLE; 5187 else 5188 (*state)->timeout = PFTM_OTHER_SINGLE; 5189 5190 /* translate source/destination address, if necessary */ 5191 if (STATE_TRANSLATE(*state)) { 5192 if (direction == PF_OUT) 5193 switch (pd->af) { 5194 #ifdef INET 5195 case AF_INET: 5196 pf_change_a(&pd->src->v4.s_addr, 5197 pd->ip_sum, (*state)->gwy.addr.v4.s_addr, 5198 0); 5199 break; 5200 #endif /* INET */ 5201 #ifdef INET6 5202 case AF_INET6: 5203 PF_ACPY(pd->src, &(*state)->gwy.addr, pd->af); 5204 break; 5205 #endif /* INET6 */ 5206 } 5207 else 5208 switch (pd->af) { 5209 #ifdef INET 5210 case AF_INET: 5211 pf_change_a(&pd->dst->v4.s_addr, 5212 pd->ip_sum, (*state)->lan.addr.v4.s_addr, 5213 0); 5214 break; 5215 #endif /* INET */ 5216 #ifdef INET6 5217 case AF_INET6: 5218 PF_ACPY(pd->dst, &(*state)->lan.addr, pd->af); 5219 break; 5220 #endif /* INET6 */ 5221 } 5222 } 5223 5224 return (PF_PASS); 5225 } 5226 5227 /* 5228 * ipoff and off are measured from the start of the mbuf chain. 5229 * h must be at "ipoff" on the mbuf chain. 5230 */ 5231 void * 5232 pf_pull_hdr(struct mbuf *m, int off, void *p, int len, 5233 u_short *actionp, u_short *reasonp, sa_family_t af) 5234 { 5235 switch (af) { 5236 #ifdef INET 5237 case AF_INET: { 5238 struct ip *h = mtod(m, struct ip *); 5239 u_int16_t fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3; 5240 5241 if (fragoff) { 5242 if (fragoff >= len) 5243 ACTION_SET(actionp, PF_PASS); 5244 else { 5245 ACTION_SET(actionp, PF_DROP); 5246 REASON_SET(reasonp, PFRES_FRAG); 5247 } 5248 return (NULL); 5249 } 5250 if (m->m_pkthdr.len < off + len || 5251 ntohs(h->ip_len) < off + len) { 5252 ACTION_SET(actionp, PF_DROP); 5253 REASON_SET(reasonp, PFRES_SHORT); 5254 return (NULL); 5255 } 5256 break; 5257 } 5258 #endif /* INET */ 5259 #ifdef INET6 5260 case AF_INET6: { 5261 struct ip6_hdr *h = mtod(m, struct ip6_hdr *); 5262 5263 if (m->m_pkthdr.len < off + len || 5264 (ntohs(h->ip6_plen) + sizeof(struct ip6_hdr)) < 5265 (unsigned)(off + len)) { 5266 ACTION_SET(actionp, PF_DROP); 5267 REASON_SET(reasonp, PFRES_SHORT); 5268 return (NULL); 5269 } 5270 break; 5271 } 5272 #endif /* INET6 */ 5273 } 5274 m_copydata(m, off, len, p); 5275 return (p); 5276 } 5277 5278 int 5279 pf_routable(struct pf_addr *addr, sa_family_t af) 5280 { 5281 int rc = 0; 5282 union { 5283 struct sockaddr dst; 5284 struct sockaddr_in dst4; 5285 struct sockaddr_in6 dst6; 5286 } u; 5287 struct route ro; 5288 5289 bzero(&ro, sizeof(ro)); 5290 switch (af) { 5291 case AF_INET: 5292 sockaddr_in_init(&u.dst4, &addr->v4, 0); 5293 break; 5294 #ifdef INET6 5295 case AF_INET6: 5296 sockaddr_in6_init(&u.dst6, &addr->v6, 0, 0, 0); 5297 break; 5298 #endif /* INET6 */ 5299 default: 5300 return (0); 5301 } 5302 rtcache_setdst(&ro, &u.dst); 5303 5304 #ifdef __OpenBSD__ 5305 rtalloc_noclone((struct route *)&ro, NO_CLONING); 5306 if (ro.ro_rt != NULL) { 5307 RTFREE(ro.ro_rt); 5308 return (1); 5309 } 5310 #else 5311 rtcache_init(&ro); 5312 rc = (ro.ro_rt != NULL) ? 1 : 0; 5313 rtcache_free(&ro); 5314 #endif 5315 5316 return rc; 5317 } 5318 5319 int 5320 pf_rtlabel_match(struct pf_addr *addr, sa_family_t af, 5321 struct pf_addr_wrap *aw) 5322 { 5323 #if 0 5324 struct sockaddr_in *dst; 5325 #ifdef INET6 5326 struct sockaddr_in6 *dst6; 5327 struct route_in6 ro; 5328 #else 5329 struct route ro; 5330 #endif 5331 int ret = 0; 5332 5333 bzero(&ro, sizeof(ro)); 5334 switch (af) { 5335 case AF_INET: 5336 dst = satosin(&ro.ro_dst); 5337 dst->sin_family = AF_INET; 5338 dst->sin_len = sizeof(*dst); 5339 dst->sin_addr = addr->v4; 5340 break; 5341 #ifdef INET6 5342 case AF_INET6: 5343 dst6 = (struct sockaddr_in6 *)&ro.ro_dst; 5344 dst6->sin6_family = AF_INET6; 5345 dst6->sin6_len = sizeof(*dst6); 5346 dst6->sin6_addr = addr->v6; 5347 break; 5348 #endif /* INET6 */ 5349 default: 5350 return (0); 5351 } 5352 5353 #ifdef __OpenBSD__ 5354 rtalloc_noclone((struct route *)&ro, NO_CLONING); 5355 #else 5356 rtcache_init((struct route *)&ro); 5357 #endif 5358 5359 #ifdef __OpenBSD__ 5360 if (ro.ro_rt != NULL) { 5361 if (ro.ro_rt->rt_labelid == aw->v.rtlabel) 5362 ret = 1; 5363 RTFREE(ro.ro_rt); 5364 } 5365 #else 5366 rtcache_free((struct route *)&ro); 5367 #endif 5368 5369 return (ret); 5370 #else 5371 return 0; 5372 #endif 5373 } 5374 5375 #ifdef INET 5376 void 5377 pf_route(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp, 5378 struct pf_state *s) 5379 { 5380 struct mbuf *m0, *m1; 5381 struct m_tag *mtag; 5382 struct route iproute; 5383 struct route *ro = NULL; 5384 const struct sockaddr *dst; 5385 union { 5386 struct sockaddr dst; 5387 struct sockaddr_in dst4; 5388 } u; 5389 struct ip *ip; 5390 struct ifnet *ifp = NULL; 5391 struct pf_addr naddr; 5392 struct pf_src_node *sn = NULL; 5393 int error = 0; 5394 5395 if (m == NULL || *m == NULL || r == NULL || 5396 (dir != PF_IN && dir != PF_OUT) || oifp == NULL) 5397 panic("pf_route: invalid parameters"); 5398 5399 if ((mtag = m_tag_find(*m, PACKET_TAG_PF_ROUTED, NULL)) == NULL) { 5400 if ((mtag = m_tag_get(PACKET_TAG_PF_ROUTED, 1, M_NOWAIT)) == 5401 NULL) { 5402 m0 = *m; 5403 *m = NULL; 5404 goto bad; 5405 } 5406 *(char *)(mtag + 1) = 1; 5407 m_tag_prepend(*m, mtag); 5408 } else { 5409 if (*(char *)(mtag + 1) > 3) { 5410 m0 = *m; 5411 *m = NULL; 5412 goto bad; 5413 } 5414 (*(char *)(mtag + 1))++; 5415 } 5416 5417 if (r->rt == PF_DUPTO) { 5418 if ((m0 = m_copym2(*m, 0, M_COPYALL, M_NOWAIT)) == NULL) 5419 return; 5420 } else { 5421 if ((r->rt == PF_REPLYTO) == (r->direction == dir)) 5422 return; 5423 m0 = *m; 5424 } 5425 5426 if (m0->m_len < sizeof(struct ip)) { 5427 DPFPRINTF(PF_DEBUG_URGENT, 5428 ("pf_route: m0->m_len < sizeof(struct ip)\n")); 5429 goto bad; 5430 } 5431 5432 ip = mtod(m0, struct ip *); 5433 5434 ro = &iproute; 5435 memset(ro, 0, sizeof(*ro)); 5436 sockaddr_in_init(&u.dst4, &ip->ip_dst, 0); 5437 dst = &u.dst; 5438 rtcache_setdst(ro, dst); 5439 5440 if (r->rt == PF_FASTROUTE) { 5441 rtcache_init(ro); 5442 if (ro->ro_rt == NULL) { 5443 ipstat.ips_noroute++; 5444 goto bad; 5445 } 5446 5447 ifp = ro->ro_rt->rt_ifp; 5448 ro->ro_rt->rt_use++; 5449 5450 if (ro->ro_rt->rt_flags & RTF_GATEWAY) 5451 dst = ro->ro_rt->rt_gateway; 5452 } else { 5453 if (TAILQ_EMPTY(&r->rpool.list)) { 5454 DPFPRINTF(PF_DEBUG_URGENT, 5455 ("pf_route: TAILQ_EMPTY(&r->rpool.list)\n")); 5456 goto bad; 5457 } 5458 if (s == NULL) { 5459 pf_map_addr(AF_INET, r, 5460 (const struct pf_addr *)&ip->ip_src, 5461 &naddr, NULL, &sn); 5462 if (!PF_AZERO(&naddr, AF_INET)) 5463 u.dst4.sin_addr.s_addr = naddr.v4.s_addr; 5464 ifp = r->rpool.cur->kif ? 5465 r->rpool.cur->kif->pfik_ifp : NULL; 5466 } else { 5467 if (!PF_AZERO(&s->rt_addr, AF_INET)) 5468 u.dst4.sin_addr.s_addr = s->rt_addr.v4.s_addr; 5469 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL; 5470 } 5471 } 5472 if (ifp == NULL) 5473 goto bad; 5474 5475 if (oifp != ifp) { 5476 if (pf_test(PF_OUT, ifp, &m0, NULL) != PF_PASS) 5477 goto bad; 5478 else if (m0 == NULL) 5479 goto done; 5480 if (m0->m_len < sizeof(struct ip)) { 5481 DPFPRINTF(PF_DEBUG_URGENT, 5482 ("pf_route: m0->m_len < sizeof(struct ip)\n")); 5483 goto bad; 5484 } 5485 ip = mtod(m0, struct ip *); 5486 } 5487 5488 /* Copied from ip_output. */ 5489 #ifdef IPSEC 5490 /* 5491 * If deferred crypto processing is needed, check that the 5492 * interface supports it. 5493 */ 5494 if ((mtag = m_tag_find(m0, PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED, NULL)) 5495 != NULL && (ifp->if_capabilities & IFCAP_IPSEC) == 0) { 5496 /* Notify IPsec to do its own crypto. */ 5497 ipsp_skipcrypto_unmark((struct tdb_ident *)(mtag + 1)); 5498 goto bad; 5499 } 5500 #endif /* IPSEC */ 5501 5502 /* Catch routing changes wrt. hardware checksumming for TCP or UDP. */ 5503 #ifdef __OpenBSD__ 5504 if (m0->m_pkthdr.csum & M_TCPV4_CSUM_OUT) { 5505 if (!(ifp->if_capabilities & IFCAP_CSUM_TCPv4) || 5506 ifp->if_bridge != NULL) { 5507 in_delayed_cksum(m0); 5508 m0->m_pkthdr.csum &= ~M_TCPV4_CSUM_OUT; /* Clear */ 5509 } 5510 } else if (m0->m_pkthdr.csum & M_UDPV4_CSUM_OUT) { 5511 if (!(ifp->if_capabilities & IFCAP_CSUM_UDPv4) || 5512 ifp->if_bridge != NULL) { 5513 in_delayed_cksum(m0); 5514 m0->m_pkthdr.csum &= ~M_UDPV4_CSUM_OUT; /* Clear */ 5515 } 5516 } 5517 #else 5518 if (m0->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 5519 in_delayed_cksum(m0); 5520 m0->m_pkthdr.csum_flags &= ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 5521 } 5522 #endif 5523 5524 if (ntohs(ip->ip_len) <= ifp->if_mtu) { 5525 #ifdef __OpenBSD__ 5526 if ((ifp->if_capabilities & IFCAP_CSUM_IPv4) && 5527 ifp->if_bridge == NULL) { 5528 m0->m_pkthdr.csum |= M_IPV4_CSUM_OUT; 5529 ipstat.ips_outhwcsum++; 5530 } else { 5531 ip->ip_sum = 0; 5532 ip->ip_sum = in_cksum(m0, ip->ip_hl << 2); 5533 } 5534 #else 5535 ip->ip_sum = 0; 5536 ip->ip_sum = in_cksum(m0, ip->ip_hl << 2); 5537 5538 m0->m_pkthdr.csum_flags &= ~M_CSUM_IPv4; 5539 #endif 5540 #ifdef __OpenBSD__ 5541 /* Update relevant hardware checksum stats for TCP/UDP */ 5542 if (m0->m_pkthdr.csum & M_TCPV4_CSUM_OUT) 5543 tcpstat.tcps_outhwcsum++; 5544 else if (m0->m_pkthdr.csum & M_UDPV4_CSUM_OUT) 5545 udpstat.udps_outhwcsum++; 5546 #endif 5547 error = (*ifp->if_output)(ifp, m0, dst, NULL); 5548 goto done; 5549 } 5550 5551 /* 5552 * Too large for interface; fragment if possible. 5553 * Must be able to put at least 8 bytes per fragment. 5554 */ 5555 if (ip->ip_off & htons(IP_DF)) { 5556 ipstat.ips_cantfrag++; 5557 if (r->rt != PF_DUPTO) { 5558 icmp_error(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 0, 5559 ifp->if_mtu); 5560 goto done; 5561 } else 5562 goto bad; 5563 } 5564 5565 /* Make ip_fragment re-compute checksums. */ 5566 if (IN_NEED_CHECKSUM(ifp, M_CSUM_IPv4)) { 5567 m0->m_pkthdr.csum_flags |= M_CSUM_IPv4; 5568 } 5569 m1 = m0; 5570 error = ip_fragment(m0, ifp, ifp->if_mtu); 5571 if (error) { 5572 m0 = NULL; 5573 goto bad; 5574 } 5575 5576 for (m0 = m1; m0; m0 = m1) { 5577 m1 = m0->m_nextpkt; 5578 m0->m_nextpkt = 0; 5579 if (error == 0) 5580 error = (*ifp->if_output)(ifp, m0, dst, NULL); 5581 else 5582 m_freem(m0); 5583 } 5584 5585 if (error == 0) 5586 ipstat.ips_fragmented++; 5587 5588 done: 5589 if (r->rt != PF_DUPTO) 5590 *m = NULL; 5591 if (ro == &iproute) 5592 rtcache_free(ro); 5593 return; 5594 5595 bad: 5596 m_freem(m0); 5597 goto done; 5598 } 5599 #endif /* INET */ 5600 5601 #ifdef INET6 5602 void 5603 pf_route6(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp, 5604 struct pf_state *s) 5605 { 5606 struct mbuf *m0; 5607 struct m_tag *mtag; 5608 struct sockaddr_in6 dst; 5609 struct ip6_hdr *ip6; 5610 struct ifnet *ifp = NULL; 5611 struct pf_addr naddr; 5612 struct pf_src_node *sn = NULL; 5613 int error = 0; 5614 5615 if (m == NULL || *m == NULL || r == NULL || 5616 (dir != PF_IN && dir != PF_OUT) || oifp == NULL) 5617 panic("pf_route6: invalid parameters"); 5618 5619 if ((mtag = m_tag_find(*m, PACKET_TAG_PF_ROUTED, NULL)) == NULL) { 5620 if ((mtag = m_tag_get(PACKET_TAG_PF_ROUTED, 1, M_NOWAIT)) == 5621 NULL) { 5622 m0 = *m; 5623 *m = NULL; 5624 goto bad; 5625 } 5626 *(char *)(mtag + 1) = 1; 5627 m_tag_prepend(*m, mtag); 5628 } else { 5629 if (*(char *)(mtag + 1) > 3) { 5630 m0 = *m; 5631 *m = NULL; 5632 goto bad; 5633 } 5634 (*(char *)(mtag + 1))++; 5635 } 5636 5637 if (r->rt == PF_DUPTO) { 5638 if ((m0 = m_copym2(*m, 0, M_COPYALL, M_NOWAIT)) == NULL) 5639 return; 5640 } else { 5641 if ((r->rt == PF_REPLYTO) == (r->direction == dir)) 5642 return; 5643 m0 = *m; 5644 } 5645 5646 if (m0->m_len < sizeof(struct ip6_hdr)) { 5647 DPFPRINTF(PF_DEBUG_URGENT, 5648 ("pf_route6: m0->m_len < sizeof(struct ip6_hdr)\n")); 5649 goto bad; 5650 } 5651 ip6 = mtod(m0, struct ip6_hdr *); 5652 5653 dst.sin6_family = AF_INET6; 5654 dst.sin6_len = sizeof(dst); 5655 dst.sin6_addr = ip6->ip6_dst; 5656 5657 /* Cheat. */ 5658 if (r->rt == PF_FASTROUTE) { 5659 mtag = m_tag_get(PACKET_TAG_PF_GENERATED, 0, M_NOWAIT); 5660 if (mtag == NULL) 5661 goto bad; 5662 m_tag_prepend(m0, mtag); 5663 #ifdef __OpenBSD__ 5664 ip6_output(m0, NULL, NULL, 0, NULL, NULL); 5665 #else 5666 ip6_output(m0, NULL, NULL, 0, NULL, NULL, NULL); 5667 #endif 5668 return; 5669 } 5670 5671 if (TAILQ_EMPTY(&r->rpool.list)) { 5672 DPFPRINTF(PF_DEBUG_URGENT, 5673 ("pf_route6: TAILQ_EMPTY(&r->rpool.list)\n")); 5674 goto bad; 5675 } 5676 if (s == NULL) { 5677 pf_map_addr(AF_INET6, r, (struct pf_addr *)&ip6->ip6_src, 5678 &naddr, NULL, &sn); 5679 if (!PF_AZERO(&naddr, AF_INET6)) 5680 PF_ACPY((struct pf_addr *)&dst.sin6_addr, 5681 &naddr, AF_INET6); 5682 ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL; 5683 } else { 5684 if (!PF_AZERO(&s->rt_addr, AF_INET6)) 5685 PF_ACPY((struct pf_addr *)&dst.sin6_addr, 5686 &s->rt_addr, AF_INET6); 5687 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL; 5688 } 5689 if (ifp == NULL) 5690 goto bad; 5691 5692 if (oifp != ifp) { 5693 if (pf_test6(PF_OUT, ifp, &m0, NULL) != PF_PASS) 5694 goto bad; 5695 else if (m0 == NULL) 5696 goto done; 5697 if (m0->m_len < sizeof(struct ip6_hdr)) { 5698 DPFPRINTF(PF_DEBUG_URGENT, 5699 ("pf_route6: m0->m_len < sizeof(struct ip6_hdr)\n")); 5700 goto bad; 5701 } 5702 ip6 = mtod(m0, struct ip6_hdr *); 5703 } 5704 5705 /* 5706 * If the packet is too large for the outgoing interface, 5707 * send back an icmp6 error. 5708 */ 5709 if (IN6_IS_ADDR_LINKLOCAL(&dst.sin6_addr)) 5710 dst.sin6_addr.s6_addr16[1] = htons(ifp->if_index); 5711 if ((u_long)m0->m_pkthdr.len <= ifp->if_mtu) { 5712 error = nd6_output(ifp, ifp, m0, &dst, NULL); 5713 } else { 5714 in6_ifstat_inc(ifp, ifs6_in_toobig); 5715 if (r->rt != PF_DUPTO) 5716 icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu); 5717 else 5718 goto bad; 5719 } 5720 5721 done: 5722 if (r->rt != PF_DUPTO) 5723 *m = NULL; 5724 return; 5725 5726 bad: 5727 m_freem(m0); 5728 goto done; 5729 } 5730 #endif /* INET6 */ 5731 5732 5733 /* 5734 * check protocol (tcp/udp/icmp/icmp6) checksum and set mbuf flag 5735 * off is the offset where the protocol header starts 5736 * len is the total length of protocol header plus payload 5737 * returns 0 when the checksum is valid, otherwise returns 1. 5738 */ 5739 int 5740 pf_check_proto_cksum(struct mbuf *m, int off, int len, u_int8_t p, 5741 sa_family_t af) 5742 { 5743 #ifdef __OpenBSD__ 5744 u_int16_t flag_ok, flag_bad; 5745 #endif 5746 u_int16_t sum; 5747 5748 #ifdef __OpenBSD__ 5749 switch (p) { 5750 case IPPROTO_TCP: 5751 flag_ok = M_TCP_CSUM_IN_OK; 5752 flag_bad = M_TCP_CSUM_IN_BAD; 5753 break; 5754 case IPPROTO_UDP: 5755 flag_ok = M_UDP_CSUM_IN_OK; 5756 flag_bad = M_UDP_CSUM_IN_BAD; 5757 break; 5758 case IPPROTO_ICMP: 5759 #ifdef INET6 5760 case IPPROTO_ICMPV6: 5761 #endif /* INET6 */ 5762 flag_ok = flag_bad = 0; 5763 break; 5764 default: 5765 return (1); 5766 } 5767 if (m->m_pkthdr.csum & flag_ok) 5768 return (0); 5769 if (m->m_pkthdr.csum & flag_bad) 5770 return (1); 5771 #endif 5772 if (off < sizeof(struct ip) || len < sizeof(struct udphdr)) 5773 return (1); 5774 if (m->m_pkthdr.len < off + len) 5775 return (1); 5776 #ifdef __NetBSD__ 5777 switch (p) { 5778 case IPPROTO_TCP: { 5779 struct tcphdr th; /* XXX */ 5780 int thlen; 5781 5782 m_copydata(m, off, sizeof(th), &th); /* XXX */ 5783 thlen = th.th_off << 2; 5784 return tcp_input_checksum(af, m, &th, off, 5785 thlen, len - thlen) != 0; 5786 } 5787 5788 case IPPROTO_UDP: { 5789 struct udphdr uh; /* XXX */ 5790 5791 m_copydata(m, off, sizeof(uh), &uh); /* XXX */ 5792 return udp_input_checksum(af, m, &uh, off, len) != 0; 5793 } 5794 } 5795 #endif /* __NetBSD__ */ 5796 switch (af) { 5797 #ifdef INET 5798 case AF_INET: 5799 if (p == IPPROTO_ICMP) { 5800 if (m->m_len < off) 5801 return (1); 5802 m->m_data += off; 5803 m->m_len -= off; 5804 sum = in_cksum(m, len); 5805 m->m_data -= off; 5806 m->m_len += off; 5807 } else { 5808 if (m->m_len < sizeof(struct ip)) 5809 return (1); 5810 sum = in4_cksum(m, p, off, len); 5811 } 5812 break; 5813 #endif /* INET */ 5814 #ifdef INET6 5815 case AF_INET6: 5816 if (m->m_len < sizeof(struct ip6_hdr)) 5817 return (1); 5818 sum = in6_cksum(m, p, off, len); 5819 break; 5820 #endif /* INET6 */ 5821 default: 5822 return (1); 5823 } 5824 if (sum) { 5825 #ifdef __OpenBSD__ 5826 m->m_pkthdr.csum |= flag_bad; 5827 #endif 5828 switch (p) { 5829 case IPPROTO_TCP: 5830 tcpstat.tcps_rcvbadsum++; 5831 break; 5832 case IPPROTO_UDP: 5833 udpstat.udps_badsum++; 5834 break; 5835 case IPPROTO_ICMP: 5836 icmpstat.icps_checksum++; 5837 break; 5838 #ifdef INET6 5839 case IPPROTO_ICMPV6: 5840 icmp6stat.icp6s_checksum++; 5841 break; 5842 #endif /* INET6 */ 5843 } 5844 return (1); 5845 } 5846 #ifdef __OpenBSD__ 5847 m->m_pkthdr.csum |= flag_ok; 5848 #endif 5849 return (0); 5850 } 5851 5852 static int 5853 pf_add_mbuf_tag(struct mbuf *m, u_int tag) 5854 { 5855 struct m_tag *mtag; 5856 5857 if (m_tag_find(m, tag, NULL) != NULL) 5858 return (0); 5859 mtag = m_tag_get(tag, 0, M_NOWAIT); 5860 if (mtag == NULL) 5861 return (1); 5862 m_tag_prepend(m, mtag); 5863 return (0); 5864 } 5865 5866 #ifdef INET 5867 int 5868 pf_test(int dir, struct ifnet *ifp, struct mbuf **m0, 5869 struct ether_header *eh) 5870 { 5871 struct pfi_kif *kif; 5872 u_short action, reason = 0, log = 0; 5873 struct mbuf *m = *m0; 5874 struct ip *h = NULL; 5875 struct pf_rule *a = NULL, *r = &pf_default_rule, *tr, *nr; 5876 struct pf_state *s = NULL; 5877 struct pf_ruleset *ruleset = NULL; 5878 struct pf_pdesc pd; 5879 int off, dirndx, pqid = 0; 5880 5881 if (!pf_status.running || 5882 (m_tag_find(m, PACKET_TAG_PF_GENERATED, NULL) != NULL)) 5883 return (PF_PASS); 5884 5885 #if NCARP > 0 5886 if (ifp->if_type == IFT_CARP && ifp->if_carpdev) 5887 ifp = ifp->if_carpdev; 5888 #endif 5889 5890 kif = pfi_index2kif[ifp->if_index]; 5891 if (kif == NULL) { 5892 DPFPRINTF(PF_DEBUG_URGENT, 5893 ("pf_test: kif == NULL, if_xname %s\n", ifp->if_xname)); 5894 return (PF_DROP); 5895 } 5896 if (kif->pfik_flags & PFI_IFLAG_SKIP) 5897 return (PF_PASS); 5898 5899 #ifdef DIAGNOSTIC 5900 if ((m->m_flags & M_PKTHDR) == 0) 5901 panic("non-M_PKTHDR is passed to pf_test"); 5902 #endif /* DIAGNOSTIC */ 5903 5904 memset(&pd, 0, sizeof(pd)); 5905 if (m->m_pkthdr.len < (int)sizeof(*h)) { 5906 action = PF_DROP; 5907 REASON_SET(&reason, PFRES_SHORT); 5908 log = 1; 5909 goto done; 5910 } 5911 5912 /* We do IP header normalization and packet reassembly here */ 5913 if (pf_normalize_ip(m0, dir, kif, &reason, &pd) != PF_PASS) { 5914 action = PF_DROP; 5915 goto done; 5916 } 5917 m = *m0; 5918 h = mtod(m, struct ip *); 5919 5920 off = h->ip_hl << 2; 5921 if (off < (int)sizeof(*h)) { 5922 action = PF_DROP; 5923 REASON_SET(&reason, PFRES_SHORT); 5924 log = 1; 5925 goto done; 5926 } 5927 5928 pd.src = (struct pf_addr *)&h->ip_src; 5929 pd.dst = (struct pf_addr *)&h->ip_dst; 5930 PF_ACPY(&pd.baddr, dir == PF_OUT ? pd.src : pd.dst, AF_INET); 5931 pd.ip_sum = &h->ip_sum; 5932 pd.proto = h->ip_p; 5933 pd.af = AF_INET; 5934 pd.tos = h->ip_tos; 5935 pd.tot_len = ntohs(h->ip_len); 5936 pd.eh = eh; 5937 5938 /* handle fragments that didn't get reassembled by normalization */ 5939 if (h->ip_off & htons(IP_MF | IP_OFFMASK)) { 5940 action = pf_test_fragment(&r, dir, kif, m, h, 5941 &pd, &a, &ruleset); 5942 goto done; 5943 } 5944 5945 switch (h->ip_p) { 5946 5947 case IPPROTO_TCP: { 5948 struct tcphdr th; 5949 5950 pd.hdr.tcp = &th; 5951 if (!pf_pull_hdr(m, off, &th, sizeof(th), 5952 &action, &reason, AF_INET)) { 5953 log = action != PF_PASS; 5954 goto done; 5955 } 5956 if (dir == PF_IN && pf_check_proto_cksum(m, off, 5957 ntohs(h->ip_len) - off, IPPROTO_TCP, AF_INET)) { 5958 action = PF_DROP; 5959 goto done; 5960 } 5961 pd.p_len = pd.tot_len - off - (th.th_off << 2); 5962 if ((th.th_flags & TH_ACK) && pd.p_len == 0) 5963 pqid = 1; 5964 action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd); 5965 if (action == PF_DROP) 5966 goto done; 5967 action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd, 5968 &reason); 5969 if (action == PF_PASS) { 5970 #if NPFSYNC 5971 pfsync_update_state(s); 5972 #endif /* NPFSYNC */ 5973 r = s->rule.ptr; 5974 a = s->anchor.ptr; 5975 log = s->log; 5976 } else if (s == NULL) 5977 action = pf_test_tcp(&r, &s, dir, kif, 5978 m, off, h, &pd, &a, &ruleset, &ipintrq); 5979 break; 5980 } 5981 5982 case IPPROTO_UDP: { 5983 struct udphdr uh; 5984 5985 pd.hdr.udp = &uh; 5986 if (!pf_pull_hdr(m, off, &uh, sizeof(uh), 5987 &action, &reason, AF_INET)) { 5988 log = action != PF_PASS; 5989 goto done; 5990 } 5991 if (dir == PF_IN && uh.uh_sum && pf_check_proto_cksum(m, 5992 off, ntohs(h->ip_len) - off, IPPROTO_UDP, AF_INET)) { 5993 action = PF_DROP; 5994 goto done; 5995 } 5996 if (uh.uh_dport == 0 || 5997 ntohs(uh.uh_ulen) > m->m_pkthdr.len - off || 5998 ntohs(uh.uh_ulen) < sizeof(struct udphdr)) { 5999 action = PF_DROP; 6000 goto done; 6001 } 6002 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd); 6003 if (action == PF_PASS) { 6004 #if NPFSYNC 6005 pfsync_update_state(s); 6006 #endif /* NPFSYNC */ 6007 r = s->rule.ptr; 6008 a = s->anchor.ptr; 6009 log = s->log; 6010 } else if (s == NULL) 6011 action = pf_test_udp(&r, &s, dir, kif, 6012 m, off, h, &pd, &a, &ruleset, &ipintrq); 6013 break; 6014 } 6015 6016 case IPPROTO_ICMP: { 6017 struct icmp ih; 6018 6019 pd.hdr.icmp = &ih; 6020 if (!pf_pull_hdr(m, off, &ih, ICMP_MINLEN, 6021 &action, &reason, AF_INET)) { 6022 log = action != PF_PASS; 6023 goto done; 6024 } 6025 if (dir == PF_IN && pf_check_proto_cksum(m, off, 6026 ntohs(h->ip_len) - off, IPPROTO_ICMP, AF_INET)) { 6027 action = PF_DROP; 6028 goto done; 6029 } 6030 action = pf_test_state_icmp(&s, dir, kif, m, off, h, &pd, 6031 &reason); 6032 if (action == PF_PASS) { 6033 #if NPFSYNC 6034 pfsync_update_state(s); 6035 #endif /* NPFSYNC */ 6036 r = s->rule.ptr; 6037 a = s->anchor.ptr; 6038 log = s->log; 6039 } else if (s == NULL) 6040 action = pf_test_icmp(&r, &s, dir, kif, 6041 m, off, h, &pd, &a, &ruleset, &ipintrq); 6042 break; 6043 } 6044 6045 default: 6046 action = pf_test_state_other(&s, dir, kif, &pd); 6047 if (action == PF_PASS) { 6048 #if NPFSYNC 6049 pfsync_update_state(s); 6050 #endif /* NPFSYNC */ 6051 r = s->rule.ptr; 6052 a = s->anchor.ptr; 6053 log = s->log; 6054 } else if (s == NULL) 6055 action = pf_test_other(&r, &s, dir, kif, m, off, h, 6056 &pd, &a, &ruleset, &ipintrq); 6057 break; 6058 } 6059 6060 done: 6061 if (action == PF_PASS && h->ip_hl > 5 && 6062 !((s && s->allow_opts) || r->allow_opts)) { 6063 action = PF_DROP; 6064 REASON_SET(&reason, PFRES_IPOPTIONS); 6065 log = 1; 6066 DPFPRINTF(PF_DEBUG_MISC, 6067 ("pf: dropping packet with ip options\n")); 6068 } 6069 6070 if (s && s->tag) 6071 pf_tag_packet(m, pf_get_tag(m), s->tag); 6072 6073 #ifdef ALTQ 6074 if (action == PF_PASS && r->qid) { 6075 struct m_tag *mtag; 6076 struct altq_tag *atag; 6077 6078 mtag = m_tag_get(PACKET_TAG_PF_QID, sizeof(*atag), M_NOWAIT); 6079 if (mtag != NULL) { 6080 atag = (struct altq_tag *)(mtag + 1); 6081 if (pqid || pd.tos == IPTOS_LOWDELAY) 6082 atag->qid = r->pqid; 6083 else 6084 atag->qid = r->qid; 6085 /* add hints for ecn */ 6086 atag->af = AF_INET; 6087 atag->hdr = h; 6088 m_tag_prepend(m, mtag); 6089 } 6090 } 6091 #endif /* ALTQ */ 6092 6093 /* 6094 * connections redirected to loopback should not match sockets 6095 * bound specifically to loopback due to security implications, 6096 * see tcp_input() and in_pcblookup_listen(). 6097 */ 6098 if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP || 6099 pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL && 6100 (s->nat_rule.ptr->action == PF_RDR || 6101 s->nat_rule.ptr->action == PF_BINAT) && 6102 (ntohl(pd.dst->v4.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET && 6103 pf_add_mbuf_tag(m, PACKET_TAG_PF_TRANSLATE_LOCALHOST)) { 6104 action = PF_DROP; 6105 REASON_SET(&reason, PFRES_MEMORY); 6106 } 6107 6108 if (log) 6109 PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, r, a, ruleset); 6110 6111 kif->pfik_bytes[0][dir == PF_OUT][action != PF_PASS] += pd.tot_len; 6112 kif->pfik_packets[0][dir == PF_OUT][action != PF_PASS]++; 6113 6114 if (action == PF_PASS || r->action == PF_DROP) { 6115 r->packets++; 6116 r->bytes += pd.tot_len; 6117 if (a != NULL) { 6118 a->packets++; 6119 a->bytes += pd.tot_len; 6120 } 6121 if (s != NULL) { 6122 dirndx = (dir == s->direction) ? 0 : 1; 6123 s->packets[dirndx]++; 6124 s->bytes[dirndx] += pd.tot_len; 6125 if (s->nat_rule.ptr != NULL) { 6126 s->nat_rule.ptr->packets++; 6127 s->nat_rule.ptr->bytes += pd.tot_len; 6128 } 6129 if (s->src_node != NULL) { 6130 s->src_node->packets++; 6131 s->src_node->bytes += pd.tot_len; 6132 } 6133 if (s->nat_src_node != NULL) { 6134 s->nat_src_node->packets++; 6135 s->nat_src_node->bytes += pd.tot_len; 6136 } 6137 } 6138 tr = r; 6139 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule; 6140 if (nr != NULL) { 6141 struct pf_addr *x; 6142 /* 6143 * XXX: we need to make sure that the addresses 6144 * passed to pfr_update_stats() are the same than 6145 * the addresses used during matching (pfr_match) 6146 */ 6147 if (r == &pf_default_rule) { 6148 tr = nr; 6149 x = (s == NULL || s->direction == dir) ? 6150 &pd.baddr : &pd.naddr; 6151 } else 6152 x = (s == NULL || s->direction == dir) ? 6153 &pd.naddr : &pd.baddr; 6154 if (x == &pd.baddr || s == NULL) { 6155 /* we need to change the address */ 6156 if (dir == PF_OUT) 6157 pd.src = x; 6158 else 6159 pd.dst = x; 6160 } 6161 } 6162 if (tr->src.addr.type == PF_ADDR_TABLE) 6163 pfr_update_stats(tr->src.addr.p.tbl, (s == NULL || 6164 s->direction == dir) ? pd.src : pd.dst, pd.af, 6165 pd.tot_len, dir == PF_OUT, r->action == PF_PASS, 6166 tr->src.neg); 6167 if (tr->dst.addr.type == PF_ADDR_TABLE) 6168 pfr_update_stats(tr->dst.addr.p.tbl, (s == NULL || 6169 s->direction == dir) ? pd.dst : pd.src, pd.af, 6170 pd.tot_len, dir == PF_OUT, r->action == PF_PASS, 6171 tr->dst.neg); 6172 } 6173 6174 6175 if (action == PF_SYNPROXY_DROP) { 6176 m_freem(*m0); 6177 *m0 = NULL; 6178 action = PF_PASS; 6179 } else if (r->rt) 6180 /* pf_route can free the mbuf causing *m0 to become NULL */ 6181 pf_route(m0, r, dir, ifp, s); 6182 6183 return (action); 6184 } 6185 #endif /* INET */ 6186 6187 #ifdef INET6 6188 int 6189 pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0, 6190 struct ether_header *eh) 6191 { 6192 struct pfi_kif *kif; 6193 u_short action, reason = 0, log = 0; 6194 struct mbuf *m = *m0; 6195 struct ip6_hdr *h = NULL; 6196 struct pf_rule *a = NULL, *r = &pf_default_rule, *tr, *nr; 6197 struct pf_state *s = NULL; 6198 struct pf_ruleset *ruleset = NULL; 6199 struct pf_pdesc pd; 6200 int off, terminal = 0, dirndx; 6201 6202 if (!pf_status.running || 6203 (m_tag_find(m, PACKET_TAG_PF_GENERATED, NULL) != NULL)) 6204 return (PF_PASS); 6205 6206 #if NCARP > 0 6207 if (ifp->if_type == IFT_CARP && ifp->if_carpdev) 6208 ifp = ifp->if_carpdev; 6209 #endif 6210 6211 kif = pfi_index2kif[ifp->if_index]; 6212 if (kif == NULL) { 6213 DPFPRINTF(PF_DEBUG_URGENT, 6214 ("pf_test6: kif == NULL, if_xname %s\n", ifp->if_xname)); 6215 return (PF_DROP); 6216 } 6217 if (kif->pfik_flags & PFI_IFLAG_SKIP) 6218 return (PF_PASS); 6219 6220 #ifdef DIAGNOSTIC 6221 if ((m->m_flags & M_PKTHDR) == 0) 6222 panic("non-M_PKTHDR is passed to pf_test6"); 6223 #endif /* DIAGNOSTIC */ 6224 6225 memset(&pd, 0, sizeof(pd)); 6226 if (m->m_pkthdr.len < (int)sizeof(*h)) { 6227 action = PF_DROP; 6228 REASON_SET(&reason, PFRES_SHORT); 6229 log = 1; 6230 goto done; 6231 } 6232 6233 /* We do IP header normalization and packet reassembly here */ 6234 if (pf_normalize_ip6(m0, dir, kif, &reason, &pd) != PF_PASS) { 6235 action = PF_DROP; 6236 goto done; 6237 } 6238 m = *m0; 6239 h = mtod(m, struct ip6_hdr *); 6240 6241 pd.src = (struct pf_addr *)&h->ip6_src; 6242 pd.dst = (struct pf_addr *)&h->ip6_dst; 6243 PF_ACPY(&pd.baddr, dir == PF_OUT ? pd.src : pd.dst, AF_INET6); 6244 pd.ip_sum = NULL; 6245 pd.af = AF_INET6; 6246 pd.tos = 0; 6247 pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr); 6248 pd.eh = eh; 6249 6250 off = ((char *)h - m->m_data) + sizeof(struct ip6_hdr); 6251 pd.proto = h->ip6_nxt; 6252 do { 6253 switch (pd.proto) { 6254 case IPPROTO_FRAGMENT: 6255 action = pf_test_fragment(&r, dir, kif, m, h, 6256 &pd, &a, &ruleset); 6257 if (action == PF_DROP) 6258 REASON_SET(&reason, PFRES_FRAG); 6259 goto done; 6260 case IPPROTO_AH: 6261 case IPPROTO_HOPOPTS: 6262 case IPPROTO_ROUTING: 6263 case IPPROTO_DSTOPTS: { 6264 /* get next header and header length */ 6265 struct ip6_ext opt6; 6266 6267 if (!pf_pull_hdr(m, off, &opt6, sizeof(opt6), 6268 NULL, &reason, pd.af)) { 6269 DPFPRINTF(PF_DEBUG_MISC, 6270 ("pf: IPv6 short opt\n")); 6271 action = PF_DROP; 6272 log = 1; 6273 goto done; 6274 } 6275 if (pd.proto == IPPROTO_AH) 6276 off += (opt6.ip6e_len + 2) * 4; 6277 else 6278 off += (opt6.ip6e_len + 1) * 8; 6279 pd.proto = opt6.ip6e_nxt; 6280 /* goto the next header */ 6281 break; 6282 } 6283 default: 6284 terminal++; 6285 break; 6286 } 6287 } while (!terminal); 6288 6289 switch (pd.proto) { 6290 6291 case IPPROTO_TCP: { 6292 struct tcphdr th; 6293 6294 pd.hdr.tcp = &th; 6295 if (!pf_pull_hdr(m, off, &th, sizeof(th), 6296 &action, &reason, AF_INET6)) { 6297 log = action != PF_PASS; 6298 goto done; 6299 } 6300 if (dir == PF_IN && pf_check_proto_cksum(m, off, 6301 ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)), 6302 IPPROTO_TCP, AF_INET6)) { 6303 action = PF_DROP; 6304 REASON_SET(&reason, PFRES_PROTCKSUM); 6305 goto done; 6306 } 6307 pd.p_len = pd.tot_len - off - (th.th_off << 2); 6308 action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd); 6309 if (action == PF_DROP) 6310 goto done; 6311 action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd, 6312 &reason); 6313 if (action == PF_PASS) { 6314 #if NPFSYNC 6315 pfsync_update_state(s); 6316 #endif /* NPFSYNC */ 6317 r = s->rule.ptr; 6318 a = s->anchor.ptr; 6319 log = s->log; 6320 } else if (s == NULL) 6321 action = pf_test_tcp(&r, &s, dir, kif, 6322 m, off, h, &pd, &a, &ruleset, &ip6intrq); 6323 break; 6324 } 6325 6326 case IPPROTO_UDP: { 6327 struct udphdr uh; 6328 6329 pd.hdr.udp = &uh; 6330 if (!pf_pull_hdr(m, off, &uh, sizeof(uh), 6331 &action, &reason, AF_INET6)) { 6332 log = action != PF_PASS; 6333 goto done; 6334 } 6335 if (dir == PF_IN && uh.uh_sum && pf_check_proto_cksum(m, 6336 off, ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)), 6337 IPPROTO_UDP, AF_INET6)) { 6338 action = PF_DROP; 6339 REASON_SET(&reason, PFRES_PROTCKSUM); 6340 goto done; 6341 } 6342 if (uh.uh_dport == 0 || 6343 ntohs(uh.uh_ulen) > m->m_pkthdr.len - off || 6344 ntohs(uh.uh_ulen) < sizeof(struct udphdr)) { 6345 action = PF_DROP; 6346 goto done; 6347 } 6348 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd); 6349 if (action == PF_PASS) { 6350 #if NPFSYNC 6351 pfsync_update_state(s); 6352 #endif /* NPFSYNC */ 6353 r = s->rule.ptr; 6354 a = s->anchor.ptr; 6355 log = s->log; 6356 } else if (s == NULL) 6357 action = pf_test_udp(&r, &s, dir, kif, 6358 m, off, h, &pd, &a, &ruleset, &ip6intrq); 6359 break; 6360 } 6361 6362 case IPPROTO_ICMPV6: { 6363 struct icmp6_hdr ih; 6364 6365 pd.hdr.icmp6 = &ih; 6366 if (!pf_pull_hdr(m, off, &ih, sizeof(ih), 6367 &action, &reason, AF_INET6)) { 6368 log = action != PF_PASS; 6369 goto done; 6370 } 6371 if (dir == PF_IN && pf_check_proto_cksum(m, off, 6372 ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)), 6373 IPPROTO_ICMPV6, AF_INET6)) { 6374 action = PF_DROP; 6375 REASON_SET(&reason, PFRES_PROTCKSUM); 6376 goto done; 6377 } 6378 action = pf_test_state_icmp(&s, dir, kif, 6379 m, off, h, &pd, &reason); 6380 if (action == PF_PASS) { 6381 #if NPFSYNC 6382 pfsync_update_state(s); 6383 #endif /* NPFSYNC */ 6384 r = s->rule.ptr; 6385 a = s->anchor.ptr; 6386 log = s->log; 6387 } else if (s == NULL) 6388 action = pf_test_icmp(&r, &s, dir, kif, 6389 m, off, h, &pd, &a, &ruleset, &ip6intrq); 6390 break; 6391 } 6392 6393 default: 6394 action = pf_test_state_other(&s, dir, kif, &pd); 6395 if (action == PF_PASS) { 6396 #if NPFSYNC 6397 pfsync_update_state(s); 6398 #endif /* NPFSYNC */ 6399 r = s->rule.ptr; 6400 a = s->anchor.ptr; 6401 log = s->log; 6402 } else if (s == NULL) 6403 action = pf_test_other(&r, &s, dir, kif, m, off, h, 6404 &pd, &a, &ruleset, &ip6intrq); 6405 break; 6406 } 6407 6408 done: 6409 /* XXX handle IPv6 options, if not allowed. not implemented. */ 6410 6411 if (s && s->tag) 6412 pf_tag_packet(m, pf_get_tag(m), s->tag); 6413 6414 #ifdef ALTQ 6415 if (action == PF_PASS && r->qid) { 6416 struct m_tag *mtag; 6417 struct altq_tag *atag; 6418 6419 mtag = m_tag_get(PACKET_TAG_PF_QID, sizeof(*atag), M_NOWAIT); 6420 if (mtag != NULL) { 6421 atag = (struct altq_tag *)(mtag + 1); 6422 if (pd.tos == IPTOS_LOWDELAY) 6423 atag->qid = r->pqid; 6424 else 6425 atag->qid = r->qid; 6426 /* add hints for ecn */ 6427 atag->af = AF_INET6; 6428 atag->hdr = h; 6429 m_tag_prepend(m, mtag); 6430 } 6431 } 6432 #endif /* ALTQ */ 6433 6434 if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP || 6435 pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL && 6436 (s->nat_rule.ptr->action == PF_RDR || 6437 s->nat_rule.ptr->action == PF_BINAT) && 6438 IN6_IS_ADDR_LOOPBACK(&pd.dst->v6) && 6439 pf_add_mbuf_tag(m, PACKET_TAG_PF_TRANSLATE_LOCALHOST)) { 6440 action = PF_DROP; 6441 REASON_SET(&reason, PFRES_MEMORY); 6442 } 6443 6444 if (log) 6445 PFLOG_PACKET(kif, h, m, AF_INET6, dir, reason, r, a, ruleset); 6446 6447 kif->pfik_bytes[1][dir == PF_OUT][action != PF_PASS] += pd.tot_len; 6448 kif->pfik_packets[1][dir == PF_OUT][action != PF_PASS]++; 6449 6450 if (action == PF_PASS || r->action == PF_DROP) { 6451 r->packets++; 6452 r->bytes += pd.tot_len; 6453 if (a != NULL) { 6454 a->packets++; 6455 a->bytes += pd.tot_len; 6456 } 6457 if (s != NULL) { 6458 dirndx = (dir == s->direction) ? 0 : 1; 6459 s->packets[dirndx]++; 6460 s->bytes[dirndx] += pd.tot_len; 6461 if (s->nat_rule.ptr != NULL) { 6462 s->nat_rule.ptr->packets++; 6463 s->nat_rule.ptr->bytes += pd.tot_len; 6464 } 6465 if (s->src_node != NULL) { 6466 s->src_node->packets++; 6467 s->src_node->bytes += pd.tot_len; 6468 } 6469 if (s->nat_src_node != NULL) { 6470 s->nat_src_node->packets++; 6471 s->nat_src_node->bytes += pd.tot_len; 6472 } 6473 } 6474 tr = r; 6475 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule; 6476 if (nr != NULL) { 6477 struct pf_addr *x; 6478 /* 6479 * XXX: we need to make sure that the addresses 6480 * passed to pfr_update_stats() are the same than 6481 * the addresses used during matching (pfr_match) 6482 */ 6483 if (r == &pf_default_rule) { 6484 tr = nr; 6485 x = (s == NULL || s->direction == dir) ? 6486 &pd.baddr : &pd.naddr; 6487 } else { 6488 x = (s == NULL || s->direction == dir) ? 6489 &pd.naddr : &pd.baddr; 6490 } 6491 if (x == &pd.baddr || s == NULL) { 6492 if (dir == PF_OUT) 6493 pd.src = x; 6494 else 6495 pd.dst = x; 6496 } 6497 } 6498 if (tr->src.addr.type == PF_ADDR_TABLE) 6499 pfr_update_stats(tr->src.addr.p.tbl, (s == NULL || 6500 s->direction == dir) ? pd.src : pd.dst, pd.af, 6501 pd.tot_len, dir == PF_OUT, r->action == PF_PASS, 6502 tr->src.neg); 6503 if (tr->dst.addr.type == PF_ADDR_TABLE) 6504 pfr_update_stats(tr->dst.addr.p.tbl, (s == NULL || 6505 s->direction == dir) ? pd.dst : pd.src, pd.af, 6506 pd.tot_len, dir == PF_OUT, r->action == PF_PASS, 6507 tr->dst.neg); 6508 } 6509 6510 6511 if (action == PF_SYNPROXY_DROP) { 6512 m_freem(*m0); 6513 *m0 = NULL; 6514 action = PF_PASS; 6515 } else if (r->rt) 6516 /* pf_route6 can free the mbuf causing *m0 to become NULL */ 6517 pf_route6(m0, r, dir, ifp, s); 6518 6519 return (action); 6520 } 6521 #endif /* INET6 */ 6522 6523 int 6524 pf_check_congestion(struct ifqueue *ifq) 6525 { 6526 #ifdef __OpenBSD__ 6527 if (ifq->ifq_congestion) 6528 return (1); 6529 else 6530 return (0); 6531 #else 6532 return 0; 6533 #endif 6534 } 6535