1 /* 2 * Copyright (C) 1993-2001, 2003 by Darren Reed. 3 * 4 * See the IPFILTER.LICENCE file for details on licencing. 5 * 6 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 7 * Use is subject to license terms. 8 */ 9 10 #pragma ident "%Z%%M% %I% %E% SMI" 11 12 #if !defined(lint) 13 static const char sccsid[] = "@(#)ip_fil_solaris.c 1.7 07/22/06 (C) 1993-2000 Darren Reed"; 14 static const char rcsid[] = "@(#)$Id: ip_fil_solaris.c,v 2.62.2.19 2005/07/13 21:40:46 darrenr Exp $"; 15 #endif 16 17 #include <sys/types.h> 18 #include <sys/errno.h> 19 #include <sys/param.h> 20 #include <sys/cpuvar.h> 21 #include <sys/open.h> 22 #include <sys/ioctl.h> 23 #include <sys/filio.h> 24 #include <sys/systm.h> 25 #include <sys/strsubr.h> 26 #include <sys/cred.h> 27 #include <sys/cred_impl.h> 28 #include <sys/ddi.h> 29 #include <sys/sunddi.h> 30 #include <sys/ksynch.h> 31 #include <sys/kmem.h> 32 #include <sys/mkdev.h> 33 #include <sys/protosw.h> 34 #include <sys/socket.h> 35 #include <sys/dditypes.h> 36 #include <sys/cmn_err.h> 37 #include <sys/zone.h> 38 #include <net/if.h> 39 #include <net/af.h> 40 #include <net/route.h> 41 #include <netinet/in.h> 42 #include <netinet/in_systm.h> 43 #include <netinet/ip.h> 44 #include <netinet/ip_var.h> 45 #include <netinet/tcp.h> 46 #include <netinet/udp.h> 47 #include <netinet/tcpip.h> 48 #include <netinet/ip_icmp.h> 49 #include "netinet/ip_compat.h" 50 #ifdef USE_INET6 51 # include <netinet/icmp6.h> 52 #endif 53 #include "netinet/ip_fil.h" 54 #include "netinet/ip_nat.h" 55 #include "netinet/ip_frag.h" 56 #include "netinet/ip_state.h" 57 #include "netinet/ip_auth.h" 58 #include "netinet/ip_proxy.h" 59 #include "netinet/ipf_stack.h" 60 #ifdef IPFILTER_LOOKUP 61 # include "netinet/ip_lookup.h" 62 #endif 63 #include <inet/ip_ire.h> 64 65 #include <sys/md5.h> 66 #include <sys/neti.h> 67 68 static int frzerostats __P((caddr_t, ipf_stack_t *)); 69 static int fr_setipfloopback __P((int, ipf_stack_t *)); 70 static int fr_send_ip __P((fr_info_t *fin, mblk_t *m, mblk_t **mp)); 71 static int ipf_nic_event_v4 __P((hook_event_token_t, hook_data_t, 72 netstack_t *)); 73 static int ipf_nic_event_v6 __P((hook_event_token_t, hook_data_t, 74 netstack_t *)); 75 static int ipf_hook_out __P((hook_event_token_t, hook_data_t, 76 netstack_t *)); 77 static int ipf_hook_in __P((hook_event_token_t, hook_data_t, 78 netstack_t *)); 79 static int ipf_hook_loop_out __P((hook_event_token_t, hook_data_t, 80 netstack_t *)); 81 static int ipf_hook_loop_in __P((hook_event_token_t, hook_data_t, 82 netstack_t *)); 83 static int ipf_hook __P((hook_data_t, int, int, netstack_t *)); 84 extern int ipf_geniter __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *)); 85 extern int ipf_frruleiter __P((void *, int, void *, ipf_stack_t *)); 86 87 #if SOLARIS2 < 10 88 #if SOLARIS2 >= 7 89 u_int *ip_ttl_ptr = NULL; 90 u_int *ip_mtudisc = NULL; 91 # if SOLARIS2 >= 8 92 int *ip_forwarding = NULL; 93 u_int *ip6_forwarding = NULL; 94 # else 95 u_int *ip_forwarding = NULL; 96 # endif 97 #else 98 u_long *ip_ttl_ptr = NULL; 99 u_long *ip_mtudisc = NULL; 100 u_long *ip_forwarding = NULL; 101 #endif 102 #endif 103 104 105 /* ------------------------------------------------------------------------ */ 106 /* Function: ipldetach */ 107 /* Returns: int - 0 == success, else error. */ 108 /* Parameters: Nil */ 109 /* */ 110 /* This function is responsible for undoing anything that might have been */ 111 /* done in a call to iplattach(). It must be able to clean up from a call */ 112 /* to iplattach() that did not succeed. Why might that happen? Someone */ 113 /* configures a table to be so large that we cannot allocate enough memory */ 114 /* for it. */ 115 /* ------------------------------------------------------------------------ */ 116 int ipldetach(ifs) 117 ipf_stack_t *ifs; 118 { 119 120 ASSERT(rw_read_locked(&ifs->ifs_ipf_global.ipf_lk) == 0); 121 122 #if SOLARIS2 < 10 123 124 if (ifs->ifs_fr_control_forwarding & 2) { 125 if (ip_forwarding != NULL) 126 *ip_forwarding = 0; 127 #if SOLARIS2 >= 8 128 if (ip6_forwarding != NULL) 129 *ip6_forwarding = 0; 130 #endif 131 } 132 #endif 133 134 /* 135 * This lock needs to be dropped around the net_unregister_hook calls 136 * because we can deadlock here with: 137 * W(ipf_global)->R(hook_family)->W(hei_lock) (this code path) vs 138 * R(hook_family)->R(hei_lock)->R(ipf_global) (active hook running) 139 */ 140 RWLOCK_EXIT(&ifs->ifs_ipf_global); 141 142 /* 143 * Remove IPv6 Hooks 144 */ 145 if (ifs->ifs_ipf_ipv6 != NULL) { 146 if (ifs->ifs_hook6_physical_in) { 147 ifs->ifs_hook6_physical_in = (net_unregister_hook(ifs->ifs_ipf_ipv6, 148 NH_PHYSICAL_IN, &ifs->ifs_ipfhook_in) != 0); 149 } 150 if (ifs->ifs_hook6_physical_out) { 151 ifs->ifs_hook6_physical_out = 152 (net_unregister_hook(ifs->ifs_ipf_ipv6, 153 NH_PHYSICAL_OUT, &ifs->ifs_ipfhook_out) != 0); 154 } 155 if (ifs->ifs_hook6_nic_events) { 156 ifs->ifs_hook6_nic_events = 157 (net_unregister_hook(ifs->ifs_ipf_ipv6, 158 NH_NIC_EVENTS, &ifs->ifs_ipfhook_nicevents) != 0); 159 } 160 if (ifs->ifs_hook6_loopback_in) { 161 ifs->ifs_hook6_loopback_in = 162 (net_unregister_hook(ifs->ifs_ipf_ipv6, 163 NH_LOOPBACK_IN, &ifs->ifs_ipfhook_loop_in) != 0); 164 } 165 if (ifs->ifs_hook6_loopback_out) { 166 ifs->ifs_hook6_loopback_out = 167 (net_unregister_hook(ifs->ifs_ipf_ipv6, 168 NH_LOOPBACK_OUT, &ifs->ifs_ipfhook_loop_out) != 0); 169 } 170 171 if (net_release(ifs->ifs_ipf_ipv6) != 0) 172 goto detach_failed; 173 ifs->ifs_ipf_ipv6 = NULL; 174 } 175 176 /* 177 * Remove IPv4 Hooks 178 */ 179 if (ifs->ifs_ipf_ipv4 != NULL) { 180 if (ifs->ifs_hook4_physical_in) { 181 ifs->ifs_hook4_physical_in = 182 (net_unregister_hook(ifs->ifs_ipf_ipv4, 183 NH_PHYSICAL_IN, &ifs->ifs_ipfhook_in) != 0); 184 } 185 if (ifs->ifs_hook4_physical_out) { 186 ifs->ifs_hook4_physical_out = 187 (net_unregister_hook(ifs->ifs_ipf_ipv4, 188 NH_PHYSICAL_OUT, &ifs->ifs_ipfhook_out) != 0); 189 } 190 if (ifs->ifs_hook4_nic_events) { 191 ifs->ifs_hook4_nic_events = 192 (net_unregister_hook(ifs->ifs_ipf_ipv4, 193 NH_NIC_EVENTS, &ifs->ifs_ipfhook_nicevents) != 0); 194 } 195 if (ifs->ifs_hook4_loopback_in) { 196 ifs->ifs_hook4_loopback_in = 197 (net_unregister_hook(ifs->ifs_ipf_ipv4, 198 NH_LOOPBACK_IN, &ifs->ifs_ipfhook_loop_in) != 0); 199 } 200 if (ifs->ifs_hook4_loopback_out) { 201 ifs->ifs_hook4_loopback_out = 202 (net_unregister_hook(ifs->ifs_ipf_ipv4, 203 NH_LOOPBACK_OUT, &ifs->ifs_ipfhook_loop_out) != 0); 204 } 205 206 if (net_release(ifs->ifs_ipf_ipv4) != 0) 207 goto detach_failed; 208 ifs->ifs_ipf_ipv4 = NULL; 209 } 210 211 #ifdef IPFDEBUG 212 cmn_err(CE_CONT, "ipldetach()\n"); 213 #endif 214 215 WRITE_ENTER(&ifs->ifs_ipf_global); 216 fr_deinitialise(ifs); 217 218 (void) frflush(IPL_LOGIPF, 0, FR_INQUE|FR_OUTQUE|FR_INACTIVE, ifs); 219 (void) frflush(IPL_LOGIPF, 0, FR_INQUE|FR_OUTQUE, ifs); 220 221 if (ifs->ifs_ipf_locks_done == 1) { 222 MUTEX_DESTROY(&ifs->ifs_ipf_timeoutlock); 223 MUTEX_DESTROY(&ifs->ifs_ipf_rw); 224 RW_DESTROY(&ifs->ifs_ipf_tokens); 225 RW_DESTROY(&ifs->ifs_ipf_ipidfrag); 226 ifs->ifs_ipf_locks_done = 0; 227 } 228 229 if (ifs->ifs_hook4_physical_in || ifs->ifs_hook4_physical_out || ifs->ifs_hook4_nic_events || 230 ifs->ifs_hook4_loopback_in || ifs->ifs_hook4_loopback_out || ifs->ifs_hook6_nic_events || 231 ifs->ifs_hook6_physical_in || ifs->ifs_hook6_physical_out || ifs->ifs_hook6_loopback_in || 232 ifs->ifs_hook6_loopback_out) 233 return -1; 234 235 return 0; 236 237 detach_failed: 238 WRITE_ENTER(&ifs->ifs_ipf_global); 239 return -1; 240 } 241 242 int iplattach(ifs, ns) 243 ipf_stack_t *ifs; 244 netstack_t *ns; 245 { 246 #if SOLARIS2 < 10 247 int i; 248 #endif 249 250 #ifdef IPFDEBUG 251 cmn_err(CE_CONT, "iplattach()\n"); 252 #endif 253 254 ASSERT(rw_read_locked(&ifs->ifs_ipf_global.ipf_lk) == 0); 255 ifs->ifs_fr_flags = IPF_LOGGING; 256 #ifdef _KERNEL 257 ifs->ifs_fr_update_ipid = 0; 258 #else 259 ifs->ifs_fr_update_ipid = 1; 260 #endif 261 ifs->ifs_fr_minttl = 4; 262 ifs->ifs_fr_icmpminfragmtu = 68; 263 #if defined(IPFILTER_DEFAULT_BLOCK) 264 ifs->ifs_fr_pass = FR_BLOCK|FR_NOMATCH; 265 #else 266 ifs->ifs_fr_pass = (IPF_DEFAULT_PASS)|FR_NOMATCH; 267 #endif 268 ifs->ifs_ipf_loopback = 0; 269 270 bzero((char *)ifs->ifs_frcache, sizeof(ifs->ifs_frcache)); 271 MUTEX_INIT(&ifs->ifs_ipf_rw, "ipf rw mutex"); 272 MUTEX_INIT(&ifs->ifs_ipf_timeoutlock, "ipf timeout lock mutex"); 273 RWLOCK_INIT(&ifs->ifs_ipf_ipidfrag, "ipf IP NAT-Frag rwlock"); 274 RWLOCK_INIT(&ifs->ifs_ipf_tokens, "ipf token rwlock"); 275 ifs->ifs_ipf_locks_done = 1; 276 277 if (fr_initialise(ifs) < 0) 278 return -1; 279 280 HOOK_INIT(&ifs->ifs_ipfhook_nicevents, ipf_nic_event_v4, 281 "ipfilter_hook_nicevents"); 282 HOOK_INIT(&ifs->ifs_ipfhook_in, ipf_hook_in, "ipfilter_hook_in"); 283 HOOK_INIT(&ifs->ifs_ipfhook_out, ipf_hook_out, "ipfilter_hook_out"); 284 HOOK_INIT(&ifs->ifs_ipfhook_loop_in, ipf_hook_in, 285 "ipfilter_hook_loop_in"); 286 HOOK_INIT(&ifs->ifs_ipfhook_loop_out, ipf_hook_out, 287 "ipfilter_hook_loop_out"); 288 289 /* 290 * If we hold this lock over all of the net_register_hook calls, we 291 * can cause a deadlock to occur with the following lock ordering: 292 * W(ipf_global)->R(hook_family)->W(hei_lock) (this code path) vs 293 * R(hook_family)->R(hei_lock)->R(ipf_global) (packet path) 294 */ 295 RWLOCK_EXIT(&ifs->ifs_ipf_global); 296 297 /* 298 * Add IPv4 hooks 299 */ 300 ifs->ifs_ipf_ipv4 = net_lookup_impl(NHF_INET, ns); 301 if (ifs->ifs_ipf_ipv4 == NULL) 302 goto hookup_failed; 303 304 ifs->ifs_hook4_nic_events = (net_register_hook(ifs->ifs_ipf_ipv4, 305 NH_NIC_EVENTS, &ifs->ifs_ipfhook_nicevents) == 0); 306 if (!ifs->ifs_hook4_nic_events) 307 goto hookup_failed; 308 309 ifs->ifs_hook4_physical_in = (net_register_hook(ifs->ifs_ipf_ipv4, 310 NH_PHYSICAL_IN, &ifs->ifs_ipfhook_in) == 0); 311 if (!ifs->ifs_hook4_physical_in) 312 goto hookup_failed; 313 314 ifs->ifs_hook4_physical_out = (net_register_hook(ifs->ifs_ipf_ipv4, 315 NH_PHYSICAL_OUT, &ifs->ifs_ipfhook_out) == 0); 316 if (!ifs->ifs_hook4_physical_out) 317 goto hookup_failed; 318 319 if (ifs->ifs_ipf_loopback) { 320 ifs->ifs_hook4_loopback_in = 321 (net_register_hook(ifs->ifs_ipf_ipv4, 322 NH_LOOPBACK_IN, &ifs->ifs_ipfhook_loop_in) == 0); 323 if (!ifs->ifs_hook4_loopback_in) 324 goto hookup_failed; 325 326 ifs->ifs_hook4_loopback_out = 327 (net_register_hook(ifs->ifs_ipf_ipv4, 328 NH_LOOPBACK_OUT, &ifs->ifs_ipfhook_loop_out) == 0); 329 if (!ifs->ifs_hook4_loopback_out) 330 goto hookup_failed; 331 } 332 /* 333 * Add IPv6 hooks 334 */ 335 ifs->ifs_ipf_ipv6 = net_lookup_impl(NHF_INET6, ns); 336 if (ifs->ifs_ipf_ipv6 == NULL) 337 goto hookup_failed; 338 339 HOOK_INIT(&ifs->ifs_ipfhook_nicevents, ipf_nic_event_v6, 340 "ipfilter_hook_nicevents"); 341 ifs->ifs_hook6_nic_events = (net_register_hook(ifs->ifs_ipf_ipv6, 342 NH_NIC_EVENTS, &ifs->ifs_ipfhook_nicevents) == 0); 343 if (!ifs->ifs_hook6_nic_events) 344 goto hookup_failed; 345 346 ifs->ifs_hook6_physical_in = (net_register_hook(ifs->ifs_ipf_ipv6, 347 NH_PHYSICAL_IN, &ifs->ifs_ipfhook_in) == 0); 348 if (!ifs->ifs_hook6_physical_in) 349 goto hookup_failed; 350 351 ifs->ifs_hook6_physical_out = (net_register_hook(ifs->ifs_ipf_ipv6, 352 NH_PHYSICAL_OUT, &ifs->ifs_ipfhook_out) == 0); 353 if (!ifs->ifs_hook6_physical_out) 354 goto hookup_failed; 355 356 if (ifs->ifs_ipf_loopback) { 357 ifs->ifs_hook6_loopback_in = 358 (net_register_hook(ifs->ifs_ipf_ipv6, 359 NH_LOOPBACK_IN, &ifs->ifs_ipfhook_loop_in) == 0); 360 if (!ifs->ifs_hook6_loopback_in) 361 goto hookup_failed; 362 363 ifs->ifs_hook6_loopback_out = 364 (net_register_hook(ifs->ifs_ipf_ipv6, 365 NH_LOOPBACK_OUT, &ifs->ifs_ipfhook_loop_out) == 0); 366 if (!ifs->ifs_hook6_loopback_out) 367 goto hookup_failed; 368 } 369 370 /* 371 * Reacquire ipf_global, now it is safe. 372 */ 373 WRITE_ENTER(&ifs->ifs_ipf_global); 374 375 /* Do not use private interface ip_params_arr[] in Solaris 10 */ 376 #if SOLARIS2 < 10 377 378 #if SOLARIS2 >= 8 379 ip_forwarding = &ip_g_forward; 380 #endif 381 /* 382 * XXX - There is no terminator for this array, so it is not possible 383 * to tell if what we are looking for is missing and go off the end 384 * of the array. 385 */ 386 387 #if SOLARIS2 <= 8 388 for (i = 0; ; i++) { 389 if (!strcmp(ip_param_arr[i].ip_param_name, "ip_def_ttl")) { 390 ip_ttl_ptr = &ip_param_arr[i].ip_param_value; 391 } else if (!strcmp(ip_param_arr[i].ip_param_name, 392 "ip_path_mtu_discovery")) { 393 ip_mtudisc = &ip_param_arr[i].ip_param_value; 394 } 395 #if SOLARIS2 < 8 396 else if (!strcmp(ip_param_arr[i].ip_param_name, 397 "ip_forwarding")) { 398 ip_forwarding = &ip_param_arr[i].ip_param_value; 399 } 400 #else 401 else if (!strcmp(ip_param_arr[i].ip_param_name, 402 "ip6_forwarding")) { 403 ip6_forwarding = &ip_param_arr[i].ip_param_value; 404 } 405 #endif 406 407 if (ip_mtudisc != NULL && ip_ttl_ptr != NULL && 408 #if SOLARIS2 >= 8 409 ip6_forwarding != NULL && 410 #endif 411 ip_forwarding != NULL) 412 break; 413 } 414 #endif 415 416 if (ifs->ifs_fr_control_forwarding & 1) { 417 if (ip_forwarding != NULL) 418 *ip_forwarding = 1; 419 #if SOLARIS2 >= 8 420 if (ip6_forwarding != NULL) 421 *ip6_forwarding = 1; 422 #endif 423 } 424 425 #endif 426 427 return 0; 428 hookup_failed: 429 WRITE_ENTER(&ifs->ifs_ipf_global); 430 return -1; 431 } 432 433 static int fr_setipfloopback(set, ifs) 434 int set; 435 ipf_stack_t *ifs; 436 { 437 if (ifs->ifs_ipf_ipv4 == NULL || ifs->ifs_ipf_ipv6 == NULL) 438 return EFAULT; 439 440 if (set && !ifs->ifs_ipf_loopback) { 441 ifs->ifs_ipf_loopback = 1; 442 443 ifs->ifs_hook4_loopback_in = 444 (net_register_hook(ifs->ifs_ipf_ipv4, 445 NH_LOOPBACK_IN, &ifs->ifs_ipfhook_loop_in) == 0); 446 if (!ifs->ifs_hook4_loopback_in) 447 return EINVAL; 448 449 ifs->ifs_hook4_loopback_out = 450 (net_register_hook(ifs->ifs_ipf_ipv4, 451 NH_LOOPBACK_OUT, &ifs->ifs_ipfhook_loop_out) == 0); 452 if (!ifs->ifs_hook4_loopback_out) 453 return EINVAL; 454 455 ifs->ifs_hook6_loopback_in = 456 (net_register_hook(ifs->ifs_ipf_ipv6, 457 NH_LOOPBACK_IN, &ifs->ifs_ipfhook_loop_in) == 0); 458 if (!ifs->ifs_hook6_loopback_in) 459 return EINVAL; 460 461 ifs->ifs_hook6_loopback_out = 462 (net_register_hook(ifs->ifs_ipf_ipv6, 463 NH_LOOPBACK_OUT, &ifs->ifs_ipfhook_loop_out) == 0); 464 if (!ifs->ifs_hook6_loopback_out) 465 return EINVAL; 466 467 } else if (!set && ifs->ifs_ipf_loopback) { 468 ifs->ifs_ipf_loopback = 0; 469 470 ifs->ifs_hook4_loopback_in = 471 (net_unregister_hook(ifs->ifs_ipf_ipv4, 472 NH_LOOPBACK_IN, &ifs->ifs_ipfhook_loop_in) != 0); 473 if (ifs->ifs_hook4_loopback_in) 474 return EBUSY; 475 476 ifs->ifs_hook4_loopback_out = 477 (net_unregister_hook(ifs->ifs_ipf_ipv4, 478 NH_LOOPBACK_OUT, &ifs->ifs_ipfhook_loop_out) != 0); 479 if (ifs->ifs_hook4_loopback_out) 480 return EBUSY; 481 482 ifs->ifs_hook6_loopback_in = 483 (net_unregister_hook(ifs->ifs_ipf_ipv6, 484 NH_LOOPBACK_IN, &ifs->ifs_ipfhook_loop_in) != 0); 485 if (ifs->ifs_hook6_loopback_in) 486 return EBUSY; 487 488 ifs->ifs_hook6_loopback_out = 489 (net_unregister_hook(ifs->ifs_ipf_ipv6, 490 NH_LOOPBACK_OUT, &ifs->ifs_ipfhook_loop_out) != 0); 491 if (ifs->ifs_hook6_loopback_out) 492 return EBUSY; 493 } 494 return 0; 495 } 496 497 498 /* 499 * Filter ioctl interface. 500 */ 501 /*ARGSUSED*/ 502 int iplioctl(dev, cmd, data, mode, cp, rp) 503 dev_t dev; 504 int cmd; 505 #if SOLARIS2 >= 7 506 intptr_t data; 507 #else 508 int *data; 509 #endif 510 int mode; 511 cred_t *cp; 512 int *rp; 513 { 514 int error = 0, tmp; 515 friostat_t fio; 516 minor_t unit; 517 u_int enable; 518 netstack_t *ns; 519 ipf_stack_t *ifs; 520 521 #ifdef IPFDEBUG 522 cmn_err(CE_CONT, "iplioctl(%x,%x,%x,%d,%x,%d)\n", 523 dev, cmd, data, mode, cp, rp); 524 #endif 525 unit = getminor(dev); 526 if (IPL_LOGMAX < unit) 527 return ENXIO; 528 529 ns = netstack_find_by_cred(cp); 530 ASSERT(ns != NULL); 531 ifs = ns->netstack_ipf; 532 ASSERT(ifs != NULL); 533 534 if (ifs->ifs_fr_running <= 0) { 535 if (unit != IPL_LOGIPF) { 536 netstack_rele(ifs->ifs_netstack); 537 return EIO; 538 } 539 if (cmd != SIOCIPFGETNEXT && cmd != SIOCIPFGET && 540 cmd != SIOCIPFSET && cmd != SIOCFRENB && 541 cmd != SIOCGETFS && cmd != SIOCGETFF) { 542 netstack_rele(ifs->ifs_netstack); 543 return EIO; 544 } 545 } 546 547 READ_ENTER(&ifs->ifs_ipf_global); 548 549 error = fr_ioctlswitch(unit, (caddr_t)data, cmd, mode, cp->cr_uid, curproc, ifs); 550 if (error != -1) { 551 RWLOCK_EXIT(&ifs->ifs_ipf_global); 552 netstack_rele(ifs->ifs_netstack); 553 return error; 554 } 555 error = 0; 556 557 switch (cmd) 558 { 559 case SIOCFRENB : 560 if (!(mode & FWRITE)) 561 error = EPERM; 562 else { 563 error = COPYIN((caddr_t)data, (caddr_t)&enable, 564 sizeof(enable)); 565 if (error != 0) { 566 error = EFAULT; 567 break; 568 } 569 570 RWLOCK_EXIT(&ifs->ifs_ipf_global); 571 WRITE_ENTER(&ifs->ifs_ipf_global); 572 if (enable) { 573 if (ifs->ifs_fr_running > 0) 574 error = 0; 575 else 576 error = iplattach(ifs, ns); 577 if (error == 0) 578 ifs->ifs_fr_running = 1; 579 else 580 (void) ipldetach(ifs); 581 } else { 582 error = ipldetach(ifs); 583 if (error == 0) 584 ifs->ifs_fr_running = -1; 585 } 586 } 587 break; 588 case SIOCIPFSET : 589 if (!(mode & FWRITE)) { 590 error = EPERM; 591 break; 592 } 593 /* FALLTHRU */ 594 case SIOCIPFGETNEXT : 595 case SIOCIPFGET : 596 error = fr_ipftune(cmd, (void *)data, ifs); 597 break; 598 case SIOCSETFF : 599 if (!(mode & FWRITE)) 600 error = EPERM; 601 else { 602 error = COPYIN((caddr_t)data, (caddr_t)&ifs->ifs_fr_flags, 603 sizeof(ifs->ifs_fr_flags)); 604 if (error != 0) 605 error = EFAULT; 606 } 607 break; 608 case SIOCIPFLP : 609 error = COPYIN((caddr_t)data, (caddr_t)&tmp, 610 sizeof(tmp)); 611 if (error != 0) 612 error = EFAULT; 613 else 614 error = fr_setipfloopback(tmp, ifs); 615 break; 616 case SIOCGETFF : 617 error = COPYOUT((caddr_t)&ifs->ifs_fr_flags, (caddr_t)data, 618 sizeof(ifs->ifs_fr_flags)); 619 if (error != 0) 620 error = EFAULT; 621 break; 622 case SIOCFUNCL : 623 error = fr_resolvefunc((void *)data); 624 break; 625 case SIOCINAFR : 626 case SIOCRMAFR : 627 case SIOCADAFR : 628 case SIOCZRLST : 629 if (!(mode & FWRITE)) 630 error = EPERM; 631 else 632 error = frrequest(unit, cmd, (caddr_t)data, 633 ifs->ifs_fr_active, 1, ifs); 634 break; 635 case SIOCINIFR : 636 case SIOCRMIFR : 637 case SIOCADIFR : 638 if (!(mode & FWRITE)) 639 error = EPERM; 640 else 641 error = frrequest(unit, cmd, (caddr_t)data, 642 1 - ifs->ifs_fr_active, 1, ifs); 643 break; 644 case SIOCSWAPA : 645 if (!(mode & FWRITE)) 646 error = EPERM; 647 else { 648 WRITE_ENTER(&ifs->ifs_ipf_mutex); 649 /* Clear one fourth of the table */ 650 bzero((char *)&ifs->ifs_frcache, 651 sizeof (ifs->ifs_frcache[0]) * 2); 652 error = COPYOUT((caddr_t)&ifs->ifs_fr_active, 653 (caddr_t)data, 654 sizeof(ifs->ifs_fr_active)); 655 if (error != 0) 656 error = EFAULT; 657 else 658 ifs->ifs_fr_active = 1 - ifs->ifs_fr_active; 659 RWLOCK_EXIT(&ifs->ifs_ipf_mutex); 660 } 661 break; 662 case SIOCGETFS : 663 fr_getstat(&fio, ifs); 664 error = fr_outobj((void *)data, &fio, IPFOBJ_IPFSTAT); 665 break; 666 case SIOCFRZST : 667 if (!(mode & FWRITE)) 668 error = EPERM; 669 else 670 error = fr_zerostats((caddr_t)data, ifs); 671 break; 672 case SIOCIPFFL : 673 if (!(mode & FWRITE)) 674 error = EPERM; 675 else { 676 error = COPYIN((caddr_t)data, (caddr_t)&tmp, 677 sizeof(tmp)); 678 if (!error) { 679 tmp = frflush(unit, 4, tmp, ifs); 680 error = COPYOUT((caddr_t)&tmp, (caddr_t)data, 681 sizeof(tmp)); 682 if (error != 0) 683 error = EFAULT; 684 } else 685 error = EFAULT; 686 } 687 break; 688 #ifdef USE_INET6 689 case SIOCIPFL6 : 690 if (!(mode & FWRITE)) 691 error = EPERM; 692 else { 693 error = COPYIN((caddr_t)data, (caddr_t)&tmp, 694 sizeof(tmp)); 695 if (!error) { 696 tmp = frflush(unit, 6, tmp, ifs); 697 error = COPYOUT((caddr_t)&tmp, (caddr_t)data, 698 sizeof(tmp)); 699 if (error != 0) 700 error = EFAULT; 701 } else 702 error = EFAULT; 703 } 704 break; 705 #endif 706 case SIOCSTLCK : 707 error = COPYIN((caddr_t)data, (caddr_t)&tmp, sizeof(tmp)); 708 if (error == 0) { 709 ifs->ifs_fr_state_lock = tmp; 710 ifs->ifs_fr_nat_lock = tmp; 711 ifs->ifs_fr_frag_lock = tmp; 712 ifs->ifs_fr_auth_lock = tmp; 713 } else 714 error = EFAULT; 715 break; 716 #ifdef IPFILTER_LOG 717 case SIOCIPFFB : 718 if (!(mode & FWRITE)) 719 error = EPERM; 720 else { 721 tmp = ipflog_clear(unit, ifs); 722 error = COPYOUT((caddr_t)&tmp, (caddr_t)data, 723 sizeof(tmp)); 724 if (error) 725 error = EFAULT; 726 } 727 break; 728 #endif /* IPFILTER_LOG */ 729 case SIOCFRSYN : 730 if (!(mode & FWRITE)) 731 error = EPERM; 732 else { 733 RWLOCK_EXIT(&ifs->ifs_ipf_global); 734 WRITE_ENTER(&ifs->ifs_ipf_global); 735 736 frsync(IPFSYNC_RESYNC, 0, NULL, NULL, ifs); 737 fr_natifpsync(IPFSYNC_RESYNC, NULL, NULL, ifs); 738 fr_nataddrsync(NULL, NULL, ifs); 739 fr_statesync(IPFSYNC_RESYNC, 0, NULL, NULL, ifs); 740 error = 0; 741 } 742 break; 743 case SIOCGFRST : 744 error = fr_outobj((void *)data, fr_fragstats(ifs), 745 IPFOBJ_FRAGSTAT); 746 break; 747 case FIONREAD : 748 #ifdef IPFILTER_LOG 749 tmp = (int)ifs->ifs_iplused[IPL_LOGIPF]; 750 751 error = COPYOUT((caddr_t)&tmp, (caddr_t)data, sizeof(tmp)); 752 if (error != 0) 753 error = EFAULT; 754 #endif 755 break; 756 case SIOCIPFITER : 757 error = ipf_frruleiter((caddr_t)data, cp->cr_uid, curproc, ifs); 758 break; 759 760 case SIOCGENITER : 761 error = ipf_genericiter((caddr_t)data, cp->cr_uid, curproc, ifs); 762 break; 763 764 case SIOCIPFDELTOK : 765 (void)BCOPYIN((caddr_t)data, (caddr_t)&tmp, sizeof(tmp)); 766 error = ipf_deltoken(tmp, cp->cr_uid, curproc, ifs); 767 break; 768 769 default : 770 cmn_err(CE_NOTE, "Unknown: cmd 0x%x data %p", cmd, (void *)data); 771 error = EINVAL; 772 break; 773 } 774 RWLOCK_EXIT(&ifs->ifs_ipf_global); 775 netstack_rele(ifs->ifs_netstack); 776 return error; 777 } 778 779 780 phy_if_t get_unit(name, v, ifs) 781 char *name; 782 int v; 783 ipf_stack_t *ifs; 784 { 785 net_data_t nif; 786 787 if (v == 4) 788 nif = ifs->ifs_ipf_ipv4; 789 else if (v == 6) 790 nif = ifs->ifs_ipf_ipv6; 791 else 792 return 0; 793 794 nif->netd_netstack = ifs->ifs_netstack; 795 796 return (net_phylookup(nif, name)); 797 } 798 799 /* 800 * routines below for saving IP headers to buffer 801 */ 802 /*ARGSUSED*/ 803 int iplopen(devp, flags, otype, cred) 804 dev_t *devp; 805 int flags, otype; 806 cred_t *cred; 807 { 808 minor_t min = getminor(*devp); 809 810 #ifdef IPFDEBUG 811 cmn_err(CE_CONT, "iplopen(%x,%x,%x,%x)\n", devp, flags, otype, cred); 812 #endif 813 if (!(otype & OTYP_CHR)) 814 return ENXIO; 815 816 min = (IPL_LOGMAX < min) ? ENXIO : 0; 817 return min; 818 } 819 820 821 /*ARGSUSED*/ 822 int iplclose(dev, flags, otype, cred) 823 dev_t dev; 824 int flags, otype; 825 cred_t *cred; 826 { 827 minor_t min = getminor(dev); 828 829 #ifdef IPFDEBUG 830 cmn_err(CE_CONT, "iplclose(%x,%x,%x,%x)\n", dev, flags, otype, cred); 831 #endif 832 833 min = (IPL_LOGMAX < min) ? ENXIO : 0; 834 return min; 835 } 836 837 #ifdef IPFILTER_LOG 838 /* 839 * iplread/ipllog 840 * both of these must operate with at least splnet() lest they be 841 * called during packet processing and cause an inconsistancy to appear in 842 * the filter lists. 843 */ 844 /*ARGSUSED*/ 845 int iplread(dev, uio, cp) 846 dev_t dev; 847 register struct uio *uio; 848 cred_t *cp; 849 { 850 netstack_t *ns; 851 ipf_stack_t *ifs; 852 int ret; 853 854 ns = netstack_find_by_cred(cp); 855 ASSERT(ns != NULL); 856 ifs = ns->netstack_ipf; 857 ASSERT(ifs != NULL); 858 859 # ifdef IPFDEBUG 860 cmn_err(CE_CONT, "iplread(%x,%x,%x)\n", dev, uio, cp); 861 # endif 862 863 if (ifs->ifs_fr_running < 1) { 864 netstack_rele(ifs->ifs_netstack); 865 return EIO; 866 } 867 868 # ifdef IPFILTER_SYNC 869 if (getminor(dev) == IPL_LOGSYNC) { 870 netstack_rele(ifs->ifs_netstack); 871 return ipfsync_read(uio); 872 } 873 # endif 874 875 ret = ipflog_read(getminor(dev), uio, ifs); 876 netstack_rele(ifs->ifs_netstack); 877 return ret; 878 } 879 #endif /* IPFILTER_LOG */ 880 881 882 /* 883 * iplread/ipllog 884 * both of these must operate with at least splnet() lest they be 885 * called during packet processing and cause an inconsistancy to appear in 886 * the filter lists. 887 */ 888 int iplwrite(dev, uio, cp) 889 dev_t dev; 890 register struct uio *uio; 891 cred_t *cp; 892 { 893 netstack_t *ns; 894 ipf_stack_t *ifs; 895 896 ns = netstack_find_by_cred(cp); 897 ASSERT(ns != NULL); 898 ifs = ns->netstack_ipf; 899 ASSERT(ifs != NULL); 900 901 #ifdef IPFDEBUG 902 cmn_err(CE_CONT, "iplwrite(%x,%x,%x)\n", dev, uio, cp); 903 #endif 904 905 if (ifs->ifs_fr_running < 1) { 906 netstack_rele(ifs->ifs_netstack); 907 return EIO; 908 } 909 910 #ifdef IPFILTER_SYNC 911 if (getminor(dev) == IPL_LOGSYNC) 912 return ipfsync_write(uio); 913 #endif /* IPFILTER_SYNC */ 914 dev = dev; /* LINT */ 915 uio = uio; /* LINT */ 916 cp = cp; /* LINT */ 917 netstack_rele(ifs->ifs_netstack); 918 return ENXIO; 919 } 920 921 922 /* 923 * fr_send_reset - this could conceivably be a call to tcp_respond(), but that 924 * requires a large amount of setting up and isn't any more efficient. 925 */ 926 int fr_send_reset(fin) 927 fr_info_t *fin; 928 { 929 tcphdr_t *tcp, *tcp2; 930 int tlen, hlen; 931 mblk_t *m; 932 #ifdef USE_INET6 933 ip6_t *ip6; 934 #endif 935 ip_t *ip; 936 937 tcp = fin->fin_dp; 938 if (tcp->th_flags & TH_RST) 939 return -1; 940 941 #ifndef IPFILTER_CKSUM 942 if (fr_checkl4sum(fin) == -1) 943 return -1; 944 #endif 945 946 tlen = (tcp->th_flags & (TH_SYN|TH_FIN)) ? 1 : 0; 947 #ifdef USE_INET6 948 if (fin->fin_v == 6) 949 hlen = sizeof(ip6_t); 950 else 951 #endif 952 hlen = sizeof(ip_t); 953 hlen += sizeof(*tcp2); 954 if ((m = (mblk_t *)allocb(hlen + 64, BPRI_HI)) == NULL) 955 return -1; 956 957 m->b_rptr += 64; 958 MTYPE(m) = M_DATA; 959 m->b_wptr = m->b_rptr + hlen; 960 ip = (ip_t *)m->b_rptr; 961 bzero((char *)ip, hlen); 962 tcp2 = (struct tcphdr *)(m->b_rptr + hlen - sizeof(*tcp2)); 963 tcp2->th_dport = tcp->th_sport; 964 tcp2->th_sport = tcp->th_dport; 965 if (tcp->th_flags & TH_ACK) { 966 tcp2->th_seq = tcp->th_ack; 967 tcp2->th_flags = TH_RST; 968 } else { 969 tcp2->th_ack = ntohl(tcp->th_seq); 970 tcp2->th_ack += tlen; 971 tcp2->th_ack = htonl(tcp2->th_ack); 972 tcp2->th_flags = TH_RST|TH_ACK; 973 } 974 tcp2->th_off = sizeof(struct tcphdr) >> 2; 975 976 ip->ip_v = fin->fin_v; 977 #ifdef USE_INET6 978 if (fin->fin_v == 6) { 979 ip6 = (ip6_t *)m->b_rptr; 980 ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow; 981 ip6->ip6_src = fin->fin_dst6; 982 ip6->ip6_dst = fin->fin_src6; 983 ip6->ip6_plen = htons(sizeof(*tcp)); 984 ip6->ip6_nxt = IPPROTO_TCP; 985 tcp2->th_sum = fr_cksum(m, (ip_t *)ip6, IPPROTO_TCP, tcp2); 986 } else 987 #endif 988 { 989 ip->ip_src.s_addr = fin->fin_daddr; 990 ip->ip_dst.s_addr = fin->fin_saddr; 991 ip->ip_id = fr_nextipid(fin); 992 ip->ip_hl = sizeof(*ip) >> 2; 993 ip->ip_p = IPPROTO_TCP; 994 ip->ip_len = sizeof(*ip) + sizeof(*tcp); 995 ip->ip_tos = fin->fin_ip->ip_tos; 996 tcp2->th_sum = fr_cksum(m, ip, IPPROTO_TCP, tcp2); 997 } 998 return fr_send_ip(fin, m, &m); 999 } 1000 1001 /* 1002 * Function: fr_send_ip 1003 * Returns: 0: success 1004 * -1: failed 1005 * Parameters: 1006 * fin: packet information 1007 * m: the message block where ip head starts 1008 * 1009 * Send a new packet through the IP stack. 1010 * 1011 * For IPv4 packets, ip_len must be in host byte order, and ip_v, 1012 * ip_ttl, ip_off, and ip_sum are ignored (filled in by this 1013 * function). 1014 * 1015 * For IPv6 packets, ip6_flow, ip6_vfc, and ip6_hlim are filled 1016 * in by this function. 1017 * 1018 * All other portions of the packet must be in on-the-wire format. 1019 */ 1020 /*ARGSUSED*/ 1021 static int fr_send_ip(fin, m, mpp) 1022 fr_info_t *fin; 1023 mblk_t *m, **mpp; 1024 { 1025 qpktinfo_t qpi, *qpip; 1026 fr_info_t fnew; 1027 ip_t *ip; 1028 int i, hlen; 1029 ipf_stack_t *ifs = fin->fin_ifs; 1030 1031 ip = (ip_t *)m->b_rptr; 1032 bzero((char *)&fnew, sizeof(fnew)); 1033 1034 #ifdef USE_INET6 1035 if (fin->fin_v == 6) { 1036 ip6_t *ip6; 1037 1038 ip6 = (ip6_t *)ip; 1039 ip6->ip6_vfc = 0x60; 1040 ip6->ip6_hlim = 127; 1041 fnew.fin_v = 6; 1042 hlen = sizeof(*ip6); 1043 fnew.fin_plen = ntohs(ip6->ip6_plen) + hlen; 1044 } else 1045 #endif 1046 { 1047 fnew.fin_v = 4; 1048 #if SOLARIS2 >= 10 1049 ip->ip_ttl = 255; 1050 if (net_getpmtuenabled(ifs->ifs_ipf_ipv4) == 1) 1051 ip->ip_off = htons(IP_DF); 1052 #else 1053 if (ip_ttl_ptr != NULL) 1054 ip->ip_ttl = (u_char)(*ip_ttl_ptr); 1055 else 1056 ip->ip_ttl = 63; 1057 if (ip_mtudisc != NULL) 1058 ip->ip_off = htons(*ip_mtudisc ? IP_DF : 0); 1059 else 1060 ip->ip_off = htons(IP_DF); 1061 #endif 1062 /* 1063 * The dance with byte order and ip_len/ip_off is because in 1064 * fr_fastroute, it expects them to be in host byte order but 1065 * ipf_cksum expects them to be in network byte order. 1066 */ 1067 ip->ip_len = htons(ip->ip_len); 1068 ip->ip_sum = ipf_cksum((u_short *)ip, sizeof(*ip)); 1069 ip->ip_len = ntohs(ip->ip_len); 1070 ip->ip_off = ntohs(ip->ip_off); 1071 hlen = sizeof(*ip); 1072 fnew.fin_plen = ip->ip_len; 1073 } 1074 1075 qpip = fin->fin_qpi; 1076 qpi.qpi_off = 0; 1077 qpi.qpi_ill = qpip->qpi_ill; 1078 qpi.qpi_m = m; 1079 qpi.qpi_data = ip; 1080 fnew.fin_qpi = &qpi; 1081 fnew.fin_ifp = fin->fin_ifp; 1082 fnew.fin_flx = FI_NOCKSUM; 1083 fnew.fin_m = m; 1084 fnew.fin_ip = ip; 1085 fnew.fin_mp = mpp; 1086 fnew.fin_hlen = hlen; 1087 fnew.fin_dp = (char *)ip + hlen; 1088 fnew.fin_ifs = fin->fin_ifs; 1089 (void) fr_makefrip(hlen, ip, &fnew); 1090 1091 i = fr_fastroute(m, mpp, &fnew, NULL); 1092 return i; 1093 } 1094 1095 1096 int fr_send_icmp_err(type, fin, dst) 1097 int type; 1098 fr_info_t *fin; 1099 int dst; 1100 { 1101 struct in_addr dst4; 1102 struct icmp *icmp; 1103 qpktinfo_t *qpi; 1104 int hlen, code; 1105 phy_if_t phy; 1106 u_short sz; 1107 #ifdef USE_INET6 1108 mblk_t *mb; 1109 #endif 1110 mblk_t *m; 1111 #ifdef USE_INET6 1112 ip6_t *ip6; 1113 #endif 1114 ip_t *ip; 1115 ipf_stack_t *ifs = fin->fin_ifs; 1116 1117 if ((type < 0) || (type > ICMP_MAXTYPE)) 1118 return -1; 1119 1120 code = fin->fin_icode; 1121 #ifdef USE_INET6 1122 if ((code < 0) || (code > sizeof(icmptoicmp6unreach)/sizeof(int))) 1123 return -1; 1124 #endif 1125 1126 #ifndef IPFILTER_CKSUM 1127 if (fr_checkl4sum(fin) == -1) 1128 return -1; 1129 #endif 1130 1131 qpi = fin->fin_qpi; 1132 1133 #ifdef USE_INET6 1134 mb = fin->fin_qfm; 1135 1136 if (fin->fin_v == 6) { 1137 sz = sizeof(ip6_t); 1138 sz += MIN(mb->b_wptr - mb->b_rptr, 512); 1139 hlen = sizeof(ip6_t); 1140 type = icmptoicmp6types[type]; 1141 if (type == ICMP6_DST_UNREACH) 1142 code = icmptoicmp6unreach[code]; 1143 } else 1144 #endif 1145 { 1146 if ((fin->fin_p == IPPROTO_ICMP) && 1147 !(fin->fin_flx & FI_SHORT)) 1148 switch (ntohs(fin->fin_data[0]) >> 8) 1149 { 1150 case ICMP_ECHO : 1151 case ICMP_TSTAMP : 1152 case ICMP_IREQ : 1153 case ICMP_MASKREQ : 1154 break; 1155 default : 1156 return 0; 1157 } 1158 1159 sz = sizeof(ip_t) * 2; 1160 sz += 8; /* 64 bits of data */ 1161 hlen = sizeof(ip_t); 1162 } 1163 1164 sz += offsetof(struct icmp, icmp_ip); 1165 if ((m = (mblk_t *)allocb((size_t)sz + 64, BPRI_HI)) == NULL) 1166 return -1; 1167 MTYPE(m) = M_DATA; 1168 m->b_rptr += 64; 1169 m->b_wptr = m->b_rptr + sz; 1170 bzero((char *)m->b_rptr, (size_t)sz); 1171 ip = (ip_t *)m->b_rptr; 1172 ip->ip_v = fin->fin_v; 1173 icmp = (struct icmp *)(m->b_rptr + hlen); 1174 icmp->icmp_type = type & 0xff; 1175 icmp->icmp_code = code & 0xff; 1176 phy = (phy_if_t)qpi->qpi_ill; 1177 if (type == ICMP_UNREACH && (phy != 0) && 1178 fin->fin_icode == ICMP_UNREACH_NEEDFRAG) 1179 icmp->icmp_nextmtu = net_getmtu(ifs->ifs_ipf_ipv4, phy,0 ); 1180 1181 #ifdef USE_INET6 1182 if (fin->fin_v == 6) { 1183 struct in6_addr dst6; 1184 int csz; 1185 1186 if (dst == 0) { 1187 ipf_stack_t *ifs = fin->fin_ifs; 1188 1189 if (fr_ifpaddr(6, FRI_NORMAL, (void *)phy, 1190 (void *)&dst6, NULL, ifs) == -1) { 1191 FREE_MB_T(m); 1192 return -1; 1193 } 1194 } else 1195 dst6 = fin->fin_dst6; 1196 1197 csz = sz; 1198 sz -= sizeof(ip6_t); 1199 ip6 = (ip6_t *)m->b_rptr; 1200 ip6->ip6_flow = ((ip6_t *)fin->fin_ip)->ip6_flow; 1201 ip6->ip6_plen = htons((u_short)sz); 1202 ip6->ip6_nxt = IPPROTO_ICMPV6; 1203 ip6->ip6_src = dst6; 1204 ip6->ip6_dst = fin->fin_src6; 1205 sz -= offsetof(struct icmp, icmp_ip); 1206 bcopy((char *)mb->b_rptr, (char *)&icmp->icmp_ip, sz); 1207 icmp->icmp_cksum = csz - sizeof(ip6_t); 1208 } else 1209 #endif 1210 { 1211 ip->ip_hl = sizeof(*ip) >> 2; 1212 ip->ip_p = IPPROTO_ICMP; 1213 ip->ip_id = fin->fin_ip->ip_id; 1214 ip->ip_tos = fin->fin_ip->ip_tos; 1215 ip->ip_len = (u_short)sz; 1216 if (dst == 0) { 1217 ipf_stack_t *ifs = fin->fin_ifs; 1218 1219 if (fr_ifpaddr(4, FRI_NORMAL, (void *)phy, 1220 (void *)&dst4, NULL, ifs) == -1) { 1221 FREE_MB_T(m); 1222 return -1; 1223 } 1224 } else { 1225 dst4 = fin->fin_dst; 1226 } 1227 ip->ip_src = dst4; 1228 ip->ip_dst = fin->fin_src; 1229 bcopy((char *)fin->fin_ip, (char *)&icmp->icmp_ip, 1230 sizeof(*fin->fin_ip)); 1231 bcopy((char *)fin->fin_ip + fin->fin_hlen, 1232 (char *)&icmp->icmp_ip + sizeof(*fin->fin_ip), 8); 1233 icmp->icmp_ip.ip_len = htons(icmp->icmp_ip.ip_len); 1234 icmp->icmp_ip.ip_off = htons(icmp->icmp_ip.ip_off); 1235 icmp->icmp_cksum = ipf_cksum((u_short *)icmp, 1236 sz - sizeof(ip_t)); 1237 } 1238 1239 /* 1240 * Need to exit out of these so we don't recursively call rw_enter 1241 * from fr_qout. 1242 */ 1243 return fr_send_ip(fin, m, &m); 1244 } 1245 1246 #include <sys/time.h> 1247 #include <sys/varargs.h> 1248 1249 #ifndef _KERNEL 1250 #include <stdio.h> 1251 #endif 1252 1253 #define NULLADDR_RATE_LIMIT 10 /* 10 seconds */ 1254 1255 1256 /* 1257 * Print out warning message at rate-limited speed. 1258 */ 1259 static void rate_limit_message(ipf_stack_t *ifs, 1260 int rate, const char *message, ...) 1261 { 1262 static time_t last_time = 0; 1263 time_t now; 1264 va_list args; 1265 char msg_buf[256]; 1266 int need_printed = 0; 1267 1268 now = ddi_get_time(); 1269 1270 /* make sure, no multiple entries */ 1271 ASSERT(MUTEX_NOT_HELD(&(ifs->ifs_ipf_rw.ipf_lk))); 1272 MUTEX_ENTER(&ifs->ifs_ipf_rw); 1273 if (now - last_time >= rate) { 1274 need_printed = 1; 1275 last_time = now; 1276 } 1277 MUTEX_EXIT(&ifs->ifs_ipf_rw); 1278 1279 if (need_printed) { 1280 va_start(args, message); 1281 (void)vsnprintf(msg_buf, 255, message, args); 1282 va_end(args); 1283 #ifdef _KERNEL 1284 cmn_err(CE_WARN, msg_buf); 1285 #else 1286 fprintf(std_err, msg_buf); 1287 #endif 1288 } 1289 } 1290 1291 /* 1292 * return the first IP Address associated with an interface 1293 */ 1294 /*ARGSUSED*/ 1295 int fr_ifpaddr(v, atype, ifptr, inp, inpmask, ifs) 1296 int v, atype; 1297 void *ifptr; 1298 struct in_addr *inp, *inpmask; 1299 ipf_stack_t *ifs; 1300 { 1301 struct sockaddr_in6 v6addr[2]; 1302 struct sockaddr_in v4addr[2]; 1303 net_ifaddr_t type[2]; 1304 net_data_t net_data; 1305 phy_if_t phyif; 1306 void *array; 1307 1308 switch (v) 1309 { 1310 case 4: 1311 net_data = ifs->ifs_ipf_ipv4; 1312 array = v4addr; 1313 break; 1314 case 6: 1315 net_data = ifs->ifs_ipf_ipv6; 1316 array = v6addr; 1317 break; 1318 default: 1319 net_data = NULL; 1320 break; 1321 } 1322 1323 if (net_data == NULL) 1324 return -1; 1325 1326 phyif = (phy_if_t)ifptr; 1327 1328 switch (atype) 1329 { 1330 case FRI_PEERADDR : 1331 type[0] = NA_PEER; 1332 break; 1333 1334 case FRI_BROADCAST : 1335 type[0] = NA_BROADCAST; 1336 break; 1337 1338 default : 1339 type[0] = NA_ADDRESS; 1340 break; 1341 } 1342 1343 type[1] = NA_NETMASK; 1344 1345 if (net_getlifaddr(net_data, phyif, 0, 2, type, array) < 0) 1346 return -1; 1347 1348 if (v == 6) { 1349 return fr_ifpfillv6addr(atype, &v6addr[0], &v6addr[1], 1350 inp, inpmask); 1351 } 1352 return fr_ifpfillv4addr(atype, &v4addr[0], &v4addr[1], inp, inpmask); 1353 } 1354 1355 1356 u_32_t fr_newisn(fin) 1357 fr_info_t *fin; 1358 { 1359 static int iss_seq_off = 0; 1360 u_char hash[16]; 1361 u_32_t newiss; 1362 MD5_CTX ctx; 1363 ipf_stack_t *ifs = fin->fin_ifs; 1364 1365 /* 1366 * Compute the base value of the ISS. It is a hash 1367 * of (saddr, sport, daddr, dport, secret). 1368 */ 1369 MD5Init(&ctx); 1370 1371 MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_src, 1372 sizeof(fin->fin_fi.fi_src)); 1373 MD5Update(&ctx, (u_char *) &fin->fin_fi.fi_dst, 1374 sizeof(fin->fin_fi.fi_dst)); 1375 MD5Update(&ctx, (u_char *) &fin->fin_dat, sizeof(fin->fin_dat)); 1376 1377 MD5Update(&ctx, ifs->ifs_ipf_iss_secret, sizeof(ifs->ifs_ipf_iss_secret)); 1378 1379 MD5Final(hash, &ctx); 1380 1381 bcopy(hash, &newiss, sizeof(newiss)); 1382 1383 /* 1384 * Now increment our "timer", and add it in to 1385 * the computed value. 1386 * 1387 * XXX Use `addin'? 1388 * XXX TCP_ISSINCR too large to use? 1389 */ 1390 iss_seq_off += 0x00010000; 1391 newiss += iss_seq_off; 1392 return newiss; 1393 } 1394 1395 1396 /* ------------------------------------------------------------------------ */ 1397 /* Function: fr_nextipid */ 1398 /* Returns: int - 0 == success, -1 == error (packet should be droppped) */ 1399 /* Parameters: fin(I) - pointer to packet information */ 1400 /* */ 1401 /* Returns the next IPv4 ID to use for this packet. */ 1402 /* ------------------------------------------------------------------------ */ 1403 u_short fr_nextipid(fin) 1404 fr_info_t *fin; 1405 { 1406 static u_short ipid = 0; 1407 ipstate_t *is; 1408 nat_t *nat; 1409 u_short id; 1410 ipf_stack_t *ifs = fin->fin_ifs; 1411 1412 MUTEX_ENTER(&ifs->ifs_ipf_rw); 1413 if (fin->fin_state != NULL) { 1414 is = fin->fin_state; 1415 id = (u_short)(is->is_pkts[(fin->fin_rev << 1) + 1] & 0xffff); 1416 } else if (fin->fin_nat != NULL) { 1417 nat = fin->fin_nat; 1418 id = (u_short)(nat->nat_pkts[fin->fin_out] & 0xffff); 1419 } else 1420 id = ipid++; 1421 MUTEX_EXIT(&ifs->ifs_ipf_rw); 1422 1423 return id; 1424 } 1425 1426 1427 #ifndef IPFILTER_CKSUM 1428 /* ARGSUSED */ 1429 #endif 1430 INLINE void fr_checkv4sum(fin) 1431 fr_info_t *fin; 1432 { 1433 #ifdef IPFILTER_CKSUM 1434 if (fr_checkl4sum(fin) == -1) 1435 fin->fin_flx |= FI_BAD; 1436 #endif 1437 } 1438 1439 1440 #ifdef USE_INET6 1441 # ifndef IPFILTER_CKSUM 1442 /* ARGSUSED */ 1443 # endif 1444 INLINE void fr_checkv6sum(fin) 1445 fr_info_t *fin; 1446 { 1447 # ifdef IPFILTER_CKSUM 1448 if (fr_checkl4sum(fin) == -1) 1449 fin->fin_flx |= FI_BAD; 1450 # endif 1451 } 1452 #endif /* USE_INET6 */ 1453 1454 1455 #if (SOLARIS2 < 7) 1456 void fr_slowtimer() 1457 #else 1458 /*ARGSUSED*/ 1459 void fr_slowtimer __P((void *arg)) 1460 #endif 1461 { 1462 ipf_stack_t *ifs = arg; 1463 1464 WRITE_ENTER(&ifs->ifs_ipf_global); 1465 if (ifs->ifs_fr_running == -1 || ifs->ifs_fr_running == 0) { 1466 ifs->ifs_fr_timer_id = timeout(fr_slowtimer, arg, drv_usectohz(500000)); 1467 RWLOCK_EXIT(&ifs->ifs_ipf_global); 1468 return; 1469 } 1470 MUTEX_DOWNGRADE(&ifs->ifs_ipf_global); 1471 1472 fr_fragexpire(ifs); 1473 fr_timeoutstate(ifs); 1474 fr_natexpire(ifs); 1475 fr_authexpire(ifs); 1476 ifs->ifs_fr_ticks++; 1477 if (ifs->ifs_fr_running == -1 || ifs->ifs_fr_running == 1) 1478 ifs->ifs_fr_timer_id = timeout(fr_slowtimer, arg, 1479 drv_usectohz(500000)); 1480 else 1481 ifs->ifs_fr_timer_id = NULL; 1482 RWLOCK_EXIT(&ifs->ifs_ipf_global); 1483 } 1484 1485 1486 /* ------------------------------------------------------------------------ */ 1487 /* Function: fr_pullup */ 1488 /* Returns: NULL == pullup failed, else pointer to protocol header */ 1489 /* Parameters: m(I) - pointer to buffer where data packet starts */ 1490 /* fin(I) - pointer to packet information */ 1491 /* len(I) - number of bytes to pullup */ 1492 /* */ 1493 /* Attempt to move at least len bytes (from the start of the buffer) into a */ 1494 /* single buffer for ease of access. Operating system native functions are */ 1495 /* used to manage buffers - if necessary. If the entire packet ends up in */ 1496 /* a single buffer, set the FI_COALESCE flag even though fr_coalesce() has */ 1497 /* not been called. Both fin_ip and fin_dp are updated before exiting _IF_ */ 1498 /* and ONLY if the pullup succeeds. */ 1499 /* */ 1500 /* We assume that 'min' is a pointer to a buffer that is part of the chain */ 1501 /* of buffers that starts at *fin->fin_mp. */ 1502 /* ------------------------------------------------------------------------ */ 1503 void *fr_pullup(min, fin, len) 1504 mb_t *min; 1505 fr_info_t *fin; 1506 int len; 1507 { 1508 qpktinfo_t *qpi = fin->fin_qpi; 1509 int out = fin->fin_out, dpoff, ipoff; 1510 mb_t *m = min, *m1, *m2; 1511 char *ip; 1512 uint32_t start, stuff, end, value, flags; 1513 ipf_stack_t *ifs = fin->fin_ifs; 1514 1515 if (m == NULL) 1516 return NULL; 1517 1518 ip = (char *)fin->fin_ip; 1519 if ((fin->fin_flx & FI_COALESCE) != 0) 1520 return ip; 1521 1522 ipoff = fin->fin_ipoff; 1523 if (fin->fin_dp != NULL) 1524 dpoff = (char *)fin->fin_dp - (char *)ip; 1525 else 1526 dpoff = 0; 1527 1528 if (M_LEN(m) < len) { 1529 1530 /* 1531 * pfil_precheck ensures the IP header is on a 32bit 1532 * aligned address so simply fail if that isn't currently 1533 * the case (should never happen). 1534 */ 1535 int inc = 0; 1536 1537 if (ipoff > 0) { 1538 if ((ipoff & 3) != 0) { 1539 inc = 4 - (ipoff & 3); 1540 if (m->b_rptr - inc >= m->b_datap->db_base) 1541 m->b_rptr -= inc; 1542 else 1543 inc = 0; 1544 } 1545 } 1546 1547 /* 1548 * XXX This is here as a work around for a bug with DEBUG 1549 * XXX Solaris kernels. The problem is b_prev is used by IP 1550 * XXX code as a way to stash the phyint_index for a packet, 1551 * XXX this doesn't get reset by IP but freeb does an ASSERT() 1552 * XXX for both of these to be NULL. See 6442390. 1553 */ 1554 m1 = m; 1555 m2 = m->b_prev; 1556 1557 do { 1558 m1->b_next = NULL; 1559 m1->b_prev = NULL; 1560 m1 = m1->b_cont; 1561 } while (m1); 1562 1563 /* 1564 * Need to preserve checksum information by copying them 1565 * to newmp which heads the pulluped message. 1566 */ 1567 hcksum_retrieve(m, NULL, NULL, &start, &stuff, &end, 1568 &value, &flags); 1569 1570 if (pullupmsg(m, len + ipoff + inc) == 0) { 1571 ATOMIC_INCL(ifs->ifs_frstats[out].fr_pull[1]); 1572 FREE_MB_T(*fin->fin_mp); 1573 *fin->fin_mp = NULL; 1574 fin->fin_m = NULL; 1575 fin->fin_ip = NULL; 1576 fin->fin_dp = NULL; 1577 qpi->qpi_data = NULL; 1578 return NULL; 1579 } 1580 1581 (void) hcksum_assoc(m, NULL, NULL, start, stuff, end, 1582 value, flags, 0); 1583 1584 m->b_prev = m2; 1585 m->b_rptr += inc; 1586 fin->fin_m = m; 1587 ip = MTOD(m, char *) + ipoff; 1588 qpi->qpi_data = ip; 1589 } 1590 1591 ATOMIC_INCL(ifs->ifs_frstats[out].fr_pull[0]); 1592 fin->fin_ip = (ip_t *)ip; 1593 if (fin->fin_dp != NULL) 1594 fin->fin_dp = (char *)fin->fin_ip + dpoff; 1595 1596 if (len == fin->fin_plen) 1597 fin->fin_flx |= FI_COALESCE; 1598 return ip; 1599 } 1600 1601 1602 /* 1603 * Function: fr_verifysrc 1604 * Returns: int (really boolean) 1605 * Parameters: fin - packet information 1606 * 1607 * Check whether the packet has a valid source address for the interface on 1608 * which the packet arrived, implementing the "fr_chksrc" feature. 1609 * Returns true iff the packet's source address is valid. 1610 */ 1611 int fr_verifysrc(fin) 1612 fr_info_t *fin; 1613 { 1614 net_data_t net_data_p; 1615 phy_if_t phy_ifdata_routeto; 1616 struct sockaddr sin; 1617 ipf_stack_t *ifs = fin->fin_ifs; 1618 1619 if (fin->fin_v == 4) { 1620 net_data_p = ifs->ifs_ipf_ipv4; 1621 } else if (fin->fin_v == 6) { 1622 net_data_p = ifs->ifs_ipf_ipv6; 1623 } else { 1624 return (0); 1625 } 1626 1627 /* Get the index corresponding to the if name */ 1628 sin.sa_family = (fin->fin_v == 4) ? AF_INET : AF_INET6; 1629 bcopy(&fin->fin_saddr, &sin.sa_data, sizeof (struct in_addr)); 1630 phy_ifdata_routeto = net_routeto(net_data_p, &sin); 1631 1632 return (((phy_if_t)fin->fin_ifp == phy_ifdata_routeto) ? 1 : 0); 1633 } 1634 1635 1636 /* 1637 * Function: fr_fastroute 1638 * Returns: 0: success; 1639 * -1: failed 1640 * Parameters: 1641 * mb: the message block where ip head starts 1642 * mpp: the pointer to the pointer of the orignal 1643 * packet message 1644 * fin: packet information 1645 * fdp: destination interface information 1646 * if it is NULL, no interface information provided. 1647 * 1648 * This function is for fastroute/to/dup-to rules. It calls 1649 * pfil_make_lay2_packet to search route, make lay-2 header 1650 * ,and identify output queue for the IP packet. 1651 * The destination address depends on the following conditions: 1652 * 1: for fastroute rule, fdp is passed in as NULL, so the 1653 * destination address is the IP Packet's destination address 1654 * 2: for to/dup-to rule, if an ip address is specified after 1655 * the interface name, this address is the as destination 1656 * address. Otherwise IP Packet's destination address is used 1657 */ 1658 int fr_fastroute(mb, mpp, fin, fdp) 1659 mblk_t *mb, **mpp; 1660 fr_info_t *fin; 1661 frdest_t *fdp; 1662 { 1663 net_data_t net_data_p; 1664 net_inject_t inj_data; 1665 mblk_t *mp = NULL; 1666 frentry_t *fr = fin->fin_fr; 1667 qpktinfo_t *qpi; 1668 ip_t *ip; 1669 1670 struct sockaddr_in *sin; 1671 struct sockaddr_in6 *sin6; 1672 struct sockaddr *sinp; 1673 ipf_stack_t *ifs = fin->fin_ifs; 1674 #ifndef sparc 1675 u_short __iplen, __ipoff; 1676 #endif 1677 1678 if (fin->fin_v == 4) { 1679 net_data_p = ifs->ifs_ipf_ipv4; 1680 } else if (fin->fin_v == 6) { 1681 net_data_p = ifs->ifs_ipf_ipv6; 1682 } else { 1683 return (-1); 1684 } 1685 1686 ip = fin->fin_ip; 1687 qpi = fin->fin_qpi; 1688 1689 /* 1690 * If this is a duplicate mblk then we want ip to point at that 1691 * data, not the original, if and only if it is already pointing at 1692 * the current mblk data. 1693 * 1694 * Otherwise, if it's not a duplicate, and we're not already pointing 1695 * at the current mblk data, then we want to ensure that the data 1696 * points at ip. 1697 */ 1698 1699 if ((ip == (ip_t *)qpi->qpi_m->b_rptr) && (qpi->qpi_m != mb)) { 1700 ip = (ip_t *)mb->b_rptr; 1701 } else if ((qpi->qpi_m == mb) && (ip != (ip_t *)qpi->qpi_m->b_rptr)) { 1702 qpi->qpi_m->b_rptr = (uchar_t *)ip; 1703 qpi->qpi_off = 0; 1704 } 1705 1706 /* 1707 * If there is another M_PROTO, we don't want it 1708 */ 1709 if (*mpp != mb) { 1710 mp = unlinkb(*mpp); 1711 freeb(*mpp); 1712 *mpp = mp; 1713 } 1714 1715 sinp = (struct sockaddr *)&inj_data.ni_addr; 1716 sin = (struct sockaddr_in *)sinp; 1717 sin6 = (struct sockaddr_in6 *)sinp; 1718 bzero((char *)&inj_data.ni_addr, sizeof (inj_data.ni_addr)); 1719 inj_data.ni_addr.ss_family = (fin->fin_v == 4) ? AF_INET : AF_INET6; 1720 inj_data.ni_packet = mb; 1721 1722 /* 1723 * In case we're here due to "to <if>" being used with 1724 * "keep state", check that we're going in the correct 1725 * direction. 1726 */ 1727 if (fdp != NULL) { 1728 if ((fr != NULL) && (fdp->fd_ifp != NULL) && 1729 (fin->fin_rev != 0) && (fdp == &fr->fr_tif)) 1730 goto bad_fastroute; 1731 inj_data.ni_physical = (phy_if_t)fdp->fd_ifp; 1732 if (fin->fin_v == 4) { 1733 sin->sin_addr = fdp->fd_ip; 1734 } else { 1735 sin6->sin6_addr = fdp->fd_ip6.in6; 1736 } 1737 } else { 1738 if (fin->fin_v == 4) { 1739 sin->sin_addr = ip->ip_dst; 1740 } else { 1741 sin6->sin6_addr = ((ip6_t *)ip)->ip6_dst; 1742 } 1743 inj_data.ni_physical = net_routeto(net_data_p, sinp); 1744 } 1745 1746 /* disable hardware checksum */ 1747 DB_CKSUMFLAGS(mb) = 0; 1748 1749 *mpp = mb; 1750 1751 if (fin->fin_out == 0) { 1752 void *saveifp; 1753 u_32_t pass; 1754 1755 saveifp = fin->fin_ifp; 1756 fin->fin_ifp = (void *)inj_data.ni_physical; 1757 fin->fin_flx &= ~FI_STATE; 1758 fin->fin_out = 1; 1759 (void) fr_acctpkt(fin, &pass); 1760 fin->fin_fr = NULL; 1761 if (!fr || !(fr->fr_flags & FR_RETMASK)) 1762 (void) fr_checkstate(fin, &pass); 1763 if (fr_checknatout(fin, NULL) == -1) 1764 goto bad_fastroute; 1765 fin->fin_out = 0; 1766 fin->fin_ifp = saveifp; 1767 1768 if (fin->fin_nat != NULL) 1769 fr_natderef((nat_t **)&fin->fin_nat, ifs); 1770 } 1771 #ifndef sparc 1772 if (fin->fin_v == 4) { 1773 __iplen = (u_short)ip->ip_len, 1774 __ipoff = (u_short)ip->ip_off; 1775 1776 ip->ip_len = htons(__iplen); 1777 ip->ip_off = htons(__ipoff); 1778 } 1779 #endif 1780 1781 if (net_data_p) { 1782 if (net_inject(net_data_p, NI_DIRECT_OUT, &inj_data) < 0) { 1783 return (-1); 1784 } 1785 } 1786 1787 ifs->ifs_fr_frouteok[0]++; 1788 return 0; 1789 bad_fastroute: 1790 freemsg(mb); 1791 ifs->ifs_fr_frouteok[1]++; 1792 return -1; 1793 } 1794 1795 1796 /* ------------------------------------------------------------------------ */ 1797 /* Function: ipf_hook_out */ 1798 /* Returns: int - 0 == packet ok, else problem, free packet if not done */ 1799 /* Parameters: event(I) - pointer to event */ 1800 /* info(I) - pointer to hook information for firewalling */ 1801 /* */ 1802 /* Calling ipf_hook. */ 1803 /* ------------------------------------------------------------------------ */ 1804 /*ARGSUSED*/ 1805 int ipf_hook_out(hook_event_token_t token, hook_data_t info, netstack_t *ns) 1806 { 1807 return ipf_hook(info, 1, 0, ns); 1808 } 1809 1810 /* ------------------------------------------------------------------------ */ 1811 /* Function: ipf_hook_in */ 1812 /* Returns: int - 0 == packet ok, else problem, free packet if not done */ 1813 /* Parameters: event(I) - pointer to event */ 1814 /* info(I) - pointer to hook information for firewalling */ 1815 /* */ 1816 /* Calling ipf_hook. */ 1817 /* ------------------------------------------------------------------------ */ 1818 /*ARGSUSED*/ 1819 int ipf_hook_in(hook_event_token_t token, hook_data_t info, netstack_t *ns) 1820 { 1821 return ipf_hook(info, 0, 0, ns); 1822 } 1823 1824 1825 /* ------------------------------------------------------------------------ */ 1826 /* Function: ipf_hook_loop_out */ 1827 /* Returns: int - 0 == packet ok, else problem, free packet if not done */ 1828 /* Parameters: event(I) - pointer to event */ 1829 /* info(I) - pointer to hook information for firewalling */ 1830 /* */ 1831 /* Calling ipf_hook. */ 1832 /* ------------------------------------------------------------------------ */ 1833 /*ARGSUSED*/ 1834 int ipf_hook_loop_out(hook_event_token_t token, hook_data_t info, 1835 netstack_t *ns) 1836 { 1837 return ipf_hook(info, 1, 1, ns); 1838 } 1839 1840 /* ------------------------------------------------------------------------ */ 1841 /* Function: ipf_hook_loop_in */ 1842 /* Returns: int - 0 == packet ok, else problem, free packet if not done */ 1843 /* Parameters: event(I) - pointer to event */ 1844 /* info(I) - pointer to hook information for firewalling */ 1845 /* */ 1846 /* Calling ipf_hook. */ 1847 /* ------------------------------------------------------------------------ */ 1848 /*ARGSUSED*/ 1849 int ipf_hook_loop_in(hook_event_token_t token, hook_data_t info, 1850 netstack_t *ns) 1851 { 1852 return ipf_hook(info, 0, 1, ns); 1853 } 1854 1855 /* ------------------------------------------------------------------------ */ 1856 /* Function: ipf_hook */ 1857 /* Returns: int - 0 == packet ok, else problem, free packet if not done */ 1858 /* Parameters: info(I) - pointer to hook information for firewalling */ 1859 /* out(I) - whether packet is going in or out */ 1860 /* loopback(I) - whether packet is a loopback packet or not */ 1861 /* */ 1862 /* Stepping stone function between the IP mainline and IPFilter. Extracts */ 1863 /* parameters out of the info structure and forms them up to be useful for */ 1864 /* calling ipfilter. */ 1865 /* ------------------------------------------------------------------------ */ 1866 int ipf_hook(hook_data_t info, int out, int loopback, netstack_t *ns) 1867 { 1868 hook_pkt_event_t *fw; 1869 int rval, v, hlen; 1870 qpktinfo_t qpi; 1871 u_short swap; 1872 phy_if_t phy; 1873 ip_t *ip; 1874 1875 fw = (hook_pkt_event_t *)info; 1876 1877 ASSERT(fw != NULL); 1878 phy = (out == 0) ? fw->hpe_ifp : fw->hpe_ofp; 1879 1880 ip = fw->hpe_hdr; 1881 v = ip->ip_v; 1882 if (v == IPV4_VERSION) { 1883 swap = ntohs(ip->ip_len); 1884 ip->ip_len = swap; 1885 swap = ntohs(ip->ip_off); 1886 ip->ip_off = swap; 1887 1888 hlen = IPH_HDR_LENGTH(ip); 1889 } else 1890 hlen = sizeof (ip6_t); 1891 1892 bzero(&qpi, sizeof (qpktinfo_t)); 1893 1894 qpi.qpi_m = fw->hpe_mb; 1895 qpi.qpi_data = fw->hpe_hdr; 1896 qpi.qpi_off = (char *)qpi.qpi_data - (char *)fw->hpe_mb->b_rptr; 1897 qpi.qpi_ill = (void *)phy; 1898 if (loopback) 1899 qpi.qpi_flags = QPI_NOCKSUM; 1900 else 1901 qpi.qpi_flags = 0; 1902 1903 rval = fr_check(fw->hpe_hdr, hlen, qpi.qpi_ill, out, 1904 &qpi, fw->hpe_mp, ns->netstack_ipf); 1905 1906 /* For fastroute cases, fr_check returns 0 with mp set to NULL */ 1907 if (rval == 0 && *(fw->hpe_mp) == NULL) 1908 rval = 1; 1909 1910 /* Notify IP the packet mblk_t and IP header pointers. */ 1911 fw->hpe_mb = qpi.qpi_m; 1912 fw->hpe_hdr = qpi.qpi_data; 1913 if ((rval == 0) && (v == IPV4_VERSION)) { 1914 ip = qpi.qpi_data; 1915 swap = ntohs(ip->ip_len); 1916 ip->ip_len = swap; 1917 swap = ntohs(ip->ip_off); 1918 ip->ip_off = swap; 1919 } 1920 return rval; 1921 1922 } 1923 1924 1925 /* ------------------------------------------------------------------------ */ 1926 /* Function: ipf_nic_event_v4 */ 1927 /* Returns: int - 0 == no problems encountered */ 1928 /* Parameters: event(I) - pointer to event */ 1929 /* info(I) - pointer to information about a NIC event */ 1930 /* */ 1931 /* Function to receive asynchronous NIC events from IP */ 1932 /* ------------------------------------------------------------------------ */ 1933 /*ARGSUSED*/ 1934 int ipf_nic_event_v4(hook_event_token_t event, hook_data_t info, 1935 netstack_t *ns) 1936 { 1937 struct sockaddr_in *sin; 1938 hook_nic_event_t *hn; 1939 ipf_stack_t *ifs = ns->netstack_ipf; 1940 1941 hn = (hook_nic_event_t *)info; 1942 1943 switch (hn->hne_event) 1944 { 1945 case NE_PLUMB : 1946 frsync(IPFSYNC_NEWIFP, 4, (void *)hn->hne_nic, hn->hne_data, 1947 ifs); 1948 fr_natifpsync(IPFSYNC_NEWIFP, (void *)hn->hne_nic, 1949 hn->hne_data, ifs); 1950 fr_statesync(IPFSYNC_NEWIFP, 4, (void *)hn->hne_nic, 1951 hn->hne_data, ifs); 1952 break; 1953 1954 case NE_UNPLUMB : 1955 frsync(IPFSYNC_OLDIFP, 4, (void *)hn->hne_nic, NULL, ifs); 1956 fr_natifpsync(IPFSYNC_OLDIFP, (void *)hn->hne_nic, NULL, ifs); 1957 fr_statesync(IPFSYNC_OLDIFP, 4, (void *)hn->hne_nic, NULL, ifs); 1958 break; 1959 1960 case NE_ADDRESS_CHANGE : 1961 /* 1962 * We only respond to events for logical interface 0 because 1963 * IPFilter only uses the first address given to a network 1964 * interface. We check for hne_lif==1 because the netinfo 1965 * code maps adds 1 to the lif number so that it can return 1966 * 0 to indicate "no more lifs" when walking them. 1967 */ 1968 if (hn->hne_lif == 1) { 1969 frsync(IPFSYNC_RESYNC, 4, (void *)hn->hne_nic, NULL, 1970 ifs); 1971 sin = hn->hne_data; 1972 fr_nataddrsync((void *)hn->hne_nic, &sin->sin_addr, 1973 ifs); 1974 } 1975 break; 1976 1977 default : 1978 break; 1979 } 1980 1981 return 0; 1982 } 1983 1984 1985 /* ------------------------------------------------------------------------ */ 1986 /* Function: ipf_nic_event_v6 */ 1987 /* Returns: int - 0 == no problems encountered */ 1988 /* Parameters: event(I) - pointer to event */ 1989 /* info(I) - pointer to information about a NIC event */ 1990 /* */ 1991 /* Function to receive asynchronous NIC events from IP */ 1992 /* ------------------------------------------------------------------------ */ 1993 /*ARGSUSED*/ 1994 int ipf_nic_event_v6(hook_event_token_t event, hook_data_t info, 1995 netstack_t *ns) 1996 { 1997 hook_nic_event_t *hn; 1998 ipf_stack_t *ifs = ns->netstack_ipf; 1999 2000 hn = (hook_nic_event_t *)info; 2001 2002 switch (hn->hne_event) 2003 { 2004 case NE_PLUMB : 2005 frsync(IPFSYNC_NEWIFP, 6, (void *)hn->hne_nic, hn->hne_data, ifs); 2006 fr_statesync(IPFSYNC_NEWIFP, 6, (void *)hn->hne_nic, 2007 hn->hne_data, ifs); 2008 break; 2009 2010 case NE_UNPLUMB : 2011 frsync(IPFSYNC_OLDIFP, 6, (void *)hn->hne_nic, NULL, ifs); 2012 fr_statesync(IPFSYNC_OLDIFP, 6, (void *)hn->hne_nic, NULL, ifs); 2013 break; 2014 2015 case NE_ADDRESS_CHANGE : 2016 break; 2017 default : 2018 break; 2019 } 2020 2021 return 0; 2022 } 2023