12393Syz155240 /* 22393Syz155240 * Copyright (C) 1995-2003 by Darren Reed. 32393Syz155240 * 42393Syz155240 * See the IPFILTER.LICENCE file for details on licencing. 52393Syz155240 * 63448Sdh155122 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 72393Syz155240 * Use is subject to license terms. 82393Syz155240 */ 92393Syz155240 102393Syz155240 #pragma ident "%Z%%M% %I% %E% SMI" 112393Syz155240 122393Syz155240 #if defined(KERNEL) || defined(_KERNEL) 132393Syz155240 # undef KERNEL 142393Syz155240 # undef _KERNEL 152393Syz155240 # define KERNEL 1 162393Syz155240 # define _KERNEL 1 172393Syz155240 #endif 182393Syz155240 #include <sys/errno.h> 192393Syz155240 #include <sys/types.h> 202393Syz155240 #include <sys/param.h> 212393Syz155240 #include <sys/file.h> 222393Syz155240 #if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \ 232393Syz155240 defined(_KERNEL) 242393Syz155240 # include "opt_ipfilter_log.h" 252393Syz155240 #endif 262393Syz155240 #if defined(_KERNEL) && defined(__FreeBSD_version) && \ 272393Syz155240 (__FreeBSD_version >= 400000) && !defined(KLD_MODULE) 282393Syz155240 #include "opt_inet6.h" 292393Syz155240 #endif 302393Syz155240 #if !defined(_KERNEL) && !defined(__KERNEL__) 312393Syz155240 # include <stdio.h> 322393Syz155240 # include <stdlib.h> 332393Syz155240 # include <string.h> 342393Syz155240 # define _KERNEL 352393Syz155240 # ifdef __OpenBSD__ 362393Syz155240 struct file; 372393Syz155240 # endif 382393Syz155240 # include <sys/uio.h> 392393Syz155240 # undef _KERNEL 402393Syz155240 #endif 412393Syz155240 #if defined(_KERNEL) && (__FreeBSD_version >= 220000) 422393Syz155240 # include <sys/filio.h> 432393Syz155240 # include <sys/fcntl.h> 442393Syz155240 # if (__FreeBSD_version >= 300000) && !defined(IPFILTER_LKM) 452393Syz155240 # include "opt_ipfilter.h" 462393Syz155240 # endif 472393Syz155240 #else 482393Syz155240 # include <sys/ioctl.h> 492393Syz155240 #endif 502393Syz155240 #include <sys/time.h> 512393Syz155240 #if !defined(linux) 522393Syz155240 # include <sys/protosw.h> 532393Syz155240 #endif 542393Syz155240 #include <sys/socket.h> 552393Syz155240 #if defined(_KERNEL) 562393Syz155240 # include <sys/systm.h> 572393Syz155240 # if !defined(__SVR4) && !defined(__svr4__) 582393Syz155240 # include <sys/mbuf.h> 592393Syz155240 # endif 602393Syz155240 #endif 612393Syz155240 #if defined(__SVR4) || defined(__svr4__) 622393Syz155240 # include <sys/filio.h> 632393Syz155240 # include <sys/byteorder.h> 642393Syz155240 # ifdef _KERNEL 652393Syz155240 # include <sys/dditypes.h> 662393Syz155240 # endif 672393Syz155240 # include <sys/stream.h> 682393Syz155240 # include <sys/kmem.h> 692393Syz155240 #endif 702393Syz155240 712393Syz155240 #include <net/if.h> 722393Syz155240 #ifdef sun 732393Syz155240 # include <net/af.h> 742393Syz155240 #endif 752393Syz155240 #include <net/route.h> 762393Syz155240 #include <netinet/in.h> 772393Syz155240 #include <netinet/in_systm.h> 782393Syz155240 #include <netinet/ip.h> 792393Syz155240 #include <netinet/tcp.h> 802393Syz155240 #if !defined(linux) 812393Syz155240 # include <netinet/ip_var.h> 822393Syz155240 #endif 832393Syz155240 #if !defined(__hpux) && !defined(linux) 842393Syz155240 # include <netinet/tcp_fsm.h> 852393Syz155240 #endif 862393Syz155240 #include <netinet/udp.h> 872393Syz155240 #include <netinet/ip_icmp.h> 882393Syz155240 #include "netinet/ip_compat.h" 892393Syz155240 #include <netinet/tcpip.h> 902393Syz155240 #include "netinet/ip_fil.h" 912393Syz155240 #include "netinet/ip_nat.h" 922393Syz155240 #include "netinet/ip_frag.h" 932393Syz155240 #include "netinet/ip_state.h" 942393Syz155240 #include "netinet/ip_proxy.h" 953448Sdh155122 #include "netinet/ipf_stack.h" 962393Syz155240 #ifdef IPFILTER_SYNC 972393Syz155240 #include "netinet/ip_sync.h" 982393Syz155240 #endif 992393Syz155240 #ifdef IPFILTER_SCAN 1002393Syz155240 #include "netinet/ip_scan.h" 1012393Syz155240 #endif 1022393Syz155240 #ifdef USE_INET6 1032393Syz155240 #include <netinet/icmp6.h> 1042393Syz155240 #endif 1052393Syz155240 #if (__FreeBSD_version >= 300000) 1062393Syz155240 # include <sys/malloc.h> 1072393Syz155240 # if defined(_KERNEL) && !defined(IPFILTER_LKM) 1082393Syz155240 # include <sys/libkern.h> 1092393Syz155240 # include <sys/systm.h> 1102393Syz155240 # endif 1112393Syz155240 #endif 1122393Syz155240 /* END OF INCLUDES */ 1132393Syz155240 1142393Syz155240 1152393Syz155240 #if !defined(lint) 1162393Syz155240 static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed"; 1172393Syz155240 static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.186.2.36 2005/08/11 19:58:03 darrenr Exp $"; 1182393Syz155240 #endif 1192393Syz155240 1202393Syz155240 #ifdef USE_INET6 1212393Syz155240 static ipstate_t *fr_checkicmp6matchingstate __P((fr_info_t *)); 1222393Syz155240 #endif 1232393Syz155240 static ipstate_t *fr_matchsrcdst __P((fr_info_t *, ipstate_t *, i6addr_t *, 1242393Syz155240 i6addr_t *, tcphdr_t *, u_32_t)); 1252393Syz155240 static ipstate_t *fr_checkicmpmatchingstate __P((fr_info_t *)); 1263448Sdh155122 static int fr_state_flush __P((int, int, ipf_stack_t *)); 1273448Sdh155122 static ips_stat_t *fr_statetstats __P((ipf_stack_t *)); 1283448Sdh155122 static void fr_delstate __P((ipstate_t *, int, ipf_stack_t *)); 1293448Sdh155122 static int fr_state_remove __P((caddr_t, ipf_stack_t *)); 1303448Sdh155122 static void fr_ipsmove __P((ipstate_t *, u_int, ipf_stack_t *)); 1312393Syz155240 static int fr_tcpstate __P((fr_info_t *, tcphdr_t *, ipstate_t *)); 1322393Syz155240 static int fr_tcpoptions __P((fr_info_t *, tcphdr_t *, tcpdata_t *)); 1332393Syz155240 static ipstate_t *fr_stclone __P((fr_info_t *, tcphdr_t *, ipstate_t *)); 1342393Syz155240 static void fr_fixinisn __P((fr_info_t *, ipstate_t *)); 1352393Syz155240 static void fr_fixoutisn __P((fr_info_t *, ipstate_t *)); 1362393Syz155240 static void fr_checknewisn __P((fr_info_t *, ipstate_t *)); 1373448Sdh155122 static int fr_stateiter __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *)); 1383448Sdh155122 1393448Sdh155122 int fr_stputent __P((caddr_t, ipf_stack_t *)); 1403448Sdh155122 int fr_stgetent __P((caddr_t, ipf_stack_t *)); 1412393Syz155240 1422393Syz155240 #define ONE_DAY IPF_TTLVAL(1 * 86400) /* 1 day */ 1432393Syz155240 #define FIVE_DAYS (5 * ONE_DAY) 1443448Sdh155122 #define DOUBLE_HASH(x, ifs) \ 1453448Sdh155122 (((x) + ifs->ifs_ips_seed[(x) % ifs->ifs_fr_statesize]) % ifs->ifs_fr_statesize) 1463448Sdh155122 1472393Syz155240 1482393Syz155240 1492393Syz155240 /* ------------------------------------------------------------------------ */ 1502393Syz155240 /* Function: fr_stateinit */ 1512393Syz155240 /* Returns: int - 0 == success, -1 == failure */ 1522393Syz155240 /* Parameters: Nil */ 1532393Syz155240 /* */ 1542393Syz155240 /* Initialise all the global variables used within the state code. */ 1552393Syz155240 /* This action also includes initiailising locks. */ 1562393Syz155240 /* ------------------------------------------------------------------------ */ 1573448Sdh155122 int fr_stateinit(ifs) 1583448Sdh155122 ipf_stack_t *ifs; 1592393Syz155240 { 1602393Syz155240 int i; 1612393Syz155240 1623448Sdh155122 ifs->ifs_fr_tcpidletimeout = FIVE_DAYS; 1633448Sdh155122 ifs->ifs_fr_tcpclosewait = IPF_TTLVAL(TCP_MSL); 1643448Sdh155122 ifs->ifs_fr_tcplastack = IPF_TTLVAL(TCP_MSL); 1653448Sdh155122 ifs->ifs_fr_tcptimeout = IPF_TTLVAL(TCP_MSL); 1663448Sdh155122 ifs->ifs_fr_tcpclosed = IPF_TTLVAL(60); 1673448Sdh155122 ifs->ifs_fr_tcphalfclosed = IPF_TTLVAL(2 * 3600); /* 2 hours */ 1683448Sdh155122 ifs->ifs_fr_udptimeout = IPF_TTLVAL(120); 1693448Sdh155122 ifs->ifs_fr_udpacktimeout = IPF_TTLVAL(12); 1703448Sdh155122 ifs->ifs_fr_icmptimeout = IPF_TTLVAL(60); 1713448Sdh155122 ifs->ifs_fr_icmpacktimeout = IPF_TTLVAL(6); 1723448Sdh155122 ifs->ifs_fr_iptimeout = IPF_TTLVAL(60); 1733448Sdh155122 ifs->ifs_fr_statemax = IPSTATE_MAX; 1743448Sdh155122 ifs->ifs_fr_statesize = IPSTATE_SIZE; 1753448Sdh155122 ifs->ifs_fr_state_maxbucket_reset = 1; 1763448Sdh155122 #ifdef IPFILTER_LOG 1773448Sdh155122 ifs->ifs_ipstate_logging = 1; 1783448Sdh155122 #else 1793448Sdh155122 ifs->ifs_ipstate_logging = 0; 1803448Sdh155122 #endif 1813448Sdh155122 1823448Sdh155122 KMALLOCS(ifs->ifs_ips_table, ipstate_t **, 1833448Sdh155122 ifs->ifs_fr_statesize * sizeof(ipstate_t *)); 1843448Sdh155122 if (ifs->ifs_ips_table == NULL) 1852393Syz155240 return -1; 1863448Sdh155122 bzero((char *)ifs->ifs_ips_table, 1873448Sdh155122 ifs->ifs_fr_statesize * sizeof(ipstate_t *)); 1883448Sdh155122 1893448Sdh155122 KMALLOCS(ifs->ifs_ips_seed, u_long *, 1903448Sdh155122 ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_seed)); 1913448Sdh155122 if (ifs->ifs_ips_seed == NULL) 1922393Syz155240 return -2; 1933448Sdh155122 for (i = 0; i < ifs->ifs_fr_statesize; i++) { 1942393Syz155240 /* 1952393Syz155240 * XXX - ips_seed[X] should be a random number of sorts. 1962393Syz155240 */ 1972393Syz155240 #if (__FreeBSD_version >= 400000) 1983448Sdh155122 ifs->ifs_ips_seed[i] = arc4random(); 1992393Syz155240 #else 2003448Sdh155122 ifs->ifs_ips_seed[i] = ((u_long)ifs->ifs_ips_seed + i) * 2013448Sdh155122 ifs->ifs_fr_statesize; 2023448Sdh155122 ifs->ifs_ips_seed[i] ^= 0xa5a55a5a; 2033448Sdh155122 ifs->ifs_ips_seed[i] *= (u_long)ifs->ifs_ips_seed; 2043448Sdh155122 ifs->ifs_ips_seed[i] ^= 0x5a5aa5a5; 2053448Sdh155122 ifs->ifs_ips_seed[i] *= ifs->ifs_fr_statemax; 2062393Syz155240 #endif 2072393Syz155240 } 2082393Syz155240 2092393Syz155240 /* fill icmp reply type table */ 2102393Syz155240 for (i = 0; i <= ICMP_MAXTYPE; i++) 2112393Syz155240 icmpreplytype4[i] = -1; 2122393Syz155240 icmpreplytype4[ICMP_ECHO] = ICMP_ECHOREPLY; 2132393Syz155240 icmpreplytype4[ICMP_TSTAMP] = ICMP_TSTAMPREPLY; 2142393Syz155240 icmpreplytype4[ICMP_IREQ] = ICMP_IREQREPLY; 2152393Syz155240 icmpreplytype4[ICMP_MASKREQ] = ICMP_MASKREPLY; 2162393Syz155240 #ifdef USE_INET6 2172393Syz155240 /* fill icmp reply type table */ 2182393Syz155240 for (i = 0; i <= ICMP6_MAXTYPE; i++) 2192393Syz155240 icmpreplytype6[i] = -1; 2202393Syz155240 icmpreplytype6[ICMP6_ECHO_REQUEST] = ICMP6_ECHO_REPLY; 2212393Syz155240 icmpreplytype6[ICMP6_MEMBERSHIP_QUERY] = ICMP6_MEMBERSHIP_REPORT; 2222393Syz155240 icmpreplytype6[ICMP6_NI_QUERY] = ICMP6_NI_REPLY; 2232393Syz155240 icmpreplytype6[ND_ROUTER_SOLICIT] = ND_ROUTER_ADVERT; 2242393Syz155240 icmpreplytype6[ND_NEIGHBOR_SOLICIT] = ND_NEIGHBOR_ADVERT; 2252393Syz155240 #endif 2262393Syz155240 2273448Sdh155122 KMALLOCS(ifs->ifs_ips_stats.iss_bucketlen, u_long *, 2283448Sdh155122 ifs->ifs_fr_statesize * sizeof(u_long)); 2293448Sdh155122 if (ifs->ifs_ips_stats.iss_bucketlen == NULL) 2302393Syz155240 return -1; 2313448Sdh155122 bzero((char *)ifs->ifs_ips_stats.iss_bucketlen, 2323448Sdh155122 ifs->ifs_fr_statesize * sizeof(u_long)); 2333448Sdh155122 2343448Sdh155122 if (ifs->ifs_fr_state_maxbucket == 0) { 2353448Sdh155122 for (i = ifs->ifs_fr_statesize; i > 0; i >>= 1) 2363448Sdh155122 ifs->ifs_fr_state_maxbucket++; 2373448Sdh155122 ifs->ifs_fr_state_maxbucket *= 2; 2382393Syz155240 } 2392393Syz155240 2403448Sdh155122 fr_sttab_init(ifs->ifs_ips_tqtqb, ifs); 2413448Sdh155122 ifs->ifs_ips_tqtqb[IPF_TCP_NSTATES - 1].ifq_next = &ifs->ifs_ips_udptq; 2423448Sdh155122 ifs->ifs_ips_udptq.ifq_ttl = (u_long)ifs->ifs_fr_udptimeout; 2433448Sdh155122 ifs->ifs_ips_udptq.ifq_ref = 1; 2443448Sdh155122 ifs->ifs_ips_udptq.ifq_head = NULL; 2453448Sdh155122 ifs->ifs_ips_udptq.ifq_tail = &ifs->ifs_ips_udptq.ifq_head; 2463448Sdh155122 MUTEX_INIT(&ifs->ifs_ips_udptq.ifq_lock, "ipftq udp tab"); 2473448Sdh155122 ifs->ifs_ips_udptq.ifq_next = &ifs->ifs_ips_udpacktq; 2483448Sdh155122 ifs->ifs_ips_udpacktq.ifq_ttl = (u_long)ifs->ifs_fr_udpacktimeout; 2493448Sdh155122 ifs->ifs_ips_udpacktq.ifq_ref = 1; 2503448Sdh155122 ifs->ifs_ips_udpacktq.ifq_head = NULL; 2513448Sdh155122 ifs->ifs_ips_udpacktq.ifq_tail = &ifs->ifs_ips_udpacktq.ifq_head; 2523448Sdh155122 MUTEX_INIT(&ifs->ifs_ips_udpacktq.ifq_lock, "ipftq udpack tab"); 2533448Sdh155122 ifs->ifs_ips_udpacktq.ifq_next = &ifs->ifs_ips_icmptq; 2543448Sdh155122 ifs->ifs_ips_icmptq.ifq_ttl = (u_long)ifs->ifs_fr_icmptimeout; 2553448Sdh155122 ifs->ifs_ips_icmptq.ifq_ref = 1; 2563448Sdh155122 ifs->ifs_ips_icmptq.ifq_head = NULL; 2573448Sdh155122 ifs->ifs_ips_icmptq.ifq_tail = &ifs->ifs_ips_icmptq.ifq_head; 2583448Sdh155122 MUTEX_INIT(&ifs->ifs_ips_icmptq.ifq_lock, "ipftq icmp tab"); 2593448Sdh155122 ifs->ifs_ips_icmptq.ifq_next = &ifs->ifs_ips_icmpacktq; 2603448Sdh155122 ifs->ifs_ips_icmpacktq.ifq_ttl = (u_long)ifs->ifs_fr_icmpacktimeout; 2613448Sdh155122 ifs->ifs_ips_icmpacktq.ifq_ref = 1; 2623448Sdh155122 ifs->ifs_ips_icmpacktq.ifq_head = NULL; 2633448Sdh155122 ifs->ifs_ips_icmpacktq.ifq_tail = &ifs->ifs_ips_icmpacktq.ifq_head; 2643448Sdh155122 MUTEX_INIT(&ifs->ifs_ips_icmpacktq.ifq_lock, "ipftq icmpack tab"); 2653448Sdh155122 ifs->ifs_ips_icmpacktq.ifq_next = &ifs->ifs_ips_iptq; 2663448Sdh155122 ifs->ifs_ips_iptq.ifq_ttl = (u_long)ifs->ifs_fr_iptimeout; 2673448Sdh155122 ifs->ifs_ips_iptq.ifq_ref = 1; 2683448Sdh155122 ifs->ifs_ips_iptq.ifq_head = NULL; 2693448Sdh155122 ifs->ifs_ips_iptq.ifq_tail = &ifs->ifs_ips_iptq.ifq_head; 2703448Sdh155122 MUTEX_INIT(&ifs->ifs_ips_iptq.ifq_lock, "ipftq ip tab"); 2713448Sdh155122 ifs->ifs_ips_iptq.ifq_next = NULL; 2723448Sdh155122 2733448Sdh155122 RWLOCK_INIT(&ifs->ifs_ipf_state, "ipf IP state rwlock"); 2743448Sdh155122 MUTEX_INIT(&ifs->ifs_ipf_stinsert, "ipf state insert mutex"); 2753448Sdh155122 ifs->ifs_fr_state_init = 1; 2763448Sdh155122 2773448Sdh155122 ifs->ifs_ips_last_force_flush = ifs->ifs_fr_ticks; 2782393Syz155240 return 0; 2792393Syz155240 } 2802393Syz155240 2812393Syz155240 2822393Syz155240 /* ------------------------------------------------------------------------ */ 2832393Syz155240 /* Function: fr_stateunload */ 2842393Syz155240 /* Returns: Nil */ 2852393Syz155240 /* Parameters: Nil */ 2862393Syz155240 /* */ 2872393Syz155240 /* Release and destroy any resources acquired or initialised so that */ 2882393Syz155240 /* IPFilter can be unloaded or re-initialised. */ 2892393Syz155240 /* ------------------------------------------------------------------------ */ 2903448Sdh155122 void fr_stateunload(ifs) 2913448Sdh155122 ipf_stack_t *ifs; 2922393Syz155240 { 2932393Syz155240 ipftq_t *ifq, *ifqnext; 2942393Syz155240 ipstate_t *is; 2952393Syz155240 2963448Sdh155122 while ((is = ifs->ifs_ips_list) != NULL) 2973448Sdh155122 fr_delstate(is, 0, ifs); 2982393Syz155240 2992393Syz155240 /* 3002393Syz155240 * Proxy timeout queues are not cleaned here because although they 3012393Syz155240 * exist on the state list, appr_unload is called after fr_stateunload 3022393Syz155240 * and the proxies actually are responsible for them being created. 3032393Syz155240 * Should the proxy timeouts have their own list? There's no real 3042393Syz155240 * justification as this is the only complicationA 3052393Syz155240 */ 3063448Sdh155122 for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) { 3072393Syz155240 ifqnext = ifq->ifq_next; 3082393Syz155240 if (((ifq->ifq_flags & IFQF_PROXY) == 0) && 3092393Syz155240 (fr_deletetimeoutqueue(ifq) == 0)) 3103448Sdh155122 fr_freetimeoutqueue(ifq, ifs); 3112393Syz155240 } 3122393Syz155240 3133448Sdh155122 ifs->ifs_ips_stats.iss_inuse = 0; 3143448Sdh155122 ifs->ifs_ips_num = 0; 3153448Sdh155122 3163448Sdh155122 if (ifs->ifs_fr_state_init == 1) { 3173448Sdh155122 fr_sttab_destroy(ifs->ifs_ips_tqtqb); 3183448Sdh155122 MUTEX_DESTROY(&ifs->ifs_ips_udptq.ifq_lock); 3193448Sdh155122 MUTEX_DESTROY(&ifs->ifs_ips_icmptq.ifq_lock); 3203448Sdh155122 MUTEX_DESTROY(&ifs->ifs_ips_udpacktq.ifq_lock); 3213448Sdh155122 MUTEX_DESTROY(&ifs->ifs_ips_icmpacktq.ifq_lock); 3223448Sdh155122 MUTEX_DESTROY(&ifs->ifs_ips_iptq.ifq_lock); 3232393Syz155240 } 3242393Syz155240 3253448Sdh155122 if (ifs->ifs_ips_table != NULL) { 3263448Sdh155122 KFREES(ifs->ifs_ips_table, 3273448Sdh155122 ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_table)); 3283448Sdh155122 ifs->ifs_ips_table = NULL; 3292393Syz155240 } 3302393Syz155240 3313448Sdh155122 if (ifs->ifs_ips_seed != NULL) { 3323448Sdh155122 KFREES(ifs->ifs_ips_seed, 3333448Sdh155122 ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_seed)); 3343448Sdh155122 ifs->ifs_ips_seed = NULL; 3352393Syz155240 } 3362393Syz155240 3373448Sdh155122 if (ifs->ifs_ips_stats.iss_bucketlen != NULL) { 3383448Sdh155122 KFREES(ifs->ifs_ips_stats.iss_bucketlen, 3393448Sdh155122 ifs->ifs_fr_statesize * sizeof(u_long)); 3403448Sdh155122 ifs->ifs_ips_stats.iss_bucketlen = NULL; 3413448Sdh155122 } 3423448Sdh155122 3433448Sdh155122 if (ifs->ifs_fr_state_maxbucket_reset == 1) 3443448Sdh155122 ifs->ifs_fr_state_maxbucket = 0; 3453448Sdh155122 3463448Sdh155122 if (ifs->ifs_fr_state_init == 1) { 3473448Sdh155122 ifs->ifs_fr_state_init = 0; 3483448Sdh155122 RW_DESTROY(&ifs->ifs_ipf_state); 3493448Sdh155122 MUTEX_DESTROY(&ifs->ifs_ipf_stinsert); 3502393Syz155240 } 3512393Syz155240 } 3522393Syz155240 3532393Syz155240 3542393Syz155240 /* ------------------------------------------------------------------------ */ 3552393Syz155240 /* Function: fr_statetstats */ 3562393Syz155240 /* Returns: ips_state_t* - pointer to state stats structure */ 3572393Syz155240 /* Parameters: Nil */ 3582393Syz155240 /* */ 3592393Syz155240 /* Put all the current numbers and pointers into a single struct and return */ 3602393Syz155240 /* a pointer to it. */ 3612393Syz155240 /* ------------------------------------------------------------------------ */ 3623448Sdh155122 static ips_stat_t *fr_statetstats(ifs) 3633448Sdh155122 ipf_stack_t *ifs; 3642393Syz155240 { 3653448Sdh155122 ifs->ifs_ips_stats.iss_active = ifs->ifs_ips_num; 3663448Sdh155122 ifs->ifs_ips_stats.iss_statesize = ifs->ifs_fr_statesize; 3673448Sdh155122 ifs->ifs_ips_stats.iss_statemax = ifs->ifs_fr_statemax; 3683448Sdh155122 ifs->ifs_ips_stats.iss_table = ifs->ifs_ips_table; 3693448Sdh155122 ifs->ifs_ips_stats.iss_list = ifs->ifs_ips_list; 3703448Sdh155122 ifs->ifs_ips_stats.iss_ticks = ifs->ifs_fr_ticks; 3713448Sdh155122 return &ifs->ifs_ips_stats; 3722393Syz155240 } 3732393Syz155240 3742393Syz155240 /* ------------------------------------------------------------------------ */ 3752393Syz155240 /* Function: fr_state_remove */ 3762393Syz155240 /* Returns: int - 0 == success, != 0 == failure */ 3772393Syz155240 /* Parameters: data(I) - pointer to state structure to delete from table */ 3782393Syz155240 /* */ 3792393Syz155240 /* Search for a state structure that matches the one passed, according to */ 3802393Syz155240 /* the IP addresses and other protocol specific information. */ 3812393Syz155240 /* ------------------------------------------------------------------------ */ 3823448Sdh155122 static int fr_state_remove(data, ifs) 3832393Syz155240 caddr_t data; 3843448Sdh155122 ipf_stack_t *ifs; 3852393Syz155240 { 3862393Syz155240 ipstate_t *sp, st; 3872393Syz155240 int error; 3882393Syz155240 3892393Syz155240 sp = &st; 3902393Syz155240 error = fr_inobj(data, &st, IPFOBJ_IPSTATE); 3912393Syz155240 if (error) 3922393Syz155240 return EFAULT; 3932393Syz155240 3943448Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state); 3953448Sdh155122 for (sp = ifs->ifs_ips_list; sp; sp = sp->is_next) 3962393Syz155240 if ((sp->is_p == st.is_p) && (sp->is_v == st.is_v) && 3972393Syz155240 !bcmp((caddr_t)&sp->is_src, (caddr_t)&st.is_src, 3982393Syz155240 sizeof(st.is_src)) && 3992393Syz155240 !bcmp((caddr_t)&sp->is_dst, (caddr_t)&st.is_src, 4002393Syz155240 sizeof(st.is_dst)) && 4012393Syz155240 !bcmp((caddr_t)&sp->is_ps, (caddr_t)&st.is_ps, 4022393Syz155240 sizeof(st.is_ps))) { 4033448Sdh155122 fr_delstate(sp, ISL_REMOVE, ifs); 4043448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 4052393Syz155240 return 0; 4062393Syz155240 } 4073448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 4082393Syz155240 return ESRCH; 4092393Syz155240 } 4102393Syz155240 4112393Syz155240 4122393Syz155240 /* ------------------------------------------------------------------------ */ 4132393Syz155240 /* Function: fr_state_ioctl */ 4142393Syz155240 /* Returns: int - 0 == success, != 0 == failure */ 4152393Syz155240 /* Parameters: data(I) - pointer to ioctl data */ 4162393Syz155240 /* cmd(I) - ioctl command integer */ 4172393Syz155240 /* mode(I) - file mode bits used with open */ 4182393Syz155240 /* */ 4192393Syz155240 /* Processes an ioctl call made to operate on the IP Filter state device. */ 4202393Syz155240 /* ------------------------------------------------------------------------ */ 4213448Sdh155122 int fr_state_ioctl(data, cmd, mode, uid, ctx, ifs) 4222393Syz155240 caddr_t data; 4232393Syz155240 ioctlcmd_t cmd; 4243448Sdh155122 int mode, uid; 4253448Sdh155122 void *ctx; 4263448Sdh155122 ipf_stack_t *ifs; 4272393Syz155240 { 4282393Syz155240 int arg, ret, error = 0; 4292393Syz155240 4302393Syz155240 switch (cmd) 4312393Syz155240 { 4322393Syz155240 /* 4332393Syz155240 * Delete an entry from the state table. 4342393Syz155240 */ 4352393Syz155240 case SIOCDELST : 4363448Sdh155122 error = fr_state_remove(data, ifs); 4372393Syz155240 break; 4382393Syz155240 /* 4392393Syz155240 * Flush the state table 4402393Syz155240 */ 4412393Syz155240 case SIOCIPFFL : 4422393Syz155240 BCOPYIN(data, (char *)&arg, sizeof(arg)); 4432393Syz155240 if (arg == 0 || arg == 1) { 4443448Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state); 4453448Sdh155122 ret = fr_state_flush(arg, 4, ifs); 4463448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 4472393Syz155240 BCOPYOUT((char *)&ret, data, sizeof(ret)); 4482393Syz155240 } else 4492393Syz155240 error = EINVAL; 4502393Syz155240 break; 4512393Syz155240 #ifdef USE_INET6 4522393Syz155240 case SIOCIPFL6 : 4532393Syz155240 BCOPYIN(data, (char *)&arg, sizeof(arg)); 4542393Syz155240 if (arg == 0 || arg == 1) { 4553448Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state); 4563448Sdh155122 ret = fr_state_flush(arg, 6, ifs); 4573448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 4582393Syz155240 BCOPYOUT((char *)&ret, data, sizeof(ret)); 4592393Syz155240 } else 4602393Syz155240 error = EINVAL; 4612393Syz155240 break; 4622393Syz155240 #endif 4632393Syz155240 #ifdef IPFILTER_LOG 4642393Syz155240 /* 4652393Syz155240 * Flush the state log. 4662393Syz155240 */ 4672393Syz155240 case SIOCIPFFB : 4682393Syz155240 if (!(mode & FWRITE)) 4692393Syz155240 error = EPERM; 4702393Syz155240 else { 4712393Syz155240 int tmp; 4722393Syz155240 4733448Sdh155122 tmp = ipflog_clear(IPL_LOGSTATE, ifs); 4742393Syz155240 BCOPYOUT((char *)&tmp, data, sizeof(tmp)); 4752393Syz155240 } 4762393Syz155240 break; 4772393Syz155240 /* 4782393Syz155240 * Turn logging of state information on/off. 4792393Syz155240 */ 4802393Syz155240 case SIOCSETLG : 4812393Syz155240 if (!(mode & FWRITE)) 4822393Syz155240 error = EPERM; 4832393Syz155240 else { 4843448Sdh155122 BCOPYIN((char *)data, 4853448Sdh155122 (char *)&ifs->ifs_ipstate_logging, 4863448Sdh155122 sizeof(ifs->ifs_ipstate_logging)); 4872393Syz155240 } 4882393Syz155240 break; 4892393Syz155240 /* 4902393Syz155240 * Return the current state of logging. 4912393Syz155240 */ 4922393Syz155240 case SIOCGETLG : 4933448Sdh155122 BCOPYOUT((char *)&ifs->ifs_ipstate_logging, (char *)data, 4943448Sdh155122 sizeof(ifs->ifs_ipstate_logging)); 4952393Syz155240 break; 4962393Syz155240 /* 4972393Syz155240 * Return the number of bytes currently waiting to be read. 4982393Syz155240 */ 4992393Syz155240 case FIONREAD : 5003448Sdh155122 arg = ifs->ifs_iplused[IPL_LOGSTATE]; /* returned in an int */ 5012393Syz155240 BCOPYOUT((char *)&arg, data, sizeof(arg)); 5022393Syz155240 break; 5032393Syz155240 #endif 5042393Syz155240 /* 5052393Syz155240 * Get the current state statistics. 5062393Syz155240 */ 5072393Syz155240 case SIOCGETFS : 5083448Sdh155122 error = fr_outobj(data, fr_statetstats(ifs), IPFOBJ_STATESTAT); 5092393Syz155240 break; 5102393Syz155240 /* 5112393Syz155240 * Lock/Unlock the state table. (Locking prevents any changes, which 5122393Syz155240 * means no packets match). 5132393Syz155240 */ 5142393Syz155240 case SIOCSTLCK : 5152393Syz155240 if (!(mode & FWRITE)) { 5162393Syz155240 error = EPERM; 5172393Syz155240 } else { 5183448Sdh155122 fr_lock(data, &ifs->ifs_fr_state_lock); 5192393Syz155240 } 5202393Syz155240 break; 5212393Syz155240 /* 5222393Syz155240 * Add an entry to the current state table. 5232393Syz155240 */ 5242393Syz155240 case SIOCSTPUT : 5253448Sdh155122 if (!ifs->ifs_fr_state_lock || !(mode &FWRITE)) { 5262393Syz155240 error = EACCES; 5272393Syz155240 break; 5282393Syz155240 } 5293448Sdh155122 error = fr_stputent(data, ifs); 5302393Syz155240 break; 5312393Syz155240 /* 5322393Syz155240 * Get a state table entry. 5332393Syz155240 */ 5342393Syz155240 case SIOCSTGET : 5353448Sdh155122 if (!ifs->ifs_fr_state_lock) { 5362393Syz155240 error = EACCES; 5372393Syz155240 break; 5382393Syz155240 } 5393448Sdh155122 error = fr_stgetent(data, ifs); 5402393Syz155240 break; 5413448Sdh155122 5423448Sdh155122 case SIOCGENITER : 5433448Sdh155122 { 5443448Sdh155122 ipftoken_t *token; 5453448Sdh155122 ipfgeniter_t iter; 5463448Sdh155122 5473448Sdh155122 error = fr_inobj(data, &iter, IPFOBJ_GENITER); 5483448Sdh155122 if (error != 0) 5493448Sdh155122 break; 5503448Sdh155122 5513448Sdh155122 token = ipf_findtoken(IPFGENITER_STATE, uid, ctx, ifs); 5523448Sdh155122 if (token != NULL) 5533448Sdh155122 error = fr_stateiter(token, &iter, ifs); 5543448Sdh155122 else 5553448Sdh155122 error = ESRCH; 5563448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_tokens); 5573448Sdh155122 break; 5583448Sdh155122 } 5593448Sdh155122 5603448Sdh155122 case SIOCIPFDELTOK : 5613448Sdh155122 (void) BCOPYIN(data, (char *)&arg, sizeof(arg)); 5623448Sdh155122 error = ipf_deltoken(arg, uid, ctx, ifs); 5633448Sdh155122 break; 5643448Sdh155122 5652393Syz155240 default : 5662393Syz155240 error = EINVAL; 5672393Syz155240 break; 5682393Syz155240 } 5692393Syz155240 return error; 5702393Syz155240 } 5712393Syz155240 5722393Syz155240 5732393Syz155240 /* ------------------------------------------------------------------------ */ 5742393Syz155240 /* Function: fr_stgetent */ 5752393Syz155240 /* Returns: int - 0 == success, != 0 == failure */ 5762393Syz155240 /* Parameters: data(I) - pointer to state structure to retrieve from table */ 5772393Syz155240 /* */ 5782393Syz155240 /* Copy out state information from the kernel to a user space process. If */ 5792393Syz155240 /* there is a filter rule associated with the state entry, copy that out */ 5802393Syz155240 /* as well. The entry to copy out is taken from the value of "ips_next" in */ 5812393Syz155240 /* the struct passed in and if not null and not found in the list of current*/ 5822393Syz155240 /* state entries, the retrieval fails. */ 5832393Syz155240 /* ------------------------------------------------------------------------ */ 5843448Sdh155122 int fr_stgetent(data, ifs) 5852393Syz155240 caddr_t data; 5863448Sdh155122 ipf_stack_t *ifs; 5872393Syz155240 { 5882393Syz155240 ipstate_t *is, *isn; 5892393Syz155240 ipstate_save_t ips; 5902393Syz155240 int error; 5912393Syz155240 5922393Syz155240 error = fr_inobj(data, &ips, IPFOBJ_STATESAVE); 5932393Syz155240 if (error) 5942393Syz155240 return EFAULT; 5952393Syz155240 5962393Syz155240 isn = ips.ips_next; 5972393Syz155240 if (isn == NULL) { 5983448Sdh155122 isn = ifs->ifs_ips_list; 5992393Syz155240 if (isn == NULL) { 6002393Syz155240 if (ips.ips_next == NULL) 6012393Syz155240 return ENOENT; 6022393Syz155240 return 0; 6032393Syz155240 } 6042393Syz155240 } else { 6052393Syz155240 /* 6062393Syz155240 * Make sure the pointer we're copying from exists in the 6072393Syz155240 * current list of entries. Security precaution to prevent 6082393Syz155240 * copying of random kernel data. 6092393Syz155240 */ 6103448Sdh155122 for (is = ifs->ifs_ips_list; is; is = is->is_next) 6112393Syz155240 if (is == isn) 6122393Syz155240 break; 6132393Syz155240 if (!is) 6142393Syz155240 return ESRCH; 6152393Syz155240 } 6162393Syz155240 ips.ips_next = isn->is_next; 6172393Syz155240 bcopy((char *)isn, (char *)&ips.ips_is, sizeof(ips.ips_is)); 6182393Syz155240 ips.ips_rule = isn->is_rule; 6192393Syz155240 if (isn->is_rule != NULL) 6202393Syz155240 bcopy((char *)isn->is_rule, (char *)&ips.ips_fr, 6212393Syz155240 sizeof(ips.ips_fr)); 6222393Syz155240 error = fr_outobj(data, &ips, IPFOBJ_STATESAVE); 6232393Syz155240 if (error) 6242393Syz155240 return EFAULT; 6252393Syz155240 return 0; 6262393Syz155240 } 6272393Syz155240 6282393Syz155240 6292393Syz155240 /* ------------------------------------------------------------------------ */ 6302393Syz155240 /* Function: fr_stputent */ 6312393Syz155240 /* Returns: int - 0 == success, != 0 == failure */ 6322393Syz155240 /* Parameters: data(I) - pointer to state information struct */ 6332393Syz155240 /* */ 6342393Syz155240 /* This function implements the SIOCSTPUT ioctl: insert a state entry into */ 6352393Syz155240 /* the state table. If the state info. includes a pointer to a filter rule */ 6362393Syz155240 /* then also add in an orphaned rule (will not show up in any "ipfstat -io" */ 6372393Syz155240 /* output. */ 6382393Syz155240 /* ------------------------------------------------------------------------ */ 6393448Sdh155122 int fr_stputent(data, ifs) 6402393Syz155240 caddr_t data; 6413448Sdh155122 ipf_stack_t *ifs; 6422393Syz155240 { 6432393Syz155240 ipstate_t *is, *isn; 6442393Syz155240 ipstate_save_t ips; 6452393Syz155240 int error, i; 6462393Syz155240 frentry_t *fr; 6472393Syz155240 char *name; 6482393Syz155240 6492393Syz155240 error = fr_inobj(data, &ips, IPFOBJ_STATESAVE); 6502393Syz155240 if (error) 6512393Syz155240 return EFAULT; 6522393Syz155240 6532393Syz155240 KMALLOC(isn, ipstate_t *); 6542393Syz155240 if (isn == NULL) 6552393Syz155240 return ENOMEM; 6562393Syz155240 6572393Syz155240 bcopy((char *)&ips.ips_is, (char *)isn, sizeof(*isn)); 6582393Syz155240 bzero((char *)isn, offsetof(struct ipstate, is_pkts)); 6592393Syz155240 isn->is_sti.tqe_pnext = NULL; 6602393Syz155240 isn->is_sti.tqe_next = NULL; 6612393Syz155240 isn->is_sti.tqe_ifq = NULL; 6622393Syz155240 isn->is_sti.tqe_parent = isn; 6632393Syz155240 isn->is_ifp[0] = NULL; 6642393Syz155240 isn->is_ifp[1] = NULL; 6652393Syz155240 isn->is_ifp[2] = NULL; 6662393Syz155240 isn->is_ifp[3] = NULL; 6672393Syz155240 isn->is_sync = NULL; 6682393Syz155240 fr = ips.ips_rule; 6692393Syz155240 6702393Syz155240 if (fr == NULL) { 6713448Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 6723448Sdh155122 fr_stinsert(isn, 0, ifs); 6732393Syz155240 MUTEX_EXIT(&isn->is_lock); 6743448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 6752393Syz155240 return 0; 6762393Syz155240 } 6772393Syz155240 6782393Syz155240 if (isn->is_flags & SI_NEWFR) { 6792393Syz155240 KMALLOC(fr, frentry_t *); 6802393Syz155240 if (fr == NULL) { 6812393Syz155240 KFREE(isn); 6822393Syz155240 return ENOMEM; 6832393Syz155240 } 6842393Syz155240 bcopy((char *)&ips.ips_fr, (char *)fr, sizeof(*fr)); 6852393Syz155240 isn->is_rule = fr; 6862393Syz155240 ips.ips_is.is_rule = fr; 6872393Syz155240 MUTEX_NUKE(&fr->fr_lock); 6882393Syz155240 MUTEX_INIT(&fr->fr_lock, "state filter rule lock"); 6892393Syz155240 6902393Syz155240 /* 6912393Syz155240 * Look up all the interface names in the rule. 6922393Syz155240 */ 6932393Syz155240 for (i = 0; i < 4; i++) { 6942393Syz155240 name = fr->fr_ifnames[i]; 6953448Sdh155122 fr->fr_ifas[i] = fr_resolvenic(name, fr->fr_v, ifs); 6962393Syz155240 name = isn->is_ifname[i]; 6973448Sdh155122 isn->is_ifp[i] = fr_resolvenic(name, isn->is_v, ifs); 6982393Syz155240 } 6992393Syz155240 7002393Syz155240 fr->fr_ref = 0; 7012393Syz155240 fr->fr_dsize = 0; 7022393Syz155240 fr->fr_data = NULL; 7032393Syz155240 7043448Sdh155122 fr_resolvedest(&fr->fr_tif, fr->fr_v, ifs); 7053448Sdh155122 fr_resolvedest(&fr->fr_dif, fr->fr_v, ifs); 7062393Syz155240 7072393Syz155240 /* 7082393Syz155240 * send a copy back to userland of what we ended up 7092393Syz155240 * to allow for verification. 7102393Syz155240 */ 7112393Syz155240 error = fr_outobj(data, &ips, IPFOBJ_STATESAVE); 7122393Syz155240 if (error) { 7132393Syz155240 KFREE(isn); 7142393Syz155240 MUTEX_DESTROY(&fr->fr_lock); 7152393Syz155240 KFREE(fr); 7162393Syz155240 return EFAULT; 7172393Syz155240 } 7183448Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 7193448Sdh155122 fr_stinsert(isn, 0, ifs); 7202393Syz155240 MUTEX_EXIT(&isn->is_lock); 7213448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 7222393Syz155240 7232393Syz155240 } else { 7243448Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 7253448Sdh155122 for (is = ifs->ifs_ips_list; is; is = is->is_next) 7262393Syz155240 if (is->is_rule == fr) { 7273448Sdh155122 fr_stinsert(isn, 0, ifs); 7282393Syz155240 MUTEX_EXIT(&isn->is_lock); 7292393Syz155240 break; 7302393Syz155240 } 7312393Syz155240 7322393Syz155240 if (is == NULL) { 7332393Syz155240 KFREE(isn); 7342393Syz155240 isn = NULL; 7352393Syz155240 } 7363448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 7372393Syz155240 7382393Syz155240 return (isn == NULL) ? ESRCH : 0; 7392393Syz155240 } 7402393Syz155240 7412393Syz155240 return 0; 7422393Syz155240 } 7432393Syz155240 7442393Syz155240 7452393Syz155240 /* ------------------------------------------------------------------------ */ 7462393Syz155240 /* Function: fr_stinsert */ 7472393Syz155240 /* Returns: Nil */ 7482393Syz155240 /* Parameters: is(I) - pointer to state structure */ 7492393Syz155240 /* rev(I) - flag indicating forward/reverse direction of packet */ 7502393Syz155240 /* */ 7512393Syz155240 /* Inserts a state structure into the hash table (for lookups) and the list */ 7522393Syz155240 /* of state entries (for enumeration). Resolves all of the interface names */ 7532393Syz155240 /* to pointers and adjusts running stats for the hash table as appropriate. */ 7542393Syz155240 /* */ 7552393Syz155240 /* Locking: it is assumed that some kind of lock on ipf_state is held. */ 7562393Syz155240 /* Exits with is_lock initialised and held. */ 7572393Syz155240 /* ------------------------------------------------------------------------ */ 7583448Sdh155122 void fr_stinsert(is, rev, ifs) 7592393Syz155240 ipstate_t *is; 7602393Syz155240 int rev; 7613448Sdh155122 ipf_stack_t *ifs; 7622393Syz155240 { 7632393Syz155240 frentry_t *fr; 7642393Syz155240 u_int hv; 7652393Syz155240 int i; 7662393Syz155240 7672393Syz155240 MUTEX_INIT(&is->is_lock, "ipf state entry"); 7682393Syz155240 7692393Syz155240 fr = is->is_rule; 7702393Syz155240 if (fr != NULL) { 7712393Syz155240 MUTEX_ENTER(&fr->fr_lock); 7722393Syz155240 fr->fr_ref++; 7732393Syz155240 fr->fr_statecnt++; 7742393Syz155240 MUTEX_EXIT(&fr->fr_lock); 7752393Syz155240 } 7762393Syz155240 7772393Syz155240 /* 7782393Syz155240 * Look up all the interface names in the state entry. 7792393Syz155240 */ 7802393Syz155240 for (i = 0; i < 4; i++) { 7812393Syz155240 if (is->is_ifp[i] != NULL) 7822393Syz155240 continue; 7833448Sdh155122 is->is_ifp[i] = fr_resolvenic(is->is_ifname[i], is->is_v, ifs); 7842393Syz155240 } 7852393Syz155240 7862393Syz155240 /* 7872393Syz155240 * If we could trust is_hv, then the modulous would not be needed, but 7882393Syz155240 * when running with IPFILTER_SYNC, this stops bad values. 7892393Syz155240 */ 7903448Sdh155122 hv = is->is_hv % ifs->ifs_fr_statesize; 7912393Syz155240 is->is_hv = hv; 7922393Syz155240 7932393Syz155240 /* 7942393Syz155240 * We need to get both of these locks...the first because it is 7952393Syz155240 * possible that once the insert is complete another packet might 7962393Syz155240 * come along, match the entry and want to update it. 7972393Syz155240 */ 7982393Syz155240 MUTEX_ENTER(&is->is_lock); 7993448Sdh155122 MUTEX_ENTER(&ifs->ifs_ipf_stinsert); 8002393Syz155240 8012393Syz155240 /* 8022393Syz155240 * add into list table. 8032393Syz155240 */ 8043448Sdh155122 if (ifs->ifs_ips_list != NULL) 8053448Sdh155122 ifs->ifs_ips_list->is_pnext = &is->is_next; 8063448Sdh155122 is->is_pnext = &ifs->ifs_ips_list; 8073448Sdh155122 is->is_next = ifs->ifs_ips_list; 8083448Sdh155122 ifs->ifs_ips_list = is; 8093448Sdh155122 8103448Sdh155122 if (ifs->ifs_ips_table[hv] != NULL) 8113448Sdh155122 ifs->ifs_ips_table[hv]->is_phnext = &is->is_hnext; 8122393Syz155240 else 8133448Sdh155122 ifs->ifs_ips_stats.iss_inuse++; 8143448Sdh155122 is->is_phnext = ifs->ifs_ips_table + hv; 8153448Sdh155122 is->is_hnext = ifs->ifs_ips_table[hv]; 8163448Sdh155122 ifs->ifs_ips_table[hv] = is; 8173448Sdh155122 ifs->ifs_ips_stats.iss_bucketlen[hv]++; 8183448Sdh155122 ifs->ifs_ips_num++; 8193448Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_stinsert); 8203448Sdh155122 8213448Sdh155122 fr_setstatequeue(is, rev, ifs); 8222393Syz155240 } 8232393Syz155240 8242393Syz155240 8252393Syz155240 /* ------------------------------------------------------------------------ */ 8262393Syz155240 /* Function: fr_addstate */ 8272393Syz155240 /* Returns: ipstate_t* - NULL == failure, else pointer to new state */ 8282393Syz155240 /* Parameters: fin(I) - pointer to packet information */ 8292393Syz155240 /* stsave(O) - pointer to place to save pointer to created */ 8302393Syz155240 /* state structure. */ 8312393Syz155240 /* flags(I) - flags to use when creating the structure */ 8322393Syz155240 /* */ 8332393Syz155240 /* Creates a new IP state structure from the packet information collected. */ 8342393Syz155240 /* Inserts it into the state table and appends to the bottom of the active */ 8352393Syz155240 /* list. If the capacity of the table has reached the maximum allowed then */ 8362393Syz155240 /* the call will fail and a flush is scheduled for the next timeout call. */ 8372393Syz155240 /* ------------------------------------------------------------------------ */ 8382393Syz155240 ipstate_t *fr_addstate(fin, stsave, flags) 8392393Syz155240 fr_info_t *fin; 8402393Syz155240 ipstate_t **stsave; 8412393Syz155240 u_int flags; 8422393Syz155240 { 8432393Syz155240 ipstate_t *is, ips; 8442393Syz155240 struct icmp *ic; 8452393Syz155240 u_int pass, hv; 8462393Syz155240 frentry_t *fr; 8472393Syz155240 tcphdr_t *tcp; 8482393Syz155240 grehdr_t *gre; 8492393Syz155240 void *ifp; 8502393Syz155240 int out; 8513448Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 8523448Sdh155122 8533448Sdh155122 if (ifs->ifs_fr_state_lock || 8542393Syz155240 (fin->fin_flx & (FI_SHORT|FI_STATE|FI_FRAGBODY|FI_BAD))) 8552393Syz155240 return NULL; 8562393Syz155240 8572393Syz155240 if ((fin->fin_flx & FI_OOW) && !(fin->fin_tcpf & TH_SYN)) 8582393Syz155240 return NULL; 8592393Syz155240 8602393Syz155240 /* 8612393Syz155240 * If a "keep state" rule has reached the maximum number of references 8622393Syz155240 * to it, then schedule an automatic flush in case we can clear out 8632944Sjojemann * some "dead old wood". Note that because the lock isn't held on 8642944Sjojemann * fr it is possible that we could overflow. The cost of overflowing 8652944Sjojemann * is being ignored here as the number by which it can overflow is 8662944Sjojemann * a product of the number of simultaneous threads that could be 8672944Sjojemann * executing in here, so a limit of 100 won't result in 200, but could 8682944Sjojemann * result in 101 or 102. 8692393Syz155240 */ 8702944Sjojemann fr = fin->fin_fr; 8712944Sjojemann if (fr != NULL) { 8723448Sdh155122 if ((ifs->ifs_ips_num == ifs->ifs_fr_statemax) && (fr->fr_statemax == 0)) { 8733448Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_max); 8743448Sdh155122 ifs->ifs_fr_state_doflush = 1; 8752944Sjojemann return NULL; 8762944Sjojemann } 8772944Sjojemann if ((fr->fr_statemax != 0) && 8782944Sjojemann (fr->fr_statecnt >= fr->fr_statemax)) { 8793448Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_maxref); 8803448Sdh155122 ifs->ifs_fr_state_doflush = 1; 8812944Sjojemann return NULL; 8822944Sjojemann } 8832393Syz155240 } 8842393Syz155240 8852393Syz155240 pass = (fr == NULL) ? 0 : fr->fr_flags; 8862393Syz155240 8872393Syz155240 ic = NULL; 8882393Syz155240 tcp = NULL; 8892393Syz155240 out = fin->fin_out; 8902393Syz155240 is = &ips; 8912393Syz155240 bzero((char *)is, sizeof(*is)); 8923448Sdh155122 is->is_die = 1 + ifs->ifs_fr_ticks; 8932393Syz155240 8942393Syz155240 /* 8952393Syz155240 * Copy and calculate... 8962393Syz155240 */ 8972393Syz155240 hv = (is->is_p = fin->fin_fi.fi_p); 8982393Syz155240 is->is_src = fin->fin_fi.fi_src; 8992393Syz155240 hv += is->is_saddr; 9002393Syz155240 is->is_dst = fin->fin_fi.fi_dst; 9012393Syz155240 hv += is->is_daddr; 9022393Syz155240 #ifdef USE_INET6 9032393Syz155240 if (fin->fin_v == 6) { 9042393Syz155240 /* 9052393Syz155240 * For ICMPv6, we check to see if the destination address is 9062393Syz155240 * a multicast address. If it is, do not include it in the 9072393Syz155240 * calculation of the hash because the correct reply will come 9082393Syz155240 * back from a real address, not a multicast address. 9092393Syz155240 */ 9102393Syz155240 if ((is->is_p == IPPROTO_ICMPV6) && 9112393Syz155240 IN6_IS_ADDR_MULTICAST(&is->is_dst.in6)) { 9122393Syz155240 /* 9132393Syz155240 * So you can do keep state with neighbour discovery. 9142393Syz155240 * 9152393Syz155240 * Here we could use the address from the neighbour 9162393Syz155240 * solicit message to put in the state structure and 9172393Syz155240 * we could use that without a wildcard flag too... 9182393Syz155240 */ 9192393Syz155240 is->is_flags |= SI_W_DADDR; 9202393Syz155240 hv -= is->is_daddr; 9212393Syz155240 } else { 9222393Syz155240 hv += is->is_dst.i6[1]; 9232393Syz155240 hv += is->is_dst.i6[2]; 9242393Syz155240 hv += is->is_dst.i6[3]; 9252393Syz155240 } 9262393Syz155240 hv += is->is_src.i6[1]; 9272393Syz155240 hv += is->is_src.i6[2]; 9282393Syz155240 hv += is->is_src.i6[3]; 9292393Syz155240 } 9302393Syz155240 #endif 9312393Syz155240 9322393Syz155240 switch (is->is_p) 9332393Syz155240 { 9342393Syz155240 #ifdef USE_INET6 9352393Syz155240 case IPPROTO_ICMPV6 : 9362393Syz155240 ic = fin->fin_dp; 9372393Syz155240 9382393Syz155240 switch (ic->icmp_type) 9392393Syz155240 { 9402393Syz155240 case ICMP6_ECHO_REQUEST : 9412393Syz155240 is->is_icmp.ici_type = ic->icmp_type; 9422393Syz155240 hv += (is->is_icmp.ici_id = ic->icmp_id); 9432393Syz155240 break; 9442393Syz155240 case ICMP6_MEMBERSHIP_QUERY : 9452393Syz155240 case ND_ROUTER_SOLICIT : 9462393Syz155240 case ND_NEIGHBOR_SOLICIT : 9472393Syz155240 case ICMP6_NI_QUERY : 9482393Syz155240 is->is_icmp.ici_type = ic->icmp_type; 9492393Syz155240 break; 9502393Syz155240 default : 9512393Syz155240 return NULL; 9522393Syz155240 } 9533448Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_icmp); 9542393Syz155240 break; 9552393Syz155240 #endif 9562393Syz155240 case IPPROTO_ICMP : 9572393Syz155240 ic = fin->fin_dp; 9582393Syz155240 9592393Syz155240 switch (ic->icmp_type) 9602393Syz155240 { 9612393Syz155240 case ICMP_ECHO : 9622393Syz155240 case ICMP_TSTAMP : 9632393Syz155240 case ICMP_IREQ : 9642393Syz155240 case ICMP_MASKREQ : 9652393Syz155240 is->is_icmp.ici_type = ic->icmp_type; 9662393Syz155240 hv += (is->is_icmp.ici_id = ic->icmp_id); 9672393Syz155240 break; 9682393Syz155240 default : 9692393Syz155240 return NULL; 9702393Syz155240 } 9713448Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_icmp); 9722393Syz155240 break; 9732393Syz155240 9742393Syz155240 case IPPROTO_GRE : 9752393Syz155240 gre = fin->fin_dp; 9762393Syz155240 9772393Syz155240 is->is_gre.gs_flags = gre->gr_flags; 9782393Syz155240 is->is_gre.gs_ptype = gre->gr_ptype; 9792393Syz155240 if (GRE_REV(is->is_gre.gs_flags) == 1) { 9802393Syz155240 is->is_call[0] = fin->fin_data[0]; 9812393Syz155240 is->is_call[1] = fin->fin_data[1]; 9822393Syz155240 } 9832393Syz155240 break; 9842393Syz155240 9852393Syz155240 case IPPROTO_TCP : 9862393Syz155240 tcp = fin->fin_dp; 9872393Syz155240 9882393Syz155240 if (tcp->th_flags & TH_RST) 9892393Syz155240 return NULL; 9902393Syz155240 /* 9912393Syz155240 * The endian of the ports doesn't matter, but the ack and 9922393Syz155240 * sequence numbers do as we do mathematics on them later. 9932393Syz155240 */ 9942393Syz155240 is->is_sport = htons(fin->fin_data[0]); 9952393Syz155240 is->is_dport = htons(fin->fin_data[1]); 9962393Syz155240 if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) { 9972393Syz155240 hv += is->is_sport; 9982393Syz155240 hv += is->is_dport; 9992393Syz155240 } 10002393Syz155240 10012393Syz155240 /* 10022393Syz155240 * If this is a real packet then initialise fields in the 10032393Syz155240 * state information structure from the TCP header information. 10042393Syz155240 */ 10052393Syz155240 10062393Syz155240 is->is_maxdwin = 1; 10072393Syz155240 is->is_maxswin = ntohs(tcp->th_win); 10082393Syz155240 if (is->is_maxswin == 0) 10092393Syz155240 is->is_maxswin = 1; 10102393Syz155240 10112393Syz155240 if ((fin->fin_flx & FI_IGNORE) == 0) { 10122393Syz155240 is->is_send = ntohl(tcp->th_seq) + fin->fin_dlen - 10132393Syz155240 (TCP_OFF(tcp) << 2) + 10142393Syz155240 ((tcp->th_flags & TH_SYN) ? 1 : 0) + 10152393Syz155240 ((tcp->th_flags & TH_FIN) ? 1 : 0); 10162393Syz155240 is->is_maxsend = is->is_send; 10172393Syz155240 10182393Syz155240 /* 10192393Syz155240 * Window scale option is only present in 10202393Syz155240 * SYN/SYN-ACK packet. 10212393Syz155240 */ 10222393Syz155240 if ((tcp->th_flags & ~(TH_FIN|TH_ACK|TH_ECNALL)) == 10232393Syz155240 TH_SYN && 10242393Syz155240 (TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) { 10252393Syz155240 if (fr_tcpoptions(fin, tcp, 10262393Syz155240 &is->is_tcp.ts_data[0])) 10272393Syz155240 is->is_swinflags = TCP_WSCALE_SEEN| 10282393Syz155240 TCP_WSCALE_FIRST; 10292393Syz155240 } 10302393Syz155240 10312393Syz155240 if ((fin->fin_out != 0) && (pass & FR_NEWISN) != 0) { 10322393Syz155240 fr_checknewisn(fin, is); 10332393Syz155240 fr_fixoutisn(fin, is); 10342393Syz155240 } 10352393Syz155240 10362393Syz155240 if ((tcp->th_flags & TH_OPENING) == TH_SYN) 10372393Syz155240 flags |= IS_TCPFSM; 10382393Syz155240 else { 10392393Syz155240 is->is_maxdwin = is->is_maxswin * 2; 10402393Syz155240 is->is_dend = ntohl(tcp->th_ack); 10412393Syz155240 is->is_maxdend = ntohl(tcp->th_ack); 10422393Syz155240 is->is_maxdwin *= 2; 10432393Syz155240 } 10442393Syz155240 } 10452393Syz155240 10462393Syz155240 /* 10472393Syz155240 * If we're creating state for a starting connection, start the 10482393Syz155240 * timer on it as we'll never see an error if it fails to 10492393Syz155240 * connect. 10502393Syz155240 */ 10513448Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_tcp); 10522393Syz155240 break; 10532393Syz155240 10542393Syz155240 case IPPROTO_UDP : 10552393Syz155240 tcp = fin->fin_dp; 10562393Syz155240 10572393Syz155240 is->is_sport = htons(fin->fin_data[0]); 10582393Syz155240 is->is_dport = htons(fin->fin_data[1]); 10592393Syz155240 if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) { 10602393Syz155240 hv += tcp->th_dport; 10612393Syz155240 hv += tcp->th_sport; 10622393Syz155240 } 10633448Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_udp); 10642393Syz155240 break; 10652393Syz155240 10662393Syz155240 default : 10672393Syz155240 break; 10682393Syz155240 } 10693448Sdh155122 hv = DOUBLE_HASH(hv, ifs); 10702393Syz155240 is->is_hv = hv; 10712393Syz155240 is->is_rule = fr; 10722393Syz155240 is->is_flags = flags & IS_INHERITED; 10732393Syz155240 10742393Syz155240 /* 10752393Syz155240 * Look for identical state. 10762393Syz155240 */ 10773448Sdh155122 for (is = ifs->ifs_ips_table[is->is_hv % ifs->ifs_fr_statesize]; 10783448Sdh155122 is != NULL; 10792393Syz155240 is = is->is_hnext) { 10802393Syz155240 if (bcmp(&ips.is_src, &is->is_src, 10812393Syz155240 offsetof(struct ipstate, is_ps) - 10822393Syz155240 offsetof(struct ipstate, is_src)) == 0) 10832393Syz155240 break; 10842393Syz155240 } 10852393Syz155240 if (is != NULL) 10862393Syz155240 return NULL; 10872393Syz155240 10883448Sdh155122 if (ifs->ifs_ips_stats.iss_bucketlen[hv] >= ifs->ifs_fr_state_maxbucket) { 10893448Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_bucketfull); 10902393Syz155240 return NULL; 10912393Syz155240 } 10922393Syz155240 KMALLOC(is, ipstate_t *); 10932393Syz155240 if (is == NULL) { 10943448Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_nomem); 10952393Syz155240 return NULL; 10962393Syz155240 } 10972393Syz155240 bcopy((char *)&ips, (char *)is, sizeof(*is)); 10982393Syz155240 /* 10992393Syz155240 * Do not do the modulous here, it is done in fr_stinsert(). 11002393Syz155240 */ 11012393Syz155240 if (fr != NULL) { 11022393Syz155240 (void) strncpy(is->is_group, fr->fr_group, FR_GROUPLEN); 11032393Syz155240 if (fr->fr_age[0] != 0) { 11043448Sdh155122 is->is_tqehead[0] = 11053448Sdh155122 fr_addtimeoutqueue(&ifs->ifs_ips_utqe, 11063448Sdh155122 fr->fr_age[0], ifs); 11072393Syz155240 is->is_sti.tqe_flags |= TQE_RULEBASED; 11082393Syz155240 } 11092393Syz155240 if (fr->fr_age[1] != 0) { 11103448Sdh155122 is->is_tqehead[1] = 11113448Sdh155122 fr_addtimeoutqueue(&ifs->ifs_ips_utqe, 11123448Sdh155122 fr->fr_age[1], ifs); 11132393Syz155240 is->is_sti.tqe_flags |= TQE_RULEBASED; 11142393Syz155240 } 11152393Syz155240 is->is_tag = fr->fr_logtag; 11162393Syz155240 11172393Syz155240 is->is_ifp[(out << 1) + 1] = fr->fr_ifas[1]; 11182393Syz155240 is->is_ifp[(1 - out) << 1] = fr->fr_ifas[2]; 11192393Syz155240 is->is_ifp[((1 - out) << 1) + 1] = fr->fr_ifas[3]; 11202393Syz155240 11212393Syz155240 if (((ifp = fr->fr_ifas[1]) != NULL) && 11222393Syz155240 (ifp != (void *)-1)) { 11232958Sdr146992 COPYIFNAME(ifp, is->is_ifname[(out << 1) + 1], fr->fr_v); 11242393Syz155240 } 11252393Syz155240 if (((ifp = fr->fr_ifas[2]) != NULL) && 11262393Syz155240 (ifp != (void *)-1)) { 11272958Sdr146992 COPYIFNAME(ifp, is->is_ifname[(1 - out) << 1], fr->fr_v); 11282393Syz155240 } 11292393Syz155240 if (((ifp = fr->fr_ifas[3]) != NULL) && 11302393Syz155240 (ifp != (void *)-1)) { 11312958Sdr146992 COPYIFNAME(ifp, is->is_ifname[((1 - out) << 1) + 1], fr->fr_v); 11322393Syz155240 } 11332393Syz155240 } else { 11343448Sdh155122 pass = ifs->ifs_fr_flags; 11352393Syz155240 is->is_tag = FR_NOLOGTAG; 11362393Syz155240 } 11372393Syz155240 11382393Syz155240 is->is_ifp[out << 1] = fin->fin_ifp; 11392393Syz155240 if (fin->fin_ifp != NULL) { 11402958Sdr146992 COPYIFNAME(fin->fin_ifp, is->is_ifname[out << 1], fr->fr_v); 11412393Syz155240 } 11422393Syz155240 11432393Syz155240 /* 11442393Syz155240 * It may seem strange to set is_ref to 2, but fr_check() will call 11452393Syz155240 * fr_statederef() after calling fr_addstate() and the idea is to 11462393Syz155240 * have it exist at the end of fr_check() with is_ref == 1. 11472393Syz155240 */ 11482393Syz155240 is->is_ref = 2; 11492393Syz155240 is->is_pass = pass; 11502393Syz155240 is->is_pkts[0] = 0, is->is_bytes[0] = 0; 11512393Syz155240 is->is_pkts[1] = 0, is->is_bytes[1] = 0; 11522393Syz155240 is->is_pkts[2] = 0, is->is_bytes[2] = 0; 11532393Syz155240 is->is_pkts[3] = 0, is->is_bytes[3] = 0; 11542393Syz155240 if ((fin->fin_flx & FI_IGNORE) == 0) { 11552393Syz155240 is->is_pkts[out] = 1; 11562393Syz155240 is->is_bytes[out] = fin->fin_plen; 11572393Syz155240 is->is_flx[out][0] = fin->fin_flx & FI_CMP; 11582393Syz155240 is->is_flx[out][0] &= ~FI_OOW; 11592393Syz155240 } 11602393Syz155240 11612393Syz155240 if (pass & FR_STSTRICT) 11622393Syz155240 is->is_flags |= IS_STRICT; 11632393Syz155240 11642393Syz155240 if (pass & FR_STATESYNC) 11652393Syz155240 is->is_flags |= IS_STATESYNC; 11662393Syz155240 11672393Syz155240 /* 11682393Syz155240 * We want to check everything that is a property of this packet, 11692393Syz155240 * but we don't (automatically) care about it's fragment status as 11702393Syz155240 * this may change. 11712393Syz155240 */ 11722393Syz155240 is->is_v = fin->fin_v; 11732393Syz155240 is->is_opt[0] = fin->fin_optmsk; 11742393Syz155240 is->is_optmsk[0] = 0xffffffff; 11752393Syz155240 is->is_optmsk[1] = 0xffffffff; 11762393Syz155240 if (is->is_v == 6) { 11772393Syz155240 is->is_opt[0] &= ~0x8; 11782393Syz155240 is->is_optmsk[0] &= ~0x8; 11792393Syz155240 is->is_optmsk[1] &= ~0x8; 11802393Syz155240 } 11812393Syz155240 is->is_sec = fin->fin_secmsk; 11822393Syz155240 is->is_secmsk = 0xffff; 11832393Syz155240 is->is_auth = fin->fin_auth; 11842393Syz155240 is->is_authmsk = 0xffff; 11852393Syz155240 if (flags & (SI_WILDP|SI_WILDA)) { 11863448Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_wild); 11872393Syz155240 } 11882393Syz155240 is->is_rulen = fin->fin_rule; 11892393Syz155240 11902393Syz155240 11912393Syz155240 if (pass & FR_LOGFIRST) 11922393Syz155240 is->is_pass &= ~(FR_LOGFIRST|FR_LOG); 11932393Syz155240 11943448Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 11952393Syz155240 is->is_me = stsave; 11962393Syz155240 11973448Sdh155122 fr_stinsert(is, fin->fin_rev, ifs); 11982393Syz155240 11992393Syz155240 if (fin->fin_p == IPPROTO_TCP) { 12002393Syz155240 /* 12012393Syz155240 * If we're creating state for a starting connection, start the 12022393Syz155240 * timer on it as we'll never see an error if it fails to 12032393Syz155240 * connect. 12042393Syz155240 */ 12053448Sdh155122 (void) fr_tcp_age(&is->is_sti, fin, ifs->ifs_ips_tqtqb, 12063448Sdh155122 is->is_flags); 12072393Syz155240 MUTEX_EXIT(&is->is_lock); 12082393Syz155240 #ifdef IPFILTER_SCAN 12092393Syz155240 if ((is->is_flags & SI_CLONE) == 0) 12102393Syz155240 (void) ipsc_attachis(is); 12112393Syz155240 #endif 12122393Syz155240 } else { 12132393Syz155240 MUTEX_EXIT(&is->is_lock); 12142393Syz155240 } 12152393Syz155240 #ifdef IPFILTER_SYNC 12162393Syz155240 if ((is->is_flags & IS_STATESYNC) && ((is->is_flags & SI_CLONE) == 0)) 12172393Syz155240 is->is_sync = ipfsync_new(SMC_STATE, fin, is); 12182393Syz155240 #endif 12193448Sdh155122 if (ifs->ifs_ipstate_logging) 12203448Sdh155122 ipstate_log(is, ISL_NEW, ifs); 12213448Sdh155122 12223448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 12232393Syz155240 fin->fin_state = is; 12242393Syz155240 fin->fin_rev = IP6_NEQ(&is->is_dst, &fin->fin_daddr); 12252393Syz155240 fin->fin_flx |= FI_STATE; 12262393Syz155240 if (fin->fin_flx & FI_FRAG) 12272393Syz155240 (void) fr_newfrag(fin, pass ^ FR_KEEPSTATE); 12282393Syz155240 12292393Syz155240 return is; 12302393Syz155240 } 12312393Syz155240 12322393Syz155240 12332393Syz155240 /* ------------------------------------------------------------------------ */ 12342393Syz155240 /* Function: fr_tcpoptions */ 12352393Syz155240 /* Returns: int - 1 == packet matches state entry, 0 == it does not */ 12362393Syz155240 /* Parameters: fin(I) - pointer to packet information */ 12372393Syz155240 /* tcp(I) - pointer to TCP packet header */ 12382393Syz155240 /* td(I) - pointer to TCP data held as part of the state */ 12392393Syz155240 /* */ 12402393Syz155240 /* Look after the TCP header for any options and deal with those that are */ 12412393Syz155240 /* present. Record details about those that we recogise. */ 12422393Syz155240 /* ------------------------------------------------------------------------ */ 12432393Syz155240 static int fr_tcpoptions(fin, tcp, td) 12442393Syz155240 fr_info_t *fin; 12452393Syz155240 tcphdr_t *tcp; 12462393Syz155240 tcpdata_t *td; 12472393Syz155240 { 12482393Syz155240 int off, mlen, ol, i, len, retval; 12492393Syz155240 char buf[64], *s, opt; 12502393Syz155240 mb_t *m = NULL; 12512393Syz155240 12522393Syz155240 len = (TCP_OFF(tcp) << 2); 12532393Syz155240 if (fin->fin_dlen < len) 12542393Syz155240 return 0; 12552393Syz155240 len -= sizeof(*tcp); 12562393Syz155240 12572393Syz155240 off = fin->fin_plen - fin->fin_dlen + sizeof(*tcp) + fin->fin_ipoff; 12582393Syz155240 12592393Syz155240 m = fin->fin_m; 12602393Syz155240 mlen = MSGDSIZE(m) - off; 12612393Syz155240 if (len > mlen) { 12622393Syz155240 len = mlen; 12632393Syz155240 retval = 0; 12642393Syz155240 } else { 12652393Syz155240 retval = 1; 12662393Syz155240 } 12672393Syz155240 12682393Syz155240 COPYDATA(m, off, len, buf); 12692393Syz155240 12702393Syz155240 for (s = buf; len > 0; ) { 12712393Syz155240 opt = *s; 12722393Syz155240 if (opt == TCPOPT_EOL) 12732393Syz155240 break; 12742393Syz155240 else if (opt == TCPOPT_NOP) 12752393Syz155240 ol = 1; 12762393Syz155240 else { 12772393Syz155240 if (len < 2) 12782393Syz155240 break; 12792393Syz155240 ol = (int)*(s + 1); 12802393Syz155240 if (ol < 2 || ol > len) 12812393Syz155240 break; 12822393Syz155240 12832393Syz155240 /* 12842393Syz155240 * Extract the TCP options we are interested in out of 12852393Syz155240 * the header and store them in the the tcpdata struct. 12862393Syz155240 */ 12872393Syz155240 switch (opt) 12882393Syz155240 { 12892393Syz155240 case TCPOPT_WINDOW : 12902393Syz155240 if (ol == TCPOLEN_WINDOW) { 12912393Syz155240 i = (int)*(s + 2); 12922393Syz155240 if (i > TCP_WSCALE_MAX) 12932393Syz155240 i = TCP_WSCALE_MAX; 12942393Syz155240 else if (i < 0) 12952393Syz155240 i = 0; 12962393Syz155240 td->td_winscale = i; 12972393Syz155240 } 12982393Syz155240 break; 12992393Syz155240 case TCPOPT_MAXSEG : 13002393Syz155240 /* 13012393Syz155240 * So, if we wanted to set the TCP MAXSEG, 13022393Syz155240 * it should be done here... 13032393Syz155240 */ 13042393Syz155240 if (ol == TCPOLEN_MAXSEG) { 13052393Syz155240 i = (int)*(s + 2); 13062393Syz155240 i <<= 8; 13072393Syz155240 i += (int)*(s + 3); 13082393Syz155240 td->td_maxseg = i; 13092393Syz155240 } 13102393Syz155240 break; 13112393Syz155240 } 13122393Syz155240 } 13132393Syz155240 len -= ol; 13142393Syz155240 s += ol; 13152393Syz155240 } 13162393Syz155240 return retval; 13172393Syz155240 } 13182393Syz155240 13192393Syz155240 13202393Syz155240 /* ------------------------------------------------------------------------ */ 13212393Syz155240 /* Function: fr_tcpstate */ 13222393Syz155240 /* Returns: int - 1 == packet matches state entry, 0 == it does not */ 13232393Syz155240 /* Parameters: fin(I) - pointer to packet information */ 13242393Syz155240 /* tcp(I) - pointer to TCP packet header */ 13252393Syz155240 /* is(I) - pointer to master state structure */ 13262393Syz155240 /* */ 13272393Syz155240 /* Check to see if a packet with TCP headers fits within the TCP window. */ 13282393Syz155240 /* Change timeout depending on whether new packet is a SYN-ACK returning */ 13292393Syz155240 /* for a SYN or a RST or FIN which indicate time to close up shop. */ 13302393Syz155240 /* ------------------------------------------------------------------------ */ 13312393Syz155240 static int fr_tcpstate(fin, tcp, is) 13322393Syz155240 fr_info_t *fin; 13332393Syz155240 tcphdr_t *tcp; 13342393Syz155240 ipstate_t *is; 13352393Syz155240 { 13362393Syz155240 int source, ret = 0, flags; 13372393Syz155240 tcpdata_t *fdata, *tdata; 13383448Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 13392393Syz155240 13402393Syz155240 source = !fin->fin_rev; 13412393Syz155240 if (((is->is_flags & IS_TCPFSM) != 0) && (source == 1) && 13422393Syz155240 (ntohs(is->is_sport) != fin->fin_data[0])) 13432393Syz155240 source = 0; 13442393Syz155240 fdata = &is->is_tcp.ts_data[!source]; 13452393Syz155240 tdata = &is->is_tcp.ts_data[source]; 13462393Syz155240 13472393Syz155240 MUTEX_ENTER(&is->is_lock); 13482393Syz155240 if (fr_tcpinwindow(fin, fdata, tdata, tcp, is->is_flags)) { 13492393Syz155240 #ifdef IPFILTER_SCAN 13502393Syz155240 if (is->is_flags & (IS_SC_CLIENT|IS_SC_SERVER)) { 13512393Syz155240 ipsc_packet(fin, is); 13522393Syz155240 if (FR_ISBLOCK(is->is_pass)) { 13532393Syz155240 MUTEX_EXIT(&is->is_lock); 13542393Syz155240 return 1; 13552393Syz155240 } 13562393Syz155240 } 13572393Syz155240 #endif 13582393Syz155240 13592393Syz155240 /* 13602393Syz155240 * Nearing end of connection, start timeout. 13612393Syz155240 */ 13623448Sdh155122 ret = fr_tcp_age(&is->is_sti, fin, ifs->ifs_ips_tqtqb, 13633448Sdh155122 is->is_flags); 13642393Syz155240 if (ret == 0) { 13652393Syz155240 MUTEX_EXIT(&is->is_lock); 13662393Syz155240 return 0; 13672393Syz155240 } 13682393Syz155240 13692393Syz155240 /* 13702393Syz155240 * set s0's as appropriate. Use syn-ack packet as it 13712393Syz155240 * contains both pieces of required information. 13722393Syz155240 */ 13732393Syz155240 /* 13742393Syz155240 * Window scale option is only present in SYN/SYN-ACK packet. 13752393Syz155240 * Compare with ~TH_FIN to mask out T/TCP setups. 13762393Syz155240 */ 13772393Syz155240 flags = tcp->th_flags & ~(TH_FIN|TH_ECNALL); 13782393Syz155240 if (flags == (TH_SYN|TH_ACK)) { 13792393Syz155240 is->is_s0[source] = ntohl(tcp->th_ack); 13802393Syz155240 is->is_s0[!source] = ntohl(tcp->th_seq) + 1; 13812393Syz155240 if ((TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2)) && 13822393Syz155240 tdata->td_winscale) { 13832393Syz155240 if (fr_tcpoptions(fin, tcp, fdata)) { 13842393Syz155240 fdata->td_winflags = TCP_WSCALE_SEEN| 13852393Syz155240 TCP_WSCALE_FIRST; 13862393Syz155240 } else { 13872393Syz155240 if (!fdata->td_winscale) 13882393Syz155240 tdata->td_winscale = 0; 13892393Syz155240 } 13902393Syz155240 } 13912393Syz155240 if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN)) 13922393Syz155240 fr_checknewisn(fin, is); 13932393Syz155240 } else if (flags == TH_SYN) { 13942393Syz155240 is->is_s0[source] = ntohl(tcp->th_seq) + 1; 13952393Syz155240 if ((TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) 13962393Syz155240 if (fr_tcpoptions(fin, tcp, tdata)) { 13972393Syz155240 tdata->td_winflags = TCP_WSCALE_SEEN| 13982393Syz155240 TCP_WSCALE_FIRST; 13992393Syz155240 } 14002393Syz155240 14012393Syz155240 if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN)) 14022393Syz155240 fr_checknewisn(fin, is); 14032393Syz155240 14042393Syz155240 } 14052393Syz155240 ret = 1; 14062393Syz155240 } else 14072393Syz155240 fin->fin_flx |= FI_OOW; 14082393Syz155240 MUTEX_EXIT(&is->is_lock); 14092393Syz155240 return ret; 14102393Syz155240 } 14112393Syz155240 14122393Syz155240 14132393Syz155240 /* ------------------------------------------------------------------------ */ 14142393Syz155240 /* Function: fr_checknewisn */ 14152393Syz155240 /* Returns: Nil */ 14162393Syz155240 /* Parameters: fin(I) - pointer to packet information */ 14172393Syz155240 /* is(I) - pointer to master state structure */ 14182393Syz155240 /* */ 14192393Syz155240 /* Check to see if this TCP connection is expecting and needs a new */ 14202393Syz155240 /* sequence number for a particular direction of the connection. */ 14212393Syz155240 /* */ 14222393Syz155240 /* NOTE: This does not actually change the sequence numbers, only gets new */ 14232393Syz155240 /* one ready. */ 14242393Syz155240 /* ------------------------------------------------------------------------ */ 14252393Syz155240 static void fr_checknewisn(fin, is) 14262393Syz155240 fr_info_t *fin; 14272393Syz155240 ipstate_t *is; 14282393Syz155240 { 14292393Syz155240 u_32_t sumd, old, new; 14302393Syz155240 tcphdr_t *tcp; 14312393Syz155240 int i; 14322393Syz155240 14332393Syz155240 i = fin->fin_rev; 14342393Syz155240 tcp = fin->fin_dp; 14352393Syz155240 14362393Syz155240 if (((i == 0) && !(is->is_flags & IS_ISNSYN)) || 14372393Syz155240 ((i == 1) && !(is->is_flags & IS_ISNACK))) { 14382393Syz155240 old = ntohl(tcp->th_seq); 14392393Syz155240 new = fr_newisn(fin); 14402393Syz155240 is->is_isninc[i] = new - old; 14412393Syz155240 CALC_SUMD(old, new, sumd); 14422393Syz155240 is->is_sumd[i] = (sumd & 0xffff) + (sumd >> 16); 14432393Syz155240 14442393Syz155240 is->is_flags |= ((i == 0) ? IS_ISNSYN : IS_ISNACK); 14452393Syz155240 } 14462393Syz155240 } 14472393Syz155240 14482393Syz155240 14492393Syz155240 /* ------------------------------------------------------------------------ */ 14502393Syz155240 /* Function: fr_tcpinwindow */ 14512393Syz155240 /* Returns: int - 1 == packet inside TCP "window", 0 == not inside. */ 14522393Syz155240 /* Parameters: fin(I) - pointer to packet information */ 14532393Syz155240 /* fdata(I) - pointer to tcp state informatio (forward) */ 14542393Syz155240 /* tdata(I) - pointer to tcp state informatio (reverse) */ 14552393Syz155240 /* tcp(I) - pointer to TCP packet header */ 14562393Syz155240 /* */ 14572393Syz155240 /* Given a packet has matched addresses and ports, check to see if it is */ 14582393Syz155240 /* within the TCP data window. In a show of generosity, allow packets that */ 14592393Syz155240 /* are within the window space behind the current sequence # as well. */ 14602393Syz155240 /* ------------------------------------------------------------------------ */ 14612393Syz155240 int fr_tcpinwindow(fin, fdata, tdata, tcp, flags) 14622393Syz155240 fr_info_t *fin; 14632393Syz155240 tcpdata_t *fdata, *tdata; 14642393Syz155240 tcphdr_t *tcp; 14652393Syz155240 int flags; 14662393Syz155240 { 14672393Syz155240 tcp_seq seq, ack, end; 14682393Syz155240 int ackskew, tcpflags; 14692393Syz155240 u_32_t win, maxwin; 14702393Syz155240 14712393Syz155240 /* 14722393Syz155240 * Find difference between last checked packet and this packet. 14732393Syz155240 */ 14742393Syz155240 tcpflags = tcp->th_flags; 14752393Syz155240 seq = ntohl(tcp->th_seq); 14762393Syz155240 ack = ntohl(tcp->th_ack); 14772393Syz155240 if (tcpflags & TH_SYN) 14782393Syz155240 win = ntohs(tcp->th_win); 14792393Syz155240 else 14802393Syz155240 win = ntohs(tcp->th_win) << fdata->td_winscale; 14812393Syz155240 if (win == 0) 14822393Syz155240 win = 1; 14832393Syz155240 14842393Syz155240 /* 14852393Syz155240 * if window scaling is present, the scaling is only allowed 14862393Syz155240 * for windows not in the first SYN packet. In that packet the 14872393Syz155240 * window is 65535 to specify the largest window possible 14882393Syz155240 * for receivers not implementing the window scale option. 14892393Syz155240 * Currently, we do not assume TTCP here. That means that 14902393Syz155240 * if we see a second packet from a host (after the initial 14912393Syz155240 * SYN), we can assume that the receiver of the SYN did 14922393Syz155240 * already send back the SYN/ACK (and thus that we know if 14932393Syz155240 * the receiver also does window scaling) 14942393Syz155240 */ 14952393Syz155240 if (!(tcpflags & TH_SYN) && (fdata->td_winflags & TCP_WSCALE_FIRST)) { 14962393Syz155240 if (tdata->td_winflags & TCP_WSCALE_SEEN) { 14972393Syz155240 fdata->td_winflags &= ~TCP_WSCALE_FIRST; 14982393Syz155240 fdata->td_maxwin = win; 14992393Syz155240 } else { 15002393Syz155240 fdata->td_winscale = 0; 15012393Syz155240 fdata->td_winflags = 0; 15022393Syz155240 tdata->td_winscale = 0; 15032393Syz155240 tdata->td_winflags = 0; 15042393Syz155240 } 15052393Syz155240 } 15062393Syz155240 15072393Syz155240 end = seq + fin->fin_dlen - (TCP_OFF(tcp) << 2) + 15082393Syz155240 ((tcpflags & TH_SYN) ? 1 : 0) + ((tcpflags & TH_FIN) ? 1 : 0); 15092393Syz155240 15102393Syz155240 if ((fdata->td_end == 0) && 15112393Syz155240 (!(flags & IS_TCPFSM) || 15122393Syz155240 ((tcpflags & TH_OPENING) == TH_OPENING))) { 15132393Syz155240 /* 15142393Syz155240 * Must be a (outgoing) SYN-ACK in reply to a SYN. 15152393Syz155240 */ 15162393Syz155240 fdata->td_end = end; 15172393Syz155240 fdata->td_maxwin = 1; 15182393Syz155240 fdata->td_maxend = end + win; 15192393Syz155240 } 15202393Syz155240 15212393Syz155240 if (!(tcpflags & TH_ACK)) { /* Pretend an ack was sent */ 15222393Syz155240 ack = tdata->td_end; 15232393Syz155240 } else if (((tcpflags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) && 15242393Syz155240 (ack == 0)) { 15252393Syz155240 /* gross hack to get around certain broken tcp stacks */ 15262393Syz155240 ack = tdata->td_end; 15272393Syz155240 } 15282393Syz155240 15292393Syz155240 if (seq == end) 15302393Syz155240 seq = end = fdata->td_end; 15312393Syz155240 15322393Syz155240 maxwin = tdata->td_maxwin; 15332393Syz155240 ackskew = tdata->td_end - ack; 15342393Syz155240 15352393Syz155240 /* 15362393Syz155240 * Strict sequencing only allows in-order delivery. 15372393Syz155240 */ 15382393Syz155240 if ((flags & IS_STRICT) != 0) { 15392393Syz155240 if (seq != fdata->td_end) { 15402393Syz155240 return 0; 15412393Syz155240 } 15422393Syz155240 } 15432393Syz155240 15442393Syz155240 #define SEQ_GE(a,b) ((int)((a) - (b)) >= 0) 15452393Syz155240 #define SEQ_GT(a,b) ((int)((a) - (b)) > 0) 15462393Syz155240 if ( 15472393Syz155240 #if defined(_KERNEL) 15482393Syz155240 (SEQ_GE(fdata->td_maxend, end)) && 15492393Syz155240 (SEQ_GE(seq, fdata->td_end - maxwin)) && 15502393Syz155240 #endif 15512393Syz155240 /* XXX what about big packets */ 15522393Syz155240 #define MAXACKWINDOW 66000 15532393Syz155240 (-ackskew <= (MAXACKWINDOW << fdata->td_winscale)) && 15542393Syz155240 ( ackskew <= (MAXACKWINDOW << fdata->td_winscale))) { 15552393Syz155240 15562393Syz155240 /* if ackskew < 0 then this should be due to fragmented 15572393Syz155240 * packets. There is no way to know the length of the 15582393Syz155240 * total packet in advance. 15592393Syz155240 * We do know the total length from the fragment cache though. 15602393Syz155240 * Note however that there might be more sessions with 15612393Syz155240 * exactly the same source and destination parameters in the 15622393Syz155240 * state cache (and source and destination is the only stuff 15632393Syz155240 * that is saved in the fragment cache). Note further that 15642393Syz155240 * some TCP connections in the state cache are hashed with 15652393Syz155240 * sport and dport as well which makes it not worthwhile to 15662393Syz155240 * look for them. 15672393Syz155240 * Thus, when ackskew is negative but still seems to belong 15682393Syz155240 * to this session, we bump up the destinations end value. 15692393Syz155240 */ 15702393Syz155240 if (ackskew < 0) 15712393Syz155240 tdata->td_end = ack; 15722393Syz155240 15732393Syz155240 /* update max window seen */ 15742393Syz155240 if (fdata->td_maxwin < win) 15752393Syz155240 fdata->td_maxwin = win; 15762393Syz155240 if (SEQ_GT(end, fdata->td_end)) 15772393Syz155240 fdata->td_end = end; 15782393Syz155240 if (SEQ_GE(ack + win, tdata->td_maxend)) 15792393Syz155240 tdata->td_maxend = ack + win; 15802393Syz155240 return 1; 15812393Syz155240 } 15822393Syz155240 return 0; 15832393Syz155240 } 15842393Syz155240 15852393Syz155240 15862393Syz155240 /* ------------------------------------------------------------------------ */ 15872393Syz155240 /* Function: fr_stclone */ 15882393Syz155240 /* Returns: ipstate_t* - NULL == cloning failed, */ 15892393Syz155240 /* else pointer to new state structure */ 15902393Syz155240 /* Parameters: fin(I) - pointer to packet information */ 15912393Syz155240 /* tcp(I) - pointer to TCP/UDP header */ 15922393Syz155240 /* is(I) - pointer to master state structure */ 15932393Syz155240 /* */ 15942393Syz155240 /* Create a "duplcate" state table entry from the master. */ 15952393Syz155240 /* ------------------------------------------------------------------------ */ 15962393Syz155240 static ipstate_t *fr_stclone(fin, tcp, is) 15972393Syz155240 fr_info_t *fin; 15982393Syz155240 tcphdr_t *tcp; 15992393Syz155240 ipstate_t *is; 16002393Syz155240 { 16012393Syz155240 ipstate_t *clone; 16022393Syz155240 u_32_t send; 16033448Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 16043448Sdh155122 16053448Sdh155122 if (ifs->ifs_ips_num == ifs->ifs_fr_statemax) { 16063448Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_max); 16073448Sdh155122 ifs->ifs_fr_state_doflush = 1; 16082393Syz155240 return NULL; 16092393Syz155240 } 16102393Syz155240 KMALLOC(clone, ipstate_t *); 16112393Syz155240 if (clone == NULL) 16122393Syz155240 return NULL; 16132393Syz155240 bcopy((char *)is, (char *)clone, sizeof(*clone)); 16142393Syz155240 16152393Syz155240 MUTEX_NUKE(&clone->is_lock); 16162393Syz155240 16173448Sdh155122 clone->is_die = ONE_DAY + ifs->ifs_fr_ticks; 16182393Syz155240 clone->is_state[0] = 0; 16192393Syz155240 clone->is_state[1] = 0; 16202393Syz155240 send = ntohl(tcp->th_seq) + fin->fin_dlen - (TCP_OFF(tcp) << 2) + 16212393Syz155240 ((tcp->th_flags & TH_SYN) ? 1 : 0) + 16222393Syz155240 ((tcp->th_flags & TH_FIN) ? 1 : 0); 16232393Syz155240 16242393Syz155240 if (fin->fin_rev == 1) { 16252393Syz155240 clone->is_dend = send; 16262393Syz155240 clone->is_maxdend = send; 16272393Syz155240 clone->is_send = 0; 16282393Syz155240 clone->is_maxswin = 1; 16292393Syz155240 clone->is_maxdwin = ntohs(tcp->th_win); 16302393Syz155240 if (clone->is_maxdwin == 0) 16312393Syz155240 clone->is_maxdwin = 1; 16322393Syz155240 } else { 16332393Syz155240 clone->is_send = send; 16342393Syz155240 clone->is_maxsend = send; 16352393Syz155240 clone->is_dend = 0; 16362393Syz155240 clone->is_maxdwin = 1; 16372393Syz155240 clone->is_maxswin = ntohs(tcp->th_win); 16382393Syz155240 if (clone->is_maxswin == 0) 16392393Syz155240 clone->is_maxswin = 1; 16402393Syz155240 } 16412393Syz155240 16422393Syz155240 clone->is_flags &= ~SI_CLONE; 16432393Syz155240 clone->is_flags |= SI_CLONED; 16443448Sdh155122 fr_stinsert(clone, fin->fin_rev, ifs); 16452393Syz155240 clone->is_ref = 2; 16462393Syz155240 if (clone->is_p == IPPROTO_TCP) { 16473448Sdh155122 (void) fr_tcp_age(&clone->is_sti, fin, ifs->ifs_ips_tqtqb, 16482393Syz155240 clone->is_flags); 16492393Syz155240 } 16502393Syz155240 MUTEX_EXIT(&clone->is_lock); 16512393Syz155240 #ifdef IPFILTER_SCAN 16522393Syz155240 (void) ipsc_attachis(is); 16532393Syz155240 #endif 16542393Syz155240 #ifdef IPFILTER_SYNC 16552393Syz155240 if (is->is_flags & IS_STATESYNC) 16562393Syz155240 clone->is_sync = ipfsync_new(SMC_STATE, fin, clone); 16572393Syz155240 #endif 16582393Syz155240 return clone; 16592393Syz155240 } 16602393Syz155240 16612393Syz155240 16622393Syz155240 /* ------------------------------------------------------------------------ */ 16632393Syz155240 /* Function: fr_matchsrcdst */ 16642393Syz155240 /* Returns: Nil */ 16652393Syz155240 /* Parameters: fin(I) - pointer to packet information */ 16662393Syz155240 /* is(I) - pointer to state structure */ 16672393Syz155240 /* src(I) - pointer to source address */ 16682393Syz155240 /* dst(I) - pointer to destination address */ 16692393Syz155240 /* tcp(I) - pointer to TCP/UDP header */ 16702393Syz155240 /* */ 16712393Syz155240 /* Match a state table entry against an IP packet. The logic below is that */ 16722393Syz155240 /* ret gets set to one if the match succeeds, else remains 0. If it is */ 16732393Syz155240 /* still 0 after the test. no match. */ 16742393Syz155240 /* ------------------------------------------------------------------------ */ 16752393Syz155240 static ipstate_t *fr_matchsrcdst(fin, is, src, dst, tcp, cmask) 16762393Syz155240 fr_info_t *fin; 16772393Syz155240 ipstate_t *is; 16782393Syz155240 i6addr_t *src, *dst; 16792393Syz155240 tcphdr_t *tcp; 16802393Syz155240 u_32_t cmask; 16812393Syz155240 { 16822393Syz155240 int ret = 0, rev, out, flags, flx = 0, idx; 16832393Syz155240 u_short sp, dp; 16842393Syz155240 u_32_t cflx; 16852393Syz155240 void *ifp; 16863448Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 16872393Syz155240 16882393Syz155240 rev = IP6_NEQ(&is->is_dst, dst); 16892393Syz155240 ifp = fin->fin_ifp; 16902393Syz155240 out = fin->fin_out; 16912393Syz155240 flags = is->is_flags; 16922393Syz155240 sp = 0; 16932393Syz155240 dp = 0; 16942393Syz155240 16952393Syz155240 if (tcp != NULL) { 16962393Syz155240 sp = htons(fin->fin_sport); 16972393Syz155240 dp = ntohs(fin->fin_dport); 16982393Syz155240 } 16992393Syz155240 if (!rev) { 17002393Syz155240 if (tcp != NULL) { 17012393Syz155240 if (!(flags & SI_W_SPORT) && (sp != is->is_sport)) 17022393Syz155240 rev = 1; 17032393Syz155240 else if (!(flags & SI_W_DPORT) && (dp != is->is_dport)) 17042393Syz155240 rev = 1; 17052393Syz155240 } 17062393Syz155240 } 17072393Syz155240 17082393Syz155240 idx = (out << 1) + rev; 17092393Syz155240 17102393Syz155240 /* 17112393Syz155240 * If the interface for this 'direction' is set, make sure it matches. 17122393Syz155240 * An interface name that is not set matches any, as does a name of *. 17132393Syz155240 */ 17142393Syz155240 if ((is->is_ifp[idx] == NULL && 17152393Syz155240 (*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '*')) || 17162393Syz155240 is->is_ifp[idx] == ifp) 17172393Syz155240 ret = 1; 17182393Syz155240 17192393Syz155240 if (ret == 0) 17202393Syz155240 return NULL; 17212393Syz155240 ret = 0; 17222393Syz155240 17232393Syz155240 /* 17242393Syz155240 * Match addresses and ports. 17252393Syz155240 */ 17262393Syz155240 if (rev == 0) { 17272393Syz155240 if ((IP6_EQ(&is->is_dst, dst) || (flags & SI_W_DADDR)) && 17282393Syz155240 (IP6_EQ(&is->is_src, src) || (flags & SI_W_SADDR))) { 17292393Syz155240 if (tcp) { 17302393Syz155240 if ((sp == is->is_sport || flags & SI_W_SPORT)&& 17312393Syz155240 (dp == is->is_dport || flags & SI_W_DPORT)) 17322393Syz155240 ret = 1; 17332393Syz155240 } else { 17342393Syz155240 ret = 1; 17352393Syz155240 } 17362393Syz155240 } 17372393Syz155240 } else { 17382393Syz155240 if ((IP6_EQ(&is->is_dst, src) || (flags & SI_W_DADDR)) && 17392393Syz155240 (IP6_EQ(&is->is_src, dst) || (flags & SI_W_SADDR))) { 17402393Syz155240 if (tcp) { 17412393Syz155240 if ((dp == is->is_sport || flags & SI_W_SPORT)&& 17422393Syz155240 (sp == is->is_dport || flags & SI_W_DPORT)) 17432393Syz155240 ret = 1; 17442393Syz155240 } else { 17452393Syz155240 ret = 1; 17462393Syz155240 } 17472393Syz155240 } 17482393Syz155240 } 17492393Syz155240 17502393Syz155240 if (ret == 0) 17512393Syz155240 return NULL; 17522393Syz155240 17532393Syz155240 /* 17542393Syz155240 * Whether or not this should be here, is questionable, but the aim 17552393Syz155240 * is to get this out of the main line. 17562393Syz155240 */ 17572393Syz155240 if (tcp == NULL) 17582393Syz155240 flags = is->is_flags & ~(SI_WILDP|SI_NEWFR|SI_CLONE|SI_CLONED); 17592393Syz155240 17602393Syz155240 /* 17612393Syz155240 * Only one of the source or destination address can be flaged as a 17622393Syz155240 * wildcard. Fill in the missing address, if set. 17632393Syz155240 * For IPv6, if the address being copied in is multicast, then 17642393Syz155240 * don't reset the wild flag - multicast causes it to be set in the 17652393Syz155240 * first place! 17662393Syz155240 */ 17672393Syz155240 if ((flags & (SI_W_SADDR|SI_W_DADDR))) { 17682393Syz155240 fr_ip_t *fi = &fin->fin_fi; 17692393Syz155240 17702393Syz155240 if ((flags & SI_W_SADDR) != 0) { 17712393Syz155240 if (rev == 0) { 17722393Syz155240 #ifdef USE_INET6 17732393Syz155240 if (is->is_v == 6 && 17742393Syz155240 IN6_IS_ADDR_MULTICAST(&fi->fi_src.in6)) 17752393Syz155240 /*EMPTY*/; 17762393Syz155240 else 17772393Syz155240 #endif 17782393Syz155240 { 17792393Syz155240 is->is_src = fi->fi_src; 17802393Syz155240 is->is_flags &= ~SI_W_SADDR; 17812393Syz155240 } 17822393Syz155240 } else { 17832393Syz155240 #ifdef USE_INET6 17842393Syz155240 if (is->is_v == 6 && 17852393Syz155240 IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6)) 17862393Syz155240 /*EMPTY*/; 17872393Syz155240 else 17882393Syz155240 #endif 17892393Syz155240 { 17902393Syz155240 is->is_src = fi->fi_dst; 17912393Syz155240 is->is_flags &= ~SI_W_SADDR; 17922393Syz155240 } 17932393Syz155240 } 17942393Syz155240 } else if ((flags & SI_W_DADDR) != 0) { 17952393Syz155240 if (rev == 0) { 17962393Syz155240 #ifdef USE_INET6 17972393Syz155240 if (is->is_v == 6 && 17982393Syz155240 IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6)) 17992393Syz155240 /*EMPTY*/; 18002393Syz155240 else 18012393Syz155240 #endif 18022393Syz155240 { 18032393Syz155240 is->is_dst = fi->fi_dst; 18042393Syz155240 is->is_flags &= ~SI_W_DADDR; 18052393Syz155240 } 18062393Syz155240 } else { 18072393Syz155240 #ifdef USE_INET6 18082393Syz155240 if (is->is_v == 6 && 18092393Syz155240 IN6_IS_ADDR_MULTICAST(&fi->fi_src.in6)) 18102393Syz155240 /*EMPTY*/; 18112393Syz155240 else 18122393Syz155240 #endif 18132393Syz155240 { 18142393Syz155240 is->is_dst = fi->fi_src; 18152393Syz155240 is->is_flags &= ~SI_W_DADDR; 18162393Syz155240 } 18172393Syz155240 } 18182393Syz155240 } 18192393Syz155240 if ((is->is_flags & (SI_WILDA|SI_WILDP)) == 0) { 18203448Sdh155122 ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild); 18212393Syz155240 } 18222393Syz155240 } 18232393Syz155240 18242393Syz155240 flx = fin->fin_flx & cmask; 18252393Syz155240 cflx = is->is_flx[out][rev]; 18262393Syz155240 18272393Syz155240 /* 18282393Syz155240 * Match up any flags set from IP options. 18292393Syz155240 */ 18302393Syz155240 if ((cflx && (flx != (cflx & cmask))) || 18312393Syz155240 ((fin->fin_optmsk & is->is_optmsk[rev]) != is->is_opt[rev]) || 18322393Syz155240 ((fin->fin_secmsk & is->is_secmsk) != is->is_sec) || 18332393Syz155240 ((fin->fin_auth & is->is_authmsk) != is->is_auth)) 18342393Syz155240 return NULL; 18352393Syz155240 18362393Syz155240 /* 18372393Syz155240 * Only one of the source or destination port can be flagged as a 18382393Syz155240 * wildcard. When filling it in, fill in a copy of the matched entry 18392393Syz155240 * if it has the cloning flag set. 18402393Syz155240 */ 18412393Syz155240 if ((fin->fin_flx & FI_IGNORE) != 0) { 18422393Syz155240 fin->fin_rev = rev; 18432393Syz155240 return is; 18442393Syz155240 } 18452393Syz155240 18462393Syz155240 if ((flags & (SI_W_SPORT|SI_W_DPORT))) { 18472393Syz155240 if ((flags & SI_CLONE) != 0) { 18482393Syz155240 ipstate_t *clone; 18492393Syz155240 18502393Syz155240 clone = fr_stclone(fin, tcp, is); 18512393Syz155240 if (clone == NULL) 18522393Syz155240 return NULL; 18532393Syz155240 is = clone; 18542393Syz155240 } else { 18553448Sdh155122 ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild); 18562393Syz155240 } 18572393Syz155240 18582393Syz155240 if ((flags & SI_W_SPORT) != 0) { 18592393Syz155240 if (rev == 0) { 18602393Syz155240 is->is_sport = sp; 18612393Syz155240 is->is_send = ntohl(tcp->th_seq); 18622393Syz155240 } else { 18632393Syz155240 is->is_sport = dp; 18642393Syz155240 is->is_send = ntohl(tcp->th_ack); 18652393Syz155240 } 18662393Syz155240 is->is_maxsend = is->is_send + 1; 18672393Syz155240 } else if ((flags & SI_W_DPORT) != 0) { 18682393Syz155240 if (rev == 0) { 18692393Syz155240 is->is_dport = dp; 18702393Syz155240 is->is_dend = ntohl(tcp->th_ack); 18712393Syz155240 } else { 18722393Syz155240 is->is_dport = sp; 18732393Syz155240 is->is_dend = ntohl(tcp->th_seq); 18742393Syz155240 } 18752393Syz155240 is->is_maxdend = is->is_dend + 1; 18762393Syz155240 } 18772393Syz155240 is->is_flags &= ~(SI_W_SPORT|SI_W_DPORT); 18783448Sdh155122 if ((flags & SI_CLONED) && ifs->ifs_ipstate_logging) 18793448Sdh155122 ipstate_log(is, ISL_CLONE, ifs); 18802393Syz155240 } 18812393Syz155240 18822393Syz155240 ret = -1; 18832393Syz155240 18842393Syz155240 if (is->is_flx[out][rev] == 0) { 18852393Syz155240 is->is_flx[out][rev] = flx; 18862393Syz155240 is->is_opt[rev] = fin->fin_optmsk; 18872393Syz155240 if (is->is_v == 6) { 18882393Syz155240 is->is_opt[rev] &= ~0x8; 18892393Syz155240 is->is_optmsk[rev] &= ~0x8; 18902393Syz155240 } 18912393Syz155240 } 18922393Syz155240 18932393Syz155240 /* 18942393Syz155240 * Check if the interface name for this "direction" is set and if not, 18952393Syz155240 * fill it in. 18962393Syz155240 */ 18972393Syz155240 if (is->is_ifp[idx] == NULL && 18982393Syz155240 (*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '*')) { 18992393Syz155240 is->is_ifp[idx] = ifp; 19002958Sdr146992 COPYIFNAME(ifp, is->is_ifname[idx], fin->fin_v); 19012393Syz155240 } 19022393Syz155240 fin->fin_rev = rev; 19032393Syz155240 return is; 19042393Syz155240 } 19052393Syz155240 19062393Syz155240 19072393Syz155240 /* ------------------------------------------------------------------------ */ 19082393Syz155240 /* Function: fr_checkicmpmatchingstate */ 19092393Syz155240 /* Returns: Nil */ 19102393Syz155240 /* Parameters: fin(I) - pointer to packet information */ 19112393Syz155240 /* */ 19122393Syz155240 /* If we've got an ICMP error message, using the information stored in the */ 19132393Syz155240 /* ICMP packet, look for a matching state table entry. */ 19142393Syz155240 /* */ 19152393Syz155240 /* If we return NULL then no lock on ipf_state is held. */ 19162393Syz155240 /* If we return non-null then a read-lock on ipf_state is held. */ 19172393Syz155240 /* ------------------------------------------------------------------------ */ 19182393Syz155240 static ipstate_t *fr_checkicmpmatchingstate(fin) 19192393Syz155240 fr_info_t *fin; 19202393Syz155240 { 19212393Syz155240 ipstate_t *is, **isp; 19222393Syz155240 u_short sport, dport; 19232393Syz155240 u_char pr; 19242393Syz155240 int backward, i, oi; 19252393Syz155240 i6addr_t dst, src; 19262393Syz155240 struct icmp *ic; 19272393Syz155240 u_short savelen; 19282393Syz155240 icmphdr_t *icmp; 19292393Syz155240 fr_info_t ofin; 19302393Syz155240 tcphdr_t *tcp; 19312393Syz155240 int len; 19322393Syz155240 ip_t *oip; 19332393Syz155240 u_int hv; 19343448Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 19352393Syz155240 19362393Syz155240 /* 19372393Syz155240 * Does it at least have the return (basic) IP header ? 19382393Syz155240 * Is it an actual recognised ICMP error type? 19392393Syz155240 * Only a basic IP header (no options) should be with 19402393Syz155240 * an ICMP error header. 19412393Syz155240 */ 19422393Syz155240 if ((fin->fin_v != 4) || (fin->fin_hlen != sizeof(ip_t)) || 19432393Syz155240 (fin->fin_plen < ICMPERR_MINPKTLEN) || 19442393Syz155240 !(fin->fin_flx & FI_ICMPERR)) 19452393Syz155240 return NULL; 19462393Syz155240 ic = fin->fin_dp; 19472393Syz155240 19482393Syz155240 oip = (ip_t *)((char *)ic + ICMPERR_ICMPHLEN); 19492393Syz155240 /* 19502393Syz155240 * Check if the at least the old IP header (with options) and 19512393Syz155240 * 8 bytes of payload is present. 19522393Syz155240 */ 19532393Syz155240 if (fin->fin_plen < ICMPERR_MAXPKTLEN + ((IP_HL(oip) - 5) << 2)) 19542393Syz155240 return NULL; 19552393Syz155240 19562393Syz155240 /* 19572393Syz155240 * Sanity Checks. 19582393Syz155240 */ 19592393Syz155240 len = fin->fin_dlen - ICMPERR_ICMPHLEN; 19602393Syz155240 if ((len <= 0) || ((IP_HL(oip) << 2) > len)) 19612393Syz155240 return NULL; 19622393Syz155240 19632393Syz155240 /* 19642393Syz155240 * Is the buffer big enough for all of it ? It's the size of the IP 19652393Syz155240 * header claimed in the encapsulated part which is of concern. It 19662393Syz155240 * may be too big to be in this buffer but not so big that it's 19672393Syz155240 * outside the ICMP packet, leading to TCP deref's causing problems. 19682393Syz155240 * This is possible because we don't know how big oip_hl is when we 19692393Syz155240 * do the pullup early in fr_check() and thus can't guarantee it is 19702393Syz155240 * all here now. 19712393Syz155240 */ 19722393Syz155240 #ifdef _KERNEL 19732393Syz155240 { 19742393Syz155240 mb_t *m; 19752393Syz155240 19762393Syz155240 m = fin->fin_m; 19772393Syz155240 # if defined(MENTAT) 19782393Syz155240 if ((char *)oip + len > (char *)m->b_wptr) 19792393Syz155240 return NULL; 19802393Syz155240 # else 19812393Syz155240 if ((char *)oip + len > (char *)fin->fin_ip + m->m_len) 19822393Syz155240 return NULL; 19832393Syz155240 # endif 19842393Syz155240 } 19852393Syz155240 #endif 1986*3607Szf203873 bcopy((char *)fin, (char *)&ofin, sizeof(*fin)); 19872393Syz155240 19882393Syz155240 /* 19892393Syz155240 * in the IPv4 case we must zero the i6addr union otherwise 19902393Syz155240 * the IP6_EQ and IP6_NEQ macros produce the wrong results because 19912393Syz155240 * of the 'junk' in the unused part of the union 19922393Syz155240 */ 19932393Syz155240 bzero((char *)&src, sizeof(src)); 19942393Syz155240 bzero((char *)&dst, sizeof(dst)); 19952393Syz155240 19962393Syz155240 /* 19972393Syz155240 * we make an fin entry to be able to feed it to 19982393Syz155240 * matchsrcdst note that not all fields are encessary 19992393Syz155240 * but this is the cleanest way. Note further we fill 20002393Syz155240 * in fin_mp such that if someone uses it we'll get 20012393Syz155240 * a kernel panic. fr_matchsrcdst does not use this. 20022393Syz155240 * 20032393Syz155240 * watch out here, as ip is in host order and oip in network 20042393Syz155240 * order. Any change we make must be undone afterwards, like 20052393Syz155240 * oip->ip_off - it is still in network byte order so fix it. 20062393Syz155240 */ 20072393Syz155240 savelen = oip->ip_len; 20082393Syz155240 oip->ip_len = len; 20092393Syz155240 oip->ip_off = ntohs(oip->ip_off); 20102393Syz155240 20112393Syz155240 ofin.fin_flx = FI_NOCKSUM; 20122393Syz155240 ofin.fin_v = 4; 20132393Syz155240 ofin.fin_ip = oip; 20142393Syz155240 ofin.fin_m = NULL; /* if dereferenced, panic XXX */ 20152393Syz155240 ofin.fin_mp = NULL; /* if dereferenced, panic XXX */ 20162393Syz155240 ofin.fin_plen = fin->fin_dlen - ICMPERR_ICMPHLEN; 20172393Syz155240 (void) fr_makefrip(IP_HL(oip) << 2, oip, &ofin); 20182393Syz155240 ofin.fin_ifp = fin->fin_ifp; 20192393Syz155240 ofin.fin_out = !fin->fin_out; 20202393Syz155240 /* 20212393Syz155240 * Reset the short and bad flag here because in fr_matchsrcdst() 20222393Syz155240 * the flags for the current packet (fin_flx) are compared against 20232393Syz155240 * those for the existing session. 20242393Syz155240 */ 20252393Syz155240 ofin.fin_flx &= ~(FI_BAD|FI_SHORT); 20262393Syz155240 20272393Syz155240 /* 20282393Syz155240 * Put old values of ip_len and ip_off back as we don't know 20292393Syz155240 * if we have to forward the packet (or process it again. 20302393Syz155240 */ 20312393Syz155240 oip->ip_len = savelen; 20322393Syz155240 oip->ip_off = htons(oip->ip_off); 20332393Syz155240 20342393Syz155240 switch (oip->ip_p) 20352393Syz155240 { 20362393Syz155240 case IPPROTO_ICMP : 20372393Syz155240 /* 20382393Syz155240 * an ICMP error can only be generated as a result of an 20392393Syz155240 * ICMP query, not as the response on an ICMP error 20402393Syz155240 * 20412393Syz155240 * XXX theoretically ICMP_ECHOREP and the other reply's are 20422393Syz155240 * ICMP query's as well, but adding them here seems strange XXX 20432393Syz155240 */ 20442393Syz155240 if ((ofin.fin_flx & FI_ICMPERR) != 0) 20452393Syz155240 return NULL; 20462393Syz155240 20472393Syz155240 /* 20482393Syz155240 * perform a lookup of the ICMP packet in the state table 20492393Syz155240 */ 20502393Syz155240 icmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 20512393Syz155240 hv = (pr = oip->ip_p); 20522393Syz155240 src.in4 = oip->ip_src; 20532393Syz155240 hv += src.in4.s_addr; 20542393Syz155240 dst.in4 = oip->ip_dst; 20552393Syz155240 hv += dst.in4.s_addr; 20562393Syz155240 hv += icmp->icmp_id; 20573448Sdh155122 hv = DOUBLE_HASH(hv, ifs); 20583448Sdh155122 20593448Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 20603448Sdh155122 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) { 20612393Syz155240 isp = &is->is_hnext; 20622393Syz155240 if ((is->is_p != pr) || (is->is_v != 4)) 20632393Syz155240 continue; 20642393Syz155240 if (is->is_pass & FR_NOICMPERR) 20652393Syz155240 continue; 20662393Syz155240 is = fr_matchsrcdst(&ofin, is, &src, &dst, 20672393Syz155240 NULL, FI_ICMPCMP); 20682393Syz155240 if (is != NULL) { 20692393Syz155240 if ((is->is_pass & FR_NOICMPERR) != 0) { 20703448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 20712393Syz155240 return NULL; 20722393Syz155240 } 20732393Syz155240 /* 20742393Syz155240 * i : the index of this packet (the icmp 20752393Syz155240 * unreachable) 20762393Syz155240 * oi : the index of the original packet found 20772393Syz155240 * in the icmp header (i.e. the packet 20782393Syz155240 * causing this icmp) 20792393Syz155240 * backward : original packet was backward 20802393Syz155240 * compared to the state 20812393Syz155240 */ 20822393Syz155240 backward = IP6_NEQ(&is->is_src, &src); 20832393Syz155240 fin->fin_rev = !backward; 20842393Syz155240 i = (!backward << 1) + fin->fin_out; 20852393Syz155240 oi = (backward << 1) + ofin.fin_out; 20862393Syz155240 if (is->is_icmppkts[i] > is->is_pkts[oi]) 20872393Syz155240 continue; 20883448Sdh155122 ifs->ifs_ips_stats.iss_hits++; 20892393Syz155240 is->is_icmppkts[i]++; 20902393Syz155240 return is; 20912393Syz155240 } 20922393Syz155240 } 20933448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 20942393Syz155240 return NULL; 20952393Syz155240 case IPPROTO_TCP : 20962393Syz155240 case IPPROTO_UDP : 20972393Syz155240 break; 20982393Syz155240 default : 20992393Syz155240 return NULL; 21002393Syz155240 } 21012393Syz155240 21022393Syz155240 tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 21032393Syz155240 dport = tcp->th_dport; 21042393Syz155240 sport = tcp->th_sport; 21052393Syz155240 21062393Syz155240 hv = (pr = oip->ip_p); 21072393Syz155240 src.in4 = oip->ip_src; 21082393Syz155240 hv += src.in4.s_addr; 21092393Syz155240 dst.in4 = oip->ip_dst; 21102393Syz155240 hv += dst.in4.s_addr; 21112393Syz155240 hv += dport; 21122393Syz155240 hv += sport; 21133448Sdh155122 hv = DOUBLE_HASH(hv, ifs); 21143448Sdh155122 21153448Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 21163448Sdh155122 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) { 21172393Syz155240 isp = &is->is_hnext; 21182393Syz155240 /* 21192393Syz155240 * Only allow this icmp though if the 21202393Syz155240 * encapsulated packet was allowed through the 21212393Syz155240 * other way around. Note that the minimal amount 21222393Syz155240 * of info present does not allow for checking against 21232393Syz155240 * tcp internals such as seq and ack numbers. Only the 21242393Syz155240 * ports are known to be present and can be even if the 21252393Syz155240 * short flag is set. 21262393Syz155240 */ 21272393Syz155240 if ((is->is_p == pr) && (is->is_v == 4) && 21282393Syz155240 (is = fr_matchsrcdst(&ofin, is, &src, &dst, 21292393Syz155240 tcp, FI_ICMPCMP))) { 21302393Syz155240 /* 21312393Syz155240 * i : the index of this packet (the icmp unreachable) 21322393Syz155240 * oi : the index of the original packet found in the 21332393Syz155240 * icmp header (i.e. the packet causing this icmp) 21342393Syz155240 * backward : original packet was backward compared to 21352393Syz155240 * the state 21362393Syz155240 */ 21372393Syz155240 backward = IP6_NEQ(&is->is_src, &src); 21382393Syz155240 fin->fin_rev = !backward; 21392393Syz155240 i = (!backward << 1) + fin->fin_out; 21402393Syz155240 oi = (backward << 1) + ofin.fin_out; 21412393Syz155240 21422393Syz155240 if (((is->is_pass & FR_NOICMPERR) != 0) || 21432393Syz155240 (is->is_icmppkts[i] > is->is_pkts[oi])) 21442393Syz155240 break; 21453448Sdh155122 ifs->ifs_ips_stats.iss_hits++; 21462393Syz155240 is->is_icmppkts[i]++; 21472393Syz155240 /* 21482393Syz155240 * we deliberately do not touch the timeouts 21492393Syz155240 * for the accompanying state table entry. 21502393Syz155240 * It remains to be seen if that is correct. XXX 21512393Syz155240 */ 21522393Syz155240 return is; 21532393Syz155240 } 21542393Syz155240 } 21553448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 21562393Syz155240 return NULL; 21572393Syz155240 } 21582393Syz155240 21592393Syz155240 21602393Syz155240 /* ------------------------------------------------------------------------ */ 21612393Syz155240 /* Function: fr_ipsmove */ 21622393Syz155240 /* Returns: Nil */ 21632393Syz155240 /* Parameters: is(I) - pointer to state table entry */ 21642393Syz155240 /* hv(I) - new hash value for state table entry */ 21652393Syz155240 /* Write Locks: ipf_state */ 21662393Syz155240 /* */ 21672393Syz155240 /* Move a state entry from one position in the hash table to another. */ 21682393Syz155240 /* ------------------------------------------------------------------------ */ 21693448Sdh155122 static void fr_ipsmove(is, hv, ifs) 21702393Syz155240 ipstate_t *is; 21712393Syz155240 u_int hv; 21723448Sdh155122 ipf_stack_t *ifs; 21732393Syz155240 { 21742393Syz155240 ipstate_t **isp; 21752393Syz155240 u_int hvm; 21762393Syz155240 21773448Sdh155122 ASSERT(rw_read_locked(&ifs->ifs_ipf_state.ipf_lk) == 0); 21782393Syz155240 21792393Syz155240 hvm = is->is_hv; 21802393Syz155240 /* 21812393Syz155240 * Remove the hash from the old location... 21822393Syz155240 */ 21832393Syz155240 isp = is->is_phnext; 21842393Syz155240 if (is->is_hnext) 21852393Syz155240 is->is_hnext->is_phnext = isp; 21862393Syz155240 *isp = is->is_hnext; 21873448Sdh155122 if (ifs->ifs_ips_table[hvm] == NULL) 21883448Sdh155122 ifs->ifs_ips_stats.iss_inuse--; 21893448Sdh155122 ifs->ifs_ips_stats.iss_bucketlen[hvm]--; 21902393Syz155240 21912393Syz155240 /* 21922393Syz155240 * ...and put the hash in the new one. 21932393Syz155240 */ 21943448Sdh155122 hvm = DOUBLE_HASH(hv, ifs); 21952393Syz155240 is->is_hv = hvm; 21963448Sdh155122 isp = &ifs->ifs_ips_table[hvm]; 21972393Syz155240 if (*isp) 21982393Syz155240 (*isp)->is_phnext = &is->is_hnext; 21992393Syz155240 else 22003448Sdh155122 ifs->ifs_ips_stats.iss_inuse++; 22013448Sdh155122 ifs->ifs_ips_stats.iss_bucketlen[hvm]++; 22022393Syz155240 is->is_phnext = isp; 22032393Syz155240 is->is_hnext = *isp; 22042393Syz155240 *isp = is; 22052393Syz155240 } 22062393Syz155240 22072393Syz155240 22082393Syz155240 /* ------------------------------------------------------------------------ */ 22092393Syz155240 /* Function: fr_stlookup */ 22102393Syz155240 /* Returns: ipstate_t* - NULL == no matching state found, */ 22112393Syz155240 /* else pointer to state information is returned */ 22122393Syz155240 /* Parameters: fin(I) - pointer to packet information */ 22132393Syz155240 /* tcp(I) - pointer to TCP/UDP header. */ 22142393Syz155240 /* */ 22152393Syz155240 /* Search the state table for a matching entry to the packet described by */ 22162393Syz155240 /* the contents of *fin. */ 22172393Syz155240 /* */ 22182393Syz155240 /* If we return NULL then no lock on ipf_state is held. */ 22192393Syz155240 /* If we return non-null then a read-lock on ipf_state is held. */ 22202393Syz155240 /* ------------------------------------------------------------------------ */ 22212393Syz155240 ipstate_t *fr_stlookup(fin, tcp, ifqp) 22222393Syz155240 fr_info_t *fin; 22232393Syz155240 tcphdr_t *tcp; 22242393Syz155240 ipftq_t **ifqp; 22252393Syz155240 { 22262393Syz155240 u_int hv, hvm, pr, v, tryagain; 22272393Syz155240 ipstate_t *is, **isp; 22282393Syz155240 u_short dport, sport; 22292393Syz155240 i6addr_t src, dst; 22302393Syz155240 struct icmp *ic; 22312393Syz155240 ipftq_t *ifq; 22322393Syz155240 int oow; 22333448Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 22342393Syz155240 22352393Syz155240 is = NULL; 22362393Syz155240 ifq = NULL; 22372393Syz155240 tcp = fin->fin_dp; 22382393Syz155240 ic = (struct icmp *)tcp; 22392393Syz155240 hv = (pr = fin->fin_fi.fi_p); 22402393Syz155240 src = fin->fin_fi.fi_src; 22412393Syz155240 dst = fin->fin_fi.fi_dst; 22422393Syz155240 hv += src.in4.s_addr; 22432393Syz155240 hv += dst.in4.s_addr; 22442393Syz155240 22452393Syz155240 v = fin->fin_fi.fi_v; 22462393Syz155240 #ifdef USE_INET6 22472393Syz155240 if (v == 6) { 22482393Syz155240 hv += fin->fin_fi.fi_src.i6[1]; 22492393Syz155240 hv += fin->fin_fi.fi_src.i6[2]; 22502393Syz155240 hv += fin->fin_fi.fi_src.i6[3]; 22512393Syz155240 22522393Syz155240 if ((fin->fin_p == IPPROTO_ICMPV6) && 22532393Syz155240 IN6_IS_ADDR_MULTICAST(&fin->fin_fi.fi_dst.in6)) { 22542393Syz155240 hv -= dst.in4.s_addr; 22552393Syz155240 } else { 22562393Syz155240 hv += fin->fin_fi.fi_dst.i6[1]; 22572393Syz155240 hv += fin->fin_fi.fi_dst.i6[2]; 22582393Syz155240 hv += fin->fin_fi.fi_dst.i6[3]; 22592393Syz155240 } 22602393Syz155240 } 22612393Syz155240 #endif 22622393Syz155240 22632393Syz155240 /* 22642393Syz155240 * Search the hash table for matching packet header info. 22652393Syz155240 */ 22662393Syz155240 switch (pr) 22672393Syz155240 { 22682393Syz155240 #ifdef USE_INET6 22692393Syz155240 case IPPROTO_ICMPV6 : 22702393Syz155240 tryagain = 0; 22712393Syz155240 if (v == 6) { 22722393Syz155240 if ((ic->icmp_type == ICMP6_ECHO_REQUEST) || 22732393Syz155240 (ic->icmp_type == ICMP6_ECHO_REPLY)) { 22742393Syz155240 hv += ic->icmp_id; 22752393Syz155240 } 22762393Syz155240 } 22773448Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 22782393Syz155240 icmp6again: 22793448Sdh155122 hvm = DOUBLE_HASH(hv, ifs); 22803448Sdh155122 for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) { 22812393Syz155240 isp = &is->is_hnext; 22822393Syz155240 if ((is->is_p != pr) || (is->is_v != v)) 22832393Syz155240 continue; 22842393Syz155240 is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP); 22852393Syz155240 if (is != NULL && 22862393Syz155240 fr_matchicmpqueryreply(v, &is->is_icmp, 22872393Syz155240 ic, fin->fin_rev)) { 22882393Syz155240 if (fin->fin_rev) 22893448Sdh155122 ifq = &ifs->ifs_ips_icmpacktq; 22902393Syz155240 else 22913448Sdh155122 ifq = &ifs->ifs_ips_icmptq; 22922393Syz155240 break; 22932393Syz155240 } 22942393Syz155240 } 22952393Syz155240 22962393Syz155240 if (is != NULL) { 22972393Syz155240 if ((tryagain != 0) && !(is->is_flags & SI_W_DADDR)) { 22982393Syz155240 hv += fin->fin_fi.fi_src.i6[0]; 22992393Syz155240 hv += fin->fin_fi.fi_src.i6[1]; 23002393Syz155240 hv += fin->fin_fi.fi_src.i6[2]; 23012393Syz155240 hv += fin->fin_fi.fi_src.i6[3]; 23023448Sdh155122 fr_ipsmove(is, hv, ifs); 23033448Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_state); 23042393Syz155240 } 23052393Syz155240 break; 23062393Syz155240 } 23073448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 23082393Syz155240 23092393Syz155240 /* 23102393Syz155240 * No matching icmp state entry. Perhaps this is a 23112393Syz155240 * response to another state entry. 23122393Syz155240 * 23132393Syz155240 * XXX With some ICMP6 packets, the "other" address is already 23142393Syz155240 * in the packet, after the ICMP6 header, and this could be 23152393Syz155240 * used in place of the multicast address. However, taking 23162393Syz155240 * advantage of this requires some significant code changes 23172393Syz155240 * to handle the specific types where that is the case. 23182393Syz155240 */ 23193448Sdh155122 if ((ifs->ifs_ips_stats.iss_wild != 0) && (v == 6) && (tryagain == 0) && 23202393Syz155240 !IN6_IS_ADDR_MULTICAST(&fin->fin_fi.fi_src.in6)) { 23212393Syz155240 hv -= fin->fin_fi.fi_src.i6[0]; 23222393Syz155240 hv -= fin->fin_fi.fi_src.i6[1]; 23232393Syz155240 hv -= fin->fin_fi.fi_src.i6[2]; 23242393Syz155240 hv -= fin->fin_fi.fi_src.i6[3]; 23252393Syz155240 tryagain = 1; 23263448Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state); 23272393Syz155240 goto icmp6again; 23282393Syz155240 } 23292393Syz155240 23302393Syz155240 is = fr_checkicmp6matchingstate(fin); 23312393Syz155240 if (is != NULL) 23322393Syz155240 return is; 23332393Syz155240 break; 23342393Syz155240 #endif 23352393Syz155240 23362393Syz155240 case IPPROTO_ICMP : 23372393Syz155240 if (v == 4) { 23382393Syz155240 hv += ic->icmp_id; 23392393Syz155240 } 23403448Sdh155122 hv = DOUBLE_HASH(hv, ifs); 23413448Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 23423448Sdh155122 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) { 23432393Syz155240 isp = &is->is_hnext; 23442393Syz155240 if ((is->is_p != pr) || (is->is_v != v)) 23452393Syz155240 continue; 23462393Syz155240 is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP); 23472393Syz155240 if (is != NULL && 23482393Syz155240 fr_matchicmpqueryreply(v, &is->is_icmp, 23492393Syz155240 ic, fin->fin_rev)) { 23502393Syz155240 if (fin->fin_rev) 23513448Sdh155122 ifq = &ifs->ifs_ips_icmpacktq; 23522393Syz155240 else 23533448Sdh155122 ifq = &ifs->ifs_ips_icmptq; 23542393Syz155240 break; 23552393Syz155240 } 23562393Syz155240 } 23572393Syz155240 if (is == NULL) { 23583448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 23592393Syz155240 } 23602393Syz155240 break; 23612393Syz155240 23622393Syz155240 case IPPROTO_TCP : 23632393Syz155240 case IPPROTO_UDP : 23642393Syz155240 ifqp = NULL; 23652393Syz155240 sport = htons(fin->fin_data[0]); 23662393Syz155240 hv += sport; 23672393Syz155240 dport = htons(fin->fin_data[1]); 23682393Syz155240 hv += dport; 23692393Syz155240 oow = 0; 23702393Syz155240 tryagain = 0; 23713448Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 23722393Syz155240 retry_tcpudp: 23733448Sdh155122 hvm = DOUBLE_HASH(hv, ifs); 23743448Sdh155122 for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) { 23752393Syz155240 isp = &is->is_hnext; 23762393Syz155240 if ((is->is_p != pr) || (is->is_v != v)) 23772393Syz155240 continue; 23782393Syz155240 fin->fin_flx &= ~FI_OOW; 23792393Syz155240 is = fr_matchsrcdst(fin, is, &src, &dst, tcp, FI_CMP); 23802393Syz155240 if (is != NULL) { 23812393Syz155240 if (pr == IPPROTO_TCP) { 23822393Syz155240 if (!fr_tcpstate(fin, tcp, is)) { 23832393Syz155240 oow |= fin->fin_flx & FI_OOW; 23842393Syz155240 continue; 23852393Syz155240 } 23862393Syz155240 } 23872393Syz155240 break; 23882393Syz155240 } 23892393Syz155240 } 23902393Syz155240 if (is != NULL) { 23912393Syz155240 if (tryagain && 23922393Syz155240 !(is->is_flags & (SI_CLONE|SI_WILDP|SI_WILDA))) { 23932393Syz155240 hv += dport; 23942393Syz155240 hv += sport; 23953448Sdh155122 fr_ipsmove(is, hv, ifs); 23963448Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_state); 23972393Syz155240 } 23982393Syz155240 break; 23992393Syz155240 } 24003448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 24013448Sdh155122 24023448Sdh155122 if (!tryagain && ifs->ifs_ips_stats.iss_wild) { 24032393Syz155240 hv -= dport; 24042393Syz155240 hv -= sport; 24052393Syz155240 tryagain = 1; 24063448Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state); 24072393Syz155240 goto retry_tcpudp; 24082393Syz155240 } 24092393Syz155240 fin->fin_flx |= oow; 24102393Syz155240 break; 24112393Syz155240 24122393Syz155240 #if 0 24132393Syz155240 case IPPROTO_GRE : 24142393Syz155240 gre = fin->fin_dp; 24152393Syz155240 if (GRE_REV(gre->gr_flags) == 1) { 24162393Syz155240 hv += gre->gr_call; 24172393Syz155240 } 24182393Syz155240 /* FALLTHROUGH */ 24192393Syz155240 #endif 24202393Syz155240 default : 24212393Syz155240 ifqp = NULL; 24223448Sdh155122 hvm = DOUBLE_HASH(hv, ifs); 24233448Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 24243448Sdh155122 for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) { 24252393Syz155240 isp = &is->is_hnext; 24262393Syz155240 if ((is->is_p != pr) || (is->is_v != v)) 24272393Syz155240 continue; 24282393Syz155240 is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP); 24292393Syz155240 if (is != NULL) { 24303448Sdh155122 ifq = &ifs->ifs_ips_iptq; 24312393Syz155240 break; 24322393Syz155240 } 24332393Syz155240 } 24342393Syz155240 if (is == NULL) { 24353448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 24362393Syz155240 } 24372393Syz155240 break; 24382393Syz155240 } 24392393Syz155240 24402393Syz155240 if ((is != NULL) && ((is->is_sti.tqe_flags & TQE_RULEBASED) != 0) && 24412393Syz155240 (is->is_tqehead[fin->fin_rev] != NULL)) 24422393Syz155240 ifq = is->is_tqehead[fin->fin_rev]; 24432393Syz155240 if (ifq != NULL && ifqp != NULL) 24442393Syz155240 *ifqp = ifq; 24452393Syz155240 return is; 24462393Syz155240 } 24472393Syz155240 24482393Syz155240 24492393Syz155240 /* ------------------------------------------------------------------------ */ 24502393Syz155240 /* Function: fr_updatestate */ 24512393Syz155240 /* Returns: Nil */ 24522393Syz155240 /* Parameters: fin(I) - pointer to packet information */ 24532393Syz155240 /* is(I) - pointer to state table entry */ 24542393Syz155240 /* Read Locks: ipf_state */ 24552393Syz155240 /* */ 24562393Syz155240 /* Updates packet and byte counters for a newly received packet. Seeds the */ 24572393Syz155240 /* fragment cache with a new entry as required. */ 24582393Syz155240 /* ------------------------------------------------------------------------ */ 24592393Syz155240 void fr_updatestate(fin, is, ifq) 24602393Syz155240 fr_info_t *fin; 24612393Syz155240 ipstate_t *is; 24622393Syz155240 ipftq_t *ifq; 24632393Syz155240 { 24642393Syz155240 ipftqent_t *tqe; 24652393Syz155240 int i, pass; 24663448Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 24672393Syz155240 24682393Syz155240 i = (fin->fin_rev << 1) + fin->fin_out; 24692393Syz155240 24702393Syz155240 /* 24712393Syz155240 * For TCP packets, ifq == NULL. For all others, check if this new 24722393Syz155240 * queue is different to the last one it was on and move it if so. 24732393Syz155240 */ 24742393Syz155240 tqe = &is->is_sti; 24752393Syz155240 MUTEX_ENTER(&is->is_lock); 24762393Syz155240 if ((tqe->tqe_flags & TQE_RULEBASED) != 0) 24772393Syz155240 ifq = is->is_tqehead[fin->fin_rev]; 24782393Syz155240 24792393Syz155240 if (ifq != NULL) 24803448Sdh155122 fr_movequeue(tqe, tqe->tqe_ifq, ifq, ifs); 24812393Syz155240 24822393Syz155240 is->is_pkts[i]++; 24832393Syz155240 is->is_bytes[i] += fin->fin_plen; 24842393Syz155240 MUTEX_EXIT(&is->is_lock); 24852393Syz155240 24862393Syz155240 #ifdef IPFILTER_SYNC 24872393Syz155240 if (is->is_flags & IS_STATESYNC) 24882393Syz155240 ipfsync_update(SMC_STATE, fin, is->is_sync); 24892393Syz155240 #endif 24902393Syz155240 24913448Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_hits); 24922393Syz155240 24932393Syz155240 fin->fin_fr = is->is_rule; 24942393Syz155240 24952393Syz155240 /* 24962393Syz155240 * If this packet is a fragment and the rule says to track fragments, 24972393Syz155240 * then create a new fragment cache entry. 24982393Syz155240 */ 24992393Syz155240 pass = is->is_pass; 25002393Syz155240 if ((fin->fin_flx & FI_FRAG) && FR_ISPASS(pass)) 25012393Syz155240 (void) fr_newfrag(fin, pass ^ FR_KEEPSTATE); 25022393Syz155240 } 25032393Syz155240 25042393Syz155240 25052393Syz155240 /* ------------------------------------------------------------------------ */ 25062393Syz155240 /* Function: fr_checkstate */ 25072393Syz155240 /* Returns: frentry_t* - NULL == search failed, */ 25082393Syz155240 /* else pointer to rule for matching state */ 25092393Syz155240 /* Parameters: ifp(I) - pointer to interface */ 25102393Syz155240 /* passp(I) - pointer to filtering result flags */ 25112393Syz155240 /* */ 25122393Syz155240 /* Check if a packet is associated with an entry in the state table. */ 25132393Syz155240 /* ------------------------------------------------------------------------ */ 25142393Syz155240 frentry_t *fr_checkstate(fin, passp) 25152393Syz155240 fr_info_t *fin; 25162393Syz155240 u_32_t *passp; 25172393Syz155240 { 25182393Syz155240 ipstate_t *is; 25192393Syz155240 frentry_t *fr; 25202393Syz155240 tcphdr_t *tcp; 25212393Syz155240 ipftq_t *ifq; 25222393Syz155240 u_int pass; 25233448Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 25243448Sdh155122 25253448Sdh155122 if (ifs->ifs_fr_state_lock || (ifs->ifs_ips_list == NULL) || 25262393Syz155240 (fin->fin_flx & (FI_SHORT|FI_STATE|FI_FRAGBODY|FI_BAD))) 25272393Syz155240 return NULL; 25282393Syz155240 25292393Syz155240 is = NULL; 25302393Syz155240 if ((fin->fin_flx & FI_TCPUDP) || 25312393Syz155240 (fin->fin_fi.fi_p == IPPROTO_ICMP) 25322393Syz155240 #ifdef USE_INET6 25332393Syz155240 || (fin->fin_fi.fi_p == IPPROTO_ICMPV6) 25342393Syz155240 #endif 25352393Syz155240 ) 25362393Syz155240 tcp = fin->fin_dp; 25372393Syz155240 else 25382393Syz155240 tcp = NULL; 25392393Syz155240 25402393Syz155240 /* 25412393Syz155240 * Search the hash table for matching packet header info. 25422393Syz155240 */ 25432393Syz155240 ifq = NULL; 25442393Syz155240 is = fin->fin_state; 25452393Syz155240 if (is == NULL) 25462393Syz155240 is = fr_stlookup(fin, tcp, &ifq); 25472393Syz155240 switch (fin->fin_p) 25482393Syz155240 { 25492393Syz155240 #ifdef USE_INET6 25502393Syz155240 case IPPROTO_ICMPV6 : 25512393Syz155240 if (is != NULL) 25522393Syz155240 break; 25532393Syz155240 if (fin->fin_v == 6) { 25542393Syz155240 is = fr_checkicmp6matchingstate(fin); 25552393Syz155240 if (is != NULL) 25562393Syz155240 goto matched; 25572393Syz155240 } 25582393Syz155240 break; 25592393Syz155240 #endif 25602393Syz155240 case IPPROTO_ICMP : 25612393Syz155240 if (is != NULL) 25622393Syz155240 break; 25632393Syz155240 /* 25642393Syz155240 * No matching icmp state entry. Perhaps this is a 25652393Syz155240 * response to another state entry. 25662393Syz155240 */ 25672393Syz155240 is = fr_checkicmpmatchingstate(fin); 25682393Syz155240 if (is != NULL) 25692393Syz155240 goto matched; 25702393Syz155240 break; 25712393Syz155240 case IPPROTO_TCP : 25722393Syz155240 if (is == NULL) 25732393Syz155240 break; 25742393Syz155240 25752393Syz155240 if (is->is_pass & FR_NEWISN) { 25762393Syz155240 if (fin->fin_out == 0) 25772393Syz155240 fr_fixinisn(fin, is); 25782393Syz155240 else if (fin->fin_out == 1) 25792393Syz155240 fr_fixoutisn(fin, is); 25802393Syz155240 } 25812393Syz155240 break; 25822393Syz155240 default : 25832393Syz155240 if (fin->fin_rev) 25843448Sdh155122 ifq = &ifs->ifs_ips_udpacktq; 25852393Syz155240 else 25863448Sdh155122 ifq = &ifs->ifs_ips_udptq; 25872393Syz155240 break; 25882393Syz155240 } 25892393Syz155240 if (is == NULL) { 25903448Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_miss); 25912393Syz155240 return NULL; 25922393Syz155240 } 25932393Syz155240 25942393Syz155240 matched: 25952393Syz155240 fr = is->is_rule; 25962393Syz155240 if (fr != NULL) { 25972393Syz155240 if ((fin->fin_out == 0) && (fr->fr_nattag.ipt_num[0] != 0)) { 25982393Syz155240 if (fin->fin_nattag == NULL) 25992393Syz155240 return NULL; 26002393Syz155240 if (fr_matchtag(&fr->fr_nattag, fin->fin_nattag) != 0) 26012393Syz155240 return NULL; 26022393Syz155240 } 26032393Syz155240 (void) strncpy(fin->fin_group, fr->fr_group, FR_GROUPLEN); 26042393Syz155240 fin->fin_icode = fr->fr_icode; 26052393Syz155240 } 26062393Syz155240 26072393Syz155240 fin->fin_rule = is->is_rulen; 26082393Syz155240 pass = is->is_pass; 26092393Syz155240 fr_updatestate(fin, is, ifq); 26102393Syz155240 if (fin->fin_out == 1) 26112393Syz155240 fin->fin_nat = is->is_nat[fin->fin_rev]; 26122393Syz155240 26132393Syz155240 fin->fin_state = is; 26143448Sdh155122 is->is_touched = ifs->ifs_fr_ticks; 26152393Syz155240 MUTEX_ENTER(&is->is_lock); 26162393Syz155240 is->is_ref++; 26172393Syz155240 MUTEX_EXIT(&is->is_lock); 26183448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 26192393Syz155240 fin->fin_flx |= FI_STATE; 26202393Syz155240 if ((pass & FR_LOGFIRST) != 0) 26212393Syz155240 pass &= ~(FR_LOGFIRST|FR_LOG); 26222393Syz155240 *passp = pass; 26232393Syz155240 return fr; 26242393Syz155240 } 26252393Syz155240 26262393Syz155240 26272393Syz155240 /* ------------------------------------------------------------------------ */ 26282393Syz155240 /* Function: fr_fixoutisn */ 26292393Syz155240 /* Returns: Nil */ 26302393Syz155240 /* Parameters: fin(I) - pointer to packet information */ 26312393Syz155240 /* is(I) - pointer to master state structure */ 26322393Syz155240 /* */ 26332393Syz155240 /* Called only for outbound packets, adjusts the sequence number and the */ 26342393Syz155240 /* TCP checksum to match that change. */ 26352393Syz155240 /* ------------------------------------------------------------------------ */ 26362393Syz155240 static void fr_fixoutisn(fin, is) 26372393Syz155240 fr_info_t *fin; 26382393Syz155240 ipstate_t *is; 26392393Syz155240 { 26402393Syz155240 tcphdr_t *tcp; 26412393Syz155240 int rev; 26422393Syz155240 u_32_t seq; 26432393Syz155240 26442393Syz155240 tcp = fin->fin_dp; 26452393Syz155240 rev = fin->fin_rev; 26462393Syz155240 if ((is->is_flags & IS_ISNSYN) != 0) { 26472393Syz155240 if (rev == 0) { 26482393Syz155240 seq = ntohl(tcp->th_seq); 26492393Syz155240 seq += is->is_isninc[0]; 26502393Syz155240 tcp->th_seq = htonl(seq); 26512958Sdr146992 fix_outcksum(&tcp->th_sum, is->is_sumd[0]); 26522393Syz155240 } 26532393Syz155240 } 26542393Syz155240 if ((is->is_flags & IS_ISNACK) != 0) { 26552393Syz155240 if (rev == 1) { 26562393Syz155240 seq = ntohl(tcp->th_seq); 26572393Syz155240 seq += is->is_isninc[1]; 26582393Syz155240 tcp->th_seq = htonl(seq); 26592958Sdr146992 fix_outcksum(&tcp->th_sum, is->is_sumd[1]); 26602393Syz155240 } 26612393Syz155240 } 26622393Syz155240 } 26632393Syz155240 26642393Syz155240 26652393Syz155240 /* ------------------------------------------------------------------------ */ 26662393Syz155240 /* Function: fr_fixinisn */ 26672393Syz155240 /* Returns: Nil */ 26682393Syz155240 /* Parameters: fin(I) - pointer to packet information */ 26692393Syz155240 /* is(I) - pointer to master state structure */ 26702393Syz155240 /* */ 26712393Syz155240 /* Called only for inbound packets, adjusts the acknowledge number and the */ 26722393Syz155240 /* TCP checksum to match that change. */ 26732393Syz155240 /* ------------------------------------------------------------------------ */ 26742393Syz155240 static void fr_fixinisn(fin, is) 26752393Syz155240 fr_info_t *fin; 26762393Syz155240 ipstate_t *is; 26772393Syz155240 { 26782393Syz155240 tcphdr_t *tcp; 26792393Syz155240 int rev; 26802393Syz155240 u_32_t ack; 26812393Syz155240 26822393Syz155240 tcp = fin->fin_dp; 26832393Syz155240 rev = fin->fin_rev; 26842393Syz155240 if ((is->is_flags & IS_ISNSYN) != 0) { 26852393Syz155240 if (rev == 1) { 26862393Syz155240 ack = ntohl(tcp->th_ack); 26872393Syz155240 ack -= is->is_isninc[0]; 26882393Syz155240 tcp->th_ack = htonl(ack); 26892958Sdr146992 fix_incksum(&tcp->th_sum, is->is_sumd[0]); 26902393Syz155240 } 26912393Syz155240 } 26922393Syz155240 if ((is->is_flags & IS_ISNACK) != 0) { 26932393Syz155240 if (rev == 0) { 26942393Syz155240 ack = ntohl(tcp->th_ack); 26952393Syz155240 ack -= is->is_isninc[1]; 26962393Syz155240 tcp->th_ack = htonl(ack); 26972958Sdr146992 fix_incksum(&tcp->th_sum, is->is_sumd[1]); 26982393Syz155240 } 26992393Syz155240 } 27002393Syz155240 } 27012393Syz155240 27022393Syz155240 27032393Syz155240 /* ------------------------------------------------------------------------ */ 27042393Syz155240 /* Function: fr_statesync */ 27052393Syz155240 /* Returns: Nil */ 27062958Sdr146992 /* Parameters: action(I) - type of synchronisation to do */ 27072958Sdr146992 /* v(I) - IP version being sync'd (v4 or v6) */ 27082958Sdr146992 /* ifp(I) - interface identifier associated with action */ 27092958Sdr146992 /* name(I) - name associated with ifp parameter */ 27102393Syz155240 /* */ 27112393Syz155240 /* Walk through all state entries and if an interface pointer match is */ 27122393Syz155240 /* found then look it up again, based on its name in case the pointer has */ 27132393Syz155240 /* changed since last time. */ 27142393Syz155240 /* */ 27152393Syz155240 /* If ifp is passed in as being non-null then we are only doing updates for */ 27162393Syz155240 /* existing, matching, uses of it. */ 27172393Syz155240 /* ------------------------------------------------------------------------ */ 27183448Sdh155122 void fr_statesync(action, v, ifp, name, ifs) 27192958Sdr146992 int action, v; 27202393Syz155240 void *ifp; 27212958Sdr146992 char *name; 27223448Sdh155122 ipf_stack_t *ifs; 27232393Syz155240 { 27242393Syz155240 ipstate_t *is; 27252393Syz155240 int i; 27262393Syz155240 27273448Sdh155122 if (ifs->ifs_fr_running <= 0) 27282393Syz155240 return; 27292393Syz155240 27303448Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state); 27313448Sdh155122 27323448Sdh155122 if (ifs->ifs_fr_running <= 0) { 27333448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 27342393Syz155240 return; 27352393Syz155240 } 27362393Syz155240 27372958Sdr146992 switch (action) 27382958Sdr146992 { 27392958Sdr146992 case IPFSYNC_RESYNC : 27403448Sdh155122 for (is = ifs->ifs_ips_list; is; is = is->is_next) { 27412958Sdr146992 if (v != 0 && is->is_v != v) 27422958Sdr146992 continue; 27432958Sdr146992 /* 27442958Sdr146992 * Look up all the interface names in the state entry. 27452958Sdr146992 */ 27462958Sdr146992 for (i = 0; i < 4; i++) { 27472393Syz155240 is->is_ifp[i] = fr_resolvenic(is->is_ifname[i], 27483448Sdh155122 is->is_v, ifs); 27492958Sdr146992 } 27502393Syz155240 } 27512958Sdr146992 break; 27522958Sdr146992 case IPFSYNC_NEWIFP : 27533448Sdh155122 for (is = ifs->ifs_ips_list; is; is = is->is_next) { 27542958Sdr146992 if (v != 0 && is->is_v != v) 27552958Sdr146992 continue; 27562958Sdr146992 /* 27572958Sdr146992 * Look up all the interface names in the state entry. 27582958Sdr146992 */ 27592958Sdr146992 for (i = 0; i < 4; i++) { 27602958Sdr146992 if (!strncmp(is->is_ifname[i], name, 27612958Sdr146992 sizeof(is->is_ifname[i]))) 27622958Sdr146992 is->is_ifp[i] = ifp; 27632958Sdr146992 } 27642958Sdr146992 } 27652958Sdr146992 break; 27662958Sdr146992 case IPFSYNC_OLDIFP : 27673448Sdh155122 for (is = ifs->ifs_ips_list; is; is = is->is_next) { 27682958Sdr146992 if (v != 0 && is->is_v != v) 27692958Sdr146992 continue; 27702958Sdr146992 /* 27712958Sdr146992 * Look up all the interface names in the state entry. 27722958Sdr146992 */ 27732958Sdr146992 for (i = 0; i < 4; i++) { 27742958Sdr146992 if (is->is_ifp[i] == ifp) 27752958Sdr146992 is->is_ifp[i] = (void *)-1; 27762958Sdr146992 } 27772958Sdr146992 } 27782958Sdr146992 break; 27792393Syz155240 } 27803448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 27812393Syz155240 } 27822393Syz155240 27832393Syz155240 27842393Syz155240 /* ------------------------------------------------------------------------ */ 27852393Syz155240 /* Function: fr_delstate */ 27862393Syz155240 /* Returns: Nil */ 27872393Syz155240 /* Parameters: is(I) - pointer to state structure to delete */ 27882393Syz155240 /* why(I) - if not 0, log reason why it was deleted */ 27893187Sdr146992 /* Write Locks: ipf_state/ipf_global */ 27902393Syz155240 /* */ 27912393Syz155240 /* Deletes a state entry from the enumerated list as well as the hash table */ 27922393Syz155240 /* and timeout queue lists. Make adjustments to hash table statistics and */ 27932393Syz155240 /* global counters as required. */ 27942393Syz155240 /* ------------------------------------------------------------------------ */ 27953448Sdh155122 static void fr_delstate(is, why, ifs) 27962393Syz155240 ipstate_t *is; 27972393Syz155240 int why; 27983448Sdh155122 ipf_stack_t *ifs; 27992393Syz155240 { 28002393Syz155240 28013448Sdh155122 ASSERT(rw_write_held(&ifs->ifs_ipf_global.ipf_lk) == 0 || 28023448Sdh155122 rw_write_held(&ifs->ifs_ipf_state.ipf_lk) == 0); 28032393Syz155240 28042393Syz155240 /* 28052393Syz155240 * Since we want to delete this, remove it from the state table, 28062393Syz155240 * where it can be found & used, first. 28072393Syz155240 */ 28082393Syz155240 if (is->is_pnext != NULL) { 28092393Syz155240 *is->is_pnext = is->is_next; 28102393Syz155240 28112393Syz155240 if (is->is_next != NULL) 28122393Syz155240 is->is_next->is_pnext = is->is_pnext; 28132393Syz155240 28142393Syz155240 is->is_pnext = NULL; 28152393Syz155240 is->is_next = NULL; 28162393Syz155240 } 28172393Syz155240 28182393Syz155240 if (is->is_phnext != NULL) { 28192393Syz155240 *is->is_phnext = is->is_hnext; 28202393Syz155240 if (is->is_hnext != NULL) 28212393Syz155240 is->is_hnext->is_phnext = is->is_phnext; 28223448Sdh155122 if (ifs->ifs_ips_table[is->is_hv] == NULL) 28233448Sdh155122 ifs->ifs_ips_stats.iss_inuse--; 28243448Sdh155122 ifs->ifs_ips_stats.iss_bucketlen[is->is_hv]--; 28252393Syz155240 28262393Syz155240 is->is_phnext = NULL; 28272393Syz155240 is->is_hnext = NULL; 28282393Syz155240 } 28292393Syz155240 28302393Syz155240 /* 28313448Sdh155122 * Because ifs->ifs_ips_stats.iss_wild is a count of entries in the state 28322393Syz155240 * table that have wildcard flags set, only decerement it once 28332393Syz155240 * and do it here. 28342393Syz155240 */ 28352393Syz155240 if (is->is_flags & (SI_WILDP|SI_WILDA)) { 28362393Syz155240 if (!(is->is_flags & SI_CLONED)) { 28373448Sdh155122 ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild); 28382393Syz155240 } 28392393Syz155240 is->is_flags &= ~(SI_WILDP|SI_WILDA); 28402393Syz155240 } 28412393Syz155240 28422393Syz155240 /* 28432393Syz155240 * Next, remove it from the timeout queue it is in. 28442393Syz155240 */ 28452393Syz155240 fr_deletequeueentry(&is->is_sti); 28462393Syz155240 28472393Syz155240 is->is_me = NULL; 28482393Syz155240 28492393Syz155240 /* 28502393Syz155240 * If it is still in use by something else, do not go any further, 28512393Syz155240 * but note that at this point it is now an orphan. 28522393Syz155240 */ 28532393Syz155240 is->is_ref--; 28542393Syz155240 if (is->is_ref > 0) 28552393Syz155240 return; 28562393Syz155240 28572393Syz155240 if (is->is_tqehead[0] != NULL) { 28582393Syz155240 if (fr_deletetimeoutqueue(is->is_tqehead[0]) == 0) 28593448Sdh155122 fr_freetimeoutqueue(is->is_tqehead[0], ifs); 28602393Syz155240 } 28612393Syz155240 if (is->is_tqehead[1] != NULL) { 28622393Syz155240 if (fr_deletetimeoutqueue(is->is_tqehead[1]) == 0) 28633448Sdh155122 fr_freetimeoutqueue(is->is_tqehead[1], ifs); 28642393Syz155240 } 28652393Syz155240 28662393Syz155240 #ifdef IPFILTER_SYNC 28672393Syz155240 if (is->is_sync) 28682393Syz155240 ipfsync_del(is->is_sync); 28692393Syz155240 #endif 28702393Syz155240 #ifdef IPFILTER_SCAN 28712393Syz155240 (void) ipsc_detachis(is); 28722393Syz155240 #endif 28732393Syz155240 28743448Sdh155122 if (ifs->ifs_ipstate_logging != 0 && why != 0) 28753448Sdh155122 ipstate_log(is, why, ifs); 28762393Syz155240 28772393Syz155240 if (is->is_rule != NULL) { 28782393Syz155240 is->is_rule->fr_statecnt--; 28793448Sdh155122 (void)fr_derefrule(&is->is_rule, ifs); 28802393Syz155240 } 28812393Syz155240 28822393Syz155240 MUTEX_DESTROY(&is->is_lock); 28832393Syz155240 KFREE(is); 28843448Sdh155122 ifs->ifs_ips_num--; 28852393Syz155240 } 28862393Syz155240 28872393Syz155240 28882393Syz155240 /* ------------------------------------------------------------------------ */ 28892393Syz155240 /* Function: fr_timeoutstate */ 28902393Syz155240 /* Returns: Nil */ 28912393Syz155240 /* Parameters: Nil */ 28922393Syz155240 /* */ 28932393Syz155240 /* Slowly expire held state for thingslike UDP and ICMP. The algorithm */ 28942393Syz155240 /* used here is to keep the queue sorted with the oldest things at the top */ 28952393Syz155240 /* and the youngest at the bottom. So if the top one doesn't need to be */ 28962393Syz155240 /* expired then neither will any under it. */ 28972393Syz155240 /* ------------------------------------------------------------------------ */ 28983448Sdh155122 void fr_timeoutstate(ifs) 28993448Sdh155122 ipf_stack_t *ifs; 29002393Syz155240 { 29012393Syz155240 ipftq_t *ifq, *ifqnext; 29022393Syz155240 ipftqent_t *tqe, *tqn; 29032393Syz155240 ipstate_t *is; 29042393Syz155240 SPL_INT(s); 29052393Syz155240 29062393Syz155240 SPL_NET(s); 29073448Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state); 29083448Sdh155122 for (ifq = ifs->ifs_ips_tqtqb; ifq != NULL; ifq = ifq->ifq_next) 29092393Syz155240 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 29103448Sdh155122 if (tqe->tqe_die > ifs->ifs_fr_ticks) 29112393Syz155240 break; 29122393Syz155240 tqn = tqe->tqe_next; 29132393Syz155240 is = tqe->tqe_parent; 29143448Sdh155122 fr_delstate(is, ISL_EXPIRE, ifs); 29152393Syz155240 } 29162393Syz155240 29173448Sdh155122 for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) { 29182393Syz155240 ifqnext = ifq->ifq_next; 29192393Syz155240 29202393Syz155240 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 29213448Sdh155122 if (tqe->tqe_die > ifs->ifs_fr_ticks) 29222393Syz155240 break; 29232393Syz155240 tqn = tqe->tqe_next; 29242393Syz155240 is = tqe->tqe_parent; 29253448Sdh155122 fr_delstate(is, ISL_EXPIRE, ifs); 29262393Syz155240 } 29272393Syz155240 } 29282393Syz155240 29293448Sdh155122 for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) { 29302393Syz155240 ifqnext = ifq->ifq_next; 29312393Syz155240 29322393Syz155240 if (((ifq->ifq_flags & IFQF_DELETE) != 0) && 29332393Syz155240 (ifq->ifq_ref == 0)) { 29343448Sdh155122 fr_freetimeoutqueue(ifq, ifs); 29352393Syz155240 } 29362393Syz155240 } 29372393Syz155240 29383448Sdh155122 if (ifs->ifs_fr_state_doflush) { 29393448Sdh155122 (void) fr_state_flush(2, 0, ifs); 29403448Sdh155122 ifs->ifs_fr_state_doflush = 0; 29412393Syz155240 } 29423448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 29432393Syz155240 SPL_X(s); 29442393Syz155240 } 29452393Syz155240 29462393Syz155240 29472393Syz155240 /* ------------------------------------------------------------------------ */ 29482393Syz155240 /* Function: fr_state_flush */ 29492393Syz155240 /* Returns: int - 0 == success, -1 == failure */ 29502393Syz155240 /* Parameters: Nil */ 29512393Syz155240 /* Write Locks: ipf_state */ 29522393Syz155240 /* */ 29532393Syz155240 /* Flush state tables. Three actions currently defined: */ 29542393Syz155240 /* which == 0 : flush all state table entries */ 29552393Syz155240 /* which == 1 : flush TCP connections which have started to close but are */ 29562393Syz155240 /* stuck for some reason. */ 29572393Syz155240 /* which == 2 : flush TCP connections which have been idle for a long time, */ 29582393Syz155240 /* starting at > 4 days idle and working back in successive half-*/ 29592393Syz155240 /* days to at most 12 hours old. If this fails to free enough */ 29602393Syz155240 /* slots then work backwards in half hour slots to 30 minutes. */ 29612393Syz155240 /* If that too fails, then work backwards in 30 second intervals */ 29622393Syz155240 /* for the last 30 minutes to at worst 30 seconds idle. */ 29632393Syz155240 /* ------------------------------------------------------------------------ */ 29643448Sdh155122 static int fr_state_flush(which, proto, ifs) 29652393Syz155240 int which, proto; 29663448Sdh155122 ipf_stack_t *ifs; 29672393Syz155240 { 29682393Syz155240 ipftq_t *ifq, *ifqnext; 29692393Syz155240 ipftqent_t *tqe, *tqn; 29702393Syz155240 ipstate_t *is, **isp; 29712393Syz155240 int delete, removed; 29722393Syz155240 long try, maxtick; 29732393Syz155240 u_long interval; 29742393Syz155240 SPL_INT(s); 29752393Syz155240 29762393Syz155240 removed = 0; 29772393Syz155240 29782393Syz155240 SPL_NET(s); 29793448Sdh155122 for (isp = &ifs->ifs_ips_list; ((is = *isp) != NULL); ) { 29802393Syz155240 delete = 0; 29812393Syz155240 29822393Syz155240 if ((proto != 0) && (is->is_v != proto)) { 29832393Syz155240 isp = &is->is_next; 29842393Syz155240 continue; 29852393Syz155240 } 29862393Syz155240 29872393Syz155240 switch (which) 29882393Syz155240 { 29892393Syz155240 case 0 : 29902393Syz155240 delete = 1; 29912393Syz155240 break; 29922393Syz155240 case 1 : 29932393Syz155240 case 2 : 29942393Syz155240 if (is->is_p != IPPROTO_TCP) 29952393Syz155240 break; 29962393Syz155240 if ((is->is_state[0] != IPF_TCPS_ESTABLISHED) || 29972393Syz155240 (is->is_state[1] != IPF_TCPS_ESTABLISHED)) 29982393Syz155240 delete = 1; 29992393Syz155240 break; 30002393Syz155240 } 30012393Syz155240 30022393Syz155240 if (delete) { 30032393Syz155240 if (is->is_p == IPPROTO_TCP) 30043448Sdh155122 ifs->ifs_ips_stats.iss_fin++; 30052393Syz155240 else 30063448Sdh155122 ifs->ifs_ips_stats.iss_expire++; 30073448Sdh155122 fr_delstate(is, ISL_FLUSH, ifs); 30082393Syz155240 removed++; 30092393Syz155240 } else 30102393Syz155240 isp = &is->is_next; 30112393Syz155240 } 30122393Syz155240 30132393Syz155240 if (which != 2) { 30142393Syz155240 SPL_X(s); 30152393Syz155240 return removed; 30162393Syz155240 } 30172393Syz155240 30182393Syz155240 /* 30192393Syz155240 * Asked to remove inactive entries because the table is full, try 30202393Syz155240 * again, 3 times, if first attempt failed with a different criteria 30212393Syz155240 * each time. The order tried in must be in decreasing age. 30222393Syz155240 * Another alternative is to implement random drop and drop N entries 30232393Syz155240 * at random until N have been freed up. 30242393Syz155240 */ 30253448Sdh155122 if (ifs->ifs_fr_ticks - ifs->ifs_ips_last_force_flush < IPF_TTLVAL(5)) 30262393Syz155240 goto force_flush_skipped; 30273448Sdh155122 ifs->ifs_ips_last_force_flush = ifs->ifs_fr_ticks; 30283448Sdh155122 30293448Sdh155122 if (ifs->ifs_fr_ticks > IPF_TTLVAL(43200)) 30302393Syz155240 interval = IPF_TTLVAL(43200); 30313448Sdh155122 else if (ifs->ifs_fr_ticks > IPF_TTLVAL(1800)) 30322393Syz155240 interval = IPF_TTLVAL(1800); 30333448Sdh155122 else if (ifs->ifs_fr_ticks > IPF_TTLVAL(30)) 30342393Syz155240 interval = IPF_TTLVAL(30); 30352393Syz155240 else 30362393Syz155240 interval = IPF_TTLVAL(10); 30373448Sdh155122 try = ifs->ifs_fr_ticks - (ifs->ifs_fr_ticks - interval); 30382393Syz155240 if (try < 0) 30392393Syz155240 goto force_flush_skipped; 30402393Syz155240 30412393Syz155240 while (removed == 0) { 30423448Sdh155122 maxtick = ifs->ifs_fr_ticks - interval; 30432393Syz155240 if (maxtick < 0) 30442393Syz155240 break; 30452393Syz155240 30462393Syz155240 while (try < maxtick) { 30473448Sdh155122 for (ifq = ifs->ifs_ips_tqtqb; ifq != NULL; 30482393Syz155240 ifq = ifq->ifq_next) { 30492393Syz155240 for (tqn = ifq->ifq_head; 30502393Syz155240 ((tqe = tqn) != NULL); ) { 30512393Syz155240 if (tqe->tqe_die > try) 30522393Syz155240 break; 30532393Syz155240 tqn = tqe->tqe_next; 30542393Syz155240 is = tqe->tqe_parent; 30553448Sdh155122 fr_delstate(is, ISL_EXPIRE, ifs); 30562393Syz155240 removed++; 30572393Syz155240 } 30582393Syz155240 } 30592393Syz155240 30603448Sdh155122 for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) { 30612393Syz155240 ifqnext = ifq->ifq_next; 30622393Syz155240 30632393Syz155240 for (tqn = ifq->ifq_head; 30642393Syz155240 ((tqe = tqn) != NULL); ) { 30652393Syz155240 if (tqe->tqe_die > try) 30662393Syz155240 break; 30672393Syz155240 tqn = tqe->tqe_next; 30682393Syz155240 is = tqe->tqe_parent; 30693448Sdh155122 fr_delstate(is, ISL_EXPIRE, ifs); 30702393Syz155240 removed++; 30712393Syz155240 } 30722393Syz155240 } 30732393Syz155240 if (try + interval > maxtick) 30742393Syz155240 break; 30752393Syz155240 try += interval; 30762393Syz155240 } 30772393Syz155240 30782393Syz155240 if (removed == 0) { 30792393Syz155240 if (interval == IPF_TTLVAL(43200)) { 30802393Syz155240 interval = IPF_TTLVAL(1800); 30812393Syz155240 } else if (interval == IPF_TTLVAL(1800)) { 30822393Syz155240 interval = IPF_TTLVAL(30); 30832393Syz155240 } else if (interval == IPF_TTLVAL(30)) { 30842393Syz155240 interval = IPF_TTLVAL(10); 30852393Syz155240 } else { 30862393Syz155240 break; 30872393Syz155240 } 30882393Syz155240 } 30892393Syz155240 } 30902393Syz155240 force_flush_skipped: 30912393Syz155240 SPL_X(s); 30922393Syz155240 return removed; 30932393Syz155240 } 30942393Syz155240 30952393Syz155240 30962393Syz155240 30972393Syz155240 /* ------------------------------------------------------------------------ */ 30982393Syz155240 /* Function: fr_tcp_age */ 30992393Syz155240 /* Returns: int - 1 == state transition made, 0 == no change (rejected) */ 31002393Syz155240 /* Parameters: tq(I) - pointer to timeout queue information */ 31012393Syz155240 /* fin(I) - pointer to packet information */ 31022393Syz155240 /* tqtab(I) - TCP timeout queue table this is in */ 31032393Syz155240 /* flags(I) - flags from state/NAT entry */ 31042393Syz155240 /* */ 31052393Syz155240 /* Rewritten by Arjan de Vet <Arjan.deVet@adv.iae.nl>, 2000-07-29: */ 31062393Syz155240 /* */ 31072393Syz155240 /* - (try to) base state transitions on real evidence only, */ 31082393Syz155240 /* i.e. packets that are sent and have been received by ipfilter; */ 31092393Syz155240 /* diagram 18.12 of TCP/IP volume 1 by W. Richard Stevens was used. */ 31102393Syz155240 /* */ 31112393Syz155240 /* - deal with half-closed connections correctly; */ 31122393Syz155240 /* */ 31132393Syz155240 /* - store the state of the source in state[0] such that ipfstat */ 31142393Syz155240 /* displays the state as source/dest instead of dest/source; the calls */ 31152393Syz155240 /* to fr_tcp_age have been changed accordingly. */ 31162393Syz155240 /* */ 31172393Syz155240 /* Internal Parameters: */ 31182393Syz155240 /* */ 31192393Syz155240 /* state[0] = state of source (host that initiated connection) */ 31202393Syz155240 /* state[1] = state of dest (host that accepted the connection) */ 31212393Syz155240 /* */ 31222393Syz155240 /* dir == 0 : a packet from source to dest */ 31232393Syz155240 /* dir == 1 : a packet from dest to source */ 31242393Syz155240 /* */ 31252393Syz155240 /* Locking: it is assumed that the parent of the tqe structure is locked. */ 31262393Syz155240 /* ------------------------------------------------------------------------ */ 31272393Syz155240 int fr_tcp_age(tqe, fin, tqtab, flags) 31282393Syz155240 ipftqent_t *tqe; 31292393Syz155240 fr_info_t *fin; 31302393Syz155240 ipftq_t *tqtab; 31312393Syz155240 int flags; 31322393Syz155240 { 31332393Syz155240 int dlen, ostate, nstate, rval, dir; 31342393Syz155240 u_char tcpflags; 31352393Syz155240 tcphdr_t *tcp; 31363448Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 31372393Syz155240 31382393Syz155240 tcp = fin->fin_dp; 31392393Syz155240 31402393Syz155240 rval = 0; 31412393Syz155240 dir = fin->fin_rev; 31422393Syz155240 tcpflags = tcp->th_flags; 31432393Syz155240 dlen = fin->fin_dlen - (TCP_OFF(tcp) << 2); 31442393Syz155240 31452393Syz155240 if (tcpflags & TH_RST) { 31462393Syz155240 if (!(tcpflags & TH_PUSH) && !dlen) 31472393Syz155240 nstate = IPF_TCPS_CLOSED; 31482393Syz155240 else 31492393Syz155240 nstate = IPF_TCPS_CLOSE_WAIT; 31502393Syz155240 rval = 1; 31512393Syz155240 } else { 31522393Syz155240 ostate = tqe->tqe_state[1 - dir]; 31532393Syz155240 nstate = tqe->tqe_state[dir]; 31542393Syz155240 31552393Syz155240 switch (nstate) 31562393Syz155240 { 31572393Syz155240 case IPF_TCPS_CLOSED: /* 0 */ 31582393Syz155240 if ((tcpflags & TH_OPENING) == TH_OPENING) { 31592393Syz155240 /* 31602393Syz155240 * 'dir' received an S and sends SA in 31612393Syz155240 * response, CLOSED -> SYN_RECEIVED 31622393Syz155240 */ 31632393Syz155240 nstate = IPF_TCPS_SYN_RECEIVED; 31642393Syz155240 rval = 1; 31652393Syz155240 } else if ((tcpflags & TH_OPENING) == TH_SYN) { 31662393Syz155240 /* 'dir' sent S, CLOSED -> SYN_SENT */ 31672393Syz155240 nstate = IPF_TCPS_SYN_SENT; 31682393Syz155240 rval = 1; 31692393Syz155240 } 31702393Syz155240 /* 31712393Syz155240 * the next piece of code makes it possible to get 31722393Syz155240 * already established connections into the state table 31732393Syz155240 * after a restart or reload of the filter rules; this 31742393Syz155240 * does not work when a strict 'flags S keep state' is 31752393Syz155240 * used for tcp connections of course 31762393Syz155240 */ 31772393Syz155240 if (((flags & IS_TCPFSM) == 0) && 31782393Syz155240 ((tcpflags & TH_ACKMASK) == TH_ACK)) { 31792393Syz155240 /* 31802393Syz155240 * we saw an A, guess 'dir' is in ESTABLISHED 31812393Syz155240 * mode 31822393Syz155240 */ 31832393Syz155240 switch (ostate) 31842393Syz155240 { 31852393Syz155240 case IPF_TCPS_CLOSED : 31862393Syz155240 case IPF_TCPS_SYN_RECEIVED : 31872393Syz155240 nstate = IPF_TCPS_HALF_ESTAB; 31882393Syz155240 rval = 1; 31892393Syz155240 break; 31902393Syz155240 case IPF_TCPS_HALF_ESTAB : 31912393Syz155240 case IPF_TCPS_ESTABLISHED : 31922393Syz155240 nstate = IPF_TCPS_ESTABLISHED; 31932393Syz155240 rval = 1; 31942393Syz155240 break; 31952393Syz155240 default : 31962393Syz155240 break; 31972393Syz155240 } 31982393Syz155240 } 31992393Syz155240 /* 32002393Syz155240 * TODO: besides regular ACK packets we can have other 32012393Syz155240 * packets as well; it is yet to be determined how we 32022393Syz155240 * should initialize the states in those cases 32032393Syz155240 */ 32042393Syz155240 break; 32052393Syz155240 32062393Syz155240 case IPF_TCPS_LISTEN: /* 1 */ 32072393Syz155240 /* NOT USED */ 32082393Syz155240 break; 32092393Syz155240 32102393Syz155240 case IPF_TCPS_SYN_SENT: /* 2 */ 32112393Syz155240 if ((tcpflags & ~(TH_ECN|TH_CWR)) == TH_SYN) { 32122393Syz155240 /* 32132393Syz155240 * A retransmitted SYN packet. We do not reset 32142393Syz155240 * the timeout here to fr_tcptimeout because a 32152393Syz155240 * connection connect timeout does not renew 32162393Syz155240 * after every packet that is sent. We need to 32172393Syz155240 * set rval so as to indicate the packet has 32182393Syz155240 * passed the check for its flags being valid 32192393Syz155240 * in the TCP FSM. Setting rval to 2 has the 32202393Syz155240 * result of not resetting the timeout. 32212393Syz155240 */ 32222393Syz155240 rval = 2; 32232393Syz155240 } else if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) == 32242393Syz155240 TH_ACK) { 32252393Syz155240 /* 32262393Syz155240 * we see an A from 'dir' which is in SYN_SENT 32272393Syz155240 * state: 'dir' sent an A in response to an SA 32282393Syz155240 * which it received, SYN_SENT -> ESTABLISHED 32292393Syz155240 */ 32302393Syz155240 nstate = IPF_TCPS_ESTABLISHED; 32312393Syz155240 rval = 1; 32322393Syz155240 } else if (tcpflags & TH_FIN) { 32332393Syz155240 /* 32342393Syz155240 * we see an F from 'dir' which is in SYN_SENT 32352393Syz155240 * state and wants to close its side of the 32362393Syz155240 * connection; SYN_SENT -> FIN_WAIT_1 32372393Syz155240 */ 32382393Syz155240 nstate = IPF_TCPS_FIN_WAIT_1; 32392393Syz155240 rval = 1; 32402393Syz155240 } else if ((tcpflags & TH_OPENING) == TH_OPENING) { 32412393Syz155240 /* 32422393Syz155240 * we see an SA from 'dir' which is already in 32432393Syz155240 * SYN_SENT state, this means we have a 32442393Syz155240 * simultaneous open; SYN_SENT -> SYN_RECEIVED 32452393Syz155240 */ 32462393Syz155240 nstate = IPF_TCPS_SYN_RECEIVED; 32472393Syz155240 rval = 1; 32482393Syz155240 } 32492393Syz155240 break; 32502393Syz155240 32512393Syz155240 case IPF_TCPS_SYN_RECEIVED: /* 3 */ 32522393Syz155240 if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) == TH_ACK) { 32532393Syz155240 /* 32542393Syz155240 * we see an A from 'dir' which was in 32552393Syz155240 * SYN_RECEIVED state so it must now be in 32562393Syz155240 * established state, SYN_RECEIVED -> 32572393Syz155240 * ESTABLISHED 32582393Syz155240 */ 32592393Syz155240 nstate = IPF_TCPS_ESTABLISHED; 32602393Syz155240 rval = 1; 32612393Syz155240 } else if ((tcpflags & ~(TH_ECN|TH_CWR)) == 32622393Syz155240 TH_OPENING) { 32632393Syz155240 /* 32642393Syz155240 * We see an SA from 'dir' which is already in 32652393Syz155240 * SYN_RECEIVED state. 32662393Syz155240 */ 32672393Syz155240 rval = 2; 32682393Syz155240 } else if (tcpflags & TH_FIN) { 32692393Syz155240 /* 32702393Syz155240 * we see an F from 'dir' which is in 32712393Syz155240 * SYN_RECEIVED state and wants to close its 32722393Syz155240 * side of the connection; SYN_RECEIVED -> 32732393Syz155240 * FIN_WAIT_1 32742393Syz155240 */ 32752393Syz155240 nstate = IPF_TCPS_FIN_WAIT_1; 32762393Syz155240 rval = 1; 32772393Syz155240 } 32782393Syz155240 break; 32792393Syz155240 32802393Syz155240 case IPF_TCPS_HALF_ESTAB: /* 4 */ 32812393Syz155240 if (ostate >= IPF_TCPS_HALF_ESTAB) { 32822393Syz155240 if ((tcpflags & TH_ACKMASK) == TH_ACK) { 32832393Syz155240 nstate = IPF_TCPS_ESTABLISHED; 32842393Syz155240 rval = 1; 32852393Syz155240 } 32862393Syz155240 } 32872393Syz155240 32882393Syz155240 break; 32892393Syz155240 32902393Syz155240 case IPF_TCPS_ESTABLISHED: /* 5 */ 32912393Syz155240 rval = 1; 32922393Syz155240 if (tcpflags & TH_FIN) { 32932393Syz155240 /* 32942393Syz155240 * 'dir' closed its side of the connection; 32952393Syz155240 * this gives us a half-closed connection; 32962393Syz155240 * ESTABLISHED -> FIN_WAIT_1 32972393Syz155240 */ 32982393Syz155240 nstate = IPF_TCPS_FIN_WAIT_1; 32992393Syz155240 } else if (tcpflags & TH_ACK) { 33002393Syz155240 /* 33012393Syz155240 * an ACK, should we exclude other flags here? 33022393Syz155240 */ 33032393Syz155240 if (ostate == IPF_TCPS_FIN_WAIT_1) { 33042393Syz155240 /* 33052393Syz155240 * We know the other side did an active 33062393Syz155240 * close, so we are ACKing the recvd 33072393Syz155240 * FIN packet (does the window matching 33082393Syz155240 * code guarantee this?) and go into 33092393Syz155240 * CLOSE_WAIT state; this gives us a 33102393Syz155240 * half-closed connection 33112393Syz155240 */ 33122393Syz155240 nstate = IPF_TCPS_CLOSE_WAIT; 33132393Syz155240 } else if (ostate < IPF_TCPS_CLOSE_WAIT) { 33142393Syz155240 /* 33152393Syz155240 * still a fully established 33162393Syz155240 * connection reset timeout 33172393Syz155240 */ 33182393Syz155240 nstate = IPF_TCPS_ESTABLISHED; 33192393Syz155240 } 33202393Syz155240 } 33212393Syz155240 break; 33222393Syz155240 33232393Syz155240 case IPF_TCPS_CLOSE_WAIT: /* 6 */ 33242393Syz155240 rval = 1; 33252393Syz155240 if (tcpflags & TH_FIN) { 33262393Syz155240 /* 33272393Syz155240 * application closed and 'dir' sent a FIN, 33282393Syz155240 * we're now going into LAST_ACK state 33292393Syz155240 */ 33302393Syz155240 nstate = IPF_TCPS_LAST_ACK; 33312393Syz155240 } else { 33322393Syz155240 /* 33332393Syz155240 * we remain in CLOSE_WAIT because the other 33342393Syz155240 * side has closed already and we did not 33352393Syz155240 * close our side yet; reset timeout 33362393Syz155240 */ 33372393Syz155240 nstate = IPF_TCPS_CLOSE_WAIT; 33382393Syz155240 } 33392393Syz155240 break; 33402393Syz155240 33412393Syz155240 case IPF_TCPS_FIN_WAIT_1: /* 7 */ 33422393Syz155240 rval = 1; 33432393Syz155240 if ((tcpflags & TH_ACK) && 33442393Syz155240 ostate > IPF_TCPS_CLOSE_WAIT) { 33452393Syz155240 /* 33462393Syz155240 * if the other side is not active anymore 33472393Syz155240 * it has sent us a FIN packet that we are 33482393Syz155240 * ack'ing now with an ACK; this means both 33492393Syz155240 * sides have now closed the connection and 33502393Syz155240 * we go into TIME_WAIT 33512393Syz155240 */ 33522393Syz155240 /* 33532393Syz155240 * XXX: how do we know we really are ACKing 33542393Syz155240 * the FIN packet here? does the window code 33552393Syz155240 * guarantee that? 33562393Syz155240 */ 33572393Syz155240 nstate = IPF_TCPS_TIME_WAIT; 33582393Syz155240 } else { 33592393Syz155240 /* 33602393Syz155240 * we closed our side of the connection 33612393Syz155240 * already but the other side is still active 33622393Syz155240 * (ESTABLISHED/CLOSE_WAIT); continue with 33632393Syz155240 * this half-closed connection 33642393Syz155240 */ 33652393Syz155240 nstate = IPF_TCPS_FIN_WAIT_1; 33662393Syz155240 } 33672393Syz155240 break; 33682393Syz155240 33692393Syz155240 case IPF_TCPS_CLOSING: /* 8 */ 33702393Syz155240 /* NOT USED */ 33712393Syz155240 break; 33722393Syz155240 33732393Syz155240 case IPF_TCPS_LAST_ACK: /* 9 */ 33742393Syz155240 if (tcpflags & TH_ACK) { 33752393Syz155240 if ((tcpflags & TH_PUSH) || dlen) 33762393Syz155240 /* 33772393Syz155240 * there is still data to be delivered, 33782393Syz155240 * reset timeout 33792393Syz155240 */ 33802393Syz155240 rval = 1; 33812393Syz155240 else 33822393Syz155240 rval = 2; 33832393Syz155240 } 33842393Syz155240 /* 33852393Syz155240 * we cannot detect when we go out of LAST_ACK state to 33862393Syz155240 * CLOSED because that is based on the reception of ACK 33872393Syz155240 * packets; ipfilter can only detect that a packet 33882393Syz155240 * has been sent by a host 33892393Syz155240 */ 33902393Syz155240 break; 33912393Syz155240 33922393Syz155240 case IPF_TCPS_FIN_WAIT_2: /* 10 */ 33932393Syz155240 rval = 1; 33942393Syz155240 if ((tcpflags & TH_OPENING) == TH_OPENING) 33952393Syz155240 nstate = IPF_TCPS_SYN_RECEIVED; 33962393Syz155240 else if (tcpflags & TH_SYN) 33972393Syz155240 nstate = IPF_TCPS_SYN_SENT; 33982393Syz155240 break; 33992393Syz155240 34002393Syz155240 case IPF_TCPS_TIME_WAIT: /* 11 */ 34012393Syz155240 /* we're in 2MSL timeout now */ 34022393Syz155240 rval = 1; 34032393Syz155240 break; 34042393Syz155240 34052393Syz155240 default : 34062393Syz155240 #if defined(_KERNEL) 34072393Syz155240 # if SOLARIS 34082393Syz155240 cmn_err(CE_NOTE, 34092393Syz155240 "tcp %lx flags %x si %lx nstate %d ostate %d\n", 34102393Syz155240 (u_long)tcp, tcpflags, (u_long)tqe, 34112393Syz155240 nstate, ostate); 34122393Syz155240 # else 34132393Syz155240 printf("tcp %lx flags %x si %lx nstate %d ostate %d\n", 34142393Syz155240 (u_long)tcp, tcpflags, (u_long)tqe, 34152393Syz155240 nstate, ostate); 34162393Syz155240 # endif 34172393Syz155240 #else 34182393Syz155240 abort(); 34192393Syz155240 #endif 34202393Syz155240 break; 34212393Syz155240 } 34222393Syz155240 } 34232393Syz155240 34242393Syz155240 /* 34252393Syz155240 * If rval == 2 then do not update the queue position, but treat the 34262393Syz155240 * packet as being ok. 34272393Syz155240 */ 34282393Syz155240 if (rval == 2) 34292393Syz155240 rval = 1; 34302393Syz155240 else if (rval == 1) { 34312393Syz155240 tqe->tqe_state[dir] = nstate; 34322393Syz155240 if ((tqe->tqe_flags & TQE_RULEBASED) == 0) 34333448Sdh155122 fr_movequeue(tqe, tqe->tqe_ifq, tqtab + nstate, ifs); 34342393Syz155240 } 34352393Syz155240 34362393Syz155240 return rval; 34372393Syz155240 } 34382393Syz155240 34392393Syz155240 34402393Syz155240 /* ------------------------------------------------------------------------ */ 34412393Syz155240 /* Function: ipstate_log */ 34422393Syz155240 /* Returns: Nil */ 34432393Syz155240 /* Parameters: is(I) - pointer to state structure */ 34442393Syz155240 /* type(I) - type of log entry to create */ 34452393Syz155240 /* */ 34462393Syz155240 /* Creates a state table log entry using the state structure and type info. */ 34472393Syz155240 /* passed in. Log packet/byte counts, source/destination address and other */ 34482393Syz155240 /* protocol specific information. */ 34492393Syz155240 /* ------------------------------------------------------------------------ */ 34503448Sdh155122 void ipstate_log(is, type, ifs) 34512393Syz155240 struct ipstate *is; 34522393Syz155240 u_int type; 34533448Sdh155122 ipf_stack_t *ifs; 34542393Syz155240 { 34552393Syz155240 #ifdef IPFILTER_LOG 34562393Syz155240 struct ipslog ipsl; 34572393Syz155240 size_t sizes[1]; 34582393Syz155240 void *items[1]; 34592393Syz155240 int types[1]; 34602393Syz155240 34612393Syz155240 /* 34622393Syz155240 * Copy information out of the ipstate_t structure and into the 34632393Syz155240 * structure used for logging. 34642393Syz155240 */ 34652393Syz155240 ipsl.isl_type = type; 34662393Syz155240 ipsl.isl_pkts[0] = is->is_pkts[0] + is->is_icmppkts[0]; 34672393Syz155240 ipsl.isl_bytes[0] = is->is_bytes[0]; 34682393Syz155240 ipsl.isl_pkts[1] = is->is_pkts[1] + is->is_icmppkts[1]; 34692393Syz155240 ipsl.isl_bytes[1] = is->is_bytes[1]; 34702393Syz155240 ipsl.isl_pkts[2] = is->is_pkts[2] + is->is_icmppkts[2]; 34712393Syz155240 ipsl.isl_bytes[2] = is->is_bytes[2]; 34722393Syz155240 ipsl.isl_pkts[3] = is->is_pkts[3] + is->is_icmppkts[3]; 34732393Syz155240 ipsl.isl_bytes[3] = is->is_bytes[3]; 34742393Syz155240 ipsl.isl_src = is->is_src; 34752393Syz155240 ipsl.isl_dst = is->is_dst; 34762393Syz155240 ipsl.isl_p = is->is_p; 34772393Syz155240 ipsl.isl_v = is->is_v; 34782393Syz155240 ipsl.isl_flags = is->is_flags; 34792393Syz155240 ipsl.isl_tag = is->is_tag; 34802393Syz155240 ipsl.isl_rulen = is->is_rulen; 34812393Syz155240 (void) strncpy(ipsl.isl_group, is->is_group, FR_GROUPLEN); 34822393Syz155240 34832393Syz155240 if (ipsl.isl_p == IPPROTO_TCP || ipsl.isl_p == IPPROTO_UDP) { 34842393Syz155240 ipsl.isl_sport = is->is_sport; 34852393Syz155240 ipsl.isl_dport = is->is_dport; 34862393Syz155240 if (ipsl.isl_p == IPPROTO_TCP) { 34872393Syz155240 ipsl.isl_state[0] = is->is_state[0]; 34882393Syz155240 ipsl.isl_state[1] = is->is_state[1]; 34892393Syz155240 } 34902393Syz155240 } else if (ipsl.isl_p == IPPROTO_ICMP) { 34912393Syz155240 ipsl.isl_itype = is->is_icmp.ici_type; 34922393Syz155240 } else if (ipsl.isl_p == IPPROTO_ICMPV6) { 34932393Syz155240 ipsl.isl_itype = is->is_icmp.ici_type; 34942393Syz155240 } else { 34952393Syz155240 ipsl.isl_ps.isl_filler[0] = 0; 34962393Syz155240 ipsl.isl_ps.isl_filler[1] = 0; 34972393Syz155240 } 34982393Syz155240 34992393Syz155240 items[0] = &ipsl; 35002393Syz155240 sizes[0] = sizeof(ipsl); 35012393Syz155240 types[0] = 0; 35022393Syz155240 35033448Sdh155122 if (ipllog(IPL_LOGSTATE, NULL, items, sizes, types, 1, ifs)) { 35043448Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_logged); 35052393Syz155240 } else { 35063448Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_logfail); 35072393Syz155240 } 35082393Syz155240 #endif 35092393Syz155240 } 35102393Syz155240 35112393Syz155240 35122393Syz155240 #ifdef USE_INET6 35132393Syz155240 /* ------------------------------------------------------------------------ */ 35142393Syz155240 /* Function: fr_checkicmp6matchingstate */ 35152393Syz155240 /* Returns: ipstate_t* - NULL == no match found, */ 35162393Syz155240 /* else pointer to matching state entry */ 35172393Syz155240 /* Parameters: fin(I) - pointer to packet information */ 35182393Syz155240 /* Locks: NULL == no locks, else Read Lock on ipf_state */ 35192393Syz155240 /* */ 35202393Syz155240 /* If we've got an ICMPv6 error message, using the information stored in */ 35212393Syz155240 /* the ICMPv6 packet, look for a matching state table entry. */ 35222393Syz155240 /* ------------------------------------------------------------------------ */ 35232393Syz155240 static ipstate_t *fr_checkicmp6matchingstate(fin) 35242393Syz155240 fr_info_t *fin; 35252393Syz155240 { 35262393Syz155240 struct icmp6_hdr *ic6, *oic; 35272393Syz155240 int backward, i; 35282393Syz155240 ipstate_t *is, **isp; 35292393Syz155240 u_short sport, dport; 35302393Syz155240 i6addr_t dst, src; 35312393Syz155240 u_short savelen; 35322393Syz155240 icmpinfo_t *ic; 35332393Syz155240 fr_info_t ofin; 35342393Syz155240 tcphdr_t *tcp; 35352393Syz155240 ip6_t *oip6; 35362393Syz155240 u_char pr; 35372393Syz155240 u_int hv; 35383448Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 35392393Syz155240 35402393Syz155240 /* 35412393Syz155240 * Does it at least have the return (basic) IP header ? 35422393Syz155240 * Is it an actual recognised ICMP error type? 35432393Syz155240 * Only a basic IP header (no options) should be with 35442393Syz155240 * an ICMP error header. 35452393Syz155240 */ 35462393Syz155240 if ((fin->fin_v != 6) || (fin->fin_plen < ICMP6ERR_MINPKTLEN) || 35472393Syz155240 !(fin->fin_flx & FI_ICMPERR)) 35482393Syz155240 return NULL; 35492393Syz155240 35502393Syz155240 ic6 = fin->fin_dp; 35512393Syz155240 35522393Syz155240 oip6 = (ip6_t *)((char *)ic6 + ICMPERR_ICMPHLEN); 35532393Syz155240 if (fin->fin_plen < sizeof(*oip6)) 35542393Syz155240 return NULL; 35552393Syz155240 3556*3607Szf203873 bcopy((char *)fin, (char *)&ofin, sizeof(*fin)); 35572393Syz155240 ofin.fin_v = 6; 35582393Syz155240 ofin.fin_ifp = fin->fin_ifp; 35592393Syz155240 ofin.fin_out = !fin->fin_out; 35602393Syz155240 ofin.fin_m = NULL; /* if dereferenced, panic XXX */ 35612393Syz155240 ofin.fin_mp = NULL; /* if dereferenced, panic XXX */ 35622393Syz155240 35632393Syz155240 /* 35642393Syz155240 * We make a fin entry to be able to feed it to 35652393Syz155240 * matchsrcdst. Note that not all fields are necessary 35662393Syz155240 * but this is the cleanest way. Note further we fill 35672393Syz155240 * in fin_mp such that if someone uses it we'll get 35682393Syz155240 * a kernel panic. fr_matchsrcdst does not use this. 35692393Syz155240 * 35702393Syz155240 * watch out here, as ip is in host order and oip6 in network 35712393Syz155240 * order. Any change we make must be undone afterwards. 35722393Syz155240 */ 35732393Syz155240 savelen = oip6->ip6_plen; 35742393Syz155240 oip6->ip6_plen = fin->fin_dlen - ICMPERR_ICMPHLEN; 35752393Syz155240 ofin.fin_flx = FI_NOCKSUM; 35762393Syz155240 ofin.fin_ip = (ip_t *)oip6; 35772393Syz155240 ofin.fin_plen = oip6->ip6_plen; 35782393Syz155240 (void) fr_makefrip(sizeof(*oip6), (ip_t *)oip6, &ofin); 35792393Syz155240 ofin.fin_flx &= ~(FI_BAD|FI_SHORT); 35802393Syz155240 oip6->ip6_plen = savelen; 35812393Syz155240 35822393Syz155240 if (oip6->ip6_nxt == IPPROTO_ICMPV6) { 35832393Syz155240 oic = (struct icmp6_hdr *)(oip6 + 1); 35842393Syz155240 /* 35852393Syz155240 * an ICMP error can only be generated as a result of an 35862393Syz155240 * ICMP query, not as the response on an ICMP error 35872393Syz155240 * 35882393Syz155240 * XXX theoretically ICMP_ECHOREP and the other reply's are 35892393Syz155240 * ICMP query's as well, but adding them here seems strange XXX 35902393Syz155240 */ 35912393Syz155240 if (!(oic->icmp6_type & ICMP6_INFOMSG_MASK)) 35922393Syz155240 return NULL; 35932393Syz155240 35942393Syz155240 /* 35952393Syz155240 * perform a lookup of the ICMP packet in the state table 35962393Syz155240 */ 35972393Syz155240 hv = (pr = oip6->ip6_nxt); 35982393Syz155240 src.in6 = oip6->ip6_src; 35992393Syz155240 hv += src.in4.s_addr; 36002393Syz155240 dst.in6 = oip6->ip6_dst; 36012393Syz155240 hv += dst.in4.s_addr; 36022393Syz155240 hv += oic->icmp6_id; 36032393Syz155240 hv += oic->icmp6_seq; 36043448Sdh155122 hv = DOUBLE_HASH(hv, ifs); 36053448Sdh155122 36063448Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 36073448Sdh155122 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) { 36082393Syz155240 ic = &is->is_icmp; 36092393Syz155240 isp = &is->is_hnext; 36102393Syz155240 if ((is->is_p == pr) && 36112393Syz155240 !(is->is_pass & FR_NOICMPERR) && 36122393Syz155240 (oic->icmp6_id == ic->ici_id) && 36132393Syz155240 (oic->icmp6_seq == ic->ici_seq) && 36142393Syz155240 (is = fr_matchsrcdst(&ofin, is, &src, 36152393Syz155240 &dst, NULL, FI_ICMPCMP))) { 36162393Syz155240 /* 36172393Syz155240 * in the state table ICMP query's are stored 36182393Syz155240 * with the type of the corresponding ICMP 36192393Syz155240 * response. Correct here 36202393Syz155240 */ 36212393Syz155240 if (((ic->ici_type == ICMP6_ECHO_REPLY) && 36222393Syz155240 (oic->icmp6_type == ICMP6_ECHO_REQUEST)) || 36232393Syz155240 (ic->ici_type - 1 == oic->icmp6_type )) { 36243448Sdh155122 ifs->ifs_ips_stats.iss_hits++; 36252393Syz155240 backward = IP6_NEQ(&is->is_dst, &src); 36262393Syz155240 fin->fin_rev = !backward; 36272393Syz155240 i = (backward << 1) + fin->fin_out; 36282393Syz155240 is->is_icmppkts[i]++; 36292393Syz155240 return is; 36302393Syz155240 } 36312393Syz155240 } 36322393Syz155240 } 36333448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 36342393Syz155240 return NULL; 36352393Syz155240 } 36362393Syz155240 36372393Syz155240 hv = (pr = oip6->ip6_nxt); 36382393Syz155240 src.in6 = oip6->ip6_src; 36392393Syz155240 hv += src.i6[0]; 36402393Syz155240 hv += src.i6[1]; 36412393Syz155240 hv += src.i6[2]; 36422393Syz155240 hv += src.i6[3]; 36432393Syz155240 dst.in6 = oip6->ip6_dst; 36442393Syz155240 hv += dst.i6[0]; 36452393Syz155240 hv += dst.i6[1]; 36462393Syz155240 hv += dst.i6[2]; 36472393Syz155240 hv += dst.i6[3]; 36482393Syz155240 36492393Syz155240 if ((oip6->ip6_nxt == IPPROTO_TCP) || (oip6->ip6_nxt == IPPROTO_UDP)) { 36502393Syz155240 tcp = (tcphdr_t *)(oip6 + 1); 36512393Syz155240 dport = tcp->th_dport; 36522393Syz155240 sport = tcp->th_sport; 36532393Syz155240 hv += dport; 36542393Syz155240 hv += sport; 36552393Syz155240 } else 36562393Syz155240 tcp = NULL; 36573448Sdh155122 hv = DOUBLE_HASH(hv, ifs); 36583448Sdh155122 36593448Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 36603448Sdh155122 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) { 36612393Syz155240 isp = &is->is_hnext; 36622393Syz155240 /* 36632393Syz155240 * Only allow this icmp though if the 36642393Syz155240 * encapsulated packet was allowed through the 36652393Syz155240 * other way around. Note that the minimal amount 36662393Syz155240 * of info present does not allow for checking against 36672393Syz155240 * tcp internals such as seq and ack numbers. 36682393Syz155240 */ 36692393Syz155240 if ((is->is_p != pr) || (is->is_v != 6) || 36702393Syz155240 (is->is_pass & FR_NOICMPERR)) 36712393Syz155240 continue; 36722393Syz155240 is = fr_matchsrcdst(&ofin, is, &src, &dst, tcp, FI_ICMPCMP); 36732393Syz155240 if (is != NULL) { 36743448Sdh155122 ifs->ifs_ips_stats.iss_hits++; 36752393Syz155240 backward = IP6_NEQ(&is->is_dst, &src); 36762393Syz155240 fin->fin_rev = !backward; 36772393Syz155240 i = (backward << 1) + fin->fin_out; 36782393Syz155240 is->is_icmppkts[i]++; 36792393Syz155240 /* 36802393Syz155240 * we deliberately do not touch the timeouts 36812393Syz155240 * for the accompanying state table entry. 36822393Syz155240 * It remains to be seen if that is correct. XXX 36832393Syz155240 */ 36842393Syz155240 return is; 36852393Syz155240 } 36862393Syz155240 } 36873448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 36882393Syz155240 return NULL; 36892393Syz155240 } 36902393Syz155240 #endif 36912393Syz155240 36922393Syz155240 36932393Syz155240 /* ------------------------------------------------------------------------ */ 36942393Syz155240 /* Function: fr_sttab_init */ 36952393Syz155240 /* Returns: Nil */ 36962393Syz155240 /* Parameters: tqp(I) - pointer to an array of timeout queues for TCP */ 36972393Syz155240 /* */ 36982393Syz155240 /* Initialise the array of timeout queues for TCP. */ 36992393Syz155240 /* ------------------------------------------------------------------------ */ 37003448Sdh155122 void fr_sttab_init(tqp, ifs) 37012393Syz155240 ipftq_t *tqp; 37023448Sdh155122 ipf_stack_t *ifs; 37032393Syz155240 { 37042393Syz155240 int i; 37052393Syz155240 37062393Syz155240 for (i = IPF_TCP_NSTATES - 1; i >= 0; i--) { 37072393Syz155240 tqp[i].ifq_ttl = 0; 37082393Syz155240 tqp[i].ifq_ref = 1; 37092393Syz155240 tqp[i].ifq_head = NULL; 37102393Syz155240 tqp[i].ifq_tail = &tqp[i].ifq_head; 37112393Syz155240 tqp[i].ifq_next = tqp + i + 1; 37122393Syz155240 MUTEX_INIT(&tqp[i].ifq_lock, "ipftq tcp tab"); 37132393Syz155240 } 37142393Syz155240 tqp[IPF_TCP_NSTATES - 1].ifq_next = NULL; 37153448Sdh155122 tqp[IPF_TCPS_CLOSED].ifq_ttl = ifs->ifs_fr_tcpclosed; 37163448Sdh155122 tqp[IPF_TCPS_LISTEN].ifq_ttl = ifs->ifs_fr_tcptimeout; 37173448Sdh155122 tqp[IPF_TCPS_SYN_SENT].ifq_ttl = ifs->ifs_fr_tcptimeout; 37183448Sdh155122 tqp[IPF_TCPS_SYN_RECEIVED].ifq_ttl = ifs->ifs_fr_tcptimeout; 37193448Sdh155122 tqp[IPF_TCPS_ESTABLISHED].ifq_ttl = ifs->ifs_fr_tcpidletimeout; 37203448Sdh155122 tqp[IPF_TCPS_CLOSE_WAIT].ifq_ttl = ifs->ifs_fr_tcphalfclosed; 37213448Sdh155122 tqp[IPF_TCPS_FIN_WAIT_1].ifq_ttl = ifs->ifs_fr_tcphalfclosed; 37223448Sdh155122 tqp[IPF_TCPS_CLOSING].ifq_ttl = ifs->ifs_fr_tcptimeout; 37233448Sdh155122 tqp[IPF_TCPS_LAST_ACK].ifq_ttl = ifs->ifs_fr_tcplastack; 37243448Sdh155122 tqp[IPF_TCPS_FIN_WAIT_2].ifq_ttl = ifs->ifs_fr_tcpclosewait; 37253448Sdh155122 tqp[IPF_TCPS_TIME_WAIT].ifq_ttl = ifs->ifs_fr_tcptimeout; 37263448Sdh155122 tqp[IPF_TCPS_HALF_ESTAB].ifq_ttl = ifs->ifs_fr_tcptimeout; 37272393Syz155240 } 37282393Syz155240 37292393Syz155240 37302393Syz155240 /* ------------------------------------------------------------------------ */ 37312393Syz155240 /* Function: fr_sttab_destroy */ 37322393Syz155240 /* Returns: Nil */ 37332393Syz155240 /* Parameters: tqp(I) - pointer to an array of timeout queues for TCP */ 37342393Syz155240 /* */ 37352393Syz155240 /* Do whatever is necessary to "destroy" each of the entries in the array */ 37362393Syz155240 /* of timeout queues for TCP. */ 37372393Syz155240 /* ------------------------------------------------------------------------ */ 37382393Syz155240 void fr_sttab_destroy(tqp) 37392393Syz155240 ipftq_t *tqp; 37402393Syz155240 { 37412393Syz155240 int i; 37422393Syz155240 37432393Syz155240 for (i = IPF_TCP_NSTATES - 1; i >= 0; i--) 37442393Syz155240 MUTEX_DESTROY(&tqp[i].ifq_lock); 37452393Syz155240 } 37462393Syz155240 37472393Syz155240 37482393Syz155240 /* ------------------------------------------------------------------------ */ 37492393Syz155240 /* Function: fr_statederef */ 37502393Syz155240 /* Returns: Nil */ 37512393Syz155240 /* Parameters: isp(I) - pointer to pointer to state table entry */ 37522393Syz155240 /* */ 37532393Syz155240 /* Decrement the reference counter for this state table entry and free it */ 37542393Syz155240 /* if there are no more things using it. */ 37552393Syz155240 /* */ 37562393Syz155240 /* When operating in userland (ipftest), we have no timers to clear a state */ 37572393Syz155240 /* entry. Therefore, we make a few simple tests before deleting an entry */ 37582393Syz155240 /* outright. We compare states on each side looking for a combination of */ 37592393Syz155240 /* TIME_WAIT (should really be FIN_WAIT_2?) and LAST_ACK. Then we factor */ 37602393Syz155240 /* in packet direction with the interface list to make sure we don't */ 37612393Syz155240 /* prematurely delete an entry on a final inbound packet that's we're also */ 37622393Syz155240 /* supposed to route elsewhere. */ 37632393Syz155240 /* */ 37642393Syz155240 /* Internal parameters: */ 37652393Syz155240 /* state[0] = state of source (host that initiated connection) */ 37662393Syz155240 /* state[1] = state of dest (host that accepted the connection) */ 37672393Syz155240 /* */ 37682393Syz155240 /* dir == 0 : a packet from source to dest */ 37692393Syz155240 /* dir == 1 : a packet from dest to source */ 37702393Syz155240 /* ------------------------------------------------------------------------ */ 37713448Sdh155122 void fr_statederef(fin, isp, ifs) 37722393Syz155240 fr_info_t *fin; 37732393Syz155240 ipstate_t **isp; 37743448Sdh155122 ipf_stack_t *ifs; 37752393Syz155240 { 37762393Syz155240 ipstate_t *is = *isp; 37772393Syz155240 #if 0 37782393Syz155240 int nstate, ostate, dir, eol; 37792393Syz155240 37802393Syz155240 eol = 0; /* End-of-the-line flag. */ 37812393Syz155240 dir = fin->fin_rev; 37822393Syz155240 ostate = is->is_state[1 - dir]; 37832393Syz155240 nstate = is->is_state[dir]; 37842393Syz155240 /* 37852393Syz155240 * Determine whether this packet is local or routed. State entries 37862393Syz155240 * with us as the destination will have an interface list of 37872393Syz155240 * int1,-,-,int1. Entries with us as the origin run as -,int1,int1,-. 37882393Syz155240 */ 37892393Syz155240 if ((fin->fin_p == IPPROTO_TCP) && (fin->fin_out == 0)) { 37902393Syz155240 if ((strcmp(is->is_ifname[0], is->is_ifname[3]) == 0) && 37912393Syz155240 (strcmp(is->is_ifname[1], is->is_ifname[2]) == 0)) { 37922393Syz155240 if ((dir == 0) && 37932393Syz155240 (strcmp(is->is_ifname[1], "-") == 0) && 37942393Syz155240 (strcmp(is->is_ifname[0], "-") != 0)) { 37952393Syz155240 eol = 1; 37962393Syz155240 } else if ((dir == 1) && 37972393Syz155240 (strcmp(is->is_ifname[0], "-") == 0) && 37982393Syz155240 (strcmp(is->is_ifname[1], "-") != 0)) { 37992393Syz155240 eol = 1; 38002393Syz155240 } 38012393Syz155240 } 38022393Syz155240 } 38032393Syz155240 #endif 38042393Syz155240 38052393Syz155240 fin = fin; /* LINT */ 38062393Syz155240 is = *isp; 38072393Syz155240 *isp = NULL; 38083448Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state); 38092393Syz155240 is->is_ref--; 38102393Syz155240 if (is->is_ref == 0) { 38112393Syz155240 is->is_ref++; /* To counter ref-- in fr_delstate() */ 38123448Sdh155122 fr_delstate(is, ISL_EXPIRE, ifs); 38132393Syz155240 #ifndef _KERNEL 38142393Syz155240 #if 0 38152393Syz155240 } else if (((fin->fin_out == 1) || (eol == 1)) && 38162393Syz155240 ((ostate == IPF_TCPS_LAST_ACK) && 38172393Syz155240 (nstate == IPF_TCPS_TIME_WAIT))) { 38182393Syz155240 ; 38192393Syz155240 #else 38202393Syz155240 } else if ((is->is_sti.tqe_state[0] > IPF_TCPS_ESTABLISHED) || 38212393Syz155240 (is->is_sti.tqe_state[1] > IPF_TCPS_ESTABLISHED)) { 38222393Syz155240 #endif 38233448Sdh155122 fr_delstate(is, ISL_ORPHAN, ifs); 38242393Syz155240 #endif 38252393Syz155240 } 38263448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 38272393Syz155240 } 38282393Syz155240 38292393Syz155240 38302393Syz155240 /* ------------------------------------------------------------------------ */ 38312393Syz155240 /* Function: fr_setstatequeue */ 38322393Syz155240 /* Returns: Nil */ 38332393Syz155240 /* Parameters: is(I) - pointer to state structure */ 38342393Syz155240 /* rev(I) - forward(0) or reverse(1) direction */ 38352393Syz155240 /* Locks: ipf_state (read or write) */ 38362393Syz155240 /* */ 38372393Syz155240 /* Put the state entry on its default queue entry, using rev as a helped in */ 38382393Syz155240 /* determining which queue it should be placed on. */ 38392393Syz155240 /* ------------------------------------------------------------------------ */ 38403448Sdh155122 void fr_setstatequeue(is, rev, ifs) 38412393Syz155240 ipstate_t *is; 38422393Syz155240 int rev; 38433448Sdh155122 ipf_stack_t *ifs; 38442393Syz155240 { 38452393Syz155240 ipftq_t *oifq, *nifq; 38462393Syz155240 38472393Syz155240 38482393Syz155240 if ((is->is_sti.tqe_flags & TQE_RULEBASED) != 0) 38492393Syz155240 nifq = is->is_tqehead[rev]; 38502393Syz155240 else 38512393Syz155240 nifq = NULL; 38522393Syz155240 38532393Syz155240 if (nifq == NULL) { 38542393Syz155240 switch (is->is_p) 38552393Syz155240 { 38562393Syz155240 #ifdef USE_INET6 38572393Syz155240 case IPPROTO_ICMPV6 : 38582393Syz155240 if (rev == 1) 38593448Sdh155122 nifq = &ifs->ifs_ips_icmpacktq; 38602393Syz155240 else 38613448Sdh155122 nifq = &ifs->ifs_ips_icmptq; 38622393Syz155240 break; 38632393Syz155240 #endif 38642393Syz155240 case IPPROTO_ICMP : 38652393Syz155240 if (rev == 1) 38663448Sdh155122 nifq = &ifs->ifs_ips_icmpacktq; 38672393Syz155240 else 38683448Sdh155122 nifq = &ifs->ifs_ips_icmptq; 38692393Syz155240 break; 38702393Syz155240 case IPPROTO_TCP : 38713448Sdh155122 nifq = ifs->ifs_ips_tqtqb + is->is_state[rev]; 38722393Syz155240 break; 38732393Syz155240 38742393Syz155240 case IPPROTO_UDP : 38752393Syz155240 if (rev == 1) 38763448Sdh155122 nifq = &ifs->ifs_ips_udpacktq; 38772393Syz155240 else 38783448Sdh155122 nifq = &ifs->ifs_ips_udptq; 38792393Syz155240 break; 38802393Syz155240 38812393Syz155240 default : 38823448Sdh155122 nifq = &ifs->ifs_ips_iptq; 38832393Syz155240 break; 38842393Syz155240 } 38852393Syz155240 } 38862393Syz155240 38872393Syz155240 oifq = is->is_sti.tqe_ifq; 38882393Syz155240 /* 38892393Syz155240 * If it's currently on a timeout queue, move it from one queue to 38902393Syz155240 * another, else put it on the end of the newly determined queue. 38912393Syz155240 */ 38922393Syz155240 if (oifq != NULL) 38933448Sdh155122 fr_movequeue(&is->is_sti, oifq, nifq, ifs); 38942393Syz155240 else 38953448Sdh155122 fr_queueappend(&is->is_sti, nifq, is, ifs); 38962393Syz155240 return; 38972393Syz155240 } 38983448Sdh155122 38993448Sdh155122 39003448Sdh155122 /* ------------------------------------------------------------------------ */ 39013448Sdh155122 /* Function: fr_stateiter */ 39023448Sdh155122 /* Returns: int - 0 == success, else error */ 39033448Sdh155122 /* Parameters: token(I) - pointer to ipftoken structure */ 39043448Sdh155122 /* itp(I) - pointer to ipfgeniter structure */ 39053448Sdh155122 /* */ 39063448Sdh155122 /* This function handles the SIOCGENITER ioctl for the state tables and */ 39073448Sdh155122 /* walks through the list of entries in the state table list (ips_list.) */ 39083448Sdh155122 /* ------------------------------------------------------------------------ */ 39093448Sdh155122 static int fr_stateiter(token, itp, ifs) 39103448Sdh155122 ipftoken_t *token; 39113448Sdh155122 ipfgeniter_t *itp; 39123448Sdh155122 ipf_stack_t *ifs; 39133448Sdh155122 { 39143448Sdh155122 ipstate_t *is, *next, zero; 39153448Sdh155122 int error; 39163448Sdh155122 39173448Sdh155122 if (itp->igi_data == NULL) 39183448Sdh155122 return EFAULT; 39193448Sdh155122 39203448Sdh155122 if (itp->igi_type != IPFGENITER_STATE) 39213448Sdh155122 return EINVAL; 39223448Sdh155122 39233448Sdh155122 is = token->ipt_data; 39243448Sdh155122 if (is == (void *)-1) { 39253448Sdh155122 ipf_freetoken(token, ifs); 39263448Sdh155122 return ESRCH; 39273448Sdh155122 } 39283448Sdh155122 39293448Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 39303448Sdh155122 if (is == NULL) { 39313448Sdh155122 next = ifs->ifs_ips_list; 39323448Sdh155122 } else { 39333448Sdh155122 next = is->is_next; 39343448Sdh155122 } 39353448Sdh155122 39363448Sdh155122 if (next != NULL) { 39373448Sdh155122 /* 39383448Sdh155122 * If we find a state entry to use, bump its reference count 39393448Sdh155122 * so that it can be used for is_next when we come back. 39403448Sdh155122 */ 39413448Sdh155122 MUTEX_ENTER(&next->is_lock); 39423448Sdh155122 next->is_ref++; 39433448Sdh155122 MUTEX_EXIT(&next->is_lock); 39443448Sdh155122 token->ipt_data = next; 39453448Sdh155122 } else { 39463448Sdh155122 bzero(&zero, sizeof(zero)); 39473448Sdh155122 next = &zero; 39483448Sdh155122 token->ipt_data = (void *)-1; 39493448Sdh155122 } 39503448Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 39513448Sdh155122 39523448Sdh155122 /* 39533448Sdh155122 * If we had a prior pointer to a state entry, release it. 39543448Sdh155122 */ 39553448Sdh155122 if (is != NULL) { 39563448Sdh155122 fr_statederef(NULL, &is, ifs); 39573448Sdh155122 } 39583448Sdh155122 39593448Sdh155122 /* 39603448Sdh155122 * This should arguably be via fr_outobj() so that the state 39613448Sdh155122 * structure can (if required) be massaged going out. 39623448Sdh155122 */ 39633448Sdh155122 error = COPYOUT(next, itp->igi_data, sizeof(*next)); 39643448Sdh155122 if (error != 0) 39653448Sdh155122 error = EFAULT; 39663448Sdh155122 39673448Sdh155122 return error; 39683448Sdh155122 } 39693448Sdh155122 3970