xref: /netbsd-src/sys/external/bsd/ipf/netinet/ip_fil_netbsd.c (revision b7b7574d3bf8eeb51a1fa3977b59142ec6434a55)
1 /*	$NetBSD: ip_fil_netbsd.c,v 1.10 2014/06/05 23:48:16 rmind Exp $	*/
2 
3 /*
4  * Copyright (C) 2012 by Darren Reed.
5  *
6  * See the IPFILTER.LICENCE file for details on licencing.
7  */
8 #if !defined(lint)
9 #if defined(__NetBSD__)
10 #include <sys/cdefs.h>
11 __KERNEL_RCSID(0, "$NetBSD: ip_fil_netbsd.c,v 1.10 2014/06/05 23:48:16 rmind Exp $");
12 #else
13 static const char sccsid[] = "@(#)ip_fil.c	2.41 6/5/96 (C) 1993-2000 Darren Reed";
14 static const char rcsid[] = "@(#)Id: ip_fil_netbsd.c,v 1.1.1.2 2012/07/22 13:45:17 darrenr Exp";
15 #endif
16 #endif
17 
18 #if defined(KERNEL) || defined(_KERNEL)
19 # undef KERNEL
20 # undef _KERNEL
21 # define        KERNEL	1
22 # define        _KERNEL	1
23 #endif
24 #include <sys/param.h>
25 #if (NetBSD >= 199905) && !defined(IPFILTER_LKM)
26 # include "opt_ipsec.h"
27 #endif
28 #include <sys/errno.h>
29 #include <sys/types.h>
30 #include <sys/file.h>
31 #include <sys/ioctl.h>
32 #include <sys/time.h>
33 #include <sys/systm.h>
34 #include <sys/select.h>
35 #if (NetBSD > 199609)
36 # include <sys/dirent.h>
37 #else
38 # include <sys/dir.h>
39 #endif
40 #if (__NetBSD_Version__ >= 599005900)
41 # include <sys/cprng.h>
42 #endif
43 #include <sys/mbuf.h>
44 #include <sys/protosw.h>
45 #include <sys/socket.h>
46 #include <sys/poll.h>
47 #if (__NetBSD_Version__ >= 399002000)
48 # include <sys/kauth.h>
49 #endif
50 
51 #include <net/if.h>
52 #include <net/route.h>
53 #include <netinet/in.h>
54 #include <netinet/in_var.h>
55 #include <netinet/in_systm.h>
56 #include <netinet/ip.h>
57 #include <netinet/ip_var.h>
58 #include <netinet/tcp.h>
59 #if __NetBSD_Version__ >= 105190000	/* 1.5T */
60 # include <netinet/tcp_timer.h>
61 # include <netinet/tcp_var.h>
62 #endif
63 #include <netinet/udp.h>
64 #include <netinet/tcpip.h>
65 #include <netinet/ip_icmp.h>
66 #include "netinet/ip_compat.h"
67 #ifdef USE_INET6
68 # include <netinet/icmp6.h>
69 # if (__NetBSD_Version__ >= 106000000)
70 #  include <netinet6/nd6.h>
71 # endif
72 #endif
73 #include "netinet/ip_fil.h"
74 #include "netinet/ip_nat.h"
75 #include "netinet/ip_frag.h"
76 #include "netinet/ip_state.h"
77 #include "netinet/ip_proxy.h"
78 #include "netinet/ip_auth.h"
79 #include "netinet/ip_sync.h"
80 #include "netinet/ip_lookup.h"
81 #include "netinet/ip_dstlist.h"
82 #ifdef	IPFILTER_SCAN
83 #include "netinet/ip_scan.h"
84 #endif
85 #include <sys/md5.h>
86 #include <sys/kernel.h>
87 #include <sys/conf.h>
88 #ifdef INET
89 extern	int	ip_optcopy (struct ip *, struct ip *);
90 #endif
91 
92 #ifdef IPFILTER_M_IPFILTER
93 MALLOC_DEFINE(M_IPFILTER, "IP Filter", "IP Filter packet filter data structures");
94 #endif
95 
96 #if __NetBSD_Version__ >= 105009999
97 # define	csuminfo	csum_flags
98 #endif
99 
100 #if __NetBSD_Version__ < 200000000
101 extern	struct	protosw	inetsw[];
102 #endif
103 
104 #if (__NetBSD_Version__ >= 599002000)
105 static kauth_listener_t ipf_listener;
106 #endif
107 
108 #if (__NetBSD_Version__ < 399001400)
109 extern int ip6_getpmtu (struct route_in6 *, struct route_in6 *,
110 			    struct ifnet *, struct in6_addr *, u_long *,
111 			    int *);
112 #endif
113 #if (NetBSD >= 199511)
114 static  int     ipfopen(dev_t dev, int flags, int devtype, PROC_T *p);
115 static  int     ipfclose(dev_t dev, int flags, int devtype, PROC_T *p);
116 #else
117 # if (__NetBSD_Version__ >= 399001400)
118 static  int     ipfopen(dev_t dev, int flags, struct lwp *);
119 static  int     ipfclose(dev_t dev, int flags, struct lwp *);
120 # else
121 static  int     ipfopen(dev_t dev, int flags);
122 static  int     ipfclose(dev_t dev, int flags);
123 # endif /* __NetBSD_Version__ >= 399001400 */
124 #endif
125 static  int     ipfread(dev_t, struct uio *, int ioflag);
126 static  int     ipfwrite(dev_t, struct uio *, int ioflag);
127 static  int     ipfpoll(dev_t, int events, PROC_T *);
128 static	void	ipf_timer_func(void *ptr);
129 
130 const struct cdevsw ipl_cdevsw = {
131 	.d_open = ipfopen,
132 	.d_close = ipfclose,
133 	.d_read = ipfread,
134 	.d_write = ipfwrite,
135 	.d_ioctl = ipfioctl,
136 	.d_stop = nostop,
137 	.d_tty = notty,
138 	.d_poll = ipfpoll,
139 	.d_mmap = nommap,
140 #if  (__NetBSD_Version__ >= 200000000)
141 	.d_kqfilter = nokqfilter,
142 #endif
143 #ifdef D_OTHER
144 	.d_flag = D_OTHER
145 #else
146 	.d_flag = 0
147 #endif
148 };
149 
150 ipf_main_softc_t ipfmain;
151 
152 static	u_short	ipid = 0;
153 static	int	(*ipf_savep)(void *, ip_t *, int, void *, int, struct mbuf **);
154 static	int	ipf_send_ip(fr_info_t *, mb_t *);
155 #ifdef USE_INET6
156 static int ipf_fastroute6(struct mbuf *, struct mbuf **,
157 			      fr_info_t *, frdest_t *);
158 #endif
159 
160 #if defined(NETBSD_PF)
161 # include <net/pfil.h>
162 /*
163  * We provide the ipf_checkp name just to minimize changes later.
164  */
165 int (*ipf_checkp)(void *, ip_t *ip, int hlen, void *ifp, int out, mb_t **mp);
166 #endif /* NETBSD_PF */
167 
168 #if defined(__NetBSD_Version__) && (__NetBSD_Version__ >= 105110000)
169 # include <net/pfil.h>
170 
171 static int ipf_check_wrapper(void *, struct mbuf **, struct ifnet *, int );
172 
173 static int
174 ipf_check_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir)
175 {
176 	struct ip *ip;
177 	int rv, hlen;
178 
179 #if __NetBSD_Version__ >= 200080000
180 	/*
181 	 * ensure that mbufs are writable beforehand
182 	 * as it's assumed by ipf code.
183 	 * XXX inefficient
184 	 */
185 	int error = m_makewritable(mp, 0, M_COPYALL, M_DONTWAIT);
186 
187 	if (error) {
188 		m_freem(*mp);
189 		*mp = NULL;
190 		return error;
191 	}
192 #endif
193 	ip = mtod(*mp, struct ip *);
194 	hlen = ip->ip_hl << 2;
195 
196 #ifdef INET
197 #if defined(M_CSUM_TCPv4)
198 	/*
199 	 * If the packet is out-bound, we can't delay checksums
200 	 * here.  For in-bound, the checksum has already been
201 	 * validated.
202 	 */
203 	if (dir == PFIL_OUT) {
204 		if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) {
205 			in_delayed_cksum(*mp);
206 			(*mp)->m_pkthdr.csum_flags &=
207 			    ~(M_CSUM_TCPv4|M_CSUM_UDPv4);
208 		}
209 	}
210 #endif /* M_CSUM_TCPv4 */
211 #endif /* INET */
212 
213 	/*
214 	 * Note, we don't need to update the checksum, because
215 	 * it has already been verified.
216 	 */
217 	rv = ipf_check(&ipfmain, ip, hlen, ifp, (dir == PFIL_OUT), mp);
218 
219 	return (rv);
220 }
221 
222 # ifdef USE_INET6
223 #  include <netinet/ip6.h>
224 
225 static int ipf_check_wrapper6(void *, struct mbuf **, struct ifnet *, int );
226 
227 static int
228 ipf_check_wrapper6(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir)
229 {
230 #if defined(INET6)
231 #  if defined(M_CSUM_TCPv6) && (__NetBSD_Version__ > 200000000)
232 	/*
233 	 * If the packet is out-bound, we can't delay checksums
234 	 * here.  For in-bound, the checksum has already been
235 	 * validated.
236 	 */
237 	if (dir == PFIL_OUT) {
238 		if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv6|M_CSUM_UDPv6)) {
239 #   if (__NetBSD_Version__ > 399000600)
240 			in6_delayed_cksum(*mp);
241 #   endif
242 			(*mp)->m_pkthdr.csum_flags &= ~(M_CSUM_TCPv6|
243 							M_CSUM_UDPv6);
244 		}
245 	}
246 #  endif
247 #endif /* INET6 */
248 
249 	return (ipf_check(&ipfmain, mtod(*mp, struct ip *), sizeof(struct ip6_hdr),
250 	    ifp, (dir == PFIL_OUT), mp));
251 }
252 # endif
253 
254 
255 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET)
256 static int ipf_pfilsync(void *, struct mbuf **, struct ifnet *, int);
257 
258 static int
259 ipf_pfilsync(void *hdr, struct mbuf **mp, struct ifnet *ifp, int dir)
260 {
261 	/*
262 	 * The interface pointer is useless for create (we have nothing to
263 	 * compare it to) and at detach, the interface name is still in the
264 	 * list of active NICs (albeit, down, but that's not any real
265 	 * indicator) and doing ifunit() on the name will still return the
266 	 * pointer, so it's not much use then, either.
267 	 */
268 	ipf_sync(&ipfmain, NULL);
269 	return 0;
270 }
271 # endif
272 
273 #endif /* __NetBSD_Version__ >= 105110000 */
274 
275 
276 #if defined(IPFILTER_LKM)
277 int
278 ipf_identify(s)
279 	char *s;
280 {
281 	if (strcmp(s, "ipl") == 0)
282 		return 1;
283 	return 0;
284 }
285 #endif /* IPFILTER_LKM */
286 
287 #if (__NetBSD_Version__ >= 599002000)
288 static int
289 ipf_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
290     void *arg0, void *arg1, void *arg2, void *arg3)
291 {
292 	int result;
293 	enum kauth_network_req req;
294 
295 	result = KAUTH_RESULT_DEFER;
296 	req = (enum kauth_network_req)arg0;
297 
298 	if (action != KAUTH_NETWORK_FIREWALL)
299 		return result;
300 
301 	/* These must have came from device context. */
302 	if ((req == KAUTH_REQ_NETWORK_FIREWALL_FW) ||
303 	    (req == KAUTH_REQ_NETWORK_FIREWALL_NAT))
304 		result = KAUTH_RESULT_ALLOW;
305 
306 	return result;
307 }
308 #endif
309 
310 /*
311  * Try to detect the case when compiling for NetBSD with pseudo-device
312  */
313 void
314 ipfilterattach(int count)
315 {
316 
317 #if (__NetBSD_Version__ >= 599002000)
318 	ipf_listener = kauth_listen_scope(KAUTH_SCOPE_NETWORK,
319 	    ipf_listener_cb, NULL);
320 #endif
321 
322 	if (ipf_load_all() == 0)
323 		(void) ipf_create_all(&ipfmain);
324 }
325 
326 
327 int
328 ipfattach(ipf_main_softc_t *softc)
329 {
330 	SPL_INT(s);
331 #if (__NetBSD_Version__ >= 499005500)
332 	int i;
333 #endif
334 #if defined(NETBSD_PF) && (__NetBSD_Version__ >= 104200000)
335 	int error = 0;
336 # if defined(__NetBSD_Version__) && (__NetBSD_Version__ >= 105110000)
337         pfil_head_t *ph_inet;
338 #  ifdef USE_INET6
339         pfil_head_t *ph_inet6;
340 #  endif
341 #  if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET)
342         pfil_head_t *ph_ifsync;
343 #  endif
344 # endif
345 #endif
346 
347 	SPL_NET(s);
348 	if ((softc->ipf_running > 0) || (ipf_checkp == ipf_check)) {
349 		printf("IP Filter: already initialized\n");
350 		SPL_X(s);
351 		IPFERROR(130017);
352 		return EBUSY;
353 	}
354 
355 	if (ipf_init_all(softc) < 0) {
356 		SPL_X(s);
357 		IPFERROR(130015);
358 		return EIO;
359 	}
360 
361 #ifdef NETBSD_PF
362 # if (__NetBSD_Version__ >= 104200000)
363 #  if __NetBSD_Version__ >= 105110000
364 	ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET);
365 #   ifdef USE_INET6
366 	ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6);
367 #   endif
368 #   if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET)
369 	ph_ifsync = pfil_head_get(PFIL_TYPE_IFNET, 0);
370 #   endif
371 
372 	if (ph_inet == NULL
373 #   ifdef USE_INET6
374 	    && ph_inet6 == NULL
375 #   endif
376 #   if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET)
377 	    && ph_ifsync == NULL
378 #   endif
379 	   ) {
380 		SPL_X(s);
381 		IPFERROR(130016);
382 		return ENODEV;
383 	}
384 
385 	if (ph_inet != NULL)
386 		error = pfil_add_hook((void *)ipf_check_wrapper, NULL,
387 				      PFIL_IN|PFIL_OUT, ph_inet);
388 	else
389 		error = 0;
390 #  else
391 	error = pfil_add_hook((void *)ipf_check, PFIL_IN|PFIL_OUT,
392 			      &inetsw[ip_protox[IPPROTO_IP]].pr_pfh);
393 #  endif
394 	if (error) {
395 		IPFERROR(130013);
396 		goto pfil_error;
397 	}
398 # else
399 	pfil_add_hook((void *)ipf_check, PFIL_IN|PFIL_OUT);
400 # endif
401 
402 # ifdef USE_INET6
403 #  if __NetBSD_Version__ >= 105110000
404 	if (ph_inet6 != NULL)
405 		error = pfil_add_hook((void *)ipf_check_wrapper6, NULL,
406 				      PFIL_IN|PFIL_OUT, ph_inet6);
407 	else
408 		error = 0;
409 	if (error) {
410 		pfil_remove_hook((void *)ipf_check_wrapper6, NULL,
411 				 PFIL_IN|PFIL_OUT, ph_inet6);
412 		ipfmain.ipf_interror = 130014;
413 		goto pfil_error;
414 	}
415 #  else
416 	error = pfil_add_hook((void *)ipf_check, PFIL_IN|PFIL_OUT,
417 			      &inetsw[ip_protox[IPPROTO_IPV6]].pr_pfh);
418 	if (error) {
419 		pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT,
420 				 &inetsw[ip_protox[IPPROTO_IP]].pr_pfh);
421 		IPFERROR(130014);
422 		goto pfil_error;
423 	}
424 #  endif
425 # endif
426 
427 # if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET)
428 	if (ph_ifsync != NULL)
429 		(void) pfil_add_hook((void *)ipf_pfilsync, NULL,
430 				     PFIL_IFNET, ph_ifsync);
431 # endif
432 #endif
433 
434 #if (__NetBSD_Version__ >= 499005500)
435 	for (i = 0; i < IPL_LOGSIZE; i++)
436 		selinit(&ipfmain.ipf_selwait[i]);
437 #else
438 	bzero((char *)ipfmain.ipf_selwait, sizeof(ipfmain.ipf_selwait));
439 #endif
440 	ipf_savep = ipf_checkp;
441 	ipf_checkp = ipf_check;
442 
443 #ifdef INET
444 	if (softc->ipf_control_forwarding & 1)
445 		ipforwarding = 1;
446 #endif
447 
448 	ipid = 0;
449 
450 	SPL_X(s);
451 
452 #if (__NetBSD_Version__ >= 104010000)
453 # if (__NetBSD_Version__ >= 499002000)
454 	callout_init(&softc->ipf_slow_ch, 0);
455 # else
456 	callout_init(&softc->ipf_slow_ch);
457 # endif
458 	callout_reset(&softc->ipf_slow_ch, (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT,
459 		     ipf_timer_func, softc);
460 #else
461 	timeout(ipf_timer_func, softc, (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT);
462 #endif
463 
464 	return 0;
465 
466 #if __NetBSD_Version__ >= 105110000
467 pfil_error:
468 	SPL_X(s);
469 	ipf_fini_all(softc);
470 	return error;
471 #endif
472 }
473 
474 static void
475 ipf_timer_func(void *ptr)
476 {
477 	ipf_main_softc_t *softc = ptr;
478 	SPL_INT(s);
479 
480 	SPL_NET(s);
481 	READ_ENTER(&softc->ipf_global);
482 
483 	if (softc->ipf_running > 0)
484 		ipf_slowtimer(softc);
485 
486 	if (softc->ipf_running == -1 || softc->ipf_running == 1) {
487 #if NETBSD_GE_REV(104240000)
488 		callout_reset(&softc->ipf_slow_ch, hz / 2,
489 			      ipf_timer_func, softc);
490 #else
491 		timeout(ipf_timer_func, softc,
492 			(hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT);
493 #endif
494 	}
495 	RWLOCK_EXIT(&softc->ipf_global);
496 	SPL_X(s);
497 }
498 
499 
500 /*
501  * Disable the filter by removing the hooks from the IP input/output
502  * stream.
503  */
504 int
505 ipfdetach(ipf_main_softc_t *softc)
506 {
507 	SPL_INT(s);
508 #if (__NetBSD_Version__ >= 499005500)
509 	int i;
510 #endif
511 #if defined(NETBSD_PF) && (__NetBSD_Version__ >= 104200000)
512 	int error = 0;
513 # if __NetBSD_Version__ >= 105150000
514 	pfil_head_t *ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET);
515 #  ifdef USE_INET6
516 	pfil_head_t *ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6);
517 #  endif
518 #  if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET)
519 	struct pfil_head *ph_ifsync = pfil_head_get(PFIL_TYPE_IFNET, 0);
520 #  endif
521 # endif
522 #endif
523 
524 	SPL_NET(s);
525 
526 #if (__NetBSD_Version__ >= 104010000)
527 	if (softc->ipf_running > 0)
528 		callout_stop(&softc->ipf_slow_ch);
529 #else
530 	untimeout(ipf_slowtimer, NULL);
531 #endif /* NetBSD */
532 
533 	ipf_checkp = ipf_savep;
534 	(void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE|FR_INACTIVE);
535 	(void) ipf_flush(softc, IPL_LOGIPF, FR_INQUE|FR_OUTQUE);
536 
537 #ifdef INET
538 	if (softc->ipf_control_forwarding & 2)
539 		ipforwarding = 0;
540 #endif
541 
542 #ifdef NETBSD_PF
543 # if (__NetBSD_Version__ >= 104200000)
544 #  if __NetBSD_Version__ >= 105110000
545 #   if defined(PFIL_TYPE_IFNET) && defined(PFIL_IFNET)
546 	(void) pfil_remove_hook((void *)ipf_pfilsync, NULL,
547 				PFIL_IFNET, ph_ifsync);
548 #   endif
549 
550 	if (ph_inet != NULL)
551 		error = pfil_remove_hook((void *)ipf_check_wrapper, NULL,
552 					 PFIL_IN|PFIL_OUT, ph_inet);
553 	else
554 		error = 0;
555 #  else
556 	error = pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT,
557 				 &inetsw[ip_protox[IPPROTO_IP]].pr_pfh);
558 #  endif
559 	if (error) {
560 		SPL_X(s);
561 		IPFERROR(130011);
562 		return error;
563 	}
564 # else
565 	pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT);
566 # endif
567 # ifdef USE_INET6
568 #  if __NetBSD_Version__ >= 105110000
569 	if (ph_inet6 != NULL)
570 		error = pfil_remove_hook((void *)ipf_check_wrapper6, NULL,
571 					 PFIL_IN|PFIL_OUT, ph_inet6);
572 	else
573 		error = 0;
574 #  else
575 	error = pfil_remove_hook((void *)ipf_check, PFIL_IN|PFIL_OUT,
576 				 &inetsw[ip_protox[IPPROTO_IPV6]].pr_pfh);
577 #  endif
578 	if (error) {
579 		SPL_X(s);
580 		IPFERROR(130012);
581 		return error;
582 	}
583 # endif
584 #endif
585 	SPL_X(s);
586 
587 #if (__NetBSD_Version__ >= 499005500)
588 	for (i = 0; i < IPL_LOGSIZE; i++)
589 		seldestroy(&ipfmain.ipf_selwait[i]);
590 #endif
591 
592 	ipf_fini_all(softc);
593 
594 	return 0;
595 }
596 
597 
598 /*
599  * Filter ioctl interface.
600  */
601 int
602 ipfioctl(dev_t dev, u_long cmd,
603 #if  (__NetBSD_Version__ >= 499001000)
604 	void *data,
605 #else
606 	caddr_t data,
607 #endif
608 	int mode
609 #if (NetBSD >= 199511)
610 # if  (__NetBSD_Version__ >= 399001400)
611 	, struct lwp *p
612 #   if (__NetBSD_Version__ >= 399002000)
613 #     define	UID(l)	kauth_cred_getuid((l)->l_cred)
614 #  else
615 #     define	UID(l)	((l)->l_proc->p_cred->p_ruid)
616 #  endif
617 # else
618 	, struct proc *p
619 #  define	UID(p)	((p)->p_cred->p_ruid)
620 # endif
621 #endif
622 )
623 {
624 	int error = 0, unit = 0;
625 	SPL_INT(s);
626 
627 #if (__NetBSD_Version__ >= 399002000)
628 	if ((mode & FWRITE) &&
629 	    kauth_authorize_network(p->l_cred, KAUTH_NETWORK_FIREWALL,
630 				    KAUTH_REQ_NETWORK_FIREWALL_FW, NULL,
631 				    NULL, NULL)) {
632 		ipfmain.ipf_interror = 130005;
633 		return EPERM;
634 	}
635 #else
636 	if ((securelevel >= 2) && (mode & FWRITE)) {
637 		ipfmain.ipf_interror = 130001;
638 		return EPERM;
639 	}
640 #endif
641 
642   	unit = GET_MINOR(dev);
643   	if ((IPL_LOGMAX < unit) || (unit < 0)) {
644 		ipfmain.ipf_interror = 130002;
645 		return ENXIO;
646 	}
647 
648 	if (ipfmain.ipf_running <= 0) {
649 		if (unit != IPL_LOGIPF && cmd != SIOCIPFINTERROR) {
650 			ipfmain.ipf_interror = 130003;
651 			return EIO;
652 		}
653 		if (cmd != SIOCIPFGETNEXT && cmd != SIOCIPFGET &&
654 		    cmd != SIOCIPFSET && cmd != SIOCFRENB &&
655 		    cmd != SIOCGETFS && cmd != SIOCGETFF &&
656 		    cmd != SIOCIPFINTERROR) {
657 			ipfmain.ipf_interror = 130004;
658 			return EIO;
659 		}
660 	}
661 
662 	SPL_NET(s);
663 
664 	error = ipf_ioctlswitch(&ipfmain, unit, data, cmd, mode, UID(p), p);
665 	if (error != -1) {
666 		SPL_X(s);
667 		return error;
668 	}
669 
670 	SPL_X(s);
671 	return error;
672 }
673 
674 
675 /*
676  * ipf_send_reset - this could conceivably be a call to tcp_respond(), but that
677  * requires a large amount of setting up and isn't any more efficient.
678  */
679 int
680 ipf_send_reset(fr_info_t *fin)
681 {
682 	struct tcphdr *tcp, *tcp2;
683 	int tlen = 0, hlen;
684 	struct mbuf *m;
685 #ifdef USE_INET6
686 	ip6_t *ip6;
687 #endif
688 	ip_t *ip;
689 
690 	tcp = fin->fin_dp;
691 	if (tcp->th_flags & TH_RST)
692 		return -1;		/* feedback loop */
693 
694 	if (ipf_checkl4sum(fin) == -1)
695 		return -1;
696 
697 	tlen = fin->fin_dlen - (TCP_OFF(tcp) << 2) +
698 			((tcp->th_flags & TH_SYN) ? 1 : 0) +
699 			((tcp->th_flags & TH_FIN) ? 1 : 0);
700 
701 #ifdef USE_INET6
702 	hlen = (fin->fin_v == 6) ? sizeof(ip6_t) : sizeof(ip_t);
703 #else
704 	hlen = sizeof(ip_t);
705 #endif
706 #ifdef MGETHDR
707 	MGETHDR(m, M_DONTWAIT, MT_HEADER);
708 #else
709 	MGET(m, M_DONTWAIT, MT_HEADER);
710 #endif
711 	if (m == NULL)
712 		return -1;
713 	if (sizeof(*tcp2) + hlen > MHLEN) {
714 		MCLGET(m, M_DONTWAIT);
715 		if (m == NULL)
716 			return -1;
717 		if ((m->m_flags & M_EXT) == 0) {
718 			FREE_MB_T(m);
719 			return -1;
720 		}
721 	}
722 
723 	m->m_len = sizeof(*tcp2) + hlen;
724 	m->m_data += max_linkhdr;
725 	m->m_pkthdr.len = m->m_len;
726 	m->m_pkthdr.rcvif = (struct ifnet *)0;
727 	ip = mtod(m, struct ip *);
728 	bzero((char *)ip, hlen);
729 #ifdef USE_INET6
730 	ip6 = (ip6_t *)ip;
731 #endif
732 	bzero((char *)ip, sizeof(*tcp2) + hlen);
733 	tcp2 = (struct tcphdr *)((char *)ip + hlen);
734 	tcp2->th_sport = tcp->th_dport;
735 	tcp2->th_dport = tcp->th_sport;
736 
737 	if (tcp->th_flags & TH_ACK) {
738 		tcp2->th_seq = tcp->th_ack;
739 		tcp2->th_flags = TH_RST;
740 		tcp2->th_ack = 0;
741 	} else {
742 		tcp2->th_seq = 0;
743 		tcp2->th_ack = ntohl(tcp->th_seq);
744 		tcp2->th_ack += tlen;
745 		tcp2->th_ack = htonl(tcp2->th_ack);
746 		tcp2->th_flags = TH_RST|TH_ACK;
747 	}
748 	tcp2->th_x2 = 0;
749 	TCP_OFF_A(tcp2, sizeof(*tcp2) >> 2);
750 	tcp2->th_win = tcp->th_win;
751 	tcp2->th_sum = 0;
752 	tcp2->th_urp = 0;
753 
754 #ifdef USE_INET6
755 	if (fin->fin_v == 6) {
756 		ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow;
757 		ip6->ip6_plen = htons(sizeof(struct tcphdr));
758 		ip6->ip6_nxt = IPPROTO_TCP;
759 		ip6->ip6_hlim = 0;
760 		ip6->ip6_src = fin->fin_dst6.in6;
761 		ip6->ip6_dst = fin->fin_src6.in6;
762 		tcp2->th_sum = in6_cksum(m, IPPROTO_TCP,
763 					 sizeof(*ip6), sizeof(*tcp2));
764 		return ipf_send_ip(fin, m);
765 	}
766 #endif
767 #ifdef INET
768 	ip->ip_p = IPPROTO_TCP;
769 	ip->ip_len = htons(sizeof(struct tcphdr));
770 	ip->ip_src.s_addr = fin->fin_daddr;
771 	ip->ip_dst.s_addr = fin->fin_saddr;
772 	tcp2->th_sum = in_cksum(m, hlen + sizeof(*tcp2));
773 	ip->ip_len = hlen + sizeof(*tcp2);
774 	return ipf_send_ip(fin, m);
775 #else
776 	return 0;
777 #endif
778 }
779 
780 
781 /*
782  * Expects ip_len to be in host byte order when called.
783  */
784 static int
785 ipf_send_ip(fr_info_t *fin, mb_t *m)
786 {
787 	fr_info_t fnew;
788 #ifdef INET
789 	ip_t *oip;
790 #endif
791 	ip_t *ip;
792 	int hlen;
793 
794 	ip = mtod(m, ip_t *);
795 	bzero((char *)&fnew, sizeof(fnew));
796 	fnew.fin_main_soft = fin->fin_main_soft;
797 
798 	IP_V_A(ip, fin->fin_v);
799 	switch (fin->fin_v)
800 	{
801 #ifdef INET
802 	case 4 :
803 		oip = fin->fin_ip;
804 		hlen = sizeof(*oip);
805 		fnew.fin_v = 4;
806 		fnew.fin_p = ip->ip_p;
807 		fnew.fin_plen = ntohs(ip->ip_len);
808 		HTONS(ip->ip_len);
809 		IP_HL_A(ip, sizeof(*oip) >> 2);
810 		ip->ip_tos = oip->ip_tos;
811 		ip->ip_id = ipf_nextipid(fin);
812 		ip->ip_off = htons(ip_mtudisc ? IP_DF : 0);
813 		ip->ip_ttl = ip_defttl;
814 		ip->ip_sum = 0;
815 		break;
816 #endif
817 #ifdef USE_INET6
818 	case 6 :
819 	{
820 		ip6_t *ip6 = (ip6_t *)ip;
821 
822 		ip6->ip6_vfc = 0x60;
823 		ip6->ip6_hlim = IPDEFTTL;
824 
825 		hlen = sizeof(*ip6);
826 		fnew.fin_p = ip6->ip6_nxt;
827 		fnew.fin_v = 6;
828 		fnew.fin_plen = ntohs(ip6->ip6_plen) + hlen;
829 		break;
830 	}
831 #endif
832 	default :
833 		return EINVAL;
834 	}
835 #ifdef KAME_IPSEC
836 	m->m_pkthdr.rcvif = NULL;
837 #endif
838 
839 	fnew.fin_ifp = fin->fin_ifp;
840 	fnew.fin_flx = FI_NOCKSUM;
841 	fnew.fin_m = m;
842 	fnew.fin_ip = ip;
843 	fnew.fin_mp = &m;
844 	fnew.fin_hlen = hlen;
845 	fnew.fin_dp = (char *)ip + hlen;
846 	(void) ipf_makefrip(hlen, ip, &fnew);
847 
848 	return ipf_fastroute(m, &m, &fnew, NULL);
849 }
850 
851 
852 int
853 ipf_send_icmp_err(int type, fr_info_t *fin, int dst)
854 {
855 	int err, hlen, xtra, iclen, ohlen, avail;
856 	struct in_addr dst4;
857 	struct icmp *icmp;
858 	struct mbuf *m;
859 	i6addr_t dst6;
860 	void *ifp;
861 #ifdef USE_INET6
862 	int code;
863 	ip6_t *ip6;
864 #endif
865 	ip_t *ip, *ip2;
866 
867 	if ((type < 0) || (type > ICMP_MAXTYPE))
868 		return -1;
869 
870 #ifdef USE_INET6
871 	code = fin->fin_icode;
872 	if ((code < 0) || (code >= sizeof(icmptoicmp6unreach)/sizeof(int)))
873 		return -1;
874 #endif
875 
876 	if (ipf_checkl4sum(fin) == -1)
877 		return -1;
878 #ifdef MGETHDR
879 	MGETHDR(m, M_DONTWAIT, MT_HEADER);
880 #else
881 	MGET(m, M_DONTWAIT, MT_HEADER);
882 #endif
883 	if (m == NULL)
884 		return -1;
885 	avail = MHLEN;
886 
887 	xtra = 0;
888 	hlen = 0;
889 	ohlen = 0;
890 	dst4.s_addr = 0;
891 	ifp = fin->fin_ifp;
892 	if (fin->fin_v == 4) {
893 		if ((fin->fin_p == IPPROTO_ICMP) && !(fin->fin_flx & FI_SHORT))
894 			switch (ntohs(fin->fin_data[0]) >> 8)
895 			{
896 			case ICMP_ECHO :
897 			case ICMP_TSTAMP :
898 			case ICMP_IREQ :
899 			case ICMP_MASKREQ :
900 				break;
901 			default :
902 				FREE_MB_T(m);
903 				return 0;
904 			}
905 
906 		if (dst == 0) {
907 			if (ipf_ifpaddr(&ipfmain, 4, FRI_NORMAL, ifp,
908 				       &dst6, NULL) == -1) {
909 				FREE_MB_T(m);
910 				return -1;
911 			}
912 			dst4 = dst6.in4;
913 		} else
914 			dst4.s_addr = fin->fin_daddr;
915 
916 		hlen = sizeof(ip_t);
917 		ohlen = fin->fin_hlen;
918 		iclen = hlen + offsetof(struct icmp, icmp_ip) + ohlen;
919 		if (fin->fin_hlen < fin->fin_plen)
920 			xtra = MIN(fin->fin_dlen, 8);
921 		else
922 			xtra = 0;
923 	}
924 
925 #ifdef USE_INET6
926 	else if (fin->fin_v == 6) {
927 		hlen = sizeof(ip6_t);
928 		ohlen = sizeof(ip6_t);
929 		iclen = hlen + offsetof(struct icmp, icmp_ip) + ohlen;
930 		type = icmptoicmp6types[type];
931 		if (type == ICMP6_DST_UNREACH)
932 			code = icmptoicmp6unreach[code];
933 
934 		if (iclen + max_linkhdr + fin->fin_plen > avail) {
935 			MCLGET(m, M_DONTWAIT);
936 			if (m == NULL)
937 				return -1;
938 			if ((m->m_flags & M_EXT) == 0) {
939 				FREE_MB_T(m);
940 				return -1;
941 			}
942 			avail = MCLBYTES;
943 		}
944 		xtra = MIN(fin->fin_plen, avail - iclen - max_linkhdr);
945 		xtra = MIN(xtra, IPV6_MMTU - iclen);
946 		if (dst == 0) {
947 			if (ipf_ifpaddr(&ipfmain, 6, FRI_NORMAL, ifp,
948 				       &dst6, NULL) == -1) {
949 				FREE_MB_T(m);
950 				return -1;
951 			}
952 		} else
953 			dst6 = fin->fin_dst6;
954 	}
955 #endif
956 	else {
957 		FREE_MB_T(m);
958 		return -1;
959 	}
960 
961 	avail -= (max_linkhdr + iclen);
962 	if (avail < 0) {
963 		FREE_MB_T(m);
964 		return -1;
965 	}
966 	if (xtra > avail)
967 		xtra = avail;
968 	iclen += xtra;
969 	m->m_data += max_linkhdr;
970 	m->m_pkthdr.rcvif = (struct ifnet *)0;
971 	m->m_pkthdr.len = iclen;
972 	m->m_len = iclen;
973 	ip = mtod(m, ip_t *);
974 	icmp = (struct icmp *)((char *)ip + hlen);
975 	ip2 = (ip_t *)&icmp->icmp_ip;
976 
977 	icmp->icmp_type = type;
978 	icmp->icmp_code = fin->fin_icode;
979 	icmp->icmp_cksum = 0;
980 #ifdef icmp_nextmtu
981 	if (type == ICMP_UNREACH && fin->fin_icode == ICMP_UNREACH_NEEDFRAG) {
982 		if (fin->fin_mtu != 0) {
983 			icmp->icmp_nextmtu = htons(fin->fin_mtu);
984 
985 		} else if (ifp != NULL) {
986 			icmp->icmp_nextmtu = htons(GETIFMTU_4(ifp));
987 
988 		} else {	/* make up a number... */
989 			icmp->icmp_nextmtu = htons(fin->fin_plen - 20);
990 		}
991 	}
992 #endif
993 
994 	bcopy((char *)fin->fin_ip, (char *)ip2, ohlen);
995 
996 #if defined(M_CSUM_IPv4)
997 	/*
998 	 * Clear any in-bound checksum flags for this packet.
999 	 */
1000 	m->m_pkthdr.csuminfo = 0;
1001 #endif /* __NetBSD__ && M_CSUM_IPv4 */
1002 
1003 #ifdef USE_INET6
1004 	ip6 = (ip6_t *)ip;
1005 	if (fin->fin_v == 6) {
1006 		ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow;
1007 		ip6->ip6_plen = htons(iclen - hlen);
1008 		ip6->ip6_nxt = IPPROTO_ICMPV6;
1009 		ip6->ip6_hlim = 0;
1010 		ip6->ip6_src = dst6.in6;
1011 		ip6->ip6_dst = fin->fin_src6.in6;
1012 		if (xtra > 0)
1013 			bcopy((char *)fin->fin_ip + ohlen,
1014 			      (char *)&icmp->icmp_ip + ohlen, xtra);
1015 		icmp->icmp_cksum = in6_cksum(m, IPPROTO_ICMPV6,
1016 					     sizeof(*ip6), iclen - hlen);
1017 	} else
1018 #endif
1019 	{
1020 		ip->ip_p = IPPROTO_ICMP;
1021 		ip->ip_src.s_addr = dst4.s_addr;
1022 		ip->ip_dst.s_addr = fin->fin_saddr;
1023 
1024 		if (xtra > 0)
1025 			bcopy((char *)fin->fin_ip + ohlen,
1026 			      (char *)&icmp->icmp_ip + ohlen, xtra);
1027 		icmp->icmp_cksum = ipf_cksum((u_short *)icmp,
1028 					     sizeof(*icmp) + 8);
1029 		ip->ip_len = iclen;
1030 		ip->ip_p = IPPROTO_ICMP;
1031 	}
1032 	err = ipf_send_ip(fin, m);
1033 	return err;
1034 }
1035 
1036 
1037 /*
1038  * m0 - pointer to mbuf where the IP packet starts
1039  * mpp - pointer to the mbuf pointer that is the start of the mbuf chain
1040  */
1041 int
1042 ipf_fastroute(mb_t *m0, mb_t **mpp, fr_info_t *fin, frdest_t *fdp)
1043 {
1044 	register struct ip *ip, *mhip;
1045 	register struct mbuf *m = *mpp;
1046 	register struct route *ro;
1047 	int len, off, error = 0, hlen, code;
1048 	struct ifnet *ifp, *sifp;
1049 	ipf_main_softc_t *softc;
1050 #if __NetBSD_Version__ >= 499001100
1051 	union {
1052 		struct sockaddr         dst;
1053 		struct sockaddr_in      dst4;
1054 	} u;
1055 #else
1056 	struct sockaddr_in *dst4;
1057 #endif
1058 	struct sockaddr *dst;
1059 	u_short ip_off, ip_len;
1060 	struct route iproute;
1061 	struct rtentry *rt;
1062 	frdest_t node;
1063 	frentry_t *fr;
1064 
1065 	if (fin->fin_v == 6) {
1066 #ifdef USE_INET6
1067 		error = ipf_fastroute6(m0, mpp, fin, fdp);
1068 #else
1069 		error = EPROTONOSUPPORT;
1070 #endif
1071 		if ((error != 0) && (*mpp != NULL))
1072 			FREE_MB_T(*mpp);
1073 		return error;
1074 	}
1075 #ifndef INET
1076 	FREE_MB_T(*mpp);
1077 	return EPROTONOSUPPORT;
1078 #else
1079 
1080 	hlen = fin->fin_hlen;
1081 	ip = mtod(m0, struct ip *);
1082 	softc = fin->fin_main_soft;
1083 	rt = NULL;
1084 	ifp = NULL;
1085 
1086 # if defined(M_CSUM_IPv4)
1087 	/*
1088 	 * Clear any in-bound checksum flags for this packet.
1089 	 */
1090 	m0->m_pkthdr.csuminfo = 0;
1091 # endif /* __NetBSD__ && M_CSUM_IPv4 */
1092 
1093 	/*
1094 	 * Route packet.
1095 	 */
1096 	ro = &iproute;
1097 	memset(ro, 0, sizeof(*ro));
1098 	fr = fin->fin_fr;
1099 
1100 	if ((fr != NULL) && !(fr->fr_flags & FR_KEEPSTATE) && (fdp != NULL) &&
1101 	    (fdp->fd_type == FRD_DSTLIST)) {
1102 		if (ipf_dstlist_select_node(fin, fdp->fd_ptr, NULL, &node) == 0)
1103 			fdp = &node;
1104 	}
1105 	if (fdp != NULL)
1106 		ifp = fdp->fd_ptr;
1107 	else
1108 		ifp = fin->fin_ifp;
1109 
1110 	if ((ifp == NULL) && ((fr == NULL) || !(fr->fr_flags & FR_FASTROUTE))) {
1111 		error = -2;
1112 		goto bad;
1113 	}
1114 
1115 # if __NetBSD_Version__ >= 499001100
1116 	if ((fdp != NULL) && (fdp->fd_ip.s_addr != 0))
1117 		sockaddr_in_init(&u.dst4, &fdp->fd_ip, 0);
1118 	else
1119 		sockaddr_in_init(&u.dst4, &ip->ip_dst, 0);
1120 	dst = &u.dst;
1121 	rtcache_setdst(ro, dst);
1122 	rt = rtcache_init(ro);
1123 # else
1124 	dst4 = (struct sockaddr_in *)&ro->ro_dst;
1125 	dst = (struct sockaddr *)dst4;
1126 	dst4->sin_family = AF_INET;
1127 	dst4->sin_addr = ip->ip_dst;
1128 
1129 	if ((fdp != NULL) && (fdp->fd_ip.s_addr != 0))
1130 		dst4->sin_addr = fdp->fd_ip;
1131 
1132 	dst4->sin_len = sizeof(*dst);
1133 	rtalloc(ro);
1134 	rt = ro->ro_rt;
1135 # endif
1136 	if ((ifp == NULL) && (rt != NULL))
1137 		ifp = rt->rt_ifp;
1138 	if ((rt == NULL) || (ifp == NULL)) {
1139 #ifdef INET
1140 		if (in_localaddr(ip->ip_dst))
1141 			error = EHOSTUNREACH;
1142 		else
1143 #endif
1144 			error = ENETUNREACH;
1145 		goto bad;
1146 	}
1147 
1148 
1149 	if (rt->rt_flags & RTF_GATEWAY)
1150 		dst = rt->rt_gateway;
1151 
1152 	rt->rt_use++;
1153 
1154 	/*
1155 	 * For input packets which are being "fastrouted", they won't
1156 	 * go back through output filtering and miss their chance to get
1157 	 * NAT'd and counted.  Duplicated packets aren't considered to be
1158 	 * part of the normal packet stream, so do not NAT them or pass
1159 	 * them through stateful checking, etc.
1160 	 */
1161 	if ((fdp != &fr->fr_dif) && (fin->fin_out == 0)) {
1162 		sifp = fin->fin_ifp;
1163 		fin->fin_ifp = ifp;
1164 		fin->fin_out = 1;
1165 		(void) ipf_acctpkt(fin, NULL);
1166 		fin->fin_fr = NULL;
1167 		if (!fr || !(fr->fr_flags & FR_RETMASK)) {
1168 			u_32_t pass;
1169 
1170 			(void) ipf_state_check(fin, &pass);
1171 		}
1172 
1173 		switch (ipf_nat_checkout(fin, NULL))
1174 		{
1175 		case 0 :
1176 			break;
1177 		case 1 :
1178 			ip->ip_sum = 0;
1179 			break;
1180 		case -1 :
1181 			error = -1;
1182 			goto bad;
1183 			break;
1184 		}
1185 
1186 		fin->fin_ifp = sifp;
1187 		fin->fin_out = 0;
1188 	} else
1189 		ip->ip_sum = 0;
1190 	/*
1191 	 * If small enough for interface, can just send directly.
1192 	 */
1193 	m->m_pkthdr.rcvif = ifp;
1194 
1195 	ip_len = ntohs(ip->ip_len);
1196 	if (ip_len <= ifp->if_mtu) {
1197 # if defined(M_CSUM_IPv4)
1198 #  if (__NetBSD_Version__ >= 105009999)
1199 		if (ifp->if_csum_flags_tx & M_CSUM_IPv4)
1200 			m->m_pkthdr.csuminfo |= M_CSUM_IPv4;
1201 #  else
1202 		if (ifp->if_capabilities & IFCAP_CSUM_IPv4)
1203 			m->m_pkthdr.csuminfo |= M_CSUM_IPv4;
1204 #  endif /* (__NetBSD_Version__ >= 105009999) */
1205 		else if (ip->ip_sum == 0)
1206 			ip->ip_sum = in_cksum(m, hlen);
1207 # else
1208 		if (!ip->ip_sum)
1209 			ip->ip_sum = in_cksum(m, hlen);
1210 # endif /* M_CSUM_IPv4 */
1211 
1212 		KERNEL_LOCK(1, NULL);
1213 		error = (*ifp->if_output)(ifp, m, dst, rt);
1214 		KERNEL_UNLOCK_ONE(NULL);
1215 		goto done;
1216 	}
1217 
1218 	/*
1219 	 * Too large for interface; fragment if possible.
1220 	 * Must be able to put at least 8 bytes per fragment.
1221 	 */
1222 	ip_off = ntohs(ip->ip_off);
1223 	if (ip_off & IP_DF) {
1224 		error = EMSGSIZE;
1225 		goto bad;
1226 	}
1227 	len = (ifp->if_mtu - hlen) &~ 7;
1228 	if (len < 8) {
1229 		error = EMSGSIZE;
1230 		goto bad;
1231 	}
1232 
1233     {
1234 	int mhlen, firstlen = len;
1235 	struct mbuf **mnext = &m->m_act;
1236 
1237 	/*
1238 	 * Loop through length of segment after first fragment,
1239 	 * make new header and copy data of each part and link onto chain.
1240 	 */
1241 	m0 = m;
1242 	mhlen = sizeof (struct ip);
1243 	for (off = hlen + len; off < ip_len; off += len) {
1244 # ifdef MGETHDR
1245 		MGETHDR(m, M_DONTWAIT, MT_HEADER);
1246 # else
1247 		MGET(m, M_DONTWAIT, MT_HEADER);
1248 # endif
1249 		if (m == 0) {
1250 			m = m0;
1251 			error = ENOBUFS;
1252 			goto bad;
1253 		}
1254 		m->m_data += max_linkhdr;
1255 		mhip = mtod(m, struct ip *);
1256 		bcopy((char *)ip, (char *)mhip, sizeof(*ip));
1257 #ifdef INET
1258 		if (hlen > sizeof (struct ip)) {
1259 			mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip);
1260 			IP_HL_A(mhip, mhlen >> 2);
1261 		}
1262 #endif
1263 		m->m_len = mhlen;
1264 		mhip->ip_off = ((off - hlen) >> 3) + ip_off;
1265 		if (off + len >= ip_len)
1266 			len = ip_len - off;
1267 		else
1268 			mhip->ip_off |= IP_MF;
1269 		mhip->ip_len = htons((u_short)(len + mhlen));
1270 		m->m_next = m_copy(m0, off, len);
1271 		if (m->m_next == 0) {
1272 			error = ENOBUFS;	/* ??? */
1273 			goto sendorfree;
1274 		}
1275 		m->m_pkthdr.len = mhlen + len;
1276 		m->m_pkthdr.rcvif = NULL;
1277 		mhip->ip_off = htons((u_short)mhip->ip_off);
1278 		mhip->ip_sum = 0;
1279 #ifdef INET
1280 		mhip->ip_sum = in_cksum(m, mhlen);
1281 #endif
1282 		*mnext = m;
1283 		mnext = &m->m_act;
1284 	}
1285 	/*
1286 	 * Update first fragment by trimming what's been copied out
1287 	 * and updating header, then send each fragment (in order).
1288 	 */
1289 	m_adj(m0, hlen + firstlen - ip_len);
1290 	ip->ip_len = htons((u_short)(hlen + firstlen));
1291 	ip->ip_off = htons((u_short)IP_MF);
1292 	ip->ip_sum = 0;
1293 #ifdef INET
1294 	ip->ip_sum = in_cksum(m0, hlen);
1295 #endif
1296 sendorfree:
1297 	for (m = m0; m; m = m0) {
1298 		m0 = m->m_act;
1299 		m->m_act = 0;
1300 		if (error == 0) {
1301 			KERNEL_LOCK(1, NULL);
1302 			error = (*ifp->if_output)(ifp, m, dst, rt);
1303 			KERNEL_UNLOCK_ONE(NULL);
1304 		} else {
1305 			FREE_MB_T(m);
1306 		}
1307 	}
1308     }
1309 done:
1310 	if (!error)
1311 		softc->ipf_frouteok[0]++;
1312 	else
1313 		softc->ipf_frouteok[1]++;
1314 
1315 # if __NetBSD_Version__ >= 499001100
1316 	rtcache_free(ro);
1317 # else
1318 	if (rt) {
1319 		RTFREE(rt);
1320 	}
1321 # endif
1322 	return error;
1323 bad:
1324 	if (error == EMSGSIZE) {
1325 		sifp = fin->fin_ifp;
1326 		code = fin->fin_icode;
1327 		fin->fin_icode = ICMP_UNREACH_NEEDFRAG;
1328 		fin->fin_ifp = ifp;
1329 		(void) ipf_send_icmp_err(ICMP_UNREACH, fin, 1);
1330 		fin->fin_ifp = sifp;
1331 		fin->fin_icode = code;
1332 	}
1333 	FREE_MB_T(m);
1334 	goto done;
1335 #endif /* INET */
1336 }
1337 
1338 
1339 #if defined(USE_INET6)
1340 /*
1341  * This is the IPv6 specific fastroute code.  It doesn't clean up the mbuf's
1342  * or ensure that it is an IPv6 packet that is being forwarded, those are
1343  * expected to be done by the called (ipf_fastroute).
1344  */
1345 static int
1346 ipf_fastroute6(struct mbuf *m0, struct mbuf **mpp, fr_info_t *fin,
1347     frdest_t *fdp)
1348 {
1349 # if __NetBSD_Version__ >= 499001100
1350 	struct route ip6route;
1351 	const struct sockaddr *dst;
1352 	union {
1353 		struct sockaddr         dst;
1354 		struct sockaddr_in6     dst6;
1355 	} u;
1356 	struct route *ro;
1357 # else
1358 	struct route_in6 ip6route;
1359 	struct sockaddr_in6 *dst6;
1360 	struct route_in6 *ro;
1361 # endif
1362 	struct rtentry *rt;
1363 	struct ifnet *ifp;
1364 	u_long mtu;
1365 	int error;
1366 
1367 	error = 0;
1368 	ro = &ip6route;
1369 
1370 	if (fdp != NULL)
1371 		ifp = fdp->fd_ptr;
1372 	else
1373 		ifp = fin->fin_ifp;
1374 	memset(ro, 0, sizeof(*ro));
1375 # if __NetBSD_Version__ >= 499001100
1376 	if (fdp != NULL && IP6_NOTZERO(&fdp->fd_ip6))
1377 		sockaddr_in6_init(&u.dst6, &fdp->fd_ip6.in6, 0, 0, 0);
1378 	else
1379 		sockaddr_in6_init(&u.dst6, &fin->fin_fi.fi_dst.in6, 0, 0, 0);
1380 	dst = &u.dst;
1381 	rtcache_setdst(ro, dst);
1382 
1383 	rt = rtcache_init(ro);
1384 	if ((ifp == NULL) && (rt != NULL))
1385 		ifp = rt->rt_ifp;
1386 # else
1387 	dst6 = (struct sockaddr_in6 *)&ro->ro_dst;
1388 	dst6->sin6_family = AF_INET6;
1389 	dst6->sin6_len = sizeof(struct sockaddr_in6);
1390 	dst6->sin6_addr = fin->fin_fi.fi_dst.in6;
1391 
1392 	if (fdp != NULL) {
1393 		if (IP6_NOTZERO(&fdp->fd_ip6))
1394 			dst6->sin6_addr = fdp->fd_ip6.in6;
1395 	}
1396 
1397 	rtalloc((struct route *)ro);
1398 
1399 	if ((ifp == NULL) && (ro->ro_rt != NULL))
1400 		ifp = ro->ro_rt->rt_ifp;
1401 	rt = ro->ro_rt;
1402 # endif
1403 	if ((rt == NULL) || (ifp == NULL)) {
1404 
1405 		error = EHOSTUNREACH;
1406 		goto bad;
1407 	}
1408 
1409 	/* KAME */
1410 # if __NetBSD_Version__ >= 499001100
1411 	if (IN6_IS_ADDR_LINKLOCAL(&u.dst6.sin6_addr))
1412 		u.dst6.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
1413 # else
1414 	if (IN6_IS_ADDR_LINKLOCAL(&dst6->sin6_addr))
1415 		dst6->sin6_addr.s6_addr16[1] = htons(ifp->if_index);
1416 # endif
1417 
1418 	{
1419 # if (__NetBSD_Version__ >= 106010000) && !defined(IN6_LINKMTU)
1420 		struct in6_ifextra *ife;
1421 # endif
1422 		if (rt->rt_flags & RTF_GATEWAY)
1423 # if __NetBSD_Version__ >= 499001100
1424 			dst = rt->rt_gateway;
1425 # else
1426 			dst6 = (struct sockaddr_in6 *)rt->rt_gateway;
1427 # endif
1428 		rt->rt_use++;
1429 
1430 		/* Determine path MTU. */
1431 # if (__NetBSD_Version__ <= 106009999)
1432 		mtu = nd_ifinfo[ifp->if_index].linkmtu;
1433 # else
1434 #  ifdef IN6_LINKMTU
1435 		mtu = IN6_LINKMTU(ifp);
1436 #  else
1437 		ife = (struct in6_ifextra *)(ifp)->if_afdata[AF_INET6];
1438 		mtu = ife->nd_ifinfo[ifp->if_index].linkmtu;
1439 #  endif
1440 # endif
1441 		if ((error == 0) && (m0->m_pkthdr.len <= mtu)) {
1442 # if __NetBSD_Version__ >= 499001100
1443 			error = nd6_output(ifp, ifp, m0, satocsin6(dst), rt);
1444 # else
1445 			error = nd6_output(ifp, ifp, m0, dst6, rt);
1446 # endif
1447 		} else {
1448 			error = EMSGSIZE;
1449 		}
1450 	}
1451 bad:
1452 # if __NetBSD_Version__ >= 499001100
1453 	rtcache_free(ro);
1454 # else
1455 	if (ro->ro_rt != NULL) {
1456 		RTFREE(((struct route *)ro)->ro_rt);
1457 	}
1458 # endif
1459 	return error;
1460 }
1461 #endif	/* INET6 */
1462 
1463 
1464 int
1465 ipf_verifysrc(fr_info_t *fin)
1466 {
1467 #if __NetBSD_Version__ >= 499001100
1468 	union {
1469 		struct sockaddr         dst;
1470 		struct sockaddr_in      dst4;
1471 	} u;
1472 	struct rtentry *rt;
1473 #else
1474 	struct sockaddr_in *dst;
1475 #endif
1476 	struct route iproute;
1477 	int rc;
1478 
1479 #if __NetBSD_Version__ >= 499001100
1480 	sockaddr_in_init(&u.dst4, &fin->fin_src, 0);
1481 	rtcache_setdst(&iproute, &u.dst);
1482 	rt = rtcache_init(&iproute);
1483 	if (rt == NULL)
1484 		rc = 0;
1485 	else
1486 		rc = (fin->fin_ifp == rt->rt_ifp);
1487 	rtcache_free(&iproute);
1488 #else
1489 	dst = (struct sockaddr_in *)&iproute.ro_dst;
1490 	dst->sin_len = sizeof(*dst);
1491 	dst->sin_family = AF_INET;
1492 	dst->sin_addr = fin->fin_src;
1493 	rtalloc(&iproute);
1494 	if (iproute.ro_rt == NULL)
1495 		return 0;
1496 	rc = (fin->fin_ifp == iproute.ro_rt->rt_ifp);
1497 	RTFREE(iproute.ro_rt);
1498 #endif
1499 	return rc;
1500 }
1501 
1502 
1503 /*
1504  * return the first IP Address associated with an interface
1505  */
1506 int
1507 ipf_ifpaddr(ipf_main_softc_t *softc, int v, int atype, void *ifptr,
1508     i6addr_t *inp, i6addr_t *inpmask)
1509 {
1510 #ifdef USE_INET6
1511 	struct in6_addr *inp6 = NULL;
1512 #endif
1513 	struct sockaddr *sock, *mask;
1514 	struct sockaddr_in *sin;
1515 	struct ifaddr *ifa;
1516 	struct ifnet *ifp;
1517 
1518 	if ((ifptr == NULL) || (ifptr == (void *)-1))
1519 		return -1;
1520 
1521 	ifp = ifptr;
1522 	mask = NULL;
1523 
1524 	if (v == 4)
1525 		inp->in4.s_addr = 0;
1526 #ifdef USE_INET6
1527 	else if (v == 6)
1528 		bzero((char *)inp, sizeof(*inp));
1529 #endif
1530 
1531 	ifa = IFADDR_FIRST(ifp);
1532 	sock = ifa ? ifa->ifa_addr : NULL;
1533 	while (sock != NULL && ifa != NULL) {
1534 		sin = (struct sockaddr_in *)sock;
1535 		if ((v == 4) && (sin->sin_family == AF_INET))
1536 			break;
1537 #ifdef USE_INET6
1538 		if ((v == 6) && (sin->sin_family == AF_INET6)) {
1539 			inp6 = &((struct sockaddr_in6 *)sin)->sin6_addr;
1540 			if (!IN6_IS_ADDR_LINKLOCAL(inp6) &&
1541 			    !IN6_IS_ADDR_LOOPBACK(inp6))
1542 				break;
1543 		}
1544 #endif
1545 		ifa = IFADDR_NEXT(ifa);
1546 		if (ifa != NULL)
1547 			sock = ifa->ifa_addr;
1548 	}
1549 	if (ifa == NULL || sock == NULL)
1550 		return -1;
1551 
1552 	mask = ifa->ifa_netmask;
1553 	if (atype == FRI_BROADCAST)
1554 		sock = ifa->ifa_broadaddr;
1555 	else if (atype == FRI_PEERADDR)
1556 		sock = ifa->ifa_dstaddr;
1557 
1558 #ifdef USE_INET6
1559 	if (v == 6)
1560 		return ipf_ifpfillv6addr(atype, (struct sockaddr_in6 *)sock,
1561 					(struct sockaddr_in6 *)mask,
1562 					inp, inpmask);
1563 #endif
1564 	return ipf_ifpfillv4addr(atype, (struct sockaddr_in *)sock,
1565 				(struct sockaddr_in *)mask,
1566 				&inp->in4, &inpmask->in4);
1567 }
1568 
1569 
1570 u_32_t
1571 ipf_newisn(fr_info_t *fin)
1572 {
1573 #if __NetBSD_Version__ >= 105190000	/* 1.5T */
1574 	size_t asz;
1575 
1576 	if (fin->fin_v == 4)
1577 		asz = sizeof(struct in_addr);
1578 	else if (fin->fin_v == 6)
1579 		asz = sizeof(fin->fin_src);
1580 	else	/* XXX: no way to return error */
1581 		return 0;
1582 #ifdef INET
1583 	return tcp_new_iss1((void *)&fin->fin_src, (void *)&fin->fin_dst,
1584 			    fin->fin_sport, fin->fin_dport, asz, 0);
1585 #else
1586 	return ENOSYS;
1587 #endif
1588 #else
1589 	static int iss_seq_off = 0;
1590 	u_char hash[16];
1591 	u_32_t newiss;
1592 	MD5_CTX ctx;
1593 
1594 	/*
1595 	 * Compute the base value of the ISS.  It is a hash
1596 	 * of (saddr, sport, daddr, dport, secret).
1597 	 */
1598 	MD5Init(&ctx);
1599 
1600 	MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_src,
1601 		  sizeof(fin->fin_fi.fi_src));
1602 	MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_dst,
1603 		  sizeof(fin->fin_fi.fi_dst));
1604 	MD5Update(&ctx, (u_char *) &fin->fin_dat, sizeof(fin->fin_dat));
1605 
1606 	MD5Update(&ctx, ipf_iss_secret, sizeof(ipf_iss_secret));
1607 
1608 	MD5Final(hash, &ctx);
1609 
1610 	memcpy(&newiss, hash, sizeof(newiss));
1611 
1612 	/*
1613 	 * Now increment our "timer", and add it in to
1614 	 * the computed value.
1615 	 *
1616 	 * XXX Use `addin'?
1617 	 * XXX TCP_ISSINCR too large to use?
1618 	 */
1619 	iss_seq_off += 0x00010000;
1620 	newiss += iss_seq_off;
1621 	return newiss;
1622 #endif
1623 }
1624 
1625 
1626 /* ------------------------------------------------------------------------ */
1627 /* Function:    ipf_nextipid                                                 */
1628 /* Returns:     int - 0 == success, -1 == error (packet should be droppped) */
1629 /* Parameters:  fin(I) - pointer to packet information                      */
1630 /*                                                                          */
1631 /* Returns the next IPv4 ID to use for this packet.                         */
1632 /* ------------------------------------------------------------------------ */
1633 u_short
1634 ipf_nextipid(fr_info_t *fin)
1635 {
1636 #ifdef USE_MUTEXES
1637 	ipf_main_softc_t *softc = fin->fin_main_soft;
1638 #endif
1639 	u_short id;
1640 
1641 	MUTEX_ENTER(&softc->ipf_rw);
1642 	id = ipid++;
1643 	MUTEX_EXIT(&softc->ipf_rw);
1644 
1645 	return id;
1646 }
1647 
1648 
1649 EXTERN_INLINE int
1650 ipf_checkv4sum(fr_info_t *fin)
1651 {
1652 #ifdef M_CSUM_TCP_UDP_BAD
1653 	int manual, pflag, cflags, active;
1654 	mb_t *m;
1655 
1656 	if ((fin->fin_flx & FI_NOCKSUM) != 0)
1657 		return 0;
1658 
1659 	if ((fin->fin_flx & FI_SHORT) != 0)
1660 		return 1;
1661 
1662 	if (fin->fin_cksum != FI_CK_NEEDED)
1663 		return (fin->fin_cksum > FI_CK_NEEDED) ? 0 : -1;
1664 
1665 	manual = 0;
1666 	m = fin->fin_m;
1667 	if (m == NULL) {
1668 		manual = 1;
1669 		goto skipauto;
1670 	}
1671 
1672 	switch (fin->fin_p)
1673 	{
1674 	case IPPROTO_UDP :
1675 		pflag = M_CSUM_UDPv4;
1676 		break;
1677 	case IPPROTO_TCP :
1678 		pflag = M_CSUM_TCPv4;
1679 		break;
1680 	default :
1681 		pflag = 0;
1682 		manual = 1;
1683 		break;
1684 	}
1685 
1686 	active = ((struct ifnet *)fin->fin_ifp)->if_csum_flags_rx & pflag;
1687 	active |= M_CSUM_TCP_UDP_BAD | M_CSUM_DATA;
1688 	cflags = m->m_pkthdr.csum_flags & active;
1689 
1690 	if (pflag != 0) {
1691 		if (cflags == (pflag | M_CSUM_TCP_UDP_BAD)) {
1692 			fin->fin_flx |= FI_BAD;
1693 			fin->fin_cksum = FI_CK_BAD;
1694 		} else if (cflags == (pflag | M_CSUM_DATA)) {
1695 			if ((m->m_pkthdr.csum_data ^ 0xffff) != 0) {
1696 				fin->fin_flx |= FI_BAD;
1697 				fin->fin_cksum = FI_CK_BAD;
1698 			} else {
1699 				fin->fin_cksum = FI_CK_SUMOK;
1700 			}
1701 		} else if (cflags == pflag) {
1702 			fin->fin_cksum = FI_CK_SUMOK;
1703 		} else {
1704 			manual = 1;
1705 		}
1706 	}
1707 skipauto:
1708 	if (manual != 0) {
1709 		if (ipf_checkl4sum(fin) == -1) {
1710 			fin->fin_flx |= FI_BAD;
1711 			return -1;
1712 		}
1713 	}
1714 #else
1715 	if (ipf_checkl4sum(fin) == -1) {
1716 		fin->fin_flx |= FI_BAD;
1717 		return -1;
1718 	}
1719 #endif
1720 	return 0;
1721 }
1722 
1723 
1724 #ifdef USE_INET6
1725 EXTERN_INLINE int
1726 ipf_checkv6sum(fr_info_t *fin)
1727 {
1728 # ifdef M_CSUM_TCP_UDP_BAD
1729 	int manual, pflag, cflags, active;
1730 	mb_t *m;
1731 
1732 	if ((fin->fin_flx & FI_NOCKSUM) != 0)
1733 		return 0;
1734 
1735 	if ((fin->fin_flx & FI_SHORT) != 0)
1736 		return 1;
1737 
1738 	if (fin->fin_cksum != FI_CK_SUMOK)
1739 		return (fin->fin_cksum > FI_CK_NEEDED) ? 0 : -1;
1740 
1741 
1742 	manual = 0;
1743 	m = fin->fin_m;
1744 
1745 	switch (fin->fin_p)
1746 	{
1747 	case IPPROTO_UDP :
1748 		pflag = M_CSUM_UDPv6;
1749 		break;
1750 	case IPPROTO_TCP :
1751 		pflag = M_CSUM_TCPv6;
1752 		break;
1753 	default :
1754 		pflag = 0;
1755 		manual = 1;
1756 		break;
1757 	}
1758 
1759 	active = ((struct ifnet *)fin->fin_ifp)->if_csum_flags_rx & pflag;
1760 	active |= M_CSUM_TCP_UDP_BAD | M_CSUM_DATA;
1761 	cflags = m->m_pkthdr.csum_flags & active;
1762 
1763 	if (pflag != 0) {
1764 		if (cflags == (pflag | M_CSUM_TCP_UDP_BAD)) {
1765 			fin->fin_flx |= FI_BAD;
1766 		} else if (cflags == (pflag | M_CSUM_DATA)) {
1767 			if ((m->m_pkthdr.csum_data ^ 0xffff) != 0)
1768 				fin->fin_flx |= FI_BAD;
1769 		} else if (cflags == pflag) {
1770 			;
1771 		} else {
1772 			manual = 1;
1773 		}
1774 	}
1775 	if (manual != 0) {
1776 		if (ipf_checkl4sum(fin) == -1) {
1777 			fin->fin_flx |= FI_BAD;
1778 			return -1;
1779 		}
1780 	}
1781 # else
1782 	if (ipf_checkl4sum(fin) == -1) {
1783 		fin->fin_flx |= FI_BAD;
1784 		return -1;
1785 	}
1786 # endif
1787 	return 0;
1788 }
1789 #endif /* USE_INET6 */
1790 
1791 
1792 size_t
1793 mbufchainlen(struct mbuf *m0)
1794 {
1795 	size_t len;
1796 
1797 	if ((m0->m_flags & M_PKTHDR) != 0) {
1798 		len = m0->m_pkthdr.len;
1799 	} else {
1800 		struct mbuf *m;
1801 
1802 		for (m = m0, len = 0; m != NULL; m = m->m_next)
1803 			len += m->m_len;
1804 	}
1805 	return len;
1806 }
1807 
1808 
1809 /* ------------------------------------------------------------------------ */
1810 /* Function:    ipf_pullup                                                  */
1811 /* Returns:     NULL == pullup failed, else pointer to protocol header      */
1812 /* Parameters:  xmin(I)- pointer to buffer where data packet starts         */
1813 /*              fin(I) - pointer to packet information                      */
1814 /*              len(I) - number of bytes to pullup                          */
1815 /*                                                                          */
1816 /* Attempt to move at least len bytes (from the start of the buffer) into a */
1817 /* single buffer for ease of access.  Operating system native functions are */
1818 /* used to manage buffers - if necessary.  If the entire packet ends up in  */
1819 /* a single buffer, set the FI_COALESCE flag even though ipf_coalesce() has */
1820 /* not been called.  Both fin_ip and fin_dp are updated before exiting _IF_ */
1821 /* and ONLY if the pullup succeeds.                                         */
1822 /*                                                                          */
1823 /* We assume that 'xmin' is a pointer to a buffer that is part of the chain */
1824 /* of buffers that starts at *fin->fin_mp.                                  */
1825 /* ------------------------------------------------------------------------ */
1826 void *
1827 ipf_pullup(mb_t *xmin, fr_info_t *fin, int len)
1828 {
1829 	int dpoff, ipoff;
1830 	mb_t *m = xmin;
1831 	char *ip;
1832 
1833 	if (m == NULL)
1834 		return NULL;
1835 
1836 	ip = (char *)fin->fin_ip;
1837 	if ((fin->fin_flx & FI_COALESCE) != 0)
1838 		return ip;
1839 
1840 	ipoff = fin->fin_ipoff;
1841 	if (fin->fin_dp != NULL)
1842 		dpoff = (char *)fin->fin_dp - (char *)ip;
1843 	else
1844 		dpoff = 0;
1845 
1846 	if (M_LEN(m) < len) {
1847 		mb_t *n = *fin->fin_mp;
1848 		/*
1849 		 * Assume that M_PKTHDR is set and just work with what is left
1850 		 * rather than check..
1851 		 * Should not make any real difference, anyway.
1852 		 */
1853 		if (m != n) {
1854 			/*
1855 			 * Record the mbuf that points to the mbuf that we're
1856 			 * about to go to work on so that we can update the
1857 			 * m_next appropriately later.
1858 			 */
1859 			for (; n->m_next != m; n = n->m_next)
1860 				;
1861 		} else {
1862 			n = NULL;
1863 		}
1864 
1865 #ifdef MHLEN
1866 		if (len > MHLEN)
1867 #else
1868 		if (len > MLEN)
1869 #endif
1870 		{
1871 #ifdef HAVE_M_PULLDOWN
1872 			if (m_pulldown(m, 0, len, NULL) == NULL)
1873 				m = NULL;
1874 #else
1875 			FREE_MB_T(*fin->fin_mp);
1876 			m = NULL;
1877 			n = NULL;
1878 #endif
1879 		} else
1880 		{
1881 			m = m_pullup(m, len);
1882 		}
1883 		if (n != NULL)
1884 			n->m_next = m;
1885 		if (m == NULL) {
1886 			/*
1887 			 * When n is non-NULL, it indicates that m pointed to
1888 			 * a sub-chain (tail) of the mbuf and that the head
1889 			 * of this chain has not yet been free'd.
1890 			 */
1891 			if (n != NULL) {
1892 				FREE_MB_T(*fin->fin_mp);
1893 			}
1894 
1895 			*fin->fin_mp = NULL;
1896 			fin->fin_m = NULL;
1897 			return NULL;
1898 		}
1899 
1900 		if (n == NULL)
1901 			*fin->fin_mp = m;
1902 
1903 		while (M_LEN(m) == 0) {
1904 			m = m->m_next;
1905 		}
1906 		fin->fin_m = m;
1907 		ip = MTOD(m, char *) + ipoff;
1908 
1909 		fin->fin_ip = (ip_t *)ip;
1910 		if (fin->fin_dp != NULL)
1911 			fin->fin_dp = (char *)fin->fin_ip + dpoff;
1912 		if (fin->fin_fraghdr != NULL)
1913 			fin->fin_fraghdr = (char *)ip +
1914 					   ((char *)fin->fin_fraghdr -
1915 					    (char *)fin->fin_ip);
1916 	}
1917 
1918 	if (len == fin->fin_plen)
1919 		fin->fin_flx |= FI_COALESCE;
1920 	return ip;
1921 }
1922 
1923 
1924 int
1925 ipf_inject(fr_info_t *fin, mb_t *m)
1926 {
1927 	int error;
1928 
1929 	if (fin->fin_out == 0) {
1930 		if (__predict_false(!pktq_enqueue(ip_pktq, m, 0))) {
1931 			FREE_MB_T(m);
1932 			error = ENOBUFS;
1933 		} else {
1934 			error = 0;
1935 		}
1936 	} else {
1937 		error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL);
1938 	}
1939 	return error;
1940 }
1941 
1942 
1943 u_32_t
1944 ipf_random(void)
1945 {
1946 	int number;
1947 
1948 #ifdef _CPRNG_H
1949 	number = cprng_fast32();
1950 #else
1951 	number = arc4random();
1952 #endif
1953 	return number;
1954 }
1955 
1956 
1957 /*
1958  * routines below for saving IP headers to buffer
1959  */
1960 static int ipfopen(dev_t dev, int flags
1961 #if (NetBSD >= 199511)
1962     , int devtype, PROC_T *p
1963 #endif
1964 )
1965 {
1966 	u_int unit = GET_MINOR(dev);
1967 	int error;
1968 
1969 	if (IPL_LOGMAX < unit) {
1970 		error = ENXIO;
1971 	} else {
1972 		switch (unit)
1973 		{
1974 		case IPL_LOGIPF :
1975 		case IPL_LOGNAT :
1976 		case IPL_LOGSTATE :
1977 		case IPL_LOGAUTH :
1978 		case IPL_LOGLOOKUP :
1979 		case IPL_LOGSYNC :
1980 #ifdef IPFILTER_SCAN
1981 		case IPL_LOGSCAN :
1982 #endif
1983 			error = 0;
1984 			break;
1985 		default :
1986 			error = ENXIO;
1987 			break;
1988 		}
1989 	}
1990 	return error;
1991 }
1992 
1993 
1994 static int ipfclose(dev_t dev, int flags
1995 #if (NetBSD >= 199511)
1996 	, int devtype, PROC_T *p
1997 #endif
1998 )
1999 {
2000 	u_int	unit = GET_MINOR(dev);
2001 
2002 	if (IPL_LOGMAX < unit)
2003 		unit = ENXIO;
2004 	else
2005 		unit = 0;
2006 	return unit;
2007 }
2008 
2009 /*
2010  * ipfread/ipflog
2011  * both of these must operate with at least splnet() lest they be
2012  * called during packet processing and cause an inconsistancy to appear in
2013  * the filter lists.
2014  */
2015 static int ipfread(dev_t dev, struct uio *uio, int ioflag)
2016 {
2017 
2018 	if (ipfmain.ipf_running < 1) {
2019 		ipfmain.ipf_interror = 130006;
2020 		return EIO;
2021 	}
2022 
2023 	if (GET_MINOR(dev) == IPL_LOGSYNC)
2024 		return ipf_sync_read(&ipfmain, uio);
2025 
2026 #ifdef IPFILTER_LOG
2027 	return ipf_log_read(&ipfmain, GET_MINOR(dev), uio);
2028 #else
2029 	ipfmain.ipf_interror = 130007;
2030 	return ENXIO;
2031 #endif
2032 }
2033 
2034 
2035 /*
2036  * ipfwrite
2037  * both of these must operate with at least splnet() lest they be
2038  * called during packet processing and cause an inconsistancy to appear in
2039  * the filter lists.
2040  */
2041 static int ipfwrite(dev_t dev, struct uio *uio, int ioflag)
2042 {
2043 
2044 	if (ipfmain.ipf_running < 1) {
2045 		ipfmain.ipf_interror = 130008;
2046 		return EIO;
2047 	}
2048 
2049 	if (GET_MINOR(dev) == IPL_LOGSYNC)
2050 		return ipf_sync_write(&ipfmain, uio);
2051 	ipfmain.ipf_interror = 130009;
2052 	return ENXIO;
2053 }
2054 
2055 
2056 static int ipfpoll(dev_t dev, int events, PROC_T *p)
2057 {
2058 	u_int unit = GET_MINOR(dev);
2059 	int revents = 0;
2060 
2061 	if (IPL_LOGMAX < unit) {
2062 		ipfmain.ipf_interror = 130010;
2063 		return ENXIO;
2064 	}
2065 
2066 	switch (unit)
2067 	{
2068 	case IPL_LOGIPF :
2069 	case IPL_LOGNAT :
2070 	case IPL_LOGSTATE :
2071 #ifdef IPFILTER_LOG
2072 		if ((events & (POLLIN | POLLRDNORM)) &&
2073 		    ipf_log_canread(&ipfmain, unit))
2074 			revents |= events & (POLLIN | POLLRDNORM);
2075 #endif
2076 		break;
2077 	case IPL_LOGAUTH :
2078 		if ((events & (POLLIN | POLLRDNORM)) &&
2079 		    ipf_auth_waiting(&ipfmain))
2080 			revents |= events & (POLLIN | POLLRDNORM);
2081 		break;
2082 	case IPL_LOGSYNC :
2083 		if ((events & (POLLIN | POLLRDNORM)) &&
2084 		    ipf_sync_canread(&ipfmain))
2085 			revents |= events & (POLLIN | POLLRDNORM);
2086 		if ((events & (POLLOUT | POLLWRNORM)) &&
2087 		    ipf_sync_canwrite(&ipfmain))
2088 			revents |= events & (POLLOUT | POLLWRNORM);
2089 		break;
2090 	case IPL_LOGSCAN :
2091 	case IPL_LOGLOOKUP :
2092 	default :
2093 		break;
2094 	}
2095 
2096 	if ((revents == 0) && (((events & (POLLIN|POLLRDNORM)) != 0)))
2097 		selrecord(p, &ipfmain.ipf_selwait[unit]);
2098 	return revents;
2099 }
2100 
2101 u_int
2102 ipf_pcksum(fr_info_t *fin, int hlen, u_int sum)
2103 {
2104 	struct mbuf *m;
2105 	u_int sum2;
2106 	int off;
2107 
2108 	m = fin->fin_m;
2109 	off = (char *)fin->fin_dp - (char *)fin->fin_ip;
2110 	m->m_data += hlen;
2111 	m->m_len -= hlen;
2112 	sum2 = in_cksum(fin->fin_m, fin->fin_plen - off);
2113 	m->m_len += hlen;
2114 	m->m_data -= hlen;
2115 
2116 	/*
2117 	 * Both sum and sum2 are partial sums, so combine them together.
2118 	 */
2119 	sum += ~sum2 & 0xffff;
2120 	while (sum > 0xffff)
2121 		sum = (sum & 0xffff) + (sum >> 16);
2122 	sum2 = ~sum & 0xffff;
2123 	return sum2;
2124 }
2125