1 /* 2 * Copyright (c) 2004 The DragonFly Project. All rights reserved. 3 * 4 * Copyright (c) 1982, 1986, 1991, 1993 5 * The Regents of the University of California. All rights reserved. 6 * (c) UNIX System Laboratories, Inc. 7 * All or some portions of this file are derived from material licensed 8 * to the University of California by American Telephone and Telegraph 9 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 10 * the permission of UNIX System Laboratories, Inc. 11 * 12 * Redistribution and use in source and binary forms, with or without 13 * modification, are permitted provided that the following conditions 14 * are met: 15 * 1. Redistributions of source code must retain the above copyright 16 * notice, this list of conditions and the following disclaimer. 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 3. Neither the name of the University nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * 36 * @(#)kern_subr.c 8.3 (Berkeley) 1/21/94 37 */ 38 39 #include <sys/param.h> 40 #include <sys/systm.h> 41 #include <sys/socket.h> 42 #include <sys/socketvar.h> 43 #include <sys/proc.h> 44 #include <sys/malloc.h> 45 #include <sys/queue.h> 46 #include <sys/kernel.h> 47 #include <sys/resourcevar.h> 48 49 #include <net/if.h> 50 51 #include <netinet/in.h> 52 #include <netinet/in_var.h> 53 #include <netinet/tcp.h> 54 55 #include <net/pf/pfvar.h> 56 #include <sys/md5.h> 57 #include <sys/random.h> 58 59 /* 60 * This implements additional functions used by pf which can not be ported 61 * easyly. At this point it boils down to mostly the Net/OpenBSD hook 62 * implementation. 63 * 64 * BEWARE: this is not locked! Required locking is done by the caller. 65 */ 66 67 void * 68 hook_establish(struct hook_desc_head *head, int tail, void (*fn)(void *), 69 void *arg) 70 { 71 struct hook_desc *hdp; 72 73 hdp = kmalloc(sizeof (*hdp), M_DEVBUF, M_WAITOK); 74 hdp->hd_fn = fn; 75 hdp->hd_arg = arg; 76 if (tail) 77 TAILQ_INSERT_TAIL(head, hdp, hd_list); 78 else 79 TAILQ_INSERT_HEAD(head, hdp, hd_list); 80 81 return (hdp); 82 } 83 84 void 85 hook_disestablish(struct hook_desc_head *head, void *vhook) 86 { 87 struct hook_desc *hdp; 88 89 #ifdef DIAGNOSTIC 90 for (hdp = TAILQ_FIRST(head); hdp != NULL; 91 hdp = TAILQ_NEXT(hdp, hd_list)) 92 if (hdp == vhook) 93 break; 94 if (hdp == NULL) 95 panic("hook_disestablish: hook not established"); 96 #endif 97 hdp = vhook; 98 TAILQ_REMOVE(head, hdp, hd_list); 99 kfree(hdp, M_DEVBUF); 100 } 101 102 /* 103 * Run hooks. Startup hooks are invoked right after scheduler_start but 104 * before root is mounted. Shutdown hooks are invoked immediately before the 105 * system is halted or rebooted, i.e. after file systems unmounted, 106 * after crash dump done, etc. 107 */ 108 void 109 dohooks(struct hook_desc_head *head, int flags) 110 { 111 struct hook_desc *hdp; 112 113 if ((flags & HOOK_REMOVE) == 0) { 114 TAILQ_FOREACH(hdp, head, hd_list) { 115 (*hdp->hd_fn)(hdp->hd_arg); 116 } 117 } else { 118 while ((hdp = TAILQ_FIRST(head)) != NULL) { 119 TAILQ_REMOVE(head, hdp, hd_list); 120 (*hdp->hd_fn)(hdp->hd_arg); 121 if ((flags & HOOK_FREE) != 0) 122 kfree(hdp, M_DEVBUF); 123 } 124 } 125 } 126 127 128 /* 129 * Following is where TCP initial sequence number generation occurs. 130 * 131 * There are two places where we must use initial sequence numbers: 132 * 1. In SYN-ACK packets. 133 * 2. In SYN packets. 134 * 135 * All ISNs for SYN-ACK packets are generated by the syncache. See 136 * tcp_syncache.c for details. 137 * 138 * The ISNs in SYN packets must be monotonic; TIME_WAIT recycling 139 * depends on this property. In addition, these ISNs should be 140 * unguessable so as to prevent connection hijacking. To satisfy 141 * the requirements of this situation, the algorithm outlined in 142 * RFC 1948 is used, with only small modifications. 143 * 144 * Implementation details: 145 * 146 * Time is based off the system timer, and is corrected so that it 147 * increases by one megabyte per second. This allows for proper 148 * recycling on high speed LANs while still leaving over an hour 149 * before rollover. 150 * 151 * As reading the *exact* system time is too expensive to be done 152 * whenever setting up a TCP connection, we increment the time 153 * offset in two ways. First, a small random positive increment 154 * is added to isn_offset for each connection that is set up. 155 * Second, the function tcp_isn_tick fires once per clock tick 156 * and increments isn_offset as necessary so that sequence numbers 157 * are incremented at approximately ISN_BYTES_PER_SECOND. The 158 * random positive increments serve only to ensure that the same 159 * exact sequence number is never sent out twice (as could otherwise 160 * happen when a port is recycled in less than the system tick 161 * interval.) 162 * 163 * net.inet.tcp.isn_reseed_interval controls the number of seconds 164 * between seeding of isn_secret. This is normally set to zero, 165 * as reseeding should not be necessary. 166 * 167 * Locking of the global variables isn_secret, isn_last_reseed, isn_offset, 168 * isn_offset_old, and isn_ctx is performed using the TCP pcbinfo lock. In 169 * general, this means holding an exclusive (write) lock. 170 */ 171 172 #define ISN_BYTES_PER_SECOND 1048576 173 #define ISN_STATIC_INCREMENT 4096 174 #define ISN_RANDOM_INCREMENT (4096 - 1) 175