1 /* $OpenBSD: pf.c,v 1.882 2014/07/13 16:58:43 bluhm Exp $ */ 2 3 /* 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2002 - 2013 Henning Brauer <henning@openbsd.org> 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * - Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * - Redistributions in binary form must reproduce the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 * 32 * Effort sponsored in part by the Defense Advanced Research Projects 33 * Agency (DARPA) and Air Force Research Laboratory, Air Force 34 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 35 * 36 */ 37 38 #include "bpfilter.h" 39 #include "pflog.h" 40 #include "pfsync.h" 41 #include "pflow.h" 42 43 #include <sys/param.h> 44 #include <sys/systm.h> 45 #include <sys/mbuf.h> 46 #include <sys/filio.h> 47 #include <sys/socket.h> 48 #include <sys/socketvar.h> 49 #include <sys/kernel.h> 50 #include <sys/time.h> 51 #include <sys/pool.h> 52 #include <sys/proc.h> 53 #include <sys/rwlock.h> 54 #include <sys/syslog.h> 55 56 #include <crypto/md5.h> 57 58 #include <net/if.h> 59 #include <net/if_types.h> 60 #include <net/bpf.h> 61 #include <net/route.h> 62 #include <net/radix_mpath.h> 63 64 #include <netinet/in.h> 65 #include <netinet/in_systm.h> 66 #include <netinet/ip.h> 67 #include <netinet/ip_var.h> 68 #include <netinet/tcp.h> 69 #include <netinet/tcp_seq.h> 70 #include <netinet/udp.h> 71 #include <netinet/ip_icmp.h> 72 #include <netinet/in_pcb.h> 73 #include <netinet/tcp_timer.h> 74 #include <netinet/tcp_var.h> 75 #include <netinet/udp_var.h> 76 #include <netinet/icmp_var.h> 77 #include <netinet/if_ether.h> 78 #include <netinet/ip_divert.h> 79 80 #include <dev/rndvar.h> 81 #include <net/pfvar.h> 82 #include <net/if_pflog.h> 83 #include <net/if_pflow.h> 84 85 #if NPFSYNC > 0 86 #include <net/if_pfsync.h> 87 #endif /* NPFSYNC > 0 */ 88 89 #ifdef INET6 90 #include <netinet6/in6_var.h> 91 #include <netinet/ip6.h> 92 #include <netinet6/ip6_var.h> 93 #include <netinet/icmp6.h> 94 #include <netinet6/nd6.h> 95 #include <netinet6/ip6_divert.h> 96 #endif /* INET6 */ 97 98 99 /* 100 * Global variables 101 */ 102 struct pf_state_tree pf_statetbl; 103 struct pf_queuehead pf_queues[2]; 104 struct pf_queuehead *pf_queues_active; 105 struct pf_queuehead *pf_queues_inactive; 106 107 struct pf_status pf_status; 108 109 MD5_CTX pf_tcp_secret_ctx; 110 u_char pf_tcp_secret[16]; 111 int pf_tcp_secret_init; 112 int pf_tcp_iss_off; 113 114 struct pf_anchor_stackframe { 115 struct pf_ruleset *rs; 116 struct pf_rule *r; 117 struct pf_anchor_node *parent; 118 struct pf_anchor *child; 119 } pf_anchor_stack[64]; 120 121 /* 122 * Cannot fold into pf_pdesc directly, unknown storage size outside pf.c. 123 * Keep in sync with union pf_headers in pflog_bpfcopy() in if_pflog.c. 124 */ 125 union pf_headers { 126 struct tcphdr tcp; 127 struct udphdr udp; 128 struct icmp icmp; 129 #ifdef INET6 130 struct icmp6_hdr icmp6; 131 struct mld_hdr mld; 132 struct nd_neighbor_solicit nd_ns; 133 #endif /* INET6 */ 134 }; 135 136 137 struct pool pf_src_tree_pl, pf_rule_pl, pf_queue_pl; 138 struct pool pf_state_pl, pf_state_key_pl, pf_state_item_pl; 139 struct pool pf_rule_item_pl, pf_sn_item_pl; 140 struct pool hfsc_class_pl, hfsc_classq_pl, hfsc_internal_sc_pl; 141 142 void pf_init_threshold(struct pf_threshold *, u_int32_t, 143 u_int32_t); 144 void pf_add_threshold(struct pf_threshold *); 145 int pf_check_threshold(struct pf_threshold *); 146 147 void pf_change_ap(struct pf_pdesc *, struct pf_addr *, 148 u_int16_t *, struct pf_addr *, u_int16_t, 149 sa_family_t); 150 int pf_modulate_sack(struct pf_pdesc *, 151 struct pf_state_peer *); 152 void pf_change_a6(struct pf_pdesc *, struct pf_addr *a, 153 struct pf_addr *an); 154 int pf_icmp_mapping(struct pf_pdesc *, u_int8_t, int *, 155 int *, u_int16_t *, u_int16_t *); 156 void pf_change_icmp(struct pf_pdesc *, struct pf_addr *, 157 u_int16_t *, struct pf_addr *, struct pf_addr *, 158 u_int16_t, sa_family_t); 159 int pf_change_icmp_af(struct mbuf *, int, 160 struct pf_pdesc *, struct pf_pdesc *, 161 struct pf_addr *, struct pf_addr *, sa_family_t, 162 sa_family_t); 163 int pf_translate_icmp_af(int, void *); 164 void pf_send_tcp(const struct pf_rule *, sa_family_t, 165 const struct pf_addr *, const struct pf_addr *, 166 u_int16_t, u_int16_t, u_int32_t, u_int32_t, 167 u_int8_t, u_int16_t, u_int16_t, u_int8_t, int, 168 u_int16_t, u_int, struct ether_header *, 169 struct ifnet *); 170 void pf_send_icmp(struct mbuf *, u_int8_t, u_int8_t, 171 sa_family_t, struct pf_rule *, u_int); 172 void pf_detach_state(struct pf_state *); 173 void pf_state_key_detach(struct pf_state *, int); 174 u_int32_t pf_tcp_iss(struct pf_pdesc *); 175 void pf_rule_to_actions(struct pf_rule *, 176 struct pf_rule_actions *); 177 int pf_test_rule(struct pf_pdesc *, struct pf_rule **, 178 struct pf_state **, struct pf_rule **, 179 struct pf_ruleset **); 180 static __inline int pf_create_state(struct pf_pdesc *, struct pf_rule *, 181 struct pf_rule *, struct pf_rule *, 182 struct pf_state_key **, struct pf_state_key **, 183 int *, struct pf_state **, int, 184 struct pf_rule_slist *, struct pf_rule_actions *, 185 struct pf_src_node *[]); 186 static __inline int pf_state_key_addr_setup(struct pf_pdesc *, void *, 187 int, struct pf_addr *, int, struct pf_addr *, 188 int, int); 189 int pf_state_key_setup(struct pf_pdesc *, struct 190 pf_state_key **, struct pf_state_key **, int); 191 int pf_tcp_track_full(struct pf_pdesc *, 192 struct pf_state_peer *, struct pf_state_peer *, 193 struct pf_state **, u_short *, int *); 194 int pf_tcp_track_sloppy(struct pf_pdesc *, 195 struct pf_state_peer *, struct pf_state_peer *, 196 struct pf_state **, u_short *); 197 static __inline int pf_synproxy(struct pf_pdesc *, struct pf_state **, 198 u_short *); 199 int pf_test_state(struct pf_pdesc *, struct pf_state **, 200 u_short *); 201 int pf_icmp_state_lookup(struct pf_pdesc *, 202 struct pf_state_key_cmp *, struct pf_state **, 203 u_int16_t, u_int16_t, int, int *, int, int); 204 int pf_test_state_icmp(struct pf_pdesc *, 205 struct pf_state **, u_short *); 206 u_int8_t pf_get_wscale(struct pf_pdesc *); 207 u_int16_t pf_get_mss(struct pf_pdesc *); 208 u_int16_t pf_calc_mss(struct pf_addr *, sa_family_t, int, 209 u_int16_t); 210 void pf_set_rt_ifp(struct pf_state *, 211 struct pf_addr *); 212 struct pf_divert *pf_get_divert(struct mbuf *); 213 int pf_walk_option6(struct pf_pdesc *, struct ip6_hdr *, 214 int, int, u_short *); 215 int pf_walk_header6(struct pf_pdesc *, struct ip6_hdr *, 216 u_short *); 217 void pf_print_state_parts(struct pf_state *, 218 struct pf_state_key *, struct pf_state_key *); 219 int pf_addr_wrap_neq(struct pf_addr_wrap *, 220 struct pf_addr_wrap *); 221 int pf_compare_state_keys(struct pf_state_key *, 222 struct pf_state_key *, struct pfi_kif *, u_int); 223 struct pf_state *pf_find_state(struct pfi_kif *, 224 struct pf_state_key_cmp *, u_int, struct mbuf *); 225 int pf_src_connlimit(struct pf_state **); 226 int pf_check_congestion(struct ifqueue *); 227 int pf_match_rcvif(struct mbuf *, struct pf_rule *); 228 void pf_step_into_anchor(int *, struct pf_ruleset **, 229 struct pf_rule **, struct pf_rule **); 230 int pf_step_out_of_anchor(int *, struct pf_ruleset **, 231 struct pf_rule **, struct pf_rule **, 232 int *); 233 void pf_counters_inc(int, struct pf_pdesc *, 234 struct pf_state *, struct pf_rule *, 235 struct pf_rule *); 236 237 extern struct pool pfr_ktable_pl; 238 extern struct pool pfr_kentry_pl; 239 240 struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX] = { 241 { &pf_state_pl, PFSTATE_HIWAT, PFSTATE_HIWAT }, 242 { &pf_src_tree_pl, PFSNODE_HIWAT, PFSNODE_HIWAT }, 243 { &pf_frent_pl, PFFRAG_FRENT_HIWAT, PFFRAG_FRENT_HIWAT }, 244 { &pfr_ktable_pl, PFR_KTABLE_HIWAT, PFR_KTABLE_HIWAT }, 245 { &pfr_kentry_pl, PFR_KENTRY_HIWAT, PFR_KENTRY_HIWAT } 246 }; 247 248 enum { PF_ICMP_MULTI_NONE, PF_ICMP_MULTI_LINK }; 249 250 251 #define STATE_LOOKUP(i, k, d, s, m) \ 252 do { \ 253 s = pf_find_state(i, k, d, m); \ 254 if (s == NULL || (s)->timeout == PFTM_PURGE) \ 255 return (PF_DROP); \ 256 if (d == PF_OUT && \ 257 (((s)->rule.ptr->rt == PF_ROUTETO && \ 258 (s)->rule.ptr->direction == PF_OUT) || \ 259 ((s)->rule.ptr->rt == PF_REPLYTO && \ 260 (s)->rule.ptr->direction == PF_IN)) && \ 261 (s)->rt_kif != NULL && \ 262 (s)->rt_kif != i) \ 263 return (PF_PASS); \ 264 } while (0) 265 266 #define BOUND_IFACE(r, k) \ 267 ((r)->rule_flag & PFRULE_IFBOUND) ? (k) : pfi_all 268 269 #define STATE_INC_COUNTERS(s) \ 270 do { \ 271 struct pf_rule_item *mrm; \ 272 s->rule.ptr->states_cur++; \ 273 s->rule.ptr->states_tot++; \ 274 if (s->anchor.ptr != NULL) { \ 275 s->anchor.ptr->states_cur++; \ 276 s->anchor.ptr->states_tot++; \ 277 } \ 278 SLIST_FOREACH(mrm, &s->match_rules, entry) \ 279 mrm->r->states_cur++; \ 280 } while (0) 281 282 #define STATE_DEC_COUNTERS(s) \ 283 do { \ 284 struct pf_rule_item *mrm; \ 285 if (s->anchor.ptr != NULL) \ 286 s->anchor.ptr->states_cur--; \ 287 s->rule.ptr->states_cur--; \ 288 SLIST_FOREACH(mrm, &s->match_rules, entry) \ 289 mrm->r->states_cur--; \ 290 } while (0) 291 292 static __inline int pf_src_compare(struct pf_src_node *, struct pf_src_node *); 293 static __inline int pf_state_compare_key(struct pf_state_key *, 294 struct pf_state_key *); 295 static __inline int pf_state_compare_id(struct pf_state *, 296 struct pf_state *); 297 298 struct pf_src_tree tree_src_tracking; 299 300 struct pf_state_tree_id tree_id; 301 struct pf_state_queue state_list; 302 303 RB_GENERATE(pf_src_tree, pf_src_node, entry, pf_src_compare); 304 RB_GENERATE(pf_state_tree, pf_state_key, entry, pf_state_compare_key); 305 RB_GENERATE(pf_state_tree_id, pf_state, 306 entry_id, pf_state_compare_id); 307 308 __inline int 309 pf_addr_compare(struct pf_addr *a, struct pf_addr *b, sa_family_t af) 310 { 311 switch (af) { 312 #ifdef INET 313 case AF_INET: 314 if (a->addr32[0] > b->addr32[0]) 315 return (1); 316 if (a->addr32[0] < b->addr32[0]) 317 return (-1); 318 break; 319 #endif /* INET */ 320 #ifdef INET6 321 case AF_INET6: 322 if (a->addr32[3] > b->addr32[3]) 323 return (1); 324 if (a->addr32[3] < b->addr32[3]) 325 return (-1); 326 if (a->addr32[2] > b->addr32[2]) 327 return (1); 328 if (a->addr32[2] < b->addr32[2]) 329 return (-1); 330 if (a->addr32[1] > b->addr32[1]) 331 return (1); 332 if (a->addr32[1] < b->addr32[1]) 333 return (-1); 334 if (a->addr32[0] > b->addr32[0]) 335 return (1); 336 if (a->addr32[0] < b->addr32[0]) 337 return (-1); 338 break; 339 #endif /* INET6 */ 340 } 341 return (0); 342 } 343 344 static __inline int 345 pf_src_compare(struct pf_src_node *a, struct pf_src_node *b) 346 { 347 int diff; 348 349 if (a->rule.ptr > b->rule.ptr) 350 return (1); 351 if (a->rule.ptr < b->rule.ptr) 352 return (-1); 353 if ((diff = a->type - b->type) != 0) 354 return (diff); 355 if ((diff = a->af - b->af) != 0) 356 return (diff); 357 if ((diff = pf_addr_compare(&a->addr, &b->addr, a->af)) != 0) 358 return (diff); 359 return (0); 360 } 361 362 #ifdef INET6 363 void 364 pf_addrcpy(struct pf_addr *dst, struct pf_addr *src, sa_family_t af) 365 { 366 switch (af) { 367 #ifdef INET 368 case AF_INET: 369 dst->addr32[0] = src->addr32[0]; 370 break; 371 #endif /* INET */ 372 case AF_INET6: 373 dst->addr32[0] = src->addr32[0]; 374 dst->addr32[1] = src->addr32[1]; 375 dst->addr32[2] = src->addr32[2]; 376 dst->addr32[3] = src->addr32[3]; 377 break; 378 } 379 } 380 #endif /* INET6 */ 381 382 void 383 pf_init_threshold(struct pf_threshold *threshold, 384 u_int32_t limit, u_int32_t seconds) 385 { 386 threshold->limit = limit * PF_THRESHOLD_MULT; 387 threshold->seconds = seconds; 388 threshold->count = 0; 389 threshold->last = time_uptime; 390 } 391 392 void 393 pf_add_threshold(struct pf_threshold *threshold) 394 { 395 u_int32_t t = time_uptime, diff = t - threshold->last; 396 397 if (diff >= threshold->seconds) 398 threshold->count = 0; 399 else 400 threshold->count -= threshold->count * diff / 401 threshold->seconds; 402 threshold->count += PF_THRESHOLD_MULT; 403 threshold->last = t; 404 } 405 406 int 407 pf_check_threshold(struct pf_threshold *threshold) 408 { 409 return (threshold->count > threshold->limit); 410 } 411 412 int 413 pf_src_connlimit(struct pf_state **state) 414 { 415 int bad = 0; 416 struct pf_src_node *sn; 417 418 if ((sn = pf_get_src_node((*state), PF_SN_NONE)) == NULL) 419 return (0); 420 421 sn->conn++; 422 (*state)->src.tcp_est = 1; 423 pf_add_threshold(&sn->conn_rate); 424 425 if ((*state)->rule.ptr->max_src_conn && 426 (*state)->rule.ptr->max_src_conn < sn->conn) { 427 pf_status.lcounters[LCNT_SRCCONN]++; 428 bad++; 429 } 430 431 if ((*state)->rule.ptr->max_src_conn_rate.limit && 432 pf_check_threshold(&sn->conn_rate)) { 433 pf_status.lcounters[LCNT_SRCCONNRATE]++; 434 bad++; 435 } 436 437 if (!bad) 438 return (0); 439 440 if ((*state)->rule.ptr->overload_tbl) { 441 struct pfr_addr p; 442 u_int32_t killed = 0; 443 444 pf_status.lcounters[LCNT_OVERLOAD_TABLE]++; 445 if (pf_status.debug >= LOG_NOTICE) { 446 log(LOG_NOTICE, 447 "pf: pf_src_connlimit: blocking address "); 448 pf_print_host(&sn->addr, 0, 449 (*state)->key[PF_SK_WIRE]->af); 450 } 451 452 bzero(&p, sizeof(p)); 453 p.pfra_af = (*state)->key[PF_SK_WIRE]->af; 454 switch ((*state)->key[PF_SK_WIRE]->af) { 455 #ifdef INET 456 case AF_INET: 457 p.pfra_net = 32; 458 p.pfra_ip4addr = sn->addr.v4; 459 break; 460 #endif /* INET */ 461 #ifdef INET6 462 case AF_INET6: 463 p.pfra_net = 128; 464 p.pfra_ip6addr = sn->addr.v6; 465 break; 466 #endif /* INET6 */ 467 } 468 469 pfr_insert_kentry((*state)->rule.ptr->overload_tbl, 470 &p, time_second); 471 472 /* kill existing states if that's required. */ 473 if ((*state)->rule.ptr->flush) { 474 struct pf_state_key *sk; 475 struct pf_state *st; 476 477 pf_status.lcounters[LCNT_OVERLOAD_FLUSH]++; 478 RB_FOREACH(st, pf_state_tree_id, &tree_id) { 479 sk = st->key[PF_SK_WIRE]; 480 /* 481 * Kill states from this source. (Only those 482 * from the same rule if PF_FLUSH_GLOBAL is not 483 * set) 484 */ 485 if (sk->af == 486 (*state)->key[PF_SK_WIRE]->af && 487 (((*state)->direction == PF_OUT && 488 PF_AEQ(&sn->addr, &sk->addr[1], sk->af)) || 489 ((*state)->direction == PF_IN && 490 PF_AEQ(&sn->addr, &sk->addr[0], sk->af))) && 491 ((*state)->rule.ptr->flush & 492 PF_FLUSH_GLOBAL || 493 (*state)->rule.ptr == st->rule.ptr)) { 494 st->timeout = PFTM_PURGE; 495 st->src.state = st->dst.state = 496 TCPS_CLOSED; 497 killed++; 498 } 499 } 500 if (pf_status.debug >= LOG_NOTICE) 501 addlog(", %u states killed", killed); 502 } 503 if (pf_status.debug >= LOG_NOTICE) 504 addlog("\n"); 505 } 506 507 /* kill this state */ 508 (*state)->timeout = PFTM_PURGE; 509 (*state)->src.state = (*state)->dst.state = TCPS_CLOSED; 510 return (1); 511 } 512 513 int 514 pf_insert_src_node(struct pf_src_node **sn, struct pf_rule *rule, 515 enum pf_sn_types type, sa_family_t af, struct pf_addr *src, 516 struct pf_addr *raddr, int global) 517 { 518 struct pf_src_node k; 519 520 if (*sn == NULL) { 521 k.af = af; 522 k.type = type; 523 PF_ACPY(&k.addr, src, af); 524 if (global) 525 k.rule.ptr = NULL; 526 else 527 k.rule.ptr = rule; 528 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++; 529 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k); 530 } 531 if (*sn == NULL) { 532 if (!rule->max_src_nodes || 533 rule->src_nodes < rule->max_src_nodes) 534 (*sn) = pool_get(&pf_src_tree_pl, PR_NOWAIT | PR_ZERO); 535 else 536 pf_status.lcounters[LCNT_SRCNODES]++; 537 if ((*sn) == NULL) 538 return (-1); 539 540 pf_init_threshold(&(*sn)->conn_rate, 541 rule->max_src_conn_rate.limit, 542 rule->max_src_conn_rate.seconds); 543 544 (*sn)->type = type; 545 (*sn)->af = af; 546 if (global) 547 (*sn)->rule.ptr = NULL; 548 else 549 (*sn)->rule.ptr = rule; 550 PF_ACPY(&(*sn)->addr, src, af); 551 if (raddr) 552 PF_ACPY(&(*sn)->raddr, raddr, af); 553 if (RB_INSERT(pf_src_tree, 554 &tree_src_tracking, *sn) != NULL) { 555 if (pf_status.debug >= LOG_NOTICE) { 556 log(LOG_NOTICE, 557 "pf: src_tree insert failed: "); 558 pf_print_host(&(*sn)->addr, 0, af); 559 addlog("\n"); 560 } 561 pool_put(&pf_src_tree_pl, *sn); 562 return (-1); 563 } 564 (*sn)->creation = time_uptime; 565 if ((*sn)->rule.ptr != NULL) 566 (*sn)->rule.ptr->src_nodes++; 567 pf_status.scounters[SCNT_SRC_NODE_INSERT]++; 568 pf_status.src_nodes++; 569 } else { 570 if (rule->max_src_states && 571 (*sn)->states >= rule->max_src_states) { 572 pf_status.lcounters[LCNT_SRCSTATES]++; 573 return (-1); 574 } 575 } 576 return (0); 577 } 578 579 void 580 pf_remove_src_node(struct pf_src_node *sn) 581 { 582 if (sn->states > 0 || sn->expire > time_uptime) 583 return; 584 585 if (sn->rule.ptr != NULL) { 586 sn->rule.ptr->src_nodes--; 587 if (sn->rule.ptr->states_cur == 0 && 588 sn->rule.ptr->src_nodes == 0) 589 pf_rm_rule(NULL, sn->rule.ptr); 590 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn); 591 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; 592 pf_status.src_nodes--; 593 pool_put(&pf_src_tree_pl, sn); 594 } 595 } 596 597 struct pf_src_node * 598 pf_get_src_node(struct pf_state *s, enum pf_sn_types type) 599 { 600 struct pf_sn_item *sni; 601 602 SLIST_FOREACH(sni, &s->src_nodes, next) 603 if (sni->sn->type == type) 604 return (sni->sn); 605 return (NULL); 606 } 607 608 void 609 pf_state_rm_src_node(struct pf_state *s, struct pf_src_node *sn) 610 { 611 struct pf_sn_item *sni, *snin, *snip = NULL; 612 613 for (sni = SLIST_FIRST(&s->src_nodes); sni; sni = snin) { 614 snin = SLIST_NEXT(sni, next); 615 if (sni->sn == sn) { 616 if (snip) 617 SLIST_REMOVE_AFTER(snip, next); 618 else 619 SLIST_REMOVE_HEAD(&s->src_nodes, next); 620 pool_put(&pf_sn_item_pl, sni); 621 sn->states--; 622 } 623 snip = sni; 624 } 625 } 626 627 /* state table stuff */ 628 629 static __inline int 630 pf_state_compare_key(struct pf_state_key *a, struct pf_state_key *b) 631 { 632 int diff; 633 634 if ((diff = a->proto - b->proto) != 0) 635 return (diff); 636 if ((diff = a->af - b->af) != 0) 637 return (diff); 638 if ((diff = pf_addr_compare(&a->addr[0], &b->addr[0], a->af)) != 0) 639 return (diff); 640 if ((diff = pf_addr_compare(&a->addr[1], &b->addr[1], a->af)) != 0) 641 return (diff); 642 if ((diff = a->port[0] - b->port[0]) != 0) 643 return (diff); 644 if ((diff = a->port[1] - b->port[1]) != 0) 645 return (diff); 646 if ((diff = a->rdomain - b->rdomain) != 0) 647 return (diff); 648 return (0); 649 } 650 651 static __inline int 652 pf_state_compare_id(struct pf_state *a, struct pf_state *b) 653 { 654 if (a->id > b->id) 655 return (1); 656 if (a->id < b->id) 657 return (-1); 658 if (a->creatorid > b->creatorid) 659 return (1); 660 if (a->creatorid < b->creatorid) 661 return (-1); 662 663 return (0); 664 } 665 666 int 667 pf_state_key_attach(struct pf_state_key *sk, struct pf_state *s, int idx) 668 { 669 struct pf_state_item *si; 670 struct pf_state_key *cur; 671 struct pf_state *olds = NULL; 672 673 KASSERT(s->key[idx] == NULL); 674 if ((cur = RB_INSERT(pf_state_tree, &pf_statetbl, sk)) != NULL) { 675 /* key exists. check for same kif, if none, add to key */ 676 TAILQ_FOREACH(si, &cur->states, entry) 677 if (si->s->kif == s->kif && 678 ((si->s->key[PF_SK_WIRE]->af == sk->af && 679 si->s->direction == s->direction) || 680 (si->s->key[PF_SK_WIRE]->af != 681 si->s->key[PF_SK_STACK]->af && 682 sk->af == si->s->key[PF_SK_STACK]->af && 683 si->s->direction != s->direction))) { 684 if (sk->proto == IPPROTO_TCP && 685 si->s->src.state >= TCPS_FIN_WAIT_2 && 686 si->s->dst.state >= TCPS_FIN_WAIT_2) { 687 si->s->src.state = si->s->dst.state = 688 TCPS_CLOSED; 689 /* unlink late or sks can go away */ 690 olds = si->s; 691 } else { 692 if (pf_status.debug >= LOG_NOTICE) { 693 log(LOG_NOTICE, 694 "pf: %s key attach " 695 "failed on %s: ", 696 (idx == PF_SK_WIRE) ? 697 "wire" : "stack", 698 s->kif->pfik_name); 699 pf_print_state_parts(s, 700 (idx == PF_SK_WIRE) ? 701 sk : NULL, 702 (idx == PF_SK_STACK) ? 703 sk : NULL); 704 addlog(", existing: "); 705 pf_print_state_parts(si->s, 706 (idx == PF_SK_WIRE) ? 707 sk : NULL, 708 (idx == PF_SK_STACK) ? 709 sk : NULL); 710 addlog("\n"); 711 } 712 pool_put(&pf_state_key_pl, sk); 713 return (-1); /* collision! */ 714 } 715 } 716 pool_put(&pf_state_key_pl, sk); 717 s->key[idx] = cur; 718 } else 719 s->key[idx] = sk; 720 721 if ((si = pool_get(&pf_state_item_pl, PR_NOWAIT)) == NULL) { 722 pf_state_key_detach(s, idx); 723 return (-1); 724 } 725 si->s = s; 726 727 /* list is sorted, if-bound states before floating */ 728 if (s->kif == pfi_all) 729 TAILQ_INSERT_TAIL(&s->key[idx]->states, si, entry); 730 else 731 TAILQ_INSERT_HEAD(&s->key[idx]->states, si, entry); 732 733 if (olds) 734 pf_unlink_state(olds); 735 736 return (0); 737 } 738 739 void 740 pf_detach_state(struct pf_state *s) 741 { 742 if (s->key[PF_SK_WIRE] == s->key[PF_SK_STACK]) 743 s->key[PF_SK_WIRE] = NULL; 744 745 if (s->key[PF_SK_STACK] != NULL) 746 pf_state_key_detach(s, PF_SK_STACK); 747 748 if (s->key[PF_SK_WIRE] != NULL) 749 pf_state_key_detach(s, PF_SK_WIRE); 750 } 751 752 void 753 pf_state_key_detach(struct pf_state *s, int idx) 754 { 755 struct pf_state_item *si; 756 757 if (s->key[idx] == NULL) 758 return; 759 760 si = TAILQ_FIRST(&s->key[idx]->states); 761 while (si && si->s != s) 762 si = TAILQ_NEXT(si, entry); 763 764 if (si) { 765 TAILQ_REMOVE(&s->key[idx]->states, si, entry); 766 pool_put(&pf_state_item_pl, si); 767 } 768 769 if (TAILQ_EMPTY(&s->key[idx]->states)) { 770 RB_REMOVE(pf_state_tree, &pf_statetbl, s->key[idx]); 771 if (s->key[idx]->reverse) 772 s->key[idx]->reverse->reverse = NULL; 773 if (s->key[idx]->inp) 774 s->key[idx]->inp->inp_pf_sk = NULL; 775 pool_put(&pf_state_key_pl, s->key[idx]); 776 } 777 s->key[idx] = NULL; 778 } 779 780 struct pf_state_key * 781 pf_alloc_state_key(int pool_flags) 782 { 783 struct pf_state_key *sk; 784 785 if ((sk = pool_get(&pf_state_key_pl, pool_flags)) == NULL) 786 return (NULL); 787 TAILQ_INIT(&sk->states); 788 789 return (sk); 790 } 791 792 static __inline int 793 pf_state_key_addr_setup(struct pf_pdesc *pd, void *arg, int sidx, 794 struct pf_addr *saddr, int didx, struct pf_addr *daddr, int af, int multi) 795 { 796 struct pf_state_key_cmp *key = arg; 797 #ifdef INET6 798 struct nd_neighbor_solicit *nd; 799 struct pf_addr *target; 800 801 if (af == AF_INET || pd->proto != IPPROTO_ICMPV6) 802 goto copy; 803 804 switch (pd->hdr.icmp6->icmp6_type) { 805 case ND_NEIGHBOR_SOLICIT: 806 if (multi) 807 return (-1); 808 nd = (void *)pd->hdr.icmp6; 809 target = (struct pf_addr *)&nd->nd_ns_target; 810 daddr = target; 811 break; 812 case ND_NEIGHBOR_ADVERT: 813 if (multi) 814 return (-1); 815 nd = (void *)pd->hdr.icmp6; 816 target = (struct pf_addr *)&nd->nd_ns_target; 817 saddr = target; 818 if (IN6_IS_ADDR_MULTICAST(&pd->dst->v6)) { 819 key->addr[didx].addr32[0] = 0; 820 key->addr[didx].addr32[1] = 0; 821 key->addr[didx].addr32[2] = 0; 822 key->addr[didx].addr32[3] = 0; 823 daddr = NULL; /* overwritten */ 824 } 825 break; 826 default: 827 if (multi == PF_ICMP_MULTI_LINK) { 828 key->addr[sidx].addr32[0] = __IPV6_ADDR_INT32_MLL; 829 key->addr[sidx].addr32[1] = 0; 830 key->addr[sidx].addr32[2] = 0; 831 key->addr[sidx].addr32[3] = __IPV6_ADDR_INT32_ONE; 832 saddr = NULL; /* overwritten */ 833 } 834 } 835 copy: 836 #endif 837 if (saddr) 838 PF_ACPY(&key->addr[sidx], saddr, af); 839 if (daddr) 840 PF_ACPY(&key->addr[didx], daddr, af); 841 842 return (0); 843 } 844 845 int 846 pf_state_key_setup(struct pf_pdesc *pd, struct pf_state_key **skw, 847 struct pf_state_key **sks, int rtableid) 848 { 849 /* if returning error we MUST pool_put state keys ourselves */ 850 struct pf_state_key *sk1, *sk2; 851 u_int wrdom = pd->rdomain; 852 int afto = pd->af != pd->naf; 853 854 if ((sk1 = pf_alloc_state_key(PR_NOWAIT | PR_ZERO)) == NULL) 855 return (ENOMEM); 856 857 pf_state_key_addr_setup(pd, sk1, pd->sidx, pd->src, pd->didx, pd->dst, 858 pd->af, 0); 859 sk1->port[pd->sidx] = pd->osport; 860 sk1->port[pd->didx] = pd->odport; 861 sk1->proto = pd->proto; 862 sk1->af = pd->af; 863 sk1->rdomain = pd->rdomain; 864 if (rtableid >= 0) 865 wrdom = rtable_l2(rtableid); 866 867 if (PF_ANEQ(&pd->nsaddr, pd->src, pd->af) || 868 PF_ANEQ(&pd->ndaddr, pd->dst, pd->af) || 869 pd->nsport != pd->osport || pd->ndport != pd->odport || 870 wrdom != pd->rdomain || afto) { /* NAT/NAT64 */ 871 if ((sk2 = pf_alloc_state_key(PR_NOWAIT | PR_ZERO)) == NULL) { 872 pool_put(&pf_state_key_pl, sk1); 873 return (ENOMEM); 874 } 875 pf_state_key_addr_setup(pd, sk2, afto ? pd->didx : pd->sidx, 876 &pd->nsaddr, afto ? pd->sidx : pd->didx, &pd->ndaddr, 877 pd->naf, 0); 878 sk2->port[afto ? pd->didx : pd->sidx] = pd->nsport; 879 sk2->port[afto ? pd->sidx : pd->didx] = pd->ndport; 880 if (afto) { 881 switch (pd->proto) { 882 case IPPROTO_ICMP: 883 sk2->proto = IPPROTO_ICMPV6; 884 break; 885 case IPPROTO_ICMPV6: 886 sk2->proto = IPPROTO_ICMP; 887 break; 888 default: 889 sk2->proto = pd->proto; 890 } 891 } else 892 sk2->proto = pd->proto; 893 sk2->af = pd->naf; 894 sk2->rdomain = wrdom; 895 } else 896 sk2 = sk1; 897 898 if (pd->dir == PF_IN) { 899 *skw = sk1; 900 *sks = sk2; 901 } else { 902 *sks = sk1; 903 *skw = sk2; 904 } 905 906 if (pf_status.debug >= LOG_DEBUG) { 907 log(LOG_DEBUG, "pf: key setup: "); 908 pf_print_state_parts(NULL, *skw, *sks); 909 addlog("\n"); 910 } 911 912 return (0); 913 } 914 915 int 916 pf_state_insert(struct pfi_kif *kif, struct pf_state_key **skw, 917 struct pf_state_key **sks, struct pf_state *s) 918 { 919 splsoftassert(IPL_SOFTNET); 920 921 s->kif = kif; 922 if (*skw == *sks) { 923 if (pf_state_key_attach(*skw, s, PF_SK_WIRE)) 924 return (-1); 925 *skw = *sks = s->key[PF_SK_WIRE]; 926 s->key[PF_SK_STACK] = s->key[PF_SK_WIRE]; 927 } else { 928 if (pf_state_key_attach(*skw, s, PF_SK_WIRE)) { 929 pool_put(&pf_state_key_pl, *sks); 930 return (-1); 931 } 932 *skw = s->key[PF_SK_WIRE]; 933 if (pf_state_key_attach(*sks, s, PF_SK_STACK)) { 934 pf_state_key_detach(s, PF_SK_WIRE); 935 return (-1); 936 } 937 *sks = s->key[PF_SK_STACK]; 938 } 939 940 if (s->id == 0 && s->creatorid == 0) { 941 s->id = htobe64(pf_status.stateid++); 942 s->creatorid = pf_status.hostid; 943 } 944 if (RB_INSERT(pf_state_tree_id, &tree_id, s) != NULL) { 945 if (pf_status.debug >= LOG_NOTICE) { 946 log(LOG_NOTICE, "pf: state insert failed: " 947 "id: %016llx creatorid: %08x", 948 betoh64(s->id), ntohl(s->creatorid)); 949 addlog("\n"); 950 } 951 pf_detach_state(s); 952 return (-1); 953 } 954 TAILQ_INSERT_TAIL(&state_list, s, entry_list); 955 pf_status.fcounters[FCNT_STATE_INSERT]++; 956 pf_status.states++; 957 pfi_kif_ref(kif, PFI_KIF_REF_STATE); 958 #if NPFSYNC > 0 959 pfsync_insert_state(s); 960 #endif 961 return (0); 962 } 963 964 struct pf_state * 965 pf_find_state_byid(struct pf_state_cmp *key) 966 { 967 pf_status.fcounters[FCNT_STATE_SEARCH]++; 968 969 return (RB_FIND(pf_state_tree_id, &tree_id, (struct pf_state *)key)); 970 } 971 972 int 973 pf_compare_state_keys(struct pf_state_key *a, struct pf_state_key *b, 974 struct pfi_kif *kif, u_int dir) 975 { 976 /* a (from hdr) and b (new) must be exact opposites of each other */ 977 if (a->af == b->af && a->proto == b->proto && 978 PF_AEQ(&a->addr[0], &b->addr[1], a->af) && 979 PF_AEQ(&a->addr[1], &b->addr[0], a->af) && 980 a->port[0] == b->port[1] && 981 a->port[1] == b->port[0] && a->rdomain == b->rdomain) 982 return (0); 983 else { 984 /* mismatch. must not happen. */ 985 if (pf_status.debug >= LOG_ERR) { 986 log(LOG_ERR, 987 "pf: state key linking mismatch! dir=%s, " 988 "if=%s, stored af=%u, a0: ", 989 dir == PF_OUT ? "OUT" : "IN", 990 kif->pfik_name, a->af); 991 pf_print_host(&a->addr[0], a->port[0], a->af); 992 addlog(", a1: "); 993 pf_print_host(&a->addr[1], a->port[1], a->af); 994 addlog(", proto=%u", a->proto); 995 addlog(", found af=%u, a0: ", b->af); 996 pf_print_host(&b->addr[0], b->port[0], b->af); 997 addlog(", a1: "); 998 pf_print_host(&b->addr[1], b->port[1], b->af); 999 addlog(", proto=%u", b->proto); 1000 addlog("\n"); 1001 } 1002 return (-1); 1003 } 1004 } 1005 1006 struct pf_state * 1007 pf_find_state(struct pfi_kif *kif, struct pf_state_key_cmp *key, u_int dir, 1008 struct mbuf *m) 1009 { 1010 struct pf_state_key *sk; 1011 struct pf_state_item *si; 1012 1013 pf_status.fcounters[FCNT_STATE_SEARCH]++; 1014 if (pf_status.debug >= LOG_DEBUG) { 1015 log(LOG_DEBUG, "pf: key search, if=%s: ", kif->pfik_name); 1016 pf_print_state_parts(NULL, (struct pf_state_key *)key, NULL); 1017 addlog("\n"); 1018 } 1019 1020 if (dir == PF_OUT && m->m_pkthdr.pf.statekey && 1021 m->m_pkthdr.pf.statekey->reverse) 1022 sk = m->m_pkthdr.pf.statekey->reverse; 1023 else if (dir == PF_OUT && m->m_pkthdr.pf.inp && 1024 m->m_pkthdr.pf.inp->inp_pf_sk) 1025 sk = m->m_pkthdr.pf.inp->inp_pf_sk; 1026 else { 1027 if ((sk = RB_FIND(pf_state_tree, &pf_statetbl, 1028 (struct pf_state_key *)key)) == NULL) 1029 return (NULL); 1030 if (dir == PF_OUT && m->m_pkthdr.pf.statekey && 1031 pf_compare_state_keys(m->m_pkthdr.pf.statekey, sk, 1032 kif, dir) == 0) { 1033 m->m_pkthdr.pf.statekey->reverse = sk; 1034 sk->reverse = m->m_pkthdr.pf.statekey; 1035 } else if (dir == PF_OUT && m->m_pkthdr.pf.inp && !sk->inp) { 1036 m->m_pkthdr.pf.inp->inp_pf_sk = sk; 1037 sk->inp = m->m_pkthdr.pf.inp; 1038 } 1039 } 1040 1041 if (dir == PF_OUT) { 1042 m->m_pkthdr.pf.statekey = NULL; 1043 m->m_pkthdr.pf.inp = NULL; 1044 } 1045 1046 /* list is sorted, if-bound states before floating ones */ 1047 TAILQ_FOREACH(si, &sk->states, entry) 1048 if ((si->s->kif == pfi_all || si->s->kif == kif) && 1049 ((si->s->key[PF_SK_WIRE]->af == si->s->key[PF_SK_STACK]->af 1050 && sk == (dir == PF_IN ? si->s->key[PF_SK_WIRE] : 1051 si->s->key[PF_SK_STACK])) || 1052 (si->s->key[PF_SK_WIRE]->af != si->s->key[PF_SK_STACK]->af 1053 && dir == PF_IN && (sk == si->s->key[PF_SK_STACK] || 1054 sk == si->s->key[PF_SK_WIRE])))) 1055 return (si->s); 1056 1057 return (NULL); 1058 } 1059 1060 struct pf_state * 1061 pf_find_state_all(struct pf_state_key_cmp *key, u_int dir, int *more) 1062 { 1063 struct pf_state_key *sk; 1064 struct pf_state_item *si, *ret = NULL; 1065 1066 pf_status.fcounters[FCNT_STATE_SEARCH]++; 1067 1068 sk = RB_FIND(pf_state_tree, &pf_statetbl, (struct pf_state_key *)key); 1069 1070 if (sk != NULL) { 1071 TAILQ_FOREACH(si, &sk->states, entry) 1072 if (dir == PF_INOUT || 1073 (sk == (dir == PF_IN ? si->s->key[PF_SK_WIRE] : 1074 si->s->key[PF_SK_STACK]))) { 1075 if (more == NULL) 1076 return (si->s); 1077 1078 if (ret) 1079 (*more)++; 1080 else 1081 ret = si; 1082 } 1083 } 1084 return (ret ? ret->s : NULL); 1085 } 1086 1087 void 1088 pf_state_export(struct pfsync_state *sp, struct pf_state *st) 1089 { 1090 int32_t expire; 1091 1092 bzero(sp, sizeof(struct pfsync_state)); 1093 1094 /* copy from state key */ 1095 sp->key[PF_SK_WIRE].addr[0] = st->key[PF_SK_WIRE]->addr[0]; 1096 sp->key[PF_SK_WIRE].addr[1] = st->key[PF_SK_WIRE]->addr[1]; 1097 sp->key[PF_SK_WIRE].port[0] = st->key[PF_SK_WIRE]->port[0]; 1098 sp->key[PF_SK_WIRE].port[1] = st->key[PF_SK_WIRE]->port[1]; 1099 sp->key[PF_SK_WIRE].rdomain = htons(st->key[PF_SK_WIRE]->rdomain); 1100 sp->key[PF_SK_WIRE].af = st->key[PF_SK_WIRE]->af; 1101 sp->key[PF_SK_STACK].addr[0] = st->key[PF_SK_STACK]->addr[0]; 1102 sp->key[PF_SK_STACK].addr[1] = st->key[PF_SK_STACK]->addr[1]; 1103 sp->key[PF_SK_STACK].port[0] = st->key[PF_SK_STACK]->port[0]; 1104 sp->key[PF_SK_STACK].port[1] = st->key[PF_SK_STACK]->port[1]; 1105 sp->key[PF_SK_STACK].rdomain = htons(st->key[PF_SK_STACK]->rdomain); 1106 sp->key[PF_SK_STACK].af = st->key[PF_SK_STACK]->af; 1107 sp->rtableid[PF_SK_WIRE] = htonl(st->rtableid[PF_SK_WIRE]); 1108 sp->rtableid[PF_SK_STACK] = htonl(st->rtableid[PF_SK_STACK]); 1109 sp->proto = st->key[PF_SK_WIRE]->proto; 1110 sp->af = st->key[PF_SK_WIRE]->af; 1111 1112 /* copy from state */ 1113 strlcpy(sp->ifname, st->kif->pfik_name, sizeof(sp->ifname)); 1114 memcpy(&sp->rt_addr, &st->rt_addr, sizeof(sp->rt_addr)); 1115 sp->creation = htonl(time_uptime - st->creation); 1116 expire = pf_state_expires(st); 1117 if (expire <= time_uptime) 1118 sp->expire = htonl(0); 1119 else 1120 sp->expire = htonl(expire - time_uptime); 1121 1122 sp->direction = st->direction; 1123 sp->log = st->log; 1124 sp->timeout = st->timeout; 1125 sp->state_flags = htons(st->state_flags); 1126 if (!SLIST_EMPTY(&st->src_nodes)) 1127 sp->sync_flags |= PFSYNC_FLAG_SRCNODE; 1128 1129 sp->id = st->id; 1130 sp->creatorid = st->creatorid; 1131 pf_state_peer_hton(&st->src, &sp->src); 1132 pf_state_peer_hton(&st->dst, &sp->dst); 1133 1134 if (st->rule.ptr == NULL) 1135 sp->rule = htonl(-1); 1136 else 1137 sp->rule = htonl(st->rule.ptr->nr); 1138 if (st->anchor.ptr == NULL) 1139 sp->anchor = htonl(-1); 1140 else 1141 sp->anchor = htonl(st->anchor.ptr->nr); 1142 sp->nat_rule = htonl(-1); /* left for compat, nat_rule is gone */ 1143 1144 pf_state_counter_hton(st->packets[0], sp->packets[0]); 1145 pf_state_counter_hton(st->packets[1], sp->packets[1]); 1146 pf_state_counter_hton(st->bytes[0], sp->bytes[0]); 1147 pf_state_counter_hton(st->bytes[1], sp->bytes[1]); 1148 1149 sp->max_mss = htons(st->max_mss); 1150 sp->min_ttl = st->min_ttl; 1151 sp->set_tos = st->set_tos; 1152 } 1153 1154 /* END state table stuff */ 1155 1156 void 1157 pf_purge_thread(void *v) 1158 { 1159 int nloops = 0, s; 1160 1161 for (;;) { 1162 tsleep(pf_purge_thread, PWAIT, "pftm", 1 * hz); 1163 1164 s = splsoftnet(); 1165 1166 /* process a fraction of the state table every second */ 1167 pf_purge_expired_states(1 + (pf_status.states 1168 / pf_default_rule.timeout[PFTM_INTERVAL])); 1169 1170 /* purge other expired types every PFTM_INTERVAL seconds */ 1171 if (++nloops >= pf_default_rule.timeout[PFTM_INTERVAL]) { 1172 pf_purge_expired_fragments(); 1173 pf_purge_expired_src_nodes(0); 1174 nloops = 0; 1175 } 1176 1177 splx(s); 1178 } 1179 } 1180 1181 int32_t 1182 pf_state_expires(const struct pf_state *state) 1183 { 1184 int32_t timeout; 1185 u_int32_t start; 1186 u_int32_t end; 1187 u_int32_t states; 1188 1189 /* handle all PFTM_* > PFTM_MAX here */ 1190 if (state->timeout == PFTM_PURGE) 1191 return (0); 1192 1193 KASSERT(state->timeout != PFTM_UNLINKED); 1194 KASSERT(state->timeout < PFTM_MAX); 1195 1196 timeout = state->rule.ptr->timeout[state->timeout]; 1197 if (!timeout) 1198 timeout = pf_default_rule.timeout[state->timeout]; 1199 1200 start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START]; 1201 if (start) { 1202 end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END]; 1203 states = state->rule.ptr->states_cur; 1204 } else { 1205 start = pf_default_rule.timeout[PFTM_ADAPTIVE_START]; 1206 end = pf_default_rule.timeout[PFTM_ADAPTIVE_END]; 1207 states = pf_status.states; 1208 } 1209 if (end && states > start && start < end) { 1210 if (states >= end) 1211 return (0); 1212 1213 timeout = timeout * (end - states) / (end - start); 1214 } 1215 1216 return (state->expire + timeout); 1217 } 1218 1219 void 1220 pf_purge_expired_src_nodes(int waslocked) 1221 { 1222 struct pf_src_node *cur, *next; 1223 int locked = waslocked; 1224 1225 for (cur = RB_MIN(pf_src_tree, &tree_src_tracking); cur; cur = next) { 1226 next = RB_NEXT(pf_src_tree, &tree_src_tracking, cur); 1227 1228 if (cur->states <= 0 && cur->expire <= time_uptime) { 1229 if (! locked) { 1230 rw_enter_write(&pf_consistency_lock); 1231 next = RB_NEXT(pf_src_tree, 1232 &tree_src_tracking, cur); 1233 locked = 1; 1234 } 1235 pf_remove_src_node(cur); 1236 } 1237 } 1238 1239 if (locked && !waslocked) 1240 rw_exit_write(&pf_consistency_lock); 1241 } 1242 1243 void 1244 pf_src_tree_remove_state(struct pf_state *s) 1245 { 1246 u_int32_t timeout; 1247 struct pf_sn_item *sni; 1248 1249 while ((sni = SLIST_FIRST(&s->src_nodes)) != NULL) { 1250 SLIST_REMOVE_HEAD(&s->src_nodes, next); 1251 if (s->src.tcp_est) 1252 --sni->sn->conn; 1253 if (--sni->sn->states <= 0) { 1254 timeout = s->rule.ptr->timeout[PFTM_SRC_NODE]; 1255 if (!timeout) 1256 timeout = 1257 pf_default_rule.timeout[PFTM_SRC_NODE]; 1258 sni->sn->expire = time_uptime + timeout; 1259 } 1260 pool_put(&pf_sn_item_pl, sni); 1261 } 1262 } 1263 1264 /* callers should be at splsoftnet */ 1265 void 1266 pf_unlink_state(struct pf_state *cur) 1267 { 1268 splsoftassert(IPL_SOFTNET); 1269 1270 /* handle load balancing related tasks */ 1271 pf_postprocess_addr(cur); 1272 1273 if (cur->src.state == PF_TCPS_PROXY_DST) { 1274 pf_send_tcp(cur->rule.ptr, cur->key[PF_SK_WIRE]->af, 1275 &cur->key[PF_SK_WIRE]->addr[1], 1276 &cur->key[PF_SK_WIRE]->addr[0], 1277 cur->key[PF_SK_WIRE]->port[1], 1278 cur->key[PF_SK_WIRE]->port[0], 1279 cur->src.seqhi, cur->src.seqlo + 1, 1280 TH_RST|TH_ACK, 0, 0, 0, 1, cur->tag, 1281 cur->key[PF_SK_WIRE]->rdomain, NULL, NULL); 1282 } 1283 RB_REMOVE(pf_state_tree_id, &tree_id, cur); 1284 #if NPFLOW > 0 1285 if (cur->state_flags & PFSTATE_PFLOW) 1286 export_pflow(cur); 1287 #endif 1288 #if NPFSYNC > 0 1289 pfsync_delete_state(cur); 1290 #endif 1291 cur->timeout = PFTM_UNLINKED; 1292 pf_src_tree_remove_state(cur); 1293 pf_detach_state(cur); 1294 } 1295 1296 /* callers should be at splsoftnet and hold the 1297 * write_lock on pf_consistency_lock */ 1298 void 1299 pf_free_state(struct pf_state *cur) 1300 { 1301 struct pf_rule_item *ri; 1302 1303 splsoftassert(IPL_SOFTNET); 1304 1305 #if NPFSYNC > 0 1306 if (pfsync_state_in_use(cur)) 1307 return; 1308 #endif 1309 KASSERT(cur->timeout == PFTM_UNLINKED); 1310 if (--cur->rule.ptr->states_cur == 0 && 1311 cur->rule.ptr->src_nodes == 0) 1312 pf_rm_rule(NULL, cur->rule.ptr); 1313 if (cur->anchor.ptr != NULL) 1314 if (--cur->anchor.ptr->states_cur == 0) 1315 pf_rm_rule(NULL, cur->anchor.ptr); 1316 while ((ri = SLIST_FIRST(&cur->match_rules))) { 1317 SLIST_REMOVE_HEAD(&cur->match_rules, entry); 1318 if (--ri->r->states_cur == 0 && 1319 ri->r->src_nodes == 0) 1320 pf_rm_rule(NULL, ri->r); 1321 pool_put(&pf_rule_item_pl, ri); 1322 } 1323 pf_normalize_tcp_cleanup(cur); 1324 pfi_kif_unref(cur->kif, PFI_KIF_REF_STATE); 1325 TAILQ_REMOVE(&state_list, cur, entry_list); 1326 if (cur->tag) 1327 pf_tag_unref(cur->tag); 1328 pool_put(&pf_state_pl, cur); 1329 pf_status.fcounters[FCNT_STATE_REMOVALS]++; 1330 pf_status.states--; 1331 } 1332 1333 void 1334 pf_purge_expired_states(u_int32_t maxcheck) 1335 { 1336 static struct pf_state *cur = NULL; 1337 struct pf_state *next; 1338 int locked = 0; 1339 1340 while (maxcheck--) { 1341 /* wrap to start of list when we hit the end */ 1342 if (cur == NULL) { 1343 cur = TAILQ_FIRST(&state_list); 1344 if (cur == NULL) 1345 break; /* list empty */ 1346 } 1347 1348 /* get next state, as cur may get deleted */ 1349 next = TAILQ_NEXT(cur, entry_list); 1350 1351 if (cur->timeout == PFTM_UNLINKED) { 1352 /* free unlinked state */ 1353 if (! locked) { 1354 rw_enter_write(&pf_consistency_lock); 1355 locked = 1; 1356 } 1357 pf_free_state(cur); 1358 } else if (pf_state_expires(cur) <= time_uptime) { 1359 /* unlink and free expired state */ 1360 pf_unlink_state(cur); 1361 if (! locked) { 1362 rw_enter_write(&pf_consistency_lock); 1363 locked = 1; 1364 } 1365 pf_free_state(cur); 1366 } 1367 cur = next; 1368 } 1369 1370 if (locked) 1371 rw_exit_write(&pf_consistency_lock); 1372 } 1373 1374 int 1375 pf_tbladdr_setup(struct pf_ruleset *rs, struct pf_addr_wrap *aw) 1376 { 1377 if (aw->type != PF_ADDR_TABLE) 1378 return (0); 1379 if ((aw->p.tbl = pfr_attach_table(rs, aw->v.tblname, 1)) == NULL) 1380 return (1); 1381 return (0); 1382 } 1383 1384 void 1385 pf_tbladdr_remove(struct pf_addr_wrap *aw) 1386 { 1387 if (aw->type != PF_ADDR_TABLE || aw->p.tbl == NULL) 1388 return; 1389 pfr_detach_table(aw->p.tbl); 1390 aw->p.tbl = NULL; 1391 } 1392 1393 void 1394 pf_tbladdr_copyout(struct pf_addr_wrap *aw) 1395 { 1396 struct pfr_ktable *kt = aw->p.tbl; 1397 1398 if (aw->type != PF_ADDR_TABLE || kt == NULL) 1399 return; 1400 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 1401 kt = kt->pfrkt_root; 1402 aw->p.tbl = NULL; 1403 aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ? 1404 kt->pfrkt_cnt : -1; 1405 } 1406 1407 void 1408 pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af) 1409 { 1410 switch (af) { 1411 #ifdef INET 1412 case AF_INET: { 1413 u_int32_t a = ntohl(addr->addr32[0]); 1414 addlog("%u.%u.%u.%u", (a>>24)&255, (a>>16)&255, 1415 (a>>8)&255, a&255); 1416 if (p) { 1417 p = ntohs(p); 1418 addlog(":%u", p); 1419 } 1420 break; 1421 } 1422 #endif /* INET */ 1423 #ifdef INET6 1424 case AF_INET6: { 1425 u_int16_t b; 1426 u_int8_t i, curstart, curend, maxstart, maxend; 1427 curstart = curend = maxstart = maxend = 255; 1428 for (i = 0; i < 8; i++) { 1429 if (!addr->addr16[i]) { 1430 if (curstart == 255) 1431 curstart = i; 1432 curend = i; 1433 } else { 1434 if ((curend - curstart) > 1435 (maxend - maxstart)) { 1436 maxstart = curstart; 1437 maxend = curend; 1438 } 1439 curstart = curend = 255; 1440 } 1441 } 1442 if ((curend - curstart) > 1443 (maxend - maxstart)) { 1444 maxstart = curstart; 1445 maxend = curend; 1446 } 1447 for (i = 0; i < 8; i++) { 1448 if (i >= maxstart && i <= maxend) { 1449 if (i == 0) 1450 addlog(":"); 1451 if (i == maxend) 1452 addlog(":"); 1453 } else { 1454 b = ntohs(addr->addr16[i]); 1455 addlog("%x", b); 1456 if (i < 7) 1457 addlog(":"); 1458 } 1459 } 1460 if (p) { 1461 p = ntohs(p); 1462 addlog("[%u]", p); 1463 } 1464 break; 1465 } 1466 #endif /* INET6 */ 1467 } 1468 } 1469 1470 void 1471 pf_print_state(struct pf_state *s) 1472 { 1473 pf_print_state_parts(s, NULL, NULL); 1474 } 1475 1476 void 1477 pf_print_state_parts(struct pf_state *s, 1478 struct pf_state_key *skwp, struct pf_state_key *sksp) 1479 { 1480 struct pf_state_key *skw, *sks; 1481 u_int8_t proto, dir; 1482 1483 /* Do our best to fill these, but they're skipped if NULL */ 1484 skw = skwp ? skwp : (s ? s->key[PF_SK_WIRE] : NULL); 1485 sks = sksp ? sksp : (s ? s->key[PF_SK_STACK] : NULL); 1486 proto = skw ? skw->proto : (sks ? sks->proto : 0); 1487 dir = s ? s->direction : 0; 1488 1489 switch (proto) { 1490 case IPPROTO_IPV4: 1491 addlog("IPv4"); 1492 break; 1493 case IPPROTO_IPV6: 1494 addlog("IPv6"); 1495 break; 1496 case IPPROTO_TCP: 1497 addlog("TCP"); 1498 break; 1499 case IPPROTO_UDP: 1500 addlog("UDP"); 1501 break; 1502 case IPPROTO_ICMP: 1503 addlog("ICMP"); 1504 break; 1505 case IPPROTO_ICMPV6: 1506 addlog("ICMPv6"); 1507 break; 1508 default: 1509 addlog("%u", proto); 1510 break; 1511 } 1512 switch (dir) { 1513 case PF_IN: 1514 addlog(" in"); 1515 break; 1516 case PF_OUT: 1517 addlog(" out"); 1518 break; 1519 } 1520 if (skw) { 1521 addlog(" wire: (%d) ", skw->rdomain); 1522 pf_print_host(&skw->addr[0], skw->port[0], skw->af); 1523 addlog(" "); 1524 pf_print_host(&skw->addr[1], skw->port[1], skw->af); 1525 } 1526 if (sks) { 1527 addlog(" stack: (%d) ", sks->rdomain); 1528 if (sks != skw) { 1529 pf_print_host(&sks->addr[0], sks->port[0], sks->af); 1530 addlog(" "); 1531 pf_print_host(&sks->addr[1], sks->port[1], sks->af); 1532 } else 1533 addlog("-"); 1534 } 1535 if (s) { 1536 if (proto == IPPROTO_TCP) { 1537 addlog(" [lo=%u high=%u win=%u modulator=%u", 1538 s->src.seqlo, s->src.seqhi, 1539 s->src.max_win, s->src.seqdiff); 1540 if (s->src.wscale && s->dst.wscale) 1541 addlog(" wscale=%u", 1542 s->src.wscale & PF_WSCALE_MASK); 1543 addlog("]"); 1544 addlog(" [lo=%u high=%u win=%u modulator=%u", 1545 s->dst.seqlo, s->dst.seqhi, 1546 s->dst.max_win, s->dst.seqdiff); 1547 if (s->src.wscale && s->dst.wscale) 1548 addlog(" wscale=%u", 1549 s->dst.wscale & PF_WSCALE_MASK); 1550 addlog("]"); 1551 } 1552 addlog(" %u:%u", s->src.state, s->dst.state); 1553 if (s->rule.ptr) 1554 addlog(" @%d", s->rule.ptr->nr); 1555 } 1556 } 1557 1558 void 1559 pf_print_flags(u_int8_t f) 1560 { 1561 if (f) 1562 addlog(" "); 1563 if (f & TH_FIN) 1564 addlog("F"); 1565 if (f & TH_SYN) 1566 addlog("S"); 1567 if (f & TH_RST) 1568 addlog("R"); 1569 if (f & TH_PUSH) 1570 addlog("P"); 1571 if (f & TH_ACK) 1572 addlog("A"); 1573 if (f & TH_URG) 1574 addlog("U"); 1575 if (f & TH_ECE) 1576 addlog("E"); 1577 if (f & TH_CWR) 1578 addlog("W"); 1579 } 1580 1581 #define PF_SET_SKIP_STEPS(i) \ 1582 do { \ 1583 while (head[i] != cur) { \ 1584 head[i]->skip[i].ptr = cur; \ 1585 head[i] = TAILQ_NEXT(head[i], entries); \ 1586 } \ 1587 } while (0) 1588 1589 void 1590 pf_calc_skip_steps(struct pf_rulequeue *rules) 1591 { 1592 struct pf_rule *cur, *prev, *head[PF_SKIP_COUNT]; 1593 int i; 1594 1595 cur = TAILQ_FIRST(rules); 1596 prev = cur; 1597 for (i = 0; i < PF_SKIP_COUNT; ++i) 1598 head[i] = cur; 1599 while (cur != NULL) { 1600 if (cur->kif != prev->kif || cur->ifnot != prev->ifnot) 1601 PF_SET_SKIP_STEPS(PF_SKIP_IFP); 1602 if (cur->direction != prev->direction) 1603 PF_SET_SKIP_STEPS(PF_SKIP_DIR); 1604 if (cur->onrdomain != prev->onrdomain || 1605 cur->ifnot != prev->ifnot) 1606 PF_SET_SKIP_STEPS(PF_SKIP_RDOM); 1607 if (cur->af != prev->af) 1608 PF_SET_SKIP_STEPS(PF_SKIP_AF); 1609 if (cur->proto != prev->proto) 1610 PF_SET_SKIP_STEPS(PF_SKIP_PROTO); 1611 if (cur->src.neg != prev->src.neg || 1612 pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr)) 1613 PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR); 1614 if (cur->dst.neg != prev->dst.neg || 1615 pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr)) 1616 PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR); 1617 if (cur->src.port[0] != prev->src.port[0] || 1618 cur->src.port[1] != prev->src.port[1] || 1619 cur->src.port_op != prev->src.port_op) 1620 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT); 1621 if (cur->dst.port[0] != prev->dst.port[0] || 1622 cur->dst.port[1] != prev->dst.port[1] || 1623 cur->dst.port_op != prev->dst.port_op) 1624 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT); 1625 1626 prev = cur; 1627 cur = TAILQ_NEXT(cur, entries); 1628 } 1629 for (i = 0; i < PF_SKIP_COUNT; ++i) 1630 PF_SET_SKIP_STEPS(i); 1631 } 1632 1633 int 1634 pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2) 1635 { 1636 if (aw1->type != aw2->type) 1637 return (1); 1638 switch (aw1->type) { 1639 case PF_ADDR_ADDRMASK: 1640 case PF_ADDR_RANGE: 1641 if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, AF_INET6)) 1642 return (1); 1643 if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, AF_INET6)) 1644 return (1); 1645 return (0); 1646 case PF_ADDR_DYNIFTL: 1647 return (aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt); 1648 case PF_ADDR_NONE: 1649 case PF_ADDR_NOROUTE: 1650 case PF_ADDR_URPFFAILED: 1651 return (0); 1652 case PF_ADDR_TABLE: 1653 return (aw1->p.tbl != aw2->p.tbl); 1654 case PF_ADDR_RTLABEL: 1655 return (aw1->v.rtlabel != aw2->v.rtlabel); 1656 default: 1657 addlog("invalid address type: %d\n", aw1->type); 1658 return (1); 1659 } 1660 } 1661 1662 void 1663 pf_change_ap(struct pf_pdesc *pd, struct pf_addr *a, u_int16_t *p, 1664 struct pf_addr *an, u_int16_t pn, sa_family_t naf) 1665 { 1666 if (pd->csum_status == PF_CSUM_UNKNOWN) 1667 pf_check_proto_cksum(pd, pd->off, pd->tot_len - pd->off, 1668 pd->proto, pd->af); 1669 if (pd->af == naf) 1670 PF_ACPY(a, an, naf); 1671 if (p != NULL) 1672 *p = pn; 1673 } 1674 1675 /* Changes a u_int32_t. Uses a void * so there are no align restrictions */ 1676 void 1677 pf_change_a(struct pf_pdesc *pd, void *a, u_int32_t an) 1678 { 1679 if (pd->csum_status == PF_CSUM_UNKNOWN) 1680 pf_check_proto_cksum(pd, pd->off, pd->tot_len - pd->off, 1681 pd->proto, pd->af); 1682 memcpy(a, &an, sizeof(u_int32_t)); 1683 } 1684 1685 #ifdef INET6 1686 void 1687 pf_change_a6(struct pf_pdesc *pd, struct pf_addr *a, struct pf_addr *an) 1688 { 1689 if (pd->csum_status == PF_CSUM_UNKNOWN) 1690 pf_check_proto_cksum(pd, pd->off, pd->tot_len - pd->off, 1691 pd->proto, pd->af); 1692 PF_ACPY(a, an, AF_INET6); 1693 } 1694 #endif /* INET6 */ 1695 1696 int 1697 pf_icmp_mapping(struct pf_pdesc *pd, u_int8_t type, int *icmp_dir, int *multi, 1698 u_int16_t *virtual_id, u_int16_t *virtual_type) 1699 { 1700 /* 1701 * ICMP types marked with PF_OUT are typically responses to 1702 * PF_IN, and will match states in the opposite direction. 1703 * PF_IN ICMP types need to match a state with that type. 1704 */ 1705 *icmp_dir = PF_OUT; 1706 *multi = PF_ICMP_MULTI_LINK; 1707 1708 /* Queries (and responses) */ 1709 switch (pd->af) { 1710 #ifdef INET 1711 case AF_INET: 1712 switch (type) { 1713 case ICMP_ECHO: 1714 *icmp_dir = PF_IN; 1715 case ICMP_ECHOREPLY: 1716 *virtual_type = ICMP_ECHO; 1717 *virtual_id = pd->hdr.icmp->icmp_id; 1718 break; 1719 1720 case ICMP_TSTAMP: 1721 *icmp_dir = PF_IN; 1722 case ICMP_TSTAMPREPLY: 1723 *virtual_type = ICMP_TSTAMP; 1724 *virtual_id = pd->hdr.icmp->icmp_id; 1725 break; 1726 1727 case ICMP_IREQ: 1728 *icmp_dir = PF_IN; 1729 case ICMP_IREQREPLY: 1730 *virtual_type = ICMP_IREQ; 1731 *virtual_id = pd->hdr.icmp->icmp_id; 1732 break; 1733 1734 case ICMP_MASKREQ: 1735 *icmp_dir = PF_IN; 1736 case ICMP_MASKREPLY: 1737 *virtual_type = ICMP_MASKREQ; 1738 *virtual_id = pd->hdr.icmp->icmp_id; 1739 break; 1740 1741 case ICMP_IPV6_WHEREAREYOU: 1742 *icmp_dir = PF_IN; 1743 case ICMP_IPV6_IAMHERE: 1744 *virtual_type = ICMP_IPV6_WHEREAREYOU; 1745 *virtual_id = 0; /* Nothing sane to match on! */ 1746 break; 1747 1748 case ICMP_MOBILE_REGREQUEST: 1749 *icmp_dir = PF_IN; 1750 case ICMP_MOBILE_REGREPLY: 1751 *virtual_type = ICMP_MOBILE_REGREQUEST; 1752 *virtual_id = 0; /* Nothing sane to match on! */ 1753 break; 1754 1755 case ICMP_ROUTERSOLICIT: 1756 *icmp_dir = PF_IN; 1757 case ICMP_ROUTERADVERT: 1758 *virtual_type = ICMP_ROUTERSOLICIT; 1759 *virtual_id = 0; /* Nothing sane to match on! */ 1760 break; 1761 1762 /* These ICMP types map to other connections */ 1763 case ICMP_UNREACH: 1764 case ICMP_SOURCEQUENCH: 1765 case ICMP_REDIRECT: 1766 case ICMP_TIMXCEED: 1767 case ICMP_PARAMPROB: 1768 /* These will not be used, but set them anyway */ 1769 *icmp_dir = PF_IN; 1770 *virtual_type = type; 1771 *virtual_id = 0; 1772 HTONS(*virtual_type); 1773 return (1); /* These types match to another state */ 1774 1775 /* 1776 * All remaining ICMP types get their own states, 1777 * and will only match in one direction. 1778 */ 1779 default: 1780 *icmp_dir = PF_IN; 1781 *virtual_type = type; 1782 *virtual_id = 0; 1783 break; 1784 } 1785 break; 1786 #endif /* INET */ 1787 #ifdef INET6 1788 case AF_INET6: 1789 switch (type) { 1790 case ICMP6_ECHO_REQUEST: 1791 *icmp_dir = PF_IN; 1792 case ICMP6_ECHO_REPLY: 1793 *virtual_type = ICMP6_ECHO_REQUEST; 1794 *virtual_id = pd->hdr.icmp6->icmp6_id; 1795 break; 1796 1797 case MLD_LISTENER_QUERY: 1798 *icmp_dir = PF_IN; 1799 case MLD_LISTENER_REPORT: { 1800 struct mld_hdr *mld = (void *)pd->hdr.icmp6; 1801 u_int32_t h; 1802 1803 *virtual_type = MLD_LISTENER_QUERY; 1804 /* generate fake id for these messages */ 1805 h = mld->mld_addr.s6_addr32[0] ^ 1806 mld->mld_addr.s6_addr32[1] ^ 1807 mld->mld_addr.s6_addr32[2] ^ 1808 mld->mld_addr.s6_addr32[3]; 1809 *virtual_id = (h >> 16) ^ (h & 0xffff); 1810 break; 1811 } 1812 1813 /* 1814 * ICMP6_FQDN and ICMP6_NI query/reply are the same type as 1815 * ICMP6_WRU 1816 */ 1817 case ICMP6_WRUREQUEST: 1818 *icmp_dir = PF_IN; 1819 case ICMP6_WRUREPLY: 1820 *virtual_type = ICMP6_WRUREQUEST; 1821 *virtual_id = 0; /* Nothing sane to match on! */ 1822 break; 1823 1824 case MLD_MTRACE: 1825 *icmp_dir = PF_IN; 1826 case MLD_MTRACE_RESP: 1827 *virtual_type = MLD_MTRACE; 1828 *virtual_id = 0; /* Nothing sane to match on! */ 1829 break; 1830 1831 case ND_NEIGHBOR_SOLICIT: 1832 *icmp_dir = PF_IN; 1833 case ND_NEIGHBOR_ADVERT: { 1834 struct nd_neighbor_solicit *nd = (void *)pd->hdr.icmp6; 1835 u_int32_t h; 1836 1837 *virtual_type = ND_NEIGHBOR_SOLICIT; 1838 /* generate fake id for these messages */ 1839 h = nd->nd_ns_target.s6_addr32[0] ^ 1840 nd->nd_ns_target.s6_addr32[1] ^ 1841 nd->nd_ns_target.s6_addr32[2] ^ 1842 nd->nd_ns_target.s6_addr32[3]; 1843 *virtual_id = (h >> 16) ^ (h & 0xffff); 1844 break; 1845 } 1846 1847 /* 1848 * These ICMP types map to other connections. 1849 * ND_REDIRECT can't be in this list because the triggering 1850 * packet header is optional. 1851 */ 1852 case ICMP6_DST_UNREACH: 1853 case ICMP6_PACKET_TOO_BIG: 1854 case ICMP6_TIME_EXCEEDED: 1855 case ICMP6_PARAM_PROB: 1856 /* These will not be used, but set them anyway */ 1857 *icmp_dir = PF_IN; 1858 *virtual_type = type; 1859 *virtual_id = 0; 1860 HTONS(*virtual_type); 1861 return (1); /* These types match to another state */ 1862 /* 1863 * All remaining ICMP6 types get their own states, 1864 * and will only match in one direction. 1865 */ 1866 default: 1867 *icmp_dir = PF_IN; 1868 *virtual_type = type; 1869 *virtual_id = 0; 1870 break; 1871 } 1872 break; 1873 #endif /* INET6 */ 1874 } 1875 HTONS(*virtual_type); 1876 return (0); /* These types match to their own state */ 1877 } 1878 1879 void 1880 pf_change_icmp(struct pf_pdesc *pd, struct pf_addr *ia, u_int16_t *ip, 1881 struct pf_addr *oa, struct pf_addr *na, u_int16_t np, sa_family_t af) 1882 { 1883 if (pd->csum_status == PF_CSUM_UNKNOWN) 1884 pf_check_proto_cksum(pd, pd->off, pd->tot_len - pd->off, 1885 pd->proto, pd->af); 1886 1887 /* Change inner protocol port */ 1888 if (ip != NULL) 1889 *ip = np; 1890 1891 /* Change inner ip address */ 1892 PF_ACPY(ia, na, af); 1893 1894 /* Outer ip address, fix outer icmpv6 checksum, if necessary. */ 1895 if (oa) 1896 PF_ACPY(oa, na, af); 1897 } 1898 1899 #if INET && INET6 1900 int 1901 pf_translate_af(struct pf_pdesc *pd) 1902 { 1903 struct mbuf *mp; 1904 struct ip *ip4; 1905 struct ip6_hdr *ip6; 1906 struct icmp6_hdr *icmp; 1907 int hlen; 1908 1909 if (pd->csum_status == PF_CSUM_UNKNOWN) 1910 pf_check_proto_cksum(pd, pd->off, pd->tot_len - pd->off, 1911 pd->proto, pd->af); 1912 1913 hlen = pd->naf == AF_INET ? sizeof(*ip4) : sizeof(*ip6); 1914 1915 /* trim the old header */ 1916 m_adj(pd->m, pd->off); 1917 1918 /* prepend a new one */ 1919 if ((M_PREPEND(pd->m, hlen, M_DONTWAIT)) == NULL) 1920 return (-1); 1921 1922 switch (pd->naf) { 1923 case AF_INET: 1924 ip4 = mtod(pd->m, struct ip *); 1925 bzero(ip4, hlen); 1926 ip4->ip_v = IPVERSION; 1927 ip4->ip_hl = hlen >> 2; 1928 ip4->ip_tos = pd->tos; 1929 ip4->ip_len = htons(hlen + (pd->tot_len - pd->off)); 1930 ip4->ip_id = htons(ip_randomid()); 1931 ip4->ip_off = htons(IP_DF); 1932 ip4->ip_ttl = pd->ttl; 1933 ip4->ip_p = pd->proto; 1934 ip4->ip_src = pd->nsaddr.v4; 1935 ip4->ip_dst = pd->ndaddr.v4; 1936 break; 1937 case AF_INET6: 1938 ip6 = mtod(pd->m, struct ip6_hdr *); 1939 bzero(ip6, hlen); 1940 ip6->ip6_vfc = IPV6_VERSION; 1941 ip6->ip6_flow |= htonl((u_int32_t)pd->tos << 20); 1942 ip6->ip6_plen = htons(pd->tot_len - pd->off); 1943 ip6->ip6_nxt = pd->proto; 1944 if (!pd->ttl || pd->ttl > IPV6_DEFHLIM) 1945 ip6->ip6_hlim = IPV6_DEFHLIM; 1946 else 1947 ip6->ip6_hlim = pd->ttl; 1948 ip6->ip6_src = pd->nsaddr.v6; 1949 ip6->ip6_dst = pd->ndaddr.v6; 1950 break; 1951 default: 1952 return (-1); 1953 } 1954 1955 /* recalculate icmp/icmp6 checksums */ 1956 if (pd->proto == IPPROTO_ICMP || pd->proto == IPPROTO_ICMPV6) { 1957 int off; 1958 if ((mp = m_pulldown(pd->m, hlen, sizeof(*icmp), &off)) == 1959 NULL) { 1960 pd->m = NULL; 1961 return (-1); 1962 } 1963 icmp = (struct icmp6_hdr *)(mp->m_data + off); 1964 icmp->icmp6_cksum = 0; 1965 icmp->icmp6_cksum = pd->naf == AF_INET ? 1966 in4_cksum(pd->m, 0, hlen, ntohs(ip4->ip_len) - hlen) : 1967 in6_cksum(pd->m, IPPROTO_ICMPV6, hlen, 1968 ntohs(ip6->ip6_plen)); 1969 } 1970 1971 return (0); 1972 } 1973 1974 int 1975 pf_change_icmp_af(struct mbuf *m, int off, struct pf_pdesc *pd, 1976 struct pf_pdesc *pd2, struct pf_addr *src, struct pf_addr *dst, 1977 sa_family_t af, sa_family_t naf) 1978 { 1979 struct mbuf *n = NULL; 1980 struct ip *ip4; 1981 struct ip6_hdr *ip6; 1982 int hlen, olen, mlen; 1983 1984 if (pd->csum_status == PF_CSUM_UNKNOWN) 1985 pf_check_proto_cksum(pd, pd->off, pd->tot_len - pd->off, 1986 pd->proto, pd->af); 1987 1988 if (af == naf || (af != AF_INET && af != AF_INET6) || 1989 (naf != AF_INET && naf != AF_INET6)) 1990 return (-1); 1991 1992 /* split the mbuf chain on the inner ip/ip6 header boundary */ 1993 if ((n = m_split(m, off, M_DONTWAIT)) == NULL) 1994 return (-1); 1995 1996 /* old header */ 1997 olen = pd2->off - off; 1998 /* new header */ 1999 hlen = naf == AF_INET ? sizeof(*ip4) : sizeof(*ip6); 2000 2001 /* trim old header */ 2002 m_adj(n, olen); 2003 2004 /* prepend a new one */ 2005 if ((M_PREPEND(n, hlen, M_DONTWAIT)) == NULL) 2006 return (-1); 2007 2008 /* translate inner ip/ip6 header */ 2009 switch (naf) { 2010 case AF_INET: 2011 ip4 = mtod(n, struct ip *); 2012 bzero(ip4, sizeof(*ip4)); 2013 ip4->ip_v = IPVERSION; 2014 ip4->ip_hl = sizeof(*ip4) >> 2; 2015 ip4->ip_len = htons(sizeof(*ip4) + pd2->tot_len - olen); 2016 ip4->ip_id = htons(ip_randomid()); 2017 ip4->ip_off = htons(IP_DF); 2018 ip4->ip_ttl = pd2->ttl; 2019 if (pd2->proto == IPPROTO_ICMPV6) 2020 ip4->ip_p = IPPROTO_ICMP; 2021 else 2022 ip4->ip_p = pd2->proto; 2023 ip4->ip_src = src->v4; 2024 ip4->ip_dst = dst->v4; 2025 ip4->ip_sum = in_cksum(n, ip4->ip_hl << 2); 2026 break; 2027 case AF_INET6: 2028 ip6 = mtod(n, struct ip6_hdr *); 2029 bzero(ip6, sizeof(*ip6)); 2030 ip6->ip6_vfc = IPV6_VERSION; 2031 ip6->ip6_plen = htons(pd2->tot_len - olen); 2032 if (pd2->proto == IPPROTO_ICMP) 2033 ip6->ip6_nxt = IPPROTO_ICMPV6; 2034 else 2035 ip6->ip6_nxt = pd2->proto; 2036 if (!pd2->ttl || pd2->ttl > IPV6_DEFHLIM) 2037 ip6->ip6_hlim = IPV6_DEFHLIM; 2038 else 2039 ip6->ip6_hlim = pd2->ttl; 2040 ip6->ip6_src = src->v6; 2041 ip6->ip6_dst = dst->v6; 2042 break; 2043 } 2044 2045 /* adjust payload offset and total packet length */ 2046 pd2->off += hlen - olen; 2047 pd->tot_len += hlen - olen; 2048 2049 /* merge modified inner packet with the original header */ 2050 mlen = n->m_pkthdr.len; 2051 m_cat(m, n); 2052 m->m_pkthdr.len += mlen; 2053 2054 return (0); 2055 } 2056 2057 2058 #define PTR_IP(field) (offsetof(struct ip, field)) 2059 #define PTR_IP6(field) (offsetof(struct ip6_hdr, field)) 2060 2061 int 2062 pf_translate_icmp_af(int af, void *arg) 2063 { 2064 struct icmp *icmp4; 2065 struct icmp6_hdr *icmp6; 2066 u_int32_t mtu; 2067 int32_t ptr = -1; 2068 u_int8_t type; 2069 u_int8_t code; 2070 2071 switch (af) { 2072 case AF_INET: 2073 icmp6 = arg; 2074 type = icmp6->icmp6_type; 2075 code = icmp6->icmp6_code; 2076 mtu = ntohl(icmp6->icmp6_mtu); 2077 2078 switch (type) { 2079 case ICMP6_ECHO_REQUEST: 2080 type = ICMP_ECHO; 2081 break; 2082 case ICMP6_ECHO_REPLY: 2083 type = ICMP_ECHOREPLY; 2084 break; 2085 case ICMP6_DST_UNREACH: 2086 type = ICMP_UNREACH; 2087 switch (code) { 2088 case ICMP6_DST_UNREACH_NOROUTE: 2089 case ICMP6_DST_UNREACH_BEYONDSCOPE: 2090 case ICMP6_DST_UNREACH_ADDR: 2091 code = ICMP_UNREACH_HOST; 2092 break; 2093 case ICMP6_DST_UNREACH_ADMIN: 2094 code = ICMP_UNREACH_HOST_PROHIB; 2095 break; 2096 case ICMP6_DST_UNREACH_NOPORT: 2097 code = ICMP_UNREACH_PORT; 2098 break; 2099 default: 2100 return (-1); 2101 } 2102 break; 2103 case ICMP6_PACKET_TOO_BIG: 2104 type = ICMP_UNREACH; 2105 code = ICMP_UNREACH_NEEDFRAG; 2106 mtu -= 20; 2107 break; 2108 case ICMP6_TIME_EXCEEDED: 2109 type = ICMP_TIMXCEED; 2110 break; 2111 case ICMP6_PARAM_PROB: 2112 switch (code) { 2113 case ICMP6_PARAMPROB_HEADER: 2114 type = ICMP_PARAMPROB; 2115 code = ICMP_PARAMPROB_ERRATPTR; 2116 ptr = ntohl(icmp6->icmp6_pptr); 2117 2118 if (ptr == PTR_IP6(ip6_vfc)) 2119 ; /* preserve */ 2120 else if (ptr == PTR_IP6(ip6_vfc) + 1) 2121 ptr = PTR_IP(ip_tos); 2122 else if (ptr == PTR_IP6(ip6_plen) || 2123 ptr == PTR_IP6(ip6_plen) + 1) 2124 ptr = PTR_IP(ip_len); 2125 else if (ptr == PTR_IP6(ip6_nxt)) 2126 ptr = PTR_IP(ip_p); 2127 else if (ptr == PTR_IP6(ip6_hlim)) 2128 ptr = PTR_IP(ip_ttl); 2129 else if (ptr >= PTR_IP6(ip6_src) && 2130 ptr < PTR_IP6(ip6_dst)) 2131 ptr = PTR_IP(ip_src); 2132 else if (ptr >= PTR_IP6(ip6_dst) && 2133 ptr < sizeof(struct ip6_hdr)) 2134 ptr = PTR_IP(ip_dst); 2135 else { 2136 return (-1); 2137 } 2138 break; 2139 case ICMP6_PARAMPROB_NEXTHEADER: 2140 type = ICMP_UNREACH; 2141 code = ICMP_UNREACH_PROTOCOL; 2142 break; 2143 default: 2144 return (-1); 2145 } 2146 break; 2147 default: 2148 return (-1); 2149 } 2150 icmp6->icmp6_type = type; 2151 icmp6->icmp6_code = code; 2152 /* aligns well with a icmpv4 nextmtu */ 2153 icmp6->icmp6_mtu = htonl(mtu); 2154 /* icmpv4 pptr is a one most significant byte */ 2155 if (ptr >= 0) 2156 icmp6->icmp6_pptr = htonl(ptr << 24); 2157 break; 2158 case AF_INET6: 2159 icmp4 = arg; 2160 type = icmp4->icmp_type; 2161 code = icmp4->icmp_code; 2162 mtu = ntohs(icmp4->icmp_nextmtu); 2163 2164 switch (type) { 2165 case ICMP_ECHO: 2166 type = ICMP6_ECHO_REQUEST; 2167 break; 2168 case ICMP_ECHOREPLY: 2169 type = ICMP6_ECHO_REPLY; 2170 break; 2171 case ICMP_UNREACH: 2172 type = ICMP6_DST_UNREACH; 2173 switch (code) { 2174 case ICMP_UNREACH_NET: 2175 case ICMP_UNREACH_HOST: 2176 case ICMP_UNREACH_NET_UNKNOWN: 2177 case ICMP_UNREACH_HOST_UNKNOWN: 2178 case ICMP_UNREACH_ISOLATED: 2179 case ICMP_UNREACH_TOSNET: 2180 case ICMP_UNREACH_TOSHOST: 2181 code = ICMP6_DST_UNREACH_NOROUTE; 2182 break; 2183 case ICMP_UNREACH_PORT: 2184 code = ICMP6_DST_UNREACH_NOPORT; 2185 break; 2186 case ICMP_UNREACH_NET_PROHIB: 2187 case ICMP_UNREACH_HOST_PROHIB: 2188 case ICMP_UNREACH_FILTER_PROHIB: 2189 case ICMP_UNREACH_PRECEDENCE_CUTOFF: 2190 code = ICMP6_DST_UNREACH_ADMIN; 2191 break; 2192 case ICMP_UNREACH_PROTOCOL: 2193 type = ICMP6_PARAM_PROB; 2194 code = ICMP6_PARAMPROB_NEXTHEADER; 2195 ptr = offsetof(struct ip6_hdr, ip6_nxt); 2196 break; 2197 case ICMP_UNREACH_NEEDFRAG: 2198 type = ICMP6_PACKET_TOO_BIG; 2199 code = 0; 2200 mtu += 20; 2201 break; 2202 default: 2203 return (-1); 2204 } 2205 break; 2206 case ICMP_TIMXCEED: 2207 type = ICMP6_TIME_EXCEEDED; 2208 break; 2209 case ICMP_PARAMPROB: 2210 type = ICMP6_PARAM_PROB; 2211 switch (code) { 2212 case ICMP_PARAMPROB_ERRATPTR: 2213 code = ICMP6_PARAMPROB_HEADER; 2214 break; 2215 case ICMP_PARAMPROB_LENGTH: 2216 code = ICMP6_PARAMPROB_HEADER; 2217 break; 2218 default: 2219 return (-1); 2220 } 2221 2222 ptr = icmp4->icmp_pptr; 2223 if (ptr == 0 || ptr == PTR_IP(ip_tos)) 2224 ; /* preserve */ 2225 else if (ptr == PTR_IP(ip_len) || 2226 ptr == PTR_IP(ip_len) + 1) 2227 ptr = PTR_IP6(ip6_plen); 2228 else if (ptr == PTR_IP(ip_ttl)) 2229 ptr = PTR_IP6(ip6_hlim); 2230 else if (ptr == PTR_IP(ip_p)) 2231 ptr = PTR_IP6(ip6_nxt); 2232 else if (ptr >= PTR_IP(ip_src) && 2233 ptr < PTR_IP(ip_dst)) 2234 ptr = PTR_IP6(ip6_src); 2235 else if (ptr >= PTR_IP(ip_dst) && 2236 ptr < sizeof(struct ip)) 2237 ptr = PTR_IP6(ip6_dst); 2238 else { 2239 return (-1); 2240 } 2241 break; 2242 default: 2243 return (-1); 2244 } 2245 icmp4->icmp_type = type; 2246 icmp4->icmp_code = code; 2247 icmp4->icmp_nextmtu = htons(mtu); 2248 if (ptr >= 0) 2249 icmp4->icmp_void = htonl(ptr); 2250 break; 2251 } 2252 2253 return (0); 2254 } 2255 #endif /* INET && INET6 */ 2256 2257 /* 2258 * Need to modulate the sequence numbers in the TCP SACK option 2259 * (credits to Krzysztof Pfaff for report and patch) 2260 */ 2261 int 2262 pf_modulate_sack(struct pf_pdesc *pd, struct pf_state_peer *dst) 2263 { 2264 struct tcphdr *th = pd->hdr.tcp; 2265 int hlen = (th->th_off << 2) - sizeof(*th); 2266 int thoptlen = hlen; 2267 u_int8_t opts[MAX_TCPOPTLEN], *opt = opts; 2268 int copyback = 0, i, olen; 2269 struct sackblk sack; 2270 2271 #define TCPOLEN_SACKLEN (TCPOLEN_SACK + 2) 2272 if (hlen < TCPOLEN_SACKLEN || hlen > MAX_TCPOPTLEN || !pf_pull_hdr( 2273 pd->m, pd->off + sizeof(*th), opts, hlen, NULL, NULL, pd->af)) 2274 return 0; 2275 2276 while (hlen >= TCPOLEN_SACKLEN) { 2277 olen = opt[1]; 2278 switch (*opt) { 2279 case TCPOPT_EOL: /* FALLTHROUGH */ 2280 case TCPOPT_NOP: 2281 opt++; 2282 hlen--; 2283 break; 2284 case TCPOPT_SACK: 2285 if (olen > hlen) 2286 olen = hlen; 2287 if (olen >= TCPOLEN_SACKLEN) { 2288 for (i = 2; i + TCPOLEN_SACK <= olen; 2289 i += TCPOLEN_SACK) { 2290 memcpy(&sack, &opt[i], sizeof(sack)); 2291 pf_change_a(pd, &sack.start, 2292 htonl(ntohl(sack.start) - 2293 dst->seqdiff)); 2294 pf_change_a(pd, &sack.end, 2295 htonl(ntohl(sack.end) - 2296 dst->seqdiff)); 2297 memcpy(&opt[i], &sack, sizeof(sack)); 2298 } 2299 copyback = 1; 2300 } 2301 /* FALLTHROUGH */ 2302 default: 2303 if (olen < 2) 2304 olen = 2; 2305 hlen -= olen; 2306 opt += olen; 2307 } 2308 } 2309 2310 if (copyback) 2311 m_copyback(pd->m, pd->off + sizeof(*th), thoptlen, opts, 2312 M_NOWAIT); 2313 return (copyback); 2314 } 2315 2316 void 2317 pf_send_tcp(const struct pf_rule *r, sa_family_t af, 2318 const struct pf_addr *saddr, const struct pf_addr *daddr, 2319 u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack, 2320 u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl, int tag, 2321 u_int16_t rtag, u_int rdom, struct ether_header *eh, struct ifnet *ifp) 2322 { 2323 struct mbuf *m; 2324 int len, tlen; 2325 #ifdef INET 2326 struct ip *h; 2327 #endif /* INET */ 2328 #ifdef INET6 2329 struct ip6_hdr *h6; 2330 #endif /* INET6 */ 2331 struct tcphdr *th; 2332 char *opt; 2333 2334 /* maximum segment size tcp option */ 2335 tlen = sizeof(struct tcphdr); 2336 if (mss) 2337 tlen += 4; 2338 2339 switch (af) { 2340 #ifdef INET 2341 case AF_INET: 2342 len = sizeof(struct ip) + tlen; 2343 break; 2344 #endif /* INET */ 2345 #ifdef INET6 2346 case AF_INET6: 2347 len = sizeof(struct ip6_hdr) + tlen; 2348 break; 2349 #endif /* INET6 */ 2350 } 2351 2352 /* create outgoing mbuf */ 2353 m = m_gethdr(M_DONTWAIT, MT_HEADER); 2354 if (m == NULL) 2355 return; 2356 if (tag) 2357 m->m_pkthdr.pf.flags |= PF_TAG_GENERATED; 2358 m->m_pkthdr.pf.tag = rtag; 2359 m->m_pkthdr.ph_rtableid = rdom; 2360 if (r && (r->scrub_flags & PFSTATE_SETPRIO)) 2361 m->m_pkthdr.pf.prio = r->set_prio[0]; 2362 if (r && r->qid) 2363 m->m_pkthdr.pf.qid = r->qid; 2364 m->m_data += max_linkhdr; 2365 m->m_pkthdr.len = m->m_len = len; 2366 m->m_pkthdr.rcvif = NULL; 2367 m->m_pkthdr.csum_flags |= M_TCP_CSUM_OUT; 2368 bzero(m->m_data, len); 2369 switch (af) { 2370 #ifdef INET 2371 case AF_INET: 2372 h = mtod(m, struct ip *); 2373 h->ip_p = IPPROTO_TCP; 2374 h->ip_len = htons(tlen); 2375 h->ip_v = 4; 2376 h->ip_hl = sizeof(*h) >> 2; 2377 h->ip_tos = IPTOS_LOWDELAY; 2378 h->ip_len = htons(len); 2379 h->ip_off = htons(ip_mtudisc ? IP_DF : 0); 2380 h->ip_ttl = ttl ? ttl : ip_defttl; 2381 h->ip_sum = 0; 2382 h->ip_src.s_addr = saddr->v4.s_addr; 2383 h->ip_dst.s_addr = daddr->v4.s_addr; 2384 2385 th = (struct tcphdr *)((caddr_t)h + sizeof(struct ip)); 2386 break; 2387 #endif /* INET */ 2388 #ifdef INET6 2389 case AF_INET6: 2390 h6 = mtod(m, struct ip6_hdr *); 2391 h6->ip6_nxt = IPPROTO_TCP; 2392 h6->ip6_plen = htons(tlen); 2393 h6->ip6_vfc |= IPV6_VERSION; 2394 h6->ip6_hlim = IPV6_DEFHLIM; 2395 memcpy(&h6->ip6_src, &saddr->v6, sizeof(struct in6_addr)); 2396 memcpy(&h6->ip6_dst, &daddr->v6, sizeof(struct in6_addr)); 2397 2398 th = (struct tcphdr *)((caddr_t)h6 + sizeof(struct ip6_hdr)); 2399 break; 2400 #endif /* INET6 */ 2401 } 2402 2403 /* TCP header */ 2404 th->th_sport = sport; 2405 th->th_dport = dport; 2406 th->th_seq = htonl(seq); 2407 th->th_ack = htonl(ack); 2408 th->th_off = tlen >> 2; 2409 th->th_flags = flags; 2410 th->th_win = htons(win); 2411 2412 if (mss) { 2413 opt = (char *)(th + 1); 2414 opt[0] = TCPOPT_MAXSEG; 2415 opt[1] = 4; 2416 HTONS(mss); 2417 memcpy((opt + 2), &mss, 2); 2418 } 2419 2420 switch (af) { 2421 #ifdef INET 2422 case AF_INET: 2423 if (eh == NULL) { 2424 ip_output(m, NULL, NULL, 0, NULL, NULL, 0); 2425 } else { 2426 struct route ro; 2427 struct rtentry rt; 2428 struct ether_header *e = (void *)ro.ro_dst.sa_data; 2429 2430 if (ifp == NULL) { 2431 m_freem(m); 2432 return; 2433 } 2434 rt.rt_ifp = ifp; 2435 ro.ro_rt = &rt; 2436 ro.ro_dst.sa_len = sizeof(ro.ro_dst); 2437 ro.ro_dst.sa_family = pseudo_AF_HDRCMPLT; 2438 memcpy(e->ether_shost, eh->ether_dhost, ETHER_ADDR_LEN); 2439 memcpy(e->ether_dhost, eh->ether_shost, ETHER_ADDR_LEN); 2440 e->ether_type = eh->ether_type; 2441 ip_output(m, NULL, &ro, IP_ROUTETOETHER, NULL, NULL, 0); 2442 } 2443 break; 2444 #endif /* INET */ 2445 #ifdef INET6 2446 case AF_INET6: 2447 ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL); 2448 break; 2449 #endif /* INET6 */ 2450 } 2451 } 2452 2453 void 2454 pf_send_icmp(struct mbuf *m, u_int8_t type, u_int8_t code, sa_family_t af, 2455 struct pf_rule *r, u_int rdomain) 2456 { 2457 struct mbuf *m0; 2458 2459 if ((m0 = m_copy(m, 0, M_COPYALL)) == NULL) 2460 return; 2461 2462 m0->m_pkthdr.pf.flags |= PF_TAG_GENERATED; 2463 m0->m_pkthdr.ph_rtableid = rdomain; 2464 if (r && (r->scrub_flags & PFSTATE_SETPRIO)) 2465 m0->m_pkthdr.pf.prio = r->set_prio[0]; 2466 if (r && r->qid) 2467 m0->m_pkthdr.pf.qid = r->qid; 2468 2469 switch (af) { 2470 #ifdef INET 2471 case AF_INET: 2472 icmp_error(m0, type, code, 0, 0); 2473 break; 2474 #endif /* INET */ 2475 #ifdef INET6 2476 case AF_INET6: 2477 icmp6_error(m0, type, code, 0); 2478 break; 2479 #endif /* INET6 */ 2480 } 2481 } 2482 2483 /* 2484 * Return 1 if the addresses a and b match (with mask m), otherwise return 0. 2485 * If n is 0, they match if they are equal. If n is != 0, they match if they 2486 * are different. 2487 */ 2488 int 2489 pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m, 2490 struct pf_addr *b, sa_family_t af) 2491 { 2492 int match = 0; 2493 2494 switch (af) { 2495 #ifdef INET 2496 case AF_INET: 2497 if ((a->addr32[0] & m->addr32[0]) == 2498 (b->addr32[0] & m->addr32[0])) 2499 match++; 2500 break; 2501 #endif /* INET */ 2502 #ifdef INET6 2503 case AF_INET6: 2504 if (((a->addr32[0] & m->addr32[0]) == 2505 (b->addr32[0] & m->addr32[0])) && 2506 ((a->addr32[1] & m->addr32[1]) == 2507 (b->addr32[1] & m->addr32[1])) && 2508 ((a->addr32[2] & m->addr32[2]) == 2509 (b->addr32[2] & m->addr32[2])) && 2510 ((a->addr32[3] & m->addr32[3]) == 2511 (b->addr32[3] & m->addr32[3]))) 2512 match++; 2513 break; 2514 #endif /* INET6 */ 2515 } 2516 if (match) { 2517 if (n) 2518 return (0); 2519 else 2520 return (1); 2521 } else { 2522 if (n) 2523 return (1); 2524 else 2525 return (0); 2526 } 2527 } 2528 2529 /* 2530 * Return 1 if b <= a <= e, otherwise return 0. 2531 */ 2532 int 2533 pf_match_addr_range(struct pf_addr *b, struct pf_addr *e, 2534 struct pf_addr *a, sa_family_t af) 2535 { 2536 switch (af) { 2537 #ifdef INET 2538 case AF_INET: 2539 if ((ntohl(a->addr32[0]) < ntohl(b->addr32[0])) || 2540 (ntohl(a->addr32[0]) > ntohl(e->addr32[0]))) 2541 return (0); 2542 break; 2543 #endif /* INET */ 2544 #ifdef INET6 2545 case AF_INET6: { 2546 int i; 2547 2548 /* check a >= b */ 2549 for (i = 0; i < 4; ++i) 2550 if (ntohl(a->addr32[i]) > ntohl(b->addr32[i])) 2551 break; 2552 else if (ntohl(a->addr32[i]) < ntohl(b->addr32[i])) 2553 return (0); 2554 /* check a <= e */ 2555 for (i = 0; i < 4; ++i) 2556 if (ntohl(a->addr32[i]) < ntohl(e->addr32[i])) 2557 break; 2558 else if (ntohl(a->addr32[i]) > ntohl(e->addr32[i])) 2559 return (0); 2560 break; 2561 } 2562 #endif /* INET6 */ 2563 } 2564 return (1); 2565 } 2566 2567 int 2568 pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p) 2569 { 2570 switch (op) { 2571 case PF_OP_IRG: 2572 return ((p > a1) && (p < a2)); 2573 case PF_OP_XRG: 2574 return ((p < a1) || (p > a2)); 2575 case PF_OP_RRG: 2576 return ((p >= a1) && (p <= a2)); 2577 case PF_OP_EQ: 2578 return (p == a1); 2579 case PF_OP_NE: 2580 return (p != a1); 2581 case PF_OP_LT: 2582 return (p < a1); 2583 case PF_OP_LE: 2584 return (p <= a1); 2585 case PF_OP_GT: 2586 return (p > a1); 2587 case PF_OP_GE: 2588 return (p >= a1); 2589 } 2590 return (0); /* never reached */ 2591 } 2592 2593 int 2594 pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p) 2595 { 2596 NTOHS(a1); 2597 NTOHS(a2); 2598 NTOHS(p); 2599 return (pf_match(op, a1, a2, p)); 2600 } 2601 2602 int 2603 pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u) 2604 { 2605 if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE) 2606 return (0); 2607 return (pf_match(op, a1, a2, u)); 2608 } 2609 2610 int 2611 pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g) 2612 { 2613 if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE) 2614 return (0); 2615 return (pf_match(op, a1, a2, g)); 2616 } 2617 2618 int 2619 pf_match_tag(struct mbuf *m, struct pf_rule *r, int *tag) 2620 { 2621 if (*tag == -1) 2622 *tag = m->m_pkthdr.pf.tag; 2623 2624 return ((!r->match_tag_not && r->match_tag == *tag) || 2625 (r->match_tag_not && r->match_tag != *tag)); 2626 } 2627 2628 int 2629 pf_match_rcvif(struct mbuf *m, struct pf_rule *r) 2630 { 2631 struct ifnet *ifp = m->m_pkthdr.rcvif; 2632 struct pfi_kif *kif; 2633 2634 if (ifp == NULL) 2635 return (0); 2636 2637 if (ifp->if_type == IFT_CARP && ifp->if_carpdev) 2638 kif = (struct pfi_kif *)ifp->if_carpdev->if_pf_kif; 2639 else 2640 kif = (struct pfi_kif *)ifp->if_pf_kif; 2641 2642 if (kif == NULL) { 2643 DPFPRINTF(LOG_ERR, 2644 "pf_test_via: kif == NULL, @%d via %s", 2645 r->nr, r->rcv_ifname); 2646 return (0); 2647 } 2648 2649 return (pfi_kif_match(r->rcv_kif, kif)); 2650 } 2651 2652 void 2653 pf_tag_packet(struct mbuf *m, int tag, int rtableid) 2654 { 2655 if (tag > 0) 2656 m->m_pkthdr.pf.tag = tag; 2657 if (rtableid >= 0) 2658 m->m_pkthdr.ph_rtableid = rtableid; 2659 } 2660 2661 void 2662 pf_step_into_anchor(int *depth, struct pf_ruleset **rs, 2663 struct pf_rule **r, struct pf_rule **a) 2664 { 2665 struct pf_anchor_stackframe *f; 2666 2667 if (*depth >= sizeof(pf_anchor_stack) / 2668 sizeof(pf_anchor_stack[0])) { 2669 log(LOG_ERR, "pf_step_into_anchor: stack overflow\n"); 2670 *r = TAILQ_NEXT(*r, entries); 2671 return; 2672 } else if (*depth == 0 && a != NULL) 2673 *a = *r; 2674 f = pf_anchor_stack + (*depth)++; 2675 f->rs = *rs; 2676 f->r = *r; 2677 if ((*r)->anchor_wildcard) { 2678 f->parent = &(*r)->anchor->children; 2679 if ((f->child = RB_MIN(pf_anchor_node, f->parent)) == NULL) { 2680 *r = NULL; 2681 return; 2682 } 2683 *rs = &f->child->ruleset; 2684 } else { 2685 f->parent = NULL; 2686 f->child = NULL; 2687 *rs = &(*r)->anchor->ruleset; 2688 } 2689 *r = TAILQ_FIRST((*rs)->rules.active.ptr); 2690 } 2691 2692 int 2693 pf_step_out_of_anchor(int *depth, struct pf_ruleset **rs, 2694 struct pf_rule **r, struct pf_rule **a, int *match) 2695 { 2696 struct pf_anchor_stackframe *f; 2697 int quick = 0; 2698 2699 do { 2700 if (*depth <= 0) 2701 break; 2702 f = pf_anchor_stack + *depth - 1; 2703 if (f->parent != NULL && f->child != NULL) { 2704 f->child = RB_NEXT(pf_anchor_node, f->parent, f->child); 2705 if (f->child != NULL) { 2706 *rs = &f->child->ruleset; 2707 *r = TAILQ_FIRST((*rs)->rules.active.ptr); 2708 if (*r == NULL) 2709 continue; 2710 else 2711 break; 2712 } 2713 } 2714 (*depth)--; 2715 if (*depth == 0 && a != NULL) 2716 *a = NULL; 2717 *rs = f->rs; 2718 if (*match > *depth) { 2719 *match = *depth; 2720 if (f->r->quick) 2721 quick = 1; 2722 } 2723 *r = TAILQ_NEXT(f->r, entries); 2724 } while (*r == NULL); 2725 2726 return (quick); 2727 } 2728 2729 #ifdef INET6 2730 void 2731 pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr, 2732 struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af) 2733 { 2734 switch (af) { 2735 #ifdef INET 2736 case AF_INET: 2737 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) | 2738 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]); 2739 break; 2740 #endif /* INET */ 2741 case AF_INET6: 2742 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) | 2743 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]); 2744 naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) | 2745 ((rmask->addr32[1] ^ 0xffffffff ) & saddr->addr32[1]); 2746 naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) | 2747 ((rmask->addr32[2] ^ 0xffffffff ) & saddr->addr32[2]); 2748 naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) | 2749 ((rmask->addr32[3] ^ 0xffffffff ) & saddr->addr32[3]); 2750 break; 2751 } 2752 } 2753 2754 void 2755 pf_addr_inc(struct pf_addr *addr, sa_family_t af) 2756 { 2757 switch (af) { 2758 #ifdef INET 2759 case AF_INET: 2760 addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1); 2761 break; 2762 #endif /* INET */ 2763 case AF_INET6: 2764 if (addr->addr32[3] == 0xffffffff) { 2765 addr->addr32[3] = 0; 2766 if (addr->addr32[2] == 0xffffffff) { 2767 addr->addr32[2] = 0; 2768 if (addr->addr32[1] == 0xffffffff) { 2769 addr->addr32[1] = 0; 2770 addr->addr32[0] = 2771 htonl(ntohl(addr->addr32[0]) + 1); 2772 } else 2773 addr->addr32[1] = 2774 htonl(ntohl(addr->addr32[1]) + 1); 2775 } else 2776 addr->addr32[2] = 2777 htonl(ntohl(addr->addr32[2]) + 1); 2778 } else 2779 addr->addr32[3] = 2780 htonl(ntohl(addr->addr32[3]) + 1); 2781 break; 2782 } 2783 } 2784 #endif /* INET6 */ 2785 2786 int 2787 pf_socket_lookup(struct pf_pdesc *pd) 2788 { 2789 struct pf_addr *saddr, *daddr; 2790 u_int16_t sport, dport; 2791 struct inpcbtable *tb; 2792 struct inpcb *inp; 2793 2794 if (pd == NULL) 2795 return (-1); 2796 pd->lookup.uid = UID_MAX; 2797 pd->lookup.gid = GID_MAX; 2798 pd->lookup.pid = NO_PID; 2799 switch (pd->proto) { 2800 case IPPROTO_TCP: 2801 if (pd->hdr.tcp == NULL) 2802 return (-1); 2803 sport = pd->hdr.tcp->th_sport; 2804 dport = pd->hdr.tcp->th_dport; 2805 tb = &tcbtable; 2806 break; 2807 case IPPROTO_UDP: 2808 if (pd->hdr.udp == NULL) 2809 return (-1); 2810 sport = pd->hdr.udp->uh_sport; 2811 dport = pd->hdr.udp->uh_dport; 2812 tb = &udbtable; 2813 break; 2814 default: 2815 return (-1); 2816 } 2817 if (pd->dir == PF_IN) { 2818 saddr = pd->src; 2819 daddr = pd->dst; 2820 } else { 2821 u_int16_t p; 2822 2823 p = sport; 2824 sport = dport; 2825 dport = p; 2826 saddr = pd->dst; 2827 daddr = pd->src; 2828 } 2829 switch (pd->af) { 2830 #ifdef INET 2831 case AF_INET: 2832 /* 2833 * Fails when rtable is changed while evaluating the ruleset 2834 * The socket looked up will not match the one hit in the end. 2835 */ 2836 inp = in_pcbhashlookup(tb, saddr->v4, sport, daddr->v4, dport, 2837 pd->rdomain); 2838 if (inp == NULL) { 2839 inp = in_pcblookup_listen(tb, daddr->v4, dport, 0, 2840 NULL, pd->rdomain); 2841 if (inp == NULL) 2842 return (-1); 2843 } 2844 break; 2845 #endif /* INET */ 2846 #ifdef INET6 2847 case AF_INET6: 2848 inp = in6_pcbhashlookup(tb, &saddr->v6, sport, &daddr->v6, 2849 dport, pd->rdomain); 2850 if (inp == NULL) { 2851 inp = in6_pcblookup_listen(tb, &daddr->v6, dport, 0, 2852 NULL, pd->rdomain); 2853 if (inp == NULL) 2854 return (-1); 2855 } 2856 break; 2857 #endif /* INET6 */ 2858 } 2859 pd->lookup.uid = inp->inp_socket->so_euid; 2860 pd->lookup.gid = inp->inp_socket->so_egid; 2861 pd->lookup.pid = inp->inp_socket->so_cpid; 2862 return (1); 2863 } 2864 2865 u_int8_t 2866 pf_get_wscale(struct pf_pdesc *pd) 2867 { 2868 struct tcphdr *th = pd->hdr.tcp; 2869 int hlen; 2870 u_int8_t hdr[60]; 2871 u_int8_t *opt, optlen; 2872 u_int8_t wscale = 0; 2873 2874 hlen = th->th_off << 2; /* hlen <= sizeof(hdr) */ 2875 if (hlen <= sizeof(struct tcphdr)) 2876 return (0); 2877 if (!pf_pull_hdr(pd->m, pd->off, hdr, hlen, NULL, NULL, pd->af)) 2878 return (0); 2879 opt = hdr + sizeof(struct tcphdr); 2880 hlen -= sizeof(struct tcphdr); 2881 while (hlen >= 3) { 2882 switch (*opt) { 2883 case TCPOPT_EOL: 2884 case TCPOPT_NOP: 2885 ++opt; 2886 --hlen; 2887 break; 2888 case TCPOPT_WINDOW: 2889 wscale = opt[2]; 2890 if (wscale > TCP_MAX_WINSHIFT) 2891 wscale = TCP_MAX_WINSHIFT; 2892 wscale |= PF_WSCALE_FLAG; 2893 /* FALLTHROUGH */ 2894 default: 2895 optlen = opt[1]; 2896 if (optlen < 2) 2897 optlen = 2; 2898 hlen -= optlen; 2899 opt += optlen; 2900 break; 2901 } 2902 } 2903 return (wscale); 2904 } 2905 2906 u_int16_t 2907 pf_get_mss(struct pf_pdesc *pd) 2908 { 2909 struct tcphdr *th = pd->hdr.tcp; 2910 int hlen; 2911 u_int8_t hdr[60]; 2912 u_int8_t *opt, optlen; 2913 u_int16_t mss = tcp_mssdflt; 2914 2915 hlen = th->th_off << 2; /* hlen <= sizeof(hdr) */ 2916 if (hlen <= sizeof(struct tcphdr)) 2917 return (0); 2918 if (!pf_pull_hdr(pd->m, pd->off, hdr, hlen, NULL, NULL, pd->af)) 2919 return (0); 2920 opt = hdr + sizeof(struct tcphdr); 2921 hlen -= sizeof(struct tcphdr); 2922 while (hlen >= TCPOLEN_MAXSEG) { 2923 switch (*opt) { 2924 case TCPOPT_EOL: 2925 case TCPOPT_NOP: 2926 ++opt; 2927 --hlen; 2928 break; 2929 case TCPOPT_MAXSEG: 2930 memcpy(&mss, (opt + 2), 2); 2931 NTOHS(mss); 2932 /* FALLTHROUGH */ 2933 default: 2934 optlen = opt[1]; 2935 if (optlen < 2) 2936 optlen = 2; 2937 hlen -= optlen; 2938 opt += optlen; 2939 break; 2940 } 2941 } 2942 return (mss); 2943 } 2944 2945 u_int16_t 2946 pf_calc_mss(struct pf_addr *addr, sa_family_t af, int rtableid, u_int16_t offer) 2947 { 2948 #ifdef INET 2949 struct sockaddr_in *dst; 2950 struct route ro; 2951 #endif /* INET */ 2952 #ifdef INET6 2953 struct sockaddr_in6 *dst6; 2954 struct route_in6 ro6; 2955 #endif /* INET6 */ 2956 struct rtentry *rt = NULL; 2957 int hlen; 2958 u_int16_t mss = tcp_mssdflt; 2959 2960 switch (af) { 2961 #ifdef INET 2962 case AF_INET: 2963 hlen = sizeof(struct ip); 2964 bzero(&ro, sizeof(ro)); 2965 dst = (struct sockaddr_in *)&ro.ro_dst; 2966 dst->sin_family = AF_INET; 2967 dst->sin_len = sizeof(*dst); 2968 dst->sin_addr = addr->v4; 2969 ro.ro_tableid = rtableid; 2970 rtalloc_noclone(&ro); 2971 rt = ro.ro_rt; 2972 break; 2973 #endif /* INET */ 2974 #ifdef INET6 2975 case AF_INET6: 2976 hlen = sizeof(struct ip6_hdr); 2977 bzero(&ro6, sizeof(ro6)); 2978 dst6 = (struct sockaddr_in6 *)&ro6.ro_dst; 2979 dst6->sin6_family = AF_INET6; 2980 dst6->sin6_len = sizeof(*dst6); 2981 dst6->sin6_addr = addr->v6; 2982 ro6.ro_tableid = rtableid; 2983 rtalloc_noclone((struct route *)&ro6); 2984 rt = ro6.ro_rt; 2985 break; 2986 #endif /* INET6 */ 2987 } 2988 2989 if (rt && rt->rt_ifp) { 2990 mss = rt->rt_ifp->if_mtu - hlen - sizeof(struct tcphdr); 2991 mss = max(tcp_mssdflt, mss); 2992 RTFREE(rt); 2993 } 2994 mss = min(mss, offer); 2995 mss = max(mss, 64); /* sanity - at least max opt space */ 2996 return (mss); 2997 } 2998 2999 void 3000 pf_set_rt_ifp(struct pf_state *s, struct pf_addr *saddr) 3001 { 3002 struct pf_rule *r = s->rule.ptr; 3003 struct pf_src_node *sns[PF_SN_MAX]; 3004 3005 s->rt_kif = NULL; 3006 if (!r->rt) 3007 return; 3008 bzero(sns, sizeof(sns)); 3009 switch (s->key[PF_SK_WIRE]->af) { 3010 #ifdef INET 3011 case AF_INET: 3012 pf_map_addr(AF_INET, r, saddr, &s->rt_addr, NULL, sns, 3013 &r->route, PF_SN_ROUTE); 3014 s->rt_kif = r->route.kif; 3015 s->natrule.ptr = r; 3016 break; 3017 #endif /* INET */ 3018 #ifdef INET6 3019 case AF_INET6: 3020 pf_map_addr(AF_INET6, r, saddr, &s->rt_addr, NULL, sns, 3021 &r->route, PF_SN_ROUTE); 3022 s->rt_kif = r->route.kif; 3023 s->natrule.ptr = r; 3024 break; 3025 #endif /* INET6 */ 3026 } 3027 } 3028 3029 u_int32_t 3030 pf_tcp_iss(struct pf_pdesc *pd) 3031 { 3032 MD5_CTX ctx; 3033 u_int32_t digest[4]; 3034 3035 if (pf_tcp_secret_init == 0) { 3036 arc4random_buf(pf_tcp_secret, sizeof(pf_tcp_secret)); 3037 MD5Init(&pf_tcp_secret_ctx); 3038 MD5Update(&pf_tcp_secret_ctx, pf_tcp_secret, 3039 sizeof(pf_tcp_secret)); 3040 pf_tcp_secret_init = 1; 3041 } 3042 ctx = pf_tcp_secret_ctx; 3043 3044 MD5Update(&ctx, (char *)&pd->hdr.tcp->th_sport, sizeof(u_short)); 3045 MD5Update(&ctx, (char *)&pd->hdr.tcp->th_dport, sizeof(u_short)); 3046 switch (pd->af) { 3047 #ifdef INET 3048 case AF_INET: 3049 MD5Update(&ctx, (char *)&pd->src->v4, sizeof(struct in_addr)); 3050 MD5Update(&ctx, (char *)&pd->dst->v4, sizeof(struct in_addr)); 3051 break; 3052 #endif /* INET */ 3053 #ifdef INET6 3054 case AF_INET6: 3055 MD5Update(&ctx, (char *)&pd->src->v6, sizeof(struct in6_addr)); 3056 MD5Update(&ctx, (char *)&pd->dst->v6, sizeof(struct in6_addr)); 3057 break; 3058 #endif /* INET6 */ 3059 } 3060 MD5Final((u_char *)digest, &ctx); 3061 pf_tcp_iss_off += 4096; 3062 return (digest[0] + tcp_iss + pf_tcp_iss_off); 3063 } 3064 3065 void 3066 pf_rule_to_actions(struct pf_rule *r, struct pf_rule_actions *a) 3067 { 3068 if (r->qid) 3069 a->qid = r->qid; 3070 if (r->pqid) 3071 a->pqid = r->pqid; 3072 if (r->rtableid >= 0) 3073 a->rtableid = r->rtableid; 3074 a->log |= r->log; 3075 if (r->scrub_flags & PFSTATE_SETTOS) 3076 a->set_tos = r->set_tos; 3077 if (r->min_ttl) 3078 a->min_ttl = r->min_ttl; 3079 if (r->max_mss) 3080 a->max_mss = r->max_mss; 3081 a->flags |= (r->scrub_flags & (PFSTATE_NODF|PFSTATE_RANDOMID| 3082 PFSTATE_SETTOS|PFSTATE_SCRUB_TCP|PFSTATE_SETPRIO)); 3083 if (r->scrub_flags & PFSTATE_SETPRIO) { 3084 a->set_prio[0] = r->set_prio[0]; 3085 a->set_prio[1] = r->set_prio[1]; 3086 } 3087 } 3088 3089 #define PF_TEST_ATTRIB(t, a) \ 3090 do { \ 3091 if (t) { \ 3092 r = a; \ 3093 goto nextrule; \ 3094 } \ 3095 } while (0) 3096 3097 int 3098 pf_test_rule(struct pf_pdesc *pd, struct pf_rule **rm, struct pf_state **sm, 3099 struct pf_rule **am, struct pf_ruleset **rsm) 3100 { 3101 struct pf_rule *r; 3102 struct pf_rule *nr = NULL; 3103 struct pf_rule *a = NULL; 3104 struct pf_ruleset *ruleset = NULL; 3105 struct pf_rule_slist rules; 3106 struct pf_rule_item *ri; 3107 struct pf_src_node *sns[PF_SN_MAX]; 3108 struct tcphdr *th = pd->hdr.tcp; 3109 struct pf_state_key *skw = NULL, *sks = NULL; 3110 struct pf_rule_actions act; 3111 struct ifqueue *ifq = &ipintrq; 3112 u_short reason; 3113 int rewrite = 0; 3114 int tag = -1; 3115 int asd = 0; 3116 int match = 0; 3117 int state_icmp = 0, icmp_dir, multi; 3118 u_int16_t virtual_type, virtual_id; 3119 u_int8_t icmptype = 0, icmpcode = 0; 3120 3121 bzero(&act, sizeof(act)); 3122 bzero(sns, sizeof(sns)); 3123 act.rtableid = pd->rdomain; 3124 SLIST_INIT(&rules); 3125 3126 #ifdef INET6 3127 if (pd->af == AF_INET6) 3128 ifq = &ip6intrq; 3129 #endif 3130 3131 if (pd->dir == PF_IN && pf_check_congestion(ifq)) { 3132 REASON_SET(&reason, PFRES_CONGEST); 3133 return (PF_DROP); 3134 } 3135 3136 switch (pd->virtual_proto) { 3137 #ifdef INET 3138 case IPPROTO_ICMP: 3139 icmptype = pd->hdr.icmp->icmp_type; 3140 icmpcode = pd->hdr.icmp->icmp_code; 3141 state_icmp = pf_icmp_mapping(pd, icmptype, 3142 &icmp_dir, &multi, &virtual_id, &virtual_type); 3143 if (icmp_dir == PF_IN) { 3144 pd->osport = pd->nsport = virtual_id; 3145 pd->odport = pd->ndport = virtual_type; 3146 } else { 3147 pd->osport = pd->nsport = virtual_type; 3148 pd->odport = pd->ndport = virtual_id; 3149 } 3150 break; 3151 #endif /* INET */ 3152 #ifdef INET6 3153 case IPPROTO_ICMPV6: 3154 icmptype = pd->hdr.icmp6->icmp6_type; 3155 icmpcode = pd->hdr.icmp6->icmp6_code; 3156 state_icmp = pf_icmp_mapping(pd, icmptype, 3157 &icmp_dir, &multi, &virtual_id, &virtual_type); 3158 if (icmp_dir == PF_IN) { 3159 pd->osport = pd->nsport = virtual_id; 3160 pd->odport = pd->ndport = virtual_type; 3161 } else { 3162 pd->osport = pd->nsport = virtual_type; 3163 pd->odport = pd->ndport = virtual_id; 3164 } 3165 break; 3166 #endif /* INET6 */ 3167 } 3168 3169 r = TAILQ_FIRST(pf_main_ruleset.rules.active.ptr); 3170 while (r != NULL) { 3171 r->evaluations++; 3172 PF_TEST_ATTRIB((pfi_kif_match(r->kif, pd->kif) == r->ifnot), 3173 r->skip[PF_SKIP_IFP].ptr); 3174 PF_TEST_ATTRIB((r->direction && r->direction != pd->dir), 3175 r->skip[PF_SKIP_DIR].ptr); 3176 PF_TEST_ATTRIB((r->onrdomain >= 0 && 3177 (r->onrdomain == pd->rdomain) == r->ifnot), 3178 r->skip[PF_SKIP_RDOM].ptr); 3179 PF_TEST_ATTRIB((r->af && r->af != pd->af), 3180 r->skip[PF_SKIP_AF].ptr); 3181 PF_TEST_ATTRIB((r->proto && r->proto != pd->proto), 3182 r->skip[PF_SKIP_PROTO].ptr); 3183 PF_TEST_ATTRIB((PF_MISMATCHAW(&r->src.addr, &pd->nsaddr, 3184 pd->naf, r->src.neg, pd->kif, act.rtableid)), 3185 r->skip[PF_SKIP_SRC_ADDR].ptr); 3186 PF_TEST_ATTRIB((PF_MISMATCHAW(&r->dst.addr, &pd->ndaddr, pd->af, 3187 r->dst.neg, NULL, act.rtableid)), 3188 r->skip[PF_SKIP_DST_ADDR].ptr); 3189 3190 switch (pd->virtual_proto) { 3191 case PF_VPROTO_FRAGMENT: 3192 /* tcp/udp only. port_op always 0 in other cases */ 3193 PF_TEST_ATTRIB((r->src.port_op || r->dst.port_op), 3194 TAILQ_NEXT(r, entries)); 3195 PF_TEST_ATTRIB((pd->proto == IPPROTO_TCP && r->flagset), 3196 TAILQ_NEXT(r, entries)); 3197 /* icmp only. type/code always 0 in other cases */ 3198 PF_TEST_ATTRIB((r->type || r->code), 3199 TAILQ_NEXT(r, entries)); 3200 /* tcp/udp only. {uid|gid}.op always 0 in other cases */ 3201 PF_TEST_ATTRIB((r->gid.op || r->uid.op), 3202 TAILQ_NEXT(r, entries)); 3203 break; 3204 3205 case IPPROTO_TCP: 3206 PF_TEST_ATTRIB(((r->flagset & th->th_flags) != 3207 r->flags), 3208 TAILQ_NEXT(r, entries)); 3209 PF_TEST_ATTRIB((r->os_fingerprint != PF_OSFP_ANY && 3210 !pf_osfp_match(pf_osfp_fingerprint(pd), 3211 r->os_fingerprint)), 3212 TAILQ_NEXT(r, entries)); 3213 /* FALLTHROUGH */ 3214 3215 case IPPROTO_UDP: 3216 /* tcp/udp only. port_op always 0 in other cases */ 3217 PF_TEST_ATTRIB((r->src.port_op && 3218 !pf_match_port(r->src.port_op, r->src.port[0], 3219 r->src.port[1], pd->nsport)), 3220 r->skip[PF_SKIP_SRC_PORT].ptr); 3221 PF_TEST_ATTRIB((r->dst.port_op && 3222 !pf_match_port(r->dst.port_op, r->dst.port[0], 3223 r->dst.port[1], pd->ndport)), 3224 r->skip[PF_SKIP_DST_PORT].ptr); 3225 /* tcp/udp only. uid.op always 0 in other cases */ 3226 PF_TEST_ATTRIB((r->uid.op && (pd->lookup.done || 3227 (pd->lookup.done = 3228 pf_socket_lookup(pd), 1)) && 3229 !pf_match_uid(r->uid.op, r->uid.uid[0], 3230 r->uid.uid[1], pd->lookup.uid)), 3231 TAILQ_NEXT(r, entries)); 3232 /* tcp/udp only. gid.op always 0 in other cases */ 3233 PF_TEST_ATTRIB((r->gid.op && (pd->lookup.done || 3234 (pd->lookup.done = 3235 pf_socket_lookup(pd), 1)) && 3236 !pf_match_gid(r->gid.op, r->gid.gid[0], 3237 r->gid.gid[1], pd->lookup.gid)), 3238 TAILQ_NEXT(r, entries)); 3239 break; 3240 3241 case IPPROTO_ICMP: 3242 case IPPROTO_ICMPV6: 3243 /* icmp only. type always 0 in other cases */ 3244 PF_TEST_ATTRIB((r->type && r->type != icmptype + 1), 3245 TAILQ_NEXT(r, entries)); 3246 /* icmp only. type always 0 in other cases */ 3247 PF_TEST_ATTRIB((r->code && r->code != icmpcode + 1), 3248 TAILQ_NEXT(r, entries)); 3249 break; 3250 3251 default: 3252 break; 3253 } 3254 3255 PF_TEST_ATTRIB((r->rule_flag & PFRULE_FRAGMENT && 3256 pd->virtual_proto != PF_VPROTO_FRAGMENT), 3257 TAILQ_NEXT(r, entries)); 3258 PF_TEST_ATTRIB((r->tos && !(r->tos == pd->tos)), 3259 TAILQ_NEXT(r, entries)); 3260 PF_TEST_ATTRIB((r->prob && 3261 r->prob <= arc4random_uniform(UINT_MAX - 1) + 1), 3262 TAILQ_NEXT(r, entries)); 3263 PF_TEST_ATTRIB((r->match_tag && !pf_match_tag(pd->m, r, &tag)), 3264 TAILQ_NEXT(r, entries)); 3265 PF_TEST_ATTRIB((r->rcv_kif && pf_match_rcvif(pd->m, r) == 3266 r->rcvifnot), 3267 TAILQ_NEXT(r, entries)); 3268 3269 /* FALLTHROUGH */ 3270 if (r->tag) 3271 tag = r->tag; 3272 if (r->anchor == NULL) { 3273 if (r->action == PF_MATCH) { 3274 if ((ri = pool_get(&pf_rule_item_pl, 3275 PR_NOWAIT)) == NULL) { 3276 REASON_SET(&reason, PFRES_MEMORY); 3277 goto cleanup; 3278 } 3279 ri->r = r; 3280 /* order is irrelevant */ 3281 SLIST_INSERT_HEAD(&rules, ri, entry); 3282 pf_rule_to_actions(r, &act); 3283 if (r->rule_flag & PFRULE_AFTO) 3284 pd->naf = r->naf; 3285 if (pf_get_transaddr(r, pd, sns, &nr) == -1) { 3286 REASON_SET(&reason, PFRES_TRANSLATE); 3287 goto cleanup; 3288 } 3289 if (r->log || act.log & PF_LOG_MATCHES) { 3290 REASON_SET(&reason, PFRES_MATCH); 3291 PFLOG_PACKET(pd, reason, r, a, ruleset); 3292 } 3293 } else { 3294 match = asd; 3295 *rm = r; 3296 *am = a; 3297 *rsm = ruleset; 3298 if (act.log & PF_LOG_MATCHES) { 3299 REASON_SET(&reason, PFRES_MATCH); 3300 PFLOG_PACKET(pd, reason, r, a, ruleset); 3301 } 3302 } 3303 3304 if (r->quick) 3305 break; 3306 r = TAILQ_NEXT(r, entries); 3307 } else 3308 pf_step_into_anchor(&asd, &ruleset, &r, &a); 3309 3310 nextrule: 3311 if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset, 3312 &r, &a, &match)) 3313 break; 3314 } 3315 r = *rm; 3316 a = *am; 3317 ruleset = *rsm; 3318 3319 /* apply actions for last matching pass/block rule */ 3320 pf_rule_to_actions(r, &act); 3321 if (r->rule_flag & PFRULE_AFTO) 3322 pd->naf = r->naf; 3323 if (pf_get_transaddr(r, pd, sns, &nr) == -1) { 3324 REASON_SET(&reason, PFRES_TRANSLATE); 3325 goto cleanup; 3326 } 3327 REASON_SET(&reason, PFRES_MATCH); 3328 3329 if (r->log || act.log & PF_LOG_MATCHES) 3330 PFLOG_PACKET(pd, reason, r, a, ruleset); 3331 3332 if (pd->virtual_proto != PF_VPROTO_FRAGMENT && 3333 (r->action == PF_DROP) && 3334 ((r->rule_flag & PFRULE_RETURNRST) || 3335 (r->rule_flag & PFRULE_RETURNICMP) || 3336 (r->rule_flag & PFRULE_RETURN))) { 3337 if (pd->proto == IPPROTO_TCP && 3338 ((r->rule_flag & PFRULE_RETURNRST) || 3339 (r->rule_flag & PFRULE_RETURN)) && 3340 !(th->th_flags & TH_RST)) { 3341 u_int32_t ack = ntohl(th->th_seq) + pd->p_len; 3342 3343 if (pf_check_proto_cksum(pd, pd->off, 3344 pd->tot_len - pd->off, IPPROTO_TCP, pd->af)) 3345 REASON_SET(&reason, PFRES_PROTCKSUM); 3346 else { 3347 if (th->th_flags & TH_SYN) 3348 ack++; 3349 if (th->th_flags & TH_FIN) 3350 ack++; 3351 pf_send_tcp(r, pd->af, pd->dst, 3352 pd->src, th->th_dport, th->th_sport, 3353 ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0, 3354 r->return_ttl, 1, 0, pd->rdomain, 3355 pd->eh, pd->kif->pfik_ifp); 3356 } 3357 } else if ((pd->proto != IPPROTO_ICMP || 3358 ICMP_INFOTYPE(icmptype)) && pd->af == AF_INET && 3359 r->return_icmp) 3360 pf_send_icmp(pd->m, r->return_icmp >> 8, 3361 r->return_icmp & 255, pd->af, r, pd->rdomain); 3362 else if ((pd->proto != IPPROTO_ICMPV6 || 3363 (icmptype >= ICMP6_ECHO_REQUEST && 3364 icmptype != ND_REDIRECT)) && pd->af == AF_INET6 && 3365 r->return_icmp6) 3366 pf_send_icmp(pd->m, r->return_icmp6 >> 8, 3367 r->return_icmp6 & 255, pd->af, r, pd->rdomain); 3368 } 3369 3370 if (r->action == PF_DROP) 3371 goto cleanup; 3372 3373 pf_tag_packet(pd->m, tag, act.rtableid); 3374 if (act.rtableid >= 0 && 3375 rtable_l2(act.rtableid) != pd->rdomain) 3376 pd->destchg = 1; 3377 3378 if (r->action == PF_PASS && pd->badopts && ! r->allow_opts) { 3379 REASON_SET(&reason, PFRES_IPOPTIONS); 3380 pd->pflog |= PF_LOG_FORCE; 3381 DPFPRINTF(LOG_NOTICE, "dropping packet with " 3382 "ip/ipv6 options in pf_test_rule()"); 3383 goto cleanup; 3384 } 3385 3386 if (pd->virtual_proto != PF_VPROTO_FRAGMENT 3387 && !state_icmp && r->keep_state) { 3388 int action; 3389 3390 if (r->rule_flag & PFRULE_SRCTRACK && 3391 pf_insert_src_node(&sns[PF_SN_NONE], r, PF_SN_NONE, pd->af, 3392 pd->src, NULL, 0) != 0) { 3393 REASON_SET(&reason, PFRES_SRCLIMIT); 3394 goto cleanup; 3395 } 3396 3397 if (r->max_states && (r->states_cur >= r->max_states)) { 3398 pf_status.lcounters[LCNT_STATES]++; 3399 REASON_SET(&reason, PFRES_MAXSTATES); 3400 goto cleanup; 3401 } 3402 3403 action = pf_create_state(pd, r, a, nr, &skw, &sks, &rewrite, 3404 sm, tag, &rules, &act, sns); 3405 3406 if (action != PF_PASS) 3407 return (action); 3408 if (sks != skw) { 3409 struct pf_state_key *sk; 3410 3411 if (pd->dir == PF_IN) 3412 sk = sks; 3413 else 3414 sk = skw; 3415 rewrite += pf_translate(pd, 3416 &sk->addr[pd->af == pd->naf ? pd->sidx : pd->didx], 3417 sk->port[pd->af == pd->naf ? pd->sidx : pd->didx], 3418 &sk->addr[pd->af == pd->naf ? pd->didx : pd->sidx], 3419 sk->port[pd->af == pd->naf ? pd->didx : pd->sidx], 3420 virtual_type, icmp_dir); 3421 } 3422 } else { 3423 while ((ri = SLIST_FIRST(&rules))) { 3424 SLIST_REMOVE_HEAD(&rules, entry); 3425 pool_put(&pf_rule_item_pl, ri); 3426 } 3427 } 3428 3429 /* copy back packet headers if needed */ 3430 if (rewrite && pd->hdrlen) { 3431 pf_cksum(pd, pd->m); 3432 m_copyback(pd->m, pd->off, pd->hdrlen, pd->hdr.any, M_NOWAIT); 3433 } 3434 3435 #if NPFSYNC > 0 3436 if (*sm != NULL && !ISSET((*sm)->state_flags, PFSTATE_NOSYNC) && 3437 pd->dir == PF_OUT && pfsync_up()) { 3438 /* 3439 * We want the state created, but we dont 3440 * want to send this in case a partner 3441 * firewall has to know about it to allow 3442 * replies through it. 3443 */ 3444 if (pfsync_defer(*sm, pd->m)) 3445 return (PF_DEFER); 3446 } 3447 #endif 3448 3449 if (r->rule_flag & PFRULE_ONCE) 3450 pf_purge_rule(ruleset, r); 3451 3452 #if INET && INET6 3453 if (rewrite && skw->af != sks->af) 3454 return (PF_AFRT); 3455 #endif /* INET && INET6 */ 3456 3457 return (PF_PASS); 3458 3459 cleanup: 3460 while ((ri = SLIST_FIRST(&rules))) { 3461 SLIST_REMOVE_HEAD(&rules, entry); 3462 pool_put(&pf_rule_item_pl, ri); 3463 } 3464 3465 return (PF_DROP); 3466 } 3467 3468 static __inline int 3469 pf_create_state(struct pf_pdesc *pd, struct pf_rule *r, struct pf_rule *a, 3470 struct pf_rule *nr, struct pf_state_key **skw, struct pf_state_key **sks, 3471 int *rewrite, struct pf_state **sm, int tag, struct pf_rule_slist *rules, 3472 struct pf_rule_actions *act, struct pf_src_node *sns[PF_SN_MAX]) 3473 { 3474 struct pf_state *s = NULL; 3475 struct tcphdr *th = pd->hdr.tcp; 3476 u_int16_t mss = tcp_mssdflt; 3477 u_short reason; 3478 u_int i; 3479 3480 s = pool_get(&pf_state_pl, PR_NOWAIT | PR_ZERO); 3481 if (s == NULL) { 3482 REASON_SET(&reason, PFRES_MEMORY); 3483 goto csfailed; 3484 } 3485 s->rule.ptr = r; 3486 s->anchor.ptr = a; 3487 s->natrule.ptr = nr; 3488 memcpy(&s->match_rules, rules, sizeof(s->match_rules)); 3489 STATE_INC_COUNTERS(s); 3490 if (r->allow_opts) 3491 s->state_flags |= PFSTATE_ALLOWOPTS; 3492 if (r->rule_flag & PFRULE_STATESLOPPY) 3493 s->state_flags |= PFSTATE_SLOPPY; 3494 if (r->rule_flag & PFRULE_PFLOW) 3495 s->state_flags |= PFSTATE_PFLOW; 3496 s->log = act->log & PF_LOG_ALL; 3497 s->qid = act->qid; 3498 s->pqid = act->pqid; 3499 s->rtableid[pd->didx] = act->rtableid; 3500 s->rtableid[pd->sidx] = -1; /* return traffic is routed normally */ 3501 s->min_ttl = act->min_ttl; 3502 s->set_tos = act->set_tos; 3503 s->max_mss = act->max_mss; 3504 s->state_flags |= act->flags; 3505 #if NPFSYNC > 0 3506 s->sync_state = PFSYNC_S_NONE; 3507 #endif 3508 s->set_prio[0] = act->set_prio[0]; 3509 s->set_prio[1] = act->set_prio[1]; 3510 SLIST_INIT(&s->src_nodes); 3511 3512 switch (pd->proto) { 3513 case IPPROTO_TCP: 3514 s->src.seqlo = ntohl(th->th_seq); 3515 s->src.seqhi = s->src.seqlo + pd->p_len + 1; 3516 if ((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN && 3517 r->keep_state == PF_STATE_MODULATE) { 3518 /* Generate sequence number modulator */ 3519 if ((s->src.seqdiff = pf_tcp_iss(pd) - s->src.seqlo) == 3520 0) 3521 s->src.seqdiff = 1; 3522 pf_change_a(pd, &th->th_seq, 3523 htonl(s->src.seqlo + s->src.seqdiff)); 3524 *rewrite = 1; 3525 } else 3526 s->src.seqdiff = 0; 3527 if (th->th_flags & TH_SYN) { 3528 s->src.seqhi++; 3529 s->src.wscale = pf_get_wscale(pd); 3530 } 3531 s->src.max_win = MAX(ntohs(th->th_win), 1); 3532 if (s->src.wscale & PF_WSCALE_MASK) { 3533 /* Remove scale factor from initial window */ 3534 int win = s->src.max_win; 3535 win += 1 << (s->src.wscale & PF_WSCALE_MASK); 3536 s->src.max_win = (win - 1) >> 3537 (s->src.wscale & PF_WSCALE_MASK); 3538 } 3539 if (th->th_flags & TH_FIN) 3540 s->src.seqhi++; 3541 s->dst.seqhi = 1; 3542 s->dst.max_win = 1; 3543 s->src.state = TCPS_SYN_SENT; 3544 s->dst.state = TCPS_CLOSED; 3545 s->timeout = PFTM_TCP_FIRST_PACKET; 3546 break; 3547 case IPPROTO_UDP: 3548 s->src.state = PFUDPS_SINGLE; 3549 s->dst.state = PFUDPS_NO_TRAFFIC; 3550 s->timeout = PFTM_UDP_FIRST_PACKET; 3551 break; 3552 case IPPROTO_ICMP: 3553 #ifdef INET6 3554 case IPPROTO_ICMPV6: 3555 #endif 3556 s->timeout = PFTM_ICMP_FIRST_PACKET; 3557 break; 3558 default: 3559 s->src.state = PFOTHERS_SINGLE; 3560 s->dst.state = PFOTHERS_NO_TRAFFIC; 3561 s->timeout = PFTM_OTHER_FIRST_PACKET; 3562 } 3563 3564 s->creation = time_uptime; 3565 s->expire = time_uptime; 3566 3567 if (pd->proto == IPPROTO_TCP) { 3568 if (s->state_flags & PFSTATE_SCRUB_TCP && 3569 pf_normalize_tcp_init(pd, &s->src, &s->dst)) { 3570 REASON_SET(&reason, PFRES_MEMORY); 3571 goto csfailed; 3572 } 3573 if (s->state_flags & PFSTATE_SCRUB_TCP && s->src.scrub && 3574 pf_normalize_tcp_stateful(pd, &reason, s, &s->src, &s->dst, 3575 rewrite)) { 3576 /* This really shouldn't happen!!! */ 3577 DPFPRINTF(LOG_ERR, 3578 "pf_normalize_tcp_stateful failed on first pkt"); 3579 goto csfailed; 3580 } 3581 } 3582 s->direction = pd->dir; 3583 3584 if (pf_state_key_setup(pd, skw, sks, act->rtableid)) { 3585 REASON_SET(&reason, PFRES_MEMORY); 3586 goto csfailed; 3587 } 3588 3589 if (pf_state_insert(BOUND_IFACE(r, pd->kif), skw, sks, s)) { 3590 pf_state_key_detach(s, PF_SK_STACK); 3591 pf_state_key_detach(s, PF_SK_WIRE); 3592 *sks = *skw = NULL; 3593 REASON_SET(&reason, PFRES_STATEINS); 3594 goto csfailed; 3595 } else 3596 *sm = s; 3597 3598 /* attach src nodes late, otherwise cleanup on error nontrivial */ 3599 for (i = 0; i < PF_SN_MAX; i++) 3600 if (sns[i] != NULL) { 3601 struct pf_sn_item *sni; 3602 3603 sni = pool_get(&pf_sn_item_pl, PR_NOWAIT); 3604 if (sni == NULL) { 3605 REASON_SET(&reason, PFRES_MEMORY); 3606 pf_src_tree_remove_state(s); 3607 STATE_DEC_COUNTERS(s); 3608 pool_put(&pf_state_pl, s); 3609 return (PF_DROP); 3610 } 3611 sni->sn = sns[i]; 3612 SLIST_INSERT_HEAD(&s->src_nodes, sni, next); 3613 sni->sn->states++; 3614 } 3615 3616 pf_set_rt_ifp(s, pd->src); /* needs s->state_key set */ 3617 if (tag > 0) { 3618 pf_tag_ref(tag); 3619 s->tag = tag; 3620 } 3621 if (pd->proto == IPPROTO_TCP && (th->th_flags & (TH_SYN|TH_ACK)) == 3622 TH_SYN && r->keep_state == PF_STATE_SYNPROXY) { 3623 int rtid = pd->rdomain; 3624 if (act->rtableid >= 0) 3625 rtid = act->rtableid; 3626 s->src.state = PF_TCPS_PROXY_SRC; 3627 s->src.seqhi = htonl(arc4random()); 3628 /* Find mss option */ 3629 mss = pf_get_mss(pd); 3630 mss = pf_calc_mss(pd->src, pd->af, rtid, mss); 3631 mss = pf_calc_mss(pd->dst, pd->af, rtid, mss); 3632 s->src.mss = mss; 3633 pf_send_tcp(r, pd->af, pd->dst, pd->src, th->th_dport, 3634 th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1, 3635 TH_SYN|TH_ACK, 0, s->src.mss, 0, 1, 0, pd->rdomain, 3636 NULL, NULL); 3637 REASON_SET(&reason, PFRES_SYNPROXY); 3638 return (PF_SYNPROXY_DROP); 3639 } 3640 3641 return (PF_PASS); 3642 3643 csfailed: 3644 for (i = 0; i < PF_SN_MAX; i++) 3645 if (sns[i] != NULL) 3646 pf_remove_src_node(sns[i]); 3647 if (s) { 3648 pf_normalize_tcp_cleanup(s); /* safe even w/o init */ 3649 pf_src_tree_remove_state(s); 3650 STATE_DEC_COUNTERS(s); 3651 pool_put(&pf_state_pl, s); 3652 } 3653 3654 return (PF_DROP); 3655 } 3656 3657 int 3658 pf_translate(struct pf_pdesc *pd, struct pf_addr *saddr, u_int16_t sport, 3659 struct pf_addr *daddr, u_int16_t dport, u_int16_t virtual_type, 3660 int icmp_dir) 3661 { 3662 /* 3663 * when called from bpf_mtap_pflog, there are extra constraints: 3664 * -mbuf is faked, m_data is the bpf buffer 3665 * -pd is not fully set up 3666 */ 3667 int rewrite = 0; 3668 int afto = pd->af != pd->naf; 3669 3670 if (afto || PF_ANEQ(daddr, pd->dst, pd->af)) 3671 pd->destchg = 1; 3672 3673 switch (pd->proto) { 3674 case IPPROTO_TCP: 3675 if (afto || PF_ANEQ(saddr, pd->src, pd->af) || 3676 *pd->sport != sport) { 3677 pf_change_ap(pd, pd->src, pd->sport, saddr, sport, 3678 pd->naf); 3679 rewrite = 1; 3680 } 3681 if (afto || PF_ANEQ(daddr, pd->dst, pd->af) || 3682 *pd->dport != dport) { 3683 pf_change_ap(pd, pd->dst, pd->dport, daddr, dport, 3684 pd->naf); 3685 rewrite = 1; 3686 } 3687 break; 3688 3689 case IPPROTO_UDP: 3690 if (afto || PF_ANEQ(saddr, pd->src, pd->af) || 3691 *pd->sport != sport) { 3692 pf_change_ap(pd, pd->src, pd->sport, saddr, sport, 3693 pd->naf); 3694 rewrite = 1; 3695 } 3696 if (afto || PF_ANEQ(daddr, pd->dst, pd->af) || 3697 *pd->dport != dport) { 3698 pf_change_ap(pd, pd->dst, pd->dport, daddr, dport, 3699 pd->naf); 3700 rewrite = 1; 3701 } 3702 break; 3703 3704 #ifdef INET 3705 case IPPROTO_ICMP: 3706 /* pf_translate() is also used when logging invalid packets */ 3707 if (pd->af != AF_INET) 3708 return (0); 3709 3710 if (afto) { 3711 #ifdef INET6 3712 if (pf_translate_icmp_af(AF_INET6, pd->hdr.icmp)) 3713 return (0); 3714 pd->proto = IPPROTO_ICMPV6; 3715 rewrite = 1; 3716 #endif /* INET6 */ 3717 } else { 3718 if (PF_ANEQ(saddr, pd->src, pd->af)) { 3719 pf_change_a(pd, &pd->src->v4.s_addr, 3720 saddr->v4.s_addr); 3721 rewrite = 1; 3722 } 3723 if (PF_ANEQ(daddr, pd->dst, pd->af)) { 3724 pf_change_a(pd, &pd->dst->v4.s_addr, 3725 daddr->v4.s_addr); 3726 rewrite = 1; 3727 } 3728 } 3729 if (virtual_type == htons(ICMP_ECHO)) { 3730 u_int16_t icmpid = (icmp_dir == PF_IN) ? sport : dport; 3731 3732 if (icmpid != pd->hdr.icmp->icmp_id) { 3733 if (pd->csum_status == PF_CSUM_UNKNOWN) 3734 pf_check_proto_cksum(pd, pd->off, 3735 pd->tot_len - pd->off, pd->proto, 3736 pd->af); 3737 pd->hdr.icmp->icmp_id = icmpid; 3738 rewrite = 1; 3739 } 3740 } 3741 break; 3742 #endif /* INET */ 3743 3744 #ifdef INET6 3745 case IPPROTO_ICMPV6: 3746 /* pf_translate() is also used when logging invalid packets */ 3747 if (pd->af != AF_INET6) 3748 return (0); 3749 3750 if (afto) { 3751 #ifdef INET 3752 /* ip_sum will be recalculated in pf_translate_af */ 3753 if (pf_translate_icmp_af(AF_INET, pd->hdr.icmp6)) 3754 return (0); 3755 pd->proto = IPPROTO_ICMP; 3756 rewrite = 1; 3757 #endif /* INET */ 3758 } else { 3759 if (PF_ANEQ(saddr, pd->src, pd->af)) { 3760 pf_change_a6(pd, pd->src, saddr); 3761 rewrite = 1; 3762 } 3763 if (PF_ANEQ(daddr, pd->dst, pd->af)) { 3764 pf_change_a6(pd, pd->dst, daddr); 3765 rewrite = 1; 3766 } 3767 } 3768 if (virtual_type == htons(ICMP6_ECHO_REQUEST)) { 3769 u_int16_t icmpid = (icmp_dir == PF_IN) ? sport : dport; 3770 3771 if (icmpid != pd->hdr.icmp6->icmp6_id) { 3772 if (pd->csum_status == PF_CSUM_UNKNOWN) 3773 pf_check_proto_cksum(pd, pd->off, 3774 pd->tot_len - pd->off, pd->proto, 3775 pd->af); 3776 pd->hdr.icmp6->icmp6_id = icmpid; 3777 rewrite = 1; 3778 } 3779 } 3780 break; 3781 #endif /* INET6 */ 3782 3783 default: 3784 switch (pd->af) { 3785 #ifdef INET 3786 case AF_INET: 3787 if (!afto && PF_ANEQ(saddr, pd->src, pd->af)) { 3788 pf_change_a(pd, &pd->src->v4.s_addr, 3789 saddr->v4.s_addr); 3790 rewrite = 1; 3791 } 3792 if (!afto && PF_ANEQ(daddr, pd->dst, pd->af)) { 3793 pf_change_a(pd, &pd->dst->v4.s_addr, 3794 daddr->v4.s_addr); 3795 rewrite = 1; 3796 } 3797 break; 3798 #endif /* INET */ 3799 #ifdef INET6 3800 case AF_INET6: 3801 if (!afto && PF_ANEQ(saddr, pd->src, pd->af)) { 3802 pf_change_a6(pd, pd->src, saddr); 3803 rewrite = 1; 3804 } 3805 if (!afto && PF_ANEQ(daddr, pd->dst, pd->af)) { 3806 pf_change_a6(pd, pd->dst, daddr); 3807 rewrite = 1; 3808 } 3809 break; 3810 #endif /* INET6 */ 3811 } 3812 } 3813 return (rewrite); 3814 } 3815 3816 int 3817 pf_tcp_track_full(struct pf_pdesc *pd, struct pf_state_peer *src, 3818 struct pf_state_peer *dst, struct pf_state **state, u_short *reason, 3819 int *copyback) 3820 { 3821 struct tcphdr *th = pd->hdr.tcp; 3822 u_int16_t win = ntohs(th->th_win); 3823 u_int32_t ack, end, data_end, seq, orig_seq; 3824 u_int8_t sws, dws; 3825 int ackskew; 3826 3827 if (src->wscale && dst->wscale && !(th->th_flags & TH_SYN)) { 3828 sws = src->wscale & PF_WSCALE_MASK; 3829 dws = dst->wscale & PF_WSCALE_MASK; 3830 } else 3831 sws = dws = 0; 3832 3833 /* 3834 * Sequence tracking algorithm from Guido van Rooij's paper: 3835 * http://www.madison-gurkha.com/publications/tcp_filtering/ 3836 * tcp_filtering.ps 3837 */ 3838 3839 orig_seq = seq = ntohl(th->th_seq); 3840 if (src->seqlo == 0) { 3841 /* First packet from this end. Set its state */ 3842 3843 if (((*state)->state_flags & PFSTATE_SCRUB_TCP || dst->scrub) && 3844 src->scrub == NULL) { 3845 if (pf_normalize_tcp_init(pd, src, dst)) { 3846 REASON_SET(reason, PFRES_MEMORY); 3847 return (PF_DROP); 3848 } 3849 } 3850 3851 /* Deferred generation of sequence number modulator */ 3852 if (dst->seqdiff && !src->seqdiff) { 3853 /* use random iss for the TCP server */ 3854 while ((src->seqdiff = arc4random() - seq) == 0) 3855 ; 3856 ack = ntohl(th->th_ack) - dst->seqdiff; 3857 pf_change_a(pd, &th->th_seq, htonl(seq + src->seqdiff)); 3858 pf_change_a(pd, &th->th_ack, htonl(ack)); 3859 *copyback = 1; 3860 } else { 3861 ack = ntohl(th->th_ack); 3862 } 3863 3864 end = seq + pd->p_len; 3865 if (th->th_flags & TH_SYN) { 3866 end++; 3867 if (dst->wscale & PF_WSCALE_FLAG) { 3868 src->wscale = pf_get_wscale(pd); 3869 if (src->wscale & PF_WSCALE_FLAG) { 3870 /* Remove scale factor from initial 3871 * window */ 3872 sws = src->wscale & PF_WSCALE_MASK; 3873 win = ((u_int32_t)win + (1 << sws) - 1) 3874 >> sws; 3875 dws = dst->wscale & PF_WSCALE_MASK; 3876 } else { 3877 /* fixup other window */ 3878 dst->max_win <<= dst->wscale & 3879 PF_WSCALE_MASK; 3880 /* in case of a retrans SYN|ACK */ 3881 dst->wscale = 0; 3882 } 3883 } 3884 } 3885 data_end = end; 3886 if (th->th_flags & TH_FIN) 3887 end++; 3888 3889 src->seqlo = seq; 3890 if (src->state < TCPS_SYN_SENT) 3891 src->state = TCPS_SYN_SENT; 3892 3893 /* 3894 * May need to slide the window (seqhi may have been set by 3895 * the crappy stack check or if we picked up the connection 3896 * after establishment) 3897 */ 3898 if (src->seqhi == 1 || 3899 SEQ_GEQ(end + MAX(1, dst->max_win << dws), src->seqhi)) 3900 src->seqhi = end + MAX(1, dst->max_win << dws); 3901 if (win > src->max_win) 3902 src->max_win = win; 3903 3904 } else { 3905 ack = ntohl(th->th_ack) - dst->seqdiff; 3906 if (src->seqdiff) { 3907 /* Modulate sequence numbers */ 3908 pf_change_a(pd, &th->th_seq, htonl(seq + src->seqdiff)); 3909 pf_change_a(pd, &th->th_ack, htonl(ack)); 3910 *copyback = 1; 3911 } 3912 end = seq + pd->p_len; 3913 if (th->th_flags & TH_SYN) 3914 end++; 3915 data_end = end; 3916 if (th->th_flags & TH_FIN) 3917 end++; 3918 } 3919 3920 if ((th->th_flags & TH_ACK) == 0) { 3921 /* Let it pass through the ack skew check */ 3922 ack = dst->seqlo; 3923 } else if ((ack == 0 && 3924 (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) || 3925 /* broken tcp stacks do not set ack */ 3926 (dst->state < TCPS_SYN_SENT)) { 3927 /* 3928 * Many stacks (ours included) will set the ACK number in an 3929 * FIN|ACK if the SYN times out -- no sequence to ACK. 3930 */ 3931 ack = dst->seqlo; 3932 } 3933 3934 if (seq == end) { 3935 /* Ease sequencing restrictions on no data packets */ 3936 seq = src->seqlo; 3937 data_end = end = seq; 3938 } 3939 3940 ackskew = dst->seqlo - ack; 3941 3942 3943 /* 3944 * Need to demodulate the sequence numbers in any TCP SACK options 3945 * (Selective ACK). We could optionally validate the SACK values 3946 * against the current ACK window, either forwards or backwards, but 3947 * I'm not confident that SACK has been implemented properly 3948 * everywhere. It wouldn't surprise me if several stacks accidently 3949 * SACK too far backwards of previously ACKed data. There really aren't 3950 * any security implications of bad SACKing unless the target stack 3951 * doesn't validate the option length correctly. Someone trying to 3952 * spoof into a TCP connection won't bother blindly sending SACK 3953 * options anyway. 3954 */ 3955 if (dst->seqdiff && (th->th_off << 2) > sizeof(struct tcphdr)) { 3956 if (pf_modulate_sack(pd, dst)) 3957 *copyback = 1; 3958 } 3959 3960 3961 #define MAXACKWINDOW (0xffff + 1500) /* 1500 is an arbitrary fudge factor */ 3962 if (SEQ_GEQ(src->seqhi, data_end) && 3963 /* Last octet inside other's window space */ 3964 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) && 3965 /* Retrans: not more than one window back */ 3966 (ackskew >= -MAXACKWINDOW) && 3967 /* Acking not more than one reassembled fragment backwards */ 3968 (ackskew <= (MAXACKWINDOW << sws)) && 3969 /* Acking not more than one window forward */ 3970 ((th->th_flags & TH_RST) == 0 || orig_seq == src->seqlo || 3971 (orig_seq == src->seqlo + 1) || (orig_seq + 1 == src->seqlo))) { 3972 /* Require an exact/+1 sequence match on resets when possible */ 3973 3974 if (dst->scrub || src->scrub) { 3975 if (pf_normalize_tcp_stateful(pd, reason, *state, src, 3976 dst, copyback)) 3977 return (PF_DROP); 3978 } 3979 3980 /* update max window */ 3981 if (src->max_win < win) 3982 src->max_win = win; 3983 /* synchronize sequencing */ 3984 if (SEQ_GT(end, src->seqlo)) 3985 src->seqlo = end; 3986 /* slide the window of what the other end can send */ 3987 if (SEQ_GEQ(ack + (win << sws), dst->seqhi)) 3988 dst->seqhi = ack + MAX((win << sws), 1); 3989 3990 /* update states */ 3991 if (th->th_flags & TH_SYN) 3992 if (src->state < TCPS_SYN_SENT) 3993 src->state = TCPS_SYN_SENT; 3994 if (th->th_flags & TH_FIN) 3995 if (src->state < TCPS_CLOSING) 3996 src->state = TCPS_CLOSING; 3997 if (th->th_flags & TH_ACK) { 3998 if (dst->state == TCPS_SYN_SENT) { 3999 dst->state = TCPS_ESTABLISHED; 4000 if (src->state == TCPS_ESTABLISHED && 4001 !SLIST_EMPTY(&(*state)->src_nodes) && 4002 pf_src_connlimit(state)) { 4003 REASON_SET(reason, PFRES_SRCLIMIT); 4004 return (PF_DROP); 4005 } 4006 } else if (dst->state == TCPS_CLOSING) 4007 dst->state = TCPS_FIN_WAIT_2; 4008 } 4009 if (th->th_flags & TH_RST) 4010 src->state = dst->state = TCPS_TIME_WAIT; 4011 4012 /* update expire time */ 4013 (*state)->expire = time_uptime; 4014 if (src->state >= TCPS_FIN_WAIT_2 && 4015 dst->state >= TCPS_FIN_WAIT_2) 4016 (*state)->timeout = PFTM_TCP_CLOSED; 4017 else if (src->state >= TCPS_CLOSING && 4018 dst->state >= TCPS_CLOSING) 4019 (*state)->timeout = PFTM_TCP_FIN_WAIT; 4020 else if (src->state < TCPS_ESTABLISHED || 4021 dst->state < TCPS_ESTABLISHED) 4022 (*state)->timeout = PFTM_TCP_OPENING; 4023 else if (src->state >= TCPS_CLOSING || 4024 dst->state >= TCPS_CLOSING) 4025 (*state)->timeout = PFTM_TCP_CLOSING; 4026 else 4027 (*state)->timeout = PFTM_TCP_ESTABLISHED; 4028 4029 /* Fall through to PASS packet */ 4030 } else if ((dst->state < TCPS_SYN_SENT || 4031 dst->state >= TCPS_FIN_WAIT_2 || 4032 src->state >= TCPS_FIN_WAIT_2) && 4033 SEQ_GEQ(src->seqhi + MAXACKWINDOW, data_end) && 4034 /* Within a window forward of the originating packet */ 4035 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW)) { 4036 /* Within a window backward of the originating packet */ 4037 4038 /* 4039 * This currently handles three situations: 4040 * 1) Stupid stacks will shotgun SYNs before their peer 4041 * replies. 4042 * 2) When PF catches an already established stream (the 4043 * firewall rebooted, the state table was flushed, routes 4044 * changed...) 4045 * 3) Packets get funky immediately after the connection 4046 * closes (this should catch Solaris spurious ACK|FINs 4047 * that web servers like to spew after a close) 4048 * 4049 * This must be a little more careful than the above code 4050 * since packet floods will also be caught here. We don't 4051 * update the TTL here to mitigate the damage of a packet 4052 * flood and so the same code can handle awkward establishment 4053 * and a loosened connection close. 4054 * In the establishment case, a correct peer response will 4055 * validate the connection, go through the normal state code 4056 * and keep updating the state TTL. 4057 */ 4058 4059 if (pf_status.debug >= LOG_NOTICE) { 4060 log(LOG_NOTICE, "pf: loose state match: "); 4061 pf_print_state(*state); 4062 pf_print_flags(th->th_flags); 4063 addlog(" seq=%u (%u) ack=%u len=%u ackskew=%d " 4064 "pkts=%llu:%llu dir=%s,%s\n", seq, orig_seq, ack, 4065 pd->p_len, ackskew, (*state)->packets[0], 4066 (*state)->packets[1], 4067 pd->dir == PF_IN ? "in" : "out", 4068 pd->dir == (*state)->direction ? "fwd" : "rev"); 4069 } 4070 4071 if (dst->scrub || src->scrub) { 4072 if (pf_normalize_tcp_stateful(pd, reason, *state, src, 4073 dst, copyback)) 4074 return (PF_DROP); 4075 } 4076 4077 /* update max window */ 4078 if (src->max_win < win) 4079 src->max_win = win; 4080 /* synchronize sequencing */ 4081 if (SEQ_GT(end, src->seqlo)) 4082 src->seqlo = end; 4083 /* slide the window of what the other end can send */ 4084 if (SEQ_GEQ(ack + (win << sws), dst->seqhi)) 4085 dst->seqhi = ack + MAX((win << sws), 1); 4086 4087 /* 4088 * Cannot set dst->seqhi here since this could be a shotgunned 4089 * SYN and not an already established connection. 4090 */ 4091 if (th->th_flags & TH_FIN) 4092 if (src->state < TCPS_CLOSING) 4093 src->state = TCPS_CLOSING; 4094 if (th->th_flags & TH_RST) 4095 src->state = dst->state = TCPS_TIME_WAIT; 4096 4097 /* Fall through to PASS packet */ 4098 } else { 4099 if ((*state)->dst.state == TCPS_SYN_SENT && 4100 (*state)->src.state == TCPS_SYN_SENT) { 4101 /* Send RST for state mismatches during handshake */ 4102 if (!(th->th_flags & TH_RST)) 4103 pf_send_tcp((*state)->rule.ptr, pd->af, 4104 pd->dst, pd->src, th->th_dport, 4105 th->th_sport, ntohl(th->th_ack), 0, 4106 TH_RST, 0, 0, 4107 (*state)->rule.ptr->return_ttl, 1, 0, 4108 pd->rdomain, pd->eh, pd->kif->pfik_ifp); 4109 src->seqlo = 0; 4110 src->seqhi = 1; 4111 src->max_win = 1; 4112 } else if (pf_status.debug >= LOG_NOTICE) { 4113 log(LOG_NOTICE, "pf: BAD state: "); 4114 pf_print_state(*state); 4115 pf_print_flags(th->th_flags); 4116 addlog(" seq=%u (%u) ack=%u len=%u ackskew=%d " 4117 "pkts=%llu:%llu dir=%s,%s\n", 4118 seq, orig_seq, ack, pd->p_len, ackskew, 4119 (*state)->packets[0], (*state)->packets[1], 4120 pd->dir == PF_IN ? "in" : "out", 4121 pd->dir == (*state)->direction ? "fwd" : "rev"); 4122 addlog("pf: State failure on: %c %c %c %c | %c %c\n", 4123 SEQ_GEQ(src->seqhi, data_end) ? ' ' : '1', 4124 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) ? 4125 ' ': '2', 4126 (ackskew >= -MAXACKWINDOW) ? ' ' : '3', 4127 (ackskew <= (MAXACKWINDOW << sws)) ? ' ' : '4', 4128 SEQ_GEQ(src->seqhi + MAXACKWINDOW, data_end) ? 4129 ' ' :'5', 4130 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW) ?' ' :'6'); 4131 } 4132 REASON_SET(reason, PFRES_BADSTATE); 4133 return (PF_DROP); 4134 } 4135 4136 return (PF_PASS); 4137 } 4138 4139 int 4140 pf_tcp_track_sloppy(struct pf_pdesc *pd, struct pf_state_peer *src, 4141 struct pf_state_peer *dst, struct pf_state **state, u_short *reason) 4142 { 4143 struct tcphdr *th = pd->hdr.tcp; 4144 4145 if (th->th_flags & TH_SYN) 4146 if (src->state < TCPS_SYN_SENT) 4147 src->state = TCPS_SYN_SENT; 4148 if (th->th_flags & TH_FIN) 4149 if (src->state < TCPS_CLOSING) 4150 src->state = TCPS_CLOSING; 4151 if (th->th_flags & TH_ACK) { 4152 if (dst->state == TCPS_SYN_SENT) { 4153 dst->state = TCPS_ESTABLISHED; 4154 if (src->state == TCPS_ESTABLISHED && 4155 !SLIST_EMPTY(&(*state)->src_nodes) && 4156 pf_src_connlimit(state)) { 4157 REASON_SET(reason, PFRES_SRCLIMIT); 4158 return (PF_DROP); 4159 } 4160 } else if (dst->state == TCPS_CLOSING) { 4161 dst->state = TCPS_FIN_WAIT_2; 4162 } else if (src->state == TCPS_SYN_SENT && 4163 dst->state < TCPS_SYN_SENT) { 4164 /* 4165 * Handle a special sloppy case where we only see one 4166 * half of the connection. If there is a ACK after 4167 * the initial SYN without ever seeing a packet from 4168 * the destination, set the connection to established. 4169 */ 4170 dst->state = src->state = TCPS_ESTABLISHED; 4171 if (!SLIST_EMPTY(&(*state)->src_nodes) && 4172 pf_src_connlimit(state)) { 4173 REASON_SET(reason, PFRES_SRCLIMIT); 4174 return (PF_DROP); 4175 } 4176 } else if (src->state == TCPS_CLOSING && 4177 dst->state == TCPS_ESTABLISHED && 4178 dst->seqlo == 0) { 4179 /* 4180 * Handle the closing of half connections where we 4181 * don't see the full bidirectional FIN/ACK+ACK 4182 * handshake. 4183 */ 4184 dst->state = TCPS_CLOSING; 4185 } 4186 } 4187 if (th->th_flags & TH_RST) 4188 src->state = dst->state = TCPS_TIME_WAIT; 4189 4190 /* update expire time */ 4191 (*state)->expire = time_uptime; 4192 if (src->state >= TCPS_FIN_WAIT_2 && 4193 dst->state >= TCPS_FIN_WAIT_2) 4194 (*state)->timeout = PFTM_TCP_CLOSED; 4195 else if (src->state >= TCPS_CLOSING && 4196 dst->state >= TCPS_CLOSING) 4197 (*state)->timeout = PFTM_TCP_FIN_WAIT; 4198 else if (src->state < TCPS_ESTABLISHED || 4199 dst->state < TCPS_ESTABLISHED) 4200 (*state)->timeout = PFTM_TCP_OPENING; 4201 else if (src->state >= TCPS_CLOSING || 4202 dst->state >= TCPS_CLOSING) 4203 (*state)->timeout = PFTM_TCP_CLOSING; 4204 else 4205 (*state)->timeout = PFTM_TCP_ESTABLISHED; 4206 4207 return (PF_PASS); 4208 } 4209 4210 static __inline int 4211 pf_synproxy(struct pf_pdesc *pd, struct pf_state **state, u_short *reason) 4212 { 4213 struct pf_state_key *sk = (*state)->key[pd->didx]; 4214 4215 if ((*state)->src.state == PF_TCPS_PROXY_SRC) { 4216 struct tcphdr *th = pd->hdr.tcp; 4217 4218 if (pd->dir != (*state)->direction) { 4219 REASON_SET(reason, PFRES_SYNPROXY); 4220 return (PF_SYNPROXY_DROP); 4221 } 4222 if (th->th_flags & TH_SYN) { 4223 if (ntohl(th->th_seq) != (*state)->src.seqlo) { 4224 REASON_SET(reason, PFRES_SYNPROXY); 4225 return (PF_DROP); 4226 } 4227 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst, 4228 pd->src, th->th_dport, th->th_sport, 4229 (*state)->src.seqhi, ntohl(th->th_seq) + 1, 4230 TH_SYN|TH_ACK, 0, (*state)->src.mss, 0, 1, 4231 0, pd->rdomain, NULL, NULL); 4232 REASON_SET(reason, PFRES_SYNPROXY); 4233 return (PF_SYNPROXY_DROP); 4234 } else if (!(th->th_flags & TH_ACK) || 4235 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) || 4236 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) { 4237 REASON_SET(reason, PFRES_SYNPROXY); 4238 return (PF_DROP); 4239 } else if (!SLIST_EMPTY(&(*state)->src_nodes) && 4240 pf_src_connlimit(state)) { 4241 REASON_SET(reason, PFRES_SRCLIMIT); 4242 return (PF_DROP); 4243 } else 4244 (*state)->src.state = PF_TCPS_PROXY_DST; 4245 } 4246 if ((*state)->src.state == PF_TCPS_PROXY_DST) { 4247 struct tcphdr *th = pd->hdr.tcp; 4248 4249 if (pd->dir == (*state)->direction) { 4250 if (((th->th_flags & (TH_SYN|TH_ACK)) != TH_ACK) || 4251 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) || 4252 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) { 4253 REASON_SET(reason, PFRES_SYNPROXY); 4254 return (PF_DROP); 4255 } 4256 (*state)->src.max_win = MAX(ntohs(th->th_win), 1); 4257 if ((*state)->dst.seqhi == 1) 4258 (*state)->dst.seqhi = htonl(arc4random()); 4259 pf_send_tcp((*state)->rule.ptr, pd->af, 4260 &sk->addr[pd->sidx], &sk->addr[pd->didx], 4261 sk->port[pd->sidx], sk->port[pd->didx], 4262 (*state)->dst.seqhi, 0, TH_SYN, 0, 4263 (*state)->src.mss, 0, 0, (*state)->tag, 4264 sk->rdomain, NULL, NULL); 4265 REASON_SET(reason, PFRES_SYNPROXY); 4266 return (PF_SYNPROXY_DROP); 4267 } else if (((th->th_flags & (TH_SYN|TH_ACK)) != 4268 (TH_SYN|TH_ACK)) || 4269 (ntohl(th->th_ack) != (*state)->dst.seqhi + 1)) { 4270 REASON_SET(reason, PFRES_SYNPROXY); 4271 return (PF_DROP); 4272 } else { 4273 (*state)->dst.max_win = MAX(ntohs(th->th_win), 1); 4274 (*state)->dst.seqlo = ntohl(th->th_seq); 4275 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst, 4276 pd->src, th->th_dport, th->th_sport, 4277 ntohl(th->th_ack), ntohl(th->th_seq) + 1, 4278 TH_ACK, (*state)->src.max_win, 0, 0, 0, 4279 (*state)->tag, pd->rdomain, NULL, NULL); 4280 pf_send_tcp((*state)->rule.ptr, pd->af, 4281 &sk->addr[pd->sidx], &sk->addr[pd->didx], 4282 sk->port[pd->sidx], sk->port[pd->didx], 4283 (*state)->src.seqhi + 1, (*state)->src.seqlo + 1, 4284 TH_ACK, (*state)->dst.max_win, 0, 0, 1, 4285 0, sk->rdomain, NULL, NULL); 4286 (*state)->src.seqdiff = (*state)->dst.seqhi - 4287 (*state)->src.seqlo; 4288 (*state)->dst.seqdiff = (*state)->src.seqhi - 4289 (*state)->dst.seqlo; 4290 (*state)->src.seqhi = (*state)->src.seqlo + 4291 (*state)->dst.max_win; 4292 (*state)->dst.seqhi = (*state)->dst.seqlo + 4293 (*state)->src.max_win; 4294 (*state)->src.wscale = (*state)->dst.wscale = 0; 4295 (*state)->src.state = (*state)->dst.state = 4296 TCPS_ESTABLISHED; 4297 REASON_SET(reason, PFRES_SYNPROXY); 4298 return (PF_SYNPROXY_DROP); 4299 } 4300 } 4301 return (PF_PASS); 4302 } 4303 4304 int 4305 pf_test_state(struct pf_pdesc *pd, struct pf_state **state, u_short *reason) 4306 { 4307 struct pf_state_key_cmp key; 4308 int copyback = 0; 4309 struct pf_state_peer *src, *dst; 4310 int action = PF_PASS; 4311 4312 key.af = pd->af; 4313 key.proto = pd->virtual_proto; 4314 key.rdomain = pd->rdomain; 4315 PF_ACPY(&key.addr[pd->sidx], pd->src, key.af); 4316 PF_ACPY(&key.addr[pd->didx], pd->dst, key.af); 4317 key.port[pd->sidx] = pd->osport; 4318 key.port[pd->didx] = pd->odport; 4319 4320 STATE_LOOKUP(pd->kif, &key, pd->dir, *state, pd->m); 4321 4322 if (pd->dir == (*state)->direction) { 4323 src = &(*state)->src; 4324 dst = &(*state)->dst; 4325 } else { 4326 src = &(*state)->dst; 4327 dst = &(*state)->src; 4328 } 4329 4330 switch (pd->virtual_proto) { 4331 case IPPROTO_TCP: 4332 if ((action = pf_synproxy(pd, state, reason)) != PF_PASS) 4333 return (action); 4334 if (((pd->hdr.tcp->th_flags & (TH_SYN|TH_ACK)) == TH_SYN) && 4335 dst->state >= TCPS_FIN_WAIT_2 && 4336 src->state >= TCPS_FIN_WAIT_2) { 4337 if (pf_status.debug >= LOG_NOTICE) { 4338 log(LOG_NOTICE, "pf: state reuse "); 4339 pf_print_state(*state); 4340 pf_print_flags(pd->hdr.tcp->th_flags); 4341 addlog("\n"); 4342 } 4343 /* XXX make sure it's the same direction ?? */ 4344 (*state)->src.state = (*state)->dst.state = TCPS_CLOSED; 4345 pf_unlink_state(*state); 4346 *state = NULL; 4347 return (PF_DROP); 4348 } 4349 4350 if ((*state)->state_flags & PFSTATE_SLOPPY) { 4351 if (pf_tcp_track_sloppy(pd, src, dst, state, reason) == 4352 PF_DROP) 4353 return (PF_DROP); 4354 } else { 4355 int ret; 4356 4357 if (PF_REVERSED_KEY((*state)->key, pd->af)) 4358 ret = pf_tcp_track_full(pd, dst, src, state, 4359 reason, ©back); 4360 else 4361 ret = pf_tcp_track_full(pd, src, dst, state, 4362 reason, ©back); 4363 if (ret == PF_DROP) 4364 return (PF_DROP); 4365 } 4366 break; 4367 case IPPROTO_UDP: 4368 /* update states */ 4369 if (src->state < PFUDPS_SINGLE) 4370 src->state = PFUDPS_SINGLE; 4371 if (dst->state == PFUDPS_SINGLE) 4372 dst->state = PFUDPS_MULTIPLE; 4373 4374 /* update expire time */ 4375 (*state)->expire = time_uptime; 4376 if (src->state == PFUDPS_MULTIPLE && 4377 dst->state == PFUDPS_MULTIPLE) 4378 (*state)->timeout = PFTM_UDP_MULTIPLE; 4379 else 4380 (*state)->timeout = PFTM_UDP_SINGLE; 4381 break; 4382 default: 4383 /* update states */ 4384 if (src->state < PFOTHERS_SINGLE) 4385 src->state = PFOTHERS_SINGLE; 4386 if (dst->state == PFOTHERS_SINGLE) 4387 dst->state = PFOTHERS_MULTIPLE; 4388 4389 /* update expire time */ 4390 (*state)->expire = time_uptime; 4391 if (src->state == PFOTHERS_MULTIPLE && 4392 dst->state == PFOTHERS_MULTIPLE) 4393 (*state)->timeout = PFTM_OTHER_MULTIPLE; 4394 else 4395 (*state)->timeout = PFTM_OTHER_SINGLE; 4396 break; 4397 } 4398 4399 /* translate source/destination address, if necessary */ 4400 if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) { 4401 struct pf_state_key *nk; 4402 int afto, sidx, didx; 4403 4404 if (PF_REVERSED_KEY((*state)->key, pd->af)) 4405 nk = (*state)->key[pd->sidx]; 4406 else 4407 nk = (*state)->key[pd->didx]; 4408 4409 afto = pd->af != nk->af; 4410 sidx = afto ? pd->didx : pd->sidx; 4411 didx = afto ? pd->sidx : pd->didx; 4412 4413 if (afto || PF_ANEQ(pd->src, &nk->addr[sidx], pd->af) || 4414 nk->port[sidx] != pd->osport) 4415 pf_change_ap(pd, pd->src, pd->sport, 4416 &nk->addr[sidx], nk->port[sidx], nk->af); 4417 4418 if (afto || PF_ANEQ(pd->dst, &nk->addr[didx], pd->af) || 4419 pd->rdomain != nk->rdomain) 4420 pd->destchg = 1; 4421 4422 if (afto || PF_ANEQ(pd->dst, &nk->addr[didx], pd->af) || 4423 nk->port[didx] != pd->odport) 4424 pf_change_ap(pd, pd->dst, pd->dport, 4425 &nk->addr[didx], nk->port[didx], nk->af); 4426 4427 #if INET && INET6 4428 if (afto) { 4429 PF_ACPY(&pd->nsaddr, &nk->addr[sidx], nk->af); 4430 PF_ACPY(&pd->ndaddr, &nk->addr[didx], nk->af); 4431 pd->naf = nk->af; 4432 action = PF_AFRT; 4433 } 4434 #endif /* INET && INET6 */ 4435 4436 pd->m->m_pkthdr.ph_rtableid = nk->rdomain; 4437 copyback = 1; 4438 } 4439 4440 if (copyback && pd->hdrlen > 0) { 4441 pf_cksum(pd, pd->m); 4442 m_copyback(pd->m, pd->off, pd->hdrlen, pd->hdr.any, M_NOWAIT); 4443 } 4444 4445 return (action); 4446 } 4447 4448 int 4449 pf_icmp_state_lookup(struct pf_pdesc *pd, struct pf_state_key_cmp *key, 4450 struct pf_state **state, u_int16_t icmpid, u_int16_t type, 4451 int icmp_dir, int *iidx, int multi, int inner) 4452 { 4453 int direction; 4454 4455 key->af = pd->af; 4456 key->proto = pd->proto; 4457 key->rdomain = pd->rdomain; 4458 if (icmp_dir == PF_IN) { 4459 *iidx = pd->sidx; 4460 key->port[pd->sidx] = icmpid; 4461 key->port[pd->didx] = type; 4462 } else { 4463 *iidx = pd->didx; 4464 key->port[pd->sidx] = type; 4465 key->port[pd->didx] = icmpid; 4466 } 4467 4468 if (pf_state_key_addr_setup(pd, key, pd->sidx, pd->src, pd->didx, 4469 pd->dst, pd->af, multi)) 4470 return (PF_DROP); 4471 4472 STATE_LOOKUP(pd->kif, key, pd->dir, *state, pd->m); 4473 4474 if ((*state)->state_flags & PFSTATE_SLOPPY) 4475 return (-1); 4476 4477 /* Is this ICMP message flowing in right direction? */ 4478 if ((*state)->key[PF_SK_WIRE]->af != (*state)->key[PF_SK_STACK]->af) 4479 direction = (pd->af == (*state)->key[PF_SK_WIRE]->af) ? 4480 PF_IN : PF_OUT; 4481 else 4482 direction = (*state)->direction; 4483 if ((((!inner && direction == pd->dir) || 4484 (inner && direction != pd->dir)) ? 4485 PF_IN : PF_OUT) != icmp_dir) { 4486 if (pf_status.debug >= LOG_NOTICE) { 4487 log(LOG_NOTICE, 4488 "pf: icmp type %d in wrong direction (%d): ", 4489 ntohs(type), icmp_dir); 4490 pf_print_state(*state); 4491 addlog("\n"); 4492 } 4493 return (PF_DROP); 4494 } 4495 return (-1); 4496 } 4497 4498 int 4499 pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **state, 4500 u_short *reason) 4501 { 4502 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 4503 u_int16_t virtual_id, virtual_type; 4504 u_int8_t icmptype; 4505 int icmp_dir, iidx, ret, multi, copyback = 0; 4506 4507 struct pf_state_key_cmp key; 4508 4509 switch (pd->proto) { 4510 #ifdef INET 4511 case IPPROTO_ICMP: 4512 icmptype = pd->hdr.icmp->icmp_type; 4513 break; 4514 #endif /* INET */ 4515 #ifdef INET6 4516 case IPPROTO_ICMPV6: 4517 icmptype = pd->hdr.icmp6->icmp6_type; 4518 break; 4519 #endif /* INET6 */ 4520 } 4521 4522 if (pf_icmp_mapping(pd, icmptype, &icmp_dir, &multi, 4523 &virtual_id, &virtual_type) == 0) { 4524 /* 4525 * ICMP query/reply message not related to a TCP/UDP packet. 4526 * Search for an ICMP state. 4527 */ 4528 ret = pf_icmp_state_lookup(pd, &key, state, 4529 virtual_id, virtual_type, icmp_dir, &iidx, 4530 PF_ICMP_MULTI_NONE, 0); 4531 if (ret >= 0) { 4532 if (ret == PF_DROP && pd->af == AF_INET6 && 4533 icmp_dir == PF_OUT) { 4534 ret = pf_icmp_state_lookup(pd, &key, state, 4535 virtual_id, virtual_type, icmp_dir, &iidx, 4536 multi, 0); 4537 if (ret >= 0) 4538 return (ret); 4539 } else 4540 return (ret); 4541 } 4542 4543 (*state)->expire = time_uptime; 4544 (*state)->timeout = PFTM_ICMP_ERROR_REPLY; 4545 4546 /* translate source/destination address, if necessary */ 4547 if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) { 4548 struct pf_state_key *nk; 4549 int afto, sidx, didx; 4550 4551 if (PF_REVERSED_KEY((*state)->key, pd->af)) 4552 nk = (*state)->key[pd->sidx]; 4553 else 4554 nk = (*state)->key[pd->didx]; 4555 4556 afto = pd->af != nk->af; 4557 sidx = afto ? pd->didx : pd->sidx; 4558 didx = afto ? pd->sidx : pd->didx; 4559 iidx = afto ? !iidx : iidx; 4560 4561 if (pd->rdomain != nk->rdomain) 4562 pd->destchg = 1; 4563 pd->m->m_pkthdr.ph_rtableid = nk->rdomain; 4564 4565 switch (pd->af) { 4566 #ifdef INET 4567 case AF_INET: 4568 #ifdef INET6 4569 if (afto) { 4570 if (pf_translate_icmp_af(AF_INET6, 4571 pd->hdr.icmp)) 4572 return (PF_DROP); 4573 pd->proto = IPPROTO_ICMPV6; 4574 } 4575 #endif /* INET6 */ 4576 if (!afto && PF_ANEQ(pd->src, 4577 &nk->addr[sidx], AF_INET)) 4578 pf_change_a(pd, &saddr->v4.s_addr, 4579 nk->addr[sidx].v4.s_addr); 4580 4581 if (!afto && PF_ANEQ(pd->dst, 4582 &nk->addr[didx], AF_INET)) { 4583 pf_change_a(pd, &daddr->v4.s_addr, 4584 nk->addr[didx].v4.s_addr); 4585 pd->destchg = 1; 4586 } 4587 4588 if (nk->port[iidx] != pd->hdr.icmp->icmp_id) { 4589 if (pd->csum_status == PF_CSUM_UNKNOWN) 4590 pf_check_proto_cksum(pd, 4591 pd->off, pd->tot_len - 4592 pd->off, pd->proto, pd->af); 4593 pd->hdr.icmp->icmp_id = nk->port[iidx]; 4594 } 4595 4596 m_copyback(pd->m, pd->off, ICMP_MINLEN, 4597 pd->hdr.icmp, M_NOWAIT); 4598 copyback = 1; 4599 break; 4600 #endif /* INET */ 4601 #ifdef INET6 4602 case AF_INET6: 4603 #ifdef INET 4604 if (afto) { 4605 if (pf_translate_icmp_af(AF_INET, 4606 pd->hdr.icmp6)) 4607 return (PF_DROP); 4608 pd->proto = IPPROTO_ICMP; 4609 } 4610 #endif /* INET */ 4611 if (!afto && PF_ANEQ(pd->src, 4612 &nk->addr[sidx], AF_INET6)) 4613 pf_change_a6(pd, saddr, 4614 &nk->addr[sidx]); 4615 4616 if (!afto && PF_ANEQ(pd->dst, 4617 &nk->addr[didx], AF_INET6)) { 4618 pf_change_a6(pd, daddr, 4619 &nk->addr[didx]); 4620 pd->destchg = 1; 4621 } 4622 4623 if (nk->port[iidx] != pd->hdr.icmp6->icmp6_id) { 4624 if (pd->csum_status == PF_CSUM_UNKNOWN) 4625 pf_check_proto_cksum(pd, 4626 pd->off, pd->tot_len - 4627 pd->off, pd->proto, pd->af); 4628 pd->hdr.icmp6->icmp6_id = 4629 nk->port[iidx]; 4630 } 4631 4632 m_copyback(pd->m, pd->off, 4633 sizeof(struct icmp6_hdr), pd->hdr.icmp6, 4634 M_NOWAIT); 4635 copyback = 1; 4636 break; 4637 #endif /* INET6 */ 4638 } 4639 #if INET && INET6 4640 if (afto) { 4641 PF_ACPY(&pd->nsaddr, &nk->addr[sidx], nk->af); 4642 PF_ACPY(&pd->ndaddr, &nk->addr[didx], nk->af); 4643 pd->naf = nk->af; 4644 return (PF_AFRT); 4645 } 4646 #endif /* INET && INET6 */ 4647 } 4648 } else { 4649 /* 4650 * ICMP error message in response to a TCP/UDP packet. 4651 * Extract the inner TCP/UDP header and search for that state. 4652 */ 4653 struct pf_pdesc pd2; 4654 #ifdef INET 4655 struct ip h2; 4656 #endif /* INET */ 4657 #ifdef INET6 4658 struct ip6_hdr h2_6; 4659 #endif /* INET6 */ 4660 int ipoff2; 4661 4662 /* Initialize pd2 fields valid for both packets with pd. */ 4663 bzero(&pd2, sizeof(pd2)); 4664 pd2.af = pd->af; 4665 pd2.dir = pd->dir; 4666 pd2.kif = pd->kif; 4667 pd2.m = pd->m; 4668 pd2.rdomain = pd->rdomain; 4669 /* Payload packet is from the opposite direction. */ 4670 pd2.sidx = (pd2.dir == PF_IN) ? 1 : 0; 4671 pd2.didx = (pd2.dir == PF_IN) ? 0 : 1; 4672 switch (pd->af) { 4673 #ifdef INET 4674 case AF_INET: 4675 /* offset of h2 in mbuf chain */ 4676 ipoff2 = pd->off + ICMP_MINLEN; 4677 4678 if (!pf_pull_hdr(pd2.m, ipoff2, &h2, sizeof(h2), 4679 NULL, reason, pd2.af)) { 4680 DPFPRINTF(LOG_NOTICE, 4681 "ICMP error message too short (ip)"); 4682 return (PF_DROP); 4683 } 4684 /* 4685 * ICMP error messages don't refer to non-first 4686 * fragments 4687 */ 4688 if (h2.ip_off & htons(IP_OFFMASK)) { 4689 REASON_SET(reason, PFRES_FRAG); 4690 return (PF_DROP); 4691 } 4692 4693 /* offset of protocol header that follows h2 */ 4694 pd2.off = ipoff2 + (h2.ip_hl << 2); 4695 4696 pd2.proto = h2.ip_p; 4697 pd2.tot_len = ntohs(h2.ip_len); 4698 pd2.src = (struct pf_addr *)&h2.ip_src; 4699 pd2.dst = (struct pf_addr *)&h2.ip_dst; 4700 break; 4701 #endif /* INET */ 4702 #ifdef INET6 4703 case AF_INET6: 4704 ipoff2 = pd->off + sizeof(struct icmp6_hdr); 4705 4706 if (!pf_pull_hdr(pd2.m, ipoff2, &h2_6, sizeof(h2_6), 4707 NULL, reason, pd2.af)) { 4708 DPFPRINTF(LOG_NOTICE, 4709 "ICMP error message too short (ip6)"); 4710 return (PF_DROP); 4711 } 4712 4713 pd2.off = ipoff2; 4714 if (pf_walk_header6(&pd2, &h2_6, reason) != PF_PASS) 4715 return (PF_DROP); 4716 4717 pd2.tot_len = ntohs(h2_6.ip6_plen) + 4718 sizeof(struct ip6_hdr); 4719 pd2.src = (struct pf_addr *)&h2_6.ip6_src; 4720 pd2.dst = (struct pf_addr *)&h2_6.ip6_dst; 4721 break; 4722 #endif /* INET6 */ 4723 } 4724 4725 switch (pd2.proto) { 4726 case IPPROTO_TCP: { 4727 struct tcphdr th; 4728 u_int32_t seq; 4729 struct pf_state_peer *src, *dst; 4730 u_int8_t dws; 4731 4732 /* 4733 * Only the first 8 bytes of the TCP header can be 4734 * expected. Don't access any TCP header fields after 4735 * th_seq, an ackskew test is not possible. 4736 */ 4737 if (!pf_pull_hdr(pd2.m, pd2.off, &th, 8, NULL, reason, 4738 pd2.af)) { 4739 DPFPRINTF(LOG_NOTICE, 4740 "ICMP error message too short (tcp)"); 4741 return (PF_DROP); 4742 } 4743 4744 key.af = pd2.af; 4745 key.proto = IPPROTO_TCP; 4746 key.rdomain = pd2.rdomain; 4747 PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af); 4748 PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af); 4749 key.port[pd2.sidx] = th.th_sport; 4750 key.port[pd2.didx] = th.th_dport; 4751 4752 STATE_LOOKUP(pd2.kif, &key, pd2.dir, *state, pd2.m); 4753 4754 if (pd2.dir == (*state)->direction) { 4755 if (PF_REVERSED_KEY((*state)->key, pd->af)) { 4756 src = &(*state)->src; 4757 dst = &(*state)->dst; 4758 } else { 4759 src = &(*state)->dst; 4760 dst = &(*state)->src; 4761 } 4762 } else { 4763 if (PF_REVERSED_KEY((*state)->key, pd->af)) { 4764 src = &(*state)->dst; 4765 dst = &(*state)->src; 4766 } else { 4767 src = &(*state)->src; 4768 dst = &(*state)->dst; 4769 } 4770 } 4771 4772 if (src->wscale && dst->wscale) 4773 dws = dst->wscale & PF_WSCALE_MASK; 4774 else 4775 dws = 0; 4776 4777 /* Demodulate sequence number */ 4778 seq = ntohl(th.th_seq) - src->seqdiff; 4779 if (src->seqdiff) { 4780 pf_change_a(pd, &th.th_seq, htonl(seq)); 4781 copyback = 1; 4782 } 4783 4784 if (!((*state)->state_flags & PFSTATE_SLOPPY) && 4785 (!SEQ_GEQ(src->seqhi, seq) || !SEQ_GEQ(seq, 4786 src->seqlo - (dst->max_win << dws)))) { 4787 if (pf_status.debug >= LOG_NOTICE) { 4788 log(LOG_NOTICE, 4789 "pf: BAD ICMP %d:%d ", 4790 icmptype, pd->hdr.icmp->icmp_code); 4791 pf_print_host(pd->src, 0, pd->af); 4792 addlog(" -> "); 4793 pf_print_host(pd->dst, 0, pd->af); 4794 addlog(" state: "); 4795 pf_print_state(*state); 4796 addlog(" seq=%u\n", seq); 4797 } 4798 REASON_SET(reason, PFRES_BADSTATE); 4799 return (PF_DROP); 4800 } else { 4801 if (pf_status.debug >= LOG_DEBUG) { 4802 log(LOG_DEBUG, 4803 "pf: OK ICMP %d:%d ", 4804 icmptype, pd->hdr.icmp->icmp_code); 4805 pf_print_host(pd->src, 0, pd->af); 4806 addlog(" -> "); 4807 pf_print_host(pd->dst, 0, pd->af); 4808 addlog(" state: "); 4809 pf_print_state(*state); 4810 addlog(" seq=%u\n", seq); 4811 } 4812 } 4813 4814 /* translate source/destination address, if necessary */ 4815 if ((*state)->key[PF_SK_WIRE] != 4816 (*state)->key[PF_SK_STACK]) { 4817 struct pf_state_key *nk; 4818 int afto, sidx, didx; 4819 4820 if (PF_REVERSED_KEY((*state)->key, pd->af)) 4821 nk = (*state)->key[pd->sidx]; 4822 else 4823 nk = (*state)->key[pd->didx]; 4824 4825 afto = pd->af != nk->af; 4826 sidx = afto ? pd2.didx : pd2.sidx; 4827 didx = afto ? pd2.sidx : pd2.didx; 4828 4829 #if INET && INET6 4830 if (afto) { 4831 if (pf_translate_icmp_af(nk->af, 4832 pd->hdr.icmp)) 4833 return (PF_DROP); 4834 m_copyback(pd->m, pd->off, 4835 sizeof(struct icmp6_hdr), 4836 pd->hdr.icmp6, M_NOWAIT); 4837 if (pf_change_icmp_af(pd->m, ipoff2, 4838 pd, &pd2, &nk->addr[sidx], 4839 &nk->addr[didx], pd->af, nk->af)) 4840 return (PF_DROP); 4841 if (nk->af == AF_INET) 4842 pd->proto = IPPROTO_ICMP; 4843 else 4844 pd->proto = IPPROTO_ICMPV6; 4845 pf_change_ap(pd, pd2.src, &th.th_sport, 4846 &nk->addr[pd2.sidx], nk->port[sidx], 4847 nk->af); 4848 pf_change_ap(pd, pd2.dst, &th.th_dport, 4849 &nk->addr[pd2.didx], nk->port[didx], 4850 nk->af); 4851 m_copyback(pd2.m, pd2.off, 8, &th, 4852 M_NOWAIT); 4853 pd->m->m_pkthdr.ph_rtableid = 4854 nk->rdomain; 4855 pd->destchg = 1; 4856 PF_ACPY(&pd->nsaddr, 4857 &nk->addr[pd2.sidx], nk->af); 4858 PF_ACPY(&pd->ndaddr, 4859 &nk->addr[pd2.didx], nk->af); 4860 pd->naf = nk->af; 4861 return (PF_AFRT); 4862 } 4863 #endif 4864 if (PF_ANEQ(pd2.src, 4865 &nk->addr[pd2.sidx], pd2.af) || 4866 nk->port[pd2.sidx] != th.th_sport) 4867 pf_change_icmp(pd, pd2.src, 4868 &th.th_sport, daddr, 4869 &nk->addr[pd2.sidx], 4870 nk->port[pd2.sidx], pd2.af); 4871 4872 if (PF_ANEQ(pd2.dst, &nk->addr[pd2.didx], 4873 pd2.af) || pd2.rdomain != nk->rdomain) 4874 pd->destchg = 1; 4875 pd->m->m_pkthdr.ph_rtableid = nk->rdomain; 4876 4877 if (PF_ANEQ(pd2.dst, 4878 &nk->addr[pd2.didx], pd2.af) || 4879 nk->port[pd2.didx] != th.th_dport) 4880 pf_change_icmp(pd, pd2.dst, 4881 &th.th_dport, saddr, 4882 &nk->addr[pd2.didx], 4883 nk->port[pd2.didx], pd2.af); 4884 copyback = 1; 4885 } 4886 4887 if (copyback) { 4888 switch (pd2.af) { 4889 #ifdef INET 4890 case AF_INET: 4891 m_copyback(pd->m, pd->off, ICMP_MINLEN, 4892 pd->hdr.icmp, M_NOWAIT); 4893 m_copyback(pd2.m, ipoff2, sizeof(h2), 4894 &h2, M_NOWAIT); 4895 break; 4896 #endif /* INET */ 4897 #ifdef INET6 4898 case AF_INET6: 4899 m_copyback(pd->m, pd->off, 4900 sizeof(struct icmp6_hdr), 4901 pd->hdr.icmp6, M_NOWAIT); 4902 m_copyback(pd2.m, ipoff2, sizeof(h2_6), 4903 &h2_6, M_NOWAIT); 4904 break; 4905 #endif /* INET6 */ 4906 } 4907 m_copyback(pd2.m, pd2.off, 8, &th, M_NOWAIT); 4908 } 4909 break; 4910 } 4911 case IPPROTO_UDP: { 4912 struct udphdr uh; 4913 4914 if (!pf_pull_hdr(pd2.m, pd2.off, &uh, sizeof(uh), 4915 NULL, reason, pd2.af)) { 4916 DPFPRINTF(LOG_NOTICE, 4917 "ICMP error message too short (udp)"); 4918 return (PF_DROP); 4919 } 4920 4921 key.af = pd2.af; 4922 key.proto = IPPROTO_UDP; 4923 key.rdomain = pd2.rdomain; 4924 PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af); 4925 PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af); 4926 key.port[pd2.sidx] = uh.uh_sport; 4927 key.port[pd2.didx] = uh.uh_dport; 4928 4929 STATE_LOOKUP(pd2.kif, &key, pd2.dir, *state, pd2.m); 4930 4931 /* translate source/destination address, if necessary */ 4932 if ((*state)->key[PF_SK_WIRE] != 4933 (*state)->key[PF_SK_STACK]) { 4934 struct pf_state_key *nk; 4935 int afto, sidx, didx; 4936 4937 if (PF_REVERSED_KEY((*state)->key, pd->af)) 4938 nk = (*state)->key[pd->sidx]; 4939 else 4940 nk = (*state)->key[pd->didx]; 4941 4942 afto = pd->af != nk->af; 4943 sidx = afto ? pd2.didx : pd2.sidx; 4944 didx = afto ? pd2.sidx : pd2.didx; 4945 4946 #if INET && INET6 4947 if (afto) { 4948 if (pf_translate_icmp_af(nk->af, 4949 pd->hdr.icmp)) 4950 return (PF_DROP); 4951 m_copyback(pd->m, pd->off, 4952 sizeof(struct icmp6_hdr), 4953 pd->hdr.icmp6, M_NOWAIT); 4954 if (pf_change_icmp_af(pd->m, ipoff2, 4955 pd, &pd2, &nk->addr[sidx], 4956 &nk->addr[didx], pd->af, nk->af)) 4957 return (PF_DROP); 4958 if (nk->af == AF_INET) 4959 pd->proto = IPPROTO_ICMP; 4960 else 4961 pd->proto = IPPROTO_ICMPV6; 4962 pf_change_ap(pd, pd2.src, &uh.uh_sport, 4963 &nk->addr[pd2.sidx], nk->port[sidx], 4964 nk->af); 4965 pf_change_ap(pd, pd2.dst, &uh.uh_dport, 4966 &nk->addr[pd2.didx], nk->port[didx], 4967 nk->af); 4968 m_copyback(pd2.m, pd2.off, sizeof(uh), 4969 &uh, M_NOWAIT); 4970 pd->m->m_pkthdr.ph_rtableid = 4971 nk->rdomain; 4972 pd->destchg = 1; 4973 PF_ACPY(&pd->nsaddr, 4974 &nk->addr[pd2.sidx], nk->af); 4975 PF_ACPY(&pd->ndaddr, 4976 &nk->addr[pd2.didx], nk->af); 4977 pd->naf = nk->af; 4978 return (PF_AFRT); 4979 } 4980 #endif /* INET && INET6 */ 4981 4982 if (PF_ANEQ(pd2.src, 4983 &nk->addr[pd2.sidx], pd2.af) || 4984 nk->port[pd2.sidx] != uh.uh_sport) 4985 pf_change_icmp(pd, pd2.src, 4986 &uh.uh_sport, daddr, 4987 &nk->addr[pd2.sidx], 4988 nk->port[pd2.sidx], pd2.af); 4989 4990 if (PF_ANEQ(pd2.dst, &nk->addr[pd2.didx], 4991 pd2.af) || pd2.rdomain != nk->rdomain) 4992 pd->destchg = 1; 4993 pd->m->m_pkthdr.ph_rtableid = nk->rdomain; 4994 4995 if (PF_ANEQ(pd2.dst, 4996 &nk->addr[pd2.didx], pd2.af) || 4997 nk->port[pd2.didx] != uh.uh_dport) 4998 pf_change_icmp(pd, pd2.dst, 4999 &uh.uh_dport, saddr, 5000 &nk->addr[pd2.didx], 5001 nk->port[pd2.didx], pd2.af); 5002 5003 switch (pd2.af) { 5004 #ifdef INET 5005 case AF_INET: 5006 m_copyback(pd->m, pd->off, ICMP_MINLEN, 5007 pd->hdr.icmp, M_NOWAIT); 5008 m_copyback(pd2.m, ipoff2, sizeof(h2), 5009 &h2, M_NOWAIT); 5010 break; 5011 #endif /* INET */ 5012 #ifdef INET6 5013 case AF_INET6: 5014 m_copyback(pd->m, pd->off, 5015 sizeof(struct icmp6_hdr), 5016 pd->hdr.icmp6, M_NOWAIT); 5017 m_copyback(pd2.m, ipoff2, sizeof(h2_6), 5018 &h2_6, M_NOWAIT); 5019 break; 5020 #endif /* INET6 */ 5021 } 5022 uh.uh_sum = 0; 5023 m_copyback(pd2.m, pd2.off, sizeof(uh), &uh, 5024 M_NOWAIT); 5025 copyback = 1; 5026 } 5027 break; 5028 } 5029 #ifdef INET 5030 case IPPROTO_ICMP: { 5031 struct icmp iih; 5032 5033 if (pd2.af != AF_INET) { 5034 REASON_SET(reason, PFRES_NORM); 5035 return (PF_DROP); 5036 } 5037 5038 if (!pf_pull_hdr(pd2.m, pd2.off, &iih, ICMP_MINLEN, 5039 NULL, reason, pd2.af)) { 5040 DPFPRINTF(LOG_NOTICE, 5041 "ICMP error message too short (icmp)"); 5042 return (PF_DROP); 5043 } 5044 5045 pd2.hdr.icmp = &iih; 5046 pf_icmp_mapping(&pd2, iih.icmp_type, 5047 &icmp_dir, &multi, &virtual_id, &virtual_type); 5048 5049 ret = pf_icmp_state_lookup(&pd2, &key, state, 5050 virtual_id, virtual_type, icmp_dir, &iidx, 5051 PF_ICMP_MULTI_NONE, 1); 5052 if (ret >= 0) 5053 return (ret); 5054 5055 /* translate source/destination address, if necessary */ 5056 if ((*state)->key[PF_SK_WIRE] != 5057 (*state)->key[PF_SK_STACK]) { 5058 struct pf_state_key *nk; 5059 int afto, sidx, didx; 5060 5061 if (PF_REVERSED_KEY((*state)->key, pd->af)) 5062 nk = (*state)->key[pd->sidx]; 5063 else 5064 nk = (*state)->key[pd->didx]; 5065 5066 afto = pd->af != nk->af; 5067 sidx = afto ? pd2.didx : pd2.sidx; 5068 didx = afto ? pd2.sidx : pd2.didx; 5069 iidx = afto ? !iidx : iidx; 5070 5071 #ifdef INET6 5072 if (afto) { 5073 if (nk->af != AF_INET6) 5074 return (PF_DROP); 5075 if (pf_translate_icmp_af(nk->af, 5076 pd->hdr.icmp)) 5077 return (PF_DROP); 5078 m_copyback(pd->m, pd->off, 5079 sizeof(struct icmp6_hdr), 5080 pd->hdr.icmp6, M_NOWAIT); 5081 if (pf_change_icmp_af(pd->m, ipoff2, 5082 pd, &pd2, &nk->addr[sidx], 5083 &nk->addr[didx], pd->af, nk->af)) 5084 return (PF_DROP); 5085 pd->proto = IPPROTO_ICMPV6; 5086 if (pf_translate_icmp_af(nk->af, &iih)) 5087 return (PF_DROP); 5088 if (virtual_type == htons(ICMP_ECHO) && 5089 nk->port[iidx] != iih.icmp_id) 5090 iih.icmp_id = nk->port[iidx]; 5091 m_copyback(pd2.m, pd2.off, ICMP_MINLEN, 5092 &iih, M_NOWAIT); 5093 pd->m->m_pkthdr.ph_rtableid = 5094 nk->rdomain; 5095 pd->destchg = 1; 5096 PF_ACPY(&pd->nsaddr, 5097 &nk->addr[pd2.sidx], nk->af); 5098 PF_ACPY(&pd->ndaddr, 5099 &nk->addr[pd2.didx], nk->af); 5100 pd->naf = nk->af; 5101 return (PF_AFRT); 5102 } 5103 #endif /* INET6 */ 5104 5105 if (PF_ANEQ(pd2.src, 5106 &nk->addr[pd2.sidx], pd2.af) || 5107 (virtual_type == htons(ICMP_ECHO) && 5108 nk->port[iidx] != iih.icmp_id)) 5109 pf_change_icmp(pd, pd2.src, 5110 (virtual_type == htons(ICMP_ECHO)) ? 5111 &iih.icmp_id : NULL, 5112 daddr, &nk->addr[pd2.sidx], 5113 (virtual_type == htons(ICMP_ECHO)) ? 5114 nk->port[iidx] : 0, AF_INET); 5115 5116 if (PF_ANEQ(pd2.dst, &nk->addr[pd2.didx], 5117 pd2.af) || pd2.rdomain != nk->rdomain) 5118 pd->destchg = 1; 5119 pd->m->m_pkthdr.ph_rtableid = nk->rdomain; 5120 5121 if (PF_ANEQ(pd2.dst, 5122 &nk->addr[pd2.didx], pd2.af)) 5123 pf_change_icmp(pd, pd2.dst, NULL, 5124 saddr, &nk->addr[pd2.didx], 0, 5125 AF_INET); 5126 5127 m_copyback(pd->m, pd->off, ICMP_MINLEN, 5128 pd->hdr.icmp, M_NOWAIT); 5129 m_copyback(pd2.m, ipoff2, sizeof(h2), &h2, 5130 M_NOWAIT); 5131 m_copyback(pd2.m, pd2.off, ICMP_MINLEN, &iih, 5132 M_NOWAIT); 5133 copyback = 1; 5134 } 5135 break; 5136 } 5137 #endif /* INET */ 5138 #ifdef INET6 5139 case IPPROTO_ICMPV6: { 5140 struct icmp6_hdr iih; 5141 5142 if (pd2.af != AF_INET6) { 5143 REASON_SET(reason, PFRES_NORM); 5144 return (PF_DROP); 5145 } 5146 5147 if (!pf_pull_hdr(pd2.m, pd2.off, &iih, 5148 sizeof(struct icmp6_hdr), NULL, reason, pd2.af)) { 5149 DPFPRINTF(LOG_NOTICE, 5150 "ICMP error message too short (icmp6)"); 5151 return (PF_DROP); 5152 } 5153 5154 pd2.hdr.icmp6 = &iih; 5155 pf_icmp_mapping(&pd2, iih.icmp6_type, 5156 &icmp_dir, &multi, &virtual_id, &virtual_type); 5157 ret = pf_icmp_state_lookup(&pd2, &key, state, 5158 virtual_id, virtual_type, icmp_dir, &iidx, 5159 PF_ICMP_MULTI_NONE, 1); 5160 if (ret >= 0) { 5161 if (ret == PF_DROP && pd2.af == AF_INET6 && 5162 icmp_dir == PF_OUT) { 5163 ret = pf_icmp_state_lookup(&pd2, &key, 5164 state, virtual_id, virtual_type, 5165 icmp_dir, &iidx, multi, 1); 5166 if (ret >= 0) 5167 return (ret); 5168 } else 5169 return (ret); 5170 } 5171 5172 /* translate source/destination address, if necessary */ 5173 if ((*state)->key[PF_SK_WIRE] != 5174 (*state)->key[PF_SK_STACK]) { 5175 struct pf_state_key *nk; 5176 int afto, sidx, didx; 5177 5178 if (PF_REVERSED_KEY((*state)->key, pd->af)) 5179 nk = (*state)->key[pd->sidx]; 5180 else 5181 nk = (*state)->key[pd->didx]; 5182 5183 afto = pd->af != nk->af; 5184 sidx = afto ? pd2.didx : pd2.sidx; 5185 didx = afto ? pd2.sidx : pd2.didx; 5186 iidx = afto ? !iidx : iidx; 5187 5188 #ifdef INET 5189 if (afto) { 5190 if (nk->af != AF_INET) 5191 return (PF_DROP); 5192 if (pf_translate_icmp_af(nk->af, 5193 pd->hdr.icmp)) 5194 return (PF_DROP); 5195 m_copyback(pd->m, pd->off, 5196 sizeof(struct icmp6_hdr), 5197 pd->hdr.icmp6, M_NOWAIT); 5198 if (pf_change_icmp_af(pd->m, ipoff2, 5199 pd, &pd2, &nk->addr[sidx], 5200 &nk->addr[didx], pd->af, nk->af)) 5201 return (PF_DROP); 5202 pd->proto = IPPROTO_ICMP; 5203 if (pf_translate_icmp_af(nk->af, &iih)) 5204 return (PF_DROP); 5205 if (virtual_type == 5206 htons(ICMP6_ECHO_REQUEST) && 5207 nk->port[iidx] != iih.icmp6_id) 5208 iih.icmp6_id = nk->port[iidx]; 5209 m_copyback(pd2.m, pd2.off, 5210 sizeof(struct icmp6_hdr), &iih, 5211 M_NOWAIT); 5212 pd->m->m_pkthdr.ph_rtableid = 5213 nk->rdomain; 5214 pd->destchg = 1; 5215 PF_ACPY(&pd->nsaddr, 5216 &nk->addr[pd2.sidx], nk->af); 5217 PF_ACPY(&pd->ndaddr, 5218 &nk->addr[pd2.didx], nk->af); 5219 pd->naf = nk->af; 5220 return (PF_AFRT); 5221 } 5222 #endif /* INET */ 5223 5224 if (PF_ANEQ(pd2.src, 5225 &nk->addr[pd2.sidx], pd2.af) || 5226 ((virtual_type == 5227 htons(ICMP6_ECHO_REQUEST)) && 5228 nk->port[pd2.sidx] != iih.icmp6_id)) 5229 pf_change_icmp(pd, pd2.src, 5230 (virtual_type == 5231 htons(ICMP6_ECHO_REQUEST)) 5232 ? &iih.icmp6_id : NULL, 5233 daddr, &nk->addr[pd2.sidx], 5234 (virtual_type == 5235 htons(ICMP6_ECHO_REQUEST)) 5236 ? nk->port[iidx] : 0, AF_INET6); 5237 5238 if (PF_ANEQ(pd2.dst, &nk->addr[pd2.didx], 5239 pd2.af) || pd2.rdomain != nk->rdomain) 5240 pd->destchg = 1; 5241 pd->m->m_pkthdr.ph_rtableid = nk->rdomain; 5242 5243 if (PF_ANEQ(pd2.dst, 5244 &nk->addr[pd2.didx], pd2.af)) 5245 pf_change_icmp(pd, pd2.dst, NULL, 5246 saddr, &nk->addr[pd2.didx], 0, 5247 AF_INET6); 5248 5249 m_copyback(pd->m, pd->off, 5250 sizeof(struct icmp6_hdr), pd->hdr.icmp6, 5251 M_NOWAIT); 5252 m_copyback(pd2.m, ipoff2, sizeof(h2_6), &h2_6, 5253 M_NOWAIT); 5254 m_copyback(pd2.m, pd2.off, 5255 sizeof(struct icmp6_hdr), &iih, M_NOWAIT); 5256 copyback = 1; 5257 } 5258 break; 5259 } 5260 #endif /* INET6 */ 5261 default: { 5262 key.af = pd2.af; 5263 key.proto = pd2.proto; 5264 key.rdomain = pd2.rdomain; 5265 PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af); 5266 PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af); 5267 key.port[0] = key.port[1] = 0; 5268 5269 STATE_LOOKUP(pd2.kif, &key, pd2.dir, *state, pd2.m); 5270 5271 /* translate source/destination address, if necessary */ 5272 if ((*state)->key[PF_SK_WIRE] != 5273 (*state)->key[PF_SK_STACK]) { 5274 struct pf_state_key *nk = 5275 (*state)->key[pd->didx]; 5276 5277 if (PF_ANEQ(pd2.src, 5278 &nk->addr[pd2.sidx], pd2.af)) 5279 pf_change_icmp(pd, pd2.src, NULL, 5280 daddr, &nk->addr[pd2.sidx], 0, 5281 pd2.af); 5282 5283 if (PF_ANEQ(pd2.dst, &nk->addr[pd2.didx], 5284 pd2.af) || pd2.rdomain != nk->rdomain) 5285 pd->destchg = 1; 5286 pd->m->m_pkthdr.ph_rtableid = nk->rdomain; 5287 5288 if (PF_ANEQ(pd2.dst, 5289 &nk->addr[pd2.didx], pd2.af)) 5290 pf_change_icmp(pd, pd2.dst, NULL, 5291 saddr, &nk->addr[pd2.didx], 0, 5292 pd2.af); 5293 5294 switch (pd2.af) { 5295 #ifdef INET 5296 case AF_INET: 5297 m_copyback(pd->m, pd->off, ICMP_MINLEN, 5298 pd->hdr.icmp, M_NOWAIT); 5299 m_copyback(pd2.m, ipoff2, sizeof(h2), 5300 &h2, M_NOWAIT); 5301 break; 5302 #endif /* INET */ 5303 #ifdef INET6 5304 case AF_INET6: 5305 m_copyback(pd->m, pd->off, 5306 sizeof(struct icmp6_hdr), 5307 pd->hdr.icmp6, M_NOWAIT); 5308 m_copyback(pd2.m, ipoff2, sizeof(h2_6), 5309 &h2_6, M_NOWAIT); 5310 break; 5311 #endif /* INET6 */ 5312 } 5313 copyback = 1; 5314 } 5315 break; 5316 } 5317 } 5318 } 5319 if (copyback) { 5320 pf_cksum(pd, pd->m); 5321 m_copyback(pd->m, pd->off, pd->hdrlen, pd->hdr.any, M_NOWAIT); 5322 } 5323 5324 return (PF_PASS); 5325 } 5326 5327 /* 5328 * ipoff and off are measured from the start of the mbuf chain. 5329 * h must be at "ipoff" on the mbuf chain. 5330 */ 5331 void * 5332 pf_pull_hdr(struct mbuf *m, int off, void *p, int len, 5333 u_short *actionp, u_short *reasonp, sa_family_t af) 5334 { 5335 switch (af) { 5336 #ifdef INET 5337 case AF_INET: { 5338 struct ip *h = mtod(m, struct ip *); 5339 u_int16_t fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3; 5340 5341 if (fragoff) { 5342 if (fragoff >= len) 5343 ACTION_SET(actionp, PF_PASS); 5344 else { 5345 ACTION_SET(actionp, PF_DROP); 5346 REASON_SET(reasonp, PFRES_FRAG); 5347 } 5348 return (NULL); 5349 } 5350 if (m->m_pkthdr.len < off + len || 5351 ntohs(h->ip_len) < off + len) { 5352 ACTION_SET(actionp, PF_DROP); 5353 REASON_SET(reasonp, PFRES_SHORT); 5354 return (NULL); 5355 } 5356 break; 5357 } 5358 #endif /* INET */ 5359 #ifdef INET6 5360 case AF_INET6: { 5361 struct ip6_hdr *h = mtod(m, struct ip6_hdr *); 5362 5363 if (m->m_pkthdr.len < off + len || 5364 (ntohs(h->ip6_plen) + sizeof(struct ip6_hdr)) < 5365 (unsigned)(off + len)) { 5366 ACTION_SET(actionp, PF_DROP); 5367 REASON_SET(reasonp, PFRES_SHORT); 5368 return (NULL); 5369 } 5370 break; 5371 } 5372 #endif /* INET6 */ 5373 } 5374 m_copydata(m, off, len, p); 5375 return (p); 5376 } 5377 5378 int 5379 pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *kif, 5380 int rtableid) 5381 { 5382 struct sockaddr_in *dst; 5383 int ret = 1; 5384 int check_mpath; 5385 #ifdef INET6 5386 struct sockaddr_in6 *dst6; 5387 struct route_in6 ro; 5388 #else 5389 struct route ro; 5390 #endif 5391 struct rtentry *rt; 5392 struct ifnet *ifp; 5393 5394 check_mpath = 0; 5395 bzero(&ro, sizeof(ro)); 5396 ro.ro_tableid = rtableid; 5397 switch (af) { 5398 #ifdef INET 5399 case AF_INET: 5400 dst = (struct sockaddr_in *)&ro.ro_dst; 5401 dst->sin_family = AF_INET; 5402 dst->sin_len = sizeof(*dst); 5403 dst->sin_addr = addr->v4; 5404 if (ipmultipath) 5405 check_mpath = 1; 5406 break; 5407 #endif /* INET */ 5408 #ifdef INET6 5409 case AF_INET6: 5410 /* 5411 * Skip check for addresses with embedded interface scope, 5412 * as they would always match anyway. 5413 */ 5414 if (IN6_IS_SCOPE_EMBED(&addr->v6)) 5415 goto out; 5416 dst6 = &ro.ro_dst; 5417 dst6->sin6_family = AF_INET6; 5418 dst6->sin6_len = sizeof(*dst6); 5419 dst6->sin6_addr = addr->v6; 5420 if (ip6_multipath) 5421 check_mpath = 1; 5422 break; 5423 #endif /* INET6 */ 5424 } 5425 5426 /* Skip checks for ipsec interfaces */ 5427 if (kif != NULL && kif->pfik_ifp->if_type == IFT_ENC) 5428 goto out; 5429 5430 rtalloc_noclone((struct route *)&ro); 5431 5432 if (ro.ro_rt != NULL) { 5433 /* No interface given, this is a no-route check */ 5434 if (kif == NULL) 5435 goto out; 5436 5437 if (kif->pfik_ifp == NULL) { 5438 ret = 0; 5439 goto out; 5440 } 5441 5442 /* Perform uRPF check if passed input interface */ 5443 ret = 0; 5444 rt = ro.ro_rt; 5445 do { 5446 if (rt->rt_ifp->if_type == IFT_CARP) 5447 ifp = rt->rt_ifp->if_carpdev; 5448 else 5449 ifp = rt->rt_ifp; 5450 5451 if (kif->pfik_ifp == ifp) 5452 ret = 1; 5453 rt = rt_mpath_next(rt); 5454 } while (check_mpath == 1 && rt != NULL && ret == 0); 5455 } else 5456 ret = 0; 5457 out: 5458 if (ro.ro_rt != NULL) 5459 RTFREE(ro.ro_rt); 5460 return (ret); 5461 } 5462 5463 int 5464 pf_rtlabel_match(struct pf_addr *addr, sa_family_t af, struct pf_addr_wrap *aw, 5465 int rtableid) 5466 { 5467 struct sockaddr_in *dst; 5468 #ifdef INET6 5469 struct sockaddr_in6 *dst6; 5470 struct route_in6 ro; 5471 #else 5472 struct route ro; 5473 #endif 5474 int ret = 0; 5475 5476 bzero(&ro, sizeof(ro)); 5477 ro.ro_tableid = rtableid; 5478 switch (af) { 5479 #ifdef INET 5480 case AF_INET: 5481 dst = (struct sockaddr_in *)(&ro.ro_dst); 5482 dst->sin_family = AF_INET; 5483 dst->sin_len = sizeof(*dst); 5484 dst->sin_addr = addr->v4; 5485 break; 5486 #endif /* INET */ 5487 #ifdef INET6 5488 case AF_INET6: 5489 dst6 = &ro.ro_dst; 5490 dst6->sin6_family = AF_INET6; 5491 dst6->sin6_len = sizeof(*dst6); 5492 dst6->sin6_addr = addr->v6; 5493 break; 5494 #endif /* INET6 */ 5495 } 5496 5497 rtalloc_noclone((struct route *)&ro); 5498 5499 if (ro.ro_rt != NULL) { 5500 if (ro.ro_rt->rt_labelid == aw->v.rtlabel) 5501 ret = 1; 5502 RTFREE(ro.ro_rt); 5503 } 5504 5505 return (ret); 5506 } 5507 5508 #ifdef INET 5509 void 5510 pf_route(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp, 5511 struct pf_state *s) 5512 { 5513 struct mbuf *m0, *m1; 5514 struct route iproute; 5515 struct route *ro = NULL; 5516 struct sockaddr_in *dst; 5517 struct ip *ip; 5518 struct ifnet *ifp = NULL; 5519 struct pf_addr naddr; 5520 struct pf_src_node *sns[PF_SN_MAX]; 5521 int error = 0; 5522 #ifdef IPSEC 5523 struct m_tag *mtag; 5524 #endif /* IPSEC */ 5525 5526 if (m == NULL || *m == NULL || r == NULL || 5527 (dir != PF_IN && dir != PF_OUT) || oifp == NULL) 5528 panic("pf_route: invalid parameters"); 5529 5530 if ((*m)->m_pkthdr.pf.routed++ > 3) { 5531 m0 = *m; 5532 *m = NULL; 5533 goto bad; 5534 } 5535 5536 if (r->rt == PF_DUPTO) { 5537 if ((m0 = m_copym2(*m, 0, M_COPYALL, M_NOWAIT)) == NULL) 5538 return; 5539 } else { 5540 if ((r->rt == PF_REPLYTO) == (r->direction == dir)) 5541 return; 5542 m0 = *m; 5543 } 5544 5545 if (m0->m_len < sizeof(struct ip)) { 5546 DPFPRINTF(LOG_ERR, 5547 "pf_route: m0->m_len < sizeof(struct ip)"); 5548 goto bad; 5549 } 5550 5551 ip = mtod(m0, struct ip *); 5552 5553 ro = &iproute; 5554 bzero((caddr_t)ro, sizeof(*ro)); 5555 dst = satosin(&ro->ro_dst); 5556 dst->sin_family = AF_INET; 5557 dst->sin_len = sizeof(*dst); 5558 dst->sin_addr = ip->ip_dst; 5559 ro->ro_tableid = m0->m_pkthdr.ph_rtableid; 5560 5561 if (!r->rt) { 5562 rtalloc(ro); 5563 if (ro->ro_rt == 0) { 5564 ipstat.ips_noroute++; 5565 goto bad; 5566 } 5567 5568 ifp = ro->ro_rt->rt_ifp; 5569 ro->ro_rt->rt_use++; 5570 5571 if (ro->ro_rt->rt_flags & RTF_GATEWAY) 5572 dst = satosin(ro->ro_rt->rt_gateway); 5573 5574 m0->m_pkthdr.pf.flags |= PF_TAG_GENERATED; 5575 } else { 5576 if (s == NULL) { 5577 bzero(sns, sizeof(sns)); 5578 if (pf_map_addr(AF_INET, r, 5579 (struct pf_addr *)&ip->ip_src, 5580 &naddr, NULL, sns, &r->route, PF_SN_ROUTE)) { 5581 DPFPRINTF(LOG_ERR, 5582 "pf_route: pf_map_addr() failed."); 5583 goto bad; 5584 } 5585 5586 if (!PF_AZERO(&naddr, AF_INET)) 5587 dst->sin_addr.s_addr = naddr.v4.s_addr; 5588 ifp = r->route.kif ? 5589 r->route.kif->pfik_ifp : NULL; 5590 } else { 5591 if (!PF_AZERO(&s->rt_addr, AF_INET)) 5592 dst->sin_addr.s_addr = 5593 s->rt_addr.v4.s_addr; 5594 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL; 5595 } 5596 } 5597 if (ifp == NULL) 5598 goto bad; 5599 5600 5601 if (oifp != ifp) { 5602 if (pf_test(AF_INET, PF_OUT, ifp, &m0, NULL) != PF_PASS) 5603 goto bad; 5604 else if (m0 == NULL) 5605 goto done; 5606 if (m0->m_len < sizeof(struct ip)) { 5607 DPFPRINTF(LOG_ERR, 5608 "pf_route: m0->m_len < sizeof(struct ip)"); 5609 goto bad; 5610 } 5611 ip = mtod(m0, struct ip *); 5612 } 5613 5614 /* Copied from ip_output. */ 5615 #ifdef IPSEC 5616 /* 5617 * If we got here and IPsec crypto processing didn't happen, drop it. 5618 */ 5619 if ((mtag = m_tag_find(m0, PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED, NULL)) 5620 != NULL) { 5621 /* Notify IPsec to do its own crypto. */ 5622 ipsp_skipcrypto_unmark((struct tdb_ident *)(mtag + 1)); 5623 goto bad; 5624 } 5625 #endif /* IPSEC */ 5626 5627 in_proto_cksum_out(m0, ifp); 5628 5629 if (ntohs(ip->ip_len) <= ifp->if_mtu) { 5630 ip->ip_sum = 0; 5631 if (ifp->if_capabilities & IFCAP_CSUM_IPv4) 5632 m0->m_pkthdr.csum_flags |= M_IPV4_CSUM_OUT; 5633 else { 5634 ipstat.ips_outswcsum++; 5635 ip->ip_sum = in_cksum(m0, ip->ip_hl << 2); 5636 } 5637 error = (*ifp->if_output)(ifp, m0, sintosa(dst), NULL); 5638 goto done; 5639 } 5640 5641 /* 5642 * Too large for interface; fragment if possible. 5643 * Must be able to put at least 8 bytes per fragment. 5644 */ 5645 if (ip->ip_off & htons(IP_DF)) { 5646 ipstat.ips_cantfrag++; 5647 if (r->rt != PF_DUPTO) { 5648 icmp_error(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 0, 5649 ifp->if_mtu); 5650 goto done; 5651 } else 5652 goto bad; 5653 } 5654 5655 m1 = m0; 5656 error = ip_fragment(m0, ifp, ifp->if_mtu); 5657 if (error) { 5658 m0 = NULL; 5659 goto bad; 5660 } 5661 5662 for (m0 = m1; m0; m0 = m1) { 5663 m1 = m0->m_nextpkt; 5664 m0->m_nextpkt = 0; 5665 if (error == 0) 5666 error = (*ifp->if_output)(ifp, m0, sintosa(dst), 5667 NULL); 5668 else 5669 m_freem(m0); 5670 } 5671 5672 if (error == 0) 5673 ipstat.ips_fragmented++; 5674 5675 done: 5676 if (r->rt != PF_DUPTO) 5677 *m = NULL; 5678 if (ro == &iproute && ro->ro_rt) 5679 RTFREE(ro->ro_rt); 5680 return; 5681 5682 bad: 5683 m_freem(m0); 5684 goto done; 5685 } 5686 #endif /* INET */ 5687 5688 #ifdef INET6 5689 void 5690 pf_route6(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp, 5691 struct pf_state *s) 5692 { 5693 struct mbuf *m0; 5694 struct route_in6 ip6route; 5695 struct route_in6 *ro; 5696 struct sockaddr_in6 *dst; 5697 struct ip6_hdr *ip6; 5698 struct ifnet *ifp = NULL; 5699 struct pf_addr naddr; 5700 struct pf_src_node *sns[PF_SN_MAX]; 5701 5702 if (m == NULL || *m == NULL || r == NULL || 5703 (dir != PF_IN && dir != PF_OUT) || oifp == NULL) 5704 panic("pf_route6: invalid parameters"); 5705 5706 if ((*m)->m_pkthdr.pf.routed++ > 3) { 5707 m0 = *m; 5708 *m = NULL; 5709 goto bad; 5710 } 5711 5712 if (r->rt == PF_DUPTO) { 5713 if ((m0 = m_copym2(*m, 0, M_COPYALL, M_NOWAIT)) == NULL) 5714 return; 5715 } else { 5716 if ((r->rt == PF_REPLYTO) == (r->direction == dir)) 5717 return; 5718 m0 = *m; 5719 } 5720 5721 if (m0->m_len < sizeof(struct ip6_hdr)) { 5722 DPFPRINTF(LOG_ERR, 5723 "pf_route6: m0->m_len < sizeof(struct ip6_hdr)"); 5724 goto bad; 5725 } 5726 ip6 = mtod(m0, struct ip6_hdr *); 5727 5728 ro = &ip6route; 5729 bzero((caddr_t)ro, sizeof(*ro)); 5730 dst = (struct sockaddr_in6 *)&ro->ro_dst; 5731 dst->sin6_family = AF_INET6; 5732 dst->sin6_len = sizeof(*dst); 5733 dst->sin6_addr = ip6->ip6_dst; 5734 ro->ro_tableid = m0->m_pkthdr.ph_rtableid; 5735 5736 if (!r->rt) { 5737 m0->m_pkthdr.pf.flags |= PF_TAG_GENERATED; 5738 ip6_output(m0, NULL, NULL, 0, NULL, NULL, NULL); 5739 return; 5740 } 5741 5742 if (s == NULL) { 5743 bzero(sns, sizeof(sns)); 5744 if (pf_map_addr(AF_INET6, r, (struct pf_addr *)&ip6->ip6_src, 5745 &naddr, NULL, sns, &r->route, PF_SN_ROUTE)) { 5746 DPFPRINTF(LOG_ERR, 5747 "pf_route6: pf_map_addr() failed."); 5748 goto bad; 5749 } 5750 if (!PF_AZERO(&naddr, AF_INET6)) 5751 PF_ACPY((struct pf_addr *)&dst->sin6_addr, 5752 &naddr, AF_INET6); 5753 ifp = r->route.kif ? r->route.kif->pfik_ifp : NULL; 5754 } else { 5755 if (!PF_AZERO(&s->rt_addr, AF_INET6)) 5756 PF_ACPY((struct pf_addr *)&dst->sin6_addr, 5757 &s->rt_addr, AF_INET6); 5758 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL; 5759 } 5760 if (ifp == NULL) 5761 goto bad; 5762 5763 if (oifp != ifp) { 5764 if (pf_test(AF_INET6, PF_OUT, ifp, &m0, NULL) != PF_PASS) 5765 goto bad; 5766 else if (m0 == NULL) 5767 goto done; 5768 if (m0->m_len < sizeof(struct ip6_hdr)) { 5769 DPFPRINTF(LOG_ERR, 5770 "pf_route6: m0->m_len < sizeof(struct ip6_hdr)"); 5771 goto bad; 5772 } 5773 } 5774 5775 /* 5776 * If the packet is too large for the outgoing interface, 5777 * send back an icmp6 error. 5778 */ 5779 if (IN6_IS_SCOPE_EMBED(&dst->sin6_addr)) 5780 dst->sin6_addr.s6_addr16[1] = htons(ifp->if_index); 5781 if ((u_long)m0->m_pkthdr.len <= ifp->if_mtu) { 5782 nd6_output(ifp, ifp, m0, dst, NULL); 5783 } else { 5784 in6_ifstat_inc(ifp, ifs6_in_toobig); 5785 if (r->rt != PF_DUPTO) 5786 icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu); 5787 else 5788 goto bad; 5789 } 5790 5791 done: 5792 if (r->rt != PF_DUPTO) 5793 *m = NULL; 5794 return; 5795 5796 bad: 5797 m_freem(m0); 5798 goto done; 5799 } 5800 #endif /* INET6 */ 5801 5802 5803 /* 5804 * check protocol (tcp/udp/icmp/icmp6) checksum and set mbuf flag 5805 * off is the offset where the protocol header starts 5806 * len is the total length of protocol header plus payload 5807 * returns 0 when the checksum is valid, otherwise returns 1. 5808 * if the _OUT flag is set the checksum isn't done yet, consider these ok 5809 */ 5810 int 5811 pf_check_proto_cksum(struct pf_pdesc *pd, int off, int len, u_int8_t p, 5812 sa_family_t af) 5813 { 5814 u_int16_t flag_ok, flag_bad, flag_out; 5815 u_int16_t sum; 5816 5817 if (pd->csum_status == PF_CSUM_OK) 5818 return (0); 5819 if (pd->csum_status == PF_CSUM_BAD) 5820 return (1); 5821 5822 switch (p) { 5823 case IPPROTO_TCP: 5824 flag_ok = M_TCP_CSUM_IN_OK; 5825 flag_out = M_TCP_CSUM_OUT; 5826 flag_bad = M_TCP_CSUM_IN_BAD; 5827 break; 5828 case IPPROTO_UDP: 5829 flag_ok = M_UDP_CSUM_IN_OK; 5830 flag_out = M_UDP_CSUM_OUT; 5831 flag_bad = M_UDP_CSUM_IN_BAD; 5832 break; 5833 case IPPROTO_ICMP: 5834 #ifdef INET6 5835 case IPPROTO_ICMPV6: 5836 #endif /* INET6 */ 5837 flag_ok = M_ICMP_CSUM_IN_OK; 5838 flag_out = M_ICMP_CSUM_OUT; 5839 flag_bad = M_ICMP_CSUM_IN_BAD; 5840 break; 5841 default: 5842 return (1); 5843 } 5844 if (pd->m->m_pkthdr.csum_flags & (flag_ok | flag_out)) { 5845 pd->csum_status = PF_CSUM_OK; 5846 return (0); 5847 } 5848 if (pd->m->m_pkthdr.csum_flags & flag_bad || off < sizeof(struct ip) || 5849 pd->m->m_pkthdr.len < off + len) { 5850 pd->csum_status = PF_CSUM_BAD; 5851 return (1); 5852 } 5853 5854 /* need to do it in software */ 5855 if (p == IPPROTO_TCP) 5856 tcpstat.tcps_inswcsum++; 5857 else if (p == IPPROTO_UDP) 5858 udpstat.udps_inswcsum++; 5859 5860 switch (af) { 5861 #ifdef INET 5862 case AF_INET: 5863 if (pd->m->m_len < sizeof(struct ip)) { 5864 pd->csum_status = PF_CSUM_BAD; 5865 return (1); 5866 } 5867 sum = in4_cksum(pd->m, (p == IPPROTO_ICMP ? 0 : p), off, len); 5868 break; 5869 #endif /* INET */ 5870 #ifdef INET6 5871 case AF_INET6: 5872 if (pd->m->m_len < sizeof(struct ip6_hdr)) { 5873 pd->csum_status = PF_CSUM_BAD; 5874 return (1); 5875 } 5876 sum = in6_cksum(pd->m, p, off, len); 5877 break; 5878 #endif /* INET6 */ 5879 } 5880 if (sum) { 5881 switch (p) { 5882 case IPPROTO_TCP: 5883 tcpstat.tcps_rcvbadsum++; 5884 break; 5885 case IPPROTO_UDP: 5886 udpstat.udps_badsum++; 5887 break; 5888 case IPPROTO_ICMP: 5889 icmpstat.icps_checksum++; 5890 break; 5891 #ifdef INET6 5892 case IPPROTO_ICMPV6: 5893 icmp6stat.icp6s_checksum++; 5894 break; 5895 #endif /* INET6 */ 5896 } 5897 pd->m->m_pkthdr.csum_flags |= flag_bad; 5898 pd->csum_status = PF_CSUM_BAD; 5899 return (1); 5900 } 5901 pd->m->m_pkthdr.csum_flags |= flag_ok; 5902 pd->csum_status = PF_CSUM_OK; 5903 return (0); 5904 } 5905 5906 struct pf_divert * 5907 pf_find_divert(struct mbuf *m) 5908 { 5909 struct m_tag *mtag; 5910 5911 if ((mtag = m_tag_find(m, PACKET_TAG_PF_DIVERT, NULL)) == NULL) 5912 return (NULL); 5913 5914 return ((struct pf_divert *)(mtag + 1)); 5915 } 5916 5917 struct pf_divert * 5918 pf_get_divert(struct mbuf *m) 5919 { 5920 struct m_tag *mtag; 5921 5922 if ((mtag = m_tag_find(m, PACKET_TAG_PF_DIVERT, NULL)) == NULL) { 5923 mtag = m_tag_get(PACKET_TAG_PF_DIVERT, sizeof(struct pf_divert), 5924 M_NOWAIT); 5925 if (mtag == NULL) 5926 return (NULL); 5927 bzero(mtag + 1, sizeof(struct pf_divert)); 5928 m_tag_prepend(m, mtag); 5929 } 5930 5931 return ((struct pf_divert *)(mtag + 1)); 5932 } 5933 5934 #ifdef INET6 5935 int 5936 pf_walk_option6(struct pf_pdesc *pd, struct ip6_hdr *h, int off, int end, 5937 u_short *reason) 5938 { 5939 struct ip6_opt opt; 5940 struct ip6_opt_jumbo jumbo; 5941 5942 while (off < end) { 5943 if (!pf_pull_hdr(pd->m, off, &opt.ip6o_type, 5944 sizeof(opt.ip6o_type), NULL, reason, AF_INET6)) { 5945 DPFPRINTF(LOG_NOTICE, "IPv6 short opt type"); 5946 return (PF_DROP); 5947 } 5948 if (opt.ip6o_type == IP6OPT_PAD1) { 5949 off++; 5950 continue; 5951 } 5952 if (!pf_pull_hdr(pd->m, off, &opt, sizeof(opt), 5953 NULL, reason, AF_INET6)) { 5954 DPFPRINTF(LOG_NOTICE, "IPv6 short opt"); 5955 return (PF_DROP); 5956 } 5957 if (off + sizeof(opt) + opt.ip6o_len > end) { 5958 DPFPRINTF(LOG_NOTICE, "IPv6 long opt"); 5959 REASON_SET(reason, PFRES_IPOPTIONS); 5960 return (PF_DROP); 5961 } 5962 switch (opt.ip6o_type) { 5963 case IP6OPT_JUMBO: 5964 if (pd->jumbolen != 0) { 5965 DPFPRINTF(LOG_NOTICE, "IPv6 multiple jumbo"); 5966 REASON_SET(reason, PFRES_IPOPTIONS); 5967 return (PF_DROP); 5968 } 5969 if (ntohs(h->ip6_plen) != 0) { 5970 DPFPRINTF(LOG_NOTICE, "IPv6 bad jumbo plen"); 5971 REASON_SET(reason, PFRES_IPOPTIONS); 5972 return (PF_DROP); 5973 } 5974 if (!pf_pull_hdr(pd->m, off, &jumbo, sizeof(jumbo), 5975 NULL, reason, AF_INET6)) { 5976 DPFPRINTF(LOG_NOTICE, "IPv6 short jumbo"); 5977 return (PF_DROP); 5978 } 5979 memcpy(&pd->jumbolen, jumbo.ip6oj_jumbo_len, 5980 sizeof(pd->jumbolen)); 5981 pd->jumbolen = ntohl(pd->jumbolen); 5982 if (pd->jumbolen < IPV6_MAXPACKET) { 5983 DPFPRINTF(LOG_NOTICE, "IPv6 short jumbolen"); 5984 REASON_SET(reason, PFRES_IPOPTIONS); 5985 return (PF_DROP); 5986 } 5987 break; 5988 default: 5989 break; 5990 } 5991 off += sizeof(opt) + opt.ip6o_len; 5992 } 5993 5994 return (PF_PASS); 5995 } 5996 5997 int 5998 pf_walk_header6(struct pf_pdesc *pd, struct ip6_hdr *h, u_short *reason) 5999 { 6000 struct ip6_frag frag; 6001 struct ip6_ext ext; 6002 struct ip6_rthdr rthdr; 6003 u_int32_t end; 6004 int fraghdr_cnt = 0, rthdr_cnt = 0; 6005 6006 pd->off += sizeof(struct ip6_hdr); 6007 end = pd->off + ntohs(h->ip6_plen); 6008 pd->fragoff = pd->extoff = pd->jumbolen = 0; 6009 pd->proto = h->ip6_nxt; 6010 for (;;) { 6011 switch (pd->proto) { 6012 case IPPROTO_FRAGMENT: 6013 if (fraghdr_cnt++) { 6014 DPFPRINTF(LOG_NOTICE, "IPv6 multiple fragment"); 6015 REASON_SET(reason, PFRES_FRAG); 6016 return (PF_DROP); 6017 } 6018 /* jumbo payload packets cannot be fragmented */ 6019 if (pd->jumbolen != 0) { 6020 DPFPRINTF(LOG_NOTICE, "IPv6 fragmented jumbo"); 6021 REASON_SET(reason, PFRES_FRAG); 6022 return (PF_DROP); 6023 } 6024 if (!pf_pull_hdr(pd->m, pd->off, &frag, sizeof(frag), 6025 NULL, reason, AF_INET6)) { 6026 DPFPRINTF(LOG_NOTICE, "IPv6 short fragment"); 6027 return (PF_DROP); 6028 } 6029 /* stop walking over non initial fragments */ 6030 if (ntohs((frag.ip6f_offlg & IP6F_OFF_MASK)) != 0) { 6031 pd->fragoff = pd->off; 6032 return (PF_PASS); 6033 } 6034 /* RFC6946: reassemble only non atomic fragments */ 6035 if (frag.ip6f_offlg & IP6F_MORE_FRAG) 6036 pd->fragoff = pd->off; 6037 pd->off += sizeof(frag); 6038 pd->proto = frag.ip6f_nxt; 6039 break; 6040 case IPPROTO_ROUTING: 6041 if (rthdr_cnt++) { 6042 DPFPRINTF(LOG_NOTICE, "IPv6 multiple rthdr"); 6043 REASON_SET(reason, PFRES_IPOPTIONS); 6044 return (PF_DROP); 6045 } 6046 /* fragments may be short */ 6047 if (pd->fragoff != 0 && end < pd->off + sizeof(rthdr)) { 6048 pd->off = pd->fragoff; 6049 pd->proto = IPPROTO_FRAGMENT; 6050 return (PF_PASS); 6051 } 6052 if (!pf_pull_hdr(pd->m, pd->off, &rthdr, sizeof(rthdr), 6053 NULL, reason, AF_INET6)) { 6054 DPFPRINTF(LOG_NOTICE, "IPv6 short rthdr"); 6055 return (PF_DROP); 6056 } 6057 if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) { 6058 DPFPRINTF(LOG_NOTICE, "IPv6 rthdr0"); 6059 REASON_SET(reason, PFRES_IPOPTIONS); 6060 return (PF_DROP); 6061 } 6062 /* FALLTHROUGH */ 6063 case IPPROTO_AH: 6064 case IPPROTO_HOPOPTS: 6065 case IPPROTO_DSTOPTS: 6066 /* fragments may be short */ 6067 if (pd->fragoff != 0 && end < pd->off + sizeof(ext)) { 6068 pd->off = pd->fragoff; 6069 pd->proto = IPPROTO_FRAGMENT; 6070 return (PF_PASS); 6071 } 6072 if (!pf_pull_hdr(pd->m, pd->off, &ext, sizeof(ext), 6073 NULL, reason, AF_INET6)) { 6074 DPFPRINTF(LOG_NOTICE, "IPv6 short exthdr"); 6075 return (PF_DROP); 6076 } 6077 /* reassembly needs the ext header before the frag */ 6078 if (pd->fragoff == 0) 6079 pd->extoff = pd->off; 6080 if (pd->proto == IPPROTO_HOPOPTS && pd->fragoff == 0) { 6081 if (pf_walk_option6(pd, h, 6082 pd->off + sizeof(ext), 6083 pd->off + (ext.ip6e_len + 1) * 8, reason) 6084 != PF_PASS) 6085 return (PF_DROP); 6086 if (ntohs(h->ip6_plen) == 0 && 6087 pd->jumbolen != 0) { 6088 DPFPRINTF(LOG_NOTICE, 6089 "IPv6 missing jumbo"); 6090 REASON_SET(reason, PFRES_IPOPTIONS); 6091 return (PF_DROP); 6092 } 6093 } 6094 if (pd->proto == IPPROTO_AH) 6095 pd->off += (ext.ip6e_len + 2) * 4; 6096 else 6097 pd->off += (ext.ip6e_len + 1) * 8; 6098 pd->proto = ext.ip6e_nxt; 6099 break; 6100 case IPPROTO_TCP: 6101 case IPPROTO_UDP: 6102 case IPPROTO_ICMPV6: 6103 /* fragments may be short, ignore inner header then */ 6104 if (pd->fragoff != 0 && end < pd->off + 6105 (pd->proto == IPPROTO_TCP ? sizeof(struct tcphdr) : 6106 pd->proto == IPPROTO_UDP ? sizeof(struct udphdr) : 6107 sizeof(struct icmp6_hdr))) { 6108 pd->off = pd->fragoff; 6109 pd->proto = IPPROTO_FRAGMENT; 6110 } 6111 /* FALLTHROUGH */ 6112 default: 6113 return (PF_PASS); 6114 } 6115 } 6116 } 6117 #endif /* INET6 */ 6118 6119 int 6120 pf_setup_pdesc(struct pf_pdesc *pd, void *pdhdrs, sa_family_t af, int dir, 6121 struct pfi_kif *kif, struct mbuf *m, u_short *reason) 6122 { 6123 bzero(pd, sizeof(*pd)); 6124 pd->hdr.any = pdhdrs; 6125 pd->dir = dir; 6126 pd->kif = kif; /* kif is NULL when called by pflog */ 6127 pd->m = m; 6128 pd->sidx = (dir == PF_IN) ? 0 : 1; 6129 pd->didx = (dir == PF_IN) ? 1 : 0; 6130 pd->af = pd->naf = af; 6131 pd->rdomain = rtable_l2(pd->m->m_pkthdr.ph_rtableid); 6132 6133 switch (pd->af) { 6134 #ifdef INET 6135 case AF_INET: { 6136 struct ip *h; 6137 6138 /* Check for illegal packets */ 6139 if (pd->m->m_pkthdr.len < (int)sizeof(struct ip)) { 6140 REASON_SET(reason, PFRES_SHORT); 6141 return (PF_DROP); 6142 } 6143 6144 h = mtod(pd->m, struct ip *); 6145 pd->off = h->ip_hl << 2; 6146 6147 if (pd->off < sizeof(struct ip) || 6148 pd->off > ntohs(h->ip_len) || 6149 pd->m->m_pkthdr.len < ntohs(h->ip_len)) { 6150 REASON_SET(reason, PFRES_SHORT); 6151 return (PF_DROP); 6152 } 6153 6154 pd->src = (struct pf_addr *)&h->ip_src; 6155 pd->dst = (struct pf_addr *)&h->ip_dst; 6156 pd->virtual_proto = pd->proto = h->ip_p; 6157 pd->tot_len = ntohs(h->ip_len); 6158 pd->tos = h->ip_tos & ~IPTOS_ECN_MASK; 6159 pd->ttl = h->ip_ttl; 6160 if (h->ip_hl > 5) /* has options */ 6161 pd->badopts++; 6162 6163 if (h->ip_off & htons(IP_MF | IP_OFFMASK)) 6164 pd->virtual_proto = PF_VPROTO_FRAGMENT; 6165 6166 break; 6167 } 6168 #endif /* INET */ 6169 #ifdef INET6 6170 case AF_INET6: { 6171 struct ip6_hdr *h; 6172 6173 /* Check for illegal packets */ 6174 if (pd->m->m_pkthdr.len < (int)sizeof(struct ip6_hdr)) { 6175 REASON_SET(reason, PFRES_SHORT); 6176 return (PF_DROP); 6177 } 6178 6179 h = mtod(pd->m, struct ip6_hdr *); 6180 pd->off = 0; 6181 6182 if (pd->m->m_pkthdr.len < 6183 sizeof(struct ip6_hdr) + ntohs(h->ip6_plen)) { 6184 REASON_SET(reason, PFRES_SHORT); 6185 return (PF_DROP); 6186 } 6187 6188 if (pf_walk_header6(pd, h, reason) != PF_PASS) 6189 return (PF_DROP); 6190 6191 #if 1 6192 /* 6193 * we do not support jumbogram yet. if we keep going, zero 6194 * ip6_plen will do something bad, so drop the packet for now. 6195 */ 6196 if (pd->jumbolen != 0) { 6197 REASON_SET(reason, PFRES_NORM); 6198 return (PF_DROP); 6199 } 6200 #endif 6201 6202 pd->src = (struct pf_addr *)&h->ip6_src; 6203 pd->dst = (struct pf_addr *)&h->ip6_dst; 6204 pd->virtual_proto = pd->proto; 6205 pd->tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr); 6206 pd->tos = (ntohl(h->ip6_flow) & 0x0fc00000) >> 20; 6207 pd->ttl = h->ip6_hlim; 6208 6209 if (pd->fragoff != 0) 6210 pd->virtual_proto = PF_VPROTO_FRAGMENT; 6211 6212 break; 6213 } 6214 #endif /* INET6 */ 6215 default: 6216 panic("pf_setup_pdesc called with illegal af %u", pd->af); 6217 6218 } 6219 6220 PF_ACPY(&pd->nsaddr, pd->src, pd->af); 6221 PF_ACPY(&pd->ndaddr, pd->dst, pd->af); 6222 6223 switch (pd->virtual_proto) { 6224 case IPPROTO_TCP: { 6225 struct tcphdr *th = pd->hdr.tcp; 6226 6227 if (!pf_pull_hdr(pd->m, pd->off, th, sizeof(*th), 6228 NULL, reason, pd->af)) 6229 return (PF_DROP); 6230 pd->hdrlen = sizeof(*th); 6231 if (pd->off + (th->th_off << 2) > pd->tot_len || 6232 (th->th_off << 2) < sizeof(struct tcphdr)) { 6233 REASON_SET(reason, PFRES_SHORT); 6234 return (PF_DROP); 6235 } 6236 pd->p_len = pd->tot_len - pd->off - (th->th_off << 2); 6237 pd->sport = &th->th_sport; 6238 pd->dport = &th->th_dport; 6239 pd->pcksum = &th->th_sum; 6240 break; 6241 } 6242 case IPPROTO_UDP: { 6243 struct udphdr *uh = pd->hdr.udp; 6244 6245 if (!pf_pull_hdr(pd->m, pd->off, uh, sizeof(*uh), 6246 NULL, reason, pd->af)) 6247 return (PF_DROP); 6248 pd->hdrlen = sizeof(*uh); 6249 if (uh->uh_dport == 0 || 6250 pd->off + ntohs(uh->uh_ulen) > pd->tot_len || 6251 ntohs(uh->uh_ulen) < sizeof(struct udphdr)) { 6252 REASON_SET(reason, PFRES_SHORT); 6253 return (PF_DROP); 6254 } 6255 pd->sport = &uh->uh_sport; 6256 pd->dport = &uh->uh_dport; 6257 pd->pcksum = &uh->uh_sum; 6258 break; 6259 } 6260 case IPPROTO_ICMP: { 6261 if (!pf_pull_hdr(pd->m, pd->off, pd->hdr.icmp, ICMP_MINLEN, 6262 NULL, reason, pd->af)) 6263 return (PF_DROP); 6264 pd->hdrlen = ICMP_MINLEN; 6265 if (pd->off + pd->hdrlen > pd->tot_len) { 6266 REASON_SET(reason, PFRES_SHORT); 6267 return (PF_DROP); 6268 } 6269 pd->pcksum = &pd->hdr.icmp->icmp_cksum; 6270 break; 6271 } 6272 #ifdef INET6 6273 case IPPROTO_ICMPV6: { 6274 size_t icmp_hlen = sizeof(struct icmp6_hdr); 6275 6276 if (!pf_pull_hdr(pd->m, pd->off, pd->hdr.icmp6, icmp_hlen, 6277 NULL, reason, pd->af)) 6278 return (PF_DROP); 6279 /* ICMP headers we look further into to match state */ 6280 switch (pd->hdr.icmp6->icmp6_type) { 6281 case MLD_LISTENER_QUERY: 6282 case MLD_LISTENER_REPORT: 6283 icmp_hlen = sizeof(struct mld_hdr); 6284 break; 6285 case ND_NEIGHBOR_SOLICIT: 6286 case ND_NEIGHBOR_ADVERT: 6287 icmp_hlen = sizeof(struct nd_neighbor_solicit); 6288 break; 6289 } 6290 if (icmp_hlen > sizeof(struct icmp6_hdr) && 6291 !pf_pull_hdr(pd->m, pd->off, pd->hdr.icmp6, icmp_hlen, 6292 NULL, reason, pd->af)) 6293 return (PF_DROP); 6294 pd->hdrlen = icmp_hlen; 6295 if (pd->off + pd->hdrlen > pd->tot_len) { 6296 REASON_SET(reason, PFRES_SHORT); 6297 return (PF_DROP); 6298 } 6299 break; 6300 } 6301 #endif /* INET6 */ 6302 } 6303 6304 if (pd->sport) 6305 pd->osport = pd->nsport = *pd->sport; 6306 if (pd->dport) 6307 pd->odport = pd->ndport = *pd->dport; 6308 6309 return (PF_PASS); 6310 } 6311 6312 void 6313 pf_counters_inc(int action, struct pf_pdesc *pd, struct pf_state *s, 6314 struct pf_rule *r, struct pf_rule *a) 6315 { 6316 int dirndx; 6317 pd->kif->pfik_bytes[pd->af == AF_INET6][pd->dir == PF_OUT] 6318 [action != PF_PASS] += pd->tot_len; 6319 pd->kif->pfik_packets[pd->af == AF_INET6][pd->dir == PF_OUT] 6320 [action != PF_PASS]++; 6321 6322 if (action == PF_PASS || action == PF_AFRT || r->action == PF_DROP) { 6323 dirndx = (pd->dir == PF_OUT); 6324 r->packets[dirndx]++; 6325 r->bytes[dirndx] += pd->tot_len; 6326 if (a != NULL) { 6327 a->packets[dirndx]++; 6328 a->bytes[dirndx] += pd->tot_len; 6329 } 6330 if (s != NULL) { 6331 struct pf_rule_item *ri; 6332 struct pf_sn_item *sni; 6333 6334 SLIST_FOREACH(sni, &s->src_nodes, next) { 6335 sni->sn->packets[dirndx]++; 6336 sni->sn->bytes[dirndx] += pd->tot_len; 6337 } 6338 dirndx = (pd->dir == s->direction) ? 0 : 1; 6339 s->packets[dirndx]++; 6340 s->bytes[dirndx] += pd->tot_len; 6341 6342 SLIST_FOREACH(ri, &s->match_rules, entry) { 6343 ri->r->packets[dirndx]++; 6344 ri->r->bytes[dirndx] += pd->tot_len; 6345 6346 if (ri->r->src.addr.type == PF_ADDR_TABLE) 6347 pfr_update_stats(ri->r->src.addr.p.tbl, 6348 &s->key[(s->direction == PF_IN)]-> 6349 addr[(s->direction == PF_OUT)], 6350 pd, ri->r->action, ri->r->src.neg); 6351 if (ri->r->dst.addr.type == PF_ADDR_TABLE) 6352 pfr_update_stats(ri->r->dst.addr.p.tbl, 6353 &s->key[(s->direction == PF_IN)]-> 6354 addr[(s->direction == PF_IN)], 6355 pd, ri->r->action, ri->r->src.neg); 6356 } 6357 } 6358 if (r->src.addr.type == PF_ADDR_TABLE) 6359 pfr_update_stats(r->src.addr.p.tbl, 6360 (s == NULL) ? pd->src : 6361 &s->key[(s->direction == PF_IN)]-> 6362 addr[(s->direction == PF_OUT)], 6363 pd, r->action, r->src.neg); 6364 if (r->dst.addr.type == PF_ADDR_TABLE) 6365 pfr_update_stats(r->dst.addr.p.tbl, 6366 (s == NULL) ? pd->dst : 6367 &s->key[(s->direction == PF_IN)]-> 6368 addr[(s->direction == PF_IN)], 6369 pd, r->action, r->dst.neg); 6370 } 6371 } 6372 6373 int 6374 pf_test(sa_family_t af, int fwdir, struct ifnet *ifp, struct mbuf **m0, 6375 struct ether_header *eh) 6376 { 6377 struct pfi_kif *kif; 6378 u_short action, reason = 0; 6379 struct pf_rule *a = NULL, *r = &pf_default_rule; 6380 struct pf_state *s = NULL; 6381 struct pf_ruleset *ruleset = NULL; 6382 struct pf_pdesc pd; 6383 union pf_headers pdhdrs; 6384 int dir = (fwdir == PF_FWD) ? PF_OUT : fwdir; 6385 u_int32_t qid, pqid = 0; 6386 6387 if (!pf_status.running) 6388 return (PF_PASS); 6389 6390 if (ifp->if_type == IFT_CARP && ifp->if_carpdev) 6391 kif = (struct pfi_kif *)ifp->if_carpdev->if_pf_kif; 6392 else 6393 kif = (struct pfi_kif *)ifp->if_pf_kif; 6394 6395 if (kif == NULL) { 6396 DPFPRINTF(LOG_ERR, 6397 "pf_test: kif == NULL, if_xname %s", ifp->if_xname); 6398 return (PF_DROP); 6399 } 6400 if (kif->pfik_flags & PFI_IFLAG_SKIP) 6401 return (PF_PASS); 6402 6403 #ifdef DIAGNOSTIC 6404 if (((*m0)->m_flags & M_PKTHDR) == 0) 6405 panic("non-M_PKTHDR is passed to pf_test"); 6406 #endif /* DIAGNOSTIC */ 6407 6408 if ((*m0)->m_pkthdr.pf.flags & PF_TAG_GENERATED) 6409 return (PF_PASS); 6410 6411 if ((*m0)->m_pkthdr.pf.flags & PF_TAG_DIVERTED_PACKET) 6412 return (PF_PASS); 6413 6414 if ((*m0)->m_pkthdr.pf.flags & PF_TAG_REFRAGMENTED) { 6415 (*m0)->m_pkthdr.pf.flags &= ~PF_TAG_REFRAGMENTED; 6416 return (PF_PASS); 6417 } 6418 6419 action = pf_setup_pdesc(&pd, &pdhdrs, af, dir, kif, *m0, &reason); 6420 if (action != PF_PASS) { 6421 pd.pflog |= PF_LOG_FORCE; 6422 goto done; 6423 } 6424 6425 /* packet normalization and reassembly */ 6426 switch (pd.af) { 6427 #ifdef INET 6428 case AF_INET: 6429 action = pf_normalize_ip(&pd, &reason); 6430 break; 6431 #endif 6432 #ifdef INET6 6433 case AF_INET6: 6434 action = pf_normalize_ip6(&pd, &reason); 6435 break; 6436 #endif 6437 } 6438 *m0 = pd.m; 6439 /* if packet sits in reassembly queue, return without error */ 6440 if (pd.m == NULL) 6441 return PF_PASS; 6442 if (action != PF_PASS) { 6443 pd.pflog |= PF_LOG_FORCE; 6444 goto done; 6445 } 6446 6447 /* if packet has been reassembled, update packet description */ 6448 if (pf_status.reass && pd.virtual_proto == PF_VPROTO_FRAGMENT) { 6449 action = pf_setup_pdesc(&pd, &pdhdrs, af, dir, kif, *m0, 6450 &reason); 6451 if (action != PF_PASS) { 6452 pd.pflog |= PF_LOG_FORCE; 6453 goto done; 6454 } 6455 } 6456 pd.eh = eh; 6457 pd.m->m_pkthdr.pf.flags |= PF_TAG_PROCESSED; 6458 6459 switch (pd.virtual_proto) { 6460 6461 case PF_VPROTO_FRAGMENT: { 6462 /* 6463 * handle fragments that aren't reassembled by 6464 * normalization 6465 */ 6466 action = pf_test_rule(&pd, &r, &s, &a, &ruleset); 6467 if (action != PF_PASS) 6468 REASON_SET(&reason, PFRES_FRAG); 6469 break; 6470 } 6471 6472 case IPPROTO_ICMP: { 6473 if (pd.af != AF_INET) { 6474 action = PF_DROP; 6475 REASON_SET(&reason, PFRES_NORM); 6476 DPFPRINTF(LOG_NOTICE, 6477 "dropping IPv6 packet with ICMPv4 payload"); 6478 goto done; 6479 } 6480 action = pf_test_state_icmp(&pd, &s, &reason); 6481 if (action == PF_PASS || action == PF_AFRT) { 6482 #if NPFSYNC > 0 6483 pfsync_update_state(s); 6484 #endif /* NPFSYNC */ 6485 r = s->rule.ptr; 6486 a = s->anchor.ptr; 6487 pd.pflog |= s->log; 6488 } else if (s == NULL) 6489 action = pf_test_rule(&pd, &r, &s, &a, &ruleset); 6490 break; 6491 } 6492 6493 #ifdef INET6 6494 case IPPROTO_ICMPV6: { 6495 if (pd.af != AF_INET6) { 6496 action = PF_DROP; 6497 REASON_SET(&reason, PFRES_NORM); 6498 DPFPRINTF(LOG_NOTICE, 6499 "dropping IPv4 packet with ICMPv6 payload"); 6500 goto done; 6501 } 6502 action = pf_test_state_icmp(&pd, &s, &reason); 6503 if (action == PF_PASS || action == PF_AFRT) { 6504 #if NPFSYNC > 0 6505 pfsync_update_state(s); 6506 #endif /* NPFSYNC */ 6507 r = s->rule.ptr; 6508 a = s->anchor.ptr; 6509 pd.pflog |= s->log; 6510 } else if (s == NULL) 6511 action = pf_test_rule(&pd, &r, &s, &a, &ruleset); 6512 break; 6513 } 6514 #endif /* INET6 */ 6515 6516 default: 6517 if (pd.virtual_proto == IPPROTO_TCP) { 6518 if ((pd.hdr.tcp->th_flags & TH_ACK) && pd.p_len == 0) 6519 pqid = 1; 6520 action = pf_normalize_tcp(&pd); 6521 if (action == PF_DROP) 6522 goto done; 6523 } 6524 action = pf_test_state(&pd, &s, &reason); 6525 if (action == PF_PASS || action == PF_AFRT) { 6526 #if NPFSYNC > 0 6527 pfsync_update_state(s); 6528 #endif /* NPFSYNC */ 6529 r = s->rule.ptr; 6530 a = s->anchor.ptr; 6531 pd.pflog |= s->log; 6532 } else if (s == NULL) 6533 action = pf_test_rule(&pd, &r, &s, &a, &ruleset); 6534 6535 if (pd.virtual_proto == IPPROTO_TCP) { 6536 if (s) { 6537 if (s->max_mss) 6538 pf_normalize_mss(&pd, s->max_mss); 6539 } else if (r->max_mss) 6540 pf_normalize_mss(&pd, r->max_mss); 6541 } 6542 6543 break; 6544 } 6545 6546 done: 6547 if (action != PF_DROP) { 6548 if (s) { 6549 /* The non-state case is handled in pf_test_rule() */ 6550 if (action == PF_PASS && pd.badopts && 6551 !(s->state_flags & PFSTATE_ALLOWOPTS)) { 6552 action = PF_DROP; 6553 REASON_SET(&reason, PFRES_IPOPTIONS); 6554 pd.pflog |= PF_LOG_FORCE; 6555 DPFPRINTF(LOG_NOTICE, "dropping packet with " 6556 "ip/ipv6 options in pf_test()"); 6557 } 6558 6559 pf_scrub(pd.m, s->state_flags, pd.af, s->min_ttl, 6560 s->set_tos); 6561 pf_tag_packet(pd.m, s->tag, s->rtableid[pd.didx]); 6562 if (pqid || (pd.tos & IPTOS_LOWDELAY)) { 6563 qid = s->pqid; 6564 if (s->state_flags & PFSTATE_SETPRIO) 6565 pd.m->m_pkthdr.pf.prio = s->set_prio[1]; 6566 } else { 6567 qid = s->qid; 6568 if (s->state_flags & PFSTATE_SETPRIO) 6569 pd.m->m_pkthdr.pf.prio = s->set_prio[0]; 6570 } 6571 } else { 6572 pf_scrub(pd.m, r->scrub_flags, pd.af, r->min_ttl, 6573 r->set_tos); 6574 if (pqid || (pd.tos & IPTOS_LOWDELAY)) { 6575 qid = r->pqid; 6576 if (r->scrub_flags & PFSTATE_SETPRIO) 6577 pd.m->m_pkthdr.pf.prio = r->set_prio[1]; 6578 } else { 6579 qid = r->qid; 6580 if (r->scrub_flags & PFSTATE_SETPRIO) 6581 pd.m->m_pkthdr.pf.prio = r->set_prio[0]; 6582 } 6583 } 6584 } 6585 6586 if (action == PF_PASS && qid) 6587 pd.m->m_pkthdr.pf.qid = qid; 6588 if (pd.dir == PF_IN && s && s->key[PF_SK_STACK]) 6589 pd.m->m_pkthdr.pf.statekey = s->key[PF_SK_STACK]; 6590 if (pd.dir == PF_OUT && 6591 pd.m->m_pkthdr.pf.inp && !pd.m->m_pkthdr.pf.inp->inp_pf_sk && 6592 s && s->key[PF_SK_STACK] && !s->key[PF_SK_STACK]->inp) { 6593 pd.m->m_pkthdr.pf.inp->inp_pf_sk = s->key[PF_SK_STACK]; 6594 s->key[PF_SK_STACK]->inp = pd.m->m_pkthdr.pf.inp; 6595 } 6596 6597 /* 6598 * connections redirected to loopback should not match sockets 6599 * bound specifically to loopback due to security implications, 6600 * see tcp_input() and in_pcblookup_listen(). 6601 */ 6602 if (pd.destchg) 6603 if ((pd.af == AF_INET && (ntohl(pd.dst->v4.s_addr) >> 6604 IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) || 6605 (pd.af == AF_INET6 && IN6_IS_ADDR_LOOPBACK(&pd.dst->v6))) 6606 pd.m->m_pkthdr.pf.flags |= PF_TAG_TRANSLATE_LOCALHOST; 6607 /* We need to redo the route lookup on outgoing routes. */ 6608 if (pd.destchg && pd.dir == PF_OUT) 6609 pd.m->m_pkthdr.pf.flags |= PF_TAG_REROUTE; 6610 6611 if (pd.dir == PF_IN && action == PF_PASS && r->divert.port) { 6612 struct pf_divert *divert; 6613 6614 if ((divert = pf_get_divert(pd.m))) { 6615 pd.m->m_pkthdr.pf.flags |= PF_TAG_DIVERTED; 6616 divert->port = r->divert.port; 6617 divert->rdomain = pd.rdomain; 6618 divert->addr = r->divert.addr; 6619 } 6620 } 6621 6622 if (action == PF_PASS && r->divert_packet.port) 6623 action = PF_DIVERT; 6624 6625 if (pd.pflog) { 6626 struct pf_rule_item *ri; 6627 6628 if (pd.pflog & PF_LOG_FORCE || r->log & PF_LOG_ALL) 6629 PFLOG_PACKET(&pd, reason, r, a, ruleset); 6630 if (s) { 6631 SLIST_FOREACH(ri, &s->match_rules, entry) 6632 if (ri->r->log & PF_LOG_ALL) 6633 PFLOG_PACKET(&pd, reason, ri->r, a, 6634 ruleset); 6635 } 6636 } 6637 6638 pf_counters_inc(action, &pd, s, r, a); 6639 6640 switch (action) { 6641 case PF_SYNPROXY_DROP: 6642 m_freem(*m0); 6643 case PF_DEFER: 6644 *m0 = NULL; 6645 action = PF_PASS; 6646 break; 6647 case PF_DIVERT: 6648 switch (pd.af) { 6649 case AF_INET: 6650 if (!divert_packet(pd.m, pd.dir, r->divert_packet.port)) 6651 *m0 = NULL; 6652 break; 6653 #ifdef INET6 6654 case AF_INET6: 6655 if (!divert6_packet(pd.m, pd.dir, 6656 r->divert_packet.port)) 6657 *m0 = NULL; 6658 break; 6659 #endif /* INET6 */ 6660 } 6661 action = PF_PASS; 6662 break; 6663 #if INET && INET6 6664 case PF_AFRT: 6665 if (pf_translate_af(&pd)) { 6666 if (!pd.m) 6667 *m0 = NULL; 6668 action = PF_DROP; 6669 break; 6670 } 6671 if (pd.naf == AF_INET) 6672 pf_route(&pd.m, r, dir, kif->pfik_ifp, s); 6673 if (pd.naf == AF_INET6) 6674 pf_route6(&pd.m, r, dir, kif->pfik_ifp, s); 6675 *m0 = NULL; 6676 action = PF_PASS; 6677 break; 6678 #endif /* INET && INET6 */ 6679 default: 6680 /* pf_route can free the mbuf causing *m0 to become NULL */ 6681 if (r->rt) { 6682 switch (pd.af) { 6683 case AF_INET: 6684 pf_route(m0, r, pd.dir, pd.kif->pfik_ifp, s); 6685 break; 6686 #ifdef INET6 6687 case AF_INET6: 6688 pf_route6(m0, r, pd.dir, pd.kif->pfik_ifp, s); 6689 break; 6690 #endif /* INET6 */ 6691 } 6692 } 6693 break; 6694 } 6695 6696 #ifdef INET6 6697 /* if reassembled packet passed, create new fragments */ 6698 if (pf_status.reass && action == PF_PASS && *m0 && fwdir == PF_FWD) { 6699 struct m_tag *mtag; 6700 6701 if ((mtag = m_tag_find(*m0, PACKET_TAG_PF_REASSEMBLED, NULL))) 6702 action = pf_refragment6(m0, mtag, fwdir); 6703 } 6704 #endif 6705 if (s && action != PF_DROP) { 6706 if (!s->if_index_in && dir == PF_IN) 6707 s->if_index_in = ifp->if_index; 6708 else if (!s->if_index_out && dir == PF_OUT) 6709 s->if_index_out = ifp->if_index; 6710 } 6711 6712 return (action); 6713 } 6714 6715 int 6716 pf_check_congestion(struct ifqueue *ifq) 6717 { 6718 if (ifq->ifq_congestion) 6719 return (1); 6720 else 6721 return (0); 6722 } 6723 6724 void 6725 pf_cksum(struct pf_pdesc *pd, struct mbuf *m) 6726 { 6727 if (pd->csum_status != PF_CSUM_OK) 6728 return; /* don't fix broken cksums */ 6729 6730 switch (pd->proto) { 6731 case IPPROTO_TCP: 6732 pd->hdr.tcp->th_sum = 0; 6733 m->m_pkthdr.csum_flags |= M_TCP_CSUM_OUT; 6734 break; 6735 case IPPROTO_UDP: 6736 pd->hdr.udp->uh_sum = 0; 6737 m->m_pkthdr.csum_flags |= M_UDP_CSUM_OUT; 6738 break; 6739 case IPPROTO_ICMP: 6740 pd->hdr.icmp->icmp_cksum = 0; 6741 m->m_pkthdr.csum_flags |= M_ICMP_CSUM_OUT; 6742 break; 6743 #ifdef INET6 6744 case IPPROTO_ICMPV6: 6745 pd->hdr.icmp6->icmp6_cksum = 0; 6746 m->m_pkthdr.csum_flags |= M_ICMP_CSUM_OUT; 6747 break; 6748 #endif /* INET6 */ 6749 default: 6750 /* nothing */ 6751 break; 6752 } 6753 } 6754 6755 /* 6756 * must be called whenever any addressing information such as 6757 * address, port, protocol has changed 6758 */ 6759 void 6760 pf_pkt_addr_changed(struct mbuf *m) 6761 { 6762 m->m_pkthdr.pf.statekey = NULL; 6763 } 6764