1 | /* |
2 | * Copyright (c) 2007-2018 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | /* $apfw: git commit 6602420f2f101b74305cd78f7cd9e0c8fdedae97 $ */ |
30 | /* $OpenBSD: pf.c,v 1.567 2008/02/20 23:40:13 henning Exp $ */ |
31 | |
32 | /* |
33 | * Copyright (c) 2001 Daniel Hartmeier |
34 | * Copyright (c) 2002 - 2013 Henning Brauer |
35 | * NAT64 - Copyright (c) 2010 Viagenie Inc. (http://www.viagenie.ca) |
36 | * All rights reserved. |
37 | * |
38 | * Redistribution and use in source and binary forms, with or without |
39 | * modification, are permitted provided that the following conditions |
40 | * are met: |
41 | * |
42 | * - Redistributions of source code must retain the above copyright |
43 | * notice, this list of conditions and the following disclaimer. |
44 | * - Redistributions in binary form must reproduce the above |
45 | * copyright notice, this list of conditions and the following |
46 | * disclaimer in the documentation and/or other materials provided |
47 | * with the distribution. |
48 | * |
49 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
50 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
51 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS |
52 | * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE |
53 | * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, |
54 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, |
55 | * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
56 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER |
57 | * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
58 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN |
59 | * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
60 | * POSSIBILITY OF SUCH DAMAGE. |
61 | * |
62 | * Effort sponsored in part by the Defense Advanced Research Projects |
63 | * Agency (DARPA) and Air Force Research Laboratory, Air Force |
64 | * Materiel Command, USAF, under agreement number F30602-01-2-0537. |
65 | * |
66 | */ |
67 | |
68 | #include <machine/endian.h> |
69 | #include <sys/param.h> |
70 | #include <sys/systm.h> |
71 | #include <sys/filio.h> |
72 | #include <sys/socket.h> |
73 | #include <sys/socketvar.h> |
74 | #include <sys/kernel.h> |
75 | #include <sys/time.h> |
76 | #include <sys/proc.h> |
77 | #include <sys/random.h> |
78 | #include <sys/mcache.h> |
79 | #include <sys/protosw.h> |
80 | |
81 | #include <libkern/crypto/md5.h> |
82 | #include <libkern/libkern.h> |
83 | |
84 | #include <mach/thread_act.h> |
85 | |
86 | #include <net/if.h> |
87 | #include <net/if_types.h> |
88 | #include <net/bpf.h> |
89 | #include <net/route.h> |
90 | #include <net/dlil.h> |
91 | |
92 | #include <netinet/in.h> |
93 | #include <netinet/in_var.h> |
94 | #include <netinet/in_systm.h> |
95 | #include <netinet/ip.h> |
96 | #include <netinet/ip_var.h> |
97 | #include <netinet/tcp.h> |
98 | #include <netinet/tcp_seq.h> |
99 | #include <netinet/udp.h> |
100 | #include <netinet/ip_icmp.h> |
101 | #include <netinet/in_pcb.h> |
102 | #include <netinet/tcp_timer.h> |
103 | #include <netinet/tcp_var.h> |
104 | #include <netinet/tcp_fsm.h> |
105 | #include <netinet/udp_var.h> |
106 | #include <netinet/icmp_var.h> |
107 | #include <net/if_ether.h> |
108 | #include <net/ethernet.h> |
109 | #include <net/flowhash.h> |
110 | #include <net/nat464_utils.h> |
111 | #include <net/pfvar.h> |
112 | #include <net/if_pflog.h> |
113 | |
114 | #if NPFSYNC |
115 | #include <net/if_pfsync.h> |
116 | #endif /* NPFSYNC */ |
117 | |
118 | #if INET6 |
119 | #include <netinet/ip6.h> |
120 | #include <netinet6/in6_pcb.h> |
121 | #include <netinet6/ip6_var.h> |
122 | #include <netinet/icmp6.h> |
123 | #include <netinet6/nd6.h> |
124 | #endif /* INET6 */ |
125 | |
126 | #if DUMMYNET |
127 | #include <netinet/ip_dummynet.h> |
128 | #endif /* DUMMYNET */ |
129 | |
130 | /* |
131 | * For RandomULong(), to get a 32 bits random value |
132 | * Note that random() returns a 31 bits value, see rdar://11159750 |
133 | */ |
134 | #include <dev/random/randomdev.h> |
135 | |
136 | #define DPFPRINTF(n, x) (pf_status.debug >= (n) ? printf x : ((void)0)) |
137 | |
138 | /* |
139 | * On Mac OS X, the rtableid value is treated as the interface scope |
140 | * value that is equivalent to the interface index used for scoped |
141 | * routing. A valid scope value is anything but IFSCOPE_NONE (0), |
142 | * as per definition of ifindex which is a positive, non-zero number. |
143 | * The other BSDs treat a negative rtableid value as invalid, hence |
144 | * the test against INT_MAX to handle userland apps which initialize |
145 | * the field with a negative number. |
146 | */ |
147 | #define PF_RTABLEID_IS_VALID(r) \ |
148 | ((r) > IFSCOPE_NONE && (r) <= INT_MAX) |
149 | |
150 | /* |
151 | * Global variables |
152 | */ |
153 | decl_lck_mtx_data(,pf_lock_data); |
154 | decl_lck_rw_data(,pf_perim_lock_data); |
155 | lck_mtx_t *pf_lock = &pf_lock_data; |
156 | lck_rw_t *pf_perim_lock = &pf_perim_lock_data; |
157 | |
158 | /* state tables */ |
159 | struct pf_state_tree_lan_ext pf_statetbl_lan_ext; |
160 | struct pf_state_tree_ext_gwy pf_statetbl_ext_gwy; |
161 | |
162 | struct pf_palist pf_pabuf; |
163 | struct pf_status pf_status; |
164 | |
165 | u_int32_t ticket_pabuf; |
166 | |
167 | static MD5_CTX pf_tcp_secret_ctx; |
168 | static u_char pf_tcp_secret[16]; |
169 | static int pf_tcp_secret_init; |
170 | static int pf_tcp_iss_off; |
171 | |
172 | static struct pf_anchor_stackframe { |
173 | struct pf_ruleset *rs; |
174 | struct pf_rule *r; |
175 | struct pf_anchor_node *parent; |
176 | struct pf_anchor *child; |
177 | } pf_anchor_stack[64]; |
178 | |
179 | struct pool pf_src_tree_pl, pf_rule_pl, pf_pooladdr_pl; |
180 | struct pool pf_state_pl, pf_state_key_pl; |
181 | |
182 | typedef void (*hook_fn_t)(void *); |
183 | |
184 | struct hook_desc { |
185 | TAILQ_ENTRY(hook_desc) hd_list; |
186 | hook_fn_t hd_fn; |
187 | void *hd_arg; |
188 | }; |
189 | |
190 | #define HOOK_REMOVE 0x01 |
191 | #define HOOK_FREE 0x02 |
192 | #define HOOK_ABORT 0x04 |
193 | |
194 | static void *hook_establish(struct hook_desc_head *, int, |
195 | hook_fn_t, void *); |
196 | static void hook_runloop(struct hook_desc_head *, int flags); |
197 | |
198 | struct pool pf_app_state_pl; |
199 | static void pf_print_addr(struct pf_addr *addr, sa_family_t af); |
200 | static void pf_print_sk_host(struct pf_state_host *, u_int8_t, int, |
201 | u_int8_t); |
202 | |
203 | static void pf_print_host(struct pf_addr *, u_int16_t, u_int8_t); |
204 | |
205 | static void pf_init_threshold(struct pf_threshold *, u_int32_t, |
206 | u_int32_t); |
207 | static void pf_add_threshold(struct pf_threshold *); |
208 | static int pf_check_threshold(struct pf_threshold *); |
209 | |
210 | static void pf_change_ap(int, pbuf_t *, struct pf_addr *, |
211 | u_int16_t *, u_int16_t *, u_int16_t *, |
212 | struct pf_addr *, u_int16_t, u_int8_t, sa_family_t, |
213 | sa_family_t, int); |
214 | static int pf_modulate_sack(pbuf_t *, int, struct pf_pdesc *, |
215 | struct tcphdr *, struct pf_state_peer *); |
216 | #if INET6 |
217 | static void pf_change_a6(struct pf_addr *, u_int16_t *, |
218 | struct pf_addr *, u_int8_t); |
219 | void pf_change_addr(struct pf_addr *a, u_int16_t *c, |
220 | struct pf_addr *an, u_int8_t u, |
221 | sa_family_t af, sa_family_t afn); |
222 | #endif /* INET6 */ |
223 | static void pf_change_icmp(struct pf_addr *, u_int16_t *, |
224 | struct pf_addr *, struct pf_addr *, u_int16_t, |
225 | u_int16_t *, u_int16_t *, u_int16_t *, |
226 | u_int16_t *, u_int8_t, sa_family_t); |
227 | static void pf_send_tcp(const struct pf_rule *, sa_family_t, |
228 | const struct pf_addr *, const struct pf_addr *, |
229 | u_int16_t, u_int16_t, u_int32_t, u_int32_t, |
230 | u_int8_t, u_int16_t, u_int16_t, u_int8_t, int, |
231 | u_int16_t, struct ether_header *, struct ifnet *); |
232 | static void pf_send_icmp(pbuf_t *, u_int8_t, u_int8_t, |
233 | sa_family_t, struct pf_rule *); |
234 | static struct pf_rule *pf_match_translation(struct pf_pdesc *, pbuf_t *, |
235 | int, int, struct pfi_kif *, struct pf_addr *, |
236 | union pf_state_xport *, struct pf_addr *, |
237 | union pf_state_xport *, int); |
238 | static struct pf_rule *pf_get_translation_aux(struct pf_pdesc *, |
239 | pbuf_t *, int, int, struct pfi_kif *, |
240 | struct pf_src_node **, struct pf_addr *, |
241 | union pf_state_xport *, struct pf_addr *, |
242 | union pf_state_xport *, union pf_state_xport * |
243 | ); |
244 | static void pf_attach_state(struct pf_state_key *, |
245 | struct pf_state *, int); |
246 | static void pf_detach_state(struct pf_state *, int); |
247 | static u_int32_t pf_tcp_iss(struct pf_pdesc *); |
248 | static int pf_test_rule(struct pf_rule **, struct pf_state **, |
249 | int, struct pfi_kif *, pbuf_t *, int, |
250 | void *, struct pf_pdesc *, struct pf_rule **, |
251 | struct pf_ruleset **, struct ifqueue *); |
252 | #if DUMMYNET |
253 | static int pf_test_dummynet(struct pf_rule **, int, |
254 | struct pfi_kif *, pbuf_t **, |
255 | struct pf_pdesc *, struct ip_fw_args *); |
256 | #endif /* DUMMYNET */ |
257 | static int pf_test_fragment(struct pf_rule **, int, |
258 | struct pfi_kif *, pbuf_t *, void *, |
259 | struct pf_pdesc *, struct pf_rule **, |
260 | struct pf_ruleset **); |
261 | static int pf_test_state_tcp(struct pf_state **, int, |
262 | struct pfi_kif *, pbuf_t *, int, |
263 | void *, struct pf_pdesc *, u_short *); |
264 | static int pf_test_state_udp(struct pf_state **, int, |
265 | struct pfi_kif *, pbuf_t *, int, |
266 | void *, struct pf_pdesc *, u_short *); |
267 | static int pf_test_state_icmp(struct pf_state **, int, |
268 | struct pfi_kif *, pbuf_t *, int, |
269 | void *, struct pf_pdesc *, u_short *); |
270 | static int pf_test_state_other(struct pf_state **, int, |
271 | struct pfi_kif *, struct pf_pdesc *); |
272 | static int pf_match_tag(struct pf_rule *, |
273 | struct pf_mtag *, int *); |
274 | static void pf_hash(struct pf_addr *, struct pf_addr *, |
275 | struct pf_poolhashkey *, sa_family_t); |
276 | static int pf_map_addr(u_int8_t, struct pf_rule *, |
277 | struct pf_addr *, struct pf_addr *, |
278 | struct pf_addr *, struct pf_src_node **); |
279 | static int pf_get_sport(struct pf_pdesc *, struct pfi_kif *, |
280 | struct pf_rule *, struct pf_addr *, |
281 | union pf_state_xport *, struct pf_addr *, |
282 | union pf_state_xport *, struct pf_addr *, |
283 | union pf_state_xport *, struct pf_src_node ** |
284 | ); |
285 | static void pf_route(pbuf_t **, struct pf_rule *, int, |
286 | struct ifnet *, struct pf_state *, |
287 | struct pf_pdesc *); |
288 | #if INET6 |
289 | static void pf_route6(pbuf_t **, struct pf_rule *, int, |
290 | struct ifnet *, struct pf_state *, |
291 | struct pf_pdesc *); |
292 | #endif /* INET6 */ |
293 | static u_int8_t pf_get_wscale(pbuf_t *, int, u_int16_t, |
294 | sa_family_t); |
295 | static u_int16_t pf_get_mss(pbuf_t *, int, u_int16_t, |
296 | sa_family_t); |
297 | static u_int16_t pf_calc_mss(struct pf_addr *, sa_family_t, |
298 | u_int16_t); |
299 | static void pf_set_rt_ifp(struct pf_state *, |
300 | struct pf_addr *, sa_family_t af); |
301 | static int pf_check_proto_cksum(pbuf_t *, int, int, |
302 | u_int8_t, sa_family_t); |
303 | static int pf_addr_wrap_neq(struct pf_addr_wrap *, |
304 | struct pf_addr_wrap *); |
305 | static struct pf_state *pf_find_state(struct pfi_kif *, |
306 | struct pf_state_key_cmp *, u_int); |
307 | static int pf_src_connlimit(struct pf_state **); |
308 | static void pf_stateins_err(const char *, struct pf_state *, |
309 | struct pfi_kif *); |
310 | static int pf_check_congestion(struct ifqueue *); |
311 | |
312 | #if 0 |
313 | static const char *pf_pptp_ctrl_type_name(u_int16_t code); |
314 | #endif |
315 | static void pf_pptp_handler(struct pf_state *, int, int, |
316 | struct pf_pdesc *, struct pfi_kif *); |
317 | static void pf_pptp_unlink(struct pf_state *); |
318 | static void pf_grev1_unlink(struct pf_state *); |
319 | static int pf_test_state_grev1(struct pf_state **, int, |
320 | struct pfi_kif *, int, struct pf_pdesc *); |
321 | static int pf_ike_compare(struct pf_app_state *, |
322 | struct pf_app_state *); |
323 | static int pf_test_state_esp(struct pf_state **, int, |
324 | struct pfi_kif *, int, struct pf_pdesc *); |
325 | |
326 | extern struct pool pfr_ktable_pl; |
327 | extern struct pool pfr_kentry_pl; |
328 | extern int path_mtu_discovery; |
329 | |
330 | struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX] = { |
331 | { &pf_state_pl, PFSTATE_HIWAT }, |
332 | { &pf_app_state_pl, PFAPPSTATE_HIWAT }, |
333 | { &pf_src_tree_pl, PFSNODE_HIWAT }, |
334 | { &pf_frent_pl, PFFRAG_FRENT_HIWAT }, |
335 | { &pfr_ktable_pl, PFR_KTABLE_HIWAT }, |
336 | { &pfr_kentry_pl, PFR_KENTRY_HIWAT }, |
337 | }; |
338 | |
339 | void * |
340 | pf_lazy_makewritable(struct pf_pdesc *pd, pbuf_t *pbuf, int len) |
341 | { |
342 | void *p; |
343 | |
344 | if (pd->lmw < 0) |
345 | return (NULL); |
346 | |
347 | VERIFY(pbuf == pd->mp); |
348 | |
349 | p = pbuf->pb_data; |
350 | if (len > pd->lmw) { |
351 | if ((p = pbuf_ensure_writable(pbuf, len)) == NULL) |
352 | len = -1; |
353 | pd->lmw = len; |
354 | if (len >= 0) { |
355 | pd->pf_mtag = pf_find_mtag_pbuf(pbuf); |
356 | |
357 | switch (pd->af) { |
358 | case AF_INET: { |
359 | struct ip *h = p; |
360 | pd->src = (struct pf_addr *)(uintptr_t)&h->ip_src; |
361 | pd->dst = (struct pf_addr *)(uintptr_t)&h->ip_dst; |
362 | pd->ip_sum = &h->ip_sum; |
363 | break; |
364 | } |
365 | #if INET6 |
366 | case AF_INET6: { |
367 | struct ip6_hdr *h = p; |
368 | pd->src = (struct pf_addr *)(uintptr_t)&h->ip6_src; |
369 | pd->dst = (struct pf_addr *)(uintptr_t)&h->ip6_dst; |
370 | break; |
371 | } |
372 | #endif /* INET6 */ |
373 | } |
374 | } |
375 | } |
376 | |
377 | return (len < 0 ? NULL : p); |
378 | } |
379 | |
380 | static const int * |
381 | pf_state_lookup_aux(struct pf_state **state, struct pfi_kif *kif, |
382 | int direction, int *action) |
383 | { |
384 | if (*state == NULL || (*state)->timeout == PFTM_PURGE) { |
385 | *action = PF_DROP; |
386 | return (action); |
387 | } |
388 | |
389 | if (direction == PF_OUT && |
390 | (((*state)->rule.ptr->rt == PF_ROUTETO && |
391 | (*state)->rule.ptr->direction == PF_OUT) || |
392 | ((*state)->rule.ptr->rt == PF_REPLYTO && |
393 | (*state)->rule.ptr->direction == PF_IN)) && |
394 | (*state)->rt_kif != NULL && (*state)->rt_kif != kif) { |
395 | *action = PF_PASS; |
396 | return (action); |
397 | } |
398 | |
399 | return (0); |
400 | } |
401 | |
402 | #define STATE_LOOKUP() \ |
403 | do { \ |
404 | int action; \ |
405 | *state = pf_find_state(kif, &key, direction); \ |
406 | if (*state != NULL && pd != NULL && \ |
407 | !(pd->pktflags & PKTF_FLOW_ID)) { \ |
408 | pd->flowsrc = (*state)->state_key->flowsrc; \ |
409 | pd->flowhash = (*state)->state_key->flowhash; \ |
410 | if (pd->flowhash != 0) { \ |
411 | pd->pktflags |= PKTF_FLOW_ID; \ |
412 | pd->pktflags &= ~PKTF_FLOW_ADV; \ |
413 | } \ |
414 | } \ |
415 | if (pf_state_lookup_aux(state, kif, direction, &action)) \ |
416 | return (action); \ |
417 | } while (0) |
418 | |
419 | #define STATE_ADDR_TRANSLATE(sk) \ |
420 | (sk)->lan.addr.addr32[0] != (sk)->gwy.addr.addr32[0] || \ |
421 | ((sk)->af_lan == AF_INET6 && \ |
422 | ((sk)->lan.addr.addr32[1] != (sk)->gwy.addr.addr32[1] || \ |
423 | (sk)->lan.addr.addr32[2] != (sk)->gwy.addr.addr32[2] || \ |
424 | (sk)->lan.addr.addr32[3] != (sk)->gwy.addr.addr32[3])) |
425 | |
426 | #define STATE_TRANSLATE(sk) \ |
427 | ((sk)->af_lan != (sk)->af_gwy || \ |
428 | STATE_ADDR_TRANSLATE(sk) || \ |
429 | (sk)->lan.xport.port != (sk)->gwy.xport.port) |
430 | |
431 | #define STATE_GRE_TRANSLATE(sk) \ |
432 | (STATE_ADDR_TRANSLATE(sk) || \ |
433 | (sk)->lan.xport.call_id != (sk)->gwy.xport.call_id) |
434 | |
435 | #define BOUND_IFACE(r, k) \ |
436 | ((r)->rule_flag & PFRULE_IFBOUND) ? (k) : pfi_all |
437 | |
438 | #define STATE_INC_COUNTERS(s) \ |
439 | do { \ |
440 | s->rule.ptr->states++; \ |
441 | VERIFY(s->rule.ptr->states != 0); \ |
442 | if (s->anchor.ptr != NULL) { \ |
443 | s->anchor.ptr->states++; \ |
444 | VERIFY(s->anchor.ptr->states != 0); \ |
445 | } \ |
446 | if (s->nat_rule.ptr != NULL) { \ |
447 | s->nat_rule.ptr->states++; \ |
448 | VERIFY(s->nat_rule.ptr->states != 0); \ |
449 | } \ |
450 | } while (0) |
451 | |
452 | #define STATE_DEC_COUNTERS(s) \ |
453 | do { \ |
454 | if (s->nat_rule.ptr != NULL) { \ |
455 | VERIFY(s->nat_rule.ptr->states > 0); \ |
456 | s->nat_rule.ptr->states--; \ |
457 | } \ |
458 | if (s->anchor.ptr != NULL) { \ |
459 | VERIFY(s->anchor.ptr->states > 0); \ |
460 | s->anchor.ptr->states--; \ |
461 | } \ |
462 | VERIFY(s->rule.ptr->states > 0); \ |
463 | s->rule.ptr->states--; \ |
464 | } while (0) |
465 | |
466 | static __inline int pf_src_compare(struct pf_src_node *, struct pf_src_node *); |
467 | static __inline int pf_state_compare_lan_ext(struct pf_state_key *, |
468 | struct pf_state_key *); |
469 | static __inline int pf_state_compare_ext_gwy(struct pf_state_key *, |
470 | struct pf_state_key *); |
471 | static __inline int pf_state_compare_id(struct pf_state *, |
472 | struct pf_state *); |
473 | |
474 | struct pf_src_tree tree_src_tracking; |
475 | |
476 | struct pf_state_tree_id tree_id; |
477 | struct pf_state_queue state_list; |
478 | |
479 | RB_GENERATE(pf_src_tree, pf_src_node, entry, pf_src_compare); |
480 | RB_GENERATE(pf_state_tree_lan_ext, pf_state_key, |
481 | entry_lan_ext, pf_state_compare_lan_ext); |
482 | RB_GENERATE(pf_state_tree_ext_gwy, pf_state_key, |
483 | entry_ext_gwy, pf_state_compare_ext_gwy); |
484 | RB_GENERATE(pf_state_tree_id, pf_state, |
485 | entry_id, pf_state_compare_id); |
486 | |
487 | #define PF_DT_SKIP_LANEXT 0x01 |
488 | #define PF_DT_SKIP_EXTGWY 0x02 |
489 | |
490 | static const u_int16_t PF_PPTP_PORT = 1723; |
491 | static const u_int32_t PF_PPTP_MAGIC_NUMBER = 0x1A2B3C4D; |
492 | |
493 | struct pf_pptp_hdr { |
494 | u_int16_t length; |
495 | u_int16_t type; |
496 | u_int32_t magic; |
497 | }; |
498 | |
499 | struct pf_pptp_ctrl_hdr { |
500 | u_int16_t type; |
501 | u_int16_t reserved_0; |
502 | }; |
503 | |
504 | struct pf_pptp_ctrl_generic { |
505 | u_int16_t data[0]; |
506 | }; |
507 | |
508 | #define PF_PPTP_CTRL_TYPE_START_REQ 1 |
509 | struct pf_pptp_ctrl_start_req { |
510 | u_int16_t protocol_version; |
511 | u_int16_t reserved_1; |
512 | u_int32_t framing_capabilities; |
513 | u_int32_t bearer_capabilities; |
514 | u_int16_t maximum_channels; |
515 | u_int16_t firmware_revision; |
516 | u_int8_t host_name[64]; |
517 | u_int8_t vendor_string[64]; |
518 | }; |
519 | |
520 | #define PF_PPTP_CTRL_TYPE_START_RPY 2 |
521 | struct pf_pptp_ctrl_start_rpy { |
522 | u_int16_t protocol_version; |
523 | u_int8_t result_code; |
524 | u_int8_t error_code; |
525 | u_int32_t framing_capabilities; |
526 | u_int32_t bearer_capabilities; |
527 | u_int16_t maximum_channels; |
528 | u_int16_t firmware_revision; |
529 | u_int8_t host_name[64]; |
530 | u_int8_t vendor_string[64]; |
531 | }; |
532 | |
533 | #define PF_PPTP_CTRL_TYPE_STOP_REQ 3 |
534 | struct pf_pptp_ctrl_stop_req { |
535 | u_int8_t reason; |
536 | u_int8_t reserved_1; |
537 | u_int16_t reserved_2; |
538 | }; |
539 | |
540 | #define PF_PPTP_CTRL_TYPE_STOP_RPY 4 |
541 | struct pf_pptp_ctrl_stop_rpy { |
542 | u_int8_t reason; |
543 | u_int8_t error_code; |
544 | u_int16_t reserved_1; |
545 | }; |
546 | |
547 | #define PF_PPTP_CTRL_TYPE_ECHO_REQ 5 |
548 | struct pf_pptp_ctrl_echo_req { |
549 | u_int32_t identifier; |
550 | }; |
551 | |
552 | #define PF_PPTP_CTRL_TYPE_ECHO_RPY 6 |
553 | struct pf_pptp_ctrl_echo_rpy { |
554 | u_int32_t identifier; |
555 | u_int8_t result_code; |
556 | u_int8_t error_code; |
557 | u_int16_t reserved_1; |
558 | }; |
559 | |
560 | #define PF_PPTP_CTRL_TYPE_CALL_OUT_REQ 7 |
561 | struct pf_pptp_ctrl_call_out_req { |
562 | u_int16_t call_id; |
563 | u_int16_t call_sernum; |
564 | u_int32_t min_bps; |
565 | u_int32_t bearer_type; |
566 | u_int32_t framing_type; |
567 | u_int16_t rxwindow_size; |
568 | u_int16_t proc_delay; |
569 | u_int8_t phone_num[64]; |
570 | u_int8_t sub_addr[64]; |
571 | }; |
572 | |
573 | #define PF_PPTP_CTRL_TYPE_CALL_OUT_RPY 8 |
574 | struct pf_pptp_ctrl_call_out_rpy { |
575 | u_int16_t call_id; |
576 | u_int16_t peer_call_id; |
577 | u_int8_t result_code; |
578 | u_int8_t error_code; |
579 | u_int16_t cause_code; |
580 | u_int32_t connect_speed; |
581 | u_int16_t rxwindow_size; |
582 | u_int16_t proc_delay; |
583 | u_int32_t phy_channel_id; |
584 | }; |
585 | |
586 | #define PF_PPTP_CTRL_TYPE_CALL_IN_1ST 9 |
587 | struct pf_pptp_ctrl_call_in_1st { |
588 | u_int16_t call_id; |
589 | u_int16_t call_sernum; |
590 | u_int32_t bearer_type; |
591 | u_int32_t phy_channel_id; |
592 | u_int16_t dialed_number_len; |
593 | u_int16_t dialing_number_len; |
594 | u_int8_t dialed_num[64]; |
595 | u_int8_t dialing_num[64]; |
596 | u_int8_t sub_addr[64]; |
597 | }; |
598 | |
599 | #define PF_PPTP_CTRL_TYPE_CALL_IN_2ND 10 |
600 | struct pf_pptp_ctrl_call_in_2nd { |
601 | u_int16_t call_id; |
602 | u_int16_t peer_call_id; |
603 | u_int8_t result_code; |
604 | u_int8_t error_code; |
605 | u_int16_t rxwindow_size; |
606 | u_int16_t txdelay; |
607 | u_int16_t reserved_1; |
608 | }; |
609 | |
610 | #define PF_PPTP_CTRL_TYPE_CALL_IN_3RD 11 |
611 | struct pf_pptp_ctrl_call_in_3rd { |
612 | u_int16_t call_id; |
613 | u_int16_t reserved_1; |
614 | u_int32_t connect_speed; |
615 | u_int16_t rxwindow_size; |
616 | u_int16_t txdelay; |
617 | u_int32_t framing_type; |
618 | }; |
619 | |
620 | #define PF_PPTP_CTRL_TYPE_CALL_CLR 12 |
621 | struct pf_pptp_ctrl_call_clr { |
622 | u_int16_t call_id; |
623 | u_int16_t reserved_1; |
624 | }; |
625 | |
626 | #define PF_PPTP_CTRL_TYPE_CALL_DISC 13 |
627 | struct pf_pptp_ctrl_call_disc { |
628 | u_int16_t call_id; |
629 | u_int8_t result_code; |
630 | u_int8_t error_code; |
631 | u_int16_t cause_code; |
632 | u_int16_t reserved_1; |
633 | u_int8_t statistics[128]; |
634 | }; |
635 | |
636 | #define PF_PPTP_CTRL_TYPE_ERROR 14 |
637 | struct pf_pptp_ctrl_error { |
638 | u_int16_t peer_call_id; |
639 | u_int16_t reserved_1; |
640 | u_int32_t crc_errors; |
641 | u_int32_t fr_errors; |
642 | u_int32_t hw_errors; |
643 | u_int32_t buf_errors; |
644 | u_int32_t tim_errors; |
645 | u_int32_t align_errors; |
646 | }; |
647 | |
648 | #define PF_PPTP_CTRL_TYPE_SET_LINKINFO 15 |
649 | struct pf_pptp_ctrl_set_linkinfo { |
650 | u_int16_t peer_call_id; |
651 | u_int16_t reserved_1; |
652 | u_int32_t tx_accm; |
653 | u_int32_t rx_accm; |
654 | }; |
655 | |
656 | #if 0 |
657 | static const char *pf_pptp_ctrl_type_name(u_int16_t code) |
658 | { |
659 | code = ntohs(code); |
660 | |
661 | if (code < PF_PPTP_CTRL_TYPE_START_REQ || |
662 | code > PF_PPTP_CTRL_TYPE_SET_LINKINFO) { |
663 | static char reserved[] = "reserved-00" ; |
664 | |
665 | sprintf(&reserved[9], "%02x" , code); |
666 | return (reserved); |
667 | } else { |
668 | static const char *name[] = { |
669 | "start_req" , "start_rpy" , "stop_req" , "stop_rpy" , |
670 | "echo_req" , "echo_rpy" , "call_out_req" , "call_out_rpy" , |
671 | "call_in_1st" , "call_in_2nd" , "call_in_3rd" , |
672 | "call_clr" , "call_disc" , "error" , "set_linkinfo" |
673 | }; |
674 | |
675 | return (name[code - 1]); |
676 | } |
677 | }; |
678 | #endif |
679 | |
680 | static const size_t PF_PPTP_CTRL_MSG_MINSIZE = |
681 | sizeof (struct pf_pptp_hdr) + sizeof (struct pf_pptp_ctrl_hdr); |
682 | |
683 | union pf_pptp_ctrl_msg_union { |
684 | struct pf_pptp_ctrl_start_req start_req; |
685 | struct pf_pptp_ctrl_start_rpy start_rpy; |
686 | struct pf_pptp_ctrl_stop_req stop_req; |
687 | struct pf_pptp_ctrl_stop_rpy stop_rpy; |
688 | struct pf_pptp_ctrl_echo_req echo_req; |
689 | struct pf_pptp_ctrl_echo_rpy echo_rpy; |
690 | struct pf_pptp_ctrl_call_out_req call_out_req; |
691 | struct pf_pptp_ctrl_call_out_rpy call_out_rpy; |
692 | struct pf_pptp_ctrl_call_in_1st call_in_1st; |
693 | struct pf_pptp_ctrl_call_in_2nd call_in_2nd; |
694 | struct pf_pptp_ctrl_call_in_3rd call_in_3rd; |
695 | struct pf_pptp_ctrl_call_clr call_clr; |
696 | struct pf_pptp_ctrl_call_disc call_disc; |
697 | struct pf_pptp_ctrl_error error; |
698 | struct pf_pptp_ctrl_set_linkinfo set_linkinfo; |
699 | u_int8_t data[0]; |
700 | }; |
701 | |
702 | struct pf_pptp_ctrl_msg { |
703 | struct pf_pptp_hdr hdr; |
704 | struct pf_pptp_ctrl_hdr ctrl; |
705 | union pf_pptp_ctrl_msg_union msg; |
706 | }; |
707 | |
708 | #define PF_GRE_FLAG_CHECKSUM_PRESENT 0x8000 |
709 | #define PF_GRE_FLAG_VERSION_MASK 0x0007 |
710 | #define PF_GRE_PPP_ETHERTYPE 0x880B |
711 | |
712 | struct pf_grev1_hdr { |
713 | u_int16_t flags; |
714 | u_int16_t protocol_type; |
715 | u_int16_t payload_length; |
716 | u_int16_t call_id; |
717 | /* |
718 | u_int32_t seqno; |
719 | u_int32_t ackno; |
720 | */ |
721 | }; |
722 | |
723 | static const u_int16_t PF_IKE_PORT = 500; |
724 | |
725 | struct pf_ike_hdr { |
726 | u_int64_t initiator_cookie, responder_cookie; |
727 | u_int8_t next_payload, version, exchange_type, flags; |
728 | u_int32_t message_id, length; |
729 | }; |
730 | |
731 | #define PF_IKE_PACKET_MINSIZE (sizeof (struct pf_ike_hdr)) |
732 | |
733 | #define PF_IKEv1_EXCHTYPE_BASE 1 |
734 | #define PF_IKEv1_EXCHTYPE_ID_PROTECT 2 |
735 | #define PF_IKEv1_EXCHTYPE_AUTH_ONLY 3 |
736 | #define PF_IKEv1_EXCHTYPE_AGGRESSIVE 4 |
737 | #define PF_IKEv1_EXCHTYPE_INFORMATIONAL 5 |
738 | #define PF_IKEv2_EXCHTYPE_SA_INIT 34 |
739 | #define PF_IKEv2_EXCHTYPE_AUTH 35 |
740 | #define PF_IKEv2_EXCHTYPE_CREATE_CHILD_SA 36 |
741 | #define PF_IKEv2_EXCHTYPE_INFORMATIONAL 37 |
742 | |
743 | #define PF_IKEv1_FLAG_E 0x01 |
744 | #define PF_IKEv1_FLAG_C 0x02 |
745 | #define PF_IKEv1_FLAG_A 0x04 |
746 | #define PF_IKEv2_FLAG_I 0x08 |
747 | #define PF_IKEv2_FLAG_V 0x10 |
748 | #define PF_IKEv2_FLAG_R 0x20 |
749 | |
750 | struct pf_esp_hdr { |
751 | u_int32_t spi; |
752 | u_int32_t seqno; |
753 | u_int8_t payload[]; |
754 | }; |
755 | |
756 | static __inline int |
757 | pf_addr_compare(struct pf_addr *a, struct pf_addr *b, sa_family_t af) |
758 | { |
759 | switch (af) { |
760 | #ifdef INET |
761 | case AF_INET: |
762 | if (a->addr32[0] > b->addr32[0]) |
763 | return (1); |
764 | if (a->addr32[0] < b->addr32[0]) |
765 | return (-1); |
766 | break; |
767 | #endif /* INET */ |
768 | #ifdef INET6 |
769 | case AF_INET6: |
770 | if (a->addr32[3] > b->addr32[3]) |
771 | return (1); |
772 | if (a->addr32[3] < b->addr32[3]) |
773 | return (-1); |
774 | if (a->addr32[2] > b->addr32[2]) |
775 | return (1); |
776 | if (a->addr32[2] < b->addr32[2]) |
777 | return (-1); |
778 | if (a->addr32[1] > b->addr32[1]) |
779 | return (1); |
780 | if (a->addr32[1] < b->addr32[1]) |
781 | return (-1); |
782 | if (a->addr32[0] > b->addr32[0]) |
783 | return (1); |
784 | if (a->addr32[0] < b->addr32[0]) |
785 | return (-1); |
786 | break; |
787 | #endif /* INET6 */ |
788 | } |
789 | return (0); |
790 | } |
791 | |
792 | static __inline int |
793 | pf_src_compare(struct pf_src_node *a, struct pf_src_node *b) |
794 | { |
795 | int diff; |
796 | |
797 | if (a->rule.ptr > b->rule.ptr) |
798 | return (1); |
799 | if (a->rule.ptr < b->rule.ptr) |
800 | return (-1); |
801 | if ((diff = a->af - b->af) != 0) |
802 | return (diff); |
803 | if ((diff = pf_addr_compare(&a->addr, &b->addr, a->af)) != 0) |
804 | return (diff); |
805 | return (0); |
806 | } |
807 | |
808 | static __inline int |
809 | pf_state_compare_lan_ext(struct pf_state_key *a, struct pf_state_key *b) |
810 | { |
811 | int diff; |
812 | int extfilter; |
813 | |
814 | if ((diff = a->proto - b->proto) != 0) |
815 | return (diff); |
816 | if ((diff = a->af_lan - b->af_lan) != 0) |
817 | return (diff); |
818 | |
819 | extfilter = PF_EXTFILTER_APD; |
820 | |
821 | switch (a->proto) { |
822 | case IPPROTO_ICMP: |
823 | case IPPROTO_ICMPV6: |
824 | if ((diff = a->lan.xport.port - b->lan.xport.port) != 0) |
825 | return (diff); |
826 | break; |
827 | |
828 | case IPPROTO_TCP: |
829 | if ((diff = a->lan.xport.port - b->lan.xport.port) != 0) |
830 | return (diff); |
831 | if ((diff = a->ext_lan.xport.port - b->ext_lan.xport.port) != 0) |
832 | return (diff); |
833 | break; |
834 | |
835 | case IPPROTO_UDP: |
836 | if ((diff = a->proto_variant - b->proto_variant)) |
837 | return (diff); |
838 | extfilter = a->proto_variant; |
839 | if ((diff = a->lan.xport.port - b->lan.xport.port) != 0) |
840 | return (diff); |
841 | if ((extfilter < PF_EXTFILTER_AD) && |
842 | (diff = a->ext_lan.xport.port - b->ext_lan.xport.port) != 0) |
843 | return (diff); |
844 | break; |
845 | |
846 | case IPPROTO_GRE: |
847 | if (a->proto_variant == PF_GRE_PPTP_VARIANT && |
848 | a->proto_variant == b->proto_variant) { |
849 | if (!!(diff = a->ext_lan.xport.call_id - |
850 | b->ext_lan.xport.call_id)) |
851 | return (diff); |
852 | } |
853 | break; |
854 | |
855 | case IPPROTO_ESP: |
856 | if (!!(diff = a->ext_lan.xport.spi - b->ext_lan.xport.spi)) |
857 | return (diff); |
858 | break; |
859 | |
860 | default: |
861 | break; |
862 | } |
863 | |
864 | switch (a->af_lan) { |
865 | #if INET |
866 | case AF_INET: |
867 | if ((diff = pf_addr_compare(&a->lan.addr, &b->lan.addr, |
868 | a->af_lan)) != 0) |
869 | return (diff); |
870 | |
871 | if (extfilter < PF_EXTFILTER_EI) { |
872 | if ((diff = pf_addr_compare(&a->ext_lan.addr, |
873 | &b->ext_lan.addr, |
874 | a->af_lan)) != 0) |
875 | return (diff); |
876 | } |
877 | break; |
878 | #endif /* INET */ |
879 | #if INET6 |
880 | case AF_INET6: |
881 | if ((diff = pf_addr_compare(&a->lan.addr, &b->lan.addr, |
882 | a->af_lan)) != 0) |
883 | return (diff); |
884 | |
885 | if (extfilter < PF_EXTFILTER_EI || |
886 | !PF_AZERO(&b->ext_lan.addr, AF_INET6)) { |
887 | if ((diff = pf_addr_compare(&a->ext_lan.addr, |
888 | &b->ext_lan.addr, |
889 | a->af_lan)) != 0) |
890 | return (diff); |
891 | } |
892 | break; |
893 | #endif /* INET6 */ |
894 | } |
895 | |
896 | if (a->app_state && b->app_state) { |
897 | if (a->app_state->compare_lan_ext && |
898 | b->app_state->compare_lan_ext) { |
899 | diff = (const char *)b->app_state->compare_lan_ext - |
900 | (const char *)a->app_state->compare_lan_ext; |
901 | if (diff != 0) |
902 | return (diff); |
903 | diff = a->app_state->compare_lan_ext(a->app_state, |
904 | b->app_state); |
905 | if (diff != 0) |
906 | return (diff); |
907 | } |
908 | } |
909 | |
910 | return (0); |
911 | } |
912 | |
913 | static __inline int |
914 | pf_state_compare_ext_gwy(struct pf_state_key *a, struct pf_state_key *b) |
915 | { |
916 | int diff; |
917 | int extfilter; |
918 | |
919 | if ((diff = a->proto - b->proto) != 0) |
920 | return (diff); |
921 | |
922 | if ((diff = a->af_gwy - b->af_gwy) != 0) |
923 | return (diff); |
924 | |
925 | extfilter = PF_EXTFILTER_APD; |
926 | |
927 | switch (a->proto) { |
928 | case IPPROTO_ICMP: |
929 | case IPPROTO_ICMPV6: |
930 | if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0) |
931 | return (diff); |
932 | break; |
933 | |
934 | case IPPROTO_TCP: |
935 | if ((diff = a->ext_gwy.xport.port - b->ext_gwy.xport.port) != 0) |
936 | return (diff); |
937 | if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0) |
938 | return (diff); |
939 | break; |
940 | |
941 | case IPPROTO_UDP: |
942 | if ((diff = a->proto_variant - b->proto_variant)) |
943 | return (diff); |
944 | extfilter = a->proto_variant; |
945 | if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0) |
946 | return (diff); |
947 | if ((extfilter < PF_EXTFILTER_AD) && |
948 | (diff = a->ext_gwy.xport.port - b->ext_gwy.xport.port) != 0) |
949 | return (diff); |
950 | break; |
951 | |
952 | case IPPROTO_GRE: |
953 | if (a->proto_variant == PF_GRE_PPTP_VARIANT && |
954 | a->proto_variant == b->proto_variant) { |
955 | if (!!(diff = a->gwy.xport.call_id - |
956 | b->gwy.xport.call_id)) |
957 | return (diff); |
958 | } |
959 | break; |
960 | |
961 | case IPPROTO_ESP: |
962 | if (!!(diff = a->gwy.xport.spi - b->gwy.xport.spi)) |
963 | return (diff); |
964 | break; |
965 | |
966 | default: |
967 | break; |
968 | } |
969 | |
970 | switch (a->af_gwy) { |
971 | #if INET |
972 | case AF_INET: |
973 | if ((diff = pf_addr_compare(&a->gwy.addr, &b->gwy.addr, |
974 | a->af_gwy)) != 0) |
975 | return (diff); |
976 | |
977 | if (extfilter < PF_EXTFILTER_EI) { |
978 | if ((diff = pf_addr_compare(&a->ext_gwy.addr, &b->ext_gwy.addr, |
979 | a->af_gwy)) != 0) |
980 | return (diff); |
981 | } |
982 | break; |
983 | #endif /* INET */ |
984 | #if INET6 |
985 | case AF_INET6: |
986 | if ((diff = pf_addr_compare(&a->gwy.addr, &b->gwy.addr, |
987 | a->af_gwy)) != 0) |
988 | return (diff); |
989 | |
990 | if (extfilter < PF_EXTFILTER_EI || |
991 | !PF_AZERO(&b->ext_gwy.addr, AF_INET6)) { |
992 | if ((diff = pf_addr_compare(&a->ext_gwy.addr, &b->ext_gwy.addr, |
993 | a->af_gwy)) != 0) |
994 | return (diff); |
995 | } |
996 | break; |
997 | #endif /* INET6 */ |
998 | } |
999 | |
1000 | if (a->app_state && b->app_state) { |
1001 | if (a->app_state->compare_ext_gwy && |
1002 | b->app_state->compare_ext_gwy) { |
1003 | diff = (const char *)b->app_state->compare_ext_gwy - |
1004 | (const char *)a->app_state->compare_ext_gwy; |
1005 | if (diff != 0) |
1006 | return (diff); |
1007 | diff = a->app_state->compare_ext_gwy(a->app_state, |
1008 | b->app_state); |
1009 | if (diff != 0) |
1010 | return (diff); |
1011 | } |
1012 | } |
1013 | |
1014 | return (0); |
1015 | } |
1016 | |
1017 | static __inline int |
1018 | pf_state_compare_id(struct pf_state *a, struct pf_state *b) |
1019 | { |
1020 | if (a->id > b->id) |
1021 | return (1); |
1022 | if (a->id < b->id) |
1023 | return (-1); |
1024 | if (a->creatorid > b->creatorid) |
1025 | return (1); |
1026 | if (a->creatorid < b->creatorid) |
1027 | return (-1); |
1028 | |
1029 | return (0); |
1030 | } |
1031 | |
1032 | #if INET6 |
1033 | void |
1034 | pf_addrcpy(struct pf_addr *dst, struct pf_addr *src, sa_family_t af) |
1035 | { |
1036 | switch (af) { |
1037 | #if INET |
1038 | case AF_INET: |
1039 | dst->addr32[0] = src->addr32[0]; |
1040 | break; |
1041 | #endif /* INET */ |
1042 | case AF_INET6: |
1043 | dst->addr32[0] = src->addr32[0]; |
1044 | dst->addr32[1] = src->addr32[1]; |
1045 | dst->addr32[2] = src->addr32[2]; |
1046 | dst->addr32[3] = src->addr32[3]; |
1047 | break; |
1048 | } |
1049 | } |
1050 | #endif /* INET6 */ |
1051 | |
1052 | struct pf_state * |
1053 | pf_find_state_byid(struct pf_state_cmp *key) |
1054 | { |
1055 | pf_status.fcounters[FCNT_STATE_SEARCH]++; |
1056 | |
1057 | return (RB_FIND(pf_state_tree_id, &tree_id, |
1058 | (struct pf_state *)(void *)key)); |
1059 | } |
1060 | |
1061 | static struct pf_state * |
1062 | pf_find_state(struct pfi_kif *kif, struct pf_state_key_cmp *key, u_int dir) |
1063 | { |
1064 | struct pf_state_key *sk = NULL; |
1065 | struct pf_state *s; |
1066 | |
1067 | pf_status.fcounters[FCNT_STATE_SEARCH]++; |
1068 | |
1069 | switch (dir) { |
1070 | case PF_OUT: |
1071 | sk = RB_FIND(pf_state_tree_lan_ext, &pf_statetbl_lan_ext, |
1072 | (struct pf_state_key *)key); |
1073 | break; |
1074 | case PF_IN: |
1075 | sk = RB_FIND(pf_state_tree_ext_gwy, &pf_statetbl_ext_gwy, |
1076 | (struct pf_state_key *)key); |
1077 | /* |
1078 | * NAT64 is done only on input, for packets coming in from |
1079 | * from the LAN side, need to lookup the lan_ext tree. |
1080 | */ |
1081 | if (sk == NULL) { |
1082 | sk = RB_FIND(pf_state_tree_lan_ext, |
1083 | &pf_statetbl_lan_ext, |
1084 | (struct pf_state_key *)key); |
1085 | if (sk && sk->af_lan == sk->af_gwy) |
1086 | sk = NULL; |
1087 | } |
1088 | break; |
1089 | default: |
1090 | panic("pf_find_state" ); |
1091 | } |
1092 | |
1093 | /* list is sorted, if-bound states before floating ones */ |
1094 | if (sk != NULL) |
1095 | TAILQ_FOREACH(s, &sk->states, next) |
1096 | if (s->kif == pfi_all || s->kif == kif) |
1097 | return (s); |
1098 | |
1099 | return (NULL); |
1100 | } |
1101 | |
1102 | struct pf_state * |
1103 | pf_find_state_all(struct pf_state_key_cmp *key, u_int dir, int *more) |
1104 | { |
1105 | struct pf_state_key *sk = NULL; |
1106 | struct pf_state *s, *ret = NULL; |
1107 | |
1108 | pf_status.fcounters[FCNT_STATE_SEARCH]++; |
1109 | |
1110 | switch (dir) { |
1111 | case PF_OUT: |
1112 | sk = RB_FIND(pf_state_tree_lan_ext, |
1113 | &pf_statetbl_lan_ext, (struct pf_state_key *)key); |
1114 | break; |
1115 | case PF_IN: |
1116 | sk = RB_FIND(pf_state_tree_ext_gwy, |
1117 | &pf_statetbl_ext_gwy, (struct pf_state_key *)key); |
1118 | /* |
1119 | * NAT64 is done only on input, for packets coming in from |
1120 | * from the LAN side, need to lookup the lan_ext tree. |
1121 | */ |
1122 | if ((sk == NULL) && pf_nat64_configured) { |
1123 | sk = RB_FIND(pf_state_tree_lan_ext, |
1124 | &pf_statetbl_lan_ext, |
1125 | (struct pf_state_key *)key); |
1126 | if (sk && sk->af_lan == sk->af_gwy) |
1127 | sk = NULL; |
1128 | } |
1129 | break; |
1130 | default: |
1131 | panic("pf_find_state_all" ); |
1132 | } |
1133 | |
1134 | if (sk != NULL) { |
1135 | ret = TAILQ_FIRST(&sk->states); |
1136 | if (more == NULL) |
1137 | return (ret); |
1138 | |
1139 | TAILQ_FOREACH(s, &sk->states, next) |
1140 | (*more)++; |
1141 | } |
1142 | |
1143 | return (ret); |
1144 | } |
1145 | |
1146 | static void |
1147 | pf_init_threshold(struct pf_threshold *threshold, |
1148 | u_int32_t limit, u_int32_t seconds) |
1149 | { |
1150 | threshold->limit = limit * PF_THRESHOLD_MULT; |
1151 | threshold->seconds = seconds; |
1152 | threshold->count = 0; |
1153 | threshold->last = pf_time_second(); |
1154 | } |
1155 | |
1156 | static void |
1157 | pf_add_threshold(struct pf_threshold *threshold) |
1158 | { |
1159 | u_int32_t t = pf_time_second(), diff = t - threshold->last; |
1160 | |
1161 | if (diff >= threshold->seconds) |
1162 | threshold->count = 0; |
1163 | else |
1164 | threshold->count -= threshold->count * diff / |
1165 | threshold->seconds; |
1166 | threshold->count += PF_THRESHOLD_MULT; |
1167 | threshold->last = t; |
1168 | } |
1169 | |
1170 | static int |
1171 | pf_check_threshold(struct pf_threshold *threshold) |
1172 | { |
1173 | return (threshold->count > threshold->limit); |
1174 | } |
1175 | |
1176 | static int |
1177 | pf_src_connlimit(struct pf_state **state) |
1178 | { |
1179 | int bad = 0; |
1180 | (*state)->src_node->conn++; |
1181 | VERIFY((*state)->src_node->conn != 0); |
1182 | (*state)->src.tcp_est = 1; |
1183 | pf_add_threshold(&(*state)->src_node->conn_rate); |
1184 | |
1185 | if ((*state)->rule.ptr->max_src_conn && |
1186 | (*state)->rule.ptr->max_src_conn < |
1187 | (*state)->src_node->conn) { |
1188 | pf_status.lcounters[LCNT_SRCCONN]++; |
1189 | bad++; |
1190 | } |
1191 | |
1192 | if ((*state)->rule.ptr->max_src_conn_rate.limit && |
1193 | pf_check_threshold(&(*state)->src_node->conn_rate)) { |
1194 | pf_status.lcounters[LCNT_SRCCONNRATE]++; |
1195 | bad++; |
1196 | } |
1197 | |
1198 | if (!bad) |
1199 | return (0); |
1200 | |
1201 | if ((*state)->rule.ptr->overload_tbl) { |
1202 | struct pfr_addr p; |
1203 | u_int32_t killed = 0; |
1204 | |
1205 | pf_status.lcounters[LCNT_OVERLOAD_TABLE]++; |
1206 | if (pf_status.debug >= PF_DEBUG_MISC) { |
1207 | printf("pf_src_connlimit: blocking address " ); |
1208 | pf_print_host(&(*state)->src_node->addr, 0, |
1209 | (*state)->state_key->af_lan); |
1210 | } |
1211 | |
1212 | bzero(&p, sizeof (p)); |
1213 | p.pfra_af = (*state)->state_key->af_lan; |
1214 | switch ((*state)->state_key->af_lan) { |
1215 | #if INET |
1216 | case AF_INET: |
1217 | p.pfra_net = 32; |
1218 | p.pfra_ip4addr = (*state)->src_node->addr.v4addr; |
1219 | break; |
1220 | #endif /* INET */ |
1221 | #if INET6 |
1222 | case AF_INET6: |
1223 | p.pfra_net = 128; |
1224 | p.pfra_ip6addr = (*state)->src_node->addr.v6addr; |
1225 | break; |
1226 | #endif /* INET6 */ |
1227 | } |
1228 | |
1229 | pfr_insert_kentry((*state)->rule.ptr->overload_tbl, |
1230 | &p, pf_calendar_time_second()); |
1231 | |
1232 | /* kill existing states if that's required. */ |
1233 | if ((*state)->rule.ptr->flush) { |
1234 | struct pf_state_key *sk; |
1235 | struct pf_state *st; |
1236 | |
1237 | pf_status.lcounters[LCNT_OVERLOAD_FLUSH]++; |
1238 | RB_FOREACH(st, pf_state_tree_id, &tree_id) { |
1239 | sk = st->state_key; |
1240 | /* |
1241 | * Kill states from this source. (Only those |
1242 | * from the same rule if PF_FLUSH_GLOBAL is not |
1243 | * set) |
1244 | */ |
1245 | if (sk->af_lan == |
1246 | (*state)->state_key->af_lan && |
1247 | (((*state)->state_key->direction == |
1248 | PF_OUT && |
1249 | PF_AEQ(&(*state)->src_node->addr, |
1250 | &sk->lan.addr, sk->af_lan)) || |
1251 | ((*state)->state_key->direction == PF_IN && |
1252 | PF_AEQ(&(*state)->src_node->addr, |
1253 | &sk->ext_lan.addr, sk->af_lan))) && |
1254 | ((*state)->rule.ptr->flush & |
1255 | PF_FLUSH_GLOBAL || |
1256 | (*state)->rule.ptr == st->rule.ptr)) { |
1257 | st->timeout = PFTM_PURGE; |
1258 | st->src.state = st->dst.state = |
1259 | TCPS_CLOSED; |
1260 | killed++; |
1261 | } |
1262 | } |
1263 | if (pf_status.debug >= PF_DEBUG_MISC) |
1264 | printf(", %u states killed" , killed); |
1265 | } |
1266 | if (pf_status.debug >= PF_DEBUG_MISC) |
1267 | printf("\n" ); |
1268 | } |
1269 | |
1270 | /* kill this state */ |
1271 | (*state)->timeout = PFTM_PURGE; |
1272 | (*state)->src.state = (*state)->dst.state = TCPS_CLOSED; |
1273 | return (1); |
1274 | } |
1275 | |
1276 | int |
1277 | pf_insert_src_node(struct pf_src_node **sn, struct pf_rule *rule, |
1278 | struct pf_addr *src, sa_family_t af) |
1279 | { |
1280 | struct pf_src_node k; |
1281 | |
1282 | if (*sn == NULL) { |
1283 | k.af = af; |
1284 | PF_ACPY(&k.addr, src, af); |
1285 | if (rule->rule_flag & PFRULE_RULESRCTRACK || |
1286 | rule->rpool.opts & PF_POOL_STICKYADDR) |
1287 | k.rule.ptr = rule; |
1288 | else |
1289 | k.rule.ptr = NULL; |
1290 | pf_status.scounters[SCNT_SRC_NODE_SEARCH]++; |
1291 | *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k); |
1292 | } |
1293 | if (*sn == NULL) { |
1294 | if (!rule->max_src_nodes || |
1295 | rule->src_nodes < rule->max_src_nodes) |
1296 | (*sn) = pool_get(&pf_src_tree_pl, PR_WAITOK); |
1297 | else |
1298 | pf_status.lcounters[LCNT_SRCNODES]++; |
1299 | if ((*sn) == NULL) |
1300 | return (-1); |
1301 | bzero(*sn, sizeof (struct pf_src_node)); |
1302 | |
1303 | pf_init_threshold(&(*sn)->conn_rate, |
1304 | rule->max_src_conn_rate.limit, |
1305 | rule->max_src_conn_rate.seconds); |
1306 | |
1307 | (*sn)->af = af; |
1308 | if (rule->rule_flag & PFRULE_RULESRCTRACK || |
1309 | rule->rpool.opts & PF_POOL_STICKYADDR) |
1310 | (*sn)->rule.ptr = rule; |
1311 | else |
1312 | (*sn)->rule.ptr = NULL; |
1313 | PF_ACPY(&(*sn)->addr, src, af); |
1314 | if (RB_INSERT(pf_src_tree, |
1315 | &tree_src_tracking, *sn) != NULL) { |
1316 | if (pf_status.debug >= PF_DEBUG_MISC) { |
1317 | printf("pf: src_tree insert failed: " ); |
1318 | pf_print_host(&(*sn)->addr, 0, af); |
1319 | printf("\n" ); |
1320 | } |
1321 | pool_put(&pf_src_tree_pl, *sn); |
1322 | return (-1); |
1323 | } |
1324 | (*sn)->creation = pf_time_second(); |
1325 | (*sn)->ruletype = rule->action; |
1326 | if ((*sn)->rule.ptr != NULL) |
1327 | (*sn)->rule.ptr->src_nodes++; |
1328 | pf_status.scounters[SCNT_SRC_NODE_INSERT]++; |
1329 | pf_status.src_nodes++; |
1330 | } else { |
1331 | if (rule->max_src_states && |
1332 | (*sn)->states >= rule->max_src_states) { |
1333 | pf_status.lcounters[LCNT_SRCSTATES]++; |
1334 | return (-1); |
1335 | } |
1336 | } |
1337 | return (0); |
1338 | } |
1339 | |
1340 | static void |
1341 | pf_stateins_err(const char *tree, struct pf_state *s, struct pfi_kif *kif) |
1342 | { |
1343 | struct pf_state_key *sk = s->state_key; |
1344 | |
1345 | if (pf_status.debug >= PF_DEBUG_MISC) { |
1346 | printf("pf: state insert failed: %s %s " , tree, kif->pfik_name); |
1347 | switch (sk->proto) { |
1348 | case IPPROTO_TCP: |
1349 | printf("TCP" ); |
1350 | break; |
1351 | case IPPROTO_UDP: |
1352 | printf("UDP" ); |
1353 | break; |
1354 | case IPPROTO_ICMP: |
1355 | printf("ICMP4" ); |
1356 | break; |
1357 | case IPPROTO_ICMPV6: |
1358 | printf("ICMP6" ); |
1359 | break; |
1360 | default: |
1361 | printf("PROTO=%u" , sk->proto); |
1362 | break; |
1363 | } |
1364 | printf(" lan: " ); |
1365 | pf_print_sk_host(&sk->lan, sk->af_lan, sk->proto, |
1366 | sk->proto_variant); |
1367 | printf(" gwy: " ); |
1368 | pf_print_sk_host(&sk->gwy, sk->af_gwy, sk->proto, |
1369 | sk->proto_variant); |
1370 | printf(" ext_lan: " ); |
1371 | pf_print_sk_host(&sk->ext_lan, sk->af_lan, sk->proto, |
1372 | sk->proto_variant); |
1373 | printf(" ext_gwy: " ); |
1374 | pf_print_sk_host(&sk->ext_gwy, sk->af_gwy, sk->proto, |
1375 | sk->proto_variant); |
1376 | if (s->sync_flags & PFSTATE_FROMSYNC) |
1377 | printf(" (from sync)" ); |
1378 | printf("\n" ); |
1379 | } |
1380 | } |
1381 | |
1382 | int |
1383 | pf_insert_state(struct pfi_kif *kif, struct pf_state *s) |
1384 | { |
1385 | struct pf_state_key *cur; |
1386 | struct pf_state *sp; |
1387 | |
1388 | VERIFY(s->state_key != NULL); |
1389 | s->kif = kif; |
1390 | |
1391 | if ((cur = RB_INSERT(pf_state_tree_lan_ext, &pf_statetbl_lan_ext, |
1392 | s->state_key)) != NULL) { |
1393 | /* key exists. check for same kif, if none, add to key */ |
1394 | TAILQ_FOREACH(sp, &cur->states, next) |
1395 | if (sp->kif == kif) { /* collision! */ |
1396 | pf_stateins_err("tree_lan_ext" , s, kif); |
1397 | pf_detach_state(s, |
1398 | PF_DT_SKIP_LANEXT|PF_DT_SKIP_EXTGWY); |
1399 | return (-1); |
1400 | } |
1401 | pf_detach_state(s, PF_DT_SKIP_LANEXT|PF_DT_SKIP_EXTGWY); |
1402 | pf_attach_state(cur, s, kif == pfi_all ? 1 : 0); |
1403 | } |
1404 | |
1405 | /* if cur != NULL, we already found a state key and attached to it */ |
1406 | if (cur == NULL && (cur = RB_INSERT(pf_state_tree_ext_gwy, |
1407 | &pf_statetbl_ext_gwy, s->state_key)) != NULL) { |
1408 | /* must not happen. we must have found the sk above! */ |
1409 | pf_stateins_err("tree_ext_gwy" , s, kif); |
1410 | pf_detach_state(s, PF_DT_SKIP_EXTGWY); |
1411 | return (-1); |
1412 | } |
1413 | |
1414 | if (s->id == 0 && s->creatorid == 0) { |
1415 | s->id = htobe64(pf_status.stateid++); |
1416 | s->creatorid = pf_status.hostid; |
1417 | } |
1418 | if (RB_INSERT(pf_state_tree_id, &tree_id, s) != NULL) { |
1419 | if (pf_status.debug >= PF_DEBUG_MISC) { |
1420 | printf("pf: state insert failed: " |
1421 | "id: %016llx creatorid: %08x" , |
1422 | be64toh(s->id), ntohl(s->creatorid)); |
1423 | if (s->sync_flags & PFSTATE_FROMSYNC) |
1424 | printf(" (from sync)" ); |
1425 | printf("\n" ); |
1426 | } |
1427 | pf_detach_state(s, 0); |
1428 | return (-1); |
1429 | } |
1430 | TAILQ_INSERT_TAIL(&state_list, s, entry_list); |
1431 | pf_status.fcounters[FCNT_STATE_INSERT]++; |
1432 | pf_status.states++; |
1433 | VERIFY(pf_status.states != 0); |
1434 | pfi_kif_ref(kif, PFI_KIF_REF_STATE); |
1435 | #if NPFSYNC |
1436 | pfsync_insert_state(s); |
1437 | #endif |
1438 | return (0); |
1439 | } |
1440 | |
1441 | static int |
1442 | pf_purge_thread_cont(int err) |
1443 | { |
1444 | #pragma unused(err) |
1445 | static u_int32_t nloops = 0; |
1446 | int t = 1; /* 1 second */ |
1447 | |
1448 | /* |
1449 | * Update coarse-grained networking timestamp (in sec.); the idea |
1450 | * is to piggy-back on the periodic timeout callout to update |
1451 | * the counter returnable via net_uptime(). |
1452 | */ |
1453 | net_update_uptime(); |
1454 | |
1455 | lck_rw_lock_shared(pf_perim_lock); |
1456 | lck_mtx_lock(pf_lock); |
1457 | |
1458 | /* purge everything if not running */ |
1459 | if (!pf_status.running) { |
1460 | pf_purge_expired_states(pf_status.states); |
1461 | pf_purge_expired_fragments(); |
1462 | pf_purge_expired_src_nodes(); |
1463 | |
1464 | /* terminate thread (we don't currently do this) */ |
1465 | if (pf_purge_thread == NULL) { |
1466 | lck_mtx_unlock(pf_lock); |
1467 | lck_rw_done(pf_perim_lock); |
1468 | |
1469 | thread_deallocate(current_thread()); |
1470 | thread_terminate(current_thread()); |
1471 | /* NOTREACHED */ |
1472 | return (0); |
1473 | } else { |
1474 | /* if there's nothing left, sleep w/o timeout */ |
1475 | if (pf_status.states == 0 && |
1476 | pf_normalize_isempty() && |
1477 | RB_EMPTY(&tree_src_tracking)) { |
1478 | nloops = 0; |
1479 | t = 0; |
1480 | } |
1481 | goto done; |
1482 | } |
1483 | } |
1484 | |
1485 | /* process a fraction of the state table every second */ |
1486 | pf_purge_expired_states(1 + (pf_status.states |
1487 | / pf_default_rule.timeout[PFTM_INTERVAL])); |
1488 | |
1489 | /* purge other expired types every PFTM_INTERVAL seconds */ |
1490 | if (++nloops >= pf_default_rule.timeout[PFTM_INTERVAL]) { |
1491 | pf_purge_expired_fragments(); |
1492 | pf_purge_expired_src_nodes(); |
1493 | nloops = 0; |
1494 | } |
1495 | done: |
1496 | lck_mtx_unlock(pf_lock); |
1497 | lck_rw_done(pf_perim_lock); |
1498 | |
1499 | (void) tsleep0(pf_purge_thread_fn, PWAIT, "pf_purge_cont" , |
1500 | t * hz, pf_purge_thread_cont); |
1501 | /* NOTREACHED */ |
1502 | VERIFY(0); |
1503 | |
1504 | return (0); |
1505 | } |
1506 | |
1507 | void |
1508 | pf_purge_thread_fn(void *v, wait_result_t w) |
1509 | { |
1510 | #pragma unused(v, w) |
1511 | (void) tsleep0(pf_purge_thread_fn, PWAIT, "pf_purge" , 0, |
1512 | pf_purge_thread_cont); |
1513 | /* |
1514 | * tsleep0() shouldn't have returned as PCATCH was not set; |
1515 | * therefore assert in this case. |
1516 | */ |
1517 | VERIFY(0); |
1518 | } |
1519 | |
1520 | u_int64_t |
1521 | pf_state_expires(const struct pf_state *state) |
1522 | { |
1523 | u_int32_t t; |
1524 | u_int32_t start; |
1525 | u_int32_t end; |
1526 | u_int32_t states; |
1527 | |
1528 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
1529 | |
1530 | /* handle all PFTM_* > PFTM_MAX here */ |
1531 | if (state->timeout == PFTM_PURGE) |
1532 | return (pf_time_second()); |
1533 | |
1534 | VERIFY(state->timeout != PFTM_UNLINKED); |
1535 | VERIFY(state->timeout < PFTM_MAX); |
1536 | t = state->rule.ptr->timeout[state->timeout]; |
1537 | if (!t) |
1538 | t = pf_default_rule.timeout[state->timeout]; |
1539 | start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START]; |
1540 | if (start) { |
1541 | end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END]; |
1542 | states = state->rule.ptr->states; |
1543 | } else { |
1544 | start = pf_default_rule.timeout[PFTM_ADAPTIVE_START]; |
1545 | end = pf_default_rule.timeout[PFTM_ADAPTIVE_END]; |
1546 | states = pf_status.states; |
1547 | } |
1548 | if (end && states > start && start < end) { |
1549 | if (states < end) |
1550 | return (state->expire + t * (end - states) / |
1551 | (end - start)); |
1552 | else |
1553 | return (pf_time_second()); |
1554 | } |
1555 | return (state->expire + t); |
1556 | } |
1557 | |
1558 | void |
1559 | pf_purge_expired_src_nodes(void) |
1560 | { |
1561 | struct pf_src_node *cur, *next; |
1562 | |
1563 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
1564 | |
1565 | for (cur = RB_MIN(pf_src_tree, &tree_src_tracking); cur; cur = next) { |
1566 | next = RB_NEXT(pf_src_tree, &tree_src_tracking, cur); |
1567 | |
1568 | if (cur->states <= 0 && cur->expire <= pf_time_second()) { |
1569 | if (cur->rule.ptr != NULL) { |
1570 | cur->rule.ptr->src_nodes--; |
1571 | if (cur->rule.ptr->states <= 0 && |
1572 | cur->rule.ptr->max_src_nodes <= 0) |
1573 | pf_rm_rule(NULL, cur->rule.ptr); |
1574 | } |
1575 | RB_REMOVE(pf_src_tree, &tree_src_tracking, cur); |
1576 | pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; |
1577 | pf_status.src_nodes--; |
1578 | pool_put(&pf_src_tree_pl, cur); |
1579 | } |
1580 | } |
1581 | } |
1582 | |
1583 | void |
1584 | pf_src_tree_remove_state(struct pf_state *s) |
1585 | { |
1586 | u_int32_t t; |
1587 | |
1588 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
1589 | |
1590 | if (s->src_node != NULL) { |
1591 | if (s->src.tcp_est) { |
1592 | VERIFY(s->src_node->conn > 0); |
1593 | --s->src_node->conn; |
1594 | } |
1595 | VERIFY(s->src_node->states > 0); |
1596 | if (--s->src_node->states <= 0) { |
1597 | t = s->rule.ptr->timeout[PFTM_SRC_NODE]; |
1598 | if (!t) |
1599 | t = pf_default_rule.timeout[PFTM_SRC_NODE]; |
1600 | s->src_node->expire = pf_time_second() + t; |
1601 | } |
1602 | } |
1603 | if (s->nat_src_node != s->src_node && s->nat_src_node != NULL) { |
1604 | VERIFY(s->nat_src_node->states > 0); |
1605 | if (--s->nat_src_node->states <= 0) { |
1606 | t = s->rule.ptr->timeout[PFTM_SRC_NODE]; |
1607 | if (!t) |
1608 | t = pf_default_rule.timeout[PFTM_SRC_NODE]; |
1609 | s->nat_src_node->expire = pf_time_second() + t; |
1610 | } |
1611 | } |
1612 | s->src_node = s->nat_src_node = NULL; |
1613 | } |
1614 | |
1615 | void |
1616 | pf_unlink_state(struct pf_state *cur) |
1617 | { |
1618 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
1619 | |
1620 | if (cur->src.state == PF_TCPS_PROXY_DST) { |
1621 | pf_send_tcp(cur->rule.ptr, cur->state_key->af_lan, |
1622 | &cur->state_key->ext_lan.addr, &cur->state_key->lan.addr, |
1623 | cur->state_key->ext_lan.xport.port, |
1624 | cur->state_key->lan.xport.port, |
1625 | cur->src.seqhi, cur->src.seqlo + 1, |
1626 | TH_RST|TH_ACK, 0, 0, 0, 1, cur->tag, NULL, NULL); |
1627 | } |
1628 | |
1629 | hook_runloop(&cur->unlink_hooks, HOOK_REMOVE|HOOK_FREE); |
1630 | RB_REMOVE(pf_state_tree_id, &tree_id, cur); |
1631 | #if NPFSYNC |
1632 | if (cur->creatorid == pf_status.hostid) |
1633 | pfsync_delete_state(cur); |
1634 | #endif |
1635 | cur->timeout = PFTM_UNLINKED; |
1636 | pf_src_tree_remove_state(cur); |
1637 | pf_detach_state(cur, 0); |
1638 | } |
1639 | |
1640 | /* callers should be at splpf and hold the |
1641 | * write_lock on pf_consistency_lock */ |
1642 | void |
1643 | pf_free_state(struct pf_state *cur) |
1644 | { |
1645 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
1646 | #if NPFSYNC |
1647 | if (pfsyncif != NULL && |
1648 | (pfsyncif->sc_bulk_send_next == cur || |
1649 | pfsyncif->sc_bulk_terminator == cur)) |
1650 | return; |
1651 | #endif |
1652 | VERIFY(cur->timeout == PFTM_UNLINKED); |
1653 | VERIFY(cur->rule.ptr->states > 0); |
1654 | if (--cur->rule.ptr->states <= 0 && |
1655 | cur->rule.ptr->src_nodes <= 0) |
1656 | pf_rm_rule(NULL, cur->rule.ptr); |
1657 | if (cur->nat_rule.ptr != NULL) { |
1658 | VERIFY(cur->nat_rule.ptr->states > 0); |
1659 | if (--cur->nat_rule.ptr->states <= 0 && |
1660 | cur->nat_rule.ptr->src_nodes <= 0) |
1661 | pf_rm_rule(NULL, cur->nat_rule.ptr); |
1662 | } |
1663 | if (cur->anchor.ptr != NULL) { |
1664 | VERIFY(cur->anchor.ptr->states > 0); |
1665 | if (--cur->anchor.ptr->states <= 0) |
1666 | pf_rm_rule(NULL, cur->anchor.ptr); |
1667 | } |
1668 | pf_normalize_tcp_cleanup(cur); |
1669 | pfi_kif_unref(cur->kif, PFI_KIF_REF_STATE); |
1670 | TAILQ_REMOVE(&state_list, cur, entry_list); |
1671 | if (cur->tag) |
1672 | pf_tag_unref(cur->tag); |
1673 | pool_put(&pf_state_pl, cur); |
1674 | pf_status.fcounters[FCNT_STATE_REMOVALS]++; |
1675 | VERIFY(pf_status.states > 0); |
1676 | pf_status.states--; |
1677 | } |
1678 | |
1679 | void |
1680 | pf_purge_expired_states(u_int32_t maxcheck) |
1681 | { |
1682 | static struct pf_state *cur = NULL; |
1683 | struct pf_state *next; |
1684 | |
1685 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
1686 | |
1687 | while (maxcheck--) { |
1688 | /* wrap to start of list when we hit the end */ |
1689 | if (cur == NULL) { |
1690 | cur = TAILQ_FIRST(&state_list); |
1691 | if (cur == NULL) |
1692 | break; /* list empty */ |
1693 | } |
1694 | |
1695 | /* get next state, as cur may get deleted */ |
1696 | next = TAILQ_NEXT(cur, entry_list); |
1697 | |
1698 | if (cur->timeout == PFTM_UNLINKED) { |
1699 | pf_free_state(cur); |
1700 | } else if (pf_state_expires(cur) <= pf_time_second()) { |
1701 | /* unlink and free expired state */ |
1702 | pf_unlink_state(cur); |
1703 | pf_free_state(cur); |
1704 | } |
1705 | cur = next; |
1706 | } |
1707 | } |
1708 | |
1709 | int |
1710 | pf_tbladdr_setup(struct pf_ruleset *rs, struct pf_addr_wrap *aw) |
1711 | { |
1712 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
1713 | |
1714 | if (aw->type != PF_ADDR_TABLE) |
1715 | return (0); |
1716 | if ((aw->p.tbl = pfr_attach_table(rs, aw->v.tblname)) == NULL) |
1717 | return (1); |
1718 | return (0); |
1719 | } |
1720 | |
1721 | void |
1722 | pf_tbladdr_remove(struct pf_addr_wrap *aw) |
1723 | { |
1724 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
1725 | |
1726 | if (aw->type != PF_ADDR_TABLE || aw->p.tbl == NULL) |
1727 | return; |
1728 | pfr_detach_table(aw->p.tbl); |
1729 | aw->p.tbl = NULL; |
1730 | } |
1731 | |
1732 | void |
1733 | pf_tbladdr_copyout(struct pf_addr_wrap *aw) |
1734 | { |
1735 | struct pfr_ktable *kt = aw->p.tbl; |
1736 | |
1737 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
1738 | |
1739 | if (aw->type != PF_ADDR_TABLE || kt == NULL) |
1740 | return; |
1741 | if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) |
1742 | kt = kt->pfrkt_root; |
1743 | aw->p.tbl = NULL; |
1744 | aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ? |
1745 | kt->pfrkt_cnt : -1; |
1746 | } |
1747 | |
1748 | static void |
1749 | pf_print_addr(struct pf_addr *addr, sa_family_t af) |
1750 | { |
1751 | switch (af) { |
1752 | #if INET |
1753 | case AF_INET: { |
1754 | u_int32_t a = ntohl(addr->addr32[0]); |
1755 | printf("%u.%u.%u.%u" , (a>>24)&255, (a>>16)&255, |
1756 | (a>>8)&255, a&255); |
1757 | break; |
1758 | } |
1759 | #endif /* INET */ |
1760 | #if INET6 |
1761 | case AF_INET6: { |
1762 | u_int16_t b; |
1763 | u_int8_t i, curstart = 255, curend = 0, |
1764 | maxstart = 0, maxend = 0; |
1765 | for (i = 0; i < 8; i++) { |
1766 | if (!addr->addr16[i]) { |
1767 | if (curstart == 255) |
1768 | curstart = i; |
1769 | else |
1770 | curend = i; |
1771 | } else { |
1772 | if (curstart) { |
1773 | if ((curend - curstart) > |
1774 | (maxend - maxstart)) { |
1775 | maxstart = curstart; |
1776 | maxend = curend; |
1777 | curstart = 255; |
1778 | } |
1779 | } |
1780 | } |
1781 | } |
1782 | for (i = 0; i < 8; i++) { |
1783 | if (i >= maxstart && i <= maxend) { |
1784 | if (maxend != 7) { |
1785 | if (i == maxstart) |
1786 | printf(":" ); |
1787 | } else { |
1788 | if (i == maxend) |
1789 | printf(":" ); |
1790 | } |
1791 | } else { |
1792 | b = ntohs(addr->addr16[i]); |
1793 | printf("%x" , b); |
1794 | if (i < 7) |
1795 | printf(":" ); |
1796 | } |
1797 | } |
1798 | break; |
1799 | } |
1800 | #endif /* INET6 */ |
1801 | } |
1802 | } |
1803 | |
1804 | static void |
1805 | pf_print_sk_host(struct pf_state_host *sh, sa_family_t af, int proto, |
1806 | u_int8_t proto_variant) |
1807 | { |
1808 | pf_print_addr(&sh->addr, af); |
1809 | |
1810 | switch (proto) { |
1811 | case IPPROTO_ESP: |
1812 | if (sh->xport.spi) |
1813 | printf("[%08x]" , ntohl(sh->xport.spi)); |
1814 | break; |
1815 | |
1816 | case IPPROTO_GRE: |
1817 | if (proto_variant == PF_GRE_PPTP_VARIANT) |
1818 | printf("[%u]" , ntohs(sh->xport.call_id)); |
1819 | break; |
1820 | |
1821 | case IPPROTO_TCP: |
1822 | case IPPROTO_UDP: |
1823 | printf("[%u]" , ntohs(sh->xport.port)); |
1824 | break; |
1825 | |
1826 | default: |
1827 | break; |
1828 | } |
1829 | } |
1830 | |
1831 | static void |
1832 | pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af) |
1833 | { |
1834 | pf_print_addr(addr, af); |
1835 | if (p) |
1836 | printf("[%u]" , ntohs(p)); |
1837 | } |
1838 | |
1839 | void |
1840 | pf_print_state(struct pf_state *s) |
1841 | { |
1842 | struct pf_state_key *sk = s->state_key; |
1843 | switch (sk->proto) { |
1844 | case IPPROTO_ESP: |
1845 | printf("ESP " ); |
1846 | break; |
1847 | case IPPROTO_GRE: |
1848 | printf("GRE%u " , sk->proto_variant); |
1849 | break; |
1850 | case IPPROTO_TCP: |
1851 | printf("TCP " ); |
1852 | break; |
1853 | case IPPROTO_UDP: |
1854 | printf("UDP " ); |
1855 | break; |
1856 | case IPPROTO_ICMP: |
1857 | printf("ICMP " ); |
1858 | break; |
1859 | case IPPROTO_ICMPV6: |
1860 | printf("ICMPV6 " ); |
1861 | break; |
1862 | default: |
1863 | printf("%u " , sk->proto); |
1864 | break; |
1865 | } |
1866 | pf_print_sk_host(&sk->lan, sk->af_lan, sk->proto, sk->proto_variant); |
1867 | printf(" " ); |
1868 | pf_print_sk_host(&sk->gwy, sk->af_gwy, sk->proto, sk->proto_variant); |
1869 | printf(" " ); |
1870 | pf_print_sk_host(&sk->ext_lan, sk->af_lan, sk->proto, |
1871 | sk->proto_variant); |
1872 | printf(" " ); |
1873 | pf_print_sk_host(&sk->ext_gwy, sk->af_gwy, sk->proto, |
1874 | sk->proto_variant); |
1875 | printf(" [lo=%u high=%u win=%u modulator=%u" , s->src.seqlo, |
1876 | s->src.seqhi, s->src.max_win, s->src.seqdiff); |
1877 | if (s->src.wscale && s->dst.wscale) |
1878 | printf(" wscale=%u" , s->src.wscale & PF_WSCALE_MASK); |
1879 | printf("]" ); |
1880 | printf(" [lo=%u high=%u win=%u modulator=%u" , s->dst.seqlo, |
1881 | s->dst.seqhi, s->dst.max_win, s->dst.seqdiff); |
1882 | if (s->src.wscale && s->dst.wscale) |
1883 | printf(" wscale=%u" , s->dst.wscale & PF_WSCALE_MASK); |
1884 | printf("]" ); |
1885 | printf(" %u:%u" , s->src.state, s->dst.state); |
1886 | } |
1887 | |
1888 | void |
1889 | pf_print_flags(u_int8_t f) |
1890 | { |
1891 | if (f) |
1892 | printf(" " ); |
1893 | if (f & TH_FIN) |
1894 | printf("F" ); |
1895 | if (f & TH_SYN) |
1896 | printf("S" ); |
1897 | if (f & TH_RST) |
1898 | printf("R" ); |
1899 | if (f & TH_PUSH) |
1900 | printf("P" ); |
1901 | if (f & TH_ACK) |
1902 | printf("A" ); |
1903 | if (f & TH_URG) |
1904 | printf("U" ); |
1905 | if (f & TH_ECE) |
1906 | printf("E" ); |
1907 | if (f & TH_CWR) |
1908 | printf("W" ); |
1909 | } |
1910 | |
1911 | #define PF_SET_SKIP_STEPS(i) \ |
1912 | do { \ |
1913 | while (head[i] != cur) { \ |
1914 | head[i]->skip[i].ptr = cur; \ |
1915 | head[i] = TAILQ_NEXT(head[i], entries); \ |
1916 | } \ |
1917 | } while (0) |
1918 | |
1919 | void |
1920 | pf_calc_skip_steps(struct pf_rulequeue *rules) |
1921 | { |
1922 | struct pf_rule *cur, *prev, *head[PF_SKIP_COUNT]; |
1923 | int i; |
1924 | |
1925 | cur = TAILQ_FIRST(rules); |
1926 | prev = cur; |
1927 | for (i = 0; i < PF_SKIP_COUNT; ++i) |
1928 | head[i] = cur; |
1929 | while (cur != NULL) { |
1930 | |
1931 | if (cur->kif != prev->kif || cur->ifnot != prev->ifnot) |
1932 | PF_SET_SKIP_STEPS(PF_SKIP_IFP); |
1933 | if (cur->direction != prev->direction) |
1934 | PF_SET_SKIP_STEPS(PF_SKIP_DIR); |
1935 | if (cur->af != prev->af) |
1936 | PF_SET_SKIP_STEPS(PF_SKIP_AF); |
1937 | if (cur->proto != prev->proto) |
1938 | PF_SET_SKIP_STEPS(PF_SKIP_PROTO); |
1939 | if (cur->src.neg != prev->src.neg || |
1940 | pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr)) |
1941 | PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR); |
1942 | { |
1943 | union pf_rule_xport *cx = &cur->src.xport; |
1944 | union pf_rule_xport *px = &prev->src.xport; |
1945 | |
1946 | switch (cur->proto) { |
1947 | case IPPROTO_GRE: |
1948 | case IPPROTO_ESP: |
1949 | PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT); |
1950 | break; |
1951 | default: |
1952 | if (prev->proto == IPPROTO_GRE || |
1953 | prev->proto == IPPROTO_ESP || |
1954 | cx->range.op != px->range.op || |
1955 | cx->range.port[0] != px->range.port[0] || |
1956 | cx->range.port[1] != px->range.port[1]) |
1957 | PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT); |
1958 | break; |
1959 | } |
1960 | } |
1961 | if (cur->dst.neg != prev->dst.neg || |
1962 | pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr)) |
1963 | PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR); |
1964 | { |
1965 | union pf_rule_xport *cx = &cur->dst.xport; |
1966 | union pf_rule_xport *px = &prev->dst.xport; |
1967 | |
1968 | switch (cur->proto) { |
1969 | case IPPROTO_GRE: |
1970 | if (cur->proto != prev->proto || |
1971 | cx->call_id != px->call_id) |
1972 | PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT); |
1973 | break; |
1974 | case IPPROTO_ESP: |
1975 | if (cur->proto != prev->proto || |
1976 | cx->spi != px->spi) |
1977 | PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT); |
1978 | break; |
1979 | default: |
1980 | if (prev->proto == IPPROTO_GRE || |
1981 | prev->proto == IPPROTO_ESP || |
1982 | cx->range.op != px->range.op || |
1983 | cx->range.port[0] != px->range.port[0] || |
1984 | cx->range.port[1] != px->range.port[1]) |
1985 | PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT); |
1986 | break; |
1987 | } |
1988 | } |
1989 | |
1990 | prev = cur; |
1991 | cur = TAILQ_NEXT(cur, entries); |
1992 | } |
1993 | for (i = 0; i < PF_SKIP_COUNT; ++i) |
1994 | PF_SET_SKIP_STEPS(i); |
1995 | } |
1996 | |
1997 | u_int32_t |
1998 | pf_calc_state_key_flowhash(struct pf_state_key *sk) |
1999 | { |
2000 | struct pf_flowhash_key fh __attribute__((aligned(8))); |
2001 | uint32_t flowhash = 0; |
2002 | |
2003 | bzero(&fh, sizeof (fh)); |
2004 | if (PF_ALEQ(&sk->lan.addr, &sk->ext_lan.addr, sk->af_lan)) { |
2005 | bcopy(&sk->lan.addr, &fh.ap1.addr, sizeof (fh.ap1.addr)); |
2006 | bcopy(&sk->ext_lan.addr, &fh.ap2.addr, sizeof (fh.ap2.addr)); |
2007 | } else { |
2008 | bcopy(&sk->ext_lan.addr, &fh.ap1.addr, sizeof (fh.ap1.addr)); |
2009 | bcopy(&sk->lan.addr, &fh.ap2.addr, sizeof (fh.ap2.addr)); |
2010 | } |
2011 | if (sk->lan.xport.spi <= sk->ext_lan.xport.spi) { |
2012 | fh.ap1.xport.spi = sk->lan.xport.spi; |
2013 | fh.ap2.xport.spi = sk->ext_lan.xport.spi; |
2014 | } else { |
2015 | fh.ap1.xport.spi = sk->ext_lan.xport.spi; |
2016 | fh.ap2.xport.spi = sk->lan.xport.spi; |
2017 | } |
2018 | fh.af = sk->af_lan; |
2019 | fh.proto = sk->proto; |
2020 | |
2021 | try_again: |
2022 | flowhash = net_flowhash(&fh, sizeof (fh), pf_hash_seed); |
2023 | if (flowhash == 0) { |
2024 | /* try to get a non-zero flowhash */ |
2025 | pf_hash_seed = RandomULong(); |
2026 | goto try_again; |
2027 | } |
2028 | |
2029 | return (flowhash); |
2030 | } |
2031 | |
2032 | static int |
2033 | pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2) |
2034 | { |
2035 | if (aw1->type != aw2->type) |
2036 | return (1); |
2037 | switch (aw1->type) { |
2038 | case PF_ADDR_ADDRMASK: |
2039 | case PF_ADDR_RANGE: |
2040 | if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, 0)) |
2041 | return (1); |
2042 | if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, 0)) |
2043 | return (1); |
2044 | return (0); |
2045 | case PF_ADDR_DYNIFTL: |
2046 | return (aw1->p.dyn == NULL || aw2->p.dyn == NULL || |
2047 | aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt); |
2048 | case PF_ADDR_NOROUTE: |
2049 | case PF_ADDR_URPFFAILED: |
2050 | return (0); |
2051 | case PF_ADDR_TABLE: |
2052 | return (aw1->p.tbl != aw2->p.tbl); |
2053 | case PF_ADDR_RTLABEL: |
2054 | return (aw1->v.rtlabel != aw2->v.rtlabel); |
2055 | default: |
2056 | printf("invalid address type: %d\n" , aw1->type); |
2057 | return (1); |
2058 | } |
2059 | } |
2060 | |
2061 | u_int16_t |
2062 | pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp) |
2063 | { |
2064 | return (nat464_cksum_fixup(cksum, old, new, udp)); |
2065 | } |
2066 | |
2067 | /* |
2068 | * change ip address & port |
2069 | * dir : packet direction |
2070 | * a : address to be changed |
2071 | * p : port to be changed |
2072 | * ic : ip header checksum |
2073 | * pc : protocol checksum |
2074 | * an : new ip address |
2075 | * pn : new port |
2076 | * u : should be 1 if UDP packet else 0 |
2077 | * af : address family of the packet |
2078 | * afn : address family of the new address |
2079 | * ua : should be 1 if ip address needs to be updated in the packet else |
2080 | * only the checksum is recalculated & updated. |
2081 | */ |
2082 | static void |
2083 | pf_change_ap(int dir, pbuf_t *pbuf, struct pf_addr *a, u_int16_t *p, |
2084 | u_int16_t *ic, u_int16_t *pc, struct pf_addr *an, u_int16_t pn, |
2085 | u_int8_t u, sa_family_t af, sa_family_t afn, int ua) |
2086 | { |
2087 | struct pf_addr ao; |
2088 | u_int16_t po = *p; |
2089 | |
2090 | PF_ACPY(&ao, a, af); |
2091 | if (ua) |
2092 | PF_ACPY(a, an, afn); |
2093 | |
2094 | *p = pn; |
2095 | |
2096 | switch (af) { |
2097 | #if INET |
2098 | case AF_INET: |
2099 | switch (afn) { |
2100 | case AF_INET: |
2101 | *ic = pf_cksum_fixup(pf_cksum_fixup(*ic, |
2102 | ao.addr16[0], an->addr16[0], 0), |
2103 | ao.addr16[1], an->addr16[1], 0); |
2104 | *p = pn; |
2105 | /* |
2106 | * If the packet is originated from an ALG on the NAT gateway |
2107 | * (source address is loopback or local), in which case the |
2108 | * TCP/UDP checksum field contains the pseudo header checksum |
2109 | * that's not yet complemented. |
2110 | * In that case we do not need to fixup the checksum for port |
2111 | * translation as the pseudo header checksum doesn't include ports. |
2112 | * |
2113 | * A packet generated locally will have UDP/TCP CSUM flag |
2114 | * set (gets set in protocol output). |
2115 | * |
2116 | * It should be noted that the fixup doesn't do anything if the |
2117 | * checksum is 0. |
2118 | */ |
2119 | if (dir == PF_OUT && pbuf != NULL && |
2120 | (*pbuf->pb_csum_flags & (CSUM_TCP | CSUM_UDP))) { |
2121 | /* Pseudo-header checksum does not include ports */ |
2122 | *pc = ~pf_cksum_fixup(pf_cksum_fixup(~*pc, |
2123 | ao.addr16[0], an->addr16[0], u), |
2124 | ao.addr16[1], an->addr16[1], u); |
2125 | } else { |
2126 | *pc = |
2127 | pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2128 | *pc, ao.addr16[0], an->addr16[0], u), |
2129 | ao.addr16[1], an->addr16[1], u), |
2130 | po, pn, u); |
2131 | } |
2132 | break; |
2133 | #ifdef INET6 |
2134 | case AF_INET6: |
2135 | *p = pn; |
2136 | *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2137 | pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2138 | |
2139 | pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc, |
2140 | ao.addr16[0], an->addr16[0], u), |
2141 | ao.addr16[1], an->addr16[1], u), |
2142 | 0, an->addr16[2], u), |
2143 | 0, an->addr16[3], u), |
2144 | 0, an->addr16[4], u), |
2145 | 0, an->addr16[5], u), |
2146 | 0, an->addr16[6], u), |
2147 | 0, an->addr16[7], u), |
2148 | po, pn, u); |
2149 | break; |
2150 | #endif /* INET6 */ |
2151 | } |
2152 | break; |
2153 | #endif /* INET */ |
2154 | #if INET6 |
2155 | case AF_INET6: |
2156 | switch (afn) { |
2157 | case AF_INET6: |
2158 | /* |
2159 | * If the packet is originated from an ALG on the NAT gateway |
2160 | * (source address is loopback or local), in which case the |
2161 | * TCP/UDP checksum field contains the pseudo header checksum |
2162 | * that's not yet complemented. |
2163 | * A packet generated locally |
2164 | * will have UDP/TCP CSUM flag set (gets set in protocol |
2165 | * output). |
2166 | */ |
2167 | if (dir == PF_OUT && pbuf != NULL && |
2168 | (*pbuf->pb_csum_flags & (CSUM_TCPIPV6 | |
2169 | CSUM_UDPIPV6))) { |
2170 | /* Pseudo-header checksum does not include ports */ |
2171 | *pc = |
2172 | ~pf_cksum_fixup(pf_cksum_fixup( |
2173 | pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2174 | pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2175 | ~*pc, |
2176 | ao.addr16[0], an->addr16[0], u), |
2177 | ao.addr16[1], an->addr16[1], u), |
2178 | ao.addr16[2], an->addr16[2], u), |
2179 | ao.addr16[3], an->addr16[3], u), |
2180 | ao.addr16[4], an->addr16[4], u), |
2181 | ao.addr16[5], an->addr16[5], u), |
2182 | ao.addr16[6], an->addr16[6], u), |
2183 | ao.addr16[7], an->addr16[7], u); |
2184 | } else { |
2185 | *pc = |
2186 | pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2187 | pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2188 | pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2189 | *pc, |
2190 | ao.addr16[0], an->addr16[0], u), |
2191 | ao.addr16[1], an->addr16[1], u), |
2192 | ao.addr16[2], an->addr16[2], u), |
2193 | ao.addr16[3], an->addr16[3], u), |
2194 | ao.addr16[4], an->addr16[4], u), |
2195 | ao.addr16[5], an->addr16[5], u), |
2196 | ao.addr16[6], an->addr16[6], u), |
2197 | ao.addr16[7], an->addr16[7], u), |
2198 | po, pn, u); |
2199 | } |
2200 | break; |
2201 | #ifdef INET |
2202 | case AF_INET: |
2203 | *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2204 | pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2205 | pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc, |
2206 | ao.addr16[0], an->addr16[0], u), |
2207 | ao.addr16[1], an->addr16[1], u), |
2208 | ao.addr16[2], 0, u), |
2209 | ao.addr16[3], 0, u), |
2210 | ao.addr16[4], 0, u), |
2211 | ao.addr16[5], 0, u), |
2212 | ao.addr16[6], 0, u), |
2213 | ao.addr16[7], 0, u), |
2214 | po, pn, u); |
2215 | break; |
2216 | #endif /* INET */ |
2217 | } |
2218 | break; |
2219 | #endif /* INET6 */ |
2220 | } |
2221 | } |
2222 | |
2223 | |
2224 | /* Changes a u_int32_t. Uses a void * so there are no align restrictions */ |
2225 | void |
2226 | pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u) |
2227 | { |
2228 | u_int32_t ao; |
2229 | |
2230 | memcpy(&ao, a, sizeof (ao)); |
2231 | memcpy(a, &an, sizeof (u_int32_t)); |
2232 | *c = pf_cksum_fixup(pf_cksum_fixup(*c, ao / 65536, an / 65536, u), |
2233 | ao % 65536, an % 65536, u); |
2234 | } |
2235 | |
2236 | #if INET6 |
2237 | static void |
2238 | pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u) |
2239 | { |
2240 | struct pf_addr ao; |
2241 | |
2242 | PF_ACPY(&ao, a, AF_INET6); |
2243 | PF_ACPY(a, an, AF_INET6); |
2244 | |
2245 | *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2246 | pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2247 | pf_cksum_fixup(pf_cksum_fixup(*c, |
2248 | ao.addr16[0], an->addr16[0], u), |
2249 | ao.addr16[1], an->addr16[1], u), |
2250 | ao.addr16[2], an->addr16[2], u), |
2251 | ao.addr16[3], an->addr16[3], u), |
2252 | ao.addr16[4], an->addr16[4], u), |
2253 | ao.addr16[5], an->addr16[5], u), |
2254 | ao.addr16[6], an->addr16[6], u), |
2255 | ao.addr16[7], an->addr16[7], u); |
2256 | } |
2257 | |
2258 | void |
2259 | pf_change_addr(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u, |
2260 | sa_family_t af, sa_family_t afn) |
2261 | { |
2262 | struct pf_addr ao; |
2263 | |
2264 | PF_ACPY(&ao, a, af); |
2265 | PF_ACPY(a, an, afn); |
2266 | |
2267 | switch (af) { |
2268 | case AF_INET: |
2269 | switch (afn) { |
2270 | case AF_INET: |
2271 | pf_change_a(a, c, an->v4addr.s_addr, u); |
2272 | break; |
2273 | case AF_INET6: |
2274 | *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2275 | pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2276 | pf_cksum_fixup(pf_cksum_fixup(*c, |
2277 | ao.addr16[0], an->addr16[0], u), |
2278 | ao.addr16[1], an->addr16[1], u), |
2279 | 0, an->addr16[2], u), |
2280 | 0, an->addr16[3], u), |
2281 | 0, an->addr16[4], u), |
2282 | 0, an->addr16[5], u), |
2283 | 0, an->addr16[6], u), |
2284 | 0, an->addr16[7], u); |
2285 | break; |
2286 | } |
2287 | break; |
2288 | case AF_INET6: |
2289 | switch (afn) { |
2290 | case AF_INET: |
2291 | *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2292 | pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2293 | pf_cksum_fixup(pf_cksum_fixup(*c, |
2294 | ao.addr16[0], an->addr16[0], u), |
2295 | ao.addr16[1], an->addr16[1], u), |
2296 | ao.addr16[2], 0, u), |
2297 | ao.addr16[3], 0, u), |
2298 | ao.addr16[4], 0, u), |
2299 | ao.addr16[5], 0, u), |
2300 | ao.addr16[6], 0, u), |
2301 | ao.addr16[7], 0, u); |
2302 | break; |
2303 | case AF_INET6: |
2304 | pf_change_a6(a, c, an, u); |
2305 | break; |
2306 | } |
2307 | break; |
2308 | } |
2309 | } |
2310 | |
2311 | #endif /* INET6 */ |
2312 | |
2313 | static void |
2314 | pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa, |
2315 | struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c, |
2316 | u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af) |
2317 | { |
2318 | struct pf_addr oia, ooa; |
2319 | |
2320 | PF_ACPY(&oia, ia, af); |
2321 | PF_ACPY(&ooa, oa, af); |
2322 | |
2323 | /* Change inner protocol port, fix inner protocol checksum. */ |
2324 | if (ip != NULL) { |
2325 | u_int16_t oip = *ip; |
2326 | u_int32_t opc = 0; |
2327 | |
2328 | if (pc != NULL) |
2329 | opc = *pc; |
2330 | *ip = np; |
2331 | if (pc != NULL) |
2332 | *pc = pf_cksum_fixup(*pc, oip, *ip, u); |
2333 | *ic = pf_cksum_fixup(*ic, oip, *ip, 0); |
2334 | if (pc != NULL) |
2335 | *ic = pf_cksum_fixup(*ic, opc, *pc, 0); |
2336 | } |
2337 | /* Change inner ip address, fix inner ip and icmp checksums. */ |
2338 | PF_ACPY(ia, na, af); |
2339 | switch (af) { |
2340 | #if INET |
2341 | case AF_INET: { |
2342 | u_int32_t oh2c = *h2c; |
2343 | |
2344 | *h2c = pf_cksum_fixup(pf_cksum_fixup(*h2c, |
2345 | oia.addr16[0], ia->addr16[0], 0), |
2346 | oia.addr16[1], ia->addr16[1], 0); |
2347 | *ic = pf_cksum_fixup(pf_cksum_fixup(*ic, |
2348 | oia.addr16[0], ia->addr16[0], 0), |
2349 | oia.addr16[1], ia->addr16[1], 0); |
2350 | *ic = pf_cksum_fixup(*ic, oh2c, *h2c, 0); |
2351 | break; |
2352 | } |
2353 | #endif /* INET */ |
2354 | #if INET6 |
2355 | case AF_INET6: |
2356 | *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2357 | pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2358 | pf_cksum_fixup(pf_cksum_fixup(*ic, |
2359 | oia.addr16[0], ia->addr16[0], u), |
2360 | oia.addr16[1], ia->addr16[1], u), |
2361 | oia.addr16[2], ia->addr16[2], u), |
2362 | oia.addr16[3], ia->addr16[3], u), |
2363 | oia.addr16[4], ia->addr16[4], u), |
2364 | oia.addr16[5], ia->addr16[5], u), |
2365 | oia.addr16[6], ia->addr16[6], u), |
2366 | oia.addr16[7], ia->addr16[7], u); |
2367 | break; |
2368 | #endif /* INET6 */ |
2369 | } |
2370 | /* Change outer ip address, fix outer ip or icmpv6 checksum. */ |
2371 | PF_ACPY(oa, na, af); |
2372 | switch (af) { |
2373 | #if INET |
2374 | case AF_INET: |
2375 | *hc = pf_cksum_fixup(pf_cksum_fixup(*hc, |
2376 | ooa.addr16[0], oa->addr16[0], 0), |
2377 | ooa.addr16[1], oa->addr16[1], 0); |
2378 | break; |
2379 | #endif /* INET */ |
2380 | #if INET6 |
2381 | case AF_INET6: |
2382 | *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2383 | pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( |
2384 | pf_cksum_fixup(pf_cksum_fixup(*ic, |
2385 | ooa.addr16[0], oa->addr16[0], u), |
2386 | ooa.addr16[1], oa->addr16[1], u), |
2387 | ooa.addr16[2], oa->addr16[2], u), |
2388 | ooa.addr16[3], oa->addr16[3], u), |
2389 | ooa.addr16[4], oa->addr16[4], u), |
2390 | ooa.addr16[5], oa->addr16[5], u), |
2391 | ooa.addr16[6], oa->addr16[6], u), |
2392 | ooa.addr16[7], oa->addr16[7], u); |
2393 | break; |
2394 | #endif /* INET6 */ |
2395 | } |
2396 | } |
2397 | |
2398 | |
2399 | /* |
2400 | * Need to modulate the sequence numbers in the TCP SACK option |
2401 | * (credits to Krzysztof Pfaff for report and patch) |
2402 | */ |
2403 | static int |
2404 | pf_modulate_sack(pbuf_t *pbuf, int off, struct pf_pdesc *pd, |
2405 | struct tcphdr *th, struct pf_state_peer *dst) |
2406 | { |
2407 | int hlen = (th->th_off << 2) - sizeof (*th), thoptlen = hlen; |
2408 | u_int8_t opts[MAX_TCPOPTLEN], *opt = opts; |
2409 | int copyback = 0, i, olen; |
2410 | struct sackblk sack; |
2411 | |
2412 | #define TCPOLEN_SACKLEN (TCPOLEN_SACK + 2) |
2413 | if (hlen < TCPOLEN_SACKLEN || |
2414 | !pf_pull_hdr(pbuf, off + sizeof (*th), opts, hlen, NULL, NULL, pd->af)) |
2415 | return (0); |
2416 | |
2417 | while (hlen >= TCPOLEN_SACKLEN) { |
2418 | olen = opt[1]; |
2419 | switch (*opt) { |
2420 | case TCPOPT_EOL: /* FALLTHROUGH */ |
2421 | case TCPOPT_NOP: |
2422 | opt++; |
2423 | hlen--; |
2424 | break; |
2425 | case TCPOPT_SACK: |
2426 | if (olen > hlen) |
2427 | olen = hlen; |
2428 | if (olen >= TCPOLEN_SACKLEN) { |
2429 | for (i = 2; i + TCPOLEN_SACK <= olen; |
2430 | i += TCPOLEN_SACK) { |
2431 | memcpy(&sack, &opt[i], sizeof (sack)); |
2432 | pf_change_a(&sack.start, &th->th_sum, |
2433 | htonl(ntohl(sack.start) - |
2434 | dst->seqdiff), 0); |
2435 | pf_change_a(&sack.end, &th->th_sum, |
2436 | htonl(ntohl(sack.end) - |
2437 | dst->seqdiff), 0); |
2438 | memcpy(&opt[i], &sack, sizeof (sack)); |
2439 | } |
2440 | copyback = off + sizeof (*th) + thoptlen; |
2441 | } |
2442 | /* FALLTHROUGH */ |
2443 | default: |
2444 | if (olen < 2) |
2445 | olen = 2; |
2446 | hlen -= olen; |
2447 | opt += olen; |
2448 | } |
2449 | } |
2450 | |
2451 | if (copyback) { |
2452 | if (pf_lazy_makewritable(pd, pbuf, copyback) == NULL) |
2453 | return (-1); |
2454 | pbuf_copy_back(pbuf, off + sizeof (*th), thoptlen, opts); |
2455 | } |
2456 | return (copyback); |
2457 | } |
2458 | |
2459 | /* |
2460 | * XXX |
2461 | * |
2462 | * The following functions (pf_send_tcp and pf_send_icmp) are somewhat |
2463 | * special in that they originate "spurious" packets rather than |
2464 | * filter/NAT existing packets. As such, they're not a great fit for |
2465 | * the 'pbuf' shim, which assumes the underlying packet buffers are |
2466 | * allocated elsewhere. |
2467 | * |
2468 | * Since these functions are rarely used, we'll carry on allocating mbufs |
2469 | * and passing them to the IP stack for eventual routing. |
2470 | */ |
2471 | static void |
2472 | pf_send_tcp(const struct pf_rule *r, sa_family_t af, |
2473 | const struct pf_addr *saddr, const struct pf_addr *daddr, |
2474 | u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack, |
2475 | u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl, int tag, |
2476 | u_int16_t rtag, struct ether_header *eh, struct ifnet *ifp) |
2477 | { |
2478 | #pragma unused(eh, ifp) |
2479 | struct mbuf *m; |
2480 | int len, tlen; |
2481 | #if INET |
2482 | struct ip *h = NULL; |
2483 | #endif /* INET */ |
2484 | #if INET6 |
2485 | struct ip6_hdr *h6 = NULL; |
2486 | #endif /* INET6 */ |
2487 | struct tcphdr *th = NULL; |
2488 | char *opt; |
2489 | struct pf_mtag *pf_mtag; |
2490 | |
2491 | /* maximum segment size tcp option */ |
2492 | tlen = sizeof (struct tcphdr); |
2493 | if (mss) |
2494 | tlen += 4; |
2495 | |
2496 | switch (af) { |
2497 | #if INET |
2498 | case AF_INET: |
2499 | len = sizeof (struct ip) + tlen; |
2500 | break; |
2501 | #endif /* INET */ |
2502 | #if INET6 |
2503 | case AF_INET6: |
2504 | len = sizeof (struct ip6_hdr) + tlen; |
2505 | break; |
2506 | #endif /* INET6 */ |
2507 | default: |
2508 | panic("pf_send_tcp: not AF_INET or AF_INET6!" ); |
2509 | return; |
2510 | } |
2511 | |
2512 | /* create outgoing mbuf */ |
2513 | m = m_gethdr(M_DONTWAIT, MT_HEADER); |
2514 | if (m == NULL) |
2515 | return; |
2516 | |
2517 | if ((pf_mtag = pf_get_mtag(m)) == NULL) |
2518 | return; |
2519 | |
2520 | if (tag) |
2521 | pf_mtag->pftag_flags |= PF_TAG_GENERATED; |
2522 | pf_mtag->pftag_tag = rtag; |
2523 | |
2524 | if (r != NULL && PF_RTABLEID_IS_VALID(r->rtableid)) |
2525 | pf_mtag->pftag_rtableid = r->rtableid; |
2526 | |
2527 | #if PF_ECN |
2528 | /* add hints for ecn */ |
2529 | pf_mtag->pftag_hdr = mtod(m, struct ip *); |
2530 | /* record address family */ |
2531 | pf_mtag->pftag_flags &= ~(PF_TAG_HDR_INET | PF_TAG_HDR_INET6); |
2532 | switch (af) { |
2533 | #if INET |
2534 | case AF_INET: |
2535 | pf_mtag->pftag_flags |= PF_TAG_HDR_INET; |
2536 | break; |
2537 | #endif /* INET */ |
2538 | #if INET6 |
2539 | case AF_INET6: |
2540 | pf_mtag->pftag_flags |= PF_TAG_HDR_INET6; |
2541 | break; |
2542 | #endif /* INET6 */ |
2543 | } |
2544 | #endif /* PF_ECN */ |
2545 | |
2546 | /* indicate this is TCP */ |
2547 | m->m_pkthdr.pkt_proto = IPPROTO_TCP; |
2548 | |
2549 | /* Make sure headers are 32-bit aligned */ |
2550 | m->m_data += max_linkhdr; |
2551 | m->m_pkthdr.len = m->m_len = len; |
2552 | m->m_pkthdr.rcvif = NULL; |
2553 | bzero(m->m_data, len); |
2554 | switch (af) { |
2555 | #if INET |
2556 | case AF_INET: |
2557 | h = mtod(m, struct ip *); |
2558 | |
2559 | /* IP header fields included in the TCP checksum */ |
2560 | h->ip_p = IPPROTO_TCP; |
2561 | h->ip_len = htons(tlen); |
2562 | h->ip_src.s_addr = saddr->v4addr.s_addr; |
2563 | h->ip_dst.s_addr = daddr->v4addr.s_addr; |
2564 | |
2565 | th = (struct tcphdr *)(void *)((caddr_t)h + sizeof (struct ip)); |
2566 | break; |
2567 | #endif /* INET */ |
2568 | #if INET6 |
2569 | case AF_INET6: |
2570 | h6 = mtod(m, struct ip6_hdr *); |
2571 | |
2572 | /* IP header fields included in the TCP checksum */ |
2573 | h6->ip6_nxt = IPPROTO_TCP; |
2574 | h6->ip6_plen = htons(tlen); |
2575 | memcpy(&h6->ip6_src, &saddr->v6addr, sizeof (struct in6_addr)); |
2576 | memcpy(&h6->ip6_dst, &daddr->v6addr, sizeof (struct in6_addr)); |
2577 | |
2578 | th = (struct tcphdr *)(void *) |
2579 | ((caddr_t)h6 + sizeof (struct ip6_hdr)); |
2580 | break; |
2581 | #endif /* INET6 */ |
2582 | } |
2583 | |
2584 | /* TCP header */ |
2585 | th->th_sport = sport; |
2586 | th->th_dport = dport; |
2587 | th->th_seq = htonl(seq); |
2588 | th->th_ack = htonl(ack); |
2589 | th->th_off = tlen >> 2; |
2590 | th->th_flags = flags; |
2591 | th->th_win = htons(win); |
2592 | |
2593 | if (mss) { |
2594 | opt = (char *)(th + 1); |
2595 | opt[0] = TCPOPT_MAXSEG; |
2596 | opt[1] = 4; |
2597 | #if BYTE_ORDER != BIG_ENDIAN |
2598 | HTONS(mss); |
2599 | #endif |
2600 | bcopy((caddr_t)&mss, (caddr_t)(opt + 2), 2); |
2601 | } |
2602 | |
2603 | switch (af) { |
2604 | #if INET |
2605 | case AF_INET: { |
2606 | struct route ro; |
2607 | |
2608 | /* TCP checksum */ |
2609 | th->th_sum = in_cksum(m, len); |
2610 | |
2611 | /* Finish the IP header */ |
2612 | h->ip_v = 4; |
2613 | h->ip_hl = sizeof (*h) >> 2; |
2614 | h->ip_tos = IPTOS_LOWDELAY; |
2615 | /* |
2616 | * ip_output() expects ip_len and ip_off to be in host order. |
2617 | */ |
2618 | h->ip_len = len; |
2619 | h->ip_off = (path_mtu_discovery ? IP_DF : 0); |
2620 | h->ip_ttl = ttl ? ttl : ip_defttl; |
2621 | h->ip_sum = 0; |
2622 | |
2623 | bzero(&ro, sizeof (ro)); |
2624 | ip_output(m, NULL, &ro, 0, NULL, NULL); |
2625 | ROUTE_RELEASE(&ro); |
2626 | break; |
2627 | } |
2628 | #endif /* INET */ |
2629 | #if INET6 |
2630 | case AF_INET6: { |
2631 | struct route_in6 ro6; |
2632 | |
2633 | /* TCP checksum */ |
2634 | th->th_sum = in6_cksum(m, IPPROTO_TCP, |
2635 | sizeof (struct ip6_hdr), tlen); |
2636 | |
2637 | h6->ip6_vfc |= IPV6_VERSION; |
2638 | h6->ip6_hlim = IPV6_DEFHLIM; |
2639 | |
2640 | bzero(&ro6, sizeof (ro6)); |
2641 | ip6_output(m, NULL, &ro6, 0, NULL, NULL, NULL); |
2642 | ROUTE_RELEASE(&ro6); |
2643 | break; |
2644 | } |
2645 | #endif /* INET6 */ |
2646 | } |
2647 | } |
2648 | |
2649 | static void |
2650 | pf_send_icmp(pbuf_t *pbuf, u_int8_t type, u_int8_t code, sa_family_t af, |
2651 | struct pf_rule *r) |
2652 | { |
2653 | struct mbuf *m0; |
2654 | struct pf_mtag *pf_mtag; |
2655 | |
2656 | m0 = pbuf_clone_to_mbuf(pbuf); |
2657 | if (m0 == NULL) |
2658 | return; |
2659 | |
2660 | if ((pf_mtag = pf_get_mtag(m0)) == NULL) |
2661 | return; |
2662 | |
2663 | pf_mtag->pftag_flags |= PF_TAG_GENERATED; |
2664 | |
2665 | if (PF_RTABLEID_IS_VALID(r->rtableid)) |
2666 | pf_mtag->pftag_rtableid = r->rtableid; |
2667 | |
2668 | #if PF_ECN |
2669 | /* add hints for ecn */ |
2670 | pf_mtag->pftag_hdr = mtod(m0, struct ip *); |
2671 | /* record address family */ |
2672 | pf_mtag->pftag_flags &= ~(PF_TAG_HDR_INET | PF_TAG_HDR_INET6); |
2673 | switch (af) { |
2674 | #if INET |
2675 | case AF_INET: |
2676 | pf_mtag->pftag_flags |= PF_TAG_HDR_INET; |
2677 | m0->m_pkthdr.pkt_proto = IPPROTO_ICMP; |
2678 | break; |
2679 | #endif /* INET */ |
2680 | #if INET6 |
2681 | case AF_INET6: |
2682 | pf_mtag->pftag_flags |= PF_TAG_HDR_INET6; |
2683 | m0->m_pkthdr.pkt_proto = IPPROTO_ICMPV6; |
2684 | break; |
2685 | #endif /* INET6 */ |
2686 | } |
2687 | #endif /* PF_ECN */ |
2688 | |
2689 | switch (af) { |
2690 | #if INET |
2691 | case AF_INET: |
2692 | icmp_error(m0, type, code, 0, 0); |
2693 | break; |
2694 | #endif /* INET */ |
2695 | #if INET6 |
2696 | case AF_INET6: |
2697 | icmp6_error(m0, type, code, 0); |
2698 | break; |
2699 | #endif /* INET6 */ |
2700 | } |
2701 | } |
2702 | |
2703 | /* |
2704 | * Return 1 if the addresses a and b match (with mask m), otherwise return 0. |
2705 | * If n is 0, they match if they are equal. If n is != 0, they match if they |
2706 | * are different. |
2707 | */ |
2708 | int |
2709 | pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m, |
2710 | struct pf_addr *b, sa_family_t af) |
2711 | { |
2712 | int match = 0; |
2713 | |
2714 | switch (af) { |
2715 | #if INET |
2716 | case AF_INET: |
2717 | if ((a->addr32[0] & m->addr32[0]) == |
2718 | (b->addr32[0] & m->addr32[0])) |
2719 | match++; |
2720 | break; |
2721 | #endif /* INET */ |
2722 | #if INET6 |
2723 | case AF_INET6: |
2724 | if (((a->addr32[0] & m->addr32[0]) == |
2725 | (b->addr32[0] & m->addr32[0])) && |
2726 | ((a->addr32[1] & m->addr32[1]) == |
2727 | (b->addr32[1] & m->addr32[1])) && |
2728 | ((a->addr32[2] & m->addr32[2]) == |
2729 | (b->addr32[2] & m->addr32[2])) && |
2730 | ((a->addr32[3] & m->addr32[3]) == |
2731 | (b->addr32[3] & m->addr32[3]))) |
2732 | match++; |
2733 | break; |
2734 | #endif /* INET6 */ |
2735 | } |
2736 | if (match) { |
2737 | if (n) |
2738 | return (0); |
2739 | else |
2740 | return (1); |
2741 | } else { |
2742 | if (n) |
2743 | return (1); |
2744 | else |
2745 | return (0); |
2746 | } |
2747 | } |
2748 | |
2749 | /* |
2750 | * Return 1 if b <= a <= e, otherwise return 0. |
2751 | */ |
2752 | int |
2753 | pf_match_addr_range(struct pf_addr *b, struct pf_addr *e, |
2754 | struct pf_addr *a, sa_family_t af) |
2755 | { |
2756 | switch (af) { |
2757 | #if INET |
2758 | case AF_INET: |
2759 | if ((a->addr32[0] < b->addr32[0]) || |
2760 | (a->addr32[0] > e->addr32[0])) |
2761 | return (0); |
2762 | break; |
2763 | #endif /* INET */ |
2764 | #if INET6 |
2765 | case AF_INET6: { |
2766 | int i; |
2767 | |
2768 | /* check a >= b */ |
2769 | for (i = 0; i < 4; ++i) |
2770 | if (a->addr32[i] > b->addr32[i]) |
2771 | break; |
2772 | else if (a->addr32[i] < b->addr32[i]) |
2773 | return (0); |
2774 | /* check a <= e */ |
2775 | for (i = 0; i < 4; ++i) |
2776 | if (a->addr32[i] < e->addr32[i]) |
2777 | break; |
2778 | else if (a->addr32[i] > e->addr32[i]) |
2779 | return (0); |
2780 | break; |
2781 | } |
2782 | #endif /* INET6 */ |
2783 | } |
2784 | return (1); |
2785 | } |
2786 | |
2787 | int |
2788 | pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p) |
2789 | { |
2790 | switch (op) { |
2791 | case PF_OP_IRG: |
2792 | return ((p > a1) && (p < a2)); |
2793 | case PF_OP_XRG: |
2794 | return ((p < a1) || (p > a2)); |
2795 | case PF_OP_RRG: |
2796 | return ((p >= a1) && (p <= a2)); |
2797 | case PF_OP_EQ: |
2798 | return (p == a1); |
2799 | case PF_OP_NE: |
2800 | return (p != a1); |
2801 | case PF_OP_LT: |
2802 | return (p < a1); |
2803 | case PF_OP_LE: |
2804 | return (p <= a1); |
2805 | case PF_OP_GT: |
2806 | return (p > a1); |
2807 | case PF_OP_GE: |
2808 | return (p >= a1); |
2809 | } |
2810 | return (0); /* never reached */ |
2811 | } |
2812 | |
2813 | int |
2814 | pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p) |
2815 | { |
2816 | #if BYTE_ORDER != BIG_ENDIAN |
2817 | NTOHS(a1); |
2818 | NTOHS(a2); |
2819 | NTOHS(p); |
2820 | #endif |
2821 | return (pf_match(op, a1, a2, p)); |
2822 | } |
2823 | |
2824 | int |
2825 | pf_match_xport(u_int8_t proto, u_int8_t proto_variant, union pf_rule_xport *rx, |
2826 | union pf_state_xport *sx) |
2827 | { |
2828 | int d = !0; |
2829 | |
2830 | if (sx) { |
2831 | switch (proto) { |
2832 | case IPPROTO_GRE: |
2833 | if (proto_variant == PF_GRE_PPTP_VARIANT) |
2834 | d = (rx->call_id == sx->call_id); |
2835 | break; |
2836 | |
2837 | case IPPROTO_ESP: |
2838 | d = (rx->spi == sx->spi); |
2839 | break; |
2840 | |
2841 | case IPPROTO_TCP: |
2842 | case IPPROTO_UDP: |
2843 | case IPPROTO_ICMP: |
2844 | case IPPROTO_ICMPV6: |
2845 | if (rx->range.op) |
2846 | d = pf_match_port(rx->range.op, |
2847 | rx->range.port[0], rx->range.port[1], |
2848 | sx->port); |
2849 | break; |
2850 | |
2851 | default: |
2852 | break; |
2853 | } |
2854 | } |
2855 | |
2856 | return (d); |
2857 | } |
2858 | |
2859 | int |
2860 | pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u) |
2861 | { |
2862 | if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE) |
2863 | return (0); |
2864 | return (pf_match(op, a1, a2, u)); |
2865 | } |
2866 | |
2867 | int |
2868 | pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g) |
2869 | { |
2870 | if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE) |
2871 | return (0); |
2872 | return (pf_match(op, a1, a2, g)); |
2873 | } |
2874 | |
2875 | static int |
2876 | pf_match_tag(struct pf_rule *r, struct pf_mtag *pf_mtag, |
2877 | int *tag) |
2878 | { |
2879 | if (*tag == -1) |
2880 | *tag = pf_mtag->pftag_tag; |
2881 | |
2882 | return ((!r->match_tag_not && r->match_tag == *tag) || |
2883 | (r->match_tag_not && r->match_tag != *tag)); |
2884 | } |
2885 | |
2886 | int |
2887 | pf_tag_packet(pbuf_t *pbuf, struct pf_mtag *pf_mtag, int tag, |
2888 | unsigned int rtableid, struct pf_pdesc *pd) |
2889 | { |
2890 | if (tag <= 0 && !PF_RTABLEID_IS_VALID(rtableid) && |
2891 | (pd == NULL || !(pd->pktflags & PKTF_FLOW_ID))) |
2892 | return (0); |
2893 | |
2894 | if (pf_mtag == NULL && (pf_mtag = pf_get_mtag_pbuf(pbuf)) == NULL) |
2895 | return (1); |
2896 | |
2897 | if (tag > 0) |
2898 | pf_mtag->pftag_tag = tag; |
2899 | if (PF_RTABLEID_IS_VALID(rtableid)) |
2900 | pf_mtag->pftag_rtableid = rtableid; |
2901 | if (pd != NULL && (pd->pktflags & PKTF_FLOW_ID)) { |
2902 | *pbuf->pb_flowsrc = pd->flowsrc; |
2903 | *pbuf->pb_flowid = pd->flowhash; |
2904 | *pbuf->pb_flags |= pd->pktflags; |
2905 | *pbuf->pb_proto = pd->proto; |
2906 | } |
2907 | |
2908 | return (0); |
2909 | } |
2910 | |
2911 | void |
2912 | pf_step_into_anchor(int *depth, struct pf_ruleset **rs, int n, |
2913 | struct pf_rule **r, struct pf_rule **a, int *match) |
2914 | { |
2915 | struct pf_anchor_stackframe *f; |
2916 | |
2917 | (*r)->anchor->match = 0; |
2918 | if (match) |
2919 | *match = 0; |
2920 | if (*depth >= (int)sizeof (pf_anchor_stack) / |
2921 | (int)sizeof (pf_anchor_stack[0])) { |
2922 | printf("pf_step_into_anchor: stack overflow\n" ); |
2923 | *r = TAILQ_NEXT(*r, entries); |
2924 | return; |
2925 | } else if (*depth == 0 && a != NULL) |
2926 | *a = *r; |
2927 | f = pf_anchor_stack + (*depth)++; |
2928 | f->rs = *rs; |
2929 | f->r = *r; |
2930 | if ((*r)->anchor_wildcard) { |
2931 | f->parent = &(*r)->anchor->children; |
2932 | if ((f->child = RB_MIN(pf_anchor_node, f->parent)) == |
2933 | NULL) { |
2934 | *r = NULL; |
2935 | return; |
2936 | } |
2937 | *rs = &f->child->ruleset; |
2938 | } else { |
2939 | f->parent = NULL; |
2940 | f->child = NULL; |
2941 | *rs = &(*r)->anchor->ruleset; |
2942 | } |
2943 | *r = TAILQ_FIRST((*rs)->rules[n].active.ptr); |
2944 | } |
2945 | |
2946 | int |
2947 | pf_step_out_of_anchor(int *depth, struct pf_ruleset **rs, int n, |
2948 | struct pf_rule **r, struct pf_rule **a, int *match) |
2949 | { |
2950 | struct pf_anchor_stackframe *f; |
2951 | int quick = 0; |
2952 | |
2953 | do { |
2954 | if (*depth <= 0) |
2955 | break; |
2956 | f = pf_anchor_stack + *depth - 1; |
2957 | if (f->parent != NULL && f->child != NULL) { |
2958 | if (f->child->match || |
2959 | (match != NULL && *match)) { |
2960 | f->r->anchor->match = 1; |
2961 | if (match) |
2962 | *match = 0; |
2963 | } |
2964 | f->child = RB_NEXT(pf_anchor_node, f->parent, f->child); |
2965 | if (f->child != NULL) { |
2966 | *rs = &f->child->ruleset; |
2967 | *r = TAILQ_FIRST((*rs)->rules[n].active.ptr); |
2968 | if (*r == NULL) |
2969 | continue; |
2970 | else |
2971 | break; |
2972 | } |
2973 | } |
2974 | (*depth)--; |
2975 | if (*depth == 0 && a != NULL) |
2976 | *a = NULL; |
2977 | *rs = f->rs; |
2978 | if (f->r->anchor->match || (match != NULL && *match)) |
2979 | quick = f->r->quick; |
2980 | *r = TAILQ_NEXT(f->r, entries); |
2981 | } while (*r == NULL); |
2982 | |
2983 | return (quick); |
2984 | } |
2985 | |
2986 | #if INET6 |
2987 | void |
2988 | pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr, |
2989 | struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af) |
2990 | { |
2991 | switch (af) { |
2992 | #if INET |
2993 | case AF_INET: |
2994 | naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) | |
2995 | ((rmask->addr32[0] ^ 0xffffffff) & saddr->addr32[0]); |
2996 | break; |
2997 | #endif /* INET */ |
2998 | case AF_INET6: |
2999 | naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) | |
3000 | ((rmask->addr32[0] ^ 0xffffffff) & saddr->addr32[0]); |
3001 | naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) | |
3002 | ((rmask->addr32[1] ^ 0xffffffff) & saddr->addr32[1]); |
3003 | naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) | |
3004 | ((rmask->addr32[2] ^ 0xffffffff) & saddr->addr32[2]); |
3005 | naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) | |
3006 | ((rmask->addr32[3] ^ 0xffffffff) & saddr->addr32[3]); |
3007 | break; |
3008 | } |
3009 | } |
3010 | |
3011 | void |
3012 | pf_addr_inc(struct pf_addr *addr, sa_family_t af) |
3013 | { |
3014 | switch (af) { |
3015 | #if INET |
3016 | case AF_INET: |
3017 | addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1); |
3018 | break; |
3019 | #endif /* INET */ |
3020 | case AF_INET6: |
3021 | if (addr->addr32[3] == 0xffffffff) { |
3022 | addr->addr32[3] = 0; |
3023 | if (addr->addr32[2] == 0xffffffff) { |
3024 | addr->addr32[2] = 0; |
3025 | if (addr->addr32[1] == 0xffffffff) { |
3026 | addr->addr32[1] = 0; |
3027 | addr->addr32[0] = |
3028 | htonl(ntohl(addr->addr32[0]) + 1); |
3029 | } else |
3030 | addr->addr32[1] = |
3031 | htonl(ntohl(addr->addr32[1]) + 1); |
3032 | } else |
3033 | addr->addr32[2] = |
3034 | htonl(ntohl(addr->addr32[2]) + 1); |
3035 | } else |
3036 | addr->addr32[3] = |
3037 | htonl(ntohl(addr->addr32[3]) + 1); |
3038 | break; |
3039 | } |
3040 | } |
3041 | #endif /* INET6 */ |
3042 | |
3043 | #define mix(a, b, c) \ |
3044 | do { \ |
3045 | a -= b; a -= c; a ^= (c >> 13); \ |
3046 | b -= c; b -= a; b ^= (a << 8); \ |
3047 | c -= a; c -= b; c ^= (b >> 13); \ |
3048 | a -= b; a -= c; a ^= (c >> 12); \ |
3049 | b -= c; b -= a; b ^= (a << 16); \ |
3050 | c -= a; c -= b; c ^= (b >> 5); \ |
3051 | a -= b; a -= c; a ^= (c >> 3); \ |
3052 | b -= c; b -= a; b ^= (a << 10); \ |
3053 | c -= a; c -= b; c ^= (b >> 15); \ |
3054 | } while (0) |
3055 | |
3056 | /* |
3057 | * hash function based on bridge_hash in if_bridge.c |
3058 | */ |
3059 | static void |
3060 | pf_hash(struct pf_addr *inaddr, struct pf_addr *hash, |
3061 | struct pf_poolhashkey *key, sa_family_t af) |
3062 | { |
3063 | u_int32_t a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0]; |
3064 | |
3065 | switch (af) { |
3066 | #if INET |
3067 | case AF_INET: |
3068 | a += inaddr->addr32[0]; |
3069 | b += key->key32[1]; |
3070 | mix(a, b, c); |
3071 | hash->addr32[0] = c + key->key32[2]; |
3072 | break; |
3073 | #endif /* INET */ |
3074 | #if INET6 |
3075 | case AF_INET6: |
3076 | a += inaddr->addr32[0]; |
3077 | b += inaddr->addr32[2]; |
3078 | mix(a, b, c); |
3079 | hash->addr32[0] = c; |
3080 | a += inaddr->addr32[1]; |
3081 | b += inaddr->addr32[3]; |
3082 | c += key->key32[1]; |
3083 | mix(a, b, c); |
3084 | hash->addr32[1] = c; |
3085 | a += inaddr->addr32[2]; |
3086 | b += inaddr->addr32[1]; |
3087 | c += key->key32[2]; |
3088 | mix(a, b, c); |
3089 | hash->addr32[2] = c; |
3090 | a += inaddr->addr32[3]; |
3091 | b += inaddr->addr32[0]; |
3092 | c += key->key32[3]; |
3093 | mix(a, b, c); |
3094 | hash->addr32[3] = c; |
3095 | break; |
3096 | #endif /* INET6 */ |
3097 | } |
3098 | } |
3099 | |
3100 | static int |
3101 | pf_map_addr(sa_family_t af, struct pf_rule *r, struct pf_addr *saddr, |
3102 | struct pf_addr *naddr, struct pf_addr *init_addr, struct pf_src_node **sn) |
3103 | { |
3104 | unsigned char hash[16]; |
3105 | struct pf_pool *rpool = &r->rpool; |
3106 | struct pf_addr *raddr = &rpool->cur->addr.v.a.addr; |
3107 | struct pf_addr *rmask = &rpool->cur->addr.v.a.mask; |
3108 | struct pf_pooladdr *acur = rpool->cur; |
3109 | struct pf_src_node k; |
3110 | |
3111 | if (*sn == NULL && r->rpool.opts & PF_POOL_STICKYADDR && |
3112 | (r->rpool.opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) { |
3113 | k.af = af; |
3114 | PF_ACPY(&k.addr, saddr, af); |
3115 | if (r->rule_flag & PFRULE_RULESRCTRACK || |
3116 | r->rpool.opts & PF_POOL_STICKYADDR) |
3117 | k.rule.ptr = r; |
3118 | else |
3119 | k.rule.ptr = NULL; |
3120 | pf_status.scounters[SCNT_SRC_NODE_SEARCH]++; |
3121 | *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k); |
3122 | if (*sn != NULL && !PF_AZERO(&(*sn)->raddr, rpool->af)) { |
3123 | PF_ACPY(naddr, &(*sn)->raddr, rpool->af); |
3124 | if (pf_status.debug >= PF_DEBUG_MISC) { |
3125 | printf("pf_map_addr: src tracking maps " ); |
3126 | pf_print_host(&k.addr, 0, af); |
3127 | printf(" to " ); |
3128 | pf_print_host(naddr, 0, rpool->af); |
3129 | printf("\n" ); |
3130 | } |
3131 | return (0); |
3132 | } |
3133 | } |
3134 | |
3135 | if (rpool->cur->addr.type == PF_ADDR_NOROUTE) |
3136 | return (1); |
3137 | if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { |
3138 | if (rpool->cur->addr.p.dyn == NULL) |
3139 | return (1); |
3140 | switch (rpool->af) { |
3141 | #if INET |
3142 | case AF_INET: |
3143 | if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 && |
3144 | (rpool->opts & PF_POOL_TYPEMASK) != |
3145 | PF_POOL_ROUNDROBIN) |
3146 | return (1); |
3147 | raddr = &rpool->cur->addr.p.dyn->pfid_addr4; |
3148 | rmask = &rpool->cur->addr.p.dyn->pfid_mask4; |
3149 | break; |
3150 | #endif /* INET */ |
3151 | #if INET6 |
3152 | case AF_INET6: |
3153 | if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 && |
3154 | (rpool->opts & PF_POOL_TYPEMASK) != |
3155 | PF_POOL_ROUNDROBIN) |
3156 | return (1); |
3157 | raddr = &rpool->cur->addr.p.dyn->pfid_addr6; |
3158 | rmask = &rpool->cur->addr.p.dyn->pfid_mask6; |
3159 | break; |
3160 | #endif /* INET6 */ |
3161 | } |
3162 | } else if (rpool->cur->addr.type == PF_ADDR_TABLE) { |
3163 | if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN) |
3164 | return (1); /* unsupported */ |
3165 | } else { |
3166 | raddr = &rpool->cur->addr.v.a.addr; |
3167 | rmask = &rpool->cur->addr.v.a.mask; |
3168 | } |
3169 | |
3170 | switch (rpool->opts & PF_POOL_TYPEMASK) { |
3171 | case PF_POOL_NONE: |
3172 | PF_ACPY(naddr, raddr, rpool->af); |
3173 | break; |
3174 | case PF_POOL_BITMASK: |
3175 | ASSERT(af == rpool->af); |
3176 | PF_POOLMASK(naddr, raddr, rmask, saddr, af); |
3177 | break; |
3178 | case PF_POOL_RANDOM: |
3179 | if (init_addr != NULL && PF_AZERO(init_addr, rpool->af)) { |
3180 | switch (af) { |
3181 | #if INET |
3182 | case AF_INET: |
3183 | rpool->counter.addr32[0] = htonl(random()); |
3184 | break; |
3185 | #endif /* INET */ |
3186 | #if INET6 |
3187 | case AF_INET6: |
3188 | if (rmask->addr32[3] != 0xffffffff) |
3189 | rpool->counter.addr32[3] = |
3190 | RandomULong(); |
3191 | else |
3192 | break; |
3193 | if (rmask->addr32[2] != 0xffffffff) |
3194 | rpool->counter.addr32[2] = |
3195 | RandomULong(); |
3196 | else |
3197 | break; |
3198 | if (rmask->addr32[1] != 0xffffffff) |
3199 | rpool->counter.addr32[1] = |
3200 | RandomULong(); |
3201 | else |
3202 | break; |
3203 | if (rmask->addr32[0] != 0xffffffff) |
3204 | rpool->counter.addr32[0] = |
3205 | RandomULong(); |
3206 | break; |
3207 | #endif /* INET6 */ |
3208 | } |
3209 | PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, |
3210 | rpool->af); |
3211 | PF_ACPY(init_addr, naddr, rpool->af); |
3212 | |
3213 | } else { |
3214 | PF_AINC(&rpool->counter, rpool->af); |
3215 | PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, |
3216 | rpool->af); |
3217 | } |
3218 | break; |
3219 | case PF_POOL_SRCHASH: |
3220 | ASSERT(af == rpool->af); |
3221 | PF_POOLMASK(naddr, raddr, rmask, saddr, af); |
3222 | pf_hash(saddr, (struct pf_addr *)(void *)&hash, |
3223 | &rpool->key, af); |
3224 | PF_POOLMASK(naddr, raddr, rmask, |
3225 | (struct pf_addr *)(void *)&hash, af); |
3226 | break; |
3227 | case PF_POOL_ROUNDROBIN: |
3228 | if (rpool->cur->addr.type == PF_ADDR_TABLE) { |
3229 | if (!pfr_pool_get(rpool->cur->addr.p.tbl, |
3230 | &rpool->tblidx, &rpool->counter, |
3231 | &raddr, &rmask, rpool->af)) |
3232 | goto get_addr; |
3233 | } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { |
3234 | if (rpool->cur->addr.p.dyn != NULL && |
3235 | !pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt, |
3236 | &rpool->tblidx, &rpool->counter, |
3237 | &raddr, &rmask, af)) |
3238 | goto get_addr; |
3239 | } else if (pf_match_addr(0, raddr, rmask, &rpool->counter, |
3240 | rpool->af)) |
3241 | goto get_addr; |
3242 | |
3243 | try_next: |
3244 | if ((rpool->cur = TAILQ_NEXT(rpool->cur, entries)) == NULL) |
3245 | rpool->cur = TAILQ_FIRST(&rpool->list); |
3246 | if (rpool->cur->addr.type == PF_ADDR_TABLE) { |
3247 | rpool->tblidx = -1; |
3248 | if (pfr_pool_get(rpool->cur->addr.p.tbl, |
3249 | &rpool->tblidx, &rpool->counter, |
3250 | &raddr, &rmask, rpool->af)) { |
3251 | /* table contains no address of type |
3252 | * 'rpool->af' */ |
3253 | if (rpool->cur != acur) |
3254 | goto try_next; |
3255 | return (1); |
3256 | } |
3257 | } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { |
3258 | rpool->tblidx = -1; |
3259 | if (rpool->cur->addr.p.dyn == NULL) |
3260 | return (1); |
3261 | if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt, |
3262 | &rpool->tblidx, &rpool->counter, |
3263 | &raddr, &rmask, rpool->af)) { |
3264 | /* table contains no address of type |
3265 | * 'rpool->af' */ |
3266 | if (rpool->cur != acur) |
3267 | goto try_next; |
3268 | return (1); |
3269 | } |
3270 | } else { |
3271 | raddr = &rpool->cur->addr.v.a.addr; |
3272 | rmask = &rpool->cur->addr.v.a.mask; |
3273 | PF_ACPY(&rpool->counter, raddr, rpool->af); |
3274 | } |
3275 | |
3276 | get_addr: |
3277 | PF_ACPY(naddr, &rpool->counter, rpool->af); |
3278 | if (init_addr != NULL && PF_AZERO(init_addr, rpool->af)) |
3279 | PF_ACPY(init_addr, naddr, rpool->af); |
3280 | PF_AINC(&rpool->counter, rpool->af); |
3281 | break; |
3282 | } |
3283 | if (*sn != NULL) |
3284 | PF_ACPY(&(*sn)->raddr, naddr, rpool->af); |
3285 | |
3286 | if (pf_status.debug >= PF_DEBUG_MISC && |
3287 | (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) { |
3288 | printf("pf_map_addr: selected address " ); |
3289 | pf_print_host(naddr, 0, rpool->af); |
3290 | printf("\n" ); |
3291 | } |
3292 | |
3293 | return (0); |
3294 | } |
3295 | |
3296 | static int |
3297 | pf_get_sport(struct pf_pdesc *pd, struct pfi_kif *kif, struct pf_rule *r, |
3298 | struct pf_addr *saddr, union pf_state_xport *sxport, struct pf_addr *daddr, |
3299 | union pf_state_xport *dxport, struct pf_addr *naddr, |
3300 | union pf_state_xport *nxport, struct pf_src_node **sn |
3301 | ) |
3302 | { |
3303 | #pragma unused(kif) |
3304 | struct pf_state_key_cmp key; |
3305 | struct pf_addr init_addr; |
3306 | unsigned int cut; |
3307 | sa_family_t af = pd->af; |
3308 | u_int8_t proto = pd->proto; |
3309 | unsigned int low = r->rpool.proxy_port[0]; |
3310 | unsigned int high = r->rpool.proxy_port[1]; |
3311 | |
3312 | bzero(&init_addr, sizeof (init_addr)); |
3313 | if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn)) |
3314 | return (1); |
3315 | |
3316 | if (proto == IPPROTO_ICMP) { |
3317 | low = 1; |
3318 | high = 65535; |
3319 | } |
3320 | |
3321 | if (!nxport) |
3322 | return (0); /* No output necessary. */ |
3323 | |
3324 | /*--- Special mapping rules for UDP ---*/ |
3325 | if (proto == IPPROTO_UDP) { |
3326 | |
3327 | /*--- Never float IKE source port ---*/ |
3328 | if (ntohs(sxport->port) == PF_IKE_PORT) { |
3329 | nxport->port = sxport->port; |
3330 | return (0); |
3331 | } |
3332 | |
3333 | /*--- Apply exterior mapping options ---*/ |
3334 | if (r->extmap > PF_EXTMAP_APD) { |
3335 | struct pf_state *s; |
3336 | |
3337 | TAILQ_FOREACH(s, &state_list, entry_list) { |
3338 | struct pf_state_key *sk = s->state_key; |
3339 | if (!sk) |
3340 | continue; |
3341 | if (s->nat_rule.ptr != r) |
3342 | continue; |
3343 | if (sk->proto != IPPROTO_UDP || |
3344 | sk->af_lan != af) |
3345 | continue; |
3346 | if (sk->lan.xport.port != sxport->port) |
3347 | continue; |
3348 | if (PF_ANEQ(&sk->lan.addr, saddr, af)) |
3349 | continue; |
3350 | if (r->extmap < PF_EXTMAP_EI && |
3351 | PF_ANEQ(&sk->ext_lan.addr, daddr, af)) |
3352 | continue; |
3353 | |
3354 | nxport->port = sk->gwy.xport.port; |
3355 | return (0); |
3356 | } |
3357 | } |
3358 | } else if (proto == IPPROTO_TCP) { |
3359 | struct pf_state* s; |
3360 | /* |
3361 | * APPLE MODIFICATION: <rdar://problem/6546358> |
3362 | * Fix allows....NAT to use a single binding for TCP session |
3363 | * with same source IP and source port |
3364 | */ |
3365 | TAILQ_FOREACH(s, &state_list, entry_list) { |
3366 | struct pf_state_key* sk = s->state_key; |
3367 | if (!sk) |
3368 | continue; |
3369 | if (s->nat_rule.ptr != r) |
3370 | continue; |
3371 | if (sk->proto != IPPROTO_TCP || sk->af_lan != af) |
3372 | continue; |
3373 | if (sk->lan.xport.port != sxport->port) |
3374 | continue; |
3375 | if (!(PF_AEQ(&sk->lan.addr, saddr, af))) |
3376 | continue; |
3377 | nxport->port = sk->gwy.xport.port; |
3378 | return (0); |
3379 | } |
3380 | } |
3381 | do { |
3382 | key.af_gwy = af; |
3383 | key.proto = proto; |
3384 | PF_ACPY(&key.ext_gwy.addr, daddr, key.af_gwy); |
3385 | PF_ACPY(&key.gwy.addr, naddr, key.af_gwy); |
3386 | switch (proto) { |
3387 | case IPPROTO_UDP: |
3388 | key.proto_variant = r->extfilter; |
3389 | break; |
3390 | default: |
3391 | key.proto_variant = 0; |
3392 | break; |
3393 | } |
3394 | if (dxport) |
3395 | key.ext_gwy.xport = *dxport; |
3396 | else |
3397 | memset(&key.ext_gwy.xport, 0, |
3398 | sizeof (key.ext_gwy.xport)); |
3399 | /* |
3400 | * port search; start random, step; |
3401 | * similar 2 portloop in in_pcbbind |
3402 | */ |
3403 | if (!(proto == IPPROTO_TCP || proto == IPPROTO_UDP || |
3404 | proto == IPPROTO_ICMP)) { |
3405 | if (dxport) |
3406 | key.gwy.xport = *dxport; |
3407 | else |
3408 | memset(&key.gwy.xport, 0, |
3409 | sizeof (key.gwy.xport)); |
3410 | if (pf_find_state_all(&key, PF_IN, NULL) == NULL) |
3411 | return (0); |
3412 | } else if (low == 0 && high == 0) { |
3413 | key.gwy.xport = *nxport; |
3414 | if (pf_find_state_all(&key, PF_IN, NULL) == NULL |
3415 | ) { |
3416 | return (0); |
3417 | } |
3418 | } else if (low == high) { |
3419 | key.gwy.xport.port = htons(low); |
3420 | if (pf_find_state_all(&key, PF_IN, NULL) == NULL |
3421 | ) { |
3422 | nxport->port = htons(low); |
3423 | return (0); |
3424 | } |
3425 | } else { |
3426 | unsigned int tmp; |
3427 | if (low > high) { |
3428 | tmp = low; |
3429 | low = high; |
3430 | high = tmp; |
3431 | } |
3432 | /* low < high */ |
3433 | cut = htonl(random()) % (1 + high - low) + low; |
3434 | /* low <= cut <= high */ |
3435 | for (tmp = cut; tmp <= high; ++(tmp)) { |
3436 | key.gwy.xport.port = htons(tmp); |
3437 | if (pf_find_state_all(&key, PF_IN, NULL) == NULL |
3438 | ) { |
3439 | nxport->port = htons(tmp); |
3440 | return (0); |
3441 | } |
3442 | } |
3443 | for (tmp = cut - 1; tmp >= low; --(tmp)) { |
3444 | key.gwy.xport.port = htons(tmp); |
3445 | if (pf_find_state_all(&key, PF_IN, NULL) == NULL |
3446 | ) { |
3447 | nxport->port = htons(tmp); |
3448 | return (0); |
3449 | } |
3450 | } |
3451 | } |
3452 | |
3453 | switch (r->rpool.opts & PF_POOL_TYPEMASK) { |
3454 | case PF_POOL_RANDOM: |
3455 | case PF_POOL_ROUNDROBIN: |
3456 | if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn)) |
3457 | return (1); |
3458 | break; |
3459 | case PF_POOL_NONE: |
3460 | case PF_POOL_SRCHASH: |
3461 | case PF_POOL_BITMASK: |
3462 | default: |
3463 | return (1); |
3464 | } |
3465 | } while (!PF_AEQ(&init_addr, naddr, af)); |
3466 | |
3467 | return (1); /* none available */ |
3468 | } |
3469 | |
3470 | static struct pf_rule * |
3471 | pf_match_translation(struct pf_pdesc *pd, pbuf_t *pbuf, int off, |
3472 | int direction, struct pfi_kif *kif, struct pf_addr *saddr, |
3473 | union pf_state_xport *sxport, struct pf_addr *daddr, |
3474 | union pf_state_xport *dxport, int rs_num) |
3475 | { |
3476 | struct pf_rule *r, *rm = NULL; |
3477 | struct pf_ruleset *ruleset = NULL; |
3478 | int tag = -1; |
3479 | unsigned int rtableid = IFSCOPE_NONE; |
3480 | int asd = 0; |
3481 | |
3482 | r = TAILQ_FIRST(pf_main_ruleset.rules[rs_num].active.ptr); |
3483 | while (r && rm == NULL) { |
3484 | struct pf_rule_addr *src = NULL, *dst = NULL; |
3485 | struct pf_addr_wrap *xdst = NULL; |
3486 | struct pf_addr_wrap *xsrc = NULL; |
3487 | union pf_rule_xport rdrxport; |
3488 | |
3489 | if (r->action == PF_BINAT && direction == PF_IN) { |
3490 | src = &r->dst; |
3491 | if (r->rpool.cur != NULL) |
3492 | xdst = &r->rpool.cur->addr; |
3493 | } else if (r->action == PF_RDR && direction == PF_OUT) { |
3494 | dst = &r->src; |
3495 | src = &r->dst; |
3496 | if (r->rpool.cur != NULL) { |
3497 | rdrxport.range.op = PF_OP_EQ; |
3498 | rdrxport.range.port[0] = |
3499 | htons(r->rpool.proxy_port[0]); |
3500 | xsrc = &r->rpool.cur->addr; |
3501 | } |
3502 | } else { |
3503 | src = &r->src; |
3504 | dst = &r->dst; |
3505 | } |
3506 | |
3507 | r->evaluations++; |
3508 | if (pfi_kif_match(r->kif, kif) == r->ifnot) |
3509 | r = r->skip[PF_SKIP_IFP].ptr; |
3510 | else if (r->direction && r->direction != direction) |
3511 | r = r->skip[PF_SKIP_DIR].ptr; |
3512 | else if (r->af && r->af != pd->af) |
3513 | r = r->skip[PF_SKIP_AF].ptr; |
3514 | else if (r->proto && r->proto != pd->proto) |
3515 | r = r->skip[PF_SKIP_PROTO].ptr; |
3516 | else if (xsrc && PF_MISMATCHAW(xsrc, saddr, pd->af, 0, NULL)) |
3517 | r = TAILQ_NEXT(r, entries); |
3518 | else if (!xsrc && PF_MISMATCHAW(&src->addr, saddr, pd->af, |
3519 | src->neg, kif)) |
3520 | r = TAILQ_NEXT(r, entries); |
3521 | else if (xsrc && (!rdrxport.range.port[0] || |
3522 | !pf_match_xport(r->proto, r->proto_variant, &rdrxport, |
3523 | sxport))) |
3524 | r = TAILQ_NEXT(r, entries); |
3525 | else if (!xsrc && !pf_match_xport(r->proto, |
3526 | r->proto_variant, &src->xport, sxport)) |
3527 | r = r->skip[src == &r->src ? PF_SKIP_SRC_PORT : |
3528 | PF_SKIP_DST_PORT].ptr; |
3529 | else if (dst != NULL && |
3530 | PF_MISMATCHAW(&dst->addr, daddr, pd->af, dst->neg, NULL)) |
3531 | r = r->skip[PF_SKIP_DST_ADDR].ptr; |
3532 | else if (xdst != NULL && PF_MISMATCHAW(xdst, daddr, pd->af, |
3533 | 0, NULL)) |
3534 | r = TAILQ_NEXT(r, entries); |
3535 | else if (dst && !pf_match_xport(r->proto, r->proto_variant, |
3536 | &dst->xport, dxport)) |
3537 | r = r->skip[PF_SKIP_DST_PORT].ptr; |
3538 | else if (r->match_tag && !pf_match_tag(r, pd->pf_mtag, &tag)) |
3539 | r = TAILQ_NEXT(r, entries); |
3540 | else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto != |
3541 | IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, pbuf, |
3542 | off, pd->hdr.tcp), r->os_fingerprint))) |
3543 | r = TAILQ_NEXT(r, entries); |
3544 | else { |
3545 | if (r->tag) |
3546 | tag = r->tag; |
3547 | if (PF_RTABLEID_IS_VALID(r->rtableid)) |
3548 | rtableid = r->rtableid; |
3549 | if (r->anchor == NULL) { |
3550 | rm = r; |
3551 | } else |
3552 | pf_step_into_anchor(&asd, &ruleset, rs_num, |
3553 | &r, NULL, NULL); |
3554 | } |
3555 | if (r == NULL) |
3556 | pf_step_out_of_anchor(&asd, &ruleset, rs_num, &r, |
3557 | NULL, NULL); |
3558 | } |
3559 | if (pf_tag_packet(pbuf, pd->pf_mtag, tag, rtableid, NULL)) |
3560 | return (NULL); |
3561 | if (rm != NULL && (rm->action == PF_NONAT || |
3562 | rm->action == PF_NORDR || rm->action == PF_NOBINAT || |
3563 | rm->action == PF_NONAT64)) |
3564 | return (NULL); |
3565 | return (rm); |
3566 | } |
3567 | |
3568 | /* |
3569 | * Get address translation information for NAT/BINAT/RDR |
3570 | * pd : pf packet descriptor |
3571 | * pbuf : pbuf holding the packet |
3572 | * off : offset to protocol header |
3573 | * direction : direction of packet |
3574 | * kif : pf interface info obtained from the packet's recv interface |
3575 | * sn : source node pointer (output) |
3576 | * saddr : packet source address |
3577 | * sxport : packet source port |
3578 | * daddr : packet destination address |
3579 | * dxport : packet destination port |
3580 | * nsxport : translated source port (output) |
3581 | * |
3582 | * Translated source & destination address are updated in pd->nsaddr & |
3583 | * pd->ndaddr |
3584 | */ |
3585 | static struct pf_rule * |
3586 | pf_get_translation_aux(struct pf_pdesc *pd, pbuf_t *pbuf, int off, |
3587 | int direction, struct pfi_kif *kif, struct pf_src_node **sn, |
3588 | struct pf_addr *saddr, union pf_state_xport *sxport, struct pf_addr *daddr, |
3589 | union pf_state_xport *dxport, union pf_state_xport *nsxport |
3590 | ) |
3591 | { |
3592 | struct pf_rule *r = NULL; |
3593 | pd->naf = pd->af; |
3594 | |
3595 | if (direction == PF_OUT) { |
3596 | r = pf_match_translation(pd, pbuf, off, direction, kif, saddr, |
3597 | sxport, daddr, dxport, PF_RULESET_BINAT); |
3598 | if (r == NULL) |
3599 | r = pf_match_translation(pd, pbuf, off, direction, kif, |
3600 | saddr, sxport, daddr, dxport, PF_RULESET_RDR); |
3601 | if (r == NULL) |
3602 | r = pf_match_translation(pd, pbuf, off, direction, kif, |
3603 | saddr, sxport, daddr, dxport, PF_RULESET_NAT); |
3604 | } else { |
3605 | r = pf_match_translation(pd, pbuf, off, direction, kif, saddr, |
3606 | sxport, daddr, dxport, PF_RULESET_RDR); |
3607 | if (r == NULL) |
3608 | r = pf_match_translation(pd, pbuf, off, direction, kif, |
3609 | saddr, sxport, daddr, dxport, PF_RULESET_BINAT); |
3610 | } |
3611 | |
3612 | if (r != NULL) { |
3613 | struct pf_addr *nsaddr = &pd->naddr; |
3614 | struct pf_addr *ndaddr = &pd->ndaddr; |
3615 | |
3616 | *nsaddr = *saddr; |
3617 | *ndaddr = *daddr; |
3618 | |
3619 | switch (r->action) { |
3620 | case PF_NONAT: |
3621 | case PF_NONAT64: |
3622 | case PF_NOBINAT: |
3623 | case PF_NORDR: |
3624 | return (NULL); |
3625 | case PF_NAT: |
3626 | case PF_NAT64: |
3627 | /* |
3628 | * we do NAT64 on incoming path and we call ip_input |
3629 | * which asserts receive interface to be not NULL. |
3630 | * The below check is to prevent NAT64 action on any |
3631 | * packet generated by local entity using synthesized |
3632 | * IPv6 address. |
3633 | */ |
3634 | if ((r->action == PF_NAT64) && (direction == PF_OUT)) |
3635 | return (NULL); |
3636 | |
3637 | if (pf_get_sport(pd, kif, r, saddr, sxport, daddr, |
3638 | dxport, nsaddr, nsxport, sn |
3639 | )) |
3640 | { |
3641 | DPFPRINTF(PF_DEBUG_MISC, |
3642 | ("pf: NAT proxy port allocation " |
3643 | "(%u-%u) failed\n" , |
3644 | r->rpool.proxy_port[0], |
3645 | r->rpool.proxy_port[1])); |
3646 | return (NULL); |
3647 | } |
3648 | /* |
3649 | * For NAT64 the destination IPv4 address is derived |
3650 | * from the last 32 bits of synthesized IPv6 address |
3651 | */ |
3652 | if (r->action == PF_NAT64) { |
3653 | ndaddr->v4addr.s_addr = daddr->addr32[3]; |
3654 | pd->naf = AF_INET; |
3655 | } |
3656 | break; |
3657 | case PF_BINAT: |
3658 | switch (direction) { |
3659 | case PF_OUT: |
3660 | if (r->rpool.cur->addr.type == |
3661 | PF_ADDR_DYNIFTL) { |
3662 | if (r->rpool.cur->addr.p.dyn == NULL) |
3663 | return (NULL); |
3664 | switch (pd->af) { |
3665 | #if INET |
3666 | case AF_INET: |
3667 | if (r->rpool.cur->addr.p.dyn-> |
3668 | pfid_acnt4 < 1) |
3669 | return (NULL); |
3670 | PF_POOLMASK(nsaddr, |
3671 | &r->rpool.cur->addr.p.dyn-> |
3672 | pfid_addr4, |
3673 | &r->rpool.cur->addr.p.dyn-> |
3674 | pfid_mask4, |
3675 | saddr, AF_INET); |
3676 | break; |
3677 | #endif /* INET */ |
3678 | #if INET6 |
3679 | case AF_INET6: |
3680 | if (r->rpool.cur->addr.p.dyn-> |
3681 | pfid_acnt6 < 1) |
3682 | return (NULL); |
3683 | PF_POOLMASK(nsaddr, |
3684 | &r->rpool.cur->addr.p.dyn-> |
3685 | pfid_addr6, |
3686 | &r->rpool.cur->addr.p.dyn-> |
3687 | pfid_mask6, |
3688 | saddr, AF_INET6); |
3689 | break; |
3690 | #endif /* INET6 */ |
3691 | } |
3692 | } else { |
3693 | PF_POOLMASK(nsaddr, |
3694 | &r->rpool.cur->addr.v.a.addr, |
3695 | &r->rpool.cur->addr.v.a.mask, |
3696 | saddr, pd->af); |
3697 | } |
3698 | break; |
3699 | case PF_IN: |
3700 | if (r->src.addr.type == PF_ADDR_DYNIFTL) { |
3701 | if (r->src.addr.p.dyn == NULL) |
3702 | return (NULL); |
3703 | switch (pd->af) { |
3704 | #if INET |
3705 | case AF_INET: |
3706 | if (r->src.addr.p.dyn-> |
3707 | pfid_acnt4 < 1) |
3708 | return (NULL); |
3709 | PF_POOLMASK(ndaddr, |
3710 | &r->src.addr.p.dyn-> |
3711 | pfid_addr4, |
3712 | &r->src.addr.p.dyn-> |
3713 | pfid_mask4, |
3714 | daddr, AF_INET); |
3715 | break; |
3716 | #endif /* INET */ |
3717 | #if INET6 |
3718 | case AF_INET6: |
3719 | if (r->src.addr.p.dyn-> |
3720 | pfid_acnt6 < 1) |
3721 | return (NULL); |
3722 | PF_POOLMASK(ndaddr, |
3723 | &r->src.addr.p.dyn-> |
3724 | pfid_addr6, |
3725 | &r->src.addr.p.dyn-> |
3726 | pfid_mask6, |
3727 | daddr, AF_INET6); |
3728 | break; |
3729 | #endif /* INET6 */ |
3730 | } |
3731 | } else |
3732 | PF_POOLMASK(ndaddr, |
3733 | &r->src.addr.v.a.addr, |
3734 | &r->src.addr.v.a.mask, daddr, |
3735 | pd->af); |
3736 | break; |
3737 | } |
3738 | break; |
3739 | case PF_RDR: { |
3740 | switch (direction) { |
3741 | case PF_OUT: |
3742 | if (r->dst.addr.type == PF_ADDR_DYNIFTL) { |
3743 | if (r->dst.addr.p.dyn == NULL) |
3744 | return (NULL); |
3745 | switch (pd->af) { |
3746 | #if INET |
3747 | case AF_INET: |
3748 | if (r->dst.addr.p.dyn-> |
3749 | pfid_acnt4 < 1) |
3750 | return (NULL); |
3751 | PF_POOLMASK(nsaddr, |
3752 | &r->dst.addr.p.dyn-> |
3753 | pfid_addr4, |
3754 | &r->dst.addr.p.dyn-> |
3755 | pfid_mask4, |
3756 | daddr, AF_INET); |
3757 | break; |
3758 | #endif /* INET */ |
3759 | #if INET6 |
3760 | case AF_INET6: |
3761 | if (r->dst.addr.p.dyn-> |
3762 | pfid_acnt6 < 1) |
3763 | return (NULL); |
3764 | PF_POOLMASK(nsaddr, |
3765 | &r->dst.addr.p.dyn-> |
3766 | pfid_addr6, |
3767 | &r->dst.addr.p.dyn-> |
3768 | pfid_mask6, |
3769 | daddr, AF_INET6); |
3770 | break; |
3771 | #endif /* INET6 */ |
3772 | } |
3773 | } else { |
3774 | PF_POOLMASK(nsaddr, |
3775 | &r->dst.addr.v.a.addr, |
3776 | &r->dst.addr.v.a.mask, |
3777 | daddr, pd->af); |
3778 | } |
3779 | if (nsxport && r->dst.xport.range.port[0]) |
3780 | nsxport->port = |
3781 | r->dst.xport.range.port[0]; |
3782 | break; |
3783 | case PF_IN: |
3784 | if (pf_map_addr(pd->af, r, saddr, |
3785 | ndaddr, NULL, sn)) |
3786 | return (NULL); |
3787 | if ((r->rpool.opts & PF_POOL_TYPEMASK) == |
3788 | PF_POOL_BITMASK) |
3789 | PF_POOLMASK(ndaddr, ndaddr, |
3790 | &r->rpool.cur->addr.v.a.mask, daddr, |
3791 | pd->af); |
3792 | |
3793 | if (nsxport && dxport) { |
3794 | if (r->rpool.proxy_port[1]) { |
3795 | u_int32_t tmp_nport; |
3796 | |
3797 | tmp_nport = |
3798 | ((ntohs(dxport->port) - |
3799 | ntohs(r->dst.xport.range. |
3800 | port[0])) % |
3801 | (r->rpool.proxy_port[1] - |
3802 | r->rpool.proxy_port[0] + |
3803 | 1)) + r->rpool.proxy_port[0]; |
3804 | |
3805 | /* wrap around if necessary */ |
3806 | if (tmp_nport > 65535) |
3807 | tmp_nport -= 65535; |
3808 | nsxport->port = |
3809 | htons((u_int16_t)tmp_nport); |
3810 | } else if (r->rpool.proxy_port[0]) { |
3811 | nsxport->port = htons(r->rpool. |
3812 | proxy_port[0]); |
3813 | } |
3814 | } |
3815 | break; |
3816 | } |
3817 | break; |
3818 | } |
3819 | default: |
3820 | return (NULL); |
3821 | } |
3822 | } |
3823 | |
3824 | return (r); |
3825 | } |
3826 | |
3827 | int |
3828 | pf_socket_lookup(int direction, struct pf_pdesc *pd) |
3829 | { |
3830 | struct pf_addr *saddr, *daddr; |
3831 | u_int16_t sport, dport; |
3832 | struct inpcbinfo *pi; |
3833 | int inp = 0; |
3834 | |
3835 | if (pd == NULL) |
3836 | return (-1); |
3837 | pd->lookup.uid = UID_MAX; |
3838 | pd->lookup.gid = GID_MAX; |
3839 | pd->lookup.pid = NO_PID; |
3840 | |
3841 | switch (pd->proto) { |
3842 | case IPPROTO_TCP: |
3843 | if (pd->hdr.tcp == NULL) |
3844 | return (-1); |
3845 | sport = pd->hdr.tcp->th_sport; |
3846 | dport = pd->hdr.tcp->th_dport; |
3847 | pi = &tcbinfo; |
3848 | break; |
3849 | case IPPROTO_UDP: |
3850 | if (pd->hdr.udp == NULL) |
3851 | return (-1); |
3852 | sport = pd->hdr.udp->uh_sport; |
3853 | dport = pd->hdr.udp->uh_dport; |
3854 | pi = &udbinfo; |
3855 | break; |
3856 | default: |
3857 | return (-1); |
3858 | } |
3859 | if (direction == PF_IN) { |
3860 | saddr = pd->src; |
3861 | daddr = pd->dst; |
3862 | } else { |
3863 | u_int16_t p; |
3864 | |
3865 | p = sport; |
3866 | sport = dport; |
3867 | dport = p; |
3868 | saddr = pd->dst; |
3869 | daddr = pd->src; |
3870 | } |
3871 | switch (pd->af) { |
3872 | #if INET |
3873 | case AF_INET: |
3874 | inp = in_pcblookup_hash_exists(pi, saddr->v4addr, sport, daddr->v4addr, dport, |
3875 | 0, &pd->lookup.uid, &pd->lookup.gid, NULL); |
3876 | #if INET6 |
3877 | if (inp == 0) { |
3878 | struct in6_addr s6, d6; |
3879 | |
3880 | memset(&s6, 0, sizeof (s6)); |
3881 | s6.s6_addr16[5] = htons(0xffff); |
3882 | memcpy(&s6.s6_addr32[3], &saddr->v4addr, |
3883 | sizeof (saddr->v4addr)); |
3884 | |
3885 | memset(&d6, 0, sizeof (d6)); |
3886 | d6.s6_addr16[5] = htons(0xffff); |
3887 | memcpy(&d6.s6_addr32[3], &daddr->v4addr, |
3888 | sizeof (daddr->v4addr)); |
3889 | |
3890 | inp = in6_pcblookup_hash_exists(pi, &s6, sport, |
3891 | &d6, dport, 0, &pd->lookup.uid, &pd->lookup.gid, NULL); |
3892 | if (inp == 0) { |
3893 | inp = in_pcblookup_hash_exists(pi, saddr->v4addr, sport, |
3894 | daddr->v4addr, dport, INPLOOKUP_WILDCARD, &pd->lookup.uid, &pd->lookup.gid, NULL); |
3895 | if (inp == 0) { |
3896 | inp = in6_pcblookup_hash_exists(pi, &s6, sport, |
3897 | &d6, dport, INPLOOKUP_WILDCARD, |
3898 | &pd->lookup.uid, &pd->lookup.gid, NULL); |
3899 | if (inp == 0) |
3900 | return (-1); |
3901 | } |
3902 | } |
3903 | } |
3904 | #else |
3905 | if (inp == 0) { |
3906 | inp = in_pcblookup_hash_exists(pi, saddr->v4addr, sport, |
3907 | daddr->v4addr, dport, INPLOOKUP_WILDCARD, |
3908 | &pd->lookup.uid, &pd->lookup.gid, NULL); |
3909 | if (inp == 0) |
3910 | return (-1); |
3911 | } |
3912 | #endif /* !INET6 */ |
3913 | break; |
3914 | #endif /* INET */ |
3915 | #if INET6 |
3916 | case AF_INET6: |
3917 | inp = in6_pcblookup_hash_exists(pi, &saddr->v6addr, sport, &daddr->v6addr, |
3918 | dport, 0, &pd->lookup.uid, &pd->lookup.gid, NULL); |
3919 | if (inp == 0) { |
3920 | inp = in6_pcblookup_hash_exists(pi, &saddr->v6addr, sport, |
3921 | &daddr->v6addr, dport, INPLOOKUP_WILDCARD, |
3922 | &pd->lookup.uid, &pd->lookup.gid, NULL); |
3923 | if (inp == 0) |
3924 | return (-1); |
3925 | } |
3926 | break; |
3927 | #endif /* INET6 */ |
3928 | |
3929 | default: |
3930 | return (-1); |
3931 | } |
3932 | |
3933 | return (1); |
3934 | } |
3935 | |
3936 | static u_int8_t |
3937 | pf_get_wscale(pbuf_t *pbuf, int off, u_int16_t th_off, sa_family_t af) |
3938 | { |
3939 | int hlen; |
3940 | u_int8_t hdr[60]; |
3941 | u_int8_t *opt, optlen; |
3942 | u_int8_t wscale = 0; |
3943 | |
3944 | hlen = th_off << 2; /* hlen <= sizeof (hdr) */ |
3945 | if (hlen <= (int)sizeof (struct tcphdr)) |
3946 | return (0); |
3947 | if (!pf_pull_hdr(pbuf, off, hdr, hlen, NULL, NULL, af)) |
3948 | return (0); |
3949 | opt = hdr + sizeof (struct tcphdr); |
3950 | hlen -= sizeof (struct tcphdr); |
3951 | while (hlen >= 3) { |
3952 | switch (*opt) { |
3953 | case TCPOPT_EOL: |
3954 | case TCPOPT_NOP: |
3955 | ++opt; |
3956 | --hlen; |
3957 | break; |
3958 | case TCPOPT_WINDOW: |
3959 | wscale = opt[2]; |
3960 | if (wscale > TCP_MAX_WINSHIFT) |
3961 | wscale = TCP_MAX_WINSHIFT; |
3962 | wscale |= PF_WSCALE_FLAG; |
3963 | /* FALLTHROUGH */ |
3964 | default: |
3965 | optlen = opt[1]; |
3966 | if (optlen < 2) |
3967 | optlen = 2; |
3968 | hlen -= optlen; |
3969 | opt += optlen; |
3970 | break; |
3971 | } |
3972 | } |
3973 | return (wscale); |
3974 | } |
3975 | |
3976 | static u_int16_t |
3977 | pf_get_mss(pbuf_t *pbuf, int off, u_int16_t th_off, sa_family_t af) |
3978 | { |
3979 | int hlen; |
3980 | u_int8_t hdr[60]; |
3981 | u_int8_t *opt, optlen; |
3982 | u_int16_t mss = tcp_mssdflt; |
3983 | |
3984 | hlen = th_off << 2; /* hlen <= sizeof (hdr) */ |
3985 | if (hlen <= (int)sizeof (struct tcphdr)) |
3986 | return (0); |
3987 | if (!pf_pull_hdr(pbuf, off, hdr, hlen, NULL, NULL, af)) |
3988 | return (0); |
3989 | opt = hdr + sizeof (struct tcphdr); |
3990 | hlen -= sizeof (struct tcphdr); |
3991 | while (hlen >= TCPOLEN_MAXSEG) { |
3992 | switch (*opt) { |
3993 | case TCPOPT_EOL: |
3994 | case TCPOPT_NOP: |
3995 | ++opt; |
3996 | --hlen; |
3997 | break; |
3998 | case TCPOPT_MAXSEG: |
3999 | bcopy((caddr_t)(opt + 2), (caddr_t)&mss, 2); |
4000 | #if BYTE_ORDER != BIG_ENDIAN |
4001 | NTOHS(mss); |
4002 | #endif |
4003 | /* FALLTHROUGH */ |
4004 | default: |
4005 | optlen = opt[1]; |
4006 | if (optlen < 2) |
4007 | optlen = 2; |
4008 | hlen -= optlen; |
4009 | opt += optlen; |
4010 | break; |
4011 | } |
4012 | } |
4013 | return (mss); |
4014 | } |
4015 | |
4016 | static u_int16_t |
4017 | pf_calc_mss(struct pf_addr *addr, sa_family_t af, u_int16_t offer) |
4018 | { |
4019 | #if INET |
4020 | struct sockaddr_in *dst; |
4021 | struct route ro; |
4022 | #endif /* INET */ |
4023 | #if INET6 |
4024 | struct sockaddr_in6 *dst6; |
4025 | struct route_in6 ro6; |
4026 | #endif /* INET6 */ |
4027 | struct rtentry *rt = NULL; |
4028 | int hlen; |
4029 | u_int16_t mss = tcp_mssdflt; |
4030 | |
4031 | switch (af) { |
4032 | #if INET |
4033 | case AF_INET: |
4034 | hlen = sizeof (struct ip); |
4035 | bzero(&ro, sizeof (ro)); |
4036 | dst = (struct sockaddr_in *)(void *)&ro.ro_dst; |
4037 | dst->sin_family = AF_INET; |
4038 | dst->sin_len = sizeof (*dst); |
4039 | dst->sin_addr = addr->v4addr; |
4040 | rtalloc(&ro); |
4041 | rt = ro.ro_rt; |
4042 | break; |
4043 | #endif /* INET */ |
4044 | #if INET6 |
4045 | case AF_INET6: |
4046 | hlen = sizeof (struct ip6_hdr); |
4047 | bzero(&ro6, sizeof (ro6)); |
4048 | dst6 = (struct sockaddr_in6 *)(void *)&ro6.ro_dst; |
4049 | dst6->sin6_family = AF_INET6; |
4050 | dst6->sin6_len = sizeof (*dst6); |
4051 | dst6->sin6_addr = addr->v6addr; |
4052 | rtalloc((struct route *)&ro); |
4053 | rt = ro6.ro_rt; |
4054 | break; |
4055 | #endif /* INET6 */ |
4056 | default: |
4057 | panic("pf_calc_mss: not AF_INET or AF_INET6!" ); |
4058 | return (0); |
4059 | } |
4060 | |
4061 | if (rt && rt->rt_ifp) { |
4062 | /* This is relevant only for PF SYN Proxy */ |
4063 | int interface_mtu = rt->rt_ifp->if_mtu; |
4064 | |
4065 | if (af == AF_INET && |
4066 | INTF_ADJUST_MTU_FOR_CLAT46(rt->rt_ifp)) { |
4067 | interface_mtu = IN6_LINKMTU(rt->rt_ifp); |
4068 | /* Further adjust the size for CLAT46 expansion */ |
4069 | interface_mtu -= CLAT46_HDR_EXPANSION_OVERHD; |
4070 | } |
4071 | mss = interface_mtu - hlen - sizeof (struct tcphdr); |
4072 | mss = max(tcp_mssdflt, mss); |
4073 | rtfree(rt); |
4074 | } |
4075 | mss = min(mss, offer); |
4076 | mss = max(mss, 64); /* sanity - at least max opt space */ |
4077 | return (mss); |
4078 | } |
4079 | |
4080 | static void |
4081 | pf_set_rt_ifp(struct pf_state *s, struct pf_addr *saddr, sa_family_t af) |
4082 | { |
4083 | struct pf_rule *r = s->rule.ptr; |
4084 | |
4085 | s->rt_kif = NULL; |
4086 | |
4087 | if (!r->rt || r->rt == PF_FASTROUTE) |
4088 | return; |
4089 | if ((af == AF_INET) || (af == AF_INET6)) { |
4090 | pf_map_addr(af, r, saddr, &s->rt_addr, NULL, |
4091 | &s->nat_src_node); |
4092 | s->rt_kif = r->rpool.cur->kif; |
4093 | } |
4094 | |
4095 | return; |
4096 | } |
4097 | |
4098 | static void |
4099 | pf_attach_state(struct pf_state_key *sk, struct pf_state *s, int tail) |
4100 | { |
4101 | s->state_key = sk; |
4102 | sk->refcnt++; |
4103 | |
4104 | /* list is sorted, if-bound states before floating */ |
4105 | if (tail) |
4106 | TAILQ_INSERT_TAIL(&sk->states, s, next); |
4107 | else |
4108 | TAILQ_INSERT_HEAD(&sk->states, s, next); |
4109 | } |
4110 | |
4111 | static void |
4112 | pf_detach_state(struct pf_state *s, int flags) |
4113 | { |
4114 | struct pf_state_key *sk = s->state_key; |
4115 | |
4116 | if (sk == NULL) |
4117 | return; |
4118 | |
4119 | s->state_key = NULL; |
4120 | TAILQ_REMOVE(&sk->states, s, next); |
4121 | if (--sk->refcnt == 0) { |
4122 | if (!(flags & PF_DT_SKIP_EXTGWY)) |
4123 | RB_REMOVE(pf_state_tree_ext_gwy, |
4124 | &pf_statetbl_ext_gwy, sk); |
4125 | if (!(flags & PF_DT_SKIP_LANEXT)) |
4126 | RB_REMOVE(pf_state_tree_lan_ext, |
4127 | &pf_statetbl_lan_ext, sk); |
4128 | if (sk->app_state) |
4129 | pool_put(&pf_app_state_pl, sk->app_state); |
4130 | pool_put(&pf_state_key_pl, sk); |
4131 | } |
4132 | } |
4133 | |
4134 | struct pf_state_key * |
4135 | pf_alloc_state_key(struct pf_state *s, struct pf_state_key *psk) |
4136 | { |
4137 | struct pf_state_key *sk; |
4138 | |
4139 | if ((sk = pool_get(&pf_state_key_pl, PR_WAITOK)) == NULL) |
4140 | return (NULL); |
4141 | bzero(sk, sizeof (*sk)); |
4142 | TAILQ_INIT(&sk->states); |
4143 | pf_attach_state(sk, s, 0); |
4144 | |
4145 | /* initialize state key from psk, if provided */ |
4146 | if (psk != NULL) { |
4147 | bcopy(&psk->lan, &sk->lan, sizeof (sk->lan)); |
4148 | bcopy(&psk->gwy, &sk->gwy, sizeof (sk->gwy)); |
4149 | bcopy(&psk->ext_lan, &sk->ext_lan, sizeof (sk->ext_lan)); |
4150 | bcopy(&psk->ext_gwy, &sk->ext_gwy, sizeof (sk->ext_gwy)); |
4151 | sk->af_lan = psk->af_lan; |
4152 | sk->af_gwy = psk->af_gwy; |
4153 | sk->proto = psk->proto; |
4154 | sk->direction = psk->direction; |
4155 | sk->proto_variant = psk->proto_variant; |
4156 | VERIFY(psk->app_state == NULL); |
4157 | sk->flowsrc = psk->flowsrc; |
4158 | sk->flowhash = psk->flowhash; |
4159 | /* don't touch tree entries, states and refcnt on sk */ |
4160 | } |
4161 | |
4162 | return (sk); |
4163 | } |
4164 | |
4165 | static u_int32_t |
4166 | pf_tcp_iss(struct pf_pdesc *pd) |
4167 | { |
4168 | MD5_CTX ctx; |
4169 | u_int32_t digest[4]; |
4170 | |
4171 | if (pf_tcp_secret_init == 0) { |
4172 | read_frandom(pf_tcp_secret, sizeof (pf_tcp_secret)); |
4173 | MD5Init(&pf_tcp_secret_ctx); |
4174 | MD5Update(&pf_tcp_secret_ctx, pf_tcp_secret, |
4175 | sizeof (pf_tcp_secret)); |
4176 | pf_tcp_secret_init = 1; |
4177 | } |
4178 | ctx = pf_tcp_secret_ctx; |
4179 | |
4180 | MD5Update(&ctx, (char *)&pd->hdr.tcp->th_sport, sizeof (u_short)); |
4181 | MD5Update(&ctx, (char *)&pd->hdr.tcp->th_dport, sizeof (u_short)); |
4182 | if (pd->af == AF_INET6) { |
4183 | MD5Update(&ctx, (char *)&pd->src->v6addr, sizeof (struct in6_addr)); |
4184 | MD5Update(&ctx, (char *)&pd->dst->v6addr, sizeof (struct in6_addr)); |
4185 | } else { |
4186 | MD5Update(&ctx, (char *)&pd->src->v4addr, sizeof (struct in_addr)); |
4187 | MD5Update(&ctx, (char *)&pd->dst->v4addr, sizeof (struct in_addr)); |
4188 | } |
4189 | MD5Final((u_char *)digest, &ctx); |
4190 | pf_tcp_iss_off += 4096; |
4191 | return (digest[0] + random() + pf_tcp_iss_off); |
4192 | } |
4193 | |
4194 | /* |
4195 | * This routine is called to perform address family translation on the |
4196 | * inner IP header (that may come as payload) of an ICMP(v4addr/6) error |
4197 | * response. |
4198 | */ |
4199 | static int |
4200 | pf_change_icmp_af(pbuf_t *pbuf, int off, |
4201 | struct pf_pdesc *pd, struct pf_pdesc *pd2, struct pf_addr *src, |
4202 | struct pf_addr *dst, sa_family_t af, sa_family_t naf) |
4203 | { |
4204 | struct ip *ip4 = NULL; |
4205 | struct ip6_hdr *ip6 = NULL; |
4206 | void *hdr; |
4207 | int hlen, olen; |
4208 | |
4209 | if (af == naf || (af != AF_INET && af != AF_INET6) || |
4210 | (naf != AF_INET && naf != AF_INET6)) |
4211 | return (-1); |
4212 | |
4213 | /* old header */ |
4214 | olen = pd2->off - off; |
4215 | /* new header */ |
4216 | hlen = naf == AF_INET ? sizeof(*ip4) : sizeof(*ip6); |
4217 | |
4218 | /* Modify the pbuf to accommodate the new header */ |
4219 | hdr = pbuf_resize_segment(pbuf, off, olen, hlen); |
4220 | if (hdr == NULL) |
4221 | return (-1); |
4222 | |
4223 | /* translate inner ip/ip6 header */ |
4224 | switch (naf) { |
4225 | case AF_INET: |
4226 | ip4 = hdr; |
4227 | bzero(ip4, sizeof(*ip4)); |
4228 | ip4->ip_v = IPVERSION; |
4229 | ip4->ip_hl = sizeof(*ip4) >> 2; |
4230 | ip4->ip_len = htons(sizeof(*ip4) + pd2->tot_len - olen); |
4231 | ip4->ip_id = rfc6864 ? 0 : htons(ip_randomid()); |
4232 | ip4->ip_off = htons(IP_DF); |
4233 | ip4->ip_ttl = pd2->ttl; |
4234 | if (pd2->proto == IPPROTO_ICMPV6) |
4235 | ip4->ip_p = IPPROTO_ICMP; |
4236 | else |
4237 | ip4->ip_p = pd2->proto; |
4238 | ip4->ip_src = src->v4addr; |
4239 | ip4->ip_dst = dst->v4addr; |
4240 | ip4->ip_sum = pbuf_inet_cksum(pbuf, 0, 0, ip4->ip_hl << 2); |
4241 | break; |
4242 | case AF_INET6: |
4243 | ip6 = hdr; |
4244 | bzero(ip6, sizeof(*ip6)); |
4245 | ip6->ip6_vfc = IPV6_VERSION; |
4246 | ip6->ip6_plen = htons(pd2->tot_len - olen); |
4247 | if (pd2->proto == IPPROTO_ICMP) |
4248 | ip6->ip6_nxt = IPPROTO_ICMPV6; |
4249 | else |
4250 | ip6->ip6_nxt = pd2->proto; |
4251 | if (!pd2->ttl || pd2->ttl > IPV6_DEFHLIM) |
4252 | ip6->ip6_hlim = IPV6_DEFHLIM; |
4253 | else |
4254 | ip6->ip6_hlim = pd2->ttl; |
4255 | ip6->ip6_src = src->v6addr; |
4256 | ip6->ip6_dst = dst->v6addr; |
4257 | break; |
4258 | } |
4259 | |
4260 | /* adjust payload offset and total packet length */ |
4261 | pd2->off += hlen - olen; |
4262 | pd->tot_len += hlen - olen; |
4263 | |
4264 | return (0); |
4265 | } |
4266 | |
4267 | #define PTR_IP(field) ((int32_t)offsetof(struct ip, field)) |
4268 | #define PTR_IP6(field) ((int32_t)offsetof(struct ip6_hdr, field)) |
4269 | |
4270 | static int |
4271 | pf_translate_icmp_af(int af, void *arg) |
4272 | { |
4273 | struct icmp *icmp4; |
4274 | struct icmp6_hdr *icmp6; |
4275 | u_int32_t mtu; |
4276 | int32_t ptr = -1; |
4277 | u_int8_t type; |
4278 | u_int8_t code; |
4279 | |
4280 | switch (af) { |
4281 | case AF_INET: |
4282 | icmp6 = arg; |
4283 | type = icmp6->icmp6_type; |
4284 | code = icmp6->icmp6_code; |
4285 | mtu = ntohl(icmp6->icmp6_mtu); |
4286 | |
4287 | switch (type) { |
4288 | case ICMP6_ECHO_REQUEST: |
4289 | type = ICMP_ECHO; |
4290 | break; |
4291 | case ICMP6_ECHO_REPLY: |
4292 | type = ICMP_ECHOREPLY; |
4293 | break; |
4294 | case ICMP6_DST_UNREACH: |
4295 | type = ICMP_UNREACH; |
4296 | switch (code) { |
4297 | case ICMP6_DST_UNREACH_NOROUTE: |
4298 | case ICMP6_DST_UNREACH_BEYONDSCOPE: |
4299 | case ICMP6_DST_UNREACH_ADDR: |
4300 | code = ICMP_UNREACH_HOST; |
4301 | break; |
4302 | case ICMP6_DST_UNREACH_ADMIN: |
4303 | code = ICMP_UNREACH_HOST_PROHIB; |
4304 | break; |
4305 | case ICMP6_DST_UNREACH_NOPORT: |
4306 | code = ICMP_UNREACH_PORT; |
4307 | break; |
4308 | default: |
4309 | return (-1); |
4310 | } |
4311 | break; |
4312 | case ICMP6_PACKET_TOO_BIG: |
4313 | type = ICMP_UNREACH; |
4314 | code = ICMP_UNREACH_NEEDFRAG; |
4315 | mtu -= 20; |
4316 | break; |
4317 | case ICMP6_TIME_EXCEEDED: |
4318 | type = ICMP_TIMXCEED; |
4319 | break; |
4320 | case ICMP6_PARAM_PROB: |
4321 | switch (code) { |
4322 | case ICMP6_PARAMPROB_HEADER: |
4323 | type = ICMP_PARAMPROB; |
4324 | code = ICMP_PARAMPROB_ERRATPTR; |
4325 | ptr = ntohl(icmp6->icmp6_pptr); |
4326 | |
4327 | if (ptr == PTR_IP6(ip6_vfc)) |
4328 | ; /* preserve */ |
4329 | else if (ptr == PTR_IP6(ip6_vfc) + 1) |
4330 | ptr = PTR_IP(ip_tos); |
4331 | else if (ptr == PTR_IP6(ip6_plen) || |
4332 | ptr == PTR_IP6(ip6_plen) + 1) |
4333 | ptr = PTR_IP(ip_len); |
4334 | else if (ptr == PTR_IP6(ip6_nxt)) |
4335 | ptr = PTR_IP(ip_p); |
4336 | else if (ptr == PTR_IP6(ip6_hlim)) |
4337 | ptr = PTR_IP(ip_ttl); |
4338 | else if (ptr >= PTR_IP6(ip6_src) && |
4339 | ptr < PTR_IP6(ip6_dst)) |
4340 | ptr = PTR_IP(ip_src); |
4341 | else if (ptr >= PTR_IP6(ip6_dst) && |
4342 | ptr < (int32_t)sizeof(struct ip6_hdr)) |
4343 | ptr = PTR_IP(ip_dst); |
4344 | else { |
4345 | return (-1); |
4346 | } |
4347 | break; |
4348 | case ICMP6_PARAMPROB_NEXTHEADER: |
4349 | type = ICMP_UNREACH; |
4350 | code = ICMP_UNREACH_PROTOCOL; |
4351 | break; |
4352 | default: |
4353 | return (-1); |
4354 | } |
4355 | break; |
4356 | default: |
4357 | return (-1); |
4358 | } |
4359 | icmp6->icmp6_type = type; |
4360 | icmp6->icmp6_code = code; |
4361 | /* aligns well with a icmpv4 nextmtu */ |
4362 | icmp6->icmp6_mtu = htonl(mtu); |
4363 | /* icmpv4 pptr is a one most significant byte */ |
4364 | if (ptr >= 0) |
4365 | icmp6->icmp6_pptr = htonl(ptr << 24); |
4366 | break; |
4367 | |
4368 | case AF_INET6: |
4369 | icmp4 = arg; |
4370 | type = icmp4->icmp_type; |
4371 | code = icmp4->icmp_code; |
4372 | mtu = ntohs(icmp4->icmp_nextmtu); |
4373 | |
4374 | switch (type) { |
4375 | case ICMP_ECHO: |
4376 | type = ICMP6_ECHO_REQUEST; |
4377 | break; |
4378 | case ICMP_ECHOREPLY: |
4379 | type = ICMP6_ECHO_REPLY; |
4380 | break; |
4381 | case ICMP_UNREACH: |
4382 | type = ICMP6_DST_UNREACH; |
4383 | switch (code) { |
4384 | case ICMP_UNREACH_NET: |
4385 | case ICMP_UNREACH_HOST: |
4386 | case ICMP_UNREACH_NET_UNKNOWN: |
4387 | case ICMP_UNREACH_HOST_UNKNOWN: |
4388 | case ICMP_UNREACH_ISOLATED: |
4389 | case ICMP_UNREACH_TOSNET: |
4390 | case ICMP_UNREACH_TOSHOST: |
4391 | code = ICMP6_DST_UNREACH_NOROUTE; |
4392 | break; |
4393 | case ICMP_UNREACH_PORT: |
4394 | code = ICMP6_DST_UNREACH_NOPORT; |
4395 | break; |
4396 | case ICMP_UNREACH_NET_PROHIB: |
4397 | case ICMP_UNREACH_HOST_PROHIB: |
4398 | case ICMP_UNREACH_FILTER_PROHIB: |
4399 | case ICMP_UNREACH_PRECEDENCE_CUTOFF: |
4400 | code = ICMP6_DST_UNREACH_ADMIN; |
4401 | break; |
4402 | case ICMP_UNREACH_PROTOCOL: |
4403 | type = ICMP6_PARAM_PROB; |
4404 | code = ICMP6_PARAMPROB_NEXTHEADER; |
4405 | ptr = offsetof(struct ip6_hdr, ip6_nxt); |
4406 | break; |
4407 | case ICMP_UNREACH_NEEDFRAG: |
4408 | type = ICMP6_PACKET_TOO_BIG; |
4409 | code = 0; |
4410 | mtu += 20; |
4411 | break; |
4412 | default: |
4413 | return (-1); |
4414 | } |
4415 | break; |
4416 | case ICMP_TIMXCEED: |
4417 | type = ICMP6_TIME_EXCEEDED; |
4418 | break; |
4419 | case ICMP_PARAMPROB: |
4420 | type = ICMP6_PARAM_PROB; |
4421 | switch (code) { |
4422 | case ICMP_PARAMPROB_ERRATPTR: |
4423 | code = ICMP6_PARAMPROB_HEADER; |
4424 | break; |
4425 | case ICMP_PARAMPROB_LENGTH: |
4426 | code = ICMP6_PARAMPROB_HEADER; |
4427 | break; |
4428 | default: |
4429 | return (-1); |
4430 | } |
4431 | |
4432 | ptr = icmp4->icmp_pptr; |
4433 | if (ptr == 0 || ptr == PTR_IP(ip_tos)) |
4434 | ; /* preserve */ |
4435 | else if (ptr == PTR_IP(ip_len) || |
4436 | ptr == PTR_IP(ip_len) + 1) |
4437 | ptr = PTR_IP6(ip6_plen); |
4438 | else if (ptr == PTR_IP(ip_ttl)) |
4439 | ptr = PTR_IP6(ip6_hlim); |
4440 | else if (ptr == PTR_IP(ip_p)) |
4441 | ptr = PTR_IP6(ip6_nxt); |
4442 | else if (ptr >= PTR_IP(ip_src) && |
4443 | ptr < PTR_IP(ip_dst)) |
4444 | ptr = PTR_IP6(ip6_src); |
4445 | else if (ptr >= PTR_IP(ip_dst) && |
4446 | ptr < (int32_t)sizeof(struct ip)) |
4447 | ptr = PTR_IP6(ip6_dst); |
4448 | else { |
4449 | return (-1); |
4450 | } |
4451 | break; |
4452 | default: |
4453 | return (-1); |
4454 | } |
4455 | icmp4->icmp_type = type; |
4456 | icmp4->icmp_code = code; |
4457 | icmp4->icmp_nextmtu = htons(mtu); |
4458 | if (ptr >= 0) |
4459 | icmp4->icmp_void = htonl(ptr); |
4460 | break; |
4461 | } |
4462 | |
4463 | return (0); |
4464 | } |
4465 | |
4466 | /* Note: frees pbuf if PF_NAT64 is returned */ |
4467 | static int |
4468 | pf_nat64_ipv6(pbuf_t *pbuf, int off, struct pf_pdesc *pd) |
4469 | { |
4470 | struct ip *ip4; |
4471 | struct mbuf *m; |
4472 | |
4473 | /* |
4474 | * ip_input asserts for rcvif to be not NULL |
4475 | * That may not be true for two corner cases |
4476 | * 1. If for some reason a local app sends DNS |
4477 | * AAAA query to local host |
4478 | * 2. If IPv6 stack in kernel internally generates a |
4479 | * message destined for a synthesized IPv6 end-point. |
4480 | */ |
4481 | if (pbuf->pb_ifp == NULL) |
4482 | return (PF_DROP); |
4483 | |
4484 | ip4 = (struct ip *)pbuf_resize_segment(pbuf, 0, off, sizeof(*ip4)); |
4485 | if (ip4 == NULL) |
4486 | return (PF_DROP); |
4487 | |
4488 | ip4->ip_v = 4; |
4489 | ip4->ip_hl = 5; |
4490 | ip4->ip_tos = pd->tos & htonl(0x0ff00000); |
4491 | ip4->ip_len = htons(sizeof(*ip4) + (pd->tot_len - off)); |
4492 | ip4->ip_id = 0; |
4493 | ip4->ip_off = htons(IP_DF); |
4494 | ip4->ip_ttl = pd->ttl; |
4495 | ip4->ip_p = pd->proto; |
4496 | ip4->ip_sum = 0; |
4497 | ip4->ip_src = pd->naddr.v4addr; |
4498 | ip4->ip_dst = pd->ndaddr.v4addr; |
4499 | ip4->ip_sum = pbuf_inet_cksum(pbuf, 0, 0, ip4->ip_hl << 2); |
4500 | |
4501 | /* recalculate icmp checksums */ |
4502 | if (pd->proto == IPPROTO_ICMP) { |
4503 | struct icmp *icmp; |
4504 | int hlen = sizeof(*ip4); |
4505 | |
4506 | icmp = (struct icmp *)pbuf_contig_segment(pbuf, hlen, |
4507 | ICMP_MINLEN); |
4508 | if (icmp == NULL) |
4509 | return (PF_DROP); |
4510 | |
4511 | icmp->icmp_cksum = 0; |
4512 | icmp->icmp_cksum = pbuf_inet_cksum(pbuf, 0, hlen, |
4513 | ntohs(ip4->ip_len) - hlen); |
4514 | } |
4515 | |
4516 | if ((m = pbuf_to_mbuf(pbuf, TRUE)) != NULL) |
4517 | ip_input(m); |
4518 | |
4519 | return (PF_NAT64); |
4520 | } |
4521 | |
4522 | static int |
4523 | pf_nat64_ipv4(pbuf_t *pbuf, int off, struct pf_pdesc *pd) |
4524 | { |
4525 | struct ip6_hdr *ip6; |
4526 | struct mbuf *m; |
4527 | |
4528 | if (pbuf->pb_ifp == NULL) |
4529 | return (PF_DROP); |
4530 | |
4531 | ip6 = (struct ip6_hdr *)pbuf_resize_segment(pbuf, 0, off, sizeof(*ip6)); |
4532 | if (ip6 == NULL) |
4533 | return (PF_DROP); |
4534 | |
4535 | ip6->ip6_vfc = htonl((6 << 28) | (pd->tos << 20)); |
4536 | ip6->ip6_plen = htons(pd->tot_len - off); |
4537 | ip6->ip6_nxt = pd->proto; |
4538 | ip6->ip6_hlim = pd->ttl; |
4539 | ip6->ip6_src = pd->naddr.v6addr; |
4540 | ip6->ip6_dst = pd->ndaddr.v6addr; |
4541 | |
4542 | /* recalculate icmp6 checksums */ |
4543 | if (pd->proto == IPPROTO_ICMPV6) { |
4544 | struct icmp6_hdr *icmp6; |
4545 | int hlen = sizeof(*ip6); |
4546 | |
4547 | icmp6 = (struct icmp6_hdr *)pbuf_contig_segment(pbuf, hlen, |
4548 | sizeof(*icmp6)); |
4549 | if (icmp6 == NULL) |
4550 | return (PF_DROP); |
4551 | |
4552 | icmp6->icmp6_cksum = 0; |
4553 | icmp6->icmp6_cksum = pbuf_inet6_cksum(pbuf, |
4554 | IPPROTO_ICMPV6, hlen, |
4555 | ntohs(ip6->ip6_plen)); |
4556 | } else if (pd->proto == IPPROTO_UDP) { |
4557 | struct udphdr *uh; |
4558 | int hlen = sizeof(*ip6); |
4559 | |
4560 | uh = (struct udphdr *)pbuf_contig_segment(pbuf, hlen, |
4561 | sizeof(*uh)); |
4562 | if (uh == NULL) |
4563 | return (PF_DROP); |
4564 | |
4565 | if (uh->uh_sum == 0) |
4566 | uh->uh_sum = pbuf_inet6_cksum(pbuf, IPPROTO_UDP, |
4567 | hlen, ntohs(ip6->ip6_plen)); |
4568 | } |
4569 | |
4570 | if ((m = pbuf_to_mbuf(pbuf, TRUE)) != NULL) |
4571 | ip6_input(m); |
4572 | |
4573 | return (PF_NAT64); |
4574 | } |
4575 | |
4576 | static int |
4577 | pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction, |
4578 | struct pfi_kif *kif, pbuf_t *pbuf, int off, void *h, |
4579 | struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm, |
4580 | struct ifqueue *ifq) |
4581 | { |
4582 | #pragma unused(h) |
4583 | struct pf_rule *nr = NULL; |
4584 | struct pf_addr *saddr = pd->src, *daddr = pd->dst; |
4585 | sa_family_t af = pd->af; |
4586 | struct pf_rule *r, *a = NULL; |
4587 | struct pf_ruleset *ruleset = NULL; |
4588 | struct pf_src_node *nsn = NULL; |
4589 | struct tcphdr *th = pd->hdr.tcp; |
4590 | struct udphdr *uh = pd->hdr.udp; |
4591 | u_short reason; |
4592 | int rewrite = 0, hdrlen = 0; |
4593 | int tag = -1; |
4594 | unsigned int rtableid = IFSCOPE_NONE; |
4595 | int asd = 0; |
4596 | int match = 0; |
4597 | int state_icmp = 0; |
4598 | u_int16_t mss = tcp_mssdflt; |
4599 | u_int8_t icmptype = 0, icmpcode = 0; |
4600 | |
4601 | struct pf_grev1_hdr *grev1 = pd->hdr.grev1; |
4602 | union pf_state_xport bxport, bdxport, nxport, sxport, dxport; |
4603 | struct pf_state_key psk; |
4604 | |
4605 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
4606 | |
4607 | if (direction == PF_IN && pf_check_congestion(ifq)) { |
4608 | REASON_SET(&reason, PFRES_CONGEST); |
4609 | return (PF_DROP); |
4610 | } |
4611 | |
4612 | hdrlen = 0; |
4613 | sxport.spi = 0; |
4614 | dxport.spi = 0; |
4615 | nxport.spi = 0; |
4616 | |
4617 | switch (pd->proto) { |
4618 | case IPPROTO_TCP: |
4619 | sxport.port = th->th_sport; |
4620 | dxport.port = th->th_dport; |
4621 | hdrlen = sizeof (*th); |
4622 | break; |
4623 | case IPPROTO_UDP: |
4624 | sxport.port = uh->uh_sport; |
4625 | dxport.port = uh->uh_dport; |
4626 | hdrlen = sizeof (*uh); |
4627 | break; |
4628 | #if INET |
4629 | case IPPROTO_ICMP: |
4630 | if (pd->af != AF_INET) |
4631 | break; |
4632 | sxport.port = dxport.port = pd->hdr.icmp->icmp_id; |
4633 | hdrlen = ICMP_MINLEN; |
4634 | icmptype = pd->hdr.icmp->icmp_type; |
4635 | icmpcode = pd->hdr.icmp->icmp_code; |
4636 | |
4637 | if (ICMP_ERRORTYPE(icmptype)) |
4638 | state_icmp++; |
4639 | break; |
4640 | #endif /* INET */ |
4641 | #if INET6 |
4642 | case IPPROTO_ICMPV6: |
4643 | if (pd->af != AF_INET6) |
4644 | break; |
4645 | sxport.port = dxport.port = pd->hdr.icmp6->icmp6_id; |
4646 | hdrlen = sizeof (*pd->hdr.icmp6); |
4647 | icmptype = pd->hdr.icmp6->icmp6_type; |
4648 | icmpcode = pd->hdr.icmp6->icmp6_code; |
4649 | |
4650 | if (ICMP6_ERRORTYPE(icmptype)) |
4651 | state_icmp++; |
4652 | break; |
4653 | #endif /* INET6 */ |
4654 | case IPPROTO_GRE: |
4655 | if (pd->proto_variant == PF_GRE_PPTP_VARIANT) { |
4656 | sxport.call_id = dxport.call_id = |
4657 | pd->hdr.grev1->call_id; |
4658 | hdrlen = sizeof (*pd->hdr.grev1); |
4659 | } |
4660 | break; |
4661 | case IPPROTO_ESP: |
4662 | sxport.spi = 0; |
4663 | dxport.spi = pd->hdr.esp->spi; |
4664 | hdrlen = sizeof (*pd->hdr.esp); |
4665 | break; |
4666 | } |
4667 | |
4668 | r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); |
4669 | |
4670 | bxport = sxport; |
4671 | bdxport = dxport; |
4672 | |
4673 | if (direction == PF_OUT) |
4674 | nxport = sxport; |
4675 | else |
4676 | nxport = dxport; |
4677 | |
4678 | /* check packet for BINAT/NAT/RDR */ |
4679 | if ((nr = pf_get_translation_aux(pd, pbuf, off, direction, kif, &nsn, |
4680 | saddr, &sxport, daddr, &dxport, &nxport |
4681 | )) != NULL) { |
4682 | int ua; |
4683 | u_int16_t dport; |
4684 | |
4685 | if (pd->af != pd->naf) |
4686 | ua = 0; |
4687 | else |
4688 | ua = 1; |
4689 | |
4690 | PF_ACPY(&pd->baddr, saddr, af); |
4691 | PF_ACPY(&pd->bdaddr, daddr, af); |
4692 | |
4693 | switch (pd->proto) { |
4694 | case IPPROTO_TCP: |
4695 | if (pd->af != pd->naf || |
4696 | PF_ANEQ(saddr, &pd->naddr, pd->af)) { |
4697 | pf_change_ap(direction, pd->mp, saddr, |
4698 | &th->th_sport, pd->ip_sum, &th->th_sum, |
4699 | &pd->naddr, nxport.port, 0, af, |
4700 | pd->naf, ua); |
4701 | sxport.port = th->th_sport; |
4702 | } |
4703 | |
4704 | if (pd->af != pd->naf || |
4705 | PF_ANEQ(daddr, &pd->ndaddr, pd->af) || |
4706 | (nr && (nr->action == PF_RDR) && |
4707 | (th->th_dport != nxport.port))) { |
4708 | if (nr && nr->action == PF_RDR) |
4709 | dport = nxport.port; |
4710 | else |
4711 | dport = th->th_dport; |
4712 | pf_change_ap(direction, pd->mp, daddr, |
4713 | &th->th_dport, pd->ip_sum, |
4714 | &th->th_sum, &pd->ndaddr, |
4715 | dport, 0, af, pd->naf, ua); |
4716 | dxport.port = th->th_dport; |
4717 | } |
4718 | rewrite++; |
4719 | break; |
4720 | |
4721 | case IPPROTO_UDP: |
4722 | if (pd->af != pd->naf || |
4723 | PF_ANEQ(saddr, &pd->naddr, pd->af)) { |
4724 | pf_change_ap(direction, pd->mp, saddr, |
4725 | &uh->uh_sport, pd->ip_sum, |
4726 | &uh->uh_sum, &pd->naddr, |
4727 | nxport.port, 1, af, pd->naf, ua); |
4728 | sxport.port = uh->uh_sport; |
4729 | } |
4730 | |
4731 | if (pd->af != pd->naf || |
4732 | PF_ANEQ(daddr, &pd->ndaddr, pd->af) || |
4733 | (nr && (nr->action == PF_RDR) && |
4734 | (uh->uh_dport != nxport.port))) { |
4735 | if (nr && nr->action == PF_RDR) |
4736 | dport = nxport.port; |
4737 | else |
4738 | dport = uh->uh_dport; |
4739 | pf_change_ap(direction, pd->mp, daddr, |
4740 | &uh->uh_dport, pd->ip_sum, |
4741 | &uh->uh_sum, &pd->ndaddr, |
4742 | dport, 0, af, pd->naf, ua); |
4743 | dxport.port = uh->uh_dport; |
4744 | } |
4745 | rewrite++; |
4746 | break; |
4747 | #if INET |
4748 | case IPPROTO_ICMP: |
4749 | if (pd->af != AF_INET) |
4750 | break; |
4751 | /* |
4752 | * TODO: |
4753 | * pd->af != pd->naf not handled yet here and would be |
4754 | * needed for NAT46 needed to support XLAT. |
4755 | * Will cross the bridge when it comes. |
4756 | */ |
4757 | if (PF_ANEQ(saddr, &pd->naddr, pd->af)) { |
4758 | pf_change_a(&saddr->v4addr.s_addr, pd->ip_sum, |
4759 | pd->naddr.v4addr.s_addr, 0); |
4760 | pd->hdr.icmp->icmp_cksum = pf_cksum_fixup( |
4761 | pd->hdr.icmp->icmp_cksum, sxport.port, |
4762 | nxport.port, 0); |
4763 | pd->hdr.icmp->icmp_id = nxport.port; |
4764 | } |
4765 | |
4766 | if (PF_ANEQ(daddr, &pd->ndaddr, pd->af)) { |
4767 | pf_change_a(&daddr->v4addr.s_addr, pd->ip_sum, |
4768 | pd->ndaddr.v4addr.s_addr, 0); |
4769 | } |
4770 | ++rewrite; |
4771 | break; |
4772 | #endif /* INET */ |
4773 | #if INET6 |
4774 | case IPPROTO_ICMPV6: |
4775 | if (pd->af != AF_INET6) |
4776 | break; |
4777 | |
4778 | if (pd->af != pd->naf || |
4779 | PF_ANEQ(saddr, &pd->naddr, pd->af)) { |
4780 | pf_change_addr(saddr, |
4781 | &pd->hdr.icmp6->icmp6_cksum, |
4782 | &pd->naddr, 0, pd->af, pd->naf); |
4783 | } |
4784 | |
4785 | if (pd->af != pd->naf || |
4786 | PF_ANEQ(daddr, &pd->ndaddr, pd->af)) { |
4787 | pf_change_addr(daddr, |
4788 | &pd->hdr.icmp6->icmp6_cksum, |
4789 | &pd->ndaddr, 0, pd->af, pd->naf); |
4790 | } |
4791 | |
4792 | if (pd->af != pd->naf) { |
4793 | if (pf_translate_icmp_af(AF_INET, |
4794 | pd->hdr.icmp6)) |
4795 | return (PF_DROP); |
4796 | pd->proto = IPPROTO_ICMP; |
4797 | } |
4798 | rewrite++; |
4799 | break; |
4800 | #endif /* INET */ |
4801 | case IPPROTO_GRE: |
4802 | if ((direction == PF_IN) && |
4803 | (pd->proto_variant == PF_GRE_PPTP_VARIANT)) |
4804 | grev1->call_id = nxport.call_id; |
4805 | |
4806 | switch (pd->af) { |
4807 | #if INET |
4808 | case AF_INET: |
4809 | if (PF_ANEQ(saddr, &pd->naddr, pd->af)) { |
4810 | pf_change_a(&saddr->v4addr.s_addr, |
4811 | pd->ip_sum, |
4812 | pd->naddr.v4addr.s_addr, 0); |
4813 | } |
4814 | if (PF_ANEQ(daddr, &pd->ndaddr, pd->af)) { |
4815 | pf_change_a(&daddr->v4addr.s_addr, |
4816 | pd->ip_sum, |
4817 | pd->ndaddr.v4addr.s_addr, 0); |
4818 | } |
4819 | break; |
4820 | #endif /* INET */ |
4821 | #if INET6 |
4822 | case AF_INET6: |
4823 | if (PF_ANEQ(saddr, &pd->naddr, pd->af)) |
4824 | PF_ACPY(saddr, &pd->naddr, AF_INET6); |
4825 | if (PF_ANEQ(daddr, &pd->ndaddr, pd->af)) |
4826 | PF_ACPY(daddr, &pd->ndaddr, AF_INET6); |
4827 | break; |
4828 | #endif /* INET6 */ |
4829 | } |
4830 | ++rewrite; |
4831 | break; |
4832 | case IPPROTO_ESP: |
4833 | if (direction == PF_OUT) |
4834 | bxport.spi = 0; |
4835 | |
4836 | switch (pd->af) { |
4837 | #if INET |
4838 | case AF_INET: |
4839 | if (PF_ANEQ(saddr, &pd->naddr, pd->af)) { |
4840 | pf_change_a(&saddr->v4addr.s_addr, |
4841 | pd->ip_sum, pd->naddr.v4addr.s_addr, 0); |
4842 | } |
4843 | if (PF_ANEQ(daddr, &pd->ndaddr, pd->af)) { |
4844 | pf_change_a(&daddr->v4addr.s_addr, |
4845 | pd->ip_sum, |
4846 | pd->ndaddr.v4addr.s_addr, 0); |
4847 | } |
4848 | break; |
4849 | #endif /* INET */ |
4850 | #if INET6 |
4851 | case AF_INET6: |
4852 | if (PF_ANEQ(saddr, &pd->naddr, pd->af)) |
4853 | PF_ACPY(saddr, &pd->naddr, AF_INET6); |
4854 | if (PF_ANEQ(daddr, &pd->ndaddr, pd->af)) |
4855 | PF_ACPY(daddr, &pd->ndaddr, AF_INET6); |
4856 | break; |
4857 | #endif /* INET6 */ |
4858 | } |
4859 | break; |
4860 | default: |
4861 | switch (pd->af) { |
4862 | #if INET |
4863 | case AF_INET: |
4864 | if ((pd->naf != AF_INET) || |
4865 | (PF_ANEQ(saddr, &pd->naddr, pd->af))) { |
4866 | pf_change_addr(saddr, pd->ip_sum, |
4867 | &pd->naddr, 0, af, pd->naf); |
4868 | } |
4869 | |
4870 | if ((pd->naf != AF_INET) || |
4871 | (PF_ANEQ(daddr, &pd->ndaddr, pd->af))) { |
4872 | pf_change_addr(daddr, pd->ip_sum, |
4873 | &pd->ndaddr, 0, af, pd->naf); |
4874 | } |
4875 | break; |
4876 | #endif /* INET */ |
4877 | #if INET6 |
4878 | case AF_INET6: |
4879 | if (PF_ANEQ(saddr, &pd->naddr, pd->af)) |
4880 | PF_ACPY(saddr, &pd->naddr, af); |
4881 | if (PF_ANEQ(daddr, &pd->ndaddr, pd->af)) |
4882 | PF_ACPY(daddr, &pd->ndaddr, af); |
4883 | break; |
4884 | #endif /* INET */ |
4885 | } |
4886 | break; |
4887 | } |
4888 | |
4889 | if (nr->natpass) |
4890 | r = NULL; |
4891 | pd->nat_rule = nr; |
4892 | pd->af = pd->naf; |
4893 | } else { |
4894 | } |
4895 | |
4896 | if (nr && nr->tag > 0) |
4897 | tag = nr->tag; |
4898 | |
4899 | while (r != NULL) { |
4900 | r->evaluations++; |
4901 | if (pfi_kif_match(r->kif, kif) == r->ifnot) |
4902 | r = r->skip[PF_SKIP_IFP].ptr; |
4903 | else if (r->direction && r->direction != direction) |
4904 | r = r->skip[PF_SKIP_DIR].ptr; |
4905 | else if (r->af && r->af != pd->af) |
4906 | r = r->skip[PF_SKIP_AF].ptr; |
4907 | else if (r->proto && r->proto != pd->proto) |
4908 | r = r->skip[PF_SKIP_PROTO].ptr; |
4909 | else if (PF_MISMATCHAW(&r->src.addr, saddr, pd->af, |
4910 | r->src.neg, kif)) |
4911 | r = r->skip[PF_SKIP_SRC_ADDR].ptr; |
4912 | /* tcp/udp only. port_op always 0 in other cases */ |
4913 | else if (r->proto == pd->proto && |
4914 | (r->proto == IPPROTO_TCP || r->proto == IPPROTO_UDP) && |
4915 | r->src.xport.range.op && |
4916 | !pf_match_port(r->src.xport.range.op, |
4917 | r->src.xport.range.port[0], r->src.xport.range.port[1], |
4918 | th->th_sport)) |
4919 | r = r->skip[PF_SKIP_SRC_PORT].ptr; |
4920 | else if (PF_MISMATCHAW(&r->dst.addr, daddr, pd->af, |
4921 | r->dst.neg, NULL)) |
4922 | r = r->skip[PF_SKIP_DST_ADDR].ptr; |
4923 | /* tcp/udp only. port_op always 0 in other cases */ |
4924 | else if (r->proto == pd->proto && |
4925 | (r->proto == IPPROTO_TCP || r->proto == IPPROTO_UDP) && |
4926 | r->dst.xport.range.op && |
4927 | !pf_match_port(r->dst.xport.range.op, |
4928 | r->dst.xport.range.port[0], r->dst.xport.range.port[1], |
4929 | th->th_dport)) |
4930 | r = r->skip[PF_SKIP_DST_PORT].ptr; |
4931 | /* icmp only. type always 0 in other cases */ |
4932 | else if (r->type && r->type != icmptype + 1) |
4933 | r = TAILQ_NEXT(r, entries); |
4934 | /* icmp only. type always 0 in other cases */ |
4935 | else if (r->code && r->code != icmpcode + 1) |
4936 | r = TAILQ_NEXT(r, entries); |
4937 | else if ((r->rule_flag & PFRULE_TOS) && r->tos && |
4938 | !(r->tos & pd->tos)) |
4939 | r = TAILQ_NEXT(r, entries); |
4940 | else if ((r->rule_flag & PFRULE_DSCP) && r->tos && |
4941 | !(r->tos & (pd->tos & DSCP_MASK))) |
4942 | r = TAILQ_NEXT(r, entries); |
4943 | else if ((r->rule_flag & PFRULE_SC) && r->tos && |
4944 | ((r->tos & SCIDX_MASK) != pd->sc)) |
4945 | r = TAILQ_NEXT(r, entries); |
4946 | else if (r->rule_flag & PFRULE_FRAGMENT) |
4947 | r = TAILQ_NEXT(r, entries); |
4948 | else if (pd->proto == IPPROTO_TCP && |
4949 | (r->flagset & th->th_flags) != r->flags) |
4950 | r = TAILQ_NEXT(r, entries); |
4951 | /* tcp/udp only. uid.op always 0 in other cases */ |
4952 | else if (r->uid.op && (pd->lookup.done || ((void)(pd->lookup.done = |
4953 | pf_socket_lookup(direction, pd)), 1)) && |
4954 | !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1], |
4955 | pd->lookup.uid)) |
4956 | r = TAILQ_NEXT(r, entries); |
4957 | /* tcp/udp only. gid.op always 0 in other cases */ |
4958 | else if (r->gid.op && (pd->lookup.done || ((void)(pd->lookup.done = |
4959 | pf_socket_lookup(direction, pd)), 1)) && |
4960 | !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1], |
4961 | pd->lookup.gid)) |
4962 | r = TAILQ_NEXT(r, entries); |
4963 | else if (r->prob && r->prob <= (RandomULong() % (UINT_MAX - 1) + 1)) |
4964 | r = TAILQ_NEXT(r, entries); |
4965 | else if (r->match_tag && !pf_match_tag(r, pd->pf_mtag, &tag)) |
4966 | r = TAILQ_NEXT(r, entries); |
4967 | else if (r->os_fingerprint != PF_OSFP_ANY && |
4968 | (pd->proto != IPPROTO_TCP || !pf_osfp_match( |
4969 | pf_osfp_fingerprint(pd, pbuf, off, th), |
4970 | r->os_fingerprint))) |
4971 | r = TAILQ_NEXT(r, entries); |
4972 | else { |
4973 | if (r->tag) |
4974 | tag = r->tag; |
4975 | if (PF_RTABLEID_IS_VALID(r->rtableid)) |
4976 | rtableid = r->rtableid; |
4977 | if (r->anchor == NULL) { |
4978 | match = 1; |
4979 | *rm = r; |
4980 | *am = a; |
4981 | *rsm = ruleset; |
4982 | if ((*rm)->quick) |
4983 | break; |
4984 | r = TAILQ_NEXT(r, entries); |
4985 | } else |
4986 | pf_step_into_anchor(&asd, &ruleset, |
4987 | PF_RULESET_FILTER, &r, &a, &match); |
4988 | } |
4989 | if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset, |
4990 | PF_RULESET_FILTER, &r, &a, &match)) |
4991 | break; |
4992 | } |
4993 | r = *rm; |
4994 | a = *am; |
4995 | ruleset = *rsm; |
4996 | |
4997 | REASON_SET(&reason, PFRES_MATCH); |
4998 | |
4999 | if (r->log || (nr != NULL && nr->log)) { |
5000 | if (rewrite > 0) { |
5001 | if (rewrite < off + hdrlen) |
5002 | rewrite = off + hdrlen; |
5003 | |
5004 | if (pf_lazy_makewritable(pd, pbuf, rewrite) == NULL) { |
5005 | REASON_SET(&reason, PFRES_MEMORY); |
5006 | return (PF_DROP); |
5007 | } |
5008 | |
5009 | pbuf_copy_back(pbuf, off, hdrlen, pd->hdr.any); |
5010 | } |
5011 | PFLOG_PACKET(kif, h, pbuf, pd->af, direction, reason, |
5012 | r->log ? r : nr, a, ruleset, pd); |
5013 | } |
5014 | |
5015 | if ((r->action == PF_DROP) && |
5016 | ((r->rule_flag & PFRULE_RETURNRST) || |
5017 | (r->rule_flag & PFRULE_RETURNICMP) || |
5018 | (r->rule_flag & PFRULE_RETURN))) { |
5019 | /* undo NAT changes, if they have taken place */ |
5020 | /* XXX For NAT64 we are not reverting the changes */ |
5021 | if (nr != NULL && nr->action != PF_NAT64) { |
5022 | if (direction == PF_OUT) { |
5023 | pd->af = af; |
5024 | switch (pd->proto) { |
5025 | case IPPROTO_TCP: |
5026 | pf_change_ap(direction, pd->mp, saddr, |
5027 | &th->th_sport, pd->ip_sum, |
5028 | &th->th_sum, &pd->baddr, |
5029 | bxport.port, 0, af, pd->af, 1); |
5030 | sxport.port = th->th_sport; |
5031 | rewrite++; |
5032 | break; |
5033 | case IPPROTO_UDP: |
5034 | pf_change_ap(direction, pd->mp, saddr, |
5035 | &pd->hdr.udp->uh_sport, pd->ip_sum, |
5036 | &pd->hdr.udp->uh_sum, &pd->baddr, |
5037 | bxport.port, 1, af, pd->af, 1); |
5038 | sxport.port = pd->hdr.udp->uh_sport; |
5039 | rewrite++; |
5040 | break; |
5041 | case IPPROTO_ICMP: |
5042 | #if INET6 |
5043 | case IPPROTO_ICMPV6: |
5044 | #endif |
5045 | /* nothing! */ |
5046 | break; |
5047 | case IPPROTO_GRE: |
5048 | PF_ACPY(&pd->baddr, saddr, af); |
5049 | ++rewrite; |
5050 | switch (af) { |
5051 | #if INET |
5052 | case AF_INET: |
5053 | pf_change_a(&saddr->v4addr.s_addr, |
5054 | pd->ip_sum, |
5055 | pd->baddr.v4addr.s_addr, 0); |
5056 | break; |
5057 | #endif /* INET */ |
5058 | #if INET6 |
5059 | case AF_INET6: |
5060 | PF_ACPY(saddr, &pd->baddr, |
5061 | AF_INET6); |
5062 | break; |
5063 | #endif /* INET6 */ |
5064 | } |
5065 | break; |
5066 | case IPPROTO_ESP: |
5067 | PF_ACPY(&pd->baddr, saddr, af); |
5068 | switch (af) { |
5069 | #if INET |
5070 | case AF_INET: |
5071 | pf_change_a(&saddr->v4addr.s_addr, |
5072 | pd->ip_sum, |
5073 | pd->baddr.v4addr.s_addr, 0); |
5074 | break; |
5075 | #endif /* INET */ |
5076 | #if INET6 |
5077 | case AF_INET6: |
5078 | PF_ACPY(saddr, &pd->baddr, |
5079 | AF_INET6); |
5080 | break; |
5081 | #endif /* INET6 */ |
5082 | } |
5083 | break; |
5084 | default: |
5085 | switch (af) { |
5086 | case AF_INET: |
5087 | pf_change_a(&saddr->v4addr.s_addr, |
5088 | pd->ip_sum, |
5089 | pd->baddr.v4addr.s_addr, 0); |
5090 | break; |
5091 | case AF_INET6: |
5092 | PF_ACPY(saddr, &pd->baddr, af); |
5093 | break; |
5094 | } |
5095 | } |
5096 | } else { |
5097 | switch (pd->proto) { |
5098 | case IPPROTO_TCP: |
5099 | pf_change_ap(direction, pd->mp, daddr, |
5100 | &th->th_dport, pd->ip_sum, |
5101 | &th->th_sum, &pd->bdaddr, |
5102 | bdxport.port, 0, af, pd->af, 1); |
5103 | dxport.port = th->th_dport; |
5104 | rewrite++; |
5105 | break; |
5106 | case IPPROTO_UDP: |
5107 | pf_change_ap(direction, pd->mp, daddr, |
5108 | &pd->hdr.udp->uh_dport, pd->ip_sum, |
5109 | &pd->hdr.udp->uh_sum, &pd->bdaddr, |
5110 | bdxport.port, 1, af, pd->af, 1); |
5111 | dxport.port = pd->hdr.udp->uh_dport; |
5112 | rewrite++; |
5113 | break; |
5114 | case IPPROTO_ICMP: |
5115 | #if INET6 |
5116 | case IPPROTO_ICMPV6: |
5117 | #endif |
5118 | /* nothing! */ |
5119 | break; |
5120 | case IPPROTO_GRE: |
5121 | if (pd->proto_variant == |
5122 | PF_GRE_PPTP_VARIANT) |
5123 | grev1->call_id = |
5124 | bdxport.call_id; |
5125 | ++rewrite; |
5126 | switch (af) { |
5127 | #if INET |
5128 | case AF_INET: |
5129 | pf_change_a(&daddr->v4addr.s_addr, |
5130 | pd->ip_sum, |
5131 | pd->bdaddr.v4addr.s_addr, 0); |
5132 | break; |
5133 | #endif /* INET */ |
5134 | #if INET6 |
5135 | case AF_INET6: |
5136 | PF_ACPY(daddr, &pd->bdaddr, |
5137 | AF_INET6); |
5138 | break; |
5139 | #endif /* INET6 */ |
5140 | } |
5141 | break; |
5142 | case IPPROTO_ESP: |
5143 | switch (af) { |
5144 | #if INET |
5145 | case AF_INET: |
5146 | pf_change_a(&daddr->v4addr.s_addr, |
5147 | pd->ip_sum, |
5148 | pd->bdaddr.v4addr.s_addr, 0); |
5149 | break; |
5150 | #endif /* INET */ |
5151 | #if INET6 |
5152 | case AF_INET6: |
5153 | PF_ACPY(daddr, &pd->bdaddr, |
5154 | AF_INET6); |
5155 | break; |
5156 | #endif /* INET6 */ |
5157 | } |
5158 | break; |
5159 | default: |
5160 | switch (af) { |
5161 | case AF_INET: |
5162 | pf_change_a(&daddr->v4addr.s_addr, |
5163 | pd->ip_sum, |
5164 | pd->bdaddr.v4addr.s_addr, 0); |
5165 | break; |
5166 | #if INET6 |
5167 | case AF_INET6: |
5168 | PF_ACPY(daddr, &pd->bdaddr, af); |
5169 | break; |
5170 | #endif /* INET6 */ |
5171 | } |
5172 | } |
5173 | } |
5174 | } |
5175 | if (pd->proto == IPPROTO_TCP && |
5176 | ((r->rule_flag & PFRULE_RETURNRST) || |
5177 | (r->rule_flag & PFRULE_RETURN)) && |
5178 | !(th->th_flags & TH_RST)) { |
5179 | u_int32_t ack = ntohl(th->th_seq) + pd->p_len; |
5180 | int len = 0; |
5181 | struct ip *h4; |
5182 | #if INET6 |
5183 | struct ip6_hdr *h6; |
5184 | #endif /* INET6 */ |
5185 | |
5186 | switch (pd->af) { |
5187 | case AF_INET: |
5188 | h4 = pbuf->pb_data; |
5189 | len = ntohs(h4->ip_len) - off; |
5190 | break; |
5191 | #if INET6 |
5192 | case AF_INET6: |
5193 | h6 = pbuf->pb_data; |
5194 | len = ntohs(h6->ip6_plen) - |
5195 | (off - sizeof (*h6)); |
5196 | break; |
5197 | #endif /* INET6 */ |
5198 | } |
5199 | |
5200 | if (pf_check_proto_cksum(pbuf, off, len, IPPROTO_TCP, |
5201 | pd->af)) |
5202 | REASON_SET(&reason, PFRES_PROTCKSUM); |
5203 | else { |
5204 | if (th->th_flags & TH_SYN) |
5205 | ack++; |
5206 | if (th->th_flags & TH_FIN) |
5207 | ack++; |
5208 | pf_send_tcp(r, pd->af, pd->dst, |
5209 | pd->src, th->th_dport, th->th_sport, |
5210 | ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0, |
5211 | r->return_ttl, 1, 0, pd->eh, kif->pfik_ifp); |
5212 | } |
5213 | } else if (pd->proto != IPPROTO_ICMP && pd->af == AF_INET && |
5214 | pd->proto != IPPROTO_ESP && pd->proto != IPPROTO_AH && |
5215 | r->return_icmp) |
5216 | pf_send_icmp(pbuf, r->return_icmp >> 8, |
5217 | r->return_icmp & 255, pd->af, r); |
5218 | else if (pd->proto != IPPROTO_ICMPV6 && af == AF_INET6 && |
5219 | pd->proto != IPPROTO_ESP && pd->proto != IPPROTO_AH && |
5220 | r->return_icmp6) |
5221 | pf_send_icmp(pbuf, r->return_icmp6 >> 8, |
5222 | r->return_icmp6 & 255, pd->af, r); |
5223 | } |
5224 | |
5225 | if (r->action == PF_DROP) { |
5226 | return (PF_DROP); |
5227 | } |
5228 | |
5229 | /* prepare state key, for flowhash and/or the state (if created) */ |
5230 | bzero(&psk, sizeof (psk)); |
5231 | psk.proto = pd->proto; |
5232 | psk.direction = direction; |
5233 | if (pd->proto == IPPROTO_UDP) { |
5234 | if (ntohs(pd->hdr.udp->uh_sport) == PF_IKE_PORT && |
5235 | ntohs(pd->hdr.udp->uh_dport) == PF_IKE_PORT) { |
5236 | psk.proto_variant = PF_EXTFILTER_APD; |
5237 | } else { |
5238 | psk.proto_variant = nr ? nr->extfilter : r->extfilter; |
5239 | if (psk.proto_variant < PF_EXTFILTER_APD) |
5240 | psk.proto_variant = PF_EXTFILTER_APD; |
5241 | } |
5242 | } else if (pd->proto == IPPROTO_GRE) { |
5243 | psk.proto_variant = pd->proto_variant; |
5244 | } |
5245 | if (direction == PF_OUT) { |
5246 | psk.af_gwy = af; |
5247 | PF_ACPY(&psk.gwy.addr, saddr, af); |
5248 | PF_ACPY(&psk.ext_gwy.addr, daddr, af); |
5249 | switch (pd->proto) { |
5250 | case IPPROTO_ESP: |
5251 | psk.gwy.xport.spi = 0; |
5252 | psk.ext_gwy.xport.spi = pd->hdr.esp->spi; |
5253 | break; |
5254 | case IPPROTO_ICMP: |
5255 | #if INET6 |
5256 | case IPPROTO_ICMPV6: |
5257 | #endif |
5258 | /* |
5259 | * NAT64 requires protocol translation between ICMPv4 |
5260 | * and ICMPv6. TCP and UDP do not require protocol |
5261 | * translation. To avoid adding complexity just to |
5262 | * handle ICMP(v4addr/v6addr), we always lookup for |
5263 | * proto = IPPROTO_ICMP on both LAN and WAN side |
5264 | */ |
5265 | psk.proto = IPPROTO_ICMP; |
5266 | psk.gwy.xport.port = nxport.port; |
5267 | psk.ext_gwy.xport.spi = 0; |
5268 | break; |
5269 | default: |
5270 | psk.gwy.xport = sxport; |
5271 | psk.ext_gwy.xport = dxport; |
5272 | break; |
5273 | } |
5274 | psk.af_lan = af; |
5275 | if (nr != NULL) { |
5276 | PF_ACPY(&psk.lan.addr, &pd->baddr, af); |
5277 | psk.lan.xport = bxport; |
5278 | PF_ACPY(&psk.ext_lan.addr, &pd->bdaddr, af); |
5279 | psk.ext_lan.xport = bdxport; |
5280 | } else { |
5281 | PF_ACPY(&psk.lan.addr, &psk.gwy.addr, af); |
5282 | psk.lan.xport = psk.gwy.xport; |
5283 | PF_ACPY(&psk.ext_lan.addr, &psk.ext_gwy.addr, af); |
5284 | psk.ext_lan.xport = psk.ext_gwy.xport; |
5285 | } |
5286 | } else { |
5287 | psk.af_lan = af; |
5288 | if (nr && nr->action == PF_NAT64) { |
5289 | PF_ACPY(&psk.lan.addr, &pd->baddr, af); |
5290 | PF_ACPY(&psk.ext_lan.addr, &pd->bdaddr, af); |
5291 | } else { |
5292 | PF_ACPY(&psk.lan.addr, daddr, af); |
5293 | PF_ACPY(&psk.ext_lan.addr, saddr, af); |
5294 | } |
5295 | switch (pd->proto) { |
5296 | case IPPROTO_ICMP: |
5297 | #if INET6 |
5298 | case IPPROTO_ICMPV6: |
5299 | #endif |
5300 | /* |
5301 | * NAT64 requires protocol translation between ICMPv4 |
5302 | * and ICMPv6. TCP and UDP do not require protocol |
5303 | * translation. To avoid adding complexity just to |
5304 | * handle ICMP(v4addr/v6addr), we always lookup for |
5305 | * proto = IPPROTO_ICMP on both LAN and WAN side |
5306 | */ |
5307 | psk.proto = IPPROTO_ICMP; |
5308 | if (nr && nr->action == PF_NAT64) { |
5309 | psk.lan.xport = bxport; |
5310 | psk.ext_lan.xport = bxport; |
5311 | } else { |
5312 | psk.lan.xport = nxport; |
5313 | psk.ext_lan.xport.spi = 0; |
5314 | } |
5315 | break; |
5316 | case IPPROTO_ESP: |
5317 | psk.ext_lan.xport.spi = 0; |
5318 | psk.lan.xport.spi = pd->hdr.esp->spi; |
5319 | break; |
5320 | default: |
5321 | if (nr != NULL) { |
5322 | if (nr->action == PF_NAT64) { |
5323 | psk.lan.xport = bxport; |
5324 | psk.ext_lan.xport = bdxport; |
5325 | } else { |
5326 | psk.lan.xport = dxport; |
5327 | psk.ext_lan.xport = sxport; |
5328 | } |
5329 | } else { |
5330 | psk.lan.xport = dxport; |
5331 | psk.ext_lan.xport = sxport; |
5332 | } |
5333 | break; |
5334 | } |
5335 | psk.af_gwy = pd->naf; |
5336 | if (nr != NULL) { |
5337 | if (nr->action == PF_NAT64) { |
5338 | PF_ACPY(&psk.gwy.addr, &pd->naddr, pd->naf); |
5339 | PF_ACPY(&psk.ext_gwy.addr, &pd->ndaddr, |
5340 | pd->naf); |
5341 | if ((pd->proto == IPPROTO_ICMPV6) || |
5342 | (pd->proto == IPPROTO_ICMP)) { |
5343 | psk.gwy.xport = nxport; |
5344 | psk.ext_gwy.xport = nxport; |
5345 | } else { |
5346 | psk.gwy.xport = sxport; |
5347 | psk.ext_gwy.xport = dxport; |
5348 | } |
5349 | } else { |
5350 | PF_ACPY(&psk.gwy.addr, &pd->bdaddr, af); |
5351 | psk.gwy.xport = bdxport; |
5352 | PF_ACPY(&psk.ext_gwy.addr, saddr, af); |
5353 | psk.ext_gwy.xport = sxport; |
5354 | } |
5355 | } else { |
5356 | PF_ACPY(&psk.gwy.addr, &psk.lan.addr, af); |
5357 | psk.gwy.xport = psk.lan.xport; |
5358 | PF_ACPY(&psk.ext_gwy.addr, &psk.ext_lan.addr, af); |
5359 | psk.ext_gwy.xport = psk.ext_lan.xport; |
5360 | } |
5361 | } |
5362 | if (pd->pktflags & PKTF_FLOW_ID) { |
5363 | /* flow hash was already computed outside of PF */ |
5364 | psk.flowsrc = pd->flowsrc; |
5365 | psk.flowhash = pd->flowhash; |
5366 | } else { |
5367 | /* compute flow hash and store it in state key */ |
5368 | psk.flowsrc = FLOWSRC_PF; |
5369 | psk.flowhash = pf_calc_state_key_flowhash(&psk); |
5370 | pd->flowsrc = psk.flowsrc; |
5371 | pd->flowhash = psk.flowhash; |
5372 | pd->pktflags |= PKTF_FLOW_ID; |
5373 | pd->pktflags &= ~PKTF_FLOW_ADV; |
5374 | } |
5375 | |
5376 | if (pf_tag_packet(pbuf, pd->pf_mtag, tag, rtableid, pd)) { |
5377 | REASON_SET(&reason, PFRES_MEMORY); |
5378 | return (PF_DROP); |
5379 | } |
5380 | |
5381 | if (!state_icmp && (r->keep_state || nr != NULL || |
5382 | (pd->flags & PFDESC_TCP_NORM))) { |
5383 | /* create new state */ |
5384 | struct pf_state *s = NULL; |
5385 | struct pf_state_key *sk = NULL; |
5386 | struct pf_src_node *sn = NULL; |
5387 | struct pf_ike_hdr ike; |
5388 | |
5389 | if (pd->proto == IPPROTO_UDP) { |
5390 | size_t plen = pbuf->pb_packet_len - off - sizeof(*uh); |
5391 | |
5392 | if (ntohs(uh->uh_sport) == PF_IKE_PORT && |
5393 | ntohs(uh->uh_dport) == PF_IKE_PORT && |
5394 | plen >= PF_IKE_PACKET_MINSIZE) { |
5395 | if (plen > PF_IKE_PACKET_MINSIZE) |
5396 | plen = PF_IKE_PACKET_MINSIZE; |
5397 | pbuf_copy_data(pbuf, off + sizeof (*uh), plen, |
5398 | &ike); |
5399 | } |
5400 | } |
5401 | |
5402 | if (nr != NULL && pd->proto == IPPROTO_ESP && |
5403 | direction == PF_OUT) { |
5404 | struct pf_state_key_cmp sk0; |
5405 | struct pf_state *s0; |
5406 | |
5407 | /* |
5408 | * <jhw@apple.com> |
5409 | * This squelches state creation if the external |
5410 | * address matches an existing incomplete state with a |
5411 | * different internal address. Only one 'blocking' |
5412 | * partial state is allowed for each external address. |
5413 | */ |
5414 | memset(&sk0, 0, sizeof (sk0)); |
5415 | sk0.af_gwy = pd->af; |
5416 | sk0.proto = IPPROTO_ESP; |
5417 | PF_ACPY(&sk0.gwy.addr, saddr, sk0.af_gwy); |
5418 | PF_ACPY(&sk0.ext_gwy.addr, daddr, sk0.af_gwy); |
5419 | s0 = pf_find_state(kif, &sk0, PF_IN); |
5420 | |
5421 | if (s0 && PF_ANEQ(&s0->state_key->lan.addr, |
5422 | pd->src, pd->af)) { |
5423 | nsn = 0; |
5424 | goto cleanup; |
5425 | } |
5426 | } |
5427 | |
5428 | /* check maximums */ |
5429 | if (r->max_states && (r->states >= r->max_states)) { |
5430 | pf_status.lcounters[LCNT_STATES]++; |
5431 | REASON_SET(&reason, PFRES_MAXSTATES); |
5432 | goto cleanup; |
5433 | } |
5434 | /* src node for filter rule */ |
5435 | if ((r->rule_flag & PFRULE_SRCTRACK || |
5436 | r->rpool.opts & PF_POOL_STICKYADDR) && |
5437 | pf_insert_src_node(&sn, r, saddr, af) != 0) { |
5438 | REASON_SET(&reason, PFRES_SRCLIMIT); |
5439 | goto cleanup; |
5440 | } |
5441 | /* src node for translation rule */ |
5442 | if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) && |
5443 | ((direction == PF_OUT && |
5444 | nr->action != PF_RDR && |
5445 | pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) || |
5446 | (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) { |
5447 | REASON_SET(&reason, PFRES_SRCLIMIT); |
5448 | goto cleanup; |
5449 | } |
5450 | s = pool_get(&pf_state_pl, PR_WAITOK); |
5451 | if (s == NULL) { |
5452 | REASON_SET(&reason, PFRES_MEMORY); |
5453 | cleanup: |
5454 | if (sn != NULL && sn->states == 0 && sn->expire == 0) { |
5455 | RB_REMOVE(pf_src_tree, &tree_src_tracking, sn); |
5456 | pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; |
5457 | pf_status.src_nodes--; |
5458 | pool_put(&pf_src_tree_pl, sn); |
5459 | } |
5460 | if (nsn != sn && nsn != NULL && nsn->states == 0 && |
5461 | nsn->expire == 0) { |
5462 | RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn); |
5463 | pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; |
5464 | pf_status.src_nodes--; |
5465 | pool_put(&pf_src_tree_pl, nsn); |
5466 | } |
5467 | if (sk != NULL) { |
5468 | if (sk->app_state) |
5469 | pool_put(&pf_app_state_pl, |
5470 | sk->app_state); |
5471 | pool_put(&pf_state_key_pl, sk); |
5472 | } |
5473 | return (PF_DROP); |
5474 | } |
5475 | bzero(s, sizeof (*s)); |
5476 | TAILQ_INIT(&s->unlink_hooks); |
5477 | s->rule.ptr = r; |
5478 | s->nat_rule.ptr = nr; |
5479 | s->anchor.ptr = a; |
5480 | STATE_INC_COUNTERS(s); |
5481 | s->allow_opts = r->allow_opts; |
5482 | s->log = r->log & PF_LOG_ALL; |
5483 | if (nr != NULL) |
5484 | s->log |= nr->log & PF_LOG_ALL; |
5485 | switch (pd->proto) { |
5486 | case IPPROTO_TCP: |
5487 | s->src.seqlo = ntohl(th->th_seq); |
5488 | s->src.seqhi = s->src.seqlo + pd->p_len + 1; |
5489 | if ((th->th_flags & (TH_SYN|TH_ACK)) == |
5490 | TH_SYN && r->keep_state == PF_STATE_MODULATE) { |
5491 | /* Generate sequence number modulator */ |
5492 | if ((s->src.seqdiff = pf_tcp_iss(pd) - |
5493 | s->src.seqlo) == 0) |
5494 | s->src.seqdiff = 1; |
5495 | pf_change_a(&th->th_seq, &th->th_sum, |
5496 | htonl(s->src.seqlo + s->src.seqdiff), 0); |
5497 | rewrite = off + sizeof (*th); |
5498 | } else |
5499 | s->src.seqdiff = 0; |
5500 | if (th->th_flags & TH_SYN) { |
5501 | s->src.seqhi++; |
5502 | s->src.wscale = pf_get_wscale(pbuf, off, |
5503 | th->th_off, af); |
5504 | } |
5505 | s->src.max_win = MAX(ntohs(th->th_win), 1); |
5506 | if (s->src.wscale & PF_WSCALE_MASK) { |
5507 | /* Remove scale factor from initial window */ |
5508 | int win = s->src.max_win; |
5509 | win += 1 << (s->src.wscale & PF_WSCALE_MASK); |
5510 | s->src.max_win = (win - 1) >> |
5511 | (s->src.wscale & PF_WSCALE_MASK); |
5512 | } |
5513 | if (th->th_flags & TH_FIN) |
5514 | s->src.seqhi++; |
5515 | s->dst.seqhi = 1; |
5516 | s->dst.max_win = 1; |
5517 | s->src.state = TCPS_SYN_SENT; |
5518 | s->dst.state = TCPS_CLOSED; |
5519 | s->timeout = PFTM_TCP_FIRST_PACKET; |
5520 | break; |
5521 | case IPPROTO_UDP: |
5522 | s->src.state = PFUDPS_SINGLE; |
5523 | s->dst.state = PFUDPS_NO_TRAFFIC; |
5524 | s->timeout = PFTM_UDP_FIRST_PACKET; |
5525 | break; |
5526 | case IPPROTO_ICMP: |
5527 | #if INET6 |
5528 | case IPPROTO_ICMPV6: |
5529 | #endif |
5530 | s->timeout = PFTM_ICMP_FIRST_PACKET; |
5531 | break; |
5532 | case IPPROTO_GRE: |
5533 | s->src.state = PFGRE1S_INITIATING; |
5534 | s->dst.state = PFGRE1S_NO_TRAFFIC; |
5535 | s->timeout = PFTM_GREv1_INITIATING; |
5536 | break; |
5537 | case IPPROTO_ESP: |
5538 | s->src.state = PFESPS_INITIATING; |
5539 | s->dst.state = PFESPS_NO_TRAFFIC; |
5540 | s->timeout = PFTM_ESP_FIRST_PACKET; |
5541 | break; |
5542 | default: |
5543 | s->src.state = PFOTHERS_SINGLE; |
5544 | s->dst.state = PFOTHERS_NO_TRAFFIC; |
5545 | s->timeout = PFTM_OTHER_FIRST_PACKET; |
5546 | } |
5547 | |
5548 | s->creation = pf_time_second(); |
5549 | s->expire = pf_time_second(); |
5550 | |
5551 | if (sn != NULL) { |
5552 | s->src_node = sn; |
5553 | s->src_node->states++; |
5554 | VERIFY(s->src_node->states != 0); |
5555 | } |
5556 | if (nsn != NULL) { |
5557 | PF_ACPY(&nsn->raddr, &pd->naddr, af); |
5558 | s->nat_src_node = nsn; |
5559 | s->nat_src_node->states++; |
5560 | VERIFY(s->nat_src_node->states != 0); |
5561 | } |
5562 | if (pd->proto == IPPROTO_TCP) { |
5563 | if ((pd->flags & PFDESC_TCP_NORM) && |
5564 | pf_normalize_tcp_init(pbuf, off, pd, th, &s->src, |
5565 | &s->dst)) { |
5566 | REASON_SET(&reason, PFRES_MEMORY); |
5567 | pf_src_tree_remove_state(s); |
5568 | STATE_DEC_COUNTERS(s); |
5569 | pool_put(&pf_state_pl, s); |
5570 | return (PF_DROP); |
5571 | } |
5572 | if ((pd->flags & PFDESC_TCP_NORM) && s->src.scrub && |
5573 | pf_normalize_tcp_stateful(pbuf, off, pd, &reason, |
5574 | th, s, &s->src, &s->dst, &rewrite)) { |
5575 | /* This really shouldn't happen!!! */ |
5576 | DPFPRINTF(PF_DEBUG_URGENT, |
5577 | ("pf_normalize_tcp_stateful failed on " |
5578 | "first pkt" )); |
5579 | pf_normalize_tcp_cleanup(s); |
5580 | pf_src_tree_remove_state(s); |
5581 | STATE_DEC_COUNTERS(s); |
5582 | pool_put(&pf_state_pl, s); |
5583 | return (PF_DROP); |
5584 | } |
5585 | } |
5586 | |
5587 | /* allocate state key and import values from psk */ |
5588 | if ((sk = pf_alloc_state_key(s, &psk)) == NULL) { |
5589 | REASON_SET(&reason, PFRES_MEMORY); |
5590 | /* |
5591 | * XXXSCW: This will leak the freshly-allocated |
5592 | * state structure 's'. Although it should |
5593 | * eventually be aged-out and removed. |
5594 | */ |
5595 | goto cleanup; |
5596 | } |
5597 | |
5598 | pf_set_rt_ifp(s, saddr, af); /* needs s->state_key set */ |
5599 | |
5600 | pbuf = pd->mp; // XXXSCW: Why? |
5601 | |
5602 | if (sk->app_state == 0) { |
5603 | switch (pd->proto) { |
5604 | case IPPROTO_TCP: { |
5605 | u_int16_t dport = (direction == PF_OUT) ? |
5606 | sk->ext_gwy.xport.port : sk->gwy.xport.port; |
5607 | |
5608 | if (nr != NULL && |
5609 | ntohs(dport) == PF_PPTP_PORT) { |
5610 | struct pf_app_state *as; |
5611 | |
5612 | as = pool_get(&pf_app_state_pl, |
5613 | PR_WAITOK); |
5614 | if (!as) { |
5615 | REASON_SET(&reason, |
5616 | PFRES_MEMORY); |
5617 | goto cleanup; |
5618 | } |
5619 | |
5620 | bzero(as, sizeof (*as)); |
5621 | as->handler = pf_pptp_handler; |
5622 | as->compare_lan_ext = 0; |
5623 | as->compare_ext_gwy = 0; |
5624 | as->u.pptp.grev1_state = 0; |
5625 | sk->app_state = as; |
5626 | (void) hook_establish(&s->unlink_hooks, |
5627 | 0, (hook_fn_t) pf_pptp_unlink, s); |
5628 | } |
5629 | break; |
5630 | } |
5631 | |
5632 | case IPPROTO_UDP: { |
5633 | if (nr != NULL && |
5634 | ntohs(uh->uh_sport) == PF_IKE_PORT && |
5635 | ntohs(uh->uh_dport) == PF_IKE_PORT) { |
5636 | struct pf_app_state *as; |
5637 | |
5638 | as = pool_get(&pf_app_state_pl, |
5639 | PR_WAITOK); |
5640 | if (!as) { |
5641 | REASON_SET(&reason, |
5642 | PFRES_MEMORY); |
5643 | goto cleanup; |
5644 | } |
5645 | |
5646 | bzero(as, sizeof (*as)); |
5647 | as->compare_lan_ext = pf_ike_compare; |
5648 | as->compare_ext_gwy = pf_ike_compare; |
5649 | as->u.ike.cookie = ike.initiator_cookie; |
5650 | sk->app_state = as; |
5651 | } |
5652 | break; |
5653 | } |
5654 | |
5655 | default: |
5656 | break; |
5657 | } |
5658 | } |
5659 | |
5660 | if (pf_insert_state(BOUND_IFACE(r, kif), s)) { |
5661 | if (pd->proto == IPPROTO_TCP) |
5662 | pf_normalize_tcp_cleanup(s); |
5663 | REASON_SET(&reason, PFRES_STATEINS); |
5664 | pf_src_tree_remove_state(s); |
5665 | STATE_DEC_COUNTERS(s); |
5666 | pool_put(&pf_state_pl, s); |
5667 | return (PF_DROP); |
5668 | } else { |
5669 | *sm = s; |
5670 | } |
5671 | if (tag > 0) { |
5672 | pf_tag_ref(tag); |
5673 | s->tag = tag; |
5674 | } |
5675 | if (pd->proto == IPPROTO_TCP && |
5676 | (th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN && |
5677 | r->keep_state == PF_STATE_SYNPROXY) { |
5678 | int ua = (sk->af_lan == sk->af_gwy) ? 1 : 0; |
5679 | s->src.state = PF_TCPS_PROXY_SRC; |
5680 | if (nr != NULL) { |
5681 | if (direction == PF_OUT) { |
5682 | pf_change_ap(direction, pd->mp, saddr, |
5683 | &th->th_sport, pd->ip_sum, |
5684 | &th->th_sum, &pd->baddr, |
5685 | bxport.port, 0, af, pd->af, ua); |
5686 | sxport.port = th->th_sport; |
5687 | } else { |
5688 | pf_change_ap(direction, pd->mp, daddr, |
5689 | &th->th_dport, pd->ip_sum, |
5690 | &th->th_sum, &pd->baddr, |
5691 | bxport.port, 0, af, pd->af, ua); |
5692 | sxport.port = th->th_dport; |
5693 | } |
5694 | } |
5695 | s->src.seqhi = htonl(random()); |
5696 | /* Find mss option */ |
5697 | mss = pf_get_mss(pbuf, off, th->th_off, af); |
5698 | mss = pf_calc_mss(saddr, af, mss); |
5699 | mss = pf_calc_mss(daddr, af, mss); |
5700 | s->src.mss = mss; |
5701 | pf_send_tcp(r, af, daddr, saddr, th->th_dport, |
5702 | th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1, |
5703 | TH_SYN|TH_ACK, 0, s->src.mss, 0, 1, 0, NULL, NULL); |
5704 | REASON_SET(&reason, PFRES_SYNPROXY); |
5705 | return (PF_SYNPROXY_DROP); |
5706 | } |
5707 | |
5708 | if (sk->app_state && sk->app_state->handler) { |
5709 | int offx = off; |
5710 | |
5711 | switch (pd->proto) { |
5712 | case IPPROTO_TCP: |
5713 | offx += th->th_off << 2; |
5714 | break; |
5715 | case IPPROTO_UDP: |
5716 | offx += pd->hdr.udp->uh_ulen << 2; |
5717 | break; |
5718 | default: |
5719 | /* ALG handlers only apply to TCP and UDP rules */ |
5720 | break; |
5721 | } |
5722 | |
5723 | if (offx > off) { |
5724 | sk->app_state->handler(s, direction, offx, |
5725 | pd, kif); |
5726 | if (pd->lmw < 0) { |
5727 | REASON_SET(&reason, PFRES_MEMORY); |
5728 | return (PF_DROP); |
5729 | } |
5730 | pbuf = pd->mp; // XXXSCW: Why? |
5731 | } |
5732 | } |
5733 | } |
5734 | |
5735 | /* copy back packet headers if we performed NAT operations */ |
5736 | if (rewrite) { |
5737 | if (rewrite < off + hdrlen) |
5738 | rewrite = off + hdrlen; |
5739 | |
5740 | if (pf_lazy_makewritable(pd, pd->mp, rewrite) == NULL) { |
5741 | REASON_SET(&reason, PFRES_MEMORY); |
5742 | return (PF_DROP); |
5743 | } |
5744 | |
5745 | pbuf_copy_back(pbuf, off, hdrlen, pd->hdr.any); |
5746 | if (af == AF_INET6 && pd->naf == AF_INET) |
5747 | return pf_nat64_ipv6(pbuf, off, pd); |
5748 | else if (af == AF_INET && pd->naf == AF_INET6) |
5749 | return pf_nat64_ipv4(pbuf, off, pd); |
5750 | |
5751 | } |
5752 | |
5753 | return (PF_PASS); |
5754 | } |
5755 | |
5756 | boolean_t is_nlc_enabled_glb = FALSE; |
5757 | |
5758 | static inline boolean_t |
5759 | pf_is_dummynet_enabled(void) |
5760 | { |
5761 | #if DUMMYNET |
5762 | if (__probable(!PF_IS_ENABLED)) |
5763 | return (FALSE); |
5764 | |
5765 | if (__probable(!DUMMYNET_LOADED)) |
5766 | return (FALSE); |
5767 | |
5768 | if (__probable(TAILQ_EMPTY(pf_main_ruleset. |
5769 | rules[PF_RULESET_DUMMYNET].active.ptr))) |
5770 | return (FALSE); |
5771 | |
5772 | return (TRUE); |
5773 | #else |
5774 | return (FALSE); |
5775 | #endif /* DUMMYNET */ |
5776 | } |
5777 | |
5778 | boolean_t |
5779 | pf_is_nlc_enabled(void) |
5780 | { |
5781 | #if DUMMYNET |
5782 | if (__probable(!pf_is_dummynet_enabled())) |
5783 | return (FALSE); |
5784 | |
5785 | if (__probable(!is_nlc_enabled_glb)) |
5786 | return (FALSE); |
5787 | |
5788 | return (TRUE); |
5789 | #else |
5790 | return (FALSE); |
5791 | #endif /* DUMMYNET */ |
5792 | } |
5793 | |
5794 | #if DUMMYNET |
5795 | /* |
5796 | * When pf_test_dummynet() returns PF_PASS, the rule matching parameter "rm" |
5797 | * remains unchanged, meaning the packet did not match a dummynet rule. |
5798 | * when the packet does match a dummynet rule, pf_test_dummynet() returns |
5799 | * PF_PASS and zero out the mbuf rule as the packet is effectively siphoned |
5800 | * out by dummynet. |
5801 | */ |
5802 | static int |
5803 | pf_test_dummynet(struct pf_rule **rm, int direction, struct pfi_kif *kif, |
5804 | pbuf_t **pbuf0, struct pf_pdesc *pd, struct ip_fw_args *fwa) |
5805 | { |
5806 | pbuf_t *pbuf = *pbuf0; |
5807 | struct pf_rule *am = NULL; |
5808 | struct pf_ruleset *rsm = NULL; |
5809 | struct pf_addr *saddr = pd->src, *daddr = pd->dst; |
5810 | sa_family_t af = pd->af; |
5811 | struct pf_rule *r, *a = NULL; |
5812 | struct pf_ruleset *ruleset = NULL; |
5813 | struct tcphdr *th = pd->hdr.tcp; |
5814 | u_short reason; |
5815 | int hdrlen = 0; |
5816 | int tag = -1; |
5817 | unsigned int rtableid = IFSCOPE_NONE; |
5818 | int asd = 0; |
5819 | int match = 0; |
5820 | u_int8_t icmptype = 0, icmpcode = 0; |
5821 | struct ip_fw_args dnflow; |
5822 | struct pf_rule *prev_matching_rule = fwa ? fwa->fwa_pf_rule : NULL; |
5823 | int found_prev_rule = (prev_matching_rule) ? 0 : 1; |
5824 | |
5825 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
5826 | |
5827 | if (!pf_is_dummynet_enabled()) |
5828 | return (PF_PASS); |
5829 | |
5830 | bzero(&dnflow, sizeof(dnflow)); |
5831 | |
5832 | hdrlen = 0; |
5833 | |
5834 | /* Fragments don't gave protocol headers */ |
5835 | if (!(pd->flags & PFDESC_IP_FRAG)) |
5836 | switch (pd->proto) { |
5837 | case IPPROTO_TCP: |
5838 | dnflow.fwa_id.flags = pd->hdr.tcp->th_flags; |
5839 | dnflow.fwa_id.dst_port = ntohs(pd->hdr.tcp->th_dport); |
5840 | dnflow.fwa_id.src_port = ntohs(pd->hdr.tcp->th_sport); |
5841 | hdrlen = sizeof (*th); |
5842 | break; |
5843 | case IPPROTO_UDP: |
5844 | dnflow.fwa_id.dst_port = ntohs(pd->hdr.udp->uh_dport); |
5845 | dnflow.fwa_id.src_port = ntohs(pd->hdr.udp->uh_sport); |
5846 | hdrlen = sizeof (*pd->hdr.udp); |
5847 | break; |
5848 | #if INET |
5849 | case IPPROTO_ICMP: |
5850 | if (af != AF_INET) |
5851 | break; |
5852 | hdrlen = ICMP_MINLEN; |
5853 | icmptype = pd->hdr.icmp->icmp_type; |
5854 | icmpcode = pd->hdr.icmp->icmp_code; |
5855 | break; |
5856 | #endif /* INET */ |
5857 | #if INET6 |
5858 | case IPPROTO_ICMPV6: |
5859 | if (af != AF_INET6) |
5860 | break; |
5861 | hdrlen = sizeof (*pd->hdr.icmp6); |
5862 | icmptype = pd->hdr.icmp6->icmp6_type; |
5863 | icmpcode = pd->hdr.icmp6->icmp6_code; |
5864 | break; |
5865 | #endif /* INET6 */ |
5866 | case IPPROTO_GRE: |
5867 | if (pd->proto_variant == PF_GRE_PPTP_VARIANT) |
5868 | hdrlen = sizeof (*pd->hdr.grev1); |
5869 | break; |
5870 | case IPPROTO_ESP: |
5871 | hdrlen = sizeof (*pd->hdr.esp); |
5872 | break; |
5873 | } |
5874 | |
5875 | r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_DUMMYNET].active.ptr); |
5876 | |
5877 | while (r != NULL) { |
5878 | r->evaluations++; |
5879 | if (pfi_kif_match(r->kif, kif) == r->ifnot) |
5880 | r = r->skip[PF_SKIP_IFP].ptr; |
5881 | else if (r->direction && r->direction != direction) |
5882 | r = r->skip[PF_SKIP_DIR].ptr; |
5883 | else if (r->af && r->af != af) |
5884 | r = r->skip[PF_SKIP_AF].ptr; |
5885 | else if (r->proto && r->proto != pd->proto) |
5886 | r = r->skip[PF_SKIP_PROTO].ptr; |
5887 | else if (PF_MISMATCHAW(&r->src.addr, saddr, af, |
5888 | r->src.neg, kif)) |
5889 | r = r->skip[PF_SKIP_SRC_ADDR].ptr; |
5890 | /* tcp/udp only. port_op always 0 in other cases */ |
5891 | else if (r->proto == pd->proto && |
5892 | (r->proto == IPPROTO_TCP || r->proto == IPPROTO_UDP) && |
5893 | ((pd->flags & PFDESC_IP_FRAG) || |
5894 | ((r->src.xport.range.op && |
5895 | !pf_match_port(r->src.xport.range.op, |
5896 | r->src.xport.range.port[0], r->src.xport.range.port[1], |
5897 | th->th_sport))))) |
5898 | r = r->skip[PF_SKIP_SRC_PORT].ptr; |
5899 | else if (PF_MISMATCHAW(&r->dst.addr, daddr, af, |
5900 | r->dst.neg, NULL)) |
5901 | r = r->skip[PF_SKIP_DST_ADDR].ptr; |
5902 | /* tcp/udp only. port_op always 0 in other cases */ |
5903 | else if (r->proto == pd->proto && |
5904 | (r->proto == IPPROTO_TCP || r->proto == IPPROTO_UDP) && |
5905 | r->dst.xport.range.op && |
5906 | ((pd->flags & PFDESC_IP_FRAG) || |
5907 | !pf_match_port(r->dst.xport.range.op, |
5908 | r->dst.xport.range.port[0], r->dst.xport.range.port[1], |
5909 | th->th_dport))) |
5910 | r = r->skip[PF_SKIP_DST_PORT].ptr; |
5911 | /* icmp only. type always 0 in other cases */ |
5912 | else if (r->type && |
5913 | ((pd->flags & PFDESC_IP_FRAG) || |
5914 | r->type != icmptype + 1)) |
5915 | r = TAILQ_NEXT(r, entries); |
5916 | /* icmp only. type always 0 in other cases */ |
5917 | else if (r->code && |
5918 | ((pd->flags & PFDESC_IP_FRAG) || |
5919 | r->code != icmpcode + 1)) |
5920 | r = TAILQ_NEXT(r, entries); |
5921 | else if (r->tos && !(r->tos == pd->tos)) |
5922 | r = TAILQ_NEXT(r, entries); |
5923 | else if (r->rule_flag & PFRULE_FRAGMENT) |
5924 | r = TAILQ_NEXT(r, entries); |
5925 | else if (pd->proto == IPPROTO_TCP && |
5926 | ((pd->flags & PFDESC_IP_FRAG) || |
5927 | (r->flagset & th->th_flags) != r->flags)) |
5928 | r = TAILQ_NEXT(r, entries); |
5929 | else if (r->prob && r->prob <= (RandomULong() % (UINT_MAX - 1) + 1)) |
5930 | r = TAILQ_NEXT(r, entries); |
5931 | else if (r->match_tag && !pf_match_tag(r, pd->pf_mtag, &tag)) |
5932 | r = TAILQ_NEXT(r, entries); |
5933 | else { |
5934 | /* |
5935 | * Need to go past the previous dummynet matching rule |
5936 | */ |
5937 | if (r->anchor == NULL) { |
5938 | if (found_prev_rule) { |
5939 | if (r->tag) |
5940 | tag = r->tag; |
5941 | if (PF_RTABLEID_IS_VALID(r->rtableid)) |
5942 | rtableid = r->rtableid; |
5943 | match = 1; |
5944 | *rm = r; |
5945 | am = a; |
5946 | rsm = ruleset; |
5947 | if ((*rm)->quick) |
5948 | break; |
5949 | } else if (r == prev_matching_rule) { |
5950 | found_prev_rule = 1; |
5951 | } |
5952 | r = TAILQ_NEXT(r, entries); |
5953 | } else { |
5954 | pf_step_into_anchor(&asd, &ruleset, |
5955 | PF_RULESET_DUMMYNET, &r, &a, &match); |
5956 | } |
5957 | } |
5958 | if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset, |
5959 | PF_RULESET_DUMMYNET, &r, &a, &match)) |
5960 | break; |
5961 | } |
5962 | r = *rm; |
5963 | a = am; |
5964 | ruleset = rsm; |
5965 | |
5966 | if (!match) |
5967 | return (PF_PASS); |
5968 | |
5969 | REASON_SET(&reason, PFRES_DUMMYNET); |
5970 | |
5971 | if (r->log) { |
5972 | PFLOG_PACKET(kif, h, pbuf, af, direction, reason, r, |
5973 | a, ruleset, pd); |
5974 | } |
5975 | |
5976 | if (r->action == PF_NODUMMYNET) { |
5977 | int dirndx = (direction == PF_OUT); |
5978 | |
5979 | r->packets[dirndx]++; |
5980 | r->bytes[dirndx] += pd->tot_len; |
5981 | |
5982 | return (PF_PASS); |
5983 | } |
5984 | if (pf_tag_packet(pbuf, pd->pf_mtag, tag, rtableid, pd)) { |
5985 | REASON_SET(&reason, PFRES_MEMORY); |
5986 | |
5987 | return (PF_DROP); |
5988 | } |
5989 | |
5990 | if (r->dnpipe && ip_dn_io_ptr != NULL) { |
5991 | struct mbuf *m; |
5992 | int dirndx = (direction == PF_OUT); |
5993 | |
5994 | r->packets[dirndx]++; |
5995 | r->bytes[dirndx] += pd->tot_len; |
5996 | |
5997 | dnflow.fwa_cookie = r->dnpipe; |
5998 | dnflow.fwa_pf_rule = r; |
5999 | dnflow.fwa_id.proto = pd->proto; |
6000 | dnflow.fwa_flags = r->dntype; |
6001 | switch (af) { |
6002 | case AF_INET: |
6003 | dnflow.fwa_id.addr_type = 4; |
6004 | dnflow.fwa_id.src_ip = ntohl(saddr->v4addr.s_addr); |
6005 | dnflow.fwa_id.dst_ip = ntohl(daddr->v4addr.s_addr); |
6006 | break; |
6007 | case AF_INET6: |
6008 | dnflow.fwa_id.addr_type = 6; |
6009 | dnflow.fwa_id.src_ip6 = saddr->v6addr; |
6010 | dnflow.fwa_id.dst_ip6 = saddr->v6addr; |
6011 | break; |
6012 | } |
6013 | |
6014 | if (fwa != NULL) { |
6015 | dnflow.fwa_oif = fwa->fwa_oif; |
6016 | dnflow.fwa_oflags = fwa->fwa_oflags; |
6017 | /* |
6018 | * Note that fwa_ro, fwa_dst and fwa_ipoa are |
6019 | * actually in a union so the following does work |
6020 | * for both IPv4 and IPv6 |
6021 | */ |
6022 | dnflow.fwa_ro = fwa->fwa_ro; |
6023 | dnflow.fwa_dst = fwa->fwa_dst; |
6024 | dnflow.fwa_ipoa = fwa->fwa_ipoa; |
6025 | dnflow.fwa_ro6_pmtu = fwa->fwa_ro6_pmtu; |
6026 | dnflow.fwa_origifp = fwa->fwa_origifp; |
6027 | dnflow.fwa_mtu = fwa->fwa_mtu; |
6028 | dnflow.fwa_alwaysfrag = fwa->fwa_alwaysfrag; |
6029 | dnflow.fwa_unfragpartlen = fwa->fwa_unfragpartlen; |
6030 | dnflow.fwa_exthdrs = fwa->fwa_exthdrs; |
6031 | } |
6032 | |
6033 | if (af == AF_INET) { |
6034 | struct ip *iphdr = pbuf->pb_data; |
6035 | NTOHS(iphdr->ip_len); |
6036 | NTOHS(iphdr->ip_off); |
6037 | } |
6038 | /* |
6039 | * Don't need to unlock pf_lock as NET_THREAD_HELD_PF |
6040 | * allows for recursive behavior |
6041 | */ |
6042 | m = pbuf_to_mbuf(pbuf, TRUE); |
6043 | if (m != NULL) { |
6044 | ip_dn_io_ptr(m, |
6045 | dnflow.fwa_cookie, (af == AF_INET) ? |
6046 | ((direction==PF_IN) ? DN_TO_IP_IN : DN_TO_IP_OUT) : |
6047 | ((direction==PF_IN) ? DN_TO_IP6_IN : DN_TO_IP6_OUT), |
6048 | &dnflow, DN_CLIENT_PF); |
6049 | } |
6050 | |
6051 | /* |
6052 | * The packet is siphoned out by dummynet so return a NULL |
6053 | * pbuf so the caller can still return success. |
6054 | */ |
6055 | *pbuf0 = NULL; |
6056 | |
6057 | return (PF_PASS); |
6058 | } |
6059 | |
6060 | return (PF_PASS); |
6061 | } |
6062 | #endif /* DUMMYNET */ |
6063 | |
6064 | static int |
6065 | pf_test_fragment(struct pf_rule **rm, int direction, struct pfi_kif *kif, |
6066 | pbuf_t *pbuf, void *h, struct pf_pdesc *pd, struct pf_rule **am, |
6067 | struct pf_ruleset **rsm) |
6068 | { |
6069 | #pragma unused(h) |
6070 | struct pf_rule *r, *a = NULL; |
6071 | struct pf_ruleset *ruleset = NULL; |
6072 | sa_family_t af = pd->af; |
6073 | u_short reason; |
6074 | int tag = -1; |
6075 | int asd = 0; |
6076 | int match = 0; |
6077 | |
6078 | r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); |
6079 | while (r != NULL) { |
6080 | r->evaluations++; |
6081 | if (pfi_kif_match(r->kif, kif) == r->ifnot) |
6082 | r = r->skip[PF_SKIP_IFP].ptr; |
6083 | else if (r->direction && r->direction != direction) |
6084 | r = r->skip[PF_SKIP_DIR].ptr; |
6085 | else if (r->af && r->af != af) |
6086 | r = r->skip[PF_SKIP_AF].ptr; |
6087 | else if (r->proto && r->proto != pd->proto) |
6088 | r = r->skip[PF_SKIP_PROTO].ptr; |
6089 | else if (PF_MISMATCHAW(&r->src.addr, pd->src, af, |
6090 | r->src.neg, kif)) |
6091 | r = r->skip[PF_SKIP_SRC_ADDR].ptr; |
6092 | else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af, |
6093 | r->dst.neg, NULL)) |
6094 | r = r->skip[PF_SKIP_DST_ADDR].ptr; |
6095 | else if ((r->rule_flag & PFRULE_TOS) && r->tos && |
6096 | !(r->tos & pd->tos)) |
6097 | r = TAILQ_NEXT(r, entries); |
6098 | else if ((r->rule_flag & PFRULE_DSCP) && r->tos && |
6099 | !(r->tos & (pd->tos & DSCP_MASK))) |
6100 | r = TAILQ_NEXT(r, entries); |
6101 | else if ((r->rule_flag & PFRULE_SC) && r->tos && |
6102 | ((r->tos & SCIDX_MASK) != pd->sc)) |
6103 | r = TAILQ_NEXT(r, entries); |
6104 | else if (r->os_fingerprint != PF_OSFP_ANY) |
6105 | r = TAILQ_NEXT(r, entries); |
6106 | else if (pd->proto == IPPROTO_UDP && |
6107 | (r->src.xport.range.op || r->dst.xport.range.op)) |
6108 | r = TAILQ_NEXT(r, entries); |
6109 | else if (pd->proto == IPPROTO_TCP && |
6110 | (r->src.xport.range.op || r->dst.xport.range.op || |
6111 | r->flagset)) |
6112 | r = TAILQ_NEXT(r, entries); |
6113 | else if ((pd->proto == IPPROTO_ICMP || |
6114 | pd->proto == IPPROTO_ICMPV6) && |
6115 | (r->type || r->code)) |
6116 | r = TAILQ_NEXT(r, entries); |
6117 | else if (r->prob && r->prob <= (RandomULong() % (UINT_MAX - 1) + 1)) |
6118 | r = TAILQ_NEXT(r, entries); |
6119 | else if (r->match_tag && !pf_match_tag(r, pd->pf_mtag, &tag)) |
6120 | r = TAILQ_NEXT(r, entries); |
6121 | else { |
6122 | if (r->anchor == NULL) { |
6123 | match = 1; |
6124 | *rm = r; |
6125 | *am = a; |
6126 | *rsm = ruleset; |
6127 | if ((*rm)->quick) |
6128 | break; |
6129 | r = TAILQ_NEXT(r, entries); |
6130 | } else |
6131 | pf_step_into_anchor(&asd, &ruleset, |
6132 | PF_RULESET_FILTER, &r, &a, &match); |
6133 | } |
6134 | if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset, |
6135 | PF_RULESET_FILTER, &r, &a, &match)) |
6136 | break; |
6137 | } |
6138 | r = *rm; |
6139 | a = *am; |
6140 | ruleset = *rsm; |
6141 | |
6142 | REASON_SET(&reason, PFRES_MATCH); |
6143 | |
6144 | if (r->log) |
6145 | PFLOG_PACKET(kif, h, pbuf, af, direction, reason, r, a, ruleset, |
6146 | pd); |
6147 | |
6148 | if (r->action != PF_PASS) |
6149 | return (PF_DROP); |
6150 | |
6151 | if (pf_tag_packet(pbuf, pd->pf_mtag, tag, -1, NULL)) { |
6152 | REASON_SET(&reason, PFRES_MEMORY); |
6153 | return (PF_DROP); |
6154 | } |
6155 | |
6156 | return (PF_PASS); |
6157 | } |
6158 | |
6159 | static void |
6160 | pf_pptp_handler(struct pf_state *s, int direction, int off, |
6161 | struct pf_pdesc *pd, struct pfi_kif *kif) |
6162 | { |
6163 | #pragma unused(direction) |
6164 | struct tcphdr *th; |
6165 | struct pf_pptp_state *pptps; |
6166 | struct pf_pptp_ctrl_msg cm; |
6167 | size_t plen, tlen; |
6168 | struct pf_state *gs; |
6169 | u_int16_t ct; |
6170 | u_int16_t *pac_call_id; |
6171 | u_int16_t *pns_call_id; |
6172 | u_int16_t *spoof_call_id; |
6173 | u_int8_t *pac_state; |
6174 | u_int8_t *pns_state; |
6175 | enum { PF_PPTP_PASS, PF_PPTP_INSERT_GRE, PF_PPTP_REMOVE_GRE } op; |
6176 | pbuf_t *pbuf; |
6177 | struct pf_state_key *sk; |
6178 | struct pf_state_key *gsk; |
6179 | struct pf_app_state *gas; |
6180 | |
6181 | sk = s->state_key; |
6182 | pptps = &sk->app_state->u.pptp; |
6183 | gs = pptps->grev1_state; |
6184 | |
6185 | if (gs) |
6186 | gs->expire = pf_time_second(); |
6187 | |
6188 | pbuf = pd->mp; |
6189 | plen = min(sizeof (cm), pbuf->pb_packet_len - off); |
6190 | if (plen < PF_PPTP_CTRL_MSG_MINSIZE) |
6191 | return; |
6192 | tlen = plen - PF_PPTP_CTRL_MSG_MINSIZE; |
6193 | pbuf_copy_data(pbuf, off, plen, &cm); |
6194 | |
6195 | if (ntohl(cm.hdr.magic) != PF_PPTP_MAGIC_NUMBER) |
6196 | return; |
6197 | if (ntohs(cm.hdr.type) != 1) |
6198 | return; |
6199 | |
6200 | #define TYPE_LEN_CHECK(_type, _name) \ |
6201 | case PF_PPTP_CTRL_TYPE_##_type: \ |
6202 | if (tlen < sizeof(struct pf_pptp_ctrl_##_name)) \ |
6203 | return; \ |
6204 | break; |
6205 | |
6206 | switch (cm.ctrl.type) { |
6207 | TYPE_LEN_CHECK(START_REQ, start_req); |
6208 | TYPE_LEN_CHECK(START_RPY, start_rpy); |
6209 | TYPE_LEN_CHECK(STOP_REQ, stop_req); |
6210 | TYPE_LEN_CHECK(STOP_RPY, stop_rpy); |
6211 | TYPE_LEN_CHECK(ECHO_REQ, echo_req); |
6212 | TYPE_LEN_CHECK(ECHO_RPY, echo_rpy); |
6213 | TYPE_LEN_CHECK(CALL_OUT_REQ, call_out_req); |
6214 | TYPE_LEN_CHECK(CALL_OUT_RPY, call_out_rpy); |
6215 | TYPE_LEN_CHECK(CALL_IN_1ST, call_in_1st); |
6216 | TYPE_LEN_CHECK(CALL_IN_2ND, call_in_2nd); |
6217 | TYPE_LEN_CHECK(CALL_IN_3RD, call_in_3rd); |
6218 | TYPE_LEN_CHECK(CALL_CLR, call_clr); |
6219 | TYPE_LEN_CHECK(CALL_DISC, call_disc); |
6220 | TYPE_LEN_CHECK(ERROR, error); |
6221 | TYPE_LEN_CHECK(SET_LINKINFO, set_linkinfo); |
6222 | default: |
6223 | return; |
6224 | } |
6225 | #undef TYPE_LEN_CHECK |
6226 | |
6227 | if (!gs) { |
6228 | gs = pool_get(&pf_state_pl, PR_WAITOK); |
6229 | if (!gs) |
6230 | return; |
6231 | |
6232 | memcpy(gs, s, sizeof (*gs)); |
6233 | |
6234 | memset(&gs->entry_id, 0, sizeof (gs->entry_id)); |
6235 | memset(&gs->entry_list, 0, sizeof (gs->entry_list)); |
6236 | |
6237 | TAILQ_INIT(&gs->unlink_hooks); |
6238 | gs->rt_kif = NULL; |
6239 | gs->creation = 0; |
6240 | gs->pfsync_time = 0; |
6241 | gs->packets[0] = gs->packets[1] = 0; |
6242 | gs->bytes[0] = gs->bytes[1] = 0; |
6243 | gs->timeout = PFTM_UNLINKED; |
6244 | gs->id = gs->creatorid = 0; |
6245 | gs->src.state = gs->dst.state = PFGRE1S_NO_TRAFFIC; |
6246 | gs->src.scrub = gs->dst.scrub = 0; |
6247 | |
6248 | gas = pool_get(&pf_app_state_pl, PR_NOWAIT); |
6249 | if (!gas) { |
6250 | pool_put(&pf_state_pl, gs); |
6251 | return; |
6252 | } |
6253 | |
6254 | gsk = pf_alloc_state_key(gs, NULL); |
6255 | if (!gsk) { |
6256 | pool_put(&pf_app_state_pl, gas); |
6257 | pool_put(&pf_state_pl, gs); |
6258 | return; |
6259 | } |
6260 | |
6261 | memcpy(&gsk->lan, &sk->lan, sizeof (gsk->lan)); |
6262 | memcpy(&gsk->gwy, &sk->gwy, sizeof (gsk->gwy)); |
6263 | memcpy(&gsk->ext_lan, &sk->ext_lan, sizeof (gsk->ext_lan)); |
6264 | memcpy(&gsk->ext_gwy, &sk->ext_gwy, sizeof (gsk->ext_gwy)); |
6265 | gsk->af_lan = sk->af_lan; |
6266 | gsk->af_gwy = sk->af_gwy; |
6267 | gsk->proto = IPPROTO_GRE; |
6268 | gsk->proto_variant = PF_GRE_PPTP_VARIANT; |
6269 | gsk->app_state = gas; |
6270 | gsk->lan.xport.call_id = 0; |
6271 | gsk->gwy.xport.call_id = 0; |
6272 | gsk->ext_lan.xport.call_id = 0; |
6273 | gsk->ext_gwy.xport.call_id = 0; |
6274 | gsk->flowsrc = FLOWSRC_PF; |
6275 | gsk->flowhash = pf_calc_state_key_flowhash(gsk); |
6276 | memset(gas, 0, sizeof (*gas)); |
6277 | gas->u.grev1.pptp_state = s; |
6278 | STATE_INC_COUNTERS(gs); |
6279 | pptps->grev1_state = gs; |
6280 | (void) hook_establish(&gs->unlink_hooks, 0, |
6281 | (hook_fn_t) pf_grev1_unlink, gs); |
6282 | } else { |
6283 | gsk = gs->state_key; |
6284 | } |
6285 | |
6286 | switch (sk->direction) { |
6287 | case PF_IN: |
6288 | pns_call_id = &gsk->ext_lan.xport.call_id; |
6289 | pns_state = &gs->dst.state; |
6290 | pac_call_id = &gsk->lan.xport.call_id; |
6291 | pac_state = &gs->src.state; |
6292 | break; |
6293 | |
6294 | case PF_OUT: |
6295 | pns_call_id = &gsk->lan.xport.call_id; |
6296 | pns_state = &gs->src.state; |
6297 | pac_call_id = &gsk->ext_lan.xport.call_id; |
6298 | pac_state = &gs->dst.state; |
6299 | break; |
6300 | |
6301 | default: |
6302 | DPFPRINTF(PF_DEBUG_URGENT, |
6303 | ("pf_pptp_handler: bad directional!\n" )); |
6304 | return; |
6305 | } |
6306 | |
6307 | spoof_call_id = 0; |
6308 | op = PF_PPTP_PASS; |
6309 | |
6310 | ct = ntohs(cm.ctrl.type); |
6311 | |
6312 | switch (ct) { |
6313 | case PF_PPTP_CTRL_TYPE_CALL_OUT_REQ: |
6314 | *pns_call_id = cm.msg.call_out_req.call_id; |
6315 | *pns_state = PFGRE1S_INITIATING; |
6316 | if (s->nat_rule.ptr && pns_call_id == &gsk->lan.xport.call_id) |
6317 | spoof_call_id = &cm.msg.call_out_req.call_id; |
6318 | break; |
6319 | |
6320 | case PF_PPTP_CTRL_TYPE_CALL_OUT_RPY: |
6321 | *pac_call_id = cm.msg.call_out_rpy.call_id; |
6322 | if (s->nat_rule.ptr) |
6323 | spoof_call_id = |
6324 | (pac_call_id == &gsk->lan.xport.call_id) ? |
6325 | &cm.msg.call_out_rpy.call_id : |
6326 | &cm.msg.call_out_rpy.peer_call_id; |
6327 | if (gs->timeout == PFTM_UNLINKED) { |
6328 | *pac_state = PFGRE1S_INITIATING; |
6329 | op = PF_PPTP_INSERT_GRE; |
6330 | } |
6331 | break; |
6332 | |
6333 | case PF_PPTP_CTRL_TYPE_CALL_IN_1ST: |
6334 | *pns_call_id = cm.msg.call_in_1st.call_id; |
6335 | *pns_state = PFGRE1S_INITIATING; |
6336 | if (s->nat_rule.ptr && pns_call_id == &gsk->lan.xport.call_id) |
6337 | spoof_call_id = &cm.msg.call_in_1st.call_id; |
6338 | break; |
6339 | |
6340 | case PF_PPTP_CTRL_TYPE_CALL_IN_2ND: |
6341 | *pac_call_id = cm.msg.call_in_2nd.call_id; |
6342 | *pac_state = PFGRE1S_INITIATING; |
6343 | if (s->nat_rule.ptr) |
6344 | spoof_call_id = |
6345 | (pac_call_id == &gsk->lan.xport.call_id) ? |
6346 | &cm.msg.call_in_2nd.call_id : |
6347 | &cm.msg.call_in_2nd.peer_call_id; |
6348 | break; |
6349 | |
6350 | case PF_PPTP_CTRL_TYPE_CALL_IN_3RD: |
6351 | if (s->nat_rule.ptr && pns_call_id == &gsk->lan.xport.call_id) |
6352 | spoof_call_id = &cm.msg.call_in_3rd.call_id; |
6353 | if (cm.msg.call_in_3rd.call_id != *pns_call_id) { |
6354 | break; |
6355 | } |
6356 | if (gs->timeout == PFTM_UNLINKED) |
6357 | op = PF_PPTP_INSERT_GRE; |
6358 | break; |
6359 | |
6360 | case PF_PPTP_CTRL_TYPE_CALL_CLR: |
6361 | if (cm.msg.call_clr.call_id != *pns_call_id) |
6362 | op = PF_PPTP_REMOVE_GRE; |
6363 | break; |
6364 | |
6365 | case PF_PPTP_CTRL_TYPE_CALL_DISC: |
6366 | if (cm.msg.call_clr.call_id != *pac_call_id) |
6367 | op = PF_PPTP_REMOVE_GRE; |
6368 | break; |
6369 | |
6370 | case PF_PPTP_CTRL_TYPE_ERROR: |
6371 | if (s->nat_rule.ptr && pns_call_id == &gsk->lan.xport.call_id) |
6372 | spoof_call_id = &cm.msg.error.peer_call_id; |
6373 | break; |
6374 | |
6375 | case PF_PPTP_CTRL_TYPE_SET_LINKINFO: |
6376 | if (s->nat_rule.ptr && pac_call_id == &gsk->lan.xport.call_id) |
6377 | spoof_call_id = &cm.msg.set_linkinfo.peer_call_id; |
6378 | break; |
6379 | |
6380 | default: |
6381 | op = PF_PPTP_PASS; |
6382 | break; |
6383 | } |
6384 | |
6385 | if (!gsk->gwy.xport.call_id && gsk->lan.xport.call_id) { |
6386 | gsk->gwy.xport.call_id = gsk->lan.xport.call_id; |
6387 | if (spoof_call_id) { |
6388 | u_int16_t call_id = 0; |
6389 | int n = 0; |
6390 | struct pf_state_key_cmp key; |
6391 | |
6392 | key.af_gwy = gsk->af_gwy; |
6393 | key.proto = IPPROTO_GRE; |
6394 | key.proto_variant = PF_GRE_PPTP_VARIANT; |
6395 | PF_ACPY(&key.gwy.addr, &gsk->gwy.addr, key.af_gwy); |
6396 | PF_ACPY(&key.ext_gwy.addr, &gsk->ext_gwy.addr, key.af_gwy); |
6397 | key.gwy.xport.call_id = gsk->gwy.xport.call_id; |
6398 | key.ext_gwy.xport.call_id = gsk->ext_gwy.xport.call_id; |
6399 | do { |
6400 | call_id = htonl(random()); |
6401 | } while (!call_id); |
6402 | |
6403 | while (pf_find_state_all(&key, PF_IN, 0)) { |
6404 | call_id = ntohs(call_id); |
6405 | --call_id; |
6406 | if (--call_id == 0) call_id = 0xffff; |
6407 | call_id = htons(call_id); |
6408 | |
6409 | key.gwy.xport.call_id = call_id; |
6410 | |
6411 | if (++n > 65535) { |
6412 | DPFPRINTF(PF_DEBUG_URGENT, |
6413 | ("pf_pptp_handler: failed to spoof " |
6414 | "call id\n" )); |
6415 | key.gwy.xport.call_id = 0; |
6416 | break; |
6417 | } |
6418 | } |
6419 | |
6420 | gsk->gwy.xport.call_id = call_id; |
6421 | } |
6422 | } |
6423 | |
6424 | th = pd->hdr.tcp; |
6425 | |
6426 | if (spoof_call_id && gsk->lan.xport.call_id != gsk->gwy.xport.call_id) { |
6427 | if (*spoof_call_id == gsk->gwy.xport.call_id) { |
6428 | *spoof_call_id = gsk->lan.xport.call_id; |
6429 | th->th_sum = pf_cksum_fixup(th->th_sum, |
6430 | gsk->gwy.xport.call_id, gsk->lan.xport.call_id, 0); |
6431 | } else { |
6432 | *spoof_call_id = gsk->gwy.xport.call_id; |
6433 | th->th_sum = pf_cksum_fixup(th->th_sum, |
6434 | gsk->lan.xport.call_id, gsk->gwy.xport.call_id, 0); |
6435 | } |
6436 | |
6437 | if (pf_lazy_makewritable(pd, pbuf, off + plen) == NULL) { |
6438 | pptps->grev1_state = NULL; |
6439 | STATE_DEC_COUNTERS(gs); |
6440 | pool_put(&pf_state_pl, gs); |
6441 | return; |
6442 | } |
6443 | pbuf_copy_back(pbuf, off, plen, &cm); |
6444 | } |
6445 | |
6446 | switch (op) { |
6447 | case PF_PPTP_REMOVE_GRE: |
6448 | gs->timeout = PFTM_PURGE; |
6449 | gs->src.state = gs->dst.state = PFGRE1S_NO_TRAFFIC; |
6450 | gsk->lan.xport.call_id = 0; |
6451 | gsk->gwy.xport.call_id = 0; |
6452 | gsk->ext_lan.xport.call_id = 0; |
6453 | gsk->ext_gwy.xport.call_id = 0; |
6454 | gs->id = gs->creatorid = 0; |
6455 | break; |
6456 | |
6457 | case PF_PPTP_INSERT_GRE: |
6458 | gs->creation = pf_time_second(); |
6459 | gs->expire = pf_time_second(); |
6460 | gs->timeout = PFTM_TCP_ESTABLISHED; |
6461 | if (gs->src_node != NULL) { |
6462 | ++gs->src_node->states; |
6463 | VERIFY(gs->src_node->states != 0); |
6464 | } |
6465 | if (gs->nat_src_node != NULL) { |
6466 | ++gs->nat_src_node->states; |
6467 | VERIFY(gs->nat_src_node->states != 0); |
6468 | } |
6469 | pf_set_rt_ifp(gs, &sk->lan.addr, sk->af_lan); |
6470 | if (pf_insert_state(BOUND_IFACE(s->rule.ptr, kif), gs)) { |
6471 | |
6472 | /* |
6473 | * <jhw@apple.com> |
6474 | * FIX ME: insertion can fail when multiple PNS |
6475 | * behind the same NAT open calls to the same PAC |
6476 | * simultaneously because spoofed call ID numbers |
6477 | * are chosen before states are inserted. This is |
6478 | * hard to fix and happens infrequently enough that |
6479 | * users will normally try again and this ALG will |
6480 | * succeed. Failures are expected to be rare enough |
6481 | * that fixing this is a low priority. |
6482 | */ |
6483 | pptps->grev1_state = NULL; |
6484 | pd->lmw = -1; /* Force PF_DROP on PFRES_MEMORY */ |
6485 | pf_src_tree_remove_state(gs); |
6486 | STATE_DEC_COUNTERS(gs); |
6487 | pool_put(&pf_state_pl, gs); |
6488 | DPFPRINTF(PF_DEBUG_URGENT, ("pf_pptp_handler: error " |
6489 | "inserting GREv1 state.\n" )); |
6490 | } |
6491 | break; |
6492 | |
6493 | default: |
6494 | break; |
6495 | } |
6496 | } |
6497 | |
6498 | static void |
6499 | pf_pptp_unlink(struct pf_state *s) |
6500 | { |
6501 | struct pf_app_state *as = s->state_key->app_state; |
6502 | struct pf_state *grev1s = as->u.pptp.grev1_state; |
6503 | |
6504 | if (grev1s) { |
6505 | struct pf_app_state *gas = grev1s->state_key->app_state; |
6506 | |
6507 | if (grev1s->timeout < PFTM_MAX) |
6508 | grev1s->timeout = PFTM_PURGE; |
6509 | gas->u.grev1.pptp_state = NULL; |
6510 | as->u.pptp.grev1_state = NULL; |
6511 | } |
6512 | } |
6513 | |
6514 | static void |
6515 | pf_grev1_unlink(struct pf_state *s) |
6516 | { |
6517 | struct pf_app_state *as = s->state_key->app_state; |
6518 | struct pf_state *pptps = as->u.grev1.pptp_state; |
6519 | |
6520 | if (pptps) { |
6521 | struct pf_app_state *pas = pptps->state_key->app_state; |
6522 | |
6523 | pas->u.pptp.grev1_state = NULL; |
6524 | as->u.grev1.pptp_state = NULL; |
6525 | } |
6526 | } |
6527 | |
6528 | static int |
6529 | pf_ike_compare(struct pf_app_state *a, struct pf_app_state *b) |
6530 | { |
6531 | int64_t d = a->u.ike.cookie - b->u.ike.cookie; |
6532 | return ((d > 0) ? 1 : ((d < 0) ? -1 : 0)); |
6533 | } |
6534 | |
6535 | static int |
6536 | pf_do_nat64(struct pf_state_key *sk, struct pf_pdesc *pd, pbuf_t *pbuf, |
6537 | int off) |
6538 | { |
6539 | if (pd->af == AF_INET) { |
6540 | if (pd->af != sk->af_lan) { |
6541 | pd->ndaddr = sk->lan.addr; |
6542 | pd->naddr = sk->ext_lan.addr; |
6543 | } else { |
6544 | pd->naddr = sk->gwy.addr; |
6545 | pd->ndaddr = sk->ext_gwy.addr; |
6546 | } |
6547 | return (pf_nat64_ipv4(pbuf, off, pd)); |
6548 | } |
6549 | else if (pd->af == AF_INET6) { |
6550 | if (pd->af != sk->af_lan) { |
6551 | pd->ndaddr = sk->lan.addr; |
6552 | pd->naddr = sk->ext_lan.addr; |
6553 | } else { |
6554 | pd->naddr = sk->gwy.addr; |
6555 | pd->ndaddr = sk->ext_gwy.addr; |
6556 | } |
6557 | return (pf_nat64_ipv6(pbuf, off, pd)); |
6558 | } |
6559 | return (PF_DROP); |
6560 | } |
6561 | |
6562 | static int |
6563 | pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif, |
6564 | pbuf_t *pbuf, int off, void *h, struct pf_pdesc *pd, |
6565 | u_short *reason) |
6566 | { |
6567 | #pragma unused(h) |
6568 | struct pf_state_key_cmp key; |
6569 | struct tcphdr *th = pd->hdr.tcp; |
6570 | u_int16_t win = ntohs(th->th_win); |
6571 | u_int32_t ack, end, seq, orig_seq; |
6572 | u_int8_t sws, dws; |
6573 | int ackskew; |
6574 | int copyback = 0; |
6575 | struct pf_state_peer *src, *dst; |
6576 | struct pf_state_key *sk; |
6577 | |
6578 | key.app_state = 0; |
6579 | key.proto = IPPROTO_TCP; |
6580 | key.af_lan = key.af_gwy = pd->af; |
6581 | |
6582 | /* |
6583 | * For NAT64 the first time rule search and state creation |
6584 | * is done on the incoming side only. |
6585 | * Once the state gets created, NAT64's LAN side (ipv6) will |
6586 | * not be able to find the state in ext-gwy tree as that normally |
6587 | * is intended to be looked up for incoming traffic from the |
6588 | * WAN side. |
6589 | * Therefore to handle NAT64 case we init keys here for both |
6590 | * lan-ext as well as ext-gwy trees. |
6591 | * In the state lookup we attempt a lookup on both trees if |
6592 | * first one does not return any result and return a match if |
6593 | * the match state's was created by NAT64 rule. |
6594 | */ |
6595 | PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy); |
6596 | PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy); |
6597 | key.ext_gwy.xport.port = th->th_sport; |
6598 | key.gwy.xport.port = th->th_dport; |
6599 | |
6600 | PF_ACPY(&key.lan.addr, pd->src, key.af_lan); |
6601 | PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan); |
6602 | key.lan.xport.port = th->th_sport; |
6603 | key.ext_lan.xport.port = th->th_dport; |
6604 | |
6605 | STATE_LOOKUP(); |
6606 | |
6607 | sk = (*state)->state_key; |
6608 | /* |
6609 | * In case of NAT64 the translation is first applied on the LAN |
6610 | * side. Therefore for stack's address family comparison |
6611 | * we use sk->af_lan. |
6612 | */ |
6613 | if ((direction == sk->direction) && (pd->af == sk->af_lan)) { |
6614 | src = &(*state)->src; |
6615 | dst = &(*state)->dst; |
6616 | } else { |
6617 | src = &(*state)->dst; |
6618 | dst = &(*state)->src; |
6619 | } |
6620 | |
6621 | if (src->state == PF_TCPS_PROXY_SRC) { |
6622 | if (direction != sk->direction) { |
6623 | REASON_SET(reason, PFRES_SYNPROXY); |
6624 | return (PF_SYNPROXY_DROP); |
6625 | } |
6626 | if (th->th_flags & TH_SYN) { |
6627 | if (ntohl(th->th_seq) != src->seqlo) { |
6628 | REASON_SET(reason, PFRES_SYNPROXY); |
6629 | return (PF_DROP); |
6630 | } |
6631 | pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst, |
6632 | pd->src, th->th_dport, th->th_sport, |
6633 | src->seqhi, ntohl(th->th_seq) + 1, |
6634 | TH_SYN|TH_ACK, 0, src->mss, 0, 1, |
6635 | 0, NULL, NULL); |
6636 | REASON_SET(reason, PFRES_SYNPROXY); |
6637 | return (PF_SYNPROXY_DROP); |
6638 | } else if (!(th->th_flags & TH_ACK) || |
6639 | (ntohl(th->th_ack) != src->seqhi + 1) || |
6640 | (ntohl(th->th_seq) != src->seqlo + 1)) { |
6641 | REASON_SET(reason, PFRES_SYNPROXY); |
6642 | return (PF_DROP); |
6643 | } else if ((*state)->src_node != NULL && |
6644 | pf_src_connlimit(state)) { |
6645 | REASON_SET(reason, PFRES_SRCLIMIT); |
6646 | return (PF_DROP); |
6647 | } else |
6648 | src->state = PF_TCPS_PROXY_DST; |
6649 | } |
6650 | if (src->state == PF_TCPS_PROXY_DST) { |
6651 | struct pf_state_host *psrc, *pdst; |
6652 | |
6653 | if (direction == PF_OUT) { |
6654 | psrc = &sk->gwy; |
6655 | pdst = &sk->ext_gwy; |
6656 | } else { |
6657 | psrc = &sk->ext_lan; |
6658 | pdst = &sk->lan; |
6659 | } |
6660 | if (direction == sk->direction) { |
6661 | if (((th->th_flags & (TH_SYN|TH_ACK)) != TH_ACK) || |
6662 | (ntohl(th->th_ack) != src->seqhi + 1) || |
6663 | (ntohl(th->th_seq) != src->seqlo + 1)) { |
6664 | REASON_SET(reason, PFRES_SYNPROXY); |
6665 | return (PF_DROP); |
6666 | } |
6667 | src->max_win = MAX(ntohs(th->th_win), 1); |
6668 | if (dst->seqhi == 1) |
6669 | dst->seqhi = htonl(random()); |
6670 | pf_send_tcp((*state)->rule.ptr, pd->af, &psrc->addr, |
6671 | &pdst->addr, psrc->xport.port, pdst->xport.port, |
6672 | dst->seqhi, 0, TH_SYN, 0, |
6673 | src->mss, 0, 0, (*state)->tag, NULL, NULL); |
6674 | REASON_SET(reason, PFRES_SYNPROXY); |
6675 | return (PF_SYNPROXY_DROP); |
6676 | } else if (((th->th_flags & (TH_SYN|TH_ACK)) != |
6677 | (TH_SYN|TH_ACK)) || |
6678 | (ntohl(th->th_ack) != dst->seqhi + 1)) { |
6679 | REASON_SET(reason, PFRES_SYNPROXY); |
6680 | return (PF_DROP); |
6681 | } else { |
6682 | dst->max_win = MAX(ntohs(th->th_win), 1); |
6683 | dst->seqlo = ntohl(th->th_seq); |
6684 | pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst, |
6685 | pd->src, th->th_dport, th->th_sport, |
6686 | ntohl(th->th_ack), ntohl(th->th_seq) + 1, |
6687 | TH_ACK, src->max_win, 0, 0, 0, |
6688 | (*state)->tag, NULL, NULL); |
6689 | pf_send_tcp((*state)->rule.ptr, pd->af, &psrc->addr, |
6690 | &pdst->addr, psrc->xport.port, pdst->xport.port, |
6691 | src->seqhi + 1, src->seqlo + 1, |
6692 | TH_ACK, dst->max_win, 0, 0, 1, |
6693 | 0, NULL, NULL); |
6694 | src->seqdiff = dst->seqhi - |
6695 | src->seqlo; |
6696 | dst->seqdiff = src->seqhi - |
6697 | dst->seqlo; |
6698 | src->seqhi = src->seqlo + |
6699 | dst->max_win; |
6700 | dst->seqhi = dst->seqlo + |
6701 | src->max_win; |
6702 | src->wscale = dst->wscale = 0; |
6703 | src->state = dst->state = |
6704 | TCPS_ESTABLISHED; |
6705 | REASON_SET(reason, PFRES_SYNPROXY); |
6706 | return (PF_SYNPROXY_DROP); |
6707 | } |
6708 | } |
6709 | |
6710 | if (((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN) && |
6711 | dst->state >= TCPS_FIN_WAIT_2 && |
6712 | src->state >= TCPS_FIN_WAIT_2) { |
6713 | if (pf_status.debug >= PF_DEBUG_MISC) { |
6714 | printf("pf: state reuse " ); |
6715 | pf_print_state(*state); |
6716 | pf_print_flags(th->th_flags); |
6717 | printf("\n" ); |
6718 | } |
6719 | /* XXX make sure it's the same direction ?? */ |
6720 | src->state = dst->state = TCPS_CLOSED; |
6721 | pf_unlink_state(*state); |
6722 | *state = NULL; |
6723 | return (PF_DROP); |
6724 | } |
6725 | |
6726 | if ((th->th_flags & TH_SYN) == 0) { |
6727 | sws = (src->wscale & PF_WSCALE_FLAG) ? |
6728 | (src->wscale & PF_WSCALE_MASK) : TCP_MAX_WINSHIFT; |
6729 | dws = (dst->wscale & PF_WSCALE_FLAG) ? |
6730 | (dst->wscale & PF_WSCALE_MASK) : TCP_MAX_WINSHIFT; |
6731 | } |
6732 | else |
6733 | sws = dws = 0; |
6734 | |
6735 | /* |
6736 | * Sequence tracking algorithm from Guido van Rooij's paper: |
6737 | * http://www.madison-gurkha.com/publications/tcp_filtering/ |
6738 | * tcp_filtering.ps |
6739 | */ |
6740 | |
6741 | orig_seq = seq = ntohl(th->th_seq); |
6742 | if (src->seqlo == 0) { |
6743 | /* First packet from this end. Set its state */ |
6744 | |
6745 | if ((pd->flags & PFDESC_TCP_NORM || dst->scrub) && |
6746 | src->scrub == NULL) { |
6747 | if (pf_normalize_tcp_init(pbuf, off, pd, th, src, dst)) { |
6748 | REASON_SET(reason, PFRES_MEMORY); |
6749 | return (PF_DROP); |
6750 | } |
6751 | } |
6752 | |
6753 | /* Deferred generation of sequence number modulator */ |
6754 | if (dst->seqdiff && !src->seqdiff) { |
6755 | /* use random iss for the TCP server */ |
6756 | while ((src->seqdiff = random() - seq) == 0) |
6757 | ; |
6758 | ack = ntohl(th->th_ack) - dst->seqdiff; |
6759 | pf_change_a(&th->th_seq, &th->th_sum, htonl(seq + |
6760 | src->seqdiff), 0); |
6761 | pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0); |
6762 | copyback = off + sizeof (*th); |
6763 | } else { |
6764 | ack = ntohl(th->th_ack); |
6765 | } |
6766 | |
6767 | end = seq + pd->p_len; |
6768 | if (th->th_flags & TH_SYN) { |
6769 | end++; |
6770 | if (dst->wscale & PF_WSCALE_FLAG) { |
6771 | src->wscale = pf_get_wscale(pbuf, off, |
6772 | th->th_off, pd->af); |
6773 | if (src->wscale & PF_WSCALE_FLAG) { |
6774 | /* |
6775 | * Remove scale factor from initial |
6776 | * window |
6777 | */ |
6778 | sws = src->wscale & PF_WSCALE_MASK; |
6779 | win = ((u_int32_t)win + (1 << sws) - 1) |
6780 | >> sws; |
6781 | dws = dst->wscale & PF_WSCALE_MASK; |
6782 | } else { |
6783 | /* |
6784 | * Window scale negotiation has failed, |
6785 | * therefore we must restore the window |
6786 | * scale in the state record that we |
6787 | * optimistically removed in |
6788 | * pf_test_rule(). Care is required to |
6789 | * prevent arithmetic overflow from |
6790 | * zeroing the window when it's |
6791 | * truncated down to 16-bits. |
6792 | */ |
6793 | u_int32_t max_win = dst->max_win; |
6794 | max_win <<= |
6795 | dst->wscale & PF_WSCALE_MASK; |
6796 | dst->max_win = MIN(0xffff, max_win); |
6797 | /* in case of a retrans SYN|ACK */ |
6798 | dst->wscale = 0; |
6799 | } |
6800 | } |
6801 | } |
6802 | if (th->th_flags & TH_FIN) |
6803 | end++; |
6804 | |
6805 | src->seqlo = seq; |
6806 | if (src->state < TCPS_SYN_SENT) |
6807 | src->state = TCPS_SYN_SENT; |
6808 | |
6809 | /* |
6810 | * May need to slide the window (seqhi may have been set by |
6811 | * the crappy stack check or if we picked up the connection |
6812 | * after establishment) |
6813 | */ |
6814 | if (src->seqhi == 1 || |
6815 | SEQ_GEQ(end + MAX(1, (u_int32_t)dst->max_win << dws), |
6816 | src->seqhi)) |
6817 | src->seqhi = end + MAX(1, (u_int32_t)dst->max_win << dws); |
6818 | if (win > src->max_win) |
6819 | src->max_win = win; |
6820 | |
6821 | } else { |
6822 | ack = ntohl(th->th_ack) - dst->seqdiff; |
6823 | if (src->seqdiff) { |
6824 | /* Modulate sequence numbers */ |
6825 | pf_change_a(&th->th_seq, &th->th_sum, htonl(seq + |
6826 | src->seqdiff), 0); |
6827 | pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0); |
6828 | copyback = off+ sizeof (*th); |
6829 | } |
6830 | end = seq + pd->p_len; |
6831 | if (th->th_flags & TH_SYN) |
6832 | end++; |
6833 | if (th->th_flags & TH_FIN) |
6834 | end++; |
6835 | } |
6836 | |
6837 | if ((th->th_flags & TH_ACK) == 0) { |
6838 | /* Let it pass through the ack skew check */ |
6839 | ack = dst->seqlo; |
6840 | } else if ((ack == 0 && |
6841 | (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) || |
6842 | /* broken tcp stacks do not set ack */ |
6843 | (dst->state < TCPS_SYN_SENT)) { |
6844 | /* |
6845 | * Many stacks (ours included) will set the ACK number in an |
6846 | * FIN|ACK if the SYN times out -- no sequence to ACK. |
6847 | */ |
6848 | ack = dst->seqlo; |
6849 | } |
6850 | |
6851 | if (seq == end) { |
6852 | /* Ease sequencing restrictions on no data packets */ |
6853 | seq = src->seqlo; |
6854 | end = seq; |
6855 | } |
6856 | |
6857 | ackskew = dst->seqlo - ack; |
6858 | |
6859 | |
6860 | /* |
6861 | * Need to demodulate the sequence numbers in any TCP SACK options |
6862 | * (Selective ACK). We could optionally validate the SACK values |
6863 | * against the current ACK window, either forwards or backwards, but |
6864 | * I'm not confident that SACK has been implemented properly |
6865 | * everywhere. It wouldn't surprise me if several stacks accidently |
6866 | * SACK too far backwards of previously ACKed data. There really aren't |
6867 | * any security implications of bad SACKing unless the target stack |
6868 | * doesn't validate the option length correctly. Someone trying to |
6869 | * spoof into a TCP connection won't bother blindly sending SACK |
6870 | * options anyway. |
6871 | */ |
6872 | if (dst->seqdiff && (th->th_off << 2) > (int)sizeof (struct tcphdr)) { |
6873 | copyback = pf_modulate_sack(pbuf, off, pd, th, dst); |
6874 | if (copyback == -1) { |
6875 | REASON_SET(reason, PFRES_MEMORY); |
6876 | return (PF_DROP); |
6877 | } |
6878 | |
6879 | pbuf = pd->mp; // XXXSCW: Why? |
6880 | } |
6881 | |
6882 | |
6883 | #define MAXACKWINDOW (0xffff + 1500) /* 1500 is an arbitrary fudge factor */ |
6884 | if (SEQ_GEQ(src->seqhi, end) && |
6885 | /* Last octet inside other's window space */ |
6886 | SEQ_GEQ(seq, src->seqlo - ((u_int32_t)dst->max_win << dws)) && |
6887 | /* Retrans: not more than one window back */ |
6888 | (ackskew >= -MAXACKWINDOW) && |
6889 | /* Acking not more than one reassembled fragment backwards */ |
6890 | (ackskew <= (MAXACKWINDOW << sws)) && |
6891 | /* Acking not more than one window forward */ |
6892 | ((th->th_flags & TH_RST) == 0 || orig_seq == src->seqlo || |
6893 | (orig_seq == src->seqlo + 1) || (orig_seq + 1 == src->seqlo) || |
6894 | (pd->flags & PFDESC_IP_REAS) == 0)) { |
6895 | /* Require an exact/+1 sequence match on resets when possible */ |
6896 | |
6897 | if (dst->scrub || src->scrub) { |
6898 | if (pf_normalize_tcp_stateful(pbuf, off, pd, reason, th, |
6899 | *state, src, dst, ©back)) |
6900 | return (PF_DROP); |
6901 | |
6902 | pbuf = pd->mp; // XXXSCW: Why? |
6903 | } |
6904 | |
6905 | /* update max window */ |
6906 | if (src->max_win < win) |
6907 | src->max_win = win; |
6908 | /* synchronize sequencing */ |
6909 | if (SEQ_GT(end, src->seqlo)) |
6910 | src->seqlo = end; |
6911 | /* slide the window of what the other end can send */ |
6912 | if (SEQ_GEQ(ack + ((u_int32_t)win << sws), dst->seqhi)) |
6913 | dst->seqhi = ack + MAX(((u_int32_t)win << sws), 1); |
6914 | |
6915 | /* update states */ |
6916 | if (th->th_flags & TH_SYN) |
6917 | if (src->state < TCPS_SYN_SENT) |
6918 | src->state = TCPS_SYN_SENT; |
6919 | if (th->th_flags & TH_FIN) |
6920 | if (src->state < TCPS_CLOSING) |
6921 | src->state = TCPS_CLOSING; |
6922 | if (th->th_flags & TH_ACK) { |
6923 | if (dst->state == TCPS_SYN_SENT) { |
6924 | dst->state = TCPS_ESTABLISHED; |
6925 | if (src->state == TCPS_ESTABLISHED && |
6926 | (*state)->src_node != NULL && |
6927 | pf_src_connlimit(state)) { |
6928 | REASON_SET(reason, PFRES_SRCLIMIT); |
6929 | return (PF_DROP); |
6930 | } |
6931 | } else if (dst->state == TCPS_CLOSING) |
6932 | dst->state = TCPS_FIN_WAIT_2; |
6933 | } |
6934 | if (th->th_flags & TH_RST) |
6935 | src->state = dst->state = TCPS_TIME_WAIT; |
6936 | |
6937 | /* update expire time */ |
6938 | (*state)->expire = pf_time_second(); |
6939 | if (src->state >= TCPS_FIN_WAIT_2 && |
6940 | dst->state >= TCPS_FIN_WAIT_2) |
6941 | (*state)->timeout = PFTM_TCP_CLOSED; |
6942 | else if (src->state >= TCPS_CLOSING && |
6943 | dst->state >= TCPS_CLOSING) |
6944 | (*state)->timeout = PFTM_TCP_FIN_WAIT; |
6945 | else if (src->state < TCPS_ESTABLISHED || |
6946 | dst->state < TCPS_ESTABLISHED) |
6947 | (*state)->timeout = PFTM_TCP_OPENING; |
6948 | else if (src->state >= TCPS_CLOSING || |
6949 | dst->state >= TCPS_CLOSING) |
6950 | (*state)->timeout = PFTM_TCP_CLOSING; |
6951 | else |
6952 | (*state)->timeout = PFTM_TCP_ESTABLISHED; |
6953 | |
6954 | /* Fall through to PASS packet */ |
6955 | |
6956 | } else if ((dst->state < TCPS_SYN_SENT || |
6957 | dst->state >= TCPS_FIN_WAIT_2 || src->state >= TCPS_FIN_WAIT_2) && |
6958 | SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) && |
6959 | /* Within a window forward of the originating packet */ |
6960 | SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW)) { |
6961 | /* Within a window backward of the originating packet */ |
6962 | |
6963 | /* |
6964 | * This currently handles three situations: |
6965 | * 1) Stupid stacks will shotgun SYNs before their peer |
6966 | * replies. |
6967 | * 2) When PF catches an already established stream (the |
6968 | * firewall rebooted, the state table was flushed, routes |
6969 | * changed...) |
6970 | * 3) Packets get funky immediately after the connection |
6971 | * closes (this should catch Solaris spurious ACK|FINs |
6972 | * that web servers like to spew after a close) |
6973 | * |
6974 | * This must be a little more careful than the above code |
6975 | * since packet floods will also be caught here. We don't |
6976 | * update the TTL here to mitigate the damage of a packet |
6977 | * flood and so the same code can handle awkward establishment |
6978 | * and a loosened connection close. |
6979 | * In the establishment case, a correct peer response will |
6980 | * validate the connection, go through the normal state code |
6981 | * and keep updating the state TTL. |
6982 | */ |
6983 | |
6984 | if (pf_status.debug >= PF_DEBUG_MISC) { |
6985 | printf("pf: loose state match: " ); |
6986 | pf_print_state(*state); |
6987 | pf_print_flags(th->th_flags); |
6988 | printf(" seq=%u (%u) ack=%u len=%u ackskew=%d " |
6989 | "pkts=%llu:%llu dir=%s,%s\n" , seq, orig_seq, ack, |
6990 | pd->p_len, ackskew, (*state)->packets[0], |
6991 | (*state)->packets[1], |
6992 | direction == PF_IN ? "in" : "out" , |
6993 | direction == sk->direction ? |
6994 | "fwd" : "rev" ); |
6995 | } |
6996 | |
6997 | if (dst->scrub || src->scrub) { |
6998 | if (pf_normalize_tcp_stateful(pbuf, off, pd, reason, th, |
6999 | *state, src, dst, ©back)) |
7000 | return (PF_DROP); |
7001 | pbuf = pd->mp; // XXXSCW: Why? |
7002 | } |
7003 | |
7004 | /* update max window */ |
7005 | if (src->max_win < win) |
7006 | src->max_win = win; |
7007 | /* synchronize sequencing */ |
7008 | if (SEQ_GT(end, src->seqlo)) |
7009 | src->seqlo = end; |
7010 | /* slide the window of what the other end can send */ |
7011 | if (SEQ_GEQ(ack + ((u_int32_t)win << sws), dst->seqhi)) |
7012 | dst->seqhi = ack + MAX(((u_int32_t)win << sws), 1); |
7013 | |
7014 | /* |
7015 | * Cannot set dst->seqhi here since this could be a shotgunned |
7016 | * SYN and not an already established connection. |
7017 | */ |
7018 | |
7019 | if (th->th_flags & TH_FIN) |
7020 | if (src->state < TCPS_CLOSING) |
7021 | src->state = TCPS_CLOSING; |
7022 | if (th->th_flags & TH_RST) |
7023 | src->state = dst->state = TCPS_TIME_WAIT; |
7024 | |
7025 | /* Fall through to PASS packet */ |
7026 | |
7027 | } else { |
7028 | if (dst->state == TCPS_SYN_SENT && |
7029 | src->state == TCPS_SYN_SENT) { |
7030 | /* Send RST for state mismatches during handshake */ |
7031 | if (!(th->th_flags & TH_RST)) |
7032 | pf_send_tcp((*state)->rule.ptr, pd->af, |
7033 | pd->dst, pd->src, th->th_dport, |
7034 | th->th_sport, ntohl(th->th_ack), 0, |
7035 | TH_RST, 0, 0, |
7036 | (*state)->rule.ptr->return_ttl, 1, 0, |
7037 | pd->eh, kif->pfik_ifp); |
7038 | src->seqlo = 0; |
7039 | src->seqhi = 1; |
7040 | src->max_win = 1; |
7041 | } else if (pf_status.debug >= PF_DEBUG_MISC) { |
7042 | printf("pf: BAD state: " ); |
7043 | pf_print_state(*state); |
7044 | pf_print_flags(th->th_flags); |
7045 | printf("\n seq=%u (%u) ack=%u len=%u ackskew=%d " |
7046 | "sws=%u dws=%u pkts=%llu:%llu dir=%s,%s\n" , |
7047 | seq, orig_seq, ack, pd->p_len, ackskew, |
7048 | (unsigned int)sws, (unsigned int)dws, |
7049 | (*state)->packets[0], (*state)->packets[1], |
7050 | direction == PF_IN ? "in" : "out" , |
7051 | direction == sk->direction ? |
7052 | "fwd" : "rev" ); |
7053 | printf("pf: State failure on: %c %c %c %c | %c %c\n" , |
7054 | SEQ_GEQ(src->seqhi, end) ? ' ' : '1', |
7055 | SEQ_GEQ(seq, |
7056 | src->seqlo - ((u_int32_t)dst->max_win << dws)) ? |
7057 | ' ': '2', |
7058 | (ackskew >= -MAXACKWINDOW) ? ' ' : '3', |
7059 | (ackskew <= (MAXACKWINDOW << sws)) ? ' ' : '4', |
7060 | SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) ?' ' :'5', |
7061 | SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW) ?' ' :'6'); |
7062 | } |
7063 | REASON_SET(reason, PFRES_BADSTATE); |
7064 | return (PF_DROP); |
7065 | } |
7066 | |
7067 | /* Any packets which have gotten here are to be passed */ |
7068 | |
7069 | if (sk->app_state && |
7070 | sk->app_state->handler) { |
7071 | sk->app_state->handler(*state, direction, |
7072 | off + (th->th_off << 2), pd, kif); |
7073 | if (pd->lmw < 0) { |
7074 | REASON_SET(reason, PFRES_MEMORY); |
7075 | return (PF_DROP); |
7076 | } |
7077 | pbuf = pd->mp; // XXXSCW: Why? |
7078 | } |
7079 | |
7080 | /* translate source/destination address, if necessary */ |
7081 | if (STATE_TRANSLATE(sk)) { |
7082 | pd->naf = (pd->af == sk->af_lan) ? sk->af_gwy : sk->af_lan; |
7083 | |
7084 | if (direction == PF_OUT) { |
7085 | pf_change_ap(direction, pd->mp, pd->src, &th->th_sport, |
7086 | pd->ip_sum, &th->th_sum, &sk->gwy.addr, |
7087 | sk->gwy.xport.port, 0, pd->af, pd->naf, 1); |
7088 | } else { |
7089 | if (pd->af != pd->naf) { |
7090 | if (pd->af == sk->af_gwy) { |
7091 | pf_change_ap(direction, pd->mp, pd->dst, |
7092 | &th->th_dport, pd->ip_sum, |
7093 | &th->th_sum, &sk->lan.addr, |
7094 | sk->lan.xport.port, 0, |
7095 | pd->af, pd->naf, 0); |
7096 | |
7097 | pf_change_ap(direction, pd->mp, pd->src, |
7098 | &th->th_sport, pd->ip_sum, |
7099 | &th->th_sum, &sk->ext_lan.addr, |
7100 | th->th_sport, 0, pd->af, |
7101 | pd->naf, 0); |
7102 | |
7103 | } else { |
7104 | pf_change_ap(direction, pd->mp, pd->dst, |
7105 | &th->th_dport, pd->ip_sum, |
7106 | &th->th_sum, &sk->ext_gwy.addr, |
7107 | th->th_dport, 0, pd->af, |
7108 | pd->naf, 0); |
7109 | |
7110 | pf_change_ap(direction, pd->mp, pd->src, |
7111 | &th->th_sport, pd->ip_sum, |
7112 | &th->th_sum, &sk->gwy.addr, |
7113 | sk->gwy.xport.port, 0, pd->af, |
7114 | pd->naf, 0); |
7115 | } |
7116 | } else { |
7117 | pf_change_ap(direction, pd->mp, pd->dst, |
7118 | &th->th_dport, pd->ip_sum, |
7119 | &th->th_sum, &sk->lan.addr, |
7120 | sk->lan.xport.port, 0, pd->af, |
7121 | pd->naf, 1); |
7122 | } |
7123 | } |
7124 | |
7125 | copyback = off + sizeof (*th); |
7126 | } |
7127 | |
7128 | if (copyback) { |
7129 | if (pf_lazy_makewritable(pd, pbuf, copyback) == NULL) { |
7130 | REASON_SET(reason, PFRES_MEMORY); |
7131 | return (PF_DROP); |
7132 | } |
7133 | |
7134 | /* Copyback sequence modulation or stateful scrub changes */ |
7135 | pbuf_copy_back(pbuf, off, sizeof (*th), th); |
7136 | |
7137 | if (sk->af_lan != sk->af_gwy) |
7138 | return (pf_do_nat64(sk, pd, pbuf, off)); |
7139 | } |
7140 | return (PF_PASS); |
7141 | } |
7142 | |
7143 | static int |
7144 | pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif, |
7145 | pbuf_t *pbuf, int off, void *h, struct pf_pdesc *pd, u_short *reason) |
7146 | { |
7147 | #pragma unused(h) |
7148 | struct pf_state_peer *src, *dst; |
7149 | struct pf_state_key_cmp key; |
7150 | struct pf_state_key *sk; |
7151 | struct udphdr *uh = pd->hdr.udp; |
7152 | struct pf_app_state as; |
7153 | int action, extfilter; |
7154 | key.app_state = 0; |
7155 | key.proto_variant = PF_EXTFILTER_APD; |
7156 | |
7157 | key.proto = IPPROTO_UDP; |
7158 | key.af_lan = key.af_gwy = pd->af; |
7159 | |
7160 | /* |
7161 | * For NAT64 the first time rule search and state creation |
7162 | * is done on the incoming side only. |
7163 | * Once the state gets created, NAT64's LAN side (ipv6) will |
7164 | * not be able to find the state in ext-gwy tree as that normally |
7165 | * is intended to be looked up for incoming traffic from the |
7166 | * WAN side. |
7167 | * Therefore to handle NAT64 case we init keys here for both |
7168 | * lan-ext as well as ext-gwy trees. |
7169 | * In the state lookup we attempt a lookup on both trees if |
7170 | * first one does not return any result and return a match if |
7171 | * the match state's was created by NAT64 rule. |
7172 | */ |
7173 | PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy); |
7174 | PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy); |
7175 | key.ext_gwy.xport.port = uh->uh_sport; |
7176 | key.gwy.xport.port = uh->uh_dport; |
7177 | |
7178 | PF_ACPY(&key.lan.addr, pd->src, key.af_lan); |
7179 | PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan); |
7180 | key.lan.xport.port = uh->uh_sport; |
7181 | key.ext_lan.xport.port = uh->uh_dport; |
7182 | |
7183 | if (ntohs(uh->uh_sport) == PF_IKE_PORT && |
7184 | ntohs(uh->uh_dport) == PF_IKE_PORT) { |
7185 | struct pf_ike_hdr ike; |
7186 | size_t plen = pbuf->pb_packet_len - off - sizeof (*uh); |
7187 | if (plen < PF_IKE_PACKET_MINSIZE) { |
7188 | DPFPRINTF(PF_DEBUG_MISC, |
7189 | ("pf: IKE message too small.\n" )); |
7190 | return (PF_DROP); |
7191 | } |
7192 | |
7193 | if (plen > sizeof (ike)) |
7194 | plen = sizeof (ike); |
7195 | pbuf_copy_data(pbuf, off + sizeof (*uh), plen, &ike); |
7196 | |
7197 | if (ike.initiator_cookie) { |
7198 | key.app_state = &as; |
7199 | as.compare_lan_ext = pf_ike_compare; |
7200 | as.compare_ext_gwy = pf_ike_compare; |
7201 | as.u.ike.cookie = ike.initiator_cookie; |
7202 | } else { |
7203 | /* |
7204 | * <http://tools.ietf.org/html/\ |
7205 | * draft-ietf-ipsec-nat-t-ike-01> |
7206 | * Support non-standard NAT-T implementations that |
7207 | * push the ESP packet over the top of the IKE packet. |
7208 | * Do not drop packet. |
7209 | */ |
7210 | DPFPRINTF(PF_DEBUG_MISC, |
7211 | ("pf: IKE initiator cookie = 0.\n" )); |
7212 | } |
7213 | } |
7214 | |
7215 | *state = pf_find_state(kif, &key, direction); |
7216 | |
7217 | if (!key.app_state && *state == 0) { |
7218 | key.proto_variant = PF_EXTFILTER_AD; |
7219 | *state = pf_find_state(kif, &key, direction); |
7220 | } |
7221 | |
7222 | if (!key.app_state && *state == 0) { |
7223 | key.proto_variant = PF_EXTFILTER_EI; |
7224 | *state = pf_find_state(kif, &key, direction); |
7225 | } |
7226 | |
7227 | /* similar to STATE_LOOKUP() */ |
7228 | if (*state != NULL && pd != NULL && !(pd->pktflags & PKTF_FLOW_ID)) { |
7229 | pd->flowsrc = (*state)->state_key->flowsrc; |
7230 | pd->flowhash = (*state)->state_key->flowhash; |
7231 | if (pd->flowhash != 0) { |
7232 | pd->pktflags |= PKTF_FLOW_ID; |
7233 | pd->pktflags &= ~PKTF_FLOW_ADV; |
7234 | } |
7235 | } |
7236 | |
7237 | if (pf_state_lookup_aux(state, kif, direction, &action)) |
7238 | return (action); |
7239 | |
7240 | sk = (*state)->state_key; |
7241 | |
7242 | /* |
7243 | * In case of NAT64 the translation is first applied on the LAN |
7244 | * side. Therefore for stack's address family comparison |
7245 | * we use sk->af_lan. |
7246 | */ |
7247 | if ((direction == sk->direction) && (pd->af == sk->af_lan)) { |
7248 | src = &(*state)->src; |
7249 | dst = &(*state)->dst; |
7250 | } else { |
7251 | src = &(*state)->dst; |
7252 | dst = &(*state)->src; |
7253 | } |
7254 | |
7255 | /* update states */ |
7256 | if (src->state < PFUDPS_SINGLE) |
7257 | src->state = PFUDPS_SINGLE; |
7258 | if (dst->state == PFUDPS_SINGLE) |
7259 | dst->state = PFUDPS_MULTIPLE; |
7260 | |
7261 | /* update expire time */ |
7262 | (*state)->expire = pf_time_second(); |
7263 | if (src->state == PFUDPS_MULTIPLE && dst->state == PFUDPS_MULTIPLE) |
7264 | (*state)->timeout = PFTM_UDP_MULTIPLE; |
7265 | else |
7266 | (*state)->timeout = PFTM_UDP_SINGLE; |
7267 | |
7268 | extfilter = sk->proto_variant; |
7269 | if (extfilter > PF_EXTFILTER_APD) { |
7270 | if (direction == PF_OUT) { |
7271 | sk->ext_lan.xport.port = key.ext_lan.xport.port; |
7272 | if (extfilter > PF_EXTFILTER_AD) |
7273 | PF_ACPY(&sk->ext_lan.addr, &key.ext_lan.addr, |
7274 | key.af_lan); |
7275 | } else { |
7276 | sk->ext_gwy.xport.port = key.ext_gwy.xport.port; |
7277 | if (extfilter > PF_EXTFILTER_AD) |
7278 | PF_ACPY(&sk->ext_gwy.addr, &key.ext_gwy.addr, |
7279 | key.af_gwy); |
7280 | } |
7281 | } |
7282 | |
7283 | if (sk->app_state && sk->app_state->handler) { |
7284 | sk->app_state->handler(*state, direction, off + uh->uh_ulen, |
7285 | pd, kif); |
7286 | if (pd->lmw < 0) { |
7287 | REASON_SET(reason, PFRES_MEMORY); |
7288 | return (PF_DROP); |
7289 | } |
7290 | pbuf = pd->mp; // XXXSCW: Why? |
7291 | } |
7292 | |
7293 | /* translate source/destination address, if necessary */ |
7294 | if (STATE_TRANSLATE(sk)) { |
7295 | if (pf_lazy_makewritable(pd, pbuf, off + sizeof (*uh)) == NULL) { |
7296 | REASON_SET(reason, PFRES_MEMORY); |
7297 | return (PF_DROP); |
7298 | } |
7299 | |
7300 | pd->naf = (pd->af == sk->af_lan) ? sk->af_gwy : sk->af_lan; |
7301 | |
7302 | if (direction == PF_OUT) { |
7303 | pf_change_ap(direction, pd->mp, pd->src, &uh->uh_sport, |
7304 | pd->ip_sum, &uh->uh_sum, &sk->gwy.addr, |
7305 | sk->gwy.xport.port, 1, pd->af, pd->naf, 1); |
7306 | } else { |
7307 | if (pd->af != pd->naf) { |
7308 | |
7309 | if (pd->af == sk->af_gwy) { |
7310 | pf_change_ap(direction, pd->mp, pd->dst, |
7311 | &uh->uh_dport, pd->ip_sum, |
7312 | &uh->uh_sum, &sk->lan.addr, |
7313 | sk->lan.xport.port, 1, |
7314 | pd->af, pd->naf, 0); |
7315 | |
7316 | pf_change_ap(direction, pd->mp, pd->src, |
7317 | &uh->uh_sport, pd->ip_sum, |
7318 | &uh->uh_sum, &sk->ext_lan.addr, |
7319 | uh->uh_sport, 1, pd->af, |
7320 | pd->naf, 0); |
7321 | |
7322 | } else { |
7323 | pf_change_ap(direction, pd->mp, pd->dst, |
7324 | &uh->uh_dport, pd->ip_sum, |
7325 | &uh->uh_sum, &sk->ext_gwy.addr, |
7326 | uh->uh_dport, 1, pd->af, |
7327 | pd->naf, 0); |
7328 | |
7329 | pf_change_ap(direction, pd->mp, pd->src, |
7330 | &uh->uh_sport, pd->ip_sum, |
7331 | &uh->uh_sum, &sk->gwy.addr, |
7332 | sk->gwy.xport.port, 1, pd->af, |
7333 | pd->naf, 0); |
7334 | } |
7335 | } else { |
7336 | pf_change_ap(direction, pd->mp, pd->dst, |
7337 | &uh->uh_dport, pd->ip_sum, |
7338 | &uh->uh_sum, &sk->lan.addr, |
7339 | sk->lan.xport.port, 1, |
7340 | pd->af, pd->naf, 1); |
7341 | } |
7342 | } |
7343 | |
7344 | pbuf_copy_back(pbuf, off, sizeof (*uh), uh); |
7345 | if (sk->af_lan != sk->af_gwy) |
7346 | return (pf_do_nat64(sk, pd, pbuf, off)); |
7347 | } |
7348 | return (PF_PASS); |
7349 | } |
7350 | |
7351 | static int |
7352 | pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif, |
7353 | pbuf_t *pbuf, int off, void *h, struct pf_pdesc *pd, u_short *reason) |
7354 | { |
7355 | #pragma unused(h) |
7356 | struct pf_addr *saddr = pd->src, *daddr = pd->dst; |
7357 | struct in_addr srcv4_inaddr = saddr->v4addr; |
7358 | u_int16_t icmpid = 0, *icmpsum = NULL; |
7359 | u_int8_t icmptype = 0; |
7360 | int state_icmp = 0; |
7361 | struct pf_state_key_cmp key; |
7362 | struct pf_state_key *sk; |
7363 | |
7364 | struct pf_app_state as; |
7365 | key.app_state = 0; |
7366 | |
7367 | pd->off = off; |
7368 | |
7369 | switch (pd->proto) { |
7370 | #if INET |
7371 | case IPPROTO_ICMP: |
7372 | icmptype = pd->hdr.icmp->icmp_type; |
7373 | icmpid = pd->hdr.icmp->icmp_id; |
7374 | icmpsum = &pd->hdr.icmp->icmp_cksum; |
7375 | |
7376 | if (ICMP_ERRORTYPE(icmptype)) |
7377 | state_icmp++; |
7378 | break; |
7379 | #endif /* INET */ |
7380 | #if INET6 |
7381 | case IPPROTO_ICMPV6: |
7382 | icmptype = pd->hdr.icmp6->icmp6_type; |
7383 | icmpid = pd->hdr.icmp6->icmp6_id; |
7384 | icmpsum = &pd->hdr.icmp6->icmp6_cksum; |
7385 | |
7386 | if (ICMP6_ERRORTYPE(icmptype)) |
7387 | state_icmp++; |
7388 | break; |
7389 | #endif /* INET6 */ |
7390 | } |
7391 | |
7392 | if (!state_icmp) { |
7393 | |
7394 | /* |
7395 | * ICMP query/reply message not related to a TCP/UDP packet. |
7396 | * Search for an ICMP state. |
7397 | */ |
7398 | /* |
7399 | * NAT64 requires protocol translation between ICMPv4 |
7400 | * and ICMPv6. TCP and UDP do not require protocol |
7401 | * translation. To avoid adding complexity just to |
7402 | * handle ICMP(v4addr/v6addr), we always lookup for |
7403 | * proto = IPPROTO_ICMP on both LAN and WAN side |
7404 | */ |
7405 | key.proto = IPPROTO_ICMP; |
7406 | key.af_lan = key.af_gwy = pd->af; |
7407 | |
7408 | PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy); |
7409 | PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy); |
7410 | key.ext_gwy.xport.port = 0; |
7411 | key.gwy.xport.port = icmpid; |
7412 | |
7413 | PF_ACPY(&key.lan.addr, pd->src, key.af_lan); |
7414 | PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan); |
7415 | key.lan.xport.port = icmpid; |
7416 | key.ext_lan.xport.port = 0; |
7417 | |
7418 | STATE_LOOKUP(); |
7419 | |
7420 | sk = (*state)->state_key; |
7421 | (*state)->expire = pf_time_second(); |
7422 | (*state)->timeout = PFTM_ICMP_ERROR_REPLY; |
7423 | |
7424 | /* translate source/destination address, if necessary */ |
7425 | if (STATE_TRANSLATE(sk)) { |
7426 | pd->naf = (pd->af == sk->af_lan) ? |
7427 | sk->af_gwy : sk->af_lan; |
7428 | if (direction == PF_OUT) { |
7429 | switch (pd->af) { |
7430 | #if INET |
7431 | case AF_INET: |
7432 | pf_change_a(&saddr->v4addr.s_addr, |
7433 | pd->ip_sum, |
7434 | sk->gwy.addr.v4addr.s_addr, 0); |
7435 | pd->hdr.icmp->icmp_cksum = |
7436 | pf_cksum_fixup( |
7437 | pd->hdr.icmp->icmp_cksum, icmpid, |
7438 | sk->gwy.xport.port, 0); |
7439 | pd->hdr.icmp->icmp_id = |
7440 | sk->gwy.xport.port; |
7441 | if (pf_lazy_makewritable(pd, pbuf, |
7442 | off + ICMP_MINLEN) == NULL) |
7443 | return (PF_DROP); |
7444 | pbuf_copy_back(pbuf, off, ICMP_MINLEN, |
7445 | pd->hdr.icmp); |
7446 | break; |
7447 | #endif /* INET */ |
7448 | #if INET6 |
7449 | case AF_INET6: |
7450 | pf_change_a6(saddr, |
7451 | &pd->hdr.icmp6->icmp6_cksum, |
7452 | &sk->gwy.addr, 0); |
7453 | if (pf_lazy_makewritable(pd, NULL, |
7454 | off + sizeof (struct icmp6_hdr)) == |
7455 | NULL) |
7456 | return (PF_DROP); |
7457 | pbuf_copy_back(pbuf, off, |
7458 | sizeof (struct icmp6_hdr), |
7459 | pd->hdr.icmp6); |
7460 | break; |
7461 | #endif /* INET6 */ |
7462 | } |
7463 | } else { |
7464 | switch (pd->af) { |
7465 | #if INET |
7466 | case AF_INET: |
7467 | if (pd->naf != AF_INET) { |
7468 | if (pf_translate_icmp_af( |
7469 | AF_INET6, pd->hdr.icmp)) |
7470 | return (PF_DROP); |
7471 | |
7472 | pd->proto = IPPROTO_ICMPV6; |
7473 | |
7474 | } else { |
7475 | |
7476 | pf_change_a(&daddr->v4addr.s_addr, |
7477 | pd->ip_sum, |
7478 | sk->lan.addr.v4addr.s_addr, 0); |
7479 | |
7480 | pd->hdr.icmp->icmp_cksum = |
7481 | pf_cksum_fixup( |
7482 | pd->hdr.icmp->icmp_cksum, |
7483 | icmpid, sk->lan.xport.port, 0); |
7484 | |
7485 | pd->hdr.icmp->icmp_id = |
7486 | sk->lan.xport.port; |
7487 | } |
7488 | |
7489 | if (pf_lazy_makewritable(pd, pbuf, |
7490 | off + ICMP_MINLEN) == NULL) |
7491 | return (PF_DROP); |
7492 | pbuf_copy_back(pbuf, off, ICMP_MINLEN, |
7493 | pd->hdr.icmp); |
7494 | if (sk->af_lan != sk->af_gwy) |
7495 | return (pf_do_nat64(sk, pd, |
7496 | pbuf, off)); |
7497 | break; |
7498 | #endif /* INET */ |
7499 | #if INET6 |
7500 | case AF_INET6: |
7501 | if (pd->naf != AF_INET6) { |
7502 | if (pf_translate_icmp_af( |
7503 | AF_INET, pd->hdr.icmp6)) |
7504 | return (PF_DROP); |
7505 | |
7506 | pd->proto = IPPROTO_ICMP; |
7507 | } else { |
7508 | pf_change_a6(daddr, |
7509 | &pd->hdr.icmp6->icmp6_cksum, |
7510 | &sk->lan.addr, 0); |
7511 | } |
7512 | if (pf_lazy_makewritable(pd, pbuf, |
7513 | off + sizeof (struct icmp6_hdr)) == |
7514 | NULL) |
7515 | return (PF_DROP); |
7516 | pbuf_copy_back(pbuf, off, |
7517 | sizeof (struct icmp6_hdr), |
7518 | pd->hdr.icmp6); |
7519 | if (sk->af_lan != sk->af_gwy) |
7520 | return (pf_do_nat64(sk, pd, |
7521 | pbuf, off)); |
7522 | break; |
7523 | #endif /* INET6 */ |
7524 | } |
7525 | } |
7526 | } |
7527 | |
7528 | return (PF_PASS); |
7529 | |
7530 | } else { |
7531 | /* |
7532 | * ICMP error message in response to a TCP/UDP packet. |
7533 | * Extract the inner TCP/UDP header and search for that state. |
7534 | */ |
7535 | struct pf_pdesc pd2; /* For inner (original) header */ |
7536 | #if INET |
7537 | struct ip h2; |
7538 | #endif /* INET */ |
7539 | #if INET6 |
7540 | struct ip6_hdr h2_6; |
7541 | int terminal = 0; |
7542 | #endif /* INET6 */ |
7543 | int ipoff2 = 0; |
7544 | int off2 = 0; |
7545 | |
7546 | memset(&pd2, 0, sizeof (pd2)); |
7547 | |
7548 | pd2.af = pd->af; |
7549 | switch (pd->af) { |
7550 | #if INET |
7551 | case AF_INET: |
7552 | /* offset of h2 in mbuf chain */ |
7553 | ipoff2 = off + ICMP_MINLEN; |
7554 | |
7555 | if (!pf_pull_hdr(pbuf, ipoff2, &h2, sizeof (h2), |
7556 | NULL, reason, pd2.af)) { |
7557 | DPFPRINTF(PF_DEBUG_MISC, |
7558 | ("pf: ICMP error message too short " |
7559 | "(ip)\n" )); |
7560 | return (PF_DROP); |
7561 | } |
7562 | /* |
7563 | * ICMP error messages don't refer to non-first |
7564 | * fragments |
7565 | */ |
7566 | if (h2.ip_off & htons(IP_OFFMASK)) { |
7567 | REASON_SET(reason, PFRES_FRAG); |
7568 | return (PF_DROP); |
7569 | } |
7570 | |
7571 | /* offset of protocol header that follows h2 */ |
7572 | off2 = ipoff2 + (h2.ip_hl << 2); |
7573 | /* TODO */ |
7574 | pd2.off = ipoff2 + (h2.ip_hl << 2); |
7575 | |
7576 | pd2.proto = h2.ip_p; |
7577 | pd2.src = (struct pf_addr *)&h2.ip_src; |
7578 | pd2.dst = (struct pf_addr *)&h2.ip_dst; |
7579 | pd2.ip_sum = &h2.ip_sum; |
7580 | break; |
7581 | #endif /* INET */ |
7582 | #if INET6 |
7583 | case AF_INET6: |
7584 | ipoff2 = off + sizeof (struct icmp6_hdr); |
7585 | |
7586 | if (!pf_pull_hdr(pbuf, ipoff2, &h2_6, sizeof (h2_6), |
7587 | NULL, reason, pd2.af)) { |
7588 | DPFPRINTF(PF_DEBUG_MISC, |
7589 | ("pf: ICMP error message too short " |
7590 | "(ip6)\n" )); |
7591 | return (PF_DROP); |
7592 | } |
7593 | pd2.proto = h2_6.ip6_nxt; |
7594 | pd2.src = (struct pf_addr *)(uintptr_t)&h2_6.ip6_src; |
7595 | pd2.dst = (struct pf_addr *)(uintptr_t)&h2_6.ip6_dst; |
7596 | pd2.ip_sum = NULL; |
7597 | off2 = ipoff2 + sizeof (h2_6); |
7598 | do { |
7599 | switch (pd2.proto) { |
7600 | case IPPROTO_FRAGMENT: |
7601 | /* |
7602 | * ICMPv6 error messages for |
7603 | * non-first fragments |
7604 | */ |
7605 | REASON_SET(reason, PFRES_FRAG); |
7606 | return (PF_DROP); |
7607 | case IPPROTO_AH: |
7608 | case IPPROTO_HOPOPTS: |
7609 | case IPPROTO_ROUTING: |
7610 | case IPPROTO_DSTOPTS: { |
7611 | /* get next header and header length */ |
7612 | struct ip6_ext opt6; |
7613 | |
7614 | if (!pf_pull_hdr(pbuf, off2, &opt6, |
7615 | sizeof (opt6), NULL, reason, |
7616 | pd2.af)) { |
7617 | DPFPRINTF(PF_DEBUG_MISC, |
7618 | ("pf: ICMPv6 short opt\n" )); |
7619 | return (PF_DROP); |
7620 | } |
7621 | if (pd2.proto == IPPROTO_AH) |
7622 | off2 += (opt6.ip6e_len + 2) * 4; |
7623 | else |
7624 | off2 += (opt6.ip6e_len + 1) * 8; |
7625 | pd2.proto = opt6.ip6e_nxt; |
7626 | /* goto the next header */ |
7627 | break; |
7628 | } |
7629 | default: |
7630 | terminal++; |
7631 | break; |
7632 | } |
7633 | } while (!terminal); |
7634 | /* TODO */ |
7635 | pd2.off = ipoff2; |
7636 | break; |
7637 | #endif /* INET6 */ |
7638 | } |
7639 | |
7640 | switch (pd2.proto) { |
7641 | case IPPROTO_TCP: { |
7642 | struct tcphdr th; |
7643 | u_int32_t seq; |
7644 | struct pf_state_peer *src, *dst; |
7645 | u_int8_t dws; |
7646 | int copyback = 0; |
7647 | |
7648 | /* |
7649 | * Only the first 8 bytes of the TCP header can be |
7650 | * expected. Don't access any TCP header fields after |
7651 | * th_seq, an ackskew test is not possible. |
7652 | */ |
7653 | if (!pf_pull_hdr(pbuf, off2, &th, 8, NULL, reason, |
7654 | pd2.af)) { |
7655 | DPFPRINTF(PF_DEBUG_MISC, |
7656 | ("pf: ICMP error message too short " |
7657 | "(tcp)\n" )); |
7658 | return (PF_DROP); |
7659 | } |
7660 | |
7661 | key.proto = IPPROTO_TCP; |
7662 | key.af_gwy = pd2.af; |
7663 | PF_ACPY(&key.ext_gwy.addr, pd2.dst, key.af_gwy); |
7664 | PF_ACPY(&key.gwy.addr, pd2.src, key.af_gwy); |
7665 | key.ext_gwy.xport.port = th.th_dport; |
7666 | key.gwy.xport.port = th.th_sport; |
7667 | |
7668 | key.af_lan = pd2.af; |
7669 | PF_ACPY(&key.lan.addr, pd2.dst, key.af_lan); |
7670 | PF_ACPY(&key.ext_lan.addr, pd2.src, key.af_lan); |
7671 | key.lan.xport.port = th.th_dport; |
7672 | key.ext_lan.xport.port = th.th_sport; |
7673 | |
7674 | STATE_LOOKUP(); |
7675 | |
7676 | sk = (*state)->state_key; |
7677 | if ((direction == sk->direction) && |
7678 | ((sk->af_lan == sk->af_gwy) || |
7679 | (pd2.af == sk->af_lan))) { |
7680 | src = &(*state)->dst; |
7681 | dst = &(*state)->src; |
7682 | } else { |
7683 | src = &(*state)->src; |
7684 | dst = &(*state)->dst; |
7685 | } |
7686 | |
7687 | if (src->wscale && (dst->wscale & PF_WSCALE_FLAG)) |
7688 | dws = dst->wscale & PF_WSCALE_MASK; |
7689 | else |
7690 | dws = TCP_MAX_WINSHIFT; |
7691 | |
7692 | /* Demodulate sequence number */ |
7693 | seq = ntohl(th.th_seq) - src->seqdiff; |
7694 | if (src->seqdiff) { |
7695 | pf_change_a(&th.th_seq, icmpsum, |
7696 | htonl(seq), 0); |
7697 | copyback = 1; |
7698 | } |
7699 | |
7700 | if (!SEQ_GEQ(src->seqhi, seq) || |
7701 | !SEQ_GEQ(seq, |
7702 | src->seqlo - ((u_int32_t)dst->max_win << dws))) { |
7703 | if (pf_status.debug >= PF_DEBUG_MISC) { |
7704 | printf("pf: BAD ICMP %d:%d " , |
7705 | icmptype, pd->hdr.icmp->icmp_code); |
7706 | pf_print_host(pd->src, 0, pd->af); |
7707 | printf(" -> " ); |
7708 | pf_print_host(pd->dst, 0, pd->af); |
7709 | printf(" state: " ); |
7710 | pf_print_state(*state); |
7711 | printf(" seq=%u\n" , seq); |
7712 | } |
7713 | REASON_SET(reason, PFRES_BADSTATE); |
7714 | return (PF_DROP); |
7715 | } |
7716 | |
7717 | pd->naf = pd2.naf = (pd2.af == sk->af_lan) ? |
7718 | sk->af_gwy : sk->af_lan; |
7719 | |
7720 | if (STATE_TRANSLATE(sk)) { |
7721 | /* NAT64 case */ |
7722 | if (sk->af_lan != sk->af_gwy) { |
7723 | struct pf_state_host *saddr2, *daddr2; |
7724 | |
7725 | if (pd2.naf == sk->af_lan) { |
7726 | saddr2 = &sk->lan; |
7727 | daddr2 = &sk->ext_lan; |
7728 | } else { |
7729 | saddr2 = &sk->ext_gwy; |
7730 | daddr2 = &sk->gwy; |
7731 | } |
7732 | |
7733 | /* translate ICMP message types and codes */ |
7734 | if (pf_translate_icmp_af(pd->naf, |
7735 | pd->hdr.icmp)) |
7736 | return (PF_DROP); |
7737 | |
7738 | if (pf_lazy_makewritable(pd, pbuf, |
7739 | off2 + 8) == NULL) |
7740 | return (PF_DROP); |
7741 | |
7742 | pbuf_copy_back(pbuf, pd->off, |
7743 | sizeof(struct icmp6_hdr), |
7744 | pd->hdr.icmp6); |
7745 | |
7746 | /* |
7747 | * translate inner ip header within the |
7748 | * ICMP message |
7749 | */ |
7750 | if (pf_change_icmp_af(pbuf, ipoff2, pd, |
7751 | &pd2, &saddr2->addr, &daddr2->addr, |
7752 | pd->af, pd->naf)) |
7753 | return (PF_DROP); |
7754 | |
7755 | if (pd->naf == AF_INET) |
7756 | pd->proto = IPPROTO_ICMP; |
7757 | else |
7758 | pd->proto = IPPROTO_ICMPV6; |
7759 | |
7760 | /* |
7761 | * translate inner tcp header within |
7762 | * the ICMP message |
7763 | */ |
7764 | pf_change_ap(direction, NULL, pd2.src, |
7765 | &th.th_sport, pd2.ip_sum, |
7766 | &th.th_sum, &daddr2->addr, |
7767 | saddr2->xport.port, 0, pd2.af, |
7768 | pd2.naf, 0); |
7769 | |
7770 | pf_change_ap(direction, NULL, pd2.dst, |
7771 | &th.th_dport, pd2.ip_sum, |
7772 | &th.th_sum, &saddr2->addr, |
7773 | daddr2->xport.port, 0, pd2.af, |
7774 | pd2.naf, 0); |
7775 | |
7776 | pbuf_copy_back(pbuf, pd2.off, 8, &th); |
7777 | |
7778 | /* translate outer ip header */ |
7779 | PF_ACPY(&pd->naddr, &daddr2->addr, |
7780 | pd->naf); |
7781 | PF_ACPY(&pd->ndaddr, &saddr2->addr, |
7782 | pd->naf); |
7783 | if (pd->af == AF_INET) { |
7784 | memcpy(&pd->naddr.addr32[3], |
7785 | &srcv4_inaddr, |
7786 | sizeof(pd->naddr.addr32[3])); |
7787 | return (pf_nat64_ipv4(pbuf, off, |
7788 | pd)); |
7789 | } else { |
7790 | return (pf_nat64_ipv6(pbuf, off, |
7791 | pd)); |
7792 | } |
7793 | } |
7794 | if (direction == PF_IN) { |
7795 | pf_change_icmp(pd2.src, &th.th_sport, |
7796 | daddr, &sk->lan.addr, |
7797 | sk->lan.xport.port, NULL, |
7798 | pd2.ip_sum, icmpsum, |
7799 | pd->ip_sum, 0, pd2.af); |
7800 | } else { |
7801 | pf_change_icmp(pd2.dst, &th.th_dport, |
7802 | saddr, &sk->gwy.addr, |
7803 | sk->gwy.xport.port, NULL, |
7804 | pd2.ip_sum, icmpsum, |
7805 | pd->ip_sum, 0, pd2.af); |
7806 | } |
7807 | copyback = 1; |
7808 | } |
7809 | |
7810 | if (copyback) { |
7811 | if (pf_lazy_makewritable(pd, pbuf, off2 + 8) == |
7812 | NULL) |
7813 | return (PF_DROP); |
7814 | switch (pd2.af) { |
7815 | #if INET |
7816 | case AF_INET: |
7817 | pbuf_copy_back(pbuf, off, ICMP_MINLEN, |
7818 | pd->hdr.icmp); |
7819 | pbuf_copy_back(pbuf, ipoff2, sizeof(h2), |
7820 | &h2); |
7821 | break; |
7822 | #endif /* INET */ |
7823 | #if INET6 |
7824 | case AF_INET6: |
7825 | pbuf_copy_back(pbuf, off, |
7826 | sizeof (struct icmp6_hdr), |
7827 | pd->hdr.icmp6); |
7828 | pbuf_copy_back(pbuf, ipoff2, |
7829 | sizeof (h2_6), &h2_6); |
7830 | break; |
7831 | #endif /* INET6 */ |
7832 | } |
7833 | pbuf_copy_back(pbuf, off2, 8, &th); |
7834 | } |
7835 | |
7836 | return (PF_PASS); |
7837 | } |
7838 | case IPPROTO_UDP: { |
7839 | struct udphdr uh; |
7840 | int dx, action; |
7841 | if (!pf_pull_hdr(pbuf, off2, &uh, sizeof (uh), |
7842 | NULL, reason, pd2.af)) { |
7843 | DPFPRINTF(PF_DEBUG_MISC, |
7844 | ("pf: ICMP error message too short " |
7845 | "(udp)\n" )); |
7846 | return (PF_DROP); |
7847 | } |
7848 | |
7849 | key.af_gwy = pd2.af; |
7850 | PF_ACPY(&key.ext_gwy.addr, pd2.dst, key.af_gwy); |
7851 | PF_ACPY(&key.gwy.addr, pd2.src, key.af_gwy); |
7852 | key.ext_gwy.xport.port = uh.uh_dport; |
7853 | key.gwy.xport.port = uh.uh_sport; |
7854 | |
7855 | key.af_lan = pd2.af; |
7856 | PF_ACPY(&key.lan.addr, pd2.dst, key.af_lan); |
7857 | PF_ACPY(&key.ext_lan.addr, pd2.src, key.af_lan); |
7858 | key.lan.xport.port = uh.uh_dport; |
7859 | key.ext_lan.xport.port = uh.uh_sport; |
7860 | |
7861 | key.proto = IPPROTO_UDP; |
7862 | key.proto_variant = PF_EXTFILTER_APD; |
7863 | dx = direction; |
7864 | |
7865 | if (ntohs(uh.uh_sport) == PF_IKE_PORT && |
7866 | ntohs(uh.uh_dport) == PF_IKE_PORT) { |
7867 | struct pf_ike_hdr ike; |
7868 | size_t plen = pbuf->pb_packet_len - off2 - |
7869 | sizeof (uh); |
7870 | if (direction == PF_IN && |
7871 | plen < 8 /* PF_IKE_PACKET_MINSIZE */) { |
7872 | DPFPRINTF(PF_DEBUG_MISC, ("pf: " |
7873 | "ICMP error, embedded IKE message " |
7874 | "too small.\n" )); |
7875 | return (PF_DROP); |
7876 | } |
7877 | |
7878 | if (plen > sizeof (ike)) |
7879 | plen = sizeof (ike); |
7880 | pbuf_copy_data(pbuf, off + sizeof (uh), plen, |
7881 | &ike); |
7882 | |
7883 | key.app_state = &as; |
7884 | as.compare_lan_ext = pf_ike_compare; |
7885 | as.compare_ext_gwy = pf_ike_compare; |
7886 | as.u.ike.cookie = ike.initiator_cookie; |
7887 | } |
7888 | |
7889 | *state = pf_find_state(kif, &key, dx); |
7890 | |
7891 | if (key.app_state && *state == 0) { |
7892 | key.app_state = 0; |
7893 | *state = pf_find_state(kif, &key, dx); |
7894 | } |
7895 | |
7896 | if (*state == 0) { |
7897 | key.proto_variant = PF_EXTFILTER_AD; |
7898 | *state = pf_find_state(kif, &key, dx); |
7899 | } |
7900 | |
7901 | if (*state == 0) { |
7902 | key.proto_variant = PF_EXTFILTER_EI; |
7903 | *state = pf_find_state(kif, &key, dx); |
7904 | } |
7905 | |
7906 | /* similar to STATE_LOOKUP() */ |
7907 | if (*state != NULL && pd != NULL && |
7908 | !(pd->pktflags & PKTF_FLOW_ID)) { |
7909 | pd->flowsrc = (*state)->state_key->flowsrc; |
7910 | pd->flowhash = (*state)->state_key->flowhash; |
7911 | if (pd->flowhash != 0) { |
7912 | pd->pktflags |= PKTF_FLOW_ID; |
7913 | pd->pktflags &= ~PKTF_FLOW_ADV; |
7914 | } |
7915 | } |
7916 | |
7917 | if (pf_state_lookup_aux(state, kif, direction, &action)) |
7918 | return (action); |
7919 | |
7920 | sk = (*state)->state_key; |
7921 | pd->naf = pd2.naf = (pd2.af == sk->af_lan) ? |
7922 | sk->af_gwy : sk->af_lan; |
7923 | |
7924 | if (STATE_TRANSLATE(sk)) { |
7925 | /* NAT64 case */ |
7926 | if (sk->af_lan != sk->af_gwy) { |
7927 | struct pf_state_host *saddr2, *daddr2; |
7928 | |
7929 | if (pd2.naf == sk->af_lan) { |
7930 | saddr2 = &sk->lan; |
7931 | daddr2 = &sk->ext_lan; |
7932 | } else { |
7933 | saddr2 = &sk->ext_gwy; |
7934 | daddr2 = &sk->gwy; |
7935 | } |
7936 | |
7937 | /* translate ICMP message */ |
7938 | if (pf_translate_icmp_af(pd->naf, |
7939 | pd->hdr.icmp)) |
7940 | return (PF_DROP); |
7941 | if (pf_lazy_makewritable(pd, pbuf, |
7942 | off2 + 8) == NULL) |
7943 | return (PF_DROP); |
7944 | |
7945 | pbuf_copy_back(pbuf, pd->off, |
7946 | sizeof(struct icmp6_hdr), |
7947 | pd->hdr.icmp6); |
7948 | |
7949 | /* |
7950 | * translate inner ip header within the |
7951 | * ICMP message |
7952 | */ |
7953 | if (pf_change_icmp_af(pbuf, ipoff2, pd, |
7954 | &pd2, &saddr2->addr, &daddr2->addr, |
7955 | pd->af, pd->naf)) |
7956 | return (PF_DROP); |
7957 | |
7958 | if (pd->naf == AF_INET) |
7959 | pd->proto = IPPROTO_ICMP; |
7960 | else |
7961 | pd->proto = IPPROTO_ICMPV6; |
7962 | |
7963 | /* |
7964 | * translate inner udp header within |
7965 | * the ICMP message |
7966 | */ |
7967 | pf_change_ap(direction, NULL, pd2.src, |
7968 | &uh.uh_sport, pd2.ip_sum, |
7969 | &uh.uh_sum, &daddr2->addr, |
7970 | saddr2->xport.port, 0, pd2.af, |
7971 | pd2.naf, 0); |
7972 | |
7973 | pf_change_ap(direction, NULL, pd2.dst, |
7974 | &uh.uh_dport, pd2.ip_sum, |
7975 | &uh.uh_sum, &saddr2->addr, |
7976 | daddr2->xport.port, 0, pd2.af, |
7977 | pd2.naf, 0); |
7978 | |
7979 | pbuf_copy_back(pbuf, pd2.off, |
7980 | sizeof(uh), &uh); |
7981 | |
7982 | /* translate outer ip header */ |
7983 | PF_ACPY(&pd->naddr, &daddr2->addr, |
7984 | pd->naf); |
7985 | PF_ACPY(&pd->ndaddr, &saddr2->addr, |
7986 | pd->naf); |
7987 | if (pd->af == AF_INET) { |
7988 | memcpy(&pd->naddr.addr32[3], |
7989 | &srcv4_inaddr, |
7990 | sizeof(pd->naddr.addr32[3])); |
7991 | return (pf_nat64_ipv4(pbuf, off, |
7992 | pd)); |
7993 | } else { |
7994 | return (pf_nat64_ipv6(pbuf, off, |
7995 | pd)); |
7996 | } |
7997 | } |
7998 | if (direction == PF_IN) { |
7999 | pf_change_icmp(pd2.src, &uh.uh_sport, |
8000 | daddr, &sk->lan.addr, |
8001 | sk->lan.xport.port, &uh.uh_sum, |
8002 | pd2.ip_sum, icmpsum, |
8003 | pd->ip_sum, 1, pd2.af); |
8004 | } else { |
8005 | pf_change_icmp(pd2.dst, &uh.uh_dport, |
8006 | saddr, &sk->gwy.addr, |
8007 | sk->gwy.xport.port, &uh.uh_sum, |
8008 | pd2.ip_sum, icmpsum, |
8009 | pd->ip_sum, 1, pd2.af); |
8010 | } |
8011 | if (pf_lazy_makewritable(pd, pbuf, |
8012 | off2 + sizeof (uh)) == NULL) |
8013 | return (PF_DROP); |
8014 | switch (pd2.af) { |
8015 | #if INET |
8016 | case AF_INET: |
8017 | pbuf_copy_back(pbuf, off, ICMP_MINLEN, |
8018 | pd->hdr.icmp); |
8019 | pbuf_copy_back(pbuf, ipoff2, |
8020 | sizeof (h2), &h2); |
8021 | break; |
8022 | #endif /* INET */ |
8023 | #if INET6 |
8024 | case AF_INET6: |
8025 | pbuf_copy_back(pbuf, off, |
8026 | sizeof (struct icmp6_hdr), |
8027 | pd->hdr.icmp6); |
8028 | pbuf_copy_back(pbuf, ipoff2, |
8029 | sizeof (h2_6), &h2_6); |
8030 | break; |
8031 | #endif /* INET6 */ |
8032 | } |
8033 | pbuf_copy_back(pbuf, off2, sizeof (uh), &uh); |
8034 | } |
8035 | |
8036 | return (PF_PASS); |
8037 | } |
8038 | #if INET |
8039 | case IPPROTO_ICMP: { |
8040 | struct icmp iih; |
8041 | |
8042 | if (!pf_pull_hdr(pbuf, off2, &iih, ICMP_MINLEN, |
8043 | NULL, reason, pd2.af)) { |
8044 | DPFPRINTF(PF_DEBUG_MISC, |
8045 | ("pf: ICMP error message too short i" |
8046 | "(icmp)\n" )); |
8047 | return (PF_DROP); |
8048 | } |
8049 | |
8050 | key.proto = IPPROTO_ICMP; |
8051 | if (direction == PF_IN) { |
8052 | key.af_gwy = pd2.af; |
8053 | PF_ACPY(&key.ext_gwy.addr, pd2.dst, key.af_gwy); |
8054 | PF_ACPY(&key.gwy.addr, pd2.src, key.af_gwy); |
8055 | key.ext_gwy.xport.port = 0; |
8056 | key.gwy.xport.port = iih.icmp_id; |
8057 | } else { |
8058 | key.af_lan = pd2.af; |
8059 | PF_ACPY(&key.lan.addr, pd2.dst, key.af_lan); |
8060 | PF_ACPY(&key.ext_lan.addr, pd2.src, key.af_lan); |
8061 | key.lan.xport.port = iih.icmp_id; |
8062 | key.ext_lan.xport.port = 0; |
8063 | } |
8064 | |
8065 | STATE_LOOKUP(); |
8066 | |
8067 | sk = (*state)->state_key; |
8068 | if (STATE_TRANSLATE(sk)) { |
8069 | if (direction == PF_IN) { |
8070 | pf_change_icmp(pd2.src, &iih.icmp_id, |
8071 | daddr, &sk->lan.addr, |
8072 | sk->lan.xport.port, NULL, |
8073 | pd2.ip_sum, icmpsum, |
8074 | pd->ip_sum, 0, AF_INET); |
8075 | } else { |
8076 | pf_change_icmp(pd2.dst, &iih.icmp_id, |
8077 | saddr, &sk->gwy.addr, |
8078 | sk->gwy.xport.port, NULL, |
8079 | pd2.ip_sum, icmpsum, |
8080 | pd->ip_sum, 0, AF_INET); |
8081 | } |
8082 | if (pf_lazy_makewritable(pd, pbuf, |
8083 | off2 + ICMP_MINLEN) == NULL) |
8084 | return (PF_DROP); |
8085 | pbuf_copy_back(pbuf, off, ICMP_MINLEN, |
8086 | pd->hdr.icmp); |
8087 | pbuf_copy_back(pbuf, ipoff2, sizeof (h2), &h2); |
8088 | pbuf_copy_back(pbuf, off2, ICMP_MINLEN, &iih); |
8089 | } |
8090 | |
8091 | return (PF_PASS); |
8092 | } |
8093 | #endif /* INET */ |
8094 | #if INET6 |
8095 | case IPPROTO_ICMPV6: { |
8096 | struct icmp6_hdr iih; |
8097 | |
8098 | if (!pf_pull_hdr(pbuf, off2, &iih, |
8099 | sizeof (struct icmp6_hdr), NULL, reason, pd2.af)) { |
8100 | DPFPRINTF(PF_DEBUG_MISC, |
8101 | ("pf: ICMP error message too short " |
8102 | "(icmp6)\n" )); |
8103 | return (PF_DROP); |
8104 | } |
8105 | |
8106 | key.proto = IPPROTO_ICMPV6; |
8107 | if (direction == PF_IN) { |
8108 | key.af_gwy = pd2.af; |
8109 | PF_ACPY(&key.ext_gwy.addr, pd2.dst, key.af_gwy); |
8110 | PF_ACPY(&key.gwy.addr, pd2.src, key.af_gwy); |
8111 | key.ext_gwy.xport.port = 0; |
8112 | key.gwy.xport.port = iih.icmp6_id; |
8113 | } else { |
8114 | key.af_lan = pd2.af; |
8115 | PF_ACPY(&key.lan.addr, pd2.dst, key.af_lan); |
8116 | PF_ACPY(&key.ext_lan.addr, pd2.src, key.af_lan); |
8117 | key.lan.xport.port = iih.icmp6_id; |
8118 | key.ext_lan.xport.port = 0; |
8119 | } |
8120 | |
8121 | STATE_LOOKUP(); |
8122 | |
8123 | sk = (*state)->state_key; |
8124 | if (STATE_TRANSLATE(sk)) { |
8125 | if (direction == PF_IN) { |
8126 | pf_change_icmp(pd2.src, &iih.icmp6_id, |
8127 | daddr, &sk->lan.addr, |
8128 | sk->lan.xport.port, NULL, |
8129 | pd2.ip_sum, icmpsum, |
8130 | pd->ip_sum, 0, AF_INET6); |
8131 | } else { |
8132 | pf_change_icmp(pd2.dst, &iih.icmp6_id, |
8133 | saddr, &sk->gwy.addr, |
8134 | sk->gwy.xport.port, NULL, |
8135 | pd2.ip_sum, icmpsum, |
8136 | pd->ip_sum, 0, AF_INET6); |
8137 | } |
8138 | if (pf_lazy_makewritable(pd, pbuf, off2 + |
8139 | sizeof (struct icmp6_hdr)) == NULL) |
8140 | return (PF_DROP); |
8141 | pbuf_copy_back(pbuf, off, |
8142 | sizeof (struct icmp6_hdr), pd->hdr.icmp6); |
8143 | pbuf_copy_back(pbuf, ipoff2, sizeof (h2_6), |
8144 | &h2_6); |
8145 | pbuf_copy_back(pbuf, off2, |
8146 | sizeof (struct icmp6_hdr), &iih); |
8147 | } |
8148 | |
8149 | return (PF_PASS); |
8150 | } |
8151 | #endif /* INET6 */ |
8152 | default: { |
8153 | key.proto = pd2.proto; |
8154 | if (direction == PF_IN) { |
8155 | key.af_gwy = pd2.af; |
8156 | PF_ACPY(&key.ext_gwy.addr, pd2.dst, key.af_gwy); |
8157 | PF_ACPY(&key.gwy.addr, pd2.src, key.af_gwy); |
8158 | key.ext_gwy.xport.port = 0; |
8159 | key.gwy.xport.port = 0; |
8160 | } else { |
8161 | key.af_lan = pd2.af; |
8162 | PF_ACPY(&key.lan.addr, pd2.dst, key.af_lan); |
8163 | PF_ACPY(&key.ext_lan.addr, pd2.src, key.af_lan); |
8164 | key.lan.xport.port = 0; |
8165 | key.ext_lan.xport.port = 0; |
8166 | } |
8167 | |
8168 | STATE_LOOKUP(); |
8169 | |
8170 | sk = (*state)->state_key; |
8171 | if (STATE_TRANSLATE(sk)) { |
8172 | if (direction == PF_IN) { |
8173 | pf_change_icmp(pd2.src, NULL, daddr, |
8174 | &sk->lan.addr, 0, NULL, |
8175 | pd2.ip_sum, icmpsum, |
8176 | pd->ip_sum, 0, pd2.af); |
8177 | } else { |
8178 | pf_change_icmp(pd2.dst, NULL, saddr, |
8179 | &sk->gwy.addr, 0, NULL, |
8180 | pd2.ip_sum, icmpsum, |
8181 | pd->ip_sum, 0, pd2.af); |
8182 | } |
8183 | switch (pd2.af) { |
8184 | #if INET |
8185 | case AF_INET: |
8186 | if (pf_lazy_makewritable(pd, pbuf, |
8187 | ipoff2 + sizeof (h2)) == NULL) |
8188 | return (PF_DROP); |
8189 | /* |
8190 | * <XXXSCW> |
8191 | * Xnu was missing the following... |
8192 | */ |
8193 | pbuf_copy_back(pbuf, off, ICMP_MINLEN, |
8194 | pd->hdr.icmp); |
8195 | pbuf_copy_back(pbuf, ipoff2, |
8196 | sizeof(h2), &h2); |
8197 | break; |
8198 | /* |
8199 | * </XXXSCW> |
8200 | */ |
8201 | #endif /* INET */ |
8202 | #if INET6 |
8203 | case AF_INET6: |
8204 | if (pf_lazy_makewritable(pd, pbuf, |
8205 | ipoff2 + sizeof (h2_6)) == NULL) |
8206 | return (PF_DROP); |
8207 | pbuf_copy_back(pbuf, off, |
8208 | sizeof (struct icmp6_hdr), |
8209 | pd->hdr.icmp6); |
8210 | pbuf_copy_back(pbuf, ipoff2, |
8211 | sizeof (h2_6), &h2_6); |
8212 | break; |
8213 | #endif /* INET6 */ |
8214 | } |
8215 | } |
8216 | |
8217 | return (PF_PASS); |
8218 | } |
8219 | } |
8220 | } |
8221 | } |
8222 | |
8223 | static int |
8224 | pf_test_state_grev1(struct pf_state **state, int direction, |
8225 | struct pfi_kif *kif, int off, struct pf_pdesc *pd) |
8226 | { |
8227 | struct pf_state_peer *src; |
8228 | struct pf_state_peer *dst; |
8229 | struct pf_state_key_cmp key; |
8230 | struct pf_grev1_hdr *grev1 = pd->hdr.grev1; |
8231 | |
8232 | key.app_state = 0; |
8233 | key.proto = IPPROTO_GRE; |
8234 | key.proto_variant = PF_GRE_PPTP_VARIANT; |
8235 | if (direction == PF_IN) { |
8236 | key.af_gwy = pd->af; |
8237 | PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy); |
8238 | PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy); |
8239 | key.gwy.xport.call_id = grev1->call_id; |
8240 | } else { |
8241 | key.af_lan = pd->af; |
8242 | PF_ACPY(&key.lan.addr, pd->src, key.af_lan); |
8243 | PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan); |
8244 | key.ext_lan.xport.call_id = grev1->call_id; |
8245 | } |
8246 | |
8247 | STATE_LOOKUP(); |
8248 | |
8249 | if (direction == (*state)->state_key->direction) { |
8250 | src = &(*state)->src; |
8251 | dst = &(*state)->dst; |
8252 | } else { |
8253 | src = &(*state)->dst; |
8254 | dst = &(*state)->src; |
8255 | } |
8256 | |
8257 | /* update states */ |
8258 | if (src->state < PFGRE1S_INITIATING) |
8259 | src->state = PFGRE1S_INITIATING; |
8260 | |
8261 | /* update expire time */ |
8262 | (*state)->expire = pf_time_second(); |
8263 | if (src->state >= PFGRE1S_INITIATING && |
8264 | dst->state >= PFGRE1S_INITIATING) { |
8265 | if ((*state)->timeout != PFTM_TCP_ESTABLISHED) |
8266 | (*state)->timeout = PFTM_GREv1_ESTABLISHED; |
8267 | src->state = PFGRE1S_ESTABLISHED; |
8268 | dst->state = PFGRE1S_ESTABLISHED; |
8269 | } else { |
8270 | (*state)->timeout = PFTM_GREv1_INITIATING; |
8271 | } |
8272 | |
8273 | if ((*state)->state_key->app_state) |
8274 | (*state)->state_key->app_state->u.grev1.pptp_state->expire = |
8275 | pf_time_second(); |
8276 | |
8277 | /* translate source/destination address, if necessary */ |
8278 | if (STATE_GRE_TRANSLATE((*state)->state_key)) { |
8279 | if (direction == PF_OUT) { |
8280 | switch (pd->af) { |
8281 | #if INET |
8282 | case AF_INET: |
8283 | pf_change_a(&pd->src->v4addr.s_addr, |
8284 | pd->ip_sum, |
8285 | (*state)->state_key->gwy.addr.v4addr.s_addr, 0); |
8286 | break; |
8287 | #endif /* INET */ |
8288 | #if INET6 |
8289 | case AF_INET6: |
8290 | PF_ACPY(pd->src, &(*state)->state_key->gwy.addr, |
8291 | pd->af); |
8292 | break; |
8293 | #endif /* INET6 */ |
8294 | } |
8295 | } else { |
8296 | grev1->call_id = (*state)->state_key->lan.xport.call_id; |
8297 | |
8298 | switch (pd->af) { |
8299 | #if INET |
8300 | case AF_INET: |
8301 | pf_change_a(&pd->dst->v4addr.s_addr, |
8302 | pd->ip_sum, |
8303 | (*state)->state_key->lan.addr.v4addr.s_addr, 0); |
8304 | break; |
8305 | #endif /* INET */ |
8306 | #if INET6 |
8307 | case AF_INET6: |
8308 | PF_ACPY(pd->dst, &(*state)->state_key->lan.addr, |
8309 | pd->af); |
8310 | break; |
8311 | #endif /* INET6 */ |
8312 | } |
8313 | } |
8314 | |
8315 | if (pf_lazy_makewritable(pd, pd->mp, off + sizeof (*grev1)) == |
8316 | NULL) |
8317 | return (PF_DROP); |
8318 | pbuf_copy_back(pd->mp, off, sizeof (*grev1), grev1); |
8319 | } |
8320 | |
8321 | return (PF_PASS); |
8322 | } |
8323 | |
8324 | static int |
8325 | pf_test_state_esp(struct pf_state **state, int direction, struct pfi_kif *kif, |
8326 | int off, struct pf_pdesc *pd) |
8327 | { |
8328 | #pragma unused(off) |
8329 | struct pf_state_peer *src; |
8330 | struct pf_state_peer *dst; |
8331 | struct pf_state_key_cmp key; |
8332 | struct pf_esp_hdr *esp = pd->hdr.esp; |
8333 | int action; |
8334 | |
8335 | memset(&key, 0, sizeof (key)); |
8336 | key.proto = IPPROTO_ESP; |
8337 | if (direction == PF_IN) { |
8338 | key.af_gwy = pd->af; |
8339 | PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy); |
8340 | PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy); |
8341 | key.gwy.xport.spi = esp->spi; |
8342 | } else { |
8343 | key.af_lan = pd->af; |
8344 | PF_ACPY(&key.lan.addr, pd->src, key.af_lan); |
8345 | PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan); |
8346 | key.ext_lan.xport.spi = esp->spi; |
8347 | } |
8348 | |
8349 | *state = pf_find_state(kif, &key, direction); |
8350 | |
8351 | if (*state == 0) { |
8352 | struct pf_state *s; |
8353 | |
8354 | /* |
8355 | * <jhw@apple.com> |
8356 | * No matching state. Look for a blocking state. If we find |
8357 | * one, then use that state and move it so that it's keyed to |
8358 | * the SPI in the current packet. |
8359 | */ |
8360 | if (direction == PF_IN) { |
8361 | key.gwy.xport.spi = 0; |
8362 | |
8363 | s = pf_find_state(kif, &key, direction); |
8364 | if (s) { |
8365 | struct pf_state_key *sk = s->state_key; |
8366 | |
8367 | RB_REMOVE(pf_state_tree_ext_gwy, |
8368 | &pf_statetbl_ext_gwy, sk); |
8369 | sk->lan.xport.spi = sk->gwy.xport.spi = |
8370 | esp->spi; |
8371 | |
8372 | if (RB_INSERT(pf_state_tree_ext_gwy, |
8373 | &pf_statetbl_ext_gwy, sk)) |
8374 | pf_detach_state(s, PF_DT_SKIP_EXTGWY); |
8375 | else |
8376 | *state = s; |
8377 | } |
8378 | } else { |
8379 | key.ext_lan.xport.spi = 0; |
8380 | |
8381 | s = pf_find_state(kif, &key, direction); |
8382 | if (s) { |
8383 | struct pf_state_key *sk = s->state_key; |
8384 | |
8385 | RB_REMOVE(pf_state_tree_lan_ext, |
8386 | &pf_statetbl_lan_ext, sk); |
8387 | sk->ext_lan.xport.spi = esp->spi; |
8388 | |
8389 | if (RB_INSERT(pf_state_tree_lan_ext, |
8390 | &pf_statetbl_lan_ext, sk)) |
8391 | pf_detach_state(s, PF_DT_SKIP_LANEXT); |
8392 | else |
8393 | *state = s; |
8394 | } |
8395 | } |
8396 | |
8397 | if (s) { |
8398 | if (*state == 0) { |
8399 | #if NPFSYNC |
8400 | if (s->creatorid == pf_status.hostid) |
8401 | pfsync_delete_state(s); |
8402 | #endif |
8403 | s->timeout = PFTM_UNLINKED; |
8404 | hook_runloop(&s->unlink_hooks, |
8405 | HOOK_REMOVE|HOOK_FREE); |
8406 | pf_src_tree_remove_state(s); |
8407 | pf_free_state(s); |
8408 | return (PF_DROP); |
8409 | } |
8410 | } |
8411 | } |
8412 | |
8413 | /* similar to STATE_LOOKUP() */ |
8414 | if (*state != NULL && pd != NULL && !(pd->pktflags & PKTF_FLOW_ID)) { |
8415 | pd->flowsrc = (*state)->state_key->flowsrc; |
8416 | pd->flowhash = (*state)->state_key->flowhash; |
8417 | if (pd->flowhash != 0) { |
8418 | pd->pktflags |= PKTF_FLOW_ID; |
8419 | pd->pktflags &= ~PKTF_FLOW_ADV; |
8420 | } |
8421 | } |
8422 | |
8423 | if (pf_state_lookup_aux(state, kif, direction, &action)) |
8424 | return (action); |
8425 | |
8426 | if (direction == (*state)->state_key->direction) { |
8427 | src = &(*state)->src; |
8428 | dst = &(*state)->dst; |
8429 | } else { |
8430 | src = &(*state)->dst; |
8431 | dst = &(*state)->src; |
8432 | } |
8433 | |
8434 | /* update states */ |
8435 | if (src->state < PFESPS_INITIATING) |
8436 | src->state = PFESPS_INITIATING; |
8437 | |
8438 | /* update expire time */ |
8439 | (*state)->expire = pf_time_second(); |
8440 | if (src->state >= PFESPS_INITIATING && |
8441 | dst->state >= PFESPS_INITIATING) { |
8442 | (*state)->timeout = PFTM_ESP_ESTABLISHED; |
8443 | src->state = PFESPS_ESTABLISHED; |
8444 | dst->state = PFESPS_ESTABLISHED; |
8445 | } else { |
8446 | (*state)->timeout = PFTM_ESP_INITIATING; |
8447 | } |
8448 | /* translate source/destination address, if necessary */ |
8449 | if (STATE_ADDR_TRANSLATE((*state)->state_key)) { |
8450 | if (direction == PF_OUT) { |
8451 | switch (pd->af) { |
8452 | #if INET |
8453 | case AF_INET: |
8454 | pf_change_a(&pd->src->v4addr.s_addr, |
8455 | pd->ip_sum, |
8456 | (*state)->state_key->gwy.addr.v4addr.s_addr, 0); |
8457 | break; |
8458 | #endif /* INET */ |
8459 | #if INET6 |
8460 | case AF_INET6: |
8461 | PF_ACPY(pd->src, &(*state)->state_key->gwy.addr, |
8462 | pd->af); |
8463 | break; |
8464 | #endif /* INET6 */ |
8465 | } |
8466 | } else { |
8467 | switch (pd->af) { |
8468 | #if INET |
8469 | case AF_INET: |
8470 | pf_change_a(&pd->dst->v4addr.s_addr, |
8471 | pd->ip_sum, |
8472 | (*state)->state_key->lan.addr.v4addr.s_addr, 0); |
8473 | break; |
8474 | #endif /* INET */ |
8475 | #if INET6 |
8476 | case AF_INET6: |
8477 | PF_ACPY(pd->dst, &(*state)->state_key->lan.addr, |
8478 | pd->af); |
8479 | break; |
8480 | #endif /* INET6 */ |
8481 | } |
8482 | } |
8483 | } |
8484 | |
8485 | return (PF_PASS); |
8486 | } |
8487 | |
8488 | static int |
8489 | pf_test_state_other(struct pf_state **state, int direction, struct pfi_kif *kif, |
8490 | struct pf_pdesc *pd) |
8491 | { |
8492 | struct pf_state_peer *src, *dst; |
8493 | struct pf_state_key_cmp key; |
8494 | |
8495 | key.app_state = 0; |
8496 | key.proto = pd->proto; |
8497 | if (direction == PF_IN) { |
8498 | key.af_gwy = pd->af; |
8499 | PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy); |
8500 | PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy); |
8501 | key.ext_gwy.xport.port = 0; |
8502 | key.gwy.xport.port = 0; |
8503 | } else { |
8504 | key.af_lan = pd->af; |
8505 | PF_ACPY(&key.lan.addr, pd->src, key.af_lan); |
8506 | PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan); |
8507 | key.lan.xport.port = 0; |
8508 | key.ext_lan.xport.port = 0; |
8509 | } |
8510 | |
8511 | STATE_LOOKUP(); |
8512 | |
8513 | if (direction == (*state)->state_key->direction) { |
8514 | src = &(*state)->src; |
8515 | dst = &(*state)->dst; |
8516 | } else { |
8517 | src = &(*state)->dst; |
8518 | dst = &(*state)->src; |
8519 | } |
8520 | |
8521 | /* update states */ |
8522 | if (src->state < PFOTHERS_SINGLE) |
8523 | src->state = PFOTHERS_SINGLE; |
8524 | if (dst->state == PFOTHERS_SINGLE) |
8525 | dst->state = PFOTHERS_MULTIPLE; |
8526 | |
8527 | /* update expire time */ |
8528 | (*state)->expire = pf_time_second(); |
8529 | if (src->state == PFOTHERS_MULTIPLE && dst->state == PFOTHERS_MULTIPLE) |
8530 | (*state)->timeout = PFTM_OTHER_MULTIPLE; |
8531 | else |
8532 | (*state)->timeout = PFTM_OTHER_SINGLE; |
8533 | |
8534 | /* translate source/destination address, if necessary */ |
8535 | if (STATE_ADDR_TRANSLATE((*state)->state_key)) { |
8536 | if (direction == PF_OUT) { |
8537 | switch (pd->af) { |
8538 | #if INET |
8539 | case AF_INET: |
8540 | pf_change_a(&pd->src->v4addr.s_addr, |
8541 | pd->ip_sum, |
8542 | (*state)->state_key->gwy.addr.v4addr.s_addr, |
8543 | 0); |
8544 | break; |
8545 | #endif /* INET */ |
8546 | #if INET6 |
8547 | case AF_INET6: |
8548 | PF_ACPY(pd->src, |
8549 | &(*state)->state_key->gwy.addr, pd->af); |
8550 | break; |
8551 | #endif /* INET6 */ |
8552 | } |
8553 | } else { |
8554 | switch (pd->af) { |
8555 | #if INET |
8556 | case AF_INET: |
8557 | pf_change_a(&pd->dst->v4addr.s_addr, |
8558 | pd->ip_sum, |
8559 | (*state)->state_key->lan.addr.v4addr.s_addr, |
8560 | 0); |
8561 | break; |
8562 | #endif /* INET */ |
8563 | #if INET6 |
8564 | case AF_INET6: |
8565 | PF_ACPY(pd->dst, |
8566 | &(*state)->state_key->lan.addr, pd->af); |
8567 | break; |
8568 | #endif /* INET6 */ |
8569 | } |
8570 | } |
8571 | } |
8572 | |
8573 | return (PF_PASS); |
8574 | } |
8575 | |
8576 | /* |
8577 | * ipoff and off are measured from the start of the mbuf chain. |
8578 | * h must be at "ipoff" on the mbuf chain. |
8579 | */ |
8580 | void * |
8581 | pf_pull_hdr(pbuf_t *pbuf, int off, void *p, int len, |
8582 | u_short *actionp, u_short *reasonp, sa_family_t af) |
8583 | { |
8584 | switch (af) { |
8585 | #if INET |
8586 | case AF_INET: { |
8587 | struct ip *h = pbuf->pb_data; |
8588 | u_int16_t fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3; |
8589 | |
8590 | if (fragoff) { |
8591 | if (fragoff >= len) { |
8592 | ACTION_SET(actionp, PF_PASS); |
8593 | } else { |
8594 | ACTION_SET(actionp, PF_DROP); |
8595 | REASON_SET(reasonp, PFRES_FRAG); |
8596 | } |
8597 | return (NULL); |
8598 | } |
8599 | if (pbuf->pb_packet_len < (unsigned)(off + len) || |
8600 | ntohs(h->ip_len) < off + len) { |
8601 | ACTION_SET(actionp, PF_DROP); |
8602 | REASON_SET(reasonp, PFRES_SHORT); |
8603 | return (NULL); |
8604 | } |
8605 | break; |
8606 | } |
8607 | #endif /* INET */ |
8608 | #if INET6 |
8609 | case AF_INET6: { |
8610 | struct ip6_hdr *h = pbuf->pb_data; |
8611 | |
8612 | if (pbuf->pb_packet_len < (unsigned)(off + len) || |
8613 | (ntohs(h->ip6_plen) + sizeof (struct ip6_hdr)) < |
8614 | (unsigned)(off + len)) { |
8615 | ACTION_SET(actionp, PF_DROP); |
8616 | REASON_SET(reasonp, PFRES_SHORT); |
8617 | return (NULL); |
8618 | } |
8619 | break; |
8620 | } |
8621 | #endif /* INET6 */ |
8622 | } |
8623 | pbuf_copy_data(pbuf, off, len, p); |
8624 | return (p); |
8625 | } |
8626 | |
8627 | int |
8628 | pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *kif) |
8629 | { |
8630 | #pragma unused(kif) |
8631 | struct sockaddr_in *dst; |
8632 | int ret = 1; |
8633 | #if INET6 |
8634 | struct sockaddr_in6 *dst6; |
8635 | struct route_in6 ro; |
8636 | #else |
8637 | struct route ro; |
8638 | #endif |
8639 | |
8640 | bzero(&ro, sizeof (ro)); |
8641 | switch (af) { |
8642 | case AF_INET: |
8643 | dst = satosin(&ro.ro_dst); |
8644 | dst->sin_family = AF_INET; |
8645 | dst->sin_len = sizeof (*dst); |
8646 | dst->sin_addr = addr->v4addr; |
8647 | break; |
8648 | #if INET6 |
8649 | case AF_INET6: |
8650 | dst6 = (struct sockaddr_in6 *)&ro.ro_dst; |
8651 | dst6->sin6_family = AF_INET6; |
8652 | dst6->sin6_len = sizeof (*dst6); |
8653 | dst6->sin6_addr = addr->v6addr; |
8654 | break; |
8655 | #endif /* INET6 */ |
8656 | default: |
8657 | return (0); |
8658 | } |
8659 | |
8660 | /* XXX: IFT_ENC is not currently used by anything*/ |
8661 | /* Skip checks for ipsec interfaces */ |
8662 | if (kif != NULL && kif->pfik_ifp->if_type == IFT_ENC) |
8663 | goto out; |
8664 | |
8665 | /* XXX: what is the point of this? */ |
8666 | rtalloc((struct route *)&ro); |
8667 | |
8668 | out: |
8669 | ROUTE_RELEASE(&ro); |
8670 | return (ret); |
8671 | } |
8672 | |
8673 | int |
8674 | pf_rtlabel_match(struct pf_addr *addr, sa_family_t af, struct pf_addr_wrap *aw) |
8675 | { |
8676 | #pragma unused(aw) |
8677 | struct sockaddr_in *dst; |
8678 | #if INET6 |
8679 | struct sockaddr_in6 *dst6; |
8680 | struct route_in6 ro; |
8681 | #else |
8682 | struct route ro; |
8683 | #endif |
8684 | int ret = 0; |
8685 | |
8686 | bzero(&ro, sizeof (ro)); |
8687 | switch (af) { |
8688 | case AF_INET: |
8689 | dst = satosin(&ro.ro_dst); |
8690 | dst->sin_family = AF_INET; |
8691 | dst->sin_len = sizeof (*dst); |
8692 | dst->sin_addr = addr->v4addr; |
8693 | break; |
8694 | #if INET6 |
8695 | case AF_INET6: |
8696 | dst6 = (struct sockaddr_in6 *)&ro.ro_dst; |
8697 | dst6->sin6_family = AF_INET6; |
8698 | dst6->sin6_len = sizeof (*dst6); |
8699 | dst6->sin6_addr = addr->v6addr; |
8700 | break; |
8701 | #endif /* INET6 */ |
8702 | default: |
8703 | return (0); |
8704 | } |
8705 | |
8706 | /* XXX: what is the point of this? */ |
8707 | rtalloc((struct route *)&ro); |
8708 | |
8709 | ROUTE_RELEASE(&ro); |
8710 | |
8711 | return (ret); |
8712 | } |
8713 | |
8714 | #if INET |
8715 | static void |
8716 | pf_route(pbuf_t **pbufp, struct pf_rule *r, int dir, struct ifnet *oifp, |
8717 | struct pf_state *s, struct pf_pdesc *pd) |
8718 | { |
8719 | #pragma unused(pd) |
8720 | struct mbuf *m0, *m1; |
8721 | struct route iproute; |
8722 | struct route *ro = &iproute; |
8723 | struct sockaddr_in *dst; |
8724 | struct ip *ip; |
8725 | struct ifnet *ifp = NULL; |
8726 | struct pf_addr naddr; |
8727 | struct pf_src_node *sn = NULL; |
8728 | int error = 0; |
8729 | uint32_t sw_csum; |
8730 | int interface_mtu = 0; |
8731 | bzero(&iproute, sizeof (iproute)); |
8732 | |
8733 | if (pbufp == NULL || !pbuf_is_valid(*pbufp) || r == NULL || |
8734 | (dir != PF_IN && dir != PF_OUT) || oifp == NULL) |
8735 | panic("pf_route: invalid parameters" ); |
8736 | |
8737 | if (pd->pf_mtag->pftag_routed++ > 3) { |
8738 | pbuf_destroy(*pbufp); |
8739 | *pbufp = NULL; |
8740 | m0 = NULL; |
8741 | goto bad; |
8742 | } |
8743 | |
8744 | /* |
8745 | * Since this is something of an edge case and may involve the |
8746 | * host stack (for routing, at least for now), we convert the |
8747 | * incoming pbuf into an mbuf. |
8748 | */ |
8749 | if (r->rt == PF_DUPTO) |
8750 | m0 = pbuf_clone_to_mbuf(*pbufp); |
8751 | else |
8752 | if ((r->rt == PF_REPLYTO) == (r->direction == dir)) |
8753 | return; |
8754 | else { |
8755 | /* We're going to consume this packet */ |
8756 | m0 = pbuf_to_mbuf(*pbufp, TRUE); |
8757 | *pbufp = NULL; |
8758 | } |
8759 | |
8760 | if (m0 == NULL) |
8761 | goto bad; |
8762 | |
8763 | /* We now have the packet in an mbuf (m0) */ |
8764 | |
8765 | if (m0->m_len < (int)sizeof (struct ip)) { |
8766 | DPFPRINTF(PF_DEBUG_URGENT, |
8767 | ("pf_route: packet length < sizeof (struct ip)\n" )); |
8768 | goto bad; |
8769 | } |
8770 | |
8771 | ip = mtod(m0, struct ip *); |
8772 | |
8773 | dst = satosin((void *)&ro->ro_dst); |
8774 | dst->sin_family = AF_INET; |
8775 | dst->sin_len = sizeof (*dst); |
8776 | dst->sin_addr = ip->ip_dst; |
8777 | |
8778 | if (r->rt == PF_FASTROUTE) { |
8779 | rtalloc(ro); |
8780 | if (ro->ro_rt == NULL) { |
8781 | ipstat.ips_noroute++; |
8782 | goto bad; |
8783 | } |
8784 | |
8785 | ifp = ro->ro_rt->rt_ifp; |
8786 | RT_LOCK(ro->ro_rt); |
8787 | ro->ro_rt->rt_use++; |
8788 | |
8789 | if (ro->ro_rt->rt_flags & RTF_GATEWAY) |
8790 | dst = satosin((void *)ro->ro_rt->rt_gateway); |
8791 | RT_UNLOCK(ro->ro_rt); |
8792 | } else { |
8793 | if (TAILQ_EMPTY(&r->rpool.list)) { |
8794 | DPFPRINTF(PF_DEBUG_URGENT, |
8795 | ("pf_route: TAILQ_EMPTY(&r->rpool.list)\n" )); |
8796 | goto bad; |
8797 | } |
8798 | if (s == NULL) { |
8799 | pf_map_addr(AF_INET, r, (struct pf_addr *)&ip->ip_src, |
8800 | &naddr, NULL, &sn); |
8801 | if (!PF_AZERO(&naddr, AF_INET)) |
8802 | dst->sin_addr.s_addr = naddr.v4addr.s_addr; |
8803 | ifp = r->rpool.cur->kif ? |
8804 | r->rpool.cur->kif->pfik_ifp : NULL; |
8805 | } else { |
8806 | if (!PF_AZERO(&s->rt_addr, AF_INET)) |
8807 | dst->sin_addr.s_addr = |
8808 | s->rt_addr.v4addr.s_addr; |
8809 | ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL; |
8810 | } |
8811 | } |
8812 | if (ifp == NULL) |
8813 | goto bad; |
8814 | |
8815 | if (oifp != ifp) { |
8816 | if (pf_test_mbuf(PF_OUT, ifp, &m0, NULL, NULL) != PF_PASS) |
8817 | goto bad; |
8818 | else if (m0 == NULL) |
8819 | goto done; |
8820 | if (m0->m_len < (int)sizeof (struct ip)) { |
8821 | DPFPRINTF(PF_DEBUG_URGENT, |
8822 | ("pf_route: packet length < sizeof (struct ip)\n" )); |
8823 | goto bad; |
8824 | } |
8825 | ip = mtod(m0, struct ip *); |
8826 | } |
8827 | |
8828 | /* Catch routing changes wrt. hardware checksumming for TCP or UDP. */ |
8829 | ip_output_checksum(ifp, m0, ((ip->ip_hl) << 2), ntohs(ip->ip_len), |
8830 | &sw_csum); |
8831 | |
8832 | interface_mtu = ifp->if_mtu; |
8833 | |
8834 | if (INTF_ADJUST_MTU_FOR_CLAT46(ifp)) { |
8835 | interface_mtu = IN6_LINKMTU(ifp); |
8836 | /* Further adjust the size for CLAT46 expansion */ |
8837 | interface_mtu -= CLAT46_HDR_EXPANSION_OVERHD; |
8838 | } |
8839 | |
8840 | if (ntohs(ip->ip_len) <= interface_mtu || TSO_IPV4_OK(ifp, m0) || |
8841 | (!(ip->ip_off & htons(IP_DF)) && |
8842 | (ifp->if_hwassist & CSUM_FRAGMENT))) { |
8843 | ip->ip_sum = 0; |
8844 | if (sw_csum & CSUM_DELAY_IP) { |
8845 | ip->ip_sum = in_cksum(m0, ip->ip_hl << 2); |
8846 | sw_csum &= ~CSUM_DELAY_IP; |
8847 | m0->m_pkthdr.csum_flags &= ~CSUM_DELAY_IP; |
8848 | } |
8849 | error = ifnet_output(ifp, PF_INET, m0, ro->ro_rt, sintosa(dst)); |
8850 | goto done; |
8851 | } |
8852 | |
8853 | /* |
8854 | * Too large for interface; fragment if possible. |
8855 | * Must be able to put at least 8 bytes per fragment. |
8856 | * Balk when DF bit is set or the interface didn't support TSO. |
8857 | */ |
8858 | if ((ip->ip_off & htons(IP_DF)) || |
8859 | (m0->m_pkthdr.csum_flags & CSUM_TSO_IPV4)) { |
8860 | ipstat.ips_cantfrag++; |
8861 | if (r->rt != PF_DUPTO) { |
8862 | icmp_error(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 0, |
8863 | interface_mtu); |
8864 | goto done; |
8865 | } else |
8866 | goto bad; |
8867 | } |
8868 | |
8869 | m1 = m0; |
8870 | |
8871 | /* PR-8933605: send ip_len,ip_off to ip_fragment in host byte order */ |
8872 | #if BYTE_ORDER != BIG_ENDIAN |
8873 | NTOHS(ip->ip_off); |
8874 | NTOHS(ip->ip_len); |
8875 | #endif |
8876 | error = ip_fragment(m0, ifp, interface_mtu, sw_csum); |
8877 | |
8878 | if (error) { |
8879 | m0 = NULL; |
8880 | goto bad; |
8881 | } |
8882 | |
8883 | for (m0 = m1; m0; m0 = m1) { |
8884 | m1 = m0->m_nextpkt; |
8885 | m0->m_nextpkt = 0; |
8886 | if (error == 0) |
8887 | error = ifnet_output(ifp, PF_INET, m0, ro->ro_rt, |
8888 | sintosa(dst)); |
8889 | else |
8890 | m_freem(m0); |
8891 | } |
8892 | |
8893 | if (error == 0) |
8894 | ipstat.ips_fragmented++; |
8895 | |
8896 | done: |
8897 | ROUTE_RELEASE(&iproute); |
8898 | return; |
8899 | |
8900 | bad: |
8901 | if (m0) |
8902 | m_freem(m0); |
8903 | goto done; |
8904 | } |
8905 | #endif /* INET */ |
8906 | |
8907 | #if INET6 |
8908 | static void |
8909 | pf_route6(pbuf_t **pbufp, struct pf_rule *r, int dir, struct ifnet *oifp, |
8910 | struct pf_state *s, struct pf_pdesc *pd) |
8911 | { |
8912 | #pragma unused(pd) |
8913 | struct mbuf *m0; |
8914 | struct route_in6 ip6route; |
8915 | struct route_in6 *ro; |
8916 | struct sockaddr_in6 *dst; |
8917 | struct ip6_hdr *ip6; |
8918 | struct ifnet *ifp = NULL; |
8919 | struct pf_addr naddr; |
8920 | struct pf_src_node *sn = NULL; |
8921 | int error = 0; |
8922 | |
8923 | if (pbufp == NULL || !pbuf_is_valid(*pbufp) || r == NULL || |
8924 | (dir != PF_IN && dir != PF_OUT) || oifp == NULL) |
8925 | panic("pf_route6: invalid parameters" ); |
8926 | |
8927 | if (pd->pf_mtag->pftag_routed++ > 3) { |
8928 | pbuf_destroy(*pbufp); |
8929 | *pbufp = NULL; |
8930 | m0 = NULL; |
8931 | goto bad; |
8932 | } |
8933 | |
8934 | /* |
8935 | * Since this is something of an edge case and may involve the |
8936 | * host stack (for routing, at least for now), we convert the |
8937 | * incoming pbuf into an mbuf. |
8938 | */ |
8939 | if (r->rt == PF_DUPTO) { |
8940 | m0 = pbuf_clone_to_mbuf(*pbufp); |
8941 | } else |
8942 | if ((r->rt == PF_REPLYTO) == (r->direction == dir)) |
8943 | return; |
8944 | else { |
8945 | /* We're about to consume this packet */ |
8946 | m0 = pbuf_to_mbuf(*pbufp, TRUE); |
8947 | *pbufp = NULL; |
8948 | } |
8949 | |
8950 | if (m0 == NULL) |
8951 | goto bad; |
8952 | |
8953 | if (m0->m_len < (int)sizeof (struct ip6_hdr)) { |
8954 | DPFPRINTF(PF_DEBUG_URGENT, |
8955 | ("pf_route6: m0->m_len < sizeof (struct ip6_hdr)\n" )); |
8956 | goto bad; |
8957 | } |
8958 | ip6 = mtod(m0, struct ip6_hdr *); |
8959 | |
8960 | ro = &ip6route; |
8961 | bzero((caddr_t)ro, sizeof (*ro)); |
8962 | dst = (struct sockaddr_in6 *)&ro->ro_dst; |
8963 | dst->sin6_family = AF_INET6; |
8964 | dst->sin6_len = sizeof (*dst); |
8965 | dst->sin6_addr = ip6->ip6_dst; |
8966 | |
8967 | /* Cheat. XXX why only in the v6addr case??? */ |
8968 | if (r->rt == PF_FASTROUTE) { |
8969 | struct pf_mtag *pf_mtag; |
8970 | |
8971 | if ((pf_mtag = pf_get_mtag(m0)) == NULL) |
8972 | goto bad; |
8973 | pf_mtag->pftag_flags |= PF_TAG_GENERATED; |
8974 | ip6_output(m0, NULL, NULL, 0, NULL, NULL, NULL); |
8975 | return; |
8976 | } |
8977 | |
8978 | if (TAILQ_EMPTY(&r->rpool.list)) { |
8979 | DPFPRINTF(PF_DEBUG_URGENT, |
8980 | ("pf_route6: TAILQ_EMPTY(&r->rpool.list)\n" )); |
8981 | goto bad; |
8982 | } |
8983 | if (s == NULL) { |
8984 | pf_map_addr(AF_INET6, r, (struct pf_addr *)(uintptr_t)&ip6->ip6_src, |
8985 | &naddr, NULL, &sn); |
8986 | if (!PF_AZERO(&naddr, AF_INET6)) |
8987 | PF_ACPY((struct pf_addr *)&dst->sin6_addr, |
8988 | &naddr, AF_INET6); |
8989 | ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL; |
8990 | } else { |
8991 | if (!PF_AZERO(&s->rt_addr, AF_INET6)) |
8992 | PF_ACPY((struct pf_addr *)&dst->sin6_addr, |
8993 | &s->rt_addr, AF_INET6); |
8994 | ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL; |
8995 | } |
8996 | if (ifp == NULL) |
8997 | goto bad; |
8998 | |
8999 | if (oifp != ifp) { |
9000 | if (pf_test6_mbuf(PF_OUT, ifp, &m0, NULL, NULL) != PF_PASS) |
9001 | goto bad; |
9002 | else if (m0 == NULL) |
9003 | goto done; |
9004 | if (m0->m_len < (int)sizeof (struct ip6_hdr)) { |
9005 | DPFPRINTF(PF_DEBUG_URGENT, ("pf_route6: m0->m_len " |
9006 | "< sizeof (struct ip6_hdr)\n" )); |
9007 | goto bad; |
9008 | } |
9009 | ip6 = mtod(m0, struct ip6_hdr *); |
9010 | } |
9011 | |
9012 | /* |
9013 | * If the packet is too large for the outgoing interface, |
9014 | * send back an icmp6 error. |
9015 | */ |
9016 | if (IN6_IS_SCOPE_EMBED(&dst->sin6_addr)) |
9017 | dst->sin6_addr.s6_addr16[1] = htons(ifp->if_index); |
9018 | if ((unsigned)m0->m_pkthdr.len <= ifp->if_mtu) { |
9019 | error = nd6_output(ifp, ifp, m0, dst, NULL, NULL); |
9020 | } else { |
9021 | in6_ifstat_inc(ifp, ifs6_in_toobig); |
9022 | if (r->rt != PF_DUPTO) |
9023 | icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu); |
9024 | else |
9025 | goto bad; |
9026 | } |
9027 | |
9028 | done: |
9029 | return; |
9030 | |
9031 | bad: |
9032 | if (m0) |
9033 | m_freem(m0); |
9034 | goto done; |
9035 | } |
9036 | #endif /* INET6 */ |
9037 | |
9038 | |
9039 | /* |
9040 | * check protocol (tcp/udp/icmp/icmp6) checksum and set mbuf flag |
9041 | * off is the offset where the protocol header starts |
9042 | * len is the total length of protocol header plus payload |
9043 | * returns 0 when the checksum is valid, otherwise returns 1. |
9044 | */ |
9045 | static int |
9046 | pf_check_proto_cksum(pbuf_t *pbuf, int off, int len, u_int8_t p, |
9047 | sa_family_t af) |
9048 | { |
9049 | u_int16_t sum; |
9050 | |
9051 | switch (p) { |
9052 | case IPPROTO_TCP: |
9053 | case IPPROTO_UDP: |
9054 | /* |
9055 | * Optimize for the common case; if the hardware calculated |
9056 | * value doesn't include pseudo-header checksum, or if it |
9057 | * is partially-computed (only 16-bit summation), do it in |
9058 | * software below. |
9059 | */ |
9060 | if ((*pbuf->pb_csum_flags & |
9061 | (CSUM_DATA_VALID | CSUM_PSEUDO_HDR)) == |
9062 | (CSUM_DATA_VALID | CSUM_PSEUDO_HDR) && |
9063 | (*pbuf->pb_csum_data ^ 0xffff) == 0) { |
9064 | return (0); |
9065 | } |
9066 | break; |
9067 | case IPPROTO_ICMP: |
9068 | #if INET6 |
9069 | case IPPROTO_ICMPV6: |
9070 | #endif /* INET6 */ |
9071 | break; |
9072 | default: |
9073 | return (1); |
9074 | } |
9075 | if (off < (int)sizeof (struct ip) || len < (int)sizeof (struct udphdr)) |
9076 | return (1); |
9077 | if (pbuf->pb_packet_len < (unsigned)(off + len)) |
9078 | return (1); |
9079 | switch (af) { |
9080 | #if INET |
9081 | case AF_INET: |
9082 | if (p == IPPROTO_ICMP) { |
9083 | #if 0 |
9084 | if (m->m_len < off) |
9085 | return (1); |
9086 | m->m_data += off; |
9087 | m->m_len -= off; |
9088 | sum = in_cksum(m, len); |
9089 | m->m_data -= off; |
9090 | m->m_len += off; |
9091 | #else |
9092 | if (pbuf->pb_contig_len < (unsigned)off) |
9093 | return (1); |
9094 | sum = pbuf_inet_cksum(pbuf, 0, off, len); |
9095 | #endif |
9096 | } else { |
9097 | if (pbuf->pb_contig_len < (int)sizeof (struct ip)) |
9098 | return (1); |
9099 | sum = pbuf_inet_cksum(pbuf, p, off, len); |
9100 | } |
9101 | break; |
9102 | #endif /* INET */ |
9103 | #if INET6 |
9104 | case AF_INET6: |
9105 | if (pbuf->pb_contig_len < (int)sizeof (struct ip6_hdr)) |
9106 | return (1); |
9107 | sum = pbuf_inet6_cksum(pbuf, p, off, len); |
9108 | break; |
9109 | #endif /* INET6 */ |
9110 | default: |
9111 | return (1); |
9112 | } |
9113 | if (sum) { |
9114 | switch (p) { |
9115 | case IPPROTO_TCP: |
9116 | tcpstat.tcps_rcvbadsum++; |
9117 | break; |
9118 | case IPPROTO_UDP: |
9119 | udpstat.udps_badsum++; |
9120 | break; |
9121 | case IPPROTO_ICMP: |
9122 | icmpstat.icps_checksum++; |
9123 | break; |
9124 | #if INET6 |
9125 | case IPPROTO_ICMPV6: |
9126 | icmp6stat.icp6s_checksum++; |
9127 | break; |
9128 | #endif /* INET6 */ |
9129 | } |
9130 | return (1); |
9131 | } |
9132 | return (0); |
9133 | } |
9134 | |
9135 | #if INET |
9136 | #define PF_APPLE_UPDATE_PDESC_IPv4() \ |
9137 | do { \ |
9138 | if (pbuf && pd.mp && pbuf != pd.mp) { \ |
9139 | pbuf = pd.mp; \ |
9140 | h = pbuf->pb_data; \ |
9141 | pd.pf_mtag = pf_get_mtag_pbuf(pbuf); \ |
9142 | } \ |
9143 | } while (0) |
9144 | |
9145 | int |
9146 | pf_test_mbuf(int dir, struct ifnet *ifp, struct mbuf **m0, |
9147 | struct ether_header *eh, struct ip_fw_args *fwa) |
9148 | { |
9149 | pbuf_t pbuf_store, *pbuf; |
9150 | int rv; |
9151 | |
9152 | pbuf_init_mbuf(&pbuf_store, *m0, (*m0)->m_pkthdr.rcvif); |
9153 | pbuf = &pbuf_store; |
9154 | |
9155 | rv = pf_test(dir, ifp, &pbuf, eh, fwa); |
9156 | |
9157 | if (pbuf_is_valid(pbuf)) { |
9158 | *m0 = pbuf->pb_mbuf; |
9159 | pbuf->pb_mbuf = NULL; |
9160 | pbuf_destroy(pbuf); |
9161 | } else |
9162 | *m0 = NULL; |
9163 | |
9164 | return (rv); |
9165 | } |
9166 | |
9167 | int |
9168 | pf_test(int dir, struct ifnet *ifp, pbuf_t **pbufp, |
9169 | struct ether_header *eh, struct ip_fw_args *fwa) |
9170 | { |
9171 | #if !DUMMYNET |
9172 | #pragma unused(fwa) |
9173 | #endif |
9174 | struct pfi_kif *kif; |
9175 | u_short action = PF_PASS, reason = 0, log = 0; |
9176 | pbuf_t *pbuf = *pbufp; |
9177 | struct ip *h = 0; |
9178 | struct pf_rule *a = NULL, *r = &pf_default_rule, *tr, *nr; |
9179 | struct pf_state *s = NULL; |
9180 | struct pf_state_key *sk = NULL; |
9181 | struct pf_ruleset *ruleset = NULL; |
9182 | struct pf_pdesc pd; |
9183 | int off, dirndx, pqid = 0; |
9184 | |
9185 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
9186 | |
9187 | if (!pf_status.running) |
9188 | return (PF_PASS); |
9189 | |
9190 | memset(&pd, 0, sizeof (pd)); |
9191 | |
9192 | if ((pd.pf_mtag = pf_get_mtag_pbuf(pbuf)) == NULL) { |
9193 | DPFPRINTF(PF_DEBUG_URGENT, |
9194 | ("pf_test: pf_get_mtag_pbuf returned NULL\n" )); |
9195 | return (PF_DROP); |
9196 | } |
9197 | |
9198 | if (pd.pf_mtag->pftag_flags & PF_TAG_GENERATED) |
9199 | return (PF_PASS); |
9200 | |
9201 | kif = (struct pfi_kif *)ifp->if_pf_kif; |
9202 | |
9203 | if (kif == NULL) { |
9204 | DPFPRINTF(PF_DEBUG_URGENT, |
9205 | ("pf_test: kif == NULL, if_name %s\n" , ifp->if_name)); |
9206 | return (PF_DROP); |
9207 | } |
9208 | if (kif->pfik_flags & PFI_IFLAG_SKIP) |
9209 | return (PF_PASS); |
9210 | |
9211 | /* initialize enough of pd for the done label */ |
9212 | h = pbuf->pb_data; |
9213 | pd.mp = pbuf; |
9214 | pd.lmw = 0; |
9215 | pd.pf_mtag = pf_get_mtag_pbuf(pbuf); |
9216 | pd.src = (struct pf_addr *)&h->ip_src; |
9217 | pd.dst = (struct pf_addr *)&h->ip_dst; |
9218 | PF_ACPY(&pd.baddr, pd.src, AF_INET); |
9219 | PF_ACPY(&pd.bdaddr, pd.dst, AF_INET); |
9220 | pd.ip_sum = &h->ip_sum; |
9221 | pd.proto = h->ip_p; |
9222 | pd.proto_variant = 0; |
9223 | pd.af = AF_INET; |
9224 | pd.tos = h->ip_tos; |
9225 | pd.ttl = h->ip_ttl; |
9226 | pd.tot_len = ntohs(h->ip_len); |
9227 | pd.eh = eh; |
9228 | |
9229 | if (pbuf->pb_packet_len < (int)sizeof (*h)) { |
9230 | action = PF_DROP; |
9231 | REASON_SET(&reason, PFRES_SHORT); |
9232 | log = 1; |
9233 | goto done; |
9234 | } |
9235 | |
9236 | #if DUMMYNET |
9237 | if (fwa != NULL && fwa->fwa_pf_rule != NULL) |
9238 | goto nonormalize; |
9239 | #endif /* DUMMYNET */ |
9240 | |
9241 | /* We do IP header normalization and packet reassembly here */ |
9242 | action = pf_normalize_ip(pbuf, dir, kif, &reason, &pd); |
9243 | if (action != PF_PASS || pd.lmw < 0) { |
9244 | action = PF_DROP; |
9245 | goto done; |
9246 | } |
9247 | |
9248 | #if DUMMYNET |
9249 | nonormalize: |
9250 | #endif /* DUMMYNET */ |
9251 | /* pf_normalize can mess with pb_data */ |
9252 | h = pbuf->pb_data; |
9253 | |
9254 | off = h->ip_hl << 2; |
9255 | if (off < (int)sizeof (*h)) { |
9256 | action = PF_DROP; |
9257 | REASON_SET(&reason, PFRES_SHORT); |
9258 | log = 1; |
9259 | goto done; |
9260 | } |
9261 | |
9262 | pd.src = (struct pf_addr *)&h->ip_src; |
9263 | pd.dst = (struct pf_addr *)&h->ip_dst; |
9264 | PF_ACPY(&pd.baddr, pd.src, AF_INET); |
9265 | PF_ACPY(&pd.bdaddr, pd.dst, AF_INET); |
9266 | pd.ip_sum = &h->ip_sum; |
9267 | pd.proto = h->ip_p; |
9268 | pd.proto_variant = 0; |
9269 | pd.mp = pbuf; |
9270 | pd.lmw = 0; |
9271 | pd.pf_mtag = pf_get_mtag_pbuf(pbuf); |
9272 | pd.af = AF_INET; |
9273 | pd.tos = h->ip_tos; |
9274 | pd.ttl = h->ip_ttl; |
9275 | pd.sc = MBUF_SCIDX(pbuf_get_service_class(pbuf)); |
9276 | pd.tot_len = ntohs(h->ip_len); |
9277 | pd.eh = eh; |
9278 | |
9279 | if (*pbuf->pb_flags & PKTF_FLOW_ID) { |
9280 | pd.flowsrc = *pbuf->pb_flowsrc; |
9281 | pd.flowhash = *pbuf->pb_flowid; |
9282 | pd.pktflags = *pbuf->pb_flags & PKTF_FLOW_MASK; |
9283 | } |
9284 | |
9285 | /* handle fragments that didn't get reassembled by normalization */ |
9286 | if (h->ip_off & htons(IP_MF | IP_OFFMASK)) { |
9287 | pd.flags |= PFDESC_IP_FRAG; |
9288 | #if DUMMYNET |
9289 | /* Traffic goes through dummynet first */ |
9290 | action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa); |
9291 | if (action == PF_DROP || pbuf == NULL) { |
9292 | *pbufp = NULL; |
9293 | return (action); |
9294 | } |
9295 | #endif /* DUMMYNET */ |
9296 | action = pf_test_fragment(&r, dir, kif, pbuf, h, |
9297 | &pd, &a, &ruleset); |
9298 | goto done; |
9299 | } |
9300 | |
9301 | switch (h->ip_p) { |
9302 | |
9303 | case IPPROTO_TCP: { |
9304 | struct tcphdr th; |
9305 | pd.hdr.tcp = &th; |
9306 | if (!pf_pull_hdr(pbuf, off, &th, sizeof (th), |
9307 | &action, &reason, AF_INET)) { |
9308 | log = action != PF_PASS; |
9309 | goto done; |
9310 | } |
9311 | pd.p_len = pd.tot_len - off - (th.th_off << 2); |
9312 | if ((th.th_flags & TH_ACK) && pd.p_len == 0) |
9313 | pqid = 1; |
9314 | #if DUMMYNET |
9315 | /* Traffic goes through dummynet first */ |
9316 | action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa); |
9317 | if (action == PF_DROP || pbuf == NULL) { |
9318 | *pbufp = NULL; |
9319 | return (action); |
9320 | } |
9321 | #endif /* DUMMYNET */ |
9322 | action = pf_normalize_tcp(dir, kif, pbuf, 0, off, h, &pd); |
9323 | if (pd.lmw < 0) |
9324 | goto done; |
9325 | PF_APPLE_UPDATE_PDESC_IPv4(); |
9326 | if (action == PF_DROP) |
9327 | goto done; |
9328 | action = pf_test_state_tcp(&s, dir, kif, pbuf, off, h, &pd, |
9329 | &reason); |
9330 | if (action == PF_NAT64) |
9331 | goto done; |
9332 | if (pd.lmw < 0) |
9333 | goto done; |
9334 | PF_APPLE_UPDATE_PDESC_IPv4(); |
9335 | if (action == PF_PASS) { |
9336 | #if NPFSYNC |
9337 | pfsync_update_state(s); |
9338 | #endif /* NPFSYNC */ |
9339 | r = s->rule.ptr; |
9340 | a = s->anchor.ptr; |
9341 | log = s->log; |
9342 | } else if (s == NULL) |
9343 | action = pf_test_rule(&r, &s, dir, kif, |
9344 | pbuf, off, h, &pd, &a, &ruleset, NULL); |
9345 | break; |
9346 | } |
9347 | |
9348 | case IPPROTO_UDP: { |
9349 | struct udphdr uh; |
9350 | |
9351 | pd.hdr.udp = &uh; |
9352 | if (!pf_pull_hdr(pbuf, off, &uh, sizeof (uh), |
9353 | &action, &reason, AF_INET)) { |
9354 | log = action != PF_PASS; |
9355 | goto done; |
9356 | } |
9357 | if (uh.uh_dport == 0 || |
9358 | ntohs(uh.uh_ulen) > pbuf->pb_packet_len - off || |
9359 | ntohs(uh.uh_ulen) < sizeof (struct udphdr)) { |
9360 | action = PF_DROP; |
9361 | REASON_SET(&reason, PFRES_SHORT); |
9362 | goto done; |
9363 | } |
9364 | #if DUMMYNET |
9365 | /* Traffic goes through dummynet first */ |
9366 | action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa); |
9367 | if (action == PF_DROP || pbuf == NULL) { |
9368 | *pbufp = NULL; |
9369 | return (action); |
9370 | } |
9371 | #endif /* DUMMYNET */ |
9372 | action = pf_test_state_udp(&s, dir, kif, pbuf, off, h, &pd, |
9373 | &reason); |
9374 | if (action == PF_NAT64) |
9375 | goto done; |
9376 | if (pd.lmw < 0) |
9377 | goto done; |
9378 | PF_APPLE_UPDATE_PDESC_IPv4(); |
9379 | if (action == PF_PASS) { |
9380 | #if NPFSYNC |
9381 | pfsync_update_state(s); |
9382 | #endif /* NPFSYNC */ |
9383 | r = s->rule.ptr; |
9384 | a = s->anchor.ptr; |
9385 | log = s->log; |
9386 | } else if (s == NULL) |
9387 | action = pf_test_rule(&r, &s, dir, kif, |
9388 | pbuf, off, h, &pd, &a, &ruleset, NULL); |
9389 | break; |
9390 | } |
9391 | |
9392 | case IPPROTO_ICMP: { |
9393 | struct icmp ih; |
9394 | |
9395 | pd.hdr.icmp = &ih; |
9396 | if (!pf_pull_hdr(pbuf, off, &ih, ICMP_MINLEN, |
9397 | &action, &reason, AF_INET)) { |
9398 | log = action != PF_PASS; |
9399 | goto done; |
9400 | } |
9401 | #if DUMMYNET |
9402 | /* Traffic goes through dummynet first */ |
9403 | action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa); |
9404 | if (action == PF_DROP || pbuf == NULL) { |
9405 | *pbufp = NULL; |
9406 | return (action); |
9407 | } |
9408 | #endif /* DUMMYNET */ |
9409 | action = pf_test_state_icmp(&s, dir, kif, pbuf, off, h, &pd, |
9410 | &reason); |
9411 | if (action == PF_NAT64) |
9412 | goto done; |
9413 | if (pd.lmw < 0) |
9414 | goto done; |
9415 | PF_APPLE_UPDATE_PDESC_IPv4(); |
9416 | if (action == PF_PASS) { |
9417 | #if NPFSYNC |
9418 | pfsync_update_state(s); |
9419 | #endif /* NPFSYNC */ |
9420 | r = s->rule.ptr; |
9421 | a = s->anchor.ptr; |
9422 | log = s->log; |
9423 | } else if (s == NULL) |
9424 | action = pf_test_rule(&r, &s, dir, kif, |
9425 | pbuf, off, h, &pd, &a, &ruleset, NULL); |
9426 | break; |
9427 | } |
9428 | |
9429 | case IPPROTO_ESP: { |
9430 | struct pf_esp_hdr esp; |
9431 | |
9432 | pd.hdr.esp = &esp; |
9433 | if (!pf_pull_hdr(pbuf, off, &esp, sizeof (esp), &action, &reason, |
9434 | AF_INET)) { |
9435 | log = action != PF_PASS; |
9436 | goto done; |
9437 | } |
9438 | #if DUMMYNET |
9439 | /* Traffic goes through dummynet first */ |
9440 | action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa); |
9441 | if (action == PF_DROP || pbuf == NULL) { |
9442 | *pbufp = NULL; |
9443 | return (action); |
9444 | } |
9445 | #endif /* DUMMYNET */ |
9446 | action = pf_test_state_esp(&s, dir, kif, off, &pd); |
9447 | if (pd.lmw < 0) |
9448 | goto done; |
9449 | PF_APPLE_UPDATE_PDESC_IPv4(); |
9450 | if (action == PF_PASS) { |
9451 | #if NPFSYNC |
9452 | pfsync_update_state(s); |
9453 | #endif /* NPFSYNC */ |
9454 | r = s->rule.ptr; |
9455 | a = s->anchor.ptr; |
9456 | log = s->log; |
9457 | } else if (s == NULL) |
9458 | action = pf_test_rule(&r, &s, dir, kif, |
9459 | pbuf, off, h, &pd, &a, &ruleset, NULL); |
9460 | break; |
9461 | } |
9462 | |
9463 | case IPPROTO_GRE: { |
9464 | struct pf_grev1_hdr grev1; |
9465 | pd.hdr.grev1 = &grev1; |
9466 | if (!pf_pull_hdr(pbuf, off, &grev1, sizeof (grev1), &action, |
9467 | &reason, AF_INET)) { |
9468 | log = (action != PF_PASS); |
9469 | goto done; |
9470 | } |
9471 | #if DUMMYNET |
9472 | /* Traffic goes through dummynet first */ |
9473 | action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa); |
9474 | if (action == PF_DROP || pbuf == NULL) { |
9475 | *pbufp = NULL; |
9476 | return (action); |
9477 | } |
9478 | #endif /* DUMMYNET */ |
9479 | if ((ntohs(grev1.flags) & PF_GRE_FLAG_VERSION_MASK) == 1 && |
9480 | ntohs(grev1.protocol_type) == PF_GRE_PPP_ETHERTYPE) { |
9481 | if (ntohs(grev1.payload_length) > |
9482 | pbuf->pb_packet_len - off) { |
9483 | action = PF_DROP; |
9484 | REASON_SET(&reason, PFRES_SHORT); |
9485 | goto done; |
9486 | } |
9487 | pd.proto_variant = PF_GRE_PPTP_VARIANT; |
9488 | action = pf_test_state_grev1(&s, dir, kif, off, &pd); |
9489 | if (pd.lmw < 0) goto done; |
9490 | PF_APPLE_UPDATE_PDESC_IPv4(); |
9491 | if (action == PF_PASS) { |
9492 | #if NPFSYNC |
9493 | pfsync_update_state(s); |
9494 | #endif /* NPFSYNC */ |
9495 | r = s->rule.ptr; |
9496 | a = s->anchor.ptr; |
9497 | log = s->log; |
9498 | break; |
9499 | } else if (s == NULL) { |
9500 | action = pf_test_rule(&r, &s, dir, kif, pbuf, |
9501 | off, h, &pd, &a, &ruleset, NULL); |
9502 | if (action == PF_PASS) |
9503 | break; |
9504 | } |
9505 | } |
9506 | |
9507 | /* not GREv1/PPTP, so treat as ordinary GRE... */ |
9508 | } |
9509 | |
9510 | default: |
9511 | #if DUMMYNET |
9512 | /* Traffic goes through dummynet first */ |
9513 | action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa); |
9514 | if (action == PF_DROP || pbuf == NULL) { |
9515 | *pbufp = NULL; |
9516 | return (action); |
9517 | } |
9518 | #endif /* DUMMYNET */ |
9519 | action = pf_test_state_other(&s, dir, kif, &pd); |
9520 | if (pd.lmw < 0) |
9521 | goto done; |
9522 | PF_APPLE_UPDATE_PDESC_IPv4(); |
9523 | if (action == PF_PASS) { |
9524 | #if NPFSYNC |
9525 | pfsync_update_state(s); |
9526 | #endif /* NPFSYNC */ |
9527 | r = s->rule.ptr; |
9528 | a = s->anchor.ptr; |
9529 | log = s->log; |
9530 | } else if (s == NULL) |
9531 | action = pf_test_rule(&r, &s, dir, kif, pbuf, off, h, |
9532 | &pd, &a, &ruleset, NULL); |
9533 | break; |
9534 | } |
9535 | |
9536 | done: |
9537 | if (action == PF_NAT64) { |
9538 | *pbufp = NULL; |
9539 | return (action); |
9540 | } |
9541 | |
9542 | *pbufp = pd.mp; |
9543 | PF_APPLE_UPDATE_PDESC_IPv4(); |
9544 | |
9545 | if (action != PF_DROP) { |
9546 | if (action == PF_PASS && h->ip_hl > 5 && |
9547 | !((s && s->allow_opts) || r->allow_opts)) { |
9548 | action = PF_DROP; |
9549 | REASON_SET(&reason, PFRES_IPOPTIONS); |
9550 | log = 1; |
9551 | DPFPRINTF(PF_DEBUG_MISC, |
9552 | ("pf: dropping packet with ip options [hlen=%u]\n" , |
9553 | (unsigned int) h->ip_hl)); |
9554 | } |
9555 | |
9556 | if ((s && s->tag) || PF_RTABLEID_IS_VALID(r->rtableid) || |
9557 | (pd.pktflags & PKTF_FLOW_ID)) |
9558 | (void) pf_tag_packet(pbuf, pd.pf_mtag, s ? s->tag : 0, |
9559 | r->rtableid, &pd); |
9560 | |
9561 | if (action == PF_PASS) { |
9562 | #if PF_ECN |
9563 | /* add hints for ecn */ |
9564 | pd.pf_mtag->pftag_hdr = h; |
9565 | /* record address family */ |
9566 | pd.pf_mtag->pftag_flags &= ~PF_TAG_HDR_INET6; |
9567 | pd.pf_mtag->pftag_flags |= PF_TAG_HDR_INET; |
9568 | #endif /* PF_ECN */ |
9569 | /* record protocol */ |
9570 | *pbuf->pb_proto = pd.proto; |
9571 | |
9572 | /* |
9573 | * connections redirected to loopback should not match sockets |
9574 | * bound specifically to loopback due to security implications, |
9575 | * see tcp_input() and in_pcblookup_listen(). |
9576 | */ |
9577 | if (dir == PF_IN && (pd.proto == IPPROTO_TCP || |
9578 | pd.proto == IPPROTO_UDP) && s != NULL && |
9579 | s->nat_rule.ptr != NULL && |
9580 | (s->nat_rule.ptr->action == PF_RDR || |
9581 | s->nat_rule.ptr->action == PF_BINAT) && |
9582 | (ntohl(pd.dst->v4addr.s_addr) >> IN_CLASSA_NSHIFT) |
9583 | == IN_LOOPBACKNET) |
9584 | pd.pf_mtag->pftag_flags |= PF_TAG_TRANSLATE_LOCALHOST; |
9585 | } |
9586 | } |
9587 | |
9588 | if (log) { |
9589 | struct pf_rule *lr; |
9590 | |
9591 | if (s != NULL && s->nat_rule.ptr != NULL && |
9592 | s->nat_rule.ptr->log & PF_LOG_ALL) |
9593 | lr = s->nat_rule.ptr; |
9594 | else |
9595 | lr = r; |
9596 | PFLOG_PACKET(kif, h, pbuf, AF_INET, dir, reason, lr, a, ruleset, |
9597 | &pd); |
9598 | } |
9599 | |
9600 | kif->pfik_bytes[0][dir == PF_OUT][action != PF_PASS] += pd.tot_len; |
9601 | kif->pfik_packets[0][dir == PF_OUT][action != PF_PASS]++; |
9602 | |
9603 | if (action == PF_PASS || r->action == PF_DROP) { |
9604 | dirndx = (dir == PF_OUT); |
9605 | r->packets[dirndx]++; |
9606 | r->bytes[dirndx] += pd.tot_len; |
9607 | if (a != NULL) { |
9608 | a->packets[dirndx]++; |
9609 | a->bytes[dirndx] += pd.tot_len; |
9610 | } |
9611 | if (s != NULL) { |
9612 | sk = s->state_key; |
9613 | if (s->nat_rule.ptr != NULL) { |
9614 | s->nat_rule.ptr->packets[dirndx]++; |
9615 | s->nat_rule.ptr->bytes[dirndx] += pd.tot_len; |
9616 | } |
9617 | if (s->src_node != NULL) { |
9618 | s->src_node->packets[dirndx]++; |
9619 | s->src_node->bytes[dirndx] += pd.tot_len; |
9620 | } |
9621 | if (s->nat_src_node != NULL) { |
9622 | s->nat_src_node->packets[dirndx]++; |
9623 | s->nat_src_node->bytes[dirndx] += pd.tot_len; |
9624 | } |
9625 | dirndx = (dir == sk->direction) ? 0 : 1; |
9626 | s->packets[dirndx]++; |
9627 | s->bytes[dirndx] += pd.tot_len; |
9628 | } |
9629 | tr = r; |
9630 | nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule; |
9631 | if (nr != NULL) { |
9632 | struct pf_addr *x; |
9633 | /* |
9634 | * XXX: we need to make sure that the addresses |
9635 | * passed to pfr_update_stats() are the same than |
9636 | * the addresses used during matching (pfr_match) |
9637 | */ |
9638 | if (r == &pf_default_rule) { |
9639 | tr = nr; |
9640 | x = (sk == NULL || sk->direction == dir) ? |
9641 | &pd.baddr : &pd.naddr; |
9642 | } else |
9643 | x = (sk == NULL || sk->direction == dir) ? |
9644 | &pd.naddr : &pd.baddr; |
9645 | if (x == &pd.baddr || s == NULL) { |
9646 | /* we need to change the address */ |
9647 | if (dir == PF_OUT) |
9648 | pd.src = x; |
9649 | else |
9650 | pd.dst = x; |
9651 | } |
9652 | } |
9653 | if (tr->src.addr.type == PF_ADDR_TABLE) |
9654 | pfr_update_stats(tr->src.addr.p.tbl, (sk == NULL || |
9655 | sk->direction == dir) ? |
9656 | pd.src : pd.dst, pd.af, |
9657 | pd.tot_len, dir == PF_OUT, r->action == PF_PASS, |
9658 | tr->src.neg); |
9659 | if (tr->dst.addr.type == PF_ADDR_TABLE) |
9660 | pfr_update_stats(tr->dst.addr.p.tbl, (sk == NULL || |
9661 | sk->direction == dir) ? pd.dst : pd.src, pd.af, |
9662 | pd.tot_len, dir == PF_OUT, r->action == PF_PASS, |
9663 | tr->dst.neg); |
9664 | } |
9665 | |
9666 | VERIFY(pbuf == NULL || pd.mp == NULL || pd.mp == pbuf); |
9667 | |
9668 | if (*pbufp) { |
9669 | if (pd.lmw < 0) { |
9670 | REASON_SET(&reason, PFRES_MEMORY); |
9671 | action = PF_DROP; |
9672 | } |
9673 | |
9674 | if (action == PF_DROP) { |
9675 | pbuf_destroy(*pbufp); |
9676 | *pbufp = NULL; |
9677 | return (PF_DROP); |
9678 | } |
9679 | |
9680 | *pbufp = pbuf; |
9681 | } |
9682 | |
9683 | if (action == PF_SYNPROXY_DROP) { |
9684 | pbuf_destroy(*pbufp); |
9685 | *pbufp = NULL; |
9686 | action = PF_PASS; |
9687 | } else if (r->rt) |
9688 | /* pf_route can free the pbuf causing *pbufp to become NULL */ |
9689 | pf_route(pbufp, r, dir, kif->pfik_ifp, s, &pd); |
9690 | |
9691 | return (action); |
9692 | } |
9693 | #endif /* INET */ |
9694 | |
9695 | #if INET6 |
9696 | #define PF_APPLE_UPDATE_PDESC_IPv6() \ |
9697 | do { \ |
9698 | if (pbuf && pd.mp && pbuf != pd.mp) { \ |
9699 | pbuf = pd.mp; \ |
9700 | } \ |
9701 | h = pbuf->pb_data; \ |
9702 | } while (0) |
9703 | |
9704 | int |
9705 | pf_test6_mbuf(int dir, struct ifnet *ifp, struct mbuf **m0, |
9706 | struct ether_header *eh, struct ip_fw_args *fwa) |
9707 | { |
9708 | pbuf_t pbuf_store, *pbuf; |
9709 | int rv; |
9710 | |
9711 | pbuf_init_mbuf(&pbuf_store, *m0, (*m0)->m_pkthdr.rcvif); |
9712 | pbuf = &pbuf_store; |
9713 | |
9714 | rv = pf_test6(dir, ifp, &pbuf, eh, fwa); |
9715 | |
9716 | if (pbuf_is_valid(pbuf)) { |
9717 | *m0 = pbuf->pb_mbuf; |
9718 | pbuf->pb_mbuf = NULL; |
9719 | pbuf_destroy(pbuf); |
9720 | } else |
9721 | *m0 = NULL; |
9722 | |
9723 | return (rv); |
9724 | } |
9725 | |
9726 | int |
9727 | pf_test6(int dir, struct ifnet *ifp, pbuf_t **pbufp, |
9728 | struct ether_header *eh, struct ip_fw_args *fwa) |
9729 | { |
9730 | #if !DUMMYNET |
9731 | #pragma unused(fwa) |
9732 | #endif |
9733 | struct pfi_kif *kif; |
9734 | u_short action = PF_PASS, reason = 0, log = 0; |
9735 | pbuf_t *pbuf = *pbufp; |
9736 | struct ip6_hdr *h; |
9737 | struct pf_rule *a = NULL, *r = &pf_default_rule, *tr, *nr; |
9738 | struct pf_state *s = NULL; |
9739 | struct pf_state_key *sk = NULL; |
9740 | struct pf_ruleset *ruleset = NULL; |
9741 | struct pf_pdesc pd; |
9742 | int off, terminal = 0, dirndx, rh_cnt = 0; |
9743 | u_int8_t nxt; |
9744 | |
9745 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
9746 | |
9747 | if (!pf_status.running) |
9748 | return (PF_PASS); |
9749 | |
9750 | memset(&pd, 0, sizeof (pd)); |
9751 | |
9752 | if ((pd.pf_mtag = pf_get_mtag_pbuf(pbuf)) == NULL) { |
9753 | DPFPRINTF(PF_DEBUG_URGENT, |
9754 | ("pf_test6: pf_get_mtag_pbuf returned NULL\n" )); |
9755 | return (PF_DROP); |
9756 | } |
9757 | |
9758 | if (pd.pf_mtag->pftag_flags & PF_TAG_GENERATED) |
9759 | return (PF_PASS); |
9760 | |
9761 | kif = (struct pfi_kif *)ifp->if_pf_kif; |
9762 | |
9763 | if (kif == NULL) { |
9764 | DPFPRINTF(PF_DEBUG_URGENT, |
9765 | ("pf_test6: kif == NULL, if_name %s\n" , ifp->if_name)); |
9766 | return (PF_DROP); |
9767 | } |
9768 | if (kif->pfik_flags & PFI_IFLAG_SKIP) |
9769 | return (PF_PASS); |
9770 | |
9771 | h = pbuf->pb_data; |
9772 | |
9773 | nxt = h->ip6_nxt; |
9774 | off = ((caddr_t)h - (caddr_t)pbuf->pb_data) + sizeof(struct ip6_hdr); |
9775 | pd.mp = pbuf; |
9776 | pd.lmw = 0; |
9777 | pd.pf_mtag = pf_get_mtag_pbuf(pbuf); |
9778 | pd.src = (struct pf_addr *)(uintptr_t)&h->ip6_src; |
9779 | pd.dst = (struct pf_addr *)(uintptr_t)&h->ip6_dst; |
9780 | PF_ACPY(&pd.baddr, pd.src, AF_INET6); |
9781 | PF_ACPY(&pd.bdaddr, pd.dst, AF_INET6); |
9782 | pd.ip_sum = NULL; |
9783 | pd.af = AF_INET6; |
9784 | pd.proto = nxt; |
9785 | pd.proto_variant = 0; |
9786 | pd.tos = 0; |
9787 | pd.ttl = h->ip6_hlim; |
9788 | pd.sc = MBUF_SCIDX(pbuf_get_service_class(pbuf)); |
9789 | pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr); |
9790 | pd.eh = eh; |
9791 | |
9792 | if (*pbuf->pb_flags & PKTF_FLOW_ID) { |
9793 | pd.flowsrc = *pbuf->pb_flowsrc; |
9794 | pd.flowhash = *pbuf->pb_flowid; |
9795 | pd.pktflags = (*pbuf->pb_flags & PKTF_FLOW_MASK); |
9796 | } |
9797 | |
9798 | if (pbuf->pb_packet_len < (int)sizeof (*h)) { |
9799 | action = PF_DROP; |
9800 | REASON_SET(&reason, PFRES_SHORT); |
9801 | log = 1; |
9802 | goto done; |
9803 | } |
9804 | |
9805 | #if DUMMYNET |
9806 | if (fwa != NULL && fwa->fwa_pf_rule != NULL) |
9807 | goto nonormalize; |
9808 | #endif /* DUMMYNET */ |
9809 | |
9810 | /* We do IP header normalization and packet reassembly here */ |
9811 | action = pf_normalize_ip6(pbuf, dir, kif, &reason, &pd); |
9812 | if (action != PF_PASS || pd.lmw < 0) { |
9813 | action = PF_DROP; |
9814 | goto done; |
9815 | } |
9816 | |
9817 | #if DUMMYNET |
9818 | nonormalize: |
9819 | #endif /* DUMMYNET */ |
9820 | h = pbuf->pb_data; |
9821 | |
9822 | #if 1 |
9823 | /* |
9824 | * we do not support jumbogram yet. if we keep going, zero ip6_plen |
9825 | * will do something bad, so drop the packet for now. |
9826 | */ |
9827 | if (htons(h->ip6_plen) == 0) { |
9828 | action = PF_DROP; |
9829 | REASON_SET(&reason, PFRES_NORM); /*XXX*/ |
9830 | goto done; |
9831 | } |
9832 | #endif |
9833 | |
9834 | pd.src = (struct pf_addr *)(uintptr_t)&h->ip6_src; |
9835 | pd.dst = (struct pf_addr *)(uintptr_t)&h->ip6_dst; |
9836 | PF_ACPY(&pd.baddr, pd.src, AF_INET6); |
9837 | PF_ACPY(&pd.bdaddr, pd.dst, AF_INET6); |
9838 | pd.ip_sum = NULL; |
9839 | pd.af = AF_INET6; |
9840 | pd.tos = 0; |
9841 | pd.ttl = h->ip6_hlim; |
9842 | pd.tot_len = ntohs(h->ip6_plen) + sizeof (struct ip6_hdr); |
9843 | pd.eh = eh; |
9844 | |
9845 | off = ((caddr_t)h - (caddr_t)pbuf->pb_data) + sizeof (struct ip6_hdr); |
9846 | pd.proto = h->ip6_nxt; |
9847 | pd.proto_variant = 0; |
9848 | pd.mp = pbuf; |
9849 | pd.lmw = 0; |
9850 | pd.pf_mtag = pf_get_mtag_pbuf(pbuf); |
9851 | |
9852 | do { |
9853 | switch (nxt) { |
9854 | case IPPROTO_FRAGMENT: { |
9855 | struct ip6_frag ip6f; |
9856 | |
9857 | pd.flags |= PFDESC_IP_FRAG; |
9858 | if (!pf_pull_hdr(pbuf, off, &ip6f, sizeof ip6f, NULL, |
9859 | &reason, pd.af)) { |
9860 | DPFPRINTF(PF_DEBUG_MISC, |
9861 | ("pf: IPv6 short fragment header\n" )); |
9862 | action = PF_DROP; |
9863 | REASON_SET(&reason, PFRES_SHORT); |
9864 | log = 1; |
9865 | goto done; |
9866 | } |
9867 | pd.proto = nxt = ip6f.ip6f_nxt; |
9868 | #if DUMMYNET |
9869 | /* Traffic goes through dummynet first */ |
9870 | action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, |
9871 | fwa); |
9872 | if (action == PF_DROP || pbuf == NULL) { |
9873 | *pbufp = NULL; |
9874 | return (action); |
9875 | } |
9876 | #endif /* DUMMYNET */ |
9877 | action = pf_test_fragment(&r, dir, kif, pbuf, h, &pd, |
9878 | &a, &ruleset); |
9879 | if (action == PF_DROP) { |
9880 | REASON_SET(&reason, PFRES_FRAG); |
9881 | log = 1; |
9882 | } |
9883 | goto done; |
9884 | } |
9885 | case IPPROTO_ROUTING: |
9886 | ++rh_cnt; |
9887 | /* FALL THROUGH */ |
9888 | |
9889 | case IPPROTO_AH: |
9890 | case IPPROTO_HOPOPTS: |
9891 | case IPPROTO_DSTOPTS: { |
9892 | /* get next header and header length */ |
9893 | struct ip6_ext opt6; |
9894 | |
9895 | if (!pf_pull_hdr(pbuf, off, &opt6, sizeof(opt6), |
9896 | NULL, &reason, pd.af)) { |
9897 | DPFPRINTF(PF_DEBUG_MISC, |
9898 | ("pf: IPv6 short opt\n" )); |
9899 | action = PF_DROP; |
9900 | log = 1; |
9901 | goto done; |
9902 | } |
9903 | if (pd.proto == IPPROTO_AH) |
9904 | off += (opt6.ip6e_len + 2) * 4; |
9905 | else |
9906 | off += (opt6.ip6e_len + 1) * 8; |
9907 | nxt = opt6.ip6e_nxt; |
9908 | /* goto the next header */ |
9909 | break; |
9910 | } |
9911 | default: |
9912 | terminal++; |
9913 | break; |
9914 | } |
9915 | } while (!terminal); |
9916 | |
9917 | |
9918 | switch (pd.proto) { |
9919 | |
9920 | case IPPROTO_TCP: { |
9921 | struct tcphdr th; |
9922 | |
9923 | pd.hdr.tcp = &th; |
9924 | if (!pf_pull_hdr(pbuf, off, &th, sizeof (th), |
9925 | &action, &reason, AF_INET6)) { |
9926 | log = action != PF_PASS; |
9927 | goto done; |
9928 | } |
9929 | pd.p_len = pd.tot_len - off - (th.th_off << 2); |
9930 | #if DUMMYNET |
9931 | /* Traffic goes through dummynet first */ |
9932 | action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa); |
9933 | if (action == PF_DROP || pbuf == NULL) { |
9934 | *pbufp = NULL; |
9935 | return (action); |
9936 | } |
9937 | #endif /* DUMMYNET */ |
9938 | action = pf_normalize_tcp(dir, kif, pbuf, 0, off, h, &pd); |
9939 | if (pd.lmw < 0) |
9940 | goto done; |
9941 | PF_APPLE_UPDATE_PDESC_IPv6(); |
9942 | if (action == PF_DROP) |
9943 | goto done; |
9944 | action = pf_test_state_tcp(&s, dir, kif, pbuf, off, h, &pd, |
9945 | &reason); |
9946 | if (action == PF_NAT64) |
9947 | goto done; |
9948 | if (pd.lmw < 0) |
9949 | goto done; |
9950 | PF_APPLE_UPDATE_PDESC_IPv6(); |
9951 | if (action == PF_PASS) { |
9952 | #if NPFSYNC |
9953 | pfsync_update_state(s); |
9954 | #endif /* NPFSYNC */ |
9955 | r = s->rule.ptr; |
9956 | a = s->anchor.ptr; |
9957 | log = s->log; |
9958 | } else if (s == NULL) |
9959 | action = pf_test_rule(&r, &s, dir, kif, |
9960 | pbuf, off, h, &pd, &a, &ruleset, NULL); |
9961 | break; |
9962 | } |
9963 | |
9964 | case IPPROTO_UDP: { |
9965 | struct udphdr uh; |
9966 | |
9967 | pd.hdr.udp = &uh; |
9968 | if (!pf_pull_hdr(pbuf, off, &uh, sizeof (uh), |
9969 | &action, &reason, AF_INET6)) { |
9970 | log = action != PF_PASS; |
9971 | goto done; |
9972 | } |
9973 | if (uh.uh_dport == 0 || |
9974 | ntohs(uh.uh_ulen) > pbuf->pb_packet_len - off || |
9975 | ntohs(uh.uh_ulen) < sizeof (struct udphdr)) { |
9976 | action = PF_DROP; |
9977 | REASON_SET(&reason, PFRES_SHORT); |
9978 | goto done; |
9979 | } |
9980 | #if DUMMYNET |
9981 | /* Traffic goes through dummynet first */ |
9982 | action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa); |
9983 | if (action == PF_DROP || pbuf == NULL) { |
9984 | *pbufp = NULL; |
9985 | return (action); |
9986 | } |
9987 | #endif /* DUMMYNET */ |
9988 | action = pf_test_state_udp(&s, dir, kif, pbuf, off, h, &pd, |
9989 | &reason); |
9990 | if (action == PF_NAT64) |
9991 | goto done; |
9992 | if (pd.lmw < 0) |
9993 | goto done; |
9994 | PF_APPLE_UPDATE_PDESC_IPv6(); |
9995 | if (action == PF_PASS) { |
9996 | #if NPFSYNC |
9997 | pfsync_update_state(s); |
9998 | #endif /* NPFSYNC */ |
9999 | r = s->rule.ptr; |
10000 | a = s->anchor.ptr; |
10001 | log = s->log; |
10002 | } else if (s == NULL) |
10003 | action = pf_test_rule(&r, &s, dir, kif, |
10004 | pbuf, off, h, &pd, &a, &ruleset, NULL); |
10005 | break; |
10006 | } |
10007 | |
10008 | case IPPROTO_ICMPV6: { |
10009 | struct icmp6_hdr ih; |
10010 | |
10011 | pd.hdr.icmp6 = &ih; |
10012 | if (!pf_pull_hdr(pbuf, off, &ih, sizeof (ih), |
10013 | &action, &reason, AF_INET6)) { |
10014 | log = action != PF_PASS; |
10015 | goto done; |
10016 | } |
10017 | #if DUMMYNET |
10018 | /* Traffic goes through dummynet first */ |
10019 | action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa); |
10020 | if (action == PF_DROP || pbuf == NULL) { |
10021 | *pbufp = NULL; |
10022 | return (action); |
10023 | } |
10024 | #endif /* DUMMYNET */ |
10025 | action = pf_test_state_icmp(&s, dir, kif, |
10026 | pbuf, off, h, &pd, &reason); |
10027 | if (action == PF_NAT64) |
10028 | goto done; |
10029 | if (pd.lmw < 0) |
10030 | goto done; |
10031 | PF_APPLE_UPDATE_PDESC_IPv6(); |
10032 | if (action == PF_PASS) { |
10033 | #if NPFSYNC |
10034 | pfsync_update_state(s); |
10035 | #endif /* NPFSYNC */ |
10036 | r = s->rule.ptr; |
10037 | a = s->anchor.ptr; |
10038 | log = s->log; |
10039 | } else if (s == NULL) |
10040 | action = pf_test_rule(&r, &s, dir, kif, |
10041 | pbuf, off, h, &pd, &a, &ruleset, NULL); |
10042 | break; |
10043 | } |
10044 | |
10045 | case IPPROTO_ESP: { |
10046 | struct pf_esp_hdr esp; |
10047 | |
10048 | pd.hdr.esp = &esp; |
10049 | if (!pf_pull_hdr(pbuf, off, &esp, sizeof (esp), &action, |
10050 | &reason, AF_INET6)) { |
10051 | log = action != PF_PASS; |
10052 | goto done; |
10053 | } |
10054 | #if DUMMYNET |
10055 | /* Traffic goes through dummynet first */ |
10056 | action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa); |
10057 | if (action == PF_DROP || pbuf == NULL) { |
10058 | *pbufp = NULL; |
10059 | return (action); |
10060 | } |
10061 | #endif /* DUMMYNET */ |
10062 | action = pf_test_state_esp(&s, dir, kif, off, &pd); |
10063 | if (pd.lmw < 0) |
10064 | goto done; |
10065 | PF_APPLE_UPDATE_PDESC_IPv6(); |
10066 | if (action == PF_PASS) { |
10067 | #if NPFSYNC |
10068 | pfsync_update_state(s); |
10069 | #endif /* NPFSYNC */ |
10070 | r = s->rule.ptr; |
10071 | a = s->anchor.ptr; |
10072 | log = s->log; |
10073 | } else if (s == NULL) |
10074 | action = pf_test_rule(&r, &s, dir, kif, |
10075 | pbuf, off, h, &pd, &a, &ruleset, NULL); |
10076 | break; |
10077 | } |
10078 | |
10079 | case IPPROTO_GRE: { |
10080 | struct pf_grev1_hdr grev1; |
10081 | |
10082 | pd.hdr.grev1 = &grev1; |
10083 | if (!pf_pull_hdr(pbuf, off, &grev1, sizeof (grev1), &action, |
10084 | &reason, AF_INET6)) { |
10085 | log = (action != PF_PASS); |
10086 | goto done; |
10087 | } |
10088 | #if DUMMYNET |
10089 | /* Traffic goes through dummynet first */ |
10090 | action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa); |
10091 | if (action == PF_DROP || pbuf == NULL) { |
10092 | *pbufp = NULL; |
10093 | return (action); |
10094 | } |
10095 | #endif /* DUMMYNET */ |
10096 | if ((ntohs(grev1.flags) & PF_GRE_FLAG_VERSION_MASK) == 1 && |
10097 | ntohs(grev1.protocol_type) == PF_GRE_PPP_ETHERTYPE) { |
10098 | if (ntohs(grev1.payload_length) > |
10099 | pbuf->pb_packet_len - off) { |
10100 | action = PF_DROP; |
10101 | REASON_SET(&reason, PFRES_SHORT); |
10102 | goto done; |
10103 | } |
10104 | action = pf_test_state_grev1(&s, dir, kif, off, &pd); |
10105 | if (pd.lmw < 0) |
10106 | goto done; |
10107 | PF_APPLE_UPDATE_PDESC_IPv6(); |
10108 | if (action == PF_PASS) { |
10109 | #if NPFSYNC |
10110 | pfsync_update_state(s); |
10111 | #endif /* NPFSYNC */ |
10112 | r = s->rule.ptr; |
10113 | a = s->anchor.ptr; |
10114 | log = s->log; |
10115 | break; |
10116 | } else if (s == NULL) { |
10117 | action = pf_test_rule(&r, &s, dir, kif, pbuf, |
10118 | off, h, &pd, &a, &ruleset, NULL); |
10119 | if (action == PF_PASS) |
10120 | break; |
10121 | } |
10122 | } |
10123 | |
10124 | /* not GREv1/PPTP, so treat as ordinary GRE... */ |
10125 | } |
10126 | |
10127 | default: |
10128 | #if DUMMYNET |
10129 | /* Traffic goes through dummynet first */ |
10130 | action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa); |
10131 | if (action == PF_DROP || pbuf == NULL) { |
10132 | *pbufp = NULL; |
10133 | return (action); |
10134 | } |
10135 | #endif /* DUMMYNET */ |
10136 | action = pf_test_state_other(&s, dir, kif, &pd); |
10137 | if (pd.lmw < 0) |
10138 | goto done; |
10139 | PF_APPLE_UPDATE_PDESC_IPv6(); |
10140 | if (action == PF_PASS) { |
10141 | #if NPFSYNC |
10142 | pfsync_update_state(s); |
10143 | #endif /* NPFSYNC */ |
10144 | r = s->rule.ptr; |
10145 | a = s->anchor.ptr; |
10146 | log = s->log; |
10147 | } else if (s == NULL) |
10148 | action = pf_test_rule(&r, &s, dir, kif, pbuf, off, h, |
10149 | &pd, &a, &ruleset, NULL); |
10150 | break; |
10151 | } |
10152 | |
10153 | done: |
10154 | if (action == PF_NAT64) { |
10155 | *pbufp = NULL; |
10156 | return (action); |
10157 | } |
10158 | |
10159 | *pbufp = pd.mp; |
10160 | PF_APPLE_UPDATE_PDESC_IPv6(); |
10161 | |
10162 | /* handle dangerous IPv6 extension headers. */ |
10163 | if (action != PF_DROP) { |
10164 | if (action == PF_PASS && rh_cnt && |
10165 | !((s && s->allow_opts) || r->allow_opts)) { |
10166 | action = PF_DROP; |
10167 | REASON_SET(&reason, PFRES_IPOPTIONS); |
10168 | log = 1; |
10169 | DPFPRINTF(PF_DEBUG_MISC, |
10170 | ("pf: dropping packet with dangerous v6addr headers\n" )); |
10171 | } |
10172 | |
10173 | if ((s && s->tag) || PF_RTABLEID_IS_VALID(r->rtableid) || |
10174 | (pd.pktflags & PKTF_FLOW_ID)) |
10175 | (void) pf_tag_packet(pbuf, pd.pf_mtag, s ? s->tag : 0, |
10176 | r->rtableid, &pd); |
10177 | |
10178 | if (action == PF_PASS) { |
10179 | #if PF_ECN |
10180 | /* add hints for ecn */ |
10181 | pd.pf_mtag->pftag_hdr = h; |
10182 | /* record address family */ |
10183 | pd.pf_mtag->pftag_flags &= ~PF_TAG_HDR_INET; |
10184 | pd.pf_mtag->pftag_flags |= PF_TAG_HDR_INET6; |
10185 | #endif /* PF_ECN */ |
10186 | /* record protocol */ |
10187 | *pbuf->pb_proto = pd.proto; |
10188 | if (dir == PF_IN && (pd.proto == IPPROTO_TCP || |
10189 | pd.proto == IPPROTO_UDP) && s != NULL && |
10190 | s->nat_rule.ptr != NULL && |
10191 | (s->nat_rule.ptr->action == PF_RDR || |
10192 | s->nat_rule.ptr->action == PF_BINAT) && |
10193 | IN6_IS_ADDR_LOOPBACK(&pd.dst->v6addr)) |
10194 | pd.pf_mtag->pftag_flags |= PF_TAG_TRANSLATE_LOCALHOST; |
10195 | } |
10196 | } |
10197 | |
10198 | |
10199 | if (log) { |
10200 | struct pf_rule *lr; |
10201 | |
10202 | if (s != NULL && s->nat_rule.ptr != NULL && |
10203 | s->nat_rule.ptr->log & PF_LOG_ALL) |
10204 | lr = s->nat_rule.ptr; |
10205 | else |
10206 | lr = r; |
10207 | PFLOG_PACKET(kif, h, pbuf, AF_INET6, dir, reason, lr, a, ruleset, |
10208 | &pd); |
10209 | } |
10210 | |
10211 | kif->pfik_bytes[1][dir == PF_OUT][action != PF_PASS] += pd.tot_len; |
10212 | kif->pfik_packets[1][dir == PF_OUT][action != PF_PASS]++; |
10213 | |
10214 | if (action == PF_PASS || r->action == PF_DROP) { |
10215 | dirndx = (dir == PF_OUT); |
10216 | r->packets[dirndx]++; |
10217 | r->bytes[dirndx] += pd.tot_len; |
10218 | if (a != NULL) { |
10219 | a->packets[dirndx]++; |
10220 | a->bytes[dirndx] += pd.tot_len; |
10221 | } |
10222 | if (s != NULL) { |
10223 | sk = s->state_key; |
10224 | if (s->nat_rule.ptr != NULL) { |
10225 | s->nat_rule.ptr->packets[dirndx]++; |
10226 | s->nat_rule.ptr->bytes[dirndx] += pd.tot_len; |
10227 | } |
10228 | if (s->src_node != NULL) { |
10229 | s->src_node->packets[dirndx]++; |
10230 | s->src_node->bytes[dirndx] += pd.tot_len; |
10231 | } |
10232 | if (s->nat_src_node != NULL) { |
10233 | s->nat_src_node->packets[dirndx]++; |
10234 | s->nat_src_node->bytes[dirndx] += pd.tot_len; |
10235 | } |
10236 | dirndx = (dir == sk->direction) ? 0 : 1; |
10237 | s->packets[dirndx]++; |
10238 | s->bytes[dirndx] += pd.tot_len; |
10239 | } |
10240 | tr = r; |
10241 | nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule; |
10242 | if (nr != NULL) { |
10243 | struct pf_addr *x; |
10244 | /* |
10245 | * XXX: we need to make sure that the addresses |
10246 | * passed to pfr_update_stats() are the same than |
10247 | * the addresses used during matching (pfr_match) |
10248 | */ |
10249 | if (r == &pf_default_rule) { |
10250 | tr = nr; |
10251 | x = (s == NULL || sk->direction == dir) ? |
10252 | &pd.baddr : &pd.naddr; |
10253 | } else { |
10254 | x = (s == NULL || sk->direction == dir) ? |
10255 | &pd.naddr : &pd.baddr; |
10256 | } |
10257 | if (x == &pd.baddr || s == NULL) { |
10258 | if (dir == PF_OUT) |
10259 | pd.src = x; |
10260 | else |
10261 | pd.dst = x; |
10262 | } |
10263 | } |
10264 | if (tr->src.addr.type == PF_ADDR_TABLE) |
10265 | pfr_update_stats(tr->src.addr.p.tbl, (sk == NULL || |
10266 | sk->direction == dir) ? pd.src : pd.dst, pd.af, |
10267 | pd.tot_len, dir == PF_OUT, r->action == PF_PASS, |
10268 | tr->src.neg); |
10269 | if (tr->dst.addr.type == PF_ADDR_TABLE) |
10270 | pfr_update_stats(tr->dst.addr.p.tbl, (sk == NULL || |
10271 | sk->direction == dir) ? pd.dst : pd.src, pd.af, |
10272 | pd.tot_len, dir == PF_OUT, r->action == PF_PASS, |
10273 | tr->dst.neg); |
10274 | } |
10275 | |
10276 | #if 0 |
10277 | if (action == PF_SYNPROXY_DROP) { |
10278 | m_freem(*m0); |
10279 | *m0 = NULL; |
10280 | action = PF_PASS; |
10281 | } else if (r->rt) |
10282 | /* pf_route6 can free the mbuf causing *m0 to become NULL */ |
10283 | pf_route6(m0, r, dir, kif->pfik_ifp, s, &pd); |
10284 | #else |
10285 | VERIFY(pbuf == NULL || pd.mp == NULL || pd.mp == pbuf); |
10286 | |
10287 | if (*pbufp) { |
10288 | if (pd.lmw < 0) { |
10289 | REASON_SET(&reason, PFRES_MEMORY); |
10290 | action = PF_DROP; |
10291 | } |
10292 | |
10293 | if (action == PF_DROP) { |
10294 | pbuf_destroy(*pbufp); |
10295 | *pbufp = NULL; |
10296 | return (PF_DROP); |
10297 | } |
10298 | |
10299 | *pbufp = pbuf; |
10300 | } |
10301 | |
10302 | if (action == PF_SYNPROXY_DROP) { |
10303 | pbuf_destroy(*pbufp); |
10304 | *pbufp = NULL; |
10305 | action = PF_PASS; |
10306 | } else if (r->rt) { |
10307 | /* pf_route6 can free the mbuf causing *m0 to become NULL */ |
10308 | pf_route6(pbufp, r, dir, kif->pfik_ifp, s, &pd); |
10309 | } |
10310 | #endif /* 0 */ |
10311 | |
10312 | return (action); |
10313 | } |
10314 | #endif /* INET6 */ |
10315 | |
10316 | static int |
10317 | pf_check_congestion(struct ifqueue *ifq) |
10318 | { |
10319 | #pragma unused(ifq) |
10320 | return (0); |
10321 | } |
10322 | |
10323 | void |
10324 | pool_init(struct pool *pp, size_t size, unsigned int align, unsigned int ioff, |
10325 | int flags, const char *wchan, void *palloc) |
10326 | { |
10327 | #pragma unused(align, ioff, flags, palloc) |
10328 | bzero(pp, sizeof (*pp)); |
10329 | pp->pool_zone = zinit(size, 1024 * size, PAGE_SIZE, wchan); |
10330 | if (pp->pool_zone != NULL) { |
10331 | zone_change(pp->pool_zone, Z_EXPAND, TRUE); |
10332 | zone_change(pp->pool_zone, Z_CALLERACCT, FALSE); |
10333 | pp->pool_hiwat = pp->pool_limit = (unsigned int)-1; |
10334 | pp->pool_name = wchan; |
10335 | } |
10336 | } |
10337 | |
10338 | /* Zones cannot be currently destroyed */ |
10339 | void |
10340 | pool_destroy(struct pool *pp) |
10341 | { |
10342 | #pragma unused(pp) |
10343 | } |
10344 | |
10345 | void |
10346 | pool_sethiwat(struct pool *pp, int n) |
10347 | { |
10348 | pp->pool_hiwat = n; /* Currently unused */ |
10349 | } |
10350 | |
10351 | void |
10352 | pool_sethardlimit(struct pool *pp, int n, const char *warnmess, int ratecap) |
10353 | { |
10354 | #pragma unused(warnmess, ratecap) |
10355 | pp->pool_limit = n; |
10356 | } |
10357 | |
10358 | void * |
10359 | pool_get(struct pool *pp, int flags) |
10360 | { |
10361 | void *buf; |
10362 | |
10363 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
10364 | |
10365 | if (pp->pool_count > pp->pool_limit) { |
10366 | DPFPRINTF(PF_DEBUG_NOISY, |
10367 | ("pf: pool %s hard limit reached (%d)\n" , |
10368 | pp->pool_name != NULL ? pp->pool_name : "unknown" , |
10369 | pp->pool_limit)); |
10370 | pp->pool_fails++; |
10371 | return (NULL); |
10372 | } |
10373 | |
10374 | buf = zalloc_canblock(pp->pool_zone, (flags & (PR_NOWAIT | PR_WAITOK))); |
10375 | if (buf != NULL) { |
10376 | pp->pool_count++; |
10377 | VERIFY(pp->pool_count != 0); |
10378 | } |
10379 | return (buf); |
10380 | } |
10381 | |
10382 | void |
10383 | pool_put(struct pool *pp, void *v) |
10384 | { |
10385 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
10386 | |
10387 | zfree(pp->pool_zone, v); |
10388 | VERIFY(pp->pool_count != 0); |
10389 | pp->pool_count--; |
10390 | } |
10391 | |
10392 | struct pf_mtag * |
10393 | pf_find_mtag_pbuf(pbuf_t *pbuf) |
10394 | { |
10395 | |
10396 | return (pbuf->pb_pftag); |
10397 | } |
10398 | |
10399 | struct pf_mtag * |
10400 | pf_find_mtag(struct mbuf *m) |
10401 | { |
10402 | |
10403 | return (m_pftag(m)); |
10404 | } |
10405 | |
10406 | struct pf_mtag * |
10407 | pf_get_mtag(struct mbuf *m) |
10408 | { |
10409 | return (pf_find_mtag(m)); |
10410 | } |
10411 | |
10412 | struct pf_mtag * |
10413 | pf_get_mtag_pbuf(pbuf_t *pbuf) |
10414 | { |
10415 | return (pf_find_mtag_pbuf(pbuf)); |
10416 | } |
10417 | |
10418 | uint64_t |
10419 | pf_time_second(void) |
10420 | { |
10421 | struct timeval t; |
10422 | |
10423 | microuptime(&t); |
10424 | return (t.tv_sec); |
10425 | } |
10426 | |
10427 | uint64_t |
10428 | pf_calendar_time_second(void) |
10429 | { |
10430 | struct timeval t; |
10431 | |
10432 | getmicrotime(&t); |
10433 | return (t.tv_sec); |
10434 | } |
10435 | |
10436 | static void * |
10437 | hook_establish(struct hook_desc_head *head, int tail, hook_fn_t fn, void *arg) |
10438 | { |
10439 | struct hook_desc *hd; |
10440 | |
10441 | hd = _MALLOC(sizeof(*hd), M_DEVBUF, M_WAITOK); |
10442 | if (hd == NULL) |
10443 | return (NULL); |
10444 | |
10445 | hd->hd_fn = fn; |
10446 | hd->hd_arg = arg; |
10447 | if (tail) |
10448 | TAILQ_INSERT_TAIL(head, hd, hd_list); |
10449 | else |
10450 | TAILQ_INSERT_HEAD(head, hd, hd_list); |
10451 | |
10452 | return (hd); |
10453 | } |
10454 | |
10455 | static void |
10456 | hook_runloop(struct hook_desc_head *head, int flags) |
10457 | { |
10458 | struct hook_desc *hd; |
10459 | |
10460 | if (!(flags & HOOK_REMOVE)) { |
10461 | if (!(flags & HOOK_ABORT)) |
10462 | TAILQ_FOREACH(hd, head, hd_list) |
10463 | hd->hd_fn(hd->hd_arg); |
10464 | } else { |
10465 | while (!!(hd = TAILQ_FIRST(head))) { |
10466 | TAILQ_REMOVE(head, hd, hd_list); |
10467 | if (!(flags & HOOK_ABORT)) |
10468 | hd->hd_fn(hd->hd_arg); |
10469 | if (flags & HOOK_FREE) |
10470 | _FREE(hd, M_DEVBUF); |
10471 | } |
10472 | } |
10473 | } |
10474 | |