1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2001 Daniel Hartmeier
5 * Copyright (c) 2002 - 2008 Henning Brauer
6 * Copyright (c) 2012 Gleb Smirnoff <glebius@FreeBSD.org>
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * - Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * - Redistributions in binary form must reproduce the above
16 * copyright notice, this list of conditions and the following
17 * disclaimer in the documentation and/or other materials provided
18 * with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31 * POSSIBILITY OF SUCH DAMAGE.
32 *
33 * Effort sponsored in part by the Defense Advanced Research Projects
34 * Agency (DARPA) and Air Force Research Laboratory, Air Force
35 * Materiel Command, USAF, under agreement number F30602-01-2-0537.
36 *
37 * $OpenBSD: pf.c,v 1.634 2009/02/27 12:37:45 henning Exp $
38 */
39
40 #include <sys/cdefs.h>
41 #include "opt_bpf.h"
42 #include "opt_inet.h"
43 #include "opt_inet6.h"
44 #include "opt_pf.h"
45 #include "opt_sctp.h"
46
47 #include <sys/param.h>
48 #include <sys/bus.h>
49 #include <sys/endian.h>
50 #include <sys/gsb_crc32.h>
51 #include <sys/hash.h>
52 #include <sys/interrupt.h>
53 #include <sys/kernel.h>
54 #include <sys/kthread.h>
55 #include <sys/limits.h>
56 #include <sys/mbuf.h>
57 #include <sys/md5.h>
58 #include <sys/random.h>
59 #include <sys/refcount.h>
60 #include <sys/sdt.h>
61 #include <sys/socket.h>
62 #include <sys/sysctl.h>
63 #include <sys/taskqueue.h>
64 #include <sys/ucred.h>
65
66 #include <net/if.h>
67 #include <net/if_var.h>
68 #include <net/if_private.h>
69 #include <net/if_types.h>
70 #include <net/if_vlan_var.h>
71 #include <net/route.h>
72 #include <net/route/nhop.h>
73 #include <net/vnet.h>
74
75 #include <net/pfil.h>
76 #include <net/pfvar.h>
77 #include <net/if_pflog.h>
78 #include <net/if_pfsync.h>
79
80 #include <netinet/in_pcb.h>
81 #include <netinet/in_var.h>
82 #include <netinet/in_fib.h>
83 #include <netinet/ip.h>
84 #include <netinet/ip_fw.h>
85 #include <netinet/ip_icmp.h>
86 #include <netinet/icmp_var.h>
87 #include <netinet/ip_var.h>
88 #include <netinet/tcp.h>
89 #include <netinet/tcp_fsm.h>
90 #include <netinet/tcp_seq.h>
91 #include <netinet/tcp_timer.h>
92 #include <netinet/tcp_var.h>
93 #include <netinet/udp.h>
94 #include <netinet/udp_var.h>
95
96 /* dummynet */
97 #include <netinet/ip_dummynet.h>
98 #include <netinet/ip_fw.h>
99 #include <netpfil/ipfw/dn_heap.h>
100 #include <netpfil/ipfw/ip_fw_private.h>
101 #include <netpfil/ipfw/ip_dn_private.h>
102
103 #ifdef INET6
104 #include <netinet/ip6.h>
105 #include <netinet/icmp6.h>
106 #include <netinet6/nd6.h>
107 #include <netinet6/ip6_var.h>
108 #include <netinet6/in6_pcb.h>
109 #include <netinet6/in6_fib.h>
110 #include <netinet6/scope6_var.h>
111 #endif /* INET6 */
112
113 #include <netinet/sctp_header.h>
114 #include <netinet/sctp_crc32.h>
115
116 #include <machine/in_cksum.h>
117 #include <security/mac/mac_framework.h>
118
119 #define DPFPRINTF(n, x) if (V_pf_status.debug >= (n)) printf x
120
121 SDT_PROVIDER_DEFINE(pf);
122 SDT_PROBE_DEFINE4(pf, ip, test, done, "int", "int", "struct pf_krule *",
123 "struct pf_kstate *");
124 SDT_PROBE_DEFINE5(pf, ip, state, lookup, "struct pfi_kkif *",
125 "struct pf_state_key_cmp *", "int", "struct pf_pdesc *",
126 "struct pf_kstate *");
127 SDT_PROBE_DEFINE2(pf, ip, , bound_iface, "struct pf_kstate *",
128 "struct pfi_kkif *");
129 SDT_PROBE_DEFINE4(pf, ip, route_to, entry, "struct mbuf *",
130 "struct pf_pdesc *", "struct pf_kstate *", "struct ifnet *");
131 SDT_PROBE_DEFINE1(pf, ip, route_to, drop, "int");
132 SDT_PROBE_DEFINE2(pf, ip, route_to, output, "struct ifnet *", "int");
133 SDT_PROBE_DEFINE4(pf, ip6, route_to, entry, "struct mbuf *",
134 "struct pf_pdesc *", "struct pf_kstate *", "struct ifnet *");
135 SDT_PROBE_DEFINE1(pf, ip6, route_to, drop, "int");
136 SDT_PROBE_DEFINE2(pf, ip6, route_to, output, "struct ifnet *", "int");
137 SDT_PROBE_DEFINE4(pf, sctp, multihome, test, "struct pfi_kkif *",
138 "struct pf_krule *", "struct mbuf *", "int");
139 SDT_PROBE_DEFINE2(pf, sctp, multihome, add, "uint32_t",
140 "struct pf_sctp_source *");
141 SDT_PROBE_DEFINE3(pf, sctp, multihome, remove, "uint32_t",
142 "struct pf_kstate *", "struct pf_sctp_source *");
143
144 SDT_PROBE_DEFINE3(pf, eth, test_rule, entry, "int", "struct ifnet *",
145 "struct mbuf *");
146 SDT_PROBE_DEFINE2(pf, eth, test_rule, test, "int", "struct pf_keth_rule *");
147 SDT_PROBE_DEFINE3(pf, eth, test_rule, mismatch,
148 "int", "struct pf_keth_rule *", "char *");
149 SDT_PROBE_DEFINE2(pf, eth, test_rule, match, "int", "struct pf_keth_rule *");
150 SDT_PROBE_DEFINE2(pf, eth, test_rule, final_match,
151 "int", "struct pf_keth_rule *");
152 SDT_PROBE_DEFINE2(pf, purge, state, rowcount, "int", "size_t");
153
154 /*
155 * Global variables
156 */
157
158 /* state tables */
159 VNET_DEFINE(struct pf_altqqueue, pf_altqs[4]);
160 VNET_DEFINE(struct pf_kpalist, pf_pabuf);
161 VNET_DEFINE(struct pf_altqqueue *, pf_altqs_active);
162 VNET_DEFINE(struct pf_altqqueue *, pf_altq_ifs_active);
163 VNET_DEFINE(struct pf_altqqueue *, pf_altqs_inactive);
164 VNET_DEFINE(struct pf_altqqueue *, pf_altq_ifs_inactive);
165 VNET_DEFINE(struct pf_kstatus, pf_status);
166
167 VNET_DEFINE(u_int32_t, ticket_altqs_active);
168 VNET_DEFINE(u_int32_t, ticket_altqs_inactive);
169 VNET_DEFINE(int, altqs_inactive_open);
170 VNET_DEFINE(u_int32_t, ticket_pabuf);
171
172 VNET_DEFINE(MD5_CTX, pf_tcp_secret_ctx);
173 #define V_pf_tcp_secret_ctx VNET(pf_tcp_secret_ctx)
174 VNET_DEFINE(u_char, pf_tcp_secret[16]);
175 #define V_pf_tcp_secret VNET(pf_tcp_secret)
176 VNET_DEFINE(int, pf_tcp_secret_init);
177 #define V_pf_tcp_secret_init VNET(pf_tcp_secret_init)
178 VNET_DEFINE(int, pf_tcp_iss_off);
179 #define V_pf_tcp_iss_off VNET(pf_tcp_iss_off)
180 VNET_DECLARE(int, pf_vnet_active);
181 #define V_pf_vnet_active VNET(pf_vnet_active)
182
183 VNET_DEFINE_STATIC(uint32_t, pf_purge_idx);
184 #define V_pf_purge_idx VNET(pf_purge_idx)
185
186 #ifdef PF_WANT_32_TO_64_COUNTER
187 VNET_DEFINE_STATIC(uint32_t, pf_counter_periodic_iter);
188 #define V_pf_counter_periodic_iter VNET(pf_counter_periodic_iter)
189
190 VNET_DEFINE(struct allrulelist_head, pf_allrulelist);
191 VNET_DEFINE(size_t, pf_allrulecount);
192 VNET_DEFINE(struct pf_krule *, pf_rulemarker);
193 #endif
194
195 struct pf_sctp_endpoint;
196 RB_HEAD(pf_sctp_endpoints, pf_sctp_endpoint);
197 struct pf_sctp_source {
198 sa_family_t af;
199 struct pf_addr addr;
200 TAILQ_ENTRY(pf_sctp_source) entry;
201 };
202 TAILQ_HEAD(pf_sctp_sources, pf_sctp_source);
203 struct pf_sctp_endpoint
204 {
205 uint32_t v_tag;
206 struct pf_sctp_sources sources;
207 RB_ENTRY(pf_sctp_endpoint) entry;
208 };
209 static int
pf_sctp_endpoint_compare(struct pf_sctp_endpoint * a,struct pf_sctp_endpoint * b)210 pf_sctp_endpoint_compare(struct pf_sctp_endpoint *a, struct pf_sctp_endpoint *b)
211 {
212 return (a->v_tag - b->v_tag);
213 }
214 RB_PROTOTYPE(pf_sctp_endpoints, pf_sctp_endpoint, entry, pf_sctp_endpoint_compare);
215 RB_GENERATE(pf_sctp_endpoints, pf_sctp_endpoint, entry, pf_sctp_endpoint_compare);
216 VNET_DEFINE_STATIC(struct pf_sctp_endpoints, pf_sctp_endpoints);
217 #define V_pf_sctp_endpoints VNET(pf_sctp_endpoints)
218 static struct mtx_padalign pf_sctp_endpoints_mtx;
219 MTX_SYSINIT(pf_sctp_endpoints_mtx, &pf_sctp_endpoints_mtx, "SCTP endpoints", MTX_DEF);
220 #define PF_SCTP_ENDPOINTS_LOCK() mtx_lock(&pf_sctp_endpoints_mtx)
221 #define PF_SCTP_ENDPOINTS_UNLOCK() mtx_unlock(&pf_sctp_endpoints_mtx)
222
223 /*
224 * Queue for pf_intr() sends.
225 */
226 static MALLOC_DEFINE(M_PFTEMP, "pf_temp", "pf(4) temporary allocations");
227 struct pf_send_entry {
228 STAILQ_ENTRY(pf_send_entry) pfse_next;
229 struct mbuf *pfse_m;
230 enum {
231 PFSE_IP,
232 PFSE_IP6,
233 PFSE_ICMP,
234 PFSE_ICMP6,
235 } pfse_type;
236 struct {
237 int type;
238 int code;
239 int mtu;
240 } icmpopts;
241 };
242
243 STAILQ_HEAD(pf_send_head, pf_send_entry);
244 VNET_DEFINE_STATIC(struct pf_send_head, pf_sendqueue);
245 #define V_pf_sendqueue VNET(pf_sendqueue)
246
247 static struct mtx_padalign pf_sendqueue_mtx;
248 MTX_SYSINIT(pf_sendqueue_mtx, &pf_sendqueue_mtx, "pf send queue", MTX_DEF);
249 #define PF_SENDQ_LOCK() mtx_lock(&pf_sendqueue_mtx)
250 #define PF_SENDQ_UNLOCK() mtx_unlock(&pf_sendqueue_mtx)
251
252 /*
253 * Queue for pf_overload_task() tasks.
254 */
255 struct pf_overload_entry {
256 SLIST_ENTRY(pf_overload_entry) next;
257 struct pf_addr addr;
258 sa_family_t af;
259 uint8_t dir;
260 struct pf_krule *rule;
261 };
262
263 SLIST_HEAD(pf_overload_head, pf_overload_entry);
264 VNET_DEFINE_STATIC(struct pf_overload_head, pf_overloadqueue);
265 #define V_pf_overloadqueue VNET(pf_overloadqueue)
266 VNET_DEFINE_STATIC(struct task, pf_overloadtask);
267 #define V_pf_overloadtask VNET(pf_overloadtask)
268
269 static struct mtx_padalign pf_overloadqueue_mtx;
270 MTX_SYSINIT(pf_overloadqueue_mtx, &pf_overloadqueue_mtx,
271 "pf overload/flush queue", MTX_DEF);
272 #define PF_OVERLOADQ_LOCK() mtx_lock(&pf_overloadqueue_mtx)
273 #define PF_OVERLOADQ_UNLOCK() mtx_unlock(&pf_overloadqueue_mtx)
274
275 VNET_DEFINE(struct pf_krulequeue, pf_unlinked_rules);
276 struct mtx_padalign pf_unlnkdrules_mtx;
277 MTX_SYSINIT(pf_unlnkdrules_mtx, &pf_unlnkdrules_mtx, "pf unlinked rules",
278 MTX_DEF);
279
280 struct sx pf_config_lock;
281 SX_SYSINIT(pf_config_lock, &pf_config_lock, "pf config");
282
283 struct mtx_padalign pf_table_stats_lock;
284 MTX_SYSINIT(pf_table_stats_lock, &pf_table_stats_lock, "pf table stats",
285 MTX_DEF);
286
287 VNET_DEFINE_STATIC(uma_zone_t, pf_sources_z);
288 #define V_pf_sources_z VNET(pf_sources_z)
289 uma_zone_t pf_mtag_z;
290 VNET_DEFINE(uma_zone_t, pf_state_z);
291 VNET_DEFINE(uma_zone_t, pf_state_key_z);
292 VNET_DEFINE(uma_zone_t, pf_udp_mapping_z);
293
294 VNET_DEFINE(struct unrhdr64, pf_stateid);
295
296 static void pf_src_tree_remove_state(struct pf_kstate *);
297 static void pf_init_threshold(struct pf_threshold *, u_int32_t,
298 u_int32_t);
299 static void pf_add_threshold(struct pf_threshold *);
300 static int pf_check_threshold(struct pf_threshold *);
301
302 static void pf_change_ap(struct mbuf *, struct pf_addr *, u_int16_t *,
303 u_int16_t *, u_int16_t *, struct pf_addr *,
304 u_int16_t, u_int8_t, sa_family_t);
305 static int pf_modulate_sack(struct pf_pdesc *,
306 struct tcphdr *, struct pf_state_peer *);
307 int pf_icmp_mapping(struct pf_pdesc *, u_int8_t, int *,
308 int *, u_int16_t *, u_int16_t *);
309 static void pf_change_icmp(struct pf_addr *, u_int16_t *,
310 struct pf_addr *, struct pf_addr *, u_int16_t,
311 u_int16_t *, u_int16_t *, u_int16_t *,
312 u_int16_t *, u_int8_t, sa_family_t);
313 static void pf_send_icmp(struct mbuf *, u_int8_t, u_int8_t,
314 sa_family_t, struct pf_krule *, int);
315 static void pf_detach_state(struct pf_kstate *);
316 static int pf_state_key_attach(struct pf_state_key *,
317 struct pf_state_key *, struct pf_kstate *);
318 static void pf_state_key_detach(struct pf_kstate *, int);
319 static int pf_state_key_ctor(void *, int, void *, int);
320 static u_int32_t pf_tcp_iss(struct pf_pdesc *);
321 static __inline void pf_dummynet_flag_remove(struct mbuf *m,
322 struct pf_mtag *pf_mtag);
323 static int pf_dummynet(struct pf_pdesc *, struct pf_kstate *,
324 struct pf_krule *, struct mbuf **);
325 static int pf_dummynet_route(struct pf_pdesc *,
326 struct pf_kstate *, struct pf_krule *,
327 struct ifnet *, struct sockaddr *, struct mbuf **);
328 static int pf_test_eth_rule(int, struct pfi_kkif *,
329 struct mbuf **);
330 static int pf_test_rule(struct pf_krule **, struct pf_kstate **,
331 struct pf_pdesc *, struct pf_krule **,
332 struct pf_kruleset **, struct inpcb *);
333 static int pf_create_state(struct pf_krule *, struct pf_krule *,
334 struct pf_krule *, struct pf_pdesc *,
335 struct pf_state_key *, struct pf_state_key *,
336 u_int16_t, u_int16_t, int *,
337 struct pf_kstate **, int, u_int16_t, u_int16_t,
338 struct pf_krule_slist *, struct pf_udp_mapping *);
339 static int pf_state_key_addr_setup(struct pf_pdesc *,
340 struct pf_state_key_cmp *, int);
341 static int pf_tcp_track_full(struct pf_kstate **,
342 struct pf_pdesc *, u_short *, int *);
343 static int pf_tcp_track_sloppy(struct pf_kstate **,
344 struct pf_pdesc *, u_short *);
345 static int pf_test_state_tcp(struct pf_kstate **,
346 struct pf_pdesc *, u_short *);
347 static int pf_test_state_udp(struct pf_kstate **,
348 struct pf_pdesc *);
349 int pf_icmp_state_lookup(struct pf_state_key_cmp *,
350 struct pf_pdesc *, struct pf_kstate **,
351 int, u_int16_t, u_int16_t,
352 int, int *, int, int);
353 static int pf_test_state_icmp(struct pf_kstate **,
354 struct pf_pdesc *, u_short *);
355 static void pf_sctp_multihome_detach_addr(const struct pf_kstate *);
356 static void pf_sctp_multihome_delayed(struct pf_pdesc *,
357 struct pfi_kkif *, struct pf_kstate *, int);
358 static int pf_test_state_sctp(struct pf_kstate **,
359 struct pf_pdesc *, u_short *);
360 static int pf_test_state_other(struct pf_kstate **,
361 struct pf_pdesc *);
362 static u_int16_t pf_calc_mss(struct pf_addr *, sa_family_t,
363 int, u_int16_t);
364 static int pf_check_proto_cksum(struct mbuf *, int, int,
365 u_int8_t, sa_family_t);
366 static int pf_walk_option6(struct mbuf *, int, int, uint32_t *,
367 u_short *);
368 static void pf_print_state_parts(struct pf_kstate *,
369 struct pf_state_key *, struct pf_state_key *);
370 static void pf_patch_8(struct mbuf *, u_int16_t *, u_int8_t *, u_int8_t,
371 bool, u_int8_t);
372 static struct pf_kstate *pf_find_state(struct pfi_kkif *,
373 const struct pf_state_key_cmp *, u_int);
374 static bool pf_src_connlimit(struct pf_kstate *);
375 static int pf_match_rcvif(struct mbuf *, struct pf_krule *);
376 static void pf_counters_inc(int, struct pf_pdesc *,
377 struct pf_kstate *, struct pf_krule *,
378 struct pf_krule *);
379 static void pf_overload_task(void *v, int pending);
380 static u_short pf_insert_src_node(struct pf_ksrc_node **,
381 struct pf_srchash **, struct pf_krule *,
382 struct pf_addr *, sa_family_t, struct pf_addr *,
383 struct pfi_kkif *);
384 static u_int pf_purge_expired_states(u_int, int);
385 static void pf_purge_unlinked_rules(void);
386 static int pf_mtag_uminit(void *, int, int);
387 static void pf_mtag_free(struct m_tag *);
388 static void pf_packet_rework_nat(struct mbuf *, struct pf_pdesc *,
389 int, struct pf_state_key *);
390 #ifdef INET
391 static void pf_route(struct mbuf **, struct pf_krule *,
392 struct ifnet *, struct pf_kstate *,
393 struct pf_pdesc *, struct inpcb *);
394 #endif /* INET */
395 #ifdef INET6
396 static void pf_change_a6(struct pf_addr *, u_int16_t *,
397 struct pf_addr *, u_int8_t);
398 static void pf_route6(struct mbuf **, struct pf_krule *,
399 struct ifnet *, struct pf_kstate *,
400 struct pf_pdesc *, struct inpcb *);
401 #endif /* INET6 */
402 static __inline void pf_set_protostate(struct pf_kstate *, int, u_int8_t);
403
404 int in4_cksum(struct mbuf *m, u_int8_t nxt, int off, int len);
405
406 extern int pf_end_threads;
407 extern struct proc *pf_purge_proc;
408
409 VNET_DEFINE(struct pf_limit, pf_limits[PF_LIMIT_MAX]);
410
411 enum { PF_ICMP_MULTI_NONE, PF_ICMP_MULTI_LINK };
412
413 #define PACKET_UNDO_NAT(_m, _pd, _off, _s) \
414 do { \
415 struct pf_state_key *nk; \
416 if ((pd->dir) == PF_OUT) \
417 nk = (_s)->key[PF_SK_STACK]; \
418 else \
419 nk = (_s)->key[PF_SK_WIRE]; \
420 pf_packet_rework_nat(_m, _pd, _off, nk); \
421 } while (0)
422
423 #define PACKET_LOOPED(pd) ((pd)->pf_mtag && \
424 (pd)->pf_mtag->flags & PF_MTAG_FLAG_PACKET_LOOPED)
425
426 #define STATE_LOOKUP(k, s, pd) \
427 do { \
428 (s) = pf_find_state((pd->kif), (k), (pd->dir)); \
429 SDT_PROBE5(pf, ip, state, lookup, pd->kif, k, (pd->dir), pd, (s)); \
430 if ((s) == NULL) \
431 return (PF_DROP); \
432 if (PACKET_LOOPED(pd)) \
433 return (PF_PASS); \
434 } while (0)
435
436 static struct pfi_kkif *
BOUND_IFACE(struct pf_kstate * st,struct pfi_kkif * k)437 BOUND_IFACE(struct pf_kstate *st, struct pfi_kkif *k)
438 {
439 SDT_PROBE2(pf, ip, , bound_iface, st, k);
440
441 /* Floating unless otherwise specified. */
442 if (! (st->rule->rule_flag & PFRULE_IFBOUND))
443 return (V_pfi_all);
444
445 /*
446 * Initially set to all, because we don't know what interface we'll be
447 * sending this out when we create the state.
448 */
449 if (st->rule->rt == PF_REPLYTO)
450 return (V_pfi_all);
451
452 /* Don't overrule the interface for states created on incoming packets. */
453 if (st->direction == PF_IN)
454 return (k);
455
456 /* No route-to, so don't overrule. */
457 if (st->act.rt != PF_ROUTETO)
458 return (k);
459
460 /* Bind to the route-to interface. */
461 return (st->act.rt_kif);
462 }
463
464 #define STATE_INC_COUNTERS(s) \
465 do { \
466 struct pf_krule_item *mrm; \
467 counter_u64_add(s->rule->states_cur, 1); \
468 counter_u64_add(s->rule->states_tot, 1); \
469 if (s->anchor != NULL) { \
470 counter_u64_add(s->anchor->states_cur, 1); \
471 counter_u64_add(s->anchor->states_tot, 1); \
472 } \
473 if (s->nat_rule != NULL) { \
474 counter_u64_add(s->nat_rule->states_cur, 1);\
475 counter_u64_add(s->nat_rule->states_tot, 1);\
476 } \
477 SLIST_FOREACH(mrm, &s->match_rules, entry) { \
478 counter_u64_add(mrm->r->states_cur, 1); \
479 counter_u64_add(mrm->r->states_tot, 1); \
480 } \
481 } while (0)
482
483 #define STATE_DEC_COUNTERS(s) \
484 do { \
485 struct pf_krule_item *mrm; \
486 if (s->nat_rule != NULL) \
487 counter_u64_add(s->nat_rule->states_cur, -1);\
488 if (s->anchor != NULL) \
489 counter_u64_add(s->anchor->states_cur, -1); \
490 counter_u64_add(s->rule->states_cur, -1); \
491 SLIST_FOREACH(mrm, &s->match_rules, entry) \
492 counter_u64_add(mrm->r->states_cur, -1); \
493 } while (0)
494
495 MALLOC_DEFINE(M_PFHASH, "pf_hash", "pf(4) hash header structures");
496 MALLOC_DEFINE(M_PF_RULE_ITEM, "pf_krule_item", "pf(4) rule items");
497 VNET_DEFINE(struct pf_keyhash *, pf_keyhash);
498 VNET_DEFINE(struct pf_idhash *, pf_idhash);
499 VNET_DEFINE(struct pf_srchash *, pf_srchash);
500 VNET_DEFINE(struct pf_udpendpointhash *, pf_udpendpointhash);
501 VNET_DEFINE(struct pf_udpendpointmapping *, pf_udpendpointmapping);
502
503 SYSCTL_NODE(_net, OID_AUTO, pf, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
504 "pf(4)");
505
506 VNET_DEFINE(u_long, pf_hashmask);
507 VNET_DEFINE(u_long, pf_srchashmask);
508 VNET_DEFINE(u_long, pf_udpendpointhashmask);
509 VNET_DEFINE_STATIC(u_long, pf_hashsize);
510 #define V_pf_hashsize VNET(pf_hashsize)
511 VNET_DEFINE_STATIC(u_long, pf_srchashsize);
512 #define V_pf_srchashsize VNET(pf_srchashsize)
513 VNET_DEFINE_STATIC(u_long, pf_udpendpointhashsize);
514 #define V_pf_udpendpointhashsize VNET(pf_udpendpointhashsize)
515 u_long pf_ioctl_maxcount = 65535;
516
517 SYSCTL_ULONG(_net_pf, OID_AUTO, states_hashsize, CTLFLAG_VNET | CTLFLAG_RDTUN,
518 &VNET_NAME(pf_hashsize), 0, "Size of pf(4) states hashtable");
519 SYSCTL_ULONG(_net_pf, OID_AUTO, source_nodes_hashsize, CTLFLAG_VNET | CTLFLAG_RDTUN,
520 &VNET_NAME(pf_srchashsize), 0, "Size of pf(4) source nodes hashtable");
521 SYSCTL_ULONG(_net_pf, OID_AUTO, udpendpoint_hashsize, CTLFLAG_VNET | CTLFLAG_RDTUN,
522 &VNET_NAME(pf_udpendpointhashsize), 0, "Size of pf(4) endpoint hashtable");
523 SYSCTL_ULONG(_net_pf, OID_AUTO, request_maxcount, CTLFLAG_RWTUN,
524 &pf_ioctl_maxcount, 0, "Maximum number of tables, addresses, ... in a single ioctl() call");
525
526 VNET_DEFINE(void *, pf_swi_cookie);
527 VNET_DEFINE(struct intr_event *, pf_swi_ie);
528
529 VNET_DEFINE(uint32_t, pf_hashseed);
530 #define V_pf_hashseed VNET(pf_hashseed)
531
532 static void
pf_sctp_checksum(struct mbuf * m,int off)533 pf_sctp_checksum(struct mbuf *m, int off)
534 {
535 uint32_t sum = 0;
536
537 /* Zero out the checksum, to enable recalculation. */
538 m_copyback(m, off + offsetof(struct sctphdr, checksum),
539 sizeof(sum), (caddr_t)&sum);
540
541 sum = sctp_calculate_cksum(m, off);
542
543 m_copyback(m, off + offsetof(struct sctphdr, checksum),
544 sizeof(sum), (caddr_t)&sum);
545 }
546
547 int
pf_addr_cmp(struct pf_addr * a,struct pf_addr * b,sa_family_t af)548 pf_addr_cmp(struct pf_addr *a, struct pf_addr *b, sa_family_t af)
549 {
550
551 switch (af) {
552 #ifdef INET
553 case AF_INET:
554 if (a->addr32[0] > b->addr32[0])
555 return (1);
556 if (a->addr32[0] < b->addr32[0])
557 return (-1);
558 break;
559 #endif /* INET */
560 #ifdef INET6
561 case AF_INET6:
562 if (a->addr32[3] > b->addr32[3])
563 return (1);
564 if (a->addr32[3] < b->addr32[3])
565 return (-1);
566 if (a->addr32[2] > b->addr32[2])
567 return (1);
568 if (a->addr32[2] < b->addr32[2])
569 return (-1);
570 if (a->addr32[1] > b->addr32[1])
571 return (1);
572 if (a->addr32[1] < b->addr32[1])
573 return (-1);
574 if (a->addr32[0] > b->addr32[0])
575 return (1);
576 if (a->addr32[0] < b->addr32[0])
577 return (-1);
578 break;
579 #endif /* INET6 */
580 }
581 return (0);
582 }
583
584 static bool
pf_is_loopback(sa_family_t af,struct pf_addr * addr)585 pf_is_loopback(sa_family_t af, struct pf_addr *addr)
586 {
587 switch (af) {
588 #ifdef INET
589 case AF_INET:
590 return IN_LOOPBACK(ntohl(addr->v4.s_addr));
591 #endif
592 case AF_INET6:
593 return IN6_IS_ADDR_LOOPBACK(&addr->v6);
594 default:
595 panic("Unknown af %d", af);
596 }
597 }
598
599 static void
pf_packet_rework_nat(struct mbuf * m,struct pf_pdesc * pd,int off,struct pf_state_key * nk)600 pf_packet_rework_nat(struct mbuf *m, struct pf_pdesc *pd, int off,
601 struct pf_state_key *nk)
602 {
603
604 switch (pd->proto) {
605 case IPPROTO_TCP: {
606 struct tcphdr *th = &pd->hdr.tcp;
607
608 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af))
609 pf_change_ap(m, pd->src, &th->th_sport, pd->ip_sum,
610 &th->th_sum, &nk->addr[pd->sidx],
611 nk->port[pd->sidx], 0, pd->af);
612 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af))
613 pf_change_ap(m, pd->dst, &th->th_dport, pd->ip_sum,
614 &th->th_sum, &nk->addr[pd->didx],
615 nk->port[pd->didx], 0, pd->af);
616 m_copyback(m, off, sizeof(*th), (caddr_t)th);
617 break;
618 }
619 case IPPROTO_UDP: {
620 struct udphdr *uh = &pd->hdr.udp;
621
622 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af))
623 pf_change_ap(m, pd->src, &uh->uh_sport, pd->ip_sum,
624 &uh->uh_sum, &nk->addr[pd->sidx],
625 nk->port[pd->sidx], 1, pd->af);
626 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af))
627 pf_change_ap(m, pd->dst, &uh->uh_dport, pd->ip_sum,
628 &uh->uh_sum, &nk->addr[pd->didx],
629 nk->port[pd->didx], 1, pd->af);
630 m_copyback(m, off, sizeof(*uh), (caddr_t)uh);
631 break;
632 }
633 case IPPROTO_SCTP: {
634 struct sctphdr *sh = &pd->hdr.sctp;
635 uint16_t checksum = 0;
636
637 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af)) {
638 pf_change_ap(m, pd->src, &sh->src_port, pd->ip_sum,
639 &checksum, &nk->addr[pd->sidx],
640 nk->port[pd->sidx], 1, pd->af);
641 }
642 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af)) {
643 pf_change_ap(m, pd->dst, &sh->dest_port, pd->ip_sum,
644 &checksum, &nk->addr[pd->didx],
645 nk->port[pd->didx], 1, pd->af);
646 }
647
648 break;
649 }
650 case IPPROTO_ICMP: {
651 struct icmp *ih = &pd->hdr.icmp;
652
653 if (nk->port[pd->sidx] != ih->icmp_id) {
654 pd->hdr.icmp.icmp_cksum = pf_cksum_fixup(
655 ih->icmp_cksum, ih->icmp_id,
656 nk->port[pd->sidx], 0);
657 ih->icmp_id = nk->port[pd->sidx];
658 pd->sport = &ih->icmp_id;
659
660 m_copyback(m, off, ICMP_MINLEN, (caddr_t)ih);
661 }
662 /* FALLTHROUGH */
663 }
664 default:
665 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af)) {
666 switch (pd->af) {
667 case AF_INET:
668 pf_change_a(&pd->src->v4.s_addr,
669 pd->ip_sum, nk->addr[pd->sidx].v4.s_addr,
670 0);
671 break;
672 case AF_INET6:
673 PF_ACPY(pd->src, &nk->addr[pd->sidx], pd->af);
674 break;
675 }
676 }
677 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af)) {
678 switch (pd->af) {
679 case AF_INET:
680 pf_change_a(&pd->dst->v4.s_addr,
681 pd->ip_sum, nk->addr[pd->didx].v4.s_addr,
682 0);
683 break;
684 case AF_INET6:
685 PF_ACPY(pd->dst, &nk->addr[pd->didx], pd->af);
686 break;
687 }
688 }
689 break;
690 }
691 }
692
693 static __inline uint32_t
pf_hashkey(const struct pf_state_key * sk)694 pf_hashkey(const struct pf_state_key *sk)
695 {
696 uint32_t h;
697
698 h = murmur3_32_hash32((const uint32_t *)sk,
699 sizeof(struct pf_state_key_cmp)/sizeof(uint32_t),
700 V_pf_hashseed);
701
702 return (h & V_pf_hashmask);
703 }
704
705 __inline uint32_t
pf_hashsrc(struct pf_addr * addr,sa_family_t af)706 pf_hashsrc(struct pf_addr *addr, sa_family_t af)
707 {
708 uint32_t h;
709
710 switch (af) {
711 case AF_INET:
712 h = murmur3_32_hash32((uint32_t *)&addr->v4,
713 sizeof(addr->v4)/sizeof(uint32_t), V_pf_hashseed);
714 break;
715 case AF_INET6:
716 h = murmur3_32_hash32((uint32_t *)&addr->v6,
717 sizeof(addr->v6)/sizeof(uint32_t), V_pf_hashseed);
718 break;
719 }
720
721 return (h & V_pf_srchashmask);
722 }
723
724 static inline uint32_t
pf_hashudpendpoint(struct pf_udp_endpoint * endpoint)725 pf_hashudpendpoint(struct pf_udp_endpoint *endpoint)
726 {
727 uint32_t h;
728
729 h = murmur3_32_hash32((uint32_t *)endpoint,
730 sizeof(struct pf_udp_endpoint_cmp)/sizeof(uint32_t),
731 V_pf_hashseed);
732 return (h & V_pf_udpendpointhashmask);
733 }
734
735 #ifdef ALTQ
736 static int
pf_state_hash(struct pf_kstate * s)737 pf_state_hash(struct pf_kstate *s)
738 {
739 u_int32_t hv = (intptr_t)s / sizeof(*s);
740
741 hv ^= crc32(&s->src, sizeof(s->src));
742 hv ^= crc32(&s->dst, sizeof(s->dst));
743 if (hv == 0)
744 hv = 1;
745 return (hv);
746 }
747 #endif
748
749 static __inline void
pf_set_protostate(struct pf_kstate * s,int which,u_int8_t newstate)750 pf_set_protostate(struct pf_kstate *s, int which, u_int8_t newstate)
751 {
752 if (which == PF_PEER_DST || which == PF_PEER_BOTH)
753 s->dst.state = newstate;
754 if (which == PF_PEER_DST)
755 return;
756 if (s->src.state == newstate)
757 return;
758 if (s->creatorid == V_pf_status.hostid &&
759 s->key[PF_SK_STACK] != NULL &&
760 s->key[PF_SK_STACK]->proto == IPPROTO_TCP &&
761 !(TCPS_HAVEESTABLISHED(s->src.state) ||
762 s->src.state == TCPS_CLOSED) &&
763 (TCPS_HAVEESTABLISHED(newstate) || newstate == TCPS_CLOSED))
764 atomic_add_32(&V_pf_status.states_halfopen, -1);
765
766 s->src.state = newstate;
767 }
768
769 #ifdef INET6
770 void
pf_addrcpy(struct pf_addr * dst,struct pf_addr * src,sa_family_t af)771 pf_addrcpy(struct pf_addr *dst, struct pf_addr *src, sa_family_t af)
772 {
773 switch (af) {
774 #ifdef INET
775 case AF_INET:
776 memcpy(&dst->v4, &src->v4, sizeof(dst->v4));
777 break;
778 #endif /* INET */
779 case AF_INET6:
780 memcpy(&dst->v6, &src->v6, sizeof(dst->v6));
781 break;
782 }
783 }
784 #endif /* INET6 */
785
786 static void
pf_init_threshold(struct pf_threshold * threshold,u_int32_t limit,u_int32_t seconds)787 pf_init_threshold(struct pf_threshold *threshold,
788 u_int32_t limit, u_int32_t seconds)
789 {
790 threshold->limit = limit * PF_THRESHOLD_MULT;
791 threshold->seconds = seconds;
792 threshold->count = 0;
793 threshold->last = time_uptime;
794 }
795
796 static void
pf_add_threshold(struct pf_threshold * threshold)797 pf_add_threshold(struct pf_threshold *threshold)
798 {
799 u_int32_t t = time_uptime, diff = t - threshold->last;
800
801 if (diff >= threshold->seconds)
802 threshold->count = 0;
803 else
804 threshold->count -= threshold->count * diff /
805 threshold->seconds;
806 threshold->count += PF_THRESHOLD_MULT;
807 threshold->last = t;
808 }
809
810 static int
pf_check_threshold(struct pf_threshold * threshold)811 pf_check_threshold(struct pf_threshold *threshold)
812 {
813 return (threshold->count > threshold->limit);
814 }
815
816 static bool
pf_src_connlimit(struct pf_kstate * state)817 pf_src_connlimit(struct pf_kstate *state)
818 {
819 struct pf_overload_entry *pfoe;
820 bool limited = false;
821
822 PF_STATE_LOCK_ASSERT(state);
823 PF_SRC_NODE_LOCK(state->src_node);
824
825 state->src_node->conn++;
826 state->src.tcp_est = 1;
827 pf_add_threshold(&state->src_node->conn_rate);
828
829 if (state->rule->max_src_conn &&
830 state->rule->max_src_conn <
831 state->src_node->conn) {
832 counter_u64_add(V_pf_status.lcounters[LCNT_SRCCONN], 1);
833 limited = true;
834 }
835
836 if (state->rule->max_src_conn_rate.limit &&
837 pf_check_threshold(&state->src_node->conn_rate)) {
838 counter_u64_add(V_pf_status.lcounters[LCNT_SRCCONNRATE], 1);
839 limited = true;
840 }
841
842 if (!limited)
843 goto done;
844
845 /* Kill this state. */
846 state->timeout = PFTM_PURGE;
847 pf_set_protostate(state, PF_PEER_BOTH, TCPS_CLOSED);
848
849 if (state->rule->overload_tbl == NULL)
850 goto done;
851
852 /* Schedule overloading and flushing task. */
853 pfoe = malloc(sizeof(*pfoe), M_PFTEMP, M_NOWAIT);
854 if (pfoe == NULL)
855 goto done; /* too bad :( */
856
857 bcopy(&state->src_node->addr, &pfoe->addr, sizeof(pfoe->addr));
858 pfoe->af = state->key[PF_SK_WIRE]->af;
859 pfoe->rule = state->rule;
860 pfoe->dir = state->direction;
861 PF_OVERLOADQ_LOCK();
862 SLIST_INSERT_HEAD(&V_pf_overloadqueue, pfoe, next);
863 PF_OVERLOADQ_UNLOCK();
864 taskqueue_enqueue(taskqueue_swi, &V_pf_overloadtask);
865
866 done:
867 PF_SRC_NODE_UNLOCK(state->src_node);
868 return (limited);
869 }
870
871 static void
pf_overload_task(void * v,int pending)872 pf_overload_task(void *v, int pending)
873 {
874 struct pf_overload_head queue;
875 struct pfr_addr p;
876 struct pf_overload_entry *pfoe, *pfoe1;
877 uint32_t killed = 0;
878
879 CURVNET_SET((struct vnet *)v);
880
881 PF_OVERLOADQ_LOCK();
882 queue = V_pf_overloadqueue;
883 SLIST_INIT(&V_pf_overloadqueue);
884 PF_OVERLOADQ_UNLOCK();
885
886 bzero(&p, sizeof(p));
887 SLIST_FOREACH(pfoe, &queue, next) {
888 counter_u64_add(V_pf_status.lcounters[LCNT_OVERLOAD_TABLE], 1);
889 if (V_pf_status.debug >= PF_DEBUG_MISC) {
890 printf("%s: blocking address ", __func__);
891 pf_print_host(&pfoe->addr, 0, pfoe->af);
892 printf("\n");
893 }
894
895 p.pfra_af = pfoe->af;
896 switch (pfoe->af) {
897 #ifdef INET
898 case AF_INET:
899 p.pfra_net = 32;
900 p.pfra_ip4addr = pfoe->addr.v4;
901 break;
902 #endif
903 #ifdef INET6
904 case AF_INET6:
905 p.pfra_net = 128;
906 p.pfra_ip6addr = pfoe->addr.v6;
907 break;
908 #endif
909 }
910
911 PF_RULES_WLOCK();
912 pfr_insert_kentry(pfoe->rule->overload_tbl, &p, time_second);
913 PF_RULES_WUNLOCK();
914 }
915
916 /*
917 * Remove those entries, that don't need flushing.
918 */
919 SLIST_FOREACH_SAFE(pfoe, &queue, next, pfoe1)
920 if (pfoe->rule->flush == 0) {
921 SLIST_REMOVE(&queue, pfoe, pf_overload_entry, next);
922 free(pfoe, M_PFTEMP);
923 } else
924 counter_u64_add(
925 V_pf_status.lcounters[LCNT_OVERLOAD_FLUSH], 1);
926
927 /* If nothing to flush, return. */
928 if (SLIST_EMPTY(&queue)) {
929 CURVNET_RESTORE();
930 return;
931 }
932
933 for (int i = 0; i <= V_pf_hashmask; i++) {
934 struct pf_idhash *ih = &V_pf_idhash[i];
935 struct pf_state_key *sk;
936 struct pf_kstate *s;
937
938 PF_HASHROW_LOCK(ih);
939 LIST_FOREACH(s, &ih->states, entry) {
940 sk = s->key[PF_SK_WIRE];
941 SLIST_FOREACH(pfoe, &queue, next)
942 if (sk->af == pfoe->af &&
943 ((pfoe->rule->flush & PF_FLUSH_GLOBAL) ||
944 pfoe->rule == s->rule) &&
945 ((pfoe->dir == PF_OUT &&
946 PF_AEQ(&pfoe->addr, &sk->addr[1], sk->af)) ||
947 (pfoe->dir == PF_IN &&
948 PF_AEQ(&pfoe->addr, &sk->addr[0], sk->af)))) {
949 s->timeout = PFTM_PURGE;
950 pf_set_protostate(s, PF_PEER_BOTH, TCPS_CLOSED);
951 killed++;
952 }
953 }
954 PF_HASHROW_UNLOCK(ih);
955 }
956 SLIST_FOREACH_SAFE(pfoe, &queue, next, pfoe1)
957 free(pfoe, M_PFTEMP);
958 if (V_pf_status.debug >= PF_DEBUG_MISC)
959 printf("%s: %u states killed", __func__, killed);
960
961 CURVNET_RESTORE();
962 }
963
964 /*
965 * On node found always returns locked. On not found its configurable.
966 */
967 struct pf_ksrc_node *
pf_find_src_node(struct pf_addr * src,struct pf_krule * rule,sa_family_t af,struct pf_srchash ** sh,bool returnlocked)968 pf_find_src_node(struct pf_addr *src, struct pf_krule *rule, sa_family_t af,
969 struct pf_srchash **sh, bool returnlocked)
970 {
971 struct pf_ksrc_node *n;
972
973 counter_u64_add(V_pf_status.scounters[SCNT_SRC_NODE_SEARCH], 1);
974
975 *sh = &V_pf_srchash[pf_hashsrc(src, af)];
976 PF_HASHROW_LOCK(*sh);
977 LIST_FOREACH(n, &(*sh)->nodes, entry)
978 if (n->rule == rule && n->af == af &&
979 ((af == AF_INET && n->addr.v4.s_addr == src->v4.s_addr) ||
980 (af == AF_INET6 && bcmp(&n->addr, src, sizeof(*src)) == 0)))
981 break;
982
983 if (n == NULL && !returnlocked)
984 PF_HASHROW_UNLOCK(*sh);
985
986 return (n);
987 }
988
989 bool
pf_src_node_exists(struct pf_ksrc_node ** sn,struct pf_srchash * sh)990 pf_src_node_exists(struct pf_ksrc_node **sn, struct pf_srchash *sh)
991 {
992 struct pf_ksrc_node *cur;
993
994 if ((*sn) == NULL)
995 return (false);
996
997 KASSERT(sh != NULL, ("%s: sh is NULL", __func__));
998
999 counter_u64_add(V_pf_status.scounters[SCNT_SRC_NODE_SEARCH], 1);
1000 PF_HASHROW_LOCK(sh);
1001 LIST_FOREACH(cur, &(sh->nodes), entry) {
1002 if (cur == (*sn) &&
1003 cur->expire != 1) /* Ignore nodes being killed */
1004 return (true);
1005 }
1006 PF_HASHROW_UNLOCK(sh);
1007 (*sn) = NULL;
1008 return (false);
1009 }
1010
1011 static void
pf_free_src_node(struct pf_ksrc_node * sn)1012 pf_free_src_node(struct pf_ksrc_node *sn)
1013 {
1014
1015 for (int i = 0; i < 2; i++) {
1016 counter_u64_free(sn->bytes[i]);
1017 counter_u64_free(sn->packets[i]);
1018 }
1019 uma_zfree(V_pf_sources_z, sn);
1020 }
1021
1022 static u_short
pf_insert_src_node(struct pf_ksrc_node ** sn,struct pf_srchash ** sh,struct pf_krule * rule,struct pf_addr * src,sa_family_t af,struct pf_addr * raddr,struct pfi_kkif * rkif)1023 pf_insert_src_node(struct pf_ksrc_node **sn, struct pf_srchash **sh,
1024 struct pf_krule *rule, struct pf_addr *src, sa_family_t af,
1025 struct pf_addr *raddr, struct pfi_kkif *rkif)
1026 {
1027 u_short reason = 0;
1028
1029 KASSERT((rule->rule_flag & PFRULE_SRCTRACK ||
1030 rule->rpool.opts & PF_POOL_STICKYADDR),
1031 ("%s for non-tracking rule %p", __func__, rule));
1032
1033 /*
1034 * Request the sh to always be locked, as we might insert a new sn.
1035 */
1036 if (*sn == NULL)
1037 *sn = pf_find_src_node(src, rule, af, sh, true);
1038
1039 if (*sn == NULL) {
1040 PF_HASHROW_ASSERT(*sh);
1041
1042 if (rule->max_src_nodes &&
1043 counter_u64_fetch(rule->src_nodes) >= rule->max_src_nodes) {
1044 counter_u64_add(V_pf_status.lcounters[LCNT_SRCNODES], 1);
1045 reason = PFRES_SRCLIMIT;
1046 goto done;
1047 }
1048
1049 (*sn) = uma_zalloc(V_pf_sources_z, M_NOWAIT | M_ZERO);
1050 if ((*sn) == NULL) {
1051 reason = PFRES_MEMORY;
1052 goto done;
1053 }
1054
1055 for (int i = 0; i < 2; i++) {
1056 (*sn)->bytes[i] = counter_u64_alloc(M_NOWAIT);
1057 (*sn)->packets[i] = counter_u64_alloc(M_NOWAIT);
1058
1059 if ((*sn)->bytes[i] == NULL || (*sn)->packets[i] == NULL) {
1060 pf_free_src_node(*sn);
1061 reason = PFRES_MEMORY;
1062 goto done;
1063 }
1064 }
1065
1066 pf_init_threshold(&(*sn)->conn_rate,
1067 rule->max_src_conn_rate.limit,
1068 rule->max_src_conn_rate.seconds);
1069
1070 MPASS((*sn)->lock == NULL);
1071 (*sn)->lock = &(*sh)->lock;
1072
1073 (*sn)->af = af;
1074 (*sn)->rule = rule;
1075 PF_ACPY(&(*sn)->addr, src, af);
1076 PF_ACPY(&(*sn)->raddr, raddr, af);
1077 (*sn)->rkif = rkif;
1078 LIST_INSERT_HEAD(&(*sh)->nodes, *sn, entry);
1079 (*sn)->creation = time_uptime;
1080 (*sn)->ruletype = rule->action;
1081 if ((*sn)->rule != NULL)
1082 counter_u64_add((*sn)->rule->src_nodes, 1);
1083 counter_u64_add(V_pf_status.scounters[SCNT_SRC_NODE_INSERT], 1);
1084 } else {
1085 if (rule->max_src_states &&
1086 (*sn)->states >= rule->max_src_states) {
1087 counter_u64_add(V_pf_status.lcounters[LCNT_SRCSTATES],
1088 1);
1089 reason = PFRES_SRCLIMIT;
1090 goto done;
1091 }
1092 }
1093 done:
1094 if (reason == 0)
1095 (*sn)->states++;
1096 else
1097 (*sn) = NULL;
1098
1099 PF_HASHROW_UNLOCK(*sh);
1100 return (reason);
1101 }
1102
1103 void
pf_unlink_src_node(struct pf_ksrc_node * src)1104 pf_unlink_src_node(struct pf_ksrc_node *src)
1105 {
1106 PF_SRC_NODE_LOCK_ASSERT(src);
1107
1108 LIST_REMOVE(src, entry);
1109 if (src->rule)
1110 counter_u64_add(src->rule->src_nodes, -1);
1111 }
1112
1113 u_int
pf_free_src_nodes(struct pf_ksrc_node_list * head)1114 pf_free_src_nodes(struct pf_ksrc_node_list *head)
1115 {
1116 struct pf_ksrc_node *sn, *tmp;
1117 u_int count = 0;
1118
1119 LIST_FOREACH_SAFE(sn, head, entry, tmp) {
1120 pf_free_src_node(sn);
1121 count++;
1122 }
1123
1124 counter_u64_add(V_pf_status.scounters[SCNT_SRC_NODE_REMOVALS], count);
1125
1126 return (count);
1127 }
1128
1129 void
pf_mtag_initialize(void)1130 pf_mtag_initialize(void)
1131 {
1132
1133 pf_mtag_z = uma_zcreate("pf mtags", sizeof(struct m_tag) +
1134 sizeof(struct pf_mtag), NULL, NULL, pf_mtag_uminit, NULL,
1135 UMA_ALIGN_PTR, 0);
1136 }
1137
1138 /* Per-vnet data storage structures initialization. */
1139 void
pf_initialize(void)1140 pf_initialize(void)
1141 {
1142 struct pf_keyhash *kh;
1143 struct pf_idhash *ih;
1144 struct pf_srchash *sh;
1145 struct pf_udpendpointhash *uh;
1146 u_int i;
1147
1148 if (V_pf_hashsize == 0 || !powerof2(V_pf_hashsize))
1149 V_pf_hashsize = PF_HASHSIZ;
1150 if (V_pf_srchashsize == 0 || !powerof2(V_pf_srchashsize))
1151 V_pf_srchashsize = PF_SRCHASHSIZ;
1152 if (V_pf_udpendpointhashsize == 0 || !powerof2(V_pf_udpendpointhashsize))
1153 V_pf_udpendpointhashsize = PF_UDPENDHASHSIZ;
1154
1155 V_pf_hashseed = arc4random();
1156
1157 /* States and state keys storage. */
1158 V_pf_state_z = uma_zcreate("pf states", sizeof(struct pf_kstate),
1159 NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
1160 V_pf_limits[PF_LIMIT_STATES].zone = V_pf_state_z;
1161 uma_zone_set_max(V_pf_state_z, PFSTATE_HIWAT);
1162 uma_zone_set_warning(V_pf_state_z, "PF states limit reached");
1163
1164 V_pf_state_key_z = uma_zcreate("pf state keys",
1165 sizeof(struct pf_state_key), pf_state_key_ctor, NULL, NULL, NULL,
1166 UMA_ALIGN_PTR, 0);
1167
1168 V_pf_keyhash = mallocarray(V_pf_hashsize, sizeof(struct pf_keyhash),
1169 M_PFHASH, M_NOWAIT | M_ZERO);
1170 V_pf_idhash = mallocarray(V_pf_hashsize, sizeof(struct pf_idhash),
1171 M_PFHASH, M_NOWAIT | M_ZERO);
1172 if (V_pf_keyhash == NULL || V_pf_idhash == NULL) {
1173 printf("pf: Unable to allocate memory for "
1174 "state_hashsize %lu.\n", V_pf_hashsize);
1175
1176 free(V_pf_keyhash, M_PFHASH);
1177 free(V_pf_idhash, M_PFHASH);
1178
1179 V_pf_hashsize = PF_HASHSIZ;
1180 V_pf_keyhash = mallocarray(V_pf_hashsize,
1181 sizeof(struct pf_keyhash), M_PFHASH, M_WAITOK | M_ZERO);
1182 V_pf_idhash = mallocarray(V_pf_hashsize,
1183 sizeof(struct pf_idhash), M_PFHASH, M_WAITOK | M_ZERO);
1184 }
1185
1186 V_pf_hashmask = V_pf_hashsize - 1;
1187 for (i = 0, kh = V_pf_keyhash, ih = V_pf_idhash; i <= V_pf_hashmask;
1188 i++, kh++, ih++) {
1189 mtx_init(&kh->lock, "pf_keyhash", NULL, MTX_DEF | MTX_DUPOK);
1190 mtx_init(&ih->lock, "pf_idhash", NULL, MTX_DEF);
1191 }
1192
1193 /* Source nodes. */
1194 V_pf_sources_z = uma_zcreate("pf source nodes",
1195 sizeof(struct pf_ksrc_node), NULL, NULL, NULL, NULL, UMA_ALIGN_PTR,
1196 0);
1197 V_pf_limits[PF_LIMIT_SRC_NODES].zone = V_pf_sources_z;
1198 uma_zone_set_max(V_pf_sources_z, PFSNODE_HIWAT);
1199 uma_zone_set_warning(V_pf_sources_z, "PF source nodes limit reached");
1200
1201 V_pf_srchash = mallocarray(V_pf_srchashsize,
1202 sizeof(struct pf_srchash), M_PFHASH, M_NOWAIT | M_ZERO);
1203 if (V_pf_srchash == NULL) {
1204 printf("pf: Unable to allocate memory for "
1205 "source_hashsize %lu.\n", V_pf_srchashsize);
1206
1207 V_pf_srchashsize = PF_SRCHASHSIZ;
1208 V_pf_srchash = mallocarray(V_pf_srchashsize,
1209 sizeof(struct pf_srchash), M_PFHASH, M_WAITOK | M_ZERO);
1210 }
1211
1212 V_pf_srchashmask = V_pf_srchashsize - 1;
1213 for (i = 0, sh = V_pf_srchash; i <= V_pf_srchashmask; i++, sh++)
1214 mtx_init(&sh->lock, "pf_srchash", NULL, MTX_DEF);
1215
1216
1217 /* UDP endpoint mappings. */
1218 V_pf_udp_mapping_z = uma_zcreate("pf UDP mappings",
1219 sizeof(struct pf_udp_mapping), NULL, NULL, NULL, NULL,
1220 UMA_ALIGN_PTR, 0);
1221 V_pf_udpendpointhash = mallocarray(V_pf_udpendpointhashsize,
1222 sizeof(struct pf_udpendpointhash), M_PFHASH, M_NOWAIT | M_ZERO);
1223 if (V_pf_udpendpointhash == NULL) {
1224 printf("pf: Unable to allocate memory for "
1225 "udpendpoint_hashsize %lu.\n", V_pf_udpendpointhashsize);
1226
1227 V_pf_udpendpointhashsize = PF_UDPENDHASHSIZ;
1228 V_pf_udpendpointhash = mallocarray(V_pf_udpendpointhashsize,
1229 sizeof(struct pf_udpendpointhash), M_PFHASH, M_WAITOK | M_ZERO);
1230 }
1231
1232 V_pf_udpendpointhashmask = V_pf_udpendpointhashsize - 1;
1233 for (i = 0, uh = V_pf_udpendpointhash;
1234 i <= V_pf_udpendpointhashmask;
1235 i++, uh++) {
1236 mtx_init(&uh->lock, "pf_udpendpointhash", NULL,
1237 MTX_DEF | MTX_DUPOK);
1238 }
1239
1240 /* ALTQ */
1241 TAILQ_INIT(&V_pf_altqs[0]);
1242 TAILQ_INIT(&V_pf_altqs[1]);
1243 TAILQ_INIT(&V_pf_altqs[2]);
1244 TAILQ_INIT(&V_pf_altqs[3]);
1245 TAILQ_INIT(&V_pf_pabuf);
1246 V_pf_altqs_active = &V_pf_altqs[0];
1247 V_pf_altq_ifs_active = &V_pf_altqs[1];
1248 V_pf_altqs_inactive = &V_pf_altqs[2];
1249 V_pf_altq_ifs_inactive = &V_pf_altqs[3];
1250
1251 /* Send & overload+flush queues. */
1252 STAILQ_INIT(&V_pf_sendqueue);
1253 SLIST_INIT(&V_pf_overloadqueue);
1254 TASK_INIT(&V_pf_overloadtask, 0, pf_overload_task, curvnet);
1255
1256 /* Unlinked, but may be referenced rules. */
1257 TAILQ_INIT(&V_pf_unlinked_rules);
1258 }
1259
1260 void
pf_mtag_cleanup(void)1261 pf_mtag_cleanup(void)
1262 {
1263
1264 uma_zdestroy(pf_mtag_z);
1265 }
1266
1267 void
pf_cleanup(void)1268 pf_cleanup(void)
1269 {
1270 struct pf_keyhash *kh;
1271 struct pf_idhash *ih;
1272 struct pf_srchash *sh;
1273 struct pf_udpendpointhash *uh;
1274 struct pf_send_entry *pfse, *next;
1275 u_int i;
1276
1277 for (i = 0, kh = V_pf_keyhash, ih = V_pf_idhash;
1278 i <= V_pf_hashmask;
1279 i++, kh++, ih++) {
1280 KASSERT(LIST_EMPTY(&kh->keys), ("%s: key hash not empty",
1281 __func__));
1282 KASSERT(LIST_EMPTY(&ih->states), ("%s: id hash not empty",
1283 __func__));
1284 mtx_destroy(&kh->lock);
1285 mtx_destroy(&ih->lock);
1286 }
1287 free(V_pf_keyhash, M_PFHASH);
1288 free(V_pf_idhash, M_PFHASH);
1289
1290 for (i = 0, sh = V_pf_srchash; i <= V_pf_srchashmask; i++, sh++) {
1291 KASSERT(LIST_EMPTY(&sh->nodes),
1292 ("%s: source node hash not empty", __func__));
1293 mtx_destroy(&sh->lock);
1294 }
1295 free(V_pf_srchash, M_PFHASH);
1296
1297 for (i = 0, uh = V_pf_udpendpointhash;
1298 i <= V_pf_udpendpointhashmask;
1299 i++, uh++) {
1300 KASSERT(LIST_EMPTY(&uh->endpoints),
1301 ("%s: udp endpoint hash not empty", __func__));
1302 mtx_destroy(&uh->lock);
1303 }
1304 free(V_pf_udpendpointhash, M_PFHASH);
1305
1306 STAILQ_FOREACH_SAFE(pfse, &V_pf_sendqueue, pfse_next, next) {
1307 m_freem(pfse->pfse_m);
1308 free(pfse, M_PFTEMP);
1309 }
1310 MPASS(RB_EMPTY(&V_pf_sctp_endpoints));
1311
1312 uma_zdestroy(V_pf_sources_z);
1313 uma_zdestroy(V_pf_state_z);
1314 uma_zdestroy(V_pf_state_key_z);
1315 uma_zdestroy(V_pf_udp_mapping_z);
1316 }
1317
1318 static int
pf_mtag_uminit(void * mem,int size,int how)1319 pf_mtag_uminit(void *mem, int size, int how)
1320 {
1321 struct m_tag *t;
1322
1323 t = (struct m_tag *)mem;
1324 t->m_tag_cookie = MTAG_ABI_COMPAT;
1325 t->m_tag_id = PACKET_TAG_PF;
1326 t->m_tag_len = sizeof(struct pf_mtag);
1327 t->m_tag_free = pf_mtag_free;
1328
1329 return (0);
1330 }
1331
1332 static void
pf_mtag_free(struct m_tag * t)1333 pf_mtag_free(struct m_tag *t)
1334 {
1335
1336 uma_zfree(pf_mtag_z, t);
1337 }
1338
1339 struct pf_mtag *
pf_get_mtag(struct mbuf * m)1340 pf_get_mtag(struct mbuf *m)
1341 {
1342 struct m_tag *mtag;
1343
1344 if ((mtag = m_tag_find(m, PACKET_TAG_PF, NULL)) != NULL)
1345 return ((struct pf_mtag *)(mtag + 1));
1346
1347 mtag = uma_zalloc(pf_mtag_z, M_NOWAIT);
1348 if (mtag == NULL)
1349 return (NULL);
1350 bzero(mtag + 1, sizeof(struct pf_mtag));
1351 m_tag_prepend(m, mtag);
1352
1353 return ((struct pf_mtag *)(mtag + 1));
1354 }
1355
1356 static int
pf_state_key_attach(struct pf_state_key * skw,struct pf_state_key * sks,struct pf_kstate * s)1357 pf_state_key_attach(struct pf_state_key *skw, struct pf_state_key *sks,
1358 struct pf_kstate *s)
1359 {
1360 struct pf_keyhash *khs, *khw, *kh;
1361 struct pf_state_key *sk, *cur;
1362 struct pf_kstate *si, *olds = NULL;
1363 int idx;
1364
1365 NET_EPOCH_ASSERT();
1366 KASSERT(s->refs == 0, ("%s: state not pristine", __func__));
1367 KASSERT(s->key[PF_SK_WIRE] == NULL, ("%s: state has key", __func__));
1368 KASSERT(s->key[PF_SK_STACK] == NULL, ("%s: state has key", __func__));
1369
1370 /*
1371 * We need to lock hash slots of both keys. To avoid deadlock
1372 * we always lock the slot with lower address first. Unlock order
1373 * isn't important.
1374 *
1375 * We also need to lock ID hash slot before dropping key
1376 * locks. On success we return with ID hash slot locked.
1377 */
1378
1379 if (skw == sks) {
1380 khs = khw = &V_pf_keyhash[pf_hashkey(skw)];
1381 PF_HASHROW_LOCK(khs);
1382 } else {
1383 khs = &V_pf_keyhash[pf_hashkey(sks)];
1384 khw = &V_pf_keyhash[pf_hashkey(skw)];
1385 if (khs == khw) {
1386 PF_HASHROW_LOCK(khs);
1387 } else if (khs < khw) {
1388 PF_HASHROW_LOCK(khs);
1389 PF_HASHROW_LOCK(khw);
1390 } else {
1391 PF_HASHROW_LOCK(khw);
1392 PF_HASHROW_LOCK(khs);
1393 }
1394 }
1395
1396 #define KEYS_UNLOCK() do { \
1397 if (khs != khw) { \
1398 PF_HASHROW_UNLOCK(khs); \
1399 PF_HASHROW_UNLOCK(khw); \
1400 } else \
1401 PF_HASHROW_UNLOCK(khs); \
1402 } while (0)
1403
1404 /*
1405 * First run: start with wire key.
1406 */
1407 sk = skw;
1408 kh = khw;
1409 idx = PF_SK_WIRE;
1410
1411 MPASS(s->lock == NULL);
1412 s->lock = &V_pf_idhash[PF_IDHASH(s)].lock;
1413
1414 keyattach:
1415 LIST_FOREACH(cur, &kh->keys, entry)
1416 if (bcmp(cur, sk, sizeof(struct pf_state_key_cmp)) == 0)
1417 break;
1418
1419 if (cur != NULL) {
1420 /* Key exists. Check for same kif, if none, add to key. */
1421 TAILQ_FOREACH(si, &cur->states[idx], key_list[idx]) {
1422 struct pf_idhash *ih = &V_pf_idhash[PF_IDHASH(si)];
1423
1424 PF_HASHROW_LOCK(ih);
1425 if (si->kif == s->kif &&
1426 si->direction == s->direction) {
1427 if (sk->proto == IPPROTO_TCP &&
1428 si->src.state >= TCPS_FIN_WAIT_2 &&
1429 si->dst.state >= TCPS_FIN_WAIT_2) {
1430 /*
1431 * New state matches an old >FIN_WAIT_2
1432 * state. We can't drop key hash locks,
1433 * thus we can't unlink it properly.
1434 *
1435 * As a workaround we drop it into
1436 * TCPS_CLOSED state, schedule purge
1437 * ASAP and push it into the very end
1438 * of the slot TAILQ, so that it won't
1439 * conflict with our new state.
1440 */
1441 pf_set_protostate(si, PF_PEER_BOTH,
1442 TCPS_CLOSED);
1443 si->timeout = PFTM_PURGE;
1444 olds = si;
1445 } else {
1446 if (V_pf_status.debug >= PF_DEBUG_MISC) {
1447 printf("pf: %s key attach "
1448 "failed on %s: ",
1449 (idx == PF_SK_WIRE) ?
1450 "wire" : "stack",
1451 s->kif->pfik_name);
1452 pf_print_state_parts(s,
1453 (idx == PF_SK_WIRE) ?
1454 sk : NULL,
1455 (idx == PF_SK_STACK) ?
1456 sk : NULL);
1457 printf(", existing: ");
1458 pf_print_state_parts(si,
1459 (idx == PF_SK_WIRE) ?
1460 sk : NULL,
1461 (idx == PF_SK_STACK) ?
1462 sk : NULL);
1463 printf("\n");
1464 }
1465 s->timeout = PFTM_UNLINKED;
1466 PF_HASHROW_UNLOCK(ih);
1467 KEYS_UNLOCK();
1468 uma_zfree(V_pf_state_key_z, skw);
1469 if (skw != sks)
1470 uma_zfree(V_pf_state_key_z, sks);
1471 if (idx == PF_SK_STACK)
1472 pf_detach_state(s);
1473 return (EEXIST); /* collision! */
1474 }
1475 }
1476 PF_HASHROW_UNLOCK(ih);
1477 }
1478 uma_zfree(V_pf_state_key_z, sk);
1479 s->key[idx] = cur;
1480 } else {
1481 LIST_INSERT_HEAD(&kh->keys, sk, entry);
1482 s->key[idx] = sk;
1483 }
1484
1485 stateattach:
1486 /* List is sorted, if-bound states before floating. */
1487 if (s->kif == V_pfi_all)
1488 TAILQ_INSERT_TAIL(&s->key[idx]->states[idx], s, key_list[idx]);
1489 else
1490 TAILQ_INSERT_HEAD(&s->key[idx]->states[idx], s, key_list[idx]);
1491
1492 if (olds) {
1493 TAILQ_REMOVE(&s->key[idx]->states[idx], olds, key_list[idx]);
1494 TAILQ_INSERT_TAIL(&s->key[idx]->states[idx], olds,
1495 key_list[idx]);
1496 olds = NULL;
1497 }
1498
1499 /*
1500 * Attach done. See how should we (or should not?)
1501 * attach a second key.
1502 */
1503 if (sks == skw) {
1504 s->key[PF_SK_STACK] = s->key[PF_SK_WIRE];
1505 idx = PF_SK_STACK;
1506 sks = NULL;
1507 goto stateattach;
1508 } else if (sks != NULL) {
1509 /*
1510 * Continue attaching with stack key.
1511 */
1512 sk = sks;
1513 kh = khs;
1514 idx = PF_SK_STACK;
1515 sks = NULL;
1516 goto keyattach;
1517 }
1518
1519 PF_STATE_LOCK(s);
1520 KEYS_UNLOCK();
1521
1522 KASSERT(s->key[PF_SK_WIRE] != NULL && s->key[PF_SK_STACK] != NULL,
1523 ("%s failure", __func__));
1524
1525 return (0);
1526 #undef KEYS_UNLOCK
1527 }
1528
1529 static void
pf_detach_state(struct pf_kstate * s)1530 pf_detach_state(struct pf_kstate *s)
1531 {
1532 struct pf_state_key *sks = s->key[PF_SK_STACK];
1533 struct pf_keyhash *kh;
1534
1535 NET_EPOCH_ASSERT();
1536 MPASS(s->timeout >= PFTM_MAX);
1537
1538 pf_sctp_multihome_detach_addr(s);
1539
1540 if ((s->state_flags & PFSTATE_PFLOW) && V_pflow_export_state_ptr)
1541 V_pflow_export_state_ptr(s);
1542
1543 if (sks != NULL) {
1544 kh = &V_pf_keyhash[pf_hashkey(sks)];
1545 PF_HASHROW_LOCK(kh);
1546 if (s->key[PF_SK_STACK] != NULL)
1547 pf_state_key_detach(s, PF_SK_STACK);
1548 /*
1549 * If both point to same key, then we are done.
1550 */
1551 if (sks == s->key[PF_SK_WIRE]) {
1552 pf_state_key_detach(s, PF_SK_WIRE);
1553 PF_HASHROW_UNLOCK(kh);
1554 return;
1555 }
1556 PF_HASHROW_UNLOCK(kh);
1557 }
1558
1559 if (s->key[PF_SK_WIRE] != NULL) {
1560 kh = &V_pf_keyhash[pf_hashkey(s->key[PF_SK_WIRE])];
1561 PF_HASHROW_LOCK(kh);
1562 if (s->key[PF_SK_WIRE] != NULL)
1563 pf_state_key_detach(s, PF_SK_WIRE);
1564 PF_HASHROW_UNLOCK(kh);
1565 }
1566 }
1567
1568 static void
pf_state_key_detach(struct pf_kstate * s,int idx)1569 pf_state_key_detach(struct pf_kstate *s, int idx)
1570 {
1571 struct pf_state_key *sk = s->key[idx];
1572 #ifdef INVARIANTS
1573 struct pf_keyhash *kh = &V_pf_keyhash[pf_hashkey(sk)];
1574
1575 PF_HASHROW_ASSERT(kh);
1576 #endif
1577 TAILQ_REMOVE(&sk->states[idx], s, key_list[idx]);
1578 s->key[idx] = NULL;
1579
1580 if (TAILQ_EMPTY(&sk->states[0]) && TAILQ_EMPTY(&sk->states[1])) {
1581 LIST_REMOVE(sk, entry);
1582 uma_zfree(V_pf_state_key_z, sk);
1583 }
1584 }
1585
1586 static int
pf_state_key_ctor(void * mem,int size,void * arg,int flags)1587 pf_state_key_ctor(void *mem, int size, void *arg, int flags)
1588 {
1589 struct pf_state_key *sk = mem;
1590
1591 bzero(sk, sizeof(struct pf_state_key_cmp));
1592 TAILQ_INIT(&sk->states[PF_SK_WIRE]);
1593 TAILQ_INIT(&sk->states[PF_SK_STACK]);
1594
1595 return (0);
1596 }
1597
1598 static int
pf_state_key_addr_setup(struct pf_pdesc * pd,struct pf_state_key_cmp * key,int multi)1599 pf_state_key_addr_setup(struct pf_pdesc *pd,
1600 struct pf_state_key_cmp *key, int multi)
1601 {
1602 struct pf_addr *saddr = pd->src;
1603 struct pf_addr *daddr = pd->dst;
1604 #ifdef INET6
1605 struct nd_neighbor_solicit nd;
1606 struct pf_addr *target;
1607 u_short action, reason;
1608
1609 if (pd->af == AF_INET || pd->proto != IPPROTO_ICMPV6)
1610 goto copy;
1611
1612 switch (pd->hdr.icmp6.icmp6_type) {
1613 case ND_NEIGHBOR_SOLICIT:
1614 if (multi)
1615 return (-1);
1616 if (!pf_pull_hdr(pd->m, pd->off, &nd, sizeof(nd), &action, &reason, pd->af))
1617 return (-1);
1618 target = (struct pf_addr *)&nd.nd_ns_target;
1619 daddr = target;
1620 break;
1621 case ND_NEIGHBOR_ADVERT:
1622 if (multi)
1623 return (-1);
1624 if (!pf_pull_hdr(pd->m, pd->off, &nd, sizeof(nd), &action, &reason, pd->af))
1625 return (-1);
1626 target = (struct pf_addr *)&nd.nd_ns_target;
1627 saddr = target;
1628 if (IN6_IS_ADDR_MULTICAST(&pd->dst->v6)) {
1629 key->addr[pd->didx].addr32[0] = 0;
1630 key->addr[pd->didx].addr32[1] = 0;
1631 key->addr[pd->didx].addr32[2] = 0;
1632 key->addr[pd->didx].addr32[3] = 0;
1633 daddr = NULL; /* overwritten */
1634 }
1635 break;
1636 default:
1637 if (multi == PF_ICMP_MULTI_LINK) {
1638 key->addr[pd->sidx].addr32[0] = IPV6_ADDR_INT32_MLL;
1639 key->addr[pd->sidx].addr32[1] = 0;
1640 key->addr[pd->sidx].addr32[2] = 0;
1641 key->addr[pd->sidx].addr32[3] = IPV6_ADDR_INT32_ONE;
1642 saddr = NULL; /* overwritten */
1643 }
1644 }
1645 copy:
1646 #endif
1647 if (saddr)
1648 PF_ACPY(&key->addr[pd->sidx], saddr, pd->af);
1649 if (daddr)
1650 PF_ACPY(&key->addr[pd->didx], daddr, pd->af);
1651
1652 return (0);
1653 }
1654
1655 struct pf_state_key *
pf_state_key_setup(struct pf_pdesc * pd,struct pf_addr * saddr,struct pf_addr * daddr,u_int16_t sport,u_int16_t dport)1656 pf_state_key_setup(struct pf_pdesc *pd,
1657 struct pf_addr *saddr, struct pf_addr *daddr, u_int16_t sport,
1658 u_int16_t dport)
1659 {
1660 struct pf_state_key *sk;
1661
1662 sk = uma_zalloc(V_pf_state_key_z, M_NOWAIT);
1663 if (sk == NULL)
1664 return (NULL);
1665
1666 if (pf_state_key_addr_setup(pd, (struct pf_state_key_cmp *)sk,
1667 0)) {
1668 uma_zfree(V_pf_state_key_z, sk);
1669 return (NULL);
1670 }
1671
1672 sk->port[pd->sidx] = sport;
1673 sk->port[pd->didx] = dport;
1674 sk->proto = pd->proto;
1675 sk->af = pd->af;
1676
1677 return (sk);
1678 }
1679
1680 struct pf_state_key *
pf_state_key_clone(const struct pf_state_key * orig)1681 pf_state_key_clone(const struct pf_state_key *orig)
1682 {
1683 struct pf_state_key *sk;
1684
1685 sk = uma_zalloc(V_pf_state_key_z, M_NOWAIT);
1686 if (sk == NULL)
1687 return (NULL);
1688
1689 bcopy(orig, sk, sizeof(struct pf_state_key_cmp));
1690
1691 return (sk);
1692 }
1693
1694 int
pf_state_insert(struct pfi_kkif * kif,struct pfi_kkif * orig_kif,struct pf_state_key * skw,struct pf_state_key * sks,struct pf_kstate * s)1695 pf_state_insert(struct pfi_kkif *kif, struct pfi_kkif *orig_kif,
1696 struct pf_state_key *skw, struct pf_state_key *sks, struct pf_kstate *s)
1697 {
1698 struct pf_idhash *ih;
1699 struct pf_kstate *cur;
1700 int error;
1701
1702 NET_EPOCH_ASSERT();
1703
1704 KASSERT(TAILQ_EMPTY(&sks->states[0]) && TAILQ_EMPTY(&sks->states[1]),
1705 ("%s: sks not pristine", __func__));
1706 KASSERT(TAILQ_EMPTY(&skw->states[0]) && TAILQ_EMPTY(&skw->states[1]),
1707 ("%s: skw not pristine", __func__));
1708 KASSERT(s->refs == 0, ("%s: state not pristine", __func__));
1709
1710 s->kif = kif;
1711 s->orig_kif = orig_kif;
1712
1713 if (s->id == 0 && s->creatorid == 0) {
1714 s->id = alloc_unr64(&V_pf_stateid);
1715 s->id = htobe64(s->id);
1716 s->creatorid = V_pf_status.hostid;
1717 }
1718
1719 /* Returns with ID locked on success. */
1720 if ((error = pf_state_key_attach(skw, sks, s)) != 0)
1721 return (error);
1722
1723 ih = &V_pf_idhash[PF_IDHASH(s)];
1724 PF_HASHROW_ASSERT(ih);
1725 LIST_FOREACH(cur, &ih->states, entry)
1726 if (cur->id == s->id && cur->creatorid == s->creatorid)
1727 break;
1728
1729 if (cur != NULL) {
1730 s->timeout = PFTM_UNLINKED;
1731 PF_HASHROW_UNLOCK(ih);
1732 if (V_pf_status.debug >= PF_DEBUG_MISC) {
1733 printf("pf: state ID collision: "
1734 "id: %016llx creatorid: %08x\n",
1735 (unsigned long long)be64toh(s->id),
1736 ntohl(s->creatorid));
1737 }
1738 pf_detach_state(s);
1739 return (EEXIST);
1740 }
1741 LIST_INSERT_HEAD(&ih->states, s, entry);
1742 /* One for keys, one for ID hash. */
1743 refcount_init(&s->refs, 2);
1744
1745 pf_counter_u64_add(&V_pf_status.fcounters[FCNT_STATE_INSERT], 1);
1746 if (V_pfsync_insert_state_ptr != NULL)
1747 V_pfsync_insert_state_ptr(s);
1748
1749 /* Returns locked. */
1750 return (0);
1751 }
1752
1753 /*
1754 * Find state by ID: returns with locked row on success.
1755 */
1756 struct pf_kstate *
pf_find_state_byid(uint64_t id,uint32_t creatorid)1757 pf_find_state_byid(uint64_t id, uint32_t creatorid)
1758 {
1759 struct pf_idhash *ih;
1760 struct pf_kstate *s;
1761
1762 pf_counter_u64_add(&V_pf_status.fcounters[FCNT_STATE_SEARCH], 1);
1763
1764 ih = &V_pf_idhash[(be64toh(id) % (V_pf_hashmask + 1))];
1765
1766 PF_HASHROW_LOCK(ih);
1767 LIST_FOREACH(s, &ih->states, entry)
1768 if (s->id == id && s->creatorid == creatorid)
1769 break;
1770
1771 if (s == NULL)
1772 PF_HASHROW_UNLOCK(ih);
1773
1774 return (s);
1775 }
1776
1777 /*
1778 * Find state by key.
1779 * Returns with ID hash slot locked on success.
1780 */
1781 static struct pf_kstate *
pf_find_state(struct pfi_kkif * kif,const struct pf_state_key_cmp * key,u_int dir)1782 pf_find_state(struct pfi_kkif *kif, const struct pf_state_key_cmp *key,
1783 u_int dir)
1784 {
1785 struct pf_keyhash *kh;
1786 struct pf_state_key *sk;
1787 struct pf_kstate *s;
1788 int idx;
1789
1790 pf_counter_u64_add(&V_pf_status.fcounters[FCNT_STATE_SEARCH], 1);
1791
1792 kh = &V_pf_keyhash[pf_hashkey((const struct pf_state_key *)key)];
1793
1794 PF_HASHROW_LOCK(kh);
1795 LIST_FOREACH(sk, &kh->keys, entry)
1796 if (bcmp(sk, key, sizeof(struct pf_state_key_cmp)) == 0)
1797 break;
1798 if (sk == NULL) {
1799 PF_HASHROW_UNLOCK(kh);
1800 return (NULL);
1801 }
1802
1803 idx = (dir == PF_IN ? PF_SK_WIRE : PF_SK_STACK);
1804
1805 /* List is sorted, if-bound states before floating ones. */
1806 TAILQ_FOREACH(s, &sk->states[idx], key_list[idx])
1807 if (s->kif == V_pfi_all || s->kif == kif || s->orig_kif == kif) {
1808 PF_STATE_LOCK(s);
1809 PF_HASHROW_UNLOCK(kh);
1810 if (__predict_false(s->timeout >= PFTM_MAX)) {
1811 /*
1812 * State is either being processed by
1813 * pf_unlink_state() in an other thread, or
1814 * is scheduled for immediate expiry.
1815 */
1816 PF_STATE_UNLOCK(s);
1817 return (NULL);
1818 }
1819 return (s);
1820 }
1821 PF_HASHROW_UNLOCK(kh);
1822
1823 return (NULL);
1824 }
1825
1826 /*
1827 * Returns with ID hash slot locked on success.
1828 */
1829 struct pf_kstate *
pf_find_state_all(const struct pf_state_key_cmp * key,u_int dir,int * more)1830 pf_find_state_all(const struct pf_state_key_cmp *key, u_int dir, int *more)
1831 {
1832 struct pf_keyhash *kh;
1833 struct pf_state_key *sk;
1834 struct pf_kstate *s, *ret = NULL;
1835 int idx, inout = 0;
1836
1837 if (more != NULL)
1838 *more = 0;
1839
1840 pf_counter_u64_add(&V_pf_status.fcounters[FCNT_STATE_SEARCH], 1);
1841
1842 kh = &V_pf_keyhash[pf_hashkey((const struct pf_state_key *)key)];
1843
1844 PF_HASHROW_LOCK(kh);
1845 LIST_FOREACH(sk, &kh->keys, entry)
1846 if (bcmp(sk, key, sizeof(struct pf_state_key_cmp)) == 0)
1847 break;
1848 if (sk == NULL) {
1849 PF_HASHROW_UNLOCK(kh);
1850 return (NULL);
1851 }
1852 switch (dir) {
1853 case PF_IN:
1854 idx = PF_SK_WIRE;
1855 break;
1856 case PF_OUT:
1857 idx = PF_SK_STACK;
1858 break;
1859 case PF_INOUT:
1860 idx = PF_SK_WIRE;
1861 inout = 1;
1862 break;
1863 default:
1864 panic("%s: dir %u", __func__, dir);
1865 }
1866 second_run:
1867 TAILQ_FOREACH(s, &sk->states[idx], key_list[idx]) {
1868 if (more == NULL) {
1869 PF_STATE_LOCK(s);
1870 PF_HASHROW_UNLOCK(kh);
1871 return (s);
1872 }
1873
1874 if (ret)
1875 (*more)++;
1876 else {
1877 ret = s;
1878 PF_STATE_LOCK(s);
1879 }
1880 }
1881 if (inout == 1) {
1882 inout = 0;
1883 idx = PF_SK_STACK;
1884 goto second_run;
1885 }
1886 PF_HASHROW_UNLOCK(kh);
1887
1888 return (ret);
1889 }
1890
1891 /*
1892 * FIXME
1893 * This routine is inefficient -- locks the state only to unlock immediately on
1894 * return.
1895 * It is racy -- after the state is unlocked nothing stops other threads from
1896 * removing it.
1897 */
1898 bool
pf_find_state_all_exists(const struct pf_state_key_cmp * key,u_int dir)1899 pf_find_state_all_exists(const struct pf_state_key_cmp *key, u_int dir)
1900 {
1901 struct pf_kstate *s;
1902
1903 s = pf_find_state_all(key, dir, NULL);
1904 if (s != NULL) {
1905 PF_STATE_UNLOCK(s);
1906 return (true);
1907 }
1908 return (false);
1909 }
1910
1911 struct pf_udp_mapping *
pf_udp_mapping_create(sa_family_t af,struct pf_addr * src_addr,uint16_t src_port,struct pf_addr * nat_addr,uint16_t nat_port)1912 pf_udp_mapping_create(sa_family_t af, struct pf_addr *src_addr, uint16_t src_port,
1913 struct pf_addr *nat_addr, uint16_t nat_port)
1914 {
1915 struct pf_udp_mapping *mapping;
1916
1917 mapping = uma_zalloc(V_pf_udp_mapping_z, M_NOWAIT | M_ZERO);
1918 if (mapping == NULL)
1919 return (NULL);
1920 PF_ACPY(&mapping->endpoints[0].addr, src_addr, af);
1921 mapping->endpoints[0].port = src_port;
1922 mapping->endpoints[0].af = af;
1923 mapping->endpoints[0].mapping = mapping;
1924 PF_ACPY(&mapping->endpoints[1].addr, nat_addr, af);
1925 mapping->endpoints[1].port = nat_port;
1926 mapping->endpoints[1].af = af;
1927 mapping->endpoints[1].mapping = mapping;
1928 refcount_init(&mapping->refs, 1);
1929 return (mapping);
1930 }
1931
1932 int
pf_udp_mapping_insert(struct pf_udp_mapping * mapping)1933 pf_udp_mapping_insert(struct pf_udp_mapping *mapping)
1934 {
1935 struct pf_udpendpointhash *h0, *h1;
1936 struct pf_udp_endpoint *endpoint;
1937 int ret = EEXIST;
1938
1939 h0 = &V_pf_udpendpointhash[pf_hashudpendpoint(&mapping->endpoints[0])];
1940 h1 = &V_pf_udpendpointhash[pf_hashudpendpoint(&mapping->endpoints[1])];
1941 if (h0 == h1) {
1942 PF_HASHROW_LOCK(h0);
1943 } else if (h0 < h1) {
1944 PF_HASHROW_LOCK(h0);
1945 PF_HASHROW_LOCK(h1);
1946 } else {
1947 PF_HASHROW_LOCK(h1);
1948 PF_HASHROW_LOCK(h0);
1949 }
1950
1951 LIST_FOREACH(endpoint, &h0->endpoints, entry) {
1952 if (bcmp(endpoint, &mapping->endpoints[0],
1953 sizeof(struct pf_udp_endpoint_cmp)) == 0)
1954 break;
1955 }
1956 if (endpoint != NULL)
1957 goto cleanup;
1958 LIST_FOREACH(endpoint, &h1->endpoints, entry) {
1959 if (bcmp(endpoint, &mapping->endpoints[1],
1960 sizeof(struct pf_udp_endpoint_cmp)) == 0)
1961 break;
1962 }
1963 if (endpoint != NULL)
1964 goto cleanup;
1965 LIST_INSERT_HEAD(&h0->endpoints, &mapping->endpoints[0], entry);
1966 LIST_INSERT_HEAD(&h1->endpoints, &mapping->endpoints[1], entry);
1967 ret = 0;
1968
1969 cleanup:
1970 if (h0 != h1) {
1971 PF_HASHROW_UNLOCK(h0);
1972 PF_HASHROW_UNLOCK(h1);
1973 } else {
1974 PF_HASHROW_UNLOCK(h0);
1975 }
1976 return (ret);
1977 }
1978
1979 void
pf_udp_mapping_release(struct pf_udp_mapping * mapping)1980 pf_udp_mapping_release(struct pf_udp_mapping *mapping)
1981 {
1982 /* refcount is synchronized on the source endpoint's row lock */
1983 struct pf_udpendpointhash *h0, *h1;
1984
1985 if (mapping == NULL)
1986 return;
1987
1988 h0 = &V_pf_udpendpointhash[pf_hashudpendpoint(&mapping->endpoints[0])];
1989 PF_HASHROW_LOCK(h0);
1990 if (refcount_release(&mapping->refs)) {
1991 LIST_REMOVE(&mapping->endpoints[0], entry);
1992 PF_HASHROW_UNLOCK(h0);
1993 h1 = &V_pf_udpendpointhash[pf_hashudpendpoint(&mapping->endpoints[1])];
1994 PF_HASHROW_LOCK(h1);
1995 LIST_REMOVE(&mapping->endpoints[1], entry);
1996 PF_HASHROW_UNLOCK(h1);
1997
1998 uma_zfree(V_pf_udp_mapping_z, mapping);
1999 } else {
2000 PF_HASHROW_UNLOCK(h0);
2001 }
2002 }
2003
2004
2005 struct pf_udp_mapping *
pf_udp_mapping_find(struct pf_udp_endpoint_cmp * key)2006 pf_udp_mapping_find(struct pf_udp_endpoint_cmp *key)
2007 {
2008 struct pf_udpendpointhash *uh;
2009 struct pf_udp_endpoint *endpoint;
2010
2011 uh = &V_pf_udpendpointhash[pf_hashudpendpoint((struct pf_udp_endpoint*)key)];
2012
2013 PF_HASHROW_LOCK(uh);
2014 LIST_FOREACH(endpoint, &uh->endpoints, entry) {
2015 if (bcmp(endpoint, key, sizeof(struct pf_udp_endpoint_cmp)) == 0 &&
2016 bcmp(endpoint, &endpoint->mapping->endpoints[0],
2017 sizeof(struct pf_udp_endpoint_cmp)) == 0)
2018 break;
2019 }
2020 if (endpoint == NULL) {
2021 PF_HASHROW_UNLOCK(uh);
2022 return (NULL);
2023 }
2024 refcount_acquire(&endpoint->mapping->refs);
2025 PF_HASHROW_UNLOCK(uh);
2026 return (endpoint->mapping);
2027 }
2028 /* END state table stuff */
2029
2030 static void
pf_send(struct pf_send_entry * pfse)2031 pf_send(struct pf_send_entry *pfse)
2032 {
2033
2034 PF_SENDQ_LOCK();
2035 STAILQ_INSERT_TAIL(&V_pf_sendqueue, pfse, pfse_next);
2036 PF_SENDQ_UNLOCK();
2037 swi_sched(V_pf_swi_cookie, 0);
2038 }
2039
2040 static bool
pf_isforlocal(struct mbuf * m,int af)2041 pf_isforlocal(struct mbuf *m, int af)
2042 {
2043 switch (af) {
2044 #ifdef INET
2045 case AF_INET: {
2046 struct ip *ip = mtod(m, struct ip *);
2047
2048 return (in_localip(ip->ip_dst));
2049 }
2050 #endif
2051 #ifdef INET6
2052 case AF_INET6: {
2053 struct ip6_hdr *ip6;
2054 struct in6_ifaddr *ia;
2055 ip6 = mtod(m, struct ip6_hdr *);
2056 ia = in6ifa_ifwithaddr(&ip6->ip6_dst, 0 /* XXX */, false);
2057 if (ia == NULL)
2058 return (false);
2059 return (! (ia->ia6_flags & IN6_IFF_NOTREADY));
2060 }
2061 #endif
2062 }
2063
2064 return (false);
2065 }
2066
2067 int
pf_icmp_mapping(struct pf_pdesc * pd,u_int8_t type,int * icmp_dir,int * multi,u_int16_t * virtual_id,u_int16_t * virtual_type)2068 pf_icmp_mapping(struct pf_pdesc *pd, u_int8_t type,
2069 int *icmp_dir, int *multi, u_int16_t *virtual_id, u_int16_t *virtual_type)
2070 {
2071 /*
2072 * ICMP types marked with PF_OUT are typically responses to
2073 * PF_IN, and will match states in the opposite direction.
2074 * PF_IN ICMP types need to match a state with that type.
2075 */
2076 *icmp_dir = PF_OUT;
2077 *multi = PF_ICMP_MULTI_LINK;
2078 /* Queries (and responses) */
2079 switch (pd->af) {
2080 #ifdef INET
2081 case AF_INET:
2082 switch (type) {
2083 case ICMP_ECHO:
2084 *icmp_dir = PF_IN;
2085 case ICMP_ECHOREPLY:
2086 *virtual_type = ICMP_ECHO;
2087 *virtual_id = pd->hdr.icmp.icmp_id;
2088 break;
2089
2090 case ICMP_TSTAMP:
2091 *icmp_dir = PF_IN;
2092 case ICMP_TSTAMPREPLY:
2093 *virtual_type = ICMP_TSTAMP;
2094 *virtual_id = pd->hdr.icmp.icmp_id;
2095 break;
2096
2097 case ICMP_IREQ:
2098 *icmp_dir = PF_IN;
2099 case ICMP_IREQREPLY:
2100 *virtual_type = ICMP_IREQ;
2101 *virtual_id = pd->hdr.icmp.icmp_id;
2102 break;
2103
2104 case ICMP_MASKREQ:
2105 *icmp_dir = PF_IN;
2106 case ICMP_MASKREPLY:
2107 *virtual_type = ICMP_MASKREQ;
2108 *virtual_id = pd->hdr.icmp.icmp_id;
2109 break;
2110
2111 case ICMP_IPV6_WHEREAREYOU:
2112 *icmp_dir = PF_IN;
2113 case ICMP_IPV6_IAMHERE:
2114 *virtual_type = ICMP_IPV6_WHEREAREYOU;
2115 *virtual_id = 0; /* Nothing sane to match on! */
2116 break;
2117
2118 case ICMP_MOBILE_REGREQUEST:
2119 *icmp_dir = PF_IN;
2120 case ICMP_MOBILE_REGREPLY:
2121 *virtual_type = ICMP_MOBILE_REGREQUEST;
2122 *virtual_id = 0; /* Nothing sane to match on! */
2123 break;
2124
2125 case ICMP_ROUTERSOLICIT:
2126 *icmp_dir = PF_IN;
2127 case ICMP_ROUTERADVERT:
2128 *virtual_type = ICMP_ROUTERSOLICIT;
2129 *virtual_id = 0; /* Nothing sane to match on! */
2130 break;
2131
2132 /* These ICMP types map to other connections */
2133 case ICMP_UNREACH:
2134 case ICMP_SOURCEQUENCH:
2135 case ICMP_REDIRECT:
2136 case ICMP_TIMXCEED:
2137 case ICMP_PARAMPROB:
2138 /* These will not be used, but set them anyway */
2139 *icmp_dir = PF_IN;
2140 *virtual_type = type;
2141 *virtual_id = 0;
2142 HTONS(*virtual_type);
2143 return (1); /* These types match to another state */
2144
2145 /*
2146 * All remaining ICMP types get their own states,
2147 * and will only match in one direction.
2148 */
2149 default:
2150 *icmp_dir = PF_IN;
2151 *virtual_type = type;
2152 *virtual_id = 0;
2153 break;
2154 }
2155 break;
2156 #endif /* INET */
2157 #ifdef INET6
2158 case AF_INET6:
2159 switch (type) {
2160 case ICMP6_ECHO_REQUEST:
2161 *icmp_dir = PF_IN;
2162 case ICMP6_ECHO_REPLY:
2163 *virtual_type = ICMP6_ECHO_REQUEST;
2164 *virtual_id = pd->hdr.icmp6.icmp6_id;
2165 break;
2166
2167 case MLD_LISTENER_QUERY:
2168 case MLD_LISTENER_REPORT: {
2169 /*
2170 * Listener Report can be sent by clients
2171 * without an associated Listener Query.
2172 * In addition to that, when Report is sent as a
2173 * reply to a Query its source and destination
2174 * address are different.
2175 */
2176 *icmp_dir = PF_IN;
2177 *virtual_type = MLD_LISTENER_QUERY;
2178 *virtual_id = 0;
2179 break;
2180 }
2181 case MLD_MTRACE:
2182 *icmp_dir = PF_IN;
2183 case MLD_MTRACE_RESP:
2184 *virtual_type = MLD_MTRACE;
2185 *virtual_id = 0; /* Nothing sane to match on! */
2186 break;
2187
2188 case ND_NEIGHBOR_SOLICIT:
2189 *icmp_dir = PF_IN;
2190 case ND_NEIGHBOR_ADVERT: {
2191 *virtual_type = ND_NEIGHBOR_SOLICIT;
2192 *virtual_id = 0;
2193 break;
2194 }
2195
2196 /*
2197 * These ICMP types map to other connections.
2198 * ND_REDIRECT can't be in this list because the triggering
2199 * packet header is optional.
2200 */
2201 case ICMP6_DST_UNREACH:
2202 case ICMP6_PACKET_TOO_BIG:
2203 case ICMP6_TIME_EXCEEDED:
2204 case ICMP6_PARAM_PROB:
2205 /* These will not be used, but set them anyway */
2206 *icmp_dir = PF_IN;
2207 *virtual_type = type;
2208 *virtual_id = 0;
2209 HTONS(*virtual_type);
2210 return (1); /* These types match to another state */
2211 /*
2212 * All remaining ICMP6 types get their own states,
2213 * and will only match in one direction.
2214 */
2215 default:
2216 *icmp_dir = PF_IN;
2217 *virtual_type = type;
2218 *virtual_id = 0;
2219 break;
2220 }
2221 break;
2222 #endif /* INET6 */
2223 }
2224 HTONS(*virtual_type);
2225 return (0); /* These types match to their own state */
2226 }
2227
2228 void
pf_intr(void * v)2229 pf_intr(void *v)
2230 {
2231 struct epoch_tracker et;
2232 struct pf_send_head queue;
2233 struct pf_send_entry *pfse, *next;
2234
2235 CURVNET_SET((struct vnet *)v);
2236
2237 PF_SENDQ_LOCK();
2238 queue = V_pf_sendqueue;
2239 STAILQ_INIT(&V_pf_sendqueue);
2240 PF_SENDQ_UNLOCK();
2241
2242 NET_EPOCH_ENTER(et);
2243
2244 STAILQ_FOREACH_SAFE(pfse, &queue, pfse_next, next) {
2245 switch (pfse->pfse_type) {
2246 #ifdef INET
2247 case PFSE_IP: {
2248 if (pf_isforlocal(pfse->pfse_m, AF_INET)) {
2249 KASSERT(pfse->pfse_m->m_pkthdr.rcvif == V_loif,
2250 ("%s: rcvif != loif", __func__));
2251
2252 pfse->pfse_m->m_flags |= M_SKIP_FIREWALL;
2253 pfse->pfse_m->m_pkthdr.csum_flags |=
2254 CSUM_IP_VALID | CSUM_IP_CHECKED;
2255 ip_input(pfse->pfse_m);
2256 } else {
2257 ip_output(pfse->pfse_m, NULL, NULL, 0, NULL,
2258 NULL);
2259 }
2260 break;
2261 }
2262 case PFSE_ICMP:
2263 icmp_error(pfse->pfse_m, pfse->icmpopts.type,
2264 pfse->icmpopts.code, 0, pfse->icmpopts.mtu);
2265 break;
2266 #endif /* INET */
2267 #ifdef INET6
2268 case PFSE_IP6:
2269 if (pf_isforlocal(pfse->pfse_m, AF_INET6)) {
2270 KASSERT(pfse->pfse_m->m_pkthdr.rcvif == V_loif,
2271 ("%s: rcvif != loif", __func__));
2272
2273 pfse->pfse_m->m_flags |= M_SKIP_FIREWALL |
2274 M_LOOP;
2275 ip6_input(pfse->pfse_m);
2276 } else {
2277 ip6_output(pfse->pfse_m, NULL, NULL, 0, NULL,
2278 NULL, NULL);
2279 }
2280 break;
2281 case PFSE_ICMP6:
2282 icmp6_error(pfse->pfse_m, pfse->icmpopts.type,
2283 pfse->icmpopts.code, pfse->icmpopts.mtu);
2284 break;
2285 #endif /* INET6 */
2286 default:
2287 panic("%s: unknown type", __func__);
2288 }
2289 free(pfse, M_PFTEMP);
2290 }
2291 NET_EPOCH_EXIT(et);
2292 CURVNET_RESTORE();
2293 }
2294
2295 #define pf_purge_thread_period (hz / 10)
2296
2297 #ifdef PF_WANT_32_TO_64_COUNTER
2298 static void
pf_status_counter_u64_periodic(void)2299 pf_status_counter_u64_periodic(void)
2300 {
2301
2302 PF_RULES_RASSERT();
2303
2304 if ((V_pf_counter_periodic_iter % (pf_purge_thread_period * 10 * 60)) != 0) {
2305 return;
2306 }
2307
2308 for (int i = 0; i < FCNT_MAX; i++) {
2309 pf_counter_u64_periodic(&V_pf_status.fcounters[i]);
2310 }
2311 }
2312
2313 static void
pf_kif_counter_u64_periodic(void)2314 pf_kif_counter_u64_periodic(void)
2315 {
2316 struct pfi_kkif *kif;
2317 size_t r, run;
2318
2319 PF_RULES_RASSERT();
2320
2321 if (__predict_false(V_pf_allkifcount == 0)) {
2322 return;
2323 }
2324
2325 if ((V_pf_counter_periodic_iter % (pf_purge_thread_period * 10 * 300)) != 0) {
2326 return;
2327 }
2328
2329 run = V_pf_allkifcount / 10;
2330 if (run < 5)
2331 run = 5;
2332
2333 for (r = 0; r < run; r++) {
2334 kif = LIST_NEXT(V_pf_kifmarker, pfik_allkiflist);
2335 if (kif == NULL) {
2336 LIST_REMOVE(V_pf_kifmarker, pfik_allkiflist);
2337 LIST_INSERT_HEAD(&V_pf_allkiflist, V_pf_kifmarker, pfik_allkiflist);
2338 break;
2339 }
2340
2341 LIST_REMOVE(V_pf_kifmarker, pfik_allkiflist);
2342 LIST_INSERT_AFTER(kif, V_pf_kifmarker, pfik_allkiflist);
2343
2344 for (int i = 0; i < 2; i++) {
2345 for (int j = 0; j < 2; j++) {
2346 for (int k = 0; k < 2; k++) {
2347 pf_counter_u64_periodic(&kif->pfik_packets[i][j][k]);
2348 pf_counter_u64_periodic(&kif->pfik_bytes[i][j][k]);
2349 }
2350 }
2351 }
2352 }
2353 }
2354
2355 static void
pf_rule_counter_u64_periodic(void)2356 pf_rule_counter_u64_periodic(void)
2357 {
2358 struct pf_krule *rule;
2359 size_t r, run;
2360
2361 PF_RULES_RASSERT();
2362
2363 if (__predict_false(V_pf_allrulecount == 0)) {
2364 return;
2365 }
2366
2367 if ((V_pf_counter_periodic_iter % (pf_purge_thread_period * 10 * 300)) != 0) {
2368 return;
2369 }
2370
2371 run = V_pf_allrulecount / 10;
2372 if (run < 5)
2373 run = 5;
2374
2375 for (r = 0; r < run; r++) {
2376 rule = LIST_NEXT(V_pf_rulemarker, allrulelist);
2377 if (rule == NULL) {
2378 LIST_REMOVE(V_pf_rulemarker, allrulelist);
2379 LIST_INSERT_HEAD(&V_pf_allrulelist, V_pf_rulemarker, allrulelist);
2380 break;
2381 }
2382
2383 LIST_REMOVE(V_pf_rulemarker, allrulelist);
2384 LIST_INSERT_AFTER(rule, V_pf_rulemarker, allrulelist);
2385
2386 pf_counter_u64_periodic(&rule->evaluations);
2387 for (int i = 0; i < 2; i++) {
2388 pf_counter_u64_periodic(&rule->packets[i]);
2389 pf_counter_u64_periodic(&rule->bytes[i]);
2390 }
2391 }
2392 }
2393
2394 static void
pf_counter_u64_periodic_main(void)2395 pf_counter_u64_periodic_main(void)
2396 {
2397 PF_RULES_RLOCK_TRACKER;
2398
2399 V_pf_counter_periodic_iter++;
2400
2401 PF_RULES_RLOCK();
2402 pf_counter_u64_critical_enter();
2403 pf_status_counter_u64_periodic();
2404 pf_kif_counter_u64_periodic();
2405 pf_rule_counter_u64_periodic();
2406 pf_counter_u64_critical_exit();
2407 PF_RULES_RUNLOCK();
2408 }
2409 #else
2410 #define pf_counter_u64_periodic_main() do { } while (0)
2411 #endif
2412
2413 void
pf_purge_thread(void * unused __unused)2414 pf_purge_thread(void *unused __unused)
2415 {
2416 struct epoch_tracker et;
2417
2418 VNET_ITERATOR_DECL(vnet_iter);
2419
2420 sx_xlock(&pf_end_lock);
2421 while (pf_end_threads == 0) {
2422 sx_sleep(pf_purge_thread, &pf_end_lock, 0, "pftm", pf_purge_thread_period);
2423
2424 VNET_LIST_RLOCK();
2425 NET_EPOCH_ENTER(et);
2426 VNET_FOREACH(vnet_iter) {
2427 CURVNET_SET(vnet_iter);
2428
2429 /* Wait until V_pf_default_rule is initialized. */
2430 if (V_pf_vnet_active == 0) {
2431 CURVNET_RESTORE();
2432 continue;
2433 }
2434
2435 pf_counter_u64_periodic_main();
2436
2437 /*
2438 * Process 1/interval fraction of the state
2439 * table every run.
2440 */
2441 V_pf_purge_idx =
2442 pf_purge_expired_states(V_pf_purge_idx, V_pf_hashmask /
2443 (V_pf_default_rule.timeout[PFTM_INTERVAL] * 10));
2444
2445 /*
2446 * Purge other expired types every
2447 * PFTM_INTERVAL seconds.
2448 */
2449 if (V_pf_purge_idx == 0) {
2450 /*
2451 * Order is important:
2452 * - states and src nodes reference rules
2453 * - states and rules reference kifs
2454 */
2455 pf_purge_expired_fragments();
2456 pf_purge_expired_src_nodes();
2457 pf_purge_unlinked_rules();
2458 pfi_kkif_purge();
2459 }
2460 CURVNET_RESTORE();
2461 }
2462 NET_EPOCH_EXIT(et);
2463 VNET_LIST_RUNLOCK();
2464 }
2465
2466 pf_end_threads++;
2467 sx_xunlock(&pf_end_lock);
2468 kproc_exit(0);
2469 }
2470
2471 void
pf_unload_vnet_purge(void)2472 pf_unload_vnet_purge(void)
2473 {
2474
2475 /*
2476 * To cleanse up all kifs and rules we need
2477 * two runs: first one clears reference flags,
2478 * then pf_purge_expired_states() doesn't
2479 * raise them, and then second run frees.
2480 */
2481 pf_purge_unlinked_rules();
2482 pfi_kkif_purge();
2483
2484 /*
2485 * Now purge everything.
2486 */
2487 pf_purge_expired_states(0, V_pf_hashmask);
2488 pf_purge_fragments(UINT_MAX);
2489 pf_purge_expired_src_nodes();
2490
2491 /*
2492 * Now all kifs & rules should be unreferenced,
2493 * thus should be successfully freed.
2494 */
2495 pf_purge_unlinked_rules();
2496 pfi_kkif_purge();
2497 }
2498
2499 u_int32_t
pf_state_expires(const struct pf_kstate * state)2500 pf_state_expires(const struct pf_kstate *state)
2501 {
2502 u_int32_t timeout;
2503 u_int32_t start;
2504 u_int32_t end;
2505 u_int32_t states;
2506
2507 /* handle all PFTM_* > PFTM_MAX here */
2508 if (state->timeout == PFTM_PURGE)
2509 return (time_uptime);
2510 KASSERT(state->timeout != PFTM_UNLINKED,
2511 ("pf_state_expires: timeout == PFTM_UNLINKED"));
2512 KASSERT((state->timeout < PFTM_MAX),
2513 ("pf_state_expires: timeout > PFTM_MAX"));
2514 timeout = state->rule->timeout[state->timeout];
2515 if (!timeout)
2516 timeout = V_pf_default_rule.timeout[state->timeout];
2517 start = state->rule->timeout[PFTM_ADAPTIVE_START];
2518 if (start && state->rule != &V_pf_default_rule) {
2519 end = state->rule->timeout[PFTM_ADAPTIVE_END];
2520 states = counter_u64_fetch(state->rule->states_cur);
2521 } else {
2522 start = V_pf_default_rule.timeout[PFTM_ADAPTIVE_START];
2523 end = V_pf_default_rule.timeout[PFTM_ADAPTIVE_END];
2524 states = V_pf_status.states;
2525 }
2526 if (end && states > start && start < end) {
2527 if (states < end) {
2528 timeout = (u_int64_t)timeout * (end - states) /
2529 (end - start);
2530 return ((state->expire / 1000) + timeout);
2531 }
2532 else
2533 return (time_uptime);
2534 }
2535 return ((state->expire / 1000) + timeout);
2536 }
2537
2538 void
pf_purge_expired_src_nodes(void)2539 pf_purge_expired_src_nodes(void)
2540 {
2541 struct pf_ksrc_node_list freelist;
2542 struct pf_srchash *sh;
2543 struct pf_ksrc_node *cur, *next;
2544 int i;
2545
2546 LIST_INIT(&freelist);
2547 for (i = 0, sh = V_pf_srchash; i <= V_pf_srchashmask; i++, sh++) {
2548 PF_HASHROW_LOCK(sh);
2549 LIST_FOREACH_SAFE(cur, &sh->nodes, entry, next)
2550 if (cur->states == 0 && cur->expire <= time_uptime) {
2551 pf_unlink_src_node(cur);
2552 LIST_INSERT_HEAD(&freelist, cur, entry);
2553 } else if (cur->rule != NULL)
2554 cur->rule->rule_ref |= PFRULE_REFS;
2555 PF_HASHROW_UNLOCK(sh);
2556 }
2557
2558 pf_free_src_nodes(&freelist);
2559
2560 V_pf_status.src_nodes = uma_zone_get_cur(V_pf_sources_z);
2561 }
2562
2563 static void
pf_src_tree_remove_state(struct pf_kstate * s)2564 pf_src_tree_remove_state(struct pf_kstate *s)
2565 {
2566 struct pf_ksrc_node *sn;
2567 uint32_t timeout;
2568
2569 timeout = s->rule->timeout[PFTM_SRC_NODE] ?
2570 s->rule->timeout[PFTM_SRC_NODE] :
2571 V_pf_default_rule.timeout[PFTM_SRC_NODE];
2572
2573 if (s->src_node != NULL) {
2574 sn = s->src_node;
2575 PF_SRC_NODE_LOCK(sn);
2576 if (s->src.tcp_est)
2577 --sn->conn;
2578 if (--sn->states == 0)
2579 sn->expire = time_uptime + timeout;
2580 PF_SRC_NODE_UNLOCK(sn);
2581 }
2582 if (s->nat_src_node != s->src_node && s->nat_src_node != NULL) {
2583 sn = s->nat_src_node;
2584 PF_SRC_NODE_LOCK(sn);
2585 if (--sn->states == 0)
2586 sn->expire = time_uptime + timeout;
2587 PF_SRC_NODE_UNLOCK(sn);
2588 }
2589 s->src_node = s->nat_src_node = NULL;
2590 }
2591
2592 /*
2593 * Unlink and potentilly free a state. Function may be
2594 * called with ID hash row locked, but always returns
2595 * unlocked, since it needs to go through key hash locking.
2596 */
2597 int
pf_unlink_state(struct pf_kstate * s)2598 pf_unlink_state(struct pf_kstate *s)
2599 {
2600 struct pf_idhash *ih = &V_pf_idhash[PF_IDHASH(s)];
2601
2602 NET_EPOCH_ASSERT();
2603 PF_HASHROW_ASSERT(ih);
2604
2605 if (s->timeout == PFTM_UNLINKED) {
2606 /*
2607 * State is being processed
2608 * by pf_unlink_state() in
2609 * an other thread.
2610 */
2611 PF_HASHROW_UNLOCK(ih);
2612 return (0); /* XXXGL: undefined actually */
2613 }
2614
2615 if (s->src.state == PF_TCPS_PROXY_DST) {
2616 /* XXX wire key the right one? */
2617 pf_send_tcp(s->rule, s->key[PF_SK_WIRE]->af,
2618 &s->key[PF_SK_WIRE]->addr[1],
2619 &s->key[PF_SK_WIRE]->addr[0],
2620 s->key[PF_SK_WIRE]->port[1],
2621 s->key[PF_SK_WIRE]->port[0],
2622 s->src.seqhi, s->src.seqlo + 1,
2623 TH_RST|TH_ACK, 0, 0, 0, M_SKIP_FIREWALL, s->tag, 0,
2624 s->act.rtableid);
2625 }
2626
2627 LIST_REMOVE(s, entry);
2628 pf_src_tree_remove_state(s);
2629
2630 if (V_pfsync_delete_state_ptr != NULL)
2631 V_pfsync_delete_state_ptr(s);
2632
2633 STATE_DEC_COUNTERS(s);
2634
2635 s->timeout = PFTM_UNLINKED;
2636
2637 /* Ensure we remove it from the list of halfopen states, if needed. */
2638 if (s->key[PF_SK_STACK] != NULL &&
2639 s->key[PF_SK_STACK]->proto == IPPROTO_TCP)
2640 pf_set_protostate(s, PF_PEER_BOTH, TCPS_CLOSED);
2641
2642 PF_HASHROW_UNLOCK(ih);
2643
2644 pf_detach_state(s);
2645
2646 pf_udp_mapping_release(s->udp_mapping);
2647
2648 /* pf_state_insert() initialises refs to 2 */
2649 return (pf_release_staten(s, 2));
2650 }
2651
2652 struct pf_kstate *
pf_alloc_state(int flags)2653 pf_alloc_state(int flags)
2654 {
2655
2656 return (uma_zalloc(V_pf_state_z, flags | M_ZERO));
2657 }
2658
2659 void
pf_free_state(struct pf_kstate * cur)2660 pf_free_state(struct pf_kstate *cur)
2661 {
2662 struct pf_krule_item *ri;
2663
2664 KASSERT(cur->refs == 0, ("%s: %p has refs", __func__, cur));
2665 KASSERT(cur->timeout == PFTM_UNLINKED, ("%s: timeout %u", __func__,
2666 cur->timeout));
2667
2668 while ((ri = SLIST_FIRST(&cur->match_rules))) {
2669 SLIST_REMOVE_HEAD(&cur->match_rules, entry);
2670 free(ri, M_PF_RULE_ITEM);
2671 }
2672
2673 pf_normalize_tcp_cleanup(cur);
2674 uma_zfree(V_pf_state_z, cur);
2675 pf_counter_u64_add(&V_pf_status.fcounters[FCNT_STATE_REMOVALS], 1);
2676 }
2677
2678 /*
2679 * Called only from pf_purge_thread(), thus serialized.
2680 */
2681 static u_int
pf_purge_expired_states(u_int i,int maxcheck)2682 pf_purge_expired_states(u_int i, int maxcheck)
2683 {
2684 struct pf_idhash *ih;
2685 struct pf_kstate *s;
2686 struct pf_krule_item *mrm;
2687 size_t count __unused;
2688
2689 V_pf_status.states = uma_zone_get_cur(V_pf_state_z);
2690
2691 /*
2692 * Go through hash and unlink states that expire now.
2693 */
2694 while (maxcheck > 0) {
2695 count = 0;
2696 ih = &V_pf_idhash[i];
2697
2698 /* only take the lock if we expect to do work */
2699 if (!LIST_EMPTY(&ih->states)) {
2700 relock:
2701 PF_HASHROW_LOCK(ih);
2702 LIST_FOREACH(s, &ih->states, entry) {
2703 if (pf_state_expires(s) <= time_uptime) {
2704 V_pf_status.states -=
2705 pf_unlink_state(s);
2706 goto relock;
2707 }
2708 s->rule->rule_ref |= PFRULE_REFS;
2709 if (s->nat_rule != NULL)
2710 s->nat_rule->rule_ref |= PFRULE_REFS;
2711 if (s->anchor != NULL)
2712 s->anchor->rule_ref |= PFRULE_REFS;
2713 s->kif->pfik_flags |= PFI_IFLAG_REFS;
2714 SLIST_FOREACH(mrm, &s->match_rules, entry)
2715 mrm->r->rule_ref |= PFRULE_REFS;
2716 if (s->act.rt_kif)
2717 s->act.rt_kif->pfik_flags |= PFI_IFLAG_REFS;
2718 count++;
2719 }
2720 PF_HASHROW_UNLOCK(ih);
2721 }
2722
2723 SDT_PROBE2(pf, purge, state, rowcount, i, count);
2724
2725 /* Return when we hit end of hash. */
2726 if (++i > V_pf_hashmask) {
2727 V_pf_status.states = uma_zone_get_cur(V_pf_state_z);
2728 return (0);
2729 }
2730
2731 maxcheck--;
2732 }
2733
2734 V_pf_status.states = uma_zone_get_cur(V_pf_state_z);
2735
2736 return (i);
2737 }
2738
2739 static void
pf_purge_unlinked_rules(void)2740 pf_purge_unlinked_rules(void)
2741 {
2742 struct pf_krulequeue tmpq;
2743 struct pf_krule *r, *r1;
2744
2745 /*
2746 * If we have overloading task pending, then we'd
2747 * better skip purging this time. There is a tiny
2748 * probability that overloading task references
2749 * an already unlinked rule.
2750 */
2751 PF_OVERLOADQ_LOCK();
2752 if (!SLIST_EMPTY(&V_pf_overloadqueue)) {
2753 PF_OVERLOADQ_UNLOCK();
2754 return;
2755 }
2756 PF_OVERLOADQ_UNLOCK();
2757
2758 /*
2759 * Do naive mark-and-sweep garbage collecting of old rules.
2760 * Reference flag is raised by pf_purge_expired_states()
2761 * and pf_purge_expired_src_nodes().
2762 *
2763 * To avoid LOR between PF_UNLNKDRULES_LOCK/PF_RULES_WLOCK,
2764 * use a temporary queue.
2765 */
2766 TAILQ_INIT(&tmpq);
2767 PF_UNLNKDRULES_LOCK();
2768 TAILQ_FOREACH_SAFE(r, &V_pf_unlinked_rules, entries, r1) {
2769 if (!(r->rule_ref & PFRULE_REFS)) {
2770 TAILQ_REMOVE(&V_pf_unlinked_rules, r, entries);
2771 TAILQ_INSERT_TAIL(&tmpq, r, entries);
2772 } else
2773 r->rule_ref &= ~PFRULE_REFS;
2774 }
2775 PF_UNLNKDRULES_UNLOCK();
2776
2777 if (!TAILQ_EMPTY(&tmpq)) {
2778 PF_CONFIG_LOCK();
2779 PF_RULES_WLOCK();
2780 TAILQ_FOREACH_SAFE(r, &tmpq, entries, r1) {
2781 TAILQ_REMOVE(&tmpq, r, entries);
2782 pf_free_rule(r);
2783 }
2784 PF_RULES_WUNLOCK();
2785 PF_CONFIG_UNLOCK();
2786 }
2787 }
2788
2789 void
pf_print_host(struct pf_addr * addr,u_int16_t p,sa_family_t af)2790 pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af)
2791 {
2792 switch (af) {
2793 #ifdef INET
2794 case AF_INET: {
2795 u_int32_t a = ntohl(addr->addr32[0]);
2796 printf("%u.%u.%u.%u", (a>>24)&255, (a>>16)&255,
2797 (a>>8)&255, a&255);
2798 if (p) {
2799 p = ntohs(p);
2800 printf(":%u", p);
2801 }
2802 break;
2803 }
2804 #endif /* INET */
2805 #ifdef INET6
2806 case AF_INET6: {
2807 u_int16_t b;
2808 u_int8_t i, curstart, curend, maxstart, maxend;
2809 curstart = curend = maxstart = maxend = 255;
2810 for (i = 0; i < 8; i++) {
2811 if (!addr->addr16[i]) {
2812 if (curstart == 255)
2813 curstart = i;
2814 curend = i;
2815 } else {
2816 if ((curend - curstart) >
2817 (maxend - maxstart)) {
2818 maxstart = curstart;
2819 maxend = curend;
2820 }
2821 curstart = curend = 255;
2822 }
2823 }
2824 if ((curend - curstart) >
2825 (maxend - maxstart)) {
2826 maxstart = curstart;
2827 maxend = curend;
2828 }
2829 for (i = 0; i < 8; i++) {
2830 if (i >= maxstart && i <= maxend) {
2831 if (i == 0)
2832 printf(":");
2833 if (i == maxend)
2834 printf(":");
2835 } else {
2836 b = ntohs(addr->addr16[i]);
2837 printf("%x", b);
2838 if (i < 7)
2839 printf(":");
2840 }
2841 }
2842 if (p) {
2843 p = ntohs(p);
2844 printf("[%u]", p);
2845 }
2846 break;
2847 }
2848 #endif /* INET6 */
2849 }
2850 }
2851
2852 void
pf_print_state(struct pf_kstate * s)2853 pf_print_state(struct pf_kstate *s)
2854 {
2855 pf_print_state_parts(s, NULL, NULL);
2856 }
2857
2858 static void
pf_print_state_parts(struct pf_kstate * s,struct pf_state_key * skwp,struct pf_state_key * sksp)2859 pf_print_state_parts(struct pf_kstate *s,
2860 struct pf_state_key *skwp, struct pf_state_key *sksp)
2861 {
2862 struct pf_state_key *skw, *sks;
2863 u_int8_t proto, dir;
2864
2865 /* Do our best to fill these, but they're skipped if NULL */
2866 skw = skwp ? skwp : (s ? s->key[PF_SK_WIRE] : NULL);
2867 sks = sksp ? sksp : (s ? s->key[PF_SK_STACK] : NULL);
2868 proto = skw ? skw->proto : (sks ? sks->proto : 0);
2869 dir = s ? s->direction : 0;
2870
2871 switch (proto) {
2872 case IPPROTO_IPV4:
2873 printf("IPv4");
2874 break;
2875 case IPPROTO_IPV6:
2876 printf("IPv6");
2877 break;
2878 case IPPROTO_TCP:
2879 printf("TCP");
2880 break;
2881 case IPPROTO_UDP:
2882 printf("UDP");
2883 break;
2884 case IPPROTO_ICMP:
2885 printf("ICMP");
2886 break;
2887 case IPPROTO_ICMPV6:
2888 printf("ICMPv6");
2889 break;
2890 default:
2891 printf("%u", proto);
2892 break;
2893 }
2894 switch (dir) {
2895 case PF_IN:
2896 printf(" in");
2897 break;
2898 case PF_OUT:
2899 printf(" out");
2900 break;
2901 }
2902 if (skw) {
2903 printf(" wire: ");
2904 pf_print_host(&skw->addr[0], skw->port[0], skw->af);
2905 printf(" ");
2906 pf_print_host(&skw->addr[1], skw->port[1], skw->af);
2907 }
2908 if (sks) {
2909 printf(" stack: ");
2910 if (sks != skw) {
2911 pf_print_host(&sks->addr[0], sks->port[0], sks->af);
2912 printf(" ");
2913 pf_print_host(&sks->addr[1], sks->port[1], sks->af);
2914 } else
2915 printf("-");
2916 }
2917 if (s) {
2918 if (proto == IPPROTO_TCP) {
2919 printf(" [lo=%u high=%u win=%u modulator=%u",
2920 s->src.seqlo, s->src.seqhi,
2921 s->src.max_win, s->src.seqdiff);
2922 if (s->src.wscale && s->dst.wscale)
2923 printf(" wscale=%u",
2924 s->src.wscale & PF_WSCALE_MASK);
2925 printf("]");
2926 printf(" [lo=%u high=%u win=%u modulator=%u",
2927 s->dst.seqlo, s->dst.seqhi,
2928 s->dst.max_win, s->dst.seqdiff);
2929 if (s->src.wscale && s->dst.wscale)
2930 printf(" wscale=%u",
2931 s->dst.wscale & PF_WSCALE_MASK);
2932 printf("]");
2933 }
2934 printf(" %u:%u", s->src.state, s->dst.state);
2935 if (s->rule)
2936 printf(" @%d", s->rule->nr);
2937 }
2938 }
2939
2940 void
pf_print_flags(uint16_t f)2941 pf_print_flags(uint16_t f)
2942 {
2943 if (f)
2944 printf(" ");
2945 if (f & TH_FIN)
2946 printf("F");
2947 if (f & TH_SYN)
2948 printf("S");
2949 if (f & TH_RST)
2950 printf("R");
2951 if (f & TH_PUSH)
2952 printf("P");
2953 if (f & TH_ACK)
2954 printf("A");
2955 if (f & TH_URG)
2956 printf("U");
2957 if (f & TH_ECE)
2958 printf("E");
2959 if (f & TH_CWR)
2960 printf("W");
2961 if (f & TH_AE)
2962 printf("e");
2963 }
2964
2965 #define PF_SET_SKIP_STEPS(i) \
2966 do { \
2967 while (head[i] != cur) { \
2968 head[i]->skip[i] = cur; \
2969 head[i] = TAILQ_NEXT(head[i], entries); \
2970 } \
2971 } while (0)
2972
2973 void
pf_calc_skip_steps(struct pf_krulequeue * rules)2974 pf_calc_skip_steps(struct pf_krulequeue *rules)
2975 {
2976 struct pf_krule *cur, *prev, *head[PF_SKIP_COUNT];
2977 int i;
2978
2979 cur = TAILQ_FIRST(rules);
2980 prev = cur;
2981 for (i = 0; i < PF_SKIP_COUNT; ++i)
2982 head[i] = cur;
2983 while (cur != NULL) {
2984 if (cur->kif != prev->kif || cur->ifnot != prev->ifnot)
2985 PF_SET_SKIP_STEPS(PF_SKIP_IFP);
2986 if (cur->direction != prev->direction)
2987 PF_SET_SKIP_STEPS(PF_SKIP_DIR);
2988 if (cur->af != prev->af)
2989 PF_SET_SKIP_STEPS(PF_SKIP_AF);
2990 if (cur->proto != prev->proto)
2991 PF_SET_SKIP_STEPS(PF_SKIP_PROTO);
2992 if (cur->src.neg != prev->src.neg ||
2993 pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr))
2994 PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR);
2995 if (cur->dst.neg != prev->dst.neg ||
2996 pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr))
2997 PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR);
2998 if (cur->src.port[0] != prev->src.port[0] ||
2999 cur->src.port[1] != prev->src.port[1] ||
3000 cur->src.port_op != prev->src.port_op)
3001 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT);
3002 if (cur->dst.port[0] != prev->dst.port[0] ||
3003 cur->dst.port[1] != prev->dst.port[1] ||
3004 cur->dst.port_op != prev->dst.port_op)
3005 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
3006
3007 prev = cur;
3008 cur = TAILQ_NEXT(cur, entries);
3009 }
3010 for (i = 0; i < PF_SKIP_COUNT; ++i)
3011 PF_SET_SKIP_STEPS(i);
3012 }
3013
3014 int
pf_addr_wrap_neq(struct pf_addr_wrap * aw1,struct pf_addr_wrap * aw2)3015 pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2)
3016 {
3017 if (aw1->type != aw2->type)
3018 return (1);
3019 switch (aw1->type) {
3020 case PF_ADDR_ADDRMASK:
3021 case PF_ADDR_RANGE:
3022 if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, AF_INET6))
3023 return (1);
3024 if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, AF_INET6))
3025 return (1);
3026 return (0);
3027 case PF_ADDR_DYNIFTL:
3028 return (aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt);
3029 case PF_ADDR_NOROUTE:
3030 case PF_ADDR_URPFFAILED:
3031 return (0);
3032 case PF_ADDR_TABLE:
3033 return (aw1->p.tbl != aw2->p.tbl);
3034 default:
3035 printf("invalid address type: %d\n", aw1->type);
3036 return (1);
3037 }
3038 }
3039
3040 /**
3041 * Checksum updates are a little complicated because the checksum in the TCP/UDP
3042 * header isn't always a full checksum. In some cases (i.e. output) it's a
3043 * pseudo-header checksum, which is a partial checksum over src/dst IP
3044 * addresses, protocol number and length.
3045 *
3046 * That means we have the following cases:
3047 * * Input or forwarding: we don't have TSO, the checksum fields are full
3048 * checksums, we need to update the checksum whenever we change anything.
3049 * * Output (i.e. the checksum is a pseudo-header checksum):
3050 * x The field being updated is src/dst address or affects the length of
3051 * the packet. We need to update the pseudo-header checksum (note that this
3052 * checksum is not ones' complement).
3053 * x Some other field is being modified (e.g. src/dst port numbers): We
3054 * don't have to update anything.
3055 **/
3056 u_int16_t
pf_cksum_fixup(u_int16_t cksum,u_int16_t old,u_int16_t new,u_int8_t udp)3057 pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp)
3058 {
3059 u_int32_t x;
3060
3061 x = cksum + old - new;
3062 x = (x + (x >> 16)) & 0xffff;
3063
3064 /* optimise: eliminate a branch when not udp */
3065 if (udp && cksum == 0x0000)
3066 return cksum;
3067 if (udp && x == 0x0000)
3068 x = 0xffff;
3069
3070 return (u_int16_t)(x);
3071 }
3072
3073 static void
pf_patch_8(struct mbuf * m,u_int16_t * cksum,u_int8_t * f,u_int8_t v,bool hi,u_int8_t udp)3074 pf_patch_8(struct mbuf *m, u_int16_t *cksum, u_int8_t *f, u_int8_t v, bool hi,
3075 u_int8_t udp)
3076 {
3077 u_int16_t old = htons(hi ? (*f << 8) : *f);
3078 u_int16_t new = htons(hi ? ( v << 8) : v);
3079
3080 if (*f == v)
3081 return;
3082
3083 *f = v;
3084
3085 if (m->m_pkthdr.csum_flags & (CSUM_DELAY_DATA | CSUM_DELAY_DATA_IPV6))
3086 return;
3087
3088 *cksum = pf_cksum_fixup(*cksum, old, new, udp);
3089 }
3090
3091 void
pf_patch_16_unaligned(struct mbuf * m,u_int16_t * cksum,void * f,u_int16_t v,bool hi,u_int8_t udp)3092 pf_patch_16_unaligned(struct mbuf *m, u_int16_t *cksum, void *f, u_int16_t v,
3093 bool hi, u_int8_t udp)
3094 {
3095 u_int8_t *fb = (u_int8_t *)f;
3096 u_int8_t *vb = (u_int8_t *)&v;
3097
3098 pf_patch_8(m, cksum, fb++, *vb++, hi, udp);
3099 pf_patch_8(m, cksum, fb++, *vb++, !hi, udp);
3100 }
3101
3102 void
pf_patch_32_unaligned(struct mbuf * m,u_int16_t * cksum,void * f,u_int32_t v,bool hi,u_int8_t udp)3103 pf_patch_32_unaligned(struct mbuf *m, u_int16_t *cksum, void *f, u_int32_t v,
3104 bool hi, u_int8_t udp)
3105 {
3106 u_int8_t *fb = (u_int8_t *)f;
3107 u_int8_t *vb = (u_int8_t *)&v;
3108
3109 pf_patch_8(m, cksum, fb++, *vb++, hi, udp);
3110 pf_patch_8(m, cksum, fb++, *vb++, !hi, udp);
3111 pf_patch_8(m, cksum, fb++, *vb++, hi, udp);
3112 pf_patch_8(m, cksum, fb++, *vb++, !hi, udp);
3113 }
3114
3115 u_int16_t
pf_proto_cksum_fixup(struct mbuf * m,u_int16_t cksum,u_int16_t old,u_int16_t new,u_int8_t udp)3116 pf_proto_cksum_fixup(struct mbuf *m, u_int16_t cksum, u_int16_t old,
3117 u_int16_t new, u_int8_t udp)
3118 {
3119 if (m->m_pkthdr.csum_flags & (CSUM_DELAY_DATA | CSUM_DELAY_DATA_IPV6))
3120 return (cksum);
3121
3122 return (pf_cksum_fixup(cksum, old, new, udp));
3123 }
3124
3125 static void
pf_change_ap(struct mbuf * m,struct pf_addr * a,u_int16_t * p,u_int16_t * ic,u_int16_t * pc,struct pf_addr * an,u_int16_t pn,u_int8_t u,sa_family_t af)3126 pf_change_ap(struct mbuf *m, struct pf_addr *a, u_int16_t *p, u_int16_t *ic,
3127 u_int16_t *pc, struct pf_addr *an, u_int16_t pn, u_int8_t u,
3128 sa_family_t af)
3129 {
3130 struct pf_addr ao;
3131 u_int16_t po = *p;
3132
3133 PF_ACPY(&ao, a, af);
3134 PF_ACPY(a, an, af);
3135
3136 if (m->m_pkthdr.csum_flags & (CSUM_DELAY_DATA | CSUM_DELAY_DATA_IPV6))
3137 *pc = ~*pc;
3138
3139 *p = pn;
3140
3141 switch (af) {
3142 #ifdef INET
3143 case AF_INET:
3144 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
3145 ao.addr16[0], an->addr16[0], 0),
3146 ao.addr16[1], an->addr16[1], 0);
3147 *p = pn;
3148
3149 *pc = pf_cksum_fixup(pf_cksum_fixup(*pc,
3150 ao.addr16[0], an->addr16[0], u),
3151 ao.addr16[1], an->addr16[1], u);
3152
3153 *pc = pf_proto_cksum_fixup(m, *pc, po, pn, u);
3154 break;
3155 #endif /* INET */
3156 #ifdef INET6
3157 case AF_INET6:
3158 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3159 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3160 pf_cksum_fixup(pf_cksum_fixup(*pc,
3161 ao.addr16[0], an->addr16[0], u),
3162 ao.addr16[1], an->addr16[1], u),
3163 ao.addr16[2], an->addr16[2], u),
3164 ao.addr16[3], an->addr16[3], u),
3165 ao.addr16[4], an->addr16[4], u),
3166 ao.addr16[5], an->addr16[5], u),
3167 ao.addr16[6], an->addr16[6], u),
3168 ao.addr16[7], an->addr16[7], u);
3169
3170 *pc = pf_proto_cksum_fixup(m, *pc, po, pn, u);
3171 break;
3172 #endif /* INET6 */
3173 }
3174
3175 if (m->m_pkthdr.csum_flags & (CSUM_DELAY_DATA |
3176 CSUM_DELAY_DATA_IPV6)) {
3177 *pc = ~*pc;
3178 if (! *pc)
3179 *pc = 0xffff;
3180 }
3181 }
3182
3183 /* Changes a u_int32_t. Uses a void * so there are no align restrictions */
3184 void
pf_change_a(void * a,u_int16_t * c,u_int32_t an,u_int8_t u)3185 pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u)
3186 {
3187 u_int32_t ao;
3188
3189 memcpy(&ao, a, sizeof(ao));
3190 memcpy(a, &an, sizeof(u_int32_t));
3191 *c = pf_cksum_fixup(pf_cksum_fixup(*c, ao / 65536, an / 65536, u),
3192 ao % 65536, an % 65536, u);
3193 }
3194
3195 void
pf_change_proto_a(struct mbuf * m,void * a,u_int16_t * c,u_int32_t an,u_int8_t udp)3196 pf_change_proto_a(struct mbuf *m, void *a, u_int16_t *c, u_int32_t an, u_int8_t udp)
3197 {
3198 u_int32_t ao;
3199
3200 memcpy(&ao, a, sizeof(ao));
3201 memcpy(a, &an, sizeof(u_int32_t));
3202
3203 *c = pf_proto_cksum_fixup(m,
3204 pf_proto_cksum_fixup(m, *c, ao / 65536, an / 65536, udp),
3205 ao % 65536, an % 65536, udp);
3206 }
3207
3208 #ifdef INET6
3209 static void
pf_change_a6(struct pf_addr * a,u_int16_t * c,struct pf_addr * an,u_int8_t u)3210 pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u)
3211 {
3212 struct pf_addr ao;
3213
3214 PF_ACPY(&ao, a, AF_INET6);
3215 PF_ACPY(a, an, AF_INET6);
3216
3217 *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3218 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3219 pf_cksum_fixup(pf_cksum_fixup(*c,
3220 ao.addr16[0], an->addr16[0], u),
3221 ao.addr16[1], an->addr16[1], u),
3222 ao.addr16[2], an->addr16[2], u),
3223 ao.addr16[3], an->addr16[3], u),
3224 ao.addr16[4], an->addr16[4], u),
3225 ao.addr16[5], an->addr16[5], u),
3226 ao.addr16[6], an->addr16[6], u),
3227 ao.addr16[7], an->addr16[7], u);
3228 }
3229 #endif /* INET6 */
3230
3231 static void
pf_change_icmp(struct pf_addr * ia,u_int16_t * ip,struct pf_addr * oa,struct pf_addr * na,u_int16_t np,u_int16_t * pc,u_int16_t * h2c,u_int16_t * ic,u_int16_t * hc,u_int8_t u,sa_family_t af)3232 pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa,
3233 struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c,
3234 u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af)
3235 {
3236 struct pf_addr oia, ooa;
3237
3238 PF_ACPY(&oia, ia, af);
3239 if (oa)
3240 PF_ACPY(&ooa, oa, af);
3241
3242 /* Change inner protocol port, fix inner protocol checksum. */
3243 if (ip != NULL) {
3244 u_int16_t oip = *ip;
3245 u_int32_t opc;
3246
3247 if (pc != NULL)
3248 opc = *pc;
3249 *ip = np;
3250 if (pc != NULL)
3251 *pc = pf_cksum_fixup(*pc, oip, *ip, u);
3252 *ic = pf_cksum_fixup(*ic, oip, *ip, 0);
3253 if (pc != NULL)
3254 *ic = pf_cksum_fixup(*ic, opc, *pc, 0);
3255 }
3256 /* Change inner ip address, fix inner ip and icmp checksums. */
3257 PF_ACPY(ia, na, af);
3258 switch (af) {
3259 #ifdef INET
3260 case AF_INET: {
3261 u_int32_t oh2c = *h2c;
3262
3263 *h2c = pf_cksum_fixup(pf_cksum_fixup(*h2c,
3264 oia.addr16[0], ia->addr16[0], 0),
3265 oia.addr16[1], ia->addr16[1], 0);
3266 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
3267 oia.addr16[0], ia->addr16[0], 0),
3268 oia.addr16[1], ia->addr16[1], 0);
3269 *ic = pf_cksum_fixup(*ic, oh2c, *h2c, 0);
3270 break;
3271 }
3272 #endif /* INET */
3273 #ifdef INET6
3274 case AF_INET6:
3275 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3276 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3277 pf_cksum_fixup(pf_cksum_fixup(*ic,
3278 oia.addr16[0], ia->addr16[0], u),
3279 oia.addr16[1], ia->addr16[1], u),
3280 oia.addr16[2], ia->addr16[2], u),
3281 oia.addr16[3], ia->addr16[3], u),
3282 oia.addr16[4], ia->addr16[4], u),
3283 oia.addr16[5], ia->addr16[5], u),
3284 oia.addr16[6], ia->addr16[6], u),
3285 oia.addr16[7], ia->addr16[7], u);
3286 break;
3287 #endif /* INET6 */
3288 }
3289 /* Outer ip address, fix outer ip or icmpv6 checksum, if necessary. */
3290 if (oa) {
3291 PF_ACPY(oa, na, af);
3292 switch (af) {
3293 #ifdef INET
3294 case AF_INET:
3295 *hc = pf_cksum_fixup(pf_cksum_fixup(*hc,
3296 ooa.addr16[0], oa->addr16[0], 0),
3297 ooa.addr16[1], oa->addr16[1], 0);
3298 break;
3299 #endif /* INET */
3300 #ifdef INET6
3301 case AF_INET6:
3302 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3303 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
3304 pf_cksum_fixup(pf_cksum_fixup(*ic,
3305 ooa.addr16[0], oa->addr16[0], u),
3306 ooa.addr16[1], oa->addr16[1], u),
3307 ooa.addr16[2], oa->addr16[2], u),
3308 ooa.addr16[3], oa->addr16[3], u),
3309 ooa.addr16[4], oa->addr16[4], u),
3310 ooa.addr16[5], oa->addr16[5], u),
3311 ooa.addr16[6], oa->addr16[6], u),
3312 ooa.addr16[7], oa->addr16[7], u);
3313 break;
3314 #endif /* INET6 */
3315 }
3316 }
3317 }
3318
3319 /*
3320 * Need to modulate the sequence numbers in the TCP SACK option
3321 * (credits to Krzysztof Pfaff for report and patch)
3322 */
3323 static int
pf_modulate_sack(struct pf_pdesc * pd,struct tcphdr * th,struct pf_state_peer * dst)3324 pf_modulate_sack(struct pf_pdesc *pd, struct tcphdr *th,
3325 struct pf_state_peer *dst)
3326 {
3327 int hlen = (th->th_off << 2) - sizeof(*th), thoptlen = hlen;
3328 u_int8_t opts[TCP_MAXOLEN], *opt = opts;
3329 int copyback = 0, i, olen;
3330 struct sackblk sack;
3331
3332 #define TCPOLEN_SACKLEN (TCPOLEN_SACK + 2)
3333 if (hlen < TCPOLEN_SACKLEN ||
3334 !pf_pull_hdr(pd->m, pd->off + sizeof(*th), opts, hlen, NULL, NULL, pd->af))
3335 return 0;
3336
3337 while (hlen >= TCPOLEN_SACKLEN) {
3338 size_t startoff = opt - opts;
3339 olen = opt[1];
3340 switch (*opt) {
3341 case TCPOPT_EOL: /* FALLTHROUGH */
3342 case TCPOPT_NOP:
3343 opt++;
3344 hlen--;
3345 break;
3346 case TCPOPT_SACK:
3347 if (olen > hlen)
3348 olen = hlen;
3349 if (olen >= TCPOLEN_SACKLEN) {
3350 for (i = 2; i + TCPOLEN_SACK <= olen;
3351 i += TCPOLEN_SACK) {
3352 memcpy(&sack, &opt[i], sizeof(sack));
3353 pf_patch_32_unaligned(pd->m,
3354 &th->th_sum, &sack.start,
3355 htonl(ntohl(sack.start) - dst->seqdiff),
3356 PF_ALGNMNT(startoff),
3357 0);
3358 pf_patch_32_unaligned(pd->m, &th->th_sum,
3359 &sack.end,
3360 htonl(ntohl(sack.end) - dst->seqdiff),
3361 PF_ALGNMNT(startoff),
3362 0);
3363 memcpy(&opt[i], &sack, sizeof(sack));
3364 }
3365 copyback = 1;
3366 }
3367 /* FALLTHROUGH */
3368 default:
3369 if (olen < 2)
3370 olen = 2;
3371 hlen -= olen;
3372 opt += olen;
3373 }
3374 }
3375
3376 if (copyback)
3377 m_copyback(pd->m, pd->off + sizeof(*th), thoptlen, (caddr_t)opts);
3378 return (copyback);
3379 }
3380
3381 struct mbuf *
pf_build_tcp(const struct pf_krule * r,sa_family_t af,const struct pf_addr * saddr,const struct pf_addr * daddr,u_int16_t sport,u_int16_t dport,u_int32_t seq,u_int32_t ack,u_int8_t tcp_flags,u_int16_t win,u_int16_t mss,u_int8_t ttl,int mbuf_flags,u_int16_t mtag_tag,u_int16_t mtag_flags,int rtableid)3382 pf_build_tcp(const struct pf_krule *r, sa_family_t af,
3383 const struct pf_addr *saddr, const struct pf_addr *daddr,
3384 u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack,
3385 u_int8_t tcp_flags, u_int16_t win, u_int16_t mss, u_int8_t ttl,
3386 int mbuf_flags, u_int16_t mtag_tag, u_int16_t mtag_flags, int rtableid)
3387 {
3388 struct mbuf *m;
3389 int len, tlen;
3390 #ifdef INET
3391 struct ip *h = NULL;
3392 #endif /* INET */
3393 #ifdef INET6
3394 struct ip6_hdr *h6 = NULL;
3395 #endif /* INET6 */
3396 struct tcphdr *th;
3397 char *opt;
3398 struct pf_mtag *pf_mtag;
3399
3400 len = 0;
3401 th = NULL;
3402
3403 /* maximum segment size tcp option */
3404 tlen = sizeof(struct tcphdr);
3405 if (mss)
3406 tlen += 4;
3407
3408 switch (af) {
3409 #ifdef INET
3410 case AF_INET:
3411 len = sizeof(struct ip) + tlen;
3412 break;
3413 #endif /* INET */
3414 #ifdef INET6
3415 case AF_INET6:
3416 len = sizeof(struct ip6_hdr) + tlen;
3417 break;
3418 #endif /* INET6 */
3419 }
3420
3421 m = m_gethdr(M_NOWAIT, MT_DATA);
3422 if (m == NULL)
3423 return (NULL);
3424
3425 #ifdef MAC
3426 mac_netinet_firewall_send(m);
3427 #endif
3428 if ((pf_mtag = pf_get_mtag(m)) == NULL) {
3429 m_freem(m);
3430 return (NULL);
3431 }
3432 m->m_flags |= mbuf_flags;
3433 pf_mtag->tag = mtag_tag;
3434 pf_mtag->flags = mtag_flags;
3435
3436 if (rtableid >= 0)
3437 M_SETFIB(m, rtableid);
3438
3439 #ifdef ALTQ
3440 if (r != NULL && r->qid) {
3441 pf_mtag->qid = r->qid;
3442
3443 /* add hints for ecn */
3444 pf_mtag->hdr = mtod(m, struct ip *);
3445 }
3446 #endif /* ALTQ */
3447 m->m_data += max_linkhdr;
3448 m->m_pkthdr.len = m->m_len = len;
3449 /* The rest of the stack assumes a rcvif, so provide one.
3450 * This is a locally generated packet, so .. close enough. */
3451 m->m_pkthdr.rcvif = V_loif;
3452 bzero(m->m_data, len);
3453 switch (af) {
3454 #ifdef INET
3455 case AF_INET:
3456 h = mtod(m, struct ip *);
3457
3458 /* IP header fields included in the TCP checksum */
3459 h->ip_p = IPPROTO_TCP;
3460 h->ip_len = htons(tlen);
3461 h->ip_src.s_addr = saddr->v4.s_addr;
3462 h->ip_dst.s_addr = daddr->v4.s_addr;
3463
3464 th = (struct tcphdr *)((caddr_t)h + sizeof(struct ip));
3465 break;
3466 #endif /* INET */
3467 #ifdef INET6
3468 case AF_INET6:
3469 h6 = mtod(m, struct ip6_hdr *);
3470
3471 /* IP header fields included in the TCP checksum */
3472 h6->ip6_nxt = IPPROTO_TCP;
3473 h6->ip6_plen = htons(tlen);
3474 memcpy(&h6->ip6_src, &saddr->v6, sizeof(struct in6_addr));
3475 memcpy(&h6->ip6_dst, &daddr->v6, sizeof(struct in6_addr));
3476
3477 th = (struct tcphdr *)((caddr_t)h6 + sizeof(struct ip6_hdr));
3478 break;
3479 #endif /* INET6 */
3480 }
3481
3482 /* TCP header */
3483 th->th_sport = sport;
3484 th->th_dport = dport;
3485 th->th_seq = htonl(seq);
3486 th->th_ack = htonl(ack);
3487 th->th_off = tlen >> 2;
3488 tcp_set_flags(th, tcp_flags);
3489 th->th_win = htons(win);
3490
3491 if (mss) {
3492 opt = (char *)(th + 1);
3493 opt[0] = TCPOPT_MAXSEG;
3494 opt[1] = 4;
3495 HTONS(mss);
3496 bcopy((caddr_t)&mss, (caddr_t)(opt + 2), 2);
3497 }
3498
3499 switch (af) {
3500 #ifdef INET
3501 case AF_INET:
3502 /* TCP checksum */
3503 th->th_sum = in_cksum(m, len);
3504
3505 /* Finish the IP header */
3506 h->ip_v = 4;
3507 h->ip_hl = sizeof(*h) >> 2;
3508 h->ip_tos = IPTOS_LOWDELAY;
3509 h->ip_off = htons(V_path_mtu_discovery ? IP_DF : 0);
3510 h->ip_len = htons(len);
3511 h->ip_ttl = ttl ? ttl : V_ip_defttl;
3512 h->ip_sum = 0;
3513 break;
3514 #endif /* INET */
3515 #ifdef INET6
3516 case AF_INET6:
3517 /* TCP checksum */
3518 th->th_sum = in6_cksum(m, IPPROTO_TCP,
3519 sizeof(struct ip6_hdr), tlen);
3520
3521 h6->ip6_vfc |= IPV6_VERSION;
3522 h6->ip6_hlim = IPV6_DEFHLIM;
3523 break;
3524 #endif /* INET6 */
3525 }
3526
3527 return (m);
3528 }
3529
3530 static void
pf_send_sctp_abort(sa_family_t af,struct pf_pdesc * pd,uint8_t ttl,int rtableid)3531 pf_send_sctp_abort(sa_family_t af, struct pf_pdesc *pd,
3532 uint8_t ttl, int rtableid)
3533 {
3534 struct mbuf *m;
3535 #ifdef INET
3536 struct ip *h = NULL;
3537 #endif /* INET */
3538 #ifdef INET6
3539 struct ip6_hdr *h6 = NULL;
3540 #endif /* INET6 */
3541 struct sctphdr *hdr;
3542 struct sctp_chunkhdr *chunk;
3543 struct pf_send_entry *pfse;
3544 int off = 0;
3545
3546 MPASS(af == pd->af);
3547
3548 m = m_gethdr(M_NOWAIT, MT_DATA);
3549 if (m == NULL)
3550 return;
3551
3552 m->m_data += max_linkhdr;
3553 m->m_flags |= M_SKIP_FIREWALL;
3554 /* The rest of the stack assumes a rcvif, so provide one.
3555 * This is a locally generated packet, so .. close enough. */
3556 m->m_pkthdr.rcvif = V_loif;
3557
3558 /* IPv4|6 header */
3559 switch (af) {
3560 #ifdef INET
3561 case AF_INET:
3562 bzero(m->m_data, sizeof(struct ip) + sizeof(*hdr) + sizeof(*chunk));
3563
3564 h = mtod(m, struct ip *);
3565
3566 /* IP header fields included in the TCP checksum */
3567
3568 h->ip_p = IPPROTO_SCTP;
3569 h->ip_len = htons(sizeof(*h) + sizeof(*hdr) + sizeof(*chunk));
3570 h->ip_ttl = ttl ? ttl : V_ip_defttl;
3571 h->ip_src = pd->dst->v4;
3572 h->ip_dst = pd->src->v4;
3573
3574 off += sizeof(struct ip);
3575 break;
3576 #endif /* INET */
3577 #ifdef INET6
3578 case AF_INET6:
3579 bzero(m->m_data, sizeof(struct ip6_hdr) + sizeof(*hdr) + sizeof(*chunk));
3580
3581 h6 = mtod(m, struct ip6_hdr *);
3582
3583 /* IP header fields included in the TCP checksum */
3584 h6->ip6_vfc |= IPV6_VERSION;
3585 h6->ip6_nxt = IPPROTO_SCTP;
3586 h6->ip6_plen = htons(sizeof(*h6) + sizeof(*hdr) + sizeof(*chunk));
3587 h6->ip6_hlim = ttl ? ttl : V_ip6_defhlim;
3588 memcpy(&h6->ip6_src, &pd->dst->v6, sizeof(struct in6_addr));
3589 memcpy(&h6->ip6_dst, &pd->src->v6, sizeof(struct in6_addr));
3590
3591 off += sizeof(struct ip6_hdr);
3592 break;
3593 #endif /* INET6 */
3594 }
3595
3596 /* SCTP header */
3597 hdr = mtodo(m, off);
3598
3599 hdr->src_port = pd->hdr.sctp.dest_port;
3600 hdr->dest_port = pd->hdr.sctp.src_port;
3601 hdr->v_tag = pd->sctp_initiate_tag;
3602 hdr->checksum = 0;
3603
3604 /* Abort chunk. */
3605 off += sizeof(struct sctphdr);
3606 chunk = mtodo(m, off);
3607
3608 chunk->chunk_type = SCTP_ABORT_ASSOCIATION;
3609 chunk->chunk_length = htons(sizeof(*chunk));
3610
3611 /* SCTP checksum */
3612 off += sizeof(*chunk);
3613 m->m_pkthdr.len = m->m_len = off;
3614
3615 pf_sctp_checksum(m, off - sizeof(*hdr) - sizeof(*chunk));
3616
3617 if (rtableid >= 0)
3618 M_SETFIB(m, rtableid);
3619
3620 /* Allocate outgoing queue entry, mbuf and mbuf tag. */
3621 pfse = malloc(sizeof(*pfse), M_PFTEMP, M_NOWAIT);
3622 if (pfse == NULL) {
3623 m_freem(m);
3624 return;
3625 }
3626
3627 switch (af) {
3628 #ifdef INET
3629 case AF_INET:
3630 pfse->pfse_type = PFSE_IP;
3631 break;
3632 #endif /* INET */
3633 #ifdef INET6
3634 case AF_INET6:
3635 pfse->pfse_type = PFSE_IP6;
3636 break;
3637 #endif /* INET6 */
3638 }
3639
3640 pfse->pfse_m = m;
3641 pf_send(pfse);
3642 }
3643
3644 void
pf_send_tcp(const struct pf_krule * r,sa_family_t af,const struct pf_addr * saddr,const struct pf_addr * daddr,u_int16_t sport,u_int16_t dport,u_int32_t seq,u_int32_t ack,u_int8_t tcp_flags,u_int16_t win,u_int16_t mss,u_int8_t ttl,int mbuf_flags,u_int16_t mtag_tag,u_int16_t mtag_flags,int rtableid)3645 pf_send_tcp(const struct pf_krule *r, sa_family_t af,
3646 const struct pf_addr *saddr, const struct pf_addr *daddr,
3647 u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack,
3648 u_int8_t tcp_flags, u_int16_t win, u_int16_t mss, u_int8_t ttl,
3649 int mbuf_flags, u_int16_t mtag_tag, u_int16_t mtag_flags, int rtableid)
3650 {
3651 struct pf_send_entry *pfse;
3652 struct mbuf *m;
3653
3654 m = pf_build_tcp(r, af, saddr, daddr, sport, dport, seq, ack, tcp_flags,
3655 win, mss, ttl, mbuf_flags, mtag_tag, mtag_flags, rtableid);
3656 if (m == NULL)
3657 return;
3658
3659 /* Allocate outgoing queue entry, mbuf and mbuf tag. */
3660 pfse = malloc(sizeof(*pfse), M_PFTEMP, M_NOWAIT);
3661 if (pfse == NULL) {
3662 m_freem(m);
3663 return;
3664 }
3665
3666 switch (af) {
3667 #ifdef INET
3668 case AF_INET:
3669 pfse->pfse_type = PFSE_IP;
3670 break;
3671 #endif /* INET */
3672 #ifdef INET6
3673 case AF_INET6:
3674 pfse->pfse_type = PFSE_IP6;
3675 break;
3676 #endif /* INET6 */
3677 }
3678
3679 pfse->pfse_m = m;
3680 pf_send(pfse);
3681 }
3682
3683 static void
pf_return(struct pf_krule * r,struct pf_krule * nr,struct pf_pdesc * pd,struct pf_state_key * sk,struct tcphdr * th,u_int16_t bproto_sum,u_int16_t bip_sum,u_short * reason,int rtableid)3684 pf_return(struct pf_krule *r, struct pf_krule *nr, struct pf_pdesc *pd,
3685 struct pf_state_key *sk, struct tcphdr *th,
3686 u_int16_t bproto_sum, u_int16_t bip_sum,
3687 u_short *reason, int rtableid)
3688 {
3689 struct pf_addr * const saddr = pd->src;
3690 struct pf_addr * const daddr = pd->dst;
3691
3692 /* undo NAT changes, if they have taken place */
3693 if (nr != NULL) {
3694 PF_ACPY(saddr, &sk->addr[pd->sidx], pd->af);
3695 PF_ACPY(daddr, &sk->addr[pd->didx], pd->af);
3696 if (pd->sport)
3697 *pd->sport = sk->port[pd->sidx];
3698 if (pd->dport)
3699 *pd->dport = sk->port[pd->didx];
3700 if (pd->ip_sum)
3701 *pd->ip_sum = bip_sum;
3702 m_copyback(pd->m, pd->off, pd->hdrlen, pd->hdr.any);
3703 }
3704 if (pd->proto == IPPROTO_TCP &&
3705 ((r->rule_flag & PFRULE_RETURNRST) ||
3706 (r->rule_flag & PFRULE_RETURN)) &&
3707 !(tcp_get_flags(th) & TH_RST)) {
3708 u_int32_t ack = ntohl(th->th_seq) + pd->p_len;
3709
3710 if (pf_check_proto_cksum(pd->m, pd->off, pd->tot_len - pd->off,
3711 IPPROTO_TCP, pd->af))
3712 REASON_SET(reason, PFRES_PROTCKSUM);
3713 else {
3714 if (tcp_get_flags(th) & TH_SYN)
3715 ack++;
3716 if (tcp_get_flags(th) & TH_FIN)
3717 ack++;
3718 pf_send_tcp(r, pd->af, pd->dst,
3719 pd->src, th->th_dport, th->th_sport,
3720 ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0,
3721 r->return_ttl, M_SKIP_FIREWALL, 0, 0, rtableid);
3722 }
3723 } else if (pd->proto == IPPROTO_SCTP &&
3724 (r->rule_flag & PFRULE_RETURN)) {
3725 pf_send_sctp_abort(pd->af, pd, r->return_ttl, rtableid);
3726 } else if (pd->proto != IPPROTO_ICMP && pd->af == AF_INET &&
3727 r->return_icmp)
3728 pf_send_icmp(pd->m, r->return_icmp >> 8,
3729 r->return_icmp & 255, pd->af, r, rtableid);
3730 else if (pd->proto != IPPROTO_ICMPV6 && pd->af == AF_INET6 &&
3731 r->return_icmp6)
3732 pf_send_icmp(pd->m, r->return_icmp6 >> 8,
3733 r->return_icmp6 & 255, pd->af, r, rtableid);
3734 }
3735
3736 static int
pf_match_ieee8021q_pcp(u_int8_t prio,struct mbuf * m)3737 pf_match_ieee8021q_pcp(u_int8_t prio, struct mbuf *m)
3738 {
3739 struct m_tag *mtag;
3740 u_int8_t mpcp;
3741
3742 mtag = m_tag_locate(m, MTAG_8021Q, MTAG_8021Q_PCP_IN, NULL);
3743 if (mtag == NULL)
3744 return (0);
3745
3746 if (prio == PF_PRIO_ZERO)
3747 prio = 0;
3748
3749 mpcp = *(uint8_t *)(mtag + 1);
3750
3751 return (mpcp == prio);
3752 }
3753
3754 static int
pf_icmp_to_bandlim(uint8_t type)3755 pf_icmp_to_bandlim(uint8_t type)
3756 {
3757 switch (type) {
3758 case ICMP_ECHO:
3759 case ICMP_ECHOREPLY:
3760 return (BANDLIM_ICMP_ECHO);
3761 case ICMP_TSTAMP:
3762 case ICMP_TSTAMPREPLY:
3763 return (BANDLIM_ICMP_TSTAMP);
3764 case ICMP_UNREACH:
3765 default:
3766 return (BANDLIM_ICMP_UNREACH);
3767 }
3768 }
3769
3770 static void
pf_send_icmp(struct mbuf * m,u_int8_t type,u_int8_t code,sa_family_t af,struct pf_krule * r,int rtableid)3771 pf_send_icmp(struct mbuf *m, u_int8_t type, u_int8_t code, sa_family_t af,
3772 struct pf_krule *r, int rtableid)
3773 {
3774 struct pf_send_entry *pfse;
3775 struct mbuf *m0;
3776 struct pf_mtag *pf_mtag;
3777
3778 /* ICMP packet rate limitation. */
3779 switch (af) {
3780 #ifdef INET6
3781 case AF_INET6:
3782 if (icmp6_ratelimit(NULL, type, code))
3783 return;
3784 break;
3785 #endif
3786 #ifdef INET
3787 case AF_INET:
3788 if (badport_bandlim(pf_icmp_to_bandlim(type)) != 0)
3789 return;
3790 break;
3791 #endif
3792 }
3793
3794 /* Allocate outgoing queue entry, mbuf and mbuf tag. */
3795 pfse = malloc(sizeof(*pfse), M_PFTEMP, M_NOWAIT);
3796 if (pfse == NULL)
3797 return;
3798
3799 if ((m0 = m_copypacket(m, M_NOWAIT)) == NULL) {
3800 free(pfse, M_PFTEMP);
3801 return;
3802 }
3803
3804 if ((pf_mtag = pf_get_mtag(m0)) == NULL) {
3805 free(pfse, M_PFTEMP);
3806 return;
3807 }
3808 /* XXX: revisit */
3809 m0->m_flags |= M_SKIP_FIREWALL;
3810
3811 if (rtableid >= 0)
3812 M_SETFIB(m0, rtableid);
3813
3814 #ifdef ALTQ
3815 if (r->qid) {
3816 pf_mtag->qid = r->qid;
3817 /* add hints for ecn */
3818 pf_mtag->hdr = mtod(m0, struct ip *);
3819 }
3820 #endif /* ALTQ */
3821
3822 switch (af) {
3823 #ifdef INET
3824 case AF_INET:
3825 pfse->pfse_type = PFSE_ICMP;
3826 break;
3827 #endif /* INET */
3828 #ifdef INET6
3829 case AF_INET6:
3830 pfse->pfse_type = PFSE_ICMP6;
3831 break;
3832 #endif /* INET6 */
3833 }
3834 pfse->pfse_m = m0;
3835 pfse->icmpopts.type = type;
3836 pfse->icmpopts.code = code;
3837 pf_send(pfse);
3838 }
3839
3840 /*
3841 * Return 1 if the addresses a and b match (with mask m), otherwise return 0.
3842 * If n is 0, they match if they are equal. If n is != 0, they match if they
3843 * are different.
3844 */
3845 int
pf_match_addr(u_int8_t n,struct pf_addr * a,struct pf_addr * m,struct pf_addr * b,sa_family_t af)3846 pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m,
3847 struct pf_addr *b, sa_family_t af)
3848 {
3849 int match = 0;
3850
3851 switch (af) {
3852 #ifdef INET
3853 case AF_INET:
3854 if (IN_ARE_MASKED_ADDR_EQUAL(a->v4, b->v4, m->v4))
3855 match++;
3856 break;
3857 #endif /* INET */
3858 #ifdef INET6
3859 case AF_INET6:
3860 if (IN6_ARE_MASKED_ADDR_EQUAL(&a->v6, &b->v6, &m->v6))
3861 match++;
3862 break;
3863 #endif /* INET6 */
3864 }
3865 if (match) {
3866 if (n)
3867 return (0);
3868 else
3869 return (1);
3870 } else {
3871 if (n)
3872 return (1);
3873 else
3874 return (0);
3875 }
3876 }
3877
3878 /*
3879 * Return 1 if b <= a <= e, otherwise return 0.
3880 */
3881 int
pf_match_addr_range(struct pf_addr * b,struct pf_addr * e,struct pf_addr * a,sa_family_t af)3882 pf_match_addr_range(struct pf_addr *b, struct pf_addr *e,
3883 struct pf_addr *a, sa_family_t af)
3884 {
3885 switch (af) {
3886 #ifdef INET
3887 case AF_INET:
3888 if ((ntohl(a->addr32[0]) < ntohl(b->addr32[0])) ||
3889 (ntohl(a->addr32[0]) > ntohl(e->addr32[0])))
3890 return (0);
3891 break;
3892 #endif /* INET */
3893 #ifdef INET6
3894 case AF_INET6: {
3895 int i;
3896
3897 /* check a >= b */
3898 for (i = 0; i < 4; ++i)
3899 if (ntohl(a->addr32[i]) > ntohl(b->addr32[i]))
3900 break;
3901 else if (ntohl(a->addr32[i]) < ntohl(b->addr32[i]))
3902 return (0);
3903 /* check a <= e */
3904 for (i = 0; i < 4; ++i)
3905 if (ntohl(a->addr32[i]) < ntohl(e->addr32[i]))
3906 break;
3907 else if (ntohl(a->addr32[i]) > ntohl(e->addr32[i]))
3908 return (0);
3909 break;
3910 }
3911 #endif /* INET6 */
3912 }
3913 return (1);
3914 }
3915
3916 static int
pf_match(u_int8_t op,u_int32_t a1,u_int32_t a2,u_int32_t p)3917 pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p)
3918 {
3919 switch (op) {
3920 case PF_OP_IRG:
3921 return ((p > a1) && (p < a2));
3922 case PF_OP_XRG:
3923 return ((p < a1) || (p > a2));
3924 case PF_OP_RRG:
3925 return ((p >= a1) && (p <= a2));
3926 case PF_OP_EQ:
3927 return (p == a1);
3928 case PF_OP_NE:
3929 return (p != a1);
3930 case PF_OP_LT:
3931 return (p < a1);
3932 case PF_OP_LE:
3933 return (p <= a1);
3934 case PF_OP_GT:
3935 return (p > a1);
3936 case PF_OP_GE:
3937 return (p >= a1);
3938 }
3939 return (0); /* never reached */
3940 }
3941
3942 int
pf_match_port(u_int8_t op,u_int16_t a1,u_int16_t a2,u_int16_t p)3943 pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p)
3944 {
3945 NTOHS(a1);
3946 NTOHS(a2);
3947 NTOHS(p);
3948 return (pf_match(op, a1, a2, p));
3949 }
3950
3951 static int
pf_match_uid(u_int8_t op,uid_t a1,uid_t a2,uid_t u)3952 pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u)
3953 {
3954 if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE)
3955 return (0);
3956 return (pf_match(op, a1, a2, u));
3957 }
3958
3959 static int
pf_match_gid(u_int8_t op,gid_t a1,gid_t a2,gid_t g)3960 pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g)
3961 {
3962 if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE)
3963 return (0);
3964 return (pf_match(op, a1, a2, g));
3965 }
3966
3967 int
pf_match_tag(struct mbuf * m,struct pf_krule * r,int * tag,int mtag)3968 pf_match_tag(struct mbuf *m, struct pf_krule *r, int *tag, int mtag)
3969 {
3970 if (*tag == -1)
3971 *tag = mtag;
3972
3973 return ((!r->match_tag_not && r->match_tag == *tag) ||
3974 (r->match_tag_not && r->match_tag != *tag));
3975 }
3976
3977 static int
pf_match_rcvif(struct mbuf * m,struct pf_krule * r)3978 pf_match_rcvif(struct mbuf *m, struct pf_krule *r)
3979 {
3980 struct ifnet *ifp = m->m_pkthdr.rcvif;
3981 struct pfi_kkif *kif;
3982
3983 if (ifp == NULL)
3984 return (0);
3985
3986 kif = (struct pfi_kkif *)ifp->if_pf_kif;
3987
3988 if (kif == NULL) {
3989 DPFPRINTF(PF_DEBUG_URGENT,
3990 ("pf_test_via: kif == NULL, @%d via %s\n", r->nr,
3991 r->rcv_ifname));
3992 return (0);
3993 }
3994
3995 return (pfi_kkif_match(r->rcv_kif, kif));
3996 }
3997
3998 int
pf_tag_packet(struct pf_pdesc * pd,int tag)3999 pf_tag_packet(struct pf_pdesc *pd, int tag)
4000 {
4001
4002 KASSERT(tag > 0, ("%s: tag %d", __func__, tag));
4003
4004 if (pd->pf_mtag == NULL && ((pd->pf_mtag = pf_get_mtag(pd->m)) == NULL))
4005 return (ENOMEM);
4006
4007 pd->pf_mtag->tag = tag;
4008
4009 return (0);
4010 }
4011
4012 #define PF_ANCHOR_STACKSIZE 32
4013 struct pf_kanchor_stackframe {
4014 struct pf_kruleset *rs;
4015 struct pf_krule *r; /* XXX: + match bit */
4016 struct pf_kanchor *child;
4017 };
4018
4019 /*
4020 * XXX: We rely on malloc(9) returning pointer aligned addresses.
4021 */
4022 #define PF_ANCHORSTACK_MATCH 0x00000001
4023 #define PF_ANCHORSTACK_MASK (PF_ANCHORSTACK_MATCH)
4024
4025 #define PF_ANCHOR_MATCH(f) ((uintptr_t)(f)->r & PF_ANCHORSTACK_MATCH)
4026 #define PF_ANCHOR_RULE(f) (struct pf_krule *) \
4027 ((uintptr_t)(f)->r & ~PF_ANCHORSTACK_MASK)
4028 #define PF_ANCHOR_SET_MATCH(f) do { (f)->r = (void *) \
4029 ((uintptr_t)(f)->r | PF_ANCHORSTACK_MATCH); \
4030 } while (0)
4031
4032 void
pf_step_into_anchor(struct pf_kanchor_stackframe * stack,int * depth,struct pf_kruleset ** rs,int n,struct pf_krule ** r,struct pf_krule ** a,int * match)4033 pf_step_into_anchor(struct pf_kanchor_stackframe *stack, int *depth,
4034 struct pf_kruleset **rs, int n, struct pf_krule **r, struct pf_krule **a,
4035 int *match)
4036 {
4037 struct pf_kanchor_stackframe *f;
4038
4039 PF_RULES_RASSERT();
4040
4041 if (match)
4042 *match = 0;
4043 if (*depth >= PF_ANCHOR_STACKSIZE) {
4044 printf("%s: anchor stack overflow on %s\n",
4045 __func__, (*r)->anchor->name);
4046 *r = TAILQ_NEXT(*r, entries);
4047 return;
4048 } else if (*depth == 0 && a != NULL)
4049 *a = *r;
4050 f = stack + (*depth)++;
4051 f->rs = *rs;
4052 f->r = *r;
4053 if ((*r)->anchor_wildcard) {
4054 struct pf_kanchor_node *parent = &(*r)->anchor->children;
4055
4056 if ((f->child = RB_MIN(pf_kanchor_node, parent)) == NULL) {
4057 *r = NULL;
4058 return;
4059 }
4060 *rs = &f->child->ruleset;
4061 } else {
4062 f->child = NULL;
4063 *rs = &(*r)->anchor->ruleset;
4064 }
4065 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
4066 }
4067
4068 int
pf_step_out_of_anchor(struct pf_kanchor_stackframe * stack,int * depth,struct pf_kruleset ** rs,int n,struct pf_krule ** r,struct pf_krule ** a,int * match)4069 pf_step_out_of_anchor(struct pf_kanchor_stackframe *stack, int *depth,
4070 struct pf_kruleset **rs, int n, struct pf_krule **r, struct pf_krule **a,
4071 int *match)
4072 {
4073 struct pf_kanchor_stackframe *f;
4074 struct pf_krule *fr;
4075 int quick = 0;
4076
4077 PF_RULES_RASSERT();
4078
4079 do {
4080 if (*depth <= 0)
4081 break;
4082 f = stack + *depth - 1;
4083 fr = PF_ANCHOR_RULE(f);
4084 if (f->child != NULL) {
4085 /*
4086 * This block traverses through
4087 * a wildcard anchor.
4088 */
4089 if (match != NULL && *match) {
4090 /*
4091 * If any of "*" matched, then
4092 * "foo/ *" matched, mark frame
4093 * appropriately.
4094 */
4095 PF_ANCHOR_SET_MATCH(f);
4096 *match = 0;
4097 }
4098 f->child = RB_NEXT(pf_kanchor_node,
4099 &fr->anchor->children, f->child);
4100 if (f->child != NULL) {
4101 *rs = &f->child->ruleset;
4102 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
4103 if (*r == NULL)
4104 continue;
4105 else
4106 break;
4107 }
4108 }
4109 (*depth)--;
4110 if (*depth == 0 && a != NULL)
4111 *a = NULL;
4112 *rs = f->rs;
4113 if (PF_ANCHOR_MATCH(f) || (match != NULL && *match))
4114 quick = fr->quick;
4115 *r = TAILQ_NEXT(fr, entries);
4116 } while (*r == NULL);
4117
4118 return (quick);
4119 }
4120
4121 struct pf_keth_anchor_stackframe {
4122 struct pf_keth_ruleset *rs;
4123 struct pf_keth_rule *r; /* XXX: + match bit */
4124 struct pf_keth_anchor *child;
4125 };
4126
4127 #define PF_ETH_ANCHOR_MATCH(f) ((uintptr_t)(f)->r & PF_ANCHORSTACK_MATCH)
4128 #define PF_ETH_ANCHOR_RULE(f) (struct pf_keth_rule *) \
4129 ((uintptr_t)(f)->r & ~PF_ANCHORSTACK_MASK)
4130 #define PF_ETH_ANCHOR_SET_MATCH(f) do { (f)->r = (void *) \
4131 ((uintptr_t)(f)->r | PF_ANCHORSTACK_MATCH); \
4132 } while (0)
4133
4134 void
pf_step_into_keth_anchor(struct pf_keth_anchor_stackframe * stack,int * depth,struct pf_keth_ruleset ** rs,struct pf_keth_rule ** r,struct pf_keth_rule ** a,int * match)4135 pf_step_into_keth_anchor(struct pf_keth_anchor_stackframe *stack, int *depth,
4136 struct pf_keth_ruleset **rs, struct pf_keth_rule **r,
4137 struct pf_keth_rule **a, int *match)
4138 {
4139 struct pf_keth_anchor_stackframe *f;
4140
4141 NET_EPOCH_ASSERT();
4142
4143 if (match)
4144 *match = 0;
4145 if (*depth >= PF_ANCHOR_STACKSIZE) {
4146 printf("%s: anchor stack overflow on %s\n",
4147 __func__, (*r)->anchor->name);
4148 *r = TAILQ_NEXT(*r, entries);
4149 return;
4150 } else if (*depth == 0 && a != NULL)
4151 *a = *r;
4152 f = stack + (*depth)++;
4153 f->rs = *rs;
4154 f->r = *r;
4155 if ((*r)->anchor_wildcard) {
4156 struct pf_keth_anchor_node *parent = &(*r)->anchor->children;
4157
4158 if ((f->child = RB_MIN(pf_keth_anchor_node, parent)) == NULL) {
4159 *r = NULL;
4160 return;
4161 }
4162 *rs = &f->child->ruleset;
4163 } else {
4164 f->child = NULL;
4165 *rs = &(*r)->anchor->ruleset;
4166 }
4167 *r = TAILQ_FIRST((*rs)->active.rules);
4168 }
4169
4170 int
pf_step_out_of_keth_anchor(struct pf_keth_anchor_stackframe * stack,int * depth,struct pf_keth_ruleset ** rs,struct pf_keth_rule ** r,struct pf_keth_rule ** a,int * match)4171 pf_step_out_of_keth_anchor(struct pf_keth_anchor_stackframe *stack, int *depth,
4172 struct pf_keth_ruleset **rs, struct pf_keth_rule **r,
4173 struct pf_keth_rule **a, int *match)
4174 {
4175 struct pf_keth_anchor_stackframe *f;
4176 struct pf_keth_rule *fr;
4177 int quick = 0;
4178
4179 NET_EPOCH_ASSERT();
4180
4181 do {
4182 if (*depth <= 0)
4183 break;
4184 f = stack + *depth - 1;
4185 fr = PF_ETH_ANCHOR_RULE(f);
4186 if (f->child != NULL) {
4187 /*
4188 * This block traverses through
4189 * a wildcard anchor.
4190 */
4191 if (match != NULL && *match) {
4192 /*
4193 * If any of "*" matched, then
4194 * "foo/ *" matched, mark frame
4195 * appropriately.
4196 */
4197 PF_ETH_ANCHOR_SET_MATCH(f);
4198 *match = 0;
4199 }
4200 f->child = RB_NEXT(pf_keth_anchor_node,
4201 &fr->anchor->children, f->child);
4202 if (f->child != NULL) {
4203 *rs = &f->child->ruleset;
4204 *r = TAILQ_FIRST((*rs)->active.rules);
4205 if (*r == NULL)
4206 continue;
4207 else
4208 break;
4209 }
4210 }
4211 (*depth)--;
4212 if (*depth == 0 && a != NULL)
4213 *a = NULL;
4214 *rs = f->rs;
4215 if (PF_ETH_ANCHOR_MATCH(f) || (match != NULL && *match))
4216 quick = fr->quick;
4217 *r = TAILQ_NEXT(fr, entries);
4218 } while (*r == NULL);
4219
4220 return (quick);
4221 }
4222
4223 #ifdef INET6
4224 void
pf_poolmask(struct pf_addr * naddr,struct pf_addr * raddr,struct pf_addr * rmask,struct pf_addr * saddr,sa_family_t af)4225 pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr,
4226 struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af)
4227 {
4228 switch (af) {
4229 #ifdef INET
4230 case AF_INET:
4231 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
4232 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]);
4233 break;
4234 #endif /* INET */
4235 case AF_INET6:
4236 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
4237 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]);
4238 naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) |
4239 ((rmask->addr32[1] ^ 0xffffffff ) & saddr->addr32[1]);
4240 naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) |
4241 ((rmask->addr32[2] ^ 0xffffffff ) & saddr->addr32[2]);
4242 naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) |
4243 ((rmask->addr32[3] ^ 0xffffffff ) & saddr->addr32[3]);
4244 break;
4245 }
4246 }
4247
4248 void
pf_addr_inc(struct pf_addr * addr,sa_family_t af)4249 pf_addr_inc(struct pf_addr *addr, sa_family_t af)
4250 {
4251 switch (af) {
4252 #ifdef INET
4253 case AF_INET:
4254 addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1);
4255 break;
4256 #endif /* INET */
4257 case AF_INET6:
4258 if (addr->addr32[3] == 0xffffffff) {
4259 addr->addr32[3] = 0;
4260 if (addr->addr32[2] == 0xffffffff) {
4261 addr->addr32[2] = 0;
4262 if (addr->addr32[1] == 0xffffffff) {
4263 addr->addr32[1] = 0;
4264 addr->addr32[0] =
4265 htonl(ntohl(addr->addr32[0]) + 1);
4266 } else
4267 addr->addr32[1] =
4268 htonl(ntohl(addr->addr32[1]) + 1);
4269 } else
4270 addr->addr32[2] =
4271 htonl(ntohl(addr->addr32[2]) + 1);
4272 } else
4273 addr->addr32[3] =
4274 htonl(ntohl(addr->addr32[3]) + 1);
4275 break;
4276 }
4277 }
4278 #endif /* INET6 */
4279
4280 void
pf_rule_to_actions(struct pf_krule * r,struct pf_rule_actions * a)4281 pf_rule_to_actions(struct pf_krule *r, struct pf_rule_actions *a)
4282 {
4283 /*
4284 * Modern rules use the same flags in rules as they do in states.
4285 */
4286 a->flags |= (r->scrub_flags & (PFSTATE_NODF|PFSTATE_RANDOMID|
4287 PFSTATE_SCRUB_TCP|PFSTATE_SETPRIO));
4288
4289 /*
4290 * Old-style scrub rules have different flags which need to be translated.
4291 */
4292 if (r->rule_flag & PFRULE_RANDOMID)
4293 a->flags |= PFSTATE_RANDOMID;
4294 if (r->scrub_flags & PFSTATE_SETTOS || r->rule_flag & PFRULE_SET_TOS ) {
4295 a->flags |= PFSTATE_SETTOS;
4296 a->set_tos = r->set_tos;
4297 }
4298
4299 if (r->qid)
4300 a->qid = r->qid;
4301 if (r->pqid)
4302 a->pqid = r->pqid;
4303 if (r->rtableid >= 0)
4304 a->rtableid = r->rtableid;
4305 a->log |= r->log;
4306 if (r->min_ttl)
4307 a->min_ttl = r->min_ttl;
4308 if (r->max_mss)
4309 a->max_mss = r->max_mss;
4310 if (r->dnpipe)
4311 a->dnpipe = r->dnpipe;
4312 if (r->dnrpipe)
4313 a->dnrpipe = r->dnrpipe;
4314 if (r->dnpipe || r->dnrpipe) {
4315 if (r->free_flags & PFRULE_DN_IS_PIPE)
4316 a->flags |= PFSTATE_DN_IS_PIPE;
4317 else
4318 a->flags &= ~PFSTATE_DN_IS_PIPE;
4319 }
4320 if (r->scrub_flags & PFSTATE_SETPRIO) {
4321 a->set_prio[0] = r->set_prio[0];
4322 a->set_prio[1] = r->set_prio[1];
4323 }
4324 }
4325
4326 int
pf_socket_lookup(struct pf_pdesc * pd)4327 pf_socket_lookup(struct pf_pdesc *pd)
4328 {
4329 struct pf_addr *saddr, *daddr;
4330 u_int16_t sport, dport;
4331 struct inpcbinfo *pi;
4332 struct inpcb *inp;
4333
4334 pd->lookup.uid = UID_MAX;
4335 pd->lookup.gid = GID_MAX;
4336
4337 switch (pd->proto) {
4338 case IPPROTO_TCP:
4339 sport = pd->hdr.tcp.th_sport;
4340 dport = pd->hdr.tcp.th_dport;
4341 pi = &V_tcbinfo;
4342 break;
4343 case IPPROTO_UDP:
4344 sport = pd->hdr.udp.uh_sport;
4345 dport = pd->hdr.udp.uh_dport;
4346 pi = &V_udbinfo;
4347 break;
4348 default:
4349 return (-1);
4350 }
4351 if (pd->dir == PF_IN) {
4352 saddr = pd->src;
4353 daddr = pd->dst;
4354 } else {
4355 u_int16_t p;
4356
4357 p = sport;
4358 sport = dport;
4359 dport = p;
4360 saddr = pd->dst;
4361 daddr = pd->src;
4362 }
4363 switch (pd->af) {
4364 #ifdef INET
4365 case AF_INET:
4366 inp = in_pcblookup_mbuf(pi, saddr->v4, sport, daddr->v4,
4367 dport, INPLOOKUP_RLOCKPCB, NULL, pd->m);
4368 if (inp == NULL) {
4369 inp = in_pcblookup_mbuf(pi, saddr->v4, sport,
4370 daddr->v4, dport, INPLOOKUP_WILDCARD |
4371 INPLOOKUP_RLOCKPCB, NULL, pd->m);
4372 if (inp == NULL)
4373 return (-1);
4374 }
4375 break;
4376 #endif /* INET */
4377 #ifdef INET6
4378 case AF_INET6:
4379 inp = in6_pcblookup_mbuf(pi, &saddr->v6, sport, &daddr->v6,
4380 dport, INPLOOKUP_RLOCKPCB, NULL, pd->m);
4381 if (inp == NULL) {
4382 inp = in6_pcblookup_mbuf(pi, &saddr->v6, sport,
4383 &daddr->v6, dport, INPLOOKUP_WILDCARD |
4384 INPLOOKUP_RLOCKPCB, NULL, pd->m);
4385 if (inp == NULL)
4386 return (-1);
4387 }
4388 break;
4389 #endif /* INET6 */
4390 }
4391 INP_RLOCK_ASSERT(inp);
4392 pd->lookup.uid = inp->inp_cred->cr_uid;
4393 pd->lookup.gid = inp->inp_cred->cr_groups[0];
4394 INP_RUNLOCK(inp);
4395
4396 return (1);
4397 }
4398
4399 u_int8_t
pf_get_wscale(struct pf_pdesc * pd)4400 pf_get_wscale(struct pf_pdesc *pd)
4401 {
4402 struct tcphdr *th = &pd->hdr.tcp;
4403 int hlen;
4404 u_int8_t hdr[60];
4405 u_int8_t *opt, optlen;
4406 u_int8_t wscale = 0;
4407
4408 hlen = th->th_off << 2; /* hlen <= sizeof(hdr) */
4409 if (hlen <= sizeof(struct tcphdr))
4410 return (0);
4411 if (!pf_pull_hdr(pd->m, pd->off, hdr, hlen, NULL, NULL, pd->af))
4412 return (0);
4413 opt = hdr + sizeof(struct tcphdr);
4414 hlen -= sizeof(struct tcphdr);
4415 while (hlen >= 3) {
4416 switch (*opt) {
4417 case TCPOPT_EOL:
4418 case TCPOPT_NOP:
4419 ++opt;
4420 --hlen;
4421 break;
4422 case TCPOPT_WINDOW:
4423 wscale = opt[2];
4424 if (wscale > TCP_MAX_WINSHIFT)
4425 wscale = TCP_MAX_WINSHIFT;
4426 wscale |= PF_WSCALE_FLAG;
4427 /* FALLTHROUGH */
4428 default:
4429 optlen = opt[1];
4430 if (optlen < 2)
4431 optlen = 2;
4432 hlen -= optlen;
4433 opt += optlen;
4434 break;
4435 }
4436 }
4437 return (wscale);
4438 }
4439
4440 u_int16_t
pf_get_mss(struct pf_pdesc * pd)4441 pf_get_mss(struct pf_pdesc *pd)
4442 {
4443 struct tcphdr *th = &pd->hdr.tcp;
4444 int hlen;
4445 u_int8_t hdr[60];
4446 u_int8_t *opt, optlen;
4447 u_int16_t mss = V_tcp_mssdflt;
4448
4449 hlen = th->th_off << 2; /* hlen <= sizeof(hdr) */
4450 if (hlen <= sizeof(struct tcphdr))
4451 return (0);
4452 if (!pf_pull_hdr(pd->m, pd->off, hdr, hlen, NULL, NULL, pd->af))
4453 return (0);
4454 opt = hdr + sizeof(struct tcphdr);
4455 hlen -= sizeof(struct tcphdr);
4456 while (hlen >= TCPOLEN_MAXSEG) {
4457 switch (*opt) {
4458 case TCPOPT_EOL:
4459 case TCPOPT_NOP:
4460 ++opt;
4461 --hlen;
4462 break;
4463 case TCPOPT_MAXSEG:
4464 bcopy((caddr_t)(opt + 2), (caddr_t)&mss, 2);
4465 NTOHS(mss);
4466 /* FALLTHROUGH */
4467 default:
4468 optlen = opt[1];
4469 if (optlen < 2)
4470 optlen = 2;
4471 hlen -= optlen;
4472 opt += optlen;
4473 break;
4474 }
4475 }
4476 return (mss);
4477 }
4478
4479 static u_int16_t
pf_calc_mss(struct pf_addr * addr,sa_family_t af,int rtableid,u_int16_t offer)4480 pf_calc_mss(struct pf_addr *addr, sa_family_t af, int rtableid, u_int16_t offer)
4481 {
4482 struct nhop_object *nh;
4483 #ifdef INET6
4484 struct in6_addr dst6;
4485 uint32_t scopeid;
4486 #endif /* INET6 */
4487 int hlen = 0;
4488 uint16_t mss = 0;
4489
4490 NET_EPOCH_ASSERT();
4491
4492 switch (af) {
4493 #ifdef INET
4494 case AF_INET:
4495 hlen = sizeof(struct ip);
4496 nh = fib4_lookup(rtableid, addr->v4, 0, 0, 0);
4497 if (nh != NULL)
4498 mss = nh->nh_mtu - hlen - sizeof(struct tcphdr);
4499 break;
4500 #endif /* INET */
4501 #ifdef INET6
4502 case AF_INET6:
4503 hlen = sizeof(struct ip6_hdr);
4504 in6_splitscope(&addr->v6, &dst6, &scopeid);
4505 nh = fib6_lookup(rtableid, &dst6, scopeid, 0, 0);
4506 if (nh != NULL)
4507 mss = nh->nh_mtu - hlen - sizeof(struct tcphdr);
4508 break;
4509 #endif /* INET6 */
4510 }
4511
4512 mss = max(V_tcp_mssdflt, mss);
4513 mss = min(mss, offer);
4514 mss = max(mss, 64); /* sanity - at least max opt space */
4515 return (mss);
4516 }
4517
4518 static u_int32_t
pf_tcp_iss(struct pf_pdesc * pd)4519 pf_tcp_iss(struct pf_pdesc *pd)
4520 {
4521 MD5_CTX ctx;
4522 u_int32_t digest[4];
4523
4524 if (V_pf_tcp_secret_init == 0) {
4525 arc4random_buf(&V_pf_tcp_secret, sizeof(V_pf_tcp_secret));
4526 MD5Init(&V_pf_tcp_secret_ctx);
4527 MD5Update(&V_pf_tcp_secret_ctx, V_pf_tcp_secret,
4528 sizeof(V_pf_tcp_secret));
4529 V_pf_tcp_secret_init = 1;
4530 }
4531
4532 ctx = V_pf_tcp_secret_ctx;
4533
4534 MD5Update(&ctx, (char *)&pd->hdr.tcp.th_sport, sizeof(u_short));
4535 MD5Update(&ctx, (char *)&pd->hdr.tcp.th_dport, sizeof(u_short));
4536 switch (pd->af) {
4537 case AF_INET6:
4538 MD5Update(&ctx, (char *)&pd->src->v6, sizeof(struct in6_addr));
4539 MD5Update(&ctx, (char *)&pd->dst->v6, sizeof(struct in6_addr));
4540 break;
4541 case AF_INET:
4542 MD5Update(&ctx, (char *)&pd->src->v4, sizeof(struct in_addr));
4543 MD5Update(&ctx, (char *)&pd->dst->v4, sizeof(struct in_addr));
4544 break;
4545 }
4546 MD5Final((u_char *)digest, &ctx);
4547 V_pf_tcp_iss_off += 4096;
4548 #define ISN_RANDOM_INCREMENT (4096 - 1)
4549 return (digest[0] + (arc4random() & ISN_RANDOM_INCREMENT) +
4550 V_pf_tcp_iss_off);
4551 #undef ISN_RANDOM_INCREMENT
4552 }
4553
4554 static bool
pf_match_eth_addr(const uint8_t * a,const struct pf_keth_rule_addr * r)4555 pf_match_eth_addr(const uint8_t *a, const struct pf_keth_rule_addr *r)
4556 {
4557 bool match = true;
4558
4559 /* Always matches if not set */
4560 if (! r->isset)
4561 return (!r->neg);
4562
4563 for (int i = 0; i < ETHER_ADDR_LEN; i++) {
4564 if ((a[i] & r->mask[i]) != (r->addr[i] & r->mask[i])) {
4565 match = false;
4566 break;
4567 }
4568 }
4569
4570 return (match ^ r->neg);
4571 }
4572
4573 static int
pf_match_eth_tag(struct mbuf * m,struct pf_keth_rule * r,int * tag,int mtag)4574 pf_match_eth_tag(struct mbuf *m, struct pf_keth_rule *r, int *tag, int mtag)
4575 {
4576 if (*tag == -1)
4577 *tag = mtag;
4578
4579 return ((!r->match_tag_not && r->match_tag == *tag) ||
4580 (r->match_tag_not && r->match_tag != *tag));
4581 }
4582
4583 static void
pf_bridge_to(struct ifnet * ifp,struct mbuf * m)4584 pf_bridge_to(struct ifnet *ifp, struct mbuf *m)
4585 {
4586 /* If we don't have the interface drop the packet. */
4587 if (ifp == NULL) {
4588 m_freem(m);
4589 return;
4590 }
4591
4592 switch (ifp->if_type) {
4593 case IFT_ETHER:
4594 case IFT_XETHER:
4595 case IFT_L2VLAN:
4596 case IFT_BRIDGE:
4597 case IFT_IEEE8023ADLAG:
4598 break;
4599 default:
4600 m_freem(m);
4601 return;
4602 }
4603
4604 ifp->if_transmit(ifp, m);
4605 }
4606
4607 static int
pf_test_eth_rule(int dir,struct pfi_kkif * kif,struct mbuf ** m0)4608 pf_test_eth_rule(int dir, struct pfi_kkif *kif, struct mbuf **m0)
4609 {
4610 #ifdef INET
4611 struct ip ip;
4612 #endif
4613 #ifdef INET6
4614 struct ip6_hdr ip6;
4615 #endif
4616 struct mbuf *m = *m0;
4617 struct ether_header *e;
4618 struct pf_keth_rule *r, *rm, *a = NULL;
4619 struct pf_keth_ruleset *ruleset = NULL;
4620 struct pf_mtag *mtag;
4621 struct pf_keth_ruleq *rules;
4622 struct pf_addr *src = NULL, *dst = NULL;
4623 struct pfi_kkif *bridge_to;
4624 sa_family_t af = 0;
4625 uint16_t proto;
4626 int asd = 0, match = 0;
4627 int tag = -1;
4628 uint8_t action;
4629 struct pf_keth_anchor_stackframe anchor_stack[PF_ANCHOR_STACKSIZE];
4630
4631 MPASS(kif->pfik_ifp->if_vnet == curvnet);
4632 NET_EPOCH_ASSERT();
4633
4634 PF_RULES_RLOCK_TRACKER;
4635
4636 SDT_PROBE3(pf, eth, test_rule, entry, dir, kif->pfik_ifp, m);
4637
4638 mtag = pf_find_mtag(m);
4639 if (mtag != NULL && mtag->flags & PF_MTAG_FLAG_DUMMYNET) {
4640 /* Dummynet re-injects packets after they've
4641 * completed their delay. We've already
4642 * processed them, so pass unconditionally. */
4643
4644 /* But only once. We may see the packet multiple times (e.g.
4645 * PFIL_IN/PFIL_OUT). */
4646 pf_dummynet_flag_remove(m, mtag);
4647
4648 return (PF_PASS);
4649 }
4650
4651 ruleset = V_pf_keth;
4652 rules = ck_pr_load_ptr(&ruleset->active.rules);
4653 r = TAILQ_FIRST(rules);
4654 rm = NULL;
4655
4656 if (__predict_false(m->m_len < sizeof(struct ether_header)) &&
4657 (m = *m0 = m_pullup(*m0, sizeof(struct ether_header))) == NULL) {
4658 DPFPRINTF(PF_DEBUG_URGENT,
4659 ("pf_test_eth_rule: m_len < sizeof(struct ether_header)"
4660 ", pullup failed\n"));
4661 return (PF_DROP);
4662 }
4663 e = mtod(m, struct ether_header *);
4664 proto = ntohs(e->ether_type);
4665
4666 switch (proto) {
4667 #ifdef INET
4668 case ETHERTYPE_IP: {
4669 if (m_length(m, NULL) < (sizeof(struct ether_header) +
4670 sizeof(ip)))
4671 return (PF_DROP);
4672
4673 af = AF_INET;
4674 m_copydata(m, sizeof(struct ether_header), sizeof(ip),
4675 (caddr_t)&ip);
4676 src = (struct pf_addr *)&ip.ip_src;
4677 dst = (struct pf_addr *)&ip.ip_dst;
4678 break;
4679 }
4680 #endif /* INET */
4681 #ifdef INET6
4682 case ETHERTYPE_IPV6: {
4683 if (m_length(m, NULL) < (sizeof(struct ether_header) +
4684 sizeof(ip6)))
4685 return (PF_DROP);
4686
4687 af = AF_INET6;
4688 m_copydata(m, sizeof(struct ether_header), sizeof(ip6),
4689 (caddr_t)&ip6);
4690 src = (struct pf_addr *)&ip6.ip6_src;
4691 dst = (struct pf_addr *)&ip6.ip6_dst;
4692 break;
4693 }
4694 #endif /* INET6 */
4695 }
4696
4697 PF_RULES_RLOCK();
4698
4699 while (r != NULL) {
4700 counter_u64_add(r->evaluations, 1);
4701 SDT_PROBE2(pf, eth, test_rule, test, r->nr, r);
4702
4703 if (pfi_kkif_match(r->kif, kif) == r->ifnot) {
4704 SDT_PROBE3(pf, eth, test_rule, mismatch, r->nr, r,
4705 "kif");
4706 r = r->skip[PFE_SKIP_IFP].ptr;
4707 }
4708 else if (r->direction && r->direction != dir) {
4709 SDT_PROBE3(pf, eth, test_rule, mismatch, r->nr, r,
4710 "dir");
4711 r = r->skip[PFE_SKIP_DIR].ptr;
4712 }
4713 else if (r->proto && r->proto != proto) {
4714 SDT_PROBE3(pf, eth, test_rule, mismatch, r->nr, r,
4715 "proto");
4716 r = r->skip[PFE_SKIP_PROTO].ptr;
4717 }
4718 else if (! pf_match_eth_addr(e->ether_shost, &r->src)) {
4719 SDT_PROBE3(pf, eth, test_rule, mismatch, r->nr, r,
4720 "src");
4721 r = r->skip[PFE_SKIP_SRC_ADDR].ptr;
4722 }
4723 else if (! pf_match_eth_addr(e->ether_dhost, &r->dst)) {
4724 SDT_PROBE3(pf, eth, test_rule, mismatch, r->nr, r,
4725 "dst");
4726 r = r->skip[PFE_SKIP_DST_ADDR].ptr;
4727 }
4728 else if (src != NULL && PF_MISMATCHAW(&r->ipsrc.addr, src, af,
4729 r->ipsrc.neg, kif, M_GETFIB(m))) {
4730 SDT_PROBE3(pf, eth, test_rule, mismatch, r->nr, r,
4731 "ip_src");
4732 r = r->skip[PFE_SKIP_SRC_IP_ADDR].ptr;
4733 }
4734 else if (dst != NULL && PF_MISMATCHAW(&r->ipdst.addr, dst, af,
4735 r->ipdst.neg, kif, M_GETFIB(m))) {
4736 SDT_PROBE3(pf, eth, test_rule, mismatch, r->nr, r,
4737 "ip_dst");
4738 r = r->skip[PFE_SKIP_DST_IP_ADDR].ptr;
4739 }
4740 else if (r->match_tag && !pf_match_eth_tag(m, r, &tag,
4741 mtag ? mtag->tag : 0)) {
4742 SDT_PROBE3(pf, eth, test_rule, mismatch, r->nr, r,
4743 "match_tag");
4744 r = TAILQ_NEXT(r, entries);
4745 }
4746 else {
4747 if (r->tag)
4748 tag = r->tag;
4749 if (r->anchor == NULL) {
4750 /* Rule matches */
4751 rm = r;
4752
4753 SDT_PROBE2(pf, eth, test_rule, match, r->nr, r);
4754
4755 if (r->quick)
4756 break;
4757
4758 r = TAILQ_NEXT(r, entries);
4759 } else {
4760 pf_step_into_keth_anchor(anchor_stack, &asd,
4761 &ruleset, &r, &a, &match);
4762 }
4763 }
4764 if (r == NULL && pf_step_out_of_keth_anchor(anchor_stack, &asd,
4765 &ruleset, &r, &a, &match))
4766 break;
4767 }
4768
4769 r = rm;
4770
4771 SDT_PROBE2(pf, eth, test_rule, final_match, (r != NULL ? r->nr : -1), r);
4772
4773 /* Default to pass. */
4774 if (r == NULL) {
4775 PF_RULES_RUNLOCK();
4776 return (PF_PASS);
4777 }
4778
4779 /* Execute action. */
4780 counter_u64_add(r->packets[dir == PF_OUT], 1);
4781 counter_u64_add(r->bytes[dir == PF_OUT], m_length(m, NULL));
4782 pf_update_timestamp(r);
4783
4784 /* Shortcut. Don't tag if we're just going to drop anyway. */
4785 if (r->action == PF_DROP) {
4786 PF_RULES_RUNLOCK();
4787 return (PF_DROP);
4788 }
4789
4790 if (tag > 0) {
4791 if (mtag == NULL)
4792 mtag = pf_get_mtag(m);
4793 if (mtag == NULL) {
4794 PF_RULES_RUNLOCK();
4795 counter_u64_add(V_pf_status.counters[PFRES_MEMORY], 1);
4796 return (PF_DROP);
4797 }
4798 mtag->tag = tag;
4799 }
4800
4801 if (r->qid != 0) {
4802 if (mtag == NULL)
4803 mtag = pf_get_mtag(m);
4804 if (mtag == NULL) {
4805 PF_RULES_RUNLOCK();
4806 counter_u64_add(V_pf_status.counters[PFRES_MEMORY], 1);
4807 return (PF_DROP);
4808 }
4809 mtag->qid = r->qid;
4810 }
4811
4812 action = r->action;
4813 bridge_to = r->bridge_to;
4814
4815 /* Dummynet */
4816 if (r->dnpipe) {
4817 struct ip_fw_args dnflow;
4818
4819 /* Drop packet if dummynet is not loaded. */
4820 if (ip_dn_io_ptr == NULL) {
4821 PF_RULES_RUNLOCK();
4822 m_freem(m);
4823 counter_u64_add(V_pf_status.counters[PFRES_MEMORY], 1);
4824 return (PF_DROP);
4825 }
4826 if (mtag == NULL)
4827 mtag = pf_get_mtag(m);
4828 if (mtag == NULL) {
4829 PF_RULES_RUNLOCK();
4830 counter_u64_add(V_pf_status.counters[PFRES_MEMORY], 1);
4831 return (PF_DROP);
4832 }
4833
4834 bzero(&dnflow, sizeof(dnflow));
4835
4836 /* We don't have port numbers here, so we set 0. That means
4837 * that we'll be somewhat limited in distinguishing flows (i.e.
4838 * only based on IP addresses, not based on port numbers), but
4839 * it's better than nothing. */
4840 dnflow.f_id.dst_port = 0;
4841 dnflow.f_id.src_port = 0;
4842 dnflow.f_id.proto = 0;
4843
4844 dnflow.rule.info = r->dnpipe;
4845 dnflow.rule.info |= IPFW_IS_DUMMYNET;
4846 if (r->dnflags & PFRULE_DN_IS_PIPE)
4847 dnflow.rule.info |= IPFW_IS_PIPE;
4848
4849 dnflow.f_id.extra = dnflow.rule.info;
4850
4851 dnflow.flags = dir == PF_IN ? IPFW_ARGS_IN : IPFW_ARGS_OUT;
4852 dnflow.flags |= IPFW_ARGS_ETHER;
4853 dnflow.ifp = kif->pfik_ifp;
4854
4855 switch (af) {
4856 case AF_INET:
4857 dnflow.f_id.addr_type = 4;
4858 dnflow.f_id.src_ip = src->v4.s_addr;
4859 dnflow.f_id.dst_ip = dst->v4.s_addr;
4860 break;
4861 case AF_INET6:
4862 dnflow.flags |= IPFW_ARGS_IP6;
4863 dnflow.f_id.addr_type = 6;
4864 dnflow.f_id.src_ip6 = src->v6;
4865 dnflow.f_id.dst_ip6 = dst->v6;
4866 break;
4867 }
4868
4869 PF_RULES_RUNLOCK();
4870
4871 mtag->flags |= PF_MTAG_FLAG_DUMMYNET;
4872 ip_dn_io_ptr(m0, &dnflow);
4873 if (*m0 != NULL)
4874 pf_dummynet_flag_remove(m, mtag);
4875 } else {
4876 PF_RULES_RUNLOCK();
4877 }
4878
4879 if (action == PF_PASS && bridge_to) {
4880 pf_bridge_to(bridge_to->pfik_ifp, *m0);
4881 *m0 = NULL; /* We've eaten the packet. */
4882 }
4883
4884 return (action);
4885 }
4886
4887 #define PF_TEST_ATTRIB(t, a)\
4888 do { \
4889 if (t) { \
4890 r = a; \
4891 goto nextrule; \
4892 } \
4893 } while (0)
4894
4895 static int
pf_test_rule(struct pf_krule ** rm,struct pf_kstate ** sm,struct pf_pdesc * pd,struct pf_krule ** am,struct pf_kruleset ** rsm,struct inpcb * inp)4896 pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm,
4897 struct pf_pdesc *pd, struct pf_krule **am,
4898 struct pf_kruleset **rsm, struct inpcb *inp)
4899 {
4900 struct pf_krule *nr = NULL;
4901 struct pf_addr * const saddr = pd->src;
4902 struct pf_addr * const daddr = pd->dst;
4903 struct pf_krule *r, *a = NULL;
4904 struct pf_kruleset *ruleset = NULL;
4905 struct pf_krule_slist match_rules;
4906 struct pf_krule_item *ri;
4907 struct tcphdr *th = &pd->hdr.tcp;
4908 struct pf_state_key *sk = NULL, *nk = NULL;
4909 u_short reason, transerror;
4910 int rewrite = 0;
4911 int tag = -1;
4912 int asd = 0;
4913 int match = 0;
4914 int state_icmp = 0, icmp_dir, multi;
4915 u_int16_t sport = 0, dport = 0, virtual_type, virtual_id;
4916 u_int16_t bproto_sum = 0, bip_sum = 0;
4917 u_int8_t icmptype = 0, icmpcode = 0;
4918 struct pf_kanchor_stackframe anchor_stack[PF_ANCHOR_STACKSIZE];
4919 struct pf_udp_mapping *udp_mapping = NULL;
4920
4921 PF_RULES_RASSERT();
4922
4923 SLIST_INIT(&match_rules);
4924
4925 if (inp != NULL) {
4926 INP_LOCK_ASSERT(inp);
4927 pd->lookup.uid = inp->inp_cred->cr_uid;
4928 pd->lookup.gid = inp->inp_cred->cr_groups[0];
4929 pd->lookup.done = 1;
4930 }
4931
4932 switch (pd->virtual_proto) {
4933 case IPPROTO_TCP:
4934 sport = th->th_sport;
4935 dport = th->th_dport;
4936 break;
4937 case IPPROTO_UDP:
4938 sport = pd->hdr.udp.uh_sport;
4939 dport = pd->hdr.udp.uh_dport;
4940 break;
4941 case IPPROTO_SCTP:
4942 sport = pd->hdr.sctp.src_port;
4943 dport = pd->hdr.sctp.dest_port;
4944 break;
4945 #ifdef INET
4946 case IPPROTO_ICMP:
4947 MPASS(pd->af == AF_INET);
4948 icmptype = pd->hdr.icmp.icmp_type;
4949 icmpcode = pd->hdr.icmp.icmp_code;
4950 state_icmp = pf_icmp_mapping(pd, icmptype,
4951 &icmp_dir, &multi, &virtual_id, &virtual_type);
4952 if (icmp_dir == PF_IN) {
4953 sport = virtual_id;
4954 dport = virtual_type;
4955 } else {
4956 sport = virtual_type;
4957 dport = virtual_id;
4958 }
4959 break;
4960 #endif /* INET */
4961 #ifdef INET6
4962 case IPPROTO_ICMPV6:
4963 MPASS(pd->af == AF_INET6);
4964 icmptype = pd->hdr.icmp6.icmp6_type;
4965 icmpcode = pd->hdr.icmp6.icmp6_code;
4966 state_icmp = pf_icmp_mapping(pd, icmptype,
4967 &icmp_dir, &multi, &virtual_id, &virtual_type);
4968 if (icmp_dir == PF_IN) {
4969 sport = virtual_id;
4970 dport = virtual_type;
4971 } else {
4972 sport = virtual_type;
4973 dport = virtual_id;
4974 }
4975
4976 break;
4977 #endif /* INET6 */
4978 default:
4979 sport = dport = 0;
4980 break;
4981 }
4982
4983 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
4984
4985 /* check packet for BINAT/NAT/RDR */
4986 transerror = pf_get_translation(pd, pd->off, &sk, &nk, saddr, daddr,
4987 sport, dport, anchor_stack, &nr, &udp_mapping);
4988 switch (transerror) {
4989 default:
4990 /* A translation error occurred. */
4991 REASON_SET(&reason, transerror);
4992 goto cleanup;
4993 case PFRES_MAX:
4994 /* No match. */
4995 break;
4996 case PFRES_MATCH:
4997 KASSERT(sk != NULL, ("%s: null sk", __func__));
4998 KASSERT(nk != NULL, ("%s: null nk", __func__));
4999
5000 if (nr->log) {
5001 PFLOG_PACKET(PF_PASS, PFRES_MATCH, nr, a,
5002 ruleset, pd, 1);
5003 }
5004
5005 if (pd->ip_sum)
5006 bip_sum = *pd->ip_sum;
5007
5008 switch (pd->proto) {
5009 case IPPROTO_TCP:
5010 bproto_sum = th->th_sum;
5011
5012 if (PF_ANEQ(saddr, &nk->addr[pd->sidx], pd->af) ||
5013 nk->port[pd->sidx] != sport) {
5014 pf_change_ap(pd->m, saddr, &th->th_sport, pd->ip_sum,
5015 &th->th_sum, &nk->addr[pd->sidx],
5016 nk->port[pd->sidx], 0, pd->af);
5017 pd->sport = &th->th_sport;
5018 sport = th->th_sport;
5019 }
5020
5021 if (PF_ANEQ(daddr, &nk->addr[pd->didx], pd->af) ||
5022 nk->port[pd->didx] != dport) {
5023 pf_change_ap(pd->m, daddr, &th->th_dport, pd->ip_sum,
5024 &th->th_sum, &nk->addr[pd->didx],
5025 nk->port[pd->didx], 0, pd->af);
5026 dport = th->th_dport;
5027 pd->dport = &th->th_dport;
5028 }
5029 rewrite++;
5030 break;
5031 case IPPROTO_UDP:
5032 bproto_sum = pd->hdr.udp.uh_sum;
5033
5034 if (PF_ANEQ(saddr, &nk->addr[pd->sidx], pd->af) ||
5035 nk->port[pd->sidx] != sport) {
5036 pf_change_ap(pd->m, saddr, &pd->hdr.udp.uh_sport,
5037 pd->ip_sum, &pd->hdr.udp.uh_sum,
5038 &nk->addr[pd->sidx],
5039 nk->port[pd->sidx], 1, pd->af);
5040 sport = pd->hdr.udp.uh_sport;
5041 pd->sport = &pd->hdr.udp.uh_sport;
5042 }
5043
5044 if (PF_ANEQ(daddr, &nk->addr[pd->didx], pd->af) ||
5045 nk->port[pd->didx] != dport) {
5046 pf_change_ap(pd->m, daddr, &pd->hdr.udp.uh_dport,
5047 pd->ip_sum, &pd->hdr.udp.uh_sum,
5048 &nk->addr[pd->didx],
5049 nk->port[pd->didx], 1, pd->af);
5050 dport = pd->hdr.udp.uh_dport;
5051 pd->dport = &pd->hdr.udp.uh_dport;
5052 }
5053 rewrite++;
5054 break;
5055 case IPPROTO_SCTP: {
5056 uint16_t checksum = 0;
5057
5058 if (PF_ANEQ(saddr, &nk->addr[pd->sidx], pd->af) ||
5059 nk->port[pd->sidx] != sport) {
5060 pf_change_ap(pd->m, saddr, &pd->hdr.sctp.src_port,
5061 pd->ip_sum, &checksum,
5062 &nk->addr[pd->sidx],
5063 nk->port[pd->sidx], 1, pd->af);
5064 }
5065 if (PF_ANEQ(daddr, &nk->addr[pd->didx], pd->af) ||
5066 nk->port[pd->didx] != dport) {
5067 pf_change_ap(pd->m, daddr, &pd->hdr.sctp.dest_port,
5068 pd->ip_sum, &checksum,
5069 &nk->addr[pd->didx],
5070 nk->port[pd->didx], 1, pd->af);
5071 }
5072 break;
5073 }
5074 #ifdef INET
5075 case IPPROTO_ICMP:
5076 if (PF_ANEQ(saddr, &nk->addr[pd->sidx], AF_INET))
5077 pf_change_a(&saddr->v4.s_addr, pd->ip_sum,
5078 nk->addr[pd->sidx].v4.s_addr, 0);
5079
5080 if (PF_ANEQ(daddr, &nk->addr[pd->didx], AF_INET))
5081 pf_change_a(&daddr->v4.s_addr, pd->ip_sum,
5082 nk->addr[pd->didx].v4.s_addr, 0);
5083
5084 if (virtual_type == htons(ICMP_ECHO) &&
5085 nk->port[pd->sidx] != pd->hdr.icmp.icmp_id) {
5086 pd->hdr.icmp.icmp_cksum = pf_cksum_fixup(
5087 pd->hdr.icmp.icmp_cksum, sport,
5088 nk->port[pd->sidx], 0);
5089 pd->hdr.icmp.icmp_id = nk->port[pd->sidx];
5090 pd->sport = &pd->hdr.icmp.icmp_id;
5091 }
5092 m_copyback(pd->m, pd->off, ICMP_MINLEN, (caddr_t)&pd->hdr.icmp);
5093 break;
5094 #endif /* INET */
5095 #ifdef INET6
5096 case IPPROTO_ICMPV6:
5097 if (PF_ANEQ(saddr, &nk->addr[pd->sidx], AF_INET6))
5098 pf_change_a6(saddr, &pd->hdr.icmp6.icmp6_cksum,
5099 &nk->addr[pd->sidx], 0);
5100
5101 if (PF_ANEQ(daddr, &nk->addr[pd->didx], AF_INET6))
5102 pf_change_a6(daddr, &pd->hdr.icmp6.icmp6_cksum,
5103 &nk->addr[pd->didx], 0);
5104 rewrite++;
5105 break;
5106 #endif /* INET */
5107 default:
5108 switch (pd->af) {
5109 #ifdef INET
5110 case AF_INET:
5111 if (PF_ANEQ(saddr,
5112 &nk->addr[pd->sidx], AF_INET))
5113 pf_change_a(&saddr->v4.s_addr,
5114 pd->ip_sum,
5115 nk->addr[pd->sidx].v4.s_addr, 0);
5116
5117 if (PF_ANEQ(daddr,
5118 &nk->addr[pd->didx], AF_INET))
5119 pf_change_a(&daddr->v4.s_addr,
5120 pd->ip_sum,
5121 nk->addr[pd->didx].v4.s_addr, 0);
5122 break;
5123 #endif /* INET */
5124 #ifdef INET6
5125 case AF_INET6:
5126 if (PF_ANEQ(saddr,
5127 &nk->addr[pd->sidx], AF_INET6))
5128 PF_ACPY(saddr, &nk->addr[pd->sidx], pd->af);
5129
5130 if (PF_ANEQ(daddr,
5131 &nk->addr[pd->didx], AF_INET6))
5132 PF_ACPY(daddr, &nk->addr[pd->didx], pd->af);
5133 break;
5134 #endif /* INET */
5135 }
5136 break;
5137 }
5138 if (nr->natpass)
5139 r = NULL;
5140 }
5141
5142 while (r != NULL) {
5143 pf_counter_u64_add(&r->evaluations, 1);
5144 PF_TEST_ATTRIB(pfi_kkif_match(r->kif, pd->kif) == r->ifnot,
5145 r->skip[PF_SKIP_IFP]);
5146 PF_TEST_ATTRIB(r->direction && r->direction != pd->dir,
5147 r->skip[PF_SKIP_DIR]);
5148 PF_TEST_ATTRIB(r->af && r->af != pd->af,
5149 r->skip[PF_SKIP_AF]);
5150 PF_TEST_ATTRIB(r->proto && r->proto != pd->proto,
5151 r->skip[PF_SKIP_PROTO]);
5152 PF_TEST_ATTRIB(PF_MISMATCHAW(&r->src.addr, saddr, pd->af,
5153 r->src.neg, pd->kif, M_GETFIB(pd->m)),
5154 r->skip[PF_SKIP_SRC_ADDR]);
5155 PF_TEST_ATTRIB(PF_MISMATCHAW(&r->dst.addr, daddr, pd->af,
5156 r->dst.neg, NULL, M_GETFIB(pd->m)),
5157 r->skip[PF_SKIP_DST_ADDR]);
5158 switch (pd->virtual_proto) {
5159 case PF_VPROTO_FRAGMENT:
5160 /* tcp/udp only. port_op always 0 in other cases */
5161 PF_TEST_ATTRIB((r->src.port_op || r->dst.port_op),
5162 TAILQ_NEXT(r, entries));
5163 PF_TEST_ATTRIB((pd->proto == IPPROTO_TCP && r->flagset),
5164 TAILQ_NEXT(r, entries));
5165 /* icmp only. type/code always 0 in other cases */
5166 PF_TEST_ATTRIB((r->type || r->code),
5167 TAILQ_NEXT(r, entries));
5168 /* tcp/udp only. {uid|gid}.op always 0 in other cases */
5169 PF_TEST_ATTRIB((r->gid.op || r->uid.op),
5170 TAILQ_NEXT(r, entries));
5171 break;
5172
5173 case IPPROTO_TCP:
5174 PF_TEST_ATTRIB((r->flagset & tcp_get_flags(th)) != r->flags,
5175 TAILQ_NEXT(r, entries));
5176 /* FALLTHROUGH */
5177 case IPPROTO_SCTP:
5178 case IPPROTO_UDP:
5179 /* tcp/udp only. port_op always 0 in other cases */
5180 PF_TEST_ATTRIB(r->src.port_op && !pf_match_port(r->src.port_op,
5181 r->src.port[0], r->src.port[1], sport),
5182 r->skip[PF_SKIP_SRC_PORT]);
5183 /* tcp/udp only. port_op always 0 in other cases */
5184 PF_TEST_ATTRIB(r->dst.port_op && !pf_match_port(r->dst.port_op,
5185 r->dst.port[0], r->dst.port[1], dport),
5186 r->skip[PF_SKIP_DST_PORT]);
5187 /* tcp/udp only. uid.op always 0 in other cases */
5188 PF_TEST_ATTRIB(r->uid.op && (pd->lookup.done || (pd->lookup.done =
5189 pf_socket_lookup(pd), 1)) &&
5190 !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1],
5191 pd->lookup.uid),
5192 TAILQ_NEXT(r, entries));
5193 /* tcp/udp only. gid.op always 0 in other cases */
5194 PF_TEST_ATTRIB(r->gid.op && (pd->lookup.done || (pd->lookup.done =
5195 pf_socket_lookup(pd), 1)) &&
5196 !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1],
5197 pd->lookup.gid),
5198 TAILQ_NEXT(r, entries));
5199 break;
5200
5201 case IPPROTO_ICMP:
5202 case IPPROTO_ICMPV6:
5203 /* icmp only. type always 0 in other cases */
5204 PF_TEST_ATTRIB(r->type && r->type != icmptype + 1,
5205 TAILQ_NEXT(r, entries));
5206 /* icmp only. type always 0 in other cases */
5207 PF_TEST_ATTRIB(r->code && r->code != icmpcode + 1,
5208 TAILQ_NEXT(r, entries));
5209 break;
5210
5211 default:
5212 break;
5213 }
5214 PF_TEST_ATTRIB(r->tos && !(r->tos == pd->tos),
5215 TAILQ_NEXT(r, entries));
5216 PF_TEST_ATTRIB(r->prio &&
5217 !pf_match_ieee8021q_pcp(r->prio, pd->m),
5218 TAILQ_NEXT(r, entries));
5219 PF_TEST_ATTRIB(r->prob &&
5220 r->prob <= arc4random(),
5221 TAILQ_NEXT(r, entries));
5222 PF_TEST_ATTRIB(r->match_tag && !pf_match_tag(pd->m, r, &tag,
5223 pd->pf_mtag ? pd->pf_mtag->tag : 0),
5224 TAILQ_NEXT(r, entries));
5225 PF_TEST_ATTRIB(r->rcv_kif && !pf_match_rcvif(pd->m, r),
5226 TAILQ_NEXT(r, entries));
5227 PF_TEST_ATTRIB((r->rule_flag & PFRULE_FRAGMENT &&
5228 pd->virtual_proto != PF_VPROTO_FRAGMENT),
5229 TAILQ_NEXT(r, entries));
5230 PF_TEST_ATTRIB(r->os_fingerprint != PF_OSFP_ANY &&
5231 (pd->virtual_proto != IPPROTO_TCP || !pf_osfp_match(
5232 pf_osfp_fingerprint(pd, th),
5233 r->os_fingerprint)),
5234 TAILQ_NEXT(r, entries));
5235 /* FALLTHROUGH */
5236 if (r->tag)
5237 tag = r->tag;
5238 if (r->anchor == NULL) {
5239 if (r->action == PF_MATCH) {
5240 ri = malloc(sizeof(struct pf_krule_item), M_PF_RULE_ITEM, M_NOWAIT | M_ZERO);
5241 if (ri == NULL) {
5242 REASON_SET(&reason, PFRES_MEMORY);
5243 goto cleanup;
5244 }
5245 ri->r = r;
5246 SLIST_INSERT_HEAD(&match_rules, ri, entry);
5247 pf_counter_u64_critical_enter();
5248 pf_counter_u64_add_protected(&r->packets[pd->dir == PF_OUT], 1);
5249 pf_counter_u64_add_protected(&r->bytes[pd->dir == PF_OUT], pd->tot_len);
5250 pf_counter_u64_critical_exit();
5251 pf_rule_to_actions(r, &pd->act);
5252 if (r->log || pd->act.log & PF_LOG_MATCHES)
5253 PFLOG_PACKET(r->action, PFRES_MATCH, r,
5254 a, ruleset, pd, 1);
5255 } else {
5256 match = 1;
5257 *rm = r;
5258 *am = a;
5259 *rsm = ruleset;
5260 if (pd->act.log & PF_LOG_MATCHES)
5261 PFLOG_PACKET(r->action, PFRES_MATCH, r,
5262 a, ruleset, pd, 1);
5263 }
5264 if ((*rm)->quick)
5265 break;
5266 r = TAILQ_NEXT(r, entries);
5267 } else
5268 pf_step_into_anchor(anchor_stack, &asd,
5269 &ruleset, PF_RULESET_FILTER, &r, &a,
5270 &match);
5271 nextrule:
5272 if (r == NULL && pf_step_out_of_anchor(anchor_stack, &asd,
5273 &ruleset, PF_RULESET_FILTER, &r, &a, &match))
5274 break;
5275 }
5276 r = *rm;
5277 a = *am;
5278 ruleset = *rsm;
5279
5280 REASON_SET(&reason, PFRES_MATCH);
5281
5282 /* apply actions for last matching pass/block rule */
5283 pf_rule_to_actions(r, &pd->act);
5284
5285 if (r->log || pd->act.log & PF_LOG_MATCHES) {
5286 if (rewrite)
5287 m_copyback(pd->m, pd->off, pd->hdrlen, pd->hdr.any);
5288 PFLOG_PACKET(r->action, reason, r, a, ruleset, pd, 1);
5289 }
5290
5291 if (pd->virtual_proto != PF_VPROTO_FRAGMENT &&
5292 (r->action == PF_DROP) &&
5293 ((r->rule_flag & PFRULE_RETURNRST) ||
5294 (r->rule_flag & PFRULE_RETURNICMP) ||
5295 (r->rule_flag & PFRULE_RETURN))) {
5296 pf_return(r, nr, pd, sk, th, bproto_sum,
5297 bip_sum, &reason, r->rtableid);
5298 }
5299
5300 if (r->action == PF_DROP)
5301 goto cleanup;
5302
5303 if (tag > 0 && pf_tag_packet(pd, tag)) {
5304 REASON_SET(&reason, PFRES_MEMORY);
5305 goto cleanup;
5306 }
5307 if (pd->act.rtableid >= 0)
5308 M_SETFIB(pd->m, pd->act.rtableid);
5309
5310 if (r->rt) {
5311 struct pf_ksrc_node *sn = NULL;
5312 struct pf_srchash *snh = NULL;
5313 /*
5314 * Set act.rt here instead of in pf_rule_to_actions() because
5315 * it is applied only from the last pass rule.
5316 */
5317 pd->act.rt = r->rt;
5318 /* Don't use REASON_SET, pf_map_addr increases the reason counters */
5319 reason = pf_map_addr_sn(pd->af, r, pd->src, &pd->act.rt_addr,
5320 &pd->act.rt_kif, NULL, &sn, &snh);
5321 if (reason != 0)
5322 goto cleanup;
5323 }
5324
5325 if (pd->virtual_proto != PF_VPROTO_FRAGMENT &&
5326 (!state_icmp && (r->keep_state || nr != NULL ||
5327 (pd->flags & PFDESC_TCP_NORM)))) {
5328 int action;
5329 action = pf_create_state(r, nr, a, pd, nk, sk,
5330 sport, dport, &rewrite, sm, tag, bproto_sum, bip_sum,
5331 &match_rules, udp_mapping);
5332 if (action != PF_PASS) {
5333 pf_udp_mapping_release(udp_mapping);
5334 if (action == PF_DROP &&
5335 (r->rule_flag & PFRULE_RETURN))
5336 pf_return(r, nr, pd, sk, th,
5337 bproto_sum, bip_sum, &reason,
5338 pd->act.rtableid);
5339 return (action);
5340 }
5341 } else {
5342 while ((ri = SLIST_FIRST(&match_rules))) {
5343 SLIST_REMOVE_HEAD(&match_rules, entry);
5344 free(ri, M_PF_RULE_ITEM);
5345 }
5346
5347 uma_zfree(V_pf_state_key_z, sk);
5348 uma_zfree(V_pf_state_key_z, nk);
5349 pf_udp_mapping_release(udp_mapping);
5350 }
5351
5352 /* copy back packet headers if we performed NAT operations */
5353 if (rewrite)
5354 m_copyback(pd->m, pd->off, pd->hdrlen, pd->hdr.any);
5355
5356 if (*sm != NULL && !((*sm)->state_flags & PFSTATE_NOSYNC) &&
5357 pd->dir == PF_OUT &&
5358 V_pfsync_defer_ptr != NULL && V_pfsync_defer_ptr(*sm, pd->m))
5359 /*
5360 * We want the state created, but we dont
5361 * want to send this in case a partner
5362 * firewall has to know about it to allow
5363 * replies through it.
5364 */
5365 return (PF_DEFER);
5366
5367 return (PF_PASS);
5368
5369 cleanup:
5370 while ((ri = SLIST_FIRST(&match_rules))) {
5371 SLIST_REMOVE_HEAD(&match_rules, entry);
5372 free(ri, M_PF_RULE_ITEM);
5373 }
5374
5375 uma_zfree(V_pf_state_key_z, sk);
5376 uma_zfree(V_pf_state_key_z, nk);
5377 pf_udp_mapping_release(udp_mapping);
5378
5379 return (PF_DROP);
5380 }
5381
5382 static int
pf_create_state(struct pf_krule * r,struct pf_krule * nr,struct pf_krule * a,struct pf_pdesc * pd,struct pf_state_key * nk,struct pf_state_key * sk,u_int16_t sport,u_int16_t dport,int * rewrite,struct pf_kstate ** sm,int tag,u_int16_t bproto_sum,u_int16_t bip_sum,struct pf_krule_slist * match_rules,struct pf_udp_mapping * udp_mapping)5383 pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
5384 struct pf_pdesc *pd, struct pf_state_key *nk, struct pf_state_key *sk,
5385 u_int16_t sport, u_int16_t dport, int *rewrite, struct pf_kstate **sm,
5386 int tag, u_int16_t bproto_sum, u_int16_t bip_sum,
5387 struct pf_krule_slist *match_rules, struct pf_udp_mapping *udp_mapping)
5388 {
5389 struct pf_kstate *s = NULL;
5390 struct pf_ksrc_node *sn = NULL;
5391 struct pf_srchash *snh = NULL;
5392 struct pf_ksrc_node *nsn = NULL;
5393 struct pf_srchash *nsnh = NULL;
5394 struct tcphdr *th = &pd->hdr.tcp;
5395 u_int16_t mss = V_tcp_mssdflt;
5396 u_short reason, sn_reason;
5397 struct pf_krule_item *ri;
5398
5399 /* check maximums */
5400 if (r->max_states &&
5401 (counter_u64_fetch(r->states_cur) >= r->max_states)) {
5402 counter_u64_add(V_pf_status.lcounters[LCNT_STATES], 1);
5403 REASON_SET(&reason, PFRES_MAXSTATES);
5404 goto csfailed;
5405 }
5406 /* src node for filter rule */
5407 if ((r->rule_flag & PFRULE_SRCTRACK ||
5408 r->rpool.opts & PF_POOL_STICKYADDR) &&
5409 (sn_reason = pf_insert_src_node(&sn, &snh, r, pd->src, pd->af,
5410 &pd->act.rt_addr, pd->act.rt_kif)) != 0) {
5411 REASON_SET(&reason, sn_reason);
5412 goto csfailed;
5413 }
5414 /* src node for translation rule */
5415 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) &&
5416 (sn_reason = pf_insert_src_node(&nsn, &nsnh, nr, &sk->addr[pd->sidx],
5417 pd->af, &nk->addr[1], NULL)) != 0 ) {
5418 REASON_SET(&reason, sn_reason);
5419 goto csfailed;
5420 }
5421 s = pf_alloc_state(M_NOWAIT);
5422 if (s == NULL) {
5423 REASON_SET(&reason, PFRES_MEMORY);
5424 goto csfailed;
5425 }
5426 s->rule = r;
5427 s->nat_rule = nr;
5428 s->anchor = a;
5429 bcopy(match_rules, &s->match_rules, sizeof(s->match_rules));
5430 memcpy(&s->act, &pd->act, sizeof(struct pf_rule_actions));
5431
5432 STATE_INC_COUNTERS(s);
5433 if (r->allow_opts)
5434 s->state_flags |= PFSTATE_ALLOWOPTS;
5435 if (r->rule_flag & PFRULE_STATESLOPPY)
5436 s->state_flags |= PFSTATE_SLOPPY;
5437 if (pd->flags & PFDESC_TCP_NORM) /* Set by old-style scrub rules */
5438 s->state_flags |= PFSTATE_SCRUB_TCP;
5439 if ((r->rule_flag & PFRULE_PFLOW) ||
5440 (nr != NULL && nr->rule_flag & PFRULE_PFLOW))
5441 s->state_flags |= PFSTATE_PFLOW;
5442
5443 s->act.log = pd->act.log & PF_LOG_ALL;
5444 s->sync_state = PFSYNC_S_NONE;
5445 s->state_flags |= pd->act.flags; /* Only needed for pfsync and state export */
5446
5447 if (nr != NULL)
5448 s->act.log |= nr->log & PF_LOG_ALL;
5449 switch (pd->proto) {
5450 case IPPROTO_TCP:
5451 s->src.seqlo = ntohl(th->th_seq);
5452 s->src.seqhi = s->src.seqlo + pd->p_len + 1;
5453 if ((tcp_get_flags(th) & (TH_SYN|TH_ACK)) == TH_SYN &&
5454 r->keep_state == PF_STATE_MODULATE) {
5455 /* Generate sequence number modulator */
5456 if ((s->src.seqdiff = pf_tcp_iss(pd) - s->src.seqlo) ==
5457 0)
5458 s->src.seqdiff = 1;
5459 pf_change_proto_a(pd->m, &th->th_seq, &th->th_sum,
5460 htonl(s->src.seqlo + s->src.seqdiff), 0);
5461 *rewrite = 1;
5462 } else
5463 s->src.seqdiff = 0;
5464 if (tcp_get_flags(th) & TH_SYN) {
5465 s->src.seqhi++;
5466 s->src.wscale = pf_get_wscale(pd);
5467 }
5468 s->src.max_win = MAX(ntohs(th->th_win), 1);
5469 if (s->src.wscale & PF_WSCALE_MASK) {
5470 /* Remove scale factor from initial window */
5471 int win = s->src.max_win;
5472 win += 1 << (s->src.wscale & PF_WSCALE_MASK);
5473 s->src.max_win = (win - 1) >>
5474 (s->src.wscale & PF_WSCALE_MASK);
5475 }
5476 if (tcp_get_flags(th) & TH_FIN)
5477 s->src.seqhi++;
5478 s->dst.seqhi = 1;
5479 s->dst.max_win = 1;
5480 pf_set_protostate(s, PF_PEER_SRC, TCPS_SYN_SENT);
5481 pf_set_protostate(s, PF_PEER_DST, TCPS_CLOSED);
5482 s->timeout = PFTM_TCP_FIRST_PACKET;
5483 atomic_add_32(&V_pf_status.states_halfopen, 1);
5484 break;
5485 case IPPROTO_UDP:
5486 pf_set_protostate(s, PF_PEER_SRC, PFUDPS_SINGLE);
5487 pf_set_protostate(s, PF_PEER_DST, PFUDPS_NO_TRAFFIC);
5488 s->timeout = PFTM_UDP_FIRST_PACKET;
5489 break;
5490 case IPPROTO_SCTP:
5491 pf_set_protostate(s, PF_PEER_SRC, SCTP_COOKIE_WAIT);
5492 pf_set_protostate(s, PF_PEER_DST, SCTP_CLOSED);
5493 s->timeout = PFTM_SCTP_FIRST_PACKET;
5494 break;
5495 case IPPROTO_ICMP:
5496 #ifdef INET6
5497 case IPPROTO_ICMPV6:
5498 #endif
5499 s->timeout = PFTM_ICMP_FIRST_PACKET;
5500 break;
5501 default:
5502 pf_set_protostate(s, PF_PEER_SRC, PFOTHERS_SINGLE);
5503 pf_set_protostate(s, PF_PEER_DST, PFOTHERS_NO_TRAFFIC);
5504 s->timeout = PFTM_OTHER_FIRST_PACKET;
5505 }
5506
5507 s->creation = s->expire = pf_get_uptime();
5508
5509 if (pd->proto == IPPROTO_TCP) {
5510 if (s->state_flags & PFSTATE_SCRUB_TCP &&
5511 pf_normalize_tcp_init(pd, th, &s->src, &s->dst)) {
5512 REASON_SET(&reason, PFRES_MEMORY);
5513 goto csfailed;
5514 }
5515 if (s->state_flags & PFSTATE_SCRUB_TCP && s->src.scrub &&
5516 pf_normalize_tcp_stateful(pd, &reason, th, s,
5517 &s->src, &s->dst, rewrite)) {
5518 /* This really shouldn't happen!!! */
5519 DPFPRINTF(PF_DEBUG_URGENT,
5520 ("pf_normalize_tcp_stateful failed on first "
5521 "pkt\n"));
5522 goto csfailed;
5523 }
5524 } else if (pd->proto == IPPROTO_SCTP) {
5525 if (pf_normalize_sctp_init(pd, &s->src, &s->dst))
5526 goto csfailed;
5527 if (! (pd->sctp_flags & (PFDESC_SCTP_INIT | PFDESC_SCTP_ADD_IP)))
5528 goto csfailed;
5529 }
5530 s->direction = pd->dir;
5531
5532 /*
5533 * sk/nk could already been setup by pf_get_translation().
5534 */
5535 if (nr == NULL) {
5536 KASSERT((sk == NULL && nk == NULL), ("%s: nr %p sk %p, nk %p",
5537 __func__, nr, sk, nk));
5538 sk = pf_state_key_setup(pd, pd->src, pd->dst, sport, dport);
5539 if (sk == NULL)
5540 goto csfailed;
5541 nk = sk;
5542 } else
5543 KASSERT((sk != NULL && nk != NULL), ("%s: nr %p sk %p, nk %p",
5544 __func__, nr, sk, nk));
5545
5546 /* Swap sk/nk for PF_OUT. */
5547 if (pf_state_insert(BOUND_IFACE(s, pd->kif), pd->kif,
5548 (pd->dir == PF_IN) ? sk : nk,
5549 (pd->dir == PF_IN) ? nk : sk, s)) {
5550 REASON_SET(&reason, PFRES_STATEINS);
5551 goto drop;
5552 } else
5553 *sm = s;
5554
5555 /*
5556 * Lock order is important: first state, then source node.
5557 */
5558 if (pf_src_node_exists(&sn, snh)) {
5559 s->src_node = sn;
5560 PF_HASHROW_UNLOCK(snh);
5561 }
5562 if (pf_src_node_exists(&nsn, nsnh)) {
5563 s->nat_src_node = nsn;
5564 PF_HASHROW_UNLOCK(nsnh);
5565 }
5566
5567 if (tag > 0)
5568 s->tag = tag;
5569 if (pd->proto == IPPROTO_TCP && (tcp_get_flags(th) & (TH_SYN|TH_ACK)) ==
5570 TH_SYN && r->keep_state == PF_STATE_SYNPROXY) {
5571 pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_SRC);
5572 /* undo NAT changes, if they have taken place */
5573 if (nr != NULL) {
5574 struct pf_state_key *skt = s->key[PF_SK_WIRE];
5575 if (pd->dir == PF_OUT)
5576 skt = s->key[PF_SK_STACK];
5577 PF_ACPY(pd->src, &skt->addr[pd->sidx], pd->af);
5578 PF_ACPY(pd->dst, &skt->addr[pd->didx], pd->af);
5579 if (pd->sport)
5580 *pd->sport = skt->port[pd->sidx];
5581 if (pd->dport)
5582 *pd->dport = skt->port[pd->didx];
5583 if (pd->ip_sum)
5584 *pd->ip_sum = bip_sum;
5585 m_copyback(pd->m, pd->off, pd->hdrlen, pd->hdr.any);
5586 }
5587 s->src.seqhi = htonl(arc4random());
5588 /* Find mss option */
5589 int rtid = M_GETFIB(pd->m);
5590 mss = pf_get_mss(pd);
5591 mss = pf_calc_mss(pd->src, pd->af, rtid, mss);
5592 mss = pf_calc_mss(pd->dst, pd->af, rtid, mss);
5593 s->src.mss = mss;
5594 pf_send_tcp(r, pd->af, pd->dst, pd->src, th->th_dport,
5595 th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1,
5596 TH_SYN|TH_ACK, 0, s->src.mss, 0, M_SKIP_FIREWALL, 0, 0,
5597 pd->act.rtableid);
5598 REASON_SET(&reason, PFRES_SYNPROXY);
5599 return (PF_SYNPROXY_DROP);
5600 }
5601
5602 s->udp_mapping = udp_mapping;
5603
5604 return (PF_PASS);
5605
5606 csfailed:
5607 while ((ri = SLIST_FIRST(match_rules))) {
5608 SLIST_REMOVE_HEAD(match_rules, entry);
5609 free(ri, M_PF_RULE_ITEM);
5610 }
5611
5612 uma_zfree(V_pf_state_key_z, sk);
5613 uma_zfree(V_pf_state_key_z, nk);
5614
5615 if (pf_src_node_exists(&sn, snh)) {
5616 if (--sn->states == 0 && sn->expire == 0) {
5617 pf_unlink_src_node(sn);
5618 pf_free_src_node(sn);
5619 counter_u64_add(
5620 V_pf_status.scounters[SCNT_SRC_NODE_REMOVALS], 1);
5621 }
5622 PF_HASHROW_UNLOCK(snh);
5623 }
5624
5625 if (sn != nsn && pf_src_node_exists(&nsn, nsnh)) {
5626 if (--nsn->states == 0 && nsn->expire == 0) {
5627 pf_unlink_src_node(nsn);
5628 pf_free_src_node(nsn);
5629 counter_u64_add(
5630 V_pf_status.scounters[SCNT_SRC_NODE_REMOVALS], 1);
5631 }
5632 PF_HASHROW_UNLOCK(nsnh);
5633 }
5634
5635 drop:
5636 if (s != NULL) {
5637 pf_src_tree_remove_state(s);
5638 s->timeout = PFTM_UNLINKED;
5639 STATE_DEC_COUNTERS(s);
5640 pf_free_state(s);
5641 }
5642
5643 return (PF_DROP);
5644 }
5645
5646 static int
pf_tcp_track_full(struct pf_kstate ** state,struct pf_pdesc * pd,u_short * reason,int * copyback)5647 pf_tcp_track_full(struct pf_kstate **state, struct pf_pdesc *pd,
5648 u_short *reason, int *copyback)
5649 {
5650 struct tcphdr *th = &pd->hdr.tcp;
5651 struct pf_state_peer *src, *dst;
5652 u_int16_t win = ntohs(th->th_win);
5653 u_int32_t ack, end, data_end, seq, orig_seq;
5654 u_int8_t sws, dws, psrc, pdst;
5655 int ackskew;
5656
5657 if (pd->dir == (*state)->direction) {
5658 src = &(*state)->src;
5659 dst = &(*state)->dst;
5660 psrc = PF_PEER_SRC;
5661 pdst = PF_PEER_DST;
5662 } else {
5663 src = &(*state)->dst;
5664 dst = &(*state)->src;
5665 psrc = PF_PEER_DST;
5666 pdst = PF_PEER_SRC;
5667 }
5668
5669 if (src->wscale && dst->wscale && !(tcp_get_flags(th) & TH_SYN)) {
5670 sws = src->wscale & PF_WSCALE_MASK;
5671 dws = dst->wscale & PF_WSCALE_MASK;
5672 } else
5673 sws = dws = 0;
5674
5675 /*
5676 * Sequence tracking algorithm from Guido van Rooij's paper:
5677 * http://www.madison-gurkha.com/publications/tcp_filtering/
5678 * tcp_filtering.ps
5679 */
5680
5681 orig_seq = seq = ntohl(th->th_seq);
5682 if (src->seqlo == 0) {
5683 /* First packet from this end. Set its state */
5684
5685 if (((*state)->state_flags & PFSTATE_SCRUB_TCP || dst->scrub) &&
5686 src->scrub == NULL) {
5687 if (pf_normalize_tcp_init(pd, th, src, dst)) {
5688 REASON_SET(reason, PFRES_MEMORY);
5689 return (PF_DROP);
5690 }
5691 }
5692
5693 /* Deferred generation of sequence number modulator */
5694 if (dst->seqdiff && !src->seqdiff) {
5695 /* use random iss for the TCP server */
5696 while ((src->seqdiff = arc4random() - seq) == 0)
5697 ;
5698 ack = ntohl(th->th_ack) - dst->seqdiff;
5699 pf_change_proto_a(pd->m, &th->th_seq, &th->th_sum, htonl(seq +
5700 src->seqdiff), 0);
5701 pf_change_proto_a(pd->m, &th->th_ack, &th->th_sum, htonl(ack), 0);
5702 *copyback = 1;
5703 } else {
5704 ack = ntohl(th->th_ack);
5705 }
5706
5707 end = seq + pd->p_len;
5708 if (tcp_get_flags(th) & TH_SYN) {
5709 end++;
5710 if (dst->wscale & PF_WSCALE_FLAG) {
5711 src->wscale = pf_get_wscale(pd);
5712 if (src->wscale & PF_WSCALE_FLAG) {
5713 /* Remove scale factor from initial
5714 * window */
5715 sws = src->wscale & PF_WSCALE_MASK;
5716 win = ((u_int32_t)win + (1 << sws) - 1)
5717 >> sws;
5718 dws = dst->wscale & PF_WSCALE_MASK;
5719 } else {
5720 /* fixup other window */
5721 dst->max_win = MIN(TCP_MAXWIN,
5722 (u_int32_t)dst->max_win <<
5723 (dst->wscale & PF_WSCALE_MASK));
5724 /* in case of a retrans SYN|ACK */
5725 dst->wscale = 0;
5726 }
5727 }
5728 }
5729 data_end = end;
5730 if (tcp_get_flags(th) & TH_FIN)
5731 end++;
5732
5733 src->seqlo = seq;
5734 if (src->state < TCPS_SYN_SENT)
5735 pf_set_protostate(*state, psrc, TCPS_SYN_SENT);
5736
5737 /*
5738 * May need to slide the window (seqhi may have been set by
5739 * the crappy stack check or if we picked up the connection
5740 * after establishment)
5741 */
5742 if (src->seqhi == 1 ||
5743 SEQ_GEQ(end + MAX(1, dst->max_win << dws), src->seqhi))
5744 src->seqhi = end + MAX(1, dst->max_win << dws);
5745 if (win > src->max_win)
5746 src->max_win = win;
5747
5748 } else {
5749 ack = ntohl(th->th_ack) - dst->seqdiff;
5750 if (src->seqdiff) {
5751 /* Modulate sequence numbers */
5752 pf_change_proto_a(pd->m, &th->th_seq, &th->th_sum, htonl(seq +
5753 src->seqdiff), 0);
5754 pf_change_proto_a(pd->m, &th->th_ack, &th->th_sum, htonl(ack), 0);
5755 *copyback = 1;
5756 }
5757 end = seq + pd->p_len;
5758 if (tcp_get_flags(th) & TH_SYN)
5759 end++;
5760 data_end = end;
5761 if (tcp_get_flags(th) & TH_FIN)
5762 end++;
5763 }
5764
5765 if ((tcp_get_flags(th) & TH_ACK) == 0) {
5766 /* Let it pass through the ack skew check */
5767 ack = dst->seqlo;
5768 } else if ((ack == 0 &&
5769 (tcp_get_flags(th) & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) ||
5770 /* broken tcp stacks do not set ack */
5771 (dst->state < TCPS_SYN_SENT)) {
5772 /*
5773 * Many stacks (ours included) will set the ACK number in an
5774 * FIN|ACK if the SYN times out -- no sequence to ACK.
5775 */
5776 ack = dst->seqlo;
5777 }
5778
5779 if (seq == end) {
5780 /* Ease sequencing restrictions on no data packets */
5781 seq = src->seqlo;
5782 data_end = end = seq;
5783 }
5784
5785 ackskew = dst->seqlo - ack;
5786
5787 /*
5788 * Need to demodulate the sequence numbers in any TCP SACK options
5789 * (Selective ACK). We could optionally validate the SACK values
5790 * against the current ACK window, either forwards or backwards, but
5791 * I'm not confident that SACK has been implemented properly
5792 * everywhere. It wouldn't surprise me if several stacks accidentally
5793 * SACK too far backwards of previously ACKed data. There really aren't
5794 * any security implications of bad SACKing unless the target stack
5795 * doesn't validate the option length correctly. Someone trying to
5796 * spoof into a TCP connection won't bother blindly sending SACK
5797 * options anyway.
5798 */
5799 if (dst->seqdiff && (th->th_off << 2) > sizeof(struct tcphdr)) {
5800 if (pf_modulate_sack(pd, th, dst))
5801 *copyback = 1;
5802 }
5803
5804 #define MAXACKWINDOW (0xffff + 1500) /* 1500 is an arbitrary fudge factor */
5805 if (SEQ_GEQ(src->seqhi, data_end) &&
5806 /* Last octet inside other's window space */
5807 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) &&
5808 /* Retrans: not more than one window back */
5809 (ackskew >= -MAXACKWINDOW) &&
5810 /* Acking not more than one reassembled fragment backwards */
5811 (ackskew <= (MAXACKWINDOW << sws)) &&
5812 /* Acking not more than one window forward */
5813 ((tcp_get_flags(th) & TH_RST) == 0 || orig_seq == src->seqlo ||
5814 (orig_seq == src->seqlo + 1) || (orig_seq + 1 == src->seqlo))) {
5815 /* Require an exact/+1 sequence match on resets when possible */
5816
5817 if (dst->scrub || src->scrub) {
5818 if (pf_normalize_tcp_stateful(pd, reason, th,
5819 *state, src, dst, copyback))
5820 return (PF_DROP);
5821 }
5822
5823 /* update max window */
5824 if (src->max_win < win)
5825 src->max_win = win;
5826 /* synchronize sequencing */
5827 if (SEQ_GT(end, src->seqlo))
5828 src->seqlo = end;
5829 /* slide the window of what the other end can send */
5830 if (SEQ_GEQ(ack + (win << sws), dst->seqhi))
5831 dst->seqhi = ack + MAX((win << sws), 1);
5832
5833 /* update states */
5834 if (tcp_get_flags(th) & TH_SYN)
5835 if (src->state < TCPS_SYN_SENT)
5836 pf_set_protostate(*state, psrc, TCPS_SYN_SENT);
5837 if (tcp_get_flags(th) & TH_FIN)
5838 if (src->state < TCPS_CLOSING)
5839 pf_set_protostate(*state, psrc, TCPS_CLOSING);
5840 if (tcp_get_flags(th) & TH_ACK) {
5841 if (dst->state == TCPS_SYN_SENT) {
5842 pf_set_protostate(*state, pdst,
5843 TCPS_ESTABLISHED);
5844 if (src->state == TCPS_ESTABLISHED &&
5845 (*state)->src_node != NULL &&
5846 pf_src_connlimit(*state)) {
5847 REASON_SET(reason, PFRES_SRCLIMIT);
5848 return (PF_DROP);
5849 }
5850 } else if (dst->state == TCPS_CLOSING)
5851 pf_set_protostate(*state, pdst,
5852 TCPS_FIN_WAIT_2);
5853 }
5854 if (tcp_get_flags(th) & TH_RST)
5855 pf_set_protostate(*state, PF_PEER_BOTH, TCPS_TIME_WAIT);
5856
5857 /* update expire time */
5858 (*state)->expire = pf_get_uptime();
5859 if (src->state >= TCPS_FIN_WAIT_2 &&
5860 dst->state >= TCPS_FIN_WAIT_2)
5861 (*state)->timeout = PFTM_TCP_CLOSED;
5862 else if (src->state >= TCPS_CLOSING &&
5863 dst->state >= TCPS_CLOSING)
5864 (*state)->timeout = PFTM_TCP_FIN_WAIT;
5865 else if (src->state < TCPS_ESTABLISHED ||
5866 dst->state < TCPS_ESTABLISHED)
5867 (*state)->timeout = PFTM_TCP_OPENING;
5868 else if (src->state >= TCPS_CLOSING ||
5869 dst->state >= TCPS_CLOSING)
5870 (*state)->timeout = PFTM_TCP_CLOSING;
5871 else
5872 (*state)->timeout = PFTM_TCP_ESTABLISHED;
5873
5874 /* Fall through to PASS packet */
5875
5876 } else if ((dst->state < TCPS_SYN_SENT ||
5877 dst->state >= TCPS_FIN_WAIT_2 ||
5878 src->state >= TCPS_FIN_WAIT_2) &&
5879 SEQ_GEQ(src->seqhi + MAXACKWINDOW, data_end) &&
5880 /* Within a window forward of the originating packet */
5881 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW)) {
5882 /* Within a window backward of the originating packet */
5883
5884 /*
5885 * This currently handles three situations:
5886 * 1) Stupid stacks will shotgun SYNs before their peer
5887 * replies.
5888 * 2) When PF catches an already established stream (the
5889 * firewall rebooted, the state table was flushed, routes
5890 * changed...)
5891 * 3) Packets get funky immediately after the connection
5892 * closes (this should catch Solaris spurious ACK|FINs
5893 * that web servers like to spew after a close)
5894 *
5895 * This must be a little more careful than the above code
5896 * since packet floods will also be caught here. We don't
5897 * update the TTL here to mitigate the damage of a packet
5898 * flood and so the same code can handle awkward establishment
5899 * and a loosened connection close.
5900 * In the establishment case, a correct peer response will
5901 * validate the connection, go through the normal state code
5902 * and keep updating the state TTL.
5903 */
5904
5905 if (V_pf_status.debug >= PF_DEBUG_MISC) {
5906 printf("pf: loose state match: ");
5907 pf_print_state(*state);
5908 pf_print_flags(tcp_get_flags(th));
5909 printf(" seq=%u (%u) ack=%u len=%u ackskew=%d "
5910 "pkts=%llu:%llu dir=%s,%s\n", seq, orig_seq, ack,
5911 pd->p_len, ackskew, (unsigned long long)(*state)->packets[0],
5912 (unsigned long long)(*state)->packets[1],
5913 pd->dir == PF_IN ? "in" : "out",
5914 pd->dir == (*state)->direction ? "fwd" : "rev");
5915 }
5916
5917 if (dst->scrub || src->scrub) {
5918 if (pf_normalize_tcp_stateful(pd, reason, th,
5919 *state, src, dst, copyback))
5920 return (PF_DROP);
5921 }
5922
5923 /* update max window */
5924 if (src->max_win < win)
5925 src->max_win = win;
5926 /* synchronize sequencing */
5927 if (SEQ_GT(end, src->seqlo))
5928 src->seqlo = end;
5929 /* slide the window of what the other end can send */
5930 if (SEQ_GEQ(ack + (win << sws), dst->seqhi))
5931 dst->seqhi = ack + MAX((win << sws), 1);
5932
5933 /*
5934 * Cannot set dst->seqhi here since this could be a shotgunned
5935 * SYN and not an already established connection.
5936 */
5937
5938 if (tcp_get_flags(th) & TH_FIN)
5939 if (src->state < TCPS_CLOSING)
5940 pf_set_protostate(*state, psrc, TCPS_CLOSING);
5941 if (tcp_get_flags(th) & TH_RST)
5942 pf_set_protostate(*state, PF_PEER_BOTH, TCPS_TIME_WAIT);
5943
5944 /* Fall through to PASS packet */
5945
5946 } else {
5947 if ((*state)->dst.state == TCPS_SYN_SENT &&
5948 (*state)->src.state == TCPS_SYN_SENT) {
5949 /* Send RST for state mismatches during handshake */
5950 if (!(tcp_get_flags(th) & TH_RST))
5951 pf_send_tcp((*state)->rule, pd->af,
5952 pd->dst, pd->src, th->th_dport,
5953 th->th_sport, ntohl(th->th_ack), 0,
5954 TH_RST, 0, 0,
5955 (*state)->rule->return_ttl, M_SKIP_FIREWALL,
5956 0, 0, (*state)->act.rtableid);
5957 src->seqlo = 0;
5958 src->seqhi = 1;
5959 src->max_win = 1;
5960 } else if (V_pf_status.debug >= PF_DEBUG_MISC) {
5961 printf("pf: BAD state: ");
5962 pf_print_state(*state);
5963 pf_print_flags(tcp_get_flags(th));
5964 printf(" seq=%u (%u) ack=%u len=%u ackskew=%d "
5965 "pkts=%llu:%llu dir=%s,%s\n",
5966 seq, orig_seq, ack, pd->p_len, ackskew,
5967 (unsigned long long)(*state)->packets[0],
5968 (unsigned long long)(*state)->packets[1],
5969 pd->dir == PF_IN ? "in" : "out",
5970 pd->dir == (*state)->direction ? "fwd" : "rev");
5971 printf("pf: State failure on: %c %c %c %c | %c %c\n",
5972 SEQ_GEQ(src->seqhi, data_end) ? ' ' : '1',
5973 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) ?
5974 ' ': '2',
5975 (ackskew >= -MAXACKWINDOW) ? ' ' : '3',
5976 (ackskew <= (MAXACKWINDOW << sws)) ? ' ' : '4',
5977 SEQ_GEQ(src->seqhi + MAXACKWINDOW, data_end) ?' ' :'5',
5978 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW) ?' ' :'6');
5979 }
5980 REASON_SET(reason, PFRES_BADSTATE);
5981 return (PF_DROP);
5982 }
5983
5984 return (PF_PASS);
5985 }
5986
5987 static int
pf_tcp_track_sloppy(struct pf_kstate ** state,struct pf_pdesc * pd,u_short * reason)5988 pf_tcp_track_sloppy(struct pf_kstate **state, struct pf_pdesc *pd, u_short *reason)
5989 {
5990 struct tcphdr *th = &pd->hdr.tcp;
5991 struct pf_state_peer *src, *dst;
5992 u_int8_t psrc, pdst;
5993
5994 if (pd->dir == (*state)->direction) {
5995 src = &(*state)->src;
5996 dst = &(*state)->dst;
5997 psrc = PF_PEER_SRC;
5998 pdst = PF_PEER_DST;
5999 } else {
6000 src = &(*state)->dst;
6001 dst = &(*state)->src;
6002 psrc = PF_PEER_DST;
6003 pdst = PF_PEER_SRC;
6004 }
6005
6006 if (tcp_get_flags(th) & TH_SYN)
6007 if (src->state < TCPS_SYN_SENT)
6008 pf_set_protostate(*state, psrc, TCPS_SYN_SENT);
6009 if (tcp_get_flags(th) & TH_FIN)
6010 if (src->state < TCPS_CLOSING)
6011 pf_set_protostate(*state, psrc, TCPS_CLOSING);
6012 if (tcp_get_flags(th) & TH_ACK) {
6013 if (dst->state == TCPS_SYN_SENT) {
6014 pf_set_protostate(*state, pdst, TCPS_ESTABLISHED);
6015 if (src->state == TCPS_ESTABLISHED &&
6016 (*state)->src_node != NULL &&
6017 pf_src_connlimit(*state)) {
6018 REASON_SET(reason, PFRES_SRCLIMIT);
6019 return (PF_DROP);
6020 }
6021 } else if (dst->state == TCPS_CLOSING) {
6022 pf_set_protostate(*state, pdst, TCPS_FIN_WAIT_2);
6023 } else if (src->state == TCPS_SYN_SENT &&
6024 dst->state < TCPS_SYN_SENT) {
6025 /*
6026 * Handle a special sloppy case where we only see one
6027 * half of the connection. If there is a ACK after
6028 * the initial SYN without ever seeing a packet from
6029 * the destination, set the connection to established.
6030 */
6031 pf_set_protostate(*state, PF_PEER_BOTH,
6032 TCPS_ESTABLISHED);
6033 dst->state = src->state = TCPS_ESTABLISHED;
6034 if ((*state)->src_node != NULL &&
6035 pf_src_connlimit(*state)) {
6036 REASON_SET(reason, PFRES_SRCLIMIT);
6037 return (PF_DROP);
6038 }
6039 } else if (src->state == TCPS_CLOSING &&
6040 dst->state == TCPS_ESTABLISHED &&
6041 dst->seqlo == 0) {
6042 /*
6043 * Handle the closing of half connections where we
6044 * don't see the full bidirectional FIN/ACK+ACK
6045 * handshake.
6046 */
6047 pf_set_protostate(*state, pdst, TCPS_CLOSING);
6048 }
6049 }
6050 if (tcp_get_flags(th) & TH_RST)
6051 pf_set_protostate(*state, PF_PEER_BOTH, TCPS_TIME_WAIT);
6052
6053 /* update expire time */
6054 (*state)->expire = pf_get_uptime();
6055 if (src->state >= TCPS_FIN_WAIT_2 &&
6056 dst->state >= TCPS_FIN_WAIT_2)
6057 (*state)->timeout = PFTM_TCP_CLOSED;
6058 else if (src->state >= TCPS_CLOSING &&
6059 dst->state >= TCPS_CLOSING)
6060 (*state)->timeout = PFTM_TCP_FIN_WAIT;
6061 else if (src->state < TCPS_ESTABLISHED ||
6062 dst->state < TCPS_ESTABLISHED)
6063 (*state)->timeout = PFTM_TCP_OPENING;
6064 else if (src->state >= TCPS_CLOSING ||
6065 dst->state >= TCPS_CLOSING)
6066 (*state)->timeout = PFTM_TCP_CLOSING;
6067 else
6068 (*state)->timeout = PFTM_TCP_ESTABLISHED;
6069
6070 return (PF_PASS);
6071 }
6072
6073 static int
pf_synproxy(struct pf_pdesc * pd,struct pf_kstate ** state,u_short * reason)6074 pf_synproxy(struct pf_pdesc *pd, struct pf_kstate **state, u_short *reason)
6075 {
6076 struct pf_state_key *sk = (*state)->key[pd->didx];
6077 struct tcphdr *th = &pd->hdr.tcp;
6078
6079 if ((*state)->src.state == PF_TCPS_PROXY_SRC) {
6080 if (pd->dir != (*state)->direction) {
6081 REASON_SET(reason, PFRES_SYNPROXY);
6082 return (PF_SYNPROXY_DROP);
6083 }
6084 if (tcp_get_flags(th) & TH_SYN) {
6085 if (ntohl(th->th_seq) != (*state)->src.seqlo) {
6086 REASON_SET(reason, PFRES_SYNPROXY);
6087 return (PF_DROP);
6088 }
6089 pf_send_tcp((*state)->rule, pd->af, pd->dst,
6090 pd->src, th->th_dport, th->th_sport,
6091 (*state)->src.seqhi, ntohl(th->th_seq) + 1,
6092 TH_SYN|TH_ACK, 0, (*state)->src.mss, 0,
6093 M_SKIP_FIREWALL, 0, 0, (*state)->act.rtableid);
6094 REASON_SET(reason, PFRES_SYNPROXY);
6095 return (PF_SYNPROXY_DROP);
6096 } else if ((tcp_get_flags(th) & (TH_ACK|TH_RST|TH_FIN)) != TH_ACK ||
6097 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) ||
6098 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) {
6099 REASON_SET(reason, PFRES_SYNPROXY);
6100 return (PF_DROP);
6101 } else if ((*state)->src_node != NULL &&
6102 pf_src_connlimit(*state)) {
6103 REASON_SET(reason, PFRES_SRCLIMIT);
6104 return (PF_DROP);
6105 } else
6106 pf_set_protostate(*state, PF_PEER_SRC,
6107 PF_TCPS_PROXY_DST);
6108 }
6109 if ((*state)->src.state == PF_TCPS_PROXY_DST) {
6110 if (pd->dir == (*state)->direction) {
6111 if (((tcp_get_flags(th) & (TH_SYN|TH_ACK)) != TH_ACK) ||
6112 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) ||
6113 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) {
6114 REASON_SET(reason, PFRES_SYNPROXY);
6115 return (PF_DROP);
6116 }
6117 (*state)->src.max_win = MAX(ntohs(th->th_win), 1);
6118 if ((*state)->dst.seqhi == 1)
6119 (*state)->dst.seqhi = htonl(arc4random());
6120 pf_send_tcp((*state)->rule, pd->af,
6121 &sk->addr[pd->sidx], &sk->addr[pd->didx],
6122 sk->port[pd->sidx], sk->port[pd->didx],
6123 (*state)->dst.seqhi, 0, TH_SYN, 0,
6124 (*state)->src.mss, 0,
6125 (*state)->orig_kif->pfik_ifp == V_loif ? M_LOOP : 0,
6126 (*state)->tag, 0, (*state)->act.rtableid);
6127 REASON_SET(reason, PFRES_SYNPROXY);
6128 return (PF_SYNPROXY_DROP);
6129 } else if (((tcp_get_flags(th) & (TH_SYN|TH_ACK)) !=
6130 (TH_SYN|TH_ACK)) ||
6131 (ntohl(th->th_ack) != (*state)->dst.seqhi + 1)) {
6132 REASON_SET(reason, PFRES_SYNPROXY);
6133 return (PF_DROP);
6134 } else {
6135 (*state)->dst.max_win = MAX(ntohs(th->th_win), 1);
6136 (*state)->dst.seqlo = ntohl(th->th_seq);
6137 pf_send_tcp((*state)->rule, pd->af, pd->dst,
6138 pd->src, th->th_dport, th->th_sport,
6139 ntohl(th->th_ack), ntohl(th->th_seq) + 1,
6140 TH_ACK, (*state)->src.max_win, 0, 0, 0,
6141 (*state)->tag, 0, (*state)->act.rtableid);
6142 pf_send_tcp((*state)->rule, pd->af,
6143 &sk->addr[pd->sidx], &sk->addr[pd->didx],
6144 sk->port[pd->sidx], sk->port[pd->didx],
6145 (*state)->src.seqhi + 1, (*state)->src.seqlo + 1,
6146 TH_ACK, (*state)->dst.max_win, 0, 0,
6147 M_SKIP_FIREWALL, 0, 0, (*state)->act.rtableid);
6148 (*state)->src.seqdiff = (*state)->dst.seqhi -
6149 (*state)->src.seqlo;
6150 (*state)->dst.seqdiff = (*state)->src.seqhi -
6151 (*state)->dst.seqlo;
6152 (*state)->src.seqhi = (*state)->src.seqlo +
6153 (*state)->dst.max_win;
6154 (*state)->dst.seqhi = (*state)->dst.seqlo +
6155 (*state)->src.max_win;
6156 (*state)->src.wscale = (*state)->dst.wscale = 0;
6157 pf_set_protostate(*state, PF_PEER_BOTH,
6158 TCPS_ESTABLISHED);
6159 REASON_SET(reason, PFRES_SYNPROXY);
6160 return (PF_SYNPROXY_DROP);
6161 }
6162 }
6163
6164 return (PF_PASS);
6165 }
6166
6167 static int
pf_test_state_tcp(struct pf_kstate ** state,struct pf_pdesc * pd,u_short * reason)6168 pf_test_state_tcp(struct pf_kstate **state, struct pf_pdesc *pd,
6169 u_short *reason)
6170 {
6171 struct pf_state_key_cmp key;
6172 struct tcphdr *th = &pd->hdr.tcp;
6173 int copyback = 0;
6174 int action;
6175 struct pf_state_peer *src, *dst;
6176
6177 bzero(&key, sizeof(key));
6178 key.af = pd->af;
6179 key.proto = IPPROTO_TCP;
6180 if (pd->dir == PF_IN) { /* wire side, straight */
6181 PF_ACPY(&key.addr[0], pd->src, key.af);
6182 PF_ACPY(&key.addr[1], pd->dst, key.af);
6183 key.port[0] = th->th_sport;
6184 key.port[1] = th->th_dport;
6185 } else { /* stack side, reverse */
6186 PF_ACPY(&key.addr[1], pd->src, key.af);
6187 PF_ACPY(&key.addr[0], pd->dst, key.af);
6188 key.port[1] = th->th_sport;
6189 key.port[0] = th->th_dport;
6190 }
6191
6192 STATE_LOOKUP(&key, *state, pd);
6193
6194 if (pd->dir == (*state)->direction) {
6195 src = &(*state)->src;
6196 dst = &(*state)->dst;
6197 } else {
6198 src = &(*state)->dst;
6199 dst = &(*state)->src;
6200 }
6201
6202 if ((action = pf_synproxy(pd, state, reason)) != PF_PASS)
6203 return (action);
6204
6205 if (dst->state >= TCPS_FIN_WAIT_2 &&
6206 src->state >= TCPS_FIN_WAIT_2 &&
6207 (((tcp_get_flags(th) & (TH_SYN|TH_ACK)) == TH_SYN) ||
6208 ((tcp_get_flags(th) & (TH_SYN|TH_ACK|TH_RST)) == TH_ACK &&
6209 pf_syncookie_check(pd) && pd->dir == PF_IN))) {
6210 if (V_pf_status.debug >= PF_DEBUG_MISC) {
6211 printf("pf: state reuse ");
6212 pf_print_state(*state);
6213 pf_print_flags(tcp_get_flags(th));
6214 printf("\n");
6215 }
6216 /* XXX make sure it's the same direction ?? */
6217 pf_set_protostate(*state, PF_PEER_BOTH, TCPS_CLOSED);
6218 pf_unlink_state(*state);
6219 *state = NULL;
6220 return (PF_DROP);
6221 }
6222
6223 if ((*state)->state_flags & PFSTATE_SLOPPY) {
6224 if (pf_tcp_track_sloppy(state, pd, reason) == PF_DROP)
6225 return (PF_DROP);
6226 } else {
6227 if (pf_tcp_track_full(state, pd, reason,
6228 ©back) == PF_DROP)
6229 return (PF_DROP);
6230 }
6231
6232 /* translate source/destination address, if necessary */
6233 if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) {
6234 struct pf_state_key *nk = (*state)->key[pd->didx];
6235
6236 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af) ||
6237 nk->port[pd->sidx] != th->th_sport)
6238 pf_change_ap(pd->m, pd->src, &th->th_sport,
6239 pd->ip_sum, &th->th_sum, &nk->addr[pd->sidx],
6240 nk->port[pd->sidx], 0, pd->af);
6241
6242 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af) ||
6243 nk->port[pd->didx] != th->th_dport)
6244 pf_change_ap(pd->m, pd->dst, &th->th_dport,
6245 pd->ip_sum, &th->th_sum, &nk->addr[pd->didx],
6246 nk->port[pd->didx], 0, pd->af);
6247 copyback = 1;
6248 }
6249
6250 /* Copyback sequence modulation or stateful scrub changes if needed */
6251 if (copyback)
6252 m_copyback(pd->m, pd->off, sizeof(*th), (caddr_t)th);
6253
6254 return (PF_PASS);
6255 }
6256
6257 static int
pf_test_state_udp(struct pf_kstate ** state,struct pf_pdesc * pd)6258 pf_test_state_udp(struct pf_kstate **state, struct pf_pdesc *pd)
6259 {
6260 struct pf_state_peer *src, *dst;
6261 struct pf_state_key_cmp key;
6262 struct udphdr *uh = &pd->hdr.udp;
6263 uint8_t psrc, pdst;
6264
6265 bzero(&key, sizeof(key));
6266 key.af = pd->af;
6267 key.proto = IPPROTO_UDP;
6268 if (pd->dir == PF_IN) { /* wire side, straight */
6269 PF_ACPY(&key.addr[0], pd->src, key.af);
6270 PF_ACPY(&key.addr[1], pd->dst, key.af);
6271 key.port[0] = uh->uh_sport;
6272 key.port[1] = uh->uh_dport;
6273 } else { /* stack side, reverse */
6274 PF_ACPY(&key.addr[1], pd->src, key.af);
6275 PF_ACPY(&key.addr[0], pd->dst, key.af);
6276 key.port[1] = uh->uh_sport;
6277 key.port[0] = uh->uh_dport;
6278 }
6279
6280 STATE_LOOKUP(&key, *state, pd);
6281
6282 if (pd->dir == (*state)->direction) {
6283 src = &(*state)->src;
6284 dst = &(*state)->dst;
6285 psrc = PF_PEER_SRC;
6286 pdst = PF_PEER_DST;
6287 } else {
6288 src = &(*state)->dst;
6289 dst = &(*state)->src;
6290 psrc = PF_PEER_DST;
6291 pdst = PF_PEER_SRC;
6292 }
6293
6294 /* update states */
6295 if (src->state < PFUDPS_SINGLE)
6296 pf_set_protostate(*state, psrc, PFUDPS_SINGLE);
6297 if (dst->state == PFUDPS_SINGLE)
6298 pf_set_protostate(*state, pdst, PFUDPS_MULTIPLE);
6299
6300 /* update expire time */
6301 (*state)->expire = pf_get_uptime();
6302 if (src->state == PFUDPS_MULTIPLE && dst->state == PFUDPS_MULTIPLE)
6303 (*state)->timeout = PFTM_UDP_MULTIPLE;
6304 else
6305 (*state)->timeout = PFTM_UDP_SINGLE;
6306
6307 /* translate source/destination address, if necessary */
6308 if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) {
6309 struct pf_state_key *nk = (*state)->key[pd->didx];
6310
6311 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af) ||
6312 nk->port[pd->sidx] != uh->uh_sport)
6313 pf_change_ap(pd->m, pd->src, &uh->uh_sport, pd->ip_sum,
6314 &uh->uh_sum, &nk->addr[pd->sidx],
6315 nk->port[pd->sidx], 1, pd->af);
6316
6317 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af) ||
6318 nk->port[pd->didx] != uh->uh_dport)
6319 pf_change_ap(pd->m, pd->dst, &uh->uh_dport, pd->ip_sum,
6320 &uh->uh_sum, &nk->addr[pd->didx],
6321 nk->port[pd->didx], 1, pd->af);
6322 m_copyback(pd->m, pd->off, sizeof(*uh), (caddr_t)uh);
6323 }
6324
6325 return (PF_PASS);
6326 }
6327
6328 static int
pf_test_state_sctp(struct pf_kstate ** state,struct pf_pdesc * pd,u_short * reason)6329 pf_test_state_sctp(struct pf_kstate **state, struct pf_pdesc *pd,
6330 u_short *reason)
6331 {
6332 struct pf_state_key_cmp key;
6333 struct pf_state_peer *src, *dst;
6334 struct sctphdr *sh = &pd->hdr.sctp;
6335 u_int8_t psrc; //, pdst;
6336
6337 bzero(&key, sizeof(key));
6338 key.af = pd->af;
6339 key.proto = IPPROTO_SCTP;
6340 if (pd->dir == PF_IN) { /* wire side, straight */
6341 PF_ACPY(&key.addr[0], pd->src, key.af);
6342 PF_ACPY(&key.addr[1], pd->dst, key.af);
6343 key.port[0] = sh->src_port;
6344 key.port[1] = sh->dest_port;
6345 } else { /* stack side, reverse */
6346 PF_ACPY(&key.addr[1], pd->src, key.af);
6347 PF_ACPY(&key.addr[0], pd->dst, key.af);
6348 key.port[1] = sh->src_port;
6349 key.port[0] = sh->dest_port;
6350 }
6351
6352 STATE_LOOKUP(&key, *state, pd);
6353
6354 if (pd->dir == (*state)->direction) {
6355 src = &(*state)->src;
6356 dst = &(*state)->dst;
6357 psrc = PF_PEER_SRC;
6358 } else {
6359 src = &(*state)->dst;
6360 dst = &(*state)->src;
6361 psrc = PF_PEER_DST;
6362 }
6363
6364 if ((src->state >= SCTP_SHUTDOWN_SENT || src->state == SCTP_CLOSED) &&
6365 (dst->state >= SCTP_SHUTDOWN_SENT || dst->state == SCTP_CLOSED) &&
6366 pd->sctp_flags & PFDESC_SCTP_INIT) {
6367 pf_set_protostate(*state, PF_PEER_BOTH, SCTP_CLOSED);
6368 pf_unlink_state(*state);
6369 *state = NULL;
6370 return (PF_DROP);
6371 }
6372
6373 /* Track state. */
6374 if (pd->sctp_flags & PFDESC_SCTP_INIT) {
6375 if (src->state < SCTP_COOKIE_WAIT) {
6376 pf_set_protostate(*state, psrc, SCTP_COOKIE_WAIT);
6377 (*state)->timeout = PFTM_SCTP_OPENING;
6378 }
6379 }
6380 if (pd->sctp_flags & PFDESC_SCTP_INIT_ACK) {
6381 MPASS(dst->scrub != NULL);
6382 if (dst->scrub->pfss_v_tag == 0)
6383 dst->scrub->pfss_v_tag = pd->sctp_initiate_tag;
6384 }
6385
6386 if (pd->sctp_flags & (PFDESC_SCTP_COOKIE | PFDESC_SCTP_HEARTBEAT_ACK)) {
6387 if (src->state < SCTP_ESTABLISHED) {
6388 pf_set_protostate(*state, psrc, SCTP_ESTABLISHED);
6389 (*state)->timeout = PFTM_SCTP_ESTABLISHED;
6390 }
6391 }
6392 if (pd->sctp_flags & (PFDESC_SCTP_SHUTDOWN | PFDESC_SCTP_ABORT |
6393 PFDESC_SCTP_SHUTDOWN_COMPLETE)) {
6394 if (src->state < SCTP_SHUTDOWN_PENDING) {
6395 pf_set_protostate(*state, psrc, SCTP_SHUTDOWN_PENDING);
6396 (*state)->timeout = PFTM_SCTP_CLOSING;
6397 }
6398 }
6399 if (pd->sctp_flags & (PFDESC_SCTP_SHUTDOWN_COMPLETE)) {
6400 pf_set_protostate(*state, psrc, SCTP_CLOSED);
6401 (*state)->timeout = PFTM_SCTP_CLOSED;
6402 }
6403
6404 if (src->scrub != NULL) {
6405 if (src->scrub->pfss_v_tag == 0) {
6406 src->scrub->pfss_v_tag = pd->hdr.sctp.v_tag;
6407 } else if (src->scrub->pfss_v_tag != pd->hdr.sctp.v_tag)
6408 return (PF_DROP);
6409 }
6410
6411 (*state)->expire = pf_get_uptime();
6412
6413 /* translate source/destination address, if necessary */
6414 if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) {
6415 uint16_t checksum = 0;
6416 struct pf_state_key *nk = (*state)->key[pd->didx];
6417
6418 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af) ||
6419 nk->port[pd->sidx] != pd->hdr.sctp.src_port) {
6420 pf_change_ap(pd->m, pd->src, &pd->hdr.sctp.src_port,
6421 pd->ip_sum, &checksum, &nk->addr[pd->sidx],
6422 nk->port[pd->sidx], 1, pd->af);
6423 }
6424
6425 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af) ||
6426 nk->port[pd->didx] != pd->hdr.sctp.dest_port) {
6427 pf_change_ap(pd->m, pd->dst, &pd->hdr.sctp.dest_port,
6428 pd->ip_sum, &checksum, &nk->addr[pd->didx],
6429 nk->port[pd->didx], 1, pd->af);
6430 }
6431 }
6432
6433 return (PF_PASS);
6434 }
6435
6436 static void
pf_sctp_multihome_detach_addr(const struct pf_kstate * s)6437 pf_sctp_multihome_detach_addr(const struct pf_kstate *s)
6438 {
6439 struct pf_sctp_endpoint key;
6440 struct pf_sctp_endpoint *ep;
6441 struct pf_state_key *sks = s->key[PF_SK_STACK];
6442 struct pf_sctp_source *i, *tmp;
6443
6444 if (sks == NULL || sks->proto != IPPROTO_SCTP || s->dst.scrub == NULL)
6445 return;
6446
6447 PF_SCTP_ENDPOINTS_LOCK();
6448
6449 key.v_tag = s->dst.scrub->pfss_v_tag;
6450 ep = RB_FIND(pf_sctp_endpoints, &V_pf_sctp_endpoints, &key);
6451 if (ep != NULL) {
6452 TAILQ_FOREACH_SAFE(i, &ep->sources, entry, tmp) {
6453 if (pf_addr_cmp(&i->addr,
6454 &s->key[PF_SK_WIRE]->addr[s->direction == PF_OUT],
6455 s->key[PF_SK_WIRE]->af) == 0) {
6456 SDT_PROBE3(pf, sctp, multihome, remove,
6457 key.v_tag, s, i);
6458 TAILQ_REMOVE(&ep->sources, i, entry);
6459 free(i, M_PFTEMP);
6460 break;
6461 }
6462 }
6463
6464 if (TAILQ_EMPTY(&ep->sources)) {
6465 RB_REMOVE(pf_sctp_endpoints, &V_pf_sctp_endpoints, ep);
6466 free(ep, M_PFTEMP);
6467 }
6468 }
6469
6470 /* Other direction. */
6471 key.v_tag = s->src.scrub->pfss_v_tag;
6472 ep = RB_FIND(pf_sctp_endpoints, &V_pf_sctp_endpoints, &key);
6473 if (ep != NULL) {
6474 TAILQ_FOREACH_SAFE(i, &ep->sources, entry, tmp) {
6475 if (pf_addr_cmp(&i->addr,
6476 &s->key[PF_SK_WIRE]->addr[s->direction == PF_IN],
6477 s->key[PF_SK_WIRE]->af) == 0) {
6478 SDT_PROBE3(pf, sctp, multihome, remove,
6479 key.v_tag, s, i);
6480 TAILQ_REMOVE(&ep->sources, i, entry);
6481 free(i, M_PFTEMP);
6482 break;
6483 }
6484 }
6485
6486 if (TAILQ_EMPTY(&ep->sources)) {
6487 RB_REMOVE(pf_sctp_endpoints, &V_pf_sctp_endpoints, ep);
6488 free(ep, M_PFTEMP);
6489 }
6490 }
6491
6492 PF_SCTP_ENDPOINTS_UNLOCK();
6493 }
6494
6495 static void
pf_sctp_multihome_add_addr(struct pf_pdesc * pd,struct pf_addr * a,uint32_t v_tag)6496 pf_sctp_multihome_add_addr(struct pf_pdesc *pd, struct pf_addr *a, uint32_t v_tag)
6497 {
6498 struct pf_sctp_endpoint key = {
6499 .v_tag = v_tag,
6500 };
6501 struct pf_sctp_source *i;
6502 struct pf_sctp_endpoint *ep;
6503
6504 PF_SCTP_ENDPOINTS_LOCK();
6505
6506 ep = RB_FIND(pf_sctp_endpoints, &V_pf_sctp_endpoints, &key);
6507 if (ep == NULL) {
6508 ep = malloc(sizeof(struct pf_sctp_endpoint),
6509 M_PFTEMP, M_NOWAIT);
6510 if (ep == NULL) {
6511 PF_SCTP_ENDPOINTS_UNLOCK();
6512 return;
6513 }
6514
6515 ep->v_tag = v_tag;
6516 TAILQ_INIT(&ep->sources);
6517 RB_INSERT(pf_sctp_endpoints, &V_pf_sctp_endpoints, ep);
6518 }
6519
6520 /* Avoid inserting duplicates. */
6521 TAILQ_FOREACH(i, &ep->sources, entry) {
6522 if (pf_addr_cmp(&i->addr, a, pd->af) == 0) {
6523 PF_SCTP_ENDPOINTS_UNLOCK();
6524 return;
6525 }
6526 }
6527
6528 i = malloc(sizeof(*i), M_PFTEMP, M_NOWAIT);
6529 if (i == NULL) {
6530 PF_SCTP_ENDPOINTS_UNLOCK();
6531 return;
6532 }
6533
6534 i->af = pd->af;
6535 memcpy(&i->addr, a, sizeof(*a));
6536 TAILQ_INSERT_TAIL(&ep->sources, i, entry);
6537 SDT_PROBE2(pf, sctp, multihome, add, v_tag, i);
6538
6539 PF_SCTP_ENDPOINTS_UNLOCK();
6540 }
6541
6542 static void
pf_sctp_multihome_delayed(struct pf_pdesc * pd,struct pfi_kkif * kif,struct pf_kstate * s,int action)6543 pf_sctp_multihome_delayed(struct pf_pdesc *pd, struct pfi_kkif *kif,
6544 struct pf_kstate *s, int action)
6545 {
6546 struct pf_sctp_multihome_job *j, *tmp;
6547 struct pf_sctp_source *i;
6548 int ret __unused;
6549 struct pf_kstate *sm = NULL;
6550 struct pf_krule *ra = NULL;
6551 struct pf_krule *r = &V_pf_default_rule;
6552 struct pf_kruleset *rs = NULL;
6553 bool do_extra = true;
6554
6555 PF_RULES_RLOCK_TRACKER;
6556
6557 again:
6558 TAILQ_FOREACH_SAFE(j, &pd->sctp_multihome_jobs, next, tmp) {
6559 if (s == NULL || action != PF_PASS)
6560 goto free;
6561
6562 /* Confirm we don't recurse here. */
6563 MPASS(! (pd->sctp_flags & PFDESC_SCTP_ADD_IP));
6564
6565 switch (j->op) {
6566 case SCTP_ADD_IP_ADDRESS: {
6567 uint32_t v_tag = pd->sctp_initiate_tag;
6568
6569 if (v_tag == 0) {
6570 if (s->direction == pd->dir)
6571 v_tag = s->src.scrub->pfss_v_tag;
6572 else
6573 v_tag = s->dst.scrub->pfss_v_tag;
6574 }
6575
6576 /*
6577 * Avoid duplicating states. We'll already have
6578 * created a state based on the source address of
6579 * the packet, but SCTP endpoints may also list this
6580 * address again in the INIT(_ACK) parameters.
6581 */
6582 if (pf_addr_cmp(&j->src, pd->src, pd->af) == 0) {
6583 break;
6584 }
6585
6586 j->pd.sctp_flags |= PFDESC_SCTP_ADD_IP;
6587 PF_RULES_RLOCK();
6588 sm = NULL;
6589 ret = pf_test_rule(&r, &sm,
6590 &j->pd, &ra, &rs, NULL);
6591 PF_RULES_RUNLOCK();
6592 SDT_PROBE4(pf, sctp, multihome, test, kif, r, j->pd.m, ret);
6593 if (ret != PF_DROP && sm != NULL) {
6594 /* Inherit v_tag values. */
6595 if (sm->direction == s->direction) {
6596 sm->src.scrub->pfss_v_tag = s->src.scrub->pfss_v_tag;
6597 sm->dst.scrub->pfss_v_tag = s->dst.scrub->pfss_v_tag;
6598 } else {
6599 sm->src.scrub->pfss_v_tag = s->dst.scrub->pfss_v_tag;
6600 sm->dst.scrub->pfss_v_tag = s->src.scrub->pfss_v_tag;
6601 }
6602 PF_STATE_UNLOCK(sm);
6603 } else {
6604 /* If we try duplicate inserts? */
6605 break;
6606 }
6607
6608 /* Only add the address if we've actually allowed the state. */
6609 pf_sctp_multihome_add_addr(pd, &j->src, v_tag);
6610
6611 if (! do_extra) {
6612 break;
6613 }
6614 /*
6615 * We need to do this for each of our source addresses.
6616 * Find those based on the verification tag.
6617 */
6618 struct pf_sctp_endpoint key = {
6619 .v_tag = pd->hdr.sctp.v_tag,
6620 };
6621 struct pf_sctp_endpoint *ep;
6622
6623 PF_SCTP_ENDPOINTS_LOCK();
6624 ep = RB_FIND(pf_sctp_endpoints, &V_pf_sctp_endpoints, &key);
6625 if (ep == NULL) {
6626 PF_SCTP_ENDPOINTS_UNLOCK();
6627 break;
6628 }
6629 MPASS(ep != NULL);
6630
6631 TAILQ_FOREACH(i, &ep->sources, entry) {
6632 struct pf_sctp_multihome_job *nj;
6633
6634 /* SCTP can intermingle IPv4 and IPv6. */
6635 if (i->af != pd->af)
6636 continue;
6637
6638 nj = malloc(sizeof(*nj), M_PFTEMP, M_NOWAIT | M_ZERO);
6639 if (! nj) {
6640 continue;
6641 }
6642 memcpy(&nj->pd, &j->pd, sizeof(j->pd));
6643 memcpy(&nj->src, &j->src, sizeof(nj->src));
6644 nj->pd.src = &nj->src;
6645 // New destination address!
6646 memcpy(&nj->dst, &i->addr, sizeof(nj->dst));
6647 nj->pd.dst = &nj->dst;
6648 nj->pd.m = j->pd.m;
6649 nj->op = j->op;
6650
6651 TAILQ_INSERT_TAIL(&pd->sctp_multihome_jobs, nj, next);
6652 }
6653 PF_SCTP_ENDPOINTS_UNLOCK();
6654
6655 break;
6656 }
6657 case SCTP_DEL_IP_ADDRESS: {
6658 struct pf_state_key_cmp key;
6659 uint8_t psrc;
6660
6661 bzero(&key, sizeof(key));
6662 key.af = j->pd.af;
6663 key.proto = IPPROTO_SCTP;
6664 if (j->pd.dir == PF_IN) { /* wire side, straight */
6665 PF_ACPY(&key.addr[0], j->pd.src, key.af);
6666 PF_ACPY(&key.addr[1], j->pd.dst, key.af);
6667 key.port[0] = j->pd.hdr.sctp.src_port;
6668 key.port[1] = j->pd.hdr.sctp.dest_port;
6669 } else { /* stack side, reverse */
6670 PF_ACPY(&key.addr[1], j->pd.src, key.af);
6671 PF_ACPY(&key.addr[0], j->pd.dst, key.af);
6672 key.port[1] = j->pd.hdr.sctp.src_port;
6673 key.port[0] = j->pd.hdr.sctp.dest_port;
6674 }
6675
6676 sm = pf_find_state(kif, &key, j->pd.dir);
6677 if (sm != NULL) {
6678 PF_STATE_LOCK_ASSERT(sm);
6679 if (j->pd.dir == sm->direction) {
6680 psrc = PF_PEER_SRC;
6681 } else {
6682 psrc = PF_PEER_DST;
6683 }
6684 pf_set_protostate(sm, psrc, SCTP_SHUTDOWN_PENDING);
6685 sm->timeout = PFTM_SCTP_CLOSING;
6686 PF_STATE_UNLOCK(sm);
6687 }
6688 break;
6689 default:
6690 panic("Unknown op %#x", j->op);
6691 }
6692 }
6693
6694 free:
6695 TAILQ_REMOVE(&pd->sctp_multihome_jobs, j, next);
6696 free(j, M_PFTEMP);
6697 }
6698
6699 /* We may have inserted extra work while processing the list. */
6700 if (! TAILQ_EMPTY(&pd->sctp_multihome_jobs)) {
6701 do_extra = false;
6702 goto again;
6703 }
6704 }
6705
6706 static int
pf_multihome_scan(int start,int len,struct pf_pdesc * pd,int op)6707 pf_multihome_scan(int start, int len, struct pf_pdesc *pd, int op)
6708 {
6709 int off = 0;
6710 struct pf_sctp_multihome_job *job;
6711
6712 while (off < len) {
6713 struct sctp_paramhdr h;
6714
6715 if (!pf_pull_hdr(pd->m, start + off, &h, sizeof(h), NULL, NULL,
6716 pd->af))
6717 return (PF_DROP);
6718
6719 /* Parameters are at least 4 bytes. */
6720 if (ntohs(h.param_length) < 4)
6721 return (PF_DROP);
6722
6723 switch (ntohs(h.param_type)) {
6724 case SCTP_IPV4_ADDRESS: {
6725 struct in_addr t;
6726
6727 if (ntohs(h.param_length) !=
6728 (sizeof(struct sctp_paramhdr) + sizeof(t)))
6729 return (PF_DROP);
6730
6731 if (!pf_pull_hdr(pd->m, start + off + sizeof(h), &t, sizeof(t),
6732 NULL, NULL, pd->af))
6733 return (PF_DROP);
6734
6735 if (in_nullhost(t))
6736 t.s_addr = pd->src->v4.s_addr;
6737
6738 /*
6739 * We hold the state lock (idhash) here, which means
6740 * that we can't acquire the keyhash, or we'll get a
6741 * LOR (and potentially double-lock things too). We also
6742 * can't release the state lock here, so instead we'll
6743 * enqueue this for async handling.
6744 * There's a relatively small race here, in that a
6745 * packet using the new addresses could arrive already,
6746 * but that's just though luck for it.
6747 */
6748 job = malloc(sizeof(*job), M_PFTEMP, M_NOWAIT | M_ZERO);
6749 if (! job)
6750 return (PF_DROP);
6751
6752 memcpy(&job->pd, pd, sizeof(*pd));
6753
6754 // New source address!
6755 memcpy(&job->src, &t, sizeof(t));
6756 job->pd.src = &job->src;
6757 memcpy(&job->dst, pd->dst, sizeof(job->dst));
6758 job->pd.dst = &job->dst;
6759 job->pd.m = pd->m;
6760 job->op = op;
6761
6762 TAILQ_INSERT_TAIL(&pd->sctp_multihome_jobs, job, next);
6763 break;
6764 }
6765 #ifdef INET6
6766 case SCTP_IPV6_ADDRESS: {
6767 struct in6_addr t;
6768
6769 if (ntohs(h.param_length) !=
6770 (sizeof(struct sctp_paramhdr) + sizeof(t)))
6771 return (PF_DROP);
6772
6773 if (!pf_pull_hdr(pd->m, start + off + sizeof(h), &t, sizeof(t),
6774 NULL, NULL, pd->af))
6775 return (PF_DROP);
6776 if (memcmp(&t, &pd->src->v6, sizeof(t)) == 0)
6777 break;
6778 if (memcmp(&t, &in6addr_any, sizeof(t)) == 0)
6779 memcpy(&t, &pd->src->v6, sizeof(t));
6780
6781 job = malloc(sizeof(*job), M_PFTEMP, M_NOWAIT | M_ZERO);
6782 if (! job)
6783 return (PF_DROP);
6784
6785 memcpy(&job->pd, pd, sizeof(*pd));
6786 memcpy(&job->src, &t, sizeof(t));
6787 job->pd.src = &job->src;
6788 memcpy(&job->dst, pd->dst, sizeof(job->dst));
6789 job->pd.dst = &job->dst;
6790 job->pd.m = pd->m;
6791 job->op = op;
6792
6793 TAILQ_INSERT_TAIL(&pd->sctp_multihome_jobs, job, next);
6794 break;
6795 }
6796 #endif
6797 case SCTP_ADD_IP_ADDRESS: {
6798 int ret;
6799 struct sctp_asconf_paramhdr ah;
6800
6801 if (!pf_pull_hdr(pd->m, start + off, &ah, sizeof(ah),
6802 NULL, NULL, pd->af))
6803 return (PF_DROP);
6804
6805 ret = pf_multihome_scan(start + off + sizeof(ah),
6806 ntohs(ah.ph.param_length) - sizeof(ah), pd,
6807 SCTP_ADD_IP_ADDRESS);
6808 if (ret != PF_PASS)
6809 return (ret);
6810 break;
6811 }
6812 case SCTP_DEL_IP_ADDRESS: {
6813 int ret;
6814 struct sctp_asconf_paramhdr ah;
6815
6816 if (!pf_pull_hdr(pd->m, start + off, &ah, sizeof(ah),
6817 NULL, NULL, pd->af))
6818 return (PF_DROP);
6819 ret = pf_multihome_scan(start + off + sizeof(ah),
6820 ntohs(ah.ph.param_length) - sizeof(ah), pd,
6821 SCTP_DEL_IP_ADDRESS);
6822 if (ret != PF_PASS)
6823 return (ret);
6824 break;
6825 }
6826 default:
6827 break;
6828 }
6829
6830 off += roundup(ntohs(h.param_length), 4);
6831 }
6832
6833 return (PF_PASS);
6834 }
6835 int
pf_multihome_scan_init(int start,int len,struct pf_pdesc * pd)6836 pf_multihome_scan_init(int start, int len, struct pf_pdesc *pd)
6837 {
6838 start += sizeof(struct sctp_init_chunk);
6839 len -= sizeof(struct sctp_init_chunk);
6840
6841 return (pf_multihome_scan(start, len, pd, SCTP_ADD_IP_ADDRESS));
6842 }
6843
6844 int
pf_multihome_scan_asconf(int start,int len,struct pf_pdesc * pd)6845 pf_multihome_scan_asconf(int start, int len, struct pf_pdesc *pd)
6846 {
6847 start += sizeof(struct sctp_asconf_chunk);
6848 len -= sizeof(struct sctp_asconf_chunk);
6849
6850 return (pf_multihome_scan(start, len, pd, SCTP_ADD_IP_ADDRESS));
6851 }
6852
6853 int
pf_icmp_state_lookup(struct pf_state_key_cmp * key,struct pf_pdesc * pd,struct pf_kstate ** state,int direction,u_int16_t icmpid,u_int16_t type,int icmp_dir,int * iidx,int multi,int inner)6854 pf_icmp_state_lookup(struct pf_state_key_cmp *key, struct pf_pdesc *pd,
6855 struct pf_kstate **state, int direction,
6856 u_int16_t icmpid, u_int16_t type, int icmp_dir,
6857 int *iidx, int multi, int inner)
6858 {
6859 key->af = pd->af;
6860 key->proto = pd->proto;
6861 if (icmp_dir == PF_IN) {
6862 *iidx = pd->sidx;
6863 key->port[pd->sidx] = icmpid;
6864 key->port[pd->didx] = type;
6865 } else {
6866 *iidx = pd->didx;
6867 key->port[pd->sidx] = type;
6868 key->port[pd->didx] = icmpid;
6869 }
6870 if (pf_state_key_addr_setup(pd, key, multi))
6871 return (PF_DROP);
6872
6873 STATE_LOOKUP(key, *state, pd);
6874
6875 if ((*state)->state_flags & PFSTATE_SLOPPY)
6876 return (-1);
6877
6878 /* Is this ICMP message flowing in right direction? */
6879 if ((*state)->rule->type &&
6880 (((!inner && (*state)->direction == direction) ||
6881 (inner && (*state)->direction != direction)) ?
6882 PF_IN : PF_OUT) != icmp_dir) {
6883 if (V_pf_status.debug >= PF_DEBUG_MISC) {
6884 printf("pf: icmp type %d in wrong direction (%d): ",
6885 ntohs(type), icmp_dir);
6886 pf_print_state(*state);
6887 printf("\n");
6888 }
6889 PF_STATE_UNLOCK(*state);
6890 *state = NULL;
6891 return (PF_DROP);
6892 }
6893 return (-1);
6894 }
6895
6896 static int
pf_test_state_icmp(struct pf_kstate ** state,struct pf_pdesc * pd,u_short * reason)6897 pf_test_state_icmp(struct pf_kstate **state, struct pf_pdesc *pd,
6898 u_short *reason)
6899 {
6900 struct pf_addr *saddr = pd->src, *daddr = pd->dst;
6901 u_int16_t *icmpsum, virtual_id, virtual_type;
6902 u_int8_t icmptype, icmpcode;
6903 int icmp_dir, iidx, ret, multi;
6904 struct pf_state_key_cmp key;
6905 #ifdef INET
6906 u_int16_t icmpid;
6907 #endif
6908
6909 MPASS(*state == NULL);
6910
6911 bzero(&key, sizeof(key));
6912 switch (pd->proto) {
6913 #ifdef INET
6914 case IPPROTO_ICMP:
6915 icmptype = pd->hdr.icmp.icmp_type;
6916 icmpcode = pd->hdr.icmp.icmp_code;
6917 icmpid = pd->hdr.icmp.icmp_id;
6918 icmpsum = &pd->hdr.icmp.icmp_cksum;
6919 break;
6920 #endif /* INET */
6921 #ifdef INET6
6922 case IPPROTO_ICMPV6:
6923 icmptype = pd->hdr.icmp6.icmp6_type;
6924 icmpcode = pd->hdr.icmp6.icmp6_code;
6925 #ifdef INET
6926 icmpid = pd->hdr.icmp6.icmp6_id;
6927 #endif
6928 icmpsum = &pd->hdr.icmp6.icmp6_cksum;
6929 break;
6930 #endif /* INET6 */
6931 }
6932
6933 if (pf_icmp_mapping(pd, icmptype, &icmp_dir, &multi,
6934 &virtual_id, &virtual_type) == 0) {
6935 /*
6936 * ICMP query/reply message not related to a TCP/UDP packet.
6937 * Search for an ICMP state.
6938 */
6939 ret = pf_icmp_state_lookup(&key, pd, state, pd->dir,
6940 virtual_id, virtual_type, icmp_dir, &iidx,
6941 PF_ICMP_MULTI_NONE, 0);
6942 if (ret >= 0) {
6943 MPASS(*state == NULL);
6944 if (ret == PF_DROP && pd->af == AF_INET6 &&
6945 icmp_dir == PF_OUT) {
6946 ret = pf_icmp_state_lookup(&key, pd, state,
6947 pd->dir, virtual_id, virtual_type,
6948 icmp_dir, &iidx, multi, 0);
6949 if (ret >= 0) {
6950 MPASS(*state == NULL);
6951 return (ret);
6952 }
6953 } else
6954 return (ret);
6955 }
6956
6957 (*state)->expire = pf_get_uptime();
6958 (*state)->timeout = PFTM_ICMP_ERROR_REPLY;
6959
6960 /* translate source/destination address, if necessary */
6961 if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) {
6962 struct pf_state_key *nk = (*state)->key[pd->didx];
6963
6964 switch (pd->af) {
6965 #ifdef INET
6966 case AF_INET:
6967 if (PF_ANEQ(pd->src,
6968 &nk->addr[pd->sidx], AF_INET))
6969 pf_change_a(&saddr->v4.s_addr,
6970 pd->ip_sum,
6971 nk->addr[pd->sidx].v4.s_addr, 0);
6972
6973 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx],
6974 AF_INET))
6975 pf_change_a(&daddr->v4.s_addr,
6976 pd->ip_sum,
6977 nk->addr[pd->didx].v4.s_addr, 0);
6978
6979 if (nk->port[iidx] !=
6980 pd->hdr.icmp.icmp_id) {
6981 pd->hdr.icmp.icmp_cksum =
6982 pf_cksum_fixup(
6983 pd->hdr.icmp.icmp_cksum, icmpid,
6984 nk->port[iidx], 0);
6985 pd->hdr.icmp.icmp_id =
6986 nk->port[iidx];
6987 }
6988
6989 m_copyback(pd->m, pd->off, ICMP_MINLEN,
6990 (caddr_t )&pd->hdr.icmp);
6991 break;
6992 #endif /* INET */
6993 #ifdef INET6
6994 case AF_INET6:
6995 if (PF_ANEQ(pd->src,
6996 &nk->addr[pd->sidx], AF_INET6))
6997 pf_change_a6(saddr,
6998 &pd->hdr.icmp6.icmp6_cksum,
6999 &nk->addr[pd->sidx], 0);
7000
7001 if (PF_ANEQ(pd->dst,
7002 &nk->addr[pd->didx], AF_INET6))
7003 pf_change_a6(daddr,
7004 &pd->hdr.icmp6.icmp6_cksum,
7005 &nk->addr[pd->didx], 0);
7006
7007 m_copyback(pd->m, pd->off, sizeof(struct icmp6_hdr),
7008 (caddr_t )&pd->hdr.icmp6);
7009 break;
7010 #endif /* INET6 */
7011 }
7012 }
7013 return (PF_PASS);
7014
7015 } else {
7016 /*
7017 * ICMP error message in response to a TCP/UDP packet.
7018 * Extract the inner TCP/UDP header and search for that state.
7019 */
7020
7021 struct pf_pdesc pd2;
7022 bzero(&pd2, sizeof pd2);
7023 #ifdef INET
7024 struct ip h2;
7025 #endif /* INET */
7026 #ifdef INET6
7027 struct ip6_hdr h2_6;
7028 int fragoff2, extoff2;
7029 u_int32_t jumbolen;
7030 #endif /* INET6 */
7031 int ipoff2 = 0;
7032
7033 pd2.af = pd->af;
7034 pd2.dir = pd->dir;
7035 /* Payload packet is from the opposite direction. */
7036 pd2.sidx = (pd->dir == PF_IN) ? 1 : 0;
7037 pd2.didx = (pd->dir == PF_IN) ? 0 : 1;
7038 pd2.m = pd->m;
7039 switch (pd->af) {
7040 #ifdef INET
7041 case AF_INET:
7042 /* offset of h2 in mbuf chain */
7043 ipoff2 = pd->off + ICMP_MINLEN;
7044
7045 if (!pf_pull_hdr(pd->m, ipoff2, &h2, sizeof(h2),
7046 NULL, reason, pd2.af)) {
7047 DPFPRINTF(PF_DEBUG_MISC,
7048 ("pf: ICMP error message too short "
7049 "(ip)\n"));
7050 return (PF_DROP);
7051 }
7052 /*
7053 * ICMP error messages don't refer to non-first
7054 * fragments
7055 */
7056 if (h2.ip_off & htons(IP_OFFMASK)) {
7057 REASON_SET(reason, PFRES_FRAG);
7058 return (PF_DROP);
7059 }
7060
7061 /* offset of protocol header that follows h2 */
7062 pd2.off = ipoff2 + (h2.ip_hl << 2);
7063
7064 pd2.proto = h2.ip_p;
7065 pd2.src = (struct pf_addr *)&h2.ip_src;
7066 pd2.dst = (struct pf_addr *)&h2.ip_dst;
7067 pd2.ip_sum = &h2.ip_sum;
7068 break;
7069 #endif /* INET */
7070 #ifdef INET6
7071 case AF_INET6:
7072 ipoff2 = pd->off + sizeof(struct icmp6_hdr);
7073
7074 if (!pf_pull_hdr(pd->m, ipoff2, &h2_6, sizeof(h2_6),
7075 NULL, reason, pd2.af)) {
7076 DPFPRINTF(PF_DEBUG_MISC,
7077 ("pf: ICMP error message too short "
7078 "(ip6)\n"));
7079 return (PF_DROP);
7080 }
7081 pd2.off = ipoff2;
7082 if (pf_walk_header6(pd->m, &h2_6, &pd2.off, &extoff2,
7083 &fragoff2, &pd2.proto, &jumbolen,
7084 reason) != PF_PASS)
7085 return (PF_DROP);
7086
7087 pd2.src = (struct pf_addr *)&h2_6.ip6_src;
7088 pd2.dst = (struct pf_addr *)&h2_6.ip6_dst;
7089 pd2.ip_sum = NULL;
7090 break;
7091 #endif /* INET6 */
7092 }
7093
7094 if (PF_ANEQ(pd->dst, pd2.src, pd->af)) {
7095 if (V_pf_status.debug >= PF_DEBUG_MISC) {
7096 printf("pf: BAD ICMP %d:%d outer dst: ",
7097 icmptype, icmpcode);
7098 pf_print_host(pd->src, 0, pd->af);
7099 printf(" -> ");
7100 pf_print_host(pd->dst, 0, pd->af);
7101 printf(" inner src: ");
7102 pf_print_host(pd2.src, 0, pd2.af);
7103 printf(" -> ");
7104 pf_print_host(pd2.dst, 0, pd2.af);
7105 printf("\n");
7106 }
7107 REASON_SET(reason, PFRES_BADSTATE);
7108 return (PF_DROP);
7109 }
7110
7111 switch (pd2.proto) {
7112 case IPPROTO_TCP: {
7113 struct tcphdr th;
7114 u_int32_t seq;
7115 struct pf_state_peer *src, *dst;
7116 u_int8_t dws;
7117 int copyback = 0;
7118
7119 /*
7120 * Only the first 8 bytes of the TCP header can be
7121 * expected. Don't access any TCP header fields after
7122 * th_seq, an ackskew test is not possible.
7123 */
7124 if (!pf_pull_hdr(pd->m, pd2.off, &th, 8, NULL, reason,
7125 pd2.af)) {
7126 DPFPRINTF(PF_DEBUG_MISC,
7127 ("pf: ICMP error message too short "
7128 "(tcp)\n"));
7129 return (PF_DROP);
7130 }
7131
7132 key.af = pd2.af;
7133 key.proto = IPPROTO_TCP;
7134 PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af);
7135 PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af);
7136 key.port[pd2.sidx] = th.th_sport;
7137 key.port[pd2.didx] = th.th_dport;
7138
7139 STATE_LOOKUP(&key, *state, pd);
7140
7141 if (pd->dir == (*state)->direction) {
7142 src = &(*state)->dst;
7143 dst = &(*state)->src;
7144 } else {
7145 src = &(*state)->src;
7146 dst = &(*state)->dst;
7147 }
7148
7149 if (src->wscale && dst->wscale)
7150 dws = dst->wscale & PF_WSCALE_MASK;
7151 else
7152 dws = 0;
7153
7154 /* Demodulate sequence number */
7155 seq = ntohl(th.th_seq) - src->seqdiff;
7156 if (src->seqdiff) {
7157 pf_change_a(&th.th_seq, icmpsum,
7158 htonl(seq), 0);
7159 copyback = 1;
7160 }
7161
7162 if (!((*state)->state_flags & PFSTATE_SLOPPY) &&
7163 (!SEQ_GEQ(src->seqhi, seq) ||
7164 !SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)))) {
7165 if (V_pf_status.debug >= PF_DEBUG_MISC) {
7166 printf("pf: BAD ICMP %d:%d ",
7167 icmptype, icmpcode);
7168 pf_print_host(pd->src, 0, pd->af);
7169 printf(" -> ");
7170 pf_print_host(pd->dst, 0, pd->af);
7171 printf(" state: ");
7172 pf_print_state(*state);
7173 printf(" seq=%u\n", seq);
7174 }
7175 REASON_SET(reason, PFRES_BADSTATE);
7176 return (PF_DROP);
7177 } else {
7178 if (V_pf_status.debug >= PF_DEBUG_MISC) {
7179 printf("pf: OK ICMP %d:%d ",
7180 icmptype, icmpcode);
7181 pf_print_host(pd->src, 0, pd->af);
7182 printf(" -> ");
7183 pf_print_host(pd->dst, 0, pd->af);
7184 printf(" state: ");
7185 pf_print_state(*state);
7186 printf(" seq=%u\n", seq);
7187 }
7188 }
7189
7190 /* translate source/destination address, if necessary */
7191 if ((*state)->key[PF_SK_WIRE] !=
7192 (*state)->key[PF_SK_STACK]) {
7193 struct pf_state_key *nk =
7194 (*state)->key[pd->didx];
7195
7196 if (PF_ANEQ(pd2.src,
7197 &nk->addr[pd2.sidx], pd2.af) ||
7198 nk->port[pd2.sidx] != th.th_sport)
7199 pf_change_icmp(pd2.src, &th.th_sport,
7200 daddr, &nk->addr[pd2.sidx],
7201 nk->port[pd2.sidx], NULL,
7202 pd2.ip_sum, icmpsum,
7203 pd->ip_sum, 0, pd2.af);
7204
7205 if (PF_ANEQ(pd2.dst,
7206 &nk->addr[pd2.didx], pd2.af) ||
7207 nk->port[pd2.didx] != th.th_dport)
7208 pf_change_icmp(pd2.dst, &th.th_dport,
7209 saddr, &nk->addr[pd2.didx],
7210 nk->port[pd2.didx], NULL,
7211 pd2.ip_sum, icmpsum,
7212 pd->ip_sum, 0, pd2.af);
7213 copyback = 1;
7214 }
7215
7216 if (copyback) {
7217 switch (pd2.af) {
7218 #ifdef INET
7219 case AF_INET:
7220 m_copyback(pd->m, pd->off, ICMP_MINLEN,
7221 (caddr_t )&pd->hdr.icmp);
7222 m_copyback(pd->m, ipoff2, sizeof(h2),
7223 (caddr_t )&h2);
7224 break;
7225 #endif /* INET */
7226 #ifdef INET6
7227 case AF_INET6:
7228 m_copyback(pd->m, pd->off,
7229 sizeof(struct icmp6_hdr),
7230 (caddr_t )&pd->hdr.icmp6);
7231 m_copyback(pd->m, ipoff2, sizeof(h2_6),
7232 (caddr_t )&h2_6);
7233 break;
7234 #endif /* INET6 */
7235 }
7236 m_copyback(pd->m, pd2.off, 8, (caddr_t)&th);
7237 }
7238
7239 return (PF_PASS);
7240 break;
7241 }
7242 case IPPROTO_UDP: {
7243 struct udphdr uh;
7244
7245 if (!pf_pull_hdr(pd->m, pd2.off, &uh, sizeof(uh),
7246 NULL, reason, pd2.af)) {
7247 DPFPRINTF(PF_DEBUG_MISC,
7248 ("pf: ICMP error message too short "
7249 "(udp)\n"));
7250 return (PF_DROP);
7251 }
7252
7253 key.af = pd2.af;
7254 key.proto = IPPROTO_UDP;
7255 PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af);
7256 PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af);
7257 key.port[pd2.sidx] = uh.uh_sport;
7258 key.port[pd2.didx] = uh.uh_dport;
7259
7260 STATE_LOOKUP(&key, *state, pd);
7261
7262 /* translate source/destination address, if necessary */
7263 if ((*state)->key[PF_SK_WIRE] !=
7264 (*state)->key[PF_SK_STACK]) {
7265 struct pf_state_key *nk =
7266 (*state)->key[pd->didx];
7267
7268 if (PF_ANEQ(pd2.src,
7269 &nk->addr[pd2.sidx], pd2.af) ||
7270 nk->port[pd2.sidx] != uh.uh_sport)
7271 pf_change_icmp(pd2.src, &uh.uh_sport,
7272 daddr, &nk->addr[pd2.sidx],
7273 nk->port[pd2.sidx], &uh.uh_sum,
7274 pd2.ip_sum, icmpsum,
7275 pd->ip_sum, 1, pd2.af);
7276
7277 if (PF_ANEQ(pd2.dst,
7278 &nk->addr[pd2.didx], pd2.af) ||
7279 nk->port[pd2.didx] != uh.uh_dport)
7280 pf_change_icmp(pd2.dst, &uh.uh_dport,
7281 saddr, &nk->addr[pd2.didx],
7282 nk->port[pd2.didx], &uh.uh_sum,
7283 pd2.ip_sum, icmpsum,
7284 pd->ip_sum, 1, pd2.af);
7285
7286 switch (pd2.af) {
7287 #ifdef INET
7288 case AF_INET:
7289 m_copyback(pd->m, pd->off, ICMP_MINLEN,
7290 (caddr_t )&pd->hdr.icmp);
7291 m_copyback(pd->m, ipoff2, sizeof(h2), (caddr_t)&h2);
7292 break;
7293 #endif /* INET */
7294 #ifdef INET6
7295 case AF_INET6:
7296 m_copyback(pd->m, pd->off,
7297 sizeof(struct icmp6_hdr),
7298 (caddr_t )&pd->hdr.icmp6);
7299 m_copyback(pd->m, ipoff2, sizeof(h2_6),
7300 (caddr_t )&h2_6);
7301 break;
7302 #endif /* INET6 */
7303 }
7304 m_copyback(pd->m, pd2.off, sizeof(uh), (caddr_t)&uh);
7305 }
7306 return (PF_PASS);
7307 break;
7308 }
7309 #ifdef INET
7310 case IPPROTO_ICMP: {
7311 struct icmp *iih = &pd2.hdr.icmp;
7312
7313 if (pd2.af != AF_INET) {
7314 REASON_SET(reason, PFRES_NORM);
7315 return (PF_DROP);
7316 }
7317
7318 if (!pf_pull_hdr(pd->m, pd2.off, iih, ICMP_MINLEN,
7319 NULL, reason, pd2.af)) {
7320 DPFPRINTF(PF_DEBUG_MISC,
7321 ("pf: ICMP error message too short i"
7322 "(icmp)\n"));
7323 return (PF_DROP);
7324 }
7325
7326 icmpid = iih->icmp_id;
7327 pf_icmp_mapping(&pd2, iih->icmp_type,
7328 &icmp_dir, &multi, &virtual_id, &virtual_type);
7329
7330 ret = pf_icmp_state_lookup(&key, &pd2, state,
7331 pd2.dir, virtual_id, virtual_type,
7332 icmp_dir, &iidx, PF_ICMP_MULTI_NONE, 1);
7333 if (ret >= 0) {
7334 MPASS(*state == NULL);
7335 return (ret);
7336 }
7337
7338 /* translate source/destination address, if necessary */
7339 if ((*state)->key[PF_SK_WIRE] !=
7340 (*state)->key[PF_SK_STACK]) {
7341 struct pf_state_key *nk =
7342 (*state)->key[pd->didx];
7343
7344 if (PF_ANEQ(pd2.src,
7345 &nk->addr[pd2.sidx], pd2.af) ||
7346 (virtual_type == htons(ICMP_ECHO) &&
7347 nk->port[iidx] != iih->icmp_id))
7348 pf_change_icmp(pd2.src,
7349 (virtual_type == htons(ICMP_ECHO)) ?
7350 &iih->icmp_id : NULL,
7351 daddr, &nk->addr[pd2.sidx],
7352 (virtual_type == htons(ICMP_ECHO)) ?
7353 nk->port[iidx] : 0, NULL,
7354 pd2.ip_sum, icmpsum,
7355 pd->ip_sum, 0, AF_INET);
7356
7357 if (PF_ANEQ(pd2.dst,
7358 &nk->addr[pd2.didx], pd2.af))
7359 pf_change_icmp(pd2.dst, NULL, NULL,
7360 &nk->addr[pd2.didx], 0, NULL,
7361 pd2.ip_sum, icmpsum, pd->ip_sum, 0,
7362 AF_INET);
7363
7364 m_copyback(pd->m, pd->off, ICMP_MINLEN, (caddr_t)&pd->hdr.icmp);
7365 m_copyback(pd->m, ipoff2, sizeof(h2), (caddr_t)&h2);
7366 m_copyback(pd->m, pd2.off, ICMP_MINLEN, (caddr_t)iih);
7367 }
7368 return (PF_PASS);
7369 break;
7370 }
7371 #endif /* INET */
7372 #ifdef INET6
7373 case IPPROTO_ICMPV6: {
7374 struct icmp6_hdr *iih = &pd2.hdr.icmp6;
7375
7376 if (pd2.af != AF_INET6) {
7377 REASON_SET(reason, PFRES_NORM);
7378 return (PF_DROP);
7379 }
7380
7381 if (!pf_pull_hdr(pd->m, pd2.off, iih,
7382 sizeof(struct icmp6_hdr), NULL, reason, pd2.af)) {
7383 DPFPRINTF(PF_DEBUG_MISC,
7384 ("pf: ICMP error message too short "
7385 "(icmp6)\n"));
7386 return (PF_DROP);
7387 }
7388
7389 pf_icmp_mapping(&pd2, iih->icmp6_type,
7390 &icmp_dir, &multi, &virtual_id, &virtual_type);
7391
7392 ret = pf_icmp_state_lookup(&key, &pd2, state,
7393 pd->dir, virtual_id, virtual_type,
7394 icmp_dir, &iidx, PF_ICMP_MULTI_NONE, 1);
7395 if (ret >= 0) {
7396 MPASS(*state == NULL);
7397 if (ret == PF_DROP && pd2.af == AF_INET6 &&
7398 icmp_dir == PF_OUT) {
7399 ret = pf_icmp_state_lookup(&key, &pd2,
7400 state, pd->dir,
7401 virtual_id, virtual_type,
7402 icmp_dir, &iidx, multi, 1);
7403 if (ret >= 0) {
7404 MPASS(*state == NULL);
7405 return (ret);
7406 }
7407 } else
7408 return (ret);
7409 }
7410
7411 /* translate source/destination address, if necessary */
7412 if ((*state)->key[PF_SK_WIRE] !=
7413 (*state)->key[PF_SK_STACK]) {
7414 struct pf_state_key *nk =
7415 (*state)->key[pd->didx];
7416
7417 if (PF_ANEQ(pd2.src,
7418 &nk->addr[pd2.sidx], pd2.af) ||
7419 ((virtual_type == htons(ICMP6_ECHO_REQUEST)) &&
7420 nk->port[pd2.sidx] != iih->icmp6_id))
7421 pf_change_icmp(pd2.src,
7422 (virtual_type == htons(ICMP6_ECHO_REQUEST))
7423 ? &iih->icmp6_id : NULL,
7424 daddr, &nk->addr[pd2.sidx],
7425 (virtual_type == htons(ICMP6_ECHO_REQUEST))
7426 ? nk->port[iidx] : 0, NULL,
7427 pd2.ip_sum, icmpsum,
7428 pd->ip_sum, 0, AF_INET6);
7429
7430 if (PF_ANEQ(pd2.dst,
7431 &nk->addr[pd2.didx], pd2.af))
7432 pf_change_icmp(pd2.dst, NULL, NULL,
7433 &nk->addr[pd2.didx], 0, NULL,
7434 pd2.ip_sum, icmpsum,
7435 pd->ip_sum, 0, AF_INET6);
7436
7437 m_copyback(pd->m, pd->off, sizeof(struct icmp6_hdr),
7438 (caddr_t)&pd->hdr.icmp6);
7439 m_copyback(pd->m, ipoff2, sizeof(h2_6), (caddr_t)&h2_6);
7440 m_copyback(pd->m, pd2.off, sizeof(struct icmp6_hdr),
7441 (caddr_t)iih);
7442 }
7443 return (PF_PASS);
7444 break;
7445 }
7446 #endif /* INET6 */
7447 default: {
7448 key.af = pd2.af;
7449 key.proto = pd2.proto;
7450 PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af);
7451 PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af);
7452 key.port[0] = key.port[1] = 0;
7453
7454 STATE_LOOKUP(&key, *state, pd);
7455
7456 /* translate source/destination address, if necessary */
7457 if ((*state)->key[PF_SK_WIRE] !=
7458 (*state)->key[PF_SK_STACK]) {
7459 struct pf_state_key *nk =
7460 (*state)->key[pd->didx];
7461
7462 if (PF_ANEQ(pd2.src,
7463 &nk->addr[pd2.sidx], pd2.af))
7464 pf_change_icmp(pd2.src, NULL, daddr,
7465 &nk->addr[pd2.sidx], 0, NULL,
7466 pd2.ip_sum, icmpsum,
7467 pd->ip_sum, 0, pd2.af);
7468
7469 if (PF_ANEQ(pd2.dst,
7470 &nk->addr[pd2.didx], pd2.af))
7471 pf_change_icmp(pd2.dst, NULL, saddr,
7472 &nk->addr[pd2.didx], 0, NULL,
7473 pd2.ip_sum, icmpsum,
7474 pd->ip_sum, 0, pd2.af);
7475
7476 switch (pd2.af) {
7477 #ifdef INET
7478 case AF_INET:
7479 m_copyback(pd->m, pd->off, ICMP_MINLEN,
7480 (caddr_t)&pd->hdr.icmp);
7481 m_copyback(pd->m, ipoff2, sizeof(h2), (caddr_t)&h2);
7482 break;
7483 #endif /* INET */
7484 #ifdef INET6
7485 case AF_INET6:
7486 m_copyback(pd->m, pd->off,
7487 sizeof(struct icmp6_hdr),
7488 (caddr_t )&pd->hdr.icmp6);
7489 m_copyback(pd->m, ipoff2, sizeof(h2_6),
7490 (caddr_t )&h2_6);
7491 break;
7492 #endif /* INET6 */
7493 }
7494 }
7495 return (PF_PASS);
7496 break;
7497 }
7498 }
7499 }
7500 }
7501
7502 static int
pf_test_state_other(struct pf_kstate ** state,struct pf_pdesc * pd)7503 pf_test_state_other(struct pf_kstate **state, struct pf_pdesc *pd)
7504 {
7505 struct pf_state_peer *src, *dst;
7506 struct pf_state_key_cmp key;
7507 uint8_t psrc, pdst;
7508
7509 bzero(&key, sizeof(key));
7510 key.af = pd->af;
7511 key.proto = pd->proto;
7512 if (pd->dir == PF_IN) {
7513 PF_ACPY(&key.addr[0], pd->src, key.af);
7514 PF_ACPY(&key.addr[1], pd->dst, key.af);
7515 key.port[0] = key.port[1] = 0;
7516 } else {
7517 PF_ACPY(&key.addr[1], pd->src, key.af);
7518 PF_ACPY(&key.addr[0], pd->dst, key.af);
7519 key.port[1] = key.port[0] = 0;
7520 }
7521
7522 STATE_LOOKUP(&key, *state, pd);
7523
7524 if (pd->dir == (*state)->direction) {
7525 src = &(*state)->src;
7526 dst = &(*state)->dst;
7527 psrc = PF_PEER_SRC;
7528 pdst = PF_PEER_DST;
7529 } else {
7530 src = &(*state)->dst;
7531 dst = &(*state)->src;
7532 psrc = PF_PEER_DST;
7533 pdst = PF_PEER_SRC;
7534 }
7535
7536 /* update states */
7537 if (src->state < PFOTHERS_SINGLE)
7538 pf_set_protostate(*state, psrc, PFOTHERS_SINGLE);
7539 if (dst->state == PFOTHERS_SINGLE)
7540 pf_set_protostate(*state, pdst, PFOTHERS_MULTIPLE);
7541
7542 /* update expire time */
7543 (*state)->expire = pf_get_uptime();
7544 if (src->state == PFOTHERS_MULTIPLE && dst->state == PFOTHERS_MULTIPLE)
7545 (*state)->timeout = PFTM_OTHER_MULTIPLE;
7546 else
7547 (*state)->timeout = PFTM_OTHER_SINGLE;
7548
7549 /* translate source/destination address, if necessary */
7550 if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) {
7551 struct pf_state_key *nk = (*state)->key[pd->didx];
7552
7553 KASSERT(nk, ("%s: nk is null", __func__));
7554 KASSERT(pd, ("%s: pd is null", __func__));
7555 KASSERT(pd->src, ("%s: pd->src is null", __func__));
7556 KASSERT(pd->dst, ("%s: pd->dst is null", __func__));
7557 switch (pd->af) {
7558 #ifdef INET
7559 case AF_INET:
7560 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], AF_INET))
7561 pf_change_a(&pd->src->v4.s_addr,
7562 pd->ip_sum,
7563 nk->addr[pd->sidx].v4.s_addr,
7564 0);
7565
7566 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], AF_INET))
7567 pf_change_a(&pd->dst->v4.s_addr,
7568 pd->ip_sum,
7569 nk->addr[pd->didx].v4.s_addr,
7570 0);
7571
7572 break;
7573 #endif /* INET */
7574 #ifdef INET6
7575 case AF_INET6:
7576 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], AF_INET6))
7577 PF_ACPY(pd->src, &nk->addr[pd->sidx], pd->af);
7578
7579 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], AF_INET6))
7580 PF_ACPY(pd->dst, &nk->addr[pd->didx], pd->af);
7581 #endif /* INET6 */
7582 }
7583 }
7584 return (PF_PASS);
7585 }
7586
7587 /*
7588 * ipoff and off are measured from the start of the mbuf chain.
7589 * h must be at "ipoff" on the mbuf chain.
7590 */
7591 void *
pf_pull_hdr(const struct mbuf * m,int off,void * p,int len,u_short * actionp,u_short * reasonp,sa_family_t af)7592 pf_pull_hdr(const struct mbuf *m, int off, void *p, int len,
7593 u_short *actionp, u_short *reasonp, sa_family_t af)
7594 {
7595 switch (af) {
7596 #ifdef INET
7597 case AF_INET: {
7598 const struct ip *h = mtod(m, struct ip *);
7599 u_int16_t fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3;
7600
7601 if (fragoff) {
7602 if (fragoff >= len)
7603 ACTION_SET(actionp, PF_PASS);
7604 else {
7605 ACTION_SET(actionp, PF_DROP);
7606 REASON_SET(reasonp, PFRES_FRAG);
7607 }
7608 return (NULL);
7609 }
7610 if (m->m_pkthdr.len < off + len ||
7611 ntohs(h->ip_len) < off + len) {
7612 ACTION_SET(actionp, PF_DROP);
7613 REASON_SET(reasonp, PFRES_SHORT);
7614 return (NULL);
7615 }
7616 break;
7617 }
7618 #endif /* INET */
7619 #ifdef INET6
7620 case AF_INET6: {
7621 const struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
7622
7623 if (m->m_pkthdr.len < off + len ||
7624 (ntohs(h->ip6_plen) + sizeof(struct ip6_hdr)) <
7625 (unsigned)(off + len)) {
7626 ACTION_SET(actionp, PF_DROP);
7627 REASON_SET(reasonp, PFRES_SHORT);
7628 return (NULL);
7629 }
7630 break;
7631 }
7632 #endif /* INET6 */
7633 }
7634 m_copydata(m, off, len, p);
7635 return (p);
7636 }
7637
7638 int
pf_routable(struct pf_addr * addr,sa_family_t af,struct pfi_kkif * kif,int rtableid)7639 pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kkif *kif,
7640 int rtableid)
7641 {
7642 struct ifnet *ifp;
7643
7644 /*
7645 * Skip check for addresses with embedded interface scope,
7646 * as they would always match anyway.
7647 */
7648 if (af == AF_INET6 && IN6_IS_SCOPE_EMBED(&addr->v6))
7649 return (1);
7650
7651 if (af != AF_INET && af != AF_INET6)
7652 return (0);
7653
7654 if (kif == V_pfi_all)
7655 return (1);
7656
7657 /* Skip checks for ipsec interfaces */
7658 if (kif != NULL && kif->pfik_ifp->if_type == IFT_ENC)
7659 return (1);
7660
7661 ifp = (kif != NULL) ? kif->pfik_ifp : NULL;
7662
7663 switch (af) {
7664 #ifdef INET6
7665 case AF_INET6:
7666 return (fib6_check_urpf(rtableid, &addr->v6, 0, NHR_NONE,
7667 ifp));
7668 #endif
7669 #ifdef INET
7670 case AF_INET:
7671 return (fib4_check_urpf(rtableid, addr->v4, 0, NHR_NONE,
7672 ifp));
7673 #endif
7674 }
7675
7676 return (0);
7677 }
7678
7679 #ifdef INET
7680 static void
pf_route(struct mbuf ** m,struct pf_krule * r,struct ifnet * oifp,struct pf_kstate * s,struct pf_pdesc * pd,struct inpcb * inp)7681 pf_route(struct mbuf **m, struct pf_krule *r, struct ifnet *oifp,
7682 struct pf_kstate *s, struct pf_pdesc *pd, struct inpcb *inp)
7683 {
7684 struct mbuf *m0, *m1, *md;
7685 struct sockaddr_in dst;
7686 struct ip *ip;
7687 struct ifnet *ifp;
7688 int error = 0;
7689 uint16_t ip_len, ip_off;
7690 uint16_t tmp;
7691 int r_dir;
7692
7693 KASSERT(m && *m && r && oifp && pd->act.rt_kif,
7694 ("%s: invalid parameters", __func__));
7695
7696 SDT_PROBE4(pf, ip, route_to, entry, *m, pd, s, oifp);
7697
7698 if (s) {
7699 r_dir = s->direction;
7700 } else {
7701 r_dir = r->direction;
7702 }
7703
7704 KASSERT(pd->dir == PF_IN || pd->dir == PF_OUT ||
7705 r_dir == PF_IN || r_dir == PF_OUT, ("%s: invalid direction",
7706 __func__));
7707
7708 if ((pd->pf_mtag == NULL &&
7709 ((pd->pf_mtag = pf_get_mtag(*m)) == NULL)) ||
7710 pd->pf_mtag->routed++ > 3) {
7711 m0 = *m;
7712 *m = NULL;
7713 SDT_PROBE1(pf, ip, route_to, drop, __LINE__);
7714 goto bad_locked;
7715 }
7716
7717 if ((ifp = pd->act.rt_kif->pfik_ifp) == NULL) {
7718 m0 = *m;
7719 *m = NULL;
7720 SDT_PROBE1(pf, ip, route_to, drop, __LINE__);
7721 goto bad_locked;
7722 }
7723
7724 if (pd->act.rt == PF_DUPTO) {
7725 if ((pd->pf_mtag->flags & PF_MTAG_FLAG_DUPLICATED)) {
7726 if (s != NULL) {
7727 PF_STATE_UNLOCK(s);
7728 }
7729 if (ifp == oifp) {
7730 /* When the 2nd interface is not skipped */
7731 return;
7732 } else {
7733 m0 = *m;
7734 *m = NULL;
7735 SDT_PROBE1(pf, ip, route_to, drop, __LINE__);
7736 goto bad;
7737 }
7738 } else {
7739 pd->pf_mtag->flags |= PF_MTAG_FLAG_DUPLICATED;
7740 if (((m0 = m_dup(*m, M_NOWAIT)) == NULL)) {
7741 if (s)
7742 PF_STATE_UNLOCK(s);
7743 return;
7744 }
7745 }
7746 } else {
7747 if ((pd->act.rt == PF_REPLYTO) == (r_dir == pd->dir)) {
7748 pf_dummynet(pd, s, r, m);
7749 if (s)
7750 PF_STATE_UNLOCK(s);
7751 return;
7752 }
7753 m0 = *m;
7754 }
7755
7756 ip = mtod(m0, struct ip *);
7757
7758 bzero(&dst, sizeof(dst));
7759 dst.sin_family = AF_INET;
7760 dst.sin_len = sizeof(dst);
7761 dst.sin_addr = ip->ip_dst;
7762 dst.sin_addr.s_addr = pd->act.rt_addr.v4.s_addr;
7763
7764 if (s != NULL){
7765 if (r->rule_flag & PFRULE_IFBOUND &&
7766 pd->act.rt == PF_REPLYTO &&
7767 s->kif == V_pfi_all) {
7768 s->kif = pd->act.rt_kif;
7769 s->orig_kif = oifp->if_pf_kif;
7770 }
7771
7772 PF_STATE_UNLOCK(s);
7773 }
7774
7775 if (pd->dir == PF_IN) {
7776 if (pf_test(AF_INET, PF_OUT, PFIL_FWD, ifp, &m0, inp,
7777 &pd->act) != PF_PASS) {
7778 SDT_PROBE1(pf, ip, route_to, drop, __LINE__);
7779 goto bad;
7780 } else if (m0 == NULL) {
7781 SDT_PROBE1(pf, ip, route_to, drop, __LINE__);
7782 goto done;
7783 }
7784 if (m0->m_len < sizeof(struct ip)) {
7785 DPFPRINTF(PF_DEBUG_URGENT,
7786 ("%s: m0->m_len < sizeof(struct ip)\n", __func__));
7787 SDT_PROBE1(pf, ip, route_to, drop, __LINE__);
7788 goto bad;
7789 }
7790 ip = mtod(m0, struct ip *);
7791 }
7792
7793 if (ifp->if_flags & IFF_LOOPBACK)
7794 m0->m_flags |= M_SKIP_FIREWALL;
7795
7796 ip_len = ntohs(ip->ip_len);
7797 ip_off = ntohs(ip->ip_off);
7798
7799 /* Copied from FreeBSD 10.0-CURRENT ip_output. */
7800 m0->m_pkthdr.csum_flags |= CSUM_IP;
7801 if (m0->m_pkthdr.csum_flags & CSUM_DELAY_DATA & ~ifp->if_hwassist) {
7802 in_delayed_cksum(m0);
7803 m0->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
7804 }
7805 if (m0->m_pkthdr.csum_flags & CSUM_SCTP & ~ifp->if_hwassist) {
7806 pf_sctp_checksum(m0, (uint32_t)(ip->ip_hl << 2));
7807 m0->m_pkthdr.csum_flags &= ~CSUM_SCTP;
7808 }
7809
7810 if (pd->dir == PF_IN) {
7811 /*
7812 * Make sure dummynet gets the correct direction, in case it needs to
7813 * re-inject later.
7814 */
7815 pd->dir = PF_OUT;
7816
7817 /*
7818 * The following processing is actually the rest of the inbound processing, even
7819 * though we've marked it as outbound (so we don't look through dummynet) and it
7820 * happens after the outbound processing (pf_test(PF_OUT) above).
7821 * Swap the dummynet pipe numbers, because it's going to come to the wrong
7822 * conclusion about what direction it's processing, and we can't fix it or it
7823 * will re-inject incorrectly. Swapping the pipe numbers means that its incorrect
7824 * decision will pick the right pipe, and everything will mostly work as expected.
7825 */
7826 tmp = pd->act.dnrpipe;
7827 pd->act.dnrpipe = pd->act.dnpipe;
7828 pd->act.dnpipe = tmp;
7829 }
7830
7831 /*
7832 * If small enough for interface, or the interface will take
7833 * care of the fragmentation for us, we can just send directly.
7834 */
7835 if (ip_len <= ifp->if_mtu ||
7836 (m0->m_pkthdr.csum_flags & ifp->if_hwassist & CSUM_TSO) != 0) {
7837 ip->ip_sum = 0;
7838 if (m0->m_pkthdr.csum_flags & CSUM_IP & ~ifp->if_hwassist) {
7839 ip->ip_sum = in_cksum(m0, ip->ip_hl << 2);
7840 m0->m_pkthdr.csum_flags &= ~CSUM_IP;
7841 }
7842 m_clrprotoflags(m0); /* Avoid confusing lower layers. */
7843
7844 md = m0;
7845 error = pf_dummynet_route(pd, s, r, ifp, sintosa(&dst), &md);
7846 if (md != NULL) {
7847 error = (*ifp->if_output)(ifp, md, sintosa(&dst), NULL);
7848 SDT_PROBE2(pf, ip, route_to, output, ifp, error);
7849 }
7850 goto done;
7851 }
7852
7853 /* Balk when DF bit is set or the interface didn't support TSO. */
7854 if ((ip_off & IP_DF) || (m0->m_pkthdr.csum_flags & CSUM_TSO)) {
7855 error = EMSGSIZE;
7856 KMOD_IPSTAT_INC(ips_cantfrag);
7857 if (pd->act.rt != PF_DUPTO) {
7858 if (s && s->nat_rule != NULL)
7859 PACKET_UNDO_NAT(m0, pd,
7860 (ip->ip_hl << 2) + (ip_off & IP_OFFMASK),
7861 s);
7862
7863 icmp_error(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 0,
7864 ifp->if_mtu);
7865 SDT_PROBE1(pf, ip, route_to, drop, __LINE__);
7866 goto done;
7867 } else {
7868 SDT_PROBE1(pf, ip, route_to, drop, __LINE__);
7869 goto bad;
7870 }
7871 }
7872
7873 error = ip_fragment(ip, &m0, ifp->if_mtu, ifp->if_hwassist);
7874 if (error) {
7875 SDT_PROBE1(pf, ip, route_to, drop, __LINE__);
7876 goto bad;
7877 }
7878
7879 for (; m0; m0 = m1) {
7880 m1 = m0->m_nextpkt;
7881 m0->m_nextpkt = NULL;
7882 if (error == 0) {
7883 m_clrprotoflags(m0);
7884 md = m0;
7885 pd->pf_mtag = pf_find_mtag(md);
7886 error = pf_dummynet_route(pd, s, r, ifp,
7887 sintosa(&dst), &md);
7888 if (md != NULL) {
7889 error = (*ifp->if_output)(ifp, md,
7890 sintosa(&dst), NULL);
7891 SDT_PROBE2(pf, ip, route_to, output, ifp, error);
7892 }
7893 } else
7894 m_freem(m0);
7895 }
7896
7897 if (error == 0)
7898 KMOD_IPSTAT_INC(ips_fragmented);
7899
7900 done:
7901 if (pd->act.rt != PF_DUPTO)
7902 *m = NULL;
7903 return;
7904
7905 bad_locked:
7906 if (s)
7907 PF_STATE_UNLOCK(s);
7908 bad:
7909 m_freem(m0);
7910 goto done;
7911 }
7912 #endif /* INET */
7913
7914 #ifdef INET6
7915 static void
pf_route6(struct mbuf ** m,struct pf_krule * r,struct ifnet * oifp,struct pf_kstate * s,struct pf_pdesc * pd,struct inpcb * inp)7916 pf_route6(struct mbuf **m, struct pf_krule *r, struct ifnet *oifp,
7917 struct pf_kstate *s, struct pf_pdesc *pd, struct inpcb *inp)
7918 {
7919 struct mbuf *m0, *md;
7920 struct m_tag *mtag;
7921 struct sockaddr_in6 dst;
7922 struct ip6_hdr *ip6;
7923 struct ifnet *ifp = NULL;
7924 int r_dir;
7925
7926 KASSERT(m && *m && r && oifp && pd->act.rt_kif,
7927 ("%s: invalid parameters", __func__));
7928
7929 SDT_PROBE4(pf, ip6, route_to, entry, *m, pd, s, oifp);
7930
7931 if (s) {
7932 r_dir = s->direction;
7933 } else {
7934 r_dir = r->direction;
7935 }
7936
7937 KASSERT(pd->dir == PF_IN || pd->dir == PF_OUT ||
7938 r_dir == PF_IN || r_dir == PF_OUT, ("%s: invalid direction",
7939 __func__));
7940
7941 if ((pd->pf_mtag == NULL &&
7942 ((pd->pf_mtag = pf_get_mtag(*m)) == NULL)) ||
7943 pd->pf_mtag->routed++ > 3) {
7944 m0 = *m;
7945 *m = NULL;
7946 SDT_PROBE1(pf, ip6, route_to, drop, __LINE__);
7947 goto bad_locked;
7948 }
7949
7950 if ((ifp = pd->act.rt_kif->pfik_ifp) == NULL) {
7951 m0 = *m;
7952 *m = NULL;
7953 SDT_PROBE1(pf, ip6, route_to, drop, __LINE__);
7954 goto bad_locked;
7955 }
7956
7957 if (pd->act.rt == PF_DUPTO) {
7958 if ((pd->pf_mtag->flags & PF_MTAG_FLAG_DUPLICATED)) {
7959 if (s != NULL) {
7960 PF_STATE_UNLOCK(s);
7961 }
7962 if (ifp == oifp) {
7963 /* When the 2nd interface is not skipped */
7964 return;
7965 } else {
7966 m0 = *m;
7967 *m = NULL;
7968 SDT_PROBE1(pf, ip6, route_to, drop, __LINE__);
7969 goto bad;
7970 }
7971 } else {
7972 pd->pf_mtag->flags |= PF_MTAG_FLAG_DUPLICATED;
7973 if (((m0 = m_dup(*m, M_NOWAIT)) == NULL)) {
7974 if (s)
7975 PF_STATE_UNLOCK(s);
7976 return;
7977 }
7978 }
7979 } else {
7980 if ((pd->act.rt == PF_REPLYTO) == (r_dir == pd->dir)) {
7981 pf_dummynet(pd, s, r, m);
7982 if (s)
7983 PF_STATE_UNLOCK(s);
7984 return;
7985 }
7986 m0 = *m;
7987 }
7988
7989 ip6 = mtod(m0, struct ip6_hdr *);
7990
7991 bzero(&dst, sizeof(dst));
7992 dst.sin6_family = AF_INET6;
7993 dst.sin6_len = sizeof(dst);
7994 dst.sin6_addr = ip6->ip6_dst;
7995 PF_ACPY((struct pf_addr *)&dst.sin6_addr, &pd->act.rt_addr, AF_INET6);
7996
7997 if (s != NULL) {
7998 if (r->rule_flag & PFRULE_IFBOUND &&
7999 pd->act.rt == PF_REPLYTO &&
8000 s->kif == V_pfi_all) {
8001 s->kif = pd->act.rt_kif;
8002 s->orig_kif = oifp->if_pf_kif;
8003 }
8004 PF_STATE_UNLOCK(s);
8005 }
8006
8007 if (pd->dir == PF_IN) {
8008 if (pf_test(AF_INET6, PF_OUT, PFIL_FWD | PF_PFIL_NOREFRAGMENT,
8009 ifp, &m0, inp, &pd->act) != PF_PASS) {
8010 SDT_PROBE1(pf, ip6, route_to, drop, __LINE__);
8011 goto bad;
8012 } else if (m0 == NULL) {
8013 SDT_PROBE1(pf, ip6, route_to, drop, __LINE__);
8014 goto done;
8015 }
8016 if (m0->m_len < sizeof(struct ip6_hdr)) {
8017 DPFPRINTF(PF_DEBUG_URGENT,
8018 ("%s: m0->m_len < sizeof(struct ip6_hdr)\n",
8019 __func__));
8020 SDT_PROBE1(pf, ip6, route_to, drop, __LINE__);
8021 goto bad;
8022 }
8023 ip6 = mtod(m0, struct ip6_hdr *);
8024 }
8025
8026 if (ifp->if_flags & IFF_LOOPBACK)
8027 m0->m_flags |= M_SKIP_FIREWALL;
8028
8029 if (m0->m_pkthdr.csum_flags & CSUM_DELAY_DATA_IPV6 &
8030 ~ifp->if_hwassist) {
8031 uint32_t plen = m0->m_pkthdr.len - sizeof(*ip6);
8032 in6_delayed_cksum(m0, plen, sizeof(struct ip6_hdr));
8033 m0->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6;
8034 }
8035
8036 /*
8037 * If the packet is too large for the outgoing interface,
8038 * send back an icmp6 error.
8039 */
8040 if (IN6_IS_SCOPE_EMBED(&dst.sin6_addr))
8041 dst.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
8042 mtag = m_tag_find(m0, PACKET_TAG_PF_REASSEMBLED, NULL);
8043 if (mtag != NULL) {
8044 int ret __sdt_used;
8045 ret = pf_refragment6(ifp, &m0, mtag, ifp, true);
8046 SDT_PROBE2(pf, ip6, route_to, output, ifp, ret);
8047 goto done;
8048 }
8049
8050 if ((u_long)m0->m_pkthdr.len <= ifp->if_mtu) {
8051 md = m0;
8052 pf_dummynet_route(pd, s, r, ifp, sintosa(&dst), &md);
8053 if (md != NULL) {
8054 int ret __sdt_used;
8055 ret = nd6_output_ifp(ifp, ifp, md, &dst, NULL);
8056 SDT_PROBE2(pf, ip6, route_to, output, ifp, ret);
8057 }
8058 }
8059 else {
8060 in6_ifstat_inc(ifp, ifs6_in_toobig);
8061 if (pd->act.rt != PF_DUPTO) {
8062 if (s && s->nat_rule != NULL)
8063 PACKET_UNDO_NAT(m0, pd,
8064 ((caddr_t)ip6 - m0->m_data) +
8065 sizeof(struct ip6_hdr), s);
8066
8067 icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu);
8068 SDT_PROBE1(pf, ip6, route_to, drop, __LINE__);
8069 } else {
8070 SDT_PROBE1(pf, ip6, route_to, drop, __LINE__);
8071 goto bad;
8072 }
8073 }
8074
8075 done:
8076 if (pd->act.rt != PF_DUPTO)
8077 *m = NULL;
8078 return;
8079
8080 bad_locked:
8081 if (s)
8082 PF_STATE_UNLOCK(s);
8083 bad:
8084 m_freem(m0);
8085 goto done;
8086 }
8087 #endif /* INET6 */
8088
8089 /*
8090 * FreeBSD supports cksum offloads for the following drivers.
8091 * em(4), fxp(4), lge(4), nge(4), re(4), ti(4), txp(4), xl(4)
8092 *
8093 * CSUM_DATA_VALID | CSUM_PSEUDO_HDR :
8094 * network driver performed cksum including pseudo header, need to verify
8095 * csum_data
8096 * CSUM_DATA_VALID :
8097 * network driver performed cksum, needs to additional pseudo header
8098 * cksum computation with partial csum_data(i.e. lack of H/W support for
8099 * pseudo header, for instance sk(4) and possibly gem(4))
8100 *
8101 * After validating the cksum of packet, set both flag CSUM_DATA_VALID and
8102 * CSUM_PSEUDO_HDR in order to avoid recomputation of the cksum in upper
8103 * TCP/UDP layer.
8104 * Also, set csum_data to 0xffff to force cksum validation.
8105 */
8106 static int
pf_check_proto_cksum(struct mbuf * m,int off,int len,u_int8_t p,sa_family_t af)8107 pf_check_proto_cksum(struct mbuf *m, int off, int len, u_int8_t p, sa_family_t af)
8108 {
8109 u_int16_t sum = 0;
8110 int hw_assist = 0;
8111 struct ip *ip;
8112
8113 if (off < sizeof(struct ip) || len < sizeof(struct udphdr))
8114 return (1);
8115 if (m->m_pkthdr.len < off + len)
8116 return (1);
8117
8118 switch (p) {
8119 case IPPROTO_TCP:
8120 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
8121 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
8122 sum = m->m_pkthdr.csum_data;
8123 } else {
8124 ip = mtod(m, struct ip *);
8125 sum = in_pseudo(ip->ip_src.s_addr,
8126 ip->ip_dst.s_addr, htonl((u_short)len +
8127 m->m_pkthdr.csum_data + IPPROTO_TCP));
8128 }
8129 sum ^= 0xffff;
8130 ++hw_assist;
8131 }
8132 break;
8133 case IPPROTO_UDP:
8134 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
8135 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
8136 sum = m->m_pkthdr.csum_data;
8137 } else {
8138 ip = mtod(m, struct ip *);
8139 sum = in_pseudo(ip->ip_src.s_addr,
8140 ip->ip_dst.s_addr, htonl((u_short)len +
8141 m->m_pkthdr.csum_data + IPPROTO_UDP));
8142 }
8143 sum ^= 0xffff;
8144 ++hw_assist;
8145 }
8146 break;
8147 case IPPROTO_ICMP:
8148 #ifdef INET6
8149 case IPPROTO_ICMPV6:
8150 #endif /* INET6 */
8151 break;
8152 default:
8153 return (1);
8154 }
8155
8156 if (!hw_assist) {
8157 switch (af) {
8158 case AF_INET:
8159 if (p == IPPROTO_ICMP) {
8160 if (m->m_len < off)
8161 return (1);
8162 m->m_data += off;
8163 m->m_len -= off;
8164 sum = in_cksum(m, len);
8165 m->m_data -= off;
8166 m->m_len += off;
8167 } else {
8168 if (m->m_len < sizeof(struct ip))
8169 return (1);
8170 sum = in4_cksum(m, p, off, len);
8171 }
8172 break;
8173 #ifdef INET6
8174 case AF_INET6:
8175 if (m->m_len < sizeof(struct ip6_hdr))
8176 return (1);
8177 sum = in6_cksum(m, p, off, len);
8178 break;
8179 #endif /* INET6 */
8180 }
8181 }
8182 if (sum) {
8183 switch (p) {
8184 case IPPROTO_TCP:
8185 {
8186 KMOD_TCPSTAT_INC(tcps_rcvbadsum);
8187 break;
8188 }
8189 case IPPROTO_UDP:
8190 {
8191 KMOD_UDPSTAT_INC(udps_badsum);
8192 break;
8193 }
8194 #ifdef INET
8195 case IPPROTO_ICMP:
8196 {
8197 KMOD_ICMPSTAT_INC(icps_checksum);
8198 break;
8199 }
8200 #endif
8201 #ifdef INET6
8202 case IPPROTO_ICMPV6:
8203 {
8204 KMOD_ICMP6STAT_INC(icp6s_checksum);
8205 break;
8206 }
8207 #endif /* INET6 */
8208 }
8209 return (1);
8210 } else {
8211 if (p == IPPROTO_TCP || p == IPPROTO_UDP) {
8212 m->m_pkthdr.csum_flags |=
8213 (CSUM_DATA_VALID | CSUM_PSEUDO_HDR);
8214 m->m_pkthdr.csum_data = 0xffff;
8215 }
8216 }
8217 return (0);
8218 }
8219
8220 static bool
pf_pdesc_to_dnflow(const struct pf_pdesc * pd,const struct pf_krule * r,const struct pf_kstate * s,struct ip_fw_args * dnflow)8221 pf_pdesc_to_dnflow(const struct pf_pdesc *pd, const struct pf_krule *r,
8222 const struct pf_kstate *s, struct ip_fw_args *dnflow)
8223 {
8224 int dndir = r->direction;
8225
8226 if (s && dndir == PF_INOUT) {
8227 dndir = s->direction;
8228 } else if (dndir == PF_INOUT) {
8229 /* Assume primary direction. Happens when we've set dnpipe in
8230 * the ethernet level code. */
8231 dndir = pd->dir;
8232 }
8233
8234 if (pd->pf_mtag->flags & PF_MTAG_FLAG_DUMMYNETED)
8235 return (false);
8236
8237 memset(dnflow, 0, sizeof(*dnflow));
8238
8239 if (pd->dport != NULL)
8240 dnflow->f_id.dst_port = ntohs(*pd->dport);
8241 if (pd->sport != NULL)
8242 dnflow->f_id.src_port = ntohs(*pd->sport);
8243
8244 if (pd->dir == PF_IN)
8245 dnflow->flags |= IPFW_ARGS_IN;
8246 else
8247 dnflow->flags |= IPFW_ARGS_OUT;
8248
8249 if (pd->dir != dndir && pd->act.dnrpipe) {
8250 dnflow->rule.info = pd->act.dnrpipe;
8251 }
8252 else if (pd->dir == dndir && pd->act.dnpipe) {
8253 dnflow->rule.info = pd->act.dnpipe;
8254 }
8255 else {
8256 return (false);
8257 }
8258
8259 dnflow->rule.info |= IPFW_IS_DUMMYNET;
8260 if (r->free_flags & PFRULE_DN_IS_PIPE || pd->act.flags & PFSTATE_DN_IS_PIPE)
8261 dnflow->rule.info |= IPFW_IS_PIPE;
8262
8263 dnflow->f_id.proto = pd->proto;
8264 dnflow->f_id.extra = dnflow->rule.info;
8265 switch (pd->af) {
8266 case AF_INET:
8267 dnflow->f_id.addr_type = 4;
8268 dnflow->f_id.src_ip = ntohl(pd->src->v4.s_addr);
8269 dnflow->f_id.dst_ip = ntohl(pd->dst->v4.s_addr);
8270 break;
8271 case AF_INET6:
8272 dnflow->flags |= IPFW_ARGS_IP6;
8273 dnflow->f_id.addr_type = 6;
8274 dnflow->f_id.src_ip6 = pd->src->v6;
8275 dnflow->f_id.dst_ip6 = pd->dst->v6;
8276 break;
8277 }
8278
8279 return (true);
8280 }
8281
8282 int
pf_test_eth(int dir,int pflags,struct ifnet * ifp,struct mbuf ** m0,struct inpcb * inp)8283 pf_test_eth(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
8284 struct inpcb *inp)
8285 {
8286 struct pfi_kkif *kif;
8287 struct mbuf *m = *m0;
8288
8289 M_ASSERTPKTHDR(m);
8290 MPASS(ifp->if_vnet == curvnet);
8291 NET_EPOCH_ASSERT();
8292
8293 if (!V_pf_status.running)
8294 return (PF_PASS);
8295
8296 kif = (struct pfi_kkif *)ifp->if_pf_kif;
8297
8298 if (kif == NULL) {
8299 DPFPRINTF(PF_DEBUG_URGENT,
8300 ("%s: kif == NULL, if_xname %s\n", __func__, ifp->if_xname));
8301 return (PF_DROP);
8302 }
8303 if (kif->pfik_flags & PFI_IFLAG_SKIP)
8304 return (PF_PASS);
8305
8306 if (m->m_flags & M_SKIP_FIREWALL)
8307 return (PF_PASS);
8308
8309 if (__predict_false(! M_WRITABLE(*m0))) {
8310 m = *m0 = m_unshare(*m0, M_NOWAIT);
8311 if (*m0 == NULL)
8312 return (PF_DROP);
8313 }
8314
8315 /* Stateless! */
8316 return (pf_test_eth_rule(dir, kif, m0));
8317 }
8318
8319 static __inline void
pf_dummynet_flag_remove(struct mbuf * m,struct pf_mtag * pf_mtag)8320 pf_dummynet_flag_remove(struct mbuf *m, struct pf_mtag *pf_mtag)
8321 {
8322 struct m_tag *mtag;
8323
8324 pf_mtag->flags &= ~PF_MTAG_FLAG_DUMMYNET;
8325
8326 /* dummynet adds this tag, but pf does not need it,
8327 * and keeping it creates unexpected behavior,
8328 * e.g. in case of divert(4) usage right after dummynet. */
8329 mtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL);
8330 if (mtag != NULL)
8331 m_tag_delete(m, mtag);
8332 }
8333
8334 static int
pf_dummynet(struct pf_pdesc * pd,struct pf_kstate * s,struct pf_krule * r,struct mbuf ** m0)8335 pf_dummynet(struct pf_pdesc *pd, struct pf_kstate *s,
8336 struct pf_krule *r, struct mbuf **m0)
8337 {
8338 return (pf_dummynet_route(pd, s, r, NULL, NULL, m0));
8339 }
8340
8341 static int
pf_dummynet_route(struct pf_pdesc * pd,struct pf_kstate * s,struct pf_krule * r,struct ifnet * ifp,struct sockaddr * sa,struct mbuf ** m0)8342 pf_dummynet_route(struct pf_pdesc *pd, struct pf_kstate *s,
8343 struct pf_krule *r, struct ifnet *ifp, struct sockaddr *sa,
8344 struct mbuf **m0)
8345 {
8346 struct ip_fw_args dnflow;
8347
8348 NET_EPOCH_ASSERT();
8349
8350 if (pd->act.dnpipe == 0 && pd->act.dnrpipe == 0)
8351 return (0);
8352
8353 if (ip_dn_io_ptr == NULL) {
8354 m_freem(*m0);
8355 *m0 = NULL;
8356 return (ENOMEM);
8357 }
8358
8359 if (pd->pf_mtag == NULL &&
8360 ((pd->pf_mtag = pf_get_mtag(*m0)) == NULL)) {
8361 m_freem(*m0);
8362 *m0 = NULL;
8363 return (ENOMEM);
8364 }
8365
8366 if (ifp != NULL) {
8367 pd->pf_mtag->flags |= PF_MTAG_FLAG_ROUTE_TO;
8368
8369 pd->pf_mtag->if_index = ifp->if_index;
8370 pd->pf_mtag->if_idxgen = ifp->if_idxgen;
8371
8372 MPASS(sa != NULL);
8373
8374 switch (pd->af) {
8375 case AF_INET:
8376 memcpy(&pd->pf_mtag->dst, sa,
8377 sizeof(struct sockaddr_in));
8378 break;
8379 case AF_INET6:
8380 memcpy(&pd->pf_mtag->dst, sa,
8381 sizeof(struct sockaddr_in6));
8382 break;
8383 }
8384 }
8385
8386 if (s != NULL && s->nat_rule != NULL &&
8387 s->nat_rule->action == PF_RDR &&
8388 (
8389 #ifdef INET
8390 (pd->af == AF_INET && IN_LOOPBACK(ntohl(pd->dst->v4.s_addr))) ||
8391 #endif
8392 (pd->af == AF_INET6 && IN6_IS_ADDR_LOOPBACK(&pd->dst->v6)))) {
8393 /*
8394 * If we're redirecting to loopback mark this packet
8395 * as being local. Otherwise it might get dropped
8396 * if dummynet re-injects.
8397 */
8398 (*m0)->m_pkthdr.rcvif = V_loif;
8399 }
8400
8401 if (pf_pdesc_to_dnflow(pd, r, s, &dnflow)) {
8402 pd->pf_mtag->flags |= PF_MTAG_FLAG_DUMMYNET;
8403 pd->pf_mtag->flags |= PF_MTAG_FLAG_DUMMYNETED;
8404 ip_dn_io_ptr(m0, &dnflow);
8405 if (*m0 != NULL) {
8406 pd->pf_mtag->flags &= ~PF_MTAG_FLAG_ROUTE_TO;
8407 pf_dummynet_flag_remove(*m0, pd->pf_mtag);
8408 }
8409 }
8410
8411 return (0);
8412 }
8413
8414 #ifdef INET6
8415 static int
pf_walk_option6(struct mbuf * m,int off,int end,uint32_t * jumbolen,u_short * reason)8416 pf_walk_option6(struct mbuf *m, int off, int end, uint32_t *jumbolen,
8417 u_short *reason)
8418 {
8419 struct ip6_opt opt;
8420 struct ip6_opt_jumbo jumbo;
8421 struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
8422
8423 while (off < end) {
8424 if (!pf_pull_hdr(m, off, &opt.ip6o_type, sizeof(opt.ip6o_type),
8425 NULL, reason, AF_INET6)) {
8426 DPFPRINTF(PF_DEBUG_MISC, ("IPv6 short opt type"));
8427 return (PF_DROP);
8428 }
8429 if (opt.ip6o_type == IP6OPT_PAD1) {
8430 off++;
8431 continue;
8432 }
8433 if (!pf_pull_hdr(m, off, &opt, sizeof(opt), NULL, reason,
8434 AF_INET6)) {
8435 DPFPRINTF(PF_DEBUG_MISC, ("IPv6 short opt"));
8436 return (PF_DROP);
8437 }
8438 if (off + sizeof(opt) + opt.ip6o_len > end) {
8439 DPFPRINTF(PF_DEBUG_MISC, ("IPv6 long opt"));
8440 REASON_SET(reason, PFRES_IPOPTIONS);
8441 return (PF_DROP);
8442 }
8443 switch (opt.ip6o_type) {
8444 case IP6OPT_JUMBO:
8445 if (*jumbolen != 0) {
8446 DPFPRINTF(PF_DEBUG_MISC, ("IPv6 multiple jumbo"));
8447 REASON_SET(reason, PFRES_IPOPTIONS);
8448 return (PF_DROP);
8449 }
8450 if (ntohs(h->ip6_plen) != 0) {
8451 DPFPRINTF(PF_DEBUG_MISC, ("IPv6 bad jumbo plen"));
8452 REASON_SET(reason, PFRES_IPOPTIONS);
8453 return (PF_DROP);
8454 }
8455 if (!pf_pull_hdr(m, off, &jumbo, sizeof(jumbo), NULL,
8456 reason, AF_INET6)) {
8457 DPFPRINTF(PF_DEBUG_MISC, ("IPv6 short jumbo"));
8458 return (PF_DROP);
8459 }
8460 memcpy(jumbolen, jumbo.ip6oj_jumbo_len,
8461 sizeof(*jumbolen));
8462 *jumbolen = ntohl(*jumbolen);
8463 if (*jumbolen < IPV6_MAXPACKET) {
8464 DPFPRINTF(PF_DEBUG_MISC, ("IPv6 short jumbolen"));
8465 REASON_SET(reason, PFRES_IPOPTIONS);
8466 return (PF_DROP);
8467 }
8468 break;
8469 default:
8470 break;
8471 }
8472 off += sizeof(opt) + opt.ip6o_len;
8473 }
8474
8475 return (PF_PASS);
8476 }
8477
8478 int
pf_walk_header6(struct mbuf * m,struct ip6_hdr * h,int * off,int * extoff,int * fragoff,uint8_t * nxt,uint32_t * jumbolen,u_short * reason)8479 pf_walk_header6(struct mbuf *m, struct ip6_hdr *h, int *off, int *extoff,
8480 int *fragoff, uint8_t *nxt, uint32_t *jumbolen, u_short *reason)
8481 {
8482 struct ip6_frag frag;
8483 struct ip6_ext ext;
8484 struct ip6_rthdr rthdr;
8485 int rthdr_cnt = 0;
8486
8487 *off += sizeof(struct ip6_hdr);
8488 *extoff = *fragoff = 0;
8489 *nxt = h->ip6_nxt;
8490 *jumbolen = 0;
8491 for (;;) {
8492 switch (*nxt) {
8493 case IPPROTO_FRAGMENT:
8494 if (*fragoff != 0) {
8495 DPFPRINTF(PF_DEBUG_MISC, ("IPv6 multiple fragment"));
8496 REASON_SET(reason, PFRES_FRAG);
8497 return (PF_DROP);
8498 }
8499 /* jumbo payload packets cannot be fragmented */
8500 if (*jumbolen != 0) {
8501 DPFPRINTF(PF_DEBUG_MISC, ("IPv6 fragmented jumbo"));
8502 REASON_SET(reason, PFRES_FRAG);
8503 return (PF_DROP);
8504 }
8505 if (!pf_pull_hdr(m, *off, &frag, sizeof(frag), NULL,
8506 reason, AF_INET6)) {
8507 DPFPRINTF(PF_DEBUG_MISC, ("IPv6 short fragment"));
8508 return (PF_DROP);
8509 }
8510 *fragoff = *off;
8511 /* stop walking over non initial fragments */
8512 if ((frag.ip6f_offlg & IP6F_OFF_MASK) != 0)
8513 return (PF_PASS);
8514 *off += sizeof(frag);
8515 *nxt = frag.ip6f_nxt;
8516 break;
8517 case IPPROTO_ROUTING:
8518 if (rthdr_cnt++) {
8519 DPFPRINTF(PF_DEBUG_MISC, ("IPv6 multiple rthdr"));
8520 REASON_SET(reason, PFRES_IPOPTIONS);
8521 return (PF_DROP);
8522 }
8523 if (!pf_pull_hdr(m, *off, &rthdr, sizeof(rthdr), NULL,
8524 reason, AF_INET6)) {
8525 /* fragments may be short */
8526 if (*fragoff != 0) {
8527 *off = *fragoff;
8528 *nxt = IPPROTO_FRAGMENT;
8529 return (PF_PASS);
8530 }
8531 DPFPRINTF(PF_DEBUG_MISC, ("IPv6 short rthdr"));
8532 return (PF_DROP);
8533 }
8534 if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
8535 DPFPRINTF(PF_DEBUG_MISC, ("IPv6 rthdr0"));
8536 REASON_SET(reason, PFRES_IPOPTIONS);
8537 return (PF_DROP);
8538 }
8539 /* FALLTHROUGH */
8540 case IPPROTO_AH:
8541 case IPPROTO_HOPOPTS:
8542 case IPPROTO_DSTOPTS:
8543 if (!pf_pull_hdr(m, *off, &ext, sizeof(ext), NULL,
8544 reason, AF_INET6)) {
8545 /* fragments may be short */
8546 if (*fragoff != 0) {
8547 *off = *fragoff;
8548 *nxt = IPPROTO_FRAGMENT;
8549 return (PF_PASS);
8550 }
8551 DPFPRINTF(PF_DEBUG_MISC, ("IPv6 short exthdr"));
8552 return (PF_DROP);
8553 }
8554 /* reassembly needs the ext header before the frag */
8555 if (*fragoff == 0)
8556 *extoff = *off;
8557 if (*nxt == IPPROTO_HOPOPTS && *fragoff == 0) {
8558 if (pf_walk_option6(m, *off + sizeof(ext),
8559 *off + (ext.ip6e_len + 1) * 8, jumbolen,
8560 reason) != PF_PASS)
8561 return (PF_DROP);
8562 if (ntohs(h->ip6_plen) == 0 && *jumbolen != 0) {
8563 DPFPRINTF(PF_DEBUG_MISC,
8564 ("IPv6 missing jumbo"));
8565 REASON_SET(reason, PFRES_IPOPTIONS);
8566 return (PF_DROP);
8567 }
8568 }
8569 if (*nxt == IPPROTO_AH)
8570 *off += (ext.ip6e_len + 2) * 4;
8571 else
8572 *off += (ext.ip6e_len + 1) * 8;
8573 *nxt = ext.ip6e_nxt;
8574 break;
8575 case IPPROTO_TCP:
8576 case IPPROTO_UDP:
8577 case IPPROTO_SCTP:
8578 case IPPROTO_ICMPV6:
8579 /* fragments may be short, ignore inner header then */
8580 if (*fragoff != 0 && ntohs(h->ip6_plen) < *off +
8581 (*nxt == IPPROTO_TCP ? sizeof(struct tcphdr) :
8582 *nxt == IPPROTO_UDP ? sizeof(struct udphdr) :
8583 *nxt == IPPROTO_SCTP ? sizeof(struct sctphdr) :
8584 sizeof(struct icmp6_hdr))) {
8585 *off = *fragoff;
8586 *nxt = IPPROTO_FRAGMENT;
8587 }
8588 /* FALLTHROUGH */
8589 default:
8590 return (PF_PASS);
8591 }
8592 }
8593 }
8594 #endif
8595
8596 static void
pf_init_pdesc(struct pf_pdesc * pd,struct mbuf * m)8597 pf_init_pdesc(struct pf_pdesc *pd, struct mbuf *m)
8598 {
8599 memset(pd, 0, sizeof(*pd));
8600 pd->pf_mtag = pf_find_mtag(m);
8601 pd->m = m;
8602 }
8603
8604 static int
pf_setup_pdesc(sa_family_t af,int dir,struct pf_pdesc * pd,struct mbuf ** m0,u_short * action,u_short * reason,struct pfi_kkif * kif,struct pf_rule_actions * default_actions)8605 pf_setup_pdesc(sa_family_t af, int dir, struct pf_pdesc *pd, struct mbuf **m0,
8606 u_short *action, u_short *reason, struct pfi_kkif *kif,
8607 struct pf_rule_actions *default_actions)
8608 {
8609 pd->af = af;
8610 pd->dir = dir;
8611 pd->kif = kif;
8612 pd->m = *m0;
8613 pd->sidx = (dir == PF_IN) ? 0 : 1;
8614 pd->didx = (dir == PF_IN) ? 1 : 0;
8615
8616 TAILQ_INIT(&pd->sctp_multihome_jobs);
8617 if (default_actions != NULL)
8618 memcpy(&pd->act, default_actions, sizeof(pd->act));
8619
8620 if (pd->pf_mtag && pd->pf_mtag->dnpipe) {
8621 pd->act.dnpipe = pd->pf_mtag->dnpipe;
8622 pd->act.flags = pd->pf_mtag->dnflags;
8623 }
8624
8625 switch (af) {
8626 #ifdef INET
8627 case AF_INET: {
8628 struct ip *h;
8629
8630 if (__predict_false((*m0)->m_len < sizeof(struct ip)) &&
8631 (pd->m = *m0 = m_pullup(*m0, sizeof(struct ip))) == NULL) {
8632 DPFPRINTF(PF_DEBUG_URGENT,
8633 ("pf_test: m_len < sizeof(struct ip), pullup failed\n"));
8634 *action = PF_DROP;
8635 REASON_SET(reason, PFRES_SHORT);
8636 return (-1);
8637 }
8638
8639 if (pf_normalize_ip(m0, reason, pd) != PF_PASS) {
8640 /* We do IP header normalization and packet reassembly here */
8641 *action = PF_DROP;
8642 return (-1);
8643 }
8644 pd->m = *m0;
8645
8646 h = mtod(pd->m, struct ip *);
8647 pd->off = h->ip_hl << 2;
8648 if (pd->off < (int)sizeof(*h)) {
8649 *action = PF_DROP;
8650 REASON_SET(reason, PFRES_SHORT);
8651 return (-1);
8652 }
8653 pd->src = (struct pf_addr *)&h->ip_src;
8654 pd->dst = (struct pf_addr *)&h->ip_dst;
8655 pd->ip_sum = &h->ip_sum;
8656 pd->virtual_proto = pd->proto = h->ip_p;
8657 pd->tos = h->ip_tos;
8658 pd->ttl = h->ip_ttl;
8659 pd->tot_len = ntohs(h->ip_len);
8660 pd->act.rtableid = -1;
8661
8662 if (h->ip_hl > 5) /* has options */
8663 pd->badopts++;
8664
8665 if (h->ip_off & htons(IP_MF | IP_OFFMASK))
8666 pd->virtual_proto = PF_VPROTO_FRAGMENT;
8667
8668 break;
8669 }
8670 #endif
8671 #ifdef INET6
8672 case AF_INET6: {
8673 struct ip6_hdr *h;
8674 int fragoff;
8675 uint32_t jumbolen;
8676 uint8_t nxt;
8677
8678 if (__predict_false((*m0)->m_len < sizeof(struct ip6_hdr)) &&
8679 (pd->m = *m0 = m_pullup(*m0, sizeof(struct ip6_hdr))) == NULL) {
8680 DPFPRINTF(PF_DEBUG_URGENT,
8681 ("pf_test6: m_len < sizeof(struct ip6_hdr)"
8682 ", pullup failed\n"));
8683 *action = PF_DROP;
8684 REASON_SET(reason, PFRES_SHORT);
8685 return (-1);
8686 }
8687
8688 h = mtod(pd->m, struct ip6_hdr *);
8689 pd->off = 0;
8690 if (pf_walk_header6(pd->m, h, &pd->off, &pd->extoff, &fragoff, &nxt,
8691 &jumbolen, reason) != PF_PASS) {
8692 *action = PF_DROP;
8693 return (-1);
8694 }
8695
8696 h = mtod(pd->m, struct ip6_hdr *);
8697 pd->src = (struct pf_addr *)&h->ip6_src;
8698 pd->dst = (struct pf_addr *)&h->ip6_dst;
8699 pd->ip_sum = NULL;
8700 pd->tos = IPV6_DSCP(h);
8701 pd->ttl = h->ip6_hlim;
8702 pd->tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
8703 pd->virtual_proto = pd->proto = h->ip6_nxt;
8704 pd->act.rtableid = -1;
8705
8706 if (fragoff != 0)
8707 pd->virtual_proto = PF_VPROTO_FRAGMENT;
8708
8709 /*
8710 * we do not support jumbogram. if we keep going, zero ip6_plen
8711 * will do something bad, so drop the packet for now.
8712 */
8713 if (htons(h->ip6_plen) == 0) {
8714 *action = PF_DROP;
8715 return (-1);
8716 }
8717
8718 /* We do IP header normalization and packet reassembly here */
8719 if (pf_normalize_ip6(m0, fragoff, reason, pd) !=
8720 PF_PASS) {
8721 *action = PF_DROP;
8722 return (-1);
8723 }
8724 pd->m = *m0;
8725 if (pd->m == NULL) {
8726 /* packet sits in reassembly queue, no error */
8727 *action = PF_PASS;
8728 return (-1);
8729 }
8730
8731 /* Update pointers into the packet. */
8732 h = mtod(pd->m, struct ip6_hdr *);
8733 pd->src = (struct pf_addr *)&h->ip6_src;
8734 pd->dst = (struct pf_addr *)&h->ip6_dst;
8735
8736 /*
8737 * Reassembly may have changed the next protocol from fragment
8738 * to something else, so update.
8739 */
8740 pd->virtual_proto = pd->proto = h->ip6_nxt;
8741 pd->off = 0;
8742
8743 if (pf_walk_header6(pd->m, h, &pd->off, &pd->extoff, &fragoff, &nxt,
8744 &jumbolen, reason) != PF_PASS) {
8745 *action = PF_DROP;
8746 return (-1);
8747 }
8748
8749 if (fragoff != 0)
8750 pd->virtual_proto = PF_VPROTO_FRAGMENT;
8751
8752 break;
8753 }
8754 #endif
8755 default:
8756 panic("pf_setup_pdesc called with illegal af %u", af);
8757 }
8758
8759 switch (pd->virtual_proto) {
8760 case IPPROTO_TCP: {
8761 struct tcphdr *th = &pd->hdr.tcp;
8762
8763 if (!pf_pull_hdr(pd->m, pd->off, th, sizeof(*th), action,
8764 reason, af)) {
8765 *action = PF_DROP;
8766 REASON_SET(reason, PFRES_SHORT);
8767 return (-1);
8768 }
8769 pd->hdrlen = sizeof(*th);
8770 pd->p_len = pd->tot_len - pd->off - (th->th_off << 2);
8771 pd->sport = &th->th_sport;
8772 pd->dport = &th->th_dport;
8773 break;
8774 }
8775 case IPPROTO_UDP: {
8776 struct udphdr *uh = &pd->hdr.udp;
8777
8778 if (!pf_pull_hdr(pd->m, pd->off, uh, sizeof(*uh), action,
8779 reason, af)) {
8780 *action = PF_DROP;
8781 REASON_SET(reason, PFRES_SHORT);
8782 return (-1);
8783 }
8784 pd->hdrlen = sizeof(*uh);
8785 if (uh->uh_dport == 0 ||
8786 ntohs(uh->uh_ulen) > pd->m->m_pkthdr.len - pd->off ||
8787 ntohs(uh->uh_ulen) < sizeof(struct udphdr)) {
8788 *action = PF_DROP;
8789 REASON_SET(reason, PFRES_SHORT);
8790 return (-1);
8791 }
8792 pd->sport = &uh->uh_sport;
8793 pd->dport = &uh->uh_dport;
8794 break;
8795 }
8796 case IPPROTO_SCTP: {
8797 if (!pf_pull_hdr(pd->m, pd->off, &pd->hdr.sctp, sizeof(pd->hdr.sctp),
8798 action, reason, af)) {
8799 *action = PF_DROP;
8800 REASON_SET(reason, PFRES_SHORT);
8801 return (-1);
8802 }
8803 pd->hdrlen = sizeof(pd->hdr.sctp);
8804 pd->p_len = pd->tot_len - pd->off;
8805
8806 pd->sport = &pd->hdr.sctp.src_port;
8807 pd->dport = &pd->hdr.sctp.dest_port;
8808 if (pd->hdr.sctp.src_port == 0 || pd->hdr.sctp.dest_port == 0) {
8809 *action = PF_DROP;
8810 REASON_SET(reason, PFRES_SHORT);
8811 return (-1);
8812 }
8813 if (pf_scan_sctp(pd) != PF_PASS) {
8814 *action = PF_DROP;
8815 REASON_SET(reason, PFRES_SHORT);
8816 return (-1);
8817 }
8818 break;
8819 }
8820 case IPPROTO_ICMP: {
8821 if (!pf_pull_hdr(pd->m, pd->off, &pd->hdr.icmp, ICMP_MINLEN,
8822 action, reason, af)) {
8823 *action = PF_DROP;
8824 REASON_SET(reason, PFRES_SHORT);
8825 return (-1);
8826 }
8827 pd->hdrlen = ICMP_MINLEN;
8828 break;
8829 }
8830 #ifdef INET6
8831 case IPPROTO_ICMPV6: {
8832 size_t icmp_hlen = sizeof(struct icmp6_hdr);
8833
8834 if (!pf_pull_hdr(pd->m, pd->off, &pd->hdr.icmp6, icmp_hlen,
8835 action, reason, af)) {
8836 *action = PF_DROP;
8837 REASON_SET(reason, PFRES_SHORT);
8838 return (-1);
8839 }
8840 /* ICMP headers we look further into to match state */
8841 switch (pd->hdr.icmp6.icmp6_type) {
8842 case MLD_LISTENER_QUERY:
8843 case MLD_LISTENER_REPORT:
8844 icmp_hlen = sizeof(struct mld_hdr);
8845 break;
8846 case ND_NEIGHBOR_SOLICIT:
8847 case ND_NEIGHBOR_ADVERT:
8848 icmp_hlen = sizeof(struct nd_neighbor_solicit);
8849 break;
8850 }
8851 if (icmp_hlen > sizeof(struct icmp6_hdr) &&
8852 !pf_pull_hdr(pd->m, pd->off, &pd->hdr.icmp6, icmp_hlen,
8853 action, reason, af)) {
8854 *action = PF_DROP;
8855 REASON_SET(reason, PFRES_SHORT);
8856 return (-1);
8857 }
8858 pd->hdrlen = icmp_hlen;
8859 break;
8860 }
8861 #endif
8862 }
8863 return (0);
8864 }
8865
8866 static void
pf_counters_inc(int action,struct pf_pdesc * pd,struct pf_kstate * s,struct pf_krule * r,struct pf_krule * a)8867 pf_counters_inc(int action, struct pf_pdesc *pd,
8868 struct pf_kstate *s, struct pf_krule *r, struct pf_krule *a)
8869 {
8870 struct pf_krule *tr;
8871 int dir = pd->dir;
8872 int dirndx;
8873
8874 pf_counter_u64_critical_enter();
8875 pf_counter_u64_add_protected(
8876 &pd->kif->pfik_bytes[pd->af == AF_INET6][dir == PF_OUT][action != PF_PASS],
8877 pd->tot_len);
8878 pf_counter_u64_add_protected(
8879 &pd->kif->pfik_packets[pd->af == AF_INET6][dir == PF_OUT][action != PF_PASS],
8880 1);
8881
8882 if (action == PF_PASS || r->action == PF_DROP) {
8883 dirndx = (dir == PF_OUT);
8884 pf_counter_u64_add_protected(&r->packets[dirndx], 1);
8885 pf_counter_u64_add_protected(&r->bytes[dirndx], pd->tot_len);
8886 pf_update_timestamp(r);
8887
8888 if (a != NULL) {
8889 pf_counter_u64_add_protected(&a->packets[dirndx], 1);
8890 pf_counter_u64_add_protected(&a->bytes[dirndx], pd->tot_len);
8891 }
8892 if (s != NULL) {
8893 struct pf_krule_item *ri;
8894
8895 if (s->nat_rule != NULL) {
8896 pf_counter_u64_add_protected(&s->nat_rule->packets[dirndx],
8897 1);
8898 pf_counter_u64_add_protected(&s->nat_rule->bytes[dirndx],
8899 pd->tot_len);
8900 }
8901 if (s->src_node != NULL) {
8902 counter_u64_add(s->src_node->packets[dirndx],
8903 1);
8904 counter_u64_add(s->src_node->bytes[dirndx],
8905 pd->tot_len);
8906 }
8907 if (s->nat_src_node != NULL) {
8908 counter_u64_add(s->nat_src_node->packets[dirndx],
8909 1);
8910 counter_u64_add(s->nat_src_node->bytes[dirndx],
8911 pd->tot_len);
8912 }
8913 dirndx = (dir == s->direction) ? 0 : 1;
8914 s->packets[dirndx]++;
8915 s->bytes[dirndx] += pd->tot_len;
8916
8917 SLIST_FOREACH(ri, &s->match_rules, entry) {
8918 pf_counter_u64_add_protected(&ri->r->packets[dirndx], 1);
8919 pf_counter_u64_add_protected(&ri->r->bytes[dirndx], pd->tot_len);
8920 }
8921 }
8922
8923 tr = r;
8924 if (s != NULL && s->nat_rule != NULL &&
8925 r == &V_pf_default_rule)
8926 tr = s->nat_rule;
8927
8928 if (tr->src.addr.type == PF_ADDR_TABLE)
8929 pfr_update_stats(tr->src.addr.p.tbl,
8930 (s == NULL) ? pd->src :
8931 &s->key[(s->direction == PF_IN)]->
8932 addr[(s->direction == PF_OUT)],
8933 pd->af, pd->tot_len, dir == PF_OUT,
8934 r->action == PF_PASS, tr->src.neg);
8935 if (tr->dst.addr.type == PF_ADDR_TABLE)
8936 pfr_update_stats(tr->dst.addr.p.tbl,
8937 (s == NULL) ? pd->dst :
8938 &s->key[(s->direction == PF_IN)]->
8939 addr[(s->direction == PF_IN)],
8940 pd->af, pd->tot_len, dir == PF_OUT,
8941 r->action == PF_PASS, tr->dst.neg);
8942 }
8943 pf_counter_u64_critical_exit();
8944 }
8945
8946 #if defined(INET) || defined(INET6)
8947 int
pf_test(sa_family_t af,int dir,int pflags,struct ifnet * ifp,struct mbuf ** m0,struct inpcb * inp,struct pf_rule_actions * default_actions)8948 pf_test(sa_family_t af, int dir, int pflags, struct ifnet *ifp, struct mbuf **m0,
8949 struct inpcb *inp, struct pf_rule_actions *default_actions)
8950 {
8951 struct pfi_kkif *kif;
8952 u_short action, reason = 0;
8953 struct m_tag *mtag;
8954 struct pf_krule *a = NULL, *r = &V_pf_default_rule;
8955 struct pf_kstate *s = NULL;
8956 struct pf_kruleset *ruleset = NULL;
8957 struct pf_pdesc pd;
8958 int use_2nd_queue = 0;
8959 uint16_t tag;
8960
8961 PF_RULES_RLOCK_TRACKER;
8962 KASSERT(dir == PF_IN || dir == PF_OUT, ("%s: bad direction %d\n", __func__, dir));
8963 M_ASSERTPKTHDR(*m0);
8964
8965 if (!V_pf_status.running)
8966 return (PF_PASS);
8967
8968 PF_RULES_RLOCK();
8969
8970 kif = (struct pfi_kkif *)ifp->if_pf_kif;
8971
8972 if (__predict_false(kif == NULL)) {
8973 DPFPRINTF(PF_DEBUG_URGENT,
8974 ("pf_test: kif == NULL, if_xname %s\n", ifp->if_xname));
8975 PF_RULES_RUNLOCK();
8976 return (PF_DROP);
8977 }
8978 if (kif->pfik_flags & PFI_IFLAG_SKIP) {
8979 PF_RULES_RUNLOCK();
8980 return (PF_PASS);
8981 }
8982
8983 if ((*m0)->m_flags & M_SKIP_FIREWALL) {
8984 PF_RULES_RUNLOCK();
8985 return (PF_PASS);
8986 }
8987
8988 #ifdef INET6
8989 /*
8990 * If we end up changing IP addresses (e.g. binat) the stack may get
8991 * confused and fail to send the icmp6 packet too big error. Just send
8992 * it here, before we do any NAT.
8993 */
8994 if (af == AF_INET6 && dir == PF_OUT && pflags & PFIL_FWD &&
8995 IN6_LINKMTU(ifp) < pf_max_frag_size(*m0)) {
8996 PF_RULES_RUNLOCK();
8997 icmp6_error(*m0, ICMP6_PACKET_TOO_BIG, 0, IN6_LINKMTU(ifp));
8998 *m0 = NULL;
8999 return (PF_DROP);
9000 }
9001 #endif
9002
9003 if (__predict_false(! M_WRITABLE(*m0))) {
9004 *m0 = m_unshare(*m0, M_NOWAIT);
9005 if (*m0 == NULL) {
9006 PF_RULES_RUNLOCK();
9007 return (PF_DROP);
9008 }
9009 }
9010
9011 pf_init_pdesc(&pd, *m0);
9012
9013 if (pd.pf_mtag != NULL && (pd.pf_mtag->flags & PF_MTAG_FLAG_ROUTE_TO)) {
9014 pd.pf_mtag->flags &= ~PF_MTAG_FLAG_ROUTE_TO;
9015
9016 ifp = ifnet_byindexgen(pd.pf_mtag->if_index,
9017 pd.pf_mtag->if_idxgen);
9018 if (ifp == NULL || ifp->if_flags & IFF_DYING) {
9019 PF_RULES_RUNLOCK();
9020 m_freem(*m0);
9021 *m0 = NULL;
9022 return (PF_PASS);
9023 }
9024 PF_RULES_RUNLOCK();
9025 (ifp->if_output)(ifp, *m0, sintosa(&pd.pf_mtag->dst), NULL);
9026 *m0 = NULL;
9027 return (PF_PASS);
9028 }
9029
9030 if (ip_dn_io_ptr != NULL && pd.pf_mtag != NULL &&
9031 pd.pf_mtag->flags & PF_MTAG_FLAG_DUMMYNET) {
9032 /* Dummynet re-injects packets after they've
9033 * completed their delay. We've already
9034 * processed them, so pass unconditionally. */
9035
9036 /* But only once. We may see the packet multiple times (e.g.
9037 * PFIL_IN/PFIL_OUT). */
9038 pf_dummynet_flag_remove(pd.m, pd.pf_mtag);
9039 PF_RULES_RUNLOCK();
9040
9041 return (PF_PASS);
9042 }
9043
9044 if (pf_setup_pdesc(af, dir, &pd, m0, &action, &reason,
9045 kif, default_actions) == -1) {
9046 if (action != PF_PASS)
9047 pd.act.log |= PF_LOG_FORCE;
9048 goto done;
9049 }
9050
9051 if (__predict_false(ip_divert_ptr != NULL) &&
9052 ((mtag = m_tag_locate(pd.m, MTAG_PF_DIVERT, 0, NULL)) != NULL)) {
9053 struct pf_divert_mtag *dt = (struct pf_divert_mtag *)(mtag+1);
9054 if ((dt->idir == PF_DIVERT_MTAG_DIR_IN && dir == PF_IN) ||
9055 (dt->idir == PF_DIVERT_MTAG_DIR_OUT && dir == PF_OUT)) {
9056 if (pd.pf_mtag == NULL &&
9057 ((pd.pf_mtag = pf_get_mtag(pd.m)) == NULL)) {
9058 action = PF_DROP;
9059 goto done;
9060 }
9061 pd.pf_mtag->flags |= PF_MTAG_FLAG_PACKET_LOOPED;
9062 }
9063 if (pd.pf_mtag && pd.pf_mtag->flags & PF_MTAG_FLAG_FASTFWD_OURS_PRESENT) {
9064 pd.m->m_flags |= M_FASTFWD_OURS;
9065 pd.pf_mtag->flags &= ~PF_MTAG_FLAG_FASTFWD_OURS_PRESENT;
9066 }
9067 m_tag_delete(pd.m, mtag);
9068
9069 mtag = m_tag_locate(pd.m, MTAG_IPFW_RULE, 0, NULL);
9070 if (mtag != NULL)
9071 m_tag_delete(pd.m, mtag);
9072 }
9073
9074 switch (pd.virtual_proto) {
9075 case PF_VPROTO_FRAGMENT:
9076 /*
9077 * handle fragments that aren't reassembled by
9078 * normalization
9079 */
9080 if (kif == NULL || r == NULL) /* pflog */
9081 action = PF_DROP;
9082 else
9083 action = pf_test_rule(&r, &s, &pd, &a,
9084 &ruleset, inp);
9085 if (action != PF_PASS)
9086 REASON_SET(&reason, PFRES_FRAG);
9087 break;
9088
9089 case IPPROTO_TCP: {
9090 /* Respond to SYN with a syncookie. */
9091 if ((tcp_get_flags(&pd.hdr.tcp) & (TH_SYN|TH_ACK|TH_RST)) == TH_SYN &&
9092 pd.dir == PF_IN && pf_synflood_check(&pd)) {
9093 pf_syncookie_send(&pd);
9094 action = PF_DROP;
9095 break;
9096 }
9097
9098 if ((tcp_get_flags(&pd.hdr.tcp) & TH_ACK) && pd.p_len == 0)
9099 use_2nd_queue = 1;
9100 action = pf_normalize_tcp(&pd);
9101 if (action == PF_DROP)
9102 goto done;
9103 action = pf_test_state_tcp(&s, &pd, &reason);
9104 if (action == PF_PASS) {
9105 if (V_pfsync_update_state_ptr != NULL)
9106 V_pfsync_update_state_ptr(s);
9107 r = s->rule;
9108 a = s->anchor;
9109 } else if (s == NULL) {
9110 /* Validate remote SYN|ACK, re-create original SYN if
9111 * valid. */
9112 if ((tcp_get_flags(&pd.hdr.tcp) & (TH_SYN|TH_ACK|TH_RST)) ==
9113 TH_ACK && pf_syncookie_validate(&pd) &&
9114 pd.dir == PF_IN) {
9115 struct mbuf *msyn;
9116
9117 msyn = pf_syncookie_recreate_syn(&pd);
9118 if (msyn == NULL) {
9119 action = PF_DROP;
9120 break;
9121 }
9122
9123 action = pf_test(af, dir, pflags, ifp, &msyn, inp,
9124 &pd.act);
9125 m_freem(msyn);
9126 if (action != PF_PASS)
9127 break;
9128
9129 action = pf_test_state_tcp(&s, &pd, &reason);
9130 if (action != PF_PASS || s == NULL) {
9131 action = PF_DROP;
9132 break;
9133 }
9134
9135 s->src.seqhi = ntohl(pd.hdr.tcp.th_ack) - 1;
9136 s->src.seqlo = ntohl(pd.hdr.tcp.th_seq) - 1;
9137 pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_DST);
9138 action = pf_synproxy(&pd, &s, &reason);
9139 break;
9140 } else {
9141 action = pf_test_rule(&r, &s, &pd,
9142 &a, &ruleset, inp);
9143 }
9144 }
9145 break;
9146 }
9147
9148 case IPPROTO_UDP: {
9149 action = pf_test_state_udp(&s, &pd);
9150 if (action == PF_PASS) {
9151 if (V_pfsync_update_state_ptr != NULL)
9152 V_pfsync_update_state_ptr(s);
9153 r = s->rule;
9154 a = s->anchor;
9155 } else if (s == NULL)
9156 action = pf_test_rule(&r, &s, &pd,
9157 &a, &ruleset, inp);
9158 break;
9159 }
9160
9161 case IPPROTO_SCTP: {
9162 action = pf_normalize_sctp(&pd);
9163 if (action == PF_DROP)
9164 goto done;
9165 action = pf_test_state_sctp(&s, &pd, &reason);
9166 if (action == PF_PASS) {
9167 if (V_pfsync_update_state_ptr != NULL)
9168 V_pfsync_update_state_ptr(s);
9169 r = s->rule;
9170 a = s->anchor;
9171 } else if (s == NULL) {
9172 action = pf_test_rule(&r, &s,
9173 &pd, &a, &ruleset, inp);
9174 }
9175 break;
9176 }
9177
9178 case IPPROTO_ICMP: {
9179 if (af != AF_INET) {
9180 action = PF_DROP;
9181 REASON_SET(&reason, PFRES_NORM);
9182 DPFPRINTF(PF_DEBUG_MISC,
9183 ("dropping IPv6 packet with ICMPv4 payload"));
9184 goto done;
9185 }
9186 action = pf_test_state_icmp(&s, &pd, &reason);
9187 if (action == PF_PASS) {
9188 if (V_pfsync_update_state_ptr != NULL)
9189 V_pfsync_update_state_ptr(s);
9190 r = s->rule;
9191 a = s->anchor;
9192 } else if (s == NULL)
9193 action = pf_test_rule(&r, &s, &pd,
9194 &a, &ruleset, inp);
9195 break;
9196 }
9197
9198 case IPPROTO_ICMPV6: {
9199 if (af != AF_INET6) {
9200 action = PF_DROP;
9201 REASON_SET(&reason, PFRES_NORM);
9202 DPFPRINTF(PF_DEBUG_MISC,
9203 ("pf: dropping IPv4 packet with ICMPv6 payload\n"));
9204 goto done;
9205 }
9206 action = pf_test_state_icmp(&s, &pd, &reason);
9207 if (action == PF_PASS) {
9208 if (V_pfsync_update_state_ptr != NULL)
9209 V_pfsync_update_state_ptr(s);
9210 r = s->rule;
9211 a = s->anchor;
9212 } else if (s == NULL)
9213 action = pf_test_rule(&r, &s, &pd,
9214 &a, &ruleset, inp);
9215 break;
9216 }
9217
9218 default:
9219 action = pf_test_state_other(&s, &pd);
9220 if (action == PF_PASS) {
9221 if (V_pfsync_update_state_ptr != NULL)
9222 V_pfsync_update_state_ptr(s);
9223 r = s->rule;
9224 a = s->anchor;
9225 } else if (s == NULL)
9226 action = pf_test_rule(&r, &s, &pd,
9227 &a, &ruleset, inp);
9228 break;
9229 }
9230
9231 done:
9232 PF_RULES_RUNLOCK();
9233
9234 if (pd.m == NULL)
9235 goto eat_pkt;
9236
9237 if (action == PF_PASS && pd.badopts &&
9238 !((s && s->state_flags & PFSTATE_ALLOWOPTS) || r->allow_opts)) {
9239 action = PF_DROP;
9240 REASON_SET(&reason, PFRES_IPOPTIONS);
9241 pd.act.log = PF_LOG_FORCE;
9242 DPFPRINTF(PF_DEBUG_MISC,
9243 ("pf: dropping packet with dangerous headers\n"));
9244 }
9245
9246 if (s) {
9247 uint8_t log = pd.act.log;
9248 memcpy(&pd.act, &s->act, sizeof(struct pf_rule_actions));
9249 pd.act.log |= log;
9250 tag = s->tag;
9251 } else {
9252 tag = r->tag;
9253 }
9254
9255 if (tag > 0 && pf_tag_packet(&pd, tag)) {
9256 action = PF_DROP;
9257 REASON_SET(&reason, PFRES_MEMORY);
9258 }
9259
9260 pf_scrub(&pd);
9261 if (pd.proto == IPPROTO_TCP && pd.act.max_mss)
9262 pf_normalize_mss(&pd);
9263
9264 if (pd.act.rtableid >= 0)
9265 M_SETFIB(pd.m, pd.act.rtableid);
9266
9267 if (pd.act.flags & PFSTATE_SETPRIO) {
9268 if (pd.tos & IPTOS_LOWDELAY)
9269 use_2nd_queue = 1;
9270 if (vlan_set_pcp(pd.m, pd.act.set_prio[use_2nd_queue])) {
9271 action = PF_DROP;
9272 REASON_SET(&reason, PFRES_MEMORY);
9273 pd.act.log = PF_LOG_FORCE;
9274 DPFPRINTF(PF_DEBUG_MISC,
9275 ("pf: failed to allocate 802.1q mtag\n"));
9276 }
9277 }
9278
9279 #ifdef ALTQ
9280 if (action == PF_PASS && pd.act.qid) {
9281 if (pd.pf_mtag == NULL &&
9282 ((pd.pf_mtag = pf_get_mtag(pd.m)) == NULL)) {
9283 action = PF_DROP;
9284 REASON_SET(&reason, PFRES_MEMORY);
9285 } else {
9286 if (s != NULL)
9287 pd.pf_mtag->qid_hash = pf_state_hash(s);
9288 if (use_2nd_queue || (pd.tos & IPTOS_LOWDELAY))
9289 pd.pf_mtag->qid = pd.act.pqid;
9290 else
9291 pd.pf_mtag->qid = pd.act.qid;
9292 /* Add hints for ecn. */
9293 pd.pf_mtag->hdr = mtod(pd.m, void *);
9294 }
9295 }
9296 #endif /* ALTQ */
9297
9298 /*
9299 * connections redirected to loopback should not match sockets
9300 * bound specifically to loopback due to security implications,
9301 * see tcp_input() and in_pcblookup_listen().
9302 */
9303 if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP ||
9304 pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule != NULL &&
9305 (s->nat_rule->action == PF_RDR ||
9306 s->nat_rule->action == PF_BINAT) &&
9307 pf_is_loopback(af, pd.dst))
9308 pd.m->m_flags |= M_SKIP_FIREWALL;
9309
9310 if (af == AF_INET && __predict_false(ip_divert_ptr != NULL) &&
9311 action == PF_PASS && r->divert.port && !PACKET_LOOPED(&pd)) {
9312 mtag = m_tag_alloc(MTAG_PF_DIVERT, 0,
9313 sizeof(struct pf_divert_mtag), M_NOWAIT | M_ZERO);
9314 if (mtag != NULL) {
9315 ((struct pf_divert_mtag *)(mtag+1))->port =
9316 ntohs(r->divert.port);
9317 ((struct pf_divert_mtag *)(mtag+1))->idir =
9318 (dir == PF_IN) ? PF_DIVERT_MTAG_DIR_IN :
9319 PF_DIVERT_MTAG_DIR_OUT;
9320
9321 if (s)
9322 PF_STATE_UNLOCK(s);
9323
9324 m_tag_prepend(pd.m, mtag);
9325 if (pd.m->m_flags & M_FASTFWD_OURS) {
9326 if (pd.pf_mtag == NULL &&
9327 ((pd.pf_mtag = pf_get_mtag(pd.m)) == NULL)) {
9328 action = PF_DROP;
9329 REASON_SET(&reason, PFRES_MEMORY);
9330 pd.act.log = PF_LOG_FORCE;
9331 DPFPRINTF(PF_DEBUG_MISC,
9332 ("pf: failed to allocate tag\n"));
9333 } else {
9334 pd.pf_mtag->flags |=
9335 PF_MTAG_FLAG_FASTFWD_OURS_PRESENT;
9336 pd.m->m_flags &= ~M_FASTFWD_OURS;
9337 }
9338 }
9339 ip_divert_ptr(*m0, dir == PF_IN);
9340 *m0 = NULL;
9341
9342 return (action);
9343 } else {
9344 /* XXX: ipfw has the same behaviour! */
9345 action = PF_DROP;
9346 REASON_SET(&reason, PFRES_MEMORY);
9347 pd.act.log = PF_LOG_FORCE;
9348 DPFPRINTF(PF_DEBUG_MISC,
9349 ("pf: failed to allocate divert tag\n"));
9350 }
9351 }
9352 /* XXX: Anybody working on it?! */
9353 if (af == AF_INET6 && r->divert.port)
9354 printf("pf: divert(9) is not supported for IPv6\n");
9355
9356 /* this flag will need revising if the pkt is forwarded */
9357 if (pd.pf_mtag)
9358 pd.pf_mtag->flags &= ~PF_MTAG_FLAG_PACKET_LOOPED;
9359
9360 if (pd.act.log) {
9361 struct pf_krule *lr;
9362 struct pf_krule_item *ri;
9363
9364 if (s != NULL && s->nat_rule != NULL &&
9365 s->nat_rule->log & PF_LOG_ALL)
9366 lr = s->nat_rule;
9367 else
9368 lr = r;
9369
9370 if (pd.act.log & PF_LOG_FORCE || lr->log & PF_LOG_ALL)
9371 PFLOG_PACKET(action, reason, lr, a,
9372 ruleset, &pd, (s == NULL));
9373 if (s) {
9374 SLIST_FOREACH(ri, &s->match_rules, entry)
9375 if (ri->r->log & PF_LOG_ALL)
9376 PFLOG_PACKET(action,
9377 reason, ri->r, a, ruleset, &pd, 0);
9378 }
9379 }
9380
9381 pf_counters_inc(action, &pd, s, r, a);
9382
9383 switch (action) {
9384 case PF_SYNPROXY_DROP:
9385 m_freem(*m0);
9386 case PF_DEFER:
9387 *m0 = NULL;
9388 action = PF_PASS;
9389 break;
9390 case PF_DROP:
9391 m_freem(*m0);
9392 *m0 = NULL;
9393 break;
9394 default:
9395 if (pd.act.rt) {
9396 switch (af) {
9397 #ifdef INET
9398 case AF_INET:
9399 /* pf_route() returns unlocked. */
9400 pf_route(m0, r, kif->pfik_ifp, s, &pd, inp);
9401 break;
9402 #endif
9403 #ifdef INET6
9404 case AF_INET6:
9405 /* pf_route6() returns unlocked. */
9406 pf_route6(m0, r, kif->pfik_ifp, s, &pd, inp);
9407 break;
9408 #endif
9409 }
9410 goto out;
9411 }
9412 if (pf_dummynet(&pd, s, r, m0) != 0) {
9413 action = PF_DROP;
9414 REASON_SET(&reason, PFRES_MEMORY);
9415 }
9416 break;
9417 }
9418
9419 eat_pkt:
9420 SDT_PROBE4(pf, ip, test, done, action, reason, r, s);
9421
9422 if (s && action != PF_DROP) {
9423 if (!s->if_index_in && dir == PF_IN)
9424 s->if_index_in = ifp->if_index;
9425 else if (!s->if_index_out && dir == PF_OUT)
9426 s->if_index_out = ifp->if_index;
9427 }
9428
9429 if (s)
9430 PF_STATE_UNLOCK(s);
9431
9432 out:
9433 #ifdef INET6
9434 /* If reassembled packet passed, create new fragments. */
9435 if (af == AF_INET6 && action == PF_PASS && *m0 && dir == PF_OUT &&
9436 (! (pflags & PF_PFIL_NOREFRAGMENT)) &&
9437 (mtag = m_tag_find(pd.m, PACKET_TAG_PF_REASSEMBLED, NULL)) != NULL)
9438 action = pf_refragment6(ifp, m0, mtag, NULL, pflags & PFIL_FWD);
9439 #endif
9440
9441 pf_sctp_multihome_delayed(&pd, kif, s, action);
9442
9443 return (action);
9444 }
9445 #endif /* INET || INET6 */
9446