xref: /netbsd-src/sys/dist/pf/net/pf_norm.c (revision 8b0f9554ff8762542c4defc4f70e1eb76fb508fa)
1 /*	$NetBSD: pf_norm.c,v 1.17 2007/12/11 11:08:21 lukem Exp $	*/
2 /*	$OpenBSD: pf_norm.c,v 1.97 2004/09/21 16:59:12 aaron Exp $ */
3 
4 /*
5  * Copyright 2001 Niels Provos <provos@citi.umich.edu>
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 __KERNEL_RCSID(0, "$NetBSD: pf_norm.c,v 1.17 2007/12/11 11:08:21 lukem Exp $");
31 
32 #ifdef _KERNEL_OPT
33 #include "opt_inet.h"
34 #endif
35 
36 #include "pflog.h"
37 
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/mbuf.h>
41 #include <sys/filio.h>
42 #include <sys/fcntl.h>
43 #include <sys/socket.h>
44 #include <sys/kernel.h>
45 #include <sys/time.h>
46 #include <sys/pool.h>
47 
48 #ifdef __OpenBSD__
49 #include <dev/rndvar.h>
50 #else
51 #include <sys/rnd.h>
52 #endif
53 #include <net/if.h>
54 #include <net/if_types.h>
55 #include <net/bpf.h>
56 #include <net/route.h>
57 #include <net/if_pflog.h>
58 
59 #include <netinet/in.h>
60 #include <netinet/in_var.h>
61 #include <netinet/in_systm.h>
62 #include <netinet/ip.h>
63 #include <netinet/ip_var.h>
64 #include <netinet/tcp.h>
65 #include <netinet/tcp_seq.h>
66 #include <netinet/udp.h>
67 #include <netinet/ip_icmp.h>
68 
69 #ifdef INET6
70 #include <netinet/ip6.h>
71 #endif /* INET6 */
72 
73 #include <net/pfvar.h>
74 
75 struct pf_frent {
76 	LIST_ENTRY(pf_frent) fr_next;
77 	struct ip *fr_ip;
78 	struct mbuf *fr_m;
79 };
80 
81 struct pf_frcache {
82 	LIST_ENTRY(pf_frcache) fr_next;
83 	uint16_t	fr_off;
84 	uint16_t	fr_end;
85 };
86 
87 #define PFFRAG_SEENLAST	0x0001		/* Seen the last fragment for this */
88 #define PFFRAG_NOBUFFER	0x0002		/* Non-buffering fragment cache */
89 #define PFFRAG_DROP	0x0004		/* Drop all fragments */
90 #define BUFFER_FRAGMENTS(fr)	(!((fr)->fr_flags & PFFRAG_NOBUFFER))
91 
92 struct pf_fragment {
93 	RB_ENTRY(pf_fragment) fr_entry;
94 	TAILQ_ENTRY(pf_fragment) frag_next;
95 	struct in_addr	fr_src;
96 	struct in_addr	fr_dst;
97 	u_int8_t	fr_p;		/* protocol of this fragment */
98 	u_int8_t	fr_flags;	/* status flags */
99 	u_int16_t	fr_id;		/* fragment id for reassemble */
100 	u_int16_t	fr_max;		/* fragment data max */
101 	u_int32_t	fr_timeout;
102 #define fr_queue	fr_u.fru_queue
103 #define fr_cache	fr_u.fru_cache
104 	union {
105 		LIST_HEAD(pf_fragq, pf_frent) fru_queue;	/* buffering */
106 		LIST_HEAD(pf_cacheq, pf_frcache) fru_cache;	/* non-buf */
107 	} fr_u;
108 };
109 
110 TAILQ_HEAD(pf_fragqueue, pf_fragment)	pf_fragqueue;
111 TAILQ_HEAD(pf_cachequeue, pf_fragment)	pf_cachequeue;
112 
113 static __inline int	 pf_frag_compare(struct pf_fragment *,
114 			    struct pf_fragment *);
115 RB_HEAD(pf_frag_tree, pf_fragment)	pf_frag_tree, pf_cache_tree;
116 RB_PROTOTYPE(pf_frag_tree, pf_fragment, fr_entry, pf_frag_compare);
117 RB_GENERATE(pf_frag_tree, pf_fragment, fr_entry, pf_frag_compare);
118 
119 /* Private prototypes */
120 void			 pf_ip2key(struct pf_fragment *, struct ip *);
121 void			 pf_remove_fragment(struct pf_fragment *);
122 void			 pf_flush_fragments(void);
123 void			 pf_free_fragment(struct pf_fragment *);
124 struct pf_fragment	*pf_find_fragment(struct ip *, struct pf_frag_tree *);
125 struct mbuf		*pf_reassemble(struct mbuf **, struct pf_fragment **,
126 			    struct pf_frent *, int);
127 struct mbuf		*pf_fragcache(struct mbuf **, struct ip*,
128 			    struct pf_fragment **, int, int, int *);
129 int			 pf_normalize_tcpopt(struct pf_rule *, struct mbuf *,
130 			    struct tcphdr *, int);
131 
132 #define	DPFPRINTF(x) do {				\
133 	if (pf_status.debug >= PF_DEBUG_MISC) {		\
134 		printf("%s: ", __func__);		\
135 		printf x ;				\
136 	}						\
137 } while(0)
138 
139 /* Globals */
140 struct pool		 pf_frent_pl, pf_frag_pl, pf_cache_pl, pf_cent_pl;
141 struct pool		 pf_state_scrub_pl;
142 int			 pf_nfrents, pf_ncache;
143 
144 void
145 pf_normalize_init(void)
146 {
147 #ifdef __NetBSD__
148 	pool_init(&pf_frent_pl, sizeof(struct pf_frent), 0, 0, 0, "pffrent",
149 	    NULL, IPL_SOFTNET);
150 	pool_init(&pf_frag_pl, sizeof(struct pf_fragment), 0, 0, 0, "pffrag",
151 	    NULL, IPL_SOFTNET);
152 	pool_init(&pf_cache_pl, sizeof(struct pf_fragment), 0, 0, 0,
153 	    "pffrcache", NULL, IPL_SOFTNET);
154 	pool_init(&pf_cent_pl, sizeof(struct pf_frcache), 0, 0, 0, "pffrcent",
155 	    NULL, IPL_SOFTNET);
156 	pool_init(&pf_state_scrub_pl, sizeof(struct pf_state_scrub), 0, 0, 0,
157 	    "pfstscr", NULL, IPL_SOFTNET);
158 #else
159 	pool_init(&pf_frent_pl, sizeof(struct pf_frent), 0, 0, 0, "pffrent",
160 	    NULL);
161 	pool_init(&pf_frag_pl, sizeof(struct pf_fragment), 0, 0, 0, "pffrag",
162 	    NULL);
163 	pool_init(&pf_cache_pl, sizeof(struct pf_fragment), 0, 0, 0,
164 	    "pffrcache", NULL);
165 	pool_init(&pf_cent_pl, sizeof(struct pf_frcache), 0, 0, 0, "pffrcent",
166 	    NULL);
167 	pool_init(&pf_state_scrub_pl, sizeof(struct pf_state_scrub), 0, 0, 0,
168 	    "pfstscr", NULL);
169 #endif
170 
171 	pool_sethiwat(&pf_frag_pl, PFFRAG_FRAG_HIWAT);
172 	pool_sethardlimit(&pf_frent_pl, PFFRAG_FRENT_HIWAT, NULL, 0);
173 	pool_sethardlimit(&pf_cache_pl, PFFRAG_FRCACHE_HIWAT, NULL, 0);
174 	pool_sethardlimit(&pf_cent_pl, PFFRAG_FRCENT_HIWAT, NULL, 0);
175 
176 	TAILQ_INIT(&pf_fragqueue);
177 	TAILQ_INIT(&pf_cachequeue);
178 }
179 
180 #ifdef _LKM
181 void
182 pf_normalize_destroy(void)
183 {
184 	pool_destroy(&pf_state_scrub_pl);
185 	pool_destroy(&pf_cent_pl);
186 	pool_destroy(&pf_cache_pl);
187 	pool_destroy(&pf_frag_pl);
188 	pool_destroy(&pf_frent_pl);
189 }
190 #endif
191 
192 static __inline int
193 pf_frag_compare(struct pf_fragment *a, struct pf_fragment *b)
194 {
195 	int	diff;
196 
197 	if ((diff = a->fr_id - b->fr_id))
198 		return (diff);
199 	else if ((diff = a->fr_p - b->fr_p))
200 		return (diff);
201 	else if (a->fr_src.s_addr < b->fr_src.s_addr)
202 		return (-1);
203 	else if (a->fr_src.s_addr > b->fr_src.s_addr)
204 		return (1);
205 	else if (a->fr_dst.s_addr < b->fr_dst.s_addr)
206 		return (-1);
207 	else if (a->fr_dst.s_addr > b->fr_dst.s_addr)
208 		return (1);
209 	return (0);
210 }
211 
212 void
213 pf_purge_expired_fragments(void)
214 {
215 	struct pf_fragment	*frag;
216 	u_int32_t		 expire = time_second -
217 				    pf_default_rule.timeout[PFTM_FRAG];
218 
219 	while ((frag = TAILQ_LAST(&pf_fragqueue, pf_fragqueue)) != NULL) {
220 		KASSERT(BUFFER_FRAGMENTS(frag));
221 		if (frag->fr_timeout > expire)
222 			break;
223 
224 		DPFPRINTF(("expiring %d(%p)\n", frag->fr_id, frag));
225 		pf_free_fragment(frag);
226 	}
227 
228 	while ((frag = TAILQ_LAST(&pf_cachequeue, pf_cachequeue)) != NULL) {
229 		KASSERT(!BUFFER_FRAGMENTS(frag));
230 		if (frag->fr_timeout > expire)
231 			break;
232 
233 		DPFPRINTF(("expiring %d(%p)\n", frag->fr_id, frag));
234 		pf_free_fragment(frag);
235 		KASSERT(TAILQ_EMPTY(&pf_cachequeue) ||
236 		    TAILQ_LAST(&pf_cachequeue, pf_cachequeue) != frag);
237 	}
238 }
239 
240 /*
241  * Try to flush old fragments to make space for new ones
242  */
243 
244 void
245 pf_flush_fragments(void)
246 {
247 	struct pf_fragment	*frag;
248 	int			 goal;
249 
250 	goal = pf_nfrents * 9 / 10;
251 	DPFPRINTF(("trying to free > %d frents\n",
252 	    pf_nfrents - goal));
253 	while (goal < pf_nfrents) {
254 		frag = TAILQ_LAST(&pf_fragqueue, pf_fragqueue);
255 		if (frag == NULL)
256 			break;
257 		pf_free_fragment(frag);
258 	}
259 
260 
261 	goal = pf_ncache * 9 / 10;
262 	DPFPRINTF(("trying to free > %d cache entries\n",
263 	    pf_ncache - goal));
264 	while (goal < pf_ncache) {
265 		frag = TAILQ_LAST(&pf_cachequeue, pf_cachequeue);
266 		if (frag == NULL)
267 			break;
268 		pf_free_fragment(frag);
269 	}
270 }
271 
272 /* Frees the fragments and all associated entries */
273 
274 void
275 pf_free_fragment(struct pf_fragment *frag)
276 {
277 	struct pf_frent		*frent;
278 	struct pf_frcache	*frcache;
279 
280 	/* Free all fragments */
281 	if (BUFFER_FRAGMENTS(frag)) {
282 		for (frent = LIST_FIRST(&frag->fr_queue); frent;
283 		    frent = LIST_FIRST(&frag->fr_queue)) {
284 			LIST_REMOVE(frent, fr_next);
285 
286 			m_freem(frent->fr_m);
287 			pool_put(&pf_frent_pl, frent);
288 			pf_nfrents--;
289 		}
290 	} else {
291 		for (frcache = LIST_FIRST(&frag->fr_cache); frcache;
292 		    frcache = LIST_FIRST(&frag->fr_cache)) {
293 			LIST_REMOVE(frcache, fr_next);
294 
295 			KASSERT(LIST_EMPTY(&frag->fr_cache) ||
296 			    LIST_FIRST(&frag->fr_cache)->fr_off >
297 			    frcache->fr_end);
298 
299 			pool_put(&pf_cent_pl, frcache);
300 			pf_ncache--;
301 		}
302 	}
303 
304 	pf_remove_fragment(frag);
305 }
306 
307 void
308 pf_ip2key(struct pf_fragment *key, struct ip *ip)
309 {
310 	key->fr_p = ip->ip_p;
311 	key->fr_id = ip->ip_id;
312 	key->fr_src.s_addr = ip->ip_src.s_addr;
313 	key->fr_dst.s_addr = ip->ip_dst.s_addr;
314 }
315 
316 struct pf_fragment *
317 pf_find_fragment(struct ip *ip, struct pf_frag_tree *tree)
318 {
319 	struct pf_fragment	 key;
320 	struct pf_fragment	*frag;
321 
322 	pf_ip2key(&key, ip);
323 
324 	frag = RB_FIND(pf_frag_tree, tree, &key);
325 	if (frag != NULL) {
326 		/* XXX Are we sure we want to update the timeout? */
327 		frag->fr_timeout = time_second;
328 		if (BUFFER_FRAGMENTS(frag)) {
329 			TAILQ_REMOVE(&pf_fragqueue, frag, frag_next);
330 			TAILQ_INSERT_HEAD(&pf_fragqueue, frag, frag_next);
331 		} else {
332 			TAILQ_REMOVE(&pf_cachequeue, frag, frag_next);
333 			TAILQ_INSERT_HEAD(&pf_cachequeue, frag, frag_next);
334 		}
335 	}
336 
337 	return (frag);
338 }
339 
340 /* Removes a fragment from the fragment queue and frees the fragment */
341 
342 void
343 pf_remove_fragment(struct pf_fragment *frag)
344 {
345 	if (BUFFER_FRAGMENTS(frag)) {
346 		RB_REMOVE(pf_frag_tree, &pf_frag_tree, frag);
347 		TAILQ_REMOVE(&pf_fragqueue, frag, frag_next);
348 		pool_put(&pf_frag_pl, frag);
349 	} else {
350 		RB_REMOVE(pf_frag_tree, &pf_cache_tree, frag);
351 		TAILQ_REMOVE(&pf_cachequeue, frag, frag_next);
352 		pool_put(&pf_cache_pl, frag);
353 	}
354 }
355 
356 #define FR_IP_OFF(fr)	((ntohs((fr)->fr_ip->ip_off) & IP_OFFMASK) << 3)
357 struct mbuf *
358 pf_reassemble(struct mbuf **m0, struct pf_fragment **frag,
359     struct pf_frent *frent, int mff)
360 {
361 	struct mbuf	*m = *m0, *m2;
362 	struct pf_frent	*frea, *next;
363 	struct pf_frent	*frep = NULL;
364 	struct ip	*ip = frent->fr_ip;
365 	int		 hlen = ip->ip_hl << 2;
366 	u_int16_t	 off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3;
367 	u_int16_t	 ip_len = ntohs(ip->ip_len) - ip->ip_hl * 4;
368 	u_int16_t	 max = ip_len + off;
369 
370 	KASSERT(*frag == NULL || BUFFER_FRAGMENTS(*frag));
371 
372 	/* Strip off ip header */
373 	m->m_data += hlen;
374 	m->m_len -= hlen;
375 
376 	/* Create a new reassembly queue for this packet */
377 	if (*frag == NULL) {
378 		*frag = pool_get(&pf_frag_pl, PR_NOWAIT);
379 		if (*frag == NULL) {
380 			pf_flush_fragments();
381 			*frag = pool_get(&pf_frag_pl, PR_NOWAIT);
382 			if (*frag == NULL)
383 				goto drop_fragment;
384 		}
385 
386 		(*frag)->fr_flags = 0;
387 		(*frag)->fr_max = 0;
388 		(*frag)->fr_src = frent->fr_ip->ip_src;
389 		(*frag)->fr_dst = frent->fr_ip->ip_dst;
390 		(*frag)->fr_p = frent->fr_ip->ip_p;
391 		(*frag)->fr_id = frent->fr_ip->ip_id;
392 		(*frag)->fr_timeout = time_second;
393 		LIST_INIT(&(*frag)->fr_queue);
394 
395 		RB_INSERT(pf_frag_tree, &pf_frag_tree, *frag);
396 		TAILQ_INSERT_HEAD(&pf_fragqueue, *frag, frag_next);
397 
398 		/* We do not have a previous fragment */
399 		frep = NULL;
400 		goto insert;
401 	}
402 
403 	/*
404 	 * Find a fragment after the current one:
405 	 *  - off contains the real shifted offset.
406 	 */
407 	LIST_FOREACH(frea, &(*frag)->fr_queue, fr_next) {
408 		if (FR_IP_OFF(frea) > off)
409 			break;
410 		frep = frea;
411 	}
412 
413 	KASSERT(frep != NULL || frea != NULL);
414 
415 	if (frep != NULL &&
416 	    FR_IP_OFF(frep) + ntohs(frep->fr_ip->ip_len) - frep->fr_ip->ip_hl *
417 	    4 > off)
418 	{
419 		u_int16_t	precut;
420 
421 		precut = FR_IP_OFF(frep) + ntohs(frep->fr_ip->ip_len) -
422 		    frep->fr_ip->ip_hl * 4 - off;
423 		if (precut >= ip_len)
424 			goto drop_fragment;
425 		m_adj(frent->fr_m, precut);
426 		DPFPRINTF(("overlap -%d\n", precut));
427 		/* Enforce 8 byte boundaries */
428 		ip->ip_off = htons(ntohs(ip->ip_off) + (precut >> 3));
429 		off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3;
430 		ip_len -= precut;
431 		ip->ip_len = htons(ip_len);
432 	}
433 
434 	for (; frea != NULL && ip_len + off > FR_IP_OFF(frea);
435 	    frea = next)
436 	{
437 		u_int16_t	aftercut;
438 
439 		aftercut = ip_len + off - FR_IP_OFF(frea);
440 		DPFPRINTF(("adjust overlap %d\n", aftercut));
441 		if (aftercut < ntohs(frea->fr_ip->ip_len) - frea->fr_ip->ip_hl
442 		    * 4)
443 		{
444 			frea->fr_ip->ip_len =
445 			    htons(ntohs(frea->fr_ip->ip_len) - aftercut);
446 			frea->fr_ip->ip_off = htons(ntohs(frea->fr_ip->ip_off) +
447 			    (aftercut >> 3));
448 			m_adj(frea->fr_m, aftercut);
449 			break;
450 		}
451 
452 		/* This fragment is completely overlapped, loose it */
453 		next = LIST_NEXT(frea, fr_next);
454 		m_freem(frea->fr_m);
455 		LIST_REMOVE(frea, fr_next);
456 		pool_put(&pf_frent_pl, frea);
457 		pf_nfrents--;
458 	}
459 
460  insert:
461 	/* Update maximum data size */
462 	if ((*frag)->fr_max < max)
463 		(*frag)->fr_max = max;
464 	/* This is the last segment */
465 	if (!mff)
466 		(*frag)->fr_flags |= PFFRAG_SEENLAST;
467 
468 	if (frep == NULL)
469 		LIST_INSERT_HEAD(&(*frag)->fr_queue, frent, fr_next);
470 	else
471 		LIST_INSERT_AFTER(frep, frent, fr_next);
472 
473 	/* Check if we are completely reassembled */
474 	if (!((*frag)->fr_flags & PFFRAG_SEENLAST))
475 		return (NULL);
476 
477 	/* Check if we have all the data */
478 	off = 0;
479 	for (frep = LIST_FIRST(&(*frag)->fr_queue); frep; frep = next) {
480 		next = LIST_NEXT(frep, fr_next);
481 
482 		off += ntohs(frep->fr_ip->ip_len) - frep->fr_ip->ip_hl * 4;
483 		if (off < (*frag)->fr_max &&
484 		    (next == NULL || FR_IP_OFF(next) != off))
485 		{
486 			DPFPRINTF(("missing fragment at %d, next %d, max %d\n",
487 			    off, next == NULL ? -1 : FR_IP_OFF(next),
488 			    (*frag)->fr_max));
489 			return (NULL);
490 		}
491 	}
492 	DPFPRINTF(("%d < %d?\n", off, (*frag)->fr_max));
493 	if (off < (*frag)->fr_max)
494 		return (NULL);
495 
496 	/* We have all the data */
497 	frent = LIST_FIRST(&(*frag)->fr_queue);
498 	KASSERT(frent != NULL);
499 	if ((frent->fr_ip->ip_hl << 2) + off > IP_MAXPACKET) {
500 		DPFPRINTF(("drop: too big: %d\n", off));
501 		pf_free_fragment(*frag);
502 		*frag = NULL;
503 		return (NULL);
504 	}
505 	next = LIST_NEXT(frent, fr_next);
506 
507 	/* Magic from ip_input */
508 	ip = frent->fr_ip;
509 	m = frent->fr_m;
510 	m2 = m->m_next;
511 	m->m_next = NULL;
512 	m_cat(m, m2);
513 	pool_put(&pf_frent_pl, frent);
514 	pf_nfrents--;
515 	for (frent = next; frent != NULL; frent = next) {
516 		next = LIST_NEXT(frent, fr_next);
517 
518 		m2 = frent->fr_m;
519 		pool_put(&pf_frent_pl, frent);
520 		pf_nfrents--;
521 		m_cat(m, m2);
522 	}
523 
524 	ip->ip_src = (*frag)->fr_src;
525 	ip->ip_dst = (*frag)->fr_dst;
526 
527 	/* Remove from fragment queue */
528 	pf_remove_fragment(*frag);
529 	*frag = NULL;
530 
531 	hlen = ip->ip_hl << 2;
532 	ip->ip_len = htons(off + hlen);
533 	m->m_len += hlen;
534 	m->m_data -= hlen;
535 
536 	/* some debugging cruft by sklower, below, will go away soon */
537 	/* XXX this should be done elsewhere */
538 	if (m->m_flags & M_PKTHDR) {
539 		int plen = 0;
540 		for (m2 = m; m2; m2 = m2->m_next)
541 			plen += m2->m_len;
542 		m->m_pkthdr.len = plen;
543 #if defined(__NetBSD__)
544 		m->m_pkthdr.csum_flags = 0;
545 #endif /* defined(__NetBSD__) */
546 	}
547 
548 	DPFPRINTF(("complete: %p(%d)\n", m, ntohs(ip->ip_len)));
549 	return (m);
550 
551  drop_fragment:
552 	/* Oops - fail safe - drop packet */
553 	pool_put(&pf_frent_pl, frent);
554 	pf_nfrents--;
555 	m_freem(m);
556 	return (NULL);
557 }
558 
559 struct mbuf *
560 pf_fragcache(struct mbuf **m0, struct ip *h, struct pf_fragment **frag, int mff,
561     int drop, int *nomem)
562 {
563 	struct mbuf		*m = *m0;
564 	struct pf_frcache	*frp, *fra, *cur = NULL;
565 	int			 ip_len = ntohs(h->ip_len) - (h->ip_hl << 2);
566 	u_int16_t		 off = ntohs(h->ip_off) << 3;
567 	u_int16_t		 max = ip_len + off;
568 	int			 hosed = 0;
569 
570 	KASSERT(*frag == NULL || !BUFFER_FRAGMENTS(*frag));
571 
572 	/* Create a new range queue for this packet */
573 	if (*frag == NULL) {
574 		*frag = pool_get(&pf_cache_pl, PR_NOWAIT);
575 		if (*frag == NULL) {
576 			pf_flush_fragments();
577 			*frag = pool_get(&pf_cache_pl, PR_NOWAIT);
578 			if (*frag == NULL)
579 				goto no_mem;
580 		}
581 
582 		/* Get an entry for the queue */
583 		cur = pool_get(&pf_cent_pl, PR_NOWAIT);
584 		if (cur == NULL) {
585 			pool_put(&pf_cache_pl, *frag);
586 			*frag = NULL;
587 			goto no_mem;
588 		}
589 		pf_ncache++;
590 
591 		(*frag)->fr_flags = PFFRAG_NOBUFFER;
592 		(*frag)->fr_max = 0;
593 		(*frag)->fr_src = h->ip_src;
594 		(*frag)->fr_dst = h->ip_dst;
595 		(*frag)->fr_p = h->ip_p;
596 		(*frag)->fr_id = h->ip_id;
597 		(*frag)->fr_timeout = time_second;
598 
599 		cur->fr_off = off;
600 		cur->fr_end = max;
601 		LIST_INIT(&(*frag)->fr_cache);
602 		LIST_INSERT_HEAD(&(*frag)->fr_cache, cur, fr_next);
603 
604 		RB_INSERT(pf_frag_tree, &pf_cache_tree, *frag);
605 		TAILQ_INSERT_HEAD(&pf_cachequeue, *frag, frag_next);
606 
607 		DPFPRINTF(("fragcache[%d]: new %d-%d\n", h->ip_id, off, max));
608 
609 		goto pass;
610 	}
611 
612 	/*
613 	 * Find a fragment after the current one:
614 	 *  - off contains the real shifted offset.
615 	 */
616 	frp = NULL;
617 	LIST_FOREACH(fra, &(*frag)->fr_cache, fr_next) {
618 		if (fra->fr_off > off)
619 			break;
620 		frp = fra;
621 	}
622 
623 	KASSERT(frp != NULL || fra != NULL);
624 
625 	if (frp != NULL) {
626 		int	precut;
627 
628 		precut = frp->fr_end - off;
629 		if (precut >= ip_len) {
630 			/* Fragment is entirely a duplicate */
631 			DPFPRINTF(("fragcache[%d]: dead (%d-%d) %d-%d\n",
632 			    h->ip_id, frp->fr_off, frp->fr_end, off, max));
633 			goto drop_fragment;
634 		}
635 		if (precut == 0) {
636 			/* They are adjacent.  Fixup cache entry */
637 			DPFPRINTF(("fragcache[%d]: adjacent (%d-%d) %d-%d\n",
638 			    h->ip_id, frp->fr_off, frp->fr_end, off, max));
639 			frp->fr_end = max;
640 		} else if (precut > 0) {
641 			/* The first part of this payload overlaps with a
642 			 * fragment that has already been passed.
643 			 * Need to trim off the first part of the payload.
644 			 * But to do so easily, we need to create another
645 			 * mbuf to throw the original header into.
646 			 */
647 
648 			DPFPRINTF(("fragcache[%d]: chop %d (%d-%d) %d-%d\n",
649 			    h->ip_id, precut, frp->fr_off, frp->fr_end, off,
650 			    max));
651 
652 			off += precut;
653 			max -= precut;
654 			/* Update the previous frag to encompass this one */
655 			frp->fr_end = max;
656 
657 			if (!drop) {
658 				/* XXX Optimization opportunity
659 				 * This is a very heavy way to trim the payload.
660 				 * we could do it much faster by diddling mbuf
661 				 * internals but that would be even less legible
662 				 * than this mbuf magic.  For my next trick,
663 				 * I'll pull a rabbit out of my laptop.
664 				 */
665 				*m0 = m_copym2(m, 0, h->ip_hl << 2, M_NOWAIT);
666 				if (*m0 == NULL)
667 					goto no_mem;
668 				KASSERT((*m0)->m_next == NULL);
669 				m_adj(m, precut + (h->ip_hl << 2));
670 				m_cat(*m0, m);
671 				m = *m0;
672 				if (m->m_flags & M_PKTHDR) {
673 					int plen = 0;
674 					struct mbuf *t;
675 					for (t = m; t; t = t->m_next)
676 						plen += t->m_len;
677 					m->m_pkthdr.len = plen;
678 				}
679 
680 
681 				h = mtod(m, struct ip *);
682 
683 
684 				KASSERT((int)m->m_len ==
685 				    ntohs(h->ip_len) - precut);
686 				h->ip_off = htons(ntohs(h->ip_off) +
687 				    (precut >> 3));
688 				h->ip_len = htons(ntohs(h->ip_len) - precut);
689 			} else {
690 				hosed++;
691 			}
692 		} else {
693 			/* There is a gap between fragments */
694 
695 			DPFPRINTF(("fragcache[%d]: gap %d (%d-%d) %d-%d\n",
696 			    h->ip_id, -precut, frp->fr_off, frp->fr_end, off,
697 			    max));
698 
699 			cur = pool_get(&pf_cent_pl, PR_NOWAIT);
700 			if (cur == NULL)
701 				goto no_mem;
702 			pf_ncache++;
703 
704 			cur->fr_off = off;
705 			cur->fr_end = max;
706 			LIST_INSERT_AFTER(frp, cur, fr_next);
707 		}
708 	}
709 
710 	if (fra != NULL) {
711 		int	aftercut;
712 		int	merge = 0;
713 
714 		aftercut = max - fra->fr_off;
715 		if (aftercut == 0) {
716 			/* Adjacent fragments */
717 			DPFPRINTF(("fragcache[%d]: adjacent %d-%d (%d-%d)\n",
718 			    h->ip_id, off, max, fra->fr_off, fra->fr_end));
719 			fra->fr_off = off;
720 			merge = 1;
721 		} else if (aftercut > 0) {
722 			/* Need to chop off the tail of this fragment */
723 			DPFPRINTF(("fragcache[%d]: chop %d %d-%d (%d-%d)\n",
724 			    h->ip_id, aftercut, off, max, fra->fr_off,
725 			    fra->fr_end));
726 			fra->fr_off = off;
727 			max -= aftercut;
728 
729 			merge = 1;
730 
731 			if (!drop) {
732 				m_adj(m, -aftercut);
733 				if (m->m_flags & M_PKTHDR) {
734 					int plen = 0;
735 					struct mbuf *t;
736 					for (t = m; t; t = t->m_next)
737 						plen += t->m_len;
738 					m->m_pkthdr.len = plen;
739 				}
740 				h = mtod(m, struct ip *);
741 				KASSERT((int)m->m_len ==
742 				    ntohs(h->ip_len) - aftercut);
743 				h->ip_len = htons(ntohs(h->ip_len) - aftercut);
744 			} else {
745 				hosed++;
746 			}
747 		} else if (frp == NULL) {
748 			/* There is a gap between fragments */
749 			DPFPRINTF(("fragcache[%d]: gap %d %d-%d (%d-%d)\n",
750 			    h->ip_id, -aftercut, off, max, fra->fr_off,
751 			    fra->fr_end));
752 
753 			cur = pool_get(&pf_cent_pl, PR_NOWAIT);
754 			if (cur == NULL)
755 				goto no_mem;
756 			pf_ncache++;
757 
758 			cur->fr_off = off;
759 			cur->fr_end = max;
760 			LIST_INSERT_BEFORE(fra, cur, fr_next);
761 		}
762 
763 
764 		/* Need to glue together two separate fragment descriptors */
765 		if (merge) {
766 			if (cur && fra->fr_off <= cur->fr_end) {
767 				/* Need to merge in a previous 'cur' */
768 				DPFPRINTF(("fragcache[%d]: adjacent(merge "
769 				    "%d-%d) %d-%d (%d-%d)\n",
770 				    h->ip_id, cur->fr_off, cur->fr_end, off,
771 				    max, fra->fr_off, fra->fr_end));
772 				fra->fr_off = cur->fr_off;
773 				LIST_REMOVE(cur, fr_next);
774 				pool_put(&pf_cent_pl, cur);
775 				pf_ncache--;
776 				cur = NULL;
777 
778 			} else if (frp && fra->fr_off <= frp->fr_end) {
779 				/* Need to merge in a modified 'frp' */
780 				KASSERT(cur == NULL);
781 				DPFPRINTF(("fragcache[%d]: adjacent(merge "
782 				    "%d-%d) %d-%d (%d-%d)\n",
783 				    h->ip_id, frp->fr_off, frp->fr_end, off,
784 				    max, fra->fr_off, fra->fr_end));
785 				fra->fr_off = frp->fr_off;
786 				LIST_REMOVE(frp, fr_next);
787 				pool_put(&pf_cent_pl, frp);
788 				pf_ncache--;
789 				frp = NULL;
790 
791 			}
792 		}
793 	}
794 
795 	if (hosed) {
796 		/*
797 		 * We must keep tracking the overall fragment even when
798 		 * we're going to drop it anyway so that we know when to
799 		 * free the overall descriptor.  Thus we drop the frag late.
800 		 */
801 		goto drop_fragment;
802 	}
803 
804 
805  pass:
806 	/* Update maximum data size */
807 	if ((*frag)->fr_max < max)
808 		(*frag)->fr_max = max;
809 
810 	/* This is the last segment */
811 	if (!mff)
812 		(*frag)->fr_flags |= PFFRAG_SEENLAST;
813 
814 	/* Check if we are completely reassembled */
815 	if (((*frag)->fr_flags & PFFRAG_SEENLAST) &&
816 	    LIST_FIRST(&(*frag)->fr_cache)->fr_off == 0 &&
817 	    LIST_FIRST(&(*frag)->fr_cache)->fr_end == (*frag)->fr_max) {
818 		/* Remove from fragment queue */
819 		DPFPRINTF(("fragcache[%d]: done 0-%d\n", h->ip_id,
820 		    (*frag)->fr_max));
821 		pf_free_fragment(*frag);
822 		*frag = NULL;
823 	}
824 
825 	return (m);
826 
827  no_mem:
828 	*nomem = 1;
829 
830 	/* Still need to pay attention to !IP_MF */
831 	if (!mff && *frag != NULL)
832 		(*frag)->fr_flags |= PFFRAG_SEENLAST;
833 
834 	m_freem(m);
835 	return (NULL);
836 
837  drop_fragment:
838 
839 	/* Still need to pay attention to !IP_MF */
840 	if (!mff && *frag != NULL)
841 		(*frag)->fr_flags |= PFFRAG_SEENLAST;
842 
843 	if (drop) {
844 		/* This fragment has been deemed bad.  Don't reass */
845 		if (((*frag)->fr_flags & PFFRAG_DROP) == 0)
846 			DPFPRINTF(("fragcache[%d]: dropping overall fragment\n",
847 			    h->ip_id));
848 		(*frag)->fr_flags |= PFFRAG_DROP;
849 	}
850 
851 	m_freem(m);
852 	return (NULL);
853 }
854 
855 int
856 pf_normalize_ip(struct mbuf **m0, int dir, struct pfi_kif *kif, u_short *reason,
857     struct pf_pdesc *pd)
858 {
859 	struct mbuf		*m = *m0;
860 	struct pf_rule		*r;
861 	struct pf_frent		*frent;
862 	struct pf_fragment	*frag = NULL;
863 	struct ip		*h = mtod(m, struct ip *);
864 	int			 mff = (ntohs(h->ip_off) & IP_MF);
865 	int			 hlen = h->ip_hl << 2;
866 	u_int16_t		 fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3;
867 	u_int16_t		 max;
868 	int			 ip_len;
869 	int			 ip_off;
870 
871 	r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr);
872 	while (r != NULL) {
873 		r->evaluations++;
874 		if (r->kif != NULL &&
875 		    (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot)
876 			r = r->skip[PF_SKIP_IFP].ptr;
877 		else if (r->direction && r->direction != dir)
878 			r = r->skip[PF_SKIP_DIR].ptr;
879 		else if (r->af && r->af != AF_INET)
880 			r = r->skip[PF_SKIP_AF].ptr;
881 		else if (r->proto && r->proto != h->ip_p)
882 			r = r->skip[PF_SKIP_PROTO].ptr;
883 		else if (PF_MISMATCHAW(&r->src.addr,
884 		    (struct pf_addr *)&h->ip_src.s_addr, AF_INET, r->src.neg))
885 			r = r->skip[PF_SKIP_SRC_ADDR].ptr;
886 		else if (PF_MISMATCHAW(&r->dst.addr,
887 		    (struct pf_addr *)&h->ip_dst.s_addr, AF_INET, r->dst.neg))
888 			r = r->skip[PF_SKIP_DST_ADDR].ptr;
889 		else
890 			break;
891 	}
892 
893 	if (r == NULL)
894 		return (PF_PASS);
895 	else
896 		r->packets++;
897 
898 	/* Check for illegal packets */
899 	if (hlen < (int)sizeof(struct ip))
900 		goto drop;
901 
902 	if (hlen > ntohs(h->ip_len))
903 		goto drop;
904 
905 	/* Clear IP_DF if the rule uses the no-df option */
906 	if (r->rule_flag & PFRULE_NODF)
907 		h->ip_off &= htons(~IP_DF);
908 
909 	/* We will need other tests here */
910 	if (!fragoff && !mff)
911 		goto no_fragment;
912 
913 	/* We're dealing with a fragment now. Don't allow fragments
914 	 * with IP_DF to enter the cache. If the flag was cleared by
915 	 * no-df above, fine. Otherwise drop it.
916 	 */
917 	if (h->ip_off & htons(IP_DF)) {
918 		DPFPRINTF(("IP_DF\n"));
919 		goto bad;
920 	}
921 
922 	ip_len = ntohs(h->ip_len) - hlen;
923 	ip_off = (ntohs(h->ip_off) & IP_OFFMASK) << 3;
924 
925 	/* All fragments are 8 byte aligned */
926 	if (mff && (ip_len & 0x7)) {
927 		DPFPRINTF(("mff and %d\n", ip_len));
928 		goto bad;
929 	}
930 
931 	/* Respect maximum length */
932 	if (fragoff + ip_len > IP_MAXPACKET) {
933 		DPFPRINTF(("max packet %d\n", fragoff + ip_len));
934 		goto bad;
935 	}
936 	max = fragoff + ip_len;
937 
938 	if ((r->rule_flag & (PFRULE_FRAGCROP|PFRULE_FRAGDROP)) == 0) {
939 		/* Fully buffer all of the fragments */
940 
941 		frag = pf_find_fragment(h, &pf_frag_tree);
942 
943 		/* Check if we saw the last fragment already */
944 		if (frag != NULL && (frag->fr_flags & PFFRAG_SEENLAST) &&
945 		    max > frag->fr_max)
946 			goto bad;
947 
948 		/* Get an entry for the fragment queue */
949 		frent = pool_get(&pf_frent_pl, PR_NOWAIT);
950 		if (frent == NULL) {
951 			REASON_SET(reason, PFRES_MEMORY);
952 			return (PF_DROP);
953 		}
954 		pf_nfrents++;
955 		frent->fr_ip = h;
956 		frent->fr_m = m;
957 
958 		/* Might return a completely reassembled mbuf, or NULL */
959 		DPFPRINTF(("reass frag %d @ %d-%d\n", h->ip_id, fragoff, max));
960 		*m0 = m = pf_reassemble(m0, &frag, frent, mff);
961 
962 		if (m == NULL)
963 			return (PF_DROP);
964 
965 		if (frag != NULL && (frag->fr_flags & PFFRAG_DROP))
966 			goto drop;
967 
968 		h = mtod(m, struct ip *);
969 	} else {
970 		/* non-buffering fragment cache (drops or masks overlaps) */
971 		int	nomem = 0;
972 
973 		if (dir == PF_OUT) {
974 			if (m_tag_find(m, PACKET_TAG_PF_FRAGCACHE, NULL) !=
975 			    NULL) {
976 				/* Already passed the fragment cache in the
977 				 * input direction.  If we continued, it would
978 				 * appear to be a dup and would be dropped.
979 				 */
980 				goto fragment_pass;
981 			}
982 		}
983 
984 		frag = pf_find_fragment(h, &pf_cache_tree);
985 
986 		/* Check if we saw the last fragment already */
987 		if (frag != NULL && (frag->fr_flags & PFFRAG_SEENLAST) &&
988 		    max > frag->fr_max) {
989 			if (r->rule_flag & PFRULE_FRAGDROP)
990 				frag->fr_flags |= PFFRAG_DROP;
991 			goto bad;
992 		}
993 
994 		*m0 = m = pf_fragcache(m0, h, &frag, mff,
995 		    (r->rule_flag & PFRULE_FRAGDROP) ? 1 : 0, &nomem);
996 		if (m == NULL) {
997 			if (nomem)
998 				goto no_mem;
999 			goto drop;
1000 		}
1001 
1002 		if (dir == PF_IN) {
1003 			struct m_tag	*mtag;
1004 
1005 			mtag = m_tag_get(PACKET_TAG_PF_FRAGCACHE, 0, M_NOWAIT);
1006 			if (mtag == NULL)
1007 				goto no_mem;
1008 			m_tag_prepend(m, mtag);
1009 		}
1010 		if (frag != NULL && (frag->fr_flags & PFFRAG_DROP))
1011 			goto drop;
1012 		goto fragment_pass;
1013 	}
1014 
1015  no_fragment:
1016 	/* At this point, only IP_DF is allowed in ip_off */
1017 	h->ip_off &= htons(IP_DF);
1018 
1019 	/* Enforce a minimum ttl, may cause endless packet loops */
1020 	if (r->min_ttl && h->ip_ttl < r->min_ttl)
1021 		h->ip_ttl = r->min_ttl;
1022 
1023 	if (r->rule_flag & PFRULE_RANDOMID) {
1024 		u_int16_t ip_id = h->ip_id;
1025 
1026 		h->ip_id = ip_randomid();
1027 		h->ip_sum = pf_cksum_fixup(h->ip_sum, ip_id, h->ip_id, 0);
1028 	}
1029 	if ((r->rule_flag & (PFRULE_FRAGCROP|PFRULE_FRAGDROP)) == 0)
1030 		pd->flags |= PFDESC_IP_REAS;
1031 
1032 	return (PF_PASS);
1033 
1034  fragment_pass:
1035 	/* Enforce a minimum ttl, may cause endless packet loops */
1036 	if (r->min_ttl && h->ip_ttl < r->min_ttl)
1037 		h->ip_ttl = r->min_ttl;
1038 	if ((r->rule_flag & (PFRULE_FRAGCROP|PFRULE_FRAGDROP)) == 0)
1039 		pd->flags |= PFDESC_IP_REAS;
1040 	return (PF_PASS);
1041 
1042  no_mem:
1043 	REASON_SET(reason, PFRES_MEMORY);
1044 	if (r != NULL && r->log)
1045 		PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL);
1046 	return (PF_DROP);
1047 
1048  drop:
1049 	REASON_SET(reason, PFRES_NORM);
1050 	if (r != NULL && r->log)
1051 		PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL);
1052 	return (PF_DROP);
1053 
1054  bad:
1055 	DPFPRINTF(("dropping bad fragment\n"));
1056 
1057 	/* Free associated fragments */
1058 	if (frag != NULL)
1059 		pf_free_fragment(frag);
1060 
1061 	REASON_SET(reason, PFRES_FRAG);
1062 	if (r != NULL && r->log)
1063 		PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL);
1064 
1065 	return (PF_DROP);
1066 }
1067 
1068 #ifdef INET6
1069 int
1070 pf_normalize_ip6(struct mbuf **m0, int dir, struct pfi_kif *kif,
1071     u_short *reason, struct pf_pdesc *pd)
1072 {
1073 	struct mbuf		*m = *m0;
1074 	struct pf_rule		*r;
1075 	struct ip6_hdr		*h = mtod(m, struct ip6_hdr *);
1076 	int			 off;
1077 	struct ip6_ext		 ext;
1078 	struct ip6_opt		 opt;
1079 	struct ip6_opt_jumbo	 jumbo;
1080 	struct ip6_frag		 frag;
1081 	u_int32_t		 jumbolen = 0, plen;
1082 	u_int16_t		 fragoff = 0;
1083 	int			 optend;
1084 	int			 ooff;
1085 	u_int8_t		 proto;
1086 	int			 terminal;
1087 
1088 	r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr);
1089 	while (r != NULL) {
1090 		r->evaluations++;
1091 		if (r->kif != NULL &&
1092 		    (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot)
1093 			r = r->skip[PF_SKIP_IFP].ptr;
1094 		else if (r->direction && r->direction != dir)
1095 			r = r->skip[PF_SKIP_DIR].ptr;
1096 		else if (r->af && r->af != AF_INET6)
1097 			r = r->skip[PF_SKIP_AF].ptr;
1098 #if 0 /* header chain! */
1099 		else if (r->proto && r->proto != h->ip6_nxt)
1100 			r = r->skip[PF_SKIP_PROTO].ptr;
1101 #endif
1102 		else if (PF_MISMATCHAW(&r->src.addr,
1103 		    (struct pf_addr *)&h->ip6_src, AF_INET6, r->src.neg))
1104 			r = r->skip[PF_SKIP_SRC_ADDR].ptr;
1105 		else if (PF_MISMATCHAW(&r->dst.addr,
1106 		    (struct pf_addr *)&h->ip6_dst, AF_INET6, r->dst.neg))
1107 			r = r->skip[PF_SKIP_DST_ADDR].ptr;
1108 		else
1109 			break;
1110 	}
1111 
1112 	if (r == NULL)
1113 		return (PF_PASS);
1114 	else
1115 		r->packets++;
1116 
1117 	/* Check for illegal packets */
1118 	if (sizeof(struct ip6_hdr) + IPV6_MAXPACKET < m->m_pkthdr.len)
1119 		goto drop;
1120 
1121 	off = sizeof(struct ip6_hdr);
1122 	proto = h->ip6_nxt;
1123 	terminal = 0;
1124 	do {
1125 		switch (proto) {
1126 		case IPPROTO_FRAGMENT:
1127 			goto fragment;
1128 			break;
1129 		case IPPROTO_AH:
1130 		case IPPROTO_ROUTING:
1131 		case IPPROTO_DSTOPTS:
1132 			if (!pf_pull_hdr(m, off, &ext, sizeof(ext), NULL,
1133 			    NULL, AF_INET6))
1134 				goto shortpkt;
1135 			if (proto == IPPROTO_AH)
1136 				off += (ext.ip6e_len + 2) * 4;
1137 			else
1138 				off += (ext.ip6e_len + 1) * 8;
1139 			proto = ext.ip6e_nxt;
1140 			break;
1141 		case IPPROTO_HOPOPTS:
1142 			if (!pf_pull_hdr(m, off, &ext, sizeof(ext), NULL,
1143 			    NULL, AF_INET6))
1144 				goto shortpkt;
1145 			optend = off + (ext.ip6e_len + 1) * 8;
1146 			ooff = off + sizeof(ext);
1147 			do {
1148 				if (!pf_pull_hdr(m, ooff, &opt.ip6o_type,
1149 				    sizeof(opt.ip6o_type), NULL, NULL,
1150 				    AF_INET6))
1151 					goto shortpkt;
1152 				if (opt.ip6o_type == IP6OPT_PAD1) {
1153 					ooff++;
1154 					continue;
1155 				}
1156 				if (!pf_pull_hdr(m, ooff, &opt, sizeof(opt),
1157 				    NULL, NULL, AF_INET6))
1158 					goto shortpkt;
1159 				if (ooff + sizeof(opt) + opt.ip6o_len > optend)
1160 					goto drop;
1161 				switch (opt.ip6o_type) {
1162 				case IP6OPT_JUMBO:
1163 					if (h->ip6_plen != 0)
1164 						goto drop;
1165 					if (!pf_pull_hdr(m, ooff, &jumbo,
1166 					    sizeof(jumbo), NULL, NULL,
1167 					    AF_INET6))
1168 						goto shortpkt;
1169 					memcpy(&jumbolen, jumbo.ip6oj_jumbo_len,
1170 					    sizeof(jumbolen));
1171 					jumbolen = ntohl(jumbolen);
1172 					if (jumbolen <= IPV6_MAXPACKET)
1173 						goto drop;
1174 					if (sizeof(struct ip6_hdr) + jumbolen !=
1175 					    m->m_pkthdr.len)
1176 						goto drop;
1177 					break;
1178 				default:
1179 					break;
1180 				}
1181 				ooff += sizeof(opt) + opt.ip6o_len;
1182 			} while (ooff < optend);
1183 
1184 			off = optend;
1185 			proto = ext.ip6e_nxt;
1186 			break;
1187 		default:
1188 			terminal = 1;
1189 			break;
1190 		}
1191 	} while (!terminal);
1192 
1193 	/* jumbo payload option must be present, or plen > 0 */
1194 	if (ntohs(h->ip6_plen) == 0)
1195 		plen = jumbolen;
1196 	else
1197 		plen = ntohs(h->ip6_plen);
1198 	if (plen == 0)
1199 		goto drop;
1200 	if (sizeof(struct ip6_hdr) + plen > m->m_pkthdr.len)
1201 		goto shortpkt;
1202 
1203 	/* Enforce a minimum ttl, may cause endless packet loops */
1204 	if (r->min_ttl && h->ip6_hlim < r->min_ttl)
1205 		h->ip6_hlim = r->min_ttl;
1206 
1207 	return (PF_PASS);
1208 
1209  fragment:
1210 	if (ntohs(h->ip6_plen) == 0 || jumbolen)
1211 		goto drop;
1212 	plen = ntohs(h->ip6_plen);
1213 
1214 	if (!pf_pull_hdr(m, off, &frag, sizeof(frag), NULL, NULL, AF_INET6))
1215 		goto shortpkt;
1216 	fragoff = ntohs(frag.ip6f_offlg & IP6F_OFF_MASK);
1217 	if (fragoff + (plen - off - sizeof(frag)) > IPV6_MAXPACKET)
1218 		goto badfrag;
1219 
1220 	/* do something about it */
1221 	/* remember to set pd->flags |= PFDESC_IP_REAS */
1222 	return (PF_PASS);
1223 
1224  shortpkt:
1225 	REASON_SET(reason, PFRES_SHORT);
1226 	if (r != NULL && r->log)
1227 		PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL);
1228 	return (PF_DROP);
1229 
1230  drop:
1231 	REASON_SET(reason, PFRES_NORM);
1232 	if (r != NULL && r->log)
1233 		PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL);
1234 	return (PF_DROP);
1235 
1236  badfrag:
1237 	REASON_SET(reason, PFRES_FRAG);
1238 	if (r != NULL && r->log)
1239 		PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL);
1240 	return (PF_DROP);
1241 }
1242 #endif /* INET6 */
1243 
1244 int
1245 pf_normalize_tcp(int dir, struct pfi_kif *kif, struct mbuf *m,
1246     int ipoff, int off, void *h, struct pf_pdesc *pd)
1247 {
1248 	struct pf_rule	*r, *rm = NULL;
1249 	struct tcphdr	*th = pd->hdr.tcp;
1250 	int		 rewrite = 0;
1251 	u_short		 reason;
1252 	u_int8_t	 flags;
1253 	sa_family_t	 af = pd->af;
1254 
1255 	r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr);
1256 	while (r != NULL) {
1257 		r->evaluations++;
1258 		if (r->kif != NULL &&
1259 		    (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot)
1260 			r = r->skip[PF_SKIP_IFP].ptr;
1261 		else if (r->direction && r->direction != dir)
1262 			r = r->skip[PF_SKIP_DIR].ptr;
1263 		else if (r->af && r->af != af)
1264 			r = r->skip[PF_SKIP_AF].ptr;
1265 		else if (r->proto && r->proto != pd->proto)
1266 			r = r->skip[PF_SKIP_PROTO].ptr;
1267 		else if (PF_MISMATCHAW(&r->src.addr, pd->src, af, r->src.neg))
1268 			r = r->skip[PF_SKIP_SRC_ADDR].ptr;
1269 		else if (r->src.port_op && !pf_match_port(r->src.port_op,
1270 			    r->src.port[0], r->src.port[1], th->th_sport))
1271 			r = r->skip[PF_SKIP_SRC_PORT].ptr;
1272 		else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af, r->dst.neg))
1273 			r = r->skip[PF_SKIP_DST_ADDR].ptr;
1274 		else if (r->dst.port_op && !pf_match_port(r->dst.port_op,
1275 			    r->dst.port[0], r->dst.port[1], th->th_dport))
1276 			r = r->skip[PF_SKIP_DST_PORT].ptr;
1277 		else if (r->os_fingerprint != PF_OSFP_ANY && !pf_osfp_match(
1278 			    pf_osfp_fingerprint(pd, m, off, th),
1279 			    r->os_fingerprint))
1280 			r = TAILQ_NEXT(r, entries);
1281 		else {
1282 			rm = r;
1283 			break;
1284 		}
1285 	}
1286 
1287 	if (rm == NULL || rm->action == PF_NOSCRUB)
1288 		return (PF_PASS);
1289 	else
1290 		r->packets++;
1291 
1292 	if (rm->rule_flag & PFRULE_REASSEMBLE_TCP)
1293 		pd->flags |= PFDESC_TCP_NORM;
1294 
1295 	flags = th->th_flags;
1296 	if (flags & TH_SYN) {
1297 		/* Illegal packet */
1298 		if (flags & TH_RST)
1299 			goto tcp_drop;
1300 
1301 		if (flags & TH_FIN)
1302 			flags &= ~TH_FIN;
1303 	} else {
1304 		/* Illegal packet */
1305 		if (!(flags & (TH_ACK|TH_RST)))
1306 			goto tcp_drop;
1307 	}
1308 
1309 	if (!(flags & TH_ACK)) {
1310 		/* These flags are only valid if ACK is set */
1311 		if ((flags & TH_FIN) || (flags & TH_PUSH) || (flags & TH_URG))
1312 			goto tcp_drop;
1313 	}
1314 
1315 	/* Check for illegal header length */
1316 	if (th->th_off < (sizeof(struct tcphdr) >> 2))
1317 		goto tcp_drop;
1318 
1319 	/* If flags changed, or reserved data set, then adjust */
1320 	if (flags != th->th_flags || th->th_x2 != 0) {
1321 		u_int16_t	ov, nv;
1322 
1323 		ov = *(u_int16_t *)(&th->th_ack + 1);
1324 		th->th_flags = flags;
1325 		th->th_x2 = 0;
1326 		nv = *(u_int16_t *)(&th->th_ack + 1);
1327 
1328 		th->th_sum = pf_cksum_fixup(th->th_sum, ov, nv, 0);
1329 		rewrite = 1;
1330 	}
1331 
1332 	/* Remove urgent pointer, if TH_URG is not set */
1333 	if (!(flags & TH_URG) && th->th_urp) {
1334 		th->th_sum = pf_cksum_fixup(th->th_sum, th->th_urp, 0, 0);
1335 		th->th_urp = 0;
1336 		rewrite = 1;
1337 	}
1338 
1339 	/* Process options */
1340 	if (r->max_mss && pf_normalize_tcpopt(r, m, th, off))
1341 		rewrite = 1;
1342 
1343 	/* copy back packet headers if we sanitized */
1344 	if (rewrite)
1345 		m_copyback(m, off, sizeof(*th), th);
1346 
1347 	return (PF_PASS);
1348 
1349  tcp_drop:
1350 	REASON_SET(&reason, PFRES_NORM);
1351 	if (rm != NULL && r->log)
1352 		PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, r, NULL, NULL);
1353 	return (PF_DROP);
1354 }
1355 
1356 int
1357 pf_normalize_tcp_init(struct mbuf *m, int off, struct pf_pdesc *pd,
1358     struct tcphdr *th, struct pf_state_peer *src,
1359     struct pf_state_peer *dst)
1360 {
1361 	u_int32_t tsval, tsecr;
1362 	u_int8_t hdr[60];
1363 	u_int8_t *opt;
1364 
1365 	KASSERT(src->scrub == NULL);
1366 
1367 	src->scrub = pool_get(&pf_state_scrub_pl, PR_NOWAIT);
1368 	if (src->scrub == NULL)
1369 		return (1);
1370 	bzero(src->scrub, sizeof(*src->scrub));
1371 
1372 	switch (pd->af) {
1373 #ifdef INET
1374 	case AF_INET: {
1375 		struct ip *h = mtod(m, struct ip *);
1376 		src->scrub->pfss_ttl = h->ip_ttl;
1377 		break;
1378 	}
1379 #endif /* INET */
1380 #ifdef INET6
1381 	case AF_INET6: {
1382 		struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
1383 		src->scrub->pfss_ttl = h->ip6_hlim;
1384 		break;
1385 	}
1386 #endif /* INET6 */
1387 	}
1388 
1389 
1390 	/*
1391 	 * All normalizations below are only begun if we see the start of
1392 	 * the connections.  They must all set an enabled bit in pfss_flags
1393 	 */
1394 	if ((th->th_flags & TH_SYN) == 0)
1395 		return (0);
1396 
1397 
1398 	if (th->th_off > (sizeof(struct tcphdr) >> 2) && src->scrub &&
1399 	    pf_pull_hdr(m, off, hdr, th->th_off << 2, NULL, NULL, pd->af)) {
1400 		/* Diddle with TCP options */
1401 		int hlen;
1402 		opt = hdr + sizeof(struct tcphdr);
1403 		hlen = (th->th_off << 2) - sizeof(struct tcphdr);
1404 		while (hlen >= TCPOLEN_TIMESTAMP) {
1405 			switch (*opt) {
1406 			case TCPOPT_EOL:	/* FALLTHROUGH */
1407 			case TCPOPT_NOP:
1408 				opt++;
1409 				hlen--;
1410 				break;
1411 			case TCPOPT_TIMESTAMP:
1412 				if (opt[1] >= TCPOLEN_TIMESTAMP) {
1413 					src->scrub->pfss_flags |=
1414 					    PFSS_TIMESTAMP;
1415 					src->scrub->pfss_ts_mod =
1416 					    htonl(arc4random());
1417 
1418 					/* note PFSS_PAWS not set yet */
1419 					memcpy(&tsval, &opt[2],
1420 					    sizeof(u_int32_t));
1421 					memcpy(&tsecr, &opt[6],
1422 					    sizeof(u_int32_t));
1423 					src->scrub->pfss_tsval0 = ntohl(tsval);
1424 					src->scrub->pfss_tsval = ntohl(tsval);
1425 					src->scrub->pfss_tsecr = ntohl(tsecr);
1426 					getmicrouptime(&src->scrub->pfss_last);
1427 				}
1428 				/* FALLTHROUGH */
1429 			default:
1430 				hlen -= MAX(opt[1], 2);
1431 				opt += MAX(opt[1], 2);
1432 				break;
1433 			}
1434 		}
1435 	}
1436 
1437 	return (0);
1438 }
1439 
1440 void
1441 pf_normalize_tcp_cleanup(struct pf_state *state)
1442 {
1443 	if (state->src.scrub)
1444 		pool_put(&pf_state_scrub_pl, state->src.scrub);
1445 	if (state->dst.scrub)
1446 		pool_put(&pf_state_scrub_pl, state->dst.scrub);
1447 
1448 	/* Someday... flush the TCP segment reassembly descriptors. */
1449 }
1450 
1451 int
1452 pf_normalize_tcp_stateful(struct mbuf *m, int off, struct pf_pdesc *pd,
1453     u_short *reason, struct tcphdr *th, struct pf_state *state,
1454     struct pf_state_peer *src, struct pf_state_peer *dst, int *writeback)
1455 {
1456 	struct timeval uptime;
1457 	u_int32_t tsval, tsecr;
1458 	u_int tsval_from_last;
1459 	u_int8_t hdr[60];
1460 	u_int8_t *opt;
1461 	int copyback = 0;
1462 	int got_ts = 0;
1463 
1464 	KASSERT(src->scrub || dst->scrub);
1465 
1466 	/*
1467 	 * Enforce the minimum TTL seen for this connection.  Negate a common
1468 	 * technique to evade an intrusion detection system and confuse
1469 	 * firewall state code.
1470 	 */
1471 	switch (pd->af) {
1472 #ifdef INET
1473 	case AF_INET: {
1474 		if (src->scrub) {
1475 			struct ip *h = mtod(m, struct ip *);
1476 			if (h->ip_ttl > src->scrub->pfss_ttl)
1477 				src->scrub->pfss_ttl = h->ip_ttl;
1478 			h->ip_ttl = src->scrub->pfss_ttl;
1479 		}
1480 		break;
1481 	}
1482 #endif /* INET */
1483 #ifdef INET6
1484 	case AF_INET6: {
1485 		if (src->scrub) {
1486 			struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
1487 			if (h->ip6_hlim > src->scrub->pfss_ttl)
1488 				src->scrub->pfss_ttl = h->ip6_hlim;
1489 			h->ip6_hlim = src->scrub->pfss_ttl;
1490 		}
1491 		break;
1492 	}
1493 #endif /* INET6 */
1494 	}
1495 
1496 	if (th->th_off > (sizeof(struct tcphdr) >> 2) &&
1497 	    ((src->scrub && (src->scrub->pfss_flags & PFSS_TIMESTAMP)) ||
1498 	    (dst->scrub && (dst->scrub->pfss_flags & PFSS_TIMESTAMP))) &&
1499 	    pf_pull_hdr(m, off, hdr, th->th_off << 2, NULL, NULL, pd->af)) {
1500 		/* Diddle with TCP options */
1501 		int hlen;
1502 		opt = hdr + sizeof(struct tcphdr);
1503 		hlen = (th->th_off << 2) - sizeof(struct tcphdr);
1504 		while (hlen >= TCPOLEN_TIMESTAMP) {
1505 			switch (*opt) {
1506 			case TCPOPT_EOL:	/* FALLTHROUGH */
1507 			case TCPOPT_NOP:
1508 				opt++;
1509 				hlen--;
1510 				break;
1511 			case TCPOPT_TIMESTAMP:
1512 				/* Modulate the timestamps.  Can be used for
1513 				 * NAT detection, OS uptime determination or
1514 				 * reboot detection.
1515 				 */
1516 
1517 				if (got_ts) {
1518 					/* Huh?  Multiple timestamps!? */
1519 					if (pf_status.debug >= PF_DEBUG_MISC) {
1520 						DPFPRINTF(("multiple TS??"));
1521 						pf_print_state(state);
1522 						printf("\n");
1523 					}
1524 					REASON_SET(reason, PFRES_TS);
1525 					return (PF_DROP);
1526 				}
1527 				if (opt[1] >= TCPOLEN_TIMESTAMP) {
1528 					memcpy(&tsval, &opt[2],
1529 					    sizeof(u_int32_t));
1530 					if (tsval && src->scrub &&
1531 					    (src->scrub->pfss_flags &
1532 					    PFSS_TIMESTAMP)) {
1533 						tsval = ntohl(tsval);
1534 						pf_change_a(&opt[2],
1535 						    &th->th_sum,
1536 						    htonl(tsval +
1537 						    src->scrub->pfss_ts_mod),
1538 						    0);
1539 						copyback = 1;
1540 					}
1541 
1542 					/* Modulate TS reply iff valid (!0) */
1543 					memcpy(&tsecr, &opt[6],
1544 					    sizeof(u_int32_t));
1545 					if (tsecr && dst->scrub &&
1546 					    (dst->scrub->pfss_flags &
1547 					    PFSS_TIMESTAMP)) {
1548 						tsecr = ntohl(tsecr)
1549 						    - dst->scrub->pfss_ts_mod;
1550 						pf_change_a(&opt[6],
1551 						    &th->th_sum, htonl(tsecr),
1552 						    0);
1553 						copyback = 1;
1554 					}
1555 					got_ts = 1;
1556 				}
1557 				/* FALLTHROUGH */
1558 			default:
1559 				hlen -= MAX(opt[1], 2);
1560 				opt += MAX(opt[1], 2);
1561 				break;
1562 			}
1563 		}
1564 		if (copyback) {
1565 			/* Copyback the options, caller copys back header */
1566 			*writeback = 1;
1567 			m_copyback(m, off + sizeof(struct tcphdr),
1568 			    (th->th_off << 2) - sizeof(struct tcphdr), hdr +
1569 			    sizeof(struct tcphdr));
1570 		}
1571 	}
1572 
1573 
1574 	/*
1575 	 * Must invalidate PAWS checks on connections idle for too long.
1576 	 * The fastest allowed timestamp clock is 1ms.  That turns out to
1577 	 * be about 24 days before it wraps.  XXX Right now our lowerbound
1578 	 * TS echo check only works for the first 12 days of a connection
1579 	 * when the TS has exhausted half its 32bit space
1580 	 */
1581 #define TS_MAX_IDLE	(24*24*60*60)
1582 #define TS_MAX_CONN	(12*24*60*60)	/* XXX remove when better tsecr check */
1583 
1584 	getmicrouptime(&uptime);
1585 	if (src->scrub && (src->scrub->pfss_flags & PFSS_PAWS) &&
1586 	    (uptime.tv_sec - src->scrub->pfss_last.tv_sec > TS_MAX_IDLE ||
1587 	    time_second - state->creation > TS_MAX_CONN))  {
1588 		if (pf_status.debug >= PF_DEBUG_MISC) {
1589 			DPFPRINTF(("src idled out of PAWS\n"));
1590 			pf_print_state(state);
1591 			printf("\n");
1592 		}
1593 		src->scrub->pfss_flags = (src->scrub->pfss_flags & ~PFSS_PAWS)
1594 		    | PFSS_PAWS_IDLED;
1595 	}
1596 	if (dst->scrub && (dst->scrub->pfss_flags & PFSS_PAWS) &&
1597 	    uptime.tv_sec - dst->scrub->pfss_last.tv_sec > TS_MAX_IDLE) {
1598 		if (pf_status.debug >= PF_DEBUG_MISC) {
1599 			DPFPRINTF(("dst idled out of PAWS\n"));
1600 			pf_print_state(state);
1601 			printf("\n");
1602 		}
1603 		dst->scrub->pfss_flags = (dst->scrub->pfss_flags & ~PFSS_PAWS)
1604 		    | PFSS_PAWS_IDLED;
1605 	}
1606 
1607 	if (got_ts && src->scrub && dst->scrub &&
1608 	    (src->scrub->pfss_flags & PFSS_PAWS) &&
1609 	    (dst->scrub->pfss_flags & PFSS_PAWS)) {
1610 		/* Validate that the timestamps are "in-window".
1611 		 * RFC1323 describes TCP Timestamp options that allow
1612 		 * measurement of RTT (round trip time) and PAWS
1613 		 * (protection against wrapped sequence numbers).  PAWS
1614 		 * gives us a set of rules for rejecting packets on
1615 		 * long fat pipes (packets that were somehow delayed
1616 		 * in transit longer than the time it took to send the
1617 		 * full TCP sequence space of 4Gb).  We can use these
1618 		 * rules and infer a few others that will let us treat
1619 		 * the 32bit timestamp and the 32bit echoed timestamp
1620 		 * as sequence numbers to prevent a blind attacker from
1621 		 * inserting packets into a connection.
1622 		 *
1623 		 * RFC1323 tells us:
1624 		 *  - The timestamp on this packet must be greater than
1625 		 *    or equal to the last value echoed by the other
1626 		 *    endpoint.  The RFC says those will be discarded
1627 		 *    since it is a dup that has already been acked.
1628 		 *    This gives us a lowerbound on the timestamp.
1629 		 *        timestamp >= other last echoed timestamp
1630 		 *  - The timestamp will be less than or equal to
1631 		 *    the last timestamp plus the time between the
1632 		 *    last packet and now.  The RFC defines the max
1633 		 *    clock rate as 1ms.  We will allow clocks to be
1634 		 *    up to 10% fast and will allow a total difference
1635 		 *    or 30 seconds due to a route change.  And this
1636 		 *    gives us an upperbound on the timestamp.
1637 		 *        timestamp <= last timestamp + max ticks
1638 		 *    We have to be careful here.  Windows will send an
1639 		 *    initial timestamp of zero and then initialize it
1640 		 *    to a random value after the 3whs; presumably to
1641 		 *    avoid a DoS by having to call an expensive RNG
1642 		 *    during a SYN flood.  Proof MS has at least one
1643 		 *    good security geek.
1644 		 *
1645 		 *  - The TCP timestamp option must also echo the other
1646 		 *    endpoints timestamp.  The timestamp echoed is the
1647 		 *    one carried on the earliest unacknowledged segment
1648 		 *    on the left edge of the sequence window.  The RFC
1649 		 *    states that the host will reject any echoed
1650 		 *    timestamps that were larger than any ever sent.
1651 		 *    This gives us an upperbound on the TS echo.
1652 		 *        tescr <= largest_tsval
1653 		 *  - The lowerbound on the TS echo is a little more
1654 		 *    tricky to determine.  The other endpoint's echoed
1655 		 *    values will not decrease.  But there may be
1656 		 *    network conditions that re-order packets and
1657 		 *    cause our view of them to decrease.  For now the
1658 		 *    only lowerbound we can safely determine is that
1659 		 *    the TS echo will never be less than the orginal
1660 		 *    TS.  XXX There is probably a better lowerbound.
1661 		 *    Remove TS_MAX_CONN with better lowerbound check.
1662 		 *        tescr >= other original TS
1663 		 *
1664 		 * It is also important to note that the fastest
1665 		 * timestamp clock of 1ms will wrap its 32bit space in
1666 		 * 24 days.  So we just disable TS checking after 24
1667 		 * days of idle time.  We actually must use a 12d
1668 		 * connection limit until we can come up with a better
1669 		 * lowerbound to the TS echo check.
1670 		 */
1671 		struct timeval delta_ts;
1672 		int ts_fudge;
1673 
1674 
1675 		/*
1676 		 * PFTM_TS_DIFF is how many seconds of leeway to allow
1677 		 * a host's timestamp.  This can happen if the previous
1678 		 * packet got delayed in transit for much longer than
1679 		 * this packet.
1680 		 */
1681 		if ((ts_fudge = state->rule.ptr->timeout[PFTM_TS_DIFF]) == 0)
1682 			ts_fudge = pf_default_rule.timeout[PFTM_TS_DIFF];
1683 
1684 
1685 		/* Calculate max ticks since the last timestamp */
1686 #define TS_MAXFREQ	1100		/* RFC max TS freq of 1 kHz + 10% skew */
1687 #define TS_MICROSECS	1000000		/* microseconds per second */
1688 		timersub(&uptime, &src->scrub->pfss_last, &delta_ts);
1689 		tsval_from_last = (delta_ts.tv_sec + ts_fudge) * TS_MAXFREQ;
1690 		tsval_from_last += delta_ts.tv_usec / (TS_MICROSECS/TS_MAXFREQ);
1691 
1692 
1693 		if ((src->state >= TCPS_ESTABLISHED &&
1694 		    dst->state >= TCPS_ESTABLISHED) &&
1695 		    (SEQ_LT(tsval, dst->scrub->pfss_tsecr) ||
1696 		    SEQ_GT(tsval, src->scrub->pfss_tsval + tsval_from_last) ||
1697 		    (tsecr && (SEQ_GT(tsecr, dst->scrub->pfss_tsval) ||
1698 		    SEQ_LT(tsecr, dst->scrub->pfss_tsval0))))) {
1699 			/* Bad RFC1323 implementation or an insertion attack.
1700 			 *
1701 			 * - Solaris 2.6 and 2.7 are known to send another ACK
1702 			 *   after the FIN,FIN|ACK,ACK closing that carries
1703 			 *   an old timestamp.
1704 			 */
1705 
1706 			DPFPRINTF(("Timestamp failed %c%c%c%c\n",
1707 			    SEQ_LT(tsval, dst->scrub->pfss_tsecr) ? '0' : ' ',
1708 			    SEQ_GT(tsval, src->scrub->pfss_tsval +
1709 			    tsval_from_last) ? '1' : ' ',
1710 			    SEQ_GT(tsecr, dst->scrub->pfss_tsval) ? '2' : ' ',
1711 			    SEQ_LT(tsecr, dst->scrub->pfss_tsval0)? '3' : ' '));
1712 			DPFPRINTF((" tsval: %" PRIu32 "  tsecr: %" PRIu32
1713 			    "  +ticks: %" PRIu32 "  idle: %lus %lums\n",
1714 			    tsval, tsecr, tsval_from_last, delta_ts.tv_sec,
1715 			    delta_ts.tv_usec / 1000));
1716 			DPFPRINTF((" src->tsval: %" PRIu32 "  tsecr: %" PRIu32
1717 			    "\n",
1718 			    src->scrub->pfss_tsval, src->scrub->pfss_tsecr));
1719 			DPFPRINTF((" dst->tsval: %" PRIu32 "  tsecr: %" PRIu32
1720 			    "  tsval0: %" PRIu32 "\n",
1721 			    dst->scrub->pfss_tsval,
1722 			    dst->scrub->pfss_tsecr, dst->scrub->pfss_tsval0));
1723 			if (pf_status.debug >= PF_DEBUG_MISC) {
1724 				pf_print_state(state);
1725 				pf_print_flags(th->th_flags);
1726 				printf("\n");
1727 			}
1728 			REASON_SET(reason, PFRES_TS);
1729 			return (PF_DROP);
1730 		}
1731 
1732 		/* XXX I'd really like to require tsecr but it's optional */
1733 
1734 	} else if (!got_ts && (th->th_flags & TH_RST) == 0 &&
1735 	    ((src->state == TCPS_ESTABLISHED && dst->state == TCPS_ESTABLISHED)
1736 	    || pd->p_len > 0 || (th->th_flags & TH_SYN)) &&
1737 	    src->scrub && dst->scrub &&
1738 	    (src->scrub->pfss_flags & PFSS_PAWS) &&
1739 	    (dst->scrub->pfss_flags & PFSS_PAWS)) {
1740 		/* Didn't send a timestamp.  Timestamps aren't really useful
1741 		 * when:
1742 		 *  - connection opening or closing (often not even sent).
1743 		 *    but we must not let an attacker to put a FIN on a
1744 		 *    data packet to sneak it through our ESTABLISHED check.
1745 		 *  - on a TCP reset.  RFC suggests not even looking at TS.
1746 		 *  - on an empty ACK.  The TS will not be echoed so it will
1747 		 *    probably not help keep the RTT calculation in sync and
1748 		 *    there isn't as much danger when the sequence numbers
1749 		 *    got wrapped.  So some stacks don't include TS on empty
1750 		 *    ACKs :-(
1751 		 *
1752 		 * To minimize the disruption to mostly RFC1323 conformant
1753 		 * stacks, we will only require timestamps on data packets.
1754 		 *
1755 		 * And what do ya know, we cannot require timestamps on data
1756 		 * packets.  There appear to be devices that do legitimate
1757 		 * TCP connection hijacking.  There are HTTP devices that allow
1758 		 * a 3whs (with timestamps) and then buffer the HTTP request.
1759 		 * If the intermediate device has the HTTP response cache, it
1760 		 * will spoof the response but not bother timestamping its
1761 		 * packets.  So we can look for the presence of a timestamp in
1762 		 * the first data packet and if there, require it in all future
1763 		 * packets.
1764 		 */
1765 
1766 		if (pd->p_len > 0 && (src->scrub->pfss_flags & PFSS_DATA_TS)) {
1767 			/*
1768 			 * Hey!  Someone tried to sneak a packet in.  Or the
1769 			 * stack changed its RFC1323 behavior?!?!
1770 			 */
1771 			if (pf_status.debug >= PF_DEBUG_MISC) {
1772 				DPFPRINTF(("Did not receive expected RFC1323 "
1773 				    "timestamp\n"));
1774 				pf_print_state(state);
1775 				pf_print_flags(th->th_flags);
1776 				printf("\n");
1777 			}
1778 			REASON_SET(reason, PFRES_TS);
1779 			return (PF_DROP);
1780 		}
1781 	}
1782 
1783 
1784 	/*
1785 	 * We will note if a host sends his data packets with or without
1786 	 * timestamps.  And require all data packets to contain a timestamp
1787 	 * if the first does.  PAWS implicitly requires that all data packets be
1788 	 * timestamped.  But I think there are middle-man devices that hijack
1789 	 * TCP streams immedietly after the 3whs and don't timestamp their
1790 	 * packets (seen in a WWW accelerator or cache).
1791 	 */
1792 	if (pd->p_len > 0 && src->scrub && (src->scrub->pfss_flags &
1793 	    (PFSS_TIMESTAMP|PFSS_DATA_TS|PFSS_DATA_NOTS)) == PFSS_TIMESTAMP) {
1794 		if (got_ts)
1795 			src->scrub->pfss_flags |= PFSS_DATA_TS;
1796 		else {
1797 			src->scrub->pfss_flags |= PFSS_DATA_NOTS;
1798 			if (pf_status.debug >= PF_DEBUG_MISC && dst->scrub &&
1799 			    (dst->scrub->pfss_flags & PFSS_TIMESTAMP)) {
1800 				/* Don't warn if other host rejected RFC1323 */
1801 				DPFPRINTF(("Broken RFC1323 stack did not "
1802 				    "timestamp data packet. Disabled PAWS "
1803 				    "security.\n"));
1804 				pf_print_state(state);
1805 				pf_print_flags(th->th_flags);
1806 				printf("\n");
1807 			}
1808 		}
1809 	}
1810 
1811 
1812 	/*
1813 	 * Update PAWS values
1814 	 */
1815 	if (got_ts && src->scrub && PFSS_TIMESTAMP == (src->scrub->pfss_flags &
1816 	    (PFSS_PAWS_IDLED|PFSS_TIMESTAMP))) {
1817 		getmicrouptime(&src->scrub->pfss_last);
1818 		if (SEQ_GEQ(tsval, src->scrub->pfss_tsval) ||
1819 		    (src->scrub->pfss_flags & PFSS_PAWS) == 0)
1820 			src->scrub->pfss_tsval = tsval;
1821 
1822 		if (tsecr) {
1823 			if (SEQ_GEQ(tsecr, src->scrub->pfss_tsecr) ||
1824 			    (src->scrub->pfss_flags & PFSS_PAWS) == 0)
1825 				src->scrub->pfss_tsecr = tsecr;
1826 
1827 			if ((src->scrub->pfss_flags & PFSS_PAWS) == 0 &&
1828 			    (SEQ_LT(tsval, src->scrub->pfss_tsval0) ||
1829 			    src->scrub->pfss_tsval0 == 0)) {
1830 				/* tsval0 MUST be the lowest timestamp */
1831 				src->scrub->pfss_tsval0 = tsval;
1832 			}
1833 
1834 			/* Only fully initialized after a TS gets echoed */
1835 			if ((src->scrub->pfss_flags & PFSS_PAWS) == 0)
1836 				src->scrub->pfss_flags |= PFSS_PAWS;
1837 		}
1838 	}
1839 
1840 	/* I have a dream....  TCP segment reassembly.... */
1841 	return (0);
1842 }
1843 
1844 int
1845 pf_normalize_tcpopt(struct pf_rule *r, struct mbuf *m, struct tcphdr *th,
1846     int off)
1847 {
1848 	u_int16_t	*mss;
1849 	int		 thoff;
1850 	int		 opt, cnt, optlen = 0;
1851 	int		 rewrite = 0;
1852 	u_char		*optp;
1853 
1854 	thoff = th->th_off << 2;
1855 	cnt = thoff - sizeof(struct tcphdr);
1856 	optp = mtod(m, u_char *) + off + sizeof(struct tcphdr);
1857 
1858 	for (; cnt > 0; cnt -= optlen, optp += optlen) {
1859 		opt = optp[0];
1860 		if (opt == TCPOPT_EOL)
1861 			break;
1862 		if (opt == TCPOPT_NOP)
1863 			optlen = 1;
1864 		else {
1865 			if (cnt < 2)
1866 				break;
1867 			optlen = optp[1];
1868 			if (optlen < 2 || optlen > cnt)
1869 				break;
1870 		}
1871 		switch (opt) {
1872 		case TCPOPT_MAXSEG:
1873 			mss = (u_int16_t *)(optp + 2);
1874 			if ((ntohs(*mss)) > r->max_mss) {
1875 				th->th_sum = pf_cksum_fixup(th->th_sum,
1876 				    *mss, htons(r->max_mss), 0);
1877 				*mss = htons(r->max_mss);
1878 				rewrite = 1;
1879 			}
1880 			break;
1881 		default:
1882 			break;
1883 		}
1884 	}
1885 
1886 	return (rewrite);
1887 }
1888