1 /* $OpenBSD: pf.c,v 1.640 2009/04/06 12:05:55 henning Exp $ */ 2 3 /* 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2002 - 2008 Henning Brauer 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * - Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * - Redistributions in binary form must reproduce the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 * 32 * Effort sponsored in part by the Defense Advanced Research Projects 33 * Agency (DARPA) and Air Force Research Laboratory, Air Force 34 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 35 * 36 */ 37 38 #include "bpfilter.h" 39 #include "pflog.h" 40 #include "pfsync.h" 41 #include "pflow.h" 42 43 #include <sys/param.h> 44 #include <sys/systm.h> 45 #include <sys/mbuf.h> 46 #include <sys/filio.h> 47 #include <sys/socket.h> 48 #include <sys/socketvar.h> 49 #include <sys/kernel.h> 50 #include <sys/time.h> 51 #include <sys/pool.h> 52 #include <sys/proc.h> 53 #include <sys/rwlock.h> 54 55 #include <crypto/md5.h> 56 57 #include <net/if.h> 58 #include <net/if_types.h> 59 #include <net/bpf.h> 60 #include <net/route.h> 61 #include <net/radix_mpath.h> 62 63 #include <netinet/in.h> 64 #include <netinet/in_var.h> 65 #include <netinet/in_systm.h> 66 #include <netinet/ip.h> 67 #include <netinet/ip_var.h> 68 #include <netinet/tcp.h> 69 #include <netinet/tcp_seq.h> 70 #include <netinet/udp.h> 71 #include <netinet/ip_icmp.h> 72 #include <netinet/in_pcb.h> 73 #include <netinet/tcp_timer.h> 74 #include <netinet/tcp_var.h> 75 #include <netinet/udp_var.h> 76 #include <netinet/icmp_var.h> 77 #include <netinet/if_ether.h> 78 79 #include <dev/rndvar.h> 80 #include <net/pfvar.h> 81 #include <net/if_pflog.h> 82 #include <net/if_pflow.h> 83 84 #if NPFSYNC > 0 85 #include <net/if_pfsync.h> 86 #endif /* NPFSYNC > 0 */ 87 88 #ifdef INET6 89 #include <netinet/ip6.h> 90 #include <netinet/in_pcb.h> 91 #include <netinet/icmp6.h> 92 #include <netinet6/nd6.h> 93 #endif /* INET6 */ 94 95 96 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x 97 98 /* 99 * Global variables 100 */ 101 102 /* state tables */ 103 struct pf_state_tree pf_statetbl; 104 105 struct pf_altqqueue pf_altqs[2]; 106 struct pf_palist pf_pabuf; 107 struct pf_altqqueue *pf_altqs_active; 108 struct pf_altqqueue *pf_altqs_inactive; 109 struct pf_status pf_status; 110 111 u_int32_t ticket_altqs_active; 112 u_int32_t ticket_altqs_inactive; 113 int altqs_inactive_open; 114 u_int32_t ticket_pabuf; 115 116 MD5_CTX pf_tcp_secret_ctx; 117 u_char pf_tcp_secret[16]; 118 int pf_tcp_secret_init; 119 int pf_tcp_iss_off; 120 121 struct pf_anchor_stackframe { 122 struct pf_ruleset *rs; 123 struct pf_rule *r; 124 struct pf_anchor_node *parent; 125 struct pf_anchor *child; 126 } pf_anchor_stack[64]; 127 128 struct pool pf_src_tree_pl, pf_rule_pl, pf_pooladdr_pl; 129 struct pool pf_state_pl, pf_state_key_pl, pf_state_item_pl; 130 struct pool pf_altq_pl, pf_rule_item_pl; 131 132 void pf_init_threshold(struct pf_threshold *, u_int32_t, 133 u_int32_t); 134 void pf_add_threshold(struct pf_threshold *); 135 int pf_check_threshold(struct pf_threshold *); 136 137 void pf_change_ap(struct pf_addr *, u_int16_t *, 138 u_int16_t *, u_int16_t *, struct pf_addr *, 139 u_int16_t, u_int8_t, sa_family_t); 140 int pf_modulate_sack(struct mbuf *, int, struct pf_pdesc *, 141 struct tcphdr *, struct pf_state_peer *); 142 #ifdef INET6 143 void pf_change_a6(struct pf_addr *, u_int16_t *, 144 struct pf_addr *, u_int8_t); 145 #endif /* INET6 */ 146 int pf_icmp_mapping(struct pf_pdesc *, u_int8_t, int *, 147 int *, u_int16_t *, u_int16_t *); 148 void pf_change_icmp(struct pf_addr *, u_int16_t *, 149 struct pf_addr *, struct pf_addr *, u_int16_t, 150 u_int16_t *, u_int16_t *, u_int16_t *, 151 u_int16_t *, u_int8_t, sa_family_t); 152 void pf_send_tcp(const struct pf_rule *, sa_family_t, 153 const struct pf_addr *, const struct pf_addr *, 154 u_int16_t, u_int16_t, u_int32_t, u_int32_t, 155 u_int8_t, u_int16_t, u_int16_t, u_int8_t, int, 156 u_int16_t, struct ether_header *, struct ifnet *, 157 u_int); 158 void pf_send_icmp(struct mbuf *, u_int8_t, u_int8_t, 159 sa_family_t, struct pf_rule *, u_int); 160 void pf_detach_state(struct pf_state *); 161 void pf_state_key_detach(struct pf_state *, int); 162 u_int32_t pf_tcp_iss(struct pf_pdesc *); 163 void pf_rule_to_actions(struct pf_rule *, 164 struct pf_rule_actions *); 165 int pf_test_rule(struct pf_rule **, struct pf_state **, 166 int, struct pfi_kif *, struct mbuf *, int, 167 void *, struct pf_pdesc *, struct pf_rule **, 168 struct pf_ruleset **, struct ifqueue *); 169 static __inline int pf_create_state(struct pf_rule *, struct pf_rule *, 170 struct pf_rule *, struct pf_pdesc *, 171 struct pf_src_node *, struct pf_state_key *, 172 struct pf_state_key *, struct pf_state_key *, 173 struct pf_state_key *, struct mbuf *, int, 174 u_int16_t, u_int16_t, int *, struct pfi_kif *, 175 struct pf_state **, int, u_int16_t, u_int16_t, 176 int, struct pf_rule_slist *, 177 struct pf_rule_actions *); 178 int pf_test_fragment(struct pf_rule **, int, 179 struct pfi_kif *, struct mbuf *, void *, 180 struct pf_pdesc *, struct pf_rule **, 181 struct pf_ruleset **); 182 int pf_tcp_track_full(struct pf_state_peer *, 183 struct pf_state_peer *, struct pf_state **, 184 struct pfi_kif *, struct mbuf *, int, 185 struct pf_pdesc *, u_short *, int *); 186 int pf_tcp_track_sloppy(struct pf_state_peer *, 187 struct pf_state_peer *, struct pf_state **, 188 struct pf_pdesc *, u_short *); 189 int pf_test_state_tcp(struct pf_state **, int, 190 struct pfi_kif *, struct mbuf *, int, 191 void *, struct pf_pdesc *, u_short *); 192 int pf_test_state_udp(struct pf_state **, int, 193 struct pfi_kif *, struct mbuf *, int, 194 void *, struct pf_pdesc *); 195 int pf_icmp_state_lookup(struct pf_state_key_cmp *, 196 struct pf_pdesc *, struct pf_state **, struct mbuf *, 197 int, struct pfi_kif *, u_int16_t, u_int16_t, 198 int, int *, int); 199 int pf_test_state_icmp(struct pf_state **, int, 200 struct pfi_kif *, struct mbuf *, int, 201 void *, struct pf_pdesc *, u_short *); 202 int pf_test_state_other(struct pf_state **, int, 203 struct pfi_kif *, struct mbuf *, struct pf_pdesc *); 204 void pf_route(struct mbuf **, struct pf_rule *, int, 205 struct ifnet *, struct pf_state *, 206 struct pf_pdesc *); 207 void pf_route6(struct mbuf **, struct pf_rule *, int, 208 struct ifnet *, struct pf_state *, 209 struct pf_pdesc *); 210 int pf_socket_lookup(int, struct pf_pdesc *); 211 u_int8_t pf_get_wscale(struct mbuf *, int, u_int16_t, 212 sa_family_t); 213 u_int16_t pf_get_mss(struct mbuf *, int, u_int16_t, 214 sa_family_t); 215 u_int16_t pf_calc_mss(struct pf_addr *, sa_family_t, 216 u_int16_t); 217 void pf_set_rt_ifp(struct pf_state *, 218 struct pf_addr *); 219 int pf_check_proto_cksum(struct mbuf *, int, int, 220 u_int8_t, sa_family_t); 221 struct pf_divert *pf_get_divert(struct mbuf *); 222 void pf_print_state_parts(struct pf_state *, 223 struct pf_state_key *, struct pf_state_key *); 224 int pf_addr_wrap_neq(struct pf_addr_wrap *, 225 struct pf_addr_wrap *); 226 int pf_compare_state_keys(struct pf_state_key *, 227 struct pf_state_key *, struct pfi_kif *, u_int); 228 struct pf_state *pf_find_state(struct pfi_kif *, 229 struct pf_state_key_cmp *, u_int, struct mbuf *); 230 int pf_src_connlimit(struct pf_state **); 231 int pf_check_congestion(struct ifqueue *); 232 233 extern struct pool pfr_ktable_pl; 234 extern struct pool pfr_kentry_pl; 235 236 struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX] = { 237 { &pf_state_pl, PFSTATE_HIWAT, PFSTATE_HIWAT }, 238 { &pf_src_tree_pl, PFSNODE_HIWAT, PFSNODE_HIWAT }, 239 { &pf_frent_pl, PFFRAG_FRENT_HIWAT, PFFRAG_FRENT_HIWAT }, 240 { &pfr_ktable_pl, PFR_KTABLE_HIWAT, PFR_KTABLE_HIWAT }, 241 { &pfr_kentry_pl, PFR_KENTRY_HIWAT, PFR_KENTRY_HIWAT } 242 }; 243 244 enum { PF_ICMP_MULTI_NONE, PF_ICMP_MULTI_SOLICITED, PF_ICMP_MULTI_LINK }; 245 246 247 #define STATE_LOOKUP(i, k, d, s, m) \ 248 do { \ 249 s = pf_find_state(i, k, d, m); \ 250 if (s == NULL || (s)->timeout == PFTM_PURGE) \ 251 return (PF_DROP); \ 252 if (d == PF_OUT && \ 253 (((s)->rule.ptr->rt == PF_ROUTETO && \ 254 (s)->rule.ptr->direction == PF_OUT) || \ 255 ((s)->rule.ptr->rt == PF_REPLYTO && \ 256 (s)->rule.ptr->direction == PF_IN)) && \ 257 (s)->rt_kif != NULL && \ 258 (s)->rt_kif != i) \ 259 return (PF_PASS); \ 260 } while (0) 261 262 #define BOUND_IFACE(r, k) \ 263 ((r)->rule_flag & PFRULE_IFBOUND) ? (k) : pfi_all 264 265 #define STATE_INC_COUNTERS(s) \ 266 do { \ 267 struct pf_rule_item *mrm; \ 268 s->rule.ptr->states_cur++; \ 269 s->rule.ptr->states_tot++; \ 270 if (s->anchor.ptr != NULL) { \ 271 s->anchor.ptr->states_cur++; \ 272 s->anchor.ptr->states_tot++; \ 273 } \ 274 if (s->nat_rule.ptr != NULL) { \ 275 s->nat_rule.ptr->states_cur++; \ 276 s->nat_rule.ptr->states_tot++; \ 277 } \ 278 SLIST_FOREACH(mrm, &s->match_rules, entry) { \ 279 mrm->r->states_cur++; \ 280 mrm->r->states_tot++; \ 281 } \ 282 } while (0) 283 284 #define STATE_DEC_COUNTERS(s) \ 285 do { \ 286 struct pf_rule_item *mrm; \ 287 if (s->nat_rule.ptr != NULL) \ 288 s->nat_rule.ptr->states_cur--; \ 289 if (s->anchor.ptr != NULL) \ 290 s->anchor.ptr->states_cur--; \ 291 s->rule.ptr->states_cur--; \ 292 SLIST_FOREACH(mrm, &s->match_rules, entry) \ 293 mrm->r->states_cur--; \ 294 } while (0) 295 296 static __inline int pf_src_compare(struct pf_src_node *, struct pf_src_node *); 297 static __inline int pf_state_compare_key(struct pf_state_key *, 298 struct pf_state_key *); 299 static __inline int pf_state_compare_id(struct pf_state *, 300 struct pf_state *); 301 302 struct pf_src_tree tree_src_tracking; 303 304 struct pf_state_tree_id tree_id; 305 struct pf_state_queue state_list; 306 307 RB_GENERATE(pf_src_tree, pf_src_node, entry, pf_src_compare); 308 RB_GENERATE(pf_state_tree, pf_state_key, entry, pf_state_compare_key); 309 RB_GENERATE(pf_state_tree_id, pf_state, 310 entry_id, pf_state_compare_id); 311 312 static __inline int 313 pf_src_compare(struct pf_src_node *a, struct pf_src_node *b) 314 { 315 int diff; 316 317 if (a->rule.ptr > b->rule.ptr) 318 return (1); 319 if (a->rule.ptr < b->rule.ptr) 320 return (-1); 321 if ((diff = a->af - b->af) != 0) 322 return (diff); 323 switch (a->af) { 324 #ifdef INET 325 case AF_INET: 326 if (a->addr.addr32[0] > b->addr.addr32[0]) 327 return (1); 328 if (a->addr.addr32[0] < b->addr.addr32[0]) 329 return (-1); 330 break; 331 #endif /* INET */ 332 #ifdef INET6 333 case AF_INET6: 334 if (a->addr.addr32[3] > b->addr.addr32[3]) 335 return (1); 336 if (a->addr.addr32[3] < b->addr.addr32[3]) 337 return (-1); 338 if (a->addr.addr32[2] > b->addr.addr32[2]) 339 return (1); 340 if (a->addr.addr32[2] < b->addr.addr32[2]) 341 return (-1); 342 if (a->addr.addr32[1] > b->addr.addr32[1]) 343 return (1); 344 if (a->addr.addr32[1] < b->addr.addr32[1]) 345 return (-1); 346 if (a->addr.addr32[0] > b->addr.addr32[0]) 347 return (1); 348 if (a->addr.addr32[0] < b->addr.addr32[0]) 349 return (-1); 350 break; 351 #endif /* INET6 */ 352 } 353 return (0); 354 } 355 356 #ifdef INET6 357 void 358 pf_addrcpy(struct pf_addr *dst, struct pf_addr *src, sa_family_t af) 359 { 360 switch (af) { 361 #ifdef INET 362 case AF_INET: 363 dst->addr32[0] = src->addr32[0]; 364 break; 365 #endif /* INET */ 366 case AF_INET6: 367 dst->addr32[0] = src->addr32[0]; 368 dst->addr32[1] = src->addr32[1]; 369 dst->addr32[2] = src->addr32[2]; 370 dst->addr32[3] = src->addr32[3]; 371 break; 372 } 373 } 374 #endif /* INET6 */ 375 376 void 377 pf_init_threshold(struct pf_threshold *threshold, 378 u_int32_t limit, u_int32_t seconds) 379 { 380 threshold->limit = limit * PF_THRESHOLD_MULT; 381 threshold->seconds = seconds; 382 threshold->count = 0; 383 threshold->last = time_second; 384 } 385 386 void 387 pf_add_threshold(struct pf_threshold *threshold) 388 { 389 u_int32_t t = time_second, diff = t - threshold->last; 390 391 if (diff >= threshold->seconds) 392 threshold->count = 0; 393 else 394 threshold->count -= threshold->count * diff / 395 threshold->seconds; 396 threshold->count += PF_THRESHOLD_MULT; 397 threshold->last = t; 398 } 399 400 int 401 pf_check_threshold(struct pf_threshold *threshold) 402 { 403 return (threshold->count > threshold->limit); 404 } 405 406 int 407 pf_src_connlimit(struct pf_state **state) 408 { 409 int bad = 0; 410 411 (*state)->src_node->conn++; 412 (*state)->src.tcp_est = 1; 413 pf_add_threshold(&(*state)->src_node->conn_rate); 414 415 if ((*state)->rule.ptr->max_src_conn && 416 (*state)->rule.ptr->max_src_conn < 417 (*state)->src_node->conn) { 418 pf_status.lcounters[LCNT_SRCCONN]++; 419 bad++; 420 } 421 422 if ((*state)->rule.ptr->max_src_conn_rate.limit && 423 pf_check_threshold(&(*state)->src_node->conn_rate)) { 424 pf_status.lcounters[LCNT_SRCCONNRATE]++; 425 bad++; 426 } 427 428 if (!bad) 429 return (0); 430 431 if ((*state)->rule.ptr->overload_tbl) { 432 struct pfr_addr p; 433 u_int32_t killed = 0; 434 435 pf_status.lcounters[LCNT_OVERLOAD_TABLE]++; 436 if (pf_status.debug >= PF_DEBUG_MISC) { 437 printf("pf_src_connlimit: blocking address "); 438 pf_print_host(&(*state)->src_node->addr, 0, 439 (*state)->key[PF_SK_WIRE]->af); 440 } 441 442 bzero(&p, sizeof(p)); 443 p.pfra_af = (*state)->key[PF_SK_WIRE]->af; 444 switch ((*state)->key[PF_SK_WIRE]->af) { 445 #ifdef INET 446 case AF_INET: 447 p.pfra_net = 32; 448 p.pfra_ip4addr = (*state)->src_node->addr.v4; 449 break; 450 #endif /* INET */ 451 #ifdef INET6 452 case AF_INET6: 453 p.pfra_net = 128; 454 p.pfra_ip6addr = (*state)->src_node->addr.v6; 455 break; 456 #endif /* INET6 */ 457 } 458 459 pfr_insert_kentry((*state)->rule.ptr->overload_tbl, 460 &p, time_second); 461 462 /* kill existing states if that's required. */ 463 if ((*state)->rule.ptr->flush) { 464 struct pf_state_key *sk; 465 struct pf_state *st; 466 467 pf_status.lcounters[LCNT_OVERLOAD_FLUSH]++; 468 RB_FOREACH(st, pf_state_tree_id, &tree_id) { 469 sk = st->key[PF_SK_WIRE]; 470 /* 471 * Kill states from this source. (Only those 472 * from the same rule if PF_FLUSH_GLOBAL is not 473 * set) 474 */ 475 if (sk->af == 476 (*state)->key[PF_SK_WIRE]->af && 477 (((*state)->direction == PF_OUT && 478 PF_AEQ(&(*state)->src_node->addr, 479 &sk->addr[0], sk->af)) || 480 ((*state)->direction == PF_IN && 481 PF_AEQ(&(*state)->src_node->addr, 482 &sk->addr[1], sk->af))) && 483 ((*state)->rule.ptr->flush & 484 PF_FLUSH_GLOBAL || 485 (*state)->rule.ptr == st->rule.ptr)) { 486 st->timeout = PFTM_PURGE; 487 st->src.state = st->dst.state = 488 TCPS_CLOSED; 489 killed++; 490 } 491 } 492 if (pf_status.debug >= PF_DEBUG_MISC) 493 printf(", %u states killed", killed); 494 } 495 if (pf_status.debug >= PF_DEBUG_MISC) 496 printf("\n"); 497 } 498 499 /* kill this state */ 500 (*state)->timeout = PFTM_PURGE; 501 (*state)->src.state = (*state)->dst.state = TCPS_CLOSED; 502 return (1); 503 } 504 505 int 506 pf_insert_src_node(struct pf_src_node **sn, struct pf_rule *rule, 507 struct pf_addr *src, sa_family_t af) 508 { 509 struct pf_src_node k; 510 511 if (*sn == NULL) { 512 k.af = af; 513 PF_ACPY(&k.addr, src, af); 514 if (rule->rule_flag & PFRULE_RULESRCTRACK || 515 rule->rpool.opts & PF_POOL_STICKYADDR) 516 k.rule.ptr = rule; 517 else 518 k.rule.ptr = NULL; 519 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++; 520 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k); 521 } 522 if (*sn == NULL) { 523 if (!rule->max_src_nodes || 524 rule->src_nodes < rule->max_src_nodes) 525 (*sn) = pool_get(&pf_src_tree_pl, PR_NOWAIT | PR_ZERO); 526 else 527 pf_status.lcounters[LCNT_SRCNODES]++; 528 if ((*sn) == NULL) 529 return (-1); 530 531 pf_init_threshold(&(*sn)->conn_rate, 532 rule->max_src_conn_rate.limit, 533 rule->max_src_conn_rate.seconds); 534 535 (*sn)->af = af; 536 if (rule->rule_flag & PFRULE_RULESRCTRACK || 537 rule->rpool.opts & PF_POOL_STICKYADDR) 538 (*sn)->rule.ptr = rule; 539 else 540 (*sn)->rule.ptr = NULL; 541 PF_ACPY(&(*sn)->addr, src, af); 542 if (RB_INSERT(pf_src_tree, 543 &tree_src_tracking, *sn) != NULL) { 544 if (pf_status.debug >= PF_DEBUG_MISC) { 545 printf("pf: src_tree insert failed: "); 546 pf_print_host(&(*sn)->addr, 0, af); 547 printf("\n"); 548 } 549 pool_put(&pf_src_tree_pl, *sn); 550 return (-1); 551 } 552 (*sn)->creation = time_second; 553 (*sn)->ruletype = rule->action; 554 if ((*sn)->rule.ptr != NULL) 555 (*sn)->rule.ptr->src_nodes++; 556 pf_status.scounters[SCNT_SRC_NODE_INSERT]++; 557 pf_status.src_nodes++; 558 } else { 559 if (rule->max_src_states && 560 (*sn)->states >= rule->max_src_states) { 561 pf_status.lcounters[LCNT_SRCSTATES]++; 562 return (-1); 563 } 564 } 565 return (0); 566 } 567 568 /* state table stuff */ 569 570 static __inline int 571 pf_state_compare_key(struct pf_state_key *a, struct pf_state_key *b) 572 { 573 int diff; 574 575 if ((diff = a->proto - b->proto) != 0) 576 return (diff); 577 if ((diff = a->af - b->af) != 0) 578 return (diff); 579 switch (a->af) { 580 #ifdef INET 581 case AF_INET: 582 if (a->addr[0].addr32[0] > b->addr[0].addr32[0]) 583 return (1); 584 if (a->addr[0].addr32[0] < b->addr[0].addr32[0]) 585 return (-1); 586 if (a->addr[1].addr32[0] > b->addr[1].addr32[0]) 587 return (1); 588 if (a->addr[1].addr32[0] < b->addr[1].addr32[0]) 589 return (-1); 590 break; 591 #endif /* INET */ 592 #ifdef INET6 593 case AF_INET6: 594 if (a->addr[0].addr32[3] > b->addr[0].addr32[3]) 595 return (1); 596 if (a->addr[0].addr32[3] < b->addr[0].addr32[3]) 597 return (-1); 598 if (a->addr[1].addr32[3] > b->addr[1].addr32[3]) 599 return (1); 600 if (a->addr[1].addr32[3] < b->addr[1].addr32[3]) 601 return (-1); 602 if (a->addr[0].addr32[2] > b->addr[0].addr32[2]) 603 return (1); 604 if (a->addr[0].addr32[2] < b->addr[0].addr32[2]) 605 return (-1); 606 if (a->addr[1].addr32[2] > b->addr[1].addr32[2]) 607 return (1); 608 if (a->addr[1].addr32[2] < b->addr[1].addr32[2]) 609 return (-1); 610 if (a->addr[0].addr32[1] > b->addr[0].addr32[1]) 611 return (1); 612 if (a->addr[0].addr32[1] < b->addr[0].addr32[1]) 613 return (-1); 614 if (a->addr[1].addr32[1] > b->addr[1].addr32[1]) 615 return (1); 616 if (a->addr[1].addr32[1] < b->addr[1].addr32[1]) 617 return (-1); 618 if (a->addr[0].addr32[0] > b->addr[0].addr32[0]) 619 return (1); 620 if (a->addr[0].addr32[0] < b->addr[0].addr32[0]) 621 return (-1); 622 if (a->addr[1].addr32[0] > b->addr[1].addr32[0]) 623 return (1); 624 if (a->addr[1].addr32[0] < b->addr[1].addr32[0]) 625 return (-1); 626 break; 627 #endif /* INET6 */ 628 } 629 630 if ((diff = a->port[0] - b->port[0]) != 0) 631 return (diff); 632 if ((diff = a->port[1] - b->port[1]) != 0) 633 return (diff); 634 635 return (0); 636 } 637 638 static __inline int 639 pf_state_compare_id(struct pf_state *a, struct pf_state *b) 640 { 641 if (a->id > b->id) 642 return (1); 643 if (a->id < b->id) 644 return (-1); 645 if (a->creatorid > b->creatorid) 646 return (1); 647 if (a->creatorid < b->creatorid) 648 return (-1); 649 650 return (0); 651 } 652 653 int 654 pf_state_key_attach(struct pf_state_key *sk, struct pf_state *s, int idx) 655 { 656 struct pf_state_item *si; 657 struct pf_state_key *cur; 658 struct pf_state *olds = NULL; 659 660 KASSERT(s->key[idx] == NULL); /* XXX handle this? */ 661 662 if ((cur = RB_INSERT(pf_state_tree, &pf_statetbl, sk)) != NULL) { 663 /* key exists. check for same kif, if none, add to key */ 664 TAILQ_FOREACH(si, &cur->states, entry) 665 if (si->s->kif == s->kif && 666 si->s->direction == s->direction) { 667 if (sk->proto == IPPROTO_TCP && 668 si->s->src.state >= TCPS_FIN_WAIT_2 && 669 si->s->dst.state >= TCPS_FIN_WAIT_2) { 670 si->s->src.state = si->s->dst.state = 671 TCPS_CLOSED; 672 /* unlink late or sks can go away */ 673 olds = si->s; 674 } else { 675 if (pf_status.debug >= PF_DEBUG_MISC) { 676 printf("pf: %s key attach " 677 "failed on %s: ", 678 (idx == PF_SK_WIRE) ? 679 "wire" : "stack", 680 s->kif->pfik_name); 681 pf_print_state_parts(s, 682 (idx == PF_SK_WIRE) ? 683 sk : NULL, 684 (idx == PF_SK_STACK) ? 685 sk : NULL); 686 printf(", existing: "); 687 pf_print_state_parts(si->s, 688 (idx == PF_SK_WIRE) ? 689 sk : NULL, 690 (idx == PF_SK_STACK) ? 691 sk : NULL); 692 printf("\n"); 693 } 694 pool_put(&pf_state_key_pl, sk); 695 return (-1); /* collision! */ 696 } 697 } 698 pool_put(&pf_state_key_pl, sk); 699 s->key[idx] = cur; 700 } else 701 s->key[idx] = sk; 702 703 if ((si = pool_get(&pf_state_item_pl, PR_NOWAIT)) == NULL) { 704 pf_state_key_detach(s, idx); 705 return (-1); 706 } 707 si->s = s; 708 709 /* list is sorted, if-bound states before floating */ 710 if (s->kif == pfi_all) 711 TAILQ_INSERT_TAIL(&s->key[idx]->states, si, entry); 712 else 713 TAILQ_INSERT_HEAD(&s->key[idx]->states, si, entry); 714 715 if (olds) 716 pf_unlink_state(olds); 717 718 return (0); 719 } 720 721 void 722 pf_detach_state(struct pf_state *s) 723 { 724 if (s->key[PF_SK_WIRE] == s->key[PF_SK_STACK]) 725 s->key[PF_SK_WIRE] = NULL; 726 727 if (s->key[PF_SK_STACK] != NULL) 728 pf_state_key_detach(s, PF_SK_STACK); 729 730 if (s->key[PF_SK_WIRE] != NULL) 731 pf_state_key_detach(s, PF_SK_WIRE); 732 } 733 734 void 735 pf_state_key_detach(struct pf_state *s, int idx) 736 { 737 struct pf_state_item *si; 738 739 si = TAILQ_FIRST(&s->key[idx]->states); 740 while (si && si->s != s) 741 si = TAILQ_NEXT(si, entry); 742 743 if (si) { 744 TAILQ_REMOVE(&s->key[idx]->states, si, entry); 745 pool_put(&pf_state_item_pl, si); 746 } 747 748 if (TAILQ_EMPTY(&s->key[idx]->states)) { 749 RB_REMOVE(pf_state_tree, &pf_statetbl, s->key[idx]); 750 if (s->key[idx]->reverse) 751 s->key[idx]->reverse->reverse = NULL; 752 if (s->key[idx]->inp) 753 s->key[idx]->inp->inp_pf_sk = NULL; 754 pool_put(&pf_state_key_pl, s->key[idx]); 755 } 756 s->key[idx] = NULL; 757 } 758 759 struct pf_state_key * 760 pf_alloc_state_key(int pool_flags) 761 { 762 struct pf_state_key *sk; 763 764 if ((sk = pool_get(&pf_state_key_pl, pool_flags)) == NULL) 765 return (NULL); 766 TAILQ_INIT(&sk->states); 767 768 return (sk); 769 } 770 771 int 772 pf_state_key_setup(struct pf_pdesc *pd, struct pf_rule *nr, 773 struct pf_state_key **skw, struct pf_state_key **sks, 774 struct pf_state_key **skp, struct pf_state_key **nkp, 775 struct pf_addr *saddr, struct pf_addr *daddr, 776 u_int16_t sport, u_int16_t dport) 777 { 778 KASSERT((*skp == NULL && *nkp == NULL)); 779 780 if ((*skp = pf_alloc_state_key(PR_NOWAIT | PR_ZERO)) == NULL) 781 return (ENOMEM); 782 783 PF_ACPY(&(*skp)->addr[pd->sidx], saddr, pd->af); 784 PF_ACPY(&(*skp)->addr[pd->didx], daddr, pd->af); 785 (*skp)->port[pd->sidx] = sport; 786 (*skp)->port[pd->didx] = dport; 787 (*skp)->proto = pd->proto; 788 (*skp)->af = pd->af; 789 790 if (nr != NULL) { 791 if ((*nkp = pf_alloc_state_key(PR_NOWAIT | PR_ZERO)) == NULL) 792 return (ENOMEM); /* caller must handle cleanup */ 793 794 /* XXX maybe just bcopy and TAILQ_INIT(&(*nkp)->states) */ 795 PF_ACPY(&(*nkp)->addr[0], &(*skp)->addr[0], pd->af); 796 PF_ACPY(&(*nkp)->addr[1], &(*skp)->addr[1], pd->af); 797 (*nkp)->port[0] = (*skp)->port[0]; 798 (*nkp)->port[1] = (*skp)->port[1]; 799 (*nkp)->proto = pd->proto; 800 (*nkp)->af = pd->af; 801 } else 802 *nkp = *skp; 803 804 if (pd->dir == PF_IN) { 805 *skw = *skp; 806 *sks = *nkp; 807 } else { 808 *sks = *skp; 809 *skw = *nkp; 810 } 811 return (0); 812 } 813 814 815 int 816 pf_state_insert(struct pfi_kif *kif, struct pf_state_key *skw, 817 struct pf_state_key *sks, struct pf_state *s) 818 { 819 splsoftassert(IPL_SOFTNET); 820 821 s->kif = kif; 822 823 if (skw == sks) { 824 if (pf_state_key_attach(skw, s, PF_SK_WIRE)) 825 return (-1); 826 s->key[PF_SK_STACK] = s->key[PF_SK_WIRE]; 827 } else { 828 if (pf_state_key_attach(skw, s, PF_SK_WIRE)) { 829 pool_put(&pf_state_key_pl, sks); 830 return (-1); 831 } 832 if (pf_state_key_attach(sks, s, PF_SK_STACK)) { 833 pf_state_key_detach(s, PF_SK_WIRE); 834 return (-1); 835 } 836 } 837 838 if (s->id == 0 && s->creatorid == 0) { 839 s->id = htobe64(pf_status.stateid++); 840 s->creatorid = pf_status.hostid; 841 } 842 if (RB_INSERT(pf_state_tree_id, &tree_id, s) != NULL) { 843 if (pf_status.debug >= PF_DEBUG_MISC) { 844 printf("pf: state insert failed: " 845 "id: %016llx creatorid: %08x", 846 betoh64(s->id), ntohl(s->creatorid)); 847 printf("\n"); 848 } 849 pf_detach_state(s); 850 return (-1); 851 } 852 TAILQ_INSERT_TAIL(&state_list, s, entry_list); 853 pf_status.fcounters[FCNT_STATE_INSERT]++; 854 pf_status.states++; 855 pfi_kif_ref(kif, PFI_KIF_REF_STATE); 856 #if NPFSYNC > 0 857 pfsync_insert_state(s); 858 #endif 859 return (0); 860 } 861 862 struct pf_state * 863 pf_find_state_byid(struct pf_state_cmp *key) 864 { 865 pf_status.fcounters[FCNT_STATE_SEARCH]++; 866 867 return (RB_FIND(pf_state_tree_id, &tree_id, (struct pf_state *)key)); 868 } 869 870 /* XXX debug function, intended to be removed one day */ 871 int 872 pf_compare_state_keys(struct pf_state_key *a, struct pf_state_key *b, 873 struct pfi_kif *kif, u_int dir) 874 { 875 /* a (from hdr) and b (new) must be exact opposites of each other */ 876 if (a->af == b->af && a->proto == b->proto && 877 PF_AEQ(&a->addr[0], &b->addr[1], a->af) && 878 PF_AEQ(&a->addr[1], &b->addr[0], a->af) && 879 a->port[0] == b->port[1] && 880 a->port[1] == b->port[0]) 881 return (0); 882 else { 883 /* mismatch. must not happen. */ 884 printf("pf: state key linking mismatch! dir=%s, " 885 "if=%s, stored af=%u, a0: ", 886 dir == PF_OUT ? "OUT" : "IN", kif->pfik_name, a->af); 887 pf_print_host(&a->addr[0], a->port[0], a->af); 888 printf(", a1: "); 889 pf_print_host(&a->addr[1], a->port[1], a->af); 890 printf(", proto=%u", a->proto); 891 printf(", found af=%u, a0: ", b->af); 892 pf_print_host(&b->addr[0], b->port[0], b->af); 893 printf(", a1: "); 894 pf_print_host(&b->addr[1], b->port[1], b->af); 895 printf(", proto=%u", b->proto); 896 printf(".\n"); 897 return (-1); 898 } 899 } 900 901 struct pf_state * 902 pf_find_state(struct pfi_kif *kif, struct pf_state_key_cmp *key, u_int dir, 903 struct mbuf *m) 904 { 905 struct pf_state_key *sk; 906 struct pf_state_item *si; 907 908 pf_status.fcounters[FCNT_STATE_SEARCH]++; 909 910 if (dir == PF_OUT && m->m_pkthdr.pf.statekey && 911 ((struct pf_state_key *)m->m_pkthdr.pf.statekey)->reverse) 912 sk = ((struct pf_state_key *)m->m_pkthdr.pf.statekey)->reverse; 913 else { 914 if ((sk = RB_FIND(pf_state_tree, &pf_statetbl, 915 (struct pf_state_key *)key)) == NULL) 916 return (NULL); 917 if (dir == PF_OUT && m->m_pkthdr.pf.statekey && 918 pf_compare_state_keys(m->m_pkthdr.pf.statekey, sk, 919 kif, dir) == 0) { 920 ((struct pf_state_key *) 921 m->m_pkthdr.pf.statekey)->reverse = sk; 922 sk->reverse = m->m_pkthdr.pf.statekey; 923 } 924 } 925 926 if (dir == PF_OUT) 927 m->m_pkthdr.pf.statekey = NULL; 928 929 /* list is sorted, if-bound states before floating ones */ 930 TAILQ_FOREACH(si, &sk->states, entry) 931 if ((si->s->kif == pfi_all || si->s->kif == kif) && 932 sk == (dir == PF_IN ? si->s->key[PF_SK_WIRE] : 933 si->s->key[PF_SK_STACK])) 934 return (si->s); 935 936 return (NULL); 937 } 938 939 struct pf_state * 940 pf_find_state_all(struct pf_state_key_cmp *key, u_int dir, int *more) 941 { 942 struct pf_state_key *sk; 943 struct pf_state_item *si, *ret = NULL; 944 945 pf_status.fcounters[FCNT_STATE_SEARCH]++; 946 947 sk = RB_FIND(pf_state_tree, &pf_statetbl, (struct pf_state_key *)key); 948 949 if (sk != NULL) { 950 TAILQ_FOREACH(si, &sk->states, entry) 951 if (dir == PF_INOUT || 952 (sk == (dir == PF_IN ? si->s->key[PF_SK_WIRE] : 953 si->s->key[PF_SK_STACK]))) { 954 if (more == NULL) 955 return (si->s); 956 957 if (ret) 958 (*more)++; 959 else 960 ret = si; 961 } 962 } 963 return (ret ? ret->s : NULL); 964 } 965 966 /* END state table stuff */ 967 968 969 void 970 pf_purge_thread(void *v) 971 { 972 int nloops = 0, s; 973 974 for (;;) { 975 tsleep(pf_purge_thread, PWAIT, "pftm", 1 * hz); 976 977 s = splsoftnet(); 978 979 /* process a fraction of the state table every second */ 980 pf_purge_expired_states(1 + (pf_status.states 981 / pf_default_rule.timeout[PFTM_INTERVAL])); 982 983 /* purge other expired types every PFTM_INTERVAL seconds */ 984 if (++nloops >= pf_default_rule.timeout[PFTM_INTERVAL]) { 985 pf_purge_expired_fragments(); 986 pf_purge_expired_src_nodes(0); 987 nloops = 0; 988 } 989 990 splx(s); 991 } 992 } 993 994 u_int32_t 995 pf_state_expires(const struct pf_state *state) 996 { 997 u_int32_t timeout; 998 u_int32_t start; 999 u_int32_t end; 1000 u_int32_t states; 1001 1002 /* handle all PFTM_* > PFTM_MAX here */ 1003 if (state->timeout == PFTM_PURGE) 1004 return (time_second); 1005 if (state->timeout == PFTM_UNTIL_PACKET) 1006 return (0); 1007 KASSERT(state->timeout != PFTM_UNLINKED); 1008 KASSERT(state->timeout < PFTM_MAX); 1009 timeout = state->rule.ptr->timeout[state->timeout]; 1010 if (!timeout) 1011 timeout = pf_default_rule.timeout[state->timeout]; 1012 start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START]; 1013 if (start) { 1014 end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END]; 1015 states = state->rule.ptr->states_cur; 1016 } else { 1017 start = pf_default_rule.timeout[PFTM_ADAPTIVE_START]; 1018 end = pf_default_rule.timeout[PFTM_ADAPTIVE_END]; 1019 states = pf_status.states; 1020 } 1021 if (end && states > start && start < end) { 1022 if (states < end) 1023 return (state->expire + timeout * (end - states) / 1024 (end - start)); 1025 else 1026 return (time_second); 1027 } 1028 return (state->expire + timeout); 1029 } 1030 1031 void 1032 pf_purge_expired_src_nodes(int waslocked) 1033 { 1034 struct pf_src_node *cur, *next; 1035 int locked = waslocked; 1036 1037 for (cur = RB_MIN(pf_src_tree, &tree_src_tracking); cur; cur = next) { 1038 next = RB_NEXT(pf_src_tree, &tree_src_tracking, cur); 1039 1040 if (cur->states <= 0 && cur->expire <= time_second) { 1041 if (! locked) { 1042 rw_enter_write(&pf_consistency_lock); 1043 next = RB_NEXT(pf_src_tree, 1044 &tree_src_tracking, cur); 1045 locked = 1; 1046 } 1047 if (cur->rule.ptr != NULL) { 1048 cur->rule.ptr->src_nodes--; 1049 if (cur->rule.ptr->states_cur <= 0 && 1050 cur->rule.ptr->max_src_nodes <= 0) 1051 pf_rm_rule(NULL, cur->rule.ptr); 1052 } 1053 RB_REMOVE(pf_src_tree, &tree_src_tracking, cur); 1054 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 1055 pf_status.src_nodes--; 1056 pool_put(&pf_src_tree_pl, cur); 1057 } 1058 } 1059 1060 if (locked && !waslocked) 1061 rw_exit_write(&pf_consistency_lock); 1062 } 1063 1064 void 1065 pf_src_tree_remove_state(struct pf_state *s) 1066 { 1067 u_int32_t timeout; 1068 1069 if (s->src_node != NULL) { 1070 if (s->src.tcp_est) 1071 --s->src_node->conn; 1072 if (--s->src_node->states <= 0) { 1073 timeout = s->rule.ptr->timeout[PFTM_SRC_NODE]; 1074 if (!timeout) 1075 timeout = 1076 pf_default_rule.timeout[PFTM_SRC_NODE]; 1077 s->src_node->expire = time_second + timeout; 1078 } 1079 } 1080 if (s->nat_src_node != s->src_node && s->nat_src_node != NULL) { 1081 if (--s->nat_src_node->states <= 0) { 1082 timeout = s->rule.ptr->timeout[PFTM_SRC_NODE]; 1083 if (!timeout) 1084 timeout = 1085 pf_default_rule.timeout[PFTM_SRC_NODE]; 1086 s->nat_src_node->expire = time_second + timeout; 1087 } 1088 } 1089 s->src_node = s->nat_src_node = NULL; 1090 } 1091 1092 /* callers should be at splsoftnet */ 1093 void 1094 pf_unlink_state(struct pf_state *cur) 1095 { 1096 splsoftassert(IPL_SOFTNET); 1097 1098 if (cur->src.state == PF_TCPS_PROXY_DST) { 1099 /* XXX wire key the right one? */ 1100 pf_send_tcp(cur->rule.ptr, cur->key[PF_SK_WIRE]->af, 1101 &cur->key[PF_SK_WIRE]->addr[1], 1102 &cur->key[PF_SK_WIRE]->addr[0], 1103 cur->key[PF_SK_WIRE]->port[1], 1104 cur->key[PF_SK_WIRE]->port[0], 1105 cur->src.seqhi, cur->src.seqlo + 1, 1106 TH_RST|TH_ACK, 0, 0, 0, 1, cur->tag, NULL, NULL, 1107 cur->rtableid); 1108 } 1109 RB_REMOVE(pf_state_tree_id, &tree_id, cur); 1110 #if NPFLOW > 0 1111 if (cur->state_flags & PFSTATE_PFLOW) 1112 export_pflow(cur); 1113 #endif 1114 #if NPFSYNC > 0 1115 pfsync_delete_state(cur); 1116 #endif 1117 cur->timeout = PFTM_UNLINKED; 1118 pf_src_tree_remove_state(cur); 1119 pf_detach_state(cur); 1120 } 1121 1122 /* callers should be at splsoftnet and hold the 1123 * write_lock on pf_consistency_lock */ 1124 void 1125 pf_free_state(struct pf_state *cur) 1126 { 1127 struct pf_rule_item *ri; 1128 1129 splsoftassert(IPL_SOFTNET); 1130 1131 #if NPFSYNC > 0 1132 if (pfsync_state_in_use(cur)) 1133 return; 1134 #endif 1135 KASSERT(cur->timeout == PFTM_UNLINKED); 1136 if (--cur->rule.ptr->states_cur <= 0 && 1137 cur->rule.ptr->src_nodes <= 0) 1138 pf_rm_rule(NULL, cur->rule.ptr); 1139 if (cur->nat_rule.ptr != NULL) 1140 if (--cur->nat_rule.ptr->states_cur <= 0 && 1141 cur->nat_rule.ptr->src_nodes <= 0) 1142 pf_rm_rule(NULL, cur->nat_rule.ptr); 1143 if (cur->anchor.ptr != NULL) 1144 if (--cur->anchor.ptr->states_cur <= 0) 1145 pf_rm_rule(NULL, cur->anchor.ptr); 1146 while ((ri = SLIST_FIRST(&cur->match_rules))) { 1147 SLIST_REMOVE_HEAD(&cur->match_rules, entry); 1148 if (--ri->r->states_cur <= 0 && 1149 ri->r->src_nodes <= 0) 1150 pf_rm_rule(NULL, ri->r); 1151 pool_put(&pf_rule_item_pl, ri); 1152 } 1153 pf_normalize_tcp_cleanup(cur); 1154 pfi_kif_unref(cur->kif, PFI_KIF_REF_STATE); 1155 TAILQ_REMOVE(&state_list, cur, entry_list); 1156 if (cur->tag) 1157 pf_tag_unref(cur->tag); 1158 pool_put(&pf_state_pl, cur); 1159 pf_status.fcounters[FCNT_STATE_REMOVALS]++; 1160 pf_status.states--; 1161 } 1162 1163 void 1164 pf_purge_expired_states(u_int32_t maxcheck) 1165 { 1166 static struct pf_state *cur = NULL; 1167 struct pf_state *next; 1168 int locked = 0; 1169 1170 while (maxcheck--) { 1171 /* wrap to start of list when we hit the end */ 1172 if (cur == NULL) { 1173 cur = TAILQ_FIRST(&state_list); 1174 if (cur == NULL) 1175 break; /* list empty */ 1176 } 1177 1178 /* get next state, as cur may get deleted */ 1179 next = TAILQ_NEXT(cur, entry_list); 1180 1181 if (cur->timeout == PFTM_UNLINKED) { 1182 /* free unlinked state */ 1183 if (! locked) { 1184 rw_enter_write(&pf_consistency_lock); 1185 locked = 1; 1186 } 1187 pf_free_state(cur); 1188 } else if (pf_state_expires(cur) <= time_second) { 1189 /* unlink and free expired state */ 1190 pf_unlink_state(cur); 1191 if (! locked) { 1192 rw_enter_write(&pf_consistency_lock); 1193 locked = 1; 1194 } 1195 pf_free_state(cur); 1196 } 1197 cur = next; 1198 } 1199 1200 if (locked) 1201 rw_exit_write(&pf_consistency_lock); 1202 } 1203 1204 int 1205 pf_tbladdr_setup(struct pf_ruleset *rs, struct pf_addr_wrap *aw) 1206 { 1207 if (aw->type != PF_ADDR_TABLE) 1208 return (0); 1209 if ((aw->p.tbl = pfr_attach_table(rs, aw->v.tblname, 1)) == NULL) 1210 return (1); 1211 return (0); 1212 } 1213 1214 void 1215 pf_tbladdr_remove(struct pf_addr_wrap *aw) 1216 { 1217 if (aw->type != PF_ADDR_TABLE || aw->p.tbl == NULL) 1218 return; 1219 pfr_detach_table(aw->p.tbl); 1220 aw->p.tbl = NULL; 1221 } 1222 1223 void 1224 pf_tbladdr_copyout(struct pf_addr_wrap *aw) 1225 { 1226 struct pfr_ktable *kt = aw->p.tbl; 1227 1228 if (aw->type != PF_ADDR_TABLE || kt == NULL) 1229 return; 1230 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 1231 kt = kt->pfrkt_root; 1232 aw->p.tbl = NULL; 1233 aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ? 1234 kt->pfrkt_cnt : -1; 1235 } 1236 1237 void 1238 pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af) 1239 { 1240 switch (af) { 1241 #ifdef INET 1242 case AF_INET: { 1243 u_int32_t a = ntohl(addr->addr32[0]); 1244 printf("%u.%u.%u.%u", (a>>24)&255, (a>>16)&255, 1245 (a>>8)&255, a&255); 1246 if (p) { 1247 p = ntohs(p); 1248 printf(":%u", p); 1249 } 1250 break; 1251 } 1252 #endif /* INET */ 1253 #ifdef INET6 1254 case AF_INET6: { 1255 u_int16_t b; 1256 u_int8_t i, curstart, curend, maxstart, maxend; 1257 curstart = curend = maxstart = maxend = 255; 1258 for (i = 0; i < 8; i++) { 1259 if (!addr->addr16[i]) { 1260 if (curstart == 255) 1261 curstart = i; 1262 curend = i; 1263 } else { 1264 if ((curend - curstart) > 1265 (maxend - maxstart)) { 1266 maxstart = curstart; 1267 maxend = curend; 1268 } 1269 curstart = curend = 255; 1270 } 1271 } 1272 if ((curend - curstart) > 1273 (maxend - maxstart)) { 1274 maxstart = curstart; 1275 maxend = curend; 1276 } 1277 for (i = 0; i < 8; i++) { 1278 if (i >= maxstart && i <= maxend) { 1279 if (i == 0) 1280 printf(":"); 1281 if (i == maxend) 1282 printf(":"); 1283 } else { 1284 b = ntohs(addr->addr16[i]); 1285 printf("%x", b); 1286 if (i < 7) 1287 printf(":"); 1288 } 1289 } 1290 if (p) { 1291 p = ntohs(p); 1292 printf("[%u]", p); 1293 } 1294 break; 1295 } 1296 #endif /* INET6 */ 1297 } 1298 } 1299 1300 void 1301 pf_print_state(struct pf_state *s) 1302 { 1303 pf_print_state_parts(s, NULL, NULL); 1304 } 1305 1306 void 1307 pf_print_state_parts(struct pf_state *s, 1308 struct pf_state_key *skwp, struct pf_state_key *sksp) 1309 { 1310 struct pf_state_key *skw, *sks; 1311 u_int8_t proto, dir; 1312 1313 /* Do our best to fill these, but they're skipped if NULL */ 1314 skw = skwp ? skwp : (s ? s->key[PF_SK_WIRE] : NULL); 1315 sks = sksp ? sksp : (s ? s->key[PF_SK_STACK] : NULL); 1316 proto = skw ? skw->proto : (sks ? sks->proto : 0); 1317 dir = s ? s->direction : 0; 1318 1319 switch (proto) { 1320 case IPPROTO_IPV4: 1321 printf("IPv4"); 1322 break; 1323 case IPPROTO_IPV6: 1324 printf("IPv6"); 1325 break; 1326 case IPPROTO_TCP: 1327 printf("TCP"); 1328 break; 1329 case IPPROTO_UDP: 1330 printf("UDP"); 1331 break; 1332 case IPPROTO_ICMP: 1333 printf("ICMP"); 1334 break; 1335 case IPPROTO_ICMPV6: 1336 printf("ICMPv6"); 1337 break; 1338 default: 1339 printf("%u", skw->proto); 1340 break; 1341 } 1342 switch (dir) { 1343 case PF_IN: 1344 printf(" in"); 1345 break; 1346 case PF_OUT: 1347 printf(" out"); 1348 break; 1349 } 1350 if (skw) { 1351 printf(" wire: "); 1352 pf_print_host(&skw->addr[0], skw->port[0], skw->af); 1353 printf(" "); 1354 pf_print_host(&skw->addr[1], skw->port[1], skw->af); 1355 } 1356 if (sks) { 1357 printf(" stack: "); 1358 if (sks != skw) { 1359 pf_print_host(&sks->addr[0], sks->port[0], sks->af); 1360 printf(" "); 1361 pf_print_host(&sks->addr[1], sks->port[1], sks->af); 1362 } else 1363 printf("-"); 1364 } 1365 if (s) { 1366 if (proto == IPPROTO_TCP) { 1367 printf(" [lo=%u high=%u win=%u modulator=%u", 1368 s->src.seqlo, s->src.seqhi, 1369 s->src.max_win, s->src.seqdiff); 1370 if (s->src.wscale && s->dst.wscale) 1371 printf(" wscale=%u", 1372 s->src.wscale & PF_WSCALE_MASK); 1373 printf("]"); 1374 printf(" [lo=%u high=%u win=%u modulator=%u", 1375 s->dst.seqlo, s->dst.seqhi, 1376 s->dst.max_win, s->dst.seqdiff); 1377 if (s->src.wscale && s->dst.wscale) 1378 printf(" wscale=%u", 1379 s->dst.wscale & PF_WSCALE_MASK); 1380 printf("]"); 1381 } 1382 printf(" %u:%u", s->src.state, s->dst.state); 1383 } 1384 } 1385 1386 void 1387 pf_print_flags(u_int8_t f) 1388 { 1389 if (f) 1390 printf(" "); 1391 if (f & TH_FIN) 1392 printf("F"); 1393 if (f & TH_SYN) 1394 printf("S"); 1395 if (f & TH_RST) 1396 printf("R"); 1397 if (f & TH_PUSH) 1398 printf("P"); 1399 if (f & TH_ACK) 1400 printf("A"); 1401 if (f & TH_URG) 1402 printf("U"); 1403 if (f & TH_ECE) 1404 printf("E"); 1405 if (f & TH_CWR) 1406 printf("W"); 1407 } 1408 1409 #define PF_SET_SKIP_STEPS(i) \ 1410 do { \ 1411 while (head[i] != cur) { \ 1412 head[i]->skip[i].ptr = cur; \ 1413 head[i] = TAILQ_NEXT(head[i], entries); \ 1414 } \ 1415 } while (0) 1416 1417 void 1418 pf_calc_skip_steps(struct pf_rulequeue *rules) 1419 { 1420 struct pf_rule *cur, *prev, *head[PF_SKIP_COUNT]; 1421 int i; 1422 1423 cur = TAILQ_FIRST(rules); 1424 prev = cur; 1425 for (i = 0; i < PF_SKIP_COUNT; ++i) 1426 head[i] = cur; 1427 while (cur != NULL) { 1428 1429 if (cur->kif != prev->kif || cur->ifnot != prev->ifnot) 1430 PF_SET_SKIP_STEPS(PF_SKIP_IFP); 1431 if (cur->direction != prev->direction) 1432 PF_SET_SKIP_STEPS(PF_SKIP_DIR); 1433 if (cur->af != prev->af) 1434 PF_SET_SKIP_STEPS(PF_SKIP_AF); 1435 if (cur->proto != prev->proto) 1436 PF_SET_SKIP_STEPS(PF_SKIP_PROTO); 1437 if (cur->src.neg != prev->src.neg || 1438 pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr)) 1439 PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR); 1440 if (cur->src.port[0] != prev->src.port[0] || 1441 cur->src.port[1] != prev->src.port[1] || 1442 cur->src.port_op != prev->src.port_op) 1443 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT); 1444 if (cur->dst.neg != prev->dst.neg || 1445 pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr)) 1446 PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR); 1447 if (cur->dst.port[0] != prev->dst.port[0] || 1448 cur->dst.port[1] != prev->dst.port[1] || 1449 cur->dst.port_op != prev->dst.port_op) 1450 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT); 1451 1452 prev = cur; 1453 cur = TAILQ_NEXT(cur, entries); 1454 } 1455 for (i = 0; i < PF_SKIP_COUNT; ++i) 1456 PF_SET_SKIP_STEPS(i); 1457 } 1458 1459 int 1460 pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2) 1461 { 1462 if (aw1->type != aw2->type) 1463 return (1); 1464 switch (aw1->type) { 1465 case PF_ADDR_ADDRMASK: 1466 case PF_ADDR_RANGE: 1467 if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, 0)) 1468 return (1); 1469 if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, 0)) 1470 return (1); 1471 return (0); 1472 case PF_ADDR_DYNIFTL: 1473 return (aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt); 1474 case PF_ADDR_NOROUTE: 1475 case PF_ADDR_URPFFAILED: 1476 return (0); 1477 case PF_ADDR_TABLE: 1478 return (aw1->p.tbl != aw2->p.tbl); 1479 case PF_ADDR_RTLABEL: 1480 return (aw1->v.rtlabel != aw2->v.rtlabel); 1481 default: 1482 printf("invalid address type: %d\n", aw1->type); 1483 return (1); 1484 } 1485 } 1486 1487 u_int16_t 1488 pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp) 1489 { 1490 u_int32_t l; 1491 1492 if (udp && !cksum) 1493 return (0x0000); 1494 l = cksum + old - new; 1495 l = (l >> 16) + (l & 65535); 1496 l = l & 65535; 1497 if (udp && !l) 1498 return (0xFFFF); 1499 return (l); 1500 } 1501 1502 void 1503 pf_change_ap(struct pf_addr *a, u_int16_t *p, u_int16_t *ic, u_int16_t *pc, 1504 struct pf_addr *an, u_int16_t pn, u_int8_t u, sa_family_t af) 1505 { 1506 struct pf_addr ao; 1507 u_int16_t po = *p; 1508 1509 PF_ACPY(&ao, a, af); 1510 PF_ACPY(a, an, af); 1511 1512 *p = pn; 1513 1514 switch (af) { 1515 #ifdef INET 1516 case AF_INET: 1517 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic, 1518 ao.addr16[0], an->addr16[0], 0), 1519 ao.addr16[1], an->addr16[1], 0); 1520 *p = pn; 1521 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc, 1522 ao.addr16[0], an->addr16[0], u), 1523 ao.addr16[1], an->addr16[1], u), 1524 po, pn, u); 1525 break; 1526 #endif /* INET */ 1527 #ifdef INET6 1528 case AF_INET6: 1529 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1530 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1531 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc, 1532 ao.addr16[0], an->addr16[0], u), 1533 ao.addr16[1], an->addr16[1], u), 1534 ao.addr16[2], an->addr16[2], u), 1535 ao.addr16[3], an->addr16[3], u), 1536 ao.addr16[4], an->addr16[4], u), 1537 ao.addr16[5], an->addr16[5], u), 1538 ao.addr16[6], an->addr16[6], u), 1539 ao.addr16[7], an->addr16[7], u), 1540 po, pn, u); 1541 break; 1542 #endif /* INET6 */ 1543 } 1544 } 1545 1546 1547 /* Changes a u_int32_t. Uses a void * so there are no align restrictions */ 1548 void 1549 pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u) 1550 { 1551 u_int32_t ao; 1552 1553 memcpy(&ao, a, sizeof(ao)); 1554 memcpy(a, &an, sizeof(u_int32_t)); 1555 *c = pf_cksum_fixup(pf_cksum_fixup(*c, ao / 65536, an / 65536, u), 1556 ao % 65536, an % 65536, u); 1557 } 1558 1559 #ifdef INET6 1560 void 1561 pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u) 1562 { 1563 struct pf_addr ao; 1564 1565 PF_ACPY(&ao, a, AF_INET6); 1566 PF_ACPY(a, an, AF_INET6); 1567 1568 *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1569 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1570 pf_cksum_fixup(pf_cksum_fixup(*c, 1571 ao.addr16[0], an->addr16[0], u), 1572 ao.addr16[1], an->addr16[1], u), 1573 ao.addr16[2], an->addr16[2], u), 1574 ao.addr16[3], an->addr16[3], u), 1575 ao.addr16[4], an->addr16[4], u), 1576 ao.addr16[5], an->addr16[5], u), 1577 ao.addr16[6], an->addr16[6], u), 1578 ao.addr16[7], an->addr16[7], u); 1579 } 1580 #endif /* INET6 */ 1581 1582 int 1583 pf_icmp_mapping(struct pf_pdesc *pd, u_int8_t type, 1584 int *icmp_dir, int *multi, u_int16_t *icmpid, u_int16_t *icmptype) 1585 { 1586 /* 1587 * ICMP types marked with PF_OUT are typically responses to 1588 * PF_IN, and will match states in the opposite direction. 1589 * PF_IN ICMP types need to match a state with that type. 1590 */ 1591 *icmp_dir = PF_OUT; 1592 *multi = PF_ICMP_MULTI_LINK; 1593 /* Queries (and responses) */ 1594 switch (type) { 1595 case ICMP_ECHO: 1596 *icmp_dir = PF_IN; 1597 case ICMP_ECHOREPLY: 1598 *icmptype = ICMP_ECHO; 1599 *icmpid = pd->hdr.icmp->icmp_id; 1600 break; 1601 1602 case ICMP_TSTAMP: 1603 *icmp_dir = PF_IN; 1604 case ICMP_TSTAMPREPLY: 1605 *icmptype = ICMP_TSTAMP; 1606 *icmpid = pd->hdr.icmp->icmp_id; 1607 break; 1608 1609 case ICMP_IREQ: 1610 *icmp_dir = PF_IN; 1611 case ICMP_IREQREPLY: 1612 *icmptype = ICMP_IREQ; 1613 *icmpid = pd->hdr.icmp->icmp_id; 1614 break; 1615 1616 case ICMP_MASKREQ: 1617 *icmp_dir = PF_IN; 1618 case ICMP_MASKREPLY: 1619 *icmptype = ICMP_MASKREQ; 1620 *icmpid = pd->hdr.icmp->icmp_id; 1621 break; 1622 1623 case ICMP_IPV6_WHEREAREYOU: 1624 *icmp_dir = PF_IN; 1625 case ICMP_IPV6_IAMHERE: 1626 *icmptype = ICMP_IPV6_WHEREAREYOU; 1627 *icmpid = 0; /* Nothing sane to match on! */ 1628 break; 1629 1630 case ICMP_MOBILE_REGREQUEST: 1631 *icmp_dir = PF_IN; 1632 case ICMP_MOBILE_REGREPLY: 1633 *icmptype = ICMP_MOBILE_REGREQUEST; 1634 *icmpid = 0; /* Nothing sane to match on! */ 1635 break; 1636 1637 case ICMP_ROUTERSOLICIT: 1638 *icmp_dir = PF_IN; 1639 case ICMP_ROUTERADVERT: 1640 *icmptype = ICMP_ROUTERSOLICIT; 1641 *icmpid = 0; /* Nothing sane to match on! */ 1642 break; 1643 1644 #ifdef INET6 1645 case ICMP6_ECHO_REQUEST: 1646 *icmp_dir = PF_IN; 1647 case ICMP6_ECHO_REPLY: 1648 *icmptype = ICMP6_ECHO_REQUEST; 1649 *icmpid = pd->hdr.icmp6->icmp6_id; 1650 break; 1651 1652 case MLD_LISTENER_QUERY: 1653 *icmp_dir = PF_IN; 1654 case MLD_LISTENER_REPORT: { 1655 struct mld_hdr *mld = (void *)pd->hdr.icmp6; 1656 1657 *icmptype = MLD_LISTENER_QUERY; 1658 /* generate fake id for these messages */ 1659 *icmpid = (mld->mld_addr.s6_addr32[0] ^ 1660 mld->mld_addr.s6_addr32[1] ^ 1661 mld->mld_addr.s6_addr32[2] ^ 1662 mld->mld_addr.s6_addr32[3]) & 0xffff; 1663 break; 1664 } 1665 1666 /* ICMP6_FQDN and ICMP6_NI query/reply are the same type as ICMP6_WRU */ 1667 case ICMP6_WRUREQUEST: 1668 *icmp_dir = PF_IN; 1669 case ICMP6_WRUREPLY: 1670 *icmptype = ICMP6_WRUREQUEST; 1671 *icmpid = 0; /* Nothing sane to match on! */ 1672 break; 1673 1674 case MLD_MTRACE: 1675 *icmp_dir = PF_IN; 1676 case MLD_MTRACE_RESP: 1677 *icmptype = MLD_MTRACE; 1678 *icmpid = 0; /* Nothing sane to match on! */ 1679 break; 1680 1681 case ND_NEIGHBOR_SOLICIT: 1682 *icmp_dir = PF_IN; 1683 case ND_NEIGHBOR_ADVERT: { 1684 struct nd_neighbor_solicit *nd = (void *)pd->hdr.icmp6; 1685 1686 *icmptype = ND_NEIGHBOR_SOLICIT; 1687 *multi = PF_ICMP_MULTI_SOLICITED; 1688 /* generate fake id for these messages */ 1689 *icmpid = (nd->nd_ns_target.s6_addr32[0] ^ 1690 nd->nd_ns_target.s6_addr32[1] ^ 1691 nd->nd_ns_target.s6_addr32[2] ^ 1692 nd->nd_ns_target.s6_addr32[3]) & 0xffff; 1693 break; 1694 } 1695 1696 #endif /* INET6 */ 1697 /* These ICMP types map to other connections */ 1698 case ICMP_UNREACH: 1699 case ICMP_SOURCEQUENCH: 1700 case ICMP_REDIRECT: 1701 case ICMP_TIMXCEED: 1702 case ICMP_PARAMPROB: 1703 #ifdef INET6 1704 /* 1705 * ICMP6_TIME_EXCEEDED is the same type as ICMP_UNREACH 1706 * ND_REDIRECT can't be in this list because the triggering packet 1707 * header is optional. 1708 */ 1709 case ICMP6_PACKET_TOO_BIG: 1710 #endif /* INET6 */ 1711 /* These will not be used, but set them anyways */ 1712 *icmp_dir = PF_IN; 1713 *icmptype = htons(type); 1714 *icmpid = 0; 1715 return (1); /* These types are matched to other state */ 1716 /* 1717 * All remaining ICMP types get their own states, 1718 * and will only match in one direction. 1719 */ 1720 default: 1721 *icmp_dir = PF_IN; 1722 *icmptype = type; 1723 *icmpid = 0; 1724 break; 1725 } 1726 HTONS(*icmptype); 1727 return (0); 1728 } 1729 1730 void 1731 pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa, 1732 struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c, 1733 u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af) 1734 { 1735 struct pf_addr oia, ooa; 1736 1737 PF_ACPY(&oia, ia, af); 1738 if (oa) 1739 PF_ACPY(&ooa, oa, af); 1740 1741 /* Change inner protocol port, fix inner protocol checksum. */ 1742 if (ip != NULL) { 1743 u_int16_t oip = *ip; 1744 u_int32_t opc; 1745 1746 if (pc != NULL) 1747 opc = *pc; 1748 *ip = np; 1749 if (pc != NULL) 1750 *pc = pf_cksum_fixup(*pc, oip, *ip, u); 1751 *ic = pf_cksum_fixup(*ic, oip, *ip, 0); 1752 if (pc != NULL) 1753 *ic = pf_cksum_fixup(*ic, opc, *pc, 0); 1754 } 1755 /* Change inner ip address, fix inner ip and icmp checksums. */ 1756 PF_ACPY(ia, na, af); 1757 switch (af) { 1758 #ifdef INET 1759 case AF_INET: { 1760 u_int32_t oh2c = *h2c; 1761 1762 *h2c = pf_cksum_fixup(pf_cksum_fixup(*h2c, 1763 oia.addr16[0], ia->addr16[0], 0), 1764 oia.addr16[1], ia->addr16[1], 0); 1765 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic, 1766 oia.addr16[0], ia->addr16[0], 0), 1767 oia.addr16[1], ia->addr16[1], 0); 1768 *ic = pf_cksum_fixup(*ic, oh2c, *h2c, 0); 1769 break; 1770 } 1771 #endif /* INET */ 1772 #ifdef INET6 1773 case AF_INET6: 1774 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1775 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1776 pf_cksum_fixup(pf_cksum_fixup(*ic, 1777 oia.addr16[0], ia->addr16[0], u), 1778 oia.addr16[1], ia->addr16[1], u), 1779 oia.addr16[2], ia->addr16[2], u), 1780 oia.addr16[3], ia->addr16[3], u), 1781 oia.addr16[4], ia->addr16[4], u), 1782 oia.addr16[5], ia->addr16[5], u), 1783 oia.addr16[6], ia->addr16[6], u), 1784 oia.addr16[7], ia->addr16[7], u); 1785 break; 1786 #endif /* INET6 */ 1787 } 1788 /* Outer ip address, fix outer ip or icmpv6 checksum, if necessary. */ 1789 if (oa) { 1790 PF_ACPY(oa, na, af); 1791 switch (af) { 1792 #ifdef INET 1793 case AF_INET: 1794 *hc = pf_cksum_fixup(pf_cksum_fixup(*hc, 1795 ooa.addr16[0], oa->addr16[0], 0), 1796 ooa.addr16[1], oa->addr16[1], 0); 1797 break; 1798 #endif /* INET */ 1799 #ifdef INET6 1800 case AF_INET6: 1801 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1802 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1803 pf_cksum_fixup(pf_cksum_fixup(*ic, 1804 ooa.addr16[0], oa->addr16[0], u), 1805 ooa.addr16[1], oa->addr16[1], u), 1806 ooa.addr16[2], oa->addr16[2], u), 1807 ooa.addr16[3], oa->addr16[3], u), 1808 ooa.addr16[4], oa->addr16[4], u), 1809 ooa.addr16[5], oa->addr16[5], u), 1810 ooa.addr16[6], oa->addr16[6], u), 1811 ooa.addr16[7], oa->addr16[7], u); 1812 break; 1813 #endif /* INET6 */ 1814 } 1815 } 1816 } 1817 1818 1819 /* 1820 * Need to modulate the sequence numbers in the TCP SACK option 1821 * (credits to Krzysztof Pfaff for report and patch) 1822 */ 1823 int 1824 pf_modulate_sack(struct mbuf *m, int off, struct pf_pdesc *pd, 1825 struct tcphdr *th, struct pf_state_peer *dst) 1826 { 1827 int hlen = (th->th_off << 2) - sizeof(*th), thoptlen = hlen; 1828 u_int8_t opts[MAX_TCPOPTLEN], *opt = opts; 1829 int copyback = 0, i, olen; 1830 struct sackblk sack; 1831 1832 #define TCPOLEN_SACKLEN (TCPOLEN_SACK + 2) 1833 if (hlen < TCPOLEN_SACKLEN || 1834 !pf_pull_hdr(m, off + sizeof(*th), opts, hlen, NULL, NULL, pd->af)) 1835 return 0; 1836 1837 while (hlen >= TCPOLEN_SACKLEN) { 1838 olen = opt[1]; 1839 switch (*opt) { 1840 case TCPOPT_EOL: /* FALLTHROUGH */ 1841 case TCPOPT_NOP: 1842 opt++; 1843 hlen--; 1844 break; 1845 case TCPOPT_SACK: 1846 if (olen > hlen) 1847 olen = hlen; 1848 if (olen >= TCPOLEN_SACKLEN) { 1849 for (i = 2; i + TCPOLEN_SACK <= olen; 1850 i += TCPOLEN_SACK) { 1851 memcpy(&sack, &opt[i], sizeof(sack)); 1852 pf_change_a(&sack.start, &th->th_sum, 1853 htonl(ntohl(sack.start) - 1854 dst->seqdiff), 0); 1855 pf_change_a(&sack.end, &th->th_sum, 1856 htonl(ntohl(sack.end) - 1857 dst->seqdiff), 0); 1858 memcpy(&opt[i], &sack, sizeof(sack)); 1859 } 1860 copyback = 1; 1861 } 1862 /* FALLTHROUGH */ 1863 default: 1864 if (olen < 2) 1865 olen = 2; 1866 hlen -= olen; 1867 opt += olen; 1868 } 1869 } 1870 1871 if (copyback) 1872 m_copyback(m, off + sizeof(*th), thoptlen, opts); 1873 return (copyback); 1874 } 1875 1876 void 1877 pf_send_tcp(const struct pf_rule *r, sa_family_t af, 1878 const struct pf_addr *saddr, const struct pf_addr *daddr, 1879 u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack, 1880 u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl, int tag, 1881 u_int16_t rtag, struct ether_header *eh, struct ifnet *ifp, u_int rtableid) 1882 { 1883 struct mbuf *m; 1884 int len, tlen; 1885 #ifdef INET 1886 struct ip *h; 1887 #endif /* INET */ 1888 #ifdef INET6 1889 struct ip6_hdr *h6; 1890 #endif /* INET6 */ 1891 struct tcphdr *th; 1892 char *opt; 1893 1894 /* maximum segment size tcp option */ 1895 tlen = sizeof(struct tcphdr); 1896 if (mss) 1897 tlen += 4; 1898 1899 switch (af) { 1900 #ifdef INET 1901 case AF_INET: 1902 len = sizeof(struct ip) + tlen; 1903 break; 1904 #endif /* INET */ 1905 #ifdef INET6 1906 case AF_INET6: 1907 len = sizeof(struct ip6_hdr) + tlen; 1908 break; 1909 #endif /* INET6 */ 1910 } 1911 1912 /* create outgoing mbuf */ 1913 m = m_gethdr(M_DONTWAIT, MT_HEADER); 1914 if (m == NULL) 1915 return; 1916 if (tag) 1917 m->m_pkthdr.pf.flags |= PF_TAG_GENERATED; 1918 m->m_pkthdr.pf.tag = rtag; 1919 1920 if (rtableid >= 0) 1921 m->m_pkthdr.pf.rtableid = rtableid; 1922 1923 #ifdef ALTQ 1924 if (r != NULL && r->qid) { 1925 m->m_pkthdr.pf.qid = r->qid; 1926 /* add hints for ecn */ 1927 m->m_pkthdr.pf.hdr = mtod(m, struct ip *); 1928 } 1929 #endif /* ALTQ */ 1930 m->m_data += max_linkhdr; 1931 m->m_pkthdr.len = m->m_len = len; 1932 m->m_pkthdr.rcvif = NULL; 1933 bzero(m->m_data, len); 1934 switch (af) { 1935 #ifdef INET 1936 case AF_INET: 1937 h = mtod(m, struct ip *); 1938 1939 /* IP header fields included in the TCP checksum */ 1940 h->ip_p = IPPROTO_TCP; 1941 h->ip_len = htons(tlen); 1942 h->ip_src.s_addr = saddr->v4.s_addr; 1943 h->ip_dst.s_addr = daddr->v4.s_addr; 1944 1945 th = (struct tcphdr *)((caddr_t)h + sizeof(struct ip)); 1946 break; 1947 #endif /* INET */ 1948 #ifdef INET6 1949 case AF_INET6: 1950 h6 = mtod(m, struct ip6_hdr *); 1951 1952 /* IP header fields included in the TCP checksum */ 1953 h6->ip6_nxt = IPPROTO_TCP; 1954 h6->ip6_plen = htons(tlen); 1955 memcpy(&h6->ip6_src, &saddr->v6, sizeof(struct in6_addr)); 1956 memcpy(&h6->ip6_dst, &daddr->v6, sizeof(struct in6_addr)); 1957 1958 th = (struct tcphdr *)((caddr_t)h6 + sizeof(struct ip6_hdr)); 1959 break; 1960 #endif /* INET6 */ 1961 } 1962 1963 /* TCP header */ 1964 th->th_sport = sport; 1965 th->th_dport = dport; 1966 th->th_seq = htonl(seq); 1967 th->th_ack = htonl(ack); 1968 th->th_off = tlen >> 2; 1969 th->th_flags = flags; 1970 th->th_win = htons(win); 1971 1972 if (mss) { 1973 opt = (char *)(th + 1); 1974 opt[0] = TCPOPT_MAXSEG; 1975 opt[1] = 4; 1976 HTONS(mss); 1977 bcopy((caddr_t)&mss, (caddr_t)(opt + 2), 2); 1978 } 1979 1980 switch (af) { 1981 #ifdef INET 1982 case AF_INET: 1983 /* TCP checksum */ 1984 th->th_sum = in_cksum(m, len); 1985 1986 /* Finish the IP header */ 1987 h->ip_v = 4; 1988 h->ip_hl = sizeof(*h) >> 2; 1989 h->ip_tos = IPTOS_LOWDELAY; 1990 h->ip_len = htons(len); 1991 h->ip_off = htons(ip_mtudisc ? IP_DF : 0); 1992 h->ip_ttl = ttl ? ttl : ip_defttl; 1993 h->ip_sum = 0; 1994 if (eh == NULL) { 1995 ip_output(m, (void *)NULL, (void *)NULL, 0, 1996 (void *)NULL, (void *)NULL); 1997 } else { 1998 struct route ro; 1999 struct rtentry rt; 2000 struct ether_header *e = (void *)ro.ro_dst.sa_data; 2001 2002 if (ifp == NULL) { 2003 m_freem(m); 2004 return; 2005 } 2006 rt.rt_ifp = ifp; 2007 ro.ro_rt = &rt; 2008 ro.ro_dst.sa_len = sizeof(ro.ro_dst); 2009 ro.ro_dst.sa_family = pseudo_AF_HDRCMPLT; 2010 bcopy(eh->ether_dhost, e->ether_shost, ETHER_ADDR_LEN); 2011 bcopy(eh->ether_shost, e->ether_dhost, ETHER_ADDR_LEN); 2012 e->ether_type = eh->ether_type; 2013 ip_output(m, (void *)NULL, &ro, IP_ROUTETOETHER, 2014 (void *)NULL, (void *)NULL); 2015 } 2016 break; 2017 #endif /* INET */ 2018 #ifdef INET6 2019 case AF_INET6: 2020 /* TCP checksum */ 2021 th->th_sum = in6_cksum(m, IPPROTO_TCP, 2022 sizeof(struct ip6_hdr), tlen); 2023 2024 h6->ip6_vfc |= IPV6_VERSION; 2025 h6->ip6_hlim = IPV6_DEFHLIM; 2026 2027 ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL); 2028 break; 2029 #endif /* INET6 */ 2030 } 2031 } 2032 2033 void 2034 pf_send_icmp(struct mbuf *m, u_int8_t type, u_int8_t code, sa_family_t af, 2035 struct pf_rule *r, u_int rtableid) 2036 { 2037 struct mbuf *m0; 2038 2039 if ((m0 = m_copy(m, 0, M_COPYALL)) == NULL) 2040 return; 2041 2042 m0->m_pkthdr.pf.flags |= PF_TAG_GENERATED; 2043 2044 if (rtableid >= 0) 2045 m0->m_pkthdr.pf.rtableid = rtableid; 2046 2047 #ifdef ALTQ 2048 if (r->qid) { 2049 m0->m_pkthdr.pf.qid = r->qid; 2050 /* add hints for ecn */ 2051 m0->m_pkthdr.pf.hdr = mtod(m0, struct ip *); 2052 } 2053 #endif /* ALTQ */ 2054 2055 switch (af) { 2056 #ifdef INET 2057 case AF_INET: 2058 icmp_error(m0, type, code, 0, 0); 2059 break; 2060 #endif /* INET */ 2061 #ifdef INET6 2062 case AF_INET6: 2063 icmp6_error(m0, type, code, 0); 2064 break; 2065 #endif /* INET6 */ 2066 } 2067 } 2068 2069 /* 2070 * Return 1 if the addresses a and b match (with mask m), otherwise return 0. 2071 * If n is 0, they match if they are equal. If n is != 0, they match if they 2072 * are different. 2073 */ 2074 int 2075 pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m, 2076 struct pf_addr *b, sa_family_t af) 2077 { 2078 int match = 0; 2079 2080 switch (af) { 2081 #ifdef INET 2082 case AF_INET: 2083 if ((a->addr32[0] & m->addr32[0]) == 2084 (b->addr32[0] & m->addr32[0])) 2085 match++; 2086 break; 2087 #endif /* INET */ 2088 #ifdef INET6 2089 case AF_INET6: 2090 if (((a->addr32[0] & m->addr32[0]) == 2091 (b->addr32[0] & m->addr32[0])) && 2092 ((a->addr32[1] & m->addr32[1]) == 2093 (b->addr32[1] & m->addr32[1])) && 2094 ((a->addr32[2] & m->addr32[2]) == 2095 (b->addr32[2] & m->addr32[2])) && 2096 ((a->addr32[3] & m->addr32[3]) == 2097 (b->addr32[3] & m->addr32[3]))) 2098 match++; 2099 break; 2100 #endif /* INET6 */ 2101 } 2102 if (match) { 2103 if (n) 2104 return (0); 2105 else 2106 return (1); 2107 } else { 2108 if (n) 2109 return (1); 2110 else 2111 return (0); 2112 } 2113 } 2114 2115 /* 2116 * Return 1 if b <= a <= e, otherwise return 0. 2117 */ 2118 int 2119 pf_match_addr_range(struct pf_addr *b, struct pf_addr *e, 2120 struct pf_addr *a, sa_family_t af) 2121 { 2122 switch (af) { 2123 #ifdef INET 2124 case AF_INET: 2125 if ((a->addr32[0] < b->addr32[0]) || 2126 (a->addr32[0] > e->addr32[0])) 2127 return (0); 2128 break; 2129 #endif /* INET */ 2130 #ifdef INET6 2131 case AF_INET6: { 2132 int i; 2133 2134 /* check a >= b */ 2135 for (i = 0; i < 4; ++i) 2136 if (a->addr32[i] > b->addr32[i]) 2137 break; 2138 else if (a->addr32[i] < b->addr32[i]) 2139 return (0); 2140 /* check a <= e */ 2141 for (i = 0; i < 4; ++i) 2142 if (a->addr32[i] < e->addr32[i]) 2143 break; 2144 else if (a->addr32[i] > e->addr32[i]) 2145 return (0); 2146 break; 2147 } 2148 #endif /* INET6 */ 2149 } 2150 return (1); 2151 } 2152 2153 int 2154 pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p) 2155 { 2156 switch (op) { 2157 case PF_OP_IRG: 2158 return ((p > a1) && (p < a2)); 2159 case PF_OP_XRG: 2160 return ((p < a1) || (p > a2)); 2161 case PF_OP_RRG: 2162 return ((p >= a1) && (p <= a2)); 2163 case PF_OP_EQ: 2164 return (p == a1); 2165 case PF_OP_NE: 2166 return (p != a1); 2167 case PF_OP_LT: 2168 return (p < a1); 2169 case PF_OP_LE: 2170 return (p <= a1); 2171 case PF_OP_GT: 2172 return (p > a1); 2173 case PF_OP_GE: 2174 return (p >= a1); 2175 } 2176 return (0); /* never reached */ 2177 } 2178 2179 int 2180 pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p) 2181 { 2182 NTOHS(a1); 2183 NTOHS(a2); 2184 NTOHS(p); 2185 return (pf_match(op, a1, a2, p)); 2186 } 2187 2188 int 2189 pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u) 2190 { 2191 if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE) 2192 return (0); 2193 return (pf_match(op, a1, a2, u)); 2194 } 2195 2196 int 2197 pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g) 2198 { 2199 if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE) 2200 return (0); 2201 return (pf_match(op, a1, a2, g)); 2202 } 2203 2204 int 2205 pf_match_tag(struct mbuf *m, struct pf_rule *r, int *tag) 2206 { 2207 if (*tag == -1) 2208 *tag = m->m_pkthdr.pf.tag; 2209 2210 return ((!r->match_tag_not && r->match_tag == *tag) || 2211 (r->match_tag_not && r->match_tag != *tag)); 2212 } 2213 2214 int 2215 pf_tag_packet(struct mbuf *m, int tag, int rtableid) 2216 { 2217 if (tag <= 0 && rtableid < 0) 2218 return (0); 2219 2220 if (tag > 0) 2221 m->m_pkthdr.pf.tag = tag; 2222 if (rtableid >= 0) 2223 m->m_pkthdr.pf.rtableid = rtableid; 2224 2225 return (0); 2226 } 2227 2228 void 2229 pf_step_into_anchor(int *depth, struct pf_ruleset **rs, int n, 2230 struct pf_rule **r, struct pf_rule **a, int *match) 2231 { 2232 struct pf_anchor_stackframe *f; 2233 2234 (*r)->anchor->match = 0; 2235 if (match) 2236 *match = 0; 2237 if (*depth >= sizeof(pf_anchor_stack) / 2238 sizeof(pf_anchor_stack[0])) { 2239 printf("pf_step_into_anchor: stack overflow\n"); 2240 *r = TAILQ_NEXT(*r, entries); 2241 return; 2242 } else if (*depth == 0 && a != NULL) 2243 *a = *r; 2244 f = pf_anchor_stack + (*depth)++; 2245 f->rs = *rs; 2246 f->r = *r; 2247 if ((*r)->anchor_wildcard) { 2248 f->parent = &(*r)->anchor->children; 2249 if ((f->child = RB_MIN(pf_anchor_node, f->parent)) == 2250 NULL) { 2251 *r = NULL; 2252 return; 2253 } 2254 *rs = &f->child->ruleset; 2255 } else { 2256 f->parent = NULL; 2257 f->child = NULL; 2258 *rs = &(*r)->anchor->ruleset; 2259 } 2260 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr); 2261 } 2262 2263 int 2264 pf_step_out_of_anchor(int *depth, struct pf_ruleset **rs, int n, 2265 struct pf_rule **r, struct pf_rule **a, int *match) 2266 { 2267 struct pf_anchor_stackframe *f; 2268 int quick = 0; 2269 2270 do { 2271 if (*depth <= 0) 2272 break; 2273 f = pf_anchor_stack + *depth - 1; 2274 if (f->parent != NULL && f->child != NULL) { 2275 if (f->child->match || 2276 (match != NULL && *match)) { 2277 f->r->anchor->match = 1; 2278 *match = 0; 2279 } 2280 f->child = RB_NEXT(pf_anchor_node, f->parent, f->child); 2281 if (f->child != NULL) { 2282 *rs = &f->child->ruleset; 2283 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr); 2284 if (*r == NULL) 2285 continue; 2286 else 2287 break; 2288 } 2289 } 2290 (*depth)--; 2291 if (*depth == 0 && a != NULL) 2292 *a = NULL; 2293 *rs = f->rs; 2294 if (f->r->anchor->match || (match != NULL && *match)) 2295 quick = f->r->quick; 2296 *r = TAILQ_NEXT(f->r, entries); 2297 } while (*r == NULL); 2298 2299 return (quick); 2300 } 2301 2302 #ifdef INET6 2303 void 2304 pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr, 2305 struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af) 2306 { 2307 switch (af) { 2308 #ifdef INET 2309 case AF_INET: 2310 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) | 2311 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]); 2312 break; 2313 #endif /* INET */ 2314 case AF_INET6: 2315 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) | 2316 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]); 2317 naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) | 2318 ((rmask->addr32[1] ^ 0xffffffff ) & saddr->addr32[1]); 2319 naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) | 2320 ((rmask->addr32[2] ^ 0xffffffff ) & saddr->addr32[2]); 2321 naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) | 2322 ((rmask->addr32[3] ^ 0xffffffff ) & saddr->addr32[3]); 2323 break; 2324 } 2325 } 2326 2327 void 2328 pf_addr_inc(struct pf_addr *addr, sa_family_t af) 2329 { 2330 switch (af) { 2331 #ifdef INET 2332 case AF_INET: 2333 addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1); 2334 break; 2335 #endif /* INET */ 2336 case AF_INET6: 2337 if (addr->addr32[3] == 0xffffffff) { 2338 addr->addr32[3] = 0; 2339 if (addr->addr32[2] == 0xffffffff) { 2340 addr->addr32[2] = 0; 2341 if (addr->addr32[1] == 0xffffffff) { 2342 addr->addr32[1] = 0; 2343 addr->addr32[0] = 2344 htonl(ntohl(addr->addr32[0]) + 1); 2345 } else 2346 addr->addr32[1] = 2347 htonl(ntohl(addr->addr32[1]) + 1); 2348 } else 2349 addr->addr32[2] = 2350 htonl(ntohl(addr->addr32[2]) + 1); 2351 } else 2352 addr->addr32[3] = 2353 htonl(ntohl(addr->addr32[3]) + 1); 2354 break; 2355 } 2356 } 2357 #endif /* INET6 */ 2358 2359 int 2360 pf_socket_lookup(int direction, struct pf_pdesc *pd) 2361 { 2362 struct pf_addr *saddr, *daddr; 2363 u_int16_t sport, dport; 2364 struct inpcbtable *tb; 2365 struct inpcb *inp; 2366 2367 if (pd == NULL) 2368 return (-1); 2369 pd->lookup.uid = UID_MAX; 2370 pd->lookup.gid = GID_MAX; 2371 pd->lookup.pid = NO_PID; 2372 switch (pd->proto) { 2373 case IPPROTO_TCP: 2374 if (pd->hdr.tcp == NULL) 2375 return (-1); 2376 sport = pd->hdr.tcp->th_sport; 2377 dport = pd->hdr.tcp->th_dport; 2378 tb = &tcbtable; 2379 break; 2380 case IPPROTO_UDP: 2381 if (pd->hdr.udp == NULL) 2382 return (-1); 2383 sport = pd->hdr.udp->uh_sport; 2384 dport = pd->hdr.udp->uh_dport; 2385 tb = &udbtable; 2386 break; 2387 default: 2388 return (-1); 2389 } 2390 if (direction == PF_IN) { 2391 saddr = pd->src; 2392 daddr = pd->dst; 2393 } else { 2394 u_int16_t p; 2395 2396 p = sport; 2397 sport = dport; 2398 dport = p; 2399 saddr = pd->dst; 2400 daddr = pd->src; 2401 } 2402 switch (pd->af) { 2403 #ifdef INET 2404 case AF_INET: 2405 inp = in_pcbhashlookup(tb, saddr->v4, sport, daddr->v4, dport); 2406 if (inp == NULL) { 2407 inp = in_pcblookup_listen(tb, daddr->v4, dport, 0, 2408 NULL); 2409 if (inp == NULL) 2410 return (-1); 2411 } 2412 break; 2413 #endif /* INET */ 2414 #ifdef INET6 2415 case AF_INET6: 2416 inp = in6_pcbhashlookup(tb, &saddr->v6, sport, &daddr->v6, 2417 dport); 2418 if (inp == NULL) { 2419 inp = in6_pcblookup_listen(tb, &daddr->v6, dport, 0, 2420 NULL); 2421 if (inp == NULL) 2422 return (-1); 2423 } 2424 break; 2425 #endif /* INET6 */ 2426 2427 default: 2428 return (-1); 2429 } 2430 pd->lookup.uid = inp->inp_socket->so_euid; 2431 pd->lookup.gid = inp->inp_socket->so_egid; 2432 pd->lookup.pid = inp->inp_socket->so_cpid; 2433 return (1); 2434 } 2435 2436 u_int8_t 2437 pf_get_wscale(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af) 2438 { 2439 int hlen; 2440 u_int8_t hdr[60]; 2441 u_int8_t *opt, optlen; 2442 u_int8_t wscale = 0; 2443 2444 hlen = th_off << 2; /* hlen <= sizeof(hdr) */ 2445 if (hlen <= sizeof(struct tcphdr)) 2446 return (0); 2447 if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af)) 2448 return (0); 2449 opt = hdr + sizeof(struct tcphdr); 2450 hlen -= sizeof(struct tcphdr); 2451 while (hlen >= 3) { 2452 switch (*opt) { 2453 case TCPOPT_EOL: 2454 case TCPOPT_NOP: 2455 ++opt; 2456 --hlen; 2457 break; 2458 case TCPOPT_WINDOW: 2459 wscale = opt[2]; 2460 if (wscale > TCP_MAX_WINSHIFT) 2461 wscale = TCP_MAX_WINSHIFT; 2462 wscale |= PF_WSCALE_FLAG; 2463 /* FALLTHROUGH */ 2464 default: 2465 optlen = opt[1]; 2466 if (optlen < 2) 2467 optlen = 2; 2468 hlen -= optlen; 2469 opt += optlen; 2470 break; 2471 } 2472 } 2473 return (wscale); 2474 } 2475 2476 u_int16_t 2477 pf_get_mss(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af) 2478 { 2479 int hlen; 2480 u_int8_t hdr[60]; 2481 u_int8_t *opt, optlen; 2482 u_int16_t mss = tcp_mssdflt; 2483 2484 hlen = th_off << 2; /* hlen <= sizeof(hdr) */ 2485 if (hlen <= sizeof(struct tcphdr)) 2486 return (0); 2487 if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af)) 2488 return (0); 2489 opt = hdr + sizeof(struct tcphdr); 2490 hlen -= sizeof(struct tcphdr); 2491 while (hlen >= TCPOLEN_MAXSEG) { 2492 switch (*opt) { 2493 case TCPOPT_EOL: 2494 case TCPOPT_NOP: 2495 ++opt; 2496 --hlen; 2497 break; 2498 case TCPOPT_MAXSEG: 2499 bcopy((caddr_t)(opt + 2), (caddr_t)&mss, 2); 2500 NTOHS(mss); 2501 /* FALLTHROUGH */ 2502 default: 2503 optlen = opt[1]; 2504 if (optlen < 2) 2505 optlen = 2; 2506 hlen -= optlen; 2507 opt += optlen; 2508 break; 2509 } 2510 } 2511 return (mss); 2512 } 2513 2514 u_int16_t 2515 pf_calc_mss(struct pf_addr *addr, sa_family_t af, u_int16_t offer) 2516 { 2517 #ifdef INET 2518 struct sockaddr_in *dst; 2519 struct route ro; 2520 #endif /* INET */ 2521 #ifdef INET6 2522 struct sockaddr_in6 *dst6; 2523 struct route_in6 ro6; 2524 #endif /* INET6 */ 2525 struct rtentry *rt = NULL; 2526 int hlen; 2527 u_int16_t mss = tcp_mssdflt; 2528 2529 switch (af) { 2530 #ifdef INET 2531 case AF_INET: 2532 hlen = sizeof(struct ip); 2533 bzero(&ro, sizeof(ro)); 2534 dst = (struct sockaddr_in *)&ro.ro_dst; 2535 dst->sin_family = AF_INET; 2536 dst->sin_len = sizeof(*dst); 2537 dst->sin_addr = addr->v4; 2538 rtalloc_noclone(&ro, NO_CLONING); 2539 rt = ro.ro_rt; 2540 break; 2541 #endif /* INET */ 2542 #ifdef INET6 2543 case AF_INET6: 2544 hlen = sizeof(struct ip6_hdr); 2545 bzero(&ro6, sizeof(ro6)); 2546 dst6 = (struct sockaddr_in6 *)&ro6.ro_dst; 2547 dst6->sin6_family = AF_INET6; 2548 dst6->sin6_len = sizeof(*dst6); 2549 dst6->sin6_addr = addr->v6; 2550 rtalloc_noclone((struct route *)&ro6, NO_CLONING); 2551 rt = ro6.ro_rt; 2552 break; 2553 #endif /* INET6 */ 2554 } 2555 2556 if (rt && rt->rt_ifp) { 2557 mss = rt->rt_ifp->if_mtu - hlen - sizeof(struct tcphdr); 2558 mss = max(tcp_mssdflt, mss); 2559 RTFREE(rt); 2560 } 2561 mss = min(mss, offer); 2562 mss = max(mss, 64); /* sanity - at least max opt space */ 2563 return (mss); 2564 } 2565 2566 void 2567 pf_set_rt_ifp(struct pf_state *s, struct pf_addr *saddr) 2568 { 2569 struct pf_rule *r = s->rule.ptr; 2570 struct pf_src_node *sn = NULL; 2571 2572 s->rt_kif = NULL; 2573 if (!r->rt || r->rt == PF_FASTROUTE) 2574 return; 2575 switch (s->key[PF_SK_WIRE]->af) { 2576 #ifdef INET 2577 case AF_INET: 2578 pf_map_addr(AF_INET, r, saddr, &s->rt_addr, NULL, &sn); 2579 s->rt_kif = r->rpool.cur->kif; 2580 break; 2581 #endif /* INET */ 2582 #ifdef INET6 2583 case AF_INET6: 2584 pf_map_addr(AF_INET6, r, saddr, &s->rt_addr, NULL, &sn); 2585 s->rt_kif = r->rpool.cur->kif; 2586 break; 2587 #endif /* INET6 */ 2588 } 2589 } 2590 2591 u_int32_t 2592 pf_tcp_iss(struct pf_pdesc *pd) 2593 { 2594 MD5_CTX ctx; 2595 u_int32_t digest[4]; 2596 2597 if (pf_tcp_secret_init == 0) { 2598 arc4random_buf(pf_tcp_secret, sizeof(pf_tcp_secret)); 2599 MD5Init(&pf_tcp_secret_ctx); 2600 MD5Update(&pf_tcp_secret_ctx, pf_tcp_secret, 2601 sizeof(pf_tcp_secret)); 2602 pf_tcp_secret_init = 1; 2603 } 2604 ctx = pf_tcp_secret_ctx; 2605 2606 MD5Update(&ctx, (char *)&pd->hdr.tcp->th_sport, sizeof(u_short)); 2607 MD5Update(&ctx, (char *)&pd->hdr.tcp->th_dport, sizeof(u_short)); 2608 if (pd->af == AF_INET6) { 2609 MD5Update(&ctx, (char *)&pd->src->v6, sizeof(struct in6_addr)); 2610 MD5Update(&ctx, (char *)&pd->dst->v6, sizeof(struct in6_addr)); 2611 } else { 2612 MD5Update(&ctx, (char *)&pd->src->v4, sizeof(struct in_addr)); 2613 MD5Update(&ctx, (char *)&pd->dst->v4, sizeof(struct in_addr)); 2614 } 2615 MD5Final((u_char *)digest, &ctx); 2616 pf_tcp_iss_off += 4096; 2617 return (digest[0] + tcp_iss + pf_tcp_iss_off); 2618 } 2619 2620 void 2621 pf_rule_to_actions(struct pf_rule *r, struct pf_rule_actions *a) 2622 { 2623 if (r->qid) 2624 a->qid = r->qid; 2625 if (r->pqid) 2626 a->pqid = r->pqid; 2627 if (r->rtableid >= 0) 2628 a->rtableid = r->rtableid; 2629 a->log |= r->log; 2630 if (r->scrub_flags & PFSTATE_SETTOS) 2631 a->set_tos = r->set_tos; 2632 if (r->min_ttl) 2633 a->min_ttl = r->min_ttl; 2634 if (r->max_mss) 2635 a->max_mss = r->max_mss; 2636 a->flags |= (r->scrub_flags & (PFSTATE_NODF|PFSTATE_RANDOMID| 2637 PFSTATE_SETTOS|PFSTATE_SCRUB_TCP)); 2638 } 2639 2640 int 2641 pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction, 2642 struct pfi_kif *kif, struct mbuf *m, int off, void *h, 2643 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm, 2644 struct ifqueue *ifq) 2645 { 2646 struct pf_rule *nr = NULL, *lastr = NULL; 2647 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 2648 sa_family_t af = pd->af; 2649 struct pf_rule *r, *a = NULL; 2650 struct pf_ruleset *ruleset = NULL; 2651 struct pf_rule_slist rules; 2652 struct pf_rule_item *ri; 2653 struct pf_src_node *nsn = NULL; 2654 struct tcphdr *th = pd->hdr.tcp; 2655 struct pf_state_key *skw = NULL, *sks = NULL; 2656 struct pf_state_key *sk = NULL, *nk = NULL; 2657 struct pf_rule_actions act; 2658 u_short reason; 2659 int rewrite = 0, hdrlen = 0; 2660 int tag = -1; 2661 int asd = 0; 2662 int match = 0; 2663 int state_icmp = 0, icmp_dir, multi; 2664 u_int16_t sport, dport, virtual_type, virtual_id; 2665 u_int16_t bproto_sum = 0, bip_sum; 2666 u_int8_t icmptype = 0, icmpcode = 0; 2667 2668 bzero(&act, sizeof(act)); 2669 act.rtableid = -1; 2670 2671 if (direction == PF_IN && pf_check_congestion(ifq)) { 2672 REASON_SET(&reason, PFRES_CONGEST); 2673 return (PF_DROP); 2674 } 2675 2676 switch (pd->proto) { 2677 case IPPROTO_TCP: 2678 sport = th->th_sport; 2679 dport = th->th_dport; 2680 hdrlen = sizeof(*th); 2681 break; 2682 case IPPROTO_UDP: 2683 sport = pd->hdr.udp->uh_sport; 2684 dport = pd->hdr.udp->uh_dport; 2685 hdrlen = sizeof(*pd->hdr.udp); 2686 break; 2687 #ifdef INET 2688 case IPPROTO_ICMP: 2689 if (pd->af != AF_INET) 2690 break; 2691 hdrlen = sizeof(*pd->hdr.icmp); 2692 icmptype = pd->hdr.icmp->icmp_type; 2693 icmpcode = pd->hdr.icmp->icmp_code; 2694 state_icmp = pf_icmp_mapping(pd, icmptype, 2695 &icmp_dir, &multi, &virtual_id, &virtual_type); 2696 if (icmp_dir == PF_IN) { 2697 sport = virtual_id; 2698 dport = virtual_type; 2699 } else { 2700 sport = virtual_type; 2701 dport = virtual_id; 2702 } 2703 break; 2704 #endif /* INET */ 2705 #ifdef INET6 2706 case IPPROTO_ICMPV6: 2707 if (af != AF_INET6) 2708 break; 2709 hdrlen = sizeof(*pd->hdr.icmp6); 2710 icmptype = pd->hdr.icmp6->icmp6_type; 2711 icmpcode = pd->hdr.icmp6->icmp6_code; 2712 state_icmp = pf_icmp_mapping(pd, icmptype, 2713 &icmp_dir, &multi, &virtual_id, &virtual_type); 2714 if (icmp_dir == PF_IN) { 2715 sport = virtual_id; 2716 dport = virtual_type; 2717 } else { 2718 sport = virtual_type; 2719 dport = virtual_id; 2720 } 2721 break; 2722 #endif /* INET6 */ 2723 default: 2724 sport = dport = hdrlen = 0; 2725 break; 2726 } 2727 2728 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 2729 2730 /* check packet for BINAT/NAT/RDR */ 2731 if ((nr = pf_get_translation(pd, m, off, direction, kif, &nsn, 2732 &skw, &sks, &sk, &nk, saddr, daddr, sport, dport)) != NULL) { 2733 if (nk == NULL || sk == NULL) { 2734 REASON_SET(&reason, PFRES_MEMORY); 2735 goto cleanup; 2736 } 2737 2738 if (pd->ip_sum) 2739 bip_sum = *pd->ip_sum; 2740 2741 switch (pd->proto) { 2742 case IPPROTO_TCP: 2743 bproto_sum = th->th_sum; 2744 pd->proto_sum = &th->th_sum; 2745 2746 if (PF_ANEQ(saddr, &nk->addr[pd->sidx], af) || 2747 nk->port[pd->sidx] != sport) { 2748 pf_change_ap(saddr, &th->th_sport, pd->ip_sum, 2749 &th->th_sum, &nk->addr[pd->sidx], 2750 nk->port[pd->sidx], 0, af); 2751 pd->sport = &th->th_sport; 2752 sport = th->th_sport; 2753 } 2754 2755 if (PF_ANEQ(daddr, &nk->addr[pd->didx], af) || 2756 nk->port[pd->didx] != dport) { 2757 pf_change_ap(daddr, &th->th_dport, pd->ip_sum, 2758 &th->th_sum, &nk->addr[pd->didx], 2759 nk->port[pd->didx], 0, af); 2760 dport = th->th_dport; 2761 pd->dport = &th->th_dport; 2762 } 2763 rewrite++; 2764 break; 2765 case IPPROTO_UDP: 2766 bproto_sum = pd->hdr.udp->uh_sum; 2767 pd->proto_sum = &pd->hdr.udp->uh_sum; 2768 2769 if (PF_ANEQ(saddr, &nk->addr[pd->sidx], af) || 2770 nk->port[pd->sidx] != sport) { 2771 pf_change_ap(saddr, &pd->hdr.udp->uh_sport, 2772 pd->ip_sum, &pd->hdr.udp->uh_sum, 2773 &nk->addr[pd->sidx], 2774 nk->port[pd->sidx], 1, af); 2775 sport = pd->hdr.udp->uh_sport; 2776 pd->sport = &pd->hdr.udp->uh_sport; 2777 } 2778 2779 if (PF_ANEQ(daddr, &nk->addr[pd->didx], af) || 2780 nk->port[pd->didx] != dport) { 2781 pf_change_ap(daddr, &pd->hdr.udp->uh_dport, 2782 pd->ip_sum, &pd->hdr.udp->uh_sum, 2783 &nk->addr[pd->didx], 2784 nk->port[pd->didx], 1, af); 2785 dport = pd->hdr.udp->uh_dport; 2786 pd->dport = &pd->hdr.udp->uh_dport; 2787 } 2788 rewrite++; 2789 break; 2790 #ifdef INET 2791 case IPPROTO_ICMP: 2792 if (PF_ANEQ(saddr, &nk->addr[pd->sidx], AF_INET)) 2793 pf_change_a(&saddr->v4.s_addr, pd->ip_sum, 2794 nk->addr[pd->sidx].v4.s_addr, 0); 2795 2796 if (PF_ANEQ(daddr, &nk->addr[pd->didx], AF_INET)) 2797 pf_change_a(&daddr->v4.s_addr, pd->ip_sum, 2798 nk->addr[pd->didx].v4.s_addr, 0); 2799 2800 if (virtual_type == ICMP_ECHO && 2801 nk->port[pd->sidx] != pd->hdr.icmp->icmp_id) { 2802 pd->hdr.icmp->icmp_cksum = pf_cksum_fixup( 2803 pd->hdr.icmp->icmp_cksum, sport, 2804 nk->port[pd->sidx], 0); 2805 pd->hdr.icmp->icmp_id = nk->port[pd->sidx]; 2806 pd->sport = &pd->hdr.icmp->icmp_id; 2807 } 2808 m_copyback(m, off, ICMP_MINLEN, pd->hdr.icmp); 2809 break; 2810 #endif /* INET */ 2811 #ifdef INET6 2812 case IPPROTO_ICMPV6: 2813 if (PF_ANEQ(saddr, &nk->addr[pd->sidx], AF_INET6)) 2814 pf_change_a6(saddr, &pd->hdr.icmp6->icmp6_cksum, 2815 &nk->addr[pd->sidx], 0); 2816 2817 if (PF_ANEQ(daddr, &nk->addr[pd->didx], AF_INET6)) 2818 pf_change_a6(daddr, &pd->hdr.icmp6->icmp6_cksum, 2819 &nk->addr[pd->didx], 0); 2820 rewrite++; 2821 break; 2822 #endif /* INET */ 2823 default: 2824 switch (af) { 2825 #ifdef INET 2826 case AF_INET: 2827 if (PF_ANEQ(saddr, 2828 &nk->addr[pd->sidx], AF_INET)) 2829 pf_change_a(&saddr->v4.s_addr, 2830 pd->ip_sum, 2831 nk->addr[pd->sidx].v4.s_addr, 0); 2832 2833 if (PF_ANEQ(daddr, 2834 &nk->addr[pd->didx], AF_INET)) 2835 pf_change_a(&daddr->v4.s_addr, 2836 pd->ip_sum, 2837 nk->addr[pd->didx].v4.s_addr, 0); 2838 break; 2839 #endif /* INET */ 2840 #ifdef INET6 2841 case AF_INET6: 2842 if (PF_ANEQ(saddr, 2843 &nk->addr[pd->sidx], AF_INET6)) 2844 PF_ACPY(saddr, &nk->addr[pd->sidx], af); 2845 2846 if (PF_ANEQ(daddr, 2847 &nk->addr[pd->didx], AF_INET6)) 2848 PF_ACPY(saddr, &nk->addr[pd->didx], af); 2849 break; 2850 #endif /* INET */ 2851 } 2852 break; 2853 } 2854 if (nr->natpass) 2855 r = NULL; 2856 pd->nat_rule = nr; 2857 } 2858 2859 SLIST_INIT(&rules); 2860 while (r != NULL) { 2861 r->evaluations++; 2862 if (pfi_kif_match(r->kif, kif) == r->ifnot) 2863 r = r->skip[PF_SKIP_IFP].ptr; 2864 else if (r->direction && r->direction != direction) 2865 r = r->skip[PF_SKIP_DIR].ptr; 2866 else if (r->af && r->af != af) 2867 r = r->skip[PF_SKIP_AF].ptr; 2868 else if (r->proto && r->proto != pd->proto) 2869 r = r->skip[PF_SKIP_PROTO].ptr; 2870 else if (PF_MISMATCHAW(&r->src.addr, saddr, af, 2871 r->src.neg, kif)) 2872 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 2873 /* tcp/udp only. port_op always 0 in other cases */ 2874 else if (r->src.port_op && !pf_match_port(r->src.port_op, 2875 r->src.port[0], r->src.port[1], sport)) 2876 r = r->skip[PF_SKIP_SRC_PORT].ptr; 2877 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af, 2878 r->dst.neg, NULL)) 2879 r = r->skip[PF_SKIP_DST_ADDR].ptr; 2880 /* tcp/udp only. port_op always 0 in other cases */ 2881 else if (r->dst.port_op && !pf_match_port(r->dst.port_op, 2882 r->dst.port[0], r->dst.port[1], dport)) 2883 r = r->skip[PF_SKIP_DST_PORT].ptr; 2884 /* icmp only. type always 0 in other cases */ 2885 else if (r->type && r->type != icmptype + 1) 2886 r = TAILQ_NEXT(r, entries); 2887 /* icmp only. type always 0 in other cases */ 2888 else if (r->code && r->code != icmpcode + 1) 2889 r = TAILQ_NEXT(r, entries); 2890 else if (r->tos && !(r->tos == pd->tos)) 2891 r = TAILQ_NEXT(r, entries); 2892 else if (r->rule_flag & PFRULE_FRAGMENT) 2893 r = TAILQ_NEXT(r, entries); 2894 else if (pd->proto == IPPROTO_TCP && 2895 (r->flagset & th->th_flags) != r->flags) 2896 r = TAILQ_NEXT(r, entries); 2897 /* tcp/udp only. uid.op always 0 in other cases */ 2898 else if (r->uid.op && (pd->lookup.done || (pd->lookup.done = 2899 pf_socket_lookup(direction, pd), 1)) && 2900 !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1], 2901 pd->lookup.uid)) 2902 r = TAILQ_NEXT(r, entries); 2903 /* tcp/udp only. gid.op always 0 in other cases */ 2904 else if (r->gid.op && (pd->lookup.done || (pd->lookup.done = 2905 pf_socket_lookup(direction, pd), 1)) && 2906 !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1], 2907 pd->lookup.gid)) 2908 r = TAILQ_NEXT(r, entries); 2909 else if (r->prob && 2910 r->prob <= arc4random_uniform(UINT_MAX - 1) + 1) 2911 r = TAILQ_NEXT(r, entries); 2912 else if (r->match_tag && !pf_match_tag(m, r, &tag)) 2913 r = TAILQ_NEXT(r, entries); 2914 else if (r->os_fingerprint != PF_OSFP_ANY && 2915 (pd->proto != IPPROTO_TCP || !pf_osfp_match( 2916 pf_osfp_fingerprint(pd, m, off, th), 2917 r->os_fingerprint))) 2918 r = TAILQ_NEXT(r, entries); 2919 else { 2920 lastr = r; 2921 if (r->tag) 2922 tag = r->tag; 2923 if (r->anchor == NULL) { 2924 if (r->action == PF_MATCH) { 2925 ri = pool_get(&pf_rule_item_pl, 2926 PR_NOWAIT); 2927 ri->r = r; 2928 /* order is irrelevant */ 2929 SLIST_INSERT_HEAD(&rules, ri, entry); 2930 pf_rule_to_actions(r, &act); 2931 } else { 2932 match = 1; 2933 *rm = r; 2934 *am = a; 2935 *rsm = ruleset; 2936 } 2937 2938 if ((*rm)->quick) 2939 break; 2940 r = TAILQ_NEXT(r, entries); 2941 } else 2942 pf_step_into_anchor(&asd, &ruleset, 2943 PF_RULESET_FILTER, &r, &a, &match); 2944 } 2945 if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset, 2946 PF_RULESET_FILTER, &r, &a, &match)) 2947 break; 2948 } 2949 r = *rm; 2950 a = *am; 2951 ruleset = *rsm; 2952 2953 /* apply actions for last matching rule */ 2954 if (lastr && lastr->action != PF_MATCH) 2955 pf_rule_to_actions(lastr, &act); 2956 2957 REASON_SET(&reason, PFRES_MATCH); 2958 2959 if (act.log || (nr != NULL && nr->log)) { 2960 struct pf_rule_item *mr; 2961 2962 if (rewrite) 2963 m_copyback(m, off, hdrlen, pd->hdr.any); 2964 if (r->log) 2965 PFLOG_PACKET(kif, h, m, af, direction, reason, 2966 r->log ? r : nr, a, ruleset, pd); 2967 SLIST_FOREACH(mr, &rules, entry) 2968 if (mr->r->log) 2969 PFLOG_PACKET(kif, h, m, af, direction, reason, 2970 mr->r, a, ruleset, pd); 2971 } 2972 2973 if ((r->action == PF_DROP) && 2974 ((r->rule_flag & PFRULE_RETURNRST) || 2975 (r->rule_flag & PFRULE_RETURNICMP) || 2976 (r->rule_flag & PFRULE_RETURN))) { 2977 /* undo NAT changes, if they have taken place */ 2978 if (nr != NULL) { 2979 PF_ACPY(saddr, &sk->addr[pd->sidx], af); 2980 PF_ACPY(daddr, &sk->addr[pd->didx], af); 2981 if (pd->sport) 2982 *pd->sport = sk->port[pd->sidx]; 2983 if (pd->dport) 2984 *pd->dport = sk->port[pd->didx]; 2985 if (pd->proto_sum) 2986 *pd->proto_sum = bproto_sum; 2987 if (pd->ip_sum) 2988 *pd->ip_sum = bip_sum; 2989 m_copyback(m, off, hdrlen, pd->hdr.any); 2990 } 2991 if (pd->proto == IPPROTO_TCP && 2992 ((r->rule_flag & PFRULE_RETURNRST) || 2993 (r->rule_flag & PFRULE_RETURN)) && 2994 !(th->th_flags & TH_RST)) { 2995 u_int32_t ack = ntohl(th->th_seq) + pd->p_len; 2996 int len = 0; 2997 struct ip *h4; 2998 struct ip6_hdr *h6; 2999 3000 switch (af) { 3001 case AF_INET: 3002 h4 = mtod(m, struct ip *); 3003 len = ntohs(h4->ip_len) - off; 3004 break; 3005 case AF_INET6: 3006 h6 = mtod(m, struct ip6_hdr *); 3007 len = ntohs(h6->ip6_plen) - (off - sizeof(*h6)); 3008 break; 3009 } 3010 3011 if (pf_check_proto_cksum(m, off, len, IPPROTO_TCP, af)) 3012 REASON_SET(&reason, PFRES_PROTCKSUM); 3013 else { 3014 if (th->th_flags & TH_SYN) 3015 ack++; 3016 if (th->th_flags & TH_FIN) 3017 ack++; 3018 pf_send_tcp(r, af, pd->dst, 3019 pd->src, th->th_dport, th->th_sport, 3020 ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0, 3021 r->return_ttl, 1, 0, pd->eh, kif->pfik_ifp, 3022 act.rtableid); 3023 } 3024 } else if (pd->proto != IPPROTO_ICMP && af == AF_INET && 3025 r->return_icmp) 3026 pf_send_icmp(m, r->return_icmp >> 8, 3027 r->return_icmp & 255, af, r, act.rtableid); 3028 else if (pd->proto != IPPROTO_ICMPV6 && af == AF_INET6 && 3029 r->return_icmp6) 3030 pf_send_icmp(m, r->return_icmp6 >> 8, 3031 r->return_icmp6 & 255, af, r, act.rtableid); 3032 } 3033 3034 if (r->action == PF_DROP) 3035 goto cleanup; 3036 3037 if (pf_tag_packet(m, tag, act.rtableid)) { 3038 REASON_SET(&reason, PFRES_MEMORY); 3039 goto cleanup; 3040 } 3041 3042 if (!state_icmp && (r->keep_state || nr != NULL)) { 3043 int action; 3044 action = pf_create_state(r, nr, a, pd, nsn, skw, sks, nk, sk, m, 3045 off, sport, dport, &rewrite, kif, sm, tag, bproto_sum, 3046 bip_sum, hdrlen, &rules, &act); 3047 if (action != PF_PASS) 3048 return (action); 3049 } else { 3050 if (sk != NULL) 3051 pool_put(&pf_state_key_pl, sk); 3052 if (nk != NULL) 3053 pool_put(&pf_state_key_pl, nk); 3054 } 3055 3056 /* copy back packet headers if we performed NAT operations */ 3057 if (rewrite) 3058 m_copyback(m, off, hdrlen, pd->hdr.any); 3059 3060 #if NPFSYNC > 0 3061 if (*sm != NULL && !ISSET((*sm)->state_flags, PFSTATE_NOSYNC) && 3062 direction == PF_OUT && pfsync_up()) { 3063 /* 3064 * We want the state created, but we dont 3065 * want to send this in case a partner 3066 * firewall has to know about it to allow 3067 * replies through it. 3068 */ 3069 if (pfsync_defer(*sm, m)) 3070 return (PF_DEFER); 3071 } 3072 #endif 3073 3074 return (PF_PASS); 3075 3076 cleanup: 3077 if (sk != NULL) 3078 pool_put(&pf_state_key_pl, sk); 3079 if (nk != NULL) 3080 pool_put(&pf_state_key_pl, nk); 3081 return (PF_DROP); 3082 } 3083 3084 static __inline int 3085 pf_create_state(struct pf_rule *r, struct pf_rule *nr, struct pf_rule *a, 3086 struct pf_pdesc *pd, struct pf_src_node *nsn, struct pf_state_key *skw, 3087 struct pf_state_key *sks, struct pf_state_key *nk, struct pf_state_key *sk, 3088 struct mbuf *m, int off, u_int16_t sport, u_int16_t dport, int *rewrite, 3089 struct pfi_kif *kif, struct pf_state **sm, int tag, u_int16_t bproto_sum, 3090 u_int16_t bip_sum, int hdrlen, struct pf_rule_slist *rules, 3091 struct pf_rule_actions *act) 3092 { 3093 struct pf_state *s = NULL; 3094 struct pf_src_node *sn = NULL; 3095 struct tcphdr *th = pd->hdr.tcp; 3096 u_int16_t mss = tcp_mssdflt; 3097 u_short reason; 3098 3099 /* check maximums */ 3100 if (r->max_states && (r->states_cur >= r->max_states)) { 3101 pf_status.lcounters[LCNT_STATES]++; 3102 REASON_SET(&reason, PFRES_MAXSTATES); 3103 return (PF_DROP); 3104 } 3105 /* src node for filter rule */ 3106 if ((r->rule_flag & PFRULE_SRCTRACK || 3107 r->rpool.opts & PF_POOL_STICKYADDR) && 3108 pf_insert_src_node(&sn, r, pd->src, pd->af) != 0) { 3109 REASON_SET(&reason, PFRES_SRCLIMIT); 3110 goto csfailed; 3111 } 3112 /* src node for translation rule */ 3113 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) && 3114 pf_insert_src_node(&nsn, nr, &sk->addr[pd->sidx], pd->af)) { 3115 REASON_SET(&reason, PFRES_SRCLIMIT); 3116 goto csfailed; 3117 } 3118 s = pool_get(&pf_state_pl, PR_NOWAIT | PR_ZERO); 3119 if (s == NULL) { 3120 REASON_SET(&reason, PFRES_MEMORY); 3121 goto csfailed; 3122 } 3123 s->rule.ptr = r; 3124 s->nat_rule.ptr = nr; 3125 s->anchor.ptr = a; 3126 bcopy(rules, &s->match_rules, sizeof(s->match_rules)); 3127 STATE_INC_COUNTERS(s); 3128 if (r->allow_opts) 3129 s->state_flags |= PFSTATE_ALLOWOPTS; 3130 if (r->rule_flag & PFRULE_STATESLOPPY) 3131 s->state_flags |= PFSTATE_SLOPPY; 3132 if (r->rule_flag & PFRULE_PFLOW) 3133 s->state_flags |= PFSTATE_PFLOW; 3134 s->log = act->log & PF_LOG_ALL; 3135 s->qid = act->qid; 3136 s->pqid = act->pqid; 3137 s->rtableid = act->rtableid; 3138 s->min_ttl = act->min_ttl; 3139 s->set_tos = act->set_tos; 3140 s->max_mss = act->max_mss; 3141 s->state_flags |= act->flags; 3142 s->sync_state = PFSYNC_S_NONE; 3143 if (nr != NULL) 3144 s->log |= nr->log & PF_LOG_ALL; 3145 switch (pd->proto) { 3146 case IPPROTO_TCP: 3147 s->src.seqlo = ntohl(th->th_seq); 3148 s->src.seqhi = s->src.seqlo + pd->p_len + 1; 3149 if ((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN && 3150 r->keep_state == PF_STATE_MODULATE) { 3151 /* Generate sequence number modulator */ 3152 if ((s->src.seqdiff = pf_tcp_iss(pd) - s->src.seqlo) == 3153 0) 3154 s->src.seqdiff = 1; 3155 pf_change_a(&th->th_seq, &th->th_sum, 3156 htonl(s->src.seqlo + s->src.seqdiff), 0); 3157 *rewrite = 1; 3158 } else 3159 s->src.seqdiff = 0; 3160 if (th->th_flags & TH_SYN) { 3161 s->src.seqhi++; 3162 s->src.wscale = pf_get_wscale(m, off, 3163 th->th_off, pd->af); 3164 } 3165 s->src.max_win = MAX(ntohs(th->th_win), 1); 3166 if (s->src.wscale & PF_WSCALE_MASK) { 3167 /* Remove scale factor from initial window */ 3168 int win = s->src.max_win; 3169 win += 1 << (s->src.wscale & PF_WSCALE_MASK); 3170 s->src.max_win = (win - 1) >> 3171 (s->src.wscale & PF_WSCALE_MASK); 3172 } 3173 if (th->th_flags & TH_FIN) 3174 s->src.seqhi++; 3175 s->dst.seqhi = 1; 3176 s->dst.max_win = 1; 3177 s->src.state = TCPS_SYN_SENT; 3178 s->dst.state = TCPS_CLOSED; 3179 s->timeout = PFTM_TCP_FIRST_PACKET; 3180 break; 3181 case IPPROTO_UDP: 3182 s->src.state = PFUDPS_SINGLE; 3183 s->dst.state = PFUDPS_NO_TRAFFIC; 3184 s->timeout = PFTM_UDP_FIRST_PACKET; 3185 break; 3186 case IPPROTO_ICMP: 3187 #ifdef INET6 3188 case IPPROTO_ICMPV6: 3189 #endif 3190 s->timeout = PFTM_ICMP_FIRST_PACKET; 3191 break; 3192 default: 3193 s->src.state = PFOTHERS_SINGLE; 3194 s->dst.state = PFOTHERS_NO_TRAFFIC; 3195 s->timeout = PFTM_OTHER_FIRST_PACKET; 3196 } 3197 3198 s->creation = time_second; 3199 s->expire = time_second; 3200 3201 if (sn != NULL) { 3202 s->src_node = sn; 3203 s->src_node->states++; 3204 } 3205 if (nsn != NULL) { 3206 /* XXX We only modify one side for now. */ 3207 PF_ACPY(&nsn->raddr, &nk->addr[1], pd->af); 3208 s->nat_src_node = nsn; 3209 s->nat_src_node->states++; 3210 } 3211 if (pd->proto == IPPROTO_TCP) { 3212 if (s->state_flags & PFSTATE_SCRUB_TCP && 3213 pf_normalize_tcp_init(m, off, pd, th, &s->src, &s->dst)) { 3214 REASON_SET(&reason, PFRES_MEMORY); 3215 pf_src_tree_remove_state(s); 3216 STATE_DEC_COUNTERS(s); 3217 pool_put(&pf_state_pl, s); 3218 return (PF_DROP); 3219 } 3220 if (s->state_flags & PFSTATE_SCRUB_TCP && s->src.scrub && 3221 pf_normalize_tcp_stateful(m, off, pd, &reason, th, s, 3222 &s->src, &s->dst, rewrite)) { 3223 /* This really shouldn't happen!!! */ 3224 DPFPRINTF(PF_DEBUG_URGENT, 3225 ("pf_normalize_tcp_stateful failed on first pkt")); 3226 pf_normalize_tcp_cleanup(s); 3227 pf_src_tree_remove_state(s); 3228 STATE_DEC_COUNTERS(s); 3229 pool_put(&pf_state_pl, s); 3230 return (PF_DROP); 3231 } 3232 } 3233 s->direction = pd->dir; 3234 3235 if (sk == NULL && pf_state_key_setup(pd, nr, &skw, &sks, &sk, &nk, 3236 pd->src, pd->dst, sport, dport)) 3237 goto csfailed; 3238 3239 if (pf_state_insert(BOUND_IFACE(r, kif), skw, sks, s)) { 3240 if (pd->proto == IPPROTO_TCP) 3241 pf_normalize_tcp_cleanup(s); 3242 REASON_SET(&reason, PFRES_STATEINS); 3243 pf_src_tree_remove_state(s); 3244 STATE_DEC_COUNTERS(s); 3245 pool_put(&pf_state_pl, s); 3246 return (PF_DROP); 3247 } else 3248 *sm = s; 3249 3250 pf_set_rt_ifp(s, pd->src); /* needs s->state_key set */ 3251 if (tag > 0) { 3252 pf_tag_ref(tag); 3253 s->tag = tag; 3254 } 3255 if (pd->proto == IPPROTO_TCP && (th->th_flags & (TH_SYN|TH_ACK)) == 3256 TH_SYN && r->keep_state == PF_STATE_SYNPROXY) { 3257 s->src.state = PF_TCPS_PROXY_SRC; 3258 /* undo NAT changes, if they have taken place */ 3259 if (nr != NULL) { 3260 struct pf_state_key *skt = s->key[PF_SK_WIRE]; 3261 if (pd->dir == PF_OUT) 3262 skt = s->key[PF_SK_STACK]; 3263 PF_ACPY(pd->src, &skt->addr[pd->sidx], pd->af); 3264 PF_ACPY(pd->dst, &skt->addr[pd->didx], pd->af); 3265 if (pd->sport) 3266 *pd->sport = skt->port[pd->sidx]; 3267 if (pd->dport) 3268 *pd->dport = skt->port[pd->didx]; 3269 if (pd->proto_sum) 3270 *pd->proto_sum = bproto_sum; 3271 if (pd->ip_sum) 3272 *pd->ip_sum = bip_sum; 3273 m_copyback(m, off, hdrlen, pd->hdr.any); 3274 } 3275 s->src.seqhi = htonl(arc4random()); 3276 /* Find mss option */ 3277 mss = pf_get_mss(m, off, th->th_off, pd->af); 3278 mss = pf_calc_mss(pd->src, pd->af, mss); 3279 mss = pf_calc_mss(pd->dst, pd->af, mss); 3280 s->src.mss = mss; 3281 pf_send_tcp(r, pd->af, pd->dst, pd->src, th->th_dport, 3282 th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1, 3283 TH_SYN|TH_ACK, 0, s->src.mss, 0, 1, 0, NULL, NULL, 3284 act->rtableid); 3285 REASON_SET(&reason, PFRES_SYNPROXY); 3286 return (PF_SYNPROXY_DROP); 3287 } 3288 3289 return (PF_PASS); 3290 3291 csfailed: 3292 if (sk != NULL) 3293 pool_put(&pf_state_key_pl, sk); 3294 if (nk != NULL) 3295 pool_put(&pf_state_key_pl, nk); 3296 3297 if (sn != NULL && sn->states == 0 && sn->expire == 0) { 3298 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn); 3299 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3300 pf_status.src_nodes--; 3301 pool_put(&pf_src_tree_pl, sn); 3302 } 3303 if (nsn != sn && nsn != NULL && nsn->states == 0 && nsn->expire == 0) { 3304 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn); 3305 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 3306 pf_status.src_nodes--; 3307 pool_put(&pf_src_tree_pl, nsn); 3308 } 3309 return (PF_DROP); 3310 } 3311 3312 int 3313 pf_test_fragment(struct pf_rule **rm, int direction, struct pfi_kif *kif, 3314 struct mbuf *m, void *h, struct pf_pdesc *pd, struct pf_rule **am, 3315 struct pf_ruleset **rsm) 3316 { 3317 struct pf_rule *r, *a = NULL; 3318 struct pf_ruleset *ruleset = NULL; 3319 sa_family_t af = pd->af; 3320 u_short reason; 3321 int tag = -1; 3322 int asd = 0; 3323 int match = 0; 3324 3325 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 3326 while (r != NULL) { 3327 r->evaluations++; 3328 if (pfi_kif_match(r->kif, kif) == r->ifnot) 3329 r = r->skip[PF_SKIP_IFP].ptr; 3330 else if (r->direction && r->direction != direction) 3331 r = r->skip[PF_SKIP_DIR].ptr; 3332 else if (r->af && r->af != af) 3333 r = r->skip[PF_SKIP_AF].ptr; 3334 else if (r->proto && r->proto != pd->proto) 3335 r = r->skip[PF_SKIP_PROTO].ptr; 3336 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af, 3337 r->src.neg, kif)) 3338 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 3339 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af, 3340 r->dst.neg, NULL)) 3341 r = r->skip[PF_SKIP_DST_ADDR].ptr; 3342 else if (r->tos && !(r->tos == pd->tos)) 3343 r = TAILQ_NEXT(r, entries); 3344 else if (r->os_fingerprint != PF_OSFP_ANY) 3345 r = TAILQ_NEXT(r, entries); 3346 else if (pd->proto == IPPROTO_UDP && 3347 (r->src.port_op || r->dst.port_op)) 3348 r = TAILQ_NEXT(r, entries); 3349 else if (pd->proto == IPPROTO_TCP && 3350 (r->src.port_op || r->dst.port_op || r->flagset)) 3351 r = TAILQ_NEXT(r, entries); 3352 else if ((pd->proto == IPPROTO_ICMP || 3353 pd->proto == IPPROTO_ICMPV6) && 3354 (r->type || r->code)) 3355 r = TAILQ_NEXT(r, entries); 3356 else if (r->prob && r->prob <= 3357 (arc4random() % (UINT_MAX - 1) + 1)) 3358 r = TAILQ_NEXT(r, entries); 3359 else if (r->match_tag && !pf_match_tag(m, r, &tag)) 3360 r = TAILQ_NEXT(r, entries); 3361 else { 3362 if (r->anchor == NULL) { 3363 match = 1; 3364 *rm = r; 3365 *am = a; 3366 *rsm = ruleset; 3367 if ((*rm)->quick) 3368 break; 3369 r = TAILQ_NEXT(r, entries); 3370 } else 3371 pf_step_into_anchor(&asd, &ruleset, 3372 PF_RULESET_FILTER, &r, &a, &match); 3373 } 3374 if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset, 3375 PF_RULESET_FILTER, &r, &a, &match)) 3376 break; 3377 } 3378 r = *rm; 3379 a = *am; 3380 ruleset = *rsm; 3381 3382 REASON_SET(&reason, PFRES_MATCH); 3383 3384 if (r->log) 3385 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset, 3386 pd); 3387 3388 if (r->action != PF_PASS) 3389 return (PF_DROP); 3390 3391 if (pf_tag_packet(m, tag, -1)) { 3392 REASON_SET(&reason, PFRES_MEMORY); 3393 return (PF_DROP); 3394 } 3395 3396 return (PF_PASS); 3397 } 3398 3399 int 3400 pf_tcp_track_full(struct pf_state_peer *src, struct pf_state_peer *dst, 3401 struct pf_state **state, struct pfi_kif *kif, struct mbuf *m, int off, 3402 struct pf_pdesc *pd, u_short *reason, int *copyback) 3403 { 3404 struct tcphdr *th = pd->hdr.tcp; 3405 u_int16_t win = ntohs(th->th_win); 3406 u_int32_t ack, end, seq, orig_seq; 3407 u_int8_t sws, dws; 3408 int ackskew; 3409 3410 if (src->wscale && dst->wscale && !(th->th_flags & TH_SYN)) { 3411 sws = src->wscale & PF_WSCALE_MASK; 3412 dws = dst->wscale & PF_WSCALE_MASK; 3413 } else 3414 sws = dws = 0; 3415 3416 /* 3417 * Sequence tracking algorithm from Guido van Rooij's paper: 3418 * http://www.madison-gurkha.com/publications/tcp_filtering/ 3419 * tcp_filtering.ps 3420 */ 3421 3422 orig_seq = seq = ntohl(th->th_seq); 3423 if (src->seqlo == 0) { 3424 /* First packet from this end. Set its state */ 3425 3426 if (((*state)->state_flags & PFSTATE_SCRUB_TCP || dst->scrub) && 3427 src->scrub == NULL) { 3428 if (pf_normalize_tcp_init(m, off, pd, th, src, dst)) { 3429 REASON_SET(reason, PFRES_MEMORY); 3430 return (PF_DROP); 3431 } 3432 } 3433 3434 /* Deferred generation of sequence number modulator */ 3435 if (dst->seqdiff && !src->seqdiff) { 3436 /* use random iss for the TCP server */ 3437 while ((src->seqdiff = arc4random() - seq) == 0) 3438 ; 3439 ack = ntohl(th->th_ack) - dst->seqdiff; 3440 pf_change_a(&th->th_seq, &th->th_sum, htonl(seq + 3441 src->seqdiff), 0); 3442 pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0); 3443 *copyback = 1; 3444 } else { 3445 ack = ntohl(th->th_ack); 3446 } 3447 3448 end = seq + pd->p_len; 3449 if (th->th_flags & TH_SYN) { 3450 end++; 3451 if (dst->wscale & PF_WSCALE_FLAG) { 3452 src->wscale = pf_get_wscale(m, off, th->th_off, 3453 pd->af); 3454 if (src->wscale & PF_WSCALE_FLAG) { 3455 /* Remove scale factor from initial 3456 * window */ 3457 sws = src->wscale & PF_WSCALE_MASK; 3458 win = ((u_int32_t)win + (1 << sws) - 1) 3459 >> sws; 3460 dws = dst->wscale & PF_WSCALE_MASK; 3461 } else { 3462 /* fixup other window */ 3463 dst->max_win <<= dst->wscale & 3464 PF_WSCALE_MASK; 3465 /* in case of a retrans SYN|ACK */ 3466 dst->wscale = 0; 3467 } 3468 } 3469 } 3470 if (th->th_flags & TH_FIN) 3471 end++; 3472 3473 src->seqlo = seq; 3474 if (src->state < TCPS_SYN_SENT) 3475 src->state = TCPS_SYN_SENT; 3476 3477 /* 3478 * May need to slide the window (seqhi may have been set by 3479 * the crappy stack check or if we picked up the connection 3480 * after establishment) 3481 */ 3482 if (src->seqhi == 1 || 3483 SEQ_GEQ(end + MAX(1, dst->max_win << dws), src->seqhi)) 3484 src->seqhi = end + MAX(1, dst->max_win << dws); 3485 if (win > src->max_win) 3486 src->max_win = win; 3487 3488 } else { 3489 ack = ntohl(th->th_ack) - dst->seqdiff; 3490 if (src->seqdiff) { 3491 /* Modulate sequence numbers */ 3492 pf_change_a(&th->th_seq, &th->th_sum, htonl(seq + 3493 src->seqdiff), 0); 3494 pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0); 3495 *copyback = 1; 3496 } 3497 end = seq + pd->p_len; 3498 if (th->th_flags & TH_SYN) 3499 end++; 3500 if (th->th_flags & TH_FIN) 3501 end++; 3502 } 3503 3504 if ((th->th_flags & TH_ACK) == 0) { 3505 /* Let it pass through the ack skew check */ 3506 ack = dst->seqlo; 3507 } else if ((ack == 0 && 3508 (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) || 3509 /* broken tcp stacks do not set ack */ 3510 (dst->state < TCPS_SYN_SENT)) { 3511 /* 3512 * Many stacks (ours included) will set the ACK number in an 3513 * FIN|ACK if the SYN times out -- no sequence to ACK. 3514 */ 3515 ack = dst->seqlo; 3516 } 3517 3518 if (seq == end) { 3519 /* Ease sequencing restrictions on no data packets */ 3520 seq = src->seqlo; 3521 end = seq; 3522 } 3523 3524 ackskew = dst->seqlo - ack; 3525 3526 3527 /* 3528 * Need to demodulate the sequence numbers in any TCP SACK options 3529 * (Selective ACK). We could optionally validate the SACK values 3530 * against the current ACK window, either forwards or backwards, but 3531 * I'm not confident that SACK has been implemented properly 3532 * everywhere. It wouldn't surprise me if several stacks accidently 3533 * SACK too far backwards of previously ACKed data. There really aren't 3534 * any security implications of bad SACKing unless the target stack 3535 * doesn't validate the option length correctly. Someone trying to 3536 * spoof into a TCP connection won't bother blindly sending SACK 3537 * options anyway. 3538 */ 3539 if (dst->seqdiff && (th->th_off << 2) > sizeof(struct tcphdr)) { 3540 if (pf_modulate_sack(m, off, pd, th, dst)) 3541 *copyback = 1; 3542 } 3543 3544 3545 #define MAXACKWINDOW (0xffff + 1500) /* 1500 is an arbitrary fudge factor */ 3546 if (SEQ_GEQ(src->seqhi, end) && 3547 /* Last octet inside other's window space */ 3548 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) && 3549 /* Retrans: not more than one window back */ 3550 (ackskew >= -MAXACKWINDOW) && 3551 /* Acking not more than one reassembled fragment backwards */ 3552 (ackskew <= (MAXACKWINDOW << sws)) && 3553 /* Acking not more than one window forward */ 3554 ((th->th_flags & TH_RST) == 0 || orig_seq == src->seqlo || 3555 (orig_seq == src->seqlo + 1) || (orig_seq + 1 == src->seqlo) || 3556 (pd->flags & PFDESC_IP_REAS) == 0)) { 3557 /* Require an exact/+1 sequence match on resets when possible */ 3558 3559 if (dst->scrub || src->scrub) { 3560 if (pf_normalize_tcp_stateful(m, off, pd, reason, th, 3561 *state, src, dst, copyback)) 3562 return (PF_DROP); 3563 } 3564 3565 /* update max window */ 3566 if (src->max_win < win) 3567 src->max_win = win; 3568 /* synchronize sequencing */ 3569 if (SEQ_GT(end, src->seqlo)) 3570 src->seqlo = end; 3571 /* slide the window of what the other end can send */ 3572 if (SEQ_GEQ(ack + (win << sws), dst->seqhi)) 3573 dst->seqhi = ack + MAX((win << sws), 1); 3574 3575 3576 /* update states */ 3577 if (th->th_flags & TH_SYN) 3578 if (src->state < TCPS_SYN_SENT) 3579 src->state = TCPS_SYN_SENT; 3580 if (th->th_flags & TH_FIN) 3581 if (src->state < TCPS_CLOSING) 3582 src->state = TCPS_CLOSING; 3583 if (th->th_flags & TH_ACK) { 3584 if (dst->state == TCPS_SYN_SENT) { 3585 dst->state = TCPS_ESTABLISHED; 3586 if (src->state == TCPS_ESTABLISHED && 3587 (*state)->src_node != NULL && 3588 pf_src_connlimit(state)) { 3589 REASON_SET(reason, PFRES_SRCLIMIT); 3590 return (PF_DROP); 3591 } 3592 } else if (dst->state == TCPS_CLOSING) 3593 dst->state = TCPS_FIN_WAIT_2; 3594 } 3595 if (th->th_flags & TH_RST) 3596 src->state = dst->state = TCPS_TIME_WAIT; 3597 3598 /* update expire time */ 3599 (*state)->expire = time_second; 3600 if (src->state >= TCPS_FIN_WAIT_2 && 3601 dst->state >= TCPS_FIN_WAIT_2) 3602 (*state)->timeout = PFTM_TCP_CLOSED; 3603 else if (src->state >= TCPS_CLOSING && 3604 dst->state >= TCPS_CLOSING) 3605 (*state)->timeout = PFTM_TCP_FIN_WAIT; 3606 else if (src->state < TCPS_ESTABLISHED || 3607 dst->state < TCPS_ESTABLISHED) 3608 (*state)->timeout = PFTM_TCP_OPENING; 3609 else if (src->state >= TCPS_CLOSING || 3610 dst->state >= TCPS_CLOSING) 3611 (*state)->timeout = PFTM_TCP_CLOSING; 3612 else 3613 (*state)->timeout = PFTM_TCP_ESTABLISHED; 3614 3615 /* Fall through to PASS packet */ 3616 3617 } else if ((dst->state < TCPS_SYN_SENT || 3618 dst->state >= TCPS_FIN_WAIT_2 || 3619 src->state >= TCPS_FIN_WAIT_2) && 3620 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) && 3621 /* Within a window forward of the originating packet */ 3622 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW)) { 3623 /* Within a window backward of the originating packet */ 3624 3625 /* 3626 * This currently handles three situations: 3627 * 1) Stupid stacks will shotgun SYNs before their peer 3628 * replies. 3629 * 2) When PF catches an already established stream (the 3630 * firewall rebooted, the state table was flushed, routes 3631 * changed...) 3632 * 3) Packets get funky immediately after the connection 3633 * closes (this should catch Solaris spurious ACK|FINs 3634 * that web servers like to spew after a close) 3635 * 3636 * This must be a little more careful than the above code 3637 * since packet floods will also be caught here. We don't 3638 * update the TTL here to mitigate the damage of a packet 3639 * flood and so the same code can handle awkward establishment 3640 * and a loosened connection close. 3641 * In the establishment case, a correct peer response will 3642 * validate the connection, go through the normal state code 3643 * and keep updating the state TTL. 3644 */ 3645 3646 if (pf_status.debug >= PF_DEBUG_MISC) { 3647 printf("pf: loose state match: "); 3648 pf_print_state(*state); 3649 pf_print_flags(th->th_flags); 3650 printf(" seq=%u (%u) ack=%u len=%u ackskew=%d " 3651 "pkts=%llu:%llu dir=%s,%s\n", seq, orig_seq, ack, 3652 pd->p_len, ackskew, (*state)->packets[0], 3653 (*state)->packets[1], 3654 pd->dir == PF_IN ? "in" : "out", 3655 pd->dir == (*state)->direction ? "fwd" : "rev"); 3656 } 3657 3658 if (dst->scrub || src->scrub) { 3659 if (pf_normalize_tcp_stateful(m, off, pd, reason, th, 3660 *state, src, dst, copyback)) 3661 return (PF_DROP); 3662 } 3663 3664 /* update max window */ 3665 if (src->max_win < win) 3666 src->max_win = win; 3667 /* synchronize sequencing */ 3668 if (SEQ_GT(end, src->seqlo)) 3669 src->seqlo = end; 3670 /* slide the window of what the other end can send */ 3671 if (SEQ_GEQ(ack + (win << sws), dst->seqhi)) 3672 dst->seqhi = ack + MAX((win << sws), 1); 3673 3674 /* 3675 * Cannot set dst->seqhi here since this could be a shotgunned 3676 * SYN and not an already established connection. 3677 */ 3678 3679 if (th->th_flags & TH_FIN) 3680 if (src->state < TCPS_CLOSING) 3681 src->state = TCPS_CLOSING; 3682 if (th->th_flags & TH_RST) 3683 src->state = dst->state = TCPS_TIME_WAIT; 3684 3685 /* Fall through to PASS packet */ 3686 3687 } else { 3688 if ((*state)->dst.state == TCPS_SYN_SENT && 3689 (*state)->src.state == TCPS_SYN_SENT) { 3690 /* Send RST for state mismatches during handshake */ 3691 if (!(th->th_flags & TH_RST)) 3692 pf_send_tcp((*state)->rule.ptr, pd->af, 3693 pd->dst, pd->src, th->th_dport, 3694 th->th_sport, ntohl(th->th_ack), 0, 3695 TH_RST, 0, 0, 3696 (*state)->rule.ptr->return_ttl, 1, 0, 3697 pd->eh, kif->pfik_ifp, (*state)->rtableid); 3698 src->seqlo = 0; 3699 src->seqhi = 1; 3700 src->max_win = 1; 3701 } else if (pf_status.debug >= PF_DEBUG_MISC) { 3702 printf("pf: BAD state: "); 3703 pf_print_state(*state); 3704 pf_print_flags(th->th_flags); 3705 printf(" seq=%u (%u) ack=%u len=%u ackskew=%d " 3706 "pkts=%llu:%llu dir=%s,%s\n", 3707 seq, orig_seq, ack, pd->p_len, ackskew, 3708 (*state)->packets[0], (*state)->packets[1], 3709 pd->dir == PF_IN ? "in" : "out", 3710 pd->dir == (*state)->direction ? "fwd" : "rev"); 3711 printf("pf: State failure on: %c %c %c %c | %c %c\n", 3712 SEQ_GEQ(src->seqhi, end) ? ' ' : '1', 3713 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) ? 3714 ' ': '2', 3715 (ackskew >= -MAXACKWINDOW) ? ' ' : '3', 3716 (ackskew <= (MAXACKWINDOW << sws)) ? ' ' : '4', 3717 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) ?' ' :'5', 3718 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW) ?' ' :'6'); 3719 } 3720 REASON_SET(reason, PFRES_BADSTATE); 3721 return (PF_DROP); 3722 } 3723 3724 return (PF_PASS); 3725 } 3726 3727 int 3728 pf_tcp_track_sloppy(struct pf_state_peer *src, struct pf_state_peer *dst, 3729 struct pf_state **state, struct pf_pdesc *pd, u_short *reason) 3730 { 3731 struct tcphdr *th = pd->hdr.tcp; 3732 3733 if (th->th_flags & TH_SYN) 3734 if (src->state < TCPS_SYN_SENT) 3735 src->state = TCPS_SYN_SENT; 3736 if (th->th_flags & TH_FIN) 3737 if (src->state < TCPS_CLOSING) 3738 src->state = TCPS_CLOSING; 3739 if (th->th_flags & TH_ACK) { 3740 if (dst->state == TCPS_SYN_SENT) { 3741 dst->state = TCPS_ESTABLISHED; 3742 if (src->state == TCPS_ESTABLISHED && 3743 (*state)->src_node != NULL && 3744 pf_src_connlimit(state)) { 3745 REASON_SET(reason, PFRES_SRCLIMIT); 3746 return (PF_DROP); 3747 } 3748 } else if (dst->state == TCPS_CLOSING) { 3749 dst->state = TCPS_FIN_WAIT_2; 3750 } else if (src->state == TCPS_SYN_SENT && 3751 dst->state < TCPS_SYN_SENT) { 3752 /* 3753 * Handle a special sloppy case where we only see one 3754 * half of the connection. If there is a ACK after 3755 * the initial SYN without ever seeing a packet from 3756 * the destination, set the connection to established. 3757 */ 3758 dst->state = src->state = TCPS_ESTABLISHED; 3759 if ((*state)->src_node != NULL && 3760 pf_src_connlimit(state)) { 3761 REASON_SET(reason, PFRES_SRCLIMIT); 3762 return (PF_DROP); 3763 } 3764 } else if (src->state == TCPS_CLOSING && 3765 dst->state == TCPS_ESTABLISHED && 3766 dst->seqlo == 0) { 3767 /* 3768 * Handle the closing of half connections where we 3769 * don't see the full bidirectional FIN/ACK+ACK 3770 * handshake. 3771 */ 3772 dst->state = TCPS_CLOSING; 3773 } 3774 } 3775 if (th->th_flags & TH_RST) 3776 src->state = dst->state = TCPS_TIME_WAIT; 3777 3778 /* update expire time */ 3779 (*state)->expire = time_second; 3780 if (src->state >= TCPS_FIN_WAIT_2 && 3781 dst->state >= TCPS_FIN_WAIT_2) 3782 (*state)->timeout = PFTM_TCP_CLOSED; 3783 else if (src->state >= TCPS_CLOSING && 3784 dst->state >= TCPS_CLOSING) 3785 (*state)->timeout = PFTM_TCP_FIN_WAIT; 3786 else if (src->state < TCPS_ESTABLISHED || 3787 dst->state < TCPS_ESTABLISHED) 3788 (*state)->timeout = PFTM_TCP_OPENING; 3789 else if (src->state >= TCPS_CLOSING || 3790 dst->state >= TCPS_CLOSING) 3791 (*state)->timeout = PFTM_TCP_CLOSING; 3792 else 3793 (*state)->timeout = PFTM_TCP_ESTABLISHED; 3794 3795 return (PF_PASS); 3796 } 3797 3798 int 3799 pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif, 3800 struct mbuf *m, int off, void *h, struct pf_pdesc *pd, 3801 u_short *reason) 3802 { 3803 struct pf_state_key_cmp key; 3804 struct tcphdr *th = pd->hdr.tcp; 3805 int copyback = 0; 3806 struct pf_state_peer *src, *dst; 3807 struct pf_state_key *sk; 3808 3809 key.af = pd->af; 3810 key.proto = IPPROTO_TCP; 3811 if (direction == PF_IN) { /* wire side, straight */ 3812 PF_ACPY(&key.addr[0], pd->src, key.af); 3813 PF_ACPY(&key.addr[1], pd->dst, key.af); 3814 key.port[0] = th->th_sport; 3815 key.port[1] = th->th_dport; 3816 } else { /* stack side, reverse */ 3817 PF_ACPY(&key.addr[1], pd->src, key.af); 3818 PF_ACPY(&key.addr[0], pd->dst, key.af); 3819 key.port[1] = th->th_sport; 3820 key.port[0] = th->th_dport; 3821 } 3822 3823 STATE_LOOKUP(kif, &key, direction, *state, m); 3824 3825 if (direction == (*state)->direction) { 3826 src = &(*state)->src; 3827 dst = &(*state)->dst; 3828 } else { 3829 src = &(*state)->dst; 3830 dst = &(*state)->src; 3831 } 3832 3833 sk = (*state)->key[pd->didx]; 3834 3835 if ((*state)->src.state == PF_TCPS_PROXY_SRC) { 3836 if (direction != (*state)->direction) { 3837 REASON_SET(reason, PFRES_SYNPROXY); 3838 return (PF_SYNPROXY_DROP); 3839 } 3840 if (th->th_flags & TH_SYN) { 3841 if (ntohl(th->th_seq) != (*state)->src.seqlo) { 3842 REASON_SET(reason, PFRES_SYNPROXY); 3843 return (PF_DROP); 3844 } 3845 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst, 3846 pd->src, th->th_dport, th->th_sport, 3847 (*state)->src.seqhi, ntohl(th->th_seq) + 1, 3848 TH_SYN|TH_ACK, 0, (*state)->src.mss, 0, 1, 3849 0, NULL, NULL, (*state)->rtableid); 3850 REASON_SET(reason, PFRES_SYNPROXY); 3851 return (PF_SYNPROXY_DROP); 3852 } else if (!(th->th_flags & TH_ACK) || 3853 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) || 3854 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) { 3855 REASON_SET(reason, PFRES_SYNPROXY); 3856 return (PF_DROP); 3857 } else if ((*state)->src_node != NULL && 3858 pf_src_connlimit(state)) { 3859 REASON_SET(reason, PFRES_SRCLIMIT); 3860 return (PF_DROP); 3861 } else 3862 (*state)->src.state = PF_TCPS_PROXY_DST; 3863 } 3864 if ((*state)->src.state == PF_TCPS_PROXY_DST) { 3865 if (direction == (*state)->direction) { 3866 if (((th->th_flags & (TH_SYN|TH_ACK)) != TH_ACK) || 3867 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) || 3868 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) { 3869 REASON_SET(reason, PFRES_SYNPROXY); 3870 return (PF_DROP); 3871 } 3872 (*state)->src.max_win = MAX(ntohs(th->th_win), 1); 3873 if ((*state)->dst.seqhi == 1) 3874 (*state)->dst.seqhi = htonl(arc4random()); 3875 pf_send_tcp((*state)->rule.ptr, pd->af, 3876 &sk->addr[pd->sidx], &sk->addr[pd->didx], 3877 sk->port[pd->sidx], sk->port[pd->didx], 3878 (*state)->dst.seqhi, 0, TH_SYN, 0, 3879 (*state)->src.mss, 0, 0, (*state)->tag, NULL, NULL, 3880 (*state)->rtableid); 3881 REASON_SET(reason, PFRES_SYNPROXY); 3882 return (PF_SYNPROXY_DROP); 3883 } else if (((th->th_flags & (TH_SYN|TH_ACK)) != 3884 (TH_SYN|TH_ACK)) || 3885 (ntohl(th->th_ack) != (*state)->dst.seqhi + 1)) { 3886 REASON_SET(reason, PFRES_SYNPROXY); 3887 return (PF_DROP); 3888 } else { 3889 (*state)->dst.max_win = MAX(ntohs(th->th_win), 1); 3890 (*state)->dst.seqlo = ntohl(th->th_seq); 3891 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst, 3892 pd->src, th->th_dport, th->th_sport, 3893 ntohl(th->th_ack), ntohl(th->th_seq) + 1, 3894 TH_ACK, (*state)->src.max_win, 0, 0, 0, 3895 (*state)->tag, NULL, NULL, (*state)->rtableid); 3896 pf_send_tcp((*state)->rule.ptr, pd->af, 3897 &sk->addr[pd->sidx], &sk->addr[pd->didx], 3898 sk->port[pd->sidx], sk->port[pd->didx], 3899 (*state)->src.seqhi + 1, (*state)->src.seqlo + 1, 3900 TH_ACK, (*state)->dst.max_win, 0, 0, 1, 3901 0, NULL, NULL, (*state)->rtableid); 3902 (*state)->src.seqdiff = (*state)->dst.seqhi - 3903 (*state)->src.seqlo; 3904 (*state)->dst.seqdiff = (*state)->src.seqhi - 3905 (*state)->dst.seqlo; 3906 (*state)->src.seqhi = (*state)->src.seqlo + 3907 (*state)->dst.max_win; 3908 (*state)->dst.seqhi = (*state)->dst.seqlo + 3909 (*state)->src.max_win; 3910 (*state)->src.wscale = (*state)->dst.wscale = 0; 3911 (*state)->src.state = (*state)->dst.state = 3912 TCPS_ESTABLISHED; 3913 REASON_SET(reason, PFRES_SYNPROXY); 3914 return (PF_SYNPROXY_DROP); 3915 } 3916 } 3917 3918 if (((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN) && 3919 dst->state >= TCPS_FIN_WAIT_2 && 3920 src->state >= TCPS_FIN_WAIT_2) { 3921 if (pf_status.debug >= PF_DEBUG_MISC) { 3922 printf("pf: state reuse "); 3923 pf_print_state(*state); 3924 pf_print_flags(th->th_flags); 3925 printf("\n"); 3926 } 3927 /* XXX make sure it's the same direction ?? */ 3928 (*state)->src.state = (*state)->dst.state = TCPS_CLOSED; 3929 pf_unlink_state(*state); 3930 *state = NULL; 3931 return (PF_DROP); 3932 } 3933 3934 if ((*state)->state_flags & PFSTATE_SLOPPY) { 3935 if (pf_tcp_track_sloppy(src, dst, state, pd, reason) == PF_DROP) 3936 return (PF_DROP); 3937 } else { 3938 if (pf_tcp_track_full(src, dst, state, kif, m, off, pd, reason, 3939 ©back) == PF_DROP) 3940 return (PF_DROP); 3941 } 3942 3943 /* translate source/destination address, if necessary */ 3944 if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) { 3945 struct pf_state_key *nk = (*state)->key[pd->didx]; 3946 3947 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af) || 3948 nk->port[pd->sidx] != th->th_sport) 3949 pf_change_ap(pd->src, &th->th_sport, pd->ip_sum, 3950 &th->th_sum, &nk->addr[pd->sidx], 3951 nk->port[pd->sidx], 0, pd->af); 3952 3953 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af) || 3954 nk->port[pd->didx] != th->th_dport) 3955 pf_change_ap(pd->dst, &th->th_dport, pd->ip_sum, 3956 &th->th_sum, &nk->addr[pd->didx], 3957 nk->port[pd->didx], 0, pd->af); 3958 copyback = 1; 3959 } 3960 3961 /* Copyback sequence modulation or stateful scrub changes if needed */ 3962 if (copyback) 3963 m_copyback(m, off, sizeof(*th), th); 3964 3965 return (PF_PASS); 3966 } 3967 3968 int 3969 pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif, 3970 struct mbuf *m, int off, void *h, struct pf_pdesc *pd) 3971 { 3972 struct pf_state_peer *src, *dst; 3973 struct pf_state_key_cmp key; 3974 struct udphdr *uh = pd->hdr.udp; 3975 3976 key.af = pd->af; 3977 key.proto = IPPROTO_UDP; 3978 if (direction == PF_IN) { /* wire side, straight */ 3979 PF_ACPY(&key.addr[0], pd->src, key.af); 3980 PF_ACPY(&key.addr[1], pd->dst, key.af); 3981 key.port[0] = uh->uh_sport; 3982 key.port[1] = uh->uh_dport; 3983 } else { /* stack side, reverse */ 3984 PF_ACPY(&key.addr[1], pd->src, key.af); 3985 PF_ACPY(&key.addr[0], pd->dst, key.af); 3986 key.port[1] = uh->uh_sport; 3987 key.port[0] = uh->uh_dport; 3988 } 3989 3990 STATE_LOOKUP(kif, &key, direction, *state, m); 3991 3992 if (direction == (*state)->direction) { 3993 src = &(*state)->src; 3994 dst = &(*state)->dst; 3995 } else { 3996 src = &(*state)->dst; 3997 dst = &(*state)->src; 3998 } 3999 4000 /* update states */ 4001 if (src->state < PFUDPS_SINGLE) 4002 src->state = PFUDPS_SINGLE; 4003 if (dst->state == PFUDPS_SINGLE) 4004 dst->state = PFUDPS_MULTIPLE; 4005 4006 /* update expire time */ 4007 (*state)->expire = time_second; 4008 if (src->state == PFUDPS_MULTIPLE && dst->state == PFUDPS_MULTIPLE) 4009 (*state)->timeout = PFTM_UDP_MULTIPLE; 4010 else 4011 (*state)->timeout = PFTM_UDP_SINGLE; 4012 4013 /* translate source/destination address, if necessary */ 4014 if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) { 4015 struct pf_state_key *nk = (*state)->key[pd->didx]; 4016 4017 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af) || 4018 nk->port[pd->sidx] != uh->uh_sport) 4019 pf_change_ap(pd->src, &uh->uh_sport, pd->ip_sum, 4020 &uh->uh_sum, &nk->addr[pd->sidx], 4021 nk->port[pd->sidx], 1, pd->af); 4022 4023 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af) || 4024 nk->port[pd->didx] != uh->uh_dport) 4025 pf_change_ap(pd->dst, &uh->uh_dport, pd->ip_sum, 4026 &uh->uh_sum, &nk->addr[pd->didx], 4027 nk->port[pd->didx], 1, pd->af); 4028 m_copyback(m, off, sizeof(*uh), uh); 4029 } 4030 4031 return (PF_PASS); 4032 } 4033 4034 int 4035 pf_icmp_state_lookup(struct pf_state_key_cmp *key, struct pf_pdesc *pd, 4036 struct pf_state **state, struct mbuf *m, int direction, struct pfi_kif *kif, 4037 u_int16_t icmpid, u_int16_t type, int icmp_dir, int *iidx, int multi) 4038 { 4039 key->af = pd->af; 4040 key->proto = pd->proto; 4041 if (icmp_dir == PF_IN) { 4042 *iidx = pd->sidx; 4043 key->port[pd->sidx] = icmpid; 4044 key->port[pd->didx] = type; 4045 } else { 4046 *iidx = pd->didx; 4047 key->port[pd->sidx] = type; 4048 key->port[pd->didx] = icmpid; 4049 } 4050 if (pd->af == AF_INET6 && multi != PF_ICMP_MULTI_NONE) { 4051 switch (multi) { 4052 case PF_ICMP_MULTI_SOLICITED: 4053 key->addr[pd->sidx].addr32[0] = IPV6_ADDR_INT32_MLL; 4054 key->addr[pd->sidx].addr32[1] = 0; 4055 key->addr[pd->sidx].addr32[2] = IPV6_ADDR_INT32_ONE; 4056 key->addr[pd->sidx].addr32[3] = pd->src->addr32[3]; 4057 key->addr[pd->sidx].addr8[12] = 0xff; 4058 break; 4059 case PF_ICMP_MULTI_LINK: 4060 key->addr[pd->sidx].addr32[0] = IPV6_ADDR_INT32_MLL; 4061 key->addr[pd->sidx].addr32[1] = 0; 4062 key->addr[pd->sidx].addr32[2] = 0; 4063 key->addr[pd->sidx].addr32[3] = IPV6_ADDR_INT32_ONE; 4064 break; 4065 } 4066 } else 4067 PF_ACPY(&key->addr[pd->sidx], pd->src, key->af); 4068 PF_ACPY(&key->addr[pd->didx], pd->dst, key->af); 4069 4070 STATE_LOOKUP(kif, key, direction, *state, m); 4071 4072 /* Is this ICMP message flowing in right direction? */ 4073 if ((*state)->rule.ptr->type && 4074 (((*state)->direction == direction) ? 4075 PF_IN : PF_OUT) != icmp_dir) { 4076 if (pf_status.debug >= PF_DEBUG_MISC) { 4077 printf("pf: icmp type %d in wrong direction (%d): ", 4078 icmp_dir); 4079 pf_print_state(*state); 4080 printf("\n"); 4081 } 4082 return (PF_DROP); 4083 } 4084 return (-1); 4085 } 4086 4087 int 4088 pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif, 4089 struct mbuf *m, int off, void *h, struct pf_pdesc *pd, u_short *reason) 4090 { 4091 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 4092 u_int16_t icmpid, *icmpsum, virtual_id, virtual_type; 4093 u_int8_t icmptype; 4094 int icmp_dir, iidx, ret, multi; 4095 struct pf_state_key_cmp key; 4096 4097 switch (pd->proto) { 4098 #ifdef INET 4099 case IPPROTO_ICMP: 4100 icmptype = pd->hdr.icmp->icmp_type; 4101 icmpid = pd->hdr.icmp->icmp_id; 4102 icmpsum = &pd->hdr.icmp->icmp_cksum; 4103 break; 4104 #endif /* INET */ 4105 #ifdef INET6 4106 case IPPROTO_ICMPV6: 4107 icmptype = pd->hdr.icmp6->icmp6_type; 4108 icmpid = pd->hdr.icmp6->icmp6_id; 4109 icmpsum = &pd->hdr.icmp6->icmp6_cksum; 4110 break; 4111 #endif /* INET6 */ 4112 } 4113 4114 if (pf_icmp_mapping(pd, icmptype, &icmp_dir, &multi, 4115 &virtual_id, &virtual_type) == 0) { 4116 /* 4117 * ICMP query/reply message not related to a TCP/UDP packet. 4118 * Search for an ICMP state. 4119 */ 4120 ret = pf_icmp_state_lookup(&key, pd, state, m, direction, 4121 kif, virtual_id, virtual_type, icmp_dir, &iidx, 4122 PF_ICMP_MULTI_NONE); 4123 if (ret >= 0) { 4124 if (ret == PF_DROP && pd->af == AF_INET6 && 4125 icmp_dir == PF_OUT) { 4126 ret = pf_icmp_state_lookup(&key, pd, state, m, 4127 direction, kif, virtual_id, virtual_type, 4128 icmp_dir, &iidx, multi); 4129 if (ret >= 0) 4130 return (ret); 4131 } else 4132 return (ret); 4133 } 4134 4135 (*state)->expire = time_second; 4136 (*state)->timeout = PFTM_ICMP_ERROR_REPLY; 4137 4138 /* translate source/destination address, if necessary */ 4139 if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) { 4140 struct pf_state_key *nk = (*state)->key[pd->didx]; 4141 4142 switch (pd->af) { 4143 #ifdef INET 4144 case AF_INET: 4145 if (PF_ANEQ(pd->src, 4146 &nk->addr[pd->sidx], AF_INET)) 4147 pf_change_a(&saddr->v4.s_addr, 4148 pd->ip_sum, 4149 nk->addr[pd->sidx].v4.s_addr, 0); 4150 4151 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], 4152 AF_INET)) 4153 pf_change_a(&daddr->v4.s_addr, 4154 pd->ip_sum, 4155 nk->addr[pd->didx].v4.s_addr, 0); 4156 4157 if (nk->port[iidx] != 4158 pd->hdr.icmp->icmp_id) { 4159 pd->hdr.icmp->icmp_cksum = 4160 pf_cksum_fixup( 4161 pd->hdr.icmp->icmp_cksum, icmpid, 4162 nk->port[iidx], 0); 4163 pd->hdr.icmp->icmp_id = nk->port[iidx]; 4164 } 4165 4166 m_copyback(m, off, ICMP_MINLEN, 4167 pd->hdr.icmp); 4168 break; 4169 #endif /* INET */ 4170 #ifdef INET6 4171 case AF_INET6: 4172 if (PF_ANEQ(pd->src, 4173 &nk->addr[pd->sidx], AF_INET6)) 4174 pf_change_a6(saddr, 4175 &pd->hdr.icmp6->icmp6_cksum, 4176 &nk->addr[pd->sidx], 0); 4177 4178 if (PF_ANEQ(pd->dst, 4179 &nk->addr[pd->didx], AF_INET6)) 4180 pf_change_a6(daddr, 4181 &pd->hdr.icmp6->icmp6_cksum, 4182 &nk->addr[pd->didx], 0); 4183 4184 m_copyback(m, off, 4185 sizeof(struct icmp6_hdr), 4186 pd->hdr.icmp6); 4187 break; 4188 #endif /* INET6 */ 4189 } 4190 } 4191 return (PF_PASS); 4192 4193 } else { 4194 /* 4195 * ICMP error message in response to a TCP/UDP packet. 4196 * Extract the inner TCP/UDP header and search for that state. 4197 */ 4198 4199 struct pf_pdesc pd2; 4200 #ifdef INET 4201 struct ip h2; 4202 #endif /* INET */ 4203 #ifdef INET6 4204 struct ip6_hdr h2_6; 4205 int terminal = 0; 4206 #endif /* INET6 */ 4207 int ipoff2; 4208 int off2; 4209 4210 pd2.af = pd->af; 4211 /* Payload packet is from the opposite direction. */ 4212 pd2.sidx = (direction == PF_IN) ? 1 : 0; 4213 pd2.didx = (direction == PF_IN) ? 0 : 1; 4214 switch (pd->af) { 4215 #ifdef INET 4216 case AF_INET: 4217 /* offset of h2 in mbuf chain */ 4218 ipoff2 = off + ICMP_MINLEN; 4219 4220 if (!pf_pull_hdr(m, ipoff2, &h2, sizeof(h2), 4221 NULL, reason, pd2.af)) { 4222 DPFPRINTF(PF_DEBUG_MISC, 4223 ("pf: ICMP error message too short " 4224 "(ip)\n")); 4225 return (PF_DROP); 4226 } 4227 /* 4228 * ICMP error messages don't refer to non-first 4229 * fragments 4230 */ 4231 if (h2.ip_off & htons(IP_OFFMASK)) { 4232 REASON_SET(reason, PFRES_FRAG); 4233 return (PF_DROP); 4234 } 4235 4236 /* offset of protocol header that follows h2 */ 4237 off2 = ipoff2 + (h2.ip_hl << 2); 4238 4239 pd2.proto = h2.ip_p; 4240 pd2.src = (struct pf_addr *)&h2.ip_src; 4241 pd2.dst = (struct pf_addr *)&h2.ip_dst; 4242 pd2.ip_sum = &h2.ip_sum; 4243 break; 4244 #endif /* INET */ 4245 #ifdef INET6 4246 case AF_INET6: 4247 ipoff2 = off + sizeof(struct icmp6_hdr); 4248 4249 if (!pf_pull_hdr(m, ipoff2, &h2_6, sizeof(h2_6), 4250 NULL, reason, pd2.af)) { 4251 DPFPRINTF(PF_DEBUG_MISC, 4252 ("pf: ICMP error message too short " 4253 "(ip6)\n")); 4254 return (PF_DROP); 4255 } 4256 pd2.proto = h2_6.ip6_nxt; 4257 pd2.src = (struct pf_addr *)&h2_6.ip6_src; 4258 pd2.dst = (struct pf_addr *)&h2_6.ip6_dst; 4259 pd2.ip_sum = NULL; 4260 off2 = ipoff2 + sizeof(h2_6); 4261 do { 4262 switch (pd2.proto) { 4263 case IPPROTO_FRAGMENT: 4264 /* 4265 * ICMPv6 error messages for 4266 * non-first fragments 4267 */ 4268 REASON_SET(reason, PFRES_FRAG); 4269 return (PF_DROP); 4270 case IPPROTO_AH: 4271 case IPPROTO_HOPOPTS: 4272 case IPPROTO_ROUTING: 4273 case IPPROTO_DSTOPTS: { 4274 /* get next header and header length */ 4275 struct ip6_ext opt6; 4276 4277 if (!pf_pull_hdr(m, off2, &opt6, 4278 sizeof(opt6), NULL, reason, 4279 pd2.af)) { 4280 DPFPRINTF(PF_DEBUG_MISC, 4281 ("pf: ICMPv6 short opt\n")); 4282 return (PF_DROP); 4283 } 4284 if (pd2.proto == IPPROTO_AH) 4285 off2 += (opt6.ip6e_len + 2) * 4; 4286 else 4287 off2 += (opt6.ip6e_len + 1) * 8; 4288 pd2.proto = opt6.ip6e_nxt; 4289 /* goto the next header */ 4290 break; 4291 } 4292 default: 4293 terminal++; 4294 break; 4295 } 4296 } while (!terminal); 4297 break; 4298 #endif /* INET6 */ 4299 } 4300 4301 switch (pd2.proto) { 4302 case IPPROTO_TCP: { 4303 struct tcphdr th; 4304 u_int32_t seq; 4305 struct pf_state_peer *src, *dst; 4306 u_int8_t dws; 4307 int copyback = 0; 4308 4309 /* 4310 * Only the first 8 bytes of the TCP header can be 4311 * expected. Don't access any TCP header fields after 4312 * th_seq, an ackskew test is not possible. 4313 */ 4314 if (!pf_pull_hdr(m, off2, &th, 8, NULL, reason, 4315 pd2.af)) { 4316 DPFPRINTF(PF_DEBUG_MISC, 4317 ("pf: ICMP error message too short " 4318 "(tcp)\n")); 4319 return (PF_DROP); 4320 } 4321 4322 key.af = pd2.af; 4323 key.proto = IPPROTO_TCP; 4324 PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af); 4325 PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af); 4326 key.port[pd2.sidx] = th.th_sport; 4327 key.port[pd2.didx] = th.th_dport; 4328 4329 STATE_LOOKUP(kif, &key, direction, *state, m); 4330 4331 if (direction == (*state)->direction) { 4332 src = &(*state)->dst; 4333 dst = &(*state)->src; 4334 } else { 4335 src = &(*state)->src; 4336 dst = &(*state)->dst; 4337 } 4338 4339 if (src->wscale && dst->wscale) 4340 dws = dst->wscale & PF_WSCALE_MASK; 4341 else 4342 dws = 0; 4343 4344 /* Demodulate sequence number */ 4345 seq = ntohl(th.th_seq) - src->seqdiff; 4346 if (src->seqdiff) { 4347 pf_change_a(&th.th_seq, icmpsum, 4348 htonl(seq), 0); 4349 copyback = 1; 4350 } 4351 4352 if (!((*state)->state_flags & PFSTATE_SLOPPY) && 4353 (!SEQ_GEQ(src->seqhi, seq) || 4354 !SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)))) { 4355 if (pf_status.debug >= PF_DEBUG_MISC) { 4356 printf("pf: BAD ICMP %d:%d ", 4357 icmptype, pd->hdr.icmp->icmp_code); 4358 pf_print_host(pd->src, 0, pd->af); 4359 printf(" -> "); 4360 pf_print_host(pd->dst, 0, pd->af); 4361 printf(" state: "); 4362 pf_print_state(*state); 4363 printf(" seq=%u\n", seq); 4364 } 4365 REASON_SET(reason, PFRES_BADSTATE); 4366 return (PF_DROP); 4367 } else { 4368 if (pf_status.debug >= PF_DEBUG_MISC) { 4369 printf("pf: OK ICMP %d:%d ", 4370 icmptype, pd->hdr.icmp->icmp_code); 4371 pf_print_host(pd->src, 0, pd->af); 4372 printf(" -> "); 4373 pf_print_host(pd->dst, 0, pd->af); 4374 printf(" state: "); 4375 pf_print_state(*state); 4376 printf(" seq=%u\n", seq); 4377 } 4378 } 4379 4380 /* translate source/destination address, if necessary */ 4381 if ((*state)->key[PF_SK_WIRE] != 4382 (*state)->key[PF_SK_STACK]) { 4383 struct pf_state_key *nk = 4384 (*state)->key[pd->didx]; 4385 4386 if (PF_ANEQ(pd2.src, 4387 &nk->addr[pd2.sidx], pd2.af) || 4388 nk->port[pd2.sidx] != th.th_sport) 4389 pf_change_icmp(pd2.src, &th.th_sport, 4390 daddr, &nk->addr[pd2.sidx], 4391 nk->port[pd2.sidx], NULL, 4392 pd2.ip_sum, icmpsum, 4393 pd->ip_sum, 0, pd2.af); 4394 4395 if (PF_ANEQ(pd2.dst, 4396 &nk->addr[pd2.didx], pd2.af) || 4397 nk->port[pd2.didx] != th.th_dport) 4398 pf_change_icmp(pd2.dst, &th.th_dport, 4399 NULL, /* XXX Inbound NAT? */ 4400 &nk->addr[pd2.didx], 4401 nk->port[pd2.didx], NULL, 4402 pd2.ip_sum, icmpsum, 4403 pd->ip_sum, 0, pd2.af); 4404 copyback = 1; 4405 } 4406 4407 if (copyback) { 4408 switch (pd2.af) { 4409 #ifdef INET 4410 case AF_INET: 4411 m_copyback(m, off, ICMP_MINLEN, 4412 pd->hdr.icmp); 4413 m_copyback(m, ipoff2, sizeof(h2), 4414 &h2); 4415 break; 4416 #endif /* INET */ 4417 #ifdef INET6 4418 case AF_INET6: 4419 m_copyback(m, off, 4420 sizeof(struct icmp6_hdr), 4421 pd->hdr.icmp6); 4422 m_copyback(m, ipoff2, sizeof(h2_6), 4423 &h2_6); 4424 break; 4425 #endif /* INET6 */ 4426 } 4427 m_copyback(m, off2, 8, &th); 4428 } 4429 4430 return (PF_PASS); 4431 break; 4432 } 4433 case IPPROTO_UDP: { 4434 struct udphdr uh; 4435 4436 if (!pf_pull_hdr(m, off2, &uh, sizeof(uh), 4437 NULL, reason, pd2.af)) { 4438 DPFPRINTF(PF_DEBUG_MISC, 4439 ("pf: ICMP error message too short " 4440 "(udp)\n")); 4441 return (PF_DROP); 4442 } 4443 4444 key.af = pd2.af; 4445 key.proto = IPPROTO_UDP; 4446 PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af); 4447 PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af); 4448 key.port[pd2.sidx] = uh.uh_sport; 4449 key.port[pd2.didx] = uh.uh_dport; 4450 4451 STATE_LOOKUP(kif, &key, direction, *state, m); 4452 4453 /* translate source/destination address, if necessary */ 4454 if ((*state)->key[PF_SK_WIRE] != 4455 (*state)->key[PF_SK_STACK]) { 4456 struct pf_state_key *nk = 4457 (*state)->key[pd->didx]; 4458 4459 if (PF_ANEQ(pd2.src, 4460 &nk->addr[pd2.sidx], pd2.af) || 4461 nk->port[pd2.sidx] != uh.uh_sport) 4462 pf_change_icmp(pd2.src, &uh.uh_sport, 4463 daddr, &nk->addr[pd2.sidx], 4464 nk->port[pd2.sidx], &uh.uh_sum, 4465 pd2.ip_sum, icmpsum, 4466 pd->ip_sum, 1, pd2.af); 4467 4468 if (PF_ANEQ(pd2.dst, 4469 &nk->addr[pd2.didx], pd2.af) || 4470 nk->port[pd2.didx] != uh.uh_dport) 4471 pf_change_icmp(pd2.dst, &uh.uh_dport, 4472 NULL, /* XXX Inbound NAT? */ 4473 &nk->addr[pd2.didx], 4474 nk->port[pd2.didx], &uh.uh_sum, 4475 pd2.ip_sum, icmpsum, 4476 pd->ip_sum, 1, pd2.af); 4477 4478 switch (pd2.af) { 4479 #ifdef INET 4480 case AF_INET: 4481 m_copyback(m, off, ICMP_MINLEN, 4482 pd->hdr.icmp); 4483 m_copyback(m, ipoff2, sizeof(h2), &h2); 4484 break; 4485 #endif /* INET */ 4486 #ifdef INET6 4487 case AF_INET6: 4488 m_copyback(m, off, 4489 sizeof(struct icmp6_hdr), 4490 pd->hdr.icmp6); 4491 m_copyback(m, ipoff2, sizeof(h2_6), 4492 &h2_6); 4493 break; 4494 #endif /* INET6 */ 4495 } 4496 m_copyback(m, off2, sizeof(uh), &uh); 4497 } 4498 return (PF_PASS); 4499 break; 4500 } 4501 #ifdef INET 4502 case IPPROTO_ICMP: { 4503 struct icmp iih; 4504 4505 if (!pf_pull_hdr(m, off2, &iih, ICMP_MINLEN, 4506 NULL, reason, pd2.af)) { 4507 DPFPRINTF(PF_DEBUG_MISC, 4508 ("pf: ICMP error message too short i" 4509 "(icmp)\n")); 4510 return (PF_DROP); 4511 } 4512 4513 pd2.hdr.icmp = &iih; 4514 pf_icmp_mapping(&pd2, iih.icmp_type, 4515 &icmp_dir, &multi, &virtual_id, &virtual_type); 4516 4517 ret = pf_icmp_state_lookup(&key, &pd2, state, m, 4518 direction, kif, virtual_id, virtual_type, 4519 icmp_dir, &iidx, PF_ICMP_MULTI_NONE); 4520 if (ret >= 0) 4521 return (ret); 4522 4523 /* translate source/destination address, if necessary */ 4524 if ((*state)->key[PF_SK_WIRE] != 4525 (*state)->key[PF_SK_STACK]) { 4526 struct pf_state_key *nk = 4527 (*state)->key[pd->didx]; 4528 4529 if (PF_ANEQ(pd2.src, 4530 &nk->addr[pd2.sidx], pd2.af) || 4531 (virtual_type == ICMP_ECHO && 4532 nk->port[iidx] != iih.icmp_id)) 4533 pf_change_icmp(pd2.src, 4534 (virtual_type == ICMP_ECHO) ? 4535 &iih.icmp_id : NULL, 4536 daddr, &nk->addr[pd2.sidx], 4537 (virtual_type == ICMP_ECHO) ? 4538 nk->port[iidx] : NULL, NULL, 4539 pd2.ip_sum, icmpsum, 4540 pd->ip_sum, 0, AF_INET); 4541 4542 if (PF_ANEQ(pd2.dst, 4543 &nk->addr[pd2.didx], pd2.af)) 4544 pf_change_icmp(pd2.dst, NULL, NULL, 4545 &nk->addr[pd2.didx], 0, NULL, 4546 pd2.ip_sum, icmpsum, 4547 pd->ip_sum, 0, AF_INET); 4548 4549 m_copyback(m, off, ICMP_MINLEN, pd->hdr.icmp); 4550 m_copyback(m, ipoff2, sizeof(h2), &h2); 4551 m_copyback(m, off2, ICMP_MINLEN, &iih); 4552 } 4553 return (PF_PASS); 4554 break; 4555 } 4556 #endif /* INET */ 4557 #ifdef INET6 4558 case IPPROTO_ICMPV6: { 4559 struct icmp6_hdr iih; 4560 4561 if (!pf_pull_hdr(m, off2, &iih, 4562 sizeof(struct icmp6_hdr), NULL, reason, pd2.af)) { 4563 DPFPRINTF(PF_DEBUG_MISC, 4564 ("pf: ICMP error message too short " 4565 "(icmp6)\n")); 4566 return (PF_DROP); 4567 } 4568 4569 pd2.hdr.icmp6 = &iih; 4570 pf_icmp_mapping(&pd2, iih.icmp6_type, 4571 &icmp_dir, &multi, &virtual_id, &virtual_type); 4572 ret = pf_icmp_state_lookup(&key, &pd2, state, m, 4573 direction, kif, virtual_id, virtual_type, 4574 icmp_dir, &iidx, PF_ICMP_MULTI_NONE); 4575 if (ret >= 0) { 4576 if (ret == PF_DROP && pd->af == AF_INET6 && 4577 icmp_dir == PF_OUT) { 4578 ret = pf_icmp_state_lookup(&key, pd, 4579 state, m, direction, kif, 4580 virtual_id, virtual_type, 4581 icmp_dir, &iidx, multi); 4582 if (ret >= 0) 4583 return (ret); 4584 } else 4585 return (ret); 4586 } 4587 4588 /* translate source/destination address, if necessary */ 4589 if ((*state)->key[PF_SK_WIRE] != 4590 (*state)->key[PF_SK_STACK]) { 4591 struct pf_state_key *nk = 4592 (*state)->key[pd->didx]; 4593 4594 if (PF_ANEQ(pd2.src, 4595 &nk->addr[pd2.sidx], pd2.af) || 4596 ((virtual_type == ICMP6_ECHO_REQUEST) && 4597 nk->port[pd2.sidx] != iih.icmp6_id)) 4598 pf_change_icmp(pd2.src, 4599 (virtual_type == ICMP6_ECHO_REQUEST) 4600 ? &iih.icmp6_id : NULL, 4601 daddr, &nk->addr[pd2.sidx], 4602 (virtual_type == ICMP6_ECHO_REQUEST) 4603 ? nk->port[iidx] : NULL, NULL, 4604 pd2.ip_sum, icmpsum, 4605 pd->ip_sum, 0, AF_INET6); 4606 4607 if (PF_ANEQ(pd2.dst, 4608 &nk->addr[pd2.didx], pd2.af)) 4609 pf_change_icmp(pd2.dst, NULL, NULL, 4610 &nk->addr[pd2.didx], 0, NULL, 4611 pd2.ip_sum, icmpsum, 4612 pd->ip_sum, 0, AF_INET6); 4613 4614 m_copyback(m, off, sizeof(struct icmp6_hdr), 4615 pd->hdr.icmp6); 4616 m_copyback(m, ipoff2, sizeof(h2_6), &h2_6); 4617 m_copyback(m, off2, sizeof(struct icmp6_hdr), 4618 &iih); 4619 } 4620 return (PF_PASS); 4621 break; 4622 } 4623 #endif /* INET6 */ 4624 default: { 4625 key.af = pd2.af; 4626 key.proto = pd2.proto; 4627 PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af); 4628 PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af); 4629 key.port[0] = key.port[1] = 0; 4630 4631 STATE_LOOKUP(kif, &key, direction, *state, m); 4632 4633 /* translate source/destination address, if necessary */ 4634 if ((*state)->key[PF_SK_WIRE] != 4635 (*state)->key[PF_SK_STACK]) { 4636 struct pf_state_key *nk = 4637 (*state)->key[pd->didx]; 4638 4639 if (PF_ANEQ(pd2.src, 4640 &nk->addr[pd2.sidx], pd2.af)) 4641 pf_change_icmp(pd2.src, NULL, daddr, 4642 &nk->addr[pd2.sidx], 0, NULL, 4643 pd2.ip_sum, icmpsum, 4644 pd->ip_sum, 0, pd2.af); 4645 4646 if (PF_ANEQ(pd2.dst, 4647 &nk->addr[pd2.didx], pd2.af)) 4648 pf_change_icmp(pd2.src, NULL, 4649 NULL, /* XXX Inbound NAT? */ 4650 &nk->addr[pd2.didx], 0, NULL, 4651 pd2.ip_sum, icmpsum, 4652 pd->ip_sum, 0, pd2.af); 4653 4654 switch (pd2.af) { 4655 #ifdef INET 4656 case AF_INET: 4657 m_copyback(m, off, ICMP_MINLEN, 4658 pd->hdr.icmp); 4659 m_copyback(m, ipoff2, sizeof(h2), &h2); 4660 break; 4661 #endif /* INET */ 4662 #ifdef INET6 4663 case AF_INET6: 4664 m_copyback(m, off, 4665 sizeof(struct icmp6_hdr), 4666 pd->hdr.icmp6); 4667 m_copyback(m, ipoff2, sizeof(h2_6), 4668 &h2_6); 4669 break; 4670 #endif /* INET6 */ 4671 } 4672 } 4673 return (PF_PASS); 4674 break; 4675 } 4676 } 4677 } 4678 } 4679 4680 int 4681 pf_test_state_other(struct pf_state **state, int direction, struct pfi_kif *kif, 4682 struct mbuf *m, struct pf_pdesc *pd) 4683 { 4684 struct pf_state_peer *src, *dst; 4685 struct pf_state_key_cmp key; 4686 4687 key.af = pd->af; 4688 key.proto = pd->proto; 4689 if (direction == PF_IN) { 4690 PF_ACPY(&key.addr[0], pd->src, key.af); 4691 PF_ACPY(&key.addr[1], pd->dst, key.af); 4692 key.port[0] = key.port[1] = 0; 4693 } else { 4694 PF_ACPY(&key.addr[1], pd->src, key.af); 4695 PF_ACPY(&key.addr[0], pd->dst, key.af); 4696 key.port[1] = key.port[0] = 0; 4697 } 4698 4699 STATE_LOOKUP(kif, &key, direction, *state, m); 4700 4701 if (direction == (*state)->direction) { 4702 src = &(*state)->src; 4703 dst = &(*state)->dst; 4704 } else { 4705 src = &(*state)->dst; 4706 dst = &(*state)->src; 4707 } 4708 4709 /* update states */ 4710 if (src->state < PFOTHERS_SINGLE) 4711 src->state = PFOTHERS_SINGLE; 4712 if (dst->state == PFOTHERS_SINGLE) 4713 dst->state = PFOTHERS_MULTIPLE; 4714 4715 /* update expire time */ 4716 (*state)->expire = time_second; 4717 if (src->state == PFOTHERS_MULTIPLE && dst->state == PFOTHERS_MULTIPLE) 4718 (*state)->timeout = PFTM_OTHER_MULTIPLE; 4719 else 4720 (*state)->timeout = PFTM_OTHER_SINGLE; 4721 4722 /* translate source/destination address, if necessary */ 4723 if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) { 4724 struct pf_state_key *nk = (*state)->key[pd->didx]; 4725 4726 KASSERT(nk); 4727 KASSERT(pd); 4728 KASSERT(pd->src); 4729 KASSERT(pd->dst); 4730 switch (pd->af) { 4731 #ifdef INET 4732 case AF_INET: 4733 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], AF_INET)) 4734 pf_change_a(&pd->src->v4.s_addr, 4735 pd->ip_sum, 4736 nk->addr[pd->sidx].v4.s_addr, 4737 0); 4738 4739 4740 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], AF_INET)) 4741 pf_change_a(&pd->dst->v4.s_addr, 4742 pd->ip_sum, 4743 nk->addr[pd->didx].v4.s_addr, 4744 0); 4745 4746 break; 4747 #endif /* INET */ 4748 #ifdef INET6 4749 case AF_INET6: 4750 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], AF_INET)) 4751 PF_ACPY(pd->src, &nk->addr[pd->sidx], pd->af); 4752 4753 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], AF_INET)) 4754 PF_ACPY(pd->dst, &nk->addr[pd->didx], pd->af); 4755 #endif /* INET6 */ 4756 } 4757 } 4758 return (PF_PASS); 4759 } 4760 4761 /* 4762 * ipoff and off are measured from the start of the mbuf chain. 4763 * h must be at "ipoff" on the mbuf chain. 4764 */ 4765 void * 4766 pf_pull_hdr(struct mbuf *m, int off, void *p, int len, 4767 u_short *actionp, u_short *reasonp, sa_family_t af) 4768 { 4769 switch (af) { 4770 #ifdef INET 4771 case AF_INET: { 4772 struct ip *h = mtod(m, struct ip *); 4773 u_int16_t fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3; 4774 4775 if (fragoff) { 4776 if (fragoff >= len) 4777 ACTION_SET(actionp, PF_PASS); 4778 else { 4779 ACTION_SET(actionp, PF_DROP); 4780 REASON_SET(reasonp, PFRES_FRAG); 4781 } 4782 return (NULL); 4783 } 4784 if (m->m_pkthdr.len < off + len || 4785 ntohs(h->ip_len) < off + len) { 4786 ACTION_SET(actionp, PF_DROP); 4787 REASON_SET(reasonp, PFRES_SHORT); 4788 return (NULL); 4789 } 4790 break; 4791 } 4792 #endif /* INET */ 4793 #ifdef INET6 4794 case AF_INET6: { 4795 struct ip6_hdr *h = mtod(m, struct ip6_hdr *); 4796 4797 if (m->m_pkthdr.len < off + len || 4798 (ntohs(h->ip6_plen) + sizeof(struct ip6_hdr)) < 4799 (unsigned)(off + len)) { 4800 ACTION_SET(actionp, PF_DROP); 4801 REASON_SET(reasonp, PFRES_SHORT); 4802 return (NULL); 4803 } 4804 break; 4805 } 4806 #endif /* INET6 */ 4807 } 4808 m_copydata(m, off, len, p); 4809 return (p); 4810 } 4811 4812 int 4813 pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *kif) 4814 { 4815 struct sockaddr_in *dst; 4816 int ret = 1; 4817 int check_mpath; 4818 extern int ipmultipath; 4819 #ifdef INET6 4820 extern int ip6_multipath; 4821 struct sockaddr_in6 *dst6; 4822 struct route_in6 ro; 4823 #else 4824 struct route ro; 4825 #endif 4826 struct radix_node *rn; 4827 struct rtentry *rt; 4828 struct ifnet *ifp; 4829 4830 check_mpath = 0; 4831 bzero(&ro, sizeof(ro)); 4832 switch (af) { 4833 case AF_INET: 4834 dst = satosin(&ro.ro_dst); 4835 dst->sin_family = AF_INET; 4836 dst->sin_len = sizeof(*dst); 4837 dst->sin_addr = addr->v4; 4838 if (ipmultipath) 4839 check_mpath = 1; 4840 break; 4841 #ifdef INET6 4842 case AF_INET6: 4843 /* 4844 * Skip check for addresses with embedded interface scope, 4845 * as they would always match anyway. 4846 */ 4847 if (IN6_IS_SCOPE_EMBED(&addr->v6)) 4848 goto out; 4849 dst6 = (struct sockaddr_in6 *)&ro.ro_dst; 4850 dst6->sin6_family = AF_INET6; 4851 dst6->sin6_len = sizeof(*dst6); 4852 dst6->sin6_addr = addr->v6; 4853 if (ip6_multipath) 4854 check_mpath = 1; 4855 break; 4856 #endif /* INET6 */ 4857 default: 4858 return (0); 4859 } 4860 4861 /* Skip checks for ipsec interfaces */ 4862 if (kif != NULL && kif->pfik_ifp->if_type == IFT_ENC) 4863 goto out; 4864 4865 rtalloc_noclone((struct route *)&ro, NO_CLONING); 4866 4867 if (ro.ro_rt != NULL) { 4868 /* No interface given, this is a no-route check */ 4869 if (kif == NULL) 4870 goto out; 4871 4872 if (kif->pfik_ifp == NULL) { 4873 ret = 0; 4874 goto out; 4875 } 4876 4877 /* Perform uRPF check if passed input interface */ 4878 ret = 0; 4879 rn = (struct radix_node *)ro.ro_rt; 4880 do { 4881 rt = (struct rtentry *)rn; 4882 if (rt->rt_ifp->if_type == IFT_CARP) 4883 ifp = rt->rt_ifp->if_carpdev; 4884 else 4885 ifp = rt->rt_ifp; 4886 4887 if (kif->pfik_ifp == ifp) 4888 ret = 1; 4889 rn = rn_mpath_next(rn, 0); 4890 } while (check_mpath == 1 && rn != NULL && ret == 0); 4891 } else 4892 ret = 0; 4893 out: 4894 if (ro.ro_rt != NULL) 4895 RTFREE(ro.ro_rt); 4896 return (ret); 4897 } 4898 4899 int 4900 pf_rtlabel_match(struct pf_addr *addr, sa_family_t af, struct pf_addr_wrap *aw) 4901 { 4902 struct sockaddr_in *dst; 4903 #ifdef INET6 4904 struct sockaddr_in6 *dst6; 4905 struct route_in6 ro; 4906 #else 4907 struct route ro; 4908 #endif 4909 int ret = 0; 4910 4911 bzero(&ro, sizeof(ro)); 4912 switch (af) { 4913 case AF_INET: 4914 dst = satosin(&ro.ro_dst); 4915 dst->sin_family = AF_INET; 4916 dst->sin_len = sizeof(*dst); 4917 dst->sin_addr = addr->v4; 4918 break; 4919 #ifdef INET6 4920 case AF_INET6: 4921 dst6 = (struct sockaddr_in6 *)&ro.ro_dst; 4922 dst6->sin6_family = AF_INET6; 4923 dst6->sin6_len = sizeof(*dst6); 4924 dst6->sin6_addr = addr->v6; 4925 break; 4926 #endif /* INET6 */ 4927 default: 4928 return (0); 4929 } 4930 4931 rtalloc_noclone((struct route *)&ro, NO_CLONING); 4932 4933 if (ro.ro_rt != NULL) { 4934 if (ro.ro_rt->rt_labelid == aw->v.rtlabel) 4935 ret = 1; 4936 RTFREE(ro.ro_rt); 4937 } 4938 4939 return (ret); 4940 } 4941 4942 #ifdef INET 4943 void 4944 pf_route(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp, 4945 struct pf_state *s, struct pf_pdesc *pd) 4946 { 4947 struct mbuf *m0, *m1; 4948 struct route iproute; 4949 struct route *ro = NULL; 4950 struct sockaddr_in *dst; 4951 struct ip *ip; 4952 struct ifnet *ifp = NULL; 4953 struct pf_addr naddr; 4954 struct pf_src_node *sn = NULL; 4955 int error = 0; 4956 #ifdef IPSEC 4957 struct m_tag *mtag; 4958 #endif /* IPSEC */ 4959 4960 if (m == NULL || *m == NULL || r == NULL || 4961 (dir != PF_IN && dir != PF_OUT) || oifp == NULL) 4962 panic("pf_route: invalid parameters"); 4963 4964 if ((*m)->m_pkthdr.pf.routed++ > 3) { 4965 m0 = *m; 4966 *m = NULL; 4967 goto bad; 4968 } 4969 4970 if (r->rt == PF_DUPTO) { 4971 if ((m0 = m_copym2(*m, 0, M_COPYALL, M_NOWAIT)) == NULL) 4972 return; 4973 } else { 4974 if ((r->rt == PF_REPLYTO) == (r->direction == dir)) 4975 return; 4976 m0 = *m; 4977 } 4978 4979 if (m0->m_len < sizeof(struct ip)) { 4980 DPFPRINTF(PF_DEBUG_URGENT, 4981 ("pf_route: m0->m_len < sizeof(struct ip)\n")); 4982 goto bad; 4983 } 4984 4985 ip = mtod(m0, struct ip *); 4986 4987 ro = &iproute; 4988 bzero((caddr_t)ro, sizeof(*ro)); 4989 dst = satosin(&ro->ro_dst); 4990 dst->sin_family = AF_INET; 4991 dst->sin_len = sizeof(*dst); 4992 dst->sin_addr = ip->ip_dst; 4993 4994 if (r->rt == PF_FASTROUTE) { 4995 rtalloc(ro); 4996 if (ro->ro_rt == 0) { 4997 ipstat.ips_noroute++; 4998 goto bad; 4999 } 5000 5001 ifp = ro->ro_rt->rt_ifp; 5002 ro->ro_rt->rt_use++; 5003 5004 if (ro->ro_rt->rt_flags & RTF_GATEWAY) 5005 dst = satosin(ro->ro_rt->rt_gateway); 5006 } else { 5007 if (TAILQ_EMPTY(&r->rpool.list)) { 5008 DPFPRINTF(PF_DEBUG_URGENT, 5009 ("pf_route: TAILQ_EMPTY(&r->rpool.list)\n")); 5010 goto bad; 5011 } 5012 if (s == NULL) { 5013 pf_map_addr(AF_INET, r, (struct pf_addr *)&ip->ip_src, 5014 &naddr, NULL, &sn); 5015 if (!PF_AZERO(&naddr, AF_INET)) 5016 dst->sin_addr.s_addr = naddr.v4.s_addr; 5017 ifp = r->rpool.cur->kif ? 5018 r->rpool.cur->kif->pfik_ifp : NULL; 5019 } else { 5020 if (!PF_AZERO(&s->rt_addr, AF_INET)) 5021 dst->sin_addr.s_addr = 5022 s->rt_addr.v4.s_addr; 5023 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL; 5024 } 5025 } 5026 if (ifp == NULL) 5027 goto bad; 5028 5029 if (oifp != ifp) { 5030 if (pf_test(PF_OUT, ifp, &m0, NULL) != PF_PASS) 5031 goto bad; 5032 else if (m0 == NULL) 5033 goto done; 5034 if (m0->m_len < sizeof(struct ip)) { 5035 DPFPRINTF(PF_DEBUG_URGENT, 5036 ("pf_route: m0->m_len < sizeof(struct ip)\n")); 5037 goto bad; 5038 } 5039 ip = mtod(m0, struct ip *); 5040 } 5041 5042 /* Copied from ip_output. */ 5043 #ifdef IPSEC 5044 /* 5045 * If deferred crypto processing is needed, check that the 5046 * interface supports it. 5047 */ 5048 if ((mtag = m_tag_find(m0, PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED, NULL)) 5049 != NULL && (ifp->if_capabilities & IFCAP_IPSEC) == 0) { 5050 /* Notify IPsec to do its own crypto. */ 5051 ipsp_skipcrypto_unmark((struct tdb_ident *)(mtag + 1)); 5052 goto bad; 5053 } 5054 #endif /* IPSEC */ 5055 5056 /* Catch routing changes wrt. hardware checksumming for TCP or UDP. */ 5057 if (m0->m_pkthdr.csum_flags & M_TCPV4_CSUM_OUT) { 5058 if (!(ifp->if_capabilities & IFCAP_CSUM_TCPv4) || 5059 ifp->if_bridge != NULL) { 5060 in_delayed_cksum(m0); 5061 m0->m_pkthdr.csum_flags &= ~M_TCPV4_CSUM_OUT; /* Clr */ 5062 } 5063 } else if (m0->m_pkthdr.csum_flags & M_UDPV4_CSUM_OUT) { 5064 if (!(ifp->if_capabilities & IFCAP_CSUM_UDPv4) || 5065 ifp->if_bridge != NULL) { 5066 in_delayed_cksum(m0); 5067 m0->m_pkthdr.csum_flags &= ~M_UDPV4_CSUM_OUT; /* Clr */ 5068 } 5069 } 5070 5071 if (ntohs(ip->ip_len) <= ifp->if_mtu) { 5072 ip->ip_sum = 0; 5073 if ((ifp->if_capabilities & IFCAP_CSUM_IPv4) && 5074 ifp->if_bridge == NULL) { 5075 m0->m_pkthdr.csum_flags |= M_IPV4_CSUM_OUT; 5076 ipstat.ips_outhwcsum++; 5077 } else 5078 ip->ip_sum = in_cksum(m0, ip->ip_hl << 2); 5079 /* Update relevant hardware checksum stats for TCP/UDP */ 5080 if (m0->m_pkthdr.csum_flags & M_TCPV4_CSUM_OUT) 5081 tcpstat.tcps_outhwcsum++; 5082 else if (m0->m_pkthdr.csum_flags & M_UDPV4_CSUM_OUT) 5083 udpstat.udps_outhwcsum++; 5084 error = (*ifp->if_output)(ifp, m0, sintosa(dst), NULL); 5085 goto done; 5086 } 5087 5088 /* 5089 * Too large for interface; fragment if possible. 5090 * Must be able to put at least 8 bytes per fragment. 5091 */ 5092 if (ip->ip_off & htons(IP_DF)) { 5093 ipstat.ips_cantfrag++; 5094 if (r->rt != PF_DUPTO) { 5095 icmp_error(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 0, 5096 ifp->if_mtu); 5097 goto done; 5098 } else 5099 goto bad; 5100 } 5101 5102 m1 = m0; 5103 error = ip_fragment(m0, ifp, ifp->if_mtu); 5104 if (error) { 5105 m0 = NULL; 5106 goto bad; 5107 } 5108 5109 for (m0 = m1; m0; m0 = m1) { 5110 m1 = m0->m_nextpkt; 5111 m0->m_nextpkt = 0; 5112 if (error == 0) 5113 error = (*ifp->if_output)(ifp, m0, sintosa(dst), 5114 NULL); 5115 else 5116 m_freem(m0); 5117 } 5118 5119 if (error == 0) 5120 ipstat.ips_fragmented++; 5121 5122 done: 5123 if (r->rt != PF_DUPTO) 5124 *m = NULL; 5125 if (ro == &iproute && ro->ro_rt) 5126 RTFREE(ro->ro_rt); 5127 return; 5128 5129 bad: 5130 m_freem(m0); 5131 goto done; 5132 } 5133 #endif /* INET */ 5134 5135 #ifdef INET6 5136 void 5137 pf_route6(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp, 5138 struct pf_state *s, struct pf_pdesc *pd) 5139 { 5140 struct mbuf *m0; 5141 struct route_in6 ip6route; 5142 struct route_in6 *ro; 5143 struct sockaddr_in6 *dst; 5144 struct ip6_hdr *ip6; 5145 struct ifnet *ifp = NULL; 5146 struct pf_addr naddr; 5147 struct pf_src_node *sn = NULL; 5148 5149 if (m == NULL || *m == NULL || r == NULL || 5150 (dir != PF_IN && dir != PF_OUT) || oifp == NULL) 5151 panic("pf_route6: invalid parameters"); 5152 5153 if ((*m)->m_pkthdr.pf.routed++ > 3) { 5154 m0 = *m; 5155 *m = NULL; 5156 goto bad; 5157 } 5158 5159 if (r->rt == PF_DUPTO) { 5160 if ((m0 = m_copym2(*m, 0, M_COPYALL, M_NOWAIT)) == NULL) 5161 return; 5162 } else { 5163 if ((r->rt == PF_REPLYTO) == (r->direction == dir)) 5164 return; 5165 m0 = *m; 5166 } 5167 5168 if (m0->m_len < sizeof(struct ip6_hdr)) { 5169 DPFPRINTF(PF_DEBUG_URGENT, 5170 ("pf_route6: m0->m_len < sizeof(struct ip6_hdr)\n")); 5171 goto bad; 5172 } 5173 ip6 = mtod(m0, struct ip6_hdr *); 5174 5175 ro = &ip6route; 5176 bzero((caddr_t)ro, sizeof(*ro)); 5177 dst = (struct sockaddr_in6 *)&ro->ro_dst; 5178 dst->sin6_family = AF_INET6; 5179 dst->sin6_len = sizeof(*dst); 5180 dst->sin6_addr = ip6->ip6_dst; 5181 5182 /* Cheat. XXX why only in the v6 case??? */ 5183 if (r->rt == PF_FASTROUTE) { 5184 m0->m_pkthdr.pf.flags |= PF_TAG_GENERATED; 5185 ip6_output(m0, NULL, NULL, 0, NULL, NULL, NULL); 5186 return; 5187 } 5188 5189 if (TAILQ_EMPTY(&r->rpool.list)) { 5190 DPFPRINTF(PF_DEBUG_URGENT, 5191 ("pf_route6: TAILQ_EMPTY(&r->rpool.list)\n")); 5192 goto bad; 5193 } 5194 if (s == NULL) { 5195 pf_map_addr(AF_INET6, r, (struct pf_addr *)&ip6->ip6_src, 5196 &naddr, NULL, &sn); 5197 if (!PF_AZERO(&naddr, AF_INET6)) 5198 PF_ACPY((struct pf_addr *)&dst->sin6_addr, 5199 &naddr, AF_INET6); 5200 ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL; 5201 } else { 5202 if (!PF_AZERO(&s->rt_addr, AF_INET6)) 5203 PF_ACPY((struct pf_addr *)&dst->sin6_addr, 5204 &s->rt_addr, AF_INET6); 5205 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL; 5206 } 5207 if (ifp == NULL) 5208 goto bad; 5209 5210 if (oifp != ifp) { 5211 if (pf_test6(PF_OUT, ifp, &m0, NULL) != PF_PASS) 5212 goto bad; 5213 else if (m0 == NULL) 5214 goto done; 5215 if (m0->m_len < sizeof(struct ip6_hdr)) { 5216 DPFPRINTF(PF_DEBUG_URGENT, 5217 ("pf_route6: m0->m_len < sizeof(struct ip6_hdr)\n")); 5218 goto bad; 5219 } 5220 ip6 = mtod(m0, struct ip6_hdr *); 5221 } 5222 5223 /* 5224 * If the packet is too large for the outgoing interface, 5225 * send back an icmp6 error. 5226 */ 5227 if (IN6_IS_SCOPE_EMBED(&dst->sin6_addr)) 5228 dst->sin6_addr.s6_addr16[1] = htons(ifp->if_index); 5229 if ((u_long)m0->m_pkthdr.len <= ifp->if_mtu) { 5230 nd6_output(ifp, ifp, m0, dst, NULL); 5231 } else { 5232 in6_ifstat_inc(ifp, ifs6_in_toobig); 5233 if (r->rt != PF_DUPTO) 5234 icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu); 5235 else 5236 goto bad; 5237 } 5238 5239 done: 5240 if (r->rt != PF_DUPTO) 5241 *m = NULL; 5242 return; 5243 5244 bad: 5245 m_freem(m0); 5246 goto done; 5247 } 5248 #endif /* INET6 */ 5249 5250 5251 /* 5252 * check protocol (tcp/udp/icmp/icmp6) checksum and set mbuf flag 5253 * off is the offset where the protocol header starts 5254 * len is the total length of protocol header plus payload 5255 * returns 0 when the checksum is valid, otherwise returns 1. 5256 */ 5257 int 5258 pf_check_proto_cksum(struct mbuf *m, int off, int len, u_int8_t p, 5259 sa_family_t af) 5260 { 5261 u_int16_t flag_ok, flag_bad; 5262 u_int16_t sum; 5263 5264 switch (p) { 5265 case IPPROTO_TCP: 5266 flag_ok = M_TCP_CSUM_IN_OK; 5267 flag_bad = M_TCP_CSUM_IN_BAD; 5268 break; 5269 case IPPROTO_UDP: 5270 flag_ok = M_UDP_CSUM_IN_OK; 5271 flag_bad = M_UDP_CSUM_IN_BAD; 5272 break; 5273 case IPPROTO_ICMP: 5274 #ifdef INET6 5275 case IPPROTO_ICMPV6: 5276 #endif /* INET6 */ 5277 flag_ok = flag_bad = 0; 5278 break; 5279 default: 5280 return (1); 5281 } 5282 if (m->m_pkthdr.csum_flags & flag_ok) 5283 return (0); 5284 if (m->m_pkthdr.csum_flags & flag_bad) 5285 return (1); 5286 if (off < sizeof(struct ip) || len < sizeof(struct udphdr)) 5287 return (1); 5288 if (m->m_pkthdr.len < off + len) 5289 return (1); 5290 switch (af) { 5291 #ifdef INET 5292 case AF_INET: 5293 if (p == IPPROTO_ICMP) { 5294 if (m->m_len < off) 5295 return (1); 5296 m->m_data += off; 5297 m->m_len -= off; 5298 sum = in_cksum(m, len); 5299 m->m_data -= off; 5300 m->m_len += off; 5301 } else { 5302 if (m->m_len < sizeof(struct ip)) 5303 return (1); 5304 sum = in4_cksum(m, p, off, len); 5305 } 5306 break; 5307 #endif /* INET */ 5308 #ifdef INET6 5309 case AF_INET6: 5310 if (m->m_len < sizeof(struct ip6_hdr)) 5311 return (1); 5312 sum = in6_cksum(m, p, off, len); 5313 break; 5314 #endif /* INET6 */ 5315 default: 5316 return (1); 5317 } 5318 if (sum) { 5319 m->m_pkthdr.csum_flags |= flag_bad; 5320 switch (p) { 5321 case IPPROTO_TCP: 5322 tcpstat.tcps_rcvbadsum++; 5323 break; 5324 case IPPROTO_UDP: 5325 udpstat.udps_badsum++; 5326 break; 5327 case IPPROTO_ICMP: 5328 icmpstat.icps_checksum++; 5329 break; 5330 #ifdef INET6 5331 case IPPROTO_ICMPV6: 5332 icmp6stat.icp6s_checksum++; 5333 break; 5334 #endif /* INET6 */ 5335 } 5336 return (1); 5337 } 5338 m->m_pkthdr.csum_flags |= flag_ok; 5339 return (0); 5340 } 5341 5342 struct pf_divert * 5343 pf_find_divert(struct mbuf *m) 5344 { 5345 struct m_tag *mtag; 5346 5347 if ((mtag = m_tag_find(m, PACKET_TAG_PF_DIVERT, NULL)) == NULL) 5348 return (NULL); 5349 5350 return ((struct pf_divert *)(mtag + 1)); 5351 } 5352 5353 struct pf_divert * 5354 pf_get_divert(struct mbuf *m) 5355 { 5356 struct m_tag *mtag; 5357 5358 if ((mtag = m_tag_find(m, PACKET_TAG_PF_DIVERT, NULL)) == NULL) { 5359 mtag = m_tag_get(PACKET_TAG_PF_DIVERT, sizeof(struct pf_divert), 5360 M_NOWAIT); 5361 if (mtag == NULL) 5362 return (NULL); 5363 bzero(mtag + 1, sizeof(struct pf_divert)); 5364 m_tag_prepend(m, mtag); 5365 } 5366 5367 return ((struct pf_divert *)(mtag + 1)); 5368 } 5369 5370 #ifdef INET 5371 int 5372 pf_test(int dir, struct ifnet *ifp, struct mbuf **m0, 5373 struct ether_header *eh) 5374 { 5375 struct pfi_kif *kif; 5376 u_short action, reason = 0, log = 0; 5377 struct mbuf *m = *m0; 5378 struct ip *h; 5379 struct pf_rule *a = NULL, *r = &pf_default_rule, *tr, *nr; 5380 struct pf_state *s = NULL; 5381 struct pf_ruleset *ruleset = NULL; 5382 struct pf_pdesc pd; 5383 int off, dirndx, pqid = 0; 5384 5385 if (!pf_status.running) 5386 return (PF_PASS); 5387 5388 memset(&pd, 0, sizeof(pd)); 5389 if (ifp->if_type == IFT_CARP && ifp->if_carpdev) 5390 kif = (struct pfi_kif *)ifp->if_carpdev->if_pf_kif; 5391 else 5392 kif = (struct pfi_kif *)ifp->if_pf_kif; 5393 5394 if (kif == NULL) { 5395 DPFPRINTF(PF_DEBUG_URGENT, 5396 ("pf_test: kif == NULL, if_xname %s\n", ifp->if_xname)); 5397 return (PF_DROP); 5398 } 5399 if (kif->pfik_flags & PFI_IFLAG_SKIP) 5400 return (PF_PASS); 5401 5402 #ifdef DIAGNOSTIC 5403 if ((m->m_flags & M_PKTHDR) == 0) 5404 panic("non-M_PKTHDR is passed to pf_test"); 5405 #endif /* DIAGNOSTIC */ 5406 5407 if (m->m_pkthdr.len < (int)sizeof(*h)) { 5408 action = PF_DROP; 5409 REASON_SET(&reason, PFRES_SHORT); 5410 log = PF_LOG_FORCE; 5411 goto done; 5412 } 5413 5414 if (m->m_pkthdr.pf.flags & PF_TAG_GENERATED) 5415 return (PF_PASS); 5416 5417 /* packet reassembly here if 1) enabled 2) we deal with a fragment */ 5418 h = mtod(m, struct ip *); 5419 if (pf_status.reass && (h->ip_off & htons(IP_MF | IP_OFFMASK)) && 5420 pf_normalize_ip(m0, dir, kif, &reason, &pd) != PF_PASS) { 5421 action = PF_DROP; 5422 goto done; 5423 } 5424 m = *m0; /* pf_normalize messes with m0 */ 5425 h = mtod(m, struct ip *); 5426 5427 off = h->ip_hl << 2; 5428 if (off < (int)sizeof(*h)) { 5429 action = PF_DROP; 5430 REASON_SET(&reason, PFRES_SHORT); 5431 log = PF_LOG_FORCE; 5432 goto done; 5433 } 5434 5435 pd.src = (struct pf_addr *)&h->ip_src; 5436 pd.dst = (struct pf_addr *)&h->ip_dst; 5437 pd.sport = pd.dport = NULL; 5438 pd.ip_sum = &h->ip_sum; 5439 pd.proto_sum = NULL; 5440 pd.proto = h->ip_p; 5441 pd.dir = dir; 5442 pd.sidx = (dir == PF_IN) ? 0 : 1; 5443 pd.didx = (dir == PF_IN) ? 1 : 0; 5444 pd.af = AF_INET; 5445 pd.tos = h->ip_tos; 5446 pd.tot_len = ntohs(h->ip_len); 5447 pd.eh = eh; 5448 5449 /* handle fragments that didn't get reassembled by normalization */ 5450 if (h->ip_off & htons(IP_MF | IP_OFFMASK)) { 5451 action = pf_test_fragment(&r, dir, kif, m, h, 5452 &pd, &a, &ruleset); 5453 goto done; 5454 } 5455 5456 switch (h->ip_p) { 5457 5458 case IPPROTO_TCP: { 5459 struct tcphdr th; 5460 5461 pd.hdr.tcp = &th; 5462 if (!pf_pull_hdr(m, off, &th, sizeof(th), 5463 &action, &reason, AF_INET)) { 5464 if (action != PF_PASS) 5465 log = PF_LOG_FORCE; 5466 goto done; 5467 } 5468 pd.p_len = pd.tot_len - off - (th.th_off << 2); 5469 if ((th.th_flags & TH_ACK) && pd.p_len == 0) 5470 pqid = 1; 5471 action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd); 5472 if (action == PF_DROP) 5473 goto done; 5474 action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd, 5475 &reason); 5476 if (action == PF_PASS) { 5477 #if NPFSYNC > 0 5478 pfsync_update_state(s); 5479 #endif /* NPFSYNC */ 5480 r = s->rule.ptr; 5481 a = s->anchor.ptr; 5482 log = s->log; 5483 } else if (s == NULL) 5484 action = pf_test_rule(&r, &s, dir, kif, 5485 m, off, h, &pd, &a, &ruleset, &ipintrq); 5486 5487 if (s) { 5488 if (s->max_mss) 5489 pf_normalize_mss(m, off, &pd, s->max_mss); 5490 } else if (r->max_mss) 5491 pf_normalize_mss(m, off, &pd, r->max_mss); 5492 5493 break; 5494 } 5495 5496 case IPPROTO_UDP: { 5497 struct udphdr uh; 5498 5499 pd.hdr.udp = &uh; 5500 if (!pf_pull_hdr(m, off, &uh, sizeof(uh), 5501 &action, &reason, AF_INET)) { 5502 if (action != PF_PASS) 5503 log = PF_LOG_FORCE; 5504 goto done; 5505 } 5506 if (uh.uh_dport == 0 || 5507 ntohs(uh.uh_ulen) > m->m_pkthdr.len - off || 5508 ntohs(uh.uh_ulen) < sizeof(struct udphdr)) { 5509 action = PF_DROP; 5510 REASON_SET(&reason, PFRES_SHORT); 5511 goto done; 5512 } 5513 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd); 5514 if (action == PF_PASS) { 5515 #if NPFSYNC > 0 5516 pfsync_update_state(s); 5517 #endif /* NPFSYNC */ 5518 r = s->rule.ptr; 5519 a = s->anchor.ptr; 5520 log = s->log; 5521 } else if (s == NULL) 5522 action = pf_test_rule(&r, &s, dir, kif, 5523 m, off, h, &pd, &a, &ruleset, &ipintrq); 5524 break; 5525 } 5526 5527 case IPPROTO_ICMP: { 5528 struct icmp ih; 5529 5530 pd.hdr.icmp = &ih; 5531 if (!pf_pull_hdr(m, off, &ih, ICMP_MINLEN, 5532 &action, &reason, AF_INET)) { 5533 if (action != PF_PASS) 5534 log = PF_LOG_FORCE; 5535 goto done; 5536 } 5537 action = pf_test_state_icmp(&s, dir, kif, m, off, h, &pd, 5538 &reason); 5539 if (action == PF_PASS) { 5540 #if NPFSYNC > 0 5541 pfsync_update_state(s); 5542 #endif /* NPFSYNC */ 5543 r = s->rule.ptr; 5544 a = s->anchor.ptr; 5545 log = s->log; 5546 } else if (s == NULL) 5547 action = pf_test_rule(&r, &s, dir, kif, 5548 m, off, h, &pd, &a, &ruleset, &ipintrq); 5549 break; 5550 } 5551 5552 default: 5553 action = pf_test_state_other(&s, dir, kif, m, &pd); 5554 if (action == PF_PASS) { 5555 #if NPFSYNC > 0 5556 pfsync_update_state(s); 5557 #endif /* NPFSYNC */ 5558 r = s->rule.ptr; 5559 a = s->anchor.ptr; 5560 log = s->log; 5561 } else if (s == NULL) 5562 action = pf_test_rule(&r, &s, dir, kif, m, off, h, 5563 &pd, &a, &ruleset, &ipintrq); 5564 break; 5565 } 5566 5567 done: 5568 if (action == PF_PASS && h->ip_hl > 5 && 5569 !((s && s->state_flags & PFSTATE_ALLOWOPTS) || r->allow_opts)) { 5570 action = PF_DROP; 5571 REASON_SET(&reason, PFRES_IPOPTIONS); 5572 log = PF_LOG_FORCE; 5573 DPFPRINTF(PF_DEBUG_MISC, 5574 ("pf: dropping packet with ip options\n")); 5575 } 5576 5577 if (s) 5578 pf_scrub_ip(&m, s->state_flags, s->min_ttl, s->set_tos); 5579 else 5580 pf_scrub_ip(&m, r->scrub_flags, r->min_ttl, r->set_tos); 5581 5582 if (s && (s->tag || s->rtableid)) 5583 pf_tag_packet(m, s ? s->tag : 0, s->rtableid); 5584 5585 if (dir == PF_IN && s && s->key[PF_SK_STACK]) 5586 m->m_pkthdr.pf.statekey = s->key[PF_SK_STACK]; 5587 5588 #ifdef ALTQ 5589 if (action == PF_PASS && s && s->qid) { 5590 if (pqid || (pd.tos & IPTOS_LOWDELAY)) 5591 m->m_pkthdr.pf.qid = s->pqid; 5592 else 5593 m->m_pkthdr.pf.qid = s->qid; 5594 /* add hints for ecn */ 5595 m->m_pkthdr.pf.hdr = h; 5596 } 5597 #endif /* ALTQ */ 5598 5599 /* 5600 * connections redirected to loopback should not match sockets 5601 * bound specifically to loopback due to security implications, 5602 * see tcp_input() and in_pcblookup_listen(). 5603 */ 5604 if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP || 5605 pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL && 5606 (s->nat_rule.ptr->action == PF_RDR || 5607 s->nat_rule.ptr->action == PF_BINAT) && 5608 (ntohl(pd.dst->v4.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) 5609 m->m_pkthdr.pf.flags |= PF_TAG_TRANSLATE_LOCALHOST; 5610 5611 if (dir == PF_IN && action == PF_PASS && r->divert.port) { 5612 struct pf_divert *divert; 5613 5614 if ((divert = pf_get_divert(m))) { 5615 m->m_pkthdr.pf.flags |= PF_TAG_DIVERTED; 5616 divert->port = r->divert.port; 5617 divert->addr.ipv4 = r->divert.addr.v4; 5618 } 5619 } 5620 5621 if (log) { 5622 struct pf_rule *lr; 5623 struct pf_rule_item *ri; 5624 5625 if (s != NULL && s->nat_rule.ptr != NULL && 5626 s->nat_rule.ptr->log & PF_LOG_ALL) 5627 lr = s->nat_rule.ptr; 5628 else 5629 lr = r; 5630 if (log == PF_LOG_FORCE || lr->log & PF_LOG_ALL) 5631 PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, lr, a, 5632 ruleset, &pd); 5633 SLIST_FOREACH(ri, &s->match_rules, entry) 5634 if (ri->r->log & PF_LOG_ALL) 5635 PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, 5636 ri->r, a, ruleset, &pd); 5637 } 5638 5639 kif->pfik_bytes[0][dir == PF_OUT][action != PF_PASS] += pd.tot_len; 5640 kif->pfik_packets[0][dir == PF_OUT][action != PF_PASS]++; 5641 5642 if (action == PF_PASS || r->action == PF_DROP) { 5643 dirndx = (dir == PF_OUT); 5644 r->packets[dirndx]++; 5645 r->bytes[dirndx] += pd.tot_len; 5646 if (a != NULL) { 5647 a->packets[dirndx]++; 5648 a->bytes[dirndx] += pd.tot_len; 5649 } 5650 if (s != NULL) { 5651 struct pf_rule_item *ri; 5652 5653 if (s->nat_rule.ptr != NULL) { 5654 s->nat_rule.ptr->packets[dirndx]++; 5655 s->nat_rule.ptr->bytes[dirndx] += pd.tot_len; 5656 } 5657 if (s->src_node != NULL) { 5658 s->src_node->packets[dirndx]++; 5659 s->src_node->bytes[dirndx] += pd.tot_len; 5660 } 5661 if (s->nat_src_node != NULL) { 5662 s->nat_src_node->packets[dirndx]++; 5663 s->nat_src_node->bytes[dirndx] += pd.tot_len; 5664 } 5665 dirndx = (dir == s->direction) ? 0 : 1; 5666 s->packets[dirndx]++; 5667 s->bytes[dirndx] += pd.tot_len; 5668 SLIST_FOREACH(ri, &s->match_rules, entry) { 5669 ri->r->packets[dirndx]++; 5670 ri->r->bytes[dirndx] += pd.tot_len; 5671 } 5672 } 5673 tr = r; 5674 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule; 5675 if (nr != NULL && r == &pf_default_rule) 5676 tr = nr; 5677 if (tr->src.addr.type == PF_ADDR_TABLE) 5678 pfr_update_stats(tr->src.addr.p.tbl, 5679 (s == NULL) ? pd.src : 5680 &s->key[(s->direction == PF_IN)]-> 5681 addr[(s->direction == PF_OUT)], 5682 pd.af, pd.tot_len, dir == PF_OUT, 5683 r->action == PF_PASS, tr->src.neg); 5684 if (tr->dst.addr.type == PF_ADDR_TABLE) 5685 pfr_update_stats(tr->dst.addr.p.tbl, 5686 (s == NULL) ? pd.dst : 5687 &s->key[(s->direction == PF_IN)]-> 5688 addr[(s->direction == PF_IN)], 5689 pd.af, pd.tot_len, dir == PF_OUT, 5690 r->action == PF_PASS, tr->dst.neg); 5691 } 5692 5693 switch (action) { 5694 case PF_SYNPROXY_DROP: 5695 m_freem(*m0); 5696 case PF_DEFER: 5697 *m0 = NULL; 5698 action = PF_PASS; 5699 break; 5700 default: 5701 /* pf_route can free the mbuf causing *m0 to become NULL */ 5702 if (r->rt) 5703 pf_route(m0, r, dir, kif->pfik_ifp, s, &pd); 5704 break; 5705 } 5706 5707 return (action); 5708 } 5709 #endif /* INET */ 5710 5711 #ifdef INET6 5712 int 5713 pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0, 5714 struct ether_header *eh) 5715 { 5716 struct pfi_kif *kif; 5717 u_short action, reason = 0, log = 0; 5718 struct mbuf *m = *m0, *n = NULL; 5719 struct ip6_hdr *h; 5720 struct pf_rule *a = NULL, *r = &pf_default_rule, *tr, *nr; 5721 struct pf_state *s = NULL; 5722 struct pf_ruleset *ruleset = NULL; 5723 struct pf_pdesc pd; 5724 int off, terminal = 0, dirndx, rh_cnt = 0; 5725 5726 if (!pf_status.running) 5727 return (PF_PASS); 5728 5729 memset(&pd, 0, sizeof(pd)); 5730 if (ifp->if_type == IFT_CARP && ifp->if_carpdev) 5731 kif = (struct pfi_kif *)ifp->if_carpdev->if_pf_kif; 5732 else 5733 kif = (struct pfi_kif *)ifp->if_pf_kif; 5734 5735 if (kif == NULL) { 5736 DPFPRINTF(PF_DEBUG_URGENT, 5737 ("pf_test6: kif == NULL, if_xname %s\n", ifp->if_xname)); 5738 return (PF_DROP); 5739 } 5740 if (kif->pfik_flags & PFI_IFLAG_SKIP) 5741 return (PF_PASS); 5742 5743 #ifdef DIAGNOSTIC 5744 if ((m->m_flags & M_PKTHDR) == 0) 5745 panic("non-M_PKTHDR is passed to pf_test6"); 5746 #endif /* DIAGNOSTIC */ 5747 5748 if (m->m_pkthdr.len < (int)sizeof(*h)) { 5749 action = PF_DROP; 5750 REASON_SET(&reason, PFRES_SHORT); 5751 log = 1; 5752 goto done; 5753 } 5754 5755 if (m->m_pkthdr.pf.flags & PF_TAG_GENERATED) 5756 return (PF_PASS); 5757 5758 /* packet reassembly */ 5759 if (pf_normalize_ip6(m0, dir, kif, &reason, &pd) != PF_PASS) { 5760 action = PF_DROP; 5761 goto done; 5762 } 5763 m = *m0; /* pf_normalize messes with m0 */ 5764 h = mtod(m, struct ip6_hdr *); 5765 5766 #if 1 5767 /* 5768 * we do not support jumbogram yet. if we keep going, zero ip6_plen 5769 * will do something bad, so drop the packet for now. 5770 */ 5771 if (htons(h->ip6_plen) == 0) { 5772 action = PF_DROP; 5773 REASON_SET(&reason, PFRES_NORM); /*XXX*/ 5774 goto done; 5775 } 5776 #endif 5777 5778 pd.src = (struct pf_addr *)&h->ip6_src; 5779 pd.dst = (struct pf_addr *)&h->ip6_dst; 5780 pd.sport = pd.dport = NULL; 5781 pd.ip_sum = NULL; 5782 pd.proto_sum = NULL; 5783 pd.dir = dir; 5784 pd.sidx = (dir == PF_IN) ? 0 : 1; 5785 pd.didx = (dir == PF_IN) ? 1 : 0; 5786 pd.af = AF_INET6; 5787 pd.tos = 0; 5788 pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr); 5789 pd.eh = eh; 5790 5791 off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr); 5792 pd.proto = h->ip6_nxt; 5793 do { 5794 switch (pd.proto) { 5795 case IPPROTO_FRAGMENT: 5796 action = pf_test_fragment(&r, dir, kif, m, h, 5797 &pd, &a, &ruleset); 5798 if (action == PF_DROP) 5799 REASON_SET(&reason, PFRES_FRAG); 5800 goto done; 5801 case IPPROTO_ROUTING: { 5802 struct ip6_rthdr rthdr; 5803 5804 if (rh_cnt++) { 5805 DPFPRINTF(PF_DEBUG_MISC, 5806 ("pf: IPv6 more than one rthdr\n")); 5807 action = PF_DROP; 5808 REASON_SET(&reason, PFRES_IPOPTIONS); 5809 log = 1; 5810 goto done; 5811 } 5812 if (!pf_pull_hdr(m, off, &rthdr, sizeof(rthdr), NULL, 5813 &reason, pd.af)) { 5814 DPFPRINTF(PF_DEBUG_MISC, 5815 ("pf: IPv6 short rthdr\n")); 5816 action = PF_DROP; 5817 REASON_SET(&reason, PFRES_SHORT); 5818 log = 1; 5819 goto done; 5820 } 5821 if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) { 5822 DPFPRINTF(PF_DEBUG_MISC, 5823 ("pf: IPv6 rthdr0\n")); 5824 action = PF_DROP; 5825 REASON_SET(&reason, PFRES_IPOPTIONS); 5826 log = 1; 5827 goto done; 5828 } 5829 /* FALLTHROUGH */ 5830 } 5831 case IPPROTO_AH: 5832 case IPPROTO_HOPOPTS: 5833 case IPPROTO_DSTOPTS: { 5834 /* get next header and header length */ 5835 struct ip6_ext opt6; 5836 5837 if (!pf_pull_hdr(m, off, &opt6, sizeof(opt6), 5838 NULL, &reason, pd.af)) { 5839 DPFPRINTF(PF_DEBUG_MISC, 5840 ("pf: IPv6 short opt\n")); 5841 action = PF_DROP; 5842 log = 1; 5843 goto done; 5844 } 5845 if (pd.proto == IPPROTO_AH) 5846 off += (opt6.ip6e_len + 2) * 4; 5847 else 5848 off += (opt6.ip6e_len + 1) * 8; 5849 pd.proto = opt6.ip6e_nxt; 5850 /* goto the next header */ 5851 break; 5852 } 5853 default: 5854 terminal++; 5855 break; 5856 } 5857 } while (!terminal); 5858 5859 /* if there's no routing header, use unmodified mbuf for checksumming */ 5860 if (!n) 5861 n = m; 5862 5863 switch (pd.proto) { 5864 5865 case IPPROTO_TCP: { 5866 struct tcphdr th; 5867 5868 pd.hdr.tcp = &th; 5869 if (!pf_pull_hdr(m, off, &th, sizeof(th), 5870 &action, &reason, AF_INET6)) { 5871 log = action != PF_PASS; 5872 goto done; 5873 } 5874 pd.p_len = pd.tot_len - off - (th.th_off << 2); 5875 action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd); 5876 if (action == PF_DROP) 5877 goto done; 5878 action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd, 5879 &reason); 5880 if (action == PF_PASS) { 5881 #if NPFSYNC > 0 5882 pfsync_update_state(s); 5883 #endif /* NPFSYNC */ 5884 r = s->rule.ptr; 5885 a = s->anchor.ptr; 5886 log = s->log; 5887 } else if (s == NULL) 5888 action = pf_test_rule(&r, &s, dir, kif, 5889 m, off, h, &pd, &a, &ruleset, &ip6intrq); 5890 break; 5891 } 5892 5893 case IPPROTO_UDP: { 5894 struct udphdr uh; 5895 5896 pd.hdr.udp = &uh; 5897 if (!pf_pull_hdr(m, off, &uh, sizeof(uh), 5898 &action, &reason, AF_INET6)) { 5899 log = action != PF_PASS; 5900 goto done; 5901 } 5902 if (uh.uh_dport == 0 || 5903 ntohs(uh.uh_ulen) > m->m_pkthdr.len - off || 5904 ntohs(uh.uh_ulen) < sizeof(struct udphdr)) { 5905 action = PF_DROP; 5906 REASON_SET(&reason, PFRES_SHORT); 5907 goto done; 5908 } 5909 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd); 5910 if (action == PF_PASS) { 5911 #if NPFSYNC > 0 5912 pfsync_update_state(s); 5913 #endif /* NPFSYNC */ 5914 r = s->rule.ptr; 5915 a = s->anchor.ptr; 5916 log = s->log; 5917 } else if (s == NULL) 5918 action = pf_test_rule(&r, &s, dir, kif, 5919 m, off, h, &pd, &a, &ruleset, &ip6intrq); 5920 break; 5921 } 5922 5923 case IPPROTO_ICMPV6: { 5924 union { 5925 struct icmp6_hdr icmp6; 5926 struct mld_hdr mld; 5927 struct nd_neighbor_solicit nd; 5928 } ih; 5929 size_t icmp_hlen = sizeof(struct icmp6_hdr); 5930 5931 pd.hdr.icmp6 = &ih.icmp6; 5932 if (!pf_pull_hdr(m, off, &ih, icmp_hlen, 5933 &action, &reason, AF_INET6)) { 5934 log = action != PF_PASS; 5935 goto done; 5936 } 5937 /* ICMP headers we look further into to match state */ 5938 switch (ih.icmp6.icmp6_type) { 5939 case MLD_LISTENER_QUERY: 5940 case MLD_LISTENER_REPORT: 5941 icmp_hlen = sizeof(struct mld_hdr); 5942 break; 5943 case ND_NEIGHBOR_SOLICIT: 5944 case ND_NEIGHBOR_ADVERT: 5945 icmp_hlen = sizeof(struct nd_neighbor_solicit); 5946 break; 5947 } 5948 if (icmp_hlen > sizeof(struct icmp6_hdr) && 5949 !pf_pull_hdr(m, off, &ih, icmp_hlen, 5950 &action, &reason, AF_INET6)) { 5951 log = action != PF_PASS; 5952 goto done; 5953 } 5954 action = pf_test_state_icmp(&s, dir, kif, 5955 m, off, h, &pd, &reason); 5956 if (action == PF_PASS) { 5957 #if NPFSYNC > 0 5958 pfsync_update_state(s); 5959 #endif /* NPFSYNC */ 5960 r = s->rule.ptr; 5961 a = s->anchor.ptr; 5962 log = s->log; 5963 } else if (s == NULL) 5964 action = pf_test_rule(&r, &s, dir, kif, 5965 m, off, h, &pd, &a, &ruleset, &ip6intrq); 5966 break; 5967 } 5968 5969 default: 5970 action = pf_test_state_other(&s, dir, kif, m, &pd); 5971 if (action == PF_PASS) { 5972 #if NPFSYNC > 0 5973 pfsync_update_state(s); 5974 #endif /* NPFSYNC */ 5975 r = s->rule.ptr; 5976 a = s->anchor.ptr; 5977 log = s->log; 5978 } else if (s == NULL) 5979 action = pf_test_rule(&r, &s, dir, kif, m, off, h, 5980 &pd, &a, &ruleset, &ip6intrq); 5981 break; 5982 } 5983 5984 done: 5985 if (n != m) { 5986 m_freem(n); 5987 n = NULL; 5988 } 5989 5990 /* handle dangerous IPv6 extension headers. */ 5991 if (action == PF_PASS && rh_cnt && 5992 !((s && s->state_flags & PFSTATE_ALLOWOPTS) || r->allow_opts)) { 5993 action = PF_DROP; 5994 REASON_SET(&reason, PFRES_IPOPTIONS); 5995 log = 1; 5996 DPFPRINTF(PF_DEBUG_MISC, 5997 ("pf: dropping packet with dangerous v6 headers\n")); 5998 } 5999 6000 if (s) 6001 pf_scrub_ip6(&m, s->min_ttl); 6002 else 6003 pf_scrub_ip6(&m, r->min_ttl); 6004 6005 if (s && (s->tag || s->rtableid)) 6006 pf_tag_packet(m, s ? s->tag : 0, s->rtableid); 6007 6008 if (dir == PF_IN && s && s->key[PF_SK_STACK]) 6009 m->m_pkthdr.pf.statekey = s->key[PF_SK_STACK]; 6010 6011 #ifdef ALTQ 6012 if (action == PF_PASS && s && s->qid) { 6013 if (pd.tos & IPTOS_LOWDELAY) 6014 m->m_pkthdr.pf.qid = s->pqid; 6015 else 6016 m->m_pkthdr.pf.qid = s->qid; 6017 /* add hints for ecn */ 6018 m->m_pkthdr.pf.hdr = h; 6019 } 6020 #endif /* ALTQ */ 6021 6022 if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP || 6023 pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL && 6024 (s->nat_rule.ptr->action == PF_RDR || 6025 s->nat_rule.ptr->action == PF_BINAT) && 6026 IN6_IS_ADDR_LOOPBACK(&pd.dst->v6)) 6027 m->m_pkthdr.pf.flags |= PF_TAG_TRANSLATE_LOCALHOST; 6028 6029 if (dir == PF_IN && action == PF_PASS && r->divert.port) { 6030 struct pf_divert *divert; 6031 6032 if ((divert = pf_get_divert(m))) { 6033 m->m_pkthdr.pf.flags |= PF_TAG_DIVERTED; 6034 divert->port = r->divert.port; 6035 divert->addr.ipv6 = r->divert.addr.v6; 6036 } 6037 } 6038 6039 if (log) { 6040 struct pf_rule *lr; 6041 6042 if (s != NULL && s->nat_rule.ptr != NULL && 6043 s->nat_rule.ptr->log & PF_LOG_ALL) 6044 lr = s->nat_rule.ptr; 6045 else 6046 lr = r; 6047 PFLOG_PACKET(kif, h, m, AF_INET6, dir, reason, lr, a, ruleset, 6048 &pd); 6049 } 6050 6051 kif->pfik_bytes[1][dir == PF_OUT][action != PF_PASS] += pd.tot_len; 6052 kif->pfik_packets[1][dir == PF_OUT][action != PF_PASS]++; 6053 6054 if (action == PF_PASS || r->action == PF_DROP) { 6055 dirndx = (dir == PF_OUT); 6056 r->packets[dirndx]++; 6057 r->bytes[dirndx] += pd.tot_len; 6058 if (a != NULL) { 6059 a->packets[dirndx]++; 6060 a->bytes[dirndx] += pd.tot_len; 6061 } 6062 if (s != NULL) { 6063 if (s->nat_rule.ptr != NULL) { 6064 s->nat_rule.ptr->packets[dirndx]++; 6065 s->nat_rule.ptr->bytes[dirndx] += pd.tot_len; 6066 } 6067 if (s->src_node != NULL) { 6068 s->src_node->packets[dirndx]++; 6069 s->src_node->bytes[dirndx] += pd.tot_len; 6070 } 6071 if (s->nat_src_node != NULL) { 6072 s->nat_src_node->packets[dirndx]++; 6073 s->nat_src_node->bytes[dirndx] += pd.tot_len; 6074 } 6075 dirndx = (dir == s->direction) ? 0 : 1; 6076 s->packets[dirndx]++; 6077 s->bytes[dirndx] += pd.tot_len; 6078 } 6079 tr = r; 6080 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule; 6081 if (nr != NULL && r == &pf_default_rule) 6082 tr = nr; 6083 if (tr->src.addr.type == PF_ADDR_TABLE) 6084 pfr_update_stats(tr->src.addr.p.tbl, 6085 (s == NULL) ? pd.src : 6086 &s->key[(s->direction == PF_IN)]->addr[0], 6087 pd.af, pd.tot_len, dir == PF_OUT, 6088 r->action == PF_PASS, tr->src.neg); 6089 if (tr->dst.addr.type == PF_ADDR_TABLE) 6090 pfr_update_stats(tr->dst.addr.p.tbl, 6091 (s == NULL) ? pd.dst : 6092 &s->key[(s->direction == PF_IN)]->addr[1], 6093 pd.af, pd.tot_len, dir == PF_OUT, 6094 r->action == PF_PASS, tr->dst.neg); 6095 } 6096 6097 switch (action) { 6098 case PF_SYNPROXY_DROP: 6099 m_freem(*m0); 6100 case PF_DEFER: 6101 *m0 = NULL; 6102 action = PF_PASS; 6103 break; 6104 default: 6105 /* pf_route6 can free the mbuf causing *m0 to become NULL */ 6106 if (r->rt) 6107 pf_route6(m0, r, dir, kif->pfik_ifp, s, &pd); 6108 break; 6109 } 6110 6111 return (action); 6112 } 6113 #endif /* INET6 */ 6114 6115 int 6116 pf_check_congestion(struct ifqueue *ifq) 6117 { 6118 if (ifq->ifq_congestion) 6119 return (1); 6120 else 6121 return (0); 6122 } 6123 6124 /* 6125 * must be called whenever any addressing information such as 6126 * address, port, protocol has changed 6127 */ 6128 void 6129 pf_pkt_addr_changed(struct mbuf *m) 6130 { 6131 m->m_pkthdr.pf.statekey = NULL; 6132 } 6133