1 | /* |
2 | * Copyright (c) 2007-2023 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | /* $apfw: git commit 6602420f2f101b74305cd78f7cd9e0c8fdedae97 $ */ |
30 | /* $OpenBSD: pf.c,v 1.567 2008/02/20 23:40:13 henning Exp $ */ |
31 | |
32 | /* |
33 | * Copyright (c) 2001 Daniel Hartmeier |
34 | * Copyright (c) 2002 - 2013 Henning Brauer |
35 | * NAT64 - Copyright (c) 2010 Viagenie Inc. (http://www.viagenie.ca) |
36 | * All rights reserved. |
37 | * |
38 | * Redistribution and use in source and binary forms, with or without |
39 | * modification, are permitted provided that the following conditions |
40 | * are met: |
41 | * |
42 | * - Redistributions of source code must retain the above copyright |
43 | * notice, this list of conditions and the following disclaimer. |
44 | * - Redistributions in binary form must reproduce the above |
45 | * copyright notice, this list of conditions and the following |
46 | * disclaimer in the documentation and/or other materials provided |
47 | * with the distribution. |
48 | * |
49 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
50 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
51 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS |
52 | * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE |
53 | * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, |
54 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, |
55 | * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
56 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER |
57 | * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
58 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN |
59 | * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
60 | * POSSIBILITY OF SUCH DAMAGE. |
61 | * |
62 | * Effort sponsored in part by the Defense Advanced Research Projects |
63 | * Agency (DARPA) and Air Force Research Laboratory, Air Force |
64 | * Materiel Command, USAF, under agreement number F30602-01-2-0537. |
65 | * |
66 | */ |
67 | |
68 | #include <machine/endian.h> |
69 | #include <sys/param.h> |
70 | #include <sys/systm.h> |
71 | #include <sys/filio.h> |
72 | #include <sys/socket.h> |
73 | #include <sys/socketvar.h> |
74 | #include <sys/kernel.h> |
75 | #include <sys/time.h> |
76 | #include <sys/proc.h> |
77 | #include <sys/random.h> |
78 | #include <sys/mcache.h> |
79 | #include <sys/protosw.h> |
80 | |
81 | #include <libkern/crypto/md5.h> |
82 | #include <libkern/libkern.h> |
83 | |
84 | #include <mach/thread_act.h> |
85 | |
86 | #include <net/if.h> |
87 | #include <net/if_types.h> |
88 | #include <net/bpf.h> |
89 | #include <net/route.h> |
90 | #include <net/dlil.h> |
91 | |
92 | #include <netinet/in.h> |
93 | #include <netinet/in_var.h> |
94 | #include <netinet/in_systm.h> |
95 | #include <netinet/ip.h> |
96 | #include <netinet/ip_var.h> |
97 | #include <netinet/tcp.h> |
98 | #include <netinet/tcp_seq.h> |
99 | #include <netinet/udp.h> |
100 | #include <netinet/ip_icmp.h> |
101 | #include <netinet/in_pcb.h> |
102 | #include <netinet/tcp_timer.h> |
103 | #include <netinet/tcp_var.h> |
104 | #include <netinet/tcp_fsm.h> |
105 | #include <netinet/udp_var.h> |
106 | #include <netinet/icmp_var.h> |
107 | #include <net/if_ether.h> |
108 | #include <net/ethernet.h> |
109 | #include <net/flowhash.h> |
110 | #include <net/nat464_utils.h> |
111 | #include <net/pfvar.h> |
112 | #include <net/if_pflog.h> |
113 | |
114 | #if NPFSYNC |
115 | #include <net/if_pfsync.h> |
116 | #endif /* NPFSYNC */ |
117 | |
118 | #include <netinet/ip6.h> |
119 | #include <netinet6/in6_pcb.h> |
120 | #include <netinet6/ip6_var.h> |
121 | #include <netinet/icmp6.h> |
122 | #include <netinet6/nd6.h> |
123 | |
124 | #if DUMMYNET |
125 | #include <netinet/ip_dummynet.h> |
126 | #endif /* DUMMYNET */ |
127 | |
128 | #if SKYWALK |
129 | #include <skywalk/namespace/flowidns.h> |
130 | #endif /* SKYWALK */ |
131 | |
132 | /* |
133 | * For RandomULong(), to get a 32 bits random value |
134 | * Note that random() returns a 31 bits value, see rdar://11159750 |
135 | */ |
136 | #include <dev/random/randomdev.h> |
137 | |
138 | #define DPFPRINTF(n, x) (pf_status.debug >= (n) ? printf x : ((void)0)) |
139 | |
140 | /* |
141 | * On Mac OS X, the rtableid value is treated as the interface scope |
142 | * value that is equivalent to the interface index used for scoped |
143 | * routing. A valid scope value is anything but IFSCOPE_NONE (0), |
144 | * as per definition of ifindex which is a positive, non-zero number. |
145 | * The other BSDs treat a negative rtableid value as invalid, hence |
146 | * the test against INT_MAX to handle userland apps which initialize |
147 | * the field with a negative number. |
148 | */ |
149 | #define PF_RTABLEID_IS_VALID(r) \ |
150 | ((r) > IFSCOPE_NONE && (r) <= INT_MAX) |
151 | |
152 | /* |
153 | * Global variables |
154 | */ |
155 | static LCK_GRP_DECLARE(pf_lock_grp, "pf" ); |
156 | LCK_MTX_DECLARE(pf_lock, &pf_lock_grp); |
157 | |
158 | static LCK_GRP_DECLARE(pf_perim_lock_grp, "pf_perim" ); |
159 | LCK_RW_DECLARE(pf_perim_lock, &pf_perim_lock_grp); |
160 | |
161 | /* state tables */ |
162 | struct pf_state_tree_lan_ext pf_statetbl_lan_ext; |
163 | struct pf_state_tree_ext_gwy pf_statetbl_ext_gwy; |
164 | static uint32_t pf_state_tree_ext_gwy_nat64_cnt = 0; |
165 | |
166 | struct pf_palist pf_pabuf; |
167 | struct pf_status pf_status; |
168 | |
169 | u_int32_t ticket_pabuf; |
170 | |
171 | static MD5_CTX pf_tcp_secret_ctx; |
172 | static u_char pf_tcp_secret[16]; |
173 | static int pf_tcp_secret_init; |
174 | static int pf_tcp_iss_off; |
175 | |
176 | static struct pf_anchor_stackframe { |
177 | struct pf_ruleset *rs; |
178 | struct pf_rule *r; |
179 | struct pf_anchor_node *parent; |
180 | struct pf_anchor *child; |
181 | } pf_anchor_stack[64]; |
182 | |
183 | struct pool pf_src_tree_pl, pf_rule_pl, pf_pooladdr_pl; |
184 | struct pool pf_state_pl, pf_state_key_pl; |
185 | |
186 | typedef void (*hook_fn_t)(void *); |
187 | |
188 | struct hook_desc { |
189 | TAILQ_ENTRY(hook_desc) hd_list; |
190 | hook_fn_t hd_fn; |
191 | void *hd_arg; |
192 | }; |
193 | |
194 | #define HOOK_REMOVE 0x01 |
195 | #define HOOK_FREE 0x02 |
196 | #define HOOK_ABORT 0x04 |
197 | |
198 | static void *hook_establish(struct hook_desc_head *, int, |
199 | hook_fn_t, void *); |
200 | static void hook_runloop(struct hook_desc_head *, int flags); |
201 | |
202 | struct pool pf_app_state_pl; |
203 | static void pf_print_addr(struct pf_addr *addr, sa_family_t af); |
204 | static void pf_print_sk_host(struct pf_state_host *, u_int8_t, int, |
205 | u_int8_t); |
206 | |
207 | static void pf_print_host(struct pf_addr *, u_int16_t, u_int8_t); |
208 | |
209 | static void pf_init_threshold(struct pf_threshold *, u_int32_t, |
210 | u_int32_t); |
211 | static void pf_add_threshold(struct pf_threshold *); |
212 | static int pf_check_threshold(struct pf_threshold *); |
213 | |
214 | static void pf_change_ap(int, pbuf_t *, struct pf_addr *, |
215 | u_int16_t *, u_int16_t *, u_int16_t *, |
216 | struct pf_addr *, u_int16_t, u_int8_t, sa_family_t, |
217 | sa_family_t, int); |
218 | static int pf_modulate_sack(pbuf_t *, int, struct pf_pdesc *, |
219 | struct tcphdr *, struct pf_state_peer *); |
220 | static void pf_change_a6(struct pf_addr *, u_int16_t *, |
221 | struct pf_addr *, u_int8_t); |
222 | static void pf_change_addr(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, |
223 | u_int8_t u, sa_family_t af, sa_family_t afn); |
224 | static void pf_change_icmp(struct pf_addr *, u_int16_t *, |
225 | struct pf_addr *, struct pf_addr *, u_int16_t, |
226 | u_int16_t *, u_int16_t *, u_int16_t *, |
227 | u_int16_t *, u_int8_t, sa_family_t); |
228 | static void pf_send_tcp(const struct pf_rule *, sa_family_t, |
229 | const struct pf_addr *, const struct pf_addr *, |
230 | u_int16_t, u_int16_t, u_int32_t, u_int32_t, |
231 | u_int8_t, u_int16_t, u_int16_t, u_int8_t, int, |
232 | u_int16_t, struct ether_header *, struct ifnet *); |
233 | static void pf_send_icmp(pbuf_t *, u_int8_t, u_int8_t, |
234 | sa_family_t, struct pf_rule *); |
235 | static struct pf_rule *pf_match_translation(struct pf_pdesc *, pbuf_t *, |
236 | int, int, struct pfi_kif *, struct pf_addr *, |
237 | union pf_state_xport *, struct pf_addr *, |
238 | union pf_state_xport *, int); |
239 | static struct pf_rule *pf_get_translation_aux(struct pf_pdesc *, |
240 | pbuf_t *, int, int, struct pfi_kif *, |
241 | struct pf_src_node **, struct pf_addr *, |
242 | union pf_state_xport *, struct pf_addr *, |
243 | union pf_state_xport *, union pf_state_xport * |
244 | #if SKYWALK |
245 | , netns_token * |
246 | #endif |
247 | ); |
248 | static void pf_attach_state(struct pf_state_key *, |
249 | struct pf_state *, int); |
250 | static u_int32_t pf_tcp_iss(struct pf_pdesc *); |
251 | static int pf_test_rule(struct pf_rule **, struct pf_state **, |
252 | int, struct pfi_kif *, pbuf_t *, int, |
253 | void *, struct pf_pdesc *, struct pf_rule **, |
254 | struct pf_ruleset **, struct ifqueue *); |
255 | #if DUMMYNET |
256 | static int pf_test_dummynet(struct pf_rule **, int, |
257 | struct pfi_kif *, pbuf_t **, |
258 | struct pf_pdesc *, struct ip_fw_args *); |
259 | #endif /* DUMMYNET */ |
260 | static int pf_test_fragment(struct pf_rule **, int, |
261 | struct pfi_kif *, pbuf_t *, void *, |
262 | struct pf_pdesc *, struct pf_rule **, |
263 | struct pf_ruleset **); |
264 | static int pf_test_state_tcp(struct pf_state **, int, |
265 | struct pfi_kif *, pbuf_t *, int, |
266 | void *, struct pf_pdesc *, u_short *); |
267 | static int pf_test_state_udp(struct pf_state **, int, |
268 | struct pfi_kif *, pbuf_t *, int, |
269 | void *, struct pf_pdesc *, u_short *); |
270 | static int pf_test_state_icmp(struct pf_state **, int, |
271 | struct pfi_kif *, pbuf_t *, int, |
272 | void *, struct pf_pdesc *, u_short *); |
273 | static int pf_test_state_other(struct pf_state **, int, |
274 | struct pfi_kif *, struct pf_pdesc *); |
275 | static int pf_match_tag(struct pf_rule *, |
276 | struct pf_mtag *, int *); |
277 | static void pf_hash(struct pf_addr *, struct pf_addr *, |
278 | struct pf_poolhashkey *, sa_family_t); |
279 | static int pf_map_addr(u_int8_t, struct pf_rule *, |
280 | struct pf_addr *, struct pf_addr *, |
281 | struct pf_addr *, struct pf_src_node **); |
282 | static int pf_get_sport(struct pf_pdesc *, struct pfi_kif *, |
283 | struct pf_rule *, struct pf_addr *, |
284 | union pf_state_xport *, struct pf_addr *, |
285 | union pf_state_xport *, struct pf_addr *, |
286 | union pf_state_xport *, struct pf_src_node ** |
287 | #if SKYWALK |
288 | , netns_token * |
289 | #endif |
290 | ); |
291 | static void pf_route(pbuf_t **, struct pf_rule *, int, |
292 | struct ifnet *, struct pf_state *, |
293 | struct pf_pdesc *); |
294 | static void pf_route6(pbuf_t **, struct pf_rule *, int, |
295 | struct ifnet *, struct pf_state *, |
296 | struct pf_pdesc *); |
297 | static u_int8_t pf_get_wscale(pbuf_t *, int, u_int16_t, |
298 | sa_family_t); |
299 | static u_int16_t pf_get_mss(pbuf_t *, int, u_int16_t, |
300 | sa_family_t); |
301 | static u_int16_t pf_calc_mss(struct pf_addr *, sa_family_t, |
302 | u_int16_t); |
303 | static void pf_set_rt_ifp(struct pf_state *, |
304 | struct pf_addr *, sa_family_t af); |
305 | static int pf_check_proto_cksum(pbuf_t *, int, int, |
306 | u_int8_t, sa_family_t); |
307 | static int pf_addr_wrap_neq(struct pf_addr_wrap *, |
308 | struct pf_addr_wrap *); |
309 | static struct pf_state *pf_find_state(struct pfi_kif *, |
310 | struct pf_state_key_cmp *, u_int); |
311 | static int pf_src_connlimit(struct pf_state **); |
312 | static void pf_stateins_err(const char *, struct pf_state *, |
313 | struct pfi_kif *); |
314 | static int pf_check_congestion(struct ifqueue *); |
315 | |
316 | #if 0 |
317 | static const char *pf_pptp_ctrl_type_name(u_int16_t code); |
318 | #endif |
319 | static void pf_pptp_handler(struct pf_state *, int, int, |
320 | struct pf_pdesc *, struct pfi_kif *); |
321 | static void pf_pptp_unlink(struct pf_state *); |
322 | static void pf_grev1_unlink(struct pf_state *); |
323 | static int pf_test_state_grev1(struct pf_state **, int, |
324 | struct pfi_kif *, int, struct pf_pdesc *); |
325 | static int pf_ike_compare(struct pf_app_state *, |
326 | struct pf_app_state *); |
327 | static int pf_test_state_esp(struct pf_state **, int, |
328 | struct pfi_kif *, int, struct pf_pdesc *); |
329 | static int pf_test6(int, struct ifnet *, pbuf_t **, struct ether_header *, |
330 | struct ip_fw_args *); |
331 | #if INET |
332 | static int pf_test(int, struct ifnet *, pbuf_t **, |
333 | struct ether_header *, struct ip_fw_args *); |
334 | #endif /* INET */ |
335 | |
336 | |
337 | extern struct pool pfr_ktable_pl; |
338 | extern struct pool pfr_kentry_pl; |
339 | extern int path_mtu_discovery; |
340 | |
341 | struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX] = { |
342 | { .pp = &pf_state_pl, .limit = PFSTATE_HIWAT }, |
343 | { .pp = &pf_app_state_pl, .limit = PFAPPSTATE_HIWAT }, |
344 | { .pp = &pf_src_tree_pl, .limit = PFSNODE_HIWAT }, |
345 | { .pp = &pf_frent_pl, .limit = PFFRAG_FRENT_HIWAT }, |
346 | { .pp = &pfr_ktable_pl, .limit = PFR_KTABLE_HIWAT }, |
347 | { .pp = &pfr_kentry_pl, .limit = PFR_KENTRY_HIWAT }, |
348 | }; |
349 | |
350 | #if SKYWALK && defined(XNU_TARGET_OS_OSX) |
351 | const char *compatible_anchors[] = { |
352 | "com.apple.internet-sharing" , |
353 | "com.apple/250.ApplicationFirewall" , |
354 | "com.apple/200.AirDrop" |
355 | }; |
356 | #endif // SKYWALK && defined(XNU_TARGET_OS_OSX) |
357 | |
358 | void * |
359 | pf_lazy_makewritable(struct pf_pdesc *pd, pbuf_t *pbuf, int len) |
360 | { |
361 | void *p; |
362 | |
363 | if (pd->lmw < 0) { |
364 | return NULL; |
365 | } |
366 | |
367 | VERIFY(pbuf == pd->mp); |
368 | |
369 | p = pbuf->pb_data; |
370 | if (len > pd->lmw) { |
371 | if ((p = pbuf_ensure_writable(pbuf, len)) == NULL) { |
372 | len = -1; |
373 | } |
374 | pd->lmw = len; |
375 | if (len >= 0) { |
376 | pd->pf_mtag = pf_find_mtag_pbuf(pbuf); |
377 | |
378 | switch (pd->af) { |
379 | case AF_INET: { |
380 | struct ip *h = p; |
381 | pd->src = (struct pf_addr *)(uintptr_t)&h->ip_src; |
382 | pd->dst = (struct pf_addr *)(uintptr_t)&h->ip_dst; |
383 | pd->ip_sum = &h->ip_sum; |
384 | break; |
385 | } |
386 | case AF_INET6: { |
387 | struct ip6_hdr *h = p; |
388 | pd->src = (struct pf_addr *)(uintptr_t)&h->ip6_src; |
389 | pd->dst = (struct pf_addr *)(uintptr_t)&h->ip6_dst; |
390 | break; |
391 | } |
392 | } |
393 | } |
394 | } |
395 | |
396 | return len < 0 ? NULL : p; |
397 | } |
398 | |
399 | static const int * |
400 | pf_state_lookup_aux(struct pf_state **state, struct pfi_kif *kif, |
401 | int direction, int *action) |
402 | { |
403 | if (*state == NULL || (*state)->timeout == PFTM_PURGE) { |
404 | *action = PF_DROP; |
405 | return action; |
406 | } |
407 | |
408 | if (direction == PF_OUT && |
409 | (((*state)->rule.ptr->rt == PF_ROUTETO && |
410 | (*state)->rule.ptr->direction == PF_OUT) || |
411 | ((*state)->rule.ptr->rt == PF_REPLYTO && |
412 | (*state)->rule.ptr->direction == PF_IN)) && |
413 | (*state)->rt_kif != NULL && (*state)->rt_kif != kif) { |
414 | *action = PF_PASS; |
415 | return action; |
416 | } |
417 | |
418 | return 0; |
419 | } |
420 | |
421 | #define STATE_LOOKUP() \ |
422 | do { \ |
423 | int action; \ |
424 | *state = pf_find_state(kif, &key, direction); \ |
425 | if (*state != NULL && pd != NULL && \ |
426 | !(pd->pktflags & PKTF_FLOW_ID)) { \ |
427 | pd->flowsrc = (*state)->state_key->flowsrc; \ |
428 | pd->flowhash = (*state)->state_key->flowhash; \ |
429 | if (pd->flowhash != 0) { \ |
430 | pd->pktflags |= PKTF_FLOW_ID; \ |
431 | pd->pktflags &= ~PKTF_FLOW_ADV; \ |
432 | } \ |
433 | } \ |
434 | if (pf_state_lookup_aux(state, kif, direction, &action)) \ |
435 | return (action); \ |
436 | } while (0) |
437 | |
438 | /* |
439 | * This macro resets the flowID information in a packet descriptor which was |
440 | * copied in from a PF state. This should be used after a protocol state lookup |
441 | * finds a matching PF state, but then decides to not use it for various |
442 | * reasons. |
443 | */ |
444 | #define PD_CLEAR_STATE_FLOWID(_pd) \ |
445 | do { \ |
446 | if (__improbable(((_pd)->pktflags & PKTF_FLOW_ID) && \ |
447 | ((_pd)->flowsrc == FLOWSRC_PF))) { \ |
448 | (_pd)->flowhash = 0; \ |
449 | (_pd)->flowsrc = 0; \ |
450 | (_pd)->pktflags &= ~PKTF_FLOW_ID; \ |
451 | } \ |
452 | \ |
453 | } while (0) |
454 | |
455 | #define STATE_ADDR_TRANSLATE(sk) \ |
456 | (sk)->lan.addr.addr32[0] != (sk)->gwy.addr.addr32[0] || \ |
457 | ((sk)->af_lan == AF_INET6 && \ |
458 | ((sk)->lan.addr.addr32[1] != (sk)->gwy.addr.addr32[1] || \ |
459 | (sk)->lan.addr.addr32[2] != (sk)->gwy.addr.addr32[2] || \ |
460 | (sk)->lan.addr.addr32[3] != (sk)->gwy.addr.addr32[3])) |
461 | |
462 | #define STATE_TRANSLATE(sk) \ |
463 | ((sk)->af_lan != (sk)->af_gwy || \ |
464 | STATE_ADDR_TRANSLATE(sk) || \ |
465 | (sk)->lan.xport.port != (sk)->gwy.xport.port) |
466 | |
467 | #define STATE_GRE_TRANSLATE(sk) \ |
468 | (STATE_ADDR_TRANSLATE(sk) || \ |
469 | (sk)->lan.xport.call_id != (sk)->gwy.xport.call_id) |
470 | |
471 | #define BOUND_IFACE(r, k) \ |
472 | ((r)->rule_flag & PFRULE_IFBOUND) ? (k) : pfi_all |
473 | |
474 | #define STATE_INC_COUNTERS(s) \ |
475 | do { \ |
476 | s->rule.ptr->states++; \ |
477 | VERIFY(s->rule.ptr->states != 0); \ |
478 | if (s->anchor.ptr != NULL) { \ |
479 | s->anchor.ptr->states++; \ |
480 | VERIFY(s->anchor.ptr->states != 0); \ |
481 | } \ |
482 | if (s->nat_rule.ptr != NULL) { \ |
483 | s->nat_rule.ptr->states++; \ |
484 | VERIFY(s->nat_rule.ptr->states != 0); \ |
485 | } \ |
486 | } while (0) |
487 | |
488 | #define STATE_DEC_COUNTERS(s) \ |
489 | do { \ |
490 | if (s->nat_rule.ptr != NULL) { \ |
491 | VERIFY(s->nat_rule.ptr->states > 0); \ |
492 | s->nat_rule.ptr->states--; \ |
493 | } \ |
494 | if (s->anchor.ptr != NULL) { \ |
495 | VERIFY(s->anchor.ptr->states > 0); \ |
496 | s->anchor.ptr->states--; \ |
497 | } \ |
498 | VERIFY(s->rule.ptr->states > 0); \ |
499 | s->rule.ptr->states--; \ |
500 | } while (0) |
501 | |
502 | static __inline int pf_src_compare(struct pf_src_node *, struct pf_src_node *); |
503 | static __inline int pf_state_compare_lan_ext(struct pf_state_key *, |
504 | struct pf_state_key *); |
505 | static __inline int pf_state_compare_ext_gwy(struct pf_state_key *, |
506 | struct pf_state_key *); |
507 | static __inline int pf_state_compare_id(struct pf_state *, |
508 | struct pf_state *); |
509 | |
510 | struct pf_src_tree tree_src_tracking; |
511 | |
512 | struct pf_state_tree_id tree_id; |
513 | struct pf_state_queue state_list; |
514 | |
515 | RB_GENERATE(pf_src_tree, pf_src_node, entry, pf_src_compare); |
516 | RB_GENERATE(pf_state_tree_lan_ext, pf_state_key, |
517 | entry_lan_ext, pf_state_compare_lan_ext); |
518 | RB_GENERATE(pf_state_tree_ext_gwy, pf_state_key, |
519 | entry_ext_gwy, pf_state_compare_ext_gwy); |
520 | RB_GENERATE(pf_state_tree_id, pf_state, |
521 | entry_id, pf_state_compare_id); |
522 | |
523 | #define PF_DT_SKIP_LANEXT 0x01 |
524 | #define PF_DT_SKIP_EXTGWY 0x02 |
525 | |
526 | static const u_int16_t PF_PPTP_PORT = 1723; |
527 | static const u_int32_t PF_PPTP_MAGIC_NUMBER = 0x1A2B3C4D; |
528 | |
529 | struct pf_pptp_hdr { |
530 | u_int16_t length; |
531 | u_int16_t type; |
532 | u_int32_t magic; |
533 | }; |
534 | |
535 | struct pf_pptp_ctrl_hdr { |
536 | u_int16_t type; |
537 | u_int16_t reserved_0; |
538 | }; |
539 | |
540 | struct pf_pptp_ctrl_generic { |
541 | u_int16_t data[0]; |
542 | }; |
543 | |
544 | #define PF_PPTP_CTRL_TYPE_START_REQ 1 |
545 | struct pf_pptp_ctrl_start_req { |
546 | u_int16_t protocol_version; |
547 | u_int16_t reserved_1; |
548 | u_int32_t framing_capabilities; |
549 | u_int32_t bearer_capabilities; |
550 | u_int16_t maximum_channels; |
551 | u_int16_t firmware_revision; |
552 | u_int8_t host_name[64]; |
553 | u_int8_t vendor_string[64]; |
554 | }; |
555 | |
556 | #define PF_PPTP_CTRL_TYPE_START_RPY 2 |
557 | struct pf_pptp_ctrl_start_rpy { |
558 | u_int16_t protocol_version; |
559 | u_int8_t result_code; |
560 | u_int8_t error_code; |
561 | u_int32_t framing_capabilities; |
562 | u_int32_t bearer_capabilities; |
563 | u_int16_t maximum_channels; |
564 | u_int16_t firmware_revision; |
565 | u_int8_t host_name[64]; |
566 | u_int8_t vendor_string[64]; |
567 | }; |
568 | |
569 | #define PF_PPTP_CTRL_TYPE_STOP_REQ 3 |
570 | struct pf_pptp_ctrl_stop_req { |
571 | u_int8_t reason; |
572 | u_int8_t reserved_1; |
573 | u_int16_t reserved_2; |
574 | }; |
575 | |
576 | #define PF_PPTP_CTRL_TYPE_STOP_RPY 4 |
577 | struct pf_pptp_ctrl_stop_rpy { |
578 | u_int8_t reason; |
579 | u_int8_t error_code; |
580 | u_int16_t reserved_1; |
581 | }; |
582 | |
583 | #define PF_PPTP_CTRL_TYPE_ECHO_REQ 5 |
584 | struct pf_pptp_ctrl_echo_req { |
585 | u_int32_t identifier; |
586 | }; |
587 | |
588 | #define PF_PPTP_CTRL_TYPE_ECHO_RPY 6 |
589 | struct pf_pptp_ctrl_echo_rpy { |
590 | u_int32_t identifier; |
591 | u_int8_t result_code; |
592 | u_int8_t error_code; |
593 | u_int16_t reserved_1; |
594 | }; |
595 | |
596 | #define PF_PPTP_CTRL_TYPE_CALL_OUT_REQ 7 |
597 | struct pf_pptp_ctrl_call_out_req { |
598 | u_int16_t call_id; |
599 | u_int16_t call_sernum; |
600 | u_int32_t min_bps; |
601 | u_int32_t bearer_type; |
602 | u_int32_t framing_type; |
603 | u_int16_t rxwindow_size; |
604 | u_int16_t proc_delay; |
605 | u_int8_t phone_num[64]; |
606 | u_int8_t sub_addr[64]; |
607 | }; |
608 | |
609 | #define PF_PPTP_CTRL_TYPE_CALL_OUT_RPY 8 |
610 | struct pf_pptp_ctrl_call_out_rpy { |
611 | u_int16_t call_id; |
612 | u_int16_t peer_call_id; |
613 | u_int8_t result_code; |
614 | u_int8_t error_code; |
615 | u_int16_t cause_code; |
616 | u_int32_t connect_speed; |
617 | u_int16_t rxwindow_size; |
618 | u_int16_t proc_delay; |
619 | u_int32_t phy_channel_id; |
620 | }; |
621 | |
622 | #define PF_PPTP_CTRL_TYPE_CALL_IN_1ST 9 |
623 | struct pf_pptp_ctrl_call_in_1st { |
624 | u_int16_t call_id; |
625 | u_int16_t call_sernum; |
626 | u_int32_t bearer_type; |
627 | u_int32_t phy_channel_id; |
628 | u_int16_t dialed_number_len; |
629 | u_int16_t dialing_number_len; |
630 | u_int8_t dialed_num[64]; |
631 | u_int8_t dialing_num[64]; |
632 | u_int8_t sub_addr[64]; |
633 | }; |
634 | |
635 | #define PF_PPTP_CTRL_TYPE_CALL_IN_2ND 10 |
636 | struct pf_pptp_ctrl_call_in_2nd { |
637 | u_int16_t call_id; |
638 | u_int16_t peer_call_id; |
639 | u_int8_t result_code; |
640 | u_int8_t error_code; |
641 | u_int16_t rxwindow_size; |
642 | u_int16_t txdelay; |
643 | u_int16_t reserved_1; |
644 | }; |
645 | |
646 | #define PF_PPTP_CTRL_TYPE_CALL_IN_3RD 11 |
647 | struct pf_pptp_ctrl_call_in_3rd { |
648 | u_int16_t call_id; |
649 | u_int16_t reserved_1; |
650 | u_int32_t connect_speed; |
651 | u_int16_t rxwindow_size; |
652 | u_int16_t txdelay; |
653 | u_int32_t framing_type; |
654 | }; |
655 | |
656 | #define PF_PPTP_CTRL_TYPE_CALL_CLR 12 |
657 | struct pf_pptp_ctrl_call_clr { |
658 | u_int16_t call_id; |
659 | u_int16_t reserved_1; |
660 | }; |
661 | |
662 | #define PF_PPTP_CTRL_TYPE_CALL_DISC 13 |
663 | struct pf_pptp_ctrl_call_disc { |
664 | u_int16_t call_id; |
665 | u_int8_t result_code; |
666 | u_int8_t error_code; |
667 | u_int16_t cause_code; |
668 | u_int16_t reserved_1; |
669 | u_int8_t statistics[128]; |
670 | }; |
671 | |
672 | #define PF_PPTP_CTRL_TYPE_ERROR 14 |
673 | struct pf_pptp_ctrl_error { |
674 | u_int16_t peer_call_id; |
675 | u_int16_t reserved_1; |
676 | u_int32_t crc_errors; |
677 | u_int32_t fr_errors; |
678 | u_int32_t hw_errors; |
679 | u_int32_t buf_errors; |
680 | u_int32_t tim_errors; |
681 | u_int32_t align_errors; |
682 | }; |
683 | |
684 | #define PF_PPTP_CTRL_TYPE_SET_LINKINFO 15 |
685 | struct pf_pptp_ctrl_set_linkinfo { |
686 | u_int16_t peer_call_id; |
687 | u_int16_t reserved_1; |
688 | u_int32_t tx_accm; |
689 | u_int32_t rx_accm; |
690 | }; |
691 | |
692 | static const size_t PF_PPTP_CTRL_MSG_MINSIZE = |
693 | sizeof(struct pf_pptp_hdr) + sizeof(struct pf_pptp_ctrl_hdr); |
694 | |
695 | union pf_pptp_ctrl_msg_union { |
696 | struct pf_pptp_ctrl_start_req start_req; |
697 | struct pf_pptp_ctrl_start_rpy start_rpy; |
698 | struct pf_pptp_ctrl_stop_req stop_req; |
699 | struct pf_pptp_ctrl_stop_rpy stop_rpy; |
700 | struct pf_pptp_ctrl_echo_req echo_req; |
701 | struct pf_pptp_ctrl_echo_rpy echo_rpy; |
702 | struct pf_pptp_ctrl_call_out_req call_out_req; |
703 | struct pf_pptp_ctrl_call_out_rpy call_out_rpy; |
704 | struct pf_pptp_ctrl_call_in_1st call_in_1st; |
705 | struct pf_pptp_ctrl_call_in_2nd call_in_2nd; |
706 | struct pf_pptp_ctrl_call_in_3rd call_in_3rd; |
707 | struct pf_pptp_ctrl_call_clr call_clr; |
708 | struct pf_pptp_ctrl_call_disc call_disc; |
709 | struct pf_pptp_ctrl_error error; |
710 | struct pf_pptp_ctrl_set_linkinfo set_linkinfo; |
711 | u_int8_t data[0]; |
712 | }; |
713 | |
714 | struct pf_pptp_ctrl_msg { |
715 | struct pf_pptp_hdr hdr; |
716 | struct pf_pptp_ctrl_hdr ctrl; |
717 | union pf_pptp_ctrl_msg_union msg; |
718 | }; |
719 | |
720 | #define PF_GRE_FLAG_CHECKSUM_PRESENT 0x8000 |
721 | #define PF_GRE_FLAG_VERSION_MASK 0x0007 |
722 | #define PF_GRE_PPP_ETHERTYPE 0x880B |
723 | |
724 | struct pf_grev1_hdr { |
725 | u_int16_t flags; |
726 | u_int16_t protocol_type; |
727 | u_int16_t payload_length; |
728 | u_int16_t call_id; |
729 | /* |
730 | * u_int32_t seqno; |
731 | * u_int32_t ackno; |
732 | */ |
733 | }; |
734 | |
735 | static const u_int16_t PF_IKE_PORT = 500; |
736 | |
737 | struct pf_ike_hdr { |
738 | u_int64_t initiator_cookie, responder_cookie; |
739 | u_int8_t next_payload, version, exchange_type, flags; |
740 | u_int32_t message_id, length; |
741 | }; |
742 | |
743 | #define PF_IKE_PACKET_MINSIZE (sizeof (struct pf_ike_hdr)) |
744 | |
745 | #define PF_IKEv1_EXCHTYPE_BASE 1 |
746 | #define PF_IKEv1_EXCHTYPE_ID_PROTECT 2 |
747 | #define PF_IKEv1_EXCHTYPE_AUTH_ONLY 3 |
748 | #define PF_IKEv1_EXCHTYPE_AGGRESSIVE 4 |
749 | #define PF_IKEv1_EXCHTYPE_INFORMATIONAL 5 |
750 | #define PF_IKEv2_EXCHTYPE_SA_INIT 34 |
751 | #define PF_IKEv2_EXCHTYPE_AUTH 35 |
752 | #define PF_IKEv2_EXCHTYPE_CREATE_CHILD_SA 36 |
753 | #define PF_IKEv2_EXCHTYPE_INFORMATIONAL 37 |
754 | |
755 | #define PF_IKEv1_FLAG_E 0x01 |
756 | #define PF_IKEv1_FLAG_C 0x02 |
757 | #define PF_IKEv1_FLAG_A 0x04 |
758 | #define PF_IKEv2_FLAG_I 0x08 |
759 | #define PF_IKEv2_FLAG_V 0x10 |
760 | #define PF_IKEv2_FLAG_R 0x20 |
761 | |
762 | struct pf_esp_hdr { |
763 | u_int32_t spi; |
764 | u_int32_t seqno; |
765 | u_int8_t payload[]; |
766 | }; |
767 | |
768 | static __inline int |
769 | pf_addr_compare(struct pf_addr *a, struct pf_addr *b, sa_family_t af) |
770 | { |
771 | switch (af) { |
772 | #ifdef INET |
773 | case AF_INET: |
774 | if (a->addr32[0] > b->addr32[0]) { |
775 | return 1; |
776 | } |
777 | if (a->addr32[0] < b->addr32[0]) { |
778 | return -1; |
779 | } |
780 | break; |
781 | #endif /* INET */ |
782 | case AF_INET6: |
783 | if (a->addr32[3] > b->addr32[3]) { |
784 | return 1; |
785 | } |
786 | if (a->addr32[3] < b->addr32[3]) { |
787 | return -1; |
788 | } |
789 | if (a->addr32[2] > b->addr32[2]) { |
790 | return 1; |
791 | } |
792 | if (a->addr32[2] < b->addr32[2]) { |
793 | return -1; |
794 | } |
795 | if (a->addr32[1] > b->addr32[1]) { |
796 | return 1; |
797 | } |
798 | if (a->addr32[1] < b->addr32[1]) { |
799 | return -1; |
800 | } |
801 | if (a->addr32[0] > b->addr32[0]) { |
802 | return 1; |
803 | } |
804 | if (a->addr32[0] < b->addr32[0]) { |
805 | return -1; |
806 | } |
807 | break; |
808 | } |
809 | return 0; |
810 | } |
811 | |
812 | static __inline int |
813 | pf_src_compare(struct pf_src_node *a, struct pf_src_node *b) |
814 | { |
815 | int diff; |
816 | |
817 | if (a->rule.ptr > b->rule.ptr) { |
818 | return 1; |
819 | } |
820 | if (a->rule.ptr < b->rule.ptr) { |
821 | return -1; |
822 | } |
823 | if ((diff = a->af - b->af) != 0) { |
824 | return diff; |
825 | } |
826 | if ((diff = pf_addr_compare(a: &a->addr, b: &b->addr, af: a->af)) != 0) { |
827 | return diff; |
828 | } |
829 | return 0; |
830 | } |
831 | |
832 | static __inline int |
833 | pf_state_compare_lan_ext(struct pf_state_key *a, struct pf_state_key *b) |
834 | { |
835 | int diff; |
836 | int extfilter; |
837 | |
838 | if ((diff = a->proto - b->proto) != 0) { |
839 | return diff; |
840 | } |
841 | if ((diff = a->af_lan - b->af_lan) != 0) { |
842 | return diff; |
843 | } |
844 | |
845 | extfilter = PF_EXTFILTER_APD; |
846 | |
847 | switch (a->proto) { |
848 | case IPPROTO_ICMP: |
849 | case IPPROTO_ICMPV6: |
850 | if ((diff = a->lan.xport.port - b->lan.xport.port) != 0) { |
851 | return diff; |
852 | } |
853 | break; |
854 | |
855 | case IPPROTO_TCP: |
856 | if ((diff = a->lan.xport.port - b->lan.xport.port) != 0) { |
857 | return diff; |
858 | } |
859 | if ((diff = a->ext_lan.xport.port - b->ext_lan.xport.port) != 0) { |
860 | return diff; |
861 | } |
862 | break; |
863 | |
864 | case IPPROTO_UDP: |
865 | if ((diff = a->proto_variant - b->proto_variant)) { |
866 | return diff; |
867 | } |
868 | extfilter = a->proto_variant; |
869 | if ((diff = a->lan.xport.port - b->lan.xport.port) != 0) { |
870 | return diff; |
871 | } |
872 | if ((extfilter < PF_EXTFILTER_AD) && |
873 | (diff = a->ext_lan.xport.port - b->ext_lan.xport.port) != 0) { |
874 | return diff; |
875 | } |
876 | break; |
877 | |
878 | case IPPROTO_GRE: |
879 | if (a->proto_variant == PF_GRE_PPTP_VARIANT && |
880 | a->proto_variant == b->proto_variant) { |
881 | if (!!(diff = a->ext_lan.xport.call_id - |
882 | b->ext_lan.xport.call_id)) { |
883 | return diff; |
884 | } |
885 | } |
886 | break; |
887 | |
888 | case IPPROTO_ESP: |
889 | if (!!(diff = a->ext_lan.xport.spi - b->ext_lan.xport.spi)) { |
890 | return diff; |
891 | } |
892 | break; |
893 | |
894 | default: |
895 | break; |
896 | } |
897 | |
898 | switch (a->af_lan) { |
899 | #if INET |
900 | case AF_INET: |
901 | if ((diff = pf_addr_compare(a: &a->lan.addr, b: &b->lan.addr, |
902 | af: a->af_lan)) != 0) { |
903 | return diff; |
904 | } |
905 | |
906 | if (extfilter < PF_EXTFILTER_EI) { |
907 | if ((diff = pf_addr_compare(a: &a->ext_lan.addr, |
908 | b: &b->ext_lan.addr, |
909 | af: a->af_lan)) != 0) { |
910 | return diff; |
911 | } |
912 | } |
913 | break; |
914 | #endif /* INET */ |
915 | case AF_INET6: |
916 | if ((diff = pf_addr_compare(a: &a->lan.addr, b: &b->lan.addr, |
917 | af: a->af_lan)) != 0) { |
918 | return diff; |
919 | } |
920 | |
921 | if (extfilter < PF_EXTFILTER_EI || |
922 | !PF_AZERO(&b->ext_lan.addr, AF_INET6)) { |
923 | if ((diff = pf_addr_compare(a: &a->ext_lan.addr, |
924 | b: &b->ext_lan.addr, |
925 | af: a->af_lan)) != 0) { |
926 | return diff; |
927 | } |
928 | } |
929 | break; |
930 | } |
931 | |
932 | if (a->app_state && b->app_state) { |
933 | if (a->app_state->compare_lan_ext && |
934 | b->app_state->compare_lan_ext) { |
935 | diff = (const char *)b->app_state->compare_lan_ext - |
936 | (const char *)a->app_state->compare_lan_ext; |
937 | if (diff != 0) { |
938 | return diff; |
939 | } |
940 | diff = a->app_state->compare_lan_ext(a->app_state, |
941 | b->app_state); |
942 | if (diff != 0) { |
943 | return diff; |
944 | } |
945 | } |
946 | } |
947 | |
948 | return 0; |
949 | } |
950 | |
951 | static __inline int |
952 | pf_state_compare_ext_gwy(struct pf_state_key *a, struct pf_state_key *b) |
953 | { |
954 | int diff; |
955 | int extfilter; |
956 | int a_nat64, b_nat64; |
957 | |
958 | if ((diff = a->proto - b->proto) != 0) { |
959 | return diff; |
960 | } |
961 | |
962 | if ((diff = a->af_gwy - b->af_gwy) != 0) { |
963 | return diff; |
964 | } |
965 | |
966 | a_nat64 = (a->af_lan == PF_INET6 && a->af_gwy == PF_INET) ? 1 : 0; |
967 | b_nat64 = (b->af_lan == PF_INET6 && b->af_gwy == PF_INET) ? 1 : 0; |
968 | if ((diff = a_nat64 - b_nat64) != 0) { |
969 | return diff; |
970 | } |
971 | |
972 | extfilter = PF_EXTFILTER_APD; |
973 | |
974 | switch (a->proto) { |
975 | case IPPROTO_ICMP: |
976 | case IPPROTO_ICMPV6: |
977 | if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0) { |
978 | return diff; |
979 | } |
980 | break; |
981 | |
982 | case IPPROTO_TCP: |
983 | if ((diff = a->ext_gwy.xport.port - b->ext_gwy.xport.port) != 0) { |
984 | return diff; |
985 | } |
986 | if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0) { |
987 | return diff; |
988 | } |
989 | break; |
990 | |
991 | case IPPROTO_UDP: |
992 | if ((diff = a->proto_variant - b->proto_variant)) { |
993 | return diff; |
994 | } |
995 | extfilter = a->proto_variant; |
996 | if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0) { |
997 | return diff; |
998 | } |
999 | if ((extfilter < PF_EXTFILTER_AD) && |
1000 | (diff = a->ext_gwy.xport.port - b->ext_gwy.xport.port) != 0) { |
1001 | return diff; |
1002 | } |
1003 | break; |
1004 | |
1005 | case IPPROTO_GRE: |
1006 | if (a->proto_variant == PF_GRE_PPTP_VARIANT && |
1007 | a->proto_variant == b->proto_variant) { |
1008 | if (!!(diff = a->gwy.xport.call_id - |
1009 | b->gwy.xport.call_id)) { |
1010 | return diff; |
1011 | } |
1012 | } |
1013 | break; |
1014 | |
1015 | case IPPROTO_ESP: |
1016 | if (!!(diff = a->gwy.xport.spi - b->gwy.xport.spi)) { |
1017 | return diff; |
1018 | } |
1019 | break; |
1020 | |
1021 | default: |
1022 | break; |
1023 | } |
1024 | |
1025 | switch (a->af_gwy) { |
1026 | #if INET |
1027 | case AF_INET: |
1028 | if ((diff = pf_addr_compare(a: &a->gwy.addr, b: &b->gwy.addr, |
1029 | af: a->af_gwy)) != 0) { |
1030 | return diff; |
1031 | } |
1032 | |
1033 | if (extfilter < PF_EXTFILTER_EI) { |
1034 | if ((diff = pf_addr_compare(a: &a->ext_gwy.addr, b: &b->ext_gwy.addr, |
1035 | af: a->af_gwy)) != 0) { |
1036 | return diff; |
1037 | } |
1038 | } |
1039 | break; |
1040 | #endif /* INET */ |
1041 | case AF_INET6: |
1042 | if ((diff = pf_addr_compare(a: &a->gwy.addr, b: &b->gwy.addr, |
1043 | af: a->af_gwy)) != 0) { |
1044 | return diff; |
1045 | } |
1046 | |
1047 | if (extfilter < PF_EXTFILTER_EI || |
1048 | !PF_AZERO(&b->ext_gwy.addr, AF_INET6)) { |
1049 | if ((diff = pf_addr_compare(a: &a->ext_gwy.addr, b: &b->ext_gwy.addr, |
1050 | af: a->af_gwy)) != 0) { |
1051 | return diff; |
1052 | } |
1053 | } |
1054 | break; |
1055 | } |
1056 | |
1057 | if (a->app_state && b->app_state) { |
1058 | if (a->app_state->compare_ext_gwy && |
1059 | b->app_state->compare_ext_gwy) { |
1060 | diff = (const char *)b->app_state->compare_ext_gwy - |
1061 | (const char *)a->app_state->compare_ext_gwy; |
1062 | if (diff != 0) { |
1063 | return diff; |
1064 | } |
1065 | diff = a->app_state->compare_ext_gwy(a->app_state, |
1066 | b->app_state); |
1067 | if (diff != 0) { |
1068 | return diff; |
1069 | } |
1070 | } |
1071 | } |
1072 | |
1073 | return 0; |
1074 | } |
1075 | |
1076 | static __inline int |
1077 | pf_state_compare_id(struct pf_state *a, struct pf_state *b) |
1078 | { |
1079 | if (a->id > b->id) { |
1080 | return 1; |
1081 | } |
1082 | if (a->id < b->id) { |
1083 | return -1; |
1084 | } |
1085 | if (a->creatorid > b->creatorid) { |
1086 | return 1; |
1087 | } |
1088 | if (a->creatorid < b->creatorid) { |
1089 | return -1; |
1090 | } |
1091 | |
1092 | return 0; |
1093 | } |
1094 | |
1095 | void |
1096 | pf_addrcpy(struct pf_addr *dst, struct pf_addr *src, sa_family_t af) |
1097 | { |
1098 | switch (af) { |
1099 | #if INET |
1100 | case AF_INET: |
1101 | dst->addr32[0] = src->addr32[0]; |
1102 | break; |
1103 | #endif /* INET */ |
1104 | case AF_INET6: |
1105 | dst->addr32[0] = src->addr32[0]; |
1106 | dst->addr32[1] = src->addr32[1]; |
1107 | dst->addr32[2] = src->addr32[2]; |
1108 | dst->addr32[3] = src->addr32[3]; |
1109 | break; |
1110 | } |
1111 | } |
1112 | |
1113 | struct pf_state * |
1114 | pf_find_state_byid(struct pf_state_cmp *key) |
1115 | { |
1116 | pf_status.fcounters[FCNT_STATE_SEARCH]++; |
1117 | |
1118 | return RB_FIND(pf_state_tree_id, &tree_id, |
1119 | (struct pf_state *)(void *)key); |
1120 | } |
1121 | |
1122 | static struct pf_state * |
1123 | pf_find_state(struct pfi_kif *kif, struct pf_state_key_cmp *key, u_int dir) |
1124 | { |
1125 | struct pf_state_key *sk = NULL; |
1126 | struct pf_state *s; |
1127 | |
1128 | pf_status.fcounters[FCNT_STATE_SEARCH]++; |
1129 | |
1130 | switch (dir) { |
1131 | case PF_OUT: |
1132 | sk = RB_FIND(pf_state_tree_lan_ext, &pf_statetbl_lan_ext, |
1133 | (struct pf_state_key *)key); |
1134 | |
1135 | break; |
1136 | case PF_IN: |
1137 | |
1138 | /* |
1139 | * Generally, a packet can match to |
1140 | * at most 1 state in the GWY table, with the sole exception |
1141 | * of NAT64, where a packet can match with at most 2 states |
1142 | * on the GWY table. This is because, unlike NAT44 or NAT66, |
1143 | * NAT64 forward translation is done on the input, not output. |
1144 | * This means a forwarded packet could cause PF to generate 2 states |
1145 | * on both input and output. |
1146 | * |
1147 | * NAT64 reverse translation is done on input. If a packet |
1148 | * matches NAT64 state on the GWY table, prioritize it |
1149 | * over any IPv4 state on the GWY table. |
1150 | */ |
1151 | if (pf_state_tree_ext_gwy_nat64_cnt > 0 && |
1152 | key->af_lan == PF_INET && key->af_gwy == PF_INET) { |
1153 | key->af_lan = PF_INET6; |
1154 | sk = RB_FIND(pf_state_tree_ext_gwy, &pf_statetbl_ext_gwy, |
1155 | (struct pf_state_key *) key); |
1156 | key->af_lan = PF_INET; |
1157 | } |
1158 | |
1159 | if (sk == NULL) { |
1160 | sk = RB_FIND(pf_state_tree_ext_gwy, &pf_statetbl_ext_gwy, |
1161 | (struct pf_state_key *)key); |
1162 | } |
1163 | /* |
1164 | * NAT64 is done only on input, for packets coming in from |
1165 | * from the LAN side, need to lookup the lan_ext tree. |
1166 | */ |
1167 | if (sk == NULL) { |
1168 | sk = RB_FIND(pf_state_tree_lan_ext, |
1169 | &pf_statetbl_lan_ext, |
1170 | (struct pf_state_key *)key); |
1171 | if (sk && sk->af_lan == sk->af_gwy) { |
1172 | sk = NULL; |
1173 | } |
1174 | } |
1175 | break; |
1176 | default: |
1177 | panic("pf_find_state" ); |
1178 | } |
1179 | |
1180 | /* list is sorted, if-bound states before floating ones */ |
1181 | if (sk != NULL) { |
1182 | TAILQ_FOREACH(s, &sk->states, next) |
1183 | if (s->kif == pfi_all || s->kif == kif) { |
1184 | return s; |
1185 | } |
1186 | } |
1187 | |
1188 | return NULL; |
1189 | } |
1190 | |
1191 | struct pf_state * |
1192 | pf_find_state_all(struct pf_state_key_cmp *key, u_int dir, int *more) |
1193 | { |
1194 | struct pf_state_key *sk = NULL; |
1195 | struct pf_state *s, *ret = NULL; |
1196 | |
1197 | pf_status.fcounters[FCNT_STATE_SEARCH]++; |
1198 | |
1199 | switch (dir) { |
1200 | case PF_OUT: |
1201 | sk = RB_FIND(pf_state_tree_lan_ext, |
1202 | &pf_statetbl_lan_ext, (struct pf_state_key *)key); |
1203 | break; |
1204 | case PF_IN: |
1205 | sk = RB_FIND(pf_state_tree_ext_gwy, |
1206 | &pf_statetbl_ext_gwy, (struct pf_state_key *)key); |
1207 | /* |
1208 | * NAT64 is done only on input, for packets coming in from |
1209 | * from the LAN side, need to lookup the lan_ext tree. |
1210 | */ |
1211 | if ((sk == NULL) && pf_nat64_configured) { |
1212 | sk = RB_FIND(pf_state_tree_lan_ext, |
1213 | &pf_statetbl_lan_ext, |
1214 | (struct pf_state_key *)key); |
1215 | if (sk && sk->af_lan == sk->af_gwy) { |
1216 | sk = NULL; |
1217 | } |
1218 | } |
1219 | break; |
1220 | default: |
1221 | panic("pf_find_state_all" ); |
1222 | } |
1223 | |
1224 | if (sk != NULL) { |
1225 | ret = TAILQ_FIRST(&sk->states); |
1226 | if (more == NULL) { |
1227 | return ret; |
1228 | } |
1229 | |
1230 | TAILQ_FOREACH(s, &sk->states, next) |
1231 | (*more)++; |
1232 | } |
1233 | |
1234 | return ret; |
1235 | } |
1236 | |
1237 | static void |
1238 | pf_init_threshold(struct pf_threshold *threshold, |
1239 | u_int32_t limit, u_int32_t seconds) |
1240 | { |
1241 | threshold->limit = limit * PF_THRESHOLD_MULT; |
1242 | threshold->seconds = seconds; |
1243 | threshold->count = 0; |
1244 | threshold->last = pf_time_second(); |
1245 | } |
1246 | |
1247 | static void |
1248 | pf_add_threshold(struct pf_threshold *threshold) |
1249 | { |
1250 | u_int32_t t = pf_time_second(), diff = t - threshold->last; |
1251 | |
1252 | if (diff >= threshold->seconds) { |
1253 | threshold->count = 0; |
1254 | } else { |
1255 | threshold->count -= threshold->count * diff / |
1256 | threshold->seconds; |
1257 | } |
1258 | threshold->count += PF_THRESHOLD_MULT; |
1259 | threshold->last = t; |
1260 | } |
1261 | |
1262 | static int |
1263 | pf_check_threshold(struct pf_threshold *threshold) |
1264 | { |
1265 | return threshold->count > threshold->limit; |
1266 | } |
1267 | |
1268 | static int |
1269 | pf_src_connlimit(struct pf_state **state) |
1270 | { |
1271 | int bad = 0; |
1272 | (*state)->src_node->conn++; |
1273 | VERIFY((*state)->src_node->conn != 0); |
1274 | (*state)->src.tcp_est = 1; |
1275 | pf_add_threshold(threshold: &(*state)->src_node->conn_rate); |
1276 | |
1277 | if ((*state)->rule.ptr->max_src_conn && |
1278 | (*state)->rule.ptr->max_src_conn < |
1279 | (*state)->src_node->conn) { |
1280 | pf_status.lcounters[LCNT_SRCCONN]++; |
1281 | bad++; |
1282 | } |
1283 | |
1284 | if ((*state)->rule.ptr->max_src_conn_rate.limit && |
1285 | pf_check_threshold(threshold: &(*state)->src_node->conn_rate)) { |
1286 | pf_status.lcounters[LCNT_SRCCONNRATE]++; |
1287 | bad++; |
1288 | } |
1289 | |
1290 | if (!bad) { |
1291 | return 0; |
1292 | } |
1293 | |
1294 | if ((*state)->rule.ptr->overload_tbl) { |
1295 | struct pfr_addr p; |
1296 | u_int32_t killed = 0; |
1297 | |
1298 | pf_status.lcounters[LCNT_OVERLOAD_TABLE]++; |
1299 | if (pf_status.debug >= PF_DEBUG_MISC) { |
1300 | printf("pf_src_connlimit: blocking address " ); |
1301 | pf_print_host(&(*state)->src_node->addr, 0, |
1302 | (*state)->state_key->af_lan); |
1303 | } |
1304 | |
1305 | bzero(s: &p, n: sizeof(p)); |
1306 | p.pfra_af = (*state)->state_key->af_lan; |
1307 | switch ((*state)->state_key->af_lan) { |
1308 | #if INET |
1309 | case AF_INET: |
1310 | p.pfra_net = 32; |
1311 | p.pfra_ip4addr = (*state)->src_node->addr.v4addr; |
1312 | break; |
1313 | #endif /* INET */ |
1314 | case AF_INET6: |
1315 | p.pfra_net = 128; |
1316 | p.pfra_ip6addr = (*state)->src_node->addr.v6addr; |
1317 | break; |
1318 | } |
1319 | |
1320 | pfr_insert_kentry((*state)->rule.ptr->overload_tbl, |
1321 | &p, pf_calendar_time_second()); |
1322 | |
1323 | /* kill existing states if that's required. */ |
1324 | if ((*state)->rule.ptr->flush) { |
1325 | struct pf_state_key *sk; |
1326 | struct pf_state *st; |
1327 | |
1328 | pf_status.lcounters[LCNT_OVERLOAD_FLUSH]++; |
1329 | RB_FOREACH(st, pf_state_tree_id, &tree_id) { |
1330 | sk = st->state_key; |
1331 | /* |
1332 | * Kill states from this source. (Only those |
1333 | * from the same rule if PF_FLUSH_GLOBAL is not |
1334 | * set) |
1335 | */ |
1336 | if (sk->af_lan == |
1337 | (*state)->state_key->af_lan && |
1338 | (((*state)->state_key->direction == |
1339 | PF_OUT && |
1340 | PF_AEQ(&(*state)->src_node->addr, |
1341 | &sk->lan.addr, sk->af_lan)) || |
1342 | ((*state)->state_key->direction == PF_IN && |
1343 | PF_AEQ(&(*state)->src_node->addr, |
1344 | &sk->ext_lan.addr, sk->af_lan))) && |
1345 | ((*state)->rule.ptr->flush & |
1346 | PF_FLUSH_GLOBAL || |
1347 | (*state)->rule.ptr == st->rule.ptr)) { |
1348 | st->timeout = PFTM_PURGE; |
1349 | st->src.state = st->dst.state = |
1350 | TCPS_CLOSED; |
1351 | killed++; |
1352 | } |
1353 | } |
1354 | if (pf_status.debug >= PF_DEBUG_MISC) { |
1355 | printf(", %u states killed" , killed); |
1356 | } |
1357 | } |
1358 | if (pf_status.debug >= PF_DEBUG_MISC) { |
1359 | printf("\n" ); |
1360 | } |
1361 | } |
1362 | |
1363 | /* kill this state */ |
1364 | (*state)->timeout = PFTM_PURGE; |
1365 | (*state)->src.state = (*state)->dst.state = TCPS_CLOSED; |
1366 | return 1; |
1367 | } |
1368 | |
1369 | int |
1370 | pf_insert_src_node(struct pf_src_node **sn, struct pf_rule *rule, |
1371 | struct pf_addr *src, sa_family_t af) |
1372 | { |
1373 | struct pf_src_node k; |
1374 | |
1375 | if (*sn == NULL) { |
1376 | k.af = af; |
1377 | PF_ACPY(&k.addr, src, af); |
1378 | if (rule->rule_flag & PFRULE_RULESRCTRACK || |
1379 | rule->rpool.opts & PF_POOL_STICKYADDR) { |
1380 | k.rule.ptr = rule; |
1381 | } else { |
1382 | k.rule.ptr = NULL; |
1383 | } |
1384 | pf_status.scounters[SCNT_SRC_NODE_SEARCH]++; |
1385 | *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k); |
1386 | } |
1387 | if (*sn == NULL) { |
1388 | if (!rule->max_src_nodes || |
1389 | rule->src_nodes < rule->max_src_nodes) { |
1390 | (*sn) = pool_get(&pf_src_tree_pl, PR_WAITOK); |
1391 | } else { |
1392 | pf_status.lcounters[LCNT_SRCNODES]++; |
1393 | } |
1394 | if ((*sn) == NULL) { |
1395 | return -1; |
1396 | } |
1397 | bzero(s: *sn, n: sizeof(struct pf_src_node)); |
1398 | |
1399 | pf_init_threshold(threshold: &(*sn)->conn_rate, |
1400 | limit: rule->max_src_conn_rate.limit, |
1401 | seconds: rule->max_src_conn_rate.seconds); |
1402 | |
1403 | (*sn)->af = af; |
1404 | if (rule->rule_flag & PFRULE_RULESRCTRACK || |
1405 | rule->rpool.opts & PF_POOL_STICKYADDR) { |
1406 | (*sn)->rule.ptr = rule; |
1407 | } else { |
1408 | (*sn)->rule.ptr = NULL; |
1409 | } |
1410 | PF_ACPY(&(*sn)->addr, src, af); |
1411 | if (RB_INSERT(pf_src_tree, |
1412 | &tree_src_tracking, *sn) != NULL) { |
1413 | if (pf_status.debug >= PF_DEBUG_MISC) { |
1414 | printf("pf: src_tree insert failed: " ); |
1415 | pf_print_host(&(*sn)->addr, 0, af); |
1416 | printf("\n" ); |
1417 | } |
1418 | pool_put(&pf_src_tree_pl, *sn); |
1419 | *sn = NULL; /* signal the caller that no additional cleanup is needed */ |
1420 | return -1; |
1421 | } |
1422 | (*sn)->creation = pf_time_second(); |
1423 | (*sn)->ruletype = rule->action; |
1424 | if ((*sn)->rule.ptr != NULL) { |
1425 | (*sn)->rule.ptr->src_nodes++; |
1426 | } |
1427 | pf_status.scounters[SCNT_SRC_NODE_INSERT]++; |
1428 | pf_status.src_nodes++; |
1429 | } else { |
1430 | if (rule->max_src_states && |
1431 | (*sn)->states >= rule->max_src_states) { |
1432 | pf_status.lcounters[LCNT_SRCSTATES]++; |
1433 | return -1; |
1434 | } |
1435 | } |
1436 | return 0; |
1437 | } |
1438 | |
1439 | static void |
1440 | pf_stateins_err(const char *tree, struct pf_state *s, struct pfi_kif *kif) |
1441 | { |
1442 | struct pf_state_key *sk = s->state_key; |
1443 | |
1444 | if (pf_status.debug >= PF_DEBUG_MISC) { |
1445 | printf("pf: state insert failed: %s %s " , tree, kif->pfik_name); |
1446 | switch (sk->proto) { |
1447 | case IPPROTO_TCP: |
1448 | printf("TCP" ); |
1449 | break; |
1450 | case IPPROTO_UDP: |
1451 | printf("UDP" ); |
1452 | break; |
1453 | case IPPROTO_ICMP: |
1454 | printf("ICMP4" ); |
1455 | break; |
1456 | case IPPROTO_ICMPV6: |
1457 | printf("ICMP6" ); |
1458 | break; |
1459 | default: |
1460 | printf("PROTO=%u" , sk->proto); |
1461 | break; |
1462 | } |
1463 | printf(" lan: " ); |
1464 | pf_print_sk_host(&sk->lan, sk->af_lan, sk->proto, |
1465 | sk->proto_variant); |
1466 | printf(" gwy: " ); |
1467 | pf_print_sk_host(&sk->gwy, sk->af_gwy, sk->proto, |
1468 | sk->proto_variant); |
1469 | printf(" ext_lan: " ); |
1470 | pf_print_sk_host(&sk->ext_lan, sk->af_lan, sk->proto, |
1471 | sk->proto_variant); |
1472 | printf(" ext_gwy: " ); |
1473 | pf_print_sk_host(&sk->ext_gwy, sk->af_gwy, sk->proto, |
1474 | sk->proto_variant); |
1475 | if (s->sync_flags & PFSTATE_FROMSYNC) { |
1476 | printf(" (from sync)" ); |
1477 | } |
1478 | printf("\n" ); |
1479 | } |
1480 | } |
1481 | |
1482 | static __inline struct pf_state_key * |
1483 | pf_insert_state_key_ext_gwy(struct pf_state_key *psk) |
1484 | { |
1485 | struct pf_state_key * ret = RB_INSERT(pf_state_tree_ext_gwy, |
1486 | &pf_statetbl_ext_gwy, psk); |
1487 | if (!ret && psk->af_lan == PF_INET6 && |
1488 | psk->af_gwy == PF_INET) { |
1489 | pf_state_tree_ext_gwy_nat64_cnt++; |
1490 | } |
1491 | return ret; |
1492 | } |
1493 | |
1494 | static __inline struct pf_state_key * |
1495 | pf_remove_state_key_ext_gwy(struct pf_state_key *psk) |
1496 | { |
1497 | struct pf_state_key * ret = RB_REMOVE(pf_state_tree_ext_gwy, |
1498 | &pf_statetbl_ext_gwy, psk); |
1499 | if (ret && psk->af_lan == PF_INET6 && |
1500 | psk->af_gwy == PF_INET) { |
1501 | pf_state_tree_ext_gwy_nat64_cnt--; |
1502 | } |
1503 | return ret; |
1504 | } |
1505 | |
1506 | int |
1507 | pf_insert_state(struct pfi_kif *kif, struct pf_state *s) |
1508 | { |
1509 | struct pf_state_key *cur; |
1510 | struct pf_state *sp; |
1511 | |
1512 | VERIFY(s->state_key != NULL); |
1513 | s->kif = kif; |
1514 | |
1515 | if ((cur = RB_INSERT(pf_state_tree_lan_ext, &pf_statetbl_lan_ext, |
1516 | s->state_key)) != NULL) { |
1517 | /* key exists. check for same kif, if none, add to key */ |
1518 | TAILQ_FOREACH(sp, &cur->states, next) |
1519 | if (sp->kif == kif) { /* collision! */ |
1520 | pf_stateins_err(tree: "tree_lan_ext" , s, kif); |
1521 | pf_detach_state(s, |
1522 | PF_DT_SKIP_LANEXT | PF_DT_SKIP_EXTGWY); |
1523 | return -1; |
1524 | } |
1525 | pf_detach_state(s, PF_DT_SKIP_LANEXT | PF_DT_SKIP_EXTGWY); |
1526 | pf_attach_state(cur, s, kif == pfi_all ? 1 : 0); |
1527 | } |
1528 | |
1529 | /* if cur != NULL, we already found a state key and attached to it */ |
1530 | if (cur == NULL && |
1531 | (cur = pf_insert_state_key_ext_gwy(psk: s->state_key)) != NULL) { |
1532 | /* must not happen. we must have found the sk above! */ |
1533 | pf_stateins_err(tree: "tree_ext_gwy" , s, kif); |
1534 | pf_detach_state(s, PF_DT_SKIP_EXTGWY); |
1535 | return -1; |
1536 | } |
1537 | |
1538 | if (s->id == 0 && s->creatorid == 0) { |
1539 | s->id = htobe64(pf_status.stateid++); |
1540 | s->creatorid = pf_status.hostid; |
1541 | } |
1542 | if (RB_INSERT(pf_state_tree_id, &tree_id, s) != NULL) { |
1543 | if (pf_status.debug >= PF_DEBUG_MISC) { |
1544 | printf("pf: state insert failed: " |
1545 | "id: %016llx creatorid: %08x" , |
1546 | be64toh(s->id), ntohl(s->creatorid)); |
1547 | if (s->sync_flags & PFSTATE_FROMSYNC) { |
1548 | printf(" (from sync)" ); |
1549 | } |
1550 | printf("\n" ); |
1551 | } |
1552 | pf_detach_state(s, 0); |
1553 | return -1; |
1554 | } |
1555 | TAILQ_INSERT_TAIL(&state_list, s, entry_list); |
1556 | pf_status.fcounters[FCNT_STATE_INSERT]++; |
1557 | pf_status.states++; |
1558 | VERIFY(pf_status.states != 0); |
1559 | pfi_kif_ref(kif, PFI_KIF_REF_STATE); |
1560 | #if NPFSYNC |
1561 | pfsync_insert_state(s); |
1562 | #endif |
1563 | return 0; |
1564 | } |
1565 | |
1566 | static int |
1567 | pf_purge_thread_cont(int err) |
1568 | { |
1569 | #pragma unused(err) |
1570 | static u_int32_t nloops = 0; |
1571 | int t = 1; /* 1 second */ |
1572 | |
1573 | /* |
1574 | * Update coarse-grained networking timestamp (in sec.); the idea |
1575 | * is to piggy-back on the periodic timeout callout to update |
1576 | * the counter returnable via net_uptime(). |
1577 | */ |
1578 | net_update_uptime(); |
1579 | |
1580 | lck_rw_lock_shared(lck: &pf_perim_lock); |
1581 | lck_mtx_lock(lck: &pf_lock); |
1582 | |
1583 | /* purge everything if not running */ |
1584 | if (!pf_status.running) { |
1585 | pf_purge_expired_states(pf_status.states); |
1586 | pf_purge_expired_fragments(); |
1587 | pf_purge_expired_src_nodes(); |
1588 | |
1589 | /* terminate thread (we don't currently do this) */ |
1590 | if (pf_purge_thread == NULL) { |
1591 | lck_mtx_unlock(lck: &pf_lock); |
1592 | lck_rw_done(lck: &pf_perim_lock); |
1593 | |
1594 | thread_deallocate(thread: current_thread()); |
1595 | thread_terminate(target_act: current_thread()); |
1596 | /* NOTREACHED */ |
1597 | return 0; |
1598 | } else { |
1599 | /* if there's nothing left, sleep w/o timeout */ |
1600 | if (pf_status.states == 0 && |
1601 | pf_normalize_isempty() && |
1602 | RB_EMPTY(&tree_src_tracking)) { |
1603 | nloops = 0; |
1604 | t = 0; |
1605 | } |
1606 | goto done; |
1607 | } |
1608 | } |
1609 | |
1610 | /* process a fraction of the state table every second */ |
1611 | pf_purge_expired_states(1 + (pf_status.states |
1612 | / pf_default_rule.timeout[PFTM_INTERVAL])); |
1613 | |
1614 | /* purge other expired types every PFTM_INTERVAL seconds */ |
1615 | if (++nloops >= pf_default_rule.timeout[PFTM_INTERVAL]) { |
1616 | pf_purge_expired_fragments(); |
1617 | pf_purge_expired_src_nodes(); |
1618 | nloops = 0; |
1619 | } |
1620 | done: |
1621 | lck_mtx_unlock(lck: &pf_lock); |
1622 | lck_rw_done(lck: &pf_perim_lock); |
1623 | |
1624 | (void) tsleep0(chan: pf_purge_thread_fn, PWAIT, wmesg: "pf_purge_cont" , |
1625 | timo: t * hz, continuation: pf_purge_thread_cont); |
1626 | /* NOTREACHED */ |
1627 | VERIFY(0); |
1628 | |
1629 | return 0; |
1630 | } |
1631 | |
1632 | void |
1633 | pf_purge_thread_fn(void *v, wait_result_t w) |
1634 | { |
1635 | #pragma unused(v, w) |
1636 | (void) tsleep0(chan: pf_purge_thread_fn, PWAIT, wmesg: "pf_purge" , timo: 0, |
1637 | continuation: pf_purge_thread_cont); |
1638 | /* |
1639 | * tsleep0() shouldn't have returned as PCATCH was not set; |
1640 | * therefore assert in this case. |
1641 | */ |
1642 | VERIFY(0); |
1643 | } |
1644 | |
1645 | u_int64_t |
1646 | pf_state_expires(const struct pf_state *state) |
1647 | { |
1648 | u_int32_t t; |
1649 | u_int32_t start; |
1650 | u_int32_t end; |
1651 | u_int32_t states; |
1652 | |
1653 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
1654 | |
1655 | /* handle all PFTM_* > PFTM_MAX here */ |
1656 | if (state->timeout == PFTM_PURGE) { |
1657 | return pf_time_second(); |
1658 | } |
1659 | |
1660 | VERIFY(state->timeout != PFTM_UNLINKED); |
1661 | VERIFY(state->timeout < PFTM_MAX); |
1662 | t = state->rule.ptr->timeout[state->timeout]; |
1663 | if (!t) { |
1664 | t = pf_default_rule.timeout[state->timeout]; |
1665 | } |
1666 | start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START]; |
1667 | if (start) { |
1668 | end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END]; |
1669 | states = state->rule.ptr->states; |
1670 | } else { |
1671 | start = pf_default_rule.timeout[PFTM_ADAPTIVE_START]; |
1672 | end = pf_default_rule.timeout[PFTM_ADAPTIVE_END]; |
1673 | states = pf_status.states; |
1674 | } |
1675 | if (end && states > start && start < end) { |
1676 | if (states < end) { |
1677 | return state->expire + t * (end - states) / |
1678 | (end - start); |
1679 | } else { |
1680 | return pf_time_second(); |
1681 | } |
1682 | } |
1683 | return state->expire + t; |
1684 | } |
1685 | |
1686 | void |
1687 | pf_purge_expired_src_nodes(void) |
1688 | { |
1689 | struct pf_src_node *cur, *next; |
1690 | |
1691 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
1692 | |
1693 | for (cur = RB_MIN(pf_src_tree, &tree_src_tracking); cur; cur = next) { |
1694 | next = RB_NEXT(pf_src_tree, &tree_src_tracking, cur); |
1695 | |
1696 | if (cur->states <= 0 && cur->expire <= pf_time_second()) { |
1697 | if (cur->rule.ptr != NULL) { |
1698 | cur->rule.ptr->src_nodes--; |
1699 | if (cur->rule.ptr->states <= 0 && |
1700 | cur->rule.ptr->max_src_nodes <= 0) { |
1701 | pf_rm_rule(NULL, cur->rule.ptr); |
1702 | } |
1703 | } |
1704 | RB_REMOVE(pf_src_tree, &tree_src_tracking, cur); |
1705 | pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++; |
1706 | pf_status.src_nodes--; |
1707 | pool_put(&pf_src_tree_pl, cur); |
1708 | } |
1709 | } |
1710 | } |
1711 | |
1712 | void |
1713 | pf_src_tree_remove_state(struct pf_state *s) |
1714 | { |
1715 | u_int32_t t; |
1716 | |
1717 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
1718 | |
1719 | if (s->src_node != NULL) { |
1720 | if (s->src.tcp_est) { |
1721 | VERIFY(s->src_node->conn > 0); |
1722 | --s->src_node->conn; |
1723 | } |
1724 | VERIFY(s->src_node->states > 0); |
1725 | if (--s->src_node->states <= 0) { |
1726 | t = s->rule.ptr->timeout[PFTM_SRC_NODE]; |
1727 | if (!t) { |
1728 | t = pf_default_rule.timeout[PFTM_SRC_NODE]; |
1729 | } |
1730 | s->src_node->expire = pf_time_second() + t; |
1731 | } |
1732 | } |
1733 | if (s->nat_src_node != s->src_node && s->nat_src_node != NULL) { |
1734 | VERIFY(s->nat_src_node->states > 0); |
1735 | if (--s->nat_src_node->states <= 0) { |
1736 | t = s->rule.ptr->timeout[PFTM_SRC_NODE]; |
1737 | if (!t) { |
1738 | t = pf_default_rule.timeout[PFTM_SRC_NODE]; |
1739 | } |
1740 | s->nat_src_node->expire = pf_time_second() + t; |
1741 | } |
1742 | } |
1743 | s->src_node = s->nat_src_node = NULL; |
1744 | } |
1745 | |
1746 | void |
1747 | pf_unlink_state(struct pf_state *cur) |
1748 | { |
1749 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
1750 | |
1751 | if (cur->src.state == PF_TCPS_PROXY_DST) { |
1752 | pf_send_tcp(cur->rule.ptr, cur->state_key->af_lan, |
1753 | &cur->state_key->ext_lan.addr, &cur->state_key->lan.addr, |
1754 | cur->state_key->ext_lan.xport.port, |
1755 | cur->state_key->lan.xport.port, |
1756 | cur->src.seqhi, cur->src.seqlo + 1, |
1757 | TH_RST | TH_ACK, 0, 0, 0, 1, cur->tag, NULL, NULL); |
1758 | } |
1759 | |
1760 | hook_runloop(&cur->unlink_hooks, HOOK_REMOVE | HOOK_FREE); |
1761 | RB_REMOVE(pf_state_tree_id, &tree_id, cur); |
1762 | #if NPFSYNC |
1763 | if (cur->creatorid == pf_status.hostid) { |
1764 | pfsync_delete_state(cur); |
1765 | } |
1766 | #endif |
1767 | cur->timeout = PFTM_UNLINKED; |
1768 | pf_src_tree_remove_state(s: cur); |
1769 | pf_detach_state(cur, 0); |
1770 | } |
1771 | |
1772 | /* callers should be at splpf and hold the |
1773 | * write_lock on pf_consistency_lock */ |
1774 | void |
1775 | pf_free_state(struct pf_state *cur) |
1776 | { |
1777 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
1778 | #if NPFSYNC |
1779 | if (pfsyncif != NULL && |
1780 | (pfsyncif->sc_bulk_send_next == cur || |
1781 | pfsyncif->sc_bulk_terminator == cur)) { |
1782 | return; |
1783 | } |
1784 | #endif |
1785 | VERIFY(cur->timeout == PFTM_UNLINKED); |
1786 | VERIFY(cur->rule.ptr->states > 0); |
1787 | if (--cur->rule.ptr->states <= 0 && |
1788 | cur->rule.ptr->src_nodes <= 0) { |
1789 | pf_rm_rule(NULL, cur->rule.ptr); |
1790 | } |
1791 | if (cur->nat_rule.ptr != NULL) { |
1792 | VERIFY(cur->nat_rule.ptr->states > 0); |
1793 | if (--cur->nat_rule.ptr->states <= 0 && |
1794 | cur->nat_rule.ptr->src_nodes <= 0) { |
1795 | pf_rm_rule(NULL, cur->nat_rule.ptr); |
1796 | } |
1797 | } |
1798 | if (cur->anchor.ptr != NULL) { |
1799 | VERIFY(cur->anchor.ptr->states > 0); |
1800 | if (--cur->anchor.ptr->states <= 0) { |
1801 | pf_rm_rule(NULL, cur->anchor.ptr); |
1802 | } |
1803 | } |
1804 | pf_normalize_tcp_cleanup(cur); |
1805 | pfi_kif_unref(cur->kif, PFI_KIF_REF_STATE); |
1806 | TAILQ_REMOVE(&state_list, cur, entry_list); |
1807 | if (cur->tag) { |
1808 | pf_tag_unref(cur->tag); |
1809 | } |
1810 | #if SKYWALK |
1811 | netns_release(token: &cur->nstoken); |
1812 | #endif |
1813 | pool_put(&pf_state_pl, cur); |
1814 | pf_status.fcounters[FCNT_STATE_REMOVALS]++; |
1815 | VERIFY(pf_status.states > 0); |
1816 | pf_status.states--; |
1817 | } |
1818 | |
1819 | void |
1820 | pf_purge_expired_states(u_int32_t maxcheck) |
1821 | { |
1822 | static struct pf_state *cur = NULL; |
1823 | struct pf_state *next; |
1824 | |
1825 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
1826 | |
1827 | while (maxcheck--) { |
1828 | /* wrap to start of list when we hit the end */ |
1829 | if (cur == NULL) { |
1830 | cur = TAILQ_FIRST(&state_list); |
1831 | if (cur == NULL) { |
1832 | break; /* list empty */ |
1833 | } |
1834 | } |
1835 | |
1836 | /* get next state, as cur may get deleted */ |
1837 | next = TAILQ_NEXT(cur, entry_list); |
1838 | |
1839 | if (cur->timeout == PFTM_UNLINKED) { |
1840 | pf_free_state(cur); |
1841 | } else if (pf_state_expires(state: cur) <= pf_time_second()) { |
1842 | /* unlink and free expired state */ |
1843 | pf_unlink_state(cur); |
1844 | pf_free_state(cur); |
1845 | } |
1846 | cur = next; |
1847 | } |
1848 | } |
1849 | |
1850 | int |
1851 | pf_tbladdr_setup(struct pf_ruleset *rs, struct pf_addr_wrap *aw) |
1852 | { |
1853 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
1854 | |
1855 | if (aw->type != PF_ADDR_TABLE) { |
1856 | return 0; |
1857 | } |
1858 | if ((aw->p.tbl = pfr_attach_table(rs, aw->v.tblname)) == NULL) { |
1859 | return 1; |
1860 | } |
1861 | return 0; |
1862 | } |
1863 | |
1864 | void |
1865 | pf_tbladdr_remove(struct pf_addr_wrap *aw) |
1866 | { |
1867 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
1868 | |
1869 | if (aw->type != PF_ADDR_TABLE || aw->p.tbl == NULL) { |
1870 | return; |
1871 | } |
1872 | pfr_detach_table(aw->p.tbl); |
1873 | aw->p.tbl = NULL; |
1874 | } |
1875 | |
1876 | void |
1877 | pf_tbladdr_copyout(struct pf_addr_wrap *aw) |
1878 | { |
1879 | struct pfr_ktable *kt = aw->p.tbl; |
1880 | |
1881 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
1882 | |
1883 | if (aw->type != PF_ADDR_TABLE || kt == NULL) { |
1884 | return; |
1885 | } |
1886 | if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) { |
1887 | kt = kt->pfrkt_root; |
1888 | } |
1889 | aw->p.tbl = NULL; |
1890 | aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ? |
1891 | kt->pfrkt_cnt : -1; |
1892 | } |
1893 | |
1894 | static void |
1895 | pf_print_addr(struct pf_addr *addr, sa_family_t af) |
1896 | { |
1897 | switch (af) { |
1898 | #if INET |
1899 | case AF_INET: { |
1900 | u_int32_t a = ntohl(addr->addr32[0]); |
1901 | printf("%u.%u.%u.%u" , (a >> 24) & 255, (a >> 16) & 255, |
1902 | (a >> 8) & 255, a & 255); |
1903 | break; |
1904 | } |
1905 | #endif /* INET */ |
1906 | case AF_INET6: { |
1907 | u_int16_t b; |
1908 | u_int8_t i, curstart = 255, curend = 0, |
1909 | maxstart = 0, maxend = 0; |
1910 | for (i = 0; i < 8; i++) { |
1911 | if (!addr->addr16[i]) { |
1912 | if (curstart == 255) { |
1913 | curstart = i; |
1914 | } else { |
1915 | curend = i; |
1916 | } |
1917 | } else { |
1918 | if (curstart) { |
1919 | if ((curend - curstart) > |
1920 | (maxend - maxstart)) { |
1921 | maxstart = curstart; |
1922 | maxend = curend; |
1923 | curstart = 255; |
1924 | } |
1925 | } |
1926 | } |
1927 | } |
1928 | for (i = 0; i < 8; i++) { |
1929 | if (i >= maxstart && i <= maxend) { |
1930 | if (maxend != 7) { |
1931 | if (i == maxstart) { |
1932 | printf(":" ); |
1933 | } |
1934 | } else { |
1935 | if (i == maxend) { |
1936 | printf(":" ); |
1937 | } |
1938 | } |
1939 | } else { |
1940 | b = ntohs(addr->addr16[i]); |
1941 | printf("%x" , b); |
1942 | if (i < 7) { |
1943 | printf(":" ); |
1944 | } |
1945 | } |
1946 | } |
1947 | break; |
1948 | } |
1949 | } |
1950 | } |
1951 | |
1952 | static void |
1953 | pf_print_sk_host(struct pf_state_host *sh, sa_family_t af, int proto, |
1954 | u_int8_t proto_variant) |
1955 | { |
1956 | pf_print_addr(addr: &sh->addr, af); |
1957 | |
1958 | switch (proto) { |
1959 | case IPPROTO_ESP: |
1960 | if (sh->xport.spi) { |
1961 | printf("[%08x]" , ntohl(sh->xport.spi)); |
1962 | } |
1963 | break; |
1964 | |
1965 | case IPPROTO_GRE: |
1966 | if (proto_variant == PF_GRE_PPTP_VARIANT) { |
1967 | printf("[%u]" , ntohs(sh->xport.call_id)); |
1968 | } |
1969 | break; |
1970 | |
1971 | case IPPROTO_TCP: |
1972 | case IPPROTO_UDP: |
1973 | printf("[%u]" , ntohs(sh->xport.port)); |
1974 | break; |
1975 | |
1976 | default: |
1977 | break; |
1978 | } |
1979 | } |
1980 | |
1981 | static void |
1982 | pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af) |
1983 | { |
1984 | pf_print_addr(addr, af); |
1985 | if (p) { |
1986 | printf("[%u]" , ntohs(p)); |
1987 | } |
1988 | } |
1989 | |
1990 | void |
1991 | pf_print_state(struct pf_state *s) |
1992 | { |
1993 | struct pf_state_key *sk = s->state_key; |
1994 | switch (sk->proto) { |
1995 | case IPPROTO_ESP: |
1996 | printf("ESP " ); |
1997 | break; |
1998 | case IPPROTO_GRE: |
1999 | printf("GRE%u " , sk->proto_variant); |
2000 | break; |
2001 | case IPPROTO_TCP: |
2002 | printf("TCP " ); |
2003 | break; |
2004 | case IPPROTO_UDP: |
2005 | printf("UDP " ); |
2006 | break; |
2007 | case IPPROTO_ICMP: |
2008 | printf("ICMP " ); |
2009 | break; |
2010 | case IPPROTO_ICMPV6: |
2011 | printf("ICMPV6 " ); |
2012 | break; |
2013 | default: |
2014 | printf("%u " , sk->proto); |
2015 | break; |
2016 | } |
2017 | pf_print_sk_host(sh: &sk->lan, af: sk->af_lan, proto: sk->proto, proto_variant: sk->proto_variant); |
2018 | printf(" " ); |
2019 | pf_print_sk_host(sh: &sk->gwy, af: sk->af_gwy, proto: sk->proto, proto_variant: sk->proto_variant); |
2020 | printf(" " ); |
2021 | pf_print_sk_host(sh: &sk->ext_lan, af: sk->af_lan, proto: sk->proto, |
2022 | proto_variant: sk->proto_variant); |
2023 | printf(" " ); |
2024 | pf_print_sk_host(sh: &sk->ext_gwy, af: sk->af_gwy, proto: sk->proto, |
2025 | proto_variant: sk->proto_variant); |
2026 | printf(" [lo=%u high=%u win=%u modulator=%u" , s->src.seqlo, |
2027 | s->src.seqhi, s->src.max_win, s->src.seqdiff); |
2028 | if (s->src.wscale && s->dst.wscale) { |
2029 | printf(" wscale=%u" , s->src.wscale & PF_WSCALE_MASK); |
2030 | } |
2031 | printf("]" ); |
2032 | printf(" [lo=%u high=%u win=%u modulator=%u" , s->dst.seqlo, |
2033 | s->dst.seqhi, s->dst.max_win, s->dst.seqdiff); |
2034 | if (s->src.wscale && s->dst.wscale) { |
2035 | printf(" wscale=%u" , s->dst.wscale & PF_WSCALE_MASK); |
2036 | } |
2037 | printf("]" ); |
2038 | printf(" %u:%u" , s->src.state, s->dst.state); |
2039 | } |
2040 | |
2041 | void |
2042 | pf_print_flags(u_int8_t f) |
2043 | { |
2044 | if (f) { |
2045 | printf(" " ); |
2046 | } |
2047 | if (f & TH_FIN) { |
2048 | printf("F" ); |
2049 | } |
2050 | if (f & TH_SYN) { |
2051 | printf("S" ); |
2052 | } |
2053 | if (f & TH_RST) { |
2054 | printf("R" ); |
2055 | } |
2056 | if (f & TH_PUSH) { |
2057 | printf("P" ); |
2058 | } |
2059 | if (f & TH_ACK) { |
2060 | printf("A" ); |
2061 | } |
2062 | if (f & TH_URG) { |
2063 | printf("U" ); |
2064 | } |
2065 | if (f & TH_ECE) { |
2066 | printf("E" ); |
2067 | } |
2068 | if (f & TH_CWR) { |
2069 | printf("W" ); |
2070 | } |
2071 | } |
2072 | |
2073 | #define PF_SET_SKIP_STEPS(i) \ |
2074 | do { \ |
2075 | while (head[i] != cur) { \ |
2076 | head[i]->skip[i].ptr = cur; \ |
2077 | head[i] = TAILQ_NEXT(head[i], entries); \ |
2078 | } \ |
2079 | } while (0) |
2080 | |
2081 | void |
2082 | pf_calc_skip_steps(struct pf_rulequeue *rules) |
2083 | { |
2084 | struct pf_rule *cur, *prev, *head[PF_SKIP_COUNT]; |
2085 | int i; |
2086 | |
2087 | cur = TAILQ_FIRST(rules); |
2088 | prev = cur; |
2089 | for (i = 0; i < PF_SKIP_COUNT; ++i) { |
2090 | head[i] = cur; |
2091 | } |
2092 | while (cur != NULL) { |
2093 | if (cur->kif != prev->kif || cur->ifnot != prev->ifnot) { |
2094 | PF_SET_SKIP_STEPS(PF_SKIP_IFP); |
2095 | } |
2096 | if (cur->direction != prev->direction) { |
2097 | PF_SET_SKIP_STEPS(PF_SKIP_DIR); |
2098 | } |
2099 | if (cur->af != prev->af) { |
2100 | PF_SET_SKIP_STEPS(PF_SKIP_AF); |
2101 | } |
2102 | if (cur->proto != prev->proto) { |
2103 | PF_SET_SKIP_STEPS(PF_SKIP_PROTO); |
2104 | } |
2105 | if (cur->src.neg != prev->src.neg || |
2106 | pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr)) { |
2107 | PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR); |
2108 | } |
2109 | { |
2110 | union pf_rule_xport *cx = &cur->src.xport; |
2111 | union pf_rule_xport *px = &prev->src.xport; |
2112 | |
2113 | switch (cur->proto) { |
2114 | case IPPROTO_GRE: |
2115 | case IPPROTO_ESP: |
2116 | PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT); |
2117 | break; |
2118 | default: |
2119 | if (prev->proto == IPPROTO_GRE || |
2120 | prev->proto == IPPROTO_ESP || |
2121 | cx->range.op != px->range.op || |
2122 | cx->range.port[0] != px->range.port[0] || |
2123 | cx->range.port[1] != px->range.port[1]) { |
2124 | PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT); |
2125 | } |
2126 | break; |
2127 | } |
2128 | } |
2129 | if (cur->dst.neg != prev->dst.neg || |
2130 | pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr)) { |
2131 | PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR); |
2132 | } |
2133 | { |
2134 | union pf_rule_xport *cx = &cur->dst.xport; |
2135 | union pf_rule_xport *px = &prev->dst.xport; |
2136 | |
2137 | switch (cur->proto) { |
2138 | case IPPROTO_GRE: |
2139 | if (cur->proto != prev->proto || |
2140 | cx->call_id != px->call_id) { |
2141 | PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT); |
2142 | } |
2143 | break; |
2144 | case IPPROTO_ESP: |
2145 | if (cur->proto != prev->proto || |
2146 | cx->spi != px->spi) { |
2147 | PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT); |
2148 | } |
2149 | break; |
2150 | default: |
2151 | if (prev->proto == IPPROTO_GRE || |
2152 | prev->proto == IPPROTO_ESP || |
2153 | cx->range.op != px->range.op || |
2154 | cx->range.port[0] != px->range.port[0] || |
2155 | cx->range.port[1] != px->range.port[1]) { |
2156 | PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT); |
2157 | } |
2158 | break; |
2159 | } |
2160 | } |
2161 | |
2162 | prev = cur; |
2163 | cur = TAILQ_NEXT(cur, entries); |
2164 | } |
2165 | for (i = 0; i < PF_SKIP_COUNT; ++i) { |
2166 | PF_SET_SKIP_STEPS(i); |
2167 | } |
2168 | } |
2169 | |
2170 | u_int32_t |
2171 | pf_calc_state_key_flowhash(struct pf_state_key *sk) |
2172 | { |
2173 | #if SKYWALK |
2174 | uint32_t flowid; |
2175 | struct flowidns_flow_key fk; |
2176 | |
2177 | VERIFY(sk->flowsrc == FLOWSRC_PF); |
2178 | bzero(s: &fk, n: sizeof(fk)); |
2179 | _CASSERT(sizeof(sk->lan.addr) == sizeof(fk.ffk_laddr)); |
2180 | _CASSERT(sizeof(sk->ext_lan.addr) == sizeof(fk.ffk_laddr)); |
2181 | bcopy(src: &sk->lan.addr, dst: &fk.ffk_laddr, n: sizeof(fk.ffk_laddr)); |
2182 | bcopy(src: &sk->ext_lan.addr, dst: &fk.ffk_raddr, n: sizeof(fk.ffk_raddr)); |
2183 | fk.ffk_af = sk->af_lan; |
2184 | fk.ffk_proto = sk->proto; |
2185 | |
2186 | switch (sk->proto) { |
2187 | case IPPROTO_ESP: |
2188 | case IPPROTO_AH: |
2189 | fk.ffk_spi = sk->lan.xport.spi; |
2190 | break; |
2191 | default: |
2192 | if (sk->lan.xport.spi <= sk->ext_lan.xport.spi) { |
2193 | fk.ffk_lport = sk->lan.xport.port; |
2194 | fk.ffk_rport = sk->ext_lan.xport.port; |
2195 | } else { |
2196 | fk.ffk_lport = sk->ext_lan.xport.port; |
2197 | fk.ffk_rport = sk->lan.xport.port; |
2198 | } |
2199 | break; |
2200 | } |
2201 | |
2202 | flowidns_allocate_flowid(domain: FLOWIDNS_DOMAIN_PF, flow_key: &fk, flowid: &flowid); |
2203 | return flowid; |
2204 | |
2205 | #else /* !SKYWALK */ |
2206 | |
2207 | struct pf_flowhash_key fh __attribute__((aligned(8))); |
2208 | uint32_t flowhash = 0; |
2209 | |
2210 | bzero(&fh, sizeof(fh)); |
2211 | if (PF_ALEQ(&sk->lan.addr, &sk->ext_lan.addr, sk->af_lan)) { |
2212 | bcopy(&sk->lan.addr, &fh.ap1.addr, sizeof(fh.ap1.addr)); |
2213 | bcopy(&sk->ext_lan.addr, &fh.ap2.addr, sizeof(fh.ap2.addr)); |
2214 | } else { |
2215 | bcopy(&sk->ext_lan.addr, &fh.ap1.addr, sizeof(fh.ap1.addr)); |
2216 | bcopy(&sk->lan.addr, &fh.ap2.addr, sizeof(fh.ap2.addr)); |
2217 | } |
2218 | if (sk->lan.xport.spi <= sk->ext_lan.xport.spi) { |
2219 | fh.ap1.xport.spi = sk->lan.xport.spi; |
2220 | fh.ap2.xport.spi = sk->ext_lan.xport.spi; |
2221 | } else { |
2222 | fh.ap1.xport.spi = sk->ext_lan.xport.spi; |
2223 | fh.ap2.xport.spi = sk->lan.xport.spi; |
2224 | } |
2225 | fh.af = sk->af_lan; |
2226 | fh.proto = sk->proto; |
2227 | |
2228 | try_again: |
2229 | flowhash = net_flowhash(&fh, sizeof(fh), pf_hash_seed); |
2230 | if (flowhash == 0) { |
2231 | /* try to get a non-zero flowhash */ |
2232 | pf_hash_seed = RandomULong(); |
2233 | goto try_again; |
2234 | } |
2235 | |
2236 | return flowhash; |
2237 | |
2238 | #endif /* !SKYWALK */ |
2239 | } |
2240 | |
2241 | static int |
2242 | pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2) |
2243 | { |
2244 | if (aw1->type != aw2->type) { |
2245 | return 1; |
2246 | } |
2247 | switch (aw1->type) { |
2248 | case PF_ADDR_ADDRMASK: |
2249 | case PF_ADDR_RANGE: |
2250 | if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, AF_INET6)) { |
2251 | return 1; |
2252 | } |
2253 | if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, AF_INET6)) { |
2254 | return 1; |
2255 | } |
2256 | return 0; |
2257 | case PF_ADDR_DYNIFTL: |
2258 | return aw1->p.dyn == NULL || aw2->p.dyn == NULL || |
2259 | aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt; |
2260 | case PF_ADDR_NOROUTE: |
2261 | case PF_ADDR_URPFFAILED: |
2262 | return 0; |
2263 | case PF_ADDR_TABLE: |
2264 | return aw1->p.tbl != aw2->p.tbl; |
2265 | case PF_ADDR_RTLABEL: |
2266 | return aw1->v.rtlabel != aw2->v.rtlabel; |
2267 | default: |
2268 | printf("invalid address type: %d\n" , aw1->type); |
2269 | return 1; |
2270 | } |
2271 | } |
2272 | |
2273 | u_int16_t |
2274 | pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp) |
2275 | { |
2276 | return nat464_cksum_fixup(cksum, old, new, udp); |
2277 | } |
2278 | |
2279 | /* |
2280 | * change ip address & port |
2281 | * dir : packet direction |
2282 | * a : address to be changed |
2283 | * p : port to be changed |
2284 | * ic : ip header checksum |
2285 | * pc : protocol checksum |
2286 | * an : new ip address |
2287 | * pn : new port |
2288 | * u : should be 1 if UDP packet else 0 |
2289 | * af : address family of the packet |
2290 | * afn : address family of the new address |
2291 | * ua : should be 1 if ip address needs to be updated in the packet else |
2292 | * only the checksum is recalculated & updated. |
2293 | */ |
2294 | static __attribute__((noinline)) void |
2295 | pf_change_ap(int dir, pbuf_t *pbuf, struct pf_addr *a, u_int16_t *p, |
2296 | u_int16_t *ic, u_int16_t *pc, struct pf_addr *an, u_int16_t pn, |
2297 | u_int8_t u, sa_family_t af, sa_family_t afn, int ua) |
2298 | { |
2299 | struct pf_addr ao; |
2300 | u_int16_t po = *p; |
2301 | |
2302 | PF_ACPY(&ao, a, af); |
2303 | if (ua) { |
2304 | PF_ACPY(a, an, afn); |
2305 | } |
2306 | |
2307 | *p = pn; |
2308 | |
2309 | switch (af) { |
2310 | #if INET |
2311 | case AF_INET: |
2312 | switch (afn) { |
2313 | case AF_INET: |
2314 | *ic = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *ic, |
2315 | old: ao.addr16[0], new: an->addr16[0], udp: 0), |
2316 | old: ao.addr16[1], new: an->addr16[1], udp: 0); |
2317 | *p = pn; |
2318 | /* |
2319 | * If the packet is originated from an ALG on the NAT gateway |
2320 | * (source address is loopback or local), in which case the |
2321 | * TCP/UDP checksum field contains the pseudo header checksum |
2322 | * that's not yet complemented. |
2323 | * In that case we do not need to fixup the checksum for port |
2324 | * translation as the pseudo header checksum doesn't include ports. |
2325 | * |
2326 | * A packet generated locally will have UDP/TCP CSUM flag |
2327 | * set (gets set in protocol output). |
2328 | * |
2329 | * It should be noted that the fixup doesn't do anything if the |
2330 | * checksum is 0. |
2331 | */ |
2332 | if (dir == PF_OUT && pbuf != NULL && |
2333 | (*pbuf->pb_csum_flags & (CSUM_TCP | CSUM_UDP))) { |
2334 | /* Pseudo-header checksum does not include ports */ |
2335 | *pc = ~pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: ~*pc, |
2336 | old: ao.addr16[0], new: an->addr16[0], udp: u), |
2337 | old: ao.addr16[1], new: an->addr16[1], udp: u); |
2338 | } else { |
2339 | *pc = |
2340 | pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2341 | cksum: *pc, old: ao.addr16[0], new: an->addr16[0], udp: u), |
2342 | old: ao.addr16[1], new: an->addr16[1], udp: u), |
2343 | old: po, new: pn, udp: u); |
2344 | } |
2345 | break; |
2346 | case AF_INET6: |
2347 | *p = pn; |
2348 | *pc = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2349 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2350 | |
2351 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *pc, |
2352 | old: ao.addr16[0], new: an->addr16[0], udp: u), |
2353 | old: ao.addr16[1], new: an->addr16[1], udp: u), |
2354 | old: 0, new: an->addr16[2], udp: u), |
2355 | old: 0, new: an->addr16[3], udp: u), |
2356 | old: 0, new: an->addr16[4], udp: u), |
2357 | old: 0, new: an->addr16[5], udp: u), |
2358 | old: 0, new: an->addr16[6], udp: u), |
2359 | old: 0, new: an->addr16[7], udp: u), |
2360 | old: po, new: pn, udp: u); |
2361 | break; |
2362 | } |
2363 | break; |
2364 | #endif /* INET */ |
2365 | case AF_INET6: |
2366 | switch (afn) { |
2367 | case AF_INET6: |
2368 | /* |
2369 | * If the packet is originated from an ALG on the NAT gateway |
2370 | * (source address is loopback or local), in which case the |
2371 | * TCP/UDP checksum field contains the pseudo header checksum |
2372 | * that's not yet complemented. |
2373 | * A packet generated locally |
2374 | * will have UDP/TCP CSUM flag set (gets set in protocol |
2375 | * output). |
2376 | */ |
2377 | if (dir == PF_OUT && pbuf != NULL && |
2378 | (*pbuf->pb_csum_flags & (CSUM_TCPIPV6 | |
2379 | CSUM_UDPIPV6))) { |
2380 | /* Pseudo-header checksum does not include ports */ |
2381 | *pc = |
2382 | ~pf_cksum_fixup(cksum: pf_cksum_fixup( |
2383 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2384 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2385 | cksum: ~*pc, |
2386 | old: ao.addr16[0], new: an->addr16[0], udp: u), |
2387 | old: ao.addr16[1], new: an->addr16[1], udp: u), |
2388 | old: ao.addr16[2], new: an->addr16[2], udp: u), |
2389 | old: ao.addr16[3], new: an->addr16[3], udp: u), |
2390 | old: ao.addr16[4], new: an->addr16[4], udp: u), |
2391 | old: ao.addr16[5], new: an->addr16[5], udp: u), |
2392 | old: ao.addr16[6], new: an->addr16[6], udp: u), |
2393 | old: ao.addr16[7], new: an->addr16[7], udp: u); |
2394 | } else { |
2395 | *pc = |
2396 | pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2397 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2398 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2399 | cksum: *pc, |
2400 | old: ao.addr16[0], new: an->addr16[0], udp: u), |
2401 | old: ao.addr16[1], new: an->addr16[1], udp: u), |
2402 | old: ao.addr16[2], new: an->addr16[2], udp: u), |
2403 | old: ao.addr16[3], new: an->addr16[3], udp: u), |
2404 | old: ao.addr16[4], new: an->addr16[4], udp: u), |
2405 | old: ao.addr16[5], new: an->addr16[5], udp: u), |
2406 | old: ao.addr16[6], new: an->addr16[6], udp: u), |
2407 | old: ao.addr16[7], new: an->addr16[7], udp: u), |
2408 | old: po, new: pn, udp: u); |
2409 | } |
2410 | break; |
2411 | #ifdef INET |
2412 | case AF_INET: |
2413 | *pc = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2414 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2415 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *pc, |
2416 | old: ao.addr16[0], new: an->addr16[0], udp: u), |
2417 | old: ao.addr16[1], new: an->addr16[1], udp: u), |
2418 | old: ao.addr16[2], new: 0, udp: u), |
2419 | old: ao.addr16[3], new: 0, udp: u), |
2420 | old: ao.addr16[4], new: 0, udp: u), |
2421 | old: ao.addr16[5], new: 0, udp: u), |
2422 | old: ao.addr16[6], new: 0, udp: u), |
2423 | old: ao.addr16[7], new: 0, udp: u), |
2424 | old: po, new: pn, udp: u); |
2425 | break; |
2426 | #endif /* INET */ |
2427 | } |
2428 | break; |
2429 | } |
2430 | } |
2431 | |
2432 | |
2433 | /* Changes a u_int32_t. Uses a void * so there are no align restrictions */ |
2434 | void |
2435 | pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u) |
2436 | { |
2437 | u_int32_t ao; |
2438 | |
2439 | memcpy(dst: &ao, src: a, n: sizeof(ao)); |
2440 | memcpy(dst: a, src: &an, n: sizeof(u_int32_t)); |
2441 | *c = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *c, old: ao / 65536, new: an / 65536, udp: u), |
2442 | old: ao % 65536, new: an % 65536, udp: u); |
2443 | } |
2444 | |
2445 | static __attribute__((noinline)) void |
2446 | pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u) |
2447 | { |
2448 | struct pf_addr ao; |
2449 | |
2450 | PF_ACPY(&ao, a, AF_INET6); |
2451 | PF_ACPY(a, an, AF_INET6); |
2452 | |
2453 | *c = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2454 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2455 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *c, |
2456 | old: ao.addr16[0], new: an->addr16[0], udp: u), |
2457 | old: ao.addr16[1], new: an->addr16[1], udp: u), |
2458 | old: ao.addr16[2], new: an->addr16[2], udp: u), |
2459 | old: ao.addr16[3], new: an->addr16[3], udp: u), |
2460 | old: ao.addr16[4], new: an->addr16[4], udp: u), |
2461 | old: ao.addr16[5], new: an->addr16[5], udp: u), |
2462 | old: ao.addr16[6], new: an->addr16[6], udp: u), |
2463 | old: ao.addr16[7], new: an->addr16[7], udp: u); |
2464 | } |
2465 | |
2466 | static __attribute__((noinline)) void |
2467 | pf_change_addr(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u, |
2468 | sa_family_t af, sa_family_t afn) |
2469 | { |
2470 | struct pf_addr ao; |
2471 | |
2472 | if (af != afn) { |
2473 | PF_ACPY(&ao, a, af); |
2474 | PF_ACPY(a, an, afn); |
2475 | } |
2476 | |
2477 | switch (af) { |
2478 | case AF_INET: |
2479 | switch (afn) { |
2480 | case AF_INET: |
2481 | pf_change_a(a, c, an: an->v4addr.s_addr, u); |
2482 | break; |
2483 | case AF_INET6: |
2484 | *c = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2485 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2486 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *c, |
2487 | old: ao.addr16[0], new: an->addr16[0], udp: u), |
2488 | old: ao.addr16[1], new: an->addr16[1], udp: u), |
2489 | old: 0, new: an->addr16[2], udp: u), |
2490 | old: 0, new: an->addr16[3], udp: u), |
2491 | old: 0, new: an->addr16[4], udp: u), |
2492 | old: 0, new: an->addr16[5], udp: u), |
2493 | old: 0, new: an->addr16[6], udp: u), |
2494 | old: 0, new: an->addr16[7], udp: u); |
2495 | break; |
2496 | } |
2497 | break; |
2498 | case AF_INET6: |
2499 | switch (afn) { |
2500 | case AF_INET: |
2501 | *c = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2502 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2503 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *c, |
2504 | old: ao.addr16[0], new: an->addr16[0], udp: u), |
2505 | old: ao.addr16[1], new: an->addr16[1], udp: u), |
2506 | old: ao.addr16[2], new: 0, udp: u), |
2507 | old: ao.addr16[3], new: 0, udp: u), |
2508 | old: ao.addr16[4], new: 0, udp: u), |
2509 | old: ao.addr16[5], new: 0, udp: u), |
2510 | old: ao.addr16[6], new: 0, udp: u), |
2511 | old: ao.addr16[7], new: 0, udp: u); |
2512 | break; |
2513 | case AF_INET6: |
2514 | pf_change_a6(a, c, an, u); |
2515 | break; |
2516 | } |
2517 | break; |
2518 | } |
2519 | } |
2520 | |
2521 | static __attribute__((noinline)) void |
2522 | pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa, |
2523 | struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c, |
2524 | u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af) |
2525 | { |
2526 | struct pf_addr oia, ooa; |
2527 | |
2528 | PF_ACPY(&oia, ia, af); |
2529 | PF_ACPY(&ooa, oa, af); |
2530 | |
2531 | /* Change inner protocol port, fix inner protocol checksum. */ |
2532 | if (ip != NULL) { |
2533 | u_int16_t oip = *ip; |
2534 | u_int32_t opc = 0; |
2535 | |
2536 | if (pc != NULL) { |
2537 | opc = *pc; |
2538 | } |
2539 | *ip = np; |
2540 | if (pc != NULL) { |
2541 | *pc = pf_cksum_fixup(cksum: *pc, old: oip, new: *ip, udp: u); |
2542 | } |
2543 | *ic = pf_cksum_fixup(cksum: *ic, old: oip, new: *ip, udp: 0); |
2544 | if (pc != NULL) { |
2545 | *ic = pf_cksum_fixup(cksum: *ic, old: opc, new: *pc, udp: 0); |
2546 | } |
2547 | } |
2548 | /* Change inner ip address, fix inner ip and icmp checksums. */ |
2549 | PF_ACPY(ia, na, af); |
2550 | switch (af) { |
2551 | #if INET |
2552 | case AF_INET: { |
2553 | u_int32_t oh2c = *h2c; |
2554 | |
2555 | *h2c = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *h2c, |
2556 | old: oia.addr16[0], new: ia->addr16[0], udp: 0), |
2557 | old: oia.addr16[1], new: ia->addr16[1], udp: 0); |
2558 | *ic = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *ic, |
2559 | old: oia.addr16[0], new: ia->addr16[0], udp: 0), |
2560 | old: oia.addr16[1], new: ia->addr16[1], udp: 0); |
2561 | *ic = pf_cksum_fixup(cksum: *ic, old: oh2c, new: *h2c, udp: 0); |
2562 | break; |
2563 | } |
2564 | #endif /* INET */ |
2565 | case AF_INET6: |
2566 | *ic = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2567 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2568 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *ic, |
2569 | old: oia.addr16[0], new: ia->addr16[0], udp: u), |
2570 | old: oia.addr16[1], new: ia->addr16[1], udp: u), |
2571 | old: oia.addr16[2], new: ia->addr16[2], udp: u), |
2572 | old: oia.addr16[3], new: ia->addr16[3], udp: u), |
2573 | old: oia.addr16[4], new: ia->addr16[4], udp: u), |
2574 | old: oia.addr16[5], new: ia->addr16[5], udp: u), |
2575 | old: oia.addr16[6], new: ia->addr16[6], udp: u), |
2576 | old: oia.addr16[7], new: ia->addr16[7], udp: u); |
2577 | break; |
2578 | } |
2579 | /* Change outer ip address, fix outer ip or icmpv6 checksum. */ |
2580 | PF_ACPY(oa, na, af); |
2581 | switch (af) { |
2582 | #if INET |
2583 | case AF_INET: |
2584 | *hc = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *hc, |
2585 | old: ooa.addr16[0], new: oa->addr16[0], udp: 0), |
2586 | old: ooa.addr16[1], new: oa->addr16[1], udp: 0); |
2587 | break; |
2588 | #endif /* INET */ |
2589 | case AF_INET6: |
2590 | *ic = pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2591 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: pf_cksum_fixup( |
2592 | cksum: pf_cksum_fixup(cksum: pf_cksum_fixup(cksum: *ic, |
2593 | old: ooa.addr16[0], new: oa->addr16[0], udp: u), |
2594 | old: ooa.addr16[1], new: oa->addr16[1], udp: u), |
2595 | old: ooa.addr16[2], new: oa->addr16[2], udp: u), |
2596 | old: ooa.addr16[3], new: oa->addr16[3], udp: u), |
2597 | old: ooa.addr16[4], new: oa->addr16[4], udp: u), |
2598 | old: ooa.addr16[5], new: oa->addr16[5], udp: u), |
2599 | old: ooa.addr16[6], new: oa->addr16[6], udp: u), |
2600 | old: ooa.addr16[7], new: oa->addr16[7], udp: u); |
2601 | break; |
2602 | } |
2603 | } |
2604 | |
2605 | |
2606 | /* |
2607 | * Need to modulate the sequence numbers in the TCP SACK option |
2608 | * (credits to Krzysztof Pfaff for report and patch) |
2609 | */ |
2610 | static __attribute__((noinline)) int |
2611 | pf_modulate_sack(pbuf_t *pbuf, int off, struct pf_pdesc *pd, |
2612 | struct tcphdr *th, struct pf_state_peer *dst) |
2613 | { |
2614 | int hlen = (th->th_off << 2) - sizeof(*th), thoptlen = hlen; |
2615 | u_int8_t opts[MAX_TCPOPTLEN], *opt = opts; |
2616 | int copyback = 0, i, olen; |
2617 | struct sackblk sack; |
2618 | |
2619 | #define TCPOLEN_SACKLEN (TCPOLEN_SACK + 2) |
2620 | if (hlen < TCPOLEN_SACKLEN || |
2621 | !pf_pull_hdr(pbuf, off + sizeof(*th), opts, hlen, NULL, NULL, pd->af)) { |
2622 | return 0; |
2623 | } |
2624 | |
2625 | while (hlen >= TCPOLEN_SACKLEN) { |
2626 | olen = opt[1]; |
2627 | switch (*opt) { |
2628 | case TCPOPT_EOL: /* FALLTHROUGH */ |
2629 | case TCPOPT_NOP: |
2630 | opt++; |
2631 | hlen--; |
2632 | break; |
2633 | case TCPOPT_SACK: |
2634 | if (olen > hlen) { |
2635 | olen = hlen; |
2636 | } |
2637 | if (olen >= TCPOLEN_SACKLEN) { |
2638 | for (i = 2; i + TCPOLEN_SACK <= olen; |
2639 | i += TCPOLEN_SACK) { |
2640 | memcpy(dst: &sack, src: &opt[i], n: sizeof(sack)); |
2641 | pf_change_a(a: &sack.start, c: &th->th_sum, |
2642 | htonl(ntohl(sack.start) - |
2643 | dst->seqdiff), u: 0); |
2644 | pf_change_a(a: &sack.end, c: &th->th_sum, |
2645 | htonl(ntohl(sack.end) - |
2646 | dst->seqdiff), u: 0); |
2647 | memcpy(dst: &opt[i], src: &sack, n: sizeof(sack)); |
2648 | } |
2649 | copyback = off + sizeof(*th) + thoptlen; |
2650 | } |
2651 | OS_FALLTHROUGH; |
2652 | default: |
2653 | if (olen < 2) { |
2654 | olen = 2; |
2655 | } |
2656 | hlen -= olen; |
2657 | opt += olen; |
2658 | } |
2659 | } |
2660 | |
2661 | if (copyback) { |
2662 | if (pf_lazy_makewritable(pd, pbuf, len: copyback) == NULL) { |
2663 | return -1; |
2664 | } |
2665 | pbuf_copy_back(pbuf, off + sizeof(*th), thoptlen, opts); |
2666 | } |
2667 | return copyback; |
2668 | } |
2669 | |
2670 | /* |
2671 | * XXX |
2672 | * |
2673 | * The following functions (pf_send_tcp and pf_send_icmp) are somewhat |
2674 | * special in that they originate "spurious" packets rather than |
2675 | * filter/NAT existing packets. As such, they're not a great fit for |
2676 | * the 'pbuf' shim, which assumes the underlying packet buffers are |
2677 | * allocated elsewhere. |
2678 | * |
2679 | * Since these functions are rarely used, we'll carry on allocating mbufs |
2680 | * and passing them to the IP stack for eventual routing. |
2681 | */ |
2682 | static __attribute__((noinline)) void |
2683 | pf_send_tcp(const struct pf_rule *r, sa_family_t af, |
2684 | const struct pf_addr *saddr, const struct pf_addr *daddr, |
2685 | u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack, |
2686 | u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl, int tag, |
2687 | u_int16_t rtag, struct ether_header *eh, struct ifnet *ifp) |
2688 | { |
2689 | #pragma unused(eh, ifp) |
2690 | struct mbuf *m; |
2691 | int len, tlen; |
2692 | #if INET |
2693 | struct ip *h = NULL; |
2694 | #endif /* INET */ |
2695 | struct ip6_hdr *h6 = NULL; |
2696 | struct tcphdr *th = NULL; |
2697 | char *opt; |
2698 | struct pf_mtag *pf_mtag; |
2699 | |
2700 | /* maximum segment size tcp option */ |
2701 | tlen = sizeof(struct tcphdr); |
2702 | if (mss) { |
2703 | tlen += 4; |
2704 | } |
2705 | |
2706 | switch (af) { |
2707 | #if INET |
2708 | case AF_INET: |
2709 | len = sizeof(struct ip) + tlen; |
2710 | break; |
2711 | #endif /* INET */ |
2712 | case AF_INET6: |
2713 | len = sizeof(struct ip6_hdr) + tlen; |
2714 | break; |
2715 | default: |
2716 | panic("pf_send_tcp: not AF_INET or AF_INET6!" ); |
2717 | return; |
2718 | } |
2719 | |
2720 | /* create outgoing mbuf */ |
2721 | m = m_gethdr(M_DONTWAIT, MT_HEADER); |
2722 | if (m == NULL) { |
2723 | return; |
2724 | } |
2725 | |
2726 | if ((pf_mtag = pf_get_mtag(m)) == NULL) { |
2727 | return; |
2728 | } |
2729 | |
2730 | if (tag) { |
2731 | pf_mtag->pftag_flags |= PF_TAG_GENERATED; |
2732 | } |
2733 | pf_mtag->pftag_tag = rtag; |
2734 | |
2735 | if (r != NULL && PF_RTABLEID_IS_VALID(r->rtableid)) { |
2736 | pf_mtag->pftag_rtableid = r->rtableid; |
2737 | } |
2738 | |
2739 | #if PF_ECN |
2740 | /* add hints for ecn */ |
2741 | pf_mtag->pftag_hdr = mtod(m, struct ip *); |
2742 | /* record address family */ |
2743 | pf_mtag->pftag_flags &= ~(PF_TAG_HDR_INET | PF_TAG_HDR_INET6); |
2744 | switch (af) { |
2745 | #if INET |
2746 | case AF_INET: |
2747 | pf_mtag->pftag_flags |= PF_TAG_HDR_INET; |
2748 | break; |
2749 | #endif /* INET */ |
2750 | case AF_INET6: |
2751 | pf_mtag->pftag_flags |= PF_TAG_HDR_INET6; |
2752 | break; |
2753 | } |
2754 | #endif /* PF_ECN */ |
2755 | |
2756 | /* indicate this is TCP */ |
2757 | m->m_pkthdr.pkt_proto = IPPROTO_TCP; |
2758 | |
2759 | /* Make sure headers are 32-bit aligned */ |
2760 | m->m_data += max_linkhdr; |
2761 | m->m_pkthdr.len = m->m_len = len; |
2762 | m->m_pkthdr.rcvif = NULL; |
2763 | bzero(s: m_mtod_current(m), n: len); |
2764 | switch (af) { |
2765 | #if INET |
2766 | case AF_INET: |
2767 | h = mtod(m, struct ip *); |
2768 | |
2769 | /* IP header fields included in the TCP checksum */ |
2770 | h->ip_p = IPPROTO_TCP; |
2771 | h->ip_len = htons(tlen); |
2772 | h->ip_src.s_addr = saddr->v4addr.s_addr; |
2773 | h->ip_dst.s_addr = daddr->v4addr.s_addr; |
2774 | |
2775 | th = (struct tcphdr *)(void *)((caddr_t)h + sizeof(struct ip)); |
2776 | break; |
2777 | #endif /* INET */ |
2778 | case AF_INET6: |
2779 | h6 = mtod(m, struct ip6_hdr *); |
2780 | |
2781 | /* IP header fields included in the TCP checksum */ |
2782 | h6->ip6_nxt = IPPROTO_TCP; |
2783 | h6->ip6_plen = htons(tlen); |
2784 | memcpy(dst: &h6->ip6_src, src: &saddr->v6addr, n: sizeof(struct in6_addr)); |
2785 | memcpy(dst: &h6->ip6_dst, src: &daddr->v6addr, n: sizeof(struct in6_addr)); |
2786 | |
2787 | th = (struct tcphdr *)(void *) |
2788 | ((caddr_t)h6 + sizeof(struct ip6_hdr)); |
2789 | break; |
2790 | } |
2791 | |
2792 | /* TCP header */ |
2793 | th->th_sport = sport; |
2794 | th->th_dport = dport; |
2795 | th->th_seq = htonl(seq); |
2796 | th->th_ack = htonl(ack); |
2797 | th->th_off = tlen >> 2; |
2798 | th->th_flags = flags; |
2799 | th->th_win = htons(win); |
2800 | |
2801 | if (mss) { |
2802 | opt = (char *)(th + 1); |
2803 | opt[0] = TCPOPT_MAXSEG; |
2804 | opt[1] = 4; |
2805 | #if BYTE_ORDER != BIG_ENDIAN |
2806 | HTONS(mss); |
2807 | #endif |
2808 | bcopy(src: (caddr_t)&mss, dst: (caddr_t)(opt + 2), n: 2); |
2809 | } |
2810 | |
2811 | switch (af) { |
2812 | #if INET |
2813 | case AF_INET: { |
2814 | struct route ro; |
2815 | |
2816 | /* TCP checksum */ |
2817 | th->th_sum = in_cksum(m, len); |
2818 | |
2819 | /* Finish the IP header */ |
2820 | h->ip_v = 4; |
2821 | h->ip_hl = sizeof(*h) >> 2; |
2822 | h->ip_tos = IPTOS_LOWDELAY; |
2823 | /* |
2824 | * ip_output() expects ip_len and ip_off to be in host order. |
2825 | */ |
2826 | h->ip_len = len; |
2827 | h->ip_off = (path_mtu_discovery ? IP_DF : 0); |
2828 | h->ip_ttl = ttl ? ttl : ip_defttl; |
2829 | h->ip_sum = 0; |
2830 | |
2831 | bzero(s: &ro, n: sizeof(ro)); |
2832 | ip_output(m, NULL, &ro, 0, NULL, NULL); |
2833 | ROUTE_RELEASE(&ro); |
2834 | break; |
2835 | } |
2836 | #endif /* INET */ |
2837 | case AF_INET6: { |
2838 | struct route_in6 ro6; |
2839 | |
2840 | /* TCP checksum */ |
2841 | th->th_sum = in6_cksum(m, IPPROTO_TCP, |
2842 | sizeof(struct ip6_hdr), tlen); |
2843 | |
2844 | h6->ip6_vfc |= IPV6_VERSION; |
2845 | h6->ip6_hlim = IPV6_DEFHLIM; |
2846 | |
2847 | ip6_output_setsrcifscope(m, IFSCOPE_UNKNOWN, NULL); |
2848 | ip6_output_setdstifscope(m, IFSCOPE_UNKNOWN, NULL); |
2849 | bzero(s: &ro6, n: sizeof(ro6)); |
2850 | ip6_output(m, NULL, &ro6, 0, NULL, NULL, NULL); |
2851 | ROUTE_RELEASE(&ro6); |
2852 | break; |
2853 | } |
2854 | } |
2855 | } |
2856 | |
2857 | static __attribute__((noinline)) void |
2858 | pf_send_icmp(pbuf_t *pbuf, u_int8_t type, u_int8_t code, sa_family_t af, |
2859 | struct pf_rule *r) |
2860 | { |
2861 | struct mbuf *m0; |
2862 | struct pf_mtag *pf_mtag; |
2863 | |
2864 | m0 = pbuf_clone_to_mbuf(pbuf); |
2865 | if (m0 == NULL) { |
2866 | return; |
2867 | } |
2868 | |
2869 | if ((pf_mtag = pf_get_mtag(m0)) == NULL) { |
2870 | return; |
2871 | } |
2872 | |
2873 | pf_mtag->pftag_flags |= PF_TAG_GENERATED; |
2874 | |
2875 | if (PF_RTABLEID_IS_VALID(r->rtableid)) { |
2876 | pf_mtag->pftag_rtableid = r->rtableid; |
2877 | } |
2878 | |
2879 | #if PF_ECN |
2880 | /* add hints for ecn */ |
2881 | pf_mtag->pftag_hdr = mtod(m0, struct ip *); |
2882 | /* record address family */ |
2883 | pf_mtag->pftag_flags &= ~(PF_TAG_HDR_INET | PF_TAG_HDR_INET6); |
2884 | switch (af) { |
2885 | #if INET |
2886 | case AF_INET: |
2887 | pf_mtag->pftag_flags |= PF_TAG_HDR_INET; |
2888 | m0->m_pkthdr.pkt_proto = IPPROTO_ICMP; |
2889 | break; |
2890 | #endif /* INET */ |
2891 | case AF_INET6: |
2892 | pf_mtag->pftag_flags |= PF_TAG_HDR_INET6; |
2893 | m0->m_pkthdr.pkt_proto = IPPROTO_ICMPV6; |
2894 | break; |
2895 | } |
2896 | #endif /* PF_ECN */ |
2897 | |
2898 | switch (af) { |
2899 | #if INET |
2900 | case AF_INET: |
2901 | icmp_error(m0, type, code, 0, 0); |
2902 | break; |
2903 | #endif /* INET */ |
2904 | case AF_INET6: |
2905 | icmp6_error(m0, type, code, 0); |
2906 | break; |
2907 | } |
2908 | } |
2909 | |
2910 | /* |
2911 | * Return 1 if the addresses a and b match (with mask m), otherwise return 0. |
2912 | * If n is 0, they match if they are equal. If n is != 0, they match if they |
2913 | * are different. |
2914 | */ |
2915 | int |
2916 | pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m, |
2917 | struct pf_addr *b, sa_family_t af) |
2918 | { |
2919 | int match = 0; |
2920 | |
2921 | switch (af) { |
2922 | #if INET |
2923 | case AF_INET: |
2924 | if ((a->addr32[0] & m->addr32[0]) == |
2925 | (b->addr32[0] & m->addr32[0])) { |
2926 | match++; |
2927 | } |
2928 | break; |
2929 | #endif /* INET */ |
2930 | case AF_INET6: |
2931 | if (((a->addr32[0] & m->addr32[0]) == |
2932 | (b->addr32[0] & m->addr32[0])) && |
2933 | ((a->addr32[1] & m->addr32[1]) == |
2934 | (b->addr32[1] & m->addr32[1])) && |
2935 | ((a->addr32[2] & m->addr32[2]) == |
2936 | (b->addr32[2] & m->addr32[2])) && |
2937 | ((a->addr32[3] & m->addr32[3]) == |
2938 | (b->addr32[3] & m->addr32[3]))) { |
2939 | match++; |
2940 | } |
2941 | break; |
2942 | } |
2943 | if (match) { |
2944 | if (n) { |
2945 | return 0; |
2946 | } else { |
2947 | return 1; |
2948 | } |
2949 | } else { |
2950 | if (n) { |
2951 | return 1; |
2952 | } else { |
2953 | return 0; |
2954 | } |
2955 | } |
2956 | } |
2957 | |
2958 | /* |
2959 | * Return 1 if b <= a <= e, otherwise return 0. |
2960 | */ |
2961 | int |
2962 | pf_match_addr_range(struct pf_addr *b, struct pf_addr *e, |
2963 | struct pf_addr *a, sa_family_t af) |
2964 | { |
2965 | switch (af) { |
2966 | #if INET |
2967 | case AF_INET: |
2968 | if ((a->addr32[0] < b->addr32[0]) || |
2969 | (a->addr32[0] > e->addr32[0])) { |
2970 | return 0; |
2971 | } |
2972 | break; |
2973 | #endif /* INET */ |
2974 | case AF_INET6: { |
2975 | int i; |
2976 | |
2977 | /* check a >= b */ |
2978 | for (i = 0; i < 4; ++i) { |
2979 | if (a->addr32[i] > b->addr32[i]) { |
2980 | break; |
2981 | } else if (a->addr32[i] < b->addr32[i]) { |
2982 | return 0; |
2983 | } |
2984 | } |
2985 | /* check a <= e */ |
2986 | for (i = 0; i < 4; ++i) { |
2987 | if (a->addr32[i] < e->addr32[i]) { |
2988 | break; |
2989 | } else if (a->addr32[i] > e->addr32[i]) { |
2990 | return 0; |
2991 | } |
2992 | } |
2993 | break; |
2994 | } |
2995 | } |
2996 | return 1; |
2997 | } |
2998 | |
2999 | int |
3000 | pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p) |
3001 | { |
3002 | switch (op) { |
3003 | case PF_OP_IRG: |
3004 | return (p > a1) && (p < a2); |
3005 | case PF_OP_XRG: |
3006 | return (p < a1) || (p > a2); |
3007 | case PF_OP_RRG: |
3008 | return (p >= a1) && (p <= a2); |
3009 | case PF_OP_EQ: |
3010 | return p == a1; |
3011 | case PF_OP_NE: |
3012 | return p != a1; |
3013 | case PF_OP_LT: |
3014 | return p < a1; |
3015 | case PF_OP_LE: |
3016 | return p <= a1; |
3017 | case PF_OP_GT: |
3018 | return p > a1; |
3019 | case PF_OP_GE: |
3020 | return p >= a1; |
3021 | } |
3022 | return 0; /* never reached */ |
3023 | } |
3024 | |
3025 | int |
3026 | pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p) |
3027 | { |
3028 | #if BYTE_ORDER != BIG_ENDIAN |
3029 | NTOHS(a1); |
3030 | NTOHS(a2); |
3031 | NTOHS(p); |
3032 | #endif |
3033 | return pf_match(op, a1, a2, p); |
3034 | } |
3035 | |
3036 | int |
3037 | pf_match_xport(u_int8_t proto, u_int8_t proto_variant, union pf_rule_xport *rx, |
3038 | union pf_state_xport *sx) |
3039 | { |
3040 | int d = !0; |
3041 | |
3042 | if (sx) { |
3043 | switch (proto) { |
3044 | case IPPROTO_GRE: |
3045 | if (proto_variant == PF_GRE_PPTP_VARIANT) { |
3046 | d = (rx->call_id == sx->call_id); |
3047 | } |
3048 | break; |
3049 | |
3050 | case IPPROTO_ESP: |
3051 | d = (rx->spi == sx->spi); |
3052 | break; |
3053 | |
3054 | case IPPROTO_TCP: |
3055 | case IPPROTO_UDP: |
3056 | case IPPROTO_ICMP: |
3057 | case IPPROTO_ICMPV6: |
3058 | if (rx->range.op) { |
3059 | d = pf_match_port(op: rx->range.op, |
3060 | a1: rx->range.port[0], a2: rx->range.port[1], |
3061 | p: sx->port); |
3062 | } |
3063 | break; |
3064 | |
3065 | default: |
3066 | break; |
3067 | } |
3068 | } |
3069 | |
3070 | return d; |
3071 | } |
3072 | |
3073 | int |
3074 | pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u) |
3075 | { |
3076 | if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE) { |
3077 | return 0; |
3078 | } |
3079 | return pf_match(op, a1, a2, p: u); |
3080 | } |
3081 | |
3082 | int |
3083 | pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g) |
3084 | { |
3085 | if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE) { |
3086 | return 0; |
3087 | } |
3088 | return pf_match(op, a1, a2, p: g); |
3089 | } |
3090 | |
3091 | static int |
3092 | pf_match_tag(struct pf_rule *r, struct pf_mtag *pf_mtag, |
3093 | int *tag) |
3094 | { |
3095 | if (*tag == -1) { |
3096 | *tag = pf_mtag->pftag_tag; |
3097 | } |
3098 | |
3099 | return (!r->match_tag_not && r->match_tag == *tag) || |
3100 | (r->match_tag_not && r->match_tag != *tag); |
3101 | } |
3102 | |
3103 | int |
3104 | pf_tag_packet(pbuf_t *pbuf, struct pf_mtag *pf_mtag, int tag, |
3105 | unsigned int rtableid, struct pf_pdesc *pd) |
3106 | { |
3107 | if (tag <= 0 && !PF_RTABLEID_IS_VALID(rtableid) && |
3108 | (pd == NULL || !(pd->pktflags & PKTF_FLOW_ID))) { |
3109 | return 0; |
3110 | } |
3111 | |
3112 | if (pf_mtag == NULL && (pf_mtag = pf_get_mtag_pbuf(pbuf)) == NULL) { |
3113 | return 1; |
3114 | } |
3115 | |
3116 | if (tag > 0) { |
3117 | pf_mtag->pftag_tag = tag; |
3118 | } |
3119 | if (PF_RTABLEID_IS_VALID(rtableid)) { |
3120 | pf_mtag->pftag_rtableid = rtableid; |
3121 | } |
3122 | if (pd != NULL && (pd->pktflags & PKTF_FLOW_ID)) { |
3123 | *pbuf->pb_flowsrc = pd->flowsrc; |
3124 | *pbuf->pb_flowid = pd->flowhash; |
3125 | *pbuf->pb_flags |= pd->pktflags; |
3126 | *pbuf->pb_proto = pd->proto; |
3127 | } |
3128 | |
3129 | return 0; |
3130 | } |
3131 | |
3132 | void |
3133 | pf_step_into_anchor(int *depth, struct pf_ruleset **rs, int n, |
3134 | struct pf_rule **r, struct pf_rule **a, int *match) |
3135 | { |
3136 | struct pf_anchor_stackframe *f; |
3137 | |
3138 | (*r)->anchor->match = 0; |
3139 | if (match) { |
3140 | *match = 0; |
3141 | } |
3142 | if (*depth >= (int)sizeof(pf_anchor_stack) / |
3143 | (int)sizeof(pf_anchor_stack[0])) { |
3144 | printf("pf_step_into_anchor: stack overflow\n" ); |
3145 | *r = TAILQ_NEXT(*r, entries); |
3146 | return; |
3147 | } else if (*depth == 0 && a != NULL) { |
3148 | *a = *r; |
3149 | } |
3150 | f = pf_anchor_stack + (*depth)++; |
3151 | f->rs = *rs; |
3152 | f->r = *r; |
3153 | if ((*r)->anchor_wildcard) { |
3154 | f->parent = &(*r)->anchor->children; |
3155 | if ((f->child = RB_MIN(pf_anchor_node, f->parent)) == |
3156 | NULL) { |
3157 | *r = NULL; |
3158 | return; |
3159 | } |
3160 | *rs = &f->child->ruleset; |
3161 | } else { |
3162 | f->parent = NULL; |
3163 | f->child = NULL; |
3164 | *rs = &(*r)->anchor->ruleset; |
3165 | } |
3166 | *r = TAILQ_FIRST((*rs)->rules[n].active.ptr); |
3167 | } |
3168 | |
3169 | int |
3170 | pf_step_out_of_anchor(int *depth, struct pf_ruleset **rs, int n, |
3171 | struct pf_rule **r, struct pf_rule **a, int *match) |
3172 | { |
3173 | struct pf_anchor_stackframe *f; |
3174 | int quick = 0; |
3175 | |
3176 | do { |
3177 | if (*depth <= 0) { |
3178 | break; |
3179 | } |
3180 | f = pf_anchor_stack + *depth - 1; |
3181 | if (f->parent != NULL && f->child != NULL) { |
3182 | if (f->child->match || |
3183 | (match != NULL && *match)) { |
3184 | f->r->anchor->match = 1; |
3185 | if (match) { |
3186 | *match = 0; |
3187 | } |
3188 | } |
3189 | f->child = RB_NEXT(pf_anchor_node, f->parent, f->child); |
3190 | if (f->child != NULL) { |
3191 | *rs = &f->child->ruleset; |
3192 | *r = TAILQ_FIRST((*rs)->rules[n].active.ptr); |
3193 | if (*r == NULL) { |
3194 | continue; |
3195 | } else { |
3196 | break; |
3197 | } |
3198 | } |
3199 | } |
3200 | (*depth)--; |
3201 | if (*depth == 0 && a != NULL) { |
3202 | *a = NULL; |
3203 | } |
3204 | *rs = f->rs; |
3205 | if (f->r->anchor->match || (match != NULL && *match)) { |
3206 | quick = f->r->quick; |
3207 | } |
3208 | *r = TAILQ_NEXT(f->r, entries); |
3209 | } while (*r == NULL); |
3210 | |
3211 | return quick; |
3212 | } |
3213 | |
3214 | void |
3215 | pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr, |
3216 | struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af) |
3217 | { |
3218 | switch (af) { |
3219 | #if INET |
3220 | case AF_INET: |
3221 | naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) | |
3222 | ((rmask->addr32[0] ^ 0xffffffff) & saddr->addr32[0]); |
3223 | break; |
3224 | #endif /* INET */ |
3225 | case AF_INET6: |
3226 | naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) | |
3227 | ((rmask->addr32[0] ^ 0xffffffff) & saddr->addr32[0]); |
3228 | naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) | |
3229 | ((rmask->addr32[1] ^ 0xffffffff) & saddr->addr32[1]); |
3230 | naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) | |
3231 | ((rmask->addr32[2] ^ 0xffffffff) & saddr->addr32[2]); |
3232 | naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) | |
3233 | ((rmask->addr32[3] ^ 0xffffffff) & saddr->addr32[3]); |
3234 | break; |
3235 | } |
3236 | } |
3237 | |
3238 | void |
3239 | pf_addr_inc(struct pf_addr *addr, sa_family_t af) |
3240 | { |
3241 | switch (af) { |
3242 | #if INET |
3243 | case AF_INET: |
3244 | addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1); |
3245 | break; |
3246 | #endif /* INET */ |
3247 | case AF_INET6: |
3248 | if (addr->addr32[3] == 0xffffffff) { |
3249 | addr->addr32[3] = 0; |
3250 | if (addr->addr32[2] == 0xffffffff) { |
3251 | addr->addr32[2] = 0; |
3252 | if (addr->addr32[1] == 0xffffffff) { |
3253 | addr->addr32[1] = 0; |
3254 | addr->addr32[0] = |
3255 | htonl(ntohl(addr->addr32[0]) + 1); |
3256 | } else { |
3257 | addr->addr32[1] = |
3258 | htonl(ntohl(addr->addr32[1]) + 1); |
3259 | } |
3260 | } else { |
3261 | addr->addr32[2] = |
3262 | htonl(ntohl(addr->addr32[2]) + 1); |
3263 | } |
3264 | } else { |
3265 | addr->addr32[3] = |
3266 | htonl(ntohl(addr->addr32[3]) + 1); |
3267 | } |
3268 | break; |
3269 | } |
3270 | } |
3271 | |
3272 | #define mix(a, b, c) \ |
3273 | do { \ |
3274 | a -= b; a -= c; a ^= (c >> 13); \ |
3275 | b -= c; b -= a; b ^= (a << 8); \ |
3276 | c -= a; c -= b; c ^= (b >> 13); \ |
3277 | a -= b; a -= c; a ^= (c >> 12); \ |
3278 | b -= c; b -= a; b ^= (a << 16); \ |
3279 | c -= a; c -= b; c ^= (b >> 5); \ |
3280 | a -= b; a -= c; a ^= (c >> 3); \ |
3281 | b -= c; b -= a; b ^= (a << 10); \ |
3282 | c -= a; c -= b; c ^= (b >> 15); \ |
3283 | } while (0) |
3284 | |
3285 | /* |
3286 | * hash function based on bridge_hash in if_bridge.c |
3287 | */ |
3288 | static void |
3289 | pf_hash(struct pf_addr *inaddr, struct pf_addr *hash, |
3290 | struct pf_poolhashkey *key, sa_family_t af) |
3291 | { |
3292 | u_int32_t a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0]; |
3293 | |
3294 | switch (af) { |
3295 | #if INET |
3296 | case AF_INET: |
3297 | a += inaddr->addr32[0]; |
3298 | b += key->key32[1]; |
3299 | mix(a, b, c); |
3300 | hash->addr32[0] = c + key->key32[2]; |
3301 | break; |
3302 | #endif /* INET */ |
3303 | case AF_INET6: |
3304 | a += inaddr->addr32[0]; |
3305 | b += inaddr->addr32[2]; |
3306 | mix(a, b, c); |
3307 | hash->addr32[0] = c; |
3308 | a += inaddr->addr32[1]; |
3309 | b += inaddr->addr32[3]; |
3310 | c += key->key32[1]; |
3311 | mix(a, b, c); |
3312 | hash->addr32[1] = c; |
3313 | a += inaddr->addr32[2]; |
3314 | b += inaddr->addr32[1]; |
3315 | c += key->key32[2]; |
3316 | mix(a, b, c); |
3317 | hash->addr32[2] = c; |
3318 | a += inaddr->addr32[3]; |
3319 | b += inaddr->addr32[0]; |
3320 | c += key->key32[3]; |
3321 | mix(a, b, c); |
3322 | hash->addr32[3] = c; |
3323 | break; |
3324 | } |
3325 | } |
3326 | |
3327 | static __attribute__((noinline)) int |
3328 | pf_map_addr(sa_family_t af, struct pf_rule *r, struct pf_addr *saddr, |
3329 | struct pf_addr *naddr, struct pf_addr *init_addr, struct pf_src_node **sn) |
3330 | { |
3331 | unsigned char hash[16]; |
3332 | struct pf_pool *rpool = &r->rpool; |
3333 | struct pf_addr *raddr = &rpool->cur->addr.v.a.addr; |
3334 | struct pf_addr *rmask = &rpool->cur->addr.v.a.mask; |
3335 | struct pf_pooladdr *acur = rpool->cur; |
3336 | struct pf_src_node k; |
3337 | |
3338 | if (*sn == NULL && r->rpool.opts & PF_POOL_STICKYADDR && |
3339 | (r->rpool.opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) { |
3340 | k.af = af; |
3341 | PF_ACPY(&k.addr, saddr, af); |
3342 | if (r->rule_flag & PFRULE_RULESRCTRACK || |
3343 | r->rpool.opts & PF_POOL_STICKYADDR) { |
3344 | k.rule.ptr = r; |
3345 | } else { |
3346 | k.rule.ptr = NULL; |
3347 | } |
3348 | pf_status.scounters[SCNT_SRC_NODE_SEARCH]++; |
3349 | *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k); |
3350 | if (*sn != NULL && !PF_AZERO(&(*sn)->raddr, rpool->af)) { |
3351 | PF_ACPY(naddr, &(*sn)->raddr, rpool->af); |
3352 | if (pf_status.debug >= PF_DEBUG_MISC) { |
3353 | printf("pf_map_addr: src tracking maps " ); |
3354 | pf_print_host(addr: &k.addr, p: 0, af); |
3355 | printf(" to " ); |
3356 | pf_print_host(addr: naddr, p: 0, af: rpool->af); |
3357 | printf("\n" ); |
3358 | } |
3359 | return 0; |
3360 | } |
3361 | } |
3362 | |
3363 | if (rpool->cur->addr.type == PF_ADDR_NOROUTE) { |
3364 | return 1; |
3365 | } |
3366 | if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { |
3367 | if (rpool->cur->addr.p.dyn == NULL) { |
3368 | return 1; |
3369 | } |
3370 | switch (rpool->af) { |
3371 | #if INET |
3372 | case AF_INET: |
3373 | if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 && |
3374 | (rpool->opts & PF_POOL_TYPEMASK) != |
3375 | PF_POOL_ROUNDROBIN) { |
3376 | return 1; |
3377 | } |
3378 | raddr = &rpool->cur->addr.p.dyn->pfid_addr4; |
3379 | rmask = &rpool->cur->addr.p.dyn->pfid_mask4; |
3380 | break; |
3381 | #endif /* INET */ |
3382 | case AF_INET6: |
3383 | if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 && |
3384 | (rpool->opts & PF_POOL_TYPEMASK) != |
3385 | PF_POOL_ROUNDROBIN) { |
3386 | return 1; |
3387 | } |
3388 | raddr = &rpool->cur->addr.p.dyn->pfid_addr6; |
3389 | rmask = &rpool->cur->addr.p.dyn->pfid_mask6; |
3390 | break; |
3391 | } |
3392 | } else if (rpool->cur->addr.type == PF_ADDR_TABLE) { |
3393 | if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN) { |
3394 | return 1; /* unsupported */ |
3395 | } |
3396 | } else { |
3397 | raddr = &rpool->cur->addr.v.a.addr; |
3398 | rmask = &rpool->cur->addr.v.a.mask; |
3399 | } |
3400 | |
3401 | switch (rpool->opts & PF_POOL_TYPEMASK) { |
3402 | case PF_POOL_NONE: |
3403 | PF_ACPY(naddr, raddr, rpool->af); |
3404 | break; |
3405 | case PF_POOL_BITMASK: |
3406 | ASSERT(af == rpool->af); |
3407 | PF_POOLMASK(naddr, raddr, rmask, saddr, af); |
3408 | break; |
3409 | case PF_POOL_RANDOM: |
3410 | if (init_addr != NULL && PF_AZERO(init_addr, rpool->af)) { |
3411 | switch (af) { |
3412 | #if INET |
3413 | case AF_INET: |
3414 | rpool->counter.addr32[0] = htonl(random()); |
3415 | break; |
3416 | #endif /* INET */ |
3417 | case AF_INET6: |
3418 | if (rmask->addr32[3] != 0xffffffff) { |
3419 | rpool->counter.addr32[3] = |
3420 | RandomULong(); |
3421 | } else { |
3422 | break; |
3423 | } |
3424 | if (rmask->addr32[2] != 0xffffffff) { |
3425 | rpool->counter.addr32[2] = |
3426 | RandomULong(); |
3427 | } else { |
3428 | break; |
3429 | } |
3430 | if (rmask->addr32[1] != 0xffffffff) { |
3431 | rpool->counter.addr32[1] = |
3432 | RandomULong(); |
3433 | } else { |
3434 | break; |
3435 | } |
3436 | if (rmask->addr32[0] != 0xffffffff) { |
3437 | rpool->counter.addr32[0] = |
3438 | RandomULong(); |
3439 | } |
3440 | break; |
3441 | } |
3442 | PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, |
3443 | rpool->af); |
3444 | PF_ACPY(init_addr, naddr, rpool->af); |
3445 | } else { |
3446 | PF_AINC(&rpool->counter, rpool->af); |
3447 | PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, |
3448 | rpool->af); |
3449 | } |
3450 | break; |
3451 | case PF_POOL_SRCHASH: |
3452 | ASSERT(af == rpool->af); |
3453 | PF_POOLMASK(naddr, raddr, rmask, saddr, af); |
3454 | pf_hash(inaddr: saddr, hash: (struct pf_addr *)(void *)&hash, |
3455 | key: &rpool->key, af); |
3456 | PF_POOLMASK(naddr, raddr, rmask, |
3457 | (struct pf_addr *)(void *)&hash, af); |
3458 | break; |
3459 | case PF_POOL_ROUNDROBIN: |
3460 | if (rpool->cur->addr.type == PF_ADDR_TABLE) { |
3461 | if (!pfr_pool_get(rpool->cur->addr.p.tbl, |
3462 | &rpool->tblidx, &rpool->counter, |
3463 | &raddr, &rmask, rpool->af)) { |
3464 | goto get_addr; |
3465 | } |
3466 | } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { |
3467 | if (rpool->cur->addr.p.dyn != NULL && |
3468 | !pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt, |
3469 | &rpool->tblidx, &rpool->counter, |
3470 | &raddr, &rmask, af)) { |
3471 | goto get_addr; |
3472 | } |
3473 | } else if (pf_match_addr(n: 0, a: raddr, m: rmask, b: &rpool->counter, |
3474 | af: rpool->af)) { |
3475 | goto get_addr; |
3476 | } |
3477 | |
3478 | try_next: |
3479 | if ((rpool->cur = TAILQ_NEXT(rpool->cur, entries)) == NULL) { |
3480 | rpool->cur = TAILQ_FIRST(&rpool->list); |
3481 | } |
3482 | if (rpool->cur->addr.type == PF_ADDR_TABLE) { |
3483 | rpool->tblidx = -1; |
3484 | if (pfr_pool_get(rpool->cur->addr.p.tbl, |
3485 | &rpool->tblidx, &rpool->counter, |
3486 | &raddr, &rmask, rpool->af)) { |
3487 | /* table contains no address of type |
3488 | * 'rpool->af' */ |
3489 | if (rpool->cur != acur) { |
3490 | goto try_next; |
3491 | } |
3492 | return 1; |
3493 | } |
3494 | } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { |
3495 | rpool->tblidx = -1; |
3496 | if (rpool->cur->addr.p.dyn == NULL) { |
3497 | return 1; |
3498 | } |
3499 | if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt, |
3500 | &rpool->tblidx, &rpool->counter, |
3501 | &raddr, &rmask, rpool->af)) { |
3502 | /* table contains no address of type |
3503 | * 'rpool->af' */ |
3504 | if (rpool->cur != acur) { |
3505 | goto try_next; |
3506 | } |
3507 | return 1; |
3508 | } |
3509 | } else { |
3510 | raddr = &rpool->cur->addr.v.a.addr; |
3511 | rmask = &rpool->cur->addr.v.a.mask; |
3512 | PF_ACPY(&rpool->counter, raddr, rpool->af); |
3513 | } |
3514 | |
3515 | get_addr: |
3516 | PF_ACPY(naddr, &rpool->counter, rpool->af); |
3517 | if (init_addr != NULL && PF_AZERO(init_addr, rpool->af)) { |
3518 | PF_ACPY(init_addr, naddr, rpool->af); |
3519 | } |
3520 | PF_AINC(&rpool->counter, rpool->af); |
3521 | break; |
3522 | } |
3523 | if (*sn != NULL) { |
3524 | PF_ACPY(&(*sn)->raddr, naddr, rpool->af); |
3525 | } |
3526 | |
3527 | if (pf_status.debug >= PF_DEBUG_MISC && |
3528 | (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) { |
3529 | printf("pf_map_addr: selected address " ); |
3530 | pf_print_host(addr: naddr, p: 0, af: rpool->af); |
3531 | printf("\n" ); |
3532 | } |
3533 | |
3534 | return 0; |
3535 | } |
3536 | |
3537 | static __attribute__((noinline)) int |
3538 | pf_get_sport(struct pf_pdesc *pd, struct pfi_kif *kif, struct pf_rule *r, |
3539 | struct pf_addr *saddr, union pf_state_xport *sxport, struct pf_addr *daddr, |
3540 | union pf_state_xport *dxport, struct pf_addr *naddr, |
3541 | union pf_state_xport *nxport, struct pf_src_node **sn |
3542 | #if SKYWALK |
3543 | , netns_token *pnstoken |
3544 | #endif |
3545 | ) |
3546 | { |
3547 | #pragma unused(kif) |
3548 | struct pf_state_key_cmp key; |
3549 | struct pf_addr init_addr; |
3550 | unsigned int cut; |
3551 | sa_family_t af = pd->af; |
3552 | u_int8_t proto = pd->proto; |
3553 | unsigned int low = r->rpool.proxy_port[0]; |
3554 | unsigned int high = r->rpool.proxy_port[1]; |
3555 | |
3556 | bzero(s: &init_addr, n: sizeof(init_addr)); |
3557 | if (pf_map_addr(af, r, saddr, naddr, init_addr: &init_addr, sn)) { |
3558 | return 1; |
3559 | } |
3560 | |
3561 | if (proto == IPPROTO_ICMP) { |
3562 | low = 1; |
3563 | high = 65535; |
3564 | } |
3565 | |
3566 | if (!nxport) { |
3567 | return 0; /* No output necessary. */ |
3568 | } |
3569 | /*--- Special mapping rules for UDP ---*/ |
3570 | if (proto == IPPROTO_UDP) { |
3571 | /*--- Never float IKE source port ---*/ |
3572 | if (ntohs(sxport->port) == PF_IKE_PORT) { |
3573 | |
---|