1 /* $NetBSD: pf.c,v 1.23 2006/05/14 03:40:02 christos Exp $ */ 2 /* $OpenBSD: pf.c,v 1.483 2005/03/15 17:38:43 dhartmei Exp $ */ 3 4 /* 5 * Copyright (c) 2001 Daniel Hartmeier 6 * Copyright (c) 2002,2003 Henning Brauer 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * - Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * - Redistributions in binary form must reproduce the above 16 * copyright notice, this list of conditions and the following 17 * disclaimer in the documentation and/or other materials provided 18 * with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 * POSSIBILITY OF SUCH DAMAGE. 32 * 33 * Effort sponsored in part by the Defense Advanced Research Projects 34 * Agency (DARPA) and Air Force Research Laboratory, Air Force 35 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 36 * 37 */ 38 39 #include "bpfilter.h" 40 #include "pflog.h" 41 #ifdef __OpenBSD__ 42 #include "pfsync.h" 43 #else 44 #define NPFSYNC 0 45 #endif 46 47 #include <sys/param.h> 48 #include <sys/systm.h> 49 #include <sys/mbuf.h> 50 #include <sys/filio.h> 51 #include <sys/socket.h> 52 #include <sys/socketvar.h> 53 #include <sys/kernel.h> 54 #include <sys/time.h> 55 #include <sys/pool.h> 56 #ifdef __NetBSD__ 57 #include <sys/endian.h> 58 #endif 59 60 #include <net/if.h> 61 #include <net/if_types.h> 62 #include <net/bpf.h> 63 #include <net/route.h> 64 65 #include <netinet/in.h> 66 #include <netinet/in_var.h> 67 #include <netinet/in_systm.h> 68 #include <netinet/ip.h> 69 #include <netinet/ip_var.h> 70 #include <netinet/tcp.h> 71 #include <netinet/tcp_seq.h> 72 #include <netinet/udp.h> 73 #include <netinet/ip_icmp.h> 74 #include <netinet/in_pcb.h> 75 #include <netinet/tcp_timer.h> 76 #include <netinet/tcp_var.h> 77 #include <netinet/udp_var.h> 78 #include <netinet/icmp_var.h> 79 #ifdef __OpenBSD__ 80 #include <netinet/if_ether.h> 81 #else 82 #include <net/if_ether.h> 83 #endif 84 85 #ifdef __OpenBSD__ 86 #include <dev/rndvar.h> 87 #else 88 #include <sys/rnd.h> 89 #endif 90 #include <net/pfvar.h> 91 #include <net/if_pflog.h> 92 93 #if NPFSYNC > 0 94 #include <net/if_pfsync.h> 95 #endif /* NPFSYNC > 0 */ 96 97 #ifdef INET6 98 #include <netinet/ip6.h> 99 #include <netinet6/ip6_var.h> 100 #ifdef __NetBSD__ 101 #include <netinet6/in6_pcb.h> 102 #endif 103 #include <netinet/icmp6.h> 104 #include <netinet6/nd6.h> 105 #endif /* INET6 */ 106 107 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x 108 109 /* 110 * Global variables 111 */ 112 113 struct pf_anchor_global pf_anchors; 114 struct pf_ruleset pf_main_ruleset; 115 struct pf_altqqueue pf_altqs[2]; 116 struct pf_palist pf_pabuf; 117 struct pf_altqqueue *pf_altqs_active; 118 struct pf_altqqueue *pf_altqs_inactive; 119 struct pf_status pf_status; 120 121 u_int32_t ticket_altqs_active; 122 u_int32_t ticket_altqs_inactive; 123 int altqs_inactive_open; 124 u_int32_t ticket_pabuf; 125 126 #ifdef __OpenBSD__ 127 struct timeout pf_expire_to; /* expire timeout */ 128 #else 129 struct callout pf_expire_to; /* expire timeout */ 130 #endif 131 132 struct pf_anchor_stackframe { 133 struct pf_ruleset *rs; 134 struct pf_rule *r; 135 struct pf_anchor_node *parent; 136 struct pf_anchor *child; 137 } pf_anchor_stack[64]; 138 139 struct pool pf_src_tree_pl, pf_rule_pl; 140 struct pool pf_state_pl, pf_altq_pl, pf_pooladdr_pl; 141 142 void pf_print_host(struct pf_addr *, u_int16_t, u_int8_t); 143 144 void pf_init_threshold(struct pf_threshold *, u_int32_t, 145 u_int32_t); 146 void pf_add_threshold(struct pf_threshold *); 147 int pf_check_threshold(struct pf_threshold *); 148 149 void pf_change_ap(struct pf_addr *, u_int16_t *, 150 u_int16_t *, u_int16_t *, struct pf_addr *, 151 u_int16_t, u_int8_t, sa_family_t); 152 #ifdef INET6 153 void pf_change_a6(struct pf_addr *, u_int16_t *, 154 struct pf_addr *, u_int8_t); 155 #endif /* INET6 */ 156 void pf_change_icmp(struct pf_addr *, u_int16_t *, 157 struct pf_addr *, struct pf_addr *, u_int16_t, 158 u_int16_t *, u_int16_t *, u_int16_t *, 159 u_int16_t *, u_int8_t, sa_family_t); 160 void pf_send_tcp(const struct pf_rule *, sa_family_t, 161 const struct pf_addr *, const struct pf_addr *, 162 u_int16_t, u_int16_t, u_int32_t, u_int32_t, 163 u_int8_t, u_int16_t, u_int16_t, u_int8_t, int, 164 struct ether_header *, struct ifnet *); 165 void pf_send_icmp(struct mbuf *, u_int8_t, u_int8_t, 166 sa_family_t, struct pf_rule *); 167 struct pf_rule *pf_match_translation(struct pf_pdesc *, struct mbuf *, 168 int, int, struct pfi_kif *, 169 struct pf_addr *, u_int16_t, struct pf_addr *, 170 u_int16_t, int); 171 struct pf_rule *pf_get_translation(struct pf_pdesc *, struct mbuf *, 172 int, int, struct pfi_kif *, struct pf_src_node **, 173 struct pf_addr *, u_int16_t, 174 struct pf_addr *, u_int16_t, 175 struct pf_addr *, u_int16_t *); 176 int pf_test_tcp(struct pf_rule **, struct pf_state **, 177 int, struct pfi_kif *, struct mbuf *, int, 178 void *, struct pf_pdesc *, struct pf_rule **, 179 struct pf_ruleset **, struct ifqueue *); 180 int pf_test_udp(struct pf_rule **, struct pf_state **, 181 int, struct pfi_kif *, struct mbuf *, int, 182 void *, struct pf_pdesc *, struct pf_rule **, 183 struct pf_ruleset **, struct ifqueue *); 184 int pf_test_icmp(struct pf_rule **, struct pf_state **, 185 int, struct pfi_kif *, struct mbuf *, int, 186 void *, struct pf_pdesc *, struct pf_rule **, 187 struct pf_ruleset **, struct ifqueue *); 188 int pf_test_other(struct pf_rule **, struct pf_state **, 189 int, struct pfi_kif *, struct mbuf *, int, void *, 190 struct pf_pdesc *, struct pf_rule **, 191 struct pf_ruleset **, struct ifqueue *); 192 int pf_test_fragment(struct pf_rule **, int, 193 struct pfi_kif *, struct mbuf *, void *, 194 struct pf_pdesc *, struct pf_rule **, 195 struct pf_ruleset **); 196 int pf_test_state_tcp(struct pf_state **, int, 197 struct pfi_kif *, struct mbuf *, int, 198 void *, struct pf_pdesc *, u_short *); 199 int pf_test_state_udp(struct pf_state **, int, 200 struct pfi_kif *, struct mbuf *, int, 201 void *, struct pf_pdesc *); 202 int pf_test_state_icmp(struct pf_state **, int, 203 struct pfi_kif *, struct mbuf *, int, 204 void *, struct pf_pdesc *, u_short *); 205 int pf_test_state_other(struct pf_state **, int, 206 struct pfi_kif *, struct pf_pdesc *); 207 struct pf_tag *pf_get_tag(struct mbuf *); 208 int pf_match_tag(struct mbuf *, struct pf_rule *, 209 struct pf_tag **, int *); 210 void pf_hash(struct pf_addr *, struct pf_addr *, 211 struct pf_poolhashkey *, sa_family_t); 212 int pf_map_addr(u_int8_t, struct pf_rule *, 213 struct pf_addr *, struct pf_addr *, 214 struct pf_addr *, struct pf_src_node **); 215 int pf_get_sport(sa_family_t, u_int8_t, struct pf_rule *, 216 struct pf_addr *, struct pf_addr *, u_int16_t, 217 struct pf_addr *, u_int16_t*, u_int16_t, u_int16_t, 218 struct pf_src_node **); 219 void pf_route(struct mbuf **, struct pf_rule *, int, 220 struct ifnet *, struct pf_state *); 221 void pf_route6(struct mbuf **, struct pf_rule *, int, 222 struct ifnet *, struct pf_state *); 223 int pf_socket_lookup(uid_t *, gid_t *, 224 int, struct pf_pdesc *); 225 u_int8_t pf_get_wscale(struct mbuf *, int, u_int16_t, 226 sa_family_t); 227 u_int16_t pf_get_mss(struct mbuf *, int, u_int16_t, 228 sa_family_t); 229 u_int16_t pf_calc_mss(struct pf_addr *, sa_family_t, 230 u_int16_t); 231 void pf_set_rt_ifp(struct pf_state *, 232 struct pf_addr *); 233 int pf_check_proto_cksum(struct mbuf *, int, int, 234 u_int8_t, sa_family_t); 235 int pf_addr_wrap_neq(struct pf_addr_wrap *, 236 struct pf_addr_wrap *); 237 static int pf_add_mbuf_tag(struct mbuf *, u_int); 238 struct pf_state *pf_find_state_recurse(struct pfi_kif *, 239 struct pf_state *, u_int8_t); 240 int pf_src_connlimit(struct pf_state **); 241 int pf_check_congestion(struct ifqueue *); 242 243 struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX] = { 244 { &pf_state_pl, PFSTATE_HIWAT }, 245 { &pf_src_tree_pl, PFSNODE_HIWAT }, 246 { &pf_frent_pl, PFFRAG_FRENT_HIWAT } 247 }; 248 249 #define STATE_LOOKUP() \ 250 do { \ 251 if (direction == PF_IN) \ 252 *state = pf_find_state_recurse( \ 253 kif, &key, PF_EXT_GWY); \ 254 else \ 255 *state = pf_find_state_recurse( \ 256 kif, &key, PF_LAN_EXT); \ 257 if (*state == NULL || (*state)->timeout == PFTM_PURGE) \ 258 return (PF_DROP); \ 259 if (direction == PF_OUT && \ 260 (((*state)->rule.ptr->rt == PF_ROUTETO && \ 261 (*state)->rule.ptr->direction == PF_OUT) || \ 262 ((*state)->rule.ptr->rt == PF_REPLYTO && \ 263 (*state)->rule.ptr->direction == PF_IN)) && \ 264 (*state)->rt_kif != NULL && \ 265 (*state)->rt_kif != kif) \ 266 return (PF_PASS); \ 267 } while (0) 268 269 #define STATE_TRANSLATE(s) \ 270 (s)->lan.addr.addr32[0] != (s)->gwy.addr.addr32[0] || \ 271 ((s)->af == AF_INET6 && \ 272 ((s)->lan.addr.addr32[1] != (s)->gwy.addr.addr32[1] || \ 273 (s)->lan.addr.addr32[2] != (s)->gwy.addr.addr32[2] || \ 274 (s)->lan.addr.addr32[3] != (s)->gwy.addr.addr32[3])) || \ 275 (s)->lan.port != (s)->gwy.port 276 277 #define BOUND_IFACE(r, k) (((r)->rule_flag & PFRULE_IFBOUND) ? (k) : \ 278 ((r)->rule_flag & PFRULE_GRBOUND) ? (k)->pfik_parent : \ 279 (k)->pfik_parent->pfik_parent) 280 281 #define STATE_INC_COUNTERS(s) \ 282 do { \ 283 s->rule.ptr->states++; \ 284 if (s->anchor.ptr != NULL) \ 285 s->anchor.ptr->states++; \ 286 if (s->nat_rule.ptr != NULL) \ 287 s->nat_rule.ptr->states++; \ 288 } while (0) 289 290 #define STATE_DEC_COUNTERS(s) \ 291 do { \ 292 if (s->nat_rule.ptr != NULL) \ 293 s->nat_rule.ptr->states--; \ 294 if (s->anchor.ptr != NULL) \ 295 s->anchor.ptr->states--; \ 296 s->rule.ptr->states--; \ 297 } while (0) 298 299 static __inline int pf_src_compare(struct pf_src_node *, struct pf_src_node *); 300 static __inline int pf_state_compare_lan_ext(struct pf_state *, 301 struct pf_state *); 302 static __inline int pf_state_compare_ext_gwy(struct pf_state *, 303 struct pf_state *); 304 static __inline int pf_state_compare_id(struct pf_state *, 305 struct pf_state *); 306 static __inline int pf_anchor_compare(struct pf_anchor *, struct pf_anchor *); 307 308 struct pf_src_tree tree_src_tracking; 309 310 struct pf_state_tree_id tree_id; 311 struct pf_state_queue state_updates; 312 313 RB_GENERATE(pf_src_tree, pf_src_node, entry, pf_src_compare); 314 RB_GENERATE(pf_state_tree_lan_ext, pf_state, 315 u.s.entry_lan_ext, pf_state_compare_lan_ext); 316 RB_GENERATE(pf_state_tree_ext_gwy, pf_state, 317 u.s.entry_ext_gwy, pf_state_compare_ext_gwy); 318 RB_GENERATE(pf_state_tree_id, pf_state, 319 u.s.entry_id, pf_state_compare_id); 320 RB_GENERATE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare); 321 RB_GENERATE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare); 322 323 static __inline int 324 pf_src_compare(struct pf_src_node *a, struct pf_src_node *b) 325 { 326 int diff; 327 328 if (a->rule.ptr > b->rule.ptr) 329 return (1); 330 if (a->rule.ptr < b->rule.ptr) 331 return (-1); 332 if ((diff = a->af - b->af) != 0) 333 return (diff); 334 switch (a->af) { 335 #ifdef INET 336 case AF_INET: 337 if (a->addr.addr32[0] > b->addr.addr32[0]) 338 return (1); 339 if (a->addr.addr32[0] < b->addr.addr32[0]) 340 return (-1); 341 break; 342 #endif /* INET */ 343 #ifdef INET6 344 case AF_INET6: 345 if (a->addr.addr32[3] > b->addr.addr32[3]) 346 return (1); 347 if (a->addr.addr32[3] < b->addr.addr32[3]) 348 return (-1); 349 if (a->addr.addr32[2] > b->addr.addr32[2]) 350 return (1); 351 if (a->addr.addr32[2] < b->addr.addr32[2]) 352 return (-1); 353 if (a->addr.addr32[1] > b->addr.addr32[1]) 354 return (1); 355 if (a->addr.addr32[1] < b->addr.addr32[1]) 356 return (-1); 357 if (a->addr.addr32[0] > b->addr.addr32[0]) 358 return (1); 359 if (a->addr.addr32[0] < b->addr.addr32[0]) 360 return (-1); 361 break; 362 #endif /* INET6 */ 363 } 364 return (0); 365 } 366 367 static __inline int 368 pf_state_compare_lan_ext(struct pf_state *a, struct pf_state *b) 369 { 370 int diff; 371 372 if ((diff = a->proto - b->proto) != 0) 373 return (diff); 374 if ((diff = a->af - b->af) != 0) 375 return (diff); 376 switch (a->af) { 377 #ifdef INET 378 case AF_INET: 379 if (a->lan.addr.addr32[0] > b->lan.addr.addr32[0]) 380 return (1); 381 if (a->lan.addr.addr32[0] < b->lan.addr.addr32[0]) 382 return (-1); 383 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0]) 384 return (1); 385 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0]) 386 return (-1); 387 break; 388 #endif /* INET */ 389 #ifdef INET6 390 case AF_INET6: 391 if (a->lan.addr.addr32[3] > b->lan.addr.addr32[3]) 392 return (1); 393 if (a->lan.addr.addr32[3] < b->lan.addr.addr32[3]) 394 return (-1); 395 if (a->ext.addr.addr32[3] > b->ext.addr.addr32[3]) 396 return (1); 397 if (a->ext.addr.addr32[3] < b->ext.addr.addr32[3]) 398 return (-1); 399 if (a->lan.addr.addr32[2] > b->lan.addr.addr32[2]) 400 return (1); 401 if (a->lan.addr.addr32[2] < b->lan.addr.addr32[2]) 402 return (-1); 403 if (a->ext.addr.addr32[2] > b->ext.addr.addr32[2]) 404 return (1); 405 if (a->ext.addr.addr32[2] < b->ext.addr.addr32[2]) 406 return (-1); 407 if (a->lan.addr.addr32[1] > b->lan.addr.addr32[1]) 408 return (1); 409 if (a->lan.addr.addr32[1] < b->lan.addr.addr32[1]) 410 return (-1); 411 if (a->ext.addr.addr32[1] > b->ext.addr.addr32[1]) 412 return (1); 413 if (a->ext.addr.addr32[1] < b->ext.addr.addr32[1]) 414 return (-1); 415 if (a->lan.addr.addr32[0] > b->lan.addr.addr32[0]) 416 return (1); 417 if (a->lan.addr.addr32[0] < b->lan.addr.addr32[0]) 418 return (-1); 419 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0]) 420 return (1); 421 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0]) 422 return (-1); 423 break; 424 #endif /* INET6 */ 425 } 426 427 if ((diff = a->lan.port - b->lan.port) != 0) 428 return (diff); 429 if ((diff = a->ext.port - b->ext.port) != 0) 430 return (diff); 431 432 return (0); 433 } 434 435 static __inline int 436 pf_state_compare_ext_gwy(struct pf_state *a, struct pf_state *b) 437 { 438 int diff; 439 440 if ((diff = a->proto - b->proto) != 0) 441 return (diff); 442 if ((diff = a->af - b->af) != 0) 443 return (diff); 444 switch (a->af) { 445 #ifdef INET 446 case AF_INET: 447 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0]) 448 return (1); 449 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0]) 450 return (-1); 451 if (a->gwy.addr.addr32[0] > b->gwy.addr.addr32[0]) 452 return (1); 453 if (a->gwy.addr.addr32[0] < b->gwy.addr.addr32[0]) 454 return (-1); 455 break; 456 #endif /* INET */ 457 #ifdef INET6 458 case AF_INET6: 459 if (a->ext.addr.addr32[3] > b->ext.addr.addr32[3]) 460 return (1); 461 if (a->ext.addr.addr32[3] < b->ext.addr.addr32[3]) 462 return (-1); 463 if (a->gwy.addr.addr32[3] > b->gwy.addr.addr32[3]) 464 return (1); 465 if (a->gwy.addr.addr32[3] < b->gwy.addr.addr32[3]) 466 return (-1); 467 if (a->ext.addr.addr32[2] > b->ext.addr.addr32[2]) 468 return (1); 469 if (a->ext.addr.addr32[2] < b->ext.addr.addr32[2]) 470 return (-1); 471 if (a->gwy.addr.addr32[2] > b->gwy.addr.addr32[2]) 472 return (1); 473 if (a->gwy.addr.addr32[2] < b->gwy.addr.addr32[2]) 474 return (-1); 475 if (a->ext.addr.addr32[1] > b->ext.addr.addr32[1]) 476 return (1); 477 if (a->ext.addr.addr32[1] < b->ext.addr.addr32[1]) 478 return (-1); 479 if (a->gwy.addr.addr32[1] > b->gwy.addr.addr32[1]) 480 return (1); 481 if (a->gwy.addr.addr32[1] < b->gwy.addr.addr32[1]) 482 return (-1); 483 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0]) 484 return (1); 485 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0]) 486 return (-1); 487 if (a->gwy.addr.addr32[0] > b->gwy.addr.addr32[0]) 488 return (1); 489 if (a->gwy.addr.addr32[0] < b->gwy.addr.addr32[0]) 490 return (-1); 491 break; 492 #endif /* INET6 */ 493 } 494 495 if ((diff = a->ext.port - b->ext.port) != 0) 496 return (diff); 497 if ((diff = a->gwy.port - b->gwy.port) != 0) 498 return (diff); 499 500 return (0); 501 } 502 503 static __inline int 504 pf_state_compare_id(struct pf_state *a, struct pf_state *b) 505 { 506 if (a->id > b->id) 507 return (1); 508 if (a->id < b->id) 509 return (-1); 510 if (a->creatorid > b->creatorid) 511 return (1); 512 if (a->creatorid < b->creatorid) 513 return (-1); 514 515 return (0); 516 } 517 518 static __inline int 519 pf_anchor_compare(struct pf_anchor *a, struct pf_anchor *b) 520 { 521 int c = strcmp(a->path, b->path); 522 523 return (c ? (c < 0 ? -1 : 1) : 0); 524 } 525 526 #ifdef INET6 527 void 528 pf_addrcpy(struct pf_addr *dst, struct pf_addr *src, sa_family_t af) 529 { 530 switch (af) { 531 #ifdef INET 532 case AF_INET: 533 dst->addr32[0] = src->addr32[0]; 534 break; 535 #endif /* INET */ 536 case AF_INET6: 537 dst->addr32[0] = src->addr32[0]; 538 dst->addr32[1] = src->addr32[1]; 539 dst->addr32[2] = src->addr32[2]; 540 dst->addr32[3] = src->addr32[3]; 541 break; 542 } 543 } 544 #endif /* INET6 */ 545 546 struct pf_state * 547 pf_find_state_byid(struct pf_state *key) 548 { 549 pf_status.fcounters[FCNT_STATE_SEARCH]++; 550 return (RB_FIND(pf_state_tree_id, &tree_id, key)); 551 } 552 553 struct pf_state * 554 pf_find_state_recurse(struct pfi_kif *kif, struct pf_state *key, u_int8_t tree) 555 { 556 struct pf_state *s; 557 558 pf_status.fcounters[FCNT_STATE_SEARCH]++; 559 560 switch (tree) { 561 case PF_LAN_EXT: 562 for (; kif != NULL; kif = kif->pfik_parent) { 563 s = RB_FIND(pf_state_tree_lan_ext, 564 &kif->pfik_lan_ext, key); 565 if (s != NULL) 566 return (s); 567 } 568 return (NULL); 569 case PF_EXT_GWY: 570 for (; kif != NULL; kif = kif->pfik_parent) { 571 s = RB_FIND(pf_state_tree_ext_gwy, 572 &kif->pfik_ext_gwy, key); 573 if (s != NULL) 574 return (s); 575 } 576 return (NULL); 577 default: 578 panic("pf_find_state_recurse"); 579 } 580 } 581 582 struct pf_state * 583 pf_find_state_all(struct pf_state *key, u_int8_t tree, int *more) 584 { 585 struct pf_state *s, *ss = NULL; 586 struct pfi_kif *kif; 587 588 pf_status.fcounters[FCNT_STATE_SEARCH]++; 589 590 switch (tree) { 591 case PF_LAN_EXT: 592 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) { 593 s = RB_FIND(pf_state_tree_lan_ext, 594 &kif->pfik_lan_ext, key); 595 if (s == NULL) 596 continue; 597 if (more == NULL) 598 return (s); 599 ss = s; 600 (*more)++; 601 } 602 return (ss); 603 case PF_EXT_GWY: 604 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) { 605 s = RB_FIND(pf_state_tree_ext_gwy, 606 &kif->pfik_ext_gwy, key); 607 if (s == NULL) 608 continue; 609 if (more == NULL) 610 return (s); 611 ss = s; 612 (*more)++; 613 } 614 return (ss); 615 default: 616 panic("pf_find_state_all"); 617 } 618 } 619 620 void 621 pf_init_threshold(struct pf_threshold *threshold, 622 u_int32_t limit, u_int32_t seconds) 623 { 624 threshold->limit = limit * PF_THRESHOLD_MULT; 625 threshold->seconds = seconds; 626 threshold->count = 0; 627 threshold->last = time_second; 628 } 629 630 void 631 pf_add_threshold(struct pf_threshold *threshold) 632 { 633 u_int32_t t = time_second, diff = t - threshold->last; 634 635 if (diff >= threshold->seconds) 636 threshold->count = 0; 637 else 638 threshold->count -= threshold->count * diff / 639 threshold->seconds; 640 threshold->count += PF_THRESHOLD_MULT; 641 threshold->last = t; 642 } 643 644 int 645 pf_check_threshold(struct pf_threshold *threshold) 646 { 647 return (threshold->count > threshold->limit); 648 } 649 650 int 651 pf_src_connlimit(struct pf_state **state) 652 { 653 struct pf_state *s; 654 int bad = 0; 655 656 (*state)->src_node->conn++; 657 pf_add_threshold(&(*state)->src_node->conn_rate); 658 659 if ((*state)->rule.ptr->max_src_conn && 660 (*state)->rule.ptr->max_src_conn < 661 (*state)->src_node->conn) { 662 pf_status.lcounters[LCNT_SRCCONN]++; 663 bad++; 664 } 665 666 if ((*state)->rule.ptr->max_src_conn_rate.limit && 667 pf_check_threshold(&(*state)->src_node->conn_rate)) { 668 pf_status.lcounters[LCNT_SRCCONNRATE]++; 669 bad++; 670 } 671 672 if (!bad) 673 return (0); 674 675 if ((*state)->rule.ptr->overload_tbl) { 676 struct pfr_addr p; 677 u_int32_t killed = 0; 678 679 pf_status.lcounters[LCNT_OVERLOAD_TABLE]++; 680 if (pf_status.debug >= PF_DEBUG_MISC) { 681 printf("pf_src_connlimit: blocking address "); 682 pf_print_host(&(*state)->src_node->addr, 0, 683 (*state)->af); 684 } 685 686 bzero(&p, sizeof(p)); 687 p.pfra_af = (*state)->af; 688 switch ((*state)->af) { 689 #ifdef INET 690 case AF_INET: 691 p.pfra_net = 32; 692 p.pfra_ip4addr = (*state)->src_node->addr.v4; 693 break; 694 #endif /* INET */ 695 #ifdef INET6 696 case AF_INET6: 697 p.pfra_net = 128; 698 p.pfra_ip6addr = (*state)->src_node->addr.v6; 699 break; 700 #endif /* INET6 */ 701 } 702 703 pfr_insert_kentry((*state)->rule.ptr->overload_tbl, 704 &p, time_second); 705 706 /* kill existing states if that's required. */ 707 if ((*state)->rule.ptr->flush) { 708 pf_status.lcounters[LCNT_OVERLOAD_FLUSH]++; 709 710 RB_FOREACH(s, pf_state_tree_id, &tree_id) { 711 /* 712 * Kill states from this source. (Only those 713 * from the same rule if PF_FLUSH_GLOBAL is not 714 * set) 715 */ 716 if (s->af == (*state)->af && 717 (((*state)->direction == PF_OUT && 718 PF_AEQ(&(*state)->src_node->addr, 719 &s->lan.addr, s->af)) || 720 ((*state)->direction == PF_IN && 721 PF_AEQ(&(*state)->src_node->addr, 722 &s->ext.addr, s->af))) && 723 ((*state)->rule.ptr->flush & 724 PF_FLUSH_GLOBAL || 725 (*state)->rule.ptr == s->rule.ptr)) { 726 s->timeout = PFTM_PURGE; 727 s->src.state = s->dst.state = 728 TCPS_CLOSED; 729 killed++; 730 } 731 } 732 if (pf_status.debug >= PF_DEBUG_MISC) 733 printf(", %u states killed", killed); 734 } 735 if (pf_status.debug >= PF_DEBUG_MISC) 736 printf("\n"); 737 } 738 739 /* kill this state */ 740 (*state)->timeout = PFTM_PURGE; 741 (*state)->src.state = (*state)->dst.state = TCPS_CLOSED; 742 return (1); 743 } 744 745 int 746 pf_insert_src_node(struct pf_src_node **sn, struct pf_rule *rule, 747 struct pf_addr *src, sa_family_t af) 748 { 749 struct pf_src_node k; 750 751 if (*sn == NULL) { 752 k.af = af; 753 PF_ACPY(&k.addr, src, af); 754 if (rule->rule_flag & PFRULE_RULESRCTRACK || 755 rule->rpool.opts & PF_POOL_STICKYADDR) 756 k.rule.ptr = rule; 757 else 758 k.rule.ptr = NULL; 759 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++; 760 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k); 761 } 762 if (*sn == NULL) { 763 if (!rule->max_src_nodes || 764 rule->src_nodes < rule->max_src_nodes) 765 (*sn) = pool_get(&pf_src_tree_pl, PR_NOWAIT); 766 else 767 pf_status.lcounters[LCNT_SRCNODES]++; 768 if ((*sn) == NULL) 769 return (-1); 770 bzero(*sn, sizeof(struct pf_src_node)); 771 772 pf_init_threshold(&(*sn)->conn_rate, 773 rule->max_src_conn_rate.limit, 774 rule->max_src_conn_rate.seconds); 775 776 (*sn)->af = af; 777 if (rule->rule_flag & PFRULE_RULESRCTRACK || 778 rule->rpool.opts & PF_POOL_STICKYADDR) 779 (*sn)->rule.ptr = rule; 780 else 781 (*sn)->rule.ptr = NULL; 782 PF_ACPY(&(*sn)->addr, src, af); 783 if (RB_INSERT(pf_src_tree, 784 &tree_src_tracking, *sn) != NULL) { 785 if (pf_status.debug >= PF_DEBUG_MISC) { 786 printf("pf: src_tree insert failed: "); 787 pf_print_host(&(*sn)->addr, 0, af); 788 printf("\n"); 789 } 790 pool_put(&pf_src_tree_pl, *sn); 791 return (-1); 792 } 793 (*sn)->creation = time_second; 794 (*sn)->ruletype = rule->action; 795 if ((*sn)->rule.ptr != NULL) 796 (*sn)->rule.ptr->src_nodes++; 797 pf_status.scounters[SCNT_SRC_NODE_INSERT]++; 798 pf_status.src_nodes++; 799 } else { 800 if (rule->max_src_states && 801 (*sn)->states >= rule->max_src_states) { 802 pf_status.lcounters[LCNT_SRCSTATES]++; 803 return (-1); 804 } 805 } 806 return (0); 807 } 808 809 int 810 pf_insert_state(struct pfi_kif *kif, struct pf_state *state) 811 { 812 /* Thou MUST NOT insert multiple duplicate keys */ 813 state->u.s.kif = kif; 814 if (RB_INSERT(pf_state_tree_lan_ext, &kif->pfik_lan_ext, state)) { 815 if (pf_status.debug >= PF_DEBUG_MISC) { 816 printf("pf: state insert failed: tree_lan_ext"); 817 printf(" lan: "); 818 pf_print_host(&state->lan.addr, state->lan.port, 819 state->af); 820 printf(" gwy: "); 821 pf_print_host(&state->gwy.addr, state->gwy.port, 822 state->af); 823 printf(" ext: "); 824 pf_print_host(&state->ext.addr, state->ext.port, 825 state->af); 826 if (state->sync_flags & PFSTATE_FROMSYNC) 827 printf(" (from sync)"); 828 printf("\n"); 829 } 830 return (-1); 831 } 832 833 if (RB_INSERT(pf_state_tree_ext_gwy, &kif->pfik_ext_gwy, state)) { 834 if (pf_status.debug >= PF_DEBUG_MISC) { 835 printf("pf: state insert failed: tree_ext_gwy"); 836 printf(" lan: "); 837 pf_print_host(&state->lan.addr, state->lan.port, 838 state->af); 839 printf(" gwy: "); 840 pf_print_host(&state->gwy.addr, state->gwy.port, 841 state->af); 842 printf(" ext: "); 843 pf_print_host(&state->ext.addr, state->ext.port, 844 state->af); 845 if (state->sync_flags & PFSTATE_FROMSYNC) 846 printf(" (from sync)"); 847 printf("\n"); 848 } 849 RB_REMOVE(pf_state_tree_lan_ext, &kif->pfik_lan_ext, state); 850 return (-1); 851 } 852 853 if (state->id == 0 && state->creatorid == 0) { 854 state->id = htobe64(pf_status.stateid++); 855 state->creatorid = pf_status.hostid; 856 } 857 if (RB_INSERT(pf_state_tree_id, &tree_id, state) != NULL) { 858 if (pf_status.debug >= PF_DEBUG_MISC) { 859 #ifdef __OpenBSD__ 860 printf("pf: state insert failed: " 861 "id: %016llx creatorid: %08x", 862 betoh64(state->id), ntohl(state->creatorid)); 863 #else 864 printf("pf: state insert failed: " 865 "id: %016" PRIx64 " creatorid: %08x", 866 be64toh(state->id), ntohl(state->creatorid)); 867 #endif 868 if (state->sync_flags & PFSTATE_FROMSYNC) 869 printf(" (from sync)"); 870 printf("\n"); 871 } 872 RB_REMOVE(pf_state_tree_lan_ext, &kif->pfik_lan_ext, state); 873 RB_REMOVE(pf_state_tree_ext_gwy, &kif->pfik_ext_gwy, state); 874 return (-1); 875 } 876 TAILQ_INSERT_HEAD(&state_updates, state, u.s.entry_updates); 877 878 pf_status.fcounters[FCNT_STATE_INSERT]++; 879 pf_status.states++; 880 pfi_attach_state(kif); 881 #if NPFSYNC 882 pfsync_insert_state(state); 883 #endif 884 return (0); 885 } 886 887 void 888 pf_purge_timeout(void *arg) 889 { 890 #ifdef __OpenBSD__ 891 struct timeout *to = arg; 892 #else 893 struct callout *to = arg; 894 #endif 895 int s; 896 897 s = splsoftnet(); 898 pf_purge_expired_states(); 899 pf_purge_expired_fragments(); 900 pf_purge_expired_src_nodes(); 901 splx(s); 902 903 #ifdef __OpenBSD__ 904 timeout_add(to, pf_default_rule.timeout[PFTM_INTERVAL] * hz); 905 #else 906 callout_schedule(to, pf_default_rule.timeout[PFTM_INTERVAL] * hz); 907 #endif 908 } 909 910 u_int32_t 911 pf_state_expires(const struct pf_state *state) 912 { 913 u_int32_t timeout; 914 u_int32_t start; 915 u_int32_t end; 916 u_int32_t states; 917 918 /* handle all PFTM_* > PFTM_MAX here */ 919 if (state->timeout == PFTM_PURGE) 920 return (time_second); 921 if (state->timeout == PFTM_UNTIL_PACKET) 922 return (0); 923 KASSERT(state->timeout < PFTM_MAX); 924 timeout = state->rule.ptr->timeout[state->timeout]; 925 if (!timeout) 926 timeout = pf_default_rule.timeout[state->timeout]; 927 start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START]; 928 if (start) { 929 end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END]; 930 states = state->rule.ptr->states; 931 } else { 932 start = pf_default_rule.timeout[PFTM_ADAPTIVE_START]; 933 end = pf_default_rule.timeout[PFTM_ADAPTIVE_END]; 934 states = pf_status.states; 935 } 936 if (end && states > start && start < end) { 937 if (states < end) 938 return (state->expire + timeout * (end - states) / 939 (end - start)); 940 else 941 return (time_second); 942 } 943 return (state->expire + timeout); 944 } 945 946 void 947 pf_purge_expired_src_nodes(void) 948 { 949 struct pf_src_node *cur, *next; 950 951 for (cur = RB_MIN(pf_src_tree, &tree_src_tracking); cur; cur = next) { 952 next = RB_NEXT(pf_src_tree, &tree_src_tracking, cur); 953 954 if (cur->states <= 0 && cur->expire <= time_second) { 955 if (cur->rule.ptr != NULL) { 956 cur->rule.ptr->src_nodes--; 957 if (cur->rule.ptr->states <= 0 && 958 cur->rule.ptr->max_src_nodes <= 0) 959 pf_rm_rule(NULL, cur->rule.ptr); 960 } 961 RB_REMOVE(pf_src_tree, &tree_src_tracking, cur); 962 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 963 pf_status.src_nodes--; 964 pool_put(&pf_src_tree_pl, cur); 965 } 966 } 967 } 968 969 void 970 pf_src_tree_remove_state(struct pf_state *s) 971 { 972 u_int32_t timeout; 973 974 if (s->src_node != NULL) { 975 if (s->proto == IPPROTO_TCP) { 976 if (s->src.state == PF_TCPS_PROXY_DST || 977 s->timeout >= PFTM_TCP_ESTABLISHED) 978 --s->src_node->conn; 979 } 980 if (--s->src_node->states <= 0) { 981 timeout = s->rule.ptr->timeout[PFTM_SRC_NODE]; 982 if (!timeout) 983 timeout = 984 pf_default_rule.timeout[PFTM_SRC_NODE]; 985 s->src_node->expire = time_second + timeout; 986 } 987 } 988 if (s->nat_src_node != s->src_node && s->nat_src_node != NULL) { 989 if (--s->nat_src_node->states <= 0) { 990 timeout = s->rule.ptr->timeout[PFTM_SRC_NODE]; 991 if (!timeout) 992 timeout = 993 pf_default_rule.timeout[PFTM_SRC_NODE]; 994 s->nat_src_node->expire = time_second + timeout; 995 } 996 } 997 s->src_node = s->nat_src_node = NULL; 998 } 999 1000 void 1001 pf_purge_expired_state(struct pf_state *cur) 1002 { 1003 if (cur->src.state == PF_TCPS_PROXY_DST) 1004 pf_send_tcp(cur->rule.ptr, cur->af, 1005 &cur->ext.addr, &cur->lan.addr, 1006 cur->ext.port, cur->lan.port, 1007 cur->src.seqhi, cur->src.seqlo + 1, 1008 TH_RST|TH_ACK, 0, 0, 0, 1, NULL, NULL); 1009 RB_REMOVE(pf_state_tree_ext_gwy, 1010 &cur->u.s.kif->pfik_ext_gwy, cur); 1011 RB_REMOVE(pf_state_tree_lan_ext, 1012 &cur->u.s.kif->pfik_lan_ext, cur); 1013 RB_REMOVE(pf_state_tree_id, &tree_id, cur); 1014 #if NPFSYNC 1015 pfsync_delete_state(cur); 1016 #endif 1017 pf_src_tree_remove_state(cur); 1018 if (--cur->rule.ptr->states <= 0 && 1019 cur->rule.ptr->src_nodes <= 0) 1020 pf_rm_rule(NULL, cur->rule.ptr); 1021 if (cur->nat_rule.ptr != NULL) 1022 if (--cur->nat_rule.ptr->states <= 0 && 1023 cur->nat_rule.ptr->src_nodes <= 0) 1024 pf_rm_rule(NULL, cur->nat_rule.ptr); 1025 if (cur->anchor.ptr != NULL) 1026 if (--cur->anchor.ptr->states <= 0) 1027 pf_rm_rule(NULL, cur->anchor.ptr); 1028 pf_normalize_tcp_cleanup(cur); 1029 pfi_detach_state(cur->u.s.kif); 1030 TAILQ_REMOVE(&state_updates, cur, u.s.entry_updates); 1031 if (cur->tag) 1032 pf_tag_unref(cur->tag); 1033 pool_put(&pf_state_pl, cur); 1034 pf_status.fcounters[FCNT_STATE_REMOVALS]++; 1035 pf_status.states--; 1036 } 1037 1038 void 1039 pf_purge_expired_states(void) 1040 { 1041 struct pf_state *cur, *next; 1042 1043 for (cur = RB_MIN(pf_state_tree_id, &tree_id); 1044 cur; cur = next) { 1045 next = RB_NEXT(pf_state_tree_id, &tree_id, cur); 1046 if (pf_state_expires(cur) <= time_second) 1047 pf_purge_expired_state(cur); 1048 } 1049 } 1050 1051 int 1052 pf_tbladdr_setup(struct pf_ruleset *rs, struct pf_addr_wrap *aw) 1053 { 1054 if (aw->type != PF_ADDR_TABLE) 1055 return (0); 1056 if ((aw->p.tbl = pfr_attach_table(rs, aw->v.tblname)) == NULL) 1057 return (1); 1058 return (0); 1059 } 1060 1061 void 1062 pf_tbladdr_remove(struct pf_addr_wrap *aw) 1063 { 1064 if (aw->type != PF_ADDR_TABLE || aw->p.tbl == NULL) 1065 return; 1066 pfr_detach_table(aw->p.tbl); 1067 aw->p.tbl = NULL; 1068 } 1069 1070 void 1071 pf_tbladdr_copyout(struct pf_addr_wrap *aw) 1072 { 1073 struct pfr_ktable *kt = aw->p.tbl; 1074 1075 if (aw->type != PF_ADDR_TABLE || kt == NULL) 1076 return; 1077 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 1078 kt = kt->pfrkt_root; 1079 aw->p.tbl = NULL; 1080 aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ? 1081 kt->pfrkt_cnt : -1; 1082 } 1083 1084 void 1085 pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af) 1086 { 1087 switch (af) { 1088 #ifdef INET 1089 case AF_INET: { 1090 u_int32_t a = ntohl(addr->addr32[0]); 1091 printf("%u.%u.%u.%u", (a>>24)&255, (a>>16)&255, 1092 (a>>8)&255, a&255); 1093 if (p) { 1094 p = ntohs(p); 1095 printf(":%u", p); 1096 } 1097 break; 1098 } 1099 #endif /* INET */ 1100 #ifdef INET6 1101 case AF_INET6: { 1102 u_int16_t b; 1103 u_int8_t i, curstart = 255, curend = 0, 1104 maxstart = 255, maxend = 255; 1105 for (i = 0; i < 8; i++) { 1106 if (!addr->addr16[i]) { 1107 if (curstart == 255) 1108 curstart = i; 1109 else 1110 curend = i; 1111 } else { 1112 if (curstart != 255) { 1113 if ((curend - curstart) > 1114 (maxend - maxstart)) { 1115 maxstart = curstart; 1116 maxend = curend; 1117 } 1118 curstart = 255; 1119 } 1120 } 1121 } 1122 for (i = 0; i < 8; i++) { 1123 if (i >= maxstart && i <= maxend) { 1124 if (maxstart == 0) { 1125 if (i < 2) 1126 printf(":"); 1127 } else if (maxend != 7) { 1128 if (i == maxstart) 1129 printf(":"); 1130 } else { 1131 if (i == maxend) 1132 printf(":"); 1133 } 1134 } else { 1135 b = ntohs(addr->addr16[i]); 1136 printf("%x", b); 1137 if (i < 7) 1138 printf(":"); 1139 } 1140 } 1141 if (p) { 1142 p = ntohs(p); 1143 printf("[%u]", p); 1144 } 1145 break; 1146 } 1147 #endif /* INET6 */ 1148 } 1149 } 1150 1151 void 1152 pf_print_state(struct pf_state *s) 1153 { 1154 switch (s->proto) { 1155 case IPPROTO_TCP: 1156 printf("TCP "); 1157 break; 1158 case IPPROTO_UDP: 1159 printf("UDP "); 1160 break; 1161 case IPPROTO_ICMP: 1162 printf("ICMP "); 1163 break; 1164 case IPPROTO_ICMPV6: 1165 printf("ICMPV6 "); 1166 break; 1167 default: 1168 printf("%u ", s->proto); 1169 break; 1170 } 1171 pf_print_host(&s->lan.addr, s->lan.port, s->af); 1172 printf(" "); 1173 pf_print_host(&s->gwy.addr, s->gwy.port, s->af); 1174 printf(" "); 1175 pf_print_host(&s->ext.addr, s->ext.port, s->af); 1176 printf(" [lo=%u high=%u win=%u modulator=%u", s->src.seqlo, 1177 s->src.seqhi, s->src.max_win, s->src.seqdiff); 1178 if (s->src.wscale && s->dst.wscale) 1179 printf(" wscale=%u", s->src.wscale & PF_WSCALE_MASK); 1180 printf("]"); 1181 printf(" [lo=%u high=%u win=%u modulator=%u", s->dst.seqlo, 1182 s->dst.seqhi, s->dst.max_win, s->dst.seqdiff); 1183 if (s->src.wscale && s->dst.wscale) 1184 printf(" wscale=%u", s->dst.wscale & PF_WSCALE_MASK); 1185 printf("]"); 1186 printf(" %u:%u", s->src.state, s->dst.state); 1187 } 1188 1189 void 1190 pf_print_flags(u_int8_t f) 1191 { 1192 if (f) 1193 printf(" "); 1194 if (f & TH_FIN) 1195 printf("F"); 1196 if (f & TH_SYN) 1197 printf("S"); 1198 if (f & TH_RST) 1199 printf("R"); 1200 if (f & TH_PUSH) 1201 printf("P"); 1202 if (f & TH_ACK) 1203 printf("A"); 1204 if (f & TH_URG) 1205 printf("U"); 1206 if (f & TH_ECE) 1207 printf("E"); 1208 if (f & TH_CWR) 1209 printf("W"); 1210 } 1211 1212 #define PF_SET_SKIP_STEPS(i) \ 1213 do { \ 1214 while (head[i] != cur) { \ 1215 head[i]->skip[i].ptr = cur; \ 1216 head[i] = TAILQ_NEXT(head[i], entries); \ 1217 } \ 1218 } while (0) 1219 1220 void 1221 pf_calc_skip_steps(struct pf_rulequeue *rules) 1222 { 1223 struct pf_rule *cur, *prev, *head[PF_SKIP_COUNT]; 1224 int i; 1225 1226 cur = TAILQ_FIRST(rules); 1227 prev = cur; 1228 for (i = 0; i < PF_SKIP_COUNT; ++i) 1229 head[i] = cur; 1230 while (cur != NULL) { 1231 1232 if (cur->kif != prev->kif || cur->ifnot != prev->ifnot) 1233 PF_SET_SKIP_STEPS(PF_SKIP_IFP); 1234 if (cur->direction != prev->direction) 1235 PF_SET_SKIP_STEPS(PF_SKIP_DIR); 1236 if (cur->af != prev->af) 1237 PF_SET_SKIP_STEPS(PF_SKIP_AF); 1238 if (cur->proto != prev->proto) 1239 PF_SET_SKIP_STEPS(PF_SKIP_PROTO); 1240 if (cur->src.neg != prev->src.neg || 1241 pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr)) 1242 PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR); 1243 if (cur->src.port[0] != prev->src.port[0] || 1244 cur->src.port[1] != prev->src.port[1] || 1245 cur->src.port_op != prev->src.port_op) 1246 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT); 1247 if (cur->dst.neg != prev->dst.neg || 1248 pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr)) 1249 PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR); 1250 if (cur->dst.port[0] != prev->dst.port[0] || 1251 cur->dst.port[1] != prev->dst.port[1] || 1252 cur->dst.port_op != prev->dst.port_op) 1253 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT); 1254 1255 prev = cur; 1256 cur = TAILQ_NEXT(cur, entries); 1257 } 1258 for (i = 0; i < PF_SKIP_COUNT; ++i) 1259 PF_SET_SKIP_STEPS(i); 1260 } 1261 1262 int 1263 pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2) 1264 { 1265 if (aw1->type != aw2->type) 1266 return (1); 1267 switch (aw1->type) { 1268 case PF_ADDR_ADDRMASK: 1269 if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, 0)) 1270 return (1); 1271 if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, 0)) 1272 return (1); 1273 return (0); 1274 case PF_ADDR_DYNIFTL: 1275 return (aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt); 1276 case PF_ADDR_NOROUTE: 1277 return (0); 1278 case PF_ADDR_TABLE: 1279 return (aw1->p.tbl != aw2->p.tbl); 1280 default: 1281 printf("invalid address type: %d\n", aw1->type); 1282 return (1); 1283 } 1284 } 1285 1286 u_int16_t 1287 pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp) 1288 { 1289 u_int32_t l; 1290 1291 if (udp && !cksum) 1292 return (0x0000); 1293 l = cksum + old - new; 1294 l = (l >> 16) + (l & 65535); 1295 l = l & 65535; 1296 if (udp && !l) 1297 return (0xFFFF); 1298 return (l); 1299 } 1300 1301 void 1302 pf_change_ap(struct pf_addr *a, u_int16_t *p, u_int16_t *ic, u_int16_t *pc, 1303 struct pf_addr *an, u_int16_t pn, u_int8_t u, sa_family_t af) 1304 { 1305 struct pf_addr ao; 1306 u_int16_t po = *p; 1307 1308 PF_ACPY(&ao, a, af); 1309 PF_ACPY(a, an, af); 1310 1311 *p = pn; 1312 1313 switch (af) { 1314 #ifdef INET 1315 case AF_INET: 1316 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic, 1317 ao.addr16[0], an->addr16[0], 0), 1318 ao.addr16[1], an->addr16[1], 0); 1319 *p = pn; 1320 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc, 1321 ao.addr16[0], an->addr16[0], u), 1322 ao.addr16[1], an->addr16[1], u), 1323 po, pn, u); 1324 break; 1325 #endif /* INET */ 1326 #ifdef INET6 1327 case AF_INET6: 1328 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1329 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1330 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc, 1331 ao.addr16[0], an->addr16[0], u), 1332 ao.addr16[1], an->addr16[1], u), 1333 ao.addr16[2], an->addr16[2], u), 1334 ao.addr16[3], an->addr16[3], u), 1335 ao.addr16[4], an->addr16[4], u), 1336 ao.addr16[5], an->addr16[5], u), 1337 ao.addr16[6], an->addr16[6], u), 1338 ao.addr16[7], an->addr16[7], u), 1339 po, pn, u); 1340 break; 1341 #endif /* INET6 */ 1342 } 1343 } 1344 1345 1346 /* Changes a u_int32_t. Uses a void * so there are no align restrictions */ 1347 void 1348 pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u) 1349 { 1350 u_int32_t ao; 1351 1352 memcpy(&ao, a, sizeof(ao)); 1353 memcpy(a, &an, sizeof(u_int32_t)); 1354 *c = pf_cksum_fixup(pf_cksum_fixup(*c, ao / 65536, an / 65536, u), 1355 ao % 65536, an % 65536, u); 1356 } 1357 1358 #ifdef INET6 1359 void 1360 pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u) 1361 { 1362 struct pf_addr ao; 1363 1364 PF_ACPY(&ao, a, AF_INET6); 1365 PF_ACPY(a, an, AF_INET6); 1366 1367 *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1368 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1369 pf_cksum_fixup(pf_cksum_fixup(*c, 1370 ao.addr16[0], an->addr16[0], u), 1371 ao.addr16[1], an->addr16[1], u), 1372 ao.addr16[2], an->addr16[2], u), 1373 ao.addr16[3], an->addr16[3], u), 1374 ao.addr16[4], an->addr16[4], u), 1375 ao.addr16[5], an->addr16[5], u), 1376 ao.addr16[6], an->addr16[6], u), 1377 ao.addr16[7], an->addr16[7], u); 1378 } 1379 #endif /* INET6 */ 1380 1381 void 1382 pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa, 1383 struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c, 1384 u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af) 1385 { 1386 struct pf_addr oia, ooa; 1387 1388 PF_ACPY(&oia, ia, af); 1389 PF_ACPY(&ooa, oa, af); 1390 1391 /* Change inner protocol port, fix inner protocol checksum. */ 1392 if (ip != NULL) { 1393 u_int16_t oip = *ip; 1394 u_int32_t opc = 0; 1395 1396 if (pc != NULL) 1397 opc = *pc; 1398 *ip = np; 1399 if (pc != NULL) 1400 *pc = pf_cksum_fixup(*pc, oip, *ip, u); 1401 *ic = pf_cksum_fixup(*ic, oip, *ip, 0); 1402 if (pc != NULL) 1403 *ic = pf_cksum_fixup(*ic, opc, *pc, 0); 1404 } 1405 /* Change inner ip address, fix inner ip and icmp checksums. */ 1406 PF_ACPY(ia, na, af); 1407 switch (af) { 1408 #ifdef INET 1409 case AF_INET: { 1410 u_int32_t oh2c = *h2c; 1411 1412 *h2c = pf_cksum_fixup(pf_cksum_fixup(*h2c, 1413 oia.addr16[0], ia->addr16[0], 0), 1414 oia.addr16[1], ia->addr16[1], 0); 1415 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic, 1416 oia.addr16[0], ia->addr16[0], 0), 1417 oia.addr16[1], ia->addr16[1], 0); 1418 *ic = pf_cksum_fixup(*ic, oh2c, *h2c, 0); 1419 break; 1420 } 1421 #endif /* INET */ 1422 #ifdef INET6 1423 case AF_INET6: 1424 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1425 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1426 pf_cksum_fixup(pf_cksum_fixup(*ic, 1427 oia.addr16[0], ia->addr16[0], u), 1428 oia.addr16[1], ia->addr16[1], u), 1429 oia.addr16[2], ia->addr16[2], u), 1430 oia.addr16[3], ia->addr16[3], u), 1431 oia.addr16[4], ia->addr16[4], u), 1432 oia.addr16[5], ia->addr16[5], u), 1433 oia.addr16[6], ia->addr16[6], u), 1434 oia.addr16[7], ia->addr16[7], u); 1435 break; 1436 #endif /* INET6 */ 1437 } 1438 /* Change outer ip address, fix outer ip or icmpv6 checksum. */ 1439 PF_ACPY(oa, na, af); 1440 switch (af) { 1441 #ifdef INET 1442 case AF_INET: 1443 *hc = pf_cksum_fixup(pf_cksum_fixup(*hc, 1444 ooa.addr16[0], oa->addr16[0], 0), 1445 ooa.addr16[1], oa->addr16[1], 0); 1446 break; 1447 #endif /* INET */ 1448 #ifdef INET6 1449 case AF_INET6: 1450 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1451 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1452 pf_cksum_fixup(pf_cksum_fixup(*ic, 1453 ooa.addr16[0], oa->addr16[0], u), 1454 ooa.addr16[1], oa->addr16[1], u), 1455 ooa.addr16[2], oa->addr16[2], u), 1456 ooa.addr16[3], oa->addr16[3], u), 1457 ooa.addr16[4], oa->addr16[4], u), 1458 ooa.addr16[5], oa->addr16[5], u), 1459 ooa.addr16[6], oa->addr16[6], u), 1460 ooa.addr16[7], oa->addr16[7], u); 1461 break; 1462 #endif /* INET6 */ 1463 } 1464 } 1465 1466 void 1467 pf_send_tcp(const struct pf_rule *r, sa_family_t af, 1468 const struct pf_addr *saddr, const struct pf_addr *daddr, 1469 u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack, 1470 u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl, int tag, 1471 struct ether_header *eh, struct ifnet *ifp) 1472 { 1473 struct mbuf *m; 1474 int len, tlen; 1475 #ifdef INET 1476 struct ip *h = NULL; 1477 #endif /* INET */ 1478 #ifdef INET6 1479 struct ip6_hdr *h6 = NULL; 1480 #endif /* INET6 */ 1481 struct tcphdr *th; 1482 char *opt; 1483 1484 /* maximum segment size tcp option */ 1485 tlen = sizeof(struct tcphdr); 1486 if (mss) 1487 tlen += 4; 1488 1489 switch (af) { 1490 #ifdef INET 1491 case AF_INET: 1492 len = sizeof(struct ip) + tlen; 1493 break; 1494 #endif /* INET */ 1495 #ifdef INET6 1496 case AF_INET6: 1497 len = sizeof(struct ip6_hdr) + tlen; 1498 break; 1499 #endif /* INET6 */ 1500 default: 1501 return; 1502 } 1503 1504 /* create outgoing mbuf */ 1505 m = m_gethdr(M_DONTWAIT, MT_HEADER); 1506 if (m == NULL) 1507 return; 1508 if (tag) { 1509 struct m_tag *mtag; 1510 1511 mtag = m_tag_get(PACKET_TAG_PF_GENERATED, 0, M_NOWAIT); 1512 if (mtag == NULL) { 1513 m_freem(m); 1514 return; 1515 } 1516 m_tag_prepend(m, mtag); 1517 } 1518 #ifdef ALTQ 1519 if (r != NULL && r->qid) { 1520 struct m_tag *mtag; 1521 struct altq_tag *atag; 1522 1523 mtag = m_tag_get(PACKET_TAG_PF_QID, sizeof(*atag), M_NOWAIT); 1524 if (mtag != NULL) { 1525 atag = (struct altq_tag *)(mtag + 1); 1526 atag->qid = r->qid; 1527 /* add hints for ecn */ 1528 atag->af = af; 1529 atag->hdr = mtod(m, struct ip *); 1530 m_tag_prepend(m, mtag); 1531 } 1532 } 1533 #endif /* ALTQ */ 1534 m->m_data += max_linkhdr; 1535 m->m_pkthdr.len = m->m_len = len; 1536 m->m_pkthdr.rcvif = NULL; 1537 bzero(m->m_data, len); 1538 switch (af) { 1539 #ifdef INET 1540 case AF_INET: 1541 h = mtod(m, struct ip *); 1542 1543 /* IP header fields included in the TCP checksum */ 1544 h->ip_p = IPPROTO_TCP; 1545 h->ip_len = htons(tlen); 1546 h->ip_src.s_addr = saddr->v4.s_addr; 1547 h->ip_dst.s_addr = daddr->v4.s_addr; 1548 1549 th = (struct tcphdr *)((caddr_t)h + sizeof(struct ip)); 1550 break; 1551 #endif /* INET */ 1552 #ifdef INET6 1553 case AF_INET6: 1554 h6 = mtod(m, struct ip6_hdr *); 1555 1556 /* IP header fields included in the TCP checksum */ 1557 h6->ip6_nxt = IPPROTO_TCP; 1558 h6->ip6_plen = htons(tlen); 1559 memcpy(&h6->ip6_src, &saddr->v6, sizeof(struct in6_addr)); 1560 memcpy(&h6->ip6_dst, &daddr->v6, sizeof(struct in6_addr)); 1561 1562 th = (struct tcphdr *)((caddr_t)h6 + sizeof(struct ip6_hdr)); 1563 break; 1564 #endif /* INET6 */ 1565 default: 1566 m_freem(m); 1567 return; 1568 } 1569 1570 /* TCP header */ 1571 th->th_sport = sport; 1572 th->th_dport = dport; 1573 th->th_seq = htonl(seq); 1574 th->th_ack = htonl(ack); 1575 th->th_off = tlen >> 2; 1576 th->th_flags = flags; 1577 th->th_win = htons(win); 1578 1579 if (mss) { 1580 opt = (char *)(th + 1); 1581 opt[0] = TCPOPT_MAXSEG; 1582 opt[1] = 4; 1583 HTONS(mss); 1584 bcopy((caddr_t)&mss, (caddr_t)(opt + 2), 2); 1585 } 1586 1587 switch (af) { 1588 #ifdef INET 1589 case AF_INET: 1590 /* TCP checksum */ 1591 th->th_sum = in_cksum(m, len); 1592 1593 /* Finish the IP header */ 1594 h->ip_v = 4; 1595 h->ip_hl = sizeof(*h) >> 2; 1596 h->ip_tos = IPTOS_LOWDELAY; 1597 h->ip_len = htons(len); 1598 h->ip_off = htons(ip_mtudisc ? IP_DF : 0); 1599 h->ip_ttl = ttl ? ttl : ip_defttl; 1600 h->ip_sum = 0; 1601 if (eh == NULL) { 1602 ip_output(m, (void *)NULL, (void *)NULL, 0, 1603 (void *)NULL, (void *)NULL); 1604 } else { 1605 #ifdef __OpenBSD__ 1606 struct route ro; 1607 struct rtentry rt; 1608 struct ether_header *e = (void *)ro.ro_dst.sa_data; 1609 1610 if (ifp == NULL) { 1611 m_freem(m); 1612 return; 1613 } 1614 rt.rt_ifp = ifp; 1615 ro.ro_rt = &rt; 1616 ro.ro_dst.sa_len = sizeof(ro.ro_dst); 1617 ro.ro_dst.sa_family = pseudo_AF_HDRCMPLT; 1618 bcopy(eh->ether_dhost, e->ether_shost, ETHER_ADDR_LEN); 1619 bcopy(eh->ether_shost, e->ether_dhost, ETHER_ADDR_LEN); 1620 e->ether_type = eh->ether_type; 1621 ip_output(m, (void *)NULL, &ro, IP_ROUTETOETHER, 1622 (void *)NULL, (void *)NULL); 1623 #else 1624 /* 1625 * on netbsd, pf_test and pf_test6 are always called 1626 * with eh == NULL. 1627 */ 1628 panic("pf_send_tcp: eh != NULL"); 1629 #endif 1630 } 1631 break; 1632 #endif /* INET */ 1633 #ifdef INET6 1634 case AF_INET6: 1635 /* TCP checksum */ 1636 th->th_sum = in6_cksum(m, IPPROTO_TCP, 1637 sizeof(struct ip6_hdr), tlen); 1638 1639 h6->ip6_vfc |= IPV6_VERSION; 1640 h6->ip6_hlim = IPV6_DEFHLIM; 1641 1642 #ifdef __OpenBSD__ 1643 ip6_output(m, NULL, NULL, 0, NULL, NULL); 1644 #else 1645 ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL); 1646 #endif 1647 break; 1648 #endif /* INET6 */ 1649 } 1650 } 1651 1652 void 1653 pf_send_icmp(struct mbuf *m, u_int8_t type, u_int8_t code, sa_family_t af, 1654 struct pf_rule *r) 1655 { 1656 struct m_tag *mtag; 1657 struct mbuf *m0; 1658 1659 mtag = m_tag_get(PACKET_TAG_PF_GENERATED, 0, M_NOWAIT); 1660 if (mtag == NULL) 1661 return; 1662 m0 = m_copy(m, 0, M_COPYALL); 1663 if (m0 == NULL) { 1664 m_tag_free(mtag); 1665 return; 1666 } 1667 m_tag_prepend(m0, mtag); 1668 1669 #ifdef ALTQ 1670 if (r->qid) { 1671 struct altq_tag *atag; 1672 1673 mtag = m_tag_get(PACKET_TAG_PF_QID, sizeof(*atag), M_NOWAIT); 1674 if (mtag != NULL) { 1675 atag = (struct altq_tag *)(mtag + 1); 1676 atag->qid = r->qid; 1677 /* add hints for ecn */ 1678 atag->af = af; 1679 atag->hdr = mtod(m0, struct ip *); 1680 m_tag_prepend(m0, mtag); 1681 } 1682 } 1683 #endif /* ALTQ */ 1684 1685 switch (af) { 1686 #ifdef INET 1687 case AF_INET: 1688 icmp_error(m0, type, code, 0, 0); 1689 break; 1690 #endif /* INET */ 1691 #ifdef INET6 1692 case AF_INET6: 1693 icmp6_error(m0, type, code, 0); 1694 break; 1695 #endif /* INET6 */ 1696 } 1697 } 1698 1699 /* 1700 * Return 1 if the addresses a and b match (with mask m), otherwise return 0. 1701 * If n is 0, they match if they are equal. If n is != 0, they match if they 1702 * are different. 1703 */ 1704 int 1705 pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m, 1706 struct pf_addr *b, sa_family_t af) 1707 { 1708 int match = 0; 1709 1710 switch (af) { 1711 #ifdef INET 1712 case AF_INET: 1713 if ((a->addr32[0] & m->addr32[0]) == 1714 (b->addr32[0] & m->addr32[0])) 1715 match++; 1716 break; 1717 #endif /* INET */ 1718 #ifdef INET6 1719 case AF_INET6: 1720 if (((a->addr32[0] & m->addr32[0]) == 1721 (b->addr32[0] & m->addr32[0])) && 1722 ((a->addr32[1] & m->addr32[1]) == 1723 (b->addr32[1] & m->addr32[1])) && 1724 ((a->addr32[2] & m->addr32[2]) == 1725 (b->addr32[2] & m->addr32[2])) && 1726 ((a->addr32[3] & m->addr32[3]) == 1727 (b->addr32[3] & m->addr32[3]))) 1728 match++; 1729 break; 1730 #endif /* INET6 */ 1731 } 1732 if (match) { 1733 if (n) 1734 return (0); 1735 else 1736 return (1); 1737 } else { 1738 if (n) 1739 return (1); 1740 else 1741 return (0); 1742 } 1743 } 1744 1745 int 1746 pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p) 1747 { 1748 switch (op) { 1749 case PF_OP_IRG: 1750 return ((p > a1) && (p < a2)); 1751 case PF_OP_XRG: 1752 return ((p < a1) || (p > a2)); 1753 case PF_OP_RRG: 1754 return ((p >= a1) && (p <= a2)); 1755 case PF_OP_EQ: 1756 return (p == a1); 1757 case PF_OP_NE: 1758 return (p != a1); 1759 case PF_OP_LT: 1760 return (p < a1); 1761 case PF_OP_LE: 1762 return (p <= a1); 1763 case PF_OP_GT: 1764 return (p > a1); 1765 case PF_OP_GE: 1766 return (p >= a1); 1767 } 1768 return (0); /* never reached */ 1769 } 1770 1771 int 1772 pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p) 1773 { 1774 NTOHS(a1); 1775 NTOHS(a2); 1776 NTOHS(p); 1777 return (pf_match(op, a1, a2, p)); 1778 } 1779 1780 int 1781 pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u) 1782 { 1783 if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE) 1784 return (0); 1785 return (pf_match(op, a1, a2, u)); 1786 } 1787 1788 int 1789 pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g) 1790 { 1791 if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE) 1792 return (0); 1793 return (pf_match(op, a1, a2, g)); 1794 } 1795 1796 struct pf_tag * 1797 pf_get_tag(struct mbuf *m) 1798 { 1799 struct m_tag *mtag; 1800 1801 if ((mtag = m_tag_find(m, PACKET_TAG_PF_TAG, NULL)) != NULL) 1802 return ((struct pf_tag *)(mtag + 1)); 1803 else 1804 return (NULL); 1805 } 1806 1807 int 1808 pf_match_tag(struct mbuf *m, struct pf_rule *r, struct pf_tag **pftag, int *tag) 1809 { 1810 if (*tag == -1) { /* find mbuf tag */ 1811 *pftag = pf_get_tag(m); 1812 if (*pftag != NULL) 1813 *tag = (*pftag)->tag; 1814 else 1815 *tag = 0; 1816 } 1817 1818 return ((!r->match_tag_not && r->match_tag == *tag) || 1819 (r->match_tag_not && r->match_tag != *tag)); 1820 } 1821 1822 int 1823 pf_tag_packet(struct mbuf *m, struct pf_tag *pftag, int tag) 1824 { 1825 struct m_tag *mtag; 1826 1827 if (tag <= 0) 1828 return (0); 1829 1830 if (pftag == NULL) { 1831 mtag = m_tag_get(PACKET_TAG_PF_TAG, sizeof(*pftag), M_NOWAIT); 1832 if (mtag == NULL) 1833 return (1); 1834 ((struct pf_tag *)(mtag + 1))->tag = tag; 1835 m_tag_prepend(m, mtag); 1836 } else 1837 pftag->tag = tag; 1838 1839 return (0); 1840 } 1841 1842 static void 1843 pf_step_into_anchor(int *depth, struct pf_ruleset **rs, int n, 1844 struct pf_rule **r, struct pf_rule **a) 1845 { 1846 struct pf_anchor_stackframe *f; 1847 1848 if (*depth >= sizeof(pf_anchor_stack) / 1849 sizeof(pf_anchor_stack[0])) { 1850 printf("pf_step_into_anchor: stack overflow\n"); 1851 *r = TAILQ_NEXT(*r, entries); 1852 return; 1853 } else if (*depth == 0 && a != NULL) 1854 *a = *r; 1855 f = pf_anchor_stack + (*depth)++; 1856 f->rs = *rs; 1857 f->r = *r; 1858 if ((*r)->anchor_wildcard) { 1859 f->parent = &(*r)->anchor->children; 1860 if ((f->child = RB_MIN(pf_anchor_node, f->parent)) == 1861 NULL) { 1862 *r = NULL; 1863 return; 1864 } 1865 *rs = &f->child->ruleset; 1866 } else { 1867 f->parent = NULL; 1868 f->child = NULL; 1869 *rs = &(*r)->anchor->ruleset; 1870 } 1871 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr); 1872 } 1873 1874 static void 1875 pf_step_out_of_anchor(int *depth, struct pf_ruleset **rs, int n, 1876 struct pf_rule **r, struct pf_rule **a) 1877 { 1878 struct pf_anchor_stackframe *f; 1879 1880 do { 1881 if (*depth <= 0) 1882 break; 1883 f = pf_anchor_stack + *depth - 1; 1884 if (f->parent != NULL && f->child != NULL) { 1885 f->child = RB_NEXT(pf_anchor_node, f->parent, f->child); 1886 if (f->child != NULL) { 1887 *rs = &f->child->ruleset; 1888 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr); 1889 if (*r == NULL) 1890 continue; 1891 else 1892 break; 1893 } 1894 } 1895 (*depth)--; 1896 if (*depth == 0 && a != NULL) 1897 *a = NULL; 1898 *rs = f->rs; 1899 *r = TAILQ_NEXT(f->r, entries); 1900 } while (*r == NULL); 1901 } 1902 1903 #ifdef INET6 1904 void 1905 pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr, 1906 struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af) 1907 { 1908 switch (af) { 1909 #ifdef INET 1910 case AF_INET: 1911 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) | 1912 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]); 1913 break; 1914 #endif /* INET */ 1915 case AF_INET6: 1916 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) | 1917 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]); 1918 naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) | 1919 ((rmask->addr32[1] ^ 0xffffffff ) & saddr->addr32[1]); 1920 naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) | 1921 ((rmask->addr32[2] ^ 0xffffffff ) & saddr->addr32[2]); 1922 naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) | 1923 ((rmask->addr32[3] ^ 0xffffffff ) & saddr->addr32[3]); 1924 break; 1925 } 1926 } 1927 1928 void 1929 pf_addr_inc(struct pf_addr *addr, sa_family_t af) 1930 { 1931 switch (af) { 1932 #ifdef INET 1933 case AF_INET: 1934 addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1); 1935 break; 1936 #endif /* INET */ 1937 case AF_INET6: 1938 if (addr->addr32[3] == 0xffffffff) { 1939 addr->addr32[3] = 0; 1940 if (addr->addr32[2] == 0xffffffff) { 1941 addr->addr32[2] = 0; 1942 if (addr->addr32[1] == 0xffffffff) { 1943 addr->addr32[1] = 0; 1944 addr->addr32[0] = 1945 htonl(ntohl(addr->addr32[0]) + 1); 1946 } else 1947 addr->addr32[1] = 1948 htonl(ntohl(addr->addr32[1]) + 1); 1949 } else 1950 addr->addr32[2] = 1951 htonl(ntohl(addr->addr32[2]) + 1); 1952 } else 1953 addr->addr32[3] = 1954 htonl(ntohl(addr->addr32[3]) + 1); 1955 break; 1956 } 1957 } 1958 #endif /* INET6 */ 1959 1960 #define mix(a,b,c) \ 1961 do { \ 1962 a -= b; a -= c; a ^= (c >> 13); \ 1963 b -= c; b -= a; b ^= (a << 8); \ 1964 c -= a; c -= b; c ^= (b >> 13); \ 1965 a -= b; a -= c; a ^= (c >> 12); \ 1966 b -= c; b -= a; b ^= (a << 16); \ 1967 c -= a; c -= b; c ^= (b >> 5); \ 1968 a -= b; a -= c; a ^= (c >> 3); \ 1969 b -= c; b -= a; b ^= (a << 10); \ 1970 c -= a; c -= b; c ^= (b >> 15); \ 1971 } while (0) 1972 1973 /* 1974 * hash function based on bridge_hash in if_bridge.c 1975 */ 1976 void 1977 pf_hash(struct pf_addr *inaddr, struct pf_addr *hash, 1978 struct pf_poolhashkey *key, sa_family_t af) 1979 { 1980 u_int32_t a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0]; 1981 1982 switch (af) { 1983 #ifdef INET 1984 case AF_INET: 1985 a += inaddr->addr32[0]; 1986 b += key->key32[1]; 1987 mix(a, b, c); 1988 hash->addr32[0] = c + key->key32[2]; 1989 break; 1990 #endif /* INET */ 1991 #ifdef INET6 1992 case AF_INET6: 1993 a += inaddr->addr32[0]; 1994 b += inaddr->addr32[2]; 1995 mix(a, b, c); 1996 hash->addr32[0] = c; 1997 a += inaddr->addr32[1]; 1998 b += inaddr->addr32[3]; 1999 c += key->key32[1]; 2000 mix(a, b, c); 2001 hash->addr32[1] = c; 2002 a += inaddr->addr32[2]; 2003 b += inaddr->addr32[1]; 2004 c += key->key32[2]; 2005 mix(a, b, c); 2006 hash->addr32[2] = c; 2007 a += inaddr->addr32[3]; 2008 b += inaddr->addr32[0]; 2009 c += key->key32[3]; 2010 mix(a, b, c); 2011 hash->addr32[3] = c; 2012 break; 2013 #endif /* INET6 */ 2014 } 2015 } 2016 2017 int 2018 pf_map_addr(sa_family_t af, struct pf_rule *r, struct pf_addr *saddr, 2019 struct pf_addr *naddr, struct pf_addr *init_addr, struct pf_src_node **sn) 2020 { 2021 unsigned char hash[16]; 2022 struct pf_pool *rpool = &r->rpool; 2023 struct pf_addr *raddr = &rpool->cur->addr.v.a.addr; 2024 struct pf_addr *rmask = &rpool->cur->addr.v.a.mask; 2025 struct pf_pooladdr *acur = rpool->cur; 2026 struct pf_src_node k; 2027 2028 if (*sn == NULL && r->rpool.opts & PF_POOL_STICKYADDR && 2029 (r->rpool.opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) { 2030 k.af = af; 2031 PF_ACPY(&k.addr, saddr, af); 2032 if (r->rule_flag & PFRULE_RULESRCTRACK || 2033 r->rpool.opts & PF_POOL_STICKYADDR) 2034 k.rule.ptr = r; 2035 else 2036 k.rule.ptr = NULL; 2037 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++; 2038 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k); 2039 if (*sn != NULL && !PF_AZERO(&(*sn)->raddr, af)) { 2040 PF_ACPY(naddr, &(*sn)->raddr, af); 2041 if (pf_status.debug >= PF_DEBUG_MISC) { 2042 printf("pf_map_addr: src tracking maps "); 2043 pf_print_host(&k.addr, 0, af); 2044 printf(" to "); 2045 pf_print_host(naddr, 0, af); 2046 printf("\n"); 2047 } 2048 return (0); 2049 } 2050 } 2051 2052 if (rpool->cur->addr.type == PF_ADDR_NOROUTE) 2053 return (1); 2054 if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { 2055 switch (af) { 2056 #ifdef INET 2057 case AF_INET: 2058 if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 && 2059 (rpool->opts & PF_POOL_TYPEMASK) != 2060 PF_POOL_ROUNDROBIN) 2061 return (1); 2062 raddr = &rpool->cur->addr.p.dyn->pfid_addr4; 2063 rmask = &rpool->cur->addr.p.dyn->pfid_mask4; 2064 break; 2065 #endif /* INET */ 2066 #ifdef INET6 2067 case AF_INET6: 2068 if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 && 2069 (rpool->opts & PF_POOL_TYPEMASK) != 2070 PF_POOL_ROUNDROBIN) 2071 return (1); 2072 raddr = &rpool->cur->addr.p.dyn->pfid_addr6; 2073 rmask = &rpool->cur->addr.p.dyn->pfid_mask6; 2074 break; 2075 #endif /* INET6 */ 2076 } 2077 } else if (rpool->cur->addr.type == PF_ADDR_TABLE) { 2078 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN) 2079 return (1); /* unsupported */ 2080 } else { 2081 raddr = &rpool->cur->addr.v.a.addr; 2082 rmask = &rpool->cur->addr.v.a.mask; 2083 } 2084 2085 switch (rpool->opts & PF_POOL_TYPEMASK) { 2086 case PF_POOL_NONE: 2087 PF_ACPY(naddr, raddr, af); 2088 break; 2089 case PF_POOL_BITMASK: 2090 PF_POOLMASK(naddr, raddr, rmask, saddr, af); 2091 break; 2092 case PF_POOL_RANDOM: 2093 if (init_addr != NULL && PF_AZERO(init_addr, af)) { 2094 switch (af) { 2095 #ifdef INET 2096 case AF_INET: 2097 rpool->counter.addr32[0] = htonl(arc4random()); 2098 break; 2099 #endif /* INET */ 2100 #ifdef INET6 2101 case AF_INET6: 2102 if (rmask->addr32[3] != 0xffffffff) 2103 rpool->counter.addr32[3] = 2104 htonl(arc4random()); 2105 else 2106 break; 2107 if (rmask->addr32[2] != 0xffffffff) 2108 rpool->counter.addr32[2] = 2109 htonl(arc4random()); 2110 else 2111 break; 2112 if (rmask->addr32[1] != 0xffffffff) 2113 rpool->counter.addr32[1] = 2114 htonl(arc4random()); 2115 else 2116 break; 2117 if (rmask->addr32[0] != 0xffffffff) 2118 rpool->counter.addr32[0] = 2119 htonl(arc4random()); 2120 break; 2121 #endif /* INET6 */ 2122 } 2123 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af); 2124 PF_ACPY(init_addr, naddr, af); 2125 2126 } else { 2127 PF_AINC(&rpool->counter, af); 2128 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af); 2129 } 2130 break; 2131 case PF_POOL_SRCHASH: 2132 pf_hash(saddr, (struct pf_addr *)&hash, &rpool->key, af); 2133 PF_POOLMASK(naddr, raddr, rmask, (struct pf_addr *)&hash, af); 2134 break; 2135 case PF_POOL_ROUNDROBIN: 2136 if (rpool->cur->addr.type == PF_ADDR_TABLE) { 2137 if (!pfr_pool_get(rpool->cur->addr.p.tbl, 2138 &rpool->tblidx, &rpool->counter, 2139 &raddr, &rmask, af)) 2140 goto get_addr; 2141 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { 2142 if (!pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt, 2143 &rpool->tblidx, &rpool->counter, 2144 &raddr, &rmask, af)) 2145 goto get_addr; 2146 } else if (pf_match_addr(0, raddr, rmask, &rpool->counter, af)) 2147 goto get_addr; 2148 2149 try_next: 2150 if ((rpool->cur = TAILQ_NEXT(rpool->cur, entries)) == NULL) 2151 rpool->cur = TAILQ_FIRST(&rpool->list); 2152 if (rpool->cur->addr.type == PF_ADDR_TABLE) { 2153 rpool->tblidx = -1; 2154 if (pfr_pool_get(rpool->cur->addr.p.tbl, 2155 &rpool->tblidx, &rpool->counter, 2156 &raddr, &rmask, af)) { 2157 /* table contains no address of type 'af' */ 2158 if (rpool->cur != acur) 2159 goto try_next; 2160 return (1); 2161 } 2162 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { 2163 rpool->tblidx = -1; 2164 if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt, 2165 &rpool->tblidx, &rpool->counter, 2166 &raddr, &rmask, af)) { 2167 /* table contains no address of type 'af' */ 2168 if (rpool->cur != acur) 2169 goto try_next; 2170 return (1); 2171 } 2172 } else { 2173 raddr = &rpool->cur->addr.v.a.addr; 2174 rmask = &rpool->cur->addr.v.a.mask; 2175 PF_ACPY(&rpool->counter, raddr, af); 2176 } 2177 2178 get_addr: 2179 PF_ACPY(naddr, &rpool->counter, af); 2180 if (init_addr != NULL && PF_AZERO(init_addr, af)) 2181 PF_ACPY(init_addr, naddr, af); 2182 PF_AINC(&rpool->counter, af); 2183 break; 2184 } 2185 if (*sn != NULL) 2186 PF_ACPY(&(*sn)->raddr, naddr, af); 2187 2188 if (pf_status.debug >= PF_DEBUG_MISC && 2189 (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) { 2190 printf("pf_map_addr: selected address "); 2191 pf_print_host(naddr, 0, af); 2192 printf("\n"); 2193 } 2194 2195 return (0); 2196 } 2197 2198 int 2199 pf_get_sport(sa_family_t af, u_int8_t proto, struct pf_rule *r, 2200 struct pf_addr *saddr, struct pf_addr *daddr, u_int16_t dport, 2201 struct pf_addr *naddr, u_int16_t *nport, u_int16_t low, u_int16_t high, 2202 struct pf_src_node **sn) 2203 { 2204 struct pf_state key; 2205 struct pf_addr init_addr; 2206 u_int16_t cut; 2207 2208 bzero(&init_addr, sizeof(init_addr)); 2209 if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn)) 2210 return (1); 2211 2212 do { 2213 key.af = af; 2214 key.proto = proto; 2215 PF_ACPY(&key.ext.addr, daddr, key.af); 2216 PF_ACPY(&key.gwy.addr, naddr, key.af); 2217 key.ext.port = dport; 2218 2219 /* 2220 * port search; start random, step; 2221 * similar 2 portloop in in_pcbbind 2222 */ 2223 if (!(proto == IPPROTO_TCP || proto == IPPROTO_UDP)) { 2224 key.gwy.port = dport; 2225 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL) 2226 return (0); 2227 } else if (low == 0 && high == 0) { 2228 key.gwy.port = *nport; 2229 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL) 2230 return (0); 2231 } else if (low == high) { 2232 key.gwy.port = htons(low); 2233 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == NULL) { 2234 *nport = htons(low); 2235 return (0); 2236 } 2237 } else { 2238 u_int16_t tmp; 2239 2240 if (low > high) { 2241 tmp = low; 2242 low = high; 2243 high = tmp; 2244 } 2245 /* low < high */ 2246 cut = htonl(arc4random()) % (1 + high - low) + low; 2247 /* low <= cut <= high */ 2248 for (tmp = cut; tmp <= high; ++(tmp)) { 2249 key.gwy.port = htons(tmp); 2250 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == 2251 NULL) { 2252 *nport = htons(tmp); 2253 return (0); 2254 } 2255 } 2256 for (tmp = cut - 1; tmp >= low; --(tmp)) { 2257 key.gwy.port = htons(tmp); 2258 if (pf_find_state_all(&key, PF_EXT_GWY, NULL) == 2259 NULL) { 2260 *nport = htons(tmp); 2261 return (0); 2262 } 2263 } 2264 } 2265 2266 switch (r->rpool.opts & PF_POOL_TYPEMASK) { 2267 case PF_POOL_RANDOM: 2268 case PF_POOL_ROUNDROBIN: 2269 if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn)) 2270 return (1); 2271 break; 2272 case PF_POOL_NONE: 2273 case PF_POOL_SRCHASH: 2274 case PF_POOL_BITMASK: 2275 default: 2276 return (1); 2277 } 2278 } while (! PF_AEQ(&init_addr, naddr, af) ); 2279 2280 return (1); /* none available */ 2281 } 2282 2283 struct pf_rule * 2284 pf_match_translation(struct pf_pdesc *pd, struct mbuf *m, int off, 2285 int direction, struct pfi_kif *kif, struct pf_addr *saddr, u_int16_t sport, 2286 struct pf_addr *daddr, u_int16_t dport, int rs_num) 2287 { 2288 struct pf_rule *r, *rm = NULL; 2289 struct pf_ruleset *ruleset = NULL; 2290 struct pf_tag *pftag = NULL; 2291 int tag = -1; 2292 int asd = 0; 2293 2294 r = TAILQ_FIRST(pf_main_ruleset.rules[rs_num].active.ptr); 2295 while (r && rm == NULL) { 2296 struct pf_rule_addr *src = NULL, *dst = NULL; 2297 struct pf_addr_wrap *xdst = NULL; 2298 2299 if (r->action == PF_BINAT && direction == PF_IN) { 2300 src = &r->dst; 2301 if (r->rpool.cur != NULL) 2302 xdst = &r->rpool.cur->addr; 2303 } else { 2304 src = &r->src; 2305 dst = &r->dst; 2306 } 2307 2308 r->evaluations++; 2309 if (r->kif != NULL && 2310 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 2311 r = r->skip[PF_SKIP_IFP].ptr; 2312 else if (r->direction && r->direction != direction) 2313 r = r->skip[PF_SKIP_DIR].ptr; 2314 else if (r->af && r->af != pd->af) 2315 r = r->skip[PF_SKIP_AF].ptr; 2316 else if (r->proto && r->proto != pd->proto) 2317 r = r->skip[PF_SKIP_PROTO].ptr; 2318 else if (PF_MISMATCHAW(&src->addr, saddr, pd->af, src->neg)) 2319 r = r->skip[src == &r->src ? PF_SKIP_SRC_ADDR : 2320 PF_SKIP_DST_ADDR].ptr; 2321 else if (src->port_op && !pf_match_port(src->port_op, 2322 src->port[0], src->port[1], sport)) 2323 r = r->skip[src == &r->src ? PF_SKIP_SRC_PORT : 2324 PF_SKIP_DST_PORT].ptr; 2325 else if (dst != NULL && 2326 PF_MISMATCHAW(&dst->addr, daddr, pd->af, dst->neg)) 2327 r = r->skip[PF_SKIP_DST_ADDR].ptr; 2328 else if (xdst != NULL && PF_MISMATCHAW(xdst, daddr, pd->af, 0)) 2329 r = TAILQ_NEXT(r, entries); 2330 else if (dst != NULL && dst->port_op && 2331 !pf_match_port(dst->port_op, dst->port[0], 2332 dst->port[1], dport)) 2333 r = r->skip[PF_SKIP_DST_PORT].ptr; 2334 else if (r->match_tag && !pf_match_tag(m, r, &pftag, &tag)) 2335 r = TAILQ_NEXT(r, entries); 2336 else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto != 2337 IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, m, 2338 off, pd->hdr.tcp), r->os_fingerprint))) 2339 r = TAILQ_NEXT(r, entries); 2340 else { 2341 if (r->tag) 2342 tag = r->tag; 2343 if (r->anchor == NULL) { 2344 rm = r; 2345 } else 2346 pf_step_into_anchor(&asd, &ruleset, rs_num, &r, NULL); 2347 } 2348 if (r == NULL) 2349 pf_step_out_of_anchor(&asd, &ruleset, rs_num, &r, NULL); 2350 } 2351 if (pf_tag_packet(m, pftag, tag)) 2352 return (NULL); 2353 if (rm != NULL && (rm->action == PF_NONAT || 2354 rm->action == PF_NORDR || rm->action == PF_NOBINAT)) 2355 return (NULL); 2356 return (rm); 2357 } 2358 2359 struct pf_rule * 2360 pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off, int direction, 2361 struct pfi_kif *kif, struct pf_src_node **sn, 2362 struct pf_addr *saddr, u_int16_t sport, 2363 struct pf_addr *daddr, u_int16_t dport, 2364 struct pf_addr *naddr, u_int16_t *nport) 2365 { 2366 struct pf_rule *r = NULL; 2367 2368 if (direction == PF_OUT) { 2369 r = pf_match_translation(pd, m, off, direction, kif, saddr, 2370 sport, daddr, dport, PF_RULESET_BINAT); 2371 if (r == NULL) 2372 r = pf_match_translation(pd, m, off, direction, kif, 2373 saddr, sport, daddr, dport, PF_RULESET_NAT); 2374 } else { 2375 r = pf_match_translation(pd, m, off, direction, kif, saddr, 2376 sport, daddr, dport, PF_RULESET_RDR); 2377 if (r == NULL) 2378 r = pf_match_translation(pd, m, off, direction, kif, 2379 saddr, sport, daddr, dport, PF_RULESET_BINAT); 2380 } 2381 2382 if (r != NULL) { 2383 switch (r->action) { 2384 case PF_NONAT: 2385 case PF_NOBINAT: 2386 case PF_NORDR: 2387 return (NULL); 2388 case PF_NAT: 2389 if (pf_get_sport(pd->af, pd->proto, r, saddr, 2390 daddr, dport, naddr, nport, r->rpool.proxy_port[0], 2391 r->rpool.proxy_port[1], sn)) { 2392 DPFPRINTF(PF_DEBUG_MISC, 2393 ("pf: NAT proxy port allocation " 2394 "(%u-%u) failed\n", 2395 r->rpool.proxy_port[0], 2396 r->rpool.proxy_port[1])); 2397 return (NULL); 2398 } 2399 break; 2400 case PF_BINAT: 2401 switch (direction) { 2402 case PF_OUT: 2403 if (r->rpool.cur->addr.type == PF_ADDR_DYNIFTL){ 2404 switch (pd->af) { 2405 #ifdef INET 2406 case AF_INET: 2407 if (r->rpool.cur->addr.p.dyn-> 2408 pfid_acnt4 < 1) 2409 return (NULL); 2410 PF_POOLMASK(naddr, 2411 &r->rpool.cur->addr.p.dyn-> 2412 pfid_addr4, 2413 &r->rpool.cur->addr.p.dyn-> 2414 pfid_mask4, 2415 saddr, AF_INET); 2416 break; 2417 #endif /* INET */ 2418 #ifdef INET6 2419 case AF_INET6: 2420 if (r->rpool.cur->addr.p.dyn-> 2421 pfid_acnt6 < 1) 2422 return (NULL); 2423 PF_POOLMASK(naddr, 2424 &r->rpool.cur->addr.p.dyn-> 2425 pfid_addr6, 2426 &r->rpool.cur->addr.p.dyn-> 2427 pfid_mask6, 2428 saddr, AF_INET6); 2429 break; 2430 #endif /* INET6 */ 2431 } 2432 } else 2433 PF_POOLMASK(naddr, 2434 &r->rpool.cur->addr.v.a.addr, 2435 &r->rpool.cur->addr.v.a.mask, 2436 saddr, pd->af); 2437 break; 2438 case PF_IN: 2439 if (r->src.addr.type == PF_ADDR_DYNIFTL) { 2440 switch (pd->af) { 2441 #ifdef INET 2442 case AF_INET: 2443 if (r->src.addr.p.dyn-> 2444 pfid_acnt4 < 1) 2445 return (NULL); 2446 PF_POOLMASK(naddr, 2447 &r->src.addr.p.dyn-> 2448 pfid_addr4, 2449 &r->src.addr.p.dyn-> 2450 pfid_mask4, 2451 daddr, AF_INET); 2452 break; 2453 #endif /* INET */ 2454 #ifdef INET6 2455 case AF_INET6: 2456 if (r->src.addr.p.dyn-> 2457 pfid_acnt6 < 1) 2458 return (NULL); 2459 PF_POOLMASK(naddr, 2460 &r->src.addr.p.dyn-> 2461 pfid_addr6, 2462 &r->src.addr.p.dyn-> 2463 pfid_mask6, 2464 daddr, AF_INET6); 2465 break; 2466 #endif /* INET6 */ 2467 } 2468 } else 2469 PF_POOLMASK(naddr, 2470 &r->src.addr.v.a.addr, 2471 &r->src.addr.v.a.mask, daddr, 2472 pd->af); 2473 break; 2474 } 2475 break; 2476 case PF_RDR: { 2477 if (pf_map_addr(pd->af, r, saddr, naddr, NULL, sn)) 2478 return (NULL); 2479 2480 if (r->rpool.proxy_port[1]) { 2481 u_int32_t tmp_nport; 2482 2483 tmp_nport = ((ntohs(dport) - 2484 ntohs(r->dst.port[0])) % 2485 (r->rpool.proxy_port[1] - 2486 r->rpool.proxy_port[0] + 1)) + 2487 r->rpool.proxy_port[0]; 2488 2489 /* wrap around if necessary */ 2490 if (tmp_nport > 65535) 2491 tmp_nport -= 65535; 2492 *nport = htons((u_int16_t)tmp_nport); 2493 } else if (r->rpool.proxy_port[0]) 2494 *nport = htons(r->rpool.proxy_port[0]); 2495 break; 2496 } 2497 default: 2498 return (NULL); 2499 } 2500 } 2501 2502 return (r); 2503 } 2504 2505 int 2506 pf_socket_lookup(uid_t *uid, gid_t *gid, int direction, struct pf_pdesc *pd) 2507 { 2508 struct pf_addr *saddr, *daddr; 2509 u_int16_t sport, dport; 2510 struct inpcbtable *tb; 2511 struct inpcb *inp = NULL; 2512 #if defined(__NetBSD__) && defined(INET6) 2513 struct in6pcb *in6p = NULL; 2514 #endif 2515 2516 *uid = UID_MAX; 2517 *gid = GID_MAX; 2518 switch (pd->proto) { 2519 case IPPROTO_TCP: 2520 sport = pd->hdr.tcp->th_sport; 2521 dport = pd->hdr.tcp->th_dport; 2522 tb = &tcbtable; 2523 break; 2524 case IPPROTO_UDP: 2525 sport = pd->hdr.udp->uh_sport; 2526 dport = pd->hdr.udp->uh_dport; 2527 tb = &udbtable; 2528 break; 2529 default: 2530 return (0); 2531 } 2532 if (direction == PF_IN) { 2533 saddr = pd->src; 2534 daddr = pd->dst; 2535 } else { 2536 u_int16_t p; 2537 2538 p = sport; 2539 sport = dport; 2540 dport = p; 2541 saddr = pd->dst; 2542 daddr = pd->src; 2543 } 2544 switch (pd->af) { 2545 #ifdef INET 2546 case AF_INET: 2547 #ifdef __OpenBSD__ 2548 inp = in_pcbhashlookup(tb, saddr->v4, sport, daddr->v4, dport); 2549 if (inp == NULL) { 2550 inp = in_pcblookup_listen(tb, daddr->v4, dport, 0); 2551 if (inp == NULL) 2552 return (0); 2553 } 2554 #else 2555 inp = in_pcblookup_connect(tb, saddr->v4, sport, daddr->v4, 2556 dport); 2557 if (inp == NULL) { 2558 inp = in_pcblookup_bind(tb, daddr->v4, dport); 2559 if (inp == NULL) 2560 return (0); 2561 } 2562 #endif 2563 break; 2564 #endif /* INET */ 2565 #ifdef INET6 2566 case AF_INET6: 2567 #ifdef __OpenBSD__ 2568 inp = in6_pcbhashlookup(tb, &saddr->v6, sport, &daddr->v6, 2569 dport); 2570 if (inp == NULL) { 2571 inp = in6_pcblookup_listen(tb, &daddr->v6, dport, 0); 2572 if (inp == NULL) 2573 return (0); 2574 } 2575 #else 2576 in6p = in6_pcblookup_connect(tb, &saddr->v6, sport, &daddr->v6, 2577 dport, 0); 2578 if (in6p == NULL) { 2579 in6p = in6_pcblookup_bind(tb, &daddr->v6, dport, 0); 2580 if (in6p == NULL) 2581 return (0); 2582 } 2583 #endif 2584 break; 2585 #endif /* INET6 */ 2586 2587 default: 2588 return (0); 2589 } 2590 #ifdef __OpenBSD__ 2591 *uid = inp->inp_socket->so_euid; 2592 *gid = inp->inp_socket->so_egid; 2593 #else 2594 switch (pd->af) { 2595 case AF_INET: 2596 *uid = inp->inp_socket->so_uidinfo->ui_uid; 2597 /* XXX gid */ 2598 break; 2599 #ifdef INET6 2600 case AF_INET6: 2601 *uid = in6p->in6p_socket->so_uidinfo->ui_uid; 2602 /* XXX gid */ 2603 break; 2604 #endif 2605 } 2606 #endif 2607 return (1); 2608 } 2609 2610 u_int8_t 2611 pf_get_wscale(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af) 2612 { 2613 int hlen; 2614 u_int8_t hdr[60]; 2615 u_int8_t *opt, optlen; 2616 u_int8_t wscale = 0; 2617 2618 hlen = th_off << 2; /* hlen <= sizeof(hdr) */ 2619 if (hlen <= sizeof(struct tcphdr)) 2620 return (0); 2621 if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af)) 2622 return (0); 2623 opt = hdr + sizeof(struct tcphdr); 2624 hlen -= sizeof(struct tcphdr); 2625 while (hlen >= 3) { 2626 switch (*opt) { 2627 case TCPOPT_EOL: 2628 case TCPOPT_NOP: 2629 ++opt; 2630 --hlen; 2631 break; 2632 case TCPOPT_WINDOW: 2633 wscale = opt[2]; 2634 if (wscale > TCP_MAX_WINSHIFT) 2635 wscale = TCP_MAX_WINSHIFT; 2636 wscale |= PF_WSCALE_FLAG; 2637 /* FALLTHROUGH */ 2638 default: 2639 optlen = opt[1]; 2640 if (optlen < 2) 2641 optlen = 2; 2642 hlen -= optlen; 2643 opt += optlen; 2644 break; 2645 } 2646 } 2647 return (wscale); 2648 } 2649 2650 u_int16_t 2651 pf_get_mss(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af) 2652 { 2653 int hlen; 2654 u_int8_t hdr[60]; 2655 u_int8_t *opt, optlen; 2656 u_int16_t mss = tcp_mssdflt; 2657 2658 hlen = th_off << 2; /* hlen <= sizeof(hdr) */ 2659 if (hlen <= sizeof(struct tcphdr)) 2660 return (0); 2661 if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af)) 2662 return (0); 2663 opt = hdr + sizeof(struct tcphdr); 2664 hlen -= sizeof(struct tcphdr); 2665 while (hlen >= TCPOLEN_MAXSEG) { 2666 switch (*opt) { 2667 case TCPOPT_EOL: 2668 case TCPOPT_NOP: 2669 ++opt; 2670 --hlen; 2671 break; 2672 case TCPOPT_MAXSEG: 2673 bcopy((caddr_t)(opt + 2), (caddr_t)&mss, 2); 2674 NTOHS(mss); 2675 /* FALLTHROUGH */ 2676 default: 2677 optlen = opt[1]; 2678 if (optlen < 2) 2679 optlen = 2; 2680 hlen -= optlen; 2681 opt += optlen; 2682 break; 2683 } 2684 } 2685 return (mss); 2686 } 2687 2688 u_int16_t 2689 pf_calc_mss(struct pf_addr *addr, sa_family_t af, u_int16_t offer) 2690 { 2691 #ifdef INET 2692 struct sockaddr_in *dst; 2693 struct route ro; 2694 #endif /* INET */ 2695 #ifdef INET6 2696 struct sockaddr_in6 *dst6; 2697 struct route_in6 ro6; 2698 #endif /* INET6 */ 2699 struct rtentry *rt = NULL; 2700 int hlen; 2701 u_int16_t mss = tcp_mssdflt; 2702 2703 hlen = 0; /* XXXGCC - -Wunitialized m68k */ 2704 2705 switch (af) { 2706 #ifdef INET 2707 case AF_INET: 2708 hlen = sizeof(struct ip); 2709 bzero(&ro, sizeof(ro)); 2710 dst = (struct sockaddr_in *)&ro.ro_dst; 2711 dst->sin_family = AF_INET; 2712 dst->sin_len = sizeof(*dst); 2713 dst->sin_addr = addr->v4; 2714 #ifdef __OpenBSD__ 2715 rtalloc_noclone(&ro, NO_CLONING); 2716 #else 2717 rtalloc(&ro); 2718 #endif 2719 rt = ro.ro_rt; 2720 break; 2721 #endif /* INET */ 2722 #ifdef INET6 2723 case AF_INET6: 2724 hlen = sizeof(struct ip6_hdr); 2725 bzero(&ro6, sizeof(ro6)); 2726 dst6 = (struct sockaddr_in6 *)&ro6.ro_dst; 2727 dst6->sin6_family = AF_INET6; 2728 dst6->sin6_len = sizeof(*dst6); 2729 dst6->sin6_addr = addr->v6; 2730 #ifdef __OpenBSD__ 2731 rtalloc_noclone((struct route *)&ro6, NO_CLONING); 2732 #else 2733 rtalloc((struct route *)&ro6); 2734 #endif 2735 rt = ro6.ro_rt; 2736 break; 2737 #endif /* INET6 */ 2738 } 2739 2740 if (rt && rt->rt_ifp) { 2741 mss = rt->rt_ifp->if_mtu - hlen - sizeof(struct tcphdr); 2742 mss = max(tcp_mssdflt, mss); 2743 RTFREE(rt); 2744 } 2745 mss = min(mss, offer); 2746 mss = max(mss, 64); /* sanity - at least max opt space */ 2747 return (mss); 2748 } 2749 2750 void 2751 pf_set_rt_ifp(struct pf_state *s, struct pf_addr *saddr) 2752 { 2753 struct pf_rule *r = s->rule.ptr; 2754 2755 s->rt_kif = NULL; 2756 if (!r->rt || r->rt == PF_FASTROUTE) 2757 return; 2758 switch (s->af) { 2759 #ifdef INET 2760 case AF_INET: 2761 pf_map_addr(AF_INET, r, saddr, &s->rt_addr, NULL, 2762 &s->nat_src_node); 2763 s->rt_kif = r->rpool.cur->kif; 2764 break; 2765 #endif /* INET */ 2766 #ifdef INET6 2767 case AF_INET6: 2768 pf_map_addr(AF_INET6, r, saddr, &s->rt_addr, NULL, 2769 &s->nat_src_node); 2770 s->rt_kif = r->rpool.cur->kif; 2771 break; 2772 #endif /* INET6 */ 2773 } 2774 } 2775 2776 int 2777 pf_test_tcp(struct pf_rule **rm, struct pf_state **sm, int direction, 2778 struct pfi_kif *kif, struct mbuf *m, int off, void *h, 2779 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm, 2780 struct ifqueue *ifq) 2781 { 2782 struct pf_rule *nr = NULL; 2783 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 2784 struct tcphdr *th = pd->hdr.tcp; 2785 u_int16_t bport, nport = 0; 2786 sa_family_t af = pd->af; 2787 int lookup = -1; 2788 uid_t uid = 0; /* XXX: GCC */ 2789 gid_t gid = 0; /* XXX: GCC */ 2790 struct pf_rule *r, *a = NULL; 2791 struct pf_ruleset *ruleset = NULL; 2792 struct pf_src_node *nsn = NULL; 2793 u_short reason; 2794 int rewrite = 0; 2795 struct pf_tag *pftag = NULL; 2796 int tag = -1; 2797 u_int16_t mss = tcp_mssdflt; 2798 int asd = 0; 2799 2800 if (pf_check_congestion(ifq)) { 2801 REASON_SET(&reason, PFRES_CONGEST); 2802 return (PF_DROP); 2803 } 2804 2805 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 2806 2807 if (direction == PF_OUT) { 2808 bport = nport = th->th_sport; 2809 /* check outgoing packet for BINAT/NAT */ 2810 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn, 2811 saddr, th->th_sport, daddr, th->th_dport, 2812 &pd->naddr, &nport)) != NULL) { 2813 PF_ACPY(&pd->baddr, saddr, af); 2814 pf_change_ap(saddr, &th->th_sport, pd->ip_sum, 2815 &th->th_sum, &pd->naddr, nport, 0, af); 2816 rewrite++; 2817 if (nr->natpass) 2818 r = NULL; 2819 pd->nat_rule = nr; 2820 } 2821 } else { 2822 bport = nport = th->th_dport; 2823 /* check incoming packet for BINAT/RDR */ 2824 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn, 2825 saddr, th->th_sport, daddr, th->th_dport, 2826 &pd->naddr, &nport)) != NULL) { 2827 PF_ACPY(&pd->baddr, daddr, af); 2828 pf_change_ap(daddr, &th->th_dport, pd->ip_sum, 2829 &th->th_sum, &pd->naddr, nport, 0, af); 2830 rewrite++; 2831 if (nr->natpass) 2832 r = NULL; 2833 pd->nat_rule = nr; 2834 } 2835 } 2836 2837 while (r != NULL) { 2838 r->evaluations++; 2839 if (r->kif != NULL && 2840 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 2841 r = r->skip[PF_SKIP_IFP].ptr; 2842 else if (r->direction && r->direction != direction) 2843 r = r->skip[PF_SKIP_DIR].ptr; 2844 else if (r->af && r->af != af) 2845 r = r->skip[PF_SKIP_AF].ptr; 2846 else if (r->proto && r->proto != IPPROTO_TCP) 2847 r = r->skip[PF_SKIP_PROTO].ptr; 2848 else if (PF_MISMATCHAW(&r->src.addr, saddr, af, r->src.neg)) 2849 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 2850 else if (r->src.port_op && !pf_match_port(r->src.port_op, 2851 r->src.port[0], r->src.port[1], th->th_sport)) 2852 r = r->skip[PF_SKIP_SRC_PORT].ptr; 2853 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af, r->dst.neg)) 2854 r = r->skip[PF_SKIP_DST_ADDR].ptr; 2855 else if (r->dst.port_op && !pf_match_port(r->dst.port_op, 2856 r->dst.port[0], r->dst.port[1], th->th_dport)) 2857 r = r->skip[PF_SKIP_DST_PORT].ptr; 2858 else if (r->tos && !(r->tos & pd->tos)) 2859 r = TAILQ_NEXT(r, entries); 2860 else if (r->rule_flag & PFRULE_FRAGMENT) 2861 r = TAILQ_NEXT(r, entries); 2862 else if ((r->flagset & th->th_flags) != r->flags) 2863 r = TAILQ_NEXT(r, entries); 2864 else if (r->uid.op && (lookup != -1 || (lookup = 2865 pf_socket_lookup(&uid, &gid, direction, pd), 1)) && 2866 !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1], 2867 uid)) 2868 r = TAILQ_NEXT(r, entries); 2869 else if (r->gid.op && (lookup != -1 || (lookup = 2870 pf_socket_lookup(&uid, &gid, direction, pd), 1)) && 2871 !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1], 2872 gid)) 2873 r = TAILQ_NEXT(r, entries); 2874 else if (r->prob && r->prob <= arc4random()) 2875 r = TAILQ_NEXT(r, entries); 2876 else if (r->match_tag && !pf_match_tag(m, r, &pftag, &tag)) 2877 r = TAILQ_NEXT(r, entries); 2878 else if (r->os_fingerprint != PF_OSFP_ANY && !pf_osfp_match( 2879 pf_osfp_fingerprint(pd, m, off, th), r->os_fingerprint)) 2880 r = TAILQ_NEXT(r, entries); 2881 else { 2882 if (r->tag) 2883 tag = r->tag; 2884 if (r->anchor == NULL) { 2885 *rm = r; 2886 *am = a; 2887 *rsm = ruleset; 2888 if ((*rm)->quick) 2889 break; 2890 r = TAILQ_NEXT(r, entries); 2891 } else 2892 pf_step_into_anchor(&asd, &ruleset, 2893 PF_RULESET_FILTER, &r, &a); 2894 } 2895 if (r == NULL) 2896 pf_step_out_of_anchor(&asd, &ruleset, 2897 PF_RULESET_FILTER, &r, &a); 2898 } 2899 r = *rm; 2900 a = *am; 2901 ruleset = *rsm; 2902 2903 REASON_SET(&reason, PFRES_MATCH); 2904 2905 if (r->log) { 2906 if (rewrite) 2907 m_copyback(m, off, sizeof(*th), th); 2908 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset); 2909 } 2910 2911 if ((r->action == PF_DROP) && 2912 ((r->rule_flag & PFRULE_RETURNRST) || 2913 (r->rule_flag & PFRULE_RETURNICMP) || 2914 (r->rule_flag & PFRULE_RETURN))) { 2915 /* undo NAT changes, if they have taken place */ 2916 if (nr != NULL) { 2917 if (direction == PF_OUT) { 2918 pf_change_ap(saddr, &th->th_sport, pd->ip_sum, 2919 &th->th_sum, &pd->baddr, bport, 0, af); 2920 rewrite++; 2921 } else { 2922 pf_change_ap(daddr, &th->th_dport, pd->ip_sum, 2923 &th->th_sum, &pd->baddr, bport, 0, af); 2924 rewrite++; 2925 } 2926 } 2927 if (((r->rule_flag & PFRULE_RETURNRST) || 2928 (r->rule_flag & PFRULE_RETURN)) && 2929 !(th->th_flags & TH_RST)) { 2930 u_int32_t ack = ntohl(th->th_seq) + pd->p_len; 2931 2932 if (th->th_flags & TH_SYN) 2933 ack++; 2934 if (th->th_flags & TH_FIN) 2935 ack++; 2936 pf_send_tcp(r, af, pd->dst, 2937 pd->src, th->th_dport, th->th_sport, 2938 ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0, 2939 r->return_ttl, 1, pd->eh, kif->pfik_ifp); 2940 } else if ((af == AF_INET) && r->return_icmp) 2941 pf_send_icmp(m, r->return_icmp >> 8, 2942 r->return_icmp & 255, af, r); 2943 else if ((af == AF_INET6) && r->return_icmp6) 2944 pf_send_icmp(m, r->return_icmp6 >> 8, 2945 r->return_icmp6 & 255, af, r); 2946 } 2947 2948 if (r->action == PF_DROP) 2949 return (PF_DROP); 2950 2951 if (pf_tag_packet(m, pftag, tag)) { 2952 REASON_SET(&reason, PFRES_MEMORY); 2953 return (PF_DROP); 2954 } 2955 2956 if (r->keep_state || nr != NULL || 2957 (pd->flags & PFDESC_TCP_NORM)) { 2958 /* create new state */ 2959 u_int16_t len; 2960 struct pf_state *s = NULL; 2961 struct pf_src_node *sn = NULL; 2962 2963 len = pd->tot_len - off - (th->th_off << 2); 2964 2965 /* check maximums */ 2966 if (r->max_states && (r->states >= r->max_states)) { 2967 pf_status.lcounters[LCNT_STATES]++; 2968 REASON_SET(&reason, PFRES_MAXSTATES); 2969 goto cleanup; 2970 } 2971 /* src node for flter rule */ 2972 if ((r->rule_flag & PFRULE_SRCTRACK || 2973 r->rpool.opts & PF_POOL_STICKYADDR) && 2974 pf_insert_src_node(&sn, r, saddr, af) != 0) { 2975 REASON_SET(&reason, PFRES_SRCLIMIT); 2976 goto cleanup; 2977 } 2978 /* src node for translation rule */ 2979 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) && 2980 ((direction == PF_OUT && 2981 pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) || 2982 (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) { 2983 REASON_SET(&reason, PFRES_SRCLIMIT); 2984 goto cleanup; 2985 } 2986 s = pool_get(&pf_state_pl, PR_NOWAIT); 2987 if (s == NULL) { 2988 REASON_SET(&reason, PFRES_MEMORY); 2989 cleanup: 2990 if (sn != NULL && sn->states == 0 && sn->expire == 0) { 2991 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn); 2992 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 2993 pf_status.src_nodes--; 2994 pool_put(&pf_src_tree_pl, sn); 2995 } 2996 if (nsn != sn && nsn != NULL && nsn->states == 0 && 2997 nsn->expire == 0) { 2998 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn); 2999 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3000 pf_status.src_nodes--; 3001 pool_put(&pf_src_tree_pl, nsn); 3002 } 3003 return (PF_DROP); 3004 } 3005 bzero(s, sizeof(*s)); 3006 s->rule.ptr = r; 3007 s->nat_rule.ptr = nr; 3008 s->anchor.ptr = a; 3009 STATE_INC_COUNTERS(s); 3010 s->allow_opts = r->allow_opts; 3011 s->log = r->log & 2; 3012 s->proto = IPPROTO_TCP; 3013 s->direction = direction; 3014 s->af = af; 3015 if (direction == PF_OUT) { 3016 PF_ACPY(&s->gwy.addr, saddr, af); 3017 s->gwy.port = th->th_sport; /* sport */ 3018 PF_ACPY(&s->ext.addr, daddr, af); 3019 s->ext.port = th->th_dport; 3020 if (nr != NULL) { 3021 PF_ACPY(&s->lan.addr, &pd->baddr, af); 3022 s->lan.port = bport; 3023 } else { 3024 PF_ACPY(&s->lan.addr, &s->gwy.addr, af); 3025 s->lan.port = s->gwy.port; 3026 } 3027 } else { 3028 PF_ACPY(&s->lan.addr, daddr, af); 3029 s->lan.port = th->th_dport; 3030 PF_ACPY(&s->ext.addr, saddr, af); 3031 s->ext.port = th->th_sport; 3032 if (nr != NULL) { 3033 PF_ACPY(&s->gwy.addr, &pd->baddr, af); 3034 s->gwy.port = bport; 3035 } else { 3036 PF_ACPY(&s->gwy.addr, &s->lan.addr, af); 3037 s->gwy.port = s->lan.port; 3038 } 3039 } 3040 3041 s->src.seqlo = ntohl(th->th_seq); 3042 s->src.seqhi = s->src.seqlo + len + 1; 3043 if ((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN && 3044 r->keep_state == PF_STATE_MODULATE) { 3045 /* Generate sequence number modulator */ 3046 while ((s->src.seqdiff = htonl(arc4random())) == 0) 3047 ; 3048 pf_change_a(&th->th_seq, &th->th_sum, 3049 htonl(s->src.seqlo + s->src.seqdiff), 0); 3050 rewrite = 1; 3051 } else 3052 s->src.seqdiff = 0; 3053 if (th->th_flags & TH_SYN) { 3054 s->src.seqhi++; 3055 s->src.wscale = pf_get_wscale(m, off, th->th_off, af); 3056 } 3057 s->src.max_win = MAX(ntohs(th->th_win), 1); 3058 if (s->src.wscale & PF_WSCALE_MASK) { 3059 /* Remove scale factor from initial window */ 3060 int win = s->src.max_win; 3061 win += 1 << (s->src.wscale & PF_WSCALE_MASK); 3062 s->src.max_win = (win - 1) >> 3063 (s->src.wscale & PF_WSCALE_MASK); 3064 } 3065 if (th->th_flags & TH_FIN) 3066 s->src.seqhi++; 3067 s->dst.seqhi = 1; 3068 s->dst.max_win = 1; 3069 s->src.state = TCPS_SYN_SENT; 3070 s->dst.state = TCPS_CLOSED; 3071 s->creation = time_second; 3072 s->expire = time_second; 3073 s->timeout = PFTM_TCP_FIRST_PACKET; 3074 pf_set_rt_ifp(s, saddr); 3075 if (sn != NULL) { 3076 s->src_node = sn; 3077 s->src_node->states++; 3078 } 3079 if (nsn != NULL) { 3080 PF_ACPY(&nsn->raddr, &pd->naddr, af); 3081 s->nat_src_node = nsn; 3082 s->nat_src_node->states++; 3083 } 3084 if ((pd->flags & PFDESC_TCP_NORM) && pf_normalize_tcp_init(m, 3085 off, pd, th, &s->src, &s->dst)) { 3086 REASON_SET(&reason, PFRES_MEMORY); 3087 pf_src_tree_remove_state(s); 3088 STATE_DEC_COUNTERS(s); 3089 pool_put(&pf_state_pl, s); 3090 return (PF_DROP); 3091 } 3092 if ((pd->flags & PFDESC_TCP_NORM) && s->src.scrub && 3093 pf_normalize_tcp_stateful(m, off, pd, &reason, th, s, 3094 &s->src, &s->dst, &rewrite)) { 3095 /* This really shouldn't happen!!! */ 3096 DPFPRINTF(PF_DEBUG_URGENT, 3097 ("pf_normalize_tcp_stateful failed on first pkt")); 3098 pf_normalize_tcp_cleanup(s); 3099 pf_src_tree_remove_state(s); 3100 STATE_DEC_COUNTERS(s); 3101 pool_put(&pf_state_pl, s); 3102 return (PF_DROP); 3103 } 3104 if (pf_insert_state(BOUND_IFACE(r, kif), s)) { 3105 pf_normalize_tcp_cleanup(s); 3106 REASON_SET(&reason, PFRES_STATEINS); 3107 pf_src_tree_remove_state(s); 3108 STATE_DEC_COUNTERS(s); 3109 pool_put(&pf_state_pl, s); 3110 return (PF_DROP); 3111 } else 3112 *sm = s; 3113 if (tag > 0) { 3114 pf_tag_ref(tag); 3115 s->tag = tag; 3116 } 3117 if ((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN && 3118 r->keep_state == PF_STATE_SYNPROXY) { 3119 s->src.state = PF_TCPS_PROXY_SRC; 3120 if (nr != NULL) { 3121 if (direction == PF_OUT) { 3122 pf_change_ap(saddr, &th->th_sport, 3123 pd->ip_sum, &th->th_sum, &pd->baddr, 3124 bport, 0, af); 3125 } else { 3126 pf_change_ap(daddr, &th->th_dport, 3127 pd->ip_sum, &th->th_sum, &pd->baddr, 3128 bport, 0, af); 3129 } 3130 } 3131 s->src.seqhi = htonl(arc4random()); 3132 /* Find mss option */ 3133 mss = pf_get_mss(m, off, th->th_off, af); 3134 mss = pf_calc_mss(saddr, af, mss); 3135 mss = pf_calc_mss(daddr, af, mss); 3136 s->src.mss = mss; 3137 pf_send_tcp(r, af, daddr, saddr, th->th_dport, 3138 th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1, 3139 TH_SYN|TH_ACK, 0, s->src.mss, 0, 1, NULL, NULL); 3140 REASON_SET(&reason, PFRES_SYNPROXY); 3141 return (PF_SYNPROXY_DROP); 3142 } 3143 } 3144 3145 /* copy back packet headers if we performed NAT operations */ 3146 if (rewrite) 3147 m_copyback(m, off, sizeof(*th), th); 3148 3149 return (PF_PASS); 3150 } 3151 3152 int 3153 pf_test_udp(struct pf_rule **rm, struct pf_state **sm, int direction, 3154 struct pfi_kif *kif, struct mbuf *m, int off, void *h, 3155 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm, 3156 struct ifqueue *ifq) 3157 { 3158 struct pf_rule *nr = NULL; 3159 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 3160 struct udphdr *uh = pd->hdr.udp; 3161 u_int16_t bport, nport = 0; 3162 sa_family_t af = pd->af; 3163 int lookup = -1; 3164 uid_t uid = 0; /* XXX: GCC */ 3165 gid_t gid = 0; /* XXX: GCC */ 3166 struct pf_rule *r, *a = NULL; 3167 struct pf_ruleset *ruleset = NULL; 3168 struct pf_src_node *nsn = NULL; 3169 u_short reason; 3170 int rewrite = 0; 3171 struct pf_tag *pftag = NULL; 3172 int tag = -1; 3173 int asd = 0; 3174 3175 if (pf_check_congestion(ifq)) { 3176 REASON_SET(&reason, PFRES_CONGEST); 3177 return (PF_DROP); 3178 } 3179 3180 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 3181 3182 if (direction == PF_OUT) { 3183 bport = nport = uh->uh_sport; 3184 /* check outgoing packet for BINAT/NAT */ 3185 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn, 3186 saddr, uh->uh_sport, daddr, uh->uh_dport, 3187 &pd->naddr, &nport)) != NULL) { 3188 PF_ACPY(&pd->baddr, saddr, af); 3189 pf_change_ap(saddr, &uh->uh_sport, pd->ip_sum, 3190 &uh->uh_sum, &pd->naddr, nport, 1, af); 3191 rewrite++; 3192 if (nr->natpass) 3193 r = NULL; 3194 pd->nat_rule = nr; 3195 } 3196 } else { 3197 bport = nport = uh->uh_dport; 3198 /* check incoming packet for BINAT/RDR */ 3199 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn, 3200 saddr, uh->uh_sport, daddr, uh->uh_dport, &pd->naddr, 3201 &nport)) != NULL) { 3202 PF_ACPY(&pd->baddr, daddr, af); 3203 pf_change_ap(daddr, &uh->uh_dport, pd->ip_sum, 3204 &uh->uh_sum, &pd->naddr, nport, 1, af); 3205 rewrite++; 3206 if (nr->natpass) 3207 r = NULL; 3208 pd->nat_rule = nr; 3209 } 3210 } 3211 3212 while (r != NULL) { 3213 r->evaluations++; 3214 if (r->kif != NULL && 3215 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 3216 r = r->skip[PF_SKIP_IFP].ptr; 3217 else if (r->direction && r->direction != direction) 3218 r = r->skip[PF_SKIP_DIR].ptr; 3219 else if (r->af && r->af != af) 3220 r = r->skip[PF_SKIP_AF].ptr; 3221 else if (r->proto && r->proto != IPPROTO_UDP) 3222 r = r->skip[PF_SKIP_PROTO].ptr; 3223 else if (PF_MISMATCHAW(&r->src.addr, saddr, af, r->src.neg)) 3224 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 3225 else if (r->src.port_op && !pf_match_port(r->src.port_op, 3226 r->src.port[0], r->src.port[1], uh->uh_sport)) 3227 r = r->skip[PF_SKIP_SRC_PORT].ptr; 3228 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af, r->dst.neg)) 3229 r = r->skip[PF_SKIP_DST_ADDR].ptr; 3230 else if (r->dst.port_op && !pf_match_port(r->dst.port_op, 3231 r->dst.port[0], r->dst.port[1], uh->uh_dport)) 3232 r = r->skip[PF_SKIP_DST_PORT].ptr; 3233 else if (r->tos && !(r->tos & pd->tos)) 3234 r = TAILQ_NEXT(r, entries); 3235 else if (r->rule_flag & PFRULE_FRAGMENT) 3236 r = TAILQ_NEXT(r, entries); 3237 else if (r->uid.op && (lookup != -1 || (lookup = 3238 pf_socket_lookup(&uid, &gid, direction, pd), 1)) && 3239 !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1], 3240 uid)) 3241 r = TAILQ_NEXT(r, entries); 3242 else if (r->gid.op && (lookup != -1 || (lookup = 3243 pf_socket_lookup(&uid, &gid, direction, pd), 1)) && 3244 !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1], 3245 gid)) 3246 r = TAILQ_NEXT(r, entries); 3247 else if (r->prob && r->prob <= arc4random()) 3248 r = TAILQ_NEXT(r, entries); 3249 else if (r->match_tag && !pf_match_tag(m, r, &pftag, &tag)) 3250 r = TAILQ_NEXT(r, entries); 3251 else if (r->os_fingerprint != PF_OSFP_ANY) 3252 r = TAILQ_NEXT(r, entries); 3253 else { 3254 if (r->tag) 3255 tag = r->tag; 3256 if (r->anchor == NULL) { 3257 *rm = r; 3258 *am = a; 3259 *rsm = ruleset; 3260 if ((*rm)->quick) 3261 break; 3262 r = TAILQ_NEXT(r, entries); 3263 } else 3264 pf_step_into_anchor(&asd, &ruleset, 3265 PF_RULESET_FILTER, &r, &a); 3266 } 3267 if (r == NULL) 3268 pf_step_out_of_anchor(&asd, &ruleset, 3269 PF_RULESET_FILTER, &r, &a); 3270 } 3271 r = *rm; 3272 a = *am; 3273 ruleset = *rsm; 3274 3275 REASON_SET(&reason, PFRES_MATCH); 3276 3277 if (r->log) { 3278 if (rewrite) 3279 m_copyback(m, off, sizeof(*uh), uh); 3280 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset); 3281 } 3282 3283 if ((r->action == PF_DROP) && 3284 ((r->rule_flag & PFRULE_RETURNICMP) || 3285 (r->rule_flag & PFRULE_RETURN))) { 3286 /* undo NAT changes, if they have taken place */ 3287 if (nr != NULL) { 3288 if (direction == PF_OUT) { 3289 pf_change_ap(saddr, &uh->uh_sport, pd->ip_sum, 3290 &uh->uh_sum, &pd->baddr, bport, 1, af); 3291 rewrite++; 3292 } else { 3293 pf_change_ap(daddr, &uh->uh_dport, pd->ip_sum, 3294 &uh->uh_sum, &pd->baddr, bport, 1, af); 3295 rewrite++; 3296 } 3297 } 3298 if ((af == AF_INET) && r->return_icmp) 3299 pf_send_icmp(m, r->return_icmp >> 8, 3300 r->return_icmp & 255, af, r); 3301 else if ((af == AF_INET6) && r->return_icmp6) 3302 pf_send_icmp(m, r->return_icmp6 >> 8, 3303 r->return_icmp6 & 255, af, r); 3304 } 3305 3306 if (r->action == PF_DROP) 3307 return (PF_DROP); 3308 3309 if (pf_tag_packet(m, pftag, tag)) { 3310 REASON_SET(&reason, PFRES_MEMORY); 3311 return (PF_DROP); 3312 } 3313 3314 if (r->keep_state || nr != NULL) { 3315 /* create new state */ 3316 struct pf_state *s = NULL; 3317 struct pf_src_node *sn = NULL; 3318 3319 /* check maximums */ 3320 if (r->max_states && (r->states >= r->max_states)) { 3321 pf_status.lcounters[LCNT_STATES]++; 3322 REASON_SET(&reason, PFRES_MAXSTATES); 3323 goto cleanup; 3324 } 3325 /* src node for flter rule */ 3326 if ((r->rule_flag & PFRULE_SRCTRACK || 3327 r->rpool.opts & PF_POOL_STICKYADDR) && 3328 pf_insert_src_node(&sn, r, saddr, af) != 0) { 3329 REASON_SET(&reason, PFRES_SRCLIMIT); 3330 goto cleanup; 3331 } 3332 /* src node for translation rule */ 3333 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) && 3334 ((direction == PF_OUT && 3335 pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) || 3336 (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) { 3337 REASON_SET(&reason, PFRES_SRCLIMIT); 3338 goto cleanup; 3339 } 3340 s = pool_get(&pf_state_pl, PR_NOWAIT); 3341 if (s == NULL) { 3342 REASON_SET(&reason, PFRES_MEMORY); 3343 cleanup: 3344 if (sn != NULL && sn->states == 0 && sn->expire == 0) { 3345 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn); 3346 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3347 pf_status.src_nodes--; 3348 pool_put(&pf_src_tree_pl, sn); 3349 } 3350 if (nsn != sn && nsn != NULL && nsn->states == 0 && 3351 nsn->expire == 0) { 3352 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn); 3353 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3354 pf_status.src_nodes--; 3355 pool_put(&pf_src_tree_pl, nsn); 3356 } 3357 return (PF_DROP); 3358 } 3359 bzero(s, sizeof(*s)); 3360 s->rule.ptr = r; 3361 s->nat_rule.ptr = nr; 3362 s->anchor.ptr = a; 3363 STATE_INC_COUNTERS(s); 3364 s->allow_opts = r->allow_opts; 3365 s->log = r->log & 2; 3366 s->proto = IPPROTO_UDP; 3367 s->direction = direction; 3368 s->af = af; 3369 if (direction == PF_OUT) { 3370 PF_ACPY(&s->gwy.addr, saddr, af); 3371 s->gwy.port = uh->uh_sport; 3372 PF_ACPY(&s->ext.addr, daddr, af); 3373 s->ext.port = uh->uh_dport; 3374 if (nr != NULL) { 3375 PF_ACPY(&s->lan.addr, &pd->baddr, af); 3376 s->lan.port = bport; 3377 } else { 3378 PF_ACPY(&s->lan.addr, &s->gwy.addr, af); 3379 s->lan.port = s->gwy.port; 3380 } 3381 } else { 3382 PF_ACPY(&s->lan.addr, daddr, af); 3383 s->lan.port = uh->uh_dport; 3384 PF_ACPY(&s->ext.addr, saddr, af); 3385 s->ext.port = uh->uh_sport; 3386 if (nr != NULL) { 3387 PF_ACPY(&s->gwy.addr, &pd->baddr, af); 3388 s->gwy.port = bport; 3389 } else { 3390 PF_ACPY(&s->gwy.addr, &s->lan.addr, af); 3391 s->gwy.port = s->lan.port; 3392 } 3393 } 3394 s->src.state = PFUDPS_SINGLE; 3395 s->dst.state = PFUDPS_NO_TRAFFIC; 3396 s->creation = time_second; 3397 s->expire = time_second; 3398 s->timeout = PFTM_UDP_FIRST_PACKET; 3399 pf_set_rt_ifp(s, saddr); 3400 if (sn != NULL) { 3401 s->src_node = sn; 3402 s->src_node->states++; 3403 } 3404 if (nsn != NULL) { 3405 PF_ACPY(&nsn->raddr, &pd->naddr, af); 3406 s->nat_src_node = nsn; 3407 s->nat_src_node->states++; 3408 } 3409 if (pf_insert_state(BOUND_IFACE(r, kif), s)) { 3410 REASON_SET(&reason, PFRES_STATEINS); 3411 pf_src_tree_remove_state(s); 3412 STATE_DEC_COUNTERS(s); 3413 pool_put(&pf_state_pl, s); 3414 return (PF_DROP); 3415 } else 3416 *sm = s; 3417 if (tag > 0) { 3418 pf_tag_ref(tag); 3419 s->tag = tag; 3420 } 3421 } 3422 3423 /* copy back packet headers if we performed NAT operations */ 3424 if (rewrite) 3425 m_copyback(m, off, sizeof(*uh), uh); 3426 3427 return (PF_PASS); 3428 } 3429 3430 int 3431 pf_test_icmp(struct pf_rule **rm, struct pf_state **sm, int direction, 3432 struct pfi_kif *kif, struct mbuf *m, int off, void *h, 3433 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm, 3434 struct ifqueue *ifq) 3435 { 3436 struct pf_rule *nr = NULL; 3437 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 3438 struct pf_rule *r, *a = NULL; 3439 struct pf_ruleset *ruleset = NULL; 3440 struct pf_src_node *nsn = NULL; 3441 u_short reason; 3442 u_int16_t icmpid = 0; 3443 sa_family_t af = pd->af; 3444 u_int8_t icmptype = 0, icmpcode = 0; 3445 int state_icmp = 0; 3446 struct pf_tag *pftag = NULL; 3447 int tag = -1; 3448 #ifdef INET6 3449 int rewrite = 0; 3450 #endif /* INET6 */ 3451 int asd = 0; 3452 3453 if (pf_check_congestion(ifq)) { 3454 REASON_SET(&reason, PFRES_CONGEST); 3455 return (PF_DROP); 3456 } 3457 3458 switch (pd->proto) { 3459 #ifdef INET 3460 case IPPROTO_ICMP: 3461 icmptype = pd->hdr.icmp->icmp_type; 3462 icmpcode = pd->hdr.icmp->icmp_code; 3463 icmpid = pd->hdr.icmp->icmp_id; 3464 3465 if (icmptype == ICMP_UNREACH || 3466 icmptype == ICMP_SOURCEQUENCH || 3467 icmptype == ICMP_REDIRECT || 3468 icmptype == ICMP_TIMXCEED || 3469 icmptype == ICMP_PARAMPROB) 3470 state_icmp++; 3471 break; 3472 #endif /* INET */ 3473 #ifdef INET6 3474 case IPPROTO_ICMPV6: 3475 icmptype = pd->hdr.icmp6->icmp6_type; 3476 icmpcode = pd->hdr.icmp6->icmp6_code; 3477 icmpid = pd->hdr.icmp6->icmp6_id; 3478 3479 if (icmptype == ICMP6_DST_UNREACH || 3480 icmptype == ICMP6_PACKET_TOO_BIG || 3481 icmptype == ICMP6_TIME_EXCEEDED || 3482 icmptype == ICMP6_PARAM_PROB) 3483 state_icmp++; 3484 break; 3485 #endif /* INET6 */ 3486 } 3487 3488 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 3489 3490 if (direction == PF_OUT) { 3491 /* check outgoing packet for BINAT/NAT */ 3492 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn, 3493 saddr, icmpid, daddr, icmpid, &pd->naddr, NULL)) != NULL) { 3494 PF_ACPY(&pd->baddr, saddr, af); 3495 switch (af) { 3496 #ifdef INET 3497 case AF_INET: 3498 pf_change_a(&saddr->v4.s_addr, pd->ip_sum, 3499 pd->naddr.v4.s_addr, 0); 3500 break; 3501 #endif /* INET */ 3502 #ifdef INET6 3503 case AF_INET6: 3504 pf_change_a6(saddr, &pd->hdr.icmp6->icmp6_cksum, 3505 &pd->naddr, 0); 3506 rewrite++; 3507 break; 3508 #endif /* INET6 */ 3509 } 3510 if (nr->natpass) 3511 r = NULL; 3512 pd->nat_rule = nr; 3513 } 3514 } else { 3515 /* check incoming packet for BINAT/RDR */ 3516 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn, 3517 saddr, icmpid, daddr, icmpid, &pd->naddr, NULL)) != NULL) { 3518 PF_ACPY(&pd->baddr, daddr, af); 3519 switch (af) { 3520 #ifdef INET 3521 case AF_INET: 3522 pf_change_a(&daddr->v4.s_addr, 3523 pd->ip_sum, pd->naddr.v4.s_addr, 0); 3524 break; 3525 #endif /* INET */ 3526 #ifdef INET6 3527 case AF_INET6: 3528 pf_change_a6(daddr, &pd->hdr.icmp6->icmp6_cksum, 3529 &pd->naddr, 0); 3530 rewrite++; 3531 break; 3532 #endif /* INET6 */ 3533 } 3534 if (nr->natpass) 3535 r = NULL; 3536 pd->nat_rule = nr; 3537 } 3538 } 3539 3540 while (r != NULL) { 3541 r->evaluations++; 3542 if (r->kif != NULL && 3543 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 3544 r = r->skip[PF_SKIP_IFP].ptr; 3545 else if (r->direction && r->direction != direction) 3546 r = r->skip[PF_SKIP_DIR].ptr; 3547 else if (r->af && r->af != af) 3548 r = r->skip[PF_SKIP_AF].ptr; 3549 else if (r->proto && r->proto != pd->proto) 3550 r = r->skip[PF_SKIP_PROTO].ptr; 3551 else if (PF_MISMATCHAW(&r->src.addr, saddr, af, r->src.neg)) 3552 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 3553 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af, r->dst.neg)) 3554 r = r->skip[PF_SKIP_DST_ADDR].ptr; 3555 else if (r->type && r->type != icmptype + 1) 3556 r = TAILQ_NEXT(r, entries); 3557 else if (r->code && r->code != icmpcode + 1) 3558 r = TAILQ_NEXT(r, entries); 3559 else if (r->tos && !(r->tos & pd->tos)) 3560 r = TAILQ_NEXT(r, entries); 3561 else if (r->rule_flag & PFRULE_FRAGMENT) 3562 r = TAILQ_NEXT(r, entries); 3563 else if (r->prob && r->prob <= arc4random()) 3564 r = TAILQ_NEXT(r, entries); 3565 else if (r->match_tag && !pf_match_tag(m, r, &pftag, &tag)) 3566 r = TAILQ_NEXT(r, entries); 3567 else if (r->os_fingerprint != PF_OSFP_ANY) 3568 r = TAILQ_NEXT(r, entries); 3569 else { 3570 if (r->tag) 3571 tag = r->tag; 3572 if (r->anchor == NULL) { 3573 *rm = r; 3574 *am = a; 3575 *rsm = ruleset; 3576 if ((*rm)->quick) 3577 break; 3578 r = TAILQ_NEXT(r, entries); 3579 } else 3580 pf_step_into_anchor(&asd, &ruleset, 3581 PF_RULESET_FILTER, &r, &a); 3582 } 3583 if (r == NULL) 3584 pf_step_out_of_anchor(&asd, &ruleset, 3585 PF_RULESET_FILTER, &r, &a); 3586 } 3587 r = *rm; 3588 a = *am; 3589 ruleset = *rsm; 3590 3591 REASON_SET(&reason, PFRES_MATCH); 3592 3593 if (r->log) { 3594 #ifdef INET6 3595 if (rewrite) 3596 m_copyback(m, off, sizeof(struct icmp6_hdr), 3597 pd->hdr.icmp6); 3598 #endif /* INET6 */ 3599 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset); 3600 } 3601 3602 if (r->action != PF_PASS) 3603 return (PF_DROP); 3604 3605 if (pf_tag_packet(m, pftag, tag)) { 3606 REASON_SET(&reason, PFRES_MEMORY); 3607 return (PF_DROP); 3608 } 3609 3610 if (!state_icmp && (r->keep_state || nr != NULL)) { 3611 /* create new state */ 3612 struct pf_state *s = NULL; 3613 struct pf_src_node *sn = NULL; 3614 3615 /* check maximums */ 3616 if (r->max_states && (r->states >= r->max_states)) { 3617 pf_status.lcounters[LCNT_STATES]++; 3618 REASON_SET(&reason, PFRES_MAXSTATES); 3619 goto cleanup; 3620 } 3621 /* src node for flter rule */ 3622 if ((r->rule_flag & PFRULE_SRCTRACK || 3623 r->rpool.opts & PF_POOL_STICKYADDR) && 3624 pf_insert_src_node(&sn, r, saddr, af) != 0) { 3625 REASON_SET(&reason, PFRES_SRCLIMIT); 3626 goto cleanup; 3627 } 3628 /* src node for translation rule */ 3629 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) && 3630 ((direction == PF_OUT && 3631 pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) || 3632 (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) { 3633 REASON_SET(&reason, PFRES_SRCLIMIT); 3634 goto cleanup; 3635 } 3636 s = pool_get(&pf_state_pl, PR_NOWAIT); 3637 if (s == NULL) { 3638 REASON_SET(&reason, PFRES_MEMORY); 3639 cleanup: 3640 if (sn != NULL && sn->states == 0 && sn->expire == 0) { 3641 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn); 3642 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3643 pf_status.src_nodes--; 3644 pool_put(&pf_src_tree_pl, sn); 3645 } 3646 if (nsn != sn && nsn != NULL && nsn->states == 0 && 3647 nsn->expire == 0) { 3648 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn); 3649 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3650 pf_status.src_nodes--; 3651 pool_put(&pf_src_tree_pl, nsn); 3652 } 3653 return (PF_DROP); 3654 } 3655 bzero(s, sizeof(*s)); 3656 s->rule.ptr = r; 3657 s->nat_rule.ptr = nr; 3658 s->anchor.ptr = a; 3659 STATE_INC_COUNTERS(s); 3660 s->allow_opts = r->allow_opts; 3661 s->log = r->log & 2; 3662 s->proto = pd->proto; 3663 s->direction = direction; 3664 s->af = af; 3665 if (direction == PF_OUT) { 3666 PF_ACPY(&s->gwy.addr, saddr, af); 3667 s->gwy.port = icmpid; 3668 PF_ACPY(&s->ext.addr, daddr, af); 3669 s->ext.port = icmpid; 3670 if (nr != NULL) 3671 PF_ACPY(&s->lan.addr, &pd->baddr, af); 3672 else 3673 PF_ACPY(&s->lan.addr, &s->gwy.addr, af); 3674 s->lan.port = icmpid; 3675 } else { 3676 PF_ACPY(&s->lan.addr, daddr, af); 3677 s->lan.port = icmpid; 3678 PF_ACPY(&s->ext.addr, saddr, af); 3679 s->ext.port = icmpid; 3680 if (nr != NULL) 3681 PF_ACPY(&s->gwy.addr, &pd->baddr, af); 3682 else 3683 PF_ACPY(&s->gwy.addr, &s->lan.addr, af); 3684 s->gwy.port = icmpid; 3685 } 3686 s->creation = time_second; 3687 s->expire = time_second; 3688 s->timeout = PFTM_ICMP_FIRST_PACKET; 3689 pf_set_rt_ifp(s, saddr); 3690 if (sn != NULL) { 3691 s->src_node = sn; 3692 s->src_node->states++; 3693 } 3694 if (nsn != NULL) { 3695 PF_ACPY(&nsn->raddr, &pd->naddr, af); 3696 s->nat_src_node = nsn; 3697 s->nat_src_node->states++; 3698 } 3699 if (pf_insert_state(BOUND_IFACE(r, kif), s)) { 3700 REASON_SET(&reason, PFRES_STATEINS); 3701 pf_src_tree_remove_state(s); 3702 STATE_DEC_COUNTERS(s); 3703 pool_put(&pf_state_pl, s); 3704 return (PF_DROP); 3705 } else 3706 *sm = s; 3707 if (tag > 0) { 3708 pf_tag_ref(tag); 3709 s->tag = tag; 3710 } 3711 } 3712 3713 #ifdef INET6 3714 /* copy back packet headers if we performed IPv6 NAT operations */ 3715 if (rewrite) 3716 m_copyback(m, off, sizeof(struct icmp6_hdr), 3717 pd->hdr.icmp6); 3718 #endif /* INET6 */ 3719 3720 return (PF_PASS); 3721 } 3722 3723 int 3724 pf_test_other(struct pf_rule **rm, struct pf_state **sm, int direction, 3725 struct pfi_kif *kif, struct mbuf *m, int off, void *h, struct pf_pdesc *pd, 3726 struct pf_rule **am, struct pf_ruleset **rsm, struct ifqueue *ifq) 3727 { 3728 struct pf_rule *nr = NULL; 3729 struct pf_rule *r, *a = NULL; 3730 struct pf_ruleset *ruleset = NULL; 3731 struct pf_src_node *nsn = NULL; 3732 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 3733 sa_family_t af = pd->af; 3734 u_short reason; 3735 struct pf_tag *pftag = NULL; 3736 int tag = -1; 3737 int asd = 0; 3738 3739 if (pf_check_congestion(ifq)) { 3740 REASON_SET(&reason, PFRES_CONGEST); 3741 return (PF_DROP); 3742 } 3743 3744 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 3745 3746 if (direction == PF_OUT) { 3747 /* check outgoing packet for BINAT/NAT */ 3748 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn, 3749 saddr, 0, daddr, 0, &pd->naddr, NULL)) != NULL) { 3750 PF_ACPY(&pd->baddr, saddr, af); 3751 switch (af) { 3752 #ifdef INET 3753 case AF_INET: 3754 pf_change_a(&saddr->v4.s_addr, pd->ip_sum, 3755 pd->naddr.v4.s_addr, 0); 3756 break; 3757 #endif /* INET */ 3758 #ifdef INET6 3759 case AF_INET6: 3760 PF_ACPY(saddr, &pd->naddr, af); 3761 break; 3762 #endif /* INET6 */ 3763 } 3764 if (nr->natpass) 3765 r = NULL; 3766 pd->nat_rule = nr; 3767 } 3768 } else { 3769 /* check incoming packet for BINAT/RDR */ 3770 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn, 3771 saddr, 0, daddr, 0, &pd->naddr, NULL)) != NULL) { 3772 PF_ACPY(&pd->baddr, daddr, af); 3773 switch (af) { 3774 #ifdef INET 3775 case AF_INET: 3776 pf_change_a(&daddr->v4.s_addr, 3777 pd->ip_sum, pd->naddr.v4.s_addr, 0); 3778 break; 3779 #endif /* INET */ 3780 #ifdef INET6 3781 case AF_INET6: 3782 PF_ACPY(daddr, &pd->naddr, af); 3783 break; 3784 #endif /* INET6 */ 3785 } 3786 if (nr->natpass) 3787 r = NULL; 3788 pd->nat_rule = nr; 3789 } 3790 } 3791 3792 while (r != NULL) { 3793 r->evaluations++; 3794 if (r->kif != NULL && 3795 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 3796 r = r->skip[PF_SKIP_IFP].ptr; 3797 else if (r->direction && r->direction != direction) 3798 r = r->skip[PF_SKIP_DIR].ptr; 3799 else if (r->af && r->af != af) 3800 r = r->skip[PF_SKIP_AF].ptr; 3801 else if (r->proto && r->proto != pd->proto) 3802 r = r->skip[PF_SKIP_PROTO].ptr; 3803 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af, r->src.neg)) 3804 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 3805 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af, r->dst.neg)) 3806 r = r->skip[PF_SKIP_DST_ADDR].ptr; 3807 else if (r->tos && !(r->tos & pd->tos)) 3808 r = TAILQ_NEXT(r, entries); 3809 else if (r->rule_flag & PFRULE_FRAGMENT) 3810 r = TAILQ_NEXT(r, entries); 3811 else if (r->prob && r->prob <= arc4random()) 3812 r = TAILQ_NEXT(r, entries); 3813 else if (r->match_tag && !pf_match_tag(m, r, &pftag, &tag)) 3814 r = TAILQ_NEXT(r, entries); 3815 else if (r->os_fingerprint != PF_OSFP_ANY) 3816 r = TAILQ_NEXT(r, entries); 3817 else { 3818 if (r->tag) 3819 tag = r->tag; 3820 if (r->anchor == NULL) { 3821 *rm = r; 3822 *am = a; 3823 *rsm = ruleset; 3824 if ((*rm)->quick) 3825 break; 3826 r = TAILQ_NEXT(r, entries); 3827 } else 3828 pf_step_into_anchor(&asd, &ruleset, 3829 PF_RULESET_FILTER, &r, &a); 3830 } 3831 if (r == NULL) 3832 pf_step_out_of_anchor(&asd, &ruleset, 3833 PF_RULESET_FILTER, &r, &a); 3834 } 3835 r = *rm; 3836 a = *am; 3837 ruleset = *rsm; 3838 3839 REASON_SET(&reason, PFRES_MATCH); 3840 3841 if (r->log) 3842 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset); 3843 3844 if ((r->action == PF_DROP) && 3845 ((r->rule_flag & PFRULE_RETURNICMP) || 3846 (r->rule_flag & PFRULE_RETURN))) { 3847 struct pf_addr *a = NULL; 3848 3849 if (nr != NULL) { 3850 if (direction == PF_OUT) 3851 a = saddr; 3852 else 3853 a = daddr; 3854 } 3855 if (a != NULL) { 3856 switch (af) { 3857 #ifdef INET 3858 case AF_INET: 3859 pf_change_a(&a->v4.s_addr, pd->ip_sum, 3860 pd->baddr.v4.s_addr, 0); 3861 break; 3862 #endif /* INET */ 3863 #ifdef INET6 3864 case AF_INET6: 3865 PF_ACPY(a, &pd->baddr, af); 3866 break; 3867 #endif /* INET6 */ 3868 } 3869 } 3870 if ((af == AF_INET) && r->return_icmp) 3871 pf_send_icmp(m, r->return_icmp >> 8, 3872 r->return_icmp & 255, af, r); 3873 else if ((af == AF_INET6) && r->return_icmp6) 3874 pf_send_icmp(m, r->return_icmp6 >> 8, 3875 r->return_icmp6 & 255, af, r); 3876 } 3877 3878 if (r->action != PF_PASS) 3879 return (PF_DROP); 3880 3881 if (pf_tag_packet(m, pftag, tag)) { 3882 REASON_SET(&reason, PFRES_MEMORY); 3883 return (PF_DROP); 3884 } 3885 3886 if (r->keep_state || nr != NULL) { 3887 /* create new state */ 3888 struct pf_state *s = NULL; 3889 struct pf_src_node *sn = NULL; 3890 3891 /* check maximums */ 3892 if (r->max_states && (r->states >= r->max_states)) { 3893 pf_status.lcounters[LCNT_STATES]++; 3894 REASON_SET(&reason, PFRES_MAXSTATES); 3895 goto cleanup; 3896 } 3897 /* src node for flter rule */ 3898 if ((r->rule_flag & PFRULE_SRCTRACK || 3899 r->rpool.opts & PF_POOL_STICKYADDR) && 3900 pf_insert_src_node(&sn, r, saddr, af) != 0) { 3901 REASON_SET(&reason, PFRES_SRCLIMIT); 3902 goto cleanup; 3903 } 3904 /* src node for translation rule */ 3905 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) && 3906 ((direction == PF_OUT && 3907 pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) || 3908 (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) { 3909 REASON_SET(&reason, PFRES_SRCLIMIT); 3910 goto cleanup; 3911 } 3912 s = pool_get(&pf_state_pl, PR_NOWAIT); 3913 if (s == NULL) { 3914 REASON_SET(&reason, PFRES_MEMORY); 3915 cleanup: 3916 if (sn != NULL && sn->states == 0 && sn->expire == 0) { 3917 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn); 3918 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3919 pf_status.src_nodes--; 3920 pool_put(&pf_src_tree_pl, sn); 3921 } 3922 if (nsn != sn && nsn != NULL && nsn->states == 0 && 3923 nsn->expire == 0) { 3924 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn); 3925 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3926 pf_status.src_nodes--; 3927 pool_put(&pf_src_tree_pl, nsn); 3928 } 3929 return (PF_DROP); 3930 } 3931 bzero(s, sizeof(*s)); 3932 s->rule.ptr = r; 3933 s->nat_rule.ptr = nr; 3934 s->anchor.ptr = a; 3935 STATE_INC_COUNTERS(s); 3936 s->allow_opts = r->allow_opts; 3937 s->log = r->log & 2; 3938 s->proto = pd->proto; 3939 s->direction = direction; 3940 s->af = af; 3941 if (direction == PF_OUT) { 3942 PF_ACPY(&s->gwy.addr, saddr, af); 3943 PF_ACPY(&s->ext.addr, daddr, af); 3944 if (nr != NULL) 3945 PF_ACPY(&s->lan.addr, &pd->baddr, af); 3946 else 3947 PF_ACPY(&s->lan.addr, &s->gwy.addr, af); 3948 } else { 3949 PF_ACPY(&s->lan.addr, daddr, af); 3950 PF_ACPY(&s->ext.addr, saddr, af); 3951 if (nr != NULL) 3952 PF_ACPY(&s->gwy.addr, &pd->baddr, af); 3953 else 3954 PF_ACPY(&s->gwy.addr, &s->lan.addr, af); 3955 } 3956 s->src.state = PFOTHERS_SINGLE; 3957 s->dst.state = PFOTHERS_NO_TRAFFIC; 3958 s->creation = time_second; 3959 s->expire = time_second; 3960 s->timeout = PFTM_OTHER_FIRST_PACKET; 3961 pf_set_rt_ifp(s, saddr); 3962 if (sn != NULL) { 3963 s->src_node = sn; 3964 s->src_node->states++; 3965 } 3966 if (nsn != NULL) { 3967 PF_ACPY(&nsn->raddr, &pd->naddr, af); 3968 s->nat_src_node = nsn; 3969 s->nat_src_node->states++; 3970 } 3971 if (pf_insert_state(BOUND_IFACE(r, kif), s)) { 3972 REASON_SET(&reason, PFRES_STATEINS); 3973 pf_src_tree_remove_state(s); 3974 STATE_DEC_COUNTERS(s); 3975 pool_put(&pf_state_pl, s); 3976 return (PF_DROP); 3977 } else 3978 *sm = s; 3979 if (tag > 0) { 3980 pf_tag_ref(tag); 3981 s->tag = tag; 3982 } 3983 } 3984 3985 return (PF_PASS); 3986 } 3987 3988 int 3989 pf_test_fragment(struct pf_rule **rm, int direction, struct pfi_kif *kif, 3990 struct mbuf *m, void *h, struct pf_pdesc *pd, struct pf_rule **am, 3991 struct pf_ruleset **rsm) 3992 { 3993 struct pf_rule *r, *a = NULL; 3994 struct pf_ruleset *ruleset = NULL; 3995 sa_family_t af = pd->af; 3996 u_short reason; 3997 struct pf_tag *pftag = NULL; 3998 int tag = -1; 3999 int asd = 0; 4000 4001 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 4002 while (r != NULL) { 4003 r->evaluations++; 4004 if (r->kif != NULL && 4005 (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot) 4006 r = r->skip[PF_SKIP_IFP].ptr; 4007 else if (r->direction && r->direction != direction) 4008 r = r->skip[PF_SKIP_DIR].ptr; 4009 else if (r->af && r->af != af) 4010 r = r->skip[PF_SKIP_AF].ptr; 4011 else if (r->proto && r->proto != pd->proto) 4012 r = r->skip[PF_SKIP_PROTO].ptr; 4013 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af, r->src.neg)) 4014 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 4015 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af, r->dst.neg)) 4016 r = r->skip[PF_SKIP_DST_ADDR].ptr; 4017 else if (r->tos && !(r->tos & pd->tos)) 4018 r = TAILQ_NEXT(r, entries); 4019 else if (r->src.port_op || r->dst.port_op || 4020 r->flagset || r->type || r->code || 4021 r->os_fingerprint != PF_OSFP_ANY) 4022 r = TAILQ_NEXT(r, entries); 4023 else if (r->prob && r->prob <= arc4random()) 4024 r = TAILQ_NEXT(r, entries); 4025 else if (r->match_tag && !pf_match_tag(m, r, &pftag, &tag)) 4026 r = TAILQ_NEXT(r, entries); 4027 else { 4028 if (r->anchor == NULL) { 4029 *rm = r; 4030 *am = a; 4031 *rsm = ruleset; 4032 if ((*rm)->quick) 4033 break; 4034 r = TAILQ_NEXT(r, entries); 4035 } else 4036 pf_step_into_anchor(&asd, &ruleset, 4037 PF_RULESET_FILTER, &r, &a); 4038 } 4039 if (r == NULL) 4040 pf_step_out_of_anchor(&asd, &ruleset, 4041 PF_RULESET_FILTER, &r, &a); 4042 } 4043 r = *rm; 4044 a = *am; 4045 ruleset = *rsm; 4046 4047 REASON_SET(&reason, PFRES_MATCH); 4048 4049 if (r->log) 4050 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset); 4051 4052 if (r->action != PF_PASS) 4053 return (PF_DROP); 4054 4055 if (pf_tag_packet(m, pftag, tag)) { 4056 REASON_SET(&reason, PFRES_MEMORY); 4057 return (PF_DROP); 4058 } 4059 4060 return (PF_PASS); 4061 } 4062 4063 int 4064 pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif, 4065 struct mbuf *m, int off, void *h, struct pf_pdesc *pd, 4066 u_short *reason) 4067 { 4068 struct pf_state key; 4069 struct tcphdr *th = pd->hdr.tcp; 4070 u_int16_t win = ntohs(th->th_win); 4071 u_int32_t ack, end, seq, orig_seq; 4072 u_int8_t sws, dws; 4073 int ackskew; 4074 int copyback = 0; 4075 struct pf_state_peer *src, *dst; 4076 4077 key.af = pd->af; 4078 key.proto = IPPROTO_TCP; 4079 if (direction == PF_IN) { 4080 PF_ACPY(&key.ext.addr, pd->src, key.af); 4081 PF_ACPY(&key.gwy.addr, pd->dst, key.af); 4082 key.ext.port = th->th_sport; 4083 key.gwy.port = th->th_dport; 4084 } else { 4085 PF_ACPY(&key.lan.addr, pd->src, key.af); 4086 PF_ACPY(&key.ext.addr, pd->dst, key.af); 4087 key.lan.port = th->th_sport; 4088 key.ext.port = th->th_dport; 4089 } 4090 4091 STATE_LOOKUP(); 4092 4093 if (direction == (*state)->direction) { 4094 src = &(*state)->src; 4095 dst = &(*state)->dst; 4096 } else { 4097 src = &(*state)->dst; 4098 dst = &(*state)->src; 4099 } 4100 4101 if ((*state)->src.state == PF_TCPS_PROXY_SRC) { 4102 if (direction != (*state)->direction) { 4103 REASON_SET(reason, PFRES_SYNPROXY); 4104 return (PF_SYNPROXY_DROP); 4105 } 4106 if (th->th_flags & TH_SYN) { 4107 if (ntohl(th->th_seq) != (*state)->src.seqlo) { 4108 REASON_SET(reason, PFRES_SYNPROXY); 4109 return (PF_DROP); 4110 } 4111 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst, 4112 pd->src, th->th_dport, th->th_sport, 4113 (*state)->src.seqhi, ntohl(th->th_seq) + 1, 4114 TH_SYN|TH_ACK, 0, (*state)->src.mss, 0, 1, 4115 NULL, NULL); 4116 REASON_SET(reason, PFRES_SYNPROXY); 4117 return (PF_SYNPROXY_DROP); 4118 } else if (!(th->th_flags & TH_ACK) || 4119 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) || 4120 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) { 4121 REASON_SET(reason, PFRES_SYNPROXY); 4122 return (PF_DROP); 4123 } else if ((*state)->src_node != NULL && 4124 pf_src_connlimit(state)) { 4125 REASON_SET(reason, PFRES_SRCLIMIT); 4126 return (PF_DROP); 4127 } else 4128 (*state)->src.state = PF_TCPS_PROXY_DST; 4129 } 4130 if ((*state)->src.state == PF_TCPS_PROXY_DST) { 4131 struct pf_state_host *src, *dst; 4132 4133 if (direction == PF_OUT) { 4134 src = &(*state)->gwy; 4135 dst = &(*state)->ext; 4136 } else { 4137 src = &(*state)->ext; 4138 dst = &(*state)->lan; 4139 } 4140 if (direction == (*state)->direction) { 4141 if (((th->th_flags & (TH_SYN|TH_ACK)) != TH_ACK) || 4142 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) || 4143 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) { 4144 REASON_SET(reason, PFRES_SYNPROXY); 4145 return (PF_DROP); 4146 } 4147 (*state)->src.max_win = MAX(ntohs(th->th_win), 1); 4148 if ((*state)->dst.seqhi == 1) 4149 (*state)->dst.seqhi = htonl(arc4random()); 4150 pf_send_tcp((*state)->rule.ptr, pd->af, &src->addr, 4151 &dst->addr, src->port, dst->port, 4152 (*state)->dst.seqhi, 0, TH_SYN, 0, 4153 (*state)->src.mss, 0, 0, NULL, NULL); 4154 REASON_SET(reason, PFRES_SYNPROXY); 4155 return (PF_SYNPROXY_DROP); 4156 } else if (((th->th_flags & (TH_SYN|TH_ACK)) != 4157 (TH_SYN|TH_ACK)) || 4158 (ntohl(th->th_ack) != (*state)->dst.seqhi + 1)) { 4159 REASON_SET(reason, PFRES_SYNPROXY); 4160 return (PF_DROP); 4161 } else { 4162 (*state)->dst.max_win = MAX(ntohs(th->th_win), 1); 4163 (*state)->dst.seqlo = ntohl(th->th_seq); 4164 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst, 4165 pd->src, th->th_dport, th->th_sport, 4166 ntohl(th->th_ack), ntohl(th->th_seq) + 1, 4167 TH_ACK, (*state)->src.max_win, 0, 0, 0, 4168 NULL, NULL); 4169 pf_send_tcp((*state)->rule.ptr, pd->af, &src->addr, 4170 &dst->addr, src->port, dst->port, 4171 (*state)->src.seqhi + 1, (*state)->src.seqlo + 1, 4172 TH_ACK, (*state)->dst.max_win, 0, 0, 1, 4173 NULL, NULL); 4174 (*state)->src.seqdiff = (*state)->dst.seqhi - 4175 (*state)->src.seqlo; 4176 (*state)->dst.seqdiff = (*state)->src.seqhi - 4177 (*state)->dst.seqlo; 4178 (*state)->src.seqhi = (*state)->src.seqlo + 4179 (*state)->src.max_win; 4180 (*state)->dst.seqhi = (*state)->dst.seqlo + 4181 (*state)->dst.max_win; 4182 (*state)->src.wscale = (*state)->dst.wscale = 0; 4183 (*state)->src.state = (*state)->dst.state = 4184 TCPS_ESTABLISHED; 4185 REASON_SET(reason, PFRES_SYNPROXY); 4186 return (PF_SYNPROXY_DROP); 4187 } 4188 } 4189 4190 if (src->wscale && dst->wscale && !(th->th_flags & TH_SYN)) { 4191 sws = src->wscale & PF_WSCALE_MASK; 4192 dws = dst->wscale & PF_WSCALE_MASK; 4193 } else 4194 sws = dws = 0; 4195 4196 /* 4197 * Sequence tracking algorithm from Guido van Rooij's paper: 4198 * http://www.madison-gurkha.com/publications/tcp_filtering/ 4199 * tcp_filtering.ps 4200 */ 4201 4202 orig_seq = seq = ntohl(th->th_seq); 4203 if (src->seqlo == 0) { 4204 /* First packet from this end. Set its state */ 4205 4206 if ((pd->flags & PFDESC_TCP_NORM || dst->scrub) && 4207 src->scrub == NULL) { 4208 if (pf_normalize_tcp_init(m, off, pd, th, src, dst)) { 4209 REASON_SET(reason, PFRES_MEMORY); 4210 return (PF_DROP); 4211 } 4212 } 4213 4214 /* Deferred generation of sequence number modulator */ 4215 if (dst->seqdiff && !src->seqdiff) { 4216 while ((src->seqdiff = htonl(arc4random())) == 0) 4217 ; 4218 ack = ntohl(th->th_ack) - dst->seqdiff; 4219 pf_change_a(&th->th_seq, &th->th_sum, htonl(seq + 4220 src->seqdiff), 0); 4221 pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0); 4222 copyback = 1; 4223 } else { 4224 ack = ntohl(th->th_ack); 4225 } 4226 4227 end = seq + pd->p_len; 4228 if (th->th_flags & TH_SYN) { 4229 end++; 4230 if (dst->wscale & PF_WSCALE_FLAG) { 4231 src->wscale = pf_get_wscale(m, off, th->th_off, 4232 pd->af); 4233 if (src->wscale & PF_WSCALE_FLAG) { 4234 /* Remove scale factor from initial 4235 * window */ 4236 sws = src->wscale & PF_WSCALE_MASK; 4237 win = ((u_int32_t)win + (1 << sws) - 1) 4238 >> sws; 4239 dws = dst->wscale & PF_WSCALE_MASK; 4240 } else { 4241 /* fixup other window */ 4242 dst->max_win <<= dst->wscale & 4243 PF_WSCALE_MASK; 4244 /* in case of a retrans SYN|ACK */ 4245 dst->wscale = 0; 4246 } 4247 } 4248 } 4249 if (th->th_flags & TH_FIN) 4250 end++; 4251 4252 src->seqlo = seq; 4253 if (src->state < TCPS_SYN_SENT) 4254 src->state = TCPS_SYN_SENT; 4255 4256 /* 4257 * May need to slide the window (seqhi may have been set by 4258 * the crappy stack check or if we picked up the connection 4259 * after establishment) 4260 */ 4261 if (src->seqhi == 1 || 4262 SEQ_GEQ(end + MAX(1, dst->max_win << dws), src->seqhi)) 4263 src->seqhi = end + MAX(1, dst->max_win << dws); 4264 if (win > src->max_win) 4265 src->max_win = win; 4266 4267 } else { 4268 ack = ntohl(th->th_ack) - dst->seqdiff; 4269 if (src->seqdiff) { 4270 /* Modulate sequence numbers */ 4271 pf_change_a(&th->th_seq, &th->th_sum, htonl(seq + 4272 src->seqdiff), 0); 4273 pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0); 4274 copyback = 1; 4275 } 4276 end = seq + pd->p_len; 4277 if (th->th_flags & TH_SYN) 4278 end++; 4279 if (th->th_flags & TH_FIN) 4280 end++; 4281 } 4282 4283 if ((th->th_flags & TH_ACK) == 0) { 4284 /* Let it pass through the ack skew check */ 4285 ack = dst->seqlo; 4286 } else if ((ack == 0 && 4287 (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) || 4288 /* broken tcp stacks do not set ack */ 4289 (dst->state < TCPS_SYN_SENT)) { 4290 /* 4291 * Many stacks (ours included) will set the ACK number in an 4292 * FIN|ACK if the SYN times out -- no sequence to ACK. 4293 */ 4294 ack = dst->seqlo; 4295 } 4296 4297 if (seq == end) { 4298 /* Ease sequencing restrictions on no data packets */ 4299 seq = src->seqlo; 4300 end = seq; 4301 } 4302 4303 ackskew = dst->seqlo - ack; 4304 4305 #define MAXACKWINDOW (0xffff + 1500) /* 1500 is an arbitrary fudge factor */ 4306 if (SEQ_GEQ(src->seqhi, end) && 4307 /* Last octet inside other's window space */ 4308 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) && 4309 /* Retrans: not more than one window back */ 4310 (ackskew >= -MAXACKWINDOW) && 4311 /* Acking not more than one reassembled fragment backwards */ 4312 (ackskew <= (MAXACKWINDOW << sws)) && 4313 /* Acking not more than one window forward */ 4314 ((th->th_flags & TH_RST) == 0 || orig_seq == src->seqlo || 4315 (pd->flags & PFDESC_IP_REAS) == 0)) { 4316 /* Require an exact sequence match on resets when possible */ 4317 4318 if (dst->scrub || src->scrub) { 4319 if (pf_normalize_tcp_stateful(m, off, pd, reason, th, 4320 *state, src, dst, ©back)) 4321 return (PF_DROP); 4322 } 4323 4324 /* update max window */ 4325 if (src->max_win < win) 4326 src->max_win = win; 4327 /* synchronize sequencing */ 4328 if (SEQ_GT(end, src->seqlo)) 4329 src->seqlo = end; 4330 /* slide the window of what the other end can send */ 4331 if (SEQ_GEQ(ack + (win << sws), dst->seqhi)) 4332 dst->seqhi = ack + MAX((win << sws), 1); 4333 4334 4335 /* update states */ 4336 if (th->th_flags & TH_SYN) 4337 if (src->state < TCPS_SYN_SENT) 4338 src->state = TCPS_SYN_SENT; 4339 if (th->th_flags & TH_FIN) 4340 if (src->state < TCPS_CLOSING) 4341 src->state = TCPS_CLOSING; 4342 if (th->th_flags & TH_ACK) { 4343 if (dst->state == TCPS_SYN_SENT) { 4344 dst->state = TCPS_ESTABLISHED; 4345 if (src->state == TCPS_ESTABLISHED && 4346 (*state)->src_node != NULL && 4347 pf_src_connlimit(state)) { 4348 REASON_SET(reason, PFRES_SRCLIMIT); 4349 return (PF_DROP); 4350 } 4351 } else if (dst->state == TCPS_CLOSING) 4352 dst->state = TCPS_FIN_WAIT_2; 4353 } 4354 if (th->th_flags & TH_RST) 4355 src->state = dst->state = TCPS_TIME_WAIT; 4356 4357 /* update expire time */ 4358 (*state)->expire = time_second; 4359 if (src->state >= TCPS_FIN_WAIT_2 && 4360 dst->state >= TCPS_FIN_WAIT_2) 4361 (*state)->timeout = PFTM_TCP_CLOSED; 4362 else if (src->state >= TCPS_FIN_WAIT_2 || 4363 dst->state >= TCPS_FIN_WAIT_2) 4364 (*state)->timeout = PFTM_TCP_FIN_WAIT; 4365 else if (src->state < TCPS_ESTABLISHED || 4366 dst->state < TCPS_ESTABLISHED) 4367 (*state)->timeout = PFTM_TCP_OPENING; 4368 else if (src->state >= TCPS_CLOSING || 4369 dst->state >= TCPS_CLOSING) 4370 (*state)->timeout = PFTM_TCP_CLOSING; 4371 else 4372 (*state)->timeout = PFTM_TCP_ESTABLISHED; 4373 4374 /* Fall through to PASS packet */ 4375 4376 } else if ((dst->state < TCPS_SYN_SENT || 4377 dst->state >= TCPS_FIN_WAIT_2 || 4378 src->state >= TCPS_FIN_WAIT_2) && 4379 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) && 4380 /* Within a window forward of the originating packet */ 4381 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW)) { 4382 /* Within a window backward of the originating packet */ 4383 4384 /* 4385 * This currently handles three situations: 4386 * 1) Stupid stacks will shotgun SYNs before their peer 4387 * replies. 4388 * 2) When PF catches an already established stream (the 4389 * firewall rebooted, the state table was flushed, routes 4390 * changed...) 4391 * 3) Packets get funky immediately after the connection 4392 * closes (this should catch Solaris spurious ACK|FINs 4393 * that web servers like to spew after a close) 4394 * 4395 * This must be a little more careful than the above code 4396 * since packet floods will also be caught here. We don't 4397 * update the TTL here to mitigate the damage of a packet 4398 * flood and so the same code can handle awkward establishment 4399 * and a loosened connection close. 4400 * In the establishment case, a correct peer response will 4401 * validate the connection, go through the normal state code 4402 * and keep updating the state TTL. 4403 */ 4404 4405 if (pf_status.debug >= PF_DEBUG_MISC) { 4406 printf("pf: loose state match: "); 4407 pf_print_state(*state); 4408 pf_print_flags(th->th_flags); 4409 printf(" seq=%u ack=%u len=%u ackskew=%d pkts=%d:%d\n", 4410 seq, ack, pd->p_len, ackskew, 4411 (*state)->packets[0], (*state)->packets[1]); 4412 } 4413 4414 if (dst->scrub || src->scrub) { 4415 if (pf_normalize_tcp_stateful(m, off, pd, reason, th, 4416 *state, src, dst, ©back)) 4417 return (PF_DROP); 4418 } 4419 4420 /* update max window */ 4421 if (src->max_win < win) 4422 src->max_win = win; 4423 /* synchronize sequencing */ 4424 if (SEQ_GT(end, src->seqlo)) 4425 src->seqlo = end; 4426 /* slide the window of what the other end can send */ 4427 if (SEQ_GEQ(ack + (win << sws), dst->seqhi)) 4428 dst->seqhi = ack + MAX((win << sws), 1); 4429 4430 /* 4431 * Cannot set dst->seqhi here since this could be a shotgunned 4432 * SYN and not an already established connection. 4433 */ 4434 4435 if (th->th_flags & TH_FIN) 4436 if (src->state < TCPS_CLOSING) 4437 src->state = TCPS_CLOSING; 4438 if (th->th_flags & TH_RST) 4439 src->state = dst->state = TCPS_TIME_WAIT; 4440 4441 /* Fall through to PASS packet */ 4442 4443 } else { 4444 if ((*state)->dst.state == TCPS_SYN_SENT && 4445 (*state)->src.state == TCPS_SYN_SENT) { 4446 /* Send RST for state mismatches during handshake */ 4447 if (!(th->th_flags & TH_RST)) 4448 pf_send_tcp((*state)->rule.ptr, pd->af, 4449 pd->dst, pd->src, th->th_dport, 4450 th->th_sport, ntohl(th->th_ack), 0, 4451 TH_RST, 0, 0, 4452 (*state)->rule.ptr->return_ttl, 1, 4453 pd->eh, kif->pfik_ifp); 4454 src->seqlo = 0; 4455 src->seqhi = 1; 4456 src->max_win = 1; 4457 } else if (pf_status.debug >= PF_DEBUG_MISC) { 4458 printf("pf: BAD state: "); 4459 pf_print_state(*state); 4460 pf_print_flags(th->th_flags); 4461 printf(" seq=%u ack=%u len=%u ackskew=%d pkts=%d:%d " 4462 "dir=%s,%s\n", seq, ack, pd->p_len, ackskew, 4463 (*state)->packets[0], (*state)->packets[1], 4464 direction == PF_IN ? "in" : "out", 4465 direction == (*state)->direction ? "fwd" : "rev"); 4466 printf("pf: State failure on: %c %c %c %c | %c %c\n", 4467 SEQ_GEQ(src->seqhi, end) ? ' ' : '1', 4468 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) ? 4469 ' ': '2', 4470 (ackskew >= -MAXACKWINDOW) ? ' ' : '3', 4471 (ackskew <= (MAXACKWINDOW << sws)) ? ' ' : '4', 4472 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) ?' ' :'5', 4473 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW) ?' ' :'6'); 4474 } 4475 REASON_SET(reason, PFRES_BADSTATE); 4476 return (PF_DROP); 4477 } 4478 4479 /* Any packets which have gotten here are to be passed */ 4480 4481 /* translate source/destination address, if necessary */ 4482 if (STATE_TRANSLATE(*state)) { 4483 if (direction == PF_OUT) 4484 pf_change_ap(pd->src, &th->th_sport, pd->ip_sum, 4485 &th->th_sum, &(*state)->gwy.addr, 4486 (*state)->gwy.port, 0, pd->af); 4487 else 4488 pf_change_ap(pd->dst, &th->th_dport, pd->ip_sum, 4489 &th->th_sum, &(*state)->lan.addr, 4490 (*state)->lan.port, 0, pd->af); 4491 m_copyback(m, off, sizeof(*th), th); 4492 } else if (copyback) { 4493 /* Copyback sequence modulation or stateful scrub changes */ 4494 m_copyback(m, off, sizeof(*th), th); 4495 } 4496 4497 return (PF_PASS); 4498 } 4499 4500 int 4501 pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif, 4502 struct mbuf *m, int off, void *h, struct pf_pdesc *pd) 4503 { 4504 struct pf_state_peer *src, *dst; 4505 struct pf_state key; 4506 struct udphdr *uh = pd->hdr.udp; 4507 4508 key.af = pd->af; 4509 key.proto = IPPROTO_UDP; 4510 if (direction == PF_IN) { 4511 PF_ACPY(&key.ext.addr, pd->src, key.af); 4512 PF_ACPY(&key.gwy.addr, pd->dst, key.af); 4513 key.ext.port = uh->uh_sport; 4514 key.gwy.port = uh->uh_dport; 4515 } else { 4516 PF_ACPY(&key.lan.addr, pd->src, key.af); 4517 PF_ACPY(&key.ext.addr, pd->dst, key.af); 4518 key.lan.port = uh->uh_sport; 4519 key.ext.port = uh->uh_dport; 4520 } 4521 4522 STATE_LOOKUP(); 4523 4524 if (direction == (*state)->direction) { 4525 src = &(*state)->src; 4526 dst = &(*state)->dst; 4527 } else { 4528 src = &(*state)->dst; 4529 dst = &(*state)->src; 4530 } 4531 4532 /* update states */ 4533 if (src->state < PFUDPS_SINGLE) 4534 src->state = PFUDPS_SINGLE; 4535 if (dst->state == PFUDPS_SINGLE) 4536 dst->state = PFUDPS_MULTIPLE; 4537 4538 /* update expire time */ 4539 (*state)->expire = time_second; 4540 if (src->state == PFUDPS_MULTIPLE && dst->state == PFUDPS_MULTIPLE) 4541 (*state)->timeout = PFTM_UDP_MULTIPLE; 4542 else 4543 (*state)->timeout = PFTM_UDP_SINGLE; 4544 4545 /* translate source/destination address, if necessary */ 4546 if (STATE_TRANSLATE(*state)) { 4547 if (direction == PF_OUT) 4548 pf_change_ap(pd->src, &uh->uh_sport, pd->ip_sum, 4549 &uh->uh_sum, &(*state)->gwy.addr, 4550 (*state)->gwy.port, 1, pd->af); 4551 else 4552 pf_change_ap(pd->dst, &uh->uh_dport, pd->ip_sum, 4553 &uh->uh_sum, &(*state)->lan.addr, 4554 (*state)->lan.port, 1, pd->af); 4555 m_copyback(m, off, sizeof(*uh), uh); 4556 } 4557 4558 return (PF_PASS); 4559 } 4560 4561 int 4562 pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif, 4563 struct mbuf *m, int off, void *h, struct pf_pdesc *pd, u_short *reason) 4564 { 4565 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 4566 u_int16_t icmpid = 0, *icmpsum; 4567 u_int8_t icmptype; 4568 int state_icmp = 0; 4569 4570 icmpsum = NULL; /* XXXGCC -Wunitialized m68k */ 4571 icmptype = 0; /* XXXGCC -Wunitialized m68k */ 4572 4573 switch (pd->proto) { 4574 #ifdef INET 4575 case IPPROTO_ICMP: 4576 icmptype = pd->hdr.icmp->icmp_type; 4577 icmpid = pd->hdr.icmp->icmp_id; 4578 icmpsum = &pd->hdr.icmp->icmp_cksum; 4579 4580 if (icmptype == ICMP_UNREACH || 4581 icmptype == ICMP_SOURCEQUENCH || 4582 icmptype == ICMP_REDIRECT || 4583 icmptype == ICMP_TIMXCEED || 4584 icmptype == ICMP_PARAMPROB) 4585 state_icmp++; 4586 break; 4587 #endif /* INET */ 4588 #ifdef INET6 4589 case IPPROTO_ICMPV6: 4590 icmptype = pd->hdr.icmp6->icmp6_type; 4591 icmpid = pd->hdr.icmp6->icmp6_id; 4592 icmpsum = &pd->hdr.icmp6->icmp6_cksum; 4593 4594 if (icmptype == ICMP6_DST_UNREACH || 4595 icmptype == ICMP6_PACKET_TOO_BIG || 4596 icmptype == ICMP6_TIME_EXCEEDED || 4597 icmptype == ICMP6_PARAM_PROB) 4598 state_icmp++; 4599 break; 4600 #endif /* INET6 */ 4601 } 4602 4603 if (!state_icmp) { 4604 4605 /* 4606 * ICMP query/reply message not related to a TCP/UDP packet. 4607 * Search for an ICMP state. 4608 */ 4609 struct pf_state key; 4610 4611 key.af = pd->af; 4612 key.proto = pd->proto; 4613 if (direction == PF_IN) { 4614 PF_ACPY(&key.ext.addr, pd->src, key.af); 4615 PF_ACPY(&key.gwy.addr, pd->dst, key.af); 4616 key.ext.port = icmpid; 4617 key.gwy.port = icmpid; 4618 } else { 4619 PF_ACPY(&key.lan.addr, pd->src, key.af); 4620 PF_ACPY(&key.ext.addr, pd->dst, key.af); 4621 key.lan.port = icmpid; 4622 key.ext.port = icmpid; 4623 } 4624 4625 STATE_LOOKUP(); 4626 4627 (*state)->expire = time_second; 4628 (*state)->timeout = PFTM_ICMP_ERROR_REPLY; 4629 4630 /* translate source/destination address, if necessary */ 4631 if (PF_ANEQ(&(*state)->lan.addr, &(*state)->gwy.addr, pd->af)) { 4632 if (direction == PF_OUT) { 4633 switch (pd->af) { 4634 #ifdef INET 4635 case AF_INET: 4636 pf_change_a(&saddr->v4.s_addr, 4637 pd->ip_sum, 4638 (*state)->gwy.addr.v4.s_addr, 0); 4639 break; 4640 #endif /* INET */ 4641 #ifdef INET6 4642 case AF_INET6: 4643 pf_change_a6(saddr, 4644 &pd->hdr.icmp6->icmp6_cksum, 4645 &(*state)->gwy.addr, 0); 4646 m_copyback(m, off, 4647 sizeof(struct icmp6_hdr), 4648 pd->hdr.icmp6); 4649 break; 4650 #endif /* INET6 */ 4651 } 4652 } else { 4653 switch (pd->af) { 4654 #ifdef INET 4655 case AF_INET: 4656 pf_change_a(&daddr->v4.s_addr, 4657 pd->ip_sum, 4658 (*state)->lan.addr.v4.s_addr, 0); 4659 break; 4660 #endif /* INET */ 4661 #ifdef INET6 4662 case AF_INET6: 4663 pf_change_a6(daddr, 4664 &pd->hdr.icmp6->icmp6_cksum, 4665 &(*state)->lan.addr, 0); 4666 m_copyback(m, off, 4667 sizeof(struct icmp6_hdr), 4668 pd->hdr.icmp6); 4669 break; 4670 #endif /* INET6 */ 4671 } 4672 } 4673 } 4674 4675 return (PF_PASS); 4676 4677 } else { 4678 /* 4679 * ICMP error message in response to a TCP/UDP packet. 4680 * Extract the inner TCP/UDP header and search for that state. 4681 */ 4682 4683 struct pf_pdesc pd2; 4684 #ifdef INET 4685 struct ip h2; 4686 #endif /* INET */ 4687 #ifdef INET6 4688 struct ip6_hdr h2_6; 4689 int terminal = 0; 4690 #endif /* INET6 */ 4691 int ipoff2 = 0; 4692 int off2 = 0; 4693 4694 memset(&pd2, 0, sizeof pd2); /* XXX gcc */ 4695 4696 pd2.af = pd->af; 4697 switch (pd->af) { 4698 #ifdef INET 4699 case AF_INET: 4700 /* offset of h2 in mbuf chain */ 4701 ipoff2 = off + ICMP_MINLEN; 4702 4703 if (!pf_pull_hdr(m, ipoff2, &h2, sizeof(h2), 4704 NULL, reason, pd2.af)) { 4705 DPFPRINTF(PF_DEBUG_MISC, 4706 ("pf: ICMP error message too short " 4707 "(ip)\n")); 4708 return (PF_DROP); 4709 } 4710 /* 4711 * ICMP error messages don't refer to non-first 4712 * fragments 4713 */ 4714 if (h2.ip_off & htons(IP_OFFMASK)) { 4715 REASON_SET(reason, PFRES_FRAG); 4716 return (PF_DROP); 4717 } 4718 4719 /* offset of protocol header that follows h2 */ 4720 off2 = ipoff2 + (h2.ip_hl << 2); 4721 4722 pd2.proto = h2.ip_p; 4723 pd2.src = (struct pf_addr *)&h2.ip_src; 4724 pd2.dst = (struct pf_addr *)&h2.ip_dst; 4725 pd2.ip_sum = &h2.ip_sum; 4726 break; 4727 #endif /* INET */ 4728 #ifdef INET6 4729 case AF_INET6: 4730 ipoff2 = off + sizeof(struct icmp6_hdr); 4731 4732 if (!pf_pull_hdr(m, ipoff2, &h2_6, sizeof(h2_6), 4733 NULL, reason, pd2.af)) { 4734 DPFPRINTF(PF_DEBUG_MISC, 4735 ("pf: ICMP error message too short " 4736 "(ip6)\n")); 4737 return (PF_DROP); 4738 } 4739 pd2.proto = h2_6.ip6_nxt; 4740 pd2.src = (struct pf_addr *)&h2_6.ip6_src; 4741 pd2.dst = (struct pf_addr *)&h2_6.ip6_dst; 4742 pd2.ip_sum = NULL; 4743 off2 = ipoff2 + sizeof(h2_6); 4744 do { 4745 switch (pd2.proto) { 4746 case IPPROTO_FRAGMENT: 4747 /* 4748 * ICMPv6 error messages for 4749 * non-first fragments 4750 */ 4751 REASON_SET(reason, PFRES_FRAG); 4752 return (PF_DROP); 4753 case IPPROTO_AH: 4754 case IPPROTO_HOPOPTS: 4755 case IPPROTO_ROUTING: 4756 case IPPROTO_DSTOPTS: { 4757 /* get next header and header length */ 4758 struct ip6_ext opt6; 4759 4760 if (!pf_pull_hdr(m, off2, &opt6, 4761 sizeof(opt6), NULL, reason, 4762 pd2.af)) { 4763 DPFPRINTF(PF_DEBUG_MISC, 4764 ("pf: ICMPv6 short opt\n")); 4765 return (PF_DROP); 4766 } 4767 if (pd2.proto == IPPROTO_AH) 4768 off2 += (opt6.ip6e_len + 2) * 4; 4769 else 4770 off2 += (opt6.ip6e_len + 1) * 8; 4771 pd2.proto = opt6.ip6e_nxt; 4772 /* goto the next header */ 4773 break; 4774 } 4775 default: 4776 terminal++; 4777 break; 4778 } 4779 } while (!terminal); 4780 break; 4781 #endif /* INET6 */ 4782 } 4783 4784 switch (pd2.proto) { 4785 case IPPROTO_TCP: { 4786 struct tcphdr th; 4787 u_int32_t seq; 4788 struct pf_state key; 4789 struct pf_state_peer *src, *dst; 4790 u_int8_t dws; 4791 int copyback = 0; 4792 4793 /* 4794 * Only the first 8 bytes of the TCP header can be 4795 * expected. Don't access any TCP header fields after 4796 * th_seq, an ackskew test is not possible. 4797 */ 4798 if (!pf_pull_hdr(m, off2, &th, 8, NULL, reason, 4799 pd2.af)) { 4800 DPFPRINTF(PF_DEBUG_MISC, 4801 ("pf: ICMP error message too short " 4802 "(tcp)\n")); 4803 return (PF_DROP); 4804 } 4805 4806 key.af = pd2.af; 4807 key.proto = IPPROTO_TCP; 4808 if (direction == PF_IN) { 4809 PF_ACPY(&key.ext.addr, pd2.dst, key.af); 4810 PF_ACPY(&key.gwy.addr, pd2.src, key.af); 4811 key.ext.port = th.th_dport; 4812 key.gwy.port = th.th_sport; 4813 } else { 4814 PF_ACPY(&key.lan.addr, pd2.dst, key.af); 4815 PF_ACPY(&key.ext.addr, pd2.src, key.af); 4816 key.lan.port = th.th_dport; 4817 key.ext.port = th.th_sport; 4818 } 4819 4820 STATE_LOOKUP(); 4821 4822 if (direction == (*state)->direction) { 4823 src = &(*state)->dst; 4824 dst = &(*state)->src; 4825 } else { 4826 src = &(*state)->src; 4827 dst = &(*state)->dst; 4828 } 4829 4830 if (src->wscale && dst->wscale && 4831 !(th.th_flags & TH_SYN)) 4832 dws = dst->wscale & PF_WSCALE_MASK; 4833 else 4834 dws = 0; 4835 4836 /* Demodulate sequence number */ 4837 seq = ntohl(th.th_seq) - src->seqdiff; 4838 if (src->seqdiff) { 4839 pf_change_a(&th.th_seq, icmpsum, 4840 htonl(seq), 0); 4841 copyback = 1; 4842 } 4843 4844 if (!SEQ_GEQ(src->seqhi, seq) || 4845 !SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws))) { 4846 if (pf_status.debug >= PF_DEBUG_MISC) { 4847 printf("pf: BAD ICMP %d:%d ", 4848 icmptype, pd->hdr.icmp->icmp_code); 4849 pf_print_host(pd->src, 0, pd->af); 4850 printf(" -> "); 4851 pf_print_host(pd->dst, 0, pd->af); 4852 printf(" state: "); 4853 pf_print_state(*state); 4854 printf(" seq=%u\n", seq); 4855 } 4856 REASON_SET(reason, PFRES_BADSTATE); 4857 return (PF_DROP); 4858 } 4859 4860 if (STATE_TRANSLATE(*state)) { 4861 if (direction == PF_IN) { 4862 pf_change_icmp(pd2.src, &th.th_sport, 4863 daddr, &(*state)->lan.addr, 4864 (*state)->lan.port, NULL, 4865 pd2.ip_sum, icmpsum, 4866 pd->ip_sum, 0, pd2.af); 4867 } else { 4868 pf_change_icmp(pd2.dst, &th.th_dport, 4869 saddr, &(*state)->gwy.addr, 4870 (*state)->gwy.port, NULL, 4871 pd2.ip_sum, icmpsum, 4872 pd->ip_sum, 0, pd2.af); 4873 } 4874 copyback = 1; 4875 } 4876 4877 if (copyback) { 4878 switch (pd2.af) { 4879 #ifdef INET 4880 case AF_INET: 4881 m_copyback(m, off, ICMP_MINLEN, 4882 pd->hdr.icmp); 4883 m_copyback(m, ipoff2, sizeof(h2), 4884 &h2); 4885 break; 4886 #endif /* INET */ 4887 #ifdef INET6 4888 case AF_INET6: 4889 m_copyback(m, off, 4890 sizeof(struct icmp6_hdr), 4891 pd->hdr.icmp6); 4892 m_copyback(m, ipoff2, sizeof(h2_6), 4893 &h2_6); 4894 break; 4895 #endif /* INET6 */ 4896 } 4897 m_copyback(m, off2, 8, &th); 4898 } 4899 4900 return (PF_PASS); 4901 break; 4902 } 4903 case IPPROTO_UDP: { 4904 struct udphdr uh; 4905 struct pf_state key; 4906 4907 if (!pf_pull_hdr(m, off2, &uh, sizeof(uh), 4908 NULL, reason, pd2.af)) { 4909 DPFPRINTF(PF_DEBUG_MISC, 4910 ("pf: ICMP error message too short " 4911 "(udp)\n")); 4912 return (PF_DROP); 4913 } 4914 4915 key.af = pd2.af; 4916 key.proto = IPPROTO_UDP; 4917 if (direction == PF_IN) { 4918 PF_ACPY(&key.ext.addr, pd2.dst, key.af); 4919 PF_ACPY(&key.gwy.addr, pd2.src, key.af); 4920 key.ext.port = uh.uh_dport; 4921 key.gwy.port = uh.uh_sport; 4922 } else { 4923 PF_ACPY(&key.lan.addr, pd2.dst, key.af); 4924 PF_ACPY(&key.ext.addr, pd2.src, key.af); 4925 key.lan.port = uh.uh_dport; 4926 key.ext.port = uh.uh_sport; 4927 } 4928 4929 STATE_LOOKUP(); 4930 4931 if (STATE_TRANSLATE(*state)) { 4932 if (direction == PF_IN) { 4933 pf_change_icmp(pd2.src, &uh.uh_sport, 4934 daddr, &(*state)->lan.addr, 4935 (*state)->lan.port, &uh.uh_sum, 4936 pd2.ip_sum, icmpsum, 4937 pd->ip_sum, 1, pd2.af); 4938 } else { 4939 pf_change_icmp(pd2.dst, &uh.uh_dport, 4940 saddr, &(*state)->gwy.addr, 4941 (*state)->gwy.port, &uh.uh_sum, 4942 pd2.ip_sum, icmpsum, 4943 pd->ip_sum, 1, pd2.af); 4944 } 4945 switch (pd2.af) { 4946 #ifdef INET 4947 case AF_INET: 4948 m_copyback(m, off, ICMP_MINLEN, 4949 pd->hdr.icmp); 4950 m_copyback(m, ipoff2, sizeof(h2), &h2); 4951 break; 4952 #endif /* INET */ 4953 #ifdef INET6 4954 case AF_INET6: 4955 m_copyback(m, off, 4956 sizeof(struct icmp6_hdr), 4957 pd->hdr.icmp6); 4958 m_copyback(m, ipoff2, sizeof(h2_6), 4959 &h2_6); 4960 break; 4961 #endif /* INET6 */ 4962 } 4963 m_copyback(m, off2, sizeof(uh), &uh); 4964 } 4965 4966 return (PF_PASS); 4967 break; 4968 } 4969 #ifdef INET 4970 case IPPROTO_ICMP: { 4971 struct icmp iih; 4972 struct pf_state key; 4973 4974 if (!pf_pull_hdr(m, off2, &iih, ICMP_MINLEN, 4975 NULL, reason, pd2.af)) { 4976 DPFPRINTF(PF_DEBUG_MISC, 4977 ("pf: ICMP error message too short i" 4978 "(icmp)\n")); 4979 return (PF_DROP); 4980 } 4981 4982 key.af = pd2.af; 4983 key.proto = IPPROTO_ICMP; 4984 if (direction == PF_IN) { 4985 PF_ACPY(&key.ext.addr, pd2.dst, key.af); 4986 PF_ACPY(&key.gwy.addr, pd2.src, key.af); 4987 key.ext.port = iih.icmp_id; 4988 key.gwy.port = iih.icmp_id; 4989 } else { 4990 PF_ACPY(&key.lan.addr, pd2.dst, key.af); 4991 PF_ACPY(&key.ext.addr, pd2.src, key.af); 4992 key.lan.port = iih.icmp_id; 4993 key.ext.port = iih.icmp_id; 4994 } 4995 4996 STATE_LOOKUP(); 4997 4998 if (STATE_TRANSLATE(*state)) { 4999 if (direction == PF_IN) { 5000 pf_change_icmp(pd2.src, &iih.icmp_id, 5001 daddr, &(*state)->lan.addr, 5002 (*state)->lan.port, NULL, 5003 pd2.ip_sum, icmpsum, 5004 pd->ip_sum, 0, AF_INET); 5005 } else { 5006 pf_change_icmp(pd2.dst, &iih.icmp_id, 5007 saddr, &(*state)->gwy.addr, 5008 (*state)->gwy.port, NULL, 5009 pd2.ip_sum, icmpsum, 5010 pd->ip_sum, 0, AF_INET); 5011 } 5012 m_copyback(m, off, ICMP_MINLEN, pd->hdr.icmp); 5013 m_copyback(m, ipoff2, sizeof(h2), &h2); 5014 m_copyback(m, off2, ICMP_MINLEN, &iih); 5015 } 5016 5017 return (PF_PASS); 5018 break; 5019 } 5020 #endif /* INET */ 5021 #ifdef INET6 5022 case IPPROTO_ICMPV6: { 5023 struct icmp6_hdr iih; 5024 struct pf_state key; 5025 5026 if (!pf_pull_hdr(m, off2, &iih, 5027 sizeof(struct icmp6_hdr), NULL, reason, pd2.af)) { 5028 DPFPRINTF(PF_DEBUG_MISC, 5029 ("pf: ICMP error message too short " 5030 "(icmp6)\n")); 5031 return (PF_DROP); 5032 } 5033 5034 key.af = pd2.af; 5035 key.proto = IPPROTO_ICMPV6; 5036 if (direction == PF_IN) { 5037 PF_ACPY(&key.ext.addr, pd2.dst, key.af); 5038 PF_ACPY(&key.gwy.addr, pd2.src, key.af); 5039 key.ext.port = iih.icmp6_id; 5040 key.gwy.port = iih.icmp6_id; 5041 } else { 5042 PF_ACPY(&key.lan.addr, pd2.dst, key.af); 5043 PF_ACPY(&key.ext.addr, pd2.src, key.af); 5044 key.lan.port = iih.icmp6_id; 5045 key.ext.port = iih.icmp6_id; 5046 } 5047 5048 STATE_LOOKUP(); 5049 5050 if (STATE_TRANSLATE(*state)) { 5051 if (direction == PF_IN) { 5052 pf_change_icmp(pd2.src, &iih.icmp6_id, 5053 daddr, &(*state)->lan.addr, 5054 (*state)->lan.port, NULL, 5055 pd2.ip_sum, icmpsum, 5056 pd->ip_sum, 0, AF_INET6); 5057 } else { 5058 pf_change_icmp(pd2.dst, &iih.icmp6_id, 5059 saddr, &(*state)->gwy.addr, 5060 (*state)->gwy.port, NULL, 5061 pd2.ip_sum, icmpsum, 5062 pd->ip_sum, 0, AF_INET6); 5063 } 5064 m_copyback(m, off, sizeof(struct icmp6_hdr), 5065 pd->hdr.icmp6); 5066 m_copyback(m, ipoff2, sizeof(h2_6), &h2_6); 5067 m_copyback(m, off2, sizeof(struct icmp6_hdr), 5068 &iih); 5069 } 5070 5071 return (PF_PASS); 5072 break; 5073 } 5074 #endif /* INET6 */ 5075 default: { 5076 struct pf_state key; 5077 5078 key.af = pd2.af; 5079 key.proto = pd2.proto; 5080 if (direction == PF_IN) { 5081 PF_ACPY(&key.ext.addr, pd2.dst, key.af); 5082 PF_ACPY(&key.gwy.addr, pd2.src, key.af); 5083 key.ext.port = 0; 5084 key.gwy.port = 0; 5085 } else { 5086 PF_ACPY(&key.lan.addr, pd2.dst, key.af); 5087 PF_ACPY(&key.ext.addr, pd2.src, key.af); 5088 key.lan.port = 0; 5089 key.ext.port = 0; 5090 } 5091 5092 STATE_LOOKUP(); 5093 5094 if (STATE_TRANSLATE(*state)) { 5095 if (direction == PF_IN) { 5096 pf_change_icmp(pd2.src, NULL, 5097 daddr, &(*state)->lan.addr, 5098 0, NULL, 5099 pd2.ip_sum, icmpsum, 5100 pd->ip_sum, 0, pd2.af); 5101 } else { 5102 pf_change_icmp(pd2.dst, NULL, 5103 saddr, &(*state)->gwy.addr, 5104 0, NULL, 5105 pd2.ip_sum, icmpsum, 5106 pd->ip_sum, 0, pd2.af); 5107 } 5108 switch (pd2.af) { 5109 #ifdef INET 5110 case AF_INET: 5111 m_copyback(m, off, ICMP_MINLEN, 5112 pd->hdr.icmp); 5113 m_copyback(m, ipoff2, sizeof(h2), &h2); 5114 break; 5115 #endif /* INET */ 5116 #ifdef INET6 5117 case AF_INET6: 5118 m_copyback(m, off, 5119 sizeof(struct icmp6_hdr), 5120 pd->hdr.icmp6); 5121 m_copyback(m, ipoff2, sizeof(h2_6), 5122 &h2_6); 5123 break; 5124 #endif /* INET6 */ 5125 } 5126 } 5127 5128 return (PF_PASS); 5129 break; 5130 } 5131 } 5132 } 5133 } 5134 5135 int 5136 pf_test_state_other(struct pf_state **state, int direction, struct pfi_kif *kif, 5137 struct pf_pdesc *pd) 5138 { 5139 struct pf_state_peer *src, *dst; 5140 struct pf_state key; 5141 5142 key.af = pd->af; 5143 key.proto = pd->proto; 5144 if (direction == PF_IN) { 5145 PF_ACPY(&key.ext.addr, pd->src, key.af); 5146 PF_ACPY(&key.gwy.addr, pd->dst, key.af); 5147 key.ext.port = 0; 5148 key.gwy.port = 0; 5149 } else { 5150 PF_ACPY(&key.lan.addr, pd->src, key.af); 5151 PF_ACPY(&key.ext.addr, pd->dst, key.af); 5152 key.lan.port = 0; 5153 key.ext.port = 0; 5154 } 5155 5156 STATE_LOOKUP(); 5157 5158 if (direction == (*state)->direction) { 5159 src = &(*state)->src; 5160 dst = &(*state)->dst; 5161 } else { 5162 src = &(*state)->dst; 5163 dst = &(*state)->src; 5164 } 5165 5166 /* update states */ 5167 if (src->state < PFOTHERS_SINGLE) 5168 src->state = PFOTHERS_SINGLE; 5169 if (dst->state == PFOTHERS_SINGLE) 5170 dst->state = PFOTHERS_MULTIPLE; 5171 5172 /* update expire time */ 5173 (*state)->expire = time_second; 5174 if (src->state == PFOTHERS_MULTIPLE && dst->state == PFOTHERS_MULTIPLE) 5175 (*state)->timeout = PFTM_OTHER_MULTIPLE; 5176 else 5177 (*state)->timeout = PFTM_OTHER_SINGLE; 5178 5179 /* translate source/destination address, if necessary */ 5180 if (STATE_TRANSLATE(*state)) { 5181 if (direction == PF_OUT) 5182 switch (pd->af) { 5183 #ifdef INET 5184 case AF_INET: 5185 pf_change_a(&pd->src->v4.s_addr, 5186 pd->ip_sum, (*state)->gwy.addr.v4.s_addr, 5187 0); 5188 break; 5189 #endif /* INET */ 5190 #ifdef INET6 5191 case AF_INET6: 5192 PF_ACPY(pd->src, &(*state)->gwy.addr, pd->af); 5193 break; 5194 #endif /* INET6 */ 5195 } 5196 else 5197 switch (pd->af) { 5198 #ifdef INET 5199 case AF_INET: 5200 pf_change_a(&pd->dst->v4.s_addr, 5201 pd->ip_sum, (*state)->lan.addr.v4.s_addr, 5202 0); 5203 break; 5204 #endif /* INET */ 5205 #ifdef INET6 5206 case AF_INET6: 5207 PF_ACPY(pd->dst, &(*state)->lan.addr, pd->af); 5208 break; 5209 #endif /* INET6 */ 5210 } 5211 } 5212 5213 return (PF_PASS); 5214 } 5215 5216 /* 5217 * ipoff and off are measured from the start of the mbuf chain. 5218 * h must be at "ipoff" on the mbuf chain. 5219 */ 5220 void * 5221 pf_pull_hdr(struct mbuf *m, int off, void *p, int len, 5222 u_short *actionp, u_short *reasonp, sa_family_t af) 5223 { 5224 switch (af) { 5225 #ifdef INET 5226 case AF_INET: { 5227 struct ip *h = mtod(m, struct ip *); 5228 u_int16_t fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3; 5229 5230 if (fragoff) { 5231 if (fragoff >= len) 5232 ACTION_SET(actionp, PF_PASS); 5233 else { 5234 ACTION_SET(actionp, PF_DROP); 5235 REASON_SET(reasonp, PFRES_FRAG); 5236 } 5237 return (NULL); 5238 } 5239 if (m->m_pkthdr.len < off + len || 5240 ntohs(h->ip_len) < off + len) { 5241 ACTION_SET(actionp, PF_DROP); 5242 REASON_SET(reasonp, PFRES_SHORT); 5243 return (NULL); 5244 } 5245 break; 5246 } 5247 #endif /* INET */ 5248 #ifdef INET6 5249 case AF_INET6: { 5250 struct ip6_hdr *h = mtod(m, struct ip6_hdr *); 5251 5252 if (m->m_pkthdr.len < off + len || 5253 (ntohs(h->ip6_plen) + sizeof(struct ip6_hdr)) < 5254 (unsigned)(off + len)) { 5255 ACTION_SET(actionp, PF_DROP); 5256 REASON_SET(reasonp, PFRES_SHORT); 5257 return (NULL); 5258 } 5259 break; 5260 } 5261 #endif /* INET6 */ 5262 } 5263 m_copydata(m, off, len, p); 5264 return (p); 5265 } 5266 5267 int 5268 pf_routable(struct pf_addr *addr, sa_family_t af) 5269 { 5270 struct sockaddr_in *dst; 5271 #ifdef INET6 5272 struct sockaddr_in6 *dst6; 5273 struct route_in6 ro; 5274 #else 5275 struct route ro; 5276 #endif 5277 5278 bzero(&ro, sizeof(ro)); 5279 switch (af) { 5280 case AF_INET: 5281 dst = satosin(&ro.ro_dst); 5282 dst->sin_family = AF_INET; 5283 dst->sin_len = sizeof(*dst); 5284 dst->sin_addr = addr->v4; 5285 break; 5286 #ifdef INET6 5287 case AF_INET6: 5288 dst6 = (struct sockaddr_in6 *)&ro.ro_dst; 5289 dst6->sin6_family = AF_INET6; 5290 dst6->sin6_len = sizeof(*dst6); 5291 dst6->sin6_addr = addr->v6; 5292 break; 5293 #endif /* INET6 */ 5294 default: 5295 return (0); 5296 } 5297 5298 #ifdef __OpenBSD__ 5299 rtalloc_noclone((struct route *)&ro, NO_CLONING); 5300 #else 5301 rtalloc((struct route *)&ro); 5302 #endif 5303 5304 if (ro.ro_rt != NULL) { 5305 RTFREE(ro.ro_rt); 5306 return (1); 5307 } 5308 5309 return (0); 5310 } 5311 5312 int 5313 pf_rtlabel_match(struct pf_addr *addr, sa_family_t af, struct pf_addr_wrap *aw) 5314 { 5315 struct sockaddr_in *dst; 5316 #ifdef INET6 5317 struct sockaddr_in6 *dst6; 5318 struct route_in6 ro; 5319 #else 5320 struct route ro; 5321 #endif 5322 int ret = 0; 5323 5324 bzero(&ro, sizeof(ro)); 5325 switch (af) { 5326 case AF_INET: 5327 dst = satosin(&ro.ro_dst); 5328 dst->sin_family = AF_INET; 5329 dst->sin_len = sizeof(*dst); 5330 dst->sin_addr = addr->v4; 5331 break; 5332 #ifdef INET6 5333 case AF_INET6: 5334 dst6 = (struct sockaddr_in6 *)&ro.ro_dst; 5335 dst6->sin6_family = AF_INET6; 5336 dst6->sin6_len = sizeof(*dst6); 5337 dst6->sin6_addr = addr->v6; 5338 break; 5339 #endif /* INET6 */ 5340 default: 5341 return (0); 5342 } 5343 5344 #ifdef __OpenBSD__ 5345 rtalloc_noclone((struct route *)&ro, NO_CLONING); 5346 #else 5347 rtalloc((struct route *)&ro); 5348 #endif 5349 5350 if (ro.ro_rt != NULL) { 5351 #ifdef __OpenBSD__ 5352 if (ro.ro_rt->rt_labelid == aw->v.rtlabel) 5353 ret = 1; 5354 #endif 5355 RTFREE(ro.ro_rt); 5356 } 5357 5358 return (ret); 5359 } 5360 5361 #ifdef INET 5362 void 5363 pf_route(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp, 5364 struct pf_state *s) 5365 { 5366 struct mbuf *m0, *m1; 5367 struct m_tag *mtag; 5368 struct route iproute; 5369 struct route *ro = NULL; 5370 struct sockaddr_in *dst; 5371 struct ip *ip; 5372 struct ifnet *ifp = NULL; 5373 struct pf_addr naddr; 5374 struct pf_src_node *sn = NULL; 5375 int error = 0; 5376 5377 if (m == NULL || *m == NULL || r == NULL || 5378 (dir != PF_IN && dir != PF_OUT) || oifp == NULL) 5379 panic("pf_route: invalid parameters"); 5380 5381 if ((mtag = m_tag_find(*m, PACKET_TAG_PF_ROUTED, NULL)) == NULL) { 5382 if ((mtag = m_tag_get(PACKET_TAG_PF_ROUTED, 1, M_NOWAIT)) == 5383 NULL) { 5384 m0 = *m; 5385 *m = NULL; 5386 goto bad; 5387 } 5388 *(char *)(mtag + 1) = 1; 5389 m_tag_prepend(*m, mtag); 5390 } else { 5391 if (*(char *)(mtag + 1) > 3) { 5392 m0 = *m; 5393 *m = NULL; 5394 goto bad; 5395 } 5396 (*(char *)(mtag + 1))++; 5397 } 5398 5399 if (r->rt == PF_DUPTO) { 5400 if ((m0 = m_copym2(*m, 0, M_COPYALL, M_NOWAIT)) == NULL) 5401 return; 5402 } else { 5403 if ((r->rt == PF_REPLYTO) == (r->direction == dir)) 5404 return; 5405 m0 = *m; 5406 } 5407 5408 if (m0->m_len < sizeof(struct ip)) { 5409 DPFPRINTF(PF_DEBUG_URGENT, 5410 ("pf_route: m0->m_len < sizeof(struct ip)\n")); 5411 goto bad; 5412 } 5413 5414 ip = mtod(m0, struct ip *); 5415 5416 ro = &iproute; 5417 bzero((caddr_t)ro, sizeof(*ro)); 5418 dst = satosin(&ro->ro_dst); 5419 dst->sin_family = AF_INET; 5420 dst->sin_len = sizeof(*dst); 5421 dst->sin_addr = ip->ip_dst; 5422 5423 if (r->rt == PF_FASTROUTE) { 5424 rtalloc(ro); 5425 if (ro->ro_rt == 0) { 5426 ipstat.ips_noroute++; 5427 goto bad; 5428 } 5429 5430 ifp = ro->ro_rt->rt_ifp; 5431 ro->ro_rt->rt_use++; 5432 5433 if (ro->ro_rt->rt_flags & RTF_GATEWAY) 5434 dst = satosin(ro->ro_rt->rt_gateway); 5435 } else { 5436 if (TAILQ_EMPTY(&r->rpool.list)) { 5437 DPFPRINTF(PF_DEBUG_URGENT, 5438 ("pf_route: TAILQ_EMPTY(&r->rpool.list)\n")); 5439 goto bad; 5440 } 5441 if (s == NULL) { 5442 pf_map_addr(AF_INET, r, (struct pf_addr *)&ip->ip_src, 5443 &naddr, NULL, &sn); 5444 if (!PF_AZERO(&naddr, AF_INET)) 5445 dst->sin_addr.s_addr = naddr.v4.s_addr; 5446 ifp = r->rpool.cur->kif ? 5447 r->rpool.cur->kif->pfik_ifp : NULL; 5448 } else { 5449 if (!PF_AZERO(&s->rt_addr, AF_INET)) 5450 dst->sin_addr.s_addr = 5451 s->rt_addr.v4.s_addr; 5452 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL; 5453 } 5454 } 5455 if (ifp == NULL) 5456 goto bad; 5457 5458 if (oifp != ifp) { 5459 if (pf_test(PF_OUT, ifp, &m0, NULL) != PF_PASS) 5460 goto bad; 5461 else if (m0 == NULL) 5462 goto done; 5463 if (m0->m_len < sizeof(struct ip)) { 5464 DPFPRINTF(PF_DEBUG_URGENT, 5465 ("pf_route: m0->m_len < sizeof(struct ip)\n")); 5466 goto bad; 5467 } 5468 ip = mtod(m0, struct ip *); 5469 } 5470 5471 /* Copied from ip_output. */ 5472 #ifdef IPSEC 5473 /* 5474 * If deferred crypto processing is needed, check that the 5475 * interface supports it. 5476 */ 5477 if ((mtag = m_tag_find(m0, PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED, NULL)) 5478 != NULL && (ifp->if_capabilities & IFCAP_IPSEC) == 0) { 5479 /* Notify IPsec to do its own crypto. */ 5480 ipsp_skipcrypto_unmark((struct tdb_ident *)(mtag + 1)); 5481 goto bad; 5482 } 5483 #endif /* IPSEC */ 5484 5485 /* Catch routing changes wrt. hardware checksumming for TCP or UDP. */ 5486 #ifdef __OpenBSD__ 5487 if (m0->m_pkthdr.csum & M_TCPV4_CSUM_OUT) { 5488 if (!(ifp->if_capabilities & IFCAP_CSUM_TCPv4) || 5489 ifp->if_bridge != NULL) { 5490 in_delayed_cksum(m0); 5491 m0->m_pkthdr.csum &= ~M_TCPV4_CSUM_OUT; /* Clear */ 5492 } 5493 } else if (m0->m_pkthdr.csum & M_UDPV4_CSUM_OUT) { 5494 if (!(ifp->if_capabilities & IFCAP_CSUM_UDPv4) || 5495 ifp->if_bridge != NULL) { 5496 in_delayed_cksum(m0); 5497 m0->m_pkthdr.csum &= ~M_UDPV4_CSUM_OUT; /* Clear */ 5498 } 5499 } 5500 #else 5501 if (m0->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 5502 in_delayed_cksum(m0); 5503 m0->m_pkthdr.csum_flags &= ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 5504 } 5505 #endif 5506 5507 if (ntohs(ip->ip_len) <= ifp->if_mtu) { 5508 #ifdef __OpenBSD__ 5509 if ((ifp->if_capabilities & IFCAP_CSUM_IPv4) && 5510 ifp->if_bridge == NULL) { 5511 m0->m_pkthdr.csum |= M_IPV4_CSUM_OUT; 5512 ipstat.ips_outhwcsum++; 5513 } else { 5514 ip->ip_sum = 0; 5515 ip->ip_sum = in_cksum(m0, ip->ip_hl << 2); 5516 } 5517 #else 5518 ip->ip_sum = 0; 5519 ip->ip_sum = in_cksum(m0, ip->ip_hl << 2); 5520 5521 m0->m_pkthdr.csum_flags &= ~M_CSUM_IPv4; 5522 #endif 5523 #ifdef __OpenBSD__ 5524 /* Update relevant hardware checksum stats for TCP/UDP */ 5525 if (m0->m_pkthdr.csum & M_TCPV4_CSUM_OUT) 5526 tcpstat.tcps_outhwcsum++; 5527 else if (m0->m_pkthdr.csum & M_UDPV4_CSUM_OUT) 5528 udpstat.udps_outhwcsum++; 5529 #endif 5530 error = (*ifp->if_output)(ifp, m0, sintosa(dst), NULL); 5531 goto done; 5532 } 5533 5534 /* 5535 * Too large for interface; fragment if possible. 5536 * Must be able to put at least 8 bytes per fragment. 5537 */ 5538 if (ip->ip_off & htons(IP_DF)) { 5539 ipstat.ips_cantfrag++; 5540 if (r->rt != PF_DUPTO) { 5541 icmp_error(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 0, 5542 ifp->if_mtu); 5543 goto done; 5544 } else 5545 goto bad; 5546 } 5547 5548 m1 = m0; 5549 error = ip_fragment(m0, ifp, ifp->if_mtu); 5550 if (error) { 5551 m0 = NULL; 5552 goto bad; 5553 } 5554 5555 for (m0 = m1; m0; m0 = m1) { 5556 m1 = m0->m_nextpkt; 5557 m0->m_nextpkt = 0; 5558 if (error == 0) 5559 error = (*ifp->if_output)(ifp, m0, sintosa(dst), 5560 NULL); 5561 else 5562 m_freem(m0); 5563 } 5564 5565 if (error == 0) 5566 ipstat.ips_fragmented++; 5567 5568 done: 5569 if (r->rt != PF_DUPTO) 5570 *m = NULL; 5571 if (ro == &iproute && ro->ro_rt) 5572 RTFREE(ro->ro_rt); 5573 return; 5574 5575 bad: 5576 m_freem(m0); 5577 goto done; 5578 } 5579 #endif /* INET */ 5580 5581 #ifdef INET6 5582 void 5583 pf_route6(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp, 5584 struct pf_state *s) 5585 { 5586 struct mbuf *m0; 5587 struct m_tag *mtag; 5588 struct route_in6 ip6route; 5589 struct route_in6 *ro; 5590 struct sockaddr_in6 *dst; 5591 struct ip6_hdr *ip6; 5592 struct ifnet *ifp = NULL; 5593 struct pf_addr naddr; 5594 struct pf_src_node *sn = NULL; 5595 int error = 0; 5596 5597 if (m == NULL || *m == NULL || r == NULL || 5598 (dir != PF_IN && dir != PF_OUT) || oifp == NULL) 5599 panic("pf_route6: invalid parameters"); 5600 5601 if ((mtag = m_tag_find(*m, PACKET_TAG_PF_ROUTED, NULL)) == NULL) { 5602 if ((mtag = m_tag_get(PACKET_TAG_PF_ROUTED, 1, M_NOWAIT)) == 5603 NULL) { 5604 m0 = *m; 5605 *m = NULL; 5606 goto bad; 5607 } 5608 *(char *)(mtag + 1) = 1; 5609 m_tag_prepend(*m, mtag); 5610 } else { 5611 if (*(char *)(mtag + 1) > 3) { 5612 m0 = *m; 5613 *m = NULL; 5614 goto bad; 5615 } 5616 (*(char *)(mtag + 1))++; 5617 } 5618 5619 if (r->rt == PF_DUPTO) { 5620 if ((m0 = m_copym2(*m, 0, M_COPYALL, M_NOWAIT)) == NULL) 5621 return; 5622 } else { 5623 if ((r->rt == PF_REPLYTO) == (r->direction == dir)) 5624 return; 5625 m0 = *m; 5626 } 5627 5628 if (m0->m_len < sizeof(struct ip6_hdr)) { 5629 DPFPRINTF(PF_DEBUG_URGENT, 5630 ("pf_route6: m0->m_len < sizeof(struct ip6_hdr)\n")); 5631 goto bad; 5632 } 5633 ip6 = mtod(m0, struct ip6_hdr *); 5634 5635 ro = &ip6route; 5636 bzero((caddr_t)ro, sizeof(*ro)); 5637 dst = (struct sockaddr_in6 *)&ro->ro_dst; 5638 dst->sin6_family = AF_INET6; 5639 dst->sin6_len = sizeof(*dst); 5640 dst->sin6_addr = ip6->ip6_dst; 5641 5642 /* Cheat. */ 5643 if (r->rt == PF_FASTROUTE) { 5644 mtag = m_tag_get(PACKET_TAG_PF_GENERATED, 0, M_NOWAIT); 5645 if (mtag == NULL) 5646 goto bad; 5647 m_tag_prepend(m0, mtag); 5648 #ifdef __OpenBSD__ 5649 ip6_output(m0, NULL, NULL, 0, NULL, NULL); 5650 #else 5651 ip6_output(m0, NULL, NULL, 0, NULL, NULL, NULL); 5652 #endif 5653 return; 5654 } 5655 5656 if (TAILQ_EMPTY(&r->rpool.list)) { 5657 DPFPRINTF(PF_DEBUG_URGENT, 5658 ("pf_route6: TAILQ_EMPTY(&r->rpool.list)\n")); 5659 goto bad; 5660 } 5661 if (s == NULL) { 5662 pf_map_addr(AF_INET6, r, (struct pf_addr *)&ip6->ip6_src, 5663 &naddr, NULL, &sn); 5664 if (!PF_AZERO(&naddr, AF_INET6)) 5665 PF_ACPY((struct pf_addr *)&dst->sin6_addr, 5666 &naddr, AF_INET6); 5667 ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL; 5668 } else { 5669 if (!PF_AZERO(&s->rt_addr, AF_INET6)) 5670 PF_ACPY((struct pf_addr *)&dst->sin6_addr, 5671 &s->rt_addr, AF_INET6); 5672 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL; 5673 } 5674 if (ifp == NULL) 5675 goto bad; 5676 5677 if (oifp != ifp) { 5678 if (pf_test6(PF_OUT, ifp, &m0, NULL) != PF_PASS) 5679 goto bad; 5680 else if (m0 == NULL) 5681 goto done; 5682 if (m0->m_len < sizeof(struct ip6_hdr)) { 5683 DPFPRINTF(PF_DEBUG_URGENT, 5684 ("pf_route6: m0->m_len < sizeof(struct ip6_hdr)\n")); 5685 goto bad; 5686 } 5687 ip6 = mtod(m0, struct ip6_hdr *); 5688 } 5689 5690 /* 5691 * If the packet is too large for the outgoing interface, 5692 * send back an icmp6 error. 5693 */ 5694 if (IN6_IS_ADDR_LINKLOCAL(&dst->sin6_addr)) 5695 dst->sin6_addr.s6_addr16[1] = htons(ifp->if_index); 5696 if ((u_long)m0->m_pkthdr.len <= ifp->if_mtu) { 5697 error = nd6_output(ifp, ifp, m0, dst, NULL); 5698 } else { 5699 in6_ifstat_inc(ifp, ifs6_in_toobig); 5700 if (r->rt != PF_DUPTO) 5701 icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu); 5702 else 5703 goto bad; 5704 } 5705 5706 done: 5707 if (r->rt != PF_DUPTO) 5708 *m = NULL; 5709 return; 5710 5711 bad: 5712 m_freem(m0); 5713 goto done; 5714 } 5715 #endif /* INET6 */ 5716 5717 5718 /* 5719 * check protocol (tcp/udp/icmp/icmp6) checksum and set mbuf flag 5720 * off is the offset where the protocol header starts 5721 * len is the total length of protocol header plus payload 5722 * returns 0 when the checksum is valid, otherwise returns 1. 5723 */ 5724 int 5725 pf_check_proto_cksum(struct mbuf *m, int off, int len, u_int8_t p, 5726 sa_family_t af) 5727 { 5728 #ifdef __OpenBSD__ 5729 u_int16_t flag_ok, flag_bad; 5730 #endif 5731 u_int16_t sum; 5732 5733 #ifdef __OpenBSD__ 5734 switch (p) { 5735 case IPPROTO_TCP: 5736 flag_ok = M_TCP_CSUM_IN_OK; 5737 flag_bad = M_TCP_CSUM_IN_BAD; 5738 break; 5739 case IPPROTO_UDP: 5740 flag_ok = M_UDP_CSUM_IN_OK; 5741 flag_bad = M_UDP_CSUM_IN_BAD; 5742 break; 5743 case IPPROTO_ICMP: 5744 #ifdef INET6 5745 case IPPROTO_ICMPV6: 5746 #endif /* INET6 */ 5747 flag_ok = flag_bad = 0; 5748 break; 5749 default: 5750 return (1); 5751 } 5752 if (m->m_pkthdr.csum & flag_ok) 5753 return (0); 5754 if (m->m_pkthdr.csum & flag_bad) 5755 return (1); 5756 #endif 5757 if (off < sizeof(struct ip) || len < sizeof(struct udphdr)) 5758 return (1); 5759 if (m->m_pkthdr.len < off + len) 5760 return (1); 5761 #ifdef __NetBSD__ 5762 switch (p) { 5763 case IPPROTO_TCP: { 5764 struct tcphdr th; /* XXX */ 5765 int thlen; 5766 5767 m_copydata(m, off, sizeof(th), &th); /* XXX */ 5768 thlen = th.th_off << 2; 5769 return tcp_input_checksum(af, m, &th, off, 5770 thlen, len - thlen) != 0; 5771 } 5772 5773 case IPPROTO_UDP: { 5774 struct udphdr uh; /* XXX */ 5775 5776 m_copydata(m, off, sizeof(uh), &uh); /* XXX */ 5777 return udp_input_checksum(af, m, &uh, off, len) != 0; 5778 } 5779 break; 5780 } 5781 #endif /* __NetBSD__ */ 5782 switch (af) { 5783 #ifdef INET 5784 case AF_INET: 5785 if (p == IPPROTO_ICMP) { 5786 if (m->m_len < off) 5787 return (1); 5788 m->m_data += off; 5789 m->m_len -= off; 5790 sum = in_cksum(m, len); 5791 m->m_data -= off; 5792 m->m_len += off; 5793 } else { 5794 if (m->m_len < sizeof(struct ip)) 5795 return (1); 5796 sum = in4_cksum(m, p, off, len); 5797 } 5798 break; 5799 #endif /* INET */ 5800 #ifdef INET6 5801 case AF_INET6: 5802 if (m->m_len < sizeof(struct ip6_hdr)) 5803 return (1); 5804 sum = in6_cksum(m, p, off, len); 5805 break; 5806 #endif /* INET6 */ 5807 default: 5808 return (1); 5809 } 5810 if (sum) { 5811 #ifdef __OpenBSD__ 5812 m->m_pkthdr.csum |= flag_bad; 5813 #endif 5814 switch (p) { 5815 case IPPROTO_TCP: 5816 tcpstat.tcps_rcvbadsum++; 5817 break; 5818 case IPPROTO_UDP: 5819 udpstat.udps_badsum++; 5820 break; 5821 case IPPROTO_ICMP: 5822 icmpstat.icps_checksum++; 5823 break; 5824 #ifdef INET6 5825 case IPPROTO_ICMPV6: 5826 icmp6stat.icp6s_checksum++; 5827 break; 5828 #endif /* INET6 */ 5829 } 5830 return (1); 5831 } 5832 #ifdef __OpenBSD__ 5833 m->m_pkthdr.csum |= flag_ok; 5834 #endif 5835 return (0); 5836 } 5837 5838 static int 5839 pf_add_mbuf_tag(struct mbuf *m, u_int tag) 5840 { 5841 struct m_tag *mtag; 5842 5843 if (m_tag_find(m, tag, NULL) != NULL) 5844 return (0); 5845 mtag = m_tag_get(tag, 0, M_NOWAIT); 5846 if (mtag == NULL) 5847 return (1); 5848 m_tag_prepend(m, mtag); 5849 return (0); 5850 } 5851 5852 #ifdef INET 5853 int 5854 pf_test(int dir, struct ifnet *ifp, struct mbuf **m0, 5855 struct ether_header *eh) 5856 { 5857 struct pfi_kif *kif; 5858 u_short action, reason = 0, log = 0; 5859 struct mbuf *m = *m0; 5860 struct ip *h = NULL; 5861 struct pf_rule *a = NULL, *r = &pf_default_rule, *tr, *nr; 5862 struct pf_state *s = NULL; 5863 struct pf_ruleset *ruleset = NULL; 5864 struct pf_pdesc pd; 5865 int off, dirndx, pqid = 0; 5866 5867 if (!pf_status.running || 5868 (m_tag_find(m, PACKET_TAG_PF_GENERATED, NULL) != NULL)) 5869 return (PF_PASS); 5870 5871 #if NCARP > 0 5872 if (ifp->if_type == IFT_CARP && ifp->if_carpdev) 5873 ifp = ifp->if_carpdev; 5874 #endif 5875 5876 kif = pfi_index2kif[ifp->if_index]; 5877 if (kif == NULL) { 5878 DPFPRINTF(PF_DEBUG_URGENT, 5879 ("pf_test: kif == NULL, if_xname %s\n", ifp->if_xname)); 5880 return (PF_DROP); 5881 } 5882 if (kif->pfik_flags & PFI_IFLAG_SKIP) 5883 return (PF_PASS); 5884 5885 #ifdef DIAGNOSTIC 5886 if ((m->m_flags & M_PKTHDR) == 0) 5887 panic("non-M_PKTHDR is passed to pf_test"); 5888 #endif /* DIAGNOSTIC */ 5889 5890 memset(&pd, 0, sizeof(pd)); 5891 if (m->m_pkthdr.len < (int)sizeof(*h)) { 5892 action = PF_DROP; 5893 REASON_SET(&reason, PFRES_SHORT); 5894 log = 1; 5895 goto done; 5896 } 5897 5898 /* We do IP header normalization and packet reassembly here */ 5899 if (pf_normalize_ip(m0, dir, kif, &reason, &pd) != PF_PASS) { 5900 action = PF_DROP; 5901 goto done; 5902 } 5903 m = *m0; 5904 h = mtod(m, struct ip *); 5905 5906 off = h->ip_hl << 2; 5907 if (off < (int)sizeof(*h)) { 5908 action = PF_DROP; 5909 REASON_SET(&reason, PFRES_SHORT); 5910 log = 1; 5911 goto done; 5912 } 5913 5914 pd.src = (struct pf_addr *)&h->ip_src; 5915 pd.dst = (struct pf_addr *)&h->ip_dst; 5916 PF_ACPY(&pd.baddr, dir == PF_OUT ? pd.src : pd.dst, AF_INET); 5917 pd.ip_sum = &h->ip_sum; 5918 pd.proto = h->ip_p; 5919 pd.af = AF_INET; 5920 pd.tos = h->ip_tos; 5921 pd.tot_len = ntohs(h->ip_len); 5922 pd.eh = eh; 5923 5924 /* handle fragments that didn't get reassembled by normalization */ 5925 if (h->ip_off & htons(IP_MF | IP_OFFMASK)) { 5926 action = pf_test_fragment(&r, dir, kif, m, h, 5927 &pd, &a, &ruleset); 5928 goto done; 5929 } 5930 5931 switch (h->ip_p) { 5932 5933 case IPPROTO_TCP: { 5934 struct tcphdr th; 5935 5936 pd.hdr.tcp = &th; 5937 if (!pf_pull_hdr(m, off, &th, sizeof(th), 5938 &action, &reason, AF_INET)) { 5939 log = action != PF_PASS; 5940 goto done; 5941 } 5942 if (dir == PF_IN && pf_check_proto_cksum(m, off, 5943 ntohs(h->ip_len) - off, IPPROTO_TCP, AF_INET)) { 5944 action = PF_DROP; 5945 goto done; 5946 } 5947 pd.p_len = pd.tot_len - off - (th.th_off << 2); 5948 if ((th.th_flags & TH_ACK) && pd.p_len == 0) 5949 pqid = 1; 5950 action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd); 5951 if (action == PF_DROP) 5952 goto done; 5953 action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd, 5954 &reason); 5955 if (action == PF_PASS) { 5956 #if NPFSYNC 5957 pfsync_update_state(s); 5958 #endif /* NPFSYNC */ 5959 r = s->rule.ptr; 5960 a = s->anchor.ptr; 5961 log = s->log; 5962 } else if (s == NULL) 5963 action = pf_test_tcp(&r, &s, dir, kif, 5964 m, off, h, &pd, &a, &ruleset, &ipintrq); 5965 break; 5966 } 5967 5968 case IPPROTO_UDP: { 5969 struct udphdr uh; 5970 5971 pd.hdr.udp = &uh; 5972 if (!pf_pull_hdr(m, off, &uh, sizeof(uh), 5973 &action, &reason, AF_INET)) { 5974 log = action != PF_PASS; 5975 goto done; 5976 } 5977 if (dir == PF_IN && uh.uh_sum && pf_check_proto_cksum(m, 5978 off, ntohs(h->ip_len) - off, IPPROTO_UDP, AF_INET)) { 5979 action = PF_DROP; 5980 goto done; 5981 } 5982 if (uh.uh_dport == 0 || 5983 ntohs(uh.uh_ulen) > m->m_pkthdr.len - off || 5984 ntohs(uh.uh_ulen) < sizeof(struct udphdr)) { 5985 action = PF_DROP; 5986 goto done; 5987 } 5988 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd); 5989 if (action == PF_PASS) { 5990 #if NPFSYNC 5991 pfsync_update_state(s); 5992 #endif /* NPFSYNC */ 5993 r = s->rule.ptr; 5994 a = s->anchor.ptr; 5995 log = s->log; 5996 } else if (s == NULL) 5997 action = pf_test_udp(&r, &s, dir, kif, 5998 m, off, h, &pd, &a, &ruleset, &ipintrq); 5999 break; 6000 } 6001 6002 case IPPROTO_ICMP: { 6003 struct icmp ih; 6004 6005 pd.hdr.icmp = &ih; 6006 if (!pf_pull_hdr(m, off, &ih, ICMP_MINLEN, 6007 &action, &reason, AF_INET)) { 6008 log = action != PF_PASS; 6009 goto done; 6010 } 6011 if (dir == PF_IN && pf_check_proto_cksum(m, off, 6012 ntohs(h->ip_len) - off, IPPROTO_ICMP, AF_INET)) { 6013 action = PF_DROP; 6014 goto done; 6015 } 6016 action = pf_test_state_icmp(&s, dir, kif, m, off, h, &pd, 6017 &reason); 6018 if (action == PF_PASS) { 6019 #if NPFSYNC 6020 pfsync_update_state(s); 6021 #endif /* NPFSYNC */ 6022 r = s->rule.ptr; 6023 a = s->anchor.ptr; 6024 log = s->log; 6025 } else if (s == NULL) 6026 action = pf_test_icmp(&r, &s, dir, kif, 6027 m, off, h, &pd, &a, &ruleset, &ipintrq); 6028 break; 6029 } 6030 6031 default: 6032 action = pf_test_state_other(&s, dir, kif, &pd); 6033 if (action == PF_PASS) { 6034 #if NPFSYNC 6035 pfsync_update_state(s); 6036 #endif /* NPFSYNC */ 6037 r = s->rule.ptr; 6038 a = s->anchor.ptr; 6039 log = s->log; 6040 } else if (s == NULL) 6041 action = pf_test_other(&r, &s, dir, kif, m, off, h, 6042 &pd, &a, &ruleset, &ipintrq); 6043 break; 6044 } 6045 6046 done: 6047 if (action == PF_PASS && h->ip_hl > 5 && 6048 !((s && s->allow_opts) || r->allow_opts)) { 6049 action = PF_DROP; 6050 REASON_SET(&reason, PFRES_IPOPTIONS); 6051 log = 1; 6052 DPFPRINTF(PF_DEBUG_MISC, 6053 ("pf: dropping packet with ip options\n")); 6054 } 6055 6056 if (s && s->tag) 6057 pf_tag_packet(m, pf_get_tag(m), s->tag); 6058 6059 #ifdef ALTQ 6060 if (action == PF_PASS && r->qid) { 6061 struct m_tag *mtag; 6062 struct altq_tag *atag; 6063 6064 mtag = m_tag_get(PACKET_TAG_PF_QID, sizeof(*atag), M_NOWAIT); 6065 if (mtag != NULL) { 6066 atag = (struct altq_tag *)(mtag + 1); 6067 if (pqid || pd.tos == IPTOS_LOWDELAY) 6068 atag->qid = r->pqid; 6069 else 6070 atag->qid = r->qid; 6071 /* add hints for ecn */ 6072 atag->af = AF_INET; 6073 atag->hdr = h; 6074 m_tag_prepend(m, mtag); 6075 } 6076 } 6077 #endif /* ALTQ */ 6078 6079 /* 6080 * connections redirected to loopback should not match sockets 6081 * bound specifically to loopback due to security implications, 6082 * see tcp_input() and in_pcblookup_listen(). 6083 */ 6084 if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP || 6085 pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL && 6086 (s->nat_rule.ptr->action == PF_RDR || 6087 s->nat_rule.ptr->action == PF_BINAT) && 6088 (ntohl(pd.dst->v4.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET && 6089 pf_add_mbuf_tag(m, PACKET_TAG_PF_TRANSLATE_LOCALHOST)) { 6090 action = PF_DROP; 6091 REASON_SET(&reason, PFRES_MEMORY); 6092 } 6093 6094 if (log) 6095 PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, r, a, ruleset); 6096 6097 kif->pfik_bytes[0][dir == PF_OUT][action != PF_PASS] += pd.tot_len; 6098 kif->pfik_packets[0][dir == PF_OUT][action != PF_PASS]++; 6099 6100 if (action == PF_PASS || r->action == PF_DROP) { 6101 r->packets++; 6102 r->bytes += pd.tot_len; 6103 if (a != NULL) { 6104 a->packets++; 6105 a->bytes += pd.tot_len; 6106 } 6107 if (s != NULL) { 6108 dirndx = (dir == s->direction) ? 0 : 1; 6109 s->packets[dirndx]++; 6110 s->bytes[dirndx] += pd.tot_len; 6111 if (s->nat_rule.ptr != NULL) { 6112 s->nat_rule.ptr->packets++; 6113 s->nat_rule.ptr->bytes += pd.tot_len; 6114 } 6115 if (s->src_node != NULL) { 6116 s->src_node->packets++; 6117 s->src_node->bytes += pd.tot_len; 6118 } 6119 if (s->nat_src_node != NULL) { 6120 s->nat_src_node->packets++; 6121 s->nat_src_node->bytes += pd.tot_len; 6122 } 6123 } 6124 tr = r; 6125 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule; 6126 if (nr != NULL) { 6127 struct pf_addr *x; 6128 /* 6129 * XXX: we need to make sure that the addresses 6130 * passed to pfr_update_stats() are the same than 6131 * the addresses used during matching (pfr_match) 6132 */ 6133 if (r == &pf_default_rule) { 6134 tr = nr; 6135 x = (s == NULL || s->direction == dir) ? 6136 &pd.baddr : &pd.naddr; 6137 } else 6138 x = (s == NULL || s->direction == dir) ? 6139 &pd.naddr : &pd.baddr; 6140 if (x == &pd.baddr || s == NULL) { 6141 /* we need to change the address */ 6142 if (dir == PF_OUT) 6143 pd.src = x; 6144 else 6145 pd.dst = x; 6146 } 6147 } 6148 if (tr->src.addr.type == PF_ADDR_TABLE) 6149 pfr_update_stats(tr->src.addr.p.tbl, (s == NULL || 6150 s->direction == dir) ? pd.src : pd.dst, pd.af, 6151 pd.tot_len, dir == PF_OUT, r->action == PF_PASS, 6152 tr->src.neg); 6153 if (tr->dst.addr.type == PF_ADDR_TABLE) 6154 pfr_update_stats(tr->dst.addr.p.tbl, (s == NULL || 6155 s->direction == dir) ? pd.dst : pd.src, pd.af, 6156 pd.tot_len, dir == PF_OUT, r->action == PF_PASS, 6157 tr->dst.neg); 6158 } 6159 6160 6161 if (action == PF_SYNPROXY_DROP) { 6162 m_freem(*m0); 6163 *m0 = NULL; 6164 action = PF_PASS; 6165 } else if (r->rt) 6166 /* pf_route can free the mbuf causing *m0 to become NULL */ 6167 pf_route(m0, r, dir, ifp, s); 6168 6169 return (action); 6170 } 6171 #endif /* INET */ 6172 6173 #ifdef INET6 6174 int 6175 pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0, 6176 struct ether_header *eh) 6177 { 6178 struct pfi_kif *kif; 6179 u_short action, reason = 0, log = 0; 6180 struct mbuf *m = *m0; 6181 struct ip6_hdr *h; 6182 struct pf_rule *a = NULL, *r = &pf_default_rule, *tr, *nr; 6183 struct pf_state *s = NULL; 6184 struct pf_ruleset *ruleset = NULL; 6185 struct pf_pdesc pd; 6186 int off, terminal = 0, dirndx; 6187 6188 if (!pf_status.running || 6189 (m_tag_find(m, PACKET_TAG_PF_GENERATED, NULL) != NULL)) 6190 return (PF_PASS); 6191 6192 #if NCARP > 0 6193 if (ifp->if_type == IFT_CARP && ifp->if_carpdev) 6194 ifp = ifp->if_carpdev; 6195 #endif 6196 6197 kif = pfi_index2kif[ifp->if_index]; 6198 if (kif == NULL) { 6199 DPFPRINTF(PF_DEBUG_URGENT, 6200 ("pf_test6: kif == NULL, if_xname %s\n", ifp->if_xname)); 6201 return (PF_DROP); 6202 } 6203 if (kif->pfik_flags & PFI_IFLAG_SKIP) 6204 return (PF_PASS); 6205 6206 #ifdef DIAGNOSTIC 6207 if ((m->m_flags & M_PKTHDR) == 0) 6208 panic("non-M_PKTHDR is passed to pf_test6"); 6209 #endif /* DIAGNOSTIC */ 6210 6211 memset(&pd, 0, sizeof(pd)); 6212 if (m->m_pkthdr.len < (int)sizeof(*h)) { 6213 action = PF_DROP; 6214 REASON_SET(&reason, PFRES_SHORT); 6215 log = 1; 6216 goto done; 6217 } 6218 6219 /* We do IP header normalization and packet reassembly here */ 6220 if (pf_normalize_ip6(m0, dir, kif, &reason, &pd) != PF_PASS) { 6221 action = PF_DROP; 6222 goto done; 6223 } 6224 m = *m0; 6225 h = mtod(m, struct ip6_hdr *); 6226 6227 pd.src = (struct pf_addr *)&h->ip6_src; 6228 pd.dst = (struct pf_addr *)&h->ip6_dst; 6229 PF_ACPY(&pd.baddr, dir == PF_OUT ? pd.src : pd.dst, AF_INET6); 6230 pd.ip_sum = NULL; 6231 pd.af = AF_INET6; 6232 pd.tos = 0; 6233 pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr); 6234 pd.eh = eh; 6235 6236 off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr); 6237 pd.proto = h->ip6_nxt; 6238 do { 6239 switch (pd.proto) { 6240 case IPPROTO_FRAGMENT: 6241 action = pf_test_fragment(&r, dir, kif, m, h, 6242 &pd, &a, &ruleset); 6243 if (action == PF_DROP) 6244 REASON_SET(&reason, PFRES_FRAG); 6245 goto done; 6246 case IPPROTO_AH: 6247 case IPPROTO_HOPOPTS: 6248 case IPPROTO_ROUTING: 6249 case IPPROTO_DSTOPTS: { 6250 /* get next header and header length */ 6251 struct ip6_ext opt6; 6252 6253 if (!pf_pull_hdr(m, off, &opt6, sizeof(opt6), 6254 NULL, &reason, pd.af)) { 6255 DPFPRINTF(PF_DEBUG_MISC, 6256 ("pf: IPv6 short opt\n")); 6257 action = PF_DROP; 6258 log = 1; 6259 goto done; 6260 } 6261 if (pd.proto == IPPROTO_AH) 6262 off += (opt6.ip6e_len + 2) * 4; 6263 else 6264 off += (opt6.ip6e_len + 1) * 8; 6265 pd.proto = opt6.ip6e_nxt; 6266 /* goto the next header */ 6267 break; 6268 } 6269 default: 6270 terminal++; 6271 break; 6272 } 6273 } while (!terminal); 6274 6275 switch (pd.proto) { 6276 6277 case IPPROTO_TCP: { 6278 struct tcphdr th; 6279 6280 pd.hdr.tcp = &th; 6281 if (!pf_pull_hdr(m, off, &th, sizeof(th), 6282 &action, &reason, AF_INET6)) { 6283 log = action != PF_PASS; 6284 goto done; 6285 } 6286 if (dir == PF_IN && pf_check_proto_cksum(m, off, 6287 ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)), 6288 IPPROTO_TCP, AF_INET6)) { 6289 action = PF_DROP; 6290 REASON_SET(&reason, PFRES_PROTCKSUM); 6291 goto done; 6292 } 6293 pd.p_len = pd.tot_len - off - (th.th_off << 2); 6294 action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd); 6295 if (action == PF_DROP) 6296 goto done; 6297 action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd, 6298 &reason); 6299 if (action == PF_PASS) { 6300 #if NPFSYNC 6301 pfsync_update_state(s); 6302 #endif /* NPFSYNC */ 6303 r = s->rule.ptr; 6304 a = s->anchor.ptr; 6305 log = s->log; 6306 } else if (s == NULL) 6307 action = pf_test_tcp(&r, &s, dir, kif, 6308 m, off, h, &pd, &a, &ruleset, &ip6intrq); 6309 break; 6310 } 6311 6312 case IPPROTO_UDP: { 6313 struct udphdr uh; 6314 6315 pd.hdr.udp = &uh; 6316 if (!pf_pull_hdr(m, off, &uh, sizeof(uh), 6317 &action, &reason, AF_INET6)) { 6318 log = action != PF_PASS; 6319 goto done; 6320 } 6321 if (dir == PF_IN && uh.uh_sum && pf_check_proto_cksum(m, 6322 off, ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)), 6323 IPPROTO_UDP, AF_INET6)) { 6324 action = PF_DROP; 6325 REASON_SET(&reason, PFRES_PROTCKSUM); 6326 goto done; 6327 } 6328 if (uh.uh_dport == 0 || 6329 ntohs(uh.uh_ulen) > m->m_pkthdr.len - off || 6330 ntohs(uh.uh_ulen) < sizeof(struct udphdr)) { 6331 action = PF_DROP; 6332 goto done; 6333 } 6334 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd); 6335 if (action == PF_PASS) { 6336 #if NPFSYNC 6337 pfsync_update_state(s); 6338 #endif /* NPFSYNC */ 6339 r = s->rule.ptr; 6340 a = s->anchor.ptr; 6341 log = s->log; 6342 } else if (s == NULL) 6343 action = pf_test_udp(&r, &s, dir, kif, 6344 m, off, h, &pd, &a, &ruleset, &ip6intrq); 6345 break; 6346 } 6347 6348 case IPPROTO_ICMPV6: { 6349 struct icmp6_hdr ih; 6350 6351 pd.hdr.icmp6 = &ih; 6352 if (!pf_pull_hdr(m, off, &ih, sizeof(ih), 6353 &action, &reason, AF_INET6)) { 6354 log = action != PF_PASS; 6355 goto done; 6356 } 6357 if (dir == PF_IN && pf_check_proto_cksum(m, off, 6358 ntohs(h->ip6_plen) - (off - sizeof(struct ip6_hdr)), 6359 IPPROTO_ICMPV6, AF_INET6)) { 6360 action = PF_DROP; 6361 REASON_SET(&reason, PFRES_PROTCKSUM); 6362 goto done; 6363 } 6364 action = pf_test_state_icmp(&s, dir, kif, 6365 m, off, h, &pd, &reason); 6366 if (action == PF_PASS) { 6367 #if NPFSYNC 6368 pfsync_update_state(s); 6369 #endif /* NPFSYNC */ 6370 r = s->rule.ptr; 6371 a = s->anchor.ptr; 6372 log = s->log; 6373 } else if (s == NULL) 6374 action = pf_test_icmp(&r, &s, dir, kif, 6375 m, off, h, &pd, &a, &ruleset, &ip6intrq); 6376 break; 6377 } 6378 6379 default: 6380 action = pf_test_state_other(&s, dir, kif, &pd); 6381 if (action == PF_PASS) { 6382 #if NPFSYNC 6383 pfsync_update_state(s); 6384 #endif /* NPFSYNC */ 6385 r = s->rule.ptr; 6386 a = s->anchor.ptr; 6387 log = s->log; 6388 } else if (s == NULL) 6389 action = pf_test_other(&r, &s, dir, kif, m, off, h, 6390 &pd, &a, &ruleset, &ip6intrq); 6391 break; 6392 } 6393 6394 done: 6395 /* XXX handle IPv6 options, if not allowed. not implemented. */ 6396 6397 if (s && s->tag) 6398 pf_tag_packet(m, pf_get_tag(m), s->tag); 6399 6400 #ifdef ALTQ 6401 if (action == PF_PASS && r->qid) { 6402 struct m_tag *mtag; 6403 struct altq_tag *atag; 6404 6405 mtag = m_tag_get(PACKET_TAG_PF_QID, sizeof(*atag), M_NOWAIT); 6406 if (mtag != NULL) { 6407 atag = (struct altq_tag *)(mtag + 1); 6408 if (pd.tos == IPTOS_LOWDELAY) 6409 atag->qid = r->pqid; 6410 else 6411 atag->qid = r->qid; 6412 /* add hints for ecn */ 6413 atag->af = AF_INET6; 6414 atag->hdr = h; 6415 m_tag_prepend(m, mtag); 6416 } 6417 } 6418 #endif /* ALTQ */ 6419 6420 if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP || 6421 pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL && 6422 (s->nat_rule.ptr->action == PF_RDR || 6423 s->nat_rule.ptr->action == PF_BINAT) && 6424 IN6_IS_ADDR_LOOPBACK(&pd.dst->v6) && 6425 pf_add_mbuf_tag(m, PACKET_TAG_PF_TRANSLATE_LOCALHOST)) { 6426 action = PF_DROP; 6427 REASON_SET(&reason, PFRES_MEMORY); 6428 } 6429 6430 if (log) 6431 PFLOG_PACKET(kif, h, m, AF_INET6, dir, reason, r, a, ruleset); 6432 6433 kif->pfik_bytes[1][dir == PF_OUT][action != PF_PASS] += pd.tot_len; 6434 kif->pfik_packets[1][dir == PF_OUT][action != PF_PASS]++; 6435 6436 if (action == PF_PASS || r->action == PF_DROP) { 6437 r->packets++; 6438 r->bytes += pd.tot_len; 6439 if (a != NULL) { 6440 a->packets++; 6441 a->bytes += pd.tot_len; 6442 } 6443 if (s != NULL) { 6444 dirndx = (dir == s->direction) ? 0 : 1; 6445 s->packets[dirndx]++; 6446 s->bytes[dirndx] += pd.tot_len; 6447 if (s->nat_rule.ptr != NULL) { 6448 s->nat_rule.ptr->packets++; 6449 s->nat_rule.ptr->bytes += pd.tot_len; 6450 } 6451 if (s->src_node != NULL) { 6452 s->src_node->packets++; 6453 s->src_node->bytes += pd.tot_len; 6454 } 6455 if (s->nat_src_node != NULL) { 6456 s->nat_src_node->packets++; 6457 s->nat_src_node->bytes += pd.tot_len; 6458 } 6459 } 6460 tr = r; 6461 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule; 6462 if (nr != NULL) { 6463 struct pf_addr *x; 6464 /* 6465 * XXX: we need to make sure that the addresses 6466 * passed to pfr_update_stats() are the same than 6467 * the addresses used during matching (pfr_match) 6468 */ 6469 if (r == &pf_default_rule) { 6470 tr = nr; 6471 x = (s == NULL || s->direction == dir) ? 6472 &pd.baddr : &pd.naddr; 6473 } else { 6474 x = (s == NULL || s->direction == dir) ? 6475 &pd.naddr : &pd.baddr; 6476 } 6477 if (x == &pd.baddr || s == NULL) { 6478 if (dir == PF_OUT) 6479 pd.src = x; 6480 else 6481 pd.dst = x; 6482 } 6483 } 6484 if (tr->src.addr.type == PF_ADDR_TABLE) 6485 pfr_update_stats(tr->src.addr.p.tbl, (s == NULL || 6486 s->direction == dir) ? pd.src : pd.dst, pd.af, 6487 pd.tot_len, dir == PF_OUT, r->action == PF_PASS, 6488 tr->src.neg); 6489 if (tr->dst.addr.type == PF_ADDR_TABLE) 6490 pfr_update_stats(tr->dst.addr.p.tbl, (s == NULL || 6491 s->direction == dir) ? pd.dst : pd.src, pd.af, 6492 pd.tot_len, dir == PF_OUT, r->action == PF_PASS, 6493 tr->dst.neg); 6494 } 6495 6496 6497 if (action == PF_SYNPROXY_DROP) { 6498 m_freem(*m0); 6499 *m0 = NULL; 6500 action = PF_PASS; 6501 } else if (r->rt) 6502 /* pf_route6 can free the mbuf causing *m0 to become NULL */ 6503 pf_route6(m0, r, dir, ifp, s); 6504 6505 return (action); 6506 } 6507 #endif /* INET6 */ 6508 6509 int 6510 pf_check_congestion(struct ifqueue *ifq) 6511 { 6512 #ifdef __OpenBSD__ 6513 if (ifq->ifq_congestion) 6514 return (1); 6515 else 6516 return (0); 6517 #else 6518 return 0; 6519 #endif 6520 } 6521