1/*
2 * Copyright (c) 2007-2023 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29/* $apfw: git commit 6602420f2f101b74305cd78f7cd9e0c8fdedae97 $ */
30/* $OpenBSD: pf.c,v 1.567 2008/02/20 23:40:13 henning Exp $ */
31
32/*
33 * Copyright (c) 2001 Daniel Hartmeier
34 * Copyright (c) 2002 - 2013 Henning Brauer
35 * NAT64 - Copyright (c) 2010 Viagenie Inc. (http://www.viagenie.ca)
36 * All rights reserved.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 *
42 * - Redistributions of source code must retain the above copyright
43 * notice, this list of conditions and the following disclaimer.
44 * - Redistributions in binary form must reproduce the above
45 * copyright notice, this list of conditions and the following
46 * disclaimer in the documentation and/or other materials provided
47 * with the distribution.
48 *
49 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
50 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
51 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
52 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
53 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
54 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
55 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
56 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
57 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
58 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
59 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
60 * POSSIBILITY OF SUCH DAMAGE.
61 *
62 * Effort sponsored in part by the Defense Advanced Research Projects
63 * Agency (DARPA) and Air Force Research Laboratory, Air Force
64 * Materiel Command, USAF, under agreement number F30602-01-2-0537.
65 *
66 */
67
68#include <machine/endian.h>
69#include <sys/param.h>
70#include <sys/systm.h>
71#include <sys/filio.h>
72#include <sys/socket.h>
73#include <sys/socketvar.h>
74#include <sys/kernel.h>
75#include <sys/time.h>
76#include <sys/proc.h>
77#include <sys/random.h>
78#include <sys/mcache.h>
79#include <sys/protosw.h>
80
81#include <libkern/crypto/md5.h>
82#include <libkern/libkern.h>
83
84#include <mach/thread_act.h>
85
86#include <net/if.h>
87#include <net/if_types.h>
88#include <net/bpf.h>
89#include <net/route.h>
90#include <net/dlil.h>
91
92#include <netinet/in.h>
93#include <netinet/in_var.h>
94#include <netinet/in_systm.h>
95#include <netinet/ip.h>
96#include <netinet/ip_var.h>
97#include <netinet/tcp.h>
98#include <netinet/tcp_seq.h>
99#include <netinet/udp.h>
100#include <netinet/ip_icmp.h>
101#include <netinet/in_pcb.h>
102#include <netinet/tcp_timer.h>
103#include <netinet/tcp_var.h>
104#include <netinet/tcp_fsm.h>
105#include <netinet/udp_var.h>
106#include <netinet/icmp_var.h>
107#include <net/if_ether.h>
108#include <net/ethernet.h>
109#include <net/flowhash.h>
110#include <net/nat464_utils.h>
111#include <net/pfvar.h>
112#include <net/if_pflog.h>
113
114#if NPFSYNC
115#include <net/if_pfsync.h>
116#endif /* NPFSYNC */
117
118#include <netinet/ip6.h>
119#include <netinet6/in6_pcb.h>
120#include <netinet6/ip6_var.h>
121#include <netinet/icmp6.h>
122#include <netinet6/nd6.h>
123
124#if DUMMYNET
125#include <netinet/ip_dummynet.h>
126#endif /* DUMMYNET */
127
128#if SKYWALK
129#include <skywalk/namespace/flowidns.h>
130#endif /* SKYWALK */
131
132/*
133 * For RandomULong(), to get a 32 bits random value
134 * Note that random() returns a 31 bits value, see rdar://11159750
135 */
136#include <dev/random/randomdev.h>
137
138#define DPFPRINTF(n, x) (pf_status.debug >= (n) ? printf x : ((void)0))
139
140/*
141 * On Mac OS X, the rtableid value is treated as the interface scope
142 * value that is equivalent to the interface index used for scoped
143 * routing. A valid scope value is anything but IFSCOPE_NONE (0),
144 * as per definition of ifindex which is a positive, non-zero number.
145 * The other BSDs treat a negative rtableid value as invalid, hence
146 * the test against INT_MAX to handle userland apps which initialize
147 * the field with a negative number.
148 */
149#define PF_RTABLEID_IS_VALID(r) \
150 ((r) > IFSCOPE_NONE && (r) <= INT_MAX)
151
152/*
153 * Global variables
154 */
155static LCK_GRP_DECLARE(pf_lock_grp, "pf");
156LCK_MTX_DECLARE(pf_lock, &pf_lock_grp);
157
158static LCK_GRP_DECLARE(pf_perim_lock_grp, "pf_perim");
159LCK_RW_DECLARE(pf_perim_lock, &pf_perim_lock_grp);
160
161/* state tables */
162struct pf_state_tree_lan_ext pf_statetbl_lan_ext;
163struct pf_state_tree_ext_gwy pf_statetbl_ext_gwy;
164static uint32_t pf_state_tree_ext_gwy_nat64_cnt = 0;
165
166struct pf_palist pf_pabuf;
167struct pf_status pf_status;
168
169u_int32_t ticket_pabuf;
170
171static MD5_CTX pf_tcp_secret_ctx;
172static u_char pf_tcp_secret[16];
173static int pf_tcp_secret_init;
174static int pf_tcp_iss_off;
175
176static struct pf_anchor_stackframe {
177 struct pf_ruleset *rs;
178 struct pf_rule *r;
179 struct pf_anchor_node *parent;
180 struct pf_anchor *child;
181} pf_anchor_stack[64];
182
183struct pool pf_src_tree_pl, pf_rule_pl, pf_pooladdr_pl;
184struct pool pf_state_pl, pf_state_key_pl;
185
186typedef void (*hook_fn_t)(void *);
187
188struct hook_desc {
189 TAILQ_ENTRY(hook_desc) hd_list;
190 hook_fn_t hd_fn;
191 void *hd_arg;
192};
193
194#define HOOK_REMOVE 0x01
195#define HOOK_FREE 0x02
196#define HOOK_ABORT 0x04
197
198static void *hook_establish(struct hook_desc_head *, int,
199 hook_fn_t, void *);
200static void hook_runloop(struct hook_desc_head *, int flags);
201
202struct pool pf_app_state_pl;
203static void pf_print_addr(struct pf_addr *addr, sa_family_t af);
204static void pf_print_sk_host(struct pf_state_host *, u_int8_t, int,
205 u_int8_t);
206
207static void pf_print_host(struct pf_addr *, u_int16_t, u_int8_t);
208
209static void pf_init_threshold(struct pf_threshold *, u_int32_t,
210 u_int32_t);
211static void pf_add_threshold(struct pf_threshold *);
212static int pf_check_threshold(struct pf_threshold *);
213
214static void pf_change_ap(int, pbuf_t *, struct pf_addr *,
215 u_int16_t *, u_int16_t *, u_int16_t *,
216 struct pf_addr *, u_int16_t, u_int8_t, sa_family_t,
217 sa_family_t, int);
218static int pf_modulate_sack(pbuf_t *, int, struct pf_pdesc *,
219 struct tcphdr *, struct pf_state_peer *);
220static void pf_change_a6(struct pf_addr *, u_int16_t *,
221 struct pf_addr *, u_int8_t);
222static void pf_change_addr(struct pf_addr *a, u_int16_t *c, struct pf_addr *an,
223 u_int8_t u, sa_family_t af, sa_family_t afn);
224static void pf_change_icmp(struct pf_addr *, u_int16_t *,
225 struct pf_addr *, struct pf_addr *, u_int16_t,
226 u_int16_t *, u_int16_t *, u_int16_t *,
227 u_int16_t *, u_int8_t, sa_family_t);
228static void pf_send_tcp(const struct pf_rule *, sa_family_t,
229 const struct pf_addr *, const struct pf_addr *,
230 u_int16_t, u_int16_t, u_int32_t, u_int32_t,
231 u_int8_t, u_int16_t, u_int16_t, u_int8_t, int,
232 u_int16_t, struct ether_header *, struct ifnet *);
233static void pf_send_icmp(pbuf_t *, u_int8_t, u_int8_t,
234 sa_family_t, struct pf_rule *);
235static struct pf_rule *pf_match_translation(struct pf_pdesc *, pbuf_t *,
236 int, int, struct pfi_kif *, struct pf_addr *,
237 union pf_state_xport *, struct pf_addr *,
238 union pf_state_xport *, int);
239static struct pf_rule *pf_get_translation_aux(struct pf_pdesc *,
240 pbuf_t *, int, int, struct pfi_kif *,
241 struct pf_src_node **, struct pf_addr *,
242 union pf_state_xport *, struct pf_addr *,
243 union pf_state_xport *, union pf_state_xport *
244#if SKYWALK
245 , netns_token *
246#endif
247 );
248static void pf_attach_state(struct pf_state_key *,
249 struct pf_state *, int);
250static u_int32_t pf_tcp_iss(struct pf_pdesc *);
251static int pf_test_rule(struct pf_rule **, struct pf_state **,
252 int, struct pfi_kif *, pbuf_t *, int,
253 void *, struct pf_pdesc *, struct pf_rule **,
254 struct pf_ruleset **, struct ifqueue *);
255#if DUMMYNET
256static int pf_test_dummynet(struct pf_rule **, int,
257 struct pfi_kif *, pbuf_t **,
258 struct pf_pdesc *, struct ip_fw_args *);
259#endif /* DUMMYNET */
260static int pf_test_fragment(struct pf_rule **, int,
261 struct pfi_kif *, pbuf_t *, void *,
262 struct pf_pdesc *, struct pf_rule **,
263 struct pf_ruleset **);
264static int pf_test_state_tcp(struct pf_state **, int,
265 struct pfi_kif *, pbuf_t *, int,
266 void *, struct pf_pdesc *, u_short *);
267static int pf_test_state_udp(struct pf_state **, int,
268 struct pfi_kif *, pbuf_t *, int,
269 void *, struct pf_pdesc *, u_short *);
270static int pf_test_state_icmp(struct pf_state **, int,
271 struct pfi_kif *, pbuf_t *, int,
272 void *, struct pf_pdesc *, u_short *);
273static int pf_test_state_other(struct pf_state **, int,
274 struct pfi_kif *, struct pf_pdesc *);
275static int pf_match_tag(struct pf_rule *,
276 struct pf_mtag *, int *);
277static void pf_hash(struct pf_addr *, struct pf_addr *,
278 struct pf_poolhashkey *, sa_family_t);
279static int pf_map_addr(u_int8_t, struct pf_rule *,
280 struct pf_addr *, struct pf_addr *,
281 struct pf_addr *, struct pf_src_node **);
282static int pf_get_sport(struct pf_pdesc *, struct pfi_kif *,
283 struct pf_rule *, struct pf_addr *,
284 union pf_state_xport *, struct pf_addr *,
285 union pf_state_xport *, struct pf_addr *,
286 union pf_state_xport *, struct pf_src_node **
287#if SKYWALK
288 , netns_token *
289#endif
290 );
291static void pf_route(pbuf_t **, struct pf_rule *, int,
292 struct ifnet *, struct pf_state *,
293 struct pf_pdesc *);
294static void pf_route6(pbuf_t **, struct pf_rule *, int,
295 struct ifnet *, struct pf_state *,
296 struct pf_pdesc *);
297static u_int8_t pf_get_wscale(pbuf_t *, int, u_int16_t,
298 sa_family_t);
299static u_int16_t pf_get_mss(pbuf_t *, int, u_int16_t,
300 sa_family_t);
301static u_int16_t pf_calc_mss(struct pf_addr *, sa_family_t,
302 u_int16_t);
303static void pf_set_rt_ifp(struct pf_state *,
304 struct pf_addr *, sa_family_t af);
305static int pf_check_proto_cksum(pbuf_t *, int, int,
306 u_int8_t, sa_family_t);
307static int pf_addr_wrap_neq(struct pf_addr_wrap *,
308 struct pf_addr_wrap *);
309static struct pf_state *pf_find_state(struct pfi_kif *,
310 struct pf_state_key_cmp *, u_int);
311static int pf_src_connlimit(struct pf_state **);
312static void pf_stateins_err(const char *, struct pf_state *,
313 struct pfi_kif *);
314static int pf_check_congestion(struct ifqueue *);
315
316#if 0
317static const char *pf_pptp_ctrl_type_name(u_int16_t code);
318#endif
319static void pf_pptp_handler(struct pf_state *, int, int,
320 struct pf_pdesc *, struct pfi_kif *);
321static void pf_pptp_unlink(struct pf_state *);
322static void pf_grev1_unlink(struct pf_state *);
323static int pf_test_state_grev1(struct pf_state **, int,
324 struct pfi_kif *, int, struct pf_pdesc *);
325static int pf_ike_compare(struct pf_app_state *,
326 struct pf_app_state *);
327static int pf_test_state_esp(struct pf_state **, int,
328 struct pfi_kif *, int, struct pf_pdesc *);
329static int pf_test6(int, struct ifnet *, pbuf_t **, struct ether_header *,
330 struct ip_fw_args *);
331#if INET
332static int pf_test(int, struct ifnet *, pbuf_t **,
333 struct ether_header *, struct ip_fw_args *);
334#endif /* INET */
335
336
337extern struct pool pfr_ktable_pl;
338extern struct pool pfr_kentry_pl;
339extern int path_mtu_discovery;
340
341struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX] = {
342 { .pp = &pf_state_pl, .limit = PFSTATE_HIWAT },
343 { .pp = &pf_app_state_pl, .limit = PFAPPSTATE_HIWAT },
344 { .pp = &pf_src_tree_pl, .limit = PFSNODE_HIWAT },
345 { .pp = &pf_frent_pl, .limit = PFFRAG_FRENT_HIWAT },
346 { .pp = &pfr_ktable_pl, .limit = PFR_KTABLE_HIWAT },
347 { .pp = &pfr_kentry_pl, .limit = PFR_KENTRY_HIWAT },
348};
349
350#if SKYWALK && defined(XNU_TARGET_OS_OSX)
351const char *compatible_anchors[] = {
352 "com.apple.internet-sharing",
353 "com.apple/250.ApplicationFirewall",
354 "com.apple/200.AirDrop"
355};
356#endif // SKYWALK && defined(XNU_TARGET_OS_OSX)
357
358void *
359pf_lazy_makewritable(struct pf_pdesc *pd, pbuf_t *pbuf, int len)
360{
361 void *p;
362
363 if (pd->lmw < 0) {
364 return NULL;
365 }
366
367 VERIFY(pbuf == pd->mp);
368
369 p = pbuf->pb_data;
370 if (len > pd->lmw) {
371 if ((p = pbuf_ensure_writable(pbuf, len)) == NULL) {
372 len = -1;
373 }
374 pd->lmw = len;
375 if (len >= 0) {
376 pd->pf_mtag = pf_find_mtag_pbuf(pbuf);
377
378 switch (pd->af) {
379 case AF_INET: {
380 struct ip *h = p;
381 pd->src = (struct pf_addr *)(uintptr_t)&h->ip_src;
382 pd->dst = (struct pf_addr *)(uintptr_t)&h->ip_dst;
383 pd->ip_sum = &h->ip_sum;
384 break;
385 }
386 case AF_INET6: {
387 struct ip6_hdr *h = p;
388 pd->src = (struct pf_addr *)(uintptr_t)&h->ip6_src;
389 pd->dst = (struct pf_addr *)(uintptr_t)&h->ip6_dst;
390 break;
391 }
392 }
393 }
394 }
395
396 return len < 0 ? NULL : p;
397}
398
399static const int *
400pf_state_lookup_aux(struct pf_state **state, struct pfi_kif *kif,
401 int direction, int *action)
402{
403 if (*state == NULL || (*state)->timeout == PFTM_PURGE) {
404 *action = PF_DROP;
405 return action;
406 }
407
408 if (direction == PF_OUT &&
409 (((*state)->rule.ptr->rt == PF_ROUTETO &&
410 (*state)->rule.ptr->direction == PF_OUT) ||
411 ((*state)->rule.ptr->rt == PF_REPLYTO &&
412 (*state)->rule.ptr->direction == PF_IN)) &&
413 (*state)->rt_kif != NULL && (*state)->rt_kif != kif) {
414 *action = PF_PASS;
415 return action;
416 }
417
418 return 0;
419}
420
421#define STATE_LOOKUP() \
422 do { \
423 int action; \
424 *state = pf_find_state(kif, &key, direction); \
425 if (*state != NULL && pd != NULL && \
426 !(pd->pktflags & PKTF_FLOW_ID)) { \
427 pd->flowsrc = (*state)->state_key->flowsrc; \
428 pd->flowhash = (*state)->state_key->flowhash; \
429 if (pd->flowhash != 0) { \
430 pd->pktflags |= PKTF_FLOW_ID; \
431 pd->pktflags &= ~PKTF_FLOW_ADV; \
432 } \
433 } \
434 if (pf_state_lookup_aux(state, kif, direction, &action)) \
435 return (action); \
436 } while (0)
437
438/*
439 * This macro resets the flowID information in a packet descriptor which was
440 * copied in from a PF state. This should be used after a protocol state lookup
441 * finds a matching PF state, but then decides to not use it for various
442 * reasons.
443 */
444#define PD_CLEAR_STATE_FLOWID(_pd) \
445 do { \
446 if (__improbable(((_pd)->pktflags & PKTF_FLOW_ID) && \
447 ((_pd)->flowsrc == FLOWSRC_PF))) { \
448 (_pd)->flowhash = 0; \
449 (_pd)->flowsrc = 0; \
450 (_pd)->pktflags &= ~PKTF_FLOW_ID; \
451 } \
452 \
453 } while (0)
454
455#define STATE_ADDR_TRANSLATE(sk) \
456 (sk)->lan.addr.addr32[0] != (sk)->gwy.addr.addr32[0] || \
457 ((sk)->af_lan == AF_INET6 && \
458 ((sk)->lan.addr.addr32[1] != (sk)->gwy.addr.addr32[1] || \
459 (sk)->lan.addr.addr32[2] != (sk)->gwy.addr.addr32[2] || \
460 (sk)->lan.addr.addr32[3] != (sk)->gwy.addr.addr32[3]))
461
462#define STATE_TRANSLATE(sk) \
463 ((sk)->af_lan != (sk)->af_gwy || \
464 STATE_ADDR_TRANSLATE(sk) || \
465 (sk)->lan.xport.port != (sk)->gwy.xport.port)
466
467#define STATE_GRE_TRANSLATE(sk) \
468 (STATE_ADDR_TRANSLATE(sk) || \
469 (sk)->lan.xport.call_id != (sk)->gwy.xport.call_id)
470
471#define BOUND_IFACE(r, k) \
472 ((r)->rule_flag & PFRULE_IFBOUND) ? (k) : pfi_all
473
474#define STATE_INC_COUNTERS(s) \
475 do { \
476 s->rule.ptr->states++; \
477 VERIFY(s->rule.ptr->states != 0); \
478 if (s->anchor.ptr != NULL) { \
479 s->anchor.ptr->states++; \
480 VERIFY(s->anchor.ptr->states != 0); \
481 } \
482 if (s->nat_rule.ptr != NULL) { \
483 s->nat_rule.ptr->states++; \
484 VERIFY(s->nat_rule.ptr->states != 0); \
485 } \
486 } while (0)
487
488#define STATE_DEC_COUNTERS(s) \
489 do { \
490 if (s->nat_rule.ptr != NULL) { \
491 VERIFY(s->nat_rule.ptr->states > 0); \
492 s->nat_rule.ptr->states--; \
493 } \
494 if (s->anchor.ptr != NULL) { \
495 VERIFY(s->anchor.ptr->states > 0); \
496 s->anchor.ptr->states--; \
497 } \
498 VERIFY(s->rule.ptr->states > 0); \
499 s->rule.ptr->states--; \
500 } while (0)
501
502static __inline int pf_src_compare(struct pf_src_node *, struct pf_src_node *);
503static __inline int pf_state_compare_lan_ext(struct pf_state_key *,
504 struct pf_state_key *);
505static __inline int pf_state_compare_ext_gwy(struct pf_state_key *,
506 struct pf_state_key *);
507static __inline int pf_state_compare_id(struct pf_state *,
508 struct pf_state *);
509
510struct pf_src_tree tree_src_tracking;
511
512struct pf_state_tree_id tree_id;
513struct pf_state_queue state_list;
514
515RB_GENERATE(pf_src_tree, pf_src_node, entry, pf_src_compare);
516RB_GENERATE(pf_state_tree_lan_ext, pf_state_key,
517 entry_lan_ext, pf_state_compare_lan_ext);
518RB_GENERATE(pf_state_tree_ext_gwy, pf_state_key,
519 entry_ext_gwy, pf_state_compare_ext_gwy);
520RB_GENERATE(pf_state_tree_id, pf_state,
521 entry_id, pf_state_compare_id);
522
523#define PF_DT_SKIP_LANEXT 0x01
524#define PF_DT_SKIP_EXTGWY 0x02
525
526static const u_int16_t PF_PPTP_PORT = 1723;
527static const u_int32_t PF_PPTP_MAGIC_NUMBER = 0x1A2B3C4D;
528
529struct pf_pptp_hdr {
530 u_int16_t length;
531 u_int16_t type;
532 u_int32_t magic;
533};
534
535struct pf_pptp_ctrl_hdr {
536 u_int16_t type;
537 u_int16_t reserved_0;
538};
539
540struct pf_pptp_ctrl_generic {
541 u_int16_t data[0];
542};
543
544#define PF_PPTP_CTRL_TYPE_START_REQ 1
545struct pf_pptp_ctrl_start_req {
546 u_int16_t protocol_version;
547 u_int16_t reserved_1;
548 u_int32_t framing_capabilities;
549 u_int32_t bearer_capabilities;
550 u_int16_t maximum_channels;
551 u_int16_t firmware_revision;
552 u_int8_t host_name[64];
553 u_int8_t vendor_string[64];
554};
555
556#define PF_PPTP_CTRL_TYPE_START_RPY 2
557struct pf_pptp_ctrl_start_rpy {
558 u_int16_t protocol_version;
559 u_int8_t result_code;
560 u_int8_t error_code;
561 u_int32_t framing_capabilities;
562 u_int32_t bearer_capabilities;
563 u_int16_t maximum_channels;
564 u_int16_t firmware_revision;
565 u_int8_t host_name[64];
566 u_int8_t vendor_string[64];
567};
568
569#define PF_PPTP_CTRL_TYPE_STOP_REQ 3
570struct pf_pptp_ctrl_stop_req {
571 u_int8_t reason;
572 u_int8_t reserved_1;
573 u_int16_t reserved_2;
574};
575
576#define PF_PPTP_CTRL_TYPE_STOP_RPY 4
577struct pf_pptp_ctrl_stop_rpy {
578 u_int8_t reason;
579 u_int8_t error_code;
580 u_int16_t reserved_1;
581};
582
583#define PF_PPTP_CTRL_TYPE_ECHO_REQ 5
584struct pf_pptp_ctrl_echo_req {
585 u_int32_t identifier;
586};
587
588#define PF_PPTP_CTRL_TYPE_ECHO_RPY 6
589struct pf_pptp_ctrl_echo_rpy {
590 u_int32_t identifier;
591 u_int8_t result_code;
592 u_int8_t error_code;
593 u_int16_t reserved_1;
594};
595
596#define PF_PPTP_CTRL_TYPE_CALL_OUT_REQ 7
597struct pf_pptp_ctrl_call_out_req {
598 u_int16_t call_id;
599 u_int16_t call_sernum;
600 u_int32_t min_bps;
601 u_int32_t bearer_type;
602 u_int32_t framing_type;
603 u_int16_t rxwindow_size;
604 u_int16_t proc_delay;
605 u_int8_t phone_num[64];
606 u_int8_t sub_addr[64];
607};
608
609#define PF_PPTP_CTRL_TYPE_CALL_OUT_RPY 8
610struct pf_pptp_ctrl_call_out_rpy {
611 u_int16_t call_id;
612 u_int16_t peer_call_id;
613 u_int8_t result_code;
614 u_int8_t error_code;
615 u_int16_t cause_code;
616 u_int32_t connect_speed;
617 u_int16_t rxwindow_size;
618 u_int16_t proc_delay;
619 u_int32_t phy_channel_id;
620};
621
622#define PF_PPTP_CTRL_TYPE_CALL_IN_1ST 9
623struct pf_pptp_ctrl_call_in_1st {
624 u_int16_t call_id;
625 u_int16_t call_sernum;
626 u_int32_t bearer_type;
627 u_int32_t phy_channel_id;
628 u_int16_t dialed_number_len;
629 u_int16_t dialing_number_len;
630 u_int8_t dialed_num[64];
631 u_int8_t dialing_num[64];
632 u_int8_t sub_addr[64];
633};
634
635#define PF_PPTP_CTRL_TYPE_CALL_IN_2ND 10
636struct pf_pptp_ctrl_call_in_2nd {
637 u_int16_t call_id;
638 u_int16_t peer_call_id;
639 u_int8_t result_code;
640 u_int8_t error_code;
641 u_int16_t rxwindow_size;
642 u_int16_t txdelay;
643 u_int16_t reserved_1;
644};
645
646#define PF_PPTP_CTRL_TYPE_CALL_IN_3RD 11
647struct pf_pptp_ctrl_call_in_3rd {
648 u_int16_t call_id;
649 u_int16_t reserved_1;
650 u_int32_t connect_speed;
651 u_int16_t rxwindow_size;
652 u_int16_t txdelay;
653 u_int32_t framing_type;
654};
655
656#define PF_PPTP_CTRL_TYPE_CALL_CLR 12
657struct pf_pptp_ctrl_call_clr {
658 u_int16_t call_id;
659 u_int16_t reserved_1;
660};
661
662#define PF_PPTP_CTRL_TYPE_CALL_DISC 13
663struct pf_pptp_ctrl_call_disc {
664 u_int16_t call_id;
665 u_int8_t result_code;
666 u_int8_t error_code;
667 u_int16_t cause_code;
668 u_int16_t reserved_1;
669 u_int8_t statistics[128];
670};
671
672#define PF_PPTP_CTRL_TYPE_ERROR 14
673struct pf_pptp_ctrl_error {
674 u_int16_t peer_call_id;
675 u_int16_t reserved_1;
676 u_int32_t crc_errors;
677 u_int32_t fr_errors;
678 u_int32_t hw_errors;
679 u_int32_t buf_errors;
680 u_int32_t tim_errors;
681 u_int32_t align_errors;
682};
683
684#define PF_PPTP_CTRL_TYPE_SET_LINKINFO 15
685struct pf_pptp_ctrl_set_linkinfo {
686 u_int16_t peer_call_id;
687 u_int16_t reserved_1;
688 u_int32_t tx_accm;
689 u_int32_t rx_accm;
690};
691
692static const size_t PF_PPTP_CTRL_MSG_MINSIZE =
693 sizeof(struct pf_pptp_hdr) + sizeof(struct pf_pptp_ctrl_hdr);
694
695union pf_pptp_ctrl_msg_union {
696 struct pf_pptp_ctrl_start_req start_req;
697 struct pf_pptp_ctrl_start_rpy start_rpy;
698 struct pf_pptp_ctrl_stop_req stop_req;
699 struct pf_pptp_ctrl_stop_rpy stop_rpy;
700 struct pf_pptp_ctrl_echo_req echo_req;
701 struct pf_pptp_ctrl_echo_rpy echo_rpy;
702 struct pf_pptp_ctrl_call_out_req call_out_req;
703 struct pf_pptp_ctrl_call_out_rpy call_out_rpy;
704 struct pf_pptp_ctrl_call_in_1st call_in_1st;
705 struct pf_pptp_ctrl_call_in_2nd call_in_2nd;
706 struct pf_pptp_ctrl_call_in_3rd call_in_3rd;
707 struct pf_pptp_ctrl_call_clr call_clr;
708 struct pf_pptp_ctrl_call_disc call_disc;
709 struct pf_pptp_ctrl_error error;
710 struct pf_pptp_ctrl_set_linkinfo set_linkinfo;
711 u_int8_t data[0];
712};
713
714struct pf_pptp_ctrl_msg {
715 struct pf_pptp_hdr hdr;
716 struct pf_pptp_ctrl_hdr ctrl;
717 union pf_pptp_ctrl_msg_union msg;
718};
719
720#define PF_GRE_FLAG_CHECKSUM_PRESENT 0x8000
721#define PF_GRE_FLAG_VERSION_MASK 0x0007
722#define PF_GRE_PPP_ETHERTYPE 0x880B
723
724struct pf_grev1_hdr {
725 u_int16_t flags;
726 u_int16_t protocol_type;
727 u_int16_t payload_length;
728 u_int16_t call_id;
729 /*
730 * u_int32_t seqno;
731 * u_int32_t ackno;
732 */
733};
734
735static const u_int16_t PF_IKE_PORT = 500;
736
737struct pf_ike_hdr {
738 u_int64_t initiator_cookie, responder_cookie;
739 u_int8_t next_payload, version, exchange_type, flags;
740 u_int32_t message_id, length;
741};
742
743#define PF_IKE_PACKET_MINSIZE (sizeof (struct pf_ike_hdr))
744
745#define PF_IKEv1_EXCHTYPE_BASE 1
746#define PF_IKEv1_EXCHTYPE_ID_PROTECT 2
747#define PF_IKEv1_EXCHTYPE_AUTH_ONLY 3
748#define PF_IKEv1_EXCHTYPE_AGGRESSIVE 4
749#define PF_IKEv1_EXCHTYPE_INFORMATIONAL 5
750#define PF_IKEv2_EXCHTYPE_SA_INIT 34
751#define PF_IKEv2_EXCHTYPE_AUTH 35
752#define PF_IKEv2_EXCHTYPE_CREATE_CHILD_SA 36
753#define PF_IKEv2_EXCHTYPE_INFORMATIONAL 37
754
755#define PF_IKEv1_FLAG_E 0x01
756#define PF_IKEv1_FLAG_C 0x02
757#define PF_IKEv1_FLAG_A 0x04
758#define PF_IKEv2_FLAG_I 0x08
759#define PF_IKEv2_FLAG_V 0x10
760#define PF_IKEv2_FLAG_R 0x20
761
762struct pf_esp_hdr {
763 u_int32_t spi;
764 u_int32_t seqno;
765 u_int8_t payload[];
766};
767
768static __inline int
769pf_addr_compare(struct pf_addr *a, struct pf_addr *b, sa_family_t af)
770{
771 switch (af) {
772#ifdef INET
773 case AF_INET:
774 if (a->addr32[0] > b->addr32[0]) {
775 return 1;
776 }
777 if (a->addr32[0] < b->addr32[0]) {
778 return -1;
779 }
780 break;
781#endif /* INET */
782 case AF_INET6:
783 if (a->addr32[3] > b->addr32[3]) {
784 return 1;
785 }
786 if (a->addr32[3] < b->addr32[3]) {
787 return -1;
788 }
789 if (a->addr32[2] > b->addr32[2]) {
790 return 1;
791 }
792 if (a->addr32[2] < b->addr32[2]) {
793 return -1;
794 }
795 if (a->addr32[1] > b->addr32[1]) {
796 return 1;
797 }
798 if (a->addr32[1] < b->addr32[1]) {
799 return -1;
800 }
801 if (a->addr32[0] > b->addr32[0]) {
802 return 1;
803 }
804 if (a->addr32[0] < b->addr32[0]) {
805 return -1;
806 }
807 break;
808 }
809 return 0;
810}
811
812static __inline int
813pf_src_compare(struct pf_src_node *a, struct pf_src_node *b)
814{
815 int diff;
816
817 if (a->rule.ptr > b->rule.ptr) {
818 return 1;
819 }
820 if (a->rule.ptr < b->rule.ptr) {
821 return -1;
822 }
823 if ((diff = a->af - b->af) != 0) {
824 return diff;
825 }
826 if ((diff = pf_addr_compare(a: &a->addr, b: &b->addr, af: a->af)) != 0) {
827 return diff;
828 }
829 return 0;
830}
831
832static __inline int
833pf_state_compare_lan_ext(struct pf_state_key *a, struct pf_state_key *b)
834{
835 int diff;
836 int extfilter;
837
838 if ((diff = a->proto - b->proto) != 0) {
839 return diff;
840 }
841 if ((diff = a->af_lan - b->af_lan) != 0) {
842 return diff;
843 }
844
845 extfilter = PF_EXTFILTER_APD;
846
847 switch (a->proto) {
848 case IPPROTO_ICMP:
849 case IPPROTO_ICMPV6:
850 if ((diff = a->lan.xport.port - b->lan.xport.port) != 0) {
851 return diff;
852 }
853 break;
854
855 case IPPROTO_TCP:
856 if ((diff = a->lan.xport.port - b->lan.xport.port) != 0) {
857 return diff;
858 }
859 if ((diff = a->ext_lan.xport.port - b->ext_lan.xport.port) != 0) {
860 return diff;
861 }
862 break;
863
864 case IPPROTO_UDP:
865 if ((diff = a->proto_variant - b->proto_variant)) {
866 return diff;
867 }
868 extfilter = a->proto_variant;
869 if ((diff = a->lan.xport.port - b->lan.xport.port) != 0) {
870 return diff;
871 }
872 if ((extfilter < PF_EXTFILTER_AD) &&
873 (diff = a->ext_lan.xport.port - b->ext_lan.xport.port) != 0) {
874 return diff;
875 }
876 break;
877
878 case IPPROTO_GRE:
879 if (a->proto_variant == PF_GRE_PPTP_VARIANT &&
880 a->proto_variant == b->proto_variant) {
881 if (!!(diff = a->ext_lan.xport.call_id -
882 b->ext_lan.xport.call_id)) {
883 return diff;
884 }
885 }
886 break;
887
888 case IPPROTO_ESP:
889 if (!!(diff = a->ext_lan.xport.spi - b->ext_lan.xport.spi)) {
890 return diff;
891 }
892 break;
893
894 default:
895 break;
896 }
897
898 switch (a->af_lan) {
899#if INET
900 case AF_INET:
901 if ((diff = pf_addr_compare(a: &a->lan.addr, b: &b->lan.addr,
902 af: a->af_lan)) != 0) {
903 return diff;
904 }
905
906 if (extfilter < PF_EXTFILTER_EI) {
907 if ((diff = pf_addr_compare(a: &a->ext_lan.addr,
908 b: &b->ext_lan.addr,
909 af: a->af_lan)) != 0) {
910 return diff;
911 }
912 }
913 break;
914#endif /* INET */
915 case AF_INET6:
916 if ((diff = pf_addr_compare(a: &a->lan.addr, b: &b->lan.addr,
917 af: a->af_lan)) != 0) {
918 return diff;
919 }
920
921 if (extfilter < PF_EXTFILTER_EI ||
922 !PF_AZERO(&b->ext_lan.addr, AF_INET6)) {
923 if ((diff = pf_addr_compare(a: &a->ext_lan.addr,
924 b: &b->ext_lan.addr,
925 af: a->af_lan)) != 0) {
926 return diff;
927 }
928 }
929 break;
930 }
931
932 if (a->app_state && b->app_state) {
933 if (a->app_state->compare_lan_ext &&
934 b->app_state->compare_lan_ext) {
935 diff = (const char *)b->app_state->compare_lan_ext -
936 (const char *)a->app_state->compare_lan_ext;
937 if (diff != 0) {
938 return diff;
939 }
940 diff = a->app_state->compare_lan_ext(a->app_state,
941 b->app_state);
942 if (diff != 0) {
943 return diff;
944 }
945 }
946 }
947
948 return 0;
949}
950
951static __inline int
952pf_state_compare_ext_gwy(struct pf_state_key *a, struct pf_state_key *b)
953{
954 int diff;
955 int extfilter;
956 int a_nat64, b_nat64;
957
958 if ((diff = a->proto - b->proto) != 0) {
959 return diff;
960 }
961
962 if ((diff = a->af_gwy - b->af_gwy) != 0) {
963 return diff;
964 }
965
966 a_nat64 = (a->af_lan == PF_INET6 && a->af_gwy == PF_INET) ? 1 : 0;
967 b_nat64 = (b->af_lan == PF_INET6 && b->af_gwy == PF_INET) ? 1 : 0;
968 if ((diff = a_nat64 - b_nat64) != 0) {
969 return diff;
970 }
971
972 extfilter = PF_EXTFILTER_APD;
973
974 switch (a->proto) {
975 case IPPROTO_ICMP:
976 case IPPROTO_ICMPV6:
977 if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0) {
978 return diff;
979 }
980 break;
981
982 case IPPROTO_TCP:
983 if ((diff = a->ext_gwy.xport.port - b->ext_gwy.xport.port) != 0) {
984 return diff;
985 }
986 if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0) {
987 return diff;
988 }
989 break;
990
991 case IPPROTO_UDP:
992 if ((diff = a->proto_variant - b->proto_variant)) {
993 return diff;
994 }
995 extfilter = a->proto_variant;
996 if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0) {
997 return diff;
998 }
999 if ((extfilter < PF_EXTFILTER_AD) &&
1000 (diff = a->ext_gwy.xport.port - b->ext_gwy.xport.port) != 0) {
1001 return diff;
1002 }
1003 break;
1004
1005 case IPPROTO_GRE:
1006 if (a->proto_variant == PF_GRE_PPTP_VARIANT &&
1007 a->proto_variant == b->proto_variant) {
1008 if (!!(diff = a->gwy.xport.call_id -
1009 b->gwy.xport.call_id)) {
1010 return diff;
1011 }
1012 }
1013 break;
1014
1015 case IPPROTO_ESP:
1016 if (!!(diff = a->gwy.xport.spi - b->gwy.xport.spi)) {
1017 return diff;
1018 }
1019 break;
1020
1021 default:
1022 break;
1023 }
1024
1025 switch (a->af_gwy) {
1026#if INET
1027 case AF_INET:
1028 if ((diff = pf_addr_compare(a: &a->gwy.addr, b: &b->gwy.addr,
1029 af: a->af_gwy)) != 0) {
1030 return diff;
1031 }
1032
1033 if (extfilter < PF_EXTFILTER_EI) {
1034 if ((diff = pf_addr_compare(a: &a->ext_gwy.addr, b: &b->ext_gwy.addr,
1035 af: a->af_gwy)) != 0) {
1036 return diff;
1037 }
1038 }
1039 break;
1040#endif /* INET */
1041 case AF_INET6:
1042 if ((diff = pf_addr_compare(a: &a->gwy.addr, b: &b->gwy.addr,
1043 af: a->af_gwy)) != 0) {
1044 return diff;
1045 }
1046
1047 if (extfilter < PF_EXTFILTER_EI ||
1048 !PF_AZERO(&b->ext_gwy.addr, AF_INET6)) {
1049 if ((diff = pf_addr_compare(a: &a->ext_gwy.addr, b: &b->ext_gwy.addr,
1050 af: a->af_gwy)) != 0) {
1051 return diff;
1052 }
1053 }
1054 break;
1055 }
1056
1057 if (a->app_state && b->app_state) {
1058 if (a->app_state->compare_ext_gwy &&
1059 b->app_state->compare_ext_gwy) {
1060 diff = (const char *)b->app_state->compare_ext_gwy -
1061 (const char *)a->app_state->compare_ext_gwy;
1062 if (diff != 0) {
1063 return diff;
1064 }
1065 diff = a->app_state->compare_ext_gwy(a->app_state,
1066 b->app_state);
1067 if (diff != 0) {
1068 return diff;
1069 }
1070 }
1071 }
1072
1073 return 0;
1074}
1075
1076static __inline int
1077pf_state_compare_id(struct pf_state *a, struct pf_state *b)
1078{
1079 if (a->id > b->id) {
1080 return 1;
1081 }
1082 if (a->id < b->id) {
1083 return -1;
1084 }
1085 if (a->creatorid > b->creatorid) {
1086 return 1;
1087 }
1088 if (a->creatorid < b->creatorid) {
1089 return -1;
1090 }
1091
1092 return 0;
1093}
1094
1095void
1096pf_addrcpy(struct pf_addr *dst, struct pf_addr *src, sa_family_t af)
1097{
1098 switch (af) {
1099#if INET
1100 case AF_INET:
1101 dst->addr32[0] = src->addr32[0];
1102 break;
1103#endif /* INET */
1104 case AF_INET6:
1105 dst->addr32[0] = src->addr32[0];
1106 dst->addr32[1] = src->addr32[1];
1107 dst->addr32[2] = src->addr32[2];
1108 dst->addr32[3] = src->addr32[3];
1109 break;
1110 }
1111}
1112
1113struct pf_state *
1114pf_find_state_byid(struct pf_state_cmp *key)
1115{
1116 pf_status.fcounters[FCNT_STATE_SEARCH]++;
1117
1118 return RB_FIND(pf_state_tree_id, &tree_id,
1119 (struct pf_state *)(void *)key);
1120}
1121
1122static struct pf_state *
1123pf_find_state(struct pfi_kif *kif, struct pf_state_key_cmp *key, u_int dir)
1124{
1125 struct pf_state_key *sk = NULL;
1126 struct pf_state *s;
1127
1128 pf_status.fcounters[FCNT_STATE_SEARCH]++;
1129
1130 switch (dir) {
1131 case PF_OUT:
1132 sk = RB_FIND(pf_state_tree_lan_ext, &pf_statetbl_lan_ext,
1133 (struct pf_state_key *)key);
1134
1135 break;
1136 case PF_IN:
1137
1138 /*
1139 * Generally, a packet can match to
1140 * at most 1 state in the GWY table, with the sole exception
1141 * of NAT64, where a packet can match with at most 2 states
1142 * on the GWY table. This is because, unlike NAT44 or NAT66,
1143 * NAT64 forward translation is done on the input, not output.
1144 * This means a forwarded packet could cause PF to generate 2 states
1145 * on both input and output.
1146 *
1147 * NAT64 reverse translation is done on input. If a packet
1148 * matches NAT64 state on the GWY table, prioritize it
1149 * over any IPv4 state on the GWY table.
1150 */
1151 if (pf_state_tree_ext_gwy_nat64_cnt > 0 &&
1152 key->af_lan == PF_INET && key->af_gwy == PF_INET) {
1153 key->af_lan = PF_INET6;
1154 sk = RB_FIND(pf_state_tree_ext_gwy, &pf_statetbl_ext_gwy,
1155 (struct pf_state_key *) key);
1156 key->af_lan = PF_INET;
1157 }
1158
1159 if (sk == NULL) {
1160 sk = RB_FIND(pf_state_tree_ext_gwy, &pf_statetbl_ext_gwy,
1161 (struct pf_state_key *)key);
1162 }
1163 /*
1164 * NAT64 is done only on input, for packets coming in from
1165 * from the LAN side, need to lookup the lan_ext tree.
1166 */
1167 if (sk == NULL) {
1168 sk = RB_FIND(pf_state_tree_lan_ext,
1169 &pf_statetbl_lan_ext,
1170 (struct pf_state_key *)key);
1171 if (sk && sk->af_lan == sk->af_gwy) {
1172 sk = NULL;
1173 }
1174 }
1175 break;
1176 default:
1177 panic("pf_find_state");
1178 }
1179
1180 /* list is sorted, if-bound states before floating ones */
1181 if (sk != NULL) {
1182 TAILQ_FOREACH(s, &sk->states, next)
1183 if (s->kif == pfi_all || s->kif == kif) {
1184 return s;
1185 }
1186 }
1187
1188 return NULL;
1189}
1190
1191struct pf_state *
1192pf_find_state_all(struct pf_state_key_cmp *key, u_int dir, int *more)
1193{
1194 struct pf_state_key *sk = NULL;
1195 struct pf_state *s, *ret = NULL;
1196
1197 pf_status.fcounters[FCNT_STATE_SEARCH]++;
1198
1199 switch (dir) {
1200 case PF_OUT:
1201 sk = RB_FIND(pf_state_tree_lan_ext,
1202 &pf_statetbl_lan_ext, (struct pf_state_key *)key);
1203 break;
1204 case PF_IN:
1205 sk = RB_FIND(pf_state_tree_ext_gwy,
1206 &pf_statetbl_ext_gwy, (struct pf_state_key *)key);
1207 /*
1208 * NAT64 is done only on input, for packets coming in from
1209 * from the LAN side, need to lookup the lan_ext tree.
1210 */
1211 if ((sk == NULL) && pf_nat64_configured) {
1212 sk = RB_FIND(pf_state_tree_lan_ext,
1213 &pf_statetbl_lan_ext,
1214 (struct pf_state_key *)key);
1215 if (sk && sk->af_lan == sk->af_gwy) {
1216 sk = NULL;
1217 }
1218 }
1219 break;
1220 default:
1221 panic("pf_find_state_all");
1222 }
1223
1224 if (sk != NULL) {
1225 ret = TAILQ_FIRST(&sk->states);
1226 if (more == NULL) {
1227 return ret;
1228 }
1229
1230 TAILQ_FOREACH(s, &sk->states, next)
1231 (*more)++;
1232 }
1233
1234 return ret;
1235}
1236
1237static void
1238pf_init_threshold(struct pf_threshold *threshold,
1239 u_int32_t limit, u_int32_t seconds)
1240{
1241 threshold->limit = limit * PF_THRESHOLD_MULT;
1242 threshold->seconds = seconds;
1243 threshold->count = 0;
1244 threshold->last = pf_time_second();
1245}
1246
1247static void
1248pf_add_threshold(struct pf_threshold *threshold)
1249{
1250 u_int32_t t = pf_time_second(), diff = t - threshold->last;
1251
1252 if (diff >= threshold->seconds) {
1253 threshold->count = 0;
1254 } else {
1255 threshold->count -= threshold->count * diff /
1256 threshold->seconds;
1257 }
1258 threshold->count += PF_THRESHOLD_MULT;
1259 threshold->last = t;
1260}
1261
1262static int
1263pf_check_threshold(struct pf_threshold *threshold)
1264{
1265 return threshold->count > threshold->limit;
1266}
1267
1268static int
1269pf_src_connlimit(struct pf_state **state)
1270{
1271 int bad = 0;
1272 (*state)->src_node->conn++;
1273 VERIFY((*state)->src_node->conn != 0);
1274 (*state)->src.tcp_est = 1;
1275 pf_add_threshold(threshold: &(*state)->src_node->conn_rate);
1276
1277 if ((*state)->rule.ptr->max_src_conn &&
1278 (*state)->rule.ptr->max_src_conn <
1279 (*state)->src_node->conn) {
1280 pf_status.lcounters[LCNT_SRCCONN]++;
1281 bad++;
1282 }
1283
1284 if ((*state)->rule.ptr->max_src_conn_rate.limit &&
1285 pf_check_threshold(threshold: &(*state)->src_node->conn_rate)) {
1286 pf_status.lcounters[LCNT_SRCCONNRATE]++;
1287 bad++;
1288 }
1289
1290 if (!bad) {
1291 return 0;
1292 }
1293
1294 if ((*state)->rule.ptr->overload_tbl) {
1295 struct pfr_addr p;
1296 u_int32_t killed = 0;
1297
1298 pf_status.lcounters[LCNT_OVERLOAD_TABLE]++;
1299 if (pf_status.debug >= PF_DEBUG_MISC) {
1300 printf("pf_src_connlimit: blocking address ");
1301 pf_print_host(&(*state)->src_node->addr, 0,
1302 (*state)->state_key->af_lan);
1303 }
1304
1305 bzero(s: &p, n: sizeof(p));
1306 p.pfra_af = (*state)->state_key->af_lan;
1307 switch ((*state)->state_key->af_lan) {
1308#if INET
1309 case AF_INET:
1310 p.pfra_net = 32;
1311 p.pfra_ip4addr = (*state)->src_node->addr.v4addr;
1312 break;
1313#endif /* INET */
1314 case AF_INET6:
1315 p.pfra_net = 128;
1316 p.pfra_ip6addr = (*state)->src_node->addr.v6addr;
1317 break;
1318 }
1319
1320 pfr_insert_kentry((*state)->rule.ptr->overload_tbl,
1321 &p, pf_calendar_time_second());
1322
1323 /* kill existing states if that's required. */
1324 if ((*state)->rule.ptr->flush) {
1325 struct pf_state_key *sk;
1326 struct pf_state *st;
1327
1328 pf_status.lcounters[LCNT_OVERLOAD_FLUSH]++;
1329 RB_FOREACH(st, pf_state_tree_id, &tree_id) {
1330 sk = st->state_key;
1331 /*
1332 * Kill states from this source. (Only those
1333 * from the same rule if PF_FLUSH_GLOBAL is not
1334 * set)
1335 */
1336 if (sk->af_lan ==
1337 (*state)->state_key->af_lan &&
1338 (((*state)->state_key->direction ==
1339 PF_OUT &&
1340 PF_AEQ(&(*state)->src_node->addr,
1341 &sk->lan.addr, sk->af_lan)) ||
1342 ((*state)->state_key->direction == PF_IN &&
1343 PF_AEQ(&(*state)->src_node->addr,
1344 &sk->ext_lan.addr, sk->af_lan))) &&
1345 ((*state)->rule.ptr->flush &
1346 PF_FLUSH_GLOBAL ||
1347 (*state)->rule.ptr == st->rule.ptr)) {
1348 st->timeout = PFTM_PURGE;
1349 st->src.state = st->dst.state =
1350 TCPS_CLOSED;
1351 killed++;
1352 }
1353 }
1354 if (pf_status.debug >= PF_DEBUG_MISC) {
1355 printf(", %u states killed", killed);
1356 }
1357 }
1358 if (pf_status.debug >= PF_DEBUG_MISC) {
1359 printf("\n");
1360 }
1361 }
1362
1363 /* kill this state */
1364 (*state)->timeout = PFTM_PURGE;
1365 (*state)->src.state = (*state)->dst.state = TCPS_CLOSED;
1366 return 1;
1367}
1368
1369int
1370pf_insert_src_node(struct pf_src_node **sn, struct pf_rule *rule,
1371 struct pf_addr *src, sa_family_t af)
1372{
1373 struct pf_src_node k;
1374
1375 if (*sn == NULL) {
1376 k.af = af;
1377 PF_ACPY(&k.addr, src, af);
1378 if (rule->rule_flag & PFRULE_RULESRCTRACK ||
1379 rule->rpool.opts & PF_POOL_STICKYADDR) {
1380 k.rule.ptr = rule;
1381 } else {
1382 k.rule.ptr = NULL;
1383 }
1384 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
1385 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k);
1386 }
1387 if (*sn == NULL) {
1388 if (!rule->max_src_nodes ||
1389 rule->src_nodes < rule->max_src_nodes) {
1390 (*sn) = pool_get(&pf_src_tree_pl, PR_WAITOK);
1391 } else {
1392 pf_status.lcounters[LCNT_SRCNODES]++;
1393 }
1394 if ((*sn) == NULL) {
1395 return -1;
1396 }
1397 bzero(s: *sn, n: sizeof(struct pf_src_node));
1398
1399 pf_init_threshold(threshold: &(*sn)->conn_rate,
1400 limit: rule->max_src_conn_rate.limit,
1401 seconds: rule->max_src_conn_rate.seconds);
1402
1403 (*sn)->af = af;
1404 if (rule->rule_flag & PFRULE_RULESRCTRACK ||
1405 rule->rpool.opts & PF_POOL_STICKYADDR) {
1406 (*sn)->rule.ptr = rule;
1407 } else {
1408 (*sn)->rule.ptr = NULL;
1409 }
1410 PF_ACPY(&(*sn)->addr, src, af);
1411 if (RB_INSERT(pf_src_tree,
1412 &tree_src_tracking, *sn) != NULL) {
1413 if (pf_status.debug >= PF_DEBUG_MISC) {
1414 printf("pf: src_tree insert failed: ");
1415 pf_print_host(&(*sn)->addr, 0, af);
1416 printf("\n");
1417 }
1418 pool_put(&pf_src_tree_pl, *sn);
1419 *sn = NULL; /* signal the caller that no additional cleanup is needed */
1420 return -1;
1421 }
1422 (*sn)->creation = pf_time_second();
1423 (*sn)->ruletype = rule->action;
1424 if ((*sn)->rule.ptr != NULL) {
1425 (*sn)->rule.ptr->src_nodes++;
1426 }
1427 pf_status.scounters[SCNT_SRC_NODE_INSERT]++;
1428 pf_status.src_nodes++;
1429 } else {
1430 if (rule->max_src_states &&
1431 (*sn)->states >= rule->max_src_states) {
1432 pf_status.lcounters[LCNT_SRCSTATES]++;
1433 return -1;
1434 }
1435 }
1436 return 0;
1437}
1438
1439static void
1440pf_stateins_err(const char *tree, struct pf_state *s, struct pfi_kif *kif)
1441{
1442 struct pf_state_key *sk = s->state_key;
1443
1444 if (pf_status.debug >= PF_DEBUG_MISC) {
1445 printf("pf: state insert failed: %s %s ", tree, kif->pfik_name);
1446 switch (sk->proto) {
1447 case IPPROTO_TCP:
1448 printf("TCP");
1449 break;
1450 case IPPROTO_UDP:
1451 printf("UDP");
1452 break;
1453 case IPPROTO_ICMP:
1454 printf("ICMP4");
1455 break;
1456 case IPPROTO_ICMPV6:
1457 printf("ICMP6");
1458 break;
1459 default:
1460 printf("PROTO=%u", sk->proto);
1461 break;
1462 }
1463 printf(" lan: ");
1464 pf_print_sk_host(&sk->lan, sk->af_lan, sk->proto,
1465 sk->proto_variant);
1466 printf(" gwy: ");
1467 pf_print_sk_host(&sk->gwy, sk->af_gwy, sk->proto,
1468 sk->proto_variant);
1469 printf(" ext_lan: ");
1470 pf_print_sk_host(&sk->ext_lan, sk->af_lan, sk->proto,
1471 sk->proto_variant);
1472 printf(" ext_gwy: ");
1473 pf_print_sk_host(&sk->ext_gwy, sk->af_gwy, sk->proto,
1474 sk->proto_variant);
1475 if (s->sync_flags & PFSTATE_FROMSYNC) {
1476 printf(" (from sync)");
1477 }
1478 printf("\n");
1479 }
1480}
1481
1482static __inline struct pf_state_key *
1483pf_insert_state_key_ext_gwy(struct pf_state_key *psk)
1484{
1485 struct pf_state_key * ret = RB_INSERT(pf_state_tree_ext_gwy,
1486 &pf_statetbl_ext_gwy, psk);
1487 if (!ret && psk->af_lan == PF_INET6 &&
1488 psk->af_gwy == PF_INET) {
1489 pf_state_tree_ext_gwy_nat64_cnt++;
1490 }
1491 return ret;
1492}
1493
1494static __inline struct pf_state_key *
1495pf_remove_state_key_ext_gwy(struct pf_state_key *psk)
1496{
1497 struct pf_state_key * ret = RB_REMOVE(pf_state_tree_ext_gwy,
1498 &pf_statetbl_ext_gwy, psk);
1499 if (ret && psk->af_lan == PF_INET6 &&
1500 psk->af_gwy == PF_INET) {
1501 pf_state_tree_ext_gwy_nat64_cnt--;
1502 }
1503 return ret;
1504}
1505
1506int
1507pf_insert_state(struct pfi_kif *kif, struct pf_state *s)
1508{
1509 struct pf_state_key *cur;
1510 struct pf_state *sp;
1511
1512 VERIFY(s->state_key != NULL);
1513 s->kif = kif;
1514
1515 if ((cur = RB_INSERT(pf_state_tree_lan_ext, &pf_statetbl_lan_ext,
1516 s->state_key)) != NULL) {
1517 /* key exists. check for same kif, if none, add to key */
1518 TAILQ_FOREACH(sp, &cur->states, next)
1519 if (sp->kif == kif) { /* collision! */
1520 pf_stateins_err(tree: "tree_lan_ext", s, kif);
1521 pf_detach_state(s,
1522 PF_DT_SKIP_LANEXT | PF_DT_SKIP_EXTGWY);
1523 return -1;
1524 }
1525 pf_detach_state(s, PF_DT_SKIP_LANEXT | PF_DT_SKIP_EXTGWY);
1526 pf_attach_state(cur, s, kif == pfi_all ? 1 : 0);
1527 }
1528
1529 /* if cur != NULL, we already found a state key and attached to it */
1530 if (cur == NULL &&
1531 (cur = pf_insert_state_key_ext_gwy(psk: s->state_key)) != NULL) {
1532 /* must not happen. we must have found the sk above! */
1533 pf_stateins_err(tree: "tree_ext_gwy", s, kif);
1534 pf_detach_state(s, PF_DT_SKIP_EXTGWY);
1535 return -1;
1536 }
1537
1538 if (s->id == 0 && s->creatorid == 0) {
1539 s->id = htobe64(pf_status.stateid++);
1540 s->creatorid = pf_status.hostid;
1541 }
1542 if (RB_INSERT(pf_state_tree_id, &tree_id, s) != NULL) {
1543 if (pf_status.debug >= PF_DEBUG_MISC) {
1544 printf("pf: state insert failed: "
1545 "id: %016llx creatorid: %08x",
1546 be64toh(s->id), ntohl(s->creatorid));
1547 if (s->sync_flags & PFSTATE_FROMSYNC) {
1548 printf(" (from sync)");
1549 }
1550 printf("\n");
1551 }
1552 pf_detach_state(s, 0);
1553 return -1;
1554 }
1555 TAILQ_INSERT_TAIL(&state_list, s, entry_list);
1556 pf_status.fcounters[FCNT_STATE_INSERT]++;
1557 pf_status.states++;
1558 VERIFY(pf_status.states != 0);
1559 pfi_kif_ref(kif, PFI_KIF_REF_STATE);
1560#if NPFSYNC
1561 pfsync_insert_state(s);
1562#endif
1563 return 0;
1564}
1565
1566static int
1567pf_purge_thread_cont(int err)
1568{
1569#pragma unused(err)
1570 static u_int32_t nloops = 0;
1571 int t = 1; /* 1 second */
1572
1573 /*
1574 * Update coarse-grained networking timestamp (in sec.); the idea
1575 * is to piggy-back on the periodic timeout callout to update
1576 * the counter returnable via net_uptime().
1577 */
1578 net_update_uptime();
1579
1580 lck_rw_lock_shared(lck: &pf_perim_lock);
1581 lck_mtx_lock(lck: &pf_lock);
1582
1583 /* purge everything if not running */
1584 if (!pf_status.running) {
1585 pf_purge_expired_states(pf_status.states);
1586 pf_purge_expired_fragments();
1587 pf_purge_expired_src_nodes();
1588
1589 /* terminate thread (we don't currently do this) */
1590 if (pf_purge_thread == NULL) {
1591 lck_mtx_unlock(lck: &pf_lock);
1592 lck_rw_done(lck: &pf_perim_lock);
1593
1594 thread_deallocate(thread: current_thread());
1595 thread_terminate(target_act: current_thread());
1596 /* NOTREACHED */
1597 return 0;
1598 } else {
1599 /* if there's nothing left, sleep w/o timeout */
1600 if (pf_status.states == 0 &&
1601 pf_normalize_isempty() &&
1602 RB_EMPTY(&tree_src_tracking)) {
1603 nloops = 0;
1604 t = 0;
1605 }
1606 goto done;
1607 }
1608 }
1609
1610 /* process a fraction of the state table every second */
1611 pf_purge_expired_states(1 + (pf_status.states
1612 / pf_default_rule.timeout[PFTM_INTERVAL]));
1613
1614 /* purge other expired types every PFTM_INTERVAL seconds */
1615 if (++nloops >= pf_default_rule.timeout[PFTM_INTERVAL]) {
1616 pf_purge_expired_fragments();
1617 pf_purge_expired_src_nodes();
1618 nloops = 0;
1619 }
1620done:
1621 lck_mtx_unlock(lck: &pf_lock);
1622 lck_rw_done(lck: &pf_perim_lock);
1623
1624 (void) tsleep0(chan: pf_purge_thread_fn, PWAIT, wmesg: "pf_purge_cont",
1625 timo: t * hz, continuation: pf_purge_thread_cont);
1626 /* NOTREACHED */
1627 VERIFY(0);
1628
1629 return 0;
1630}
1631
1632void
1633pf_purge_thread_fn(void *v, wait_result_t w)
1634{
1635#pragma unused(v, w)
1636 (void) tsleep0(chan: pf_purge_thread_fn, PWAIT, wmesg: "pf_purge", timo: 0,
1637 continuation: pf_purge_thread_cont);
1638 /*
1639 * tsleep0() shouldn't have returned as PCATCH was not set;
1640 * therefore assert in this case.
1641 */
1642 VERIFY(0);
1643}
1644
1645u_int64_t
1646pf_state_expires(const struct pf_state *state)
1647{
1648 u_int32_t t;
1649 u_int32_t start;
1650 u_int32_t end;
1651 u_int32_t states;
1652
1653 LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED);
1654
1655 /* handle all PFTM_* > PFTM_MAX here */
1656 if (state->timeout == PFTM_PURGE) {
1657 return pf_time_second();
1658 }
1659
1660 VERIFY(state->timeout != PFTM_UNLINKED);
1661 VERIFY(state->timeout < PFTM_MAX);
1662 t = state->rule.ptr->timeout[state->timeout];
1663 if (!t) {
1664 t = pf_default_rule.timeout[state->timeout];
1665 }
1666 start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START];
1667 if (start) {
1668 end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END];
1669 states = state->rule.ptr->states;
1670 } else {
1671 start = pf_default_rule.timeout[PFTM_ADAPTIVE_START];
1672 end = pf_default_rule.timeout[PFTM_ADAPTIVE_END];
1673 states = pf_status.states;
1674 }
1675 if (end && states > start && start < end) {
1676 if (states < end) {
1677 return state->expire + t * (end - states) /
1678 (end - start);
1679 } else {
1680 return pf_time_second();
1681 }
1682 }
1683 return state->expire + t;
1684}
1685
1686void
1687pf_purge_expired_src_nodes(void)
1688{
1689 struct pf_src_node *cur, *next;
1690
1691 LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED);
1692
1693 for (cur = RB_MIN(pf_src_tree, &tree_src_tracking); cur; cur = next) {
1694 next = RB_NEXT(pf_src_tree, &tree_src_tracking, cur);
1695
1696 if (cur->states <= 0 && cur->expire <= pf_time_second()) {
1697 if (cur->rule.ptr != NULL) {
1698 cur->rule.ptr->src_nodes--;
1699 if (cur->rule.ptr->states <= 0 &&
1700 cur->rule.ptr->max_src_nodes <= 0) {
1701 pf_rm_rule(NULL, cur->rule.ptr);
1702 }
1703 }
1704 RB_REMOVE(pf_src_tree, &tree_src_tracking, cur);
1705 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
1706 pf_status.src_nodes--;
1707 pool_put(&pf_src_tree_pl, cur);
1708 }
1709 }
1710}
1711
1712void
1713pf_src_tree_remove_state(struct pf_state *s)
1714{
1715 u_int32_t t;
1716
1717 LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED);
1718
1719 if (s->src_node != NULL) {
1720 if (s->src.tcp_est) {
1721 VERIFY(s->src_node->conn > 0);
1722 --s->src_node->conn;
1723 }
1724 VERIFY(s->src_node->states > 0);
1725 if (--s->src_node->states <= 0) {
1726 t = s->rule.ptr->timeout[PFTM_SRC_NODE];
1727 if (!t) {
1728 t = pf_default_rule.timeout[PFTM_SRC_NODE];
1729 }
1730 s->src_node->expire = pf_time_second() + t;
1731 }
1732 }
1733 if (s->nat_src_node != s->src_node && s->nat_src_node != NULL) {
1734 VERIFY(s->nat_src_node->states > 0);
1735 if (--s->nat_src_node->states <= 0) {
1736 t = s->rule.ptr->timeout[PFTM_SRC_NODE];
1737 if (!t) {
1738 t = pf_default_rule.timeout[PFTM_SRC_NODE];
1739 }
1740 s->nat_src_node->expire = pf_time_second() + t;
1741 }
1742 }
1743 s->src_node = s->nat_src_node = NULL;
1744}
1745
1746void
1747pf_unlink_state(struct pf_state *cur)
1748{
1749 LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED);
1750
1751 if (cur->src.state == PF_TCPS_PROXY_DST) {
1752 pf_send_tcp(cur->rule.ptr, cur->state_key->af_lan,
1753 &cur->state_key->ext_lan.addr, &cur->state_key->lan.addr,
1754 cur->state_key->ext_lan.xport.port,
1755 cur->state_key->lan.xport.port,
1756 cur->src.seqhi, cur->src.seqlo + 1,
1757 TH_RST | TH_ACK, 0, 0, 0, 1, cur->tag, NULL, NULL);
1758 }
1759
1760 hook_runloop(&cur->unlink_hooks, HOOK_REMOVE | HOOK_FREE);
1761 RB_REMOVE(pf_state_tree_id, &tree_id, cur);
1762#if NPFSYNC
1763 if (cur->creatorid == pf_status.hostid) {
1764 pfsync_delete_state(cur);
1765 }
1766#endif
1767 cur->timeout = PFTM_UNLINKED;
1768 pf_src_tree_remove_state(s: cur);
1769 pf_detach_state(cur, 0);
1770}
1771
1772/* callers should be at splpf and hold the
1773 * write_lock on pf_consistency_lock */
1774void
1775pf_free_state(struct pf_state *cur)
1776{
1777 LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED);
1778#if NPFSYNC
1779 if (pfsyncif != NULL &&
1780 (pfsyncif->sc_bulk_send_next == cur ||
1781 pfsyncif->sc_bulk_terminator == cur)) {
1782 return;
1783 }
1784#endif
1785 VERIFY(cur->timeout == PFTM_UNLINKED);
1786 VERIFY(cur->rule.ptr->states > 0);
1787 if (--cur->rule.ptr->states <= 0 &&
1788 cur->rule.ptr->src_nodes <= 0) {
1789 pf_rm_rule(NULL, cur->rule.ptr);
1790 }
1791 if (cur->nat_rule.ptr != NULL) {
1792 VERIFY(cur->nat_rule.ptr->states > 0);
1793 if (--cur->nat_rule.ptr->states <= 0 &&
1794 cur->nat_rule.ptr->src_nodes <= 0) {
1795 pf_rm_rule(NULL, cur->nat_rule.ptr);
1796 }
1797 }
1798 if (cur->anchor.ptr != NULL) {
1799 VERIFY(cur->anchor.ptr->states > 0);
1800 if (--cur->anchor.ptr->states <= 0) {
1801 pf_rm_rule(NULL, cur->anchor.ptr);
1802 }
1803 }
1804 pf_normalize_tcp_cleanup(cur);
1805 pfi_kif_unref(cur->kif, PFI_KIF_REF_STATE);
1806 TAILQ_REMOVE(&state_list, cur, entry_list);
1807 if (cur->tag) {
1808 pf_tag_unref(cur->tag);
1809 }
1810#if SKYWALK
1811 netns_release(token: &cur->nstoken);
1812#endif
1813 pool_put(&pf_state_pl, cur);
1814 pf_status.fcounters[FCNT_STATE_REMOVALS]++;
1815 VERIFY(pf_status.states > 0);
1816 pf_status.states--;
1817}
1818
1819void
1820pf_purge_expired_states(u_int32_t maxcheck)
1821{
1822 static struct pf_state *cur = NULL;
1823 struct pf_state *next;
1824
1825 LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED);
1826
1827 while (maxcheck--) {
1828 /* wrap to start of list when we hit the end */
1829 if (cur == NULL) {
1830 cur = TAILQ_FIRST(&state_list);
1831 if (cur == NULL) {
1832 break; /* list empty */
1833 }
1834 }
1835
1836 /* get next state, as cur may get deleted */
1837 next = TAILQ_NEXT(cur, entry_list);
1838
1839 if (cur->timeout == PFTM_UNLINKED) {
1840 pf_free_state(cur);
1841 } else if (pf_state_expires(state: cur) <= pf_time_second()) {
1842 /* unlink and free expired state */
1843 pf_unlink_state(cur);
1844 pf_free_state(cur);
1845 }
1846 cur = next;
1847 }
1848}
1849
1850int
1851pf_tbladdr_setup(struct pf_ruleset *rs, struct pf_addr_wrap *aw)
1852{
1853 LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED);
1854
1855 if (aw->type != PF_ADDR_TABLE) {
1856 return 0;
1857 }
1858 if ((aw->p.tbl = pfr_attach_table(rs, aw->v.tblname)) == NULL) {
1859 return 1;
1860 }
1861 return 0;
1862}
1863
1864void
1865pf_tbladdr_remove(struct pf_addr_wrap *aw)
1866{
1867 LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED);
1868
1869 if (aw->type != PF_ADDR_TABLE || aw->p.tbl == NULL) {
1870 return;
1871 }
1872 pfr_detach_table(aw->p.tbl);
1873 aw->p.tbl = NULL;
1874}
1875
1876void
1877pf_tbladdr_copyout(struct pf_addr_wrap *aw)
1878{
1879 struct pfr_ktable *kt = aw->p.tbl;
1880
1881 LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED);
1882
1883 if (aw->type != PF_ADDR_TABLE || kt == NULL) {
1884 return;
1885 }
1886 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) {
1887 kt = kt->pfrkt_root;
1888 }
1889 aw->p.tbl = NULL;
1890 aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ?
1891 kt->pfrkt_cnt : -1;
1892}
1893
1894static void
1895pf_print_addr(struct pf_addr *addr, sa_family_t af)
1896{
1897 switch (af) {
1898#if INET
1899 case AF_INET: {
1900 u_int32_t a = ntohl(addr->addr32[0]);
1901 printf("%u.%u.%u.%u", (a >> 24) & 255, (a >> 16) & 255,
1902 (a >> 8) & 255, a & 255);
1903 break;
1904 }
1905#endif /* INET */
1906 case AF_INET6: {
1907 u_int16_t b;
1908 u_int8_t i, curstart = 255, curend = 0,
1909 maxstart = 0, maxend = 0;
1910 for (i = 0; i < 8; i++) {
1911 if (!addr->addr16[i]) {
1912 if (curstart == 255) {
1913 curstart = i;
1914 } else {
1915 curend = i;
1916 }
1917 } else {
1918 if (curstart) {
1919 if ((curend - curstart) >
1920 (maxend - maxstart)) {
1921 maxstart = curstart;
1922 maxend = curend;
1923 curstart = 255;
1924 }
1925 }
1926 }
1927 }
1928 for (i = 0; i < 8; i++) {
1929 if (i >= maxstart && i <= maxend) {
1930 if (maxend != 7) {
1931 if (i == maxstart) {
1932 printf(":");
1933 }
1934 } else {
1935 if (i == maxend) {
1936 printf(":");
1937 }
1938 }
1939 } else {
1940 b = ntohs(addr->addr16[i]);
1941 printf("%x", b);
1942 if (i < 7) {
1943 printf(":");
1944 }
1945 }
1946 }
1947 break;
1948 }
1949 }
1950}
1951
1952static void
1953pf_print_sk_host(struct pf_state_host *sh, sa_family_t af, int proto,
1954 u_int8_t proto_variant)
1955{
1956 pf_print_addr(addr: &sh->addr, af);
1957
1958 switch (proto) {
1959 case IPPROTO_ESP:
1960 if (sh->xport.spi) {
1961 printf("[%08x]", ntohl(sh->xport.spi));
1962 }
1963 break;
1964
1965 case IPPROTO_GRE:
1966 if (proto_variant == PF_GRE_PPTP_VARIANT) {
1967 printf("[%u]", ntohs(sh->xport.call_id));
1968 }
1969 break;
1970
1971 case IPPROTO_TCP:
1972 case IPPROTO_UDP:
1973 printf("[%u]", ntohs(sh->xport.port));
1974 break;
1975
1976 default:
1977 break;
1978 }
1979}
1980
1981static void
1982pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af)
1983{
1984 pf_print_addr(addr, af);
1985 if (p) {
1986 printf("[%u]", ntohs(p));
1987 }
1988}
1989
1990void
1991pf_print_state(struct pf_state *s)
1992{
1993 struct pf_state_key *sk = s->state_key;
1994 switch (sk->proto) {
1995 case IPPROTO_ESP:
1996 printf("ESP ");
1997 break;
1998 case IPPROTO_GRE:
1999 printf("GRE%u ", sk->proto_variant);
2000 break;
2001 case IPPROTO_TCP:
2002 printf("TCP ");
2003 break;
2004 case IPPROTO_UDP:
2005 printf("UDP ");
2006 break;
2007 case IPPROTO_ICMP:
2008 printf("ICMP ");
2009 break;
2010 case IPPROTO_ICMPV6:
2011 printf("ICMPV6 ");
2012 break;
2013 default:
2014 printf("%u ", sk->proto);
2015 break;
2016 }
2017 pf_print_sk_host(sh: &sk->lan, af: sk->af_lan, proto: sk->proto, proto_variant: sk->proto_variant);
2018 printf(" ");
2019 pf_print_sk_host(sh: &sk->gwy, af: sk->af_gwy, proto: sk->proto, proto_variant: sk->proto_variant);
2020 printf(" ");
2021 pf_print_sk_host(sh: &sk->ext_lan, af: sk->af_lan, proto: sk->proto,
2022 proto_variant: sk->proto_variant);
2023 printf(" ");
2024 pf_print_sk_host(sh: &sk->ext_gwy, af: sk->af_gwy, proto: sk->proto,
2025 proto_variant: sk->proto_variant);
2026 printf(" [lo=%u high=%u win=%u modulator=%u", s->src.seqlo,
2027 s->src.seqhi, s->src.max_win, s->src.seqdiff);
2028 if (s->src.wscale && s->dst.wscale) {
2029 printf(" wscale=%u", s->src.wscale & PF_WSCALE_MASK);
2030 }
2031 printf("]");
2032 printf(" [lo=%u high=%u win=%u modulator=%u", s->dst.seqlo,
2033 s->dst.seqhi, s->dst.max_win, s->dst.seqdiff);
2034 if (s->src.wscale && s->dst.wscale) {
2035 printf(" wscale=%u", s->dst.wscale & PF_WSCALE_MASK);
2036 }
2037 printf("]");
2038 printf(" %u:%u", s->src.state, s->dst.state);
2039}
2040
2041void
2042pf_print_flags(u_int8_t f)
2043{
2044 if (f) {
2045 printf(" ");
2046 }
2047 if (f & TH_FIN) {
2048 printf("F");
2049 }
2050 if (f & TH_SYN) {
2051 printf("S");
2052 }
2053 if (f & TH_RST) {
2054 printf("R");
2055 }
2056 if (f & TH_PUSH) {
2057 printf("P");
2058 }
2059 if (f & TH_ACK) {
2060 printf("A");
2061 }
2062 if (f & TH_URG) {
2063 printf("U");
2064 }
2065 if (f & TH_ECE) {
2066 printf("E");
2067 }
2068 if (f & TH_CWR) {
2069 printf("W");
2070 }
2071}
2072
2073#define PF_SET_SKIP_STEPS(i) \
2074 do { \
2075 while (head[i] != cur) { \
2076 head[i]->skip[i].ptr = cur; \
2077 head[i] = TAILQ_NEXT(head[i], entries); \
2078 } \
2079 } while (0)
2080
2081void
2082pf_calc_skip_steps(struct pf_rulequeue *rules)
2083{
2084 struct pf_rule *cur, *prev, *head[PF_SKIP_COUNT];
2085 int i;
2086
2087 cur = TAILQ_FIRST(rules);
2088 prev = cur;
2089 for (i = 0; i < PF_SKIP_COUNT; ++i) {
2090 head[i] = cur;
2091 }
2092 while (cur != NULL) {
2093 if (cur->kif != prev->kif || cur->ifnot != prev->ifnot) {
2094 PF_SET_SKIP_STEPS(PF_SKIP_IFP);
2095 }
2096 if (cur->direction != prev->direction) {
2097 PF_SET_SKIP_STEPS(PF_SKIP_DIR);
2098 }
2099 if (cur->af != prev->af) {
2100 PF_SET_SKIP_STEPS(PF_SKIP_AF);
2101 }
2102 if (cur->proto != prev->proto) {
2103 PF_SET_SKIP_STEPS(PF_SKIP_PROTO);
2104 }
2105 if (cur->src.neg != prev->src.neg ||
2106 pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr)) {
2107 PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR);
2108 }
2109 {
2110 union pf_rule_xport *cx = &cur->src.xport;
2111 union pf_rule_xport *px = &prev->src.xport;
2112
2113 switch (cur->proto) {
2114 case IPPROTO_GRE:
2115 case IPPROTO_ESP:
2116 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT);
2117 break;
2118 default:
2119 if (prev->proto == IPPROTO_GRE ||
2120 prev->proto == IPPROTO_ESP ||
2121 cx->range.op != px->range.op ||
2122 cx->range.port[0] != px->range.port[0] ||
2123 cx->range.port[1] != px->range.port[1]) {
2124 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT);
2125 }
2126 break;
2127 }
2128 }
2129 if (cur->dst.neg != prev->dst.neg ||
2130 pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr)) {
2131 PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR);
2132 }
2133 {
2134 union pf_rule_xport *cx = &cur->dst.xport;
2135 union pf_rule_xport *px = &prev->dst.xport;
2136
2137 switch (cur->proto) {
2138 case IPPROTO_GRE:
2139 if (cur->proto != prev->proto ||
2140 cx->call_id != px->call_id) {
2141 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
2142 }
2143 break;
2144 case IPPROTO_ESP:
2145 if (cur->proto != prev->proto ||
2146 cx->spi != px->spi) {
2147 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
2148 }
2149 break;
2150 default:
2151 if (prev->proto == IPPROTO_GRE ||
2152 prev->proto == IPPROTO_ESP ||
2153 cx->range.op != px->range.op ||
2154 cx->range.port[0] != px->range.port[0] ||
2155 cx->range.port[1] != px->range.port[1]) {
2156 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
2157 }
2158 break;
2159 }
2160 }
2161
2162 prev = cur;
2163 cur = TAILQ_NEXT(cur, entries);
2164 }
2165 for (i = 0; i < PF_SKIP_COUNT; ++i) {
2166 PF_SET_SKIP_STEPS(i);
2167 }
2168}
2169
2170u_int32_t
2171pf_calc_state_key_flowhash(struct pf_state_key *sk)
2172{
2173#if SKYWALK
2174 uint32_t flowid;
2175 struct flowidns_flow_key fk;
2176
2177 VERIFY(sk->flowsrc == FLOWSRC_PF);
2178 bzero(s: &fk, n: sizeof(fk));
2179 _CASSERT(sizeof(sk->lan.addr) == sizeof(fk.ffk_laddr));
2180 _CASSERT(sizeof(sk->ext_lan.addr) == sizeof(fk.ffk_laddr));
2181 bcopy(src: &sk->lan.addr, dst: &fk.ffk_laddr, n: sizeof(fk.ffk_laddr));
2182 bcopy(src: &sk->ext_lan.addr, dst: &fk.ffk_raddr, n: sizeof(fk.ffk_raddr));
2183 fk.ffk_af = sk->af_lan;
2184 fk.ffk_proto = sk->proto;
2185
2186 switch (sk->proto) {
2187 case IPPROTO_ESP:
2188 case IPPROTO_AH:
2189 fk.ffk_spi = sk->lan.xport.spi;
2190 break;
2191 default:
2192 if (sk->lan.xport.spi <= sk->ext_lan.xport.spi) {
2193 fk.ffk_lport = sk->lan.xport.port;
2194 fk.ffk_rport = sk->ext_lan.xport.port;
2195 } else {
2196 fk.ffk_lport = sk->ext_lan.xport.port;
2197 fk.ffk_rport = sk->lan.xport.port;
2198 }
2199 break;
2200 }
2201
2202 flowidns_allocate_flowid(domain: FLOWIDNS_DOMAIN_PF, flow_key: &fk, flowid: &flowid);
2203 return flowid;
2204
2205#else /* !SKYWALK */
2206
2207 struct pf_flowhash_key fh __attribute__((aligned(8)));
2208 uint32_t flowhash = 0;
2209
2210 bzero(&fh, sizeof(fh));
2211 if (PF_ALEQ(&sk->lan.addr, &sk->ext_lan.addr, sk->af_lan)) {
2212 bcopy(&sk->lan.addr, &fh.ap1.addr, sizeof(fh.ap1.addr));
2213 bcopy(&sk->ext_lan.addr, &fh.ap2.addr, sizeof(fh.ap2.addr));
2214 } else {
2215 bcopy(&sk->ext_lan.addr, &fh.ap1.addr, sizeof(fh.ap1.addr));
2216 bcopy(&sk->lan.addr, &fh.ap2.addr, sizeof(fh.ap2.addr));
2217 }
2218 if (sk->lan.xport.spi <= sk->ext_lan.xport.spi) {
2219 fh.ap1.xport.spi = sk->lan.xport.spi;
2220 fh.ap2.xport.spi = sk->ext_lan.xport.spi;
2221 } else {
2222 fh.ap1.xport.spi = sk->ext_lan.xport.spi;
2223 fh.ap2.xport.spi = sk->lan.xport.spi;
2224 }
2225 fh.af = sk->af_lan;
2226 fh.proto = sk->proto;
2227
2228try_again:
2229 flowhash = net_flowhash(&fh, sizeof(fh), pf_hash_seed);
2230 if (flowhash == 0) {
2231 /* try to get a non-zero flowhash */
2232 pf_hash_seed = RandomULong();
2233 goto try_again;
2234 }
2235
2236 return flowhash;
2237
2238#endif /* !SKYWALK */
2239}
2240
2241static int
2242pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2)
2243{
2244 if (aw1->type != aw2->type) {
2245 return 1;
2246 }
2247 switch (aw1->type) {
2248 case PF_ADDR_ADDRMASK:
2249 case PF_ADDR_RANGE:
2250 if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, AF_INET6)) {
2251 return 1;
2252 }
2253 if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, AF_INET6)) {
2254 return 1;
2255 }
2256 return 0;
2257 case PF_ADDR_DYNIFTL:
2258 return aw1->p.dyn == NULL || aw2->p.dyn == NULL ||
2259 aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt;
2260 case PF_ADDR_NOROUTE:
2261 case PF_ADDR_URPFFAILED:
2262 return 0;
2263 case PF_ADDR_TABLE:
2264 return aw1->p.tbl != aw2->p.tbl;
2265 case PF_ADDR_RTLABEL:
2266 return aw1->v.rtlabel != aw2->v.rtlabel;
2267 default:
2268 printf("invalid address type: %d\n", aw1->type);
2269 return 1;
2270 }
2271}
2272
2273u_int16_t
2274pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp)
2275{
2276 return nat464_cksum_fixup(cksum, old, new, udp);
2277}
2278
2279/*
2280 * change ip address & port
2281 * dir : packet direction
2282 * a : address to be changed
2283 * p : port to be changed
2284 * ic : ip header checksum
2285 * pc : protocol checksum
2286 * an : new ip address
2287 * pn : new port
2288 * u : should be 1 if UDP packet else 0
2289 * af : address family of the packet
2290 * afn : address family of the new address
2291 * ua : should be 1 if ip address needs to be updated in the packet else
2292 * only the checksum is recalculated & updated.
2293 */
2294static __attribute__((noinline)) void
2295pf_change_ap(int dir, pbuf_t *pbuf, struct pf_addr *a, u_int16_t *p,
2296 u_int16_t *ic, u_int16_t *pc, struct pf_addr *an, u_int16_t pn,
2297 u_int8_t u, sa_family_t af, sa_family_t afn, int ua)
2298{
2299 struct pf_addr ao;
2300 u_int16_t po = *p;
2301
2302 PF_ACPY(&ao, a, af);
2303 if (ua) {
2304 PF_ACPY(a, an, afn);
2305 }
2306
2307 *p = pn;
2308
2309 switch (af) {
2310#if INET
2311 case AF_INET:
2312 switch (afn) {
2313 case AF_INET:
2314 *ic = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *ic,
2315 old: ao.addr16[0], new: an->addr16[0], udp: 0),
2316 old: ao.addr16[1], new: an->addr16[1], udp: 0);
2317 *p = pn;
2318 /*
2319 * If the packet is originated from an ALG on the NAT gateway
2320 * (source address is loopback or local), in which case the
2321 * TCP/UDP checksum field contains the pseudo header checksum
2322 * that's not yet complemented.
2323 * In that case we do not need to fixup the checksum for port
2324 * translation as the pseudo header checksum doesn't include ports.
2325 *
2326 * A packet generated locally will have UDP/TCP CSUM flag
2327 * set (gets set in protocol output).
2328 *
2329 * It should be noted that the fixup doesn't do anything if the
2330 * checksum is 0.
2331 */
2332 if (dir == PF_OUT && pbuf != NULL &&
2333 (*pbuf->pb_csum_flags & (CSUM_TCP | CSUM_UDP))) {
2334 /* Pseudo-header checksum does not include ports */
2335 *pc = ~pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: ~*pc,
2336 old: ao.addr16[0], new: an->addr16[0], udp: u),
2337 old: ao.addr16[1], new: an->addr16[1], udp: u);
2338 } else {
2339 *pc =
2340 pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2341 cksum: *pc, old: ao.addr16[0], new: an->addr16[0], udp: u),
2342 old: ao.addr16[1], new: an->addr16[1], udp: u),
2343 old: po, new: pn, udp: u);
2344 }
2345 break;
2346 case AF_INET6:
2347 *p = pn;
2348 *pc = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2349 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2350
2351 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *pc,
2352 old: ao.addr16[0], new: an->addr16[0], udp: u),
2353 old: ao.addr16[1], new: an->addr16[1], udp: u),
2354 old: 0, new: an->addr16[2], udp: u),
2355 old: 0, new: an->addr16[3], udp: u),
2356 old: 0, new: an->addr16[4], udp: u),
2357 old: 0, new: an->addr16[5], udp: u),
2358 old: 0, new: an->addr16[6], udp: u),
2359 old: 0, new: an->addr16[7], udp: u),
2360 old: po, new: pn, udp: u);
2361 break;
2362 }
2363 break;
2364#endif /* INET */
2365 case AF_INET6:
2366 switch (afn) {
2367 case AF_INET6:
2368 /*
2369 * If the packet is originated from an ALG on the NAT gateway
2370 * (source address is loopback or local), in which case the
2371 * TCP/UDP checksum field contains the pseudo header checksum
2372 * that's not yet complemented.
2373 * A packet generated locally
2374 * will have UDP/TCP CSUM flag set (gets set in protocol
2375 * output).
2376 */
2377 if (dir == PF_OUT && pbuf != NULL &&
2378 (*pbuf->pb_csum_flags & (CSUM_TCPIPV6 |
2379 CSUM_UDPIPV6))) {
2380 /* Pseudo-header checksum does not include ports */
2381 *pc =
2382 ~pf_cksum_fixup(cksum: pf_cksum_fixup(
2383 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2384 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2385 cksum: ~*pc,
2386 old: ao.addr16[0], new: an->addr16[0], udp: u),
2387 old: ao.addr16[1], new: an->addr16[1], udp: u),
2388 old: ao.addr16[2], new: an->addr16[2], udp: u),
2389 old: ao.addr16[3], new: an->addr16[3], udp: u),
2390 old: ao.addr16[4], new: an->addr16[4], udp: u),
2391 old: ao.addr16[5], new: an->addr16[5], udp: u),
2392 old: ao.addr16[6], new: an->addr16[6], udp: u),
2393 old: ao.addr16[7], new: an->addr16[7], udp: u);
2394 } else {
2395 *pc =
2396 pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2397 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2398 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2399 cksum: *pc,
2400 old: ao.addr16[0], new: an->addr16[0], udp: u),
2401 old: ao.addr16[1], new: an->addr16[1], udp: u),
2402 old: ao.addr16[2], new: an->addr16[2], udp: u),
2403 old: ao.addr16[3], new: an->addr16[3], udp: u),
2404 old: ao.addr16[4], new: an->addr16[4], udp: u),
2405 old: ao.addr16[5], new: an->addr16[5], udp: u),
2406 old: ao.addr16[6], new: an->addr16[6], udp: u),
2407 old: ao.addr16[7], new: an->addr16[7], udp: u),
2408 old: po, new: pn, udp: u);
2409 }
2410 break;
2411#ifdef INET
2412 case AF_INET:
2413 *pc = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2414 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2415 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *pc,
2416 old: ao.addr16[0], new: an->addr16[0], udp: u),
2417 old: ao.addr16[1], new: an->addr16[1], udp: u),
2418 old: ao.addr16[2], new: 0, udp: u),
2419 old: ao.addr16[3], new: 0, udp: u),
2420 old: ao.addr16[4], new: 0, udp: u),
2421 old: ao.addr16[5], new: 0, udp: u),
2422 old: ao.addr16[6], new: 0, udp: u),
2423 old: ao.addr16[7], new: 0, udp: u),
2424 old: po, new: pn, udp: u);
2425 break;
2426#endif /* INET */
2427 }
2428 break;
2429 }
2430}
2431
2432
2433/* Changes a u_int32_t. Uses a void * so there are no align restrictions */
2434void
2435pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u)
2436{
2437 u_int32_t ao;
2438
2439 memcpy(dst: &ao, src: a, n: sizeof(ao));
2440 memcpy(dst: a, src: &an, n: sizeof(u_int32_t));
2441 *c = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *c, old: ao / 65536, new: an / 65536, udp: u),
2442 old: ao % 65536, new: an % 65536, udp: u);
2443}
2444
2445static __attribute__((noinline)) void
2446pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u)
2447{
2448 struct pf_addr ao;
2449
2450 PF_ACPY(&ao, a, AF_INET6);
2451 PF_ACPY(a, an, AF_INET6);
2452
2453 *c = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2454 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2455 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *c,
2456 old: ao.addr16[0], new: an->addr16[0], udp: u),
2457 old: ao.addr16[1], new: an->addr16[1], udp: u),
2458 old: ao.addr16[2], new: an->addr16[2], udp: u),
2459 old: ao.addr16[3], new: an->addr16[3], udp: u),
2460 old: ao.addr16[4], new: an->addr16[4], udp: u),
2461 old: ao.addr16[5], new: an->addr16[5], udp: u),
2462 old: ao.addr16[6], new: an->addr16[6], udp: u),
2463 old: ao.addr16[7], new: an->addr16[7], udp: u);
2464}
2465
2466static __attribute__((noinline)) void
2467pf_change_addr(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u,
2468 sa_family_t af, sa_family_t afn)
2469{
2470 struct pf_addr ao;
2471
2472 if (af != afn) {
2473 PF_ACPY(&ao, a, af);
2474 PF_ACPY(a, an, afn);
2475 }
2476
2477 switch (af) {
2478 case AF_INET:
2479 switch (afn) {
2480 case AF_INET:
2481 pf_change_a(a, c, an: an->v4addr.s_addr, u);
2482 break;
2483 case AF_INET6:
2484 *c = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2485 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2486 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *c,
2487 old: ao.addr16[0], new: an->addr16[0], udp: u),
2488 old: ao.addr16[1], new: an->addr16[1], udp: u),
2489 old: 0, new: an->addr16[2], udp: u),
2490 old: 0, new: an->addr16[3], udp: u),
2491 old: 0, new: an->addr16[4], udp: u),
2492 old: 0, new: an->addr16[5], udp: u),
2493 old: 0, new: an->addr16[6], udp: u),
2494 old: 0, new: an->addr16[7], udp: u);
2495 break;
2496 }
2497 break;
2498 case AF_INET6:
2499 switch (afn) {
2500 case AF_INET:
2501 *c = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2502 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2503 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *c,
2504 old: ao.addr16[0], new: an->addr16[0], udp: u),
2505 old: ao.addr16[1], new: an->addr16[1], udp: u),
2506 old: ao.addr16[2], new: 0, udp: u),
2507 old: ao.addr16[3], new: 0, udp: u),
2508 old: ao.addr16[4], new: 0, udp: u),
2509 old: ao.addr16[5], new: 0, udp: u),
2510 old: ao.addr16[6], new: 0, udp: u),
2511 old: ao.addr16[7], new: 0, udp: u);
2512 break;
2513 case AF_INET6:
2514 pf_change_a6(a, c, an, u);
2515 break;
2516 }
2517 break;
2518 }
2519}
2520
2521static __attribute__((noinline)) void
2522pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa,
2523 struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c,
2524 u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af)
2525{
2526 struct pf_addr oia, ooa;
2527
2528 PF_ACPY(&oia, ia, af);
2529 PF_ACPY(&ooa, oa, af);
2530
2531 /* Change inner protocol port, fix inner protocol checksum. */
2532 if (ip != NULL) {
2533 u_int16_t oip = *ip;
2534 u_int32_t opc = 0;
2535
2536 if (pc != NULL) {
2537 opc = *pc;
2538 }
2539 *ip = np;
2540 if (pc != NULL) {
2541 *pc = pf_cksum_fixup(cksum: *pc, old: oip, new: *ip, udp: u);
2542 }
2543 *ic = pf_cksum_fixup(cksum: *ic, old: oip, new: *ip, udp: 0);
2544 if (pc != NULL) {
2545 *ic = pf_cksum_fixup(cksum: *ic, old: opc, new: *pc, udp: 0);
2546 }
2547 }
2548 /* Change inner ip address, fix inner ip and icmp checksums. */
2549 PF_ACPY(ia, na, af);
2550 switch (af) {
2551#if INET
2552 case AF_INET: {
2553 u_int32_t oh2c = *h2c;
2554
2555 *h2c = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *h2c,
2556 old: oia.addr16[0], new: ia->addr16[0], udp: 0),
2557 old: oia.addr16[1], new: ia->addr16[1], udp: 0);
2558 *ic = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *ic,
2559 old: oia.addr16[0], new: ia->addr16[0], udp: 0),
2560 old: oia.addr16[1], new: ia->addr16[1], udp: 0);
2561 *ic = pf_cksum_fixup(cksum: *ic, old: oh2c, new: *h2c, udp: 0);
2562 break;
2563 }
2564#endif /* INET */
2565 case AF_INET6:
2566 *ic = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2567 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2568 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *ic,
2569 old: oia.addr16[0], new: ia->addr16[0], udp: u),
2570 old: oia.addr16[1], new: ia->addr16[1], udp: u),
2571 old: oia.addr16[2], new: ia->addr16[2], udp: u),
2572 old: oia.addr16[3], new: ia->addr16[3], udp: u),
2573 old: oia.addr16[4], new: ia->addr16[4], udp: u),
2574 old: oia.addr16[5], new: ia->addr16[5], udp: u),
2575 old: oia.addr16[6], new: ia->addr16[6], udp: u),
2576 old: oia.addr16[7], new: ia->addr16[7], udp: u);
2577 break;
2578 }
2579 /* Change outer ip address, fix outer ip or icmpv6 checksum. */
2580 PF_ACPY(oa, na, af);
2581 switch (af) {
2582#if INET
2583 case AF_INET:
2584 *hc = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *hc,
2585 old: ooa.addr16[0], new: oa->addr16[0], udp: 0),
2586 old: ooa.addr16[1], new: oa->addr16[1], udp: 0);
2587 break;
2588#endif /* INET */
2589 case AF_INET6:
2590 *ic = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2591 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(
2592 cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *ic,
2593 old: ooa.addr16[0], new: oa->addr16[0], udp: u),
2594 old: ooa.addr16[1], new: oa->addr16[1], udp: u),
2595 old: ooa.addr16[2], new: oa->addr16[2], udp: u),
2596 old: ooa.addr16[3], new: oa->addr16[3], udp: u),
2597 old: ooa.addr16[4], new: oa->addr16[4], udp: u),
2598 old: ooa.addr16[5], new: oa->addr16[5], udp: u),
2599 old: ooa.addr16[6], new: oa->addr16[6], udp: u),
2600 old: ooa.addr16[7], new: oa->addr16[7], udp: u);
2601 break;
2602 }
2603}
2604
2605
2606/*
2607 * Need to modulate the sequence numbers in the TCP SACK option
2608 * (credits to Krzysztof Pfaff for report and patch)
2609 */
2610static __attribute__((noinline)) int
2611pf_modulate_sack(pbuf_t *pbuf, int off, struct pf_pdesc *pd,
2612 struct tcphdr *th, struct pf_state_peer *dst)
2613{
2614 int hlen = (th->th_off << 2) - sizeof(*th), thoptlen = hlen;
2615 u_int8_t opts[MAX_TCPOPTLEN], *opt = opts;
2616 int copyback = 0, i, olen;
2617 struct sackblk sack;
2618
2619#define TCPOLEN_SACKLEN (TCPOLEN_SACK + 2)
2620 if (hlen < TCPOLEN_SACKLEN ||
2621 !pf_pull_hdr(pbuf, off + sizeof(*th), opts, hlen, NULL, NULL, pd->af)) {
2622 return 0;
2623 }
2624
2625 while (hlen >= TCPOLEN_SACKLEN) {
2626 olen = opt[1];
2627 switch (*opt) {
2628 case TCPOPT_EOL: /* FALLTHROUGH */
2629 case TCPOPT_NOP:
2630 opt++;
2631 hlen--;
2632 break;
2633 case TCPOPT_SACK:
2634 if (olen > hlen) {
2635 olen = hlen;
2636 }
2637 if (olen >= TCPOLEN_SACKLEN) {
2638 for (i = 2; i + TCPOLEN_SACK <= olen;
2639 i += TCPOLEN_SACK) {
2640 memcpy(dst: &sack, src: &opt[i], n: sizeof(sack));
2641 pf_change_a(a: &sack.start, c: &th->th_sum,
2642 htonl(ntohl(sack.start) -
2643 dst->seqdiff), u: 0);
2644 pf_change_a(a: &sack.end, c: &th->th_sum,
2645 htonl(ntohl(sack.end) -
2646 dst->seqdiff), u: 0);
2647 memcpy(dst: &opt[i], src: &sack, n: sizeof(sack));
2648 }
2649 copyback = off + sizeof(*th) + thoptlen;
2650 }
2651 OS_FALLTHROUGH;
2652 default:
2653 if (olen < 2) {
2654 olen = 2;
2655 }
2656 hlen -= olen;
2657 opt += olen;
2658 }
2659 }
2660
2661 if (copyback) {
2662 if (pf_lazy_makewritable(pd, pbuf, len: copyback) == NULL) {
2663 return -1;
2664 }
2665 pbuf_copy_back(pbuf, off + sizeof(*th), thoptlen, opts);
2666 }
2667 return copyback;
2668}
2669
2670/*
2671 * XXX
2672 *
2673 * The following functions (pf_send_tcp and pf_send_icmp) are somewhat
2674 * special in that they originate "spurious" packets rather than
2675 * filter/NAT existing packets. As such, they're not a great fit for
2676 * the 'pbuf' shim, which assumes the underlying packet buffers are
2677 * allocated elsewhere.
2678 *
2679 * Since these functions are rarely used, we'll carry on allocating mbufs
2680 * and passing them to the IP stack for eventual routing.
2681 */
2682static __attribute__((noinline)) void
2683pf_send_tcp(const struct pf_rule *r, sa_family_t af,
2684 const struct pf_addr *saddr, const struct pf_addr *daddr,
2685 u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack,
2686 u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl, int tag,
2687 u_int16_t rtag, struct ether_header *eh, struct ifnet *ifp)
2688{
2689#pragma unused(eh, ifp)
2690 struct mbuf *m;
2691 int len, tlen;
2692#if INET
2693 struct ip *h = NULL;
2694#endif /* INET */
2695 struct ip6_hdr *h6 = NULL;
2696 struct tcphdr *th = NULL;
2697 char *opt;
2698 struct pf_mtag *pf_mtag;
2699
2700 /* maximum segment size tcp option */
2701 tlen = sizeof(struct tcphdr);
2702 if (mss) {
2703 tlen += 4;
2704 }
2705
2706 switch (af) {
2707#if INET
2708 case AF_INET:
2709 len = sizeof(struct ip) + tlen;
2710 break;
2711#endif /* INET */
2712 case AF_INET6:
2713 len = sizeof(struct ip6_hdr) + tlen;
2714 break;
2715 default:
2716 panic("pf_send_tcp: not AF_INET or AF_INET6!");
2717 return;
2718 }
2719
2720 /* create outgoing mbuf */
2721 m = m_gethdr(M_DONTWAIT, MT_HEADER);
2722 if (m == NULL) {
2723 return;
2724 }
2725
2726 if ((pf_mtag = pf_get_mtag(m)) == NULL) {
2727 return;
2728 }
2729
2730 if (tag) {
2731 pf_mtag->pftag_flags |= PF_TAG_GENERATED;
2732 }
2733 pf_mtag->pftag_tag = rtag;
2734
2735 if (r != NULL && PF_RTABLEID_IS_VALID(r->rtableid)) {
2736 pf_mtag->pftag_rtableid = r->rtableid;
2737 }
2738
2739#if PF_ECN
2740 /* add hints for ecn */
2741 pf_mtag->pftag_hdr = mtod(m, struct ip *);
2742 /* record address family */
2743 pf_mtag->pftag_flags &= ~(PF_TAG_HDR_INET | PF_TAG_HDR_INET6);
2744 switch (af) {
2745#if INET
2746 case AF_INET:
2747 pf_mtag->pftag_flags |= PF_TAG_HDR_INET;
2748 break;
2749#endif /* INET */
2750 case AF_INET6:
2751 pf_mtag->pftag_flags |= PF_TAG_HDR_INET6;
2752 break;
2753 }
2754#endif /* PF_ECN */
2755
2756 /* indicate this is TCP */
2757 m->m_pkthdr.pkt_proto = IPPROTO_TCP;
2758
2759 /* Make sure headers are 32-bit aligned */
2760 m->m_data += max_linkhdr;
2761 m->m_pkthdr.len = m->m_len = len;
2762 m->m_pkthdr.rcvif = NULL;
2763 bzero(s: m_mtod_current(m), n: len);
2764 switch (af) {
2765#if INET
2766 case AF_INET:
2767 h = mtod(m, struct ip *);
2768
2769 /* IP header fields included in the TCP checksum */
2770 h->ip_p = IPPROTO_TCP;
2771 h->ip_len = htons(tlen);
2772 h->ip_src.s_addr = saddr->v4addr.s_addr;
2773 h->ip_dst.s_addr = daddr->v4addr.s_addr;
2774
2775 th = (struct tcphdr *)(void *)((caddr_t)h + sizeof(struct ip));
2776 break;
2777#endif /* INET */
2778 case AF_INET6:
2779 h6 = mtod(m, struct ip6_hdr *);
2780
2781 /* IP header fields included in the TCP checksum */
2782 h6->ip6_nxt = IPPROTO_TCP;
2783 h6->ip6_plen = htons(tlen);
2784 memcpy(dst: &h6->ip6_src, src: &saddr->v6addr, n: sizeof(struct in6_addr));
2785 memcpy(dst: &h6->ip6_dst, src: &daddr->v6addr, n: sizeof(struct in6_addr));
2786
2787 th = (struct tcphdr *)(void *)
2788 ((caddr_t)h6 + sizeof(struct ip6_hdr));
2789 break;
2790 }
2791
2792 /* TCP header */
2793 th->th_sport = sport;
2794 th->th_dport = dport;
2795 th->th_seq = htonl(seq);
2796 th->th_ack = htonl(ack);
2797 th->th_off = tlen >> 2;
2798 th->th_flags = flags;
2799 th->th_win = htons(win);
2800
2801 if (mss) {
2802 opt = (char *)(th + 1);
2803 opt[0] = TCPOPT_MAXSEG;
2804 opt[1] = 4;
2805#if BYTE_ORDER != BIG_ENDIAN
2806 HTONS(mss);
2807#endif
2808 bcopy(src: (caddr_t)&mss, dst: (caddr_t)(opt + 2), n: 2);
2809 }
2810
2811 switch (af) {
2812#if INET
2813 case AF_INET: {
2814 struct route ro;
2815
2816 /* TCP checksum */
2817 th->th_sum = in_cksum(m, len);
2818
2819 /* Finish the IP header */
2820 h->ip_v = 4;
2821 h->ip_hl = sizeof(*h) >> 2;
2822 h->ip_tos = IPTOS_LOWDELAY;
2823 /*
2824 * ip_output() expects ip_len and ip_off to be in host order.
2825 */
2826 h->ip_len = len;
2827 h->ip_off = (path_mtu_discovery ? IP_DF : 0);
2828 h->ip_ttl = ttl ? ttl : ip_defttl;
2829 h->ip_sum = 0;
2830
2831 bzero(s: &ro, n: sizeof(ro));
2832 ip_output(m, NULL, &ro, 0, NULL, NULL);
2833 ROUTE_RELEASE(&ro);
2834 break;
2835 }
2836#endif /* INET */
2837 case AF_INET6: {
2838 struct route_in6 ro6;
2839
2840 /* TCP checksum */
2841 th->th_sum = in6_cksum(m, IPPROTO_TCP,
2842 sizeof(struct ip6_hdr), tlen);
2843
2844 h6->ip6_vfc |= IPV6_VERSION;
2845 h6->ip6_hlim = IPV6_DEFHLIM;
2846
2847 ip6_output_setsrcifscope(m, IFSCOPE_UNKNOWN, NULL);
2848 ip6_output_setdstifscope(m, IFSCOPE_UNKNOWN, NULL);
2849 bzero(s: &ro6, n: sizeof(ro6));
2850 ip6_output(m, NULL, &ro6, 0, NULL, NULL, NULL);
2851 ROUTE_RELEASE(&ro6);
2852 break;
2853 }
2854 }
2855}
2856
2857static __attribute__((noinline)) void
2858pf_send_icmp(pbuf_t *pbuf, u_int8_t type, u_int8_t code, sa_family_t af,
2859 struct pf_rule *r)
2860{
2861 struct mbuf *m0;
2862 struct pf_mtag *pf_mtag;
2863
2864 m0 = pbuf_clone_to_mbuf(pbuf);
2865 if (m0 == NULL) {
2866 return;
2867 }
2868
2869 if ((pf_mtag = pf_get_mtag(m0)) == NULL) {
2870 return;
2871 }
2872
2873 pf_mtag->pftag_flags |= PF_TAG_GENERATED;
2874
2875 if (PF_RTABLEID_IS_VALID(r->rtableid)) {
2876 pf_mtag->pftag_rtableid = r->rtableid;
2877 }
2878
2879#if PF_ECN
2880 /* add hints for ecn */
2881 pf_mtag->pftag_hdr = mtod(m0, struct ip *);
2882 /* record address family */
2883 pf_mtag->pftag_flags &= ~(PF_TAG_HDR_INET | PF_TAG_HDR_INET6);
2884 switch (af) {
2885#if INET
2886 case AF_INET:
2887 pf_mtag->pftag_flags |= PF_TAG_HDR_INET;
2888 m0->m_pkthdr.pkt_proto = IPPROTO_ICMP;
2889 break;
2890#endif /* INET */
2891 case AF_INET6:
2892 pf_mtag->pftag_flags |= PF_TAG_HDR_INET6;
2893 m0->m_pkthdr.pkt_proto = IPPROTO_ICMPV6;
2894 break;
2895 }
2896#endif /* PF_ECN */
2897
2898 switch (af) {
2899#if INET
2900 case AF_INET:
2901 icmp_error(m0, type, code, 0, 0);
2902 break;
2903#endif /* INET */
2904 case AF_INET6:
2905 icmp6_error(m0, type, code, 0);
2906 break;
2907 }
2908}
2909
2910/*
2911 * Return 1 if the addresses a and b match (with mask m), otherwise return 0.
2912 * If n is 0, they match if they are equal. If n is != 0, they match if they
2913 * are different.
2914 */
2915int
2916pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m,
2917 struct pf_addr *b, sa_family_t af)
2918{
2919 int match = 0;
2920
2921 switch (af) {
2922#if INET
2923 case AF_INET:
2924 if ((a->addr32[0] & m->addr32[0]) ==
2925 (b->addr32[0] & m->addr32[0])) {
2926 match++;
2927 }
2928 break;
2929#endif /* INET */
2930 case AF_INET6:
2931 if (((a->addr32[0] & m->addr32[0]) ==
2932 (b->addr32[0] & m->addr32[0])) &&
2933 ((a->addr32[1] & m->addr32[1]) ==
2934 (b->addr32[1] & m->addr32[1])) &&
2935 ((a->addr32[2] & m->addr32[2]) ==
2936 (b->addr32[2] & m->addr32[2])) &&
2937 ((a->addr32[3] & m->addr32[3]) ==
2938 (b->addr32[3] & m->addr32[3]))) {
2939 match++;
2940 }
2941 break;
2942 }
2943 if (match) {
2944 if (n) {
2945 return 0;
2946 } else {
2947 return 1;
2948 }
2949 } else {
2950 if (n) {
2951 return 1;
2952 } else {
2953 return 0;
2954 }
2955 }
2956}
2957
2958/*
2959 * Return 1 if b <= a <= e, otherwise return 0.
2960 */
2961int
2962pf_match_addr_range(struct pf_addr *b, struct pf_addr *e,
2963 struct pf_addr *a, sa_family_t af)
2964{
2965 switch (af) {
2966#if INET
2967 case AF_INET:
2968 if ((a->addr32[0] < b->addr32[0]) ||
2969 (a->addr32[0] > e->addr32[0])) {
2970 return 0;
2971 }
2972 break;
2973#endif /* INET */
2974 case AF_INET6: {
2975 int i;
2976
2977 /* check a >= b */
2978 for (i = 0; i < 4; ++i) {
2979 if (a->addr32[i] > b->addr32[i]) {
2980 break;
2981 } else if (a->addr32[i] < b->addr32[i]) {
2982 return 0;
2983 }
2984 }
2985 /* check a <= e */
2986 for (i = 0; i < 4; ++i) {
2987 if (a->addr32[i] < e->addr32[i]) {
2988 break;
2989 } else if (a->addr32[i] > e->addr32[i]) {
2990 return 0;
2991 }
2992 }
2993 break;
2994 }
2995 }
2996 return 1;
2997}
2998
2999int
3000pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p)
3001{
3002 switch (op) {
3003 case PF_OP_IRG:
3004 return (p > a1) && (p < a2);
3005 case PF_OP_XRG:
3006 return (p < a1) || (p > a2);
3007 case PF_OP_RRG:
3008 return (p >= a1) && (p <= a2);
3009 case PF_OP_EQ:
3010 return p == a1;
3011 case PF_OP_NE:
3012 return p != a1;
3013 case PF_OP_LT:
3014 return p < a1;
3015 case PF_OP_LE:
3016 return p <= a1;
3017 case PF_OP_GT:
3018 return p > a1;
3019 case PF_OP_GE:
3020 return p >= a1;
3021 }
3022 return 0; /* never reached */
3023}
3024
3025int
3026pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p)
3027{
3028#if BYTE_ORDER != BIG_ENDIAN
3029 NTOHS(a1);
3030 NTOHS(a2);
3031 NTOHS(p);
3032#endif
3033 return pf_match(op, a1, a2, p);
3034}
3035
3036int
3037pf_match_xport(u_int8_t proto, u_int8_t proto_variant, union pf_rule_xport *rx,
3038 union pf_state_xport *sx)
3039{
3040 int d = !0;
3041
3042 if (sx) {
3043 switch (proto) {
3044 case IPPROTO_GRE:
3045 if (proto_variant == PF_GRE_PPTP_VARIANT) {
3046 d = (rx->call_id == sx->call_id);
3047 }
3048 break;
3049
3050 case IPPROTO_ESP:
3051 d = (rx->spi == sx->spi);
3052 break;
3053
3054 case IPPROTO_TCP:
3055 case IPPROTO_UDP:
3056 case IPPROTO_ICMP:
3057 case IPPROTO_ICMPV6:
3058 if (rx->range.op) {
3059 d = pf_match_port(op: rx->range.op,
3060 a1: rx->range.port[0], a2: rx->range.port[1],
3061 p: sx->port);
3062 }
3063 break;
3064
3065 default:
3066 break;
3067 }
3068 }
3069
3070 return d;
3071}
3072
3073int
3074pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u)
3075{
3076 if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE) {
3077 return 0;
3078 }
3079 return pf_match(op, a1, a2, p: u);
3080}
3081
3082int
3083pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g)
3084{
3085 if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE) {
3086 return 0;
3087 }
3088 return pf_match(op, a1, a2, p: g);
3089}
3090
3091static int
3092pf_match_tag(struct pf_rule *r, struct pf_mtag *pf_mtag,
3093 int *tag)
3094{
3095 if (*tag == -1) {
3096 *tag = pf_mtag->pftag_tag;
3097 }
3098
3099 return (!r->match_tag_not && r->match_tag == *tag) ||
3100 (r->match_tag_not && r->match_tag != *tag);
3101}
3102
3103int
3104pf_tag_packet(pbuf_t *pbuf, struct pf_mtag *pf_mtag, int tag,
3105 unsigned int rtableid, struct pf_pdesc *pd)
3106{
3107 if (tag <= 0 && !PF_RTABLEID_IS_VALID(rtableid) &&
3108 (pd == NULL || !(pd->pktflags & PKTF_FLOW_ID))) {
3109 return 0;
3110 }
3111
3112 if (pf_mtag == NULL && (pf_mtag = pf_get_mtag_pbuf(pbuf)) == NULL) {
3113 return 1;
3114 }
3115
3116 if (tag > 0) {
3117 pf_mtag->pftag_tag = tag;
3118 }
3119 if (PF_RTABLEID_IS_VALID(rtableid)) {
3120 pf_mtag->pftag_rtableid = rtableid;
3121 }
3122 if (pd != NULL && (pd->pktflags & PKTF_FLOW_ID)) {
3123 *pbuf->pb_flowsrc = pd->flowsrc;
3124 *pbuf->pb_flowid = pd->flowhash;
3125 *pbuf->pb_flags |= pd->pktflags;
3126 *pbuf->pb_proto = pd->proto;
3127 }
3128
3129 return 0;
3130}
3131
3132void
3133pf_step_into_anchor(int *depth, struct pf_ruleset **rs, int n,
3134 struct pf_rule **r, struct pf_rule **a, int *match)
3135{
3136 struct pf_anchor_stackframe *f;
3137
3138 (*r)->anchor->match = 0;
3139 if (match) {
3140 *match = 0;
3141 }
3142 if (*depth >= (int)sizeof(pf_anchor_stack) /
3143 (int)sizeof(pf_anchor_stack[0])) {
3144 printf("pf_step_into_anchor: stack overflow\n");
3145 *r = TAILQ_NEXT(*r, entries);
3146 return;
3147 } else if (*depth == 0 && a != NULL) {
3148 *a = *r;
3149 }
3150 f = pf_anchor_stack + (*depth)++;
3151 f->rs = *rs;
3152 f->r = *r;
3153 if ((*r)->anchor_wildcard) {
3154 f->parent = &(*r)->anchor->children;
3155 if ((f->child = RB_MIN(pf_anchor_node, f->parent)) ==
3156 NULL) {
3157 *r = NULL;
3158 return;
3159 }
3160 *rs = &f->child->ruleset;
3161 } else {
3162 f->parent = NULL;
3163 f->child = NULL;
3164 *rs = &(*r)->anchor->ruleset;
3165 }
3166 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
3167}
3168
3169int
3170pf_step_out_of_anchor(int *depth, struct pf_ruleset **rs, int n,
3171 struct pf_rule **r, struct pf_rule **a, int *match)
3172{
3173 struct pf_anchor_stackframe *f;
3174 int quick = 0;
3175
3176 do {
3177 if (*depth <= 0) {
3178 break;
3179 }
3180 f = pf_anchor_stack + *depth - 1;
3181 if (f->parent != NULL && f->child != NULL) {
3182 if (f->child->match ||
3183 (match != NULL && *match)) {
3184 f->r->anchor->match = 1;
3185 if (match) {
3186 *match = 0;
3187 }
3188 }
3189 f->child = RB_NEXT(pf_anchor_node, f->parent, f->child);
3190 if (f->child != NULL) {
3191 *rs = &f->child->ruleset;
3192 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
3193 if (*r == NULL) {
3194 continue;
3195 } else {
3196 break;
3197 }
3198 }
3199 }
3200 (*depth)--;
3201 if (*depth == 0 && a != NULL) {
3202 *a = NULL;
3203 }
3204 *rs = f->rs;
3205 if (f->r->anchor->match || (match != NULL && *match)) {
3206 quick = f->r->quick;
3207 }
3208 *r = TAILQ_NEXT(f->r, entries);
3209 } while (*r == NULL);
3210
3211 return quick;
3212}
3213
3214void
3215pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr,
3216 struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af)
3217{
3218 switch (af) {
3219#if INET
3220 case AF_INET:
3221 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
3222 ((rmask->addr32[0] ^ 0xffffffff) & saddr->addr32[0]);
3223 break;
3224#endif /* INET */
3225 case AF_INET6:
3226 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
3227 ((rmask->addr32[0] ^ 0xffffffff) & saddr->addr32[0]);
3228 naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) |
3229 ((rmask->addr32[1] ^ 0xffffffff) & saddr->addr32[1]);
3230 naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) |
3231 ((rmask->addr32[2] ^ 0xffffffff) & saddr->addr32[2]);
3232 naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) |
3233 ((rmask->addr32[3] ^ 0xffffffff) & saddr->addr32[3]);
3234 break;
3235 }
3236}
3237
3238void
3239pf_addr_inc(struct pf_addr *addr, sa_family_t af)
3240{
3241 switch (af) {
3242#if INET
3243 case AF_INET:
3244 addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1);
3245 break;
3246#endif /* INET */
3247 case AF_INET6:
3248 if (addr->addr32[3] == 0xffffffff) {
3249 addr->addr32[3] = 0;
3250 if (addr->addr32[2] == 0xffffffff) {
3251 addr->addr32[2] = 0;
3252 if (addr->addr32[1] == 0xffffffff) {
3253 addr->addr32[1] = 0;
3254 addr->addr32[0] =
3255 htonl(ntohl(addr->addr32[0]) + 1);
3256 } else {
3257 addr->addr32[1] =
3258 htonl(ntohl(addr->addr32[1]) + 1);
3259 }
3260 } else {
3261 addr->addr32[2] =
3262 htonl(ntohl(addr->addr32[2]) + 1);
3263 }
3264 } else {
3265 addr->addr32[3] =
3266 htonl(ntohl(addr->addr32[3]) + 1);
3267 }
3268 break;
3269 }
3270}
3271
3272#define mix(a, b, c) \
3273 do { \
3274 a -= b; a -= c; a ^= (c >> 13); \
3275 b -= c; b -= a; b ^= (a << 8); \
3276 c -= a; c -= b; c ^= (b >> 13); \
3277 a -= b; a -= c; a ^= (c >> 12); \
3278 b -= c; b -= a; b ^= (a << 16); \
3279 c -= a; c -= b; c ^= (b >> 5); \
3280 a -= b; a -= c; a ^= (c >> 3); \
3281 b -= c; b -= a; b ^= (a << 10); \
3282 c -= a; c -= b; c ^= (b >> 15); \
3283 } while (0)
3284
3285/*
3286 * hash function based on bridge_hash in if_bridge.c
3287 */
3288static void
3289pf_hash(struct pf_addr *inaddr, struct pf_addr *hash,
3290 struct pf_poolhashkey *key, sa_family_t af)
3291{
3292 u_int32_t a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0];
3293
3294 switch (af) {
3295#if INET
3296 case AF_INET:
3297 a += inaddr->addr32[0];
3298 b += key->key32[1];
3299 mix(a, b, c);
3300 hash->addr32[0] = c + key->key32[2];
3301 break;
3302#endif /* INET */
3303 case AF_INET6:
3304 a += inaddr->addr32[0];
3305 b += inaddr->addr32[2];
3306 mix(a, b, c);
3307 hash->addr32[0] = c;
3308 a += inaddr->addr32[1];
3309 b += inaddr->addr32[3];
3310 c += key->key32[1];
3311 mix(a, b, c);
3312 hash->addr32[1] = c;
3313 a += inaddr->addr32[2];
3314 b += inaddr->addr32[1];
3315 c += key->key32[2];
3316 mix(a, b, c);
3317 hash->addr32[2] = c;
3318 a += inaddr->addr32[3];
3319 b += inaddr->addr32[0];
3320 c += key->key32[3];
3321 mix(a, b, c);
3322 hash->addr32[3] = c;
3323 break;
3324 }
3325}
3326
3327static __attribute__((noinline)) int
3328pf_map_addr(sa_family_t af, struct pf_rule *r, struct pf_addr *saddr,
3329 struct pf_addr *naddr, struct pf_addr *init_addr, struct pf_src_node **sn)
3330{
3331 unsigned char hash[16];
3332 struct pf_pool *rpool = &r->rpool;
3333 struct pf_addr *raddr = &rpool->cur->addr.v.a.addr;
3334 struct pf_addr *rmask = &rpool->cur->addr.v.a.mask;
3335 struct pf_pooladdr *acur = rpool->cur;
3336 struct pf_src_node k;
3337
3338 if (*sn == NULL && r->rpool.opts & PF_POOL_STICKYADDR &&
3339 (r->rpool.opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
3340 k.af = af;
3341 PF_ACPY(&k.addr, saddr, af);
3342 if (r->rule_flag & PFRULE_RULESRCTRACK ||
3343 r->rpool.opts & PF_POOL_STICKYADDR) {
3344 k.rule.ptr = r;
3345 } else {
3346 k.rule.ptr = NULL;
3347 }
3348 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
3349 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k);
3350 if (*sn != NULL && !PF_AZERO(&(*sn)->raddr, rpool->af)) {
3351 PF_ACPY(naddr, &(*sn)->raddr, rpool->af);
3352 if (pf_status.debug >= PF_DEBUG_MISC) {
3353 printf("pf_map_addr: src tracking maps ");
3354 pf_print_host(addr: &k.addr, p: 0, af);
3355 printf(" to ");
3356 pf_print_host(addr: naddr, p: 0, af: rpool->af);
3357 printf("\n");
3358 }
3359 return 0;
3360 }
3361 }
3362
3363 if (rpool->cur->addr.type == PF_ADDR_NOROUTE) {
3364 return 1;
3365 }
3366 if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
3367 if (rpool->cur->addr.p.dyn == NULL) {
3368 return 1;
3369 }
3370 switch (rpool->af) {
3371#if INET
3372 case AF_INET:
3373 if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 &&
3374 (rpool->opts & PF_POOL_TYPEMASK) !=
3375 PF_POOL_ROUNDROBIN) {
3376 return 1;
3377 }
3378 raddr = &rpool->cur->addr.p.dyn->pfid_addr4;
3379 rmask = &rpool->cur->addr.p.dyn->pfid_mask4;
3380 break;
3381#endif /* INET */
3382 case AF_INET6:
3383 if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 &&
3384 (rpool->opts & PF_POOL_TYPEMASK) !=
3385 PF_POOL_ROUNDROBIN) {
3386 return 1;
3387 }
3388 raddr = &rpool->cur->addr.p.dyn->pfid_addr6;
3389 rmask = &rpool->cur->addr.p.dyn->pfid_mask6;
3390 break;
3391 }
3392 } else if (rpool->cur->addr.type == PF_ADDR_TABLE) {
3393 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN) {
3394 return 1; /* unsupported */
3395 }
3396 } else {
3397 raddr = &rpool->cur->addr.v.a.addr;
3398 rmask = &rpool->cur->addr.v.a.mask;
3399 }
3400
3401 switch (rpool->opts & PF_POOL_TYPEMASK) {
3402 case PF_POOL_NONE:
3403 PF_ACPY(naddr, raddr, rpool->af);
3404 break;
3405 case PF_POOL_BITMASK:
3406 ASSERT(af == rpool->af);
3407 PF_POOLMASK(naddr, raddr, rmask, saddr, af);
3408 break;
3409 case PF_POOL_RANDOM:
3410 if (init_addr != NULL && PF_AZERO(init_addr, rpool->af)) {
3411 switch (af) {
3412#if INET
3413 case AF_INET:
3414 rpool->counter.addr32[0] = htonl(random());
3415 break;
3416#endif /* INET */
3417 case AF_INET6:
3418 if (rmask->addr32[3] != 0xffffffff) {
3419 rpool->counter.addr32[3] =
3420 RandomULong();
3421 } else {
3422 break;
3423 }
3424 if (rmask->addr32[2] != 0xffffffff) {
3425 rpool->counter.addr32[2] =
3426 RandomULong();
3427 } else {
3428 break;
3429 }
3430 if (rmask->addr32[1] != 0xffffffff) {
3431 rpool->counter.addr32[1] =
3432 RandomULong();
3433 } else {
3434 break;
3435 }
3436 if (rmask->addr32[0] != 0xffffffff) {
3437 rpool->counter.addr32[0] =
3438 RandomULong();
3439 }
3440 break;
3441 }
3442 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter,
3443 rpool->af);
3444 PF_ACPY(init_addr, naddr, rpool->af);
3445 } else {
3446 PF_AINC(&rpool->counter, rpool->af);
3447 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter,
3448 rpool->af);
3449 }
3450 break;
3451 case PF_POOL_SRCHASH:
3452 ASSERT(af == rpool->af);
3453 PF_POOLMASK(naddr, raddr, rmask, saddr, af);
3454 pf_hash(inaddr: saddr, hash: (struct pf_addr *)(void *)&hash,
3455 key: &rpool->key, af);
3456 PF_POOLMASK(naddr, raddr, rmask,
3457 (struct pf_addr *)(void *)&hash, af);
3458 break;
3459 case PF_POOL_ROUNDROBIN:
3460 if (rpool->cur->addr.type == PF_ADDR_TABLE) {
3461 if (!pfr_pool_get(rpool->cur->addr.p.tbl,
3462 &rpool->tblidx, &rpool->counter,
3463 &raddr, &rmask, rpool->af)) {
3464 goto get_addr;
3465 }
3466 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
3467 if (rpool->cur->addr.p.dyn != NULL &&
3468 !pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
3469 &rpool->tblidx, &rpool->counter,
3470 &raddr, &rmask, af)) {
3471 goto get_addr;
3472 }
3473 } else if (pf_match_addr(n: 0, a: raddr, m: rmask, b: &rpool->counter,
3474 af: rpool->af)) {
3475 goto get_addr;
3476 }
3477
3478try_next:
3479 if ((rpool->cur = TAILQ_NEXT(rpool->cur, entries)) == NULL) {
3480 rpool->cur = TAILQ_FIRST(&rpool->list);
3481 }
3482 if (rpool->cur->addr.type == PF_ADDR_TABLE) {
3483 rpool->tblidx = -1;
3484 if (pfr_pool_get(rpool->cur->addr.p.tbl,
3485 &rpool->tblidx, &rpool->counter,
3486 &raddr, &rmask, rpool->af)) {
3487 /* table contains no address of type
3488 * 'rpool->af' */
3489 if (rpool->cur != acur) {
3490 goto try_next;
3491 }
3492 return 1;
3493 }
3494 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
3495 rpool->tblidx = -1;
3496 if (rpool->cur->addr.p.dyn == NULL) {
3497 return 1;
3498 }
3499 if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
3500 &rpool->tblidx, &rpool->counter,
3501 &raddr, &rmask, rpool->af)) {
3502 /* table contains no address of type
3503 * 'rpool->af' */
3504 if (rpool->cur != acur) {
3505 goto try_next;
3506 }
3507 return 1;
3508 }
3509 } else {
3510 raddr = &rpool->cur->addr.v.a.addr;
3511 rmask = &rpool->cur->addr.v.a.mask;
3512 PF_ACPY(&rpool->counter, raddr, rpool->af);
3513 }
3514
3515get_addr:
3516 PF_ACPY(naddr, &rpool->counter, rpool->af);
3517 if (init_addr != NULL && PF_AZERO(init_addr, rpool->af)) {
3518 PF_ACPY(init_addr, naddr, rpool->af);
3519 }
3520 PF_AINC(&rpool->counter, rpool->af);
3521 break;
3522 }
3523 if (*sn != NULL) {
3524 PF_ACPY(&(*sn)->raddr, naddr, rpool->af);
3525 }
3526
3527 if (pf_status.debug >= PF_DEBUG_MISC &&
3528 (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
3529 printf("pf_map_addr: selected address ");
3530 pf_print_host(addr: naddr, p: 0, af: rpool->af);
3531 printf("\n");
3532 }
3533
3534 return 0;
3535}
3536
3537static __attribute__((noinline)) int
3538pf_get_sport(struct pf_pdesc *pd, struct pfi_kif *kif, struct pf_rule *r,
3539 struct pf_addr *saddr, union pf_state_xport *sxport, struct pf_addr *daddr,
3540 union pf_state_xport *dxport, struct pf_addr *naddr,
3541 union pf_state_xport *nxport, struct pf_src_node **sn
3542#if SKYWALK
3543 , netns_token *pnstoken
3544#endif
3545 )
3546{
3547#pragma unused(kif)
3548 struct pf_state_key_cmp key;
3549 struct pf_addr init_addr;
3550 unsigned int cut;
3551 sa_family_t af = pd->af;
3552 u_int8_t proto = pd->proto;
3553 unsigned int low = r->rpool.proxy_port[0];
3554 unsigned int high = r->rpool.proxy_port[1];
3555
3556 bzero(s: &init_addr, n: sizeof(init_addr));
3557 if (pf_map_addr(af, r, saddr, naddr, init_addr: &init_addr, sn)) {
3558 return 1;
3559 }
3560
3561 if (proto == IPPROTO_ICMP) {
3562 low = 1;
3563 high = 65535;
3564 }
3565
3566 if (!nxport) {
3567 return 0; /* No output necessary. */
3568 }
3569 /*--- Special mapping rules for UDP ---*/
3570 if (proto == IPPROTO_UDP) {
3571 /*--- Never float IKE source port ---*/
3572 if (ntohs(sxport->port) == PF_IKE_PORT) {
3573