1 /* $NetBSD: pf_norm.c,v 1.29 2021/03/08 23:34:58 christos Exp $ */
2 /* $OpenBSD: pf_norm.c,v 1.109 2007/05/28 17:16:39 henning Exp $ */
3
4 /*
5 * Copyright 2001 Niels Provos <provos@citi.umich.edu>
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27 */
28
29 #include <sys/cdefs.h>
30 __KERNEL_RCSID(0, "$NetBSD: pf_norm.c,v 1.29 2021/03/08 23:34:58 christos Exp $");
31
32 #ifdef _KERNEL_OPT
33 #include "opt_inet.h"
34 #endif
35
36 #include "pflog.h"
37
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/mbuf.h>
41 #include <sys/filio.h>
42 #include <sys/fcntl.h>
43 #include <sys/socket.h>
44 #include <sys/kernel.h>
45 #include <sys/time.h>
46 #include <sys/pool.h>
47
48 #ifdef __NetBSD__
49 #include <sys/cprng.h>
50 #else
51 #include <dev/rndvar.h>
52 #endif /* !__NetBSD__ */
53 #include <net/if.h>
54 #include <net/if_types.h>
55 #include <net/bpf.h>
56 #include <net/route.h>
57 #include <net/if_pflog.h>
58
59 #include <netinet/in.h>
60 #include <netinet/in_var.h>
61 #include <netinet/in_systm.h>
62 #include <netinet/ip.h>
63 #include <netinet/ip_var.h>
64 #include <netinet/tcp.h>
65 #include <netinet/tcp_seq.h>
66 #include <netinet/udp.h>
67 #include <netinet/ip_icmp.h>
68
69 #ifdef INET6
70 #include <netinet/ip6.h>
71 #endif /* INET6 */
72
73 #include <net/pfvar.h>
74
75 struct pf_frent {
76 LIST_ENTRY(pf_frent) fr_next;
77 struct ip *fr_ip;
78 struct mbuf *fr_m;
79 };
80
81 struct pf_frcache {
82 LIST_ENTRY(pf_frcache) fr_next;
83 uint16_t fr_off;
84 uint16_t fr_end;
85 };
86
87 #define PFFRAG_SEENLAST 0x0001 /* Seen the last fragment for this */
88 #define PFFRAG_NOBUFFER 0x0002 /* Non-buffering fragment cache */
89 #define PFFRAG_DROP 0x0004 /* Drop all fragments */
90 #define BUFFER_FRAGMENTS(fr) (!((fr)->fr_flags & PFFRAG_NOBUFFER))
91
92 struct pf_fragment {
93 RB_ENTRY(pf_fragment) fr_entry;
94 TAILQ_ENTRY(pf_fragment) frag_next;
95 struct in_addr fr_src;
96 struct in_addr fr_dst;
97 u_int8_t fr_p; /* protocol of this fragment */
98 u_int8_t fr_flags; /* status flags */
99 u_int16_t fr_id; /* fragment id for reassemble */
100 u_int16_t fr_max; /* fragment data max */
101 u_int32_t fr_timeout;
102 #define fr_queue fr_u.fru_queue
103 #define fr_cache fr_u.fru_cache
104 union {
105 LIST_HEAD(pf_fragq, pf_frent) fru_queue; /* buffering */
106 LIST_HEAD(pf_cacheq, pf_frcache) fru_cache; /* non-buf */
107 } fr_u;
108 };
109
110 TAILQ_HEAD(pf_fragqueue, pf_fragment) pf_fragqueue;
111 TAILQ_HEAD(pf_cachequeue, pf_fragment) pf_cachequeue;
112
113 static __inline int pf_frag_compare(struct pf_fragment *,
114 struct pf_fragment *);
115 RB_HEAD(pf_frag_tree, pf_fragment) pf_frag_tree, pf_cache_tree;
116 RB_PROTOTYPE(pf_frag_tree, pf_fragment, fr_entry, pf_frag_compare);
117 RB_GENERATE(pf_frag_tree, pf_fragment, fr_entry, pf_frag_compare);
118
119 /* Private prototypes */
120 void pf_ip2key(struct pf_fragment *, struct ip *);
121 void pf_remove_fragment(struct pf_fragment *);
122 void pf_flush_fragments(void);
123 void pf_free_fragment(struct pf_fragment *);
124 struct pf_fragment *pf_find_fragment(struct ip *, struct pf_frag_tree *);
125 struct mbuf *pf_reassemble(struct mbuf **, struct pf_fragment **,
126 struct pf_frent *, int);
127 struct mbuf *pf_fragcache(struct mbuf **, struct ip*,
128 struct pf_fragment **, int, int, int *);
129 int pf_normalize_tcpopt(struct pf_rule *, struct mbuf *,
130 struct tcphdr *, int);
131
132 #define DPFPRINTF(x) do { \
133 if (pf_status.debug >= PF_DEBUG_MISC) { \
134 printf("%s: ", __func__); \
135 printf x ; \
136 } \
137 } while(0)
138
139 /* Globals */
140 struct pool pf_frent_pl, pf_frag_pl, pf_cache_pl, pf_cent_pl;
141 struct pool pf_state_scrub_pl;
142 int pf_nfrents, pf_ncache;
143
144 void
pf_normalize_init(void)145 pf_normalize_init(void)
146 {
147 #ifdef __NetBSD__
148 pool_init(&pf_frent_pl, sizeof(struct pf_frent), 0, 0, 0, "pffrent",
149 NULL, IPL_SOFTNET);
150 pool_init(&pf_frag_pl, sizeof(struct pf_fragment), 0, 0, 0, "pffrag",
151 NULL, IPL_SOFTNET);
152 pool_init(&pf_cache_pl, sizeof(struct pf_fragment), 0, 0, 0,
153 "pffrcache", NULL, IPL_SOFTNET);
154 pool_init(&pf_cent_pl, sizeof(struct pf_frcache), 0, 0, 0, "pffrcent",
155 NULL, IPL_SOFTNET);
156 pool_init(&pf_state_scrub_pl, sizeof(struct pf_state_scrub), 0, 0, 0,
157 "pfstscr", NULL, IPL_SOFTNET);
158 #else
159 pool_init(&pf_frent_pl, sizeof(struct pf_frent), 0, 0, 0, "pffrent",
160 NULL);
161 pool_init(&pf_frag_pl, sizeof(struct pf_fragment), 0, 0, 0, "pffrag",
162 NULL);
163 pool_init(&pf_cache_pl, sizeof(struct pf_fragment), 0, 0, 0,
164 "pffrcache", NULL);
165 pool_init(&pf_cent_pl, sizeof(struct pf_frcache), 0, 0, 0, "pffrcent",
166 NULL);
167 pool_init(&pf_state_scrub_pl, sizeof(struct pf_state_scrub), 0, 0, 0,
168 "pfstscr", NULL);
169 #endif /* !__NetBSD__ */
170
171 pool_sethiwat(&pf_frag_pl, PFFRAG_FRAG_HIWAT);
172 pool_sethardlimit(&pf_frent_pl, PFFRAG_FRENT_HIWAT, NULL, 0);
173 pool_sethardlimit(&pf_cache_pl, PFFRAG_FRCACHE_HIWAT, NULL, 0);
174 pool_sethardlimit(&pf_cent_pl, PFFRAG_FRCENT_HIWAT, NULL, 0);
175
176 TAILQ_INIT(&pf_fragqueue);
177 TAILQ_INIT(&pf_cachequeue);
178 }
179
180 #ifdef _MODULE
181 void
pf_normalize_destroy(void)182 pf_normalize_destroy(void)
183 {
184 pool_destroy(&pf_state_scrub_pl);
185 pool_destroy(&pf_cent_pl);
186 pool_destroy(&pf_cache_pl);
187 pool_destroy(&pf_frag_pl);
188 pool_destroy(&pf_frent_pl);
189 }
190 #endif /* _MODULE */
191
192 static __inline int
pf_frag_compare(struct pf_fragment * a,struct pf_fragment * b)193 pf_frag_compare(struct pf_fragment *a, struct pf_fragment *b)
194 {
195 int diff;
196
197 if ((diff = a->fr_id - b->fr_id))
198 return (diff);
199 else if ((diff = a->fr_p - b->fr_p))
200 return (diff);
201 else if (a->fr_src.s_addr < b->fr_src.s_addr)
202 return (-1);
203 else if (a->fr_src.s_addr > b->fr_src.s_addr)
204 return (1);
205 else if (a->fr_dst.s_addr < b->fr_dst.s_addr)
206 return (-1);
207 else if (a->fr_dst.s_addr > b->fr_dst.s_addr)
208 return (1);
209 return (0);
210 }
211
212 void
pf_purge_expired_fragments(void)213 pf_purge_expired_fragments(void)
214 {
215 struct pf_fragment *frag;
216 u_int32_t expire = time_second -
217 pf_default_rule.timeout[PFTM_FRAG];
218
219 while ((frag = TAILQ_LAST(&pf_fragqueue, pf_fragqueue)) != NULL) {
220 KASSERT(BUFFER_FRAGMENTS(frag));
221 if (frag->fr_timeout > expire)
222 break;
223
224 DPFPRINTF(("expiring %d(%p)\n", frag->fr_id, frag));
225 pf_free_fragment(frag);
226 }
227
228 while ((frag = TAILQ_LAST(&pf_cachequeue, pf_cachequeue)) != NULL) {
229 KASSERT(!BUFFER_FRAGMENTS(frag));
230 if (frag->fr_timeout > expire)
231 break;
232
233 DPFPRINTF(("expiring %d(%p)\n", frag->fr_id, frag));
234 pf_free_fragment(frag);
235 KASSERT(TAILQ_EMPTY(&pf_cachequeue) ||
236 TAILQ_LAST(&pf_cachequeue, pf_cachequeue) != frag);
237 }
238 }
239
240 /*
241 * Try to flush old fragments to make space for new ones
242 */
243
244 void
pf_flush_fragments(void)245 pf_flush_fragments(void)
246 {
247 struct pf_fragment *frag;
248 int goal;
249
250 goal = pf_nfrents * 9 / 10;
251 DPFPRINTF(("trying to free > %d frents\n",
252 pf_nfrents - goal));
253 while (goal < pf_nfrents) {
254 frag = TAILQ_LAST(&pf_fragqueue, pf_fragqueue);
255 if (frag == NULL)
256 break;
257 pf_free_fragment(frag);
258 }
259
260
261 goal = pf_ncache * 9 / 10;
262 DPFPRINTF(("trying to free > %d cache entries\n",
263 pf_ncache - goal));
264 while (goal < pf_ncache) {
265 frag = TAILQ_LAST(&pf_cachequeue, pf_cachequeue);
266 if (frag == NULL)
267 break;
268 pf_free_fragment(frag);
269 }
270 }
271
272 /* Frees the fragments and all associated entries */
273
274 void
pf_free_fragment(struct pf_fragment * frag)275 pf_free_fragment(struct pf_fragment *frag)
276 {
277 struct pf_frent *frent;
278 struct pf_frcache *frcache;
279
280 /* Free all fragments */
281 if (BUFFER_FRAGMENTS(frag)) {
282 for (frent = LIST_FIRST(&frag->fr_queue); frent;
283 frent = LIST_FIRST(&frag->fr_queue)) {
284 LIST_REMOVE(frent, fr_next);
285
286 m_freem(frent->fr_m);
287 pool_put(&pf_frent_pl, frent);
288 pf_nfrents--;
289 }
290 } else {
291 for (frcache = LIST_FIRST(&frag->fr_cache); frcache;
292 frcache = LIST_FIRST(&frag->fr_cache)) {
293 LIST_REMOVE(frcache, fr_next);
294
295 KASSERT(LIST_EMPTY(&frag->fr_cache) ||
296 LIST_FIRST(&frag->fr_cache)->fr_off >
297 frcache->fr_end);
298
299 pool_put(&pf_cent_pl, frcache);
300 pf_ncache--;
301 }
302 }
303
304 pf_remove_fragment(frag);
305 }
306
307 void
pf_ip2key(struct pf_fragment * key,struct ip * ip)308 pf_ip2key(struct pf_fragment *key, struct ip *ip)
309 {
310 key->fr_p = ip->ip_p;
311 key->fr_id = ip->ip_id;
312 key->fr_src.s_addr = ip->ip_src.s_addr;
313 key->fr_dst.s_addr = ip->ip_dst.s_addr;
314 }
315
316 struct pf_fragment *
pf_find_fragment(struct ip * ip,struct pf_frag_tree * tree)317 pf_find_fragment(struct ip *ip, struct pf_frag_tree *tree)
318 {
319 struct pf_fragment key;
320 struct pf_fragment *frag;
321
322 pf_ip2key(&key, ip);
323
324 frag = RB_FIND(pf_frag_tree, tree, &key);
325 if (frag != NULL) {
326 /* XXX Are we sure we want to update the timeout? */
327 frag->fr_timeout = time_second;
328 if (BUFFER_FRAGMENTS(frag)) {
329 TAILQ_REMOVE(&pf_fragqueue, frag, frag_next);
330 TAILQ_INSERT_HEAD(&pf_fragqueue, frag, frag_next);
331 } else {
332 TAILQ_REMOVE(&pf_cachequeue, frag, frag_next);
333 TAILQ_INSERT_HEAD(&pf_cachequeue, frag, frag_next);
334 }
335 }
336
337 return (frag);
338 }
339
340 /* Removes a fragment from the fragment queue and frees the fragment */
341
342 void
pf_remove_fragment(struct pf_fragment * frag)343 pf_remove_fragment(struct pf_fragment *frag)
344 {
345 if (BUFFER_FRAGMENTS(frag)) {
346 RB_REMOVE(pf_frag_tree, &pf_frag_tree, frag);
347 TAILQ_REMOVE(&pf_fragqueue, frag, frag_next);
348 pool_put(&pf_frag_pl, frag);
349 } else {
350 RB_REMOVE(pf_frag_tree, &pf_cache_tree, frag);
351 TAILQ_REMOVE(&pf_cachequeue, frag, frag_next);
352 pool_put(&pf_cache_pl, frag);
353 }
354 }
355
356 #define FR_IP_OFF(fr) ((ntohs((fr)->fr_ip->ip_off) & IP_OFFMASK) << 3)
357 struct mbuf *
pf_reassemble(struct mbuf ** m0,struct pf_fragment ** frag,struct pf_frent * frent,int mff)358 pf_reassemble(struct mbuf **m0, struct pf_fragment **frag,
359 struct pf_frent *frent, int mff)
360 {
361 struct mbuf *m = *m0, *m2;
362 struct pf_frent *frea, *next;
363 struct pf_frent *frep = NULL;
364 struct ip *ip = frent->fr_ip;
365 int hlen = ip->ip_hl << 2;
366 u_int16_t off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3;
367 u_int16_t ip_len = ntohs(ip->ip_len) - ip->ip_hl * 4;
368 u_int16_t frmax = ip_len + off;
369
370 KASSERT(*frag == NULL || BUFFER_FRAGMENTS(*frag));
371
372 /* Strip off ip header */
373 m->m_data += hlen;
374 m->m_len -= hlen;
375
376 /* Create a new reassembly queue for this packet */
377 if (*frag == NULL) {
378 *frag = pool_get(&pf_frag_pl, PR_NOWAIT);
379 if (*frag == NULL) {
380 pf_flush_fragments();
381 *frag = pool_get(&pf_frag_pl, PR_NOWAIT);
382 if (*frag == NULL)
383 goto drop_fragment;
384 }
385
386 (*frag)->fr_flags = 0;
387 (*frag)->fr_max = 0;
388 (*frag)->fr_src = frent->fr_ip->ip_src;
389 (*frag)->fr_dst = frent->fr_ip->ip_dst;
390 (*frag)->fr_p = frent->fr_ip->ip_p;
391 (*frag)->fr_id = frent->fr_ip->ip_id;
392 (*frag)->fr_timeout = time_second;
393 LIST_INIT(&(*frag)->fr_queue);
394
395 RB_INSERT(pf_frag_tree, &pf_frag_tree, *frag);
396 TAILQ_INSERT_HEAD(&pf_fragqueue, *frag, frag_next);
397
398 /* We do not have a previous fragment */
399 frep = NULL;
400 goto insert;
401 }
402
403 /*
404 * Find a fragment after the current one:
405 * - off contains the real shifted offset.
406 */
407 LIST_FOREACH(frea, &(*frag)->fr_queue, fr_next) {
408 if (FR_IP_OFF(frea) > off)
409 break;
410 frep = frea;
411 }
412
413 KASSERT(frep != NULL || frea != NULL);
414
415 if (frep != NULL &&
416 FR_IP_OFF(frep) + ntohs(frep->fr_ip->ip_len) - frep->fr_ip->ip_hl *
417 4 > off)
418 {
419 u_int16_t precut;
420
421 precut = FR_IP_OFF(frep) + ntohs(frep->fr_ip->ip_len) -
422 frep->fr_ip->ip_hl * 4 - off;
423 if (precut >= ip_len)
424 goto drop_fragment;
425 m_adj(frent->fr_m, precut);
426 DPFPRINTF(("overlap -%d\n", precut));
427 /* Enforce 8 byte boundaries */
428 ip->ip_off = htons(ntohs(ip->ip_off) + (precut >> 3));
429 off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3;
430 ip_len -= precut;
431 ip->ip_len = htons(ip_len);
432 }
433
434 for (; frea != NULL && ip_len + off > FR_IP_OFF(frea);
435 frea = next)
436 {
437 u_int16_t aftercut;
438
439 aftercut = ip_len + off - FR_IP_OFF(frea);
440 DPFPRINTF(("adjust overlap %d\n", aftercut));
441 if (aftercut < ntohs(frea->fr_ip->ip_len) - frea->fr_ip->ip_hl
442 * 4)
443 {
444 frea->fr_ip->ip_len =
445 htons(ntohs(frea->fr_ip->ip_len) - aftercut);
446 frea->fr_ip->ip_off = htons(ntohs(frea->fr_ip->ip_off) +
447 (aftercut >> 3));
448 m_adj(frea->fr_m, aftercut);
449 break;
450 }
451
452 /* This fragment is completely overlapped, lose it */
453 next = LIST_NEXT(frea, fr_next);
454 m_freem(frea->fr_m);
455 LIST_REMOVE(frea, fr_next);
456 pool_put(&pf_frent_pl, frea);
457 pf_nfrents--;
458 }
459
460 insert:
461 /* Update maximum data size */
462 if ((*frag)->fr_max < frmax)
463 (*frag)->fr_max = frmax;
464 /* This is the last segment */
465 if (!mff)
466 (*frag)->fr_flags |= PFFRAG_SEENLAST;
467
468 if (frep == NULL)
469 LIST_INSERT_HEAD(&(*frag)->fr_queue, frent, fr_next);
470 else
471 LIST_INSERT_AFTER(frep, frent, fr_next);
472
473 /* Check if we are completely reassembled */
474 if (!((*frag)->fr_flags & PFFRAG_SEENLAST))
475 return (NULL);
476
477 /* Check if we have all the data */
478 off = 0;
479 for (frep = LIST_FIRST(&(*frag)->fr_queue); frep; frep = next) {
480 next = LIST_NEXT(frep, fr_next);
481
482 off += ntohs(frep->fr_ip->ip_len) - frep->fr_ip->ip_hl * 4;
483 if (off < (*frag)->fr_max &&
484 (next == NULL || FR_IP_OFF(next) != off))
485 {
486 DPFPRINTF(("missing fragment at %d, next %d, max %d\n",
487 off, next == NULL ? -1 : FR_IP_OFF(next),
488 (*frag)->fr_max));
489 return (NULL);
490 }
491 }
492 DPFPRINTF(("%d < %d?\n", off, (*frag)->fr_max));
493 if (off < (*frag)->fr_max)
494 return (NULL);
495
496 /* We have all the data */
497 frent = LIST_FIRST(&(*frag)->fr_queue);
498 KASSERT(frent != NULL);
499 if ((frent->fr_ip->ip_hl << 2) + off > IP_MAXPACKET) {
500 DPFPRINTF(("drop: too big: %d\n", off));
501 pf_free_fragment(*frag);
502 *frag = NULL;
503 return (NULL);
504 }
505 next = LIST_NEXT(frent, fr_next);
506
507 /* Magic from ip_input */
508 ip = frent->fr_ip;
509 m = frent->fr_m;
510 m2 = m->m_next;
511 m->m_next = NULL;
512 m_cat(m, m2);
513 pool_put(&pf_frent_pl, frent);
514 pf_nfrents--;
515 for (frent = next; frent != NULL; frent = next) {
516 next = LIST_NEXT(frent, fr_next);
517
518 m2 = frent->fr_m;
519 pool_put(&pf_frent_pl, frent);
520 pf_nfrents--;
521 m_cat(m, m2);
522 }
523
524 ip->ip_src = (*frag)->fr_src;
525 ip->ip_dst = (*frag)->fr_dst;
526
527 /* Remove from fragment queue */
528 pf_remove_fragment(*frag);
529 *frag = NULL;
530
531 hlen = ip->ip_hl << 2;
532 ip->ip_len = htons(off + hlen);
533 m->m_len += hlen;
534 m->m_data -= hlen;
535
536 /* some debugging cruft by sklower, below, will go away soon */
537 /* XXX this should be done elsewhere */
538 if (m->m_flags & M_PKTHDR) {
539 int plen = 0;
540 for (m2 = m; m2; m2 = m2->m_next)
541 plen += m2->m_len;
542 m->m_pkthdr.len = plen;
543 #ifdef __NetBSD__
544 m->m_pkthdr.csum_flags = 0;
545 #endif /* __NetBSD__ */
546 }
547
548 DPFPRINTF(("complete: %p(%d)\n", m, ntohs(ip->ip_len)));
549 return (m);
550
551 drop_fragment:
552 /* Oops - fail safe - drop packet */
553 pool_put(&pf_frent_pl, frent);
554 pf_nfrents--;
555 m_freem(m);
556 return (NULL);
557 }
558
559 struct mbuf *
pf_fragcache(struct mbuf ** m0,struct ip * h,struct pf_fragment ** frag,int mff,int drop,int * nomem)560 pf_fragcache(struct mbuf **m0, struct ip *h, struct pf_fragment **frag, int mff,
561 int drop, int *nomem)
562 {
563 struct mbuf *m = *m0;
564 struct pf_frcache *frp, *fra, *cur = NULL;
565 int ip_len = ntohs(h->ip_len) - (h->ip_hl << 2);
566 u_int16_t off = ntohs(h->ip_off) << 3;
567 u_int16_t frmax = ip_len + off;
568 int hosed = 0;
569
570 KASSERT(*frag == NULL || !BUFFER_FRAGMENTS(*frag));
571
572 /* Create a new range queue for this packet */
573 if (*frag == NULL) {
574 *frag = pool_get(&pf_cache_pl, PR_NOWAIT);
575 if (*frag == NULL) {
576 pf_flush_fragments();
577 *frag = pool_get(&pf_cache_pl, PR_NOWAIT);
578 if (*frag == NULL)
579 goto no_mem;
580 }
581
582 /* Get an entry for the queue */
583 cur = pool_get(&pf_cent_pl, PR_NOWAIT);
584 if (cur == NULL) {
585 pool_put(&pf_cache_pl, *frag);
586 *frag = NULL;
587 goto no_mem;
588 }
589 pf_ncache++;
590
591 (*frag)->fr_flags = PFFRAG_NOBUFFER;
592 (*frag)->fr_max = 0;
593 (*frag)->fr_src = h->ip_src;
594 (*frag)->fr_dst = h->ip_dst;
595 (*frag)->fr_p = h->ip_p;
596 (*frag)->fr_id = h->ip_id;
597 (*frag)->fr_timeout = time_second;
598
599 cur->fr_off = off;
600 cur->fr_end = frmax;
601 LIST_INIT(&(*frag)->fr_cache);
602 LIST_INSERT_HEAD(&(*frag)->fr_cache, cur, fr_next);
603
604 RB_INSERT(pf_frag_tree, &pf_cache_tree, *frag);
605 TAILQ_INSERT_HEAD(&pf_cachequeue, *frag, frag_next);
606
607 DPFPRINTF(("fragcache[%d]: new %d-%d\n", h->ip_id, off, frmax));
608
609 goto pass;
610 }
611
612 /*
613 * Find a fragment after the current one:
614 * - off contains the real shifted offset.
615 */
616 frp = NULL;
617 LIST_FOREACH(fra, &(*frag)->fr_cache, fr_next) {
618 if (fra->fr_off > off)
619 break;
620 frp = fra;
621 }
622
623 KASSERT(frp != NULL || fra != NULL);
624
625 if (frp != NULL) {
626 int precut;
627
628 precut = frp->fr_end - off;
629 if (precut >= ip_len) {
630 /* Fragment is entirely a duplicate */
631 DPFPRINTF(("fragcache[%d]: dead (%d-%d) %d-%d\n",
632 h->ip_id, frp->fr_off, frp->fr_end, off, frmax));
633 goto drop_fragment;
634 }
635 if (precut == 0) {
636 /* They are adjacent. Fixup cache entry */
637 DPFPRINTF(("fragcache[%d]: adjacent (%d-%d) %d-%d\n",
638 h->ip_id, frp->fr_off, frp->fr_end, off, frmax));
639 frp->fr_end = frmax;
640 } else if (precut > 0) {
641 /* The first part of this payload overlaps with a
642 * fragment that has already been passed.
643 * Need to trim off the first part of the payload.
644 * But to do so easily, we need to create another
645 * mbuf to throw the original header into.
646 */
647
648 DPFPRINTF(("fragcache[%d]: chop %d (%d-%d) %d-%d\n",
649 h->ip_id, precut, frp->fr_off, frp->fr_end, off,
650 frmax));
651
652 off += precut;
653 frmax -= precut;
654 /* Update the previous frag to encompass this one */
655 frp->fr_end = frmax;
656
657 if (!drop) {
658 /* XXX Optimization opportunity
659 * This is a very heavy way to trim the payload.
660 * we could do it much faster by diddling mbuf
661 * internals but that would be even less legible
662 * than this mbuf magic. For my next trick,
663 * I'll pull a rabbit out of my laptop.
664 */
665 *m0 = m_dup(m, 0, h->ip_hl << 2, M_NOWAIT);
666 if (*m0 == NULL)
667 goto no_mem;
668 KASSERT((*m0)->m_next == NULL);
669 m_adj(m, precut + (h->ip_hl << 2));
670 m_cat(*m0, m);
671 m = *m0;
672 if (m->m_flags & M_PKTHDR) {
673 int plen = 0;
674 struct mbuf *t;
675 for (t = m; t; t = t->m_next)
676 plen += t->m_len;
677 m->m_pkthdr.len = plen;
678 }
679
680
681 h = mtod(m, struct ip *);
682
683
684 KASSERT((int)m->m_len ==
685 ntohs(h->ip_len) - precut);
686 h->ip_off = htons(ntohs(h->ip_off) +
687 (precut >> 3));
688 h->ip_len = htons(ntohs(h->ip_len) - precut);
689 } else {
690 hosed++;
691 }
692 } else {
693 /* There is a gap between fragments */
694
695 DPFPRINTF(("fragcache[%d]: gap %d (%d-%d) %d-%d\n",
696 h->ip_id, -precut, frp->fr_off, frp->fr_end, off,
697 frmax));
698
699 cur = pool_get(&pf_cent_pl, PR_NOWAIT);
700 if (cur == NULL)
701 goto no_mem;
702 pf_ncache++;
703
704 cur->fr_off = off;
705 cur->fr_end = frmax;
706 LIST_INSERT_AFTER(frp, cur, fr_next);
707 }
708 }
709
710 if (fra != NULL) {
711 int aftercut;
712 int merge = 0;
713
714 aftercut = frmax - fra->fr_off;
715 if (aftercut == 0) {
716 /* Adjacent fragments */
717 DPFPRINTF(("fragcache[%d]: adjacent %d-%d (%d-%d)\n",
718 h->ip_id, off, frmax, fra->fr_off, fra->fr_end));
719 fra->fr_off = off;
720 merge = 1;
721 } else if (aftercut > 0) {
722 /* Need to chop off the tail of this fragment */
723 DPFPRINTF(("fragcache[%d]: chop %d %d-%d (%d-%d)\n",
724 h->ip_id, aftercut, off, frmax, fra->fr_off,
725 fra->fr_end));
726 fra->fr_off = off;
727 frmax -= aftercut;
728
729 merge = 1;
730
731 if (!drop) {
732 m_adj(m, -aftercut);
733 if (m->m_flags & M_PKTHDR) {
734 int plen = 0;
735 struct mbuf *t;
736 for (t = m; t; t = t->m_next)
737 plen += t->m_len;
738 m->m_pkthdr.len = plen;
739 }
740 h = mtod(m, struct ip *);
741 KASSERT((int)m->m_len ==
742 ntohs(h->ip_len) - aftercut);
743 h->ip_len = htons(ntohs(h->ip_len) - aftercut);
744 } else {
745 hosed++;
746 }
747 } else if (frp == NULL) {
748 /* There is a gap between fragments */
749 DPFPRINTF(("fragcache[%d]: gap %d %d-%d (%d-%d)\n",
750 h->ip_id, -aftercut, off, frmax, fra->fr_off,
751 fra->fr_end));
752
753 cur = pool_get(&pf_cent_pl, PR_NOWAIT);
754 if (cur == NULL)
755 goto no_mem;
756 pf_ncache++;
757
758 cur->fr_off = off;
759 cur->fr_end = frmax;
760 LIST_INSERT_BEFORE(fra, cur, fr_next);
761 }
762
763
764 /* Need to glue together two separate fragment descriptors */
765 if (merge) {
766 if (cur && fra->fr_off <= cur->fr_end) {
767 /* Need to merge in a previous 'cur' */
768 DPFPRINTF(("fragcache[%d]: adjacent(merge "
769 "%d-%d) %d-%d (%d-%d)\n",
770 h->ip_id, cur->fr_off, cur->fr_end, off,
771 frmax, fra->fr_off, fra->fr_end));
772 fra->fr_off = cur->fr_off;
773 LIST_REMOVE(cur, fr_next);
774 pool_put(&pf_cent_pl, cur);
775 pf_ncache--;
776 cur = NULL;
777
778 } else if (frp && fra->fr_off <= frp->fr_end) {
779 /* Need to merge in a modified 'frp' */
780 KASSERT(cur == NULL);
781 DPFPRINTF(("fragcache[%d]: adjacent(merge "
782 "%d-%d) %d-%d (%d-%d)\n",
783 h->ip_id, frp->fr_off, frp->fr_end, off,
784 frmax, fra->fr_off, fra->fr_end));
785 fra->fr_off = frp->fr_off;
786 LIST_REMOVE(frp, fr_next);
787 pool_put(&pf_cent_pl, frp);
788 pf_ncache--;
789 frp = NULL;
790
791 }
792 }
793 }
794
795 if (hosed) {
796 /*
797 * We must keep tracking the overall fragment even when
798 * we're going to drop it anyway so that we know when to
799 * free the overall descriptor. Thus we drop the frag late.
800 */
801 goto drop_fragment;
802 }
803
804
805 pass:
806 /* Update maximum data size */
807 if ((*frag)->fr_max < frmax)
808 (*frag)->fr_max = frmax;
809
810 /* This is the last segment */
811 if (!mff)
812 (*frag)->fr_flags |= PFFRAG_SEENLAST;
813
814 /* Check if we are completely reassembled */
815 if (((*frag)->fr_flags & PFFRAG_SEENLAST) &&
816 LIST_FIRST(&(*frag)->fr_cache)->fr_off == 0 &&
817 LIST_FIRST(&(*frag)->fr_cache)->fr_end == (*frag)->fr_max) {
818 /* Remove from fragment queue */
819 DPFPRINTF(("fragcache[%d]: done 0-%d\n", h->ip_id,
820 (*frag)->fr_max));
821 pf_free_fragment(*frag);
822 *frag = NULL;
823 }
824
825 return (m);
826
827 no_mem:
828 *nomem = 1;
829
830 /* Still need to pay attention to !IP_MF */
831 if (!mff && *frag != NULL)
832 (*frag)->fr_flags |= PFFRAG_SEENLAST;
833
834 m_freem(m);
835 return (NULL);
836
837 drop_fragment:
838
839 /* Still need to pay attention to !IP_MF */
840 if (!mff && *frag != NULL)
841 (*frag)->fr_flags |= PFFRAG_SEENLAST;
842
843 if (drop) {
844 /* This fragment has been deemed bad. Don't reass */
845 if (((*frag)->fr_flags & PFFRAG_DROP) == 0)
846 DPFPRINTF(("fragcache[%d]: dropping overall fragment\n",
847 h->ip_id));
848 (*frag)->fr_flags |= PFFRAG_DROP;
849 }
850
851 m_freem(m);
852 return (NULL);
853 }
854
855 int
pf_normalize_ip(struct mbuf ** m0,int dir,struct pfi_kif * kif,u_short * reason,struct pf_pdesc * pd)856 pf_normalize_ip(struct mbuf **m0, int dir, struct pfi_kif *kif, u_short *reason,
857 struct pf_pdesc *pd)
858 {
859 struct mbuf *m = *m0;
860 struct pf_rule *r;
861 struct pf_frent *frent;
862 struct pf_fragment *frag = NULL;
863 struct ip *h = mtod(m, struct ip *);
864 int mff = (ntohs(h->ip_off) & IP_MF);
865 int hlen = h->ip_hl << 2;
866 u_int16_t fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3;
867 u_int16_t frmax;
868 int ip_len;
869
870 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr);
871 while (r != NULL) {
872 r->evaluations++;
873 if (pfi_kif_match(r->kif, kif) == r->ifnot)
874 r = r->skip[PF_SKIP_IFP].ptr;
875 else if (r->direction && r->direction != dir)
876 r = r->skip[PF_SKIP_DIR].ptr;
877 else if (r->af && r->af != AF_INET)
878 r = r->skip[PF_SKIP_AF].ptr;
879 else if (r->proto && r->proto != h->ip_p)
880 r = r->skip[PF_SKIP_PROTO].ptr;
881 else if (PF_MISMATCHAW(&r->src.addr,
882 (struct pf_addr *)&h->ip_src.s_addr, AF_INET,
883 r->src.neg, kif))
884 r = r->skip[PF_SKIP_SRC_ADDR].ptr;
885 else if (PF_MISMATCHAW(&r->dst.addr,
886 (struct pf_addr *)&h->ip_dst.s_addr, AF_INET,
887 r->dst.neg, NULL))
888 r = r->skip[PF_SKIP_DST_ADDR].ptr;
889 else
890 break;
891 }
892
893 if (r == NULL || r->action == PF_NOSCRUB)
894 return (PF_PASS);
895 else {
896 r->packets[dir == PF_OUT]++;
897 r->bytes[dir == PF_OUT] += pd->tot_len;
898 }
899
900 /* Check for illegal packets */
901 if (hlen < (int)sizeof(struct ip))
902 goto drop;
903
904 if (hlen > ntohs(h->ip_len))
905 goto drop;
906
907 /* Clear IP_DF if the rule uses the no-df option */
908 if (r->rule_flag & PFRULE_NODF && h->ip_off & htons(IP_DF)) {
909 u_int16_t off = h->ip_off;
910
911 h->ip_off &= htons(~IP_DF);
912 h->ip_sum = pf_cksum_fixup(h->ip_sum, off, h->ip_off, 0);
913 }
914
915 /* We will need other tests here */
916 if (!fragoff && !mff)
917 goto no_fragment;
918
919 /* We're dealing with a fragment now. Don't allow fragments
920 * with IP_DF to enter the cache. If the flag was cleared by
921 * no-df above, fine. Otherwise drop it.
922 */
923 if (h->ip_off & htons(IP_DF)) {
924 DPFPRINTF(("IP_DF\n"));
925 goto bad;
926 }
927
928 ip_len = ntohs(h->ip_len) - hlen;
929
930 /* All fragments are 8 byte aligned */
931 if (mff && (ip_len & 0x7)) {
932 DPFPRINTF(("mff and %d\n", ip_len));
933 goto bad;
934 }
935
936 /* Respect maximum length */
937 if (fragoff + ip_len > IP_MAXPACKET) {
938 DPFPRINTF(("max packet %d\n", fragoff + ip_len));
939 goto bad;
940 }
941 frmax = fragoff + ip_len;
942
943 if ((r->rule_flag & (PFRULE_FRAGCROP|PFRULE_FRAGDROP)) == 0) {
944 /* Fully buffer all of the fragments */
945
946 frag = pf_find_fragment(h, &pf_frag_tree);
947
948 /* Check if we saw the last fragment already */
949 if (frag != NULL && (frag->fr_flags & PFFRAG_SEENLAST) &&
950 frmax > frag->fr_max)
951 goto bad;
952
953 /* Get an entry for the fragment queue */
954 frent = pool_get(&pf_frent_pl, PR_NOWAIT);
955 if (frent == NULL) {
956 REASON_SET(reason, PFRES_MEMORY);
957 return (PF_DROP);
958 }
959 pf_nfrents++;
960 frent->fr_ip = h;
961 frent->fr_m = m;
962
963 /* Might return a completely reassembled mbuf, or NULL */
964 DPFPRINTF(("reass frag %d @ %d-%d\n", h->ip_id, fragoff, frmax));
965 *m0 = m = pf_reassemble(m0, &frag, frent, mff);
966
967 if (m == NULL)
968 return (PF_DROP);
969
970 if (frag != NULL && (frag->fr_flags & PFFRAG_DROP))
971 goto drop;
972
973 h = mtod(m, struct ip *);
974 } else {
975 /* non-buffering fragment cache (drops or masks overlaps) */
976 int nomem = 0;
977
978 #ifdef __NetBSD__
979 struct pf_mtag *pf_mtag = pf_find_mtag(m);
980 KASSERT(pf_mtag != NULL);
981
982 if (dir == PF_OUT && pf_mtag->flags & PF_TAG_FRAGCACHE) {
983 #else
984 if (dir == PF_OUT && m->m_pkthdr.pf.flags & PF_TAG_FRAGCACHE) {
985 #endif /* !__NetBSD__ */
986 /*
987 * Already passed the fragment cache in the
988 * input direction. If we continued, it would
989 * appear to be a dup and would be dropped.
990 */
991 goto fragment_pass;
992 }
993
994 frag = pf_find_fragment(h, &pf_cache_tree);
995
996 /* Check if we saw the last fragment already */
997 if (frag != NULL && (frag->fr_flags & PFFRAG_SEENLAST) &&
998 frmax > frag->fr_max) {
999 if (r->rule_flag & PFRULE_FRAGDROP)
1000 frag->fr_flags |= PFFRAG_DROP;
1001 goto bad;
1002 }
1003
1004 *m0 = m = pf_fragcache(m0, h, &frag, mff,
1005 (r->rule_flag & PFRULE_FRAGDROP) ? 1 : 0, &nomem);
1006 if (m == NULL) {
1007 if (nomem)
1008 goto no_mem;
1009 goto drop;
1010 }
1011
1012 if (dir == PF_IN)
1013 #ifdef __NetBSD__
1014 pf_mtag = pf_find_mtag(m);
1015 KASSERT(pf_mtag != NULL);
1016
1017 pf_mtag->flags |= PF_TAG_FRAGCACHE;
1018 #else
1019 m->m_pkthdr.pf.flags |= PF_TAG_FRAGCACHE;
1020 #endif /* !__NetBSD__ */
1021
1022 if (frag != NULL && (frag->fr_flags & PFFRAG_DROP))
1023 goto drop;
1024 goto fragment_pass;
1025 }
1026
1027 no_fragment:
1028 /* At this point, only IP_DF is allowed in ip_off */
1029 if (h->ip_off & ~htons(IP_DF)) {
1030 u_int16_t off = h->ip_off;
1031
1032 h->ip_off &= htons(IP_DF);
1033 h->ip_sum = pf_cksum_fixup(h->ip_sum, off, h->ip_off, 0);
1034 }
1035
1036 /* Enforce a minimum ttl, may cause endless packet loops */
1037 if (r->min_ttl && h->ip_ttl < r->min_ttl) {
1038 u_int16_t ip_ttl = h->ip_ttl;
1039
1040 h->ip_ttl = r->min_ttl;
1041 h->ip_sum = pf_cksum_fixup(h->ip_sum, ip_ttl, h->ip_ttl, 0);
1042 }
1043
1044 if (r->rule_flag & PFRULE_RANDOMID) {
1045 u_int16_t id = h->ip_id;
1046
1047 h->ip_id = ip_randomid();
1048 h->ip_sum = pf_cksum_fixup(h->ip_sum, id, h->ip_id, 0);
1049 }
1050 if ((r->rule_flag & (PFRULE_FRAGCROP|PFRULE_FRAGDROP)) == 0)
1051 pd->flags |= PFDESC_IP_REAS;
1052
1053 return (PF_PASS);
1054
1055 fragment_pass:
1056 /* Enforce a minimum ttl, may cause endless packet loops */
1057 if (r->min_ttl && h->ip_ttl < r->min_ttl) {
1058 u_int16_t ip_ttl = h->ip_ttl;
1059
1060 h->ip_ttl = r->min_ttl;
1061 h->ip_sum = pf_cksum_fixup(h->ip_sum, ip_ttl, h->ip_ttl, 0);
1062 }
1063 if ((r->rule_flag & (PFRULE_FRAGCROP|PFRULE_FRAGDROP)) == 0)
1064 pd->flags |= PFDESC_IP_REAS;
1065 return (PF_PASS);
1066
1067 no_mem:
1068 REASON_SET(reason, PFRES_MEMORY);
1069 if (r != NULL && r->log)
1070 PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL, pd);
1071 return (PF_DROP);
1072
1073 drop:
1074 REASON_SET(reason, PFRES_NORM);
1075 if (r != NULL && r->log)
1076 PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL, pd);
1077 return (PF_DROP);
1078
1079 bad:
1080 DPFPRINTF(("dropping bad fragment\n"));
1081
1082 /* Free associated fragments */
1083 if (frag != NULL)
1084 pf_free_fragment(frag);
1085
1086 REASON_SET(reason, PFRES_FRAG);
1087 if (r != NULL && r->log)
1088 PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL, pd);
1089
1090 return (PF_DROP);
1091 }
1092
1093 #ifdef INET6
1094 int
1095 pf_normalize_ip6(struct mbuf **m0, int dir, struct pfi_kif *kif,
1096 u_short *reason, struct pf_pdesc *pd)
1097 {
1098 struct mbuf *m = *m0;
1099 struct pf_rule *r;
1100 struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
1101 int off;
1102 struct ip6_ext ext;
1103 struct ip6_opt opt;
1104 struct ip6_opt_jumbo jumbo;
1105 struct ip6_frag frag;
1106 u_int32_t jumbolen = 0, plen;
1107 u_int16_t fragoff = 0;
1108 int optend;
1109 int ooff;
1110 u_int8_t proto;
1111 int terminal;
1112
1113 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr);
1114 while (r != NULL) {
1115 r->evaluations++;
1116 if (pfi_kif_match(r->kif, kif) == r->ifnot)
1117 r = r->skip[PF_SKIP_IFP].ptr;
1118 else if (r->direction && r->direction != dir)
1119 r = r->skip[PF_SKIP_DIR].ptr;
1120 else if (r->af && r->af != AF_INET6)
1121 r = r->skip[PF_SKIP_AF].ptr;
1122 #if 0 /* header chain! */
1123 else if (r->proto && r->proto != h->ip6_nxt)
1124 r = r->skip[PF_SKIP_PROTO].ptr;
1125 #endif
1126 else if (PF_MISMATCHAW(&r->src.addr,
1127 (struct pf_addr *)&h->ip6_src, AF_INET6,
1128 r->src.neg, kif))
1129 r = r->skip[PF_SKIP_SRC_ADDR].ptr;
1130 else if (PF_MISMATCHAW(&r->dst.addr,
1131 (struct pf_addr *)&h->ip6_dst, AF_INET6,
1132 r->dst.neg, NULL))
1133 r = r->skip[PF_SKIP_DST_ADDR].ptr;
1134 else
1135 break;
1136 }
1137
1138 if (r == NULL || r->action == PF_NOSCRUB)
1139 return (PF_PASS);
1140 else {
1141 r->packets[dir == PF_OUT]++;
1142 r->bytes[dir == PF_OUT] += pd->tot_len;
1143 }
1144
1145 /* Check for illegal packets */
1146 if (sizeof(struct ip6_hdr) + IPV6_MAXPACKET < m->m_pkthdr.len)
1147 goto drop;
1148
1149 off = sizeof(struct ip6_hdr);
1150 proto = h->ip6_nxt;
1151 terminal = 0;
1152 do {
1153 switch (proto) {
1154 case IPPROTO_FRAGMENT:
1155 goto fragment;
1156 break;
1157 case IPPROTO_AH:
1158 case IPPROTO_ROUTING:
1159 case IPPROTO_DSTOPTS:
1160 if (!pf_pull_hdr(m, off, &ext, sizeof(ext), NULL,
1161 NULL, AF_INET6))
1162 goto shortpkt;
1163 if (proto == IPPROTO_AH)
1164 off += (ext.ip6e_len + 2) * 4;
1165 else
1166 off += (ext.ip6e_len + 1) * 8;
1167 proto = ext.ip6e_nxt;
1168 break;
1169 case IPPROTO_HOPOPTS:
1170 if (!pf_pull_hdr(m, off, &ext, sizeof(ext), NULL,
1171 NULL, AF_INET6))
1172 goto shortpkt;
1173 optend = off + (ext.ip6e_len + 1) * 8;
1174 ooff = off + sizeof(ext);
1175 do {
1176 if (!pf_pull_hdr(m, ooff, &opt.ip6o_type,
1177 sizeof(opt.ip6o_type), NULL, NULL,
1178 AF_INET6))
1179 goto shortpkt;
1180 if (opt.ip6o_type == IP6OPT_PAD1) {
1181 ooff++;
1182 continue;
1183 }
1184 if (!pf_pull_hdr(m, ooff, &opt, sizeof(opt),
1185 NULL, NULL, AF_INET6))
1186 goto shortpkt;
1187 if (ooff + sizeof(opt) + opt.ip6o_len > optend)
1188 goto drop;
1189 switch (opt.ip6o_type) {
1190 case IP6OPT_JUMBO:
1191 if (h->ip6_plen != 0)
1192 goto drop;
1193 if (!pf_pull_hdr(m, ooff, &jumbo,
1194 sizeof(jumbo), NULL, NULL,
1195 AF_INET6))
1196 goto shortpkt;
1197 memcpy(&jumbolen, jumbo.ip6oj_jumbo_len,
1198 sizeof(jumbolen));
1199 jumbolen = ntohl(jumbolen);
1200 if (jumbolen <= IPV6_MAXPACKET)
1201 goto drop;
1202 if (sizeof(struct ip6_hdr) + jumbolen !=
1203 m->m_pkthdr.len)
1204 goto drop;
1205 break;
1206 default:
1207 break;
1208 }
1209 ooff += sizeof(opt) + opt.ip6o_len;
1210 } while (ooff < optend);
1211
1212 off = optend;
1213 proto = ext.ip6e_nxt;
1214 break;
1215 default:
1216 terminal = 1;
1217 break;
1218 }
1219 } while (!terminal);
1220
1221 /* jumbo payload option must be present, or plen > 0 */
1222 if (ntohs(h->ip6_plen) == 0)
1223 plen = jumbolen;
1224 else
1225 plen = ntohs(h->ip6_plen);
1226 if (plen == 0)
1227 goto drop;
1228 if (sizeof(struct ip6_hdr) + plen > m->m_pkthdr.len)
1229 goto shortpkt;
1230
1231 /* Enforce a minimum ttl, may cause endless packet loops */
1232 if (r->min_ttl && h->ip6_hlim < r->min_ttl)
1233 h->ip6_hlim = r->min_ttl;
1234
1235 return (PF_PASS);
1236
1237 fragment:
1238 if (ntohs(h->ip6_plen) == 0 || jumbolen)
1239 goto drop;
1240 plen = ntohs(h->ip6_plen);
1241
1242 if (!pf_pull_hdr(m, off, &frag, sizeof(frag), NULL, NULL, AF_INET6))
1243 goto shortpkt;
1244 fragoff = ntohs(frag.ip6f_offlg & IP6F_OFF_MASK);
1245 if (fragoff + (plen - off - sizeof(frag)) > IPV6_MAXPACKET)
1246 goto badfrag;
1247
1248 /* do something about it */
1249 /* remember to set pd->flags |= PFDESC_IP_REAS */
1250 return (PF_PASS);
1251
1252 shortpkt:
1253 REASON_SET(reason, PFRES_SHORT);
1254 if (r != NULL && r->log)
1255 PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL, pd);
1256 return (PF_DROP);
1257
1258 drop:
1259 REASON_SET(reason, PFRES_NORM);
1260 if (r != NULL && r->log)
1261 PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL, pd);
1262 return (PF_DROP);
1263
1264 badfrag:
1265 REASON_SET(reason, PFRES_FRAG);
1266 if (r != NULL && r->log)
1267 PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL, pd);
1268 return (PF_DROP);
1269 }
1270 #endif /* INET6 */
1271
1272 int
1273 pf_normalize_tcp(int dir, struct pfi_kif *kif, struct mbuf *m,
1274 int ipoff, int off, void *h, struct pf_pdesc *pd)
1275 {
1276 struct pf_rule *r, *rm = NULL;
1277 struct tcphdr *th = pd->hdr.tcp;
1278 int rewrite = 0;
1279 u_short reason;
1280 u_int8_t flags;
1281 sa_family_t af = pd->af;
1282
1283 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr);
1284 while (r != NULL) {
1285 r->evaluations++;
1286 if (pfi_kif_match(r->kif, kif) == r->ifnot)
1287 r = r->skip[PF_SKIP_IFP].ptr;
1288 else if (r->direction && r->direction != dir)
1289 r = r->skip[PF_SKIP_DIR].ptr;
1290 else if (r->af && r->af != af)
1291 r = r->skip[PF_SKIP_AF].ptr;
1292 else if (r->proto && r->proto != pd->proto)
1293 r = r->skip[PF_SKIP_PROTO].ptr;
1294 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af,
1295 r->src.neg, kif))
1296 r = r->skip[PF_SKIP_SRC_ADDR].ptr;
1297 else if (r->src.port_op && !pf_match_port(r->src.port_op,
1298 r->src.port[0], r->src.port[1], th->th_sport))
1299 r = r->skip[PF_SKIP_SRC_PORT].ptr;
1300 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af,
1301 r->dst.neg, NULL))
1302 r = r->skip[PF_SKIP_DST_ADDR].ptr;
1303 else if (r->dst.port_op && !pf_match_port(r->dst.port_op,
1304 r->dst.port[0], r->dst.port[1], th->th_dport))
1305 r = r->skip[PF_SKIP_DST_PORT].ptr;
1306 else if (r->os_fingerprint != PF_OSFP_ANY && !pf_osfp_match(
1307 pf_osfp_fingerprint(pd, m, off, th),
1308 r->os_fingerprint))
1309 r = TAILQ_NEXT(r, entries);
1310 else {
1311 rm = r;
1312 break;
1313 }
1314 }
1315
1316 if (rm == NULL || rm->action == PF_NOSCRUB)
1317 return (PF_PASS);
1318 else {
1319 r->packets[dir == PF_OUT]++;
1320 r->bytes[dir == PF_OUT] += pd->tot_len;
1321 }
1322
1323 if (rm->rule_flag & PFRULE_REASSEMBLE_TCP)
1324 pd->flags |= PFDESC_TCP_NORM;
1325
1326 flags = th->th_flags;
1327 if (flags & TH_SYN) {
1328 /* Illegal packet */
1329 if (flags & TH_RST)
1330 goto tcp_drop;
1331
1332 if (flags & TH_FIN)
1333 flags &= ~TH_FIN;
1334 } else {
1335 /* Illegal packet */
1336 if (!(flags & (TH_ACK|TH_RST)))
1337 goto tcp_drop;
1338 }
1339
1340 if (!(flags & TH_ACK)) {
1341 /* These flags are only valid if ACK is set */
1342 if ((flags & TH_FIN) || (flags & TH_PUSH) || (flags & TH_URG))
1343 goto tcp_drop;
1344 }
1345
1346 /* Check for illegal header length */
1347 if (th->th_off < (sizeof(struct tcphdr) >> 2))
1348 goto tcp_drop;
1349
1350 /* If flags changed, or reserved data set, then adjust */
1351 if (flags != th->th_flags || th->th_x2 != 0) {
1352 u_int16_t ov, nv;
1353
1354 ov = *(u_int16_t *)(&th->th_ack + 1);
1355 th->th_flags = flags;
1356 th->th_x2 = 0;
1357 nv = *(u_int16_t *)(&th->th_ack + 1);
1358
1359 th->th_sum = pf_cksum_fixup(th->th_sum, ov, nv, 0);
1360 rewrite = 1;
1361 }
1362
1363 /* Remove urgent pointer, if TH_URG is not set */
1364 if (!(flags & TH_URG) && th->th_urp) {
1365 th->th_sum = pf_cksum_fixup(th->th_sum, th->th_urp, 0, 0);
1366 th->th_urp = 0;
1367 rewrite = 1;
1368 }
1369
1370 /* Process options */
1371 if (r->max_mss && pf_normalize_tcpopt(r, m, th, off))
1372 rewrite = 1;
1373
1374 /* copy back packet headers if we sanitized */
1375 if (rewrite)
1376 m_copyback(m, off, sizeof(*th), th);
1377
1378 return (PF_PASS);
1379
1380 tcp_drop:
1381 REASON_SET_NOPTR(&reason, PFRES_NORM);
1382 if (rm != NULL && r->log)
1383 PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, r, NULL, NULL, pd);
1384 return (PF_DROP);
1385 }
1386
1387 int
1388 pf_normalize_tcp_init(struct mbuf *m, int off, struct pf_pdesc *pd,
1389 struct tcphdr *th, struct pf_state_peer *src,
1390 struct pf_state_peer *dst)
1391 {
1392 u_int32_t tsval, tsecr;
1393 u_int8_t hdr[60];
1394 u_int8_t *opt;
1395
1396 KASSERT(src->scrub == NULL);
1397
1398 src->scrub = pool_get(&pf_state_scrub_pl, PR_NOWAIT);
1399 if (src->scrub == NULL)
1400 return (1);
1401 bzero(src->scrub, sizeof(*src->scrub));
1402
1403 switch (pd->af) {
1404 #ifdef INET
1405 case AF_INET: {
1406 struct ip *h = mtod(m, struct ip *);
1407 src->scrub->pfss_ttl = h->ip_ttl;
1408 break;
1409 }
1410 #endif /* INET */
1411 #ifdef INET6
1412 case AF_INET6: {
1413 struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
1414 src->scrub->pfss_ttl = h->ip6_hlim;
1415 break;
1416 }
1417 #endif /* INET6 */
1418 }
1419
1420
1421 /*
1422 * All normalizations below are only begun if we see the start of
1423 * the connections. They must all set an enabled bit in pfss_flags
1424 */
1425 if ((th->th_flags & TH_SYN) == 0)
1426 return (0);
1427
1428
1429 if (th->th_off > (sizeof(struct tcphdr) >> 2) && src->scrub &&
1430 pf_pull_hdr(m, off, hdr, th->th_off << 2, NULL, NULL, pd->af)) {
1431 /* Diddle with TCP options */
1432 int hlen;
1433 opt = hdr + sizeof(struct tcphdr);
1434 hlen = (th->th_off << 2) - sizeof(struct tcphdr);
1435 while (hlen >= TCPOLEN_TIMESTAMP) {
1436 switch (*opt) {
1437 case TCPOPT_EOL: /* FALLTHROUGH */
1438 case TCPOPT_NOP:
1439 opt++;
1440 hlen--;
1441 break;
1442 case TCPOPT_TIMESTAMP:
1443 if (opt[1] >= TCPOLEN_TIMESTAMP) {
1444 src->scrub->pfss_flags |=
1445 PFSS_TIMESTAMP;
1446 src->scrub->pfss_ts_mod =
1447 htonl(cprng_fast32());
1448
1449 /* note PFSS_PAWS not set yet */
1450 memcpy(&tsval, &opt[2],
1451 sizeof(u_int32_t));
1452 memcpy(&tsecr, &opt[6],
1453 sizeof(u_int32_t));
1454 src->scrub->pfss_tsval0 = ntohl(tsval);
1455 src->scrub->pfss_tsval = ntohl(tsval);
1456 src->scrub->pfss_tsecr = ntohl(tsecr);
1457 getmicrouptime(&src->scrub->pfss_last);
1458 }
1459 /* FALLTHROUGH */
1460 default:
1461 hlen -= MAX(opt[1], 2);
1462 opt += MAX(opt[1], 2);
1463 break;
1464 }
1465 }
1466 }
1467
1468 return (0);
1469 }
1470
1471 void
1472 pf_normalize_tcp_cleanup(struct pf_state *state)
1473 {
1474 if (state->src.scrub)
1475 pool_put(&pf_state_scrub_pl, state->src.scrub);
1476 if (state->dst.scrub)
1477 pool_put(&pf_state_scrub_pl, state->dst.scrub);
1478
1479 /* Someday... flush the TCP segment reassembly descriptors. */
1480 }
1481
1482 int
1483 pf_normalize_tcp_stateful(struct mbuf *m, int off, struct pf_pdesc *pd,
1484 u_short *reason, struct tcphdr *th, struct pf_state *state,
1485 struct pf_state_peer *src, struct pf_state_peer *dst, int *writeback)
1486 {
1487 struct timeval uptime;
1488 u_int32_t tsval = 0, tsecr = 0;
1489 u_int tsval_from_last;
1490 u_int8_t hdr[60];
1491 u_int8_t *opt;
1492 int copyback = 0;
1493 int got_ts = 0;
1494
1495 KASSERT(src->scrub || dst->scrub);
1496
1497 /*
1498 * Enforce the minimum TTL seen for this connection. Negate a common
1499 * technique to evade an intrusion detection system and confuse
1500 * firewall state code.
1501 */
1502 switch (pd->af) {
1503 #ifdef INET
1504 case AF_INET: {
1505 if (src->scrub) {
1506 struct ip *h = mtod(m, struct ip *);
1507 if (h->ip_ttl > src->scrub->pfss_ttl)
1508 src->scrub->pfss_ttl = h->ip_ttl;
1509 h->ip_ttl = src->scrub->pfss_ttl;
1510 }
1511 break;
1512 }
1513 #endif /* INET */
1514 #ifdef INET6
1515 case AF_INET6: {
1516 if (src->scrub) {
1517 struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
1518 if (h->ip6_hlim > src->scrub->pfss_ttl)
1519 src->scrub->pfss_ttl = h->ip6_hlim;
1520 h->ip6_hlim = src->scrub->pfss_ttl;
1521 }
1522 break;
1523 }
1524 #endif /* INET6 */
1525 }
1526
1527 if (th->th_off > (sizeof(struct tcphdr) >> 2) &&
1528 ((src->scrub && (src->scrub->pfss_flags & PFSS_TIMESTAMP)) ||
1529 (dst->scrub && (dst->scrub->pfss_flags & PFSS_TIMESTAMP))) &&
1530 pf_pull_hdr(m, off, hdr, th->th_off << 2, NULL, NULL, pd->af)) {
1531 /* Diddle with TCP options */
1532 int hlen;
1533 opt = hdr + sizeof(struct tcphdr);
1534 hlen = (th->th_off << 2) - sizeof(struct tcphdr);
1535 while (hlen >= TCPOLEN_TIMESTAMP) {
1536 switch (*opt) {
1537 case TCPOPT_EOL: /* FALLTHROUGH */
1538 case TCPOPT_NOP:
1539 opt++;
1540 hlen--;
1541 break;
1542 case TCPOPT_TIMESTAMP:
1543 /* Modulate the timestamps. Can be used for
1544 * NAT detection, OS uptime determination or
1545 * reboot detection.
1546 */
1547
1548 if (got_ts) {
1549 /* Huh? Multiple timestamps!? */
1550 if (pf_status.debug >= PF_DEBUG_MISC) {
1551 DPFPRINTF(("multiple TS??"));
1552 pf_print_state(state);
1553 printf("\n");
1554 }
1555 REASON_SET(reason, PFRES_TS);
1556 return (PF_DROP);
1557 }
1558 if (opt[1] >= TCPOLEN_TIMESTAMP) {
1559 memcpy(&tsval, &opt[2],
1560 sizeof(u_int32_t));
1561 if (tsval && src->scrub &&
1562 (src->scrub->pfss_flags &
1563 PFSS_TIMESTAMP)) {
1564 tsval = ntohl(tsval);
1565 pf_change_a(&opt[2],
1566 &th->th_sum,
1567 htonl(tsval +
1568 src->scrub->pfss_ts_mod),
1569 0);
1570 copyback = 1;
1571 }
1572
1573 /* Modulate TS reply iff valid (!0) */
1574 memcpy(&tsecr, &opt[6],
1575 sizeof(u_int32_t));
1576 if (tsecr && dst->scrub &&
1577 (dst->scrub->pfss_flags &
1578 PFSS_TIMESTAMP)) {
1579 tsecr = ntohl(tsecr)
1580 - dst->scrub->pfss_ts_mod;
1581 pf_change_a(&opt[6],
1582 &th->th_sum, htonl(tsecr),
1583 0);
1584 copyback = 1;
1585 }
1586 got_ts = 1;
1587 }
1588 /* FALLTHROUGH */
1589 default:
1590 hlen -= MAX(opt[1], 2);
1591 opt += MAX(opt[1], 2);
1592 break;
1593 }
1594 }
1595 if (copyback) {
1596 /* Copyback the options, caller copys back header */
1597 *writeback = 1;
1598 m_copyback(m, off + sizeof(struct tcphdr),
1599 (th->th_off << 2) - sizeof(struct tcphdr), hdr +
1600 sizeof(struct tcphdr));
1601 }
1602 }
1603
1604
1605 /*
1606 * Must invalidate PAWS checks on connections idle for too long.
1607 * The fastest allowed timestamp clock is 1ms. That turns out to
1608 * be about 24 days before it wraps. XXX Right now our lowerbound
1609 * TS echo check only works for the first 12 days of a connection
1610 * when the TS has exhausted half its 32bit space
1611 */
1612 #define TS_MAX_IDLE (24*24*60*60)
1613 #define TS_MAX_CONN (12*24*60*60) /* XXX remove when better tsecr check */
1614
1615 getmicrouptime(&uptime);
1616 if (src->scrub && (src->scrub->pfss_flags & PFSS_PAWS) &&
1617 (uptime.tv_sec - src->scrub->pfss_last.tv_sec > TS_MAX_IDLE ||
1618 time_second - state->creation > TS_MAX_CONN)) {
1619 if (pf_status.debug >= PF_DEBUG_MISC) {
1620 DPFPRINTF(("src idled out of PAWS\n"));
1621 pf_print_state(state);
1622 printf("\n");
1623 }
1624 src->scrub->pfss_flags = (src->scrub->pfss_flags & ~PFSS_PAWS)
1625 | PFSS_PAWS_IDLED;
1626 }
1627 if (dst->scrub && (dst->scrub->pfss_flags & PFSS_PAWS) &&
1628 uptime.tv_sec - dst->scrub->pfss_last.tv_sec > TS_MAX_IDLE) {
1629 if (pf_status.debug >= PF_DEBUG_MISC) {
1630 DPFPRINTF(("dst idled out of PAWS\n"));
1631 pf_print_state(state);
1632 printf("\n");
1633 }
1634 dst->scrub->pfss_flags = (dst->scrub->pfss_flags & ~PFSS_PAWS)
1635 | PFSS_PAWS_IDLED;
1636 }
1637
1638 if (got_ts && src->scrub && dst->scrub &&
1639 (src->scrub->pfss_flags & PFSS_PAWS) &&
1640 (dst->scrub->pfss_flags & PFSS_PAWS)) {
1641 /* Validate that the timestamps are "in-window".
1642 * RFC1323 describes TCP Timestamp options that allow
1643 * measurement of RTT (round trip time) and PAWS
1644 * (protection against wrapped sequence numbers). PAWS
1645 * gives us a set of rules for rejecting packets on
1646 * long fat pipes (packets that were somehow delayed
1647 * in transit longer than the time it took to send the
1648 * full TCP sequence space of 4Gb). We can use these
1649 * rules and infer a few others that will let us treat
1650 * the 32bit timestamp and the 32bit echoed timestamp
1651 * as sequence numbers to prevent a blind attacker from
1652 * inserting packets into a connection.
1653 *
1654 * RFC1323 tells us:
1655 * - The timestamp on this packet must be greater than
1656 * or equal to the last value echoed by the other
1657 * endpoint. The RFC says those will be discarded
1658 * since it is a dup that has already been acked.
1659 * This gives us a lowerbound on the timestamp.
1660 * timestamp >= other last echoed timestamp
1661 * - The timestamp will be less than or equal to
1662 * the last timestamp plus the time between the
1663 * last packet and now. The RFC defines the max
1664 * clock rate as 1ms. We will allow clocks to be
1665 * up to 10% fast and will allow a total difference
1666 * or 30 seconds due to a route change. And this
1667 * gives us an upperbound on the timestamp.
1668 * timestamp <= last timestamp + max ticks
1669 * We have to be careful here. Windows will send an
1670 * initial timestamp of zero and then initialize it
1671 * to a random value after the 3whs; presumably to
1672 * avoid a DoS by having to call an expensive RNG
1673 * during a SYN flood. Proof MS has at least one
1674 * good security geek.
1675 *
1676 * - The TCP timestamp option must also echo the other
1677 * endpoints timestamp. The timestamp echoed is the
1678 * one carried on the earliest unacknowledged segment
1679 * on the left edge of the sequence window. The RFC
1680 * states that the host will reject any echoed
1681 * timestamps that were larger than any ever sent.
1682 * This gives us an upperbound on the TS echo.
1683 * tescr <= largest_tsval
1684 * - The lowerbound on the TS echo is a little more
1685 * tricky to determine. The other endpoint's echoed
1686 * values will not decrease. But there may be
1687 * network conditions that re-order packets and
1688 * cause our view of them to decrease. For now the
1689 * only lowerbound we can safely determine is that
1690 * the TS echo will never be less than the original
1691 * TS. XXX There is probably a better lowerbound.
1692 * Remove TS_MAX_CONN with better lowerbound check.
1693 * tescr >= other original TS
1694 *
1695 * It is also important to note that the fastest
1696 * timestamp clock of 1ms will wrap its 32bit space in
1697 * 24 days. So we just disable TS checking after 24
1698 * days of idle time. We actually must use a 12d
1699 * connection limit until we can come up with a better
1700 * lowerbound to the TS echo check.
1701 */
1702 struct timeval delta_ts;
1703 int ts_fudge;
1704
1705
1706 /*
1707 * PFTM_TS_DIFF is how many seconds of leeway to allow
1708 * a host's timestamp. This can happen if the previous
1709 * packet got delayed in transit for much longer than
1710 * this packet.
1711 */
1712 if ((ts_fudge = state->rule.ptr->timeout[PFTM_TS_DIFF]) == 0)
1713 ts_fudge = pf_default_rule.timeout[PFTM_TS_DIFF];
1714
1715
1716 /* Calculate max ticks since the last timestamp */
1717 #define TS_MAXFREQ 1100 /* RFC max TS freq of 1 kHz + 10% skew */
1718 #define TS_MICROSECS 1000000 /* microseconds per second */
1719 timersub(&uptime, &src->scrub->pfss_last, &delta_ts);
1720 tsval_from_last = (delta_ts.tv_sec + ts_fudge) * TS_MAXFREQ;
1721 tsval_from_last += delta_ts.tv_usec / (TS_MICROSECS/TS_MAXFREQ);
1722
1723
1724 if ((src->state >= TCPS_ESTABLISHED &&
1725 dst->state >= TCPS_ESTABLISHED) &&
1726 (SEQ_LT(tsval, dst->scrub->pfss_tsecr) ||
1727 SEQ_GT(tsval, src->scrub->pfss_tsval + tsval_from_last) ||
1728 (tsecr && (SEQ_GT(tsecr, dst->scrub->pfss_tsval) ||
1729 SEQ_LT(tsecr, dst->scrub->pfss_tsval0))))) {
1730 /* Bad RFC1323 implementation or an insertion attack.
1731 *
1732 * - Solaris 2.6 and 2.7 are known to send another ACK
1733 * after the FIN,FIN|ACK,ACK closing that carries
1734 * an old timestamp.
1735 */
1736
1737 DPFPRINTF(("Timestamp failed %c%c%c%c\n",
1738 SEQ_LT(tsval, dst->scrub->pfss_tsecr) ? '0' : ' ',
1739 SEQ_GT(tsval, src->scrub->pfss_tsval +
1740 tsval_from_last) ? '1' : ' ',
1741 SEQ_GT(tsecr, dst->scrub->pfss_tsval) ? '2' : ' ',
1742 SEQ_LT(tsecr, dst->scrub->pfss_tsval0)? '3' : ' '));
1743 DPFPRINTF((" tsval: %" PRIu32 " tsecr: %" PRIu32
1744 " +ticks: %" PRIu32 " idle: %"PRIx64"s %ums\n",
1745 tsval, tsecr, tsval_from_last, delta_ts.tv_sec,
1746 delta_ts.tv_usec / 1000U));
1747 DPFPRINTF((" src->tsval: %" PRIu32 " tsecr: %" PRIu32
1748 "\n",
1749 src->scrub->pfss_tsval, src->scrub->pfss_tsecr));
1750 DPFPRINTF((" dst->tsval: %" PRIu32 " tsecr: %" PRIu32
1751 " tsval0: %" PRIu32 "\n",
1752 dst->scrub->pfss_tsval,
1753 dst->scrub->pfss_tsecr, dst->scrub->pfss_tsval0));
1754 if (pf_status.debug >= PF_DEBUG_MISC) {
1755 pf_print_state(state);
1756 pf_print_flags(th->th_flags);
1757 printf("\n");
1758 }
1759 REASON_SET(reason, PFRES_TS);
1760 return (PF_DROP);
1761 }
1762
1763 /* XXX I'd really like to require tsecr but it's optional */
1764
1765 } else if (!got_ts && (th->th_flags & TH_RST) == 0 &&
1766 ((src->state == TCPS_ESTABLISHED && dst->state == TCPS_ESTABLISHED)
1767 || pd->p_len > 0 || (th->th_flags & TH_SYN)) &&
1768 src->scrub && dst->scrub &&
1769 (src->scrub->pfss_flags & PFSS_PAWS) &&
1770 (dst->scrub->pfss_flags & PFSS_PAWS)) {
1771 /* Didn't send a timestamp. Timestamps aren't really useful
1772 * when:
1773 * - connection opening or closing (often not even sent).
1774 * but we must not let an attacker to put a FIN on a
1775 * data packet to sneak it through our ESTABLISHED check.
1776 * - on a TCP reset. RFC suggests not even looking at TS.
1777 * - on an empty ACK. The TS will not be echoed so it will
1778 * probably not help keep the RTT calculation in sync and
1779 * there isn't as much danger when the sequence numbers
1780 * got wrapped. So some stacks don't include TS on empty
1781 * ACKs :-(
1782 *
1783 * To minimize the disruption to mostly RFC1323 conformant
1784 * stacks, we will only require timestamps on data packets.
1785 *
1786 * And what do ya know, we cannot require timestamps on data
1787 * packets. There appear to be devices that do legitimate
1788 * TCP connection hijacking. There are HTTP devices that allow
1789 * a 3whs (with timestamps) and then buffer the HTTP request.
1790 * If the intermediate device has the HTTP response cache, it
1791 * will spoof the response but not bother timestamping its
1792 * packets. So we can look for the presence of a timestamp in
1793 * the first data packet and if there, require it in all future
1794 * packets.
1795 */
1796
1797 if (pd->p_len > 0 && (src->scrub->pfss_flags & PFSS_DATA_TS)) {
1798 /*
1799 * Hey! Someone tried to sneak a packet in. Or the
1800 * stack changed its RFC1323 behavior?!?!
1801 */
1802 if (pf_status.debug >= PF_DEBUG_MISC) {
1803 DPFPRINTF(("Did not receive expected RFC1323 "
1804 "timestamp\n"));
1805 pf_print_state(state);
1806 pf_print_flags(th->th_flags);
1807 printf("\n");
1808 }
1809 REASON_SET(reason, PFRES_TS);
1810 return (PF_DROP);
1811 }
1812 }
1813
1814
1815 /*
1816 * We will note if a host sends his data packets with or without
1817 * timestamps. And require all data packets to contain a timestamp
1818 * if the first does. PAWS implicitly requires that all data packets be
1819 * timestamped. But I think there are middle-man devices that hijack
1820 * TCP streams immediately after the 3whs and don't timestamp their
1821 * packets (seen in a WWW accelerator or cache).
1822 */
1823 if (pd->p_len > 0 && src->scrub && (src->scrub->pfss_flags &
1824 (PFSS_TIMESTAMP|PFSS_DATA_TS|PFSS_DATA_NOTS)) == PFSS_TIMESTAMP) {
1825 if (got_ts)
1826 src->scrub->pfss_flags |= PFSS_DATA_TS;
1827 else {
1828 src->scrub->pfss_flags |= PFSS_DATA_NOTS;
1829 if (pf_status.debug >= PF_DEBUG_MISC && dst->scrub &&
1830 (dst->scrub->pfss_flags & PFSS_TIMESTAMP)) {
1831 /* Don't warn if other host rejected RFC1323 */
1832 DPFPRINTF(("Broken RFC1323 stack did not "
1833 "timestamp data packet. Disabled PAWS "
1834 "security.\n"));
1835 pf_print_state(state);
1836 pf_print_flags(th->th_flags);
1837 printf("\n");
1838 }
1839 }
1840 }
1841
1842
1843 /*
1844 * Update PAWS values
1845 */
1846 if (got_ts && src->scrub && PFSS_TIMESTAMP == (src->scrub->pfss_flags &
1847 (PFSS_PAWS_IDLED|PFSS_TIMESTAMP))) {
1848 getmicrouptime(&src->scrub->pfss_last);
1849 if (SEQ_GEQ(tsval, src->scrub->pfss_tsval) ||
1850 (src->scrub->pfss_flags & PFSS_PAWS) == 0)
1851 src->scrub->pfss_tsval = tsval;
1852
1853 if (tsecr) {
1854 if (SEQ_GEQ(tsecr, src->scrub->pfss_tsecr) ||
1855 (src->scrub->pfss_flags & PFSS_PAWS) == 0)
1856 src->scrub->pfss_tsecr = tsecr;
1857
1858 if ((src->scrub->pfss_flags & PFSS_PAWS) == 0 &&
1859 (SEQ_LT(tsval, src->scrub->pfss_tsval0) ||
1860 src->scrub->pfss_tsval0 == 0)) {
1861 /* tsval0 MUST be the lowest timestamp */
1862 src->scrub->pfss_tsval0 = tsval;
1863 }
1864
1865 /* Only fully initialized after a TS gets echoed */
1866 if ((src->scrub->pfss_flags & PFSS_PAWS) == 0)
1867 src->scrub->pfss_flags |= PFSS_PAWS;
1868 }
1869 }
1870
1871 /* I have a dream.... TCP segment reassembly.... */
1872 return (0);
1873 }
1874
1875 int
1876 pf_normalize_tcpopt(struct pf_rule *r, struct mbuf *m, struct tcphdr *th,
1877 int off)
1878 {
1879 u_int16_t *mss;
1880 int thoff;
1881 int opt, cnt, optlen = 0;
1882 int rewrite = 0;
1883 u_char *optp;
1884
1885 thoff = th->th_off << 2;
1886 cnt = thoff - sizeof(struct tcphdr);
1887 optp = mtod(m, u_char *) + off + sizeof(struct tcphdr);
1888
1889 for (; cnt > 0; cnt -= optlen, optp += optlen) {
1890 opt = optp[0];
1891 if (opt == TCPOPT_EOL)
1892 break;
1893 if (opt == TCPOPT_NOP)
1894 optlen = 1;
1895 else {
1896 if (cnt < 2)
1897 break;
1898 optlen = optp[1];
1899 if (optlen < 2 || optlen > cnt)
1900 break;
1901 }
1902 switch (opt) {
1903 case TCPOPT_MAXSEG:
1904 mss = (u_int16_t *)(optp + 2);
1905 if ((ntohs(*mss)) > r->max_mss) {
1906 th->th_sum = pf_cksum_fixup(th->th_sum,
1907 *mss, htons(r->max_mss), 0);
1908 *mss = htons(r->max_mss);
1909 rewrite = 1;
1910 }
1911 break;
1912 default:
1913 break;
1914 }
1915 }
1916
1917 return (rewrite);
1918 }
1919