1
2 /*
3 * Copyright (C) 2012 by Darren Reed.
4 *
5 * See the IPFILTER.LICENCE file for details on licencing.
6 */
7
8 #if defined(KERNEL) || defined(_KERNEL)
9 # undef KERNEL
10 # undef _KERNEL
11 # define KERNEL 1
12 # define _KERNEL 1
13 #endif
14 #if defined(__FreeBSD__) && \
15 !defined(KLD_MODULE) && !defined(IPFILTER_LKM)
16 # include "opt_inet6.h"
17 #endif
18 #include <sys/param.h>
19 #include <sys/eventhandler.h>
20 #include <sys/conf.h>
21 #include <sys/errno.h>
22 #include <sys/types.h>
23 #include <sys/file.h>
24 #include <sys/fcntl.h>
25 #include <sys/filio.h>
26 #include <sys/time.h>
27 #include <sys/systm.h>
28 #include <sys/dirent.h>
29 #if defined(__FreeBSD__)
30 # include <sys/jail.h>
31 #endif
32 #include <sys/malloc.h>
33 #include <sys/mbuf.h>
34 #include <sys/sockopt.h>
35 #include <sys/socket.h>
36 #include <sys/selinfo.h>
37 #include <net/if.h>
38 #include <net/if_var.h>
39 #include <net/netisr.h>
40 #include <net/route.h>
41 #include <net/route/nhop.h>
42 #include <netinet/in.h>
43 #include <netinet/in_fib.h>
44 #include <netinet/in_pcb.h>
45 #include <netinet/in_var.h>
46 #include <netinet/in_systm.h>
47 #include <netinet/ip.h>
48 #include <netinet/ip_var.h>
49 #include <netinet/tcp.h>
50 #include <netinet/tcp_var.h>
51 #include <net/vnet.h>
52 #include <netinet/udp.h>
53 #include <netinet/tcpip.h>
54 #include <netinet/ip_icmp.h>
55 #include "netinet/ip_compat.h"
56 #ifdef USE_INET6
57 # include <netinet/icmp6.h>
58 #endif
59 #include "netinet/ip_fil.h"
60 #include "netinet/ip_nat.h"
61 #include "netinet/ip_frag.h"
62 #include "netinet/ip_state.h"
63 #include "netinet/ip_proxy.h"
64 #include "netinet/ip_auth.h"
65 #include "netinet/ip_sync.h"
66 #include "netinet/ip_lookup.h"
67 #include "netinet/ip_dstlist.h"
68 #ifdef IPFILTER_SCAN
69 # include "netinet/ip_scan.h"
70 #endif
71 #include "netinet/ip_pool.h"
72 #include <sys/malloc.h>
73 #include <sys/kernel.h>
74 #ifdef CSUM_DATA_VALID
75 # include <machine/in_cksum.h>
76 #endif
77 extern int ip_optcopy(struct ip *, struct ip *);
78
79 #ifdef IPFILTER_M_IPFILTER
80 MALLOC_DEFINE(M_IPFILTER, "ipfilter", "IP Filter packet filter data structures");
81 #endif
82
83
84 static int ipf_send_ip(fr_info_t *, mb_t *);
85 static void ipf_timer_func(void *arg);
86
87 VNET_DEFINE(ipf_main_softc_t, ipfmain) = {
88 .ipf_running = -2,
89 };
90 #define V_ipfmain VNET(ipfmain)
91
92 #include <sys/conf.h>
93 #include <net/pfil.h>
94
95 VNET_DEFINE_STATIC(eventhandler_tag, ipf_arrivetag);
96 VNET_DEFINE_STATIC(eventhandler_tag, ipf_departtag);
97 #define V_ipf_arrivetag VNET(ipf_arrivetag)
98 #define V_ipf_departtag VNET(ipf_departtag)
99
100 static void ipf_ifevent(void *arg, struct ifnet *ifp);
101
ipf_ifevent(void * arg,struct ifnet * ifp)102 static void ipf_ifevent(void *arg, struct ifnet *ifp)
103 {
104
105 CURVNET_SET(ifp->if_vnet);
106 if (V_ipfmain.ipf_running > 0)
107 ipf_sync(&V_ipfmain, NULL);
108 CURVNET_RESTORE();
109 }
110
111
112
113 static pfil_return_t
ipf_check_wrapper(struct mbuf ** mp,struct ifnet * ifp,int flags,void * ruleset __unused,struct inpcb * inp)114 ipf_check_wrapper(struct mbuf **mp, struct ifnet *ifp, int flags,
115 void *ruleset __unused, struct inpcb *inp)
116 {
117 struct ip *ip = mtod(*mp, struct ip *);
118 pfil_return_t rv;
119
120 CURVNET_SET(ifp->if_vnet);
121 rv = ipf_check(&V_ipfmain, ip, ip->ip_hl << 2, ifp,
122 !!(flags & PFIL_OUT), mp);
123 CURVNET_RESTORE();
124 if (rv == 0 && *mp == NULL)
125 return (PFIL_CONSUMED);
126 return (rv == 0 ? PFIL_PASS : PFIL_DROPPED);
127 }
128
129 #ifdef USE_INET6
130 static pfil_return_t
ipf_check_wrapper6(struct mbuf ** mp,struct ifnet * ifp,int flags,void * ruleset __unused,struct inpcb * inp)131 ipf_check_wrapper6(struct mbuf **mp, struct ifnet *ifp, int flags,
132 void *ruleset __unused, struct inpcb *inp)
133 {
134 pfil_return_t rv;
135
136 CURVNET_SET(ifp->if_vnet);
137 rv = ipf_check(&V_ipfmain, mtod(*mp, struct ip *),
138 sizeof(struct ip6_hdr), ifp, !!(flags & PFIL_OUT), mp);
139 CURVNET_RESTORE();
140 if (rv == 0 && *mp == NULL)
141 return (PFIL_CONSUMED);
142
143 return (rv == 0 ? PFIL_PASS : PFIL_DROPPED);
144 }
145 # endif
146 #if defined(IPFILTER_LKM)
ipf_identify(char * s)147 int ipf_identify(char *s)
148 {
149 if (strcmp(s, "ipl") == 0)
150 return (1);
151 return (0);
152 }
153 #endif /* IPFILTER_LKM */
154
155
156 static void
ipf_timer_func(void * arg)157 ipf_timer_func(void *arg)
158 {
159 ipf_main_softc_t *softc = arg;
160 SPL_INT(s);
161
162 SPL_NET(s);
163
164 if (softc->ipf_running > 0)
165 ipf_slowtimer(softc);
166
167 if (softc->ipf_running == -1 || softc->ipf_running == 1) {
168 callout_reset(&softc->ipf_slow_ch,
169 (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT,
170 ipf_timer_func, softc);
171 }
172 SPL_X(s);
173 }
174
175
176 int
ipfattach(ipf_main_softc_t * softc)177 ipfattach(ipf_main_softc_t *softc)
178 {
179 #ifdef USE_SPL
180 int s;
181 #endif
182
183 SPL_NET(s);
184 if (softc->ipf_running > 0) {
185 SPL_X(s);
186 return (EBUSY);
187 }
188
189 if (ipf_init_all(softc) < 0) {
190 SPL_X(s);
191 return (EIO);
192 }
193
194
195 bzero((char *)V_ipfmain.ipf_selwait, sizeof(V_ipfmain.ipf_selwait));
196 softc->ipf_running = 1;
197
198 if (softc->ipf_control_forwarding & 1)
199 V_ipforwarding = 1;
200
201 SPL_X(s);
202 callout_init_rw(&softc->ipf_slow_ch, &softc->ipf_global.ipf_lk, CALLOUT_SHAREDLOCK);
203 callout_reset(&softc->ipf_slow_ch, (hz / IPF_HZ_DIVIDE) * IPF_HZ_MULT,
204 ipf_timer_func, softc);
205 return (0);
206 }
207
208
209 /*
210 * Disable the filter by removing the hooks from the IP input/output
211 * stream.
212 */
213 int
ipfdetach(ipf_main_softc_t * softc)214 ipfdetach(ipf_main_softc_t *softc)
215 {
216 #ifdef USE_SPL
217 int s;
218 #endif
219
220 if (softc->ipf_control_forwarding & 2)
221 V_ipforwarding = 0;
222
223 SPL_NET(s);
224
225 callout_drain(&softc->ipf_slow_ch);
226
227 ipf_fini_all(softc);
228
229 softc->ipf_running = -2;
230
231 SPL_X(s);
232
233 return (0);
234 }
235
236
237 /*
238 * Filter ioctl interface.
239 */
240 int
ipfioctl(struct cdev * dev,ioctlcmd_t cmd,caddr_t data,int mode,struct thread * p)241 ipfioctl(struct cdev *dev, ioctlcmd_t cmd, caddr_t data,
242 int mode, struct thread *p)
243 #define p_cred td_ucred
244 #define p_uid td_ucred->cr_ruid
245 {
246 int error = 0, unit = 0;
247 SPL_INT(s);
248
249 CURVNET_SET(TD_TO_VNET(p));
250 if (securelevel_ge(p->p_cred, 3) && (mode & FWRITE))
251 {
252 V_ipfmain.ipf_interror = 130001;
253 CURVNET_RESTORE();
254 return (EPERM);
255 }
256
257 if (jailed_without_vnet(p->p_cred)) {
258 V_ipfmain.ipf_interror = 130018;
259 CURVNET_RESTORE();
260 return (EOPNOTSUPP);
261 }
262
263 unit = GET_MINOR(dev);
264 if ((IPL_LOGMAX < unit) || (unit < 0)) {
265 V_ipfmain.ipf_interror = 130002;
266 CURVNET_RESTORE();
267 return (ENXIO);
268 }
269
270 if (V_ipfmain.ipf_running <= 0) {
271 if (unit != IPL_LOGIPF && cmd != SIOCIPFINTERROR) {
272 V_ipfmain.ipf_interror = 130003;
273 CURVNET_RESTORE();
274 return (EIO);
275 }
276 if (cmd != SIOCIPFGETNEXT && cmd != SIOCIPFGET &&
277 cmd != SIOCIPFSET && cmd != SIOCFRENB &&
278 cmd != SIOCGETFS && cmd != SIOCGETFF &&
279 cmd != SIOCIPFINTERROR) {
280 V_ipfmain.ipf_interror = 130004;
281 CURVNET_RESTORE();
282 return (EIO);
283 }
284 }
285
286 SPL_NET(s);
287
288 error = ipf_ioctlswitch(&V_ipfmain, unit, data, cmd, mode, p->p_uid, p);
289 CURVNET_RESTORE();
290 if (error != -1) {
291 SPL_X(s);
292 return (error);
293 }
294
295 SPL_X(s);
296
297 return (error);
298 }
299
300
301 /*
302 * ipf_send_reset - this could conceivably be a call to tcp_respond(), but that
303 * requires a large amount of setting up and isn't any more efficient.
304 */
305 int
ipf_send_reset(fr_info_t * fin)306 ipf_send_reset(fr_info_t *fin)
307 {
308 struct tcphdr *tcp, *tcp2;
309 int tlen = 0, hlen;
310 struct mbuf *m;
311 #ifdef USE_INET6
312 ip6_t *ip6;
313 #endif
314 ip_t *ip;
315
316 tcp = fin->fin_dp;
317 if (tcp_get_flags(tcp) & TH_RST)
318 return (-1); /* feedback loop */
319
320 if (ipf_checkl4sum(fin) == -1)
321 return (-1);
322
323 tlen = fin->fin_dlen - (TCP_OFF(tcp) << 2) +
324 ((tcp_get_flags(tcp) & TH_SYN) ? 1 : 0) +
325 ((tcp_get_flags(tcp) & TH_FIN) ? 1 : 0);
326
327 #ifdef USE_INET6
328 hlen = (fin->fin_v == 6) ? sizeof(ip6_t) : sizeof(ip_t);
329 #else
330 hlen = sizeof(ip_t);
331 #endif
332 #ifdef MGETHDR
333 MGETHDR(m, M_NOWAIT, MT_HEADER);
334 #else
335 MGET(m, M_NOWAIT, MT_HEADER);
336 #endif
337 if (m == NULL)
338 return (-1);
339 if (sizeof(*tcp2) + hlen > MLEN) {
340 if (!(MCLGET(m, M_NOWAIT))) {
341 FREE_MB_T(m);
342 return (-1);
343 }
344 }
345
346 m->m_len = sizeof(*tcp2) + hlen;
347 m->m_data += max_linkhdr;
348 m->m_pkthdr.len = m->m_len;
349 m->m_pkthdr.rcvif = (struct ifnet *)0;
350 ip = mtod(m, struct ip *);
351 bzero((char *)ip, hlen);
352 #ifdef USE_INET6
353 ip6 = (ip6_t *)ip;
354 #endif
355 tcp2 = (struct tcphdr *)((char *)ip + hlen);
356 tcp2->th_sport = tcp->th_dport;
357 tcp2->th_dport = tcp->th_sport;
358
359 if (tcp_get_flags(tcp) & TH_ACK) {
360 tcp2->th_seq = tcp->th_ack;
361 tcp_set_flags(tcp2, TH_RST);
362 tcp2->th_ack = 0;
363 } else {
364 tcp2->th_seq = 0;
365 tcp2->th_ack = ntohl(tcp->th_seq);
366 tcp2->th_ack += tlen;
367 tcp2->th_ack = htonl(tcp2->th_ack);
368 tcp_set_flags(tcp2, TH_RST|TH_ACK);
369 }
370 TCP_OFF_A(tcp2, sizeof(*tcp2) >> 2);
371 tcp2->th_win = tcp->th_win;
372 tcp2->th_sum = 0;
373 tcp2->th_urp = 0;
374
375 #ifdef USE_INET6
376 if (fin->fin_v == 6) {
377 ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow;
378 ip6->ip6_plen = htons(sizeof(struct tcphdr));
379 ip6->ip6_nxt = IPPROTO_TCP;
380 ip6->ip6_hlim = 0;
381 ip6->ip6_src = fin->fin_dst6.in6;
382 ip6->ip6_dst = fin->fin_src6.in6;
383 tcp2->th_sum = in6_cksum(m, IPPROTO_TCP,
384 sizeof(*ip6), sizeof(*tcp2));
385 return (ipf_send_ip(fin, m));
386 }
387 #endif
388 ip->ip_p = IPPROTO_TCP;
389 ip->ip_len = htons(sizeof(struct tcphdr));
390 ip->ip_src.s_addr = fin->fin_daddr;
391 ip->ip_dst.s_addr = fin->fin_saddr;
392 tcp2->th_sum = in_cksum(m, hlen + sizeof(*tcp2));
393 ip->ip_len = htons(hlen + sizeof(*tcp2));
394 return (ipf_send_ip(fin, m));
395 }
396
397
398 /*
399 * ip_len must be in network byte order when called.
400 */
401 static int
ipf_send_ip(fr_info_t * fin,mb_t * m)402 ipf_send_ip(fr_info_t *fin, mb_t *m)
403 {
404 fr_info_t fnew;
405 ip_t *ip, *oip;
406 int hlen;
407
408 ip = mtod(m, ip_t *);
409 bzero((char *)&fnew, sizeof(fnew));
410 fnew.fin_main_soft = fin->fin_main_soft;
411
412 IP_V_A(ip, fin->fin_v);
413 switch (fin->fin_v)
414 {
415 case 4 :
416 oip = fin->fin_ip;
417 hlen = sizeof(*oip);
418 fnew.fin_v = 4;
419 fnew.fin_p = ip->ip_p;
420 fnew.fin_plen = ntohs(ip->ip_len);
421 IP_HL_A(ip, sizeof(*oip) >> 2);
422 ip->ip_tos = oip->ip_tos;
423 ip->ip_id = fin->fin_ip->ip_id;
424 ip->ip_off = htons(V_path_mtu_discovery ? IP_DF : 0);
425 ip->ip_ttl = V_ip_defttl;
426 ip->ip_sum = 0;
427 break;
428 #ifdef USE_INET6
429 case 6 :
430 {
431 ip6_t *ip6 = (ip6_t *)ip;
432
433 ip6->ip6_vfc = 0x60;
434 ip6->ip6_hlim = IPDEFTTL;
435
436 hlen = sizeof(*ip6);
437 fnew.fin_p = ip6->ip6_nxt;
438 fnew.fin_v = 6;
439 fnew.fin_plen = ntohs(ip6->ip6_plen) + hlen;
440 break;
441 }
442 #endif
443 default :
444 return (EINVAL);
445 }
446 #ifdef IPSEC_SUPPORT
447 m->m_pkthdr.rcvif = NULL;
448 #endif
449
450 fnew.fin_ifp = fin->fin_ifp;
451 fnew.fin_flx = FI_NOCKSUM;
452 fnew.fin_m = m;
453 fnew.fin_ip = ip;
454 fnew.fin_mp = &m;
455 fnew.fin_hlen = hlen;
456 fnew.fin_dp = (char *)ip + hlen;
457 (void) ipf_makefrip(hlen, ip, &fnew);
458
459 return (ipf_fastroute(m, &m, &fnew, NULL));
460 }
461
462
463 int
ipf_send_icmp_err(int type,fr_info_t * fin,int dst)464 ipf_send_icmp_err(int type, fr_info_t *fin, int dst)
465 {
466 int err, hlen, xtra, iclen, ohlen, avail;
467 struct in_addr dst4;
468 struct icmp *icmp;
469 struct mbuf *m;
470 i6addr_t dst6;
471 void *ifp;
472 #ifdef USE_INET6
473 int code;
474 ip6_t *ip6;
475 #endif
476 ip_t *ip, *ip2;
477
478 if ((type < 0) || (type >= ICMP_MAXTYPE))
479 return (-1);
480
481 #ifdef USE_INET6
482 code = fin->fin_icode;
483 /* See NetBSD ip_fil_netbsd.c r1.4: */
484 if ((code < 0) || (code >= sizeof(icmptoicmp6unreach)/sizeof(int)))
485 return (-1);
486 #endif
487
488 if (ipf_checkl4sum(fin) == -1)
489 return (-1);
490 #ifdef MGETHDR
491 MGETHDR(m, M_NOWAIT, MT_HEADER);
492 #else
493 MGET(m, M_NOWAIT, MT_HEADER);
494 #endif
495 if (m == NULL)
496 return (-1);
497 avail = MHLEN;
498
499 xtra = 0;
500 hlen = 0;
501 ohlen = 0;
502 dst4.s_addr = 0;
503 ifp = fin->fin_ifp;
504 if (fin->fin_v == 4) {
505 if ((fin->fin_p == IPPROTO_ICMP) && !(fin->fin_flx & FI_SHORT))
506 switch (ntohs(fin->fin_data[0]) >> 8)
507 {
508 case ICMP_ECHO :
509 case ICMP_TSTAMP :
510 case ICMP_IREQ :
511 case ICMP_MASKREQ :
512 break;
513 default :
514 FREE_MB_T(m);
515 return (0);
516 }
517
518 if (dst == 0) {
519 if (ipf_ifpaddr(&V_ipfmain, 4, FRI_NORMAL, ifp,
520 &dst6, NULL) == -1) {
521 FREE_MB_T(m);
522 return (-1);
523 }
524 dst4 = dst6.in4;
525 } else
526 dst4.s_addr = fin->fin_daddr;
527
528 hlen = sizeof(ip_t);
529 ohlen = fin->fin_hlen;
530 iclen = hlen + offsetof(struct icmp, icmp_ip) + ohlen;
531 if (fin->fin_hlen < fin->fin_plen)
532 xtra = MIN(fin->fin_dlen, 8);
533 else
534 xtra = 0;
535 }
536
537 #ifdef USE_INET6
538 else if (fin->fin_v == 6) {
539 hlen = sizeof(ip6_t);
540 ohlen = sizeof(ip6_t);
541 iclen = hlen + offsetof(struct icmp, icmp_ip) + ohlen;
542 type = icmptoicmp6types[type];
543 if (type == ICMP6_DST_UNREACH)
544 code = icmptoicmp6unreach[code];
545
546 if (iclen + max_linkhdr + fin->fin_plen > avail) {
547 if (!(MCLGET(m, M_NOWAIT))) {
548 FREE_MB_T(m);
549 return (-1);
550 }
551 avail = MCLBYTES;
552 }
553 xtra = MIN(fin->fin_plen, avail - iclen - max_linkhdr);
554 xtra = MIN(xtra, IPV6_MMTU - iclen);
555 if (dst == 0) {
556 if (ipf_ifpaddr(&V_ipfmain, 6, FRI_NORMAL, ifp,
557 &dst6, NULL) == -1) {
558 FREE_MB_T(m);
559 return (-1);
560 }
561 } else
562 dst6 = fin->fin_dst6;
563 }
564 #endif
565 else {
566 FREE_MB_T(m);
567 return (-1);
568 }
569
570 avail -= (max_linkhdr + iclen);
571 if (avail < 0) {
572 FREE_MB_T(m);
573 return (-1);
574 }
575 if (xtra > avail)
576 xtra = avail;
577 iclen += xtra;
578 m->m_data += max_linkhdr;
579 m->m_pkthdr.rcvif = (struct ifnet *)0;
580 m->m_pkthdr.len = iclen;
581 m->m_len = iclen;
582 ip = mtod(m, ip_t *);
583 icmp = (struct icmp *)((char *)ip + hlen);
584 ip2 = (ip_t *)&icmp->icmp_ip;
585
586 icmp->icmp_type = type;
587 icmp->icmp_code = fin->fin_icode;
588 icmp->icmp_cksum = 0;
589 #ifdef icmp_nextmtu
590 if (type == ICMP_UNREACH && fin->fin_icode == ICMP_UNREACH_NEEDFRAG) {
591 if (fin->fin_mtu != 0) {
592 icmp->icmp_nextmtu = htons(fin->fin_mtu);
593
594 } else if (ifp != NULL) {
595 icmp->icmp_nextmtu = htons(GETIFMTU_4(ifp));
596
597 } else { /* make up a number... */
598 icmp->icmp_nextmtu = htons(fin->fin_plen - 20);
599 }
600 }
601 #endif
602
603 bcopy((char *)fin->fin_ip, (char *)ip2, ohlen);
604
605 #ifdef USE_INET6
606 ip6 = (ip6_t *)ip;
607 if (fin->fin_v == 6) {
608 ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow;
609 ip6->ip6_plen = htons(iclen - hlen);
610 ip6->ip6_nxt = IPPROTO_ICMPV6;
611 ip6->ip6_hlim = 0;
612 ip6->ip6_src = dst6.in6;
613 ip6->ip6_dst = fin->fin_src6.in6;
614 if (xtra > 0)
615 bcopy((char *)fin->fin_ip + ohlen,
616 (char *)&icmp->icmp_ip + ohlen, xtra);
617 icmp->icmp_cksum = in6_cksum(m, IPPROTO_ICMPV6,
618 sizeof(*ip6), iclen - hlen);
619 } else
620 #endif
621 {
622 ip->ip_p = IPPROTO_ICMP;
623 ip->ip_src.s_addr = dst4.s_addr;
624 ip->ip_dst.s_addr = fin->fin_saddr;
625
626 if (xtra > 0)
627 bcopy((char *)fin->fin_ip + ohlen,
628 (char *)&icmp->icmp_ip + ohlen, xtra);
629 icmp->icmp_cksum = ipf_cksum((u_short *)icmp,
630 sizeof(*icmp) + 8);
631 ip->ip_len = htons(iclen);
632 ip->ip_p = IPPROTO_ICMP;
633 }
634 err = ipf_send_ip(fin, m);
635 return (err);
636 }
637
638
639
640
641 /*
642 * m0 - pointer to mbuf where the IP packet starts
643 * mpp - pointer to the mbuf pointer that is the start of the mbuf chain
644 */
645 int
ipf_fastroute(mb_t * m0,mb_t ** mpp,fr_info_t * fin,frdest_t * fdp)646 ipf_fastroute(mb_t *m0, mb_t **mpp, fr_info_t *fin, frdest_t *fdp)
647 {
648 register struct ip *ip, *mhip;
649 register struct mbuf *m = *mpp;
650 int len, off, error = 0, hlen, code;
651 struct ifnet *ifp, *sifp;
652 struct route ro;
653 struct sockaddr_in *dst;
654 const struct sockaddr *gw;
655 struct nhop_object *nh;
656 u_long fibnum = 0;
657 u_short ip_off;
658 frdest_t node;
659 frentry_t *fr;
660
661 #ifdef M_WRITABLE
662 /*
663 * HOT FIX/KLUDGE:
664 *
665 * If the mbuf we're about to send is not writable (because of
666 * a cluster reference, for example) we'll need to make a copy
667 * of it since this routine modifies the contents.
668 *
669 * If you have non-crappy network hardware that can transmit data
670 * from the mbuf, rather than making a copy, this is gonna be a
671 * problem.
672 */
673 if (M_WRITABLE(m) == 0) {
674 m0 = m_dup(m, M_NOWAIT);
675 if (m0 != NULL) {
676 FREE_MB_T(m);
677 m = m0;
678 *mpp = m;
679 } else {
680 error = ENOBUFS;
681 FREE_MB_T(m);
682 goto done;
683 }
684 }
685 #endif
686
687 #ifdef USE_INET6
688 if (fin->fin_v == 6) {
689 /*
690 * currently "to <if>" and "to <if>:ip#" are not supported
691 * for IPv6
692 */
693 return (ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL));
694 }
695 #endif
696
697 hlen = fin->fin_hlen;
698 ip = mtod(m0, struct ip *);
699 ifp = NULL;
700
701 /*
702 * Route packet.
703 */
704 bzero(&ro, sizeof (ro));
705 dst = (struct sockaddr_in *)&ro.ro_dst;
706 dst->sin_family = AF_INET;
707 dst->sin_addr = ip->ip_dst;
708 dst->sin_len = sizeof(dst);
709 gw = (const struct sockaddr *)dst;
710
711 fr = fin->fin_fr;
712 if ((fr != NULL) && !(fr->fr_flags & FR_KEEPSTATE) && (fdp != NULL) &&
713 (fdp->fd_type == FRD_DSTLIST)) {
714 if (ipf_dstlist_select_node(fin, fdp->fd_ptr, NULL, &node) == 0)
715 fdp = &node;
716 }
717
718 if (fdp != NULL)
719 ifp = fdp->fd_ptr;
720 else
721 ifp = fin->fin_ifp;
722
723 if ((ifp == NULL) && ((fr == NULL) || !(fr->fr_flags & FR_FASTROUTE))) {
724 error = -2;
725 goto bad;
726 }
727
728 if ((fdp != NULL) && (fdp->fd_ip.s_addr != 0))
729 dst->sin_addr = fdp->fd_ip;
730
731 fibnum = M_GETFIB(m0);
732 NET_EPOCH_ASSERT();
733 nh = fib4_lookup(fibnum, dst->sin_addr, 0, NHR_NONE, 0);
734 if (nh == NULL) {
735 if (in_localaddr(ip->ip_dst))
736 error = EHOSTUNREACH;
737 else
738 error = ENETUNREACH;
739 goto bad;
740 }
741
742 if (ifp == NULL)
743 ifp = nh->nh_ifp;
744 if (nh->nh_flags & NHF_GATEWAY) {
745 gw = &nh->gw_sa;
746 ro.ro_flags |= RT_HAS_GW;
747 }
748
749 /*
750 * For input packets which are being "fastrouted", they won't
751 * go back through output filtering and miss their chance to get
752 * NAT'd and counted. Duplicated packets aren't considered to be
753 * part of the normal packet stream, so do not NAT them or pass
754 * them through stateful checking, etc.
755 */
756 if ((fdp != &fr->fr_dif) && (fin->fin_out == 0)) {
757 sifp = fin->fin_ifp;
758 fin->fin_ifp = ifp;
759 fin->fin_out = 1;
760 (void) ipf_acctpkt(fin, NULL);
761 fin->fin_fr = NULL;
762 if (!fr || !(fr->fr_flags & FR_RETMASK)) {
763 u_32_t pass;
764
765 (void) ipf_state_check(fin, &pass);
766 }
767
768 switch (ipf_nat_checkout(fin, NULL))
769 {
770 case 0 :
771 break;
772 case 1 :
773 ip->ip_sum = 0;
774 break;
775 case -1 :
776 error = -1;
777 goto bad;
778 break;
779 }
780
781 fin->fin_ifp = sifp;
782 fin->fin_out = 0;
783 } else
784 ip->ip_sum = 0;
785 /*
786 * If small enough for interface, can just send directly.
787 */
788 if (ntohs(ip->ip_len) <= ifp->if_mtu) {
789 if (!ip->ip_sum)
790 ip->ip_sum = in_cksum(m, hlen);
791 error = (*ifp->if_output)(ifp, m, gw, &ro);
792 goto done;
793 }
794 /*
795 * Too large for interface; fragment if possible.
796 * Must be able to put at least 8 bytes per fragment.
797 */
798 ip_off = ntohs(ip->ip_off);
799 if (ip_off & IP_DF) {
800 error = EMSGSIZE;
801 goto bad;
802 }
803 len = (ifp->if_mtu - hlen) &~ 7;
804 if (len < 8) {
805 error = EMSGSIZE;
806 goto bad;
807 }
808
809 {
810 int mhlen, firstlen = len;
811 struct mbuf **mnext = &m->m_act;
812
813 /*
814 * Loop through length of segment after first fragment,
815 * make new header and copy data of each part and link onto chain.
816 */
817 m0 = m;
818 mhlen = sizeof (struct ip);
819 for (off = hlen + len; off < ntohs(ip->ip_len); off += len) {
820 #ifdef MGETHDR
821 MGETHDR(m, M_NOWAIT, MT_HEADER);
822 #else
823 MGET(m, M_NOWAIT, MT_HEADER);
824 #endif
825 if (m == NULL) {
826 m = m0;
827 error = ENOBUFS;
828 goto bad;
829 }
830 m->m_data += max_linkhdr;
831 mhip = mtod(m, struct ip *);
832 bcopy((char *)ip, (char *)mhip, sizeof(*ip));
833 if (hlen > sizeof (struct ip)) {
834 mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip);
835 IP_HL_A(mhip, mhlen >> 2);
836 }
837 m->m_len = mhlen;
838 mhip->ip_off = ((off - hlen) >> 3) + ip_off;
839 if (off + len >= ntohs(ip->ip_len))
840 len = ntohs(ip->ip_len) - off;
841 else
842 mhip->ip_off |= IP_MF;
843 mhip->ip_len = htons((u_short)(len + mhlen));
844 *mnext = m;
845 m->m_next = m_copym(m0, off, len, M_NOWAIT);
846 if (m->m_next == 0) {
847 error = ENOBUFS; /* ??? */
848 goto sendorfree;
849 }
850 m->m_pkthdr.len = mhlen + len;
851 m->m_pkthdr.rcvif = NULL;
852 mhip->ip_off = htons((u_short)mhip->ip_off);
853 mhip->ip_sum = 0;
854 mhip->ip_sum = in_cksum(m, mhlen);
855 mnext = &m->m_act;
856 }
857 /*
858 * Update first fragment by trimming what's been copied out
859 * and updating header, then send each fragment (in order).
860 */
861 m_adj(m0, hlen + firstlen - ip->ip_len);
862 ip->ip_len = htons((u_short)(hlen + firstlen));
863 ip->ip_off = htons((u_short)IP_MF);
864 ip->ip_sum = 0;
865 ip->ip_sum = in_cksum(m0, hlen);
866 sendorfree:
867 for (m = m0; m; m = m0) {
868 m0 = m->m_act;
869 m->m_act = 0;
870 if (error == 0)
871 error = (*ifp->if_output)(ifp, m, gw, &ro);
872 else
873 FREE_MB_T(m);
874 }
875 }
876 done:
877 if (!error)
878 V_ipfmain.ipf_frouteok[0]++;
879 else
880 V_ipfmain.ipf_frouteok[1]++;
881
882 return (0);
883 bad:
884 if (error == EMSGSIZE) {
885 sifp = fin->fin_ifp;
886 code = fin->fin_icode;
887 fin->fin_icode = ICMP_UNREACH_NEEDFRAG;
888 fin->fin_ifp = ifp;
889 (void) ipf_send_icmp_err(ICMP_UNREACH, fin, 1);
890 fin->fin_ifp = sifp;
891 fin->fin_icode = code;
892 }
893 FREE_MB_T(m);
894 goto done;
895 }
896
897
898 int
ipf_verifysrc(fr_info_t * fin)899 ipf_verifysrc(fr_info_t *fin)
900 {
901 struct nhop_object *nh;
902
903 NET_EPOCH_ASSERT();
904 nh = fib4_lookup(RT_DEFAULT_FIB, fin->fin_src, 0, NHR_NONE, 0);
905 if (nh == NULL)
906 return (0);
907 return (fin->fin_ifp == nh->nh_ifp);
908 }
909
910
911 /*
912 * return the first IP Address associated with an interface
913 */
914 int
ipf_ifpaddr(ipf_main_softc_t * softc,int v,int atype,void * ifptr,i6addr_t * inp,i6addr_t * inpmask)915 ipf_ifpaddr(ipf_main_softc_t *softc, int v, int atype, void *ifptr,
916 i6addr_t *inp, i6addr_t *inpmask)
917 {
918 #ifdef USE_INET6
919 struct in6_addr *ia6 = NULL;
920 #endif
921 struct sockaddr *sock, *mask;
922 struct sockaddr_in *sin;
923 struct ifaddr *ifa;
924 struct ifnet *ifp;
925
926 if ((ifptr == NULL) || (ifptr == (void *)-1))
927 return (-1);
928
929 sin = NULL;
930 ifp = ifptr;
931
932 if (v == 4)
933 inp->in4.s_addr = 0;
934 #ifdef USE_INET6
935 else if (v == 6)
936 bzero((char *)inp, sizeof(*inp));
937 #endif
938 ifa = CK_STAILQ_FIRST(&ifp->if_addrhead);
939
940 sock = ifa->ifa_addr;
941 while (sock != NULL && ifa != NULL) {
942 sin = (struct sockaddr_in *)sock;
943 if ((v == 4) && (sin->sin_family == AF_INET))
944 break;
945 #ifdef USE_INET6
946 if ((v == 6) && (sin->sin_family == AF_INET6)) {
947 ia6 = &((struct sockaddr_in6 *)sin)->sin6_addr;
948 if (!IN6_IS_ADDR_LINKLOCAL(ia6) &&
949 !IN6_IS_ADDR_LOOPBACK(ia6))
950 break;
951 }
952 #endif
953 ifa = CK_STAILQ_NEXT(ifa, ifa_link);
954 if (ifa != NULL)
955 sock = ifa->ifa_addr;
956 }
957
958 if (ifa == NULL || sin == NULL)
959 return (-1);
960
961 mask = ifa->ifa_netmask;
962 if (atype == FRI_BROADCAST)
963 sock = ifa->ifa_broadaddr;
964 else if (atype == FRI_PEERADDR)
965 sock = ifa->ifa_dstaddr;
966
967 if (sock == NULL)
968 return (-1);
969
970 #ifdef USE_INET6
971 if (v == 6) {
972 return (ipf_ifpfillv6addr(atype, (struct sockaddr_in6 *)sock,
973 (struct sockaddr_in6 *)mask,
974 inp, inpmask));
975 }
976 #endif
977 return (ipf_ifpfillv4addr(atype, (struct sockaddr_in *)sock,
978 (struct sockaddr_in *)mask,
979 &inp->in4, &inpmask->in4));
980 }
981
982
983 u_32_t
ipf_newisn(fr_info_t * fin)984 ipf_newisn(fr_info_t *fin)
985 {
986 u_32_t newiss;
987 newiss = arc4random();
988 return (newiss);
989 }
990
991
992 int
ipf_checkv4sum(fr_info_t * fin)993 ipf_checkv4sum(fr_info_t *fin)
994 {
995 #ifdef CSUM_DATA_VALID
996 int manual = 0;
997 u_short sum;
998 ip_t *ip;
999 mb_t *m;
1000
1001 if ((fin->fin_flx & FI_NOCKSUM) != 0)
1002 return (0);
1003
1004 if ((fin->fin_flx & FI_SHORT) != 0)
1005 return (1);
1006
1007 if (fin->fin_cksum != FI_CK_NEEDED)
1008 return (fin->fin_cksum > FI_CK_NEEDED) ? 0 : -1;
1009
1010 m = fin->fin_m;
1011 if (m == NULL) {
1012 manual = 1;
1013 goto skipauto;
1014 }
1015 ip = fin->fin_ip;
1016
1017 if ((m->m_pkthdr.csum_flags & (CSUM_IP_CHECKED|CSUM_IP_VALID)) ==
1018 CSUM_IP_CHECKED) {
1019 fin->fin_cksum = FI_CK_BAD;
1020 fin->fin_flx |= FI_BAD;
1021 DT2(ipf_fi_bad_checkv4sum_csum_ip_checked, fr_info_t *, fin, u_int, m->m_pkthdr.csum_flags & (CSUM_IP_CHECKED|CSUM_IP_VALID));
1022 return (-1);
1023 }
1024 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
1025 /* Depending on the driver, UDP may have zero checksum */
1026 if (fin->fin_p == IPPROTO_UDP && (fin->fin_flx &
1027 (FI_FRAG|FI_SHORT|FI_BAD)) == 0) {
1028 udphdr_t *udp = fin->fin_dp;
1029 if (udp->uh_sum == 0) {
1030 /*
1031 * we're good no matter what the hardware
1032 * checksum flags and csum_data say (handling
1033 * of csum_data for zero UDP checksum is not
1034 * consistent across all drivers)
1035 */
1036 fin->fin_cksum = 1;
1037 return (0);
1038 }
1039 }
1040
1041 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
1042 sum = m->m_pkthdr.csum_data;
1043 else
1044 sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
1045 htonl(m->m_pkthdr.csum_data +
1046 fin->fin_dlen + fin->fin_p));
1047 sum ^= 0xffff;
1048 if (sum != 0) {
1049 fin->fin_cksum = FI_CK_BAD;
1050 fin->fin_flx |= FI_BAD;
1051 DT2(ipf_fi_bad_checkv4sum_sum, fr_info_t *, fin, u_int, sum);
1052 } else {
1053 fin->fin_cksum = FI_CK_SUMOK;
1054 return (0);
1055 }
1056 } else {
1057 if (m->m_pkthdr.csum_flags == CSUM_DELAY_DATA) {
1058 fin->fin_cksum = FI_CK_L4FULL;
1059 return (0);
1060 } else if (m->m_pkthdr.csum_flags == CSUM_TCP ||
1061 m->m_pkthdr.csum_flags == CSUM_UDP ||
1062 m->m_pkthdr.csum_flags == CSUM_IP) {
1063 fin->fin_cksum = FI_CK_L4PART;
1064 return (0);
1065 } else {
1066 manual = 1;
1067 }
1068 }
1069 skipauto:
1070 if (manual != 0) {
1071 if (ipf_checkl4sum(fin) == -1) {
1072 fin->fin_flx |= FI_BAD;
1073 DT2(ipf_fi_bad_checkv4sum_manual, fr_info_t *, fin, u_int, manual);
1074 return (-1);
1075 }
1076 }
1077 #else
1078 if (ipf_checkl4sum(fin) == -1) {
1079 fin->fin_flx |= FI_BAD;
1080 DT2(ipf_fi_bad_checkv4sum_checkl4sum, fr_info_t *, fin, u_int, -1);
1081 return (-1);
1082 }
1083 #endif
1084 return (0);
1085 }
1086
1087
1088 #ifdef USE_INET6
1089 int
ipf_checkv6sum(fr_info_t * fin)1090 ipf_checkv6sum(fr_info_t *fin)
1091 {
1092 if ((fin->fin_flx & FI_NOCKSUM) != 0) {
1093 DT(ipf_checkv6sum_fi_nocksum);
1094 return (0);
1095 }
1096
1097 if ((fin->fin_flx & FI_SHORT) != 0) {
1098 DT(ipf_checkv6sum_fi_short);
1099 return (1);
1100 }
1101
1102 if (fin->fin_cksum != FI_CK_NEEDED) {
1103 DT(ipf_checkv6sum_fi_ck_needed);
1104 return (fin->fin_cksum > FI_CK_NEEDED) ? 0 : -1;
1105 }
1106
1107 if (ipf_checkl4sum(fin) == -1) {
1108 fin->fin_flx |= FI_BAD;
1109 DT2(ipf_fi_bad_checkv6sum_checkl4sum, fr_info_t *, fin, u_int, -1);
1110 return (-1);
1111 }
1112 return (0);
1113 }
1114 #endif /* USE_INET6 */
1115
1116
1117 size_t
mbufchainlen(struct mbuf * m0)1118 mbufchainlen(struct mbuf *m0)
1119 {
1120 size_t len;
1121
1122 if ((m0->m_flags & M_PKTHDR) != 0) {
1123 len = m0->m_pkthdr.len;
1124 } else {
1125 struct mbuf *m;
1126
1127 for (m = m0, len = 0; m != NULL; m = m->m_next)
1128 len += m->m_len;
1129 }
1130 return (len);
1131 }
1132
1133
1134 /* ------------------------------------------------------------------------ */
1135 /* Function: ipf_pullup */
1136 /* Returns: NULL == pullup failed, else pointer to protocol header */
1137 /* Parameters: xmin(I)- pointer to buffer where data packet starts */
1138 /* fin(I) - pointer to packet information */
1139 /* len(I) - number of bytes to pullup */
1140 /* */
1141 /* Attempt to move at least len bytes (from the start of the buffer) into a */
1142 /* single buffer for ease of access. Operating system native functions are */
1143 /* used to manage buffers - if necessary. If the entire packet ends up in */
1144 /* a single buffer, set the FI_COALESCE flag even though ipf_coalesce() has */
1145 /* not been called. Both fin_ip and fin_dp are updated before exiting _IF_ */
1146 /* and ONLY if the pullup succeeds. */
1147 /* */
1148 /* We assume that 'xmin' is a pointer to a buffer that is part of the chain */
1149 /* of buffers that starts at *fin->fin_mp. */
1150 /* ------------------------------------------------------------------------ */
1151 ip_t *
ipf_pullup(mb_t * xmin,fr_info_t * fin,int len)1152 ipf_pullup(mb_t *xmin, fr_info_t *fin, int len)
1153 {
1154 int dpoff, ipoff;
1155 mb_t *m = xmin;
1156 ip_t *ip;
1157
1158 if (m == NULL)
1159 return (NULL);
1160
1161 ip = fin->fin_ip;
1162 if ((fin->fin_flx & FI_COALESCE) != 0)
1163 return (ip);
1164
1165 ipoff = fin->fin_ipoff;
1166 if (fin->fin_dp != NULL)
1167 dpoff = (char *)fin->fin_dp - (char *)ip;
1168 else
1169 dpoff = 0;
1170
1171 if (M_LEN(m) < len) {
1172 mb_t *n = *fin->fin_mp;
1173 /*
1174 * Assume that M_PKTHDR is set and just work with what is left
1175 * rather than check..
1176 * Should not make any real difference, anyway.
1177 */
1178 if (m != n) {
1179 /*
1180 * Record the mbuf that points to the mbuf that we're
1181 * about to go to work on so that we can update the
1182 * m_next appropriately later.
1183 */
1184 for (; n->m_next != m; n = n->m_next)
1185 ;
1186 } else {
1187 n = NULL;
1188 }
1189
1190 #ifdef MHLEN
1191 if (len > MHLEN)
1192 #else
1193 if (len > MLEN)
1194 #endif
1195 {
1196 #ifdef HAVE_M_PULLDOWN
1197 if (m_pulldown(m, 0, len, NULL) == NULL)
1198 m = NULL;
1199 #else
1200 FREE_MB_T(*fin->fin_mp);
1201 m = NULL;
1202 n = NULL;
1203 #endif
1204 } else
1205 {
1206
1207 m = m_pullup(m, len);
1208 }
1209 if (n != NULL)
1210 n->m_next = m;
1211 if (m == NULL) {
1212 /*
1213 * When n is non-NULL, it indicates that m pointed to
1214 * a sub-chain (tail) of the mbuf and that the head
1215 * of this chain has not yet been free'd.
1216 */
1217 if (n != NULL) {
1218 FREE_MB_T(*fin->fin_mp);
1219 }
1220
1221 *fin->fin_mp = NULL;
1222 fin->fin_m = NULL;
1223 return (NULL);
1224 }
1225
1226 if (n == NULL)
1227 *fin->fin_mp = m;
1228
1229 while (M_LEN(m) == 0) {
1230 m = m->m_next;
1231 }
1232 fin->fin_m = m;
1233 ip = MTOD(m, ip_t *) + ipoff;
1234
1235 fin->fin_ip = ip;
1236 if (fin->fin_dp != NULL)
1237 fin->fin_dp = (char *)fin->fin_ip + dpoff;
1238 if (fin->fin_fraghdr != NULL)
1239 fin->fin_fraghdr = (char *)ip +
1240 ((char *)fin->fin_fraghdr -
1241 (char *)fin->fin_ip);
1242 }
1243
1244 if (len == fin->fin_plen)
1245 fin->fin_flx |= FI_COALESCE;
1246 return (ip);
1247 }
1248
1249
1250 int
ipf_inject(fr_info_t * fin,mb_t * m)1251 ipf_inject(fr_info_t *fin, mb_t *m)
1252 {
1253 struct epoch_tracker et;
1254 int error = 0;
1255
1256 NET_EPOCH_ENTER(et);
1257 if (fin->fin_out == 0) {
1258 netisr_dispatch(NETISR_IP, m);
1259 } else {
1260 fin->fin_ip->ip_len = ntohs(fin->fin_ip->ip_len);
1261 fin->fin_ip->ip_off = ntohs(fin->fin_ip->ip_off);
1262 error = ip_output(m, NULL, NULL, IP_FORWARDING, NULL, NULL);
1263 }
1264 NET_EPOCH_EXIT(et);
1265
1266 return (error);
1267 }
1268
1269 VNET_DEFINE_STATIC(pfil_hook_t, ipf_inet_hook);
1270 VNET_DEFINE_STATIC(pfil_hook_t, ipf_inet6_hook);
1271 #define V_ipf_inet_hook VNET(ipf_inet_hook)
1272 #define V_ipf_inet6_hook VNET(ipf_inet6_hook)
1273
ipf_pfil_unhook(void)1274 int ipf_pfil_unhook(void) {
1275
1276 pfil_remove_hook(V_ipf_inet_hook);
1277
1278 #ifdef USE_INET6
1279 pfil_remove_hook(V_ipf_inet6_hook);
1280 #endif
1281
1282 return (0);
1283 }
1284
ipf_pfil_hook(void)1285 int ipf_pfil_hook(void) {
1286 int error, error6;
1287
1288 struct pfil_hook_args pha = {
1289 .pa_version = PFIL_VERSION,
1290 .pa_flags = PFIL_IN | PFIL_OUT,
1291 .pa_modname = "ipfilter",
1292 .pa_rulname = "default-ip4",
1293 .pa_mbuf_chk = ipf_check_wrapper,
1294 .pa_type = PFIL_TYPE_IP4,
1295 };
1296 V_ipf_inet_hook = pfil_add_hook(&pha);
1297
1298 #ifdef USE_INET6
1299 pha.pa_rulname = "default-ip6";
1300 pha.pa_mbuf_chk = ipf_check_wrapper6;
1301 pha.pa_type = PFIL_TYPE_IP6;
1302 V_ipf_inet6_hook = pfil_add_hook(&pha);
1303 #endif
1304
1305 struct pfil_link_args pla = {
1306 .pa_version = PFIL_VERSION,
1307 .pa_flags = PFIL_IN | PFIL_OUT | PFIL_HEADPTR | PFIL_HOOKPTR,
1308 .pa_head = V_inet_pfil_head,
1309 .pa_hook = V_ipf_inet_hook,
1310 };
1311 error = pfil_link(&pla);
1312
1313 error6 = 0;
1314 #ifdef USE_INET6
1315 pla.pa_head = V_inet6_pfil_head;
1316 pla.pa_hook = V_ipf_inet6_hook;
1317 error6 = pfil_link(&pla);
1318 #endif
1319
1320 if (error || error6)
1321 error = ENODEV;
1322 else
1323 error = 0;
1324
1325 return (error);
1326 }
1327
1328 void
ipf_event_reg(void)1329 ipf_event_reg(void)
1330 {
1331 V_ipf_arrivetag = EVENTHANDLER_REGISTER(ifnet_arrival_event, \
1332 ipf_ifevent, NULL, \
1333 EVENTHANDLER_PRI_ANY);
1334 V_ipf_departtag = EVENTHANDLER_REGISTER(ifnet_departure_event, \
1335 ipf_ifevent, NULL, \
1336 EVENTHANDLER_PRI_ANY);
1337 }
1338
1339 void
ipf_event_dereg(void)1340 ipf_event_dereg(void)
1341 {
1342 if (V_ipf_arrivetag != NULL) {
1343 EVENTHANDLER_DEREGISTER(ifnet_arrival_event, V_ipf_arrivetag);
1344 }
1345 if (V_ipf_departtag != NULL) {
1346 EVENTHANDLER_DEREGISTER(ifnet_departure_event, V_ipf_departtag);
1347 }
1348 }
1349
1350
1351 u_32_t
ipf_random(void)1352 ipf_random(void)
1353 {
1354 return (arc4random());
1355 }
1356
1357
1358 u_int
ipf_pcksum(fr_info_t * fin,int hlen,u_int sum)1359 ipf_pcksum(fr_info_t *fin, int hlen, u_int sum)
1360 {
1361 struct mbuf *m;
1362 u_int sum2;
1363 int off;
1364
1365 m = fin->fin_m;
1366 off = (char *)fin->fin_dp - (char *)fin->fin_ip;
1367 m->m_data += hlen;
1368 m->m_len -= hlen;
1369 sum2 = in_cksum(fin->fin_m, fin->fin_plen - off);
1370 m->m_len += hlen;
1371 m->m_data -= hlen;
1372
1373 /*
1374 * Both sum and sum2 are partial sums, so combine them together.
1375 */
1376 sum += ~sum2 & 0xffff;
1377 while (sum > 0xffff)
1378 sum = (sum & 0xffff) + (sum >> 16);
1379 sum2 = ~sum & 0xffff;
1380 return (sum2);
1381 }
1382
1383 #ifdef USE_INET6
1384 u_int
ipf_pcksum6(struct mbuf * m,ip6_t * ip6,u_int32_t off,u_int32_t len)1385 ipf_pcksum6(struct mbuf *m, ip6_t *ip6, u_int32_t off, u_int32_t len)
1386 {
1387 #ifdef _KERNEL
1388 int sum;
1389
1390 if (m->m_len < sizeof(struct ip6_hdr)) {
1391 return (0xffff);
1392 }
1393
1394 sum = in6_cksum(m, ip6->ip6_nxt, off, len);
1395 return (sum);
1396 #else
1397 u_short *sp;
1398 u_int sum;
1399
1400 sp = (u_short *)&ip6->ip6_src;
1401 sum = *sp++; /* ip6_src */
1402 sum += *sp++;
1403 sum += *sp++;
1404 sum += *sp++;
1405 sum += *sp++;
1406 sum += *sp++;
1407 sum += *sp++;
1408 sum += *sp++;
1409 sum += *sp++; /* ip6_dst */
1410 sum += *sp++;
1411 sum += *sp++;
1412 sum += *sp++;
1413 sum += *sp++;
1414 sum += *sp++;
1415 sum += *sp++;
1416 sum += *sp++;
1417 return (ipf_pcksum(fin, off, sum));
1418 #endif
1419 }
1420 #endif
1421
1422 void
ipf_fbsd_kenv_get(ipf_main_softc_t * softc)1423 ipf_fbsd_kenv_get(ipf_main_softc_t *softc)
1424 {
1425 TUNABLE_INT_FETCH("net.inet.ipf.large_nat",
1426 &softc->ipf_large_nat);
1427 }
1428