1 2 /* 3 * Copyright (C) 2012 by Darren Reed. 4 * 5 * See the IPFILTER.LICENCE file for details on licencing. 6 * 7 * Copyright 2008 Sun Microsystems. 8 * 9 * $Id$ 10 */ 11 #if defined(KERNEL) || defined(_KERNEL) 12 # undef KERNEL 13 # undef _KERNEL 14 # define KERNEL 1 15 # define _KERNEL 1 16 #endif 17 #include <sys/errno.h> 18 #include <sys/types.h> 19 #include <sys/param.h> 20 #include <sys/file.h> 21 #if defined(_KERNEL) && defined(__FreeBSD__) && \ 22 !defined(KLD_MODULE) 23 #include "opt_inet6.h" 24 #endif 25 #if !defined(_KERNEL) && !defined(__KERNEL__) 26 # include <stdio.h> 27 # include <stdlib.h> 28 # include <string.h> 29 # define _KERNEL 30 # include <sys/uio.h> 31 # undef _KERNEL 32 #endif 33 #if defined(_KERNEL) && defined(__FreeBSD__) 34 # include <sys/filio.h> 35 # include <sys/fcntl.h> 36 #else 37 # include <sys/ioctl.h> 38 #endif 39 #include <sys/time.h> 40 # include <sys/protosw.h> 41 #include <sys/socket.h> 42 #if defined(_KERNEL) 43 # include <sys/systm.h> 44 # if !defined(__SVR4) 45 # include <sys/mbuf.h> 46 # endif 47 #endif 48 #if defined(__SVR4) 49 # include <sys/filio.h> 50 # include <sys/byteorder.h> 51 # ifdef _KERNEL 52 # include <sys/dditypes.h> 53 # endif 54 # include <sys/stream.h> 55 # include <sys/kmem.h> 56 #endif 57 58 #include <net/if.h> 59 #ifdef sun 60 # include <net/af.h> 61 #endif 62 #include <netinet/in.h> 63 #include <netinet/in_systm.h> 64 #include <netinet/ip.h> 65 #include <netinet/tcp.h> 66 # include <netinet/tcp_fsm.h> 67 #include <netinet/udp.h> 68 #include <netinet/ip_icmp.h> 69 #if !defined(_KERNEL) 70 # include "ipf.h" 71 #endif 72 #include "netinet/ip_compat.h" 73 #include "netinet/ip_fil.h" 74 #include "netinet/ip_nat.h" 75 #include "netinet/ip_frag.h" 76 #include "netinet/ip_state.h" 77 #include "netinet/ip_proxy.h" 78 #include "netinet/ip_lookup.h" 79 #include "netinet/ip_dstlist.h" 80 #include "netinet/ip_sync.h" 81 #ifdef USE_INET6 82 #include <netinet/icmp6.h> 83 #endif 84 #ifdef __FreeBSD__ 85 # include <sys/malloc.h> 86 # if defined(_KERNEL) && !defined(IPFILTER_LKM) 87 # include <sys/libkern.h> 88 # include <sys/systm.h> 89 # endif 90 #endif 91 /* END OF INCLUDES */ 92 93 94 #if !defined(lint) 95 static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed"; 96 static const char rcsid[] = "@(#)$Id$"; 97 #endif 98 99 100 static ipftuneable_t ipf_state_tuneables[] = { 101 { { (void *)offsetof(ipf_state_softc_t, ipf_state_max) }, 102 "state_max", 1, 0x7fffffff, 103 stsizeof(ipf_state_softc_t, ipf_state_max), 104 0, NULL, NULL }, 105 { { (void *)offsetof(ipf_state_softc_t, ipf_state_size) }, 106 "state_size", 1, 0x7fffffff, 107 stsizeof(ipf_state_softc_t, ipf_state_size), 108 0, NULL, ipf_state_rehash }, 109 { { (void *)offsetof(ipf_state_softc_t, ipf_state_lock) }, 110 "state_lock", 0, 1, 111 stsizeof(ipf_state_softc_t, ipf_state_lock), 112 IPFT_RDONLY, NULL, NULL }, 113 { { (void *)offsetof(ipf_state_softc_t, ipf_state_maxbucket) }, 114 "state_maxbucket", 1, 0x7fffffff, 115 stsizeof(ipf_state_softc_t, ipf_state_maxbucket), 116 0, NULL, NULL }, 117 { { (void *)offsetof(ipf_state_softc_t, ipf_state_logging) }, 118 "state_logging",0, 1, 119 stsizeof(ipf_state_softc_t, ipf_state_logging), 120 0, NULL, NULL }, 121 { { (void *)offsetof(ipf_state_softc_t, ipf_state_wm_high) }, 122 "state_wm_high",2, 100, 123 stsizeof(ipf_state_softc_t, ipf_state_wm_high), 124 0, NULL, NULL }, 125 { { (void *)offsetof(ipf_state_softc_t, ipf_state_wm_low) }, 126 "state_wm_low", 1, 99, 127 stsizeof(ipf_state_softc_t, ipf_state_wm_low), 128 0, NULL, NULL }, 129 { { (void *)offsetof(ipf_state_softc_t, ipf_state_wm_freq) }, 130 "state_wm_freq",2, 999999, 131 stsizeof(ipf_state_softc_t, ipf_state_wm_freq), 132 0, NULL, NULL }, 133 { { NULL }, 134 NULL, 0, 0, 135 0, 136 0, NULL, NULL } 137 }; 138 139 #define SINCL(x) ATOMIC_INCL(softs->x) 140 #define SBUMP(x) (softs->x)++ 141 #define SBUMPD(x, y) do { (softs->x.y)++; DT(y); } while (0) 142 #define SBUMPDX(x, y, z)do { (softs->x.y)++; DT(z); } while (0) 143 144 #ifdef USE_INET6 145 static ipstate_t *ipf_checkicmp6matchingstate(fr_info_t *); 146 #endif 147 static int ipf_allowstateicmp(fr_info_t *, ipstate_t *, i6addr_t *); 148 static ipstate_t *ipf_matchsrcdst(fr_info_t *, ipstate_t *, i6addr_t *, 149 i6addr_t *, tcphdr_t *, u_32_t); 150 static ipstate_t *ipf_checkicmpmatchingstate(fr_info_t *); 151 static int ipf_state_flush_entry(ipf_main_softc_t *, void *); 152 static ips_stat_t *ipf_state_stats(ipf_main_softc_t *); 153 static int ipf_state_del(ipf_main_softc_t *, ipstate_t *, int); 154 static int ipf_state_remove(ipf_main_softc_t *, caddr_t); 155 static int ipf_state_match(ipstate_t *is1, ipstate_t *is2); 156 static int ipf_state_matchaddresses(ipstate_t *is1, ipstate_t *is2); 157 static int ipf_state_matchipv4addrs(ipstate_t *is1, ipstate_t *is2); 158 static int ipf_state_matchipv6addrs(ipstate_t *is1, ipstate_t *is2); 159 static int ipf_state_matchisps(ipstate_t *is1, ipstate_t *is2); 160 static int ipf_state_matchports(udpinfo_t *is1, udpinfo_t *is2); 161 static int ipf_state_matcharray(ipstate_t *, int *, u_long); 162 static void ipf_ipsmove(ipf_state_softc_t *, ipstate_t *, u_int); 163 static int ipf_state_tcp(ipf_main_softc_t *, ipf_state_softc_t *, 164 fr_info_t *, tcphdr_t *, ipstate_t *); 165 static int ipf_tcpoptions(ipf_state_softc_t *, fr_info_t *, 166 tcphdr_t *, tcpdata_t *); 167 static ipstate_t *ipf_state_clone(fr_info_t *, tcphdr_t *, ipstate_t *); 168 static void ipf_fixinisn(fr_info_t *, ipstate_t *); 169 static void ipf_fixoutisn(fr_info_t *, ipstate_t *); 170 static void ipf_checknewisn(fr_info_t *, ipstate_t *); 171 static int ipf_state_iter(ipf_main_softc_t *, ipftoken_t *, 172 ipfgeniter_t *, ipfobj_t *); 173 static int ipf_state_gettable(ipf_main_softc_t *, ipf_state_softc_t *, 174 char *); 175 static int ipf_state_tcpinwindow(struct fr_info *, struct tcpdata *, 176 struct tcpdata *, tcphdr_t *, int); 177 178 static int ipf_state_getent(ipf_main_softc_t *, ipf_state_softc_t *, 179 caddr_t); 180 static int ipf_state_putent(ipf_main_softc_t *, ipf_state_softc_t *, 181 caddr_t); 182 183 #define ONE_DAY IPF_TTLVAL(1 * 86400) /* 1 day */ 184 #define FIVE_DAYS (5 * ONE_DAY) 185 #define DOUBLE_HASH(x) (((x) + softs->ipf_state_seed[(x) % \ 186 softs->ipf_state_size]) % softs->ipf_state_size) 187 188 189 /* ------------------------------------------------------------------------ */ 190 /* Function: ipf_state_main_load */ 191 /* Returns: int - 0 == success, -1 == failure */ 192 /* Parameters: Nil */ 193 /* */ 194 /* A null-op function that exists as a placeholder so that the flow in */ 195 /* other functions is obvious. */ 196 /* ------------------------------------------------------------------------ */ 197 int 198 ipf_state_main_load(void) 199 { 200 return (0); 201 } 202 203 204 /* ------------------------------------------------------------------------ */ 205 /* Function: ipf_state_main_unload */ 206 /* Returns: int - 0 == success, -1 == failure */ 207 /* Parameters: Nil */ 208 /* */ 209 /* A null-op function that exists as a placeholder so that the flow in */ 210 /* other functions is obvious. */ 211 /* ------------------------------------------------------------------------ */ 212 int 213 ipf_state_main_unload(void) 214 { 215 return (0); 216 } 217 218 219 /* ------------------------------------------------------------------------ */ 220 /* Function: ipf_state_soft_create */ 221 /* Returns: void * - NULL = failure, else pointer to soft context */ 222 /* Parameters: softc(I) - pointer to soft context main structure */ 223 /* */ 224 /* Create a new state soft context structure and populate it with the list */ 225 /* of tunables and other default settings. */ 226 /* ------------------------------------------------------------------------ */ 227 void * 228 ipf_state_soft_create(ipf_main_softc_t *softc) 229 { 230 ipf_state_softc_t *softs; 231 232 KMALLOC(softs, ipf_state_softc_t *); 233 if (softs == NULL) 234 return (NULL); 235 236 bzero((char *)softs, sizeof(*softs)); 237 238 softs->ipf_state_tune = ipf_tune_array_copy(softs, 239 sizeof(ipf_state_tuneables), 240 ipf_state_tuneables); 241 if (softs->ipf_state_tune == NULL) { 242 ipf_state_soft_destroy(softc, softs); 243 return (NULL); 244 } 245 if (ipf_tune_array_link(softc, softs->ipf_state_tune) == -1) { 246 ipf_state_soft_destroy(softc, softs); 247 return (NULL); 248 } 249 250 #ifdef IPFILTER_LOG 251 softs->ipf_state_logging = 1; 252 #else 253 softs->ipf_state_logging = 0; 254 #endif 255 softs->ipf_state_size = IPSTATE_SIZE, 256 softs->ipf_state_maxbucket = 0; 257 softs->ipf_state_wm_freq = IPF_TTLVAL(10); 258 softs->ipf_state_max = IPSTATE_MAX; 259 softs->ipf_state_wm_last = 0; 260 softs->ipf_state_wm_high = 99; 261 softs->ipf_state_wm_low = 90; 262 softs->ipf_state_inited = 0; 263 softs->ipf_state_lock = 0; 264 softs->ipf_state_doflush = 0; 265 266 return (softs); 267 } 268 269 270 /* ------------------------------------------------------------------------ */ 271 /* Function: ipf_state_soft_destroy */ 272 /* Returns: Nil */ 273 /* Parameters: softc(I) - pointer to soft context main structure */ 274 /* arg(I) - pointer to local context to use */ 275 /* */ 276 /* Undo only what we did in soft create: unlink and free the tunables and */ 277 /* free the soft context structure itself. */ 278 /* ------------------------------------------------------------------------ */ 279 void 280 ipf_state_soft_destroy(ipf_main_softc_t *softc, void *arg) 281 { 282 ipf_state_softc_t *softs = arg; 283 284 if (softs->ipf_state_tune != NULL) { 285 ipf_tune_array_unlink(softc, softs->ipf_state_tune); 286 KFREES(softs->ipf_state_tune, sizeof(ipf_state_tuneables)); 287 softs->ipf_state_tune = NULL; 288 } 289 290 KFREE(softs); 291 } 292 293 static void * 294 ipf_state_seed_alloc(u_int state_size, u_int state_max) 295 { 296 u_int i; 297 u_long *state_seed; 298 KMALLOCS(state_seed, u_long *, state_size * sizeof(*state_seed)); 299 if (state_seed == NULL) 300 return (NULL); 301 302 for (i = 0; i < state_size; i++) { 303 /* 304 * XXX - ipf_state_seed[X] should be a random number of sorts. 305 */ 306 #ifdef __FreeBSD__ 307 state_seed[i] = arc4random(); 308 #else 309 state_seed[i] = ((u_long)state_seed + i) * state_size; 310 state_seed[i] ^= 0xa5a55a5a; 311 state_seed[i] *= (u_long)state_seed; 312 state_seed[i] ^= 0x5a5aa5a5; 313 state_seed[i] *= state_max; 314 #endif 315 } 316 return (state_seed); 317 } 318 319 320 /* ------------------------------------------------------------------------ */ 321 /* Function: ipf_state_soft_init */ 322 /* Returns: int - 0 == success, -1 == failure */ 323 /* Parameters: softc(I) - pointer to soft context main structure */ 324 /* arg(I) - pointer to local context to use */ 325 /* */ 326 /* Initialise the state soft context structure so it is ready for use. */ 327 /* This involves: */ 328 /* - allocating a hash table and zero'ing it out */ 329 /* - building a secondary table of seeds for double hashing to make it more */ 330 /* difficult to attempt to attack the hash table itself (for DoS) */ 331 /* - initialise all of the timeout queues, including a table for TCP, some */ 332 /* pairs of query/response for UDP and other IP protocols (typically the */ 333 /* reply queue has a shorter timeout than the query) */ 334 /* ------------------------------------------------------------------------ */ 335 int 336 ipf_state_soft_init(ipf_main_softc_t *softc, void *arg) 337 { 338 ipf_state_softc_t *softs = arg; 339 int i; 340 341 KMALLOCS(softs->ipf_state_table, 342 ipstate_t **, softs->ipf_state_size * sizeof(ipstate_t *)); 343 if (softs->ipf_state_table == NULL) 344 return (-1); 345 346 bzero((char *)softs->ipf_state_table, 347 softs->ipf_state_size * sizeof(ipstate_t *)); 348 349 softs->ipf_state_seed = ipf_state_seed_alloc(softs->ipf_state_size, 350 softs->ipf_state_max); 351 if (softs->ipf_state_seed == NULL) 352 return (-2); 353 354 KMALLOCS(softs->ipf_state_stats.iss_bucketlen, u_int *, 355 softs->ipf_state_size * sizeof(u_int)); 356 if (softs->ipf_state_stats.iss_bucketlen == NULL) 357 return (-3); 358 359 bzero((char *)softs->ipf_state_stats.iss_bucketlen, 360 softs->ipf_state_size * sizeof(u_int)); 361 362 if (softs->ipf_state_maxbucket == 0) { 363 for (i = softs->ipf_state_size; i > 0; i >>= 1) 364 softs->ipf_state_maxbucket++; 365 softs->ipf_state_maxbucket *= 2; 366 } 367 368 ipf_sttab_init(softc, softs->ipf_state_tcptq); 369 softs->ipf_state_stats.iss_tcptab = softs->ipf_state_tcptq; 370 softs->ipf_state_tcptq[IPF_TCP_NSTATES - 1].ifq_next = 371 &softs->ipf_state_udptq; 372 373 IPFTQ_INIT(&softs->ipf_state_udptq, softc->ipf_udptimeout, 374 "ipftq udp tab"); 375 softs->ipf_state_udptq.ifq_next = &softs->ipf_state_udpacktq; 376 377 IPFTQ_INIT(&softs->ipf_state_udpacktq, softc->ipf_udpacktimeout, 378 "ipftq udpack tab"); 379 softs->ipf_state_udpacktq.ifq_next = &softs->ipf_state_icmptq; 380 381 IPFTQ_INIT(&softs->ipf_state_icmptq, softc->ipf_icmptimeout, 382 "ipftq icmp tab"); 383 softs->ipf_state_icmptq.ifq_next = &softs->ipf_state_icmpacktq; 384 385 IPFTQ_INIT(&softs->ipf_state_icmpacktq, softc->ipf_icmpacktimeout, 386 "ipftq icmpack tab"); 387 softs->ipf_state_icmpacktq.ifq_next = &softs->ipf_state_iptq; 388 389 IPFTQ_INIT(&softs->ipf_state_iptq, softc->ipf_iptimeout, 390 "ipftq iptimeout tab"); 391 softs->ipf_state_iptq.ifq_next = &softs->ipf_state_pending; 392 393 IPFTQ_INIT(&softs->ipf_state_pending, IPF_HZ_DIVIDE, "ipftq pending"); 394 softs->ipf_state_pending.ifq_next = &softs->ipf_state_deletetq; 395 396 IPFTQ_INIT(&softs->ipf_state_deletetq, 1, "ipftq delete"); 397 softs->ipf_state_deletetq.ifq_next = NULL; 398 399 MUTEX_INIT(&softs->ipf_stinsert, "ipf state insert mutex"); 400 401 402 softs->ipf_state_wm_last = softc->ipf_ticks; 403 softs->ipf_state_inited = 1; 404 405 return (0); 406 } 407 408 409 /* ------------------------------------------------------------------------ */ 410 /* Function: ipf_state_soft_fini */ 411 /* Returns: int - 0 = success, -1 = failure */ 412 /* Parameters: softc(I) - pointer to soft context main structure */ 413 /* arg(I) - pointer to local context to use */ 414 /* */ 415 /* Release and destroy any resources acquired or initialised so that */ 416 /* IPFilter can be unloaded or re-initialised. */ 417 /* ------------------------------------------------------------------------ */ 418 int 419 ipf_state_soft_fini(ipf_main_softc_t *softc, void *arg) 420 { 421 ipf_state_softc_t *softs = arg; 422 ipftq_t *ifq, *ifqnext; 423 ipstate_t *is; 424 425 while ((is = softs->ipf_state_list) != NULL) 426 ipf_state_del(softc, is, ISL_UNLOAD); 427 428 /* 429 * Proxy timeout queues are not cleaned here because although they 430 * exist on the state list, appr_unload is called after 431 * ipf_state_unload and the proxies actually are responsible for them 432 * being created. Should the proxy timeouts have their own list? 433 * There's no real justification as this is the only complication. 434 */ 435 for (ifq = softs->ipf_state_usertq; ifq != NULL; ifq = ifqnext) { 436 ifqnext = ifq->ifq_next; 437 438 if (ipf_deletetimeoutqueue(ifq) == 0) 439 ipf_freetimeoutqueue(softc, ifq); 440 } 441 442 softs->ipf_state_stats.iss_inuse = 0; 443 softs->ipf_state_stats.iss_active = 0; 444 445 if (softs->ipf_state_inited == 1) { 446 softs->ipf_state_inited = 0; 447 ipf_sttab_destroy(softs->ipf_state_tcptq); 448 MUTEX_DESTROY(&softs->ipf_state_udptq.ifq_lock); 449 MUTEX_DESTROY(&softs->ipf_state_icmptq.ifq_lock); 450 MUTEX_DESTROY(&softs->ipf_state_udpacktq.ifq_lock); 451 MUTEX_DESTROY(&softs->ipf_state_icmpacktq.ifq_lock); 452 MUTEX_DESTROY(&softs->ipf_state_iptq.ifq_lock); 453 MUTEX_DESTROY(&softs->ipf_state_deletetq.ifq_lock); 454 MUTEX_DESTROY(&softs->ipf_state_pending.ifq_lock); 455 MUTEX_DESTROY(&softs->ipf_stinsert); 456 } 457 458 if (softs->ipf_state_table != NULL) { 459 KFREES(softs->ipf_state_table, 460 softs->ipf_state_size * sizeof(*softs->ipf_state_table)); 461 softs->ipf_state_table = NULL; 462 } 463 464 if (softs->ipf_state_seed != NULL) { 465 KFREES(softs->ipf_state_seed, 466 softs->ipf_state_size * sizeof(*softs->ipf_state_seed)); 467 softs->ipf_state_seed = NULL; 468 } 469 470 if (softs->ipf_state_stats.iss_bucketlen != NULL) { 471 KFREES(softs->ipf_state_stats.iss_bucketlen, 472 softs->ipf_state_size * sizeof(u_int)); 473 softs->ipf_state_stats.iss_bucketlen = NULL; 474 } 475 476 return (0); 477 } 478 479 480 /* ------------------------------------------------------------------------ */ 481 /* Function: ipf_state_setlock */ 482 /* Returns: Nil */ 483 /* Parameters: arg(I) - pointer to local context to use */ 484 /* tmp(I) - new value for lock */ 485 /* */ 486 /* Stub function that allows for external manipulation of ipf_state_lock */ 487 /* ------------------------------------------------------------------------ */ 488 void 489 ipf_state_setlock(void *arg, int tmp) 490 { 491 ipf_state_softc_t *softs = arg; 492 493 softs->ipf_state_lock = tmp; 494 } 495 496 497 /* ------------------------------------------------------------------------ */ 498 /* Function: ipf_state_stats */ 499 /* Returns: ips_state_t* - pointer to state stats structure */ 500 /* Parameters: softc(I) - pointer to soft context main structure */ 501 /* */ 502 /* Put all the current numbers and pointers into a single struct and return */ 503 /* a pointer to it. */ 504 /* ------------------------------------------------------------------------ */ 505 static ips_stat_t * 506 ipf_state_stats(ipf_main_softc_t *softc) 507 { 508 ipf_state_softc_t *softs = softc->ipf_state_soft; 509 ips_stat_t *issp = &softs->ipf_state_stats; 510 511 issp->iss_state_size = softs->ipf_state_size; 512 issp->iss_state_max = softs->ipf_state_max; 513 issp->iss_table = softs->ipf_state_table; 514 issp->iss_list = softs->ipf_state_list; 515 issp->iss_ticks = softc->ipf_ticks; 516 517 #ifdef IPFILTER_LOGGING 518 issp->iss_log_ok = ipf_log_logok(softc, IPF_LOGSTATE); 519 issp->iss_log_fail = ipf_log_failures(softc, IPF_LOGSTATE); 520 #else 521 issp->iss_log_ok = 0; 522 issp->iss_log_fail = 0; 523 #endif 524 return (issp); 525 } 526 527 /* ------------------------------------------------------------------------ */ 528 /* Function: ipf_state_remove */ 529 /* Returns: int - 0 == success, != 0 == failure */ 530 /* Parameters: softc(I) - pointer to soft context main structure */ 531 /* data(I) - pointer to state structure to delete from table */ 532 /* */ 533 /* Search for a state structure that matches the one passed, according to */ 534 /* the IP addresses and other protocol specific information. */ 535 /* ------------------------------------------------------------------------ */ 536 static int 537 ipf_state_remove(ipf_main_softc_t *softc, caddr_t data) 538 { 539 ipf_state_softc_t *softs = softc->ipf_state_soft; 540 ipstate_t *sp, st; 541 int error; 542 543 sp = &st; 544 error = ipf_inobj(softc, data, NULL, &st, IPFOBJ_IPSTATE); 545 if (error) 546 return (EFAULT); 547 548 WRITE_ENTER(&softc->ipf_state); 549 for (sp = softs->ipf_state_list; sp; sp = sp->is_next) 550 if ((sp->is_p == st.is_p) && (sp->is_v == st.is_v) && 551 !bcmp((caddr_t)&sp->is_src, (caddr_t)&st.is_src, 552 sizeof(st.is_src)) && 553 !bcmp((caddr_t)&sp->is_dst, (caddr_t)&st.is_dst, 554 sizeof(st.is_dst)) && 555 !bcmp((caddr_t)&sp->is_ps, (caddr_t)&st.is_ps, 556 sizeof(st.is_ps))) { 557 ipf_state_del(softc, sp, ISL_REMOVE); 558 RWLOCK_EXIT(&softc->ipf_state); 559 return (0); 560 } 561 RWLOCK_EXIT(&softc->ipf_state); 562 563 IPFERROR(100001); 564 return (ESRCH); 565 } 566 567 568 /* ------------------------------------------------------------------------ */ 569 /* Function: ipf_state_ioctl */ 570 /* Returns: int - 0 == success, != 0 == failure */ 571 /* Parameters: softc(I) - pointer to soft context main structure */ 572 /* data(I) - pointer to ioctl data */ 573 /* cmd(I) - ioctl command integer */ 574 /* mode(I) - file mode bits used with open */ 575 /* uid(I) - uid of process making the ioctl call */ 576 /* ctx(I) - pointer specific to context of the call */ 577 /* */ 578 /* Processes an ioctl call made to operate on the IP Filter state device. */ 579 /* ------------------------------------------------------------------------ */ 580 int 581 ipf_state_ioctl(ipf_main_softc_t *softc, caddr_t data, ioctlcmd_t cmd, 582 int mode, int uid, void *ctx) 583 { 584 ipf_state_softc_t *softs = softc->ipf_state_soft; 585 int arg, ret, error = 0; 586 SPL_INT(s); 587 588 switch (cmd) 589 { 590 /* 591 * Delete an entry from the state table. 592 */ 593 case SIOCDELST : 594 error = ipf_state_remove(softc, data); 595 break; 596 597 /* 598 * Flush the state table 599 */ 600 case SIOCIPFFL : 601 error = BCOPYIN(data, &arg, sizeof(arg)); 602 if (error != 0) { 603 IPFERROR(100002); 604 error = EFAULT; 605 606 } else { 607 WRITE_ENTER(&softc->ipf_state); 608 ret = ipf_state_flush(softc, arg, 4); 609 RWLOCK_EXIT(&softc->ipf_state); 610 611 error = BCOPYOUT(&ret, data, sizeof(ret)); 612 if (error != 0) { 613 IPFERROR(100003); 614 error = EFAULT; 615 } 616 } 617 break; 618 619 #ifdef USE_INET6 620 case SIOCIPFL6 : 621 error = BCOPYIN(data, &arg, sizeof(arg)); 622 if (error != 0) { 623 IPFERROR(100004); 624 error = EFAULT; 625 626 } else { 627 WRITE_ENTER(&softc->ipf_state); 628 ret = ipf_state_flush(softc, arg, 6); 629 RWLOCK_EXIT(&softc->ipf_state); 630 631 error = BCOPYOUT(&ret, data, sizeof(ret)); 632 if (error != 0) { 633 IPFERROR(100005); 634 error = EFAULT; 635 } 636 } 637 break; 638 #endif 639 640 case SIOCMATCHFLUSH : 641 WRITE_ENTER(&softc->ipf_state); 642 error = ipf_state_matchflush(softc, data); 643 RWLOCK_EXIT(&softc->ipf_state); 644 break; 645 646 #ifdef IPFILTER_LOG 647 /* 648 * Flush the state log. 649 */ 650 case SIOCIPFFB : 651 if (!(mode & FWRITE)) { 652 IPFERROR(100008); 653 error = EPERM; 654 } else { 655 int tmp; 656 657 tmp = ipf_log_clear(softc, IPL_LOGSTATE); 658 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 659 if (error != 0) { 660 IPFERROR(100009); 661 error = EFAULT; 662 } 663 } 664 break; 665 666 /* 667 * Turn logging of state information on/off. 668 */ 669 case SIOCSETLG : 670 if (!(mode & FWRITE)) { 671 IPFERROR(100010); 672 error = EPERM; 673 } else { 674 error = BCOPYIN(data, &softs->ipf_state_logging, 675 sizeof(softs->ipf_state_logging)); 676 if (error != 0) { 677 IPFERROR(100011); 678 error = EFAULT; 679 } 680 } 681 break; 682 683 /* 684 * Return the current state of logging. 685 */ 686 case SIOCGETLG : 687 error = BCOPYOUT(&softs->ipf_state_logging, data, 688 sizeof(softs->ipf_state_logging)); 689 if (error != 0) { 690 IPFERROR(100012); 691 error = EFAULT; 692 } 693 break; 694 695 /* 696 * Return the number of bytes currently waiting to be read. 697 */ 698 case FIONREAD : 699 arg = ipf_log_bytesused(softc, IPL_LOGSTATE); 700 error = BCOPYOUT(&arg, data, sizeof(arg)); 701 if (error != 0) { 702 IPFERROR(100013); 703 error = EFAULT; 704 } 705 break; 706 #endif 707 708 /* 709 * Get the current state statistics. 710 */ 711 case SIOCGETFS : 712 error = ipf_outobj(softc, data, ipf_state_stats(softc), 713 IPFOBJ_STATESTAT); 714 break; 715 716 /* 717 * Lock/Unlock the state table. (Locking prevents any changes, which 718 * means no packets match). 719 */ 720 case SIOCSTLCK : 721 if (!(mode & FWRITE)) { 722 IPFERROR(100014); 723 error = EPERM; 724 } else { 725 error = ipf_lock(data, &softs->ipf_state_lock); 726 } 727 break; 728 729 /* 730 * Add an entry to the current state table. 731 */ 732 case SIOCSTPUT : 733 if (!softs->ipf_state_lock || !(mode &FWRITE)) { 734 IPFERROR(100015); 735 error = EACCES; 736 break; 737 } 738 error = ipf_state_putent(softc, softs, data); 739 break; 740 741 /* 742 * Get a state table entry. 743 */ 744 case SIOCSTGET : 745 if (!softs->ipf_state_lock) { 746 IPFERROR(100016); 747 error = EACCES; 748 break; 749 } 750 error = ipf_state_getent(softc, softs, data); 751 break; 752 753 case SIOCGENITER : 754 { 755 ipftoken_t *token; 756 ipfgeniter_t iter; 757 ipfobj_t obj; 758 759 error = ipf_inobj(softc, data, &obj, &iter, IPFOBJ_GENITER); 760 if (error != 0) 761 break; 762 763 SPL_SCHED(s); 764 token = ipf_token_find(softc, IPFGENITER_STATE, uid, ctx); 765 if (token != NULL) { 766 error = ipf_state_iter(softc, token, &iter, &obj); 767 WRITE_ENTER(&softc->ipf_tokens); 768 ipf_token_deref(softc, token); 769 RWLOCK_EXIT(&softc->ipf_tokens); 770 } else { 771 IPFERROR(100018); 772 error = ESRCH; 773 } 774 SPL_X(s); 775 break; 776 } 777 778 case SIOCGTABL : 779 error = ipf_state_gettable(softc, softs, data); 780 break; 781 782 case SIOCIPFDELTOK : 783 error = BCOPYIN(data, &arg, sizeof(arg)); 784 if (error != 0) { 785 IPFERROR(100019); 786 error = EFAULT; 787 } else { 788 SPL_SCHED(s); 789 error = ipf_token_del(softc, arg, uid, ctx); 790 SPL_X(s); 791 } 792 break; 793 794 case SIOCGTQTAB : 795 error = ipf_outobj(softc, data, softs->ipf_state_tcptq, 796 IPFOBJ_STATETQTAB); 797 break; 798 799 default : 800 IPFERROR(100020); 801 error = EINVAL; 802 break; 803 } 804 return (error); 805 } 806 807 808 /* ------------------------------------------------------------------------ */ 809 /* Function: ipf_state_getent */ 810 /* Returns: int - 0 == success, != 0 == failure */ 811 /* Parameters: softc(I) - pointer to soft context main structure */ 812 /* softs(I) - pointer to state context structure */ 813 /* data(I) - pointer to state structure to retrieve from table*/ 814 /* */ 815 /* Copy out state information from the kernel to a user space process. If */ 816 /* there is a filter rule associated with the state entry, copy that out */ 817 /* as well. The entry to copy out is taken from the value of "ips_next" in */ 818 /* the struct passed in and if not null and not found in the list of current*/ 819 /* state entries, the retrieval fails. */ 820 /* ------------------------------------------------------------------------ */ 821 static int 822 ipf_state_getent(ipf_main_softc_t *softc, ipf_state_softc_t *softs, 823 caddr_t data) 824 { 825 ipstate_t *is, *isn; 826 ipstate_save_t ips; 827 int error; 828 829 error = ipf_inobj(softc, data, NULL, &ips, IPFOBJ_STATESAVE); 830 if (error) 831 return (EFAULT); 832 833 READ_ENTER(&softc->ipf_state); 834 isn = ips.ips_next; 835 if (isn == NULL) { 836 isn = softs->ipf_state_list; 837 if (isn == NULL) { 838 if (ips.ips_next == NULL) { 839 RWLOCK_EXIT(&softc->ipf_state); 840 IPFERROR(100021); 841 return (ENOENT); 842 } 843 return (0); 844 } 845 } else { 846 /* 847 * Make sure the pointer we're copying from exists in the 848 * current list of entries. Security precaution to prevent 849 * copying of random kernel data. 850 */ 851 for (is = softs->ipf_state_list; is; is = is->is_next) 852 if (is == isn) 853 break; 854 if (!is) { 855 RWLOCK_EXIT(&softc->ipf_state); 856 IPFERROR(100022); 857 return (ESRCH); 858 } 859 } 860 ips.ips_next = isn->is_next; 861 bcopy((char *)isn, (char *)&ips.ips_is, sizeof(ips.ips_is)); 862 ips.ips_rule = isn->is_rule; 863 if (isn->is_rule != NULL) 864 bcopy((char *)isn->is_rule, (char *)&ips.ips_fr, 865 sizeof(ips.ips_fr)); 866 RWLOCK_EXIT(&softc->ipf_state); 867 error = ipf_outobj(softc, data, &ips, IPFOBJ_STATESAVE); 868 return (error); 869 } 870 871 872 /* ------------------------------------------------------------------------ */ 873 /* Function: ipf_state_putent */ 874 /* Returns: int - 0 == success, != 0 == failure */ 875 /* Parameters: softc(I) - pointer to soft context main structure */ 876 /* softs(I) - pointer to state context structure */ 877 /* data(I) - pointer to state information struct */ 878 /* */ 879 /* This function implements the SIOCSTPUT ioctl: insert a state entry into */ 880 /* the state table. If the state info. includes a pointer to a filter rule */ 881 /* then also add in an orphaned rule (will not show up in any "ipfstat -io" */ 882 /* output. */ 883 /* ------------------------------------------------------------------------ */ 884 int 885 ipf_state_putent(ipf_main_softc_t *softc, ipf_state_softc_t *softs, 886 caddr_t data) 887 { 888 ipstate_t *is, *isn; 889 ipstate_save_t ips; 890 int error, out, i; 891 frentry_t *fr; 892 char *name; 893 894 error = ipf_inobj(softc, data, NULL, &ips, IPFOBJ_STATESAVE); 895 if (error != 0) 896 return (error); 897 898 KMALLOC(isn, ipstate_t *); 899 if (isn == NULL) { 900 IPFERROR(100023); 901 return (ENOMEM); 902 } 903 904 bcopy((char *)&ips.ips_is, (char *)isn, sizeof(*isn)); 905 bzero((char *)isn, offsetof(struct ipstate, is_pkts)); 906 isn->is_sti.tqe_pnext = NULL; 907 isn->is_sti.tqe_next = NULL; 908 isn->is_sti.tqe_ifq = NULL; 909 isn->is_sti.tqe_parent = isn; 910 isn->is_ifp[0] = NULL; 911 isn->is_ifp[1] = NULL; 912 isn->is_ifp[2] = NULL; 913 isn->is_ifp[3] = NULL; 914 isn->is_sync = NULL; 915 fr = ips.ips_rule; 916 917 if (fr == NULL) { 918 int inserr; 919 920 READ_ENTER(&softc->ipf_state); 921 inserr = ipf_state_insert(softc, isn, 0); 922 MUTEX_EXIT(&isn->is_lock); 923 RWLOCK_EXIT(&softc->ipf_state); 924 925 return (inserr); 926 } 927 928 if (isn->is_flags & SI_NEWFR) { 929 KMALLOC(fr, frentry_t *); 930 if (fr == NULL) { 931 KFREE(isn); 932 IPFERROR(100024); 933 return (ENOMEM); 934 } 935 bcopy((char *)&ips.ips_fr, (char *)fr, sizeof(*fr)); 936 out = fr->fr_flags & FR_OUTQUE ? 1 : 0; 937 isn->is_rule = fr; 938 ips.ips_is.is_rule = fr; 939 MUTEX_NUKE(&fr->fr_lock); 940 MUTEX_INIT(&fr->fr_lock, "state filter rule lock"); 941 942 /* 943 * Look up all the interface names in the rule. 944 */ 945 for (i = 0; i < FR_NUM(fr->fr_ifnames); i++) { 946 if (fr->fr_ifnames[i] == -1) { 947 fr->fr_ifas[i] = NULL; 948 continue; 949 } 950 name = FR_NAME(fr, fr_ifnames[i]); 951 fr->fr_ifas[i] = ipf_resolvenic(softc, name, 952 fr->fr_family); 953 } 954 955 for (i = 0; i < FR_NUM(isn->is_ifname); i++) { 956 name = isn->is_ifname[i]; 957 isn->is_ifp[i] = ipf_resolvenic(softc, name, 958 isn->is_v); 959 } 960 961 fr->fr_ref = 0; 962 fr->fr_dsize = 0; 963 fr->fr_data = NULL; 964 fr->fr_type = FR_T_NONE; 965 966 (void) ipf_resolvedest(softc, fr->fr_names, &fr->fr_tifs[0], 967 fr->fr_family); 968 (void) ipf_resolvedest(softc, fr->fr_names, &fr->fr_tifs[1], 969 fr->fr_family); 970 (void) ipf_resolvedest(softc, fr->fr_names, &fr->fr_dif, 971 fr->fr_family); 972 973 /* 974 * send a copy back to userland of what we ended up 975 * to allow for verification. 976 */ 977 error = ipf_outobj(softc, data, &ips, IPFOBJ_STATESAVE); 978 if (error != 0) { 979 KFREE(isn); 980 MUTEX_DESTROY(&fr->fr_lock); 981 KFREE(fr); 982 IPFERROR(100025); 983 return (EFAULT); 984 } 985 READ_ENTER(&softc->ipf_state); 986 error = ipf_state_insert(softc, isn, 0); 987 MUTEX_EXIT(&isn->is_lock); 988 RWLOCK_EXIT(&softc->ipf_state); 989 990 } else { 991 READ_ENTER(&softc->ipf_state); 992 for (is = softs->ipf_state_list; is; is = is->is_next) 993 if (is->is_rule == fr) { 994 error = ipf_state_insert(softc, isn, 0); 995 MUTEX_EXIT(&isn->is_lock); 996 break; 997 } 998 999 if (is == NULL) { 1000 KFREE(isn); 1001 isn = NULL; 1002 } 1003 RWLOCK_EXIT(&softc->ipf_state); 1004 1005 if (isn == NULL) { 1006 IPFERROR(100033); 1007 error = ESRCH; 1008 } 1009 } 1010 1011 return (error); 1012 } 1013 1014 1015 /* ------------------------------------------------------------------------ */ 1016 /* Function: ipf_state_insert */ 1017 /* Returns: int - 0 == success, -1 == failure */ 1018 /* Parameters: softc(I) - pointer to soft context main structure */ 1019 /* Parameters: is(I) - pointer to state structure */ 1020 /* rev(I) - flag indicating direction of packet */ 1021 /* */ 1022 /* Inserts a state structure into the hash table (for lookups) and the list */ 1023 /* of state entries (for enumeration). Resolves all of the interface names */ 1024 /* to pointers and adjusts running stats for the hash table as appropriate. */ 1025 /* */ 1026 /* This function can fail if the filter rule has had a population policy of */ 1027 /* IP addresses used with stateful filtering assigned to it. */ 1028 /* */ 1029 /* Locking: it is assumed that some kind of lock on ipf_state is held. */ 1030 /* Exits with is_lock initialised and held - *EVEN IF ERROR*. */ 1031 /* ------------------------------------------------------------------------ */ 1032 int 1033 ipf_state_insert(ipf_main_softc_t *softc, ipstate_t *is, int rev) 1034 { 1035 ipf_state_softc_t *softs = softc->ipf_state_soft; 1036 frentry_t *fr; 1037 u_int hv; 1038 int i; 1039 1040 /* 1041 * Look up all the interface names in the state entry. 1042 */ 1043 for (i = 0; i < FR_NUM(is->is_ifp); i++) { 1044 if (is->is_ifp[i] != NULL) 1045 continue; 1046 is->is_ifp[i] = ipf_resolvenic(softc, is->is_ifname[i], 1047 is->is_v); 1048 } 1049 1050 /* 1051 * If we could trust is_hv, then the modulus would not be needed, 1052 * but when running with IPFILTER_SYNC, this stops bad values. 1053 */ 1054 hv = is->is_hv % softs->ipf_state_size; 1055 /* TRACE is, hv */ 1056 is->is_hv = hv; 1057 1058 /* 1059 * We need to get both of these locks...the first because it is 1060 * possible that once the insert is complete another packet might 1061 * come along, match the entry and want to update it. 1062 */ 1063 MUTEX_INIT(&is->is_lock, "ipf state entry"); 1064 MUTEX_ENTER(&is->is_lock); 1065 MUTEX_ENTER(&softs->ipf_stinsert); 1066 1067 fr = is->is_rule; 1068 if (fr != NULL) { 1069 if ((fr->fr_srctrack.ht_max_nodes != 0) && 1070 (ipf_ht_node_add(softc, &fr->fr_srctrack, 1071 is->is_family, &is->is_src) == -1)) { 1072 SBUMPD(ipf_state_stats, iss_max_track); 1073 MUTEX_EXIT(&softs->ipf_stinsert); 1074 return (-1); 1075 } 1076 1077 MUTEX_ENTER(&fr->fr_lock); 1078 fr->fr_ref++; 1079 MUTEX_EXIT(&fr->fr_lock); 1080 fr->fr_statecnt++; 1081 } 1082 1083 if (is->is_flags & (SI_WILDP|SI_WILDA)) { 1084 DT(iss_wild_plus_one); 1085 SINCL(ipf_state_stats.iss_wild); 1086 } 1087 1088 SBUMP(ipf_state_stats.iss_proto[is->is_p]); 1089 SBUMP(ipf_state_stats.iss_active_proto[is->is_p]); 1090 1091 /* 1092 * add into list table. 1093 */ 1094 if (softs->ipf_state_list != NULL) 1095 softs->ipf_state_list->is_pnext = &is->is_next; 1096 is->is_pnext = &softs->ipf_state_list; 1097 is->is_next = softs->ipf_state_list; 1098 softs->ipf_state_list = is; 1099 1100 if (softs->ipf_state_table[hv] != NULL) 1101 softs->ipf_state_table[hv]->is_phnext = &is->is_hnext; 1102 else 1103 softs->ipf_state_stats.iss_inuse++; 1104 is->is_phnext = softs->ipf_state_table + hv; 1105 is->is_hnext = softs->ipf_state_table[hv]; 1106 softs->ipf_state_table[hv] = is; 1107 softs->ipf_state_stats.iss_bucketlen[hv]++; 1108 softs->ipf_state_stats.iss_active++; 1109 MUTEX_EXIT(&softs->ipf_stinsert); 1110 1111 ipf_state_setqueue(softc, is, rev); 1112 1113 return (0); 1114 } 1115 1116 1117 /* ------------------------------------------------------------------------ */ 1118 /* Function: ipf_state_matchipv4addrs */ 1119 /* Returns: int - 2 addresses match (strong match), 1 reverse match, */ 1120 /* 0 no match */ 1121 /* Parameters: is1, is2 pointers to states we are checking */ 1122 /* */ 1123 /* Function matches IPv4 addresses it returns strong match for ICMP proto */ 1124 /* even there is only reverse match */ 1125 /* ------------------------------------------------------------------------ */ 1126 static int 1127 ipf_state_matchipv4addrs(ipstate_t *is1, ipstate_t *is2) 1128 { 1129 int rv; 1130 1131 if (is1->is_saddr == is2->is_saddr && is1->is_daddr == is2->is_daddr) 1132 rv = 2; 1133 else if (is1->is_saddr == is2->is_daddr && 1134 is1->is_daddr == is2->is_saddr) { 1135 /* force strong match for ICMP protocol */ 1136 rv = (is1->is_p == IPPROTO_ICMP) ? 2 : 1; 1137 } 1138 else 1139 rv = 0; 1140 1141 return (rv); 1142 } 1143 1144 1145 /* ------------------------------------------------------------------------ */ 1146 /* Function: ipf_state_matchipv6addrs */ 1147 /* Returns: int - 2 addresses match (strong match), 1 reverse match, */ 1148 /* 0 no match */ 1149 /* Parameters: is1, is2 pointers to states we are checking */ 1150 /* */ 1151 /* Function matches IPv6 addresses it returns strong match for ICMP proto */ 1152 /* even there is only reverse match */ 1153 /* ------------------------------------------------------------------------ */ 1154 static int 1155 ipf_state_matchipv6addrs(ipstate_t *is1, ipstate_t *is2) 1156 { 1157 int rv; 1158 1159 if (IP6_EQ(&is1->is_src, &is2->is_src) && 1160 IP6_EQ(&is1->is_dst, &is2->is_dst)) 1161 rv = 2; 1162 else if (IP6_EQ(&is1->is_src, &is2->is_dst) && 1163 IP6_EQ(&is1->is_dst, &is2->is_src)) { 1164 /* force strong match for ICMPv6 protocol */ 1165 rv = (is1->is_p == IPPROTO_ICMPV6) ? 2 : 1; 1166 } 1167 else 1168 rv = 0; 1169 1170 return (rv); 1171 } 1172 1173 1174 /* ------------------------------------------------------------------------ */ 1175 /* Function: ipf_state_matchaddresses */ 1176 /* Returns: int - 2 addresses match, 1 reverse match, zero no match */ 1177 /* Parameters: is1, is2 pointers to states we are checking */ 1178 /* */ 1179 /* function retruns true if two pairs of addresses belong to single */ 1180 /* connection. suppose there are two endpoints: */ 1181 /* endpoint1 1.1.1.1 */ 1182 /* endpoint2 1.1.1.2 */ 1183 /* */ 1184 /* the state is established by packet flying from .1 to .2 so we see: */ 1185 /* is1->src = 1.1.1.1 */ 1186 /* is1->dst = 1.1.1.2 */ 1187 /* now endpoint 1.1.1.2 sends answer */ 1188 /* retreives is1 record created by first packat and compares it with is2 */ 1189 /* temporal record, is2 is initialized as follows: */ 1190 /* is2->src = 1.1.1.2 */ 1191 /* is2->dst = 1.1.1.1 */ 1192 /* in this case 1 will be returned */ 1193 /* */ 1194 /* the ipf_matchaddresses() assumes those two records to be same. of course */ 1195 /* the ipf_matchaddresses() also assume records are same in case you pass */ 1196 /* identical arguments (i.e. ipf_matchaddress(is1, is1) would return 2 */ 1197 /* ------------------------------------------------------------------------ */ 1198 static int 1199 ipf_state_matchaddresses(ipstate_t *is1, ipstate_t *is2) 1200 { 1201 int rv; 1202 1203 if (is1->is_v == 4) { 1204 rv = ipf_state_matchipv4addrs(is1, is2); 1205 } 1206 else { 1207 rv = ipf_state_matchipv6addrs(is1, is2); 1208 } 1209 1210 return (rv); 1211 } 1212 1213 1214 /* ------------------------------------------------------------------------ */ 1215 /* Function: ipf_matchports */ 1216 /* Returns: int - 2 match, 1 rverse match, 0 no match */ 1217 /* Parameters: ppairs1, ppairs - src, dst ports we want to match */ 1218 /* */ 1219 /* performs the same match for isps members as for addresses */ 1220 /* ------------------------------------------------------------------------ */ 1221 static int 1222 ipf_state_matchports(udpinfo_t *ppairs1, udpinfo_t *ppairs2) 1223 { 1224 int rv; 1225 1226 if (ppairs1->us_sport == ppairs2->us_sport && 1227 ppairs1->us_dport == ppairs2->us_dport) 1228 rv = 2; 1229 else if (ppairs1->us_sport == ppairs2->us_dport && 1230 ppairs1->us_dport == ppairs2->us_sport) 1231 rv = 1; 1232 else 1233 rv = 0; 1234 1235 return (rv); 1236 } 1237 1238 1239 /* ------------------------------------------------------------------------ */ 1240 /* Function: ipf_matchisps */ 1241 /* Returns: int - nonzero if isps members match, 0 nomatch */ 1242 /* Parameters: is1, is2 - states we want to match */ 1243 /* */ 1244 /* performs the same match for isps members as for addresses */ 1245 /* ------------------------------------------------------------------------ */ 1246 static int 1247 ipf_state_matchisps(ipstate_t *is1, ipstate_t *is2) 1248 { 1249 int rv; 1250 1251 if (is1->is_p == is2->is_p) { 1252 switch (is1->is_p) 1253 { 1254 case IPPROTO_TCP : 1255 case IPPROTO_UDP : 1256 case IPPROTO_GRE : 1257 /* greinfo_t can be also interpreted as port pair */ 1258 rv = ipf_state_matchports(&is1->is_ps.is_us, 1259 &is2->is_ps.is_us); 1260 break; 1261 1262 case IPPROTO_ICMP : 1263 case IPPROTO_ICMPV6 : 1264 /* force strong match for ICMP datagram. */ 1265 if (bcmp(&is1->is_ps, &is2->is_ps, 1266 sizeof(icmpinfo_t)) == 0) { 1267 rv = 2; 1268 } else { 1269 rv = 0; 1270 } 1271 break; 1272 1273 default: 1274 rv = 0; 1275 } 1276 } else { 1277 rv = 0; 1278 } 1279 1280 return (rv); 1281 } 1282 1283 1284 /* ------------------------------------------------------------------------ */ 1285 /* Function: ipf_state_match */ 1286 /* Returns: int - nonzero match, zero no match */ 1287 /* Parameters: is1, is2 - states we want to match */ 1288 /* */ 1289 /* ------------------------------------------------------------------------ */ 1290 static int 1291 ipf_state_match(ipstate_t *is1, ipstate_t *is2) 1292 { 1293 int rv; 1294 int amatch; 1295 int pomatch; 1296 1297 if (bcmp(&is1->is_pass, &is2->is_pass, 1298 offsetof(struct ipstate, is_authmsk) - 1299 offsetof(struct ipstate, is_pass)) == 0) { 1300 1301 pomatch = ipf_state_matchisps(is1, is2); 1302 amatch = ipf_state_matchaddresses(is1, is2); 1303 rv = (amatch != 0) && (amatch == pomatch); 1304 } else { 1305 rv = 0; 1306 } 1307 1308 return (rv); 1309 } 1310 1311 /* ------------------------------------------------------------------------ */ 1312 /* Function: ipf_state_add */ 1313 /* Returns: ipstate_t - 0 = success */ 1314 /* Parameters: softc(I) - pointer to soft context main structure */ 1315 /* fin(I) - pointer to packet information */ 1316 /* stsave(O) - pointer to place to save pointer to created */ 1317 /* state structure. */ 1318 /* flags(I) - flags to use when creating the structure */ 1319 /* */ 1320 /* Creates a new IP state structure from the packet information collected. */ 1321 /* Inserts it into the state table and appends to the bottom of the active */ 1322 /* list. If the capacity of the table has reached the maximum allowed then */ 1323 /* the call will fail and a flush is scheduled for the next timeout call. */ 1324 /* */ 1325 /* NOTE: The use of stsave to point to nat_state will result in memory */ 1326 /* corruption. It should only be used to point to objects that will */ 1327 /* either outlive this (not expired) or will deref the ip_state_t */ 1328 /* when they are deleted. */ 1329 /* ------------------------------------------------------------------------ */ 1330 int 1331 ipf_state_add(ipf_main_softc_t *softc, fr_info_t *fin, ipstate_t **stsave, 1332 u_int flags) 1333 { 1334 ipf_state_softc_t *softs = softc->ipf_state_soft; 1335 ipstate_t *is, ips; 1336 struct icmp *ic; 1337 u_int pass, hv; 1338 frentry_t *fr; 1339 tcphdr_t *tcp; 1340 frdest_t *fdp; 1341 int out; 1342 1343 /* 1344 * If a locally created packet is trying to egress but it 1345 * does not match because of this lock, it is likely that 1346 * the policy will block it and return network unreachable further 1347 * up the stack. To mitigate this error, EAGAIN is returned instead, 1348 * telling the IP stack to try sending this packet again later. 1349 */ 1350 if (softs->ipf_state_lock) { 1351 SBUMPD(ipf_state_stats, iss_add_locked); 1352 fin->fin_error = EAGAIN; 1353 return (-1); 1354 } 1355 1356 if (fin->fin_flx & (FI_SHORT|FI_STATE|FI_FRAGBODY|FI_BAD)) { 1357 SBUMPD(ipf_state_stats, iss_add_bad); 1358 return (-1); 1359 } 1360 1361 if ((fin->fin_flx & FI_OOW) && !(fin->fin_tcpf & TH_SYN)) { 1362 SBUMPD(ipf_state_stats, iss_add_oow); 1363 return (-1); 1364 } 1365 1366 if ((softs->ipf_state_stats.iss_active * 100 / softs->ipf_state_max) > 1367 softs->ipf_state_wm_high) { 1368 softs->ipf_state_doflush = 1; 1369 } 1370 1371 /* 1372 * If a "keep state" rule has reached the maximum number of references 1373 * to it, then schedule an automatic flush in case we can clear out 1374 * some "dead old wood". Note that because the lock isn't held on 1375 * fr it is possible that we could overflow. The cost of overflowing 1376 * is being ignored here as the number by which it can overflow is 1377 * a product of the number of simultaneous threads that could be 1378 * executing in here, so a limit of 100 won't result in 200, but could 1379 * result in 101 or 102. 1380 */ 1381 fr = fin->fin_fr; 1382 if (fr != NULL) { 1383 if ((softs->ipf_state_stats.iss_active >= 1384 softs->ipf_state_max) && (fr->fr_statemax == 0)) { 1385 SBUMPD(ipf_state_stats, iss_max); 1386 return (1); 1387 } 1388 if ((fr->fr_statemax != 0) && 1389 (fr->fr_statecnt >= fr->fr_statemax)) { 1390 SBUMPD(ipf_state_stats, iss_max_ref); 1391 return (2); 1392 } 1393 } 1394 1395 is = &ips; 1396 if (fr == NULL) { 1397 pass = softc->ipf_flags; 1398 is->is_tag = FR_NOLOGTAG; 1399 } else { 1400 pass = fr->fr_flags; 1401 } 1402 1403 ic = NULL; 1404 tcp = NULL; 1405 out = fin->fin_out; 1406 bzero((char *)is, sizeof(*is)); 1407 is->is_die = 1 + softc->ipf_ticks; 1408 /* 1409 * We want to check everything that is a property of this packet, 1410 * but we don't (automatically) care about its fragment status as 1411 * this may change. 1412 */ 1413 is->is_pass = pass; 1414 is->is_v = fin->fin_v; 1415 is->is_sec = fin->fin_secmsk; 1416 is->is_secmsk = 0xffff; 1417 is->is_auth = fin->fin_auth; 1418 is->is_authmsk = 0xffff; 1419 is->is_family = fin->fin_family; 1420 is->is_opt[0] = fin->fin_optmsk; 1421 is->is_optmsk[0] = 0xffffffff; 1422 if (is->is_v == 6) { 1423 is->is_opt[0] &= ~0x8; 1424 is->is_optmsk[0] &= ~0x8; 1425 } 1426 1427 /* 1428 * Copy and calculate... 1429 */ 1430 hv = (is->is_p = fin->fin_fi.fi_p); 1431 is->is_src = fin->fin_fi.fi_src; 1432 hv += is->is_saddr; 1433 is->is_dst = fin->fin_fi.fi_dst; 1434 hv += is->is_daddr; 1435 #ifdef USE_INET6 1436 if (fin->fin_v == 6) { 1437 /* 1438 * For ICMPv6, we check to see if the destination address is 1439 * a multicast address. If it is, do not include it in the 1440 * calculation of the hash because the correct reply will come 1441 * back from a real address, not a multicast address. 1442 */ 1443 if ((is->is_p == IPPROTO_ICMPV6) && 1444 IN6_IS_ADDR_MULTICAST(&is->is_dst.in6)) { 1445 /* 1446 * So you can do keep state with neighbour discovery. 1447 * 1448 * Here we could use the address from the neighbour 1449 * solicit message to put in the state structure and 1450 * we could use that without a wildcard flag too... 1451 */ 1452 flags |= SI_W_DADDR; 1453 hv -= is->is_daddr; 1454 } else { 1455 hv += is->is_dst.i6[1]; 1456 hv += is->is_dst.i6[2]; 1457 hv += is->is_dst.i6[3]; 1458 } 1459 hv += is->is_src.i6[1]; 1460 hv += is->is_src.i6[2]; 1461 hv += is->is_src.i6[3]; 1462 } 1463 #endif 1464 if ((fin->fin_v == 4) && 1465 (fin->fin_flx & (FI_MULTICAST|FI_BROADCAST|FI_MBCAST))) { 1466 flags |= SI_W_DADDR; 1467 hv -= is->is_daddr; 1468 } 1469 1470 switch (is->is_p) 1471 { 1472 #ifdef USE_INET6 1473 case IPPROTO_ICMPV6 : 1474 ic = fin->fin_dp; 1475 1476 switch (ic->icmp_type) 1477 { 1478 case ICMP6_ECHO_REQUEST : 1479 hv += (is->is_icmp.ici_id = ic->icmp_id); 1480 /*FALLTHROUGH*/ 1481 case ICMP6_MEMBERSHIP_QUERY : 1482 case ND_ROUTER_SOLICIT : 1483 case ND_NEIGHBOR_SOLICIT : 1484 case ICMP6_NI_QUERY : 1485 is->is_icmp.ici_type = ic->icmp_type; 1486 break; 1487 default : 1488 SBUMPD(ipf_state_stats, iss_icmp6_notquery); 1489 return (-2); 1490 } 1491 break; 1492 #endif 1493 case IPPROTO_ICMP : 1494 ic = fin->fin_dp; 1495 1496 switch (ic->icmp_type) 1497 { 1498 case ICMP_ECHO : 1499 case ICMP_TSTAMP : 1500 case ICMP_IREQ : 1501 case ICMP_MASKREQ : 1502 is->is_icmp.ici_type = ic->icmp_type; 1503 hv += (is->is_icmp.ici_id = ic->icmp_id); 1504 break; 1505 default : 1506 SBUMPD(ipf_state_stats, iss_icmp_notquery); 1507 return (-3); 1508 } 1509 break; 1510 1511 #if 0 1512 case IPPROTO_GRE : 1513 gre = fin->fin_dp; 1514 1515 is->is_gre.gs_flags = gre->gr_flags; 1516 is->is_gre.gs_ptype = gre->gr_ptype; 1517 if (GRE_REV(is->is_gre.gs_flags) == 1) { 1518 is->is_call[0] = fin->fin_data[0]; 1519 is->is_call[1] = fin->fin_data[1]; 1520 } 1521 break; 1522 #endif 1523 1524 case IPPROTO_TCP : 1525 tcp = fin->fin_dp; 1526 1527 if (tcp->th_flags & TH_RST) { 1528 SBUMPD(ipf_state_stats, iss_tcp_rstadd); 1529 return (-4); 1530 } 1531 1532 /* TRACE is, flags, hv */ 1533 1534 /* 1535 * The endian of the ports doesn't matter, but the ack and 1536 * sequence numbers do as we do mathematics on them later. 1537 */ 1538 is->is_sport = htons(fin->fin_data[0]); 1539 is->is_dport = htons(fin->fin_data[1]); 1540 if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) { 1541 hv += is->is_sport; 1542 hv += is->is_dport; 1543 } 1544 1545 /* TRACE is, flags, hv */ 1546 1547 /* 1548 * If this is a real packet then initialise fields in the 1549 * state information structure from the TCP header information. 1550 */ 1551 1552 is->is_maxdwin = 1; 1553 is->is_maxswin = ntohs(tcp->th_win); 1554 if (is->is_maxswin == 0) 1555 is->is_maxswin = 1; 1556 1557 if ((fin->fin_flx & FI_IGNORE) == 0) { 1558 is->is_send = ntohl(tcp->th_seq) + fin->fin_dlen - 1559 (TCP_OFF(tcp) << 2) + 1560 ((tcp->th_flags & TH_SYN) ? 1 : 0) + 1561 ((tcp->th_flags & TH_FIN) ? 1 : 0); 1562 is->is_maxsend = is->is_send; 1563 1564 /* 1565 * Window scale option is only present in 1566 * SYN/SYN-ACK packet. 1567 */ 1568 if ((tcp->th_flags & ~(TH_FIN|TH_ACK|TH_ECNALL)) == 1569 TH_SYN && 1570 (TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) { 1571 if (ipf_tcpoptions(softs, fin, tcp, 1572 &is->is_tcp.ts_data[0]) == -1) { 1573 fin->fin_flx |= FI_BAD; 1574 DT1(ipf_fi_bad_tcpoptions_th_fin_ack_ecnall, fr_info_t *, fin); 1575 } 1576 } 1577 1578 if ((fin->fin_out != 0) && (pass & FR_NEWISN) != 0) { 1579 ipf_checknewisn(fin, is); 1580 ipf_fixoutisn(fin, is); 1581 } 1582 1583 if ((tcp->th_flags & TH_OPENING) == TH_SYN) 1584 flags |= IS_TCPFSM; 1585 else { 1586 is->is_maxdwin = is->is_maxswin * 2; 1587 is->is_dend = ntohl(tcp->th_ack); 1588 is->is_maxdend = ntohl(tcp->th_ack); 1589 is->is_maxdwin *= 2; 1590 } 1591 } 1592 1593 /* 1594 * If we're creating state for a starting connection, start 1595 * the timer on it as we'll never see an error if it fails 1596 * to connect. 1597 */ 1598 break; 1599 1600 case IPPROTO_UDP : 1601 tcp = fin->fin_dp; 1602 1603 is->is_sport = htons(fin->fin_data[0]); 1604 is->is_dport = htons(fin->fin_data[1]); 1605 if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) { 1606 hv += tcp->th_dport; 1607 hv += tcp->th_sport; 1608 } 1609 break; 1610 1611 default : 1612 break; 1613 } 1614 hv = DOUBLE_HASH(hv); 1615 is->is_hv = hv; 1616 1617 /* 1618 * Look for identical state. 1619 */ 1620 for (is = softs->ipf_state_table[hv % softs->ipf_state_size]; 1621 is != NULL; is = is->is_hnext) { 1622 if (ipf_state_match(&ips, is) == 1) 1623 break; 1624 } 1625 if (is != NULL) { 1626 SBUMPD(ipf_state_stats, iss_add_dup); 1627 return (3); 1628 } 1629 1630 if (softs->ipf_state_stats.iss_bucketlen[hv] >= 1631 softs->ipf_state_maxbucket) { 1632 SBUMPD(ipf_state_stats, iss_bucket_full); 1633 return (4); 1634 } 1635 1636 /* 1637 * No existing state; create new 1638 */ 1639 KMALLOC(is, ipstate_t *); 1640 if (is == NULL) { 1641 SBUMPD(ipf_state_stats, iss_nomem); 1642 return (5); 1643 } 1644 bcopy((char *)&ips, (char *)is, sizeof(*is)); 1645 is->is_flags = flags & IS_INHERITED; 1646 is->is_rulen = fin->fin_rule; 1647 is->is_rule = fr; 1648 1649 /* 1650 * Do not do the modulus here, it is done in ipf_state_insert(). 1651 */ 1652 if (fr != NULL) { 1653 ipftq_t *tq; 1654 1655 (void) strncpy(is->is_group, FR_NAME(fr, fr_group), 1656 FR_GROUPLEN); 1657 if (fr->fr_age[0] != 0) { 1658 tq = ipf_addtimeoutqueue(softc, 1659 &softs->ipf_state_usertq, 1660 fr->fr_age[0]); 1661 is->is_tqehead[0] = tq; 1662 is->is_sti.tqe_flags |= TQE_RULEBASED; 1663 } 1664 if (fr->fr_age[1] != 0) { 1665 tq = ipf_addtimeoutqueue(softc, 1666 &softs->ipf_state_usertq, 1667 fr->fr_age[1]); 1668 is->is_tqehead[1] = tq; 1669 is->is_sti.tqe_flags |= TQE_RULEBASED; 1670 } 1671 1672 is->is_tag = fr->fr_logtag; 1673 } 1674 1675 /* 1676 * It may seem strange to set is_ref to 2, but if stsave is not NULL 1677 * then a copy of the pointer is being stored somewhere else and in 1678 * the end, it will expect to be able to do something with it. 1679 */ 1680 is->is_me = stsave; 1681 if (stsave != NULL) { 1682 *stsave = is; 1683 is->is_ref = 2; 1684 } else { 1685 is->is_ref = 1; 1686 } 1687 is->is_pkts[0] = 0, is->is_bytes[0] = 0; 1688 is->is_pkts[1] = 0, is->is_bytes[1] = 0; 1689 is->is_pkts[2] = 0, is->is_bytes[2] = 0; 1690 is->is_pkts[3] = 0, is->is_bytes[3] = 0; 1691 if ((fin->fin_flx & FI_IGNORE) == 0) { 1692 is->is_pkts[out] = 1; 1693 fin->fin_pktnum = 1; 1694 is->is_bytes[out] = fin->fin_plen; 1695 is->is_flx[out][0] = fin->fin_flx & FI_CMP; 1696 is->is_flx[out][0] &= ~FI_OOW; 1697 } 1698 1699 if (pass & FR_STLOOSE) 1700 is->is_flags |= IS_LOOSE; 1701 1702 if (pass & FR_STSTRICT) 1703 is->is_flags |= IS_STRICT; 1704 1705 if (pass & FR_STATESYNC) 1706 is->is_flags |= IS_STATESYNC; 1707 1708 if (pass & FR_LOGFIRST) 1709 is->is_pass &= ~(FR_LOGFIRST|FR_LOG); 1710 1711 READ_ENTER(&softc->ipf_state); 1712 1713 if (ipf_state_insert(softc, is, fin->fin_rev) == -1) { 1714 RWLOCK_EXIT(&softc->ipf_state); 1715 /* 1716 * This is a bit more manual than it should be but 1717 * ipf_state_del cannot be called. 1718 */ 1719 MUTEX_EXIT(&is->is_lock); 1720 MUTEX_DESTROY(&is->is_lock); 1721 if (is->is_tqehead[0] != NULL) { 1722 if (ipf_deletetimeoutqueue(is->is_tqehead[0]) == 0) 1723 ipf_freetimeoutqueue(softc, is->is_tqehead[0]); 1724 is->is_tqehead[0] = NULL; 1725 } 1726 if (is->is_tqehead[1] != NULL) { 1727 if (ipf_deletetimeoutqueue(is->is_tqehead[1]) == 0) 1728 ipf_freetimeoutqueue(softc, is->is_tqehead[1]); 1729 is->is_tqehead[1] = NULL; 1730 } 1731 KFREE(is); 1732 return (-1); 1733 } 1734 1735 /* 1736 * Filling in the interface name is after the insert so that an 1737 * event (such as add/delete) of an interface that is referenced 1738 * by this rule will see this state entry. 1739 */ 1740 if (fr != NULL) { 1741 /* 1742 * The name '-' is special for network interfaces and causes 1743 * a NULL name to be present, always, allowing packets to 1744 * match it, regardless of their interface. 1745 */ 1746 if ((fin->fin_ifp == NULL) || 1747 (fr->fr_ifnames[out << 1] != -1 && 1748 fr->fr_names[fr->fr_ifnames[out << 1] + 0] == '-' && 1749 fr->fr_names[fr->fr_ifnames[out << 1] + 1] == '\0')) { 1750 is->is_ifp[out << 1] = fr->fr_ifas[0]; 1751 strncpy(is->is_ifname[out << 1], 1752 FR_NAME(fr, fr_ifnames[0]), 1753 sizeof(fr->fr_ifnames[0])); 1754 } else { 1755 is->is_ifp[out << 1] = fin->fin_ifp; 1756 COPYIFNAME(fin->fin_v, fin->fin_ifp, 1757 is->is_ifname[out << 1]); 1758 } 1759 1760 is->is_ifp[(out << 1) + 1] = fr->fr_ifas[1]; 1761 if (fr->fr_ifnames[1] != -1) { 1762 strncpy(is->is_ifname[(out << 1) + 1], 1763 FR_NAME(fr, fr_ifnames[1]), 1764 sizeof(fr->fr_ifnames[1])); 1765 } 1766 1767 is->is_ifp[(1 - out) << 1] = fr->fr_ifas[2]; 1768 if (fr->fr_ifnames[2] != -1) { 1769 strncpy(is->is_ifname[((1 - out) << 1)], 1770 FR_NAME(fr, fr_ifnames[2]), 1771 sizeof(fr->fr_ifnames[2])); 1772 } 1773 1774 is->is_ifp[((1 - out) << 1) + 1] = fr->fr_ifas[3]; 1775 if (fr->fr_ifnames[3] != -1) { 1776 strncpy(is->is_ifname[((1 - out) << 1) + 1], 1777 FR_NAME(fr, fr_ifnames[3]), 1778 sizeof(fr->fr_ifnames[3])); 1779 } 1780 } else { 1781 if (fin->fin_ifp != NULL) { 1782 is->is_ifp[out << 1] = fin->fin_ifp; 1783 COPYIFNAME(fin->fin_v, fin->fin_ifp, 1784 is->is_ifname[out << 1]); 1785 } 1786 } 1787 1788 if (fin->fin_p == IPPROTO_TCP) { 1789 /* 1790 * If we're creating state for a starting connection, start the 1791 * timer on it as we'll never see an error if it fails to 1792 * connect. 1793 */ 1794 (void) ipf_tcp_age(&is->is_sti, fin, softs->ipf_state_tcptq, 1795 is->is_flags, 2); 1796 } 1797 MUTEX_EXIT(&is->is_lock); 1798 if ((is->is_flags & IS_STATESYNC) && ((is->is_flags & SI_CLONE) == 0)) 1799 is->is_sync = ipf_sync_new(softc, SMC_STATE, fin, is); 1800 if (softs->ipf_state_logging) 1801 ipf_state_log(softc, is, ISL_NEW); 1802 1803 RWLOCK_EXIT(&softc->ipf_state); 1804 1805 fin->fin_flx |= FI_STATE; 1806 if (fin->fin_flx & FI_FRAG) 1807 (void) ipf_frag_new(softc, fin, pass); 1808 1809 fdp = &fr->fr_tifs[0]; 1810 if (fdp->fd_type == FRD_DSTLIST) { 1811 ipf_dstlist_select_node(fin, fdp->fd_ptr, NULL, 1812 &is->is_tifs[0]); 1813 } else { 1814 bcopy(fdp, &is->is_tifs[0], sizeof(*fdp)); 1815 } 1816 1817 fdp = &fr->fr_tifs[1]; 1818 if (fdp->fd_type == FRD_DSTLIST) { 1819 ipf_dstlist_select_node(fin, fdp->fd_ptr, NULL, 1820 &is->is_tifs[1]); 1821 } else { 1822 bcopy(fdp, &is->is_tifs[1], sizeof(*fdp)); 1823 } 1824 fin->fin_tif = &is->is_tifs[fin->fin_rev]; 1825 1826 fdp = &fr->fr_dif; 1827 if (fdp->fd_type == FRD_DSTLIST) { 1828 ipf_dstlist_select_node(fin, fdp->fd_ptr, NULL, 1829 &is->is_dif); 1830 } else { 1831 bcopy(fdp, &is->is_dif, sizeof(*fdp)); 1832 } 1833 fin->fin_dif = &is->is_dif; 1834 1835 return (0); 1836 } 1837 1838 1839 /* ------------------------------------------------------------------------ */ 1840 /* Function: ipf_tcpoptions */ 1841 /* Returns: int - 1 == packet matches state entry, 0 == it does not, */ 1842 /* -1 == packet has bad TCP options data */ 1843 /* Parameters: softs(I) - pointer to state context structure */ 1844 /* fin(I) - pointer to packet information */ 1845 /* tcp(I) - pointer to TCP packet header */ 1846 /* td(I) - pointer to TCP data held as part of the state */ 1847 /* */ 1848 /* Look after the TCP header for any options and deal with those that are */ 1849 /* present. Record details about those that we recogise. */ 1850 /* ------------------------------------------------------------------------ */ 1851 static int 1852 ipf_tcpoptions(ipf_state_softc_t *softs, fr_info_t *fin, tcphdr_t *tcp, 1853 tcpdata_t *td) 1854 { 1855 int off, mlen, ol, i, len, retval; 1856 char buf[64], *s, opt; 1857 mb_t *m = NULL; 1858 1859 len = (TCP_OFF(tcp) << 2); 1860 if (fin->fin_dlen < len) { 1861 SBUMPD(ipf_state_stats, iss_tcp_toosmall); 1862 return (0); 1863 } 1864 len -= sizeof(*tcp); 1865 1866 off = fin->fin_plen - fin->fin_dlen + sizeof(*tcp) + fin->fin_ipoff; 1867 1868 m = fin->fin_m; 1869 mlen = MSGDSIZE(m) - off; 1870 if (len > mlen) { 1871 len = mlen; 1872 retval = 0; 1873 } else { 1874 retval = 1; 1875 } 1876 1877 COPYDATA(m, off, len, buf); 1878 1879 for (s = buf; len > 0; ) { 1880 opt = *s; 1881 if (opt == TCPOPT_EOL) 1882 break; 1883 else if (opt == TCPOPT_NOP) 1884 ol = 1; 1885 else { 1886 if (len < 2) 1887 break; 1888 ol = (int)*(s + 1); 1889 if (ol < 2 || ol > len) 1890 break; 1891 1892 /* 1893 * Extract the TCP options we are interested in out of 1894 * the header and store them in the tcpdata struct. 1895 */ 1896 switch (opt) 1897 { 1898 case TCPOPT_WINDOW : 1899 if (ol == TCPOLEN_WINDOW) { 1900 i = (int)*(s + 2); 1901 if (i > TCP_WSCALE_MAX) 1902 i = TCP_WSCALE_MAX; 1903 else if (i < 0) 1904 i = 0; 1905 td->td_winscale = i; 1906 td->td_winflags |= TCP_WSCALE_SEEN| 1907 TCP_WSCALE_FIRST; 1908 } else 1909 retval = -1; 1910 break; 1911 case TCPOPT_MAXSEG : 1912 /* 1913 * So, if we wanted to set the TCP MAXSEG, 1914 * it should be done here... 1915 */ 1916 if (ol == TCPOLEN_MAXSEG) { 1917 i = (int)*(s + 2); 1918 i <<= 8; 1919 i += (int)*(s + 3); 1920 td->td_maxseg = i; 1921 } else 1922 retval = -1; 1923 break; 1924 case TCPOPT_SACK_PERMITTED : 1925 if (ol == TCPOLEN_SACK_PERMITTED) 1926 td->td_winflags |= TCP_SACK_PERMIT; 1927 else 1928 retval = -1; 1929 break; 1930 } 1931 } 1932 len -= ol; 1933 s += ol; 1934 } 1935 if (retval == -1) { 1936 SBUMPD(ipf_state_stats, iss_tcp_badopt); 1937 } 1938 return (retval); 1939 } 1940 1941 1942 /* ------------------------------------------------------------------------ */ 1943 /* Function: ipf_state_tcp */ 1944 /* Returns: int - 1 == packet matches state entry, 0 == it does not */ 1945 /* Parameters: softc(I) - pointer to soft context main structure */ 1946 /* softs(I) - pointer to state context structure */ 1947 /* fin(I) - pointer to packet information */ 1948 /* tcp(I) - pointer to TCP packet header */ 1949 /* is(I) - pointer to master state structure */ 1950 /* */ 1951 /* Check to see if a packet with TCP headers fits within the TCP window. */ 1952 /* Change timeout depending on whether new packet is a SYN-ACK returning */ 1953 /* for a SYN or a RST or FIN which indicate time to close up shop. */ 1954 /* ------------------------------------------------------------------------ */ 1955 static int 1956 ipf_state_tcp(ipf_main_softc_t *softc, ipf_state_softc_t *softs, 1957 fr_info_t *fin, tcphdr_t *tcp, ipstate_t *is) 1958 { 1959 tcpdata_t *fdata, *tdata; 1960 int source, ret, flags; 1961 1962 source = !fin->fin_rev; 1963 if (((is->is_flags & IS_TCPFSM) != 0) && (source == 1) && 1964 (ntohs(is->is_sport) != fin->fin_data[0])) 1965 source = 0; 1966 fdata = &is->is_tcp.ts_data[!source]; 1967 tdata = &is->is_tcp.ts_data[source]; 1968 1969 MUTEX_ENTER(&is->is_lock); 1970 1971 /* 1972 * If a SYN packet is received for a connection that is on the way out 1973 * but hasn't yet departed then advance this session along the way. 1974 */ 1975 if ((tcp->th_flags & TH_OPENING) == TH_SYN) { 1976 if ((is->is_state[0] > IPF_TCPS_ESTABLISHED) && 1977 (is->is_state[1] > IPF_TCPS_ESTABLISHED)) { 1978 is->is_state[!source] = IPF_TCPS_CLOSED; 1979 ipf_movequeue(softc->ipf_ticks, &is->is_sti, 1980 is->is_sti.tqe_ifq, 1981 &softs->ipf_state_deletetq); 1982 MUTEX_EXIT(&is->is_lock); 1983 DT1(iss_tcp_closing, ipstate_t *, is); 1984 SBUMP(ipf_state_stats.iss_tcp_closing); 1985 return (0); 1986 } 1987 } 1988 1989 if (is->is_flags & IS_LOOSE) 1990 ret = 1; 1991 else 1992 ret = ipf_state_tcpinwindow(fin, fdata, tdata, tcp, 1993 is->is_flags); 1994 if (ret > 0) { 1995 /* 1996 * Nearing end of connection, start timeout. 1997 */ 1998 ret = ipf_tcp_age(&is->is_sti, fin, softs->ipf_state_tcptq, 1999 is->is_flags, ret); 2000 if (ret == 0) { 2001 MUTEX_EXIT(&is->is_lock); 2002 DT2(iss_tcp_fsm, fr_info_t *, fin, ipstate_t *, is); 2003 SBUMP(ipf_state_stats.iss_tcp_fsm); 2004 return (0); 2005 } 2006 2007 if (softs->ipf_state_logging > 4) 2008 ipf_state_log(softc, is, ISL_STATECHANGE); 2009 2010 /* 2011 * set s0's as appropriate. Use syn-ack packet as it 2012 * contains both pieces of required information. 2013 */ 2014 /* 2015 * Window scale option is only present in SYN/SYN-ACK packet. 2016 * Compare with ~TH_FIN to mask out T/TCP setups. 2017 */ 2018 flags = tcp->th_flags & ~(TH_FIN|TH_ECNALL); 2019 if (flags == (TH_SYN|TH_ACK)) { 2020 is->is_s0[source] = ntohl(tcp->th_ack); 2021 is->is_s0[!source] = ntohl(tcp->th_seq) + 1; 2022 if ((TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) { 2023 if (ipf_tcpoptions(softs, fin, tcp, 2024 fdata) == -1) { 2025 fin->fin_flx |= FI_BAD; 2026 DT1(ipf_fi_bad_winscale_syn_ack, fr_info_t *, fin); 2027 } 2028 } 2029 if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN)) 2030 ipf_checknewisn(fin, is); 2031 } else if (flags == TH_SYN) { 2032 is->is_s0[source] = ntohl(tcp->th_seq) + 1; 2033 if ((TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) { 2034 if (ipf_tcpoptions(softs, fin, tcp, 2035 fdata) == -1) { 2036 fin->fin_flx |= FI_BAD; 2037 DT1(ipf_fi_bad_winscale_syn, fr_info_t *, fin); 2038 } 2039 } 2040 2041 if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN)) 2042 ipf_checknewisn(fin, is); 2043 2044 } 2045 ret = 1; 2046 } else { 2047 DT2(iss_tcp_oow, fr_info_t *, fin, ipstate_t *, is); 2048 SBUMP(ipf_state_stats.iss_tcp_oow); 2049 ret = 0; 2050 } 2051 MUTEX_EXIT(&is->is_lock); 2052 return (ret); 2053 } 2054 2055 2056 /* ------------------------------------------------------------------------ */ 2057 /* Function: ipf_checknewisn */ 2058 /* Returns: Nil */ 2059 /* Parameters: fin(I) - pointer to packet information */ 2060 /* is(I) - pointer to master state structure */ 2061 /* */ 2062 /* Check to see if this TCP connection is expecting and needs a new */ 2063 /* sequence number for a particular direction of the connection. */ 2064 /* */ 2065 /* NOTE: This does not actually change the sequence numbers, only gets new */ 2066 /* one ready. */ 2067 /* ------------------------------------------------------------------------ */ 2068 static void 2069 ipf_checknewisn(fr_info_t *fin, ipstate_t *is) 2070 { 2071 u_32_t sumd, old, new; 2072 tcphdr_t *tcp; 2073 int i; 2074 2075 i = fin->fin_rev; 2076 tcp = fin->fin_dp; 2077 2078 if (((i == 0) && !(is->is_flags & IS_ISNSYN)) || 2079 ((i == 1) && !(is->is_flags & IS_ISNACK))) { 2080 old = ntohl(tcp->th_seq); 2081 new = ipf_newisn(fin); 2082 is->is_isninc[i] = new - old; 2083 CALC_SUMD(old, new, sumd); 2084 is->is_sumd[i] = (sumd & 0xffff) + (sumd >> 16); 2085 2086 is->is_flags |= ((i == 0) ? IS_ISNSYN : IS_ISNACK); 2087 } 2088 } 2089 2090 2091 /* ------------------------------------------------------------------------ */ 2092 /* Function: ipf_state_tcpinwindow */ 2093 /* Returns: int - 1 == packet inside TCP "window", 0 == not inside. */ 2094 /* Parameters: fin(I) - pointer to packet information */ 2095 /* fdata(I) - pointer to tcp state informatio (forward) */ 2096 /* tdata(I) - pointer to tcp state informatio (reverse) */ 2097 /* tcp(I) - pointer to TCP packet header */ 2098 /* */ 2099 /* Given a packet has matched addresses and ports, check to see if it is */ 2100 /* within the TCP data window. In a show of generosity, allow packets that */ 2101 /* are within the window space behind the current sequence # as well. */ 2102 /* ------------------------------------------------------------------------ */ 2103 static int 2104 ipf_state_tcpinwindow(fr_info_t *fin, tcpdata_t *fdata, tcpdata_t *tdata, 2105 tcphdr_t *tcp, int flags) 2106 { 2107 ipf_main_softc_t *softc = fin->fin_main_soft; 2108 ipf_state_softc_t *softs = softc->ipf_state_soft; 2109 tcp_seq seq, ack, end; 2110 int ackskew, tcpflags; 2111 u_32_t win, maxwin; 2112 int dsize, inseq; 2113 2114 /* 2115 * Find difference between last checked packet and this packet. 2116 */ 2117 tcpflags = tcp->th_flags; 2118 seq = ntohl(tcp->th_seq); 2119 ack = ntohl(tcp->th_ack); 2120 if (tcpflags & TH_SYN) 2121 win = ntohs(tcp->th_win); 2122 else 2123 win = ntohs(tcp->th_win) << fdata->td_winscale; 2124 2125 /* 2126 * A window of 0 produces undesirable behaviour from this function. 2127 */ 2128 if (win == 0) 2129 win = 1; 2130 2131 dsize = fin->fin_dlen - (TCP_OFF(tcp) << 2) + 2132 ((tcpflags & TH_SYN) ? 1 : 0) + ((tcpflags & TH_FIN) ? 1 : 0); 2133 2134 /* 2135 * if window scaling is present, the scaling is only allowed 2136 * for windows not in the first SYN packet. In that packet the 2137 * window is 65535 to specify the largest window possible 2138 * for receivers not implementing the window scale option. 2139 * Currently, we do not assume TTCP here. That means that 2140 * if we see a second packet from a host (after the initial 2141 * SYN), we can assume that the receiver of the SYN did 2142 * already send back the SYN/ACK (and thus that we know if 2143 * the receiver also does window scaling) 2144 */ 2145 if (!(tcpflags & TH_SYN) && (fdata->td_winflags & TCP_WSCALE_FIRST)) { 2146 fdata->td_winflags &= ~TCP_WSCALE_FIRST; 2147 fdata->td_maxwin = win; 2148 } 2149 2150 end = seq + dsize; 2151 2152 if ((fdata->td_end == 0) && 2153 (!(flags & IS_TCPFSM) || 2154 ((tcpflags & TH_OPENING) == TH_OPENING))) { 2155 /* 2156 * Must be a (outgoing) SYN-ACK in reply to a SYN. 2157 */ 2158 fdata->td_end = end - 1; 2159 fdata->td_maxwin = 1; 2160 fdata->td_maxend = end + win; 2161 } 2162 2163 if (!(tcpflags & TH_ACK)) { /* Pretend an ack was sent */ 2164 ack = tdata->td_end; 2165 } else if (((tcpflags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) && 2166 (ack == 0)) { 2167 /* gross hack to get around certain broken tcp stacks */ 2168 ack = tdata->td_end; 2169 } 2170 2171 maxwin = tdata->td_maxwin; 2172 ackskew = tdata->td_end - ack; 2173 2174 /* 2175 * Strict sequencing only allows in-order delivery. 2176 */ 2177 if ((flags & IS_STRICT) != 0) { 2178 if (seq != fdata->td_end) { 2179 DT2(iss_tcp_struct, tcpdata_t *, fdata, int, seq); 2180 SBUMP(ipf_state_stats.iss_tcp_strict); 2181 fin->fin_flx |= FI_OOW; 2182 return (0); 2183 } 2184 } 2185 2186 #define SEQ_GE(a,b) ((int)((a) - (b)) >= 0) 2187 #define SEQ_GT(a,b) ((int)((a) - (b)) > 0) 2188 inseq = 0; 2189 if ((SEQ_GE(fdata->td_maxend, end)) && 2190 (SEQ_GE(seq, fdata->td_end - maxwin)) && 2191 /* XXX what about big packets */ 2192 #define MAXACKWINDOW 66000 2193 (-ackskew <= (MAXACKWINDOW)) && 2194 ( ackskew <= (MAXACKWINDOW << fdata->td_winscale))) { 2195 inseq = 1; 2196 /* 2197 * Microsoft Windows will send the next packet to the right of the 2198 * window if SACK is in use. 2199 */ 2200 } else if ((seq == fdata->td_maxend) && (ackskew == 0) && 2201 (fdata->td_winflags & TCP_SACK_PERMIT) && 2202 (tdata->td_winflags & TCP_SACK_PERMIT)) { 2203 DT2(iss_sinsack, tcpdata_t *, fdata, int, seq); 2204 SBUMP(ipf_state_stats.iss_winsack); 2205 inseq = 1; 2206 /* 2207 * Sometimes a TCP RST will be generated with only the ACK field 2208 * set to non-zero. 2209 */ 2210 } else if ((seq == 0) && (tcpflags == (TH_RST|TH_ACK)) && 2211 (ackskew >= -1) && (ackskew <= 1)) { 2212 inseq = 1; 2213 } else if (!(flags & IS_TCPFSM)) { 2214 int i; 2215 2216 i = (fin->fin_rev << 1) + fin->fin_out; 2217 2218 #if 0 2219 if (is_pkts[i]0 == 0) { 2220 /* 2221 * Picking up a connection in the middle, the "next" 2222 * packet seen from a direction that is new should be 2223 * accepted, even if it appears out of sequence. 2224 */ 2225 inseq = 1; 2226 } else 2227 #endif 2228 if (!(fdata->td_winflags & 2229 (TCP_WSCALE_SEEN|TCP_WSCALE_FIRST))) { 2230 /* 2231 * No TCPFSM and no window scaling, so make some 2232 * extra guesses. 2233 */ 2234 if ((seq == fdata->td_maxend) && (ackskew == 0)) 2235 inseq = 1; 2236 else if (SEQ_GE(seq + maxwin, fdata->td_end - maxwin)) 2237 inseq = 1; 2238 } 2239 } 2240 2241 /* TRACE(inseq, fdata, tdata, seq, end, ack, ackskew, win, maxwin) */ 2242 2243 if (inseq) { 2244 /* if ackskew < 0 then this should be due to fragmented 2245 * packets. There is no way to know the length of the 2246 * total packet in advance. 2247 * We do know the total length from the fragment cache though. 2248 * Note however that there might be more sessions with 2249 * exactly the same source and destination parameters in the 2250 * state cache (and source and destination is the only stuff 2251 * that is saved in the fragment cache). Note further that 2252 * some TCP connections in the state cache are hashed with 2253 * sport and dport as well which makes it not worthwhile to 2254 * look for them. 2255 * Thus, when ackskew is negative but still seems to belong 2256 * to this session, we bump up the destinations end value. 2257 */ 2258 if (ackskew < 0) 2259 tdata->td_end = ack; 2260 2261 /* update max window seen */ 2262 if (fdata->td_maxwin < win) 2263 fdata->td_maxwin = win; 2264 if (SEQ_GT(end, fdata->td_end)) 2265 fdata->td_end = end; 2266 if (SEQ_GE(ack + win, tdata->td_maxend)) 2267 tdata->td_maxend = ack + win; 2268 return (1); 2269 } 2270 SBUMP(ipf_state_stats.iss_oow); 2271 fin->fin_flx |= FI_OOW; 2272 return (0); 2273 } 2274 2275 2276 /* ------------------------------------------------------------------------ */ 2277 /* Function: ipf_state_clone */ 2278 /* Returns: ipstate_t* - NULL == cloning failed, */ 2279 /* else pointer to new state structure */ 2280 /* Parameters: fin(I) - pointer to packet information */ 2281 /* tcp(I) - pointer to TCP/UDP header */ 2282 /* is(I) - pointer to master state structure */ 2283 /* */ 2284 /* Create a "duplcate" state table entry from the master. */ 2285 /* ------------------------------------------------------------------------ */ 2286 static ipstate_t * 2287 ipf_state_clone(fr_info_t *fin, tcphdr_t *tcp, ipstate_t *is) 2288 { 2289 ipf_main_softc_t *softc = fin->fin_main_soft; 2290 ipf_state_softc_t *softs = softc->ipf_state_soft; 2291 ipstate_t *clone; 2292 u_32_t send; 2293 2294 if (softs->ipf_state_stats.iss_active == softs->ipf_state_max) { 2295 SBUMPD(ipf_state_stats, iss_max); 2296 softs->ipf_state_doflush = 1; 2297 return (NULL); 2298 } 2299 KMALLOC(clone, ipstate_t *); 2300 if (clone == NULL) { 2301 SBUMPD(ipf_state_stats, iss_clone_nomem); 2302 return (NULL); 2303 } 2304 bcopy((char *)is, (char *)clone, sizeof(*clone)); 2305 2306 MUTEX_NUKE(&clone->is_lock); 2307 /* 2308 * It has not yet been placed on any timeout queue, so make sure 2309 * all of that data is zero'd out. 2310 */ 2311 clone->is_sti.tqe_pnext = NULL; 2312 clone->is_sti.tqe_next = NULL; 2313 clone->is_sti.tqe_ifq = NULL; 2314 clone->is_sti.tqe_parent = clone; 2315 2316 clone->is_die = ONE_DAY + softc->ipf_ticks; 2317 clone->is_state[0] = 0; 2318 clone->is_state[1] = 0; 2319 send = ntohl(tcp->th_seq) + fin->fin_dlen - (TCP_OFF(tcp) << 2) + 2320 ((tcp->th_flags & TH_SYN) ? 1 : 0) + 2321 ((tcp->th_flags & TH_FIN) ? 1 : 0); 2322 2323 if (fin->fin_rev == 1) { 2324 clone->is_dend = send; 2325 clone->is_maxdend = send; 2326 clone->is_send = 0; 2327 clone->is_maxswin = 1; 2328 clone->is_maxdwin = ntohs(tcp->th_win); 2329 if (clone->is_maxdwin == 0) 2330 clone->is_maxdwin = 1; 2331 } else { 2332 clone->is_send = send; 2333 clone->is_maxsend = send; 2334 clone->is_dend = 0; 2335 clone->is_maxdwin = 1; 2336 clone->is_maxswin = ntohs(tcp->th_win); 2337 if (clone->is_maxswin == 0) 2338 clone->is_maxswin = 1; 2339 } 2340 2341 clone->is_flags &= ~SI_CLONE; 2342 clone->is_flags |= SI_CLONED; 2343 if (ipf_state_insert(softc, clone, fin->fin_rev) == -1) { 2344 KFREE(clone); 2345 return (NULL); 2346 } 2347 2348 clone->is_ref = 1; 2349 if (clone->is_p == IPPROTO_TCP) { 2350 (void) ipf_tcp_age(&clone->is_sti, fin, softs->ipf_state_tcptq, 2351 clone->is_flags, 2); 2352 } 2353 MUTEX_EXIT(&clone->is_lock); 2354 if (is->is_flags & IS_STATESYNC) 2355 clone->is_sync = ipf_sync_new(softc, SMC_STATE, fin, clone); 2356 DT2(iss_clone, ipstate_t *, is, ipstate_t *, clone); 2357 SBUMP(ipf_state_stats.iss_cloned); 2358 return (clone); 2359 } 2360 2361 2362 /* ------------------------------------------------------------------------ */ 2363 /* Function: ipf_matchsrcdst */ 2364 /* Returns: Nil */ 2365 /* Parameters: fin(I) - pointer to packet information */ 2366 /* is(I) - pointer to state structure */ 2367 /* src(I) - pointer to source address */ 2368 /* dst(I) - pointer to destination address */ 2369 /* tcp(I) - pointer to TCP/UDP header */ 2370 /* cmask(I) - mask of FI_* bits to check */ 2371 /* */ 2372 /* Match a state table entry against an IP packet. The logic below is that */ 2373 /* ret gets set to one if the match succeeds, else remains 0. If it is */ 2374 /* still 0 after the test. no match. */ 2375 /* ------------------------------------------------------------------------ */ 2376 static ipstate_t * 2377 ipf_matchsrcdst(fr_info_t *fin, ipstate_t *is, i6addr_t *src, i6addr_t *dst, 2378 tcphdr_t *tcp, u_32_t cmask) 2379 { 2380 ipf_main_softc_t *softc = fin->fin_main_soft; 2381 ipf_state_softc_t *softs = softc->ipf_state_soft; 2382 int ret = 0, rev, out, flags, flx = 0, idx; 2383 u_short sp, dp; 2384 u_32_t cflx; 2385 void *ifp; 2386 2387 /* 2388 * If a connection is about to be deleted, no packets 2389 * are allowed to match it. 2390 */ 2391 if (is->is_sti.tqe_ifq == &softs->ipf_state_deletetq) 2392 return (NULL); 2393 2394 rev = IP6_NEQ(&is->is_dst, dst); 2395 ifp = fin->fin_ifp; 2396 out = fin->fin_out; 2397 flags = is->is_flags; 2398 sp = 0; 2399 dp = 0; 2400 2401 if (tcp != NULL) { 2402 sp = htons(fin->fin_sport); 2403 dp = ntohs(fin->fin_dport); 2404 } 2405 if (!rev) { 2406 if (tcp != NULL) { 2407 if (!(flags & SI_W_SPORT) && (sp != is->is_sport)) 2408 rev = 1; 2409 else if (!(flags & SI_W_DPORT) && (dp != is->is_dport)) 2410 rev = 1; 2411 } 2412 } 2413 2414 idx = (out << 1) + rev; 2415 2416 /* 2417 * If the interface for this 'direction' is set, make sure it matches. 2418 * An interface name that is not set matches any, as does a name of *. 2419 */ 2420 if ((is->is_ifp[idx] == ifp) || (is->is_ifp[idx] == NULL && 2421 (*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '-' || 2422 *is->is_ifname[idx] == '*'))) 2423 ret = 1; 2424 2425 if (ret == 0) { 2426 DT2(iss_lookup_badifp, fr_info_t *, fin, ipstate_t *, is); 2427 SBUMP(ipf_state_stats.iss_lookup_badifp); 2428 /* TRACE is, out, rev, idx */ 2429 return (NULL); 2430 } 2431 ret = 0; 2432 2433 /* 2434 * Match addresses and ports. 2435 */ 2436 if (rev == 0) { 2437 if ((IP6_EQ(&is->is_dst, dst) || (flags & SI_W_DADDR)) && 2438 (IP6_EQ(&is->is_src, src) || (flags & SI_W_SADDR))) { 2439 if (tcp) { 2440 if ((sp == is->is_sport || flags & SI_W_SPORT) 2441 && 2442 (dp == is->is_dport || flags & SI_W_DPORT)) 2443 ret = 1; 2444 } else { 2445 ret = 1; 2446 } 2447 } 2448 } else { 2449 if ((IP6_EQ(&is->is_dst, src) || (flags & SI_W_DADDR)) && 2450 (IP6_EQ(&is->is_src, dst) || (flags & SI_W_SADDR))) { 2451 if (tcp) { 2452 if ((dp == is->is_sport || flags & SI_W_SPORT) 2453 && 2454 (sp == is->is_dport || flags & SI_W_DPORT)) 2455 ret = 1; 2456 } else { 2457 ret = 1; 2458 } 2459 } 2460 } 2461 2462 if (ret == 0) { 2463 SBUMP(ipf_state_stats.iss_lookup_badport); 2464 DT2(iss_lookup_badport, fr_info_t *, fin, ipstate_t *, is); 2465 /* TRACE rev, is, sp, dp, src, dst */ 2466 return (NULL); 2467 } 2468 2469 /* 2470 * Whether or not this should be here, is questionable, but the aim 2471 * is to get this out of the main line. 2472 */ 2473 if (tcp == NULL) 2474 flags = is->is_flags & ~(SI_WILDP|SI_NEWFR|SI_CLONE|SI_CLONED); 2475 2476 /* 2477 * Only one of the source or destination address can be flaged as a 2478 * wildcard. Fill in the missing address, if set. 2479 * For IPv6, if the address being copied in is multicast, then 2480 * don't reset the wild flag - multicast causes it to be set in the 2481 * first place! 2482 */ 2483 if ((flags & (SI_W_SADDR|SI_W_DADDR))) { 2484 fr_ip_t *fi = &fin->fin_fi; 2485 2486 if ((flags & SI_W_SADDR) != 0) { 2487 if (rev == 0) { 2488 is->is_src = fi->fi_src; 2489 is->is_flags &= ~SI_W_SADDR; 2490 } else { 2491 if (!(fin->fin_flx & (FI_MULTICAST|FI_MBCAST))){ 2492 is->is_src = fi->fi_dst; 2493 is->is_flags &= ~SI_W_SADDR; 2494 } 2495 } 2496 } else if ((flags & SI_W_DADDR) != 0) { 2497 if (rev == 0) { 2498 if (!(fin->fin_flx & (FI_MULTICAST|FI_MBCAST))){ 2499 is->is_dst = fi->fi_dst; 2500 is->is_flags &= ~SI_W_DADDR; 2501 } 2502 } else { 2503 is->is_dst = fi->fi_src; 2504 is->is_flags &= ~SI_W_DADDR; 2505 } 2506 } 2507 if ((is->is_flags & (SI_WILDA|SI_WILDP)) == 0) { 2508 ATOMIC_DECL(softs->ipf_state_stats.iss_wild); 2509 } 2510 } 2511 2512 flx = fin->fin_flx & cmask; 2513 cflx = is->is_flx[out][rev]; 2514 2515 /* 2516 * Match up any flags set from IP options. 2517 */ 2518 if ((cflx && (flx != (cflx & cmask))) || 2519 ((fin->fin_optmsk & is->is_optmsk[rev]) != is->is_opt[rev]) || 2520 ((fin->fin_secmsk & is->is_secmsk) != is->is_sec) || 2521 ((fin->fin_auth & is->is_authmsk) != is->is_auth)) { 2522 SBUMPD(ipf_state_stats, iss_miss_mask); 2523 return (NULL); 2524 } 2525 2526 if ((fin->fin_flx & FI_IGNORE) != 0) { 2527 fin->fin_rev = rev; 2528 return (is); 2529 } 2530 2531 /* 2532 * Only one of the source or destination port can be flagged as a 2533 * wildcard. When filling it in, fill in a copy of the matched entry 2534 * if it has the cloning flag set. 2535 */ 2536 if ((flags & (SI_W_SPORT|SI_W_DPORT))) { 2537 if ((flags & SI_CLONE) != 0) { 2538 ipstate_t *clone; 2539 2540 clone = ipf_state_clone(fin, tcp, is); 2541 if (clone == NULL) 2542 return (NULL); 2543 is = clone; 2544 } else { 2545 ATOMIC_DECL(softs->ipf_state_stats.iss_wild); 2546 } 2547 2548 if ((flags & SI_W_SPORT) != 0) { 2549 if (rev == 0) { 2550 is->is_sport = sp; 2551 is->is_send = ntohl(tcp->th_seq); 2552 } else { 2553 is->is_sport = dp; 2554 is->is_send = ntohl(tcp->th_ack); 2555 } 2556 is->is_maxsend = is->is_send + 1; 2557 } else if ((flags & SI_W_DPORT) != 0) { 2558 if (rev == 0) { 2559 is->is_dport = dp; 2560 is->is_dend = ntohl(tcp->th_ack); 2561 } else { 2562 is->is_dport = sp; 2563 is->is_dend = ntohl(tcp->th_seq); 2564 } 2565 is->is_maxdend = is->is_dend + 1; 2566 } 2567 is->is_flags &= ~(SI_W_SPORT|SI_W_DPORT); 2568 if ((flags & SI_CLONED) && softs->ipf_state_logging) 2569 ipf_state_log(softc, is, ISL_CLONE); 2570 } 2571 2572 ret = -1; 2573 2574 if (is->is_flx[out][rev] == 0) { 2575 is->is_flx[out][rev] = flx; 2576 if (rev == 1 && is->is_optmsk[1] == 0) { 2577 is->is_opt[1] = fin->fin_optmsk; 2578 is->is_optmsk[1] = 0xffffffff; 2579 if (is->is_v == 6) { 2580 is->is_opt[1] &= ~0x8; 2581 is->is_optmsk[1] &= ~0x8; 2582 } 2583 } 2584 } 2585 2586 /* 2587 * Check if the interface name for this "direction" is set and if not, 2588 * fill it in. 2589 */ 2590 if (is->is_ifp[idx] == NULL && 2591 (*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '*')) { 2592 is->is_ifp[idx] = ifp; 2593 COPYIFNAME(fin->fin_v, ifp, is->is_ifname[idx]); 2594 } 2595 fin->fin_rev = rev; 2596 return (is); 2597 } 2598 2599 2600 /* ------------------------------------------------------------------------ */ 2601 /* Function: ipf_checkicmpmatchingstate */ 2602 /* Returns: Nil */ 2603 /* Parameters: fin(I) - pointer to packet information */ 2604 /* */ 2605 /* If we've got an ICMP error message, using the information stored in the */ 2606 /* ICMP packet, look for a matching state table entry. */ 2607 /* */ 2608 /* If we return NULL then no lock on ipf_state is held. */ 2609 /* If we return non-null then a read-lock on ipf_state is held. */ 2610 /* ------------------------------------------------------------------------ */ 2611 static ipstate_t * 2612 ipf_checkicmpmatchingstate(fr_info_t *fin) 2613 { 2614 ipf_main_softc_t *softc = fin->fin_main_soft; 2615 ipf_state_softc_t *softs = softc->ipf_state_soft; 2616 ipstate_t *is, **isp; 2617 i6addr_t dst, src; 2618 struct icmp *ic; 2619 u_short savelen; 2620 icmphdr_t *icmp; 2621 fr_info_t ofin; 2622 tcphdr_t *tcp; 2623 int type, len; 2624 u_char pr; 2625 ip_t *oip; 2626 u_int hv; 2627 2628 /* 2629 * Does it at least have the return (basic) IP header ? 2630 * Is it an actual recognised ICMP error type? 2631 * Only a basic IP header (no options) should be with 2632 * an ICMP error header. 2633 */ 2634 if ((fin->fin_v != 4) || (fin->fin_hlen != sizeof(ip_t)) || 2635 (fin->fin_plen < ICMPERR_MINPKTLEN) || 2636 !(fin->fin_flx & FI_ICMPERR)) { 2637 SBUMPD(ipf_state_stats, iss_icmp_bad); 2638 return (NULL); 2639 } 2640 ic = fin->fin_dp; 2641 type = ic->icmp_type; 2642 2643 oip = (ip_t *)((char *)ic + ICMPERR_ICMPHLEN); 2644 /* 2645 * Check if the at least the old IP header (with options) and 2646 * 8 bytes of payload is present. 2647 */ 2648 if (fin->fin_plen < ICMPERR_MAXPKTLEN + ((IP_HL(oip) - 5) << 2)) { 2649 SBUMPDX(ipf_state_stats, iss_icmp_short, iss_icmp_short_1); 2650 return (NULL); 2651 } 2652 2653 /* 2654 * Sanity Checks. 2655 */ 2656 len = fin->fin_dlen - ICMPERR_ICMPHLEN; 2657 if ((len <= 0) || ((IP_HL(oip) << 2) > len)) { 2658 DT2(iss_icmp_len, fr_info_t *, fin, struct ip*, oip); 2659 SBUMPDX(ipf_state_stats, iss_icmp_short, iss_icmp_short_1); 2660 return (NULL); 2661 } 2662 2663 /* 2664 * Is the buffer big enough for all of it ? It's the size of the IP 2665 * header claimed in the encapsulated part which is of concern. It 2666 * may be too big to be in this buffer but not so big that it's 2667 * outside the ICMP packet, leading to TCP deref's causing problems. 2668 * This is possible because we don't know how big oip_hl is when we 2669 * do the pullup early in ipf_check() and thus can't guarantee it is 2670 * all here now. 2671 */ 2672 #ifdef _KERNEL 2673 { 2674 mb_t *m; 2675 2676 m = fin->fin_m; 2677 # if SOLARIS 2678 if ((char *)oip + len > (char *)m->b_wptr) { 2679 SBUMPDX(ipf_state_stats, iss_icmp_short, iss_icmp_short_2); 2680 return (NULL); 2681 } 2682 # else 2683 if ((char *)oip + len > (char *)fin->fin_ip + m->m_len) { 2684 SBUMPDX(ipf_state_stats, iss_icmp_short, iss_icmp_short_3); 2685 return (NULL); 2686 } 2687 # endif 2688 } 2689 #endif 2690 2691 bcopy((char *)fin, (char *)&ofin, sizeof(*fin)); 2692 2693 /* 2694 * in the IPv4 case we must zero the i6addr union otherwise 2695 * the IP6_EQ and IP6_NEQ macros produce the wrong results because 2696 * of the 'junk' in the unused part of the union 2697 */ 2698 bzero((char *)&src, sizeof(src)); 2699 bzero((char *)&dst, sizeof(dst)); 2700 2701 /* 2702 * we make an fin entry to be able to feed it to 2703 * matchsrcdst note that not all fields are encessary 2704 * but this is the cleanest way. Note further we fill 2705 * in fin_mp such that if someone uses it we'll get 2706 * a kernel panic. ipf_matchsrcdst does not use this. 2707 * 2708 * watch out here, as ip is in host order and oip in network 2709 * order. Any change we make must be undone afterwards, like 2710 * oip->ip_len. 2711 */ 2712 savelen = oip->ip_len; 2713 oip->ip_len = htons(len); 2714 2715 ofin.fin_flx = FI_NOCKSUM; 2716 ofin.fin_v = 4; 2717 ofin.fin_ip = oip; 2718 ofin.fin_m = NULL; /* if dereferenced, panic XXX */ 2719 ofin.fin_mp = NULL; /* if dereferenced, panic XXX */ 2720 (void) ipf_makefrip(IP_HL(oip) << 2, oip, &ofin); 2721 ofin.fin_ifp = fin->fin_ifp; 2722 ofin.fin_out = !fin->fin_out; 2723 2724 hv = (pr = oip->ip_p); 2725 src.in4 = oip->ip_src; 2726 hv += src.in4.s_addr; 2727 dst.in4 = oip->ip_dst; 2728 hv += dst.in4.s_addr; 2729 2730 /* 2731 * Reset the short and bad flag here because in ipf_matchsrcdst() 2732 * the flags for the current packet (fin_flx) are compared against 2733 * those for the existing session. 2734 */ 2735 ofin.fin_flx &= ~(FI_BAD|FI_SHORT); 2736 2737 /* 2738 * Put old values of ip_len back as we don't know 2739 * if we have to forward the packet or process it again. 2740 */ 2741 oip->ip_len = savelen; 2742 2743 switch (oip->ip_p) 2744 { 2745 case IPPROTO_ICMP : 2746 /* 2747 * an ICMP error can only be generated as a result of an 2748 * ICMP query, not as the response on an ICMP error 2749 * 2750 * XXX theoretically ICMP_ECHOREP and the other reply's are 2751 * ICMP query's as well, but adding them here seems strange XXX 2752 */ 2753 if ((ofin.fin_flx & FI_ICMPERR) != 0) { 2754 DT1(iss_icmp_icmperr, fr_info_t *, &ofin); 2755 SBUMP(ipf_state_stats.iss_icmp_icmperr); 2756 return (NULL); 2757 } 2758 2759 /* 2760 * perform a lookup of the ICMP packet in the state table 2761 */ 2762 icmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 2763 hv += icmp->icmp_id; 2764 hv = DOUBLE_HASH(hv); 2765 2766 READ_ENTER(&softc->ipf_state); 2767 for (isp = &softs->ipf_state_table[hv]; 2768 ((is = *isp) != NULL); ) { 2769 isp = &is->is_hnext; 2770 if ((is->is_p != pr) || (is->is_v != 4)) 2771 continue; 2772 if (is->is_pass & FR_NOICMPERR) 2773 continue; 2774 2775 is = ipf_matchsrcdst(&ofin, is, &src, &dst, 2776 NULL, FI_ICMPCMP); 2777 if ((is != NULL) && !ipf_allowstateicmp(fin, is, &src)) 2778 return (is); 2779 } 2780 RWLOCK_EXIT(&softc->ipf_state); 2781 SBUMPDX(ipf_state_stats, iss_icmp_miss, iss_icmp_miss_1); 2782 return (NULL); 2783 case IPPROTO_TCP : 2784 case IPPROTO_UDP : 2785 break; 2786 default : 2787 SBUMPDX(ipf_state_stats, iss_icmp_miss, iss_icmp_miss_2); 2788 return (NULL); 2789 } 2790 2791 tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 2792 2793 hv += tcp->th_dport; 2794 hv += tcp->th_sport; 2795 hv = DOUBLE_HASH(hv); 2796 2797 READ_ENTER(&softc->ipf_state); 2798 for (isp = &softs->ipf_state_table[hv]; ((is = *isp) != NULL); ) { 2799 isp = &is->is_hnext; 2800 /* 2801 * Only allow this icmp though if the 2802 * encapsulated packet was allowed through the 2803 * other way around. Note that the minimal amount 2804 * of info present does not allow for checking against 2805 * tcp internals such as seq and ack numbers. Only the 2806 * ports are known to be present and can be even if the 2807 * short flag is set. 2808 */ 2809 if ((is->is_p == pr) && (is->is_v == 4) && 2810 (is = ipf_matchsrcdst(&ofin, is, &src, &dst, 2811 tcp, FI_ICMPCMP))) { 2812 if (ipf_allowstateicmp(fin, is, &src) == 0) 2813 return (is); 2814 } 2815 } 2816 RWLOCK_EXIT(&softc->ipf_state); 2817 SBUMPDX(ipf_state_stats, iss_icmp_miss, iss_icmp_miss_3); 2818 return (NULL); 2819 } 2820 2821 2822 /* ------------------------------------------------------------------------ */ 2823 /* Function: ipf_allowstateicmp */ 2824 /* Returns: int - 1 = packet denied, 0 = packet allowed */ 2825 /* Parameters: fin(I) - pointer to packet information */ 2826 /* is(I) - pointer to state table entry */ 2827 /* src(I) - source address to check permission for */ 2828 /* */ 2829 /* For an ICMP packet that has so far matched a state table entry, check if */ 2830 /* there are any further refinements that might mean we want to block this */ 2831 /* packet. This code isn't specific to either IPv4 or IPv6. */ 2832 /* ------------------------------------------------------------------------ */ 2833 static int 2834 ipf_allowstateicmp(fr_info_t *fin, ipstate_t *is, i6addr_t *src) 2835 { 2836 ipf_main_softc_t *softc = fin->fin_main_soft; 2837 ipf_state_softc_t *softs = softc->ipf_state_soft; 2838 frentry_t *savefr; 2839 frentry_t *fr; 2840 u_32_t ipass; 2841 int backward; 2842 int oi; 2843 int i; 2844 2845 fr = is->is_rule; 2846 if (fr != NULL && fr->fr_icmpgrp != NULL) { 2847 savefr = fin->fin_fr; 2848 fin->fin_fr = fr->fr_icmpgrp->fg_start; 2849 2850 ipass = ipf_scanlist(fin, softc->ipf_pass); 2851 fin->fin_fr = savefr; 2852 if (FR_ISBLOCK(ipass)) { 2853 SBUMPD(ipf_state_stats, iss_icmp_headblock); 2854 return (1); 2855 } 2856 } 2857 2858 /* 2859 * i : the index of this packet (the icmp unreachable) 2860 * oi : the index of the original packet found in the 2861 * icmp header (i.e. the packet causing this icmp) 2862 * backward : original packet was backward compared to 2863 * the state 2864 */ 2865 backward = IP6_NEQ(&is->is_src, src); 2866 fin->fin_rev = !backward; 2867 i = (!backward << 1) + fin->fin_out; 2868 oi = (backward << 1) + !fin->fin_out; 2869 2870 if (is->is_pass & FR_NOICMPERR) { 2871 SBUMPD(ipf_state_stats, iss_icmp_banned); 2872 return (1); 2873 } 2874 if (is->is_icmppkts[i] > is->is_pkts[oi]) { 2875 SBUMPD(ipf_state_stats, iss_icmp_toomany); 2876 return (1); 2877 } 2878 2879 DT2(iss_icmp_hits, fr_info_t *, fin, ipstate_t *, is); 2880 SBUMP(ipf_state_stats.iss_icmp_hits); 2881 is->is_icmppkts[i]++; 2882 2883 /* 2884 * we deliberately do not touch the timeouts 2885 * for the accompanying state table entry. 2886 * It remains to be seen if that is correct. XXX 2887 */ 2888 return (0); 2889 } 2890 2891 2892 /* ------------------------------------------------------------------------ */ 2893 /* Function: ipf_ipsmove */ 2894 /* Returns: Nil */ 2895 /* Parameters: is(I) - pointer to state table entry */ 2896 /* hv(I) - new hash value for state table entry */ 2897 /* Write Locks: ipf_state */ 2898 /* */ 2899 /* Move a state entry from one position in the hash table to another. */ 2900 /* ------------------------------------------------------------------------ */ 2901 static void 2902 ipf_ipsmove(ipf_state_softc_t *softs, ipstate_t *is, u_int hv) 2903 { 2904 ipstate_t **isp; 2905 u_int hvm; 2906 2907 hvm = is->is_hv; 2908 2909 /* TRACE is, is_hv, hvm */ 2910 2911 /* 2912 * Remove the hash from the old location... 2913 */ 2914 isp = is->is_phnext; 2915 if (is->is_hnext) 2916 is->is_hnext->is_phnext = isp; 2917 *isp = is->is_hnext; 2918 if (softs->ipf_state_table[hvm] == NULL) 2919 softs->ipf_state_stats.iss_inuse--; 2920 softs->ipf_state_stats.iss_bucketlen[hvm]--; 2921 2922 /* 2923 * ...and put the hash in the new one. 2924 */ 2925 hvm = DOUBLE_HASH(hv); 2926 is->is_hv = hvm; 2927 2928 /* TRACE is, hv, is_hv, hvm */ 2929 2930 isp = &softs->ipf_state_table[hvm]; 2931 if (*isp) 2932 (*isp)->is_phnext = &is->is_hnext; 2933 else 2934 softs->ipf_state_stats.iss_inuse++; 2935 softs->ipf_state_stats.iss_bucketlen[hvm]++; 2936 is->is_phnext = isp; 2937 is->is_hnext = *isp; 2938 *isp = is; 2939 } 2940 2941 2942 /* ------------------------------------------------------------------------ */ 2943 /* Function: ipf_state_lookup */ 2944 /* Returns: ipstate_t* - NULL == no matching state found, */ 2945 /* else pointer to state information is returned */ 2946 /* Parameters: fin(I) - pointer to packet information */ 2947 /* tcp(I) - pointer to TCP/UDP header. */ 2948 /* ifqp(O) - pointer for storing tailq timeout */ 2949 /* */ 2950 /* Search the state table for a matching entry to the packet described by */ 2951 /* the contents of *fin. For certain protocols, when a match is found the */ 2952 /* timeout queue is also selected and stored in ifpq if it is non-NULL. */ 2953 /* */ 2954 /* If we return NULL then no lock on ipf_state is held. */ 2955 /* If we return non-null then a read-lock on ipf_state is held. */ 2956 /* ------------------------------------------------------------------------ */ 2957 ipstate_t * 2958 ipf_state_lookup(fr_info_t *fin, tcphdr_t *tcp, ipftq_t **ifqp) 2959 { 2960 ipf_main_softc_t *softc = fin->fin_main_soft; 2961 ipf_state_softc_t *softs = softc->ipf_state_soft; 2962 u_int hv, hvm, pr, v, tryagain; 2963 ipstate_t *is, **isp; 2964 u_short dport, sport; 2965 i6addr_t src, dst; 2966 struct icmp *ic; 2967 ipftq_t *ifq; 2968 int oow; 2969 2970 is = NULL; 2971 ifq = NULL; 2972 tcp = fin->fin_dp; 2973 ic = (struct icmp *)tcp; 2974 hv = (pr = fin->fin_fi.fi_p); 2975 src = fin->fin_fi.fi_src; 2976 dst = fin->fin_fi.fi_dst; 2977 hv += src.in4.s_addr; 2978 hv += dst.in4.s_addr; 2979 2980 v = fin->fin_fi.fi_v; 2981 #ifdef USE_INET6 2982 if (v == 6) { 2983 hv += fin->fin_fi.fi_src.i6[1]; 2984 hv += fin->fin_fi.fi_src.i6[2]; 2985 hv += fin->fin_fi.fi_src.i6[3]; 2986 2987 if ((fin->fin_p == IPPROTO_ICMPV6) && 2988 IN6_IS_ADDR_MULTICAST(&fin->fin_fi.fi_dst.in6)) { 2989 hv -= dst.in4.s_addr; 2990 } else { 2991 hv += fin->fin_fi.fi_dst.i6[1]; 2992 hv += fin->fin_fi.fi_dst.i6[2]; 2993 hv += fin->fin_fi.fi_dst.i6[3]; 2994 } 2995 } 2996 #endif 2997 if ((v == 4) && 2998 (fin->fin_flx & (FI_MULTICAST|FI_BROADCAST|FI_MBCAST))) { 2999 if (fin->fin_out == 0) { 3000 hv -= src.in4.s_addr; 3001 } else { 3002 hv -= dst.in4.s_addr; 3003 } 3004 } 3005 3006 /* TRACE fin_saddr, fin_daddr, hv */ 3007 3008 /* 3009 * Search the hash table for matching packet header info. 3010 */ 3011 switch (pr) 3012 { 3013 #ifdef USE_INET6 3014 case IPPROTO_ICMPV6 : 3015 tryagain = 0; 3016 if (v == 6) { 3017 if ((ic->icmp_type == ICMP6_ECHO_REQUEST) || 3018 (ic->icmp_type == ICMP6_ECHO_REPLY)) { 3019 hv += ic->icmp_id; 3020 } 3021 } 3022 READ_ENTER(&softc->ipf_state); 3023 icmp6again: 3024 hvm = DOUBLE_HASH(hv); 3025 for (isp = &softs->ipf_state_table[hvm]; 3026 ((is = *isp) != NULL); ) { 3027 isp = &is->is_hnext; 3028 if ((is->is_p != pr) || (is->is_v != v)) 3029 continue; 3030 is = ipf_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP); 3031 if (is != NULL && 3032 ipf_matchicmpqueryreply(v, &is->is_icmp, 3033 ic, fin->fin_rev)) { 3034 if (fin->fin_rev) 3035 ifq = &softs->ipf_state_icmpacktq; 3036 else 3037 ifq = &softs->ipf_state_icmptq; 3038 break; 3039 } 3040 } 3041 3042 if (is != NULL) { 3043 if ((tryagain != 0) && !(is->is_flags & SI_W_DADDR)) { 3044 hv += fin->fin_fi.fi_src.i6[0]; 3045 hv += fin->fin_fi.fi_src.i6[1]; 3046 hv += fin->fin_fi.fi_src.i6[2]; 3047 hv += fin->fin_fi.fi_src.i6[3]; 3048 ipf_ipsmove(softs, is, hv); 3049 MUTEX_DOWNGRADE(&softc->ipf_state); 3050 } 3051 break; 3052 } 3053 RWLOCK_EXIT(&softc->ipf_state); 3054 3055 /* 3056 * No matching icmp state entry. Perhaps this is a 3057 * response to another state entry. 3058 * 3059 * XXX With some ICMP6 packets, the "other" address is already 3060 * in the packet, after the ICMP6 header, and this could be 3061 * used in place of the multicast address. However, taking 3062 * advantage of this requires some significant code changes 3063 * to handle the specific types where that is the case. 3064 */ 3065 if ((softs->ipf_state_stats.iss_wild != 0) && 3066 ((fin->fin_flx & FI_NOWILD) == 0) && 3067 (v == 6) && (tryagain == 0)) { 3068 hv -= fin->fin_fi.fi_src.i6[0]; 3069 hv -= fin->fin_fi.fi_src.i6[1]; 3070 hv -= fin->fin_fi.fi_src.i6[2]; 3071 hv -= fin->fin_fi.fi_src.i6[3]; 3072 tryagain = 1; 3073 WRITE_ENTER(&softc->ipf_state); 3074 goto icmp6again; 3075 } 3076 3077 is = ipf_checkicmp6matchingstate(fin); 3078 if (is != NULL) 3079 return (is); 3080 break; 3081 #endif 3082 3083 case IPPROTO_ICMP : 3084 if (v == 4) { 3085 hv += ic->icmp_id; 3086 } 3087 hv = DOUBLE_HASH(hv); 3088 READ_ENTER(&softc->ipf_state); 3089 for (isp = &softs->ipf_state_table[hv]; 3090 ((is = *isp) != NULL); ) { 3091 isp = &is->is_hnext; 3092 if ((is->is_p != pr) || (is->is_v != v)) 3093 continue; 3094 is = ipf_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP); 3095 if ((is != NULL) && 3096 (ic->icmp_id == is->is_icmp.ici_id) && 3097 ipf_matchicmpqueryreply(v, &is->is_icmp, 3098 ic, fin->fin_rev)) { 3099 if (fin->fin_rev) 3100 ifq = &softs->ipf_state_icmpacktq; 3101 else 3102 ifq = &softs->ipf_state_icmptq; 3103 break; 3104 } 3105 } 3106 if (is == NULL) { 3107 RWLOCK_EXIT(&softc->ipf_state); 3108 } 3109 break; 3110 3111 case IPPROTO_TCP : 3112 case IPPROTO_UDP : 3113 ifqp = NULL; 3114 sport = htons(fin->fin_data[0]); 3115 hv += sport; 3116 dport = htons(fin->fin_data[1]); 3117 hv += dport; 3118 oow = 0; 3119 tryagain = 0; 3120 READ_ENTER(&softc->ipf_state); 3121 retry_tcpudp: 3122 hvm = DOUBLE_HASH(hv); 3123 3124 /* TRACE hv, hvm */ 3125 3126 for (isp = &softs->ipf_state_table[hvm]; 3127 ((is = *isp) != NULL); ) { 3128 isp = &is->is_hnext; 3129 if ((is->is_p != pr) || (is->is_v != v)) 3130 continue; 3131 fin->fin_flx &= ~FI_OOW; 3132 is = ipf_matchsrcdst(fin, is, &src, &dst, tcp, FI_CMP); 3133 if (is != NULL) { 3134 if (pr == IPPROTO_TCP) { 3135 if (!ipf_state_tcp(softc, softs, fin, 3136 tcp, is)) { 3137 oow |= fin->fin_flx & FI_OOW; 3138 continue; 3139 } 3140 } 3141 break; 3142 } 3143 } 3144 if (is != NULL) { 3145 if (tryagain && 3146 !(is->is_flags & (SI_CLONE|SI_WILDP|SI_WILDA))) { 3147 hv += dport; 3148 hv += sport; 3149 ipf_ipsmove(softs, is, hv); 3150 MUTEX_DOWNGRADE(&softc->ipf_state); 3151 } 3152 break; 3153 } 3154 RWLOCK_EXIT(&softc->ipf_state); 3155 3156 if ((softs->ipf_state_stats.iss_wild != 0) && 3157 ((fin->fin_flx & FI_NOWILD) == 0)) { 3158 if (tryagain == 0) { 3159 hv -= dport; 3160 hv -= sport; 3161 } else if (tryagain == 1) { 3162 hv = fin->fin_fi.fi_p; 3163 /* 3164 * If we try to pretend this is a reply to a 3165 * multicast/broadcast packet then we need to 3166 * exclude part of the address from the hash 3167 * calculation. 3168 */ 3169 if (fin->fin_out == 0) { 3170 hv += src.in4.s_addr; 3171 } else { 3172 hv += dst.in4.s_addr; 3173 } 3174 hv += dport; 3175 hv += sport; 3176 } 3177 tryagain++; 3178 if (tryagain <= 2) { 3179 WRITE_ENTER(&softc->ipf_state); 3180 goto retry_tcpudp; 3181 } 3182 } 3183 fin->fin_flx |= oow; 3184 break; 3185 3186 #if 0 3187 case IPPROTO_GRE : 3188 gre = fin->fin_dp; 3189 if (GRE_REV(gre->gr_flags) == 1) { 3190 hv += gre->gr_call; 3191 } 3192 /* FALLTHROUGH */ 3193 #endif 3194 default : 3195 ifqp = NULL; 3196 hvm = DOUBLE_HASH(hv); 3197 READ_ENTER(&softc->ipf_state); 3198 for (isp = &softs->ipf_state_table[hvm]; 3199 ((is = *isp) != NULL); ) { 3200 isp = &is->is_hnext; 3201 if ((is->is_p != pr) || (is->is_v != v)) 3202 continue; 3203 is = ipf_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP); 3204 if (is != NULL) { 3205 ifq = &softs->ipf_state_iptq; 3206 break; 3207 } 3208 } 3209 if (is == NULL) { 3210 RWLOCK_EXIT(&softc->ipf_state); 3211 } 3212 break; 3213 } 3214 3215 if (is != NULL) { 3216 if (((is->is_sti.tqe_flags & TQE_RULEBASED) != 0) && 3217 (is->is_tqehead[fin->fin_rev] != NULL)) 3218 ifq = is->is_tqehead[fin->fin_rev]; 3219 if (ifq != NULL && ifqp != NULL) 3220 *ifqp = ifq; 3221 } else { 3222 SBUMP(ipf_state_stats.iss_lookup_miss); 3223 } 3224 return (is); 3225 } 3226 3227 3228 /* ------------------------------------------------------------------------ */ 3229 /* Function: ipf_state_check */ 3230 /* Returns: frentry_t* - NULL == search failed, */ 3231 /* else pointer to rule for matching state */ 3232 /* Parameters: fin(I) - pointer to packet information */ 3233 /* passp(I) - pointer to filtering result flags */ 3234 /* */ 3235 /* Check if a packet is associated with an entry in the state table. */ 3236 /* ------------------------------------------------------------------------ */ 3237 frentry_t * 3238 ipf_state_check(fr_info_t *fin, u_32_t *passp) 3239 { 3240 ipf_main_softc_t *softc = fin->fin_main_soft; 3241 ipf_state_softc_t *softs = softc->ipf_state_soft; 3242 ipftqent_t *tqe; 3243 ipstate_t *is; 3244 frentry_t *fr; 3245 tcphdr_t *tcp; 3246 ipftq_t *ifq; 3247 u_int pass; 3248 int inout; 3249 3250 if (softs->ipf_state_lock || (softs->ipf_state_list == NULL)) 3251 return (NULL); 3252 3253 if (fin->fin_flx & (FI_SHORT|FI_FRAGBODY|FI_BAD)) { 3254 SBUMPD(ipf_state_stats, iss_check_bad); 3255 return (NULL); 3256 } 3257 3258 if ((fin->fin_flx & FI_TCPUDP) || 3259 (fin->fin_fi.fi_p == IPPROTO_ICMP) 3260 #ifdef USE_INET6 3261 || (fin->fin_fi.fi_p == IPPROTO_ICMPV6) 3262 #endif 3263 ) 3264 tcp = fin->fin_dp; 3265 else 3266 tcp = NULL; 3267 3268 ifq = NULL; 3269 /* 3270 * Search the hash table for matching packet header info. 3271 */ 3272 is = ipf_state_lookup(fin, tcp, &ifq); 3273 3274 switch (fin->fin_p) 3275 { 3276 #ifdef USE_INET6 3277 case IPPROTO_ICMPV6 : 3278 if (is != NULL) 3279 break; 3280 if (fin->fin_v == 6) { 3281 is = ipf_checkicmp6matchingstate(fin); 3282 } 3283 break; 3284 #endif 3285 case IPPROTO_ICMP : 3286 if (is != NULL) 3287 break; 3288 /* 3289 * No matching icmp state entry. Perhaps this is a 3290 * response to another state entry. 3291 */ 3292 is = ipf_checkicmpmatchingstate(fin); 3293 break; 3294 3295 case IPPROTO_TCP : 3296 if (is == NULL) 3297 break; 3298 3299 if (is->is_pass & FR_NEWISN) { 3300 if (fin->fin_out == 0) 3301 ipf_fixinisn(fin, is); 3302 else if (fin->fin_out == 1) 3303 ipf_fixoutisn(fin, is); 3304 } 3305 break; 3306 default : 3307 if (fin->fin_rev) 3308 ifq = &softs->ipf_state_udpacktq; 3309 else 3310 ifq = &softs->ipf_state_udptq; 3311 break; 3312 } 3313 if (is == NULL) { 3314 SBUMP(ipf_state_stats.iss_check_miss); 3315 return (NULL); 3316 } 3317 3318 fr = is->is_rule; 3319 if (fr != NULL) { 3320 if ((fin->fin_out == 0) && (fr->fr_nattag.ipt_num[0] != 0)) { 3321 if (fin->fin_nattag == NULL) { 3322 RWLOCK_EXIT(&softc->ipf_state); 3323 SBUMPD(ipf_state_stats, iss_check_notag); 3324 return (NULL); 3325 } 3326 if (ipf_matchtag(&fr->fr_nattag, fin->fin_nattag)!=0) { 3327 RWLOCK_EXIT(&softc->ipf_state); 3328 SBUMPD(ipf_state_stats, iss_check_nattag); 3329 return (NULL); 3330 } 3331 } 3332 (void) strncpy(fin->fin_group, FR_NAME(fr, fr_group), 3333 FR_GROUPLEN); 3334 fin->fin_icode = fr->fr_icode; 3335 } 3336 3337 fin->fin_rule = is->is_rulen; 3338 fin->fin_fr = fr; 3339 3340 /* 3341 * If this packet is a fragment and the rule says to track fragments, 3342 * then create a new fragment cache entry. 3343 */ 3344 if (fin->fin_flx & FI_FRAG && FR_ISPASS(is->is_pass) && 3345 is->is_pass & FR_KEEPFRAG) 3346 (void) ipf_frag_new(softc, fin, is->is_pass); 3347 3348 /* 3349 * For TCP packets, ifq == NULL. For all others, check if this new 3350 * queue is different to the last one it was on and move it if so. 3351 */ 3352 tqe = &is->is_sti; 3353 if ((tqe->tqe_flags & TQE_RULEBASED) != 0) 3354 ifq = is->is_tqehead[fin->fin_rev]; 3355 3356 MUTEX_ENTER(&is->is_lock); 3357 3358 if (ifq != NULL) 3359 ipf_movequeue(softc->ipf_ticks, tqe, tqe->tqe_ifq, ifq); 3360 3361 inout = (fin->fin_rev << 1) + fin->fin_out; 3362 is->is_pkts[inout]++; 3363 is->is_bytes[inout] += fin->fin_plen; 3364 fin->fin_pktnum = is->is_pkts[inout] + is->is_icmppkts[inout]; 3365 3366 MUTEX_EXIT(&is->is_lock); 3367 3368 pass = is->is_pass; 3369 3370 if (is->is_flags & IS_STATESYNC) 3371 ipf_sync_update(softc, SMC_STATE, fin, is->is_sync); 3372 3373 RWLOCK_EXIT(&softc->ipf_state); 3374 3375 SBUMP(ipf_state_stats.iss_hits); 3376 3377 fin->fin_dif = &is->is_dif; 3378 fin->fin_tif = &is->is_tifs[fin->fin_rev]; 3379 fin->fin_flx |= FI_STATE; 3380 if ((pass & FR_LOGFIRST) != 0) 3381 pass &= ~(FR_LOGFIRST|FR_LOG); 3382 *passp = pass; 3383 return (fr); 3384 } 3385 3386 3387 /* ------------------------------------------------------------------------ */ 3388 /* Function: ipf_fixoutisn */ 3389 /* Returns: Nil */ 3390 /* Parameters: fin(I) - pointer to packet information */ 3391 /* is(I) - pointer to master state structure */ 3392 /* */ 3393 /* Called only for outbound packets, adjusts the sequence number and the */ 3394 /* TCP checksum to match that change. */ 3395 /* ------------------------------------------------------------------------ */ 3396 static void 3397 ipf_fixoutisn(fr_info_t *fin, ipstate_t *is) 3398 { 3399 tcphdr_t *tcp; 3400 int rev; 3401 u_32_t seq; 3402 3403 tcp = fin->fin_dp; 3404 rev = fin->fin_rev; 3405 if ((is->is_flags & IS_ISNSYN) != 0) { 3406 if ((rev == 0) && (fin->fin_cksum < FI_CK_L4PART)) { 3407 seq = ntohl(tcp->th_seq); 3408 seq += is->is_isninc[0]; 3409 tcp->th_seq = htonl(seq); 3410 ipf_fix_outcksum(0, &tcp->th_sum, is->is_sumd[0], 0); 3411 } 3412 } 3413 if ((is->is_flags & IS_ISNACK) != 0) { 3414 if ((rev == 1) && (fin->fin_cksum < FI_CK_L4PART)) { 3415 seq = ntohl(tcp->th_seq); 3416 seq += is->is_isninc[1]; 3417 tcp->th_seq = htonl(seq); 3418 ipf_fix_outcksum(0, &tcp->th_sum, is->is_sumd[1], 0); 3419 } 3420 } 3421 } 3422 3423 3424 /* ------------------------------------------------------------------------ */ 3425 /* Function: ipf_fixinisn */ 3426 /* Returns: Nil */ 3427 /* Parameters: fin(I) - pointer to packet information */ 3428 /* is(I) - pointer to master state structure */ 3429 /* */ 3430 /* Called only for inbound packets, adjusts the acknowledge number and the */ 3431 /* TCP checksum to match that change. */ 3432 /* ------------------------------------------------------------------------ */ 3433 static void 3434 ipf_fixinisn(fr_info_t *fin, ipstate_t *is) 3435 { 3436 tcphdr_t *tcp; 3437 int rev; 3438 u_32_t ack; 3439 3440 tcp = fin->fin_dp; 3441 rev = fin->fin_rev; 3442 if ((is->is_flags & IS_ISNSYN) != 0) { 3443 if ((rev == 1) && (fin->fin_cksum < FI_CK_L4PART)) { 3444 ack = ntohl(tcp->th_ack); 3445 ack -= is->is_isninc[0]; 3446 tcp->th_ack = htonl(ack); 3447 ipf_fix_incksum(0, &tcp->th_sum, is->is_sumd[0], 0); 3448 } 3449 } 3450 if ((is->is_flags & IS_ISNACK) != 0) { 3451 if ((rev == 0) && (fin->fin_cksum < FI_CK_L4PART)) { 3452 ack = ntohl(tcp->th_ack); 3453 ack -= is->is_isninc[1]; 3454 tcp->th_ack = htonl(ack); 3455 ipf_fix_incksum(0, &tcp->th_sum, is->is_sumd[1], 0); 3456 } 3457 } 3458 } 3459 3460 3461 /* ------------------------------------------------------------------------ */ 3462 /* Function: ipf_state_sync */ 3463 /* Returns: Nil */ 3464 /* Parameters: softc(I) - pointer to soft context main structure */ 3465 /* ifp(I) - pointer to interface */ 3466 /* */ 3467 /* Walk through all state entries and if an interface pointer match is */ 3468 /* found then look it up again, based on its name in case the pointer has */ 3469 /* changed since last time. */ 3470 /* */ 3471 /* If ifp is passed in as being non-null then we are only doing updates for */ 3472 /* existing, matching, uses of it. */ 3473 /* ------------------------------------------------------------------------ */ 3474 void 3475 ipf_state_sync(ipf_main_softc_t *softc, void *ifp) 3476 { 3477 ipf_state_softc_t *softs = softc->ipf_state_soft; 3478 ipstate_t *is; 3479 int i; 3480 3481 if (softc->ipf_running <= 0) 3482 return; 3483 3484 WRITE_ENTER(&softc->ipf_state); 3485 3486 if (softc->ipf_running <= 0) { 3487 RWLOCK_EXIT(&softc->ipf_state); 3488 return; 3489 } 3490 3491 for (is = softs->ipf_state_list; is; is = is->is_next) { 3492 /* 3493 * Look up all the interface names in the state entry. 3494 */ 3495 for (i = 0; i < FR_NUM(is->is_ifp); i++) { 3496 if (ifp == NULL || ifp == is->is_ifp[i]) 3497 is->is_ifp[i] = ipf_resolvenic(softc, 3498 is->is_ifname[i], 3499 is->is_v); 3500 } 3501 } 3502 RWLOCK_EXIT(&softc->ipf_state); 3503 } 3504 3505 3506 /* ------------------------------------------------------------------------ */ 3507 /* Function: ipf_state_del */ 3508 /* Returns: int - 0 = deleted, else refernce count on active struct */ 3509 /* Parameters: softc(I) - pointer to soft context main structure */ 3510 /* is(I) - pointer to state structure to delete */ 3511 /* why(I) - if not 0, log reason why it was deleted */ 3512 /* Write Locks: ipf_state */ 3513 /* */ 3514 /* Deletes a state entry from the enumerated list as well as the hash table */ 3515 /* and timeout queue lists. Make adjustments to hash table statistics and */ 3516 /* global counters as required. */ 3517 /* ------------------------------------------------------------------------ */ 3518 static int 3519 ipf_state_del(ipf_main_softc_t *softc, ipstate_t *is, int why) 3520 { 3521 ipf_state_softc_t *softs = softc->ipf_state_soft; 3522 int orphan = 1; 3523 frentry_t *fr; 3524 3525 /* 3526 * Since we want to delete this, remove it from the state table, 3527 * where it can be found & used, first. 3528 */ 3529 if (is->is_phnext != NULL) { 3530 *is->is_phnext = is->is_hnext; 3531 if (is->is_hnext != NULL) 3532 is->is_hnext->is_phnext = is->is_phnext; 3533 if (softs->ipf_state_table[is->is_hv] == NULL) 3534 softs->ipf_state_stats.iss_inuse--; 3535 softs->ipf_state_stats.iss_bucketlen[is->is_hv]--; 3536 3537 is->is_phnext = NULL; 3538 is->is_hnext = NULL; 3539 orphan = 0; 3540 } 3541 3542 /* 3543 * Because ipf_state_stats.iss_wild is a count of entries in the state 3544 * table that have wildcard flags set, only decerement it once 3545 * and do it here. 3546 */ 3547 if (is->is_flags & (SI_WILDP|SI_WILDA)) { 3548 if (!(is->is_flags & SI_CLONED)) { 3549 ATOMIC_DECL(softs->ipf_state_stats.iss_wild); 3550 } 3551 is->is_flags &= ~(SI_WILDP|SI_WILDA); 3552 } 3553 3554 /* 3555 * Next, remove it from the timeout queue it is in. 3556 */ 3557 if (is->is_sti.tqe_ifq != NULL) 3558 ipf_deletequeueentry(&is->is_sti); 3559 3560 /* 3561 * If it is still in use by something else, do not go any further, 3562 * but note that at this point it is now an orphan. How can this 3563 * be? ipf_state_flush() calls ipf_delete() directly because it wants 3564 * to empty the table out and if something has a hold on a state 3565 * entry (such as ipfstat), it'll do the deref path that'll bring 3566 * us back here to do the real delete & free. 3567 */ 3568 MUTEX_ENTER(&is->is_lock); 3569 if (is->is_me != NULL) { 3570 *is->is_me = NULL; 3571 is->is_me = NULL; 3572 is->is_ref--; 3573 } 3574 is->is_ref--; 3575 if (is->is_ref > 0) { 3576 int refs; 3577 3578 refs = is->is_ref; 3579 MUTEX_EXIT(&is->is_lock); 3580 if (!orphan) 3581 softs->ipf_state_stats.iss_orphan++; 3582 return (refs); 3583 } 3584 3585 fr = is->is_rule; 3586 is->is_rule = NULL; 3587 if (fr != NULL) { 3588 if (fr->fr_srctrack.ht_max_nodes != 0) { 3589 (void) ipf_ht_node_del(&fr->fr_srctrack, 3590 is->is_family, &is->is_src); 3591 } 3592 } 3593 3594 ASSERT(is->is_ref == 0); 3595 MUTEX_EXIT(&is->is_lock); 3596 3597 if (is->is_tqehead[0] != NULL) { 3598 if (ipf_deletetimeoutqueue(is->is_tqehead[0]) == 0) 3599 ipf_freetimeoutqueue(softc, is->is_tqehead[0]); 3600 } 3601 if (is->is_tqehead[1] != NULL) { 3602 if (ipf_deletetimeoutqueue(is->is_tqehead[1]) == 0) 3603 ipf_freetimeoutqueue(softc, is->is_tqehead[1]); 3604 } 3605 3606 if (is->is_sync) 3607 ipf_sync_del_state(softc->ipf_sync_soft, is->is_sync); 3608 3609 /* 3610 * Now remove it from the linked list of known states 3611 */ 3612 if (is->is_pnext != NULL) { 3613 *is->is_pnext = is->is_next; 3614 3615 if (is->is_next != NULL) 3616 is->is_next->is_pnext = is->is_pnext; 3617 3618 is->is_pnext = NULL; 3619 is->is_next = NULL; 3620 } 3621 3622 if (softs->ipf_state_logging != 0 && why != 0) 3623 ipf_state_log(softc, is, why); 3624 3625 if (is->is_p == IPPROTO_TCP) 3626 softs->ipf_state_stats.iss_fin++; 3627 else 3628 softs->ipf_state_stats.iss_expire++; 3629 if (orphan) 3630 softs->ipf_state_stats.iss_orphan--; 3631 3632 if (fr != NULL) { 3633 fr->fr_statecnt--; 3634 (void) ipf_derefrule(softc, &fr); 3635 } 3636 3637 softs->ipf_state_stats.iss_active_proto[is->is_p]--; 3638 3639 MUTEX_DESTROY(&is->is_lock); 3640 KFREE(is); 3641 softs->ipf_state_stats.iss_active--; 3642 3643 return (0); 3644 } 3645 3646 3647 /* ------------------------------------------------------------------------ */ 3648 /* Function: ipf_state_expire */ 3649 /* Returns: Nil */ 3650 /* Parameters: softc(I) - pointer to soft context main structure */ 3651 /* */ 3652 /* Slowly expire held state for thingslike UDP and ICMP. The algorithm */ 3653 /* used here is to keep the queue sorted with the oldest things at the top */ 3654 /* and the youngest at the bottom. So if the top one doesn't need to be */ 3655 /* expired then neither will any under it. */ 3656 /* ------------------------------------------------------------------------ */ 3657 void 3658 ipf_state_expire(ipf_main_softc_t *softc) 3659 { 3660 ipf_state_softc_t *softs = softc->ipf_state_soft; 3661 ipftq_t *ifq, *ifqnext; 3662 ipftqent_t *tqe, *tqn; 3663 ipstate_t *is; 3664 SPL_INT(s); 3665 3666 SPL_NET(s); 3667 WRITE_ENTER(&softc->ipf_state); 3668 for (ifq = softs->ipf_state_tcptq; ifq != NULL; ifq = ifq->ifq_next) 3669 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 3670 if (tqe->tqe_die > softc->ipf_ticks) 3671 break; 3672 tqn = tqe->tqe_next; 3673 is = tqe->tqe_parent; 3674 ipf_state_del(softc, is, ISL_EXPIRE); 3675 } 3676 3677 for (ifq = softs->ipf_state_usertq; ifq != NULL; ifq = ifqnext) { 3678 ifqnext = ifq->ifq_next; 3679 3680 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 3681 if (tqe->tqe_die > softc->ipf_ticks) 3682 break; 3683 tqn = tqe->tqe_next; 3684 is = tqe->tqe_parent; 3685 ipf_state_del(softc, is, ISL_EXPIRE); 3686 } 3687 } 3688 3689 for (ifq = softs->ipf_state_usertq; ifq != NULL; ifq = ifqnext) { 3690 ifqnext = ifq->ifq_next; 3691 3692 if (((ifq->ifq_flags & IFQF_DELETE) != 0) && 3693 (ifq->ifq_ref == 0)) { 3694 ipf_freetimeoutqueue(softc, ifq); 3695 } 3696 } 3697 3698 if (softs->ipf_state_doflush) { 3699 (void) ipf_state_flush(softc, 2, 0); 3700 softs->ipf_state_doflush = 0; 3701 softs->ipf_state_wm_last = softc->ipf_ticks; 3702 } 3703 3704 RWLOCK_EXIT(&softc->ipf_state); 3705 SPL_X(s); 3706 } 3707 3708 3709 /* ------------------------------------------------------------------------ */ 3710 /* Function: ipf_state_flush */ 3711 /* Returns: int - 0 == success, -1 == failure */ 3712 /* Parameters: softc(I) - pointer to soft context main structure */ 3713 /* which(I) - which flush action to perform */ 3714 /* proto(I) - which protocol to flush (0 == ALL) */ 3715 /* Write Locks: ipf_state */ 3716 /* */ 3717 /* Flush state tables. Three actions currently defined: */ 3718 /* which == 0 : flush all state table entries */ 3719 /* which == 1 : flush TCP connections which have started to close but are */ 3720 /* stuck for some reason. */ 3721 /* which == 2 : flush TCP connections which have been idle for a long time, */ 3722 /* starting at > 4 days idle and working back in successive half-*/ 3723 /* days to at most 12 hours old. If this fails to free enough */ 3724 /* slots then work backwards in half hour slots to 30 minutes. */ 3725 /* If that too fails, then work backwards in 30 second intervals */ 3726 /* for the last 30 minutes to at worst 30 seconds idle. */ 3727 /* ------------------------------------------------------------------------ */ 3728 int 3729 ipf_state_flush(ipf_main_softc_t *softc, int which, int proto) 3730 { 3731 ipf_state_softc_t *softs = softc->ipf_state_soft; 3732 ipftqent_t *tqe, *tqn; 3733 ipstate_t *is, **isp; 3734 ipftq_t *ifq; 3735 int removed; 3736 SPL_INT(s); 3737 3738 removed = 0; 3739 3740 SPL_NET(s); 3741 3742 switch (which) 3743 { 3744 case 0 : 3745 SBUMP(ipf_state_stats.iss_flush_all); 3746 /* 3747 * Style 0 flush removes everything... 3748 */ 3749 for (isp = &softs->ipf_state_list; ((is = *isp) != NULL); ) { 3750 if ((proto != 0) && (is->is_v != proto)) { 3751 isp = &is->is_next; 3752 continue; 3753 } 3754 if (ipf_state_del(softc, is, ISL_FLUSH) == 0) 3755 removed++; 3756 else 3757 isp = &is->is_next; 3758 } 3759 break; 3760 3761 case 1 : 3762 SBUMP(ipf_state_stats.iss_flush_closing); 3763 /* 3764 * Since we're only interested in things that are closing, 3765 * we can start with the appropriate timeout queue. 3766 */ 3767 for (ifq = softs->ipf_state_tcptq + IPF_TCPS_CLOSE_WAIT; 3768 ifq != NULL; ifq = ifq->ifq_next) { 3769 3770 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 3771 tqn = tqe->tqe_next; 3772 is = tqe->tqe_parent; 3773 if (is->is_p != IPPROTO_TCP) 3774 break; 3775 if (ipf_state_del(softc, is, ISL_FLUSH) == 0) 3776 removed++; 3777 } 3778 } 3779 3780 /* 3781 * Also need to look through the user defined queues. 3782 */ 3783 for (ifq = softs->ipf_state_usertq; ifq != NULL; 3784 ifq = ifq->ifq_next) { 3785 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 3786 tqn = tqe->tqe_next; 3787 is = tqe->tqe_parent; 3788 if (is->is_p != IPPROTO_TCP) 3789 continue; 3790 3791 if ((is->is_state[0] > IPF_TCPS_ESTABLISHED) && 3792 (is->is_state[1] > IPF_TCPS_ESTABLISHED)) { 3793 if (ipf_state_del(softc, is, 3794 ISL_FLUSH) == 0) 3795 removed++; 3796 } 3797 } 3798 } 3799 break; 3800 3801 case 2 : 3802 break; 3803 3804 /* 3805 * Args 5-11 correspond to flushing those particular states 3806 * for TCP connections. 3807 */ 3808 case IPF_TCPS_CLOSE_WAIT : 3809 case IPF_TCPS_FIN_WAIT_1 : 3810 case IPF_TCPS_CLOSING : 3811 case IPF_TCPS_LAST_ACK : 3812 case IPF_TCPS_FIN_WAIT_2 : 3813 case IPF_TCPS_TIME_WAIT : 3814 case IPF_TCPS_CLOSED : 3815 SBUMP(ipf_state_stats.iss_flush_queue); 3816 tqn = softs->ipf_state_tcptq[which].ifq_head; 3817 while (tqn != NULL) { 3818 tqe = tqn; 3819 tqn = tqe->tqe_next; 3820 is = tqe->tqe_parent; 3821 if (ipf_state_del(softc, is, ISL_FLUSH) == 0) 3822 removed++; 3823 } 3824 break; 3825 3826 default : 3827 if (which < 30) 3828 break; 3829 3830 SBUMP(ipf_state_stats.iss_flush_state); 3831 /* 3832 * Take a large arbitrary number to mean the number of seconds 3833 * for which which consider to be the maximum value we'll allow 3834 * the expiration to be. 3835 */ 3836 which = IPF_TTLVAL(which); 3837 for (isp = &softs->ipf_state_list; ((is = *isp) != NULL); ) { 3838 if ((proto == 0) || (is->is_v == proto)) { 3839 if (softc->ipf_ticks - is->is_touched > which) { 3840 if (ipf_state_del(softc, is, 3841 ISL_FLUSH) == 0) { 3842 removed++; 3843 continue; 3844 } 3845 } 3846 } 3847 isp = &is->is_next; 3848 } 3849 break; 3850 } 3851 3852 if (which != 2) { 3853 SPL_X(s); 3854 return (removed); 3855 } 3856 3857 SBUMP(ipf_state_stats.iss_flush_timeout); 3858 /* 3859 * Asked to remove inactive entries because the table is full, try 3860 * again, 3 times, if first attempt failed with a different criteria 3861 * each time. The order tried in must be in decreasing age. 3862 * Another alternative is to implement random drop and drop N entries 3863 * at random until N have been freed up. 3864 */ 3865 if (softc->ipf_ticks - softs->ipf_state_wm_last > 3866 softs->ipf_state_wm_freq) { 3867 removed = ipf_queueflush(softc, ipf_state_flush_entry, 3868 softs->ipf_state_tcptq, 3869 softs->ipf_state_usertq, 3870 &softs->ipf_state_stats.iss_active, 3871 softs->ipf_state_size, 3872 softs->ipf_state_wm_low); 3873 softs->ipf_state_wm_last = softc->ipf_ticks; 3874 } 3875 3876 SPL_X(s); 3877 return (removed); 3878 } 3879 3880 3881 /* ------------------------------------------------------------------------ */ 3882 /* Function: ipf_state_flush_entry */ 3883 /* Returns: int - 0 = entry deleted, else not deleted */ 3884 /* Parameters: softc(I) - pointer to soft context main structure */ 3885 /* entry(I) - pointer to state structure to delete */ 3886 /* Write Locks: ipf_state */ 3887 /* */ 3888 /* This function is a stepping stone between ipf_queueflush() and */ 3889 /* ipf_state_del(). It is used so we can provide a uniform interface via */ 3890 /* the ipf_queueflush() function. */ 3891 /* ------------------------------------------------------------------------ */ 3892 static int 3893 ipf_state_flush_entry(ipf_main_softc_t *softc, void *entry) 3894 { 3895 return (ipf_state_del(softc, entry, ISL_FLUSH)); 3896 } 3897 3898 3899 /* ------------------------------------------------------------------------ */ 3900 /* Function: ipf_tcp_age */ 3901 /* Returns: int - 1 == state transition made, 0 == no change (rejected) */ 3902 /* Parameters: tqe(I) - pointer to timeout queue information */ 3903 /* fin(I) - pointer to packet information */ 3904 /* tqtab(I) - TCP timeout queue table this is in */ 3905 /* flags(I) - flags from state/NAT entry */ 3906 /* ok(I) - can we advance state */ 3907 /* */ 3908 /* Rewritten by Arjan de Vet <Arjan.deVet@adv.iae.nl>, 2000-07-29: */ 3909 /* */ 3910 /* - (try to) base state transitions on real evidence only, */ 3911 /* i.e. packets that are sent and have been received by ipfilter; */ 3912 /* diagram 18.12 of TCP/IP volume 1 by W. Richard Stevens was used. */ 3913 /* */ 3914 /* - deal with half-closed connections correctly; */ 3915 /* */ 3916 /* - store the state of the source in state[0] such that ipfstat */ 3917 /* displays the state as source/dest instead of dest/source; the calls */ 3918 /* to ipf_tcp_age have been changed accordingly. */ 3919 /* */ 3920 /* Internal Parameters: */ 3921 /* */ 3922 /* state[0] = state of source (host that initiated connection) */ 3923 /* state[1] = state of dest (host that accepted the connection) */ 3924 /* */ 3925 /* dir == 0 : a packet from source to dest */ 3926 /* dir == 1 : a packet from dest to source */ 3927 /* */ 3928 /* A typical procession for a connection is as follows: */ 3929 /* */ 3930 /* +--------------+-------------------+ */ 3931 /* | Side '0' | Side '1' | */ 3932 /* +--------------+-------------------+ */ 3933 /* | 0 -> 1 (SYN) | | */ 3934 /* | | 0 -> 2 (SYN-ACK) | */ 3935 /* | 1 -> 3 (ACK) | | */ 3936 /* | | 2 -> 4 (ACK-PUSH) | */ 3937 /* | 3 -> 4 (ACK) | | */ 3938 /* | ... | ... | */ 3939 /* | | 4 -> 6 (FIN-ACK) | */ 3940 /* | 4 -> 5 (ACK) | | */ 3941 /* | | 6 -> 6 (ACK-PUSH) | */ 3942 /* | 5 -> 5 (ACK) | | */ 3943 /* | 5 -> 8 (FIN) | | */ 3944 /* | | 6 -> 10 (ACK) | */ 3945 /* +--------------+-------------------+ */ 3946 /* */ 3947 /* Locking: it is assumed that the parent of the tqe structure is locked. */ 3948 /* ------------------------------------------------------------------------ */ 3949 int 3950 ipf_tcp_age(ipftqent_t *tqe, fr_info_t *fin, ipftq_t *tqtab, int flags, int ok) 3951 { 3952 ipf_main_softc_t *softc = fin->fin_main_soft; 3953 int dlen, ostate, nstate, rval, dir; 3954 u_char tcpflags; 3955 tcphdr_t *tcp; 3956 3957 tcp = fin->fin_dp; 3958 3959 rval = 0; 3960 dir = fin->fin_rev; 3961 tcpflags = tcp->th_flags; 3962 dlen = fin->fin_dlen - (TCP_OFF(tcp) << 2); 3963 ostate = tqe->tqe_state[1 - dir]; 3964 nstate = tqe->tqe_state[dir]; 3965 3966 if (tcpflags & TH_RST) { 3967 if (!(tcpflags & TH_PUSH) && !dlen) 3968 nstate = IPF_TCPS_CLOSED; 3969 else 3970 nstate = IPF_TCPS_CLOSE_WAIT; 3971 3972 if (ostate <= IPF_TCPS_ESTABLISHED) { 3973 tqe->tqe_state[1 - dir] = IPF_TCPS_CLOSE_WAIT; 3974 } 3975 rval = 1; 3976 } else { 3977 switch (nstate) 3978 { 3979 case IPF_TCPS_LISTEN: /* 0 */ 3980 if ((tcpflags & TH_OPENING) == TH_OPENING) { 3981 /* 3982 * 'dir' received an S and sends SA in 3983 * response, LISTEN -> SYN_RECEIVED 3984 */ 3985 nstate = IPF_TCPS_SYN_RECEIVED; 3986 rval = 1; 3987 } else if ((tcpflags & TH_OPENING) == TH_SYN) { 3988 /* 'dir' sent S, LISTEN -> SYN_SENT */ 3989 nstate = IPF_TCPS_SYN_SENT; 3990 rval = 1; 3991 } 3992 /* 3993 * the next piece of code makes it possible to get 3994 * already established connections into the state table 3995 * after a restart or reload of the filter rules; this 3996 * does not work when a strict 'flags S keep state' is 3997 * used for tcp connections of course 3998 */ 3999 if (((flags & IS_TCPFSM) == 0) && 4000 ((tcpflags & TH_ACKMASK) == TH_ACK)) { 4001 /* 4002 * we saw an A, guess 'dir' is in ESTABLISHED 4003 * mode 4004 */ 4005 switch (ostate) 4006 { 4007 case IPF_TCPS_LISTEN : 4008 case IPF_TCPS_SYN_RECEIVED : 4009 nstate = IPF_TCPS_HALF_ESTAB; 4010 rval = 1; 4011 break; 4012 case IPF_TCPS_HALF_ESTAB : 4013 case IPF_TCPS_ESTABLISHED : 4014 nstate = IPF_TCPS_ESTABLISHED; 4015 rval = 1; 4016 break; 4017 default : 4018 break; 4019 } 4020 } 4021 /* 4022 * TODO: besides regular ACK packets we can have other 4023 * packets as well; it is yet to be determined how we 4024 * should initialize the states in those cases 4025 */ 4026 break; 4027 4028 case IPF_TCPS_SYN_SENT: /* 1 */ 4029 if ((tcpflags & ~(TH_ECN|TH_CWR)) == TH_SYN) { 4030 /* 4031 * A retransmitted SYN packet. We do not reset 4032 * the timeout here to ipf_tcptimeout because a 4033 * connection connect timeout does not renew 4034 * after every packet that is sent. We need to 4035 * set rval so as to indicate the packet has 4036 * passed the check for its flags being valid 4037 * in the TCP FSM. Setting rval to 2 has the 4038 * result of not resetting the timeout. 4039 */ 4040 rval = 2; 4041 } else if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) == 4042 TH_ACK) { 4043 /* 4044 * we see an A from 'dir' which is in SYN_SENT 4045 * state: 'dir' sent an A in response to an SA 4046 * which it received, SYN_SENT -> ESTABLISHED 4047 */ 4048 nstate = IPF_TCPS_ESTABLISHED; 4049 rval = 1; 4050 } else if (tcpflags & TH_FIN) { 4051 /* 4052 * we see an F from 'dir' which is in SYN_SENT 4053 * state and wants to close its side of the 4054 * connection; SYN_SENT -> FIN_WAIT_1 4055 */ 4056 nstate = IPF_TCPS_FIN_WAIT_1; 4057 rval = 1; 4058 } else if ((tcpflags & TH_OPENING) == TH_OPENING) { 4059 /* 4060 * we see an SA from 'dir' which is already in 4061 * SYN_SENT state, this means we have a 4062 * simultaneous open; SYN_SENT -> SYN_RECEIVED 4063 */ 4064 nstate = IPF_TCPS_SYN_RECEIVED; 4065 rval = 1; 4066 } 4067 break; 4068 4069 case IPF_TCPS_SYN_RECEIVED: /* 2 */ 4070 if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) == TH_ACK) { 4071 /* 4072 * we see an A from 'dir' which was in 4073 * SYN_RECEIVED state so it must now be in 4074 * established state, SYN_RECEIVED -> 4075 * ESTABLISHED 4076 */ 4077 nstate = IPF_TCPS_ESTABLISHED; 4078 rval = 1; 4079 } else if ((tcpflags & ~(TH_ECN|TH_CWR)) == 4080 TH_OPENING) { 4081 /* 4082 * We see an SA from 'dir' which is already in 4083 * SYN_RECEIVED state. 4084 */ 4085 rval = 2; 4086 } else if (tcpflags & TH_FIN) { 4087 /* 4088 * we see an F from 'dir' which is in 4089 * SYN_RECEIVED state and wants to close its 4090 * side of the connection; SYN_RECEIVED -> 4091 * FIN_WAIT_1 4092 */ 4093 nstate = IPF_TCPS_FIN_WAIT_1; 4094 rval = 1; 4095 } 4096 break; 4097 4098 case IPF_TCPS_HALF_ESTAB: /* 3 */ 4099 if (tcpflags & TH_FIN) { 4100 nstate = IPF_TCPS_FIN_WAIT_1; 4101 rval = 1; 4102 } else if ((tcpflags & TH_ACKMASK) == TH_ACK) { 4103 /* 4104 * If we've picked up a connection in mid 4105 * flight, we could be looking at a follow on 4106 * packet from the same direction as the one 4107 * that created this state. Recognise it but 4108 * do not advance the entire connection's 4109 * state. 4110 */ 4111 switch (ostate) 4112 { 4113 case IPF_TCPS_LISTEN : 4114 case IPF_TCPS_SYN_SENT : 4115 case IPF_TCPS_SYN_RECEIVED : 4116 rval = 1; 4117 break; 4118 case IPF_TCPS_HALF_ESTAB : 4119 case IPF_TCPS_ESTABLISHED : 4120 nstate = IPF_TCPS_ESTABLISHED; 4121 rval = 1; 4122 break; 4123 default : 4124 break; 4125 } 4126 } 4127 break; 4128 4129 case IPF_TCPS_ESTABLISHED: /* 4 */ 4130 rval = 1; 4131 if (tcpflags & TH_FIN) { 4132 /* 4133 * 'dir' closed its side of the connection; 4134 * this gives us a half-closed connection; 4135 * ESTABLISHED -> FIN_WAIT_1 4136 */ 4137 if (ostate == IPF_TCPS_FIN_WAIT_1) { 4138 nstate = IPF_TCPS_CLOSING; 4139 } else { 4140 nstate = IPF_TCPS_FIN_WAIT_1; 4141 } 4142 } else if (tcpflags & TH_ACK) { 4143 /* 4144 * an ACK, should we exclude other flags here? 4145 */ 4146 if (ostate == IPF_TCPS_FIN_WAIT_1) { 4147 /* 4148 * We know the other side did an active 4149 * close, so we are ACKing the recvd 4150 * FIN packet (does the window matching 4151 * code guarantee this?) and go into 4152 * CLOSE_WAIT state; this gives us a 4153 * half-closed connection 4154 */ 4155 nstate = IPF_TCPS_CLOSE_WAIT; 4156 } else if (ostate < IPF_TCPS_CLOSE_WAIT) { 4157 /* 4158 * still a fully established 4159 * connection reset timeout 4160 */ 4161 nstate = IPF_TCPS_ESTABLISHED; 4162 } 4163 } 4164 break; 4165 4166 case IPF_TCPS_CLOSE_WAIT: /* 5 */ 4167 rval = 1; 4168 if (tcpflags & TH_FIN) { 4169 /* 4170 * application closed and 'dir' sent a FIN, 4171 * we're now going into LAST_ACK state 4172 */ 4173 nstate = IPF_TCPS_LAST_ACK; 4174 } else { 4175 /* 4176 * we remain in CLOSE_WAIT because the other 4177 * side has closed already and we did not 4178 * close our side yet; reset timeout 4179 */ 4180 nstate = IPF_TCPS_CLOSE_WAIT; 4181 } 4182 break; 4183 4184 case IPF_TCPS_FIN_WAIT_1: /* 6 */ 4185 rval = 1; 4186 if ((tcpflags & TH_ACK) && 4187 ostate > IPF_TCPS_CLOSE_WAIT) { 4188 /* 4189 * if the other side is not active anymore 4190 * it has sent us a FIN packet that we are 4191 * ack'ing now with an ACK; this means both 4192 * sides have now closed the connection and 4193 * we go into TIME_WAIT 4194 */ 4195 /* 4196 * XXX: how do we know we really are ACKing 4197 * the FIN packet here? does the window code 4198 * guarantee that? 4199 */ 4200 nstate = IPF_TCPS_LAST_ACK; 4201 } else { 4202 /* 4203 * we closed our side of the connection 4204 * already but the other side is still active 4205 * (ESTABLISHED/CLOSE_WAIT); continue with 4206 * this half-closed connection 4207 */ 4208 nstate = IPF_TCPS_FIN_WAIT_1; 4209 } 4210 break; 4211 4212 case IPF_TCPS_CLOSING: /* 7 */ 4213 if ((tcpflags & (TH_FIN|TH_ACK)) == TH_ACK) { 4214 nstate = IPF_TCPS_TIME_WAIT; 4215 } 4216 rval = 1; 4217 break; 4218 4219 case IPF_TCPS_LAST_ACK: /* 8 */ 4220 if (tcpflags & TH_ACK) { 4221 rval = 1; 4222 } 4223 /* 4224 * we cannot detect when we go out of LAST_ACK state 4225 * to CLOSED because that is based on the reception 4226 * of ACK packets; ipfilter can only detect that a 4227 * packet has been sent by a host 4228 */ 4229 break; 4230 4231 case IPF_TCPS_FIN_WAIT_2: /* 9 */ 4232 /* NOT USED */ 4233 break; 4234 4235 case IPF_TCPS_TIME_WAIT: /* 10 */ 4236 /* we're in 2MSL timeout now */ 4237 if (ostate == IPF_TCPS_LAST_ACK) { 4238 nstate = IPF_TCPS_CLOSED; 4239 rval = 1; 4240 } else { 4241 rval = 2; 4242 } 4243 break; 4244 4245 case IPF_TCPS_CLOSED: /* 11 */ 4246 rval = 2; 4247 break; 4248 4249 default : 4250 #if !defined(_KERNEL) 4251 abort(); 4252 #endif 4253 break; 4254 } 4255 } 4256 4257 /* 4258 * If rval == 2 then do not update the queue position, but treat the 4259 * packet as being ok. 4260 */ 4261 if (rval == 2) 4262 rval = 1; 4263 else if (rval == 1) { 4264 if (ok) 4265 tqe->tqe_state[dir] = nstate; 4266 if ((tqe->tqe_flags & TQE_RULEBASED) == 0) 4267 ipf_movequeue(softc->ipf_ticks, tqe, tqe->tqe_ifq, 4268 tqtab + nstate); 4269 } 4270 4271 return (rval); 4272 } 4273 4274 4275 /* ------------------------------------------------------------------------ */ 4276 /* Function: ipf_state_log */ 4277 /* Returns: Nil */ 4278 /* Parameters: softc(I) - pointer to soft context main structure */ 4279 /* is(I) - pointer to state structure */ 4280 /* type(I) - type of log entry to create */ 4281 /* */ 4282 /* Creates a state table log entry using the state structure and type info. */ 4283 /* passed in. Log packet/byte counts, source/destination address and other */ 4284 /* protocol specific information. */ 4285 /* ------------------------------------------------------------------------ */ 4286 void 4287 ipf_state_log(ipf_main_softc_t *softc, struct ipstate *is, u_int type) 4288 { 4289 #ifdef IPFILTER_LOG 4290 struct ipslog ipsl; 4291 size_t sizes[1]; 4292 void *items[1]; 4293 int types[1]; 4294 4295 /* 4296 * Copy information out of the ipstate_t structure and into the 4297 * structure used for logging. 4298 */ 4299 ipsl.isl_type = type; 4300 ipsl.isl_pkts[0] = is->is_pkts[0] + is->is_icmppkts[0]; 4301 ipsl.isl_bytes[0] = is->is_bytes[0]; 4302 ipsl.isl_pkts[1] = is->is_pkts[1] + is->is_icmppkts[1]; 4303 ipsl.isl_bytes[1] = is->is_bytes[1]; 4304 ipsl.isl_pkts[2] = is->is_pkts[2] + is->is_icmppkts[2]; 4305 ipsl.isl_bytes[2] = is->is_bytes[2]; 4306 ipsl.isl_pkts[3] = is->is_pkts[3] + is->is_icmppkts[3]; 4307 ipsl.isl_bytes[3] = is->is_bytes[3]; 4308 ipsl.isl_src = is->is_src; 4309 ipsl.isl_dst = is->is_dst; 4310 ipsl.isl_p = is->is_p; 4311 ipsl.isl_v = is->is_v; 4312 ipsl.isl_flags = is->is_flags; 4313 ipsl.isl_tag = is->is_tag; 4314 ipsl.isl_rulen = is->is_rulen; 4315 (void) strncpy(ipsl.isl_group, is->is_group, FR_GROUPLEN); 4316 4317 if (ipsl.isl_p == IPPROTO_TCP || ipsl.isl_p == IPPROTO_UDP) { 4318 ipsl.isl_sport = is->is_sport; 4319 ipsl.isl_dport = is->is_dport; 4320 if (ipsl.isl_p == IPPROTO_TCP) { 4321 ipsl.isl_state[0] = is->is_state[0]; 4322 ipsl.isl_state[1] = is->is_state[1]; 4323 } 4324 } else if (ipsl.isl_p == IPPROTO_ICMP) { 4325 ipsl.isl_itype = is->is_icmp.ici_type; 4326 } else if (ipsl.isl_p == IPPROTO_ICMPV6) { 4327 ipsl.isl_itype = is->is_icmp.ici_type; 4328 } else { 4329 ipsl.isl_ps.isl_filler[0] = 0; 4330 ipsl.isl_ps.isl_filler[1] = 0; 4331 } 4332 4333 items[0] = &ipsl; 4334 sizes[0] = sizeof(ipsl); 4335 types[0] = 0; 4336 4337 (void) ipf_log_items(softc, IPL_LOGSTATE, NULL, items, sizes, types, 1); 4338 #endif 4339 } 4340 4341 4342 #ifdef USE_INET6 4343 /* ------------------------------------------------------------------------ */ 4344 /* Function: ipf_checkicmp6matchingstate */ 4345 /* Returns: ipstate_t* - NULL == no match found, */ 4346 /* else pointer to matching state entry */ 4347 /* Parameters: fin(I) - pointer to packet information */ 4348 /* Locks: NULL == no locks, else Read Lock on ipf_state */ 4349 /* */ 4350 /* If we've got an ICMPv6 error message, using the information stored in */ 4351 /* the ICMPv6 packet, look for a matching state table entry. */ 4352 /* ------------------------------------------------------------------------ */ 4353 static ipstate_t * 4354 ipf_checkicmp6matchingstate(fr_info_t *fin) 4355 { 4356 ipf_main_softc_t *softc = fin->fin_main_soft; 4357 ipf_state_softc_t *softs = softc->ipf_state_soft; 4358 struct icmp6_hdr *ic6, *oic; 4359 ipstate_t *is, **isp; 4360 u_short sport, dport; 4361 i6addr_t dst, src; 4362 u_short savelen; 4363 icmpinfo_t *ic; 4364 fr_info_t ofin; 4365 tcphdr_t *tcp; 4366 ip6_t *oip6; 4367 u_char pr; 4368 u_int hv; 4369 int type; 4370 4371 /* 4372 * Does it at least have the return (basic) IP header ? 4373 * Is it an actual recognised ICMP error type? 4374 * Only a basic IP header (no options) should be with 4375 * an ICMP error header. 4376 */ 4377 if ((fin->fin_v != 6) || (fin->fin_plen < ICMP6ERR_MINPKTLEN) || 4378 !(fin->fin_flx & FI_ICMPERR)) { 4379 SBUMPD(ipf_state_stats, iss_icmp_bad); 4380 return (NULL); 4381 } 4382 4383 ic6 = fin->fin_dp; 4384 type = ic6->icmp6_type; 4385 4386 oip6 = (ip6_t *)((char *)ic6 + ICMPERR_ICMPHLEN); 4387 if (fin->fin_plen < sizeof(*oip6)) { 4388 SBUMPD(ipf_state_stats, iss_icmp_short); 4389 return (NULL); 4390 } 4391 4392 bcopy((char *)fin, (char *)&ofin, sizeof(*fin)); 4393 ofin.fin_v = 6; 4394 ofin.fin_ifp = fin->fin_ifp; 4395 ofin.fin_out = !fin->fin_out; 4396 ofin.fin_m = NULL; /* if dereferenced, panic XXX */ 4397 ofin.fin_mp = NULL; /* if dereferenced, panic XXX */ 4398 4399 /* 4400 * We make a fin entry to be able to feed it to 4401 * matchsrcdst. Note that not all fields are necessary 4402 * but this is the cleanest way. Note further we fill 4403 * in fin_mp such that if someone uses it we'll get 4404 * a kernel panic. ipf_matchsrcdst does not use this. 4405 * 4406 * watch out here, as ip is in host order and oip6 in network 4407 * order. Any change we make must be undone afterwards. 4408 */ 4409 savelen = oip6->ip6_plen; 4410 oip6->ip6_plen = htons(fin->fin_dlen - ICMPERR_ICMPHLEN); 4411 ofin.fin_flx = FI_NOCKSUM; 4412 ofin.fin_ip = (ip_t *)oip6; 4413 (void) ipf_makefrip(sizeof(*oip6), (ip_t *)oip6, &ofin); 4414 ofin.fin_flx &= ~(FI_BAD|FI_SHORT); 4415 oip6->ip6_plen = savelen; 4416 pr = ofin.fin_p; 4417 4418 /* 4419 * an ICMP error can never generate an ICMP error in response. 4420 */ 4421 if (ofin.fin_flx & FI_ICMPERR) { 4422 DT1(iss_icmp6_icmperr, fr_info_t *, &ofin); 4423 SBUMP(ipf_state_stats.iss_icmp6_icmperr); 4424 return (NULL); 4425 } 4426 4427 if (oip6->ip6_nxt == IPPROTO_ICMPV6) { 4428 oic = ofin.fin_dp; 4429 /* 4430 * an ICMP error can only be generated as a result of an 4431 * ICMP query, not as the response on an ICMP error 4432 * 4433 * XXX theoretically ICMP_ECHOREP and the other reply's are 4434 * ICMP query's as well, but adding them here seems strange XXX 4435 */ 4436 if (!(oic->icmp6_type & ICMP6_INFOMSG_MASK)) { 4437 DT1(iss_icmp6_notinfo, fr_info_t *, &ofin); 4438 SBUMP(ipf_state_stats.iss_icmp6_notinfo); 4439 return (NULL); 4440 } 4441 4442 /* 4443 * perform a lookup of the ICMP packet in the state table 4444 */ 4445 hv = (pr = oip6->ip6_nxt); 4446 src.in6 = oip6->ip6_src; 4447 hv += src.in4.s_addr; 4448 dst.in6 = oip6->ip6_dst; 4449 hv += dst.in4.s_addr; 4450 hv += oic->icmp6_id; 4451 hv += oic->icmp6_seq; 4452 hv = DOUBLE_HASH(hv); 4453 4454 READ_ENTER(&softc->ipf_state); 4455 for (isp = &softs->ipf_state_table[hv]; 4456 ((is = *isp) != NULL); ) { 4457 ic = &is->is_icmp; 4458 isp = &is->is_hnext; 4459 if ((is->is_p == pr) && 4460 !(is->is_pass & FR_NOICMPERR) && 4461 (oic->icmp6_id == ic->ici_id) && 4462 (oic->icmp6_seq == ic->ici_seq) && 4463 (is = ipf_matchsrcdst(&ofin, is, &src, 4464 &dst, NULL, FI_ICMPCMP))) { 4465 /* 4466 * in the state table ICMP query's are stored 4467 * with the type of the corresponding ICMP 4468 * response. Correct here 4469 */ 4470 if (((ic->ici_type == ICMP6_ECHO_REPLY) && 4471 (oic->icmp6_type == ICMP6_ECHO_REQUEST)) || 4472 (ic->ici_type - 1 == oic->icmp6_type )) { 4473 if (!ipf_allowstateicmp(fin, is, &src)) 4474 return (is); 4475 } 4476 } 4477 } 4478 RWLOCK_EXIT(&softc->ipf_state); 4479 SBUMPD(ipf_state_stats, iss_icmp6_miss); 4480 return (NULL); 4481 } 4482 4483 hv = (pr = oip6->ip6_nxt); 4484 src.in6 = oip6->ip6_src; 4485 hv += src.i6[0]; 4486 hv += src.i6[1]; 4487 hv += src.i6[2]; 4488 hv += src.i6[3]; 4489 dst.in6 = oip6->ip6_dst; 4490 hv += dst.i6[0]; 4491 hv += dst.i6[1]; 4492 hv += dst.i6[2]; 4493 hv += dst.i6[3]; 4494 4495 tcp = NULL; 4496 4497 switch (oip6->ip6_nxt) 4498 { 4499 case IPPROTO_TCP : 4500 case IPPROTO_UDP : 4501 tcp = (tcphdr_t *)(oip6 + 1); 4502 dport = tcp->th_dport; 4503 sport = tcp->th_sport; 4504 hv += dport; 4505 hv += sport; 4506 break; 4507 4508 case IPPROTO_ICMPV6 : 4509 oic = (struct icmp6_hdr *)(oip6 + 1); 4510 hv += oic->icmp6_id; 4511 hv += oic->icmp6_seq; 4512 break; 4513 4514 default : 4515 break; 4516 } 4517 4518 hv = DOUBLE_HASH(hv); 4519 4520 READ_ENTER(&softc->ipf_state); 4521 for (isp = &softs->ipf_state_table[hv]; ((is = *isp) != NULL); ) { 4522 isp = &is->is_hnext; 4523 /* 4524 * Only allow this icmp though if the 4525 * encapsulated packet was allowed through the 4526 * other way around. Note that the minimal amount 4527 * of info present does not allow for checking against 4528 * tcp internals such as seq and ack numbers. 4529 */ 4530 if ((is->is_p != pr) || (is->is_v != 6) || 4531 (is->is_pass & FR_NOICMPERR)) 4532 continue; 4533 is = ipf_matchsrcdst(&ofin, is, &src, &dst, tcp, FI_ICMPCMP); 4534 if ((is != NULL) && (ipf_allowstateicmp(fin, is, &src) == 0)) 4535 return (is); 4536 } 4537 RWLOCK_EXIT(&softc->ipf_state); 4538 SBUMPD(ipf_state_stats, iss_icmp_miss); 4539 return (NULL); 4540 } 4541 #endif 4542 4543 4544 /* ------------------------------------------------------------------------ */ 4545 /* Function: ipf_sttab_init */ 4546 /* Returns: Nil */ 4547 /* Parameters: softc(I) - pointer to soft context main structure */ 4548 /* tqp(I) - pointer to an array of timeout queues for TCP */ 4549 /* */ 4550 /* Initialise the array of timeout queues for TCP. */ 4551 /* ------------------------------------------------------------------------ */ 4552 void 4553 ipf_sttab_init(ipf_main_softc_t *softc, ipftq_t *tqp) 4554 { 4555 int i; 4556 4557 for (i = IPF_TCP_NSTATES - 1; i >= 0; i--) { 4558 IPFTQ_INIT(&tqp[i], 0, "ipftq tcp tab"); 4559 tqp[i].ifq_next = tqp + i + 1; 4560 } 4561 tqp[IPF_TCP_NSTATES - 1].ifq_next = NULL; 4562 tqp[IPF_TCPS_CLOSED].ifq_ttl = softc->ipf_tcpclosed; 4563 tqp[IPF_TCPS_LISTEN].ifq_ttl = softc->ipf_tcptimeout; 4564 tqp[IPF_TCPS_SYN_SENT].ifq_ttl = softc->ipf_tcpsynsent; 4565 tqp[IPF_TCPS_SYN_RECEIVED].ifq_ttl = softc->ipf_tcpsynrecv; 4566 tqp[IPF_TCPS_ESTABLISHED].ifq_ttl = softc->ipf_tcpidletimeout; 4567 tqp[IPF_TCPS_CLOSE_WAIT].ifq_ttl = softc->ipf_tcphalfclosed; 4568 tqp[IPF_TCPS_FIN_WAIT_1].ifq_ttl = softc->ipf_tcphalfclosed; 4569 tqp[IPF_TCPS_CLOSING].ifq_ttl = softc->ipf_tcptimeout; 4570 tqp[IPF_TCPS_LAST_ACK].ifq_ttl = softc->ipf_tcplastack; 4571 tqp[IPF_TCPS_FIN_WAIT_2].ifq_ttl = softc->ipf_tcpclosewait; 4572 tqp[IPF_TCPS_TIME_WAIT].ifq_ttl = softc->ipf_tcptimewait; 4573 tqp[IPF_TCPS_HALF_ESTAB].ifq_ttl = softc->ipf_tcptimeout; 4574 } 4575 4576 4577 /* ------------------------------------------------------------------------ */ 4578 /* Function: ipf_sttab_destroy */ 4579 /* Returns: Nil */ 4580 /* Parameters: tqp(I) - pointer to an array of timeout queues for TCP */ 4581 /* */ 4582 /* Do whatever is necessary to "destroy" each of the entries in the array */ 4583 /* of timeout queues for TCP. */ 4584 /* ------------------------------------------------------------------------ */ 4585 void 4586 ipf_sttab_destroy(ipftq_t *tqp) 4587 { 4588 int i; 4589 4590 for (i = IPF_TCP_NSTATES - 1; i >= 0; i--) 4591 MUTEX_DESTROY(&tqp[i].ifq_lock); 4592 } 4593 4594 4595 /* ------------------------------------------------------------------------ */ 4596 /* Function: ipf_state_deref */ 4597 /* Returns: Nil */ 4598 /* Parameters: softc(I) - pointer to soft context main structure */ 4599 /* isp(I) - pointer to pointer to state table entry */ 4600 /* */ 4601 /* Decrement the reference counter for this state table entry and free it */ 4602 /* if there are no more things using it. */ 4603 /* */ 4604 /* This function is only called when cleaning up after increasing is_ref by */ 4605 /* one earlier in the 'code path' so if is_ref is 1 when entering, we do */ 4606 /* have an orphan, otherwise not. However there is a possible race between */ 4607 /* the entry being deleted via flushing with an ioctl call (that calls the */ 4608 /* delete function directly) and the tail end of packet processing so we */ 4609 /* need to grab is_lock before doing the check to synchronise the two code */ 4610 /* paths. */ 4611 /* */ 4612 /* When operating in userland (ipftest), we have no timers to clear a state */ 4613 /* entry. Therefore, we make a few simple tests before deleting an entry */ 4614 /* outright. We compare states on each side looking for a combination of */ 4615 /* TIME_WAIT (should really be FIN_WAIT_2?) and LAST_ACK. Then we factor */ 4616 /* in packet direction with the interface list to make sure we don't */ 4617 /* prematurely delete an entry on a final inbound packet that's we're also */ 4618 /* supposed to route elsewhere. */ 4619 /* */ 4620 /* Internal parameters: */ 4621 /* state[0] = state of source (host that initiated connection) */ 4622 /* state[1] = state of dest (host that accepted the connection) */ 4623 /* */ 4624 /* dir == 0 : a packet from source to dest */ 4625 /* dir == 1 : a packet from dest to source */ 4626 /* ------------------------------------------------------------------------ */ 4627 void 4628 ipf_state_deref(ipf_main_softc_t *softc, ipstate_t **isp) 4629 { 4630 ipstate_t *is = *isp; 4631 4632 is = *isp; 4633 *isp = NULL; 4634 4635 MUTEX_ENTER(&is->is_lock); 4636 if (is->is_ref > 1) { 4637 is->is_ref--; 4638 MUTEX_EXIT(&is->is_lock); 4639 #ifndef _KERNEL 4640 if ((is->is_sti.tqe_state[0] > IPF_TCPS_ESTABLISHED) || 4641 (is->is_sti.tqe_state[1] > IPF_TCPS_ESTABLISHED)) { 4642 ipf_state_del(softc, is, ISL_EXPIRE); 4643 } 4644 #endif 4645 return; 4646 } 4647 MUTEX_EXIT(&is->is_lock); 4648 4649 WRITE_ENTER(&softc->ipf_state); 4650 ipf_state_del(softc, is, ISL_ORPHAN); 4651 RWLOCK_EXIT(&softc->ipf_state); 4652 } 4653 4654 4655 /* ------------------------------------------------------------------------ */ 4656 /* Function: ipf_state_setqueue */ 4657 /* Returns: Nil */ 4658 /* Parameters: softc(I) - pointer to soft context main structure */ 4659 /* is(I) - pointer to state structure */ 4660 /* rev(I) - forward(0) or reverse(1) direction */ 4661 /* Locks: ipf_state (read or write) */ 4662 /* */ 4663 /* Put the state entry on its default queue entry, using rev as a helped in */ 4664 /* determining which queue it should be placed on. */ 4665 /* ------------------------------------------------------------------------ */ 4666 void 4667 ipf_state_setqueue(ipf_main_softc_t *softc, ipstate_t *is, int rev) 4668 { 4669 ipf_state_softc_t *softs = softc->ipf_state_soft; 4670 ipftq_t *oifq, *nifq; 4671 4672 if ((is->is_sti.tqe_flags & TQE_RULEBASED) != 0) 4673 nifq = is->is_tqehead[rev]; 4674 else 4675 nifq = NULL; 4676 4677 if (nifq == NULL) { 4678 switch (is->is_p) 4679 { 4680 #ifdef USE_INET6 4681 case IPPROTO_ICMPV6 : 4682 if (rev == 1) 4683 nifq = &softs->ipf_state_icmpacktq; 4684 else 4685 nifq = &softs->ipf_state_icmptq; 4686 break; 4687 #endif 4688 case IPPROTO_ICMP : 4689 if (rev == 1) 4690 nifq = &softs->ipf_state_icmpacktq; 4691 else 4692 nifq = &softs->ipf_state_icmptq; 4693 break; 4694 case IPPROTO_TCP : 4695 nifq = softs->ipf_state_tcptq + is->is_state[rev]; 4696 break; 4697 4698 case IPPROTO_UDP : 4699 if (rev == 1) 4700 nifq = &softs->ipf_state_udpacktq; 4701 else 4702 nifq = &softs->ipf_state_udptq; 4703 break; 4704 4705 default : 4706 nifq = &softs->ipf_state_iptq; 4707 break; 4708 } 4709 } 4710 4711 oifq = is->is_sti.tqe_ifq; 4712 /* 4713 * If it's currently on a timeout queue, move it from one queue to 4714 * another, else put it on the end of the newly determined queue. 4715 */ 4716 if (oifq != NULL) 4717 ipf_movequeue(softc->ipf_ticks, &is->is_sti, oifq, nifq); 4718 else 4719 ipf_queueappend(softc->ipf_ticks, &is->is_sti, nifq, is); 4720 return; 4721 } 4722 4723 4724 /* ------------------------------------------------------------------------ */ 4725 /* Function: ipf_state_iter */ 4726 /* Returns: int - 0 == success, else error */ 4727 /* Parameters: softc(I) - pointer to main soft context */ 4728 /* token(I) - pointer to ipftoken structure */ 4729 /* itp(I) - pointer to ipfgeniter structure */ 4730 /* obj(I) - pointer to data description structure */ 4731 /* */ 4732 /* This function handles the SIOCGENITER ioctl for the state tables and */ 4733 /* walks through the list of entries in the state table list (softs->ipf_state_list.) */ 4734 /* ------------------------------------------------------------------------ */ 4735 static int 4736 ipf_state_iter(ipf_main_softc_t *softc, ipftoken_t *token, ipfgeniter_t *itp, 4737 ipfobj_t *obj) 4738 { 4739 ipf_state_softc_t *softs = softc->ipf_state_soft; 4740 ipstate_t *is, *next, zero; 4741 int error; 4742 4743 if (itp->igi_data == NULL) { 4744 IPFERROR(100026); 4745 return (EFAULT); 4746 } 4747 4748 if (itp->igi_nitems < 1) { 4749 IPFERROR(100027); 4750 return (ENOSPC); 4751 } 4752 4753 if (itp->igi_type != IPFGENITER_STATE) { 4754 IPFERROR(100028); 4755 return (EINVAL); 4756 } 4757 4758 is = token->ipt_data; 4759 if (is == (void *)-1) { 4760 IPFERROR(100029); 4761 return (ESRCH); 4762 } 4763 4764 error = 0; 4765 obj->ipfo_type = IPFOBJ_IPSTATE; 4766 obj->ipfo_size = sizeof(ipstate_t); 4767 4768 READ_ENTER(&softc->ipf_state); 4769 4770 is = token->ipt_data; 4771 if (is == NULL) { 4772 next = softs->ipf_state_list; 4773 } else { 4774 next = is->is_next; 4775 } 4776 4777 /* 4778 * If we find a state entry to use, bump its reference count so that 4779 * it can be used for is_next when we come back. 4780 */ 4781 if (next != NULL) { 4782 MUTEX_ENTER(&next->is_lock); 4783 next->is_ref++; 4784 MUTEX_EXIT(&next->is_lock); 4785 token->ipt_data = next; 4786 } else { 4787 bzero(&zero, sizeof(zero)); 4788 next = &zero; 4789 token->ipt_data = NULL; 4790 } 4791 if (next->is_next == NULL) 4792 ipf_token_mark_complete(token); 4793 4794 RWLOCK_EXIT(&softc->ipf_state); 4795 4796 obj->ipfo_ptr = itp->igi_data; 4797 error = ipf_outobjk(softc, obj, next); 4798 if (is != NULL) 4799 ipf_state_deref(softc, &is); 4800 4801 return (error); 4802 } 4803 4804 4805 /* ------------------------------------------------------------------------ */ 4806 /* Function: ipf_state_gettable */ 4807 /* Returns: int - 0 = success, else error */ 4808 /* Parameters: softc(I) - pointer to main soft context */ 4809 /* softs(I) - pointer to state context structure */ 4810 /* data(I) - pointer to ioctl data */ 4811 /* */ 4812 /* This function handles ioctl requests for tables of state information. */ 4813 /* At present the only table it deals with is the hash bucket statistics. */ 4814 /* ------------------------------------------------------------------------ */ 4815 static int 4816 ipf_state_gettable(ipf_main_softc_t *softc, ipf_state_softc_t *softs, 4817 char *data) 4818 { 4819 ipftable_t table; 4820 int error; 4821 4822 error = ipf_inobj(softc, data, NULL, &table, IPFOBJ_GTABLE); 4823 if (error != 0) 4824 return (error); 4825 4826 if (table.ita_type != IPFTABLE_BUCKETS) { 4827 IPFERROR(100031); 4828 return (EINVAL); 4829 } 4830 4831 error = COPYOUT(softs->ipf_state_stats.iss_bucketlen, table.ita_table, 4832 softs->ipf_state_size * sizeof(u_int)); 4833 if (error != 0) { 4834 IPFERROR(100032); 4835 error = EFAULT; 4836 } 4837 return (error); 4838 } 4839 4840 4841 /* ------------------------------------------------------------------------ */ 4842 /* Function: ipf_state_setpending */ 4843 /* Returns: Nil */ 4844 /* Parameters: softc(I) - pointer to main soft context */ 4845 /* is(I) - pointer to state structure */ 4846 /* Locks: ipf_state (read or write) */ 4847 /* */ 4848 /* Put the state entry on to the pending queue - this queue has a very */ 4849 /* short lifetime where items are put that can't be deleted straight away */ 4850 /* because of locking issues but we want to delete them ASAP, anyway. */ 4851 /* ------------------------------------------------------------------------ */ 4852 void 4853 ipf_state_setpending(ipf_main_softc_t *softc, ipstate_t *is) 4854 { 4855 ipf_state_softc_t *softs = softc->ipf_state_soft; 4856 ipftq_t *oifq; 4857 4858 oifq = is->is_sti.tqe_ifq; 4859 if (oifq != NULL) 4860 ipf_movequeue(softc->ipf_ticks, &is->is_sti, oifq, 4861 &softs->ipf_state_pending); 4862 else 4863 ipf_queueappend(softc->ipf_ticks, &is->is_sti, 4864 &softs->ipf_state_pending, is); 4865 4866 MUTEX_ENTER(&is->is_lock); 4867 if (is->is_me != NULL) { 4868 *is->is_me = NULL; 4869 is->is_me = NULL; 4870 is->is_ref--; 4871 } 4872 MUTEX_EXIT(&is->is_lock); 4873 } 4874 4875 4876 /* ------------------------------------------------------------------------ */ 4877 /* Function: ipf_state_matchflush */ 4878 /* Returns: Nil */ 4879 /* Parameters: softc(I) - pointer to main soft context */ 4880 /* data(I) - pointer to state structure */ 4881 /* Locks: ipf_state (read or write) */ 4882 /* */ 4883 /* Flush all entries from the list of state entries that match the */ 4884 /* properties in the array loaded. */ 4885 /* ------------------------------------------------------------------------ */ 4886 int 4887 ipf_state_matchflush(ipf_main_softc_t *softc, caddr_t data) 4888 { 4889 ipf_state_softc_t *softs = softc->ipf_state_soft; 4890 int *array, flushed, error; 4891 ipstate_t *state, *statenext; 4892 ipfobj_t obj; 4893 4894 error = ipf_matcharray_load(softc, data, &obj, &array); 4895 if (error != 0) 4896 return (error); 4897 4898 flushed = 0; 4899 4900 for (state = softs->ipf_state_list; state != NULL; state = statenext) { 4901 statenext = state->is_next; 4902 if (ipf_state_matcharray(state, array, softc->ipf_ticks) == 0) { 4903 ipf_state_del(softc, state, ISL_FLUSH); 4904 flushed++; 4905 } 4906 } 4907 4908 obj.ipfo_retval = flushed; 4909 error = BCOPYOUT(&obj, data, sizeof(obj)); 4910 4911 KFREES(array, array[0] * sizeof(*array)); 4912 4913 return (error); 4914 } 4915 4916 4917 /* ------------------------------------------------------------------------ */ 4918 /* Function: ipf_state_matcharray */ 4919 /* Returns: int - 0 = no match, 1 = match */ 4920 /* Parameters: state(I) - pointer to state structure */ 4921 /* array(I) - pointer to ipf matching expression */ 4922 /* ticks(I) - current value of ipfilter tick timer */ 4923 /* Locks: ipf_state (read or write) */ 4924 /* */ 4925 /* Compare a state entry with the match array passed in and return a value */ 4926 /* to indicate whether or not the matching was successful. */ 4927 /* ------------------------------------------------------------------------ */ 4928 static int 4929 ipf_state_matcharray(ipstate_t *state, int *array, u_long ticks) 4930 { 4931 int i, n, *x, rv, p; 4932 ipfexp_t *e; 4933 4934 rv = 0; 4935 n = array[0]; 4936 x = array + 1; 4937 4938 for (; n > 0; x += 3 + x[3], rv = 0) { 4939 e = (ipfexp_t *)x; 4940 n -= e->ipfe_size; 4941 if (x[0] == IPF_EXP_END) 4942 break; 4943 4944 /* 4945 * If we need to match the protocol and that doesn't match, 4946 * don't even both with the instruction array. 4947 */ 4948 p = e->ipfe_cmd >> 16; 4949 if ((p != 0) && (p != state->is_p)) 4950 break; 4951 4952 switch (e->ipfe_cmd) 4953 { 4954 case IPF_EXP_IP_PR : 4955 for (i = 0; !rv && i < e->ipfe_narg; i++) { 4956 rv |= (state->is_p == e->ipfe_arg0[i]); 4957 } 4958 break; 4959 4960 case IPF_EXP_IP_SRCADDR : 4961 if (state->is_v != 4) 4962 break; 4963 for (i = 0; !rv && i < e->ipfe_narg; i++) { 4964 rv |= ((state->is_saddr & 4965 e->ipfe_arg0[i * 2 + 1]) == 4966 e->ipfe_arg0[i * 2]); 4967 } 4968 break; 4969 4970 case IPF_EXP_IP_DSTADDR : 4971 if (state->is_v != 4) 4972 break; 4973 for (i = 0; !rv && i < e->ipfe_narg; i++) { 4974 rv |= ((state->is_daddr & 4975 e->ipfe_arg0[i * 2 + 1]) == 4976 e->ipfe_arg0[i * 2]); 4977 } 4978 break; 4979 4980 case IPF_EXP_IP_ADDR : 4981 if (state->is_v != 4) 4982 break; 4983 for (i = 0; !rv && i < e->ipfe_narg; i++) { 4984 rv |= ((state->is_saddr & 4985 e->ipfe_arg0[i * 2 + 1]) == 4986 e->ipfe_arg0[i * 2]) || 4987 ((state->is_daddr & 4988 e->ipfe_arg0[i * 2 + 1]) == 4989 e->ipfe_arg0[i * 2]); 4990 } 4991 break; 4992 4993 #ifdef USE_INET6 4994 case IPF_EXP_IP6_SRCADDR : 4995 if (state->is_v != 6) 4996 break; 4997 for (i = 0; !rv && i < x[3]; i++) { 4998 rv |= IP6_MASKEQ(&state->is_src.in6, 4999 &e->ipfe_arg0[i * 8 + 4], 5000 &e->ipfe_arg0[i * 8]); 5001 } 5002 break; 5003 5004 case IPF_EXP_IP6_DSTADDR : 5005 if (state->is_v != 6) 5006 break; 5007 for (i = 0; !rv && i < x[3]; i++) { 5008 rv |= IP6_MASKEQ(&state->is_dst.in6, 5009 &e->ipfe_arg0[i * 8 + 4], 5010 &e->ipfe_arg0[i * 8]); 5011 } 5012 break; 5013 5014 case IPF_EXP_IP6_ADDR : 5015 if (state->is_v != 6) 5016 break; 5017 for (i = 0; !rv && i < x[3]; i++) { 5018 rv |= IP6_MASKEQ(&state->is_src.in6, 5019 &e->ipfe_arg0[i * 8 + 4], 5020 &e->ipfe_arg0[i * 8]) || 5021 IP6_MASKEQ(&state->is_dst.in6, 5022 &e->ipfe_arg0[i * 8 + 4], 5023 &e->ipfe_arg0[i * 8]); 5024 } 5025 break; 5026 #endif 5027 5028 case IPF_EXP_UDP_PORT : 5029 case IPF_EXP_TCP_PORT : 5030 for (i = 0; !rv && i < e->ipfe_narg; i++) { 5031 rv |= (state->is_sport == e->ipfe_arg0[i]) || 5032 (state->is_dport == e->ipfe_arg0[i]); 5033 } 5034 break; 5035 5036 case IPF_EXP_UDP_SPORT : 5037 case IPF_EXP_TCP_SPORT : 5038 for (i = 0; !rv && i < e->ipfe_narg; i++) { 5039 rv |= (state->is_sport == e->ipfe_arg0[i]); 5040 } 5041 break; 5042 5043 case IPF_EXP_UDP_DPORT : 5044 case IPF_EXP_TCP_DPORT : 5045 for (i = 0; !rv && i < e->ipfe_narg; i++) { 5046 rv |= (state->is_dport == e->ipfe_arg0[i]); 5047 } 5048 break; 5049 5050 case IPF_EXP_TCP_STATE : 5051 for (i = 0; !rv && i < e->ipfe_narg; i++) { 5052 rv |= (state->is_state[0] == e->ipfe_arg0[i]) || 5053 (state->is_state[1] == e->ipfe_arg0[i]); 5054 } 5055 break; 5056 5057 case IPF_EXP_IDLE_GT : 5058 rv |= (ticks - state->is_touched > e->ipfe_arg0[0]); 5059 break; 5060 } 5061 5062 /* 5063 * Factor in doing a negative match. 5064 */ 5065 rv ^= e->ipfe_not; 5066 5067 if (rv == 0) 5068 break; 5069 } 5070 5071 return (rv); 5072 } 5073 5074 5075 /* ------------------------------------------------------------------------ */ 5076 /* Function: ipf_state_settimeout */ 5077 /* Returns: int 0 = success, else failure */ 5078 /* Parameters: softc(I) - pointer to main soft context */ 5079 /* t(I) - pointer to tuneable being changed */ 5080 /* p(I) - pointer to the new value */ 5081 /* */ 5082 /* Sets a timeout value for one of the many timeout queues. We find the */ 5083 /* correct queue using a somewhat manual process of comparing the timeout */ 5084 /* names for each specific value available and calling ipf_apply_timeout on */ 5085 /* that queue so that all of the items on it are updated accordingly. */ 5086 /* ------------------------------------------------------------------------ */ 5087 int 5088 ipf_state_settimeout(struct ipf_main_softc_s *softc, ipftuneable_t *t, 5089 ipftuneval_t *p) 5090 { 5091 ipf_state_softc_t *softs = softc->ipf_state_soft; 5092 5093 /* 5094 * In case there is nothing to do... 5095 */ 5096 if (*t->ipft_pint == p->ipftu_int) 5097 return (0); 5098 5099 if (!strncmp(t->ipft_name, "tcp_", 4)) 5100 return (ipf_settimeout_tcp(t, p, softs->ipf_state_tcptq)); 5101 5102 if (!strcmp(t->ipft_name, "udp_timeout")) { 5103 ipf_apply_timeout(&softs->ipf_state_udptq, p->ipftu_int); 5104 } else if (!strcmp(t->ipft_name, "udp_ack_timeout")) { 5105 ipf_apply_timeout(&softs->ipf_state_udpacktq, p->ipftu_int); 5106 } else if (!strcmp(t->ipft_name, "icmp_timeout")) { 5107 ipf_apply_timeout(&softs->ipf_state_icmptq, p->ipftu_int); 5108 } else if (!strcmp(t->ipft_name, "icmp_ack_timeout")) { 5109 ipf_apply_timeout(&softs->ipf_state_icmpacktq, p->ipftu_int); 5110 } else if (!strcmp(t->ipft_name, "ip_timeout")) { 5111 ipf_apply_timeout(&softs->ipf_state_iptq, p->ipftu_int); 5112 } else { 5113 IPFERROR(100034); 5114 return (ESRCH); 5115 } 5116 5117 /* 5118 * Update the tuneable being set. 5119 */ 5120 *t->ipft_pint = p->ipftu_int; 5121 5122 return (0); 5123 } 5124 5125 5126 /* ------------------------------------------------------------------------ */ 5127 /* Function: ipf_state_rehash */ 5128 /* Returns: int 0 = success, else failure */ 5129 /* Parameters: softc(I) - pointer to main soft context */ 5130 /* t(I) - pointer to tuneable being changed */ 5131 /* p(I) - pointer to the new value */ 5132 /* */ 5133 /* To change the size of the state hash table at runtime, a new table has */ 5134 /* to be allocated and then all of the existing entries put in it, bumping */ 5135 /* up the bucketlength for it as we go along. */ 5136 /* ------------------------------------------------------------------------ */ 5137 int 5138 ipf_state_rehash(ipf_main_softc_t *softc, ipftuneable_t *t, ipftuneval_t *p) 5139 { 5140 ipf_state_softc_t *softs = softc->ipf_state_soft; 5141 ipstate_t **newtab, *is; 5142 u_long *newseed; 5143 u_int *bucketlens; 5144 u_int maxbucket; 5145 u_int newsize; 5146 u_int hv; 5147 int i; 5148 5149 newsize = p->ipftu_int; 5150 /* 5151 * In case there is nothing to do... 5152 */ 5153 if (newsize == softs->ipf_state_size) 5154 return (0); 5155 5156 KMALLOCS(newtab, ipstate_t **, newsize * sizeof(ipstate_t *)); 5157 if (newtab == NULL) { 5158 IPFERROR(100035); 5159 return (ENOMEM); 5160 } 5161 5162 KMALLOCS(bucketlens, u_int *, newsize * sizeof(u_int)); 5163 if (bucketlens == NULL) { 5164 KFREES(newtab, newsize * sizeof(*softs->ipf_state_table)); 5165 IPFERROR(100036); 5166 return (ENOMEM); 5167 } 5168 5169 newseed = ipf_state_seed_alloc(newsize, softs->ipf_state_max); 5170 if (newseed == NULL) { 5171 KFREES(bucketlens, newsize * sizeof(*bucketlens)); 5172 KFREES(newtab, newsize * sizeof(*newtab)); 5173 IPFERROR(100037); 5174 return (ENOMEM); 5175 } 5176 5177 for (maxbucket = 0, i = newsize; i > 0; i >>= 1) 5178 maxbucket++; 5179 maxbucket *= 2; 5180 5181 bzero((char *)newtab, newsize * sizeof(ipstate_t *)); 5182 bzero((char *)bucketlens, newsize * sizeof(u_int)); 5183 5184 WRITE_ENTER(&softc->ipf_state); 5185 5186 if (softs->ipf_state_table != NULL) { 5187 KFREES(softs->ipf_state_table, 5188 softs->ipf_state_size * sizeof(*softs->ipf_state_table)); 5189 } 5190 softs->ipf_state_table = newtab; 5191 5192 if (softs->ipf_state_seed != NULL) { 5193 KFREES(softs->ipf_state_seed, 5194 softs->ipf_state_size * sizeof(*softs->ipf_state_seed)); 5195 } 5196 softs->ipf_state_seed = newseed; 5197 5198 if (softs->ipf_state_stats.iss_bucketlen != NULL) { 5199 KFREES(softs->ipf_state_stats.iss_bucketlen, 5200 softs->ipf_state_size * sizeof(u_int)); 5201 } 5202 softs->ipf_state_stats.iss_bucketlen = bucketlens; 5203 softs->ipf_state_maxbucket = maxbucket; 5204 softs->ipf_state_size = newsize; 5205 5206 /* 5207 * Walk through the entire list of state table entries and put them 5208 * in the new state table, somewhere. Because we have a new table, 5209 * we need to restart the counter of how many chains are in use. 5210 */ 5211 softs->ipf_state_stats.iss_inuse = 0; 5212 for (is = softs->ipf_state_list; is != NULL; is = is->is_next) { 5213 is->is_hnext = NULL; 5214 is->is_phnext = NULL; 5215 hv = is->is_hv % softs->ipf_state_size; 5216 5217 if (softs->ipf_state_table[hv] != NULL) 5218 softs->ipf_state_table[hv]->is_phnext = &is->is_hnext; 5219 else 5220 softs->ipf_state_stats.iss_inuse++; 5221 is->is_phnext = softs->ipf_state_table + hv; 5222 is->is_hnext = softs->ipf_state_table[hv]; 5223 softs->ipf_state_table[hv] = is; 5224 softs->ipf_state_stats.iss_bucketlen[hv]++; 5225 } 5226 RWLOCK_EXIT(&softc->ipf_state); 5227 5228 return (0); 5229 } 5230 5231 5232 /* ------------------------------------------------------------------------ */ 5233 /* Function: ipf_state_add_tq */ 5234 /* Returns: ipftq_t * - NULL = failure, else pointer to new timeout */ 5235 /* queue */ 5236 /* Parameters: softc(I) - pointer to main soft context */ 5237 /* ttl(I) - pointer to the ttl for the new queue */ 5238 /* */ 5239 /* Request a pointer to a timeout queue that has a ttl as given by the */ 5240 /* value being passed in. The timeout queue is added tot the list of those */ 5241 /* used internally for stateful filtering. */ 5242 /* ------------------------------------------------------------------------ */ 5243 ipftq_t * 5244 ipf_state_add_tq(ipf_main_softc_t *softc, int ttl) 5245 { 5246 ipf_state_softc_t *softs = softc->ipf_state_soft; 5247 5248 return (ipf_addtimeoutqueue(softc, &softs->ipf_state_usertq, ttl)); 5249 } 5250 5251 5252 #ifndef _KERNEL 5253 /* 5254 * Display the built up state table rules and mapping entries. 5255 */ 5256 void 5257 ipf_state_dump(ipf_main_softc_t *softc, void *arg) 5258 { 5259 ipf_state_softc_t *softs = arg; 5260 ipstate_t *ips; 5261 5262 printf("List of active state sessions:\n"); 5263 for (ips = softs->ipf_state_list; ips != NULL; ) 5264 ips = printstate(ips, opts & (OPT_DEBUG|OPT_VERBOSE), 5265 softc->ipf_ticks); 5266 } 5267 #endif 5268