xref: /onnv-gate/usr/src/uts/common/inet/ipf/ip_state.c (revision 3607:288ca557ca70)
12393Syz155240 /*
22393Syz155240  * Copyright (C) 1995-2003 by Darren Reed.
32393Syz155240  *
42393Syz155240  * See the IPFILTER.LICENCE file for details on licencing.
52393Syz155240  *
63448Sdh155122  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
72393Syz155240  * Use is subject to license terms.
82393Syz155240  */
92393Syz155240 
102393Syz155240 #pragma ident	"%Z%%M%	%I%	%E% SMI"
112393Syz155240 
122393Syz155240 #if defined(KERNEL) || defined(_KERNEL)
132393Syz155240 # undef KERNEL
142393Syz155240 # undef _KERNEL
152393Syz155240 # define        KERNEL	1
162393Syz155240 # define        _KERNEL	1
172393Syz155240 #endif
182393Syz155240 #include <sys/errno.h>
192393Syz155240 #include <sys/types.h>
202393Syz155240 #include <sys/param.h>
212393Syz155240 #include <sys/file.h>
222393Syz155240 #if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \
232393Syz155240     defined(_KERNEL)
242393Syz155240 # include "opt_ipfilter_log.h"
252393Syz155240 #endif
262393Syz155240 #if defined(_KERNEL) && defined(__FreeBSD_version) && \
272393Syz155240     (__FreeBSD_version >= 400000) && !defined(KLD_MODULE)
282393Syz155240 #include "opt_inet6.h"
292393Syz155240 #endif
302393Syz155240 #if !defined(_KERNEL) && !defined(__KERNEL__)
312393Syz155240 # include <stdio.h>
322393Syz155240 # include <stdlib.h>
332393Syz155240 # include <string.h>
342393Syz155240 # define _KERNEL
352393Syz155240 # ifdef __OpenBSD__
362393Syz155240 struct file;
372393Syz155240 # endif
382393Syz155240 # include <sys/uio.h>
392393Syz155240 # undef _KERNEL
402393Syz155240 #endif
412393Syz155240 #if defined(_KERNEL) && (__FreeBSD_version >= 220000)
422393Syz155240 # include <sys/filio.h>
432393Syz155240 # include <sys/fcntl.h>
442393Syz155240 # if (__FreeBSD_version >= 300000) && !defined(IPFILTER_LKM)
452393Syz155240 #  include "opt_ipfilter.h"
462393Syz155240 # endif
472393Syz155240 #else
482393Syz155240 # include <sys/ioctl.h>
492393Syz155240 #endif
502393Syz155240 #include <sys/time.h>
512393Syz155240 #if !defined(linux)
522393Syz155240 # include <sys/protosw.h>
532393Syz155240 #endif
542393Syz155240 #include <sys/socket.h>
552393Syz155240 #if defined(_KERNEL)
562393Syz155240 # include <sys/systm.h>
572393Syz155240 # if !defined(__SVR4) && !defined(__svr4__)
582393Syz155240 #  include <sys/mbuf.h>
592393Syz155240 # endif
602393Syz155240 #endif
612393Syz155240 #if defined(__SVR4) || defined(__svr4__)
622393Syz155240 # include <sys/filio.h>
632393Syz155240 # include <sys/byteorder.h>
642393Syz155240 # ifdef _KERNEL
652393Syz155240 #  include <sys/dditypes.h>
662393Syz155240 # endif
672393Syz155240 # include <sys/stream.h>
682393Syz155240 # include <sys/kmem.h>
692393Syz155240 #endif
702393Syz155240 
712393Syz155240 #include <net/if.h>
722393Syz155240 #ifdef sun
732393Syz155240 # include <net/af.h>
742393Syz155240 #endif
752393Syz155240 #include <net/route.h>
762393Syz155240 #include <netinet/in.h>
772393Syz155240 #include <netinet/in_systm.h>
782393Syz155240 #include <netinet/ip.h>
792393Syz155240 #include <netinet/tcp.h>
802393Syz155240 #if !defined(linux)
812393Syz155240 # include <netinet/ip_var.h>
822393Syz155240 #endif
832393Syz155240 #if !defined(__hpux) && !defined(linux)
842393Syz155240 # include <netinet/tcp_fsm.h>
852393Syz155240 #endif
862393Syz155240 #include <netinet/udp.h>
872393Syz155240 #include <netinet/ip_icmp.h>
882393Syz155240 #include "netinet/ip_compat.h"
892393Syz155240 #include <netinet/tcpip.h>
902393Syz155240 #include "netinet/ip_fil.h"
912393Syz155240 #include "netinet/ip_nat.h"
922393Syz155240 #include "netinet/ip_frag.h"
932393Syz155240 #include "netinet/ip_state.h"
942393Syz155240 #include "netinet/ip_proxy.h"
953448Sdh155122 #include "netinet/ipf_stack.h"
962393Syz155240 #ifdef	IPFILTER_SYNC
972393Syz155240 #include "netinet/ip_sync.h"
982393Syz155240 #endif
992393Syz155240 #ifdef	IPFILTER_SCAN
1002393Syz155240 #include "netinet/ip_scan.h"
1012393Syz155240 #endif
1022393Syz155240 #ifdef	USE_INET6
1032393Syz155240 #include <netinet/icmp6.h>
1042393Syz155240 #endif
1052393Syz155240 #if (__FreeBSD_version >= 300000)
1062393Syz155240 # include <sys/malloc.h>
1072393Syz155240 # if defined(_KERNEL) && !defined(IPFILTER_LKM)
1082393Syz155240 #  include <sys/libkern.h>
1092393Syz155240 #  include <sys/systm.h>
1102393Syz155240 # endif
1112393Syz155240 #endif
1122393Syz155240 /* END OF INCLUDES */
1132393Syz155240 
1142393Syz155240 
1152393Syz155240 #if !defined(lint)
1162393Syz155240 static const char sccsid[] = "@(#)ip_state.c	1.8 6/5/96 (C) 1993-2000 Darren Reed";
1172393Syz155240 static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.186.2.36 2005/08/11 19:58:03 darrenr Exp $";
1182393Syz155240 #endif
1192393Syz155240 
1202393Syz155240 #ifdef	USE_INET6
1212393Syz155240 static ipstate_t *fr_checkicmp6matchingstate __P((fr_info_t *));
1222393Syz155240 #endif
1232393Syz155240 static ipstate_t *fr_matchsrcdst __P((fr_info_t *, ipstate_t *, i6addr_t *,
1242393Syz155240 				      i6addr_t *, tcphdr_t *, u_32_t));
1252393Syz155240 static ipstate_t *fr_checkicmpmatchingstate __P((fr_info_t *));
1263448Sdh155122 static int fr_state_flush __P((int, int, ipf_stack_t *));
1273448Sdh155122 static ips_stat_t *fr_statetstats __P((ipf_stack_t *));
1283448Sdh155122 static void fr_delstate __P((ipstate_t *, int, ipf_stack_t *));
1293448Sdh155122 static int fr_state_remove __P((caddr_t, ipf_stack_t *));
1303448Sdh155122 static void fr_ipsmove __P((ipstate_t *, u_int, ipf_stack_t *));
1312393Syz155240 static int fr_tcpstate __P((fr_info_t *, tcphdr_t *, ipstate_t *));
1322393Syz155240 static int fr_tcpoptions __P((fr_info_t *, tcphdr_t *, tcpdata_t *));
1332393Syz155240 static ipstate_t *fr_stclone __P((fr_info_t *, tcphdr_t *, ipstate_t *));
1342393Syz155240 static void fr_fixinisn __P((fr_info_t *, ipstate_t *));
1352393Syz155240 static void fr_fixoutisn __P((fr_info_t *, ipstate_t *));
1362393Syz155240 static void fr_checknewisn __P((fr_info_t *, ipstate_t *));
1373448Sdh155122 static int fr_stateiter __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *));
1383448Sdh155122 
1393448Sdh155122 int fr_stputent __P((caddr_t, ipf_stack_t *));
1403448Sdh155122 int fr_stgetent __P((caddr_t, ipf_stack_t *));
1412393Syz155240 
1422393Syz155240 #define	ONE_DAY		IPF_TTLVAL(1 * 86400)	/* 1 day */
1432393Syz155240 #define	FIVE_DAYS	(5 * ONE_DAY)
1443448Sdh155122 #define	DOUBLE_HASH(x, ifs)	\
1453448Sdh155122     (((x) + ifs->ifs_ips_seed[(x) % ifs->ifs_fr_statesize]) % ifs->ifs_fr_statesize)
1463448Sdh155122 
1472393Syz155240 
1482393Syz155240 
1492393Syz155240 /* ------------------------------------------------------------------------ */
1502393Syz155240 /* Function:    fr_stateinit                                                */
1512393Syz155240 /* Returns:     int - 0 == success, -1 == failure                           */
1522393Syz155240 /* Parameters:  Nil                                                         */
1532393Syz155240 /*                                                                          */
1542393Syz155240 /* Initialise all the global variables used within the state code.          */
1552393Syz155240 /* This action also includes initiailising locks.                           */
1562393Syz155240 /* ------------------------------------------------------------------------ */
1573448Sdh155122 int fr_stateinit(ifs)
1583448Sdh155122 ipf_stack_t *ifs;
1592393Syz155240 {
1602393Syz155240 	int i;
1612393Syz155240 
1623448Sdh155122 	ifs->ifs_fr_tcpidletimeout = FIVE_DAYS;
1633448Sdh155122 	ifs->ifs_fr_tcpclosewait = IPF_TTLVAL(TCP_MSL);
1643448Sdh155122 	ifs->ifs_fr_tcplastack = IPF_TTLVAL(TCP_MSL);
1653448Sdh155122 	ifs->ifs_fr_tcptimeout = IPF_TTLVAL(TCP_MSL);
1663448Sdh155122 	ifs->ifs_fr_tcpclosed = IPF_TTLVAL(60);
1673448Sdh155122 	ifs->ifs_fr_tcphalfclosed = IPF_TTLVAL(2 * 3600);	/* 2 hours */
1683448Sdh155122 	ifs->ifs_fr_udptimeout = IPF_TTLVAL(120);
1693448Sdh155122 	ifs->ifs_fr_udpacktimeout = IPF_TTLVAL(12);
1703448Sdh155122 	ifs->ifs_fr_icmptimeout = IPF_TTLVAL(60);
1713448Sdh155122 	ifs->ifs_fr_icmpacktimeout = IPF_TTLVAL(6);
1723448Sdh155122 	ifs->ifs_fr_iptimeout = IPF_TTLVAL(60);
1733448Sdh155122 	ifs->ifs_fr_statemax = IPSTATE_MAX;
1743448Sdh155122 	ifs->ifs_fr_statesize = IPSTATE_SIZE;
1753448Sdh155122 	ifs->ifs_fr_state_maxbucket_reset = 1;
1763448Sdh155122 #ifdef	IPFILTER_LOG
1773448Sdh155122 	ifs->ifs_ipstate_logging = 1;
1783448Sdh155122 #else
1793448Sdh155122 	ifs->ifs_ipstate_logging = 0;
1803448Sdh155122 #endif
1813448Sdh155122 
1823448Sdh155122 	KMALLOCS(ifs->ifs_ips_table, ipstate_t **,
1833448Sdh155122 		 ifs->ifs_fr_statesize * sizeof(ipstate_t *));
1843448Sdh155122 	if (ifs->ifs_ips_table == NULL)
1852393Syz155240 		return -1;
1863448Sdh155122 	bzero((char *)ifs->ifs_ips_table,
1873448Sdh155122 	      ifs->ifs_fr_statesize * sizeof(ipstate_t *));
1883448Sdh155122 
1893448Sdh155122 	KMALLOCS(ifs->ifs_ips_seed, u_long *,
1903448Sdh155122 		 ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_seed));
1913448Sdh155122 	if (ifs->ifs_ips_seed == NULL)
1922393Syz155240 		return -2;
1933448Sdh155122 	for (i = 0; i < ifs->ifs_fr_statesize; i++) {
1942393Syz155240 		/*
1952393Syz155240 		 * XXX - ips_seed[X] should be a random number of sorts.
1962393Syz155240 		 */
1972393Syz155240 #if  (__FreeBSD_version >= 400000)
1983448Sdh155122 		ifs->ifs_ips_seed[i] = arc4random();
1992393Syz155240 #else
2003448Sdh155122 		ifs->ifs_ips_seed[i] = ((u_long)ifs->ifs_ips_seed + i) *
2013448Sdh155122 		    ifs->ifs_fr_statesize;
2023448Sdh155122 		ifs->ifs_ips_seed[i] ^= 0xa5a55a5a;
2033448Sdh155122 		ifs->ifs_ips_seed[i] *= (u_long)ifs->ifs_ips_seed;
2043448Sdh155122 		ifs->ifs_ips_seed[i] ^= 0x5a5aa5a5;
2053448Sdh155122 		ifs->ifs_ips_seed[i] *= ifs->ifs_fr_statemax;
2062393Syz155240 #endif
2072393Syz155240 	}
2082393Syz155240 
2092393Syz155240 	/* fill icmp reply type table */
2102393Syz155240 	for (i = 0; i <= ICMP_MAXTYPE; i++)
2112393Syz155240 		icmpreplytype4[i] = -1;
2122393Syz155240 	icmpreplytype4[ICMP_ECHO] = ICMP_ECHOREPLY;
2132393Syz155240 	icmpreplytype4[ICMP_TSTAMP] = ICMP_TSTAMPREPLY;
2142393Syz155240 	icmpreplytype4[ICMP_IREQ] = ICMP_IREQREPLY;
2152393Syz155240 	icmpreplytype4[ICMP_MASKREQ] = ICMP_MASKREPLY;
2162393Syz155240 #ifdef	USE_INET6
2172393Syz155240 	/* fill icmp reply type table */
2182393Syz155240 	for (i = 0; i <= ICMP6_MAXTYPE; i++)
2192393Syz155240 		icmpreplytype6[i] = -1;
2202393Syz155240 	icmpreplytype6[ICMP6_ECHO_REQUEST] = ICMP6_ECHO_REPLY;
2212393Syz155240 	icmpreplytype6[ICMP6_MEMBERSHIP_QUERY] = ICMP6_MEMBERSHIP_REPORT;
2222393Syz155240 	icmpreplytype6[ICMP6_NI_QUERY] = ICMP6_NI_REPLY;
2232393Syz155240 	icmpreplytype6[ND_ROUTER_SOLICIT] = ND_ROUTER_ADVERT;
2242393Syz155240 	icmpreplytype6[ND_NEIGHBOR_SOLICIT] = ND_NEIGHBOR_ADVERT;
2252393Syz155240 #endif
2262393Syz155240 
2273448Sdh155122 	KMALLOCS(ifs->ifs_ips_stats.iss_bucketlen, u_long *,
2283448Sdh155122 		 ifs->ifs_fr_statesize * sizeof(u_long));
2293448Sdh155122 	if (ifs->ifs_ips_stats.iss_bucketlen == NULL)
2302393Syz155240 		return -1;
2313448Sdh155122 	bzero((char *)ifs->ifs_ips_stats.iss_bucketlen,
2323448Sdh155122 	      ifs->ifs_fr_statesize * sizeof(u_long));
2333448Sdh155122 
2343448Sdh155122 	if (ifs->ifs_fr_state_maxbucket == 0) {
2353448Sdh155122 		for (i = ifs->ifs_fr_statesize; i > 0; i >>= 1)
2363448Sdh155122 			ifs->ifs_fr_state_maxbucket++;
2373448Sdh155122 		ifs->ifs_fr_state_maxbucket *= 2;
2382393Syz155240 	}
2392393Syz155240 
2403448Sdh155122 	fr_sttab_init(ifs->ifs_ips_tqtqb, ifs);
2413448Sdh155122 	ifs->ifs_ips_tqtqb[IPF_TCP_NSTATES - 1].ifq_next = &ifs->ifs_ips_udptq;
2423448Sdh155122 	ifs->ifs_ips_udptq.ifq_ttl = (u_long)ifs->ifs_fr_udptimeout;
2433448Sdh155122 	ifs->ifs_ips_udptq.ifq_ref = 1;
2443448Sdh155122 	ifs->ifs_ips_udptq.ifq_head = NULL;
2453448Sdh155122 	ifs->ifs_ips_udptq.ifq_tail = &ifs->ifs_ips_udptq.ifq_head;
2463448Sdh155122 	MUTEX_INIT(&ifs->ifs_ips_udptq.ifq_lock, "ipftq udp tab");
2473448Sdh155122 	ifs->ifs_ips_udptq.ifq_next = &ifs->ifs_ips_udpacktq;
2483448Sdh155122 	ifs->ifs_ips_udpacktq.ifq_ttl = (u_long)ifs->ifs_fr_udpacktimeout;
2493448Sdh155122 	ifs->ifs_ips_udpacktq.ifq_ref = 1;
2503448Sdh155122 	ifs->ifs_ips_udpacktq.ifq_head = NULL;
2513448Sdh155122 	ifs->ifs_ips_udpacktq.ifq_tail = &ifs->ifs_ips_udpacktq.ifq_head;
2523448Sdh155122 	MUTEX_INIT(&ifs->ifs_ips_udpacktq.ifq_lock, "ipftq udpack tab");
2533448Sdh155122 	ifs->ifs_ips_udpacktq.ifq_next = &ifs->ifs_ips_icmptq;
2543448Sdh155122 	ifs->ifs_ips_icmptq.ifq_ttl = (u_long)ifs->ifs_fr_icmptimeout;
2553448Sdh155122 	ifs->ifs_ips_icmptq.ifq_ref = 1;
2563448Sdh155122 	ifs->ifs_ips_icmptq.ifq_head = NULL;
2573448Sdh155122 	ifs->ifs_ips_icmptq.ifq_tail = &ifs->ifs_ips_icmptq.ifq_head;
2583448Sdh155122 	MUTEX_INIT(&ifs->ifs_ips_icmptq.ifq_lock, "ipftq icmp tab");
2593448Sdh155122 	ifs->ifs_ips_icmptq.ifq_next = &ifs->ifs_ips_icmpacktq;
2603448Sdh155122 	ifs->ifs_ips_icmpacktq.ifq_ttl = (u_long)ifs->ifs_fr_icmpacktimeout;
2613448Sdh155122 	ifs->ifs_ips_icmpacktq.ifq_ref = 1;
2623448Sdh155122 	ifs->ifs_ips_icmpacktq.ifq_head = NULL;
2633448Sdh155122 	ifs->ifs_ips_icmpacktq.ifq_tail = &ifs->ifs_ips_icmpacktq.ifq_head;
2643448Sdh155122 	MUTEX_INIT(&ifs->ifs_ips_icmpacktq.ifq_lock, "ipftq icmpack tab");
2653448Sdh155122 	ifs->ifs_ips_icmpacktq.ifq_next = &ifs->ifs_ips_iptq;
2663448Sdh155122 	ifs->ifs_ips_iptq.ifq_ttl = (u_long)ifs->ifs_fr_iptimeout;
2673448Sdh155122 	ifs->ifs_ips_iptq.ifq_ref = 1;
2683448Sdh155122 	ifs->ifs_ips_iptq.ifq_head = NULL;
2693448Sdh155122 	ifs->ifs_ips_iptq.ifq_tail = &ifs->ifs_ips_iptq.ifq_head;
2703448Sdh155122 	MUTEX_INIT(&ifs->ifs_ips_iptq.ifq_lock, "ipftq ip tab");
2713448Sdh155122 	ifs->ifs_ips_iptq.ifq_next = NULL;
2723448Sdh155122 
2733448Sdh155122 	RWLOCK_INIT(&ifs->ifs_ipf_state, "ipf IP state rwlock");
2743448Sdh155122 	MUTEX_INIT(&ifs->ifs_ipf_stinsert, "ipf state insert mutex");
2753448Sdh155122 	ifs->ifs_fr_state_init = 1;
2763448Sdh155122 
2773448Sdh155122 	ifs->ifs_ips_last_force_flush = ifs->ifs_fr_ticks;
2782393Syz155240 	return 0;
2792393Syz155240 }
2802393Syz155240 
2812393Syz155240 
2822393Syz155240 /* ------------------------------------------------------------------------ */
2832393Syz155240 /* Function:    fr_stateunload                                              */
2842393Syz155240 /* Returns:     Nil                                                         */
2852393Syz155240 /* Parameters:  Nil                                                         */
2862393Syz155240 /*                                                                          */
2872393Syz155240 /* Release and destroy any resources acquired or initialised so that        */
2882393Syz155240 /* IPFilter can be unloaded or re-initialised.                              */
2892393Syz155240 /* ------------------------------------------------------------------------ */
2903448Sdh155122 void fr_stateunload(ifs)
2913448Sdh155122 ipf_stack_t *ifs;
2922393Syz155240 {
2932393Syz155240 	ipftq_t *ifq, *ifqnext;
2942393Syz155240 	ipstate_t *is;
2952393Syz155240 
2963448Sdh155122 	while ((is = ifs->ifs_ips_list) != NULL)
2973448Sdh155122 	    fr_delstate(is, 0, ifs);
2982393Syz155240 
2992393Syz155240 	/*
3002393Syz155240 	 * Proxy timeout queues are not cleaned here because although they
3012393Syz155240 	 * exist on the state list, appr_unload is called after fr_stateunload
3022393Syz155240 	 * and the proxies actually are responsible for them being created.
3032393Syz155240 	 * Should the proxy timeouts have their own list?  There's no real
3042393Syz155240 	 * justification as this is the only complicationA
3052393Syz155240 	 */
3063448Sdh155122 	for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) {
3072393Syz155240 		ifqnext = ifq->ifq_next;
3082393Syz155240 		if (((ifq->ifq_flags & IFQF_PROXY) == 0) &&
3092393Syz155240 		    (fr_deletetimeoutqueue(ifq) == 0))
3103448Sdh155122 			fr_freetimeoutqueue(ifq, ifs);
3112393Syz155240 	}
3122393Syz155240 
3133448Sdh155122 	ifs->ifs_ips_stats.iss_inuse = 0;
3143448Sdh155122 	ifs->ifs_ips_num = 0;
3153448Sdh155122 
3163448Sdh155122 	if (ifs->ifs_fr_state_init == 1) {
3173448Sdh155122 		fr_sttab_destroy(ifs->ifs_ips_tqtqb);
3183448Sdh155122 		MUTEX_DESTROY(&ifs->ifs_ips_udptq.ifq_lock);
3193448Sdh155122 		MUTEX_DESTROY(&ifs->ifs_ips_icmptq.ifq_lock);
3203448Sdh155122 		MUTEX_DESTROY(&ifs->ifs_ips_udpacktq.ifq_lock);
3213448Sdh155122 		MUTEX_DESTROY(&ifs->ifs_ips_icmpacktq.ifq_lock);
3223448Sdh155122 		MUTEX_DESTROY(&ifs->ifs_ips_iptq.ifq_lock);
3232393Syz155240 	}
3242393Syz155240 
3253448Sdh155122 	if (ifs->ifs_ips_table != NULL) {
3263448Sdh155122 		KFREES(ifs->ifs_ips_table,
3273448Sdh155122 		       ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_table));
3283448Sdh155122 		ifs->ifs_ips_table = NULL;
3292393Syz155240 	}
3302393Syz155240 
3313448Sdh155122 	if (ifs->ifs_ips_seed != NULL) {
3323448Sdh155122 		KFREES(ifs->ifs_ips_seed,
3333448Sdh155122 		       ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_seed));
3343448Sdh155122 		ifs->ifs_ips_seed = NULL;
3352393Syz155240 	}
3362393Syz155240 
3373448Sdh155122 	if (ifs->ifs_ips_stats.iss_bucketlen != NULL) {
3383448Sdh155122 		KFREES(ifs->ifs_ips_stats.iss_bucketlen,
3393448Sdh155122 		       ifs->ifs_fr_statesize * sizeof(u_long));
3403448Sdh155122 		ifs->ifs_ips_stats.iss_bucketlen = NULL;
3413448Sdh155122 	}
3423448Sdh155122 
3433448Sdh155122 	if (ifs->ifs_fr_state_maxbucket_reset == 1)
3443448Sdh155122 		ifs->ifs_fr_state_maxbucket = 0;
3453448Sdh155122 
3463448Sdh155122 	if (ifs->ifs_fr_state_init == 1) {
3473448Sdh155122 		ifs->ifs_fr_state_init = 0;
3483448Sdh155122 		RW_DESTROY(&ifs->ifs_ipf_state);
3493448Sdh155122 		MUTEX_DESTROY(&ifs->ifs_ipf_stinsert);
3502393Syz155240 	}
3512393Syz155240 }
3522393Syz155240 
3532393Syz155240 
3542393Syz155240 /* ------------------------------------------------------------------------ */
3552393Syz155240 /* Function:    fr_statetstats                                              */
3562393Syz155240 /* Returns:     ips_state_t* - pointer to state stats structure             */
3572393Syz155240 /* Parameters:  Nil                                                         */
3582393Syz155240 /*                                                                          */
3592393Syz155240 /* Put all the current numbers and pointers into a single struct and return */
3602393Syz155240 /* a pointer to it.                                                         */
3612393Syz155240 /* ------------------------------------------------------------------------ */
3623448Sdh155122 static ips_stat_t *fr_statetstats(ifs)
3633448Sdh155122 ipf_stack_t *ifs;
3642393Syz155240 {
3653448Sdh155122 	ifs->ifs_ips_stats.iss_active = ifs->ifs_ips_num;
3663448Sdh155122 	ifs->ifs_ips_stats.iss_statesize = ifs->ifs_fr_statesize;
3673448Sdh155122 	ifs->ifs_ips_stats.iss_statemax = ifs->ifs_fr_statemax;
3683448Sdh155122 	ifs->ifs_ips_stats.iss_table = ifs->ifs_ips_table;
3693448Sdh155122 	ifs->ifs_ips_stats.iss_list = ifs->ifs_ips_list;
3703448Sdh155122 	ifs->ifs_ips_stats.iss_ticks = ifs->ifs_fr_ticks;
3713448Sdh155122 	return &ifs->ifs_ips_stats;
3722393Syz155240 }
3732393Syz155240 
3742393Syz155240 /* ------------------------------------------------------------------------ */
3752393Syz155240 /* Function:    fr_state_remove                                             */
3762393Syz155240 /* Returns:     int - 0 == success, != 0 == failure                         */
3772393Syz155240 /* Parameters:  data(I) - pointer to state structure to delete from table   */
3782393Syz155240 /*                                                                          */
3792393Syz155240 /* Search for a state structure that matches the one passed, according to   */
3802393Syz155240 /* the IP addresses and other protocol specific information.                */
3812393Syz155240 /* ------------------------------------------------------------------------ */
3823448Sdh155122 static int fr_state_remove(data, ifs)
3832393Syz155240 caddr_t data;
3843448Sdh155122 ipf_stack_t *ifs;
3852393Syz155240 {
3862393Syz155240 	ipstate_t *sp, st;
3872393Syz155240 	int error;
3882393Syz155240 
3892393Syz155240 	sp = &st;
3902393Syz155240 	error = fr_inobj(data, &st, IPFOBJ_IPSTATE);
3912393Syz155240 	if (error)
3922393Syz155240 		return EFAULT;
3932393Syz155240 
3943448Sdh155122 	WRITE_ENTER(&ifs->ifs_ipf_state);
3953448Sdh155122 	for (sp = ifs->ifs_ips_list; sp; sp = sp->is_next)
3962393Syz155240 		if ((sp->is_p == st.is_p) && (sp->is_v == st.is_v) &&
3972393Syz155240 		    !bcmp((caddr_t)&sp->is_src, (caddr_t)&st.is_src,
3982393Syz155240 			  sizeof(st.is_src)) &&
3992393Syz155240 		    !bcmp((caddr_t)&sp->is_dst, (caddr_t)&st.is_src,
4002393Syz155240 			  sizeof(st.is_dst)) &&
4012393Syz155240 		    !bcmp((caddr_t)&sp->is_ps, (caddr_t)&st.is_ps,
4022393Syz155240 			  sizeof(st.is_ps))) {
4033448Sdh155122 			fr_delstate(sp, ISL_REMOVE, ifs);
4043448Sdh155122 			RWLOCK_EXIT(&ifs->ifs_ipf_state);
4052393Syz155240 			return 0;
4062393Syz155240 		}
4073448Sdh155122 	RWLOCK_EXIT(&ifs->ifs_ipf_state);
4082393Syz155240 	return ESRCH;
4092393Syz155240 }
4102393Syz155240 
4112393Syz155240 
4122393Syz155240 /* ------------------------------------------------------------------------ */
4132393Syz155240 /* Function:    fr_state_ioctl                                              */
4142393Syz155240 /* Returns:     int - 0 == success, != 0 == failure                         */
4152393Syz155240 /* Parameters:  data(I) - pointer to ioctl data                             */
4162393Syz155240 /*              cmd(I)  - ioctl command integer                             */
4172393Syz155240 /*              mode(I) - file mode bits used with open                     */
4182393Syz155240 /*                                                                          */
4192393Syz155240 /* Processes an ioctl call made to operate on the IP Filter state device.   */
4202393Syz155240 /* ------------------------------------------------------------------------ */
4213448Sdh155122 int fr_state_ioctl(data, cmd, mode, uid, ctx, ifs)
4222393Syz155240 caddr_t data;
4232393Syz155240 ioctlcmd_t cmd;
4243448Sdh155122 int mode, uid;
4253448Sdh155122 void *ctx;
4263448Sdh155122 ipf_stack_t *ifs;
4272393Syz155240 {
4282393Syz155240 	int arg, ret, error = 0;
4292393Syz155240 
4302393Syz155240 	switch (cmd)
4312393Syz155240 	{
4322393Syz155240 	/*
4332393Syz155240 	 * Delete an entry from the state table.
4342393Syz155240 	 */
4352393Syz155240 	case SIOCDELST :
4363448Sdh155122 	    error = fr_state_remove(data, ifs);
4372393Syz155240 		break;
4382393Syz155240 	/*
4392393Syz155240 	 * Flush the state table
4402393Syz155240 	 */
4412393Syz155240 	case SIOCIPFFL :
4422393Syz155240 		BCOPYIN(data, (char *)&arg, sizeof(arg));
4432393Syz155240 		if (arg == 0 || arg == 1) {
4443448Sdh155122 			WRITE_ENTER(&ifs->ifs_ipf_state);
4453448Sdh155122 			ret = fr_state_flush(arg, 4, ifs);
4463448Sdh155122 			RWLOCK_EXIT(&ifs->ifs_ipf_state);
4472393Syz155240 			BCOPYOUT((char *)&ret, data, sizeof(ret));
4482393Syz155240 		} else
4492393Syz155240 			error = EINVAL;
4502393Syz155240 		break;
4512393Syz155240 #ifdef	USE_INET6
4522393Syz155240 	case SIOCIPFL6 :
4532393Syz155240 		BCOPYIN(data, (char *)&arg, sizeof(arg));
4542393Syz155240 		if (arg == 0 || arg == 1) {
4553448Sdh155122 			WRITE_ENTER(&ifs->ifs_ipf_state);
4563448Sdh155122 			ret = fr_state_flush(arg, 6, ifs);
4573448Sdh155122 			RWLOCK_EXIT(&ifs->ifs_ipf_state);
4582393Syz155240 			BCOPYOUT((char *)&ret, data, sizeof(ret));
4592393Syz155240 		} else
4602393Syz155240 			error = EINVAL;
4612393Syz155240 		break;
4622393Syz155240 #endif
4632393Syz155240 #ifdef	IPFILTER_LOG
4642393Syz155240 	/*
4652393Syz155240 	 * Flush the state log.
4662393Syz155240 	 */
4672393Syz155240 	case SIOCIPFFB :
4682393Syz155240 		if (!(mode & FWRITE))
4692393Syz155240 			error = EPERM;
4702393Syz155240 		else {
4712393Syz155240 			int tmp;
4722393Syz155240 
4733448Sdh155122 			tmp = ipflog_clear(IPL_LOGSTATE, ifs);
4742393Syz155240 			BCOPYOUT((char *)&tmp, data, sizeof(tmp));
4752393Syz155240 		}
4762393Syz155240 		break;
4772393Syz155240 	/*
4782393Syz155240 	 * Turn logging of state information on/off.
4792393Syz155240 	 */
4802393Syz155240 	case SIOCSETLG :
4812393Syz155240 		if (!(mode & FWRITE))
4822393Syz155240 			error = EPERM;
4832393Syz155240 		else {
4843448Sdh155122 			BCOPYIN((char *)data,
4853448Sdh155122 				       (char *)&ifs->ifs_ipstate_logging,
4863448Sdh155122 				       sizeof(ifs->ifs_ipstate_logging));
4872393Syz155240 		}
4882393Syz155240 		break;
4892393Syz155240 	/*
4902393Syz155240 	 * Return the current state of logging.
4912393Syz155240 	 */
4922393Syz155240 	case SIOCGETLG :
4933448Sdh155122 		BCOPYOUT((char *)&ifs->ifs_ipstate_logging, (char *)data,
4943448Sdh155122 			sizeof(ifs->ifs_ipstate_logging));
4952393Syz155240 		break;
4962393Syz155240 	/*
4972393Syz155240 	 * Return the number of bytes currently waiting to be read.
4982393Syz155240 	 */
4992393Syz155240 	case FIONREAD :
5003448Sdh155122 		arg = ifs->ifs_iplused[IPL_LOGSTATE]; /* returned in an int */
5012393Syz155240 		BCOPYOUT((char *)&arg, data, sizeof(arg));
5022393Syz155240 		break;
5032393Syz155240 #endif
5042393Syz155240 	/*
5052393Syz155240 	 * Get the current state statistics.
5062393Syz155240 	 */
5072393Syz155240 	case SIOCGETFS :
5083448Sdh155122 		error = fr_outobj(data, fr_statetstats(ifs), IPFOBJ_STATESTAT);
5092393Syz155240 		break;
5102393Syz155240 	/*
5112393Syz155240 	 * Lock/Unlock the state table.  (Locking prevents any changes, which
5122393Syz155240 	 * means no packets match).
5132393Syz155240 	 */
5142393Syz155240 	case SIOCSTLCK :
5152393Syz155240 		if (!(mode & FWRITE)) {
5162393Syz155240 			error = EPERM;
5172393Syz155240 		} else {
5183448Sdh155122 			fr_lock(data, &ifs->ifs_fr_state_lock);
5192393Syz155240 		}
5202393Syz155240 		break;
5212393Syz155240 	/*
5222393Syz155240 	 * Add an entry to the current state table.
5232393Syz155240 	 */
5242393Syz155240 	case SIOCSTPUT :
5253448Sdh155122 		if (!ifs->ifs_fr_state_lock || !(mode &FWRITE)) {
5262393Syz155240 			error = EACCES;
5272393Syz155240 			break;
5282393Syz155240 		}
5293448Sdh155122 		error = fr_stputent(data, ifs);
5302393Syz155240 		break;
5312393Syz155240 	/*
5322393Syz155240 	 * Get a state table entry.
5332393Syz155240 	 */
5342393Syz155240 	case SIOCSTGET :
5353448Sdh155122 		if (!ifs->ifs_fr_state_lock) {
5362393Syz155240 			error = EACCES;
5372393Syz155240 			break;
5382393Syz155240 		}
5393448Sdh155122 		error = fr_stgetent(data, ifs);
5402393Syz155240 		break;
5413448Sdh155122 
5423448Sdh155122 	case SIOCGENITER :
5433448Sdh155122 	    {
5443448Sdh155122 		ipftoken_t *token;
5453448Sdh155122 		ipfgeniter_t iter;
5463448Sdh155122 
5473448Sdh155122 		error = fr_inobj(data, &iter, IPFOBJ_GENITER);
5483448Sdh155122 		if (error != 0)
5493448Sdh155122 			break;
5503448Sdh155122 
5513448Sdh155122 		token = ipf_findtoken(IPFGENITER_STATE, uid, ctx, ifs);
5523448Sdh155122 		if (token != NULL)
5533448Sdh155122 			error = fr_stateiter(token, &iter, ifs);
5543448Sdh155122 		else
5553448Sdh155122 			error = ESRCH;
5563448Sdh155122 		RWLOCK_EXIT(&ifs->ifs_ipf_tokens);
5573448Sdh155122 		break;
5583448Sdh155122 	    }
5593448Sdh155122 
5603448Sdh155122 	case SIOCIPFDELTOK :
5613448Sdh155122 		(void) BCOPYIN(data, (char *)&arg, sizeof(arg));
5623448Sdh155122 		error = ipf_deltoken(arg, uid, ctx, ifs);
5633448Sdh155122 		break;
5643448Sdh155122 
5652393Syz155240 	default :
5662393Syz155240 		error = EINVAL;
5672393Syz155240 		break;
5682393Syz155240 	}
5692393Syz155240 	return error;
5702393Syz155240 }
5712393Syz155240 
5722393Syz155240 
5732393Syz155240 /* ------------------------------------------------------------------------ */
5742393Syz155240 /* Function:    fr_stgetent                                                 */
5752393Syz155240 /* Returns:     int - 0 == success, != 0 == failure                         */
5762393Syz155240 /* Parameters:  data(I) - pointer to state structure to retrieve from table */
5772393Syz155240 /*                                                                          */
5782393Syz155240 /* Copy out state information from the kernel to a user space process.  If  */
5792393Syz155240 /* there is a filter rule associated with the state entry, copy that out    */
5802393Syz155240 /* as well.  The entry to copy out is taken from the value of "ips_next" in */
5812393Syz155240 /* the struct passed in and if not null and not found in the list of current*/
5822393Syz155240 /* state entries, the retrieval fails.                                      */
5832393Syz155240 /* ------------------------------------------------------------------------ */
5843448Sdh155122 int fr_stgetent(data, ifs)
5852393Syz155240 caddr_t data;
5863448Sdh155122 ipf_stack_t *ifs;
5872393Syz155240 {
5882393Syz155240 	ipstate_t *is, *isn;
5892393Syz155240 	ipstate_save_t ips;
5902393Syz155240 	int error;
5912393Syz155240 
5922393Syz155240 	error = fr_inobj(data, &ips, IPFOBJ_STATESAVE);
5932393Syz155240 	if (error)
5942393Syz155240 		return EFAULT;
5952393Syz155240 
5962393Syz155240 	isn = ips.ips_next;
5972393Syz155240 	if (isn == NULL) {
5983448Sdh155122 		isn = ifs->ifs_ips_list;
5992393Syz155240 		if (isn == NULL) {
6002393Syz155240 			if (ips.ips_next == NULL)
6012393Syz155240 				return ENOENT;
6022393Syz155240 			return 0;
6032393Syz155240 		}
6042393Syz155240 	} else {
6052393Syz155240 		/*
6062393Syz155240 		 * Make sure the pointer we're copying from exists in the
6072393Syz155240 		 * current list of entries.  Security precaution to prevent
6082393Syz155240 		 * copying of random kernel data.
6092393Syz155240 		 */
6103448Sdh155122 		for (is = ifs->ifs_ips_list; is; is = is->is_next)
6112393Syz155240 			if (is == isn)
6122393Syz155240 				break;
6132393Syz155240 		if (!is)
6142393Syz155240 			return ESRCH;
6152393Syz155240 	}
6162393Syz155240 	ips.ips_next = isn->is_next;
6172393Syz155240 	bcopy((char *)isn, (char *)&ips.ips_is, sizeof(ips.ips_is));
6182393Syz155240 	ips.ips_rule = isn->is_rule;
6192393Syz155240 	if (isn->is_rule != NULL)
6202393Syz155240 		bcopy((char *)isn->is_rule, (char *)&ips.ips_fr,
6212393Syz155240 		      sizeof(ips.ips_fr));
6222393Syz155240 	error = fr_outobj(data, &ips, IPFOBJ_STATESAVE);
6232393Syz155240 	if (error)
6242393Syz155240 		return EFAULT;
6252393Syz155240 	return 0;
6262393Syz155240 }
6272393Syz155240 
6282393Syz155240 
6292393Syz155240 /* ------------------------------------------------------------------------ */
6302393Syz155240 /* Function:    fr_stputent                                                 */
6312393Syz155240 /* Returns:     int - 0 == success, != 0 == failure                         */
6322393Syz155240 /* Parameters:  data(I) - pointer to state information struct               */
6332393Syz155240 /*                                                                          */
6342393Syz155240 /* This function implements the SIOCSTPUT ioctl: insert a state entry into  */
6352393Syz155240 /* the state table.  If the state info. includes a pointer to a filter rule */
6362393Syz155240 /* then also add in an orphaned rule (will not show up in any "ipfstat -io" */
6372393Syz155240 /* output.                                                                  */
6382393Syz155240 /* ------------------------------------------------------------------------ */
6393448Sdh155122 int fr_stputent(data, ifs)
6402393Syz155240 caddr_t data;
6413448Sdh155122 ipf_stack_t *ifs;
6422393Syz155240 {
6432393Syz155240 	ipstate_t *is, *isn;
6442393Syz155240 	ipstate_save_t ips;
6452393Syz155240 	int error, i;
6462393Syz155240 	frentry_t *fr;
6472393Syz155240 	char *name;
6482393Syz155240 
6492393Syz155240 	error = fr_inobj(data, &ips, IPFOBJ_STATESAVE);
6502393Syz155240 	if (error)
6512393Syz155240 		return EFAULT;
6522393Syz155240 
6532393Syz155240 	KMALLOC(isn, ipstate_t *);
6542393Syz155240 	if (isn == NULL)
6552393Syz155240 		return ENOMEM;
6562393Syz155240 
6572393Syz155240 	bcopy((char *)&ips.ips_is, (char *)isn, sizeof(*isn));
6582393Syz155240 	bzero((char *)isn, offsetof(struct ipstate, is_pkts));
6592393Syz155240 	isn->is_sti.tqe_pnext = NULL;
6602393Syz155240 	isn->is_sti.tqe_next = NULL;
6612393Syz155240 	isn->is_sti.tqe_ifq = NULL;
6622393Syz155240 	isn->is_sti.tqe_parent = isn;
6632393Syz155240 	isn->is_ifp[0] = NULL;
6642393Syz155240 	isn->is_ifp[1] = NULL;
6652393Syz155240 	isn->is_ifp[2] = NULL;
6662393Syz155240 	isn->is_ifp[3] = NULL;
6672393Syz155240 	isn->is_sync = NULL;
6682393Syz155240 	fr = ips.ips_rule;
6692393Syz155240 
6702393Syz155240 	if (fr == NULL) {
6713448Sdh155122 		READ_ENTER(&ifs->ifs_ipf_state);
6723448Sdh155122 		fr_stinsert(isn, 0, ifs);
6732393Syz155240 		MUTEX_EXIT(&isn->is_lock);
6743448Sdh155122 		RWLOCK_EXIT(&ifs->ifs_ipf_state);
6752393Syz155240 		return 0;
6762393Syz155240 	}
6772393Syz155240 
6782393Syz155240 	if (isn->is_flags & SI_NEWFR) {
6792393Syz155240 		KMALLOC(fr, frentry_t *);
6802393Syz155240 		if (fr == NULL) {
6812393Syz155240 			KFREE(isn);
6822393Syz155240 			return ENOMEM;
6832393Syz155240 		}
6842393Syz155240 		bcopy((char *)&ips.ips_fr, (char *)fr, sizeof(*fr));
6852393Syz155240 		isn->is_rule = fr;
6862393Syz155240 		ips.ips_is.is_rule = fr;
6872393Syz155240 		MUTEX_NUKE(&fr->fr_lock);
6882393Syz155240 		MUTEX_INIT(&fr->fr_lock, "state filter rule lock");
6892393Syz155240 
6902393Syz155240 		/*
6912393Syz155240 		 * Look up all the interface names in the rule.
6922393Syz155240 		 */
6932393Syz155240 		for (i = 0; i < 4; i++) {
6942393Syz155240 			name = fr->fr_ifnames[i];
6953448Sdh155122 			fr->fr_ifas[i] = fr_resolvenic(name, fr->fr_v, ifs);
6962393Syz155240 			name = isn->is_ifname[i];
6973448Sdh155122 			isn->is_ifp[i] = fr_resolvenic(name, isn->is_v, ifs);
6982393Syz155240 		}
6992393Syz155240 
7002393Syz155240 		fr->fr_ref = 0;
7012393Syz155240 		fr->fr_dsize = 0;
7022393Syz155240 		fr->fr_data = NULL;
7032393Syz155240 
7043448Sdh155122 		fr_resolvedest(&fr->fr_tif, fr->fr_v, ifs);
7053448Sdh155122 		fr_resolvedest(&fr->fr_dif, fr->fr_v, ifs);
7062393Syz155240 
7072393Syz155240 		/*
7082393Syz155240 		 * send a copy back to userland of what we ended up
7092393Syz155240 		 * to allow for verification.
7102393Syz155240 		 */
7112393Syz155240 		error = fr_outobj(data, &ips, IPFOBJ_STATESAVE);
7122393Syz155240 		if (error) {
7132393Syz155240 			KFREE(isn);
7142393Syz155240 			MUTEX_DESTROY(&fr->fr_lock);
7152393Syz155240 			KFREE(fr);
7162393Syz155240 			return EFAULT;
7172393Syz155240 		}
7183448Sdh155122 		READ_ENTER(&ifs->ifs_ipf_state);
7193448Sdh155122 		fr_stinsert(isn, 0, ifs);
7202393Syz155240 		MUTEX_EXIT(&isn->is_lock);
7213448Sdh155122 		RWLOCK_EXIT(&ifs->ifs_ipf_state);
7222393Syz155240 
7232393Syz155240 	} else {
7243448Sdh155122 		READ_ENTER(&ifs->ifs_ipf_state);
7253448Sdh155122 		for (is = ifs->ifs_ips_list; is; is = is->is_next)
7262393Syz155240 			if (is->is_rule == fr) {
7273448Sdh155122 				fr_stinsert(isn, 0, ifs);
7282393Syz155240 				MUTEX_EXIT(&isn->is_lock);
7292393Syz155240 				break;
7302393Syz155240 			}
7312393Syz155240 
7322393Syz155240 		if (is == NULL) {
7332393Syz155240 			KFREE(isn);
7342393Syz155240 			isn = NULL;
7352393Syz155240 		}
7363448Sdh155122 		RWLOCK_EXIT(&ifs->ifs_ipf_state);
7372393Syz155240 
7382393Syz155240 		return (isn == NULL) ? ESRCH : 0;
7392393Syz155240 	}
7402393Syz155240 
7412393Syz155240 	return 0;
7422393Syz155240 }
7432393Syz155240 
7442393Syz155240 
7452393Syz155240 /* ------------------------------------------------------------------------ */
7462393Syz155240 /* Function:   fr_stinsert                                                  */
7472393Syz155240 /* Returns:    Nil                                                          */
7482393Syz155240 /* Parameters: is(I)  - pointer to state structure                          */
7492393Syz155240 /*             rev(I) - flag indicating forward/reverse direction of packet */
7502393Syz155240 /*                                                                          */
7512393Syz155240 /* Inserts a state structure into the hash table (for lookups) and the list */
7522393Syz155240 /* of state entries (for enumeration).  Resolves all of the interface names */
7532393Syz155240 /* to pointers and adjusts running stats for the hash table as appropriate. */
7542393Syz155240 /*                                                                          */
7552393Syz155240 /* Locking: it is assumed that some kind of lock on ipf_state is held.      */
7562393Syz155240 /*          Exits with is_lock initialised and held.                        */
7572393Syz155240 /* ------------------------------------------------------------------------ */
7583448Sdh155122 void fr_stinsert(is, rev, ifs)
7592393Syz155240 ipstate_t *is;
7602393Syz155240 int rev;
7613448Sdh155122 ipf_stack_t *ifs;
7622393Syz155240 {
7632393Syz155240 	frentry_t *fr;
7642393Syz155240 	u_int hv;
7652393Syz155240 	int i;
7662393Syz155240 
7672393Syz155240 	MUTEX_INIT(&is->is_lock, "ipf state entry");
7682393Syz155240 
7692393Syz155240 	fr = is->is_rule;
7702393Syz155240 	if (fr != NULL) {
7712393Syz155240 		MUTEX_ENTER(&fr->fr_lock);
7722393Syz155240 		fr->fr_ref++;
7732393Syz155240 		fr->fr_statecnt++;
7742393Syz155240 		MUTEX_EXIT(&fr->fr_lock);
7752393Syz155240 	}
7762393Syz155240 
7772393Syz155240 	/*
7782393Syz155240 	 * Look up all the interface names in the state entry.
7792393Syz155240 	 */
7802393Syz155240 	for (i = 0; i < 4; i++) {
7812393Syz155240 		if (is->is_ifp[i] != NULL)
7822393Syz155240 			continue;
7833448Sdh155122 		is->is_ifp[i] = fr_resolvenic(is->is_ifname[i], is->is_v, ifs);
7842393Syz155240 	}
7852393Syz155240 
7862393Syz155240 	/*
7872393Syz155240 	 * If we could trust is_hv, then the modulous would not be needed, but
7882393Syz155240 	 * when running with IPFILTER_SYNC, this stops bad values.
7892393Syz155240 	 */
7903448Sdh155122 	hv = is->is_hv % ifs->ifs_fr_statesize;
7912393Syz155240 	is->is_hv = hv;
7922393Syz155240 
7932393Syz155240 	/*
7942393Syz155240 	 * We need to get both of these locks...the first because it is
7952393Syz155240 	 * possible that once the insert is complete another packet might
7962393Syz155240 	 * come along, match the entry and want to update it.
7972393Syz155240 	 */
7982393Syz155240 	MUTEX_ENTER(&is->is_lock);
7993448Sdh155122 	MUTEX_ENTER(&ifs->ifs_ipf_stinsert);
8002393Syz155240 
8012393Syz155240 	/*
8022393Syz155240 	 * add into list table.
8032393Syz155240 	 */
8043448Sdh155122 	if (ifs->ifs_ips_list != NULL)
8053448Sdh155122 		ifs->ifs_ips_list->is_pnext = &is->is_next;
8063448Sdh155122 	is->is_pnext = &ifs->ifs_ips_list;
8073448Sdh155122 	is->is_next = ifs->ifs_ips_list;
8083448Sdh155122 	ifs->ifs_ips_list = is;
8093448Sdh155122 
8103448Sdh155122 	if (ifs->ifs_ips_table[hv] != NULL)
8113448Sdh155122 		ifs->ifs_ips_table[hv]->is_phnext = &is->is_hnext;
8122393Syz155240 	else
8133448Sdh155122 		ifs->ifs_ips_stats.iss_inuse++;
8143448Sdh155122 	is->is_phnext = ifs->ifs_ips_table + hv;
8153448Sdh155122 	is->is_hnext = ifs->ifs_ips_table[hv];
8163448Sdh155122 	ifs->ifs_ips_table[hv] = is;
8173448Sdh155122 	ifs->ifs_ips_stats.iss_bucketlen[hv]++;
8183448Sdh155122 	ifs->ifs_ips_num++;
8193448Sdh155122 	MUTEX_EXIT(&ifs->ifs_ipf_stinsert);
8203448Sdh155122 
8213448Sdh155122 	fr_setstatequeue(is, rev, ifs);
8222393Syz155240 }
8232393Syz155240 
8242393Syz155240 
8252393Syz155240 /* ------------------------------------------------------------------------ */
8262393Syz155240 /* Function:    fr_addstate                                                 */
8272393Syz155240 /* Returns:     ipstate_t* - NULL == failure, else pointer to new state     */
8282393Syz155240 /* Parameters:  fin(I)    - pointer to packet information                   */
8292393Syz155240 /*              stsave(O) - pointer to place to save pointer to created     */
8302393Syz155240 /*                          state structure.                                */
8312393Syz155240 /*              flags(I)  - flags to use when creating the structure        */
8322393Syz155240 /*                                                                          */
8332393Syz155240 /* Creates a new IP state structure from the packet information collected.  */
8342393Syz155240 /* Inserts it into the state table and appends to the bottom of the active  */
8352393Syz155240 /* list.  If the capacity of the table has reached the maximum allowed then */
8362393Syz155240 /* the call will fail and a flush is scheduled for the next timeout call.   */
8372393Syz155240 /* ------------------------------------------------------------------------ */
8382393Syz155240 ipstate_t *fr_addstate(fin, stsave, flags)
8392393Syz155240 fr_info_t *fin;
8402393Syz155240 ipstate_t **stsave;
8412393Syz155240 u_int flags;
8422393Syz155240 {
8432393Syz155240 	ipstate_t *is, ips;
8442393Syz155240 	struct icmp *ic;
8452393Syz155240 	u_int pass, hv;
8462393Syz155240 	frentry_t *fr;
8472393Syz155240 	tcphdr_t *tcp;
8482393Syz155240 	grehdr_t *gre;
8492393Syz155240 	void *ifp;
8502393Syz155240 	int out;
8513448Sdh155122 	ipf_stack_t *ifs = fin->fin_ifs;
8523448Sdh155122 
8533448Sdh155122 	if (ifs->ifs_fr_state_lock ||
8542393Syz155240 	    (fin->fin_flx & (FI_SHORT|FI_STATE|FI_FRAGBODY|FI_BAD)))
8552393Syz155240 		return NULL;
8562393Syz155240 
8572393Syz155240 	if ((fin->fin_flx & FI_OOW) && !(fin->fin_tcpf & TH_SYN))
8582393Syz155240 		return NULL;
8592393Syz155240 
8602393Syz155240 	/*
8612393Syz155240 	 * If a "keep state" rule has reached the maximum number of references
8622393Syz155240 	 * to it, then schedule an automatic flush in case we can clear out
8632944Sjojemann 	 * some "dead old wood".  Note that because the lock isn't held on
8642944Sjojemann 	 * fr it is possible that we could overflow.  The cost of overflowing
8652944Sjojemann 	 * is being ignored here as the number by which it can overflow is
8662944Sjojemann 	 * a product of the number of simultaneous threads that could be
8672944Sjojemann 	 * executing in here, so a limit of 100 won't result in 200, but could
8682944Sjojemann 	 * result in 101 or 102.
8692393Syz155240 	 */
8702944Sjojemann 	fr = fin->fin_fr;
8712944Sjojemann 	if (fr != NULL) {
8723448Sdh155122 		if ((ifs->ifs_ips_num == ifs->ifs_fr_statemax) && (fr->fr_statemax == 0)) {
8733448Sdh155122 			ATOMIC_INCL(ifs->ifs_ips_stats.iss_max);
8743448Sdh155122 			ifs->ifs_fr_state_doflush = 1;
8752944Sjojemann 			return NULL;
8762944Sjojemann 		}
8772944Sjojemann 		if ((fr->fr_statemax != 0) &&
8782944Sjojemann 		    (fr->fr_statecnt >= fr->fr_statemax)) {
8793448Sdh155122 			ATOMIC_INCL(ifs->ifs_ips_stats.iss_maxref);
8803448Sdh155122 			ifs->ifs_fr_state_doflush = 1;
8812944Sjojemann 			return NULL;
8822944Sjojemann 		}
8832393Syz155240 	}
8842393Syz155240 
8852393Syz155240 	pass = (fr == NULL) ? 0 : fr->fr_flags;
8862393Syz155240 
8872393Syz155240 	ic = NULL;
8882393Syz155240 	tcp = NULL;
8892393Syz155240 	out = fin->fin_out;
8902393Syz155240 	is = &ips;
8912393Syz155240 	bzero((char *)is, sizeof(*is));
8923448Sdh155122 	is->is_die = 1 + ifs->ifs_fr_ticks;
8932393Syz155240 
8942393Syz155240 	/*
8952393Syz155240 	 * Copy and calculate...
8962393Syz155240 	 */
8972393Syz155240 	hv = (is->is_p = fin->fin_fi.fi_p);
8982393Syz155240 	is->is_src = fin->fin_fi.fi_src;
8992393Syz155240 	hv += is->is_saddr;
9002393Syz155240 	is->is_dst = fin->fin_fi.fi_dst;
9012393Syz155240 	hv += is->is_daddr;
9022393Syz155240 #ifdef	USE_INET6
9032393Syz155240 	if (fin->fin_v == 6) {
9042393Syz155240 		/*
9052393Syz155240 		 * For ICMPv6, we check to see if the destination address is
9062393Syz155240 		 * a multicast address.  If it is, do not include it in the
9072393Syz155240 		 * calculation of the hash because the correct reply will come
9082393Syz155240 		 * back from a real address, not a multicast address.
9092393Syz155240 		 */
9102393Syz155240 		if ((is->is_p == IPPROTO_ICMPV6) &&
9112393Syz155240 		    IN6_IS_ADDR_MULTICAST(&is->is_dst.in6)) {
9122393Syz155240 			/*
9132393Syz155240 			 * So you can do keep state with neighbour discovery.
9142393Syz155240 			 *
9152393Syz155240 			 * Here we could use the address from the neighbour
9162393Syz155240 			 * solicit message to put in the state structure and
9172393Syz155240 			 * we could use that without a wildcard flag too...
9182393Syz155240 			 */
9192393Syz155240 			is->is_flags |= SI_W_DADDR;
9202393Syz155240 			hv -= is->is_daddr;
9212393Syz155240 		} else {
9222393Syz155240 			hv += is->is_dst.i6[1];
9232393Syz155240 			hv += is->is_dst.i6[2];
9242393Syz155240 			hv += is->is_dst.i6[3];
9252393Syz155240 		}
9262393Syz155240 		hv += is->is_src.i6[1];
9272393Syz155240 		hv += is->is_src.i6[2];
9282393Syz155240 		hv += is->is_src.i6[3];
9292393Syz155240 	}
9302393Syz155240 #endif
9312393Syz155240 
9322393Syz155240 	switch (is->is_p)
9332393Syz155240 	{
9342393Syz155240 #ifdef	USE_INET6
9352393Syz155240 	case IPPROTO_ICMPV6 :
9362393Syz155240 		ic = fin->fin_dp;
9372393Syz155240 
9382393Syz155240 		switch (ic->icmp_type)
9392393Syz155240 		{
9402393Syz155240 		case ICMP6_ECHO_REQUEST :
9412393Syz155240 			is->is_icmp.ici_type = ic->icmp_type;
9422393Syz155240 			hv += (is->is_icmp.ici_id = ic->icmp_id);
9432393Syz155240 			break;
9442393Syz155240 		case ICMP6_MEMBERSHIP_QUERY :
9452393Syz155240 		case ND_ROUTER_SOLICIT :
9462393Syz155240 		case ND_NEIGHBOR_SOLICIT :
9472393Syz155240 		case ICMP6_NI_QUERY :
9482393Syz155240 			is->is_icmp.ici_type = ic->icmp_type;
9492393Syz155240 			break;
9502393Syz155240 		default :
9512393Syz155240 			return NULL;
9522393Syz155240 		}
9533448Sdh155122 		ATOMIC_INCL(ifs->ifs_ips_stats.iss_icmp);
9542393Syz155240 		break;
9552393Syz155240 #endif
9562393Syz155240 	case IPPROTO_ICMP :
9572393Syz155240 		ic = fin->fin_dp;
9582393Syz155240 
9592393Syz155240 		switch (ic->icmp_type)
9602393Syz155240 		{
9612393Syz155240 		case ICMP_ECHO :
9622393Syz155240 		case ICMP_TSTAMP :
9632393Syz155240 		case ICMP_IREQ :
9642393Syz155240 		case ICMP_MASKREQ :
9652393Syz155240 			is->is_icmp.ici_type = ic->icmp_type;
9662393Syz155240 			hv += (is->is_icmp.ici_id = ic->icmp_id);
9672393Syz155240 			break;
9682393Syz155240 		default :
9692393Syz155240 			return NULL;
9702393Syz155240 		}
9713448Sdh155122 		ATOMIC_INCL(ifs->ifs_ips_stats.iss_icmp);
9722393Syz155240 		break;
9732393Syz155240 
9742393Syz155240 	case IPPROTO_GRE :
9752393Syz155240 		gre = fin->fin_dp;
9762393Syz155240 
9772393Syz155240 		is->is_gre.gs_flags = gre->gr_flags;
9782393Syz155240 		is->is_gre.gs_ptype = gre->gr_ptype;
9792393Syz155240 		if (GRE_REV(is->is_gre.gs_flags) == 1) {
9802393Syz155240 			is->is_call[0] = fin->fin_data[0];
9812393Syz155240 			is->is_call[1] = fin->fin_data[1];
9822393Syz155240 		}
9832393Syz155240 		break;
9842393Syz155240 
9852393Syz155240 	case IPPROTO_TCP :
9862393Syz155240 		tcp = fin->fin_dp;
9872393Syz155240 
9882393Syz155240 		if (tcp->th_flags & TH_RST)
9892393Syz155240 			return NULL;
9902393Syz155240 		/*
9912393Syz155240 		 * The endian of the ports doesn't matter, but the ack and
9922393Syz155240 		 * sequence numbers do as we do mathematics on them later.
9932393Syz155240 		 */
9942393Syz155240 		is->is_sport = htons(fin->fin_data[0]);
9952393Syz155240 		is->is_dport = htons(fin->fin_data[1]);
9962393Syz155240 		if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) {
9972393Syz155240 			hv += is->is_sport;
9982393Syz155240 			hv += is->is_dport;
9992393Syz155240 		}
10002393Syz155240 
10012393Syz155240 		/*
10022393Syz155240 		 * If this is a real packet then initialise fields in the
10032393Syz155240 		 * state information structure from the TCP header information.
10042393Syz155240 		 */
10052393Syz155240 
10062393Syz155240 		is->is_maxdwin = 1;
10072393Syz155240 		is->is_maxswin = ntohs(tcp->th_win);
10082393Syz155240 		if (is->is_maxswin == 0)
10092393Syz155240 			is->is_maxswin = 1;
10102393Syz155240 
10112393Syz155240 		if ((fin->fin_flx & FI_IGNORE) == 0) {
10122393Syz155240 			is->is_send = ntohl(tcp->th_seq) + fin->fin_dlen -
10132393Syz155240 				      (TCP_OFF(tcp) << 2) +
10142393Syz155240 				      ((tcp->th_flags & TH_SYN) ? 1 : 0) +
10152393Syz155240 				      ((tcp->th_flags & TH_FIN) ? 1 : 0);
10162393Syz155240 			is->is_maxsend = is->is_send;
10172393Syz155240 
10182393Syz155240 			/*
10192393Syz155240 			 * Window scale option is only present in
10202393Syz155240 			 * SYN/SYN-ACK packet.
10212393Syz155240 			 */
10222393Syz155240 			if ((tcp->th_flags & ~(TH_FIN|TH_ACK|TH_ECNALL)) ==
10232393Syz155240 			    TH_SYN &&
10242393Syz155240 			    (TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) {
10252393Syz155240 				if (fr_tcpoptions(fin, tcp,
10262393Syz155240 					      &is->is_tcp.ts_data[0]))
10272393Syz155240 					is->is_swinflags = TCP_WSCALE_SEEN|
10282393Syz155240 							   TCP_WSCALE_FIRST;
10292393Syz155240 			}
10302393Syz155240 
10312393Syz155240 			if ((fin->fin_out != 0) && (pass & FR_NEWISN) != 0) {
10322393Syz155240 				fr_checknewisn(fin, is);
10332393Syz155240 				fr_fixoutisn(fin, is);
10342393Syz155240 			}
10352393Syz155240 
10362393Syz155240 			if ((tcp->th_flags & TH_OPENING) == TH_SYN)
10372393Syz155240 				flags |= IS_TCPFSM;
10382393Syz155240 			else {
10392393Syz155240 				is->is_maxdwin = is->is_maxswin * 2;
10402393Syz155240 				is->is_dend = ntohl(tcp->th_ack);
10412393Syz155240 				is->is_maxdend = ntohl(tcp->th_ack);
10422393Syz155240 				is->is_maxdwin *= 2;
10432393Syz155240 			}
10442393Syz155240 		}
10452393Syz155240 
10462393Syz155240 		/*
10472393Syz155240 		 * If we're creating state for a starting connection, start the
10482393Syz155240 		 * timer on it as we'll never see an error if it fails to
10492393Syz155240 		 * connect.
10502393Syz155240 		 */
10513448Sdh155122 		ATOMIC_INCL(ifs->ifs_ips_stats.iss_tcp);
10522393Syz155240 		break;
10532393Syz155240 
10542393Syz155240 	case IPPROTO_UDP :
10552393Syz155240 		tcp = fin->fin_dp;
10562393Syz155240 
10572393Syz155240 		is->is_sport = htons(fin->fin_data[0]);
10582393Syz155240 		is->is_dport = htons(fin->fin_data[1]);
10592393Syz155240 		if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) {
10602393Syz155240 			hv += tcp->th_dport;
10612393Syz155240 			hv += tcp->th_sport;
10622393Syz155240 		}
10633448Sdh155122 		ATOMIC_INCL(ifs->ifs_ips_stats.iss_udp);
10642393Syz155240 		break;
10652393Syz155240 
10662393Syz155240 	default :
10672393Syz155240 		break;
10682393Syz155240 	}
10693448Sdh155122 	hv = DOUBLE_HASH(hv, ifs);
10702393Syz155240 	is->is_hv = hv;
10712393Syz155240 	is->is_rule = fr;
10722393Syz155240 	is->is_flags = flags & IS_INHERITED;
10732393Syz155240 
10742393Syz155240 	/*
10752393Syz155240 	 * Look for identical state.
10762393Syz155240 	 */
10773448Sdh155122 	for (is = ifs->ifs_ips_table[is->is_hv % ifs->ifs_fr_statesize];
10783448Sdh155122 	     is != NULL;
10792393Syz155240 	     is = is->is_hnext) {
10802393Syz155240 		if (bcmp(&ips.is_src, &is->is_src,
10812393Syz155240 			 offsetof(struct ipstate, is_ps) -
10822393Syz155240 			 offsetof(struct ipstate, is_src)) == 0)
10832393Syz155240 			break;
10842393Syz155240 	}
10852393Syz155240 	if (is != NULL)
10862393Syz155240 		return NULL;
10872393Syz155240 
10883448Sdh155122 	if (ifs->ifs_ips_stats.iss_bucketlen[hv] >= ifs->ifs_fr_state_maxbucket) {
10893448Sdh155122 		ATOMIC_INCL(ifs->ifs_ips_stats.iss_bucketfull);
10902393Syz155240 		return NULL;
10912393Syz155240 	}
10922393Syz155240 	KMALLOC(is, ipstate_t *);
10932393Syz155240 	if (is == NULL) {
10943448Sdh155122 		ATOMIC_INCL(ifs->ifs_ips_stats.iss_nomem);
10952393Syz155240 		return NULL;
10962393Syz155240 	}
10972393Syz155240 	bcopy((char *)&ips, (char *)is, sizeof(*is));
10982393Syz155240 	/*
10992393Syz155240 	 * Do not do the modulous here, it is done in fr_stinsert().
11002393Syz155240 	 */
11012393Syz155240 	if (fr != NULL) {
11022393Syz155240 		(void) strncpy(is->is_group, fr->fr_group, FR_GROUPLEN);
11032393Syz155240 		if (fr->fr_age[0] != 0) {
11043448Sdh155122 			is->is_tqehead[0] =
11053448Sdh155122 			    fr_addtimeoutqueue(&ifs->ifs_ips_utqe,
11063448Sdh155122 					       fr->fr_age[0], ifs);
11072393Syz155240 			is->is_sti.tqe_flags |= TQE_RULEBASED;
11082393Syz155240 		}
11092393Syz155240 		if (fr->fr_age[1] != 0) {
11103448Sdh155122 			is->is_tqehead[1] =
11113448Sdh155122 			    fr_addtimeoutqueue(&ifs->ifs_ips_utqe,
11123448Sdh155122 					       fr->fr_age[1], ifs);
11132393Syz155240 			is->is_sti.tqe_flags |= TQE_RULEBASED;
11142393Syz155240 		}
11152393Syz155240 		is->is_tag = fr->fr_logtag;
11162393Syz155240 
11172393Syz155240 		is->is_ifp[(out << 1) + 1] = fr->fr_ifas[1];
11182393Syz155240 		is->is_ifp[(1 - out) << 1] = fr->fr_ifas[2];
11192393Syz155240 		is->is_ifp[((1 - out) << 1) + 1] = fr->fr_ifas[3];
11202393Syz155240 
11212393Syz155240 		if (((ifp = fr->fr_ifas[1]) != NULL) &&
11222393Syz155240 		    (ifp != (void *)-1)) {
11232958Sdr146992 			COPYIFNAME(ifp, is->is_ifname[(out << 1) + 1], fr->fr_v);
11242393Syz155240 		}
11252393Syz155240 		if (((ifp = fr->fr_ifas[2]) != NULL) &&
11262393Syz155240 		    (ifp != (void *)-1)) {
11272958Sdr146992 			COPYIFNAME(ifp, is->is_ifname[(1 - out) << 1], fr->fr_v);
11282393Syz155240 		}
11292393Syz155240 		if (((ifp = fr->fr_ifas[3]) != NULL) &&
11302393Syz155240 		    (ifp != (void *)-1)) {
11312958Sdr146992 			COPYIFNAME(ifp, is->is_ifname[((1 - out) << 1) + 1], fr->fr_v);
11322393Syz155240 		}
11332393Syz155240 	} else {
11343448Sdh155122 		pass = ifs->ifs_fr_flags;
11352393Syz155240 		is->is_tag = FR_NOLOGTAG;
11362393Syz155240 	}
11372393Syz155240 
11382393Syz155240 	is->is_ifp[out << 1] = fin->fin_ifp;
11392393Syz155240 	if (fin->fin_ifp != NULL) {
11402958Sdr146992 		COPYIFNAME(fin->fin_ifp, is->is_ifname[out << 1], fr->fr_v);
11412393Syz155240 	}
11422393Syz155240 
11432393Syz155240 	/*
11442393Syz155240 	 * It may seem strange to set is_ref to 2, but fr_check() will call
11452393Syz155240 	 * fr_statederef() after calling fr_addstate() and the idea is to
11462393Syz155240 	 * have it exist at the end of fr_check() with is_ref == 1.
11472393Syz155240 	 */
11482393Syz155240 	is->is_ref = 2;
11492393Syz155240 	is->is_pass = pass;
11502393Syz155240 	is->is_pkts[0] = 0, is->is_bytes[0] = 0;
11512393Syz155240 	is->is_pkts[1] = 0, is->is_bytes[1] = 0;
11522393Syz155240 	is->is_pkts[2] = 0, is->is_bytes[2] = 0;
11532393Syz155240 	is->is_pkts[3] = 0, is->is_bytes[3] = 0;
11542393Syz155240 	if ((fin->fin_flx & FI_IGNORE) == 0) {
11552393Syz155240 		is->is_pkts[out] = 1;
11562393Syz155240 		is->is_bytes[out] = fin->fin_plen;
11572393Syz155240 		is->is_flx[out][0] = fin->fin_flx & FI_CMP;
11582393Syz155240 		is->is_flx[out][0] &= ~FI_OOW;
11592393Syz155240 	}
11602393Syz155240 
11612393Syz155240 	if (pass & FR_STSTRICT)
11622393Syz155240 		is->is_flags |= IS_STRICT;
11632393Syz155240 
11642393Syz155240 	if (pass & FR_STATESYNC)
11652393Syz155240 		is->is_flags |= IS_STATESYNC;
11662393Syz155240 
11672393Syz155240 	/*
11682393Syz155240 	 * We want to check everything that is a property of this packet,
11692393Syz155240 	 * but we don't (automatically) care about it's fragment status as
11702393Syz155240 	 * this may change.
11712393Syz155240 	 */
11722393Syz155240 	is->is_v = fin->fin_v;
11732393Syz155240 	is->is_opt[0] = fin->fin_optmsk;
11742393Syz155240 	is->is_optmsk[0] = 0xffffffff;
11752393Syz155240 	is->is_optmsk[1] = 0xffffffff;
11762393Syz155240 	if (is->is_v == 6) {
11772393Syz155240 		is->is_opt[0] &= ~0x8;
11782393Syz155240 		is->is_optmsk[0] &= ~0x8;
11792393Syz155240 		is->is_optmsk[1] &= ~0x8;
11802393Syz155240 	}
11812393Syz155240 	is->is_sec = fin->fin_secmsk;
11822393Syz155240 	is->is_secmsk = 0xffff;
11832393Syz155240 	is->is_auth = fin->fin_auth;
11842393Syz155240 	is->is_authmsk = 0xffff;
11852393Syz155240 	if (flags & (SI_WILDP|SI_WILDA)) {
11863448Sdh155122 		ATOMIC_INCL(ifs->ifs_ips_stats.iss_wild);
11872393Syz155240 	}
11882393Syz155240 	is->is_rulen = fin->fin_rule;
11892393Syz155240 
11902393Syz155240 
11912393Syz155240 	if (pass & FR_LOGFIRST)
11922393Syz155240 		is->is_pass &= ~(FR_LOGFIRST|FR_LOG);
11932393Syz155240 
11943448Sdh155122 	READ_ENTER(&ifs->ifs_ipf_state);
11952393Syz155240 	is->is_me = stsave;
11962393Syz155240 
11973448Sdh155122 	fr_stinsert(is, fin->fin_rev, ifs);
11982393Syz155240 
11992393Syz155240 	if (fin->fin_p == IPPROTO_TCP) {
12002393Syz155240 		/*
12012393Syz155240 		* If we're creating state for a starting connection, start the
12022393Syz155240 		* timer on it as we'll never see an error if it fails to
12032393Syz155240 		* connect.
12042393Syz155240 		*/
12053448Sdh155122 		(void) fr_tcp_age(&is->is_sti, fin, ifs->ifs_ips_tqtqb,
12063448Sdh155122 				  is->is_flags);
12072393Syz155240 		MUTEX_EXIT(&is->is_lock);
12082393Syz155240 #ifdef	IPFILTER_SCAN
12092393Syz155240 		if ((is->is_flags & SI_CLONE) == 0)
12102393Syz155240 			(void) ipsc_attachis(is);
12112393Syz155240 #endif
12122393Syz155240 	} else {
12132393Syz155240 		MUTEX_EXIT(&is->is_lock);
12142393Syz155240 	}
12152393Syz155240 #ifdef	IPFILTER_SYNC
12162393Syz155240 	if ((is->is_flags & IS_STATESYNC) && ((is->is_flags & SI_CLONE) == 0))
12172393Syz155240 		is->is_sync = ipfsync_new(SMC_STATE, fin, is);
12182393Syz155240 #endif
12193448Sdh155122 	if (ifs->ifs_ipstate_logging)
12203448Sdh155122 		ipstate_log(is, ISL_NEW, ifs);
12213448Sdh155122 
12223448Sdh155122 	RWLOCK_EXIT(&ifs->ifs_ipf_state);
12232393Syz155240 	fin->fin_state = is;
12242393Syz155240 	fin->fin_rev = IP6_NEQ(&is->is_dst, &fin->fin_daddr);
12252393Syz155240 	fin->fin_flx |= FI_STATE;
12262393Syz155240 	if (fin->fin_flx & FI_FRAG)
12272393Syz155240 		(void) fr_newfrag(fin, pass ^ FR_KEEPSTATE);
12282393Syz155240 
12292393Syz155240 	return is;
12302393Syz155240 }
12312393Syz155240 
12322393Syz155240 
12332393Syz155240 /* ------------------------------------------------------------------------ */
12342393Syz155240 /* Function:    fr_tcpoptions                                               */
12352393Syz155240 /* Returns:     int - 1 == packet matches state entry, 0 == it does not     */
12362393Syz155240 /* Parameters:  fin(I) - pointer to packet information                      */
12372393Syz155240 /*              tcp(I) - pointer to TCP packet header                       */
12382393Syz155240 /*              td(I)  - pointer to TCP data held as part of the state      */
12392393Syz155240 /*                                                                          */
12402393Syz155240 /* Look after the TCP header for any options and deal with those that are   */
12412393Syz155240 /* present.  Record details about those that we recogise.                   */
12422393Syz155240 /* ------------------------------------------------------------------------ */
12432393Syz155240 static int fr_tcpoptions(fin, tcp, td)
12442393Syz155240 fr_info_t *fin;
12452393Syz155240 tcphdr_t *tcp;
12462393Syz155240 tcpdata_t *td;
12472393Syz155240 {
12482393Syz155240 	int off, mlen, ol, i, len, retval;
12492393Syz155240 	char buf[64], *s, opt;
12502393Syz155240 	mb_t *m = NULL;
12512393Syz155240 
12522393Syz155240 	len = (TCP_OFF(tcp) << 2);
12532393Syz155240 	if (fin->fin_dlen < len)
12542393Syz155240 		return 0;
12552393Syz155240 	len -= sizeof(*tcp);
12562393Syz155240 
12572393Syz155240 	off = fin->fin_plen - fin->fin_dlen + sizeof(*tcp) + fin->fin_ipoff;
12582393Syz155240 
12592393Syz155240 	m = fin->fin_m;
12602393Syz155240 	mlen = MSGDSIZE(m) - off;
12612393Syz155240 	if (len > mlen) {
12622393Syz155240 		len = mlen;
12632393Syz155240 		retval = 0;
12642393Syz155240 	} else {
12652393Syz155240 		retval = 1;
12662393Syz155240 	}
12672393Syz155240 
12682393Syz155240 	COPYDATA(m, off, len, buf);
12692393Syz155240 
12702393Syz155240 	for (s = buf; len > 0; ) {
12712393Syz155240 		opt = *s;
12722393Syz155240 		if (opt == TCPOPT_EOL)
12732393Syz155240 			break;
12742393Syz155240 		else if (opt == TCPOPT_NOP)
12752393Syz155240 			ol = 1;
12762393Syz155240 		else {
12772393Syz155240 			if (len < 2)
12782393Syz155240 				break;
12792393Syz155240 			ol = (int)*(s + 1);
12802393Syz155240 			if (ol < 2 || ol > len)
12812393Syz155240 				break;
12822393Syz155240 
12832393Syz155240 			/*
12842393Syz155240 			 * Extract the TCP options we are interested in out of
12852393Syz155240 			 * the header and store them in the the tcpdata struct.
12862393Syz155240 			 */
12872393Syz155240 			switch (opt)
12882393Syz155240 			{
12892393Syz155240 			case TCPOPT_WINDOW :
12902393Syz155240 				if (ol == TCPOLEN_WINDOW) {
12912393Syz155240 					i = (int)*(s + 2);
12922393Syz155240 					if (i > TCP_WSCALE_MAX)
12932393Syz155240 						i = TCP_WSCALE_MAX;
12942393Syz155240 					else if (i < 0)
12952393Syz155240 						i = 0;
12962393Syz155240 					td->td_winscale = i;
12972393Syz155240 				}
12982393Syz155240 				break;
12992393Syz155240 			case TCPOPT_MAXSEG :
13002393Syz155240 				/*
13012393Syz155240 				 * So, if we wanted to set the TCP MAXSEG,
13022393Syz155240 				 * it should be done here...
13032393Syz155240 				 */
13042393Syz155240 				if (ol == TCPOLEN_MAXSEG) {
13052393Syz155240 					i = (int)*(s + 2);
13062393Syz155240 					i <<= 8;
13072393Syz155240 					i += (int)*(s + 3);
13082393Syz155240 					td->td_maxseg = i;
13092393Syz155240 				}
13102393Syz155240 				break;
13112393Syz155240 			}
13122393Syz155240 		}
13132393Syz155240 		len -= ol;
13142393Syz155240 		s += ol;
13152393Syz155240 	}
13162393Syz155240 	return retval;
13172393Syz155240 }
13182393Syz155240 
13192393Syz155240 
13202393Syz155240 /* ------------------------------------------------------------------------ */
13212393Syz155240 /* Function:    fr_tcpstate                                                 */
13222393Syz155240 /* Returns:     int - 1 == packet matches state entry, 0 == it does not     */
13232393Syz155240 /* Parameters:  fin(I)   - pointer to packet information                    */
13242393Syz155240 /*              tcp(I)   - pointer to TCP packet header                     */
13252393Syz155240 /*              is(I)  - pointer to master state structure                  */
13262393Syz155240 /*                                                                          */
13272393Syz155240 /* Check to see if a packet with TCP headers fits within the TCP window.    */
13282393Syz155240 /* Change timeout depending on whether new packet is a SYN-ACK returning    */
13292393Syz155240 /* for a SYN or a RST or FIN which indicate time to close up shop.          */
13302393Syz155240 /* ------------------------------------------------------------------------ */
13312393Syz155240 static int fr_tcpstate(fin, tcp, is)
13322393Syz155240 fr_info_t *fin;
13332393Syz155240 tcphdr_t *tcp;
13342393Syz155240 ipstate_t *is;
13352393Syz155240 {
13362393Syz155240 	int source, ret = 0, flags;
13372393Syz155240 	tcpdata_t  *fdata, *tdata;
13383448Sdh155122 	ipf_stack_t *ifs = fin->fin_ifs;
13392393Syz155240 
13402393Syz155240 	source = !fin->fin_rev;
13412393Syz155240 	if (((is->is_flags & IS_TCPFSM) != 0) && (source == 1) &&
13422393Syz155240 	    (ntohs(is->is_sport) != fin->fin_data[0]))
13432393Syz155240 		source = 0;
13442393Syz155240 	fdata = &is->is_tcp.ts_data[!source];
13452393Syz155240 	tdata = &is->is_tcp.ts_data[source];
13462393Syz155240 
13472393Syz155240 	MUTEX_ENTER(&is->is_lock);
13482393Syz155240 	if (fr_tcpinwindow(fin, fdata, tdata, tcp, is->is_flags)) {
13492393Syz155240 #ifdef	IPFILTER_SCAN
13502393Syz155240 		if (is->is_flags & (IS_SC_CLIENT|IS_SC_SERVER)) {
13512393Syz155240 			ipsc_packet(fin, is);
13522393Syz155240 			if (FR_ISBLOCK(is->is_pass)) {
13532393Syz155240 				MUTEX_EXIT(&is->is_lock);
13542393Syz155240 				return 1;
13552393Syz155240 			}
13562393Syz155240 		}
13572393Syz155240 #endif
13582393Syz155240 
13592393Syz155240 		/*
13602393Syz155240 		 * Nearing end of connection, start timeout.
13612393Syz155240 		 */
13623448Sdh155122 		ret = fr_tcp_age(&is->is_sti, fin, ifs->ifs_ips_tqtqb,
13633448Sdh155122 				 is->is_flags);
13642393Syz155240 		if (ret == 0) {
13652393Syz155240 			MUTEX_EXIT(&is->is_lock);
13662393Syz155240 			return 0;
13672393Syz155240 		}
13682393Syz155240 
13692393Syz155240 		/*
13702393Syz155240 		 * set s0's as appropriate.  Use syn-ack packet as it
13712393Syz155240 		 * contains both pieces of required information.
13722393Syz155240 		 */
13732393Syz155240 		/*
13742393Syz155240 		 * Window scale option is only present in SYN/SYN-ACK packet.
13752393Syz155240 		 * Compare with ~TH_FIN to mask out T/TCP setups.
13762393Syz155240 		 */
13772393Syz155240 		flags = tcp->th_flags & ~(TH_FIN|TH_ECNALL);
13782393Syz155240 		if (flags == (TH_SYN|TH_ACK)) {
13792393Syz155240 			is->is_s0[source] = ntohl(tcp->th_ack);
13802393Syz155240 			is->is_s0[!source] = ntohl(tcp->th_seq) + 1;
13812393Syz155240 			if ((TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2)) &&
13822393Syz155240 			    tdata->td_winscale) {
13832393Syz155240 				if (fr_tcpoptions(fin, tcp, fdata)) {
13842393Syz155240 					fdata->td_winflags = TCP_WSCALE_SEEN|
13852393Syz155240 							     TCP_WSCALE_FIRST;
13862393Syz155240 				} else {
13872393Syz155240 					if (!fdata->td_winscale)
13882393Syz155240 						tdata->td_winscale = 0;
13892393Syz155240 				}
13902393Syz155240 			}
13912393Syz155240 			if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN))
13922393Syz155240 				fr_checknewisn(fin, is);
13932393Syz155240 		} else if (flags == TH_SYN) {
13942393Syz155240 			is->is_s0[source] = ntohl(tcp->th_seq) + 1;
13952393Syz155240 			if ((TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2)))
13962393Syz155240 				if (fr_tcpoptions(fin, tcp, tdata)) {
13972393Syz155240 					tdata->td_winflags = TCP_WSCALE_SEEN|
13982393Syz155240 							     TCP_WSCALE_FIRST;
13992393Syz155240 				}
14002393Syz155240 
14012393Syz155240 			if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN))
14022393Syz155240 				fr_checknewisn(fin, is);
14032393Syz155240 
14042393Syz155240 		}
14052393Syz155240 		ret = 1;
14062393Syz155240 	} else
14072393Syz155240 		fin->fin_flx |= FI_OOW;
14082393Syz155240 	MUTEX_EXIT(&is->is_lock);
14092393Syz155240 	return ret;
14102393Syz155240 }
14112393Syz155240 
14122393Syz155240 
14132393Syz155240 /* ------------------------------------------------------------------------ */
14142393Syz155240 /* Function:    fr_checknewisn                                              */
14152393Syz155240 /* Returns:     Nil                                                         */
14162393Syz155240 /* Parameters:  fin(I)   - pointer to packet information                    */
14172393Syz155240 /*              is(I)  - pointer to master state structure                  */
14182393Syz155240 /*                                                                          */
14192393Syz155240 /* Check to see if this TCP connection is expecting and needs a new         */
14202393Syz155240 /* sequence number for a particular direction of the connection.            */
14212393Syz155240 /*                                                                          */
14222393Syz155240 /* NOTE: This does not actually change the sequence numbers, only gets new  */
14232393Syz155240 /* one ready.                                                               */
14242393Syz155240 /* ------------------------------------------------------------------------ */
14252393Syz155240 static void fr_checknewisn(fin, is)
14262393Syz155240 fr_info_t *fin;
14272393Syz155240 ipstate_t *is;
14282393Syz155240 {
14292393Syz155240 	u_32_t sumd, old, new;
14302393Syz155240 	tcphdr_t *tcp;
14312393Syz155240 	int i;
14322393Syz155240 
14332393Syz155240 	i = fin->fin_rev;
14342393Syz155240 	tcp = fin->fin_dp;
14352393Syz155240 
14362393Syz155240 	if (((i == 0) && !(is->is_flags & IS_ISNSYN)) ||
14372393Syz155240 	    ((i == 1) && !(is->is_flags & IS_ISNACK))) {
14382393Syz155240 		old = ntohl(tcp->th_seq);
14392393Syz155240 		new = fr_newisn(fin);
14402393Syz155240 		is->is_isninc[i] = new - old;
14412393Syz155240 		CALC_SUMD(old, new, sumd);
14422393Syz155240 		is->is_sumd[i] = (sumd & 0xffff) + (sumd >> 16);
14432393Syz155240 
14442393Syz155240 		is->is_flags |= ((i == 0) ? IS_ISNSYN : IS_ISNACK);
14452393Syz155240 	}
14462393Syz155240 }
14472393Syz155240 
14482393Syz155240 
14492393Syz155240 /* ------------------------------------------------------------------------ */
14502393Syz155240 /* Function:    fr_tcpinwindow                                              */
14512393Syz155240 /* Returns:     int - 1 == packet inside TCP "window", 0 == not inside.     */
14522393Syz155240 /* Parameters:  fin(I)   - pointer to packet information                    */
14532393Syz155240 /*              fdata(I) - pointer to tcp state informatio (forward)        */
14542393Syz155240 /*              tdata(I) - pointer to tcp state informatio (reverse)        */
14552393Syz155240 /*              tcp(I)   - pointer to TCP packet header                     */
14562393Syz155240 /*                                                                          */
14572393Syz155240 /* Given a packet has matched addresses and ports, check to see if it is    */
14582393Syz155240 /* within the TCP data window.  In a show of generosity, allow packets that */
14592393Syz155240 /* are within the window space behind the current sequence # as well.       */
14602393Syz155240 /* ------------------------------------------------------------------------ */
14612393Syz155240 int fr_tcpinwindow(fin, fdata, tdata, tcp, flags)
14622393Syz155240 fr_info_t *fin;
14632393Syz155240 tcpdata_t  *fdata, *tdata;
14642393Syz155240 tcphdr_t *tcp;
14652393Syz155240 int flags;
14662393Syz155240 {
14672393Syz155240 	tcp_seq seq, ack, end;
14682393Syz155240 	int ackskew, tcpflags;
14692393Syz155240 	u_32_t win, maxwin;
14702393Syz155240 
14712393Syz155240 	/*
14722393Syz155240 	 * Find difference between last checked packet and this packet.
14732393Syz155240 	 */
14742393Syz155240 	tcpflags = tcp->th_flags;
14752393Syz155240 	seq = ntohl(tcp->th_seq);
14762393Syz155240 	ack = ntohl(tcp->th_ack);
14772393Syz155240 	if (tcpflags & TH_SYN)
14782393Syz155240 		win = ntohs(tcp->th_win);
14792393Syz155240 	else
14802393Syz155240 		win = ntohs(tcp->th_win) << fdata->td_winscale;
14812393Syz155240 	if (win == 0)
14822393Syz155240 		win = 1;
14832393Syz155240 
14842393Syz155240 	/*
14852393Syz155240 	 * if window scaling is present, the scaling is only allowed
14862393Syz155240 	 * for windows not in the first SYN packet. In that packet the
14872393Syz155240 	 * window is 65535 to specify the largest window possible
14882393Syz155240 	 * for receivers not implementing the window scale option.
14892393Syz155240 	 * Currently, we do not assume TTCP here. That means that
14902393Syz155240 	 * if we see a second packet from a host (after the initial
14912393Syz155240 	 * SYN), we can assume that the receiver of the SYN did
14922393Syz155240 	 * already send back the SYN/ACK (and thus that we know if
14932393Syz155240 	 * the receiver also does window scaling)
14942393Syz155240 	 */
14952393Syz155240 	if (!(tcpflags & TH_SYN) && (fdata->td_winflags & TCP_WSCALE_FIRST)) {
14962393Syz155240 		if (tdata->td_winflags & TCP_WSCALE_SEEN) {
14972393Syz155240 			fdata->td_winflags &= ~TCP_WSCALE_FIRST;
14982393Syz155240 			fdata->td_maxwin = win;
14992393Syz155240 		} else {
15002393Syz155240 			fdata->td_winscale = 0;
15012393Syz155240 			fdata->td_winflags = 0;
15022393Syz155240 			tdata->td_winscale = 0;
15032393Syz155240 			tdata->td_winflags = 0;
15042393Syz155240 		  }
15052393Syz155240 	}
15062393Syz155240 
15072393Syz155240 	end = seq + fin->fin_dlen - (TCP_OFF(tcp) << 2) +
15082393Syz155240 	      ((tcpflags & TH_SYN) ? 1 : 0) + ((tcpflags & TH_FIN) ? 1 : 0);
15092393Syz155240 
15102393Syz155240 	if ((fdata->td_end == 0) &&
15112393Syz155240 	    (!(flags & IS_TCPFSM) ||
15122393Syz155240 	     ((tcpflags & TH_OPENING) == TH_OPENING))) {
15132393Syz155240 		/*
15142393Syz155240 		 * Must be a (outgoing) SYN-ACK in reply to a SYN.
15152393Syz155240 		 */
15162393Syz155240 		fdata->td_end = end;
15172393Syz155240 		fdata->td_maxwin = 1;
15182393Syz155240 		fdata->td_maxend = end + win;
15192393Syz155240 	}
15202393Syz155240 
15212393Syz155240 	if (!(tcpflags & TH_ACK)) {  /* Pretend an ack was sent */
15222393Syz155240 		ack = tdata->td_end;
15232393Syz155240 	} else if (((tcpflags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) &&
15242393Syz155240 		   (ack == 0)) {
15252393Syz155240 		/* gross hack to get around certain broken tcp stacks */
15262393Syz155240 		ack = tdata->td_end;
15272393Syz155240 	}
15282393Syz155240 
15292393Syz155240 	if (seq == end)
15302393Syz155240 		seq = end = fdata->td_end;
15312393Syz155240 
15322393Syz155240 	maxwin = tdata->td_maxwin;
15332393Syz155240 	ackskew = tdata->td_end - ack;
15342393Syz155240 
15352393Syz155240 	/*
15362393Syz155240 	 * Strict sequencing only allows in-order delivery.
15372393Syz155240 	 */
15382393Syz155240 	if ((flags & IS_STRICT) != 0) {
15392393Syz155240 		if (seq != fdata->td_end) {
15402393Syz155240 			return 0;
15412393Syz155240 		}
15422393Syz155240 	}
15432393Syz155240 
15442393Syz155240 #define	SEQ_GE(a,b)	((int)((a) - (b)) >= 0)
15452393Syz155240 #define	SEQ_GT(a,b)	((int)((a) - (b)) > 0)
15462393Syz155240 	if (
15472393Syz155240 #if defined(_KERNEL)
15482393Syz155240 	    (SEQ_GE(fdata->td_maxend, end)) &&
15492393Syz155240 	    (SEQ_GE(seq, fdata->td_end - maxwin)) &&
15502393Syz155240 #endif
15512393Syz155240 /* XXX what about big packets */
15522393Syz155240 #define MAXACKWINDOW 66000
15532393Syz155240 	    (-ackskew <= (MAXACKWINDOW << fdata->td_winscale)) &&
15542393Syz155240 	    ( ackskew <= (MAXACKWINDOW << fdata->td_winscale))) {
15552393Syz155240 
15562393Syz155240 		/* if ackskew < 0 then this should be due to fragmented
15572393Syz155240 		 * packets. There is no way to know the length of the
15582393Syz155240 		 * total packet in advance.
15592393Syz155240 		 * We do know the total length from the fragment cache though.
15602393Syz155240 		 * Note however that there might be more sessions with
15612393Syz155240 		 * exactly the same source and destination parameters in the
15622393Syz155240 		 * state cache (and source and destination is the only stuff
15632393Syz155240 		 * that is saved in the fragment cache). Note further that
15642393Syz155240 		 * some TCP connections in the state cache are hashed with
15652393Syz155240 		 * sport and dport as well which makes it not worthwhile to
15662393Syz155240 		 * look for them.
15672393Syz155240 		 * Thus, when ackskew is negative but still seems to belong
15682393Syz155240 		 * to this session, we bump up the destinations end value.
15692393Syz155240 		 */
15702393Syz155240 		if (ackskew < 0)
15712393Syz155240 			tdata->td_end = ack;
15722393Syz155240 
15732393Syz155240 		/* update max window seen */
15742393Syz155240 		if (fdata->td_maxwin < win)
15752393Syz155240 			fdata->td_maxwin = win;
15762393Syz155240 		if (SEQ_GT(end, fdata->td_end))
15772393Syz155240 			fdata->td_end = end;
15782393Syz155240 		if (SEQ_GE(ack + win, tdata->td_maxend))
15792393Syz155240 			tdata->td_maxend = ack + win;
15802393Syz155240 		return 1;
15812393Syz155240 	}
15822393Syz155240 	return 0;
15832393Syz155240 }
15842393Syz155240 
15852393Syz155240 
15862393Syz155240 /* ------------------------------------------------------------------------ */
15872393Syz155240 /* Function:    fr_stclone                                                  */
15882393Syz155240 /* Returns:     ipstate_t* - NULL == cloning failed,                        */
15892393Syz155240 /*                           else pointer to new state structure            */
15902393Syz155240 /* Parameters:  fin(I) - pointer to packet information                      */
15912393Syz155240 /*              tcp(I) - pointer to TCP/UDP header                          */
15922393Syz155240 /*              is(I)  - pointer to master state structure                  */
15932393Syz155240 /*                                                                          */
15942393Syz155240 /* Create a "duplcate" state table entry from the master.                   */
15952393Syz155240 /* ------------------------------------------------------------------------ */
15962393Syz155240 static ipstate_t *fr_stclone(fin, tcp, is)
15972393Syz155240 fr_info_t *fin;
15982393Syz155240 tcphdr_t *tcp;
15992393Syz155240 ipstate_t *is;
16002393Syz155240 {
16012393Syz155240 	ipstate_t *clone;
16022393Syz155240 	u_32_t send;
16033448Sdh155122 	ipf_stack_t *ifs = fin->fin_ifs;
16043448Sdh155122 
16053448Sdh155122 	if (ifs->ifs_ips_num == ifs->ifs_fr_statemax) {
16063448Sdh155122 		ATOMIC_INCL(ifs->ifs_ips_stats.iss_max);
16073448Sdh155122 		ifs->ifs_fr_state_doflush = 1;
16082393Syz155240 		return NULL;
16092393Syz155240 	}
16102393Syz155240 	KMALLOC(clone, ipstate_t *);
16112393Syz155240 	if (clone == NULL)
16122393Syz155240 		return NULL;
16132393Syz155240 	bcopy((char *)is, (char *)clone, sizeof(*clone));
16142393Syz155240 
16152393Syz155240 	MUTEX_NUKE(&clone->is_lock);
16162393Syz155240 
16173448Sdh155122 	clone->is_die = ONE_DAY + ifs->ifs_fr_ticks;
16182393Syz155240 	clone->is_state[0] = 0;
16192393Syz155240 	clone->is_state[1] = 0;
16202393Syz155240 	send = ntohl(tcp->th_seq) + fin->fin_dlen - (TCP_OFF(tcp) << 2) +
16212393Syz155240 		((tcp->th_flags & TH_SYN) ? 1 : 0) +
16222393Syz155240 		((tcp->th_flags & TH_FIN) ? 1 : 0);
16232393Syz155240 
16242393Syz155240 	if (fin->fin_rev == 1) {
16252393Syz155240 		clone->is_dend = send;
16262393Syz155240 		clone->is_maxdend = send;
16272393Syz155240 		clone->is_send = 0;
16282393Syz155240 		clone->is_maxswin = 1;
16292393Syz155240 		clone->is_maxdwin = ntohs(tcp->th_win);
16302393Syz155240 		if (clone->is_maxdwin == 0)
16312393Syz155240 			clone->is_maxdwin = 1;
16322393Syz155240 	} else {
16332393Syz155240 		clone->is_send = send;
16342393Syz155240 		clone->is_maxsend = send;
16352393Syz155240 		clone->is_dend = 0;
16362393Syz155240 		clone->is_maxdwin = 1;
16372393Syz155240 		clone->is_maxswin = ntohs(tcp->th_win);
16382393Syz155240 		if (clone->is_maxswin == 0)
16392393Syz155240 			clone->is_maxswin = 1;
16402393Syz155240 	}
16412393Syz155240 
16422393Syz155240 	clone->is_flags &= ~SI_CLONE;
16432393Syz155240 	clone->is_flags |= SI_CLONED;
16443448Sdh155122 	fr_stinsert(clone, fin->fin_rev, ifs);
16452393Syz155240 	clone->is_ref = 2;
16462393Syz155240 	if (clone->is_p == IPPROTO_TCP) {
16473448Sdh155122 		(void) fr_tcp_age(&clone->is_sti, fin, ifs->ifs_ips_tqtqb,
16482393Syz155240 				  clone->is_flags);
16492393Syz155240 	}
16502393Syz155240 	MUTEX_EXIT(&clone->is_lock);
16512393Syz155240 #ifdef	IPFILTER_SCAN
16522393Syz155240 	(void) ipsc_attachis(is);
16532393Syz155240 #endif
16542393Syz155240 #ifdef	IPFILTER_SYNC
16552393Syz155240 	if (is->is_flags & IS_STATESYNC)
16562393Syz155240 		clone->is_sync = ipfsync_new(SMC_STATE, fin, clone);
16572393Syz155240 #endif
16582393Syz155240 	return clone;
16592393Syz155240 }
16602393Syz155240 
16612393Syz155240 
16622393Syz155240 /* ------------------------------------------------------------------------ */
16632393Syz155240 /* Function:    fr_matchsrcdst                                              */
16642393Syz155240 /* Returns:     Nil                                                         */
16652393Syz155240 /* Parameters:  fin(I) - pointer to packet information                      */
16662393Syz155240 /*              is(I)  - pointer to state structure                         */
16672393Syz155240 /*              src(I) - pointer to source address                          */
16682393Syz155240 /*              dst(I) - pointer to destination address                     */
16692393Syz155240 /*              tcp(I) - pointer to TCP/UDP header                          */
16702393Syz155240 /*                                                                          */
16712393Syz155240 /* Match a state table entry against an IP packet.  The logic below is that */
16722393Syz155240 /* ret gets set to one if the match succeeds, else remains 0.  If it is     */
16732393Syz155240 /* still 0 after the test. no match.                                        */
16742393Syz155240 /* ------------------------------------------------------------------------ */
16752393Syz155240 static ipstate_t *fr_matchsrcdst(fin, is, src, dst, tcp, cmask)
16762393Syz155240 fr_info_t *fin;
16772393Syz155240 ipstate_t *is;
16782393Syz155240 i6addr_t *src, *dst;
16792393Syz155240 tcphdr_t *tcp;
16802393Syz155240 u_32_t cmask;
16812393Syz155240 {
16822393Syz155240 	int ret = 0, rev, out, flags, flx = 0, idx;
16832393Syz155240 	u_short sp, dp;
16842393Syz155240 	u_32_t cflx;
16852393Syz155240 	void *ifp;
16863448Sdh155122 	ipf_stack_t *ifs = fin->fin_ifs;
16872393Syz155240 
16882393Syz155240 	rev = IP6_NEQ(&is->is_dst, dst);
16892393Syz155240 	ifp = fin->fin_ifp;
16902393Syz155240 	out = fin->fin_out;
16912393Syz155240 	flags = is->is_flags;
16922393Syz155240 	sp = 0;
16932393Syz155240 	dp = 0;
16942393Syz155240 
16952393Syz155240 	if (tcp != NULL) {
16962393Syz155240 		sp = htons(fin->fin_sport);
16972393Syz155240 		dp = ntohs(fin->fin_dport);
16982393Syz155240 	}
16992393Syz155240 	if (!rev) {
17002393Syz155240 		if (tcp != NULL) {
17012393Syz155240 			if (!(flags & SI_W_SPORT) && (sp != is->is_sport))
17022393Syz155240 				rev = 1;
17032393Syz155240 			else if (!(flags & SI_W_DPORT) && (dp != is->is_dport))
17042393Syz155240 				rev = 1;
17052393Syz155240 		}
17062393Syz155240 	}
17072393Syz155240 
17082393Syz155240 	idx = (out << 1) + rev;
17092393Syz155240 
17102393Syz155240 	/*
17112393Syz155240 	 * If the interface for this 'direction' is set, make sure it matches.
17122393Syz155240 	 * An interface name that is not set matches any, as does a name of *.
17132393Syz155240 	 */
17142393Syz155240 	if ((is->is_ifp[idx] == NULL &&
17152393Syz155240 	    (*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '*')) ||
17162393Syz155240 	    is->is_ifp[idx] == ifp)
17172393Syz155240 		ret = 1;
17182393Syz155240 
17192393Syz155240 	if (ret == 0)
17202393Syz155240 		return NULL;
17212393Syz155240 	ret = 0;
17222393Syz155240 
17232393Syz155240 	/*
17242393Syz155240 	 * Match addresses and ports.
17252393Syz155240 	 */
17262393Syz155240 	if (rev == 0) {
17272393Syz155240 		if ((IP6_EQ(&is->is_dst, dst) || (flags & SI_W_DADDR)) &&
17282393Syz155240 		    (IP6_EQ(&is->is_src, src) || (flags & SI_W_SADDR))) {
17292393Syz155240 			if (tcp) {
17302393Syz155240 				if ((sp == is->is_sport || flags & SI_W_SPORT)&&
17312393Syz155240 				    (dp == is->is_dport || flags & SI_W_DPORT))
17322393Syz155240 					ret = 1;
17332393Syz155240 			} else {
17342393Syz155240 				ret = 1;
17352393Syz155240 			}
17362393Syz155240 		}
17372393Syz155240 	} else {
17382393Syz155240 		if ((IP6_EQ(&is->is_dst, src) || (flags & SI_W_DADDR)) &&
17392393Syz155240 		    (IP6_EQ(&is->is_src, dst) || (flags & SI_W_SADDR))) {
17402393Syz155240 			if (tcp) {
17412393Syz155240 				if ((dp == is->is_sport || flags & SI_W_SPORT)&&
17422393Syz155240 				    (sp == is->is_dport || flags & SI_W_DPORT))
17432393Syz155240 					ret = 1;
17442393Syz155240 			} else {
17452393Syz155240 				ret = 1;
17462393Syz155240 			}
17472393Syz155240 		}
17482393Syz155240 	}
17492393Syz155240 
17502393Syz155240 	if (ret == 0)
17512393Syz155240 		return NULL;
17522393Syz155240 
17532393Syz155240 	/*
17542393Syz155240 	 * Whether or not this should be here, is questionable, but the aim
17552393Syz155240 	 * is to get this out of the main line.
17562393Syz155240 	 */
17572393Syz155240 	if (tcp == NULL)
17582393Syz155240 		flags = is->is_flags & ~(SI_WILDP|SI_NEWFR|SI_CLONE|SI_CLONED);
17592393Syz155240 
17602393Syz155240 	/*
17612393Syz155240 	 * Only one of the source or destination address can be flaged as a
17622393Syz155240 	 * wildcard.  Fill in the missing address, if set.
17632393Syz155240 	 * For IPv6, if the address being copied in is multicast, then
17642393Syz155240 	 * don't reset the wild flag - multicast causes it to be set in the
17652393Syz155240 	 * first place!
17662393Syz155240 	 */
17672393Syz155240 	if ((flags & (SI_W_SADDR|SI_W_DADDR))) {
17682393Syz155240 		fr_ip_t *fi = &fin->fin_fi;
17692393Syz155240 
17702393Syz155240 		if ((flags & SI_W_SADDR) != 0) {
17712393Syz155240 			if (rev == 0) {
17722393Syz155240 #ifdef USE_INET6
17732393Syz155240 				if (is->is_v == 6 &&
17742393Syz155240 				    IN6_IS_ADDR_MULTICAST(&fi->fi_src.in6))
17752393Syz155240 					/*EMPTY*/;
17762393Syz155240 				else
17772393Syz155240 #endif
17782393Syz155240 				{
17792393Syz155240 					is->is_src = fi->fi_src;
17802393Syz155240 					is->is_flags &= ~SI_W_SADDR;
17812393Syz155240 				}
17822393Syz155240 			} else {
17832393Syz155240 #ifdef USE_INET6
17842393Syz155240 				if (is->is_v == 6 &&
17852393Syz155240 				    IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6))
17862393Syz155240 					/*EMPTY*/;
17872393Syz155240 				else
17882393Syz155240 #endif
17892393Syz155240 				{
17902393Syz155240 					is->is_src = fi->fi_dst;
17912393Syz155240 					is->is_flags &= ~SI_W_SADDR;
17922393Syz155240 				}
17932393Syz155240 			}
17942393Syz155240 		} else if ((flags & SI_W_DADDR) != 0) {
17952393Syz155240 			if (rev == 0) {
17962393Syz155240 #ifdef USE_INET6
17972393Syz155240 				if (is->is_v == 6 &&
17982393Syz155240 				    IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6))
17992393Syz155240 					/*EMPTY*/;
18002393Syz155240 				else
18012393Syz155240 #endif
18022393Syz155240 				{
18032393Syz155240 					is->is_dst = fi->fi_dst;
18042393Syz155240 					is->is_flags &= ~SI_W_DADDR;
18052393Syz155240 				}
18062393Syz155240 			} else {
18072393Syz155240 #ifdef USE_INET6
18082393Syz155240 				if (is->is_v == 6 &&
18092393Syz155240 				    IN6_IS_ADDR_MULTICAST(&fi->fi_src.in6))
18102393Syz155240 					/*EMPTY*/;
18112393Syz155240 				else
18122393Syz155240 #endif
18132393Syz155240 				{
18142393Syz155240 					is->is_dst = fi->fi_src;
18152393Syz155240 					is->is_flags &= ~SI_W_DADDR;
18162393Syz155240 				}
18172393Syz155240 			}
18182393Syz155240 		}
18192393Syz155240 		if ((is->is_flags & (SI_WILDA|SI_WILDP)) == 0) {
18203448Sdh155122 			ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild);
18212393Syz155240 		}
18222393Syz155240 	}
18232393Syz155240 
18242393Syz155240 	flx = fin->fin_flx & cmask;
18252393Syz155240 	cflx = is->is_flx[out][rev];
18262393Syz155240 
18272393Syz155240 	/*
18282393Syz155240 	 * Match up any flags set from IP options.
18292393Syz155240 	 */
18302393Syz155240 	if ((cflx && (flx != (cflx & cmask))) ||
18312393Syz155240 	    ((fin->fin_optmsk & is->is_optmsk[rev]) != is->is_opt[rev]) ||
18322393Syz155240 	    ((fin->fin_secmsk & is->is_secmsk) != is->is_sec) ||
18332393Syz155240 	    ((fin->fin_auth & is->is_authmsk) != is->is_auth))
18342393Syz155240 		return NULL;
18352393Syz155240 
18362393Syz155240 	/*
18372393Syz155240 	 * Only one of the source or destination port can be flagged as a
18382393Syz155240 	 * wildcard.  When filling it in, fill in a copy of the matched entry
18392393Syz155240 	 * if it has the cloning flag set.
18402393Syz155240 	 */
18412393Syz155240 	if ((fin->fin_flx & FI_IGNORE) != 0) {
18422393Syz155240 		fin->fin_rev = rev;
18432393Syz155240 		return is;
18442393Syz155240 	}
18452393Syz155240 
18462393Syz155240 	if ((flags & (SI_W_SPORT|SI_W_DPORT))) {
18472393Syz155240 		if ((flags & SI_CLONE) != 0) {
18482393Syz155240 			ipstate_t *clone;
18492393Syz155240 
18502393Syz155240 			clone = fr_stclone(fin, tcp, is);
18512393Syz155240 			if (clone == NULL)
18522393Syz155240 				return NULL;
18532393Syz155240 			is = clone;
18542393Syz155240 		} else {
18553448Sdh155122 			ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild);
18562393Syz155240 		}
18572393Syz155240 
18582393Syz155240 		if ((flags & SI_W_SPORT) != 0) {
18592393Syz155240 			if (rev == 0) {
18602393Syz155240 				is->is_sport = sp;
18612393Syz155240 				is->is_send = ntohl(tcp->th_seq);
18622393Syz155240 			} else {
18632393Syz155240 				is->is_sport = dp;
18642393Syz155240 				is->is_send = ntohl(tcp->th_ack);
18652393Syz155240 			}
18662393Syz155240 			is->is_maxsend = is->is_send + 1;
18672393Syz155240 		} else if ((flags & SI_W_DPORT) != 0) {
18682393Syz155240 			if (rev == 0) {
18692393Syz155240 				is->is_dport = dp;
18702393Syz155240 				is->is_dend = ntohl(tcp->th_ack);
18712393Syz155240 			} else {
18722393Syz155240 				is->is_dport = sp;
18732393Syz155240 				is->is_dend = ntohl(tcp->th_seq);
18742393Syz155240 			}
18752393Syz155240 			is->is_maxdend = is->is_dend + 1;
18762393Syz155240 		}
18772393Syz155240 		is->is_flags &= ~(SI_W_SPORT|SI_W_DPORT);
18783448Sdh155122 		if ((flags & SI_CLONED) && ifs->ifs_ipstate_logging)
18793448Sdh155122 			ipstate_log(is, ISL_CLONE, ifs);
18802393Syz155240 	}
18812393Syz155240 
18822393Syz155240 	ret = -1;
18832393Syz155240 
18842393Syz155240 	if (is->is_flx[out][rev] == 0) {
18852393Syz155240 		is->is_flx[out][rev] = flx;
18862393Syz155240 		is->is_opt[rev] = fin->fin_optmsk;
18872393Syz155240 		if (is->is_v == 6) {
18882393Syz155240 			is->is_opt[rev] &= ~0x8;
18892393Syz155240 			is->is_optmsk[rev] &= ~0x8;
18902393Syz155240 		}
18912393Syz155240 	}
18922393Syz155240 
18932393Syz155240 	/*
18942393Syz155240 	 * Check if the interface name for this "direction" is set and if not,
18952393Syz155240 	 * fill it in.
18962393Syz155240 	 */
18972393Syz155240 	if (is->is_ifp[idx] == NULL &&
18982393Syz155240 	    (*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '*')) {
18992393Syz155240 		is->is_ifp[idx] = ifp;
19002958Sdr146992 		COPYIFNAME(ifp, is->is_ifname[idx], fin->fin_v);
19012393Syz155240 	}
19022393Syz155240 	fin->fin_rev = rev;
19032393Syz155240 	return is;
19042393Syz155240 }
19052393Syz155240 
19062393Syz155240 
19072393Syz155240 /* ------------------------------------------------------------------------ */
19082393Syz155240 /* Function:    fr_checkicmpmatchingstate                                   */
19092393Syz155240 /* Returns:     Nil                                                         */
19102393Syz155240 /* Parameters:  fin(I) - pointer to packet information                      */
19112393Syz155240 /*                                                                          */
19122393Syz155240 /* If we've got an ICMP error message, using the information stored in the  */
19132393Syz155240 /* ICMP packet, look for a matching state table entry.                      */
19142393Syz155240 /*                                                                          */
19152393Syz155240 /* If we return NULL then no lock on ipf_state is held.                     */
19162393Syz155240 /* If we return non-null then a read-lock on ipf_state is held.             */
19172393Syz155240 /* ------------------------------------------------------------------------ */
19182393Syz155240 static ipstate_t *fr_checkicmpmatchingstate(fin)
19192393Syz155240 fr_info_t *fin;
19202393Syz155240 {
19212393Syz155240 	ipstate_t *is, **isp;
19222393Syz155240 	u_short sport, dport;
19232393Syz155240 	u_char	pr;
19242393Syz155240 	int backward, i, oi;
19252393Syz155240 	i6addr_t dst, src;
19262393Syz155240 	struct icmp *ic;
19272393Syz155240 	u_short savelen;
19282393Syz155240 	icmphdr_t *icmp;
19292393Syz155240 	fr_info_t ofin;
19302393Syz155240 	tcphdr_t *tcp;
19312393Syz155240 	int len;
19322393Syz155240 	ip_t *oip;
19332393Syz155240 	u_int hv;
19343448Sdh155122 	ipf_stack_t *ifs = fin->fin_ifs;
19352393Syz155240 
19362393Syz155240 	/*
19372393Syz155240 	 * Does it at least have the return (basic) IP header ?
19382393Syz155240 	 * Is it an actual recognised ICMP error type?
19392393Syz155240 	 * Only a basic IP header (no options) should be with
19402393Syz155240 	 * an ICMP error header.
19412393Syz155240 	 */
19422393Syz155240 	if ((fin->fin_v != 4) || (fin->fin_hlen != sizeof(ip_t)) ||
19432393Syz155240 	    (fin->fin_plen < ICMPERR_MINPKTLEN) ||
19442393Syz155240 	    !(fin->fin_flx & FI_ICMPERR))
19452393Syz155240 		return NULL;
19462393Syz155240 	ic = fin->fin_dp;
19472393Syz155240 
19482393Syz155240 	oip = (ip_t *)((char *)ic + ICMPERR_ICMPHLEN);
19492393Syz155240 	/*
19502393Syz155240 	 * Check if the at least the old IP header (with options) and
19512393Syz155240 	 * 8 bytes of payload is present.
19522393Syz155240 	 */
19532393Syz155240 	if (fin->fin_plen < ICMPERR_MAXPKTLEN + ((IP_HL(oip) - 5) << 2))
19542393Syz155240 		return NULL;
19552393Syz155240 
19562393Syz155240 	/*
19572393Syz155240 	 * Sanity Checks.
19582393Syz155240 	 */
19592393Syz155240 	len = fin->fin_dlen - ICMPERR_ICMPHLEN;
19602393Syz155240 	if ((len <= 0) || ((IP_HL(oip) << 2) > len))
19612393Syz155240 		return NULL;
19622393Syz155240 
19632393Syz155240 	/*
19642393Syz155240 	 * Is the buffer big enough for all of it ?  It's the size of the IP
19652393Syz155240 	 * header claimed in the encapsulated part which is of concern.  It
19662393Syz155240 	 * may be too big to be in this buffer but not so big that it's
19672393Syz155240 	 * outside the ICMP packet, leading to TCP deref's causing problems.
19682393Syz155240 	 * This is possible because we don't know how big oip_hl is when we
19692393Syz155240 	 * do the pullup early in fr_check() and thus can't guarantee it is
19702393Syz155240 	 * all here now.
19712393Syz155240 	 */
19722393Syz155240 #ifdef  _KERNEL
19732393Syz155240 	{
19742393Syz155240 	mb_t *m;
19752393Syz155240 
19762393Syz155240 	m = fin->fin_m;
19772393Syz155240 # if defined(MENTAT)
19782393Syz155240 	if ((char *)oip + len > (char *)m->b_wptr)
19792393Syz155240 		return NULL;
19802393Syz155240 # else
19812393Syz155240 	if ((char *)oip + len > (char *)fin->fin_ip + m->m_len)
19822393Syz155240 		return NULL;
19832393Syz155240 # endif
19842393Syz155240 	}
19852393Syz155240 #endif
1986*3607Szf203873 	bcopy((char *)fin, (char *)&ofin, sizeof(*fin));
19872393Syz155240 
19882393Syz155240 	/*
19892393Syz155240 	 * in the IPv4 case we must zero the i6addr union otherwise
19902393Syz155240 	 * the IP6_EQ and IP6_NEQ macros produce the wrong results because
19912393Syz155240 	 * of the 'junk' in the unused part of the union
19922393Syz155240 	 */
19932393Syz155240 	bzero((char *)&src, sizeof(src));
19942393Syz155240 	bzero((char *)&dst, sizeof(dst));
19952393Syz155240 
19962393Syz155240 	/*
19972393Syz155240 	 * we make an fin entry to be able to feed it to
19982393Syz155240 	 * matchsrcdst note that not all fields are encessary
19992393Syz155240 	 * but this is the cleanest way. Note further we fill
20002393Syz155240 	 * in fin_mp such that if someone uses it we'll get
20012393Syz155240 	 * a kernel panic. fr_matchsrcdst does not use this.
20022393Syz155240 	 *
20032393Syz155240 	 * watch out here, as ip is in host order and oip in network
20042393Syz155240 	 * order. Any change we make must be undone afterwards, like
20052393Syz155240 	 * oip->ip_off - it is still in network byte order so fix it.
20062393Syz155240 	 */
20072393Syz155240 	savelen = oip->ip_len;
20082393Syz155240 	oip->ip_len = len;
20092393Syz155240 	oip->ip_off = ntohs(oip->ip_off);
20102393Syz155240 
20112393Syz155240 	ofin.fin_flx = FI_NOCKSUM;
20122393Syz155240 	ofin.fin_v = 4;
20132393Syz155240 	ofin.fin_ip = oip;
20142393Syz155240 	ofin.fin_m = NULL;	/* if dereferenced, panic XXX */
20152393Syz155240 	ofin.fin_mp = NULL;	/* if dereferenced, panic XXX */
20162393Syz155240 	ofin.fin_plen = fin->fin_dlen - ICMPERR_ICMPHLEN;
20172393Syz155240 	(void) fr_makefrip(IP_HL(oip) << 2, oip, &ofin);
20182393Syz155240 	ofin.fin_ifp = fin->fin_ifp;
20192393Syz155240 	ofin.fin_out = !fin->fin_out;
20202393Syz155240 	/*
20212393Syz155240 	 * Reset the short and bad flag here because in fr_matchsrcdst()
20222393Syz155240 	 * the flags for the current packet (fin_flx) are compared against
20232393Syz155240 	 * those for the existing session.
20242393Syz155240 	 */
20252393Syz155240 	ofin.fin_flx &= ~(FI_BAD|FI_SHORT);
20262393Syz155240 
20272393Syz155240 	/*
20282393Syz155240 	 * Put old values of ip_len and ip_off back as we don't know
20292393Syz155240 	 * if we have to forward the packet (or process it again.
20302393Syz155240 	 */
20312393Syz155240 	oip->ip_len = savelen;
20322393Syz155240 	oip->ip_off = htons(oip->ip_off);
20332393Syz155240 
20342393Syz155240 	switch (oip->ip_p)
20352393Syz155240 	{
20362393Syz155240 	case IPPROTO_ICMP :
20372393Syz155240 		/*
20382393Syz155240 		 * an ICMP error can only be generated as a result of an
20392393Syz155240 		 * ICMP query, not as the response on an ICMP error
20402393Syz155240 		 *
20412393Syz155240 		 * XXX theoretically ICMP_ECHOREP and the other reply's are
20422393Syz155240 		 * ICMP query's as well, but adding them here seems strange XXX
20432393Syz155240 		 */
20442393Syz155240 		if ((ofin.fin_flx & FI_ICMPERR) != 0)
20452393Syz155240 		    	return NULL;
20462393Syz155240 
20472393Syz155240 		/*
20482393Syz155240 		 * perform a lookup of the ICMP packet in the state table
20492393Syz155240 		 */
20502393Syz155240 		icmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2));
20512393Syz155240 		hv = (pr = oip->ip_p);
20522393Syz155240 		src.in4 = oip->ip_src;
20532393Syz155240 		hv += src.in4.s_addr;
20542393Syz155240 		dst.in4 = oip->ip_dst;
20552393Syz155240 		hv += dst.in4.s_addr;
20562393Syz155240 		hv += icmp->icmp_id;
20573448Sdh155122 		hv = DOUBLE_HASH(hv, ifs);
20583448Sdh155122 
20593448Sdh155122 		READ_ENTER(&ifs->ifs_ipf_state);
20603448Sdh155122 		for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) {
20612393Syz155240 			isp = &is->is_hnext;
20622393Syz155240 			if ((is->is_p != pr) || (is->is_v != 4))
20632393Syz155240 				continue;
20642393Syz155240 			if (is->is_pass & FR_NOICMPERR)
20652393Syz155240 				continue;
20662393Syz155240 			is = fr_matchsrcdst(&ofin, is, &src, &dst,
20672393Syz155240 					    NULL, FI_ICMPCMP);
20682393Syz155240 			if (is != NULL) {
20692393Syz155240 				if ((is->is_pass & FR_NOICMPERR) != 0) {
20703448Sdh155122 					RWLOCK_EXIT(&ifs->ifs_ipf_state);
20712393Syz155240 					return NULL;
20722393Syz155240 				}
20732393Syz155240 				/*
20742393Syz155240 				 * i  : the index of this packet (the icmp
20752393Syz155240 				 *      unreachable)
20762393Syz155240 				 * oi : the index of the original packet found
20772393Syz155240 				 *      in the icmp header (i.e. the packet
20782393Syz155240 				 *      causing this icmp)
20792393Syz155240 				 * backward : original packet was backward
20802393Syz155240 				 *      compared to the state
20812393Syz155240 				 */
20822393Syz155240 				backward = IP6_NEQ(&is->is_src, &src);
20832393Syz155240 				fin->fin_rev = !backward;
20842393Syz155240 				i = (!backward << 1) + fin->fin_out;
20852393Syz155240 				oi = (backward << 1) + ofin.fin_out;
20862393Syz155240 				if (is->is_icmppkts[i] > is->is_pkts[oi])
20872393Syz155240 					continue;
20883448Sdh155122 				ifs->ifs_ips_stats.iss_hits++;
20892393Syz155240 				is->is_icmppkts[i]++;
20902393Syz155240 				return is;
20912393Syz155240 			}
20922393Syz155240 		}
20933448Sdh155122 		RWLOCK_EXIT(&ifs->ifs_ipf_state);
20942393Syz155240 		return NULL;
20952393Syz155240 	case IPPROTO_TCP :
20962393Syz155240 	case IPPROTO_UDP :
20972393Syz155240 		break;
20982393Syz155240 	default :
20992393Syz155240 		return NULL;
21002393Syz155240 	}
21012393Syz155240 
21022393Syz155240 	tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2));
21032393Syz155240 	dport = tcp->th_dport;
21042393Syz155240 	sport = tcp->th_sport;
21052393Syz155240 
21062393Syz155240 	hv = (pr = oip->ip_p);
21072393Syz155240 	src.in4 = oip->ip_src;
21082393Syz155240 	hv += src.in4.s_addr;
21092393Syz155240 	dst.in4 = oip->ip_dst;
21102393Syz155240 	hv += dst.in4.s_addr;
21112393Syz155240 	hv += dport;
21122393Syz155240 	hv += sport;
21133448Sdh155122 	hv = DOUBLE_HASH(hv, ifs);
21143448Sdh155122 
21153448Sdh155122 	READ_ENTER(&ifs->ifs_ipf_state);
21163448Sdh155122 	for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) {
21172393Syz155240 		isp = &is->is_hnext;
21182393Syz155240 		/*
21192393Syz155240 		 * Only allow this icmp though if the
21202393Syz155240 		 * encapsulated packet was allowed through the
21212393Syz155240 		 * other way around. Note that the minimal amount
21222393Syz155240 		 * of info present does not allow for checking against
21232393Syz155240 		 * tcp internals such as seq and ack numbers.   Only the
21242393Syz155240 		 * ports are known to be present and can be even if the
21252393Syz155240 		 * short flag is set.
21262393Syz155240 		 */
21272393Syz155240 		if ((is->is_p == pr) && (is->is_v == 4) &&
21282393Syz155240 		    (is = fr_matchsrcdst(&ofin, is, &src, &dst,
21292393Syz155240 					 tcp, FI_ICMPCMP))) {
21302393Syz155240 			/*
21312393Syz155240 			 * i  : the index of this packet (the icmp unreachable)
21322393Syz155240 			 * oi : the index of the original packet found in the
21332393Syz155240 			 *      icmp header (i.e. the packet causing this icmp)
21342393Syz155240 			 * backward : original packet was backward compared to
21352393Syz155240 			 *            the state
21362393Syz155240 			 */
21372393Syz155240 			backward = IP6_NEQ(&is->is_src, &src);
21382393Syz155240 			fin->fin_rev = !backward;
21392393Syz155240 			i = (!backward << 1) + fin->fin_out;
21402393Syz155240 			oi = (backward << 1) + ofin.fin_out;
21412393Syz155240 
21422393Syz155240 			if (((is->is_pass & FR_NOICMPERR) != 0) ||
21432393Syz155240 			    (is->is_icmppkts[i] > is->is_pkts[oi]))
21442393Syz155240 				break;
21453448Sdh155122 			ifs->ifs_ips_stats.iss_hits++;
21462393Syz155240 			is->is_icmppkts[i]++;
21472393Syz155240 			/*
21482393Syz155240 			 * we deliberately do not touch the timeouts
21492393Syz155240 			 * for the accompanying state table entry.
21502393Syz155240 			 * It remains to be seen if that is correct. XXX
21512393Syz155240 			 */
21522393Syz155240 			return is;
21532393Syz155240 		}
21542393Syz155240 	}
21553448Sdh155122 	RWLOCK_EXIT(&ifs->ifs_ipf_state);
21562393Syz155240 	return NULL;
21572393Syz155240 }
21582393Syz155240 
21592393Syz155240 
21602393Syz155240 /* ------------------------------------------------------------------------ */
21612393Syz155240 /* Function:    fr_ipsmove                                                  */
21622393Syz155240 /* Returns:     Nil                                                         */
21632393Syz155240 /* Parameters:  is(I) - pointer to state table entry                        */
21642393Syz155240 /*              hv(I) - new hash value for state table entry                */
21652393Syz155240 /* Write Locks: ipf_state                                                   */
21662393Syz155240 /*                                                                          */
21672393Syz155240 /* Move a state entry from one position in the hash table to another.       */
21682393Syz155240 /* ------------------------------------------------------------------------ */
21693448Sdh155122 static void fr_ipsmove(is, hv, ifs)
21702393Syz155240 ipstate_t *is;
21712393Syz155240 u_int hv;
21723448Sdh155122 ipf_stack_t *ifs;
21732393Syz155240 {
21742393Syz155240 	ipstate_t **isp;
21752393Syz155240 	u_int hvm;
21762393Syz155240 
21773448Sdh155122 	ASSERT(rw_read_locked(&ifs->ifs_ipf_state.ipf_lk) == 0);
21782393Syz155240 
21792393Syz155240 	hvm = is->is_hv;
21802393Syz155240 	/*
21812393Syz155240 	 * Remove the hash from the old location...
21822393Syz155240 	 */
21832393Syz155240 	isp = is->is_phnext;
21842393Syz155240 	if (is->is_hnext)
21852393Syz155240 		is->is_hnext->is_phnext = isp;
21862393Syz155240 	*isp = is->is_hnext;
21873448Sdh155122 	if (ifs->ifs_ips_table[hvm] == NULL)
21883448Sdh155122 		ifs->ifs_ips_stats.iss_inuse--;
21893448Sdh155122 	ifs->ifs_ips_stats.iss_bucketlen[hvm]--;
21902393Syz155240 
21912393Syz155240 	/*
21922393Syz155240 	 * ...and put the hash in the new one.
21932393Syz155240 	 */
21943448Sdh155122 	hvm = DOUBLE_HASH(hv, ifs);
21952393Syz155240 	is->is_hv = hvm;
21963448Sdh155122 	isp = &ifs->ifs_ips_table[hvm];
21972393Syz155240 	if (*isp)
21982393Syz155240 		(*isp)->is_phnext = &is->is_hnext;
21992393Syz155240 	else
22003448Sdh155122 		ifs->ifs_ips_stats.iss_inuse++;
22013448Sdh155122 	ifs->ifs_ips_stats.iss_bucketlen[hvm]++;
22022393Syz155240 	is->is_phnext = isp;
22032393Syz155240 	is->is_hnext = *isp;
22042393Syz155240 	*isp = is;
22052393Syz155240 }
22062393Syz155240 
22072393Syz155240 
22082393Syz155240 /* ------------------------------------------------------------------------ */
22092393Syz155240 /* Function:    fr_stlookup                                                 */
22102393Syz155240 /* Returns:     ipstate_t* - NULL == no matching state found,               */
22112393Syz155240 /*                           else pointer to state information is returned  */
22122393Syz155240 /* Parameters:  fin(I) - pointer to packet information                      */
22132393Syz155240 /*              tcp(I) - pointer to TCP/UDP header.                         */
22142393Syz155240 /*                                                                          */
22152393Syz155240 /* Search the state table for a matching entry to the packet described by   */
22162393Syz155240 /* the contents of *fin.                                                    */
22172393Syz155240 /*                                                                          */
22182393Syz155240 /* If we return NULL then no lock on ipf_state is held.                     */
22192393Syz155240 /* If we return non-null then a read-lock on ipf_state is held.             */
22202393Syz155240 /* ------------------------------------------------------------------------ */
22212393Syz155240 ipstate_t *fr_stlookup(fin, tcp, ifqp)
22222393Syz155240 fr_info_t *fin;
22232393Syz155240 tcphdr_t *tcp;
22242393Syz155240 ipftq_t **ifqp;
22252393Syz155240 {
22262393Syz155240 	u_int hv, hvm, pr, v, tryagain;
22272393Syz155240 	ipstate_t *is, **isp;
22282393Syz155240 	u_short dport, sport;
22292393Syz155240 	i6addr_t src, dst;
22302393Syz155240 	struct icmp *ic;
22312393Syz155240 	ipftq_t *ifq;
22322393Syz155240 	int oow;
22333448Sdh155122 	ipf_stack_t *ifs = fin->fin_ifs;
22342393Syz155240 
22352393Syz155240 	is = NULL;
22362393Syz155240 	ifq = NULL;
22372393Syz155240 	tcp = fin->fin_dp;
22382393Syz155240 	ic = (struct icmp *)tcp;
22392393Syz155240 	hv = (pr = fin->fin_fi.fi_p);
22402393Syz155240 	src = fin->fin_fi.fi_src;
22412393Syz155240 	dst = fin->fin_fi.fi_dst;
22422393Syz155240 	hv += src.in4.s_addr;
22432393Syz155240 	hv += dst.in4.s_addr;
22442393Syz155240 
22452393Syz155240 	v = fin->fin_fi.fi_v;
22462393Syz155240 #ifdef	USE_INET6
22472393Syz155240 	if (v == 6) {
22482393Syz155240 		hv  += fin->fin_fi.fi_src.i6[1];
22492393Syz155240 		hv  += fin->fin_fi.fi_src.i6[2];
22502393Syz155240 		hv  += fin->fin_fi.fi_src.i6[3];
22512393Syz155240 
22522393Syz155240 		if ((fin->fin_p == IPPROTO_ICMPV6) &&
22532393Syz155240 		    IN6_IS_ADDR_MULTICAST(&fin->fin_fi.fi_dst.in6)) {
22542393Syz155240 			hv -= dst.in4.s_addr;
22552393Syz155240 		} else {
22562393Syz155240 			hv += fin->fin_fi.fi_dst.i6[1];
22572393Syz155240 			hv += fin->fin_fi.fi_dst.i6[2];
22582393Syz155240 			hv += fin->fin_fi.fi_dst.i6[3];
22592393Syz155240 		}
22602393Syz155240 	}
22612393Syz155240 #endif
22622393Syz155240 
22632393Syz155240 	/*
22642393Syz155240 	 * Search the hash table for matching packet header info.
22652393Syz155240 	 */
22662393Syz155240 	switch (pr)
22672393Syz155240 	{
22682393Syz155240 #ifdef	USE_INET6
22692393Syz155240 	case IPPROTO_ICMPV6 :
22702393Syz155240 		tryagain = 0;
22712393Syz155240 		if (v == 6) {
22722393Syz155240 			if ((ic->icmp_type == ICMP6_ECHO_REQUEST) ||
22732393Syz155240 			    (ic->icmp_type == ICMP6_ECHO_REPLY)) {
22742393Syz155240 				hv += ic->icmp_id;
22752393Syz155240 			}
22762393Syz155240 		}
22773448Sdh155122 		READ_ENTER(&ifs->ifs_ipf_state);
22782393Syz155240 icmp6again:
22793448Sdh155122 		hvm = DOUBLE_HASH(hv, ifs);
22803448Sdh155122 		for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) {
22812393Syz155240 			isp = &is->is_hnext;
22822393Syz155240 			if ((is->is_p != pr) || (is->is_v != v))
22832393Syz155240 				continue;
22842393Syz155240 			is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP);
22852393Syz155240 			if (is != NULL &&
22862393Syz155240 			    fr_matchicmpqueryreply(v, &is->is_icmp,
22872393Syz155240 						   ic, fin->fin_rev)) {
22882393Syz155240 				if (fin->fin_rev)
22893448Sdh155122 					ifq = &ifs->ifs_ips_icmpacktq;
22902393Syz155240 				else
22913448Sdh155122 					ifq = &ifs->ifs_ips_icmptq;
22922393Syz155240 				break;
22932393Syz155240 			}
22942393Syz155240 		}
22952393Syz155240 
22962393Syz155240 		if (is != NULL) {
22972393Syz155240 			if ((tryagain != 0) && !(is->is_flags & SI_W_DADDR)) {
22982393Syz155240 				hv += fin->fin_fi.fi_src.i6[0];
22992393Syz155240 				hv += fin->fin_fi.fi_src.i6[1];
23002393Syz155240 				hv += fin->fin_fi.fi_src.i6[2];
23012393Syz155240 				hv += fin->fin_fi.fi_src.i6[3];
23023448Sdh155122 				fr_ipsmove(is, hv, ifs);
23033448Sdh155122 				MUTEX_DOWNGRADE(&ifs->ifs_ipf_state);
23042393Syz155240 			}
23052393Syz155240 			break;
23062393Syz155240 		}
23073448Sdh155122 		RWLOCK_EXIT(&ifs->ifs_ipf_state);
23082393Syz155240 
23092393Syz155240 		/*
23102393Syz155240 		 * No matching icmp state entry. Perhaps this is a
23112393Syz155240 		 * response to another state entry.
23122393Syz155240 		 *
23132393Syz155240 		 * XXX With some ICMP6 packets, the "other" address is already
23142393Syz155240 		 * in the packet, after the ICMP6 header, and this could be
23152393Syz155240 		 * used in place of the multicast address.  However, taking
23162393Syz155240 		 * advantage of this requires some significant code changes
23172393Syz155240 		 * to handle the specific types where that is the case.
23182393Syz155240 		 */
23193448Sdh155122 		if ((ifs->ifs_ips_stats.iss_wild != 0) && (v == 6) && (tryagain == 0) &&
23202393Syz155240 		    !IN6_IS_ADDR_MULTICAST(&fin->fin_fi.fi_src.in6)) {
23212393Syz155240 			hv -= fin->fin_fi.fi_src.i6[0];
23222393Syz155240 			hv -= fin->fin_fi.fi_src.i6[1];
23232393Syz155240 			hv -= fin->fin_fi.fi_src.i6[2];
23242393Syz155240 			hv -= fin->fin_fi.fi_src.i6[3];
23252393Syz155240 			tryagain = 1;
23263448Sdh155122 			WRITE_ENTER(&ifs->ifs_ipf_state);
23272393Syz155240 			goto icmp6again;
23282393Syz155240 		}
23292393Syz155240 
23302393Syz155240 		is = fr_checkicmp6matchingstate(fin);
23312393Syz155240 		if (is != NULL)
23322393Syz155240 			return is;
23332393Syz155240 		break;
23342393Syz155240 #endif
23352393Syz155240 
23362393Syz155240 	case IPPROTO_ICMP :
23372393Syz155240 		if (v == 4) {
23382393Syz155240 			hv += ic->icmp_id;
23392393Syz155240 		}
23403448Sdh155122 		hv = DOUBLE_HASH(hv, ifs);
23413448Sdh155122 		READ_ENTER(&ifs->ifs_ipf_state);
23423448Sdh155122 		for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) {
23432393Syz155240 			isp = &is->is_hnext;
23442393Syz155240 			if ((is->is_p != pr) || (is->is_v != v))
23452393Syz155240 				continue;
23462393Syz155240 			is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP);
23472393Syz155240 			if (is != NULL &&
23482393Syz155240 			    fr_matchicmpqueryreply(v, &is->is_icmp,
23492393Syz155240 						   ic, fin->fin_rev)) {
23502393Syz155240 				if (fin->fin_rev)
23513448Sdh155122 					ifq = &ifs->ifs_ips_icmpacktq;
23522393Syz155240 				else
23533448Sdh155122 					ifq = &ifs->ifs_ips_icmptq;
23542393Syz155240 				break;
23552393Syz155240 			}
23562393Syz155240 		}
23572393Syz155240 		if (is == NULL) {
23583448Sdh155122 			RWLOCK_EXIT(&ifs->ifs_ipf_state);
23592393Syz155240 		}
23602393Syz155240 		break;
23612393Syz155240 
23622393Syz155240 	case IPPROTO_TCP :
23632393Syz155240 	case IPPROTO_UDP :
23642393Syz155240 		ifqp = NULL;
23652393Syz155240 		sport = htons(fin->fin_data[0]);
23662393Syz155240 		hv += sport;
23672393Syz155240 		dport = htons(fin->fin_data[1]);
23682393Syz155240 		hv += dport;
23692393Syz155240 		oow = 0;
23702393Syz155240 		tryagain = 0;
23713448Sdh155122 		READ_ENTER(&ifs->ifs_ipf_state);
23722393Syz155240 retry_tcpudp:
23733448Sdh155122 		hvm = DOUBLE_HASH(hv, ifs);
23743448Sdh155122 		for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) {
23752393Syz155240 			isp = &is->is_hnext;
23762393Syz155240 			if ((is->is_p != pr) || (is->is_v != v))
23772393Syz155240 				continue;
23782393Syz155240 			fin->fin_flx &= ~FI_OOW;
23792393Syz155240 			is = fr_matchsrcdst(fin, is, &src, &dst, tcp, FI_CMP);
23802393Syz155240 			if (is != NULL) {
23812393Syz155240 				if (pr == IPPROTO_TCP) {
23822393Syz155240 					if (!fr_tcpstate(fin, tcp, is)) {
23832393Syz155240 						oow |= fin->fin_flx & FI_OOW;
23842393Syz155240 						continue;
23852393Syz155240 					}
23862393Syz155240 				}
23872393Syz155240 				break;
23882393Syz155240 			}
23892393Syz155240 		}
23902393Syz155240 		if (is != NULL) {
23912393Syz155240 			if (tryagain &&
23922393Syz155240 			    !(is->is_flags & (SI_CLONE|SI_WILDP|SI_WILDA))) {
23932393Syz155240 				hv += dport;
23942393Syz155240 				hv += sport;
23953448Sdh155122 				fr_ipsmove(is, hv, ifs);
23963448Sdh155122 				MUTEX_DOWNGRADE(&ifs->ifs_ipf_state);
23972393Syz155240 			}
23982393Syz155240 			break;
23992393Syz155240 		}
24003448Sdh155122 		RWLOCK_EXIT(&ifs->ifs_ipf_state);
24013448Sdh155122 
24023448Sdh155122 		if (!tryagain && ifs->ifs_ips_stats.iss_wild) {
24032393Syz155240 			hv -= dport;
24042393Syz155240 			hv -= sport;
24052393Syz155240 			tryagain = 1;
24063448Sdh155122 			WRITE_ENTER(&ifs->ifs_ipf_state);
24072393Syz155240 			goto retry_tcpudp;
24082393Syz155240 		}
24092393Syz155240 		fin->fin_flx |= oow;
24102393Syz155240 		break;
24112393Syz155240 
24122393Syz155240 #if 0
24132393Syz155240 	case IPPROTO_GRE :
24142393Syz155240 		gre = fin->fin_dp;
24152393Syz155240 		if (GRE_REV(gre->gr_flags) == 1) {
24162393Syz155240 			hv += gre->gr_call;
24172393Syz155240 		}
24182393Syz155240 		/* FALLTHROUGH */
24192393Syz155240 #endif
24202393Syz155240 	default :
24212393Syz155240 		ifqp = NULL;
24223448Sdh155122 		hvm = DOUBLE_HASH(hv, ifs);
24233448Sdh155122 		READ_ENTER(&ifs->ifs_ipf_state);
24243448Sdh155122 		for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) {
24252393Syz155240 			isp = &is->is_hnext;
24262393Syz155240 			if ((is->is_p != pr) || (is->is_v != v))
24272393Syz155240 				continue;
24282393Syz155240 			is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP);
24292393Syz155240 			if (is != NULL) {
24303448Sdh155122 				ifq = &ifs->ifs_ips_iptq;
24312393Syz155240 				break;
24322393Syz155240 			}
24332393Syz155240 		}
24342393Syz155240 		if (is == NULL) {
24353448Sdh155122 			RWLOCK_EXIT(&ifs->ifs_ipf_state);
24362393Syz155240 		}
24372393Syz155240 		break;
24382393Syz155240 	}
24392393Syz155240 
24402393Syz155240 	if ((is != NULL) && ((is->is_sti.tqe_flags & TQE_RULEBASED) != 0) &&
24412393Syz155240 	    (is->is_tqehead[fin->fin_rev] != NULL))
24422393Syz155240 		ifq = is->is_tqehead[fin->fin_rev];
24432393Syz155240 	if (ifq != NULL && ifqp != NULL)
24442393Syz155240 		*ifqp = ifq;
24452393Syz155240 	return is;
24462393Syz155240 }
24472393Syz155240 
24482393Syz155240 
24492393Syz155240 /* ------------------------------------------------------------------------ */
24502393Syz155240 /* Function:    fr_updatestate                                              */
24512393Syz155240 /* Returns:     Nil                                                         */
24522393Syz155240 /* Parameters:  fin(I) - pointer to packet information                      */
24532393Syz155240 /*              is(I)  - pointer to state table entry                       */
24542393Syz155240 /* Read Locks:  ipf_state                                                   */
24552393Syz155240 /*                                                                          */
24562393Syz155240 /* Updates packet and byte counters for a newly received packet.  Seeds the */
24572393Syz155240 /* fragment cache with a new entry as required.                             */
24582393Syz155240 /* ------------------------------------------------------------------------ */
24592393Syz155240 void fr_updatestate(fin, is, ifq)
24602393Syz155240 fr_info_t *fin;
24612393Syz155240 ipstate_t *is;
24622393Syz155240 ipftq_t *ifq;
24632393Syz155240 {
24642393Syz155240 	ipftqent_t *tqe;
24652393Syz155240 	int i, pass;
24663448Sdh155122 	ipf_stack_t *ifs = fin->fin_ifs;
24672393Syz155240 
24682393Syz155240 	i = (fin->fin_rev << 1) + fin->fin_out;
24692393Syz155240 
24702393Syz155240 	/*
24712393Syz155240 	 * For TCP packets, ifq == NULL.  For all others, check if this new
24722393Syz155240 	 * queue is different to the last one it was on and move it if so.
24732393Syz155240 	 */
24742393Syz155240 	tqe = &is->is_sti;
24752393Syz155240 	MUTEX_ENTER(&is->is_lock);
24762393Syz155240 	if ((tqe->tqe_flags & TQE_RULEBASED) != 0)
24772393Syz155240 		ifq = is->is_tqehead[fin->fin_rev];
24782393Syz155240 
24792393Syz155240 	if (ifq != NULL)
24803448Sdh155122 		fr_movequeue(tqe, tqe->tqe_ifq, ifq, ifs);
24812393Syz155240 
24822393Syz155240 	is->is_pkts[i]++;
24832393Syz155240 	is->is_bytes[i] += fin->fin_plen;
24842393Syz155240 	MUTEX_EXIT(&is->is_lock);
24852393Syz155240 
24862393Syz155240 #ifdef	IPFILTER_SYNC
24872393Syz155240 	if (is->is_flags & IS_STATESYNC)
24882393Syz155240 		ipfsync_update(SMC_STATE, fin, is->is_sync);
24892393Syz155240 #endif
24902393Syz155240 
24913448Sdh155122 	ATOMIC_INCL(ifs->ifs_ips_stats.iss_hits);
24922393Syz155240 
24932393Syz155240 	fin->fin_fr = is->is_rule;
24942393Syz155240 
24952393Syz155240 	/*
24962393Syz155240 	 * If this packet is a fragment and the rule says to track fragments,
24972393Syz155240 	 * then create a new fragment cache entry.
24982393Syz155240 	 */
24992393Syz155240 	pass = is->is_pass;
25002393Syz155240 	if ((fin->fin_flx & FI_FRAG) && FR_ISPASS(pass))
25012393Syz155240 		(void) fr_newfrag(fin, pass ^ FR_KEEPSTATE);
25022393Syz155240 }
25032393Syz155240 
25042393Syz155240 
25052393Syz155240 /* ------------------------------------------------------------------------ */
25062393Syz155240 /* Function:    fr_checkstate                                               */
25072393Syz155240 /* Returns:     frentry_t* - NULL == search failed,                         */
25082393Syz155240 /*                           else pointer to rule for matching state        */
25092393Syz155240 /* Parameters:  ifp(I)   - pointer to interface                             */
25102393Syz155240 /*              passp(I) - pointer to filtering result flags                */
25112393Syz155240 /*                                                                          */
25122393Syz155240 /* Check if a packet is associated with an entry in the state table.        */
25132393Syz155240 /* ------------------------------------------------------------------------ */
25142393Syz155240 frentry_t *fr_checkstate(fin, passp)
25152393Syz155240 fr_info_t *fin;
25162393Syz155240 u_32_t *passp;
25172393Syz155240 {
25182393Syz155240 	ipstate_t *is;
25192393Syz155240 	frentry_t *fr;
25202393Syz155240 	tcphdr_t *tcp;
25212393Syz155240 	ipftq_t *ifq;
25222393Syz155240 	u_int pass;
25233448Sdh155122 	ipf_stack_t *ifs = fin->fin_ifs;
25243448Sdh155122 
25253448Sdh155122 	if (ifs->ifs_fr_state_lock || (ifs->ifs_ips_list == NULL) ||
25262393Syz155240 	    (fin->fin_flx & (FI_SHORT|FI_STATE|FI_FRAGBODY|FI_BAD)))
25272393Syz155240 		return NULL;
25282393Syz155240 
25292393Syz155240 	is = NULL;
25302393Syz155240 	if ((fin->fin_flx & FI_TCPUDP) ||
25312393Syz155240 	    (fin->fin_fi.fi_p == IPPROTO_ICMP)
25322393Syz155240 #ifdef	USE_INET6
25332393Syz155240 	    || (fin->fin_fi.fi_p == IPPROTO_ICMPV6)
25342393Syz155240 #endif
25352393Syz155240 	    )
25362393Syz155240 		tcp = fin->fin_dp;
25372393Syz155240 	else
25382393Syz155240 		tcp = NULL;
25392393Syz155240 
25402393Syz155240 	/*
25412393Syz155240 	 * Search the hash table for matching packet header info.
25422393Syz155240 	 */
25432393Syz155240 	ifq = NULL;
25442393Syz155240 	is = fin->fin_state;
25452393Syz155240 	if (is == NULL)
25462393Syz155240 		is = fr_stlookup(fin, tcp, &ifq);
25472393Syz155240 	switch (fin->fin_p)
25482393Syz155240 	{
25492393Syz155240 #ifdef	USE_INET6
25502393Syz155240 	case IPPROTO_ICMPV6 :
25512393Syz155240 		if (is != NULL)
25522393Syz155240 			break;
25532393Syz155240 		if (fin->fin_v == 6) {
25542393Syz155240 			is = fr_checkicmp6matchingstate(fin);
25552393Syz155240 			if (is != NULL)
25562393Syz155240 				goto matched;
25572393Syz155240 		}
25582393Syz155240 		break;
25592393Syz155240 #endif
25602393Syz155240 	case IPPROTO_ICMP :
25612393Syz155240 		if (is != NULL)
25622393Syz155240 			break;
25632393Syz155240 		/*
25642393Syz155240 		 * No matching icmp state entry. Perhaps this is a
25652393Syz155240 		 * response to another state entry.
25662393Syz155240 		 */
25672393Syz155240 		is = fr_checkicmpmatchingstate(fin);
25682393Syz155240 		if (is != NULL)
25692393Syz155240 			goto matched;
25702393Syz155240 		break;
25712393Syz155240 	case IPPROTO_TCP :
25722393Syz155240 		if (is == NULL)
25732393Syz155240 			break;
25742393Syz155240 
25752393Syz155240 		if (is->is_pass & FR_NEWISN) {
25762393Syz155240 			if (fin->fin_out == 0)
25772393Syz155240 				fr_fixinisn(fin, is);
25782393Syz155240 			else if (fin->fin_out == 1)
25792393Syz155240 				fr_fixoutisn(fin, is);
25802393Syz155240 		}
25812393Syz155240 		break;
25822393Syz155240 	default :
25832393Syz155240 		if (fin->fin_rev)
25843448Sdh155122 			ifq = &ifs->ifs_ips_udpacktq;
25852393Syz155240 		else
25863448Sdh155122 			ifq = &ifs->ifs_ips_udptq;
25872393Syz155240 		break;
25882393Syz155240 	}
25892393Syz155240 	if (is == NULL) {
25903448Sdh155122 		ATOMIC_INCL(ifs->ifs_ips_stats.iss_miss);
25912393Syz155240 		return NULL;
25922393Syz155240 	}
25932393Syz155240 
25942393Syz155240 matched:
25952393Syz155240 	fr = is->is_rule;
25962393Syz155240 	if (fr != NULL) {
25972393Syz155240 		if ((fin->fin_out == 0) && (fr->fr_nattag.ipt_num[0] != 0)) {
25982393Syz155240 			if (fin->fin_nattag == NULL)
25992393Syz155240 				return NULL;
26002393Syz155240 			if (fr_matchtag(&fr->fr_nattag, fin->fin_nattag) != 0)
26012393Syz155240 				return NULL;
26022393Syz155240 		}
26032393Syz155240 		(void) strncpy(fin->fin_group, fr->fr_group, FR_GROUPLEN);
26042393Syz155240 		fin->fin_icode = fr->fr_icode;
26052393Syz155240 	}
26062393Syz155240 
26072393Syz155240 	fin->fin_rule = is->is_rulen;
26082393Syz155240 	pass = is->is_pass;
26092393Syz155240 	fr_updatestate(fin, is, ifq);
26102393Syz155240 	if (fin->fin_out == 1)
26112393Syz155240 		fin->fin_nat = is->is_nat[fin->fin_rev];
26122393Syz155240 
26132393Syz155240 	fin->fin_state = is;
26143448Sdh155122 	is->is_touched = ifs->ifs_fr_ticks;
26152393Syz155240 	MUTEX_ENTER(&is->is_lock);
26162393Syz155240 	is->is_ref++;
26172393Syz155240 	MUTEX_EXIT(&is->is_lock);
26183448Sdh155122 	RWLOCK_EXIT(&ifs->ifs_ipf_state);
26192393Syz155240 	fin->fin_flx |= FI_STATE;
26202393Syz155240 	if ((pass & FR_LOGFIRST) != 0)
26212393Syz155240 		pass &= ~(FR_LOGFIRST|FR_LOG);
26222393Syz155240 	*passp = pass;
26232393Syz155240 	return fr;
26242393Syz155240 }
26252393Syz155240 
26262393Syz155240 
26272393Syz155240 /* ------------------------------------------------------------------------ */
26282393Syz155240 /* Function:    fr_fixoutisn                                                */
26292393Syz155240 /* Returns:     Nil                                                         */
26302393Syz155240 /* Parameters:  fin(I)   - pointer to packet information                    */
26312393Syz155240 /*              is(I)  - pointer to master state structure                  */
26322393Syz155240 /*                                                                          */
26332393Syz155240 /* Called only for outbound packets, adjusts the sequence number and the    */
26342393Syz155240 /* TCP checksum to match that change.                                       */
26352393Syz155240 /* ------------------------------------------------------------------------ */
26362393Syz155240 static void fr_fixoutisn(fin, is)
26372393Syz155240 fr_info_t *fin;
26382393Syz155240 ipstate_t *is;
26392393Syz155240 {
26402393Syz155240 	tcphdr_t *tcp;
26412393Syz155240 	int rev;
26422393Syz155240 	u_32_t seq;
26432393Syz155240 
26442393Syz155240 	tcp = fin->fin_dp;
26452393Syz155240 	rev = fin->fin_rev;
26462393Syz155240 	if ((is->is_flags & IS_ISNSYN) != 0) {
26472393Syz155240 		if (rev == 0) {
26482393Syz155240 			seq = ntohl(tcp->th_seq);
26492393Syz155240 			seq += is->is_isninc[0];
26502393Syz155240 			tcp->th_seq = htonl(seq);
26512958Sdr146992 			fix_outcksum(&tcp->th_sum, is->is_sumd[0]);
26522393Syz155240 		}
26532393Syz155240 	}
26542393Syz155240 	if ((is->is_flags & IS_ISNACK) != 0) {
26552393Syz155240 		if (rev == 1) {
26562393Syz155240 			seq = ntohl(tcp->th_seq);
26572393Syz155240 			seq += is->is_isninc[1];
26582393Syz155240 			tcp->th_seq = htonl(seq);
26592958Sdr146992 			fix_outcksum(&tcp->th_sum, is->is_sumd[1]);
26602393Syz155240 		}
26612393Syz155240 	}
26622393Syz155240 }
26632393Syz155240 
26642393Syz155240 
26652393Syz155240 /* ------------------------------------------------------------------------ */
26662393Syz155240 /* Function:    fr_fixinisn                                                 */
26672393Syz155240 /* Returns:     Nil                                                         */
26682393Syz155240 /* Parameters:  fin(I)   - pointer to packet information                    */
26692393Syz155240 /*              is(I)  - pointer to master state structure                  */
26702393Syz155240 /*                                                                          */
26712393Syz155240 /* Called only for inbound packets, adjusts the acknowledge number and the  */
26722393Syz155240 /* TCP checksum to match that change.                                       */
26732393Syz155240 /* ------------------------------------------------------------------------ */
26742393Syz155240 static void fr_fixinisn(fin, is)
26752393Syz155240 fr_info_t *fin;
26762393Syz155240 ipstate_t *is;
26772393Syz155240 {
26782393Syz155240 	tcphdr_t *tcp;
26792393Syz155240 	int rev;
26802393Syz155240 	u_32_t ack;
26812393Syz155240 
26822393Syz155240 	tcp = fin->fin_dp;
26832393Syz155240 	rev = fin->fin_rev;
26842393Syz155240 	if ((is->is_flags & IS_ISNSYN) != 0) {
26852393Syz155240 		if (rev == 1) {
26862393Syz155240 			ack = ntohl(tcp->th_ack);
26872393Syz155240 			ack -= is->is_isninc[0];
26882393Syz155240 			tcp->th_ack = htonl(ack);
26892958Sdr146992 			fix_incksum(&tcp->th_sum, is->is_sumd[0]);
26902393Syz155240 		}
26912393Syz155240 	}
26922393Syz155240 	if ((is->is_flags & IS_ISNACK) != 0) {
26932393Syz155240 		if (rev == 0) {
26942393Syz155240 			ack = ntohl(tcp->th_ack);
26952393Syz155240 			ack -= is->is_isninc[1];
26962393Syz155240 			tcp->th_ack = htonl(ack);
26972958Sdr146992 			fix_incksum(&tcp->th_sum, is->is_sumd[1]);
26982393Syz155240 		}
26992393Syz155240 	}
27002393Syz155240 }
27012393Syz155240 
27022393Syz155240 
27032393Syz155240 /* ------------------------------------------------------------------------ */
27042393Syz155240 /* Function:    fr_statesync                                                */
27052393Syz155240 /* Returns:     Nil                                                         */
27062958Sdr146992 /* Parameters:  action(I) - type of synchronisation to do                   */
27072958Sdr146992 /*              v(I)      - IP version being sync'd (v4 or v6)              */
27082958Sdr146992 /*              ifp(I)    - interface identifier associated with action     */
27092958Sdr146992 /*              name(I)   - name associated with ifp parameter              */
27102393Syz155240 /*                                                                          */
27112393Syz155240 /* Walk through all state entries and if an interface pointer match is      */
27122393Syz155240 /* found then look it up again, based on its name in case the pointer has   */
27132393Syz155240 /* changed since last time.                                                 */
27142393Syz155240 /*                                                                          */
27152393Syz155240 /* If ifp is passed in as being non-null then we are only doing updates for */
27162393Syz155240 /* existing, matching, uses of it.                                          */
27172393Syz155240 /* ------------------------------------------------------------------------ */
27183448Sdh155122 void fr_statesync(action, v, ifp, name, ifs)
27192958Sdr146992 int action, v;
27202393Syz155240 void *ifp;
27212958Sdr146992 char *name;
27223448Sdh155122 ipf_stack_t *ifs;
27232393Syz155240 {
27242393Syz155240 	ipstate_t *is;
27252393Syz155240 	int i;
27262393Syz155240 
27273448Sdh155122 	if (ifs->ifs_fr_running <= 0)
27282393Syz155240 		return;
27292393Syz155240 
27303448Sdh155122 	WRITE_ENTER(&ifs->ifs_ipf_state);
27313448Sdh155122 
27323448Sdh155122 	if (ifs->ifs_fr_running <= 0) {
27333448Sdh155122 		RWLOCK_EXIT(&ifs->ifs_ipf_state);
27342393Syz155240 		return;
27352393Syz155240 	}
27362393Syz155240 
27372958Sdr146992 	switch (action)
27382958Sdr146992 	{
27392958Sdr146992 	case IPFSYNC_RESYNC :
27403448Sdh155122 		for (is = ifs->ifs_ips_list; is; is = is->is_next) {
27412958Sdr146992 			if (v != 0 && is->is_v != v)
27422958Sdr146992 				continue;
27432958Sdr146992 			/*
27442958Sdr146992 			 * Look up all the interface names in the state entry.
27452958Sdr146992 			 */
27462958Sdr146992 			for (i = 0; i < 4; i++) {
27472393Syz155240 				is->is_ifp[i] = fr_resolvenic(is->is_ifname[i],
27483448Sdh155122 							      is->is_v, ifs);
27492958Sdr146992 			}
27502393Syz155240 		}
27512958Sdr146992 		break;
27522958Sdr146992 	case IPFSYNC_NEWIFP :
27533448Sdh155122 		for (is = ifs->ifs_ips_list; is; is = is->is_next) {
27542958Sdr146992 			if (v != 0 && is->is_v != v)
27552958Sdr146992 				continue;
27562958Sdr146992 			/*
27572958Sdr146992 			 * Look up all the interface names in the state entry.
27582958Sdr146992 			 */
27592958Sdr146992 			for (i = 0; i < 4; i++) {
27602958Sdr146992 				if (!strncmp(is->is_ifname[i], name,
27612958Sdr146992 					     sizeof(is->is_ifname[i])))
27622958Sdr146992 					is->is_ifp[i] = ifp;
27632958Sdr146992 			}
27642958Sdr146992 		}
27652958Sdr146992 		break;
27662958Sdr146992 	case IPFSYNC_OLDIFP :
27673448Sdh155122 		for (is = ifs->ifs_ips_list; is; is = is->is_next) {
27682958Sdr146992 			if (v != 0 && is->is_v != v)
27692958Sdr146992 				continue;
27702958Sdr146992 			/*
27712958Sdr146992 			 * Look up all the interface names in the state entry.
27722958Sdr146992 			 */
27732958Sdr146992 			for (i = 0; i < 4; i++) {
27742958Sdr146992 				if (is->is_ifp[i] == ifp)
27752958Sdr146992 					is->is_ifp[i] = (void *)-1;
27762958Sdr146992 			}
27772958Sdr146992 		}
27782958Sdr146992 		break;
27792393Syz155240 	}
27803448Sdh155122 	RWLOCK_EXIT(&ifs->ifs_ipf_state);
27812393Syz155240 }
27822393Syz155240 
27832393Syz155240 
27842393Syz155240 /* ------------------------------------------------------------------------ */
27852393Syz155240 /* Function:    fr_delstate                                                 */
27862393Syz155240 /* Returns:     Nil                                                         */
27872393Syz155240 /* Parameters:  is(I)  - pointer to state structure to delete               */
27882393Syz155240 /*              why(I) - if not 0, log reason why it was deleted            */
27893187Sdr146992 /* Write Locks: ipf_state/ipf_global                                        */
27902393Syz155240 /*                                                                          */
27912393Syz155240 /* Deletes a state entry from the enumerated list as well as the hash table */
27922393Syz155240 /* and timeout queue lists.  Make adjustments to hash table statistics and  */
27932393Syz155240 /* global counters as required.                                             */
27942393Syz155240 /* ------------------------------------------------------------------------ */
27953448Sdh155122 static void fr_delstate(is, why, ifs)
27962393Syz155240 ipstate_t *is;
27972393Syz155240 int why;
27983448Sdh155122 ipf_stack_t *ifs;
27992393Syz155240 {
28002393Syz155240 
28013448Sdh155122 	ASSERT(rw_write_held(&ifs->ifs_ipf_global.ipf_lk) == 0 ||
28023448Sdh155122 		rw_write_held(&ifs->ifs_ipf_state.ipf_lk) == 0);
28032393Syz155240 
28042393Syz155240 	/*
28052393Syz155240 	 * Since we want to delete this, remove it from the state table,
28062393Syz155240 	 * where it can be found & used, first.
28072393Syz155240 	 */
28082393Syz155240 	if (is->is_pnext != NULL) {
28092393Syz155240 		*is->is_pnext = is->is_next;
28102393Syz155240 
28112393Syz155240 		if (is->is_next != NULL)
28122393Syz155240 			is->is_next->is_pnext = is->is_pnext;
28132393Syz155240 
28142393Syz155240 		is->is_pnext = NULL;
28152393Syz155240 		is->is_next = NULL;
28162393Syz155240 	}
28172393Syz155240 
28182393Syz155240 	if (is->is_phnext != NULL) {
28192393Syz155240 		*is->is_phnext = is->is_hnext;
28202393Syz155240 		if (is->is_hnext != NULL)
28212393Syz155240 			is->is_hnext->is_phnext = is->is_phnext;
28223448Sdh155122 		if (ifs->ifs_ips_table[is->is_hv] == NULL)
28233448Sdh155122 			ifs->ifs_ips_stats.iss_inuse--;
28243448Sdh155122 		ifs->ifs_ips_stats.iss_bucketlen[is->is_hv]--;
28252393Syz155240 
28262393Syz155240 		is->is_phnext = NULL;
28272393Syz155240 		is->is_hnext = NULL;
28282393Syz155240 	}
28292393Syz155240 
28302393Syz155240 	/*
28313448Sdh155122 	 * Because ifs->ifs_ips_stats.iss_wild is a count of entries in the state
28322393Syz155240 	 * table that have wildcard flags set, only decerement it once
28332393Syz155240 	 * and do it here.
28342393Syz155240 	 */
28352393Syz155240 	if (is->is_flags & (SI_WILDP|SI_WILDA)) {
28362393Syz155240 		if (!(is->is_flags & SI_CLONED)) {
28373448Sdh155122 			ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild);
28382393Syz155240 		}
28392393Syz155240 		is->is_flags &= ~(SI_WILDP|SI_WILDA);
28402393Syz155240 	}
28412393Syz155240 
28422393Syz155240 	/*
28432393Syz155240 	 * Next, remove it from the timeout queue it is in.
28442393Syz155240 	 */
28452393Syz155240 	fr_deletequeueentry(&is->is_sti);
28462393Syz155240 
28472393Syz155240 	is->is_me = NULL;
28482393Syz155240 
28492393Syz155240 	/*
28502393Syz155240 	 * If it is still in use by something else, do not go any further,
28512393Syz155240 	 * but note that at this point it is now an orphan.
28522393Syz155240 	 */
28532393Syz155240 	is->is_ref--;
28542393Syz155240 	if (is->is_ref > 0)
28552393Syz155240 		return;
28562393Syz155240 
28572393Syz155240 	if (is->is_tqehead[0] != NULL) {
28582393Syz155240 		if (fr_deletetimeoutqueue(is->is_tqehead[0]) == 0)
28593448Sdh155122 			fr_freetimeoutqueue(is->is_tqehead[0], ifs);
28602393Syz155240 	}
28612393Syz155240 	if (is->is_tqehead[1] != NULL) {
28622393Syz155240 		if (fr_deletetimeoutqueue(is->is_tqehead[1]) == 0)
28633448Sdh155122 			fr_freetimeoutqueue(is->is_tqehead[1], ifs);
28642393Syz155240 	}
28652393Syz155240 
28662393Syz155240 #ifdef	IPFILTER_SYNC
28672393Syz155240 	if (is->is_sync)
28682393Syz155240 		ipfsync_del(is->is_sync);
28692393Syz155240 #endif
28702393Syz155240 #ifdef	IPFILTER_SCAN
28712393Syz155240 	(void) ipsc_detachis(is);
28722393Syz155240 #endif
28732393Syz155240 
28743448Sdh155122 	if (ifs->ifs_ipstate_logging != 0 && why != 0)
28753448Sdh155122 		ipstate_log(is, why, ifs);
28762393Syz155240 
28772393Syz155240 	if (is->is_rule != NULL) {
28782393Syz155240 		is->is_rule->fr_statecnt--;
28793448Sdh155122 		(void)fr_derefrule(&is->is_rule, ifs);
28802393Syz155240 	}
28812393Syz155240 
28822393Syz155240 	MUTEX_DESTROY(&is->is_lock);
28832393Syz155240 	KFREE(is);
28843448Sdh155122 	ifs->ifs_ips_num--;
28852393Syz155240 }
28862393Syz155240 
28872393Syz155240 
28882393Syz155240 /* ------------------------------------------------------------------------ */
28892393Syz155240 /* Function:    fr_timeoutstate                                             */
28902393Syz155240 /* Returns:     Nil                                                         */
28912393Syz155240 /* Parameters:  Nil                                                         */
28922393Syz155240 /*                                                                          */
28932393Syz155240 /* Slowly expire held state for thingslike UDP and ICMP.  The algorithm     */
28942393Syz155240 /* used here is to keep the queue sorted with the oldest things at the top  */
28952393Syz155240 /* and the youngest at the bottom.  So if the top one doesn't need to be    */
28962393Syz155240 /* expired then neither will any under it.                                  */
28972393Syz155240 /* ------------------------------------------------------------------------ */
28983448Sdh155122 void fr_timeoutstate(ifs)
28993448Sdh155122 ipf_stack_t *ifs;
29002393Syz155240 {
29012393Syz155240 	ipftq_t *ifq, *ifqnext;
29022393Syz155240 	ipftqent_t *tqe, *tqn;
29032393Syz155240 	ipstate_t *is;
29042393Syz155240 	SPL_INT(s);
29052393Syz155240 
29062393Syz155240 	SPL_NET(s);
29073448Sdh155122 	WRITE_ENTER(&ifs->ifs_ipf_state);
29083448Sdh155122 	for (ifq = ifs->ifs_ips_tqtqb; ifq != NULL; ifq = ifq->ifq_next)
29092393Syz155240 		for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) {
29103448Sdh155122 			if (tqe->tqe_die > ifs->ifs_fr_ticks)
29112393Syz155240 				break;
29122393Syz155240 			tqn = tqe->tqe_next;
29132393Syz155240 			is = tqe->tqe_parent;
29143448Sdh155122 			fr_delstate(is, ISL_EXPIRE, ifs);
29152393Syz155240 		}
29162393Syz155240 
29173448Sdh155122 	for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) {
29182393Syz155240 		ifqnext = ifq->ifq_next;
29192393Syz155240 
29202393Syz155240 		for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) {
29213448Sdh155122 			if (tqe->tqe_die > ifs->ifs_fr_ticks)
29222393Syz155240 				break;
29232393Syz155240 			tqn = tqe->tqe_next;
29242393Syz155240 			is = tqe->tqe_parent;
29253448Sdh155122 			fr_delstate(is, ISL_EXPIRE, ifs);
29262393Syz155240 		}
29272393Syz155240 	}
29282393Syz155240 
29293448Sdh155122 	for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) {
29302393Syz155240 		ifqnext = ifq->ifq_next;
29312393Syz155240 
29322393Syz155240 		if (((ifq->ifq_flags & IFQF_DELETE) != 0) &&
29332393Syz155240 		    (ifq->ifq_ref == 0)) {
29343448Sdh155122 			fr_freetimeoutqueue(ifq, ifs);
29352393Syz155240 		}
29362393Syz155240 	}
29372393Syz155240 
29383448Sdh155122 	if (ifs->ifs_fr_state_doflush) {
29393448Sdh155122 		(void) fr_state_flush(2, 0, ifs);
29403448Sdh155122 		ifs->ifs_fr_state_doflush = 0;
29412393Syz155240 	}
29423448Sdh155122 	RWLOCK_EXIT(&ifs->ifs_ipf_state);
29432393Syz155240 	SPL_X(s);
29442393Syz155240 }
29452393Syz155240 
29462393Syz155240 
29472393Syz155240 /* ------------------------------------------------------------------------ */
29482393Syz155240 /* Function:    fr_state_flush                                              */
29492393Syz155240 /* Returns:     int - 0 == success, -1 == failure                           */
29502393Syz155240 /* Parameters:  Nil                                                         */
29512393Syz155240 /* Write Locks: ipf_state                                                   */
29522393Syz155240 /*                                                                          */
29532393Syz155240 /* Flush state tables.  Three actions currently defined:                    */
29542393Syz155240 /* which == 0 : flush all state table entries                               */
29552393Syz155240 /* which == 1 : flush TCP connections which have started to close but are   */
29562393Syz155240 /*	      stuck for some reason.                                        */
29572393Syz155240 /* which == 2 : flush TCP connections which have been idle for a long time, */
29582393Syz155240 /*	      starting at > 4 days idle and working back in successive half-*/
29592393Syz155240 /*	      days to at most 12 hours old.  If this fails to free enough   */
29602393Syz155240 /*            slots then work backwards in half hour slots to 30 minutes.   */
29612393Syz155240 /*            If that too fails, then work backwards in 30 second intervals */
29622393Syz155240 /*            for the last 30 minutes to at worst 30 seconds idle.          */
29632393Syz155240 /* ------------------------------------------------------------------------ */
29643448Sdh155122 static int fr_state_flush(which, proto, ifs)
29652393Syz155240 int which, proto;
29663448Sdh155122 ipf_stack_t *ifs;
29672393Syz155240 {
29682393Syz155240 	ipftq_t *ifq, *ifqnext;
29692393Syz155240 	ipftqent_t *tqe, *tqn;
29702393Syz155240 	ipstate_t *is, **isp;
29712393Syz155240 	int delete, removed;
29722393Syz155240 	long try, maxtick;
29732393Syz155240 	u_long interval;
29742393Syz155240 	SPL_INT(s);
29752393Syz155240 
29762393Syz155240 	removed = 0;
29772393Syz155240 
29782393Syz155240 	SPL_NET(s);
29793448Sdh155122 	for (isp = &ifs->ifs_ips_list; ((is = *isp) != NULL); ) {
29802393Syz155240 		delete = 0;
29812393Syz155240 
29822393Syz155240 		if ((proto != 0) && (is->is_v != proto)) {
29832393Syz155240 			isp = &is->is_next;
29842393Syz155240 			continue;
29852393Syz155240 		}
29862393Syz155240 
29872393Syz155240 		switch (which)
29882393Syz155240 		{
29892393Syz155240 		case 0 :
29902393Syz155240 			delete = 1;
29912393Syz155240 			break;
29922393Syz155240 		case 1 :
29932393Syz155240 		case 2 :
29942393Syz155240 			if (is->is_p != IPPROTO_TCP)
29952393Syz155240 				break;
29962393Syz155240 			if ((is->is_state[0] != IPF_TCPS_ESTABLISHED) ||
29972393Syz155240 			    (is->is_state[1] != IPF_TCPS_ESTABLISHED))
29982393Syz155240 				delete = 1;
29992393Syz155240 			break;
30002393Syz155240 		}
30012393Syz155240 
30022393Syz155240 		if (delete) {
30032393Syz155240 			if (is->is_p == IPPROTO_TCP)
30043448Sdh155122 				ifs->ifs_ips_stats.iss_fin++;
30052393Syz155240 			else
30063448Sdh155122 				ifs->ifs_ips_stats.iss_expire++;
30073448Sdh155122 			fr_delstate(is, ISL_FLUSH, ifs);
30082393Syz155240 			removed++;
30092393Syz155240 		} else
30102393Syz155240 			isp = &is->is_next;
30112393Syz155240 	}
30122393Syz155240 
30132393Syz155240 	if (which != 2) {
30142393Syz155240 		SPL_X(s);
30152393Syz155240 		return removed;
30162393Syz155240 	}
30172393Syz155240 
30182393Syz155240 	/*
30192393Syz155240 	 * Asked to remove inactive entries because the table is full, try
30202393Syz155240 	 * again, 3 times, if first attempt failed with a different criteria
30212393Syz155240 	 * each time.  The order tried in must be in decreasing age.
30222393Syz155240 	 * Another alternative is to implement random drop and drop N entries
30232393Syz155240 	 * at random until N have been freed up.
30242393Syz155240 	 */
30253448Sdh155122 	if (ifs->ifs_fr_ticks - ifs->ifs_ips_last_force_flush < IPF_TTLVAL(5))
30262393Syz155240 		goto force_flush_skipped;
30273448Sdh155122 	ifs->ifs_ips_last_force_flush = ifs->ifs_fr_ticks;
30283448Sdh155122 
30293448Sdh155122 	if (ifs->ifs_fr_ticks > IPF_TTLVAL(43200))
30302393Syz155240 		interval = IPF_TTLVAL(43200);
30313448Sdh155122 	else if (ifs->ifs_fr_ticks > IPF_TTLVAL(1800))
30322393Syz155240 		interval = IPF_TTLVAL(1800);
30333448Sdh155122 	else if (ifs->ifs_fr_ticks > IPF_TTLVAL(30))
30342393Syz155240 		interval = IPF_TTLVAL(30);
30352393Syz155240 	else
30362393Syz155240 		interval = IPF_TTLVAL(10);
30373448Sdh155122 	try = ifs->ifs_fr_ticks - (ifs->ifs_fr_ticks - interval);
30382393Syz155240 	if (try < 0)
30392393Syz155240 		goto force_flush_skipped;
30402393Syz155240 
30412393Syz155240 	while (removed == 0) {
30423448Sdh155122 		maxtick = ifs->ifs_fr_ticks - interval;
30432393Syz155240 		if (maxtick < 0)
30442393Syz155240 			break;
30452393Syz155240 
30462393Syz155240 		while (try < maxtick) {
30473448Sdh155122 			for (ifq = ifs->ifs_ips_tqtqb; ifq != NULL;
30482393Syz155240 			     ifq = ifq->ifq_next) {
30492393Syz155240 				for (tqn = ifq->ifq_head;
30502393Syz155240 				     ((tqe = tqn) != NULL); ) {
30512393Syz155240 					if (tqe->tqe_die > try)
30522393Syz155240 						break;
30532393Syz155240 					tqn = tqe->tqe_next;
30542393Syz155240 					is = tqe->tqe_parent;
30553448Sdh155122 					fr_delstate(is, ISL_EXPIRE, ifs);
30562393Syz155240 					removed++;
30572393Syz155240 				}
30582393Syz155240 			}
30592393Syz155240 
30603448Sdh155122 			for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) {
30612393Syz155240 				ifqnext = ifq->ifq_next;
30622393Syz155240 
30632393Syz155240 				for (tqn = ifq->ifq_head;
30642393Syz155240 				     ((tqe = tqn) != NULL); ) {
30652393Syz155240 					if (tqe->tqe_die > try)
30662393Syz155240 						break;
30672393Syz155240 					tqn = tqe->tqe_next;
30682393Syz155240 					is = tqe->tqe_parent;
30693448Sdh155122 					fr_delstate(is, ISL_EXPIRE, ifs);
30702393Syz155240 					removed++;
30712393Syz155240 				}
30722393Syz155240 			}
30732393Syz155240 			if (try + interval > maxtick)
30742393Syz155240 				break;
30752393Syz155240 			try += interval;
30762393Syz155240 		}
30772393Syz155240 
30782393Syz155240 		if (removed == 0) {
30792393Syz155240 			if (interval == IPF_TTLVAL(43200)) {
30802393Syz155240 				interval = IPF_TTLVAL(1800);
30812393Syz155240 			} else if (interval == IPF_TTLVAL(1800)) {
30822393Syz155240 				interval = IPF_TTLVAL(30);
30832393Syz155240 			} else if (interval == IPF_TTLVAL(30)) {
30842393Syz155240 				interval = IPF_TTLVAL(10);
30852393Syz155240 			} else {
30862393Syz155240 				break;
30872393Syz155240 			}
30882393Syz155240 		}
30892393Syz155240 	}
30902393Syz155240 force_flush_skipped:
30912393Syz155240 	SPL_X(s);
30922393Syz155240 	return removed;
30932393Syz155240 }
30942393Syz155240 
30952393Syz155240 
30962393Syz155240 
30972393Syz155240 /* ------------------------------------------------------------------------ */
30982393Syz155240 /* Function:    fr_tcp_age                                                  */
30992393Syz155240 /* Returns:     int - 1 == state transition made, 0 == no change (rejected) */
31002393Syz155240 /* Parameters:  tq(I)    - pointer to timeout queue information             */
31012393Syz155240 /*              fin(I)   - pointer to packet information                    */
31022393Syz155240 /*              tqtab(I) - TCP timeout queue table this is in               */
31032393Syz155240 /*              flags(I) - flags from state/NAT entry                       */
31042393Syz155240 /*                                                                          */
31052393Syz155240 /* Rewritten by Arjan de Vet <Arjan.deVet@adv.iae.nl>, 2000-07-29:          */
31062393Syz155240 /*                                                                          */
31072393Syz155240 /* - (try to) base state transitions on real evidence only,                 */
31082393Syz155240 /*   i.e. packets that are sent and have been received by ipfilter;         */
31092393Syz155240 /*   diagram 18.12 of TCP/IP volume 1 by W. Richard Stevens was used.       */
31102393Syz155240 /*                                                                          */
31112393Syz155240 /* - deal with half-closed connections correctly;                           */
31122393Syz155240 /*                                                                          */
31132393Syz155240 /* - store the state of the source in state[0] such that ipfstat            */
31142393Syz155240 /*   displays the state as source/dest instead of dest/source; the calls    */
31152393Syz155240 /*   to fr_tcp_age have been changed accordingly.                           */
31162393Syz155240 /*                                                                          */
31172393Syz155240 /* Internal Parameters:                                                     */
31182393Syz155240 /*                                                                          */
31192393Syz155240 /*    state[0] = state of source (host that initiated connection)           */
31202393Syz155240 /*    state[1] = state of dest   (host that accepted the connection)        */
31212393Syz155240 /*                                                                          */
31222393Syz155240 /*    dir == 0 : a packet from source to dest                               */
31232393Syz155240 /*    dir == 1 : a packet from dest to source                               */
31242393Syz155240 /*                                                                          */
31252393Syz155240 /* Locking: it is assumed that the parent of the tqe structure is locked.   */
31262393Syz155240 /* ------------------------------------------------------------------------ */
31272393Syz155240 int fr_tcp_age(tqe, fin, tqtab, flags)
31282393Syz155240 ipftqent_t *tqe;
31292393Syz155240 fr_info_t *fin;
31302393Syz155240 ipftq_t *tqtab;
31312393Syz155240 int flags;
31322393Syz155240 {
31332393Syz155240 	int dlen, ostate, nstate, rval, dir;
31342393Syz155240 	u_char tcpflags;
31352393Syz155240 	tcphdr_t *tcp;
31363448Sdh155122 	ipf_stack_t *ifs = fin->fin_ifs;
31372393Syz155240 
31382393Syz155240 	tcp = fin->fin_dp;
31392393Syz155240 
31402393Syz155240 	rval = 0;
31412393Syz155240 	dir = fin->fin_rev;
31422393Syz155240 	tcpflags = tcp->th_flags;
31432393Syz155240 	dlen = fin->fin_dlen - (TCP_OFF(tcp) << 2);
31442393Syz155240 
31452393Syz155240 	if (tcpflags & TH_RST) {
31462393Syz155240 		if (!(tcpflags & TH_PUSH) && !dlen)
31472393Syz155240 			nstate = IPF_TCPS_CLOSED;
31482393Syz155240 		else
31492393Syz155240 			nstate = IPF_TCPS_CLOSE_WAIT;
31502393Syz155240 		rval = 1;
31512393Syz155240 	} else {
31522393Syz155240 		ostate = tqe->tqe_state[1 - dir];
31532393Syz155240 		nstate = tqe->tqe_state[dir];
31542393Syz155240 
31552393Syz155240 		switch (nstate)
31562393Syz155240 		{
31572393Syz155240 		case IPF_TCPS_CLOSED: /* 0 */
31582393Syz155240 			if ((tcpflags & TH_OPENING) == TH_OPENING) {
31592393Syz155240 				/*
31602393Syz155240 				 * 'dir' received an S and sends SA in
31612393Syz155240 				 * response, CLOSED -> SYN_RECEIVED
31622393Syz155240 				 */
31632393Syz155240 				nstate = IPF_TCPS_SYN_RECEIVED;
31642393Syz155240 				rval = 1;
31652393Syz155240 			} else if ((tcpflags & TH_OPENING) == TH_SYN) {
31662393Syz155240 				/* 'dir' sent S, CLOSED -> SYN_SENT */
31672393Syz155240 				nstate = IPF_TCPS_SYN_SENT;
31682393Syz155240 				rval = 1;
31692393Syz155240 			}
31702393Syz155240 			/*
31712393Syz155240 			 * the next piece of code makes it possible to get
31722393Syz155240 			 * already established connections into the state table
31732393Syz155240 			 * after a restart or reload of the filter rules; this
31742393Syz155240 			 * does not work when a strict 'flags S keep state' is
31752393Syz155240 			 * used for tcp connections of course
31762393Syz155240 			 */
31772393Syz155240 			if (((flags & IS_TCPFSM) == 0) &&
31782393Syz155240 			    ((tcpflags & TH_ACKMASK) == TH_ACK)) {
31792393Syz155240 				/*
31802393Syz155240 				 * we saw an A, guess 'dir' is in ESTABLISHED
31812393Syz155240 				 * mode
31822393Syz155240 				 */
31832393Syz155240 				switch (ostate)
31842393Syz155240 				{
31852393Syz155240 				case IPF_TCPS_CLOSED :
31862393Syz155240 				case IPF_TCPS_SYN_RECEIVED :
31872393Syz155240 					nstate = IPF_TCPS_HALF_ESTAB;
31882393Syz155240 					rval = 1;
31892393Syz155240 					break;
31902393Syz155240 				case IPF_TCPS_HALF_ESTAB :
31912393Syz155240 				case IPF_TCPS_ESTABLISHED :
31922393Syz155240 					nstate = IPF_TCPS_ESTABLISHED;
31932393Syz155240 					rval = 1;
31942393Syz155240 					break;
31952393Syz155240 				default :
31962393Syz155240 					break;
31972393Syz155240 				}
31982393Syz155240 			}
31992393Syz155240 			/*
32002393Syz155240 			 * TODO: besides regular ACK packets we can have other
32012393Syz155240 			 * packets as well; it is yet to be determined how we
32022393Syz155240 			 * should initialize the states in those cases
32032393Syz155240 			 */
32042393Syz155240 			break;
32052393Syz155240 
32062393Syz155240 		case IPF_TCPS_LISTEN: /* 1 */
32072393Syz155240 			/* NOT USED */
32082393Syz155240 			break;
32092393Syz155240 
32102393Syz155240 		case IPF_TCPS_SYN_SENT: /* 2 */
32112393Syz155240 			if ((tcpflags & ~(TH_ECN|TH_CWR)) == TH_SYN) {
32122393Syz155240 				/*
32132393Syz155240 				 * A retransmitted SYN packet.  We do not reset
32142393Syz155240 				 * the timeout here to fr_tcptimeout because a
32152393Syz155240 				 * connection connect timeout does not renew
32162393Syz155240 				 * after every packet that is sent.  We need to
32172393Syz155240 				 * set rval so as to indicate the packet has
32182393Syz155240 				 * passed the check for its flags being valid
32192393Syz155240 				 * in the TCP FSM.  Setting rval to 2 has the
32202393Syz155240 				 * result of not resetting the timeout.
32212393Syz155240 				 */
32222393Syz155240 				rval = 2;
32232393Syz155240 			} else if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) ==
32242393Syz155240 				   TH_ACK) {
32252393Syz155240 				/*
32262393Syz155240 				 * we see an A from 'dir' which is in SYN_SENT
32272393Syz155240 				 * state: 'dir' sent an A in response to an SA
32282393Syz155240 				 * which it received, SYN_SENT -> ESTABLISHED
32292393Syz155240 				 */
32302393Syz155240 				nstate = IPF_TCPS_ESTABLISHED;
32312393Syz155240 				rval = 1;
32322393Syz155240 			} else if (tcpflags & TH_FIN) {
32332393Syz155240 				/*
32342393Syz155240 				 * we see an F from 'dir' which is in SYN_SENT
32352393Syz155240 				 * state and wants to close its side of the
32362393Syz155240 				 * connection; SYN_SENT -> FIN_WAIT_1
32372393Syz155240 				 */
32382393Syz155240 				nstate = IPF_TCPS_FIN_WAIT_1;
32392393Syz155240 				rval = 1;
32402393Syz155240 			} else if ((tcpflags & TH_OPENING) == TH_OPENING) {
32412393Syz155240 				/*
32422393Syz155240 				 * we see an SA from 'dir' which is already in
32432393Syz155240 				 * SYN_SENT state, this means we have a
32442393Syz155240 				 * simultaneous open; SYN_SENT -> SYN_RECEIVED
32452393Syz155240 				 */
32462393Syz155240 				nstate = IPF_TCPS_SYN_RECEIVED;
32472393Syz155240 				rval = 1;
32482393Syz155240 			}
32492393Syz155240 			break;
32502393Syz155240 
32512393Syz155240 		case IPF_TCPS_SYN_RECEIVED: /* 3 */
32522393Syz155240 			if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) == TH_ACK) {
32532393Syz155240 				/*
32542393Syz155240 				 * we see an A from 'dir' which was in
32552393Syz155240 				 * SYN_RECEIVED state so it must now be in
32562393Syz155240 				 * established state, SYN_RECEIVED ->
32572393Syz155240 				 * ESTABLISHED
32582393Syz155240 				 */
32592393Syz155240 				nstate = IPF_TCPS_ESTABLISHED;
32602393Syz155240 				rval = 1;
32612393Syz155240 			} else if ((tcpflags & ~(TH_ECN|TH_CWR)) ==
32622393Syz155240 				   TH_OPENING) {
32632393Syz155240 				/*
32642393Syz155240 				 * We see an SA from 'dir' which is already in
32652393Syz155240 				 * SYN_RECEIVED state.
32662393Syz155240 				 */
32672393Syz155240 				rval = 2;
32682393Syz155240 			} else if (tcpflags & TH_FIN) {
32692393Syz155240 				/*
32702393Syz155240 				 * we see an F from 'dir' which is in
32712393Syz155240 				 * SYN_RECEIVED state and wants to close its
32722393Syz155240 				 * side of the connection; SYN_RECEIVED ->
32732393Syz155240 				 * FIN_WAIT_1
32742393Syz155240 				 */
32752393Syz155240 				nstate = IPF_TCPS_FIN_WAIT_1;
32762393Syz155240 				rval = 1;
32772393Syz155240 			}
32782393Syz155240 			break;
32792393Syz155240 
32802393Syz155240 		case IPF_TCPS_HALF_ESTAB: /* 4 */
32812393Syz155240 			if (ostate >= IPF_TCPS_HALF_ESTAB) {
32822393Syz155240 				if ((tcpflags & TH_ACKMASK) == TH_ACK) {
32832393Syz155240 					nstate = IPF_TCPS_ESTABLISHED;
32842393Syz155240 					rval = 1;
32852393Syz155240 				}
32862393Syz155240 			}
32872393Syz155240 
32882393Syz155240 			break;
32892393Syz155240 
32902393Syz155240 		case IPF_TCPS_ESTABLISHED: /* 5 */
32912393Syz155240 			rval = 1;
32922393Syz155240 			if (tcpflags & TH_FIN) {
32932393Syz155240 				/*
32942393Syz155240 				 * 'dir' closed its side of the connection;
32952393Syz155240 				 * this gives us a half-closed connection;
32962393Syz155240 				 * ESTABLISHED -> FIN_WAIT_1
32972393Syz155240 				 */
32982393Syz155240 				nstate = IPF_TCPS_FIN_WAIT_1;
32992393Syz155240 			} else if (tcpflags & TH_ACK) {
33002393Syz155240 				/*
33012393Syz155240 				 * an ACK, should we exclude other flags here?
33022393Syz155240 				 */
33032393Syz155240 				if (ostate == IPF_TCPS_FIN_WAIT_1) {
33042393Syz155240 					/*
33052393Syz155240 					 * We know the other side did an active
33062393Syz155240 					 * close, so we are ACKing the recvd
33072393Syz155240 					 * FIN packet (does the window matching
33082393Syz155240 					 * code guarantee this?) and go into
33092393Syz155240 					 * CLOSE_WAIT state; this gives us a
33102393Syz155240 					 * half-closed connection
33112393Syz155240 					 */
33122393Syz155240 					nstate = IPF_TCPS_CLOSE_WAIT;
33132393Syz155240 				} else if (ostate < IPF_TCPS_CLOSE_WAIT) {
33142393Syz155240 					/*
33152393Syz155240 					 * still a fully established
33162393Syz155240 					 * connection reset timeout
33172393Syz155240 					 */
33182393Syz155240 					nstate = IPF_TCPS_ESTABLISHED;
33192393Syz155240 				}
33202393Syz155240 			}
33212393Syz155240 			break;
33222393Syz155240 
33232393Syz155240 		case IPF_TCPS_CLOSE_WAIT: /* 6 */
33242393Syz155240 			rval = 1;
33252393Syz155240 			if (tcpflags & TH_FIN) {
33262393Syz155240 				/*
33272393Syz155240 				 * application closed and 'dir' sent a FIN,
33282393Syz155240 				 * we're now going into LAST_ACK state
33292393Syz155240 				 */
33302393Syz155240 				nstate = IPF_TCPS_LAST_ACK;
33312393Syz155240 			} else {
33322393Syz155240 				/*
33332393Syz155240 				 * we remain in CLOSE_WAIT because the other
33342393Syz155240 				 * side has closed already and we did not
33352393Syz155240 				 * close our side yet; reset timeout
33362393Syz155240 				 */
33372393Syz155240 				nstate = IPF_TCPS_CLOSE_WAIT;
33382393Syz155240 			}
33392393Syz155240 			break;
33402393Syz155240 
33412393Syz155240 		case IPF_TCPS_FIN_WAIT_1: /* 7 */
33422393Syz155240 			rval = 1;
33432393Syz155240 			if ((tcpflags & TH_ACK) &&
33442393Syz155240 			    ostate > IPF_TCPS_CLOSE_WAIT) {
33452393Syz155240 				/*
33462393Syz155240 				 * if the other side is not active anymore
33472393Syz155240 				 * it has sent us a FIN packet that we are
33482393Syz155240 				 * ack'ing now with an ACK; this means both
33492393Syz155240 				 * sides have now closed the connection and
33502393Syz155240 				 * we go into TIME_WAIT
33512393Syz155240 				 */
33522393Syz155240 				/*
33532393Syz155240 				 * XXX: how do we know we really are ACKing
33542393Syz155240 				 * the FIN packet here? does the window code
33552393Syz155240 				 * guarantee that?
33562393Syz155240 				 */
33572393Syz155240 				nstate = IPF_TCPS_TIME_WAIT;
33582393Syz155240 			} else {
33592393Syz155240 				/*
33602393Syz155240 				 * we closed our side of the connection
33612393Syz155240 				 * already but the other side is still active
33622393Syz155240 				 * (ESTABLISHED/CLOSE_WAIT); continue with
33632393Syz155240 				 * this half-closed connection
33642393Syz155240 				 */
33652393Syz155240 				nstate = IPF_TCPS_FIN_WAIT_1;
33662393Syz155240 			}
33672393Syz155240 			break;
33682393Syz155240 
33692393Syz155240 		case IPF_TCPS_CLOSING: /* 8 */
33702393Syz155240 			/* NOT USED */
33712393Syz155240 			break;
33722393Syz155240 
33732393Syz155240 		case IPF_TCPS_LAST_ACK: /* 9 */
33742393Syz155240 			if (tcpflags & TH_ACK) {
33752393Syz155240 				if ((tcpflags & TH_PUSH) || dlen)
33762393Syz155240 					/*
33772393Syz155240 					 * there is still data to be delivered,
33782393Syz155240 					 * reset timeout
33792393Syz155240 					 */
33802393Syz155240 					rval = 1;
33812393Syz155240 				else
33822393Syz155240 					rval = 2;
33832393Syz155240 			}
33842393Syz155240 			/*
33852393Syz155240 			 * we cannot detect when we go out of LAST_ACK state to
33862393Syz155240 			 * CLOSED because that is based on the reception of ACK
33872393Syz155240 			 * packets; ipfilter can only detect that a packet
33882393Syz155240 			 * has been sent by a host
33892393Syz155240 			 */
33902393Syz155240 			break;
33912393Syz155240 
33922393Syz155240 		case IPF_TCPS_FIN_WAIT_2: /* 10 */
33932393Syz155240 			rval = 1;
33942393Syz155240 			if ((tcpflags & TH_OPENING) == TH_OPENING)
33952393Syz155240 				nstate = IPF_TCPS_SYN_RECEIVED;
33962393Syz155240 			else if (tcpflags & TH_SYN)
33972393Syz155240 				nstate = IPF_TCPS_SYN_SENT;
33982393Syz155240 			break;
33992393Syz155240 
34002393Syz155240 		case IPF_TCPS_TIME_WAIT: /* 11 */
34012393Syz155240 			/* we're in 2MSL timeout now */
34022393Syz155240 			rval = 1;
34032393Syz155240 			break;
34042393Syz155240 
34052393Syz155240 		default :
34062393Syz155240 #if defined(_KERNEL)
34072393Syz155240 # if SOLARIS
34082393Syz155240 			cmn_err(CE_NOTE,
34092393Syz155240 				"tcp %lx flags %x si %lx nstate %d ostate %d\n",
34102393Syz155240 				(u_long)tcp, tcpflags, (u_long)tqe,
34112393Syz155240 				nstate, ostate);
34122393Syz155240 # else
34132393Syz155240 			printf("tcp %lx flags %x si %lx nstate %d ostate %d\n",
34142393Syz155240 				(u_long)tcp, tcpflags, (u_long)tqe,
34152393Syz155240 				nstate, ostate);
34162393Syz155240 # endif
34172393Syz155240 #else
34182393Syz155240 			abort();
34192393Syz155240 #endif
34202393Syz155240 			break;
34212393Syz155240 		}
34222393Syz155240 	}
34232393Syz155240 
34242393Syz155240 	/*
34252393Syz155240 	 * If rval == 2 then do not update the queue position, but treat the
34262393Syz155240 	 * packet as being ok.
34272393Syz155240 	 */
34282393Syz155240 	if (rval == 2)
34292393Syz155240 		rval = 1;
34302393Syz155240 	else if (rval == 1) {
34312393Syz155240 		tqe->tqe_state[dir] = nstate;
34322393Syz155240 		if ((tqe->tqe_flags & TQE_RULEBASED) == 0)
34333448Sdh155122 			fr_movequeue(tqe, tqe->tqe_ifq, tqtab + nstate, ifs);
34342393Syz155240 	}
34352393Syz155240 
34362393Syz155240 	return rval;
34372393Syz155240 }
34382393Syz155240 
34392393Syz155240 
34402393Syz155240 /* ------------------------------------------------------------------------ */
34412393Syz155240 /* Function:    ipstate_log                                                 */
34422393Syz155240 /* Returns:     Nil                                                         */
34432393Syz155240 /* Parameters:  is(I)   - pointer to state structure                        */
34442393Syz155240 /*              type(I) - type of log entry to create                       */
34452393Syz155240 /*                                                                          */
34462393Syz155240 /* Creates a state table log entry using the state structure and type info. */
34472393Syz155240 /* passed in.  Log packet/byte counts, source/destination address and other */
34482393Syz155240 /* protocol specific information.                                           */
34492393Syz155240 /* ------------------------------------------------------------------------ */
34503448Sdh155122 void ipstate_log(is, type, ifs)
34512393Syz155240 struct ipstate *is;
34522393Syz155240 u_int type;
34533448Sdh155122 ipf_stack_t *ifs;
34542393Syz155240 {
34552393Syz155240 #ifdef	IPFILTER_LOG
34562393Syz155240 	struct	ipslog	ipsl;
34572393Syz155240 	size_t sizes[1];
34582393Syz155240 	void *items[1];
34592393Syz155240 	int types[1];
34602393Syz155240 
34612393Syz155240 	/*
34622393Syz155240 	 * Copy information out of the ipstate_t structure and into the
34632393Syz155240 	 * structure used for logging.
34642393Syz155240 	 */
34652393Syz155240 	ipsl.isl_type = type;
34662393Syz155240 	ipsl.isl_pkts[0] = is->is_pkts[0] + is->is_icmppkts[0];
34672393Syz155240 	ipsl.isl_bytes[0] = is->is_bytes[0];
34682393Syz155240 	ipsl.isl_pkts[1] = is->is_pkts[1] + is->is_icmppkts[1];
34692393Syz155240 	ipsl.isl_bytes[1] = is->is_bytes[1];
34702393Syz155240 	ipsl.isl_pkts[2] = is->is_pkts[2] + is->is_icmppkts[2];
34712393Syz155240 	ipsl.isl_bytes[2] = is->is_bytes[2];
34722393Syz155240 	ipsl.isl_pkts[3] = is->is_pkts[3] + is->is_icmppkts[3];
34732393Syz155240 	ipsl.isl_bytes[3] = is->is_bytes[3];
34742393Syz155240 	ipsl.isl_src = is->is_src;
34752393Syz155240 	ipsl.isl_dst = is->is_dst;
34762393Syz155240 	ipsl.isl_p = is->is_p;
34772393Syz155240 	ipsl.isl_v = is->is_v;
34782393Syz155240 	ipsl.isl_flags = is->is_flags;
34792393Syz155240 	ipsl.isl_tag = is->is_tag;
34802393Syz155240 	ipsl.isl_rulen = is->is_rulen;
34812393Syz155240 	(void) strncpy(ipsl.isl_group, is->is_group, FR_GROUPLEN);
34822393Syz155240 
34832393Syz155240 	if (ipsl.isl_p == IPPROTO_TCP || ipsl.isl_p == IPPROTO_UDP) {
34842393Syz155240 		ipsl.isl_sport = is->is_sport;
34852393Syz155240 		ipsl.isl_dport = is->is_dport;
34862393Syz155240 		if (ipsl.isl_p == IPPROTO_TCP) {
34872393Syz155240 			ipsl.isl_state[0] = is->is_state[0];
34882393Syz155240 			ipsl.isl_state[1] = is->is_state[1];
34892393Syz155240 		}
34902393Syz155240 	} else if (ipsl.isl_p == IPPROTO_ICMP) {
34912393Syz155240 		ipsl.isl_itype = is->is_icmp.ici_type;
34922393Syz155240 	} else if (ipsl.isl_p == IPPROTO_ICMPV6) {
34932393Syz155240 		ipsl.isl_itype = is->is_icmp.ici_type;
34942393Syz155240 	} else {
34952393Syz155240 		ipsl.isl_ps.isl_filler[0] = 0;
34962393Syz155240 		ipsl.isl_ps.isl_filler[1] = 0;
34972393Syz155240 	}
34982393Syz155240 
34992393Syz155240 	items[0] = &ipsl;
35002393Syz155240 	sizes[0] = sizeof(ipsl);
35012393Syz155240 	types[0] = 0;
35022393Syz155240 
35033448Sdh155122 	if (ipllog(IPL_LOGSTATE, NULL, items, sizes, types, 1, ifs)) {
35043448Sdh155122 		ATOMIC_INCL(ifs->ifs_ips_stats.iss_logged);
35052393Syz155240 	} else {
35063448Sdh155122 		ATOMIC_INCL(ifs->ifs_ips_stats.iss_logfail);
35072393Syz155240 	}
35082393Syz155240 #endif
35092393Syz155240 }
35102393Syz155240 
35112393Syz155240 
35122393Syz155240 #ifdef	USE_INET6
35132393Syz155240 /* ------------------------------------------------------------------------ */
35142393Syz155240 /* Function:    fr_checkicmp6matchingstate                                  */
35152393Syz155240 /* Returns:     ipstate_t* - NULL == no match found,                        */
35162393Syz155240 /*                           else  pointer to matching state entry          */
35172393Syz155240 /* Parameters:  fin(I) - pointer to packet information                      */
35182393Syz155240 /* Locks:       NULL == no locks, else Read Lock on ipf_state               */
35192393Syz155240 /*                                                                          */
35202393Syz155240 /* If we've got an ICMPv6 error message, using the information stored in    */
35212393Syz155240 /* the ICMPv6 packet, look for a matching state table entry.                */
35222393Syz155240 /* ------------------------------------------------------------------------ */
35232393Syz155240 static ipstate_t *fr_checkicmp6matchingstate(fin)
35242393Syz155240 fr_info_t *fin;
35252393Syz155240 {
35262393Syz155240 	struct icmp6_hdr *ic6, *oic;
35272393Syz155240 	int backward, i;
35282393Syz155240 	ipstate_t *is, **isp;
35292393Syz155240 	u_short sport, dport;
35302393Syz155240 	i6addr_t dst, src;
35312393Syz155240 	u_short savelen;
35322393Syz155240 	icmpinfo_t *ic;
35332393Syz155240 	fr_info_t ofin;
35342393Syz155240 	tcphdr_t *tcp;
35352393Syz155240 	ip6_t *oip6;
35362393Syz155240 	u_char	pr;
35372393Syz155240 	u_int hv;
35383448Sdh155122 	ipf_stack_t *ifs = fin->fin_ifs;
35392393Syz155240 
35402393Syz155240 	/*
35412393Syz155240 	 * Does it at least have the return (basic) IP header ?
35422393Syz155240 	 * Is it an actual recognised ICMP error type?
35432393Syz155240 	 * Only a basic IP header (no options) should be with
35442393Syz155240 	 * an ICMP error header.
35452393Syz155240 	 */
35462393Syz155240 	if ((fin->fin_v != 6) || (fin->fin_plen < ICMP6ERR_MINPKTLEN) ||
35472393Syz155240 	    !(fin->fin_flx & FI_ICMPERR))
35482393Syz155240 		return NULL;
35492393Syz155240 
35502393Syz155240 	ic6 = fin->fin_dp;
35512393Syz155240 
35522393Syz155240 	oip6 = (ip6_t *)((char *)ic6 + ICMPERR_ICMPHLEN);
35532393Syz155240 	if (fin->fin_plen < sizeof(*oip6))
35542393Syz155240 		return NULL;
35552393Syz155240 
3556*3607Szf203873 	bcopy((char *)fin, (char *)&ofin, sizeof(*fin));
35572393Syz155240 	ofin.fin_v = 6;
35582393Syz155240 	ofin.fin_ifp = fin->fin_ifp;
35592393Syz155240 	ofin.fin_out = !fin->fin_out;
35602393Syz155240 	ofin.fin_m = NULL;	/* if dereferenced, panic XXX */
35612393Syz155240 	ofin.fin_mp = NULL;	/* if dereferenced, panic XXX */
35622393Syz155240 
35632393Syz155240 	/*
35642393Syz155240 	 * We make a fin entry to be able to feed it to
35652393Syz155240 	 * matchsrcdst. Note that not all fields are necessary
35662393Syz155240 	 * but this is the cleanest way. Note further we fill
35672393Syz155240 	 * in fin_mp such that if someone uses it we'll get
35682393Syz155240 	 * a kernel panic. fr_matchsrcdst does not use this.
35692393Syz155240 	 *
35702393Syz155240 	 * watch out here, as ip is in host order and oip6 in network
35712393Syz155240 	 * order. Any change we make must be undone afterwards.
35722393Syz155240 	 */
35732393Syz155240 	savelen = oip6->ip6_plen;
35742393Syz155240 	oip6->ip6_plen = fin->fin_dlen - ICMPERR_ICMPHLEN;
35752393Syz155240 	ofin.fin_flx = FI_NOCKSUM;
35762393Syz155240 	ofin.fin_ip = (ip_t *)oip6;
35772393Syz155240 	ofin.fin_plen = oip6->ip6_plen;
35782393Syz155240 	(void) fr_makefrip(sizeof(*oip6), (ip_t *)oip6, &ofin);
35792393Syz155240 	ofin.fin_flx &= ~(FI_BAD|FI_SHORT);
35802393Syz155240 	oip6->ip6_plen = savelen;
35812393Syz155240 
35822393Syz155240 	if (oip6->ip6_nxt == IPPROTO_ICMPV6) {
35832393Syz155240 		oic = (struct icmp6_hdr *)(oip6 + 1);
35842393Syz155240 		/*
35852393Syz155240 		 * an ICMP error can only be generated as a result of an
35862393Syz155240 		 * ICMP query, not as the response on an ICMP error
35872393Syz155240 		 *
35882393Syz155240 		 * XXX theoretically ICMP_ECHOREP and the other reply's are
35892393Syz155240 		 * ICMP query's as well, but adding them here seems strange XXX
35902393Syz155240 		 */
35912393Syz155240 		 if (!(oic->icmp6_type & ICMP6_INFOMSG_MASK))
35922393Syz155240 		    	return NULL;
35932393Syz155240 
35942393Syz155240 		/*
35952393Syz155240 		 * perform a lookup of the ICMP packet in the state table
35962393Syz155240 		 */
35972393Syz155240 		hv = (pr = oip6->ip6_nxt);
35982393Syz155240 		src.in6 = oip6->ip6_src;
35992393Syz155240 		hv += src.in4.s_addr;
36002393Syz155240 		dst.in6 = oip6->ip6_dst;
36012393Syz155240 		hv += dst.in4.s_addr;
36022393Syz155240 		hv += oic->icmp6_id;
36032393Syz155240 		hv += oic->icmp6_seq;
36043448Sdh155122 		hv = DOUBLE_HASH(hv, ifs);
36053448Sdh155122 
36063448Sdh155122 		READ_ENTER(&ifs->ifs_ipf_state);
36073448Sdh155122 		for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) {
36082393Syz155240 			ic = &is->is_icmp;
36092393Syz155240 			isp = &is->is_hnext;
36102393Syz155240 			if ((is->is_p == pr) &&
36112393Syz155240 			    !(is->is_pass & FR_NOICMPERR) &&
36122393Syz155240 			    (oic->icmp6_id == ic->ici_id) &&
36132393Syz155240 			    (oic->icmp6_seq == ic->ici_seq) &&
36142393Syz155240 			    (is = fr_matchsrcdst(&ofin, is, &src,
36152393Syz155240 						 &dst, NULL, FI_ICMPCMP))) {
36162393Syz155240 			    	/*
36172393Syz155240 			    	 * in the state table ICMP query's are stored
36182393Syz155240 			    	 * with the type of the corresponding ICMP
36192393Syz155240 			    	 * response. Correct here
36202393Syz155240 			    	 */
36212393Syz155240 				if (((ic->ici_type == ICMP6_ECHO_REPLY) &&
36222393Syz155240 				     (oic->icmp6_type == ICMP6_ECHO_REQUEST)) ||
36232393Syz155240 				     (ic->ici_type - 1 == oic->icmp6_type )) {
36243448Sdh155122 				    	ifs->ifs_ips_stats.iss_hits++;
36252393Syz155240 					backward = IP6_NEQ(&is->is_dst, &src);
36262393Syz155240 					fin->fin_rev = !backward;
36272393Syz155240 					i = (backward << 1) + fin->fin_out;
36282393Syz155240     					is->is_icmppkts[i]++;
36292393Syz155240 					return is;
36302393Syz155240 				}
36312393Syz155240 			}
36322393Syz155240 		}
36333448Sdh155122 		RWLOCK_EXIT(&ifs->ifs_ipf_state);
36342393Syz155240 		return NULL;
36352393Syz155240 	}
36362393Syz155240 
36372393Syz155240 	hv = (pr = oip6->ip6_nxt);
36382393Syz155240 	src.in6 = oip6->ip6_src;
36392393Syz155240 	hv += src.i6[0];
36402393Syz155240 	hv += src.i6[1];
36412393Syz155240 	hv += src.i6[2];
36422393Syz155240 	hv += src.i6[3];
36432393Syz155240 	dst.in6 = oip6->ip6_dst;
36442393Syz155240 	hv += dst.i6[0];
36452393Syz155240 	hv += dst.i6[1];
36462393Syz155240 	hv += dst.i6[2];
36472393Syz155240 	hv += dst.i6[3];
36482393Syz155240 
36492393Syz155240 	if ((oip6->ip6_nxt == IPPROTO_TCP) || (oip6->ip6_nxt == IPPROTO_UDP)) {
36502393Syz155240 		tcp = (tcphdr_t *)(oip6 + 1);
36512393Syz155240 		dport = tcp->th_dport;
36522393Syz155240 		sport = tcp->th_sport;
36532393Syz155240 		hv += dport;
36542393Syz155240 		hv += sport;
36552393Syz155240 	} else
36562393Syz155240 		tcp = NULL;
36573448Sdh155122 	hv = DOUBLE_HASH(hv, ifs);
36583448Sdh155122 
36593448Sdh155122 	READ_ENTER(&ifs->ifs_ipf_state);
36603448Sdh155122 	for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) {
36612393Syz155240 		isp = &is->is_hnext;
36622393Syz155240 		/*
36632393Syz155240 		 * Only allow this icmp though if the
36642393Syz155240 		 * encapsulated packet was allowed through the
36652393Syz155240 		 * other way around. Note that the minimal amount
36662393Syz155240 		 * of info present does not allow for checking against
36672393Syz155240 		 * tcp internals such as seq and ack numbers.
36682393Syz155240 		 */
36692393Syz155240 		if ((is->is_p != pr) || (is->is_v != 6) ||
36702393Syz155240 		    (is->is_pass & FR_NOICMPERR))
36712393Syz155240 			continue;
36722393Syz155240 		is = fr_matchsrcdst(&ofin, is, &src, &dst, tcp, FI_ICMPCMP);
36732393Syz155240 		if (is != NULL) {
36743448Sdh155122 			ifs->ifs_ips_stats.iss_hits++;
36752393Syz155240 			backward = IP6_NEQ(&is->is_dst, &src);
36762393Syz155240 			fin->fin_rev = !backward;
36772393Syz155240 			i = (backward << 1) + fin->fin_out;
36782393Syz155240 			is->is_icmppkts[i]++;
36792393Syz155240 			/*
36802393Syz155240 			 * we deliberately do not touch the timeouts
36812393Syz155240 			 * for the accompanying state table entry.
36822393Syz155240 			 * It remains to be seen if that is correct. XXX
36832393Syz155240 			 */
36842393Syz155240 			return is;
36852393Syz155240 		}
36862393Syz155240 	}
36873448Sdh155122 	RWLOCK_EXIT(&ifs->ifs_ipf_state);
36882393Syz155240 	return NULL;
36892393Syz155240 }
36902393Syz155240 #endif
36912393Syz155240 
36922393Syz155240 
36932393Syz155240 /* ------------------------------------------------------------------------ */
36942393Syz155240 /* Function:    fr_sttab_init                                               */
36952393Syz155240 /* Returns:     Nil                                                         */
36962393Syz155240 /* Parameters:  tqp(I) - pointer to an array of timeout queues for TCP      */
36972393Syz155240 /*                                                                          */
36982393Syz155240 /* Initialise the array of timeout queues for TCP.                          */
36992393Syz155240 /* ------------------------------------------------------------------------ */
37003448Sdh155122 void fr_sttab_init(tqp, ifs)
37012393Syz155240 ipftq_t *tqp;
37023448Sdh155122 ipf_stack_t *ifs;
37032393Syz155240 {
37042393Syz155240 	int i;
37052393Syz155240 
37062393Syz155240 	for (i = IPF_TCP_NSTATES - 1; i >= 0; i--) {
37072393Syz155240 		tqp[i].ifq_ttl = 0;
37082393Syz155240 		tqp[i].ifq_ref = 1;
37092393Syz155240 		tqp[i].ifq_head = NULL;
37102393Syz155240 		tqp[i].ifq_tail = &tqp[i].ifq_head;
37112393Syz155240 		tqp[i].ifq_next = tqp + i + 1;
37122393Syz155240 		MUTEX_INIT(&tqp[i].ifq_lock, "ipftq tcp tab");
37132393Syz155240 	}
37142393Syz155240 	tqp[IPF_TCP_NSTATES - 1].ifq_next = NULL;
37153448Sdh155122 	tqp[IPF_TCPS_CLOSED].ifq_ttl = ifs->ifs_fr_tcpclosed;
37163448Sdh155122 	tqp[IPF_TCPS_LISTEN].ifq_ttl = ifs->ifs_fr_tcptimeout;
37173448Sdh155122 	tqp[IPF_TCPS_SYN_SENT].ifq_ttl = ifs->ifs_fr_tcptimeout;
37183448Sdh155122 	tqp[IPF_TCPS_SYN_RECEIVED].ifq_ttl = ifs->ifs_fr_tcptimeout;
37193448Sdh155122 	tqp[IPF_TCPS_ESTABLISHED].ifq_ttl = ifs->ifs_fr_tcpidletimeout;
37203448Sdh155122 	tqp[IPF_TCPS_CLOSE_WAIT].ifq_ttl = ifs->ifs_fr_tcphalfclosed;
37213448Sdh155122 	tqp[IPF_TCPS_FIN_WAIT_1].ifq_ttl = ifs->ifs_fr_tcphalfclosed;
37223448Sdh155122 	tqp[IPF_TCPS_CLOSING].ifq_ttl = ifs->ifs_fr_tcptimeout;
37233448Sdh155122 	tqp[IPF_TCPS_LAST_ACK].ifq_ttl = ifs->ifs_fr_tcplastack;
37243448Sdh155122 	tqp[IPF_TCPS_FIN_WAIT_2].ifq_ttl = ifs->ifs_fr_tcpclosewait;
37253448Sdh155122 	tqp[IPF_TCPS_TIME_WAIT].ifq_ttl = ifs->ifs_fr_tcptimeout;
37263448Sdh155122 	tqp[IPF_TCPS_HALF_ESTAB].ifq_ttl = ifs->ifs_fr_tcptimeout;
37272393Syz155240 }
37282393Syz155240 
37292393Syz155240 
37302393Syz155240 /* ------------------------------------------------------------------------ */
37312393Syz155240 /* Function:    fr_sttab_destroy                                            */
37322393Syz155240 /* Returns:     Nil                                                         */
37332393Syz155240 /* Parameters:  tqp(I) - pointer to an array of timeout queues for TCP      */
37342393Syz155240 /*                                                                          */
37352393Syz155240 /* Do whatever is necessary to "destroy" each of the entries in the array   */
37362393Syz155240 /* of timeout queues for TCP.                                               */
37372393Syz155240 /* ------------------------------------------------------------------------ */
37382393Syz155240 void fr_sttab_destroy(tqp)
37392393Syz155240 ipftq_t *tqp;
37402393Syz155240 {
37412393Syz155240 	int i;
37422393Syz155240 
37432393Syz155240 	for (i = IPF_TCP_NSTATES - 1; i >= 0; i--)
37442393Syz155240 		MUTEX_DESTROY(&tqp[i].ifq_lock);
37452393Syz155240 }
37462393Syz155240 
37472393Syz155240 
37482393Syz155240 /* ------------------------------------------------------------------------ */
37492393Syz155240 /* Function:    fr_statederef                                               */
37502393Syz155240 /* Returns:     Nil                                                         */
37512393Syz155240 /* Parameters:  isp(I) - pointer to pointer to state table entry            */
37522393Syz155240 /*                                                                          */
37532393Syz155240 /* Decrement the reference counter for this state table entry and free it   */
37542393Syz155240 /* if there are no more things using it.                                    */
37552393Syz155240 /*                                                                          */
37562393Syz155240 /* When operating in userland (ipftest), we have no timers to clear a state */
37572393Syz155240 /* entry.  Therefore, we make a few simple tests before deleting an entry   */
37582393Syz155240 /* outright.  We compare states on each side looking for a combination of   */
37592393Syz155240 /* TIME_WAIT (should really be FIN_WAIT_2?) and LAST_ACK.  Then we factor   */
37602393Syz155240 /* in packet direction with the interface list to make sure we don't        */
37612393Syz155240 /* prematurely delete an entry on a final inbound packet that's we're also  */
37622393Syz155240 /* supposed to route elsewhere.                                             */
37632393Syz155240 /*                                                                          */
37642393Syz155240 /* Internal parameters:                                                     */
37652393Syz155240 /*    state[0] = state of source (host that initiated connection)           */
37662393Syz155240 /*    state[1] = state of dest   (host that accepted the connection)        */
37672393Syz155240 /*                                                                          */
37682393Syz155240 /*    dir == 0 : a packet from source to dest                               */
37692393Syz155240 /*    dir == 1 : a packet from dest to source                               */
37702393Syz155240 /* ------------------------------------------------------------------------ */
37713448Sdh155122 void fr_statederef(fin, isp, ifs)
37722393Syz155240 fr_info_t *fin;
37732393Syz155240 ipstate_t **isp;
37743448Sdh155122 ipf_stack_t *ifs;
37752393Syz155240 {
37762393Syz155240 	ipstate_t *is = *isp;
37772393Syz155240 #if 0
37782393Syz155240 	int nstate, ostate, dir, eol;
37792393Syz155240 
37802393Syz155240 	eol = 0; /* End-of-the-line flag. */
37812393Syz155240 	dir = fin->fin_rev;
37822393Syz155240 	ostate = is->is_state[1 - dir];
37832393Syz155240 	nstate = is->is_state[dir];
37842393Syz155240 	/*
37852393Syz155240 	 * Determine whether this packet is local or routed.  State entries
37862393Syz155240 	 * with us as the destination will have an interface list of
37872393Syz155240 	 * int1,-,-,int1.  Entries with us as the origin run as -,int1,int1,-.
37882393Syz155240 	 */
37892393Syz155240 	if ((fin->fin_p == IPPROTO_TCP) && (fin->fin_out == 0)) {
37902393Syz155240 		if ((strcmp(is->is_ifname[0], is->is_ifname[3]) == 0) &&
37912393Syz155240 		    (strcmp(is->is_ifname[1], is->is_ifname[2]) == 0)) {
37922393Syz155240 			if ((dir == 0) &&
37932393Syz155240 			    (strcmp(is->is_ifname[1], "-") == 0) &&
37942393Syz155240 			    (strcmp(is->is_ifname[0], "-") != 0)) {
37952393Syz155240 				eol = 1;
37962393Syz155240 			} else if ((dir == 1) &&
37972393Syz155240 				   (strcmp(is->is_ifname[0], "-") == 0) &&
37982393Syz155240 				   (strcmp(is->is_ifname[1], "-") != 0)) {
37992393Syz155240 				eol = 1;
38002393Syz155240 			}
38012393Syz155240 		}
38022393Syz155240 	}
38032393Syz155240 #endif
38042393Syz155240 
38052393Syz155240 	fin = fin;	/* LINT */
38062393Syz155240 	is = *isp;
38072393Syz155240 	*isp = NULL;
38083448Sdh155122 	WRITE_ENTER(&ifs->ifs_ipf_state);
38092393Syz155240 	is->is_ref--;
38102393Syz155240 	if (is->is_ref == 0) {
38112393Syz155240 		is->is_ref++;		/* To counter ref-- in fr_delstate() */
38123448Sdh155122 		fr_delstate(is, ISL_EXPIRE, ifs);
38132393Syz155240 #ifndef	_KERNEL
38142393Syz155240 #if 0
38152393Syz155240 	} else if (((fin->fin_out == 1) || (eol == 1)) &&
38162393Syz155240 		   ((ostate == IPF_TCPS_LAST_ACK) &&
38172393Syz155240 		   (nstate == IPF_TCPS_TIME_WAIT))) {
38182393Syz155240 		;
38192393Syz155240 #else
38202393Syz155240 	} else if ((is->is_sti.tqe_state[0] > IPF_TCPS_ESTABLISHED) ||
38212393Syz155240 		   (is->is_sti.tqe_state[1] > IPF_TCPS_ESTABLISHED)) {
38222393Syz155240 #endif
38233448Sdh155122 		fr_delstate(is, ISL_ORPHAN, ifs);
38242393Syz155240 #endif
38252393Syz155240 	}
38263448Sdh155122 	RWLOCK_EXIT(&ifs->ifs_ipf_state);
38272393Syz155240 }
38282393Syz155240 
38292393Syz155240 
38302393Syz155240 /* ------------------------------------------------------------------------ */
38312393Syz155240 /* Function:    fr_setstatequeue                                            */
38322393Syz155240 /* Returns:     Nil                                                         */
38332393Syz155240 /* Parameters:  is(I) - pointer to state structure                          */
38342393Syz155240 /*              rev(I) - forward(0) or reverse(1) direction                 */
38352393Syz155240 /* Locks:       ipf_state (read or write)                                   */
38362393Syz155240 /*                                                                          */
38372393Syz155240 /* Put the state entry on its default queue entry, using rev as a helped in */
38382393Syz155240 /* determining which queue it should be placed on.                          */
38392393Syz155240 /* ------------------------------------------------------------------------ */
38403448Sdh155122 void fr_setstatequeue(is, rev, ifs)
38412393Syz155240 ipstate_t *is;
38422393Syz155240 int rev;
38433448Sdh155122 ipf_stack_t *ifs;
38442393Syz155240 {
38452393Syz155240 	ipftq_t *oifq, *nifq;
38462393Syz155240 
38472393Syz155240 
38482393Syz155240 	if ((is->is_sti.tqe_flags & TQE_RULEBASED) != 0)
38492393Syz155240 		nifq = is->is_tqehead[rev];
38502393Syz155240 	else
38512393Syz155240 		nifq = NULL;
38522393Syz155240 
38532393Syz155240 	if (nifq == NULL) {
38542393Syz155240 		switch (is->is_p)
38552393Syz155240 		{
38562393Syz155240 #ifdef USE_INET6
38572393Syz155240 		case IPPROTO_ICMPV6 :
38582393Syz155240 			if (rev == 1)
38593448Sdh155122 				nifq = &ifs->ifs_ips_icmpacktq;
38602393Syz155240 			else
38613448Sdh155122 				nifq = &ifs->ifs_ips_icmptq;
38622393Syz155240 			break;
38632393Syz155240 #endif
38642393Syz155240 		case IPPROTO_ICMP :
38652393Syz155240 			if (rev == 1)
38663448Sdh155122 				nifq = &ifs->ifs_ips_icmpacktq;
38672393Syz155240 			else
38683448Sdh155122 				nifq = &ifs->ifs_ips_icmptq;
38692393Syz155240 			break;
38702393Syz155240 		case IPPROTO_TCP :
38713448Sdh155122 			nifq = ifs->ifs_ips_tqtqb + is->is_state[rev];
38722393Syz155240 			break;
38732393Syz155240 
38742393Syz155240 		case IPPROTO_UDP :
38752393Syz155240 			if (rev == 1)
38763448Sdh155122 				nifq = &ifs->ifs_ips_udpacktq;
38772393Syz155240 			else
38783448Sdh155122 				nifq = &ifs->ifs_ips_udptq;
38792393Syz155240 			break;
38802393Syz155240 
38812393Syz155240 		default :
38823448Sdh155122 			nifq = &ifs->ifs_ips_iptq;
38832393Syz155240 			break;
38842393Syz155240 		}
38852393Syz155240 	}
38862393Syz155240 
38872393Syz155240 	oifq = is->is_sti.tqe_ifq;
38882393Syz155240 	/*
38892393Syz155240 	 * If it's currently on a timeout queue, move it from one queue to
38902393Syz155240 	 * another, else put it on the end of the newly determined queue.
38912393Syz155240 	 */
38922393Syz155240 	if (oifq != NULL)
38933448Sdh155122 		fr_movequeue(&is->is_sti, oifq, nifq, ifs);
38942393Syz155240 	else
38953448Sdh155122 		fr_queueappend(&is->is_sti, nifq, is, ifs);
38962393Syz155240 	return;
38972393Syz155240 }
38983448Sdh155122 
38993448Sdh155122 
39003448Sdh155122 /* ------------------------------------------------------------------------ */
39013448Sdh155122 /* Function:    fr_stateiter                                                */
39023448Sdh155122 /* Returns:     int - 0 == success, else error                              */
39033448Sdh155122 /* Parameters:  token(I) - pointer to ipftoken structure                    */
39043448Sdh155122 /*              itp(I)   - pointer to ipfgeniter structure                  */
39053448Sdh155122 /*                                                                          */
39063448Sdh155122 /* This function handles the SIOCGENITER ioctl for the state tables and     */
39073448Sdh155122 /* walks through the list of entries in the state table list (ips_list.)    */
39083448Sdh155122 /* ------------------------------------------------------------------------ */
39093448Sdh155122 static int fr_stateiter(token, itp, ifs)
39103448Sdh155122 ipftoken_t *token;
39113448Sdh155122 ipfgeniter_t *itp;
39123448Sdh155122 ipf_stack_t *ifs;
39133448Sdh155122 {
39143448Sdh155122 	ipstate_t *is, *next, zero;
39153448Sdh155122 	int error;
39163448Sdh155122 
39173448Sdh155122 	if (itp->igi_data == NULL)
39183448Sdh155122 		return EFAULT;
39193448Sdh155122 
39203448Sdh155122 	if (itp->igi_type != IPFGENITER_STATE)
39213448Sdh155122 		return EINVAL;
39223448Sdh155122 
39233448Sdh155122 	is = token->ipt_data;
39243448Sdh155122 	if (is == (void *)-1) {
39253448Sdh155122 		ipf_freetoken(token, ifs);
39263448Sdh155122 		return ESRCH;
39273448Sdh155122 	}
39283448Sdh155122 
39293448Sdh155122 	READ_ENTER(&ifs->ifs_ipf_state);
39303448Sdh155122 	if (is == NULL) {
39313448Sdh155122 		next = ifs->ifs_ips_list;
39323448Sdh155122 	} else {
39333448Sdh155122 		next = is->is_next;
39343448Sdh155122 	}
39353448Sdh155122 
39363448Sdh155122 	if (next != NULL) {
39373448Sdh155122 		/*
39383448Sdh155122 		 * If we find a state entry to use, bump its reference count
39393448Sdh155122 		 * so that it can be used for is_next when we come back.
39403448Sdh155122 		 */
39413448Sdh155122 		MUTEX_ENTER(&next->is_lock);
39423448Sdh155122 		next->is_ref++;
39433448Sdh155122 		MUTEX_EXIT(&next->is_lock);
39443448Sdh155122 		token->ipt_data = next;
39453448Sdh155122 	} else {
39463448Sdh155122 		bzero(&zero, sizeof(zero));
39473448Sdh155122 		next = &zero;
39483448Sdh155122 		token->ipt_data = (void *)-1;
39493448Sdh155122 	}
39503448Sdh155122 	RWLOCK_EXIT(&ifs->ifs_ipf_state);
39513448Sdh155122 
39523448Sdh155122 	/*
39533448Sdh155122 	 * If we had a prior pointer to a state entry, release it.
39543448Sdh155122 	 */
39553448Sdh155122 	if (is != NULL) {
39563448Sdh155122 		fr_statederef(NULL, &is, ifs);
39573448Sdh155122 	}
39583448Sdh155122 
39593448Sdh155122 	/*
39603448Sdh155122 	 * This should arguably be via fr_outobj() so that the state
39613448Sdh155122 	 * structure can (if required) be massaged going out.
39623448Sdh155122 	 */
39633448Sdh155122 	error = COPYOUT(next, itp->igi_data, sizeof(*next));
39643448Sdh155122 	if (error != 0)
39653448Sdh155122 		error = EFAULT;
39663448Sdh155122 
39673448Sdh155122 	return error;
39683448Sdh155122 }
39693448Sdh155122 
3970