1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2001 Daniel Hartmeier
5 * Copyright (c) 2002 - 2008 Henning Brauer
6 * Copyright (c) 2012 Gleb Smirnoff <glebius@FreeBSD.org>
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * - Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * - Redistributions in binary form must reproduce the above
16 * copyright notice, this list of conditions and the following
17 * disclaimer in the documentation and/or other materials provided
18 * with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31 * POSSIBILITY OF SUCH DAMAGE.
32 *
33 * Effort sponsored in part by the Defense Advanced Research Projects
34 * Agency (DARPA) and Air Force Research Laboratory, Air Force
35 * Materiel Command, USAF, under agreement number F30602-01-2-0537.
36 *
37 * $OpenBSD: pf.c,v 1.634 2009/02/27 12:37:45 henning Exp $
38 */
39
40 #include <sys/cdefs.h>
41 #include "opt_bpf.h"
42 #include "opt_inet.h"
43 #include "opt_inet6.h"
44 #include "opt_pf.h"
45 #include "opt_sctp.h"
46
47 #include <sys/param.h>
48 #include <sys/bus.h>
49 #include <sys/endian.h>
50 #include <sys/gsb_crc32.h>
51 #include <sys/hash.h>
52 #include <sys/interrupt.h>
53 #include <sys/kernel.h>
54 #include <sys/kthread.h>
55 #include <sys/limits.h>
56 #include <sys/mbuf.h>
57 #include <sys/random.h>
58 #include <sys/refcount.h>
59 #include <sys/sdt.h>
60 #include <sys/socket.h>
61 #include <sys/sysctl.h>
62 #include <sys/taskqueue.h>
63 #include <sys/ucred.h>
64
65 #include <crypto/sha2/sha512.h>
66
67 #include <net/if.h>
68 #include <net/if_var.h>
69 #include <net/if_private.h>
70 #include <net/if_types.h>
71 #include <net/if_vlan_var.h>
72 #include <net/route.h>
73 #include <net/route/nhop.h>
74 #include <net/vnet.h>
75
76 #include <net/pfil.h>
77 #include <net/pfvar.h>
78 #include <net/if_pflog.h>
79 #include <net/if_pfsync.h>
80
81 #include <netinet/in_pcb.h>
82 #include <netinet/in_var.h>
83 #include <netinet/in_fib.h>
84 #include <netinet/ip.h>
85 #include <netinet/ip_fw.h>
86 #include <netinet/ip_icmp.h>
87 #include <netinet/icmp_var.h>
88 #include <netinet/ip_var.h>
89 #include <netinet/tcp.h>
90 #include <netinet/tcp_fsm.h>
91 #include <netinet/tcp_seq.h>
92 #include <netinet/tcp_timer.h>
93 #include <netinet/tcp_var.h>
94 #include <netinet/udp.h>
95 #include <netinet/udp_var.h>
96
97 /* dummynet */
98 #include <netinet/ip_dummynet.h>
99 #include <netinet/ip_fw.h>
100 #include <netpfil/ipfw/dn_heap.h>
101 #include <netpfil/ipfw/ip_fw_private.h>
102 #include <netpfil/ipfw/ip_dn_private.h>
103
104 #ifdef INET6
105 #include <netinet/ip6.h>
106 #include <netinet/icmp6.h>
107 #include <netinet6/nd6.h>
108 #include <netinet6/ip6_var.h>
109 #include <netinet6/in6_pcb.h>
110 #include <netinet6/in6_fib.h>
111 #include <netinet6/scope6_var.h>
112 #endif /* INET6 */
113
114 #include <netinet/sctp_header.h>
115 #include <netinet/sctp_crc32.h>
116
117 #include <netipsec/ah.h>
118
119 #include <machine/in_cksum.h>
120 #include <security/mac/mac_framework.h>
121
122 SDT_PROVIDER_DEFINE(pf);
123 SDT_PROBE_DEFINE2(pf, , test, reason_set, "int", "int");
124 SDT_PROBE_DEFINE4(pf, ip, test, done, "int", "int", "struct pf_krule *",
125 "struct pf_kstate *");
126 SDT_PROBE_DEFINE5(pf, ip, state, lookup, "struct pfi_kkif *",
127 "struct pf_state_key_cmp *", "int", "struct pf_pdesc *",
128 "struct pf_kstate *");
129 SDT_PROBE_DEFINE2(pf, ip, , bound_iface, "struct pf_kstate *",
130 "struct pfi_kkif *");
131 SDT_PROBE_DEFINE4(pf, ip, route_to, entry, "struct mbuf *",
132 "struct pf_pdesc *", "struct pf_kstate *", "struct ifnet *");
133 SDT_PROBE_DEFINE1(pf, ip, route_to, drop, "int");
134 SDT_PROBE_DEFINE2(pf, ip, route_to, output, "struct ifnet *", "int");
135 SDT_PROBE_DEFINE4(pf, ip6, route_to, entry, "struct mbuf *",
136 "struct pf_pdesc *", "struct pf_kstate *", "struct ifnet *");
137 SDT_PROBE_DEFINE1(pf, ip6, route_to, drop, "int");
138 SDT_PROBE_DEFINE2(pf, ip6, route_to, output, "struct ifnet *", "int");
139 SDT_PROBE_DEFINE4(pf, sctp, multihome, test, "struct pfi_kkif *",
140 "struct pf_krule *", "struct mbuf *", "int");
141 SDT_PROBE_DEFINE2(pf, sctp, multihome, add, "uint32_t",
142 "struct pf_sctp_source *");
143 SDT_PROBE_DEFINE3(pf, sctp, multihome, remove, "uint32_t",
144 "struct pf_kstate *", "struct pf_sctp_source *");
145 SDT_PROBE_DEFINE4(pf, sctp, multihome_scan, entry, "int",
146 "int", "struct pf_pdesc *", "int");
147 SDT_PROBE_DEFINE2(pf, sctp, multihome_scan, param, "uint16_t", "uint16_t");
148 SDT_PROBE_DEFINE2(pf, sctp, multihome_scan, ipv4, "struct in_addr *",
149 "int");
150 SDT_PROBE_DEFINE2(pf, sctp, multihome_scan, ipv6, "struct in_addr6 *",
151 "int");
152
153 SDT_PROBE_DEFINE3(pf, eth, test_rule, entry, "int", "struct ifnet *",
154 "struct mbuf *");
155 SDT_PROBE_DEFINE2(pf, eth, test_rule, test, "int", "struct pf_keth_rule *");
156 SDT_PROBE_DEFINE3(pf, eth, test_rule, mismatch,
157 "int", "struct pf_keth_rule *", "char *");
158 SDT_PROBE_DEFINE2(pf, eth, test_rule, match, "int", "struct pf_keth_rule *");
159 SDT_PROBE_DEFINE2(pf, eth, test_rule, final_match,
160 "int", "struct pf_keth_rule *");
161 SDT_PROBE_DEFINE2(pf, purge, state, rowcount, "int", "size_t");
162 SDT_PROBE_DEFINE2(pf, , log, log, "int", "const char *");
163
164 /*
165 * Global variables
166 */
167
168 /* state tables */
169 VNET_DEFINE(struct pf_altqqueue, pf_altqs[4]);
170 VNET_DEFINE(struct pf_kpalist, pf_pabuf[3]);
171 VNET_DEFINE(struct pf_altqqueue *, pf_altqs_active);
172 VNET_DEFINE(struct pf_altqqueue *, pf_altq_ifs_active);
173 VNET_DEFINE(struct pf_altqqueue *, pf_altqs_inactive);
174 VNET_DEFINE(struct pf_altqqueue *, pf_altq_ifs_inactive);
175 VNET_DEFINE(struct pf_kstatus, pf_status);
176
177 VNET_DEFINE(u_int32_t, ticket_altqs_active);
178 VNET_DEFINE(u_int32_t, ticket_altqs_inactive);
179 VNET_DEFINE(int, altqs_inactive_open);
180 VNET_DEFINE(u_int32_t, ticket_pabuf);
181
182 static const int PF_HDR_LIMIT = 20; /* arbitrary limit */
183
184 VNET_DEFINE(SHA512_CTX, pf_tcp_secret_ctx);
185 #define V_pf_tcp_secret_ctx VNET(pf_tcp_secret_ctx)
186 VNET_DEFINE(u_char, pf_tcp_secret[16]);
187 #define V_pf_tcp_secret VNET(pf_tcp_secret)
188 VNET_DEFINE(int, pf_tcp_secret_init);
189 #define V_pf_tcp_secret_init VNET(pf_tcp_secret_init)
190 VNET_DEFINE(int, pf_tcp_iss_off);
191 #define V_pf_tcp_iss_off VNET(pf_tcp_iss_off)
192 VNET_DECLARE(int, pf_vnet_active);
193 #define V_pf_vnet_active VNET(pf_vnet_active)
194
195 VNET_DEFINE_STATIC(uint32_t, pf_purge_idx);
196 #define V_pf_purge_idx VNET(pf_purge_idx)
197
198 #ifdef PF_WANT_32_TO_64_COUNTER
199 VNET_DEFINE_STATIC(uint32_t, pf_counter_periodic_iter);
200 #define V_pf_counter_periodic_iter VNET(pf_counter_periodic_iter)
201
202 VNET_DEFINE(struct allrulelist_head, pf_allrulelist);
203 VNET_DEFINE(size_t, pf_allrulecount);
204 VNET_DEFINE(struct pf_krule *, pf_rulemarker);
205 #endif
206
207 #define PF_SCTP_MAX_ENDPOINTS 8
208
209 struct pf_sctp_endpoint;
210 RB_HEAD(pf_sctp_endpoints, pf_sctp_endpoint);
211 struct pf_sctp_source {
212 sa_family_t af;
213 struct pf_addr addr;
214 TAILQ_ENTRY(pf_sctp_source) entry;
215 };
216 TAILQ_HEAD(pf_sctp_sources, pf_sctp_source);
217 struct pf_sctp_endpoint
218 {
219 uint32_t v_tag;
220 struct pf_sctp_sources sources;
221 RB_ENTRY(pf_sctp_endpoint) entry;
222 };
223 static int
pf_sctp_endpoint_compare(struct pf_sctp_endpoint * a,struct pf_sctp_endpoint * b)224 pf_sctp_endpoint_compare(struct pf_sctp_endpoint *a, struct pf_sctp_endpoint *b)
225 {
226 return (a->v_tag - b->v_tag);
227 }
228 RB_PROTOTYPE(pf_sctp_endpoints, pf_sctp_endpoint, entry, pf_sctp_endpoint_compare);
229 RB_GENERATE(pf_sctp_endpoints, pf_sctp_endpoint, entry, pf_sctp_endpoint_compare);
230 VNET_DEFINE_STATIC(struct pf_sctp_endpoints, pf_sctp_endpoints);
231 #define V_pf_sctp_endpoints VNET(pf_sctp_endpoints)
232 static struct mtx_padalign pf_sctp_endpoints_mtx;
233 MTX_SYSINIT(pf_sctp_endpoints_mtx, &pf_sctp_endpoints_mtx, "SCTP endpoints", MTX_DEF);
234 #define PF_SCTP_ENDPOINTS_LOCK() mtx_lock(&pf_sctp_endpoints_mtx)
235 #define PF_SCTP_ENDPOINTS_UNLOCK() mtx_unlock(&pf_sctp_endpoints_mtx)
236
237 /*
238 * Queue for pf_intr() sends.
239 */
240 static MALLOC_DEFINE(M_PFTEMP, "pf_temp", "pf(4) temporary allocations");
241 struct pf_send_entry {
242 STAILQ_ENTRY(pf_send_entry) pfse_next;
243 struct mbuf *pfse_m;
244 enum {
245 PFSE_IP,
246 PFSE_IP6,
247 PFSE_ICMP,
248 PFSE_ICMP6,
249 } pfse_type;
250 struct {
251 int type;
252 int code;
253 int mtu;
254 } icmpopts;
255 };
256
257 STAILQ_HEAD(pf_send_head, pf_send_entry);
258 VNET_DEFINE_STATIC(struct pf_send_head, pf_sendqueue);
259 #define V_pf_sendqueue VNET(pf_sendqueue)
260
261 static struct mtx_padalign pf_sendqueue_mtx;
262 MTX_SYSINIT(pf_sendqueue_mtx, &pf_sendqueue_mtx, "pf send queue", MTX_DEF);
263 #define PF_SENDQ_LOCK() mtx_lock(&pf_sendqueue_mtx)
264 #define PF_SENDQ_UNLOCK() mtx_unlock(&pf_sendqueue_mtx)
265
266 /*
267 * Queue for pf_overload_task() tasks.
268 */
269 struct pf_overload_entry {
270 SLIST_ENTRY(pf_overload_entry) next;
271 struct pf_addr addr;
272 sa_family_t af;
273 uint8_t dir;
274 struct pf_krule *rule;
275 };
276
277 SLIST_HEAD(pf_overload_head, pf_overload_entry);
278 VNET_DEFINE_STATIC(struct pf_overload_head, pf_overloadqueue);
279 #define V_pf_overloadqueue VNET(pf_overloadqueue)
280 VNET_DEFINE_STATIC(struct task, pf_overloadtask);
281 #define V_pf_overloadtask VNET(pf_overloadtask)
282
283 static struct mtx_padalign pf_overloadqueue_mtx;
284 MTX_SYSINIT(pf_overloadqueue_mtx, &pf_overloadqueue_mtx,
285 "pf overload/flush queue", MTX_DEF);
286 #define PF_OVERLOADQ_LOCK() mtx_lock(&pf_overloadqueue_mtx)
287 #define PF_OVERLOADQ_UNLOCK() mtx_unlock(&pf_overloadqueue_mtx)
288
289 VNET_DEFINE(struct pf_krulequeue, pf_unlinked_rules);
290 struct mtx_padalign pf_unlnkdrules_mtx;
291 MTX_SYSINIT(pf_unlnkdrules_mtx, &pf_unlnkdrules_mtx, "pf unlinked rules",
292 MTX_DEF);
293
294 struct sx pf_config_lock;
295 SX_SYSINIT(pf_config_lock, &pf_config_lock, "pf config");
296
297 struct mtx_padalign pf_table_stats_lock;
298 MTX_SYSINIT(pf_table_stats_lock, &pf_table_stats_lock, "pf table stats",
299 MTX_DEF);
300
301 VNET_DEFINE_STATIC(uma_zone_t, pf_sources_z);
302 #define V_pf_sources_z VNET(pf_sources_z)
303 uma_zone_t pf_mtag_z;
304 VNET_DEFINE(uma_zone_t, pf_state_z);
305 VNET_DEFINE(uma_zone_t, pf_state_key_z);
306 VNET_DEFINE(uma_zone_t, pf_udp_mapping_z);
307
308 VNET_DEFINE(struct unrhdr64, pf_stateid);
309
310 static void pf_src_tree_remove_state(struct pf_kstate *);
311 static int pf_check_threshold(struct pf_kthreshold *);
312
313 static void pf_change_ap(struct pf_pdesc *, struct pf_addr *, u_int16_t *,
314 struct pf_addr *, u_int16_t);
315 static int pf_modulate_sack(struct pf_pdesc *,
316 struct tcphdr *, struct pf_state_peer *);
317 int pf_icmp_mapping(struct pf_pdesc *, u_int8_t, int *,
318 u_int16_t *, u_int16_t *);
319 static void pf_change_icmp(struct pf_addr *, u_int16_t *,
320 struct pf_addr *, struct pf_addr *, u_int16_t,
321 u_int16_t *, u_int16_t *, u_int16_t *,
322 u_int16_t *, u_int8_t, sa_family_t);
323 int pf_change_icmp_af(struct mbuf *, int,
324 struct pf_pdesc *, struct pf_pdesc *,
325 struct pf_addr *, struct pf_addr *, sa_family_t,
326 sa_family_t);
327 int pf_translate_icmp_af(int, void *);
328 static void pf_send_icmp(struct mbuf *, u_int8_t, u_int8_t,
329 int, sa_family_t, struct pf_krule *, int);
330 static void pf_detach_state(struct pf_kstate *);
331 static int pf_state_key_attach(struct pf_state_key *,
332 struct pf_state_key *, struct pf_kstate *);
333 static void pf_state_key_detach(struct pf_kstate *, int);
334 static int pf_state_key_ctor(void *, int, void *, int);
335 static u_int32_t pf_tcp_iss(struct pf_pdesc *);
336 static __inline void pf_dummynet_flag_remove(struct mbuf *m,
337 struct pf_mtag *pf_mtag);
338 static int pf_dummynet(struct pf_pdesc *, struct pf_kstate *,
339 struct pf_krule *, struct mbuf **);
340 static int pf_dummynet_route(struct pf_pdesc *,
341 struct pf_kstate *, struct pf_krule *,
342 struct ifnet *, const struct sockaddr *, struct mbuf **);
343 static int pf_test_eth_rule(int, struct pfi_kkif *,
344 struct mbuf **);
345 static int pf_test_rule(struct pf_krule **, struct pf_kstate **,
346 struct pf_pdesc *, struct pf_krule **,
347 struct pf_kruleset **, u_short *, struct inpcb *);
348 static int pf_create_state(struct pf_krule *,
349 struct pf_test_ctx *,
350 struct pf_kstate **, u_int16_t, u_int16_t);
351 static int pf_state_key_addr_setup(struct pf_pdesc *,
352 struct pf_state_key_cmp *, int);
353 static int pf_tcp_track_full(struct pf_kstate *,
354 struct pf_pdesc *, u_short *, int *,
355 struct pf_state_peer *, struct pf_state_peer *,
356 u_int8_t, u_int8_t);
357 static int pf_tcp_track_sloppy(struct pf_kstate *,
358 struct pf_pdesc *, u_short *,
359 struct pf_state_peer *, struct pf_state_peer *,
360 u_int8_t, u_int8_t);
361 static int pf_test_state(struct pf_kstate **, struct pf_pdesc *,
362 u_short *);
363 int pf_icmp_state_lookup(struct pf_state_key_cmp *,
364 struct pf_pdesc *, struct pf_kstate **,
365 u_int16_t, u_int16_t, int, int *, int, int);
366 static int pf_test_state_icmp(struct pf_kstate **,
367 struct pf_pdesc *, u_short *);
368 static int pf_sctp_track(struct pf_kstate *, struct pf_pdesc *,
369 u_short *);
370 static void pf_sctp_multihome_detach_addr(const struct pf_kstate *);
371 static void pf_sctp_multihome_delayed(struct pf_pdesc *,
372 struct pfi_kkif *, struct pf_kstate *, int);
373 static u_int16_t pf_calc_mss(struct pf_addr *, sa_family_t,
374 int, u_int16_t);
375 static int pf_check_proto_cksum(struct mbuf *, int, int,
376 u_int8_t, sa_family_t);
377 static int pf_walk_option(struct pf_pdesc *, struct ip *,
378 int, int, u_short *);
379 static int pf_walk_header(struct pf_pdesc *, struct ip *, u_short *);
380 #ifdef INET6
381 static int pf_walk_option6(struct pf_pdesc *, struct ip6_hdr *,
382 int, int, u_short *);
383 static int pf_walk_header6(struct pf_pdesc *, struct ip6_hdr *,
384 u_short *);
385 #endif
386 static void pf_print_state_parts(struct pf_kstate *,
387 struct pf_state_key *, struct pf_state_key *);
388 static int pf_patch_8(struct pf_pdesc *, u_int8_t *, u_int8_t,
389 bool);
390 static int pf_find_state(struct pf_pdesc *,
391 const struct pf_state_key_cmp *, struct pf_kstate **);
392 static bool pf_src_connlimit(struct pf_kstate *);
393 static int pf_match_rcvif(struct mbuf *, struct pf_krule *);
394 static void pf_counters_inc(int, struct pf_pdesc *,
395 struct pf_kstate *, struct pf_krule *,
396 struct pf_krule *);
397 static void pf_log_matches(struct pf_pdesc *, struct pf_krule *,
398 struct pf_krule *, struct pf_kruleset *,
399 struct pf_krule_slist *);
400 static void pf_overload_task(void *v, int pending);
401 static u_short pf_insert_src_node(struct pf_ksrc_node *[PF_SN_MAX],
402 struct pf_srchash *[PF_SN_MAX], struct pf_krule *,
403 struct pf_addr *, sa_family_t, struct pf_addr *,
404 struct pfi_kkif *, pf_sn_types_t);
405 static u_int pf_purge_expired_states(u_int, int);
406 static void pf_purge_unlinked_rules(void);
407 static int pf_mtag_uminit(void *, int, int);
408 static void pf_mtag_free(struct m_tag *);
409 static void pf_packet_rework_nat(struct pf_pdesc *, int,
410 struct pf_state_key *);
411 #ifdef INET
412 static void pf_route(struct pf_krule *,
413 struct ifnet *, struct pf_kstate *,
414 struct pf_pdesc *, struct inpcb *);
415 #endif /* INET */
416 #ifdef INET6
417 static void pf_change_a6(struct pf_addr *, u_int16_t *,
418 struct pf_addr *, u_int8_t);
419 static void pf_route6(struct pf_krule *,
420 struct ifnet *, struct pf_kstate *,
421 struct pf_pdesc *, struct inpcb *);
422 #endif /* INET6 */
423 static __inline void pf_set_protostate(struct pf_kstate *, int, u_int8_t);
424
425 int in4_cksum(struct mbuf *m, u_int8_t nxt, int off, int len);
426
427 extern int pf_end_threads;
428 extern struct proc *pf_purge_proc;
429
430 VNET_DEFINE(struct pf_limit, pf_limits[PF_LIMIT_MAX]);
431
432 #define PACKET_UNDO_NAT(_pd, _off, _s) \
433 do { \
434 struct pf_state_key *nk; \
435 if ((pd->dir) == PF_OUT) \
436 nk = (_s)->key[PF_SK_STACK]; \
437 else \
438 nk = (_s)->key[PF_SK_WIRE]; \
439 pf_packet_rework_nat(_pd, _off, nk); \
440 } while (0)
441
442 #define PACKET_LOOPED(pd) ((pd)->pf_mtag && \
443 (pd)->pf_mtag->flags & PF_MTAG_FLAG_PACKET_LOOPED)
444
445 static struct pfi_kkif *
BOUND_IFACE(struct pf_kstate * st,struct pf_pdesc * pd)446 BOUND_IFACE(struct pf_kstate *st, struct pf_pdesc *pd)
447 {
448 struct pfi_kkif *k = pd->kif;
449
450 SDT_PROBE2(pf, ip, , bound_iface, st, k);
451
452 /* Floating unless otherwise specified. */
453 if (! (st->rule->rule_flag & PFRULE_IFBOUND))
454 return (V_pfi_all);
455
456 /*
457 * Initially set to all, because we don't know what interface we'll be
458 * sending this out when we create the state.
459 */
460 if (st->rule->rt == PF_REPLYTO || (pd->af != pd->naf && st->direction == PF_IN))
461 return (V_pfi_all);
462
463 /*
464 * If this state is created based on another state (e.g. SCTP
465 * multihome) always set it floating initially. We can't know for sure
466 * what interface the actual traffic for this state will come in on.
467 */
468 if (pd->related_rule)
469 return (V_pfi_all);
470
471 /* Don't overrule the interface for states created on incoming packets. */
472 if (st->direction == PF_IN)
473 return (k);
474
475 /* No route-to, so don't overrule. */
476 if (st->act.rt != PF_ROUTETO)
477 return (k);
478
479 /* Bind to the route-to interface. */
480 return (st->act.rt_kif);
481 }
482
483 #define STATE_INC_COUNTERS(s) \
484 do { \
485 struct pf_krule_item *mrm; \
486 counter_u64_add(s->rule->states_cur, 1); \
487 counter_u64_add(s->rule->states_tot, 1); \
488 if (s->anchor != NULL) { \
489 counter_u64_add(s->anchor->states_cur, 1); \
490 counter_u64_add(s->anchor->states_tot, 1); \
491 } \
492 if (s->nat_rule != NULL) { \
493 counter_u64_add(s->nat_rule->states_cur, 1);\
494 counter_u64_add(s->nat_rule->states_tot, 1);\
495 } \
496 SLIST_FOREACH(mrm, &s->match_rules, entry) { \
497 counter_u64_add(mrm->r->states_cur, 1); \
498 counter_u64_add(mrm->r->states_tot, 1); \
499 } \
500 } while (0)
501
502 #define STATE_DEC_COUNTERS(s) \
503 do { \
504 struct pf_krule_item *mrm; \
505 if (s->nat_rule != NULL) \
506 counter_u64_add(s->nat_rule->states_cur, -1);\
507 if (s->anchor != NULL) \
508 counter_u64_add(s->anchor->states_cur, -1); \
509 counter_u64_add(s->rule->states_cur, -1); \
510 SLIST_FOREACH(mrm, &s->match_rules, entry) \
511 counter_u64_add(mrm->r->states_cur, -1); \
512 } while (0)
513
514 MALLOC_DEFINE(M_PFHASH, "pf_hash", "pf(4) hash header structures");
515 MALLOC_DEFINE(M_PF_RULE_ITEM, "pf_krule_item", "pf(4) rule items");
516 VNET_DEFINE(struct pf_keyhash *, pf_keyhash);
517 VNET_DEFINE(struct pf_idhash *, pf_idhash);
518 VNET_DEFINE(struct pf_srchash *, pf_srchash);
519 VNET_DEFINE(struct pf_udpendpointhash *, pf_udpendpointhash);
520 VNET_DEFINE(struct pf_udpendpointmapping *, pf_udpendpointmapping);
521
522 SYSCTL_NODE(_net, OID_AUTO, pf, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
523 "pf(4)");
524
525 VNET_DEFINE(u_long, pf_hashmask);
526 VNET_DEFINE(u_long, pf_srchashmask);
527 VNET_DEFINE(u_long, pf_udpendpointhashmask);
528 VNET_DEFINE_STATIC(u_long, pf_hashsize);
529 #define V_pf_hashsize VNET(pf_hashsize)
530 VNET_DEFINE_STATIC(u_long, pf_srchashsize);
531 #define V_pf_srchashsize VNET(pf_srchashsize)
532 VNET_DEFINE_STATIC(u_long, pf_udpendpointhashsize);
533 #define V_pf_udpendpointhashsize VNET(pf_udpendpointhashsize)
534 u_long pf_ioctl_maxcount = 65535;
535
536 SYSCTL_ULONG(_net_pf, OID_AUTO, states_hashsize, CTLFLAG_VNET | CTLFLAG_RDTUN,
537 &VNET_NAME(pf_hashsize), 0, "Size of pf(4) states hashtable");
538 SYSCTL_ULONG(_net_pf, OID_AUTO, source_nodes_hashsize, CTLFLAG_VNET | CTLFLAG_RDTUN,
539 &VNET_NAME(pf_srchashsize), 0, "Size of pf(4) source nodes hashtable");
540 SYSCTL_ULONG(_net_pf, OID_AUTO, udpendpoint_hashsize, CTLFLAG_VNET | CTLFLAG_RDTUN,
541 &VNET_NAME(pf_udpendpointhashsize), 0, "Size of pf(4) endpoint hashtable");
542 SYSCTL_ULONG(_net_pf, OID_AUTO, request_maxcount, CTLFLAG_RWTUN,
543 &pf_ioctl_maxcount, 0, "Maximum number of tables, addresses, ... in a single ioctl() call");
544
545 VNET_DEFINE(void *, pf_swi_cookie);
546 VNET_DEFINE(struct intr_event *, pf_swi_ie);
547
548 VNET_DEFINE(uint32_t, pf_hashseed);
549 #define V_pf_hashseed VNET(pf_hashseed)
550
551 static void
pf_sctp_checksum(struct mbuf * m,int off)552 pf_sctp_checksum(struct mbuf *m, int off)
553 {
554 uint32_t sum = 0;
555
556 /* Zero out the checksum, to enable recalculation. */
557 m_copyback(m, off + offsetof(struct sctphdr, checksum),
558 sizeof(sum), (caddr_t)&sum);
559
560 sum = sctp_calculate_cksum(m, off);
561
562 m_copyback(m, off + offsetof(struct sctphdr, checksum),
563 sizeof(sum), (caddr_t)&sum);
564 }
565
566 int
pf_addr_cmp(struct pf_addr * a,struct pf_addr * b,sa_family_t af)567 pf_addr_cmp(struct pf_addr *a, struct pf_addr *b, sa_family_t af)
568 {
569
570 switch (af) {
571 #ifdef INET
572 case AF_INET:
573 if (a->addr32[0] > b->addr32[0])
574 return (1);
575 if (a->addr32[0] < b->addr32[0])
576 return (-1);
577 break;
578 #endif /* INET */
579 #ifdef INET6
580 case AF_INET6:
581 if (a->addr32[3] > b->addr32[3])
582 return (1);
583 if (a->addr32[3] < b->addr32[3])
584 return (-1);
585 if (a->addr32[2] > b->addr32[2])
586 return (1);
587 if (a->addr32[2] < b->addr32[2])
588 return (-1);
589 if (a->addr32[1] > b->addr32[1])
590 return (1);
591 if (a->addr32[1] < b->addr32[1])
592 return (-1);
593 if (a->addr32[0] > b->addr32[0])
594 return (1);
595 if (a->addr32[0] < b->addr32[0])
596 return (-1);
597 break;
598 #endif /* INET6 */
599 default:
600 unhandled_af(af);
601 }
602 return (0);
603 }
604
605 static bool
pf_is_loopback(sa_family_t af,struct pf_addr * addr)606 pf_is_loopback(sa_family_t af, struct pf_addr *addr)
607 {
608 switch (af) {
609 #ifdef INET
610 case AF_INET:
611 return IN_LOOPBACK(ntohl(addr->v4.s_addr));
612 #endif /* INET */
613 case AF_INET6:
614 return IN6_IS_ADDR_LOOPBACK(&addr->v6);
615 default:
616 unhandled_af(af);
617 }
618 }
619
620 static void
pf_packet_rework_nat(struct pf_pdesc * pd,int off,struct pf_state_key * nk)621 pf_packet_rework_nat(struct pf_pdesc *pd, int off, struct pf_state_key *nk)
622 {
623
624 switch (pd->proto) {
625 case IPPROTO_TCP: {
626 struct tcphdr *th = &pd->hdr.tcp;
627
628 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af))
629 pf_change_ap(pd, pd->src, &th->th_sport,
630 &nk->addr[pd->sidx], nk->port[pd->sidx]);
631 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af))
632 pf_change_ap(pd, pd->dst, &th->th_dport,
633 &nk->addr[pd->didx], nk->port[pd->didx]);
634 m_copyback(pd->m, off, sizeof(*th), (caddr_t)th);
635 break;
636 }
637 case IPPROTO_UDP: {
638 struct udphdr *uh = &pd->hdr.udp;
639
640 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af))
641 pf_change_ap(pd, pd->src, &uh->uh_sport,
642 &nk->addr[pd->sidx], nk->port[pd->sidx]);
643 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af))
644 pf_change_ap(pd, pd->dst, &uh->uh_dport,
645 &nk->addr[pd->didx], nk->port[pd->didx]);
646 m_copyback(pd->m, off, sizeof(*uh), (caddr_t)uh);
647 break;
648 }
649 case IPPROTO_SCTP: {
650 struct sctphdr *sh = &pd->hdr.sctp;
651
652 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af)) {
653 pf_change_ap(pd, pd->src, &sh->src_port,
654 &nk->addr[pd->sidx], nk->port[pd->sidx]);
655 }
656 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af)) {
657 pf_change_ap(pd, pd->dst, &sh->dest_port,
658 &nk->addr[pd->didx], nk->port[pd->didx]);
659 }
660
661 break;
662 }
663 case IPPROTO_ICMP: {
664 struct icmp *ih = &pd->hdr.icmp;
665
666 if (nk->port[pd->sidx] != ih->icmp_id) {
667 pd->hdr.icmp.icmp_cksum = pf_cksum_fixup(
668 ih->icmp_cksum, ih->icmp_id,
669 nk->port[pd->sidx], 0);
670 ih->icmp_id = nk->port[pd->sidx];
671 pd->sport = &ih->icmp_id;
672
673 m_copyback(pd->m, off, ICMP_MINLEN, (caddr_t)ih);
674 }
675 /* FALLTHROUGH */
676 }
677 default:
678 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af)) {
679 switch (pd->af) {
680 case AF_INET:
681 pf_change_a(&pd->src->v4.s_addr,
682 pd->ip_sum, nk->addr[pd->sidx].v4.s_addr,
683 0);
684 break;
685 case AF_INET6:
686 pf_addrcpy(pd->src, &nk->addr[pd->sidx],
687 pd->af);
688 break;
689 default:
690 unhandled_af(pd->af);
691 }
692 }
693 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af)) {
694 switch (pd->af) {
695 case AF_INET:
696 pf_change_a(&pd->dst->v4.s_addr,
697 pd->ip_sum, nk->addr[pd->didx].v4.s_addr,
698 0);
699 break;
700 case AF_INET6:
701 pf_addrcpy(pd->dst, &nk->addr[pd->didx],
702 pd->af);
703 break;
704 default:
705 unhandled_af(pd->af);
706 }
707 }
708 break;
709 }
710 }
711
712 static __inline uint32_t
pf_hashkey(const struct pf_state_key * sk)713 pf_hashkey(const struct pf_state_key *sk)
714 {
715 uint32_t h;
716
717 h = murmur3_32_hash32((const uint32_t *)sk,
718 sizeof(struct pf_state_key_cmp)/sizeof(uint32_t),
719 V_pf_hashseed);
720
721 return (h & V_pf_hashmask);
722 }
723
724 __inline uint32_t
pf_hashsrc(struct pf_addr * addr,sa_family_t af)725 pf_hashsrc(struct pf_addr *addr, sa_family_t af)
726 {
727 uint32_t h;
728
729 switch (af) {
730 case AF_INET:
731 h = murmur3_32_hash32((uint32_t *)&addr->v4,
732 sizeof(addr->v4)/sizeof(uint32_t), V_pf_hashseed);
733 break;
734 case AF_INET6:
735 h = murmur3_32_hash32((uint32_t *)&addr->v6,
736 sizeof(addr->v6)/sizeof(uint32_t), V_pf_hashseed);
737 break;
738 default:
739 unhandled_af(af);
740 }
741
742 return (h & V_pf_srchashmask);
743 }
744
745 static inline uint32_t
pf_hashudpendpoint(struct pf_udp_endpoint * endpoint)746 pf_hashudpendpoint(struct pf_udp_endpoint *endpoint)
747 {
748 uint32_t h;
749
750 h = murmur3_32_hash32((uint32_t *)endpoint,
751 sizeof(struct pf_udp_endpoint_cmp)/sizeof(uint32_t),
752 V_pf_hashseed);
753 return (h & V_pf_udpendpointhashmask);
754 }
755
756 #ifdef ALTQ
757 static int
pf_state_hash(struct pf_kstate * s)758 pf_state_hash(struct pf_kstate *s)
759 {
760 u_int32_t hv = (intptr_t)s / sizeof(*s);
761
762 hv ^= crc32(&s->src, sizeof(s->src));
763 hv ^= crc32(&s->dst, sizeof(s->dst));
764 if (hv == 0)
765 hv = 1;
766 return (hv);
767 }
768 #endif /* ALTQ */
769
770 static __inline void
pf_set_protostate(struct pf_kstate * s,int which,u_int8_t newstate)771 pf_set_protostate(struct pf_kstate *s, int which, u_int8_t newstate)
772 {
773 if (which == PF_PEER_DST || which == PF_PEER_BOTH)
774 s->dst.state = newstate;
775 if (which == PF_PEER_DST)
776 return;
777 if (s->src.state == newstate)
778 return;
779 if (s->creatorid == V_pf_status.hostid &&
780 s->key[PF_SK_STACK] != NULL &&
781 s->key[PF_SK_STACK]->proto == IPPROTO_TCP &&
782 !(TCPS_HAVEESTABLISHED(s->src.state) ||
783 s->src.state == TCPS_CLOSED) &&
784 (TCPS_HAVEESTABLISHED(newstate) || newstate == TCPS_CLOSED))
785 atomic_add_32(&V_pf_status.states_halfopen, -1);
786
787 s->src.state = newstate;
788 }
789
790 bool
pf_init_threshold(struct pf_kthreshold * threshold,u_int32_t limit,u_int32_t seconds)791 pf_init_threshold(struct pf_kthreshold *threshold,
792 u_int32_t limit, u_int32_t seconds)
793 {
794 threshold->limit = limit;
795 threshold->seconds = seconds;
796 threshold->cr = counter_rate_alloc(M_NOWAIT, seconds);
797
798 return (threshold->cr != NULL);
799 }
800
801 static int
pf_check_threshold(struct pf_kthreshold * threshold)802 pf_check_threshold(struct pf_kthreshold *threshold)
803 {
804 return (counter_ratecheck(threshold->cr, threshold->limit) < 0);
805 }
806
807 static bool
pf_src_connlimit(struct pf_kstate * state)808 pf_src_connlimit(struct pf_kstate *state)
809 {
810 struct pf_overload_entry *pfoe;
811 struct pf_ksrc_node *src_node = state->sns[PF_SN_LIMIT];
812 bool limited = false;
813
814 PF_STATE_LOCK_ASSERT(state);
815 PF_SRC_NODE_LOCK(src_node);
816
817 src_node->conn++;
818 state->src.tcp_est = 1;
819
820 if (state->rule->max_src_conn &&
821 state->rule->max_src_conn <
822 src_node->conn) {
823 counter_u64_add(V_pf_status.lcounters[LCNT_SRCCONN], 1);
824 limited = true;
825 }
826
827 if (state->rule->max_src_conn_rate.limit &&
828 pf_check_threshold(&src_node->conn_rate)) {
829 counter_u64_add(V_pf_status.lcounters[LCNT_SRCCONNRATE], 1);
830 limited = true;
831 }
832
833 if (!limited)
834 goto done;
835
836 /* Kill this state. */
837 state->timeout = PFTM_PURGE;
838 pf_set_protostate(state, PF_PEER_BOTH, TCPS_CLOSED);
839
840 if (state->rule->overload_tbl == NULL)
841 goto done;
842
843 /* Schedule overloading and flushing task. */
844 pfoe = malloc(sizeof(*pfoe), M_PFTEMP, M_NOWAIT);
845 if (pfoe == NULL)
846 goto done; /* too bad :( */
847
848 bcopy(&src_node->addr, &pfoe->addr, sizeof(pfoe->addr));
849 pfoe->af = state->key[PF_SK_WIRE]->af;
850 pfoe->rule = state->rule;
851 pfoe->dir = state->direction;
852 PF_OVERLOADQ_LOCK();
853 SLIST_INSERT_HEAD(&V_pf_overloadqueue, pfoe, next);
854 PF_OVERLOADQ_UNLOCK();
855 taskqueue_enqueue(taskqueue_swi, &V_pf_overloadtask);
856
857 done:
858 PF_SRC_NODE_UNLOCK(src_node);
859 return (limited);
860 }
861
862 static void
pf_overload_task(void * v,int pending)863 pf_overload_task(void *v, int pending)
864 {
865 struct pf_overload_head queue;
866 struct pfr_addr p;
867 struct pf_overload_entry *pfoe, *pfoe1;
868 uint32_t killed = 0;
869
870 CURVNET_SET((struct vnet *)v);
871
872 PF_OVERLOADQ_LOCK();
873 queue = V_pf_overloadqueue;
874 SLIST_INIT(&V_pf_overloadqueue);
875 PF_OVERLOADQ_UNLOCK();
876
877 bzero(&p, sizeof(p));
878 SLIST_FOREACH(pfoe, &queue, next) {
879 counter_u64_add(V_pf_status.lcounters[LCNT_OVERLOAD_TABLE], 1);
880 if (V_pf_status.debug >= PF_DEBUG_MISC) {
881 printf("%s: blocking address ", __func__);
882 pf_print_host(&pfoe->addr, 0, pfoe->af);
883 printf("\n");
884 }
885
886 p.pfra_af = pfoe->af;
887 switch (pfoe->af) {
888 #ifdef INET
889 case AF_INET:
890 p.pfra_net = 32;
891 p.pfra_ip4addr = pfoe->addr.v4;
892 break;
893 #endif /* INET */
894 #ifdef INET6
895 case AF_INET6:
896 p.pfra_net = 128;
897 p.pfra_ip6addr = pfoe->addr.v6;
898 break;
899 #endif /* INET6 */
900 default:
901 unhandled_af(pfoe->af);
902 }
903
904 PF_RULES_WLOCK();
905 pfr_insert_kentry(pfoe->rule->overload_tbl, &p, time_second);
906 PF_RULES_WUNLOCK();
907 }
908
909 /*
910 * Remove those entries, that don't need flushing.
911 */
912 SLIST_FOREACH_SAFE(pfoe, &queue, next, pfoe1)
913 if (pfoe->rule->flush == 0) {
914 SLIST_REMOVE(&queue, pfoe, pf_overload_entry, next);
915 free(pfoe, M_PFTEMP);
916 } else
917 counter_u64_add(
918 V_pf_status.lcounters[LCNT_OVERLOAD_FLUSH], 1);
919
920 /* If nothing to flush, return. */
921 if (SLIST_EMPTY(&queue)) {
922 CURVNET_RESTORE();
923 return;
924 }
925
926 for (int i = 0; i <= V_pf_hashmask; i++) {
927 struct pf_idhash *ih = &V_pf_idhash[i];
928 struct pf_state_key *sk;
929 struct pf_kstate *s;
930
931 PF_HASHROW_LOCK(ih);
932 LIST_FOREACH(s, &ih->states, entry) {
933 sk = s->key[PF_SK_WIRE];
934 SLIST_FOREACH(pfoe, &queue, next)
935 if (sk->af == pfoe->af &&
936 ((pfoe->rule->flush & PF_FLUSH_GLOBAL) ||
937 pfoe->rule == s->rule) &&
938 ((pfoe->dir == PF_OUT &&
939 PF_AEQ(&pfoe->addr, &sk->addr[1], sk->af)) ||
940 (pfoe->dir == PF_IN &&
941 PF_AEQ(&pfoe->addr, &sk->addr[0], sk->af)))) {
942 s->timeout = PFTM_PURGE;
943 pf_set_protostate(s, PF_PEER_BOTH, TCPS_CLOSED);
944 killed++;
945 }
946 }
947 PF_HASHROW_UNLOCK(ih);
948 }
949 SLIST_FOREACH_SAFE(pfoe, &queue, next, pfoe1)
950 free(pfoe, M_PFTEMP);
951 if (V_pf_status.debug >= PF_DEBUG_MISC)
952 printf("%s: %u states killed", __func__, killed);
953
954 CURVNET_RESTORE();
955 }
956
957 /*
958 * On node found always returns locked. On not found its configurable.
959 */
960 struct pf_ksrc_node *
pf_find_src_node(struct pf_addr * src,struct pf_krule * rule,sa_family_t af,struct pf_srchash ** sh,pf_sn_types_t sn_type,bool returnlocked)961 pf_find_src_node(struct pf_addr *src, struct pf_krule *rule, sa_family_t af,
962 struct pf_srchash **sh, pf_sn_types_t sn_type, bool returnlocked)
963 {
964 struct pf_ksrc_node *n;
965
966 counter_u64_add(V_pf_status.scounters[SCNT_SRC_NODE_SEARCH], 1);
967
968 *sh = &V_pf_srchash[pf_hashsrc(src, af)];
969 PF_HASHROW_LOCK(*sh);
970 LIST_FOREACH(n, &(*sh)->nodes, entry)
971 if (n->rule == rule && n->af == af && n->type == sn_type &&
972 ((af == AF_INET && n->addr.v4.s_addr == src->v4.s_addr) ||
973 (af == AF_INET6 && bcmp(&n->addr, src, sizeof(*src)) == 0)))
974 break;
975
976 if (n == NULL && !returnlocked)
977 PF_HASHROW_UNLOCK(*sh);
978
979 return (n);
980 }
981
982 bool
pf_src_node_exists(struct pf_ksrc_node ** sn,struct pf_srchash * sh)983 pf_src_node_exists(struct pf_ksrc_node **sn, struct pf_srchash *sh)
984 {
985 struct pf_ksrc_node *cur;
986
987 if ((*sn) == NULL)
988 return (false);
989
990 KASSERT(sh != NULL, ("%s: sh is NULL", __func__));
991
992 counter_u64_add(V_pf_status.scounters[SCNT_SRC_NODE_SEARCH], 1);
993 PF_HASHROW_LOCK(sh);
994 LIST_FOREACH(cur, &(sh->nodes), entry) {
995 if (cur == (*sn) &&
996 cur->expire != 1) /* Ignore nodes being killed */
997 return (true);
998 }
999 PF_HASHROW_UNLOCK(sh);
1000 (*sn) = NULL;
1001 return (false);
1002 }
1003
1004 static void
pf_free_src_node(struct pf_ksrc_node * sn)1005 pf_free_src_node(struct pf_ksrc_node *sn)
1006 {
1007
1008 for (int i = 0; i < 2; i++) {
1009 counter_u64_free(sn->bytes[i]);
1010 counter_u64_free(sn->packets[i]);
1011 }
1012 counter_rate_free(sn->conn_rate.cr);
1013 uma_zfree(V_pf_sources_z, sn);
1014 }
1015
1016 static u_short
pf_insert_src_node(struct pf_ksrc_node * sns[PF_SN_MAX],struct pf_srchash * snhs[PF_SN_MAX],struct pf_krule * rule,struct pf_addr * src,sa_family_t af,struct pf_addr * raddr,struct pfi_kkif * rkif,pf_sn_types_t sn_type)1017 pf_insert_src_node(struct pf_ksrc_node *sns[PF_SN_MAX],
1018 struct pf_srchash *snhs[PF_SN_MAX], struct pf_krule *rule,
1019 struct pf_addr *src, sa_family_t af, struct pf_addr *raddr,
1020 struct pfi_kkif *rkif, pf_sn_types_t sn_type)
1021 {
1022 u_short reason = 0;
1023 struct pf_krule *r_track = rule;
1024 struct pf_ksrc_node **sn = &(sns[sn_type]);
1025 struct pf_srchash **sh = &(snhs[sn_type]);
1026
1027 KASSERT(sn_type != PF_SN_LIMIT || (raddr == NULL && rkif == NULL),
1028 ("%s: raddr and rkif must be NULL for PF_SN_LIMIT", __func__));
1029
1030 KASSERT(sn_type != PF_SN_LIMIT || (rule->rule_flag & PFRULE_SRCTRACK),
1031 ("%s: PF_SN_LIMIT only valid for rules with PFRULE_SRCTRACK", __func__));
1032
1033 /*
1034 * XXX: There could be a KASSERT for
1035 * sn_type == PF_SN_LIMIT || (pool->opts & PF_POOL_STICKYADDR)
1036 * but we'd need to pass pool *only* for this KASSERT.
1037 */
1038
1039 if ( (rule->rule_flag & PFRULE_SRCTRACK) &&
1040 !(rule->rule_flag & PFRULE_RULESRCTRACK))
1041 r_track = &V_pf_default_rule;
1042
1043 /*
1044 * Request the sh to always be locked, as we might insert a new sn.
1045 */
1046 if (*sn == NULL)
1047 *sn = pf_find_src_node(src, r_track, af, sh, sn_type, true);
1048
1049 if (*sn == NULL) {
1050 PF_HASHROW_ASSERT(*sh);
1051
1052 if (sn_type == PF_SN_LIMIT && rule->max_src_nodes &&
1053 counter_u64_fetch(r_track->src_nodes[sn_type]) >= rule->max_src_nodes) {
1054 counter_u64_add(V_pf_status.lcounters[LCNT_SRCNODES], 1);
1055 reason = PFRES_SRCLIMIT;
1056 goto done;
1057 }
1058
1059 (*sn) = uma_zalloc(V_pf_sources_z, M_NOWAIT | M_ZERO);
1060 if ((*sn) == NULL) {
1061 reason = PFRES_MEMORY;
1062 goto done;
1063 }
1064
1065 for (int i = 0; i < 2; i++) {
1066 (*sn)->bytes[i] = counter_u64_alloc(M_NOWAIT);
1067 (*sn)->packets[i] = counter_u64_alloc(M_NOWAIT);
1068
1069 if ((*sn)->bytes[i] == NULL || (*sn)->packets[i] == NULL) {
1070 pf_free_src_node(*sn);
1071 reason = PFRES_MEMORY;
1072 goto done;
1073 }
1074 }
1075
1076 if (sn_type == PF_SN_LIMIT)
1077 if (! pf_init_threshold(&(*sn)->conn_rate,
1078 rule->max_src_conn_rate.limit,
1079 rule->max_src_conn_rate.seconds)) {
1080 pf_free_src_node(*sn);
1081 reason = PFRES_MEMORY;
1082 goto done;
1083 }
1084
1085 MPASS((*sn)->lock == NULL);
1086 (*sn)->lock = &(*sh)->lock;
1087
1088 (*sn)->af = af;
1089 (*sn)->rule = r_track;
1090 pf_addrcpy(&(*sn)->addr, src, af);
1091 if (raddr != NULL)
1092 pf_addrcpy(&(*sn)->raddr, raddr, af);
1093 (*sn)->rkif = rkif;
1094 LIST_INSERT_HEAD(&(*sh)->nodes, *sn, entry);
1095 (*sn)->creation = time_uptime;
1096 (*sn)->ruletype = rule->action;
1097 (*sn)->type = sn_type;
1098 counter_u64_add(r_track->src_nodes[sn_type], 1);
1099 counter_u64_add(V_pf_status.scounters[SCNT_SRC_NODE_INSERT], 1);
1100 } else {
1101 if (sn_type == PF_SN_LIMIT && rule->max_src_states &&
1102 (*sn)->states >= rule->max_src_states) {
1103 counter_u64_add(V_pf_status.lcounters[LCNT_SRCSTATES],
1104 1);
1105 reason = PFRES_SRCLIMIT;
1106 goto done;
1107 }
1108 }
1109 done:
1110 if (reason == 0)
1111 (*sn)->states++;
1112 else
1113 (*sn) = NULL;
1114
1115 PF_HASHROW_UNLOCK(*sh);
1116 return (reason);
1117 }
1118
1119 void
pf_unlink_src_node(struct pf_ksrc_node * src)1120 pf_unlink_src_node(struct pf_ksrc_node *src)
1121 {
1122 PF_SRC_NODE_LOCK_ASSERT(src);
1123
1124 LIST_REMOVE(src, entry);
1125 if (src->rule)
1126 counter_u64_add(src->rule->src_nodes[src->type], -1);
1127 }
1128
1129 u_int
pf_free_src_nodes(struct pf_ksrc_node_list * head)1130 pf_free_src_nodes(struct pf_ksrc_node_list *head)
1131 {
1132 struct pf_ksrc_node *sn, *tmp;
1133 u_int count = 0;
1134
1135 LIST_FOREACH_SAFE(sn, head, entry, tmp) {
1136 pf_free_src_node(sn);
1137 count++;
1138 }
1139
1140 counter_u64_add(V_pf_status.scounters[SCNT_SRC_NODE_REMOVALS], count);
1141
1142 return (count);
1143 }
1144
1145 void
pf_mtag_initialize(void)1146 pf_mtag_initialize(void)
1147 {
1148
1149 pf_mtag_z = uma_zcreate("pf mtags", sizeof(struct m_tag) +
1150 sizeof(struct pf_mtag), NULL, NULL, pf_mtag_uminit, NULL,
1151 UMA_ALIGN_PTR, 0);
1152 }
1153
1154 /* Per-vnet data storage structures initialization. */
1155 void
pf_initialize(void)1156 pf_initialize(void)
1157 {
1158 struct pf_keyhash *kh;
1159 struct pf_idhash *ih;
1160 struct pf_srchash *sh;
1161 struct pf_udpendpointhash *uh;
1162 u_int i;
1163
1164 if (V_pf_hashsize == 0 || !powerof2(V_pf_hashsize))
1165 V_pf_hashsize = PF_HASHSIZ;
1166 if (V_pf_srchashsize == 0 || !powerof2(V_pf_srchashsize))
1167 V_pf_srchashsize = PF_SRCHASHSIZ;
1168 if (V_pf_udpendpointhashsize == 0 || !powerof2(V_pf_udpendpointhashsize))
1169 V_pf_udpendpointhashsize = PF_UDPENDHASHSIZ;
1170
1171 V_pf_hashseed = arc4random();
1172
1173 /* States and state keys storage. */
1174 V_pf_state_z = uma_zcreate("pf states", sizeof(struct pf_kstate),
1175 NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
1176 V_pf_limits[PF_LIMIT_STATES].zone = V_pf_state_z;
1177 uma_zone_set_max(V_pf_state_z, PFSTATE_HIWAT);
1178 uma_zone_set_warning(V_pf_state_z, "PF states limit reached");
1179
1180 V_pf_state_key_z = uma_zcreate("pf state keys",
1181 sizeof(struct pf_state_key), pf_state_key_ctor, NULL, NULL, NULL,
1182 UMA_ALIGN_PTR, 0);
1183
1184 V_pf_keyhash = mallocarray(V_pf_hashsize, sizeof(struct pf_keyhash),
1185 M_PFHASH, M_NOWAIT | M_ZERO);
1186 V_pf_idhash = mallocarray(V_pf_hashsize, sizeof(struct pf_idhash),
1187 M_PFHASH, M_NOWAIT | M_ZERO);
1188 if (V_pf_keyhash == NULL || V_pf_idhash == NULL) {
1189 printf("pf: Unable to allocate memory for "
1190 "state_hashsize %lu.\n", V_pf_hashsize);
1191
1192 free(V_pf_keyhash, M_PFHASH);
1193 free(V_pf_idhash, M_PFHASH);
1194
1195 V_pf_hashsize = PF_HASHSIZ;
1196 V_pf_keyhash = mallocarray(V_pf_hashsize,
1197 sizeof(struct pf_keyhash), M_PFHASH, M_WAITOK | M_ZERO);
1198 V_pf_idhash = mallocarray(V_pf_hashsize,
1199 sizeof(struct pf_idhash), M_PFHASH, M_WAITOK | M_ZERO);
1200 }
1201
1202 V_pf_hashmask = V_pf_hashsize - 1;
1203 for (i = 0, kh = V_pf_keyhash, ih = V_pf_idhash; i <= V_pf_hashmask;
1204 i++, kh++, ih++) {
1205 mtx_init(&kh->lock, "pf_keyhash", NULL, MTX_DEF | MTX_DUPOK);
1206 mtx_init(&ih->lock, "pf_idhash", NULL, MTX_DEF);
1207 }
1208
1209 /* Source nodes. */
1210 V_pf_sources_z = uma_zcreate("pf source nodes",
1211 sizeof(struct pf_ksrc_node), NULL, NULL, NULL, NULL, UMA_ALIGN_PTR,
1212 0);
1213 V_pf_limits[PF_LIMIT_SRC_NODES].zone = V_pf_sources_z;
1214 uma_zone_set_max(V_pf_sources_z, PFSNODE_HIWAT);
1215 uma_zone_set_warning(V_pf_sources_z, "PF source nodes limit reached");
1216
1217 V_pf_srchash = mallocarray(V_pf_srchashsize,
1218 sizeof(struct pf_srchash), M_PFHASH, M_NOWAIT | M_ZERO);
1219 if (V_pf_srchash == NULL) {
1220 printf("pf: Unable to allocate memory for "
1221 "source_hashsize %lu.\n", V_pf_srchashsize);
1222
1223 V_pf_srchashsize = PF_SRCHASHSIZ;
1224 V_pf_srchash = mallocarray(V_pf_srchashsize,
1225 sizeof(struct pf_srchash), M_PFHASH, M_WAITOK | M_ZERO);
1226 }
1227
1228 V_pf_srchashmask = V_pf_srchashsize - 1;
1229 for (i = 0, sh = V_pf_srchash; i <= V_pf_srchashmask; i++, sh++)
1230 mtx_init(&sh->lock, "pf_srchash", NULL, MTX_DEF);
1231
1232
1233 /* UDP endpoint mappings. */
1234 V_pf_udp_mapping_z = uma_zcreate("pf UDP mappings",
1235 sizeof(struct pf_udp_mapping), NULL, NULL, NULL, NULL,
1236 UMA_ALIGN_PTR, 0);
1237 V_pf_udpendpointhash = mallocarray(V_pf_udpendpointhashsize,
1238 sizeof(struct pf_udpendpointhash), M_PFHASH, M_NOWAIT | M_ZERO);
1239 if (V_pf_udpendpointhash == NULL) {
1240 printf("pf: Unable to allocate memory for "
1241 "udpendpoint_hashsize %lu.\n", V_pf_udpendpointhashsize);
1242
1243 V_pf_udpendpointhashsize = PF_UDPENDHASHSIZ;
1244 V_pf_udpendpointhash = mallocarray(V_pf_udpendpointhashsize,
1245 sizeof(struct pf_udpendpointhash), M_PFHASH, M_WAITOK | M_ZERO);
1246 }
1247
1248 V_pf_udpendpointhashmask = V_pf_udpendpointhashsize - 1;
1249 for (i = 0, uh = V_pf_udpendpointhash;
1250 i <= V_pf_udpendpointhashmask;
1251 i++, uh++) {
1252 mtx_init(&uh->lock, "pf_udpendpointhash", NULL,
1253 MTX_DEF | MTX_DUPOK);
1254 }
1255
1256 /* ALTQ */
1257 TAILQ_INIT(&V_pf_altqs[0]);
1258 TAILQ_INIT(&V_pf_altqs[1]);
1259 TAILQ_INIT(&V_pf_altqs[2]);
1260 TAILQ_INIT(&V_pf_altqs[3]);
1261 TAILQ_INIT(&V_pf_pabuf[0]);
1262 TAILQ_INIT(&V_pf_pabuf[1]);
1263 TAILQ_INIT(&V_pf_pabuf[2]);
1264 V_pf_altqs_active = &V_pf_altqs[0];
1265 V_pf_altq_ifs_active = &V_pf_altqs[1];
1266 V_pf_altqs_inactive = &V_pf_altqs[2];
1267 V_pf_altq_ifs_inactive = &V_pf_altqs[3];
1268
1269 /* Send & overload+flush queues. */
1270 STAILQ_INIT(&V_pf_sendqueue);
1271 SLIST_INIT(&V_pf_overloadqueue);
1272 TASK_INIT(&V_pf_overloadtask, 0, pf_overload_task, curvnet);
1273
1274 /* Unlinked, but may be referenced rules. */
1275 TAILQ_INIT(&V_pf_unlinked_rules);
1276 }
1277
1278 void
pf_mtag_cleanup(void)1279 pf_mtag_cleanup(void)
1280 {
1281
1282 uma_zdestroy(pf_mtag_z);
1283 }
1284
1285 void
pf_cleanup(void)1286 pf_cleanup(void)
1287 {
1288 struct pf_keyhash *kh;
1289 struct pf_idhash *ih;
1290 struct pf_srchash *sh;
1291 struct pf_udpendpointhash *uh;
1292 struct pf_send_entry *pfse, *next;
1293 u_int i;
1294
1295 for (i = 0, kh = V_pf_keyhash, ih = V_pf_idhash;
1296 i <= V_pf_hashmask;
1297 i++, kh++, ih++) {
1298 KASSERT(LIST_EMPTY(&kh->keys), ("%s: key hash not empty",
1299 __func__));
1300 KASSERT(LIST_EMPTY(&ih->states), ("%s: id hash not empty",
1301 __func__));
1302 mtx_destroy(&kh->lock);
1303 mtx_destroy(&ih->lock);
1304 }
1305 free(V_pf_keyhash, M_PFHASH);
1306 free(V_pf_idhash, M_PFHASH);
1307
1308 for (i = 0, sh = V_pf_srchash; i <= V_pf_srchashmask; i++, sh++) {
1309 KASSERT(LIST_EMPTY(&sh->nodes),
1310 ("%s: source node hash not empty", __func__));
1311 mtx_destroy(&sh->lock);
1312 }
1313 free(V_pf_srchash, M_PFHASH);
1314
1315 for (i = 0, uh = V_pf_udpendpointhash;
1316 i <= V_pf_udpendpointhashmask;
1317 i++, uh++) {
1318 KASSERT(LIST_EMPTY(&uh->endpoints),
1319 ("%s: udp endpoint hash not empty", __func__));
1320 mtx_destroy(&uh->lock);
1321 }
1322 free(V_pf_udpendpointhash, M_PFHASH);
1323
1324 STAILQ_FOREACH_SAFE(pfse, &V_pf_sendqueue, pfse_next, next) {
1325 m_freem(pfse->pfse_m);
1326 free(pfse, M_PFTEMP);
1327 }
1328 MPASS(RB_EMPTY(&V_pf_sctp_endpoints));
1329
1330 uma_zdestroy(V_pf_sources_z);
1331 uma_zdestroy(V_pf_state_z);
1332 uma_zdestroy(V_pf_state_key_z);
1333 uma_zdestroy(V_pf_udp_mapping_z);
1334 }
1335
1336 static int
pf_mtag_uminit(void * mem,int size,int how)1337 pf_mtag_uminit(void *mem, int size, int how)
1338 {
1339 struct m_tag *t;
1340
1341 t = (struct m_tag *)mem;
1342 t->m_tag_cookie = MTAG_ABI_COMPAT;
1343 t->m_tag_id = PACKET_TAG_PF;
1344 t->m_tag_len = sizeof(struct pf_mtag);
1345 t->m_tag_free = pf_mtag_free;
1346
1347 return (0);
1348 }
1349
1350 static void
pf_mtag_free(struct m_tag * t)1351 pf_mtag_free(struct m_tag *t)
1352 {
1353
1354 uma_zfree(pf_mtag_z, t);
1355 }
1356
1357 struct pf_mtag *
pf_get_mtag(struct mbuf * m)1358 pf_get_mtag(struct mbuf *m)
1359 {
1360 struct m_tag *mtag;
1361
1362 if ((mtag = m_tag_find(m, PACKET_TAG_PF, NULL)) != NULL)
1363 return ((struct pf_mtag *)(mtag + 1));
1364
1365 mtag = uma_zalloc(pf_mtag_z, M_NOWAIT);
1366 if (mtag == NULL)
1367 return (NULL);
1368 bzero(mtag + 1, sizeof(struct pf_mtag));
1369 m_tag_prepend(m, mtag);
1370
1371 return ((struct pf_mtag *)(mtag + 1));
1372 }
1373
1374 static int
pf_state_key_attach(struct pf_state_key * skw,struct pf_state_key * sks,struct pf_kstate * s)1375 pf_state_key_attach(struct pf_state_key *skw, struct pf_state_key *sks,
1376 struct pf_kstate *s)
1377 {
1378 struct pf_keyhash *khs, *khw, *kh;
1379 struct pf_state_key *sk, *cur;
1380 struct pf_kstate *si, *olds = NULL;
1381 int idx;
1382
1383 NET_EPOCH_ASSERT();
1384 KASSERT(s->refs == 0, ("%s: state not pristine", __func__));
1385 KASSERT(s->key[PF_SK_WIRE] == NULL, ("%s: state has key", __func__));
1386 KASSERT(s->key[PF_SK_STACK] == NULL, ("%s: state has key", __func__));
1387
1388 /*
1389 * We need to lock hash slots of both keys. To avoid deadlock
1390 * we always lock the slot with lower address first. Unlock order
1391 * isn't important.
1392 *
1393 * We also need to lock ID hash slot before dropping key
1394 * locks. On success we return with ID hash slot locked.
1395 */
1396
1397 if (skw == sks) {
1398 khs = khw = &V_pf_keyhash[pf_hashkey(skw)];
1399 PF_HASHROW_LOCK(khs);
1400 } else {
1401 khs = &V_pf_keyhash[pf_hashkey(sks)];
1402 khw = &V_pf_keyhash[pf_hashkey(skw)];
1403 if (khs == khw) {
1404 PF_HASHROW_LOCK(khs);
1405 } else if (khs < khw) {
1406 PF_HASHROW_LOCK(khs);
1407 PF_HASHROW_LOCK(khw);
1408 } else {
1409 PF_HASHROW_LOCK(khw);
1410 PF_HASHROW_LOCK(khs);
1411 }
1412 }
1413
1414 #define KEYS_UNLOCK() do { \
1415 if (khs != khw) { \
1416 PF_HASHROW_UNLOCK(khs); \
1417 PF_HASHROW_UNLOCK(khw); \
1418 } else \
1419 PF_HASHROW_UNLOCK(khs); \
1420 } while (0)
1421
1422 /*
1423 * First run: start with wire key.
1424 */
1425 sk = skw;
1426 kh = khw;
1427 idx = PF_SK_WIRE;
1428
1429 MPASS(s->lock == NULL);
1430 s->lock = &V_pf_idhash[PF_IDHASH(s)].lock;
1431
1432 keyattach:
1433 LIST_FOREACH(cur, &kh->keys, entry)
1434 if (bcmp(cur, sk, sizeof(struct pf_state_key_cmp)) == 0)
1435 break;
1436
1437 if (cur != NULL) {
1438 /* Key exists. Check for same kif, if none, add to key. */
1439 TAILQ_FOREACH(si, &cur->states[idx], key_list[idx]) {
1440 struct pf_idhash *ih = &V_pf_idhash[PF_IDHASH(si)];
1441
1442 PF_HASHROW_LOCK(ih);
1443 if (si->kif == s->kif &&
1444 ((si->key[PF_SK_WIRE]->af == sk->af &&
1445 si->direction == s->direction) ||
1446 (si->key[PF_SK_WIRE]->af !=
1447 si->key[PF_SK_STACK]->af &&
1448 sk->af == si->key[PF_SK_STACK]->af &&
1449 si->direction != s->direction))) {
1450 bool reuse = false;
1451
1452 if (sk->proto == IPPROTO_TCP &&
1453 si->src.state >= TCPS_FIN_WAIT_2 &&
1454 si->dst.state >= TCPS_FIN_WAIT_2)
1455 reuse = true;
1456
1457 if (V_pf_status.debug >= PF_DEBUG_MISC) {
1458 printf("pf: %s key attach "
1459 "%s on %s: ",
1460 (idx == PF_SK_WIRE) ?
1461 "wire" : "stack",
1462 reuse ? "reuse" : "failed",
1463 s->kif->pfik_name);
1464 pf_print_state_parts(s,
1465 (idx == PF_SK_WIRE) ?
1466 sk : NULL,
1467 (idx == PF_SK_STACK) ?
1468 sk : NULL);
1469 printf(", existing: ");
1470 pf_print_state_parts(si,
1471 (idx == PF_SK_WIRE) ?
1472 sk : NULL,
1473 (idx == PF_SK_STACK) ?
1474 sk : NULL);
1475 printf("\n");
1476 }
1477
1478 if (reuse) {
1479 /*
1480 * New state matches an old >FIN_WAIT_2
1481 * state. We can't drop key hash locks,
1482 * thus we can't unlink it properly.
1483 *
1484 * As a workaround we drop it into
1485 * TCPS_CLOSED state, schedule purge
1486 * ASAP and push it into the very end
1487 * of the slot TAILQ, so that it won't
1488 * conflict with our new state.
1489 */
1490 pf_set_protostate(si, PF_PEER_BOTH,
1491 TCPS_CLOSED);
1492 si->timeout = PFTM_PURGE;
1493 olds = si;
1494 } else {
1495 s->timeout = PFTM_UNLINKED;
1496 if (idx == PF_SK_STACK)
1497 /*
1498 * Remove the wire key from
1499 * the hash. Other threads
1500 * can't be referencing it
1501 * because we still hold the
1502 * hash lock.
1503 */
1504 pf_state_key_detach(s,
1505 PF_SK_WIRE);
1506 PF_HASHROW_UNLOCK(ih);
1507 KEYS_UNLOCK();
1508 if (idx == PF_SK_WIRE)
1509 /*
1510 * We've not inserted either key.
1511 * Free both.
1512 */
1513 uma_zfree(V_pf_state_key_z, skw);
1514 if (skw != sks)
1515 uma_zfree(
1516 V_pf_state_key_z,
1517 sks);
1518 return (EEXIST); /* collision! */
1519 }
1520 }
1521 PF_HASHROW_UNLOCK(ih);
1522 }
1523 uma_zfree(V_pf_state_key_z, sk);
1524 s->key[idx] = cur;
1525 } else {
1526 LIST_INSERT_HEAD(&kh->keys, sk, entry);
1527 s->key[idx] = sk;
1528 }
1529
1530 stateattach:
1531 /* List is sorted, if-bound states before floating. */
1532 if (s->kif == V_pfi_all)
1533 TAILQ_INSERT_TAIL(&s->key[idx]->states[idx], s, key_list[idx]);
1534 else
1535 TAILQ_INSERT_HEAD(&s->key[idx]->states[idx], s, key_list[idx]);
1536
1537 if (olds) {
1538 TAILQ_REMOVE(&s->key[idx]->states[idx], olds, key_list[idx]);
1539 TAILQ_INSERT_TAIL(&s->key[idx]->states[idx], olds,
1540 key_list[idx]);
1541 olds = NULL;
1542 }
1543
1544 /*
1545 * Attach done. See how should we (or should not?)
1546 * attach a second key.
1547 */
1548 if (sks == skw) {
1549 s->key[PF_SK_STACK] = s->key[PF_SK_WIRE];
1550 idx = PF_SK_STACK;
1551 sks = NULL;
1552 goto stateattach;
1553 } else if (sks != NULL) {
1554 /*
1555 * Continue attaching with stack key.
1556 */
1557 sk = sks;
1558 kh = khs;
1559 idx = PF_SK_STACK;
1560 sks = NULL;
1561 goto keyattach;
1562 }
1563
1564 PF_STATE_LOCK(s);
1565 KEYS_UNLOCK();
1566
1567 KASSERT(s->key[PF_SK_WIRE] != NULL && s->key[PF_SK_STACK] != NULL,
1568 ("%s failure", __func__));
1569
1570 return (0);
1571 #undef KEYS_UNLOCK
1572 }
1573
1574 static void
pf_detach_state(struct pf_kstate * s)1575 pf_detach_state(struct pf_kstate *s)
1576 {
1577 struct pf_state_key *sks = s->key[PF_SK_STACK];
1578 struct pf_keyhash *kh;
1579
1580 NET_EPOCH_ASSERT();
1581 MPASS(s->timeout >= PFTM_MAX);
1582
1583 pf_sctp_multihome_detach_addr(s);
1584
1585 if ((s->state_flags & PFSTATE_PFLOW) && V_pflow_export_state_ptr)
1586 V_pflow_export_state_ptr(s);
1587
1588 if (sks != NULL) {
1589 kh = &V_pf_keyhash[pf_hashkey(sks)];
1590 PF_HASHROW_LOCK(kh);
1591 if (s->key[PF_SK_STACK] != NULL)
1592 pf_state_key_detach(s, PF_SK_STACK);
1593 /*
1594 * If both point to same key, then we are done.
1595 */
1596 if (sks == s->key[PF_SK_WIRE]) {
1597 pf_state_key_detach(s, PF_SK_WIRE);
1598 PF_HASHROW_UNLOCK(kh);
1599 return;
1600 }
1601 PF_HASHROW_UNLOCK(kh);
1602 }
1603
1604 if (s->key[PF_SK_WIRE] != NULL) {
1605 kh = &V_pf_keyhash[pf_hashkey(s->key[PF_SK_WIRE])];
1606 PF_HASHROW_LOCK(kh);
1607 if (s->key[PF_SK_WIRE] != NULL)
1608 pf_state_key_detach(s, PF_SK_WIRE);
1609 PF_HASHROW_UNLOCK(kh);
1610 }
1611 }
1612
1613 static void
pf_state_key_detach(struct pf_kstate * s,int idx)1614 pf_state_key_detach(struct pf_kstate *s, int idx)
1615 {
1616 struct pf_state_key *sk = s->key[idx];
1617 #ifdef INVARIANTS
1618 struct pf_keyhash *kh = &V_pf_keyhash[pf_hashkey(sk)];
1619
1620 PF_HASHROW_ASSERT(kh);
1621 #endif /* INVARIANTS */
1622 TAILQ_REMOVE(&sk->states[idx], s, key_list[idx]);
1623 s->key[idx] = NULL;
1624
1625 if (TAILQ_EMPTY(&sk->states[0]) && TAILQ_EMPTY(&sk->states[1])) {
1626 LIST_REMOVE(sk, entry);
1627 uma_zfree(V_pf_state_key_z, sk);
1628 }
1629 }
1630
1631 static int
pf_state_key_ctor(void * mem,int size,void * arg,int flags)1632 pf_state_key_ctor(void *mem, int size, void *arg, int flags)
1633 {
1634 struct pf_state_key *sk = mem;
1635
1636 bzero(sk, sizeof(struct pf_state_key_cmp));
1637 TAILQ_INIT(&sk->states[PF_SK_WIRE]);
1638 TAILQ_INIT(&sk->states[PF_SK_STACK]);
1639
1640 return (0);
1641 }
1642
1643 static int
pf_state_key_addr_setup(struct pf_pdesc * pd,struct pf_state_key_cmp * key,int multi)1644 pf_state_key_addr_setup(struct pf_pdesc *pd,
1645 struct pf_state_key_cmp *key, int multi)
1646 {
1647 struct pf_addr *saddr = pd->src;
1648 struct pf_addr *daddr = pd->dst;
1649 #ifdef INET6
1650 struct nd_neighbor_solicit nd;
1651 struct pf_addr *target;
1652 u_short action, reason;
1653
1654 if (pd->af == AF_INET || pd->proto != IPPROTO_ICMPV6)
1655 goto copy;
1656
1657 switch (pd->hdr.icmp6.icmp6_type) {
1658 case ND_NEIGHBOR_SOLICIT:
1659 if (multi)
1660 return (-1);
1661 if (!pf_pull_hdr(pd->m, pd->off, &nd, sizeof(nd), &action, &reason, pd->af))
1662 return (-1);
1663 target = (struct pf_addr *)&nd.nd_ns_target;
1664 daddr = target;
1665 break;
1666 case ND_NEIGHBOR_ADVERT:
1667 if (multi)
1668 return (-1);
1669 if (!pf_pull_hdr(pd->m, pd->off, &nd, sizeof(nd), &action, &reason, pd->af))
1670 return (-1);
1671 target = (struct pf_addr *)&nd.nd_ns_target;
1672 saddr = target;
1673 if (IN6_IS_ADDR_MULTICAST(&pd->dst->v6)) {
1674 key->addr[pd->didx].addr32[0] = 0;
1675 key->addr[pd->didx].addr32[1] = 0;
1676 key->addr[pd->didx].addr32[2] = 0;
1677 key->addr[pd->didx].addr32[3] = 0;
1678 daddr = NULL; /* overwritten */
1679 }
1680 break;
1681 default:
1682 if (multi) {
1683 key->addr[pd->sidx].addr32[0] = IPV6_ADDR_INT32_MLL;
1684 key->addr[pd->sidx].addr32[1] = 0;
1685 key->addr[pd->sidx].addr32[2] = 0;
1686 key->addr[pd->sidx].addr32[3] = IPV6_ADDR_INT32_ONE;
1687 saddr = NULL; /* overwritten */
1688 }
1689 }
1690 copy:
1691 #endif /* INET6 */
1692 if (saddr)
1693 pf_addrcpy(&key->addr[pd->sidx], saddr, pd->af);
1694 if (daddr)
1695 pf_addrcpy(&key->addr[pd->didx], daddr, pd->af);
1696
1697 return (0);
1698 }
1699
1700 int
pf_state_key_setup(struct pf_pdesc * pd,u_int16_t sport,u_int16_t dport,struct pf_state_key ** sk,struct pf_state_key ** nk)1701 pf_state_key_setup(struct pf_pdesc *pd, u_int16_t sport, u_int16_t dport,
1702 struct pf_state_key **sk, struct pf_state_key **nk)
1703 {
1704 *sk = uma_zalloc(V_pf_state_key_z, M_NOWAIT);
1705 if (*sk == NULL)
1706 return (ENOMEM);
1707
1708 if (pf_state_key_addr_setup(pd, (struct pf_state_key_cmp *)*sk,
1709 0)) {
1710 uma_zfree(V_pf_state_key_z, *sk);
1711 *sk = NULL;
1712 return (ENOMEM);
1713 }
1714
1715 (*sk)->port[pd->sidx] = sport;
1716 (*sk)->port[pd->didx] = dport;
1717 (*sk)->proto = pd->proto;
1718 (*sk)->af = pd->af;
1719
1720 *nk = pf_state_key_clone(*sk);
1721 if (*nk == NULL) {
1722 uma_zfree(V_pf_state_key_z, *sk);
1723 *sk = NULL;
1724 return (ENOMEM);
1725 }
1726
1727 if (pd->af != pd->naf) {
1728 (*sk)->port[pd->sidx] = pd->osport;
1729 (*sk)->port[pd->didx] = pd->odport;
1730
1731 (*nk)->af = pd->naf;
1732
1733 /*
1734 * We're overwriting an address here, so potentially there's bits of an IPv6
1735 * address left in here. Clear that out first.
1736 */
1737 bzero(&(*nk)->addr[0], sizeof((*nk)->addr[0]));
1738 bzero(&(*nk)->addr[1], sizeof((*nk)->addr[1]));
1739 if (pd->dir == PF_IN) {
1740 pf_addrcpy(&(*nk)->addr[pd->didx], &pd->nsaddr,
1741 pd->naf);
1742 pf_addrcpy(&(*nk)->addr[pd->sidx], &pd->ndaddr,
1743 pd->naf);
1744 (*nk)->port[pd->didx] = pd->nsport;
1745 (*nk)->port[pd->sidx] = pd->ndport;
1746 } else {
1747 pf_addrcpy(&(*nk)->addr[pd->sidx], &pd->nsaddr,
1748 pd->naf);
1749 pf_addrcpy(&(*nk)->addr[pd->didx], &pd->ndaddr,
1750 pd->naf);
1751 (*nk)->port[pd->sidx] = pd->nsport;
1752 (*nk)->port[pd->didx] = pd->ndport;
1753 }
1754
1755 switch (pd->proto) {
1756 case IPPROTO_ICMP:
1757 (*nk)->proto = IPPROTO_ICMPV6;
1758 break;
1759 case IPPROTO_ICMPV6:
1760 (*nk)->proto = IPPROTO_ICMP;
1761 break;
1762 default:
1763 (*nk)->proto = pd->proto;
1764 }
1765 }
1766
1767 return (0);
1768 }
1769
1770 struct pf_state_key *
pf_state_key_clone(const struct pf_state_key * orig)1771 pf_state_key_clone(const struct pf_state_key *orig)
1772 {
1773 struct pf_state_key *sk;
1774
1775 sk = uma_zalloc(V_pf_state_key_z, M_NOWAIT);
1776 if (sk == NULL)
1777 return (NULL);
1778
1779 bcopy(orig, sk, sizeof(struct pf_state_key_cmp));
1780
1781 return (sk);
1782 }
1783
1784 int
pf_state_insert(struct pfi_kkif * kif,struct pfi_kkif * orig_kif,struct pf_state_key * skw,struct pf_state_key * sks,struct pf_kstate * s)1785 pf_state_insert(struct pfi_kkif *kif, struct pfi_kkif *orig_kif,
1786 struct pf_state_key *skw, struct pf_state_key *sks, struct pf_kstate *s)
1787 {
1788 struct pf_idhash *ih;
1789 struct pf_kstate *cur;
1790 int error;
1791
1792 NET_EPOCH_ASSERT();
1793
1794 KASSERT(TAILQ_EMPTY(&sks->states[0]) && TAILQ_EMPTY(&sks->states[1]),
1795 ("%s: sks not pristine", __func__));
1796 KASSERT(TAILQ_EMPTY(&skw->states[0]) && TAILQ_EMPTY(&skw->states[1]),
1797 ("%s: skw not pristine", __func__));
1798 KASSERT(s->refs == 0, ("%s: state not pristine", __func__));
1799
1800 s->kif = kif;
1801 s->orig_kif = orig_kif;
1802
1803 if (s->id == 0 && s->creatorid == 0) {
1804 s->id = alloc_unr64(&V_pf_stateid);
1805 s->id = htobe64(s->id);
1806 s->creatorid = V_pf_status.hostid;
1807 }
1808
1809 /* Returns with ID locked on success. */
1810 if ((error = pf_state_key_attach(skw, sks, s)) != 0)
1811 return (error);
1812 skw = sks = NULL;
1813
1814 ih = &V_pf_idhash[PF_IDHASH(s)];
1815 PF_HASHROW_ASSERT(ih);
1816 LIST_FOREACH(cur, &ih->states, entry)
1817 if (cur->id == s->id && cur->creatorid == s->creatorid)
1818 break;
1819
1820 if (cur != NULL) {
1821 s->timeout = PFTM_UNLINKED;
1822 PF_HASHROW_UNLOCK(ih);
1823 if (V_pf_status.debug >= PF_DEBUG_MISC) {
1824 printf("pf: state ID collision: "
1825 "id: %016llx creatorid: %08x\n",
1826 (unsigned long long)be64toh(s->id),
1827 ntohl(s->creatorid));
1828 }
1829 pf_detach_state(s);
1830 return (EEXIST);
1831 }
1832 LIST_INSERT_HEAD(&ih->states, s, entry);
1833 /* One for keys, one for ID hash. */
1834 refcount_init(&s->refs, 2);
1835
1836 pf_counter_u64_add(&V_pf_status.fcounters[FCNT_STATE_INSERT], 1);
1837 if (V_pfsync_insert_state_ptr != NULL)
1838 V_pfsync_insert_state_ptr(s);
1839
1840 /* Returns locked. */
1841 return (0);
1842 }
1843
1844 /*
1845 * Find state by ID: returns with locked row on success.
1846 */
1847 struct pf_kstate *
pf_find_state_byid(uint64_t id,uint32_t creatorid)1848 pf_find_state_byid(uint64_t id, uint32_t creatorid)
1849 {
1850 struct pf_idhash *ih;
1851 struct pf_kstate *s;
1852
1853 pf_counter_u64_add(&V_pf_status.fcounters[FCNT_STATE_SEARCH], 1);
1854
1855 ih = &V_pf_idhash[PF_IDHASHID(id)];
1856
1857 PF_HASHROW_LOCK(ih);
1858 LIST_FOREACH(s, &ih->states, entry)
1859 if (s->id == id && s->creatorid == creatorid)
1860 break;
1861
1862 if (s == NULL)
1863 PF_HASHROW_UNLOCK(ih);
1864
1865 return (s);
1866 }
1867
1868 /*
1869 * Find state by key.
1870 * Returns with ID hash slot locked on success.
1871 */
1872 static int
pf_find_state(struct pf_pdesc * pd,const struct pf_state_key_cmp * key,struct pf_kstate ** state)1873 pf_find_state(struct pf_pdesc *pd, const struct pf_state_key_cmp *key,
1874 struct pf_kstate **state)
1875 {
1876 struct pf_keyhash *kh;
1877 struct pf_state_key *sk;
1878 struct pf_kstate *s;
1879 int idx;
1880
1881 *state = NULL;
1882
1883 pf_counter_u64_add(&V_pf_status.fcounters[FCNT_STATE_SEARCH], 1);
1884
1885 kh = &V_pf_keyhash[pf_hashkey((const struct pf_state_key *)key)];
1886
1887 PF_HASHROW_LOCK(kh);
1888 LIST_FOREACH(sk, &kh->keys, entry)
1889 if (bcmp(sk, key, sizeof(struct pf_state_key_cmp)) == 0)
1890 break;
1891 if (sk == NULL) {
1892 PF_HASHROW_UNLOCK(kh);
1893 return (PF_DROP);
1894 }
1895
1896 idx = (pd->dir == PF_IN ? PF_SK_WIRE : PF_SK_STACK);
1897
1898 /* List is sorted, if-bound states before floating ones. */
1899 TAILQ_FOREACH(s, &sk->states[idx], key_list[idx])
1900 if (s->kif == V_pfi_all || s->kif == pd->kif ||
1901 s->orig_kif == pd->kif) {
1902 PF_STATE_LOCK(s);
1903 PF_HASHROW_UNLOCK(kh);
1904 if (__predict_false(s->timeout >= PFTM_MAX)) {
1905 /*
1906 * State is either being processed by
1907 * pf_remove_state() in an other thread, or
1908 * is scheduled for immediate expiry.
1909 */
1910 PF_STATE_UNLOCK(s);
1911 SDT_PROBE5(pf, ip, state, lookup, pd->kif,
1912 key, (pd->dir), pd, *state);
1913 return (PF_DROP);
1914 }
1915 goto out;
1916 }
1917
1918 /* Look through the other list, in case of AF-TO */
1919 idx = idx == PF_SK_WIRE ? PF_SK_STACK : PF_SK_WIRE;
1920 TAILQ_FOREACH(s, &sk->states[idx], key_list[idx]) {
1921 if (s->key[PF_SK_WIRE]->af == s->key[PF_SK_STACK]->af)
1922 continue;
1923 if (s->kif == V_pfi_all || s->kif == pd->kif ||
1924 s->orig_kif == pd->kif) {
1925 PF_STATE_LOCK(s);
1926 PF_HASHROW_UNLOCK(kh);
1927 if (__predict_false(s->timeout >= PFTM_MAX)) {
1928 /*
1929 * State is either being processed by
1930 * pf_remove_state() in an other thread, or
1931 * is scheduled for immediate expiry.
1932 */
1933 PF_STATE_UNLOCK(s);
1934 SDT_PROBE5(pf, ip, state, lookup, pd->kif,
1935 key, (pd->dir), pd, NULL);
1936 return (PF_DROP);
1937 }
1938 goto out;
1939 }
1940 }
1941
1942 PF_HASHROW_UNLOCK(kh);
1943
1944 out:
1945 SDT_PROBE5(pf, ip, state, lookup, pd->kif, key, (pd->dir), pd, *state);
1946
1947 if (s == NULL || s->timeout == PFTM_PURGE) {
1948 if (s)
1949 PF_STATE_UNLOCK(s);
1950 return (PF_DROP);
1951 }
1952
1953 if ((s)->rule->pktrate.limit && pd->dir == (s)->direction) {
1954 if (pf_check_threshold(&(s)->rule->pktrate)) {
1955 PF_STATE_UNLOCK(s);
1956 return (PF_DROP);
1957 }
1958 }
1959 if (PACKET_LOOPED(pd)) {
1960 PF_STATE_UNLOCK(s);
1961 return (PF_PASS);
1962 }
1963
1964 *state = s;
1965
1966 return (PF_MATCH);
1967 }
1968
1969 /*
1970 * Returns with ID hash slot locked on success.
1971 */
1972 struct pf_kstate *
pf_find_state_all(const struct pf_state_key_cmp * key,u_int dir,int * more)1973 pf_find_state_all(const struct pf_state_key_cmp *key, u_int dir, int *more)
1974 {
1975 struct pf_keyhash *kh;
1976 struct pf_state_key *sk;
1977 struct pf_kstate *s, *ret = NULL;
1978 int idx, inout = 0;
1979
1980 if (more != NULL)
1981 *more = 0;
1982
1983 pf_counter_u64_add(&V_pf_status.fcounters[FCNT_STATE_SEARCH], 1);
1984
1985 kh = &V_pf_keyhash[pf_hashkey((const struct pf_state_key *)key)];
1986
1987 PF_HASHROW_LOCK(kh);
1988 LIST_FOREACH(sk, &kh->keys, entry)
1989 if (bcmp(sk, key, sizeof(struct pf_state_key_cmp)) == 0)
1990 break;
1991 if (sk == NULL) {
1992 PF_HASHROW_UNLOCK(kh);
1993 return (NULL);
1994 }
1995 switch (dir) {
1996 case PF_IN:
1997 idx = PF_SK_WIRE;
1998 break;
1999 case PF_OUT:
2000 idx = PF_SK_STACK;
2001 break;
2002 case PF_INOUT:
2003 idx = PF_SK_WIRE;
2004 inout = 1;
2005 break;
2006 default:
2007 panic("%s: dir %u", __func__, dir);
2008 }
2009 second_run:
2010 TAILQ_FOREACH(s, &sk->states[idx], key_list[idx]) {
2011 if (more == NULL) {
2012 PF_STATE_LOCK(s);
2013 PF_HASHROW_UNLOCK(kh);
2014 return (s);
2015 }
2016
2017 if (ret)
2018 (*more)++;
2019 else {
2020 ret = s;
2021 PF_STATE_LOCK(s);
2022 }
2023 }
2024 if (inout == 1) {
2025 inout = 0;
2026 idx = PF_SK_STACK;
2027 goto second_run;
2028 }
2029 PF_HASHROW_UNLOCK(kh);
2030
2031 return (ret);
2032 }
2033
2034 /*
2035 * FIXME
2036 * This routine is inefficient -- locks the state only to unlock immediately on
2037 * return.
2038 * It is racy -- after the state is unlocked nothing stops other threads from
2039 * removing it.
2040 */
2041 bool
pf_find_state_all_exists(const struct pf_state_key_cmp * key,u_int dir)2042 pf_find_state_all_exists(const struct pf_state_key_cmp *key, u_int dir)
2043 {
2044 struct pf_kstate *s;
2045
2046 s = pf_find_state_all(key, dir, NULL);
2047 if (s != NULL) {
2048 PF_STATE_UNLOCK(s);
2049 return (true);
2050 }
2051 return (false);
2052 }
2053
2054 struct pf_udp_mapping *
pf_udp_mapping_create(sa_family_t af,struct pf_addr * src_addr,uint16_t src_port,struct pf_addr * nat_addr,uint16_t nat_port)2055 pf_udp_mapping_create(sa_family_t af, struct pf_addr *src_addr, uint16_t src_port,
2056 struct pf_addr *nat_addr, uint16_t nat_port)
2057 {
2058 struct pf_udp_mapping *mapping;
2059
2060 mapping = uma_zalloc(V_pf_udp_mapping_z, M_NOWAIT | M_ZERO);
2061 if (mapping == NULL)
2062 return (NULL);
2063 pf_addrcpy(&mapping->endpoints[0].addr, src_addr, af);
2064 mapping->endpoints[0].port = src_port;
2065 mapping->endpoints[0].af = af;
2066 mapping->endpoints[0].mapping = mapping;
2067 pf_addrcpy(&mapping->endpoints[1].addr, nat_addr, af);
2068 mapping->endpoints[1].port = nat_port;
2069 mapping->endpoints[1].af = af;
2070 mapping->endpoints[1].mapping = mapping;
2071 refcount_init(&mapping->refs, 1);
2072 return (mapping);
2073 }
2074
2075 int
pf_udp_mapping_insert(struct pf_udp_mapping * mapping)2076 pf_udp_mapping_insert(struct pf_udp_mapping *mapping)
2077 {
2078 struct pf_udpendpointhash *h0, *h1;
2079 struct pf_udp_endpoint *endpoint;
2080 int ret = EEXIST;
2081
2082 h0 = &V_pf_udpendpointhash[pf_hashudpendpoint(&mapping->endpoints[0])];
2083 h1 = &V_pf_udpendpointhash[pf_hashudpendpoint(&mapping->endpoints[1])];
2084 if (h0 == h1) {
2085 PF_HASHROW_LOCK(h0);
2086 } else if (h0 < h1) {
2087 PF_HASHROW_LOCK(h0);
2088 PF_HASHROW_LOCK(h1);
2089 } else {
2090 PF_HASHROW_LOCK(h1);
2091 PF_HASHROW_LOCK(h0);
2092 }
2093
2094 LIST_FOREACH(endpoint, &h0->endpoints, entry) {
2095 if (bcmp(endpoint, &mapping->endpoints[0],
2096 sizeof(struct pf_udp_endpoint_cmp)) == 0)
2097 break;
2098 }
2099 if (endpoint != NULL)
2100 goto cleanup;
2101 LIST_FOREACH(endpoint, &h1->endpoints, entry) {
2102 if (bcmp(endpoint, &mapping->endpoints[1],
2103 sizeof(struct pf_udp_endpoint_cmp)) == 0)
2104 break;
2105 }
2106 if (endpoint != NULL)
2107 goto cleanup;
2108 LIST_INSERT_HEAD(&h0->endpoints, &mapping->endpoints[0], entry);
2109 LIST_INSERT_HEAD(&h1->endpoints, &mapping->endpoints[1], entry);
2110 ret = 0;
2111
2112 cleanup:
2113 if (h0 != h1) {
2114 PF_HASHROW_UNLOCK(h0);
2115 PF_HASHROW_UNLOCK(h1);
2116 } else {
2117 PF_HASHROW_UNLOCK(h0);
2118 }
2119 return (ret);
2120 }
2121
2122 void
pf_udp_mapping_release(struct pf_udp_mapping * mapping)2123 pf_udp_mapping_release(struct pf_udp_mapping *mapping)
2124 {
2125 /* refcount is synchronized on the source endpoint's row lock */
2126 struct pf_udpendpointhash *h0, *h1;
2127
2128 if (mapping == NULL)
2129 return;
2130
2131 h0 = &V_pf_udpendpointhash[pf_hashudpendpoint(&mapping->endpoints[0])];
2132 PF_HASHROW_LOCK(h0);
2133 if (refcount_release(&mapping->refs)) {
2134 LIST_REMOVE(&mapping->endpoints[0], entry);
2135 PF_HASHROW_UNLOCK(h0);
2136 h1 = &V_pf_udpendpointhash[pf_hashudpendpoint(&mapping->endpoints[1])];
2137 PF_HASHROW_LOCK(h1);
2138 LIST_REMOVE(&mapping->endpoints[1], entry);
2139 PF_HASHROW_UNLOCK(h1);
2140
2141 uma_zfree(V_pf_udp_mapping_z, mapping);
2142 } else {
2143 PF_HASHROW_UNLOCK(h0);
2144 }
2145 }
2146
2147
2148 struct pf_udp_mapping *
pf_udp_mapping_find(struct pf_udp_endpoint_cmp * key)2149 pf_udp_mapping_find(struct pf_udp_endpoint_cmp *key)
2150 {
2151 struct pf_udpendpointhash *uh;
2152 struct pf_udp_endpoint *endpoint;
2153
2154 uh = &V_pf_udpendpointhash[pf_hashudpendpoint((struct pf_udp_endpoint*)key)];
2155
2156 PF_HASHROW_LOCK(uh);
2157 LIST_FOREACH(endpoint, &uh->endpoints, entry) {
2158 if (bcmp(endpoint, key, sizeof(struct pf_udp_endpoint_cmp)) == 0 &&
2159 bcmp(endpoint, &endpoint->mapping->endpoints[0],
2160 sizeof(struct pf_udp_endpoint_cmp)) == 0)
2161 break;
2162 }
2163 if (endpoint == NULL) {
2164 PF_HASHROW_UNLOCK(uh);
2165 return (NULL);
2166 }
2167 refcount_acquire(&endpoint->mapping->refs);
2168 PF_HASHROW_UNLOCK(uh);
2169 return (endpoint->mapping);
2170 }
2171 /* END state table stuff */
2172
2173 static void
pf_send(struct pf_send_entry * pfse)2174 pf_send(struct pf_send_entry *pfse)
2175 {
2176
2177 PF_SENDQ_LOCK();
2178 STAILQ_INSERT_TAIL(&V_pf_sendqueue, pfse, pfse_next);
2179 PF_SENDQ_UNLOCK();
2180 swi_sched(V_pf_swi_cookie, 0);
2181 }
2182
2183 static bool
pf_isforlocal(struct mbuf * m,int af)2184 pf_isforlocal(struct mbuf *m, int af)
2185 {
2186 switch (af) {
2187 #ifdef INET
2188 case AF_INET: {
2189 struct ip *ip = mtod(m, struct ip *);
2190
2191 return (in_localip(ip->ip_dst));
2192 }
2193 #endif /* INET */
2194 #ifdef INET6
2195 case AF_INET6: {
2196 struct ip6_hdr *ip6;
2197 struct in6_ifaddr *ia;
2198 ip6 = mtod(m, struct ip6_hdr *);
2199 ia = in6ifa_ifwithaddr(&ip6->ip6_dst, 0 /* XXX */, false);
2200 if (ia == NULL)
2201 return (false);
2202 return (! (ia->ia6_flags & IN6_IFF_NOTREADY));
2203 }
2204 #endif /* INET6 */
2205 default:
2206 unhandled_af(af);
2207 }
2208
2209 return (false);
2210 }
2211
2212 int
pf_icmp_mapping(struct pf_pdesc * pd,u_int8_t type,int * icmp_dir,u_int16_t * virtual_id,u_int16_t * virtual_type)2213 pf_icmp_mapping(struct pf_pdesc *pd, u_int8_t type,
2214 int *icmp_dir, u_int16_t *virtual_id, u_int16_t *virtual_type)
2215 {
2216 /*
2217 * ICMP types marked with PF_OUT are typically responses to
2218 * PF_IN, and will match states in the opposite direction.
2219 * PF_IN ICMP types need to match a state with that type.
2220 */
2221 *icmp_dir = PF_OUT;
2222
2223 /* Queries (and responses) */
2224 switch (pd->af) {
2225 #ifdef INET
2226 case AF_INET:
2227 switch (type) {
2228 case ICMP_ECHO:
2229 *icmp_dir = PF_IN;
2230 /* FALLTHROUGH */
2231 case ICMP_ECHOREPLY:
2232 *virtual_type = ICMP_ECHO;
2233 *virtual_id = pd->hdr.icmp.icmp_id;
2234 break;
2235
2236 case ICMP_TSTAMP:
2237 *icmp_dir = PF_IN;
2238 /* FALLTHROUGH */
2239 case ICMP_TSTAMPREPLY:
2240 *virtual_type = ICMP_TSTAMP;
2241 *virtual_id = pd->hdr.icmp.icmp_id;
2242 break;
2243
2244 case ICMP_IREQ:
2245 *icmp_dir = PF_IN;
2246 /* FALLTHROUGH */
2247 case ICMP_IREQREPLY:
2248 *virtual_type = ICMP_IREQ;
2249 *virtual_id = pd->hdr.icmp.icmp_id;
2250 break;
2251
2252 case ICMP_MASKREQ:
2253 *icmp_dir = PF_IN;
2254 /* FALLTHROUGH */
2255 case ICMP_MASKREPLY:
2256 *virtual_type = ICMP_MASKREQ;
2257 *virtual_id = pd->hdr.icmp.icmp_id;
2258 break;
2259
2260 case ICMP_IPV6_WHEREAREYOU:
2261 *icmp_dir = PF_IN;
2262 /* FALLTHROUGH */
2263 case ICMP_IPV6_IAMHERE:
2264 *virtual_type = ICMP_IPV6_WHEREAREYOU;
2265 *virtual_id = 0; /* Nothing sane to match on! */
2266 break;
2267
2268 case ICMP_MOBILE_REGREQUEST:
2269 *icmp_dir = PF_IN;
2270 /* FALLTHROUGH */
2271 case ICMP_MOBILE_REGREPLY:
2272 *virtual_type = ICMP_MOBILE_REGREQUEST;
2273 *virtual_id = 0; /* Nothing sane to match on! */
2274 break;
2275
2276 case ICMP_ROUTERSOLICIT:
2277 *icmp_dir = PF_IN;
2278 /* FALLTHROUGH */
2279 case ICMP_ROUTERADVERT:
2280 *virtual_type = ICMP_ROUTERSOLICIT;
2281 *virtual_id = 0; /* Nothing sane to match on! */
2282 break;
2283
2284 /* These ICMP types map to other connections */
2285 case ICMP_UNREACH:
2286 case ICMP_SOURCEQUENCH:
2287 case ICMP_REDIRECT:
2288 case ICMP_TIMXCEED:
2289 case ICMP_PARAMPROB:
2290 /* These will not be used, but set them anyway */
2291 *icmp_dir = PF_IN;
2292 *virtual_type = type;
2293 *virtual_id = 0;
2294 *virtual_type = htons(*virtual_type);
2295 return (1); /* These types match to another state */
2296
2297 /*
2298 * All remaining ICMP types get their own states,
2299 * and will only match in one direction.
2300 */
2301 default:
2302 *icmp_dir = PF_IN;
2303 *virtual_type = type;
2304 *virtual_id = 0;
2305 break;
2306 }
2307 break;
2308 #endif /* INET */
2309 #ifdef INET6
2310 case AF_INET6:
2311 switch (type) {
2312 case ICMP6_ECHO_REQUEST:
2313 *icmp_dir = PF_IN;
2314 /* FALLTHROUGH */
2315 case ICMP6_ECHO_REPLY:
2316 *virtual_type = ICMP6_ECHO_REQUEST;
2317 *virtual_id = pd->hdr.icmp6.icmp6_id;
2318 break;
2319
2320 case MLD_LISTENER_QUERY:
2321 case MLD_LISTENER_REPORT: {
2322 /*
2323 * Listener Report can be sent by clients
2324 * without an associated Listener Query.
2325 * In addition to that, when Report is sent as a
2326 * reply to a Query its source and destination
2327 * address are different.
2328 */
2329 *icmp_dir = PF_IN;
2330 *virtual_type = MLD_LISTENER_QUERY;
2331 *virtual_id = 0;
2332 break;
2333 }
2334 case MLD_MTRACE:
2335 *icmp_dir = PF_IN;
2336 /* FALLTHROUGH */
2337 case MLD_MTRACE_RESP:
2338 *virtual_type = MLD_MTRACE;
2339 *virtual_id = 0; /* Nothing sane to match on! */
2340 break;
2341
2342 case ND_NEIGHBOR_SOLICIT:
2343 *icmp_dir = PF_IN;
2344 /* FALLTHROUGH */
2345 case ND_NEIGHBOR_ADVERT: {
2346 *virtual_type = ND_NEIGHBOR_SOLICIT;
2347 *virtual_id = 0;
2348 break;
2349 }
2350
2351 /*
2352 * These ICMP types map to other connections.
2353 * ND_REDIRECT can't be in this list because the triggering
2354 * packet header is optional.
2355 */
2356 case ICMP6_DST_UNREACH:
2357 case ICMP6_PACKET_TOO_BIG:
2358 case ICMP6_TIME_EXCEEDED:
2359 case ICMP6_PARAM_PROB:
2360 /* These will not be used, but set them anyway */
2361 *icmp_dir = PF_IN;
2362 *virtual_type = type;
2363 *virtual_id = 0;
2364 *virtual_type = htons(*virtual_type);
2365 return (1); /* These types match to another state */
2366 /*
2367 * All remaining ICMP6 types get their own states,
2368 * and will only match in one direction.
2369 */
2370 default:
2371 *icmp_dir = PF_IN;
2372 *virtual_type = type;
2373 *virtual_id = 0;
2374 break;
2375 }
2376 break;
2377 #endif /* INET6 */
2378 default:
2379 unhandled_af(pd->af);
2380 }
2381 *virtual_type = htons(*virtual_type);
2382 return (0); /* These types match to their own state */
2383 }
2384
2385 void
pf_intr(void * v)2386 pf_intr(void *v)
2387 {
2388 struct epoch_tracker et;
2389 struct pf_send_head queue;
2390 struct pf_send_entry *pfse, *next;
2391
2392 CURVNET_SET((struct vnet *)v);
2393
2394 PF_SENDQ_LOCK();
2395 queue = V_pf_sendqueue;
2396 STAILQ_INIT(&V_pf_sendqueue);
2397 PF_SENDQ_UNLOCK();
2398
2399 NET_EPOCH_ENTER(et);
2400
2401 STAILQ_FOREACH_SAFE(pfse, &queue, pfse_next, next) {
2402 switch (pfse->pfse_type) {
2403 #ifdef INET
2404 case PFSE_IP: {
2405 if (pf_isforlocal(pfse->pfse_m, AF_INET)) {
2406 KASSERT(pfse->pfse_m->m_pkthdr.rcvif == V_loif,
2407 ("%s: rcvif != loif", __func__));
2408
2409 pfse->pfse_m->m_flags |= M_SKIP_FIREWALL;
2410 pfse->pfse_m->m_pkthdr.csum_flags |=
2411 CSUM_IP_VALID | CSUM_IP_CHECKED |
2412 CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
2413 pfse->pfse_m->m_pkthdr.csum_data = 0xffff;
2414 ip_input(pfse->pfse_m);
2415 } else {
2416 ip_output(pfse->pfse_m, NULL, NULL, 0, NULL,
2417 NULL);
2418 }
2419 break;
2420 }
2421 case PFSE_ICMP:
2422 icmp_error(pfse->pfse_m, pfse->icmpopts.type,
2423 pfse->icmpopts.code, 0, pfse->icmpopts.mtu);
2424 break;
2425 #endif /* INET */
2426 #ifdef INET6
2427 case PFSE_IP6:
2428 if (pf_isforlocal(pfse->pfse_m, AF_INET6)) {
2429 KASSERT(pfse->pfse_m->m_pkthdr.rcvif == V_loif,
2430 ("%s: rcvif != loif", __func__));
2431
2432 pfse->pfse_m->m_flags |= M_SKIP_FIREWALL |
2433 M_LOOP;
2434 pfse->pfse_m->m_pkthdr.csum_flags |=
2435 CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
2436 pfse->pfse_m->m_pkthdr.csum_data = 0xffff;
2437 ip6_input(pfse->pfse_m);
2438 } else {
2439 ip6_output(pfse->pfse_m, NULL, NULL, 0, NULL,
2440 NULL, NULL);
2441 }
2442 break;
2443 case PFSE_ICMP6:
2444 icmp6_error(pfse->pfse_m, pfse->icmpopts.type,
2445 pfse->icmpopts.code, pfse->icmpopts.mtu);
2446 break;
2447 #endif /* INET6 */
2448 default:
2449 panic("%s: unknown type", __func__);
2450 }
2451 free(pfse, M_PFTEMP);
2452 }
2453 NET_EPOCH_EXIT(et);
2454 CURVNET_RESTORE();
2455 }
2456
2457 #define pf_purge_thread_period (hz / 10)
2458
2459 #ifdef PF_WANT_32_TO_64_COUNTER
2460 static void
pf_status_counter_u64_periodic(void)2461 pf_status_counter_u64_periodic(void)
2462 {
2463
2464 PF_RULES_RASSERT();
2465
2466 if ((V_pf_counter_periodic_iter % (pf_purge_thread_period * 10 * 60)) != 0) {
2467 return;
2468 }
2469
2470 for (int i = 0; i < FCNT_MAX; i++) {
2471 pf_counter_u64_periodic(&V_pf_status.fcounters[i]);
2472 }
2473 }
2474
2475 static void
pf_kif_counter_u64_periodic(void)2476 pf_kif_counter_u64_periodic(void)
2477 {
2478 struct pfi_kkif *kif;
2479 size_t r, run;
2480
2481 PF_RULES_RASSERT();
2482
2483 if (__predict_false(V_pf_allkifcount == 0)) {
2484 return;
2485 }
2486
2487 if ((V_pf_counter_periodic_iter % (pf_purge_thread_period * 10 * 300)) != 0) {
2488 return;
2489 }
2490
2491 run = V_pf_allkifcount / 10;
2492 if (run < 5)
2493 run = 5;
2494
2495 for (r = 0; r < run; r++) {
2496 kif = LIST_NEXT(V_pf_kifmarker, pfik_allkiflist);
2497 if (kif == NULL) {
2498 LIST_REMOVE(V_pf_kifmarker, pfik_allkiflist);
2499 LIST_INSERT_HEAD(&V_pf_allkiflist, V_pf_kifmarker, pfik_allkiflist);
2500 break;
2501 }
2502
2503 LIST_REMOVE(V_pf_kifmarker, pfik_allkiflist);
2504 LIST_INSERT_AFTER(kif, V_pf_kifmarker, pfik_allkiflist);
2505
2506 for (int i = 0; i < 2; i++) {
2507 for (int j = 0; j < 2; j++) {
2508 for (int k = 0; k < 2; k++) {
2509 pf_counter_u64_periodic(&kif->pfik_packets[i][j][k]);
2510 pf_counter_u64_periodic(&kif->pfik_bytes[i][j][k]);
2511 }
2512 }
2513 }
2514 }
2515 }
2516
2517 static void
pf_rule_counter_u64_periodic(void)2518 pf_rule_counter_u64_periodic(void)
2519 {
2520 struct pf_krule *rule;
2521 size_t r, run;
2522
2523 PF_RULES_RASSERT();
2524
2525 if (__predict_false(V_pf_allrulecount == 0)) {
2526 return;
2527 }
2528
2529 if ((V_pf_counter_periodic_iter % (pf_purge_thread_period * 10 * 300)) != 0) {
2530 return;
2531 }
2532
2533 run = V_pf_allrulecount / 10;
2534 if (run < 5)
2535 run = 5;
2536
2537 for (r = 0; r < run; r++) {
2538 rule = LIST_NEXT(V_pf_rulemarker, allrulelist);
2539 if (rule == NULL) {
2540 LIST_REMOVE(V_pf_rulemarker, allrulelist);
2541 LIST_INSERT_HEAD(&V_pf_allrulelist, V_pf_rulemarker, allrulelist);
2542 break;
2543 }
2544
2545 LIST_REMOVE(V_pf_rulemarker, allrulelist);
2546 LIST_INSERT_AFTER(rule, V_pf_rulemarker, allrulelist);
2547
2548 pf_counter_u64_periodic(&rule->evaluations);
2549 for (int i = 0; i < 2; i++) {
2550 pf_counter_u64_periodic(&rule->packets[i]);
2551 pf_counter_u64_periodic(&rule->bytes[i]);
2552 }
2553 }
2554 }
2555
2556 static void
pf_counter_u64_periodic_main(void)2557 pf_counter_u64_periodic_main(void)
2558 {
2559 PF_RULES_RLOCK_TRACKER;
2560
2561 V_pf_counter_periodic_iter++;
2562
2563 PF_RULES_RLOCK();
2564 pf_counter_u64_critical_enter();
2565 pf_status_counter_u64_periodic();
2566 pf_kif_counter_u64_periodic();
2567 pf_rule_counter_u64_periodic();
2568 pf_counter_u64_critical_exit();
2569 PF_RULES_RUNLOCK();
2570 }
2571 #else
2572 #define pf_counter_u64_periodic_main() do { } while (0)
2573 #endif
2574
2575 void
pf_purge_thread(void * unused __unused)2576 pf_purge_thread(void *unused __unused)
2577 {
2578 struct epoch_tracker et;
2579
2580 VNET_ITERATOR_DECL(vnet_iter);
2581
2582 sx_xlock(&pf_end_lock);
2583 while (pf_end_threads == 0) {
2584 sx_sleep(pf_purge_thread, &pf_end_lock, 0, "pftm", pf_purge_thread_period);
2585
2586 VNET_LIST_RLOCK();
2587 NET_EPOCH_ENTER(et);
2588 VNET_FOREACH(vnet_iter) {
2589 CURVNET_SET(vnet_iter);
2590
2591 /* Wait until V_pf_default_rule is initialized. */
2592 if (V_pf_vnet_active == 0) {
2593 CURVNET_RESTORE();
2594 continue;
2595 }
2596
2597 pf_counter_u64_periodic_main();
2598
2599 /*
2600 * Process 1/interval fraction of the state
2601 * table every run.
2602 */
2603 V_pf_purge_idx =
2604 pf_purge_expired_states(V_pf_purge_idx, V_pf_hashmask /
2605 (V_pf_default_rule.timeout[PFTM_INTERVAL] * 10));
2606
2607 /*
2608 * Purge other expired types every
2609 * PFTM_INTERVAL seconds.
2610 */
2611 if (V_pf_purge_idx == 0) {
2612 /*
2613 * Order is important:
2614 * - states and src nodes reference rules
2615 * - states and rules reference kifs
2616 */
2617 pf_purge_expired_fragments();
2618 pf_purge_expired_src_nodes();
2619 pf_purge_unlinked_rules();
2620 pfi_kkif_purge();
2621 }
2622 CURVNET_RESTORE();
2623 }
2624 NET_EPOCH_EXIT(et);
2625 VNET_LIST_RUNLOCK();
2626 }
2627
2628 pf_end_threads++;
2629 sx_xunlock(&pf_end_lock);
2630 kproc_exit(0);
2631 }
2632
2633 void
pf_unload_vnet_purge(void)2634 pf_unload_vnet_purge(void)
2635 {
2636
2637 /*
2638 * To cleanse up all kifs and rules we need
2639 * two runs: first one clears reference flags,
2640 * then pf_purge_expired_states() doesn't
2641 * raise them, and then second run frees.
2642 */
2643 pf_purge_unlinked_rules();
2644 pfi_kkif_purge();
2645
2646 /*
2647 * Now purge everything.
2648 */
2649 pf_purge_expired_states(0, V_pf_hashmask);
2650 pf_purge_fragments(UINT_MAX);
2651 pf_purge_expired_src_nodes();
2652
2653 /*
2654 * Now all kifs & rules should be unreferenced,
2655 * thus should be successfully freed.
2656 */
2657 pf_purge_unlinked_rules();
2658 pfi_kkif_purge();
2659 }
2660
2661 u_int32_t
pf_state_expires(const struct pf_kstate * state)2662 pf_state_expires(const struct pf_kstate *state)
2663 {
2664 u_int32_t timeout;
2665 u_int32_t start;
2666 u_int32_t end;
2667 u_int32_t states;
2668
2669 /* handle all PFTM_* > PFTM_MAX here */
2670 if (state->timeout == PFTM_PURGE)
2671 return (time_uptime);
2672 KASSERT(state->timeout != PFTM_UNLINKED,
2673 ("pf_state_expires: timeout == PFTM_UNLINKED"));
2674 KASSERT((state->timeout < PFTM_MAX),
2675 ("pf_state_expires: timeout > PFTM_MAX"));
2676 timeout = state->rule->timeout[state->timeout];
2677 if (!timeout)
2678 timeout = V_pf_default_rule.timeout[state->timeout];
2679 start = state->rule->timeout[PFTM_ADAPTIVE_START];
2680 if (start && state->rule != &V_pf_default_rule) {
2681 end = state->rule->timeout[PFTM_ADAPTIVE_END];
2682 states = counter_u64_fetch(state->rule->states_cur);
2683 } else {
2684 start = V_pf_default_rule.timeout[PFTM_ADAPTIVE_START];
2685 end = V_pf_default_rule.timeout[PFTM_ADAPTIVE_END];
2686 states = V_pf_status.states;
2687 }
2688 if (end && states > start && start < end) {
2689 if (states < end) {
2690 timeout = (u_int64_t)timeout * (end - states) /
2691 (end - start);
2692 return ((state->expire / 1000) + timeout);
2693 }
2694 else
2695 return (time_uptime);
2696 }
2697 return ((state->expire / 1000) + timeout);
2698 }
2699
2700 void
pf_purge_expired_src_nodes(void)2701 pf_purge_expired_src_nodes(void)
2702 {
2703 struct pf_ksrc_node_list freelist;
2704 struct pf_srchash *sh;
2705 struct pf_ksrc_node *cur, *next;
2706 int i;
2707
2708 LIST_INIT(&freelist);
2709 for (i = 0, sh = V_pf_srchash; i <= V_pf_srchashmask; i++, sh++) {
2710 PF_HASHROW_LOCK(sh);
2711 LIST_FOREACH_SAFE(cur, &sh->nodes, entry, next)
2712 if (cur->states == 0 && cur->expire <= time_uptime) {
2713 pf_unlink_src_node(cur);
2714 LIST_INSERT_HEAD(&freelist, cur, entry);
2715 } else if (cur->rule != NULL)
2716 cur->rule->rule_ref |= PFRULE_REFS;
2717 PF_HASHROW_UNLOCK(sh);
2718 }
2719
2720 pf_free_src_nodes(&freelist);
2721
2722 V_pf_status.src_nodes = uma_zone_get_cur(V_pf_sources_z);
2723 }
2724
2725 static void
pf_src_tree_remove_state(struct pf_kstate * s)2726 pf_src_tree_remove_state(struct pf_kstate *s)
2727 {
2728 uint32_t timeout;
2729
2730 timeout = s->rule->timeout[PFTM_SRC_NODE] ?
2731 s->rule->timeout[PFTM_SRC_NODE] :
2732 V_pf_default_rule.timeout[PFTM_SRC_NODE];
2733
2734 for (pf_sn_types_t sn_type=0; sn_type<PF_SN_MAX; sn_type++) {
2735 if (s->sns[sn_type] == NULL)
2736 continue;
2737 PF_SRC_NODE_LOCK(s->sns[sn_type]);
2738 if (sn_type == PF_SN_LIMIT && s->src.tcp_est)
2739 --(s->sns[sn_type]->conn);
2740 if (--(s->sns[sn_type]->states) == 0)
2741 s->sns[sn_type]->expire = time_uptime + timeout;
2742 PF_SRC_NODE_UNLOCK(s->sns[sn_type]);
2743 s->sns[sn_type] = NULL;
2744 }
2745
2746 }
2747
2748 /*
2749 * Unlink and potentilly free a state. Function may be
2750 * called with ID hash row locked, but always returns
2751 * unlocked, since it needs to go through key hash locking.
2752 */
2753 int
pf_remove_state(struct pf_kstate * s)2754 pf_remove_state(struct pf_kstate *s)
2755 {
2756 struct pf_idhash *ih = &V_pf_idhash[PF_IDHASH(s)];
2757
2758 NET_EPOCH_ASSERT();
2759 PF_HASHROW_ASSERT(ih);
2760
2761 if (s->timeout == PFTM_UNLINKED) {
2762 /*
2763 * State is being processed
2764 * by pf_remove_state() in
2765 * an other thread.
2766 */
2767 PF_HASHROW_UNLOCK(ih);
2768 return (0); /* XXXGL: undefined actually */
2769 }
2770
2771 if (s->src.state == PF_TCPS_PROXY_DST) {
2772 /* XXX wire key the right one? */
2773 pf_send_tcp(s->rule, s->key[PF_SK_WIRE]->af,
2774 &s->key[PF_SK_WIRE]->addr[1],
2775 &s->key[PF_SK_WIRE]->addr[0],
2776 s->key[PF_SK_WIRE]->port[1],
2777 s->key[PF_SK_WIRE]->port[0],
2778 s->src.seqhi, s->src.seqlo + 1,
2779 TH_RST|TH_ACK, 0, 0, 0, M_SKIP_FIREWALL, s->tag, 0,
2780 s->act.rtableid);
2781 }
2782
2783 LIST_REMOVE(s, entry);
2784 pf_src_tree_remove_state(s);
2785
2786 if (V_pfsync_delete_state_ptr != NULL)
2787 V_pfsync_delete_state_ptr(s);
2788
2789 STATE_DEC_COUNTERS(s);
2790
2791 s->timeout = PFTM_UNLINKED;
2792
2793 /* Ensure we remove it from the list of halfopen states, if needed. */
2794 if (s->key[PF_SK_STACK] != NULL &&
2795 s->key[PF_SK_STACK]->proto == IPPROTO_TCP)
2796 pf_set_protostate(s, PF_PEER_BOTH, TCPS_CLOSED);
2797
2798 PF_HASHROW_UNLOCK(ih);
2799
2800 pf_detach_state(s);
2801
2802 pf_udp_mapping_release(s->udp_mapping);
2803
2804 /* pf_state_insert() initialises refs to 2 */
2805 return (pf_release_staten(s, 2));
2806 }
2807
2808 struct pf_kstate *
pf_alloc_state(int flags)2809 pf_alloc_state(int flags)
2810 {
2811
2812 return (uma_zalloc(V_pf_state_z, flags | M_ZERO));
2813 }
2814
2815 void
pf_free_state(struct pf_kstate * cur)2816 pf_free_state(struct pf_kstate *cur)
2817 {
2818 struct pf_krule_item *ri;
2819
2820 KASSERT(cur->refs == 0, ("%s: %p has refs", __func__, cur));
2821 KASSERT(cur->timeout == PFTM_UNLINKED, ("%s: timeout %u", __func__,
2822 cur->timeout));
2823
2824 while ((ri = SLIST_FIRST(&cur->match_rules))) {
2825 SLIST_REMOVE_HEAD(&cur->match_rules, entry);
2826 free(ri, M_PF_RULE_ITEM);
2827 }
2828
2829 pf_normalize_tcp_cleanup(cur);
2830 uma_zfree(V_pf_state_z, cur);
2831 pf_counter_u64_add(&V_pf_status.fcounters[FCNT_STATE_REMOVALS], 1);
2832 }
2833
2834 /*
2835 * Called only from pf_purge_thread(), thus serialized.
2836 */
2837 static u_int
pf_purge_expired_states(u_int i,int maxcheck)2838 pf_purge_expired_states(u_int i, int maxcheck)
2839 {
2840 struct pf_idhash *ih;
2841 struct pf_kstate *s;
2842 struct pf_krule_item *mrm;
2843 size_t count __unused;
2844
2845 V_pf_status.states = uma_zone_get_cur(V_pf_state_z);
2846
2847 /*
2848 * Go through hash and unlink states that expire now.
2849 */
2850 while (maxcheck > 0) {
2851 count = 0;
2852 ih = &V_pf_idhash[i];
2853
2854 /* only take the lock if we expect to do work */
2855 if (!LIST_EMPTY(&ih->states)) {
2856 relock:
2857 PF_HASHROW_LOCK(ih);
2858 LIST_FOREACH(s, &ih->states, entry) {
2859 if (pf_state_expires(s) <= time_uptime) {
2860 V_pf_status.states -=
2861 pf_remove_state(s);
2862 goto relock;
2863 }
2864 s->rule->rule_ref |= PFRULE_REFS;
2865 if (s->nat_rule != NULL)
2866 s->nat_rule->rule_ref |= PFRULE_REFS;
2867 if (s->anchor != NULL)
2868 s->anchor->rule_ref |= PFRULE_REFS;
2869 s->kif->pfik_flags |= PFI_IFLAG_REFS;
2870 SLIST_FOREACH(mrm, &s->match_rules, entry)
2871 mrm->r->rule_ref |= PFRULE_REFS;
2872 if (s->act.rt_kif)
2873 s->act.rt_kif->pfik_flags |= PFI_IFLAG_REFS;
2874 count++;
2875 }
2876 PF_HASHROW_UNLOCK(ih);
2877 }
2878
2879 SDT_PROBE2(pf, purge, state, rowcount, i, count);
2880
2881 /* Return when we hit end of hash. */
2882 if (++i > V_pf_hashmask) {
2883 V_pf_status.states = uma_zone_get_cur(V_pf_state_z);
2884 return (0);
2885 }
2886
2887 maxcheck--;
2888 }
2889
2890 V_pf_status.states = uma_zone_get_cur(V_pf_state_z);
2891
2892 return (i);
2893 }
2894
2895 static void
pf_purge_unlinked_rules(void)2896 pf_purge_unlinked_rules(void)
2897 {
2898 struct pf_krulequeue tmpq;
2899 struct pf_krule *r, *r1;
2900
2901 /*
2902 * If we have overloading task pending, then we'd
2903 * better skip purging this time. There is a tiny
2904 * probability that overloading task references
2905 * an already unlinked rule.
2906 */
2907 PF_OVERLOADQ_LOCK();
2908 if (!SLIST_EMPTY(&V_pf_overloadqueue)) {
2909 PF_OVERLOADQ_UNLOCK();
2910 return;
2911 }
2912 PF_OVERLOADQ_UNLOCK();
2913
2914 /*
2915 * Do naive mark-and-sweep garbage collecting of old rules.
2916 * Reference flag is raised by pf_purge_expired_states()
2917 * and pf_purge_expired_src_nodes().
2918 *
2919 * To avoid LOR between PF_UNLNKDRULES_LOCK/PF_RULES_WLOCK,
2920 * use a temporary queue.
2921 */
2922 TAILQ_INIT(&tmpq);
2923 PF_UNLNKDRULES_LOCK();
2924 TAILQ_FOREACH_SAFE(r, &V_pf_unlinked_rules, entries, r1) {
2925 if (!(r->rule_ref & PFRULE_REFS)) {
2926 TAILQ_REMOVE(&V_pf_unlinked_rules, r, entries);
2927 TAILQ_INSERT_TAIL(&tmpq, r, entries);
2928 } else
2929 r->rule_ref &= ~PFRULE_REFS;
2930 }
2931 PF_UNLNKDRULES_UNLOCK();
2932
2933 if (!TAILQ_EMPTY(&tmpq)) {
2934 PF_CONFIG_LOCK();
2935 PF_RULES_WLOCK();
2936 TAILQ_FOREACH_SAFE(r, &tmpq, entries, r1) {
2937 TAILQ_REMOVE(&tmpq, r, entries);
2938 pf_free_rule(r);
2939 }
2940 PF_RULES_WUNLOCK();
2941 PF_CONFIG_UNLOCK();
2942 }
2943 }
2944
2945 void
pf_print_host(struct pf_addr * addr,u_int16_t p,sa_family_t af)2946 pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af)
2947 {
2948 switch (af) {
2949 #ifdef INET
2950 case AF_INET: {
2951 u_int32_t a = ntohl(addr->addr32[0]);
2952 printf("%u.%u.%u.%u", (a>>24)&255, (a>>16)&255,
2953 (a>>8)&255, a&255);
2954 if (p) {
2955 p = ntohs(p);
2956 printf(":%u", p);
2957 }
2958 break;
2959 }
2960 #endif /* INET */
2961 #ifdef INET6
2962 case AF_INET6: {
2963 u_int16_t b;
2964 u_int8_t i, curstart, curend, maxstart, maxend;
2965 curstart = curend = maxstart = maxend = 255;
2966 for (i = 0; i < 8; i++) {
2967 if (!addr->addr16[i]) {
2968 if (curstart == 255)
2969 curstart = i;
2970 curend = i;
2971 } else {
2972 if ((curend - curstart) >
2973 (maxend - maxstart)) {
2974 maxstart = curstart;
2975 maxend = curend;
2976 }
2977 curstart = curend = 255;
2978 }
2979 }
2980 if ((curend - curstart) >
2981 (maxend - maxstart)) {
2982 maxstart = curstart;
2983 maxend = curend;
2984 }
2985 for (i = 0; i < 8; i++) {
2986 if (i >= maxstart && i <= maxend) {
2987 if (i == 0)
2988 printf(":");
2989 if (i == maxend)
2990 printf(":");
2991 } else {
2992 b = ntohs(addr->addr16[i]);
2993 printf("%x", b);
2994 if (i < 7)
2995 printf(":");
2996 }
2997 }
2998 if (p) {
2999 p = ntohs(p);
3000 printf("[%u]", p);
3001 }
3002 break;
3003 }
3004 #endif /* INET6 */
3005 default:
3006 unhandled_af(af);
3007 }
3008 }
3009
3010 void
pf_print_state(struct pf_kstate * s)3011 pf_print_state(struct pf_kstate *s)
3012 {
3013 pf_print_state_parts(s, NULL, NULL);
3014 }
3015
3016 static void
pf_print_state_parts(struct pf_kstate * s,struct pf_state_key * skwp,struct pf_state_key * sksp)3017 pf_print_state_parts(struct pf_kstate *s,
3018 struct pf_state_key *skwp, struct pf_state_key *sksp)
3019 {
3020 struct pf_state_key *skw, *sks;
3021 u_int8_t proto, dir;
3022
3023 /* Do our best to fill these, but they're skipped if NULL */
3024 skw = skwp ? skwp : (s ? s->key[PF_SK_WIRE] : NULL);
3025 sks = sksp ? sksp : (s ? s->key[PF_SK_STACK] : NULL);
3026 proto = skw ? skw->proto : (sks ? sks->proto : 0);
3027 dir = s ? s->direction : 0;
3028
3029 switch (proto) {
3030 case IPPROTO_IPV4:
3031 printf("IPv4");
3032 break;
3033 case IPPROTO_IPV6:
3034 printf("IPv6");
3035 break;
3036 case IPPROTO_TCP:
3037 printf("TCP");
3038 break;
3039 case IPPROTO_UDP:
3040 printf("UDP");
3041 break;
3042 case IPPROTO_ICMP:
3043 printf("ICMP");
3044 break;
3045 case IPPROTO_ICMPV6:
3046 printf("ICMPv6");
3047 break;
3048 default:
3049 printf("%u", proto);
3050 break;
3051 }
3052 switch (dir) {
3053 case PF_IN:
3054 printf(" in");
3055 break;
3056 case PF_OUT:
3057 printf(" out");
3058 break;
3059 }
3060 if (skw) {
3061 printf(" wire: ");
3062 pf_print_host(&skw->addr[0], skw->port[0], skw->af);
3063 printf(" ");
3064 pf_print_host(&skw->addr[1], skw->port[1], skw->af);
3065 }
3066 if (sks) {
3067 printf(" stack: ");
3068 if (sks != skw) {
3069 pf_print_host(&sks->addr[0], sks->port[0], sks->af);
3070 printf(" ");
3071 pf_print_host(&sks->addr[1], sks->port[1], sks->af);
3072 } else
3073 printf("-");
3074 }
3075 if (s) {
3076 if (proto == IPPROTO_TCP) {
3077 printf(" [lo=%u high=%u win=%u modulator=%u",
3078 s->src.seqlo, s->src.seqhi,
3079 s->src.max_win, s->src.seqdiff);
3080 if (s->src.wscale && s->dst.wscale)
3081 printf(" wscale=%u",
3082 s->src.wscale & PF_WSCALE_MASK);
3083 printf("]");
3084 printf(" [lo=%u high=%u win=%u modulator=%u",
3085 s->dst.seqlo, s->dst.seqhi,
3086 s->dst.max_win, s->dst.seqdiff);
3087 if (s->src.wscale && s->dst.wscale)
3088 printf(" wscale=%u",
3089 s->dst.wscale & PF_WSCALE_MASK);
3090 printf("]");
3091 }
3092 printf(" %u:%u", s->src.state, s->dst.state);
3093 if (s->rule)
3094 printf(" @%d", s->rule->nr);
3095 }
3096 }
3097
3098 void
pf_print_flags(uint16_t f)3099 pf_print_flags(uint16_t f)
3100 {
3101 if (f)
3102 printf(" ");
3103 if (f & TH_FIN)
3104 printf("F");
3105 if (f & TH_SYN)
3106 printf("S");
3107 if (f & TH_RST)
3108 printf("R");
3109 if (f & TH_PUSH)
3110 printf("P");
3111 if (f & TH_ACK)
3112 printf("A");
3113 if (f & TH_URG)
3114 printf("U");
3115 if (f & TH_ECE)
3116 printf("E");
3117 if (f & TH_CWR)
3118 printf("W");
3119 if (f & TH_AE)
3120 printf("e");
3121 }
3122
3123 #define PF_SET_SKIP_STEPS(i) \
3124 do { \
3125 while (head[i] != cur) { \
3126 head[i]->skip[i] = cur; \
3127 head[i] = TAILQ_NEXT(head[i], entries); \
3128 } \
3129 } while (0)
3130
3131 void
pf_calc_skip_steps(struct pf_krulequeue * rules)3132 pf_calc_skip_steps(struct pf_krulequeue *rules)
3133 {
3134 struct pf_krule *cur, *prev, *head[PF_SKIP_COUNT];
3135 int i;
3136
3137 cur = TAILQ_FIRST(rules);
3138 prev = cur;
3139 for (i = 0; i < PF_SKIP_COUNT; ++i)
3140 head[i] = cur;
3141 while (cur != NULL) {
3142 if (cur->kif != prev->kif || cur->ifnot != prev->ifnot)
3143 PF_SET_SKIP_STEPS(PF_SKIP_IFP);
3144 if (cur->direction != prev->direction)
3145 PF_SET_SKIP_STEPS(PF_SKIP_DIR);
3146 if (cur->af != prev->af)
3147 PF_SET_SKIP_STEPS(PF_SKIP_AF);
3148 if (cur->proto != prev->proto)
3149 PF_SET_SKIP_STEPS(PF_SKIP_PROTO);
3150 if (cur->src.neg != prev->src.neg ||
3151 pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr))
3152 PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR);
3153 if (cur->dst.neg != prev->dst.neg ||
3154 pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr))
3155 PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR);
3156 if (cur->src.port[0] != prev->src.port[0] ||
3157 cur->src.port[1] != prev->src.port[1] ||
3158 cur->src.port_op != prev->src.port_op)
3159 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT);
3160 if (cur->dst.port[0] != prev->dst.port[0] ||
3161 cur->dst.port[1] != prev->dst.port[1] ||
3162 cur->dst.port_op != prev->dst.port_op)
3163 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
3164
3165 prev = cur;
3166 cur = TAILQ_NEXT(cur, entries);
3167 }
3168 for (i = 0; i < PF_SKIP_COUNT; ++i)
3169 PF_SET_SKIP_STEPS(i);
3170 }
3171
3172 int
pf_addr_wrap_neq(struct pf_addr_wrap * aw1,struct pf_addr_wrap * aw2)3173 pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2)
3174 {
3175 if (aw1->type != aw2->type)
3176 return (1);
3177 switch (aw1->type) {
3178 case PF_ADDR_ADDRMASK:
3179 case PF_ADDR_RANGE:
3180 if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, AF_INET6))
3181 return (1);
3182 if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, AF_INET6))
3183 return (1);
3184 return (0);
3185 case PF_ADDR_DYNIFTL:
3186 return (aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt);
3187 case PF_ADDR_NONE:
3188 case PF_ADDR_NOROUTE:
3189 case PF_ADDR_URPFFAILED:
3190 return (0);
3191 case PF_ADDR_TABLE:
3192 return (aw1->p.tbl != aw2->p.tbl);
3193 default:
3194 printf("invalid address type: %d\n", aw1->type);
3195 return (1);
3196 }
3197 }
3198
3199 /**
3200 * Checksum updates are a little complicated because the checksum in the TCP/UDP
3201 * header isn't always a full checksum. In some cases (i.e. output) it's a
3202 * pseudo-header checksum, which is a partial checksum over src/dst IP
3203 * addresses, protocol number and length.
3204 *
3205 * That means we have the following cases:
3206 * * Input or forwarding: we don't have TSO, the checksum fields are full
3207 * checksums, we need to update the checksum whenever we change anything.
3208 * * Output (i.e. the checksum is a pseudo-header checksum):
3209 * x The field being updated is src/dst address or affects the length of
3210 * the packet. We need to update the pseudo-header checksum (note that this
3211 * checksum is not ones' complement).
3212 * x Some other field is being modified (e.g. src/dst port numbers): We
3213 * don't have to update anything.
3214 **/
3215 u_int16_t
pf_cksum_fixup(u_int16_t cksum,u_int16_t old,u_int16_t new,u_int8_t udp)3216 pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp)
3217 {
3218 u_int32_t x;
3219
3220 x = cksum + old - new;
3221 x = (x + (x >> 16)) & 0xffff;
3222
3223 /* optimise: eliminate a branch when not udp */
3224 if (udp && cksum == 0x0000)
3225 return cksum;
3226 if (udp && x == 0x0000)
3227 x = 0xffff;
3228
3229 return (u_int16_t)(x);
3230 }
3231
3232 static int
pf_patch_8(struct pf_pdesc * pd,u_int8_t * f,u_int8_t v,bool hi)3233 pf_patch_8(struct pf_pdesc *pd, u_int8_t *f, u_int8_t v, bool hi)
3234 {
3235 int rewrite = 0;
3236
3237 if (*f != v) {
3238 uint16_t old = htons(hi ? (*f << 8) : *f);
3239 uint16_t new = htons(hi ? ( v << 8) : v);
3240
3241 *f = v;
3242
3243 if (! (pd->m->m_pkthdr.csum_flags & (CSUM_DELAY_DATA |
3244 CSUM_DELAY_DATA_IPV6)))
3245 *pd->pcksum = pf_cksum_fixup(*pd->pcksum, old, new,
3246 pd->proto == IPPROTO_UDP);
3247
3248 rewrite = 1;
3249 }
3250
3251 return (rewrite);
3252 }
3253
3254 int
pf_patch_16(struct pf_pdesc * pd,void * f,u_int16_t v,bool hi)3255 pf_patch_16(struct pf_pdesc *pd, void *f, u_int16_t v, bool hi)
3256 {
3257 int rewrite = 0;
3258 u_int8_t *fb = (u_int8_t *)f;
3259 u_int8_t *vb = (u_int8_t *)&v;
3260
3261 rewrite += pf_patch_8(pd, fb++, *vb++, hi);
3262 rewrite += pf_patch_8(pd, fb++, *vb++, !hi);
3263
3264 return (rewrite);
3265 }
3266
3267 int
pf_patch_32(struct pf_pdesc * pd,void * f,u_int32_t v,bool hi)3268 pf_patch_32(struct pf_pdesc *pd, void *f, u_int32_t v, bool hi)
3269 {
3270 int rewrite = 0;
3271 u_int8_t *fb = (u_int8_t *)f;
3272 u_int8_t *vb = (u_int8_t *)&v;
3273
3274 rewrite += pf_patch_8(pd, fb++, *vb++, hi);
3275 rewrite += pf_patch_8(pd, fb++, *vb++, !hi);
3276 rewrite += pf_patch_8(pd, fb++, *vb++, hi);
3277 rewrite += pf_patch_8(pd, fb++, *vb++, !hi);
3278
3279 return (rewrite);
3280 }
3281
3282 u_int16_t
pf_proto_cksum_fixup(struct mbuf * m,u_int16_t cksum,u_int16_t old,u_int16_t new,u_int8_t udp)3283 pf_proto_cksum_fixup(struct mbuf *m, u_int16_t cksum, u_int16_t old,
3284 u_int16_t new, u_int8_t udp)
3285 {
3286 if (m->m_pkthdr.csum_flags & (CSUM_DELAY_DATA | CSUM_DELAY_DATA_IPV6))
3287 return (cksum);
3288
3289 return (pf_cksum_fixup(cksum, old, new, udp));
3290 }
3291
3292 static void
pf_change_ap(struct pf_pdesc * pd,struct pf_addr * a,u_int16_t * p,struct pf_addr * an,u_int16_t pn)3293 pf_change_ap(struct pf_pdesc *pd, struct pf_addr *a, u_int16_t *p,
3294 struct pf_addr *an, u_int16_t pn)
3295 {
3296 struct pf_addr ao;
3297 u_int16_t po;
3298 uint8_t u = pd->virtual_proto == IPPROTO_UDP;
3299
3300 MPASS(pd->pcksum);
3301 if (pd->af == AF_INET) {
3302 MPASS(pd->ip_sum);
3303 }
3304
3305 pf_addrcpy(&ao, a, pd->af);
3306 if (pd->af == pd->naf)
3307 pf_addrcpy(a, an, pd->af);
3308
3309 if (pd->m->m_pkthdr.csum_flags & (CSUM_DELAY_DATA | CSUM_DELAY_DATA_IPV6))
3310 *pd->pcksum = ~*pd->pcksum;
3311
3312 if (p == NULL) /* no port -> done. no cksum to worry about. */
3313 return;
3314 po = *p;
3315 *p = pn;
3316
3317 switch (pd->af) {
3318 #ifdef INET
3319 case AF_INET:
3320 switch (pd->naf) {
3321 case AF_INET:
3322 *pd->ip_sum = pf_cksum_fixup(pf_cksum_fixup(*pd->ip_sum,
3323 ao.addr16[0], an->addr16[0], 0),
3324 ao.addr16[1], an->addr16[1], 0);
3325 *p = pn;
3326
3327 *pd->pcksum = pf_cksum_fixup(pf_cksum_fixup(*pd->pcksum,
3328 ao.addr16[0], an->addr16[0], u),
3329 ao.addr16[1], an->addr16[1], u);
3330
3331 *pd->pcksum = pf_proto_cksum_fixup(pd->m, *pd->pcksum, po, pn, u);
3332 break;
3333 #ifdef INET6
3334 case AF_INET6:
3335 *pd->pcksum = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3336 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3337 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pd->pcksum,
3338 ao.addr16[0], an->addr16[0], u),
3339 ao.addr16[1], an->addr16[1], u),
3340 0, an->addr16[2], u),
3341 0, an->addr16[3], u),
3342 0, an->addr16[4], u),
3343 0, an->addr16[5], u),
3344 0, an->addr16[6], u),
3345 0, an->addr16[7], u),
3346 po, pn, u);
3347 break;
3348 #endif /* INET6 */
3349 default:
3350 unhandled_af(pd->naf);
3351 }
3352 break;
3353 #endif /* INET */
3354 #ifdef INET6
3355 case AF_INET6:
3356 switch (pd->naf) {
3357 #ifdef INET
3358 case AF_INET:
3359 *pd->pcksum = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3360 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3361 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pd->pcksum,
3362 ao.addr16[0], an->addr16[0], u),
3363 ao.addr16[1], an->addr16[1], u),
3364 ao.addr16[2], 0, u),
3365 ao.addr16[3], 0, u),
3366 ao.addr16[4], 0, u),
3367 ao.addr16[5], 0, u),
3368 ao.addr16[6], 0, u),
3369 ao.addr16[7], 0, u),
3370 po, pn, u);
3371 break;
3372 #endif /* INET */
3373 case AF_INET6:
3374 *pd->pcksum = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3375 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3376 pf_cksum_fixup(pf_cksum_fixup(*pd->pcksum,
3377 ao.addr16[0], an->addr16[0], u),
3378 ao.addr16[1], an->addr16[1], u),
3379 ao.addr16[2], an->addr16[2], u),
3380 ao.addr16[3], an->addr16[3], u),
3381 ao.addr16[4], an->addr16[4], u),
3382 ao.addr16[5], an->addr16[5], u),
3383 ao.addr16[6], an->addr16[6], u),
3384 ao.addr16[7], an->addr16[7], u);
3385
3386 *pd->pcksum = pf_proto_cksum_fixup(pd->m, *pd->pcksum, po, pn, u);
3387 break;
3388 default:
3389 unhandled_af(pd->naf);
3390 }
3391 break;
3392 #endif /* INET6 */
3393 default:
3394 unhandled_af(pd->af);
3395 }
3396
3397 if (pd->m->m_pkthdr.csum_flags & (CSUM_DELAY_DATA |
3398 CSUM_DELAY_DATA_IPV6)) {
3399 *pd->pcksum = ~*pd->pcksum;
3400 if (! *pd->pcksum)
3401 *pd->pcksum = 0xffff;
3402 }
3403 }
3404
3405 /* Changes a u_int32_t. Uses a void * so there are no align restrictions */
3406 void
pf_change_a(void * a,u_int16_t * c,u_int32_t an,u_int8_t u)3407 pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u)
3408 {
3409 u_int32_t ao;
3410
3411 memcpy(&ao, a, sizeof(ao));
3412 memcpy(a, &an, sizeof(u_int32_t));
3413 *c = pf_cksum_fixup(pf_cksum_fixup(*c, ao / 65536, an / 65536, u),
3414 ao % 65536, an % 65536, u);
3415 }
3416
3417 void
pf_change_proto_a(struct mbuf * m,void * a,u_int16_t * c,u_int32_t an,u_int8_t udp)3418 pf_change_proto_a(struct mbuf *m, void *a, u_int16_t *c, u_int32_t an, u_int8_t udp)
3419 {
3420 u_int32_t ao;
3421
3422 memcpy(&ao, a, sizeof(ao));
3423 memcpy(a, &an, sizeof(u_int32_t));
3424
3425 *c = pf_proto_cksum_fixup(m,
3426 pf_proto_cksum_fixup(m, *c, ao / 65536, an / 65536, udp),
3427 ao % 65536, an % 65536, udp);
3428 }
3429
3430 #ifdef INET6
3431 static void
pf_change_a6(struct pf_addr * a,u_int16_t * c,struct pf_addr * an,u_int8_t u)3432 pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u)
3433 {
3434 struct pf_addr ao;
3435
3436 pf_addrcpy(&ao, a, AF_INET6);
3437 pf_addrcpy(a, an, AF_INET6);
3438
3439 *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3440 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3441 pf_cksum_fixup(pf_cksum_fixup(*c,
3442 ao.addr16[0], an->addr16[0], u),
3443 ao.addr16[1], an->addr16[1], u),
3444 ao.addr16[2], an->addr16[2], u),
3445 ao.addr16[3], an->addr16[3], u),
3446 ao.addr16[4], an->addr16[4], u),
3447 ao.addr16[5], an->addr16[5], u),
3448 ao.addr16[6], an->addr16[6], u),
3449 ao.addr16[7], an->addr16[7], u);
3450 }
3451 #endif /* INET6 */
3452
3453 static void
pf_change_icmp(struct pf_addr * ia,u_int16_t * ip,struct pf_addr * oa,struct pf_addr * na,u_int16_t np,u_int16_t * pc,u_int16_t * h2c,u_int16_t * ic,u_int16_t * hc,u_int8_t u,sa_family_t af)3454 pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa,
3455 struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c,
3456 u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af)
3457 {
3458 struct pf_addr oia, ooa;
3459
3460 pf_addrcpy(&oia, ia, af);
3461 if (oa)
3462 pf_addrcpy(&ooa, oa, af);
3463
3464 /* Change inner protocol port, fix inner protocol checksum. */
3465 if (ip != NULL) {
3466 u_int16_t oip = *ip;
3467 u_int32_t opc;
3468
3469 if (pc != NULL)
3470 opc = *pc;
3471 *ip = np;
3472 if (pc != NULL)
3473 *pc = pf_cksum_fixup(*pc, oip, *ip, u);
3474 *ic = pf_cksum_fixup(*ic, oip, *ip, 0);
3475 if (pc != NULL)
3476 *ic = pf_cksum_fixup(*ic, opc, *pc, 0);
3477 }
3478 /* Change inner ip address, fix inner ip and icmp checksums. */
3479 pf_addrcpy(ia, na, af);
3480 switch (af) {
3481 #ifdef INET
3482 case AF_INET: {
3483 u_int32_t oh2c = *h2c;
3484
3485 *h2c = pf_cksum_fixup(pf_cksum_fixup(*h2c,
3486 oia.addr16[0], ia->addr16[0], 0),
3487 oia.addr16[1], ia->addr16[1], 0);
3488 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
3489 oia.addr16[0], ia->addr16[0], 0),
3490 oia.addr16[1], ia->addr16[1], 0);
3491 *ic = pf_cksum_fixup(*ic, oh2c, *h2c, 0);
3492 break;
3493 }
3494 #endif /* INET */
3495 #ifdef INET6
3496 case AF_INET6:
3497 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3498 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3499 pf_cksum_fixup(pf_cksum_fixup(*ic,
3500 oia.addr16[0], ia->addr16[0], u),
3501 oia.addr16[1], ia->addr16[1], u),
3502 oia.addr16[2], ia->addr16[2], u),
3503 oia.addr16[3], ia->addr16[3], u),
3504 oia.addr16[4], ia->addr16[4], u),
3505 oia.addr16[5], ia->addr16[5], u),
3506 oia.addr16[6], ia->addr16[6], u),
3507 oia.addr16[7], ia->addr16[7], u);
3508 break;
3509 #endif /* INET6 */
3510 }
3511 /* Outer ip address, fix outer ip or icmpv6 checksum, if necessary. */
3512 if (oa) {
3513 pf_addrcpy(oa, na, af);
3514 switch (af) {
3515 #ifdef INET
3516 case AF_INET:
3517 *hc = pf_cksum_fixup(pf_cksum_fixup(*hc,
3518 ooa.addr16[0], oa->addr16[0], 0),
3519 ooa.addr16[1], oa->addr16[1], 0);
3520 break;
3521 #endif /* INET */
3522 #ifdef INET6
3523 case AF_INET6:
3524 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3525 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3526 pf_cksum_fixup(pf_cksum_fixup(*ic,
3527 ooa.addr16[0], oa->addr16[0], u),
3528 ooa.addr16[1], oa->addr16[1], u),
3529 ooa.addr16[2], oa->addr16[2], u),
3530 ooa.addr16[3], oa->addr16[3], u),
3531 ooa.addr16[4], oa->addr16[4], u),
3532 ooa.addr16[5], oa->addr16[5], u),
3533 ooa.addr16[6], oa->addr16[6], u),
3534 ooa.addr16[7], oa->addr16[7], u);
3535 break;
3536 #endif /* INET6 */
3537 }
3538 }
3539 }
3540
3541 int
pf_translate_af(struct pf_pdesc * pd)3542 pf_translate_af(struct pf_pdesc *pd)
3543 {
3544 #if defined(INET) && defined(INET6)
3545 struct mbuf *mp;
3546 struct ip *ip4;
3547 struct ip6_hdr *ip6;
3548 struct icmp6_hdr *icmp;
3549 struct m_tag *mtag;
3550 struct pf_fragment_tag *ftag;
3551 int hlen;
3552
3553 hlen = pd->naf == AF_INET ? sizeof(*ip4) : sizeof(*ip6);
3554
3555 /* trim the old header */
3556 m_adj(pd->m, pd->off);
3557
3558 /* prepend a new one */
3559 M_PREPEND(pd->m, hlen, M_NOWAIT);
3560 if (pd->m == NULL)
3561 return (-1);
3562
3563 switch (pd->naf) {
3564 case AF_INET:
3565 ip4 = mtod(pd->m, struct ip *);
3566 bzero(ip4, hlen);
3567 ip4->ip_v = IPVERSION;
3568 ip4->ip_hl = hlen >> 2;
3569 ip4->ip_tos = pd->tos;
3570 ip4->ip_len = htons(hlen + (pd->tot_len - pd->off));
3571 ip_fillid(ip4, V_ip_random_id);
3572 ip4->ip_ttl = pd->ttl;
3573 ip4->ip_p = pd->proto;
3574 ip4->ip_src = pd->nsaddr.v4;
3575 ip4->ip_dst = pd->ndaddr.v4;
3576 pd->src = (struct pf_addr *)&ip4->ip_src;
3577 pd->dst = (struct pf_addr *)&ip4->ip_dst;
3578 pd->off = sizeof(struct ip);
3579 break;
3580 case AF_INET6:
3581 ip6 = mtod(pd->m, struct ip6_hdr *);
3582 bzero(ip6, hlen);
3583 ip6->ip6_vfc = IPV6_VERSION;
3584 ip6->ip6_flow |= htonl((u_int32_t)pd->tos << 20);
3585 ip6->ip6_plen = htons(pd->tot_len - pd->off);
3586 ip6->ip6_nxt = pd->proto;
3587 if (!pd->ttl || pd->ttl > IPV6_DEFHLIM)
3588 ip6->ip6_hlim = IPV6_DEFHLIM;
3589 else
3590 ip6->ip6_hlim = pd->ttl;
3591 ip6->ip6_src = pd->nsaddr.v6;
3592 ip6->ip6_dst = pd->ndaddr.v6;
3593 pd->src = (struct pf_addr *)&ip6->ip6_src;
3594 pd->dst = (struct pf_addr *)&ip6->ip6_dst;
3595 pd->off = sizeof(struct ip6_hdr);
3596
3597 /*
3598 * If we're dealing with a reassembled packet we need to adjust
3599 * the header length from the IPv4 header size to IPv6 header
3600 * size.
3601 */
3602 mtag = m_tag_find(pd->m, PACKET_TAG_PF_REASSEMBLED, NULL);
3603 if (mtag) {
3604 ftag = (struct pf_fragment_tag *)(mtag + 1);
3605 ftag->ft_hdrlen = sizeof(*ip6);
3606 ftag->ft_maxlen -= sizeof(struct ip6_hdr) -
3607 sizeof(struct ip) + sizeof(struct ip6_frag);
3608 }
3609 break;
3610 default:
3611 return (-1);
3612 }
3613
3614 /* recalculate icmp/icmp6 checksums */
3615 if (pd->proto == IPPROTO_ICMP || pd->proto == IPPROTO_ICMPV6) {
3616 int off;
3617 if ((mp = m_pulldown(pd->m, hlen, sizeof(*icmp), &off)) ==
3618 NULL) {
3619 pd->m = NULL;
3620 return (-1);
3621 }
3622 icmp = (struct icmp6_hdr *)(mp->m_data + off);
3623 icmp->icmp6_cksum = 0;
3624 icmp->icmp6_cksum = pd->naf == AF_INET ?
3625 in4_cksum(pd->m, 0, hlen, ntohs(ip4->ip_len) - hlen) :
3626 in6_cksum(pd->m, IPPROTO_ICMPV6, hlen,
3627 ntohs(ip6->ip6_plen));
3628 }
3629 #endif /* INET && INET6 */
3630
3631 return (0);
3632 }
3633
3634 int
pf_change_icmp_af(struct mbuf * m,int off,struct pf_pdesc * pd,struct pf_pdesc * pd2,struct pf_addr * src,struct pf_addr * dst,sa_family_t af,sa_family_t naf)3635 pf_change_icmp_af(struct mbuf *m, int off, struct pf_pdesc *pd,
3636 struct pf_pdesc *pd2, struct pf_addr *src, struct pf_addr *dst,
3637 sa_family_t af, sa_family_t naf)
3638 {
3639 #if defined(INET) && defined(INET6)
3640 struct mbuf *n = NULL;
3641 struct ip *ip4;
3642 struct ip6_hdr *ip6;
3643 int hlen, olen, mlen;
3644
3645 if (af == naf || (af != AF_INET && af != AF_INET6) ||
3646 (naf != AF_INET && naf != AF_INET6))
3647 return (-1);
3648
3649 /* split the mbuf chain on the inner ip/ip6 header boundary */
3650 if ((n = m_split(m, off, M_NOWAIT)) == NULL)
3651 return (-1);
3652
3653 /* old header */
3654 olen = pd2->off - off;
3655 /* new header */
3656 hlen = naf == AF_INET ? sizeof(*ip4) : sizeof(*ip6);
3657
3658 /* trim old header */
3659 m_adj(n, olen);
3660
3661 /* prepend a new one */
3662 M_PREPEND(n, hlen, M_NOWAIT);
3663 if (n == NULL)
3664 return (-1);
3665
3666 /* translate inner ip/ip6 header */
3667 switch (naf) {
3668 case AF_INET:
3669 ip4 = mtod(n, struct ip *);
3670 bzero(ip4, sizeof(*ip4));
3671 ip4->ip_v = IPVERSION;
3672 ip4->ip_hl = sizeof(*ip4) >> 2;
3673 ip4->ip_len = htons(sizeof(*ip4) + pd2->tot_len - olen);
3674 ip_fillid(ip4, V_ip_random_id);
3675 ip4->ip_off = htons(IP_DF);
3676 ip4->ip_ttl = pd2->ttl;
3677 if (pd2->proto == IPPROTO_ICMPV6)
3678 ip4->ip_p = IPPROTO_ICMP;
3679 else
3680 ip4->ip_p = pd2->proto;
3681 ip4->ip_src = src->v4;
3682 ip4->ip_dst = dst->v4;
3683 ip4->ip_sum = in_cksum(n, ip4->ip_hl << 2);
3684 break;
3685 case AF_INET6:
3686 ip6 = mtod(n, struct ip6_hdr *);
3687 bzero(ip6, sizeof(*ip6));
3688 ip6->ip6_vfc = IPV6_VERSION;
3689 ip6->ip6_plen = htons(pd2->tot_len - olen);
3690 if (pd2->proto == IPPROTO_ICMP)
3691 ip6->ip6_nxt = IPPROTO_ICMPV6;
3692 else
3693 ip6->ip6_nxt = pd2->proto;
3694 if (!pd2->ttl || pd2->ttl > IPV6_DEFHLIM)
3695 ip6->ip6_hlim = IPV6_DEFHLIM;
3696 else
3697 ip6->ip6_hlim = pd2->ttl;
3698 ip6->ip6_src = src->v6;
3699 ip6->ip6_dst = dst->v6;
3700 break;
3701 default:
3702 unhandled_af(naf);
3703 }
3704
3705 /* adjust payload offset and total packet length */
3706 pd2->off += hlen - olen;
3707 pd->tot_len += hlen - olen;
3708
3709 /* merge modified inner packet with the original header */
3710 mlen = n->m_pkthdr.len;
3711 m_cat(m, n);
3712 m->m_pkthdr.len += mlen;
3713 #endif /* INET && INET6 */
3714
3715 return (0);
3716 }
3717
3718 #define PTR_IP(field) (offsetof(struct ip, field))
3719 #define PTR_IP6(field) (offsetof(struct ip6_hdr, field))
3720
3721 int
pf_translate_icmp_af(int af,void * arg)3722 pf_translate_icmp_af(int af, void *arg)
3723 {
3724 #if defined(INET) && defined(INET6)
3725 struct icmp *icmp4;
3726 struct icmp6_hdr *icmp6;
3727 u_int32_t mtu;
3728 int32_t ptr = -1;
3729 u_int8_t type;
3730 u_int8_t code;
3731
3732 switch (af) {
3733 case AF_INET:
3734 icmp6 = arg;
3735 type = icmp6->icmp6_type;
3736 code = icmp6->icmp6_code;
3737 mtu = ntohl(icmp6->icmp6_mtu);
3738
3739 switch (type) {
3740 case ICMP6_ECHO_REQUEST:
3741 type = ICMP_ECHO;
3742 break;
3743 case ICMP6_ECHO_REPLY:
3744 type = ICMP_ECHOREPLY;
3745 break;
3746 case ICMP6_DST_UNREACH:
3747 type = ICMP_UNREACH;
3748 switch (code) {
3749 case ICMP6_DST_UNREACH_NOROUTE:
3750 case ICMP6_DST_UNREACH_BEYONDSCOPE:
3751 case ICMP6_DST_UNREACH_ADDR:
3752 code = ICMP_UNREACH_HOST;
3753 break;
3754 case ICMP6_DST_UNREACH_ADMIN:
3755 code = ICMP_UNREACH_HOST_PROHIB;
3756 break;
3757 case ICMP6_DST_UNREACH_NOPORT:
3758 code = ICMP_UNREACH_PORT;
3759 break;
3760 default:
3761 return (-1);
3762 }
3763 break;
3764 case ICMP6_PACKET_TOO_BIG:
3765 type = ICMP_UNREACH;
3766 code = ICMP_UNREACH_NEEDFRAG;
3767 mtu -= 20;
3768 break;
3769 case ICMP6_TIME_EXCEEDED:
3770 type = ICMP_TIMXCEED;
3771 break;
3772 case ICMP6_PARAM_PROB:
3773 switch (code) {
3774 case ICMP6_PARAMPROB_HEADER:
3775 type = ICMP_PARAMPROB;
3776 code = ICMP_PARAMPROB_ERRATPTR;
3777 ptr = ntohl(icmp6->icmp6_pptr);
3778
3779 if (ptr == PTR_IP6(ip6_vfc))
3780 ; /* preserve */
3781 else if (ptr == PTR_IP6(ip6_vfc) + 1)
3782 ptr = PTR_IP(ip_tos);
3783 else if (ptr == PTR_IP6(ip6_plen) ||
3784 ptr == PTR_IP6(ip6_plen) + 1)
3785 ptr = PTR_IP(ip_len);
3786 else if (ptr == PTR_IP6(ip6_nxt))
3787 ptr = PTR_IP(ip_p);
3788 else if (ptr == PTR_IP6(ip6_hlim))
3789 ptr = PTR_IP(ip_ttl);
3790 else if (ptr >= PTR_IP6(ip6_src) &&
3791 ptr < PTR_IP6(ip6_dst))
3792 ptr = PTR_IP(ip_src);
3793 else if (ptr >= PTR_IP6(ip6_dst) &&
3794 ptr < sizeof(struct ip6_hdr))
3795 ptr = PTR_IP(ip_dst);
3796 else {
3797 return (-1);
3798 }
3799 break;
3800 case ICMP6_PARAMPROB_NEXTHEADER:
3801 type = ICMP_UNREACH;
3802 code = ICMP_UNREACH_PROTOCOL;
3803 break;
3804 default:
3805 return (-1);
3806 }
3807 break;
3808 default:
3809 return (-1);
3810 }
3811 if (icmp6->icmp6_type != type) {
3812 icmp6->icmp6_cksum = pf_cksum_fixup(icmp6->icmp6_cksum,
3813 icmp6->icmp6_type, type, 0);
3814 icmp6->icmp6_type = type;
3815 }
3816 if (icmp6->icmp6_code != code) {
3817 icmp6->icmp6_cksum = pf_cksum_fixup(icmp6->icmp6_cksum,
3818 icmp6->icmp6_code, code, 0);
3819 icmp6->icmp6_code = code;
3820 }
3821 if (icmp6->icmp6_mtu != htonl(mtu)) {
3822 icmp6->icmp6_cksum = pf_cksum_fixup(icmp6->icmp6_cksum,
3823 htons(ntohl(icmp6->icmp6_mtu)), htons(mtu), 0);
3824 /* aligns well with a icmpv4 nextmtu */
3825 icmp6->icmp6_mtu = htonl(mtu);
3826 }
3827 if (ptr >= 0 && icmp6->icmp6_pptr != htonl(ptr)) {
3828 icmp6->icmp6_cksum = pf_cksum_fixup(icmp6->icmp6_cksum,
3829 htons(ntohl(icmp6->icmp6_pptr)), htons(ptr), 0);
3830 /* icmpv4 pptr is a one most significant byte */
3831 icmp6->icmp6_pptr = htonl(ptr << 24);
3832 }
3833 break;
3834 case AF_INET6:
3835 icmp4 = arg;
3836 type = icmp4->icmp_type;
3837 code = icmp4->icmp_code;
3838 mtu = ntohs(icmp4->icmp_nextmtu);
3839
3840 switch (type) {
3841 case ICMP_ECHO:
3842 type = ICMP6_ECHO_REQUEST;
3843 break;
3844 case ICMP_ECHOREPLY:
3845 type = ICMP6_ECHO_REPLY;
3846 break;
3847 case ICMP_UNREACH:
3848 type = ICMP6_DST_UNREACH;
3849 switch (code) {
3850 case ICMP_UNREACH_NET:
3851 case ICMP_UNREACH_HOST:
3852 case ICMP_UNREACH_NET_UNKNOWN:
3853 case ICMP_UNREACH_HOST_UNKNOWN:
3854 case ICMP_UNREACH_ISOLATED:
3855 case ICMP_UNREACH_TOSNET:
3856 case ICMP_UNREACH_TOSHOST:
3857 code = ICMP6_DST_UNREACH_NOROUTE;
3858 break;
3859 case ICMP_UNREACH_PORT:
3860 code = ICMP6_DST_UNREACH_NOPORT;
3861 break;
3862 case ICMP_UNREACH_NET_PROHIB:
3863 case ICMP_UNREACH_HOST_PROHIB:
3864 case ICMP_UNREACH_FILTER_PROHIB:
3865 case ICMP_UNREACH_PRECEDENCE_CUTOFF:
3866 code = ICMP6_DST_UNREACH_ADMIN;
3867 break;
3868 case ICMP_UNREACH_PROTOCOL:
3869 type = ICMP6_PARAM_PROB;
3870 code = ICMP6_PARAMPROB_NEXTHEADER;
3871 ptr = offsetof(struct ip6_hdr, ip6_nxt);
3872 break;
3873 case ICMP_UNREACH_NEEDFRAG:
3874 type = ICMP6_PACKET_TOO_BIG;
3875 code = 0;
3876 mtu += 20;
3877 break;
3878 default:
3879 return (-1);
3880 }
3881 break;
3882 case ICMP_TIMXCEED:
3883 type = ICMP6_TIME_EXCEEDED;
3884 break;
3885 case ICMP_PARAMPROB:
3886 type = ICMP6_PARAM_PROB;
3887 switch (code) {
3888 case ICMP_PARAMPROB_ERRATPTR:
3889 code = ICMP6_PARAMPROB_HEADER;
3890 break;
3891 case ICMP_PARAMPROB_LENGTH:
3892 code = ICMP6_PARAMPROB_HEADER;
3893 break;
3894 default:
3895 return (-1);
3896 }
3897
3898 ptr = icmp4->icmp_pptr;
3899 if (ptr == 0 || ptr == PTR_IP(ip_tos))
3900 ; /* preserve */
3901 else if (ptr == PTR_IP(ip_len) ||
3902 ptr == PTR_IP(ip_len) + 1)
3903 ptr = PTR_IP6(ip6_plen);
3904 else if (ptr == PTR_IP(ip_ttl))
3905 ptr = PTR_IP6(ip6_hlim);
3906 else if (ptr == PTR_IP(ip_p))
3907 ptr = PTR_IP6(ip6_nxt);
3908 else if (ptr >= PTR_IP(ip_src) && ptr < PTR_IP(ip_dst))
3909 ptr = PTR_IP6(ip6_src);
3910 else if (ptr >= PTR_IP(ip_dst) &&
3911 ptr < sizeof(struct ip))
3912 ptr = PTR_IP6(ip6_dst);
3913 else {
3914 return (-1);
3915 }
3916 break;
3917 default:
3918 return (-1);
3919 }
3920 if (icmp4->icmp_type != type) {
3921 icmp4->icmp_cksum = pf_cksum_fixup(icmp4->icmp_cksum,
3922 icmp4->icmp_type, type, 0);
3923 icmp4->icmp_type = type;
3924 }
3925 if (icmp4->icmp_code != code) {
3926 icmp4->icmp_cksum = pf_cksum_fixup(icmp4->icmp_cksum,
3927 icmp4->icmp_code, code, 0);
3928 icmp4->icmp_code = code;
3929 }
3930 if (icmp4->icmp_nextmtu != htons(mtu)) {
3931 icmp4->icmp_cksum = pf_cksum_fixup(icmp4->icmp_cksum,
3932 icmp4->icmp_nextmtu, htons(mtu), 0);
3933 icmp4->icmp_nextmtu = htons(mtu);
3934 }
3935 if (ptr >= 0 && icmp4->icmp_void != ptr) {
3936 icmp4->icmp_cksum = pf_cksum_fixup(icmp4->icmp_cksum,
3937 htons(icmp4->icmp_pptr), htons(ptr), 0);
3938 icmp4->icmp_void = htonl(ptr);
3939 }
3940 break;
3941 default:
3942 unhandled_af(af);
3943 }
3944 #endif /* INET && INET6 */
3945
3946 return (0);
3947 }
3948
3949 /*
3950 * Need to modulate the sequence numbers in the TCP SACK option
3951 * (credits to Krzysztof Pfaff for report and patch)
3952 */
3953 static int
pf_modulate_sack(struct pf_pdesc * pd,struct tcphdr * th,struct pf_state_peer * dst)3954 pf_modulate_sack(struct pf_pdesc *pd, struct tcphdr *th,
3955 struct pf_state_peer *dst)
3956 {
3957 struct sackblk sack;
3958 int copyback = 0, i;
3959 int olen, optsoff;
3960 uint8_t opts[MAX_TCPOPTLEN], *opt, *eoh;
3961
3962 olen = (pd->hdr.tcp.th_off << 2) - sizeof(struct tcphdr);
3963 optsoff = pd->off + sizeof(struct tcphdr);
3964 #define TCPOLEN_MINSACK (TCPOLEN_SACK + 2)
3965 if (olen < TCPOLEN_MINSACK ||
3966 !pf_pull_hdr(pd->m, optsoff, opts, olen, NULL, NULL, pd->af))
3967 return (0);
3968
3969 eoh = opts + olen;
3970 opt = opts;
3971 while ((opt = pf_find_tcpopt(opt, opts, olen,
3972 TCPOPT_SACK, TCPOLEN_MINSACK)) != NULL)
3973 {
3974 size_t safelen = MIN(opt[1], (eoh - opt));
3975 for (i = 2; i + TCPOLEN_SACK <= safelen; i += TCPOLEN_SACK) {
3976 size_t startoff = (opt + i) - opts;
3977 memcpy(&sack, &opt[i], sizeof(sack));
3978 pf_patch_32(pd, &sack.start,
3979 htonl(ntohl(sack.start) - dst->seqdiff),
3980 PF_ALGNMNT(startoff));
3981 pf_patch_32(pd, &sack.end,
3982 htonl(ntohl(sack.end) - dst->seqdiff),
3983 PF_ALGNMNT(startoff + sizeof(sack.start)));
3984 memcpy(&opt[i], &sack, sizeof(sack));
3985 }
3986 copyback = 1;
3987 opt += opt[1];
3988 }
3989
3990 if (copyback)
3991 m_copyback(pd->m, optsoff, olen, (caddr_t)opts);
3992
3993 return (copyback);
3994 }
3995
3996 struct mbuf *
pf_build_tcp(const struct pf_krule * r,sa_family_t af,const struct pf_addr * saddr,const struct pf_addr * daddr,u_int16_t sport,u_int16_t dport,u_int32_t seq,u_int32_t ack,u_int8_t tcp_flags,u_int16_t win,u_int16_t mss,u_int8_t ttl,int mbuf_flags,u_int16_t mtag_tag,u_int16_t mtag_flags,u_int sack,int rtableid)3997 pf_build_tcp(const struct pf_krule *r, sa_family_t af,
3998 const struct pf_addr *saddr, const struct pf_addr *daddr,
3999 u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack,
4000 u_int8_t tcp_flags, u_int16_t win, u_int16_t mss, u_int8_t ttl,
4001 int mbuf_flags, u_int16_t mtag_tag, u_int16_t mtag_flags, u_int sack,
4002 int rtableid)
4003 {
4004 struct mbuf *m;
4005 int len, tlen;
4006 #ifdef INET
4007 struct ip *h = NULL;
4008 #endif /* INET */
4009 #ifdef INET6
4010 struct ip6_hdr *h6 = NULL;
4011 #endif /* INET6 */
4012 struct tcphdr *th;
4013 char *opt;
4014 struct pf_mtag *pf_mtag;
4015
4016 len = 0;
4017 th = NULL;
4018
4019 /* maximum segment size tcp option */
4020 tlen = sizeof(struct tcphdr);
4021 if (mss)
4022 tlen += 4;
4023 if (sack)
4024 tlen += 2;
4025
4026 switch (af) {
4027 #ifdef INET
4028 case AF_INET:
4029 len = sizeof(struct ip) + tlen;
4030 break;
4031 #endif /* INET */
4032 #ifdef INET6
4033 case AF_INET6:
4034 len = sizeof(struct ip6_hdr) + tlen;
4035 break;
4036 #endif /* INET6 */
4037 default:
4038 unhandled_af(af);
4039 }
4040
4041 m = m_gethdr(M_NOWAIT, MT_DATA);
4042 if (m == NULL)
4043 return (NULL);
4044
4045 #ifdef MAC
4046 mac_netinet_firewall_send(m);
4047 #endif
4048 if ((pf_mtag = pf_get_mtag(m)) == NULL) {
4049 m_freem(m);
4050 return (NULL);
4051 }
4052 m->m_flags |= mbuf_flags;
4053 pf_mtag->tag = mtag_tag;
4054 pf_mtag->flags = mtag_flags;
4055
4056 if (rtableid >= 0)
4057 M_SETFIB(m, rtableid);
4058
4059 #ifdef ALTQ
4060 if (r != NULL && r->qid) {
4061 pf_mtag->qid = r->qid;
4062
4063 /* add hints for ecn */
4064 pf_mtag->hdr = mtod(m, struct ip *);
4065 }
4066 #endif /* ALTQ */
4067 m->m_data += max_linkhdr;
4068 m->m_pkthdr.len = m->m_len = len;
4069 /* The rest of the stack assumes a rcvif, so provide one.
4070 * This is a locally generated packet, so .. close enough. */
4071 m->m_pkthdr.rcvif = V_loif;
4072 bzero(m->m_data, len);
4073 switch (af) {
4074 #ifdef INET
4075 case AF_INET:
4076 m->m_pkthdr.csum_flags |= CSUM_TCP;
4077 m->m_pkthdr.csum_data = offsetof(struct tcphdr, th_sum);
4078
4079 h = mtod(m, struct ip *);
4080
4081 h->ip_p = IPPROTO_TCP;
4082 h->ip_len = htons(tlen);
4083 h->ip_v = 4;
4084 h->ip_hl = sizeof(*h) >> 2;
4085 h->ip_tos = IPTOS_LOWDELAY;
4086 h->ip_len = htons(len);
4087 h->ip_off = htons(V_path_mtu_discovery ? IP_DF : 0);
4088 h->ip_ttl = ttl ? ttl : V_ip_defttl;
4089 h->ip_sum = 0;
4090 h->ip_src.s_addr = saddr->v4.s_addr;
4091 h->ip_dst.s_addr = daddr->v4.s_addr;
4092
4093 th = (struct tcphdr *)((caddr_t)h + sizeof(struct ip));
4094 th->th_sum = in_pseudo(h->ip_src.s_addr, h->ip_dst.s_addr,
4095 htons(len - sizeof(struct ip) + IPPROTO_TCP));
4096 break;
4097 #endif /* INET */
4098 #ifdef INET6
4099 case AF_INET6:
4100 m->m_pkthdr.csum_flags |= CSUM_TCP_IPV6;
4101 m->m_pkthdr.csum_data = offsetof(struct tcphdr, th_sum);
4102
4103 h6 = mtod(m, struct ip6_hdr *);
4104
4105 /* IP header fields included in the TCP checksum */
4106 h6->ip6_nxt = IPPROTO_TCP;
4107 h6->ip6_plen = htons(tlen);
4108 h6->ip6_vfc |= IPV6_VERSION;
4109 h6->ip6_hlim = V_ip6_defhlim;
4110 memcpy(&h6->ip6_src, &saddr->v6, sizeof(struct in6_addr));
4111 memcpy(&h6->ip6_dst, &daddr->v6, sizeof(struct in6_addr));
4112
4113 th = (struct tcphdr *)((caddr_t)h6 + sizeof(struct ip6_hdr));
4114 th->th_sum = in6_cksum_pseudo(h6, len - sizeof(struct ip6_hdr),
4115 IPPROTO_TCP, 0);
4116 break;
4117 #endif /* INET6 */
4118 }
4119
4120 /* TCP header */
4121 th->th_sport = sport;
4122 th->th_dport = dport;
4123 th->th_seq = htonl(seq);
4124 th->th_ack = htonl(ack);
4125 th->th_off = tlen >> 2;
4126 tcp_set_flags(th, tcp_flags);
4127 th->th_win = htons(win);
4128
4129 opt = (char *)(th + 1);
4130 if (mss) {
4131 opt = (char *)(th + 1);
4132 opt[0] = TCPOPT_MAXSEG;
4133 opt[1] = 4;
4134 mss = htons(mss);
4135 memcpy((opt + 2), &mss, 2);
4136 opt += 4;
4137 }
4138 if (sack) {
4139 opt[0] = TCPOPT_SACK_PERMITTED;
4140 opt[1] = 2;
4141 opt += 2;
4142 }
4143
4144 return (m);
4145 }
4146
4147 static void
pf_send_sctp_abort(sa_family_t af,struct pf_pdesc * pd,uint8_t ttl,int rtableid)4148 pf_send_sctp_abort(sa_family_t af, struct pf_pdesc *pd,
4149 uint8_t ttl, int rtableid)
4150 {
4151 struct mbuf *m;
4152 #ifdef INET
4153 struct ip *h = NULL;
4154 #endif /* INET */
4155 #ifdef INET6
4156 struct ip6_hdr *h6 = NULL;
4157 #endif /* INET6 */
4158 struct sctphdr *hdr;
4159 struct sctp_chunkhdr *chunk;
4160 struct pf_send_entry *pfse;
4161 int off = 0;
4162
4163 MPASS(af == pd->af);
4164
4165 m = m_gethdr(M_NOWAIT, MT_DATA);
4166 if (m == NULL)
4167 return;
4168
4169 m->m_data += max_linkhdr;
4170 m->m_flags |= M_SKIP_FIREWALL;
4171 /* The rest of the stack assumes a rcvif, so provide one.
4172 * This is a locally generated packet, so .. close enough. */
4173 m->m_pkthdr.rcvif = V_loif;
4174
4175 /* IPv4|6 header */
4176 switch (af) {
4177 #ifdef INET
4178 case AF_INET:
4179 bzero(m->m_data, sizeof(struct ip) + sizeof(*hdr) + sizeof(*chunk));
4180
4181 h = mtod(m, struct ip *);
4182
4183 /* IP header fields included in the TCP checksum */
4184
4185 h->ip_p = IPPROTO_SCTP;
4186 h->ip_len = htons(sizeof(*h) + sizeof(*hdr) + sizeof(*chunk));
4187 h->ip_ttl = ttl ? ttl : V_ip_defttl;
4188 h->ip_src = pd->dst->v4;
4189 h->ip_dst = pd->src->v4;
4190
4191 off += sizeof(struct ip);
4192 break;
4193 #endif /* INET */
4194 #ifdef INET6
4195 case AF_INET6:
4196 bzero(m->m_data, sizeof(struct ip6_hdr) + sizeof(*hdr) + sizeof(*chunk));
4197
4198 h6 = mtod(m, struct ip6_hdr *);
4199
4200 /* IP header fields included in the TCP checksum */
4201 h6->ip6_vfc |= IPV6_VERSION;
4202 h6->ip6_nxt = IPPROTO_SCTP;
4203 h6->ip6_plen = htons(sizeof(*h6) + sizeof(*hdr) + sizeof(*chunk));
4204 h6->ip6_hlim = ttl ? ttl : V_ip6_defhlim;
4205 memcpy(&h6->ip6_src, &pd->dst->v6, sizeof(struct in6_addr));
4206 memcpy(&h6->ip6_dst, &pd->src->v6, sizeof(struct in6_addr));
4207
4208 off += sizeof(struct ip6_hdr);
4209 break;
4210 #endif /* INET6 */
4211 default:
4212 unhandled_af(af);
4213 }
4214
4215 /* SCTP header */
4216 hdr = mtodo(m, off);
4217
4218 hdr->src_port = pd->hdr.sctp.dest_port;
4219 hdr->dest_port = pd->hdr.sctp.src_port;
4220 hdr->v_tag = pd->sctp_initiate_tag;
4221 hdr->checksum = 0;
4222
4223 /* Abort chunk. */
4224 off += sizeof(struct sctphdr);
4225 chunk = mtodo(m, off);
4226
4227 chunk->chunk_type = SCTP_ABORT_ASSOCIATION;
4228 chunk->chunk_length = htons(sizeof(*chunk));
4229
4230 /* SCTP checksum */
4231 off += sizeof(*chunk);
4232 m->m_pkthdr.len = m->m_len = off;
4233
4234 pf_sctp_checksum(m, off - sizeof(*hdr) - sizeof(*chunk));
4235
4236 if (rtableid >= 0)
4237 M_SETFIB(m, rtableid);
4238
4239 /* Allocate outgoing queue entry, mbuf and mbuf tag. */
4240 pfse = malloc(sizeof(*pfse), M_PFTEMP, M_NOWAIT);
4241 if (pfse == NULL) {
4242 m_freem(m);
4243 return;
4244 }
4245
4246 switch (af) {
4247 #ifdef INET
4248 case AF_INET:
4249 pfse->pfse_type = PFSE_IP;
4250 break;
4251 #endif /* INET */
4252 #ifdef INET6
4253 case AF_INET6:
4254 pfse->pfse_type = PFSE_IP6;
4255 break;
4256 #endif /* INET6 */
4257 }
4258
4259 pfse->pfse_m = m;
4260 pf_send(pfse);
4261 }
4262
4263 void
pf_send_tcp(const struct pf_krule * r,sa_family_t af,const struct pf_addr * saddr,const struct pf_addr * daddr,u_int16_t sport,u_int16_t dport,u_int32_t seq,u_int32_t ack,u_int8_t tcp_flags,u_int16_t win,u_int16_t mss,u_int8_t ttl,int mbuf_flags,u_int16_t mtag_tag,u_int16_t mtag_flags,int rtableid)4264 pf_send_tcp(const struct pf_krule *r, sa_family_t af,
4265 const struct pf_addr *saddr, const struct pf_addr *daddr,
4266 u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack,
4267 u_int8_t tcp_flags, u_int16_t win, u_int16_t mss, u_int8_t ttl,
4268 int mbuf_flags, u_int16_t mtag_tag, u_int16_t mtag_flags, int rtableid)
4269 {
4270 struct pf_send_entry *pfse;
4271 struct mbuf *m;
4272
4273 m = pf_build_tcp(r, af, saddr, daddr, sport, dport, seq, ack, tcp_flags,
4274 win, mss, ttl, mbuf_flags, mtag_tag, mtag_flags, 0, rtableid);
4275 if (m == NULL)
4276 return;
4277
4278 /* Allocate outgoing queue entry, mbuf and mbuf tag. */
4279 pfse = malloc(sizeof(*pfse), M_PFTEMP, M_NOWAIT);
4280 if (pfse == NULL) {
4281 m_freem(m);
4282 return;
4283 }
4284
4285 switch (af) {
4286 #ifdef INET
4287 case AF_INET:
4288 pfse->pfse_type = PFSE_IP;
4289 break;
4290 #endif /* INET */
4291 #ifdef INET6
4292 case AF_INET6:
4293 pfse->pfse_type = PFSE_IP6;
4294 break;
4295 #endif /* INET6 */
4296 default:
4297 unhandled_af(af);
4298 }
4299
4300 pfse->pfse_m = m;
4301 pf_send(pfse);
4302 }
4303
4304 static void
pf_undo_nat(struct pf_krule * nr,struct pf_pdesc * pd,uint16_t bip_sum)4305 pf_undo_nat(struct pf_krule *nr, struct pf_pdesc *pd, uint16_t bip_sum)
4306 {
4307 /* undo NAT changes, if they have taken place */
4308 if (nr != NULL) {
4309 pf_addrcpy(pd->src, &pd->osrc, pd->af);
4310 pf_addrcpy(pd->dst, &pd->odst, pd->af);
4311 if (pd->sport)
4312 *pd->sport = pd->osport;
4313 if (pd->dport)
4314 *pd->dport = pd->odport;
4315 if (pd->ip_sum)
4316 *pd->ip_sum = bip_sum;
4317 m_copyback(pd->m, pd->off, pd->hdrlen, pd->hdr.any);
4318 }
4319 }
4320
4321 static void
pf_return(struct pf_krule * r,struct pf_krule * nr,struct pf_pdesc * pd,struct tcphdr * th,u_int16_t bproto_sum,u_int16_t bip_sum,u_short * reason,int rtableid)4322 pf_return(struct pf_krule *r, struct pf_krule *nr, struct pf_pdesc *pd,
4323 struct tcphdr *th, u_int16_t bproto_sum, u_int16_t bip_sum,
4324 u_short *reason, int rtableid)
4325 {
4326 pf_undo_nat(nr, pd, bip_sum);
4327
4328 if (pd->proto == IPPROTO_TCP &&
4329 ((r->rule_flag & PFRULE_RETURNRST) ||
4330 (r->rule_flag & PFRULE_RETURN)) &&
4331 !(tcp_get_flags(th) & TH_RST)) {
4332 u_int32_t ack = ntohl(th->th_seq) + pd->p_len;
4333
4334 if (pf_check_proto_cksum(pd->m, pd->off, pd->tot_len - pd->off,
4335 IPPROTO_TCP, pd->af))
4336 REASON_SET(reason, PFRES_PROTCKSUM);
4337 else {
4338 if (tcp_get_flags(th) & TH_SYN)
4339 ack++;
4340 if (tcp_get_flags(th) & TH_FIN)
4341 ack++;
4342 pf_send_tcp(r, pd->af, pd->dst,
4343 pd->src, th->th_dport, th->th_sport,
4344 ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0,
4345 r->return_ttl, M_SKIP_FIREWALL, 0, 0, rtableid);
4346 }
4347 } else if (pd->proto == IPPROTO_SCTP &&
4348 (r->rule_flag & PFRULE_RETURN)) {
4349 pf_send_sctp_abort(pd->af, pd, r->return_ttl, rtableid);
4350 } else if (pd->proto != IPPROTO_ICMP && pd->af == AF_INET &&
4351 r->return_icmp)
4352 pf_send_icmp(pd->m, r->return_icmp >> 8,
4353 r->return_icmp & 255, 0, pd->af, r, rtableid);
4354 else if (pd->proto != IPPROTO_ICMPV6 && pd->af == AF_INET6 &&
4355 r->return_icmp6)
4356 pf_send_icmp(pd->m, r->return_icmp6 >> 8,
4357 r->return_icmp6 & 255, 0, pd->af, r, rtableid);
4358 }
4359
4360 static int
pf_match_ieee8021q_pcp(u_int8_t prio,struct mbuf * m)4361 pf_match_ieee8021q_pcp(u_int8_t prio, struct mbuf *m)
4362 {
4363 struct m_tag *mtag;
4364 u_int8_t mpcp;
4365
4366 mtag = m_tag_locate(m, MTAG_8021Q, MTAG_8021Q_PCP_IN, NULL);
4367 if (mtag == NULL)
4368 return (0);
4369
4370 if (prio == PF_PRIO_ZERO)
4371 prio = 0;
4372
4373 mpcp = *(uint8_t *)(mtag + 1);
4374
4375 return (mpcp == prio);
4376 }
4377
4378 static int
pf_icmp_to_bandlim(uint8_t type)4379 pf_icmp_to_bandlim(uint8_t type)
4380 {
4381 switch (type) {
4382 case ICMP_ECHO:
4383 case ICMP_ECHOREPLY:
4384 return (BANDLIM_ICMP_ECHO);
4385 case ICMP_TSTAMP:
4386 case ICMP_TSTAMPREPLY:
4387 return (BANDLIM_ICMP_TSTAMP);
4388 case ICMP_UNREACH:
4389 default:
4390 return (BANDLIM_ICMP_UNREACH);
4391 }
4392 }
4393
4394 static void
pf_send_challenge_ack(struct pf_pdesc * pd,struct pf_kstate * s,struct pf_state_peer * src,struct pf_state_peer * dst)4395 pf_send_challenge_ack(struct pf_pdesc *pd, struct pf_kstate *s,
4396 struct pf_state_peer *src, struct pf_state_peer *dst)
4397 {
4398 /*
4399 * We are sending challenge ACK as a response to SYN packet, which
4400 * matches existing state (modulo TCP window check). Therefore packet
4401 * must be sent on behalf of destination.
4402 *
4403 * We expect sender to remain either silent, or send RST packet
4404 * so both, firewall and remote peer, can purge dead state from
4405 * memory.
4406 */
4407 pf_send_tcp(s->rule, pd->af, pd->dst, pd->src,
4408 pd->hdr.tcp.th_dport, pd->hdr.tcp.th_sport, dst->seqlo,
4409 src->seqlo, TH_ACK, 0, 0, s->rule->return_ttl, 0, 0, 0,
4410 s->rule->rtableid);
4411 }
4412
4413 static void
pf_send_icmp(struct mbuf * m,u_int8_t type,u_int8_t code,int mtu,sa_family_t af,struct pf_krule * r,int rtableid)4414 pf_send_icmp(struct mbuf *m, u_int8_t type, u_int8_t code, int mtu,
4415 sa_family_t af, struct pf_krule *r, int rtableid)
4416 {
4417 struct pf_send_entry *pfse;
4418 struct mbuf *m0;
4419 struct pf_mtag *pf_mtag;
4420
4421 /* ICMP packet rate limitation. */
4422 switch (af) {
4423 #ifdef INET6
4424 case AF_INET6:
4425 if (icmp6_ratelimit(NULL, type, code))
4426 return;
4427 break;
4428 #endif /* INET6 */
4429 #ifdef INET
4430 case AF_INET:
4431 if (badport_bandlim(pf_icmp_to_bandlim(type)) != 0)
4432 return;
4433 break;
4434 #endif /* INET */
4435 }
4436
4437 /* Allocate outgoing queue entry, mbuf and mbuf tag. */
4438 pfse = malloc(sizeof(*pfse), M_PFTEMP, M_NOWAIT);
4439 if (pfse == NULL)
4440 return;
4441
4442 if ((m0 = m_copypacket(m, M_NOWAIT)) == NULL) {
4443 free(pfse, M_PFTEMP);
4444 return;
4445 }
4446
4447 if ((pf_mtag = pf_get_mtag(m0)) == NULL) {
4448 free(pfse, M_PFTEMP);
4449 return;
4450 }
4451 /* XXX: revisit */
4452 m0->m_flags |= M_SKIP_FIREWALL;
4453
4454 if (rtableid >= 0)
4455 M_SETFIB(m0, rtableid);
4456
4457 #ifdef ALTQ
4458 if (r->qid) {
4459 pf_mtag->qid = r->qid;
4460 /* add hints for ecn */
4461 pf_mtag->hdr = mtod(m0, struct ip *);
4462 }
4463 #endif /* ALTQ */
4464
4465 switch (af) {
4466 #ifdef INET
4467 case AF_INET:
4468 pfse->pfse_type = PFSE_ICMP;
4469 break;
4470 #endif /* INET */
4471 #ifdef INET6
4472 case AF_INET6:
4473 pfse->pfse_type = PFSE_ICMP6;
4474 break;
4475 #endif /* INET6 */
4476 }
4477 pfse->pfse_m = m0;
4478 pfse->icmpopts.type = type;
4479 pfse->icmpopts.code = code;
4480 pfse->icmpopts.mtu = mtu;
4481 pf_send(pfse);
4482 }
4483
4484 /*
4485 * Return ((n = 0) == (a = b [with mask m]))
4486 * Note: n != 0 => returns (a != b [with mask m])
4487 */
4488 int
pf_match_addr(u_int8_t n,const struct pf_addr * a,const struct pf_addr * m,const struct pf_addr * b,sa_family_t af)4489 pf_match_addr(u_int8_t n, const struct pf_addr *a, const struct pf_addr *m,
4490 const struct pf_addr *b, sa_family_t af)
4491 {
4492 switch (af) {
4493 #ifdef INET
4494 case AF_INET:
4495 if (IN_ARE_MASKED_ADDR_EQUAL(a->v4, b->v4, m->v4))
4496 return (n == 0);
4497 break;
4498 #endif /* INET */
4499 #ifdef INET6
4500 case AF_INET6:
4501 if (IN6_ARE_MASKED_ADDR_EQUAL(&a->v6, &b->v6, &m->v6))
4502 return (n == 0);
4503 break;
4504 #endif /* INET6 */
4505 }
4506
4507 return (n != 0);
4508 }
4509
4510 /*
4511 * Return 1 if b <= a <= e, otherwise return 0.
4512 */
4513 int
pf_match_addr_range(const struct pf_addr * b,const struct pf_addr * e,const struct pf_addr * a,sa_family_t af)4514 pf_match_addr_range(const struct pf_addr *b, const struct pf_addr *e,
4515 const struct pf_addr *a, sa_family_t af)
4516 {
4517 switch (af) {
4518 #ifdef INET
4519 case AF_INET:
4520 if ((ntohl(a->addr32[0]) < ntohl(b->addr32[0])) ||
4521 (ntohl(a->addr32[0]) > ntohl(e->addr32[0])))
4522 return (0);
4523 break;
4524 #endif /* INET */
4525 #ifdef INET6
4526 case AF_INET6: {
4527 int i;
4528
4529 /* check a >= b */
4530 for (i = 0; i < 4; ++i)
4531 if (ntohl(a->addr32[i]) > ntohl(b->addr32[i]))
4532 break;
4533 else if (ntohl(a->addr32[i]) < ntohl(b->addr32[i]))
4534 return (0);
4535 /* check a <= e */
4536 for (i = 0; i < 4; ++i)
4537 if (ntohl(a->addr32[i]) < ntohl(e->addr32[i]))
4538 break;
4539 else if (ntohl(a->addr32[i]) > ntohl(e->addr32[i]))
4540 return (0);
4541 break;
4542 }
4543 #endif /* INET6 */
4544 }
4545 return (1);
4546 }
4547
4548 static int
pf_match(u_int8_t op,u_int32_t a1,u_int32_t a2,u_int32_t p)4549 pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p)
4550 {
4551 switch (op) {
4552 case PF_OP_IRG:
4553 return ((p > a1) && (p < a2));
4554 case PF_OP_XRG:
4555 return ((p < a1) || (p > a2));
4556 case PF_OP_RRG:
4557 return ((p >= a1) && (p <= a2));
4558 case PF_OP_EQ:
4559 return (p == a1);
4560 case PF_OP_NE:
4561 return (p != a1);
4562 case PF_OP_LT:
4563 return (p < a1);
4564 case PF_OP_LE:
4565 return (p <= a1);
4566 case PF_OP_GT:
4567 return (p > a1);
4568 case PF_OP_GE:
4569 return (p >= a1);
4570 }
4571 return (0); /* never reached */
4572 }
4573
4574 int
pf_match_port(u_int8_t op,u_int16_t a1,u_int16_t a2,u_int16_t p)4575 pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p)
4576 {
4577 return (pf_match(op, ntohs(a1), ntohs(a2), ntohs(p)));
4578 }
4579
4580 static int
pf_match_uid(u_int8_t op,uid_t a1,uid_t a2,uid_t u)4581 pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u)
4582 {
4583 if (u == -1 && op != PF_OP_EQ && op != PF_OP_NE)
4584 return (0);
4585 return (pf_match(op, a1, a2, u));
4586 }
4587
4588 static int
pf_match_gid(u_int8_t op,gid_t a1,gid_t a2,gid_t g)4589 pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g)
4590 {
4591 if (g == -1 && op != PF_OP_EQ && op != PF_OP_NE)
4592 return (0);
4593 return (pf_match(op, a1, a2, g));
4594 }
4595
4596 int
pf_match_tag(struct mbuf * m,struct pf_krule * r,int * tag,int mtag)4597 pf_match_tag(struct mbuf *m, struct pf_krule *r, int *tag, int mtag)
4598 {
4599 if (*tag == -1)
4600 *tag = mtag;
4601
4602 return ((!r->match_tag_not && r->match_tag == *tag) ||
4603 (r->match_tag_not && r->match_tag != *tag));
4604 }
4605
4606 static int
pf_match_rcvif(struct mbuf * m,struct pf_krule * r)4607 pf_match_rcvif(struct mbuf *m, struct pf_krule *r)
4608 {
4609 struct ifnet *ifp = m->m_pkthdr.rcvif;
4610 struct pfi_kkif *kif;
4611
4612 if (ifp == NULL)
4613 return (0);
4614
4615 kif = (struct pfi_kkif *)ifp->if_pf_kif;
4616
4617 if (kif == NULL) {
4618 DPFPRINTF(PF_DEBUG_URGENT,
4619 "%s: kif == NULL, @%d via %s", __func__, r->nr,
4620 r->rcv_ifname);
4621 return (0);
4622 }
4623
4624 return (pfi_kkif_match(r->rcv_kif, kif));
4625 }
4626
4627 int
pf_tag_packet(struct pf_pdesc * pd,int tag)4628 pf_tag_packet(struct pf_pdesc *pd, int tag)
4629 {
4630
4631 KASSERT(tag > 0, ("%s: tag %d", __func__, tag));
4632
4633 if (pd->pf_mtag == NULL && ((pd->pf_mtag = pf_get_mtag(pd->m)) == NULL))
4634 return (ENOMEM);
4635
4636 pd->pf_mtag->tag = tag;
4637
4638 return (0);
4639 }
4640
4641 /*
4642 * XXX: We rely on malloc(9) returning pointer aligned addresses.
4643 */
4644 #define PF_ANCHORSTACK_MATCH 0x00000001
4645 #define PF_ANCHORSTACK_MASK (PF_ANCHORSTACK_MATCH)
4646
4647 #define PF_ANCHOR_MATCH(f) ((uintptr_t)(f)->r & PF_ANCHORSTACK_MATCH)
4648 #define PF_ANCHOR_RULE(f) (struct pf_krule *) \
4649 ((uintptr_t)(f)->r & ~PF_ANCHORSTACK_MASK)
4650 #define PF_ANCHOR_SET_MATCH(f) do { (f)->r = (void *) \
4651 ((uintptr_t)(f)->r | PF_ANCHORSTACK_MATCH); \
4652 } while (0)
4653
4654 enum pf_test_status
pf_step_into_anchor(struct pf_test_ctx * ctx,struct pf_krule * r)4655 pf_step_into_anchor(struct pf_test_ctx *ctx, struct pf_krule *r)
4656 {
4657 enum pf_test_status rv;
4658
4659 PF_RULES_RASSERT();
4660
4661 if (ctx->depth >= PF_ANCHOR_STACK_MAX) {
4662 printf("%s: anchor stack overflow on %s\n",
4663 __func__, r->anchor->name);
4664 return (PF_TEST_FAIL);
4665 }
4666
4667 ctx->depth++;
4668
4669 if (r->anchor_wildcard) {
4670 struct pf_kanchor *child;
4671 rv = PF_TEST_OK;
4672 RB_FOREACH(child, pf_kanchor_node, &r->anchor->children) {
4673 rv = pf_match_rule(ctx, &child->ruleset);
4674 if ((rv == PF_TEST_QUICK) || (rv == PF_TEST_FAIL)) {
4675 /*
4676 * we either hit a rule with quick action
4677 * (more likely), or hit some runtime
4678 * error (e.g. pool_get() failure).
4679 */
4680 break;
4681 }
4682 }
4683 } else {
4684 rv = pf_match_rule(ctx, &r->anchor->ruleset);
4685 /*
4686 * Unless errors occured, stop iff any rule matched
4687 * within quick anchors.
4688 */
4689 if (rv != PF_TEST_FAIL && r->quick == PF_TEST_QUICK &&
4690 *ctx->am == r)
4691 rv = PF_TEST_QUICK;
4692 }
4693
4694 ctx->depth--;
4695
4696 return (rv);
4697 }
4698
4699 struct pf_keth_anchor_stackframe {
4700 struct pf_keth_ruleset *rs;
4701 struct pf_keth_rule *r; /* XXX: + match bit */
4702 struct pf_keth_anchor *child;
4703 };
4704
4705 #define PF_ETH_ANCHOR_MATCH(f) ((uintptr_t)(f)->r & PF_ANCHORSTACK_MATCH)
4706 #define PF_ETH_ANCHOR_RULE(f) (struct pf_keth_rule *) \
4707 ((uintptr_t)(f)->r & ~PF_ANCHORSTACK_MASK)
4708 #define PF_ETH_ANCHOR_SET_MATCH(f) do { (f)->r = (void *) \
4709 ((uintptr_t)(f)->r | PF_ANCHORSTACK_MATCH); \
4710 } while (0)
4711
4712 void
pf_step_into_keth_anchor(struct pf_keth_anchor_stackframe * stack,int * depth,struct pf_keth_ruleset ** rs,struct pf_keth_rule ** r,struct pf_keth_rule ** a,int * match)4713 pf_step_into_keth_anchor(struct pf_keth_anchor_stackframe *stack, int *depth,
4714 struct pf_keth_ruleset **rs, struct pf_keth_rule **r,
4715 struct pf_keth_rule **a, int *match)
4716 {
4717 struct pf_keth_anchor_stackframe *f;
4718
4719 NET_EPOCH_ASSERT();
4720
4721 if (match)
4722 *match = 0;
4723 if (*depth >= PF_ANCHOR_STACK_MAX) {
4724 printf("%s: anchor stack overflow on %s\n",
4725 __func__, (*r)->anchor->name);
4726 *r = TAILQ_NEXT(*r, entries);
4727 return;
4728 } else if (*depth == 0 && a != NULL)
4729 *a = *r;
4730 f = stack + (*depth)++;
4731 f->rs = *rs;
4732 f->r = *r;
4733 if ((*r)->anchor_wildcard) {
4734 struct pf_keth_anchor_node *parent = &(*r)->anchor->children;
4735
4736 if ((f->child = RB_MIN(pf_keth_anchor_node, parent)) == NULL) {
4737 *r = NULL;
4738 return;
4739 }
4740 *rs = &f->child->ruleset;
4741 } else {
4742 f->child = NULL;
4743 *rs = &(*r)->anchor->ruleset;
4744 }
4745 *r = TAILQ_FIRST((*rs)->active.rules);
4746 }
4747
4748 int
pf_step_out_of_keth_anchor(struct pf_keth_anchor_stackframe * stack,int * depth,struct pf_keth_ruleset ** rs,struct pf_keth_rule ** r,struct pf_keth_rule ** a,int * match)4749 pf_step_out_of_keth_anchor(struct pf_keth_anchor_stackframe *stack, int *depth,
4750 struct pf_keth_ruleset **rs, struct pf_keth_rule **r,
4751 struct pf_keth_rule **a, int *match)
4752 {
4753 struct pf_keth_anchor_stackframe *f;
4754 struct pf_keth_rule *fr;
4755 int quick = 0;
4756
4757 NET_EPOCH_ASSERT();
4758
4759 do {
4760 if (*depth <= 0)
4761 break;
4762 f = stack + *depth - 1;
4763 fr = PF_ETH_ANCHOR_RULE(f);
4764 if (f->child != NULL) {
4765 /*
4766 * This block traverses through
4767 * a wildcard anchor.
4768 */
4769 if (match != NULL && *match) {
4770 /*
4771 * If any of "*" matched, then
4772 * "foo/ *" matched, mark frame
4773 * appropriately.
4774 */
4775 PF_ETH_ANCHOR_SET_MATCH(f);
4776 *match = 0;
4777 }
4778 f->child = RB_NEXT(pf_keth_anchor_node,
4779 &fr->anchor->children, f->child);
4780 if (f->child != NULL) {
4781 *rs = &f->child->ruleset;
4782 *r = TAILQ_FIRST((*rs)->active.rules);
4783 if (*r == NULL)
4784 continue;
4785 else
4786 break;
4787 }
4788 }
4789 (*depth)--;
4790 if (*depth == 0 && a != NULL)
4791 *a = NULL;
4792 *rs = f->rs;
4793 if (PF_ETH_ANCHOR_MATCH(f) || (match != NULL && *match))
4794 quick = fr->quick;
4795 *r = TAILQ_NEXT(fr, entries);
4796 } while (*r == NULL);
4797
4798 return (quick);
4799 }
4800
4801 void
pf_poolmask(struct pf_addr * naddr,struct pf_addr * raddr,struct pf_addr * rmask,struct pf_addr * saddr,sa_family_t af)4802 pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr,
4803 struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af)
4804 {
4805 switch (af) {
4806 #ifdef INET
4807 case AF_INET:
4808 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
4809 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]);
4810 break;
4811 #endif /* INET */
4812 #ifdef INET6
4813 case AF_INET6:
4814 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
4815 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]);
4816 naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) |
4817 ((rmask->addr32[1] ^ 0xffffffff ) & saddr->addr32[1]);
4818 naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) |
4819 ((rmask->addr32[2] ^ 0xffffffff ) & saddr->addr32[2]);
4820 naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) |
4821 ((rmask->addr32[3] ^ 0xffffffff ) & saddr->addr32[3]);
4822 break;
4823 #endif /* INET6 */
4824 }
4825 }
4826
4827 void
pf_addr_inc(struct pf_addr * addr,sa_family_t af)4828 pf_addr_inc(struct pf_addr *addr, sa_family_t af)
4829 {
4830 switch (af) {
4831 #ifdef INET
4832 case AF_INET:
4833 addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1);
4834 break;
4835 #endif /* INET */
4836 #ifdef INET6
4837 case AF_INET6:
4838 if (addr->addr32[3] == 0xffffffff) {
4839 addr->addr32[3] = 0;
4840 if (addr->addr32[2] == 0xffffffff) {
4841 addr->addr32[2] = 0;
4842 if (addr->addr32[1] == 0xffffffff) {
4843 addr->addr32[1] = 0;
4844 addr->addr32[0] =
4845 htonl(ntohl(addr->addr32[0]) + 1);
4846 } else
4847 addr->addr32[1] =
4848 htonl(ntohl(addr->addr32[1]) + 1);
4849 } else
4850 addr->addr32[2] =
4851 htonl(ntohl(addr->addr32[2]) + 1);
4852 } else
4853 addr->addr32[3] =
4854 htonl(ntohl(addr->addr32[3]) + 1);
4855 break;
4856 #endif /* INET6 */
4857 }
4858 }
4859
4860 void
pf_rule_to_actions(struct pf_krule * r,struct pf_rule_actions * a)4861 pf_rule_to_actions(struct pf_krule *r, struct pf_rule_actions *a)
4862 {
4863 /*
4864 * Modern rules use the same flags in rules as they do in states.
4865 */
4866 a->flags |= (r->scrub_flags & (PFSTATE_NODF|PFSTATE_RANDOMID|
4867 PFSTATE_SCRUB_TCP|PFSTATE_SETPRIO));
4868
4869 /*
4870 * Old-style scrub rules have different flags which need to be translated.
4871 */
4872 if (r->rule_flag & PFRULE_RANDOMID)
4873 a->flags |= PFSTATE_RANDOMID;
4874 if (r->scrub_flags & PFSTATE_SETTOS || r->rule_flag & PFRULE_SET_TOS ) {
4875 a->flags |= PFSTATE_SETTOS;
4876 a->set_tos = r->set_tos;
4877 }
4878
4879 if (r->qid)
4880 a->qid = r->qid;
4881 if (r->pqid)
4882 a->pqid = r->pqid;
4883 if (r->rtableid >= 0)
4884 a->rtableid = r->rtableid;
4885 a->log |= r->log;
4886 if (r->min_ttl)
4887 a->min_ttl = r->min_ttl;
4888 if (r->max_mss)
4889 a->max_mss = r->max_mss;
4890 if (r->dnpipe)
4891 a->dnpipe = r->dnpipe;
4892 if (r->dnrpipe)
4893 a->dnrpipe = r->dnrpipe;
4894 if (r->dnpipe || r->dnrpipe) {
4895 if (r->free_flags & PFRULE_DN_IS_PIPE)
4896 a->flags |= PFSTATE_DN_IS_PIPE;
4897 else
4898 a->flags &= ~PFSTATE_DN_IS_PIPE;
4899 }
4900 if (r->scrub_flags & PFSTATE_SETPRIO) {
4901 a->set_prio[0] = r->set_prio[0];
4902 a->set_prio[1] = r->set_prio[1];
4903 }
4904 if (r->allow_opts)
4905 a->allow_opts = r->allow_opts;
4906 if (r->max_pkt_size)
4907 a->max_pkt_size = r->max_pkt_size;
4908 }
4909
4910 int
pf_socket_lookup(struct pf_pdesc * pd)4911 pf_socket_lookup(struct pf_pdesc *pd)
4912 {
4913 struct pf_addr *saddr, *daddr;
4914 u_int16_t sport, dport;
4915 struct inpcbinfo *pi;
4916 struct inpcb *inp;
4917
4918 pd->lookup.uid = -1;
4919 pd->lookup.gid = -1;
4920
4921 switch (pd->proto) {
4922 case IPPROTO_TCP:
4923 sport = pd->hdr.tcp.th_sport;
4924 dport = pd->hdr.tcp.th_dport;
4925 pi = &V_tcbinfo;
4926 break;
4927 case IPPROTO_UDP:
4928 sport = pd->hdr.udp.uh_sport;
4929 dport = pd->hdr.udp.uh_dport;
4930 pi = &V_udbinfo;
4931 break;
4932 default:
4933 return (-1);
4934 }
4935 if (pd->dir == PF_IN) {
4936 saddr = pd->src;
4937 daddr = pd->dst;
4938 } else {
4939 u_int16_t p;
4940
4941 p = sport;
4942 sport = dport;
4943 dport = p;
4944 saddr = pd->dst;
4945 daddr = pd->src;
4946 }
4947 switch (pd->af) {
4948 #ifdef INET
4949 case AF_INET:
4950 inp = in_pcblookup_mbuf(pi, saddr->v4, sport, daddr->v4,
4951 dport, INPLOOKUP_RLOCKPCB, NULL, pd->m);
4952 if (inp == NULL) {
4953 inp = in_pcblookup_mbuf(pi, saddr->v4, sport,
4954 daddr->v4, dport, INPLOOKUP_WILDCARD |
4955 INPLOOKUP_RLOCKPCB, NULL, pd->m);
4956 if (inp == NULL)
4957 return (-1);
4958 }
4959 break;
4960 #endif /* INET */
4961 #ifdef INET6
4962 case AF_INET6:
4963 inp = in6_pcblookup_mbuf(pi, &saddr->v6, sport, &daddr->v6,
4964 dport, INPLOOKUP_RLOCKPCB, NULL, pd->m);
4965 if (inp == NULL) {
4966 inp = in6_pcblookup_mbuf(pi, &saddr->v6, sport,
4967 &daddr->v6, dport, INPLOOKUP_WILDCARD |
4968 INPLOOKUP_RLOCKPCB, NULL, pd->m);
4969 if (inp == NULL)
4970 return (-1);
4971 }
4972 break;
4973 #endif /* INET6 */
4974 default:
4975 unhandled_af(pd->af);
4976 }
4977 INP_RLOCK_ASSERT(inp);
4978 pd->lookup.uid = inp->inp_cred->cr_uid;
4979 pd->lookup.gid = inp->inp_cred->cr_gid;
4980 INP_RUNLOCK(inp);
4981
4982 return (1);
4983 }
4984
4985 /* post: r => (r[0] == type /\ r[1] >= min_typelen >= 2 "validity"
4986 * /\ (eoh - r) >= min_typelen >= 2 "safety" )
4987 *
4988 * warning: r + r[1] may exceed opts bounds for r[1] > min_typelen
4989 */
4990 uint8_t*
pf_find_tcpopt(u_int8_t * opt,u_int8_t * opts,size_t hlen,u_int8_t type,u_int8_t min_typelen)4991 pf_find_tcpopt(u_int8_t *opt, u_int8_t *opts, size_t hlen, u_int8_t type,
4992 u_int8_t min_typelen)
4993 {
4994 uint8_t *eoh = opts + hlen;
4995
4996 if (min_typelen < 2)
4997 return (NULL);
4998
4999 while ((eoh - opt) >= min_typelen) {
5000 switch (*opt) {
5001 case TCPOPT_EOL:
5002 /* FALLTHROUGH - Workaround the failure of some
5003 systems to NOP-pad their bzero'd option buffers,
5004 producing spurious EOLs */
5005 case TCPOPT_NOP:
5006 opt++;
5007 continue;
5008 default:
5009 if (opt[0] == type &&
5010 opt[1] >= min_typelen)
5011 return (opt);
5012 }
5013
5014 opt += MAX(opt[1], 2); /* evade infinite loops */
5015 }
5016
5017 return (NULL);
5018 }
5019
5020 u_int8_t
pf_get_wscale(struct pf_pdesc * pd)5021 pf_get_wscale(struct pf_pdesc *pd)
5022 {
5023 int olen;
5024 uint8_t opts[MAX_TCPOPTLEN], *opt;
5025 uint8_t wscale = 0;
5026
5027 olen = (pd->hdr.tcp.th_off << 2) - sizeof(struct tcphdr);
5028 if (olen < TCPOLEN_WINDOW || !pf_pull_hdr(pd->m,
5029 pd->off + sizeof(struct tcphdr), opts, olen, NULL, NULL, pd->af))
5030 return (0);
5031
5032 opt = opts;
5033 while ((opt = pf_find_tcpopt(opt, opts, olen,
5034 TCPOPT_WINDOW, TCPOLEN_WINDOW)) != NULL) {
5035 wscale = opt[2];
5036 wscale = MIN(wscale, TCP_MAX_WINSHIFT);
5037 wscale |= PF_WSCALE_FLAG;
5038
5039 opt += opt[1];
5040 }
5041
5042 return (wscale);
5043 }
5044
5045 u_int16_t
pf_get_mss(struct pf_pdesc * pd)5046 pf_get_mss(struct pf_pdesc *pd)
5047 {
5048 int olen;
5049 uint8_t opts[MAX_TCPOPTLEN], *opt;
5050 u_int16_t mss = V_tcp_mssdflt;
5051
5052 olen = (pd->hdr.tcp.th_off << 2) - sizeof(struct tcphdr);
5053 if (olen < TCPOLEN_MAXSEG || !pf_pull_hdr(pd->m,
5054 pd->off + sizeof(struct tcphdr), opts, olen, NULL, NULL, pd->af))
5055 return (0);
5056
5057 opt = opts;
5058 while ((opt = pf_find_tcpopt(opt, opts, olen,
5059 TCPOPT_MAXSEG, TCPOLEN_MAXSEG)) != NULL) {
5060 memcpy(&mss, (opt + 2), 2);
5061 mss = ntohs(mss);
5062 opt += opt[1];
5063 }
5064
5065 return (mss);
5066 }
5067
5068 static u_int16_t
pf_calc_mss(struct pf_addr * addr,sa_family_t af,int rtableid,u_int16_t offer)5069 pf_calc_mss(struct pf_addr *addr, sa_family_t af, int rtableid, u_int16_t offer)
5070 {
5071 struct nhop_object *nh;
5072 #ifdef INET6
5073 struct in6_addr dst6;
5074 uint32_t scopeid;
5075 #endif /* INET6 */
5076 int hlen = 0;
5077 uint16_t mss = 0;
5078
5079 NET_EPOCH_ASSERT();
5080
5081 switch (af) {
5082 #ifdef INET
5083 case AF_INET:
5084 hlen = sizeof(struct ip);
5085 nh = fib4_lookup(rtableid, addr->v4, 0, 0, 0);
5086 if (nh != NULL)
5087 mss = nh->nh_mtu - hlen - sizeof(struct tcphdr);
5088 break;
5089 #endif /* INET */
5090 #ifdef INET6
5091 case AF_INET6:
5092 hlen = sizeof(struct ip6_hdr);
5093 in6_splitscope(&addr->v6, &dst6, &scopeid);
5094 nh = fib6_lookup(rtableid, &dst6, scopeid, 0, 0);
5095 if (nh != NULL)
5096 mss = nh->nh_mtu - hlen - sizeof(struct tcphdr);
5097 break;
5098 #endif /* INET6 */
5099 }
5100
5101 mss = max(V_tcp_mssdflt, mss);
5102 mss = min(mss, offer);
5103 mss = max(mss, 64); /* sanity - at least max opt space */
5104 return (mss);
5105 }
5106
5107 static u_int32_t
pf_tcp_iss(struct pf_pdesc * pd)5108 pf_tcp_iss(struct pf_pdesc *pd)
5109 {
5110 SHA512_CTX ctx;
5111 union {
5112 uint8_t bytes[SHA512_DIGEST_LENGTH];
5113 uint32_t words[1];
5114 } digest;
5115
5116 if (V_pf_tcp_secret_init == 0) {
5117 arc4random_buf(&V_pf_tcp_secret, sizeof(V_pf_tcp_secret));
5118 SHA512_Init(&V_pf_tcp_secret_ctx);
5119 SHA512_Update(&V_pf_tcp_secret_ctx, V_pf_tcp_secret,
5120 sizeof(V_pf_tcp_secret));
5121 V_pf_tcp_secret_init = 1;
5122 }
5123
5124 ctx = V_pf_tcp_secret_ctx;
5125
5126 SHA512_Update(&ctx, &pd->hdr.tcp.th_sport, sizeof(u_short));
5127 SHA512_Update(&ctx, &pd->hdr.tcp.th_dport, sizeof(u_short));
5128 switch (pd->af) {
5129 case AF_INET6:
5130 SHA512_Update(&ctx, &pd->src->v6, sizeof(struct in6_addr));
5131 SHA512_Update(&ctx, &pd->dst->v6, sizeof(struct in6_addr));
5132 break;
5133 case AF_INET:
5134 SHA512_Update(&ctx, &pd->src->v4, sizeof(struct in_addr));
5135 SHA512_Update(&ctx, &pd->dst->v4, sizeof(struct in_addr));
5136 break;
5137 }
5138 SHA512_Final(digest.bytes, &ctx);
5139 V_pf_tcp_iss_off += 4096;
5140 #define ISN_RANDOM_INCREMENT (4096 - 1)
5141 return (digest.words[0] + (arc4random() & ISN_RANDOM_INCREMENT) +
5142 V_pf_tcp_iss_off);
5143 #undef ISN_RANDOM_INCREMENT
5144 }
5145
5146 static bool
pf_match_eth_addr(const uint8_t * a,const struct pf_keth_rule_addr * r)5147 pf_match_eth_addr(const uint8_t *a, const struct pf_keth_rule_addr *r)
5148 {
5149 bool match = true;
5150
5151 /* Always matches if not set */
5152 if (! r->isset)
5153 return (!r->neg);
5154
5155 for (int i = 0; i < ETHER_ADDR_LEN; i++) {
5156 if ((a[i] & r->mask[i]) != (r->addr[i] & r->mask[i])) {
5157 match = false;
5158 break;
5159 }
5160 }
5161
5162 return (match ^ r->neg);
5163 }
5164
5165 static int
pf_match_eth_tag(struct mbuf * m,struct pf_keth_rule * r,int * tag,int mtag)5166 pf_match_eth_tag(struct mbuf *m, struct pf_keth_rule *r, int *tag, int mtag)
5167 {
5168 if (*tag == -1)
5169 *tag = mtag;
5170
5171 return ((!r->match_tag_not && r->match_tag == *tag) ||
5172 (r->match_tag_not && r->match_tag != *tag));
5173 }
5174
5175 static void
pf_bridge_to(struct ifnet * ifp,struct mbuf * m)5176 pf_bridge_to(struct ifnet *ifp, struct mbuf *m)
5177 {
5178 /* If we don't have the interface drop the packet. */
5179 if (ifp == NULL) {
5180 m_freem(m);
5181 return;
5182 }
5183
5184 switch (ifp->if_type) {
5185 case IFT_ETHER:
5186 case IFT_XETHER:
5187 case IFT_L2VLAN:
5188 case IFT_BRIDGE:
5189 case IFT_IEEE8023ADLAG:
5190 break;
5191 default:
5192 m_freem(m);
5193 return;
5194 }
5195
5196 ifp->if_transmit(ifp, m);
5197 }
5198
5199 static int
pf_test_eth_rule(int dir,struct pfi_kkif * kif,struct mbuf ** m0)5200 pf_test_eth_rule(int dir, struct pfi_kkif *kif, struct mbuf **m0)
5201 {
5202 #ifdef INET
5203 struct ip ip;
5204 #endif /* INET */
5205 #ifdef INET6
5206 struct ip6_hdr ip6;
5207 #endif /* INET6 */
5208 struct mbuf *m = *m0;
5209 struct ether_header *e;
5210 struct pf_keth_rule *r, *rm, *a = NULL;
5211 struct pf_keth_ruleset *ruleset = NULL;
5212 struct pf_mtag *mtag;
5213 struct pf_keth_ruleq *rules;
5214 struct pf_addr *src = NULL, *dst = NULL;
5215 struct pfi_kkif *bridge_to;
5216 sa_family_t af = 0;
5217 uint16_t proto;
5218 int asd = 0, match = 0;
5219 int tag = -1;
5220 uint8_t action;
5221 struct pf_keth_anchor_stackframe anchor_stack[PF_ANCHOR_STACK_MAX];
5222
5223 MPASS(kif->pfik_ifp->if_vnet == curvnet);
5224 NET_EPOCH_ASSERT();
5225
5226 PF_RULES_RLOCK_TRACKER;
5227
5228 SDT_PROBE3(pf, eth, test_rule, entry, dir, kif->pfik_ifp, m);
5229
5230 mtag = pf_find_mtag(m);
5231 if (mtag != NULL && mtag->flags & PF_MTAG_FLAG_DUMMYNET) {
5232 /* Dummynet re-injects packets after they've
5233 * completed their delay. We've already
5234 * processed them, so pass unconditionally. */
5235
5236 /* But only once. We may see the packet multiple times (e.g.
5237 * PFIL_IN/PFIL_OUT). */
5238 pf_dummynet_flag_remove(m, mtag);
5239
5240 return (PF_PASS);
5241 }
5242
5243 if (__predict_false(m->m_len < sizeof(struct ether_header)) &&
5244 (m = *m0 = m_pullup(*m0, sizeof(struct ether_header))) == NULL) {
5245 DPFPRINTF(PF_DEBUG_URGENT,
5246 "%s: m_len < sizeof(struct ether_header)"
5247 ", pullup failed", __func__);
5248 return (PF_DROP);
5249 }
5250 e = mtod(m, struct ether_header *);
5251 proto = ntohs(e->ether_type);
5252
5253 switch (proto) {
5254 #ifdef INET
5255 case ETHERTYPE_IP: {
5256 if (m_length(m, NULL) < (sizeof(struct ether_header) +
5257 sizeof(ip)))
5258 return (PF_DROP);
5259
5260 af = AF_INET;
5261 m_copydata(m, sizeof(struct ether_header), sizeof(ip),
5262 (caddr_t)&ip);
5263 src = (struct pf_addr *)&ip.ip_src;
5264 dst = (struct pf_addr *)&ip.ip_dst;
5265 break;
5266 }
5267 #endif /* INET */
5268 #ifdef INET6
5269 case ETHERTYPE_IPV6: {
5270 if (m_length(m, NULL) < (sizeof(struct ether_header) +
5271 sizeof(ip6)))
5272 return (PF_DROP);
5273
5274 af = AF_INET6;
5275 m_copydata(m, sizeof(struct ether_header), sizeof(ip6),
5276 (caddr_t)&ip6);
5277 src = (struct pf_addr *)&ip6.ip6_src;
5278 dst = (struct pf_addr *)&ip6.ip6_dst;
5279 break;
5280 }
5281 #endif /* INET6 */
5282 }
5283
5284 PF_RULES_RLOCK();
5285
5286 ruleset = V_pf_keth;
5287 rules = atomic_load_ptr(&ruleset->active.rules);
5288 for (r = TAILQ_FIRST(rules), rm = NULL; r != NULL;) {
5289 counter_u64_add(r->evaluations, 1);
5290 SDT_PROBE2(pf, eth, test_rule, test, r->nr, r);
5291
5292 if (pfi_kkif_match(r->kif, kif) == r->ifnot) {
5293 SDT_PROBE3(pf, eth, test_rule, mismatch, r->nr, r,
5294 "kif");
5295 r = r->skip[PFE_SKIP_IFP].ptr;
5296 }
5297 else if (r->direction && r->direction != dir) {
5298 SDT_PROBE3(pf, eth, test_rule, mismatch, r->nr, r,
5299 "dir");
5300 r = r->skip[PFE_SKIP_DIR].ptr;
5301 }
5302 else if (r->proto && r->proto != proto) {
5303 SDT_PROBE3(pf, eth, test_rule, mismatch, r->nr, r,
5304 "proto");
5305 r = r->skip[PFE_SKIP_PROTO].ptr;
5306 }
5307 else if (! pf_match_eth_addr(e->ether_shost, &r->src)) {
5308 SDT_PROBE3(pf, eth, test_rule, mismatch, r->nr, r,
5309 "src");
5310 r = r->skip[PFE_SKIP_SRC_ADDR].ptr;
5311 }
5312 else if (! pf_match_eth_addr(e->ether_dhost, &r->dst)) {
5313 SDT_PROBE3(pf, eth, test_rule, mismatch, r->nr, r,
5314 "dst");
5315 r = r->skip[PFE_SKIP_DST_ADDR].ptr;
5316 }
5317 else if (src != NULL && PF_MISMATCHAW(&r->ipsrc.addr, src, af,
5318 r->ipsrc.neg, kif, M_GETFIB(m))) {
5319 SDT_PROBE3(pf, eth, test_rule, mismatch, r->nr, r,
5320 "ip_src");
5321 r = r->skip[PFE_SKIP_SRC_IP_ADDR].ptr;
5322 }
5323 else if (dst != NULL && PF_MISMATCHAW(&r->ipdst.addr, dst, af,
5324 r->ipdst.neg, kif, M_GETFIB(m))) {
5325 SDT_PROBE3(pf, eth, test_rule, mismatch, r->nr, r,
5326 "ip_dst");
5327 r = r->skip[PFE_SKIP_DST_IP_ADDR].ptr;
5328 }
5329 else if (r->match_tag && !pf_match_eth_tag(m, r, &tag,
5330 mtag ? mtag->tag : 0)) {
5331 SDT_PROBE3(pf, eth, test_rule, mismatch, r->nr, r,
5332 "match_tag");
5333 r = TAILQ_NEXT(r, entries);
5334 }
5335 else {
5336 if (r->tag)
5337 tag = r->tag;
5338 if (r->anchor == NULL) {
5339 /* Rule matches */
5340 rm = r;
5341
5342 SDT_PROBE2(pf, eth, test_rule, match, r->nr, r);
5343
5344 if (r->quick)
5345 break;
5346
5347 r = TAILQ_NEXT(r, entries);
5348 } else {
5349 pf_step_into_keth_anchor(anchor_stack, &asd,
5350 &ruleset, &r, &a, &match);
5351 }
5352 }
5353 if (r == NULL && pf_step_out_of_keth_anchor(anchor_stack, &asd,
5354 &ruleset, &r, &a, &match))
5355 break;
5356 }
5357
5358 r = rm;
5359
5360 SDT_PROBE2(pf, eth, test_rule, final_match, (r != NULL ? r->nr : -1), r);
5361
5362 /* Default to pass. */
5363 if (r == NULL) {
5364 PF_RULES_RUNLOCK();
5365 return (PF_PASS);
5366 }
5367
5368 /* Execute action. */
5369 counter_u64_add(r->packets[dir == PF_OUT], 1);
5370 counter_u64_add(r->bytes[dir == PF_OUT], m_length(m, NULL));
5371 pf_update_timestamp(r);
5372
5373 /* Shortcut. Don't tag if we're just going to drop anyway. */
5374 if (r->action == PF_DROP) {
5375 PF_RULES_RUNLOCK();
5376 return (PF_DROP);
5377 }
5378
5379 if (tag > 0) {
5380 if (mtag == NULL)
5381 mtag = pf_get_mtag(m);
5382 if (mtag == NULL) {
5383 PF_RULES_RUNLOCK();
5384 counter_u64_add(V_pf_status.counters[PFRES_MEMORY], 1);
5385 return (PF_DROP);
5386 }
5387 mtag->tag = tag;
5388 }
5389
5390 if (r->qid != 0) {
5391 if (mtag == NULL)
5392 mtag = pf_get_mtag(m);
5393 if (mtag == NULL) {
5394 PF_RULES_RUNLOCK();
5395 counter_u64_add(V_pf_status.counters[PFRES_MEMORY], 1);
5396 return (PF_DROP);
5397 }
5398 mtag->qid = r->qid;
5399 }
5400
5401 action = r->action;
5402 bridge_to = r->bridge_to;
5403
5404 /* Dummynet */
5405 if (r->dnpipe) {
5406 struct ip_fw_args dnflow;
5407
5408 /* Drop packet if dummynet is not loaded. */
5409 if (ip_dn_io_ptr == NULL) {
5410 PF_RULES_RUNLOCK();
5411 m_freem(m);
5412 counter_u64_add(V_pf_status.counters[PFRES_MEMORY], 1);
5413 return (PF_DROP);
5414 }
5415 if (mtag == NULL)
5416 mtag = pf_get_mtag(m);
5417 if (mtag == NULL) {
5418 PF_RULES_RUNLOCK();
5419 counter_u64_add(V_pf_status.counters[PFRES_MEMORY], 1);
5420 return (PF_DROP);
5421 }
5422
5423 bzero(&dnflow, sizeof(dnflow));
5424
5425 /* We don't have port numbers here, so we set 0. That means
5426 * that we'll be somewhat limited in distinguishing flows (i.e.
5427 * only based on IP addresses, not based on port numbers), but
5428 * it's better than nothing. */
5429 dnflow.f_id.dst_port = 0;
5430 dnflow.f_id.src_port = 0;
5431 dnflow.f_id.proto = 0;
5432
5433 dnflow.rule.info = r->dnpipe;
5434 dnflow.rule.info |= IPFW_IS_DUMMYNET;
5435 if (r->dnflags & PFRULE_DN_IS_PIPE)
5436 dnflow.rule.info |= IPFW_IS_PIPE;
5437
5438 dnflow.f_id.extra = dnflow.rule.info;
5439
5440 dnflow.flags = dir == PF_IN ? IPFW_ARGS_IN : IPFW_ARGS_OUT;
5441 dnflow.flags |= IPFW_ARGS_ETHER;
5442 dnflow.ifp = kif->pfik_ifp;
5443
5444 switch (af) {
5445 case AF_INET:
5446 dnflow.f_id.addr_type = 4;
5447 dnflow.f_id.src_ip = src->v4.s_addr;
5448 dnflow.f_id.dst_ip = dst->v4.s_addr;
5449 break;
5450 case AF_INET6:
5451 dnflow.flags |= IPFW_ARGS_IP6;
5452 dnflow.f_id.addr_type = 6;
5453 dnflow.f_id.src_ip6 = src->v6;
5454 dnflow.f_id.dst_ip6 = dst->v6;
5455 break;
5456 }
5457
5458 PF_RULES_RUNLOCK();
5459
5460 mtag->flags |= PF_MTAG_FLAG_DUMMYNET;
5461 ip_dn_io_ptr(m0, &dnflow);
5462 if (*m0 != NULL)
5463 pf_dummynet_flag_remove(m, mtag);
5464 } else {
5465 PF_RULES_RUNLOCK();
5466 }
5467
5468 if (action == PF_PASS && bridge_to) {
5469 pf_bridge_to(bridge_to->pfik_ifp, *m0);
5470 *m0 = NULL; /* We've eaten the packet. */
5471 }
5472
5473 return (action);
5474 }
5475
5476 #define PF_TEST_ATTRIB(t, a) \
5477 if (t) { \
5478 r = a; \
5479 continue; \
5480 } else do { \
5481 } while (0)
5482
5483 static __inline u_short
pf_rule_apply_nat(struct pf_test_ctx * ctx,struct pf_krule * r)5484 pf_rule_apply_nat(struct pf_test_ctx *ctx, struct pf_krule *r)
5485 {
5486 struct pf_pdesc *pd = ctx->pd;
5487 u_short transerror;
5488 u_int8_t nat_action;
5489
5490 if (r->rule_flag & PFRULE_AFTO) {
5491 /* Don't translate if there was an old style NAT rule */
5492 if (ctx->nr != NULL)
5493 return (PFRES_TRANSLATE);
5494
5495 /* pass af-to rules, unsupported on match rules */
5496 KASSERT(r->action != PF_MATCH, ("%s: af-to on match rule", __func__));
5497 /* XXX I can imagine scenarios where we have both NAT and RDR source tracking */
5498 ctx->nat_pool = &(r->nat);
5499 ctx->nr = r;
5500 pd->naf = r->naf;
5501 if (pf_get_transaddr_af(ctx->nr, pd) == -1) {
5502 return (PFRES_TRANSLATE);
5503 }
5504 return (PFRES_MATCH);
5505 } else if (r->rdr.cur || r->nat.cur) {
5506 /* Don't translate if there was an old style NAT rule */
5507 if (ctx->nr != NULL)
5508 return (PFRES_TRANSLATE);
5509
5510 /* match/pass nat-to/rdr-to rules */
5511 ctx->nr = r;
5512 if (r->nat.cur) {
5513 nat_action = PF_NAT;
5514 ctx->nat_pool = &(r->nat);
5515 } else {
5516 nat_action = PF_RDR;
5517 ctx->nat_pool = &(r->rdr);
5518 }
5519
5520 transerror = pf_get_transaddr(ctx, ctx->nr,
5521 nat_action, ctx->nat_pool);
5522 if (transerror == PFRES_MATCH) {
5523 ctx->rewrite += pf_translate_compat(ctx);
5524 return(PFRES_MATCH);
5525 }
5526 return (transerror);
5527 }
5528
5529 return (PFRES_MAX);
5530 }
5531
5532 enum pf_test_status
pf_match_rule(struct pf_test_ctx * ctx,struct pf_kruleset * ruleset)5533 pf_match_rule(struct pf_test_ctx *ctx, struct pf_kruleset *ruleset)
5534 {
5535 struct pf_krule_item *ri;
5536 struct pf_krule *r;
5537 struct pf_krule *save_a;
5538 struct pf_kruleset *save_aruleset;
5539 struct pf_pdesc *pd = ctx->pd;
5540 u_short transerror;
5541
5542 r = TAILQ_FIRST(ruleset->rules[PF_RULESET_FILTER].active.ptr);
5543 while (r != NULL) {
5544 if (ctx->pd->related_rule) {
5545 *ctx->rm = ctx->pd->related_rule;
5546 break;
5547 }
5548 pf_counter_u64_add(&r->evaluations, 1);
5549 PF_TEST_ATTRIB(pfi_kkif_match(r->kif, pd->kif) == r->ifnot,
5550 r->skip[PF_SKIP_IFP]);
5551 PF_TEST_ATTRIB(r->direction && r->direction != pd->dir,
5552 r->skip[PF_SKIP_DIR]);
5553 PF_TEST_ATTRIB(r->af && r->af != pd->af,
5554 r->skip[PF_SKIP_AF]);
5555 PF_TEST_ATTRIB(r->proto && r->proto != pd->proto,
5556 r->skip[PF_SKIP_PROTO]);
5557 PF_TEST_ATTRIB(PF_MISMATCHAW(&r->src.addr, &pd->nsaddr, pd->naf,
5558 r->src.neg, pd->kif, M_GETFIB(pd->m)),
5559 r->skip[PF_SKIP_SRC_ADDR]);
5560 PF_TEST_ATTRIB(PF_MISMATCHAW(&r->dst.addr, &pd->ndaddr, pd->af,
5561 r->dst.neg, NULL, M_GETFIB(pd->m)),
5562 r->skip[PF_SKIP_DST_ADDR]);
5563 switch (pd->virtual_proto) {
5564 case PF_VPROTO_FRAGMENT:
5565 /* tcp/udp only. port_op always 0 in other cases */
5566 PF_TEST_ATTRIB((r->src.port_op || r->dst.port_op),
5567 TAILQ_NEXT(r, entries));
5568 PF_TEST_ATTRIB((pd->proto == IPPROTO_TCP && r->flagset),
5569 TAILQ_NEXT(r, entries));
5570 /* icmp only. type/code always 0 in other cases */
5571 PF_TEST_ATTRIB((r->type || r->code),
5572 TAILQ_NEXT(r, entries));
5573 /* tcp/udp only. {uid|gid}.op always 0 in other cases */
5574 PF_TEST_ATTRIB((r->gid.op || r->uid.op),
5575 TAILQ_NEXT(r, entries));
5576 break;
5577
5578 case IPPROTO_TCP:
5579 PF_TEST_ATTRIB((r->flagset & tcp_get_flags(ctx->th))
5580 != r->flags,
5581 TAILQ_NEXT(r, entries));
5582 /* FALLTHROUGH */
5583 case IPPROTO_SCTP:
5584 case IPPROTO_UDP:
5585 /* tcp/udp only. port_op always 0 in other cases */
5586 PF_TEST_ATTRIB(r->src.port_op && !pf_match_port(r->src.port_op,
5587 r->src.port[0], r->src.port[1], pd->nsport),
5588 r->skip[PF_SKIP_SRC_PORT]);
5589 /* tcp/udp only. port_op always 0 in other cases */
5590 PF_TEST_ATTRIB(r->dst.port_op && !pf_match_port(r->dst.port_op,
5591 r->dst.port[0], r->dst.port[1], pd->ndport),
5592 r->skip[PF_SKIP_DST_PORT]);
5593 /* tcp/udp only. uid.op always 0 in other cases */
5594 PF_TEST_ATTRIB(r->uid.op && (pd->lookup.done || (pd->lookup.done =
5595 pf_socket_lookup(pd), 1)) &&
5596 !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1],
5597 pd->lookup.uid),
5598 TAILQ_NEXT(r, entries));
5599 /* tcp/udp only. gid.op always 0 in other cases */
5600 PF_TEST_ATTRIB(r->gid.op && (pd->lookup.done || (pd->lookup.done =
5601 pf_socket_lookup(pd), 1)) &&
5602 !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1],
5603 pd->lookup.gid),
5604 TAILQ_NEXT(r, entries));
5605 break;
5606
5607 case IPPROTO_ICMP:
5608 case IPPROTO_ICMPV6:
5609 /* icmp only. type always 0 in other cases */
5610 PF_TEST_ATTRIB(r->type && r->type != ctx->icmptype + 1,
5611 TAILQ_NEXT(r, entries));
5612 /* icmp only. type always 0 in other cases */
5613 PF_TEST_ATTRIB(r->code && r->code != ctx->icmpcode + 1,
5614 TAILQ_NEXT(r, entries));
5615 break;
5616
5617 default:
5618 break;
5619 }
5620 PF_TEST_ATTRIB(r->tos && !(r->tos == pd->tos),
5621 TAILQ_NEXT(r, entries));
5622 PF_TEST_ATTRIB(r->prio &&
5623 !pf_match_ieee8021q_pcp(r->prio, pd->m),
5624 TAILQ_NEXT(r, entries));
5625 PF_TEST_ATTRIB(r->prob &&
5626 r->prob <= arc4random(),
5627 TAILQ_NEXT(r, entries));
5628 PF_TEST_ATTRIB(r->match_tag && !pf_match_tag(pd->m, r,
5629 &ctx->tag, pd->pf_mtag ? pd->pf_mtag->tag : 0),
5630 TAILQ_NEXT(r, entries));
5631 PF_TEST_ATTRIB((r->rcv_kif && pf_match_rcvif(pd->m, r) ==
5632 r->rcvifnot),
5633 TAILQ_NEXT(r, entries));
5634 PF_TEST_ATTRIB((r->rule_flag & PFRULE_FRAGMENT &&
5635 pd->virtual_proto != PF_VPROTO_FRAGMENT),
5636 TAILQ_NEXT(r, entries));
5637 PF_TEST_ATTRIB(r->os_fingerprint != PF_OSFP_ANY &&
5638 (pd->virtual_proto != IPPROTO_TCP || !pf_osfp_match(
5639 pf_osfp_fingerprint(pd, ctx->th),
5640 r->os_fingerprint)),
5641 TAILQ_NEXT(r, entries));
5642 /* must be last! */
5643 if (r->pktrate.limit) {
5644 PF_TEST_ATTRIB((pf_check_threshold(&r->pktrate)),
5645 TAILQ_NEXT(r, entries));
5646 }
5647 /* FALLTHROUGH */
5648 if (r->tag)
5649 ctx->tag = r->tag;
5650 if (r->anchor == NULL) {
5651 if (r->action == PF_MATCH) {
5652 /*
5653 * Apply translations before increasing counters,
5654 * in case it fails.
5655 */
5656 transerror = pf_rule_apply_nat(ctx, r);
5657 switch (transerror) {
5658 case PFRES_MATCH:
5659 /* Translation action found in rule and applied successfully */
5660 case PFRES_MAX:
5661 /* No translation action found in rule */
5662 break;
5663 default:
5664 /* Translation action found in rule but failed to apply */
5665 REASON_SET(&ctx->reason, transerror);
5666 return (PF_TEST_FAIL);
5667 }
5668 ri = malloc(sizeof(struct pf_krule_item), M_PF_RULE_ITEM, M_NOWAIT | M_ZERO);
5669 if (ri == NULL) {
5670 REASON_SET(&ctx->reason, PFRES_MEMORY);
5671 return (PF_TEST_FAIL);
5672 }
5673 ri->r = r;
5674 SLIST_INSERT_HEAD(&ctx->rules, ri, entry);
5675 pf_counter_u64_critical_enter();
5676 pf_counter_u64_add_protected(&r->packets[pd->dir == PF_OUT], 1);
5677 pf_counter_u64_add_protected(&r->bytes[pd->dir == PF_OUT], pd->tot_len);
5678 pf_counter_u64_critical_exit();
5679 pf_rule_to_actions(r, &pd->act);
5680 if (r->log)
5681 PFLOG_PACKET(r->action, PFRES_MATCH, r,
5682 ctx->a, ruleset, pd, 1, NULL);
5683 } else {
5684 /*
5685 * found matching r
5686 */
5687 *ctx->rm = r;
5688 /*
5689 * anchor, with ruleset, where r belongs to
5690 */
5691 *ctx->am = ctx->a;
5692 /*
5693 * ruleset where r belongs to
5694 */
5695 *ctx->rsm = ruleset;
5696 /*
5697 * ruleset, where anchor belongs to.
5698 */
5699 ctx->arsm = ctx->aruleset;
5700 }
5701 if (pd->act.log & PF_LOG_MATCHES)
5702 pf_log_matches(pd, r, ctx->a, ruleset, &ctx->rules);
5703 if (r->quick) {
5704 ctx->test_status = PF_TEST_QUICK;
5705 break;
5706 }
5707 } else {
5708 save_a = ctx->a;
5709 save_aruleset = ctx->aruleset;
5710
5711 ctx->a = r; /* remember anchor */
5712 ctx->aruleset = ruleset; /* and its ruleset */
5713 if (ctx->a->quick)
5714 ctx->test_status = PF_TEST_QUICK;
5715 /*
5716 * Note: we don't need to restore if we are not going
5717 * to continue with ruleset evaluation.
5718 */
5719 if (pf_step_into_anchor(ctx, r) != PF_TEST_OK) {
5720 break;
5721 }
5722 ctx->a = save_a;
5723 ctx->aruleset = save_aruleset;
5724 }
5725 r = TAILQ_NEXT(r, entries);
5726 }
5727
5728 return (ctx->test_status);
5729 }
5730
5731 static int
pf_test_rule(struct pf_krule ** rm,struct pf_kstate ** sm,struct pf_pdesc * pd,struct pf_krule ** am,struct pf_kruleset ** rsm,u_short * reason,struct inpcb * inp)5732 pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm,
5733 struct pf_pdesc *pd, struct pf_krule **am,
5734 struct pf_kruleset **rsm, u_short *reason, struct inpcb *inp)
5735 {
5736 struct pf_krule *r = NULL;
5737 struct pf_kruleset *ruleset = NULL;
5738 struct pf_krule_item *ri;
5739 struct pf_test_ctx ctx;
5740 u_short transerror;
5741 int action = PF_PASS;
5742 u_int16_t bproto_sum = 0, bip_sum = 0;
5743 enum pf_test_status rv;
5744
5745 PF_RULES_RASSERT();
5746
5747 bzero(&ctx, sizeof(ctx));
5748 ctx.tag = -1;
5749 ctx.pd = pd;
5750 ctx.rm = rm;
5751 ctx.am = am;
5752 ctx.rsm = rsm;
5753 ctx.th = &pd->hdr.tcp;
5754 ctx.reason = *reason;
5755 SLIST_INIT(&ctx.rules);
5756
5757 pf_addrcpy(&pd->nsaddr, pd->src, pd->af);
5758 pf_addrcpy(&pd->ndaddr, pd->dst, pd->af);
5759
5760 if (inp != NULL) {
5761 INP_LOCK_ASSERT(inp);
5762 pd->lookup.uid = inp->inp_cred->cr_uid;
5763 pd->lookup.gid = inp->inp_cred->cr_gid;
5764 pd->lookup.done = 1;
5765 }
5766
5767 if (pd->ip_sum)
5768 bip_sum = *pd->ip_sum;
5769
5770 switch (pd->virtual_proto) {
5771 case IPPROTO_TCP:
5772 bproto_sum = ctx.th->th_sum;
5773 pd->nsport = ctx.th->th_sport;
5774 pd->ndport = ctx.th->th_dport;
5775 break;
5776 case IPPROTO_UDP:
5777 bproto_sum = pd->hdr.udp.uh_sum;
5778 pd->nsport = pd->hdr.udp.uh_sport;
5779 pd->ndport = pd->hdr.udp.uh_dport;
5780 break;
5781 case IPPROTO_SCTP:
5782 pd->nsport = pd->hdr.sctp.src_port;
5783 pd->ndport = pd->hdr.sctp.dest_port;
5784 break;
5785 #ifdef INET
5786 case IPPROTO_ICMP:
5787 MPASS(pd->af == AF_INET);
5788 ctx.icmptype = pd->hdr.icmp.icmp_type;
5789 ctx.icmpcode = pd->hdr.icmp.icmp_code;
5790 ctx.state_icmp = pf_icmp_mapping(pd, ctx.icmptype,
5791 &ctx.icmp_dir, &ctx.virtual_id, &ctx.virtual_type);
5792 if (ctx.icmp_dir == PF_IN) {
5793 pd->nsport = ctx.virtual_id;
5794 pd->ndport = ctx.virtual_type;
5795 } else {
5796 pd->nsport = ctx.virtual_type;
5797 pd->ndport = ctx.virtual_id;
5798 }
5799 break;
5800 #endif /* INET */
5801 #ifdef INET6
5802 case IPPROTO_ICMPV6:
5803 MPASS(pd->af == AF_INET6);
5804 ctx.icmptype = pd->hdr.icmp6.icmp6_type;
5805 ctx.icmpcode = pd->hdr.icmp6.icmp6_code;
5806 ctx.state_icmp = pf_icmp_mapping(pd, ctx.icmptype,
5807 &ctx.icmp_dir, &ctx.virtual_id, &ctx.virtual_type);
5808 if (ctx.icmp_dir == PF_IN) {
5809 pd->nsport = ctx.virtual_id;
5810 pd->ndport = ctx.virtual_type;
5811 } else {
5812 pd->nsport = ctx.virtual_type;
5813 pd->ndport = ctx.virtual_id;
5814 }
5815
5816 break;
5817 #endif /* INET6 */
5818 default:
5819 pd->nsport = pd->ndport = 0;
5820 break;
5821 }
5822 pd->osport = pd->nsport;
5823 pd->odport = pd->ndport;
5824
5825 /* check packet for BINAT/NAT/RDR */
5826 transerror = pf_get_translation(&ctx);
5827 switch (transerror) {
5828 default:
5829 /* A translation error occurred. */
5830 REASON_SET(&ctx.reason, transerror);
5831 goto cleanup;
5832 case PFRES_MAX:
5833 /* No match. */
5834 break;
5835 case PFRES_MATCH:
5836 KASSERT(ctx.sk != NULL, ("%s: null sk", __func__));
5837 KASSERT(ctx.nk != NULL, ("%s: null nk", __func__));
5838 if (ctx.nr->log) {
5839 PFLOG_PACKET(ctx.nr->action, PFRES_MATCH, ctx.nr, ctx.a,
5840 ruleset, pd, 1, NULL);
5841 }
5842
5843 ctx.rewrite += pf_translate_compat(&ctx);
5844 ctx.nat_pool = &(ctx.nr->rdr);
5845 }
5846
5847 ruleset = &pf_main_ruleset;
5848 rv = pf_match_rule(&ctx, ruleset);
5849 if (rv == PF_TEST_FAIL) {
5850 /*
5851 * Reason has been set in pf_match_rule() already.
5852 */
5853 goto cleanup;
5854 }
5855
5856 r = *ctx.rm; /* matching rule */
5857 ctx.a = *ctx.am; /* rule that defines an anchor containing 'r' */
5858 ruleset = *ctx.rsm; /* ruleset of the anchor defined by the rule 'a' */
5859 ctx.aruleset = ctx.arsm; /* ruleset of the 'a' rule itself */
5860
5861 REASON_SET(&ctx.reason, PFRES_MATCH);
5862
5863 /* apply actions for last matching pass/block rule */
5864 pf_rule_to_actions(r, &pd->act);
5865 transerror = pf_rule_apply_nat(&ctx, r);
5866 switch (transerror) {
5867 case PFRES_MATCH:
5868 /* Translation action found in rule and applied successfully */
5869 case PFRES_MAX:
5870 /* No translation action found in rule */
5871 break;
5872 default:
5873 /* Translation action found in rule but failed to apply */
5874 REASON_SET(&ctx.reason, transerror);
5875 goto cleanup;
5876 }
5877
5878 if (r->log) {
5879 if (ctx.rewrite)
5880 m_copyback(pd->m, pd->off, pd->hdrlen, pd->hdr.any);
5881 PFLOG_PACKET(r->action, ctx.reason, r, ctx.a, ruleset, pd, 1, NULL);
5882 }
5883 if (pd->act.log & PF_LOG_MATCHES)
5884 pf_log_matches(pd, r, ctx.a, ruleset, &ctx.rules);
5885 if (pd->virtual_proto != PF_VPROTO_FRAGMENT &&
5886 (r->action == PF_DROP) &&
5887 ((r->rule_flag & PFRULE_RETURNRST) ||
5888 (r->rule_flag & PFRULE_RETURNICMP) ||
5889 (r->rule_flag & PFRULE_RETURN))) {
5890 pf_return(r, ctx.nr, pd, ctx.th, bproto_sum,
5891 bip_sum, &ctx.reason, r->rtableid);
5892 }
5893
5894 if (r->action == PF_DROP)
5895 goto cleanup;
5896
5897 if (ctx.tag > 0 && pf_tag_packet(pd, ctx.tag)) {
5898 REASON_SET(&ctx.reason, PFRES_MEMORY);
5899 goto cleanup;
5900 }
5901 if (pd->act.rtableid >= 0)
5902 M_SETFIB(pd->m, pd->act.rtableid);
5903
5904 if (r->rt) {
5905 /*
5906 * Set act.rt here instead of in pf_rule_to_actions() because
5907 * it is applied only from the last pass rule.
5908 */
5909 pd->act.rt = r->rt;
5910 if ((transerror = pf_map_addr_sn(pd->af, r, pd->src,
5911 &pd->act.rt_addr, &pd->act.rt_kif, NULL, &(r->route),
5912 PF_SN_ROUTE)) != PFRES_MATCH) {
5913 REASON_SET(&ctx.reason, transerror);
5914 goto cleanup;
5915 }
5916 }
5917
5918 if (pd->virtual_proto != PF_VPROTO_FRAGMENT &&
5919 (!ctx.state_icmp && (r->keep_state || ctx.nr != NULL ||
5920 (pd->flags & PFDESC_TCP_NORM)))) {
5921 bool nat64;
5922
5923 action = pf_create_state(r, &ctx, sm, bproto_sum, bip_sum);
5924 ctx.sk = ctx.nk = NULL;
5925 if (action != PF_PASS) {
5926 pf_udp_mapping_release(ctx.udp_mapping);
5927 if (r->log || (ctx.nr != NULL && ctx.nr->log) ||
5928 ctx.reason == PFRES_MEMORY)
5929 pd->act.log |= PF_LOG_FORCE;
5930 if (action == PF_DROP &&
5931 (r->rule_flag & PFRULE_RETURN))
5932 pf_return(r, ctx.nr, pd, ctx.th,
5933 bproto_sum, bip_sum, &ctx.reason,
5934 pd->act.rtableid);
5935 *reason = ctx.reason;
5936 return (action);
5937 }
5938
5939 nat64 = pd->af != pd->naf;
5940 if (nat64) {
5941 int ret;
5942
5943 if (ctx.sk == NULL)
5944 ctx.sk = (*sm)->key[pd->dir == PF_IN ? PF_SK_STACK : PF_SK_WIRE];
5945 if (ctx.nk == NULL)
5946 ctx.nk = (*sm)->key[pd->dir == PF_IN ? PF_SK_WIRE : PF_SK_STACK];
5947
5948 if (pd->dir == PF_IN) {
5949 ret = pf_translate(pd, &ctx.sk->addr[pd->didx],
5950 ctx.sk->port[pd->didx], &ctx.sk->addr[pd->sidx],
5951 ctx.sk->port[pd->sidx], ctx.virtual_type,
5952 ctx.icmp_dir);
5953 } else {
5954 ret = pf_translate(pd, &ctx.sk->addr[pd->sidx],
5955 ctx.sk->port[pd->sidx], &ctx.sk->addr[pd->didx],
5956 ctx.sk->port[pd->didx], ctx.virtual_type,
5957 ctx.icmp_dir);
5958 }
5959
5960 if (ret < 0)
5961 goto cleanup;
5962
5963 ctx.rewrite += ret;
5964
5965 if (ctx.rewrite && ctx.sk->af != ctx.nk->af)
5966 action = PF_AFRT;
5967 }
5968 } else {
5969 while ((ri = SLIST_FIRST(&ctx.rules))) {
5970 SLIST_REMOVE_HEAD(&ctx.rules, entry);
5971 free(ri, M_PF_RULE_ITEM);
5972 }
5973
5974 uma_zfree(V_pf_state_key_z, ctx.sk);
5975 uma_zfree(V_pf_state_key_z, ctx.nk);
5976 ctx.sk = ctx.nk = NULL;
5977 pf_udp_mapping_release(ctx.udp_mapping);
5978 }
5979
5980 /* copy back packet headers if we performed NAT operations */
5981 if (ctx.rewrite)
5982 m_copyback(pd->m, pd->off, pd->hdrlen, pd->hdr.any);
5983
5984 if (*sm != NULL && !((*sm)->state_flags & PFSTATE_NOSYNC) &&
5985 pd->dir == PF_OUT &&
5986 V_pfsync_defer_ptr != NULL && V_pfsync_defer_ptr(*sm, pd->m)) {
5987 /*
5988 * We want the state created, but we dont
5989 * want to send this in case a partner
5990 * firewall has to know about it to allow
5991 * replies through it.
5992 */
5993 *reason = ctx.reason;
5994 return (PF_DEFER);
5995 }
5996
5997 *reason = ctx.reason;
5998 return (action);
5999
6000 cleanup:
6001 while ((ri = SLIST_FIRST(&ctx.rules))) {
6002 SLIST_REMOVE_HEAD(&ctx.rules, entry);
6003 free(ri, M_PF_RULE_ITEM);
6004 }
6005
6006 uma_zfree(V_pf_state_key_z, ctx.sk);
6007 uma_zfree(V_pf_state_key_z, ctx.nk);
6008 pf_udp_mapping_release(ctx.udp_mapping);
6009 *reason = ctx.reason;
6010
6011 return (PF_DROP);
6012 }
6013
6014 static int
pf_create_state(struct pf_krule * r,struct pf_test_ctx * ctx,struct pf_kstate ** sm,u_int16_t bproto_sum,u_int16_t bip_sum)6015 pf_create_state(struct pf_krule *r, struct pf_test_ctx *ctx,
6016 struct pf_kstate **sm, u_int16_t bproto_sum, u_int16_t bip_sum)
6017 {
6018 struct pf_pdesc *pd = ctx->pd;
6019 struct pf_kstate *s = NULL;
6020 struct pf_ksrc_node *sns[PF_SN_MAX] = { NULL };
6021 /*
6022 * XXXKS: The hash for PF_SN_LIMIT and PF_SN_ROUTE should be the same
6023 * but for PF_SN_NAT it is different. Don't try optimizing it,
6024 * just store all 3 hashes.
6025 */
6026 struct pf_srchash *snhs[PF_SN_MAX] = { NULL };
6027 struct tcphdr *th = &pd->hdr.tcp;
6028 u_int16_t mss = V_tcp_mssdflt;
6029 u_short sn_reason;
6030 struct pf_krule_item *ri;
6031
6032 /* check maximums */
6033 if (r->max_states &&
6034 (counter_u64_fetch(r->states_cur) >= r->max_states)) {
6035 counter_u64_add(V_pf_status.lcounters[LCNT_STATES], 1);
6036 REASON_SET(&ctx->reason, PFRES_MAXSTATES);
6037 goto csfailed;
6038 }
6039 /* src node for limits */
6040 if ((r->rule_flag & PFRULE_SRCTRACK) &&
6041 (sn_reason = pf_insert_src_node(sns, snhs, r, pd->src, pd->af,
6042 NULL, NULL, PF_SN_LIMIT)) != 0) {
6043 REASON_SET(&ctx->reason, sn_reason);
6044 goto csfailed;
6045 }
6046 /* src node for route-to rule */
6047 if (r->rt) {
6048 if ((r->route.opts & PF_POOL_STICKYADDR) &&
6049 (sn_reason = pf_insert_src_node(sns, snhs, r, pd->src,
6050 pd->af, &pd->act.rt_addr, pd->act.rt_kif,
6051 PF_SN_ROUTE)) != 0) {
6052 REASON_SET(&ctx->reason, sn_reason);
6053 goto csfailed;
6054 }
6055 }
6056 /* src node for translation rule */
6057 if (ctx->nr != NULL) {
6058 KASSERT(ctx->nat_pool != NULL, ("%s: nat_pool is NULL", __func__));
6059 /*
6060 * The NAT addresses are chosen during ruleset parsing.
6061 * The new afto code stores post-nat addresses in nsaddr.
6062 * The old nat code (also used for new nat-to rules) creates
6063 * state keys and stores addresses in them.
6064 */
6065 if ((ctx->nat_pool->opts & PF_POOL_STICKYADDR) &&
6066 (sn_reason = pf_insert_src_node(sns, snhs, ctx->nr,
6067 ctx->sk ? &(ctx->sk->addr[pd->sidx]) : pd->src, pd->af,
6068 ctx->nk ? &(ctx->nk->addr[1]) : &(pd->nsaddr), NULL,
6069 PF_SN_NAT)) != 0 ) {
6070 REASON_SET(&ctx->reason, sn_reason);
6071 goto csfailed;
6072 }
6073 }
6074 s = pf_alloc_state(M_NOWAIT);
6075 if (s == NULL) {
6076 REASON_SET(&ctx->reason, PFRES_MEMORY);
6077 goto csfailed;
6078 }
6079 s->rule = r;
6080 s->nat_rule = ctx->nr;
6081 s->anchor = ctx->a;
6082 memcpy(&s->match_rules, &ctx->rules, sizeof(s->match_rules));
6083 memcpy(&s->act, &pd->act, sizeof(struct pf_rule_actions));
6084
6085 if (pd->act.allow_opts)
6086 s->state_flags |= PFSTATE_ALLOWOPTS;
6087 if (r->rule_flag & PFRULE_STATESLOPPY)
6088 s->state_flags |= PFSTATE_SLOPPY;
6089 if (pd->flags & PFDESC_TCP_NORM) /* Set by old-style scrub rules */
6090 s->state_flags |= PFSTATE_SCRUB_TCP;
6091 if ((r->rule_flag & PFRULE_PFLOW) ||
6092 (ctx->nr != NULL && ctx->nr->rule_flag & PFRULE_PFLOW))
6093 s->state_flags |= PFSTATE_PFLOW;
6094
6095 s->act.log = pd->act.log & PF_LOG_ALL;
6096 s->sync_state = PFSYNC_S_NONE;
6097 s->state_flags |= pd->act.flags; /* Only needed for pfsync and state export */
6098
6099 if (ctx->nr != NULL)
6100 s->act.log |= ctx->nr->log & PF_LOG_ALL;
6101 switch (pd->proto) {
6102 case IPPROTO_TCP:
6103 s->src.seqlo = ntohl(th->th_seq);
6104 s->src.seqhi = s->src.seqlo + pd->p_len + 1;
6105 if ((tcp_get_flags(th) & (TH_SYN|TH_ACK)) == TH_SYN &&
6106 r->keep_state == PF_STATE_MODULATE) {
6107 /* Generate sequence number modulator */
6108 if ((s->src.seqdiff = pf_tcp_iss(pd) - s->src.seqlo) ==
6109 0)
6110 s->src.seqdiff = 1;
6111 pf_change_proto_a(pd->m, &th->th_seq, &th->th_sum,
6112 htonl(s->src.seqlo + s->src.seqdiff), 0);
6113 ctx->rewrite = 1;
6114 } else
6115 s->src.seqdiff = 0;
6116 if (tcp_get_flags(th) & TH_SYN) {
6117 s->src.seqhi++;
6118 s->src.wscale = pf_get_wscale(pd);
6119 }
6120 s->src.max_win = MAX(ntohs(th->th_win), 1);
6121 if (s->src.wscale & PF_WSCALE_MASK) {
6122 /* Remove scale factor from initial window */
6123 int win = s->src.max_win;
6124 win += 1 << (s->src.wscale & PF_WSCALE_MASK);
6125 s->src.max_win = (win - 1) >>
6126 (s->src.wscale & PF_WSCALE_MASK);
6127 }
6128 if (tcp_get_flags(th) & TH_FIN)
6129 s->src.seqhi++;
6130 s->dst.seqhi = 1;
6131 s->dst.max_win = 1;
6132 pf_set_protostate(s, PF_PEER_SRC, TCPS_SYN_SENT);
6133 pf_set_protostate(s, PF_PEER_DST, TCPS_CLOSED);
6134 s->timeout = PFTM_TCP_FIRST_PACKET;
6135 atomic_add_32(&V_pf_status.states_halfopen, 1);
6136 break;
6137 case IPPROTO_UDP:
6138 pf_set_protostate(s, PF_PEER_SRC, PFUDPS_SINGLE);
6139 pf_set_protostate(s, PF_PEER_DST, PFUDPS_NO_TRAFFIC);
6140 s->timeout = PFTM_UDP_FIRST_PACKET;
6141 break;
6142 case IPPROTO_SCTP:
6143 pf_set_protostate(s, PF_PEER_SRC, SCTP_COOKIE_WAIT);
6144 pf_set_protostate(s, PF_PEER_DST, SCTP_CLOSED);
6145 s->timeout = PFTM_SCTP_FIRST_PACKET;
6146 break;
6147 case IPPROTO_ICMP:
6148 #ifdef INET6
6149 case IPPROTO_ICMPV6:
6150 #endif /* INET6 */
6151 s->timeout = PFTM_ICMP_FIRST_PACKET;
6152 break;
6153 default:
6154 pf_set_protostate(s, PF_PEER_SRC, PFOTHERS_SINGLE);
6155 pf_set_protostate(s, PF_PEER_DST, PFOTHERS_NO_TRAFFIC);
6156 s->timeout = PFTM_OTHER_FIRST_PACKET;
6157 }
6158
6159 s->creation = s->expire = pf_get_uptime();
6160
6161 if (pd->proto == IPPROTO_TCP) {
6162 if (s->state_flags & PFSTATE_SCRUB_TCP &&
6163 pf_normalize_tcp_init(pd, th, &s->src)) {
6164 REASON_SET(&ctx->reason, PFRES_MEMORY);
6165 goto csfailed;
6166 }
6167 if (s->state_flags & PFSTATE_SCRUB_TCP && s->src.scrub &&
6168 pf_normalize_tcp_stateful(pd, &ctx->reason, th, s,
6169 &s->src, &s->dst, &ctx->rewrite)) {
6170 /* This really shouldn't happen!!! */
6171 DPFPRINTF(PF_DEBUG_URGENT,
6172 "%s: tcp normalize failed on first "
6173 "pkt", __func__);
6174 goto csfailed;
6175 }
6176 } else if (pd->proto == IPPROTO_SCTP) {
6177 if (pf_normalize_sctp_init(pd, &s->src, &s->dst))
6178 goto csfailed;
6179 if (! (pd->sctp_flags & (PFDESC_SCTP_INIT | PFDESC_SCTP_ADD_IP)))
6180 goto csfailed;
6181 }
6182 s->direction = pd->dir;
6183
6184 /*
6185 * sk/nk could already been setup by pf_get_translation().
6186 */
6187 if (ctx->sk == NULL && ctx->nk == NULL) {
6188 MPASS(pd->sport == NULL || (pd->osport == *pd->sport));
6189 MPASS(pd->dport == NULL || (pd->odport == *pd->dport));
6190 if (pf_state_key_setup(pd, pd->nsport, pd->ndport,
6191 &ctx->sk, &ctx->nk)) {
6192 goto csfailed;
6193 }
6194 } else
6195 KASSERT((ctx->sk != NULL && ctx->nk != NULL), ("%s: nr %p sk %p, nk %p",
6196 __func__, ctx->nr, ctx->sk, ctx->nk));
6197
6198 /* Swap sk/nk for PF_OUT. */
6199 if (pf_state_insert(BOUND_IFACE(s, pd), pd->kif,
6200 (pd->dir == PF_IN) ? ctx->sk : ctx->nk,
6201 (pd->dir == PF_IN) ? ctx->nk : ctx->sk, s)) {
6202 REASON_SET(&ctx->reason, PFRES_STATEINS);
6203 goto drop;
6204 } else
6205 *sm = s;
6206 ctx->sk = ctx->nk = NULL;
6207
6208 STATE_INC_COUNTERS(s);
6209
6210 /*
6211 * Lock order is important: first state, then source node.
6212 */
6213 for (pf_sn_types_t sn_type=0; sn_type<PF_SN_MAX; sn_type++) {
6214 if (pf_src_node_exists(&sns[sn_type], snhs[sn_type])) {
6215 s->sns[sn_type] = sns[sn_type];
6216 PF_HASHROW_UNLOCK(snhs[sn_type]);
6217 }
6218 }
6219
6220 if (ctx->tag > 0)
6221 s->tag = ctx->tag;
6222 if (pd->proto == IPPROTO_TCP && (tcp_get_flags(th) & (TH_SYN|TH_ACK)) ==
6223 TH_SYN && r->keep_state == PF_STATE_SYNPROXY && pd->dir == PF_IN) {
6224 pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_SRC);
6225 pf_undo_nat(ctx->nr, pd, bip_sum);
6226 s->src.seqhi = arc4random();
6227 /* Find mss option */
6228 int rtid = M_GETFIB(pd->m);
6229 mss = pf_get_mss(pd);
6230 mss = pf_calc_mss(pd->src, pd->af, rtid, mss);
6231 mss = pf_calc_mss(pd->dst, pd->af, rtid, mss);
6232 s->src.mss = mss;
6233 pf_send_tcp(r, pd->af, pd->dst, pd->src, th->th_dport,
6234 th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1,
6235 TH_SYN|TH_ACK, 0, s->src.mss, 0, M_SKIP_FIREWALL, 0, 0,
6236 pd->act.rtableid);
6237 REASON_SET(&ctx->reason, PFRES_SYNPROXY);
6238 return (PF_SYNPROXY_DROP);
6239 }
6240
6241 s->udp_mapping = ctx->udp_mapping;
6242
6243 return (PF_PASS);
6244
6245 csfailed:
6246 while ((ri = SLIST_FIRST(&ctx->rules))) {
6247 SLIST_REMOVE_HEAD(&ctx->rules, entry);
6248 free(ri, M_PF_RULE_ITEM);
6249 }
6250
6251 uma_zfree(V_pf_state_key_z, ctx->sk);
6252 uma_zfree(V_pf_state_key_z, ctx->nk);
6253
6254 for (pf_sn_types_t sn_type=0; sn_type<PF_SN_MAX; sn_type++) {
6255 if (pf_src_node_exists(&sns[sn_type], snhs[sn_type])) {
6256 if (--sns[sn_type]->states == 0 &&
6257 sns[sn_type]->expire == 0) {
6258 pf_unlink_src_node(sns[sn_type]);
6259 pf_free_src_node(sns[sn_type]);
6260 counter_u64_add(
6261 V_pf_status.scounters[SCNT_SRC_NODE_REMOVALS], 1);
6262 }
6263 PF_HASHROW_UNLOCK(snhs[sn_type]);
6264 }
6265 }
6266
6267 drop:
6268 if (s != NULL) {
6269 pf_src_tree_remove_state(s);
6270 s->timeout = PFTM_UNLINKED;
6271 pf_free_state(s);
6272 }
6273
6274 return (PF_DROP);
6275 }
6276
6277 int
pf_translate(struct pf_pdesc * pd,struct pf_addr * saddr,u_int16_t sport,struct pf_addr * daddr,u_int16_t dport,u_int16_t virtual_type,int icmp_dir)6278 pf_translate(struct pf_pdesc *pd, struct pf_addr *saddr, u_int16_t sport,
6279 struct pf_addr *daddr, u_int16_t dport, u_int16_t virtual_type,
6280 int icmp_dir)
6281 {
6282 /*
6283 * pf_translate() implements OpenBSD's "new" NAT approach.
6284 * We don't follow it, because it involves a breaking syntax change
6285 * (removing nat/rdr rules, moving it into regular pf rules.)
6286 * It also moves NAT processing to be done after normal rules evaluation
6287 * whereas in FreeBSD that's done before rules processing.
6288 *
6289 * We adopt the function only for nat64, and keep other NAT processing
6290 * before rules processing.
6291 */
6292 int rewrite = 0;
6293 int afto = pd->af != pd->naf;
6294
6295 MPASS(afto);
6296
6297 switch (pd->proto) {
6298 case IPPROTO_TCP:
6299 case IPPROTO_UDP:
6300 case IPPROTO_SCTP:
6301 if (afto || *pd->sport != sport) {
6302 pf_change_ap(pd, pd->src, pd->sport,
6303 saddr, sport);
6304 rewrite = 1;
6305 }
6306 if (afto || *pd->dport != dport) {
6307 pf_change_ap(pd, pd->dst, pd->dport,
6308 daddr, dport);
6309 rewrite = 1;
6310 }
6311 break;
6312
6313 #ifdef INET
6314 case IPPROTO_ICMP:
6315 /* pf_translate() is also used when logging invalid packets */
6316 if (pd->af != AF_INET)
6317 return (0);
6318
6319 if (afto) {
6320 if (pf_translate_icmp_af(AF_INET6, &pd->hdr.icmp))
6321 return (-1);
6322 pd->proto = IPPROTO_ICMPV6;
6323 rewrite = 1;
6324 }
6325 if (virtual_type == htons(ICMP_ECHO)) {
6326 u_int16_t icmpid = (icmp_dir == PF_IN) ? sport : dport;
6327
6328 if (icmpid != pd->hdr.icmp.icmp_id) {
6329 pd->hdr.icmp.icmp_cksum = pf_cksum_fixup(
6330 pd->hdr.icmp.icmp_cksum,
6331 pd->hdr.icmp.icmp_id, icmpid, 0);
6332 pd->hdr.icmp.icmp_id = icmpid;
6333 /* XXX TODO copyback. */
6334 rewrite = 1;
6335 }
6336 }
6337 break;
6338 #endif /* INET */
6339
6340 #ifdef INET6
6341 case IPPROTO_ICMPV6:
6342 /* pf_translate() is also used when logging invalid packets */
6343 if (pd->af != AF_INET6)
6344 return (0);
6345
6346 if (afto) {
6347 /* ip_sum will be recalculated in pf_translate_af */
6348 if (pf_translate_icmp_af(AF_INET, &pd->hdr.icmp6))
6349 return (0);
6350 pd->proto = IPPROTO_ICMP;
6351 rewrite = 1;
6352 }
6353 break;
6354 #endif /* INET6 */
6355
6356 default:
6357 break;
6358 }
6359
6360 return (rewrite);
6361 }
6362
6363 int
pf_translate_compat(struct pf_test_ctx * ctx)6364 pf_translate_compat(struct pf_test_ctx *ctx)
6365 {
6366 struct pf_pdesc *pd = ctx->pd;
6367 struct pf_state_key *nk = ctx->nk;
6368 struct tcphdr *th = &pd->hdr.tcp;
6369 int rewrite = 0;
6370
6371 KASSERT(ctx->sk != NULL, ("%s: null sk", __func__));
6372 KASSERT(ctx->nk != NULL, ("%s: null nk", __func__));
6373
6374 switch (pd->proto) {
6375 case IPPROTO_TCP:
6376 if (PF_ANEQ(&pd->nsaddr, &nk->addr[pd->sidx], pd->af) ||
6377 nk->port[pd->sidx] != pd->nsport) {
6378 pf_change_ap(pd, pd->src, &th->th_sport,
6379 &nk->addr[pd->sidx], nk->port[pd->sidx]);
6380 pd->sport = &th->th_sport;
6381 pd->nsport = th->th_sport;
6382 pf_addrcpy(&pd->nsaddr, pd->src, pd->af);
6383 }
6384
6385 if (PF_ANEQ(&pd->ndaddr, &nk->addr[pd->didx], pd->af) ||
6386 nk->port[pd->didx] != pd->ndport) {
6387 pf_change_ap(pd, pd->dst, &th->th_dport,
6388 &nk->addr[pd->didx], nk->port[pd->didx]);
6389 pd->dport = &th->th_dport;
6390 pd->ndport = th->th_dport;
6391 pf_addrcpy(&pd->ndaddr, pd->dst, pd->af);
6392 }
6393 rewrite++;
6394 break;
6395 case IPPROTO_UDP:
6396 if (PF_ANEQ(&pd->nsaddr, &nk->addr[pd->sidx], pd->af) ||
6397 nk->port[pd->sidx] != pd->nsport) {
6398 pf_change_ap(pd, pd->src,
6399 &pd->hdr.udp.uh_sport,
6400 &nk->addr[pd->sidx],
6401 nk->port[pd->sidx]);
6402 pd->sport = &pd->hdr.udp.uh_sport;
6403 pd->nsport = pd->hdr.udp.uh_sport;
6404 pf_addrcpy(&pd->nsaddr, pd->src, pd->af);
6405 }
6406
6407 if (PF_ANEQ(&pd->ndaddr, &nk->addr[pd->didx], pd->af) ||
6408 nk->port[pd->didx] != pd->ndport) {
6409 pf_change_ap(pd, pd->dst,
6410 &pd->hdr.udp.uh_dport,
6411 &nk->addr[pd->didx],
6412 nk->port[pd->didx]);
6413 pd->dport = &pd->hdr.udp.uh_dport;
6414 pd->ndport = pd->hdr.udp.uh_dport;
6415 pf_addrcpy(&pd->ndaddr, pd->dst, pd->af);
6416 }
6417 rewrite++;
6418 break;
6419 case IPPROTO_SCTP: {
6420 if (PF_ANEQ(&pd->nsaddr, &nk->addr[pd->sidx], pd->af) ||
6421 nk->port[pd->sidx] != pd->nsport) {
6422 pf_change_ap(pd, pd->src,
6423 &pd->hdr.sctp.src_port,
6424 &nk->addr[pd->sidx],
6425 nk->port[pd->sidx]);
6426 pd->sport = &pd->hdr.sctp.src_port;
6427 pd->nsport = pd->hdr.sctp.src_port;
6428 pf_addrcpy(&pd->nsaddr, pd->src, pd->af);
6429 }
6430 if (PF_ANEQ(&pd->ndaddr, &nk->addr[pd->didx], pd->af) ||
6431 nk->port[pd->didx] != pd->ndport) {
6432 pf_change_ap(pd, pd->dst,
6433 &pd->hdr.sctp.dest_port,
6434 &nk->addr[pd->didx],
6435 nk->port[pd->didx]);
6436 pd->dport = &pd->hdr.sctp.dest_port;
6437 pd->ndport = pd->hdr.sctp.dest_port;
6438 pf_addrcpy(&pd->ndaddr, pd->dst, pd->af);
6439 }
6440 break;
6441 }
6442 #ifdef INET
6443 case IPPROTO_ICMP:
6444 if (PF_ANEQ(&pd->nsaddr, &nk->addr[pd->sidx], AF_INET)) {
6445 pf_change_a(&pd->src->v4.s_addr, pd->ip_sum,
6446 nk->addr[pd->sidx].v4.s_addr, 0);
6447 pf_addrcpy(&pd->nsaddr, pd->src, pd->af);
6448 }
6449
6450 if (PF_ANEQ(&pd->ndaddr, &nk->addr[pd->didx], AF_INET)) {
6451 pf_change_a(&pd->dst->v4.s_addr, pd->ip_sum,
6452 nk->addr[pd->didx].v4.s_addr, 0);
6453 pf_addrcpy(&pd->ndaddr, pd->dst, pd->af);
6454 }
6455
6456 if (ctx->virtual_type == htons(ICMP_ECHO) &&
6457 nk->port[pd->sidx] != pd->hdr.icmp.icmp_id) {
6458 pd->hdr.icmp.icmp_cksum = pf_cksum_fixup(
6459 pd->hdr.icmp.icmp_cksum, pd->nsport,
6460 nk->port[pd->sidx], 0);
6461 pd->hdr.icmp.icmp_id = nk->port[pd->sidx];
6462 pd->sport = &pd->hdr.icmp.icmp_id;
6463 }
6464 m_copyback(pd->m, pd->off, ICMP_MINLEN, (caddr_t)&pd->hdr.icmp);
6465 break;
6466 #endif /* INET */
6467 #ifdef INET6
6468 case IPPROTO_ICMPV6:
6469 if (PF_ANEQ(&pd->nsaddr, &nk->addr[pd->sidx], AF_INET6)) {
6470 pf_change_a6(pd->src, &pd->hdr.icmp6.icmp6_cksum,
6471 &nk->addr[pd->sidx], 0);
6472 pf_addrcpy(&pd->nsaddr, pd->src, pd->af);
6473 }
6474
6475 if (PF_ANEQ(&pd->ndaddr, &nk->addr[pd->didx], AF_INET6)) {
6476 pf_change_a6(pd->dst, &pd->hdr.icmp6.icmp6_cksum,
6477 &nk->addr[pd->didx], 0);
6478 pf_addrcpy(&pd->ndaddr, pd->dst, pd->af);
6479 }
6480 rewrite++;
6481 break;
6482 #endif /* INET */
6483 default:
6484 switch (pd->af) {
6485 #ifdef INET
6486 case AF_INET:
6487 if (PF_ANEQ(&pd->nsaddr,
6488 &nk->addr[pd->sidx], AF_INET)) {
6489 pf_change_a(&pd->src->v4.s_addr,
6490 pd->ip_sum,
6491 nk->addr[pd->sidx].v4.s_addr, 0);
6492 pf_addrcpy(&pd->nsaddr, pd->src, pd->af);
6493 }
6494
6495 if (PF_ANEQ(&pd->ndaddr,
6496 &nk->addr[pd->didx], AF_INET)) {
6497 pf_change_a(&pd->dst->v4.s_addr,
6498 pd->ip_sum,
6499 nk->addr[pd->didx].v4.s_addr, 0);
6500 pf_addrcpy(&pd->ndaddr, pd->dst, pd->af);
6501 }
6502 break;
6503 #endif /* INET */
6504 #ifdef INET6
6505 case AF_INET6:
6506 if (PF_ANEQ(&pd->nsaddr,
6507 &nk->addr[pd->sidx], AF_INET6)) {
6508 pf_addrcpy(&pd->nsaddr, &nk->addr[pd->sidx],
6509 pd->af);
6510 pf_addrcpy(pd->src, &nk->addr[pd->sidx], pd->af);
6511 }
6512
6513 if (PF_ANEQ(&pd->ndaddr,
6514 &nk->addr[pd->didx], AF_INET6)) {
6515 pf_addrcpy(&pd->ndaddr, &nk->addr[pd->didx],
6516 pd->af);
6517 pf_addrcpy(pd->dst, &nk->addr[pd->didx],
6518 pd->af);
6519 }
6520 break;
6521 #endif /* INET6 */
6522 }
6523 break;
6524 }
6525 return (rewrite);
6526 }
6527
6528 static int
pf_tcp_track_full(struct pf_kstate * state,struct pf_pdesc * pd,u_short * reason,int * copyback,struct pf_state_peer * src,struct pf_state_peer * dst,u_int8_t psrc,u_int8_t pdst)6529 pf_tcp_track_full(struct pf_kstate *state, struct pf_pdesc *pd,
6530 u_short *reason, int *copyback, struct pf_state_peer *src,
6531 struct pf_state_peer *dst, u_int8_t psrc, u_int8_t pdst)
6532 {
6533 struct tcphdr *th = &pd->hdr.tcp;
6534 u_int16_t win = ntohs(th->th_win);
6535 u_int32_t ack, end, data_end, seq, orig_seq;
6536 u_int8_t sws, dws;
6537 int ackskew;
6538
6539 if (src->wscale && dst->wscale && !(tcp_get_flags(th) & TH_SYN)) {
6540 sws = src->wscale & PF_WSCALE_MASK;
6541 dws = dst->wscale & PF_WSCALE_MASK;
6542 } else
6543 sws = dws = 0;
6544
6545 /*
6546 * Sequence tracking algorithm from Guido van Rooij's paper:
6547 * http://www.madison-gurkha.com/publications/tcp_filtering/
6548 * tcp_filtering.ps
6549 */
6550
6551 orig_seq = seq = ntohl(th->th_seq);
6552 if (src->seqlo == 0) {
6553 /* First packet from this end. Set its state */
6554
6555 if ((state->state_flags & PFSTATE_SCRUB_TCP || dst->scrub) &&
6556 src->scrub == NULL) {
6557 if (pf_normalize_tcp_init(pd, th, src)) {
6558 REASON_SET(reason, PFRES_MEMORY);
6559 return (PF_DROP);
6560 }
6561 }
6562
6563 /* Deferred generation of sequence number modulator */
6564 if (dst->seqdiff && !src->seqdiff) {
6565 /* use random iss for the TCP server */
6566 while ((src->seqdiff = arc4random() - seq) == 0)
6567 ;
6568 ack = ntohl(th->th_ack) - dst->seqdiff;
6569 pf_change_proto_a(pd->m, &th->th_seq, &th->th_sum, htonl(seq +
6570 src->seqdiff), 0);
6571 pf_change_proto_a(pd->m, &th->th_ack, &th->th_sum, htonl(ack), 0);
6572 *copyback = 1;
6573 } else {
6574 ack = ntohl(th->th_ack);
6575 }
6576
6577 end = seq + pd->p_len;
6578 if (tcp_get_flags(th) & TH_SYN) {
6579 end++;
6580 if (dst->wscale & PF_WSCALE_FLAG) {
6581 src->wscale = pf_get_wscale(pd);
6582 if (src->wscale & PF_WSCALE_FLAG) {
6583 /* Remove scale factor from initial
6584 * window */
6585 sws = src->wscale & PF_WSCALE_MASK;
6586 win = ((u_int32_t)win + (1 << sws) - 1)
6587 >> sws;
6588 dws = dst->wscale & PF_WSCALE_MASK;
6589 } else {
6590 /* fixup other window */
6591 dst->max_win = MIN(TCP_MAXWIN,
6592 (u_int32_t)dst->max_win <<
6593 (dst->wscale & PF_WSCALE_MASK));
6594 /* in case of a retrans SYN|ACK */
6595 dst->wscale = 0;
6596 }
6597 }
6598 }
6599 data_end = end;
6600 if (tcp_get_flags(th) & TH_FIN)
6601 end++;
6602
6603 src->seqlo = seq;
6604 if (src->state < TCPS_SYN_SENT)
6605 pf_set_protostate(state, psrc, TCPS_SYN_SENT);
6606
6607 /*
6608 * May need to slide the window (seqhi may have been set by
6609 * the crappy stack check or if we picked up the connection
6610 * after establishment)
6611 */
6612 if (src->seqhi == 1 ||
6613 SEQ_GEQ(end + MAX(1, dst->max_win << dws), src->seqhi))
6614 src->seqhi = end + MAX(1, dst->max_win << dws);
6615 if (win > src->max_win)
6616 src->max_win = win;
6617
6618 } else {
6619 ack = ntohl(th->th_ack) - dst->seqdiff;
6620 if (src->seqdiff) {
6621 /* Modulate sequence numbers */
6622 pf_change_proto_a(pd->m, &th->th_seq, &th->th_sum, htonl(seq +
6623 src->seqdiff), 0);
6624 pf_change_proto_a(pd->m, &th->th_ack, &th->th_sum, htonl(ack), 0);
6625 *copyback = 1;
6626 }
6627 end = seq + pd->p_len;
6628 if (tcp_get_flags(th) & TH_SYN)
6629 end++;
6630 data_end = end;
6631 if (tcp_get_flags(th) & TH_FIN)
6632 end++;
6633 }
6634
6635 if ((tcp_get_flags(th) & TH_ACK) == 0) {
6636 /* Let it pass through the ack skew check */
6637 ack = dst->seqlo;
6638 } else if ((ack == 0 &&
6639 (tcp_get_flags(th) & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) ||
6640 /* broken tcp stacks do not set ack */
6641 (dst->state < TCPS_SYN_SENT)) {
6642 /*
6643 * Many stacks (ours included) will set the ACK number in an
6644 * FIN|ACK if the SYN times out -- no sequence to ACK.
6645 */
6646 ack = dst->seqlo;
6647 }
6648
6649 if (seq == end) {
6650 /* Ease sequencing restrictions on no data packets */
6651 seq = src->seqlo;
6652 data_end = end = seq;
6653 }
6654
6655 ackskew = dst->seqlo - ack;
6656
6657 /*
6658 * Need to demodulate the sequence numbers in any TCP SACK options
6659 * (Selective ACK). We could optionally validate the SACK values
6660 * against the current ACK window, either forwards or backwards, but
6661 * I'm not confident that SACK has been implemented properly
6662 * everywhere. It wouldn't surprise me if several stacks accidentally
6663 * SACK too far backwards of previously ACKed data. There really aren't
6664 * any security implications of bad SACKing unless the target stack
6665 * doesn't validate the option length correctly. Someone trying to
6666 * spoof into a TCP connection won't bother blindly sending SACK
6667 * options anyway.
6668 */
6669 if (dst->seqdiff && (th->th_off << 2) > sizeof(struct tcphdr)) {
6670 if (pf_modulate_sack(pd, th, dst))
6671 *copyback = 1;
6672 }
6673
6674 #define MAXACKWINDOW (0xffff + 1500) /* 1500 is an arbitrary fudge factor */
6675 if (SEQ_GEQ(src->seqhi, data_end) &&
6676 /* Last octet inside other's window space */
6677 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) &&
6678 /* Retrans: not more than one window back */
6679 (ackskew >= -MAXACKWINDOW) &&
6680 /* Acking not more than one reassembled fragment backwards */
6681 (ackskew <= (MAXACKWINDOW << sws)) &&
6682 /* Acking not more than one window forward */
6683 ((tcp_get_flags(th) & TH_RST) == 0 || orig_seq == src->seqlo ||
6684 (orig_seq == src->seqlo + 1) || (orig_seq + 1 == src->seqlo))) {
6685 /* Require an exact/+1 sequence match on resets when possible */
6686
6687 if (dst->scrub || src->scrub) {
6688 if (pf_normalize_tcp_stateful(pd, reason, th,
6689 state, src, dst, copyback))
6690 return (PF_DROP);
6691 }
6692
6693 /* update max window */
6694 if (src->max_win < win)
6695 src->max_win = win;
6696 /* synchronize sequencing */
6697 if (SEQ_GT(end, src->seqlo))
6698 src->seqlo = end;
6699 /* slide the window of what the other end can send */
6700 if (SEQ_GEQ(ack + (win << sws), dst->seqhi))
6701 dst->seqhi = ack + MAX((win << sws), 1);
6702
6703 /* update states */
6704 if (tcp_get_flags(th) & TH_SYN)
6705 if (src->state < TCPS_SYN_SENT)
6706 pf_set_protostate(state, psrc, TCPS_SYN_SENT);
6707 if (tcp_get_flags(th) & TH_FIN)
6708 if (src->state < TCPS_CLOSING)
6709 pf_set_protostate(state, psrc, TCPS_CLOSING);
6710 if (tcp_get_flags(th) & TH_ACK) {
6711 if (dst->state == TCPS_SYN_SENT) {
6712 pf_set_protostate(state, pdst,
6713 TCPS_ESTABLISHED);
6714 if (src->state == TCPS_ESTABLISHED &&
6715 state->sns[PF_SN_LIMIT] != NULL &&
6716 pf_src_connlimit(state)) {
6717 REASON_SET(reason, PFRES_SRCLIMIT);
6718 return (PF_DROP);
6719 }
6720 } else if (dst->state == TCPS_CLOSING)
6721 pf_set_protostate(state, pdst,
6722 TCPS_FIN_WAIT_2);
6723 }
6724 if (tcp_get_flags(th) & TH_RST)
6725 pf_set_protostate(state, PF_PEER_BOTH, TCPS_TIME_WAIT);
6726
6727 /* update expire time */
6728 state->expire = pf_get_uptime();
6729 if (src->state >= TCPS_FIN_WAIT_2 &&
6730 dst->state >= TCPS_FIN_WAIT_2)
6731 state->timeout = PFTM_TCP_CLOSED;
6732 else if (src->state >= TCPS_CLOSING &&
6733 dst->state >= TCPS_CLOSING)
6734 state->timeout = PFTM_TCP_FIN_WAIT;
6735 else if (src->state < TCPS_ESTABLISHED ||
6736 dst->state < TCPS_ESTABLISHED)
6737 state->timeout = PFTM_TCP_OPENING;
6738 else if (src->state >= TCPS_CLOSING ||
6739 dst->state >= TCPS_CLOSING)
6740 state->timeout = PFTM_TCP_CLOSING;
6741 else
6742 state->timeout = PFTM_TCP_ESTABLISHED;
6743
6744 /* Fall through to PASS packet */
6745
6746 } else if ((dst->state < TCPS_SYN_SENT ||
6747 dst->state >= TCPS_FIN_WAIT_2 ||
6748 src->state >= TCPS_FIN_WAIT_2) &&
6749 SEQ_GEQ(src->seqhi + MAXACKWINDOW, data_end) &&
6750 /* Within a window forward of the originating packet */
6751 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW)) {
6752 /* Within a window backward of the originating packet */
6753
6754 /*
6755 * This currently handles three situations:
6756 * 1) Stupid stacks will shotgun SYNs before their peer
6757 * replies.
6758 * 2) When PF catches an already established stream (the
6759 * firewall rebooted, the state table was flushed, routes
6760 * changed...)
6761 * 3) Packets get funky immediately after the connection
6762 * closes (this should catch Solaris spurious ACK|FINs
6763 * that web servers like to spew after a close)
6764 *
6765 * This must be a little more careful than the above code
6766 * since packet floods will also be caught here. We don't
6767 * update the TTL here to mitigate the damage of a packet
6768 * flood and so the same code can handle awkward establishment
6769 * and a loosened connection close.
6770 * In the establishment case, a correct peer response will
6771 * validate the connection, go through the normal state code
6772 * and keep updating the state TTL.
6773 */
6774
6775 if (V_pf_status.debug >= PF_DEBUG_MISC) {
6776 printf("pf: loose state match: ");
6777 pf_print_state(state);
6778 pf_print_flags(tcp_get_flags(th));
6779 printf(" seq=%u (%u) ack=%u len=%u ackskew=%d "
6780 "pkts=%llu:%llu dir=%s,%s\n", seq, orig_seq, ack,
6781 pd->p_len, ackskew, (unsigned long long)state->packets[0],
6782 (unsigned long long)state->packets[1],
6783 pd->dir == PF_IN ? "in" : "out",
6784 pd->dir == state->direction ? "fwd" : "rev");
6785 }
6786
6787 if (dst->scrub || src->scrub) {
6788 if (pf_normalize_tcp_stateful(pd, reason, th,
6789 state, src, dst, copyback))
6790 return (PF_DROP);
6791 }
6792
6793 /* update max window */
6794 if (src->max_win < win)
6795 src->max_win = win;
6796 /* synchronize sequencing */
6797 if (SEQ_GT(end, src->seqlo))
6798 src->seqlo = end;
6799 /* slide the window of what the other end can send */
6800 if (SEQ_GEQ(ack + (win << sws), dst->seqhi))
6801 dst->seqhi = ack + MAX((win << sws), 1);
6802
6803 /*
6804 * Cannot set dst->seqhi here since this could be a shotgunned
6805 * SYN and not an already established connection.
6806 */
6807
6808 if (tcp_get_flags(th) & TH_FIN)
6809 if (src->state < TCPS_CLOSING)
6810 pf_set_protostate(state, psrc, TCPS_CLOSING);
6811 if (tcp_get_flags(th) & TH_RST)
6812 pf_set_protostate(state, PF_PEER_BOTH, TCPS_TIME_WAIT);
6813
6814 /* Fall through to PASS packet */
6815
6816 } else {
6817 if (state->dst.state == TCPS_SYN_SENT &&
6818 state->src.state == TCPS_SYN_SENT) {
6819 /* Send RST for state mismatches during handshake */
6820 if (!(tcp_get_flags(th) & TH_RST))
6821 pf_send_tcp(state->rule, pd->af,
6822 pd->dst, pd->src, th->th_dport,
6823 th->th_sport, ntohl(th->th_ack), 0,
6824 TH_RST, 0, 0,
6825 state->rule->return_ttl, M_SKIP_FIREWALL,
6826 0, 0, state->act.rtableid);
6827 src->seqlo = 0;
6828 src->seqhi = 1;
6829 src->max_win = 1;
6830 } else if (V_pf_status.debug >= PF_DEBUG_MISC) {
6831 printf("pf: BAD state: ");
6832 pf_print_state(state);
6833 pf_print_flags(tcp_get_flags(th));
6834 printf(" seq=%u (%u) ack=%u len=%u ackskew=%d "
6835 "pkts=%llu:%llu dir=%s,%s\n",
6836 seq, orig_seq, ack, pd->p_len, ackskew,
6837 (unsigned long long)state->packets[0],
6838 (unsigned long long)state->packets[1],
6839 pd->dir == PF_IN ? "in" : "out",
6840 pd->dir == state->direction ? "fwd" : "rev");
6841 printf("pf: State failure on: %c %c %c %c | %c %c\n",
6842 SEQ_GEQ(src->seqhi, data_end) ? ' ' : '1',
6843 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) ?
6844 ' ': '2',
6845 (ackskew >= -MAXACKWINDOW) ? ' ' : '3',
6846 (ackskew <= (MAXACKWINDOW << sws)) ? ' ' : '4',
6847 SEQ_GEQ(src->seqhi + MAXACKWINDOW, data_end) ?' ' :'5',
6848 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW) ?' ' :'6');
6849 }
6850 REASON_SET(reason, PFRES_BADSTATE);
6851 return (PF_DROP);
6852 }
6853
6854 return (PF_PASS);
6855 }
6856
6857 static int
pf_tcp_track_sloppy(struct pf_kstate * state,struct pf_pdesc * pd,u_short * reason,struct pf_state_peer * src,struct pf_state_peer * dst,u_int8_t psrc,u_int8_t pdst)6858 pf_tcp_track_sloppy(struct pf_kstate *state, struct pf_pdesc *pd,
6859 u_short *reason, struct pf_state_peer *src, struct pf_state_peer *dst,
6860 u_int8_t psrc, u_int8_t pdst)
6861 {
6862 struct tcphdr *th = &pd->hdr.tcp;
6863
6864 if (tcp_get_flags(th) & TH_SYN)
6865 if (src->state < TCPS_SYN_SENT)
6866 pf_set_protostate(state, psrc, TCPS_SYN_SENT);
6867 if (tcp_get_flags(th) & TH_FIN)
6868 if (src->state < TCPS_CLOSING)
6869 pf_set_protostate(state, psrc, TCPS_CLOSING);
6870 if (tcp_get_flags(th) & TH_ACK) {
6871 if (dst->state == TCPS_SYN_SENT) {
6872 pf_set_protostate(state, pdst, TCPS_ESTABLISHED);
6873 if (src->state == TCPS_ESTABLISHED &&
6874 state->sns[PF_SN_LIMIT] != NULL &&
6875 pf_src_connlimit(state)) {
6876 REASON_SET(reason, PFRES_SRCLIMIT);
6877 return (PF_DROP);
6878 }
6879 } else if (dst->state == TCPS_CLOSING) {
6880 pf_set_protostate(state, pdst, TCPS_FIN_WAIT_2);
6881 } else if (src->state == TCPS_SYN_SENT &&
6882 dst->state < TCPS_SYN_SENT) {
6883 /*
6884 * Handle a special sloppy case where we only see one
6885 * half of the connection. If there is a ACK after
6886 * the initial SYN without ever seeing a packet from
6887 * the destination, set the connection to established.
6888 */
6889 pf_set_protostate(state, PF_PEER_BOTH,
6890 TCPS_ESTABLISHED);
6891 dst->state = src->state = TCPS_ESTABLISHED;
6892 if (state->sns[PF_SN_LIMIT] != NULL &&
6893 pf_src_connlimit(state)) {
6894 REASON_SET(reason, PFRES_SRCLIMIT);
6895 return (PF_DROP);
6896 }
6897 } else if (src->state == TCPS_CLOSING &&
6898 dst->state == TCPS_ESTABLISHED &&
6899 dst->seqlo == 0) {
6900 /*
6901 * Handle the closing of half connections where we
6902 * don't see the full bidirectional FIN/ACK+ACK
6903 * handshake.
6904 */
6905 pf_set_protostate(state, pdst, TCPS_CLOSING);
6906 }
6907 }
6908 if (tcp_get_flags(th) & TH_RST)
6909 pf_set_protostate(state, PF_PEER_BOTH, TCPS_TIME_WAIT);
6910
6911 /* update expire time */
6912 state->expire = pf_get_uptime();
6913 if (src->state >= TCPS_FIN_WAIT_2 &&
6914 dst->state >= TCPS_FIN_WAIT_2)
6915 state->timeout = PFTM_TCP_CLOSED;
6916 else if (src->state >= TCPS_CLOSING &&
6917 dst->state >= TCPS_CLOSING)
6918 state->timeout = PFTM_TCP_FIN_WAIT;
6919 else if (src->state < TCPS_ESTABLISHED ||
6920 dst->state < TCPS_ESTABLISHED)
6921 state->timeout = PFTM_TCP_OPENING;
6922 else if (src->state >= TCPS_CLOSING ||
6923 dst->state >= TCPS_CLOSING)
6924 state->timeout = PFTM_TCP_CLOSING;
6925 else
6926 state->timeout = PFTM_TCP_ESTABLISHED;
6927
6928 return (PF_PASS);
6929 }
6930
6931 static int
pf_synproxy(struct pf_pdesc * pd,struct pf_kstate * state,u_short * reason)6932 pf_synproxy(struct pf_pdesc *pd, struct pf_kstate *state, u_short *reason)
6933 {
6934 struct pf_state_key *sk = state->key[pd->didx];
6935 struct tcphdr *th = &pd->hdr.tcp;
6936
6937 if (state->src.state == PF_TCPS_PROXY_SRC) {
6938 if (pd->dir != state->direction) {
6939 REASON_SET(reason, PFRES_SYNPROXY);
6940 return (PF_SYNPROXY_DROP);
6941 }
6942 if (tcp_get_flags(th) & TH_SYN) {
6943 if (ntohl(th->th_seq) != state->src.seqlo) {
6944 REASON_SET(reason, PFRES_SYNPROXY);
6945 return (PF_DROP);
6946 }
6947 pf_send_tcp(state->rule, pd->af, pd->dst,
6948 pd->src, th->th_dport, th->th_sport,
6949 state->src.seqhi, ntohl(th->th_seq) + 1,
6950 TH_SYN|TH_ACK, 0, state->src.mss, 0,
6951 M_SKIP_FIREWALL, 0, 0, state->act.rtableid);
6952 REASON_SET(reason, PFRES_SYNPROXY);
6953 return (PF_SYNPROXY_DROP);
6954 } else if ((tcp_get_flags(th) & (TH_ACK|TH_RST|TH_FIN)) != TH_ACK ||
6955 (ntohl(th->th_ack) != state->src.seqhi + 1) ||
6956 (ntohl(th->th_seq) != state->src.seqlo + 1)) {
6957 REASON_SET(reason, PFRES_SYNPROXY);
6958 return (PF_DROP);
6959 } else if (state->sns[PF_SN_LIMIT] != NULL &&
6960 pf_src_connlimit(state)) {
6961 REASON_SET(reason, PFRES_SRCLIMIT);
6962 return (PF_DROP);
6963 } else
6964 pf_set_protostate(state, PF_PEER_SRC,
6965 PF_TCPS_PROXY_DST);
6966 }
6967 if (state->src.state == PF_TCPS_PROXY_DST) {
6968 if (pd->dir == state->direction) {
6969 if (((tcp_get_flags(th) & (TH_SYN|TH_ACK)) != TH_ACK) ||
6970 (ntohl(th->th_ack) != state->src.seqhi + 1) ||
6971 (ntohl(th->th_seq) != state->src.seqlo + 1)) {
6972 REASON_SET(reason, PFRES_SYNPROXY);
6973 return (PF_DROP);
6974 }
6975 state->src.max_win = MAX(ntohs(th->th_win), 1);
6976 if (state->dst.seqhi == 1)
6977 state->dst.seqhi = arc4random();
6978 pf_send_tcp(state->rule, pd->af,
6979 &sk->addr[pd->sidx], &sk->addr[pd->didx],
6980 sk->port[pd->sidx], sk->port[pd->didx],
6981 state->dst.seqhi, 0, TH_SYN, 0,
6982 state->src.mss, 0,
6983 state->orig_kif->pfik_ifp == V_loif ? M_LOOP : 0,
6984 state->tag, 0, state->act.rtableid);
6985 REASON_SET(reason, PFRES_SYNPROXY);
6986 return (PF_SYNPROXY_DROP);
6987 } else if (((tcp_get_flags(th) & (TH_SYN|TH_ACK)) !=
6988 (TH_SYN|TH_ACK)) ||
6989 (ntohl(th->th_ack) != state->dst.seqhi + 1)) {
6990 REASON_SET(reason, PFRES_SYNPROXY);
6991 return (PF_DROP);
6992 } else {
6993 state->dst.max_win = MAX(ntohs(th->th_win), 1);
6994 state->dst.seqlo = ntohl(th->th_seq);
6995 pf_send_tcp(state->rule, pd->af, pd->dst,
6996 pd->src, th->th_dport, th->th_sport,
6997 ntohl(th->th_ack), ntohl(th->th_seq) + 1,
6998 TH_ACK, state->src.max_win, 0, 0, 0,
6999 state->tag, 0, state->act.rtableid);
7000 pf_send_tcp(state->rule, pd->af,
7001 &sk->addr[pd->sidx], &sk->addr[pd->didx],
7002 sk->port[pd->sidx], sk->port[pd->didx],
7003 state->src.seqhi + 1, state->src.seqlo + 1,
7004 TH_ACK, state->dst.max_win, 0, 0,
7005 M_SKIP_FIREWALL, 0, 0, state->act.rtableid);
7006 state->src.seqdiff = state->dst.seqhi -
7007 state->src.seqlo;
7008 state->dst.seqdiff = state->src.seqhi -
7009 state->dst.seqlo;
7010 state->src.seqhi = state->src.seqlo +
7011 state->dst.max_win;
7012 state->dst.seqhi = state->dst.seqlo +
7013 state->src.max_win;
7014 state->src.wscale = state->dst.wscale = 0;
7015 pf_set_protostate(state, PF_PEER_BOTH,
7016 TCPS_ESTABLISHED);
7017 REASON_SET(reason, PFRES_SYNPROXY);
7018 return (PF_SYNPROXY_DROP);
7019 }
7020 }
7021
7022 return (PF_PASS);
7023 }
7024
7025 static int
pf_test_state(struct pf_kstate ** state,struct pf_pdesc * pd,u_short * reason)7026 pf_test_state(struct pf_kstate **state, struct pf_pdesc *pd, u_short *reason)
7027 {
7028 struct pf_state_key_cmp key;
7029 int copyback = 0;
7030 struct pf_state_peer *src, *dst;
7031 uint8_t psrc, pdst;
7032 int action;
7033
7034 bzero(&key, sizeof(key));
7035 key.af = pd->af;
7036 key.proto = pd->virtual_proto;
7037 pf_addrcpy(&key.addr[pd->sidx], pd->src, key.af);
7038 pf_addrcpy(&key.addr[pd->didx], pd->dst, key.af);
7039 key.port[pd->sidx] = pd->osport;
7040 key.port[pd->didx] = pd->odport;
7041
7042 action = pf_find_state(pd, &key, state);
7043 if (action != PF_MATCH)
7044 return (action);
7045
7046 action = PF_PASS;
7047 if (pd->dir == (*state)->direction) {
7048 if (PF_REVERSED_KEY(*state, pd->af)) {
7049 src = &(*state)->dst;
7050 dst = &(*state)->src;
7051 psrc = PF_PEER_DST;
7052 pdst = PF_PEER_SRC;
7053 } else {
7054 src = &(*state)->src;
7055 dst = &(*state)->dst;
7056 psrc = PF_PEER_SRC;
7057 pdst = PF_PEER_DST;
7058 }
7059 } else {
7060 if (PF_REVERSED_KEY(*state, pd->af)) {
7061 src = &(*state)->src;
7062 dst = &(*state)->dst;
7063 psrc = PF_PEER_SRC;
7064 pdst = PF_PEER_DST;
7065 } else {
7066 src = &(*state)->dst;
7067 dst = &(*state)->src;
7068 psrc = PF_PEER_DST;
7069 pdst = PF_PEER_SRC;
7070 }
7071 }
7072
7073 switch (pd->virtual_proto) {
7074 case IPPROTO_TCP: {
7075 struct tcphdr *th = &pd->hdr.tcp;
7076
7077 if ((action = pf_synproxy(pd, *state, reason)) != PF_PASS)
7078 return (action);
7079 if (((tcp_get_flags(th) & (TH_SYN | TH_ACK)) == TH_SYN) ||
7080 ((th->th_flags & (TH_SYN | TH_ACK | TH_RST)) == TH_ACK &&
7081 pf_syncookie_check(pd) && pd->dir == PF_IN)) {
7082 if ((*state)->src.state >= TCPS_FIN_WAIT_2 &&
7083 (*state)->dst.state >= TCPS_FIN_WAIT_2) {
7084 if (V_pf_status.debug >= PF_DEBUG_MISC) {
7085 printf("pf: state reuse ");
7086 pf_print_state(*state);
7087 pf_print_flags(tcp_get_flags(th));
7088 printf("\n");
7089 }
7090 /* XXX make sure it's the same direction ?? */
7091 pf_set_protostate(*state, PF_PEER_BOTH, TCPS_CLOSED);
7092 pf_remove_state(*state);
7093 *state = NULL;
7094 return (PF_DROP);
7095 } else if ((*state)->src.state >= TCPS_ESTABLISHED &&
7096 (*state)->dst.state >= TCPS_ESTABLISHED) {
7097 /*
7098 * SYN matches existing state???
7099 * Typically happens when sender boots up after
7100 * sudden panic. Certain protocols (NFSv3) are
7101 * always using same port numbers. Challenge
7102 * ACK enables all parties (firewall and peers)
7103 * to get in sync again.
7104 */
7105 pf_send_challenge_ack(pd, *state, src, dst);
7106 return (PF_DROP);
7107 }
7108 }
7109 if ((*state)->state_flags & PFSTATE_SLOPPY) {
7110 if (pf_tcp_track_sloppy(*state, pd, reason, src, dst,
7111 psrc, pdst) == PF_DROP)
7112 return (PF_DROP);
7113 } else {
7114 int ret;
7115
7116 ret = pf_tcp_track_full(*state, pd, reason,
7117 ©back, src, dst, psrc, pdst);
7118 if (ret == PF_DROP)
7119 return (PF_DROP);
7120 }
7121 break;
7122 }
7123 case IPPROTO_UDP:
7124 /* update states */
7125 if (src->state < PFUDPS_SINGLE)
7126 pf_set_protostate(*state, psrc, PFUDPS_SINGLE);
7127 if (dst->state == PFUDPS_SINGLE)
7128 pf_set_protostate(*state, pdst, PFUDPS_MULTIPLE);
7129
7130 /* update expire time */
7131 (*state)->expire = pf_get_uptime();
7132 if (src->state == PFUDPS_MULTIPLE && dst->state == PFUDPS_MULTIPLE)
7133 (*state)->timeout = PFTM_UDP_MULTIPLE;
7134 else
7135 (*state)->timeout = PFTM_UDP_SINGLE;
7136 break;
7137 case IPPROTO_SCTP:
7138 if ((src->state >= SCTP_SHUTDOWN_SENT || src->state == SCTP_CLOSED) &&
7139 (dst->state >= SCTP_SHUTDOWN_SENT || dst->state == SCTP_CLOSED) &&
7140 pd->sctp_flags & PFDESC_SCTP_INIT) {
7141 pf_set_protostate(*state, PF_PEER_BOTH, SCTP_CLOSED);
7142 pf_remove_state(*state);
7143 *state = NULL;
7144 return (PF_DROP);
7145 }
7146
7147 if (pf_sctp_track(*state, pd, reason) != PF_PASS)
7148 return (PF_DROP);
7149
7150 /* Track state. */
7151 if (pd->sctp_flags & PFDESC_SCTP_INIT) {
7152 if (src->state < SCTP_COOKIE_WAIT) {
7153 pf_set_protostate(*state, psrc, SCTP_COOKIE_WAIT);
7154 (*state)->timeout = PFTM_SCTP_OPENING;
7155 }
7156 }
7157 if (pd->sctp_flags & PFDESC_SCTP_INIT_ACK) {
7158 MPASS(dst->scrub != NULL);
7159 if (dst->scrub->pfss_v_tag == 0)
7160 dst->scrub->pfss_v_tag = pd->sctp_initiate_tag;
7161 }
7162
7163 /*
7164 * Bind to the correct interface if we're if-bound. For multihomed
7165 * extra associations we don't know which interface that will be until
7166 * here, so we've inserted the state on V_pf_all. Fix that now.
7167 */
7168 if ((*state)->kif == V_pfi_all &&
7169 (*state)->rule->rule_flag & PFRULE_IFBOUND)
7170 (*state)->kif = pd->kif;
7171
7172 if (pd->sctp_flags & (PFDESC_SCTP_COOKIE | PFDESC_SCTP_HEARTBEAT_ACK)) {
7173 if (src->state < SCTP_ESTABLISHED) {
7174 pf_set_protostate(*state, psrc, SCTP_ESTABLISHED);
7175 (*state)->timeout = PFTM_SCTP_ESTABLISHED;
7176 }
7177 }
7178 if (pd->sctp_flags & (PFDESC_SCTP_SHUTDOWN |
7179 PFDESC_SCTP_SHUTDOWN_COMPLETE)) {
7180 if (src->state < SCTP_SHUTDOWN_PENDING) {
7181 pf_set_protostate(*state, psrc, SCTP_SHUTDOWN_PENDING);
7182 (*state)->timeout = PFTM_SCTP_CLOSING;
7183 }
7184 }
7185 if (pd->sctp_flags & (PFDESC_SCTP_SHUTDOWN_COMPLETE | PFDESC_SCTP_ABORT)) {
7186 pf_set_protostate(*state, psrc, SCTP_CLOSED);
7187 (*state)->timeout = PFTM_SCTP_CLOSED;
7188 }
7189
7190 (*state)->expire = pf_get_uptime();
7191 break;
7192 default:
7193 /* update states */
7194 if (src->state < PFOTHERS_SINGLE)
7195 pf_set_protostate(*state, psrc, PFOTHERS_SINGLE);
7196 if (dst->state == PFOTHERS_SINGLE)
7197 pf_set_protostate(*state, pdst, PFOTHERS_MULTIPLE);
7198
7199 /* update expire time */
7200 (*state)->expire = pf_get_uptime();
7201 if (src->state == PFOTHERS_MULTIPLE && dst->state == PFOTHERS_MULTIPLE)
7202 (*state)->timeout = PFTM_OTHER_MULTIPLE;
7203 else
7204 (*state)->timeout = PFTM_OTHER_SINGLE;
7205 break;
7206 }
7207
7208 /* translate source/destination address, if necessary */
7209 if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) {
7210 struct pf_state_key *nk;
7211 int afto, sidx, didx;
7212
7213 if (PF_REVERSED_KEY(*state, pd->af))
7214 nk = (*state)->key[pd->sidx];
7215 else
7216 nk = (*state)->key[pd->didx];
7217
7218 afto = pd->af != nk->af;
7219
7220 if (afto && (*state)->direction == PF_IN) {
7221 sidx = pd->didx;
7222 didx = pd->sidx;
7223 } else {
7224 sidx = pd->sidx;
7225 didx = pd->didx;
7226 }
7227
7228 if (afto) {
7229 pf_addrcpy(&pd->nsaddr, &nk->addr[sidx], nk->af);
7230 pf_addrcpy(&pd->ndaddr, &nk->addr[didx], nk->af);
7231 pd->naf = nk->af;
7232 action = PF_AFRT;
7233 }
7234
7235 if (afto || PF_ANEQ(pd->src, &nk->addr[sidx], pd->af) ||
7236 nk->port[sidx] != pd->osport)
7237 pf_change_ap(pd, pd->src, pd->sport,
7238 &nk->addr[sidx], nk->port[sidx]);
7239
7240 if (afto || PF_ANEQ(pd->dst, &nk->addr[didx], pd->af) ||
7241 nk->port[didx] != pd->odport)
7242 pf_change_ap(pd, pd->dst, pd->dport,
7243 &nk->addr[didx], nk->port[didx]);
7244
7245 copyback = 1;
7246 }
7247
7248 if (copyback && pd->hdrlen > 0)
7249 m_copyback(pd->m, pd->off, pd->hdrlen, pd->hdr.any);
7250
7251 return (action);
7252 }
7253
7254 static int
pf_sctp_track(struct pf_kstate * state,struct pf_pdesc * pd,u_short * reason)7255 pf_sctp_track(struct pf_kstate *state, struct pf_pdesc *pd,
7256 u_short *reason)
7257 {
7258 struct pf_state_peer *src;
7259 if (pd->dir == state->direction) {
7260 if (PF_REVERSED_KEY(state, pd->af))
7261 src = &state->dst;
7262 else
7263 src = &state->src;
7264 } else {
7265 if (PF_REVERSED_KEY(state, pd->af))
7266 src = &state->src;
7267 else
7268 src = &state->dst;
7269 }
7270
7271 if (src->scrub != NULL) {
7272 if (src->scrub->pfss_v_tag == 0)
7273 src->scrub->pfss_v_tag = pd->hdr.sctp.v_tag;
7274 else if (src->scrub->pfss_v_tag != pd->hdr.sctp.v_tag)
7275 return (PF_DROP);
7276 }
7277
7278 return (PF_PASS);
7279 }
7280
7281 static void
pf_sctp_multihome_detach_addr(const struct pf_kstate * s)7282 pf_sctp_multihome_detach_addr(const struct pf_kstate *s)
7283 {
7284 struct pf_sctp_endpoint key;
7285 struct pf_sctp_endpoint *ep;
7286 struct pf_state_key *sks = s->key[PF_SK_STACK];
7287 struct pf_sctp_source *i, *tmp;
7288
7289 if (sks == NULL || sks->proto != IPPROTO_SCTP || s->dst.scrub == NULL)
7290 return;
7291
7292 PF_SCTP_ENDPOINTS_LOCK();
7293
7294 key.v_tag = s->dst.scrub->pfss_v_tag;
7295 ep = RB_FIND(pf_sctp_endpoints, &V_pf_sctp_endpoints, &key);
7296 if (ep != NULL) {
7297 TAILQ_FOREACH_SAFE(i, &ep->sources, entry, tmp) {
7298 if (pf_addr_cmp(&i->addr,
7299 &s->key[PF_SK_WIRE]->addr[s->direction == PF_OUT],
7300 s->key[PF_SK_WIRE]->af) == 0) {
7301 SDT_PROBE3(pf, sctp, multihome, remove,
7302 key.v_tag, s, i);
7303 TAILQ_REMOVE(&ep->sources, i, entry);
7304 free(i, M_PFTEMP);
7305 break;
7306 }
7307 }
7308
7309 if (TAILQ_EMPTY(&ep->sources)) {
7310 RB_REMOVE(pf_sctp_endpoints, &V_pf_sctp_endpoints, ep);
7311 free(ep, M_PFTEMP);
7312 }
7313 }
7314
7315 /* Other direction. */
7316 key.v_tag = s->src.scrub->pfss_v_tag;
7317 ep = RB_FIND(pf_sctp_endpoints, &V_pf_sctp_endpoints, &key);
7318 if (ep != NULL) {
7319 TAILQ_FOREACH_SAFE(i, &ep->sources, entry, tmp) {
7320 if (pf_addr_cmp(&i->addr,
7321 &s->key[PF_SK_WIRE]->addr[s->direction == PF_IN],
7322 s->key[PF_SK_WIRE]->af) == 0) {
7323 SDT_PROBE3(pf, sctp, multihome, remove,
7324 key.v_tag, s, i);
7325 TAILQ_REMOVE(&ep->sources, i, entry);
7326 free(i, M_PFTEMP);
7327 break;
7328 }
7329 }
7330
7331 if (TAILQ_EMPTY(&ep->sources)) {
7332 RB_REMOVE(pf_sctp_endpoints, &V_pf_sctp_endpoints, ep);
7333 free(ep, M_PFTEMP);
7334 }
7335 }
7336
7337 PF_SCTP_ENDPOINTS_UNLOCK();
7338 }
7339
7340 static void
pf_sctp_multihome_add_addr(struct pf_pdesc * pd,struct pf_addr * a,uint32_t v_tag)7341 pf_sctp_multihome_add_addr(struct pf_pdesc *pd, struct pf_addr *a, uint32_t v_tag)
7342 {
7343 struct pf_sctp_endpoint key = {
7344 .v_tag = v_tag,
7345 };
7346 struct pf_sctp_source *i;
7347 struct pf_sctp_endpoint *ep;
7348 int count;
7349
7350 PF_SCTP_ENDPOINTS_LOCK();
7351
7352 ep = RB_FIND(pf_sctp_endpoints, &V_pf_sctp_endpoints, &key);
7353 if (ep == NULL) {
7354 ep = malloc(sizeof(struct pf_sctp_endpoint),
7355 M_PFTEMP, M_NOWAIT);
7356 if (ep == NULL) {
7357 PF_SCTP_ENDPOINTS_UNLOCK();
7358 return;
7359 }
7360
7361 ep->v_tag = v_tag;
7362 TAILQ_INIT(&ep->sources);
7363 RB_INSERT(pf_sctp_endpoints, &V_pf_sctp_endpoints, ep);
7364 }
7365
7366 /* Avoid inserting duplicates. */
7367 count = 0;
7368 TAILQ_FOREACH(i, &ep->sources, entry) {
7369 count++;
7370 if (pf_addr_cmp(&i->addr, a, pd->af) == 0) {
7371 PF_SCTP_ENDPOINTS_UNLOCK();
7372 return;
7373 }
7374 }
7375
7376 /* Limit the number of addresses per endpoint. */
7377 if (count >= PF_SCTP_MAX_ENDPOINTS) {
7378 PF_SCTP_ENDPOINTS_UNLOCK();
7379 return;
7380 }
7381
7382 i = malloc(sizeof(*i), M_PFTEMP, M_NOWAIT);
7383 if (i == NULL) {
7384 PF_SCTP_ENDPOINTS_UNLOCK();
7385 return;
7386 }
7387
7388 i->af = pd->af;
7389 memcpy(&i->addr, a, sizeof(*a));
7390 TAILQ_INSERT_TAIL(&ep->sources, i, entry);
7391 SDT_PROBE2(pf, sctp, multihome, add, v_tag, i);
7392
7393 PF_SCTP_ENDPOINTS_UNLOCK();
7394 }
7395
7396 static void
pf_sctp_multihome_delayed(struct pf_pdesc * pd,struct pfi_kkif * kif,struct pf_kstate * s,int action)7397 pf_sctp_multihome_delayed(struct pf_pdesc *pd, struct pfi_kkif *kif,
7398 struct pf_kstate *s, int action)
7399 {
7400 struct pf_sctp_multihome_job *j, *tmp;
7401 struct pf_sctp_source *i;
7402 int ret __unused;
7403 struct pf_kstate *sm = NULL;
7404 struct pf_krule *ra = NULL;
7405 struct pf_krule *r = &V_pf_default_rule;
7406 struct pf_kruleset *rs = NULL;
7407 u_short reason;
7408 bool do_extra = true;
7409
7410 PF_RULES_RLOCK_TRACKER;
7411
7412 again:
7413 TAILQ_FOREACH_SAFE(j, &pd->sctp_multihome_jobs, next, tmp) {
7414 if (s == NULL || action != PF_PASS)
7415 goto free;
7416
7417 /* Confirm we don't recurse here. */
7418 MPASS(! (pd->sctp_flags & PFDESC_SCTP_ADD_IP));
7419
7420 switch (j->op) {
7421 case SCTP_ADD_IP_ADDRESS: {
7422 uint32_t v_tag = pd->sctp_initiate_tag;
7423
7424 if (v_tag == 0) {
7425 if (s->direction == pd->dir)
7426 v_tag = s->src.scrub->pfss_v_tag;
7427 else
7428 v_tag = s->dst.scrub->pfss_v_tag;
7429 }
7430
7431 /*
7432 * Avoid duplicating states. We'll already have
7433 * created a state based on the source address of
7434 * the packet, but SCTP endpoints may also list this
7435 * address again in the INIT(_ACK) parameters.
7436 */
7437 if (pf_addr_cmp(&j->src, pd->src, pd->af) == 0) {
7438 break;
7439 }
7440
7441 j->pd.sctp_flags |= PFDESC_SCTP_ADD_IP;
7442 PF_RULES_RLOCK();
7443 sm = NULL;
7444 if (s->rule->rule_flag & PFRULE_ALLOW_RELATED) {
7445 j->pd.related_rule = s->rule;
7446 }
7447 ret = pf_test_rule(&r, &sm,
7448 &j->pd, &ra, &rs, &reason, NULL);
7449 PF_RULES_RUNLOCK();
7450 SDT_PROBE4(pf, sctp, multihome, test, kif, r, j->pd.m, ret);
7451 if (ret != PF_DROP && sm != NULL) {
7452 /* Inherit v_tag values. */
7453 if (sm->direction == s->direction) {
7454 sm->src.scrub->pfss_v_tag = s->src.scrub->pfss_v_tag;
7455 sm->dst.scrub->pfss_v_tag = s->dst.scrub->pfss_v_tag;
7456 } else {
7457 sm->src.scrub->pfss_v_tag = s->dst.scrub->pfss_v_tag;
7458 sm->dst.scrub->pfss_v_tag = s->src.scrub->pfss_v_tag;
7459 }
7460 PF_STATE_UNLOCK(sm);
7461 } else {
7462 /* If we try duplicate inserts? */
7463 break;
7464 }
7465
7466 /* Only add the address if we've actually allowed the state. */
7467 pf_sctp_multihome_add_addr(pd, &j->src, v_tag);
7468
7469 if (! do_extra) {
7470 break;
7471 }
7472 /*
7473 * We need to do this for each of our source addresses.
7474 * Find those based on the verification tag.
7475 */
7476 struct pf_sctp_endpoint key = {
7477 .v_tag = pd->hdr.sctp.v_tag,
7478 };
7479 struct pf_sctp_endpoint *ep;
7480
7481 PF_SCTP_ENDPOINTS_LOCK();
7482 ep = RB_FIND(pf_sctp_endpoints, &V_pf_sctp_endpoints, &key);
7483 if (ep == NULL) {
7484 PF_SCTP_ENDPOINTS_UNLOCK();
7485 break;
7486 }
7487 MPASS(ep != NULL);
7488
7489 TAILQ_FOREACH(i, &ep->sources, entry) {
7490 struct pf_sctp_multihome_job *nj;
7491
7492 /* SCTP can intermingle IPv4 and IPv6. */
7493 if (i->af != pd->af)
7494 continue;
7495
7496 nj = malloc(sizeof(*nj), M_PFTEMP, M_NOWAIT | M_ZERO);
7497 if (! nj) {
7498 continue;
7499 }
7500 memcpy(&nj->pd, &j->pd, sizeof(j->pd));
7501 memcpy(&nj->src, &j->src, sizeof(nj->src));
7502 nj->pd.src = &nj->src;
7503 // New destination address!
7504 memcpy(&nj->dst, &i->addr, sizeof(nj->dst));
7505 nj->pd.dst = &nj->dst;
7506 nj->pd.m = j->pd.m;
7507 nj->op = j->op;
7508
7509 TAILQ_INSERT_TAIL(&pd->sctp_multihome_jobs, nj, next);
7510 }
7511 PF_SCTP_ENDPOINTS_UNLOCK();
7512
7513 break;
7514 }
7515 case SCTP_DEL_IP_ADDRESS: {
7516 struct pf_state_key_cmp key;
7517 uint8_t psrc;
7518 int action;
7519
7520 bzero(&key, sizeof(key));
7521 key.af = j->pd.af;
7522 key.proto = IPPROTO_SCTP;
7523 if (j->pd.dir == PF_IN) { /* wire side, straight */
7524 pf_addrcpy(&key.addr[0], j->pd.src, key.af);
7525 pf_addrcpy(&key.addr[1], j->pd.dst, key.af);
7526 key.port[0] = j->pd.hdr.sctp.src_port;
7527 key.port[1] = j->pd.hdr.sctp.dest_port;
7528 } else { /* stack side, reverse */
7529 pf_addrcpy(&key.addr[1], j->pd.src, key.af);
7530 pf_addrcpy(&key.addr[0], j->pd.dst, key.af);
7531 key.port[1] = j->pd.hdr.sctp.src_port;
7532 key.port[0] = j->pd.hdr.sctp.dest_port;
7533 }
7534
7535 action = pf_find_state(&j->pd, &key, &sm);
7536 if (action == PF_MATCH) {
7537 PF_STATE_LOCK_ASSERT(sm);
7538 if (j->pd.dir == sm->direction) {
7539 psrc = PF_PEER_SRC;
7540 } else {
7541 psrc = PF_PEER_DST;
7542 }
7543 pf_set_protostate(sm, psrc, SCTP_SHUTDOWN_PENDING);
7544 sm->timeout = PFTM_SCTP_CLOSING;
7545 PF_STATE_UNLOCK(sm);
7546 }
7547 break;
7548 default:
7549 panic("Unknown op %#x", j->op);
7550 }
7551 }
7552
7553 free:
7554 TAILQ_REMOVE(&pd->sctp_multihome_jobs, j, next);
7555 free(j, M_PFTEMP);
7556 }
7557
7558 /* We may have inserted extra work while processing the list. */
7559 if (! TAILQ_EMPTY(&pd->sctp_multihome_jobs)) {
7560 do_extra = false;
7561 goto again;
7562 }
7563 }
7564
7565 static int
pf_multihome_scan(int start,int len,struct pf_pdesc * pd,int op)7566 pf_multihome_scan(int start, int len, struct pf_pdesc *pd, int op)
7567 {
7568 int off = 0;
7569 struct pf_sctp_multihome_job *job;
7570
7571 SDT_PROBE4(pf, sctp, multihome_scan, entry, start, len, pd, op);
7572
7573 while (off < len) {
7574 struct sctp_paramhdr h;
7575
7576 if (!pf_pull_hdr(pd->m, start + off, &h, sizeof(h), NULL, NULL,
7577 pd->af))
7578 return (PF_DROP);
7579
7580 /* Parameters are at least 4 bytes. */
7581 if (ntohs(h.param_length) < 4)
7582 return (PF_DROP);
7583
7584 SDT_PROBE2(pf, sctp, multihome_scan, param, ntohs(h.param_type),
7585 ntohs(h.param_length));
7586
7587 switch (ntohs(h.param_type)) {
7588 case SCTP_IPV4_ADDRESS: {
7589 struct in_addr t;
7590
7591 if (ntohs(h.param_length) !=
7592 (sizeof(struct sctp_paramhdr) + sizeof(t)))
7593 return (PF_DROP);
7594
7595 if (!pf_pull_hdr(pd->m, start + off + sizeof(h), &t, sizeof(t),
7596 NULL, NULL, pd->af))
7597 return (PF_DROP);
7598
7599 if (in_nullhost(t))
7600 t.s_addr = pd->src->v4.s_addr;
7601
7602 /*
7603 * We hold the state lock (idhash) here, which means
7604 * that we can't acquire the keyhash, or we'll get a
7605 * LOR (and potentially double-lock things too). We also
7606 * can't release the state lock here, so instead we'll
7607 * enqueue this for async handling.
7608 * There's a relatively small race here, in that a
7609 * packet using the new addresses could arrive already,
7610 * but that's just though luck for it.
7611 */
7612 job = malloc(sizeof(*job), M_PFTEMP, M_NOWAIT | M_ZERO);
7613 if (! job)
7614 return (PF_DROP);
7615
7616 SDT_PROBE2(pf, sctp, multihome_scan, ipv4, &t, op);
7617
7618 memcpy(&job->pd, pd, sizeof(*pd));
7619
7620 // New source address!
7621 memcpy(&job->src, &t, sizeof(t));
7622 job->pd.src = &job->src;
7623 memcpy(&job->dst, pd->dst, sizeof(job->dst));
7624 job->pd.dst = &job->dst;
7625 job->pd.m = pd->m;
7626 job->op = op;
7627
7628 TAILQ_INSERT_TAIL(&pd->sctp_multihome_jobs, job, next);
7629 break;
7630 }
7631 #ifdef INET6
7632 case SCTP_IPV6_ADDRESS: {
7633 struct in6_addr t;
7634
7635 if (ntohs(h.param_length) !=
7636 (sizeof(struct sctp_paramhdr) + sizeof(t)))
7637 return (PF_DROP);
7638
7639 if (!pf_pull_hdr(pd->m, start + off + sizeof(h), &t, sizeof(t),
7640 NULL, NULL, pd->af))
7641 return (PF_DROP);
7642 if (memcmp(&t, &pd->src->v6, sizeof(t)) == 0)
7643 break;
7644 if (memcmp(&t, &in6addr_any, sizeof(t)) == 0)
7645 memcpy(&t, &pd->src->v6, sizeof(t));
7646
7647 job = malloc(sizeof(*job), M_PFTEMP, M_NOWAIT | M_ZERO);
7648 if (! job)
7649 return (PF_DROP);
7650
7651 SDT_PROBE2(pf, sctp, multihome_scan, ipv6, &t, op);
7652
7653 memcpy(&job->pd, pd, sizeof(*pd));
7654 memcpy(&job->src, &t, sizeof(t));
7655 job->pd.src = &job->src;
7656 memcpy(&job->dst, pd->dst, sizeof(job->dst));
7657 job->pd.dst = &job->dst;
7658 job->pd.m = pd->m;
7659 job->op = op;
7660
7661 TAILQ_INSERT_TAIL(&pd->sctp_multihome_jobs, job, next);
7662 break;
7663 }
7664 #endif /* INET6 */
7665 case SCTP_ADD_IP_ADDRESS: {
7666 int ret;
7667 struct sctp_asconf_paramhdr ah;
7668
7669 if (!pf_pull_hdr(pd->m, start + off, &ah, sizeof(ah),
7670 NULL, NULL, pd->af))
7671 return (PF_DROP);
7672
7673 ret = pf_multihome_scan(start + off + sizeof(ah),
7674 ntohs(ah.ph.param_length) - sizeof(ah), pd,
7675 SCTP_ADD_IP_ADDRESS);
7676 if (ret != PF_PASS)
7677 return (ret);
7678 break;
7679 }
7680 case SCTP_DEL_IP_ADDRESS: {
7681 int ret;
7682 struct sctp_asconf_paramhdr ah;
7683
7684 if (!pf_pull_hdr(pd->m, start + off, &ah, sizeof(ah),
7685 NULL, NULL, pd->af))
7686 return (PF_DROP);
7687 ret = pf_multihome_scan(start + off + sizeof(ah),
7688 ntohs(ah.ph.param_length) - sizeof(ah), pd,
7689 SCTP_DEL_IP_ADDRESS);
7690 if (ret != PF_PASS)
7691 return (ret);
7692 break;
7693 }
7694 default:
7695 break;
7696 }
7697
7698 off += roundup(ntohs(h.param_length), 4);
7699 }
7700
7701 return (PF_PASS);
7702 }
7703
7704 int
pf_multihome_scan_init(int start,int len,struct pf_pdesc * pd)7705 pf_multihome_scan_init(int start, int len, struct pf_pdesc *pd)
7706 {
7707 start += sizeof(struct sctp_init_chunk);
7708 len -= sizeof(struct sctp_init_chunk);
7709
7710 return (pf_multihome_scan(start, len, pd, SCTP_ADD_IP_ADDRESS));
7711 }
7712
7713 int
pf_multihome_scan_asconf(int start,int len,struct pf_pdesc * pd)7714 pf_multihome_scan_asconf(int start, int len, struct pf_pdesc *pd)
7715 {
7716 start += sizeof(struct sctp_asconf_chunk);
7717 len -= sizeof(struct sctp_asconf_chunk);
7718
7719 return (pf_multihome_scan(start, len, pd, SCTP_ADD_IP_ADDRESS));
7720 }
7721
7722 int
pf_icmp_state_lookup(struct pf_state_key_cmp * key,struct pf_pdesc * pd,struct pf_kstate ** state,u_int16_t icmpid,u_int16_t type,int icmp_dir,int * iidx,int multi,int inner)7723 pf_icmp_state_lookup(struct pf_state_key_cmp *key, struct pf_pdesc *pd,
7724 struct pf_kstate **state, u_int16_t icmpid, u_int16_t type, int icmp_dir,
7725 int *iidx, int multi, int inner)
7726 {
7727 int action, direction = pd->dir;
7728
7729 key->af = pd->af;
7730 key->proto = pd->proto;
7731 if (icmp_dir == PF_IN) {
7732 *iidx = pd->sidx;
7733 key->port[pd->sidx] = icmpid;
7734 key->port[pd->didx] = type;
7735 } else {
7736 *iidx = pd->didx;
7737 key->port[pd->sidx] = type;
7738 key->port[pd->didx] = icmpid;
7739 }
7740 if (pf_state_key_addr_setup(pd, key, multi))
7741 return (PF_DROP);
7742
7743 action = pf_find_state(pd, key, state);
7744 if (action != PF_MATCH)
7745 return (action);
7746
7747 if ((*state)->state_flags & PFSTATE_SLOPPY)
7748 return (-1);
7749
7750 /* Is this ICMP message flowing in right direction? */
7751 if ((*state)->key[PF_SK_WIRE]->af != (*state)->key[PF_SK_STACK]->af)
7752 direction = (pd->af == (*state)->key[PF_SK_WIRE]->af) ?
7753 PF_IN : PF_OUT;
7754 else
7755 direction = (*state)->direction;
7756 if ((*state)->rule->type &&
7757 (((!inner && direction == pd->dir) ||
7758 (inner && direction != pd->dir)) ?
7759 PF_IN : PF_OUT) != icmp_dir) {
7760 if (V_pf_status.debug >= PF_DEBUG_MISC) {
7761 printf("pf: icmp type %d in wrong direction (%d): ",
7762 ntohs(type), icmp_dir);
7763 pf_print_state(*state);
7764 printf("\n");
7765 }
7766 PF_STATE_UNLOCK(*state);
7767 *state = NULL;
7768 return (PF_DROP);
7769 }
7770 return (-1);
7771 }
7772
7773 static int
pf_test_state_icmp(struct pf_kstate ** state,struct pf_pdesc * pd,u_short * reason)7774 pf_test_state_icmp(struct pf_kstate **state, struct pf_pdesc *pd,
7775 u_short *reason)
7776 {
7777 struct pf_addr *saddr = pd->src, *daddr = pd->dst;
7778 u_int16_t *icmpsum, virtual_id, virtual_type;
7779 u_int8_t icmptype, icmpcode;
7780 int icmp_dir, iidx, ret;
7781 struct pf_state_key_cmp key;
7782 #ifdef INET
7783 u_int16_t icmpid;
7784 #endif /* INET*/
7785
7786 MPASS(*state == NULL);
7787
7788 bzero(&key, sizeof(key));
7789 switch (pd->proto) {
7790 #ifdef INET
7791 case IPPROTO_ICMP:
7792 icmptype = pd->hdr.icmp.icmp_type;
7793 icmpcode = pd->hdr.icmp.icmp_code;
7794 icmpid = pd->hdr.icmp.icmp_id;
7795 icmpsum = &pd->hdr.icmp.icmp_cksum;
7796 break;
7797 #endif /* INET */
7798 #ifdef INET6
7799 case IPPROTO_ICMPV6:
7800 icmptype = pd->hdr.icmp6.icmp6_type;
7801 icmpcode = pd->hdr.icmp6.icmp6_code;
7802 #ifdef INET
7803 icmpid = pd->hdr.icmp6.icmp6_id;
7804 #endif /* INET */
7805 icmpsum = &pd->hdr.icmp6.icmp6_cksum;
7806 break;
7807 #endif /* INET6 */
7808 default:
7809 panic("unhandled proto %d", pd->proto);
7810 }
7811
7812 if (pf_icmp_mapping(pd, icmptype, &icmp_dir, &virtual_id,
7813 &virtual_type) == 0) {
7814 /*
7815 * ICMP query/reply message not related to a TCP/UDP/SCTP
7816 * packet. Search for an ICMP state.
7817 */
7818 ret = pf_icmp_state_lookup(&key, pd, state, virtual_id,
7819 virtual_type, icmp_dir, &iidx, 0, 0);
7820 /* IPv6? try matching a multicast address */
7821 if (ret == PF_DROP && pd->af == AF_INET6 && icmp_dir == PF_OUT) {
7822 MPASS(*state == NULL);
7823 ret = pf_icmp_state_lookup(&key, pd, state,
7824 virtual_id, virtual_type,
7825 icmp_dir, &iidx, 1, 0);
7826 }
7827 if (ret >= 0) {
7828 MPASS(*state == NULL);
7829 return (ret);
7830 }
7831
7832 (*state)->expire = pf_get_uptime();
7833 (*state)->timeout = PFTM_ICMP_ERROR_REPLY;
7834
7835 /* translate source/destination address, if necessary */
7836 if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) {
7837 struct pf_state_key *nk;
7838 int afto, sidx, didx;
7839
7840 if (PF_REVERSED_KEY(*state, pd->af))
7841 nk = (*state)->key[pd->sidx];
7842 else
7843 nk = (*state)->key[pd->didx];
7844
7845 afto = pd->af != nk->af;
7846
7847 if (afto && (*state)->direction == PF_IN) {
7848 sidx = pd->didx;
7849 didx = pd->sidx;
7850 iidx = !iidx;
7851 } else {
7852 sidx = pd->sidx;
7853 didx = pd->didx;
7854 }
7855
7856 switch (pd->af) {
7857 #ifdef INET
7858 case AF_INET:
7859 #ifdef INET6
7860 if (afto) {
7861 if (pf_translate_icmp_af(AF_INET6,
7862 &pd->hdr.icmp))
7863 return (PF_DROP);
7864 pd->proto = IPPROTO_ICMPV6;
7865 }
7866 #endif /* INET6 */
7867 if (!afto &&
7868 PF_ANEQ(pd->src, &nk->addr[sidx], AF_INET))
7869 pf_change_a(&saddr->v4.s_addr,
7870 pd->ip_sum,
7871 nk->addr[sidx].v4.s_addr,
7872 0);
7873
7874 if (!afto && PF_ANEQ(pd->dst,
7875 &nk->addr[didx], AF_INET))
7876 pf_change_a(&daddr->v4.s_addr,
7877 pd->ip_sum,
7878 nk->addr[didx].v4.s_addr, 0);
7879
7880 if (nk->port[iidx] !=
7881 pd->hdr.icmp.icmp_id) {
7882 pd->hdr.icmp.icmp_cksum =
7883 pf_cksum_fixup(
7884 pd->hdr.icmp.icmp_cksum, icmpid,
7885 nk->port[iidx], 0);
7886 pd->hdr.icmp.icmp_id =
7887 nk->port[iidx];
7888 }
7889
7890 m_copyback(pd->m, pd->off, ICMP_MINLEN,
7891 (caddr_t )&pd->hdr.icmp);
7892 break;
7893 #endif /* INET */
7894 #ifdef INET6
7895 case AF_INET6:
7896 #ifdef INET
7897 if (afto) {
7898 if (pf_translate_icmp_af(AF_INET,
7899 &pd->hdr.icmp6))
7900 return (PF_DROP);
7901 pd->proto = IPPROTO_ICMP;
7902 }
7903 #endif /* INET */
7904 if (!afto &&
7905 PF_ANEQ(pd->src, &nk->addr[sidx], AF_INET6))
7906 pf_change_a6(saddr,
7907 &pd->hdr.icmp6.icmp6_cksum,
7908 &nk->addr[sidx], 0);
7909
7910 if (!afto && PF_ANEQ(pd->dst,
7911 &nk->addr[didx], AF_INET6))
7912 pf_change_a6(daddr,
7913 &pd->hdr.icmp6.icmp6_cksum,
7914 &nk->addr[didx], 0);
7915
7916 if (nk->port[iidx] != pd->hdr.icmp6.icmp6_id)
7917 pd->hdr.icmp6.icmp6_id =
7918 nk->port[iidx];
7919
7920 m_copyback(pd->m, pd->off, sizeof(struct icmp6_hdr),
7921 (caddr_t )&pd->hdr.icmp6);
7922 break;
7923 #endif /* INET6 */
7924 }
7925 if (afto) {
7926 pf_addrcpy(&pd->nsaddr, &nk->addr[sidx],
7927 nk->af);
7928 pf_addrcpy(&pd->ndaddr, &nk->addr[didx],
7929 nk->af);
7930 pd->naf = nk->af;
7931 return (PF_AFRT);
7932 }
7933 }
7934 return (PF_PASS);
7935
7936 } else {
7937 /*
7938 * ICMP error message in response to a TCP/UDP packet.
7939 * Extract the inner TCP/UDP header and search for that state.
7940 */
7941
7942 struct pf_pdesc pd2;
7943 bzero(&pd2, sizeof pd2);
7944 #ifdef INET
7945 struct ip h2;
7946 #endif /* INET */
7947 #ifdef INET6
7948 struct ip6_hdr h2_6;
7949 #endif /* INET6 */
7950 int ipoff2 = 0;
7951
7952 pd2.af = pd->af;
7953 pd2.dir = pd->dir;
7954 /* Payload packet is from the opposite direction. */
7955 pd2.sidx = (pd->dir == PF_IN) ? 1 : 0;
7956 pd2.didx = (pd->dir == PF_IN) ? 0 : 1;
7957 pd2.m = pd->m;
7958 pd2.pf_mtag = pd->pf_mtag;
7959 pd2.kif = pd->kif;
7960 switch (pd->af) {
7961 #ifdef INET
7962 case AF_INET:
7963 /* offset of h2 in mbuf chain */
7964 ipoff2 = pd->off + ICMP_MINLEN;
7965
7966 if (!pf_pull_hdr(pd->m, ipoff2, &h2, sizeof(h2),
7967 NULL, reason, pd2.af)) {
7968 DPFPRINTF(PF_DEBUG_MISC,
7969 "pf: ICMP error message too short "
7970 "(ip)");
7971 return (PF_DROP);
7972 }
7973 /*
7974 * ICMP error messages don't refer to non-first
7975 * fragments
7976 */
7977 if (h2.ip_off & htons(IP_OFFMASK)) {
7978 REASON_SET(reason, PFRES_FRAG);
7979 return (PF_DROP);
7980 }
7981
7982 /* offset of protocol header that follows h2 */
7983 pd2.off = ipoff2;
7984 if (pf_walk_header(&pd2, &h2, reason) != PF_PASS)
7985 return (PF_DROP);
7986
7987 pd2.tot_len = ntohs(h2.ip_len);
7988 pd2.src = (struct pf_addr *)&h2.ip_src;
7989 pd2.dst = (struct pf_addr *)&h2.ip_dst;
7990 pd2.ip_sum = &h2.ip_sum;
7991 break;
7992 #endif /* INET */
7993 #ifdef INET6
7994 case AF_INET6:
7995 ipoff2 = pd->off + sizeof(struct icmp6_hdr);
7996
7997 if (!pf_pull_hdr(pd->m, ipoff2, &h2_6, sizeof(h2_6),
7998 NULL, reason, pd2.af)) {
7999 DPFPRINTF(PF_DEBUG_MISC,
8000 "pf: ICMP error message too short "
8001 "(ip6)");
8002 return (PF_DROP);
8003 }
8004 pd2.off = ipoff2;
8005 if (pf_walk_header6(&pd2, &h2_6, reason) != PF_PASS)
8006 return (PF_DROP);
8007
8008 pd2.tot_len = ntohs(h2_6.ip6_plen) +
8009 sizeof(struct ip6_hdr);
8010 pd2.src = (struct pf_addr *)&h2_6.ip6_src;
8011 pd2.dst = (struct pf_addr *)&h2_6.ip6_dst;
8012 pd2.ip_sum = NULL;
8013 break;
8014 #endif /* INET6 */
8015 default:
8016 unhandled_af(pd->af);
8017 }
8018
8019 if (PF_ANEQ(pd->dst, pd2.src, pd->af)) {
8020 if (V_pf_status.debug >= PF_DEBUG_MISC) {
8021 printf("pf: BAD ICMP %d:%d outer dst: ",
8022 icmptype, icmpcode);
8023 pf_print_host(pd->src, 0, pd->af);
8024 printf(" -> ");
8025 pf_print_host(pd->dst, 0, pd->af);
8026 printf(" inner src: ");
8027 pf_print_host(pd2.src, 0, pd2.af);
8028 printf(" -> ");
8029 pf_print_host(pd2.dst, 0, pd2.af);
8030 printf("\n");
8031 }
8032 REASON_SET(reason, PFRES_BADSTATE);
8033 return (PF_DROP);
8034 }
8035
8036 switch (pd2.proto) {
8037 case IPPROTO_TCP: {
8038 struct tcphdr *th = &pd2.hdr.tcp;
8039 u_int32_t seq;
8040 struct pf_state_peer *src, *dst;
8041 u_int8_t dws;
8042 int copyback = 0;
8043 int action;
8044
8045 /*
8046 * Only the first 8 bytes of the TCP header can be
8047 * expected. Don't access any TCP header fields after
8048 * th_seq, an ackskew test is not possible.
8049 */
8050 if (!pf_pull_hdr(pd->m, pd2.off, th, 8, NULL, reason,
8051 pd2.af)) {
8052 DPFPRINTF(PF_DEBUG_MISC,
8053 "pf: ICMP error message too short "
8054 "(tcp)");
8055 return (PF_DROP);
8056 }
8057 pd2.pcksum = &pd2.hdr.tcp.th_sum;
8058
8059 key.af = pd2.af;
8060 key.proto = IPPROTO_TCP;
8061 pf_addrcpy(&key.addr[pd2.sidx], pd2.src, key.af);
8062 pf_addrcpy(&key.addr[pd2.didx], pd2.dst, key.af);
8063 key.port[pd2.sidx] = th->th_sport;
8064 key.port[pd2.didx] = th->th_dport;
8065
8066 action = pf_find_state(&pd2, &key, state);
8067 if (action != PF_MATCH)
8068 return (action);
8069
8070 if (pd->dir == (*state)->direction) {
8071 if (PF_REVERSED_KEY(*state, pd->af)) {
8072 src = &(*state)->src;
8073 dst = &(*state)->dst;
8074 } else {
8075 src = &(*state)->dst;
8076 dst = &(*state)->src;
8077 }
8078 } else {
8079 if (PF_REVERSED_KEY(*state, pd->af)) {
8080 src = &(*state)->dst;
8081 dst = &(*state)->src;
8082 } else {
8083 src = &(*state)->src;
8084 dst = &(*state)->dst;
8085 }
8086 }
8087
8088 if (src->wscale && dst->wscale)
8089 dws = dst->wscale & PF_WSCALE_MASK;
8090 else
8091 dws = 0;
8092
8093 /* Demodulate sequence number */
8094 seq = ntohl(th->th_seq) - src->seqdiff;
8095 if (src->seqdiff) {
8096 pf_change_a(&th->th_seq, icmpsum,
8097 htonl(seq), 0);
8098 copyback = 1;
8099 }
8100
8101 if (!((*state)->state_flags & PFSTATE_SLOPPY) &&
8102 (!SEQ_GEQ(src->seqhi, seq) ||
8103 !SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)))) {
8104 if (V_pf_status.debug >= PF_DEBUG_MISC) {
8105 printf("pf: BAD ICMP %d:%d ",
8106 icmptype, icmpcode);
8107 pf_print_host(pd->src, 0, pd->af);
8108 printf(" -> ");
8109 pf_print_host(pd->dst, 0, pd->af);
8110 printf(" state: ");
8111 pf_print_state(*state);
8112 printf(" seq=%u\n", seq);
8113 }
8114 REASON_SET(reason, PFRES_BADSTATE);
8115 return (PF_DROP);
8116 } else {
8117 if (V_pf_status.debug >= PF_DEBUG_MISC) {
8118 printf("pf: OK ICMP %d:%d ",
8119 icmptype, icmpcode);
8120 pf_print_host(pd->src, 0, pd->af);
8121 printf(" -> ");
8122 pf_print_host(pd->dst, 0, pd->af);
8123 printf(" state: ");
8124 pf_print_state(*state);
8125 printf(" seq=%u\n", seq);
8126 }
8127 }
8128
8129 /* translate source/destination address, if necessary */
8130 if ((*state)->key[PF_SK_WIRE] !=
8131 (*state)->key[PF_SK_STACK]) {
8132
8133 struct pf_state_key *nk;
8134
8135 if (PF_REVERSED_KEY(*state, pd->af))
8136 nk = (*state)->key[pd->sidx];
8137 else
8138 nk = (*state)->key[pd->didx];
8139
8140 #if defined(INET) && defined(INET6)
8141 int afto, sidx, didx;
8142
8143 afto = pd->af != nk->af;
8144
8145 if (afto && (*state)->direction == PF_IN) {
8146 sidx = pd2.didx;
8147 didx = pd2.sidx;
8148 } else {
8149 sidx = pd2.sidx;
8150 didx = pd2.didx;
8151 }
8152
8153 if (afto) {
8154 if (pf_translate_icmp_af(nk->af,
8155 &pd->hdr.icmp))
8156 return (PF_DROP);
8157 m_copyback(pd->m, pd->off,
8158 sizeof(struct icmp6_hdr),
8159 (c_caddr_t)&pd->hdr.icmp6);
8160 if (pf_change_icmp_af(pd->m, ipoff2, pd,
8161 &pd2, &nk->addr[sidx],
8162 &nk->addr[didx], pd->af,
8163 nk->af))
8164 return (PF_DROP);
8165 pf_addrcpy(&pd->nsaddr,
8166 &nk->addr[pd2.sidx], nk->af);
8167 pf_addrcpy(&pd->ndaddr,
8168 &nk->addr[pd2.didx], nk->af);
8169 if (nk->af == AF_INET) {
8170 pd->proto = IPPROTO_ICMP;
8171 } else {
8172 pd->proto = IPPROTO_ICMPV6;
8173 /*
8174 * IPv4 becomes IPv6 so we must
8175 * copy IPv4 src addr to least
8176 * 32bits in IPv6 address to
8177 * keep traceroute/icmp
8178 * working.
8179 */
8180 pd->nsaddr.addr32[3] =
8181 pd->src->addr32[0];
8182 }
8183 pd->naf = pd2.naf = nk->af;
8184 pf_change_ap(&pd2, pd2.src, &th->th_sport,
8185 &nk->addr[pd2.sidx], nk->port[sidx]);
8186 pf_change_ap(&pd2, pd2.dst, &th->th_dport,
8187 &nk->addr[pd2.didx], nk->port[didx]);
8188 m_copyback(pd2.m, pd2.off, 8, (c_caddr_t)th);
8189 return (PF_AFRT);
8190 }
8191 #endif /* INET && INET6 */
8192
8193 if (PF_ANEQ(pd2.src,
8194 &nk->addr[pd2.sidx], pd2.af) ||
8195 nk->port[pd2.sidx] != th->th_sport)
8196 pf_change_icmp(pd2.src, &th->th_sport,
8197 daddr, &nk->addr[pd2.sidx],
8198 nk->port[pd2.sidx], NULL,
8199 pd2.ip_sum, icmpsum,
8200 pd->ip_sum, 0, pd2.af);
8201
8202 if (PF_ANEQ(pd2.dst,
8203 &nk->addr[pd2.didx], pd2.af) ||
8204 nk->port[pd2.didx] != th->th_dport)
8205 pf_change_icmp(pd2.dst, &th->th_dport,
8206 saddr, &nk->addr[pd2.didx],
8207 nk->port[pd2.didx], NULL,
8208 pd2.ip_sum, icmpsum,
8209 pd->ip_sum, 0, pd2.af);
8210 copyback = 1;
8211 }
8212
8213 if (copyback) {
8214 switch (pd2.af) {
8215 #ifdef INET
8216 case AF_INET:
8217 m_copyback(pd->m, pd->off, ICMP_MINLEN,
8218 (caddr_t )&pd->hdr.icmp);
8219 m_copyback(pd->m, ipoff2, sizeof(h2),
8220 (caddr_t )&h2);
8221 break;
8222 #endif /* INET */
8223 #ifdef INET6
8224 case AF_INET6:
8225 m_copyback(pd->m, pd->off,
8226 sizeof(struct icmp6_hdr),
8227 (caddr_t )&pd->hdr.icmp6);
8228 m_copyback(pd->m, ipoff2, sizeof(h2_6),
8229 (caddr_t )&h2_6);
8230 break;
8231 #endif /* INET6 */
8232 default:
8233 unhandled_af(pd->af);
8234 }
8235 m_copyback(pd->m, pd2.off, 8, (caddr_t)th);
8236 }
8237
8238 return (PF_PASS);
8239 break;
8240 }
8241 case IPPROTO_UDP: {
8242 struct udphdr *uh = &pd2.hdr.udp;
8243 int action;
8244
8245 if (!pf_pull_hdr(pd->m, pd2.off, uh, sizeof(*uh),
8246 NULL, reason, pd2.af)) {
8247 DPFPRINTF(PF_DEBUG_MISC,
8248 "pf: ICMP error message too short "
8249 "(udp)");
8250 return (PF_DROP);
8251 }
8252 pd2.pcksum = &pd2.hdr.udp.uh_sum;
8253
8254 key.af = pd2.af;
8255 key.proto = IPPROTO_UDP;
8256 pf_addrcpy(&key.addr[pd2.sidx], pd2.src, key.af);
8257 pf_addrcpy(&key.addr[pd2.didx], pd2.dst, key.af);
8258 key.port[pd2.sidx] = uh->uh_sport;
8259 key.port[pd2.didx] = uh->uh_dport;
8260
8261 action = pf_find_state(&pd2, &key, state);
8262 if (action != PF_MATCH)
8263 return (action);
8264
8265 /* translate source/destination address, if necessary */
8266 if ((*state)->key[PF_SK_WIRE] !=
8267 (*state)->key[PF_SK_STACK]) {
8268 struct pf_state_key *nk;
8269
8270 if (PF_REVERSED_KEY(*state, pd->af))
8271 nk = (*state)->key[pd->sidx];
8272 else
8273 nk = (*state)->key[pd->didx];
8274
8275 #if defined(INET) && defined(INET6)
8276 int afto, sidx, didx;
8277
8278 afto = pd->af != nk->af;
8279
8280 if (afto && (*state)->direction == PF_IN) {
8281 sidx = pd2.didx;
8282 didx = pd2.sidx;
8283 } else {
8284 sidx = pd2.sidx;
8285 didx = pd2.didx;
8286 }
8287
8288 if (afto) {
8289 if (pf_translate_icmp_af(nk->af,
8290 &pd->hdr.icmp))
8291 return (PF_DROP);
8292 m_copyback(pd->m, pd->off,
8293 sizeof(struct icmp6_hdr),
8294 (c_caddr_t)&pd->hdr.icmp6);
8295 if (pf_change_icmp_af(pd->m, ipoff2, pd,
8296 &pd2, &nk->addr[sidx],
8297 &nk->addr[didx], pd->af,
8298 nk->af))
8299 return (PF_DROP);
8300 pf_addrcpy(&pd->nsaddr,
8301 &nk->addr[pd2.sidx], nk->af);
8302 pf_addrcpy(&pd->ndaddr,
8303 &nk->addr[pd2.didx], nk->af);
8304 if (nk->af == AF_INET) {
8305 pd->proto = IPPROTO_ICMP;
8306 } else {
8307 pd->proto = IPPROTO_ICMPV6;
8308 /*
8309 * IPv4 becomes IPv6 so we must
8310 * copy IPv4 src addr to least
8311 * 32bits in IPv6 address to
8312 * keep traceroute/icmp
8313 * working.
8314 */
8315 pd->nsaddr.addr32[3] =
8316 pd->src->addr32[0];
8317 }
8318 pd->naf = pd2.naf = nk->af;
8319 pf_change_ap(&pd2, pd2.src, &uh->uh_sport,
8320 &nk->addr[pd2.sidx], nk->port[sidx]);
8321 pf_change_ap(&pd2, pd2.dst, &uh->uh_dport,
8322 &nk->addr[pd2.didx], nk->port[didx]);
8323 m_copyback(pd2.m, pd2.off, sizeof(*uh),
8324 (c_caddr_t)uh);
8325 return (PF_AFRT);
8326 }
8327 #endif /* INET && INET6 */
8328
8329 if (PF_ANEQ(pd2.src,
8330 &nk->addr[pd2.sidx], pd2.af) ||
8331 nk->port[pd2.sidx] != uh->uh_sport)
8332 pf_change_icmp(pd2.src, &uh->uh_sport,
8333 daddr, &nk->addr[pd2.sidx],
8334 nk->port[pd2.sidx], &uh->uh_sum,
8335 pd2.ip_sum, icmpsum,
8336 pd->ip_sum, 1, pd2.af);
8337
8338 if (PF_ANEQ(pd2.dst,
8339 &nk->addr[pd2.didx], pd2.af) ||
8340 nk->port[pd2.didx] != uh->uh_dport)
8341 pf_change_icmp(pd2.dst, &uh->uh_dport,
8342 saddr, &nk->addr[pd2.didx],
8343 nk->port[pd2.didx], &uh->uh_sum,
8344 pd2.ip_sum, icmpsum,
8345 pd->ip_sum, 1, pd2.af);
8346
8347 switch (pd2.af) {
8348 #ifdef INET
8349 case AF_INET:
8350 m_copyback(pd->m, pd->off, ICMP_MINLEN,
8351 (caddr_t )&pd->hdr.icmp);
8352 m_copyback(pd->m, ipoff2, sizeof(h2), (caddr_t)&h2);
8353 break;
8354 #endif /* INET */
8355 #ifdef INET6
8356 case AF_INET6:
8357 m_copyback(pd->m, pd->off,
8358 sizeof(struct icmp6_hdr),
8359 (caddr_t )&pd->hdr.icmp6);
8360 m_copyback(pd->m, ipoff2, sizeof(h2_6),
8361 (caddr_t )&h2_6);
8362 break;
8363 #endif /* INET6 */
8364 }
8365 m_copyback(pd->m, pd2.off, sizeof(*uh), (caddr_t)uh);
8366 }
8367 return (PF_PASS);
8368 break;
8369 }
8370 #ifdef INET
8371 case IPPROTO_SCTP: {
8372 struct sctphdr *sh = &pd2.hdr.sctp;
8373 struct pf_state_peer *src;
8374 int copyback = 0;
8375 int action;
8376
8377 if (! pf_pull_hdr(pd->m, pd2.off, sh, sizeof(*sh), NULL, reason,
8378 pd2.af)) {
8379 DPFPRINTF(PF_DEBUG_MISC,
8380 "pf: ICMP error message too short "
8381 "(sctp)");
8382 return (PF_DROP);
8383 }
8384 pd2.pcksum = &pd2.sctp_dummy_sum;
8385
8386 key.af = pd2.af;
8387 key.proto = IPPROTO_SCTP;
8388 pf_addrcpy(&key.addr[pd2.sidx], pd2.src, key.af);
8389 pf_addrcpy(&key.addr[pd2.didx], pd2.dst, key.af);
8390 key.port[pd2.sidx] = sh->src_port;
8391 key.port[pd2.didx] = sh->dest_port;
8392
8393 action = pf_find_state(&pd2, &key, state);
8394 if (action != PF_MATCH)
8395 return (action);
8396
8397 if (pd->dir == (*state)->direction) {
8398 if (PF_REVERSED_KEY(*state, pd->af))
8399 src = &(*state)->src;
8400 else
8401 src = &(*state)->dst;
8402 } else {
8403 if (PF_REVERSED_KEY(*state, pd->af))
8404 src = &(*state)->dst;
8405 else
8406 src = &(*state)->src;
8407 }
8408
8409 if (src->scrub->pfss_v_tag != sh->v_tag) {
8410 DPFPRINTF(PF_DEBUG_MISC,
8411 "pf: ICMP error message has incorrect "
8412 "SCTP v_tag");
8413 return (PF_DROP);
8414 }
8415
8416 /* translate source/destination address, if necessary */
8417 if ((*state)->key[PF_SK_WIRE] !=
8418 (*state)->key[PF_SK_STACK]) {
8419
8420 struct pf_state_key *nk;
8421
8422 if (PF_REVERSED_KEY(*state, pd->af))
8423 nk = (*state)->key[pd->sidx];
8424 else
8425 nk = (*state)->key[pd->didx];
8426
8427 #if defined(INET) && defined(INET6)
8428 int afto, sidx, didx;
8429
8430 afto = pd->af != nk->af;
8431
8432 if (afto && (*state)->direction == PF_IN) {
8433 sidx = pd2.didx;
8434 didx = pd2.sidx;
8435 } else {
8436 sidx = pd2.sidx;
8437 didx = pd2.didx;
8438 }
8439
8440 if (afto) {
8441 if (pf_translate_icmp_af(nk->af,
8442 &pd->hdr.icmp))
8443 return (PF_DROP);
8444 m_copyback(pd->m, pd->off,
8445 sizeof(struct icmp6_hdr),
8446 (c_caddr_t)&pd->hdr.icmp6);
8447 if (pf_change_icmp_af(pd->m, ipoff2, pd,
8448 &pd2, &nk->addr[sidx],
8449 &nk->addr[didx], pd->af,
8450 nk->af))
8451 return (PF_DROP);
8452 sh->src_port = nk->port[sidx];
8453 sh->dest_port = nk->port[didx];
8454 m_copyback(pd2.m, pd2.off, sizeof(*sh), (c_caddr_t)sh);
8455 pf_addrcpy(&pd->nsaddr,
8456 &nk->addr[pd2.sidx], nk->af);
8457 pf_addrcpy(&pd->ndaddr,
8458 &nk->addr[pd2.didx], nk->af);
8459 if (nk->af == AF_INET) {
8460 pd->proto = IPPROTO_ICMP;
8461 } else {
8462 pd->proto = IPPROTO_ICMPV6;
8463 /*
8464 * IPv4 becomes IPv6 so we must
8465 * copy IPv4 src addr to least
8466 * 32bits in IPv6 address to
8467 * keep traceroute/icmp
8468 * working.
8469 */
8470 pd->nsaddr.addr32[3] =
8471 pd->src->addr32[0];
8472 }
8473 pd->naf = nk->af;
8474 return (PF_AFRT);
8475 }
8476 #endif /* INET && INET6 */
8477
8478 if (PF_ANEQ(pd2.src,
8479 &nk->addr[pd2.sidx], pd2.af) ||
8480 nk->port[pd2.sidx] != sh->src_port)
8481 pf_change_icmp(pd2.src, &sh->src_port,
8482 daddr, &nk->addr[pd2.sidx],
8483 nk->port[pd2.sidx], NULL,
8484 pd2.ip_sum, icmpsum,
8485 pd->ip_sum, 0, pd2.af);
8486
8487 if (PF_ANEQ(pd2.dst,
8488 &nk->addr[pd2.didx], pd2.af) ||
8489 nk->port[pd2.didx] != sh->dest_port)
8490 pf_change_icmp(pd2.dst, &sh->dest_port,
8491 saddr, &nk->addr[pd2.didx],
8492 nk->port[pd2.didx], NULL,
8493 pd2.ip_sum, icmpsum,
8494 pd->ip_sum, 0, pd2.af);
8495 copyback = 1;
8496 }
8497
8498 if (copyback) {
8499 switch (pd2.af) {
8500 #ifdef INET
8501 case AF_INET:
8502 m_copyback(pd->m, pd->off, ICMP_MINLEN,
8503 (caddr_t )&pd->hdr.icmp);
8504 m_copyback(pd->m, ipoff2, sizeof(h2),
8505 (caddr_t )&h2);
8506 break;
8507 #endif /* INET */
8508 #ifdef INET6
8509 case AF_INET6:
8510 m_copyback(pd->m, pd->off,
8511 sizeof(struct icmp6_hdr),
8512 (caddr_t )&pd->hdr.icmp6);
8513 m_copyback(pd->m, ipoff2, sizeof(h2_6),
8514 (caddr_t )&h2_6);
8515 break;
8516 #endif /* INET6 */
8517 }
8518 m_copyback(pd->m, pd2.off, sizeof(*sh), (caddr_t)sh);
8519 }
8520
8521 return (PF_PASS);
8522 break;
8523 }
8524 case IPPROTO_ICMP: {
8525 struct icmp *iih = &pd2.hdr.icmp;
8526
8527 if (pd2.af != AF_INET) {
8528 REASON_SET(reason, PFRES_NORM);
8529 return (PF_DROP);
8530 }
8531
8532 if (!pf_pull_hdr(pd->m, pd2.off, iih, ICMP_MINLEN,
8533 NULL, reason, pd2.af)) {
8534 DPFPRINTF(PF_DEBUG_MISC,
8535 "pf: ICMP error message too short i"
8536 "(icmp)");
8537 return (PF_DROP);
8538 }
8539 pd2.pcksum = &pd2.hdr.icmp.icmp_cksum;
8540
8541 icmpid = iih->icmp_id;
8542 pf_icmp_mapping(&pd2, iih->icmp_type,
8543 &icmp_dir, &virtual_id, &virtual_type);
8544
8545 ret = pf_icmp_state_lookup(&key, &pd2, state,
8546 virtual_id, virtual_type, icmp_dir, &iidx, 0, 1);
8547 if (ret >= 0) {
8548 MPASS(*state == NULL);
8549 return (ret);
8550 }
8551
8552 /* translate source/destination address, if necessary */
8553 if ((*state)->key[PF_SK_WIRE] !=
8554 (*state)->key[PF_SK_STACK]) {
8555 struct pf_state_key *nk;
8556
8557 if (PF_REVERSED_KEY(*state, pd->af))
8558 nk = (*state)->key[pd->sidx];
8559 else
8560 nk = (*state)->key[pd->didx];
8561
8562 #if defined(INET) && defined(INET6)
8563 int afto, sidx, didx;
8564
8565 afto = pd->af != nk->af;
8566
8567 if (afto && (*state)->direction == PF_IN) {
8568 sidx = pd2.didx;
8569 didx = pd2.sidx;
8570 iidx = !iidx;
8571 } else {
8572 sidx = pd2.sidx;
8573 didx = pd2.didx;
8574 }
8575
8576 if (afto) {
8577 if (nk->af != AF_INET6)
8578 return (PF_DROP);
8579 if (pf_translate_icmp_af(nk->af,
8580 &pd->hdr.icmp))
8581 return (PF_DROP);
8582 m_copyback(pd->m, pd->off,
8583 sizeof(struct icmp6_hdr),
8584 (c_caddr_t)&pd->hdr.icmp6);
8585 if (pf_change_icmp_af(pd->m, ipoff2, pd,
8586 &pd2, &nk->addr[sidx],
8587 &nk->addr[didx], pd->af,
8588 nk->af))
8589 return (PF_DROP);
8590 pd->proto = IPPROTO_ICMPV6;
8591 if (pf_translate_icmp_af(nk->af, iih))
8592 return (PF_DROP);
8593 if (virtual_type == htons(ICMP_ECHO) &&
8594 nk->port[iidx] != iih->icmp_id)
8595 iih->icmp_id = nk->port[iidx];
8596 m_copyback(pd2.m, pd2.off, ICMP_MINLEN,
8597 (c_caddr_t)iih);
8598 pf_addrcpy(&pd->nsaddr,
8599 &nk->addr[pd2.sidx], nk->af);
8600 pf_addrcpy(&pd->ndaddr,
8601 &nk->addr[pd2.didx], nk->af);
8602 /*
8603 * IPv4 becomes IPv6 so we must copy
8604 * IPv4 src addr to least 32bits in
8605 * IPv6 address to keep traceroute
8606 * working.
8607 */
8608 pd->nsaddr.addr32[3] =
8609 pd->src->addr32[0];
8610 pd->naf = nk->af;
8611 return (PF_AFRT);
8612 }
8613 #endif /* INET && INET6 */
8614
8615 if (PF_ANEQ(pd2.src,
8616 &nk->addr[pd2.sidx], pd2.af) ||
8617 (virtual_type == htons(ICMP_ECHO) &&
8618 nk->port[iidx] != iih->icmp_id))
8619 pf_change_icmp(pd2.src,
8620 (virtual_type == htons(ICMP_ECHO)) ?
8621 &iih->icmp_id : NULL,
8622 daddr, &nk->addr[pd2.sidx],
8623 (virtual_type == htons(ICMP_ECHO)) ?
8624 nk->port[iidx] : 0, NULL,
8625 pd2.ip_sum, icmpsum,
8626 pd->ip_sum, 0, AF_INET);
8627
8628 if (PF_ANEQ(pd2.dst,
8629 &nk->addr[pd2.didx], pd2.af))
8630 pf_change_icmp(pd2.dst, NULL, NULL,
8631 &nk->addr[pd2.didx], 0, NULL,
8632 pd2.ip_sum, icmpsum, pd->ip_sum, 0,
8633 AF_INET);
8634
8635 m_copyback(pd->m, pd->off, ICMP_MINLEN, (caddr_t)&pd->hdr.icmp);
8636 m_copyback(pd->m, ipoff2, sizeof(h2), (caddr_t)&h2);
8637 m_copyback(pd->m, pd2.off, ICMP_MINLEN, (caddr_t)iih);
8638 }
8639 return (PF_PASS);
8640 break;
8641 }
8642 #endif /* INET */
8643 #ifdef INET6
8644 case IPPROTO_ICMPV6: {
8645 struct icmp6_hdr *iih = &pd2.hdr.icmp6;
8646
8647 if (pd2.af != AF_INET6) {
8648 REASON_SET(reason, PFRES_NORM);
8649 return (PF_DROP);
8650 }
8651
8652 if (!pf_pull_hdr(pd->m, pd2.off, iih,
8653 sizeof(struct icmp6_hdr), NULL, reason, pd2.af)) {
8654 DPFPRINTF(PF_DEBUG_MISC,
8655 "pf: ICMP error message too short "
8656 "(icmp6)");
8657 return (PF_DROP);
8658 }
8659 pd2.pcksum = &pd2.hdr.icmp6.icmp6_cksum;
8660
8661 pf_icmp_mapping(&pd2, iih->icmp6_type,
8662 &icmp_dir, &virtual_id, &virtual_type);
8663
8664 ret = pf_icmp_state_lookup(&key, &pd2, state,
8665 virtual_id, virtual_type, icmp_dir, &iidx, 0, 1);
8666 /* IPv6? try matching a multicast address */
8667 if (ret == PF_DROP && pd2.af == AF_INET6 &&
8668 icmp_dir == PF_OUT) {
8669 MPASS(*state == NULL);
8670 ret = pf_icmp_state_lookup(&key, &pd2,
8671 state, virtual_id, virtual_type,
8672 icmp_dir, &iidx, 1, 1);
8673 }
8674 if (ret >= 0) {
8675 MPASS(*state == NULL);
8676 return (ret);
8677 }
8678
8679 /* translate source/destination address, if necessary */
8680 if ((*state)->key[PF_SK_WIRE] !=
8681 (*state)->key[PF_SK_STACK]) {
8682 struct pf_state_key *nk;
8683
8684 if (PF_REVERSED_KEY(*state, pd->af))
8685 nk = (*state)->key[pd->sidx];
8686 else
8687 nk = (*state)->key[pd->didx];
8688
8689 #if defined(INET) && defined(INET6)
8690 int afto, sidx, didx;
8691
8692 afto = pd->af != nk->af;
8693
8694 if (afto && (*state)->direction == PF_IN) {
8695 sidx = pd2.didx;
8696 didx = pd2.sidx;
8697 iidx = !iidx;
8698 } else {
8699 sidx = pd2.sidx;
8700 didx = pd2.didx;
8701 }
8702
8703 if (afto) {
8704 if (nk->af != AF_INET)
8705 return (PF_DROP);
8706 if (pf_translate_icmp_af(nk->af,
8707 &pd->hdr.icmp))
8708 return (PF_DROP);
8709 m_copyback(pd->m, pd->off,
8710 sizeof(struct icmp6_hdr),
8711 (c_caddr_t)&pd->hdr.icmp6);
8712 if (pf_change_icmp_af(pd->m, ipoff2, pd,
8713 &pd2, &nk->addr[sidx],
8714 &nk->addr[didx], pd->af,
8715 nk->af))
8716 return (PF_DROP);
8717 pd->proto = IPPROTO_ICMP;
8718 if (pf_translate_icmp_af(nk->af, iih))
8719 return (PF_DROP);
8720 if (virtual_type ==
8721 htons(ICMP6_ECHO_REQUEST) &&
8722 nk->port[iidx] != iih->icmp6_id)
8723 iih->icmp6_id = nk->port[iidx];
8724 m_copyback(pd2.m, pd2.off,
8725 sizeof(struct icmp6_hdr), (c_caddr_t)iih);
8726 pf_addrcpy(&pd->nsaddr,
8727 &nk->addr[pd2.sidx], nk->af);
8728 pf_addrcpy(&pd->ndaddr,
8729 &nk->addr[pd2.didx], nk->af);
8730 pd->naf = nk->af;
8731 return (PF_AFRT);
8732 }
8733 #endif /* INET && INET6 */
8734
8735 if (PF_ANEQ(pd2.src,
8736 &nk->addr[pd2.sidx], pd2.af) ||
8737 ((virtual_type == htons(ICMP6_ECHO_REQUEST)) &&
8738 nk->port[pd2.sidx] != iih->icmp6_id))
8739 pf_change_icmp(pd2.src,
8740 (virtual_type == htons(ICMP6_ECHO_REQUEST))
8741 ? &iih->icmp6_id : NULL,
8742 daddr, &nk->addr[pd2.sidx],
8743 (virtual_type == htons(ICMP6_ECHO_REQUEST))
8744 ? nk->port[iidx] : 0, NULL,
8745 pd2.ip_sum, icmpsum,
8746 pd->ip_sum, 0, AF_INET6);
8747
8748 if (PF_ANEQ(pd2.dst,
8749 &nk->addr[pd2.didx], pd2.af))
8750 pf_change_icmp(pd2.dst, NULL, NULL,
8751 &nk->addr[pd2.didx], 0, NULL,
8752 pd2.ip_sum, icmpsum,
8753 pd->ip_sum, 0, AF_INET6);
8754
8755 m_copyback(pd->m, pd->off, sizeof(struct icmp6_hdr),
8756 (caddr_t)&pd->hdr.icmp6);
8757 m_copyback(pd->m, ipoff2, sizeof(h2_6), (caddr_t)&h2_6);
8758 m_copyback(pd->m, pd2.off, sizeof(struct icmp6_hdr),
8759 (caddr_t)iih);
8760 }
8761 return (PF_PASS);
8762 break;
8763 }
8764 #endif /* INET6 */
8765 default: {
8766 int action;
8767
8768 key.af = pd2.af;
8769 key.proto = pd2.proto;
8770 pf_addrcpy(&key.addr[pd2.sidx], pd2.src, key.af);
8771 pf_addrcpy(&key.addr[pd2.didx], pd2.dst, key.af);
8772 key.port[0] = key.port[1] = 0;
8773
8774 action = pf_find_state(&pd2, &key, state);
8775 if (action != PF_MATCH)
8776 return (action);
8777
8778 /* translate source/destination address, if necessary */
8779 if ((*state)->key[PF_SK_WIRE] !=
8780 (*state)->key[PF_SK_STACK]) {
8781 struct pf_state_key *nk =
8782 (*state)->key[pd->didx];
8783
8784 if (PF_ANEQ(pd2.src,
8785 &nk->addr[pd2.sidx], pd2.af))
8786 pf_change_icmp(pd2.src, NULL, daddr,
8787 &nk->addr[pd2.sidx], 0, NULL,
8788 pd2.ip_sum, icmpsum,
8789 pd->ip_sum, 0, pd2.af);
8790
8791 if (PF_ANEQ(pd2.dst,
8792 &nk->addr[pd2.didx], pd2.af))
8793 pf_change_icmp(pd2.dst, NULL, saddr,
8794 &nk->addr[pd2.didx], 0, NULL,
8795 pd2.ip_sum, icmpsum,
8796 pd->ip_sum, 0, pd2.af);
8797
8798 switch (pd2.af) {
8799 #ifdef INET
8800 case AF_INET:
8801 m_copyback(pd->m, pd->off, ICMP_MINLEN,
8802 (caddr_t)&pd->hdr.icmp);
8803 m_copyback(pd->m, ipoff2, sizeof(h2), (caddr_t)&h2);
8804 break;
8805 #endif /* INET */
8806 #ifdef INET6
8807 case AF_INET6:
8808 m_copyback(pd->m, pd->off,
8809 sizeof(struct icmp6_hdr),
8810 (caddr_t )&pd->hdr.icmp6);
8811 m_copyback(pd->m, ipoff2, sizeof(h2_6),
8812 (caddr_t )&h2_6);
8813 break;
8814 #endif /* INET6 */
8815 }
8816 }
8817 return (PF_PASS);
8818 break;
8819 }
8820 }
8821 }
8822 }
8823
8824 /*
8825 * ipoff and off are measured from the start of the mbuf chain.
8826 * h must be at "ipoff" on the mbuf chain.
8827 */
8828 void *
pf_pull_hdr(const struct mbuf * m,int off,void * p,int len,u_short * actionp,u_short * reasonp,sa_family_t af)8829 pf_pull_hdr(const struct mbuf *m, int off, void *p, int len,
8830 u_short *actionp, u_short *reasonp, sa_family_t af)
8831 {
8832 int iplen = 0;
8833 switch (af) {
8834 #ifdef INET
8835 case AF_INET: {
8836 const struct ip *h = mtod(m, struct ip *);
8837 u_int16_t fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3;
8838
8839 if (fragoff) {
8840 if (fragoff >= len)
8841 ACTION_SET(actionp, PF_PASS);
8842 else {
8843 ACTION_SET(actionp, PF_DROP);
8844 REASON_SET(reasonp, PFRES_FRAG);
8845 }
8846 return (NULL);
8847 }
8848 iplen = ntohs(h->ip_len);
8849 break;
8850 }
8851 #endif /* INET */
8852 #ifdef INET6
8853 case AF_INET6: {
8854 const struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
8855
8856 iplen = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
8857 break;
8858 }
8859 #endif /* INET6 */
8860 }
8861 if (m->m_pkthdr.len < off + len || iplen < off + len) {
8862 ACTION_SET(actionp, PF_DROP);
8863 REASON_SET(reasonp, PFRES_SHORT);
8864 return (NULL);
8865 }
8866 m_copydata(m, off, len, p);
8867 return (p);
8868 }
8869
8870 int
pf_routable(struct pf_addr * addr,sa_family_t af,struct pfi_kkif * kif,int rtableid)8871 pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kkif *kif,
8872 int rtableid)
8873 {
8874 struct ifnet *ifp;
8875
8876 /*
8877 * Skip check for addresses with embedded interface scope,
8878 * as they would always match anyway.
8879 */
8880 if (af == AF_INET6 && IN6_IS_SCOPE_EMBED(&addr->v6))
8881 return (1);
8882
8883 if (af != AF_INET && af != AF_INET6)
8884 return (0);
8885
8886 if (kif == V_pfi_all)
8887 return (1);
8888
8889 /* Skip checks for ipsec interfaces */
8890 if (kif != NULL && kif->pfik_ifp->if_type == IFT_ENC)
8891 return (1);
8892
8893 ifp = (kif != NULL) ? kif->pfik_ifp : NULL;
8894
8895 switch (af) {
8896 #ifdef INET6
8897 case AF_INET6:
8898 return (fib6_check_urpf(rtableid, &addr->v6, 0, NHR_NONE,
8899 ifp));
8900 #endif /* INET6 */
8901 #ifdef INET
8902 case AF_INET:
8903 return (fib4_check_urpf(rtableid, addr->v4, 0, NHR_NONE,
8904 ifp));
8905 #endif /* INET */
8906 }
8907
8908 return (0);
8909 }
8910
8911 #ifdef INET
8912 static void
pf_route(struct pf_krule * r,struct ifnet * oifp,struct pf_kstate * s,struct pf_pdesc * pd,struct inpcb * inp)8913 pf_route(struct pf_krule *r, struct ifnet *oifp,
8914 struct pf_kstate *s, struct pf_pdesc *pd, struct inpcb *inp)
8915 {
8916 struct mbuf *m0, *m1, *md;
8917 struct route ro;
8918 const struct sockaddr *gw = &ro.ro_dst;
8919 struct sockaddr_in *dst;
8920 struct ip *ip;
8921 struct ifnet *ifp = NULL;
8922 int error = 0;
8923 uint16_t ip_len, ip_off;
8924 uint16_t tmp;
8925 int r_dir;
8926 bool skip_test = false;
8927
8928 KASSERT(pd->m && r && oifp, ("%s: invalid parameters", __func__));
8929
8930 SDT_PROBE4(pf, ip, route_to, entry, pd->m, pd, s, oifp);
8931
8932 if (s) {
8933 r_dir = s->direction;
8934 } else {
8935 r_dir = r->direction;
8936 }
8937
8938 KASSERT(pd->dir == PF_IN || pd->dir == PF_OUT ||
8939 r_dir == PF_IN || r_dir == PF_OUT, ("%s: invalid direction",
8940 __func__));
8941
8942 if ((pd->pf_mtag == NULL &&
8943 ((pd->pf_mtag = pf_get_mtag(pd->m)) == NULL)) ||
8944 pd->pf_mtag->routed++ > 3) {
8945 m0 = pd->m;
8946 pd->m = NULL;
8947 SDT_PROBE1(pf, ip, route_to, drop, __LINE__);
8948 goto bad_locked;
8949 }
8950
8951 if (pd->act.rt_kif != NULL)
8952 ifp = pd->act.rt_kif->pfik_ifp;
8953
8954 if (pd->act.rt == PF_DUPTO) {
8955 if ((pd->pf_mtag->flags & PF_MTAG_FLAG_DUPLICATED)) {
8956 if (s != NULL) {
8957 PF_STATE_UNLOCK(s);
8958 }
8959 if (ifp == oifp) {
8960 /* When the 2nd interface is not skipped */
8961 return;
8962 } else {
8963 m0 = pd->m;
8964 pd->m = NULL;
8965 SDT_PROBE1(pf, ip, route_to, drop, __LINE__);
8966 goto bad;
8967 }
8968 } else {
8969 pd->pf_mtag->flags |= PF_MTAG_FLAG_DUPLICATED;
8970 if (((m0 = m_dup(pd->m, M_NOWAIT)) == NULL)) {
8971 if (s)
8972 PF_STATE_UNLOCK(s);
8973 return;
8974 }
8975 }
8976 } else {
8977 if ((pd->act.rt == PF_REPLYTO) == (r_dir == pd->dir)) {
8978 if (pd->af == pd->naf) {
8979 pf_dummynet(pd, s, r, &pd->m);
8980 if (s)
8981 PF_STATE_UNLOCK(s);
8982 return;
8983 } else {
8984 if (r_dir == PF_IN) {
8985 skip_test = true;
8986 }
8987 }
8988 }
8989
8990 /*
8991 * If we're actually doing route-to and af-to and are in the
8992 * reply direction.
8993 */
8994 if (pd->act.rt_kif && pd->act.rt_kif->pfik_ifp &&
8995 pd->af != pd->naf) {
8996 if (pd->act.rt == PF_ROUTETO && r->naf != AF_INET) {
8997 /* Un-set ifp so we do a plain route lookup. */
8998 ifp = NULL;
8999 }
9000 if (pd->act.rt == PF_REPLYTO && r->naf != AF_INET6) {
9001 /* Un-set ifp so we do a plain route lookup. */
9002 ifp = NULL;
9003 }
9004 }
9005 m0 = pd->m;
9006 }
9007
9008 ip = mtod(m0, struct ip *);
9009
9010 bzero(&ro, sizeof(ro));
9011 dst = (struct sockaddr_in *)&ro.ro_dst;
9012 dst->sin_family = AF_INET;
9013 dst->sin_len = sizeof(struct sockaddr_in);
9014 dst->sin_addr.s_addr = pd->act.rt_addr.v4.s_addr;
9015
9016 if (pd->dir == PF_IN) {
9017 if (ip->ip_ttl <= IPTTLDEC) {
9018 if (r->rt != PF_DUPTO)
9019 pf_send_icmp(m0, ICMP_TIMXCEED,
9020 ICMP_TIMXCEED_INTRANS, 0, pd->af, r,
9021 pd->act.rtableid);
9022 goto bad_locked;
9023 }
9024 ip->ip_ttl -= IPTTLDEC;
9025 }
9026
9027 if (s != NULL) {
9028 if (ifp == NULL && (pd->af != pd->naf)) {
9029 /* We're in the AFTO case. Do a route lookup. */
9030 const struct nhop_object *nh;
9031 nh = fib4_lookup(M_GETFIB(m0), ip->ip_dst, 0, NHR_NONE, 0);
9032 if (nh) {
9033 ifp = nh->nh_ifp;
9034
9035 /* Use the gateway if needed. */
9036 if (nh->nh_flags & NHF_GATEWAY) {
9037 gw = &nh->gw_sa;
9038 ro.ro_flags |= RT_HAS_GW;
9039 } else {
9040 dst->sin_addr = ip->ip_dst;
9041 }
9042
9043 /*
9044 * Bind to the correct interface if we're
9045 * if-bound. We don't know which interface
9046 * that will be until here, so we've inserted
9047 * the state on V_pf_all. Fix that now.
9048 */
9049 if (s->kif == V_pfi_all && ifp != NULL &&
9050 r->rule_flag & PFRULE_IFBOUND)
9051 s->kif = ifp->if_pf_kif;
9052 }
9053 }
9054
9055 if (r->rule_flag & PFRULE_IFBOUND &&
9056 pd->act.rt == PF_REPLYTO &&
9057 s->kif == V_pfi_all) {
9058 s->kif = pd->act.rt_kif;
9059 s->orig_kif = oifp->if_pf_kif;
9060 }
9061
9062 PF_STATE_UNLOCK(s);
9063 }
9064
9065 if (ifp == NULL) {
9066 m0 = pd->m;
9067 pd->m = NULL;
9068 SDT_PROBE1(pf, ip, route_to, drop, __LINE__);
9069 goto bad;
9070 }
9071
9072 if (r->rt == PF_DUPTO)
9073 skip_test = true;
9074
9075 if (pd->dir == PF_IN && !skip_test) {
9076 if (pf_test(AF_INET, PF_OUT, PFIL_FWD, ifp, &m0, inp,
9077 &pd->act) != PF_PASS) {
9078 SDT_PROBE1(pf, ip, route_to, drop, __LINE__);
9079 goto bad;
9080 } else if (m0 == NULL) {
9081 SDT_PROBE1(pf, ip, route_to, drop, __LINE__);
9082 goto done;
9083 }
9084 if (m0->m_len < sizeof(struct ip)) {
9085 DPFPRINTF(PF_DEBUG_URGENT,
9086 "%s: m0->m_len < sizeof(struct ip)", __func__);
9087 SDT_PROBE1(pf, ip, route_to, drop, __LINE__);
9088 goto bad;
9089 }
9090 ip = mtod(m0, struct ip *);
9091 }
9092
9093 if (ifp->if_flags & IFF_LOOPBACK)
9094 m0->m_flags |= M_SKIP_FIREWALL;
9095
9096 ip_len = ntohs(ip->ip_len);
9097 ip_off = ntohs(ip->ip_off);
9098
9099 /* Copied from FreeBSD 10.0-CURRENT ip_output. */
9100 m0->m_pkthdr.csum_flags |= CSUM_IP;
9101 if (m0->m_pkthdr.csum_flags & CSUM_DELAY_DATA & ~ifp->if_hwassist) {
9102 in_delayed_cksum(m0);
9103 m0->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
9104 }
9105 if (m0->m_pkthdr.csum_flags & CSUM_SCTP & ~ifp->if_hwassist) {
9106 pf_sctp_checksum(m0, (uint32_t)(ip->ip_hl << 2));
9107 m0->m_pkthdr.csum_flags &= ~CSUM_SCTP;
9108 }
9109
9110 if (pd->dir == PF_IN) {
9111 /*
9112 * Make sure dummynet gets the correct direction, in case it needs to
9113 * re-inject later.
9114 */
9115 pd->dir = PF_OUT;
9116
9117 /*
9118 * The following processing is actually the rest of the inbound processing, even
9119 * though we've marked it as outbound (so we don't look through dummynet) and it
9120 * happens after the outbound processing (pf_test(PF_OUT) above).
9121 * Swap the dummynet pipe numbers, because it's going to come to the wrong
9122 * conclusion about what direction it's processing, and we can't fix it or it
9123 * will re-inject incorrectly. Swapping the pipe numbers means that its incorrect
9124 * decision will pick the right pipe, and everything will mostly work as expected.
9125 */
9126 tmp = pd->act.dnrpipe;
9127 pd->act.dnrpipe = pd->act.dnpipe;
9128 pd->act.dnpipe = tmp;
9129 }
9130
9131 /*
9132 * If small enough for interface, or the interface will take
9133 * care of the fragmentation for us, we can just send directly.
9134 */
9135 if (ip_len <= ifp->if_mtu ||
9136 (m0->m_pkthdr.csum_flags & ifp->if_hwassist & CSUM_TSO) != 0) {
9137 ip->ip_sum = 0;
9138 if (m0->m_pkthdr.csum_flags & CSUM_IP & ~ifp->if_hwassist) {
9139 ip->ip_sum = in_cksum(m0, ip->ip_hl << 2);
9140 m0->m_pkthdr.csum_flags &= ~CSUM_IP;
9141 }
9142 m_clrprotoflags(m0); /* Avoid confusing lower layers. */
9143
9144 md = m0;
9145 error = pf_dummynet_route(pd, s, r, ifp, gw, &md);
9146 if (md != NULL) {
9147 error = (*ifp->if_output)(ifp, md, gw, &ro);
9148 SDT_PROBE2(pf, ip, route_to, output, ifp, error);
9149 }
9150 goto done;
9151 }
9152
9153 /* Balk when DF bit is set or the interface didn't support TSO. */
9154 if ((ip_off & IP_DF) || (m0->m_pkthdr.csum_flags & CSUM_TSO)) {
9155 error = EMSGSIZE;
9156 KMOD_IPSTAT_INC(ips_cantfrag);
9157 if (pd->act.rt != PF_DUPTO) {
9158 if (s && s->nat_rule != NULL) {
9159 MPASS(m0 == pd->m);
9160 PACKET_UNDO_NAT(pd,
9161 (ip->ip_hl << 2) + (ip_off & IP_OFFMASK),
9162 s);
9163 }
9164
9165 pf_send_icmp(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG,
9166 ifp->if_mtu, pd->af, r, pd->act.rtableid);
9167 }
9168 SDT_PROBE1(pf, ip, route_to, drop, __LINE__);
9169 goto bad;
9170 }
9171
9172 error = ip_fragment(ip, &m0, ifp->if_mtu, ifp->if_hwassist);
9173 if (error) {
9174 SDT_PROBE1(pf, ip, route_to, drop, __LINE__);
9175 goto bad;
9176 }
9177
9178 for (; m0; m0 = m1) {
9179 m1 = m0->m_nextpkt;
9180 m0->m_nextpkt = NULL;
9181 if (error == 0) {
9182 m_clrprotoflags(m0);
9183 md = m0;
9184 pd->pf_mtag = pf_find_mtag(md);
9185 error = pf_dummynet_route(pd, s, r, ifp,
9186 gw, &md);
9187 if (md != NULL) {
9188 error = (*ifp->if_output)(ifp, md, gw, &ro);
9189 SDT_PROBE2(pf, ip, route_to, output, ifp, error);
9190 }
9191 } else
9192 m_freem(m0);
9193 }
9194
9195 if (error == 0)
9196 KMOD_IPSTAT_INC(ips_fragmented);
9197
9198 done:
9199 if (pd->act.rt != PF_DUPTO)
9200 pd->m = NULL;
9201 return;
9202
9203 bad_locked:
9204 if (s)
9205 PF_STATE_UNLOCK(s);
9206 bad:
9207 m_freem(m0);
9208 goto done;
9209 }
9210 #endif /* INET */
9211
9212 #ifdef INET6
9213 static void
pf_route6(struct pf_krule * r,struct ifnet * oifp,struct pf_kstate * s,struct pf_pdesc * pd,struct inpcb * inp)9214 pf_route6(struct pf_krule *r, struct ifnet *oifp,
9215 struct pf_kstate *s, struct pf_pdesc *pd, struct inpcb *inp)
9216 {
9217 struct mbuf *m0, *md;
9218 struct m_tag *mtag;
9219 struct sockaddr_in6 dst;
9220 struct ip6_hdr *ip6;
9221 struct ifnet *ifp = NULL;
9222 int r_dir;
9223 bool skip_test = false;
9224
9225 KASSERT(pd->m && r && oifp, ("%s: invalid parameters", __func__));
9226
9227 SDT_PROBE4(pf, ip6, route_to, entry, pd->m, pd, s, oifp);
9228
9229 if (s) {
9230 r_dir = s->direction;
9231 } else {
9232 r_dir = r->direction;
9233 }
9234
9235 KASSERT(pd->dir == PF_IN || pd->dir == PF_OUT ||
9236 r_dir == PF_IN || r_dir == PF_OUT, ("%s: invalid direction",
9237 __func__));
9238
9239 if ((pd->pf_mtag == NULL &&
9240 ((pd->pf_mtag = pf_get_mtag(pd->m)) == NULL)) ||
9241 pd->pf_mtag->routed++ > 3) {
9242 m0 = pd->m;
9243 pd->m = NULL;
9244 SDT_PROBE1(pf, ip6, route_to, drop, __LINE__);
9245 goto bad_locked;
9246 }
9247
9248 if (pd->act.rt_kif != NULL)
9249 ifp = pd->act.rt_kif->pfik_ifp;
9250
9251 if (pd->act.rt == PF_DUPTO) {
9252 if ((pd->pf_mtag->flags & PF_MTAG_FLAG_DUPLICATED)) {
9253 if (s != NULL) {
9254 PF_STATE_UNLOCK(s);
9255 }
9256 if (ifp == oifp) {
9257 /* When the 2nd interface is not skipped */
9258 return;
9259 } else {
9260 m0 = pd->m;
9261 pd->m = NULL;
9262 SDT_PROBE1(pf, ip6, route_to, drop, __LINE__);
9263 goto bad;
9264 }
9265 } else {
9266 pd->pf_mtag->flags |= PF_MTAG_FLAG_DUPLICATED;
9267 if (((m0 = m_dup(pd->m, M_NOWAIT)) == NULL)) {
9268 if (s)
9269 PF_STATE_UNLOCK(s);
9270 return;
9271 }
9272 }
9273 } else {
9274 if ((pd->act.rt == PF_REPLYTO) == (r_dir == pd->dir)) {
9275 if (pd->af == pd->naf) {
9276 pf_dummynet(pd, s, r, &pd->m);
9277 if (s)
9278 PF_STATE_UNLOCK(s);
9279 return;
9280 } else {
9281 if (r_dir == PF_IN) {
9282 skip_test = true;
9283 }
9284 }
9285 }
9286
9287 /*
9288 * If we're actually doing route-to and af-to and are in the
9289 * reply direction.
9290 */
9291 if (pd->act.rt_kif && pd->act.rt_kif->pfik_ifp &&
9292 pd->af != pd->naf) {
9293 if (pd->act.rt == PF_ROUTETO && r->naf != AF_INET6) {
9294 /* Un-set ifp so we do a plain route lookup. */
9295 ifp = NULL;
9296 }
9297 if (pd->act.rt == PF_REPLYTO && r->naf != AF_INET) {
9298 /* Un-set ifp so we do a plain route lookup. */
9299 ifp = NULL;
9300 }
9301 }
9302 m0 = pd->m;
9303 }
9304
9305 ip6 = mtod(m0, struct ip6_hdr *);
9306
9307 bzero(&dst, sizeof(dst));
9308 dst.sin6_family = AF_INET6;
9309 dst.sin6_len = sizeof(dst);
9310 pf_addrcpy((struct pf_addr *)&dst.sin6_addr, &pd->act.rt_addr,
9311 AF_INET6);
9312
9313 if (pd->dir == PF_IN) {
9314 if (ip6->ip6_hlim <= IPV6_HLIMDEC) {
9315 if (r->rt != PF_DUPTO)
9316 pf_send_icmp(m0, ICMP6_TIME_EXCEEDED,
9317 ICMP6_TIME_EXCEED_TRANSIT, 0, pd->af, r,
9318 pd->act.rtableid);
9319 goto bad_locked;
9320 }
9321 ip6->ip6_hlim -= IPV6_HLIMDEC;
9322 }
9323
9324 if (s != NULL) {
9325 if (ifp == NULL && (pd->af != pd->naf)) {
9326 const struct nhop_object *nh;
9327 nh = fib6_lookup(M_GETFIB(m0), &ip6->ip6_dst, 0, NHR_NONE, 0);
9328 if (nh) {
9329 ifp = nh->nh_ifp;
9330
9331 /* Use the gateway if needed. */
9332 if (nh->nh_flags & NHF_GATEWAY)
9333 bcopy(&nh->gw6_sa.sin6_addr, &dst.sin6_addr,
9334 sizeof(dst.sin6_addr));
9335 else
9336 dst.sin6_addr = ip6->ip6_dst;
9337
9338 /*
9339 * Bind to the correct interface if we're
9340 * if-bound. We don't know which interface
9341 * that will be until here, so we've inserted
9342 * the state on V_pf_all. Fix that now.
9343 */
9344 if (s->kif == V_pfi_all && ifp != NULL &&
9345 r->rule_flag & PFRULE_IFBOUND)
9346 s->kif = ifp->if_pf_kif;
9347 }
9348 }
9349
9350 if (r->rule_flag & PFRULE_IFBOUND &&
9351 pd->act.rt == PF_REPLYTO &&
9352 s->kif == V_pfi_all) {
9353 s->kif = pd->act.rt_kif;
9354 s->orig_kif = oifp->if_pf_kif;
9355 }
9356
9357 PF_STATE_UNLOCK(s);
9358 }
9359
9360 if (pd->af != pd->naf) {
9361 struct udphdr *uh = &pd->hdr.udp;
9362
9363 if (pd->proto == IPPROTO_UDP && uh->uh_sum == 0) {
9364 uh->uh_sum = in6_cksum_pseudo(ip6,
9365 ntohs(uh->uh_ulen), IPPROTO_UDP, 0);
9366 m_copyback(m0, pd->off, sizeof(*uh), pd->hdr.any);
9367 }
9368 }
9369
9370 if (ifp == NULL) {
9371 m0 = pd->m;
9372 pd->m = NULL;
9373 SDT_PROBE1(pf, ip6, route_to, drop, __LINE__);
9374 goto bad;
9375 }
9376
9377 if (r->rt == PF_DUPTO)
9378 skip_test = true;
9379
9380 if (pd->dir == PF_IN && !skip_test) {
9381 if (pf_test(AF_INET6, PF_OUT, PFIL_FWD | PF_PFIL_NOREFRAGMENT,
9382 ifp, &m0, inp, &pd->act) != PF_PASS) {
9383 SDT_PROBE1(pf, ip6, route_to, drop, __LINE__);
9384 goto bad;
9385 } else if (m0 == NULL) {
9386 SDT_PROBE1(pf, ip6, route_to, drop, __LINE__);
9387 goto done;
9388 }
9389 if (m0->m_len < sizeof(struct ip6_hdr)) {
9390 DPFPRINTF(PF_DEBUG_URGENT,
9391 "%s: m0->m_len < sizeof(struct ip6_hdr)",
9392 __func__);
9393 SDT_PROBE1(pf, ip6, route_to, drop, __LINE__);
9394 goto bad;
9395 }
9396 ip6 = mtod(m0, struct ip6_hdr *);
9397 }
9398
9399 if (ifp->if_flags & IFF_LOOPBACK)
9400 m0->m_flags |= M_SKIP_FIREWALL;
9401
9402 if (m0->m_pkthdr.csum_flags & CSUM_DELAY_DATA_IPV6 &
9403 ~ifp->if_hwassist) {
9404 uint32_t plen = m0->m_pkthdr.len - sizeof(*ip6);
9405 in6_delayed_cksum(m0, plen, sizeof(struct ip6_hdr));
9406 m0->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6;
9407 }
9408
9409 if (pd->dir == PF_IN) {
9410 uint16_t tmp;
9411 /*
9412 * Make sure dummynet gets the correct direction, in case it needs to
9413 * re-inject later.
9414 */
9415 pd->dir = PF_OUT;
9416
9417 /*
9418 * The following processing is actually the rest of the inbound processing, even
9419 * though we've marked it as outbound (so we don't look through dummynet) and it
9420 * happens after the outbound processing (pf_test(PF_OUT) above).
9421 * Swap the dummynet pipe numbers, because it's going to come to the wrong
9422 * conclusion about what direction it's processing, and we can't fix it or it
9423 * will re-inject incorrectly. Swapping the pipe numbers means that its incorrect
9424 * decision will pick the right pipe, and everything will mostly work as expected.
9425 */
9426 tmp = pd->act.dnrpipe;
9427 pd->act.dnrpipe = pd->act.dnpipe;
9428 pd->act.dnpipe = tmp;
9429 }
9430
9431 /*
9432 * If the packet is too large for the outgoing interface,
9433 * send back an icmp6 error.
9434 */
9435 if (IN6_IS_SCOPE_EMBED(&dst.sin6_addr))
9436 dst.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
9437 mtag = m_tag_find(m0, PACKET_TAG_PF_REASSEMBLED, NULL);
9438 if (mtag != NULL) {
9439 int ret __sdt_used;
9440 ret = pf_refragment6(ifp, &m0, mtag, ifp, true);
9441 SDT_PROBE2(pf, ip6, route_to, output, ifp, ret);
9442 goto done;
9443 }
9444
9445 if ((u_long)m0->m_pkthdr.len <= ifp->if_mtu) {
9446 md = m0;
9447 pf_dummynet_route(pd, s, r, ifp, sintosa(&dst), &md);
9448 if (md != NULL) {
9449 int ret __sdt_used;
9450 ret = nd6_output_ifp(ifp, ifp, md, &dst, NULL);
9451 SDT_PROBE2(pf, ip6, route_to, output, ifp, ret);
9452 }
9453 }
9454 else {
9455 in6_ifstat_inc(ifp, ifs6_in_toobig);
9456 if (pd->act.rt != PF_DUPTO) {
9457 if (s && s->nat_rule != NULL) {
9458 MPASS(m0 == pd->m);
9459 PACKET_UNDO_NAT(pd,
9460 ((caddr_t)ip6 - m0->m_data) +
9461 sizeof(struct ip6_hdr), s);
9462 }
9463
9464 if (r->rt != PF_DUPTO)
9465 pf_send_icmp(m0, ICMP6_PACKET_TOO_BIG, 0,
9466 ifp->if_mtu, pd->af, r, pd->act.rtableid);
9467 }
9468 SDT_PROBE1(pf, ip6, route_to, drop, __LINE__);
9469 goto bad;
9470 }
9471
9472 done:
9473 if (pd->act.rt != PF_DUPTO)
9474 pd->m = NULL;
9475 return;
9476
9477 bad_locked:
9478 if (s)
9479 PF_STATE_UNLOCK(s);
9480 bad:
9481 m_freem(m0);
9482 goto done;
9483 }
9484 #endif /* INET6 */
9485
9486 /*
9487 * FreeBSD supports cksum offloads for the following drivers.
9488 * em(4), fxp(4), lge(4), nge(4), re(4), ti(4), txp(4), xl(4)
9489 *
9490 * CSUM_DATA_VALID | CSUM_PSEUDO_HDR :
9491 * network driver performed cksum including pseudo header, need to verify
9492 * csum_data
9493 * CSUM_DATA_VALID :
9494 * network driver performed cksum, needs to additional pseudo header
9495 * cksum computation with partial csum_data(i.e. lack of H/W support for
9496 * pseudo header, for instance sk(4) and possibly gem(4))
9497 *
9498 * After validating the cksum of packet, set both flag CSUM_DATA_VALID and
9499 * CSUM_PSEUDO_HDR in order to avoid recomputation of the cksum in upper
9500 * TCP/UDP layer.
9501 * Also, set csum_data to 0xffff to force cksum validation.
9502 */
9503 static int
pf_check_proto_cksum(struct mbuf * m,int off,int len,u_int8_t p,sa_family_t af)9504 pf_check_proto_cksum(struct mbuf *m, int off, int len, u_int8_t p, sa_family_t af)
9505 {
9506 u_int16_t sum = 0;
9507 int hw_assist = 0;
9508 struct ip *ip;
9509
9510 if (off < sizeof(struct ip) || len < sizeof(struct udphdr))
9511 return (1);
9512 if (m->m_pkthdr.len < off + len)
9513 return (1);
9514
9515 switch (p) {
9516 case IPPROTO_TCP:
9517 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
9518 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
9519 sum = m->m_pkthdr.csum_data;
9520 } else {
9521 ip = mtod(m, struct ip *);
9522 sum = in_pseudo(ip->ip_src.s_addr,
9523 ip->ip_dst.s_addr, htonl((u_short)len +
9524 m->m_pkthdr.csum_data + IPPROTO_TCP));
9525 }
9526 sum ^= 0xffff;
9527 ++hw_assist;
9528 }
9529 break;
9530 case IPPROTO_UDP:
9531 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
9532 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
9533 sum = m->m_pkthdr.csum_data;
9534 } else {
9535 ip = mtod(m, struct ip *);
9536 sum = in_pseudo(ip->ip_src.s_addr,
9537 ip->ip_dst.s_addr, htonl((u_short)len +
9538 m->m_pkthdr.csum_data + IPPROTO_UDP));
9539 }
9540 sum ^= 0xffff;
9541 ++hw_assist;
9542 }
9543 break;
9544 case IPPROTO_ICMP:
9545 #ifdef INET6
9546 case IPPROTO_ICMPV6:
9547 #endif /* INET6 */
9548 break;
9549 default:
9550 return (1);
9551 }
9552
9553 if (!hw_assist) {
9554 switch (af) {
9555 case AF_INET:
9556 if (m->m_len < sizeof(struct ip))
9557 return (1);
9558 sum = in4_cksum(m, (p == IPPROTO_ICMP ? 0 : p), off, len);
9559 break;
9560 #ifdef INET6
9561 case AF_INET6:
9562 if (m->m_len < sizeof(struct ip6_hdr))
9563 return (1);
9564 sum = in6_cksum(m, p, off, len);
9565 break;
9566 #endif /* INET6 */
9567 }
9568 }
9569 if (sum) {
9570 switch (p) {
9571 case IPPROTO_TCP:
9572 {
9573 KMOD_TCPSTAT_INC(tcps_rcvbadsum);
9574 break;
9575 }
9576 case IPPROTO_UDP:
9577 {
9578 KMOD_UDPSTAT_INC(udps_badsum);
9579 break;
9580 }
9581 #ifdef INET
9582 case IPPROTO_ICMP:
9583 {
9584 KMOD_ICMPSTAT_INC(icps_checksum);
9585 break;
9586 }
9587 #endif
9588 #ifdef INET6
9589 case IPPROTO_ICMPV6:
9590 {
9591 KMOD_ICMP6STAT_INC(icp6s_checksum);
9592 break;
9593 }
9594 #endif /* INET6 */
9595 }
9596 return (1);
9597 } else {
9598 if (p == IPPROTO_TCP || p == IPPROTO_UDP) {
9599 m->m_pkthdr.csum_flags |=
9600 (CSUM_DATA_VALID | CSUM_PSEUDO_HDR);
9601 m->m_pkthdr.csum_data = 0xffff;
9602 }
9603 }
9604 return (0);
9605 }
9606
9607 static bool
pf_pdesc_to_dnflow(const struct pf_pdesc * pd,const struct pf_krule * r,const struct pf_kstate * s,struct ip_fw_args * dnflow)9608 pf_pdesc_to_dnflow(const struct pf_pdesc *pd, const struct pf_krule *r,
9609 const struct pf_kstate *s, struct ip_fw_args *dnflow)
9610 {
9611 int dndir = r->direction;
9612
9613 if (s && dndir == PF_INOUT) {
9614 dndir = s->direction;
9615 } else if (dndir == PF_INOUT) {
9616 /* Assume primary direction. Happens when we've set dnpipe in
9617 * the ethernet level code. */
9618 dndir = pd->dir;
9619 }
9620
9621 if (pd->pf_mtag->flags & PF_MTAG_FLAG_DUMMYNETED)
9622 return (false);
9623
9624 memset(dnflow, 0, sizeof(*dnflow));
9625
9626 if (pd->dport != NULL)
9627 dnflow->f_id.dst_port = ntohs(*pd->dport);
9628 if (pd->sport != NULL)
9629 dnflow->f_id.src_port = ntohs(*pd->sport);
9630
9631 if (pd->dir == PF_IN)
9632 dnflow->flags |= IPFW_ARGS_IN;
9633 else
9634 dnflow->flags |= IPFW_ARGS_OUT;
9635
9636 if (pd->dir != dndir && pd->act.dnrpipe) {
9637 dnflow->rule.info = pd->act.dnrpipe;
9638 }
9639 else if (pd->dir == dndir && pd->act.dnpipe) {
9640 dnflow->rule.info = pd->act.dnpipe;
9641 }
9642 else {
9643 return (false);
9644 }
9645
9646 dnflow->rule.info |= IPFW_IS_DUMMYNET;
9647 if (r->free_flags & PFRULE_DN_IS_PIPE || pd->act.flags & PFSTATE_DN_IS_PIPE)
9648 dnflow->rule.info |= IPFW_IS_PIPE;
9649
9650 dnflow->f_id.proto = pd->proto;
9651 dnflow->f_id.extra = dnflow->rule.info;
9652 switch (pd->naf) {
9653 case AF_INET:
9654 dnflow->f_id.addr_type = 4;
9655 dnflow->f_id.src_ip = ntohl(pd->src->v4.s_addr);
9656 dnflow->f_id.dst_ip = ntohl(pd->dst->v4.s_addr);
9657 break;
9658 case AF_INET6:
9659 dnflow->flags |= IPFW_ARGS_IP6;
9660 dnflow->f_id.addr_type = 6;
9661 dnflow->f_id.src_ip6 = pd->src->v6;
9662 dnflow->f_id.dst_ip6 = pd->dst->v6;
9663 break;
9664 }
9665
9666 return (true);
9667 }
9668
9669 int
pf_test_eth(int dir,int pflags,struct ifnet * ifp,struct mbuf ** m0,struct inpcb * inp)9670 pf_test_eth(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
9671 struct inpcb *inp)
9672 {
9673 struct pfi_kkif *kif;
9674 struct mbuf *m = *m0;
9675
9676 M_ASSERTPKTHDR(m);
9677 MPASS(ifp->if_vnet == curvnet);
9678 NET_EPOCH_ASSERT();
9679
9680 if (!V_pf_status.running)
9681 return (PF_PASS);
9682
9683 kif = (struct pfi_kkif *)ifp->if_pf_kif;
9684
9685 if (kif == NULL) {
9686 DPFPRINTF(PF_DEBUG_URGENT,
9687 "%s: kif == NULL, if_xname %s", __func__, ifp->if_xname);
9688 return (PF_DROP);
9689 }
9690 if (kif->pfik_flags & PFI_IFLAG_SKIP)
9691 return (PF_PASS);
9692
9693 if (m->m_flags & M_SKIP_FIREWALL)
9694 return (PF_PASS);
9695
9696 if (__predict_false(! M_WRITABLE(*m0))) {
9697 m = *m0 = m_unshare(*m0, M_NOWAIT);
9698 if (*m0 == NULL)
9699 return (PF_DROP);
9700 }
9701
9702 /* Stateless! */
9703 return (pf_test_eth_rule(dir, kif, m0));
9704 }
9705
9706 static __inline void
pf_dummynet_flag_remove(struct mbuf * m,struct pf_mtag * pf_mtag)9707 pf_dummynet_flag_remove(struct mbuf *m, struct pf_mtag *pf_mtag)
9708 {
9709 struct m_tag *mtag;
9710
9711 pf_mtag->flags &= ~PF_MTAG_FLAG_DUMMYNET;
9712
9713 /* dummynet adds this tag, but pf does not need it,
9714 * and keeping it creates unexpected behavior,
9715 * e.g. in case of divert(4) usage right after dummynet. */
9716 mtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL);
9717 if (mtag != NULL)
9718 m_tag_delete(m, mtag);
9719 }
9720
9721 static int
pf_dummynet(struct pf_pdesc * pd,struct pf_kstate * s,struct pf_krule * r,struct mbuf ** m0)9722 pf_dummynet(struct pf_pdesc *pd, struct pf_kstate *s,
9723 struct pf_krule *r, struct mbuf **m0)
9724 {
9725 return (pf_dummynet_route(pd, s, r, NULL, NULL, m0));
9726 }
9727
9728 static int
pf_dummynet_route(struct pf_pdesc * pd,struct pf_kstate * s,struct pf_krule * r,struct ifnet * ifp,const struct sockaddr * sa,struct mbuf ** m0)9729 pf_dummynet_route(struct pf_pdesc *pd, struct pf_kstate *s,
9730 struct pf_krule *r, struct ifnet *ifp, const struct sockaddr *sa,
9731 struct mbuf **m0)
9732 {
9733 struct ip_fw_args dnflow;
9734
9735 NET_EPOCH_ASSERT();
9736
9737 if (pd->act.dnpipe == 0 && pd->act.dnrpipe == 0)
9738 return (0);
9739
9740 if (ip_dn_io_ptr == NULL) {
9741 m_freem(*m0);
9742 *m0 = NULL;
9743 return (ENOMEM);
9744 }
9745
9746 if (pd->pf_mtag == NULL &&
9747 ((pd->pf_mtag = pf_get_mtag(*m0)) == NULL)) {
9748 m_freem(*m0);
9749 *m0 = NULL;
9750 return (ENOMEM);
9751 }
9752
9753 if (ifp != NULL) {
9754 pd->pf_mtag->flags |= PF_MTAG_FLAG_ROUTE_TO;
9755
9756 pd->pf_mtag->if_index = ifp->if_index;
9757 pd->pf_mtag->if_idxgen = ifp->if_idxgen;
9758
9759 MPASS(sa != NULL);
9760
9761 switch (sa->sa_family) {
9762 case AF_INET:
9763 memcpy(&pd->pf_mtag->dst, sa,
9764 sizeof(struct sockaddr_in));
9765 break;
9766 case AF_INET6:
9767 memcpy(&pd->pf_mtag->dst, sa,
9768 sizeof(struct sockaddr_in6));
9769 break;
9770 }
9771 }
9772
9773 if (s != NULL && s->nat_rule != NULL &&
9774 s->nat_rule->action == PF_RDR &&
9775 (
9776 #ifdef INET
9777 (pd->af == AF_INET && IN_LOOPBACK(ntohl(pd->dst->v4.s_addr))) ||
9778 #endif /* INET */
9779 (pd->af == AF_INET6 && IN6_IS_ADDR_LOOPBACK(&pd->dst->v6)))) {
9780 /*
9781 * If we're redirecting to loopback mark this packet
9782 * as being local. Otherwise it might get dropped
9783 * if dummynet re-injects.
9784 */
9785 (*m0)->m_pkthdr.rcvif = V_loif;
9786 }
9787
9788 if (pf_pdesc_to_dnflow(pd, r, s, &dnflow)) {
9789 pd->pf_mtag->flags |= PF_MTAG_FLAG_DUMMYNET;
9790 pd->pf_mtag->flags |= PF_MTAG_FLAG_DUMMYNETED;
9791 ip_dn_io_ptr(m0, &dnflow);
9792 if (*m0 != NULL) {
9793 pd->pf_mtag->flags &= ~PF_MTAG_FLAG_ROUTE_TO;
9794 pf_dummynet_flag_remove(*m0, pd->pf_mtag);
9795 }
9796 }
9797
9798 return (0);
9799 }
9800
9801 static int
pf_walk_option(struct pf_pdesc * pd,struct ip * h,int off,int end,u_short * reason)9802 pf_walk_option(struct pf_pdesc *pd, struct ip *h, int off, int end,
9803 u_short *reason)
9804 {
9805 uint8_t type, length, opts[15 * 4 - sizeof(struct ip)];
9806
9807 /* IP header in payload of ICMP packet may be too short */
9808 if (pd->m->m_pkthdr.len < end) {
9809 DPFPRINTF(PF_DEBUG_MISC, "IP option too short");
9810 REASON_SET(reason, PFRES_SHORT);
9811 return (PF_DROP);
9812 }
9813
9814 MPASS(end - off <= sizeof(opts));
9815 m_copydata(pd->m, off, end - off, opts);
9816 end -= off;
9817 off = 0;
9818
9819 while (off < end) {
9820 type = opts[off];
9821 if (type == IPOPT_EOL)
9822 break;
9823 if (type == IPOPT_NOP) {
9824 off++;
9825 continue;
9826 }
9827 if (off + 2 > end) {
9828 DPFPRINTF(PF_DEBUG_MISC, "IP length opt");
9829 REASON_SET(reason, PFRES_IPOPTIONS);
9830 return (PF_DROP);
9831 }
9832 length = opts[off + 1];
9833 if (length < 2) {
9834 DPFPRINTF(PF_DEBUG_MISC, "IP short opt");
9835 REASON_SET(reason, PFRES_IPOPTIONS);
9836 return (PF_DROP);
9837 }
9838 if (off + length > end) {
9839 DPFPRINTF(PF_DEBUG_MISC, "IP long opt");
9840 REASON_SET(reason, PFRES_IPOPTIONS);
9841 return (PF_DROP);
9842 }
9843 switch (type) {
9844 case IPOPT_RA:
9845 pd->badopts |= PF_OPT_ROUTER_ALERT;
9846 break;
9847 default:
9848 pd->badopts |= PF_OPT_OTHER;
9849 break;
9850 }
9851 off += length;
9852 }
9853
9854 return (PF_PASS);
9855 }
9856
9857 static int
pf_walk_header(struct pf_pdesc * pd,struct ip * h,u_short * reason)9858 pf_walk_header(struct pf_pdesc *pd, struct ip *h, u_short *reason)
9859 {
9860 struct ah ext;
9861 u_int32_t hlen, end;
9862 int hdr_cnt;
9863
9864 hlen = h->ip_hl << 2;
9865 if (hlen < sizeof(struct ip) || hlen > ntohs(h->ip_len)) {
9866 REASON_SET(reason, PFRES_SHORT);
9867 return (PF_DROP);
9868 }
9869 if (hlen != sizeof(struct ip)) {
9870 if (pf_walk_option(pd, h, pd->off + sizeof(struct ip),
9871 pd->off + hlen, reason) != PF_PASS)
9872 return (PF_DROP);
9873 /* header options which contain only padding is fishy */
9874 if (pd->badopts == 0)
9875 pd->badopts |= PF_OPT_OTHER;
9876 }
9877 end = pd->off + ntohs(h->ip_len);
9878 pd->off += hlen;
9879 pd->proto = h->ip_p;
9880 /* IGMP packets have router alert options, allow them */
9881 if (pd->proto == IPPROTO_IGMP) {
9882 /* According to RFC 1112 ttl must be set to 1. */
9883 if ((h->ip_ttl != 1) ||
9884 !IN_MULTICAST(ntohl(h->ip_dst.s_addr))) {
9885 DPFPRINTF(PF_DEBUG_MISC, "Invalid IGMP");
9886 REASON_SET(reason, PFRES_IPOPTIONS);
9887 return (PF_DROP);
9888 }
9889 pd->badopts &= ~PF_OPT_ROUTER_ALERT;
9890 }
9891 /* stop walking over non initial fragments */
9892 if ((h->ip_off & htons(IP_OFFMASK)) != 0)
9893 return (PF_PASS);
9894 for (hdr_cnt = 0; hdr_cnt < PF_HDR_LIMIT; hdr_cnt++) {
9895 switch (pd->proto) {
9896 case IPPROTO_AH:
9897 /* fragments may be short */
9898 if ((h->ip_off & htons(IP_MF | IP_OFFMASK)) != 0 &&
9899 end < pd->off + sizeof(ext))
9900 return (PF_PASS);
9901 if (!pf_pull_hdr(pd->m, pd->off, &ext, sizeof(ext),
9902 NULL, reason, AF_INET)) {
9903 DPFPRINTF(PF_DEBUG_MISC, "IP short exthdr");
9904 return (PF_DROP);
9905 }
9906 pd->off += (ext.ah_len + 2) * 4;
9907 pd->proto = ext.ah_nxt;
9908 break;
9909 default:
9910 return (PF_PASS);
9911 }
9912 }
9913 DPFPRINTF(PF_DEBUG_MISC, "IPv4 nested authentication header limit");
9914 REASON_SET(reason, PFRES_IPOPTIONS);
9915 return (PF_DROP);
9916 }
9917
9918 #ifdef INET6
9919 static int
pf_walk_option6(struct pf_pdesc * pd,struct ip6_hdr * h,int off,int end,u_short * reason)9920 pf_walk_option6(struct pf_pdesc *pd, struct ip6_hdr *h, int off, int end,
9921 u_short *reason)
9922 {
9923 struct ip6_opt opt;
9924 struct ip6_opt_jumbo jumbo;
9925
9926 while (off < end) {
9927 if (!pf_pull_hdr(pd->m, off, &opt.ip6o_type,
9928 sizeof(opt.ip6o_type), NULL, reason, AF_INET6)) {
9929 DPFPRINTF(PF_DEBUG_MISC, "IPv6 short opt type");
9930 return (PF_DROP);
9931 }
9932 if (opt.ip6o_type == IP6OPT_PAD1) {
9933 off++;
9934 continue;
9935 }
9936 if (!pf_pull_hdr(pd->m, off, &opt, sizeof(opt), NULL,
9937 reason, AF_INET6)) {
9938 DPFPRINTF(PF_DEBUG_MISC, "IPv6 short opt");
9939 return (PF_DROP);
9940 }
9941 if (off + sizeof(opt) + opt.ip6o_len > end) {
9942 DPFPRINTF(PF_DEBUG_MISC, "IPv6 long opt");
9943 REASON_SET(reason, PFRES_IPOPTIONS);
9944 return (PF_DROP);
9945 }
9946 switch (opt.ip6o_type) {
9947 case IP6OPT_PADN:
9948 break;
9949 case IP6OPT_JUMBO:
9950 pd->badopts |= PF_OPT_JUMBO;
9951 if (pd->jumbolen != 0) {
9952 DPFPRINTF(PF_DEBUG_MISC, "IPv6 multiple jumbo");
9953 REASON_SET(reason, PFRES_IPOPTIONS);
9954 return (PF_DROP);
9955 }
9956 if (ntohs(h->ip6_plen) != 0) {
9957 DPFPRINTF(PF_DEBUG_MISC, "IPv6 bad jumbo plen");
9958 REASON_SET(reason, PFRES_IPOPTIONS);
9959 return (PF_DROP);
9960 }
9961 if (!pf_pull_hdr(pd->m, off, &jumbo, sizeof(jumbo), NULL,
9962 reason, AF_INET6)) {
9963 DPFPRINTF(PF_DEBUG_MISC, "IPv6 short jumbo");
9964 return (PF_DROP);
9965 }
9966 memcpy(&pd->jumbolen, jumbo.ip6oj_jumbo_len,
9967 sizeof(pd->jumbolen));
9968 pd->jumbolen = ntohl(pd->jumbolen);
9969 if (pd->jumbolen < IPV6_MAXPACKET) {
9970 DPFPRINTF(PF_DEBUG_MISC, "IPv6 short jumbolen");
9971 REASON_SET(reason, PFRES_IPOPTIONS);
9972 return (PF_DROP);
9973 }
9974 break;
9975 case IP6OPT_ROUTER_ALERT:
9976 pd->badopts |= PF_OPT_ROUTER_ALERT;
9977 break;
9978 default:
9979 pd->badopts |= PF_OPT_OTHER;
9980 break;
9981 }
9982 off += sizeof(opt) + opt.ip6o_len;
9983 }
9984
9985 return (PF_PASS);
9986 }
9987
9988 int
pf_walk_header6(struct pf_pdesc * pd,struct ip6_hdr * h,u_short * reason)9989 pf_walk_header6(struct pf_pdesc *pd, struct ip6_hdr *h, u_short *reason)
9990 {
9991 struct ip6_frag frag;
9992 struct ip6_ext ext;
9993 struct icmp6_hdr icmp6;
9994 struct ip6_rthdr rthdr;
9995 uint32_t end;
9996 int hdr_cnt, fraghdr_cnt = 0, rthdr_cnt = 0;
9997
9998 pd->off += sizeof(struct ip6_hdr);
9999 end = pd->off + ntohs(h->ip6_plen);
10000 pd->fragoff = pd->extoff = pd->jumbolen = 0;
10001 pd->proto = h->ip6_nxt;
10002 for (hdr_cnt = 0; hdr_cnt < PF_HDR_LIMIT; hdr_cnt++) {
10003 switch (pd->proto) {
10004 case IPPROTO_ROUTING:
10005 case IPPROTO_DSTOPTS:
10006 pd->badopts |= PF_OPT_OTHER;
10007 break;
10008 case IPPROTO_HOPOPTS:
10009 if (!pf_pull_hdr(pd->m, pd->off, &ext, sizeof(ext),
10010 NULL, reason, AF_INET6)) {
10011 DPFPRINTF(PF_DEBUG_MISC, "IPv6 short exthdr");
10012 return (PF_DROP);
10013 }
10014 if (pf_walk_option6(pd, h, pd->off + sizeof(ext),
10015 pd->off + (ext.ip6e_len + 1) * 8,
10016 reason) != PF_PASS)
10017 return (PF_DROP);
10018 /* option header which contains only padding is fishy */
10019 if (pd->badopts == 0)
10020 pd->badopts |= PF_OPT_OTHER;
10021 break;
10022 }
10023 switch (pd->proto) {
10024 case IPPROTO_FRAGMENT:
10025 if (fraghdr_cnt++) {
10026 DPFPRINTF(PF_DEBUG_MISC, "IPv6 multiple fragment");
10027 REASON_SET(reason, PFRES_FRAG);
10028 return (PF_DROP);
10029 }
10030 /* jumbo payload packets cannot be fragmented */
10031 if (pd->jumbolen != 0) {
10032 DPFPRINTF(PF_DEBUG_MISC, "IPv6 fragmented jumbo");
10033 REASON_SET(reason, PFRES_FRAG);
10034 return (PF_DROP);
10035 }
10036 if (!pf_pull_hdr(pd->m, pd->off, &frag, sizeof(frag),
10037 NULL, reason, AF_INET6)) {
10038 DPFPRINTF(PF_DEBUG_MISC, "IPv6 short fragment");
10039 return (PF_DROP);
10040 }
10041 /* stop walking over non initial fragments */
10042 if (ntohs((frag.ip6f_offlg & IP6F_OFF_MASK)) != 0) {
10043 pd->fragoff = pd->off;
10044 return (PF_PASS);
10045 }
10046 /* RFC6946: reassemble only non atomic fragments */
10047 if (frag.ip6f_offlg & IP6F_MORE_FRAG)
10048 pd->fragoff = pd->off;
10049 pd->off += sizeof(frag);
10050 pd->proto = frag.ip6f_nxt;
10051 break;
10052 case IPPROTO_ROUTING:
10053 if (rthdr_cnt++) {
10054 DPFPRINTF(PF_DEBUG_MISC, "IPv6 multiple rthdr");
10055 REASON_SET(reason, PFRES_IPOPTIONS);
10056 return (PF_DROP);
10057 }
10058 /* fragments may be short */
10059 if (pd->fragoff != 0 && end < pd->off + sizeof(rthdr)) {
10060 pd->off = pd->fragoff;
10061 pd->proto = IPPROTO_FRAGMENT;
10062 return (PF_PASS);
10063 }
10064 if (!pf_pull_hdr(pd->m, pd->off, &rthdr, sizeof(rthdr),
10065 NULL, reason, AF_INET6)) {
10066 DPFPRINTF(PF_DEBUG_MISC, "IPv6 short rthdr");
10067 return (PF_DROP);
10068 }
10069 if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
10070 DPFPRINTF(PF_DEBUG_MISC, "IPv6 rthdr0");
10071 REASON_SET(reason, PFRES_IPOPTIONS);
10072 return (PF_DROP);
10073 }
10074 /* FALLTHROUGH */
10075 case IPPROTO_HOPOPTS:
10076 /* RFC2460 4.1: Hop-by-Hop only after IPv6 header */
10077 if (pd->proto == IPPROTO_HOPOPTS && hdr_cnt > 0) {
10078 DPFPRINTF(PF_DEBUG_MISC, "IPv6 hopopts not first");
10079 REASON_SET(reason, PFRES_IPOPTIONS);
10080 return (PF_DROP);
10081 }
10082 /* FALLTHROUGH */
10083 case IPPROTO_AH:
10084 case IPPROTO_DSTOPTS:
10085 if (!pf_pull_hdr(pd->m, pd->off, &ext, sizeof(ext),
10086 NULL, reason, AF_INET6)) {
10087 DPFPRINTF(PF_DEBUG_MISC, "IPv6 short exthdr");
10088 return (PF_DROP);
10089 }
10090 /* fragments may be short */
10091 if (pd->fragoff != 0 && end < pd->off + sizeof(ext)) {
10092 pd->off = pd->fragoff;
10093 pd->proto = IPPROTO_FRAGMENT;
10094 return (PF_PASS);
10095 }
10096 /* reassembly needs the ext header before the frag */
10097 if (pd->fragoff == 0)
10098 pd->extoff = pd->off;
10099 if (pd->proto == IPPROTO_HOPOPTS && pd->fragoff == 0 &&
10100 ntohs(h->ip6_plen) == 0 && pd->jumbolen != 0) {
10101 DPFPRINTF(PF_DEBUG_MISC, "IPv6 missing jumbo");
10102 REASON_SET(reason, PFRES_IPOPTIONS);
10103 return (PF_DROP);
10104 }
10105 if (pd->proto == IPPROTO_AH)
10106 pd->off += (ext.ip6e_len + 2) * 4;
10107 else
10108 pd->off += (ext.ip6e_len + 1) * 8;
10109 pd->proto = ext.ip6e_nxt;
10110 break;
10111 case IPPROTO_ICMPV6:
10112 /* fragments may be short, ignore inner header then */
10113 if (pd->fragoff != 0 && end < pd->off + sizeof(icmp6)) {
10114 pd->off = pd->fragoff;
10115 pd->proto = IPPROTO_FRAGMENT;
10116 return (PF_PASS);
10117 }
10118 if (!pf_pull_hdr(pd->m, pd->off, &icmp6, sizeof(icmp6),
10119 NULL, reason, AF_INET6)) {
10120 DPFPRINTF(PF_DEBUG_MISC,
10121 "IPv6 short icmp6hdr");
10122 return (PF_DROP);
10123 }
10124 /* ICMP multicast packets have router alert options */
10125 switch (icmp6.icmp6_type) {
10126 case MLD_LISTENER_QUERY:
10127 case MLD_LISTENER_REPORT:
10128 case MLD_LISTENER_DONE:
10129 case MLDV2_LISTENER_REPORT:
10130 /*
10131 * According to RFC 2710 all MLD messages are
10132 * sent with hop-limit (ttl) set to 1, and link
10133 * local source address. If either one is
10134 * missing then MLD message is invalid and
10135 * should be discarded.
10136 */
10137 if ((h->ip6_hlim != 1) ||
10138 !IN6_IS_ADDR_LINKLOCAL(&h->ip6_src)) {
10139 DPFPRINTF(PF_DEBUG_MISC, "Invalid MLD");
10140 REASON_SET(reason, PFRES_IPOPTIONS);
10141 return (PF_DROP);
10142 }
10143 pd->badopts &= ~PF_OPT_ROUTER_ALERT;
10144 break;
10145 }
10146 return (PF_PASS);
10147 case IPPROTO_TCP:
10148 case IPPROTO_UDP:
10149 case IPPROTO_SCTP:
10150 /* fragments may be short, ignore inner header then */
10151 if (pd->fragoff != 0 && end < pd->off +
10152 (pd->proto == IPPROTO_TCP ? sizeof(struct tcphdr) :
10153 pd->proto == IPPROTO_UDP ? sizeof(struct udphdr) :
10154 pd->proto == IPPROTO_SCTP ? sizeof(struct sctphdr) :
10155 sizeof(struct icmp6_hdr))) {
10156 pd->off = pd->fragoff;
10157 pd->proto = IPPROTO_FRAGMENT;
10158 }
10159 /* FALLTHROUGH */
10160 default:
10161 return (PF_PASS);
10162 }
10163 }
10164 DPFPRINTF(PF_DEBUG_MISC, "IPv6 nested extension header limit");
10165 REASON_SET(reason, PFRES_IPOPTIONS);
10166 return (PF_DROP);
10167 }
10168 #endif /* INET6 */
10169
10170 static void
pf_init_pdesc(struct pf_pdesc * pd,struct mbuf * m)10171 pf_init_pdesc(struct pf_pdesc *pd, struct mbuf *m)
10172 {
10173 memset(pd, 0, sizeof(*pd));
10174 pd->pf_mtag = pf_find_mtag(m);
10175 pd->m = m;
10176 }
10177
10178 static int
pf_setup_pdesc(sa_family_t af,int dir,struct pf_pdesc * pd,struct mbuf ** m0,u_short * action,u_short * reason,struct pfi_kkif * kif,struct pf_rule_actions * default_actions)10179 pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf **m0,
10180 u_short *action, u_short *reason, struct pfi_kkif *kif,
10181 struct pf_rule_actions *default_actions)
10182 {
10183 pd->dir = dir;
10184 pd->kif = kif;
10185 pd->m = *m0;
10186 pd->sidx = (dir == PF_IN) ? 0 : 1;
10187 pd->didx = (dir == PF_IN) ? 1 : 0;
10188 pd->af = pd->naf = af;
10189
10190 PF_RULES_ASSERT();
10191
10192 TAILQ_INIT(&pd->sctp_multihome_jobs);
10193 if (default_actions != NULL)
10194 memcpy(&pd->act, default_actions, sizeof(pd->act));
10195
10196 if (pd->pf_mtag && pd->pf_mtag->dnpipe) {
10197 pd->act.dnpipe = pd->pf_mtag->dnpipe;
10198 pd->act.flags = pd->pf_mtag->dnflags;
10199 }
10200
10201 switch (af) {
10202 #ifdef INET
10203 case AF_INET: {
10204 struct ip *h;
10205
10206 if (__predict_false((*m0)->m_len < sizeof(struct ip)) &&
10207 (pd->m = *m0 = m_pullup(*m0, sizeof(struct ip))) == NULL) {
10208 DPFPRINTF(PF_DEBUG_URGENT,
10209 "%s: m_len < sizeof(struct ip), pullup failed",
10210 __func__);
10211 *action = PF_DROP;
10212 REASON_SET(reason, PFRES_SHORT);
10213 return (-1);
10214 }
10215
10216 h = mtod(pd->m, struct ip *);
10217 if (pd->m->m_pkthdr.len < ntohs(h->ip_len)) {
10218 *action = PF_DROP;
10219 REASON_SET(reason, PFRES_SHORT);
10220 return (-1);
10221 }
10222
10223 if (pf_normalize_ip(reason, pd) != PF_PASS) {
10224 /* We do IP header normalization and packet reassembly here */
10225 *m0 = pd->m;
10226 *action = PF_DROP;
10227 return (-1);
10228 }
10229 *m0 = pd->m;
10230 h = mtod(pd->m, struct ip *);
10231
10232 if (pf_walk_header(pd, h, reason) != PF_PASS) {
10233 *action = PF_DROP;
10234 return (-1);
10235 }
10236
10237 pd->src = (struct pf_addr *)&h->ip_src;
10238 pd->dst = (struct pf_addr *)&h->ip_dst;
10239 pf_addrcpy(&pd->osrc, pd->src, af);
10240 pf_addrcpy(&pd->odst, pd->dst, af);
10241 pd->ip_sum = &h->ip_sum;
10242 pd->tos = h->ip_tos & ~IPTOS_ECN_MASK;
10243 pd->ttl = h->ip_ttl;
10244 pd->tot_len = ntohs(h->ip_len);
10245 pd->act.rtableid = -1;
10246 pd->df = h->ip_off & htons(IP_DF);
10247 pd->virtual_proto = (h->ip_off & htons(IP_MF | IP_OFFMASK)) ?
10248 PF_VPROTO_FRAGMENT : pd->proto;
10249
10250 break;
10251 }
10252 #endif /* INET */
10253 #ifdef INET6
10254 case AF_INET6: {
10255 struct ip6_hdr *h;
10256
10257 if (__predict_false((*m0)->m_len < sizeof(struct ip6_hdr)) &&
10258 (pd->m = *m0 = m_pullup(*m0, sizeof(struct ip6_hdr))) == NULL) {
10259 DPFPRINTF(PF_DEBUG_URGENT,
10260 "%s: m_len < sizeof(struct ip6_hdr)"
10261 ", pullup failed", __func__);
10262 *action = PF_DROP;
10263 REASON_SET(reason, PFRES_SHORT);
10264 return (-1);
10265 }
10266
10267 h = mtod(pd->m, struct ip6_hdr *);
10268 if (pd->m->m_pkthdr.len <
10269 sizeof(struct ip6_hdr) + ntohs(h->ip6_plen)) {
10270 *action = PF_DROP;
10271 REASON_SET(reason, PFRES_SHORT);
10272 return (-1);
10273 }
10274
10275 /*
10276 * we do not support jumbogram. if we keep going, zero ip6_plen
10277 * will do something bad, so drop the packet for now.
10278 */
10279 if (htons(h->ip6_plen) == 0) {
10280 *action = PF_DROP;
10281 return (-1);
10282 }
10283
10284 if (pf_walk_header6(pd, h, reason) != PF_PASS) {
10285 *action = PF_DROP;
10286 return (-1);
10287 }
10288
10289 h = mtod(pd->m, struct ip6_hdr *);
10290 pd->src = (struct pf_addr *)&h->ip6_src;
10291 pd->dst = (struct pf_addr *)&h->ip6_dst;
10292 pf_addrcpy(&pd->osrc, pd->src, af);
10293 pf_addrcpy(&pd->odst, pd->dst, af);
10294 pd->ip_sum = NULL;
10295 pd->tos = IPV6_DSCP(h);
10296 pd->ttl = h->ip6_hlim;
10297 pd->tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
10298 pd->act.rtableid = -1;
10299
10300 pd->virtual_proto = (pd->fragoff != 0) ?
10301 PF_VPROTO_FRAGMENT : pd->proto;
10302
10303 /* We do IP header normalization and packet reassembly here */
10304 if (pf_normalize_ip6(pd->fragoff, reason, pd) !=
10305 PF_PASS) {
10306 *m0 = pd->m;
10307 *action = PF_DROP;
10308 return (-1);
10309 }
10310 *m0 = pd->m;
10311 if (pd->m == NULL) {
10312 /* packet sits in reassembly queue, no error */
10313 *action = PF_PASS;
10314 return (-1);
10315 }
10316
10317 /* Update pointers into the packet. */
10318 h = mtod(pd->m, struct ip6_hdr *);
10319 pd->src = (struct pf_addr *)&h->ip6_src;
10320 pd->dst = (struct pf_addr *)&h->ip6_dst;
10321
10322 pd->off = 0;
10323
10324 if (pf_walk_header6(pd, h, reason) != PF_PASS) {
10325 *action = PF_DROP;
10326 return (-1);
10327 }
10328
10329 if (m_tag_find(pd->m, PACKET_TAG_PF_REASSEMBLED, NULL) != NULL) {
10330 /*
10331 * Reassembly may have changed the next protocol from
10332 * fragment to something else, so update.
10333 */
10334 pd->virtual_proto = pd->proto;
10335 MPASS(pd->fragoff == 0);
10336 }
10337
10338 if (pd->fragoff != 0)
10339 pd->virtual_proto = PF_VPROTO_FRAGMENT;
10340
10341 break;
10342 }
10343 #endif /* INET6 */
10344 default:
10345 panic("pf_setup_pdesc called with illegal af %u", af);
10346 }
10347
10348 switch (pd->virtual_proto) {
10349 case IPPROTO_TCP: {
10350 struct tcphdr *th = &pd->hdr.tcp;
10351
10352 if (!pf_pull_hdr(pd->m, pd->off, th, sizeof(*th), action,
10353 reason, af)) {
10354 *action = PF_DROP;
10355 REASON_SET(reason, PFRES_SHORT);
10356 return (-1);
10357 }
10358 pd->hdrlen = sizeof(*th);
10359 pd->p_len = pd->tot_len - pd->off - (th->th_off << 2);
10360 pd->sport = &th->th_sport;
10361 pd->dport = &th->th_dport;
10362 pd->pcksum = &th->th_sum;
10363 break;
10364 }
10365 case IPPROTO_UDP: {
10366 struct udphdr *uh = &pd->hdr.udp;
10367
10368 if (!pf_pull_hdr(pd->m, pd->off, uh, sizeof(*uh), action,
10369 reason, af)) {
10370 *action = PF_DROP;
10371 REASON_SET(reason, PFRES_SHORT);
10372 return (-1);
10373 }
10374 pd->hdrlen = sizeof(*uh);
10375 if (uh->uh_dport == 0 ||
10376 ntohs(uh->uh_ulen) > pd->m->m_pkthdr.len - pd->off ||
10377 ntohs(uh->uh_ulen) < sizeof(struct udphdr)) {
10378 *action = PF_DROP;
10379 REASON_SET(reason, PFRES_SHORT);
10380 return (-1);
10381 }
10382 pd->sport = &uh->uh_sport;
10383 pd->dport = &uh->uh_dport;
10384 pd->pcksum = &uh->uh_sum;
10385 break;
10386 }
10387 case IPPROTO_SCTP: {
10388 if (!pf_pull_hdr(pd->m, pd->off, &pd->hdr.sctp, sizeof(pd->hdr.sctp),
10389 action, reason, af)) {
10390 *action = PF_DROP;
10391 REASON_SET(reason, PFRES_SHORT);
10392 return (-1);
10393 }
10394 pd->hdrlen = sizeof(pd->hdr.sctp);
10395 pd->p_len = pd->tot_len - pd->off;
10396
10397 pd->sport = &pd->hdr.sctp.src_port;
10398 pd->dport = &pd->hdr.sctp.dest_port;
10399 if (pd->hdr.sctp.src_port == 0 || pd->hdr.sctp.dest_port == 0) {
10400 *action = PF_DROP;
10401 REASON_SET(reason, PFRES_SHORT);
10402 return (-1);
10403 }
10404 if (pf_scan_sctp(pd) != PF_PASS) {
10405 *action = PF_DROP;
10406 REASON_SET(reason, PFRES_SHORT);
10407 return (-1);
10408 }
10409 /*
10410 * Placeholder. The SCTP checksum is 32-bits, but
10411 * pf_test_state() expects to update a 16-bit checksum.
10412 * Provide a dummy value which we'll subsequently ignore.
10413 */
10414 pd->pcksum = &pd->sctp_dummy_sum;
10415 break;
10416 }
10417 case IPPROTO_ICMP: {
10418 if (!pf_pull_hdr(pd->m, pd->off, &pd->hdr.icmp, ICMP_MINLEN,
10419 action, reason, af)) {
10420 *action = PF_DROP;
10421 REASON_SET(reason, PFRES_SHORT);
10422 return (-1);
10423 }
10424 pd->pcksum = &pd->hdr.icmp.icmp_cksum;
10425 pd->hdrlen = ICMP_MINLEN;
10426 break;
10427 }
10428 #ifdef INET6
10429 case IPPROTO_ICMPV6: {
10430 size_t icmp_hlen = sizeof(struct icmp6_hdr);
10431
10432 if (!pf_pull_hdr(pd->m, pd->off, &pd->hdr.icmp6, icmp_hlen,
10433 action, reason, af)) {
10434 *action = PF_DROP;
10435 REASON_SET(reason, PFRES_SHORT);
10436 return (-1);
10437 }
10438 /* ICMP headers we look further into to match state */
10439 switch (pd->hdr.icmp6.icmp6_type) {
10440 case MLD_LISTENER_QUERY:
10441 case MLD_LISTENER_REPORT:
10442 icmp_hlen = sizeof(struct mld_hdr);
10443 break;
10444 case ND_NEIGHBOR_SOLICIT:
10445 case ND_NEIGHBOR_ADVERT:
10446 icmp_hlen = sizeof(struct nd_neighbor_solicit);
10447 /* FALLTHROUGH */
10448 case ND_ROUTER_SOLICIT:
10449 case ND_ROUTER_ADVERT:
10450 case ND_REDIRECT:
10451 if (pd->ttl != 255) {
10452 REASON_SET(reason, PFRES_NORM);
10453 return (PF_DROP);
10454 }
10455 break;
10456 }
10457 if (icmp_hlen > sizeof(struct icmp6_hdr) &&
10458 !pf_pull_hdr(pd->m, pd->off, &pd->hdr.icmp6, icmp_hlen,
10459 action, reason, af)) {
10460 *action = PF_DROP;
10461 REASON_SET(reason, PFRES_SHORT);
10462 return (-1);
10463 }
10464 pd->hdrlen = icmp_hlen;
10465 pd->pcksum = &pd->hdr.icmp6.icmp6_cksum;
10466 break;
10467 }
10468 #endif /* INET6 */
10469 }
10470
10471 if (pd->sport)
10472 pd->osport = pd->nsport = *pd->sport;
10473 if (pd->dport)
10474 pd->odport = pd->ndport = *pd->dport;
10475
10476 return (0);
10477 }
10478
10479 static void
pf_counters_inc(int action,struct pf_pdesc * pd,struct pf_kstate * s,struct pf_krule * r,struct pf_krule * a)10480 pf_counters_inc(int action, struct pf_pdesc *pd,
10481 struct pf_kstate *s, struct pf_krule *r, struct pf_krule *a)
10482 {
10483 struct pf_krule *tr;
10484 int dir = pd->dir;
10485 int dirndx;
10486
10487 pf_counter_u64_critical_enter();
10488 pf_counter_u64_add_protected(
10489 &pd->kif->pfik_bytes[pd->af == AF_INET6][dir == PF_OUT][action != PF_PASS],
10490 pd->tot_len);
10491 pf_counter_u64_add_protected(
10492 &pd->kif->pfik_packets[pd->af == AF_INET6][dir == PF_OUT][action != PF_PASS],
10493 1);
10494
10495 if (action == PF_PASS || action == PF_AFRT || r->action == PF_DROP) {
10496 dirndx = (dir == PF_OUT);
10497 pf_counter_u64_add_protected(&r->packets[dirndx], 1);
10498 pf_counter_u64_add_protected(&r->bytes[dirndx], pd->tot_len);
10499 pf_update_timestamp(r);
10500
10501 if (a != NULL) {
10502 pf_counter_u64_add_protected(&a->packets[dirndx], 1);
10503 pf_counter_u64_add_protected(&a->bytes[dirndx], pd->tot_len);
10504 }
10505 if (s != NULL) {
10506 struct pf_krule_item *ri;
10507
10508 if (s->nat_rule != NULL) {
10509 pf_counter_u64_add_protected(&s->nat_rule->packets[dirndx],
10510 1);
10511 pf_counter_u64_add_protected(&s->nat_rule->bytes[dirndx],
10512 pd->tot_len);
10513 }
10514 /*
10515 * Source nodes are accessed unlocked here.
10516 * But since we are operating with stateful tracking
10517 * and the state is locked, those SNs could not have
10518 * been freed.
10519 */
10520 for (pf_sn_types_t sn_type=0; sn_type<PF_SN_MAX; sn_type++) {
10521 if (s->sns[sn_type] != NULL) {
10522 counter_u64_add(
10523 s->sns[sn_type]->packets[dirndx],
10524 1);
10525 counter_u64_add(
10526 s->sns[sn_type]->bytes[dirndx],
10527 pd->tot_len);
10528 }
10529 }
10530 dirndx = (dir == s->direction) ? 0 : 1;
10531 s->packets[dirndx]++;
10532 s->bytes[dirndx] += pd->tot_len;
10533
10534 SLIST_FOREACH(ri, &s->match_rules, entry) {
10535 pf_counter_u64_add_protected(&ri->r->packets[dirndx], 1);
10536 pf_counter_u64_add_protected(&ri->r->bytes[dirndx], pd->tot_len);
10537
10538 if (ri->r->src.addr.type == PF_ADDR_TABLE)
10539 pfr_update_stats(ri->r->src.addr.p.tbl,
10540 (s == NULL) ? pd->src :
10541 &s->key[(s->direction == PF_IN)]->
10542 addr[(s->direction == PF_OUT)],
10543 pd->af, pd->tot_len, dir == PF_OUT,
10544 r->action == PF_PASS, ri->r->src.neg);
10545 if (ri->r->dst.addr.type == PF_ADDR_TABLE)
10546 pfr_update_stats(ri->r->dst.addr.p.tbl,
10547 (s == NULL) ? pd->dst :
10548 &s->key[(s->direction == PF_IN)]->
10549 addr[(s->direction == PF_IN)],
10550 pd->af, pd->tot_len, dir == PF_OUT,
10551 r->action == PF_PASS, ri->r->dst.neg);
10552 }
10553 }
10554
10555 tr = r;
10556 if (s != NULL && s->nat_rule != NULL &&
10557 r == &V_pf_default_rule)
10558 tr = s->nat_rule;
10559
10560 if (tr->src.addr.type == PF_ADDR_TABLE)
10561 pfr_update_stats(tr->src.addr.p.tbl,
10562 (s == NULL) ? pd->src :
10563 &s->key[(s->direction == PF_IN)]->
10564 addr[(s->direction == PF_OUT)],
10565 pd->af, pd->tot_len, dir == PF_OUT,
10566 r->action == PF_PASS, tr->src.neg);
10567 if (tr->dst.addr.type == PF_ADDR_TABLE)
10568 pfr_update_stats(tr->dst.addr.p.tbl,
10569 (s == NULL) ? pd->dst :
10570 &s->key[(s->direction == PF_IN)]->
10571 addr[(s->direction == PF_IN)],
10572 pd->af, pd->tot_len, dir == PF_OUT,
10573 r->action == PF_PASS, tr->dst.neg);
10574 }
10575 pf_counter_u64_critical_exit();
10576 }
10577 static void
pf_log_matches(struct pf_pdesc * pd,struct pf_krule * rm,struct pf_krule * am,struct pf_kruleset * ruleset,struct pf_krule_slist * matchrules)10578 pf_log_matches(struct pf_pdesc *pd, struct pf_krule *rm,
10579 struct pf_krule *am, struct pf_kruleset *ruleset,
10580 struct pf_krule_slist *matchrules)
10581 {
10582 struct pf_krule_item *ri;
10583
10584 /* if this is the log(matches) rule, packet has been logged already */
10585 if (rm->log & PF_LOG_MATCHES)
10586 return;
10587
10588 SLIST_FOREACH(ri, matchrules, entry)
10589 if (ri->r->log & PF_LOG_MATCHES)
10590 PFLOG_PACKET(rm->action, PFRES_MATCH, rm, am,
10591 ruleset, pd, 1, ri->r);
10592 }
10593
10594 #if defined(INET) || defined(INET6)
10595 int
pf_test(sa_family_t af,int dir,int pflags,struct ifnet * ifp,struct mbuf ** m0,struct inpcb * inp,struct pf_rule_actions * default_actions)10596 pf_test(sa_family_t af, int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
10597 struct inpcb *inp, struct pf_rule_actions *default_actions)
10598 {
10599 struct pfi_kkif *kif;
10600 u_short action, reason = 0;
10601 struct m_tag *mtag;
10602 struct pf_krule *a = NULL, *r = &V_pf_default_rule;
10603 struct pf_kstate *s = NULL;
10604 struct pf_kruleset *ruleset = NULL;
10605 struct pf_pdesc pd;
10606 int use_2nd_queue = 0;
10607 uint16_t tag;
10608
10609 PF_RULES_RLOCK_TRACKER;
10610 KASSERT(dir == PF_IN || dir == PF_OUT, ("%s: bad direction %d\n", __func__, dir));
10611 M_ASSERTPKTHDR(*m0);
10612 NET_EPOCH_ASSERT();
10613
10614 if (!V_pf_status.running)
10615 return (PF_PASS);
10616
10617 kif = (struct pfi_kkif *)ifp->if_pf_kif;
10618
10619 if (__predict_false(kif == NULL)) {
10620 DPFPRINTF(PF_DEBUG_URGENT,
10621 "%s: kif == NULL, if_xname %s",
10622 __func__, ifp->if_xname);
10623 return (PF_DROP);
10624 }
10625 if (kif->pfik_flags & PFI_IFLAG_SKIP) {
10626 return (PF_PASS);
10627 }
10628
10629 if ((*m0)->m_flags & M_SKIP_FIREWALL) {
10630 return (PF_PASS);
10631 }
10632
10633 if (__predict_false(! M_WRITABLE(*m0))) {
10634 *m0 = m_unshare(*m0, M_NOWAIT);
10635 if (*m0 == NULL) {
10636 return (PF_DROP);
10637 }
10638 }
10639
10640 pf_init_pdesc(&pd, *m0);
10641
10642 if (pd.pf_mtag != NULL && (pd.pf_mtag->flags & PF_MTAG_FLAG_ROUTE_TO)) {
10643 pd.pf_mtag->flags &= ~PF_MTAG_FLAG_ROUTE_TO;
10644
10645 ifp = ifnet_byindexgen(pd.pf_mtag->if_index,
10646 pd.pf_mtag->if_idxgen);
10647 if (ifp == NULL || ifp->if_flags & IFF_DYING) {
10648 m_freem(*m0);
10649 *m0 = NULL;
10650 return (PF_PASS);
10651 }
10652 (ifp->if_output)(ifp, *m0, sintosa(&pd.pf_mtag->dst), NULL);
10653 *m0 = NULL;
10654 return (PF_PASS);
10655 }
10656
10657 if (ip_dn_io_ptr != NULL && pd.pf_mtag != NULL &&
10658 pd.pf_mtag->flags & PF_MTAG_FLAG_DUMMYNET) {
10659 /* Dummynet re-injects packets after they've
10660 * completed their delay. We've already
10661 * processed them, so pass unconditionally. */
10662
10663 /* But only once. We may see the packet multiple times (e.g.
10664 * PFIL_IN/PFIL_OUT). */
10665 pf_dummynet_flag_remove(pd.m, pd.pf_mtag);
10666
10667 return (PF_PASS);
10668 }
10669
10670 PF_RULES_RLOCK();
10671
10672 if (pf_setup_pdesc(af, dir, &pd, m0, &action, &reason,
10673 kif, default_actions) == -1) {
10674 if (action != PF_PASS)
10675 pd.act.log |= PF_LOG_FORCE;
10676 goto done;
10677 }
10678
10679 #ifdef INET
10680 if (af == AF_INET && dir == PF_OUT && pflags & PFIL_FWD &&
10681 pd.df && (*m0)->m_pkthdr.len > ifp->if_mtu) {
10682 PF_RULES_RUNLOCK();
10683 icmp_error(*m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG,
10684 0, ifp->if_mtu);
10685 *m0 = NULL;
10686 return (PF_DROP);
10687 }
10688 #endif /* INET */
10689 #ifdef INET6
10690 /*
10691 * If we end up changing IP addresses (e.g. binat) the stack may get
10692 * confused and fail to send the icmp6 packet too big error. Just send
10693 * it here, before we do any NAT.
10694 */
10695 if (af == AF_INET6 && dir == PF_OUT && pflags & PFIL_FWD &&
10696 IN6_LINKMTU(ifp) < pf_max_frag_size(*m0)) {
10697 PF_RULES_RUNLOCK();
10698 icmp6_error(*m0, ICMP6_PACKET_TOO_BIG, 0, IN6_LINKMTU(ifp));
10699 *m0 = NULL;
10700 return (PF_DROP);
10701 }
10702 #endif /* INET6 */
10703
10704 if (__predict_false(ip_divert_ptr != NULL) &&
10705 ((mtag = m_tag_locate(pd.m, MTAG_PF_DIVERT, 0, NULL)) != NULL)) {
10706 struct pf_divert_mtag *dt = (struct pf_divert_mtag *)(mtag+1);
10707 if ((dt->idir == PF_DIVERT_MTAG_DIR_IN && dir == PF_IN) ||
10708 (dt->idir == PF_DIVERT_MTAG_DIR_OUT && dir == PF_OUT)) {
10709 if (pd.pf_mtag == NULL &&
10710 ((pd.pf_mtag = pf_get_mtag(pd.m)) == NULL)) {
10711 action = PF_DROP;
10712 goto done;
10713 }
10714 pd.pf_mtag->flags |= PF_MTAG_FLAG_PACKET_LOOPED;
10715 }
10716 if (pd.pf_mtag && pd.pf_mtag->flags & PF_MTAG_FLAG_FASTFWD_OURS_PRESENT) {
10717 pd.m->m_flags |= M_FASTFWD_OURS;
10718 pd.pf_mtag->flags &= ~PF_MTAG_FLAG_FASTFWD_OURS_PRESENT;
10719 }
10720 m_tag_delete(pd.m, mtag);
10721
10722 mtag = m_tag_locate(pd.m, MTAG_IPFW_RULE, 0, NULL);
10723 if (mtag != NULL)
10724 m_tag_delete(pd.m, mtag);
10725 }
10726
10727 switch (pd.virtual_proto) {
10728 case PF_VPROTO_FRAGMENT:
10729 /*
10730 * handle fragments that aren't reassembled by
10731 * normalization
10732 */
10733 if (kif == NULL || r == NULL) /* pflog */
10734 action = PF_DROP;
10735 else
10736 action = pf_test_rule(&r, &s, &pd, &a,
10737 &ruleset, &reason, inp);
10738 if (action != PF_PASS)
10739 REASON_SET(&reason, PFRES_FRAG);
10740 break;
10741
10742 case IPPROTO_TCP: {
10743 /* Respond to SYN with a syncookie. */
10744 if ((tcp_get_flags(&pd.hdr.tcp) & (TH_SYN|TH_ACK|TH_RST)) == TH_SYN &&
10745 pd.dir == PF_IN && pf_synflood_check(&pd)) {
10746 pf_syncookie_send(&pd);
10747 action = PF_DROP;
10748 break;
10749 }
10750
10751 if ((tcp_get_flags(&pd.hdr.tcp) & TH_ACK) && pd.p_len == 0)
10752 use_2nd_queue = 1;
10753 action = pf_normalize_tcp(&pd);
10754 if (action == PF_DROP)
10755 break;
10756 action = pf_test_state(&s, &pd, &reason);
10757 if (action == PF_PASS || action == PF_AFRT) {
10758 if (V_pfsync_update_state_ptr != NULL)
10759 V_pfsync_update_state_ptr(s);
10760 r = s->rule;
10761 a = s->anchor;
10762 } else if (s == NULL) {
10763 /* Validate remote SYN|ACK, re-create original SYN if
10764 * valid. */
10765 if ((tcp_get_flags(&pd.hdr.tcp) & (TH_SYN|TH_ACK|TH_RST)) ==
10766 TH_ACK && pf_syncookie_validate(&pd) &&
10767 pd.dir == PF_IN) {
10768 struct mbuf *msyn;
10769
10770 msyn = pf_syncookie_recreate_syn(&pd);
10771 if (msyn == NULL) {
10772 action = PF_DROP;
10773 break;
10774 }
10775
10776 action = pf_test(af, dir, pflags, ifp, &msyn, inp,
10777 &pd.act);
10778 m_freem(msyn);
10779 if (action != PF_PASS)
10780 break;
10781
10782 action = pf_test_state(&s, &pd, &reason);
10783 if (action != PF_PASS || s == NULL) {
10784 action = PF_DROP;
10785 break;
10786 }
10787
10788 s->src.seqhi = ntohl(pd.hdr.tcp.th_ack) - 1;
10789 s->src.seqlo = ntohl(pd.hdr.tcp.th_seq) - 1;
10790 pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_DST);
10791 action = pf_synproxy(&pd, s, &reason);
10792 break;
10793 } else {
10794 action = pf_test_rule(&r, &s, &pd,
10795 &a, &ruleset, &reason, inp);
10796 }
10797 }
10798 break;
10799 }
10800
10801 case IPPROTO_SCTP:
10802 action = pf_normalize_sctp(&pd);
10803 if (action == PF_DROP)
10804 break;
10805 /* fallthrough */
10806 case IPPROTO_UDP:
10807 default:
10808 action = pf_test_state(&s, &pd, &reason);
10809 if (action == PF_PASS || action == PF_AFRT) {
10810 if (V_pfsync_update_state_ptr != NULL)
10811 V_pfsync_update_state_ptr(s);
10812 r = s->rule;
10813 a = s->anchor;
10814 } else if (s == NULL) {
10815 action = pf_test_rule(&r, &s,
10816 &pd, &a, &ruleset, &reason, inp);
10817 }
10818 break;
10819
10820 case IPPROTO_ICMP:
10821 case IPPROTO_ICMPV6: {
10822 if (pd.virtual_proto == IPPROTO_ICMP && af != AF_INET) {
10823 action = PF_DROP;
10824 REASON_SET(&reason, PFRES_NORM);
10825 DPFPRINTF(PF_DEBUG_MISC,
10826 "dropping IPv6 packet with ICMPv4 payload");
10827 break;
10828 }
10829 if (pd.virtual_proto == IPPROTO_ICMPV6 && af != AF_INET6) {
10830 action = PF_DROP;
10831 REASON_SET(&reason, PFRES_NORM);
10832 DPFPRINTF(PF_DEBUG_MISC,
10833 "pf: dropping IPv4 packet with ICMPv6 payload");
10834 break;
10835 }
10836 action = pf_test_state_icmp(&s, &pd, &reason);
10837 if (action == PF_PASS || action == PF_AFRT) {
10838 if (V_pfsync_update_state_ptr != NULL)
10839 V_pfsync_update_state_ptr(s);
10840 r = s->rule;
10841 a = s->anchor;
10842 } else if (s == NULL)
10843 action = pf_test_rule(&r, &s, &pd,
10844 &a, &ruleset, &reason, inp);
10845 break;
10846 }
10847
10848 }
10849
10850 done:
10851 PF_RULES_RUNLOCK();
10852
10853 if (pd.m == NULL)
10854 goto eat_pkt;
10855
10856 if (s)
10857 memcpy(&pd.act, &s->act, sizeof(s->act));
10858
10859 if (action == PF_PASS && pd.badopts != 0 && !pd.act.allow_opts) {
10860 action = PF_DROP;
10861 REASON_SET(&reason, PFRES_IPOPTIONS);
10862 pd.act.log = PF_LOG_FORCE;
10863 DPFPRINTF(PF_DEBUG_MISC,
10864 "pf: dropping packet with dangerous headers");
10865 }
10866
10867 if (pd.act.max_pkt_size && pd.act.max_pkt_size &&
10868 pd.tot_len > pd.act.max_pkt_size) {
10869 action = PF_DROP;
10870 REASON_SET(&reason, PFRES_NORM);
10871 pd.act.log = PF_LOG_FORCE;
10872 DPFPRINTF(PF_DEBUG_MISC,
10873 "pf: dropping overly long packet");
10874 }
10875
10876 if (s) {
10877 uint8_t log = pd.act.log;
10878 memcpy(&pd.act, &s->act, sizeof(struct pf_rule_actions));
10879 pd.act.log |= log;
10880 tag = s->tag;
10881 } else {
10882 tag = r->tag;
10883 }
10884
10885 if (tag > 0 && pf_tag_packet(&pd, tag)) {
10886 action = PF_DROP;
10887 REASON_SET(&reason, PFRES_MEMORY);
10888 }
10889
10890 pf_scrub(&pd);
10891 if (pd.proto == IPPROTO_TCP && pd.act.max_mss)
10892 pf_normalize_mss(&pd);
10893
10894 if (pd.act.rtableid >= 0)
10895 M_SETFIB(pd.m, pd.act.rtableid);
10896
10897 if (pd.act.flags & PFSTATE_SETPRIO) {
10898 if (pd.tos & IPTOS_LOWDELAY)
10899 use_2nd_queue = 1;
10900 if (vlan_set_pcp(pd.m, pd.act.set_prio[use_2nd_queue])) {
10901 action = PF_DROP;
10902 REASON_SET(&reason, PFRES_MEMORY);
10903 pd.act.log = PF_LOG_FORCE;
10904 DPFPRINTF(PF_DEBUG_MISC,
10905 "pf: failed to allocate 802.1q mtag");
10906 }
10907 }
10908
10909 #ifdef ALTQ
10910 if (action == PF_PASS && pd.act.qid) {
10911 if (pd.pf_mtag == NULL &&
10912 ((pd.pf_mtag = pf_get_mtag(pd.m)) == NULL)) {
10913 action = PF_DROP;
10914 REASON_SET(&reason, PFRES_MEMORY);
10915 } else {
10916 if (s != NULL)
10917 pd.pf_mtag->qid_hash = pf_state_hash(s);
10918 if (use_2nd_queue || (pd.tos & IPTOS_LOWDELAY))
10919 pd.pf_mtag->qid = pd.act.pqid;
10920 else
10921 pd.pf_mtag->qid = pd.act.qid;
10922 /* Add hints for ecn. */
10923 pd.pf_mtag->hdr = mtod(pd.m, void *);
10924 }
10925 }
10926 #endif /* ALTQ */
10927
10928 /*
10929 * connections redirected to loopback should not match sockets
10930 * bound specifically to loopback due to security implications,
10931 * see tcp_input() and in_pcblookup_listen().
10932 */
10933 if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP ||
10934 pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule != NULL &&
10935 (s->nat_rule->action == PF_RDR ||
10936 s->nat_rule->action == PF_BINAT) &&
10937 pf_is_loopback(af, pd.dst))
10938 pd.m->m_flags |= M_SKIP_FIREWALL;
10939
10940 if (af == AF_INET && __predict_false(ip_divert_ptr != NULL) &&
10941 action == PF_PASS && r->divert.port && !PACKET_LOOPED(&pd)) {
10942 mtag = m_tag_alloc(MTAG_PF_DIVERT, 0,
10943 sizeof(struct pf_divert_mtag), M_NOWAIT | M_ZERO);
10944 if (mtag != NULL) {
10945 ((struct pf_divert_mtag *)(mtag+1))->port =
10946 ntohs(r->divert.port);
10947 ((struct pf_divert_mtag *)(mtag+1))->idir =
10948 (dir == PF_IN) ? PF_DIVERT_MTAG_DIR_IN :
10949 PF_DIVERT_MTAG_DIR_OUT;
10950
10951 if (s)
10952 PF_STATE_UNLOCK(s);
10953
10954 m_tag_prepend(pd.m, mtag);
10955 if (pd.m->m_flags & M_FASTFWD_OURS) {
10956 if (pd.pf_mtag == NULL &&
10957 ((pd.pf_mtag = pf_get_mtag(pd.m)) == NULL)) {
10958 action = PF_DROP;
10959 REASON_SET(&reason, PFRES_MEMORY);
10960 pd.act.log = PF_LOG_FORCE;
10961 DPFPRINTF(PF_DEBUG_MISC,
10962 "pf: failed to allocate tag");
10963 } else {
10964 pd.pf_mtag->flags |=
10965 PF_MTAG_FLAG_FASTFWD_OURS_PRESENT;
10966 pd.m->m_flags &= ~M_FASTFWD_OURS;
10967 }
10968 }
10969 ip_divert_ptr(*m0, dir == PF_IN);
10970 *m0 = NULL;
10971
10972 return (action);
10973 } else {
10974 /* XXX: ipfw has the same behaviour! */
10975 action = PF_DROP;
10976 REASON_SET(&reason, PFRES_MEMORY);
10977 pd.act.log = PF_LOG_FORCE;
10978 DPFPRINTF(PF_DEBUG_MISC,
10979 "pf: failed to allocate divert tag");
10980 }
10981 }
10982 /* XXX: Anybody working on it?! */
10983 if (af == AF_INET6 && r->divert.port)
10984 printf("pf: divert(9) is not supported for IPv6\n");
10985
10986 /* this flag will need revising if the pkt is forwarded */
10987 if (pd.pf_mtag)
10988 pd.pf_mtag->flags &= ~PF_MTAG_FLAG_PACKET_LOOPED;
10989
10990 if (pd.act.log) {
10991 struct pf_krule *lr;
10992 struct pf_krule_item *ri;
10993
10994 if (s != NULL && s->nat_rule != NULL &&
10995 s->nat_rule->log & PF_LOG_ALL)
10996 lr = s->nat_rule;
10997 else
10998 lr = r;
10999
11000 if (pd.act.log & PF_LOG_FORCE || lr->log & PF_LOG_ALL)
11001 PFLOG_PACKET(action, reason, lr, a,
11002 ruleset, &pd, (s == NULL), NULL);
11003 if (s) {
11004 SLIST_FOREACH(ri, &s->match_rules, entry)
11005 if (ri->r->log & PF_LOG_ALL)
11006 PFLOG_PACKET(action,
11007 reason, ri->r, a, ruleset, &pd, 0, NULL);
11008 }
11009 }
11010
11011 pf_counters_inc(action, &pd, s, r, a);
11012
11013 switch (action) {
11014 case PF_SYNPROXY_DROP:
11015 m_freem(*m0);
11016 case PF_DEFER:
11017 *m0 = NULL;
11018 action = PF_PASS;
11019 break;
11020 case PF_DROP:
11021 m_freem(*m0);
11022 *m0 = NULL;
11023 break;
11024 case PF_AFRT:
11025 if (pf_translate_af(&pd)) {
11026 *m0 = pd.m;
11027 action = PF_DROP;
11028 break;
11029 }
11030 #ifdef INET
11031 if (pd.naf == AF_INET)
11032 pf_route(r, kif->pfik_ifp, s, &pd, inp);
11033 #endif /* INET */
11034 #ifdef INET6
11035 if (pd.naf == AF_INET6)
11036 pf_route6(r, kif->pfik_ifp, s, &pd, inp);
11037 #endif /* INET6 */
11038 *m0 = pd.m;
11039 action = PF_PASS;
11040 goto out;
11041 break;
11042 default:
11043 if (pd.act.rt) {
11044 switch (af) {
11045 #ifdef INET
11046 case AF_INET:
11047 /* pf_route() returns unlocked. */
11048 pf_route(r, kif->pfik_ifp, s, &pd, inp);
11049 break;
11050 #endif /* INET */
11051 #ifdef INET6
11052 case AF_INET6:
11053 /* pf_route6() returns unlocked. */
11054 pf_route6(r, kif->pfik_ifp, s, &pd, inp);
11055 break;
11056 #endif /* INET6 */
11057 }
11058 *m0 = pd.m;
11059 goto out;
11060 }
11061 if (pf_dummynet(&pd, s, r, m0) != 0) {
11062 action = PF_DROP;
11063 REASON_SET(&reason, PFRES_MEMORY);
11064 }
11065 break;
11066 }
11067
11068 eat_pkt:
11069 SDT_PROBE4(pf, ip, test, done, action, reason, r, s);
11070
11071 if (s && action != PF_DROP) {
11072 if (!s->if_index_in && dir == PF_IN)
11073 s->if_index_in = ifp->if_index;
11074 else if (!s->if_index_out && dir == PF_OUT)
11075 s->if_index_out = ifp->if_index;
11076 }
11077
11078 if (s)
11079 PF_STATE_UNLOCK(s);
11080
11081 out:
11082 #ifdef INET6
11083 /* If reassembled packet passed, create new fragments. */
11084 if (af == AF_INET6 && action == PF_PASS && *m0 && dir == PF_OUT &&
11085 (! (pflags & PF_PFIL_NOREFRAGMENT)) &&
11086 (mtag = m_tag_find(pd.m, PACKET_TAG_PF_REASSEMBLED, NULL)) != NULL)
11087 action = pf_refragment6(ifp, m0, mtag, NULL, pflags & PFIL_FWD);
11088 #endif /* INET6 */
11089
11090 pf_sctp_multihome_delayed(&pd, kif, s, action);
11091
11092 return (action);
11093 }
11094 #endif /* INET || INET6 */
11095