1 /* $OpenBSD: pf.c,v 1.380 2003/07/29 20:56:55 dhartmei Exp $ */ 2 3 /* 4 * Copyright (c) 2001 Daniel Hartmeier 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * - Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * - Redistributions in binary form must reproduce the above 14 * copyright notice, this list of conditions and the following 15 * disclaimer in the documentation and/or other materials provided 16 * with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 21 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 22 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 24 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 25 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 26 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 28 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 * 31 * Effort sponsored in part by the Defense Advanced Research Projects 32 * Agency (DARPA) and Air Force Research Laboratory, Air Force 33 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 34 * 35 */ 36 37 #include "bpfilter.h" 38 #include "pflog.h" 39 #include "pfsync.h" 40 41 #include <sys/param.h> 42 #include <sys/systm.h> 43 #include <sys/mbuf.h> 44 #include <sys/filio.h> 45 #include <sys/socket.h> 46 #include <sys/socketvar.h> 47 #include <sys/kernel.h> 48 #include <sys/time.h> 49 #include <sys/pool.h> 50 51 #include <net/if.h> 52 #include <net/if_types.h> 53 #include <net/bpf.h> 54 #include <net/route.h> 55 56 #include <netinet/in.h> 57 #include <netinet/in_var.h> 58 #include <netinet/in_systm.h> 59 #include <netinet/ip.h> 60 #include <netinet/ip_var.h> 61 #include <netinet/tcp.h> 62 #include <netinet/tcp_seq.h> 63 #include <netinet/udp.h> 64 #include <netinet/ip_icmp.h> 65 #include <netinet/in_pcb.h> 66 #include <netinet/tcp_timer.h> 67 #include <netinet/tcp_var.h> 68 #include <netinet/udp_var.h> 69 #include <netinet/icmp_var.h> 70 71 #include <dev/rndvar.h> 72 #include <net/pfvar.h> 73 #include <net/if_pflog.h> 74 #include <net/if_pfsync.h> 75 76 #ifdef INET6 77 #include <netinet/ip6.h> 78 #include <netinet/in_pcb.h> 79 #include <netinet/icmp6.h> 80 #include <netinet6/nd6.h> 81 #endif /* INET6 */ 82 83 #ifdef ALTQ 84 #include <altq/if_altq.h> 85 #endif 86 87 88 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x 89 struct pf_state_tree; 90 91 /* 92 * Global variables 93 */ 94 95 struct pf_anchorqueue pf_anchors; 96 struct pf_ruleset pf_main_ruleset; 97 struct pf_altqqueue pf_altqs[2]; 98 struct pf_palist pf_pabuf; 99 struct pf_altqqueue *pf_altqs_active; 100 struct pf_altqqueue *pf_altqs_inactive; 101 struct pf_status pf_status; 102 struct ifnet *status_ifp; 103 104 u_int32_t ticket_altqs_active; 105 u_int32_t ticket_altqs_inactive; 106 u_int32_t ticket_pabuf; 107 108 struct timeout pf_expire_to; /* expire timeout */ 109 110 struct pool pf_tree_pl, pf_rule_pl, pf_addr_pl; 111 struct pool pf_state_pl, pf_altq_pl, pf_pooladdr_pl; 112 113 void pf_dynaddr_update(void *); 114 void pf_print_host(struct pf_addr *, u_int16_t, u_int8_t); 115 void pf_print_state(struct pf_state *); 116 void pf_print_flags(u_int8_t); 117 118 u_int16_t pf_cksum_fixup(u_int16_t, u_int16_t, u_int16_t, 119 u_int8_t); 120 void pf_change_ap(struct pf_addr *, u_int16_t *, 121 u_int16_t *, u_int16_t *, struct pf_addr *, 122 u_int16_t, u_int8_t, sa_family_t); 123 #ifdef INET6 124 void pf_change_a6(struct pf_addr *, u_int16_t *, 125 struct pf_addr *, u_int8_t); 126 #endif /* INET6 */ 127 void pf_change_icmp(struct pf_addr *, u_int16_t *, 128 struct pf_addr *, struct pf_addr *, u_int16_t, 129 u_int16_t *, u_int16_t *, u_int16_t *, 130 u_int16_t *, u_int8_t, sa_family_t); 131 void pf_send_tcp(const struct pf_rule *, sa_family_t, 132 const struct pf_addr *, const struct pf_addr *, 133 u_int16_t, u_int16_t, u_int32_t, u_int32_t, 134 u_int8_t, u_int16_t, u_int16_t, u_int8_t); 135 void pf_send_icmp(struct mbuf *, u_int8_t, u_int8_t, 136 sa_family_t, struct pf_rule *); 137 struct pf_rule *pf_match_translation(int, struct ifnet *, u_int8_t, 138 struct pf_addr *, u_int16_t, struct pf_addr *, 139 u_int16_t, sa_family_t, int); 140 struct pf_rule *pf_get_translation(int, struct ifnet *, u_int8_t, 141 struct pf_addr *, u_int16_t, 142 struct pf_addr *, u_int16_t, 143 struct pf_addr *, u_int16_t *, sa_family_t); 144 int pf_test_tcp(struct pf_rule **, struct pf_state **, 145 int, struct ifnet *, struct mbuf *, int, int, 146 void *, struct pf_pdesc *, struct pf_rule **, 147 struct pf_ruleset **); 148 int pf_test_udp(struct pf_rule **, struct pf_state **, 149 int, struct ifnet *, struct mbuf *, int, int, 150 void *, struct pf_pdesc *, struct pf_rule **, 151 struct pf_ruleset **); 152 int pf_test_icmp(struct pf_rule **, struct pf_state **, 153 int, struct ifnet *, struct mbuf *, int, int, 154 void *, struct pf_pdesc *, struct pf_rule **, 155 struct pf_ruleset **); 156 int pf_test_other(struct pf_rule **, struct pf_state **, 157 int, struct ifnet *, struct mbuf *, void *, 158 struct pf_pdesc *, struct pf_rule **, 159 struct pf_ruleset **); 160 int pf_test_fragment(struct pf_rule **, int, 161 struct ifnet *, struct mbuf *, void *, 162 struct pf_pdesc *, struct pf_rule **, 163 struct pf_ruleset **); 164 int pf_test_state_tcp(struct pf_state **, int, 165 struct ifnet *, struct mbuf *, int, int, 166 void *, struct pf_pdesc *, u_short *); 167 int pf_test_state_udp(struct pf_state **, int, 168 struct ifnet *, struct mbuf *, int, int, 169 void *, struct pf_pdesc *); 170 int pf_test_state_icmp(struct pf_state **, int, 171 struct ifnet *, struct mbuf *, int, int, 172 void *, struct pf_pdesc *); 173 int pf_test_state_other(struct pf_state **, int, 174 struct ifnet *, struct pf_pdesc *); 175 struct pf_tag *pf_get_tag(struct mbuf *); 176 int pf_match_tag(struct mbuf *, struct pf_rule *, 177 struct pf_rule *, struct pf_rule *, 178 struct pf_tag *, int *); 179 180 #ifdef INET6 181 void pf_poolmask(struct pf_addr *, struct pf_addr*, 182 struct pf_addr *, struct pf_addr *, u_int8_t); 183 void pf_addr_inc(struct pf_addr *, sa_family_t); 184 #endif /* INET6 */ 185 186 void pf_hash(struct pf_addr *, struct pf_addr *, 187 struct pf_poolhashkey *, sa_family_t); 188 int pf_map_addr(u_int8_t, struct pf_pool *, 189 struct pf_addr *, struct pf_addr *, 190 struct pf_addr *); 191 int pf_get_sport(sa_family_t, u_int8_t, struct pf_pool *, 192 struct pf_addr *, struct pf_addr *, u_int16_t, 193 struct pf_addr *, u_int16_t*, u_int16_t, u_int16_t); 194 void pf_route(struct mbuf **, struct pf_rule *, int, 195 struct ifnet *, struct pf_state *); 196 void pf_route6(struct mbuf **, struct pf_rule *, int, 197 struct ifnet *, struct pf_state *); 198 int pf_socket_lookup(uid_t *, gid_t *, int, sa_family_t, 199 int, struct pf_pdesc *); 200 u_int8_t pf_get_wscale(struct mbuf *, int, u_int16_t, 201 sa_family_t); 202 u_int16_t pf_get_mss(struct mbuf *, int, u_int16_t, 203 sa_family_t); 204 u_int16_t pf_calc_mss(struct pf_addr *, sa_family_t, 205 u_int16_t); 206 void pf_set_rt_ifp(struct pf_state *, 207 struct pf_addr *); 208 int pf_check_proto_cksum(struct mbuf *, int, int, 209 u_int8_t, sa_family_t); 210 int pf_addr_wrap_neq(struct pf_addr_wrap *, 211 struct pf_addr_wrap *); 212 213 214 struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX] = 215 { { &pf_state_pl, PFSTATE_HIWAT }, { &pf_frent_pl, PFFRAG_FRENT_HIWAT } }; 216 217 #define STATE_LOOKUP() \ 218 do { \ 219 if (direction == PF_IN) \ 220 *state = pf_find_state(&tree_ext_gwy, &key); \ 221 else \ 222 *state = pf_find_state(&tree_lan_ext, &key); \ 223 if (*state == NULL) \ 224 return (PF_DROP); \ 225 if (direction == PF_OUT && \ 226 (((*state)->rule.ptr->rt == PF_ROUTETO && \ 227 (*state)->rule.ptr->direction == PF_OUT) || \ 228 ((*state)->rule.ptr->rt == PF_REPLYTO && \ 229 (*state)->rule.ptr->direction == PF_IN)) && \ 230 (*state)->rt_ifp != NULL && \ 231 (*state)->rt_ifp != ifp) \ 232 return (PF_PASS); \ 233 } while (0) 234 235 #define STATE_TRANSLATE(s) \ 236 (s)->lan.addr.addr32[0] != (s)->gwy.addr.addr32[0] || \ 237 ((s)->af == AF_INET6 && \ 238 ((s)->lan.addr.addr32[1] != (s)->gwy.addr.addr32[1] || \ 239 (s)->lan.addr.addr32[2] != (s)->gwy.addr.addr32[2] || \ 240 (s)->lan.addr.addr32[3] != (s)->gwy.addr.addr32[3])) || \ 241 (s)->lan.port != (s)->gwy.port 242 243 static __inline int pf_state_compare(struct pf_tree_node *, 244 struct pf_tree_node *); 245 246 struct pf_state_tree tree_lan_ext, tree_ext_gwy; 247 RB_GENERATE(pf_state_tree, pf_tree_node, entry, pf_state_compare); 248 249 static __inline int 250 pf_state_compare(struct pf_tree_node *a, struct pf_tree_node *b) 251 { 252 int diff; 253 254 if ((diff = a->proto - b->proto) != 0) 255 return (diff); 256 if ((diff = a->af - b->af) != 0) 257 return (diff); 258 switch (a->af) { 259 #ifdef INET 260 case AF_INET: 261 if (a->addr[0].addr32[0] > b->addr[0].addr32[0]) 262 return (1); 263 if (a->addr[0].addr32[0] < b->addr[0].addr32[0]) 264 return (-1); 265 if (a->addr[1].addr32[0] > b->addr[1].addr32[0]) 266 return (1); 267 if (a->addr[1].addr32[0] < b->addr[1].addr32[0]) 268 return (-1); 269 break; 270 #endif /* INET */ 271 #ifdef INET6 272 case AF_INET6: 273 if (a->addr[0].addr32[3] > b->addr[0].addr32[3]) 274 return (1); 275 if (a->addr[0].addr32[3] < b->addr[0].addr32[3]) 276 return (-1); 277 if (a->addr[1].addr32[3] > b->addr[1].addr32[3]) 278 return (1); 279 if (a->addr[1].addr32[3] < b->addr[1].addr32[3]) 280 return (-1); 281 if (a->addr[0].addr32[2] > b->addr[0].addr32[2]) 282 return (1); 283 if (a->addr[0].addr32[2] < b->addr[0].addr32[2]) 284 return (-1); 285 if (a->addr[1].addr32[2] > b->addr[1].addr32[2]) 286 return (1); 287 if (a->addr[1].addr32[2] < b->addr[1].addr32[2]) 288 return (-1); 289 if (a->addr[0].addr32[1] > b->addr[0].addr32[1]) 290 return (1); 291 if (a->addr[0].addr32[1] < b->addr[0].addr32[1]) 292 return (-1); 293 if (a->addr[1].addr32[1] > b->addr[1].addr32[1]) 294 return (1); 295 if (a->addr[1].addr32[1] < b->addr[1].addr32[1]) 296 return (-1); 297 if (a->addr[0].addr32[0] > b->addr[0].addr32[0]) 298 return (1); 299 if (a->addr[0].addr32[0] < b->addr[0].addr32[0]) 300 return (-1); 301 if (a->addr[1].addr32[0] > b->addr[1].addr32[0]) 302 return (1); 303 if (a->addr[1].addr32[0] < b->addr[1].addr32[0]) 304 return (-1); 305 break; 306 #endif /* INET6 */ 307 } 308 309 if ((diff = a->port[0] - b->port[0]) != 0) 310 return (diff); 311 if ((diff = a->port[1] - b->port[1]) != 0) 312 return (diff); 313 314 return (0); 315 } 316 317 #ifdef INET6 318 void 319 pf_addrcpy(struct pf_addr *dst, struct pf_addr *src, sa_family_t af) 320 { 321 switch (af) { 322 #ifdef INET 323 case AF_INET: 324 dst->addr32[0] = src->addr32[0]; 325 break; 326 #endif /* INET */ 327 case AF_INET6: 328 dst->addr32[0] = src->addr32[0]; 329 dst->addr32[1] = src->addr32[1]; 330 dst->addr32[2] = src->addr32[2]; 331 dst->addr32[3] = src->addr32[3]; 332 break; 333 } 334 } 335 #endif 336 337 struct pf_state * 338 pf_find_state(struct pf_state_tree *tree, struct pf_tree_node *key) 339 { 340 struct pf_tree_node *k; 341 342 pf_status.fcounters[FCNT_STATE_SEARCH]++; 343 k = RB_FIND(pf_state_tree, tree, key); 344 if (k) 345 return (k->state); 346 else 347 return (NULL); 348 } 349 350 int 351 pf_insert_state(struct pf_state *state) 352 { 353 struct pf_tree_node *keya, *keyb; 354 355 keya = pool_get(&pf_tree_pl, PR_NOWAIT); 356 if (keya == NULL) 357 return (-1); 358 keya->state = state; 359 keya->proto = state->proto; 360 keya->af = state->af; 361 PF_ACPY(&keya->addr[0], &state->lan.addr, state->af); 362 keya->port[0] = state->lan.port; 363 PF_ACPY(&keya->addr[1], &state->ext.addr, state->af); 364 keya->port[1] = state->ext.port; 365 366 /* Thou MUST NOT insert multiple duplicate keys */ 367 if (RB_INSERT(pf_state_tree, &tree_lan_ext, keya) != NULL) { 368 if (pf_status.debug >= PF_DEBUG_MISC) { 369 printf("pf: state insert failed: tree_lan_ext"); 370 printf(" lan: "); 371 pf_print_host(&state->lan.addr, state->lan.port, 372 state->af); 373 printf(" gwy: "); 374 pf_print_host(&state->gwy.addr, state->gwy.port, 375 state->af); 376 printf(" ext: "); 377 pf_print_host(&state->ext.addr, state->ext.port, 378 state->af); 379 printf("\n"); 380 } 381 pool_put(&pf_tree_pl, keya); 382 return (-1); 383 } 384 385 keyb = pool_get(&pf_tree_pl, PR_NOWAIT); 386 if (keyb == NULL) { 387 /* Need to pull out the other state */ 388 RB_REMOVE(pf_state_tree, &tree_lan_ext, keya); 389 pool_put(&pf_tree_pl, keya); 390 return (-1); 391 } 392 keyb->state = state; 393 keyb->proto = state->proto; 394 keyb->af = state->af; 395 PF_ACPY(&keyb->addr[0], &state->ext.addr, state->af); 396 keyb->port[0] = state->ext.port; 397 PF_ACPY(&keyb->addr[1], &state->gwy.addr, state->af); 398 keyb->port[1] = state->gwy.port; 399 400 if (RB_INSERT(pf_state_tree, &tree_ext_gwy, keyb) != NULL) { 401 if (pf_status.debug >= PF_DEBUG_MISC) { 402 printf("pf: state insert failed: tree_ext_gwy"); 403 printf(" lan: "); 404 pf_print_host(&state->lan.addr, state->lan.port, 405 state->af); 406 printf(" gwy: "); 407 pf_print_host(&state->gwy.addr, state->gwy.port, 408 state->af); 409 printf(" ext: "); 410 pf_print_host(&state->ext.addr, state->ext.port, 411 state->af); 412 printf("\n"); 413 } 414 RB_REMOVE(pf_state_tree, &tree_lan_ext, keya); 415 pool_put(&pf_tree_pl, keya); 416 pool_put(&pf_tree_pl, keyb); 417 return (-1); 418 } 419 420 pf_status.fcounters[FCNT_STATE_INSERT]++; 421 pf_status.states++; 422 #if NPFSYNC 423 pfsync_insert_state(state); 424 #endif 425 return (0); 426 } 427 428 void 429 pf_purge_timeout(void *arg) 430 { 431 struct timeout *to = arg; 432 int s; 433 434 s = splsoftnet(); 435 pf_purge_expired_states(); 436 pf_purge_expired_fragments(); 437 splx(s); 438 439 timeout_add(to, pf_default_rule.timeout[PFTM_INTERVAL] * hz); 440 } 441 442 u_int32_t 443 pf_state_expires(const struct pf_state *state) 444 { 445 u_int32_t timeout; 446 u_int32_t start; 447 u_int32_t end; 448 u_int32_t states; 449 450 /* handle all PFTM_* > PFTM_MAX here */ 451 if (state->timeout == PFTM_PURGE) 452 return (time.tv_sec); 453 if (state->timeout == PFTM_UNTIL_PACKET) 454 return (0); 455 KASSERT(state->timeout < PFTM_MAX); 456 timeout = state->rule.ptr->timeout[state->timeout]; 457 if (!timeout) 458 timeout = pf_default_rule.timeout[state->timeout]; 459 start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START]; 460 if (start) { 461 end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END]; 462 states = state->rule.ptr->states; 463 } else { 464 start = pf_default_rule.timeout[PFTM_ADAPTIVE_START]; 465 end = pf_default_rule.timeout[PFTM_ADAPTIVE_END]; 466 states = pf_status.states; 467 } 468 if (end && states > start && start < end) { 469 if (states < end) 470 return (state->expire + timeout * (end - states) / 471 (end - start)); 472 else 473 return (time.tv_sec); 474 } 475 return (state->expire + timeout); 476 } 477 478 void 479 pf_purge_expired_states(void) 480 { 481 struct pf_tree_node *cur, *peer, *next; 482 struct pf_tree_node key; 483 484 for (cur = RB_MIN(pf_state_tree, &tree_ext_gwy); cur; cur = next) { 485 next = RB_NEXT(pf_state_tree, &tree_ext_gwy, cur); 486 487 if (pf_state_expires(cur->state) <= time.tv_sec) { 488 if (cur->state->src.state == PF_TCPS_PROXY_DST) 489 pf_send_tcp(cur->state->rule.ptr, 490 cur->state->af, 491 &cur->state->ext.addr, 492 &cur->state->lan.addr, 493 cur->state->ext.port, 494 cur->state->lan.port, 495 cur->state->src.seqhi, 496 cur->state->src.seqlo + 1, 497 0, 498 TH_RST|TH_ACK, 0, 0); 499 RB_REMOVE(pf_state_tree, &tree_ext_gwy, cur); 500 501 /* Need this key's peer (in the other tree) */ 502 key.state = cur->state; 503 key.proto = cur->state->proto; 504 key.af = cur->state->af; 505 PF_ACPY(&key.addr[0], &cur->state->lan.addr, 506 cur->state->af); 507 key.port[0] = cur->state->lan.port; 508 PF_ACPY(&key.addr[1], &cur->state->ext.addr, 509 cur->state->af); 510 key.port[1] = cur->state->ext.port; 511 512 peer = RB_FIND(pf_state_tree, &tree_lan_ext, &key); 513 KASSERT(peer); 514 KASSERT(peer->state == cur->state); 515 RB_REMOVE(pf_state_tree, &tree_lan_ext, peer); 516 517 #if NPFSYNC 518 pfsync_delete_state(cur->state); 519 #endif 520 if (--cur->state->rule.ptr->states <= 0) 521 pf_rm_rule(NULL, cur->state->rule.ptr); 522 if (cur->state->nat_rule.ptr != NULL) 523 if (--cur->state->nat_rule.ptr->states <= 0) 524 pf_rm_rule(NULL, 525 cur->state->nat_rule.ptr); 526 if (cur->state->anchor.ptr != NULL) 527 if (--cur->state->anchor.ptr->states <= 0) 528 pf_rm_rule(NULL, 529 cur->state->anchor.ptr); 530 pf_normalize_tcp_cleanup(cur->state); 531 pool_put(&pf_state_pl, cur->state); 532 pool_put(&pf_tree_pl, cur); 533 pool_put(&pf_tree_pl, peer); 534 pf_status.fcounters[FCNT_STATE_REMOVALS]++; 535 pf_status.states--; 536 } 537 } 538 } 539 540 int 541 pf_tbladdr_setup(struct pf_ruleset *rs, struct pf_addr_wrap *aw) 542 { 543 if (aw->type != PF_ADDR_TABLE) 544 return (0); 545 if ((aw->p.tbl = pfr_attach_table(rs, aw->v.tblname)) == NULL) 546 return (1); 547 return (0); 548 } 549 550 void 551 pf_tbladdr_remove(struct pf_addr_wrap *aw) 552 { 553 if (aw->type != PF_ADDR_TABLE || aw->p.tbl == NULL) 554 return; 555 pfr_detach_table(aw->p.tbl); 556 aw->p.tbl = NULL; 557 } 558 559 void 560 pf_tbladdr_copyout(struct pf_addr_wrap *aw) 561 { 562 if (aw->type != PF_ADDR_TABLE || aw->p.tbl == NULL) 563 return; 564 aw->p.tblcnt = (aw->p.tbl->pfrkt_flags & PFR_TFLAG_ACTIVE) ? 565 aw->p.tbl->pfrkt_cnt : -1; 566 } 567 568 int 569 pf_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af) 570 { 571 if (aw->type != PF_ADDR_DYNIFTL) 572 return (0); 573 aw->p.dyn = pool_get(&pf_addr_pl, PR_NOWAIT); 574 if (aw->p.dyn == NULL) 575 return (1); 576 bcopy(aw->v.ifname, aw->p.dyn->ifname, sizeof(aw->p.dyn->ifname)); 577 aw->p.dyn->ifp = ifunit(aw->p.dyn->ifname); 578 if (aw->p.dyn->ifp == NULL) { 579 pool_put(&pf_addr_pl, aw->p.dyn); 580 aw->p.dyn = NULL; 581 return (1); 582 } 583 aw->p.dyn->addr = &aw->v.a.addr; 584 aw->p.dyn->af = af; 585 aw->p.dyn->undefined = 1; 586 aw->p.dyn->hook_cookie = hook_establish( 587 aw->p.dyn->ifp->if_addrhooks, 1, 588 pf_dynaddr_update, aw->p.dyn); 589 if (aw->p.dyn->hook_cookie == NULL) { 590 pool_put(&pf_addr_pl, aw->p.dyn); 591 aw->p.dyn = NULL; 592 return (1); 593 } 594 pf_dynaddr_update(aw->p.dyn); 595 return (0); 596 } 597 598 void 599 pf_dynaddr_update(void *p) 600 { 601 struct pf_addr_dyn *ad = (struct pf_addr_dyn *)p; 602 struct ifaddr *ia; 603 int s, changed = 0; 604 605 if (ad == NULL || ad->ifp == NULL) 606 panic("pf_dynaddr_update"); 607 s = splsoftnet(); 608 TAILQ_FOREACH(ia, &ad->ifp->if_addrlist, ifa_list) 609 if (ia->ifa_addr != NULL && 610 ia->ifa_addr->sa_family == ad->af) { 611 if (ad->af == AF_INET) { 612 struct in_addr *a, *b; 613 614 a = &ad->addr->v4; 615 b = &((struct sockaddr_in *)ia->ifa_addr) 616 ->sin_addr; 617 if (ad->undefined || 618 memcmp(a, b, sizeof(*a))) { 619 bcopy(b, a, sizeof(*a)); 620 changed = 1; 621 } 622 } else if (ad->af == AF_INET6) { 623 struct in6_addr *a, *b; 624 625 a = &ad->addr->v6; 626 b = &((struct sockaddr_in6 *)ia->ifa_addr) 627 ->sin6_addr; 628 if (ad->undefined || 629 memcmp(a, b, sizeof(*a))) { 630 bcopy(b, a, sizeof(*a)); 631 changed = 1; 632 } 633 } 634 if (changed) 635 ad->undefined = 0; 636 break; 637 } 638 if (ia == NULL) 639 ad->undefined = 1; 640 splx(s); 641 } 642 643 void 644 pf_dynaddr_remove(struct pf_addr_wrap *aw) 645 { 646 if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL) 647 return; 648 hook_disestablish(aw->p.dyn->ifp->if_addrhooks, 649 aw->p.dyn->hook_cookie); 650 pool_put(&pf_addr_pl, aw->p.dyn); 651 aw->p.dyn = NULL; 652 } 653 654 void 655 pf_dynaddr_copyout(struct pf_addr_wrap *aw) 656 { 657 if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL) 658 return; 659 bcopy(aw->p.dyn->ifname, aw->v.ifname, sizeof(aw->v.ifname)); 660 aw->p.dyn = (struct pf_addr_dyn *)1; 661 } 662 663 void 664 pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af) 665 { 666 switch (af) { 667 #ifdef INET 668 case AF_INET: { 669 u_int32_t a = ntohl(addr->addr32[0]); 670 printf("%u.%u.%u.%u", (a>>24)&255, (a>>16)&255, 671 (a>>8)&255, a&255); 672 if (p) { 673 p = ntohs(p); 674 printf(":%u", p); 675 } 676 break; 677 } 678 #endif /* INET */ 679 #ifdef INET6 680 case AF_INET6: { 681 u_int16_t b; 682 u_int8_t i, curstart = 255, curend = 0, 683 maxstart = 0, maxend = 0; 684 for (i = 0; i < 8; i++) { 685 if (!addr->addr16[i]) { 686 if (curstart == 255) 687 curstart = i; 688 else 689 curend = i; 690 } else { 691 if (curstart) { 692 if ((curend - curstart) > 693 (maxend - maxstart)) { 694 maxstart = curstart; 695 maxend = curend; 696 curstart = 255; 697 } 698 } 699 } 700 } 701 for (i = 0; i < 8; i++) { 702 if (i >= maxstart && i <= maxend) { 703 if (maxend != 7) { 704 if (i == maxstart) 705 printf(":"); 706 } else { 707 if (i == maxend) 708 printf(":"); 709 } 710 } else { 711 b = ntohs(addr->addr16[i]); 712 printf("%x", b); 713 if (i < 7) 714 printf(":"); 715 } 716 } 717 if (p) { 718 p = ntohs(p); 719 printf("[%u]", p); 720 } 721 break; 722 } 723 #endif /* INET6 */ 724 } 725 } 726 727 void 728 pf_print_state(struct pf_state *s) 729 { 730 switch (s->proto) { 731 case IPPROTO_TCP: 732 printf("TCP "); 733 break; 734 case IPPROTO_UDP: 735 printf("UDP "); 736 break; 737 case IPPROTO_ICMP: 738 printf("ICMP "); 739 break; 740 case IPPROTO_ICMPV6: 741 printf("ICMPV6 "); 742 break; 743 default: 744 printf("%u ", s->proto); 745 break; 746 } 747 pf_print_host(&s->lan.addr, s->lan.port, s->af); 748 printf(" "); 749 pf_print_host(&s->gwy.addr, s->gwy.port, s->af); 750 printf(" "); 751 pf_print_host(&s->ext.addr, s->ext.port, s->af); 752 printf(" [lo=%u high=%u win=%u modulator=%u", s->src.seqlo, 753 s->src.seqhi, s->src.max_win, s->src.seqdiff); 754 if (s->src.wscale && s->dst.wscale) 755 printf(" wscale=%u", s->src.wscale & PF_WSCALE_MASK); 756 printf("]"); 757 printf(" [lo=%u high=%u win=%u modulator=%u", s->dst.seqlo, 758 s->dst.seqhi, s->dst.max_win, s->dst.seqdiff); 759 if (s->src.wscale && s->dst.wscale) 760 printf(" wscale=%u", s->dst.wscale & PF_WSCALE_MASK); 761 printf("]"); 762 printf(" %u:%u", s->src.state, s->dst.state); 763 } 764 765 void 766 pf_print_flags(u_int8_t f) 767 { 768 if (f) 769 printf(" "); 770 if (f & TH_FIN) 771 printf("F"); 772 if (f & TH_SYN) 773 printf("S"); 774 if (f & TH_RST) 775 printf("R"); 776 if (f & TH_PUSH) 777 printf("P"); 778 if (f & TH_ACK) 779 printf("A"); 780 if (f & TH_URG) 781 printf("U"); 782 if (f & TH_ECE) 783 printf("E"); 784 if (f & TH_CWR) 785 printf("W"); 786 } 787 788 #define PF_SET_SKIP_STEPS(i) \ 789 do { \ 790 while (head[i] != cur) { \ 791 head[i]->skip[i].ptr = cur; \ 792 head[i] = TAILQ_NEXT(head[i], entries); \ 793 } \ 794 } while (0) 795 796 void 797 pf_calc_skip_steps(struct pf_rulequeue *rules) 798 { 799 struct pf_rule *cur, *prev, *head[PF_SKIP_COUNT]; 800 int i; 801 802 cur = TAILQ_FIRST(rules); 803 prev = cur; 804 for (i = 0; i < PF_SKIP_COUNT; ++i) 805 head[i] = cur; 806 while (cur != NULL) { 807 808 if (cur->ifp != prev->ifp || cur->ifnot != prev->ifnot) 809 PF_SET_SKIP_STEPS(PF_SKIP_IFP); 810 if (cur->direction != prev->direction) 811 PF_SET_SKIP_STEPS(PF_SKIP_DIR); 812 if (cur->af != prev->af) 813 PF_SET_SKIP_STEPS(PF_SKIP_AF); 814 if (cur->proto != prev->proto) 815 PF_SET_SKIP_STEPS(PF_SKIP_PROTO); 816 if (cur->src.not != prev->src.not || 817 pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr)) 818 PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR); 819 if (cur->src.port[0] != prev->src.port[0] || 820 cur->src.port[1] != prev->src.port[1] || 821 cur->src.port_op != prev->src.port_op) 822 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT); 823 if (cur->dst.not != prev->dst.not || 824 pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr)) 825 PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR); 826 if (cur->dst.port[0] != prev->dst.port[0] || 827 cur->dst.port[1] != prev->dst.port[1] || 828 cur->dst.port_op != prev->dst.port_op) 829 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT); 830 831 prev = cur; 832 cur = TAILQ_NEXT(cur, entries); 833 } 834 for (i = 0; i < PF_SKIP_COUNT; ++i) 835 PF_SET_SKIP_STEPS(i); 836 } 837 838 int 839 pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2) 840 { 841 if (aw1->type != aw2->type) 842 return (1); 843 switch (aw1->type) { 844 case PF_ADDR_ADDRMASK: 845 if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, 0)) 846 return (1); 847 if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, 0)) 848 return (1); 849 return (0); 850 case PF_ADDR_DYNIFTL: 851 if (aw1->p.dyn->ifp != aw2->p.dyn->ifp) 852 return (1); 853 if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, 0)) 854 return (1); 855 return (0); 856 case PF_ADDR_NOROUTE: 857 return (0); 858 case PF_ADDR_TABLE: 859 return (aw1->p.tbl != aw2->p.tbl); 860 default: 861 printf("invalid address type: %d\n", aw1->type); 862 return (1); 863 } 864 } 865 866 void 867 pf_rule_set_qid(struct pf_rulequeue *rules) 868 { 869 struct pf_rule *rule; 870 871 TAILQ_FOREACH(rule, rules, entries) 872 if (rule->qname[0] != 0) { 873 rule->qid = pf_qname_to_qid(rule->qname); 874 if (rule->pqname[0] != 0) 875 rule->pqid = pf_qname_to_qid(rule->pqname); 876 else 877 rule->pqid = rule->qid; 878 } 879 } 880 881 u_int32_t 882 pf_qname_to_qid(char *qname) 883 { 884 struct pf_altq *altq; 885 886 TAILQ_FOREACH(altq, pf_altqs_active, entries) 887 if (!strcmp(altq->qname, qname)) 888 return (altq->qid); 889 890 return (0); 891 } 892 893 void 894 pf_update_anchor_rules() 895 { 896 struct pf_rule *rule; 897 int i; 898 899 for (i = 0; i < PF_RULESET_MAX; ++i) 900 TAILQ_FOREACH(rule, pf_main_ruleset.rules[i].active.ptr, 901 entries) 902 if (rule->anchorname[0]) 903 rule->anchor = pf_find_anchor(rule->anchorname); 904 else 905 rule->anchor = NULL; 906 } 907 908 u_int16_t 909 pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp) 910 { 911 u_int32_t l; 912 913 if (udp && !cksum) 914 return (0x0000); 915 l = cksum + old - new; 916 l = (l >> 16) + (l & 65535); 917 l = l & 65535; 918 if (udp && !l) 919 return (0xFFFF); 920 return (l); 921 } 922 923 void 924 pf_change_ap(struct pf_addr *a, u_int16_t *p, u_int16_t *ic, u_int16_t *pc, 925 struct pf_addr *an, u_int16_t pn, u_int8_t u, sa_family_t af) 926 { 927 struct pf_addr ao; 928 u_int16_t po = *p; 929 930 PF_ACPY(&ao, a, af); 931 PF_ACPY(a, an, af); 932 933 *p = pn; 934 935 switch (af) { 936 #ifdef INET 937 case AF_INET: 938 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic, 939 ao.addr16[0], an->addr16[0], 0), 940 ao.addr16[1], an->addr16[1], 0); 941 *p = pn; 942 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc, 943 ao.addr16[0], an->addr16[0], u), 944 ao.addr16[1], an->addr16[1], u), 945 po, pn, u); 946 break; 947 #endif /* INET */ 948 #ifdef INET6 949 case AF_INET6: 950 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 951 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 952 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc, 953 ao.addr16[0], an->addr16[0], u), 954 ao.addr16[1], an->addr16[1], u), 955 ao.addr16[2], an->addr16[2], u), 956 ao.addr16[3], an->addr16[3], u), 957 ao.addr16[4], an->addr16[4], u), 958 ao.addr16[5], an->addr16[5], u), 959 ao.addr16[6], an->addr16[6], u), 960 ao.addr16[7], an->addr16[7], u), 961 po, pn, u); 962 break; 963 #endif /* INET6 */ 964 } 965 } 966 967 968 /* Changes a u_int32_t. Uses a void * so there are no align restrictions */ 969 void 970 pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u) 971 { 972 u_int32_t ao; 973 974 memcpy(&ao, a, sizeof(ao)); 975 memcpy(a, &an, sizeof(u_int32_t)); 976 *c = pf_cksum_fixup(pf_cksum_fixup(*c, ao / 65536, an / 65536, u), 977 ao % 65536, an % 65536, u); 978 } 979 980 #ifdef INET6 981 void 982 pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u) 983 { 984 struct pf_addr ao; 985 986 PF_ACPY(&ao, a, AF_INET6); 987 PF_ACPY(a, an, AF_INET6); 988 989 *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 990 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 991 pf_cksum_fixup(pf_cksum_fixup(*c, 992 ao.addr16[0], an->addr16[0], u), 993 ao.addr16[1], an->addr16[1], u), 994 ao.addr16[2], an->addr16[2], u), 995 ao.addr16[3], an->addr16[3], u), 996 ao.addr16[4], an->addr16[4], u), 997 ao.addr16[5], an->addr16[5], u), 998 ao.addr16[6], an->addr16[6], u), 999 ao.addr16[7], an->addr16[7], u); 1000 } 1001 #endif /* INET6 */ 1002 1003 void 1004 pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa, 1005 struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c, 1006 u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af) 1007 { 1008 struct pf_addr oia, ooa; 1009 1010 PF_ACPY(&oia, ia, af); 1011 PF_ACPY(&ooa, oa, af); 1012 1013 /* Change inner protocol port, fix inner protocol checksum. */ 1014 if (ip != NULL) { 1015 u_int16_t oip = *ip; 1016 u_int32_t opc; 1017 1018 if (pc != NULL) 1019 opc = *pc; 1020 *ip = np; 1021 if (pc != NULL) 1022 *pc = pf_cksum_fixup(*pc, oip, *ip, u); 1023 *ic = pf_cksum_fixup(*ic, oip, *ip, 0); 1024 if (pc != NULL) 1025 *ic = pf_cksum_fixup(*ic, opc, *pc, 0); 1026 } 1027 /* Change inner ip address, fix inner ip and icmp checksums. */ 1028 PF_ACPY(ia, na, af); 1029 switch (af) { 1030 #ifdef INET 1031 case AF_INET: { 1032 u_int32_t oh2c = *h2c; 1033 1034 *h2c = pf_cksum_fixup(pf_cksum_fixup(*h2c, 1035 oia.addr16[0], ia->addr16[0], 0), 1036 oia.addr16[1], ia->addr16[1], 0); 1037 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic, 1038 oia.addr16[0], ia->addr16[0], 0), 1039 oia.addr16[1], ia->addr16[1], 0); 1040 *ic = pf_cksum_fixup(*ic, oh2c, *h2c, 0); 1041 break; 1042 } 1043 #endif /* INET */ 1044 #ifdef INET6 1045 case AF_INET6: 1046 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1047 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1048 pf_cksum_fixup(pf_cksum_fixup(*ic, 1049 oia.addr16[0], ia->addr16[0], u), 1050 oia.addr16[1], ia->addr16[1], u), 1051 oia.addr16[2], ia->addr16[2], u), 1052 oia.addr16[3], ia->addr16[3], u), 1053 oia.addr16[4], ia->addr16[4], u), 1054 oia.addr16[5], ia->addr16[5], u), 1055 oia.addr16[6], ia->addr16[6], u), 1056 oia.addr16[7], ia->addr16[7], u); 1057 break; 1058 #endif /* INET6 */ 1059 } 1060 /* Change outer ip address, fix outer ip or icmpv6 checksum. */ 1061 PF_ACPY(oa, na, af); 1062 switch (af) { 1063 #ifdef INET 1064 case AF_INET: 1065 *hc = pf_cksum_fixup(pf_cksum_fixup(*hc, 1066 ooa.addr16[0], oa->addr16[0], 0), 1067 ooa.addr16[1], oa->addr16[1], 0); 1068 break; 1069 #endif /* INET */ 1070 #ifdef INET6 1071 case AF_INET6: 1072 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1073 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup( 1074 pf_cksum_fixup(pf_cksum_fixup(*ic, 1075 ooa.addr16[0], oa->addr16[0], u), 1076 ooa.addr16[1], oa->addr16[1], u), 1077 ooa.addr16[2], oa->addr16[2], u), 1078 ooa.addr16[3], oa->addr16[3], u), 1079 ooa.addr16[4], oa->addr16[4], u), 1080 ooa.addr16[5], oa->addr16[5], u), 1081 ooa.addr16[6], oa->addr16[6], u), 1082 ooa.addr16[7], oa->addr16[7], u); 1083 break; 1084 #endif /* INET6 */ 1085 } 1086 } 1087 1088 void 1089 pf_send_tcp(const struct pf_rule *r, sa_family_t af, 1090 const struct pf_addr *saddr, const struct pf_addr *daddr, 1091 u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack, 1092 u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl) 1093 { 1094 struct mbuf *m; 1095 struct m_tag *mtag; 1096 int len, tlen; 1097 #ifdef INET 1098 struct ip *h; 1099 #endif /* INET */ 1100 #ifdef INET6 1101 struct ip6_hdr *h6; 1102 #endif /* INET6 */ 1103 struct tcphdr *th; 1104 char *opt; 1105 1106 /* maximum segment size tcp option */ 1107 tlen = sizeof(struct tcphdr); 1108 if (mss) 1109 tlen += 4; 1110 1111 switch (af) { 1112 #ifdef INET 1113 case AF_INET: 1114 len = sizeof(struct ip) + tlen; 1115 break; 1116 #endif /* INET */ 1117 #ifdef INET6 1118 case AF_INET6: 1119 len = sizeof(struct ip6_hdr) + tlen; 1120 break; 1121 #endif /* INET6 */ 1122 } 1123 1124 /* create outgoing mbuf */ 1125 mtag = m_tag_get(PACKET_TAG_PF_GENERATED, 0, M_NOWAIT); 1126 if (mtag == NULL) 1127 return; 1128 m = m_gethdr(M_DONTWAIT, MT_HEADER); 1129 if (m == NULL) { 1130 m_tag_free(mtag); 1131 return; 1132 } 1133 m_tag_prepend(m, mtag); 1134 #ifdef ALTQ 1135 if (r != NULL && r->qid) { 1136 struct altq_tag *atag; 1137 1138 mtag = m_tag_get(PACKET_TAG_PF_QID, sizeof(*atag), M_NOWAIT); 1139 if (mtag != NULL) { 1140 atag = (struct altq_tag *)(mtag + 1); 1141 atag->qid = r->qid; 1142 /* add hints for ecn */ 1143 atag->af = af; 1144 atag->hdr = mtod(m, struct ip *); 1145 m_tag_prepend(m, mtag); 1146 } 1147 } 1148 #endif 1149 m->m_data += max_linkhdr; 1150 m->m_pkthdr.len = m->m_len = len; 1151 m->m_pkthdr.rcvif = NULL; 1152 bzero(m->m_data, len); 1153 switch (af) { 1154 #ifdef INET 1155 case AF_INET: 1156 h = mtod(m, struct ip *); 1157 1158 /* IP header fields included in the TCP checksum */ 1159 h->ip_p = IPPROTO_TCP; 1160 h->ip_len = htons(tlen); 1161 h->ip_src.s_addr = saddr->v4.s_addr; 1162 h->ip_dst.s_addr = daddr->v4.s_addr; 1163 1164 th = (struct tcphdr *)((caddr_t)h + sizeof(struct ip)); 1165 break; 1166 #endif /* INET */ 1167 #ifdef INET6 1168 case AF_INET6: 1169 h6 = mtod(m, struct ip6_hdr *); 1170 1171 /* IP header fields included in the TCP checksum */ 1172 h6->ip6_nxt = IPPROTO_TCP; 1173 h6->ip6_plen = htons(tlen); 1174 memcpy(&h6->ip6_src, &saddr->v6, sizeof(struct in6_addr)); 1175 memcpy(&h6->ip6_dst, &daddr->v6, sizeof(struct in6_addr)); 1176 1177 th = (struct tcphdr *)((caddr_t)h6 + sizeof(struct ip6_hdr)); 1178 break; 1179 #endif /* INET6 */ 1180 } 1181 1182 /* TCP header */ 1183 th->th_sport = sport; 1184 th->th_dport = dport; 1185 th->th_seq = htonl(seq); 1186 th->th_ack = htonl(ack); 1187 th->th_off = tlen >> 2; 1188 th->th_flags = flags; 1189 th->th_win = htons(win); 1190 1191 if (mss) { 1192 opt = (char *)(th + 1); 1193 opt[0] = TCPOPT_MAXSEG; 1194 opt[1] = 4; 1195 HTONS(mss); 1196 bcopy((caddr_t)&mss, (caddr_t)(opt + 2), 2); 1197 } 1198 1199 switch (af) { 1200 #ifdef INET 1201 case AF_INET: 1202 /* TCP checksum */ 1203 th->th_sum = in_cksum(m, len); 1204 1205 /* Finish the IP header */ 1206 h->ip_v = 4; 1207 h->ip_hl = sizeof(*h) >> 2; 1208 h->ip_tos = IPTOS_LOWDELAY; 1209 h->ip_len = htons(len); 1210 h->ip_off = htons(ip_mtudisc ? IP_DF : 0); 1211 h->ip_ttl = ttl ? ttl : ip_defttl; 1212 h->ip_sum = 0; 1213 ip_output(m, (void *)NULL, (void *)NULL, 0, (void *)NULL, 1214 (void *)NULL); 1215 break; 1216 #endif /* INET */ 1217 #ifdef INET6 1218 case AF_INET6: 1219 /* TCP checksum */ 1220 th->th_sum = in6_cksum(m, IPPROTO_TCP, 1221 sizeof(struct ip6_hdr), tlen); 1222 1223 h6->ip6_vfc |= IPV6_VERSION; 1224 h6->ip6_hlim = IPV6_DEFHLIM; 1225 1226 ip6_output(m, NULL, NULL, 0, NULL, NULL); 1227 #endif /* INET6 */ 1228 } 1229 } 1230 1231 void 1232 pf_send_icmp(struct mbuf *m, u_int8_t type, u_int8_t code, sa_family_t af, 1233 struct pf_rule *r) 1234 { 1235 struct m_tag *mtag; 1236 struct mbuf *m0; 1237 1238 mtag = m_tag_get(PACKET_TAG_PF_GENERATED, 0, M_NOWAIT); 1239 if (mtag == NULL) 1240 return; 1241 m0 = m_copy(m, 0, M_COPYALL); 1242 if (m0 == NULL) { 1243 m_tag_free(mtag); 1244 return; 1245 } 1246 m_tag_prepend(m0, mtag); 1247 1248 #ifdef ALTQ 1249 if (r->qid) { 1250 struct altq_tag *atag; 1251 1252 mtag = m_tag_get(PACKET_TAG_PF_QID, sizeof(*atag), M_NOWAIT); 1253 if (mtag != NULL) { 1254 atag = (struct altq_tag *)(mtag + 1); 1255 atag->qid = r->qid; 1256 /* add hints for ecn */ 1257 atag->af = af; 1258 atag->hdr = mtod(m0, struct ip *); 1259 m_tag_prepend(m0, mtag); 1260 } 1261 } 1262 #endif 1263 1264 switch (af) { 1265 #ifdef INET 1266 case AF_INET: 1267 icmp_error(m0, type, code, 0, 0); 1268 break; 1269 #endif /* INET */ 1270 #ifdef INET6 1271 case AF_INET6: 1272 icmp6_error(m0, type, code, 0); 1273 break; 1274 #endif /* INET6 */ 1275 } 1276 } 1277 1278 /* 1279 * Return 1 if the addresses a and b match (with mask m), otherwise return 0. 1280 * If n is 0, they match if they are equal. If n is != 0, they match if they 1281 * are different. 1282 */ 1283 int 1284 pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m, 1285 struct pf_addr *b, sa_family_t af) 1286 { 1287 int match = 0; 1288 1289 switch (af) { 1290 #ifdef INET 1291 case AF_INET: 1292 if ((a->addr32[0] & m->addr32[0]) == 1293 (b->addr32[0] & m->addr32[0])) 1294 match++; 1295 break; 1296 #endif /* INET */ 1297 #ifdef INET6 1298 case AF_INET6: 1299 if (((a->addr32[0] & m->addr32[0]) == 1300 (b->addr32[0] & m->addr32[0])) && 1301 ((a->addr32[1] & m->addr32[1]) == 1302 (b->addr32[1] & m->addr32[1])) && 1303 ((a->addr32[2] & m->addr32[2]) == 1304 (b->addr32[2] & m->addr32[2])) && 1305 ((a->addr32[3] & m->addr32[3]) == 1306 (b->addr32[3] & m->addr32[3]))) 1307 match++; 1308 break; 1309 #endif /* INET6 */ 1310 } 1311 if (match) { 1312 if (n) 1313 return (0); 1314 else 1315 return (1); 1316 } else { 1317 if (n) 1318 return (1); 1319 else 1320 return (0); 1321 } 1322 } 1323 1324 int 1325 pf_match(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p) 1326 { 1327 switch (op) { 1328 case PF_OP_IRG: 1329 return ((p > a1) && (p < a2)); 1330 case PF_OP_XRG: 1331 return ((p < a1) || (p > a2)); 1332 case PF_OP_RRG: 1333 return ((p >= a1) && (p <= a2)); 1334 case PF_OP_EQ: 1335 return (p == a1); 1336 case PF_OP_NE: 1337 return (p != a1); 1338 case PF_OP_LT: 1339 return (p < a1); 1340 case PF_OP_LE: 1341 return (p <= a1); 1342 case PF_OP_GT: 1343 return (p > a1); 1344 case PF_OP_GE: 1345 return (p >= a1); 1346 } 1347 return (0); /* never reached */ 1348 } 1349 1350 int 1351 pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p) 1352 { 1353 NTOHS(a1); 1354 NTOHS(a2); 1355 NTOHS(p); 1356 return (pf_match(op, a1, a2, p)); 1357 } 1358 1359 int 1360 pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u) 1361 { 1362 if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE) 1363 return (0); 1364 return (pf_match(op, a1, a2, u)); 1365 } 1366 1367 int 1368 pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g) 1369 { 1370 if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE) 1371 return (0); 1372 return (pf_match(op, a1, a2, g)); 1373 } 1374 1375 struct pf_tag * 1376 pf_get_tag(struct mbuf *m) 1377 { 1378 struct m_tag *mtag; 1379 1380 if ((mtag = m_tag_find(m, PACKET_TAG_PF_TAG, NULL)) != NULL) 1381 return ((struct pf_tag *)(mtag + 1)); 1382 else 1383 return (NULL); 1384 } 1385 1386 int 1387 pf_match_tag(struct mbuf *m, struct pf_rule *r, struct pf_rule *nat, 1388 struct pf_rule *rdr, struct pf_tag *pftag, int *tag) 1389 { 1390 if (*tag == -1) { /* find mbuf tag */ 1391 pftag = pf_get_tag(m); 1392 if (pftag != NULL) 1393 *tag = pftag->tag; 1394 else 1395 *tag = 0; 1396 if (nat != NULL && nat->tag) 1397 *tag = nat->tag; 1398 if (rdr != NULL && rdr->tag) 1399 *tag = rdr->tag; 1400 } 1401 1402 return ((!r->match_tag_not && r->match_tag == *tag) || 1403 (r->match_tag_not && r->match_tag != *tag)); 1404 } 1405 1406 int 1407 pf_tag_packet(struct mbuf *m, struct pf_tag *pftag, int tag) 1408 { 1409 struct m_tag *mtag; 1410 1411 if (tag <= 0) 1412 return (0); 1413 1414 if (pftag == NULL) { 1415 mtag = m_tag_get(PACKET_TAG_PF_TAG, sizeof(*pftag), M_NOWAIT); 1416 if (mtag == NULL) 1417 return (1); 1418 ((struct pf_tag *)(mtag + 1))->tag = tag; 1419 m_tag_prepend(m, mtag); 1420 } else 1421 pftag->tag = tag; 1422 1423 return (0); 1424 } 1425 1426 #define PF_STEP_INTO_ANCHOR(r, a, s, n) \ 1427 do { \ 1428 if ((r) == NULL || (r)->anchor == NULL || \ 1429 (s) != NULL || (a) != NULL) \ 1430 panic("PF_STEP_INTO_ANCHOR"); \ 1431 (a) = (r); \ 1432 (s) = TAILQ_FIRST(&(r)->anchor->rulesets); \ 1433 (r) = NULL; \ 1434 while ((s) != NULL && ((r) = \ 1435 TAILQ_FIRST((s)->rules[n].active.ptr)) == NULL) \ 1436 (s) = TAILQ_NEXT((s), entries); \ 1437 if ((r) == NULL) { \ 1438 (r) = TAILQ_NEXT((a), entries); \ 1439 (a) = NULL; \ 1440 } \ 1441 } while (0) 1442 1443 #define PF_STEP_OUT_OF_ANCHOR(r, a, s, n) \ 1444 do { \ 1445 if ((r) != NULL || (a) == NULL || (s) == NULL) \ 1446 panic("PF_STEP_OUT_OF_ANCHOR"); \ 1447 (s) = TAILQ_NEXT((s), entries); \ 1448 while ((s) != NULL && ((r) = \ 1449 TAILQ_FIRST((s)->rules[n].active.ptr)) == NULL) \ 1450 (s) = TAILQ_NEXT((s), entries); \ 1451 if ((r) == NULL) { \ 1452 (r) = TAILQ_NEXT((a), entries); \ 1453 (a) = NULL; \ 1454 } \ 1455 } while (0) 1456 1457 #ifdef INET6 1458 void 1459 pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr, 1460 struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af) 1461 { 1462 switch (af) { 1463 #ifdef INET 1464 case AF_INET: 1465 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) | 1466 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]); 1467 break; 1468 #endif /* INET */ 1469 case AF_INET6: 1470 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) | 1471 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]); 1472 naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) | 1473 ((rmask->addr32[1] ^ 0xffffffff ) & saddr->addr32[1]); 1474 naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) | 1475 ((rmask->addr32[2] ^ 0xffffffff ) & saddr->addr32[2]); 1476 naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) | 1477 ((rmask->addr32[3] ^ 0xffffffff ) & saddr->addr32[3]); 1478 break; 1479 } 1480 } 1481 1482 void 1483 pf_addr_inc(struct pf_addr *addr, u_int8_t af) 1484 { 1485 switch (af) { 1486 #ifdef INET 1487 case AF_INET: 1488 addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1); 1489 break; 1490 #endif /* INET */ 1491 case AF_INET6: 1492 if (addr->addr32[3] == 0xffffffff) { 1493 addr->addr32[3] = 0; 1494 if (addr->addr32[2] == 0xffffffff) { 1495 addr->addr32[2] = 0; 1496 if (addr->addr32[1] == 0xffffffff) { 1497 addr->addr32[1] = 0; 1498 addr->addr32[0] = 1499 htonl(ntohl(addr->addr32[0]) + 1); 1500 } else 1501 addr->addr32[1] = 1502 htonl(ntohl(addr->addr32[1]) + 1); 1503 } else 1504 addr->addr32[2] = 1505 htonl(ntohl(addr->addr32[2]) + 1); 1506 } else 1507 addr->addr32[3] = 1508 htonl(ntohl(addr->addr32[3]) + 1); 1509 break; 1510 } 1511 } 1512 #endif /* INET6 */ 1513 1514 #define mix(a,b,c) \ 1515 do { \ 1516 a -= b; a -= c; a ^= (c >> 13); \ 1517 b -= c; b -= a; b ^= (a << 8); \ 1518 c -= a; c -= b; c ^= (b >> 13); \ 1519 a -= b; a -= c; a ^= (c >> 12); \ 1520 b -= c; b -= a; b ^= (a << 16); \ 1521 c -= a; c -= b; c ^= (b >> 5); \ 1522 a -= b; a -= c; a ^= (c >> 3); \ 1523 b -= c; b -= a; b ^= (a << 10); \ 1524 c -= a; c -= b; c ^= (b >> 15); \ 1525 } while (0) 1526 1527 /* 1528 * hash function based on bridge_hash in if_bridge.c 1529 */ 1530 void 1531 pf_hash(struct pf_addr *inaddr, struct pf_addr *hash, 1532 struct pf_poolhashkey *key, sa_family_t af) 1533 { 1534 u_int32_t a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0]; 1535 1536 switch (af) { 1537 #ifdef INET 1538 case AF_INET: 1539 a += inaddr->addr32[0]; 1540 b += key->key32[1]; 1541 mix(a, b, c); 1542 hash->addr32[0] = c + key->key32[2]; 1543 break; 1544 #endif /* INET */ 1545 #ifdef INET6 1546 case AF_INET6: 1547 a += inaddr->addr32[0]; 1548 b += inaddr->addr32[2]; 1549 mix(a, b, c); 1550 hash->addr32[0] = c; 1551 a += inaddr->addr32[1]; 1552 b += inaddr->addr32[3]; 1553 c += key->key32[1]; 1554 mix(a, b, c); 1555 hash->addr32[1] = c; 1556 a += inaddr->addr32[2]; 1557 b += inaddr->addr32[1]; 1558 c += key->key32[2]; 1559 mix(a, b, c); 1560 hash->addr32[2] = c; 1561 a += inaddr->addr32[3]; 1562 b += inaddr->addr32[0]; 1563 c += key->key32[3]; 1564 mix(a, b, c); 1565 hash->addr32[3] = c; 1566 break; 1567 #endif /* INET6 */ 1568 } 1569 } 1570 1571 int 1572 pf_map_addr(u_int8_t af, struct pf_pool *rpool, struct pf_addr *saddr, 1573 struct pf_addr *naddr, struct pf_addr *init_addr) 1574 { 1575 unsigned char hash[16]; 1576 struct pf_addr *raddr = &rpool->cur->addr.v.a.addr; 1577 struct pf_addr *rmask = &rpool->cur->addr.v.a.mask; 1578 1579 if (rpool->cur->addr.type == PF_ADDR_NOROUTE || 1580 rpool->cur->addr.type == PF_ADDR_TABLE) 1581 return (1); 1582 if (rpool->cur->addr.type == PF_ADDR_DYNIFTL && 1583 rpool->cur->addr.p.dyn->undefined) 1584 return (1); 1585 1586 switch (rpool->opts & PF_POOL_TYPEMASK) { 1587 case PF_POOL_NONE: 1588 PF_ACPY(naddr, raddr, af); 1589 break; 1590 case PF_POOL_BITMASK: 1591 PF_POOLMASK(naddr, raddr, rmask, saddr, af); 1592 break; 1593 case PF_POOL_RANDOM: 1594 if (init_addr != NULL && PF_AZERO(init_addr, af)) { 1595 switch (af) { 1596 #ifdef INET 1597 case AF_INET: 1598 rpool->counter.addr32[0] = arc4random(); 1599 break; 1600 #endif /* INET */ 1601 #ifdef INET6 1602 case AF_INET6: 1603 if (rmask->addr32[3] != 0xffffffff) 1604 rpool->counter.addr32[3] = arc4random(); 1605 else 1606 break; 1607 if (rmask->addr32[2] != 0xffffffff) 1608 rpool->counter.addr32[2] = arc4random(); 1609 else 1610 break; 1611 if (rmask->addr32[1] != 0xffffffff) 1612 rpool->counter.addr32[1] = arc4random(); 1613 else 1614 break; 1615 if (rmask->addr32[0] != 0xffffffff) 1616 rpool->counter.addr32[0] = arc4random(); 1617 break; 1618 #endif /* INET6 */ 1619 } 1620 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af); 1621 PF_ACPY(init_addr, naddr, af); 1622 1623 } else { 1624 PF_AINC(&rpool->counter, af); 1625 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af); 1626 } 1627 break; 1628 case PF_POOL_SRCHASH: 1629 pf_hash(saddr, (struct pf_addr *)&hash, &rpool->key, af); 1630 PF_POOLMASK(naddr, raddr, rmask, (struct pf_addr *)&hash, af); 1631 break; 1632 case PF_POOL_ROUNDROBIN: 1633 if (pf_match_addr(0, &rpool->cur->addr.v.a.addr, 1634 &rpool->cur->addr.v.a.mask, &rpool->counter, af)) { 1635 PF_ACPY(naddr, &rpool->counter, af); 1636 PF_AINC(&rpool->counter, af); 1637 } else { 1638 if ((rpool->cur = 1639 TAILQ_NEXT(rpool->cur, entries)) == NULL) 1640 rpool->cur = TAILQ_FIRST(&rpool->list); 1641 PF_ACPY(naddr, &rpool->cur->addr.v.a.addr, af); 1642 PF_ACPY(&rpool->counter, 1643 &rpool->cur->addr.v.a.addr, af); 1644 PF_AINC(&rpool->counter, af); 1645 } 1646 break; 1647 } 1648 1649 if (pf_status.debug >= PF_DEBUG_MISC && 1650 (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) { 1651 printf("pf_map_addr: selected address: "); 1652 pf_print_host(naddr, 0, af); 1653 printf("\n"); 1654 } 1655 1656 return (0); 1657 } 1658 1659 int 1660 pf_get_sport(sa_family_t af, u_int8_t proto, struct pf_pool *rpool, 1661 struct pf_addr *saddr, struct pf_addr *daddr, u_int16_t dport, 1662 struct pf_addr *naddr, u_int16_t *nport, u_int16_t low, u_int16_t high) 1663 { 1664 struct pf_tree_node key; 1665 struct pf_addr init_addr; 1666 u_int16_t cut; 1667 1668 bzero(&init_addr, sizeof(init_addr)); 1669 if (pf_map_addr(af, rpool, saddr, naddr, &init_addr)) 1670 return (1); 1671 1672 do { 1673 key.af = af; 1674 key.proto = proto; 1675 PF_ACPY(&key.addr[0], daddr, key.af); 1676 PF_ACPY(&key.addr[1], naddr, key.af); 1677 key.port[0] = dport; 1678 1679 /* 1680 * port search; start random, step; 1681 * similar 2 portloop in in_pcbbind 1682 */ 1683 if (!(proto == IPPROTO_TCP || proto == IPPROTO_UDP)) { 1684 key.port[1] = 0; 1685 if (pf_find_state(&tree_ext_gwy, &key) == NULL) 1686 return (0); 1687 } else if (low == 0 && high == 0) { 1688 key.port[1] = *nport; 1689 if (pf_find_state(&tree_ext_gwy, &key) == NULL) { 1690 return (0); 1691 } 1692 } else if (low == high) { 1693 key.port[1] = htons(low); 1694 if (pf_find_state(&tree_ext_gwy, &key) == NULL) { 1695 *nport = htons(low); 1696 return (0); 1697 } 1698 } else { 1699 u_int16_t tmp; 1700 1701 if (low > high) { 1702 tmp = low; 1703 low = high; 1704 high = tmp; 1705 } 1706 /* low < high */ 1707 cut = arc4random() % (1 + high - low) + low; 1708 /* low <= cut <= high */ 1709 for (tmp = cut; tmp <= high; ++(tmp)) { 1710 key.port[1] = htons(tmp); 1711 if (pf_find_state(&tree_ext_gwy, &key) == 1712 NULL) { 1713 *nport = htons(tmp); 1714 return (0); 1715 } 1716 } 1717 for (tmp = cut - 1; tmp >= low; --(tmp)) { 1718 key.port[1] = htons(tmp); 1719 if (pf_find_state(&tree_ext_gwy, &key) == 1720 NULL) { 1721 *nport = htons(tmp); 1722 return (0); 1723 } 1724 } 1725 } 1726 1727 switch (rpool->opts & PF_POOL_TYPEMASK) { 1728 case PF_POOL_RANDOM: 1729 case PF_POOL_ROUNDROBIN: 1730 if (pf_map_addr(af, rpool, saddr, naddr, &init_addr)) 1731 return (1); 1732 break; 1733 case PF_POOL_NONE: 1734 case PF_POOL_SRCHASH: 1735 case PF_POOL_BITMASK: 1736 default: 1737 return (1); 1738 break; 1739 } 1740 } while (! PF_AEQ(&init_addr, naddr, af) ); 1741 1742 return (1); /* none available */ 1743 } 1744 1745 struct pf_rule * 1746 pf_match_translation(int direction, struct ifnet *ifp, u_int8_t proto, 1747 struct pf_addr *saddr, u_int16_t sport, struct pf_addr *daddr, 1748 u_int16_t dport, sa_family_t af, int rs_num) 1749 { 1750 struct pf_rule *r, *rm = NULL, *anchorrule = NULL; 1751 struct pf_ruleset *ruleset = NULL; 1752 1753 r = TAILQ_FIRST(pf_main_ruleset.rules[rs_num].active.ptr); 1754 while (r && rm == NULL) { 1755 struct pf_rule_addr *src = NULL, *dst = NULL; 1756 struct pf_addr_wrap *xdst = NULL; 1757 1758 if (r->action == PF_BINAT && direction == PF_IN) { 1759 src = &r->dst; 1760 if (r->rpool.cur != NULL) 1761 xdst = &r->rpool.cur->addr; 1762 } else { 1763 src = &r->src; 1764 dst = &r->dst; 1765 } 1766 1767 r->evaluations++; 1768 if (r->ifp != NULL && ((r->ifp != ifp && !r->ifnot) || 1769 (r->ifp == ifp && r->ifnot))) 1770 r = r->skip[PF_SKIP_IFP].ptr; 1771 else if (r->direction && r->direction != direction) 1772 r = r->skip[PF_SKIP_DIR].ptr; 1773 else if (r->af && r->af != af) 1774 r = r->skip[PF_SKIP_AF].ptr; 1775 else if (r->proto && r->proto != proto) 1776 r = r->skip[PF_SKIP_PROTO].ptr; 1777 else if (PF_MISMATCHAW(&src->addr, saddr, af, src->not)) 1778 r = r->skip[src == &r->src ? PF_SKIP_SRC_ADDR : 1779 PF_SKIP_DST_ADDR].ptr; 1780 else if (src->port_op && !pf_match_port(src->port_op, 1781 src->port[0], src->port[1], sport)) 1782 r = r->skip[src == &r->src ? PF_SKIP_SRC_PORT : 1783 PF_SKIP_DST_PORT].ptr; 1784 else if (dst != NULL && 1785 PF_MISMATCHAW(&dst->addr, daddr, af, dst->not)) 1786 r = r->skip[PF_SKIP_DST_ADDR].ptr; 1787 else if (xdst != NULL && PF_MISMATCHAW(xdst, daddr, af, 0)) 1788 r = TAILQ_NEXT(r, entries); 1789 else if (dst != NULL && dst->port_op && 1790 !pf_match_port(dst->port_op, dst->port[0], 1791 dst->port[1], dport)) 1792 r = r->skip[PF_SKIP_DST_PORT].ptr; 1793 else if (r->anchorname[0] && r->anchor == NULL) 1794 r = TAILQ_NEXT(r, entries); 1795 else if (r->anchor == NULL) 1796 rm = r; 1797 else 1798 PF_STEP_INTO_ANCHOR(r, anchorrule, ruleset, rs_num); 1799 if (r == NULL && anchorrule != NULL) 1800 PF_STEP_OUT_OF_ANCHOR(r, anchorrule, ruleset, 1801 rs_num); 1802 } 1803 if (rm != NULL && (rm->action == PF_NONAT || 1804 rm->action == PF_NORDR || rm->action == PF_NOBINAT)) 1805 return (NULL); 1806 return (rm); 1807 } 1808 1809 struct pf_rule * 1810 pf_get_translation(int direction, struct ifnet *ifp, u_int8_t proto, 1811 struct pf_addr *saddr, u_int16_t sport, 1812 struct pf_addr *daddr, u_int16_t dport, 1813 struct pf_addr *naddr, u_int16_t *nport, sa_family_t af) 1814 { 1815 struct pf_rule *r = NULL; 1816 1817 if (direction == PF_OUT) { 1818 r = pf_match_translation(direction, ifp, proto, 1819 saddr, sport, daddr, dport, af, PF_RULESET_BINAT); 1820 if (r == NULL) 1821 r = pf_match_translation(direction, ifp, proto, 1822 saddr, sport, daddr, dport, af, PF_RULESET_NAT); 1823 } else { 1824 r = pf_match_translation(direction, ifp, proto, 1825 saddr, sport, daddr, dport, af, PF_RULESET_RDR); 1826 if (r == NULL) 1827 r = pf_match_translation(direction, ifp, proto, 1828 saddr, sport, daddr, dport, af, PF_RULESET_BINAT); 1829 } 1830 1831 if (r != NULL) { 1832 switch (r->action) { 1833 case PF_NONAT: 1834 case PF_NOBINAT: 1835 case PF_NORDR: 1836 return (NULL); 1837 break; 1838 case PF_NAT: 1839 if (pf_get_sport(af, proto, &r->rpool, saddr, daddr, 1840 dport, naddr, nport, r->rpool.proxy_port[0], 1841 r->rpool.proxy_port[1])) { 1842 DPFPRINTF(PF_DEBUG_MISC, 1843 ("pf: NAT proxy port allocation " 1844 "(%u-%u) failed\n", 1845 r->rpool.proxy_port[0], 1846 r->rpool.proxy_port[1])); 1847 return (NULL); 1848 } 1849 break; 1850 case PF_BINAT: 1851 switch (direction) { 1852 case PF_OUT: 1853 if (r->rpool.cur->addr.type == 1854 PF_ADDR_DYNIFTL && 1855 r->rpool.cur->addr.p.dyn->undefined) 1856 return (NULL); 1857 else 1858 PF_POOLMASK(naddr, 1859 &r->rpool.cur->addr.v.a.addr, 1860 &r->rpool.cur->addr.v.a.mask, 1861 saddr, af); 1862 break; 1863 case PF_IN: 1864 if (r->src.addr.type == PF_ADDR_DYNIFTL && 1865 r->src.addr.p.dyn->undefined) 1866 return (NULL); 1867 else 1868 PF_POOLMASK(naddr, 1869 &r->src.addr.v.a.addr, 1870 &r->src.addr.v.a.mask, saddr, af); 1871 break; 1872 } 1873 break; 1874 case PF_RDR: { 1875 if (pf_map_addr(r->af, &r->rpool, saddr, naddr, NULL)) 1876 return (NULL); 1877 1878 if (r->rpool.proxy_port[1]) { 1879 u_int32_t tmp_nport; 1880 1881 tmp_nport = ((ntohs(dport) - 1882 ntohs(r->dst.port[0])) % 1883 (r->rpool.proxy_port[1] - 1884 r->rpool.proxy_port[0] + 1)) + 1885 r->rpool.proxy_port[0]; 1886 1887 /* wrap around if necessary */ 1888 if (tmp_nport > 65535) 1889 tmp_nport -= 65535; 1890 *nport = htons((u_int16_t)tmp_nport); 1891 } else if (r->rpool.proxy_port[0]) 1892 *nport = htons(r->rpool.proxy_port[0]); 1893 break; 1894 } 1895 default: 1896 return (NULL); 1897 break; 1898 } 1899 } 1900 1901 return (r); 1902 } 1903 1904 int 1905 pf_socket_lookup(uid_t *uid, gid_t *gid, int direction, sa_family_t af, 1906 int proto, struct pf_pdesc *pd) 1907 { 1908 struct pf_addr *saddr, *daddr; 1909 u_int16_t sport, dport; 1910 struct inpcbtable *tb; 1911 struct inpcb *inp; 1912 1913 *uid = UID_MAX; 1914 *gid = GID_MAX; 1915 switch (proto) { 1916 case IPPROTO_TCP: 1917 sport = pd->hdr.tcp->th_sport; 1918 dport = pd->hdr.tcp->th_dport; 1919 tb = &tcbtable; 1920 break; 1921 case IPPROTO_UDP: 1922 sport = pd->hdr.udp->uh_sport; 1923 dport = pd->hdr.udp->uh_dport; 1924 tb = &udbtable; 1925 break; 1926 default: 1927 return (0); 1928 } 1929 if (direction == PF_IN) { 1930 saddr = pd->src; 1931 daddr = pd->dst; 1932 } else { 1933 u_int16_t p; 1934 1935 p = sport; 1936 sport = dport; 1937 dport = p; 1938 saddr = pd->dst; 1939 daddr = pd->src; 1940 } 1941 switch(af) { 1942 case AF_INET: 1943 inp = in_pcbhashlookup(tb, saddr->v4, sport, daddr->v4, dport); 1944 if (inp == NULL) { 1945 inp = in_pcblookup(tb, &saddr->v4, sport, &daddr->v4, 1946 dport, INPLOOKUP_WILDCARD); 1947 if (inp == NULL) 1948 return (0); 1949 } 1950 break; 1951 #ifdef INET6 1952 case AF_INET6: 1953 inp = in6_pcbhashlookup(tb, &saddr->v6, sport, &daddr->v6, 1954 dport); 1955 if (inp == NULL) { 1956 inp = in_pcblookup(tb, &saddr->v6, sport, &daddr->v6, 1957 dport, INPLOOKUP_WILDCARD | INPLOOKUP_IPV6); 1958 if (inp == NULL) 1959 return (0); 1960 } 1961 break; 1962 #endif /* INET6 */ 1963 1964 default: 1965 return (0); 1966 } 1967 *uid = inp->inp_socket->so_euid; 1968 *gid = inp->inp_socket->so_egid; 1969 return (1); 1970 } 1971 1972 u_int8_t 1973 pf_get_wscale(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af) 1974 { 1975 int hlen; 1976 u_int8_t hdr[60]; 1977 u_int8_t *opt, optlen; 1978 u_int8_t wscale = 0; 1979 1980 hlen = th_off << 2; /* hlen <= sizeof(hdr) */ 1981 if (hlen <= sizeof(struct tcphdr)) 1982 return (0); 1983 if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af)) 1984 return (0); 1985 opt = hdr + sizeof(struct tcphdr); 1986 hlen -= sizeof(struct tcphdr); 1987 while (hlen >= 3) { 1988 switch (*opt) { 1989 case TCPOPT_EOL: 1990 case TCPOPT_NOP: 1991 ++opt; 1992 --hlen; 1993 break; 1994 case TCPOPT_WINDOW: 1995 wscale = opt[2]; 1996 if (wscale > TCP_MAX_WINSHIFT) 1997 wscale = TCP_MAX_WINSHIFT; 1998 wscale |= PF_WSCALE_FLAG; 1999 /* fallthrough */ 2000 default: 2001 optlen = opt[1]; 2002 if (optlen < 2) 2003 optlen = 2; 2004 hlen -= optlen; 2005 opt += optlen; 2006 } 2007 } 2008 return (wscale); 2009 } 2010 2011 u_int16_t 2012 pf_get_mss(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af) 2013 { 2014 int hlen; 2015 u_int8_t hdr[60]; 2016 u_int8_t *opt, optlen; 2017 u_int16_t mss = tcp_mssdflt; 2018 2019 hlen = th_off << 2; /* hlen <= sizeof(hdr) */ 2020 if (hlen <= sizeof(struct tcphdr)) 2021 return (0); 2022 if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af)) 2023 return (0); 2024 opt = hdr + sizeof(struct tcphdr); 2025 hlen -= sizeof(struct tcphdr); 2026 while (hlen >= TCPOLEN_MAXSEG) { 2027 switch (*opt) { 2028 case TCPOPT_EOL: 2029 case TCPOPT_NOP: 2030 ++opt; 2031 --hlen; 2032 break; 2033 case TCPOPT_MAXSEG: 2034 bcopy((caddr_t)(opt + 2), (caddr_t)&mss, 2); 2035 /* fallthrough */ 2036 default: 2037 optlen = opt[1]; 2038 if (optlen < 2) 2039 optlen = 2; 2040 hlen -= optlen; 2041 opt += optlen; 2042 } 2043 } 2044 return (mss); 2045 } 2046 2047 u_int16_t 2048 pf_calc_mss(struct pf_addr *addr, sa_family_t af, u_int16_t offer) 2049 { 2050 #ifdef INET 2051 struct sockaddr_in *dst; 2052 struct route ro; 2053 #endif /* INET */ 2054 #ifdef INET6 2055 struct sockaddr_in6 *dst6; 2056 struct route_in6 ro6; 2057 #endif /* INET6 */ 2058 struct rtentry *rt = NULL; 2059 int hlen; 2060 u_int16_t mss = tcp_mssdflt; 2061 2062 switch (af) { 2063 #ifdef INET 2064 case AF_INET: 2065 hlen = sizeof(struct ip); 2066 bzero(&ro, sizeof(ro)); 2067 dst = (struct sockaddr_in *)&ro.ro_dst; 2068 dst->sin_family = AF_INET; 2069 dst->sin_len = sizeof(*dst); 2070 dst->sin_addr = addr->v4; 2071 rtalloc_noclone(&ro, NO_CLONING); 2072 rt = ro.ro_rt; 2073 break; 2074 #endif /* INET */ 2075 #ifdef INET6 2076 case AF_INET6: 2077 hlen = sizeof(struct ip6_hdr); 2078 bzero(&ro6, sizeof(ro6)); 2079 dst6 = (struct sockaddr_in6 *)&ro6.ro_dst; 2080 dst6->sin6_family = AF_INET6; 2081 dst6->sin6_len = sizeof(*dst6); 2082 dst6->sin6_addr = addr->v6; 2083 rtalloc_noclone((struct route *)&ro6, NO_CLONING); 2084 rt = ro6.ro_rt; 2085 break; 2086 #endif /* INET6 */ 2087 } 2088 2089 if (rt && rt->rt_ifp) { 2090 mss = rt->rt_ifp->if_mtu - hlen - sizeof(struct tcphdr); 2091 mss = max(tcp_mssdflt, mss); 2092 RTFREE(rt); 2093 } 2094 mss = min(mss, offer); 2095 mss = max(mss, 64); /* sanity - at least max opt space */ 2096 return (mss); 2097 } 2098 2099 void 2100 pf_set_rt_ifp(struct pf_state *s, struct pf_addr *saddr) 2101 { 2102 struct pf_rule *r = s->rule.ptr; 2103 2104 s->rt_ifp = NULL; 2105 if (!r->rt || r->rt == PF_FASTROUTE) 2106 return; 2107 switch (s->af) { 2108 #ifdef INET 2109 case AF_INET: 2110 pf_map_addr(AF_INET, &r->rpool, saddr, 2111 &s->rt_addr, NULL); 2112 s->rt_ifp = r->rpool.cur->ifp; 2113 break; 2114 #endif /* INET */ 2115 #ifdef INET6 2116 case AF_INET6: 2117 pf_map_addr(AF_INET6, &r->rpool, saddr, 2118 &s->rt_addr, NULL); 2119 s->rt_ifp = r->rpool.cur->ifp; 2120 break; 2121 #endif /* INET6 */ 2122 } 2123 } 2124 2125 int 2126 pf_test_tcp(struct pf_rule **rm, struct pf_state **sm, int direction, 2127 struct ifnet *ifp, struct mbuf *m, int ipoff, int off, void *h, 2128 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm) 2129 { 2130 struct pf_rule *nat = NULL, *rdr = NULL; 2131 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 2132 struct pf_addr baddr, naddr; 2133 struct tcphdr *th = pd->hdr.tcp; 2134 u_int16_t bport, nport = 0; 2135 sa_family_t af = pd->af; 2136 int lookup = -1; 2137 uid_t uid; 2138 gid_t gid; 2139 struct pf_rule *r, *a = NULL; 2140 struct pf_ruleset *ruleset = NULL; 2141 u_short reason; 2142 int rewrite = 0; 2143 struct pf_tag *pftag = NULL; 2144 int tag = -1; 2145 u_int16_t mss = tcp_mssdflt; 2146 2147 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 2148 2149 if (direction == PF_OUT) { 2150 bport = nport = th->th_sport; 2151 /* check outgoing packet for BINAT/NAT */ 2152 if ((nat = pf_get_translation(PF_OUT, ifp, IPPROTO_TCP, 2153 saddr, th->th_sport, daddr, th->th_dport, 2154 &naddr, &nport, af)) != NULL) { 2155 PF_ACPY(&baddr, saddr, af); 2156 pf_change_ap(saddr, &th->th_sport, pd->ip_sum, 2157 &th->th_sum, &naddr, nport, 0, af); 2158 rewrite++; 2159 if (nat->natpass) 2160 r = NULL; 2161 } 2162 } else { 2163 bport = nport = th->th_dport; 2164 /* check incoming packet for BINAT/RDR */ 2165 if ((rdr = pf_get_translation(PF_IN, ifp, IPPROTO_TCP, 2166 saddr, th->th_sport, daddr, th->th_dport, 2167 &naddr, &nport, af)) != NULL) { 2168 PF_ACPY(&baddr, daddr, af); 2169 pf_change_ap(daddr, &th->th_dport, pd->ip_sum, 2170 &th->th_sum, &naddr, nport, 0, af); 2171 rewrite++; 2172 if (rdr->natpass) 2173 r = NULL; 2174 } 2175 } 2176 2177 while (r != NULL) { 2178 r->evaluations++; 2179 if (r->ifp != NULL && ((r->ifp != ifp && !r->ifnot) || 2180 (r->ifp == ifp && r->ifnot))) 2181 r = r->skip[PF_SKIP_IFP].ptr; 2182 else if (r->direction && r->direction != direction) 2183 r = r->skip[PF_SKIP_DIR].ptr; 2184 else if (r->af && r->af != af) 2185 r = r->skip[PF_SKIP_AF].ptr; 2186 else if (r->proto && r->proto != IPPROTO_TCP) 2187 r = r->skip[PF_SKIP_PROTO].ptr; 2188 else if (PF_MISMATCHAW(&r->src.addr, saddr, af, r->src.not)) 2189 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 2190 else if (r->src.port_op && !pf_match_port(r->src.port_op, 2191 r->src.port[0], r->src.port[1], th->th_sport)) 2192 r = r->skip[PF_SKIP_SRC_PORT].ptr; 2193 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af, r->dst.not)) 2194 r = r->skip[PF_SKIP_DST_ADDR].ptr; 2195 else if (r->dst.port_op && !pf_match_port(r->dst.port_op, 2196 r->dst.port[0], r->dst.port[1], th->th_dport)) 2197 r = r->skip[PF_SKIP_DST_PORT].ptr; 2198 else if (r->tos && !(r->tos & pd->tos)) 2199 r = TAILQ_NEXT(r, entries); 2200 else if (r->rule_flag & PFRULE_FRAGMENT) 2201 r = TAILQ_NEXT(r, entries); 2202 else if ((r->flagset & th->th_flags) != r->flags) 2203 r = TAILQ_NEXT(r, entries); 2204 else if (r->uid.op && (lookup != -1 || (lookup = 2205 pf_socket_lookup(&uid, &gid, direction, af, IPPROTO_TCP, 2206 pd), 1)) && 2207 !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1], 2208 uid)) 2209 r = TAILQ_NEXT(r, entries); 2210 else if (r->gid.op && (lookup != -1 || (lookup = 2211 pf_socket_lookup(&uid, &gid, direction, af, IPPROTO_TCP, 2212 pd), 1)) && 2213 !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1], 2214 gid)) 2215 r = TAILQ_NEXT(r, entries); 2216 else if (r->match_tag && 2217 !pf_match_tag(m, r, nat, rdr, pftag, &tag)) 2218 r = TAILQ_NEXT(r, entries); 2219 else if (r->anchorname[0] && r->anchor == NULL) 2220 r = TAILQ_NEXT(r, entries); 2221 else { 2222 if (r->tag) 2223 tag = r->tag; 2224 if (r->anchor == NULL) { 2225 *rm = r; 2226 *am = a; 2227 *rsm = ruleset; 2228 if ((*rm)->quick) 2229 break; 2230 r = TAILQ_NEXT(r, entries); 2231 } else 2232 PF_STEP_INTO_ANCHOR(r, a, ruleset, 2233 PF_RULESET_FILTER); 2234 } 2235 if (r == NULL && a != NULL) 2236 PF_STEP_OUT_OF_ANCHOR(r, a, ruleset, 2237 PF_RULESET_FILTER); 2238 } 2239 r = *rm; 2240 a = *am; 2241 ruleset = *rsm; 2242 2243 r->packets++; 2244 r->bytes += pd->tot_len; 2245 if (a != NULL) { 2246 a->packets++; 2247 a->bytes += pd->tot_len; 2248 } 2249 REASON_SET(&reason, PFRES_MATCH); 2250 2251 if (r->log) { 2252 if (rewrite) 2253 m_copyback(m, off, sizeof(*th), (caddr_t)th); 2254 PFLOG_PACKET(ifp, h, m, af, direction, reason, r, a, ruleset); 2255 } 2256 2257 if ((r->action == PF_DROP) && 2258 ((r->rule_flag & PFRULE_RETURNRST) || 2259 (r->rule_flag & PFRULE_RETURNICMP) || 2260 (r->rule_flag & PFRULE_RETURN))) { 2261 /* undo NAT changes, if they have taken place */ 2262 if (nat != NULL) { 2263 pf_change_ap(saddr, &th->th_sport, pd->ip_sum, 2264 &th->th_sum, &baddr, bport, 0, af); 2265 rewrite++; 2266 } else if (rdr != NULL) { 2267 pf_change_ap(daddr, &th->th_dport, pd->ip_sum, 2268 &th->th_sum, &baddr, bport, 0, af); 2269 rewrite++; 2270 } 2271 if (((r->rule_flag & PFRULE_RETURNRST) || 2272 (r->rule_flag & PFRULE_RETURN)) && 2273 !(th->th_flags & TH_RST)) { 2274 u_int32_t ack = ntohl(th->th_seq) + pd->p_len; 2275 2276 if (th->th_flags & TH_SYN) 2277 ack++; 2278 if (th->th_flags & TH_FIN) 2279 ack++; 2280 pf_send_tcp(r, af, pd->dst, 2281 pd->src, th->th_dport, th->th_sport, 2282 ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0, 2283 r->return_ttl); 2284 } else if ((af == AF_INET) && r->return_icmp) 2285 pf_send_icmp(m, r->return_icmp >> 8, 2286 r->return_icmp & 255, af, r); 2287 else if ((af == AF_INET6) && r->return_icmp6) 2288 pf_send_icmp(m, r->return_icmp6 >> 8, 2289 r->return_icmp6 & 255, af, r); 2290 } 2291 2292 if (r->action == PF_DROP) 2293 return (PF_DROP); 2294 2295 if (pf_tag_packet(m, pftag, tag)) { 2296 REASON_SET(&reason, PFRES_MEMORY); 2297 return (PF_DROP); 2298 } 2299 2300 if (r->keep_state || nat != NULL || rdr != NULL || 2301 (pd->flags & PFDESC_TCP_NORM)) { 2302 /* create new state */ 2303 u_int16_t len; 2304 struct pf_state *s = NULL; 2305 2306 len = pd->tot_len - off - (th->th_off << 2); 2307 if (!r->max_states || r->states < r->max_states) 2308 s = pool_get(&pf_state_pl, PR_NOWAIT); 2309 if (s == NULL) { 2310 REASON_SET(&reason, PFRES_MEMORY); 2311 return (PF_DROP); 2312 } 2313 bzero(s, sizeof(*s)); 2314 r->states++; 2315 if (a != NULL) 2316 a->states++; 2317 s->rule.ptr = r; 2318 if (nat != NULL) 2319 s->nat_rule.ptr = nat; 2320 else 2321 s->nat_rule.ptr = rdr; 2322 if (s->nat_rule.ptr != NULL) 2323 s->nat_rule.ptr->states++; 2324 s->anchor.ptr = a; 2325 s->allow_opts = r->allow_opts; 2326 s->log = r->log & 2; 2327 s->proto = IPPROTO_TCP; 2328 s->direction = direction; 2329 s->af = af; 2330 if (direction == PF_OUT) { 2331 PF_ACPY(&s->gwy.addr, saddr, af); 2332 s->gwy.port = th->th_sport; /* sport */ 2333 PF_ACPY(&s->ext.addr, daddr, af); 2334 s->ext.port = th->th_dport; 2335 if (nat != NULL) { 2336 PF_ACPY(&s->lan.addr, &baddr, af); 2337 s->lan.port = bport; 2338 } else { 2339 PF_ACPY(&s->lan.addr, &s->gwy.addr, af); 2340 s->lan.port = s->gwy.port; 2341 } 2342 } else { 2343 PF_ACPY(&s->lan.addr, daddr, af); 2344 s->lan.port = th->th_dport; 2345 PF_ACPY(&s->ext.addr, saddr, af); 2346 s->ext.port = th->th_sport; 2347 if (rdr != NULL) { 2348 PF_ACPY(&s->gwy.addr, &baddr, af); 2349 s->gwy.port = bport; 2350 } else { 2351 PF_ACPY(&s->gwy.addr, &s->lan.addr, af); 2352 s->gwy.port = s->lan.port; 2353 } 2354 } 2355 2356 s->src.seqlo = ntohl(th->th_seq); 2357 s->src.seqhi = s->src.seqlo + len + 1; 2358 if ((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN && 2359 r->keep_state == PF_STATE_MODULATE) { 2360 /* Generate sequence number modulator */ 2361 while ((s->src.seqdiff = arc4random()) == 0) 2362 ; 2363 pf_change_a(&th->th_seq, &th->th_sum, 2364 htonl(s->src.seqlo + s->src.seqdiff), 0); 2365 rewrite = 1; 2366 } else 2367 s->src.seqdiff = 0; 2368 if (th->th_flags & TH_SYN) { 2369 s->src.seqhi++; 2370 s->src.wscale = pf_get_wscale(m, off, th->th_off, af); 2371 } 2372 s->src.max_win = MAX(ntohs(th->th_win), 1); 2373 if (s->src.wscale & PF_WSCALE_MASK) { 2374 /* Remove scale factor from initial window */ 2375 int win = s->src.max_win; 2376 win += 1 << (s->src.wscale & PF_WSCALE_MASK); 2377 s->src.max_win = (win - 1) >> 2378 (s->src.wscale & PF_WSCALE_MASK); 2379 } 2380 if (th->th_flags & TH_FIN) 2381 s->src.seqhi++; 2382 s->dst.seqlo = 0; /* Haven't seen these yet */ 2383 s->dst.seqhi = 1; 2384 s->dst.max_win = 1; 2385 s->dst.seqdiff = 0; /* Defer random generation */ 2386 s->src.state = TCPS_SYN_SENT; 2387 s->dst.state = TCPS_CLOSED; 2388 s->creation = time.tv_sec; 2389 s->expire = time.tv_sec; 2390 s->timeout = PFTM_TCP_FIRST_PACKET; 2391 s->packets[0] = 1; 2392 s->bytes[0] = pd->tot_len; 2393 pf_set_rt_ifp(s, saddr); 2394 2395 if ((pd->flags & PFDESC_TCP_NORM) && pf_normalize_tcp_init(m, 2396 off, pd, th, &s->src, &s->dst)) { 2397 REASON_SET(&reason, PFRES_MEMORY); 2398 pool_put(&pf_state_pl, s); 2399 return (PF_DROP); 2400 } 2401 if ((pd->flags & PFDESC_TCP_NORM) && s->src.scrub && 2402 pf_normalize_tcp_stateful(m, off, pd, &reason, th, &s->src, 2403 &s->dst, &rewrite)) { 2404 pf_normalize_tcp_cleanup(s); 2405 pool_put(&pf_state_pl, s); 2406 return (PF_DROP); 2407 } 2408 if (pf_insert_state(s)) { 2409 pf_normalize_tcp_cleanup(s); 2410 REASON_SET(&reason, PFRES_MEMORY); 2411 pool_put(&pf_state_pl, s); 2412 return (PF_DROP); 2413 } else 2414 *sm = s; 2415 if ((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN && 2416 r->keep_state == PF_STATE_SYNPROXY) { 2417 s->src.state = PF_TCPS_PROXY_SRC; 2418 if (nat != NULL) 2419 pf_change_ap(saddr, &th->th_sport, 2420 pd->ip_sum, &th->th_sum, &baddr, 2421 bport, 0, af); 2422 else if (rdr != NULL) 2423 pf_change_ap(daddr, &th->th_dport, 2424 pd->ip_sum, &th->th_sum, &baddr, 2425 bport, 0, af); 2426 s->src.seqhi = arc4random(); 2427 /* Find mss option */ 2428 mss = pf_get_mss(m, off, th->th_off, af); 2429 mss = pf_calc_mss(saddr, af, mss); 2430 mss = pf_calc_mss(daddr, af, mss); 2431 s->src.mss = mss; 2432 pf_send_tcp(r, af, daddr, saddr, th->th_dport, 2433 th->th_sport, s->src.seqhi, 2434 ntohl(th->th_seq) + 1, TH_SYN|TH_ACK, 0, s->src.mss, 0); 2435 return (PF_SYNPROXY_DROP); 2436 } 2437 } 2438 2439 /* copy back packet headers if we performed NAT operations */ 2440 if (rewrite) 2441 m_copyback(m, off, sizeof(*th), (caddr_t)th); 2442 2443 return (PF_PASS); 2444 } 2445 2446 int 2447 pf_test_udp(struct pf_rule **rm, struct pf_state **sm, int direction, 2448 struct ifnet *ifp, struct mbuf *m, int ipoff, int off, void *h, 2449 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm) 2450 { 2451 struct pf_rule *nat = NULL, *rdr = NULL; 2452 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 2453 struct pf_addr baddr, naddr; 2454 struct udphdr *uh = pd->hdr.udp; 2455 u_int16_t bport, nport = 0; 2456 sa_family_t af = pd->af; 2457 int lookup = -1; 2458 uid_t uid; 2459 gid_t gid; 2460 struct pf_rule *r, *a = NULL; 2461 struct pf_ruleset *ruleset = NULL; 2462 u_short reason; 2463 int rewrite = 0; 2464 struct pf_tag *pftag = NULL; 2465 int tag = -1; 2466 2467 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 2468 2469 if (direction == PF_OUT) { 2470 bport = nport = uh->uh_sport; 2471 /* check outgoing packet for BINAT/NAT */ 2472 if ((nat = pf_get_translation(PF_OUT, ifp, IPPROTO_UDP, 2473 saddr, uh->uh_sport, daddr, uh->uh_dport, 2474 &naddr, &nport, af)) != NULL) { 2475 PF_ACPY(&baddr, saddr, af); 2476 pf_change_ap(saddr, &uh->uh_sport, pd->ip_sum, 2477 &uh->uh_sum, &naddr, nport, 1, af); 2478 rewrite++; 2479 if (nat->natpass) 2480 r = NULL; 2481 } 2482 } else { 2483 bport = nport = uh->uh_dport; 2484 /* check incoming packet for BINAT/RDR */ 2485 if ((rdr = pf_get_translation(PF_IN, ifp, IPPROTO_UDP, 2486 saddr, uh->uh_sport, daddr, uh->uh_dport, 2487 &naddr, &nport, af)) != NULL) { 2488 PF_ACPY(&baddr, daddr, af); 2489 pf_change_ap(daddr, &uh->uh_dport, pd->ip_sum, 2490 &uh->uh_sum, &naddr, nport, 1, af); 2491 rewrite++; 2492 if (rdr->natpass) 2493 r = NULL; 2494 } 2495 } 2496 2497 while (r != NULL) { 2498 r->evaluations++; 2499 if (r->ifp != NULL && ((r->ifp != ifp && !r->ifnot) || 2500 (r->ifp == ifp && r->ifnot))) 2501 r = r->skip[PF_SKIP_IFP].ptr; 2502 else if (r->direction && r->direction != direction) 2503 r = r->skip[PF_SKIP_DIR].ptr; 2504 else if (r->af && r->af != af) 2505 r = r->skip[PF_SKIP_AF].ptr; 2506 else if (r->proto && r->proto != IPPROTO_UDP) 2507 r = r->skip[PF_SKIP_PROTO].ptr; 2508 else if (PF_MISMATCHAW(&r->src.addr, saddr, af, r->src.not)) 2509 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 2510 else if (r->src.port_op && !pf_match_port(r->src.port_op, 2511 r->src.port[0], r->src.port[1], uh->uh_sport)) 2512 r = r->skip[PF_SKIP_SRC_PORT].ptr; 2513 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af, r->dst.not)) 2514 r = r->skip[PF_SKIP_DST_ADDR].ptr; 2515 else if (r->dst.port_op && !pf_match_port(r->dst.port_op, 2516 r->dst.port[0], r->dst.port[1], uh->uh_dport)) 2517 r = r->skip[PF_SKIP_DST_PORT].ptr; 2518 else if (r->tos && !(r->tos & pd->tos)) 2519 r = TAILQ_NEXT(r, entries); 2520 else if (r->rule_flag & PFRULE_FRAGMENT) 2521 r = TAILQ_NEXT(r, entries); 2522 else if (r->uid.op && (lookup != -1 || (lookup = 2523 pf_socket_lookup(&uid, &gid, direction, af, IPPROTO_UDP, 2524 pd), 1)) && 2525 !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1], 2526 uid)) 2527 r = TAILQ_NEXT(r, entries); 2528 else if (r->gid.op && (lookup != -1 || (lookup = 2529 pf_socket_lookup(&uid, &gid, direction, af, IPPROTO_UDP, 2530 pd), 1)) && 2531 !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1], 2532 gid)) 2533 r = TAILQ_NEXT(r, entries); 2534 else if (r->match_tag && 2535 !pf_match_tag(m, r, nat, rdr, pftag, &tag)) 2536 r = TAILQ_NEXT(r, entries); 2537 else if (r->anchorname[0] && r->anchor == NULL) 2538 r = TAILQ_NEXT(r, entries); 2539 else { 2540 if (r->tag) 2541 tag = r->tag; 2542 if (r->anchor == NULL) { 2543 *rm = r; 2544 *am = a; 2545 *rsm = ruleset; 2546 if ((*rm)->quick) 2547 break; 2548 r = TAILQ_NEXT(r, entries); 2549 } else 2550 PF_STEP_INTO_ANCHOR(r, a, ruleset, 2551 PF_RULESET_FILTER); 2552 } 2553 if (r == NULL && a != NULL) 2554 PF_STEP_OUT_OF_ANCHOR(r, a, ruleset, 2555 PF_RULESET_FILTER); 2556 } 2557 r = *rm; 2558 a = *am; 2559 ruleset = *rsm; 2560 2561 r->packets++; 2562 r->bytes += pd->tot_len; 2563 if (a != NULL) { 2564 a->packets++; 2565 a->bytes += pd->tot_len; 2566 } 2567 REASON_SET(&reason, PFRES_MATCH); 2568 2569 if (r->log) { 2570 if (rewrite) 2571 m_copyback(m, off, sizeof(*uh), (caddr_t)uh); 2572 PFLOG_PACKET(ifp, h, m, af, direction, reason, r, a, ruleset); 2573 } 2574 2575 if ((r->action == PF_DROP) && 2576 ((r->rule_flag & PFRULE_RETURNICMP) || 2577 (r->rule_flag & PFRULE_RETURN))) { 2578 /* undo NAT changes, if they have taken place */ 2579 if (nat != NULL) { 2580 pf_change_ap(saddr, &uh->uh_sport, pd->ip_sum, 2581 &uh->uh_sum, &baddr, bport, 1, af); 2582 rewrite++; 2583 } else if (rdr != NULL) { 2584 pf_change_ap(daddr, &uh->uh_dport, pd->ip_sum, 2585 &uh->uh_sum, &baddr, bport, 1, af); 2586 rewrite++; 2587 } 2588 if ((af == AF_INET) && r->return_icmp) 2589 pf_send_icmp(m, r->return_icmp >> 8, 2590 r->return_icmp & 255, af, r); 2591 else if ((af == AF_INET6) && r->return_icmp6) 2592 pf_send_icmp(m, r->return_icmp6 >> 8, 2593 r->return_icmp6 & 255, af, r); 2594 } 2595 2596 if (r->action == PF_DROP) 2597 return (PF_DROP); 2598 2599 if (pf_tag_packet(m, pftag, tag)) { 2600 REASON_SET(&reason, PFRES_MEMORY); 2601 return (PF_DROP); 2602 } 2603 2604 if (r->keep_state || nat != NULL || rdr != NULL) { 2605 /* create new state */ 2606 struct pf_state *s = NULL; 2607 2608 if (!r->max_states || r->states < r->max_states) 2609 s = pool_get(&pf_state_pl, PR_NOWAIT); 2610 if (s == NULL) { 2611 REASON_SET(&reason, PFRES_MEMORY); 2612 return (PF_DROP); 2613 } 2614 bzero(s, sizeof(*s)); 2615 r->states++; 2616 if (a != NULL) 2617 a->states++; 2618 s->rule.ptr = r; 2619 if (nat != NULL) 2620 s->nat_rule.ptr = nat; 2621 else 2622 s->nat_rule.ptr = rdr; 2623 if (s->nat_rule.ptr != NULL) 2624 s->nat_rule.ptr->states++; 2625 s->anchor.ptr = a; 2626 s->allow_opts = r->allow_opts; 2627 s->log = r->log & 2; 2628 s->proto = IPPROTO_UDP; 2629 s->direction = direction; 2630 s->af = af; 2631 if (direction == PF_OUT) { 2632 PF_ACPY(&s->gwy.addr, saddr, af); 2633 s->gwy.port = uh->uh_sport; 2634 PF_ACPY(&s->ext.addr, daddr, af); 2635 s->ext.port = uh->uh_dport; 2636 if (nat != NULL) { 2637 PF_ACPY(&s->lan.addr, &baddr, af); 2638 s->lan.port = bport; 2639 } else { 2640 PF_ACPY(&s->lan.addr, &s->gwy.addr, af); 2641 s->lan.port = s->gwy.port; 2642 } 2643 } else { 2644 PF_ACPY(&s->lan.addr, daddr, af); 2645 s->lan.port = uh->uh_dport; 2646 PF_ACPY(&s->ext.addr, saddr, af); 2647 s->ext.port = uh->uh_sport; 2648 if (rdr != NULL) { 2649 PF_ACPY(&s->gwy.addr, &baddr, af); 2650 s->gwy.port = bport; 2651 } else { 2652 PF_ACPY(&s->gwy.addr, &s->lan.addr, af); 2653 s->gwy.port = s->lan.port; 2654 } 2655 } 2656 s->src.seqlo = 0; 2657 s->src.seqhi = 0; 2658 s->src.seqdiff = 0; 2659 s->src.max_win = 0; 2660 s->src.state = PFUDPS_SINGLE; 2661 s->dst.seqlo = 0; 2662 s->dst.seqhi = 0; 2663 s->dst.seqdiff = 0; 2664 s->dst.max_win = 0; 2665 s->dst.state = PFUDPS_NO_TRAFFIC; 2666 s->creation = time.tv_sec; 2667 s->expire = time.tv_sec; 2668 s->timeout = PFTM_UDP_FIRST_PACKET; 2669 s->packets[0] = 1; 2670 s->bytes[0] = pd->tot_len; 2671 pf_set_rt_ifp(s, saddr); 2672 if (pf_insert_state(s)) { 2673 REASON_SET(&reason, PFRES_MEMORY); 2674 pool_put(&pf_state_pl, s); 2675 return (PF_DROP); 2676 } else 2677 *sm = s; 2678 } 2679 2680 /* copy back packet headers if we performed NAT operations */ 2681 if (rewrite) 2682 m_copyback(m, off, sizeof(*uh), (caddr_t)uh); 2683 2684 return (PF_PASS); 2685 } 2686 2687 int 2688 pf_test_icmp(struct pf_rule **rm, struct pf_state **sm, int direction, 2689 struct ifnet *ifp, struct mbuf *m, int ipoff, int off, void *h, 2690 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm) 2691 { 2692 struct pf_rule *nat = NULL, *rdr = NULL; 2693 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 2694 struct pf_addr baddr, naddr; 2695 struct pf_rule *r, *a = NULL; 2696 struct pf_ruleset *ruleset = NULL; 2697 u_short reason; 2698 u_int16_t icmpid; 2699 sa_family_t af = pd->af; 2700 u_int8_t icmptype, icmpcode; 2701 int state_icmp = 0; 2702 struct pf_tag *pftag = NULL; 2703 int tag = -1; 2704 #ifdef INET6 2705 int rewrite = 0; 2706 #endif /* INET6 */ 2707 2708 switch (pd->proto) { 2709 #ifdef INET 2710 case IPPROTO_ICMP: 2711 icmptype = pd->hdr.icmp->icmp_type; 2712 icmpcode = pd->hdr.icmp->icmp_code; 2713 icmpid = pd->hdr.icmp->icmp_id; 2714 2715 if (icmptype == ICMP_UNREACH || 2716 icmptype == ICMP_SOURCEQUENCH || 2717 icmptype == ICMP_REDIRECT || 2718 icmptype == ICMP_TIMXCEED || 2719 icmptype == ICMP_PARAMPROB) 2720 state_icmp++; 2721 break; 2722 #endif /* INET */ 2723 #ifdef INET6 2724 case IPPROTO_ICMPV6: 2725 icmptype = pd->hdr.icmp6->icmp6_type; 2726 icmpcode = pd->hdr.icmp6->icmp6_code; 2727 icmpid = pd->hdr.icmp6->icmp6_id; 2728 2729 if (icmptype == ICMP6_DST_UNREACH || 2730 icmptype == ICMP6_PACKET_TOO_BIG || 2731 icmptype == ICMP6_TIME_EXCEEDED || 2732 icmptype == ICMP6_PARAM_PROB) 2733 state_icmp++; 2734 break; 2735 #endif /* INET6 */ 2736 } 2737 2738 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 2739 2740 if (direction == PF_OUT) { 2741 /* check outgoing packet for BINAT/NAT */ 2742 if ((nat = pf_get_translation(PF_OUT, ifp, pd->proto, 2743 saddr, 0, daddr, 0, &naddr, NULL, af)) != NULL) { 2744 PF_ACPY(&baddr, saddr, af); 2745 switch (af) { 2746 #ifdef INET 2747 case AF_INET: 2748 pf_change_a(&saddr->v4.s_addr, pd->ip_sum, 2749 naddr.v4.s_addr, 0); 2750 break; 2751 #endif /* INET */ 2752 #ifdef INET6 2753 case AF_INET6: 2754 pf_change_a6(saddr, &pd->hdr.icmp6->icmp6_cksum, 2755 &naddr, 0); 2756 rewrite++; 2757 break; 2758 #endif /* INET6 */ 2759 } 2760 if (nat->natpass) 2761 r = NULL; 2762 } 2763 } else { 2764 /* check incoming packet for BINAT/RDR */ 2765 if ((rdr = pf_get_translation(PF_IN, ifp, pd->proto, 2766 saddr, 0, daddr, 0, &naddr, NULL, af)) != NULL) { 2767 PF_ACPY(&baddr, daddr, af); 2768 switch (af) { 2769 #ifdef INET 2770 case AF_INET: 2771 pf_change_a(&daddr->v4.s_addr, 2772 pd->ip_sum, naddr.v4.s_addr, 0); 2773 break; 2774 #endif /* INET */ 2775 #ifdef INET6 2776 case AF_INET6: 2777 pf_change_a6(daddr, &pd->hdr.icmp6->icmp6_cksum, 2778 &naddr, 0); 2779 rewrite++; 2780 break; 2781 #endif /* INET6 */ 2782 } 2783 if (rdr->natpass) 2784 r = NULL; 2785 } 2786 } 2787 2788 while (r != NULL) { 2789 r->evaluations++; 2790 if (r->ifp != NULL && ((r->ifp != ifp && !r->ifnot) || 2791 (r->ifp == ifp && r->ifnot))) 2792 r = r->skip[PF_SKIP_IFP].ptr; 2793 else if (r->direction && r->direction != direction) 2794 r = r->skip[PF_SKIP_DIR].ptr; 2795 else if (r->af && r->af != af) 2796 r = r->skip[PF_SKIP_AF].ptr; 2797 else if (r->proto && r->proto != pd->proto) 2798 r = r->skip[PF_SKIP_PROTO].ptr; 2799 else if (PF_MISMATCHAW(&r->src.addr, saddr, af, r->src.not)) 2800 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 2801 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af, r->dst.not)) 2802 r = r->skip[PF_SKIP_DST_ADDR].ptr; 2803 else if (r->type && r->type != icmptype + 1) 2804 r = TAILQ_NEXT(r, entries); 2805 else if (r->code && r->code != icmpcode + 1) 2806 r = TAILQ_NEXT(r, entries); 2807 else if (r->tos && !(r->tos & pd->tos)) 2808 r = TAILQ_NEXT(r, entries); 2809 else if (r->rule_flag & PFRULE_FRAGMENT) 2810 r = TAILQ_NEXT(r, entries); 2811 else if (r->match_tag && 2812 !pf_match_tag(m, r, nat, rdr, pftag, &tag)) 2813 r = TAILQ_NEXT(r, entries); 2814 else if (r->anchorname[0] && r->anchor == NULL) 2815 r = TAILQ_NEXT(r, entries); 2816 else { 2817 if (r->tag) 2818 tag = r->tag; 2819 if (r->anchor == NULL) { 2820 *rm = r; 2821 *am = a; 2822 *rsm = ruleset; 2823 if ((*rm)->quick) 2824 break; 2825 r = TAILQ_NEXT(r, entries); 2826 } else 2827 PF_STEP_INTO_ANCHOR(r, a, ruleset, 2828 PF_RULESET_FILTER); 2829 } 2830 if (r == NULL && a != NULL) 2831 PF_STEP_OUT_OF_ANCHOR(r, a, ruleset, 2832 PF_RULESET_FILTER); 2833 } 2834 r = *rm; 2835 a = *am; 2836 ruleset = *rsm; 2837 2838 r->packets++; 2839 r->bytes += pd->tot_len; 2840 if (a != NULL) { 2841 a->packets++; 2842 a->bytes += pd->tot_len; 2843 } 2844 REASON_SET(&reason, PFRES_MATCH); 2845 2846 if (r->log) { 2847 #ifdef INET6 2848 if (rewrite) 2849 m_copyback(m, off, sizeof(struct icmp6_hdr), 2850 (caddr_t)pd->hdr.icmp6); 2851 #endif /* INET6 */ 2852 PFLOG_PACKET(ifp, h, m, af, direction, reason, r, a, ruleset); 2853 } 2854 2855 if (r->action != PF_PASS) 2856 return (PF_DROP); 2857 2858 if (pf_tag_packet(m, pftag, tag)) { 2859 REASON_SET(&reason, PFRES_MEMORY); 2860 return (PF_DROP); 2861 } 2862 2863 if (!state_icmp && (r->keep_state || 2864 nat != NULL || rdr != NULL)) { 2865 /* create new state */ 2866 struct pf_state *s = NULL; 2867 2868 if (!r->max_states || r->states < r->max_states) 2869 s = pool_get(&pf_state_pl, PR_NOWAIT); 2870 if (s == NULL) { 2871 REASON_SET(&reason, PFRES_MEMORY); 2872 return (PF_DROP); 2873 } 2874 bzero(s, sizeof(*s)); 2875 r->states++; 2876 if (a != NULL) 2877 a->states++; 2878 s->rule.ptr = r; 2879 if (nat != NULL) 2880 s->nat_rule.ptr = nat; 2881 else 2882 s->nat_rule.ptr = rdr; 2883 if (s->nat_rule.ptr != NULL) 2884 s->nat_rule.ptr->states++; 2885 s->anchor.ptr = a; 2886 s->allow_opts = r->allow_opts; 2887 s->log = r->log & 2; 2888 s->proto = pd->proto; 2889 s->direction = direction; 2890 s->af = af; 2891 if (direction == PF_OUT) { 2892 PF_ACPY(&s->gwy.addr, saddr, af); 2893 s->gwy.port = icmpid; 2894 PF_ACPY(&s->ext.addr, daddr, af); 2895 s->ext.port = icmpid; 2896 if (nat != NULL) 2897 PF_ACPY(&s->lan.addr, &baddr, af); 2898 else 2899 PF_ACPY(&s->lan.addr, &s->gwy.addr, af); 2900 s->lan.port = icmpid; 2901 } else { 2902 PF_ACPY(&s->lan.addr, daddr, af); 2903 s->lan.port = icmpid; 2904 PF_ACPY(&s->ext.addr, saddr, af); 2905 s->ext.port = icmpid; 2906 if (rdr != NULL) 2907 PF_ACPY(&s->gwy.addr, &baddr, af); 2908 else 2909 PF_ACPY(&s->gwy.addr, &s->lan.addr, af); 2910 s->gwy.port = icmpid; 2911 } 2912 s->src.seqlo = 0; 2913 s->src.seqhi = 0; 2914 s->src.seqdiff = 0; 2915 s->src.max_win = 0; 2916 s->src.state = 0; 2917 s->dst.seqlo = 0; 2918 s->dst.seqhi = 0; 2919 s->dst.seqdiff = 0; 2920 s->dst.max_win = 0; 2921 s->dst.state = 0; 2922 s->creation = time.tv_sec; 2923 s->expire = time.tv_sec; 2924 s->timeout = PFTM_ICMP_FIRST_PACKET; 2925 s->packets[0] = 1; 2926 s->bytes[0] = pd->tot_len; 2927 pf_set_rt_ifp(s, saddr); 2928 if (pf_insert_state(s)) { 2929 REASON_SET(&reason, PFRES_MEMORY); 2930 pool_put(&pf_state_pl, s); 2931 return (PF_DROP); 2932 } else 2933 *sm = s; 2934 } 2935 2936 #ifdef INET6 2937 /* copy back packet headers if we performed IPv6 NAT operations */ 2938 if (rewrite) 2939 m_copyback(m, off, sizeof(struct icmp6_hdr), 2940 (caddr_t)pd->hdr.icmp6); 2941 #endif /* INET6 */ 2942 2943 return (PF_PASS); 2944 } 2945 2946 int 2947 pf_test_other(struct pf_rule **rm, struct pf_state **sm, int direction, 2948 struct ifnet *ifp, struct mbuf *m, void *h, struct pf_pdesc *pd, 2949 struct pf_rule **am, struct pf_ruleset **rsm) 2950 { 2951 struct pf_rule *nat = NULL, *rdr = NULL; 2952 struct pf_rule *r, *a = NULL; 2953 struct pf_ruleset *ruleset = NULL; 2954 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 2955 struct pf_addr baddr, naddr; 2956 sa_family_t af = pd->af; 2957 u_short reason; 2958 struct pf_tag *pftag = NULL; 2959 int tag = -1; 2960 2961 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 2962 2963 if (direction == PF_OUT) { 2964 /* check outgoing packet for BINAT/NAT */ 2965 if ((nat = pf_get_translation(PF_OUT, ifp, pd->proto, 2966 saddr, 0, daddr, 0, &naddr, NULL, af)) != NULL) { 2967 PF_ACPY(&baddr, saddr, af); 2968 switch (af) { 2969 #ifdef INET 2970 case AF_INET: 2971 pf_change_a(&saddr->v4.s_addr, pd->ip_sum, 2972 naddr.v4.s_addr, 0); 2973 break; 2974 #endif /* INET */ 2975 #ifdef INET6 2976 case AF_INET6: 2977 PF_ACPY(saddr, &naddr, af); 2978 break; 2979 #endif /* INET6 */ 2980 } 2981 if (nat->natpass) 2982 r = NULL; 2983 } 2984 } else { 2985 /* check incoming packet for BINAT/RDR */ 2986 if ((rdr = pf_get_translation(PF_IN, ifp, pd->proto, 2987 saddr, 0, daddr, 0, &naddr, NULL, af)) != NULL) { 2988 PF_ACPY(&baddr, daddr, af); 2989 switch (af) { 2990 #ifdef INET 2991 case AF_INET: 2992 pf_change_a(&daddr->v4.s_addr, 2993 pd->ip_sum, naddr.v4.s_addr, 0); 2994 break; 2995 #endif /* INET */ 2996 #ifdef INET6 2997 case AF_INET6: 2998 PF_ACPY(daddr, &naddr, af); 2999 break; 3000 #endif /* INET6 */ 3001 } 3002 if (rdr->natpass) 3003 r = NULL; 3004 } 3005 } 3006 3007 while (r != NULL) { 3008 r->evaluations++; 3009 if (r->ifp != NULL && ((r->ifp != ifp && !r->ifnot) || 3010 (r->ifp == ifp && r->ifnot))) 3011 r = r->skip[PF_SKIP_IFP].ptr; 3012 else if (r->direction && r->direction != direction) 3013 r = r->skip[PF_SKIP_DIR].ptr; 3014 else if (r->af && r->af != af) 3015 r = r->skip[PF_SKIP_AF].ptr; 3016 else if (r->proto && r->proto != pd->proto) 3017 r = r->skip[PF_SKIP_PROTO].ptr; 3018 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af, r->src.not)) 3019 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 3020 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af, r->dst.not)) 3021 r = r->skip[PF_SKIP_DST_ADDR].ptr; 3022 else if (r->tos && !(r->tos & pd->tos)) 3023 r = TAILQ_NEXT(r, entries); 3024 else if (r->rule_flag & PFRULE_FRAGMENT) 3025 r = TAILQ_NEXT(r, entries); 3026 else if (r->match_tag && 3027 !pf_match_tag(m, r, nat, rdr, pftag, &tag)) 3028 r = TAILQ_NEXT(r, entries); 3029 else if (r->anchorname[0] && r->anchor == NULL) 3030 r = TAILQ_NEXT(r, entries); 3031 else { 3032 if (r->tag) 3033 tag = r->tag; 3034 if (r->anchor == NULL) { 3035 *rm = r; 3036 *am = a; 3037 *rsm = ruleset; 3038 if ((*rm)->quick) 3039 break; 3040 r = TAILQ_NEXT(r, entries); 3041 } else 3042 PF_STEP_INTO_ANCHOR(r, a, ruleset, 3043 PF_RULESET_FILTER); 3044 } 3045 if (r == NULL && a != NULL) 3046 PF_STEP_OUT_OF_ANCHOR(r, a, ruleset, 3047 PF_RULESET_FILTER); 3048 } 3049 r = *rm; 3050 a = *am; 3051 ruleset = *rsm; 3052 3053 r->packets++; 3054 r->bytes += pd->tot_len; 3055 if (a != NULL) { 3056 a->packets++; 3057 a->bytes += pd->tot_len; 3058 } 3059 REASON_SET(&reason, PFRES_MATCH); 3060 if (r->log) 3061 PFLOG_PACKET(ifp, h, m, af, direction, reason, r, a, ruleset); 3062 3063 if ((r->action == PF_DROP) && 3064 ((r->rule_flag & PFRULE_RETURNICMP) || 3065 (r->rule_flag & PFRULE_RETURN))) { 3066 struct pf_addr *a = NULL; 3067 3068 if (nat != NULL) 3069 a = saddr; 3070 else if (rdr != NULL) 3071 a = daddr; 3072 if (a != NULL) { 3073 switch (af) { 3074 #ifdef INET 3075 case AF_INET: 3076 pf_change_a(&a->v4.s_addr, pd->ip_sum, 3077 baddr.v4.s_addr, 0); 3078 break; 3079 #endif /* INET */ 3080 #ifdef INET6 3081 case AF_INET6: 3082 PF_ACPY(a, &baddr, af); 3083 break; 3084 #endif /* INET6 */ 3085 } 3086 } 3087 if ((af == AF_INET) && r->return_icmp) 3088 pf_send_icmp(m, r->return_icmp >> 8, 3089 r->return_icmp & 255, af, r); 3090 else if ((af == AF_INET6) && r->return_icmp6) 3091 pf_send_icmp(m, r->return_icmp6 >> 8, 3092 r->return_icmp6 & 255, af, r); 3093 } 3094 3095 if (r->action != PF_PASS) 3096 return (PF_DROP); 3097 3098 if (pf_tag_packet(m, pftag, tag)) { 3099 REASON_SET(&reason, PFRES_MEMORY); 3100 return (PF_DROP); 3101 } 3102 3103 if (r->keep_state || nat != NULL || rdr != NULL) { 3104 /* create new state */ 3105 struct pf_state *s = NULL; 3106 3107 if (!r->max_states || r->states < r->max_states) 3108 s = pool_get(&pf_state_pl, PR_NOWAIT); 3109 if (s == NULL) { 3110 REASON_SET(&reason, PFRES_MEMORY); 3111 return (PF_DROP); 3112 } 3113 bzero(s, sizeof(*s)); 3114 r->states++; 3115 if (a != NULL) 3116 a->states++; 3117 s->rule.ptr = r; 3118 if (nat != NULL) 3119 s->nat_rule.ptr = nat; 3120 else 3121 s->nat_rule.ptr = rdr; 3122 if (s->nat_rule.ptr != NULL) 3123 s->nat_rule.ptr->states++; 3124 s->anchor.ptr = a; 3125 s->allow_opts = r->allow_opts; 3126 s->log = r->log & 2; 3127 s->proto = pd->proto; 3128 s->direction = direction; 3129 s->af = af; 3130 if (direction == PF_OUT) { 3131 PF_ACPY(&s->gwy.addr, saddr, af); 3132 s->gwy.port = 0; 3133 PF_ACPY(&s->ext.addr, daddr, af); 3134 s->ext.port = 0; 3135 if (nat != NULL) 3136 PF_ACPY(&s->lan.addr, &baddr, af); 3137 else 3138 PF_ACPY(&s->lan.addr, &s->gwy.addr, af); 3139 s->lan.port = 0; 3140 } else { 3141 PF_ACPY(&s->lan.addr, daddr, af); 3142 s->lan.port = 0; 3143 PF_ACPY(&s->ext.addr, saddr, af); 3144 s->ext.port = 0; 3145 if (rdr != NULL) 3146 PF_ACPY(&s->gwy.addr, &baddr, af); 3147 else 3148 PF_ACPY(&s->gwy.addr, &s->lan.addr, af); 3149 s->gwy.port = 0; 3150 } 3151 s->src.seqlo = 0; 3152 s->src.seqhi = 0; 3153 s->src.seqdiff = 0; 3154 s->src.max_win = 0; 3155 s->src.state = PFOTHERS_SINGLE; 3156 s->dst.seqlo = 0; 3157 s->dst.seqhi = 0; 3158 s->dst.seqdiff = 0; 3159 s->dst.max_win = 0; 3160 s->dst.state = PFOTHERS_NO_TRAFFIC; 3161 s->creation = time.tv_sec; 3162 s->expire = time.tv_sec; 3163 s->timeout = PFTM_OTHER_FIRST_PACKET; 3164 s->packets[0] = 1; 3165 s->bytes[0] = pd->tot_len; 3166 pf_set_rt_ifp(s, saddr); 3167 if (pf_insert_state(s)) { 3168 REASON_SET(&reason, PFRES_MEMORY); 3169 if (r->log) 3170 PFLOG_PACKET(ifp, h, m, af, direction, reason, 3171 r, a, ruleset); 3172 pool_put(&pf_state_pl, s); 3173 return (PF_DROP); 3174 } else 3175 *sm = s; 3176 } 3177 3178 return (PF_PASS); 3179 } 3180 3181 int 3182 pf_test_fragment(struct pf_rule **rm, int direction, struct ifnet *ifp, 3183 struct mbuf *m, void *h, struct pf_pdesc *pd, struct pf_rule **am, 3184 struct pf_ruleset **rsm) 3185 { 3186 struct pf_rule *r, *a = NULL; 3187 struct pf_ruleset *ruleset = NULL; 3188 sa_family_t af = pd->af; 3189 u_short reason; 3190 struct pf_tag *pftag = NULL; 3191 int tag = -1; 3192 3193 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); 3194 while (r != NULL) { 3195 r->evaluations++; 3196 if (r->ifp != NULL && ((r->ifp != ifp && !r->ifnot) || 3197 (r->ifp == ifp && r->ifnot))) 3198 r = r->skip[PF_SKIP_IFP].ptr; 3199 else if (r->direction && r->direction != direction) 3200 r = r->skip[PF_SKIP_DIR].ptr; 3201 else if (r->af && r->af != af) 3202 r = r->skip[PF_SKIP_AF].ptr; 3203 else if (r->proto && r->proto != pd->proto) 3204 r = r->skip[PF_SKIP_PROTO].ptr; 3205 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af, r->src.not)) 3206 r = r->skip[PF_SKIP_SRC_ADDR].ptr; 3207 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af, r->dst.not)) 3208 r = r->skip[PF_SKIP_DST_ADDR].ptr; 3209 else if (r->tos && !(r->tos & pd->tos)) 3210 r = TAILQ_NEXT(r, entries); 3211 else if (r->src.port_op || r->dst.port_op || 3212 r->flagset || r->type || r->code) 3213 r = TAILQ_NEXT(r, entries); 3214 else if (r->match_tag && 3215 !pf_match_tag(m, r, NULL, NULL, pftag, &tag)) 3216 r = TAILQ_NEXT(r, entries); 3217 else if (r->anchorname[0] && r->anchor == NULL) 3218 r = TAILQ_NEXT(r, entries); 3219 else { 3220 if (r->anchor == NULL) { 3221 *rm = r; 3222 *am = a; 3223 *rsm = ruleset; 3224 if ((*rm)->quick) 3225 break; 3226 r = TAILQ_NEXT(r, entries); 3227 } else 3228 PF_STEP_INTO_ANCHOR(r, a, ruleset, 3229 PF_RULESET_FILTER); 3230 } 3231 if (r == NULL && a != NULL) 3232 PF_STEP_OUT_OF_ANCHOR(r, a, ruleset, 3233 PF_RULESET_FILTER); 3234 } 3235 r = *rm; 3236 a = *am; 3237 ruleset = *rsm; 3238 3239 r->packets++; 3240 r->bytes += pd->tot_len; 3241 if (a != NULL) { 3242 a->packets++; 3243 a->bytes += pd->tot_len; 3244 } 3245 REASON_SET(&reason, PFRES_MATCH); 3246 if (r->log) 3247 PFLOG_PACKET(ifp, h, m, af, direction, reason, r, a, ruleset); 3248 3249 if (r->action != PF_PASS) 3250 return (PF_DROP); 3251 3252 if (pf_tag_packet(m, pftag, tag)) { 3253 REASON_SET(&reason, PFRES_MEMORY); 3254 return (PF_DROP); 3255 } 3256 3257 return (PF_PASS); 3258 } 3259 3260 int 3261 pf_test_state_tcp(struct pf_state **state, int direction, struct ifnet *ifp, 3262 struct mbuf *m, int ipoff, int off, void *h, struct pf_pdesc *pd, 3263 u_short *reason) 3264 { 3265 struct pf_tree_node key; 3266 struct tcphdr *th = pd->hdr.tcp; 3267 u_int16_t win = ntohs(th->th_win); 3268 u_int32_t ack, end, seq; 3269 u_int8_t sws, dws; 3270 int ackskew, dirndx; 3271 int copyback = 0; 3272 struct pf_state_peer *src, *dst; 3273 3274 key.af = pd->af; 3275 key.proto = IPPROTO_TCP; 3276 PF_ACPY(&key.addr[0], pd->src, key.af); 3277 PF_ACPY(&key.addr[1], pd->dst, key.af); 3278 key.port[0] = th->th_sport; 3279 key.port[1] = th->th_dport; 3280 3281 STATE_LOOKUP(); 3282 3283 if (direction == (*state)->direction) { 3284 src = &(*state)->src; 3285 dst = &(*state)->dst; 3286 dirndx = 0; 3287 } else { 3288 src = &(*state)->dst; 3289 dst = &(*state)->src; 3290 dirndx = 1; 3291 } 3292 3293 if ((*state)->src.state == PF_TCPS_PROXY_SRC) { 3294 if (direction != (*state)->direction) 3295 return (PF_SYNPROXY_DROP); 3296 if (th->th_flags & TH_SYN) { 3297 if (ntohl(th->th_seq) != (*state)->src.seqlo) 3298 return (PF_DROP); 3299 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst, 3300 pd->src, th->th_dport, th->th_sport, 3301 (*state)->src.seqhi, ntohl(th->th_seq) + 1, 3302 TH_SYN|TH_ACK, 0, (*state)->src.mss, 0); 3303 return (PF_SYNPROXY_DROP); 3304 } else if (!(th->th_flags & TH_ACK) || 3305 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) || 3306 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) 3307 return (PF_DROP); 3308 else 3309 (*state)->src.state = PF_TCPS_PROXY_DST; 3310 } 3311 if ((*state)->src.state == PF_TCPS_PROXY_DST) { 3312 struct pf_state_host *src, *dst; 3313 3314 if (direction == PF_OUT) { 3315 src = &(*state)->gwy; 3316 dst = &(*state)->ext; 3317 } else { 3318 src = &(*state)->ext; 3319 dst = &(*state)->lan; 3320 } 3321 if (direction == (*state)->direction) { 3322 if (((th->th_flags & (TH_SYN|TH_ACK)) != TH_ACK) || 3323 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) || 3324 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) 3325 return (PF_DROP); 3326 (*state)->src.max_win = MAX(ntohs(th->th_win), 1); 3327 if ((*state)->dst.seqhi == 1) 3328 (*state)->dst.seqhi = arc4random(); 3329 pf_send_tcp((*state)->rule.ptr, pd->af, &src->addr, 3330 &dst->addr, src->port, dst->port, 3331 (*state)->dst.seqhi, 0, TH_SYN, 0, (*state)->src.mss, 0); 3332 return (PF_SYNPROXY_DROP); 3333 } else if (((th->th_flags & (TH_SYN|TH_ACK)) != 3334 (TH_SYN|TH_ACK)) || 3335 (ntohl(th->th_ack) != (*state)->dst.seqhi + 1)) 3336 return (PF_DROP); 3337 else { 3338 (*state)->dst.max_win = MAX(ntohs(th->th_win), 1); 3339 (*state)->dst.seqlo = ntohl(th->th_seq); 3340 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst, 3341 pd->src, th->th_dport, th->th_sport, 3342 ntohl(th->th_ack), ntohl(th->th_seq) + 1, 3343 TH_ACK, (*state)->src.max_win, 0, 0); 3344 pf_send_tcp((*state)->rule.ptr, pd->af, &src->addr, 3345 &dst->addr, src->port, dst->port, 3346 (*state)->src.seqhi + 1, (*state)->src.seqlo + 1, 3347 TH_ACK, (*state)->dst.max_win, 0, 0); 3348 (*state)->src.seqdiff = (*state)->dst.seqhi - 3349 (*state)->src.seqlo; 3350 (*state)->dst.seqdiff = (*state)->src.seqhi - 3351 (*state)->dst.seqlo; 3352 (*state)->src.seqhi = (*state)->src.seqlo + 3353 (*state)->src.max_win; 3354 (*state)->dst.seqhi = (*state)->dst.seqlo + 3355 (*state)->dst.max_win; 3356 (*state)->src.wscale = (*state)->dst.wscale = 0; 3357 (*state)->src.state = (*state)->dst.state = 3358 TCPS_ESTABLISHED; 3359 return (PF_SYNPROXY_DROP); 3360 } 3361 } 3362 3363 if (src->wscale && dst->wscale && !(th->th_flags & TH_SYN)) { 3364 sws = src->wscale & PF_WSCALE_MASK; 3365 dws = dst->wscale & PF_WSCALE_MASK; 3366 } else 3367 sws = dws = 0; 3368 3369 /* 3370 * Sequence tracking algorithm from Guido van Rooij's paper: 3371 * http://www.madison-gurkha.com/publications/tcp_filtering/ 3372 * tcp_filtering.ps 3373 */ 3374 3375 seq = ntohl(th->th_seq); 3376 if (src->seqlo == 0) { 3377 /* First packet from this end. Set its state */ 3378 3379 if ((pd->flags & PFDESC_TCP_NORM || dst->scrub) && 3380 src->scrub == NULL) { 3381 if (pf_normalize_tcp_init(m, off, pd, th, src, dst)) { 3382 REASON_SET(reason, PFRES_MEMORY); 3383 return (PF_DROP); 3384 } 3385 } 3386 3387 /* Deferred generation of sequence number modulator */ 3388 if (dst->seqdiff && !src->seqdiff) { 3389 while ((src->seqdiff = arc4random()) == 0) 3390 ; 3391 ack = ntohl(th->th_ack) - dst->seqdiff; 3392 pf_change_a(&th->th_seq, &th->th_sum, htonl(seq + 3393 src->seqdiff), 0); 3394 pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0); 3395 copyback = 1; 3396 } else { 3397 ack = ntohl(th->th_ack); 3398 } 3399 3400 end = seq + pd->p_len; 3401 if (th->th_flags & TH_SYN) { 3402 end++; 3403 if (dst->wscale & PF_WSCALE_FLAG) { 3404 src->wscale = pf_get_wscale(m, off, th->th_off, 3405 pd->af); 3406 if (src->wscale & PF_WSCALE_FLAG) { 3407 /* Remove scale factor from initial 3408 * window */ 3409 sws = src->wscale & PF_WSCALE_MASK; 3410 win = ((u_int32_t)win + (1 << sws) - 1) 3411 >> sws; 3412 dws = dst->wscale & PF_WSCALE_MASK; 3413 } else { 3414 /* fixup other window */ 3415 dst->max_win <<= dst->wscale & 3416 PF_WSCALE_MASK; 3417 /* in case of a retrans SYN|ACK */ 3418 dst->wscale = 0; 3419 } 3420 } 3421 } 3422 if (th->th_flags & TH_FIN) 3423 end++; 3424 3425 src->seqlo = seq; 3426 if (src->state < TCPS_SYN_SENT) 3427 src->state = TCPS_SYN_SENT; 3428 3429 /* 3430 * May need to slide the window (seqhi may have been set by 3431 * the crappy stack check or if we picked up the connection 3432 * after establishment) 3433 */ 3434 if (src->seqhi == 1 || 3435 SEQ_GEQ(end + MAX(1, dst->max_win << dws), src->seqhi)) 3436 src->seqhi = end + MAX(1, dst->max_win << dws); 3437 if (win > src->max_win) 3438 src->max_win = win; 3439 3440 } else { 3441 ack = ntohl(th->th_ack) - dst->seqdiff; 3442 if (src->seqdiff) { 3443 /* Modulate sequence numbers */ 3444 pf_change_a(&th->th_seq, &th->th_sum, htonl(seq + 3445 src->seqdiff), 0); 3446 pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0); 3447 copyback = 1; 3448 } 3449 end = seq + pd->p_len; 3450 if (th->th_flags & TH_SYN) 3451 end++; 3452 if (th->th_flags & TH_FIN) 3453 end++; 3454 } 3455 3456 if ((th->th_flags & TH_ACK) == 0) { 3457 /* Let it pass through the ack skew check */ 3458 ack = dst->seqlo; 3459 } else if ((ack == 0 && 3460 (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) || 3461 /* broken tcp stacks do not set ack */ 3462 (dst->state < TCPS_SYN_SENT)) { 3463 /* 3464 * Many stacks (ours included) will set the ACK number in an 3465 * FIN|ACK if the SYN times out -- no sequence to ACK. 3466 */ 3467 ack = dst->seqlo; 3468 } 3469 3470 if (seq == end) { 3471 /* Ease sequencing restrictions on no data packets */ 3472 seq = src->seqlo; 3473 end = seq; 3474 } 3475 3476 ackskew = dst->seqlo - ack; 3477 3478 #define MAXACKWINDOW (0xffff + 1500) /* 1500 is an arbitrary fudge factor */ 3479 if (SEQ_GEQ(src->seqhi, end) && 3480 /* Last octet inside other's window space */ 3481 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) && 3482 /* Retrans: not more than one window back */ 3483 (ackskew >= -MAXACKWINDOW) && 3484 /* Acking not more than one reassembled fragment backwards */ 3485 (ackskew <= (MAXACKWINDOW << sws))) { 3486 /* Acking not more than one window forward */ 3487 3488 (*state)->packets[dirndx]++; 3489 (*state)->bytes[dirndx] += pd->tot_len; 3490 3491 /* update max window */ 3492 if (src->max_win < win) 3493 src->max_win = win; 3494 /* synchronize sequencing */ 3495 if (SEQ_GT(end, src->seqlo)) 3496 src->seqlo = end; 3497 /* slide the window of what the other end can send */ 3498 if (SEQ_GEQ(ack + (win << sws), dst->seqhi)) 3499 dst->seqhi = ack + MAX((win << sws), 1); 3500 3501 3502 /* update states */ 3503 if (th->th_flags & TH_SYN) 3504 if (src->state < TCPS_SYN_SENT) 3505 src->state = TCPS_SYN_SENT; 3506 if (th->th_flags & TH_FIN) 3507 if (src->state < TCPS_CLOSING) 3508 src->state = TCPS_CLOSING; 3509 if (th->th_flags & TH_ACK) { 3510 if (dst->state == TCPS_SYN_SENT) 3511 dst->state = TCPS_ESTABLISHED; 3512 else if (dst->state == TCPS_CLOSING) 3513 dst->state = TCPS_FIN_WAIT_2; 3514 } 3515 if (th->th_flags & TH_RST) 3516 src->state = dst->state = TCPS_TIME_WAIT; 3517 3518 /* update expire time */ 3519 (*state)->expire = time.tv_sec; 3520 if (src->state >= TCPS_FIN_WAIT_2 && 3521 dst->state >= TCPS_FIN_WAIT_2) 3522 (*state)->timeout = PFTM_TCP_CLOSED; 3523 else if (src->state >= TCPS_FIN_WAIT_2 || 3524 dst->state >= TCPS_FIN_WAIT_2) 3525 (*state)->timeout = PFTM_TCP_FIN_WAIT; 3526 else if (src->state < TCPS_ESTABLISHED || 3527 dst->state < TCPS_ESTABLISHED) 3528 (*state)->timeout = PFTM_TCP_OPENING; 3529 else if (src->state >= TCPS_CLOSING || 3530 dst->state >= TCPS_CLOSING) 3531 (*state)->timeout = PFTM_TCP_CLOSING; 3532 else 3533 (*state)->timeout = PFTM_TCP_ESTABLISHED; 3534 3535 /* Fall through to PASS packet */ 3536 3537 } else if ((dst->state < TCPS_SYN_SENT || 3538 dst->state >= TCPS_FIN_WAIT_2 || 3539 src->state >= TCPS_FIN_WAIT_2) && 3540 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) && 3541 /* Within a window forward of the originating packet */ 3542 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW)) { 3543 /* Within a window backward of the originating packet */ 3544 3545 /* 3546 * This currently handles three situations: 3547 * 1) Stupid stacks will shotgun SYNs before their peer 3548 * replies. 3549 * 2) When PF catches an already established stream (the 3550 * firewall rebooted, the state table was flushed, routes 3551 * changed...) 3552 * 3) Packets get funky immediately after the connection 3553 * closes (this should catch Solaris spurious ACK|FINs 3554 * that web servers like to spew after a close) 3555 * 3556 * This must be a little more careful than the above code 3557 * since packet floods will also be caught here. We don't 3558 * update the TTL here to mitigate the damage of a packet 3559 * flood and so the same code can handle awkward establishment 3560 * and a loosened connection close. 3561 * In the establishment case, a correct peer response will 3562 * validate the connection, go through the normal state code 3563 * and keep updating the state TTL. 3564 */ 3565 3566 if (pf_status.debug >= PF_DEBUG_MISC) { 3567 printf("pf: loose state match: "); 3568 pf_print_state(*state); 3569 pf_print_flags(th->th_flags); 3570 printf(" seq=%u ack=%u len=%u ackskew=%d pkts=%d:%d\n", 3571 seq, ack, pd->p_len, ackskew, 3572 (*state)->packets[0], (*state)->packets[1]); 3573 } 3574 3575 (*state)->packets[dirndx]++; 3576 (*state)->bytes[dirndx] += pd->tot_len; 3577 3578 /* update max window */ 3579 if (src->max_win < win) 3580 src->max_win = win; 3581 /* synchronize sequencing */ 3582 if (SEQ_GT(end, src->seqlo)) 3583 src->seqlo = end; 3584 /* slide the window of what the other end can send */ 3585 if (SEQ_GEQ(ack + (win << sws), dst->seqhi)) 3586 dst->seqhi = ack + MAX((win << sws), 1); 3587 3588 /* 3589 * Cannot set dst->seqhi here since this could be a shotgunned 3590 * SYN and not an already established connection. 3591 */ 3592 3593 if (th->th_flags & TH_FIN) 3594 if (src->state < TCPS_CLOSING) 3595 src->state = TCPS_CLOSING; 3596 if (th->th_flags & TH_RST) 3597 src->state = dst->state = TCPS_TIME_WAIT; 3598 3599 /* Fall through to PASS packet */ 3600 3601 } else { 3602 if ((*state)->dst.state == TCPS_SYN_SENT && 3603 (*state)->src.state == TCPS_SYN_SENT) { 3604 /* Send RST for state mismatches during handshake */ 3605 if (!(th->th_flags & TH_RST)) { 3606 u_int32_t ack = ntohl(th->th_seq) + pd->p_len; 3607 3608 if (th->th_flags & TH_SYN) 3609 ack++; 3610 if (th->th_flags & TH_FIN) 3611 ack++; 3612 pf_send_tcp((*state)->rule.ptr, pd->af, 3613 pd->dst, pd->src, th->th_dport, 3614 th->th_sport, ntohl(th->th_ack), ack, 3615 TH_RST|TH_ACK, 0, 0, 3616 (*state)->rule.ptr->return_ttl); 3617 } 3618 src->seqlo = 0; 3619 src->seqhi = 1; 3620 src->max_win = 1; 3621 } else if (pf_status.debug >= PF_DEBUG_MISC) { 3622 printf("pf: BAD state: "); 3623 pf_print_state(*state); 3624 pf_print_flags(th->th_flags); 3625 printf(" seq=%u ack=%u len=%u ackskew=%d pkts=%d:%d " 3626 "dir=%s,%s\n", seq, ack, pd->p_len, ackskew, 3627 (*state)->packets[0], (*state)->packets[1], 3628 direction == PF_IN ? "in" : "out", 3629 direction == (*state)->direction ? "fwd" : "rev"); 3630 printf("pf: State failure on: %c %c %c %c | %c %c\n", 3631 SEQ_GEQ(src->seqhi, end) ? ' ' : '1', 3632 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) ? 3633 ' ': '2', 3634 (ackskew >= -MAXACKWINDOW) ? ' ' : '3', 3635 (ackskew <= (MAXACKWINDOW << sws)) ? ' ' : '4', 3636 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) ?' ' :'5', 3637 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW) ?' ' :'6'); 3638 } 3639 return (PF_DROP); 3640 } 3641 3642 if (dst->scrub || src->scrub) { 3643 if (pf_normalize_tcp_stateful(m, off, pd, reason, th, src, dst, 3644 ©back)) 3645 return (PF_DROP); 3646 } 3647 3648 /* Any packets which have gotten here are to be passed */ 3649 3650 /* translate source/destination address, if necessary */ 3651 if (STATE_TRANSLATE(*state)) { 3652 if (direction == PF_OUT) 3653 pf_change_ap(pd->src, &th->th_sport, pd->ip_sum, 3654 &th->th_sum, &(*state)->gwy.addr, 3655 (*state)->gwy.port, 0, pd->af); 3656 else 3657 pf_change_ap(pd->dst, &th->th_dport, pd->ip_sum, 3658 &th->th_sum, &(*state)->lan.addr, 3659 (*state)->lan.port, 0, pd->af); 3660 m_copyback(m, off, sizeof(*th), (caddr_t)th); 3661 } else if (copyback) { 3662 /* Copyback sequence modulation or stateful scrub changes */ 3663 m_copyback(m, off, sizeof(*th), (caddr_t)th); 3664 } 3665 3666 (*state)->rule.ptr->packets++; 3667 (*state)->rule.ptr->bytes += pd->tot_len; 3668 if ((*state)->nat_rule.ptr != NULL) { 3669 (*state)->nat_rule.ptr->packets++; 3670 (*state)->nat_rule.ptr->bytes += pd->tot_len; 3671 } 3672 if ((*state)->anchor.ptr != NULL) { 3673 (*state)->anchor.ptr->packets++; 3674 (*state)->anchor.ptr->bytes += pd->tot_len; 3675 } 3676 return (PF_PASS); 3677 } 3678 3679 int 3680 pf_test_state_udp(struct pf_state **state, int direction, struct ifnet *ifp, 3681 struct mbuf *m, int ipoff, int off, void *h, struct pf_pdesc *pd) 3682 { 3683 struct pf_state_peer *src, *dst; 3684 struct pf_tree_node key; 3685 struct udphdr *uh = pd->hdr.udp; 3686 int dirndx; 3687 3688 key.af = pd->af; 3689 key.proto = IPPROTO_UDP; 3690 PF_ACPY(&key.addr[0], pd->src, key.af); 3691 PF_ACPY(&key.addr[1], pd->dst, key.af); 3692 key.port[0] = uh->uh_sport; 3693 key.port[1] = uh->uh_dport; 3694 3695 STATE_LOOKUP(); 3696 3697 if (direction == (*state)->direction) { 3698 src = &(*state)->src; 3699 dst = &(*state)->dst; 3700 dirndx = 0; 3701 } else { 3702 src = &(*state)->dst; 3703 dst = &(*state)->src; 3704 dirndx = 1; 3705 } 3706 3707 (*state)->packets[dirndx]++; 3708 (*state)->bytes[dirndx] += pd->tot_len; 3709 3710 /* update states */ 3711 if (src->state < PFUDPS_SINGLE) 3712 src->state = PFUDPS_SINGLE; 3713 if (dst->state == PFUDPS_SINGLE) 3714 dst->state = PFUDPS_MULTIPLE; 3715 3716 /* update expire time */ 3717 (*state)->expire = time.tv_sec; 3718 if (src->state == PFUDPS_MULTIPLE && dst->state == PFUDPS_MULTIPLE) 3719 (*state)->timeout = PFTM_UDP_MULTIPLE; 3720 else 3721 (*state)->timeout = PFTM_UDP_SINGLE; 3722 3723 /* translate source/destination address, if necessary */ 3724 if (STATE_TRANSLATE(*state)) { 3725 if (direction == PF_OUT) 3726 pf_change_ap(pd->src, &uh->uh_sport, pd->ip_sum, 3727 &uh->uh_sum, &(*state)->gwy.addr, 3728 (*state)->gwy.port, 1, pd->af); 3729 else 3730 pf_change_ap(pd->dst, &uh->uh_dport, pd->ip_sum, 3731 &uh->uh_sum, &(*state)->lan.addr, 3732 (*state)->lan.port, 1, pd->af); 3733 m_copyback(m, off, sizeof(*uh), (caddr_t)uh); 3734 } 3735 3736 (*state)->rule.ptr->packets++; 3737 (*state)->rule.ptr->bytes += pd->tot_len; 3738 if ((*state)->nat_rule.ptr != NULL) { 3739 (*state)->nat_rule.ptr->packets++; 3740 (*state)->nat_rule.ptr->bytes += pd->tot_len; 3741 } 3742 if ((*state)->anchor.ptr != NULL) { 3743 (*state)->anchor.ptr->packets++; 3744 (*state)->anchor.ptr->bytes += pd->tot_len; 3745 } 3746 return (PF_PASS); 3747 } 3748 3749 int 3750 pf_test_state_icmp(struct pf_state **state, int direction, struct ifnet *ifp, 3751 struct mbuf *m, int ipoff, int off, void *h, struct pf_pdesc *pd) 3752 { 3753 struct pf_addr *saddr = pd->src, *daddr = pd->dst; 3754 u_int16_t icmpid, *icmpsum; 3755 u_int8_t icmptype; 3756 int state_icmp = 0, dirndx; 3757 3758 switch (pd->proto) { 3759 #ifdef INET 3760 case IPPROTO_ICMP: 3761 icmptype = pd->hdr.icmp->icmp_type; 3762 icmpid = pd->hdr.icmp->icmp_id; 3763 icmpsum = &pd->hdr.icmp->icmp_cksum; 3764 3765 if (icmptype == ICMP_UNREACH || 3766 icmptype == ICMP_SOURCEQUENCH || 3767 icmptype == ICMP_REDIRECT || 3768 icmptype == ICMP_TIMXCEED || 3769 icmptype == ICMP_PARAMPROB) 3770 state_icmp++; 3771 break; 3772 #endif /* INET */ 3773 #ifdef INET6 3774 case IPPROTO_ICMPV6: 3775 icmptype = pd->hdr.icmp6->icmp6_type; 3776 icmpid = pd->hdr.icmp6->icmp6_id; 3777 icmpsum = &pd->hdr.icmp6->icmp6_cksum; 3778 3779 if (icmptype == ICMP6_DST_UNREACH || 3780 icmptype == ICMP6_PACKET_TOO_BIG || 3781 icmptype == ICMP6_TIME_EXCEEDED || 3782 icmptype == ICMP6_PARAM_PROB) 3783 state_icmp++; 3784 break; 3785 #endif /* INET6 */ 3786 } 3787 3788 if (!state_icmp) { 3789 3790 /* 3791 * ICMP query/reply message not related to a TCP/UDP packet. 3792 * Search for an ICMP state. 3793 */ 3794 struct pf_tree_node key; 3795 3796 key.af = pd->af; 3797 key.proto = pd->proto; 3798 PF_ACPY(&key.addr[0], saddr, key.af); 3799 PF_ACPY(&key.addr[1], daddr, key.af); 3800 key.port[0] = icmpid; 3801 key.port[1] = icmpid; 3802 3803 STATE_LOOKUP(); 3804 3805 dirndx = (direction == (*state)->direction) ? 0 : 1; 3806 (*state)->packets[dirndx]++; 3807 (*state)->bytes[dirndx] += pd->tot_len; 3808 (*state)->expire = time.tv_sec; 3809 (*state)->timeout = PFTM_ICMP_ERROR_REPLY; 3810 3811 /* translate source/destination address, if necessary */ 3812 if (PF_ANEQ(&(*state)->lan.addr, &(*state)->gwy.addr, pd->af)) { 3813 if (direction == PF_OUT) { 3814 switch (pd->af) { 3815 #ifdef INET 3816 case AF_INET: 3817 pf_change_a(&saddr->v4.s_addr, 3818 pd->ip_sum, 3819 (*state)->gwy.addr.v4.s_addr, 0); 3820 break; 3821 #endif /* INET */ 3822 #ifdef INET6 3823 case AF_INET6: 3824 pf_change_a6(saddr, 3825 &pd->hdr.icmp6->icmp6_cksum, 3826 &(*state)->gwy.addr, 0); 3827 m_copyback(m, off, 3828 sizeof(struct icmp6_hdr), 3829 (caddr_t)pd->hdr.icmp6); 3830 break; 3831 #endif /* INET6 */ 3832 } 3833 } else { 3834 switch (pd->af) { 3835 #ifdef INET 3836 case AF_INET: 3837 pf_change_a(&daddr->v4.s_addr, 3838 pd->ip_sum, 3839 (*state)->lan.addr.v4.s_addr, 0); 3840 break; 3841 #endif /* INET */ 3842 #ifdef INET6 3843 case AF_INET6: 3844 pf_change_a6(daddr, 3845 &pd->hdr.icmp6->icmp6_cksum, 3846 &(*state)->lan.addr, 0); 3847 m_copyback(m, off, 3848 sizeof(struct icmp6_hdr), 3849 (caddr_t)pd->hdr.icmp6); 3850 break; 3851 #endif /* INET6 */ 3852 } 3853 } 3854 } 3855 3856 return (PF_PASS); 3857 3858 } else { 3859 /* 3860 * ICMP error message in response to a TCP/UDP packet. 3861 * Extract the inner TCP/UDP header and search for that state. 3862 */ 3863 3864 struct pf_pdesc pd2; 3865 #ifdef INET 3866 struct ip h2; 3867 #endif /* INET */ 3868 #ifdef INET6 3869 struct ip6_hdr h2_6; 3870 int terminal = 0; 3871 #endif /* INET6 */ 3872 int ipoff2; 3873 int off2; 3874 3875 pd2.af = pd->af; 3876 switch (pd->af) { 3877 #ifdef INET 3878 case AF_INET: 3879 /* offset of h2 in mbuf chain */ 3880 ipoff2 = off + ICMP_MINLEN; 3881 3882 if (!pf_pull_hdr(m, ipoff2, &h2, sizeof(h2), 3883 NULL, NULL, pd2.af)) { 3884 DPFPRINTF(PF_DEBUG_MISC, 3885 ("pf: ICMP error message too short " 3886 "(ip)\n")); 3887 return (PF_DROP); 3888 } 3889 /* 3890 * ICMP error messages don't refer to non-first 3891 * fragments 3892 */ 3893 if (h2.ip_off & htons(IP_OFFMASK)) 3894 return (PF_DROP); 3895 3896 /* offset of protocol header that follows h2 */ 3897 off2 = ipoff2 + (h2.ip_hl << 2); 3898 3899 pd2.proto = h2.ip_p; 3900 pd2.src = (struct pf_addr *)&h2.ip_src; 3901 pd2.dst = (struct pf_addr *)&h2.ip_dst; 3902 pd2.ip_sum = &h2.ip_sum; 3903 break; 3904 #endif /* INET */ 3905 #ifdef INET6 3906 case AF_INET6: 3907 ipoff2 = off + sizeof(struct icmp6_hdr); 3908 3909 if (!pf_pull_hdr(m, ipoff2, &h2_6, sizeof(h2_6), 3910 NULL, NULL, pd2.af)) { 3911 DPFPRINTF(PF_DEBUG_MISC, 3912 ("pf: ICMP error message too short " 3913 "(ip6)\n")); 3914 return (PF_DROP); 3915 } 3916 pd2.proto = h2_6.ip6_nxt; 3917 pd2.src = (struct pf_addr *)&h2_6.ip6_src; 3918 pd2.dst = (struct pf_addr *)&h2_6.ip6_dst; 3919 pd2.ip_sum = NULL; 3920 off2 = ipoff2 + sizeof(h2_6); 3921 do { 3922 switch (pd2.proto) { 3923 case IPPROTO_FRAGMENT: 3924 /* 3925 * ICMPv6 error messages for 3926 * non-first fragments 3927 */ 3928 return (PF_DROP); 3929 case IPPROTO_AH: 3930 case IPPROTO_HOPOPTS: 3931 case IPPROTO_ROUTING: 3932 case IPPROTO_DSTOPTS: { 3933 /* get next header and header length */ 3934 struct ip6_ext opt6; 3935 3936 if (!pf_pull_hdr(m, off2, &opt6, 3937 sizeof(opt6), NULL, NULL, pd2.af)) { 3938 DPFPRINTF(PF_DEBUG_MISC, 3939 ("pf: ICMPv6 short opt\n")); 3940 return (PF_DROP); 3941 } 3942 if (pd2.proto == IPPROTO_AH) 3943 off2 += (opt6.ip6e_len + 2) * 4; 3944 else 3945 off2 += (opt6.ip6e_len + 1) * 8; 3946 pd2.proto = opt6.ip6e_nxt; 3947 /* goto the next header */ 3948 break; 3949 } 3950 default: 3951 terminal++; 3952 break; 3953 } 3954 } while (!terminal); 3955 break; 3956 #endif /* INET6 */ 3957 } 3958 3959 switch (pd2.proto) { 3960 case IPPROTO_TCP: { 3961 struct tcphdr th; 3962 u_int32_t seq; 3963 struct pf_tree_node key; 3964 struct pf_state_peer *src, *dst; 3965 u_int8_t dws; 3966 3967 /* 3968 * Only the first 8 bytes of the TCP header can be 3969 * expected. Don't access any TCP header fields after 3970 * th_seq, an ackskew test is not possible. 3971 */ 3972 if (!pf_pull_hdr(m, off2, &th, 8, NULL, NULL, pd2.af)) { 3973 DPFPRINTF(PF_DEBUG_MISC, 3974 ("pf: ICMP error message too short " 3975 "(tcp)\n")); 3976 return (PF_DROP); 3977 } 3978 3979 key.af = pd2.af; 3980 key.proto = IPPROTO_TCP; 3981 PF_ACPY(&key.addr[0], pd2.dst, pd2.af); 3982 key.port[0] = th.th_dport; 3983 PF_ACPY(&key.addr[1], pd2.src, pd2.af); 3984 key.port[1] = th.th_sport; 3985 3986 STATE_LOOKUP(); 3987 3988 if (direction == (*state)->direction) { 3989 src = &(*state)->dst; 3990 dst = &(*state)->src; 3991 } else { 3992 src = &(*state)->src; 3993 dst = &(*state)->dst; 3994 } 3995 3996 if (src->wscale && dst->wscale && !(th.th_flags & TH_SYN)) 3997 dws = dst->wscale & PF_WSCALE_MASK; 3998 else 3999 dws = 0; 4000 4001 /* Demodulate sequence number */ 4002 seq = ntohl(th.th_seq) - src->seqdiff; 4003 if (src->seqdiff) 4004 pf_change_a(&th.th_seq, &th.th_sum, 4005 htonl(seq), 0); 4006 4007 if (!SEQ_GEQ(src->seqhi, seq) || 4008 !SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws))) { 4009 if (pf_status.debug >= PF_DEBUG_MISC) { 4010 printf("pf: BAD ICMP %d:%d ", 4011 icmptype, pd->hdr.icmp->icmp_code); 4012 pf_print_host(pd->src, 0, pd->af); 4013 printf(" -> "); 4014 pf_print_host(pd->dst, 0, pd->af); 4015 printf(" state: "); 4016 pf_print_state(*state); 4017 printf(" seq=%u\n", seq); 4018 } 4019 return (PF_DROP); 4020 } 4021 4022 if (STATE_TRANSLATE(*state)) { 4023 if (direction == PF_IN) { 4024 pf_change_icmp(pd2.src, &th.th_sport, 4025 saddr, &(*state)->lan.addr, 4026 (*state)->lan.port, NULL, 4027 pd2.ip_sum, icmpsum, 4028 pd->ip_sum, 0, pd2.af); 4029 } else { 4030 pf_change_icmp(pd2.dst, &th.th_dport, 4031 saddr, &(*state)->gwy.addr, 4032 (*state)->gwy.port, NULL, 4033 pd2.ip_sum, icmpsum, 4034 pd->ip_sum, 0, pd2.af); 4035 } 4036 switch (pd2.af) { 4037 #ifdef INET 4038 case AF_INET: 4039 m_copyback(m, off, ICMP_MINLEN, 4040 (caddr_t)pd->hdr.icmp); 4041 m_copyback(m, ipoff2, sizeof(h2), 4042 (caddr_t)&h2); 4043 break; 4044 #endif /* INET */ 4045 #ifdef INET6 4046 case AF_INET6: 4047 m_copyback(m, off, 4048 sizeof(struct icmp6_hdr), 4049 (caddr_t)pd->hdr.icmp6); 4050 m_copyback(m, ipoff2, sizeof(h2_6), 4051 (caddr_t)&h2_6); 4052 break; 4053 #endif /* INET6 */ 4054 } 4055 m_copyback(m, off2, 8, (caddr_t)&th); 4056 } else if (src->seqdiff) { 4057 m_copyback(m, off2, 8, (caddr_t)&th); 4058 } 4059 4060 return (PF_PASS); 4061 break; 4062 } 4063 case IPPROTO_UDP: { 4064 struct udphdr uh; 4065 struct pf_tree_node key; 4066 4067 if (!pf_pull_hdr(m, off2, &uh, sizeof(uh), 4068 NULL, NULL, pd2.af)) { 4069 DPFPRINTF(PF_DEBUG_MISC, 4070 ("pf: ICMP error message too short " 4071 "(udp)\n")); 4072 return (PF_DROP); 4073 } 4074 4075 key.af = pd2.af; 4076 key.proto = IPPROTO_UDP; 4077 PF_ACPY(&key.addr[0], pd2.dst, pd2.af); 4078 key.port[0] = uh.uh_dport; 4079 PF_ACPY(&key.addr[1], pd2.src, pd2.af); 4080 key.port[1] = uh.uh_sport; 4081 4082 STATE_LOOKUP(); 4083 4084 if (STATE_TRANSLATE(*state)) { 4085 if (direction == PF_IN) { 4086 pf_change_icmp(pd2.src, &uh.uh_sport, 4087 daddr, &(*state)->lan.addr, 4088 (*state)->lan.port, &uh.uh_sum, 4089 pd2.ip_sum, icmpsum, 4090 pd->ip_sum, 1, pd2.af); 4091 } else { 4092 pf_change_icmp(pd2.dst, &uh.uh_dport, 4093 saddr, &(*state)->gwy.addr, 4094 (*state)->gwy.port, &uh.uh_sum, 4095 pd2.ip_sum, icmpsum, 4096 pd->ip_sum, 1, pd2.af); 4097 } 4098 switch (pd2.af) { 4099 #ifdef INET 4100 case AF_INET: 4101 m_copyback(m, off, ICMP_MINLEN, 4102 (caddr_t)pd->hdr.icmp); 4103 m_copyback(m, ipoff2, sizeof(h2), 4104 (caddr_t)&h2); 4105 break; 4106 #endif /* INET */ 4107 #ifdef INET6 4108 case AF_INET6: 4109 m_copyback(m, off, 4110 sizeof(struct icmp6_hdr), 4111 (caddr_t)pd->hdr.icmp6); 4112 m_copyback(m, ipoff2, sizeof(h2_6), 4113 (caddr_t)&h2_6); 4114 break; 4115 #endif /* INET6 */ 4116 } 4117 m_copyback(m, off2, sizeof(uh), 4118 (caddr_t)&uh); 4119 } 4120 4121 return (PF_PASS); 4122 break; 4123 } 4124 #ifdef INET 4125 case IPPROTO_ICMP: { 4126 struct icmp iih; 4127 struct pf_tree_node key; 4128 4129 if (!pf_pull_hdr(m, off2, &iih, ICMP_MINLEN, 4130 NULL, NULL, pd2.af)) { 4131 DPFPRINTF(PF_DEBUG_MISC, 4132 ("pf: ICMP error message too short i" 4133 "(icmp)\n")); 4134 return (PF_DROP); 4135 } 4136 4137 key.af = pd2.af; 4138 key.proto = IPPROTO_ICMP; 4139 PF_ACPY(&key.addr[0], pd2.dst, pd2.af); 4140 key.port[0] = iih.icmp_id; 4141 PF_ACPY(&key.addr[1], pd2.src, pd2.af); 4142 key.port[1] = iih.icmp_id; 4143 4144 STATE_LOOKUP(); 4145 4146 if (STATE_TRANSLATE(*state)) { 4147 if (direction == PF_IN) { 4148 pf_change_icmp(pd2.src, &iih.icmp_id, 4149 daddr, &(*state)->lan.addr, 4150 (*state)->lan.port, NULL, 4151 pd2.ip_sum, icmpsum, 4152 pd->ip_sum, 0, AF_INET); 4153 } else { 4154 pf_change_icmp(pd2.dst, &iih.icmp_id, 4155 saddr, &(*state)->gwy.addr, 4156 (*state)->gwy.port, NULL, 4157 pd2.ip_sum, icmpsum, 4158 pd->ip_sum, 0, AF_INET); 4159 } 4160 m_copyback(m, off, ICMP_MINLEN, 4161 (caddr_t)pd->hdr.icmp); 4162 m_copyback(m, ipoff2, sizeof(h2), 4163 (caddr_t)&h2); 4164 m_copyback(m, off2, ICMP_MINLEN, 4165 (caddr_t)&iih); 4166 } 4167 4168 return (PF_PASS); 4169 break; 4170 } 4171 #endif /* INET */ 4172 #ifdef INET6 4173 case IPPROTO_ICMPV6: { 4174 struct icmp6_hdr iih; 4175 struct pf_tree_node key; 4176 4177 if (!pf_pull_hdr(m, off2, &iih, 4178 sizeof(struct icmp6_hdr), NULL, NULL, pd2.af)) { 4179 DPFPRINTF(PF_DEBUG_MISC, 4180 ("pf: ICMP error message too short " 4181 "(icmp6)\n")); 4182 return (PF_DROP); 4183 } 4184 4185 key.af = pd2.af; 4186 key.proto = IPPROTO_ICMPV6; 4187 PF_ACPY(&key.addr[0], pd2.dst, pd2.af); 4188 key.port[0] = iih.icmp6_id; 4189 PF_ACPY(&key.addr[1], pd2.src, pd2.af); 4190 key.port[1] = iih.icmp6_id; 4191 4192 STATE_LOOKUP(); 4193 4194 if (STATE_TRANSLATE(*state)) { 4195 if (direction == PF_IN) { 4196 pf_change_icmp(pd2.src, &iih.icmp6_id, 4197 daddr, &(*state)->lan.addr, 4198 (*state)->lan.port, NULL, 4199 pd2.ip_sum, icmpsum, 4200 pd->ip_sum, 0, AF_INET6); 4201 } else { 4202 pf_change_icmp(pd2.dst, &iih.icmp6_id, 4203 saddr, &(*state)->gwy.addr, 4204 (*state)->gwy.port, NULL, 4205 pd2.ip_sum, icmpsum, 4206 pd->ip_sum, 0, AF_INET6); 4207 } 4208 m_copyback(m, off, sizeof(struct icmp6_hdr), 4209 (caddr_t)pd->hdr.icmp6); 4210 m_copyback(m, ipoff2, sizeof(h2_6), 4211 (caddr_t)&h2_6); 4212 m_copyback(m, off2, sizeof(struct icmp6_hdr), 4213 (caddr_t)&iih); 4214 } 4215 4216 return (PF_PASS); 4217 break; 4218 } 4219 #endif /* INET6 */ 4220 default: { 4221 struct pf_tree_node key; 4222 4223 key.af = pd2.af; 4224 key.proto = pd2.proto; 4225 PF_ACPY(&key.addr[0], pd2.dst, pd2.af); 4226 key.port[0] = 0; 4227 PF_ACPY(&key.addr[1], pd2.src, pd2.af); 4228 key.port[1] = 0; 4229 4230 STATE_LOOKUP(); 4231 4232 if (STATE_TRANSLATE(*state)) { 4233 if (direction == PF_IN) { 4234 pf_change_icmp(pd2.src, NULL, 4235 daddr, &(*state)->lan.addr, 4236 0, NULL, 4237 pd2.ip_sum, icmpsum, 4238 pd->ip_sum, 0, pd2.af); 4239 } else { 4240 pf_change_icmp(pd2.dst, NULL, 4241 saddr, &(*state)->gwy.addr, 4242 0, NULL, 4243 pd2.ip_sum, icmpsum, 4244 pd->ip_sum, 0, pd2.af); 4245 } 4246 switch (pd2.af) { 4247 #ifdef INET 4248 case AF_INET: 4249 m_copyback(m, off, ICMP_MINLEN, 4250 (caddr_t)pd->hdr.icmp); 4251 m_copyback(m, ipoff2, sizeof(h2), 4252 (caddr_t)&h2); 4253 break; 4254 #endif /* INET */ 4255 #ifdef INET6 4256 case AF_INET6: 4257 m_copyback(m, off, 4258 sizeof(struct icmp6_hdr), 4259 (caddr_t)pd->hdr.icmp6); 4260 m_copyback(m, ipoff2, sizeof(h2_6), 4261 (caddr_t)&h2_6); 4262 break; 4263 #endif /* INET6 */ 4264 } 4265 } 4266 4267 return (PF_PASS); 4268 break; 4269 } 4270 } 4271 } 4272 } 4273 4274 int 4275 pf_test_state_other(struct pf_state **state, int direction, struct ifnet *ifp, 4276 struct pf_pdesc *pd) 4277 { 4278 struct pf_state_peer *src, *dst; 4279 struct pf_tree_node key; 4280 int dirndx; 4281 4282 key.af = pd->af; 4283 key.proto = pd->proto; 4284 PF_ACPY(&key.addr[0], pd->src, key.af); 4285 PF_ACPY(&key.addr[1], pd->dst, key.af); 4286 key.port[0] = 0; 4287 key.port[1] = 0; 4288 4289 STATE_LOOKUP(); 4290 4291 if (direction == (*state)->direction) { 4292 src = &(*state)->src; 4293 dst = &(*state)->dst; 4294 dirndx = 0; 4295 } else { 4296 src = &(*state)->dst; 4297 dst = &(*state)->src; 4298 dirndx = 1; 4299 } 4300 4301 (*state)->packets[dirndx]++; 4302 (*state)->bytes[dirndx] += pd->tot_len; 4303 4304 /* update states */ 4305 if (src->state < PFOTHERS_SINGLE) 4306 src->state = PFOTHERS_SINGLE; 4307 if (dst->state == PFOTHERS_SINGLE) 4308 dst->state = PFOTHERS_MULTIPLE; 4309 4310 /* update expire time */ 4311 (*state)->expire = time.tv_sec; 4312 if (src->state == PFOTHERS_MULTIPLE && dst->state == PFOTHERS_MULTIPLE) 4313 (*state)->timeout = PFTM_OTHER_MULTIPLE; 4314 else 4315 (*state)->timeout = PFTM_OTHER_SINGLE; 4316 4317 /* translate source/destination address, if necessary */ 4318 if (STATE_TRANSLATE(*state)) { 4319 if (direction == PF_OUT) 4320 switch (pd->af) { 4321 #ifdef INET 4322 case AF_INET: 4323 pf_change_a(&pd->src->v4.s_addr, 4324 pd->ip_sum, (*state)->gwy.addr.v4.s_addr, 4325 0); 4326 break; 4327 #endif /* INET */ 4328 #ifdef INET6 4329 case AF_INET6: 4330 PF_ACPY(pd->src, &(*state)->gwy.addr, pd->af); 4331 break; 4332 #endif /* INET6 */ 4333 } 4334 else 4335 switch (pd->af) { 4336 #ifdef INET 4337 case AF_INET: 4338 pf_change_a(&pd->dst->v4.s_addr, 4339 pd->ip_sum, (*state)->lan.addr.v4.s_addr, 4340 0); 4341 break; 4342 #endif /* INET */ 4343 #ifdef INET6 4344 case AF_INET6: 4345 PF_ACPY(pd->dst, &(*state)->lan.addr, pd->af); 4346 break; 4347 #endif /* INET6 */ 4348 } 4349 } 4350 4351 (*state)->rule.ptr->packets++; 4352 (*state)->rule.ptr->bytes += pd->tot_len; 4353 if ((*state)->nat_rule.ptr != NULL) { 4354 (*state)->nat_rule.ptr->packets++; 4355 (*state)->nat_rule.ptr->bytes += pd->tot_len; 4356 } 4357 if ((*state)->anchor.ptr != NULL) { 4358 (*state)->anchor.ptr->packets++; 4359 (*state)->anchor.ptr->bytes += pd->tot_len; 4360 } 4361 return (PF_PASS); 4362 } 4363 4364 /* 4365 * ipoff and off are measured from the start of the mbuf chain. 4366 * h must be at "ipoff" on the mbuf chain. 4367 */ 4368 void * 4369 pf_pull_hdr(struct mbuf *m, int off, void *p, int len, 4370 u_short *actionp, u_short *reasonp, sa_family_t af) 4371 { 4372 switch (af) { 4373 #ifdef INET 4374 case AF_INET: { 4375 struct ip *h = mtod(m, struct ip *); 4376 u_int16_t fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3; 4377 4378 if (fragoff) { 4379 if (fragoff >= len) 4380 ACTION_SET(actionp, PF_PASS); 4381 else { 4382 ACTION_SET(actionp, PF_DROP); 4383 REASON_SET(reasonp, PFRES_FRAG); 4384 } 4385 return (NULL); 4386 } 4387 if (m->m_pkthdr.len < off + len || ntohs(h->ip_len) < off + len) { 4388 ACTION_SET(actionp, PF_DROP); 4389 REASON_SET(reasonp, PFRES_SHORT); 4390 return (NULL); 4391 } 4392 break; 4393 } 4394 #endif /* INET */ 4395 #ifdef INET6 4396 case AF_INET6: { 4397 struct ip6_hdr *h = mtod(m, struct ip6_hdr *); 4398 4399 if (m->m_pkthdr.len < off + len || 4400 (ntohs(h->ip6_plen) + sizeof(struct ip6_hdr)) < 4401 (unsigned)(off + len)) { 4402 ACTION_SET(actionp, PF_DROP); 4403 REASON_SET(reasonp, PFRES_SHORT); 4404 return (NULL); 4405 } 4406 break; 4407 } 4408 #endif /* INET6 */ 4409 } 4410 m_copydata(m, off, len, p); 4411 return (p); 4412 } 4413 4414 int 4415 pf_routable(struct pf_addr *addr, sa_family_t af) 4416 { 4417 struct sockaddr_in *dst; 4418 struct route ro; 4419 int ret = 0; 4420 4421 bzero(&ro, sizeof(ro)); 4422 dst = satosin(&ro.ro_dst); 4423 dst->sin_family = af; 4424 dst->sin_len = sizeof(*dst); 4425 dst->sin_addr = addr->v4; 4426 rtalloc_noclone(&ro, NO_CLONING); 4427 4428 if (ro.ro_rt != NULL) { 4429 ret = 1; 4430 RTFREE(ro.ro_rt); 4431 } 4432 4433 return (ret); 4434 } 4435 4436 #ifdef INET 4437 void 4438 pf_route(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp, 4439 struct pf_state *s) 4440 { 4441 struct mbuf *m0, *m1; 4442 struct route iproute; 4443 struct route *ro; 4444 struct sockaddr_in *dst; 4445 struct ip *ip; 4446 struct ifnet *ifp = NULL; 4447 struct m_tag *mtag; 4448 struct pf_addr naddr; 4449 int error = 0; 4450 4451 if (m == NULL || *m == NULL || r == NULL || 4452 (dir != PF_IN && dir != PF_OUT) || oifp == NULL) 4453 panic("pf_route: invalid parameters"); 4454 4455 if (r->rt == PF_DUPTO) { 4456 m0 = *m; 4457 mtag = m_tag_find(m0, PACKET_TAG_PF_ROUTED, NULL); 4458 if (mtag == NULL) { 4459 mtag = m_tag_get(PACKET_TAG_PF_ROUTED, 0, M_NOWAIT); 4460 if (mtag == NULL) 4461 goto bad; 4462 m_tag_prepend(m0, mtag); 4463 } 4464 m0 = m_copym2(*m, 0, M_COPYALL, M_NOWAIT); 4465 if (m0 == NULL) 4466 return; 4467 } else { 4468 if ((r->rt == PF_REPLYTO) == (r->direction == dir)) 4469 return; 4470 m0 = *m; 4471 } 4472 4473 if (m0->m_len < sizeof(struct ip)) 4474 panic("pf_route: m0->m_len < sizeof(struct ip)"); 4475 ip = mtod(m0, struct ip *); 4476 4477 ro = &iproute; 4478 bzero((caddr_t)ro, sizeof(*ro)); 4479 dst = satosin(&ro->ro_dst); 4480 dst->sin_family = AF_INET; 4481 dst->sin_len = sizeof(*dst); 4482 dst->sin_addr = ip->ip_dst; 4483 4484 if (r->rt == PF_FASTROUTE) { 4485 rtalloc(ro); 4486 if (ro->ro_rt == 0) { 4487 ipstat.ips_noroute++; 4488 goto bad; 4489 } 4490 4491 ifp = ro->ro_rt->rt_ifp; 4492 ro->ro_rt->rt_use++; 4493 4494 if (ro->ro_rt->rt_flags & RTF_GATEWAY) 4495 dst = satosin(ro->ro_rt->rt_gateway); 4496 } else { 4497 if (TAILQ_EMPTY(&r->rpool.list)) 4498 panic("pf_route: TAILQ_EMPTY(&r->rpool.list)"); 4499 if (s == NULL) { 4500 pf_map_addr(AF_INET, &r->rpool, 4501 (struct pf_addr *)&ip->ip_src, 4502 &naddr, NULL); 4503 if (!PF_AZERO(&naddr, AF_INET)) 4504 dst->sin_addr.s_addr = naddr.v4.s_addr; 4505 ifp = r->rpool.cur->ifp; 4506 } else { 4507 if (!PF_AZERO(&s->rt_addr, AF_INET)) 4508 dst->sin_addr.s_addr = 4509 s->rt_addr.v4.s_addr; 4510 ifp = s->rt_ifp; 4511 } 4512 } 4513 4514 if (ifp == NULL) 4515 goto bad; 4516 4517 if (oifp != ifp) { 4518 mtag = m_tag_find(m0, PACKET_TAG_PF_ROUTED, NULL); 4519 if (mtag == NULL) { 4520 mtag = m_tag_get(PACKET_TAG_PF_ROUTED, 0, M_NOWAIT); 4521 if (mtag == NULL) 4522 goto bad; 4523 m_tag_prepend(m0, mtag); 4524 if (pf_test(PF_OUT, ifp, &m0) != PF_PASS) 4525 goto bad; 4526 else if (m0 == NULL) 4527 goto done; 4528 if (m0->m_len < sizeof(struct ip)) 4529 panic("pf_route: m0->m_len < " 4530 "sizeof(struct ip)"); 4531 ip = mtod(m0, struct ip *); 4532 } 4533 } 4534 4535 /* Copied from ip_output. */ 4536 if (ntohs(ip->ip_len) <= ifp->if_mtu) { 4537 if ((ifp->if_capabilities & IFCAP_CSUM_IPv4) && 4538 ifp->if_bridge == NULL) { 4539 m0->m_pkthdr.csum |= M_IPV4_CSUM_OUT; 4540 ipstat.ips_outhwcsum++; 4541 } else { 4542 ip->ip_sum = 0; 4543 ip->ip_sum = in_cksum(m0, ip->ip_hl << 2); 4544 } 4545 /* Update relevant hardware checksum stats for TCP/UDP */ 4546 if (m0->m_pkthdr.csum & M_TCPV4_CSUM_OUT) 4547 tcpstat.tcps_outhwcsum++; 4548 else if (m0->m_pkthdr.csum & M_UDPV4_CSUM_OUT) 4549 udpstat.udps_outhwcsum++; 4550 error = (*ifp->if_output)(ifp, m0, sintosa(dst), NULL); 4551 goto done; 4552 } 4553 4554 /* 4555 * Too large for interface; fragment if possible. 4556 * Must be able to put at least 8 bytes per fragment. 4557 */ 4558 if (ip->ip_off & htons(IP_DF)) { 4559 ipstat.ips_cantfrag++; 4560 if (r->rt != PF_DUPTO) { 4561 icmp_error(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 0, 4562 ifp); 4563 goto done; 4564 } else 4565 goto bad; 4566 } 4567 4568 m1 = m0; 4569 error = ip_fragment(m0, ifp, ifp->if_mtu); 4570 if (error == EMSGSIZE) 4571 goto bad; 4572 4573 for (m0 = m1; m0; m0 = m1) { 4574 m1 = m0->m_nextpkt; 4575 m0->m_nextpkt = 0; 4576 if (error == 0) 4577 error = (*ifp->if_output)(ifp, m0, sintosa(dst), 4578 NULL); 4579 else 4580 m_freem(m0); 4581 } 4582 4583 if (error == 0) 4584 ipstat.ips_fragmented++; 4585 4586 done: 4587 if (r->rt != PF_DUPTO) 4588 *m = NULL; 4589 if (ro == &iproute && ro->ro_rt) 4590 RTFREE(ro->ro_rt); 4591 return; 4592 4593 bad: 4594 m_freem(m0); 4595 goto done; 4596 } 4597 #endif /* INET */ 4598 4599 #ifdef INET6 4600 void 4601 pf_route6(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp, 4602 struct pf_state *s) 4603 { 4604 struct mbuf *m0; 4605 struct m_tag *mtag; 4606 struct route_in6 ip6route; 4607 struct route_in6 *ro; 4608 struct sockaddr_in6 *dst; 4609 struct ip6_hdr *ip6; 4610 struct ifnet *ifp = NULL; 4611 struct pf_addr naddr; 4612 int error = 0; 4613 4614 if (m == NULL || *m == NULL || r == NULL || 4615 (dir != PF_IN && dir != PF_OUT) || oifp == NULL) 4616 panic("pf_route6: invalid parameters"); 4617 4618 if (r->rt == PF_DUPTO) { 4619 m0 = *m; 4620 mtag = m_tag_find(m0, PACKET_TAG_PF_ROUTED, NULL); 4621 if (mtag == NULL) { 4622 mtag = m_tag_get(PACKET_TAG_PF_ROUTED, 0, M_NOWAIT); 4623 if (mtag == NULL) 4624 goto bad; 4625 m_tag_prepend(m0, mtag); 4626 } 4627 m0 = m_copym2(*m, 0, M_COPYALL, M_NOWAIT); 4628 if (m0 == NULL) 4629 return; 4630 } else { 4631 if ((r->rt == PF_REPLYTO) == (r->direction == dir)) 4632 return; 4633 m0 = *m; 4634 } 4635 4636 if (m0->m_len < sizeof(struct ip6_hdr)) 4637 panic("pf_route6: m0->m_len < sizeof(struct ip6_hdr)"); 4638 ip6 = mtod(m0, struct ip6_hdr *); 4639 4640 ro = &ip6route; 4641 bzero((caddr_t)ro, sizeof(*ro)); 4642 dst = (struct sockaddr_in6 *)&ro->ro_dst; 4643 dst->sin6_family = AF_INET6; 4644 dst->sin6_len = sizeof(*dst); 4645 dst->sin6_addr = ip6->ip6_dst; 4646 4647 /* Cheat. */ 4648 if (r->rt == PF_FASTROUTE) { 4649 mtag = m_tag_get(PACKET_TAG_PF_GENERATED, 0, M_NOWAIT); 4650 if (mtag == NULL) 4651 goto bad; 4652 m_tag_prepend(m0, mtag); 4653 ip6_output(m0, NULL, NULL, NULL, NULL, NULL); 4654 return; 4655 } 4656 4657 if (TAILQ_EMPTY(&r->rpool.list)) 4658 panic("pf_route6: TAILQ_EMPTY(&r->rpool.list)"); 4659 if (s == NULL) { 4660 pf_map_addr(AF_INET6, &r->rpool, 4661 (struct pf_addr *)&ip6->ip6_src, &naddr, NULL); 4662 if (!PF_AZERO(&naddr, AF_INET6)) 4663 PF_ACPY((struct pf_addr *)&dst->sin6_addr, 4664 &naddr, AF_INET6); 4665 ifp = r->rpool.cur->ifp; 4666 } else { 4667 if (!PF_AZERO(&s->rt_addr, AF_INET6)) 4668 PF_ACPY((struct pf_addr *)&dst->sin6_addr, 4669 &s->rt_addr, AF_INET6); 4670 ifp = s->rt_ifp; 4671 } 4672 4673 if (ifp == NULL) 4674 goto bad; 4675 4676 if (oifp != ifp) { 4677 mtag = m_tag_find(m0, PACKET_TAG_PF_ROUTED, NULL); 4678 if (mtag == NULL) { 4679 mtag = m_tag_get(PACKET_TAG_PF_ROUTED, 0, M_NOWAIT); 4680 if (mtag == NULL) 4681 goto bad; 4682 m_tag_prepend(m0, mtag); 4683 if (pf_test6(PF_OUT, ifp, &m0) != PF_PASS) 4684 goto bad; 4685 else if (m0 == NULL) 4686 goto done; 4687 } 4688 } 4689 4690 /* 4691 * If the packet is too large for the outgoing interface, 4692 * send back an icmp6 error. 4693 */ 4694 if (IN6_IS_ADDR_LINKLOCAL(&dst->sin6_addr)) 4695 dst->sin6_addr.s6_addr16[1] = htons(ifp->if_index); 4696 if ((u_long)m0->m_pkthdr.len <= ifp->if_mtu) { 4697 error = nd6_output(ifp, ifp, m0, dst, NULL); 4698 } else { 4699 in6_ifstat_inc(ifp, ifs6_in_toobig); 4700 if (r->rt != PF_DUPTO) 4701 icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu); 4702 else 4703 goto bad; 4704 } 4705 4706 done: 4707 if (r->rt != PF_DUPTO) 4708 *m = NULL; 4709 return; 4710 4711 bad: 4712 m_freem(m0); 4713 goto done; 4714 } 4715 #endif /* INET6 */ 4716 4717 4718 /* 4719 * check protocol (tcp/udp/icmp/icmp6) checksum and set mbuf flag 4720 * off is the offset where the protocol header starts 4721 * len is the total length of protocol header plus payload 4722 * returns 0 when the checksum is valid, otherwise returns 1. 4723 */ 4724 int 4725 pf_check_proto_cksum(struct mbuf *m, int off, int len, u_int8_t p, sa_family_t af) 4726 { 4727 u_int16_t flag_ok, flag_bad; 4728 u_int16_t sum; 4729 4730 switch (p) { 4731 case IPPROTO_TCP: 4732 flag_ok = M_TCP_CSUM_IN_OK; 4733 flag_bad = M_TCP_CSUM_IN_BAD; 4734 break; 4735 case IPPROTO_UDP: 4736 flag_ok = M_UDP_CSUM_IN_OK; 4737 flag_bad = M_UDP_CSUM_IN_BAD; 4738 break; 4739 case IPPROTO_ICMP: 4740 #ifdef INET6 4741 case IPPROTO_ICMPV6: 4742 #endif /* INET6 */ 4743 flag_ok = flag_bad = 0; 4744 break; 4745 default: 4746 return (1); 4747 } 4748 if (m->m_pkthdr.csum & flag_ok) 4749 return (0); 4750 if (m->m_pkthdr.csum & flag_bad) 4751 return (1); 4752 if (off < sizeof(struct ip) || len < sizeof(struct udphdr)) 4753 return (1); 4754 if (m->m_pkthdr.len < off + len) 4755 return (1); 4756 switch (af) { 4757 case AF_INET: 4758 if (p == IPPROTO_ICMP) { 4759 if (m->m_len < off) 4760 return (1); 4761 m->m_data += off; 4762 m->m_len -= off; 4763 sum = in_cksum(m, len); 4764 m->m_data -= off; 4765 m->m_len += off; 4766 } else { 4767 if (m->m_len < sizeof(struct ip)) 4768 return (1); 4769 sum = in4_cksum(m, p, off, len); 4770 } 4771 break; 4772 #ifdef INET6 4773 case AF_INET6: 4774 if (m->m_len < sizeof(struct ip6_hdr)) 4775 return (1); 4776 sum = in6_cksum(m, p, off, len); 4777 break; 4778 #endif /* INET6 */ 4779 default: 4780 return (1); 4781 } 4782 if (sum) { 4783 m->m_pkthdr.csum |= flag_bad; 4784 switch (p) { 4785 case IPPROTO_TCP: 4786 tcpstat.tcps_rcvbadsum++; 4787 break; 4788 case IPPROTO_UDP: 4789 udpstat.udps_badsum++; 4790 break; 4791 case IPPROTO_ICMP: 4792 icmpstat.icps_checksum++; 4793 break; 4794 #ifdef INET6 4795 case IPPROTO_ICMPV6: 4796 icmp6stat.icp6s_checksum++; 4797 break; 4798 #endif /* INET6 */ 4799 } 4800 return (1); 4801 } 4802 m->m_pkthdr.csum |= flag_ok; 4803 return (0); 4804 } 4805 4806 #ifdef INET 4807 int 4808 pf_test(int dir, struct ifnet *ifp, struct mbuf **m0) 4809 { 4810 u_short action, reason = 0, log = 0; 4811 struct mbuf *m = *m0; 4812 struct ip *h; 4813 struct pf_rule *a = NULL, *r = &pf_default_rule; 4814 struct pf_state *s = NULL; 4815 struct pf_ruleset *ruleset = NULL; 4816 struct pf_pdesc pd; 4817 int off; 4818 int pqid = 0; 4819 4820 if (!pf_status.running || 4821 (m_tag_find(m, PACKET_TAG_PF_GENERATED, NULL) != NULL)) 4822 return (PF_PASS); 4823 4824 #ifdef DIAGNOSTIC 4825 if ((m->m_flags & M_PKTHDR) == 0) 4826 panic("non-M_PKTHDR is passed to pf_test"); 4827 #endif 4828 4829 if (m->m_pkthdr.len < (int)sizeof(*h)) { 4830 action = PF_DROP; 4831 REASON_SET(&reason, PFRES_SHORT); 4832 log = 1; 4833 goto done; 4834 } 4835 4836 /* We do IP header normalization and packet reassembly here */ 4837 if (pf_normalize_ip(m0, dir, ifp, &reason) != PF_PASS) { 4838 action = PF_DROP; 4839 goto done; 4840 } 4841 m = *m0; 4842 h = mtod(m, struct ip *); 4843 4844 off = h->ip_hl << 2; 4845 if (off < (int)sizeof(*h)) { 4846 action = PF_DROP; 4847 REASON_SET(&reason, PFRES_SHORT); 4848 log = 1; 4849 goto done; 4850 } 4851 4852 memset(&pd, 0, sizeof(pd)); 4853 pd.src = (struct pf_addr *)&h->ip_src; 4854 pd.dst = (struct pf_addr *)&h->ip_dst; 4855 pd.ip_sum = &h->ip_sum; 4856 pd.proto = h->ip_p; 4857 pd.af = AF_INET; 4858 pd.tos = h->ip_tos; 4859 pd.tot_len = ntohs(h->ip_len); 4860 4861 /* handle fragments that didn't get reassembled by normalization */ 4862 if (h->ip_off & htons(IP_MF | IP_OFFMASK)) { 4863 action = pf_test_fragment(&r, dir, ifp, m, h, 4864 &pd, &a, &ruleset); 4865 goto done; 4866 } 4867 4868 switch (h->ip_p) { 4869 4870 case IPPROTO_TCP: { 4871 struct tcphdr th; 4872 4873 pd.hdr.tcp = &th; 4874 if (!pf_pull_hdr(m, off, &th, sizeof(th), 4875 &action, &reason, AF_INET)) { 4876 log = action != PF_PASS; 4877 goto done; 4878 } 4879 if (dir == PF_IN && pf_check_proto_cksum(m, off, 4880 ntohs(h->ip_len) - off, IPPROTO_TCP, AF_INET)) { 4881 action = PF_DROP; 4882 goto done; 4883 } 4884 pd.p_len = pd.tot_len - off - (th.th_off << 2); 4885 if ((th.th_flags & TH_ACK) && pd.p_len == 0) 4886 pqid = 1; 4887 action = pf_normalize_tcp(dir, ifp, m, 0, off, h, &pd); 4888 if (action == PF_DROP) 4889 break; 4890 action = pf_test_state_tcp(&s, dir, ifp, m, 0, off, h, &pd, 4891 &reason); 4892 if (action == PF_PASS) { 4893 r = s->rule.ptr; 4894 log = s->log; 4895 } else if (s == NULL) 4896 action = pf_test_tcp(&r, &s, dir, ifp, 4897 m, 0, off, h, &pd, &a, &ruleset); 4898 break; 4899 } 4900 4901 case IPPROTO_UDP: { 4902 struct udphdr uh; 4903 4904 pd.hdr.udp = &uh; 4905 if (!pf_pull_hdr(m, off, &uh, sizeof(uh), 4906 &action, &reason, AF_INET)) { 4907 log = action != PF_PASS; 4908 goto done; 4909 } 4910 if (dir == PF_IN && uh.uh_sum && pf_check_proto_cksum(m, 4911 off, ntohs(h->ip_len) - off, IPPROTO_UDP, AF_INET)) { 4912 action = PF_DROP; 4913 goto done; 4914 } 4915 action = pf_test_state_udp(&s, dir, ifp, m, 0, off, h, &pd); 4916 if (action == PF_PASS) { 4917 r = s->rule.ptr; 4918 a = s->anchor.ptr; 4919 log = s->log; 4920 } else if (s == NULL) 4921 action = pf_test_udp(&r, &s, dir, ifp, 4922 m, 0, off, h, &pd, &a, &ruleset); 4923 break; 4924 } 4925 4926 case IPPROTO_ICMP: { 4927 struct icmp ih; 4928 4929 pd.hdr.icmp = &ih; 4930 if (!pf_pull_hdr(m, off, &ih, ICMP_MINLEN, 4931 &action, &reason, AF_INET)) { 4932 log = action != PF_PASS; 4933 goto done; 4934 } 4935 if (dir == PF_IN && pf_check_proto_cksum(m, off, 4936 ntohs(h->ip_len) - off, IPPROTO_ICMP, AF_INET)) { 4937 action = PF_DROP; 4938 goto done; 4939 } 4940 action = pf_test_state_icmp(&s, dir, ifp, m, 0, off, h, &pd); 4941 if (action == PF_PASS) { 4942 r = s->rule.ptr; 4943 r->packets++; 4944 r->bytes += ntohs(h->ip_len); 4945 a = s->anchor.ptr; 4946 if (a != NULL) { 4947 a->packets++; 4948 a->bytes += ntohs(h->ip_len); 4949 } 4950 log = s->log; 4951 } else if (s == NULL) 4952 action = pf_test_icmp(&r, &s, dir, ifp, 4953 m, 0, off, h, &pd, &a, &ruleset); 4954 break; 4955 } 4956 4957 default: 4958 action = pf_test_state_other(&s, dir, ifp, &pd); 4959 if (action == PF_PASS) { 4960 r = s->rule.ptr; 4961 a = s->anchor.ptr; 4962 log = s->log; 4963 } else if (s == NULL) 4964 action = pf_test_other(&r, &s, dir, ifp, m, h, 4965 &pd, &a, &ruleset); 4966 break; 4967 } 4968 4969 if (ifp == status_ifp) { 4970 pf_status.bcounters[0][dir == PF_OUT] += pd.tot_len; 4971 pf_status.pcounters[0][dir == PF_OUT][action != PF_PASS]++; 4972 } 4973 4974 done: 4975 if (r->src.addr.type == PF_ADDR_TABLE) 4976 pfr_update_stats(r->src.addr.p.tbl, 4977 (s == NULL || s->direction == dir) ? pd.src : pd.dst, pd.af, 4978 pd.tot_len, dir == PF_OUT, r->action == PF_PASS, 4979 r->src.not); 4980 if (r->dst.addr.type == PF_ADDR_TABLE) 4981 pfr_update_stats(r->dst.addr.p.tbl, 4982 (s == NULL || s->direction == dir) ? pd.dst : pd.src, pd.af, 4983 pd.tot_len, dir == PF_OUT, r->action == PF_PASS, 4984 r->dst.not); 4985 4986 if (action == PF_PASS && h->ip_hl > 5 && 4987 !((s && s->allow_opts) || r->allow_opts)) { 4988 action = PF_DROP; 4989 REASON_SET(&reason, PFRES_SHORT); 4990 log = 1; 4991 DPFPRINTF(PF_DEBUG_MISC, 4992 ("pf: dropping packet with ip options\n")); 4993 } 4994 4995 #ifdef ALTQ 4996 if (action == PF_PASS && r->qid) { 4997 struct m_tag *mtag; 4998 struct altq_tag *atag; 4999 5000 mtag = m_tag_get(PACKET_TAG_PF_QID, sizeof(*atag), M_NOWAIT); 5001 if (mtag != NULL) { 5002 atag = (struct altq_tag *)(mtag + 1); 5003 if (pqid || pd.tos == IPTOS_LOWDELAY) 5004 atag->qid = r->pqid; 5005 else 5006 atag->qid = r->qid; 5007 /* add hints for ecn */ 5008 atag->af = AF_INET; 5009 atag->hdr = h; 5010 m_tag_prepend(m, mtag); 5011 } 5012 } 5013 #endif 5014 5015 if (log) 5016 PFLOG_PACKET(ifp, h, m, AF_INET, dir, reason, r, a, ruleset); 5017 5018 if (action == PF_SYNPROXY_DROP) { 5019 m_freem(*m0); 5020 *m0 = NULL; 5021 action = PF_PASS; 5022 } else if (r->rt) 5023 /* pf_route can free the mbuf causing *m0 to become NULL */ 5024 pf_route(m0, r, dir, ifp, s); 5025 5026 return (action); 5027 } 5028 #endif /* INET */ 5029 5030 #ifdef INET6 5031 int 5032 pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0) 5033 { 5034 u_short action, reason = 0, log = 0; 5035 struct mbuf *m = *m0; 5036 struct ip6_hdr *h; 5037 struct pf_rule *a = NULL, *r = &pf_default_rule; 5038 struct pf_state *s = NULL; 5039 struct pf_ruleset *ruleset = NULL; 5040 struct pf_pdesc pd; 5041 int off, terminal = 0; 5042 5043 if (!pf_status.running || 5044 (m_tag_find(m, PACKET_TAG_PF_GENERATED, NULL) != NULL)) 5045 return (PF_PASS); 5046 5047 #ifdef DIAGNOSTIC 5048 if ((m->m_flags & M_PKTHDR) == 0) 5049 panic("non-M_PKTHDR is passed to pf_test"); 5050 #endif 5051 5052 if (m->m_pkthdr.len < (int)sizeof(*h)) { 5053 action = PF_DROP; 5054 REASON_SET(&reason, PFRES_SHORT); 5055 log = 1; 5056 goto done; 5057 } 5058 5059 /* We do IP header normalization and packet reassembly here */ 5060 if (pf_normalize_ip6(m0, dir, ifp, &reason) != PF_PASS) { 5061 action = PF_DROP; 5062 goto done; 5063 } 5064 m = *m0; 5065 h = mtod(m, struct ip6_hdr *); 5066 5067 memset(&pd, 0, sizeof(pd)); 5068 pd.src = (struct pf_addr *)&h->ip6_src; 5069 pd.dst = (struct pf_addr *)&h->ip6_dst; 5070 pd.ip_sum = NULL; 5071 pd.af = AF_INET6; 5072 pd.tos = 0; 5073 pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr); 5074 5075 off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr); 5076 pd.proto = h->ip6_nxt; 5077 do { 5078 switch (pd.proto) { 5079 case IPPROTO_FRAGMENT: 5080 action = pf_test_fragment(&r, dir, ifp, m, h, 5081 &pd, &a, &ruleset); 5082 if (action == PF_DROP) 5083 REASON_SET(&reason, PFRES_FRAG); 5084 goto done; 5085 case IPPROTO_AH: 5086 case IPPROTO_HOPOPTS: 5087 case IPPROTO_ROUTING: 5088 case IPPROTO_DSTOPTS: { 5089 /* get next header and header length */ 5090 struct ip6_ext opt6; 5091 5092 if (!pf_pull_hdr(m, off, &opt6, sizeof(opt6), 5093 NULL, NULL, pd.af)) { 5094 DPFPRINTF(PF_DEBUG_MISC, 5095 ("pf: IPv6 short opt\n")); 5096 action = PF_DROP; 5097 REASON_SET(&reason, PFRES_SHORT); 5098 log = 1; 5099 goto done; 5100 } 5101 if (pd.proto == IPPROTO_AH) 5102 off += (opt6.ip6e_len + 2) * 4; 5103 else 5104 off += (opt6.ip6e_len + 1) * 8; 5105 pd.proto = opt6.ip6e_nxt; 5106 /* goto the next header */ 5107 break; 5108 } 5109 default: 5110 terminal++; 5111 break; 5112 } 5113 } while (!terminal); 5114 5115 switch (pd.proto) { 5116 5117 case IPPROTO_TCP: { 5118 struct tcphdr th; 5119 5120 pd.hdr.tcp = &th; 5121 if (!pf_pull_hdr(m, off, &th, sizeof(th), 5122 &action, &reason, AF_INET6)) { 5123 log = action != PF_PASS; 5124 goto done; 5125 } 5126 if (dir == PF_IN && pf_check_proto_cksum(m, off, 5127 ntohs(h->ip6_plen), IPPROTO_TCP, AF_INET6)) { 5128 action = PF_DROP; 5129 goto done; 5130 } 5131 pd.p_len = pd.tot_len - off - (th.th_off << 2); 5132 action = pf_normalize_tcp(dir, ifp, m, 0, off, h, &pd); 5133 if (action == PF_DROP) 5134 break; 5135 action = pf_test_state_tcp(&s, dir, ifp, m, 0, off, h, &pd, 5136 &reason); 5137 if (action == PF_PASS) { 5138 r = s->rule.ptr; 5139 log = s->log; 5140 } else if (s == NULL) 5141 action = pf_test_tcp(&r, &s, dir, ifp, 5142 m, 0, off, h, &pd, &a, &ruleset); 5143 break; 5144 } 5145 5146 case IPPROTO_UDP: { 5147 struct udphdr uh; 5148 5149 pd.hdr.udp = &uh; 5150 if (!pf_pull_hdr(m, off, &uh, sizeof(uh), 5151 &action, &reason, AF_INET6)) { 5152 log = action != PF_PASS; 5153 goto done; 5154 } 5155 if (dir == PF_IN && uh.uh_sum && pf_check_proto_cksum(m, 5156 off, ntohs(h->ip6_plen), IPPROTO_UDP, AF_INET6)) { 5157 action = PF_DROP; 5158 goto done; 5159 } 5160 action = pf_test_state_udp(&s, dir, ifp, m, 0, off, h, &pd); 5161 if (action == PF_PASS) { 5162 r = s->rule.ptr; 5163 log = s->log; 5164 } else if (s == NULL) 5165 action = pf_test_udp(&r, &s, dir, ifp, 5166 m, 0, off, h, &pd, &a, &ruleset); 5167 break; 5168 } 5169 5170 case IPPROTO_ICMPV6: { 5171 struct icmp6_hdr ih; 5172 5173 pd.hdr.icmp6 = &ih; 5174 if (!pf_pull_hdr(m, off, &ih, sizeof(ih), 5175 &action, &reason, AF_INET6)) { 5176 log = action != PF_PASS; 5177 goto done; 5178 } 5179 if (dir == PF_IN && pf_check_proto_cksum(m, off, 5180 ntohs(h->ip6_plen), IPPROTO_ICMPV6, AF_INET6)) { 5181 action = PF_DROP; 5182 goto done; 5183 } 5184 action = pf_test_state_icmp(&s, dir, ifp, 5185 m, 0, off, h, &pd); 5186 if (action == PF_PASS) { 5187 r = s->rule.ptr; 5188 r->packets++; 5189 r->bytes += h->ip6_plen; 5190 log = s->log; 5191 } else if (s == NULL) 5192 action = pf_test_icmp(&r, &s, dir, ifp, 5193 m, 0, off, h, &pd, &a, &ruleset); 5194 break; 5195 } 5196 5197 default: 5198 action = pf_test_other(&r, &s, dir, ifp, m, h, 5199 &pd, &a, &ruleset); 5200 break; 5201 } 5202 5203 if (ifp == status_ifp) { 5204 pf_status.bcounters[1][dir == PF_OUT] += pd.tot_len; 5205 pf_status.pcounters[1][dir == PF_OUT][action != PF_PASS]++; 5206 } 5207 5208 done: 5209 if (r->src.addr.type == PF_ADDR_TABLE) 5210 pfr_update_stats(r->src.addr.p.tbl, 5211 (s == NULL || s->direction == dir) ? pd.src : pd.dst, pd.af, 5212 pd.tot_len, dir == PF_OUT, r->action == PF_PASS, 5213 r->src.not); 5214 if (r->dst.addr.type == PF_ADDR_TABLE) 5215 pfr_update_stats(r->dst.addr.p.tbl, 5216 (s == NULL || s->direction == dir) ? pd.dst : pd.src, pd.af, 5217 pd.tot_len, dir == PF_OUT, r->action == PF_PASS, 5218 r->dst.not); 5219 5220 /* XXX handle IPv6 options, if not allowed. not implemented. */ 5221 5222 #ifdef ALTQ 5223 if (action == PF_PASS && r->qid) { 5224 struct m_tag *mtag; 5225 struct altq_tag *atag; 5226 5227 mtag = m_tag_get(PACKET_TAG_PF_QID, sizeof(*atag), M_NOWAIT); 5228 if (mtag != NULL) { 5229 atag = (struct altq_tag *)(mtag + 1); 5230 if (pd.tos == IPTOS_LOWDELAY) 5231 atag->qid = r->pqid; 5232 else 5233 atag->qid = r->qid; 5234 /* add hints for ecn */ 5235 atag->af = AF_INET6; 5236 atag->hdr = h; 5237 m_tag_prepend(m, mtag); 5238 } 5239 } 5240 #endif 5241 5242 if (log) 5243 PFLOG_PACKET(ifp, h, m, AF_INET6, dir, reason, r, a, ruleset); 5244 5245 if (action == PF_SYNPROXY_DROP) { 5246 m_freem(*m0); 5247 *m0 = NULL; 5248 action = PF_PASS; 5249 } else if (r->rt) 5250 /* pf_route6 can free the mbuf causing *m0 to become NULL */ 5251 pf_route6(m0, r, dir, ifp, s); 5252 5253 return (action); 5254 } 5255 #endif /* INET6 */ 5256