1 /* $NetBSD: fil.c,v 1.24 2018/07/11 05:25:46 maxv Exp $ */ 2 3 /* 4 * Copyright (C) 2012 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 * 8 * Id: fil.c,v 1.1.1.2 2012/07/22 13:45:07 darrenr Exp $ 9 * 10 */ 11 #if defined(KERNEL) || defined(_KERNEL) 12 # undef KERNEL 13 # undef _KERNEL 14 # define KERNEL 1 15 # define _KERNEL 1 16 #endif 17 #include <sys/errno.h> 18 #include <sys/types.h> 19 #include <sys/param.h> 20 #include <sys/time.h> 21 #if defined(_KERNEL) && defined(__FreeBSD_version) && \ 22 (__FreeBSD_version >= 220000) 23 # if (__FreeBSD_version >= 400000) 24 # if !defined(IPFILTER_LKM) 25 # include "opt_inet6.h" 26 # endif 27 # if (__FreeBSD_version == 400019) 28 # define CSUM_DELAY_DATA 29 # endif 30 # endif 31 # include <sys/filio.h> 32 #else 33 # include <sys/ioctl.h> 34 #endif 35 #if (defined(__SVR4) || defined(__svr4__)) && defined(sun) 36 # include <sys/filio.h> 37 #endif 38 #if !defined(_AIX51) 39 # include <sys/fcntl.h> 40 #endif 41 #if defined(_KERNEL) 42 # include <sys/systm.h> 43 # include <sys/file.h> 44 #else 45 # include <stdio.h> 46 # include <string.h> 47 # include <stdlib.h> 48 # include <stddef.h> 49 # include <sys/file.h> 50 # define _KERNEL 51 # ifdef __OpenBSD__ 52 struct file; 53 # endif 54 # include <sys/uio.h> 55 # undef _KERNEL 56 #endif 57 #if !defined(__SVR4) && !defined(__svr4__) && !defined(__hpux) && \ 58 !defined(linux) 59 # include <sys/mbuf.h> 60 #else 61 # if !defined(linux) 62 # include <sys/byteorder.h> 63 # endif 64 # if (SOLARIS2 < 5) && defined(sun) 65 # include <sys/dditypes.h> 66 # endif 67 #endif 68 #ifdef __hpux 69 # define _NET_ROUTE_INCLUDED 70 #endif 71 #if !defined(linux) 72 # include <sys/protosw.h> 73 #endif 74 #include <sys/socket.h> 75 #include <net/if.h> 76 #ifdef sun 77 # include <net/af.h> 78 #endif 79 #include <netinet/in.h> 80 #include <netinet/in_systm.h> 81 #include <netinet/ip.h> 82 #if defined(__sgi) && defined(IFF_DRVRLOCK) /* IRIX 6 */ 83 # include <sys/hashing.h> 84 # include <netinet/in_var.h> 85 #endif 86 #include <netinet/tcp.h> 87 #if (!defined(__sgi) && !defined(AIX)) || defined(_KERNEL) 88 # include <netinet/udp.h> 89 # include <netinet/ip_icmp.h> 90 #endif 91 #ifdef __hpux 92 # undef _NET_ROUTE_INCLUDED 93 #endif 94 #ifdef __osf__ 95 # undef _RADIX_H_ 96 #endif 97 #include "netinet/ip_compat.h" 98 #ifdef USE_INET6 99 # include <netinet/icmp6.h> 100 # if !SOLARIS && defined(_KERNEL) && !defined(__osf__) && !defined(__hpux) 101 # include <netinet6/in6_var.h> 102 # endif 103 #endif 104 #include "netinet/ip_fil.h" 105 #include "netinet/ip_nat.h" 106 #include "netinet/ip_frag.h" 107 #include "netinet/ip_state.h" 108 #include "netinet/ip_proxy.h" 109 #include "netinet/ip_auth.h" 110 #ifdef IPFILTER_SCAN 111 # include "netinet/ip_scan.h" 112 #endif 113 #include "netinet/ip_sync.h" 114 #include "netinet/ip_lookup.h" 115 #include "netinet/ip_pool.h" 116 #include "netinet/ip_htable.h" 117 #ifdef IPFILTER_COMPILED 118 # include "netinet/ip_rules.h" 119 #endif 120 #if defined(IPFILTER_BPF) && defined(_KERNEL) 121 # include <net/bpf.h> 122 #endif 123 #if defined(__FreeBSD_version) && (__FreeBSD_version >= 300000) 124 # include <sys/malloc.h> 125 #endif 126 #include "netinet/ipl.h" 127 128 #if defined(__NetBSD__) && (__NetBSD_Version__ >= 104230000) 129 # include <sys/callout.h> 130 extern struct callout ipf_slowtimer_ch; 131 #endif 132 #if defined(__OpenBSD__) 133 # include <sys/timeout.h> 134 extern struct timeout ipf_slowtimer_ch; 135 #endif 136 #if defined(__NetBSD__) 137 #include <netinet/in_offload.h> 138 #endif 139 /* END OF INCLUDES */ 140 141 #if !defined(lint) 142 #if defined(__NetBSD__) 143 #include <sys/cdefs.h> 144 __KERNEL_RCSID(0, "$NetBSD: fil.c,v 1.24 2018/07/11 05:25:46 maxv Exp $"); 145 #else 146 static const char sccsid[] = "@(#)fil.c 1.36 6/5/96 (C) 1993-2000 Darren Reed"; 147 static const char rcsid[] = "@(#)Id: fil.c,v 1.1.1.2 2012/07/22 13:45:07 darrenr Exp $"; 148 #endif 149 #endif 150 151 #ifndef _KERNEL 152 # include "ipf.h" 153 # include "ipt.h" 154 extern int opts; 155 extern int blockreason; 156 #endif /* _KERNEL */ 157 158 #define LBUMP(x) softc->x++ 159 #define LBUMPD(x, y) do { softc->x.y++; DT(y); } while (0) 160 161 static INLINE int ipf_check_ipf(fr_info_t *, frentry_t *, int); 162 static u_32_t ipf_checkcipso(fr_info_t *, u_char *, int); 163 static u_32_t ipf_checkripso(u_char *); 164 static u_32_t ipf_decaps(fr_info_t *, u_32_t, int); 165 #ifdef IPFILTER_LOG 166 static frentry_t *ipf_dolog(fr_info_t *, u_32_t *); 167 #endif 168 static int ipf_flushlist(ipf_main_softc_t *, int *, frentry_t **); 169 static int ipf_flush_groups(ipf_main_softc_t *, frgroup_t **, int); 170 static ipfunc_t ipf_findfunc(ipfunc_t); 171 static void *ipf_findlookup(ipf_main_softc_t *, int, frentry_t *, 172 i6addr_t *, i6addr_t *); 173 static frentry_t *ipf_firewall(fr_info_t *, u_32_t *); 174 static int ipf_fr_matcharray(fr_info_t *, int *); 175 static int ipf_frruleiter(ipf_main_softc_t *, void *, int, void *); 176 static void ipf_funcfini(ipf_main_softc_t *, frentry_t *);; 177 static int ipf_funcinit(ipf_main_softc_t *, frentry_t *); 178 static int ipf_geniter(ipf_main_softc_t *, ipftoken_t *, 179 ipfgeniter_t *); 180 static void ipf_getstat(ipf_main_softc_t *, 181 struct friostat *, int); 182 static int ipf_group_flush(ipf_main_softc_t *, frgroup_t *); 183 static void ipf_group_free(frgroup_t *); 184 static int ipf_grpmapfini(struct ipf_main_softc_s *, frentry_t *); 185 static int ipf_grpmapinit(struct ipf_main_softc_s *, frentry_t *); 186 static frentry_t *ipf_nextrule(ipf_main_softc_t *, int, int, 187 frentry_t *, int); 188 static int ipf_portcheck(frpcmp_t *, u_32_t); 189 static INLINE int ipf_pr_ah(fr_info_t *); 190 static INLINE void ipf_pr_esp(fr_info_t *); 191 static INLINE void ipf_pr_gre(fr_info_t *); 192 static INLINE void ipf_pr_udp(fr_info_t *); 193 static INLINE void ipf_pr_tcp(fr_info_t *); 194 static INLINE void ipf_pr_icmp(fr_info_t *); 195 static INLINE void ipf_pr_ipv4hdr(fr_info_t *); 196 static INLINE void ipf_pr_short(fr_info_t *, int); 197 static INLINE int ipf_pr_tcpcommon(fr_info_t *); 198 static INLINE int ipf_pr_udpcommon(fr_info_t *); 199 static void ipf_rule_delete(ipf_main_softc_t *, frentry_t *f, 200 int, int); 201 static void ipf_rule_expire_insert(ipf_main_softc_t *, 202 frentry_t *, int); 203 static int ipf_synclist(ipf_main_softc_t *, frentry_t *, void *); 204 static void ipf_token_flush(ipf_main_softc_t *); 205 static void ipf_token_unlink(ipf_main_softc_t *, ipftoken_t *); 206 static ipftuneable_t *ipf_tune_findbyname(ipftuneable_t *, const char *); 207 static ipftuneable_t *ipf_tune_findbycookie(ipftuneable_t **, void *, 208 void **); 209 static int ipf_updateipid(fr_info_t *); 210 static int ipf_settimeout(struct ipf_main_softc_s *, 211 struct ipftuneable *, ipftuneval_t *); 212 213 214 /* 215 * bit values for identifying presence of individual IP options 216 * All of these tables should be ordered by increasing key value on the left 217 * hand side to allow for binary searching of the array and include a trailer 218 * with a 0 for the bitmask for linear searches to easily find the end with. 219 */ 220 static const struct optlist ipopts[20] = { 221 { IPOPT_NOP, 0x000001 }, 222 { IPOPT_RR, 0x000002 }, 223 { IPOPT_ZSU, 0x000004 }, 224 { IPOPT_MTUP, 0x000008 }, 225 { IPOPT_MTUR, 0x000010 }, 226 { IPOPT_ENCODE, 0x000020 }, 227 { IPOPT_TS, 0x000040 }, 228 { IPOPT_TR, 0x000080 }, 229 { IPOPT_SECURITY, 0x000100 }, 230 { IPOPT_LSRR, 0x000200 }, 231 { IPOPT_E_SEC, 0x000400 }, 232 { IPOPT_CIPSO, 0x000800 }, 233 { IPOPT_SATID, 0x001000 }, 234 { IPOPT_SSRR, 0x002000 }, 235 { IPOPT_ADDEXT, 0x004000 }, 236 { IPOPT_VISA, 0x008000 }, 237 { IPOPT_IMITD, 0x010000 }, 238 { IPOPT_EIP, 0x020000 }, 239 { IPOPT_FINN, 0x040000 }, 240 { 0, 0x000000 } 241 }; 242 243 #ifdef USE_INET6 244 static const struct optlist ip6exthdr[] = { 245 { IPPROTO_HOPOPTS, 0x000001 }, 246 { IPPROTO_IPV6, 0x000002 }, 247 { IPPROTO_ROUTING, 0x000004 }, 248 { IPPROTO_FRAGMENT, 0x000008 }, 249 { IPPROTO_ESP, 0x000010 }, 250 { IPPROTO_AH, 0x000020 }, 251 { IPPROTO_NONE, 0x000040 }, 252 { IPPROTO_DSTOPTS, 0x000080 }, 253 { IPPROTO_MOBILITY, 0x000100 }, 254 { 0, 0 } 255 }; 256 #endif 257 258 /* 259 * bit values for identifying presence of individual IP security options 260 */ 261 static const struct optlist secopt[8] = { 262 { IPSO_CLASS_RES4, 0x01 }, 263 { IPSO_CLASS_TOPS, 0x02 }, 264 { IPSO_CLASS_SECR, 0x04 }, 265 { IPSO_CLASS_RES3, 0x08 }, 266 { IPSO_CLASS_CONF, 0x10 }, 267 { IPSO_CLASS_UNCL, 0x20 }, 268 { IPSO_CLASS_RES2, 0x40 }, 269 { IPSO_CLASS_RES1, 0x80 } 270 }; 271 272 char ipfilter_version[] = IPL_VERSION; 273 274 int ipf_features = 0 275 #ifdef IPFILTER_LKM 276 | IPF_FEAT_LKM 277 #endif 278 #ifdef IPFILTER_LOG 279 | IPF_FEAT_LOG 280 #endif 281 | IPF_FEAT_LOOKUP 282 #ifdef IPFILTER_BPF 283 | IPF_FEAT_BPF 284 #endif 285 #ifdef IPFILTER_COMPILED 286 | IPF_FEAT_COMPILED 287 #endif 288 #ifdef IPFILTER_CKSUM 289 | IPF_FEAT_CKSUM 290 #endif 291 | IPF_FEAT_SYNC 292 #ifdef IPFILTER_SCAN 293 | IPF_FEAT_SCAN 294 #endif 295 #ifdef USE_INET6 296 | IPF_FEAT_IPV6 297 #endif 298 ; 299 300 301 /* 302 * Table of functions available for use with call rules. 303 */ 304 static ipfunc_resolve_t ipf_availfuncs[] = { 305 { "srcgrpmap", ipf_srcgrpmap, ipf_grpmapinit, ipf_grpmapfini }, 306 { "dstgrpmap", ipf_dstgrpmap, ipf_grpmapinit, ipf_grpmapfini }, 307 { "", NULL, NULL, NULL } 308 }; 309 310 static const ipftuneable_t ipf_main_tuneables[] = { 311 { { (void *)offsetof(struct ipf_main_softc_s, ipf_flags) }, 312 "ipf_flags", 0, 0xffffffff, 313 stsizeof(ipf_main_softc_t, ipf_flags), 314 0, NULL, NULL }, 315 { { (void *)offsetof(struct ipf_main_softc_s, ipf_active) }, 316 "active", 0, 0, 317 stsizeof(ipf_main_softc_t, ipf_active), 318 IPFT_RDONLY, NULL, NULL }, 319 { { (void *)offsetof(ipf_main_softc_t, ipf_control_forwarding) }, 320 "control_forwarding", 0, 1, 321 stsizeof(ipf_main_softc_t, ipf_control_forwarding), 322 0, NULL, NULL }, 323 { { (void *)offsetof(ipf_main_softc_t, ipf_update_ipid) }, 324 "update_ipid", 0, 1, 325 stsizeof(ipf_main_softc_t, ipf_update_ipid), 326 0, NULL, NULL }, 327 { { (void *)offsetof(ipf_main_softc_t, ipf_chksrc) }, 328 "chksrc", 0, 1, 329 stsizeof(ipf_main_softc_t, ipf_chksrc), 330 0, NULL, NULL }, 331 { { (void *)offsetof(ipf_main_softc_t, ipf_minttl) }, 332 "min_ttl", 0, 1, 333 stsizeof(ipf_main_softc_t, ipf_minttl), 334 0, NULL, NULL }, 335 { { (void *)offsetof(ipf_main_softc_t, ipf_icmpminfragmtu) }, 336 "icmp_minfragmtu", 0, 1, 337 stsizeof(ipf_main_softc_t, ipf_icmpminfragmtu), 338 0, NULL, NULL }, 339 { { (void *)offsetof(ipf_main_softc_t, ipf_pass) }, 340 "default_pass", 0, 0xffffffff, 341 stsizeof(ipf_main_softc_t, ipf_pass), 342 0, NULL, NULL }, 343 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpidletimeout) }, 344 "tcp_idle_timeout", 1, 0x7fffffff, 345 stsizeof(ipf_main_softc_t, ipf_tcpidletimeout), 346 0, NULL, ipf_settimeout }, 347 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpclosewait) }, 348 "tcp_close_wait", 1, 0x7fffffff, 349 stsizeof(ipf_main_softc_t, ipf_tcpclosewait), 350 0, NULL, ipf_settimeout }, 351 { { (void *)offsetof(ipf_main_softc_t, ipf_tcplastack) }, 352 "tcp_last_ack", 1, 0x7fffffff, 353 stsizeof(ipf_main_softc_t, ipf_tcplastack), 354 0, NULL, ipf_settimeout }, 355 { { (void *)offsetof(ipf_main_softc_t, ipf_tcptimeout) }, 356 "tcp_timeout", 1, 0x7fffffff, 357 stsizeof(ipf_main_softc_t, ipf_tcptimeout), 358 0, NULL, ipf_settimeout }, 359 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpsynsent) }, 360 "tcp_syn_sent", 1, 0x7fffffff, 361 stsizeof(ipf_main_softc_t, ipf_tcpsynsent), 362 0, NULL, ipf_settimeout }, 363 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpsynrecv) }, 364 "tcp_syn_received", 1, 0x7fffffff, 365 stsizeof(ipf_main_softc_t, ipf_tcpsynrecv), 366 0, NULL, ipf_settimeout }, 367 { { (void *)offsetof(ipf_main_softc_t, ipf_tcpclosed) }, 368 "tcp_closed", 1, 0x7fffffff, 369 stsizeof(ipf_main_softc_t, ipf_tcpclosed), 370 0, NULL, ipf_settimeout }, 371 { { (void *)offsetof(ipf_main_softc_t, ipf_tcphalfclosed) }, 372 "tcp_half_closed", 1, 0x7fffffff, 373 stsizeof(ipf_main_softc_t, ipf_tcphalfclosed), 374 0, NULL, ipf_settimeout }, 375 { { (void *)offsetof(ipf_main_softc_t, ipf_tcptimewait) }, 376 "tcp_time_wait", 1, 0x7fffffff, 377 stsizeof(ipf_main_softc_t, ipf_tcptimewait), 378 0, NULL, ipf_settimeout }, 379 { { (void *)offsetof(ipf_main_softc_t, ipf_udptimeout) }, 380 "udp_timeout", 1, 0x7fffffff, 381 stsizeof(ipf_main_softc_t, ipf_udptimeout), 382 0, NULL, ipf_settimeout }, 383 { { (void *)offsetof(ipf_main_softc_t, ipf_udpacktimeout) }, 384 "udp_ack_timeout", 1, 0x7fffffff, 385 stsizeof(ipf_main_softc_t, ipf_udpacktimeout), 386 0, NULL, ipf_settimeout }, 387 { { (void *)offsetof(ipf_main_softc_t, ipf_icmptimeout) }, 388 "icmp_timeout", 1, 0x7fffffff, 389 stsizeof(ipf_main_softc_t, ipf_icmptimeout), 390 0, NULL, ipf_settimeout }, 391 { { (void *)offsetof(ipf_main_softc_t, ipf_icmpacktimeout) }, 392 "icmp_ack_timeout", 1, 0x7fffffff, 393 stsizeof(ipf_main_softc_t, ipf_icmpacktimeout), 394 0, NULL, ipf_settimeout }, 395 { { (void *)offsetof(ipf_main_softc_t, ipf_iptimeout) }, 396 "ip_timeout", 1, 0x7fffffff, 397 stsizeof(ipf_main_softc_t, ipf_iptimeout), 398 0, NULL, ipf_settimeout }, 399 #if defined(INSTANCES) && defined(_KERNEL) 400 { { (void *)offsetof(ipf_main_softc_t, ipf_get_loopback) }, 401 "intercept_loopback", 0, 1, 402 stsizeof(ipf_main_softc_t, ipf_get_loopback), 403 0, NULL, ipf_set_loopback }, 404 #endif 405 { { 0 }, 406 NULL, 0, 0, 407 0, 408 0, NULL, NULL } 409 }; 410 411 412 /* 413 * The next section of code is a a collection of small routines that set 414 * fields in the fr_info_t structure passed based on properties of the 415 * current packet. There are different routines for the same protocol 416 * for each of IPv4 and IPv6. Adding a new protocol, for which there 417 * will "special" inspection for setup, is now more easily done by adding 418 * a new routine and expanding the ipf_pr_ipinit*() function rather than by 419 * adding more code to a growing switch statement. 420 */ 421 #ifdef USE_INET6 422 static INLINE int ipf_pr_ah6(fr_info_t *); 423 static INLINE void ipf_pr_esp6(fr_info_t *); 424 static INLINE void ipf_pr_gre6(fr_info_t *); 425 static INLINE void ipf_pr_udp6(fr_info_t *); 426 static INLINE void ipf_pr_tcp6(fr_info_t *); 427 static INLINE void ipf_pr_icmp6(fr_info_t *); 428 static INLINE void ipf_pr_ipv6hdr(fr_info_t *); 429 static INLINE void ipf_pr_short6(fr_info_t *, int); 430 static INLINE int ipf_pr_hopopts6(fr_info_t *); 431 static INLINE int ipf_pr_mobility6(fr_info_t *); 432 static INLINE int ipf_pr_routing6(fr_info_t *); 433 static INLINE int ipf_pr_dstopts6(fr_info_t *); 434 static INLINE int ipf_pr_fragment6(fr_info_t *); 435 static INLINE struct ip6_ext *ipf_pr_ipv6exthdr(fr_info_t *, int, int); 436 437 438 /* ------------------------------------------------------------------------ */ 439 /* Function: ipf_pr_short6 */ 440 /* Returns: void */ 441 /* Parameters: fin(I) - pointer to packet information */ 442 /* xmin(I) - minimum header size */ 443 /* */ 444 /* IPv6 Only */ 445 /* This is function enforces the 'is a packet too short to be legit' rule */ 446 /* for IPv6 and marks the packet with FI_SHORT if so. See function comment */ 447 /* for ipf_pr_short() for more details. */ 448 /* ------------------------------------------------------------------------ */ 449 static INLINE void 450 ipf_pr_short6(fr_info_t *fin, int xmin) 451 { 452 453 if (fin->fin_dlen < xmin) 454 fin->fin_flx |= FI_SHORT; 455 } 456 457 458 /* ------------------------------------------------------------------------ */ 459 /* Function: ipf_pr_ipv6hdr */ 460 /* Returns: void */ 461 /* Parameters: fin(I) - pointer to packet information */ 462 /* */ 463 /* IPv6 Only */ 464 /* Copy values from the IPv6 header into the fr_info_t struct and call the */ 465 /* per-protocol analyzer if it exists. In validating the packet, a protocol*/ 466 /* analyzer may pullup or free the packet itself so we need to be vigiliant */ 467 /* of that possibility arising. */ 468 /* ------------------------------------------------------------------------ */ 469 static INLINE void 470 ipf_pr_ipv6hdr(fr_info_t *fin) 471 { 472 ip6_t *ip6 = (ip6_t *)fin->fin_ip; 473 int p, go = 1, i, hdrcount; 474 fr_ip_t *fi = &fin->fin_fi; 475 476 fin->fin_off = 0; 477 478 fi->fi_tos = 0; 479 fi->fi_optmsk = 0; 480 fi->fi_secmsk = 0; 481 fi->fi_auth = 0; 482 483 p = ip6->ip6_nxt; 484 fin->fin_crc = p; 485 fi->fi_ttl = ip6->ip6_hlim; 486 fi->fi_src.in6 = ip6->ip6_src; 487 fin->fin_crc += fi->fi_src.i6[0]; 488 fin->fin_crc += fi->fi_src.i6[1]; 489 fin->fin_crc += fi->fi_src.i6[2]; 490 fin->fin_crc += fi->fi_src.i6[3]; 491 fi->fi_dst.in6 = ip6->ip6_dst; 492 fin->fin_crc += fi->fi_dst.i6[0]; 493 fin->fin_crc += fi->fi_dst.i6[1]; 494 fin->fin_crc += fi->fi_dst.i6[2]; 495 fin->fin_crc += fi->fi_dst.i6[3]; 496 fin->fin_id = 0; 497 if (IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6)) 498 fin->fin_flx |= FI_MULTICAST|FI_MBCAST; 499 500 hdrcount = 0; 501 while (go && !(fin->fin_flx & FI_SHORT)) { 502 switch (p) 503 { 504 case IPPROTO_UDP : 505 ipf_pr_udp6(fin); 506 go = 0; 507 break; 508 509 case IPPROTO_TCP : 510 ipf_pr_tcp6(fin); 511 go = 0; 512 break; 513 514 case IPPROTO_ICMPV6 : 515 ipf_pr_icmp6(fin); 516 go = 0; 517 break; 518 519 case IPPROTO_GRE : 520 ipf_pr_gre6(fin); 521 go = 0; 522 break; 523 524 case IPPROTO_HOPOPTS : 525 p = ipf_pr_hopopts6(fin); 526 break; 527 528 case IPPROTO_MOBILITY : 529 p = ipf_pr_mobility6(fin); 530 break; 531 532 case IPPROTO_DSTOPTS : 533 p = ipf_pr_dstopts6(fin); 534 break; 535 536 case IPPROTO_ROUTING : 537 p = ipf_pr_routing6(fin); 538 break; 539 540 case IPPROTO_AH : 541 p = ipf_pr_ah6(fin); 542 break; 543 544 case IPPROTO_ESP : 545 ipf_pr_esp6(fin); 546 go = 0; 547 break; 548 549 case IPPROTO_IPV6 : 550 for (i = 0; ip6exthdr[i].ol_bit != 0; i++) 551 if (ip6exthdr[i].ol_val == p) { 552 fin->fin_flx |= ip6exthdr[i].ol_bit; 553 break; 554 } 555 go = 0; 556 break; 557 558 case IPPROTO_NONE : 559 go = 0; 560 break; 561 562 case IPPROTO_FRAGMENT : 563 p = ipf_pr_fragment6(fin); 564 /* 565 * Given that the only fragments we want to let through 566 * (where fin_off != 0) are those where the non-first 567 * fragments only have data, we can safely stop looking 568 * at headers if this is a non-leading fragment. 569 */ 570 if (fin->fin_off != 0) 571 go = 0; 572 break; 573 574 default : 575 go = 0; 576 break; 577 } 578 hdrcount++; 579 580 /* 581 * It is important to note that at this point, for the 582 * extension headers (go != 0), the entire header may not have 583 * been pulled up when the code gets to this point. This is 584 * only done for "go != 0" because the other header handlers 585 * will all pullup their complete header. The other indicator 586 * of an incomplete packet is that this was just an extension 587 * header. 588 */ 589 if ((go != 0) && (p != IPPROTO_NONE) && 590 (ipf_pr_pullup(fin, 0) == -1)) { 591 p = IPPROTO_NONE; 592 break; 593 } 594 } 595 596 /* 597 * Some of the above functions, like ipf_pr_esp6(), can call ipf_pullup 598 * and destroy whatever packet was here. The caller of this function 599 * expects us to return if there is a problem with ipf_pullup. 600 */ 601 if (fin->fin_m == NULL) { 602 ipf_main_softc_t *softc = fin->fin_main_soft; 603 604 LBUMPD(ipf_stats[fin->fin_out], fr_v6_bad); 605 return; 606 } 607 608 fi->fi_p = p; 609 610 /* 611 * IPv6 fragment case 1 - see comment for ipf_pr_fragment6(). 612 * "go != 0" imples the above loop hasn't arrived at a layer 4 header. 613 */ 614 if ((go != 0) && (fin->fin_flx & FI_FRAG) && (fin->fin_off == 0)) { 615 ipf_main_softc_t *softc = fin->fin_main_soft; 616 617 fin->fin_flx |= FI_BAD; 618 DT2(ipf_fi_bad_ipv6_frag_1, fr_info_t *, fin, int, go); 619 LBUMPD(ipf_stats[fin->fin_out], fr_v6_badfrag); 620 LBUMP(ipf_stats[fin->fin_out].fr_v6_bad); 621 } 622 } 623 624 625 /* ------------------------------------------------------------------------ */ 626 /* Function: ipf_pr_ipv6exthdr */ 627 /* Returns: struct ip6_ext * - pointer to the start of the next header */ 628 /* or NULL if there is a prolblem. */ 629 /* Parameters: fin(I) - pointer to packet information */ 630 /* multiple(I) - flag indicating yes/no if multiple occurances */ 631 /* of this extension header are allowed. */ 632 /* proto(I) - protocol number for this extension header */ 633 /* */ 634 /* IPv6 Only */ 635 /* This function embodies a number of common checks that all IPv6 extension */ 636 /* headers must be subjected to. For example, making sure the packet is */ 637 /* big enough for it to be in, checking if it is repeated and setting a */ 638 /* flag to indicate its presence. */ 639 /* ------------------------------------------------------------------------ */ 640 static INLINE struct ip6_ext * 641 ipf_pr_ipv6exthdr(fr_info_t *fin, int multiple, int proto) 642 { 643 ipf_main_softc_t *softc = fin->fin_main_soft; 644 struct ip6_ext *hdr; 645 u_short shift; 646 int i; 647 648 fin->fin_flx |= FI_V6EXTHDR; 649 650 /* 8 is default length of extension hdr */ 651 if ((fin->fin_dlen - 8) < 0) { 652 fin->fin_flx |= FI_SHORT; 653 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_short); 654 return NULL; 655 } 656 657 if (ipf_pr_pullup(fin, 8) == -1) { 658 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_pullup); 659 return NULL; 660 } 661 662 hdr = fin->fin_dp; 663 switch (proto) 664 { 665 case IPPROTO_FRAGMENT : 666 shift = 8; 667 break; 668 default : 669 shift = 8 + (hdr->ip6e_len << 3); 670 break; 671 } 672 673 if (shift > fin->fin_dlen) { /* Nasty extension header length? */ 674 fin->fin_flx |= FI_BAD; 675 DT3(ipf_fi_bad_pr_ipv6exthdr_len, fr_info_t *, fin, u_short, shift, u_short, fin->fin_dlen); 676 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ext_hlen); 677 return NULL; 678 } 679 680 fin->fin_dp = (char *)fin->fin_dp + shift; 681 fin->fin_dlen -= shift; 682 683 /* 684 * If we have seen a fragment header, do not set any flags to indicate 685 * the presence of this extension header as it has no impact on the 686 * end result until after it has been defragmented. 687 */ 688 if (fin->fin_flx & FI_FRAG) 689 return hdr; 690 691 for (i = 0; ip6exthdr[i].ol_bit != 0; i++) 692 if (ip6exthdr[i].ol_val == proto) { 693 /* 694 * Most IPv6 extension headers are only allowed once. 695 */ 696 if ((multiple == 0) && 697 ((fin->fin_optmsk & ip6exthdr[i].ol_bit) != 0)) { 698 fin->fin_flx |= FI_BAD; 699 DT2(ipf_fi_bad_ipv6exthdr_once, fr_info_t *, fin, u_int, (fin->fin_optmsk & ip6exthdr[i].ol_bit)); 700 } else 701 fin->fin_optmsk |= ip6exthdr[i].ol_bit; 702 break; 703 } 704 705 return hdr; 706 } 707 708 709 /* ------------------------------------------------------------------------ */ 710 /* Function: ipf_pr_hopopts6 */ 711 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 712 /* Parameters: fin(I) - pointer to packet information */ 713 /* */ 714 /* IPv6 Only */ 715 /* This is function checks pending hop by hop options extension header */ 716 /* ------------------------------------------------------------------------ */ 717 static INLINE int 718 ipf_pr_hopopts6(fr_info_t *fin) 719 { 720 struct ip6_ext *hdr; 721 722 hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_HOPOPTS); 723 if (hdr == NULL) 724 return IPPROTO_NONE; 725 return hdr->ip6e_nxt; 726 } 727 728 729 /* ------------------------------------------------------------------------ */ 730 /* Function: ipf_pr_mobility6 */ 731 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 732 /* Parameters: fin(I) - pointer to packet information */ 733 /* */ 734 /* IPv6 Only */ 735 /* This is function checks the IPv6 mobility extension header */ 736 /* ------------------------------------------------------------------------ */ 737 static INLINE int 738 ipf_pr_mobility6(fr_info_t *fin) 739 { 740 struct ip6_ext *hdr; 741 742 hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_MOBILITY); 743 if (hdr == NULL) 744 return IPPROTO_NONE; 745 return hdr->ip6e_nxt; 746 } 747 748 749 /* ------------------------------------------------------------------------ */ 750 /* Function: ipf_pr_routing6 */ 751 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 752 /* Parameters: fin(I) - pointer to packet information */ 753 /* */ 754 /* IPv6 Only */ 755 /* This is function checks pending routing extension header */ 756 /* ------------------------------------------------------------------------ */ 757 static INLINE int 758 ipf_pr_routing6(fr_info_t *fin) 759 { 760 struct ip6_routing *hdr; 761 762 hdr = (struct ip6_routing *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_ROUTING); 763 if (hdr == NULL) 764 return IPPROTO_NONE; 765 766 switch (hdr->ip6r_type) 767 { 768 case 0 : 769 /* 770 * Nasty extension header length? 771 */ 772 if (((hdr->ip6r_len >> 1) < hdr->ip6r_segleft) || 773 (hdr->ip6r_segleft && (hdr->ip6r_len & 1))) { 774 ipf_main_softc_t *softc = fin->fin_main_soft; 775 776 fin->fin_flx |= FI_BAD; 777 DT1(ipf_fi_bad_routing6, fr_info_t *, fin); 778 LBUMPD(ipf_stats[fin->fin_out], fr_v6_rh_bad); 779 return IPPROTO_NONE; 780 } 781 break; 782 783 default : 784 break; 785 } 786 787 return hdr->ip6r_nxt; 788 } 789 790 791 /* ------------------------------------------------------------------------ */ 792 /* Function: ipf_pr_fragment6 */ 793 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 794 /* Parameters: fin(I) - pointer to packet information */ 795 /* */ 796 /* IPv6 Only */ 797 /* Examine the IPv6 fragment header and extract fragment offset information.*/ 798 /* */ 799 /* Fragments in IPv6 are extraordinarily difficult to deal with - much more */ 800 /* so than in IPv4. There are 5 cases of fragments with IPv6 that all */ 801 /* packets with a fragment header can fit into. They are as follows: */ 802 /* */ 803 /* 1. [IPv6][0-n EH][FH][0-n EH] (no L4HDR present) */ 804 /* 2. [IPV6][0-n EH][FH][0-n EH][L4HDR part] (short) */ 805 /* 3. [IPV6][0-n EH][FH][L4HDR part][0-n data] (short) */ 806 /* 4. [IPV6][0-n EH][FH][0-n EH][L4HDR][0-n data] */ 807 /* 5. [IPV6][0-n EH][FH][data] */ 808 /* */ 809 /* IPV6 = IPv6 header, FH = Fragment Header, */ 810 /* 0-n EH = 0 or more extension headers, 0-n data = 0 or more bytes of data */ 811 /* */ 812 /* Packets that match 1, 2, 3 will be dropped as the only reasonable */ 813 /* scenario in which they happen is in extreme circumstances that are most */ 814 /* likely to be an indication of an attack rather than normal traffic. */ 815 /* A type 3 packet may be sent by an attacked after a type 4 packet. There */ 816 /* are two rules that can be used to guard against type 3 packets: L4 */ 817 /* headers must always be in a packet that has the offset field set to 0 */ 818 /* and no packet is allowed to overlay that where offset = 0. */ 819 /* ------------------------------------------------------------------------ */ 820 static INLINE int 821 ipf_pr_fragment6(fr_info_t *fin) 822 { 823 ipf_main_softc_t *softc = fin->fin_main_soft; 824 struct ip6_frag *frag; 825 826 fin->fin_flx |= FI_FRAG; 827 828 frag = (struct ip6_frag *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_FRAGMENT); 829 if (frag == NULL) { 830 LBUMPD(ipf_stats[fin->fin_out], fr_v6_frag_bad); 831 return IPPROTO_NONE; 832 } 833 834 if ((frag->ip6f_offlg & IP6F_MORE_FRAG) != 0) { 835 /* 836 * Any fragment that isn't the last fragment must have its 837 * length as a multiple of 8. 838 */ 839 if ((fin->fin_plen & 7) != 0) { 840 fin->fin_flx |= FI_BAD; 841 DT2(ipf_fi_bad_frag_not_8, fr_info_t *, fin, u_int, (fin->fin_plen & 7)); 842 } 843 } 844 845 fin->fin_fraghdr = frag; 846 fin->fin_id = frag->ip6f_ident; 847 fin->fin_off = ntohs(frag->ip6f_offlg & IP6F_OFF_MASK); 848 if (fin->fin_off != 0) 849 fin->fin_flx |= FI_FRAGBODY; 850 851 /* 852 * Jumbograms aren't handled, so the max. length is 64k 853 */ 854 if ((fin->fin_off << 3) + fin->fin_dlen > 65535) { 855 fin->fin_flx |= FI_BAD; 856 DT2(ipf_fi_bad_jumbogram, fr_info_t *, fin, u_int, ((fin->fin_off << 3) + fin->fin_dlen)); 857 } 858 859 /* 860 * We don't know where the transport layer header (or whatever is next 861 * is), as it could be behind destination options (amongst others) so 862 * return the fragment header as the type of packet this is. Note that 863 * this effectively disables the fragment cache for > 1 protocol at a 864 * time. 865 */ 866 return frag->ip6f_nxt; 867 } 868 869 870 /* ------------------------------------------------------------------------ */ 871 /* Function: ipf_pr_dstopts6 */ 872 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 873 /* Parameters: fin(I) - pointer to packet information */ 874 /* */ 875 /* IPv6 Only */ 876 /* This is function checks pending destination options extension header */ 877 /* ------------------------------------------------------------------------ */ 878 static INLINE int 879 ipf_pr_dstopts6(fr_info_t *fin) 880 { 881 ipf_main_softc_t *softc = fin->fin_main_soft; 882 struct ip6_ext *hdr; 883 884 hdr = ipf_pr_ipv6exthdr(fin, 0, IPPROTO_DSTOPTS); 885 if (hdr == NULL) { 886 LBUMPD(ipf_stats[fin->fin_out], fr_v6_dst_bad); 887 return IPPROTO_NONE; 888 } 889 return hdr->ip6e_nxt; 890 } 891 892 893 /* ------------------------------------------------------------------------ */ 894 /* Function: ipf_pr_icmp6 */ 895 /* Returns: void */ 896 /* Parameters: fin(I) - pointer to packet information */ 897 /* */ 898 /* IPv6 Only */ 899 /* This routine is mainly concerned with determining the minimum valid size */ 900 /* for an ICMPv6 packet. */ 901 /* ------------------------------------------------------------------------ */ 902 static INLINE void 903 ipf_pr_icmp6(fr_info_t *fin) 904 { 905 int minicmpsz = sizeof(struct icmp6_hdr); 906 struct icmp6_hdr *icmp6; 907 908 if (ipf_pr_pullup(fin, ICMP6ERR_MINPKTLEN - sizeof(ip6_t)) == -1) { 909 ipf_main_softc_t *softc = fin->fin_main_soft; 910 911 LBUMPD(ipf_stats[fin->fin_out], fr_v6_icmp6_pullup); 912 return; 913 } 914 915 if (fin->fin_dlen > 1) { 916 ip6_t *ip6; 917 918 icmp6 = fin->fin_dp; 919 920 fin->fin_data[0] = *(u_short *)icmp6; 921 922 if ((icmp6->icmp6_type & ICMP6_INFOMSG_MASK) != 0) 923 fin->fin_flx |= FI_ICMPQUERY; 924 925 switch (icmp6->icmp6_type) 926 { 927 case ICMP6_ECHO_REPLY : 928 case ICMP6_ECHO_REQUEST : 929 if (fin->fin_dlen >= 6) 930 fin->fin_data[1] = icmp6->icmp6_id; 931 minicmpsz = ICMP6ERR_MINPKTLEN - sizeof(ip6_t); 932 break; 933 934 case ICMP6_DST_UNREACH : 935 case ICMP6_PACKET_TOO_BIG : 936 case ICMP6_TIME_EXCEEDED : 937 case ICMP6_PARAM_PROB : 938 fin->fin_flx |= FI_ICMPERR; 939 minicmpsz = ICMP6ERR_IPICMPHLEN - sizeof(ip6_t); 940 if (fin->fin_plen < ICMP6ERR_IPICMPHLEN) 941 break; 942 943 if (M_LEN(fin->fin_m) < fin->fin_plen) { 944 if (ipf_coalesce(fin) != 1) 945 return; 946 } 947 948 if (ipf_pr_pullup(fin, ICMP6ERR_MINPKTLEN) == -1) 949 return; 950 951 /* 952 * If the destination of this packet doesn't match the 953 * source of the original packet then this packet is 954 * not correct. 955 */ 956 icmp6 = fin->fin_dp; 957 ip6 = (ip6_t *)((char *)icmp6 + ICMPERR_ICMPHLEN); 958 if (IP6_NEQ(&fin->fin_fi.fi_dst, 959 &ip6->ip6_src)) { 960 fin->fin_flx |= FI_BAD; 961 DT1(ipf_fi_bad_icmp6, fr_info_t *, fin); 962 } 963 break; 964 default : 965 break; 966 } 967 } 968 969 ipf_pr_short6(fin, minicmpsz); 970 if ((fin->fin_flx & (FI_SHORT|FI_BAD)) == 0) { 971 u_char p = fin->fin_p; 972 973 fin->fin_p = IPPROTO_ICMPV6; 974 ipf_checkv6sum(fin); 975 fin->fin_p = p; 976 } 977 } 978 979 980 /* ------------------------------------------------------------------------ */ 981 /* Function: ipf_pr_udp6 */ 982 /* Returns: void */ 983 /* Parameters: fin(I) - pointer to packet information */ 984 /* */ 985 /* IPv6 Only */ 986 /* Analyse the packet for IPv6/UDP properties. */ 987 /* Is not expected to be called for fragmented packets. */ 988 /* ------------------------------------------------------------------------ */ 989 static INLINE void 990 ipf_pr_udp6(fr_info_t *fin) 991 { 992 993 if (ipf_pr_udpcommon(fin) == 0) { 994 u_char p = fin->fin_p; 995 996 fin->fin_p = IPPROTO_UDP; 997 ipf_checkv6sum(fin); 998 fin->fin_p = p; 999 } 1000 } 1001 1002 1003 /* ------------------------------------------------------------------------ */ 1004 /* Function: ipf_pr_tcp6 */ 1005 /* Returns: void */ 1006 /* Parameters: fin(I) - pointer to packet information */ 1007 /* */ 1008 /* IPv6 Only */ 1009 /* Analyse the packet for IPv6/TCP properties. */ 1010 /* Is not expected to be called for fragmented packets. */ 1011 /* ------------------------------------------------------------------------ */ 1012 static INLINE void 1013 ipf_pr_tcp6(fr_info_t *fin) 1014 { 1015 1016 if (ipf_pr_tcpcommon(fin) == 0) { 1017 u_char p = fin->fin_p; 1018 1019 fin->fin_p = IPPROTO_TCP; 1020 ipf_checkv6sum(fin); 1021 fin->fin_p = p; 1022 } 1023 } 1024 1025 1026 /* ------------------------------------------------------------------------ */ 1027 /* Function: ipf_pr_esp6 */ 1028 /* Returns: void */ 1029 /* Parameters: fin(I) - pointer to packet information */ 1030 /* */ 1031 /* IPv6 Only */ 1032 /* Analyse the packet for ESP properties. */ 1033 /* The minimum length is taken to be the SPI (32bits) plus a tail (32bits) */ 1034 /* even though the newer ESP packets must also have a sequence number that */ 1035 /* is 32bits as well, it is not possible(?) to determine the version from a */ 1036 /* simple packet header. */ 1037 /* ------------------------------------------------------------------------ */ 1038 static INLINE void 1039 ipf_pr_esp6(fr_info_t *fin) 1040 { 1041 1042 if ((fin->fin_off == 0) && (ipf_pr_pullup(fin, 8) == -1)) { 1043 ipf_main_softc_t *softc = fin->fin_main_soft; 1044 1045 LBUMPD(ipf_stats[fin->fin_out], fr_v6_esp_pullup); 1046 return; 1047 } 1048 } 1049 1050 1051 /* ------------------------------------------------------------------------ */ 1052 /* Function: ipf_pr_ah6 */ 1053 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 1054 /* Parameters: fin(I) - pointer to packet information */ 1055 /* */ 1056 /* IPv6 Only */ 1057 /* Analyse the packet for AH properties. */ 1058 /* The minimum length is taken to be the combination of all fields in the */ 1059 /* header being present and no authentication data (null algorithm used.) */ 1060 /* ------------------------------------------------------------------------ */ 1061 static INLINE int 1062 ipf_pr_ah6(fr_info_t *fin) 1063 { 1064 authhdr_t *ah; 1065 1066 fin->fin_flx |= FI_AH; 1067 1068 ah = (authhdr_t *)ipf_pr_ipv6exthdr(fin, 0, IPPROTO_HOPOPTS); 1069 if (ah == NULL) { 1070 ipf_main_softc_t *softc = fin->fin_main_soft; 1071 1072 LBUMPD(ipf_stats[fin->fin_out], fr_v6_ah_bad); 1073 return IPPROTO_NONE; 1074 } 1075 1076 ipf_pr_short6(fin, sizeof(*ah)); 1077 1078 /* 1079 * No need for another pullup, ipf_pr_ipv6exthdr() will pullup 1080 * enough data to satisfy ah_next (the very first one.) 1081 */ 1082 return ah->ah_next; 1083 } 1084 1085 1086 /* ------------------------------------------------------------------------ */ 1087 /* Function: ipf_pr_gre6 */ 1088 /* Returns: void */ 1089 /* Parameters: fin(I) - pointer to packet information */ 1090 /* */ 1091 /* Analyse the packet for GRE properties. */ 1092 /* ------------------------------------------------------------------------ */ 1093 static INLINE void 1094 ipf_pr_gre6(fr_info_t *fin) 1095 { 1096 grehdr_t *gre; 1097 1098 if (ipf_pr_pullup(fin, sizeof(grehdr_t)) == -1) { 1099 ipf_main_softc_t *softc = fin->fin_main_soft; 1100 1101 LBUMPD(ipf_stats[fin->fin_out], fr_v6_gre_pullup); 1102 return; 1103 } 1104 1105 gre = fin->fin_dp; 1106 if (GRE_REV(gre->gr_flags) == 1) 1107 fin->fin_data[0] = gre->gr_call; 1108 } 1109 #endif /* USE_INET6 */ 1110 1111 1112 /* ------------------------------------------------------------------------ */ 1113 /* Function: ipf_pr_pullup */ 1114 /* Returns: int - 0 == pullup succeeded, -1 == failure */ 1115 /* Parameters: fin(I) - pointer to packet information */ 1116 /* plen(I) - length (excluding L3 header) to pullup */ 1117 /* */ 1118 /* Short inline function to cut down on code duplication to perform a call */ 1119 /* to ipf_pullup to ensure there is the required amount of data, */ 1120 /* consecutively in the packet buffer. */ 1121 /* */ 1122 /* This function pulls up 'extra' data at the location of fin_dp. fin_dp */ 1123 /* points to the first byte after the complete layer 3 header, which will */ 1124 /* include all of the known extension headers for IPv6 or options for IPv4. */ 1125 /* */ 1126 /* Since fr_pullup() expects the total length of bytes to be pulled up, it */ 1127 /* is necessary to add those we can already assume to be pulled up (fin_dp */ 1128 /* - fin_ip) to what is passed through. */ 1129 /* ------------------------------------------------------------------------ */ 1130 int 1131 ipf_pr_pullup(fr_info_t *fin, int plen) 1132 { 1133 ipf_main_softc_t *softc = fin->fin_main_soft; 1134 1135 if (fin->fin_m != NULL) { 1136 if (fin->fin_dp != NULL) 1137 plen += (char *)fin->fin_dp - 1138 ((char *)fin->fin_ip + fin->fin_hlen); 1139 plen += fin->fin_hlen; 1140 if (M_LEN(fin->fin_m) < plen + fin->fin_ipoff) { 1141 #if defined(_KERNEL) 1142 if (ipf_pullup(fin->fin_m, fin, plen) == NULL) { 1143 DT(ipf_pullup_fail); 1144 LBUMP(ipf_stats[fin->fin_out].fr_pull[1]); 1145 return -1; 1146 } 1147 LBUMP(ipf_stats[fin->fin_out].fr_pull[0]); 1148 #else 1149 LBUMP(ipf_stats[fin->fin_out].fr_pull[1]); 1150 /* 1151 * Fake ipf_pullup failing 1152 */ 1153 fin->fin_reason = FRB_PULLUP; 1154 *fin->fin_mp = NULL; 1155 fin->fin_m = NULL; 1156 fin->fin_ip = NULL; 1157 return -1; 1158 #endif 1159 } 1160 } 1161 return 0; 1162 } 1163 1164 1165 /* ------------------------------------------------------------------------ */ 1166 /* Function: ipf_pr_short */ 1167 /* Returns: void */ 1168 /* Parameters: fin(I) - pointer to packet information */ 1169 /* xmin(I) - minimum header size */ 1170 /* */ 1171 /* Check if a packet is "short" as defined by xmin. The rule we are */ 1172 /* applying here is that the packet must not be fragmented within the layer */ 1173 /* 4 header. That is, it must not be a fragment that has its offset set to */ 1174 /* start within the layer 4 header (hdrmin) or if it is at offset 0, the */ 1175 /* entire layer 4 header must be present (min). */ 1176 /* ------------------------------------------------------------------------ */ 1177 static INLINE void 1178 ipf_pr_short(fr_info_t *fin, int xmin) 1179 { 1180 1181 if (fin->fin_off == 0) { 1182 if (fin->fin_dlen < xmin) 1183 fin->fin_flx |= FI_SHORT; 1184 } else if (fin->fin_off < xmin) { 1185 fin->fin_flx |= FI_SHORT; 1186 } 1187 } 1188 1189 1190 /* ------------------------------------------------------------------------ */ 1191 /* Function: ipf_pr_icmp */ 1192 /* Returns: void */ 1193 /* Parameters: fin(I) - pointer to packet information */ 1194 /* */ 1195 /* IPv4 Only */ 1196 /* Do a sanity check on the packet for ICMP (v4). In nearly all cases, */ 1197 /* except extrememly bad packets, both type and code will be present. */ 1198 /* The expected minimum size of an ICMP packet is very much dependent on */ 1199 /* the type of it. */ 1200 /* */ 1201 /* XXX - other ICMP sanity checks? */ 1202 /* ------------------------------------------------------------------------ */ 1203 static INLINE void 1204 ipf_pr_icmp(fr_info_t *fin) 1205 { 1206 ipf_main_softc_t *softc = fin->fin_main_soft; 1207 int minicmpsz = sizeof(struct icmp); 1208 icmphdr_t *icmp; 1209 ip_t *oip; 1210 1211 ipf_pr_short(fin, ICMPERR_ICMPHLEN); 1212 1213 if (fin->fin_off != 0) { 1214 LBUMPD(ipf_stats[fin->fin_out], fr_v4_icmp_frag); 1215 return; 1216 } 1217 1218 if (ipf_pr_pullup(fin, ICMPERR_ICMPHLEN) == -1) { 1219 LBUMPD(ipf_stats[fin->fin_out], fr_v4_icmp_pullup); 1220 return; 1221 } 1222 1223 icmp = fin->fin_dp; 1224 1225 fin->fin_data[0] = *(u_short *)icmp; 1226 fin->fin_data[1] = icmp->icmp_id; 1227 1228 switch (icmp->icmp_type) 1229 { 1230 case ICMP_ECHOREPLY : 1231 case ICMP_ECHO : 1232 /* Router discovery messaes - RFC 1256 */ 1233 case ICMP_ROUTERADVERT : 1234 case ICMP_ROUTERSOLICIT : 1235 fin->fin_flx |= FI_ICMPQUERY; 1236 minicmpsz = ICMP_MINLEN; 1237 break; 1238 /* 1239 * type(1) + code(1) + cksum(2) + id(2) seq(2) + 1240 * 3 * timestamp(3 * 4) 1241 */ 1242 case ICMP_TSTAMP : 1243 case ICMP_TSTAMPREPLY : 1244 fin->fin_flx |= FI_ICMPQUERY; 1245 minicmpsz = 20; 1246 break; 1247 /* 1248 * type(1) + code(1) + cksum(2) + id(2) seq(2) + 1249 * mask(4) 1250 */ 1251 case ICMP_IREQ : 1252 case ICMP_IREQREPLY : 1253 case ICMP_MASKREQ : 1254 case ICMP_MASKREPLY : 1255 fin->fin_flx |= FI_ICMPQUERY; 1256 minicmpsz = 12; 1257 break; 1258 /* 1259 * type(1) + code(1) + cksum(2) + id(2) seq(2) + ip(20+) 1260 */ 1261 case ICMP_UNREACH : 1262 #ifdef icmp_nextmtu 1263 if (icmp->icmp_code == ICMP_UNREACH_NEEDFRAG) { 1264 if (icmp->icmp_nextmtu < softc->ipf_icmpminfragmtu) { 1265 fin->fin_flx |= FI_BAD; 1266 DT3(ipf_fi_bad_icmp_nextmtu, fr_info_t *, fin, u_int, icmp->icmp_nextmtu, u_int, softc->ipf_icmpminfragmtu); 1267 } 1268 } 1269 #endif 1270 case ICMP_SOURCEQUENCH : 1271 case ICMP_REDIRECT : 1272 case ICMP_TIMXCEED : 1273 case ICMP_PARAMPROB : 1274 fin->fin_flx |= FI_ICMPERR; 1275 if (ipf_coalesce(fin) != 1) { 1276 LBUMPD(ipf_stats[fin->fin_out], fr_icmp_coalesce); 1277 return; 1278 } 1279 1280 /* 1281 * ICMP error packets should not be generated for IP 1282 * packets that are a fragment that isn't the first 1283 * fragment. 1284 */ 1285 oip = (ip_t *)((char *)fin->fin_dp + ICMPERR_ICMPHLEN); 1286 if ((ntohs(oip->ip_off) & IP_OFFMASK) != 0) { 1287 fin->fin_flx |= FI_BAD; 1288 DT2(ipf_fi_bad_icmp_err, fr_info_t, fin, u_int, (ntohs(oip->ip_off) & IP_OFFMASK)); 1289 } 1290 1291 /* 1292 * If the destination of this packet doesn't match the 1293 * source of the original packet then this packet is 1294 * not correct. 1295 */ 1296 if (oip->ip_src.s_addr != fin->fin_daddr) { 1297 fin->fin_flx |= FI_BAD; 1298 DT1(ipf_fi_bad_src_ne_dst, fr_info_t *, fin); 1299 } 1300 break; 1301 default : 1302 break; 1303 } 1304 1305 ipf_pr_short(fin, minicmpsz); 1306 1307 ipf_checkv4sum(fin); 1308 } 1309 1310 1311 /* ------------------------------------------------------------------------ */ 1312 /* Function: ipf_pr_tcpcommon */ 1313 /* Returns: int - 0 = header ok, 1 = bad packet, -1 = buffer error */ 1314 /* Parameters: fin(I) - pointer to packet information */ 1315 /* */ 1316 /* TCP header sanity checking. Look for bad combinations of TCP flags, */ 1317 /* and make some checks with how they interact with other fields. */ 1318 /* If compiled with IPFILTER_CKSUM, check to see if the TCP checksum is */ 1319 /* valid and mark the packet as bad if not. */ 1320 /* ------------------------------------------------------------------------ */ 1321 static INLINE int 1322 ipf_pr_tcpcommon(fr_info_t *fin) 1323 { 1324 ipf_main_softc_t *softc = fin->fin_main_soft; 1325 int flags, tlen; 1326 tcphdr_t *tcp; 1327 1328 fin->fin_flx |= FI_TCPUDP; 1329 if (fin->fin_off != 0) { 1330 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_frag); 1331 return 0; 1332 } 1333 1334 if (ipf_pr_pullup(fin, sizeof(*tcp)) == -1) { 1335 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_pullup); 1336 return -1; 1337 } 1338 1339 tcp = fin->fin_dp; 1340 if (fin->fin_dlen > 3) { 1341 fin->fin_sport = ntohs(tcp->th_sport); 1342 fin->fin_dport = ntohs(tcp->th_dport); 1343 } 1344 1345 if ((fin->fin_flx & FI_SHORT) != 0) { 1346 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_short); 1347 return 1; 1348 } 1349 1350 /* 1351 * Use of the TCP data offset *must* result in a value that is at 1352 * least the same size as the TCP header. 1353 */ 1354 tlen = TCP_OFF(tcp) << 2; 1355 if (tlen < sizeof(tcphdr_t)) { 1356 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_small); 1357 fin->fin_flx |= FI_BAD; 1358 DT3(ipf_fi_bad_tlen, fr_info_t, fin, u_int, tlen, u_int, sizeof(tcphdr_t)); 1359 return 1; 1360 } 1361 1362 flags = tcp->th_flags; 1363 fin->fin_tcpf = tcp->th_flags; 1364 1365 /* 1366 * If the urgent flag is set, then the urgent pointer must 1367 * also be set and vice versa. Good TCP packets do not have 1368 * just one of these set. 1369 */ 1370 if ((flags & TH_URG) != 0 && (tcp->th_urp == 0)) { 1371 fin->fin_flx |= FI_BAD; 1372 DT3(ipf_fi_bad_th_urg, fr_info_t*, fin, u_int, (flags & TH_URG), u_int, tcp->th_urp); 1373 #if 0 1374 } else if ((flags & TH_URG) == 0 && (tcp->th_urp != 0)) { 1375 /* 1376 * Ignore this case (#if 0) as it shows up in "real" 1377 * traffic with bogus values in the urgent pointer field. 1378 */ 1379 fin->fin_flx |= FI_BAD; 1380 DT3(ipf_fi_bad_th_urg0, fr_info_t *, fin, u_int, (flags & TH_URG), u_int, tcp->th_urp); 1381 #endif 1382 } else if (((flags & (TH_SYN|TH_FIN)) != 0) && 1383 ((flags & (TH_RST|TH_ACK)) == TH_RST)) { 1384 /* TH_FIN|TH_RST|TH_ACK seems to appear "naturally" */ 1385 fin->fin_flx |= FI_BAD; 1386 DT1(ipf_fi_bad_th_fin_rst_ack, fr_info_t, fin); 1387 #if 1 1388 } else if (((flags & TH_SYN) != 0) && 1389 ((flags & (TH_URG|TH_PUSH)) != 0)) { 1390 /* 1391 * SYN with URG and PUSH set is not for normal TCP but it is 1392 * possible(?) with T/TCP...but who uses T/TCP? 1393 */ 1394 fin->fin_flx |= FI_BAD; 1395 DT1(ipf_fi_bad_th_syn_urg_psh, fr_info_t *, fin); 1396 #endif 1397 } else if (!(flags & TH_ACK)) { 1398 /* 1399 * If the ack bit isn't set, then either the SYN or 1400 * RST bit must be set. If the SYN bit is set, then 1401 * we expect the ACK field to be 0. If the ACK is 1402 * not set and if URG, PSH or FIN are set, consdier 1403 * that to indicate a bad TCP packet. 1404 */ 1405 if ((flags == TH_SYN) && (tcp->th_ack != 0)) { 1406 /* 1407 * Cisco PIX sets the ACK field to a random value. 1408 * In light of this, do not set FI_BAD until a patch 1409 * is available from Cisco to ensure that 1410 * interoperability between existing systems is 1411 * achieved. 1412 */ 1413 /*fin->fin_flx |= FI_BAD*/; 1414 /*DT1(ipf_fi_bad_th_syn_ack, fr_info_t *, fin);*/ 1415 } else if (!(flags & (TH_RST|TH_SYN))) { 1416 fin->fin_flx |= FI_BAD; 1417 DT1(ipf_fi_bad_th_rst_syn, fr_info_t *, fin); 1418 } else if ((flags & (TH_URG|TH_PUSH|TH_FIN)) != 0) { 1419 fin->fin_flx |= FI_BAD; 1420 DT1(ipf_fi_bad_th_urg_push_fin, fr_info_t *, fin); 1421 } 1422 } 1423 if (fin->fin_flx & FI_BAD) { 1424 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_bad_flags); 1425 return 1; 1426 } 1427 1428 /* 1429 * At this point, it's not exactly clear what is to be gained by 1430 * marking up which TCP options are and are not present. The one we 1431 * are most interested in is the TCP window scale. This is only in 1432 * a SYN packet [RFC1323] so we don't need this here...? 1433 * Now if we were to analyse the header for passive fingerprinting, 1434 * then that might add some weight to adding this... 1435 */ 1436 if (tlen == sizeof(tcphdr_t)) { 1437 return 0; 1438 } 1439 1440 if (ipf_pr_pullup(fin, tlen) == -1) { 1441 LBUMPD(ipf_stats[fin->fin_out], fr_tcp_pullup); 1442 return -1; 1443 } 1444 1445 #if 0 1446 tcp = fin->fin_dp; 1447 ip = fin->fin_ip; 1448 s = (u_char *)(tcp + 1); 1449 off = IP_HL(ip) << 2; 1450 # ifdef _KERNEL 1451 if (fin->fin_mp != NULL) { 1452 mb_t *m = *fin->fin_mp; 1453 1454 if (off + tlen > M_LEN(m)) 1455 return; 1456 } 1457 # endif 1458 for (tlen -= (int)sizeof(*tcp); tlen > 0; ) { 1459 opt = *s; 1460 if (opt == '\0') 1461 break; 1462 else if (opt == TCPOPT_NOP) 1463 ol = 1; 1464 else { 1465 if (tlen < 2) 1466 break; 1467 ol = (int)*(s + 1); 1468 if (ol < 2 || ol > tlen) 1469 break; 1470 } 1471 1472 for (i = 9, mv = 4; mv >= 0; ) { 1473 op = ipopts + i; 1474 if (opt == (u_char)op->ol_val) { 1475 optmsk |= op->ol_bit; 1476 break; 1477 } 1478 } 1479 tlen -= ol; 1480 s += ol; 1481 } 1482 #endif /* 0 */ 1483 1484 return 0; 1485 } 1486 1487 1488 1489 /* ------------------------------------------------------------------------ */ 1490 /* Function: ipf_pr_udpcommon */ 1491 /* Returns: int - 0 = header ok, 1 = bad packet */ 1492 /* Parameters: fin(I) - pointer to packet information */ 1493 /* */ 1494 /* Extract the UDP source and destination ports, if present. If compiled */ 1495 /* with IPFILTER_CKSUM, check to see if the UDP checksum is valid. */ 1496 /* ------------------------------------------------------------------------ */ 1497 static INLINE int 1498 ipf_pr_udpcommon(fr_info_t *fin) 1499 { 1500 udphdr_t *udp; 1501 1502 fin->fin_flx |= FI_TCPUDP; 1503 1504 if (!fin->fin_off && (fin->fin_dlen > 3)) { 1505 if (ipf_pr_pullup(fin, sizeof(*udp)) == -1) { 1506 ipf_main_softc_t *softc = fin->fin_main_soft; 1507 1508 fin->fin_flx |= FI_SHORT; 1509 LBUMPD(ipf_stats[fin->fin_out], fr_udp_pullup); 1510 return 1; 1511 } 1512 1513 udp = fin->fin_dp; 1514 1515 fin->fin_sport = ntohs(udp->uh_sport); 1516 fin->fin_dport = ntohs(udp->uh_dport); 1517 } 1518 1519 return 0; 1520 } 1521 1522 1523 /* ------------------------------------------------------------------------ */ 1524 /* Function: ipf_pr_tcp */ 1525 /* Returns: void */ 1526 /* Parameters: fin(I) - pointer to packet information */ 1527 /* */ 1528 /* IPv4 Only */ 1529 /* Analyse the packet for IPv4/TCP properties. */ 1530 /* ------------------------------------------------------------------------ */ 1531 static INLINE void 1532 ipf_pr_tcp(fr_info_t *fin) 1533 { 1534 1535 ipf_pr_short(fin, sizeof(tcphdr_t)); 1536 1537 if (ipf_pr_tcpcommon(fin) == 0) 1538 ipf_checkv4sum(fin); 1539 } 1540 1541 1542 /* ------------------------------------------------------------------------ */ 1543 /* Function: ipf_pr_udp */ 1544 /* Returns: void */ 1545 /* Parameters: fin(I) - pointer to packet information */ 1546 /* */ 1547 /* IPv4 Only */ 1548 /* Analyse the packet for IPv4/UDP properties. */ 1549 /* ------------------------------------------------------------------------ */ 1550 static INLINE void 1551 ipf_pr_udp(fr_info_t *fin) 1552 { 1553 1554 ipf_pr_short(fin, sizeof(udphdr_t)); 1555 1556 if (ipf_pr_udpcommon(fin) == 0) 1557 ipf_checkv4sum(fin); 1558 } 1559 1560 1561 /* ------------------------------------------------------------------------ */ 1562 /* Function: ipf_pr_esp */ 1563 /* Returns: void */ 1564 /* Parameters: fin(I) - pointer to packet information */ 1565 /* */ 1566 /* Analyse the packet for ESP properties. */ 1567 /* The minimum length is taken to be the SPI (32bits) plus a tail (32bits) */ 1568 /* even though the newer ESP packets must also have a sequence number that */ 1569 /* is 32bits as well, it is not possible(?) to determine the version from a */ 1570 /* simple packet header. */ 1571 /* ------------------------------------------------------------------------ */ 1572 static INLINE void 1573 ipf_pr_esp(fr_info_t *fin) 1574 { 1575 1576 if (fin->fin_off == 0) { 1577 ipf_pr_short(fin, 8); 1578 if (ipf_pr_pullup(fin, 8) == -1) { 1579 ipf_main_softc_t *softc = fin->fin_main_soft; 1580 1581 LBUMPD(ipf_stats[fin->fin_out], fr_v4_esp_pullup); 1582 } 1583 } 1584 } 1585 1586 1587 /* ------------------------------------------------------------------------ */ 1588 /* Function: ipf_pr_ah */ 1589 /* Returns: int - value of the next header or IPPROTO_NONE if error */ 1590 /* Parameters: fin(I) - pointer to packet information */ 1591 /* */ 1592 /* Analyse the packet for AH properties. */ 1593 /* The minimum length is taken to be the combination of all fields in the */ 1594 /* header being present and no authentication data (null algorithm used.) */ 1595 /* ------------------------------------------------------------------------ */ 1596 static INLINE int 1597 ipf_pr_ah(fr_info_t *fin) 1598 { 1599 ipf_main_softc_t *softc = fin->fin_main_soft; 1600 authhdr_t *ah; 1601 int len; 1602 1603 fin->fin_flx |= FI_AH; 1604 ipf_pr_short(fin, sizeof(*ah)); 1605 1606 if (((fin->fin_flx & FI_SHORT) != 0) || (fin->fin_off != 0)) { 1607 LBUMPD(ipf_stats[fin->fin_out], fr_v4_ah_bad); 1608 return IPPROTO_NONE; 1609 } 1610 1611 if (ipf_pr_pullup(fin, sizeof(*ah)) == -1) { 1612 DT(fr_v4_ah_pullup_1); 1613 LBUMP(ipf_stats[fin->fin_out].fr_v4_ah_pullup); 1614 return IPPROTO_NONE; 1615 } 1616 1617 ah = (authhdr_t *)fin->fin_dp; 1618 1619 len = (ah->ah_plen + 2) << 2; 1620 ipf_pr_short(fin, len); 1621 if (ipf_pr_pullup(fin, len) == -1) { 1622 DT(fr_v4_ah_pullup_2); 1623 LBUMP(ipf_stats[fin->fin_out].fr_v4_ah_pullup); 1624 return IPPROTO_NONE; 1625 } 1626 1627 /* 1628 * Adjust fin_dp and fin_dlen for skipping over the authentication 1629 * header. 1630 */ 1631 fin->fin_dp = (char *)fin->fin_dp + len; 1632 fin->fin_dlen -= len; 1633 return ah->ah_next; 1634 } 1635 1636 1637 /* ------------------------------------------------------------------------ */ 1638 /* Function: ipf_pr_gre */ 1639 /* Returns: void */ 1640 /* Parameters: fin(I) - pointer to packet information */ 1641 /* */ 1642 /* Analyse the packet for GRE properties. */ 1643 /* ------------------------------------------------------------------------ */ 1644 static INLINE void 1645 ipf_pr_gre(fr_info_t *fin) 1646 { 1647 ipf_main_softc_t *softc = fin->fin_main_soft; 1648 grehdr_t *gre; 1649 1650 ipf_pr_short(fin, sizeof(grehdr_t)); 1651 1652 if (fin->fin_off != 0) { 1653 LBUMPD(ipf_stats[fin->fin_out], fr_v4_gre_frag); 1654 return; 1655 } 1656 1657 if (ipf_pr_pullup(fin, sizeof(grehdr_t)) == -1) { 1658 LBUMPD(ipf_stats[fin->fin_out], fr_v4_gre_pullup); 1659 return; 1660 } 1661 1662 gre = fin->fin_dp; 1663 if (GRE_REV(gre->gr_flags) == 1) 1664 fin->fin_data[0] = gre->gr_call; 1665 } 1666 1667 1668 /* ------------------------------------------------------------------------ */ 1669 /* Function: ipf_pr_ipv4hdr */ 1670 /* Returns: void */ 1671 /* Parameters: fin(I) - pointer to packet information */ 1672 /* */ 1673 /* IPv4 Only */ 1674 /* Analyze the IPv4 header and set fields in the fr_info_t structure. */ 1675 /* Check all options present and flag their presence if any exist. */ 1676 /* ------------------------------------------------------------------------ */ 1677 static INLINE void 1678 ipf_pr_ipv4hdr(fr_info_t *fin) 1679 { 1680 u_short optmsk = 0, secmsk = 0, auth = 0; 1681 int hlen, ol, mv, p, i; 1682 const struct optlist *op; 1683 u_char *s, opt; 1684 u_short off; 1685 fr_ip_t *fi; 1686 ip_t *ip; 1687 1688 fi = &fin->fin_fi; 1689 hlen = fin->fin_hlen; 1690 1691 ip = fin->fin_ip; 1692 p = ip->ip_p; 1693 fi->fi_p = p; 1694 fin->fin_crc = p; 1695 fi->fi_tos = ip->ip_tos; 1696 fin->fin_id = ip->ip_id; 1697 off = ntohs(ip->ip_off); 1698 1699 /* Get both TTL and protocol */ 1700 fi->fi_p = ip->ip_p; 1701 fi->fi_ttl = ip->ip_ttl; 1702 1703 /* Zero out bits not used in IPv6 address */ 1704 fi->fi_src.i6[1] = 0; 1705 fi->fi_src.i6[2] = 0; 1706 fi->fi_src.i6[3] = 0; 1707 fi->fi_dst.i6[1] = 0; 1708 fi->fi_dst.i6[2] = 0; 1709 fi->fi_dst.i6[3] = 0; 1710 1711 fi->fi_saddr = ip->ip_src.s_addr; 1712 fin->fin_crc += fi->fi_saddr; 1713 fi->fi_daddr = ip->ip_dst.s_addr; 1714 fin->fin_crc += fi->fi_daddr; 1715 if (IN_CLASSD(fi->fi_daddr)) 1716 fin->fin_flx |= FI_MULTICAST|FI_MBCAST; 1717 1718 /* 1719 * set packet attribute flags based on the offset and 1720 * calculate the byte offset that it represents. 1721 */ 1722 off &= IP_MF|IP_OFFMASK; 1723 if (off != 0) { 1724 int morefrag = off & IP_MF; 1725 1726 fi->fi_flx |= FI_FRAG; 1727 off &= IP_OFFMASK; 1728 if (off != 0) { 1729 fin->fin_flx |= FI_FRAGBODY; 1730 off <<= 3; 1731 if ((off + fin->fin_dlen > 65535) || 1732 (fin->fin_dlen == 0) || 1733 ((morefrag != 0) && ((fin->fin_dlen & 7) != 0))) { 1734 /* 1735 * The length of the packet, starting at its 1736 * offset cannot exceed 65535 (0xffff) as the 1737 * length of an IP packet is only 16 bits. 1738 * 1739 * Any fragment that isn't the last fragment 1740 * must have a length greater than 0 and it 1741 * must be an even multiple of 8. 1742 */ 1743 fi->fi_flx |= FI_BAD; 1744 DT1(ipf_fi_bad_fragbody_gt_65535, fr_info_t *, fin); 1745 } 1746 } 1747 } 1748 fin->fin_off = off; 1749 1750 /* 1751 * Call per-protocol setup and checking 1752 */ 1753 if (p == IPPROTO_AH) { 1754 /* 1755 * Treat AH differently because we expect there to be another 1756 * layer 4 header after it. 1757 */ 1758 p = ipf_pr_ah(fin); 1759 } 1760 1761 switch (p) 1762 { 1763 case IPPROTO_UDP : 1764 ipf_pr_udp(fin); 1765 break; 1766 case IPPROTO_TCP : 1767 ipf_pr_tcp(fin); 1768 break; 1769 case IPPROTO_ICMP : 1770 ipf_pr_icmp(fin); 1771 break; 1772 case IPPROTO_ESP : 1773 ipf_pr_esp(fin); 1774 break; 1775 case IPPROTO_GRE : 1776 ipf_pr_gre(fin); 1777 break; 1778 } 1779 1780 ip = fin->fin_ip; 1781 if (ip == NULL) 1782 return; 1783 1784 /* 1785 * If it is a standard IP header (no options), set the flag fields 1786 * which relate to options to 0. 1787 */ 1788 if (hlen == sizeof(*ip)) { 1789 fi->fi_optmsk = 0; 1790 fi->fi_secmsk = 0; 1791 fi->fi_auth = 0; 1792 return; 1793 } 1794 1795 /* 1796 * So the IP header has some IP options attached. Walk the entire 1797 * list of options present with this packet and set flags to indicate 1798 * which ones are here and which ones are not. For the somewhat out 1799 * of date and obscure security classification options, set a flag to 1800 * represent which classification is present. 1801 */ 1802 fi->fi_flx |= FI_OPTIONS; 1803 1804 for (s = (u_char *)(ip + 1), hlen -= (int)sizeof(*ip); hlen > 0; ) { 1805 opt = *s; 1806 if (opt == '\0') 1807 break; 1808 else if (opt == IPOPT_NOP) 1809 ol = 1; 1810 else { 1811 if (hlen < 2) 1812 break; 1813 ol = (int)*(s + 1); 1814 if (ol < 2 || ol > hlen) 1815 break; 1816 } 1817 for (i = 9, mv = 4; mv >= 0; ) { 1818 op = ipopts + i; 1819 1820 if ((opt == (u_char)op->ol_val) && (ol > 4)) { 1821 u_32_t doi; 1822 1823 switch (opt) 1824 { 1825 case IPOPT_SECURITY : 1826 if (optmsk & op->ol_bit) { 1827 fin->fin_flx |= FI_BAD; 1828 DT2(ipf_fi_bad_ipopt_security, fr_info_t *, fin, u_short, (optmsk & op->ol_bit)); 1829 } else { 1830 doi = ipf_checkripso(s); 1831 secmsk = doi >> 16; 1832 auth = doi & 0xffff; 1833 } 1834 break; 1835 1836 case IPOPT_CIPSO : 1837 1838 if (optmsk & op->ol_bit) { 1839 fin->fin_flx |= FI_BAD; 1840 DT2(ipf_fi_bad_ipopt_cipso, fr_info_t *, fin, u_short, (optmsk & op->ol_bit)); 1841 } else { 1842 doi = ipf_checkcipso(fin, 1843 s, ol); 1844 secmsk = doi >> 16; 1845 auth = doi & 0xffff; 1846 } 1847 break; 1848 } 1849 optmsk |= op->ol_bit; 1850 } 1851 1852 if (opt < op->ol_val) 1853 i -= mv; 1854 else 1855 i += mv; 1856 mv--; 1857 } 1858 hlen -= ol; 1859 s += ol; 1860 } 1861 1862 /* 1863 * 1864 */ 1865 if (auth && !(auth & 0x0100)) 1866 auth &= 0xff00; 1867 fi->fi_optmsk = optmsk; 1868 fi->fi_secmsk = secmsk; 1869 fi->fi_auth = auth; 1870 } 1871 1872 1873 /* ------------------------------------------------------------------------ */ 1874 /* Function: ipf_checkripso */ 1875 /* Returns: void */ 1876 /* Parameters: s(I) - pointer to start of RIPSO option */ 1877 /* */ 1878 /* ------------------------------------------------------------------------ */ 1879 static u_32_t 1880 ipf_checkripso(u_char *s) 1881 { 1882 const struct optlist *sp; 1883 u_short secmsk = 0, auth = 0; 1884 u_char sec; 1885 int j, m; 1886 1887 sec = *(s + 2); /* classification */ 1888 for (j = 3, m = 2; m >= 0; ) { 1889 sp = secopt + j; 1890 if (sec == sp->ol_val) { 1891 secmsk |= sp->ol_bit; 1892 auth = *(s + 3); 1893 auth *= 256; 1894 auth += *(s + 4); 1895 break; 1896 } 1897 if (sec < sp->ol_val) 1898 j -= m; 1899 else 1900 j += m; 1901 m--; 1902 } 1903 1904 return (secmsk << 16) | auth; 1905 } 1906 1907 1908 /* ------------------------------------------------------------------------ */ 1909 /* Function: ipf_checkcipso */ 1910 /* Returns: u_32_t - 0 = failure, else the doi from the header */ 1911 /* Parameters: fin(IO) - pointer to packet information */ 1912 /* s(I) - pointer to start of CIPSO option */ 1913 /* ol(I) - length of CIPSO option field */ 1914 /* */ 1915 /* This function returns the domain of integrity (DOI) field from the CIPSO */ 1916 /* header and returns that whilst also storing the highest sensitivity */ 1917 /* value found in the fr_info_t structure. */ 1918 /* */ 1919 /* No attempt is made to extract the category bitmaps as these are defined */ 1920 /* by the user (rather than the protocol) and can be rather numerous on the */ 1921 /* end nodes. */ 1922 /* ------------------------------------------------------------------------ */ 1923 static u_32_t 1924 ipf_checkcipso(fr_info_t *fin, u_char *s, int ol) 1925 { 1926 ipf_main_softc_t *softc = fin->fin_main_soft; 1927 fr_ip_t *fi; 1928 u_32_t doi; 1929 u_char *t, tag, tlen, sensitivity; 1930 int len; 1931 1932 if (ol < 6 || ol > 40) { 1933 LBUMPD(ipf_stats[fin->fin_out], fr_v4_cipso_bad); 1934 fin->fin_flx |= FI_BAD; 1935 DT2(ipf_fi_bad_checkcipso_ol, fr_info_t *, fin, u_int, ol); 1936 return 0; 1937 } 1938 1939 fi = &fin->fin_fi; 1940 fi->fi_sensitivity = 0; 1941 /* 1942 * The DOI field MUST be there. 1943 */ 1944 bcopy(s + 2, &doi, sizeof(doi)); 1945 1946 t = (u_char *)s + 6; 1947 for (len = ol - 6; len >= 2; len -= tlen, t+= tlen) { 1948 tag = *t; 1949 tlen = *(t + 1); 1950 if (tlen > len || tlen < 4 || tlen > 34) { 1951 LBUMPD(ipf_stats[fin->fin_out], fr_v4_cipso_tlen); 1952 fin->fin_flx |= FI_BAD; 1953 DT2(ipf_fi_bad_checkcipso_tlen, fr_info_t *, fin, u_int, tlen); 1954 return 0; 1955 } 1956 1957 sensitivity = 0; 1958 /* 1959 * Tag numbers 0, 1, 2, 5 are laid out in the CIPSO Internet 1960 * draft (16 July 1992) that has expired. 1961 */ 1962 if (tag == 0) { 1963 fin->fin_flx |= FI_BAD; 1964 DT2(ipf_fi_bad_checkcipso_tag, fr_info_t *, fin, u_int, tag); 1965 continue; 1966 } else if (tag == 1) { 1967 if (*(t + 2) != 0) { 1968 fin->fin_flx |= FI_BAD; 1969 DT2(ipf_fi_bad_checkcipso_tag1_t2, fr_info_t *, fin, u_int, (*t + 2)); 1970 continue; 1971 } 1972 sensitivity = *(t + 3); 1973 /* Category bitmap for categories 0-239 */ 1974 1975 } else if (tag == 4) { 1976 if (*(t + 2) != 0) { 1977 fin->fin_flx |= FI_BAD; 1978 DT2(ipf_fi_bad_checkcipso_tag4_t2, fr_info_t *, fin, u_int, (*t + 2)); 1979 continue; 1980 } 1981 sensitivity = *(t + 3); 1982 /* Enumerated categories, 16bits each, upto 15 */ 1983 1984 } else if (tag == 5) { 1985 if (*(t + 2) != 0) { 1986 fin->fin_flx |= FI_BAD; 1987 DT2(ipf_fi_bad_checkcipso_tag5_t2, fr_info_t *, fin, u_int, (*t + 2)); 1988 continue; 1989 } 1990 sensitivity = *(t + 3); 1991 /* Range of categories (2*16bits), up to 7 pairs */ 1992 1993 } else if (tag > 127) { 1994 /* Custom defined DOI */ 1995 ; 1996 } else { 1997 DT2(ipf_fi_bad_checkcipso_tag127, fr_info_t *, fin, u_int, tag); 1998 fin->fin_flx |= FI_BAD; 1999 continue; 2000 } 2001 2002 if (sensitivity > fi->fi_sensitivity) 2003 fi->fi_sensitivity = sensitivity; 2004 } 2005 2006 return doi; 2007 } 2008 2009 2010 /* ------------------------------------------------------------------------ */ 2011 /* Function: ipf_makefrip */ 2012 /* Returns: int - 0 == packet ok, -1 == packet freed */ 2013 /* Parameters: hlen(I) - length of IP packet header */ 2014 /* ip(I) - pointer to the IP header */ 2015 /* fin(IO) - pointer to packet information */ 2016 /* */ 2017 /* Compact the IP header into a structure which contains just the info. */ 2018 /* which is useful for comparing IP headers with and store this information */ 2019 /* in the fr_info_t structure pointer to by fin. At present, it is assumed */ 2020 /* this function will be called with either an IPv4 or IPv6 packet. */ 2021 /* ------------------------------------------------------------------------ */ 2022 int 2023 ipf_makefrip(int hlen, ip_t *ip, fr_info_t *fin) 2024 { 2025 ipf_main_softc_t *softc = fin->fin_main_soft; 2026 int v; 2027 2028 fin->fin_depth = 0; 2029 fin->fin_hlen = (u_short)hlen; 2030 fin->fin_ip = ip; 2031 fin->fin_rule = 0xffffffff; 2032 fin->fin_group[0] = -1; 2033 fin->fin_group[1] = '\0'; 2034 fin->fin_dp = (char *)ip + hlen; 2035 2036 v = fin->fin_v; 2037 if (v == 4) { 2038 fin->fin_plen = ntohs(ip->ip_len); 2039 fin->fin_dlen = fin->fin_plen - hlen; 2040 ipf_pr_ipv4hdr(fin); 2041 #ifdef USE_INET6 2042 } else if (v == 6) { 2043 fin->fin_plen = ntohs(((ip6_t *)ip)->ip6_plen); 2044 fin->fin_dlen = fin->fin_plen; 2045 fin->fin_plen += hlen; 2046 2047 ipf_pr_ipv6hdr(fin); 2048 #endif 2049 } 2050 if (fin->fin_ip == NULL) { 2051 LBUMP(ipf_stats[fin->fin_out].fr_ip_freed); 2052 return -1; 2053 } 2054 return 0; 2055 } 2056 2057 2058 /* ------------------------------------------------------------------------ */ 2059 /* Function: ipf_portcheck */ 2060 /* Returns: int - 1 == port matched, 0 == port match failed */ 2061 /* Parameters: frp(I) - pointer to port check `expression' */ 2062 /* pop(I) - port number to evaluate */ 2063 /* */ 2064 /* Perform a comparison of a port number against some other(s), using a */ 2065 /* structure with compare information stored in it. */ 2066 /* ------------------------------------------------------------------------ */ 2067 static INLINE int 2068 ipf_portcheck(frpcmp_t *frp, u_32_t pop) 2069 { 2070 int err = 1; 2071 u_32_t po; 2072 2073 po = frp->frp_port; 2074 2075 /* 2076 * Do opposite test to that required and continue if that succeeds. 2077 */ 2078 switch (frp->frp_cmp) 2079 { 2080 case FR_EQUAL : 2081 if (pop != po) /* EQUAL */ 2082 err = 0; 2083 break; 2084 case FR_NEQUAL : 2085 if (pop == po) /* NOTEQUAL */ 2086 err = 0; 2087 break; 2088 case FR_LESST : 2089 if (pop >= po) /* LESSTHAN */ 2090 err = 0; 2091 break; 2092 case FR_GREATERT : 2093 if (pop <= po) /* GREATERTHAN */ 2094 err = 0; 2095 break; 2096 case FR_LESSTE : 2097 if (pop > po) /* LT or EQ */ 2098 err = 0; 2099 break; 2100 case FR_GREATERTE : 2101 if (pop < po) /* GT or EQ */ 2102 err = 0; 2103 break; 2104 case FR_OUTRANGE : 2105 if (pop >= po && pop <= frp->frp_top) /* Out of range */ 2106 err = 0; 2107 break; 2108 case FR_INRANGE : 2109 if (pop <= po || pop >= frp->frp_top) /* In range */ 2110 err = 0; 2111 break; 2112 case FR_INCRANGE : 2113 if (pop < po || pop > frp->frp_top) /* Inclusive range */ 2114 err = 0; 2115 break; 2116 default : 2117 break; 2118 } 2119 return err; 2120 } 2121 2122 2123 /* ------------------------------------------------------------------------ */ 2124 /* Function: ipf_tcpudpchk */ 2125 /* Returns: int - 1 == protocol matched, 0 == check failed */ 2126 /* Parameters: fda(I) - pointer to packet information */ 2127 /* ft(I) - pointer to structure with comparison data */ 2128 /* */ 2129 /* Compares the current pcket (assuming it is TCP/UDP) information with a */ 2130 /* structure containing information that we want to match against. */ 2131 /* ------------------------------------------------------------------------ */ 2132 int 2133 ipf_tcpudpchk(fr_ip_t *fi, frtuc_t *ft) 2134 { 2135 int err = 1; 2136 2137 /* 2138 * Both ports should *always* be in the first fragment. 2139 * So far, I cannot find any cases where they can not be. 2140 * 2141 * compare destination ports 2142 */ 2143 if (ft->ftu_dcmp) 2144 err = ipf_portcheck(&ft->ftu_dst, fi->fi_ports[1]); 2145 2146 /* 2147 * compare source ports 2148 */ 2149 if (err && ft->ftu_scmp) 2150 err = ipf_portcheck(&ft->ftu_src, fi->fi_ports[0]); 2151 2152 /* 2153 * If we don't have all the TCP/UDP header, then how can we 2154 * expect to do any sort of match on it ? If we were looking for 2155 * TCP flags, then NO match. If not, then match (which should 2156 * satisfy the "short" class too). 2157 */ 2158 if (err && (fi->fi_p == IPPROTO_TCP)) { 2159 if (fi->fi_flx & FI_SHORT) 2160 return !(ft->ftu_tcpf | ft->ftu_tcpfm); 2161 /* 2162 * Match the flags ? If not, abort this match. 2163 */ 2164 if (ft->ftu_tcpfm && 2165 ft->ftu_tcpf != (fi->fi_tcpf & ft->ftu_tcpfm)) { 2166 FR_DEBUG(("f. %#x & %#x != %#x\n", fi->fi_tcpf, 2167 ft->ftu_tcpfm, ft->ftu_tcpf)); 2168 err = 0; 2169 } 2170 } 2171 return err; 2172 } 2173 2174 2175 /* ------------------------------------------------------------------------ */ 2176 /* Function: ipf_check_ipf */ 2177 /* Returns: int - 0 == match, else no match */ 2178 /* Parameters: fin(I) - pointer to packet information */ 2179 /* fr(I) - pointer to filter rule */ 2180 /* portcmp(I) - flag indicating whether to attempt matching on */ 2181 /* TCP/UDP port data. */ 2182 /* */ 2183 /* Check to see if a packet matches an IPFilter rule. Checks of addresses, */ 2184 /* port numbers, etc, for "standard" IPFilter rules are all orchestrated in */ 2185 /* this function. */ 2186 /* ------------------------------------------------------------------------ */ 2187 static INLINE int 2188 ipf_check_ipf(fr_info_t *fin, frentry_t *fr, int portcmp) 2189 { 2190 u_32_t *ld, *lm, *lip; 2191 fripf_t *fri; 2192 fr_ip_t *fi; 2193 int i; 2194 2195 fi = &fin->fin_fi; 2196 fri = fr->fr_ipf; 2197 lip = (u_32_t *)fi; 2198 lm = (u_32_t *)&fri->fri_mip; 2199 ld = (u_32_t *)&fri->fri_ip; 2200 2201 /* 2202 * first 32 bits to check coversion: 2203 * IP version, TOS, TTL, protocol 2204 */ 2205 i = ((*lip & *lm) != *ld); 2206 FR_DEBUG(("0. %#08x & %#08x != %#08x\n", 2207 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2208 if (i) 2209 return 1; 2210 2211 /* 2212 * Next 32 bits is a constructed bitmask indicating which IP options 2213 * are present (if any) in this packet. 2214 */ 2215 lip++, lm++, ld++; 2216 i = ((*lip & *lm) != *ld); 2217 FR_DEBUG(("1. %#08x & %#08x != %#08x\n", 2218 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2219 if (i != 0) 2220 return 1; 2221 2222 lip++, lm++, ld++; 2223 /* 2224 * Unrolled loops (4 each, for 32 bits) for address checks. 2225 */ 2226 /* 2227 * Check the source address. 2228 */ 2229 if (fr->fr_satype == FRI_LOOKUP) { 2230 i = (*fr->fr_srcfunc)(fin->fin_main_soft, fr->fr_srcptr, 2231 fi->fi_v, lip, fin->fin_plen); 2232 if (i == -1) 2233 return 1; 2234 lip += 3; 2235 lm += 3; 2236 ld += 3; 2237 } else { 2238 i = ((*lip & *lm) != *ld); 2239 FR_DEBUG(("2a. %#08x & %#08x != %#08x\n", 2240 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2241 if (fi->fi_v == 6) { 2242 lip++, lm++, ld++; 2243 i |= ((*lip & *lm) != *ld); 2244 FR_DEBUG(("2b. %#08x & %#08x != %#08x\n", 2245 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2246 lip++, lm++, ld++; 2247 i |= ((*lip & *lm) != *ld); 2248 FR_DEBUG(("2c. %#08x & %#08x != %#08x\n", 2249 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2250 lip++, lm++, ld++; 2251 i |= ((*lip & *lm) != *ld); 2252 FR_DEBUG(("2d. %#08x & %#08x != %#08x\n", 2253 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2254 } else { 2255 lip += 3; 2256 lm += 3; 2257 ld += 3; 2258 } 2259 } 2260 i ^= (fr->fr_flags & FR_NOTSRCIP) >> 6; 2261 if (i != 0) 2262 return 1; 2263 2264 /* 2265 * Check the destination address. 2266 */ 2267 lip++, lm++, ld++; 2268 if (fr->fr_datype == FRI_LOOKUP) { 2269 i = (*fr->fr_dstfunc)(fin->fin_main_soft, fr->fr_dstptr, 2270 fi->fi_v, lip, fin->fin_plen); 2271 if (i == -1) 2272 return 1; 2273 lip += 3; 2274 lm += 3; 2275 ld += 3; 2276 } else { 2277 i = ((*lip & *lm) != *ld); 2278 FR_DEBUG(("3a. %#08x & %#08x != %#08x\n", 2279 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2280 if (fi->fi_v == 6) { 2281 lip++, lm++, ld++; 2282 i |= ((*lip & *lm) != *ld); 2283 FR_DEBUG(("3b. %#08x & %#08x != %#08x\n", 2284 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2285 lip++, lm++, ld++; 2286 i |= ((*lip & *lm) != *ld); 2287 FR_DEBUG(("3c. %#08x & %#08x != %#08x\n", 2288 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2289 lip++, lm++, ld++; 2290 i |= ((*lip & *lm) != *ld); 2291 FR_DEBUG(("3d. %#08x & %#08x != %#08x\n", 2292 ntohl(*lip), ntohl(*lm), ntohl(*ld))); 2293 } else { 2294 lip += 3; 2295 lm += 3; 2296 ld += 3; 2297 } 2298 } 2299 i ^= (fr->fr_flags & FR_NOTDSTIP) >> 7; 2300 if (i != 0) 2301 return 1; 2302 /* 2303 * IP addresses matched. The next 32bits contains: 2304 * mast of old IP header security & authentication bits. 2305 */ 2306 lip++, lm++, ld++; 2307 i = (*ld - (*lip & *lm)); 2308 FR_DEBUG(("4. %#08x & %#08x != %#08x\n", *lip, *lm, *ld)); 2309 2310 /* 2311 * Next we have 32 bits of packet flags. 2312 */ 2313 lip++, lm++, ld++; 2314 i |= (*ld - (*lip & *lm)); 2315 FR_DEBUG(("5. %#08x & %#08x != %#08x\n", *lip, *lm, *ld)); 2316 2317 if (i == 0) { 2318 /* 2319 * If a fragment, then only the first has what we're 2320 * looking for here... 2321 */ 2322 if (portcmp) { 2323 if (!ipf_tcpudpchk(&fin->fin_fi, &fr->fr_tuc)) 2324 i = 1; 2325 } else { 2326 if (fr->fr_dcmp || fr->fr_scmp || 2327 fr->fr_tcpf || fr->fr_tcpfm) 2328 i = 1; 2329 if (fr->fr_icmpm || fr->fr_icmp) { 2330 if (((fi->fi_p != IPPROTO_ICMP) && 2331 (fi->fi_p != IPPROTO_ICMPV6)) || 2332 fin->fin_off || (fin->fin_dlen < 2)) 2333 i = 1; 2334 else if ((fin->fin_data[0] & fr->fr_icmpm) != 2335 fr->fr_icmp) { 2336 FR_DEBUG(("i. %#x & %#x != %#x\n", 2337 fin->fin_data[0], 2338 fr->fr_icmpm, fr->fr_icmp)); 2339 i = 1; 2340 } 2341 } 2342 } 2343 } 2344 return i; 2345 } 2346 2347 2348 /* ------------------------------------------------------------------------ */ 2349 /* Function: ipf_scanlist */ 2350 /* Returns: int - result flags of scanning filter list */ 2351 /* Parameters: fin(I) - pointer to packet information */ 2352 /* pass(I) - default result to return for filtering */ 2353 /* */ 2354 /* Check the input/output list of rules for a match to the current packet. */ 2355 /* If a match is found, the value of fr_flags from the rule becomes the */ 2356 /* return value and fin->fin_fr points to the matched rule. */ 2357 /* */ 2358 /* This function may be called recusively upto 16 times (limit inbuilt.) */ 2359 /* When unwinding, it should finish up with fin_depth as 0. */ 2360 /* */ 2361 /* Could be per interface, but this gets real nasty when you don't have, */ 2362 /* or can't easily change, the kernel source code to . */ 2363 /* ------------------------------------------------------------------------ */ 2364 int 2365 ipf_scanlist(fr_info_t *fin, u_32_t pass) 2366 { 2367 ipf_main_softc_t *softc = fin->fin_main_soft; 2368 int rulen, portcmp, off, skip; 2369 struct frentry *fr, *fnext; 2370 u_32_t passt, passo; 2371 2372 /* 2373 * Do not allow nesting deeper than 16 levels. 2374 */ 2375 if (fin->fin_depth >= 16) 2376 return pass; 2377 2378 fr = fin->fin_fr; 2379 2380 /* 2381 * If there are no rules in this list, return now. 2382 */ 2383 if (fr == NULL) 2384 return pass; 2385 2386 skip = 0; 2387 portcmp = 0; 2388 fin->fin_depth++; 2389 fin->fin_fr = NULL; 2390 off = fin->fin_off; 2391 2392 if ((fin->fin_flx & FI_TCPUDP) && (fin->fin_dlen > 3) && !off) 2393 portcmp = 1; 2394 2395 for (rulen = 0; fr; fr = fnext, rulen++) { 2396 fnext = fr->fr_next; 2397 if (skip != 0) { 2398 FR_VERBOSE(("SKIP %d (%#x)\n", skip, fr->fr_flags)); 2399 skip--; 2400 continue; 2401 } 2402 2403 /* 2404 * In all checks below, a null (zero) value in the 2405 * filter struture is taken to mean a wildcard. 2406 * 2407 * check that we are working for the right interface 2408 */ 2409 #ifdef _KERNEL 2410 if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp) 2411 continue; 2412 #else 2413 if (opts & (OPT_VERBOSE|OPT_DEBUG)) 2414 printf("\n"); 2415 FR_VERBOSE(("%c", FR_ISSKIP(pass) ? 's' : 2416 FR_ISPASS(pass) ? 'p' : 2417 FR_ISACCOUNT(pass) ? 'A' : 2418 FR_ISAUTH(pass) ? 'a' : 2419 (pass & FR_NOMATCH) ? 'n' :'b')); 2420 if (fr->fr_ifa && fr->fr_ifa != fin->fin_ifp) 2421 continue; 2422 FR_VERBOSE((":i")); 2423 #endif 2424 2425 switch (fr->fr_type) 2426 { 2427 case FR_T_IPF : 2428 case FR_T_IPF_BUILTIN : 2429 if (ipf_check_ipf(fin, fr, portcmp)) 2430 continue; 2431 break; 2432 #if defined(IPFILTER_BPF) 2433 case FR_T_BPFOPC : 2434 case FR_T_BPFOPC_BUILTIN : 2435 { 2436 u_char *mc; 2437 int wlen; 2438 2439 if (*fin->fin_mp == NULL) 2440 continue; 2441 if (fin->fin_family != fr->fr_family) 2442 continue; 2443 mc = (u_char *)fin->fin_m; 2444 wlen = fin->fin_dlen + fin->fin_hlen; 2445 if (!bpf_filter(fr->fr_data, mc, wlen, 0)) 2446 continue; 2447 break; 2448 } 2449 #endif 2450 case FR_T_CALLFUNC_BUILTIN : 2451 { 2452 frentry_t *f; 2453 2454 f = (*fr->fr_func)(fin, &pass); 2455 if (f != NULL) 2456 fr = f; 2457 else 2458 continue; 2459 break; 2460 } 2461 2462 case FR_T_IPFEXPR : 2463 case FR_T_IPFEXPR_BUILTIN : 2464 if (fin->fin_family != fr->fr_family) 2465 continue; 2466 if (ipf_fr_matcharray(fin, fr->fr_data) == 0) 2467 continue; 2468 break; 2469 2470 default : 2471 break; 2472 } 2473 2474 if ((fin->fin_out == 0) && (fr->fr_nattag.ipt_num[0] != 0)) { 2475 if (fin->fin_nattag == NULL) 2476 continue; 2477 if (ipf_matchtag(&fr->fr_nattag, fin->fin_nattag) == 0) 2478 continue; 2479 } 2480 FR_VERBOSE(("=%d/%d.%d *", fr->fr_grhead, fr->fr_group, rulen)); 2481 2482 passt = fr->fr_flags; 2483 2484 /* 2485 * If the rule is a "call now" rule, then call the function 2486 * in the rule, if it exists and use the results from that. 2487 * If the function pointer is bad, just make like we ignore 2488 * it, except for increasing the hit counter. 2489 */ 2490 if ((passt & FR_CALLNOW) != 0) { 2491 frentry_t *frs; 2492 2493 ATOMIC_INC64(fr->fr_hits); 2494 if ((fr->fr_func == NULL) || 2495 (fr->fr_func == (ipfunc_t)-1)) 2496 continue; 2497 2498 frs = fin->fin_fr; 2499 fin->fin_fr = fr; 2500 fr = (*fr->fr_func)(fin, &passt); 2501 if (fr == NULL) { 2502 fin->fin_fr = frs; 2503 continue; 2504 } 2505 passt = fr->fr_flags; 2506 } 2507 fin->fin_fr = fr; 2508 2509 #ifdef IPFILTER_LOG 2510 /* 2511 * Just log this packet... 2512 */ 2513 if ((passt & FR_LOGMASK) == FR_LOG) { 2514 if (ipf_log_pkt(fin, passt) == -1) { 2515 if (passt & FR_LOGORBLOCK) { 2516 DT(frb_logfail); 2517 passt &= ~FR_CMDMASK; 2518 passt |= FR_BLOCK|FR_QUICK; 2519 fin->fin_reason = FRB_LOGFAIL; 2520 } 2521 } 2522 } 2523 #endif /* IPFILTER_LOG */ 2524 2525 MUTEX_ENTER(&fr->fr_lock); 2526 fr->fr_bytes += (U_QUAD_T)fin->fin_plen; 2527 fr->fr_hits++; 2528 MUTEX_EXIT(&fr->fr_lock); 2529 fin->fin_rule = rulen; 2530 2531 passo = pass; 2532 if (FR_ISSKIP(passt)) { 2533 skip = fr->fr_arg; 2534 continue; 2535 } else if (((passt & FR_LOGMASK) != FR_LOG) && 2536 ((passt & FR_LOGMASK) != FR_DECAPSULATE)) { 2537 pass = passt; 2538 } 2539 2540 if (passt & (FR_RETICMP|FR_FAKEICMP)) 2541 fin->fin_icode = fr->fr_icode; 2542 2543 if (fr->fr_group != -1) { 2544 (void) strncpy(fin->fin_group, 2545 FR_NAME(fr, fr_group), 2546 strlen(FR_NAME(fr, fr_group))); 2547 } else { 2548 fin->fin_group[0] = '\0'; 2549 } 2550 2551 FR_DEBUG(("pass %#x/%#x/%x\n", passo, pass, passt)); 2552 2553 if (fr->fr_grphead != NULL) { 2554 fin->fin_fr = fr->fr_grphead->fg_start; 2555 FR_VERBOSE(("group %s\n", FR_NAME(fr, fr_grhead))); 2556 2557 if (FR_ISDECAPS(passt)) 2558 passt = ipf_decaps(fin, pass, fr->fr_icode); 2559 else 2560 passt = ipf_scanlist(fin, pass); 2561 2562 if (fin->fin_fr == NULL) { 2563 fin->fin_rule = rulen; 2564 if (fr->fr_group != -1) 2565 (void) strncpy(fin->fin_group, 2566 fr->fr_names + 2567 fr->fr_group, 2568 strlen(fr->fr_names + 2569 fr->fr_group)); 2570 fin->fin_fr = fr; 2571 passt = pass; 2572 } 2573 pass = passt; 2574 } 2575 2576 if (pass & FR_QUICK) { 2577 /* 2578 * Finally, if we've asked to track state for this 2579 * packet, set it up. Add state for "quick" rules 2580 * here so that if the action fails we can consider 2581 * the rule to "not match" and keep on processing 2582 * filter rules. 2583 */ 2584 if ((pass & FR_KEEPSTATE) && !FR_ISAUTH(pass) && 2585 !(fin->fin_flx & FI_STATE)) { 2586 int out = fin->fin_out; 2587 2588 fin->fin_fr = fr; 2589 if (ipf_state_add(softc, fin, NULL, 0) == 0) { 2590 LBUMPD(ipf_stats[out], fr_ads); 2591 } else { 2592 LBUMPD(ipf_stats[out], fr_bads); 2593 pass = passo; 2594 continue; 2595 } 2596 } 2597 break; 2598 } 2599 } 2600 fin->fin_depth--; 2601 return pass; 2602 } 2603 2604 2605 /* ------------------------------------------------------------------------ */ 2606 /* Function: ipf_acctpkt */ 2607 /* Returns: frentry_t* - always returns NULL */ 2608 /* Parameters: fin(I) - pointer to packet information */ 2609 /* passp(IO) - pointer to current/new filter decision (unused) */ 2610 /* */ 2611 /* Checks a packet against accounting rules, if there are any for the given */ 2612 /* IP protocol version. */ 2613 /* */ 2614 /* N.B.: this function returns NULL to match the prototype used by other */ 2615 /* functions called from the IPFilter "mainline" in ipf_check(). */ 2616 /* ------------------------------------------------------------------------ */ 2617 frentry_t * 2618 ipf_acctpkt(fr_info_t *fin, u_32_t *passp) 2619 { 2620 ipf_main_softc_t *softc = fin->fin_main_soft; 2621 char group[FR_GROUPLEN]; 2622 frentry_t *fr, *frsave; 2623 u_32_t pass, rulen; 2624 2625 passp = passp; 2626 fr = softc->ipf_acct[fin->fin_out][softc->ipf_active]; 2627 2628 if (fr != NULL) { 2629 frsave = fin->fin_fr; 2630 bcopy(fin->fin_group, group, FR_GROUPLEN); 2631 rulen = fin->fin_rule; 2632 fin->fin_fr = fr; 2633 pass = ipf_scanlist(fin, FR_NOMATCH); 2634 if (FR_ISACCOUNT(pass)) { 2635 LBUMPD(ipf_stats[0], fr_acct); 2636 } 2637 fin->fin_fr = frsave; 2638 bcopy(group, fin->fin_group, FR_GROUPLEN); 2639 fin->fin_rule = rulen; 2640 } 2641 return NULL; 2642 } 2643 2644 2645 /* ------------------------------------------------------------------------ */ 2646 /* Function: ipf_firewall */ 2647 /* Returns: frentry_t* - returns pointer to matched rule, if no matches */ 2648 /* were found, returns NULL. */ 2649 /* Parameters: fin(I) - pointer to packet information */ 2650 /* passp(IO) - pointer to current/new filter decision (unused) */ 2651 /* */ 2652 /* Applies an appropriate set of firewall rules to the packet, to see if */ 2653 /* there are any matches. The first check is to see if a match can be seen */ 2654 /* in the cache. If not, then search an appropriate list of rules. Once a */ 2655 /* matching rule is found, take any appropriate actions as defined by the */ 2656 /* rule - except logging. */ 2657 /* ------------------------------------------------------------------------ */ 2658 static frentry_t * 2659 ipf_firewall(fr_info_t *fin, u_32_t *passp) 2660 { 2661 ipf_main_softc_t *softc = fin->fin_main_soft; 2662 frentry_t *fr; 2663 u_32_t pass; 2664 int out; 2665 2666 out = fin->fin_out; 2667 pass = *passp; 2668 2669 /* 2670 * This rule cache will only affect packets that are not being 2671 * statefully filtered. 2672 */ 2673 fin->fin_fr = softc->ipf_rules[out][softc->ipf_active]; 2674 if (fin->fin_fr != NULL) 2675 pass = ipf_scanlist(fin, softc->ipf_pass); 2676 2677 if ((pass & FR_NOMATCH)) { 2678 LBUMPD(ipf_stats[out], fr_nom); 2679 } 2680 fr = fin->fin_fr; 2681 2682 /* 2683 * Apply packets per second rate-limiting to a rule as required. 2684 */ 2685 if ((fr != NULL) && (fr->fr_pps != 0) && 2686 !ppsratecheck(&fr->fr_lastpkt, &fr->fr_curpps, fr->fr_pps)) { 2687 DT2(frb_ppsrate, fr_info_t *, fin, frentry_t *, fr); 2688 pass &= ~(FR_CMDMASK|FR_RETICMP|FR_RETRST); 2689 pass |= FR_BLOCK; 2690 LBUMPD(ipf_stats[out], fr_ppshit); 2691 fin->fin_reason = FRB_PPSRATE; 2692 } 2693 2694 /* 2695 * If we fail to add a packet to the authorization queue, then we 2696 * drop the packet later. However, if it was added then pretend 2697 * we've dropped it already. 2698 */ 2699 if (FR_ISAUTH(pass)) { 2700 if (ipf_auth_new(fin->fin_m, fin) != 0) { 2701 DT1(frb_authnew, fr_info_t *, fin); 2702 fin->fin_m = *fin->fin_mp = NULL; 2703 fin->fin_reason = FRB_AUTHNEW; 2704 fin->fin_error = 0; 2705 } else { 2706 IPFERROR(1); 2707 fin->fin_error = ENOSPC; 2708 } 2709 } 2710 2711 if ((fr != NULL) && (fr->fr_func != NULL) && 2712 (fr->fr_func != (ipfunc_t)-1) && !(pass & FR_CALLNOW)) 2713 (void) (*fr->fr_func)(fin, &pass); 2714 2715 /* 2716 * If a rule is a pre-auth rule, check again in the list of rules 2717 * loaded for authenticated use. It does not particulary matter 2718 * if this search fails because a "preauth" result, from a rule, 2719 * is treated as "not a pass", hence the packet is blocked. 2720 */ 2721 if (FR_ISPREAUTH(pass)) { 2722 pass = ipf_auth_pre_scanlist(softc, fin, pass); 2723 } 2724 2725 /* 2726 * If the rule has "keep frag" and the packet is actually a fragment, 2727 * then create a fragment state entry. 2728 */ 2729 if (pass & FR_KEEPFRAG) { 2730 if (fin->fin_flx & FI_FRAG) { 2731 if (ipf_frag_new(softc, fin, pass) == -1) { 2732 LBUMP(ipf_stats[out].fr_bnfr); 2733 } else { 2734 LBUMP(ipf_stats[out].fr_nfr); 2735 } 2736 } else { 2737 LBUMP(ipf_stats[out].fr_cfr); 2738 } 2739 } 2740 2741 fr = fin->fin_fr; 2742 *passp = pass; 2743 2744 return fr; 2745 } 2746 2747 2748 /* ------------------------------------------------------------------------ */ 2749 /* Function: ipf_check */ 2750 /* Returns: int - 0 == packet allowed through, */ 2751 /* User space: */ 2752 /* -1 == packet blocked */ 2753 /* 1 == packet not matched */ 2754 /* -2 == requires authentication */ 2755 /* Kernel: */ 2756 /* > 0 == filter error # for packet */ 2757 /* Parameters: ip(I) - pointer to start of IPv4/6 packet */ 2758 /* hlen(I) - length of header */ 2759 /* ifp(I) - pointer to interface this packet is on */ 2760 /* out(I) - 0 == packet going in, 1 == packet going out */ 2761 /* mp(IO) - pointer to caller's buffer pointer that holds this */ 2762 /* IP packet. */ 2763 /* Solaris & HP-UX ONLY : */ 2764 /* qpi(I) - pointer to STREAMS queue information for this */ 2765 /* interface & direction. */ 2766 /* */ 2767 /* ipf_check() is the master function for all IPFilter packet processing. */ 2768 /* It orchestrates: Network Address Translation (NAT), checking for packet */ 2769 /* authorisation (or pre-authorisation), presence of related state info., */ 2770 /* generating log entries, IP packet accounting, routing of packets as */ 2771 /* directed by firewall rules and of course whether or not to allow the */ 2772 /* packet to be further processed by the kernel. */ 2773 /* */ 2774 /* For packets blocked, the contents of "mp" will be NULL'd and the buffer */ 2775 /* freed. Packets passed may be returned with the pointer pointed to by */ 2776 /* by "mp" changed to a new buffer. */ 2777 /* ------------------------------------------------------------------------ */ 2778 int 2779 ipf_check(void *ctx, ip_t *ip, int hlen, void *ifp, int out, 2780 #if defined(_KERNEL) && defined(MENTAT) 2781 void *qif, 2782 #endif 2783 mb_t **mp) 2784 { 2785 /* 2786 * The above really sucks, but short of writing a diff 2787 */ 2788 ipf_main_softc_t *softc = ctx; 2789 fr_info_t frinfo; 2790 fr_info_t *fin = &frinfo; 2791 u_32_t pass = softc->ipf_pass; 2792 frentry_t *fr = NULL; 2793 int v = IP_V(ip); 2794 mb_t *mc = NULL; 2795 mb_t *m; 2796 /* 2797 * The first part of ipf_check() deals with making sure that what goes 2798 * into the filtering engine makes some sense. Information about the 2799 * the packet is distilled, collected into a fr_info_t structure and 2800 * the an attempt to ensure the buffer the packet is in is big enough 2801 * to hold all the required packet headers. 2802 */ 2803 #ifdef _KERNEL 2804 # ifdef MENTAT 2805 qpktinfo_t *qpi = qif; 2806 2807 # ifdef __sparc 2808 if ((u_int)ip & 0x3) 2809 return 2; 2810 # endif 2811 # else 2812 SPL_INT(s); 2813 # endif 2814 2815 if (softc->ipf_running <= 0) { 2816 return 0; 2817 } 2818 2819 bzero((char *)fin, sizeof(*fin)); 2820 2821 # ifdef MENTAT 2822 if (qpi->qpi_flags & QF_BROADCAST) 2823 fin->fin_flx |= FI_MBCAST|FI_BROADCAST; 2824 if (qpi->qpi_flags & QF_MULTICAST) 2825 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2826 m = qpi->qpi_m; 2827 fin->fin_qfm = m; 2828 fin->fin_qpi = qpi; 2829 # else /* MENTAT */ 2830 2831 m = *mp; 2832 2833 # if defined(M_MCAST) 2834 if ((m->m_flags & M_MCAST) != 0) 2835 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2836 # endif 2837 # if defined(M_MLOOP) 2838 if ((m->m_flags & M_MLOOP) != 0) 2839 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2840 # endif 2841 # if defined(M_BCAST) 2842 if ((m->m_flags & M_BCAST) != 0) 2843 fin->fin_flx |= FI_MBCAST|FI_BROADCAST; 2844 # endif 2845 # ifdef M_CANFASTFWD 2846 /* 2847 * XXX For now, IP Filter and fast-forwarding of cached flows 2848 * XXX are mutually exclusive. Eventually, IP Filter should 2849 * XXX get a "can-fast-forward" filter rule. 2850 */ 2851 m->m_flags &= ~M_CANFASTFWD; 2852 # endif /* M_CANFASTFWD */ 2853 # if defined(CSUM_DELAY_DATA) && (!defined(__FreeBSD_version) || \ 2854 (__FreeBSD_version < 501108)) 2855 /* 2856 * disable delayed checksums. 2857 */ 2858 if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) { 2859 in_undefer_cksum_tcpudp(m); 2860 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA; 2861 } 2862 # endif /* CSUM_DELAY_DATA */ 2863 # endif /* MENTAT */ 2864 #else 2865 bzero((char *)fin, sizeof(*fin)); 2866 m = *mp; 2867 # if defined(M_MCAST) 2868 if ((m->m_flags & M_MCAST) != 0) 2869 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2870 # endif 2871 # if defined(M_MLOOP) 2872 if ((m->m_flags & M_MLOOP) != 0) 2873 fin->fin_flx |= FI_MBCAST|FI_MULTICAST; 2874 # endif 2875 # if defined(M_BCAST) 2876 if ((m->m_flags & M_BCAST) != 0) 2877 fin->fin_flx |= FI_MBCAST|FI_BROADCAST; 2878 # endif 2879 #endif /* _KERNEL */ 2880 2881 fin->fin_v = v; 2882 fin->fin_m = m; 2883 fin->fin_ip = ip; 2884 fin->fin_mp = mp; 2885 fin->fin_out = out; 2886 fin->fin_ifp = ifp; 2887 fin->fin_error = ENETUNREACH; 2888 fin->fin_hlen = (u_short)hlen; 2889 fin->fin_dp = (char *)ip + hlen; 2890 fin->fin_main_soft = softc; 2891 2892 fin->fin_ipoff = (char *)ip - MTOD(m, char *); 2893 2894 SPL_NET(s); 2895 2896 #ifdef USE_INET6 2897 if (v == 6) { 2898 LBUMP(ipf_stats[out].fr_ipv6); 2899 /* 2900 * Jumbo grams are quite likely too big for internal buffer 2901 * structures to handle comfortably, for now, so just drop 2902 * them. 2903 */ 2904 if (((ip6_t *)ip)->ip6_plen == 0) { 2905 DT1(frb_jumbo, ip6_t *, (ip6_t *)ip); 2906 pass = FR_BLOCK|FR_NOMATCH; 2907 fin->fin_reason = FRB_JUMBO; 2908 goto finished; 2909 } 2910 fin->fin_family = AF_INET6; 2911 } else 2912 #endif 2913 { 2914 fin->fin_family = AF_INET; 2915 } 2916 2917 if (ipf_makefrip(hlen, ip, fin) == -1) { 2918 DT1(frb_makefrip, fr_info_t *, fin); 2919 pass = FR_BLOCK|FR_NOMATCH; 2920 fin->fin_reason = FRB_MAKEFRIP; 2921 goto finished; 2922 } 2923 2924 /* 2925 * For at least IPv6 packets, if a m_pullup() fails then this pointer 2926 * becomes NULL and so we have no packet to free. 2927 */ 2928 if (*fin->fin_mp == NULL) 2929 goto finished; 2930 2931 if (!out) { 2932 if (v == 4) { 2933 if (softc->ipf_chksrc && !ipf_verifysrc(fin)) { 2934 LBUMPD(ipf_stats[0], fr_v4_badsrc); 2935 fin->fin_flx |= FI_BADSRC; 2936 } 2937 if (fin->fin_ip->ip_ttl < softc->ipf_minttl) { 2938 LBUMPD(ipf_stats[0], fr_v4_badttl); 2939 fin->fin_flx |= FI_LOWTTL; 2940 } 2941 } 2942 #ifdef USE_INET6 2943 else if (v == 6) { 2944 if (((ip6_t *)ip)->ip6_hlim < softc->ipf_minttl) { 2945 LBUMPD(ipf_stats[0], fr_v6_badttl); 2946 fin->fin_flx |= FI_LOWTTL; 2947 } 2948 } 2949 #endif 2950 } 2951 2952 if (fin->fin_flx & FI_SHORT) { 2953 LBUMPD(ipf_stats[out], fr_short); 2954 } 2955 2956 READ_ENTER(&softc->ipf_mutex); 2957 2958 if (!out) { 2959 switch (fin->fin_v) 2960 { 2961 case 4 : 2962 if (ipf_nat_checkin(fin, &pass) == -1) { 2963 goto filterdone; 2964 } 2965 break; 2966 #ifdef USE_INET6 2967 case 6 : 2968 if (ipf_nat6_checkin(fin, &pass) == -1) { 2969 goto filterdone; 2970 } 2971 break; 2972 #endif 2973 default : 2974 break; 2975 } 2976 } 2977 /* 2978 * Check auth now. 2979 * If a packet is found in the auth table, then skip checking 2980 * the access lists for permission but we do need to consider 2981 * the result as if it were from the ACL's. In addition, being 2982 * found in the auth table means it has been seen before, so do 2983 * not pass it through accounting (again), lest it be counted twice. 2984 */ 2985 fr = ipf_auth_check(fin, &pass); 2986 if (!out && (fr == NULL)) 2987 (void) ipf_acctpkt(fin, NULL); 2988 2989 if (fr == NULL) { 2990 if ((fin->fin_flx & FI_FRAG) != 0) 2991 fr = ipf_frag_known(fin, &pass); 2992 2993 if (fr == NULL) 2994 fr = ipf_state_check(fin, &pass); 2995 } 2996 2997 if ((pass & FR_NOMATCH) || (fr == NULL)) 2998 fr = ipf_firewall(fin, &pass); 2999 3000 /* 3001 * If we've asked to track state for this packet, set it up. 3002 * Here rather than ipf_firewall because ipf_checkauth may decide 3003 * to return a packet for "keep state" 3004 */ 3005 if ((pass & FR_KEEPSTATE) && (fin->fin_m != NULL) && 3006 !(fin->fin_flx & FI_STATE)) { 3007 if (ipf_state_add(softc, fin, NULL, 0) == 0) { 3008 LBUMP(ipf_stats[out].fr_ads); 3009 } else { 3010 LBUMP(ipf_stats[out].fr_bads); 3011 if (FR_ISPASS(pass)) { 3012 DT(frb_stateadd); 3013 pass &= ~FR_CMDMASK; 3014 pass |= FR_BLOCK; 3015 fin->fin_reason = FRB_STATEADD; 3016 } 3017 } 3018 } 3019 3020 fin->fin_fr = fr; 3021 if ((fr != NULL) && !(fin->fin_flx & FI_STATE)) { 3022 fin->fin_dif = &fr->fr_dif; 3023 fin->fin_tif = &fr->fr_tifs[fin->fin_rev]; 3024 } 3025 3026 /* 3027 * Only count/translate packets which will be passed on, out the 3028 * interface. 3029 */ 3030 if (out && FR_ISPASS(pass)) { 3031 (void) ipf_acctpkt(fin, NULL); 3032 3033 switch (fin->fin_v) 3034 { 3035 case 4 : 3036 if (ipf_nat_checkout(fin, &pass) == -1) { 3037 ; 3038 } else if ((softc->ipf_update_ipid != 0) && (v == 4)) { 3039 if (ipf_updateipid(fin) == -1) { 3040 DT(frb_updateipid); 3041 LBUMP(ipf_stats[1].fr_ipud); 3042 pass &= ~FR_CMDMASK; 3043 pass |= FR_BLOCK; 3044 fin->fin_reason = FRB_UPDATEIPID; 3045 } else { 3046 LBUMP(ipf_stats[0].fr_ipud); 3047 } 3048 } 3049 break; 3050 #ifdef USE_INET6 3051 case 6 : 3052 (void) ipf_nat6_checkout(fin, &pass); 3053 break; 3054 #endif 3055 default : 3056 break; 3057 } 3058 } 3059 3060 filterdone: 3061 #ifdef IPFILTER_LOG 3062 if ((softc->ipf_flags & FF_LOGGING) || (pass & FR_LOGMASK)) { 3063 (void) ipf_dolog(fin, &pass); 3064 } 3065 #endif 3066 3067 /* 3068 * The FI_STATE flag is cleared here so that calling ipf_state_check 3069 * will work when called from inside of fr_fastroute. Although 3070 * there is a similar flag, FI_NATED, for NAT, it does have the same 3071 * impact on code execution. 3072 */ 3073 fin->fin_flx &= ~FI_STATE; 3074 3075 #if defined(FASTROUTE_RECURSION) 3076 /* 3077 * Up the reference on fr_lock and exit ipf_mutex. The generation of 3078 * a packet below can sometimes cause a recursive call into IPFilter. 3079 * On those platforms where that does happen, we need to hang onto 3080 * the filter rule just in case someone decides to remove or flush it 3081 * in the meantime. 3082 */ 3083 if (fr != NULL) { 3084 MUTEX_ENTER(&fr->fr_lock); 3085 fr->fr_ref++; 3086 MUTEX_EXIT(&fr->fr_lock); 3087 } 3088 3089 RWLOCK_EXIT(&softc->ipf_mutex); 3090 #endif 3091 3092 if ((pass & FR_RETMASK) != 0) { 3093 /* 3094 * Should we return an ICMP packet to indicate error 3095 * status passing through the packet filter ? 3096 * WARNING: ICMP error packets AND TCP RST packets should 3097 * ONLY be sent in repsonse to incoming packets. Sending 3098 * them in response to outbound packets can result in a 3099 * panic on some operating systems. 3100 */ 3101 if (!out) { 3102 if (pass & FR_RETICMP) { 3103 int dst; 3104 3105 if ((pass & FR_RETMASK) == FR_FAKEICMP) 3106 dst = 1; 3107 else 3108 dst = 0; 3109 (void) ipf_send_icmp_err(ICMP_UNREACH, fin, 3110 dst); 3111 LBUMP(ipf_stats[0].fr_ret); 3112 } else if (((pass & FR_RETMASK) == FR_RETRST) && 3113 !(fin->fin_flx & FI_SHORT)) { 3114 if (((fin->fin_flx & FI_OOW) != 0) || 3115 (ipf_send_reset(fin) == 0)) { 3116 LBUMP(ipf_stats[1].fr_ret); 3117 } 3118 } 3119 3120 /* 3121 * When using return-* with auth rules, the auth code 3122 * takes over disposing of this packet. 3123 */ 3124 if (FR_ISAUTH(pass) && (fin->fin_m != NULL)) { 3125 DT1(frb_authcapture, fr_info_t *, fin); 3126 fin->fin_m = *fin->fin_mp = NULL; 3127 fin->fin_reason = FRB_AUTHCAPTURE; 3128 m = NULL; 3129 } 3130 } else { 3131 if (pass & FR_RETRST) { 3132 fin->fin_error = ECONNRESET; 3133 } 3134 } 3135 } 3136 3137 /* 3138 * After the above so that ICMP unreachables and TCP RSTs get 3139 * created properly. 3140 */ 3141 if (FR_ISBLOCK(pass) && (fin->fin_flx & FI_NEWNAT)) 3142 ipf_nat_uncreate(fin); 3143 3144 /* 3145 * If we didn't drop off the bottom of the list of rules (and thus 3146 * the 'current' rule fr is not NULL), then we may have some extra 3147 * instructions about what to do with a packet. 3148 * Once we're finished return to our caller, freeing the packet if 3149 * we are dropping it. 3150 */ 3151 if (fr != NULL) { 3152 frdest_t *fdp; 3153 3154 /* 3155 * Generate a duplicated packet first because ipf_fastroute 3156 * can lead to fin_m being free'd... not good. 3157 */ 3158 fdp = fin->fin_dif; 3159 if ((fdp != NULL) && (fdp->fd_ptr != NULL) && 3160 (fdp->fd_ptr != (void *)-1) && (fin->fin_m != NULL)) { 3161 mc = M_COPY(fin->fin_m); 3162 if (mc != NULL) 3163 ipf_fastroute(mc, &mc, fin, fdp); 3164 } 3165 3166 fdp = fin->fin_tif; 3167 if (!out && (pass & FR_FASTROUTE)) { 3168 /* 3169 * For fastroute rule, no destination interface defined 3170 * so pass NULL as the frdest_t parameter 3171 */ 3172 (void) ipf_fastroute(fin->fin_m, mp, fin, NULL); 3173 m = *mp = NULL; 3174 } else if ((fdp != NULL) && (fdp->fd_ptr != NULL) && 3175 (fdp->fd_ptr != (struct ifnet *)-1)) { 3176 /* this is for to rules: */ 3177 ipf_fastroute(fin->fin_m, mp, fin, fdp); 3178 m = *mp = NULL; 3179 } 3180 3181 #if defined(FASTROUTE_RECURSION) 3182 (void) ipf_derefrule(softc, &fr); 3183 #endif 3184 } 3185 #if !defined(FASTROUTE_RECURSION) 3186 RWLOCK_EXIT(&softc->ipf_mutex); 3187 #endif 3188 3189 finished: 3190 if (!FR_ISPASS(pass)) { 3191 LBUMP(ipf_stats[out].fr_block); 3192 if (*mp != NULL) { 3193 #ifdef _KERNEL 3194 FREE_MB_T(*mp); 3195 #endif 3196 m = *mp = NULL; 3197 } 3198 } else { 3199 LBUMP(ipf_stats[out].fr_pass); 3200 #if defined(_KERNEL) && defined(__sgi) 3201 if ((fin->fin_hbuf != NULL) && 3202 (mtod(fin->fin_m, struct ip *) != fin->fin_ip)) { 3203 COPYBACK(fin->fin_m, 0, fin->fin_plen, fin->fin_hbuf); 3204 } 3205 #endif 3206 } 3207 3208 SPL_X(s); 3209 3210 #ifdef _KERNEL 3211 if (FR_ISPASS(pass)) 3212 return 0; 3213 LBUMP(ipf_stats[out].fr_blocked[fin->fin_reason]); 3214 return fin->fin_error; 3215 #else /* _KERNEL */ 3216 if (*mp != NULL) 3217 (*mp)->mb_ifp = fin->fin_ifp; 3218 blockreason = fin->fin_reason; 3219 FR_VERBOSE(("fin_flx %#x pass %#x ", fin->fin_flx, pass)); 3220 /*if ((pass & FR_CMDMASK) == (softc->ipf_pass & FR_CMDMASK))*/ 3221 if ((pass & FR_NOMATCH) != 0) 3222 return 1; 3223 3224 if ((pass & FR_RETMASK) != 0) 3225 switch (pass & FR_RETMASK) 3226 { 3227 case FR_RETRST : 3228 return 3; 3229 case FR_RETICMP : 3230 return 4; 3231 case FR_FAKEICMP : 3232 return 5; 3233 } 3234 3235 switch (pass & FR_CMDMASK) 3236 { 3237 case FR_PASS : 3238 return 0; 3239 case FR_BLOCK : 3240 return -1; 3241 case FR_AUTH : 3242 return -2; 3243 case FR_ACCOUNT : 3244 return -3; 3245 case FR_PREAUTH : 3246 return -4; 3247 } 3248 return 2; 3249 #endif /* _KERNEL */ 3250 } 3251 3252 3253 #ifdef IPFILTER_LOG 3254 /* ------------------------------------------------------------------------ */ 3255 /* Function: ipf_dolog */ 3256 /* Returns: frentry_t* - returns contents of fin_fr (no change made) */ 3257 /* Parameters: fin(I) - pointer to packet information */ 3258 /* passp(IO) - pointer to current/new filter decision (unused) */ 3259 /* */ 3260 /* Checks flags set to see how a packet should be logged, if it is to be */ 3261 /* logged. Adjust statistics based on its success or not. */ 3262 /* ------------------------------------------------------------------------ */ 3263 frentry_t * 3264 ipf_dolog(fr_info_t *fin, u_32_t *passp) 3265 { 3266 ipf_main_softc_t *softc = fin->fin_main_soft; 3267 u_32_t pass; 3268 int out; 3269 3270 out = fin->fin_out; 3271 pass = *passp; 3272 3273 if ((softc->ipf_flags & FF_LOGNOMATCH) && (pass & FR_NOMATCH)) { 3274 pass |= FF_LOGNOMATCH; 3275 LBUMPD(ipf_stats[out], fr_npkl); 3276 goto logit; 3277 3278 } else if (((pass & FR_LOGMASK) == FR_LOGP) || 3279 (FR_ISPASS(pass) && (softc->ipf_flags & FF_LOGPASS))) { 3280 if ((pass & FR_LOGMASK) != FR_LOGP) 3281 pass |= FF_LOGPASS; 3282 LBUMPD(ipf_stats[out], fr_ppkl); 3283 goto logit; 3284 3285 } else if (((pass & FR_LOGMASK) == FR_LOGB) || 3286 (FR_ISBLOCK(pass) && (softc->ipf_flags & FF_LOGBLOCK))) { 3287 if ((pass & FR_LOGMASK) != FR_LOGB) 3288 pass |= FF_LOGBLOCK; 3289 LBUMPD(ipf_stats[out], fr_bpkl); 3290 3291 logit: 3292 if (ipf_log_pkt(fin, pass) == -1) { 3293 /* 3294 * If the "or-block" option has been used then 3295 * block the packet if we failed to log it. 3296 */ 3297 if ((pass & FR_LOGORBLOCK) && FR_ISPASS(pass)) { 3298 DT1(frb_logfail2, u_int, pass); 3299 pass &= ~FR_CMDMASK; 3300 pass |= FR_BLOCK; 3301 fin->fin_reason = FRB_LOGFAIL2; 3302 } 3303 } 3304 *passp = pass; 3305 } 3306 3307 return fin->fin_fr; 3308 } 3309 #endif /* IPFILTER_LOG */ 3310 3311 3312 /* ------------------------------------------------------------------------ */ 3313 /* Function: ipf_cksum */ 3314 /* Returns: u_short - IP header checksum */ 3315 /* Parameters: addr(I) - pointer to start of buffer to checksum */ 3316 /* len(I) - length of buffer in bytes */ 3317 /* */ 3318 /* Calculate the two's complement 16 bit checksum of the buffer passed. */ 3319 /* */ 3320 /* N.B.: addr should be 16bit aligned. */ 3321 /* ------------------------------------------------------------------------ */ 3322 u_short 3323 ipf_cksum(u_short *addr, int len) 3324 { 3325 u_32_t sum = 0; 3326 3327 for (sum = 0; len > 1; len -= 2) 3328 sum += *addr++; 3329 3330 /* mop up an odd byte, if necessary */ 3331 if (len == 1) 3332 sum += *(u_char *)addr; 3333 3334 /* 3335 * add back carry outs from top 16 bits to low 16 bits 3336 */ 3337 sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */ 3338 sum += (sum >> 16); /* add carry */ 3339 return (u_short)(~sum); 3340 } 3341 3342 3343 /* ------------------------------------------------------------------------ */ 3344 /* Function: fr_cksum */ 3345 /* Returns: u_short - layer 4 checksum */ 3346 /* Parameters: fin(I) - pointer to packet information */ 3347 /* ip(I) - pointer to IP header */ 3348 /* l4proto(I) - protocol to caclulate checksum for */ 3349 /* l4hdr(I) - pointer to layer 4 header */ 3350 /* */ 3351 /* Calculates the TCP checksum for the packet held in "m", using the data */ 3352 /* in the IP header "ip" to seed it. */ 3353 /* */ 3354 /* NB: This function assumes we've pullup'd enough for all of the IP header */ 3355 /* and the TCP header. We also assume that data blocks aren't allocated in */ 3356 /* odd sizes. */ 3357 /* */ 3358 /* Expects ip_len and ip_off to be in network byte order when called. */ 3359 /* ------------------------------------------------------------------------ */ 3360 u_short 3361 fr_cksum(fr_info_t *fin, ip_t *ip, int l4proto, void *l4hdr) 3362 { 3363 u_short *sp, slen, sumsave, *csump; 3364 u_int sum, sum2; 3365 int hlen; 3366 int off; 3367 #ifdef USE_INET6 3368 ip6_t *ip6; 3369 #endif 3370 3371 csump = NULL; 3372 sumsave = 0; 3373 sp = NULL; 3374 slen = 0; 3375 hlen = 0; 3376 sum = 0; 3377 3378 sum = htons((u_short)l4proto); 3379 /* 3380 * Add up IP Header portion 3381 */ 3382 #ifdef USE_INET6 3383 if (IP_V(ip) == 4) { 3384 #endif 3385 hlen = IP_HL(ip) << 2; 3386 off = hlen; 3387 sp = (u_short *)&ip->ip_src; 3388 sum += *sp++; /* ip_src */ 3389 sum += *sp++; 3390 sum += *sp++; /* ip_dst */ 3391 sum += *sp++; 3392 #ifdef USE_INET6 3393 } else if (IP_V(ip) == 6) { 3394 ip6 = (ip6_t *)ip; 3395 hlen = sizeof(*ip6); 3396 off = ((char *)fin->fin_dp - (char *)fin->fin_ip); 3397 sp = (u_short *)&ip6->ip6_src; 3398 sum += *sp++; /* ip6_src */ 3399 sum += *sp++; 3400 sum += *sp++; 3401 sum += *sp++; 3402 sum += *sp++; 3403 sum += *sp++; 3404 sum += *sp++; 3405 sum += *sp++; 3406 /* This needs to be routing header aware. */ 3407 sum += *sp++; /* ip6_dst */ 3408 sum += *sp++; 3409 sum += *sp++; 3410 sum += *sp++; 3411 sum += *sp++; 3412 sum += *sp++; 3413 sum += *sp++; 3414 sum += *sp++; 3415 } else { 3416 return 0xffff; 3417 } 3418 #endif 3419 slen = fin->fin_plen - off; 3420 sum += htons(slen); 3421 3422 switch (l4proto) 3423 { 3424 case IPPROTO_UDP : 3425 csump = &((udphdr_t *)l4hdr)->uh_sum; 3426 break; 3427 3428 case IPPROTO_TCP : 3429 csump = &((tcphdr_t *)l4hdr)->th_sum; 3430 break; 3431 case IPPROTO_ICMP : 3432 csump = &((icmphdr_t *)l4hdr)->icmp_cksum; 3433 sum = 0; /* Pseudo-checksum is not included */ 3434 break; 3435 #ifdef USE_INET6 3436 case IPPROTO_ICMPV6 : 3437 csump = &((struct icmp6_hdr *)l4hdr)->icmp6_cksum; 3438 break; 3439 #endif 3440 default : 3441 break; 3442 } 3443 3444 if (csump != NULL) { 3445 sumsave = *csump; 3446 *csump = 0; 3447 } 3448 3449 sum2 = ipf_pcksum(fin, off, sum); 3450 if (csump != NULL) 3451 *csump = sumsave; 3452 return sum2; 3453 } 3454 3455 3456 /* ------------------------------------------------------------------------ */ 3457 /* Function: ipf_findgroup */ 3458 /* Returns: frgroup_t * - NULL = group not found, else pointer to group */ 3459 /* Parameters: softc(I) - pointer to soft context main structure */ 3460 /* group(I) - group name to search for */ 3461 /* unit(I) - device to which this group belongs */ 3462 /* set(I) - which set of rules (inactive/inactive) this is */ 3463 /* fgpp(O) - pointer to place to store pointer to the pointer */ 3464 /* to where to add the next (last) group or where */ 3465 /* to delete group from. */ 3466 /* */ 3467 /* Search amongst the defined groups for a particular group number. */ 3468 /* ------------------------------------------------------------------------ */ 3469 frgroup_t * 3470 ipf_findgroup(ipf_main_softc_t *softc, char *group, minor_t unit, int set, 3471 frgroup_t ***fgpp) 3472 { 3473 frgroup_t *fg, **fgp; 3474 3475 /* 3476 * Which list of groups to search in is dependent on which list of 3477 * rules are being operated on. 3478 */ 3479 fgp = &softc->ipf_groups[unit][set]; 3480 3481 while ((fg = *fgp) != NULL) { 3482 if (strncmp(group, fg->fg_name, FR_GROUPLEN) == 0) 3483 break; 3484 else 3485 fgp = &fg->fg_next; 3486 } 3487 if (fgpp != NULL) 3488 *fgpp = fgp; 3489 return fg; 3490 } 3491 3492 3493 /* ------------------------------------------------------------------------ */ 3494 /* Function: ipf_group_add */ 3495 /* Returns: frgroup_t * - NULL == did not create group, */ 3496 /* != NULL == pointer to the group */ 3497 /* Parameters: softc(I) - pointer to soft context main structure */ 3498 /* num(I) - group number to add */ 3499 /* head(I) - rule pointer that is using this as the head */ 3500 /* flags(I) - rule flags which describe the type of rule it is */ 3501 /* unit(I) - device to which this group will belong to */ 3502 /* set(I) - which set of rules (inactive/inactive) this is */ 3503 /* Write Locks: ipf_mutex */ 3504 /* */ 3505 /* Add a new group head, or if it already exists, increase the reference */ 3506 /* count to it. */ 3507 /* ------------------------------------------------------------------------ */ 3508 frgroup_t * 3509 ipf_group_add(ipf_main_softc_t *softc, char *group, void *head, u_32_t flags, 3510 minor_t unit, int set) 3511 { 3512 frgroup_t *fg, **fgp; 3513 u_32_t gflags; 3514 3515 if (group == NULL) 3516 return NULL; 3517 3518 if (unit == IPL_LOGIPF && *group == '\0') 3519 return NULL; 3520 3521 fgp = NULL; 3522 gflags = flags & FR_INOUT; 3523 3524 fg = ipf_findgroup(softc, group, unit, set, &fgp); 3525 if (fg != NULL) { 3526 if (fg->fg_head == NULL && head != NULL) 3527 fg->fg_head = head; 3528 if (fg->fg_flags == 0) 3529 fg->fg_flags = gflags; 3530 else if (gflags != fg->fg_flags) 3531 return NULL; 3532 fg->fg_ref++; 3533 return fg; 3534 } 3535 3536 KMALLOC(fg, frgroup_t *); 3537 if (fg != NULL) { 3538 fg->fg_head = head; 3539 fg->fg_start = NULL; 3540 fg->fg_next = *fgp; 3541 bcopy(group, fg->fg_name, strlen(group) + 1); 3542 fg->fg_flags = gflags; 3543 fg->fg_ref = 1; 3544 fg->fg_set = &softc->ipf_groups[unit][set]; 3545 *fgp = fg; 3546 } 3547 return fg; 3548 } 3549 3550 3551 /* ------------------------------------------------------------------------ */ 3552 /* Function: ipf_group_del */ 3553 /* Returns: int - number of rules deleted */ 3554 /* Parameters: softc(I) - pointer to soft context main structure */ 3555 /* group(I) - group name to delete */ 3556 /* fr(I) - filter rule from which group is referenced */ 3557 /* Write Locks: ipf_mutex */ 3558 /* */ 3559 /* This function is called whenever a reference to a group is to be dropped */ 3560 /* and thus its reference count needs to be lowered and the group free'd if */ 3561 /* the reference count reaches zero. Passing in fr is really for the sole */ 3562 /* purpose of knowing when the head rule is being deleted. */ 3563 /* ------------------------------------------------------------------------ */ 3564 void 3565 ipf_group_del(ipf_main_softc_t *softc, frgroup_t *group, frentry_t *fr) 3566 { 3567 3568 if (group->fg_head == fr) 3569 group->fg_head = NULL; 3570 3571 group->fg_ref--; 3572 if ((group->fg_ref == 0) && (group->fg_start == NULL)) 3573 ipf_group_free(group); 3574 } 3575 3576 3577 /* ------------------------------------------------------------------------ */ 3578 /* Function: ipf_group_free */ 3579 /* Returns: Nil */ 3580 /* Parameters: group(I) - pointer to filter rule group */ 3581 /* */ 3582 /* Remove the group from the list of groups and free it. */ 3583 /* ------------------------------------------------------------------------ */ 3584 static void 3585 ipf_group_free(frgroup_t *group) 3586 { 3587 frgroup_t **gp; 3588 3589 for (gp = group->fg_set; *gp != NULL; gp = &(*gp)->fg_next) { 3590 if (*gp == group) { 3591 *gp = group->fg_next; 3592 break; 3593 } 3594 } 3595 KFREE(group); 3596 } 3597 3598 3599 /* ------------------------------------------------------------------------ */ 3600 /* Function: ipf_group_flush */ 3601 /* Returns: int - number of rules flush from group */ 3602 /* Parameters: softc(I) - pointer to soft context main structure */ 3603 /* Parameters: group(I) - pointer to filter rule group */ 3604 /* */ 3605 /* Remove all of the rules that currently are listed under the given group. */ 3606 /* ------------------------------------------------------------------------ */ 3607 static int 3608 ipf_group_flush(ipf_main_softc_t *softc, frgroup_t *group) 3609 { 3610 int gone = 0; 3611 3612 (void) ipf_flushlist(softc, &gone, &group->fg_start); 3613 3614 return gone; 3615 } 3616 3617 3618 /* ------------------------------------------------------------------------ */ 3619 /* Function: ipf_getrulen */ 3620 /* Returns: frentry_t * - NULL == not found, else pointer to rule n */ 3621 /* Parameters: softc(I) - pointer to soft context main structure */ 3622 /* Parameters: unit(I) - device for which to count the rule's number */ 3623 /* flags(I) - which set of rules to find the rule in */ 3624 /* group(I) - group name */ 3625 /* n(I) - rule number to find */ 3626 /* */ 3627 /* Find rule # n in group # g and return a pointer to it. Return NULl if */ 3628 /* group # g doesn't exist or there are less than n rules in the group. */ 3629 /* ------------------------------------------------------------------------ */ 3630 frentry_t * 3631 ipf_getrulen(ipf_main_softc_t *softc, int unit, char *group, u_32_t n) 3632 { 3633 frentry_t *fr; 3634 frgroup_t *fg; 3635 3636 fg = ipf_findgroup(softc, group, unit, softc->ipf_active, NULL); 3637 if (fg == NULL) 3638 return NULL; 3639 for (fr = fg->fg_start; fr && n; fr = fr->fr_next, n--) 3640 ; 3641 if (n != 0) 3642 return NULL; 3643 return fr; 3644 } 3645 3646 3647 /* ------------------------------------------------------------------------ */ 3648 /* Function: ipf_flushlist */ 3649 /* Returns: int - >= 0 - number of flushed rules */ 3650 /* Parameters: softc(I) - pointer to soft context main structure */ 3651 /* nfreedp(O) - pointer to int where flush count is stored */ 3652 /* listp(I) - pointer to list to flush pointer */ 3653 /* Write Locks: ipf_mutex */ 3654 /* */ 3655 /* Recursively flush rules from the list, descending groups as they are */ 3656 /* encountered. if a rule is the head of a group and it has lost all its */ 3657 /* group members, then also delete the group reference. nfreedp is needed */ 3658 /* to store the accumulating count of rules removed, whereas the returned */ 3659 /* value is just the number removed from the current list. The latter is */ 3660 /* needed to correctly adjust reference counts on rules that define groups. */ 3661 /* */ 3662 /* NOTE: Rules not loaded from user space cannot be flushed. */ 3663 /* ------------------------------------------------------------------------ */ 3664 static int 3665 ipf_flushlist(ipf_main_softc_t *softc, int *nfreedp, frentry_t **listp) 3666 { 3667 int freed = 0; 3668 frentry_t *fp; 3669 3670 while ((fp = *listp) != NULL) { 3671 if ((fp->fr_type & FR_T_BUILTIN) || 3672 !(fp->fr_flags & FR_COPIED)) { 3673 listp = &fp->fr_next; 3674 continue; 3675 } 3676 *listp = fp->fr_next; 3677 if (fp->fr_next != NULL) 3678 fp->fr_next->fr_pnext = fp->fr_pnext; 3679 fp->fr_pnext = NULL; 3680 3681 if (fp->fr_grphead != NULL) { 3682 freed += ipf_group_flush(softc, fp->fr_grphead); 3683 fp->fr_names[fp->fr_grhead] = '\0'; 3684 } 3685 3686 if (fp->fr_icmpgrp != NULL) { 3687 freed += ipf_group_flush(softc, fp->fr_icmpgrp); 3688 fp->fr_names[fp->fr_icmphead] = '\0'; 3689 } 3690 3691 if (fp->fr_srctrack.ht_max_nodes) 3692 ipf_rb_ht_flush(&fp->fr_srctrack); 3693 3694 fp->fr_next = NULL; 3695 3696 ASSERT(fp->fr_ref > 0); 3697 if (ipf_derefrule(softc, &fp) == 0) 3698 freed++; 3699 } 3700 *nfreedp += freed; 3701 return freed; 3702 } 3703 3704 3705 /* ------------------------------------------------------------------------ */ 3706 /* Function: ipf_flush */ 3707 /* Returns: int - >= 0 - number of flushed rules */ 3708 /* Parameters: softc(I) - pointer to soft context main structure */ 3709 /* unit(I) - device for which to flush rules */ 3710 /* flags(I) - which set of rules to flush */ 3711 /* */ 3712 /* Calls flushlist() for all filter rules (accounting, firewall - both IPv4 */ 3713 /* and IPv6) as defined by the value of flags. */ 3714 /* ------------------------------------------------------------------------ */ 3715 int 3716 ipf_flush(ipf_main_softc_t *softc, minor_t unit, int flags) 3717 { 3718 int flushed = 0, set; 3719 3720 WRITE_ENTER(&softc->ipf_mutex); 3721 3722 set = softc->ipf_active; 3723 if ((flags & FR_INACTIVE) == FR_INACTIVE) 3724 set = 1 - set; 3725 3726 if (flags & FR_OUTQUE) { 3727 ipf_flushlist(softc, &flushed, &softc->ipf_rules[1][set]); 3728 ipf_flushlist(softc, &flushed, &softc->ipf_acct[1][set]); 3729 } 3730 if (flags & FR_INQUE) { 3731 ipf_flushlist(softc, &flushed, &softc->ipf_rules[0][set]); 3732 ipf_flushlist(softc, &flushed, &softc->ipf_acct[0][set]); 3733 } 3734 3735 flushed += ipf_flush_groups(softc, &softc->ipf_groups[unit][set], 3736 flags & (FR_INQUE|FR_OUTQUE)); 3737 3738 RWLOCK_EXIT(&softc->ipf_mutex); 3739 3740 if (unit == IPL_LOGIPF) { 3741 int tmp; 3742 3743 tmp = ipf_flush(softc, IPL_LOGCOUNT, flags); 3744 if (tmp >= 0) 3745 flushed += tmp; 3746 } 3747 return flushed; 3748 } 3749 3750 3751 /* ------------------------------------------------------------------------ */ 3752 /* Function: ipf_flush_groups */ 3753 /* Returns: int - >= 0 - number of flushed rules */ 3754 /* Parameters: softc(I) - soft context pointerto work with */ 3755 /* grhead(I) - pointer to the start of the group list to flush */ 3756 /* flags(I) - which set of rules to flush */ 3757 /* */ 3758 /* Walk through all of the groups under the given group head and remove all */ 3759 /* of those that match the flags passed in. The for loop here is bit more */ 3760 /* complicated than usual because the removal of a rule with ipf_derefrule */ 3761 /* may end up removing not only the structure pointed to by "fg" but also */ 3762 /* what is fg_next and fg_next after that. So if a filter rule is actually */ 3763 /* removed from the group then it is necessary to start again. */ 3764 /* ------------------------------------------------------------------------ */ 3765 static int 3766 ipf_flush_groups( ipf_main_softc_t *softc, frgroup_t **grhead, int flags) 3767 { 3768 frentry_t *fr, **frp; 3769 frgroup_t *fg, **fgp; 3770 int flushed = 0; 3771 int removed = 0; 3772 3773 for (fgp = grhead; (fg = *fgp) != NULL; ) { 3774 while ((fg != NULL) && ((fg->fg_flags & flags) == 0)) 3775 fg = fg->fg_next; 3776 if (fg == NULL) 3777 break; 3778 removed = 0; 3779 frp = &fg->fg_start; 3780 while ((removed == 0) && ((fr = *frp) != NULL)) { 3781 if ((fr->fr_flags & flags) == 0) { 3782 frp = &fr->fr_next; 3783 } else { 3784 if (fr->fr_next != NULL) 3785 fr->fr_next->fr_pnext = fr->fr_pnext; 3786 *frp = fr->fr_next; 3787 fr->fr_pnext = NULL; 3788 fr->fr_next = NULL; 3789 (void) ipf_derefrule(softc, &fr); 3790 flushed++; 3791 removed++; 3792 } 3793 } 3794 if (removed == 0) 3795 fgp = &fg->fg_next; 3796 } 3797 return flushed; 3798 } 3799 3800 3801 /* ------------------------------------------------------------------------ */ 3802 /* Function: memstr */ 3803 /* Returns: char * - NULL if failed, != NULL pointer to matching bytes */ 3804 /* Parameters: src(I) - pointer to byte sequence to match */ 3805 /* dst(I) - pointer to byte sequence to search */ 3806 /* slen(I) - match length */ 3807 /* dlen(I) - length available to search in */ 3808 /* */ 3809 /* Search dst for a sequence of bytes matching those at src and extend for */ 3810 /* slen bytes. */ 3811 /* ------------------------------------------------------------------------ */ 3812 char * 3813 memstr(const char *src, char *dst, size_t slen, size_t dlen) 3814 { 3815 char *s = NULL; 3816 3817 while (dlen >= slen) { 3818 if (memcmp(src, dst, slen) == 0) { 3819 s = dst; 3820 break; 3821 } 3822 dst++; 3823 dlen--; 3824 } 3825 return s; 3826 } 3827 3828 3829 /* ------------------------------------------------------------------------ */ 3830 /* Function: ipf_fixskip */ 3831 /* Returns: Nil */ 3832 /* Parameters: listp(IO) - pointer to start of list with skip rule */ 3833 /* rp(I) - rule added/removed with skip in it. */ 3834 /* addremove(I) - adjustment (-1/+1) to make to skip count, */ 3835 /* depending on whether a rule was just added */ 3836 /* or removed. */ 3837 /* */ 3838 /* Adjust all the rules in a list which would have skip'd past the position */ 3839 /* where we are inserting to skip to the right place given the change. */ 3840 /* ------------------------------------------------------------------------ */ 3841 void 3842 ipf_fixskip(frentry_t **listp, frentry_t *rp, int addremove) 3843 { 3844 int rules, rn; 3845 frentry_t *fp; 3846 3847 rules = 0; 3848 for (fp = *listp; (fp != NULL) && (fp != rp); fp = fp->fr_next) 3849 rules++; 3850 3851 if (!fp) 3852 return; 3853 3854 for (rn = 0, fp = *listp; fp && (fp != rp); fp = fp->fr_next, rn++) 3855 if (FR_ISSKIP(fp->fr_flags) && (rn + fp->fr_arg >= rules)) 3856 fp->fr_arg += addremove; 3857 } 3858 3859 3860 #ifdef _KERNEL 3861 /* ------------------------------------------------------------------------ */ 3862 /* Function: count4bits */ 3863 /* Returns: int - >= 0 - number of consecutive bits in input */ 3864 /* Parameters: ip(I) - 32bit IP address */ 3865 /* */ 3866 /* IPv4 ONLY */ 3867 /* count consecutive 1's in bit mask. If the mask generated by counting */ 3868 /* consecutive 1's is different to that passed, return -1, else return # */ 3869 /* of bits. */ 3870 /* ------------------------------------------------------------------------ */ 3871 int 3872 count4bits(u_32_t ip) 3873 { 3874 u_32_t ipn; 3875 int cnt = 0, i, j; 3876 3877 ip = ipn = ntohl(ip); 3878 for (i = 32; i; i--, ipn *= 2) 3879 if (ipn & 0x80000000) 3880 cnt++; 3881 else 3882 break; 3883 ipn = 0; 3884 for (i = 32, j = cnt; i; i--, j--) { 3885 ipn *= 2; 3886 if (j > 0) 3887 ipn++; 3888 } 3889 if (ipn == ip) 3890 return cnt; 3891 return -1; 3892 } 3893 3894 3895 /* ------------------------------------------------------------------------ */ 3896 /* Function: count6bits */ 3897 /* Returns: int - >= 0 - number of consecutive bits in input */ 3898 /* Parameters: msk(I) - pointer to start of IPv6 bitmask */ 3899 /* */ 3900 /* IPv6 ONLY */ 3901 /* count consecutive 1's in bit mask. */ 3902 /* ------------------------------------------------------------------------ */ 3903 # ifdef USE_INET6 3904 int 3905 count6bits(u_32_t *msk) 3906 { 3907 int i = 0, k; 3908 u_32_t j; 3909 3910 for (k = 3; k >= 0; k--) 3911 if (msk[k] == 0xffffffff) 3912 i += 32; 3913 else { 3914 for (j = msk[k]; j; j <<= 1) 3915 if (j & 0x80000000) 3916 i++; 3917 } 3918 return i; 3919 } 3920 # endif 3921 #endif /* _KERNEL */ 3922 3923 3924 /* ------------------------------------------------------------------------ */ 3925 /* Function: ipf_synclist */ 3926 /* Returns: int - 0 = no failures, else indication of first failure */ 3927 /* Parameters: fr(I) - start of filter list to sync interface names for */ 3928 /* ifp(I) - interface pointer for limiting sync lookups */ 3929 /* Write Locks: ipf_mutex */ 3930 /* */ 3931 /* Walk through a list of filter rules and resolve any interface names into */ 3932 /* pointers. Where dynamic addresses are used, also update the IP address */ 3933 /* used in the rule. The interface pointer is used to limit the lookups to */ 3934 /* a specific set of matching names if it is non-NULL. */ 3935 /* Errors can occur when resolving the destination name of to/dup-to fields */ 3936 /* when the name points to a pool and that pool doest not exist. If this */ 3937 /* does happen then it is necessary to check if there are any lookup refs */ 3938 /* that need to be dropped before returning with an error. */ 3939 /* ------------------------------------------------------------------------ */ 3940 static int 3941 ipf_synclist(ipf_main_softc_t *softc, frentry_t *fr, void *ifp) 3942 { 3943 frentry_t *frt, *start = fr; 3944 frdest_t *fdp; 3945 char *name; 3946 int error; 3947 void *ifa; 3948 int v, i; 3949 3950 error = 0; 3951 3952 for (; fr; fr = fr->fr_next) { 3953 if (fr->fr_family == AF_INET) 3954 v = 4; 3955 else if (fr->fr_family == AF_INET6) 3956 v = 6; 3957 else 3958 v = 0; 3959 3960 /* 3961 * Lookup all the interface names that are part of the rule. 3962 */ 3963 for (i = 0; i < 4; i++) { 3964 if ((ifp != NULL) && (fr->fr_ifas[i] != ifp)) 3965 continue; 3966 if (fr->fr_ifnames[i] == -1) 3967 continue; 3968 name = FR_NAME(fr, fr_ifnames[i]); 3969 fr->fr_ifas[i] = ipf_resolvenic(softc, name, v); 3970 } 3971 3972 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) { 3973 if (fr->fr_satype != FRI_NORMAL && 3974 fr->fr_satype != FRI_LOOKUP) { 3975 ifa = ipf_resolvenic(softc, fr->fr_names + 3976 fr->fr_sifpidx, v); 3977 ipf_ifpaddr(softc, v, fr->fr_satype, ifa, 3978 &fr->fr_src6, &fr->fr_smsk6); 3979 } 3980 if (fr->fr_datype != FRI_NORMAL && 3981 fr->fr_datype != FRI_LOOKUP) { 3982 ifa = ipf_resolvenic(softc, fr->fr_names + 3983 fr->fr_sifpidx, v); 3984 ipf_ifpaddr(softc, v, fr->fr_datype, ifa, 3985 &fr->fr_dst6, &fr->fr_dmsk6); 3986 } 3987 } 3988 3989 fdp = &fr->fr_tifs[0]; 3990 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) { 3991 error = ipf_resolvedest(softc, fr->fr_names, fdp, v); 3992 if (error != 0) 3993 goto unwind; 3994 } 3995 3996 fdp = &fr->fr_tifs[1]; 3997 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) { 3998 error = ipf_resolvedest(softc, fr->fr_names, fdp, v); 3999 if (error != 0) 4000 goto unwind; 4001 } 4002 4003 fdp = &fr->fr_dif; 4004 if ((ifp == NULL) || (fdp->fd_ptr == ifp)) { 4005 error = ipf_resolvedest(softc, fr->fr_names, fdp, v); 4006 if (error != 0) 4007 goto unwind; 4008 } 4009 4010 if (((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4011 (fr->fr_satype == FRI_LOOKUP) && (fr->fr_srcptr == NULL)) { 4012 fr->fr_srcptr = ipf_lookup_res_num(softc, 4013 fr->fr_srctype, 4014 IPL_LOGIPF, 4015 fr->fr_srcnum, 4016 &fr->fr_srcfunc); 4017 } 4018 if (((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4019 (fr->fr_datype == FRI_LOOKUP) && (fr->fr_dstptr == NULL)) { 4020 fr->fr_dstptr = ipf_lookup_res_num(softc, 4021 fr->fr_dsttype, 4022 IPL_LOGIPF, 4023 fr->fr_dstnum, 4024 &fr->fr_dstfunc); 4025 } 4026 } 4027 return 0; 4028 4029 unwind: 4030 for (frt = start; frt != fr; fr = fr->fr_next) { 4031 if (((frt->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4032 (frt->fr_satype == FRI_LOOKUP) && (frt->fr_srcptr != NULL)) 4033 ipf_lookup_deref(softc, frt->fr_srctype, 4034 frt->fr_srcptr); 4035 if (((frt->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) && 4036 (frt->fr_datype == FRI_LOOKUP) && (frt->fr_dstptr != NULL)) 4037 ipf_lookup_deref(softc, frt->fr_dsttype, 4038 frt->fr_dstptr); 4039 } 4040 return error; 4041 } 4042 4043 4044 /* ------------------------------------------------------------------------ */ 4045 /* Function: ipf_sync */ 4046 /* Returns: void */ 4047 /* Parameters: Nil */ 4048 /* */ 4049 /* ipf_sync() is called when we suspect that the interface list or */ 4050 /* information about interfaces (like IP#) has changed. Go through all */ 4051 /* filter rules, NAT entries and the state table and check if anything */ 4052 /* needs to be changed/updated. */ 4053 /* ------------------------------------------------------------------------ */ 4054 int 4055 ipf_sync(ipf_main_softc_t *softc, void *ifp) 4056 { 4057 int i; 4058 4059 # if !SOLARIS 4060 ipf_nat_sync(softc, ifp); 4061 ipf_state_sync(softc, ifp); 4062 ipf_lookup_sync(softc, ifp); 4063 # endif 4064 4065 WRITE_ENTER(&softc->ipf_mutex); 4066 (void) ipf_synclist(softc, softc->ipf_acct[0][softc->ipf_active], ifp); 4067 (void) ipf_synclist(softc, softc->ipf_acct[1][softc->ipf_active], ifp); 4068 (void) ipf_synclist(softc, softc->ipf_rules[0][softc->ipf_active], ifp); 4069 (void) ipf_synclist(softc, softc->ipf_rules[1][softc->ipf_active], ifp); 4070 4071 for (i = 0; i < IPL_LOGSIZE; i++) { 4072 frgroup_t *g; 4073 4074 for (g = softc->ipf_groups[i][0]; g != NULL; g = g->fg_next) 4075 (void) ipf_synclist(softc, g->fg_start, ifp); 4076 for (g = softc->ipf_groups[i][1]; g != NULL; g = g->fg_next) 4077 (void) ipf_synclist(softc, g->fg_start, ifp); 4078 } 4079 RWLOCK_EXIT(&softc->ipf_mutex); 4080 4081 return 0; 4082 } 4083 4084 4085 /* 4086 * In the functions below, bcopy() is called because the pointer being 4087 * copied _from_ in this instance is a pointer to a char buf (which could 4088 * end up being unaligned) and on the kernel's local stack. 4089 */ 4090 /* ------------------------------------------------------------------------ */ 4091 /* Function: copyinptr */ 4092 /* Returns: int - 0 = success, else failure */ 4093 /* Parameters: src(I) - pointer to the source address */ 4094 /* dst(I) - destination address */ 4095 /* size(I) - number of bytes to copy */ 4096 /* */ 4097 /* Copy a block of data in from user space, given a pointer to the pointer */ 4098 /* to start copying from (src) and a pointer to where to store it (dst). */ 4099 /* NB: src - pointer to user space pointer, dst - kernel space pointer */ 4100 /* ------------------------------------------------------------------------ */ 4101 int 4102 copyinptr(ipf_main_softc_t *softc, void *src, void *dst, size_t size) 4103 { 4104 void *ca; 4105 int error; 4106 4107 # if SOLARIS 4108 error = COPYIN(src, &ca, sizeof(ca)); 4109 if (error != 0) 4110 return error; 4111 # else 4112 bcopy(src, (void *)&ca, sizeof(ca)); 4113 # endif 4114 error = COPYIN(ca, dst, size); 4115 if (error != 0) { 4116 IPFERROR(3); 4117 error = EFAULT; 4118 } 4119 return error; 4120 } 4121 4122 4123 /* ------------------------------------------------------------------------ */ 4124 /* Function: copyoutptr */ 4125 /* Returns: int - 0 = success, else failure */ 4126 /* Parameters: src(I) - pointer to the source address */ 4127 /* dst(I) - destination address */ 4128 /* size(I) - number of bytes to copy */ 4129 /* */ 4130 /* Copy a block of data out to user space, given a pointer to the pointer */ 4131 /* to start copying from (src) and a pointer to where to store it (dst). */ 4132 /* NB: src - kernel space pointer, dst - pointer to user space pointer. */ 4133 /* ------------------------------------------------------------------------ */ 4134 int 4135 copyoutptr(ipf_main_softc_t *softc, void *src, void *dst, size_t size) 4136 { 4137 void *ca; 4138 int error; 4139 4140 bcopy(dst, &ca, sizeof(ca)); 4141 error = COPYOUT(src, ca, size); 4142 if (error != 0) { 4143 IPFERROR(4); 4144 error = EFAULT; 4145 } 4146 return error; 4147 } 4148 #ifdef _KERNEL 4149 #endif 4150 4151 4152 /* ------------------------------------------------------------------------ */ 4153 /* Function: ipf_lock */ 4154 /* Returns: int - 0 = success, else error */ 4155 /* Parameters: data(I) - pointer to lock value to set */ 4156 /* lockp(O) - pointer to location to store old lock value */ 4157 /* */ 4158 /* Get the new value for the lock integer, set it and return the old value */ 4159 /* in *lockp. */ 4160 /* ------------------------------------------------------------------------ */ 4161 int 4162 ipf_lock(void *data, int *lockp) 4163 { 4164 int arg, err; 4165 4166 err = BCOPYIN(data, &arg, sizeof(arg)); 4167 if (err != 0) 4168 return EFAULT; 4169 err = BCOPYOUT(lockp, data, sizeof(*lockp)); 4170 if (err != 0) 4171 return EFAULT; 4172 *lockp = arg; 4173 return 0; 4174 } 4175 4176 4177 /* ------------------------------------------------------------------------ */ 4178 /* Function: ipf_getstat */ 4179 /* Returns: Nil */ 4180 /* Parameters: softc(I) - pointer to soft context main structure */ 4181 /* fiop(I) - pointer to ipfilter stats structure */ 4182 /* rev(I) - version claim by program doing ioctl */ 4183 /* */ 4184 /* Stores a copy of current pointers, counters, etc, in the friostat */ 4185 /* structure. */ 4186 /* If IPFILTER_COMPAT is compiled, we pretend to be whatever version the */ 4187 /* program is looking for. This ensure that validation of the version it */ 4188 /* expects will always succeed. Thus kernels with IPFILTER_COMPAT will */ 4189 /* allow older binaries to work but kernels without it will not. */ 4190 /* ------------------------------------------------------------------------ */ 4191 /*ARGSUSED*/ 4192 static void 4193 ipf_getstat(ipf_main_softc_t *softc, friostat_t *fiop, int rev) 4194 { 4195 int i; 4196 4197 bcopy((char *)softc->ipf_stats, (char *)fiop->f_st, 4198 sizeof(ipf_statistics_t) * 2); 4199 fiop->f_locks[IPL_LOGSTATE] = -1; 4200 fiop->f_locks[IPL_LOGNAT] = -1; 4201 fiop->f_locks[IPL_LOGIPF] = -1; 4202 fiop->f_locks[IPL_LOGAUTH] = -1; 4203 4204 fiop->f_ipf[0][0] = softc->ipf_rules[0][0]; 4205 fiop->f_acct[0][0] = softc->ipf_acct[0][0]; 4206 fiop->f_ipf[0][1] = softc->ipf_rules[0][1]; 4207 fiop->f_acct[0][1] = softc->ipf_acct[0][1]; 4208 fiop->f_ipf[1][0] = softc->ipf_rules[1][0]; 4209 fiop->f_acct[1][0] = softc->ipf_acct[1][0]; 4210 fiop->f_ipf[1][1] = softc->ipf_rules[1][1]; 4211 fiop->f_acct[1][1] = softc->ipf_acct[1][1]; 4212 4213 fiop->f_ticks = softc->ipf_ticks; 4214 fiop->f_active = softc->ipf_active; 4215 fiop->f_froute[0] = softc->ipf_frouteok[0]; 4216 fiop->f_froute[1] = softc->ipf_frouteok[1]; 4217 fiop->f_rb_no_mem = softc->ipf_rb_no_mem; 4218 fiop->f_rb_node_max = softc->ipf_rb_node_max; 4219 4220 fiop->f_running = softc->ipf_running; 4221 for (i = 0; i < IPL_LOGSIZE; i++) { 4222 fiop->f_groups[i][0] = softc->ipf_groups[i][0]; 4223 fiop->f_groups[i][1] = softc->ipf_groups[i][1]; 4224 } 4225 #ifdef IPFILTER_LOG 4226 fiop->f_log_ok = ipf_log_logok(softc, IPL_LOGIPF); 4227 fiop->f_log_fail = ipf_log_failures(softc, IPL_LOGIPF); 4228 fiop->f_logging = 1; 4229 #else 4230 fiop->f_log_ok = 0; 4231 fiop->f_log_fail = 0; 4232 fiop->f_logging = 0; 4233 #endif 4234 fiop->f_defpass = softc->ipf_pass; 4235 fiop->f_features = ipf_features; 4236 4237 #ifdef IPFILTER_COMPAT 4238 snprintf(fiop->f_version, sizeof(fiop->f_version), 4239 "IP Filter: v%d.%d.%d", (rev / 1000000) % 100, 4240 (rev / 10000) % 100, (rev / 100) % 100); 4241 #else 4242 rev = rev; 4243 (void) strncpy(fiop->f_version, ipfilter_version, 4244 sizeof(fiop->f_version)); 4245 fiop->f_version[sizeof(fiop->f_version) - 1] = '\0'; 4246 #endif 4247 } 4248 4249 4250 #ifdef USE_INET6 4251 int icmptoicmp6types[ICMP_MAXTYPE+1] = { 4252 ICMP6_ECHO_REPLY, /* 0: ICMP_ECHOREPLY */ 4253 -1, /* 1: UNUSED */ 4254 -1, /* 2: UNUSED */ 4255 ICMP6_DST_UNREACH, /* 3: ICMP_UNREACH */ 4256 -1, /* 4: ICMP_SOURCEQUENCH */ 4257 ND_REDIRECT, /* 5: ICMP_REDIRECT */ 4258 -1, /* 6: UNUSED */ 4259 -1, /* 7: UNUSED */ 4260 ICMP6_ECHO_REQUEST, /* 8: ICMP_ECHO */ 4261 -1, /* 9: UNUSED */ 4262 -1, /* 10: UNUSED */ 4263 ICMP6_TIME_EXCEEDED, /* 11: ICMP_TIMXCEED */ 4264 ICMP6_PARAM_PROB, /* 12: ICMP_PARAMPROB */ 4265 -1, /* 13: ICMP_TSTAMP */ 4266 -1, /* 14: ICMP_TSTAMPREPLY */ 4267 -1, /* 15: ICMP_IREQ */ 4268 -1, /* 16: ICMP_IREQREPLY */ 4269 -1, /* 17: ICMP_MASKREQ */ 4270 -1, /* 18: ICMP_MASKREPLY */ 4271 }; 4272 4273 4274 int icmptoicmp6unreach[ICMP_MAX_UNREACH] = { 4275 ICMP6_DST_UNREACH_ADDR, /* 0: ICMP_UNREACH_NET */ 4276 ICMP6_DST_UNREACH_ADDR, /* 1: ICMP_UNREACH_HOST */ 4277 -1, /* 2: ICMP_UNREACH_PROTOCOL */ 4278 ICMP6_DST_UNREACH_NOPORT, /* 3: ICMP_UNREACH_PORT */ 4279 -1, /* 4: ICMP_UNREACH_NEEDFRAG */ 4280 ICMP6_DST_UNREACH_NOTNEIGHBOR, /* 5: ICMP_UNREACH_SRCFAIL */ 4281 ICMP6_DST_UNREACH_ADDR, /* 6: ICMP_UNREACH_NET_UNKNOWN */ 4282 ICMP6_DST_UNREACH_ADDR, /* 7: ICMP_UNREACH_HOST_UNKNOWN */ 4283 -1, /* 8: ICMP_UNREACH_ISOLATED */ 4284 ICMP6_DST_UNREACH_ADMIN, /* 9: ICMP_UNREACH_NET_PROHIB */ 4285 ICMP6_DST_UNREACH_ADMIN, /* 10: ICMP_UNREACH_HOST_PROHIB */ 4286 -1, /* 11: ICMP_UNREACH_TOSNET */ 4287 -1, /* 12: ICMP_UNREACH_TOSHOST */ 4288 ICMP6_DST_UNREACH_ADMIN, /* 13: ICMP_UNREACH_ADMIN_PROHIBIT */ 4289 }; 4290 int icmpreplytype6[ICMP6_MAXTYPE + 1]; 4291 #endif 4292 4293 int icmpreplytype4[ICMP_MAXTYPE + 1]; 4294 4295 4296 /* ------------------------------------------------------------------------ */ 4297 /* Function: ipf_matchicmpqueryreply */ 4298 /* Returns: int - 1 if "icmp" is a valid reply to "ic" else 0. */ 4299 /* Parameters: v(I) - IP protocol version (4 or 6) */ 4300 /* ic(I) - ICMP information */ 4301 /* icmp(I) - ICMP packet header */ 4302 /* rev(I) - direction (0 = forward/1 = reverse) of packet */ 4303 /* */ 4304 /* Check if the ICMP packet defined by the header pointed to by icmp is a */ 4305 /* reply to one as described by what's in ic. If it is a match, return 1, */ 4306 /* else return 0 for no match. */ 4307 /* ------------------------------------------------------------------------ */ 4308 int 4309 ipf_matchicmpqueryreply(int v, icmpinfo_t *ic, icmphdr_t *icmp, int rev) 4310 { 4311 int ictype; 4312 4313 ictype = ic->ici_type; 4314 4315 if (v == 4) { 4316 /* 4317 * If we matched its type on the way in, then when going out 4318 * it will still be the same type. 4319 */ 4320 if ((!rev && (icmp->icmp_type == ictype)) || 4321 (rev && (icmpreplytype4[ictype] == icmp->icmp_type))) { 4322 if (icmp->icmp_type != ICMP_ECHOREPLY) 4323 return 1; 4324 if (icmp->icmp_id == ic->ici_id) 4325 return 1; 4326 } 4327 } 4328 #ifdef USE_INET6 4329 else if (v == 6) { 4330 if ((!rev && (icmp->icmp_type == ictype)) || 4331 (rev && (icmpreplytype6[ictype] == icmp->icmp_type))) { 4332 if (icmp->icmp_type != ICMP6_ECHO_REPLY) 4333 return 1; 4334 if (icmp->icmp_id == ic->ici_id) 4335 return 1; 4336 } 4337 } 4338 #endif 4339 return 0; 4340 } 4341 4342 /* ------------------------------------------------------------------------ */ 4343 /* Function: ipf_rule_compare */ 4344 /* Parameters: fr1(I) - first rule structure to compare */ 4345 /* fr2(I) - second rule structure to compare */ 4346 /* Returns: int - 0 == rules are the same, else mismatch */ 4347 /* */ 4348 /* Compare two rules and return 0 if they match or a number indicating */ 4349 /* which of the individual checks failed. */ 4350 /* ------------------------------------------------------------------------ */ 4351 static int 4352 ipf_rule_compare(frentry_t *fr1, frentry_t *fr2) 4353 { 4354 if (fr1->fr_cksum != fr2->fr_cksum) 4355 return 1; 4356 if (fr1->fr_size != fr2->fr_size) 4357 return 2; 4358 if (fr1->fr_dsize != fr2->fr_dsize) 4359 return 3; 4360 if (memcmp(&fr1->fr_func, &fr2->fr_func, 4361 fr1->fr_size - offsetof(struct frentry, fr_func)) != 0) 4362 return 4; 4363 if (fr1->fr_data && !fr2->fr_data) 4364 return 5; 4365 if (!fr1->fr_data && fr2->fr_data) 4366 return 6; 4367 if (fr1->fr_data) { 4368 if (memcmp(fr1->fr_caddr, fr2->fr_caddr, fr1->fr_dsize)) 4369 return 7; 4370 } 4371 return 0; 4372 } 4373 4374 4375 /* ------------------------------------------------------------------------ */ 4376 /* Function: frrequest */ 4377 /* Returns: int - 0 == success, > 0 == errno value */ 4378 /* Parameters: unit(I) - device for which this is for */ 4379 /* req(I) - ioctl command (SIOC*) */ 4380 /* data(I) - pointr to ioctl data */ 4381 /* set(I) - 1 or 0 (filter set) */ 4382 /* makecopy(I) - flag indicating whether data points to a rule */ 4383 /* in kernel space & hence doesn't need copying. */ 4384 /* */ 4385 /* This function handles all the requests which operate on the list of */ 4386 /* filter rules. This includes adding, deleting, insertion. It is also */ 4387 /* responsible for creating groups when a "head" rule is loaded. Interface */ 4388 /* names are resolved here and other sanity checks are made on the content */ 4389 /* of the rule structure being loaded. If a rule has user defined timeouts */ 4390 /* then make sure they are created and initialised before exiting. */ 4391 /* ------------------------------------------------------------------------ */ 4392 int 4393 frrequest(ipf_main_softc_t *softc, int unit, ioctlcmd_t req, void *data, 4394 int set, int makecopy) 4395 { 4396 int error = 0, in, family, addrem, need_free = 0; 4397 frentry_t frd, *fp, *f, **fprev, **ftail; 4398 void *ptr, *uptr; 4399 u_int *p, *pp; 4400 frgroup_t *fg; 4401 char *group; 4402 4403 ptr = NULL; 4404 fg = NULL; 4405 fp = &frd; 4406 if (makecopy != 0) { 4407 bzero(fp, sizeof(frd)); 4408 error = ipf_inobj(softc, data, NULL, fp, IPFOBJ_FRENTRY); 4409 if (error) { 4410 return error; 4411 } 4412 if ((fp->fr_type & FR_T_BUILTIN) != 0) { 4413 IPFERROR(6); 4414 return EINVAL; 4415 } 4416 KMALLOCS(f, frentry_t *, fp->fr_size); 4417 if (f == NULL) { 4418 IPFERROR(131); 4419 return ENOMEM; 4420 } 4421 bzero(f, fp->fr_size); 4422 error = ipf_inobjsz(softc, data, f, IPFOBJ_FRENTRY, 4423 fp->fr_size); 4424 if (error) { 4425 KFREES(f, fp->fr_size); 4426 return error; 4427 } 4428 4429 fp = f; 4430 f = NULL; 4431 fp->fr_next = NULL; 4432 fp->fr_dnext = NULL; 4433 fp->fr_pnext = NULL; 4434 fp->fr_pdnext = NULL; 4435 fp->fr_grp = NULL; 4436 fp->fr_grphead = NULL; 4437 fp->fr_icmpgrp = NULL; 4438 fp->fr_isc = (void *)-1; 4439 fp->fr_ptr = NULL; 4440 fp->fr_ref = 0; 4441 fp->fr_flags |= FR_COPIED; 4442 } else { 4443 fp = (frentry_t *)data; 4444 if ((fp->fr_type & FR_T_BUILTIN) == 0) { 4445 IPFERROR(7); 4446 return EINVAL; 4447 } 4448 fp->fr_flags &= ~FR_COPIED; 4449 } 4450 4451 if (((fp->fr_dsize == 0) && (fp->fr_data != NULL)) || 4452 ((fp->fr_dsize != 0) && (fp->fr_data == NULL))) { 4453 IPFERROR(8); 4454 error = EINVAL; 4455 goto donenolock; 4456 } 4457 4458 family = fp->fr_family; 4459 uptr = fp->fr_data; 4460 4461 if (req == (ioctlcmd_t)SIOCINAFR || req == (ioctlcmd_t)SIOCINIFR || 4462 req == (ioctlcmd_t)SIOCADAFR || req == (ioctlcmd_t)SIOCADIFR) 4463 addrem = 0; 4464 else if (req == (ioctlcmd_t)SIOCRMAFR || req == (ioctlcmd_t)SIOCRMIFR) 4465 addrem = 1; 4466 else if (req == (ioctlcmd_t)SIOCZRLST) 4467 addrem = 2; 4468 else { 4469 IPFERROR(9); 4470 error = EINVAL; 4471 goto donenolock; 4472 } 4473 4474 /* 4475 * Only filter rules for IPv4 or IPv6 are accepted. 4476 */ 4477 if (family == AF_INET) { 4478 /*EMPTY*/; 4479 #ifdef USE_INET6 4480 } else if (family == AF_INET6) { 4481 /*EMPTY*/; 4482 #endif 4483 } else if (family != 0) { 4484 IPFERROR(10); 4485 error = EINVAL; 4486 goto donenolock; 4487 } 4488 4489 /* 4490 * If the rule is being loaded from user space, i.e. we had to copy it 4491 * into kernel space, then do not trust the function pointer in the 4492 * rule. 4493 */ 4494 if ((makecopy == 1) && (fp->fr_func != NULL)) { 4495 if (ipf_findfunc(fp->fr_func) == NULL) { 4496 IPFERROR(11); 4497 error = ESRCH; 4498 goto donenolock; 4499 } 4500 4501 if (addrem == 0) { 4502 error = ipf_funcinit(softc, fp); 4503 if (error != 0) 4504 goto donenolock; 4505 } 4506 } 4507 if ((fp->fr_flags & FR_CALLNOW) && 4508 ((fp->fr_func == NULL) || (fp->fr_func == (ipfunc_t)-1))) { 4509 IPFERROR(142); 4510 error = ESRCH; 4511 goto donenolock; 4512 } 4513 if (((fp->fr_flags & FR_CMDMASK) == FR_CALL) && 4514 ((fp->fr_func == NULL) || (fp->fr_func == (ipfunc_t)-1))) { 4515 IPFERROR(143); 4516 error = ESRCH; 4517 goto donenolock; 4518 } 4519 4520 ptr = NULL; 4521 4522 if (FR_ISACCOUNT(fp->fr_flags)) 4523 unit = IPL_LOGCOUNT; 4524 4525 /* 4526 * Check that each group name in the rule has a start index that 4527 * is valid. 4528 */ 4529 if (fp->fr_icmphead != -1) { 4530 if ((fp->fr_icmphead < 0) || 4531 (fp->fr_icmphead >= fp->fr_namelen)) { 4532 IPFERROR(136); 4533 error = EINVAL; 4534 goto donenolock; 4535 } 4536 if (!strcmp(FR_NAME(fp, fr_icmphead), "0")) 4537 fp->fr_names[fp->fr_icmphead] = '\0'; 4538 } 4539 4540 if (fp->fr_grhead != -1) { 4541 if ((fp->fr_grhead < 0) || 4542 (fp->fr_grhead >= fp->fr_namelen)) { 4543 IPFERROR(137); 4544 error = EINVAL; 4545 goto donenolock; 4546 } 4547 if (!strcmp(FR_NAME(fp, fr_grhead), "0")) 4548 fp->fr_names[fp->fr_grhead] = '\0'; 4549 } 4550 4551 if (fp->fr_group != -1) { 4552 if ((fp->fr_group < 0) || 4553 (fp->fr_group >= fp->fr_namelen)) { 4554 IPFERROR(138); 4555 error = EINVAL; 4556 goto donenolock; 4557 } 4558 if ((req != (int)SIOCZRLST) && (fp->fr_group != -1)) { 4559 /* 4560 * Allow loading rules that are in groups to cause 4561 * them to be created if they don't already exit. 4562 */ 4563 group = FR_NAME(fp, fr_group); 4564 if (addrem == 0) { 4565 fg = ipf_group_add(softc, group, NULL, 4566 fp->fr_flags, unit, set); 4567 if (fg == NULL) { 4568 IPFERROR(152); 4569 error = ESRCH; 4570 goto donenolock; 4571 } 4572 fp->fr_grp = fg; 4573 } else { 4574 fg = ipf_findgroup(softc, group, unit, 4575 set, NULL); 4576 if (fg == NULL) { 4577 IPFERROR(12); 4578 error = ESRCH; 4579 goto donenolock; 4580 } 4581 } 4582 4583 if (fg->fg_flags == 0) { 4584 fg->fg_flags = fp->fr_flags & FR_INOUT; 4585 } else if (fg->fg_flags != (fp->fr_flags & FR_INOUT)) { 4586 IPFERROR(13); 4587 error = ESRCH; 4588 goto donenolock; 4589 } 4590 } 4591 } else { 4592 /* 4593 * If a rule is going to be part of a group then it does 4594 * not matter whether it is an in or out rule, but if it 4595 * isn't in a group, then it does... 4596 */ 4597 if ((fp->fr_flags & (FR_INQUE|FR_OUTQUE)) == 0) { 4598 IPFERROR(14); 4599 error = EINVAL; 4600 goto donenolock; 4601 } 4602 } 4603 in = (fp->fr_flags & FR_INQUE) ? 0 : 1; 4604 4605 /* 4606 * Work out which rule list this change is being applied to. 4607 */ 4608 ftail = NULL; 4609 fprev = NULL; 4610 if (unit == IPL_LOGAUTH) { 4611 if ((fp->fr_tifs[0].fd_ptr != NULL) || 4612 (fp->fr_tifs[1].fd_ptr != NULL) || 4613 (fp->fr_dif.fd_ptr != NULL) || 4614 (fp->fr_flags & FR_FASTROUTE)) { 4615 IPFERROR(145); 4616 error = EINVAL; 4617 goto donenolock; 4618 } 4619 fprev = ipf_auth_rulehead(softc); 4620 } else { 4621 if (FR_ISACCOUNT(fp->fr_flags)) 4622 fprev = &softc->ipf_acct[in][set]; 4623 else if ((fp->fr_flags & (FR_OUTQUE|FR_INQUE)) != 0) 4624 fprev = &softc->ipf_rules[in][set]; 4625 } 4626 if (fprev == NULL) { 4627 IPFERROR(15); 4628 error = ESRCH; 4629 goto donenolock; 4630 } 4631 4632 if (fg != NULL) 4633 fprev = &fg->fg_start; 4634 4635 /* 4636 * Copy in extra data for the rule. 4637 */ 4638 if (fp->fr_dsize != 0) { 4639 if (makecopy != 0) { 4640 KMALLOCS(ptr, void *, fp->fr_dsize); 4641 if (ptr == NULL) { 4642 IPFERROR(16); 4643 error = ENOMEM; 4644 goto donenolock; 4645 } 4646 4647 /* 4648 * The bcopy case is for when the data is appended 4649 * to the rule by ipf_in_compat(). 4650 */ 4651 if (uptr >= (void *)fp && 4652 uptr < (void *)((char *)fp + fp->fr_size)) { 4653 bcopy(uptr, ptr, fp->fr_dsize); 4654 error = 0; 4655 } else { 4656 error = COPYIN(uptr, ptr, fp->fr_dsize); 4657 if (error != 0) { 4658 IPFERROR(17); 4659 error = EFAULT; 4660 goto donenolock; 4661 } 4662 } 4663 } else { 4664 ptr = uptr; 4665 } 4666 fp->fr_data = ptr; 4667 } else { 4668 fp->fr_data = NULL; 4669 } 4670 4671 /* 4672 * Perform per-rule type sanity checks of their members. 4673 * All code after this needs to be aware that allocated memory 4674 * may need to be free'd before exiting. 4675 */ 4676 switch (fp->fr_type & ~FR_T_BUILTIN) 4677 { 4678 #if defined(IPFILTER_BPF) 4679 case FR_T_BPFOPC : 4680 if (fp->fr_dsize == 0) { 4681 IPFERROR(19); 4682 error = EINVAL; 4683 break; 4684 } 4685 if (!bpf_validate(ptr, fp->fr_dsize/sizeof(struct bpf_insn))) { 4686 IPFERROR(20); 4687 error = EINVAL; 4688 break; 4689 } 4690 break; 4691 #endif 4692 case FR_T_IPF : 4693 /* 4694 * Preparation for error case at the bottom of this function. 4695 */ 4696 if (fp->fr_datype == FRI_LOOKUP) 4697 fp->fr_dstptr = NULL; 4698 if (fp->fr_satype == FRI_LOOKUP) 4699 fp->fr_srcptr = NULL; 4700 4701 if (fp->fr_dsize != sizeof(fripf_t)) { 4702 IPFERROR(21); 4703 error = EINVAL; 4704 break; 4705 } 4706 4707 /* 4708 * Allowing a rule with both "keep state" and "with oow" is 4709 * pointless because adding a state entry to the table will 4710 * fail with the out of window (oow) flag set. 4711 */ 4712 if ((fp->fr_flags & FR_KEEPSTATE) && (fp->fr_flx & FI_OOW)) { 4713 IPFERROR(22); 4714 error = EINVAL; 4715 break; 4716 } 4717 4718 switch (fp->fr_satype) 4719 { 4720 case FRI_BROADCAST : 4721 case FRI_DYNAMIC : 4722 case FRI_NETWORK : 4723 case FRI_NETMASKED : 4724 case FRI_PEERADDR : 4725 if (fp->fr_sifpidx < 0) { 4726 IPFERROR(23); 4727 error = EINVAL; 4728 } 4729 break; 4730 case FRI_LOOKUP : 4731 fp->fr_srcptr = ipf_findlookup(softc, unit, fp, 4732 &fp->fr_src6, 4733 &fp->fr_smsk6); 4734 if (fp->fr_srcfunc == NULL) { 4735 IPFERROR(132); 4736 error = ESRCH; 4737 break; 4738 } 4739 break; 4740 case FRI_NORMAL : 4741 break; 4742 default : 4743 IPFERROR(133); 4744 error = EINVAL; 4745 break; 4746 } 4747 if (error != 0) 4748 break; 4749 4750 switch (fp->fr_datype) 4751 { 4752 case FRI_BROADCAST : 4753 case FRI_DYNAMIC : 4754 case FRI_NETWORK : 4755 case FRI_NETMASKED : 4756 case FRI_PEERADDR : 4757 if (fp->fr_difpidx < 0) { 4758 IPFERROR(24); 4759 error = EINVAL; 4760 } 4761 break; 4762 case FRI_LOOKUP : 4763 fp->fr_dstptr = ipf_findlookup(softc, unit, fp, 4764 &fp->fr_dst6, 4765 &fp->fr_dmsk6); 4766 if (fp->fr_dstfunc == NULL) { 4767 IPFERROR(134); 4768 error = ESRCH; 4769 } 4770 break; 4771 case FRI_NORMAL : 4772 break; 4773 default : 4774 IPFERROR(135); 4775 error = EINVAL; 4776 } 4777 break; 4778 4779 case FR_T_NONE : 4780 case FR_T_CALLFUNC : 4781 case FR_T_COMPIPF : 4782 break; 4783 4784 case FR_T_IPFEXPR : 4785 if (ipf_matcharray_verify(fp->fr_data, fp->fr_dsize) == -1) { 4786 IPFERROR(25); 4787 error = EINVAL; 4788 } 4789 break; 4790 4791 default : 4792 IPFERROR(26); 4793 error = EINVAL; 4794 break; 4795 } 4796 if (error != 0) 4797 goto donenolock; 4798 4799 if (fp->fr_tif.fd_name != -1) { 4800 if ((fp->fr_tif.fd_name < 0) || 4801 (fp->fr_tif.fd_name >= fp->fr_namelen)) { 4802 IPFERROR(139); 4803 error = EINVAL; 4804 goto donenolock; 4805 } 4806 } 4807 4808 if (fp->fr_dif.fd_name != -1) { 4809 if ((fp->fr_dif.fd_name < 0) || 4810 (fp->fr_dif.fd_name >= fp->fr_namelen)) { 4811 IPFERROR(140); 4812 error = EINVAL; 4813 goto donenolock; 4814 } 4815 } 4816 4817 if (fp->fr_rif.fd_name != -1) { 4818 if ((fp->fr_rif.fd_name < 0) || 4819 (fp->fr_rif.fd_name >= fp->fr_namelen)) { 4820 IPFERROR(141); 4821 error = EINVAL; 4822 goto donenolock; 4823 } 4824 } 4825 4826 /* 4827 * Lookup all the interface names that are part of the rule. 4828 */ 4829 error = ipf_synclist(softc, fp, NULL); 4830 if (error != 0) 4831 goto donenolock; 4832 fp->fr_statecnt = 0; 4833 if (fp->fr_srctrack.ht_max_nodes != 0) 4834 ipf_rb_ht_init(&fp->fr_srctrack); 4835 4836 /* 4837 * Look for an existing matching filter rule, but don't include the 4838 * next or interface pointer in the comparison (fr_next, fr_ifa). 4839 * This elminates rules which are indentical being loaded. Checksum 4840 * the constant part of the filter rule to make comparisons quicker 4841 * (this meaning no pointers are included). 4842 */ 4843 for (fp->fr_cksum = 0, p = (u_int *)&fp->fr_func, pp = &fp->fr_cksum; 4844 p < pp; p++) 4845 fp->fr_cksum += *p; 4846 pp = (u_int *)((char *)fp->fr_caddr + fp->fr_dsize); 4847 for (p = (u_int *)fp->fr_data; p < pp; p++) 4848 fp->fr_cksum += *p; 4849 4850 WRITE_ENTER(&softc->ipf_mutex); 4851 4852 /* 4853 * Now that the filter rule lists are locked, we can walk the 4854 * chain of them without fear. 4855 */ 4856 ftail = fprev; 4857 for (f = *ftail; (f = *ftail) != NULL; ftail = &f->fr_next) { 4858 if (fp->fr_collect <= f->fr_collect) { 4859 ftail = fprev; 4860 f = NULL; 4861 break; 4862 } 4863 fprev = ftail; 4864 } 4865 4866 for (; (f = *ftail) != NULL; ftail = &f->fr_next) { 4867 DT2(rule_cmp, frentry_t *, fp, frentry_t *, f); 4868 if (ipf_rule_compare(fp, f) == 0) 4869 break; 4870 } 4871 4872 /* 4873 * If zero'ing statistics, copy current to caller and zero. 4874 */ 4875 if (addrem == 2) { 4876 if (f == NULL) { 4877 IPFERROR(27); 4878 error = ESRCH; 4879 } else { 4880 /* 4881 * Copy and reduce lock because of impending copyout. 4882 * Well we should, but if we do then the atomicity of 4883 * this call and the correctness of fr_hits and 4884 * fr_bytes cannot be guaranteed. As it is, this code 4885 * only resets them to 0 if they are successfully 4886 * copied out into user space. 4887 */ 4888 bcopy((char *)f, (char *)fp, f->fr_size); 4889 /* MUTEX_DOWNGRADE(&softc->ipf_mutex); */ 4890 4891 /* 4892 * When we copy this rule back out, set the data 4893 * pointer to be what it was in user space. 4894 */ 4895 fp->fr_data = uptr; 4896 error = ipf_outobj(softc, data, fp, IPFOBJ_FRENTRY); 4897 4898 if (error == 0) { 4899 if ((f->fr_dsize != 0) && (uptr != NULL)) { 4900 error = COPYOUT(f->fr_data, uptr, 4901 f->fr_dsize); 4902 if (error != 0) { 4903 IPFERROR(28); 4904 error = EFAULT; 4905 } 4906 } 4907 if (error == 0) { 4908 f->fr_hits = 0; 4909 f->fr_bytes = 0; 4910 } 4911 } 4912 } 4913 4914 if (makecopy != 0) { 4915 if (ptr != NULL) { 4916 KFREES(ptr, fp->fr_dsize); 4917 } 4918 KFREES(fp, fp->fr_size); 4919 } 4920 RWLOCK_EXIT(&softc->ipf_mutex); 4921 return error; 4922 } 4923 4924 if (!f) { 4925 /* 4926 * At the end of this, ftail must point to the place where the 4927 * new rule is to be saved/inserted/added. 4928 * For SIOCAD*FR, this should be the last rule in the group of 4929 * rules that have equal fr_collect fields. 4930 * For SIOCIN*FR, ... 4931 */ 4932 if (req == (ioctlcmd_t)SIOCADAFR || 4933 req == (ioctlcmd_t)SIOCADIFR) { 4934 4935 for (ftail = fprev; (f = *ftail) != NULL; ) { 4936 if (f->fr_collect > fp->fr_collect) 4937 break; 4938 ftail = &f->fr_next; 4939 fprev = ftail; 4940 } 4941 ftail = fprev; 4942 f = NULL; 4943 ptr = NULL; 4944 } else if (req == (ioctlcmd_t)SIOCINAFR || 4945 req == (ioctlcmd_t)SIOCINIFR) { 4946 while ((f = *fprev) != NULL) { 4947 if (f->fr_collect >= fp->fr_collect) 4948 break; 4949 fprev = &f->fr_next; 4950 } 4951 ftail = fprev; 4952 if (fp->fr_hits != 0) { 4953 while (fp->fr_hits && (f = *ftail)) { 4954 if (f->fr_collect != fp->fr_collect) 4955 break; 4956 fprev = ftail; 4957 ftail = &f->fr_next; 4958 fp->fr_hits--; 4959 } 4960 } 4961 f = NULL; 4962 ptr = NULL; 4963 } 4964 } 4965 4966 /* 4967 * Request to remove a rule. 4968 */ 4969 if (addrem == 1) { 4970 if (!f) { 4971 IPFERROR(29); 4972 error = ESRCH; 4973 } else { 4974 /* 4975 * Do not allow activity from user space to interfere 4976 * with rules not loaded that way. 4977 */ 4978 if ((makecopy == 1) && !(f->fr_flags & FR_COPIED)) { 4979 IPFERROR(30); 4980 error = EPERM; 4981 goto done; 4982 } 4983 4984 /* 4985 * Return EBUSY if the rule is being reference by 4986 * something else (eg state information.) 4987 */ 4988 if (f->fr_ref > 1) { 4989 IPFERROR(31); 4990 error = EBUSY; 4991 goto done; 4992 } 4993 #ifdef IPFILTER_SCAN 4994 if (f->fr_isctag != -1 && 4995 (f->fr_isc != (struct ipscan *)-1)) 4996 ipf_scan_detachfr(f); 4997 #endif 4998 4999 if (unit == IPL_LOGAUTH) { 5000 error = ipf_auth_precmd(softc, req, f, ftail); 5001 goto done; 5002 } 5003 5004 ipf_rule_delete(softc, f, unit, set); 5005 5006 need_free = makecopy; 5007 } 5008 } else { 5009 /* 5010 * Not removing, so we must be adding/inserting a rule. 5011 */ 5012 if (f != NULL) { 5013 IPFERROR(32); 5014 error = EEXIST; 5015 goto done; 5016 } 5017 if (unit == IPL_LOGAUTH) { 5018 error = ipf_auth_precmd(softc, req, fp, ftail); 5019 goto done; 5020 } 5021 5022 MUTEX_NUKE(&fp->fr_lock); 5023 MUTEX_INIT(&fp->fr_lock, "filter rule lock"); 5024 if (fp->fr_die != 0) 5025 ipf_rule_expire_insert(softc, fp, set); 5026 5027 fp->fr_hits = 0; 5028 if (makecopy != 0) 5029 fp->fr_ref = 1; 5030 fp->fr_pnext = ftail; 5031 fp->fr_next = *ftail; 5032 if (fp->fr_next != NULL) 5033 fp->fr_next->fr_pnext = &fp->fr_next; 5034 *ftail = fp; 5035 if (addrem == 0) 5036 ipf_fixskip(ftail, fp, 1); 5037 5038 fp->fr_icmpgrp = NULL; 5039 if (fp->fr_icmphead != -1) { 5040 group = FR_NAME(fp, fr_icmphead); 5041 fg = ipf_group_add(softc, group, fp, 0, unit, set); 5042 fp->fr_icmpgrp = fg; 5043 } 5044 5045 fp->fr_grphead = NULL; 5046 if (fp->fr_grhead != -1) { 5047 group = FR_NAME(fp, fr_grhead); 5048 fg = ipf_group_add(softc, group, fp, fp->fr_flags, 5049 unit, set); 5050 fp->fr_grphead = fg; 5051 } 5052 } 5053 done: 5054 RWLOCK_EXIT(&softc->ipf_mutex); 5055 donenolock: 5056 if (need_free || (error != 0)) { 5057 if ((fp->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) { 5058 if ((fp->fr_satype == FRI_LOOKUP) && 5059 (fp->fr_srcptr != NULL)) 5060 ipf_lookup_deref(softc, fp->fr_srctype, 5061 fp->fr_srcptr); 5062 if ((fp->fr_datype == FRI_LOOKUP) && 5063 (fp->fr_dstptr != NULL)) 5064 ipf_lookup_deref(softc, fp->fr_dsttype, 5065 fp->fr_dstptr); 5066 } 5067 if (fp->fr_grp != NULL) { 5068 WRITE_ENTER(&softc->ipf_mutex); 5069 ipf_group_del(softc, fp->fr_grp, fp); 5070 RWLOCK_EXIT(&softc->ipf_mutex); 5071 } 5072 if ((ptr != NULL) && (makecopy != 0)) { 5073 KFREES(ptr, fp->fr_dsize); 5074 } 5075 KFREES(fp, fp->fr_size); 5076 } 5077 return (error); 5078 } 5079 5080 5081 /* ------------------------------------------------------------------------ */ 5082 /* Function: ipf_rule_delete */ 5083 /* Returns: Nil */ 5084 /* Parameters: softc(I) - pointer to soft context main structure */ 5085 /* f(I) - pointer to the rule being deleted */ 5086 /* ftail(I) - pointer to the pointer to f */ 5087 /* unit(I) - device for which this is for */ 5088 /* set(I) - 1 or 0 (filter set) */ 5089 /* */ 5090 /* This function attempts to do what it can to delete a filter rule: remove */ 5091 /* it from any linked lists and remove any groups it is responsible for. */ 5092 /* But in the end, removing a rule can only drop the reference count - we */ 5093 /* must use that as the guide for whether or not it can be freed. */ 5094 /* ------------------------------------------------------------------------ */ 5095 static void 5096 ipf_rule_delete(ipf_main_softc_t *softc, frentry_t *f, int unit, int set) 5097 { 5098 5099 /* 5100 * If fr_pdnext is set, then the rule is on the expire list, so 5101 * remove it from there. 5102 */ 5103 if (f->fr_pdnext != NULL) { 5104 *f->fr_pdnext = f->fr_dnext; 5105 if (f->fr_dnext != NULL) 5106 f->fr_dnext->fr_pdnext = f->fr_pdnext; 5107 f->fr_pdnext = NULL; 5108 f->fr_dnext = NULL; 5109 } 5110 5111 ipf_fixskip(f->fr_pnext, f, -1); 5112 if (f->fr_pnext != NULL) 5113 *f->fr_pnext = f->fr_next; 5114 if (f->fr_next != NULL) 5115 f->fr_next->fr_pnext = f->fr_pnext; 5116 f->fr_pnext = NULL; 5117 f->fr_next = NULL; 5118 5119 (void) ipf_derefrule(softc, &f); 5120 } 5121 5122 /* ------------------------------------------------------------------------ */ 5123 /* Function: ipf_rule_expire_insert */ 5124 /* Returns: Nil */ 5125 /* Parameters: softc(I) - pointer to soft context main structure */ 5126 /* f(I) - pointer to rule to be added to expire list */ 5127 /* set(I) - 1 or 0 (filter set) */ 5128 /* */ 5129 /* If the new rule has a given expiration time, insert it into the list of */ 5130 /* expiring rules with the ones to be removed first added to the front of */ 5131 /* the list. The insertion is O(n) but it is kept sorted for quick scans at */ 5132 /* expiration interval checks. */ 5133 /* ------------------------------------------------------------------------ */ 5134 static void 5135 ipf_rule_expire_insert(ipf_main_softc_t *softc, frentry_t *f, int set) 5136 { 5137 frentry_t *fr; 5138 5139 /* 5140 */ 5141 5142 f->fr_die = softc->ipf_ticks + IPF_TTLVAL(f->fr_die); 5143 for (fr = softc->ipf_rule_explist[set]; fr != NULL; 5144 fr = fr->fr_dnext) { 5145 if (f->fr_die < fr->fr_die) 5146 break; 5147 if (fr->fr_dnext == NULL) { 5148 /* 5149 * We've got to the last rule and everything 5150 * wanted to be expired before this new node, 5151 * so we have to tack it on the end... 5152 */ 5153 fr->fr_dnext = f; 5154 f->fr_pdnext = &fr->fr_dnext; 5155 fr = NULL; 5156 break; 5157 } 5158 } 5159 5160 if (softc->ipf_rule_explist[set] == NULL) { 5161 softc->ipf_rule_explist[set] = f; 5162 f->fr_pdnext = &softc->ipf_rule_explist[set]; 5163 } else if (fr != NULL) { 5164 f->fr_dnext = fr; 5165 f->fr_pdnext = fr->fr_pdnext; 5166 fr->fr_pdnext = &f->fr_dnext; 5167 } 5168 } 5169 5170 5171 /* ------------------------------------------------------------------------ */ 5172 /* Function: ipf_findlookup */ 5173 /* Returns: NULL = failure, else success */ 5174 /* Parameters: softc(I) - pointer to soft context main structure */ 5175 /* unit(I) - ipf device we want to find match for */ 5176 /* fp(I) - rule for which lookup is for */ 5177 /* addrp(I) - pointer to lookup information in address struct */ 5178 /* maskp(O) - pointer to lookup information for storage */ 5179 /* */ 5180 /* When using pools and hash tables to store addresses for matching in */ 5181 /* rules, it is necessary to resolve both the object referred to by the */ 5182 /* name or address (and return that pointer) and also provide the means by */ 5183 /* which to determine if an address belongs to that object to make the */ 5184 /* packet matching quicker. */ 5185 /* ------------------------------------------------------------------------ */ 5186 static void * 5187 ipf_findlookup(ipf_main_softc_t *softc, int unit, frentry_t *fr, 5188 i6addr_t *addrp, i6addr_t *maskp) 5189 { 5190 void *ptr = NULL; 5191 5192 switch (addrp->iplookupsubtype) 5193 { 5194 case 0 : 5195 ptr = ipf_lookup_res_num(softc, unit, addrp->iplookuptype, 5196 addrp->iplookupnum, 5197 &maskp->iplookupfunc); 5198 break; 5199 case 1 : 5200 if (addrp->iplookupname < 0) 5201 break; 5202 if (addrp->iplookupname >= fr->fr_namelen) 5203 break; 5204 ptr = ipf_lookup_res_name(softc, unit, addrp->iplookuptype, 5205 fr->fr_names + addrp->iplookupname, 5206 &maskp->iplookupfunc); 5207 break; 5208 default : 5209 break; 5210 } 5211 5212 return ptr; 5213 } 5214 5215 5216 /* ------------------------------------------------------------------------ */ 5217 /* Function: ipf_funcinit */ 5218 /* Returns: int - 0 == success, else ESRCH: cannot resolve rule details */ 5219 /* Parameters: softc(I) - pointer to soft context main structure */ 5220 /* fr(I) - pointer to filter rule */ 5221 /* */ 5222 /* If a rule is a call rule, then check if the function it points to needs */ 5223 /* an init function to be called now the rule has been loaded. */ 5224 /* ------------------------------------------------------------------------ */ 5225 static int 5226 ipf_funcinit(ipf_main_softc_t *softc, frentry_t *fr) 5227 { 5228 ipfunc_resolve_t *ft; 5229 int err; 5230 5231 IPFERROR(34); 5232 err = ESRCH; 5233 5234 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5235 if (ft->ipfu_addr == fr->fr_func) { 5236 err = 0; 5237 if (ft->ipfu_init != NULL) 5238 err = (*ft->ipfu_init)(softc, fr); 5239 break; 5240 } 5241 return err; 5242 } 5243 5244 5245 /* ------------------------------------------------------------------------ */ 5246 /* Function: ipf_funcfini */ 5247 /* Returns: Nil */ 5248 /* Parameters: softc(I) - pointer to soft context main structure */ 5249 /* fr(I) - pointer to filter rule */ 5250 /* */ 5251 /* For a given filter rule, call the matching "fini" function if the rule */ 5252 /* is using a known function that would have resulted in the "init" being */ 5253 /* called for ealier. */ 5254 /* ------------------------------------------------------------------------ */ 5255 static void 5256 ipf_funcfini(ipf_main_softc_t *softc, frentry_t *fr) 5257 { 5258 ipfunc_resolve_t *ft; 5259 5260 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5261 if (ft->ipfu_addr == fr->fr_func) { 5262 if (ft->ipfu_fini != NULL) 5263 (void) (*ft->ipfu_fini)(softc, fr); 5264 break; 5265 } 5266 } 5267 5268 5269 /* ------------------------------------------------------------------------ */ 5270 /* Function: ipf_findfunc */ 5271 /* Returns: ipfunc_t - pointer to function if found, else NULL */ 5272 /* Parameters: funcptr(I) - function pointer to lookup */ 5273 /* */ 5274 /* Look for a function in the table of known functions. */ 5275 /* ------------------------------------------------------------------------ */ 5276 static ipfunc_t 5277 ipf_findfunc(ipfunc_t funcptr) 5278 { 5279 ipfunc_resolve_t *ft; 5280 5281 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5282 if (ft->ipfu_addr == funcptr) 5283 return funcptr; 5284 return NULL; 5285 } 5286 5287 5288 /* ------------------------------------------------------------------------ */ 5289 /* Function: ipf_resolvefunc */ 5290 /* Returns: int - 0 == success, else error */ 5291 /* Parameters: data(IO) - ioctl data pointer to ipfunc_resolve_t struct */ 5292 /* */ 5293 /* Copy in a ipfunc_resolve_t structure and then fill in the missing field. */ 5294 /* This will either be the function name (if the pointer is set) or the */ 5295 /* function pointer if the name is set. When found, fill in the other one */ 5296 /* so that the entire, complete, structure can be copied back to user space.*/ 5297 /* ------------------------------------------------------------------------ */ 5298 int 5299 ipf_resolvefunc(ipf_main_softc_t *softc, void *data) 5300 { 5301 ipfunc_resolve_t res, *ft; 5302 int error; 5303 5304 error = BCOPYIN(data, &res, sizeof(res)); 5305 if (error != 0) { 5306 IPFERROR(123); 5307 return EFAULT; 5308 } 5309 5310 if (res.ipfu_addr == NULL && res.ipfu_name[0] != '\0') { 5311 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5312 if (strncmp(res.ipfu_name, ft->ipfu_name, 5313 sizeof(res.ipfu_name)) == 0) { 5314 res.ipfu_addr = ft->ipfu_addr; 5315 res.ipfu_init = ft->ipfu_init; 5316 if (COPYOUT(&res, data, sizeof(res)) != 0) { 5317 IPFERROR(35); 5318 return EFAULT; 5319 } 5320 return 0; 5321 } 5322 } 5323 if (res.ipfu_addr != NULL && res.ipfu_name[0] == '\0') { 5324 for (ft = ipf_availfuncs; ft->ipfu_addr != NULL; ft++) 5325 if (ft->ipfu_addr == res.ipfu_addr) { 5326 (void) strncpy(res.ipfu_name, ft->ipfu_name, 5327 sizeof(res.ipfu_name)); 5328 res.ipfu_init = ft->ipfu_init; 5329 if (COPYOUT(&res, data, sizeof(res)) != 0) { 5330 IPFERROR(36); 5331 return EFAULT; 5332 } 5333 return 0; 5334 } 5335 } 5336 IPFERROR(37); 5337 return ESRCH; 5338 } 5339 5340 5341 #if !defined(_KERNEL) || (!defined(__NetBSD__) && !defined(__OpenBSD__) && \ 5342 !defined(__FreeBSD__)) || \ 5343 FREEBSD_LT_REV(501000) || NETBSD_LT_REV(105000000) || \ 5344 OPENBSD_LT_REV(200006) 5345 /* 5346 * From: NetBSD 5347 * ppsratecheck(): packets (or events) per second limitation. 5348 */ 5349 int 5350 ppsratecheck(lasttime, curpps, maxpps) 5351 struct timeval *lasttime; 5352 int *curpps; 5353 int maxpps; /* maximum pps allowed */ 5354 { 5355 struct timeval tv, delta; 5356 int rv; 5357 5358 GETKTIME(&tv); 5359 5360 delta.tv_sec = tv.tv_sec - lasttime->tv_sec; 5361 delta.tv_usec = tv.tv_usec - lasttime->tv_usec; 5362 if (delta.tv_usec < 0) { 5363 delta.tv_sec--; 5364 delta.tv_usec += 1000000; 5365 } 5366 5367 /* 5368 * check for 0,0 is so that the message will be seen at least once. 5369 * if more than one second have passed since the last update of 5370 * lasttime, reset the counter. 5371 * 5372 * we do increment *curpps even in *curpps < maxpps case, as some may 5373 * try to use *curpps for stat purposes as well. 5374 */ 5375 if ((lasttime->tv_sec == 0 && lasttime->tv_usec == 0) || 5376 delta.tv_sec >= 1) { 5377 *lasttime = tv; 5378 *curpps = 0; 5379 rv = 1; 5380 } else if (maxpps < 0) 5381 rv = 1; 5382 else if (*curpps < maxpps) 5383 rv = 1; 5384 else 5385 rv = 0; 5386 *curpps = *curpps + 1; 5387 5388 return (rv); 5389 } 5390 #endif 5391 5392 5393 /* ------------------------------------------------------------------------ */ 5394 /* Function: ipf_derefrule */ 5395 /* Returns: int - 0 == rule freed up, else rule not freed */ 5396 /* Parameters: fr(I) - pointer to filter rule */ 5397 /* */ 5398 /* Decrement the reference counter to a rule by one. If it reaches zero, */ 5399 /* free it and any associated storage space being used by it. */ 5400 /* ------------------------------------------------------------------------ */ 5401 int 5402 ipf_derefrule(ipf_main_softc_t *softc, frentry_t **frp) 5403 { 5404 frentry_t *fr; 5405 frdest_t *fdp; 5406 5407 fr = *frp; 5408 *frp = NULL; 5409 5410 MUTEX_ENTER(&fr->fr_lock); 5411 fr->fr_ref--; 5412 if (fr->fr_ref == 0) { 5413 MUTEX_EXIT(&fr->fr_lock); 5414 MUTEX_DESTROY(&fr->fr_lock); 5415 5416 ipf_funcfini(softc, fr); 5417 5418 fdp = &fr->fr_tif; 5419 if (fdp->fd_type == FRD_DSTLIST) 5420 ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr); 5421 5422 fdp = &fr->fr_rif; 5423 if (fdp->fd_type == FRD_DSTLIST) 5424 ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr); 5425 5426 fdp = &fr->fr_dif; 5427 if (fdp->fd_type == FRD_DSTLIST) 5428 ipf_lookup_deref(softc, IPLT_DSTLIST, fdp->fd_ptr); 5429 5430 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF && 5431 fr->fr_satype == FRI_LOOKUP) 5432 ipf_lookup_deref(softc, fr->fr_srctype, fr->fr_srcptr); 5433 if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF && 5434 fr->fr_datype == FRI_LOOKUP) 5435 ipf_lookup_deref(softc, fr->fr_dsttype, fr->fr_dstptr); 5436 5437 if (fr->fr_grp != NULL) 5438 ipf_group_del(softc, fr->fr_grp, fr); 5439 5440 if (fr->fr_grphead != NULL) 5441 ipf_group_del(softc, fr->fr_grphead, fr); 5442 5443 if (fr->fr_icmpgrp != NULL) 5444 ipf_group_del(softc, fr->fr_icmpgrp, fr); 5445 5446 if ((fr->fr_flags & FR_COPIED) != 0) { 5447 if (fr->fr_dsize) { 5448 KFREES(fr->fr_data, fr->fr_dsize); 5449 } 5450 KFREES(fr, fr->fr_size); 5451 return 0; 5452 } 5453 return 1; 5454 } else { 5455 MUTEX_EXIT(&fr->fr_lock); 5456 } 5457 return -1; 5458 } 5459 5460 5461 /* ------------------------------------------------------------------------ */ 5462 /* Function: ipf_grpmapinit */ 5463 /* Returns: int - 0 == success, else ESRCH because table entry not found*/ 5464 /* Parameters: fr(I) - pointer to rule to find hash table for */ 5465 /* */ 5466 /* Looks for group hash table fr_arg and stores a pointer to it in fr_ptr. */ 5467 /* fr_ptr is later used by ipf_srcgrpmap and ipf_dstgrpmap. */ 5468 /* ------------------------------------------------------------------------ */ 5469 static int 5470 ipf_grpmapinit(ipf_main_softc_t *softc, frentry_t *fr) 5471 { 5472 char name[FR_GROUPLEN]; 5473 iphtable_t *iph; 5474 5475 (void) snprintf(name, sizeof(name), "%d", fr->fr_arg); 5476 iph = ipf_lookup_find_htable(softc, IPL_LOGIPF, name); 5477 if (iph == NULL) { 5478 IPFERROR(38); 5479 return ESRCH; 5480 } 5481 if ((iph->iph_flags & FR_INOUT) != (fr->fr_flags & FR_INOUT)) { 5482 IPFERROR(39); 5483 return ESRCH; 5484 } 5485 iph->iph_ref++; 5486 fr->fr_ptr = iph; 5487 return 0; 5488 } 5489 5490 5491 /* ------------------------------------------------------------------------ */ 5492 /* Function: ipf_grpmapfini */ 5493 /* Returns: int - 0 == success, else ESRCH because table entry not found*/ 5494 /* Parameters: softc(I) - pointer to soft context main structure */ 5495 /* fr(I) - pointer to rule to release hash table for */ 5496 /* */ 5497 /* For rules that have had ipf_grpmapinit called, ipf_lookup_deref needs to */ 5498 /* be called to undo what ipf_grpmapinit caused to be done. */ 5499 /* ------------------------------------------------------------------------ */ 5500 static int 5501 ipf_grpmapfini(ipf_main_softc_t *softc, frentry_t *fr) 5502 { 5503 iphtable_t *iph; 5504 iph = fr->fr_ptr; 5505 if (iph != NULL) 5506 ipf_lookup_deref(softc, IPLT_HASH, iph); 5507 return 0; 5508 } 5509 5510 5511 /* ------------------------------------------------------------------------ */ 5512 /* Function: ipf_srcgrpmap */ 5513 /* Returns: frentry_t * - pointer to "new last matching" rule or NULL */ 5514 /* Parameters: fin(I) - pointer to packet information */ 5515 /* passp(IO) - pointer to current/new filter decision (unused) */ 5516 /* */ 5517 /* Look for a rule group head in a hash table, using the source address as */ 5518 /* the key, and descend into that group and continue matching rules against */ 5519 /* the packet. */ 5520 /* ------------------------------------------------------------------------ */ 5521 frentry_t * 5522 ipf_srcgrpmap(fr_info_t *fin, u_32_t *passp) 5523 { 5524 frgroup_t *fg; 5525 void *rval; 5526 5527 rval = ipf_iphmfindgroup(fin->fin_main_soft, fin->fin_fr->fr_ptr, 5528 &fin->fin_src); 5529 if (rval == NULL) 5530 return NULL; 5531 5532 fg = rval; 5533 fin->fin_fr = fg->fg_start; 5534 (void) ipf_scanlist(fin, *passp); 5535 return fin->fin_fr; 5536 } 5537 5538 5539 /* ------------------------------------------------------------------------ */ 5540 /* Function: ipf_dstgrpmap */ 5541 /* Returns: frentry_t * - pointer to "new last matching" rule or NULL */ 5542 /* Parameters: fin(I) - pointer to packet information */ 5543 /* passp(IO) - pointer to current/new filter decision (unused) */ 5544 /* */ 5545 /* Look for a rule group head in a hash table, using the destination */ 5546 /* address as the key, and descend into that group and continue matching */ 5547 /* rules against the packet. */ 5548 /* ------------------------------------------------------------------------ */ 5549 frentry_t * 5550 ipf_dstgrpmap(fr_info_t *fin, u_32_t *passp) 5551 { 5552 frgroup_t *fg; 5553 void *rval; 5554 5555 rval = ipf_iphmfindgroup(fin->fin_main_soft, fin->fin_fr->fr_ptr, 5556 &fin->fin_dst); 5557 if (rval == NULL) 5558 return NULL; 5559 5560 fg = rval; 5561 fin->fin_fr = fg->fg_start; 5562 (void) ipf_scanlist(fin, *passp); 5563 return fin->fin_fr; 5564 } 5565 5566 /* 5567 * Queue functions 5568 * =============== 5569 * These functions manage objects on queues for efficient timeouts. There 5570 * are a number of system defined queues as well as user defined timeouts. 5571 * It is expected that a lock is held in the domain in which the queue 5572 * belongs (i.e. either state or NAT) when calling any of these functions 5573 * that prevents ipf_freetimeoutqueue() from being called at the same time 5574 * as any other. 5575 */ 5576 5577 5578 /* ------------------------------------------------------------------------ */ 5579 /* Function: ipf_addtimeoutqueue */ 5580 /* Returns: struct ifqtq * - NULL if malloc fails, else pointer to */ 5581 /* timeout queue with given interval. */ 5582 /* Parameters: parent(I) - pointer to pointer to parent node of this list */ 5583 /* of interface queues. */ 5584 /* seconds(I) - timeout value in seconds for this queue. */ 5585 /* */ 5586 /* This routine first looks for a timeout queue that matches the interval */ 5587 /* being requested. If it finds one, increments the reference counter and */ 5588 /* returns a pointer to it. If none are found, it allocates a new one and */ 5589 /* inserts it at the top of the list. */ 5590 /* */ 5591 /* Locking. */ 5592 /* It is assumed that the caller of this function has an appropriate lock */ 5593 /* held (exclusively) in the domain that encompases 'parent'. */ 5594 /* ------------------------------------------------------------------------ */ 5595 ipftq_t * 5596 ipf_addtimeoutqueue(ipf_main_softc_t *softc, ipftq_t **parent, u_int seconds) 5597 { 5598 ipftq_t *ifq; 5599 u_int period; 5600 5601 period = seconds * IPF_HZ_DIVIDE; 5602 5603 MUTEX_ENTER(&softc->ipf_timeoutlock); 5604 for (ifq = *parent; ifq != NULL; ifq = ifq->ifq_next) { 5605 if (ifq->ifq_ttl == period) { 5606 /* 5607 * Reset the delete flag, if set, so the structure 5608 * gets reused rather than freed and reallocated. 5609 */ 5610 MUTEX_ENTER(&ifq->ifq_lock); 5611 ifq->ifq_flags &= ~IFQF_DELETE; 5612 ifq->ifq_ref++; 5613 MUTEX_EXIT(&ifq->ifq_lock); 5614 MUTEX_EXIT(&softc->ipf_timeoutlock); 5615 5616 return ifq; 5617 } 5618 } 5619 5620 KMALLOC(ifq, ipftq_t *); 5621 if (ifq != NULL) { 5622 MUTEX_NUKE(&ifq->ifq_lock); 5623 IPFTQ_INIT(ifq, period, "ipftq mutex"); 5624 ifq->ifq_next = *parent; 5625 ifq->ifq_pnext = parent; 5626 ifq->ifq_flags = IFQF_USER; 5627 ifq->ifq_ref++; 5628 *parent = ifq; 5629 softc->ipf_userifqs++; 5630 } 5631 MUTEX_EXIT(&softc->ipf_timeoutlock); 5632 return ifq; 5633 } 5634 5635 5636 /* ------------------------------------------------------------------------ */ 5637 /* Function: ipf_deletetimeoutqueue */ 5638 /* Returns: int - new reference count value of the timeout queue */ 5639 /* Parameters: ifq(I) - timeout queue which is losing a reference. */ 5640 /* Locks: ifq->ifq_lock */ 5641 /* */ 5642 /* This routine must be called when we're discarding a pointer to a timeout */ 5643 /* queue object, taking care of the reference counter. */ 5644 /* */ 5645 /* Now that this just sets a DELETE flag, it requires the expire code to */ 5646 /* check the list of user defined timeout queues and call the free function */ 5647 /* below (currently commented out) to stop memory leaking. It is done this */ 5648 /* way because the locking may not be sufficient to safely do a free when */ 5649 /* this function is called. */ 5650 /* ------------------------------------------------------------------------ */ 5651 int 5652 ipf_deletetimeoutqueue(ipftq_t *ifq) 5653 { 5654 5655 ifq->ifq_ref--; 5656 if ((ifq->ifq_ref == 0) && ((ifq->ifq_flags & IFQF_USER) != 0)) { 5657 ifq->ifq_flags |= IFQF_DELETE; 5658 } 5659 5660 return ifq->ifq_ref; 5661 } 5662 5663 5664 /* ------------------------------------------------------------------------ */ 5665 /* Function: ipf_freetimeoutqueue */ 5666 /* Parameters: ifq(I) - timeout queue which is losing a reference. */ 5667 /* Returns: Nil */ 5668 /* */ 5669 /* Locking: */ 5670 /* It is assumed that the caller of this function has an appropriate lock */ 5671 /* held (exclusively) in the domain that encompases the callers "domain". */ 5672 /* The ifq_lock for this structure should not be held. */ 5673 /* */ 5674 /* Remove a user defined timeout queue from the list of queues it is in and */ 5675 /* tidy up after this is done. */ 5676 /* ------------------------------------------------------------------------ */ 5677 void 5678 ipf_freetimeoutqueue(ipf_main_softc_t *softc, ipftq_t *ifq) 5679 { 5680 5681 if (((ifq->ifq_flags & IFQF_DELETE) == 0) || (ifq->ifq_ref != 0) || 5682 ((ifq->ifq_flags & IFQF_USER) == 0)) { 5683 printf("ipf_freetimeoutqueue(%lx) flags 0x%x ttl %d ref %d\n", 5684 (u_long)ifq, ifq->ifq_flags, ifq->ifq_ttl, 5685 ifq->ifq_ref); 5686 return; 5687 } 5688 5689 /* 5690 * Remove from its position in the list. 5691 */ 5692 *ifq->ifq_pnext = ifq->ifq_next; 5693 if (ifq->ifq_next != NULL) 5694 ifq->ifq_next->ifq_pnext = ifq->ifq_pnext; 5695 ifq->ifq_next = NULL; 5696 ifq->ifq_pnext = NULL; 5697 5698 MUTEX_DESTROY(&ifq->ifq_lock); 5699 ATOMIC_DEC(softc->ipf_userifqs); 5700 KFREE(ifq); 5701 } 5702 5703 5704 /* ------------------------------------------------------------------------ */ 5705 /* Function: ipf_deletequeueentry */ 5706 /* Returns: Nil */ 5707 /* Parameters: tqe(I) - timeout queue entry to delete */ 5708 /* */ 5709 /* Remove a tail queue entry from its queue and make it an orphan. */ 5710 /* ipf_deletetimeoutqueue is called to make sure the reference count on the */ 5711 /* queue is correct. We can't, however, call ipf_freetimeoutqueue because */ 5712 /* the correct lock(s) may not be held that would make it safe to do so. */ 5713 /* ------------------------------------------------------------------------ */ 5714 void 5715 ipf_deletequeueentry(ipftqent_t *tqe) 5716 { 5717 ipftq_t *ifq; 5718 5719 ifq = tqe->tqe_ifq; 5720 5721 MUTEX_ENTER(&ifq->ifq_lock); 5722 5723 if (tqe->tqe_pnext != NULL) { 5724 *tqe->tqe_pnext = tqe->tqe_next; 5725 if (tqe->tqe_next != NULL) 5726 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5727 else /* we must be the tail anyway */ 5728 ifq->ifq_tail = tqe->tqe_pnext; 5729 5730 tqe->tqe_pnext = NULL; 5731 tqe->tqe_ifq = NULL; 5732 } 5733 5734 (void) ipf_deletetimeoutqueue(ifq); 5735 ASSERT(ifq->ifq_ref > 0); 5736 5737 MUTEX_EXIT(&ifq->ifq_lock); 5738 } 5739 5740 5741 /* ------------------------------------------------------------------------ */ 5742 /* Function: ipf_queuefront */ 5743 /* Returns: Nil */ 5744 /* Parameters: tqe(I) - pointer to timeout queue entry */ 5745 /* */ 5746 /* Move a queue entry to the front of the queue, if it isn't already there. */ 5747 /* ------------------------------------------------------------------------ */ 5748 void 5749 ipf_queuefront(ipftqent_t *tqe) 5750 { 5751 ipftq_t *ifq; 5752 5753 ifq = tqe->tqe_ifq; 5754 if (ifq == NULL) 5755 return; 5756 5757 MUTEX_ENTER(&ifq->ifq_lock); 5758 if (ifq->ifq_head != tqe) { 5759 *tqe->tqe_pnext = tqe->tqe_next; 5760 if (tqe->tqe_next) 5761 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5762 else 5763 ifq->ifq_tail = tqe->tqe_pnext; 5764 5765 tqe->tqe_next = ifq->ifq_head; 5766 ifq->ifq_head->tqe_pnext = &tqe->tqe_next; 5767 ifq->ifq_head = tqe; 5768 tqe->tqe_pnext = &ifq->ifq_head; 5769 } 5770 MUTEX_EXIT(&ifq->ifq_lock); 5771 } 5772 5773 5774 /* ------------------------------------------------------------------------ */ 5775 /* Function: ipf_queueback */ 5776 /* Returns: Nil */ 5777 /* Parameters: ticks(I) - ipf tick time to use with this call */ 5778 /* tqe(I) - pointer to timeout queue entry */ 5779 /* */ 5780 /* Move a queue entry to the back of the queue, if it isn't already there. */ 5781 /* We use use ticks to calculate the expiration and mark for when we last */ 5782 /* touched the structure. */ 5783 /* ------------------------------------------------------------------------ */ 5784 void 5785 ipf_queueback(u_long ticks, ipftqent_t *tqe) 5786 { 5787 ipftq_t *ifq; 5788 5789 ifq = tqe->tqe_ifq; 5790 if (ifq == NULL) 5791 return; 5792 tqe->tqe_die = ticks + ifq->ifq_ttl; 5793 tqe->tqe_touched = ticks; 5794 5795 MUTEX_ENTER(&ifq->ifq_lock); 5796 if (tqe->tqe_next != NULL) { /* at the end already ? */ 5797 /* 5798 * Remove from list 5799 */ 5800 *tqe->tqe_pnext = tqe->tqe_next; 5801 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5802 5803 /* 5804 * Make it the last entry. 5805 */ 5806 tqe->tqe_next = NULL; 5807 tqe->tqe_pnext = ifq->ifq_tail; 5808 *ifq->ifq_tail = tqe; 5809 ifq->ifq_tail = &tqe->tqe_next; 5810 } 5811 MUTEX_EXIT(&ifq->ifq_lock); 5812 } 5813 5814 5815 /* ------------------------------------------------------------------------ */ 5816 /* Function: ipf_queueappend */ 5817 /* Returns: Nil */ 5818 /* Parameters: ticks(I) - ipf tick time to use with this call */ 5819 /* tqe(I) - pointer to timeout queue entry */ 5820 /* ifq(I) - pointer to timeout queue */ 5821 /* parent(I) - owing object pointer */ 5822 /* */ 5823 /* Add a new item to this queue and put it on the very end. */ 5824 /* We use use ticks to calculate the expiration and mark for when we last */ 5825 /* touched the structure. */ 5826 /* ------------------------------------------------------------------------ */ 5827 void 5828 ipf_queueappend(u_long ticks, ipftqent_t *tqe, ipftq_t *ifq, void *parent) 5829 { 5830 5831 MUTEX_ENTER(&ifq->ifq_lock); 5832 tqe->tqe_parent = parent; 5833 tqe->tqe_pnext = ifq->ifq_tail; 5834 *ifq->ifq_tail = tqe; 5835 ifq->ifq_tail = &tqe->tqe_next; 5836 tqe->tqe_next = NULL; 5837 tqe->tqe_ifq = ifq; 5838 tqe->tqe_die = ticks + ifq->ifq_ttl; 5839 tqe->tqe_touched = ticks; 5840 ifq->ifq_ref++; 5841 MUTEX_EXIT(&ifq->ifq_lock); 5842 } 5843 5844 5845 /* ------------------------------------------------------------------------ */ 5846 /* Function: ipf_movequeue */ 5847 /* Returns: Nil */ 5848 /* Parameters: tq(I) - pointer to timeout queue information */ 5849 /* oifp(I) - old timeout queue entry was on */ 5850 /* nifp(I) - new timeout queue to put entry on */ 5851 /* */ 5852 /* Move a queue entry from one timeout queue to another timeout queue. */ 5853 /* If it notices that the current entry is already last and does not need */ 5854 /* to move queue, the return. */ 5855 /* ------------------------------------------------------------------------ */ 5856 void 5857 ipf_movequeue(u_long ticks, ipftqent_t *tqe, ipftq_t *oifq, ipftq_t *nifq) 5858 { 5859 5860 /* 5861 * If the queue hasn't changed and we last touched this entry at the 5862 * same ipf time, then we're not going to achieve anything by either 5863 * changing the ttl or moving it on the queue. 5864 */ 5865 if (oifq == nifq && tqe->tqe_touched == ticks) 5866 return; 5867 5868 /* 5869 * For any of this to be outside the lock, there is a risk that two 5870 * packets entering simultaneously, with one changing to a different 5871 * queue and one not, could end up with things in a bizarre state. 5872 */ 5873 MUTEX_ENTER(&oifq->ifq_lock); 5874 5875 tqe->tqe_touched = ticks; 5876 tqe->tqe_die = ticks + nifq->ifq_ttl; 5877 /* 5878 * Is the operation here going to be a no-op ? 5879 */ 5880 if (oifq == nifq) { 5881 if ((tqe->tqe_next == NULL) || 5882 (tqe->tqe_next->tqe_die == tqe->tqe_die)) { 5883 MUTEX_EXIT(&oifq->ifq_lock); 5884 return; 5885 } 5886 } 5887 5888 /* 5889 * Remove from the old queue 5890 */ 5891 *tqe->tqe_pnext = tqe->tqe_next; 5892 if (tqe->tqe_next) 5893 tqe->tqe_next->tqe_pnext = tqe->tqe_pnext; 5894 else 5895 oifq->ifq_tail = tqe->tqe_pnext; 5896 tqe->tqe_next = NULL; 5897 5898 /* 5899 * If we're moving from one queue to another, release the 5900 * lock on the old queue and get a lock on the new queue. 5901 * For user defined queues, if we're moving off it, call 5902 * delete in case it can now be freed. 5903 */ 5904 if (oifq != nifq) { 5905 tqe->tqe_ifq = NULL; 5906 5907 (void) ipf_deletetimeoutqueue(oifq); 5908 5909 MUTEX_EXIT(&oifq->ifq_lock); 5910 5911 MUTEX_ENTER(&nifq->ifq_lock); 5912 5913 tqe->tqe_ifq = nifq; 5914 nifq->ifq_ref++; 5915 } 5916 5917 /* 5918 * Add to the bottom of the new queue 5919 */ 5920 tqe->tqe_pnext = nifq->ifq_tail; 5921 *nifq->ifq_tail = tqe; 5922 nifq->ifq_tail = &tqe->tqe_next; 5923 MUTEX_EXIT(&nifq->ifq_lock); 5924 } 5925 5926 5927 /* ------------------------------------------------------------------------ */ 5928 /* Function: ipf_updateipid */ 5929 /* Returns: int - 0 == success, -1 == error (packet should be droppped) */ 5930 /* Parameters: fin(I) - pointer to packet information */ 5931 /* */ 5932 /* When we are doing NAT, change the IP of every packet to represent a */ 5933 /* single sequence of packets coming from the host, hiding any host */ 5934 /* specific sequencing that might otherwise be revealed. If the packet is */ 5935 /* a fragment, then store the 'new' IPid in the fragment cache and look up */ 5936 /* the fragment cache for non-leading fragments. If a non-leading fragment */ 5937 /* has no match in the cache, return an error. */ 5938 /* ------------------------------------------------------------------------ */ 5939 static int 5940 ipf_updateipid(fr_info_t *fin) 5941 { 5942 u_short id, ido, sums; 5943 u_32_t sumd, sum; 5944 ip_t *ip; 5945 5946 if (fin->fin_off != 0) { 5947 sum = ipf_frag_ipidknown(fin); 5948 if (sum == 0xffffffff) 5949 return -1; 5950 sum &= 0xffff; 5951 id = (u_short)sum; 5952 } else { 5953 id = ipf_nextipid(fin); 5954 if (fin->fin_off == 0 && (fin->fin_flx & FI_FRAG) != 0) 5955 (void) ipf_frag_ipidnew(fin, (u_32_t)id); 5956 } 5957 5958 ip = fin->fin_ip; 5959 ido = ntohs(ip->ip_id); 5960 if (id == ido) 5961 return 0; 5962 ip->ip_id = htons(id); 5963 CALC_SUMD(ido, id, sumd); /* DESTRUCTIVE MACRO! id,ido change */ 5964 sum = (~ntohs(ip->ip_sum)) & 0xffff; 5965 sum += sumd; 5966 sum = (sum >> 16) + (sum & 0xffff); 5967 sum = (sum >> 16) + (sum & 0xffff); 5968 sums = ~(u_short)sum; 5969 ip->ip_sum = htons(sums); 5970 return 0; 5971 } 5972 5973 5974 #ifdef NEED_FRGETIFNAME 5975 /* ------------------------------------------------------------------------ */ 5976 /* Function: ipf_getifname */ 5977 /* Returns: char * - pointer to interface name */ 5978 /* Parameters: ifp(I) - pointer to network interface */ 5979 /* buffer(O) - pointer to where to store interface name */ 5980 /* */ 5981 /* Constructs an interface name in the buffer passed. The buffer passed is */ 5982 /* expected to be at least LIFNAMSIZ in bytes big. If buffer is passed in */ 5983 /* as a NULL pointer then return a pointer to a static array. */ 5984 /* ------------------------------------------------------------------------ */ 5985 char * 5986 ipf_getifname(ifp, buffer) 5987 struct ifnet *ifp; 5988 char *buffer; 5989 { 5990 static char namebuf[LIFNAMSIZ]; 5991 # if defined(MENTAT) || defined(__FreeBSD__) || defined(__osf__) || \ 5992 defined(__sgi) || defined(linux) || defined(_AIX51) || \ 5993 (defined(sun) && !defined(__SVR4) && !defined(__svr4__)) 5994 int unit, space; 5995 char temp[20]; 5996 char *s; 5997 # endif 5998 5999 if (buffer == NULL) 6000 buffer = namebuf; 6001 (void) strncpy(buffer, ifp->if_name, LIFNAMSIZ); 6002 buffer[LIFNAMSIZ - 1] = '\0'; 6003 # if defined(MENTAT) || defined(__FreeBSD__) || defined(__osf__) || \ 6004 defined(__sgi) || defined(_AIX51) || \ 6005 (defined(sun) && !defined(__SVR4) && !defined(__svr4__)) 6006 for (s = buffer; *s; s++) 6007 ; 6008 unit = ifp->if_unit; 6009 space = LIFNAMSIZ - (s - buffer); 6010 if ((space > 0) && (unit >= 0)) { 6011 snprintf(temp, sizeof(temp), "%d", unit); 6012 (void) strncpy(s, temp, space); 6013 s[space - 1] = '\0'; 6014 } 6015 # endif 6016 return buffer; 6017 } 6018 #endif 6019 6020 6021 /* ------------------------------------------------------------------------ */ 6022 /* Function: ipf_ioctlswitch */ 6023 /* Returns: int - -1 continue processing, else ioctl return value */ 6024 /* Parameters: unit(I) - device unit opened */ 6025 /* data(I) - pointer to ioctl data */ 6026 /* cmd(I) - ioctl command */ 6027 /* mode(I) - mode value */ 6028 /* uid(I) - uid making the ioctl call */ 6029 /* ctx(I) - pointer to context data */ 6030 /* */ 6031 /* Based on the value of unit, call the appropriate ioctl handler or return */ 6032 /* EIO if ipfilter is not running. Also checks if write perms are req'd */ 6033 /* for the device in order to execute the ioctl. A special case is made */ 6034 /* SIOCIPFINTERROR so that the same code isn't required in every handler. */ 6035 /* The context data pointer is passed through as this is used as the key */ 6036 /* for locating a matching token for continued access for walking lists, */ 6037 /* etc. */ 6038 /* ------------------------------------------------------------------------ */ 6039 int 6040 ipf_ioctlswitch(ipf_main_softc_t *softc, int unit, void *data, ioctlcmd_t cmd, 6041 int mode, int uid, void *ctx) 6042 { 6043 int error = 0; 6044 6045 switch (cmd) 6046 { 6047 case SIOCIPFINTERROR : 6048 error = BCOPYOUT(&softc->ipf_interror, data, 6049 sizeof(softc->ipf_interror)); 6050 if (error != 0) { 6051 IPFERROR(40); 6052 error = EFAULT; 6053 } 6054 return error; 6055 default : 6056 break; 6057 } 6058 6059 switch (unit) 6060 { 6061 case IPL_LOGIPF : 6062 error = ipf_ipf_ioctl(softc, data, cmd, mode, uid, ctx); 6063 break; 6064 case IPL_LOGNAT : 6065 if (softc->ipf_running > 0) { 6066 error = ipf_nat_ioctl(softc, data, cmd, mode, 6067 uid, ctx); 6068 } else { 6069 IPFERROR(42); 6070 error = EIO; 6071 } 6072 break; 6073 case IPL_LOGSTATE : 6074 if (softc->ipf_running > 0) { 6075 error = ipf_state_ioctl(softc, data, cmd, mode, 6076 uid, ctx); 6077 } else { 6078 IPFERROR(43); 6079 error = EIO; 6080 } 6081 break; 6082 case IPL_LOGAUTH : 6083 if (softc->ipf_running > 0) { 6084 error = ipf_auth_ioctl(softc, data, cmd, mode, 6085 uid, ctx); 6086 } else { 6087 IPFERROR(44); 6088 error = EIO; 6089 } 6090 break; 6091 case IPL_LOGSYNC : 6092 if (softc->ipf_running > 0) { 6093 error = ipf_sync_ioctl(softc, data, cmd, mode, 6094 uid, ctx); 6095 } else { 6096 error = EIO; 6097 IPFERROR(45); 6098 } 6099 break; 6100 case IPL_LOGSCAN : 6101 #ifdef IPFILTER_SCAN 6102 if (softc->ipf_running > 0) 6103 error = ipf_scan_ioctl(softc, data, cmd, mode, 6104 uid, ctx); 6105 else 6106 #endif 6107 { 6108 error = EIO; 6109 IPFERROR(46); 6110 } 6111 break; 6112 case IPL_LOGLOOKUP : 6113 if (softc->ipf_running > 0) { 6114 error = ipf_lookup_ioctl(softc, data, cmd, mode, 6115 uid, ctx); 6116 } else { 6117 error = EIO; 6118 IPFERROR(47); 6119 } 6120 break; 6121 default : 6122 IPFERROR(48); 6123 error = EIO; 6124 break; 6125 } 6126 6127 return error; 6128 } 6129 6130 6131 /* 6132 * This array defines the expected size of objects coming into the kernel 6133 * for the various recognised object types. The first column is flags (see 6134 * below), 2nd column is current size, 3rd column is the version number of 6135 * when the current size became current. 6136 * Flags: 6137 * 1 = minimum size, not absolute size 6138 */ 6139 static int ipf_objbytes[IPFOBJ_COUNT][3] = { 6140 { 1, sizeof(struct frentry), 5010000 }, /* 0 */ 6141 { 1, sizeof(struct friostat), 5010000 }, 6142 { 0, sizeof(struct fr_info), 5010000 }, 6143 { 0, sizeof(struct ipf_authstat), 4010100 }, 6144 { 0, sizeof(struct ipfrstat), 5010000 }, 6145 { 1, sizeof(struct ipnat), 5010000 }, /* 5 */ 6146 { 0, sizeof(struct natstat), 5010000 }, 6147 { 0, sizeof(struct ipstate_save), 5010000 }, 6148 { 1, sizeof(struct nat_save), 5010000 }, 6149 { 0, sizeof(struct natlookup), 5010000 }, 6150 { 1, sizeof(struct ipstate), 5010000 }, /* 10 */ 6151 { 0, sizeof(struct ips_stat), 5010000 }, 6152 { 0, sizeof(struct frauth), 5010000 }, 6153 { 0, sizeof(struct ipftune), 4010100 }, 6154 { 0, sizeof(struct nat), 5010000 }, 6155 { 0, sizeof(struct ipfruleiter), 4011400 }, /* 15 */ 6156 { 0, sizeof(struct ipfgeniter), 4011400 }, 6157 { 0, sizeof(struct ipftable), 4011400 }, 6158 { 0, sizeof(struct ipflookupiter), 4011400 }, 6159 { 0, sizeof(struct ipftq) * IPF_TCP_NSTATES }, 6160 { 1, 0, 0 }, /* IPFEXPR */ 6161 { 0, 0, 0 }, /* PROXYCTL */ 6162 { 0, sizeof (struct fripf), 5010000 } 6163 }; 6164 6165 6166 /* ------------------------------------------------------------------------ */ 6167 /* Function: ipf_inobj */ 6168 /* Returns: int - 0 = success, else failure */ 6169 /* Parameters: softc(I) - soft context pointerto work with */ 6170 /* data(I) - pointer to ioctl data */ 6171 /* objp(O) - where to store ipfobj structure */ 6172 /* ptr(I) - pointer to data to copy out */ 6173 /* type(I) - type of structure being moved */ 6174 /* */ 6175 /* Copy in the contents of what the ipfobj_t points to. In future, we */ 6176 /* add things to check for version numbers, sizes, etc, to make it backward */ 6177 /* compatible at the ABI for user land. */ 6178 /* If objp is not NULL then we assume that the caller wants to see what is */ 6179 /* in the ipfobj_t structure being copied in. As an example, this can tell */ 6180 /* the caller what version of ipfilter the ioctl program was written to. */ 6181 /* ------------------------------------------------------------------------ */ 6182 int 6183 ipf_inobj(ipf_main_softc_t *softc, void *data, ipfobj_t *objp, void *ptr, 6184 int type) 6185 { 6186 ipfobj_t obj; 6187 int error; 6188 int size; 6189 6190 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6191 IPFERROR(49); 6192 return EINVAL; 6193 } 6194 6195 if (objp == NULL) 6196 objp = &obj; 6197 error = BCOPYIN(data, objp, sizeof(*objp)); 6198 if (error != 0) { 6199 IPFERROR(124); 6200 return EFAULT; 6201 } 6202 6203 if (objp->ipfo_type != type) { 6204 IPFERROR(50); 6205 return EINVAL; 6206 } 6207 6208 if (objp->ipfo_rev >= ipf_objbytes[type][2]) { 6209 if ((ipf_objbytes[type][0] & 1) != 0) { 6210 if (objp->ipfo_size < ipf_objbytes[type][1]) { 6211 IPFERROR(51); 6212 return EINVAL; 6213 } 6214 size = ipf_objbytes[type][1]; 6215 } else if (objp->ipfo_size == ipf_objbytes[type][1]) { 6216 size = objp->ipfo_size; 6217 } else { 6218 IPFERROR(52); 6219 return EINVAL; 6220 } 6221 error = COPYIN(objp->ipfo_ptr, ptr, size); 6222 if (error != 0) { 6223 IPFERROR(55); 6224 error = EFAULT; 6225 } 6226 } else { 6227 #ifdef IPFILTER_COMPAT 6228 error = ipf_in_compat(softc, objp, ptr, 0); 6229 #else 6230 IPFERROR(54); 6231 error = EINVAL; 6232 #endif 6233 } 6234 return error; 6235 } 6236 6237 6238 /* ------------------------------------------------------------------------ */ 6239 /* Function: ipf_inobjsz */ 6240 /* Returns: int - 0 = success, else failure */ 6241 /* Parameters: softc(I) - soft context pointerto work with */ 6242 /* data(I) - pointer to ioctl data */ 6243 /* ptr(I) - pointer to store real data in */ 6244 /* type(I) - type of structure being moved */ 6245 /* sz(I) - size of data to copy */ 6246 /* */ 6247 /* As per ipf_inobj, except the size of the object to copy in is passed in */ 6248 /* but it must not be smaller than the size defined for the type and the */ 6249 /* type must allow for varied sized objects. The extra requirement here is */ 6250 /* that sz must match the size of the object being passed in - this is not */ 6251 /* not possible nor required in ipf_inobj(). */ 6252 /* ------------------------------------------------------------------------ */ 6253 int 6254 ipf_inobjsz(ipf_main_softc_t *softc, void *data, void *ptr, int type, int sz) 6255 { 6256 ipfobj_t obj; 6257 int error; 6258 6259 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6260 IPFERROR(56); 6261 return EINVAL; 6262 } 6263 6264 error = BCOPYIN(data, &obj, sizeof(obj)); 6265 if (error != 0) { 6266 IPFERROR(125); 6267 return EFAULT; 6268 } 6269 6270 if (obj.ipfo_type != type) { 6271 IPFERROR(58); 6272 return EINVAL; 6273 } 6274 6275 if (obj.ipfo_rev >= ipf_objbytes[type][2]) { 6276 if (((ipf_objbytes[type][0] & 1) == 0) || 6277 (sz < ipf_objbytes[type][1])) { 6278 IPFERROR(57); 6279 return EINVAL; 6280 } 6281 error = COPYIN(obj.ipfo_ptr, ptr, sz); 6282 if (error != 0) { 6283 IPFERROR(61); 6284 error = EFAULT; 6285 } 6286 } else { 6287 #ifdef IPFILTER_COMPAT 6288 error = ipf_in_compat(softc, &obj, ptr, sz); 6289 #else 6290 IPFERROR(60); 6291 error = EINVAL; 6292 #endif 6293 } 6294 return error; 6295 } 6296 6297 6298 /* ------------------------------------------------------------------------ */ 6299 /* Function: ipf_outobjsz */ 6300 /* Returns: int - 0 = success, else failure */ 6301 /* Parameters: data(I) - pointer to ioctl data */ 6302 /* ptr(I) - pointer to store real data in */ 6303 /* type(I) - type of structure being moved */ 6304 /* sz(I) - size of data to copy */ 6305 /* */ 6306 /* As per ipf_outobj, except the size of the object to copy out is passed in*/ 6307 /* but it must not be smaller than the size defined for the type and the */ 6308 /* type must allow for varied sized objects. The extra requirement here is */ 6309 /* that sz must match the size of the object being passed in - this is not */ 6310 /* not possible nor required in ipf_outobj(). */ 6311 /* ------------------------------------------------------------------------ */ 6312 int 6313 ipf_outobjsz(ipf_main_softc_t *softc, void *data, void *ptr, int type, int sz) 6314 { 6315 ipfobj_t obj; 6316 int error; 6317 6318 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6319 IPFERROR(62); 6320 return EINVAL; 6321 } 6322 6323 error = BCOPYIN(data, &obj, sizeof(obj)); 6324 if (error != 0) { 6325 IPFERROR(127); 6326 return EFAULT; 6327 } 6328 6329 if (obj.ipfo_type != type) { 6330 IPFERROR(63); 6331 return EINVAL; 6332 } 6333 6334 if (obj.ipfo_rev >= ipf_objbytes[type][2]) { 6335 if (((ipf_objbytes[type][0] & 1) == 0) || 6336 (sz < ipf_objbytes[type][1])) { 6337 IPFERROR(146); 6338 return EINVAL; 6339 } 6340 error = COPYOUT(ptr, obj.ipfo_ptr, sz); 6341 if (error != 0) { 6342 IPFERROR(66); 6343 error = EFAULT; 6344 } 6345 } else { 6346 #ifdef IPFILTER_COMPAT 6347 error = ipf_out_compat(softc, &obj, ptr); 6348 #else 6349 IPFERROR(65); 6350 error = EINVAL; 6351 #endif 6352 } 6353 return error; 6354 } 6355 6356 6357 /* ------------------------------------------------------------------------ */ 6358 /* Function: ipf_outobj */ 6359 /* Returns: int - 0 = success, else failure */ 6360 /* Parameters: data(I) - pointer to ioctl data */ 6361 /* ptr(I) - pointer to store real data in */ 6362 /* type(I) - type of structure being moved */ 6363 /* */ 6364 /* Copy out the contents of what ptr is to where ipfobj points to. In */ 6365 /* future, we add things to check for version numbers, sizes, etc, to make */ 6366 /* it backward compatible at the ABI for user land. */ 6367 /* ------------------------------------------------------------------------ */ 6368 int 6369 ipf_outobj(ipf_main_softc_t *softc, void *data, void *ptr, int type) 6370 { 6371 ipfobj_t obj; 6372 int error; 6373 6374 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6375 IPFERROR(67); 6376 return EINVAL; 6377 } 6378 6379 error = BCOPYIN(data, &obj, sizeof(obj)); 6380 if (error != 0) { 6381 IPFERROR(126); 6382 return EFAULT; 6383 } 6384 6385 if (obj.ipfo_type != type) { 6386 IPFERROR(68); 6387 return EINVAL; 6388 } 6389 6390 if (obj.ipfo_rev >= ipf_objbytes[type][2]) { 6391 if ((ipf_objbytes[type][0] & 1) != 0) { 6392 if (obj.ipfo_size < ipf_objbytes[type][1]) { 6393 IPFERROR(69); 6394 return EINVAL; 6395 } 6396 } else if (obj.ipfo_size != ipf_objbytes[type][1]) { 6397 IPFERROR(70); 6398 return EINVAL; 6399 } 6400 6401 error = COPYOUT(ptr, obj.ipfo_ptr, obj.ipfo_size); 6402 if (error != 0) { 6403 IPFERROR(73); 6404 error = EFAULT; 6405 } 6406 } else { 6407 #ifdef IPFILTER_COMPAT 6408 error = ipf_out_compat(softc, &obj, ptr); 6409 #else 6410 IPFERROR(72); 6411 error = EINVAL; 6412 #endif 6413 } 6414 return error; 6415 } 6416 6417 6418 /* ------------------------------------------------------------------------ */ 6419 /* Function: ipf_outobjk */ 6420 /* Returns: int - 0 = success, else failure */ 6421 /* Parameters: obj(I) - pointer to data description structure */ 6422 /* ptr(I) - pointer to kernel data to copy out */ 6423 /* */ 6424 /* In the above functions, the ipfobj_t structure is copied into the kernel,*/ 6425 /* telling ipfilter how to copy out data. In this instance, the ipfobj_t is */ 6426 /* already populated with information and now we just need to use it. */ 6427 /* There is no need for this function to have a "type" parameter as there */ 6428 /* is no point in validating information that comes from the kernel with */ 6429 /* itself. */ 6430 /* ------------------------------------------------------------------------ */ 6431 int 6432 ipf_outobjk(ipf_main_softc_t *softc, ipfobj_t *obj, void *ptr) 6433 { 6434 int type = obj->ipfo_type; 6435 int error; 6436 6437 if ((type < 0) || (type >= IPFOBJ_COUNT)) { 6438 IPFERROR(147); 6439 return EINVAL; 6440 } 6441 6442 if (obj->ipfo_rev >= ipf_objbytes[type][2]) { 6443 if ((ipf_objbytes[type][0] & 1) != 0) { 6444 if (obj->ipfo_size < ipf_objbytes[type][1]) { 6445 IPFERROR(148); 6446 return EINVAL; 6447 } 6448 6449 } else if (obj->ipfo_size != ipf_objbytes[type][1]) { 6450 IPFERROR(149); 6451 return EINVAL; 6452 } 6453 6454 error = COPYOUT(ptr, obj->ipfo_ptr, obj->ipfo_size); 6455 if (error != 0) { 6456 IPFERROR(150); 6457 error = EFAULT; 6458 } 6459 } else { 6460 #ifdef IPFILTER_COMPAT 6461 error = ipf_out_compat(softc, obj, ptr); 6462 #else 6463 IPFERROR(151); 6464 error = EINVAL; 6465 #endif 6466 } 6467 return error; 6468 } 6469 6470 6471 /* ------------------------------------------------------------------------ */ 6472 /* Function: ipf_checkl4sum */ 6473 /* Returns: int - 0 = good, -1 = bad, 1 = cannot check */ 6474 /* Parameters: fin(I) - pointer to packet information */ 6475 /* */ 6476 /* If possible, calculate the layer 4 checksum for the packet. If this is */ 6477 /* not possible, return without indicating a failure or success but in a */ 6478 /* way that is ditinguishable. This function should only be called by the */ 6479 /* ipf_checkv6sum() for each platform. */ 6480 /* ------------------------------------------------------------------------ */ 6481 int 6482 ipf_checkl4sum(fr_info_t *fin) 6483 { 6484 u_short sum, hdrsum, *csump; 6485 udphdr_t *udp; 6486 int dosum; 6487 6488 /* 6489 * If the TCP packet isn't a fragment, isn't too short and otherwise 6490 * isn't already considered "bad", then validate the checksum. If 6491 * this check fails then considered the packet to be "bad". 6492 */ 6493 if ((fin->fin_flx & (FI_FRAG|FI_SHORT|FI_BAD)) != 0) 6494 return 1; 6495 6496 csump = NULL; 6497 hdrsum = 0; 6498 dosum = 0; 6499 sum = 0; 6500 6501 switch (fin->fin_p) 6502 { 6503 case IPPROTO_TCP : 6504 csump = &((tcphdr_t *)fin->fin_dp)->th_sum; 6505 dosum = 1; 6506 break; 6507 6508 case IPPROTO_UDP : 6509 udp = fin->fin_dp; 6510 if (udp->uh_sum != 0) { 6511 csump = &udp->uh_sum; 6512 dosum = 1; 6513 } 6514 break; 6515 6516 #ifdef USE_INET6 6517 case IPPROTO_ICMPV6 : 6518 csump = &((struct icmp6_hdr *)fin->fin_dp)->icmp6_cksum; 6519 dosum = 1; 6520 break; 6521 #endif 6522 6523 case IPPROTO_ICMP : 6524 csump = &((struct icmp *)fin->fin_dp)->icmp_cksum; 6525 dosum = 1; 6526 break; 6527 6528 default : 6529 return 1; 6530 /*NOTREACHED*/ 6531 } 6532 6533 if (csump != NULL) 6534 hdrsum = *csump; 6535 6536 if (dosum) { 6537 sum = fr_cksum(fin, fin->fin_ip, fin->fin_p, fin->fin_dp); 6538 } 6539 #if !defined(_KERNEL) 6540 if (sum == hdrsum) { 6541 FR_DEBUG(("checkl4sum: %hx == %hx\n", sum, hdrsum)); 6542 } else { 6543 FR_DEBUG(("checkl4sum: %hx != %hx\n", sum, hdrsum)); 6544 } 6545 #endif 6546 DT2(l4sums, u_short, hdrsum, u_short, sum); 6547 if (hdrsum == sum) { 6548 fin->fin_cksum = FI_CK_SUMOK; 6549 return 0; 6550 } 6551 fin->fin_cksum = FI_CK_BAD; 6552 return -1; 6553 } 6554 6555 6556 /* ------------------------------------------------------------------------ */ 6557 /* Function: ipf_ifpfillv4addr */ 6558 /* Returns: int - 0 = address update, -1 = address not updated */ 6559 /* Parameters: atype(I) - type of network address update to perform */ 6560 /* sin(I) - pointer to source of address information */ 6561 /* mask(I) - pointer to source of netmask information */ 6562 /* inp(I) - pointer to destination address store */ 6563 /* inpmask(I) - pointer to destination netmask store */ 6564 /* */ 6565 /* Given a type of network address update (atype) to perform, copy */ 6566 /* information from sin/mask into inp/inpmask. If ipnmask is NULL then no */ 6567 /* netmask update is performed unless FRI_NETMASKED is passed as atype, in */ 6568 /* which case the operation fails. For all values of atype other than */ 6569 /* FRI_NETMASKED, if inpmask is non-NULL then the mask is set to an all 1s */ 6570 /* value. */ 6571 /* ------------------------------------------------------------------------ */ 6572 int 6573 ipf_ifpfillv4addr(int atype, struct sockaddr_in *sin, struct sockaddr_in *mask, 6574 struct in_addr *inp, struct in_addr *inpmask) 6575 { 6576 if (inpmask != NULL && atype != FRI_NETMASKED) 6577 inpmask->s_addr = 0xffffffff; 6578 6579 if (atype == FRI_NETWORK || atype == FRI_NETMASKED) { 6580 if (atype == FRI_NETMASKED) { 6581 if (inpmask == NULL) 6582 return -1; 6583 inpmask->s_addr = mask->sin_addr.s_addr; 6584 } 6585 inp->s_addr = sin->sin_addr.s_addr & mask->sin_addr.s_addr; 6586 } else { 6587 inp->s_addr = sin->sin_addr.s_addr; 6588 } 6589 return 0; 6590 } 6591 6592 6593 #ifdef USE_INET6 6594 /* ------------------------------------------------------------------------ */ 6595 /* Function: ipf_ifpfillv6addr */ 6596 /* Returns: int - 0 = address update, -1 = address not updated */ 6597 /* Parameters: atype(I) - type of network address update to perform */ 6598 /* sin(I) - pointer to source of address information */ 6599 /* mask(I) - pointer to source of netmask information */ 6600 /* inp(I) - pointer to destination address store */ 6601 /* inpmask(I) - pointer to destination netmask store */ 6602 /* */ 6603 /* Given a type of network address update (atype) to perform, copy */ 6604 /* information from sin/mask into inp/inpmask. If ipnmask is NULL then no */ 6605 /* netmask update is performed unless FRI_NETMASKED is passed as atype, in */ 6606 /* which case the operation fails. For all values of atype other than */ 6607 /* FRI_NETMASKED, if inpmask is non-NULL then the mask is set to an all 1s */ 6608 /* value. */ 6609 /* ------------------------------------------------------------------------ */ 6610 int 6611 ipf_ifpfillv6addr(int atype, struct sockaddr_in6 *sin, 6612 struct sockaddr_in6 *mask, i6addr_t *inp, i6addr_t *inpmask) 6613 { 6614 i6addr_t *src, *and; 6615 6616 src = (i6addr_t *)&sin->sin6_addr; 6617 and = (i6addr_t *)&mask->sin6_addr; 6618 6619 if (inpmask != NULL && atype != FRI_NETMASKED) { 6620 inpmask->i6[0] = 0xffffffff; 6621 inpmask->i6[1] = 0xffffffff; 6622 inpmask->i6[2] = 0xffffffff; 6623 inpmask->i6[3] = 0xffffffff; 6624 } 6625 6626 if (atype == FRI_NETWORK || atype == FRI_NETMASKED) { 6627 if (atype == FRI_NETMASKED) { 6628 if (inpmask == NULL) 6629 return -1; 6630 inpmask->i6[0] = and->i6[0]; 6631 inpmask->i6[1] = and->i6[1]; 6632 inpmask->i6[2] = and->i6[2]; 6633 inpmask->i6[3] = and->i6[3]; 6634 } 6635 6636 inp->i6[0] = src->i6[0] & and->i6[0]; 6637 inp->i6[1] = src->i6[1] & and->i6[1]; 6638 inp->i6[2] = src->i6[2] & and->i6[2]; 6639 inp->i6[3] = src->i6[3] & and->i6[3]; 6640 } else { 6641 inp->i6[0] = src->i6[0]; 6642 inp->i6[1] = src->i6[1]; 6643 inp->i6[2] = src->i6[2]; 6644 inp->i6[3] = src->i6[3]; 6645 } 6646 return 0; 6647 } 6648 #endif 6649 6650 6651 /* ------------------------------------------------------------------------ */ 6652 /* Function: ipf_matchtag */ 6653 /* Returns: 0 == mismatch, 1 == match. */ 6654 /* Parameters: tag1(I) - pointer to first tag to compare */ 6655 /* tag2(I) - pointer to second tag to compare */ 6656 /* */ 6657 /* Returns true (non-zero) or false(0) if the two tag structures can be */ 6658 /* considered to be a match or not match, respectively. The tag is 16 */ 6659 /* bytes long (16 characters) but that is overlayed with 4 32bit ints so */ 6660 /* compare the ints instead, for speed. tag1 is the master of the */ 6661 /* comparison. This function should only be called with both tag1 and tag2 */ 6662 /* as non-NULL pointers. */ 6663 /* ------------------------------------------------------------------------ */ 6664 int 6665 ipf_matchtag(ipftag_t *tag1, ipftag_t *tag2) 6666 { 6667 if (tag1 == tag2) 6668 return 1; 6669 6670 if ((tag1->ipt_num[0] == 0) && (tag2->ipt_num[0] == 0)) 6671 return 1; 6672 6673 if ((tag1->ipt_num[0] == tag2->ipt_num[0]) && 6674 (tag1->ipt_num[1] == tag2->ipt_num[1]) && 6675 (tag1->ipt_num[2] == tag2->ipt_num[2]) && 6676 (tag1->ipt_num[3] == tag2->ipt_num[3])) 6677 return 1; 6678 return 0; 6679 } 6680 6681 6682 /* ------------------------------------------------------------------------ */ 6683 /* Function: ipf_coalesce */ 6684 /* Returns: 1 == success, -1 == failure, 0 == no change */ 6685 /* Parameters: fin(I) - pointer to packet information */ 6686 /* */ 6687 /* Attempt to get all of the packet data into a single, contiguous buffer. */ 6688 /* If this call returns a failure then the buffers have also been freed. */ 6689 /* ------------------------------------------------------------------------ */ 6690 int 6691 ipf_coalesce(fr_info_t *fin) 6692 { 6693 6694 if ((fin->fin_flx & FI_COALESCE) != 0) 6695 return 1; 6696 6697 /* 6698 * If the mbuf pointers indicate that there is no mbuf to work with, 6699 * return but do not indicate success or failure. 6700 */ 6701 if (fin->fin_m == NULL || fin->fin_mp == NULL) 6702 return 0; 6703 6704 #if defined(_KERNEL) 6705 if (ipf_pullup(fin->fin_m, fin, fin->fin_plen) == NULL) { 6706 ipf_main_softc_t *softc = fin->fin_main_soft; 6707 6708 DT1(frb_coalesce, fr_info_t *, fin); 6709 LBUMP(ipf_stats[fin->fin_out].fr_badcoalesces); 6710 # ifdef MENTAT 6711 FREE_MB_T(*fin->fin_mp); 6712 # endif 6713 fin->fin_reason = FRB_COALESCE; 6714 *fin->fin_mp = NULL; 6715 fin->fin_m = NULL; 6716 return -1; 6717 } 6718 #else 6719 fin = fin; /* LINT */ 6720 #endif 6721 return 1; 6722 } 6723 6724 6725 /* 6726 * The following table lists all of the tunable variables that can be 6727 * accessed via SIOCIPFGET/SIOCIPFSET/SIOCIPFGETNEXt. The format of each row 6728 * in the table below is as follows: 6729 * 6730 * pointer to value, name of value, minimum, maximum, size of the value's 6731 * container, value attribute flags 6732 * 6733 * For convienience, IPFT_RDONLY means the value is read-only, IPFT_WRDISABLED 6734 * means the value can only be written to when IPFilter is loaded but disabled. 6735 * The obvious implication is if neither of these are set then the value can be 6736 * changed at any time without harm. 6737 */ 6738 6739 6740 /* ------------------------------------------------------------------------ */ 6741 /* Function: ipf_tune_findbycookie */ 6742 /* Returns: NULL = search failed, else pointer to tune struct */ 6743 /* Parameters: cookie(I) - cookie value to search for amongst tuneables */ 6744 /* next(O) - pointer to place to store the cookie for the */ 6745 /* "next" tuneable, if it is desired. */ 6746 /* */ 6747 /* This function is used to walk through all of the existing tunables with */ 6748 /* successive calls. It searches the known tunables for the one which has */ 6749 /* a matching value for "cookie" - ie its address. When returning a match, */ 6750 /* the next one to be found may be returned inside next. */ 6751 /* ------------------------------------------------------------------------ */ 6752 static ipftuneable_t * 6753 ipf_tune_findbycookie(ipftuneable_t **ptop, void *cookie, void **next) 6754 { 6755 ipftuneable_t *ta, **tap; 6756 6757 for (ta = *ptop; ta->ipft_name != NULL; ta++) 6758 if (ta == cookie) { 6759 if (next != NULL) { 6760 /* 6761 * If the next entry in the array has a name 6762 * present, then return a pointer to it for 6763 * where to go next, else return a pointer to 6764 * the dynaminc list as a key to search there 6765 * next. This facilitates a weak linking of 6766 * the two "lists" together. 6767 */ 6768 if ((ta + 1)->ipft_name != NULL) 6769 *next = ta + 1; 6770 else 6771 *next = ptop; 6772 } 6773 return ta; 6774 } 6775 6776 for (tap = ptop; (ta = *tap) != NULL; tap = &ta->ipft_next) 6777 if (tap == cookie) { 6778 if (next != NULL) 6779 *next = &ta->ipft_next; 6780 return ta; 6781 } 6782 6783 if (next != NULL) 6784 *next = NULL; 6785 return NULL; 6786 } 6787 6788 6789 /* ------------------------------------------------------------------------ */ 6790 /* Function: ipf_tune_findbyname */ 6791 /* Returns: NULL = search failed, else pointer to tune struct */ 6792 /* Parameters: name(I) - name of the tuneable entry to find. */ 6793 /* */ 6794 /* Search the static array of tuneables and the list of dynamic tuneables */ 6795 /* for an entry with a matching name. If we can find one, return a pointer */ 6796 /* to the matching structure. */ 6797 /* ------------------------------------------------------------------------ */ 6798 static ipftuneable_t * 6799 ipf_tune_findbyname(ipftuneable_t *top, const char *name) 6800 { 6801 ipftuneable_t *ta; 6802 6803 for (ta = top; ta != NULL; ta = ta->ipft_next) 6804 if (!strcmp(ta->ipft_name, name)) { 6805 return ta; 6806 } 6807 6808 return NULL; 6809 } 6810 6811 6812 /* ------------------------------------------------------------------------ */ 6813 /* Function: ipf_tune_add_array */ 6814 /* Returns: int - 0 == success, else failure */ 6815 /* Parameters: newtune - pointer to new tune array to add to tuneables */ 6816 /* */ 6817 /* Appends tune structures from the array passed in (newtune) to the end of */ 6818 /* the current list of "dynamic" tuneable parameters. */ 6819 /* If any entry to be added is already present (by name) then the operation */ 6820 /* is aborted - entries that have been added are removed before returning. */ 6821 /* An entry with no name (NULL) is used as the indication that the end of */ 6822 /* the array has been reached. */ 6823 /* ------------------------------------------------------------------------ */ 6824 int 6825 ipf_tune_add_array(ipf_main_softc_t *softc, ipftuneable_t *newtune) 6826 { 6827 ipftuneable_t *nt, *dt; 6828 int error = 0; 6829 6830 for (nt = newtune; nt->ipft_name != NULL; nt++) { 6831 error = ipf_tune_add(softc, nt); 6832 if (error != 0) { 6833 for (dt = newtune; dt != nt; dt++) { 6834 (void) ipf_tune_del(softc, dt); 6835 } 6836 } 6837 } 6838 6839 return error; 6840 } 6841 6842 6843 /* ------------------------------------------------------------------------ */ 6844 /* Function: ipf_tune_array_link */ 6845 /* Returns: 0 == success, -1 == failure */ 6846 /* Parameters: softc(I) - soft context pointerto work with */ 6847 /* array(I) - pointer to an array of tuneables */ 6848 /* */ 6849 /* Given an array of tunables (array), append them to the current list of */ 6850 /* tuneables for this context (softc->ipf_tuners.) To properly prepare the */ 6851 /* the array for being appended to the list, initialise all of the next */ 6852 /* pointers so we don't need to walk parts of it with ++ and others with */ 6853 /* next. The array is expected to have an entry with a NULL name as the */ 6854 /* terminator. Trying to add an array with no non-NULL names will return as */ 6855 /* a failure. */ 6856 /* ------------------------------------------------------------------------ */ 6857 int 6858 ipf_tune_array_link(ipf_main_softc_t *softc, ipftuneable_t *array) 6859 { 6860 ipftuneable_t *t, **p; 6861 6862 t = array; 6863 if (t->ipft_name == NULL) 6864 return -1; 6865 6866 for (; t[1].ipft_name != NULL; t++) 6867 t[0].ipft_next = &t[1]; 6868 t->ipft_next = NULL; 6869 6870 /* 6871 * Since a pointer to the last entry isn't kept, we need to find it 6872 * each time we want to add new variables to the list. 6873 */ 6874 for (p = &softc->ipf_tuners; (t = *p) != NULL; p = &t->ipft_next) 6875 if (t->ipft_name == NULL) 6876 break; 6877 *p = array; 6878 6879 return 0; 6880 } 6881 6882 6883 /* ------------------------------------------------------------------------ */ 6884 /* Function: ipf_tune_array_unlink */ 6885 /* Returns: 0 == success, -1 == failure */ 6886 /* Parameters: softc(I) - soft context pointerto work with */ 6887 /* array(I) - pointer to an array of tuneables */ 6888 /* */ 6889 /* ------------------------------------------------------------------------ */ 6890 int 6891 ipf_tune_array_unlink(ipf_main_softc_t *softc, ipftuneable_t *array) 6892 { 6893 ipftuneable_t *t, **p; 6894 6895 for (p = &softc->ipf_tuners; (t = *p) != NULL; p = &t->ipft_next) 6896 if (t == array) 6897 break; 6898 if (t == NULL) 6899 return -1; 6900 6901 for (; t[1].ipft_name != NULL; t++) 6902 ; 6903 6904 *p = t->ipft_next; 6905 6906 return 0; 6907 } 6908 6909 6910 /* ------------------------------------------------------------------------ */ 6911 /* Function: ipf_tune_array_copy */ 6912 /* Returns: NULL = failure, else pointer to new array */ 6913 /* Parameters: base(I) - pointer to structure base */ 6914 /* size(I) - size of the array at template */ 6915 /* template(I) - original array to copy */ 6916 /* */ 6917 /* Allocate memory for a new set of tuneable values and copy everything */ 6918 /* from template into the new region of memory. The new region is full of */ 6919 /* uninitialised pointers (ipft_next) so set them up. Now, ipftp_offset... */ 6920 /* */ 6921 /* NOTE: the following assumes that sizeof(long) == sizeof(void *) */ 6922 /* In the array template, ipftp_offset is the offset (in bytes) of the */ 6923 /* location of the tuneable value inside the structure pointed to by base. */ 6924 /* As ipftp_offset is a union over the pointers to the tuneable values, if */ 6925 /* we add base to the copy's ipftp_offset, copy ends up with a pointer in */ 6926 /* ipftp_void that points to the stored value. */ 6927 /* ------------------------------------------------------------------------ */ 6928 ipftuneable_t * 6929 ipf_tune_array_copy(void *base, size_t size, const ipftuneable_t *template) 6930 { 6931 ipftuneable_t *copy; 6932 int i; 6933 6934 6935 KMALLOCS(copy, ipftuneable_t *, size); 6936 if (copy == NULL) { 6937 return NULL; 6938 } 6939 bcopy(template, copy, size); 6940 6941 for (i = 0; copy[i].ipft_name; i++) { 6942 copy[i].ipft_una.ipftp_offset += (u_long)base; 6943 copy[i].ipft_next = copy + i + 1; 6944 } 6945 6946 return copy; 6947 } 6948 6949 6950 /* ------------------------------------------------------------------------ */ 6951 /* Function: ipf_tune_add */ 6952 /* Returns: int - 0 == success, else failure */ 6953 /* Parameters: newtune - pointer to new tune entry to add to tuneables */ 6954 /* */ 6955 /* Appends tune structures from the array passed in (newtune) to the end of */ 6956 /* the current list of "dynamic" tuneable parameters. Once added, the */ 6957 /* owner of the object is not expected to ever change "ipft_next". */ 6958 /* ------------------------------------------------------------------------ */ 6959 int 6960 ipf_tune_add(ipf_main_softc_t *softc, ipftuneable_t *newtune) 6961 { 6962 ipftuneable_t *ta, **tap; 6963 6964 ta = ipf_tune_findbyname(softc->ipf_tuners, newtune->ipft_name); 6965 if (ta != NULL) { 6966 IPFERROR(74); 6967 return EEXIST; 6968 } 6969 6970 for (tap = &softc->ipf_tuners; *tap != NULL; tap = &(*tap)->ipft_next) 6971 ; 6972 6973 newtune->ipft_next = NULL; 6974 *tap = newtune; 6975 return 0; 6976 } 6977 6978 6979 /* ------------------------------------------------------------------------ */ 6980 /* Function: ipf_tune_del */ 6981 /* Returns: int - 0 == success, else failure */ 6982 /* Parameters: oldtune - pointer to tune entry to remove from the list of */ 6983 /* current dynamic tuneables */ 6984 /* */ 6985 /* Search for the tune structure, by pointer, in the list of those that are */ 6986 /* dynamically added at run time. If found, adjust the list so that this */ 6987 /* structure is no longer part of it. */ 6988 /* ------------------------------------------------------------------------ */ 6989 int 6990 ipf_tune_del(ipf_main_softc_t *softc, ipftuneable_t *oldtune) 6991 { 6992 ipftuneable_t *ta, **tap; 6993 int error = 0; 6994 6995 for (tap = &softc->ipf_tuners; (ta = *tap) != NULL; 6996 tap = &ta->ipft_next) { 6997 if (ta == oldtune) { 6998 *tap = oldtune->ipft_next; 6999 oldtune->ipft_next = NULL; 7000 break; 7001 } 7002 } 7003 7004 if (ta == NULL) { 7005 error = ESRCH; 7006 IPFERROR(75); 7007 } 7008 return error; 7009 } 7010 7011 7012 /* ------------------------------------------------------------------------ */ 7013 /* Function: ipf_tune_del_array */ 7014 /* Returns: int - 0 == success, else failure */ 7015 /* Parameters: oldtune - pointer to tuneables array */ 7016 /* */ 7017 /* Remove each tuneable entry in the array from the list of "dynamic" */ 7018 /* tunables. If one entry should fail to be found, an error will be */ 7019 /* returned and no further ones removed. */ 7020 /* An entry with a NULL name is used as the indicator of the last entry in */ 7021 /* the array. */ 7022 /* ------------------------------------------------------------------------ */ 7023 int 7024 ipf_tune_del_array(ipf_main_softc_t *softc, ipftuneable_t *oldtune) 7025 { 7026 ipftuneable_t *ot; 7027 int error = 0; 7028 7029 for (ot = oldtune; ot->ipft_name != NULL; ot++) { 7030 error = ipf_tune_del(softc, ot); 7031 if (error != 0) 7032 break; 7033 } 7034 7035 return error; 7036 7037 } 7038 7039 7040 /* ------------------------------------------------------------------------ */ 7041 /* Function: ipf_tune */ 7042 /* Returns: int - 0 == success, else failure */ 7043 /* Parameters: cmd(I) - ioctl command number */ 7044 /* data(I) - pointer to ioctl data structure */ 7045 /* */ 7046 /* Implement handling of SIOCIPFGETNEXT, SIOCIPFGET and SIOCIPFSET. These */ 7047 /* three ioctls provide the means to access and control global variables */ 7048 /* within IPFilter, allowing (for example) timeouts and table sizes to be */ 7049 /* changed without rebooting, reloading or recompiling. The initialisation */ 7050 /* and 'destruction' routines of the various components of ipfilter are all */ 7051 /* each responsible for handling their own values being too big. */ 7052 /* ------------------------------------------------------------------------ */ 7053 int 7054 ipf_ipftune(ipf_main_softc_t *softc, ioctlcmd_t cmd, void *data) 7055 { 7056 ipftuneable_t *ta; 7057 ipftune_t tu; 7058 void *cookie; 7059 int error; 7060 7061 error = ipf_inobj(softc, data, NULL, &tu, IPFOBJ_TUNEABLE); 7062 if (error != 0) 7063 return error; 7064 7065 tu.ipft_name[sizeof(tu.ipft_name) - 1] = '\0'; 7066 cookie = tu.ipft_cookie; 7067 ta = NULL; 7068 7069 switch (cmd) 7070 { 7071 case SIOCIPFGETNEXT : 7072 /* 7073 * If cookie is non-NULL, assume it to be a pointer to the last 7074 * entry we looked at, so find it (if possible) and return a 7075 * pointer to the next one after it. The last entry in the 7076 * the table is a NULL entry, so when we get to it, set cookie 7077 * to NULL and return that, indicating end of list, erstwhile 7078 * if we come in with cookie set to NULL, we are starting anew 7079 * at the front of the list. 7080 */ 7081 if (cookie != NULL) { 7082 ta = ipf_tune_findbycookie(&softc->ipf_tuners, 7083 cookie, &tu.ipft_cookie); 7084 } else { 7085 ta = softc->ipf_tuners; 7086 tu.ipft_cookie = ta + 1; 7087 } 7088 if (ta != NULL) { 7089 /* 7090 * Entry found, but does the data pointed to by that 7091 * row fit in what we can return? 7092 */ 7093 if (ta->ipft_sz > sizeof(tu.ipft_un)) { 7094 IPFERROR(76); 7095 return EINVAL; 7096 } 7097 7098 tu.ipft_vlong = 0; 7099 if (ta->ipft_sz == sizeof(u_long)) 7100 tu.ipft_vlong = *ta->ipft_plong; 7101 else if (ta->ipft_sz == sizeof(u_int)) 7102 tu.ipft_vint = *ta->ipft_pint; 7103 else if (ta->ipft_sz == sizeof(u_short)) 7104 tu.ipft_vshort = *ta->ipft_pshort; 7105 else if (ta->ipft_sz == sizeof(u_char)) 7106 tu.ipft_vchar = *ta->ipft_pchar; 7107 7108 tu.ipft_sz = ta->ipft_sz; 7109 tu.ipft_min = ta->ipft_min; 7110 tu.ipft_max = ta->ipft_max; 7111 tu.ipft_flags = ta->ipft_flags; 7112 bcopy(ta->ipft_name, tu.ipft_name, 7113 MIN(sizeof(tu.ipft_name), 7114 strlen(ta->ipft_name) + 1)); 7115 } 7116 error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE); 7117 break; 7118 7119 case SIOCIPFGET : 7120 case SIOCIPFSET : 7121 /* 7122 * Search by name or by cookie value for a particular entry 7123 * in the tuning paramter table. 7124 */ 7125 IPFERROR(77); 7126 error = ESRCH; 7127 if (cookie != NULL) { 7128 ta = ipf_tune_findbycookie(&softc->ipf_tuners, 7129 cookie, NULL); 7130 if (ta != NULL) 7131 error = 0; 7132 } else if (tu.ipft_name[0] != '\0') { 7133 ta = ipf_tune_findbyname(softc->ipf_tuners, 7134 tu.ipft_name); 7135 if (ta != NULL) 7136 error = 0; 7137 } 7138 if (error != 0) 7139 break; 7140 7141 if (cmd == (ioctlcmd_t)SIOCIPFGET) { 7142 /* 7143 * Fetch the tuning parameters for a particular value 7144 */ 7145 tu.ipft_vlong = 0; 7146 if (ta->ipft_sz == sizeof(u_long)) 7147 tu.ipft_vlong = *ta->ipft_plong; 7148 else if (ta->ipft_sz == sizeof(u_int)) 7149 tu.ipft_vint = *ta->ipft_pint; 7150 else if (ta->ipft_sz == sizeof(u_short)) 7151 tu.ipft_vshort = *ta->ipft_pshort; 7152 else if (ta->ipft_sz == sizeof(u_char)) 7153 tu.ipft_vchar = *ta->ipft_pchar; 7154 tu.ipft_cookie = ta; 7155 tu.ipft_sz = ta->ipft_sz; 7156 tu.ipft_min = ta->ipft_min; 7157 tu.ipft_max = ta->ipft_max; 7158 tu.ipft_flags = ta->ipft_flags; 7159 error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE); 7160 7161 } else if (cmd == (ioctlcmd_t)SIOCIPFSET) { 7162 /* 7163 * Set an internal parameter. The hard part here is 7164 * getting the new value safely and correctly out of 7165 * the kernel (given we only know its size, not type.) 7166 */ 7167 u_long in; 7168 7169 if (((ta->ipft_flags & IPFT_WRDISABLED) != 0) && 7170 (softc->ipf_running > 0)) { 7171 IPFERROR(78); 7172 error = EBUSY; 7173 break; 7174 } 7175 7176 in = tu.ipft_vlong; 7177 if (in < ta->ipft_min || in > ta->ipft_max) { 7178 IPFERROR(79); 7179 error = EINVAL; 7180 break; 7181 } 7182 7183 if (ta->ipft_func != NULL) { 7184 SPL_INT(s); 7185 7186 SPL_NET(s); 7187 error = (*ta->ipft_func)(softc, ta, 7188 &tu.ipft_un); 7189 SPL_X(s); 7190 7191 } else if (ta->ipft_sz == sizeof(u_long)) { 7192 tu.ipft_vlong = *ta->ipft_plong; 7193 *ta->ipft_plong = in; 7194 7195 } else if (ta->ipft_sz == sizeof(u_int)) { 7196 tu.ipft_vint = *ta->ipft_pint; 7197 *ta->ipft_pint = (u_int)(in & 0xffffffff); 7198 7199 } else if (ta->ipft_sz == sizeof(u_short)) { 7200 tu.ipft_vshort = *ta->ipft_pshort; 7201 *ta->ipft_pshort = (u_short)(in & 0xffff); 7202 7203 } else if (ta->ipft_sz == sizeof(u_char)) { 7204 tu.ipft_vchar = *ta->ipft_pchar; 7205 *ta->ipft_pchar = (u_char)(in & 0xff); 7206 } 7207 error = ipf_outobj(softc, data, &tu, IPFOBJ_TUNEABLE); 7208 } 7209 break; 7210 7211 default : 7212 IPFERROR(80); 7213 error = EINVAL; 7214 break; 7215 } 7216 7217 return error; 7218 } 7219 7220 7221 /* ------------------------------------------------------------------------ */ 7222 /* Function: ipf_zerostats */ 7223 /* Returns: int - 0 = success, else failure */ 7224 /* Parameters: data(O) - pointer to pointer for copying data back to */ 7225 /* */ 7226 /* Copies the current statistics out to userspace and then zero's the */ 7227 /* current ones in the kernel. The lock is only held across the bzero() as */ 7228 /* the copyout may result in paging (ie network activity.) */ 7229 /* ------------------------------------------------------------------------ */ 7230 int 7231 ipf_zerostats(ipf_main_softc_t *softc, void *data) 7232 { 7233 friostat_t fio; 7234 ipfobj_t obj; 7235 int error; 7236 7237 error = ipf_inobj(softc, data, &obj, &fio, IPFOBJ_IPFSTAT); 7238 if (error != 0) 7239 return error; 7240 ipf_getstat(softc, &fio, obj.ipfo_rev); 7241 error = ipf_outobj(softc, data, &fio, IPFOBJ_IPFSTAT); 7242 if (error != 0) 7243 return error; 7244 7245 WRITE_ENTER(&softc->ipf_mutex); 7246 bzero(&softc->ipf_stats, sizeof(softc->ipf_stats)); 7247 RWLOCK_EXIT(&softc->ipf_mutex); 7248 7249 return 0; 7250 } 7251 7252 7253 /* ------------------------------------------------------------------------ */ 7254 /* Function: ipf_resolvedest */ 7255 /* Returns: Nil */ 7256 /* Parameters: softc(I) - pointer to soft context main structure */ 7257 /* base(I) - where strings are stored */ 7258 /* fdp(IO) - pointer to destination information to resolve */ 7259 /* v(I) - IP protocol version to match */ 7260 /* */ 7261 /* Looks up an interface name in the frdest structure pointed to by fdp and */ 7262 /* if a matching name can be found for the particular IP protocol version */ 7263 /* then store the interface pointer in the frdest struct. If no match is */ 7264 /* found, then set the interface pointer to be -1 as NULL is considered to */ 7265 /* indicate there is no information at all in the structure. */ 7266 /* ------------------------------------------------------------------------ */ 7267 int 7268 ipf_resolvedest(ipf_main_softc_t *softc, char *base, frdest_t *fdp, int v) 7269 { 7270 int errval = 0; 7271 void *ifp; 7272 7273 ifp = NULL; 7274 7275 if (fdp->fd_name != -1) { 7276 if (fdp->fd_type == FRD_DSTLIST) { 7277 ifp = ipf_lookup_res_name(softc, IPL_LOGIPF, 7278 IPLT_DSTLIST, 7279 base + fdp->fd_name, 7280 NULL); 7281 if (ifp == NULL) { 7282 IPFERROR(144); 7283 errval = ESRCH; 7284 } 7285 } else { 7286 ifp = GETIFP(base + fdp->fd_name, v); 7287 if (ifp == NULL) 7288 ifp = (void *)-1; 7289 if ((ifp != NULL) && (ifp != (void *)-1)) 7290 fdp->fd_local = ipf_deliverlocal(softc, v, ifp, 7291 &fdp->fd_ip6); 7292 } 7293 } 7294 fdp->fd_ptr = ifp; 7295 7296 return errval; 7297 } 7298 7299 7300 /* ------------------------------------------------------------------------ */ 7301 /* Function: ipf_resolvenic */ 7302 /* Returns: void* - NULL = wildcard name, -1 = failed to find NIC, else */ 7303 /* pointer to interface structure for NIC */ 7304 /* Parameters: softc(I)- pointer to soft context main structure */ 7305 /* name(I) - complete interface name */ 7306 /* v(I) - IP protocol version */ 7307 /* */ 7308 /* Look for a network interface structure that firstly has a matching name */ 7309 /* to that passed in and that is also being used for that IP protocol */ 7310 /* version (necessary on some platforms where there are separate listings */ 7311 /* for both IPv4 and IPv6 on the same physical NIC. */ 7312 /* */ 7313 /* ------------------------------------------------------------------------ */ 7314 void * 7315 ipf_resolvenic(ipf_main_softc_t *softc, char *name, int v) 7316 { 7317 void *nic; 7318 7319 softc = softc; /* gcc -Wextra */ 7320 if (name[0] == '\0') 7321 return NULL; 7322 7323 if ((name[1] == '\0') && ((name[0] == '-') || (name[0] == '*'))) { 7324 return NULL; 7325 } 7326 7327 nic = GETIFP(name, v); 7328 if (nic == NULL) 7329 nic = (void *)-1; 7330 return nic; 7331 } 7332 7333 7334 /* ------------------------------------------------------------------------ */ 7335 /* Function: ipf_token_expire */ 7336 /* Returns: None. */ 7337 /* Parameters: softc(I) - pointer to soft context main structure */ 7338 /* */ 7339 /* This function is run every ipf tick to see if there are any tokens that */ 7340 /* have been held for too long and need to be freed up. */ 7341 /* ------------------------------------------------------------------------ */ 7342 void 7343 ipf_token_expire(ipf_main_softc_t *softc) 7344 { 7345 ipftoken_t *it; 7346 7347 WRITE_ENTER(&softc->ipf_tokens); 7348 while ((it = softc->ipf_token_head) != NULL) { 7349 if (it->ipt_die > softc->ipf_ticks) 7350 break; 7351 7352 ipf_token_deref(softc, it); 7353 } 7354 RWLOCK_EXIT(&softc->ipf_tokens); 7355 } 7356 7357 7358 /* ------------------------------------------------------------------------ */ 7359 /* Function: ipf_token_flush */ 7360 /* Returns: None. */ 7361 /* Parameters: softc(I) - pointer to soft context main structure */ 7362 /* */ 7363 /* Loop through all of the existing tokens and call deref to see if they */ 7364 /* can be freed. Normally a function like this might just loop on */ 7365 /* ipf_token_head but there is a chance that a token might have a ref count */ 7366 /* of greater than one and in that case the the reference would drop twice */ 7367 /* by code that is only entitled to drop it once. */ 7368 /* ------------------------------------------------------------------------ */ 7369 static void 7370 ipf_token_flush(ipf_main_softc_t *softc) 7371 { 7372 ipftoken_t *it, *next; 7373 7374 WRITE_ENTER(&softc->ipf_tokens); 7375 for (it = softc->ipf_token_head; it != NULL; it = next) { 7376 next = it->ipt_next; 7377 (void) ipf_token_deref(softc, it); 7378 } 7379 RWLOCK_EXIT(&softc->ipf_tokens); 7380 } 7381 7382 7383 /* ------------------------------------------------------------------------ */ 7384 /* Function: ipf_token_del */ 7385 /* Returns: int - 0 = success, else error */ 7386 /* Parameters: softc(I)- pointer to soft context main structure */ 7387 /* type(I) - the token type to match */ 7388 /* uid(I) - uid owning the token */ 7389 /* ptr(I) - context pointer for the token */ 7390 /* */ 7391 /* This function looks for a a token in the current list that matches up */ 7392 /* the fields (type, uid, ptr). If none is found, ESRCH is returned, else */ 7393 /* call ipf_token_dewref() to remove it from the list. In the event that */ 7394 /* the token has a reference held elsewhere, setting ipt_complete to 2 */ 7395 /* enables debugging to distinguish between the two paths that ultimately */ 7396 /* lead to a token to be deleted. */ 7397 /* ------------------------------------------------------------------------ */ 7398 int 7399 ipf_token_del(ipf_main_softc_t *softc, int type, int uid, void *ptr) 7400 { 7401 ipftoken_t *it; 7402 int error; 7403 7404 IPFERROR(82); 7405 error = ESRCH; 7406 7407 WRITE_ENTER(&softc->ipf_tokens); 7408 for (it = softc->ipf_token_head; it != NULL; it = it->ipt_next) { 7409 if (ptr == it->ipt_ctx && type == it->ipt_type && 7410 uid == it->ipt_uid) { 7411 it->ipt_complete = 2; 7412 ipf_token_deref(softc, it); 7413 error = 0; 7414 break; 7415 } 7416 } 7417 RWLOCK_EXIT(&softc->ipf_tokens); 7418 7419 return error; 7420 } 7421 7422 7423 /* ------------------------------------------------------------------------ */ 7424 /* Function: ipf_token_mark_complete */ 7425 /* Returns: None. */ 7426 /* Parameters: token(I) - pointer to token structure */ 7427 /* */ 7428 /* Mark a token as being ineligable for being found with ipf_token_find. */ 7429 /* ------------------------------------------------------------------------ */ 7430 void 7431 ipf_token_mark_complete(ipftoken_t *token) 7432 { 7433 if (token->ipt_complete == 0) 7434 token->ipt_complete = 1; 7435 } 7436 7437 7438 /* ------------------------------------------------------------------------ */ 7439 /* Function: ipf_token_find */ 7440 /* Returns: ipftoken_t * - NULL if no memory, else pointer to token */ 7441 /* Parameters: softc(I)- pointer to soft context main structure */ 7442 /* type(I) - the token type to match */ 7443 /* uid(I) - uid owning the token */ 7444 /* ptr(I) - context pointer for the token */ 7445 /* */ 7446 /* This function looks for a live token in the list of current tokens that */ 7447 /* matches the tuple (type, uid, ptr). If one cannot be found then one is */ 7448 /* allocated. If one is found then it is moved to the top of the list of */ 7449 /* currently active tokens. */ 7450 /* ------------------------------------------------------------------------ */ 7451 ipftoken_t * 7452 ipf_token_find(ipf_main_softc_t *softc, int type, int uid, void *ptr) 7453 { 7454 ipftoken_t *it, *new; 7455 7456 KMALLOC(new, ipftoken_t *); 7457 if (new != NULL) 7458 bzero((char *)new, sizeof(*new)); 7459 7460 WRITE_ENTER(&softc->ipf_tokens); 7461 for (it = softc->ipf_token_head; it != NULL; it = it->ipt_next) { 7462 if ((ptr == it->ipt_ctx) && (type == it->ipt_type) && 7463 (uid == it->ipt_uid) && (it->ipt_complete < 2)) 7464 break; 7465 } 7466 7467 if (it == NULL) { 7468 it = new; 7469 new = NULL; 7470 if (it == NULL) { 7471 RWLOCK_EXIT(&softc->ipf_tokens); 7472 return NULL; 7473 } 7474 it->ipt_ctx = ptr; 7475 it->ipt_uid = uid; 7476 it->ipt_type = type; 7477 it->ipt_ref = 1; 7478 } else { 7479 if (new != NULL) { 7480 KFREE(new); 7481 new = NULL; 7482 } 7483 7484 if (it->ipt_complete > 0) 7485 it = NULL; 7486 else 7487 ipf_token_unlink(softc, it); 7488 } 7489 7490 if (it != NULL) { 7491 it->ipt_pnext = softc->ipf_token_tail; 7492 *softc->ipf_token_tail = it; 7493 softc->ipf_token_tail = &it->ipt_next; 7494 it->ipt_next = NULL; 7495 it->ipt_ref++; 7496 7497 it->ipt_die = softc->ipf_ticks + 20; 7498 } 7499 7500 RWLOCK_EXIT(&softc->ipf_tokens); 7501 7502 return it; 7503 } 7504 7505 7506 /* ------------------------------------------------------------------------ */ 7507 /* Function: ipf_token_unlink */ 7508 /* Returns: None. */ 7509 /* Parameters: softc(I) - pointer to soft context main structure */ 7510 /* token(I) - pointer to token structure */ 7511 /* Write Locks: ipf_tokens */ 7512 /* */ 7513 /* This function unlinks a token structure from the linked list of tokens */ 7514 /* that "own" it. The head pointer never needs to be explicitly adjusted */ 7515 /* but the tail does due to the linked list implementation. */ 7516 /* ------------------------------------------------------------------------ */ 7517 static void 7518 ipf_token_unlink(ipf_main_softc_t *softc, ipftoken_t *token) 7519 { 7520 7521 if (softc->ipf_token_tail == &token->ipt_next) 7522 softc->ipf_token_tail = token->ipt_pnext; 7523 7524 *token->ipt_pnext = token->ipt_next; 7525 if (token->ipt_next != NULL) 7526 token->ipt_next->ipt_pnext = token->ipt_pnext; 7527 token->ipt_next = NULL; 7528 token->ipt_pnext = NULL; 7529 } 7530 7531 7532 /* ------------------------------------------------------------------------ */ 7533 /* Function: ipf_token_deref */ 7534 /* Returns: int - 0 == token freed, else reference count */ 7535 /* Parameters: softc(I) - pointer to soft context main structure */ 7536 /* token(I) - pointer to token structure */ 7537 /* Write Locks: ipf_tokens */ 7538 /* */ 7539 /* Drop the reference count on the token structure and if it drops to zero, */ 7540 /* call the dereference function for the token type because it is then */ 7541 /* possible to free the token data structure. */ 7542 /* ------------------------------------------------------------------------ */ 7543 int 7544 ipf_token_deref(ipf_main_softc_t *softc, ipftoken_t *token) 7545 { 7546 void *data, **datap; 7547 7548 ASSERT(token->ipt_ref > 0); 7549 token->ipt_ref--; 7550 if (token->ipt_ref > 0) 7551 return token->ipt_ref; 7552 7553 data = token->ipt_data; 7554 datap = &data; 7555 7556 if ((data != NULL) && (data != (void *)-1)) { 7557 switch (token->ipt_type) 7558 { 7559 case IPFGENITER_IPF : 7560 (void) ipf_derefrule(softc, (frentry_t **)datap); 7561 break; 7562 case IPFGENITER_IPNAT : 7563 WRITE_ENTER(&softc->ipf_nat); 7564 ipf_nat_rule_deref(softc, (ipnat_t **)datap); 7565 RWLOCK_EXIT(&softc->ipf_nat); 7566 break; 7567 case IPFGENITER_NAT : 7568 ipf_nat_deref(softc, (nat_t **)datap); 7569 break; 7570 case IPFGENITER_STATE : 7571 ipf_state_deref(softc, (ipstate_t **)datap); 7572 break; 7573 case IPFGENITER_FRAG : 7574 ipf_frag_pkt_deref(softc, (ipfr_t **)datap); 7575 break; 7576 case IPFGENITER_NATFRAG : 7577 ipf_frag_nat_deref(softc, (ipfr_t **)datap); 7578 break; 7579 case IPFGENITER_HOSTMAP : 7580 WRITE_ENTER(&softc->ipf_nat); 7581 ipf_nat_hostmapdel(softc, (hostmap_t **)datap); 7582 RWLOCK_EXIT(&softc->ipf_nat); 7583 break; 7584 default : 7585 ipf_lookup_iterderef(softc, token->ipt_type, data); 7586 break; 7587 } 7588 } 7589 7590 ipf_token_unlink(softc, token); 7591 KFREE(token); 7592 return 0; 7593 } 7594 7595 7596 /* ------------------------------------------------------------------------ */ 7597 /* Function: ipf_nextrule */ 7598 /* Returns: frentry_t * - NULL == no more rules, else pointer to next */ 7599 /* Parameters: softc(I) - pointer to soft context main structure */ 7600 /* fr(I) - pointer to filter rule */ 7601 /* out(I) - 1 == out rules, 0 == input rules */ 7602 /* */ 7603 /* Starting with "fr", find the next rule to visit. This includes visiting */ 7604 /* the list of rule groups if either fr is NULL (empty list) or it is the */ 7605 /* last rule in the list. When walking rule lists, it is either input or */ 7606 /* output rules that are returned, never both. */ 7607 /* ------------------------------------------------------------------------ */ 7608 static frentry_t * 7609 ipf_nextrule(ipf_main_softc_t *softc, int active, int unit, 7610 frentry_t *fr, int out) 7611 { 7612 frentry_t *next; 7613 frgroup_t *fg; 7614 7615 if (fr != NULL && fr->fr_group != -1) { 7616 fg = ipf_findgroup(softc, fr->fr_names + fr->fr_group, 7617 unit, active, NULL); 7618 if (fg != NULL) 7619 fg = fg->fg_next; 7620 } else { 7621 fg = softc->ipf_groups[unit][active]; 7622 } 7623 7624 while (fg != NULL) { 7625 next = fg->fg_start; 7626 while (next != NULL) { 7627 if (out) { 7628 if (next->fr_flags & FR_OUTQUE) 7629 return next; 7630 } else if (next->fr_flags & FR_INQUE) { 7631 return next; 7632 } 7633 next = next->fr_next; 7634 } 7635 if (next == NULL) 7636 fg = fg->fg_next; 7637 } 7638 7639 return NULL; 7640 } 7641 7642 /* ------------------------------------------------------------------------ */ 7643 /* Function: ipf_getnextrule */ 7644 /* Returns: int - 0 = success, else error */ 7645 /* Parameters: softc(I)- pointer to soft context main structure */ 7646 /* t(I) - pointer to destination information to resolve */ 7647 /* ptr(I) - pointer to ipfobj_t to copyin from user space */ 7648 /* */ 7649 /* This function's first job is to bring in the ipfruleiter_t structure via */ 7650 /* the ipfobj_t structure to determine what should be the next rule to */ 7651 /* return. Once the ipfruleiter_t has been brought in, it then tries to */ 7652 /* find the 'next rule'. This may include searching rule group lists or */ 7653 /* just be as simple as looking at the 'next' field in the rule structure. */ 7654 /* When we have found the rule to return, increase its reference count and */ 7655 /* if we used an existing rule to get here, decrease its reference count. */ 7656 /* ------------------------------------------------------------------------ */ 7657 int 7658 ipf_getnextrule(ipf_main_softc_t *softc, ipftoken_t *t, void *ptr) 7659 { 7660 frentry_t *fr, *next, zero; 7661 ipfruleiter_t it; 7662 int error, out; 7663 frgroup_t *fg; 7664 ipfobj_t obj; 7665 int predict; 7666 char *dst; 7667 int unit; 7668 7669 if (t == NULL || ptr == NULL) { 7670 IPFERROR(84); 7671 return EFAULT; 7672 } 7673 7674 error = ipf_inobj(softc, ptr, &obj, &it, IPFOBJ_IPFITER); 7675 if (error != 0) 7676 return error; 7677 7678 if ((it.iri_inout < 0) || (it.iri_inout > 3)) { 7679 IPFERROR(85); 7680 return EINVAL; 7681 } 7682 if ((it.iri_active != 0) && (it.iri_active != 1)) { 7683 IPFERROR(86); 7684 return EINVAL; 7685 } 7686 if (it.iri_nrules == 0) { 7687 IPFERROR(87); 7688 return ENOSPC; 7689 } 7690 if (it.iri_rule == NULL) { 7691 IPFERROR(88); 7692 return EFAULT; 7693 } 7694 7695 fg = NULL; 7696 fr = t->ipt_data; 7697 if ((it.iri_inout & F_OUT) != 0) 7698 out = 1; 7699 else 7700 out = 0; 7701 if ((it.iri_inout & F_ACIN) != 0) 7702 unit = IPL_LOGCOUNT; 7703 else 7704 unit = IPL_LOGIPF; 7705 7706 READ_ENTER(&softc->ipf_mutex); 7707 if (fr == NULL) { 7708 if (*it.iri_group == '\0') { 7709 if (unit == IPL_LOGCOUNT) { 7710 next = softc->ipf_acct[out][it.iri_active]; 7711 } else { 7712 next = softc->ipf_rules[out][it.iri_active]; 7713 } 7714 if (next == NULL) 7715 next = ipf_nextrule(softc, it.iri_active, 7716 unit, NULL, out); 7717 } else { 7718 fg = ipf_findgroup(softc, it.iri_group, unit, 7719 it.iri_active, NULL); 7720 if (fg != NULL) 7721 next = fg->fg_start; 7722 else 7723 next = NULL; 7724 } 7725 } else { 7726 next = fr->fr_next; 7727 if (next == NULL) 7728 next = ipf_nextrule(softc, it.iri_active, unit, 7729 fr, out); 7730 } 7731 7732 if (next != NULL && next->fr_next != NULL) 7733 predict = 1; 7734 else if (ipf_nextrule(softc, it.iri_active, unit, next, out) != NULL) 7735 predict = 1; 7736 else 7737 predict = 0; 7738 7739 if (fr != NULL) 7740 (void) ipf_derefrule(softc, &fr); 7741 7742 obj.ipfo_type = IPFOBJ_FRENTRY; 7743 dst = (char *)it.iri_rule; 7744 7745 if (next != NULL) { 7746 obj.ipfo_size = next->fr_size; 7747 MUTEX_ENTER(&next->fr_lock); 7748 next->fr_ref++; 7749 MUTEX_EXIT(&next->fr_lock); 7750 t->ipt_data = next; 7751 } else { 7752 obj.ipfo_size = sizeof(frentry_t); 7753 bzero(&zero, sizeof(zero)); 7754 next = &zero; 7755 t->ipt_data = NULL; 7756 } 7757 it.iri_rule = predict ? next : NULL; 7758 if (predict == 0) 7759 ipf_token_mark_complete(t); 7760 7761 RWLOCK_EXIT(&softc->ipf_mutex); 7762 7763 obj.ipfo_ptr = dst; 7764 error = ipf_outobjk(softc, &obj, next); 7765 if (error == 0 && t->ipt_data != NULL) { 7766 dst += obj.ipfo_size; 7767 if (next->fr_data != NULL) { 7768 ipfobj_t dobj; 7769 7770 if (next->fr_type == FR_T_IPFEXPR) 7771 dobj.ipfo_type = IPFOBJ_IPFEXPR; 7772 else 7773 dobj.ipfo_type = IPFOBJ_FRIPF; 7774 dobj.ipfo_size = next->fr_dsize; 7775 dobj.ipfo_rev = obj.ipfo_rev; 7776 dobj.ipfo_ptr = dst; 7777 error = ipf_outobjk(softc, &dobj, next->fr_data); 7778 } 7779 } 7780 7781 if ((fr != NULL) && (next == &zero)) 7782 (void) ipf_derefrule(softc, &fr); 7783 7784 return error; 7785 } 7786 7787 7788 /* ------------------------------------------------------------------------ */ 7789 /* Function: ipf_frruleiter */ 7790 /* Returns: int - 0 = success, else error */ 7791 /* Parameters: softc(I)- pointer to soft context main structure */ 7792 /* data(I) - the token type to match */ 7793 /* uid(I) - uid owning the token */ 7794 /* ptr(I) - context pointer for the token */ 7795 /* */ 7796 /* This function serves as a stepping stone between ipf_ipf_ioctl and */ 7797 /* ipf_getnextrule. It's role is to find the right token in the kernel for */ 7798 /* the process doing the ioctl and use that to ask for the next rule. */ 7799 /* ------------------------------------------------------------------------ */ 7800 static int 7801 ipf_frruleiter(ipf_main_softc_t *softc, void *data, int uid, void *ctx) 7802 { 7803 ipftoken_t *token; 7804 ipfruleiter_t it; 7805 ipfobj_t obj; 7806 int error; 7807 7808 token = ipf_token_find(softc, IPFGENITER_IPF, uid, ctx); 7809 if (token != NULL) { 7810 error = ipf_getnextrule(softc, token, data); 7811 WRITE_ENTER(&softc->ipf_tokens); 7812 ipf_token_deref(softc, token); 7813 RWLOCK_EXIT(&softc->ipf_tokens); 7814 } else { 7815 error = ipf_inobj(softc, data, &obj, &it, IPFOBJ_IPFITER); 7816 if (error != 0) 7817 return error; 7818 it.iri_rule = NULL; 7819 error = ipf_outobj(softc, data, &it, IPFOBJ_IPFITER); 7820 } 7821 7822 return error; 7823 } 7824 7825 7826 /* ------------------------------------------------------------------------ */ 7827 /* Function: ipf_geniter */ 7828 /* Returns: int - 0 = success, else error */ 7829 /* Parameters: softc(I) - pointer to soft context main structure */ 7830 /* token(I) - pointer to ipftoken_t structure */ 7831 /* itp(I) - pointer to iterator data */ 7832 /* */ 7833 /* Decide which iterator function to call using information passed through */ 7834 /* the ipfgeniter_t structure at itp. */ 7835 /* ------------------------------------------------------------------------ */ 7836 static int 7837 ipf_geniter(ipf_main_softc_t *softc, ipftoken_t *token, ipfgeniter_t *itp) 7838 { 7839 int error; 7840 7841 switch (itp->igi_type) 7842 { 7843 case IPFGENITER_FRAG : 7844 error = ipf_frag_pkt_next(softc, token, itp); 7845 break; 7846 default : 7847 IPFERROR(92); 7848 error = EINVAL; 7849 break; 7850 } 7851 7852 return error; 7853 } 7854 7855 7856 /* ------------------------------------------------------------------------ */ 7857 /* Function: ipf_genericiter */ 7858 /* Returns: int - 0 = success, else error */ 7859 /* Parameters: softc(I)- pointer to soft context main structure */ 7860 /* data(I) - the token type to match */ 7861 /* uid(I) - uid owning the token */ 7862 /* ptr(I) - context pointer for the token */ 7863 /* */ 7864 /* Handle the SIOCGENITER ioctl for the ipfilter device. The primary role */ 7865 /* ------------------------------------------------------------------------ */ 7866 int 7867 ipf_genericiter(ipf_main_softc_t *softc, void *data, int uid, void *ctx) 7868 { 7869 ipftoken_t *token; 7870 ipfgeniter_t iter; 7871 int error; 7872 7873 error = ipf_inobj(softc, data, NULL, &iter, IPFOBJ_GENITER); 7874 if (error != 0) 7875 return error; 7876 7877 token = ipf_token_find(softc, iter.igi_type, uid, ctx); 7878 if (token != NULL) { 7879 token->ipt_subtype = iter.igi_type; 7880 error = ipf_geniter(softc, token, &iter); 7881 WRITE_ENTER(&softc->ipf_tokens); 7882 ipf_token_deref(softc, token); 7883 RWLOCK_EXIT(&softc->ipf_tokens); 7884 } else { 7885 IPFERROR(93); 7886 error = 0; 7887 } 7888 7889 return error; 7890 } 7891 7892 7893 /* ------------------------------------------------------------------------ */ 7894 /* Function: ipf_ipf_ioctl */ 7895 /* Returns: int - 0 = success, else error */ 7896 /* Parameters: softc(I)- pointer to soft context main structure */ 7897 /* data(I) - the token type to match */ 7898 /* cmd(I) - the ioctl command number */ 7899 /* mode(I) - mode flags for the ioctl */ 7900 /* uid(I) - uid owning the token */ 7901 /* ptr(I) - context pointer for the token */ 7902 /* */ 7903 /* This function handles all of the ioctl command that are actually isssued */ 7904 /* to the /dev/ipl device. */ 7905 /* ------------------------------------------------------------------------ */ 7906 int 7907 ipf_ipf_ioctl(ipf_main_softc_t *softc, void *data, ioctlcmd_t cmd, int mode, 7908 int uid, void *ctx) 7909 { 7910 friostat_t fio; 7911 int error, tmp; 7912 ipfobj_t obj; 7913 SPL_INT(s); 7914 7915 switch (cmd) 7916 { 7917 case SIOCFRENB : 7918 if (!(mode & FWRITE)) { 7919 IPFERROR(94); 7920 error = EPERM; 7921 } else { 7922 error = BCOPYIN(data, &tmp, sizeof(tmp)); 7923 if (error != 0) { 7924 IPFERROR(95); 7925 error = EFAULT; 7926 break; 7927 } 7928 7929 WRITE_ENTER(&softc->ipf_global); 7930 if (tmp) { 7931 if (softc->ipf_running > 0) 7932 error = 0; 7933 else 7934 error = ipfattach(softc); 7935 if (error == 0) 7936 softc->ipf_running = 1; 7937 else 7938 (void) ipfdetach(softc); 7939 } else { 7940 if (softc->ipf_running == 1) 7941 error = ipfdetach(softc); 7942 else 7943 error = 0; 7944 if (error == 0) 7945 softc->ipf_running = -1; 7946 } 7947 RWLOCK_EXIT(&softc->ipf_global); 7948 } 7949 break; 7950 7951 case SIOCIPFSET : 7952 if (!(mode & FWRITE)) { 7953 IPFERROR(96); 7954 error = EPERM; 7955 break; 7956 } 7957 /* FALLTHRU */ 7958 case SIOCIPFGETNEXT : 7959 case SIOCIPFGET : 7960 error = ipf_ipftune(softc, cmd, (void *)data); 7961 break; 7962 7963 case SIOCSETFF : 7964 if (!(mode & FWRITE)) { 7965 IPFERROR(97); 7966 error = EPERM; 7967 } else { 7968 error = BCOPYIN(data, &softc->ipf_flags, 7969 sizeof(softc->ipf_flags)); 7970 if (error != 0) { 7971 IPFERROR(98); 7972 error = EFAULT; 7973 } 7974 } 7975 break; 7976 7977 case SIOCGETFF : 7978 error = BCOPYOUT(&softc->ipf_flags, data, 7979 sizeof(softc->ipf_flags)); 7980 if (error != 0) { 7981 IPFERROR(99); 7982 error = EFAULT; 7983 } 7984 break; 7985 7986 case SIOCFUNCL : 7987 error = ipf_resolvefunc(softc, (void *)data); 7988 break; 7989 7990 case SIOCINAFR : 7991 case SIOCRMAFR : 7992 case SIOCADAFR : 7993 case SIOCZRLST : 7994 if (!(mode & FWRITE)) { 7995 IPFERROR(100); 7996 error = EPERM; 7997 } else { 7998 error = frrequest(softc, IPL_LOGIPF, cmd, data, 7999 softc->ipf_active, 1); 8000 } 8001 break; 8002 8003 case SIOCINIFR : 8004 case SIOCRMIFR : 8005 case SIOCADIFR : 8006 if (!(mode & FWRITE)) { 8007 IPFERROR(101); 8008 error = EPERM; 8009 } else { 8010 error = frrequest(softc, IPL_LOGIPF, cmd, data, 8011 1 - softc->ipf_active, 1); 8012 } 8013 break; 8014 8015 case SIOCSWAPA : 8016 if (!(mode & FWRITE)) { 8017 IPFERROR(102); 8018 error = EPERM; 8019 } else { 8020 WRITE_ENTER(&softc->ipf_mutex); 8021 error = BCOPYOUT(&softc->ipf_active, data, 8022 sizeof(softc->ipf_active)); 8023 if (error != 0) { 8024 IPFERROR(103); 8025 error = EFAULT; 8026 } else { 8027 softc->ipf_active = 1 - softc->ipf_active; 8028 } 8029 RWLOCK_EXIT(&softc->ipf_mutex); 8030 } 8031 break; 8032 8033 case SIOCGETFS : 8034 error = ipf_inobj(softc, (void *)data, &obj, &fio, 8035 IPFOBJ_IPFSTAT); 8036 if (error != 0) 8037 break; 8038 ipf_getstat(softc, &fio, obj.ipfo_rev); 8039 error = ipf_outobj(softc, (void *)data, &fio, IPFOBJ_IPFSTAT); 8040 break; 8041 8042 case SIOCFRZST : 8043 if (!(mode & FWRITE)) { 8044 IPFERROR(104); 8045 error = EPERM; 8046 } else 8047 error = ipf_zerostats(softc, data); 8048 break; 8049 8050 case SIOCIPFFL : 8051 if (!(mode & FWRITE)) { 8052 IPFERROR(105); 8053 error = EPERM; 8054 } else { 8055 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8056 if (!error) { 8057 tmp = ipf_flush(softc, IPL_LOGIPF, tmp); 8058 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8059 if (error != 0) { 8060 IPFERROR(106); 8061 error = EFAULT; 8062 } 8063 } else { 8064 IPFERROR(107); 8065 error = EFAULT; 8066 } 8067 } 8068 break; 8069 8070 #ifdef USE_INET6 8071 case SIOCIPFL6 : 8072 if (!(mode & FWRITE)) { 8073 IPFERROR(108); 8074 error = EPERM; 8075 } else { 8076 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8077 if (!error) { 8078 tmp = ipf_flush(softc, IPL_LOGIPF, tmp); 8079 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8080 if (error != 0) { 8081 IPFERROR(109); 8082 error = EFAULT; 8083 } 8084 } else { 8085 IPFERROR(110); 8086 error = EFAULT; 8087 } 8088 } 8089 break; 8090 #endif 8091 8092 case SIOCSTLCK : 8093 if (!(mode & FWRITE)) { 8094 IPFERROR(122); 8095 error = EPERM; 8096 } else { 8097 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8098 if (error == 0) { 8099 ipf_state_setlock(softc->ipf_state_soft, tmp); 8100 ipf_nat_setlock(softc->ipf_nat_soft, tmp); 8101 ipf_frag_setlock(softc->ipf_frag_soft, tmp); 8102 ipf_auth_setlock(softc->ipf_auth_soft, tmp); 8103 } else { 8104 IPFERROR(111); 8105 error = EFAULT; 8106 } 8107 } 8108 break; 8109 8110 #ifdef IPFILTER_LOG 8111 case SIOCIPFFB : 8112 if (!(mode & FWRITE)) { 8113 IPFERROR(112); 8114 error = EPERM; 8115 } else { 8116 tmp = ipf_log_clear(softc, IPL_LOGIPF); 8117 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8118 if (error) { 8119 IPFERROR(113); 8120 error = EFAULT; 8121 } 8122 } 8123 break; 8124 #endif /* IPFILTER_LOG */ 8125 8126 case SIOCFRSYN : 8127 if (!(mode & FWRITE)) { 8128 IPFERROR(114); 8129 error = EPERM; 8130 } else { 8131 WRITE_ENTER(&softc->ipf_global); 8132 #if (defined(MENTAT) && defined(_KERNEL)) && !defined(INSTANCES) 8133 error = ipfsync(); 8134 #else 8135 ipf_sync(softc, NULL); 8136 error = 0; 8137 #endif 8138 RWLOCK_EXIT(&softc->ipf_global); 8139 8140 } 8141 break; 8142 8143 case SIOCGFRST : 8144 error = ipf_outobj(softc, (void *)data, 8145 ipf_frag_stats(softc->ipf_frag_soft), 8146 IPFOBJ_FRAGSTAT); 8147 break; 8148 8149 #ifdef IPFILTER_LOG 8150 case FIONREAD : 8151 tmp = ipf_log_bytesused(softc, IPL_LOGIPF); 8152 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 8153 break; 8154 #endif 8155 8156 case SIOCIPFITER : 8157 SPL_SCHED(s); 8158 error = ipf_frruleiter(softc, data, uid, ctx); 8159 SPL_X(s); 8160 break; 8161 8162 case SIOCGENITER : 8163 SPL_SCHED(s); 8164 error = ipf_genericiter(softc, data, uid, ctx); 8165 SPL_X(s); 8166 break; 8167 8168 case SIOCIPFDELTOK : 8169 error = BCOPYIN(data, &tmp, sizeof(tmp)); 8170 if (error == 0) { 8171 SPL_SCHED(s); 8172 error = ipf_token_del(softc, tmp, uid, ctx); 8173 SPL_X(s); 8174 } 8175 break; 8176 8177 default : 8178 IPFERROR(115); 8179 error = EINVAL; 8180 break; 8181 } 8182 8183 return error; 8184 } 8185 8186 8187 /* ------------------------------------------------------------------------ */ 8188 /* Function: ipf_decaps */ 8189 /* Returns: int - -1 == decapsulation failed, else bit mask of */ 8190 /* flags indicating packet filtering decision. */ 8191 /* Parameters: fin(I) - pointer to packet information */ 8192 /* pass(I) - IP protocol version to match */ 8193 /* l5proto(I) - layer 5 protocol to decode UDP data as. */ 8194 /* */ 8195 /* This function is called for packets that are wrapt up in other packets, */ 8196 /* for example, an IP packet that is the entire data segment for another IP */ 8197 /* packet. If the basic constraints for this are satisfied, change the */ 8198 /* buffer to point to the start of the inner packet and start processing */ 8199 /* rules belonging to the head group this rule specifies. */ 8200 /* ------------------------------------------------------------------------ */ 8201 u_32_t 8202 ipf_decaps(fr_info_t *fin, u_32_t pass, int l5proto) 8203 { 8204 fr_info_t fin2, *fino = NULL; 8205 int elen, hlen, nh; 8206 grehdr_t gre; 8207 ip_t *ip; 8208 mb_t *m; 8209 8210 if ((fin->fin_flx & FI_COALESCE) == 0) 8211 if (ipf_coalesce(fin) == -1) 8212 goto cantdecaps; 8213 8214 m = fin->fin_m; 8215 hlen = fin->fin_hlen; 8216 8217 switch (fin->fin_p) 8218 { 8219 case IPPROTO_UDP : 8220 /* 8221 * In this case, the specific protocol being decapsulated 8222 * inside UDP frames comes from the rule. 8223 */ 8224 nh = fin->fin_fr->fr_icode; 8225 break; 8226 8227 case IPPROTO_GRE : /* 47 */ 8228 bcopy(fin->fin_dp, (char *)&gre, sizeof(gre)); 8229 hlen += sizeof(grehdr_t); 8230 if (gre.gr_R|gre.gr_s) 8231 goto cantdecaps; 8232 if (gre.gr_C) 8233 hlen += 4; 8234 if (gre.gr_K) 8235 hlen += 4; 8236 if (gre.gr_S) 8237 hlen += 4; 8238 8239 nh = IPPROTO_IP; 8240 8241 /* 8242 * If the routing options flag is set, validate that it is 8243 * there and bounce over it. 8244 */ 8245 #if 0 8246 /* This is really heavy weight and lots of room for error, */ 8247 /* so for now, put it off and get the simple stuff right. */ 8248 if (gre.gr_R) { 8249 u_char off, len, *s; 8250 u_short af; 8251 int end; 8252 8253 end = 0; 8254 s = fin->fin_dp; 8255 s += hlen; 8256 aplen = fin->fin_plen - hlen; 8257 while (aplen > 3) { 8258 af = (s[0] << 8) | s[1]; 8259 off = s[2]; 8260 len = s[3]; 8261 aplen -= 4; 8262 s += 4; 8263 if (af == 0 && len == 0) { 8264 end = 1; 8265 break; 8266 } 8267 if (aplen < len) 8268 break; 8269 s += len; 8270 aplen -= len; 8271 } 8272 if (end != 1) 8273 goto cantdecaps; 8274 hlen = s - (u_char *)fin->fin_dp; 8275 } 8276 #endif 8277 break; 8278 8279 #ifdef IPPROTO_IPIP 8280 case IPPROTO_IPIP : /* 4 */ 8281 #endif 8282 nh = IPPROTO_IP; 8283 break; 8284 8285 default : /* Includes ESP, AH is special for IPv4 */ 8286 goto cantdecaps; 8287 } 8288 8289 switch (nh) 8290 { 8291 case IPPROTO_IP : 8292 case IPPROTO_IPV6 : 8293 break; 8294 default : 8295 goto cantdecaps; 8296 } 8297 8298 bcopy((char *)fin, (char *)&fin2, sizeof(fin2)); 8299 fino = fin; 8300 fin = &fin2; 8301 elen = hlen; 8302 #if defined(MENTAT) && defined(_KERNEL) 8303 m->b_rptr += elen; 8304 #else 8305 m->m_data += elen; 8306 m->m_len -= elen; 8307 #endif 8308 fin->fin_plen -= elen; 8309 8310 ip = (ip_t *)((char *)fin->fin_ip + elen); 8311 8312 /* 8313 * Make sure we have at least enough data for the network layer 8314 * header. 8315 */ 8316 if (IP_V(ip) == 4) 8317 hlen = IP_HL(ip) << 2; 8318 #ifdef USE_INET6 8319 else if (IP_V(ip) == 6) 8320 hlen = sizeof(ip6_t); 8321 #endif 8322 else 8323 goto cantdecaps2; 8324 8325 if (fin->fin_plen < hlen) 8326 goto cantdecaps2; 8327 8328 fin->fin_dp = (char *)ip + hlen; 8329 8330 if (IP_V(ip) == 4) { 8331 /* 8332 * Perform IPv4 header checksum validation. 8333 */ 8334 if (ipf_cksum((u_short *)ip, hlen)) 8335 goto cantdecaps2; 8336 } 8337 8338 if (ipf_makefrip(hlen, ip, fin) == -1) { 8339 cantdecaps2: 8340 if (m != NULL) { 8341 #if defined(MENTAT) && defined(_KERNEL) 8342 m->b_rptr -= elen; 8343 #else 8344 m->m_data -= elen; 8345 m->m_len += elen; 8346 #endif 8347 } 8348 cantdecaps: 8349 DT1(frb_decapfrip, fr_info_t *, fin); 8350 pass &= ~FR_CMDMASK; 8351 pass |= FR_BLOCK|FR_QUICK; 8352 fin->fin_reason = FRB_DECAPFRIP; 8353 return -1; 8354 } 8355 8356 pass = ipf_scanlist(fin, pass); 8357 8358 /* 8359 * Copy the packet filter "result" fields out of the fr_info_t struct 8360 * that is local to the decapsulation processing and back into the 8361 * one we were called with. 8362 */ 8363 fino->fin_flx = fin->fin_flx; 8364 fino->fin_rev = fin->fin_rev; 8365 fino->fin_icode = fin->fin_icode; 8366 fino->fin_rule = fin->fin_rule; 8367 (void) strncpy(fino->fin_group, fin->fin_group, FR_GROUPLEN); 8368 fino->fin_fr = fin->fin_fr; 8369 fino->fin_error = fin->fin_error; 8370 fino->fin_mp = fin->fin_mp; 8371 fino->fin_m = fin->fin_m; 8372 m = fin->fin_m; 8373 if (m != NULL) { 8374 #if defined(MENTAT) && defined(_KERNEL) 8375 m->b_rptr -= elen; 8376 #else 8377 m->m_data -= elen; 8378 m->m_len += elen; 8379 #endif 8380 } 8381 return pass; 8382 } 8383 8384 8385 /* ------------------------------------------------------------------------ */ 8386 /* Function: ipf_matcharray_load */ 8387 /* Returns: int - 0 = success, else error */ 8388 /* Parameters: softc(I) - pointer to soft context main structure */ 8389 /* data(I) - pointer to ioctl data */ 8390 /* objp(I) - ipfobj_t structure to load data into */ 8391 /* arrayptr(I) - pointer to location to store array pointer */ 8392 /* */ 8393 /* This function loads in a mathing array through the ipfobj_t struct that */ 8394 /* describes it. Sanity checking and array size limitations are enforced */ 8395 /* in this function to prevent userspace from trying to load in something */ 8396 /* that is insanely big. Once the size of the array is known, the memory */ 8397 /* required is malloc'd and returned through changing *arrayptr. The */ 8398 /* contents of the array are verified before returning. Only in the event */ 8399 /* of a successful call is the caller required to free up the malloc area. */ 8400 /* ------------------------------------------------------------------------ */ 8401 int 8402 ipf_matcharray_load(ipf_main_softc_t *softc, void *data, ipfobj_t *objp, 8403 int **arrayptr) 8404 { 8405 int arraysize, *array, error; 8406 8407 *arrayptr = NULL; 8408 8409 error = BCOPYIN(data, objp, sizeof(*objp)); 8410 if (error != 0) { 8411 IPFERROR(116); 8412 return EFAULT; 8413 } 8414 8415 if (objp->ipfo_type != IPFOBJ_IPFEXPR) { 8416 IPFERROR(117); 8417 return EINVAL; 8418 } 8419 8420 if (((objp->ipfo_size & 3) != 0) || (objp->ipfo_size == 0) || 8421 (objp->ipfo_size > 1024)) { 8422 IPFERROR(118); 8423 return EINVAL; 8424 } 8425 8426 arraysize = objp->ipfo_size * sizeof(*array); 8427 KMALLOCS(array, int *, arraysize); 8428 if (array == NULL) { 8429 IPFERROR(119); 8430 return ENOMEM; 8431 } 8432 8433 error = COPYIN(objp->ipfo_ptr, array, arraysize); 8434 if (error != 0) { 8435 KFREES(array, arraysize); 8436 IPFERROR(120); 8437 return EFAULT; 8438 } 8439 8440 if (ipf_matcharray_verify(array, arraysize) != 0) { 8441 KFREES(array, arraysize); 8442 IPFERROR(121); 8443 return EINVAL; 8444 } 8445 8446 *arrayptr = array; 8447 return 0; 8448 } 8449 8450 8451 /* ------------------------------------------------------------------------ */ 8452 /* Function: ipf_matcharray_verify */ 8453 /* Returns: Nil */ 8454 /* Parameters: array(I) - pointer to matching array */ 8455 /* arraysize(I) - number of elements in the array */ 8456 /* */ 8457 /* Verify the contents of a matching array by stepping through each element */ 8458 /* in it. The actual commands in the array are not verified for */ 8459 /* correctness, only that all of the sizes are correctly within limits. */ 8460 /* ------------------------------------------------------------------------ */ 8461 int 8462 ipf_matcharray_verify(int *array, int arraysize) 8463 { 8464 int i, nelem, maxidx; 8465 ipfexp_t *e; 8466 8467 nelem = arraysize / sizeof(*array); 8468 8469 /* 8470 * Currently, it makes no sense to have an array less than 6 8471 * elements long - the initial size at the from, a single operation 8472 * (minimum 4 in length) and a trailer, for a total of 6. 8473 */ 8474 if ((array[0] < 6) || (arraysize < 24) || (arraysize > 4096)) { 8475 return -1; 8476 } 8477 8478 /* 8479 * Verify the size of data pointed to by array with how long 8480 * the array claims to be itself. 8481 */ 8482 if (array[0] * sizeof(*array) != arraysize) { 8483 return -1; 8484 } 8485 8486 maxidx = nelem - 1; 8487 /* 8488 * The last opcode in this array should be an IPF_EXP_END. 8489 */ 8490 if (array[maxidx] != IPF_EXP_END) { 8491 return -1; 8492 } 8493 8494 for (i = 1; i < maxidx; ) { 8495 e = (ipfexp_t *)(array + i); 8496 8497 /* 8498 * The length of the bits to check must be at least 1 8499 * (or else there is nothing to comapre with!) and it 8500 * cannot exceed the length of the data present. 8501 */ 8502 if ((e->ipfe_size < 1 ) || 8503 (e->ipfe_size + i > maxidx)) { 8504 return -1; 8505 } 8506 i += e->ipfe_size; 8507 } 8508 return 0; 8509 } 8510 8511 8512 /* ------------------------------------------------------------------------ */ 8513 /* Function: ipf_fr_matcharray */ 8514 /* Returns: int - 0 = match failed, else positive match */ 8515 /* Parameters: fin(I) - pointer to packet information */ 8516 /* array(I) - pointer to matching array */ 8517 /* */ 8518 /* This function is used to apply a matching array against a packet and */ 8519 /* return an indication of whether or not the packet successfully matches */ 8520 /* all of the commands in it. */ 8521 /* ------------------------------------------------------------------------ */ 8522 static int 8523 ipf_fr_matcharray(fr_info_t *fin, int *array) 8524 { 8525 int i, n, *x, rv, p; 8526 ipfexp_t *e; 8527 8528 rv = 0; 8529 n = array[0]; 8530 x = array + 1; 8531 8532 for (; n > 0; x += 3 + x[3], rv = 0) { 8533 e = (ipfexp_t *)x; 8534 if (e->ipfe_cmd == IPF_EXP_END) 8535 break; 8536 n -= e->ipfe_size; 8537 8538 /* 8539 * The upper 16 bits currently store the protocol value. 8540 * This is currently used with TCP and UDP port compares and 8541 * allows "tcp.port = 80" without requiring an explicit 8542 " "ip.pr = tcp" first. 8543 */ 8544 p = e->ipfe_cmd >> 16; 8545 if ((p != 0) && (p != fin->fin_p)) 8546 break; 8547 8548 switch (e->ipfe_cmd) 8549 { 8550 case IPF_EXP_IP_PR : 8551 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8552 rv |= (fin->fin_p == e->ipfe_arg0[i]); 8553 } 8554 break; 8555 8556 case IPF_EXP_IP_SRCADDR : 8557 if (fin->fin_v != 4) 8558 break; 8559 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8560 rv |= ((fin->fin_saddr & 8561 e->ipfe_arg0[i * 2 + 1]) == 8562 e->ipfe_arg0[i * 2]); 8563 } 8564 break; 8565 8566 case IPF_EXP_IP_DSTADDR : 8567 if (fin->fin_v != 4) 8568 break; 8569 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8570 rv |= ((fin->fin_daddr & 8571 e->ipfe_arg0[i * 2 + 1]) == 8572 e->ipfe_arg0[i * 2]); 8573 } 8574 break; 8575 8576 case IPF_EXP_IP_ADDR : 8577 if (fin->fin_v != 4) 8578 break; 8579 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8580 rv |= ((fin->fin_saddr & 8581 e->ipfe_arg0[i * 2 + 1]) == 8582 e->ipfe_arg0[i * 2]) || 8583 ((fin->fin_daddr & 8584 e->ipfe_arg0[i * 2 + 1]) == 8585 e->ipfe_arg0[i * 2]); 8586 } 8587 break; 8588 8589 #ifdef USE_INET6 8590 case IPF_EXP_IP6_SRCADDR : 8591 if (fin->fin_v != 6) 8592 break; 8593 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8594 rv |= IP6_MASKEQ(&fin->fin_src6, 8595 &e->ipfe_arg0[i * 8 + 4], 8596 &e->ipfe_arg0[i * 8]); 8597 } 8598 break; 8599 8600 case IPF_EXP_IP6_DSTADDR : 8601 if (fin->fin_v != 6) 8602 break; 8603 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8604 rv |= IP6_MASKEQ(&fin->fin_dst6, 8605 &e->ipfe_arg0[i * 8 + 4], 8606 &e->ipfe_arg0[i * 8]); 8607 } 8608 break; 8609 8610 case IPF_EXP_IP6_ADDR : 8611 if (fin->fin_v != 6) 8612 break; 8613 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8614 rv |= IP6_MASKEQ(&fin->fin_src6, 8615 &e->ipfe_arg0[i * 8 + 4], 8616 &e->ipfe_arg0[i * 8]) || 8617 IP6_MASKEQ(&fin->fin_dst6, 8618 &e->ipfe_arg0[i * 8 + 4], 8619 &e->ipfe_arg0[i * 8]); 8620 } 8621 break; 8622 #endif 8623 8624 case IPF_EXP_UDP_PORT : 8625 case IPF_EXP_TCP_PORT : 8626 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8627 rv |= (fin->fin_sport == e->ipfe_arg0[i]) || 8628 (fin->fin_dport == e->ipfe_arg0[i]); 8629 } 8630 break; 8631 8632 case IPF_EXP_UDP_SPORT : 8633 case IPF_EXP_TCP_SPORT : 8634 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8635 rv |= (fin->fin_sport == e->ipfe_arg0[i]); 8636 } 8637 break; 8638 8639 case IPF_EXP_UDP_DPORT : 8640 case IPF_EXP_TCP_DPORT : 8641 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8642 rv |= (fin->fin_dport == e->ipfe_arg0[i]); 8643 } 8644 break; 8645 8646 case IPF_EXP_TCP_FLAGS : 8647 for (i = 0; !rv && i < e->ipfe_narg; i++) { 8648 rv |= ((fin->fin_tcpf & 8649 e->ipfe_arg0[i * 2 + 1]) == 8650 e->ipfe_arg0[i * 2]); 8651 } 8652 break; 8653 } 8654 rv ^= e->ipfe_not; 8655 8656 if (rv == 0) 8657 break; 8658 } 8659 8660 return rv; 8661 } 8662 8663 8664 /* ------------------------------------------------------------------------ */ 8665 /* Function: ipf_queueflush */ 8666 /* Returns: int - number of entries flushed (0 = none) */ 8667 /* Parameters: softc(I) - pointer to soft context main structure */ 8668 /* deletefn(I) - function to call to delete entry */ 8669 /* ipfqs(I) - top of the list of ipf internal queues */ 8670 /* userqs(I) - top of the list of user defined timeouts */ 8671 /* */ 8672 /* This fucntion gets called when the state/NAT hash tables fill up and we */ 8673 /* need to try a bit harder to free up some space. The algorithm used here */ 8674 /* split into two parts but both halves have the same goal: to reduce the */ 8675 /* number of connections considered to be "active" to the low watermark. */ 8676 /* There are two steps in doing this: */ 8677 /* 1) Remove any TCP connections that are already considered to be "closed" */ 8678 /* but have not yet been removed from the state table. The two states */ 8679 /* TCPS_TIME_WAIT and TCPS_CLOSED are considered to be the perfect */ 8680 /* candidates for this style of removal. If freeing up entries in */ 8681 /* CLOSED or both CLOSED and TIME_WAIT brings us to the low watermark, */ 8682 /* we do not go on to step 2. */ 8683 /* */ 8684 /* 2) Look for the oldest entries on each timeout queue and free them if */ 8685 /* they are within the given window we are considering. Where the */ 8686 /* window starts and the steps taken to increase its size depend upon */ 8687 /* how long ipf has been running (ipf_ticks.) Anything modified in the */ 8688 /* last 30 seconds is not touched. */ 8689 /* touched */ 8690 /* die ipf_ticks 30*1.5 1800*1.5 | 43200*1.5 */ 8691 /* | | | | | | */ 8692 /* future <--+----------+--------+-----------+-----+-----+-----------> past */ 8693 /* now \_int=30s_/ \_int=1hr_/ \_int=12hr */ 8694 /* */ 8695 /* Points to note: */ 8696 /* - tqe_die is the time, in the future, when entries die. */ 8697 /* - tqe_die - ipf_ticks is how long left the connection has to live in ipf */ 8698 /* ticks. */ 8699 /* - tqe_touched is when the entry was last used by NAT/state */ 8700 /* - the closer tqe_touched is to ipf_ticks, the further tqe_die will be */ 8701 /* ipf_ticks any given timeout queue and vice versa. */ 8702 /* - both tqe_die and tqe_touched increase over time */ 8703 /* - timeout queues are sorted with the highest value of tqe_die at the */ 8704 /* bottom and therefore the smallest values of each are at the top */ 8705 /* - the pointer passed in as ipfqs should point to an array of timeout */ 8706 /* queues representing each of the TCP states */ 8707 /* */ 8708 /* We start by setting up a maximum range to scan for things to move of */ 8709 /* iend (newest) to istart (oldest) in chunks of "interval". If nothing is */ 8710 /* found in that range, "interval" is adjusted (so long as it isn't 30) and */ 8711 /* we start again with a new value for "iend" and "istart". This is */ 8712 /* continued until we either finish the scan of 30 second intervals or the */ 8713 /* low water mark is reached. */ 8714 /* ------------------------------------------------------------------------ */ 8715 int 8716 ipf_queueflush(ipf_main_softc_t *softc, ipftq_delete_fn_t deletefn, 8717 ipftq_t *ipfqs, ipftq_t *userqs, u_int *activep, int size, int low) 8718 { 8719 u_long interval, istart, iend; 8720 ipftq_t *ifq, *ifqnext; 8721 ipftqent_t *tqe, *tqn; 8722 int removed = 0; 8723 8724 for (tqn = ipfqs[IPF_TCPS_CLOSED].ifq_head; ((tqe = tqn) != NULL); ) { 8725 tqn = tqe->tqe_next; 8726 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 8727 removed++; 8728 } 8729 if ((*activep * 100 / size) > low) { 8730 for (tqn = ipfqs[IPF_TCPS_TIME_WAIT].ifq_head; 8731 ((tqe = tqn) != NULL); ) { 8732 tqn = tqe->tqe_next; 8733 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 8734 removed++; 8735 } 8736 } 8737 8738 if ((*activep * 100 / size) <= low) { 8739 return removed; 8740 } 8741 8742 /* 8743 * NOTE: Use of "* 15 / 10" is required here because if "* 1.5" is 8744 * used then the operations are upgraded to floating point 8745 * and kernels don't like floating point... 8746 */ 8747 if (softc->ipf_ticks > IPF_TTLVAL(43200 * 15 / 10)) { 8748 istart = IPF_TTLVAL(86400 * 4); 8749 interval = IPF_TTLVAL(43200); 8750 } else if (softc->ipf_ticks > IPF_TTLVAL(1800 * 15 / 10)) { 8751 istart = IPF_TTLVAL(43200); 8752 interval = IPF_TTLVAL(1800); 8753 } else if (softc->ipf_ticks > IPF_TTLVAL(30 * 15 / 10)) { 8754 istart = IPF_TTLVAL(1800); 8755 interval = IPF_TTLVAL(30); 8756 } else { 8757 return 0; 8758 } 8759 if (istart > softc->ipf_ticks) { 8760 if (softc->ipf_ticks - interval < interval) 8761 istart = interval; 8762 else 8763 istart = (softc->ipf_ticks / interval) * interval; 8764 } 8765 8766 iend = softc->ipf_ticks - interval; 8767 8768 while ((*activep * 100 / size) > low) { 8769 u_long try; 8770 8771 try = softc->ipf_ticks - istart; 8772 8773 for (ifq = ipfqs; ifq != NULL; ifq = ifq->ifq_next) { 8774 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 8775 if (try < tqe->tqe_touched) 8776 break; 8777 tqn = tqe->tqe_next; 8778 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 8779 removed++; 8780 } 8781 } 8782 8783 for (ifq = userqs; ifq != NULL; ifq = ifqnext) { 8784 ifqnext = ifq->ifq_next; 8785 8786 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 8787 if (try < tqe->tqe_touched) 8788 break; 8789 tqn = tqe->tqe_next; 8790 if ((*deletefn)(softc, tqe->tqe_parent) == 0) 8791 removed++; 8792 } 8793 } 8794 8795 if (try >= iend) { 8796 if (interval == IPF_TTLVAL(43200)) { 8797 interval = IPF_TTLVAL(1800); 8798 } else if (interval == IPF_TTLVAL(1800)) { 8799 interval = IPF_TTLVAL(30); 8800 } else { 8801 break; 8802 } 8803 if (interval >= softc->ipf_ticks) 8804 break; 8805 8806 iend = softc->ipf_ticks - interval; 8807 } 8808 istart -= interval; 8809 } 8810 8811 return removed; 8812 } 8813 8814 8815 /* ------------------------------------------------------------------------ */ 8816 /* Function: ipf_deliverlocal */ 8817 /* Returns: int - 1 = local address, 0 = non-local address */ 8818 /* Parameters: softc(I) - pointer to soft context main structure */ 8819 /* ipversion(I) - IP protocol version (4 or 6) */ 8820 /* ifp(I) - network interface pointer */ 8821 /* ipaddr(I) - IPv4/6 destination address */ 8822 /* */ 8823 /* This fucntion is used to determine in the address "ipaddr" belongs to */ 8824 /* the network interface represented by ifp. */ 8825 /* ------------------------------------------------------------------------ */ 8826 int 8827 ipf_deliverlocal(ipf_main_softc_t *softc, int ipversion, void *ifp, 8828 i6addr_t *ipaddr) 8829 { 8830 i6addr_t addr; 8831 int islocal = 0; 8832 8833 if (ipversion == 4) { 8834 if (ipf_ifpaddr(softc, 4, FRI_NORMAL, ifp, &addr, NULL) == 0) { 8835 if (addr.in4.s_addr == ipaddr->in4.s_addr) 8836 islocal = 1; 8837 } 8838 8839 #ifdef USE_INET6 8840 } else if (ipversion == 6) { 8841 if (ipf_ifpaddr(softc, 6, FRI_NORMAL, ifp, &addr, NULL) == 0) { 8842 if (IP6_EQ(&addr, ipaddr)) 8843 islocal = 1; 8844 } 8845 #endif 8846 } 8847 8848 return islocal; 8849 } 8850 8851 8852 /* ------------------------------------------------------------------------ */ 8853 /* Function: ipf_settimeout */ 8854 /* Returns: int - 0 = success, -1 = failure */ 8855 /* Parameters: softc(I) - pointer to soft context main structure */ 8856 /* t(I) - pointer to tuneable array entry */ 8857 /* p(I) - pointer to values passed in to apply */ 8858 /* */ 8859 /* This function is called to set the timeout values for each distinct */ 8860 /* queue timeout that is available. When called, it calls into both the */ 8861 /* state and NAT code, telling them to update their timeout queues. */ 8862 /* ------------------------------------------------------------------------ */ 8863 static int 8864 ipf_settimeout(struct ipf_main_softc_s *softc, ipftuneable_t *t, 8865 ipftuneval_t *p) 8866 { 8867 8868 /* 8869 * ipf_interror should be set by the functions called here, not 8870 * by this function - it's just a middle man. 8871 */ 8872 if (ipf_state_settimeout(softc, t, p) == -1) 8873 return -1; 8874 if (ipf_nat_settimeout(softc, t, p) == -1) 8875 return -1; 8876 return 0; 8877 } 8878 8879 8880 /* ------------------------------------------------------------------------ */ 8881 /* Function: ipf_apply_timeout */ 8882 /* Returns: int - 0 = success, -1 = failure */ 8883 /* Parameters: head(I) - pointer to tuneable array entry */ 8884 /* seconds(I) - pointer to values passed in to apply */ 8885 /* */ 8886 /* This function applies a timeout of "seconds" to the timeout queue that */ 8887 /* is pointed to by "head". All entries on this list have an expiration */ 8888 /* set to be the current tick value of ipf plus the ttl. Given that this */ 8889 /* function should only be called when the delta is non-zero, the task is */ 8890 /* to walk the entire list and apply the change. The sort order will not */ 8891 /* change. The only catch is that this is O(n) across the list, so if the */ 8892 /* queue has lots of entries (10s of thousands or 100s of thousands), it */ 8893 /* could take a relatively long time to work through them all. */ 8894 /* ------------------------------------------------------------------------ */ 8895 void 8896 ipf_apply_timeout(ipftq_t *head, u_int seconds) 8897 { 8898 u_int oldtimeout, newtimeout; 8899 ipftqent_t *tqe; 8900 int delta; 8901 8902 MUTEX_ENTER(&head->ifq_lock); 8903 oldtimeout = head->ifq_ttl; 8904 newtimeout = IPF_TTLVAL(seconds); 8905 delta = oldtimeout - newtimeout; 8906 8907 head->ifq_ttl = newtimeout; 8908 8909 for (tqe = head->ifq_head; tqe != NULL; tqe = tqe->tqe_next) { 8910 tqe->tqe_die += delta; 8911 } 8912 MUTEX_EXIT(&head->ifq_lock); 8913 } 8914 8915 8916 /* ------------------------------------------------------------------------ */ 8917 /* Function: ipf_settimeout_tcp */ 8918 /* Returns: int - 0 = successfully applied, -1 = failed */ 8919 /* Parameters: t(I) - pointer to tuneable to change */ 8920 /* p(I) - pointer to new timeout information */ 8921 /* tab(I) - pointer to table of TCP queues */ 8922 /* */ 8923 /* This function applies the new timeout (p) to the TCP tunable (t) and */ 8924 /* updates all of the entries on the relevant timeout queue by calling */ 8925 /* ipf_apply_timeout(). */ 8926 /* ------------------------------------------------------------------------ */ 8927 int 8928 ipf_settimeout_tcp(ipftuneable_t *t, ipftuneval_t *p, ipftq_t *tab) 8929 { 8930 if (!strcmp(t->ipft_name, "tcp_idle_timeout") || 8931 !strcmp(t->ipft_name, "tcp_established")) { 8932 ipf_apply_timeout(&tab[IPF_TCPS_ESTABLISHED], p->ipftu_int); 8933 } else if (!strcmp(t->ipft_name, "tcp_close_wait")) { 8934 ipf_apply_timeout(&tab[IPF_TCPS_CLOSE_WAIT], p->ipftu_int); 8935 } else if (!strcmp(t->ipft_name, "tcp_last_ack")) { 8936 ipf_apply_timeout(&tab[IPF_TCPS_LAST_ACK], p->ipftu_int); 8937 } else if (!strcmp(t->ipft_name, "tcp_timeout")) { 8938 ipf_apply_timeout(&tab[IPF_TCPS_LISTEN], p->ipftu_int); 8939 ipf_apply_timeout(&tab[IPF_TCPS_HALF_ESTAB], p->ipftu_int); 8940 ipf_apply_timeout(&tab[IPF_TCPS_CLOSING], p->ipftu_int); 8941 } else if (!strcmp(t->ipft_name, "tcp_listen")) { 8942 ipf_apply_timeout(&tab[IPF_TCPS_LISTEN], p->ipftu_int); 8943 } else if (!strcmp(t->ipft_name, "tcp_half_established")) { 8944 ipf_apply_timeout(&tab[IPF_TCPS_HALF_ESTAB], p->ipftu_int); 8945 } else if (!strcmp(t->ipft_name, "tcp_closing")) { 8946 ipf_apply_timeout(&tab[IPF_TCPS_CLOSING], p->ipftu_int); 8947 } else if (!strcmp(t->ipft_name, "tcp_syn_received")) { 8948 ipf_apply_timeout(&tab[IPF_TCPS_SYN_RECEIVED], p->ipftu_int); 8949 } else if (!strcmp(t->ipft_name, "tcp_syn_sent")) { 8950 ipf_apply_timeout(&tab[IPF_TCPS_SYN_SENT], p->ipftu_int); 8951 } else if (!strcmp(t->ipft_name, "tcp_closed")) { 8952 ipf_apply_timeout(&tab[IPF_TCPS_CLOSED], p->ipftu_int); 8953 } else if (!strcmp(t->ipft_name, "tcp_half_closed")) { 8954 ipf_apply_timeout(&tab[IPF_TCPS_CLOSED], p->ipftu_int); 8955 } else if (!strcmp(t->ipft_name, "tcp_time_wait")) { 8956 ipf_apply_timeout(&tab[IPF_TCPS_TIME_WAIT], p->ipftu_int); 8957 } else { 8958 /* 8959 * ipf_interror isn't set here because it should be set 8960 * by whatever called this function. 8961 */ 8962 return -1; 8963 } 8964 return 0; 8965 } 8966 8967 8968 /* ------------------------------------------------------------------------ */ 8969 /* Function: ipf_main_soft_create */ 8970 /* Returns: NULL = failure, else success */ 8971 /* Parameters: arg(I) - pointer to soft context structure if already allocd */ 8972 /* */ 8973 /* Create the foundation soft context structure. In circumstances where it */ 8974 /* is not required to dynamically allocate the context, a pointer can be */ 8975 /* passed in (rather than NULL) to a structure to be initialised. */ 8976 /* The main thing of interest is that a number of locks are initialised */ 8977 /* here instead of in the where might be expected - in the relevant create */ 8978 /* function elsewhere. This is done because the current locking design has */ 8979 /* some areas where these locks are used outside of their module. */ 8980 /* Possibly the most important exercise that is done here is setting of all */ 8981 /* the timeout values, allowing them to be changed before init(). */ 8982 /* ------------------------------------------------------------------------ */ 8983 void * 8984 ipf_main_soft_create(void *arg) 8985 { 8986 ipf_main_softc_t *softc; 8987 8988 if (arg == NULL) { 8989 KMALLOC(softc, ipf_main_softc_t *); 8990 if (softc == NULL) 8991 return NULL; 8992 } else { 8993 softc = arg; 8994 } 8995 8996 bzero((char *)softc, sizeof(*softc)); 8997 8998 /* 8999 * This serves as a flag as to whether or not the softc should be 9000 * free'd when _destroy is called. 9001 */ 9002 softc->ipf_dynamic_softc = (arg == NULL) ? 1 : 0; 9003 9004 softc->ipf_tuners = ipf_tune_array_copy(softc, 9005 sizeof(ipf_main_tuneables), 9006 ipf_main_tuneables); 9007 if (softc->ipf_tuners == NULL) { 9008 ipf_main_soft_destroy(softc); 9009 return NULL; 9010 } 9011 9012 MUTEX_INIT(&softc->ipf_rw, "ipf rw mutex"); 9013 MUTEX_INIT(&softc->ipf_timeoutlock, "ipf timeout lock"); 9014 RWLOCK_INIT(&softc->ipf_global, "ipf filter load/unload mutex"); 9015 RWLOCK_INIT(&softc->ipf_mutex, "ipf filter rwlock"); 9016 RWLOCK_INIT(&softc->ipf_tokens, "ipf token rwlock"); 9017 RWLOCK_INIT(&softc->ipf_state, "ipf state rwlock"); 9018 RWLOCK_INIT(&softc->ipf_nat, "ipf IP NAT rwlock"); 9019 RWLOCK_INIT(&softc->ipf_poolrw, "ipf pool rwlock"); 9020 RWLOCK_INIT(&softc->ipf_frag, "ipf frag rwlock"); 9021 9022 softc->ipf_token_head = NULL; 9023 softc->ipf_token_tail = &softc->ipf_token_head; 9024 9025 softc->ipf_tcpidletimeout = FIVE_DAYS; 9026 softc->ipf_tcpclosewait = IPF_TTLVAL(2 * TCP_MSL); 9027 softc->ipf_tcplastack = IPF_TTLVAL(30); 9028 softc->ipf_tcptimewait = IPF_TTLVAL(2 * TCP_MSL); 9029 softc->ipf_tcptimeout = IPF_TTLVAL(2 * TCP_MSL); 9030 softc->ipf_tcpsynsent = IPF_TTLVAL(2 * TCP_MSL); 9031 softc->ipf_tcpsynrecv = IPF_TTLVAL(2 * TCP_MSL); 9032 softc->ipf_tcpclosed = IPF_TTLVAL(30); 9033 softc->ipf_tcphalfclosed = IPF_TTLVAL(2 * 3600); 9034 softc->ipf_udptimeout = IPF_TTLVAL(120); 9035 softc->ipf_udpacktimeout = IPF_TTLVAL(12); 9036 softc->ipf_icmptimeout = IPF_TTLVAL(60); 9037 softc->ipf_icmpacktimeout = IPF_TTLVAL(6); 9038 softc->ipf_iptimeout = IPF_TTLVAL(60); 9039 9040 #if defined(IPFILTER_DEFAULT_BLOCK) 9041 softc->ipf_pass = FR_BLOCK|FR_NOMATCH; 9042 #else 9043 softc->ipf_pass = (IPF_DEFAULT_PASS)|FR_NOMATCH; 9044 #endif 9045 softc->ipf_minttl = 4; 9046 softc->ipf_icmpminfragmtu = 68; 9047 softc->ipf_flags = IPF_LOGGING; 9048 9049 return softc; 9050 } 9051 9052 /* ------------------------------------------------------------------------ */ 9053 /* Function: ipf_main_soft_init */ 9054 /* Returns: 0 = success, -1 = failure */ 9055 /* Parameters: softc(I) - pointer to soft context main structure */ 9056 /* */ 9057 /* A null-op function that exists as a placeholder so that the flow in */ 9058 /* other functions is obvious. */ 9059 /* ------------------------------------------------------------------------ */ 9060 /*ARGSUSED*/ 9061 int 9062 ipf_main_soft_init(ipf_main_softc_t *softc) 9063 { 9064 return 0; 9065 } 9066 9067 9068 /* ------------------------------------------------------------------------ */ 9069 /* Function: ipf_main_soft_destroy */ 9070 /* Returns: void */ 9071 /* Parameters: softc(I) - pointer to soft context main structure */ 9072 /* */ 9073 /* Undo everything that we did in ipf_main_soft_create. */ 9074 /* */ 9075 /* The most important check that needs to be made here is whether or not */ 9076 /* the structure was allocated by ipf_main_soft_create() by checking what */ 9077 /* value is stored in ipf_dynamic_main. */ 9078 /* ------------------------------------------------------------------------ */ 9079 /*ARGSUSED*/ 9080 void 9081 ipf_main_soft_destroy(ipf_main_softc_t *softc) 9082 { 9083 9084 RW_DESTROY(&softc->ipf_frag); 9085 RW_DESTROY(&softc->ipf_poolrw); 9086 RW_DESTROY(&softc->ipf_nat); 9087 RW_DESTROY(&softc->ipf_state); 9088 RW_DESTROY(&softc->ipf_tokens); 9089 RW_DESTROY(&softc->ipf_mutex); 9090 RW_DESTROY(&softc->ipf_global); 9091 MUTEX_DESTROY(&softc->ipf_timeoutlock); 9092 MUTEX_DESTROY(&softc->ipf_rw); 9093 9094 if (softc->ipf_tuners != NULL) { 9095 KFREES(softc->ipf_tuners, sizeof(ipf_main_tuneables)); 9096 } 9097 if (softc->ipf_dynamic_softc == 1) { 9098 KFREE(softc); 9099 } 9100 } 9101 9102 9103 /* ------------------------------------------------------------------------ */ 9104 /* Function: ipf_main_soft_fini */ 9105 /* Returns: 0 = success, -1 = failure */ 9106 /* Parameters: softc(I) - pointer to soft context main structure */ 9107 /* */ 9108 /* Clean out the rules which have been added since _init was last called, */ 9109 /* the only dynamic part of the mainline. */ 9110 /* ------------------------------------------------------------------------ */ 9111 int 9112 ipf_main_soft_fini(ipf_main_softc_t *softc) 9113 { 9114 (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE|FR_INACTIVE); 9115 (void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE); 9116 (void) ipf_flush(softc, IPL_LOGCOUNT, FR_INQUE|FR_OUTQUE|FR_INACTIVE); 9117 (void) ipf_flush(softc, IPL_LOGCOUNT, FR_INQUE|FR_OUTQUE); 9118 9119 return 0; 9120 } 9121 9122 9123 /* ------------------------------------------------------------------------ */ 9124 /* Function: ipf_main_load */ 9125 /* Returns: 0 = success, -1 = failure */ 9126 /* Parameters: none */ 9127 /* */ 9128 /* Handle global initialisation that needs to be done for the base part of */ 9129 /* IPFilter. At present this just amounts to initialising some ICMP lookup */ 9130 /* arrays that get used by the state/NAT code. */ 9131 /* ------------------------------------------------------------------------ */ 9132 int 9133 ipf_main_load(void) 9134 { 9135 int i; 9136 9137 /* fill icmp reply type table */ 9138 for (i = 0; i <= ICMP_MAXTYPE; i++) 9139 icmpreplytype4[i] = -1; 9140 icmpreplytype4[ICMP_ECHO] = ICMP_ECHOREPLY; 9141 icmpreplytype4[ICMP_TSTAMP] = ICMP_TSTAMPREPLY; 9142 icmpreplytype4[ICMP_IREQ] = ICMP_IREQREPLY; 9143 icmpreplytype4[ICMP_MASKREQ] = ICMP_MASKREPLY; 9144 9145 #ifdef USE_INET6 9146 /* fill icmp reply type table */ 9147 for (i = 0; i <= ICMP6_MAXTYPE; i++) 9148 icmpreplytype6[i] = -1; 9149 icmpreplytype6[ICMP6_ECHO_REQUEST] = ICMP6_ECHO_REPLY; 9150 icmpreplytype6[ICMP6_MEMBERSHIP_QUERY] = ICMP6_MEMBERSHIP_REPORT; 9151 icmpreplytype6[ICMP6_NI_QUERY] = ICMP6_NI_REPLY; 9152 icmpreplytype6[ND_ROUTER_SOLICIT] = ND_ROUTER_ADVERT; 9153 icmpreplytype6[ND_NEIGHBOR_SOLICIT] = ND_NEIGHBOR_ADVERT; 9154 #endif 9155 9156 return 0; 9157 } 9158 9159 9160 /* ------------------------------------------------------------------------ */ 9161 /* Function: ipf_main_unload */ 9162 /* Returns: 0 = success, -1 = failure */ 9163 /* Parameters: none */ 9164 /* */ 9165 /* A null-op function that exists as a placeholder so that the flow in */ 9166 /* other functions is obvious. */ 9167 /* ------------------------------------------------------------------------ */ 9168 int 9169 ipf_main_unload(void) 9170 { 9171 return 0; 9172 } 9173 9174 9175 /* ------------------------------------------------------------------------ */ 9176 /* Function: ipf_load_all */ 9177 /* Returns: 0 = success, -1 = failure */ 9178 /* Parameters: none */ 9179 /* */ 9180 /* Work through all of the subsystems inside IPFilter and call the load */ 9181 /* function for each in an order that won't lead to a crash :) */ 9182 /* ------------------------------------------------------------------------ */ 9183 int 9184 ipf_load_all(void) 9185 { 9186 if (ipf_main_load() == -1) 9187 return -1; 9188 9189 if (ipf_state_main_load() == -1) 9190 return -1; 9191 9192 if (ipf_nat_main_load() == -1) 9193 return -1; 9194 9195 if (ipf_frag_main_load() == -1) 9196 return -1; 9197 9198 if (ipf_auth_main_load() == -1) 9199 return -1; 9200 9201 if (ipf_proxy_main_load() == -1) 9202 return -1; 9203 9204 return 0; 9205 } 9206 9207 9208 /* ------------------------------------------------------------------------ */ 9209 /* Function: ipf_unload_all */ 9210 /* Returns: 0 = success, -1 = failure */ 9211 /* Parameters: none */ 9212 /* */ 9213 /* Work through all of the subsystems inside IPFilter and call the unload */ 9214 /* function for each in an order that won't lead to a crash :) */ 9215 /* ------------------------------------------------------------------------ */ 9216 int 9217 ipf_unload_all(void) 9218 { 9219 if (ipf_proxy_main_unload() == -1) 9220 return -1; 9221 9222 if (ipf_auth_main_unload() == -1) 9223 return -1; 9224 9225 if (ipf_frag_main_unload() == -1) 9226 return -1; 9227 9228 if (ipf_nat_main_unload() == -1) 9229 return -1; 9230 9231 if (ipf_state_main_unload() == -1) 9232 return -1; 9233 9234 if (ipf_main_unload() == -1) 9235 return -1; 9236 9237 return 0; 9238 } 9239 9240 9241 /* ------------------------------------------------------------------------ */ 9242 /* Function: ipf_create_all */ 9243 /* Returns: NULL = failure, else success */ 9244 /* Parameters: arg(I) - pointer to soft context main structure */ 9245 /* */ 9246 /* Work through all of the subsystems inside IPFilter and call the create */ 9247 /* function for each in an order that won't lead to a crash :) */ 9248 /* ------------------------------------------------------------------------ */ 9249 ipf_main_softc_t * 9250 ipf_create_all(void *arg) 9251 { 9252 ipf_main_softc_t *softc; 9253 9254 softc = ipf_main_soft_create(arg); 9255 if (softc == NULL) 9256 return NULL; 9257 9258 #ifdef IPFILTER_LOG 9259 softc->ipf_log_soft = ipf_log_soft_create(softc); 9260 if (softc->ipf_log_soft == NULL) { 9261 ipf_destroy_all(softc); 9262 return NULL; 9263 } 9264 #endif 9265 9266 softc->ipf_lookup_soft = ipf_lookup_soft_create(softc); 9267 if (softc->ipf_lookup_soft == NULL) { 9268 ipf_destroy_all(softc); 9269 return NULL; 9270 } 9271 9272 softc->ipf_sync_soft = ipf_sync_soft_create(softc); 9273 if (softc->ipf_sync_soft == NULL) { 9274 ipf_destroy_all(softc); 9275 return NULL; 9276 } 9277 9278 softc->ipf_state_soft = ipf_state_soft_create(softc); 9279 if (softc->ipf_state_soft == NULL) { 9280 ipf_destroy_all(softc); 9281 return NULL; 9282 } 9283 9284 softc->ipf_nat_soft = ipf_nat_soft_create(softc); 9285 if (softc->ipf_nat_soft == NULL) { 9286 ipf_destroy_all(softc); 9287 return NULL; 9288 } 9289 9290 softc->ipf_frag_soft = ipf_frag_soft_create(softc); 9291 if (softc->ipf_frag_soft == NULL) { 9292 ipf_destroy_all(softc); 9293 return NULL; 9294 } 9295 9296 softc->ipf_auth_soft = ipf_auth_soft_create(softc); 9297 if (softc->ipf_auth_soft == NULL) { 9298 ipf_destroy_all(softc); 9299 return NULL; 9300 } 9301 9302 softc->ipf_proxy_soft = ipf_proxy_soft_create(softc); 9303 if (softc->ipf_proxy_soft == NULL) { 9304 ipf_destroy_all(softc); 9305 return NULL; 9306 } 9307 9308 return softc; 9309 } 9310 9311 9312 /* ------------------------------------------------------------------------ */ 9313 /* Function: ipf_destroy_all */ 9314 /* Returns: void */ 9315 /* Parameters: softc(I) - pointer to soft context main structure */ 9316 /* */ 9317 /* Work through all of the subsystems inside IPFilter and call the destroy */ 9318 /* function for each in an order that won't lead to a crash :) */ 9319 /* */ 9320 /* Every one of these functions is expected to succeed, so there is no */ 9321 /* checking of return values. */ 9322 /* ------------------------------------------------------------------------ */ 9323 void 9324 ipf_destroy_all(ipf_main_softc_t *softc) 9325 { 9326 9327 if (softc->ipf_state_soft != NULL) { 9328 ipf_state_soft_destroy(softc, softc->ipf_state_soft); 9329 softc->ipf_state_soft = NULL; 9330 } 9331 9332 if (softc->ipf_nat_soft != NULL) { 9333 ipf_nat_soft_destroy(softc, softc->ipf_nat_soft); 9334 softc->ipf_nat_soft = NULL; 9335 } 9336 9337 if (softc->ipf_frag_soft != NULL) { 9338 ipf_frag_soft_destroy(softc, softc->ipf_frag_soft); 9339 softc->ipf_frag_soft = NULL; 9340 } 9341 9342 if (softc->ipf_auth_soft != NULL) { 9343 ipf_auth_soft_destroy(softc, softc->ipf_auth_soft); 9344 softc->ipf_auth_soft = NULL; 9345 } 9346 9347 if (softc->ipf_proxy_soft != NULL) { 9348 ipf_proxy_soft_destroy(softc, softc->ipf_proxy_soft); 9349 softc->ipf_proxy_soft = NULL; 9350 } 9351 9352 if (softc->ipf_sync_soft != NULL) { 9353 ipf_sync_soft_destroy(softc, softc->ipf_sync_soft); 9354 softc->ipf_sync_soft = NULL; 9355 } 9356 9357 if (softc->ipf_lookup_soft != NULL) { 9358 ipf_lookup_soft_destroy(softc, softc->ipf_lookup_soft); 9359 softc->ipf_lookup_soft = NULL; 9360 } 9361 9362 #ifdef IPFILTER_LOG 9363 if (softc->ipf_log_soft != NULL) { 9364 ipf_log_soft_destroy(softc, softc->ipf_log_soft); 9365 softc->ipf_log_soft = NULL; 9366 } 9367 #endif 9368 9369 ipf_main_soft_destroy(softc); 9370 } 9371 9372 9373 /* ------------------------------------------------------------------------ */ 9374 /* Function: ipf_init_all */ 9375 /* Returns: 0 = success, -1 = failure */ 9376 /* Parameters: softc(I) - pointer to soft context main structure */ 9377 /* */ 9378 /* Work through all of the subsystems inside IPFilter and call the init */ 9379 /* function for each in an order that won't lead to a crash :) */ 9380 /* ------------------------------------------------------------------------ */ 9381 int 9382 ipf_init_all(ipf_main_softc_t *softc) 9383 { 9384 9385 if (ipf_main_soft_init(softc) == -1) 9386 return -1; 9387 9388 #ifdef IPFILTER_LOG 9389 if (ipf_log_soft_init(softc, softc->ipf_log_soft) == -1) 9390 return -1; 9391 #endif 9392 9393 if (ipf_lookup_soft_init(softc, softc->ipf_lookup_soft) == -1) 9394 return -1; 9395 9396 if (ipf_sync_soft_init(softc, softc->ipf_sync_soft) == -1) 9397 return -1; 9398 9399 if (ipf_state_soft_init(softc, softc->ipf_state_soft) == -1) 9400 return -1; 9401 9402 if (ipf_nat_soft_init(softc, softc->ipf_nat_soft) == -1) 9403 return -1; 9404 9405 if (ipf_frag_soft_init(softc, softc->ipf_frag_soft) == -1) 9406 return -1; 9407 9408 if (ipf_auth_soft_init(softc, softc->ipf_auth_soft) == -1) 9409 return -1; 9410 9411 if (ipf_proxy_soft_init(softc, softc->ipf_proxy_soft) == -1) 9412 return -1; 9413 9414 return 0; 9415 } 9416 9417 9418 /* ------------------------------------------------------------------------ */ 9419 /* Function: ipf_fini_all */ 9420 /* Returns: 0 = success, -1 = failure */ 9421 /* Parameters: softc(I) - pointer to soft context main structure */ 9422 /* */ 9423 /* Work through all of the subsystems inside IPFilter and call the fini */ 9424 /* function for each in an order that won't lead to a crash :) */ 9425 /* ------------------------------------------------------------------------ */ 9426 int 9427 ipf_fini_all(ipf_main_softc_t *softc) 9428 { 9429 9430 ipf_token_flush(softc); 9431 9432 if (ipf_proxy_soft_fini(softc, softc->ipf_proxy_soft) == -1) 9433 return -1; 9434 9435 if (ipf_auth_soft_fini(softc, softc->ipf_auth_soft) == -1) 9436 return -1; 9437 9438 if (ipf_frag_soft_fini(softc, softc->ipf_frag_soft) == -1) 9439 return -1; 9440 9441 if (ipf_nat_soft_fini(softc, softc->ipf_nat_soft) == -1) 9442 return -1; 9443 9444 if (ipf_state_soft_fini(softc, softc->ipf_state_soft) == -1) 9445 return -1; 9446 9447 if (ipf_sync_soft_fini(softc, softc->ipf_sync_soft) == -1) 9448 return -1; 9449 9450 if (ipf_lookup_soft_fini(softc, softc->ipf_lookup_soft) == -1) 9451 return -1; 9452 9453 #ifdef IPFILTER_LOG 9454 if (ipf_log_soft_fini(softc, softc->ipf_log_soft) == -1) 9455 return -1; 9456 #endif 9457 9458 if (ipf_main_soft_fini(softc) == -1) 9459 return -1; 9460 9461 return 0; 9462 } 9463 9464 9465 /* ------------------------------------------------------------------------ */ 9466 /* Function: ipf_rule_expire */ 9467 /* Returns: Nil */ 9468 /* Parameters: softc(I) - pointer to soft context main structure */ 9469 /* */ 9470 /* At present this function exists just to support temporary addition of */ 9471 /* firewall rules. Both inactive and active lists are scanned for items to */ 9472 /* purge, as by rights, the expiration is computed as soon as the rule is */ 9473 /* loaded in. */ 9474 /* ------------------------------------------------------------------------ */ 9475 void 9476 ipf_rule_expire(ipf_main_softc_t *softc) 9477 { 9478 frentry_t *fr; 9479 9480 if ((softc->ipf_rule_explist[0] == NULL) && 9481 (softc->ipf_rule_explist[1] == NULL)) 9482 return; 9483 9484 WRITE_ENTER(&softc->ipf_mutex); 9485 9486 while ((fr = softc->ipf_rule_explist[0]) != NULL) { 9487 /* 9488 * Because the list is kept sorted on insertion, the fist 9489 * one that dies in the future means no more work to do. 9490 */ 9491 if (fr->fr_die > softc->ipf_ticks) 9492 break; 9493 ipf_rule_delete(softc, fr, IPL_LOGIPF, 0); 9494 } 9495 9496 while ((fr = softc->ipf_rule_explist[1]) != NULL) { 9497 /* 9498 * Because the list is kept sorted on insertion, the fist 9499 * one that dies in the future means no more work to do. 9500 */ 9501 if (fr->fr_die > softc->ipf_ticks) 9502 break; 9503 ipf_rule_delete(softc, fr, IPL_LOGIPF, 1); 9504 } 9505 9506 RWLOCK_EXIT(&softc->ipf_mutex); 9507 } 9508 9509 9510 static int ipf_ht_node_cmp(const struct host_node_s *, const struct host_node_s *); 9511 static void ipf_ht_node_make_key(host_track_t *, host_node_t *, int, 9512 i6addr_t *); 9513 9514 RBI_CODE(ipf_rb, host_node_t, hn_entry, ipf_ht_node_cmp) 9515 9516 9517 /* ------------------------------------------------------------------------ */ 9518 /* Function: ipf_ht_node_cmp */ 9519 /* Returns: int - 0 == nodes are the same, .. */ 9520 /* Parameters: k1(I) - pointer to first key to compare */ 9521 /* k2(I) - pointer to second key to compare */ 9522 /* */ 9523 /* The "key" for the node is a combination of two fields: the address */ 9524 /* family and the address itself. */ 9525 /* */ 9526 /* Because we're not actually interpreting the address data, it isn't */ 9527 /* necessary to convert them to/from network/host byte order. The mask is */ 9528 /* just used to remove bits that aren't significant - it doesn't matter */ 9529 /* where they are, as long as they're always in the same place. */ 9530 /* */ 9531 /* As with IP6_EQ, comparing IPv6 addresses starts at the bottom because */ 9532 /* this is where individual ones will differ the most - but not true for */ 9533 /* for /48's, etc. */ 9534 /* ------------------------------------------------------------------------ */ 9535 static int 9536 ipf_ht_node_cmp(const struct host_node_s *k1, const struct host_node_s *k2) 9537 { 9538 int i; 9539 9540 i = (k2->hn_addr.adf_family - k1->hn_addr.adf_family); 9541 if (i != 0) 9542 return i; 9543 9544 if (k1->hn_addr.adf_family == AF_INET) 9545 return (k2->hn_addr.adf_addr.in4.s_addr - 9546 k1->hn_addr.adf_addr.in4.s_addr); 9547 9548 i = k2->hn_addr.adf_addr.i6[3] - k1->hn_addr.adf_addr.i6[3]; 9549 if (i != 0) 9550 return i; 9551 i = k2->hn_addr.adf_addr.i6[2] - k1->hn_addr.adf_addr.i6[2]; 9552 if (i != 0) 9553 return i; 9554 i = k2->hn_addr.adf_addr.i6[1] - k1->hn_addr.adf_addr.i6[1]; 9555 if (i != 0) 9556 return i; 9557 i = k2->hn_addr.adf_addr.i6[0] - k1->hn_addr.adf_addr.i6[0]; 9558 return i; 9559 } 9560 9561 9562 /* ------------------------------------------------------------------------ */ 9563 /* Function: ipf_ht_node_make_key */ 9564 /* Returns: Nil */ 9565 /* parameters: htp(I) - pointer to address tracking structure */ 9566 /* key(I) - where to store masked address for lookup */ 9567 /* family(I) - protocol family of address */ 9568 /* addr(I) - pointer to network address */ 9569 /* */ 9570 /* Using the "netmask" (number of bits) stored parent host tracking struct, */ 9571 /* copy the address passed in into the key structure whilst masking out the */ 9572 /* bits that we don't want. */ 9573 /* */ 9574 /* Because the parser will set ht_netmask to 128 if there is no protocol */ 9575 /* specified (the parser doesn't know if it should be a v4 or v6 rule), we */ 9576 /* have to be wary of that and not allow 32-128 to happen. */ 9577 /* ------------------------------------------------------------------------ */ 9578 static void 9579 ipf_ht_node_make_key(host_track_t *htp, host_node_t *key, int family, 9580 i6addr_t *addr) 9581 { 9582 key->hn_addr.adf_family = family; 9583 if (family == AF_INET) { 9584 u_32_t mask; 9585 int bits; 9586 9587 key->hn_addr.adf_len = sizeof(key->hn_addr.adf_addr.in4); 9588 bits = htp->ht_netmask; 9589 if (bits >= 32) { 9590 mask = 0xffffffff; 9591 } else { 9592 mask = htonl(0xffffffff << (32 - bits)); 9593 } 9594 key->hn_addr.adf_addr.in4.s_addr = addr->in4.s_addr & mask; 9595 #ifdef USE_INET6 9596 } else { 9597 int bits = htp->ht_netmask; 9598 9599 key->hn_addr.adf_len = sizeof(key->hn_addr.adf_addr.in6); 9600 if (bits > 96) { 9601 key->hn_addr.adf_addr.i6[3] = addr->i6[3] & 9602 htonl(0xffffffff << (128 - bits)); 9603 key->hn_addr.adf_addr.i6[2] = addr->i6[2]; 9604 key->hn_addr.adf_addr.i6[1] = addr->i6[2]; 9605 key->hn_addr.adf_addr.i6[0] = addr->i6[2]; 9606 } else if (bits > 64) { 9607 key->hn_addr.adf_addr.i6[3] = 0; 9608 key->hn_addr.adf_addr.i6[2] = addr->i6[2] & 9609 htonl(0xffffffff << (96 - bits)); 9610 key->hn_addr.adf_addr.i6[1] = addr->i6[1]; 9611 key->hn_addr.adf_addr.i6[0] = addr->i6[0]; 9612 } else if (bits > 32) { 9613 key->hn_addr.adf_addr.i6[3] = 0; 9614 key->hn_addr.adf_addr.i6[2] = 0; 9615 key->hn_addr.adf_addr.i6[1] = addr->i6[1] & 9616 htonl(0xffffffff << (64 - bits)); 9617 key->hn_addr.adf_addr.i6[0] = addr->i6[0]; 9618 } else { 9619 key->hn_addr.adf_addr.i6[3] = 0; 9620 key->hn_addr.adf_addr.i6[2] = 0; 9621 key->hn_addr.adf_addr.i6[1] = 0; 9622 key->hn_addr.adf_addr.i6[0] = addr->i6[0] & 9623 htonl(0xffffffff << (32 - bits)); 9624 } 9625 #endif 9626 } 9627 } 9628 9629 9630 /* ------------------------------------------------------------------------ */ 9631 /* Function: ipf_ht_node_add */ 9632 /* Returns: int - 0 == success, -1 == failure */ 9633 /* Parameters: softc(I) - pointer to soft context main structure */ 9634 /* htp(I) - pointer to address tracking structure */ 9635 /* family(I) - protocol family of address */ 9636 /* addr(I) - pointer to network address */ 9637 /* */ 9638 /* NOTE: THIS FUNCTION MUST BE CALLED WITH AN EXCLUSIVE LOCK THAT PREVENTS */ 9639 /* ipf_ht_node_del FROM RUNNING CONCURRENTLY ON THE SAME htp. */ 9640 /* */ 9641 /* After preparing the key with the address information to find, look in */ 9642 /* the red-black tree to see if the address is known. A successful call to */ 9643 /* this function can mean one of two things: a new node was added to the */ 9644 /* tree or a matching node exists and we're able to bump up its activity. */ 9645 /* ------------------------------------------------------------------------ */ 9646 int 9647 ipf_ht_node_add(ipf_main_softc_t *softc, host_track_t *htp, int family, 9648 i6addr_t *addr) 9649 { 9650 host_node_t *h; 9651 host_node_t k; 9652 9653 ipf_ht_node_make_key(htp, &k, family, addr); 9654 9655 h = RBI_SEARCH(ipf_rb, &htp->ht_root, &k); 9656 if (h == NULL) { 9657 if (htp->ht_cur_nodes >= htp->ht_max_nodes) 9658 return -1; 9659 KMALLOC(h, host_node_t *); 9660 if (h == NULL) { 9661 DT(ipf_rb_no_mem); 9662 LBUMP(ipf_rb_no_mem); 9663 return -1; 9664 } 9665 9666 /* 9667 * If there was a macro to initialise the RB node then that 9668 * would get used here, but there isn't... 9669 */ 9670 bzero((char *)h, sizeof(*h)); 9671 h->hn_addr = k.hn_addr; 9672 h->hn_addr.adf_family = k.hn_addr.adf_family; 9673 RBI_INSERT(ipf_rb, &htp->ht_root, h); 9674 htp->ht_cur_nodes++; 9675 } else { 9676 if ((htp->ht_max_per_node != 0) && 9677 (h->hn_active >= htp->ht_max_per_node)) { 9678 DT(ipf_rb_node_max); 9679 LBUMP(ipf_rb_node_max); 9680 return -1; 9681 } 9682 } 9683 9684 h->hn_active++; 9685 9686 return 0; 9687 } 9688 9689 9690 /* ------------------------------------------------------------------------ */ 9691 /* Function: ipf_ht_node_del */ 9692 /* Returns: int - 0 == success, -1 == failure */ 9693 /* parameters: htp(I) - pointer to address tracking structure */ 9694 /* family(I) - protocol family of address */ 9695 /* addr(I) - pointer to network address */ 9696 /* */ 9697 /* NOTE: THIS FUNCTION MUST BE CALLED WITH AN EXCLUSIVE LOCK THAT PREVENTS */ 9698 /* ipf_ht_node_add FROM RUNNING CONCURRENTLY ON THE SAME htp. */ 9699 /* */ 9700 /* Try and find the address passed in amongst the leaves on this tree to */ 9701 /* be friend. If found then drop the active account for that node drops by */ 9702 /* one. If that count reaches 0, it is time to free it all up. */ 9703 /* ------------------------------------------------------------------------ */ 9704 int 9705 ipf_ht_node_del(host_track_t *htp, int family, i6addr_t *addr) 9706 { 9707 host_node_t *h; 9708 host_node_t k; 9709 9710 ipf_ht_node_make_key(htp, &k, family, addr); 9711 9712 h = RBI_SEARCH(ipf_rb, &htp->ht_root, &k); 9713 if (h == NULL) { 9714 return -1; 9715 } else { 9716 h->hn_active--; 9717 if (h->hn_active == 0) { 9718 (void) RBI_DELETE(ipf_rb, &htp->ht_root, h); 9719 htp->ht_cur_nodes--; 9720 KFREE(h); 9721 } 9722 } 9723 9724 return 0; 9725 } 9726 9727 9728 /* ------------------------------------------------------------------------ */ 9729 /* Function: ipf_rb_ht_init */ 9730 /* Returns: Nil */ 9731 /* Parameters: head(I) - pointer to host tracking structure */ 9732 /* */ 9733 /* Initialise the host tracking structure to be ready for use above. */ 9734 /* ------------------------------------------------------------------------ */ 9735 void 9736 ipf_rb_ht_init(host_track_t *head) 9737 { 9738 memset(head, 0, sizeof(*head)); 9739 RBI_INIT(ipf_rb, &head->ht_root); 9740 } 9741 9742 9743 /* ------------------------------------------------------------------------ */ 9744 /* Function: ipf_rb_ht_freenode */ 9745 /* Returns: Nil */ 9746 /* Parameters: head(I) - pointer to host tracking structure */ 9747 /* arg(I) - additional argument from walk caller */ 9748 /* */ 9749 /* Free an actual host_node_t structure. */ 9750 /* ------------------------------------------------------------------------ */ 9751 void 9752 ipf_rb_ht_freenode(host_node_t *node, void *arg) 9753 { 9754 KFREE(node); 9755 } 9756 9757 9758 /* ------------------------------------------------------------------------ */ 9759 /* Function: ipf_rb_ht_flush */ 9760 /* Returns: Nil */ 9761 /* Parameters: head(I) - pointer to host tracking structure */ 9762 /* */ 9763 /* Remove all of the nodes in the tree tracking hosts by calling a walker */ 9764 /* and free'ing each one. */ 9765 /* ------------------------------------------------------------------------ */ 9766 void 9767 ipf_rb_ht_flush(host_track_t *head) 9768 { 9769 /* XXX - May use node members after freeing the node. */ 9770 RBI_WALK(ipf_rb, &head->ht_root, ipf_rb_ht_freenode, NULL); 9771 } 9772 9773 9774 /* ------------------------------------------------------------------------ */ 9775 /* Function: ipf_slowtimer */ 9776 /* Returns: Nil */ 9777 /* Parameters: ptr(I) - pointer to main ipf soft context structure */ 9778 /* */ 9779 /* Slowly expire held state for fragments. Timeouts are set * in */ 9780 /* expectation of this being called twice per second. */ 9781 /* ------------------------------------------------------------------------ */ 9782 void 9783 ipf_slowtimer(ipf_main_softc_t *softc) 9784 { 9785 9786 ipf_token_expire(softc); 9787 ipf_frag_expire(softc); 9788 ipf_state_expire(softc); 9789 ipf_nat_expire(softc); 9790 ipf_auth_expire(softc); 9791 ipf_lookup_expire(softc); 9792 ipf_rule_expire(softc); 9793 ipf_sync_expire(softc); 9794 softc->ipf_ticks++; 9795 # if defined(__OpenBSD__) 9796 timeout_add(&ipf_slowtimer_ch, hz/2); 9797 # endif 9798 } 9799 9800 9801 /* ------------------------------------------------------------------------ */ 9802 /* Function: ipf_inet_mask_add */ 9803 /* Returns: Nil */ 9804 /* Parameters: bits(I) - pointer to nat context information */ 9805 /* mtab(I) - pointer to mask hash table structure */ 9806 /* */ 9807 /* When called, bits represents the mask of a new NAT rule that has just */ 9808 /* been added. This function inserts a bitmask into the array of masks to */ 9809 /* search when searching for a matching NAT rule for a packet. */ 9810 /* Prevention of duplicate masks is achieved by checking the use count for */ 9811 /* a given netmask. */ 9812 /* ------------------------------------------------------------------------ */ 9813 void 9814 ipf_inet_mask_add(int bits, ipf_v4_masktab_t *mtab) 9815 { 9816 u_32_t mask; 9817 int i, j; 9818 9819 mtab->imt4_masks[bits]++; 9820 if (mtab->imt4_masks[bits] > 1) 9821 return; 9822 9823 if (bits == 0) 9824 mask = 0; 9825 else 9826 mask = 0xffffffff << (32 - bits); 9827 9828 for (i = 0; i < 33; i++) { 9829 if (ntohl(mtab->imt4_active[i]) < mask) { 9830 for (j = 32; j > i; j--) 9831 mtab->imt4_active[j] = mtab->imt4_active[j - 1]; 9832 mtab->imt4_active[i] = htonl(mask); 9833 break; 9834 } 9835 } 9836 mtab->imt4_max++; 9837 } 9838 9839 9840 /* ------------------------------------------------------------------------ */ 9841 /* Function: ipf_inet_mask_del */ 9842 /* Returns: Nil */ 9843 /* Parameters: bits(I) - number of bits set in the netmask */ 9844 /* mtab(I) - pointer to mask hash table structure */ 9845 /* */ 9846 /* Remove the 32bit bitmask represented by "bits" from the collection of */ 9847 /* netmasks stored inside of mtab. */ 9848 /* ------------------------------------------------------------------------ */ 9849 void 9850 ipf_inet_mask_del(int bits, ipf_v4_masktab_t *mtab) 9851 { 9852 u_32_t mask; 9853 int i, j; 9854 9855 mtab->imt4_masks[bits]--; 9856 if (mtab->imt4_masks[bits] > 0) 9857 return; 9858 9859 mask = htonl(0xffffffff << (32 - bits)); 9860 for (i = 0; i < 33; i++) { 9861 if (mtab->imt4_active[i] == mask) { 9862 for (j = i + 1; j < 33; j++) 9863 mtab->imt4_active[j - 1] = mtab->imt4_active[j]; 9864 break; 9865 } 9866 } 9867 mtab->imt4_max--; 9868 ASSERT(mtab->imt4_max >= 0); 9869 } 9870 9871 9872 #ifdef USE_INET6 9873 /* ------------------------------------------------------------------------ */ 9874 /* Function: ipf_inet6_mask_add */ 9875 /* Returns: Nil */ 9876 /* Parameters: bits(I) - number of bits set in mask */ 9877 /* mask(I) - pointer to mask to add */ 9878 /* mtab(I) - pointer to mask hash table structure */ 9879 /* */ 9880 /* When called, bitcount represents the mask of a IPv6 NAT map rule that */ 9881 /* has just been added. This function inserts a bitmask into the array of */ 9882 /* masks to search when searching for a matching NAT rule for a packet. */ 9883 /* Prevention of duplicate masks is achieved by checking the use count for */ 9884 /* a given netmask. */ 9885 /* ------------------------------------------------------------------------ */ 9886 void 9887 ipf_inet6_mask_add(int bits, i6addr_t *mask, ipf_v6_masktab_t *mtab) 9888 { 9889 i6addr_t zero; 9890 int i, j; 9891 9892 mtab->imt6_masks[bits]++; 9893 if (mtab->imt6_masks[bits] > 1) 9894 return; 9895 9896 if (bits == 0) { 9897 mask = &zero; 9898 zero.i6[0] = 0; 9899 zero.i6[1] = 0; 9900 zero.i6[2] = 0; 9901 zero.i6[3] = 0; 9902 } 9903 9904 for (i = 0; i < 129; i++) { 9905 if (IP6_LT(&mtab->imt6_active[i], mask)) { 9906 for (j = 128; j > i; j--) 9907 mtab->imt6_active[j] = mtab->imt6_active[j - 1]; 9908 mtab->imt6_active[i] = *mask; 9909 break; 9910 } 9911 } 9912 mtab->imt6_max++; 9913 } 9914 9915 9916 /* ------------------------------------------------------------------------ */ 9917 /* Function: ipf_inet6_mask_del */ 9918 /* Returns: Nil */ 9919 /* Parameters: bits(I) - number of bits set in mask */ 9920 /* mask(I) - pointer to mask to remove */ 9921 /* mtab(I) - pointer to mask hash table structure */ 9922 /* */ 9923 /* Remove the 128bit bitmask represented by "bits" from the collection of */ 9924 /* netmasks stored inside of mtab. */ 9925 /* ------------------------------------------------------------------------ */ 9926 void 9927 ipf_inet6_mask_del(int bits, i6addr_t *mask, ipf_v6_masktab_t *mtab) 9928 { 9929 i6addr_t zero; 9930 int i, j; 9931 9932 mtab->imt6_masks[bits]--; 9933 if (mtab->imt6_masks[bits] > 0) 9934 return; 9935 9936 if (bits == 0) 9937 mask = &zero; 9938 zero.i6[0] = 0; 9939 zero.i6[1] = 0; 9940 zero.i6[2] = 0; 9941 zero.i6[3] = 0; 9942 9943 for (i = 0; i < 129; i++) { 9944 if (IP6_EQ(&mtab->imt6_active[i], mask)) { 9945 for (j = i + 1; j < 129; j++) { 9946 mtab->imt6_active[j - 1] = mtab->imt6_active[j]; 9947 if (IP6_EQ(&mtab->imt6_active[j - 1], &zero)) 9948 break; 9949 } 9950 break; 9951 } 9952 } 9953 mtab->imt6_max--; 9954 ASSERT(mtab->imt6_max >= 0); 9955 } 9956 #endif 9957