1
2 /*
3 * Copyright (C) 2012 by Darren Reed.
4 *
5 * See the IPFILTER.LICENCE file for details on licencing.
6 */
7
8 #if defined(KERNEL) || defined(_KERNEL)
9 # undef KERNEL
10 # undef _KERNEL
11 # define KERNEL 1
12 # define _KERNEL 1
13 #endif
14 #if defined(__FreeBSD__) && \
15 !defined(KLD_MODULE) && !defined(IPFILTER_LKM)
16 # include "opt_inet6.h"
17 #endif
18 #include <sys/param.h>
19 #include <sys/eventhandler.h>
20 #include <sys/conf.h>
21 #include <sys/errno.h>
22 #include <sys/types.h>
23 #include <sys/file.h>
24 #include <sys/fcntl.h>
25 #include <sys/filio.h>
26 #include <sys/time.h>
27 #include <sys/systm.h>
28 #include <sys/dirent.h>
29 #if defined(__FreeBSD__)
30 # include <sys/jail.h>
31 #endif
32 #include <sys/malloc.h>
33 #include <sys/mbuf.h>
34 #include <sys/sockopt.h>
35 #include <sys/socket.h>
36 #include <sys/selinfo.h>
37 #include <net/if.h>
38 #include <net/if_var.h>
39 #include <net/netisr.h>
40 #include <net/route.h>
41 #include <net/route/nhop.h>
42 #include <netinet/in.h>
43 #include <netinet/in_fib.h>
44 #include <netinet/in_pcb.h>
45 #include <netinet/in_var.h>
46 #include <netinet/in_systm.h>
47 #include <netinet/ip.h>
48 #include <netinet/ip_var.h>
49 #include <netinet/tcp.h>
50 #include <netinet/tcp_var.h>
51 #include <net/vnet.h>
52 #include <netinet/udp.h>
53 #include <netinet/tcpip.h>
54 #include <netinet/ip_icmp.h>
55 #include "netinet/ip_compat.h"
56 #ifdef USE_INET6
57 # include <netinet/icmp6.h>
58 #endif
59 #include "netinet/ip_fil.h"
60 #include "netinet/ip_nat.h"
61 #include "netinet/ip_frag.h"
62 #include "netinet/ip_state.h"
63 #include "netinet/ip_proxy.h"
64 #include "netinet/ip_auth.h"
65 #include "netinet/ip_sync.h"
66 #include "netinet/ip_lookup.h"
67 #include "netinet/ip_dstlist.h"
68 #ifdef IPFILTER_SCAN
69 # include "netinet/ip_scan.h"
70 #endif
71 #include "netinet/ip_pool.h"
72 #include <sys/malloc.h>
73 #include <sys/kernel.h>
74 #ifdef CSUM_DATA_VALID
75 # include <machine/in_cksum.h>
76 #endif
77 extern int ip_optcopy(struct ip *, struct ip *);
78
79 #ifdef IPFILTER_M_IPFILTER
80 MALLOC_DEFINE(M_IPFILTER, "ipfilter", "IP Filter packet filter data structures");
81 #endif
82
83
84 static int ipf_send_ip(fr_info_t *, mb_t *);
85 static void ipf_timer_func(void *arg);
86
87 VNET_DEFINE(ipf_main_softc_t, ipfmain) = {
88 .ipf_running = -2,
89 };
90 #define V_ipfmain VNET(ipfmain)
91 #define V0_ipfmain VNET_VNET(vnet0,ipfmain)
92
93 #include <sys/conf.h>
94 #include <net/pfil.h>
95
96 VNET_DEFINE_STATIC(eventhandler_tag, ipf_arrivetag);
97 VNET_DEFINE_STATIC(eventhandler_tag, ipf_departtag);
98 VNET_DEFINE_STATIC(eventhandler_tag, ipf_renametag);
99 #define V_ipf_arrivetag VNET(ipf_arrivetag)
100 #define V_ipf_departtag VNET(ipf_departtag)
101 #define V_ipf_renametag VNET(ipf_renametag)
102
103 static void ipf_ifevent(void *arg, struct ifnet *ifp);
104
ipf_ifevent(void * arg,struct ifnet * ifp)105 static void ipf_ifevent(void *arg, struct ifnet *ifp)
106 {
107
108 CURVNET_SET(ifp->if_vnet);
109 if (V_ipfmain.ipf_running > 0)
110 ipf_sync(&V_ipfmain, NULL);
111 CURVNET_RESTORE();
112 }
113
114
115
116 static pfil_return_t
ipf_check_wrapper(struct mbuf ** mp,struct ifnet * ifp,int flags,void * ruleset __unused,struct inpcb * inp)117 ipf_check_wrapper(struct mbuf **mp, struct ifnet *ifp, int flags,
118 void *ruleset __unused, struct inpcb *inp)
119 {
120 struct ip *ip = mtod(*mp, struct ip *);
121 pfil_return_t rv;
122
123 CURVNET_SET(ifp->if_vnet);
124 rv = ipf_check(&V_ipfmain, ip, ip->ip_hl << 2, ifp,
125 !!(flags & PFIL_OUT), mp);
126 CURVNET_RESTORE();
127 if (rv == 0 && *mp == NULL)
128 return (PFIL_CONSUMED);
129 return (rv == 0 ? PFIL_PASS : PFIL_DROPPED);
130 }
131
132 #ifdef USE_INET6
133 static pfil_return_t
ipf_check_wrapper6(struct mbuf ** mp,struct ifnet * ifp,int flags,void * ruleset __unused,struct inpcb * inp)134 ipf_check_wrapper6(struct mbuf **mp, struct ifnet *ifp, int flags,
135 void *ruleset __unused, struct inpcb *inp)
136 {
137 pfil_return_t rv;
138
139 CURVNET_SET(ifp->if_vnet);
140 rv = ipf_check(&V_ipfmain, mtod(*mp, struct ip *),
141 sizeof(struct ip6_hdr), ifp, !!(flags & PFIL_OUT), mp);
142 CURVNET_RESTORE();
143 if (rv == 0 && *mp == NULL)
144 return (PFIL_CONSUMED);
145
146 return (rv == 0 ? PFIL_PASS : PFIL_DROPPED);
147 }
148 # endif
149 #if defined(IPFILTER_LKM)
ipf_identify(char * s)150 int ipf_identify(char *s)
151 {
152 if (strcmp(s, "ipl") == 0)
153 return (1);
154 return (0);
155 }
156 #endif /* IPFILTER_LKM */
157
158
159 static void
ipf_timer_func(void * arg)160 ipf_timer_func(void *arg)
161 {
162 ipf_main_softc_t *softc = arg;
163 SPL_INT(s);
164
165 SPL_NET(s);
166
167 if (softc->ipf_running > 0)
168 ipf_slowtimer(softc);
169
170 if (softc->ipf_running == -1 || softc->ipf_running == 1) {
171 callout_reset(&softc->ipf_slow_ch,
172 (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT,
173 ipf_timer_func, softc);
174 }
175 SPL_X(s);
176 }
177
178
179 int
ipfattach(ipf_main_softc_t * softc)180 ipfattach(ipf_main_softc_t *softc)
181 {
182 #ifdef USE_SPL
183 int s;
184 #endif
185
186 SPL_NET(s);
187 if (softc->ipf_running > 0) {
188 SPL_X(s);
189 return (EBUSY);
190 }
191
192 if (ipf_init_all(softc) < 0) {
193 SPL_X(s);
194 return (EIO);
195 }
196
197
198 bzero((char *)V_ipfmain.ipf_selwait, sizeof(V_ipfmain.ipf_selwait));
199 softc->ipf_running = 1;
200
201 if (softc->ipf_control_forwarding & 1)
202 V_ipforwarding = 1;
203
204 SPL_X(s);
205 callout_init_rw(&softc->ipf_slow_ch, &softc->ipf_global.ipf_lk, CALLOUT_SHAREDLOCK);
206 callout_reset(&softc->ipf_slow_ch, (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT,
207 ipf_timer_func, softc);
208 return (0);
209 }
210
211
212 /*
213 * Disable the filter by removing the hooks from the IP input/output
214 * stream.
215 */
216 int
ipfdetach(ipf_main_softc_t * softc)217 ipfdetach(ipf_main_softc_t *softc)
218 {
219 #ifdef USE_SPL
220 int s;
221 #endif
222
223 if (softc->ipf_control_forwarding & 2)
224 V_ipforwarding = 0;
225
226 SPL_NET(s);
227
228 callout_drain(&softc->ipf_slow_ch);
229
230 ipf_fini_all(softc);
231
232 softc->ipf_running = -2;
233
234 SPL_X(s);
235
236 return (0);
237 }
238
239
240 /*
241 * Filter ioctl interface.
242 */
243 int
ipfioctl(struct cdev * dev,ioctlcmd_t cmd,caddr_t data,int mode,struct thread * p)244 ipfioctl(struct cdev *dev, ioctlcmd_t cmd, caddr_t data,
245 int mode, struct thread *p)
246 #define p_cred td_ucred
247 #define p_uid td_ucred->cr_ruid
248 {
249 int error = 0, unit = 0;
250 SPL_INT(s);
251
252 CURVNET_SET(TD_TO_VNET(p));
253 if (securelevel_ge(p->p_cred, 3) && (mode & FWRITE))
254 {
255 V_ipfmain.ipf_interror = 130001;
256 CURVNET_RESTORE();
257 return (EPERM);
258 }
259
260 /*
261 * Remember, the host system (with its vnet0) controls
262 * whether a jail is allowed to use ipfilter or not.
263 * The default is ipfilter cannot be used by a jail
264 * unless the sysctl allows it.
265 */
266 if (V0_ipfmain.ipf_jail_allowed == 0) {
267 if (jailed(p->p_cred)) {
268 V_ipfmain.ipf_interror = 130019;
269 CURVNET_RESTORE();
270 return (EOPNOTSUPP);
271 }
272 }
273
274 if (jailed_without_vnet(p->p_cred)) {
275 V_ipfmain.ipf_interror = 130018;
276 CURVNET_RESTORE();
277 return (EOPNOTSUPP);
278 }
279
280 unit = GET_MINOR(dev);
281 if ((IPL_LOGMAX < unit) || (unit < 0)) {
282 V_ipfmain.ipf_interror = 130002;
283 CURVNET_RESTORE();
284 return (ENXIO);
285 }
286
287 if (V_ipfmain.ipf_running <= 0) {
288 if (unit != IPL_LOGIPF && cmd != SIOCIPFINTERROR) {
289 V_ipfmain.ipf_interror = 130003;
290 CURVNET_RESTORE();
291 return (EIO);
292 }
293 if (cmd != SIOCIPFGETNEXT && cmd != SIOCIPFGET &&
294 cmd != SIOCIPFSET && cmd != SIOCFRENB &&
295 cmd != SIOCGETFS && cmd != SIOCGETFF &&
296 cmd != SIOCIPFINTERROR) {
297 V_ipfmain.ipf_interror = 130004;
298 CURVNET_RESTORE();
299 return (EIO);
300 }
301 }
302
303 SPL_NET(s);
304
305 error = ipf_ioctlswitch(&V_ipfmain, unit, data, cmd, mode, p->p_uid, p);
306 CURVNET_RESTORE();
307 if (error != -1) {
308 SPL_X(s);
309 return (error);
310 }
311
312 SPL_X(s);
313
314 return (error);
315 }
316
317
318 /*
319 * ipf_send_reset - this could conceivably be a call to tcp_respond(), but that
320 * requires a large amount of setting up and isn't any more efficient.
321 */
322 int
ipf_send_reset(fr_info_t * fin)323 ipf_send_reset(fr_info_t *fin)
324 {
325 struct tcphdr *tcp, *tcp2;
326 int tlen = 0, hlen;
327 struct mbuf *m;
328 #ifdef USE_INET6
329 ip6_t *ip6;
330 #endif
331 ip_t *ip;
332
333 tcp = fin->fin_dp;
334 if (tcp_get_flags(tcp) & TH_RST)
335 return (-1); /* feedback loop */
336
337 if (ipf_checkl4sum(fin) == -1)
338 return (-1);
339
340 tlen = fin->fin_dlen - (TCP_OFF(tcp) << 2) +
341 ((tcp_get_flags(tcp) & TH_SYN) ? 1 : 0) +
342 ((tcp_get_flags(tcp) & TH_FIN) ? 1 : 0);
343
344 #ifdef USE_INET6
345 hlen = (fin->fin_v == 6) ? sizeof(ip6_t) : sizeof(ip_t);
346 #else
347 hlen = sizeof(ip_t);
348 #endif
349 #ifdef MGETHDR
350 MGETHDR(m, M_NOWAIT, MT_HEADER);
351 #else
352 MGET(m, M_NOWAIT, MT_HEADER);
353 #endif
354 if (m == NULL)
355 return (-1);
356 if (sizeof(*tcp2) + hlen > MLEN) {
357 if (!(MCLGET(m, M_NOWAIT))) {
358 FREE_MB_T(m);
359 return (-1);
360 }
361 }
362
363 m->m_len = sizeof(*tcp2) + hlen;
364 m->m_data += max_linkhdr;
365 m->m_pkthdr.len = m->m_len;
366 m->m_pkthdr.rcvif = (struct ifnet *)0;
367 ip = mtod(m, struct ip *);
368 bzero((char *)ip, hlen);
369 #ifdef USE_INET6
370 ip6 = (ip6_t *)ip;
371 #endif
372 tcp2 = (struct tcphdr *)((char *)ip + hlen);
373 tcp2->th_sport = tcp->th_dport;
374 tcp2->th_dport = tcp->th_sport;
375
376 if (tcp_get_flags(tcp) & TH_ACK) {
377 tcp2->th_seq = tcp->th_ack;
378 tcp_set_flags(tcp2, TH_RST);
379 tcp2->th_ack = 0;
380 } else {
381 tcp2->th_seq = 0;
382 tcp2->th_ack = ntohl(tcp->th_seq);
383 tcp2->th_ack += tlen;
384 tcp2->th_ack = htonl(tcp2->th_ack);
385 tcp_set_flags(tcp2, TH_RST|TH_ACK);
386 }
387 TCP_OFF_A(tcp2, sizeof(*tcp2) >> 2);
388 tcp2->th_win = tcp->th_win;
389 tcp2->th_sum = 0;
390 tcp2->th_urp = 0;
391
392 #ifdef USE_INET6
393 if (fin->fin_v == 6) {
394 ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow;
395 ip6->ip6_plen = htons(sizeof(struct tcphdr));
396 ip6->ip6_nxt = IPPROTO_TCP;
397 ip6->ip6_hlim = 0;
398 ip6->ip6_src = fin->fin_dst6.in6;
399 ip6->ip6_dst = fin->fin_src6.in6;
400 tcp2->th_sum = in6_cksum(m, IPPROTO_TCP,
401 sizeof(*ip6), sizeof(*tcp2));
402 return (ipf_send_ip(fin, m));
403 }
404 #endif
405 ip->ip_p = IPPROTO_TCP;
406 ip->ip_len = htons(sizeof(struct tcphdr));
407 ip->ip_src.s_addr = fin->fin_daddr;
408 ip->ip_dst.s_addr = fin->fin_saddr;
409 tcp2->th_sum = in_cksum(m, hlen + sizeof(*tcp2));
410 ip->ip_len = htons(hlen + sizeof(*tcp2));
411 return (ipf_send_ip(fin, m));
412 }
413
414
415 /*
416 * ip_len must be in network byte order when called.
417 */
418 static int
ipf_send_ip(fr_info_t * fin,mb_t * m)419 ipf_send_ip(fr_info_t *fin, mb_t *m)
420 {
421 fr_info_t fnew;
422 ip_t *ip, *oip;
423 int hlen;
424
425 ip = mtod(m, ip_t *);
426 bzero((char *)&fnew, sizeof(fnew));
427 fnew.fin_main_soft = fin->fin_main_soft;
428
429 IP_V_A(ip, fin->fin_v);
430 switch (fin->fin_v)
431 {
432 case 4 :
433 oip = fin->fin_ip;
434 hlen = sizeof(*oip);
435 fnew.fin_v = 4;
436 fnew.fin_p = ip->ip_p;
437 fnew.fin_plen = ntohs(ip->ip_len);
438 IP_HL_A(ip, sizeof(*oip) >> 2);
439 ip->ip_tos = oip->ip_tos;
440 ip->ip_id = fin->fin_ip->ip_id;
441 ip->ip_off = htons(V_path_mtu_discovery ? IP_DF : 0);
442 ip->ip_ttl = V_ip_defttl;
443 ip->ip_sum = 0;
444 break;
445 #ifdef USE_INET6
446 case 6 :
447 {
448 ip6_t *ip6 = (ip6_t *)ip;
449
450 ip6->ip6_vfc = 0x60;
451 ip6->ip6_hlim = IPDEFTTL;
452
453 hlen = sizeof(*ip6);
454 fnew.fin_p = ip6->ip6_nxt;
455 fnew.fin_v = 6;
456 fnew.fin_plen = ntohs(ip6->ip6_plen) + hlen;
457 break;
458 }
459 #endif
460 default :
461 return (EINVAL);
462 }
463 #ifdef IPSEC_SUPPORT
464 m->m_pkthdr.rcvif = NULL;
465 #endif
466
467 fnew.fin_ifp = fin->fin_ifp;
468 fnew.fin_flx = FI_NOCKSUM;
469 fnew.fin_m = m;
470 fnew.fin_ip = ip;
471 fnew.fin_mp = &m;
472 fnew.fin_hlen = hlen;
473 fnew.fin_dp = (char *)ip + hlen;
474 (void) ipf_makefrip(hlen, ip, &fnew);
475
476 return (ipf_fastroute(m, &m, &fnew, NULL));
477 }
478
479
480 int
ipf_send_icmp_err(int type,fr_info_t * fin,int dst)481 ipf_send_icmp_err(int type, fr_info_t *fin, int dst)
482 {
483 int err, hlen, xtra, iclen, ohlen, avail;
484 struct in_addr dst4;
485 struct icmp *icmp;
486 struct mbuf *m;
487 i6addr_t dst6;
488 void *ifp;
489 #ifdef USE_INET6
490 int code;
491 ip6_t *ip6;
492 #endif
493 ip_t *ip, *ip2;
494
495 if ((type < 0) || (type >= ICMP_MAXTYPE))
496 return (-1);
497
498 #ifdef USE_INET6
499 code = fin->fin_icode;
500 /* See NetBSD ip_fil_netbsd.c r1.4: */
501 if ((code < 0) || (code >= sizeof(icmptoicmp6unreach)/sizeof(int)))
502 return (-1);
503 #endif
504
505 if (ipf_checkl4sum(fin) == -1)
506 return (-1);
507 #ifdef MGETHDR
508 MGETHDR(m, M_NOWAIT, MT_HEADER);
509 #else
510 MGET(m, M_NOWAIT, MT_HEADER);
511 #endif
512 if (m == NULL)
513 return (-1);
514 avail = MHLEN;
515
516 xtra = 0;
517 hlen = 0;
518 ohlen = 0;
519 dst4.s_addr = 0;
520 ifp = fin->fin_ifp;
521 if (fin->fin_v == 4) {
522 if ((fin->fin_p == IPPROTO_ICMP) && !(fin->fin_flx & FI_SHORT))
523 switch (ntohs(fin->fin_data[0]) >> 8)
524 {
525 case ICMP_ECHO :
526 case ICMP_TSTAMP :
527 case ICMP_IREQ :
528 case ICMP_MASKREQ :
529 break;
530 default :
531 FREE_MB_T(m);
532 return (0);
533 }
534
535 if (dst == 0) {
536 if (ipf_ifpaddr(&V_ipfmain, 4, FRI_NORMAL, ifp,
537 &dst6, NULL) == -1) {
538 FREE_MB_T(m);
539 return (-1);
540 }
541 dst4 = dst6.in4;
542 } else
543 dst4.s_addr = fin->fin_daddr;
544
545 hlen = sizeof(ip_t);
546 ohlen = fin->fin_hlen;
547 iclen = hlen + offsetof(struct icmp, icmp_ip) + ohlen;
548 if (fin->fin_hlen < fin->fin_plen)
549 xtra = MIN(fin->fin_dlen, 8);
550 else
551 xtra = 0;
552 }
553
554 #ifdef USE_INET6
555 else if (fin->fin_v == 6) {
556 hlen = sizeof(ip6_t);
557 ohlen = sizeof(ip6_t);
558 iclen = hlen + offsetof(struct icmp, icmp_ip) + ohlen;
559 type = icmptoicmp6types[type];
560 if (type == ICMP6_DST_UNREACH)
561 code = icmptoicmp6unreach[code];
562
563 if (iclen + max_linkhdr + fin->fin_plen > avail) {
564 if (!(MCLGET(m, M_NOWAIT))) {
565 FREE_MB_T(m);
566 return (-1);
567 }
568 avail = MCLBYTES;
569 }
570 xtra = MIN(fin->fin_plen, avail - iclen - max_linkhdr);
571 xtra = MIN(xtra, IPV6_MMTU - iclen);
572 if (dst == 0) {
573 if (ipf_ifpaddr(&V_ipfmain, 6, FRI_NORMAL, ifp,
574 &dst6, NULL) == -1) {
575 FREE_MB_T(m);
576 return (-1);
577 }
578 } else
579 dst6 = fin->fin_dst6;
580 }
581 #endif
582 else {
583 FREE_MB_T(m);
584 return (-1);
585 }
586
587 avail -= (max_linkhdr + iclen);
588 if (avail < 0) {
589 FREE_MB_T(m);
590 return (-1);
591 }
592 if (xtra > avail)
593 xtra = avail;
594 iclen += xtra;
595 m->m_data += max_linkhdr;
596 m->m_pkthdr.rcvif = (struct ifnet *)0;
597 m->m_pkthdr.len = iclen;
598 m->m_len = iclen;
599 ip = mtod(m, ip_t *);
600 icmp = (struct icmp *)((char *)ip + hlen);
601 ip2 = (ip_t *)&icmp->icmp_ip;
602
603 icmp->icmp_type = type;
604 icmp->icmp_code = fin->fin_icode;
605 icmp->icmp_cksum = 0;
606 #ifdef icmp_nextmtu
607 if (type == ICMP_UNREACH && fin->fin_icode == ICMP_UNREACH_NEEDFRAG) {
608 if (fin->fin_mtu != 0) {
609 icmp->icmp_nextmtu = htons(fin->fin_mtu);
610
611 } else if (ifp != NULL) {
612 icmp->icmp_nextmtu = htons(GETIFMTU_4(ifp));
613
614 } else { /* make up a number... */
615 icmp->icmp_nextmtu = htons(fin->fin_plen - 20);
616 }
617 }
618 #endif
619
620 bcopy((char *)fin->fin_ip, (char *)ip2, ohlen);
621
622 #ifdef USE_INET6
623 ip6 = (ip6_t *)ip;
624 if (fin->fin_v == 6) {
625 ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow;
626 ip6->ip6_plen = htons(iclen - hlen);
627 ip6->ip6_nxt = IPPROTO_ICMPV6;
628 ip6->ip6_hlim = 0;
629 ip6->ip6_src = dst6.in6;
630 ip6->ip6_dst = fin->fin_src6.in6;
631 if (xtra > 0)
632 bcopy((char *)fin->fin_ip + ohlen,
633 (char *)&icmp->icmp_ip + ohlen, xtra);
634 icmp->icmp_cksum = in6_cksum(m, IPPROTO_ICMPV6,
635 sizeof(*ip6), iclen - hlen);
636 } else
637 #endif
638 {
639 ip->ip_p = IPPROTO_ICMP;
640 ip->ip_src.s_addr = dst4.s_addr;
641 ip->ip_dst.s_addr = fin->fin_saddr;
642
643 if (xtra > 0)
644 bcopy((char *)fin->fin_ip + ohlen,
645 (char *)&icmp->icmp_ip + ohlen, xtra);
646 icmp->icmp_cksum = ipf_cksum((u_short *)icmp,
647 sizeof(*icmp) + 8);
648 ip->ip_len = htons(iclen);
649 ip->ip_p = IPPROTO_ICMP;
650 }
651 err = ipf_send_ip(fin, m);
652 return (err);
653 }
654
655
656
657
658 /*
659 * m0 - pointer to mbuf where the IP packet starts
660 * mpp - pointer to the mbuf pointer that is the start of the mbuf chain
661 */
662 int
ipf_fastroute(mb_t * m0,mb_t ** mpp,fr_info_t * fin,frdest_t * fdp)663 ipf_fastroute(mb_t *m0, mb_t **mpp, fr_info_t *fin, frdest_t *fdp)
664 {
665 register struct ip *ip, *mhip;
666 register struct mbuf *m = *mpp;
667 int len, off, error = 0, hlen, code;
668 struct ifnet *ifp, *sifp;
669 struct route ro;
670 struct sockaddr_in *dst;
671 const struct sockaddr *gw;
672 struct nhop_object *nh;
673 u_long fibnum = 0;
674 u_short ip_off;
675 frdest_t node;
676 frentry_t *fr;
677
678 #ifdef M_WRITABLE
679 /*
680 * HOT FIX/KLUDGE:
681 *
682 * If the mbuf we're about to send is not writable (because of
683 * a cluster reference, for example) we'll need to make a copy
684 * of it since this routine modifies the contents.
685 *
686 * If you have non-crappy network hardware that can transmit data
687 * from the mbuf, rather than making a copy, this is gonna be a
688 * problem.
689 */
690 if (M_WRITABLE(m) == 0) {
691 m0 = m_dup(m, M_NOWAIT);
692 if (m0 != NULL) {
693 FREE_MB_T(m);
694 m = m0;
695 *mpp = m;
696 } else {
697 error = ENOBUFS;
698 FREE_MB_T(m);
699 goto done;
700 }
701 }
702 #endif
703
704 #ifdef USE_INET6
705 if (fin->fin_v == 6) {
706 /*
707 * currently "to <if>" and "to <if>:ip#" are not supported
708 * for IPv6
709 */
710 return (ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL));
711 }
712 #endif
713
714 hlen = fin->fin_hlen;
715 ip = mtod(m0, struct ip *);
716 ifp = NULL;
717
718 /*
719 * Route packet.
720 */
721 bzero(&ro, sizeof (ro));
722 dst = (struct sockaddr_in *)&ro.ro_dst;
723 dst->sin_family = AF_INET;
724 dst->sin_addr = ip->ip_dst;
725 dst->sin_len = sizeof(dst);
726 gw = (const struct sockaddr *)dst;
727
728 fr = fin->fin_fr;
729 if ((fr != NULL) && !(fr->fr_flags & FR_KEEPSTATE) && (fdp != NULL) &&
730 (fdp->fd_type == FRD_DSTLIST)) {
731 if (ipf_dstlist_select_node(fin, fdp->fd_ptr, NULL, &node) == 0)
732 fdp = &node;
733 }
734
735 if (fdp != NULL)
736 ifp = fdp->fd_ptr;
737 else
738 ifp = fin->fin_ifp;
739
740 if ((ifp == NULL) && ((fr == NULL) || !(fr->fr_flags & FR_FASTROUTE))) {
741 error = -2;
742 goto bad;
743 }
744
745 if ((fdp != NULL) && (fdp->fd_ip.s_addr != 0))
746 dst->sin_addr = fdp->fd_ip;
747
748 fibnum = M_GETFIB(m0);
749 NET_EPOCH_ASSERT();
750 nh = fib4_lookup(fibnum, dst->sin_addr, 0, NHR_NONE, 0);
751 if (nh == NULL) {
752 if (in_localaddr(ip->ip_dst))
753 error = EHOSTUNREACH;
754 else
755 error = ENETUNREACH;
756 goto bad;
757 }
758
759 if (ifp == NULL)
760 ifp = nh->nh_ifp;
761 if (nh->nh_flags & NHF_GATEWAY) {
762 gw = &nh->gw_sa;
763 ro.ro_flags |= RT_HAS_GW;
764 }
765
766 /*
767 * For input packets which are being "fastrouted", they won't
768 * go back through output filtering and miss their chance to get
769 * NAT'd and counted. Duplicated packets aren't considered to be
770 * part of the normal packet stream, so do not NAT them or pass
771 * them through stateful checking, etc.
772 */
773 if ((fdp != &fr->fr_dif) && (fin->fin_out == 0)) {
774 sifp = fin->fin_ifp;
775 fin->fin_ifp = ifp;
776 fin->fin_out = 1;
777 (void) ipf_acctpkt(fin, NULL);
778 fin->fin_fr = NULL;
779 if (!fr || !(fr->fr_flags & FR_RETMASK)) {
780 u_32_t pass;
781
782 (void) ipf_state_check(fin, &pass);
783 }
784
785 switch (ipf_nat_checkout(fin, NULL))
786 {
787 case 0 :
788 break;
789 case 1 :
790 ip->ip_sum = 0;
791 break;
792 case -1 :
793 error = -1;
794 goto bad;
795 break;
796 }
797
798 fin->fin_ifp = sifp;
799 fin->fin_out = 0;
800 } else
801 ip->ip_sum = 0;
802 /*
803 * If small enough for interface, can just send directly.
804 */
805 if (ntohs(ip->ip_len) <= ifp->if_mtu) {
806 if (!ip->ip_sum)
807 ip->ip_sum = in_cksum(m, hlen);
808 error = (*ifp->if_output)(ifp, m, gw, &ro);
809 goto done;
810 }
811 /*
812 * Too large for interface; fragment if possible.
813 * Must be able to put at least 8 bytes per fragment.
814 */
815 ip_off = ntohs(ip->ip_off);
816 if (ip_off & IP_DF) {
817 error = EMSGSIZE;
818 goto bad;
819 }
820 len = (ifp->if_mtu - hlen) &~ 7;
821 if (len < 8) {
822 error = EMSGSIZE;
823 goto bad;
824 }
825
826 {
827 int mhlen, firstlen = len;
828 struct mbuf **mnext = &m->m_act;
829
830 /*
831 * Loop through length of segment after first fragment,
832 * make new header and copy data of each part and link onto chain.
833 */
834 m0 = m;
835 mhlen = sizeof (struct ip);
836 for (off = hlen + len; off < ntohs(ip->ip_len); off += len) {
837 #ifdef MGETHDR
838 MGETHDR(m, M_NOWAIT, MT_HEADER);
839 #else
840 MGET(m, M_NOWAIT, MT_HEADER);
841 #endif
842 if (m == NULL) {
843 m = m0;
844 error = ENOBUFS;
845 goto bad;
846 }
847 m->m_data += max_linkhdr;
848 mhip = mtod(m, struct ip *);
849 bcopy((char *)ip, (char *)mhip, sizeof(*ip));
850 if (hlen > sizeof (struct ip)) {
851 mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip);
852 IP_HL_A(mhip, mhlen >> 2);
853 }
854 m->m_len = mhlen;
855 mhip->ip_off = ((off - hlen) >> 3) + ip_off;
856 if (off + len >= ntohs(ip->ip_len))
857 len = ntohs(ip->ip_len) - off;
858 else
859 mhip->ip_off |= IP_MF;
860 mhip->ip_len = htons((u_short)(len + mhlen));
861 *mnext = m;
862 m->m_next = m_copym(m0, off, len, M_NOWAIT);
863 if (m->m_next == 0) {
864 error = ENOBUFS; /* ??? */
865 goto sendorfree;
866 }
867 m->m_pkthdr.len = mhlen + len;
868 m->m_pkthdr.rcvif = NULL;
869 mhip->ip_off = htons((u_short)mhip->ip_off);
870 mhip->ip_sum = 0;
871 mhip->ip_sum = in_cksum(m, mhlen);
872 mnext = &m->m_act;
873 }
874 /*
875 * Update first fragment by trimming what's been copied out
876 * and updating header, then send each fragment (in order).
877 */
878 m_adj(m0, hlen + firstlen - ip->ip_len);
879 ip->ip_len = htons((u_short)(hlen + firstlen));
880 ip->ip_off = htons((u_short)IP_MF);
881 ip->ip_sum = 0;
882 ip->ip_sum = in_cksum(m0, hlen);
883 sendorfree:
884 for (m = m0; m; m = m0) {
885 m0 = m->m_act;
886 m->m_act = 0;
887 if (error == 0)
888 error = (*ifp->if_output)(ifp, m, gw, &ro);
889 else
890 FREE_MB_T(m);
891 }
892 }
893 done:
894 if (!error)
895 V_ipfmain.ipf_frouteok[0]++;
896 else
897 V_ipfmain.ipf_frouteok[1]++;
898
899 return (0);
900 bad:
901 if (error == EMSGSIZE) {
902 sifp = fin->fin_ifp;
903 code = fin->fin_icode;
904 fin->fin_icode = ICMP_UNREACH_NEEDFRAG;
905 fin->fin_ifp = ifp;
906 (void) ipf_send_icmp_err(ICMP_UNREACH, fin, 1);
907 fin->fin_ifp = sifp;
908 fin->fin_icode = code;
909 }
910 FREE_MB_T(m);
911 goto done;
912 }
913
914
915 int
ipf_verifysrc(fr_info_t * fin)916 ipf_verifysrc(fr_info_t *fin)
917 {
918 struct nhop_object *nh;
919
920 NET_EPOCH_ASSERT();
921 nh = fib4_lookup(RT_DEFAULT_FIB, fin->fin_src, 0, NHR_NONE, 0);
922 if (nh == NULL)
923 return (0);
924 return (fin->fin_ifp == nh->nh_ifp);
925 }
926
927
928 /*
929 * return the first IP Address associated with an interface
930 */
931 int
ipf_ifpaddr(ipf_main_softc_t * softc,int v,int atype,void * ifptr,i6addr_t * inp,i6addr_t * inpmask)932 ipf_ifpaddr(ipf_main_softc_t *softc, int v, int atype, void *ifptr,
933 i6addr_t *inp, i6addr_t *inpmask)
934 {
935 #ifdef USE_INET6
936 struct in6_addr *ia6 = NULL;
937 #endif
938 struct sockaddr *sock, *mask;
939 struct sockaddr_in *sin;
940 struct ifaddr *ifa;
941 struct ifnet *ifp;
942
943 if ((ifptr == NULL) || (ifptr == (void *)-1))
944 return (-1);
945
946 sin = NULL;
947 ifp = ifptr;
948
949 if (v == 4)
950 inp->in4.s_addr = 0;
951 #ifdef USE_INET6
952 else if (v == 6)
953 bzero((char *)inp, sizeof(*inp));
954 #endif
955 ifa = CK_STAILQ_FIRST(&ifp->if_addrhead);
956
957 sock = ifa->ifa_addr;
958 while (sock != NULL && ifa != NULL) {
959 sin = (struct sockaddr_in *)sock;
960 if ((v == 4) && (sin->sin_family == AF_INET))
961 break;
962 #ifdef USE_INET6
963 if ((v == 6) && (sin->sin_family == AF_INET6)) {
964 ia6 = &((struct sockaddr_in6 *)sin)->sin6_addr;
965 if (!IN6_IS_ADDR_LINKLOCAL(ia6) &&
966 !IN6_IS_ADDR_LOOPBACK(ia6))
967 break;
968 }
969 #endif
970 ifa = CK_STAILQ_NEXT(ifa, ifa_link);
971 if (ifa != NULL)
972 sock = ifa->ifa_addr;
973 }
974
975 if (ifa == NULL || sin == NULL)
976 return (-1);
977
978 mask = ifa->ifa_netmask;
979 if (atype == FRI_BROADCAST)
980 sock = ifa->ifa_broadaddr;
981 else if (atype == FRI_PEERADDR)
982 sock = ifa->ifa_dstaddr;
983
984 if (sock == NULL)
985 return (-1);
986
987 #ifdef USE_INET6
988 if (v == 6) {
989 return (ipf_ifpfillv6addr(atype, (struct sockaddr_in6 *)sock,
990 (struct sockaddr_in6 *)mask,
991 inp, inpmask));
992 }
993 #endif
994 return (ipf_ifpfillv4addr(atype, (struct sockaddr_in *)sock,
995 (struct sockaddr_in *)mask,
996 &inp->in4, &inpmask->in4));
997 }
998
999
1000 u_32_t
ipf_newisn(fr_info_t * fin)1001 ipf_newisn(fr_info_t *fin)
1002 {
1003 u_32_t newiss;
1004 newiss = arc4random();
1005 return (newiss);
1006 }
1007
1008
1009 int
ipf_checkv4sum(fr_info_t * fin)1010 ipf_checkv4sum(fr_info_t *fin)
1011 {
1012 #ifdef CSUM_DATA_VALID
1013 int manual = 0;
1014 u_short sum;
1015 ip_t *ip;
1016 mb_t *m;
1017
1018 if ((fin->fin_flx & FI_NOCKSUM) != 0)
1019 return (0);
1020
1021 if ((fin->fin_flx & FI_SHORT) != 0)
1022 return (1);
1023
1024 if (fin->fin_cksum != FI_CK_NEEDED)
1025 return (fin->fin_cksum > FI_CK_NEEDED) ? 0 : -1;
1026
1027 m = fin->fin_m;
1028 if (m == NULL) {
1029 manual = 1;
1030 goto skipauto;
1031 }
1032 ip = fin->fin_ip;
1033
1034 if ((m->m_pkthdr.csum_flags & (CSUM_IP_CHECKED|CSUM_IP_VALID)) ==
1035 CSUM_IP_CHECKED) {
1036 fin->fin_cksum = FI_CK_BAD;
1037 fin->fin_flx |= FI_BAD;
1038 DT2(ipf_fi_bad_checkv4sum_csum_ip_checked, fr_info_t *, fin, u_int, m->m_pkthdr.csum_flags & (CSUM_IP_CHECKED|CSUM_IP_VALID));
1039 return (-1);
1040 }
1041 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
1042 /* Depending on the driver, UDP may have zero checksum */
1043 if (fin->fin_p == IPPROTO_UDP && (fin->fin_flx &
1044 (FI_FRAG|FI_SHORT|FI_BAD)) == 0) {
1045 udphdr_t *udp = fin->fin_dp;
1046 if (udp->uh_sum == 0) {
1047 /*
1048 * we're good no matter what the hardware
1049 * checksum flags and csum_data say (handling
1050 * of csum_data for zero UDP checksum is not
1051 * consistent across all drivers)
1052 */
1053 fin->fin_cksum = 1;
1054 return (0);
1055 }
1056 }
1057
1058 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
1059 sum = m->m_pkthdr.csum_data;
1060 else
1061 sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
1062 htonl(m->m_pkthdr.csum_data +
1063 fin->fin_dlen + fin->fin_p));
1064 sum ^= 0xffff;
1065 if (sum != 0) {
1066 fin->fin_cksum = FI_CK_BAD;
1067 fin->fin_flx |= FI_BAD;
1068 DT2(ipf_fi_bad_checkv4sum_sum, fr_info_t *, fin, u_int, sum);
1069 } else {
1070 fin->fin_cksum = FI_CK_SUMOK;
1071 return (0);
1072 }
1073 } else {
1074 if (m->m_pkthdr.csum_flags == CSUM_DELAY_DATA) {
1075 fin->fin_cksum = FI_CK_L4FULL;
1076 return (0);
1077 } else if (m->m_pkthdr.csum_flags == CSUM_TCP ||
1078 m->m_pkthdr.csum_flags == CSUM_UDP ||
1079 m->m_pkthdr.csum_flags == CSUM_IP) {
1080 fin->fin_cksum = FI_CK_L4PART;
1081 return (0);
1082 } else {
1083 manual = 1;
1084 }
1085 }
1086 skipauto:
1087 if (manual != 0) {
1088 if (ipf_checkl4sum(fin) == -1) {
1089 fin->fin_flx |= FI_BAD;
1090 DT2(ipf_fi_bad_checkv4sum_manual, fr_info_t *, fin, u_int, manual);
1091 return (-1);
1092 }
1093 }
1094 #else
1095 if (ipf_checkl4sum(fin) == -1) {
1096 fin->fin_flx |= FI_BAD;
1097 DT2(ipf_fi_bad_checkv4sum_checkl4sum, fr_info_t *, fin, u_int, -1);
1098 return (-1);
1099 }
1100 #endif
1101 return (0);
1102 }
1103
1104
1105 #ifdef USE_INET6
1106 int
ipf_checkv6sum(fr_info_t * fin)1107 ipf_checkv6sum(fr_info_t *fin)
1108 {
1109 if ((fin->fin_flx & FI_NOCKSUM) != 0) {
1110 DT(ipf_checkv6sum_fi_nocksum);
1111 return (0);
1112 }
1113
1114 if ((fin->fin_flx & FI_SHORT) != 0) {
1115 DT(ipf_checkv6sum_fi_short);
1116 return (1);
1117 }
1118
1119 if (fin->fin_cksum != FI_CK_NEEDED) {
1120 DT(ipf_checkv6sum_fi_ck_needed);
1121 return (fin->fin_cksum > FI_CK_NEEDED) ? 0 : -1;
1122 }
1123
1124 if (ipf_checkl4sum(fin) == -1) {
1125 fin->fin_flx |= FI_BAD;
1126 DT2(ipf_fi_bad_checkv6sum_checkl4sum, fr_info_t *, fin, u_int, -1);
1127 return (-1);
1128 }
1129 return (0);
1130 }
1131 #endif /* USE_INET6 */
1132
1133
1134 size_t
mbufchainlen(struct mbuf * m0)1135 mbufchainlen(struct mbuf *m0)
1136 {
1137 size_t len;
1138
1139 if ((m0->m_flags & M_PKTHDR) != 0) {
1140 len = m0->m_pkthdr.len;
1141 } else {
1142 struct mbuf *m;
1143
1144 for (m = m0, len = 0; m != NULL; m = m->m_next)
1145 len += m->m_len;
1146 }
1147 return (len);
1148 }
1149
1150
1151 /* ------------------------------------------------------------------------ */
1152 /* Function: ipf_pullup */
1153 /* Returns: NULL == pullup failed, else pointer to protocol header */
1154 /* Parameters: xmin(I)- pointer to buffer where data packet starts */
1155 /* fin(I) - pointer to packet information */
1156 /* len(I) - number of bytes to pullup */
1157 /* */
1158 /* Attempt to move at least len bytes (from the start of the buffer) into a */
1159 /* single buffer for ease of access. Operating system native functions are */
1160 /* used to manage buffers - if necessary. If the entire packet ends up in */
1161 /* a single buffer, set the FI_COALESCE flag even though ipf_coalesce() has */
1162 /* not been called. Both fin_ip and fin_dp are updated before exiting _IF_ */
1163 /* and ONLY if the pullup succeeds. */
1164 /* */
1165 /* We assume that 'xmin' is a pointer to a buffer that is part of the chain */
1166 /* of buffers that starts at *fin->fin_mp. */
1167 /* ------------------------------------------------------------------------ */
1168 ip_t *
ipf_pullup(mb_t * xmin,fr_info_t * fin,int len)1169 ipf_pullup(mb_t *xmin, fr_info_t *fin, int len)
1170 {
1171 int dpoff, ipoff;
1172 mb_t *m = xmin;
1173 ip_t *ip;
1174
1175 if (m == NULL)
1176 return (NULL);
1177
1178 ip = fin->fin_ip;
1179 if ((fin->fin_flx & FI_COALESCE) != 0)
1180 return (ip);
1181
1182 ipoff = fin->fin_ipoff;
1183 if (fin->fin_dp != NULL)
1184 dpoff = (char *)fin->fin_dp - (char *)ip;
1185 else
1186 dpoff = 0;
1187
1188 if (M_LEN(m) < len) {
1189 mb_t *n = *fin->fin_mp;
1190 /*
1191 * Assume that M_PKTHDR is set and just work with what is left
1192 * rather than check..
1193 * Should not make any real difference, anyway.
1194 */
1195 if (m != n) {
1196 /*
1197 * Record the mbuf that points to the mbuf that we're
1198 * about to go to work on so that we can update the
1199 * m_next appropriately later.
1200 */
1201 for (; n->m_next != m; n = n->m_next)
1202 ;
1203 } else {
1204 n = NULL;
1205 }
1206
1207 #ifdef MHLEN
1208 if (len > MHLEN)
1209 #else
1210 if (len > MLEN)
1211 #endif
1212 {
1213 #ifdef HAVE_M_PULLDOWN
1214 if (m_pulldown(m, 0, len, NULL) == NULL)
1215 m = NULL;
1216 #else
1217 FREE_MB_T(*fin->fin_mp);
1218 m = NULL;
1219 n = NULL;
1220 #endif
1221 } else
1222 {
1223
1224 m = m_pullup(m, len);
1225 }
1226 if (n != NULL)
1227 n->m_next = m;
1228 if (m == NULL) {
1229 /*
1230 * When n is non-NULL, it indicates that m pointed to
1231 * a sub-chain (tail) of the mbuf and that the head
1232 * of this chain has not yet been free'd.
1233 */
1234 if (n != NULL) {
1235 FREE_MB_T(*fin->fin_mp);
1236 }
1237
1238 *fin->fin_mp = NULL;
1239 fin->fin_m = NULL;
1240 return (NULL);
1241 }
1242
1243 if (n == NULL)
1244 *fin->fin_mp = m;
1245
1246 while (M_LEN(m) == 0) {
1247 m = m->m_next;
1248 }
1249 fin->fin_m = m;
1250 ip = MTOD(m, ip_t *) + ipoff;
1251
1252 fin->fin_ip = ip;
1253 if (fin->fin_dp != NULL)
1254 fin->fin_dp = (char *)fin->fin_ip + dpoff;
1255 if (fin->fin_fraghdr != NULL)
1256 fin->fin_fraghdr = (char *)ip +
1257 ((char *)fin->fin_fraghdr -
1258 (char *)fin->fin_ip);
1259 }
1260
1261 if (len == fin->fin_plen)
1262 fin->fin_flx |= FI_COALESCE;
1263 return (ip);
1264 }
1265
1266
1267 int
ipf_inject(fr_info_t * fin,mb_t * m)1268 ipf_inject(fr_info_t *fin, mb_t *m)
1269 {
1270 struct epoch_tracker et;
1271 int error = 0;
1272
1273 NET_EPOCH_ENTER(et);
1274 if (fin->fin_out == 0) {
1275 netisr_dispatch(NETISR_IP, m);
1276 } else {
1277 fin->fin_ip->ip_len = ntohs(fin->fin_ip->ip_len);
1278 fin->fin_ip->ip_off = ntohs(fin->fin_ip->ip_off);
1279 error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL, NULL);
1280 }
1281 NET_EPOCH_EXIT(et);
1282
1283 return (error);
1284 }
1285
1286 VNET_DEFINE_STATIC(pfil_hook_t, ipf_inet_hook);
1287 VNET_DEFINE_STATIC(pfil_hook_t, ipf_inet6_hook);
1288 #define V_ipf_inet_hook VNET(ipf_inet_hook)
1289 #define V_ipf_inet6_hook VNET(ipf_inet6_hook)
1290
ipf_pfil_unhook(void)1291 int ipf_pfil_unhook(void) {
1292
1293 pfil_remove_hook(V_ipf_inet_hook);
1294
1295 #ifdef USE_INET6
1296 pfil_remove_hook(V_ipf_inet6_hook);
1297 #endif
1298
1299 return (0);
1300 }
1301
ipf_pfil_hook(void)1302 int ipf_pfil_hook(void) {
1303 int error, error6;
1304
1305 struct pfil_hook_args pha = {
1306 .pa_version = PFIL_VERSION,
1307 .pa_flags = PFIL_IN | PFIL_OUT,
1308 .pa_modname = "ipfilter",
1309 .pa_rulname = "default-ip4",
1310 .pa_mbuf_chk = ipf_check_wrapper,
1311 .pa_type = PFIL_TYPE_IP4,
1312 };
1313 V_ipf_inet_hook = pfil_add_hook(&pha);
1314
1315 #ifdef USE_INET6
1316 pha.pa_rulname = "default-ip6";
1317 pha.pa_mbuf_chk = ipf_check_wrapper6;
1318 pha.pa_type = PFIL_TYPE_IP6;
1319 V_ipf_inet6_hook = pfil_add_hook(&pha);
1320 #endif
1321
1322 struct pfil_link_args pla = {
1323 .pa_version = PFIL_VERSION,
1324 .pa_flags = PFIL_IN | PFIL_OUT | PFIL_HEADPTR | PFIL_HOOKPTR,
1325 .pa_head = V_inet_pfil_head,
1326 .pa_hook = V_ipf_inet_hook,
1327 };
1328 error = pfil_link(&pla);
1329
1330 error6 = 0;
1331 #ifdef USE_INET6
1332 pla.pa_head = V_inet6_pfil_head;
1333 pla.pa_hook = V_ipf_inet6_hook;
1334 error6 = pfil_link(&pla);
1335 #endif
1336
1337 if (error || error6)
1338 error = ENODEV;
1339 else
1340 error = 0;
1341
1342 return (error);
1343 }
1344
1345 void
ipf_event_reg(void)1346 ipf_event_reg(void)
1347 {
1348 V_ipf_arrivetag = EVENTHANDLER_REGISTER(ifnet_arrival_event, \
1349 ipf_ifevent, NULL, \
1350 EVENTHANDLER_PRI_ANY);
1351 V_ipf_departtag = EVENTHANDLER_REGISTER(ifnet_departure_event, \
1352 ipf_ifevent, NULL, \
1353 EVENTHANDLER_PRI_ANY);
1354 V_ipf_renametag = EVENTHANDLER_REGISTER(ifnet_rename_event, \
1355 ipf_ifevent, NULL, \
1356 EVENTHANDLER_PRI_ANY);
1357 }
1358
1359 void
ipf_event_dereg(void)1360 ipf_event_dereg(void)
1361 {
1362 if (V_ipf_arrivetag != NULL) {
1363 EVENTHANDLER_DEREGISTER(ifnet_arrival_event, V_ipf_arrivetag);
1364 }
1365 if (V_ipf_departtag != NULL) {
1366 EVENTHANDLER_DEREGISTER(ifnet_departure_event, V_ipf_departtag);
1367 }
1368 if (V_ipf_renametag != NULL) {
1369 EVENTHANDLER_DEREGISTER(ifnet_rename_event, V_ipf_renametag);
1370 }
1371 }
1372
1373
1374 u_32_t
ipf_random(void)1375 ipf_random(void)
1376 {
1377 return (arc4random());
1378 }
1379
1380
1381 u_int
ipf_pcksum(fr_info_t * fin,int hlen,u_int sum)1382 ipf_pcksum(fr_info_t *fin, int hlen, u_int sum)
1383 {
1384 struct mbuf *m;
1385 u_int sum2;
1386 int off;
1387
1388 m = fin->fin_m;
1389 off = (char *)fin->fin_dp - (char *)fin->fin_ip;
1390 m->m_data += hlen;
1391 m->m_len -= hlen;
1392 sum2 = in_cksum(fin->fin_m, fin->fin_plen - off);
1393 m->m_len += hlen;
1394 m->m_data -= hlen;
1395
1396 /*
1397 * Both sum and sum2 are partial sums, so combine them together.
1398 */
1399 sum += ~sum2 & 0xffff;
1400 while (sum > 0xffff)
1401 sum = (sum & 0xffff) + (sum >> 16);
1402 sum2 = ~sum & 0xffff;
1403 return (sum2);
1404 }
1405
1406 #ifdef USE_INET6
1407 u_int
ipf_pcksum6(struct mbuf * m,ip6_t * ip6,u_int32_t off,u_int32_t len)1408 ipf_pcksum6(struct mbuf *m, ip6_t *ip6, u_int32_t off, u_int32_t len)
1409 {
1410 #ifdef _KERNEL
1411 int sum;
1412
1413 if (m->m_len < sizeof(struct ip6_hdr)) {
1414 return (0xffff);
1415 }
1416
1417 sum = in6_cksum(m, ip6->ip6_nxt, off, len);
1418 return (sum);
1419 #else
1420 u_short *sp;
1421 u_int sum;
1422
1423 sp = (u_short *)&ip6->ip6_src;
1424 sum = *sp++; /* ip6_src */
1425 sum += *sp++;
1426 sum += *sp++;
1427 sum += *sp++;
1428 sum += *sp++;
1429 sum += *sp++;
1430 sum += *sp++;
1431 sum += *sp++;
1432 sum += *sp++; /* ip6_dst */
1433 sum += *sp++;
1434 sum += *sp++;
1435 sum += *sp++;
1436 sum += *sp++;
1437 sum += *sp++;
1438 sum += *sp++;
1439 sum += *sp++;
1440 return (ipf_pcksum(fin, off, sum));
1441 #endif
1442 }
1443 #endif
1444
1445 void
ipf_fbsd_kenv_get(ipf_main_softc_t * softc)1446 ipf_fbsd_kenv_get(ipf_main_softc_t *softc)
1447 {
1448 TUNABLE_INT_FETCH("net.inet.ipf.large_nat",
1449 &softc->ipf_large_nat);
1450 TUNABLE_INT_FETCH("net.inet.ipf.jail_allowed",
1451 &softc->ipf_jail_allowed);
1452 }
1453