1ab25eeb5Syz155240 /*
2ab25eeb5Syz155240 * Copyright (C) 1995-2003 by Darren Reed.
3ab25eeb5Syz155240 *
4ab25eeb5Syz155240 * See the IPFILTER.LICENCE file for details on licencing.
5ab25eeb5Syz155240 *
6d3edf6acSJan Parcel * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
794bdecd9SRob Gulewich *
894bdecd9SRob Gulewich * Copyright (c) 2014, Joyent, Inc. All rights reserved.
9ab25eeb5Syz155240 */
10ab25eeb5Syz155240
11ab25eeb5Syz155240 #if defined(KERNEL) || defined(_KERNEL)
12ab25eeb5Syz155240 # undef KERNEL
13ab25eeb5Syz155240 # undef _KERNEL
14ab25eeb5Syz155240 # define KERNEL 1
15ab25eeb5Syz155240 # define _KERNEL 1
16ab25eeb5Syz155240 #endif
17ab25eeb5Syz155240 #include <sys/errno.h>
18ab25eeb5Syz155240 #include <sys/types.h>
19ab25eeb5Syz155240 #include <sys/param.h>
20ab25eeb5Syz155240 #include <sys/file.h>
21ab25eeb5Syz155240 #if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \
22ab25eeb5Syz155240 defined(_KERNEL)
23ab25eeb5Syz155240 # include "opt_ipfilter_log.h"
24ab25eeb5Syz155240 #endif
25ab25eeb5Syz155240 #if defined(_KERNEL) && defined(__FreeBSD_version) && \
26ab25eeb5Syz155240 (__FreeBSD_version >= 400000) && !defined(KLD_MODULE)
27ab25eeb5Syz155240 #include "opt_inet6.h"
28ab25eeb5Syz155240 #endif
29ab25eeb5Syz155240 #if !defined(_KERNEL) && !defined(__KERNEL__)
30ab25eeb5Syz155240 # include <stdio.h>
31ab25eeb5Syz155240 # include <stdlib.h>
32ab25eeb5Syz155240 # include <string.h>
33ab25eeb5Syz155240 # define _KERNEL
34ab25eeb5Syz155240 # ifdef __OpenBSD__
35ab25eeb5Syz155240 struct file;
36ab25eeb5Syz155240 # endif
37ab25eeb5Syz155240 # include <sys/uio.h>
38ab25eeb5Syz155240 # undef _KERNEL
39ab25eeb5Syz155240 #endif
40ab25eeb5Syz155240 #if defined(_KERNEL) && (__FreeBSD_version >= 220000)
41ab25eeb5Syz155240 # include <sys/filio.h>
42ab25eeb5Syz155240 # include <sys/fcntl.h>
43ab25eeb5Syz155240 # if (__FreeBSD_version >= 300000) && !defined(IPFILTER_LKM)
44ab25eeb5Syz155240 # include "opt_ipfilter.h"
45ab25eeb5Syz155240 # endif
46ab25eeb5Syz155240 #else
47ab25eeb5Syz155240 # include <sys/ioctl.h>
48ab25eeb5Syz155240 #endif
49ab25eeb5Syz155240 #include <sys/time.h>
50ab25eeb5Syz155240 #if !defined(linux)
51ab25eeb5Syz155240 # include <sys/protosw.h>
52ab25eeb5Syz155240 #endif
53ab25eeb5Syz155240 #include <sys/socket.h>
54ab25eeb5Syz155240 #if defined(_KERNEL)
55ab25eeb5Syz155240 # include <sys/systm.h>
56ab25eeb5Syz155240 # if !defined(__SVR4) && !defined(__svr4__)
57ab25eeb5Syz155240 # include <sys/mbuf.h>
58ab25eeb5Syz155240 # endif
59ab25eeb5Syz155240 #endif
60ab25eeb5Syz155240 #if defined(__SVR4) || defined(__svr4__)
61ab25eeb5Syz155240 # include <sys/filio.h>
62ab25eeb5Syz155240 # include <sys/byteorder.h>
63ab25eeb5Syz155240 # ifdef _KERNEL
64ab25eeb5Syz155240 # include <sys/dditypes.h>
65ab25eeb5Syz155240 # endif
66ab25eeb5Syz155240 # include <sys/stream.h>
67ab25eeb5Syz155240 # include <sys/kmem.h>
68ab25eeb5Syz155240 #endif
69ab25eeb5Syz155240
70ab25eeb5Syz155240 #include <net/if.h>
71ab25eeb5Syz155240 #ifdef sun
72ab25eeb5Syz155240 # include <net/af.h>
73ab25eeb5Syz155240 #endif
74ab25eeb5Syz155240 #include <net/route.h>
75ab25eeb5Syz155240 #include <netinet/in.h>
76ab25eeb5Syz155240 #include <netinet/in_systm.h>
77ab25eeb5Syz155240 #include <netinet/ip.h>
78ab25eeb5Syz155240 #include <netinet/tcp.h>
79ab25eeb5Syz155240 #if !defined(linux)
80ab25eeb5Syz155240 # include <netinet/ip_var.h>
81ab25eeb5Syz155240 #endif
82ab25eeb5Syz155240 #if !defined(__hpux) && !defined(linux)
83ab25eeb5Syz155240 # include <netinet/tcp_fsm.h>
84ab25eeb5Syz155240 #endif
85ab25eeb5Syz155240 #include <netinet/udp.h>
86ab25eeb5Syz155240 #include <netinet/ip_icmp.h>
87ab25eeb5Syz155240 #include "netinet/ip_compat.h"
88ab25eeb5Syz155240 #include <netinet/tcpip.h>
89ab25eeb5Syz155240 #include "netinet/ip_fil.h"
90ab25eeb5Syz155240 #include "netinet/ip_nat.h"
91ab25eeb5Syz155240 #include "netinet/ip_frag.h"
92ab25eeb5Syz155240 #include "netinet/ip_state.h"
93ab25eeb5Syz155240 #include "netinet/ip_proxy.h"
94f4b3ec61Sdh155122 #include "netinet/ipf_stack.h"
95ab25eeb5Syz155240 #ifdef IPFILTER_SYNC
96ab25eeb5Syz155240 #include "netinet/ip_sync.h"
97ab25eeb5Syz155240 #endif
98ab25eeb5Syz155240 #ifdef IPFILTER_SCAN
99ab25eeb5Syz155240 #include "netinet/ip_scan.h"
100ab25eeb5Syz155240 #endif
101ab25eeb5Syz155240 #ifdef USE_INET6
102ab25eeb5Syz155240 #include <netinet/icmp6.h>
103ab25eeb5Syz155240 #endif
104ab25eeb5Syz155240 #if (__FreeBSD_version >= 300000)
105ab25eeb5Syz155240 # include <sys/malloc.h>
106ab25eeb5Syz155240 # if defined(_KERNEL) && !defined(IPFILTER_LKM)
107ab25eeb5Syz155240 # include <sys/libkern.h>
108ab25eeb5Syz155240 # include <sys/systm.h>
109ab25eeb5Syz155240 # endif
110ab25eeb5Syz155240 #endif
111ab25eeb5Syz155240 /* END OF INCLUDES */
112ab25eeb5Syz155240
113ab25eeb5Syz155240
114ab25eeb5Syz155240 #if !defined(lint)
115ab25eeb5Syz155240 static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed";
116ab25eeb5Syz155240 static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.186.2.36 2005/08/11 19:58:03 darrenr Exp $";
117ab25eeb5Syz155240 #endif
118ab25eeb5Syz155240
119ab25eeb5Syz155240 #ifdef USE_INET6
120ab25eeb5Syz155240 static ipstate_t *fr_checkicmp6matchingstate __P((fr_info_t *));
121ab25eeb5Syz155240 #endif
122ab25eeb5Syz155240 static ipstate_t *fr_matchsrcdst __P((fr_info_t *, ipstate_t *, i6addr_t *,
123ab25eeb5Syz155240 i6addr_t *, tcphdr_t *, u_32_t));
124ab25eeb5Syz155240 static ipstate_t *fr_checkicmpmatchingstate __P((fr_info_t *));
125f4b3ec61Sdh155122 static int fr_state_flush __P((int, int, ipf_stack_t *));
126f4b3ec61Sdh155122 static ips_stat_t *fr_statetstats __P((ipf_stack_t *));
127f4b3ec61Sdh155122 static int fr_state_remove __P((caddr_t, ipf_stack_t *));
128f4b3ec61Sdh155122 static void fr_ipsmove __P((ipstate_t *, u_int, ipf_stack_t *));
129ab25eeb5Syz155240 static int fr_tcpstate __P((fr_info_t *, tcphdr_t *, ipstate_t *));
130ab25eeb5Syz155240 static int fr_tcpoptions __P((fr_info_t *, tcphdr_t *, tcpdata_t *));
131ab25eeb5Syz155240 static ipstate_t *fr_stclone __P((fr_info_t *, tcphdr_t *, ipstate_t *));
132ab25eeb5Syz155240 static void fr_fixinisn __P((fr_info_t *, ipstate_t *));
133ab25eeb5Syz155240 static void fr_fixoutisn __P((fr_info_t *, ipstate_t *));
134ab25eeb5Syz155240 static void fr_checknewisn __P((fr_info_t *, ipstate_t *));
135f4b3ec61Sdh155122 static int fr_stateiter __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *));
136ab25eeb5Syz155240
137f4b3ec61Sdh155122 int fr_stputent __P((caddr_t, ipf_stack_t *));
138f4b3ec61Sdh155122 int fr_stgetent __P((caddr_t, ipf_stack_t *));
139ab25eeb5Syz155240
140ab25eeb5Syz155240 #define ONE_DAY IPF_TTLVAL(1 * 86400) /* 1 day */
141ab25eeb5Syz155240 #define FIVE_DAYS (5 * ONE_DAY)
142f4b3ec61Sdh155122 #define DOUBLE_HASH(x, ifs) \
143f4b3ec61Sdh155122 (((x) + ifs->ifs_ips_seed[(x) % ifs->ifs_fr_statesize]) % ifs->ifs_fr_statesize)
144ab25eeb5Syz155240
145ab25eeb5Syz155240
146ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
147ab25eeb5Syz155240 /* Function: fr_stateinit */
148ab25eeb5Syz155240 /* Returns: int - 0 == success, -1 == failure */
149ea8244dcSJohn Ojemann /* Parameters: ifs - ipf stack instance */
150ab25eeb5Syz155240 /* */
151ab25eeb5Syz155240 /* Initialise all the global variables used within the state code. */
152ab25eeb5Syz155240 /* This action also includes initiailising locks. */
153ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_stateinit(ifs)154f4b3ec61Sdh155122 int fr_stateinit(ifs)
155f4b3ec61Sdh155122 ipf_stack_t *ifs;
156ab25eeb5Syz155240 {
157ab073b32Sdr146992 #if defined(NEED_LOCAL_RAND) || !defined(_KERNEL)
158ab073b32Sdr146992 struct timeval tv;
159ab073b32Sdr146992 #endif
160ab25eeb5Syz155240 int i;
161ab25eeb5Syz155240
162f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_ips_table, ipstate_t **,
163f4b3ec61Sdh155122 ifs->ifs_fr_statesize * sizeof(ipstate_t *));
164f4b3ec61Sdh155122 if (ifs->ifs_ips_table == NULL)
165f4b3ec61Sdh155122 return -1;
166f4b3ec61Sdh155122 bzero((char *)ifs->ifs_ips_table,
167f4b3ec61Sdh155122 ifs->ifs_fr_statesize * sizeof(ipstate_t *));
168f4b3ec61Sdh155122
169f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_ips_seed, u_long *,
170f4b3ec61Sdh155122 ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_seed));
171f4b3ec61Sdh155122 if (ifs->ifs_ips_seed == NULL)
172ab25eeb5Syz155240 return -2;
173ab073b32Sdr146992 #if defined(NEED_LOCAL_RAND) || !defined(_KERNEL)
174ab073b32Sdr146992 tv.tv_sec = 0;
175ab073b32Sdr146992 GETKTIME(&tv);
176ab073b32Sdr146992 #endif
177f4b3ec61Sdh155122 for (i = 0; i < ifs->ifs_fr_statesize; i++) {
178ab25eeb5Syz155240 /*
179ab25eeb5Syz155240 * XXX - ips_seed[X] should be a random number of sorts.
180ab25eeb5Syz155240 */
181ab073b32Sdr146992 #if !defined(NEED_LOCAL_RAND) && defined(_KERNEL)
182ab073b32Sdr146992 ifs->ifs_ips_seed[i] = ipf_random();
183ab25eeb5Syz155240 #else
184f4b3ec61Sdh155122 ifs->ifs_ips_seed[i] = ((u_long)ifs->ifs_ips_seed + i) *
185f4b3ec61Sdh155122 ifs->ifs_fr_statesize;
186ab073b32Sdr146992 ifs->ifs_ips_seed[i] += tv.tv_sec;
187f4b3ec61Sdh155122 ifs->ifs_ips_seed[i] *= (u_long)ifs->ifs_ips_seed;
188f4b3ec61Sdh155122 ifs->ifs_ips_seed[i] ^= 0x5a5aa5a5;
189f4b3ec61Sdh155122 ifs->ifs_ips_seed[i] *= ifs->ifs_fr_statemax;
190ab25eeb5Syz155240 #endif
191ab25eeb5Syz155240 }
192ab25eeb5Syz155240
193ab25eeb5Syz155240 /* fill icmp reply type table */
194ab25eeb5Syz155240 for (i = 0; i <= ICMP_MAXTYPE; i++)
195ab25eeb5Syz155240 icmpreplytype4[i] = -1;
196ab25eeb5Syz155240 icmpreplytype4[ICMP_ECHO] = ICMP_ECHOREPLY;
197ab25eeb5Syz155240 icmpreplytype4[ICMP_TSTAMP] = ICMP_TSTAMPREPLY;
198ab25eeb5Syz155240 icmpreplytype4[ICMP_IREQ] = ICMP_IREQREPLY;
199ab25eeb5Syz155240 icmpreplytype4[ICMP_MASKREQ] = ICMP_MASKREPLY;
200ab25eeb5Syz155240 #ifdef USE_INET6
201ab25eeb5Syz155240 /* fill icmp reply type table */
202ab25eeb5Syz155240 for (i = 0; i <= ICMP6_MAXTYPE; i++)
203ab25eeb5Syz155240 icmpreplytype6[i] = -1;
204ab25eeb5Syz155240 icmpreplytype6[ICMP6_ECHO_REQUEST] = ICMP6_ECHO_REPLY;
205ab25eeb5Syz155240 icmpreplytype6[ICMP6_MEMBERSHIP_QUERY] = ICMP6_MEMBERSHIP_REPORT;
206ab25eeb5Syz155240 icmpreplytype6[ICMP6_NI_QUERY] = ICMP6_NI_REPLY;
207ab25eeb5Syz155240 icmpreplytype6[ND_ROUTER_SOLICIT] = ND_ROUTER_ADVERT;
208ab25eeb5Syz155240 icmpreplytype6[ND_NEIGHBOR_SOLICIT] = ND_NEIGHBOR_ADVERT;
209ab25eeb5Syz155240 #endif
210ab25eeb5Syz155240
211f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_ips_stats.iss_bucketlen, u_long *,
212f4b3ec61Sdh155122 ifs->ifs_fr_statesize * sizeof(u_long));
213f4b3ec61Sdh155122 if (ifs->ifs_ips_stats.iss_bucketlen == NULL)
214ab25eeb5Syz155240 return -1;
215f4b3ec61Sdh155122 bzero((char *)ifs->ifs_ips_stats.iss_bucketlen,
216f4b3ec61Sdh155122 ifs->ifs_fr_statesize * sizeof(u_long));
217ab25eeb5Syz155240
218f4b3ec61Sdh155122 if (ifs->ifs_fr_state_maxbucket == 0) {
219f4b3ec61Sdh155122 for (i = ifs->ifs_fr_statesize; i > 0; i >>= 1)
220f4b3ec61Sdh155122 ifs->ifs_fr_state_maxbucket++;
221f4b3ec61Sdh155122 ifs->ifs_fr_state_maxbucket *= 2;
222ab25eeb5Syz155240 }
223ab25eeb5Syz155240
224f4b3ec61Sdh155122 fr_sttab_init(ifs->ifs_ips_tqtqb, ifs);
225f4b3ec61Sdh155122 ifs->ifs_ips_tqtqb[IPF_TCP_NSTATES - 1].ifq_next = &ifs->ifs_ips_udptq;
226f4b3ec61Sdh155122 ifs->ifs_ips_udptq.ifq_ttl = (u_long)ifs->ifs_fr_udptimeout;
227f4b3ec61Sdh155122 ifs->ifs_ips_udptq.ifq_ref = 1;
228f4b3ec61Sdh155122 ifs->ifs_ips_udptq.ifq_head = NULL;
229f4b3ec61Sdh155122 ifs->ifs_ips_udptq.ifq_tail = &ifs->ifs_ips_udptq.ifq_head;
230f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ips_udptq.ifq_lock, "ipftq udp tab");
231f4b3ec61Sdh155122 ifs->ifs_ips_udptq.ifq_next = &ifs->ifs_ips_udpacktq;
232f4b3ec61Sdh155122 ifs->ifs_ips_udpacktq.ifq_ttl = (u_long)ifs->ifs_fr_udpacktimeout;
233f4b3ec61Sdh155122 ifs->ifs_ips_udpacktq.ifq_ref = 1;
234f4b3ec61Sdh155122 ifs->ifs_ips_udpacktq.ifq_head = NULL;
235f4b3ec61Sdh155122 ifs->ifs_ips_udpacktq.ifq_tail = &ifs->ifs_ips_udpacktq.ifq_head;
236f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ips_udpacktq.ifq_lock, "ipftq udpack tab");
237f4b3ec61Sdh155122 ifs->ifs_ips_udpacktq.ifq_next = &ifs->ifs_ips_icmptq;
238f4b3ec61Sdh155122 ifs->ifs_ips_icmptq.ifq_ttl = (u_long)ifs->ifs_fr_icmptimeout;
239f4b3ec61Sdh155122 ifs->ifs_ips_icmptq.ifq_ref = 1;
240f4b3ec61Sdh155122 ifs->ifs_ips_icmptq.ifq_head = NULL;
241f4b3ec61Sdh155122 ifs->ifs_ips_icmptq.ifq_tail = &ifs->ifs_ips_icmptq.ifq_head;
242f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ips_icmptq.ifq_lock, "ipftq icmp tab");
243f4b3ec61Sdh155122 ifs->ifs_ips_icmptq.ifq_next = &ifs->ifs_ips_icmpacktq;
244f4b3ec61Sdh155122 ifs->ifs_ips_icmpacktq.ifq_ttl = (u_long)ifs->ifs_fr_icmpacktimeout;
245f4b3ec61Sdh155122 ifs->ifs_ips_icmpacktq.ifq_ref = 1;
246f4b3ec61Sdh155122 ifs->ifs_ips_icmpacktq.ifq_head = NULL;
247f4b3ec61Sdh155122 ifs->ifs_ips_icmpacktq.ifq_tail = &ifs->ifs_ips_icmpacktq.ifq_head;
248f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ips_icmpacktq.ifq_lock, "ipftq icmpack tab");
249f4b3ec61Sdh155122 ifs->ifs_ips_icmpacktq.ifq_next = &ifs->ifs_ips_iptq;
250f4b3ec61Sdh155122 ifs->ifs_ips_iptq.ifq_ttl = (u_long)ifs->ifs_fr_iptimeout;
251f4b3ec61Sdh155122 ifs->ifs_ips_iptq.ifq_ref = 1;
252f4b3ec61Sdh155122 ifs->ifs_ips_iptq.ifq_head = NULL;
253f4b3ec61Sdh155122 ifs->ifs_ips_iptq.ifq_tail = &ifs->ifs_ips_iptq.ifq_head;
254f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ips_iptq.ifq_lock, "ipftq ip tab");
2551e6b25a4San207044 ifs->ifs_ips_iptq.ifq_next = &ifs->ifs_ips_deletetq;
2561e6b25a4San207044 /* entry's ttl in deletetq is just 1 tick */
2571e6b25a4San207044 ifs->ifs_ips_deletetq.ifq_ttl = (u_long) 1;
2581e6b25a4San207044 ifs->ifs_ips_deletetq.ifq_ref = 1;
2591e6b25a4San207044 ifs->ifs_ips_deletetq.ifq_head = NULL;
2601e6b25a4San207044 ifs->ifs_ips_deletetq.ifq_tail = &ifs->ifs_ips_deletetq.ifq_head;
2611e6b25a4San207044 MUTEX_INIT(&ifs->ifs_ips_deletetq.ifq_lock, "state delete queue");
2621e6b25a4San207044 ifs->ifs_ips_deletetq.ifq_next = NULL;
263ab25eeb5Syz155240
264f4b3ec61Sdh155122 RWLOCK_INIT(&ifs->ifs_ipf_state, "ipf IP state rwlock");
265f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ipf_stinsert, "ipf state insert mutex");
266f4b3ec61Sdh155122 ifs->ifs_fr_state_init = 1;
267ab25eeb5Syz155240
268f4b3ec61Sdh155122 ifs->ifs_ips_last_force_flush = ifs->ifs_fr_ticks;
269ab25eeb5Syz155240 return 0;
270ab25eeb5Syz155240 }
271ab25eeb5Syz155240
272ab25eeb5Syz155240
273ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
274ab25eeb5Syz155240 /* Function: fr_stateunload */
275ab25eeb5Syz155240 /* Returns: Nil */
276ea8244dcSJohn Ojemann /* Parameters: ifs - ipf stack instance */
277ab25eeb5Syz155240 /* */
278ab25eeb5Syz155240 /* Release and destroy any resources acquired or initialised so that */
279ab25eeb5Syz155240 /* IPFilter can be unloaded or re-initialised. */
280ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_stateunload(ifs)281f4b3ec61Sdh155122 void fr_stateunload(ifs)
282f4b3ec61Sdh155122 ipf_stack_t *ifs;
283ab25eeb5Syz155240 {
284ab25eeb5Syz155240 ipftq_t *ifq, *ifqnext;
285ab25eeb5Syz155240 ipstate_t *is;
286ab25eeb5Syz155240
287f4b3ec61Sdh155122 while ((is = ifs->ifs_ips_list) != NULL)
288ea8244dcSJohn Ojemann (void) fr_delstate(is, 0, ifs);
289ab25eeb5Syz155240
290ab25eeb5Syz155240 /*
291ab25eeb5Syz155240 * Proxy timeout queues are not cleaned here because although they
292ab25eeb5Syz155240 * exist on the state list, appr_unload is called after fr_stateunload
293ab25eeb5Syz155240 * and the proxies actually are responsible for them being created.
294ab25eeb5Syz155240 * Should the proxy timeouts have their own list? There's no real
295ab25eeb5Syz155240 * justification as this is the only complicationA
296ab25eeb5Syz155240 */
297f4b3ec61Sdh155122 for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) {
298ab25eeb5Syz155240 ifqnext = ifq->ifq_next;
299ab25eeb5Syz155240 if (((ifq->ifq_flags & IFQF_PROXY) == 0) &&
300ab25eeb5Syz155240 (fr_deletetimeoutqueue(ifq) == 0))
301f4b3ec61Sdh155122 fr_freetimeoutqueue(ifq, ifs);
302ab25eeb5Syz155240 }
303ab25eeb5Syz155240
304f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_inuse = 0;
305f4b3ec61Sdh155122 ifs->ifs_ips_num = 0;
306ab25eeb5Syz155240
307f4b3ec61Sdh155122 if (ifs->ifs_fr_state_init == 1) {
308f4b3ec61Sdh155122 fr_sttab_destroy(ifs->ifs_ips_tqtqb);
309f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ips_udptq.ifq_lock);
310f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ips_icmptq.ifq_lock);
311f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ips_udpacktq.ifq_lock);
312f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ips_icmpacktq.ifq_lock);
313f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ips_iptq.ifq_lock);
3141e6b25a4San207044 MUTEX_DESTROY(&ifs->ifs_ips_deletetq.ifq_lock);
315ab25eeb5Syz155240 }
316ab25eeb5Syz155240
317f4b3ec61Sdh155122 if (ifs->ifs_ips_table != NULL) {
318f4b3ec61Sdh155122 KFREES(ifs->ifs_ips_table,
319f4b3ec61Sdh155122 ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_table));
320f4b3ec61Sdh155122 ifs->ifs_ips_table = NULL;
321ab25eeb5Syz155240 }
322ab25eeb5Syz155240
323f4b3ec61Sdh155122 if (ifs->ifs_ips_seed != NULL) {
324f4b3ec61Sdh155122 KFREES(ifs->ifs_ips_seed,
325f4b3ec61Sdh155122 ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_seed));
326f4b3ec61Sdh155122 ifs->ifs_ips_seed = NULL;
327ab25eeb5Syz155240 }
328ab25eeb5Syz155240
329f4b3ec61Sdh155122 if (ifs->ifs_ips_stats.iss_bucketlen != NULL) {
330f4b3ec61Sdh155122 KFREES(ifs->ifs_ips_stats.iss_bucketlen,
331f4b3ec61Sdh155122 ifs->ifs_fr_statesize * sizeof(u_long));
332f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_bucketlen = NULL;
333ab25eeb5Syz155240 }
334ab25eeb5Syz155240
335f4b3ec61Sdh155122 if (ifs->ifs_fr_state_maxbucket_reset == 1)
336f4b3ec61Sdh155122 ifs->ifs_fr_state_maxbucket = 0;
337ab25eeb5Syz155240
338f4b3ec61Sdh155122 if (ifs->ifs_fr_state_init == 1) {
339f4b3ec61Sdh155122 ifs->ifs_fr_state_init = 0;
340f4b3ec61Sdh155122 RW_DESTROY(&ifs->ifs_ipf_state);
341f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ipf_stinsert);
342ab25eeb5Syz155240 }
343ab25eeb5Syz155240 }
344ab25eeb5Syz155240
345ab25eeb5Syz155240
346ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
347ab25eeb5Syz155240 /* Function: fr_statetstats */
348ab25eeb5Syz155240 /* Returns: ips_state_t* - pointer to state stats structure */
349ab25eeb5Syz155240 /* Parameters: Nil */
350ab25eeb5Syz155240 /* */
351ab25eeb5Syz155240 /* Put all the current numbers and pointers into a single struct and return */
352ab25eeb5Syz155240 /* a pointer to it. */
353ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_statetstats(ifs)354f4b3ec61Sdh155122 static ips_stat_t *fr_statetstats(ifs)
355f4b3ec61Sdh155122 ipf_stack_t *ifs;
356ab25eeb5Syz155240 {
357f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_active = ifs->ifs_ips_num;
358f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_statesize = ifs->ifs_fr_statesize;
359f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_statemax = ifs->ifs_fr_statemax;
360f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_table = ifs->ifs_ips_table;
361f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_list = ifs->ifs_ips_list;
362f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_ticks = ifs->ifs_fr_ticks;
363f4b3ec61Sdh155122 return &ifs->ifs_ips_stats;
364ab25eeb5Syz155240 }
365ab25eeb5Syz155240
366ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
367ab25eeb5Syz155240 /* Function: fr_state_remove */
368ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 == failure */
369ab25eeb5Syz155240 /* Parameters: data(I) - pointer to state structure to delete from table */
370ea8244dcSJohn Ojemann /* ifs - ipf stack instance */
371ab25eeb5Syz155240 /* */
372ab25eeb5Syz155240 /* Search for a state structure that matches the one passed, according to */
373ab25eeb5Syz155240 /* the IP addresses and other protocol specific information. */
374ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_state_remove(data,ifs)375f4b3ec61Sdh155122 static int fr_state_remove(data, ifs)
376ab25eeb5Syz155240 caddr_t data;
377f4b3ec61Sdh155122 ipf_stack_t *ifs;
378ab25eeb5Syz155240 {
379ab25eeb5Syz155240 ipstate_t *sp, st;
380ab25eeb5Syz155240 int error;
381ab25eeb5Syz155240
382ab25eeb5Syz155240 sp = &st;
383ab25eeb5Syz155240 error = fr_inobj(data, &st, IPFOBJ_IPSTATE);
384ab25eeb5Syz155240 if (error)
385ab25eeb5Syz155240 return EFAULT;
386ab25eeb5Syz155240
387f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state);
388f4b3ec61Sdh155122 for (sp = ifs->ifs_ips_list; sp; sp = sp->is_next)
389ab25eeb5Syz155240 if ((sp->is_p == st.is_p) && (sp->is_v == st.is_v) &&
390ab25eeb5Syz155240 !bcmp((caddr_t)&sp->is_src, (caddr_t)&st.is_src,
391ab25eeb5Syz155240 sizeof(st.is_src)) &&
39290907f62SJohn Ojemann !bcmp((caddr_t)&sp->is_dst, (caddr_t)&st.is_dst,
393ab25eeb5Syz155240 sizeof(st.is_dst)) &&
394ab25eeb5Syz155240 !bcmp((caddr_t)&sp->is_ps, (caddr_t)&st.is_ps,
395ab25eeb5Syz155240 sizeof(st.is_ps))) {
396ea8244dcSJohn Ojemann (void) fr_delstate(sp, ISL_REMOVE, ifs);
397f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
398ab25eeb5Syz155240 return 0;
399ab25eeb5Syz155240 }
400f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
401ab25eeb5Syz155240 return ESRCH;
402ab25eeb5Syz155240 }
403ab25eeb5Syz155240
404ab25eeb5Syz155240
405ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
406ab25eeb5Syz155240 /* Function: fr_state_ioctl */
407ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 == failure */
408ab25eeb5Syz155240 /* Parameters: data(I) - pointer to ioctl data */
409ab25eeb5Syz155240 /* cmd(I) - ioctl command integer */
410ab25eeb5Syz155240 /* mode(I) - file mode bits used with open */
411ea8244dcSJohn Ojemann /* uid(I) - uid of caller */
412ea8244dcSJohn Ojemann /* ctx(I) - pointer to give the uid context */
413ea8244dcSJohn Ojemann /* ifs - ipf stack instance */
414ab25eeb5Syz155240 /* */
415ab25eeb5Syz155240 /* Processes an ioctl call made to operate on the IP Filter state device. */
416ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_state_ioctl(data,cmd,mode,uid,ctx,ifs)417f4b3ec61Sdh155122 int fr_state_ioctl(data, cmd, mode, uid, ctx, ifs)
418ab25eeb5Syz155240 caddr_t data;
419ab25eeb5Syz155240 ioctlcmd_t cmd;
420f4b3ec61Sdh155122 int mode, uid;
421f4b3ec61Sdh155122 void *ctx;
422f4b3ec61Sdh155122 ipf_stack_t *ifs;
423ab25eeb5Syz155240 {
424ab25eeb5Syz155240 int arg, ret, error = 0;
425ab25eeb5Syz155240
426ab25eeb5Syz155240 switch (cmd)
427ab25eeb5Syz155240 {
428ab25eeb5Syz155240 /*
429ab25eeb5Syz155240 * Delete an entry from the state table.
430ab25eeb5Syz155240 */
431ab25eeb5Syz155240 case SIOCDELST :
432f4b3ec61Sdh155122 error = fr_state_remove(data, ifs);
433ab25eeb5Syz155240 break;
434ab25eeb5Syz155240 /*
435ab25eeb5Syz155240 * Flush the state table
436ab25eeb5Syz155240 */
437ab25eeb5Syz155240 case SIOCIPFFL :
438bb1d9de5SJohn Ojemann error = BCOPYIN(data, (char *)&arg, sizeof(arg));
439bb1d9de5SJohn Ojemann if (error != 0) {
440bb1d9de5SJohn Ojemann error = EFAULT;
441bb1d9de5SJohn Ojemann } else {
442ea8244dcSJohn Ojemann if (VALID_TABLE_FLUSH_OPT(arg)) {
443f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state);
444f4b3ec61Sdh155122 ret = fr_state_flush(arg, 4, ifs);
445f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
446bb1d9de5SJohn Ojemann error = BCOPYOUT((char *)&ret, data,
447bb1d9de5SJohn Ojemann sizeof(ret));
448bb1d9de5SJohn Ojemann if (error != 0)
449bb1d9de5SJohn Ojemann return EFAULT;
450bb1d9de5SJohn Ojemann } else {
451ab25eeb5Syz155240 error = EINVAL;
452bb1d9de5SJohn Ojemann }
453bb1d9de5SJohn Ojemann }
454ab25eeb5Syz155240 break;
455bb1d9de5SJohn Ojemann
456ab25eeb5Syz155240 #ifdef USE_INET6
457ab25eeb5Syz155240 case SIOCIPFL6 :
458bb1d9de5SJohn Ojemann error = BCOPYIN(data, (char *)&arg, sizeof(arg));
459bb1d9de5SJohn Ojemann if (error != 0) {
460bb1d9de5SJohn Ojemann error = EFAULT;
461bb1d9de5SJohn Ojemann } else {
462ea8244dcSJohn Ojemann if (VALID_TABLE_FLUSH_OPT(arg)) {
463f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state);
464f4b3ec61Sdh155122 ret = fr_state_flush(arg, 6, ifs);
465f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
466bb1d9de5SJohn Ojemann error = BCOPYOUT((char *)&ret, data,
467bb1d9de5SJohn Ojemann sizeof(ret));
468bb1d9de5SJohn Ojemann if (error != 0)
469bb1d9de5SJohn Ojemann return EFAULT;
470bb1d9de5SJohn Ojemann } else {
471ab25eeb5Syz155240 error = EINVAL;
472bb1d9de5SJohn Ojemann }
473bb1d9de5SJohn Ojemann }
474ab25eeb5Syz155240 break;
475ab25eeb5Syz155240 #endif
476ab25eeb5Syz155240 #ifdef IPFILTER_LOG
477ab25eeb5Syz155240 /*
478ab25eeb5Syz155240 * Flush the state log.
479ab25eeb5Syz155240 */
480ab25eeb5Syz155240 case SIOCIPFFB :
481ab25eeb5Syz155240 if (!(mode & FWRITE))
482ab25eeb5Syz155240 error = EPERM;
483ab25eeb5Syz155240 else {
484ab25eeb5Syz155240 int tmp;
485ab25eeb5Syz155240
486f4b3ec61Sdh155122 tmp = ipflog_clear(IPL_LOGSTATE, ifs);
487bb1d9de5SJohn Ojemann error = BCOPYOUT((char *)&tmp, data, sizeof(tmp));
488bb1d9de5SJohn Ojemann if (error != 0)
489bb1d9de5SJohn Ojemann error = EFAULT;
490ab25eeb5Syz155240 }
491ab25eeb5Syz155240 break;
492ab25eeb5Syz155240 /*
493ab25eeb5Syz155240 * Turn logging of state information on/off.
494ab25eeb5Syz155240 */
495ab25eeb5Syz155240 case SIOCSETLG :
496bb1d9de5SJohn Ojemann if (!(mode & FWRITE)) {
497ab25eeb5Syz155240 error = EPERM;
498bb1d9de5SJohn Ojemann } else {
499bb1d9de5SJohn Ojemann error = BCOPYIN((char *)data,
500f4b3ec61Sdh155122 (char *)&ifs->ifs_ipstate_logging,
501f4b3ec61Sdh155122 sizeof(ifs->ifs_ipstate_logging));
502bb1d9de5SJohn Ojemann if (error != 0)
503bb1d9de5SJohn Ojemann error = EFAULT;
504ab25eeb5Syz155240 }
505ab25eeb5Syz155240 break;
506ab25eeb5Syz155240 /*
507ab25eeb5Syz155240 * Return the current state of logging.
508ab25eeb5Syz155240 */
509ab25eeb5Syz155240 case SIOCGETLG :
510bb1d9de5SJohn Ojemann error = BCOPYOUT((char *)&ifs->ifs_ipstate_logging,
511bb1d9de5SJohn Ojemann (char *)data,
512f4b3ec61Sdh155122 sizeof(ifs->ifs_ipstate_logging));
513bb1d9de5SJohn Ojemann if (error != 0)
514bb1d9de5SJohn Ojemann error = EFAULT;
515ab25eeb5Syz155240 break;
516ab25eeb5Syz155240 /*
517ab25eeb5Syz155240 * Return the number of bytes currently waiting to be read.
518ab25eeb5Syz155240 */
519ab25eeb5Syz155240 case FIONREAD :
520f4b3ec61Sdh155122 arg = ifs->ifs_iplused[IPL_LOGSTATE]; /* returned in an int */
521bb1d9de5SJohn Ojemann error = BCOPYOUT((char *)&arg, data, sizeof(arg));
522bb1d9de5SJohn Ojemann if (error != 0)
523bb1d9de5SJohn Ojemann error = EFAULT;
524ab25eeb5Syz155240 break;
525ab25eeb5Syz155240 #endif
526ab25eeb5Syz155240 /*
527ab25eeb5Syz155240 * Get the current state statistics.
528ab25eeb5Syz155240 */
529ab25eeb5Syz155240 case SIOCGETFS :
530f4b3ec61Sdh155122 error = fr_outobj(data, fr_statetstats(ifs), IPFOBJ_STATESTAT);
531ab25eeb5Syz155240 break;
532ab25eeb5Syz155240 /*
533ab25eeb5Syz155240 * Lock/Unlock the state table. (Locking prevents any changes, which
534ab25eeb5Syz155240 * means no packets match).
535ab25eeb5Syz155240 */
536ab25eeb5Syz155240 case SIOCSTLCK :
537ab25eeb5Syz155240 if (!(mode & FWRITE)) {
538ab25eeb5Syz155240 error = EPERM;
539ab25eeb5Syz155240 } else {
540bb1d9de5SJohn Ojemann error = fr_lock(data, &ifs->ifs_fr_state_lock);
541ab25eeb5Syz155240 }
542ab25eeb5Syz155240 break;
543ab25eeb5Syz155240 /*
544ab25eeb5Syz155240 * Add an entry to the current state table.
545ab25eeb5Syz155240 */
546ab25eeb5Syz155240 case SIOCSTPUT :
547f4b3ec61Sdh155122 if (!ifs->ifs_fr_state_lock || !(mode & FWRITE)) {
548ab25eeb5Syz155240 error = EACCES;
549ab25eeb5Syz155240 break;
550ab25eeb5Syz155240 }
551f4b3ec61Sdh155122 error = fr_stputent(data, ifs);
552ab25eeb5Syz155240 break;
553ab25eeb5Syz155240 /*
554ab25eeb5Syz155240 * Get a state table entry.
555ab25eeb5Syz155240 */
556ab25eeb5Syz155240 case SIOCSTGET :
557f4b3ec61Sdh155122 if (!ifs->ifs_fr_state_lock) {
558ab25eeb5Syz155240 error = EACCES;
559ab25eeb5Syz155240 break;
560ab25eeb5Syz155240 }
561f4b3ec61Sdh155122 error = fr_stgetent(data, ifs);
562ab25eeb5Syz155240 break;
563f4b3ec61Sdh155122
564f4b3ec61Sdh155122 case SIOCGENITER :
565f4b3ec61Sdh155122 {
566f4b3ec61Sdh155122 ipftoken_t *token;
567f4b3ec61Sdh155122 ipfgeniter_t iter;
568f4b3ec61Sdh155122
569f4b3ec61Sdh155122 error = fr_inobj(data, &iter, IPFOBJ_GENITER);
570f4b3ec61Sdh155122 if (error != 0)
571f4b3ec61Sdh155122 break;
572f4b3ec61Sdh155122
573f4b3ec61Sdh155122 token = ipf_findtoken(IPFGENITER_STATE, uid, ctx, ifs);
574f4b3ec61Sdh155122 if (token != NULL)
575f4b3ec61Sdh155122 error = fr_stateiter(token, &iter, ifs);
576f4b3ec61Sdh155122 else
577f4b3ec61Sdh155122 error = ESRCH;
578f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_tokens);
579f4b3ec61Sdh155122 break;
580f4b3ec61Sdh155122 }
581f4b3ec61Sdh155122
582f4b3ec61Sdh155122 case SIOCIPFDELTOK :
583bb1d9de5SJohn Ojemann error = BCOPYIN(data, (char *)&arg, sizeof(arg));
584bb1d9de5SJohn Ojemann if (error != 0) {
585bb1d9de5SJohn Ojemann error = EFAULT;
586bb1d9de5SJohn Ojemann } else {
587f4b3ec61Sdh155122 error = ipf_deltoken(arg, uid, ctx, ifs);
588bb1d9de5SJohn Ojemann }
589f4b3ec61Sdh155122 break;
590f4b3ec61Sdh155122
591ab25eeb5Syz155240 default :
592ab25eeb5Syz155240 error = EINVAL;
593ab25eeb5Syz155240 break;
594ab25eeb5Syz155240 }
595ab25eeb5Syz155240 return error;
596ab25eeb5Syz155240 }
597ab25eeb5Syz155240
598ab25eeb5Syz155240
599ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
600ab25eeb5Syz155240 /* Function: fr_stgetent */
601ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 == failure */
602ab25eeb5Syz155240 /* Parameters: data(I) - pointer to state structure to retrieve from table */
603ab25eeb5Syz155240 /* */
604ab25eeb5Syz155240 /* Copy out state information from the kernel to a user space process. If */
605ab25eeb5Syz155240 /* there is a filter rule associated with the state entry, copy that out */
606ab25eeb5Syz155240 /* as well. The entry to copy out is taken from the value of "ips_next" in */
607ab25eeb5Syz155240 /* the struct passed in and if not null and not found in the list of current*/
608ab25eeb5Syz155240 /* state entries, the retrieval fails. */
609ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_stgetent(data,ifs)610f4b3ec61Sdh155122 int fr_stgetent(data, ifs)
611ab25eeb5Syz155240 caddr_t data;
612f4b3ec61Sdh155122 ipf_stack_t *ifs;
613ab25eeb5Syz155240 {
614ab25eeb5Syz155240 ipstate_t *is, *isn;
615ab25eeb5Syz155240 ipstate_save_t ips;
616ab25eeb5Syz155240 int error;
617ab25eeb5Syz155240
618ab25eeb5Syz155240 error = fr_inobj(data, &ips, IPFOBJ_STATESAVE);
619ab25eeb5Syz155240 if (error)
620ab25eeb5Syz155240 return EFAULT;
621ab25eeb5Syz155240
622ab25eeb5Syz155240 isn = ips.ips_next;
623ab25eeb5Syz155240 if (isn == NULL) {
624f4b3ec61Sdh155122 isn = ifs->ifs_ips_list;
625ab25eeb5Syz155240 if (isn == NULL) {
626ab25eeb5Syz155240 if (ips.ips_next == NULL)
627ab25eeb5Syz155240 return ENOENT;
628ab25eeb5Syz155240 return 0;
629ab25eeb5Syz155240 }
630ab25eeb5Syz155240 } else {
631ab25eeb5Syz155240 /*
632ab25eeb5Syz155240 * Make sure the pointer we're copying from exists in the
633ab25eeb5Syz155240 * current list of entries. Security precaution to prevent
634ab25eeb5Syz155240 * copying of random kernel data.
635ab25eeb5Syz155240 */
636f4b3ec61Sdh155122 for (is = ifs->ifs_ips_list; is; is = is->is_next)
637ab25eeb5Syz155240 if (is == isn)
638ab25eeb5Syz155240 break;
639ab25eeb5Syz155240 if (!is)
640ab25eeb5Syz155240 return ESRCH;
641ab25eeb5Syz155240 }
642ab25eeb5Syz155240 ips.ips_next = isn->is_next;
643ab25eeb5Syz155240 bcopy((char *)isn, (char *)&ips.ips_is, sizeof(ips.ips_is));
644ab25eeb5Syz155240 ips.ips_rule = isn->is_rule;
645ab25eeb5Syz155240 if (isn->is_rule != NULL)
646ab25eeb5Syz155240 bcopy((char *)isn->is_rule, (char *)&ips.ips_fr,
647ab25eeb5Syz155240 sizeof(ips.ips_fr));
648ab25eeb5Syz155240 error = fr_outobj(data, &ips, IPFOBJ_STATESAVE);
649ab25eeb5Syz155240 if (error)
650ab25eeb5Syz155240 return EFAULT;
651ab25eeb5Syz155240 return 0;
652ab25eeb5Syz155240 }
653ab25eeb5Syz155240
654ab25eeb5Syz155240
655ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
656ab25eeb5Syz155240 /* Function: fr_stputent */
657ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 == failure */
658ab25eeb5Syz155240 /* Parameters: data(I) - pointer to state information struct */
659ea8244dcSJohn Ojemann /* ifs - ipf stack instance */
660ab25eeb5Syz155240 /* */
661ab25eeb5Syz155240 /* This function implements the SIOCSTPUT ioctl: insert a state entry into */
662ab25eeb5Syz155240 /* the state table. If the state info. includes a pointer to a filter rule */
663ab25eeb5Syz155240 /* then also add in an orphaned rule (will not show up in any "ipfstat -io" */
664ab25eeb5Syz155240 /* output. */
665ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_stputent(data,ifs)666f4b3ec61Sdh155122 int fr_stputent(data, ifs)
667ab25eeb5Syz155240 caddr_t data;
668f4b3ec61Sdh155122 ipf_stack_t *ifs;
669ab25eeb5Syz155240 {
670ab25eeb5Syz155240 ipstate_t *is, *isn;
671ab25eeb5Syz155240 ipstate_save_t ips;
672ab25eeb5Syz155240 int error, i;
673ab25eeb5Syz155240 frentry_t *fr;
674ab25eeb5Syz155240 char *name;
675ab25eeb5Syz155240
676ab25eeb5Syz155240 error = fr_inobj(data, &ips, IPFOBJ_STATESAVE);
677ab25eeb5Syz155240 if (error)
678ab25eeb5Syz155240 return EFAULT;
679ab25eeb5Syz155240
680ea8244dcSJohn Ojemann /*
681ea8244dcSJohn Ojemann * Trigger automatic call to fr_state_flush() if the
682ea8244dcSJohn Ojemann * table has reached capacity specified by hi watermark.
683ea8244dcSJohn Ojemann */
684ea8244dcSJohn Ojemann if (ST_TAB_WATER_LEVEL(ifs) > ifs->ifs_state_flush_level_hi)
685ea8244dcSJohn Ojemann ifs->ifs_fr_state_doflush = 1;
686ea8244dcSJohn Ojemann
687ea8244dcSJohn Ojemann /*
688ea8244dcSJohn Ojemann * If automatic flushing did not do its job, and the table
689ea8244dcSJohn Ojemann * has filled up, don't try to create a new entry.
690ea8244dcSJohn Ojemann */
691ea8244dcSJohn Ojemann if (ifs->ifs_ips_num >= ifs->ifs_fr_statemax) {
692ea8244dcSJohn Ojemann ATOMIC_INCL(ifs->ifs_ips_stats.iss_max);
693ea8244dcSJohn Ojemann return ENOMEM;
694ea8244dcSJohn Ojemann }
695ea8244dcSJohn Ojemann
696ab25eeb5Syz155240 KMALLOC(isn, ipstate_t *);
697ab25eeb5Syz155240 if (isn == NULL)
698ab25eeb5Syz155240 return ENOMEM;
699ab25eeb5Syz155240
700ab25eeb5Syz155240 bcopy((char *)&ips.ips_is, (char *)isn, sizeof(*isn));
701ab25eeb5Syz155240 bzero((char *)isn, offsetof(struct ipstate, is_pkts));
702ab25eeb5Syz155240 isn->is_sti.tqe_pnext = NULL;
703ab25eeb5Syz155240 isn->is_sti.tqe_next = NULL;
704ab25eeb5Syz155240 isn->is_sti.tqe_ifq = NULL;
705ab25eeb5Syz155240 isn->is_sti.tqe_parent = isn;
706ab25eeb5Syz155240 isn->is_ifp[0] = NULL;
707ab25eeb5Syz155240 isn->is_ifp[1] = NULL;
708ab25eeb5Syz155240 isn->is_ifp[2] = NULL;
709ab25eeb5Syz155240 isn->is_ifp[3] = NULL;
710ab25eeb5Syz155240 isn->is_sync = NULL;
711ab25eeb5Syz155240 fr = ips.ips_rule;
712ab25eeb5Syz155240
713ab25eeb5Syz155240 if (fr == NULL) {
714f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state);
715f4b3ec61Sdh155122 fr_stinsert(isn, 0, ifs);
716ab25eeb5Syz155240 MUTEX_EXIT(&isn->is_lock);
717f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
718ab25eeb5Syz155240 return 0;
719ab25eeb5Syz155240 }
720ab25eeb5Syz155240
721ab25eeb5Syz155240 if (isn->is_flags & SI_NEWFR) {
722ab25eeb5Syz155240 KMALLOC(fr, frentry_t *);
723ab25eeb5Syz155240 if (fr == NULL) {
724ab25eeb5Syz155240 KFREE(isn);
725ab25eeb5Syz155240 return ENOMEM;
726ab25eeb5Syz155240 }
727ab25eeb5Syz155240 bcopy((char *)&ips.ips_fr, (char *)fr, sizeof(*fr));
728ab25eeb5Syz155240 isn->is_rule = fr;
729ab25eeb5Syz155240 ips.ips_is.is_rule = fr;
730ab25eeb5Syz155240 MUTEX_NUKE(&fr->fr_lock);
731ab25eeb5Syz155240 MUTEX_INIT(&fr->fr_lock, "state filter rule lock");
732ab25eeb5Syz155240
733ab25eeb5Syz155240 /*
734ab25eeb5Syz155240 * Look up all the interface names in the rule.
735ab25eeb5Syz155240 */
736ab25eeb5Syz155240 for (i = 0; i < 4; i++) {
737ab25eeb5Syz155240 name = fr->fr_ifnames[i];
738f4b3ec61Sdh155122 fr->fr_ifas[i] = fr_resolvenic(name, fr->fr_v, ifs);
739ab25eeb5Syz155240 name = isn->is_ifname[i];
740f4b3ec61Sdh155122 isn->is_ifp[i] = fr_resolvenic(name, isn->is_v, ifs);
741ab25eeb5Syz155240 }
742ab25eeb5Syz155240
743ab25eeb5Syz155240 fr->fr_ref = 0;
744ab25eeb5Syz155240 fr->fr_dsize = 0;
745ab25eeb5Syz155240 fr->fr_data = NULL;
746cbded9aeSdr146992 fr->fr_type = FR_T_NONE;
747ab25eeb5Syz155240
748f4b3ec61Sdh155122 fr_resolvedest(&fr->fr_tif, fr->fr_v, ifs);
749f4b3ec61Sdh155122 fr_resolvedest(&fr->fr_dif, fr->fr_v, ifs);
750d3675867Sjojemann fr_resolvedest(&fr->fr_rif, fr->fr_v, ifs);
751ab25eeb5Syz155240
752ab25eeb5Syz155240 /*
753ab25eeb5Syz155240 * send a copy back to userland of what we ended up
754ab25eeb5Syz155240 * to allow for verification.
755ab25eeb5Syz155240 */
756ab25eeb5Syz155240 error = fr_outobj(data, &ips, IPFOBJ_STATESAVE);
757ab25eeb5Syz155240 if (error) {
758ab25eeb5Syz155240 KFREE(isn);
759ab25eeb5Syz155240 MUTEX_DESTROY(&fr->fr_lock);
760ab25eeb5Syz155240 KFREE(fr);
761ab25eeb5Syz155240 return EFAULT;
762ab25eeb5Syz155240 }
763f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state);
764f4b3ec61Sdh155122 fr_stinsert(isn, 0, ifs);
765ab25eeb5Syz155240 MUTEX_EXIT(&isn->is_lock);
766f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
767ab25eeb5Syz155240
768ab25eeb5Syz155240 } else {
769f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state);
770f4b3ec61Sdh155122 for (is = ifs->ifs_ips_list; is; is = is->is_next)
771ab25eeb5Syz155240 if (is->is_rule == fr) {
772f4b3ec61Sdh155122 fr_stinsert(isn, 0, ifs);
773ab25eeb5Syz155240 MUTEX_EXIT(&isn->is_lock);
774ab25eeb5Syz155240 break;
775ab25eeb5Syz155240 }
776ab25eeb5Syz155240
777ab25eeb5Syz155240 if (is == NULL) {
778ab25eeb5Syz155240 KFREE(isn);
779ab25eeb5Syz155240 isn = NULL;
780ab25eeb5Syz155240 }
781f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
782ab25eeb5Syz155240
783ab25eeb5Syz155240 return (isn == NULL) ? ESRCH : 0;
784ab25eeb5Syz155240 }
785ab25eeb5Syz155240
786ab25eeb5Syz155240 return 0;
787ab25eeb5Syz155240 }
788ab25eeb5Syz155240
789ab25eeb5Syz155240
790ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
791ab25eeb5Syz155240 /* Function: fr_stinsert */
792ab25eeb5Syz155240 /* Returns: Nil */
793ab25eeb5Syz155240 /* Parameters: is(I) - pointer to state structure */
794ab25eeb5Syz155240 /* rev(I) - flag indicating forward/reverse direction of packet */
795ab25eeb5Syz155240 /* */
796ab25eeb5Syz155240 /* Inserts a state structure into the hash table (for lookups) and the list */
797ab25eeb5Syz155240 /* of state entries (for enumeration). Resolves all of the interface names */
798ab25eeb5Syz155240 /* to pointers and adjusts running stats for the hash table as appropriate. */
799ab25eeb5Syz155240 /* */
800ab25eeb5Syz155240 /* Locking: it is assumed that some kind of lock on ipf_state is held. */
801ab25eeb5Syz155240 /* Exits with is_lock initialised and held. */
802ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_stinsert(is,rev,ifs)803f4b3ec61Sdh155122 void fr_stinsert(is, rev, ifs)
804ab25eeb5Syz155240 ipstate_t *is;
805ab25eeb5Syz155240 int rev;
806f4b3ec61Sdh155122 ipf_stack_t *ifs;
807ab25eeb5Syz155240 {
808ab25eeb5Syz155240 frentry_t *fr;
809ab25eeb5Syz155240 u_int hv;
810ab25eeb5Syz155240 int i;
811ab25eeb5Syz155240
812ab25eeb5Syz155240 MUTEX_INIT(&is->is_lock, "ipf state entry");
813ab25eeb5Syz155240
814ab25eeb5Syz155240 fr = is->is_rule;
815ab25eeb5Syz155240 if (fr != NULL) {
816ab25eeb5Syz155240 MUTEX_ENTER(&fr->fr_lock);
817ab25eeb5Syz155240 fr->fr_ref++;
818ab25eeb5Syz155240 fr->fr_statecnt++;
819ab25eeb5Syz155240 MUTEX_EXIT(&fr->fr_lock);
820ab25eeb5Syz155240 }
821ab25eeb5Syz155240
822ab25eeb5Syz155240 /*
823ab25eeb5Syz155240 * Look up all the interface names in the state entry.
824ab25eeb5Syz155240 */
825ab25eeb5Syz155240 for (i = 0; i < 4; i++) {
826ab25eeb5Syz155240 if (is->is_ifp[i] != NULL)
827ab25eeb5Syz155240 continue;
828f4b3ec61Sdh155122 is->is_ifp[i] = fr_resolvenic(is->is_ifname[i], is->is_v, ifs);
829ab25eeb5Syz155240 }
830ab25eeb5Syz155240
831ab25eeb5Syz155240 /*
832ab25eeb5Syz155240 * If we could trust is_hv, then the modulous would not be needed, but
833ab25eeb5Syz155240 * when running with IPFILTER_SYNC, this stops bad values.
834ab25eeb5Syz155240 */
835f4b3ec61Sdh155122 hv = is->is_hv % ifs->ifs_fr_statesize;
836ab25eeb5Syz155240 is->is_hv = hv;
837ab25eeb5Syz155240
838ab25eeb5Syz155240 /*
839ab25eeb5Syz155240 * We need to get both of these locks...the first because it is
840ab25eeb5Syz155240 * possible that once the insert is complete another packet might
841ab25eeb5Syz155240 * come along, match the entry and want to update it.
842ab25eeb5Syz155240 */
843ab25eeb5Syz155240 MUTEX_ENTER(&is->is_lock);
844f4b3ec61Sdh155122 MUTEX_ENTER(&ifs->ifs_ipf_stinsert);
845ab25eeb5Syz155240
846ab25eeb5Syz155240 /*
847ab25eeb5Syz155240 * add into list table.
848ab25eeb5Syz155240 */
849f4b3ec61Sdh155122 if (ifs->ifs_ips_list != NULL)
850f4b3ec61Sdh155122 ifs->ifs_ips_list->is_pnext = &is->is_next;
851f4b3ec61Sdh155122 is->is_pnext = &ifs->ifs_ips_list;
852f4b3ec61Sdh155122 is->is_next = ifs->ifs_ips_list;
853f4b3ec61Sdh155122 ifs->ifs_ips_list = is;
854ab25eeb5Syz155240
855f4b3ec61Sdh155122 if (ifs->ifs_ips_table[hv] != NULL)
856f4b3ec61Sdh155122 ifs->ifs_ips_table[hv]->is_phnext = &is->is_hnext;
857ab25eeb5Syz155240 else
858f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_inuse++;
859f4b3ec61Sdh155122 is->is_phnext = ifs->ifs_ips_table + hv;
860f4b3ec61Sdh155122 is->is_hnext = ifs->ifs_ips_table[hv];
861f4b3ec61Sdh155122 ifs->ifs_ips_table[hv] = is;
862f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_bucketlen[hv]++;
863f4b3ec61Sdh155122 ifs->ifs_ips_num++;
864f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_stinsert);
865ab25eeb5Syz155240
866f4b3ec61Sdh155122 fr_setstatequeue(is, rev, ifs);
867ab25eeb5Syz155240 }
868ab25eeb5Syz155240
86952239d04San207044 /* ------------------------------------------------------------------------ */
87052239d04San207044 /* Function: fr_match_ipv4addrs */
87152239d04San207044 /* Returns: int - 2 strong match (same addresses, same direction) */
87252239d04San207044 /* 1 weak match (same address, opposite direction) */
87352239d04San207044 /* 0 no match */
87452239d04San207044 /* */
87552239d04San207044 /* Function matches IPv4 addresses. */
87652239d04San207044 /* ------------------------------------------------------------------------ */
fr_match_ipv4addrs(is1,is2)87752239d04San207044 static int fr_match_ipv4addrs(is1, is2)
87852239d04San207044 ipstate_t *is1;
87952239d04San207044 ipstate_t *is2;
88052239d04San207044 {
88152239d04San207044 int rv;
88252239d04San207044
88352239d04San207044 if (is1->is_saddr == is2->is_saddr && is1->is_daddr == is2->is_daddr)
88452239d04San207044 rv = 2;
88552239d04San207044 else if (is1->is_saddr == is2->is_daddr &&
88652239d04San207044 is1->is_daddr == is2->is_saddr)
88752239d04San207044 rv = 1;
88852239d04San207044 else
88952239d04San207044 rv = 0;
89052239d04San207044
89152239d04San207044 return (rv);
89252239d04San207044 }
89352239d04San207044
89452239d04San207044 /* ------------------------------------------------------------------------ */
89552239d04San207044 /* Function: fr_match_ipv6addrs */
89652239d04San207044 /* Returns: int - 2 strong match (same addresses, same direction) */
89752239d04San207044 /* 1 weak match (same addresses, opposite direction) */
89852239d04San207044 /* 0 no match */
89952239d04San207044 /* */
90052239d04San207044 /* Function matches IPv6 addresses. */
90152239d04San207044 /* ------------------------------------------------------------------------ */
fr_match_ipv6addrs(is1,is2)90252239d04San207044 static int fr_match_ipv6addrs(is1, is2)
90352239d04San207044 ipstate_t *is1;
90452239d04San207044 ipstate_t *is2;
90552239d04San207044 {
90652239d04San207044 int rv;
90752239d04San207044
90852239d04San207044 if (IP6_EQ(&is1->is_src, &is2->is_src) &&
90952239d04San207044 IP6_EQ(&is1->is_dst, &is2->is_dst))
91052239d04San207044 rv = 2;
91152239d04San207044 else if (IP6_EQ(&is1->is_src, &is2->is_dst) &&
91252239d04San207044 IP6_EQ(&is1->is_dst, &is2->is_src)) {
91352239d04San207044 rv = 1;
91452239d04San207044 }
91552239d04San207044 else
91652239d04San207044 rv = 0;
91752239d04San207044
91852239d04San207044 return (rv);
91952239d04San207044 }
92052239d04San207044 /* ------------------------------------------------------------------------ */
92152239d04San207044 /* Function: fr_match_addresses */
92252239d04San207044 /* Returns: int - 2 strong match (same addresses, same direction) */
92352239d04San207044 /* 1 weak match (same address, opposite directions) */
92452239d04San207044 /* 0 no match */
92552239d04San207044 /* Parameters: is1, is2 pointers to states we are checking */
92652239d04San207044 /* */
92752239d04San207044 /* Matches addresses, function uses fr_match_ipvXaddrs() to deal with IPv4 */
92852239d04San207044 /* and IPv6 address format. */
92952239d04San207044 /* ------------------------------------------------------------------------ */
fr_match_addresses(is1,is2)93052239d04San207044 static int fr_match_addresses(is1, is2)
93152239d04San207044 ipstate_t *is1;
93252239d04San207044 ipstate_t *is2;
93352239d04San207044 {
93452239d04San207044 int rv;
93552239d04San207044
93652239d04San207044 if (is1->is_v == 4) {
93752239d04San207044 rv = fr_match_ipv4addrs(is1, is2);
93840cdc2e8SAlexandr Nedvedicky } else {
93952239d04San207044 rv = fr_match_ipv6addrs(is1, is2);
94052239d04San207044 }
94152239d04San207044
94252239d04San207044 return (rv);
94352239d04San207044 }
94452239d04San207044
94552239d04San207044 /* ------------------------------------------------------------------------ */
94652239d04San207044 /* Function: fr_match_ppairs */
94752239d04San207044 /* Returns: int - 2 strong match (same ports, same direction) */
94852239d04San207044 /* 1 weak match (same ports, different direction) */
94952239d04San207044 /* 0 no match */
95052239d04San207044 /* Parameters ppairs1, ppairs - src, dst ports we want to match. */
95152239d04San207044 /* */
95252239d04San207044 /* Matches two port_pair_t types (port pairs). Each port pair contains */
95352239d04San207044 /* src, dst port, which belong to session (state entry). */
95452239d04San207044 /* ------------------------------------------------------------------------ */
fr_match_ppairs(ppairs1,ppairs2)95552239d04San207044 static int fr_match_ppairs(ppairs1, ppairs2)
95652239d04San207044 port_pair_t *ppairs1;
95752239d04San207044 port_pair_t *ppairs2;
95852239d04San207044 {
95952239d04San207044 int rv;
96052239d04San207044
96152239d04San207044 if (ppairs1->pp_sport == ppairs2->pp_sport &&
96252239d04San207044 ppairs1->pp_dport == ppairs2->pp_dport)
96352239d04San207044 rv = 2;
96452239d04San207044 else if (ppairs1->pp_sport == ppairs2->pp_dport &&
96552239d04San207044 ppairs1->pp_dport == ppairs2->pp_sport)
96652239d04San207044 rv = 1;
96752239d04San207044 else
96852239d04San207044 rv = 0;
96952239d04San207044
97052239d04San207044 return (rv);
97152239d04San207044 }
97252239d04San207044
97352239d04San207044 /* ------------------------------------------------------------------------ */
97452239d04San207044 /* Function: fr_match_l4_hdr */
97552239d04San207044 /* Returns: int - 0 no match, */
97652239d04San207044 /* 1 weak match (same ports, different directions) */
97752239d04San207044 /* 2 strong match (same ports, same direction) */
97852239d04San207044 /* Parameters is1, is2 - states we want to match */
97952239d04San207044 /* */
98052239d04San207044 /* Function matches L4 header data (source ports for TCP, UDP, CallIds for */
98152239d04San207044 /* GRE protocol). */
98252239d04San207044 /* ------------------------------------------------------------------------ */
fr_match_l4_hdr(is1,is2)98352239d04San207044 static int fr_match_l4_hdr(is1, is2)
98452239d04San207044 ipstate_t *is1;
98552239d04San207044 ipstate_t *is2;
98652239d04San207044 {
98752239d04San207044 int rv = 0;
98852239d04San207044 port_pair_t pp1;
98952239d04San207044 port_pair_t pp2;
99052239d04San207044
99152239d04San207044 if (is1->is_p != is2->is_p)
99252239d04San207044 return (0);
99352239d04San207044
99452239d04San207044 switch (is1->is_p) {
99552239d04San207044 case IPPROTO_TCP:
99652239d04San207044 pp1.pp_sport = is1->is_ps.is_ts.ts_sport;
99752239d04San207044 pp1.pp_dport = is1->is_ps.is_ts.ts_dport;
99852239d04San207044 pp2.pp_sport = is2->is_ps.is_ts.ts_sport;
99952239d04San207044 pp2.pp_dport = is2->is_ps.is_ts.ts_dport;
100052239d04San207044 rv = fr_match_ppairs(&pp1, &pp2);
100152239d04San207044 break;
100252239d04San207044 case IPPROTO_UDP:
100352239d04San207044 pp1.pp_sport = is1->is_ps.is_us.us_sport;
100452239d04San207044 pp1.pp_dport = is1->is_ps.is_us.us_dport;
100552239d04San207044 pp2.pp_sport = is2->is_ps.is_us.us_sport;
100652239d04San207044 pp2.pp_dport = is2->is_ps.is_us.us_dport;
100752239d04San207044 rv = fr_match_ppairs(&pp1, &pp2);
100852239d04San207044 break;
100952239d04San207044 case IPPROTO_GRE:
101052239d04San207044 /* greinfo_t can be also interprted as port pair */
101152239d04San207044 pp1.pp_sport = is1->is_ps.is_ug.gs_call[0];
101252239d04San207044 pp1.pp_dport = is1->is_ps.is_ug.gs_call[1];
101352239d04San207044 pp2.pp_sport = is2->is_ps.is_ug.gs_call[0];
101452239d04San207044 pp2.pp_dport = is2->is_ps.is_ug.gs_call[1];
101552239d04San207044 rv = fr_match_ppairs(&pp1, &pp2);
101652239d04San207044 break;
101752239d04San207044 case IPPROTO_ICMP:
101852239d04San207044 case IPPROTO_ICMPV6:
101952239d04San207044 if (bcmp(&is1->is_ps, &is2->is_ps, sizeof (icmpinfo_t)))
102052239d04San207044 rv = 1;
102152239d04San207044 else
102252239d04San207044 rv = 0;
102352239d04San207044 break;
102452239d04San207044 default:
102552239d04San207044 rv = 0;
102652239d04San207044 }
102752239d04San207044
102852239d04San207044 return (rv);
102952239d04San207044 }
103052239d04San207044
103152239d04San207044 /* ------------------------------------------------------------------------ */
103252239d04San207044 /* Function: fr_matchstates */
103352239d04San207044 /* Returns: int - nonzero match, zero no match */
103452239d04San207044 /* Parameters is1, is2 - states we want to match */
103552239d04San207044 /* */
103652239d04San207044 /* The state entries are equal (identical match) if they belong to the same */
103752239d04San207044 /* session. Any time new state entry is being added the fr_addstate() */
103852239d04San207044 /* function creates temporal state entry from the data it gets from IP and */
103952239d04San207044 /* L4 header. The fr_matchstats() must be also aware of packet direction, */
104052239d04San207044 /* which is also stored within the state entry. We should keep in mind the */
104152239d04San207044 /* information about packet direction is spread accross L3 (addresses) and */
104252239d04San207044 /* L4 (ports). There are three possible relationships betwee is1, is2: */
104352239d04San207044 /* - no match (match(is1, is2) == 0)) */
104452239d04San207044 /* - weak match same addresses (ports), but different */
104552239d04San207044 /* directions (1) (fr_match_xxxx(is1, is2) == 1) */
104652239d04San207044 /* - strong match same addresses (ports) and same directions */
104752239d04San207044 /* (2) (fr_match_xxxx(is1, is2) == 2) */
104852239d04San207044 /* */
104952239d04San207044 /* There are functions, which match match addresses (L3 header) in is1, is2 */
105052239d04San207044 /* and functions, which are used to compare ports (L4 header) data. We say */
105152239d04San207044 /* the is1 and is2 are same (identical) if there is a match */
105252239d04San207044 /* (fr_match_l4_hdr(is1, is2) != 0) and matchlevels are same for entries */
105352239d04San207044 /* (fr_match_l3_hdr(is1, is2) == fr_match_l4_hdr(is1, is2)) for is1, is2. */
105452239d04San207044 /* Such requirement deals with case as follows: */
105552239d04San207044 /* suppose there are two connections between hosts A, B. Connection 1: */
105652239d04San207044 /* a.a.a.a:12345 <=> b.b.b.b:54321 */
105752239d04San207044 /* Connection 2: */
105852239d04San207044 /* a.a.a.a:54321 <=> b.b.b.b:12345 */
105952239d04San207044 /* since we've introduced match levels into our fr_matchstates(), we are */
106052239d04San207044 /* able to identify, which packets belong to connection A and which belong */
106152239d04San207044 /* to connection B. Assume there are two entries is1, is2. is1 has been */
106252239d04San207044 /* from con. 1 packet, which travelled from A to B: */
106352239d04San207044 /* a.a.a.a:12345 -> b.b.b.b:54321 */
106452239d04San207044 /* while s2, has been created from packet which belongs to con. 2 and is */
106552239d04San207044 /* also coming from A to B: */
106652239d04San207044 /* a.a.a.a:54321 -> b.b.b.b:12345 */
106752239d04San207044 /* fr_match_l3_hdr(is1, is2) == 2 -> strong match, while */
106852239d04San207044 /* fr_match_l4_hdr(is1, is2) == 1 -> weak match. Since match levels are */
106952239d04San207044 /* different the state entries are not identical -> no match as a final */
107052239d04San207044 /* result. */
107152239d04San207044 /* ------------------------------------------------------------------------ */
fr_matchstates(is1,is2)107252239d04San207044 static int fr_matchstates(is1, is2)
107352239d04San207044 ipstate_t *is1;
107452239d04San207044 ipstate_t *is2;
107552239d04San207044 {
107652239d04San207044 int rv;
107752239d04San207044 int amatch;
107852239d04San207044 int pmatch;
107952239d04San207044
108052239d04San207044 if (bcmp(&is1->is_pass, &is2->is_pass,
108152239d04San207044 offsetof(struct ipstate, is_ps) -
108252239d04San207044 offsetof(struct ipstate, is_pass)) == 0) {
108352239d04San207044
108452239d04San207044 pmatch = fr_match_l4_hdr(is1, is2);
108552239d04San207044 amatch = fr_match_addresses(is1, is2);
108652239d04San207044 /*
108752239d04San207044 * If addresses match (amatch != 0), then 'match levels'
108852239d04San207044 * must be same for matching entries. If amatch and pmatch
108952239d04San207044 * have different values (different match levels), then
109052239d04San207044 * is1 and is2 belong to different sessions.
109152239d04San207044 */
109252239d04San207044 rv = (amatch != 0) && (amatch == pmatch);
109352239d04San207044 }
109452239d04San207044 else
109552239d04San207044 rv = 0;
109652239d04San207044
109752239d04San207044 return (rv);
109852239d04San207044 }
1099ab25eeb5Syz155240
1100ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
1101ab25eeb5Syz155240 /* Function: fr_addstate */
1102ab25eeb5Syz155240 /* Returns: ipstate_t* - NULL == failure, else pointer to new state */
1103ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */
1104ab25eeb5Syz155240 /* stsave(O) - pointer to place to save pointer to created */
1105ab25eeb5Syz155240 /* state structure. */
1106ab25eeb5Syz155240 /* flags(I) - flags to use when creating the structure */
1107ab25eeb5Syz155240 /* */
1108ab25eeb5Syz155240 /* Creates a new IP state structure from the packet information collected. */
1109ab25eeb5Syz155240 /* Inserts it into the state table and appends to the bottom of the active */
1110ab25eeb5Syz155240 /* list. If the capacity of the table has reached the maximum allowed then */
1111ab25eeb5Syz155240 /* the call will fail and a flush is scheduled for the next timeout call. */
1112ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_addstate(fin,stsave,flags)1113ab25eeb5Syz155240 ipstate_t *fr_addstate(fin, stsave, flags)
1114ab25eeb5Syz155240 fr_info_t *fin;
1115ab25eeb5Syz155240 ipstate_t **stsave;
1116ab25eeb5Syz155240 u_int flags;
1117ab25eeb5Syz155240 {
1118ab25eeb5Syz155240 ipstate_t *is, ips;
1119ab25eeb5Syz155240 struct icmp *ic;
1120ab25eeb5Syz155240 u_int pass, hv;
1121ab25eeb5Syz155240 frentry_t *fr;
1122ab25eeb5Syz155240 tcphdr_t *tcp;
1123ab25eeb5Syz155240 grehdr_t *gre;
1124ab25eeb5Syz155240 void *ifp;
1125ab25eeb5Syz155240 int out;
1126f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs;
1127ab25eeb5Syz155240
1128f4b3ec61Sdh155122 if (ifs->ifs_fr_state_lock ||
1129ab25eeb5Syz155240 (fin->fin_flx & (FI_SHORT|FI_STATE|FI_FRAGBODY|FI_BAD)))
1130ab25eeb5Syz155240 return NULL;
1131ab25eeb5Syz155240
1132ab25eeb5Syz155240 if ((fin->fin_flx & FI_OOW) && !(fin->fin_tcpf & TH_SYN))
1133ab25eeb5Syz155240 return NULL;
1134ab25eeb5Syz155240
113520a07c48Sjojemann /*
1136ea8244dcSJohn Ojemann * Trigger automatic call to fr_state_flush() if the
1137ea8244dcSJohn Ojemann * table has reached capacity specified by hi watermark.
1138ea8244dcSJohn Ojemann */
1139ea8244dcSJohn Ojemann if (ST_TAB_WATER_LEVEL(ifs) > ifs->ifs_state_flush_level_hi)
1140ea8244dcSJohn Ojemann ifs->ifs_fr_state_doflush = 1;
1141ea8244dcSJohn Ojemann
1142ea8244dcSJohn Ojemann /*
1143ea8244dcSJohn Ojemann * If the max number of state entries has been reached, and there is no
1144ea8244dcSJohn Ojemann * limit on the state count for the rule, then do not continue. In the
1145ea8244dcSJohn Ojemann * case where a limit exists, it's ok allow the entries to be created as
1146ea8244dcSJohn Ojemann * long as specified limit itself has not been reached.
1147ea8244dcSJohn Ojemann *
1148ea8244dcSJohn Ojemann * Note that because the lock isn't held on fr, it is possible to exceed
1149ea8244dcSJohn Ojemann * the specified size of the table. However, the cost of this is being
1150ea8244dcSJohn Ojemann * ignored here; as the number by which it can go over is a product of
1151ea8244dcSJohn Ojemann * the number of simultaneous threads that could be executing in here.
1152ea8244dcSJohn Ojemann * So, a limit of 100 won't result in 200, but could result in 101 or 102.
1153ea8244dcSJohn Ojemann *
1154ea8244dcSJohn Ojemann * Also note that, since the automatic flush should have been triggered
1155ea8244dcSJohn Ojemann * well before we reach the maximum number of state table entries, the
1156ea8244dcSJohn Ojemann * likelihood of reaching the max (and thus exceedng it) is minimal.
115720a07c48Sjojemann */
1158ab25eeb5Syz155240 fr = fin->fin_fr;
115920a07c48Sjojemann if (fr != NULL) {
1160ea8244dcSJohn Ojemann if ((ifs->ifs_ips_num >= ifs->ifs_fr_statemax) &&
1161ea8244dcSJohn Ojemann (fr->fr_statemax == 0)) {
1162f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_max);
1163ab25eeb5Syz155240 return NULL;
1164ab25eeb5Syz155240 }
116520a07c48Sjojemann if ((fr->fr_statemax != 0) &&
1166ab25eeb5Syz155240 (fr->fr_statecnt >= fr->fr_statemax)) {
1167f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_maxref);
1168f4b3ec61Sdh155122 ifs->ifs_fr_state_doflush = 1;
1169ab25eeb5Syz155240 return NULL;
1170ab25eeb5Syz155240 }
117120a07c48Sjojemann }
1172ab25eeb5Syz155240
1173ab25eeb5Syz155240 ic = NULL;
1174ab25eeb5Syz155240 tcp = NULL;
1175ab25eeb5Syz155240 out = fin->fin_out;
1176ab25eeb5Syz155240 is = &ips;
1177ab25eeb5Syz155240 bzero((char *)is, sizeof(*is));
117852239d04San207044
117952239d04San207044 if (fr == NULL) {
118052239d04San207044 pass = ifs->ifs_fr_flags;
118152239d04San207044 is->is_tag = FR_NOLOGTAG;
118240cdc2e8SAlexandr Nedvedicky } else {
118352239d04San207044 pass = fr->fr_flags;
118452239d04San207044 }
118552239d04San207044
1186f4b3ec61Sdh155122 is->is_die = 1 + ifs->ifs_fr_ticks;
118752239d04San207044 /*
118852239d04San207044 * We want to check everything that is a property of this packet,
118952239d04San207044 * but we don't (automatically) care about it's fragment status as
119052239d04San207044 * this may change.
119152239d04San207044 */
119252239d04San207044 is->is_pass = pass;
119352239d04San207044 is->is_v = fin->fin_v;
119452239d04San207044 is->is_opt[0] = fin->fin_optmsk;
119552239d04San207044 is->is_optmsk[0] = 0xffffffff;
1196d3edf6acSJan Parcel /*
1197d3edf6acSJan Parcel * The reverse direction option mask will be set in fr_matchsrcdst(),
1198d3edf6acSJan Parcel * when we will see the first packet from the peer. We will leave it
1199d3edf6acSJan Parcel * as zero for now.
1200d3edf6acSJan Parcel */
1201d3edf6acSJan Parcel is->is_optmsk[1] = 0x0;
1202d3edf6acSJan Parcel
120352239d04San207044 if (is->is_v == 6) {
120452239d04San207044 is->is_opt[0] &= ~0x8;
120552239d04San207044 is->is_optmsk[0] &= ~0x8;
120652239d04San207044 }
120752239d04San207044 is->is_sec = fin->fin_secmsk;
120852239d04San207044 is->is_secmsk = 0xffff;
120952239d04San207044 is->is_auth = fin->fin_auth;
121052239d04San207044 is->is_authmsk = 0xffff;
1211ab25eeb5Syz155240
1212ab25eeb5Syz155240 /*
1213ab25eeb5Syz155240 * Copy and calculate...
1214ab25eeb5Syz155240 */
1215ab25eeb5Syz155240 hv = (is->is_p = fin->fin_fi.fi_p);
1216ab25eeb5Syz155240 is->is_src = fin->fin_fi.fi_src;
1217ab25eeb5Syz155240 hv += is->is_saddr;
1218ab25eeb5Syz155240 is->is_dst = fin->fin_fi.fi_dst;
1219ab25eeb5Syz155240 hv += is->is_daddr;
1220ab25eeb5Syz155240 #ifdef USE_INET6
1221ab25eeb5Syz155240 if (fin->fin_v == 6) {
1222ab25eeb5Syz155240 /*
1223ab25eeb5Syz155240 * For ICMPv6, we check to see if the destination address is
1224ab25eeb5Syz155240 * a multicast address. If it is, do not include it in the
1225ab25eeb5Syz155240 * calculation of the hash because the correct reply will come
1226ab25eeb5Syz155240 * back from a real address, not a multicast address.
1227ab25eeb5Syz155240 */
1228ab25eeb5Syz155240 if ((is->is_p == IPPROTO_ICMPV6) &&
1229ab25eeb5Syz155240 IN6_IS_ADDR_MULTICAST(&is->is_dst.in6)) {
1230ab25eeb5Syz155240 /*
1231ab25eeb5Syz155240 * So you can do keep state with neighbour discovery.
1232ab25eeb5Syz155240 *
1233ab25eeb5Syz155240 * Here we could use the address from the neighbour
1234ab25eeb5Syz155240 * solicit message to put in the state structure and
1235ab25eeb5Syz155240 * we could use that without a wildcard flag too...
1236ab25eeb5Syz155240 */
1237ab25eeb5Syz155240 is->is_flags |= SI_W_DADDR;
1238ab25eeb5Syz155240 hv -= is->is_daddr;
1239ab25eeb5Syz155240 } else {
1240ab25eeb5Syz155240 hv += is->is_dst.i6[1];
1241ab25eeb5Syz155240 hv += is->is_dst.i6[2];
1242ab25eeb5Syz155240 hv += is->is_dst.i6[3];
1243ab25eeb5Syz155240 }
1244ab25eeb5Syz155240 hv += is->is_src.i6[1];
1245ab25eeb5Syz155240 hv += is->is_src.i6[2];
1246ab25eeb5Syz155240 hv += is->is_src.i6[3];
1247ab25eeb5Syz155240 }
1248ab25eeb5Syz155240 #endif
1249bb1d9de5SJohn Ojemann if ((fin->fin_v == 4) &&
1250bb1d9de5SJohn Ojemann (fin->fin_flx & (FI_MULTICAST|FI_BROADCAST|FI_MBCAST))) {
1251bb1d9de5SJohn Ojemann if (fin->fin_out == 0) {
1252bb1d9de5SJohn Ojemann flags |= SI_W_DADDR|SI_CLONE;
1253bb1d9de5SJohn Ojemann hv -= is->is_daddr;
1254bb1d9de5SJohn Ojemann } else {
1255bb1d9de5SJohn Ojemann flags |= SI_W_SADDR|SI_CLONE;
1256bb1d9de5SJohn Ojemann hv -= is->is_saddr;
1257bb1d9de5SJohn Ojemann }
1258bb1d9de5SJohn Ojemann }
1259ab25eeb5Syz155240
1260ab25eeb5Syz155240 switch (is->is_p)
1261ab25eeb5Syz155240 {
1262ab25eeb5Syz155240 #ifdef USE_INET6
1263ab25eeb5Syz155240 case IPPROTO_ICMPV6 :
1264ab25eeb5Syz155240 ic = fin->fin_dp;
1265ab25eeb5Syz155240
1266ab25eeb5Syz155240 switch (ic->icmp_type)
1267ab25eeb5Syz155240 {
1268ab25eeb5Syz155240 case ICMP6_ECHO_REQUEST :
1269ab25eeb5Syz155240 is->is_icmp.ici_type = ic->icmp_type;
1270ab25eeb5Syz155240 hv += (is->is_icmp.ici_id = ic->icmp_id);
1271ab25eeb5Syz155240 break;
1272ab25eeb5Syz155240 case ICMP6_MEMBERSHIP_QUERY :
1273ab25eeb5Syz155240 case ND_ROUTER_SOLICIT :
1274ab25eeb5Syz155240 case ND_NEIGHBOR_SOLICIT :
1275ab25eeb5Syz155240 case ICMP6_NI_QUERY :
1276ab25eeb5Syz155240 is->is_icmp.ici_type = ic->icmp_type;
1277ab25eeb5Syz155240 break;
1278ab25eeb5Syz155240 default :
1279ab25eeb5Syz155240 return NULL;
1280ab25eeb5Syz155240 }
1281f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_icmp);
1282ab25eeb5Syz155240 break;
1283ab25eeb5Syz155240 #endif
1284ab25eeb5Syz155240 case IPPROTO_ICMP :
1285ab25eeb5Syz155240 ic = fin->fin_dp;
1286ab25eeb5Syz155240
1287ab25eeb5Syz155240 switch (ic->icmp_type)
1288ab25eeb5Syz155240 {
1289ab25eeb5Syz155240 case ICMP_ECHO :
12900b9f2168SRob Gulewich case ICMP_ECHOREPLY :
1291ab25eeb5Syz155240 case ICMP_TSTAMP :
1292ab25eeb5Syz155240 case ICMP_IREQ :
1293ab25eeb5Syz155240 case ICMP_MASKREQ :
1294ab25eeb5Syz155240 is->is_icmp.ici_type = ic->icmp_type;
1295ab25eeb5Syz155240 hv += (is->is_icmp.ici_id = ic->icmp_id);
1296ab25eeb5Syz155240 break;
1297ab25eeb5Syz155240 default :
1298ab25eeb5Syz155240 return NULL;
1299ab25eeb5Syz155240 }
1300f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_icmp);
1301ab25eeb5Syz155240 break;
1302ab25eeb5Syz155240
1303ab25eeb5Syz155240 case IPPROTO_GRE :
1304ab25eeb5Syz155240 gre = fin->fin_dp;
1305ab25eeb5Syz155240
1306ab25eeb5Syz155240 is->is_gre.gs_flags = gre->gr_flags;
1307ab25eeb5Syz155240 is->is_gre.gs_ptype = gre->gr_ptype;
1308ab25eeb5Syz155240 if (GRE_REV(is->is_gre.gs_flags) == 1) {
1309ab25eeb5Syz155240 is->is_call[0] = fin->fin_data[0];
1310ab25eeb5Syz155240 is->is_call[1] = fin->fin_data[1];
1311ab25eeb5Syz155240 }
1312ab25eeb5Syz155240 break;
1313ab25eeb5Syz155240
1314ab25eeb5Syz155240 case IPPROTO_TCP :
1315ab25eeb5Syz155240 tcp = fin->fin_dp;
1316ab25eeb5Syz155240
1317ab25eeb5Syz155240 if (tcp->th_flags & TH_RST)
1318ab25eeb5Syz155240 return NULL;
1319ab25eeb5Syz155240 /*
1320ab25eeb5Syz155240 * The endian of the ports doesn't matter, but the ack and
1321ab25eeb5Syz155240 * sequence numbers do as we do mathematics on them later.
1322ab25eeb5Syz155240 */
1323ab25eeb5Syz155240 is->is_sport = htons(fin->fin_data[0]);
1324ab25eeb5Syz155240 is->is_dport = htons(fin->fin_data[1]);
1325ab25eeb5Syz155240 if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) {
1326ab25eeb5Syz155240 hv += is->is_sport;
1327ab25eeb5Syz155240 hv += is->is_dport;
1328ab25eeb5Syz155240 }
1329ab25eeb5Syz155240
1330ab25eeb5Syz155240 /*
1331ab25eeb5Syz155240 * If this is a real packet then initialise fields in the
1332ab25eeb5Syz155240 * state information structure from the TCP header information.
1333ab25eeb5Syz155240 */
1334ab25eeb5Syz155240
1335ab25eeb5Syz155240 is->is_maxdwin = 1;
1336ab25eeb5Syz155240 is->is_maxswin = ntohs(tcp->th_win);
1337ab25eeb5Syz155240 if (is->is_maxswin == 0)
1338ab25eeb5Syz155240 is->is_maxswin = 1;
1339ab25eeb5Syz155240
1340ab25eeb5Syz155240 if ((fin->fin_flx & FI_IGNORE) == 0) {
1341ab25eeb5Syz155240 is->is_send = ntohl(tcp->th_seq) + fin->fin_dlen -
1342ab25eeb5Syz155240 (TCP_OFF(tcp) << 2) +
1343ab25eeb5Syz155240 ((tcp->th_flags & TH_SYN) ? 1 : 0) +
1344ab25eeb5Syz155240 ((tcp->th_flags & TH_FIN) ? 1 : 0);
1345ab25eeb5Syz155240 is->is_maxsend = is->is_send;
1346ab25eeb5Syz155240
1347ab25eeb5Syz155240 /*
1348ab25eeb5Syz155240 * Window scale option is only present in
1349ab25eeb5Syz155240 * SYN/SYN-ACK packet.
1350ab25eeb5Syz155240 */
1351ab25eeb5Syz155240 if ((tcp->th_flags & ~(TH_FIN|TH_ACK|TH_ECNALL)) ==
1352ab25eeb5Syz155240 TH_SYN &&
1353ab25eeb5Syz155240 (TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) {
1354ab25eeb5Syz155240 if (fr_tcpoptions(fin, tcp,
1355f17d2b41San207044 &is->is_tcp.ts_data[0]) == -1) {
1356f17d2b41San207044 fin->fin_flx |= FI_BAD;
1357f17d2b41San207044 }
1358ab25eeb5Syz155240 }
1359ab25eeb5Syz155240
1360ab25eeb5Syz155240 if ((fin->fin_out != 0) && (pass & FR_NEWISN) != 0) {
1361ab25eeb5Syz155240 fr_checknewisn(fin, is);
1362ab25eeb5Syz155240 fr_fixoutisn(fin, is);
1363ab25eeb5Syz155240 }
1364ab25eeb5Syz155240
1365ab25eeb5Syz155240 if ((tcp->th_flags & TH_OPENING) == TH_SYN)
1366ab25eeb5Syz155240 flags |= IS_TCPFSM;
1367ab25eeb5Syz155240 else {
1368ab25eeb5Syz155240 is->is_maxdwin = is->is_maxswin * 2;
1369ab25eeb5Syz155240 is->is_dend = ntohl(tcp->th_ack);
1370ab25eeb5Syz155240 is->is_maxdend = ntohl(tcp->th_ack);
1371ab25eeb5Syz155240 is->is_maxdwin *= 2;
1372ab25eeb5Syz155240 }
1373ab25eeb5Syz155240 }
1374ab25eeb5Syz155240
1375ab25eeb5Syz155240 /*
1376ab25eeb5Syz155240 * If we're creating state for a starting connection, start the
1377ab25eeb5Syz155240 * timer on it as we'll never see an error if it fails to
1378ab25eeb5Syz155240 * connect.
1379ab25eeb5Syz155240 */
1380f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_tcp);
1381ab25eeb5Syz155240 break;
1382ab25eeb5Syz155240
1383ab25eeb5Syz155240 case IPPROTO_UDP :
1384ab25eeb5Syz155240 tcp = fin->fin_dp;
1385ab25eeb5Syz155240
1386ab25eeb5Syz155240 is->is_sport = htons(fin->fin_data[0]);
1387ab25eeb5Syz155240 is->is_dport = htons(fin->fin_data[1]);
1388ab25eeb5Syz155240 if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) {
1389ab25eeb5Syz155240 hv += tcp->th_dport;
1390ab25eeb5Syz155240 hv += tcp->th_sport;
1391ab25eeb5Syz155240 }
1392f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_udp);
1393ab25eeb5Syz155240 break;
1394ab25eeb5Syz155240
1395ab25eeb5Syz155240 default :
1396ab25eeb5Syz155240 break;
1397ab25eeb5Syz155240 }
1398f4b3ec61Sdh155122 hv = DOUBLE_HASH(hv, ifs);
1399ab25eeb5Syz155240 is->is_hv = hv;
1400ab25eeb5Syz155240 is->is_rule = fr;
1401ab25eeb5Syz155240 is->is_flags = flags & IS_INHERITED;
1402ab25eeb5Syz155240
1403ab25eeb5Syz155240 /*
1404ab25eeb5Syz155240 * Look for identical state.
1405ab25eeb5Syz155240 */
1406f4b3ec61Sdh155122 for (is = ifs->ifs_ips_table[is->is_hv % ifs->ifs_fr_statesize];
1407f4b3ec61Sdh155122 is != NULL;
1408ab25eeb5Syz155240 is = is->is_hnext) {
140952239d04San207044 if (fr_matchstates(&ips, is) == 1)
1410ab25eeb5Syz155240 break;
1411ab25eeb5Syz155240 }
141252239d04San207044
141352239d04San207044 /*
141452239d04San207044 * we've found a matching state -> state already exists,
141552239d04San207044 * we are not going to add a duplicate record.
141652239d04San207044 */
1417ab25eeb5Syz155240 if (is != NULL)
1418ab25eeb5Syz155240 return NULL;
1419ab25eeb5Syz155240
1420f4b3ec61Sdh155122 if (ifs->ifs_ips_stats.iss_bucketlen[hv] >= ifs->ifs_fr_state_maxbucket) {
1421f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_bucketfull);
1422ab25eeb5Syz155240 return NULL;
1423ab25eeb5Syz155240 }
1424ab25eeb5Syz155240 KMALLOC(is, ipstate_t *);
1425ab25eeb5Syz155240 if (is == NULL) {
1426f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_nomem);
1427ab25eeb5Syz155240 return NULL;
1428ab25eeb5Syz155240 }
1429ab25eeb5Syz155240 bcopy((char *)&ips, (char *)is, sizeof(*is));
1430ab25eeb5Syz155240 /*
1431ab25eeb5Syz155240 * Do not do the modulous here, it is done in fr_stinsert().
1432ab25eeb5Syz155240 */
1433ab25eeb5Syz155240 if (fr != NULL) {
1434ab25eeb5Syz155240 (void) strncpy(is->is_group, fr->fr_group, FR_GROUPLEN);
1435ab25eeb5Syz155240 if (fr->fr_age[0] != 0) {
1436f4b3ec61Sdh155122 is->is_tqehead[0] =
1437f4b3ec61Sdh155122 fr_addtimeoutqueue(&ifs->ifs_ips_utqe,
1438f4b3ec61Sdh155122 fr->fr_age[0], ifs);
1439ab25eeb5Syz155240 is->is_sti.tqe_flags |= TQE_RULEBASED;
1440ab25eeb5Syz155240 }
1441ab25eeb5Syz155240 if (fr->fr_age[1] != 0) {
1442f4b3ec61Sdh155122 is->is_tqehead[1] =
1443f4b3ec61Sdh155122 fr_addtimeoutqueue(&ifs->ifs_ips_utqe,
1444f4b3ec61Sdh155122 fr->fr_age[1], ifs);
1445ab25eeb5Syz155240 is->is_sti.tqe_flags |= TQE_RULEBASED;
1446ab25eeb5Syz155240 }
1447ab25eeb5Syz155240 is->is_tag = fr->fr_logtag;
1448ab25eeb5Syz155240
1449ab25eeb5Syz155240 is->is_ifp[(out << 1) + 1] = fr->fr_ifas[1];
1450ab25eeb5Syz155240 is->is_ifp[(1 - out) << 1] = fr->fr_ifas[2];
1451ab25eeb5Syz155240 is->is_ifp[((1 - out) << 1) + 1] = fr->fr_ifas[3];
1452ab25eeb5Syz155240
1453ab25eeb5Syz155240 if (((ifp = fr->fr_ifas[1]) != NULL) &&
1454ab25eeb5Syz155240 (ifp != (void *)-1)) {
1455381a2a9aSdr146992 COPYIFNAME(ifp, is->is_ifname[(out << 1) + 1], fr->fr_v);
1456ab25eeb5Syz155240 }
1457ab25eeb5Syz155240 if (((ifp = fr->fr_ifas[2]) != NULL) &&
1458ab25eeb5Syz155240 (ifp != (void *)-1)) {
1459381a2a9aSdr146992 COPYIFNAME(ifp, is->is_ifname[(1 - out) << 1], fr->fr_v);
1460ab25eeb5Syz155240 }
1461ab25eeb5Syz155240 if (((ifp = fr->fr_ifas[3]) != NULL) &&
1462ab25eeb5Syz155240 (ifp != (void *)-1)) {
1463381a2a9aSdr146992 COPYIFNAME(ifp, is->is_ifname[((1 - out) << 1) + 1], fr->fr_v);
1464ab25eeb5Syz155240 }
1465ab25eeb5Syz155240 }
1466ab25eeb5Syz155240
1467ab25eeb5Syz155240 is->is_ifp[out << 1] = fin->fin_ifp;
1468ab25eeb5Syz155240 if (fin->fin_ifp != NULL) {
146943412a42SDarren Reed COPYIFNAME(fin->fin_ifp, is->is_ifname[out << 1], fin->fin_v);
1470ab25eeb5Syz155240 }
1471ab25eeb5Syz155240
147233f2fefdSDarren Reed is->is_ref = 1;
1473ab25eeb5Syz155240 is->is_pkts[0] = 0, is->is_bytes[0] = 0;
1474ab25eeb5Syz155240 is->is_pkts[1] = 0, is->is_bytes[1] = 0;
1475ab25eeb5Syz155240 is->is_pkts[2] = 0, is->is_bytes[2] = 0;
1476ab25eeb5Syz155240 is->is_pkts[3] = 0, is->is_bytes[3] = 0;
1477ab25eeb5Syz155240 if ((fin->fin_flx & FI_IGNORE) == 0) {
1478ab25eeb5Syz155240 is->is_pkts[out] = 1;
1479ab25eeb5Syz155240 is->is_bytes[out] = fin->fin_plen;
1480ab25eeb5Syz155240 is->is_flx[out][0] = fin->fin_flx & FI_CMP;
1481ab25eeb5Syz155240 is->is_flx[out][0] &= ~FI_OOW;
1482ab25eeb5Syz155240 }
1483ab25eeb5Syz155240
1484ab25eeb5Syz155240 if (pass & FR_STSTRICT)
1485ab25eeb5Syz155240 is->is_flags |= IS_STRICT;
1486ab25eeb5Syz155240
1487ab25eeb5Syz155240 if (pass & FR_STATESYNC)
1488ab25eeb5Syz155240 is->is_flags |= IS_STATESYNC;
1489ab25eeb5Syz155240
1490ab25eeb5Syz155240 if (flags & (SI_WILDP|SI_WILDA)) {
1491f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_wild);
1492ab25eeb5Syz155240 }
1493ab25eeb5Syz155240 is->is_rulen = fin->fin_rule;
1494ab25eeb5Syz155240
1495ab25eeb5Syz155240
1496ab25eeb5Syz155240 if (pass & FR_LOGFIRST)
1497ab25eeb5Syz155240 is->is_pass &= ~(FR_LOGFIRST|FR_LOG);
1498ab25eeb5Syz155240
1499f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state);
1500ab25eeb5Syz155240 is->is_me = stsave;
1501ab25eeb5Syz155240
1502f4b3ec61Sdh155122 fr_stinsert(is, fin->fin_rev, ifs);
1503ab25eeb5Syz155240
1504ab25eeb5Syz155240 if (fin->fin_p == IPPROTO_TCP) {
1505ab25eeb5Syz155240 /*
1506ab25eeb5Syz155240 * If we're creating state for a starting connection, start the
1507ab25eeb5Syz155240 * timer on it as we'll never see an error if it fails to
1508ab25eeb5Syz155240 * connect.
1509ab25eeb5Syz155240 */
1510f4b3ec61Sdh155122 (void) fr_tcp_age(&is->is_sti, fin, ifs->ifs_ips_tqtqb,
1511f4b3ec61Sdh155122 is->is_flags);
1512ab25eeb5Syz155240 MUTEX_EXIT(&is->is_lock);
1513ab25eeb5Syz155240 #ifdef IPFILTER_SCAN
1514ab25eeb5Syz155240 if ((is->is_flags & SI_CLONE) == 0)
1515ab25eeb5Syz155240 (void) ipsc_attachis(is);
1516ab25eeb5Syz155240 #endif
1517ab25eeb5Syz155240 } else {
1518ab25eeb5Syz155240 MUTEX_EXIT(&is->is_lock);
1519ab25eeb5Syz155240 }
1520ab25eeb5Syz155240 #ifdef IPFILTER_SYNC
1521ab25eeb5Syz155240 if ((is->is_flags & IS_STATESYNC) && ((is->is_flags & SI_CLONE) == 0))
1522ab25eeb5Syz155240 is->is_sync = ipfsync_new(SMC_STATE, fin, is);
1523ab25eeb5Syz155240 #endif
1524f4b3ec61Sdh155122 if (ifs->ifs_ipstate_logging)
1525f4b3ec61Sdh155122 ipstate_log(is, ISL_NEW, ifs);
1526ab25eeb5Syz155240
1527f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
1528ab25eeb5Syz155240 fin->fin_rev = IP6_NEQ(&is->is_dst, &fin->fin_daddr);
1529ab25eeb5Syz155240 fin->fin_flx |= FI_STATE;
1530ab25eeb5Syz155240 if (fin->fin_flx & FI_FRAG)
1531ab25eeb5Syz155240 (void) fr_newfrag(fin, pass ^ FR_KEEPSTATE);
1532ab25eeb5Syz155240
1533ab25eeb5Syz155240 return is;
1534ab25eeb5Syz155240 }
1535ab25eeb5Syz155240
1536ab25eeb5Syz155240
1537ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
1538ab25eeb5Syz155240 /* Function: fr_tcpoptions */
1539ab25eeb5Syz155240 /* Returns: int - 1 == packet matches state entry, 0 == it does not */
1540ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */
1541ab25eeb5Syz155240 /* tcp(I) - pointer to TCP packet header */
1542ab25eeb5Syz155240 /* td(I) - pointer to TCP data held as part of the state */
1543ab25eeb5Syz155240 /* */
1544ab25eeb5Syz155240 /* Look after the TCP header for any options and deal with those that are */
1545ab25eeb5Syz155240 /* present. Record details about those that we recogise. */
1546ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_tcpoptions(fin,tcp,td)1547ab25eeb5Syz155240 static int fr_tcpoptions(fin, tcp, td)
1548ab25eeb5Syz155240 fr_info_t *fin;
1549ab25eeb5Syz155240 tcphdr_t *tcp;
1550ab25eeb5Syz155240 tcpdata_t *td;
1551ab25eeb5Syz155240 {
1552ab25eeb5Syz155240 int off, mlen, ol, i, len, retval;
1553ab25eeb5Syz155240 char buf[64], *s, opt;
1554ab25eeb5Syz155240 mb_t *m = NULL;
1555ab25eeb5Syz155240
1556ab25eeb5Syz155240 len = (TCP_OFF(tcp) << 2);
1557ab25eeb5Syz155240 if (fin->fin_dlen < len)
1558ab25eeb5Syz155240 return 0;
1559ab25eeb5Syz155240 len -= sizeof(*tcp);
1560ab25eeb5Syz155240
1561ab25eeb5Syz155240 off = fin->fin_plen - fin->fin_dlen + sizeof(*tcp) + fin->fin_ipoff;
1562ab25eeb5Syz155240
1563ab25eeb5Syz155240 m = fin->fin_m;
1564ab25eeb5Syz155240 mlen = MSGDSIZE(m) - off;
1565ab25eeb5Syz155240 if (len > mlen) {
1566ab25eeb5Syz155240 len = mlen;
1567ab25eeb5Syz155240 retval = 0;
1568ab25eeb5Syz155240 } else {
1569ab25eeb5Syz155240 retval = 1;
1570ab25eeb5Syz155240 }
1571ab25eeb5Syz155240
1572ab25eeb5Syz155240 COPYDATA(m, off, len, buf);
1573ab25eeb5Syz155240
1574ab25eeb5Syz155240 for (s = buf; len > 0; ) {
1575ab25eeb5Syz155240 opt = *s;
1576ab25eeb5Syz155240 if (opt == TCPOPT_EOL)
1577ab25eeb5Syz155240 break;
1578ab25eeb5Syz155240 else if (opt == TCPOPT_NOP)
1579ab25eeb5Syz155240 ol = 1;
1580ab25eeb5Syz155240 else {
1581ab25eeb5Syz155240 if (len < 2)
1582ab25eeb5Syz155240 break;
1583ab25eeb5Syz155240 ol = (int)*(s + 1);
1584ab25eeb5Syz155240 if (ol < 2 || ol > len)
1585ab25eeb5Syz155240 break;
1586ab25eeb5Syz155240
1587ab25eeb5Syz155240 /*
1588ab25eeb5Syz155240 * Extract the TCP options we are interested in out of
1589ab25eeb5Syz155240 * the header and store them in the the tcpdata struct.
1590ab25eeb5Syz155240 */
1591ab25eeb5Syz155240 switch (opt)
1592ab25eeb5Syz155240 {
1593ab25eeb5Syz155240 case TCPOPT_WINDOW :
1594ab25eeb5Syz155240 if (ol == TCPOLEN_WINDOW) {
1595ab25eeb5Syz155240 i = (int)*(s + 2);
1596ab25eeb5Syz155240 if (i > TCP_WSCALE_MAX)
1597ab25eeb5Syz155240 i = TCP_WSCALE_MAX;
1598ab25eeb5Syz155240 else if (i < 0)
1599ab25eeb5Syz155240 i = 0;
1600ab25eeb5Syz155240 td->td_winscale = i;
1601f17d2b41San207044 td->td_winflags |= TCP_WSCALE_SEEN |
1602f17d2b41San207044 TCP_WSCALE_FIRST;
1603f17d2b41San207044 } else
1604f17d2b41San207044 retval = -1;
1605ab25eeb5Syz155240 break;
1606ab25eeb5Syz155240 case TCPOPT_MAXSEG :
1607ab25eeb5Syz155240 /*
1608ab25eeb5Syz155240 * So, if we wanted to set the TCP MAXSEG,
1609ab25eeb5Syz155240 * it should be done here...
1610ab25eeb5Syz155240 */
1611ab25eeb5Syz155240 if (ol == TCPOLEN_MAXSEG) {
1612ab25eeb5Syz155240 i = (int)*(s + 2);
1613ab25eeb5Syz155240 i <<= 8;
1614ab25eeb5Syz155240 i += (int)*(s + 3);
1615ab25eeb5Syz155240 td->td_maxseg = i;
1616f17d2b41San207044 } else
1617f17d2b41San207044 retval = -1;
1618f17d2b41San207044 break;
1619f17d2b41San207044 case TCPOPT_SACK_PERMITTED :
1620f17d2b41San207044 if (ol == TCPOLEN_SACK_PERMITTED)
1621f17d2b41San207044 td->td_winflags |= TCP_SACK_PERMIT;
1622f17d2b41San207044 else
1623f17d2b41San207044 retval = -1;
1624ab25eeb5Syz155240 break;
1625ab25eeb5Syz155240 }
1626ab25eeb5Syz155240 }
1627ab25eeb5Syz155240 len -= ol;
1628ab25eeb5Syz155240 s += ol;
1629ab25eeb5Syz155240 }
1630ab25eeb5Syz155240 return retval;
1631ab25eeb5Syz155240 }
1632ab25eeb5Syz155240
1633ab25eeb5Syz155240
1634ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
1635ab25eeb5Syz155240 /* Function: fr_tcpstate */
1636ab25eeb5Syz155240 /* Returns: int - 1 == packet matches state entry, 0 == it does not */
1637ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */
1638ab25eeb5Syz155240 /* tcp(I) - pointer to TCP packet header */
1639ab25eeb5Syz155240 /* is(I) - pointer to master state structure */
1640ab25eeb5Syz155240 /* */
1641ab25eeb5Syz155240 /* Check to see if a packet with TCP headers fits within the TCP window. */
1642ab25eeb5Syz155240 /* Change timeout depending on whether new packet is a SYN-ACK returning */
1643ab25eeb5Syz155240 /* for a SYN or a RST or FIN which indicate time to close up shop. */
1644ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_tcpstate(fin,tcp,is)1645ab25eeb5Syz155240 static int fr_tcpstate(fin, tcp, is)
1646ab25eeb5Syz155240 fr_info_t *fin;
1647ab25eeb5Syz155240 tcphdr_t *tcp;
1648ab25eeb5Syz155240 ipstate_t *is;
1649ab25eeb5Syz155240 {
1650ab25eeb5Syz155240 int source, ret = 0, flags;
1651ab25eeb5Syz155240 tcpdata_t *fdata, *tdata;
1652f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs;
1653ab25eeb5Syz155240
1654ab25eeb5Syz155240 source = !fin->fin_rev;
1655ab25eeb5Syz155240 if (((is->is_flags & IS_TCPFSM) != 0) && (source == 1) &&
1656ab25eeb5Syz155240 (ntohs(is->is_sport) != fin->fin_data[0]))
1657ab25eeb5Syz155240 source = 0;
1658ab25eeb5Syz155240 fdata = &is->is_tcp.ts_data[!source];
1659ab25eeb5Syz155240 tdata = &is->is_tcp.ts_data[source];
1660ab25eeb5Syz155240
1661ab25eeb5Syz155240 MUTEX_ENTER(&is->is_lock);
16621e6b25a4San207044
16631e6b25a4San207044 /*
16641e6b25a4San207044 * If a SYN packet is received for a connection that is in a half
16651e6b25a4San207044 * closed state, then move its state entry to deletetq. In such case
16661e6b25a4San207044 * the SYN packet will be consequently dropped. This allows new state
16671e6b25a4San207044 * entry to be created with a retransmited SYN packet.
16681e6b25a4San207044 */
16691e6b25a4San207044 if ((tcp->th_flags & TH_OPENING) == TH_SYN) {
16706ccacea7SAlexandr Nedvedicky if ((is->is_state[source] > IPF_TCPS_ESTABLISHED) &&
16716ccacea7SAlexandr Nedvedicky (is->is_state[!source] > IPF_TCPS_ESTABLISHED)) {
16726ccacea7SAlexandr Nedvedicky is->is_state[source] = IPF_TCPS_CLOSED;
16736ccacea7SAlexandr Nedvedicky is->is_state[!source] = IPF_TCPS_CLOSED;
16741e6b25a4San207044 /*
16751e6b25a4San207044 * Do not update is->is_sti.tqe_die in case state entry
16761e6b25a4San207044 * is already present in deletetq. It prevents state
16771e6b25a4San207044 * entry ttl update by retransmitted SYN packets, which
16781e6b25a4San207044 * may arrive before timer tick kicks off. The SYN
16791e6b25a4San207044 * packet will be dropped again.
16801e6b25a4San207044 */
16811e6b25a4San207044 if (is->is_sti.tqe_ifq != &ifs->ifs_ips_deletetq)
16821e6b25a4San207044 fr_movequeue(&is->is_sti, is->is_sti.tqe_ifq,
16831e6b25a4San207044 &fin->fin_ifs->ifs_ips_deletetq,
16841e6b25a4San207044 fin->fin_ifs);
16851e6b25a4San207044
16861e6b25a4San207044 MUTEX_EXIT(&is->is_lock);
16871e6b25a4San207044 return 0;
16881e6b25a4San207044 }
16891e6b25a4San207044 }
16901e6b25a4San207044
1691ab25eeb5Syz155240 if (fr_tcpinwindow(fin, fdata, tdata, tcp, is->is_flags)) {
1692ab25eeb5Syz155240 #ifdef IPFILTER_SCAN
1693ab25eeb5Syz155240 if (is->is_flags & (IS_SC_CLIENT|IS_SC_SERVER)) {
1694ab25eeb5Syz155240 ipsc_packet(fin, is);
1695ab25eeb5Syz155240 if (FR_ISBLOCK(is->is_pass)) {
1696ab25eeb5Syz155240 MUTEX_EXIT(&is->is_lock);
1697ab25eeb5Syz155240 return 1;
1698ab25eeb5Syz155240 }
1699ab25eeb5Syz155240 }
1700ab25eeb5Syz155240 #endif
1701ab25eeb5Syz155240
1702ab25eeb5Syz155240 /*
1703ab25eeb5Syz155240 * Nearing end of connection, start timeout.
1704ab25eeb5Syz155240 */
1705f4b3ec61Sdh155122 ret = fr_tcp_age(&is->is_sti, fin, ifs->ifs_ips_tqtqb,
1706f4b3ec61Sdh155122 is->is_flags);
1707ab25eeb5Syz155240 if (ret == 0) {
1708ab25eeb5Syz155240 MUTEX_EXIT(&is->is_lock);
1709ab25eeb5Syz155240 return 0;
1710ab25eeb5Syz155240 }
1711ab25eeb5Syz155240
1712ab25eeb5Syz155240 /*
1713ab25eeb5Syz155240 * set s0's as appropriate. Use syn-ack packet as it
1714ab25eeb5Syz155240 * contains both pieces of required information.
1715ab25eeb5Syz155240 */
1716ab25eeb5Syz155240 /*
1717ab25eeb5Syz155240 * Window scale option is only present in SYN/SYN-ACK packet.
1718ab25eeb5Syz155240 * Compare with ~TH_FIN to mask out T/TCP setups.
1719ab25eeb5Syz155240 */
1720ab25eeb5Syz155240 flags = tcp->th_flags & ~(TH_FIN|TH_ECNALL);
1721ab25eeb5Syz155240 if (flags == (TH_SYN|TH_ACK)) {
1722ab25eeb5Syz155240 is->is_s0[source] = ntohl(tcp->th_ack);
1723ab25eeb5Syz155240 is->is_s0[!source] = ntohl(tcp->th_seq) + 1;
1724f17d2b41San207044 if (TCP_OFF(tcp) > (sizeof (tcphdr_t) >> 2)) {
1725f17d2b41San207044 (void) fr_tcpoptions(fin, tcp, fdata);
1726ab25eeb5Syz155240 }
1727ab25eeb5Syz155240 if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN))
1728ab25eeb5Syz155240 fr_checknewisn(fin, is);
1729ab25eeb5Syz155240 } else if (flags == TH_SYN) {
1730ab25eeb5Syz155240 is->is_s0[source] = ntohl(tcp->th_seq) + 1;
1731ab25eeb5Syz155240 if ((TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2)))
1732*6a6ded8aSDan McDonald (void) fr_tcpoptions(fin, tcp, fdata);
1733ab25eeb5Syz155240
1734ab25eeb5Syz155240 if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN))
1735ab25eeb5Syz155240 fr_checknewisn(fin, is);
1736ab25eeb5Syz155240
1737ab25eeb5Syz155240 }
1738ab25eeb5Syz155240 ret = 1;
1739ab25eeb5Syz155240 } else
1740ab25eeb5Syz155240 fin->fin_flx |= FI_OOW;
1741ab25eeb5Syz155240 MUTEX_EXIT(&is->is_lock);
1742ab25eeb5Syz155240 return ret;
1743ab25eeb5Syz155240 }
1744ab25eeb5Syz155240
1745ab25eeb5Syz155240
1746ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
1747ab25eeb5Syz155240 /* Function: fr_checknewisn */
1748ab25eeb5Syz155240 /* Returns: Nil */
1749ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */
1750ab25eeb5Syz155240 /* is(I) - pointer to master state structure */
1751ab25eeb5Syz155240 /* */
1752ab25eeb5Syz155240 /* Check to see if this TCP connection is expecting and needs a new */
1753ab25eeb5Syz155240 /* sequence number for a particular direction of the connection. */
1754ab25eeb5Syz155240 /* */
1755ab25eeb5Syz155240 /* NOTE: This does not actually change the sequence numbers, only gets new */
1756ab25eeb5Syz155240 /* one ready. */
1757ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_checknewisn(fin,is)1758ab25eeb5Syz155240 static void fr_checknewisn(fin, is)
1759ab25eeb5Syz155240 fr_info_t *fin;
1760ab25eeb5Syz155240 ipstate_t *is;
1761ab25eeb5Syz155240 {
1762ab25eeb5Syz155240 u_32_t sumd, old, new;
1763ab25eeb5Syz155240 tcphdr_t *tcp;
1764ab25eeb5Syz155240 int i;
1765ab25eeb5Syz155240
1766ab25eeb5Syz155240 i = fin->fin_rev;
1767ab25eeb5Syz155240 tcp = fin->fin_dp;
1768ab25eeb5Syz155240
1769ab25eeb5Syz155240 if (((i == 0) && !(is->is_flags & IS_ISNSYN)) ||
1770ab25eeb5Syz155240 ((i == 1) && !(is->is_flags & IS_ISNACK))) {
1771ab25eeb5Syz155240 old = ntohl(tcp->th_seq);
1772ab25eeb5Syz155240 new = fr_newisn(fin);
1773ab25eeb5Syz155240 is->is_isninc[i] = new - old;
1774ab25eeb5Syz155240 CALC_SUMD(old, new, sumd);
1775ab25eeb5Syz155240 is->is_sumd[i] = (sumd & 0xffff) + (sumd >> 16);
1776ab25eeb5Syz155240
1777ab25eeb5Syz155240 is->is_flags |= ((i == 0) ? IS_ISNSYN : IS_ISNACK);
1778ab25eeb5Syz155240 }
1779ab25eeb5Syz155240 }
1780ab25eeb5Syz155240
1781ab25eeb5Syz155240
1782ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
1783ab25eeb5Syz155240 /* Function: fr_tcpinwindow */
1784ab25eeb5Syz155240 /* Returns: int - 1 == packet inside TCP "window", 0 == not inside. */
1785ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */
1786ab25eeb5Syz155240 /* fdata(I) - pointer to tcp state informatio (forward) */
1787ab25eeb5Syz155240 /* tdata(I) - pointer to tcp state informatio (reverse) */
1788ab25eeb5Syz155240 /* tcp(I) - pointer to TCP packet header */
1789ab25eeb5Syz155240 /* */
1790ab25eeb5Syz155240 /* Given a packet has matched addresses and ports, check to see if it is */
1791ab25eeb5Syz155240 /* within the TCP data window. In a show of generosity, allow packets that */
1792ab25eeb5Syz155240 /* are within the window space behind the current sequence # as well. */
1793ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_tcpinwindow(fin,fdata,tdata,tcp,flags)1794ab25eeb5Syz155240 int fr_tcpinwindow(fin, fdata, tdata, tcp, flags)
1795ab25eeb5Syz155240 fr_info_t *fin;
1796ab25eeb5Syz155240 tcpdata_t *fdata, *tdata;
1797ab25eeb5Syz155240 tcphdr_t *tcp;
1798ab25eeb5Syz155240 int flags;
1799ab25eeb5Syz155240 {
1800ab25eeb5Syz155240 tcp_seq seq, ack, end;
1801ab25eeb5Syz155240 int ackskew, tcpflags;
1802ab25eeb5Syz155240 u_32_t win, maxwin;
1803f17d2b41San207044 int dsize, inseq;
1804ab25eeb5Syz155240
1805ab25eeb5Syz155240 /*
1806ab25eeb5Syz155240 * Find difference between last checked packet and this packet.
1807ab25eeb5Syz155240 */
1808ab25eeb5Syz155240 tcpflags = tcp->th_flags;
1809ab25eeb5Syz155240 seq = ntohl(tcp->th_seq);
1810ab25eeb5Syz155240 ack = ntohl(tcp->th_ack);
1811f17d2b41San207044
1812ab25eeb5Syz155240 if (tcpflags & TH_SYN)
1813ab25eeb5Syz155240 win = ntohs(tcp->th_win);
1814ab25eeb5Syz155240 else
1815ab25eeb5Syz155240 win = ntohs(tcp->th_win) << fdata->td_winscale;
1816f17d2b41San207044
1817f17d2b41San207044 /*
1818f17d2b41San207044 * win 0 means the receiving endpoint has closed the window, because it
1819f17d2b41San207044 * has not enough memory to receive data from sender. In such case we
1820f17d2b41San207044 * are pretending window size to be 1 to let TCP probe data through.
1821f17d2b41San207044 * TCP probe data can be either 0 or 1 octet of data, the RFC does not
1822f17d2b41San207044 * state this accurately, so we have to allow 1 octet (win = 1) even if
1823f17d2b41San207044 * the window is closed (win == 0).
1824f17d2b41San207044 */
1825ab25eeb5Syz155240 if (win == 0)
1826ab25eeb5Syz155240 win = 1;
1827ab25eeb5Syz155240
1828f17d2b41San207044 dsize = fin->fin_dlen - (TCP_OFF(tcp) << 2) +
1829f17d2b41San207044 ((tcpflags & TH_SYN) ? 1 : 0) + ((tcpflags & TH_FIN) ? 1 : 0);
1830f17d2b41San207044
1831ab25eeb5Syz155240 /*
1832ab25eeb5Syz155240 * if window scaling is present, the scaling is only allowed
1833ab25eeb5Syz155240 * for windows not in the first SYN packet. In that packet the
1834ab25eeb5Syz155240 * window is 65535 to specify the largest window possible
1835ab25eeb5Syz155240 * for receivers not implementing the window scale option.
1836ab25eeb5Syz155240 * Currently, we do not assume TTCP here. That means that
1837ab25eeb5Syz155240 * if we see a second packet from a host (after the initial
1838ab25eeb5Syz155240 * SYN), we can assume that the receiver of the SYN did
1839ab25eeb5Syz155240 * already send back the SYN/ACK (and thus that we know if
1840ab25eeb5Syz155240 * the receiver also does window scaling)
1841ab25eeb5Syz155240 */
1842ab25eeb5Syz155240 if (!(tcpflags & TH_SYN) && (fdata->td_winflags & TCP_WSCALE_FIRST)) {
1843*6a6ded8aSDan McDonald fdata->td_winflags &= ~TCP_WSCALE_FIRST;
1844ab25eeb5Syz155240 fdata->td_maxwin = win;
1845ab25eeb5Syz155240 }
1846ab25eeb5Syz155240
1847f17d2b41San207044 end = seq + dsize;
1848ab25eeb5Syz155240
1849ab25eeb5Syz155240 if ((fdata->td_end == 0) &&
1850ab25eeb5Syz155240 (!(flags & IS_TCPFSM) ||
1851ab25eeb5Syz155240 ((tcpflags & TH_OPENING) == TH_OPENING))) {
1852ab25eeb5Syz155240 /*
1853ab25eeb5Syz155240 * Must be a (outgoing) SYN-ACK in reply to a SYN.
1854ab25eeb5Syz155240 */
1855f17d2b41San207044 fdata->td_end = end - 1;
1856ab25eeb5Syz155240 fdata->td_maxwin = 1;
1857ab25eeb5Syz155240 fdata->td_maxend = end + win;
1858ab25eeb5Syz155240 }
1859ab25eeb5Syz155240
1860ab25eeb5Syz155240 if (!(tcpflags & TH_ACK)) { /* Pretend an ack was sent */
1861ab25eeb5Syz155240 ack = tdata->td_end;
1862ab25eeb5Syz155240 } else if (((tcpflags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) &&
1863ab25eeb5Syz155240 (ack == 0)) {
1864ab25eeb5Syz155240 /* gross hack to get around certain broken tcp stacks */
1865ab25eeb5Syz155240 ack = tdata->td_end;
1866ab25eeb5Syz155240 }
1867ab25eeb5Syz155240
1868ab25eeb5Syz155240 maxwin = tdata->td_maxwin;
1869ab25eeb5Syz155240 ackskew = tdata->td_end - ack;
1870ab25eeb5Syz155240
1871ab25eeb5Syz155240 /*
1872ab25eeb5Syz155240 * Strict sequencing only allows in-order delivery.
1873ab25eeb5Syz155240 */
1874ab25eeb5Syz155240 if ((flags & IS_STRICT) != 0) {
1875ab25eeb5Syz155240 if (seq != fdata->td_end) {
187640cdc2e8SAlexandr Nedvedicky DTRACE_PROBE(strict_check);
1877ab25eeb5Syz155240 return 0;
1878ab25eeb5Syz155240 }
1879ab25eeb5Syz155240 }
1880ab25eeb5Syz155240
1881ab25eeb5Syz155240 #define SEQ_GE(a,b) ((int)((a) - (b)) >= 0)
1882ab25eeb5Syz155240 #define SEQ_GT(a,b) ((int)((a) - (b)) > 0)
1883f17d2b41San207044 inseq = 0;
188440cdc2e8SAlexandr Nedvedicky DTRACE_PROBE4(
188540cdc2e8SAlexandr Nedvedicky dyn_params,
188640cdc2e8SAlexandr Nedvedicky int, dsize,
188740cdc2e8SAlexandr Nedvedicky int, ackskew,
188840cdc2e8SAlexandr Nedvedicky int, maxwin,
188940cdc2e8SAlexandr Nedvedicky int, win
189040cdc2e8SAlexandr Nedvedicky );
1891ab25eeb5Syz155240 if (
1892ab25eeb5Syz155240 #if defined(_KERNEL)
189340cdc2e8SAlexandr Nedvedicky /*
189440cdc2e8SAlexandr Nedvedicky * end <-> s + n
189540cdc2e8SAlexandr Nedvedicky * maxend <-> ack + win
189640cdc2e8SAlexandr Nedvedicky * this is upperbound check
189740cdc2e8SAlexandr Nedvedicky */
1898ab25eeb5Syz155240 (SEQ_GE(fdata->td_maxend, end)) &&
189940cdc2e8SAlexandr Nedvedicky /*
190040cdc2e8SAlexandr Nedvedicky * this is lowerbound check
190140cdc2e8SAlexandr Nedvedicky */
1902ab25eeb5Syz155240 (SEQ_GE(seq, fdata->td_end - maxwin)) &&
1903ab25eeb5Syz155240 #endif
1904ab25eeb5Syz155240 /* XXX what about big packets */
1905ab25eeb5Syz155240 #define MAXACKWINDOW 66000
1906*6a6ded8aSDan McDonald (-ackskew <= (MAXACKWINDOW)) &&
1907ab25eeb5Syz155240 ( ackskew <= (MAXACKWINDOW << fdata->td_winscale))) {
1908f17d2b41San207044 inseq = 1;
1909f17d2b41San207044 /*
1910f17d2b41San207044 * Microsoft Windows will send the next packet to the right of the
1911f17d2b41San207044 * window if SACK is in use.
1912f17d2b41San207044 */
1913f17d2b41San207044 } else if ((seq == fdata->td_maxend) && (ackskew == 0) &&
1914f17d2b41San207044 (fdata->td_winflags & TCP_SACK_PERMIT) &&
1915f17d2b41San207044 (tdata->td_winflags & TCP_SACK_PERMIT)) {
1916f17d2b41San207044 inseq = 1;
1917f17d2b41San207044 /*
1918f17d2b41San207044 * RST ACK with SEQ equal to 0 is sent by some OSes (i.e. Solaris) as a
1919f17d2b41San207044 * response to initial SYN packet, when there is no application
1920f17d2b41San207044 * listeing to on a port, where the SYN packet has came to.
1921f17d2b41San207044 */
1922f17d2b41San207044 } else if ((seq == 0) && (tcpflags == (TH_RST|TH_ACK)) &&
1923f17d2b41San207044 (ackskew >= -1) && (ackskew <= 1)) {
1924f17d2b41San207044 inseq = 1;
1925f17d2b41San207044 } else if (!(flags & IS_TCPFSM)) {
1926ab25eeb5Syz155240
1927f17d2b41San207044 if (!(fdata->td_winflags &
1928f17d2b41San207044 (TCP_WSCALE_SEEN|TCP_WSCALE_FIRST))) {
1929f17d2b41San207044 /*
1930f17d2b41San207044 * No TCPFSM and no window scaling, so make some
1931f17d2b41San207044 * extra guesses.
1932f17d2b41San207044 */
1933f17d2b41San207044 if ((seq == fdata->td_maxend) && (ackskew == 0))
1934f17d2b41San207044 inseq = 1;
1935f17d2b41San207044 else if (SEQ_GE(seq + maxwin, fdata->td_end - maxwin))
1936f17d2b41San207044 inseq = 1;
1937f17d2b41San207044 }
1938f17d2b41San207044 }
1939f17d2b41San207044
1940f17d2b41San207044 if (inseq) {
1941ab25eeb5Syz155240 /* if ackskew < 0 then this should be due to fragmented
1942ab25eeb5Syz155240 * packets. There is no way to know the length of the
1943ab25eeb5Syz155240 * total packet in advance.
1944ab25eeb5Syz155240 * We do know the total length from the fragment cache though.
1945ab25eeb5Syz155240 * Note however that there might be more sessions with
1946ab25eeb5Syz155240 * exactly the same source and destination parameters in the
1947ab25eeb5Syz155240 * state cache (and source and destination is the only stuff
1948ab25eeb5Syz155240 * that is saved in the fragment cache). Note further that
1949ab25eeb5Syz155240 * some TCP connections in the state cache are hashed with
1950ab25eeb5Syz155240 * sport and dport as well which makes it not worthwhile to
1951ab25eeb5Syz155240 * look for them.
1952ab25eeb5Syz155240 * Thus, when ackskew is negative but still seems to belong
1953ab25eeb5Syz155240 * to this session, we bump up the destinations end value.
1954ab25eeb5Syz155240 */
195540cdc2e8SAlexandr Nedvedicky if (ackskew < 0) {
195640cdc2e8SAlexandr Nedvedicky DTRACE_PROBE2(end_update_td,
195740cdc2e8SAlexandr Nedvedicky int, tdata->td_end,
195840cdc2e8SAlexandr Nedvedicky int, ack
195940cdc2e8SAlexandr Nedvedicky );
1960ab25eeb5Syz155240 tdata->td_end = ack;
196140cdc2e8SAlexandr Nedvedicky }
1962ab25eeb5Syz155240
1963ab25eeb5Syz155240 /* update max window seen */
196440cdc2e8SAlexandr Nedvedicky if (fdata->td_maxwin < win) {
196540cdc2e8SAlexandr Nedvedicky DTRACE_PROBE2(win_update_fd,
196640cdc2e8SAlexandr Nedvedicky int, fdata->td_maxwin,
196740cdc2e8SAlexandr Nedvedicky int, win
196840cdc2e8SAlexandr Nedvedicky );
1969ab25eeb5Syz155240 fdata->td_maxwin = win;
197040cdc2e8SAlexandr Nedvedicky }
197140cdc2e8SAlexandr Nedvedicky
197240cdc2e8SAlexandr Nedvedicky if (SEQ_GT(end, fdata->td_end)) {
197340cdc2e8SAlexandr Nedvedicky DTRACE_PROBE2(end_update_fd,
197440cdc2e8SAlexandr Nedvedicky int, fdata->td_end,
197540cdc2e8SAlexandr Nedvedicky int, end
197640cdc2e8SAlexandr Nedvedicky );
1977ab25eeb5Syz155240 fdata->td_end = end;
197840cdc2e8SAlexandr Nedvedicky }
197940cdc2e8SAlexandr Nedvedicky
198040cdc2e8SAlexandr Nedvedicky if (SEQ_GE(ack + win, tdata->td_maxend)) {
198140cdc2e8SAlexandr Nedvedicky DTRACE_PROBE2(max_end_update_td,
198240cdc2e8SAlexandr Nedvedicky int, tdata->td_maxend,
198340cdc2e8SAlexandr Nedvedicky int, ack + win
198440cdc2e8SAlexandr Nedvedicky );
1985ab25eeb5Syz155240 tdata->td_maxend = ack + win;
198640cdc2e8SAlexandr Nedvedicky }
198740cdc2e8SAlexandr Nedvedicky
1988ab25eeb5Syz155240 return 1;
1989ab25eeb5Syz155240 }
1990f17d2b41San207044 fin->fin_flx |= FI_OOW;
199140cdc2e8SAlexandr Nedvedicky
199240cdc2e8SAlexandr Nedvedicky #if defined(_KERNEL)
199340cdc2e8SAlexandr Nedvedicky if (!(SEQ_GE(seq, fdata->td_end - maxwin)))
199440cdc2e8SAlexandr Nedvedicky fin->fin_flx |= FI_NEG_OOW;
199540cdc2e8SAlexandr Nedvedicky #endif
199640cdc2e8SAlexandr Nedvedicky
1997ab25eeb5Syz155240 return 0;
1998ab25eeb5Syz155240 }
1999ab25eeb5Syz155240
2000ab25eeb5Syz155240
2001ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
2002ab25eeb5Syz155240 /* Function: fr_stclone */
2003ab25eeb5Syz155240 /* Returns: ipstate_t* - NULL == cloning failed, */
2004ab25eeb5Syz155240 /* else pointer to new state structure */
2005ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */
2006ab25eeb5Syz155240 /* tcp(I) - pointer to TCP/UDP header */
2007ab25eeb5Syz155240 /* is(I) - pointer to master state structure */
2008ab25eeb5Syz155240 /* */
2009ab25eeb5Syz155240 /* Create a "duplcate" state table entry from the master. */
2010ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_stclone(fin,tcp,is)2011ab25eeb5Syz155240 static ipstate_t *fr_stclone(fin, tcp, is)
2012ab25eeb5Syz155240 fr_info_t *fin;
2013ab25eeb5Syz155240 tcphdr_t *tcp;
2014ab25eeb5Syz155240 ipstate_t *is;
2015ab25eeb5Syz155240 {
2016ab25eeb5Syz155240 ipstate_t *clone;
2017ab25eeb5Syz155240 u_32_t send;
2018f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs;
2019ab25eeb5Syz155240
2020ea8244dcSJohn Ojemann /*
2021ea8244dcSJohn Ojemann * Trigger automatic call to fr_state_flush() if the
2022ea8244dcSJohn Ojemann * table has reached capacity specified by hi watermark.
2023ea8244dcSJohn Ojemann */
2024ea8244dcSJohn Ojemann if (ST_TAB_WATER_LEVEL(ifs) > ifs->ifs_state_flush_level_hi)
2025f4b3ec61Sdh155122 ifs->ifs_fr_state_doflush = 1;
2026ea8244dcSJohn Ojemann
2027ea8244dcSJohn Ojemann /*
2028ea8244dcSJohn Ojemann * If automatic flushing did not do its job, and the table
2029ea8244dcSJohn Ojemann * has filled up, don't try to create a new entry. A NULL
2030ea8244dcSJohn Ojemann * return will indicate that the cloning has failed.
2031ea8244dcSJohn Ojemann */
2032ea8244dcSJohn Ojemann if (ifs->ifs_ips_num >= ifs->ifs_fr_statemax) {
2033ea8244dcSJohn Ojemann ATOMIC_INCL(ifs->ifs_ips_stats.iss_max);
2034ab25eeb5Syz155240 return NULL;
2035ab25eeb5Syz155240 }
2036ea8244dcSJohn Ojemann
2037ab25eeb5Syz155240 KMALLOC(clone, ipstate_t *);
2038ab25eeb5Syz155240 if (clone == NULL)
2039ab25eeb5Syz155240 return NULL;
2040ab25eeb5Syz155240 bcopy((char *)is, (char *)clone, sizeof(*clone));
2041ab25eeb5Syz155240
2042ab25eeb5Syz155240 MUTEX_NUKE(&clone->is_lock);
2043ab25eeb5Syz155240
2044f4b3ec61Sdh155122 clone->is_die = ONE_DAY + ifs->ifs_fr_ticks;
2045ab25eeb5Syz155240 clone->is_state[0] = 0;
2046ab25eeb5Syz155240 clone->is_state[1] = 0;
2047ab25eeb5Syz155240 send = ntohl(tcp->th_seq) + fin->fin_dlen - (TCP_OFF(tcp) << 2) +
2048ab25eeb5Syz155240 ((tcp->th_flags & TH_SYN) ? 1 : 0) +
2049ab25eeb5Syz155240 ((tcp->th_flags & TH_FIN) ? 1 : 0);
2050ab25eeb5Syz155240
2051ab25eeb5Syz155240 if (fin->fin_rev == 1) {
2052ab25eeb5Syz155240 clone->is_dend = send;
2053ab25eeb5Syz155240 clone->is_maxdend = send;
2054ab25eeb5Syz155240 clone->is_send = 0;
2055ab25eeb5Syz155240 clone->is_maxswin = 1;
2056ab25eeb5Syz155240 clone->is_maxdwin = ntohs(tcp->th_win);
2057ab25eeb5Syz155240 if (clone->is_maxdwin == 0)
2058ab25eeb5Syz155240 clone->is_maxdwin = 1;
2059ab25eeb5Syz155240 } else {
2060ab25eeb5Syz155240 clone->is_send = send;
2061ab25eeb5Syz155240 clone->is_maxsend = send;
2062ab25eeb5Syz155240 clone->is_dend = 0;
2063ab25eeb5Syz155240 clone->is_maxdwin = 1;
2064ab25eeb5Syz155240 clone->is_maxswin = ntohs(tcp->th_win);
2065ab25eeb5Syz155240 if (clone->is_maxswin == 0)
2066ab25eeb5Syz155240 clone->is_maxswin = 1;
2067ab25eeb5Syz155240 }
2068ab25eeb5Syz155240
2069ab25eeb5Syz155240 clone->is_flags &= ~SI_CLONE;
2070ab25eeb5Syz155240 clone->is_flags |= SI_CLONED;
2071f4b3ec61Sdh155122 fr_stinsert(clone, fin->fin_rev, ifs);
207233f2fefdSDarren Reed clone->is_ref = 1;
2073ab25eeb5Syz155240 if (clone->is_p == IPPROTO_TCP) {
2074f4b3ec61Sdh155122 (void) fr_tcp_age(&clone->is_sti, fin, ifs->ifs_ips_tqtqb,
2075ab25eeb5Syz155240 clone->is_flags);
2076ab25eeb5Syz155240 }
2077ab25eeb5Syz155240 MUTEX_EXIT(&clone->is_lock);
2078ab25eeb5Syz155240 #ifdef IPFILTER_SCAN
2079ab25eeb5Syz155240 (void) ipsc_attachis(is);
2080ab25eeb5Syz155240 #endif
2081ab25eeb5Syz155240 #ifdef IPFILTER_SYNC
2082ab25eeb5Syz155240 if (is->is_flags & IS_STATESYNC)
2083ab25eeb5Syz155240 clone->is_sync = ipfsync_new(SMC_STATE, fin, clone);
2084ab25eeb5Syz155240 #endif
2085ab25eeb5Syz155240 return clone;
2086ab25eeb5Syz155240 }
2087ab25eeb5Syz155240
2088ab25eeb5Syz155240
2089ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
2090ab25eeb5Syz155240 /* Function: fr_matchsrcdst */
2091ab25eeb5Syz155240 /* Returns: Nil */
2092ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */
2093ab25eeb5Syz155240 /* is(I) - pointer to state structure */
2094ab25eeb5Syz155240 /* src(I) - pointer to source address */
2095ab25eeb5Syz155240 /* dst(I) - pointer to destination address */
2096ab25eeb5Syz155240 /* tcp(I) - pointer to TCP/UDP header */
2097ab25eeb5Syz155240 /* */
2098ab25eeb5Syz155240 /* Match a state table entry against an IP packet. The logic below is that */
2099ab25eeb5Syz155240 /* ret gets set to one if the match succeeds, else remains 0. If it is */
2100ab25eeb5Syz155240 /* still 0 after the test. no match. */
2101ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_matchsrcdst(fin,is,src,dst,tcp,cmask)2102ab25eeb5Syz155240 static ipstate_t *fr_matchsrcdst(fin, is, src, dst, tcp, cmask)
2103ab25eeb5Syz155240 fr_info_t *fin;
2104ab25eeb5Syz155240 ipstate_t *is;
2105ab25eeb5Syz155240 i6addr_t *src, *dst;
2106ab25eeb5Syz155240 tcphdr_t *tcp;
2107ab25eeb5Syz155240 u_32_t cmask;
2108ab25eeb5Syz155240 {
2109ab25eeb5Syz155240 int ret = 0, rev, out, flags, flx = 0, idx;
2110ab25eeb5Syz155240 u_short sp, dp;
2111ab25eeb5Syz155240 u_32_t cflx;
2112ab25eeb5Syz155240 void *ifp;
2113f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs;
2114ab25eeb5Syz155240
2115ab25eeb5Syz155240 rev = IP6_NEQ(&is->is_dst, dst);
2116ab25eeb5Syz155240 ifp = fin->fin_ifp;
2117ab25eeb5Syz155240 out = fin->fin_out;
2118ab25eeb5Syz155240 flags = is->is_flags;
2119ab25eeb5Syz155240 sp = 0;
2120ab25eeb5Syz155240 dp = 0;
2121ab25eeb5Syz155240
2122ab25eeb5Syz155240 if (tcp != NULL) {
2123ab25eeb5Syz155240 sp = htons(fin->fin_sport);
2124ab25eeb5Syz155240 dp = ntohs(fin->fin_dport);
2125ab25eeb5Syz155240 }
2126ab25eeb5Syz155240 if (!rev) {
2127ab25eeb5Syz155240 if (tcp != NULL) {
2128ab25eeb5Syz155240 if (!(flags & SI_W_SPORT) && (sp != is->is_sport))
2129ab25eeb5Syz155240 rev = 1;
2130ab25eeb5Syz155240 else if (!(flags & SI_W_DPORT) && (dp != is->is_dport))
2131ab25eeb5Syz155240 rev = 1;
2132ab25eeb5Syz155240 }
2133ab25eeb5Syz155240 }
2134ab25eeb5Syz155240
2135ab25eeb5Syz155240 idx = (out << 1) + rev;
2136ab25eeb5Syz155240
2137ab25eeb5Syz155240 /*
2138ab25eeb5Syz155240 * If the interface for this 'direction' is set, make sure it matches.
2139ab25eeb5Syz155240 * An interface name that is not set matches any, as does a name of *.
2140ab25eeb5Syz155240 */
2141ab25eeb5Syz155240 if ((is->is_ifp[idx] == NULL &&
2142ab25eeb5Syz155240 (*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '*')) ||
2143ab25eeb5Syz155240 is->is_ifp[idx] == ifp)
2144ab25eeb5Syz155240 ret = 1;
2145ab25eeb5Syz155240
2146d3edf6acSJan Parcel if (ret == 0) {
2147d3edf6acSJan Parcel DTRACE_PROBE(no_match_on_iface);
2148ab25eeb5Syz155240 return NULL;
2149d3edf6acSJan Parcel }
2150ab25eeb5Syz155240 ret = 0;
2151ab25eeb5Syz155240
2152ab25eeb5Syz155240 /*
2153ab25eeb5Syz155240 * Match addresses and ports.
2154ab25eeb5Syz155240 */
2155ab25eeb5Syz155240 if (rev == 0) {
2156ab25eeb5Syz155240 if ((IP6_EQ(&is->is_dst, dst) || (flags & SI_W_DADDR)) &&
2157ab25eeb5Syz155240 (IP6_EQ(&is->is_src, src) || (flags & SI_W_SADDR))) {
2158ab25eeb5Syz155240 if (tcp) {
2159ab25eeb5Syz155240 if ((sp == is->is_sport || flags & SI_W_SPORT)&&
2160ab25eeb5Syz155240 (dp == is->is_dport || flags & SI_W_DPORT))
2161ab25eeb5Syz155240 ret = 1;
2162ab25eeb5Syz155240 } else {
2163ab25eeb5Syz155240 ret = 1;
2164ab25eeb5Syz155240 }
2165ab25eeb5Syz155240 }
2166ab25eeb5Syz155240 } else {
2167ab25eeb5Syz155240 if ((IP6_EQ(&is->is_dst, src) || (flags & SI_W_DADDR)) &&
2168ab25eeb5Syz155240 (IP6_EQ(&is->is_src, dst) || (flags & SI_W_SADDR))) {
2169ab25eeb5Syz155240 if (tcp) {
2170ab25eeb5Syz155240 if ((dp == is->is_sport || flags & SI_W_SPORT)&&
2171ab25eeb5Syz155240 (sp == is->is_dport || flags & SI_W_DPORT))
2172ab25eeb5Syz155240 ret = 1;
2173ab25eeb5Syz155240 } else {
2174ab25eeb5Syz155240 ret = 1;
2175ab25eeb5Syz155240 }
2176ab25eeb5Syz155240 }
2177ab25eeb5Syz155240 }
2178ab25eeb5Syz155240
2179d3edf6acSJan Parcel if (ret == 0) {
2180d3edf6acSJan Parcel DTRACE_PROBE(no_match_on_addrs);
2181ab25eeb5Syz155240 return NULL;
2182d3edf6acSJan Parcel }
2183ab25eeb5Syz155240 /*
2184ab25eeb5Syz155240 * Whether or not this should be here, is questionable, but the aim
2185ab25eeb5Syz155240 * is to get this out of the main line.
2186ab25eeb5Syz155240 */
2187ab25eeb5Syz155240 if (tcp == NULL)
2188ab25eeb5Syz155240 flags = is->is_flags & ~(SI_WILDP|SI_NEWFR|SI_CLONE|SI_CLONED);
2189ab25eeb5Syz155240
2190ab25eeb5Syz155240 /*
2191ab25eeb5Syz155240 * Only one of the source or destination address can be flaged as a
2192ab25eeb5Syz155240 * wildcard. Fill in the missing address, if set.
2193ab25eeb5Syz155240 * For IPv6, if the address being copied in is multicast, then
2194ab25eeb5Syz155240 * don't reset the wild flag - multicast causes it to be set in the
2195ab25eeb5Syz155240 * first place!
2196ab25eeb5Syz155240 */
2197ab25eeb5Syz155240 if ((flags & (SI_W_SADDR|SI_W_DADDR))) {
2198ab25eeb5Syz155240 fr_ip_t *fi = &fin->fin_fi;
2199ab25eeb5Syz155240
2200ab25eeb5Syz155240 if ((flags & SI_W_SADDR) != 0) {
2201ab25eeb5Syz155240 if (rev == 0) {
2202ab25eeb5Syz155240 #ifdef USE_INET6
2203ab25eeb5Syz155240 if (is->is_v == 6 &&
2204ab25eeb5Syz155240 IN6_IS_ADDR_MULTICAST(&fi->fi_src.in6))
2205ab25eeb5Syz155240 /*EMPTY*/;
2206ab25eeb5Syz155240 else
2207ab25eeb5Syz155240 #endif
2208ab25eeb5Syz155240 {
2209ab25eeb5Syz155240 is->is_src = fi->fi_src;
2210ab25eeb5Syz155240 is->is_flags &= ~SI_W_SADDR;
2211ab25eeb5Syz155240 }
2212ab25eeb5Syz155240 } else {
2213ab25eeb5Syz155240 #ifdef USE_INET6
2214ab25eeb5Syz155240 if (is->is_v == 6 &&
2215ab25eeb5Syz155240 IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6))
2216ab25eeb5Syz155240 /*EMPTY*/;
2217ab25eeb5Syz155240 else
2218ab25eeb5Syz155240 #endif
2219ab25eeb5Syz155240 {
2220ab25eeb5Syz155240 is->is_src = fi->fi_dst;
2221ab25eeb5Syz155240 is->is_flags &= ~SI_W_SADDR;
2222ab25eeb5Syz155240 }
2223ab25eeb5Syz155240 }
2224ab25eeb5Syz155240 } else if ((flags & SI_W_DADDR) != 0) {
2225ab25eeb5Syz155240 if (rev == 0) {
2226ab25eeb5Syz155240 #ifdef USE_INET6
2227ab25eeb5Syz155240 if (is->is_v == 6 &&
2228ab25eeb5Syz155240 IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6))
2229ab25eeb5Syz155240 /*EMPTY*/;
2230ab25eeb5Syz155240 else
2231ab25eeb5Syz155240 #endif
2232ab25eeb5Syz155240 {
2233ab25eeb5Syz155240 is->is_dst = fi->fi_dst;
2234ab25eeb5Syz155240 is->is_flags &= ~SI_W_DADDR;
2235ab25eeb5Syz155240 }
2236ab25eeb5Syz155240 } else {
2237ab25eeb5Syz155240 #ifdef USE_INET6
2238ab25eeb5Syz155240 if (is->is_v == 6 &&
2239ab25eeb5Syz155240 IN6_IS_ADDR_MULTICAST(&fi->fi_src.in6))
2240ab25eeb5Syz155240 /*EMPTY*/;
2241ab25eeb5Syz155240 else
2242ab25eeb5Syz155240 #endif
2243ab25eeb5Syz155240 {
2244ab25eeb5Syz155240 is->is_dst = fi->fi_src;
2245ab25eeb5Syz155240 is->is_flags &= ~SI_W_DADDR;
2246ab25eeb5Syz155240 }
2247ab25eeb5Syz155240 }
2248ab25eeb5Syz155240 }
2249ab25eeb5Syz155240 if ((is->is_flags & (SI_WILDA|SI_WILDP)) == 0) {
2250f4b3ec61Sdh155122 ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild);
2251ab25eeb5Syz155240 }
2252ab25eeb5Syz155240 }
2253ab25eeb5Syz155240
2254ab25eeb5Syz155240 flx = fin->fin_flx & cmask;
2255ab25eeb5Syz155240 cflx = is->is_flx[out][rev];
2256ab25eeb5Syz155240
2257ab25eeb5Syz155240 /*
2258ab25eeb5Syz155240 * Match up any flags set from IP options.
2259ab25eeb5Syz155240 */
2260ab25eeb5Syz155240 if ((cflx && (flx != (cflx & cmask))) ||
2261ab25eeb5Syz155240 ((fin->fin_optmsk & is->is_optmsk[rev]) != is->is_opt[rev]) ||
2262ab25eeb5Syz155240 ((fin->fin_secmsk & is->is_secmsk) != is->is_sec) ||
2263d3edf6acSJan Parcel ((fin->fin_auth & is->is_authmsk) != is->is_auth)) {
2264d3edf6acSJan Parcel DTRACE_PROBE4(no_match_on_flags,
2265d3edf6acSJan Parcel int, (cflx && (flx != (cflx & cmask))),
2266d3edf6acSJan Parcel int,
2267d3edf6acSJan Parcel ((fin->fin_optmsk & is->is_optmsk[rev]) != is->is_opt[rev]),
2268d3edf6acSJan Parcel int, ((fin->fin_secmsk & is->is_secmsk) != is->is_sec),
2269d3edf6acSJan Parcel int, ((fin->fin_auth & is->is_authmsk) != is->is_auth)
2270d3edf6acSJan Parcel );
2271ab25eeb5Syz155240 return NULL;
2272d3edf6acSJan Parcel }
2273ab25eeb5Syz155240 /*
2274ab25eeb5Syz155240 * Only one of the source or destination port can be flagged as a
2275ab25eeb5Syz155240 * wildcard. When filling it in, fill in a copy of the matched entry
2276ab25eeb5Syz155240 * if it has the cloning flag set.
2277ab25eeb5Syz155240 */
2278ab25eeb5Syz155240 if ((fin->fin_flx & FI_IGNORE) != 0) {
2279ab25eeb5Syz155240 fin->fin_rev = rev;
2280ab25eeb5Syz155240 return is;
2281ab25eeb5Syz155240 }
2282ab25eeb5Syz155240
2283ab25eeb5Syz155240 if ((flags & (SI_W_SPORT|SI_W_DPORT))) {
2284ab25eeb5Syz155240 if ((flags & SI_CLONE) != 0) {
2285ab25eeb5Syz155240 ipstate_t *clone;
2286ab25eeb5Syz155240
2287ab25eeb5Syz155240 clone = fr_stclone(fin, tcp, is);
2288ab25eeb5Syz155240 if (clone == NULL)
2289ab25eeb5Syz155240 return NULL;
2290ab25eeb5Syz155240 is = clone;
2291ab25eeb5Syz155240 } else {
2292f4b3ec61Sdh155122 ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild);
2293ab25eeb5Syz155240 }
2294ab25eeb5Syz155240
2295ab25eeb5Syz155240 if ((flags & SI_W_SPORT) != 0) {
2296ab25eeb5Syz155240 if (rev == 0) {
2297ab25eeb5Syz155240 is->is_sport = sp;
2298ab25eeb5Syz155240 is->is_send = ntohl(tcp->th_seq);
2299ab25eeb5Syz155240 } else {
2300ab25eeb5Syz155240 is->is_sport = dp;
2301ab25eeb5Syz155240 is->is_send = ntohl(tcp->th_ack);
2302ab25eeb5Syz155240 }
2303ab25eeb5Syz155240 is->is_maxsend = is->is_send + 1;
2304ab25eeb5Syz155240 } else if ((flags & SI_W_DPORT) != 0) {
2305ab25eeb5Syz155240 if (rev == 0) {
2306ab25eeb5Syz155240 is->is_dport = dp;
2307ab25eeb5Syz155240 is->is_dend = ntohl(tcp->th_ack);
2308ab25eeb5Syz155240 } else {
2309ab25eeb5Syz155240 is->is_dport = sp;
2310ab25eeb5Syz155240 is->is_dend = ntohl(tcp->th_seq);
2311ab25eeb5Syz155240 }
2312ab25eeb5Syz155240 is->is_maxdend = is->is_dend + 1;
2313ab25eeb5Syz155240 }
2314ab25eeb5Syz155240 is->is_flags &= ~(SI_W_SPORT|SI_W_DPORT);
2315f4b3ec61Sdh155122 if ((flags & SI_CLONED) && ifs->ifs_ipstate_logging)
2316f4b3ec61Sdh155122 ipstate_log(is, ISL_CLONE, ifs);
2317ab25eeb5Syz155240 }
2318ab25eeb5Syz155240
2319ab25eeb5Syz155240 ret = -1;
2320ab25eeb5Syz155240
2321ab25eeb5Syz155240 if (is->is_flx[out][rev] == 0) {
2322ab25eeb5Syz155240 is->is_flx[out][rev] = flx;
2323d3edf6acSJan Parcel /*
2324d3edf6acSJan Parcel * If we are dealing with the first packet coming in reverse
2325d3edf6acSJan Parcel * direction (sent by peer), then we have to set options into
2326d3edf6acSJan Parcel * state.
2327d3edf6acSJan Parcel */
2328d3edf6acSJan Parcel if (rev == 1 && is->is_optmsk[1] == 0x0) {
2329d3edf6acSJan Parcel is->is_optmsk[1] = 0xffffffff;
2330d3edf6acSJan Parcel is->is_opt[1] = fin->fin_optmsk;
2331d3edf6acSJan Parcel DTRACE_PROBE(set_rev_opts);
2332d3edf6acSJan Parcel }
2333ab25eeb5Syz155240 if (is->is_v == 6) {
2334ab25eeb5Syz155240 is->is_opt[rev] &= ~0x8;
2335ab25eeb5Syz155240 is->is_optmsk[rev] &= ~0x8;
2336ab25eeb5Syz155240 }
2337ab25eeb5Syz155240 }
2338ab25eeb5Syz155240
2339ab25eeb5Syz155240 /*
2340ab25eeb5Syz155240 * Check if the interface name for this "direction" is set and if not,
2341ab25eeb5Syz155240 * fill it in.
2342ab25eeb5Syz155240 */
2343ab25eeb5Syz155240 if (is->is_ifp[idx] == NULL &&
2344ab25eeb5Syz155240 (*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '*')) {
2345ab25eeb5Syz155240 is->is_ifp[idx] = ifp;
2346381a2a9aSdr146992 COPYIFNAME(ifp, is->is_ifname[idx], fin->fin_v);
2347ab25eeb5Syz155240 }
2348ab25eeb5Syz155240 fin->fin_rev = rev;
2349ab25eeb5Syz155240 return is;
2350ab25eeb5Syz155240 }
2351ab25eeb5Syz155240
2352ab25eeb5Syz155240
2353ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
2354ab25eeb5Syz155240 /* Function: fr_checkicmpmatchingstate */
2355ab25eeb5Syz155240 /* Returns: Nil */
2356ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */
2357ab25eeb5Syz155240 /* */
2358ab25eeb5Syz155240 /* If we've got an ICMP error message, using the information stored in the */
2359ab25eeb5Syz155240 /* ICMP packet, look for a matching state table entry. */
2360ab25eeb5Syz155240 /* */
2361ab25eeb5Syz155240 /* If we return NULL then no lock on ipf_state is held. */
2362ab25eeb5Syz155240 /* If we return non-null then a read-lock on ipf_state is held. */
2363ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_checkicmpmatchingstate(fin)2364ab25eeb5Syz155240 static ipstate_t *fr_checkicmpmatchingstate(fin)
2365ab25eeb5Syz155240 fr_info_t *fin;
2366ab25eeb5Syz155240 {
2367ab25eeb5Syz155240 ipstate_t *is, **isp;
2368ab25eeb5Syz155240 u_short sport, dport;
2369ab25eeb5Syz155240 u_char pr;
2370ab25eeb5Syz155240 int backward, i, oi;
2371ab25eeb5Syz155240 i6addr_t dst, src;
2372ab25eeb5Syz155240 struct icmp *ic;
2373ab25eeb5Syz155240 u_short savelen;
2374ab25eeb5Syz155240 icmphdr_t *icmp;
2375ab25eeb5Syz155240 fr_info_t ofin;
2376ab25eeb5Syz155240 tcphdr_t *tcp;
2377ab25eeb5Syz155240 int len;
2378ab25eeb5Syz155240 ip_t *oip;
2379ab25eeb5Syz155240 u_int hv;
2380f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs;
2381ab25eeb5Syz155240
2382ab25eeb5Syz155240 /*
2383ab25eeb5Syz155240 * Does it at least have the return (basic) IP header ?
2384ab25eeb5Syz155240 * Is it an actual recognised ICMP error type?
2385ab25eeb5Syz155240 * Only a basic IP header (no options) should be with
2386ab25eeb5Syz155240 * an ICMP error header.
2387ab25eeb5Syz155240 */
2388ab25eeb5Syz155240 if ((fin->fin_v != 4) || (fin->fin_hlen != sizeof(ip_t)) ||
2389ab25eeb5Syz155240 (fin->fin_plen < ICMPERR_MINPKTLEN) ||
2390ab25eeb5Syz155240 !(fin->fin_flx & FI_ICMPERR))
2391ab25eeb5Syz155240 return NULL;
2392ab25eeb5Syz155240 ic = fin->fin_dp;
2393ab25eeb5Syz155240
2394ab25eeb5Syz155240 oip = (ip_t *)((char *)ic + ICMPERR_ICMPHLEN);
2395ab25eeb5Syz155240 /*
2396ab25eeb5Syz155240 * Check if the at least the old IP header (with options) and
2397ab25eeb5Syz155240 * 8 bytes of payload is present.
2398ab25eeb5Syz155240 */
2399ab25eeb5Syz155240 if (fin->fin_plen < ICMPERR_MAXPKTLEN + ((IP_HL(oip) - 5) << 2))
2400ab25eeb5Syz155240 return NULL;
2401ab25eeb5Syz155240
2402ab25eeb5Syz155240 /*
2403ab25eeb5Syz155240 * Sanity Checks.
2404ab25eeb5Syz155240 */
2405ab25eeb5Syz155240 len = fin->fin_dlen - ICMPERR_ICMPHLEN;
2406ab25eeb5Syz155240 if ((len <= 0) || ((IP_HL(oip) << 2) > len))
2407ab25eeb5Syz155240 return NULL;
2408ab25eeb5Syz155240
2409ab25eeb5Syz155240 /*
2410ab25eeb5Syz155240 * Is the buffer big enough for all of it ? It's the size of the IP
2411ab25eeb5Syz155240 * header claimed in the encapsulated part which is of concern. It
2412ab25eeb5Syz155240 * may be too big to be in this buffer but not so big that it's
2413ab25eeb5Syz155240 * outside the ICMP packet, leading to TCP deref's causing problems.
2414ab25eeb5Syz155240 * This is possible because we don't know how big oip_hl is when we
2415ab25eeb5Syz155240 * do the pullup early in fr_check() and thus can't guarantee it is
2416ab25eeb5Syz155240 * all here now.
2417ab25eeb5Syz155240 */
2418ab25eeb5Syz155240 #ifdef _KERNEL
2419ab25eeb5Syz155240 {
2420ab25eeb5Syz155240 mb_t *m;
2421ab25eeb5Syz155240
2422ab25eeb5Syz155240 m = fin->fin_m;
2423ab25eeb5Syz155240 # if defined(MENTAT)
2424ab25eeb5Syz155240 if ((char *)oip + len > (char *)m->b_wptr)
2425ab25eeb5Syz155240 return NULL;
2426ab25eeb5Syz155240 # else
2427ab25eeb5Syz155240 if ((char *)oip + len > (char *)fin->fin_ip + m->m_len)
2428ab25eeb5Syz155240 return NULL;
2429ab25eeb5Syz155240 # endif
2430ab25eeb5Syz155240 }
2431ab25eeb5Syz155240 #endif
24326f8d8657Szf203873 bcopy((char *)fin, (char *)&ofin, sizeof(*fin));
2433ab25eeb5Syz155240
2434ab25eeb5Syz155240 /*
2435ab25eeb5Syz155240 * in the IPv4 case we must zero the i6addr union otherwise
2436ab25eeb5Syz155240 * the IP6_EQ and IP6_NEQ macros produce the wrong results because
2437ab25eeb5Syz155240 * of the 'junk' in the unused part of the union
2438ab25eeb5Syz155240 */
2439ab25eeb5Syz155240 bzero((char *)&src, sizeof(src));
2440ab25eeb5Syz155240 bzero((char *)&dst, sizeof(dst));
2441ab25eeb5Syz155240
2442ab25eeb5Syz155240 /*
2443ab25eeb5Syz155240 * we make an fin entry to be able to feed it to
2444ab25eeb5Syz155240 * matchsrcdst note that not all fields are encessary
2445ab25eeb5Syz155240 * but this is the cleanest way. Note further we fill
2446ab25eeb5Syz155240 * in fin_mp such that if someone uses it we'll get
2447ab25eeb5Syz155240 * a kernel panic. fr_matchsrcdst does not use this.
2448ab25eeb5Syz155240 *
2449ab25eeb5Syz155240 * watch out here, as ip is in host order and oip in network
2450ab25eeb5Syz155240 * order. Any change we make must be undone afterwards, like
2451ab25eeb5Syz155240 * oip->ip_off - it is still in network byte order so fix it.
2452ab25eeb5Syz155240 */
2453ab25eeb5Syz155240 savelen = oip->ip_len;
2454ab25eeb5Syz155240 oip->ip_len = len;
2455ab25eeb5Syz155240 oip->ip_off = ntohs(oip->ip_off);
2456ab25eeb5Syz155240
2457ab25eeb5Syz155240 ofin.fin_flx = FI_NOCKSUM;
2458ab25eeb5Syz155240 ofin.fin_v = 4;
2459ab25eeb5Syz155240 ofin.fin_ip = oip;
2460ab25eeb5Syz155240 ofin.fin_m = NULL; /* if dereferenced, panic XXX */
2461ab25eeb5Syz155240 ofin.fin_mp = NULL; /* if dereferenced, panic XXX */
2462ab25eeb5Syz155240 ofin.fin_plen = fin->fin_dlen - ICMPERR_ICMPHLEN;
2463ab25eeb5Syz155240 (void) fr_makefrip(IP_HL(oip) << 2, oip, &ofin);
2464ab25eeb5Syz155240 ofin.fin_ifp = fin->fin_ifp;
2465ab25eeb5Syz155240 ofin.fin_out = !fin->fin_out;
2466ab25eeb5Syz155240 /*
2467ab25eeb5Syz155240 * Reset the short and bad flag here because in fr_matchsrcdst()
2468ab25eeb5Syz155240 * the flags for the current packet (fin_flx) are compared against
2469ab25eeb5Syz155240 * those for the existing session.
2470ab25eeb5Syz155240 */
2471ab25eeb5Syz155240 ofin.fin_flx &= ~(FI_BAD|FI_SHORT);
2472ab25eeb5Syz155240
2473ab25eeb5Syz155240 /*
2474ab25eeb5Syz155240 * Put old values of ip_len and ip_off back as we don't know
2475ab25eeb5Syz155240 * if we have to forward the packet (or process it again.
2476ab25eeb5Syz155240 */
2477ab25eeb5Syz155240 oip->ip_len = savelen;
2478ab25eeb5Syz155240 oip->ip_off = htons(oip->ip_off);
2479ab25eeb5Syz155240
2480ab25eeb5Syz155240 switch (oip->ip_p)
2481ab25eeb5Syz155240 {
2482ab25eeb5Syz155240 case IPPROTO_ICMP :
2483ab25eeb5Syz155240 /*
2484ab25eeb5Syz155240 * an ICMP error can only be generated as a result of an
2485ab25eeb5Syz155240 * ICMP query, not as the response on an ICMP error
2486ab25eeb5Syz155240 *
2487ab25eeb5Syz155240 * XXX theoretically ICMP_ECHOREP and the other reply's are
2488ab25eeb5Syz155240 * ICMP query's as well, but adding them here seems strange XXX
2489ab25eeb5Syz155240 */
2490ab25eeb5Syz155240 if ((ofin.fin_flx & FI_ICMPERR) != 0)
2491ab25eeb5Syz155240 return NULL;
2492ab25eeb5Syz155240
2493ab25eeb5Syz155240 /*
2494ab25eeb5Syz155240 * perform a lookup of the ICMP packet in the state table
2495ab25eeb5Syz155240 */
2496ab25eeb5Syz155240 icmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2));
2497ab25eeb5Syz155240 hv = (pr = oip->ip_p);
2498ab25eeb5Syz155240 src.in4 = oip->ip_src;
2499ab25eeb5Syz155240 hv += src.in4.s_addr;
2500ab25eeb5Syz155240 dst.in4 = oip->ip_dst;
2501ab25eeb5Syz155240 hv += dst.in4.s_addr;
2502ab25eeb5Syz155240 hv += icmp->icmp_id;
2503f4b3ec61Sdh155122 hv = DOUBLE_HASH(hv, ifs);
2504ab25eeb5Syz155240
2505f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state);
2506f4b3ec61Sdh155122 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) {
2507ab25eeb5Syz155240 isp = &is->is_hnext;
2508ab25eeb5Syz155240 if ((is->is_p != pr) || (is->is_v != 4))
2509ab25eeb5Syz155240 continue;
2510ab25eeb5Syz155240 if (is->is_pass & FR_NOICMPERR)
2511ab25eeb5Syz155240 continue;
2512ab25eeb5Syz155240 is = fr_matchsrcdst(&ofin, is, &src, &dst,
2513ab25eeb5Syz155240 NULL, FI_ICMPCMP);
2514ab25eeb5Syz155240 if (is != NULL) {
2515ab25eeb5Syz155240 if ((is->is_pass & FR_NOICMPERR) != 0) {
2516f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
2517ab25eeb5Syz155240 return NULL;
2518ab25eeb5Syz155240 }
2519ab25eeb5Syz155240 /*
2520ab25eeb5Syz155240 * i : the index of this packet (the icmp
2521ab25eeb5Syz155240 * unreachable)
2522ab25eeb5Syz155240 * oi : the index of the original packet found
2523ab25eeb5Syz155240 * in the icmp header (i.e. the packet
2524ab25eeb5Syz155240 * causing this icmp)
2525ab25eeb5Syz155240 * backward : original packet was backward
2526ab25eeb5Syz155240 * compared to the state
2527ab25eeb5Syz155240 */
2528ab25eeb5Syz155240 backward = IP6_NEQ(&is->is_src, &src);
2529ab25eeb5Syz155240 fin->fin_rev = !backward;
2530ab25eeb5Syz155240 i = (!backward << 1) + fin->fin_out;
2531ab25eeb5Syz155240 oi = (backward << 1) + ofin.fin_out;
2532ab25eeb5Syz155240 if (is->is_icmppkts[i] > is->is_pkts[oi])
2533ab25eeb5Syz155240 continue;
2534f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_hits++;
2535ab25eeb5Syz155240 is->is_icmppkts[i]++;
2536ab25eeb5Syz155240 return is;
2537ab25eeb5Syz155240 }
2538ab25eeb5Syz155240 }
2539f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
2540ab25eeb5Syz155240 return NULL;
2541ab25eeb5Syz155240 case IPPROTO_TCP :
2542ab25eeb5Syz155240 case IPPROTO_UDP :
2543ab25eeb5Syz155240 break;
2544ab25eeb5Syz155240 default :
2545ab25eeb5Syz155240 return NULL;
2546ab25eeb5Syz155240 }
2547ab25eeb5Syz155240
2548ab25eeb5Syz155240 tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2));
2549ab25eeb5Syz155240 dport = tcp->th_dport;
2550ab25eeb5Syz155240 sport = tcp->th_sport;
2551ab25eeb5Syz155240
2552ab25eeb5Syz155240 hv = (pr = oip->ip_p);
2553ab25eeb5Syz155240 src.in4 = oip->ip_src;
2554ab25eeb5Syz155240 hv += src.in4.s_addr;
2555ab25eeb5Syz155240 dst.in4 = oip->ip_dst;
2556ab25eeb5Syz155240 hv += dst.in4.s_addr;
2557ab25eeb5Syz155240 hv += dport;
2558ab25eeb5Syz155240 hv += sport;
2559f4b3ec61Sdh155122 hv = DOUBLE_HASH(hv, ifs);
2560ab25eeb5Syz155240
2561f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state);
2562f4b3ec61Sdh155122 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) {
2563ab25eeb5Syz155240 isp = &is->is_hnext;
2564ab25eeb5Syz155240 /*
2565ab25eeb5Syz155240 * Only allow this icmp though if the
2566ab25eeb5Syz155240 * encapsulated packet was allowed through the
2567ab25eeb5Syz155240 * other way around. Note that the minimal amount
2568ab25eeb5Syz155240 * of info present does not allow for checking against
2569ab25eeb5Syz155240 * tcp internals such as seq and ack numbers. Only the
2570ab25eeb5Syz155240 * ports are known to be present and can be even if the
2571ab25eeb5Syz155240 * short flag is set.
2572ab25eeb5Syz155240 */
2573ab25eeb5Syz155240 if ((is->is_p == pr) && (is->is_v == 4) &&
2574ab25eeb5Syz155240 (is = fr_matchsrcdst(&ofin, is, &src, &dst,
2575ab25eeb5Syz155240 tcp, FI_ICMPCMP))) {
2576ab25eeb5Syz155240 /*
2577ab25eeb5Syz155240 * i : the index of this packet (the icmp unreachable)
2578ab25eeb5Syz155240 * oi : the index of the original packet found in the
2579ab25eeb5Syz155240 * icmp header (i.e. the packet causing this icmp)
2580ab25eeb5Syz155240 * backward : original packet was backward compared to
2581ab25eeb5Syz155240 * the state
2582ab25eeb5Syz155240 */
2583ab25eeb5Syz155240 backward = IP6_NEQ(&is->is_src, &src);
2584ab25eeb5Syz155240 fin->fin_rev = !backward;
2585ab25eeb5Syz155240 i = (!backward << 1) + fin->fin_out;
2586ab25eeb5Syz155240 oi = (backward << 1) + ofin.fin_out;
2587ab25eeb5Syz155240
2588ab25eeb5Syz155240 if (((is->is_pass & FR_NOICMPERR) != 0) ||
2589ab25eeb5Syz155240 (is->is_icmppkts[i] > is->is_pkts[oi]))
2590ab25eeb5Syz155240 break;
2591f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_hits++;
2592ab25eeb5Syz155240 is->is_icmppkts[i]++;
2593ab25eeb5Syz155240 /*
2594ab25eeb5Syz155240 * we deliberately do not touch the timeouts
2595ab25eeb5Syz155240 * for the accompanying state table entry.
2596ab25eeb5Syz155240 * It remains to be seen if that is correct. XXX
2597ab25eeb5Syz155240 */
2598ab25eeb5Syz155240 return is;
2599ab25eeb5Syz155240 }
2600ab25eeb5Syz155240 }
2601f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
2602ab25eeb5Syz155240 return NULL;
2603ab25eeb5Syz155240 }
2604ab25eeb5Syz155240
2605ab25eeb5Syz155240
2606ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
2607ab25eeb5Syz155240 /* Function: fr_ipsmove */
2608ab25eeb5Syz155240 /* Returns: Nil */
2609ab25eeb5Syz155240 /* Parameters: is(I) - pointer to state table entry */
2610ab25eeb5Syz155240 /* hv(I) - new hash value for state table entry */
2611ab25eeb5Syz155240 /* Write Locks: ipf_state */
2612ab25eeb5Syz155240 /* */
2613ab25eeb5Syz155240 /* Move a state entry from one position in the hash table to another. */
2614ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_ipsmove(is,hv,ifs)2615f4b3ec61Sdh155122 static void fr_ipsmove(is, hv, ifs)
2616ab25eeb5Syz155240 ipstate_t *is;
2617ab25eeb5Syz155240 u_int hv;
2618f4b3ec61Sdh155122 ipf_stack_t *ifs;
2619ab25eeb5Syz155240 {
2620ab25eeb5Syz155240 ipstate_t **isp;
2621ab25eeb5Syz155240 u_int hvm;
2622ab25eeb5Syz155240
2623f4b3ec61Sdh155122 ASSERT(rw_read_locked(&ifs->ifs_ipf_state.ipf_lk) == 0);
2624ab25eeb5Syz155240
2625ab25eeb5Syz155240 hvm = is->is_hv;
2626ab25eeb5Syz155240 /*
2627ab25eeb5Syz155240 * Remove the hash from the old location...
2628ab25eeb5Syz155240 */
2629ab25eeb5Syz155240 isp = is->is_phnext;
2630ab25eeb5Syz155240 if (is->is_hnext)
2631ab25eeb5Syz155240 is->is_hnext->is_phnext = isp;
2632ab25eeb5Syz155240 *isp = is->is_hnext;
2633f4b3ec61Sdh155122 if (ifs->ifs_ips_table[hvm] == NULL)
2634f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_inuse--;
2635f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_bucketlen[hvm]--;
2636ab25eeb5Syz155240
2637ab25eeb5Syz155240 /*
2638ab25eeb5Syz155240 * ...and put the hash in the new one.
2639ab25eeb5Syz155240 */
2640f4b3ec61Sdh155122 hvm = DOUBLE_HASH(hv, ifs);
2641ab25eeb5Syz155240 is->is_hv = hvm;
2642f4b3ec61Sdh155122 isp = &ifs->ifs_ips_table[hvm];
2643ab25eeb5Syz155240 if (*isp)
2644ab25eeb5Syz155240 (*isp)->is_phnext = &is->is_hnext;
2645ab25eeb5Syz155240 else
2646f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_inuse++;
2647f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_bucketlen[hvm]++;
2648ab25eeb5Syz155240 is->is_phnext = isp;
2649ab25eeb5Syz155240 is->is_hnext = *isp;
2650ab25eeb5Syz155240 *isp = is;
2651ab25eeb5Syz155240 }
2652ab25eeb5Syz155240
2653ab25eeb5Syz155240
2654ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
2655ab25eeb5Syz155240 /* Function: fr_stlookup */
2656ab25eeb5Syz155240 /* Returns: ipstate_t* - NULL == no matching state found, */
2657ab25eeb5Syz155240 /* else pointer to state information is returned */
2658ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */
2659ab25eeb5Syz155240 /* tcp(I) - pointer to TCP/UDP header. */
2660ab25eeb5Syz155240 /* */
2661ab25eeb5Syz155240 /* Search the state table for a matching entry to the packet described by */
2662ab25eeb5Syz155240 /* the contents of *fin. */
2663ab25eeb5Syz155240 /* */
2664ab25eeb5Syz155240 /* If we return NULL then no lock on ipf_state is held. */
2665ab25eeb5Syz155240 /* If we return non-null then a read-lock on ipf_state is held. */
2666ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_stlookup(fin,tcp,ifqp)2667ab25eeb5Syz155240 ipstate_t *fr_stlookup(fin, tcp, ifqp)
2668ab25eeb5Syz155240 fr_info_t *fin;
2669ab25eeb5Syz155240 tcphdr_t *tcp;
2670ab25eeb5Syz155240 ipftq_t **ifqp;
2671ab25eeb5Syz155240 {
2672ab25eeb5Syz155240 u_int hv, hvm, pr, v, tryagain;
2673ab25eeb5Syz155240 ipstate_t *is, **isp;
2674ab25eeb5Syz155240 u_short dport, sport;
2675ab25eeb5Syz155240 i6addr_t src, dst;
2676ab25eeb5Syz155240 struct icmp *ic;
2677ab25eeb5Syz155240 ipftq_t *ifq;
2678ab25eeb5Syz155240 int oow;
2679f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs;
2680ab25eeb5Syz155240
2681ab25eeb5Syz155240 is = NULL;
2682ab25eeb5Syz155240 ifq = NULL;
2683ab25eeb5Syz155240 tcp = fin->fin_dp;
2684ab25eeb5Syz155240 ic = (struct icmp *)tcp;
2685ab25eeb5Syz155240 hv = (pr = fin->fin_fi.fi_p);
2686ab25eeb5Syz155240 src = fin->fin_fi.fi_src;
2687ab25eeb5Syz155240 dst = fin->fin_fi.fi_dst;
2688ab25eeb5Syz155240 hv += src.in4.s_addr;
2689ab25eeb5Syz155240 hv += dst.in4.s_addr;
2690ab25eeb5Syz155240
2691ab25eeb5Syz155240 v = fin->fin_fi.fi_v;
2692ab25eeb5Syz155240 #ifdef USE_INET6
2693ab25eeb5Syz155240 if (v == 6) {
2694ab25eeb5Syz155240 hv += fin->fin_fi.fi_src.i6[1];
2695ab25eeb5Syz155240 hv += fin->fin_fi.fi_src.i6[2];
2696ab25eeb5Syz155240 hv += fin->fin_fi.fi_src.i6[3];
2697ab25eeb5Syz155240
2698ab25eeb5Syz155240 if ((fin->fin_p == IPPROTO_ICMPV6) &&
2699ab25eeb5Syz155240 IN6_IS_ADDR_MULTICAST(&fin->fin_fi.fi_dst.in6)) {
2700ab25eeb5Syz155240 hv -= dst.in4.s_addr;
2701ab25eeb5Syz155240 } else {
2702ab25eeb5Syz155240 hv += fin->fin_fi.fi_dst.i6[1];
2703ab25eeb5Syz155240 hv += fin->fin_fi.fi_dst.i6[2];
2704ab25eeb5Syz155240 hv += fin->fin_fi.fi_dst.i6[3];
2705ab25eeb5Syz155240 }
2706ab25eeb5Syz155240 }
2707ab25eeb5Syz155240 #endif
2708bb1d9de5SJohn Ojemann if ((v == 4) &&
2709bb1d9de5SJohn Ojemann (fin->fin_flx & (FI_MULTICAST|FI_BROADCAST|FI_MBCAST))) {
2710bb1d9de5SJohn Ojemann if (fin->fin_out == 0) {
2711bb1d9de5SJohn Ojemann hv -= src.in4.s_addr;
2712bb1d9de5SJohn Ojemann } else {
2713bb1d9de5SJohn Ojemann hv -= dst.in4.s_addr;
2714bb1d9de5SJohn Ojemann }
2715bb1d9de5SJohn Ojemann }
2716ab25eeb5Syz155240
2717ab25eeb5Syz155240 /*
2718ab25eeb5Syz155240 * Search the hash table for matching packet header info.
2719ab25eeb5Syz155240 */
2720ab25eeb5Syz155240 switch (pr)
2721ab25eeb5Syz155240 {
2722ab25eeb5Syz155240 #ifdef USE_INET6
2723ab25eeb5Syz155240 case IPPROTO_ICMPV6 :
2724ab25eeb5Syz155240 tryagain = 0;
2725ab25eeb5Syz155240 if (v == 6) {
2726ab25eeb5Syz155240 if ((ic->icmp_type == ICMP6_ECHO_REQUEST) ||
2727ab25eeb5Syz155240 (ic->icmp_type == ICMP6_ECHO_REPLY)) {
2728ab25eeb5Syz155240 hv += ic->icmp_id;
2729ab25eeb5Syz155240 }
2730ab25eeb5Syz155240 }
2731f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state);
2732ab25eeb5Syz155240 icmp6again:
2733f4b3ec61Sdh155122 hvm = DOUBLE_HASH(hv, ifs);
2734f4b3ec61Sdh155122 for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) {
2735ab25eeb5Syz155240 isp = &is->is_hnext;
2736ab25eeb5Syz155240 if ((is->is_p != pr) || (is->is_v != v))
2737ab25eeb5Syz155240 continue;
2738ab25eeb5Syz155240 is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP);
2739ab25eeb5Syz155240 if (is != NULL &&
2740ab25eeb5Syz155240 fr_matchicmpqueryreply(v, &is->is_icmp,
2741ab25eeb5Syz155240 ic, fin->fin_rev)) {
2742ab25eeb5Syz155240 if (fin->fin_rev)
2743f4b3ec61Sdh155122 ifq = &ifs->ifs_ips_icmpacktq;
2744ab25eeb5Syz155240 else
2745f4b3ec61Sdh155122 ifq = &ifs->ifs_ips_icmptq;
2746ab25eeb5Syz155240 break;
2747ab25eeb5Syz155240 }
2748ab25eeb5Syz155240 }
2749ab25eeb5Syz155240
2750ab25eeb5Syz155240 if (is != NULL) {
2751ab25eeb5Syz155240 if ((tryagain != 0) && !(is->is_flags & SI_W_DADDR)) {
2752ab25eeb5Syz155240 hv += fin->fin_fi.fi_src.i6[0];
2753ab25eeb5Syz155240 hv += fin->fin_fi.fi_src.i6[1];
2754ab25eeb5Syz155240 hv += fin->fin_fi.fi_src.i6[2];
2755ab25eeb5Syz155240 hv += fin->fin_fi.fi_src.i6[3];
2756f4b3ec61Sdh155122 fr_ipsmove(is, hv, ifs);
2757f4b3ec61Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_state);
2758ab25eeb5Syz155240 }
2759ab25eeb5Syz155240 break;
2760ab25eeb5Syz155240 }
2761f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
2762ab25eeb5Syz155240
2763ab25eeb5Syz155240 /*
2764ab25eeb5Syz155240 * No matching icmp state entry. Perhaps this is a
2765ab25eeb5Syz155240 * response to another state entry.
2766ab25eeb5Syz155240 *
2767ab25eeb5Syz155240 * XXX With some ICMP6 packets, the "other" address is already
2768ab25eeb5Syz155240 * in the packet, after the ICMP6 header, and this could be
2769ab25eeb5Syz155240 * used in place of the multicast address. However, taking
2770ab25eeb5Syz155240 * advantage of this requires some significant code changes
2771ab25eeb5Syz155240 * to handle the specific types where that is the case.
2772ab25eeb5Syz155240 */
2773f4b3ec61Sdh155122 if ((ifs->ifs_ips_stats.iss_wild != 0) && (v == 6) && (tryagain == 0) &&
2774ab25eeb5Syz155240 !IN6_IS_ADDR_MULTICAST(&fin->fin_fi.fi_src.in6)) {
2775ab25eeb5Syz155240 hv -= fin->fin_fi.fi_src.i6[0];
2776ab25eeb5Syz155240 hv -= fin->fin_fi.fi_src.i6[1];
2777ab25eeb5Syz155240 hv -= fin->fin_fi.fi_src.i6[2];
2778ab25eeb5Syz155240 hv -= fin->fin_fi.fi_src.i6[3];
2779ab25eeb5Syz155240 tryagain = 1;
2780f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state);
2781ab25eeb5Syz155240 goto icmp6again;
2782ab25eeb5Syz155240 }
2783ab25eeb5Syz155240
2784ab25eeb5Syz155240 is = fr_checkicmp6matchingstate(fin);
2785ab25eeb5Syz155240 if (is != NULL)
2786ab25eeb5Syz155240 return is;
2787ab25eeb5Syz155240 break;
2788ab25eeb5Syz155240 #endif
2789ab25eeb5Syz155240
2790ab25eeb5Syz155240 case IPPROTO_ICMP :
2791ab25eeb5Syz155240 if (v == 4) {
2792ab25eeb5Syz155240 hv += ic->icmp_id;
2793ab25eeb5Syz155240 }
2794f4b3ec61Sdh155122 hv = DOUBLE_HASH(hv, ifs);
2795f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state);
2796f4b3ec61Sdh155122 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) {
2797ab25eeb5Syz155240 isp = &is->is_hnext;
2798ab25eeb5Syz155240 if ((is->is_p != pr) || (is->is_v != v))
2799ab25eeb5Syz155240 continue;
2800ab25eeb5Syz155240 is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP);
2801ab25eeb5Syz155240 if (is != NULL &&
2802ab25eeb5Syz155240 fr_matchicmpqueryreply(v, &is->is_icmp,
2803ab25eeb5Syz155240 ic, fin->fin_rev)) {
2804ab25eeb5Syz155240 if (fin->fin_rev)
2805f4b3ec61Sdh155122 ifq = &ifs->ifs_ips_icmpacktq;
2806ab25eeb5Syz155240 else
2807f4b3ec61Sdh155122 ifq = &ifs->ifs_ips_icmptq;
2808ab25eeb5Syz155240 break;
2809ab25eeb5Syz155240 }
2810ab25eeb5Syz155240 }
2811ab25eeb5Syz155240 if (is == NULL) {
2812f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
2813ab25eeb5Syz155240 }
2814ab25eeb5Syz155240 break;
2815ab25eeb5Syz155240
2816ab25eeb5Syz155240 case IPPROTO_TCP :
2817ab25eeb5Syz155240 case IPPROTO_UDP :
2818ab25eeb5Syz155240 ifqp = NULL;
2819ab25eeb5Syz155240 sport = htons(fin->fin_data[0]);
2820ab25eeb5Syz155240 hv += sport;
2821ab25eeb5Syz155240 dport = htons(fin->fin_data[1]);
2822ab25eeb5Syz155240 hv += dport;
2823ab25eeb5Syz155240 oow = 0;
2824ab25eeb5Syz155240 tryagain = 0;
2825f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state);
2826ab25eeb5Syz155240 retry_tcpudp:
2827f4b3ec61Sdh155122 hvm = DOUBLE_HASH(hv, ifs);
2828f4b3ec61Sdh155122 for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) {
2829ab25eeb5Syz155240 isp = &is->is_hnext;
2830ab25eeb5Syz155240 if ((is->is_p != pr) || (is->is_v != v))
2831ab25eeb5Syz155240 continue;
2832ab25eeb5Syz155240 fin->fin_flx &= ~FI_OOW;
2833ab25eeb5Syz155240 is = fr_matchsrcdst(fin, is, &src, &dst, tcp, FI_CMP);
2834ab25eeb5Syz155240 if (is != NULL) {
2835ab25eeb5Syz155240 if (pr == IPPROTO_TCP) {
2836ab25eeb5Syz155240 if (!fr_tcpstate(fin, tcp, is)) {
2837ab25eeb5Syz155240 oow |= fin->fin_flx & FI_OOW;
2838ab25eeb5Syz155240 continue;
2839ab25eeb5Syz155240 }
2840ab25eeb5Syz155240 }
2841ab25eeb5Syz155240 break;
2842ab25eeb5Syz155240 }
2843ab25eeb5Syz155240 }
2844ab25eeb5Syz155240 if (is != NULL) {
2845ab25eeb5Syz155240 if (tryagain &&
2846ab25eeb5Syz155240 !(is->is_flags & (SI_CLONE|SI_WILDP|SI_WILDA))) {
2847ab25eeb5Syz155240 hv += dport;
2848ab25eeb5Syz155240 hv += sport;
2849f4b3ec61Sdh155122 fr_ipsmove(is, hv, ifs);
2850f4b3ec61Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_state);
2851ab25eeb5Syz155240 }
2852ab25eeb5Syz155240 break;
2853ab25eeb5Syz155240 }
2854f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
2855ab25eeb5Syz155240
2856bb1d9de5SJohn Ojemann if (ifs->ifs_ips_stats.iss_wild) {
2857bb1d9de5SJohn Ojemann if (tryagain == 0) {
2858ab25eeb5Syz155240 hv -= dport;
2859ab25eeb5Syz155240 hv -= sport;
2860bb1d9de5SJohn Ojemann } else if (tryagain == 1) {
2861bb1d9de5SJohn Ojemann hv = fin->fin_fi.fi_p;
2862bb1d9de5SJohn Ojemann /*
2863bb1d9de5SJohn Ojemann * If we try to pretend this is a reply to a
2864bb1d9de5SJohn Ojemann * multicast/broadcast packet then we need to
2865bb1d9de5SJohn Ojemann * exclude part of the address from the hash
2866bb1d9de5SJohn Ojemann * calculation.
2867bb1d9de5SJohn Ojemann */
2868bb1d9de5SJohn Ojemann if (fin->fin_out == 0) {
2869bb1d9de5SJohn Ojemann hv += src.in4.s_addr;
2870bb1d9de5SJohn Ojemann } else {
2871bb1d9de5SJohn Ojemann hv += dst.in4.s_addr;
2872bb1d9de5SJohn Ojemann }
2873bb1d9de5SJohn Ojemann hv += dport;
2874bb1d9de5SJohn Ojemann hv += sport;
2875bb1d9de5SJohn Ojemann }
2876bb1d9de5SJohn Ojemann tryagain++;
2877bb1d9de5SJohn Ojemann if (tryagain <= 2) {
2878f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state);
2879ab25eeb5Syz155240 goto retry_tcpudp;
2880ab25eeb5Syz155240 }
2881bb1d9de5SJohn Ojemann }
2882ab25eeb5Syz155240 fin->fin_flx |= oow;
2883ab25eeb5Syz155240 break;
2884ab25eeb5Syz155240
2885ab25eeb5Syz155240 #if 0
2886ab25eeb5Syz155240 case IPPROTO_GRE :
2887ab25eeb5Syz155240 gre = fin->fin_dp;
2888ab25eeb5Syz155240 if (GRE_REV(gre->gr_flags) == 1) {
2889ab25eeb5Syz155240 hv += gre->gr_call;
2890ab25eeb5Syz155240 }
2891ab25eeb5Syz155240 /* FALLTHROUGH */
2892ab25eeb5Syz155240 #endif
2893ab25eeb5Syz155240 default :
2894ab25eeb5Syz155240 ifqp = NULL;
2895f4b3ec61Sdh155122 hvm = DOUBLE_HASH(hv, ifs);
2896f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state);
2897f4b3ec61Sdh155122 for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) {
2898ab25eeb5Syz155240 isp = &is->is_hnext;
2899ab25eeb5Syz155240 if ((is->is_p != pr) || (is->is_v != v))
2900ab25eeb5Syz155240 continue;
2901ab25eeb5Syz155240 is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP);
2902ab25eeb5Syz155240 if (is != NULL) {
2903f4b3ec61Sdh155122 ifq = &ifs->ifs_ips_iptq;
2904ab25eeb5Syz155240 break;
2905ab25eeb5Syz155240 }
2906ab25eeb5Syz155240 }
2907ab25eeb5Syz155240 if (is == NULL) {
2908f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
2909ab25eeb5Syz155240 }
2910ab25eeb5Syz155240 break;
2911ab25eeb5Syz155240 }
2912ab25eeb5Syz155240
2913ab25eeb5Syz155240 if ((is != NULL) && ((is->is_sti.tqe_flags & TQE_RULEBASED) != 0) &&
2914ab25eeb5Syz155240 (is->is_tqehead[fin->fin_rev] != NULL))
2915ab25eeb5Syz155240 ifq = is->is_tqehead[fin->fin_rev];
2916ab25eeb5Syz155240 if (ifq != NULL && ifqp != NULL)
2917ab25eeb5Syz155240 *ifqp = ifq;
2918ab25eeb5Syz155240 return is;
2919ab25eeb5Syz155240 }
2920ab25eeb5Syz155240
2921ab25eeb5Syz155240
2922ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
2923ab25eeb5Syz155240 /* Function: fr_updatestate */
2924ab25eeb5Syz155240 /* Returns: Nil */
2925ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */
2926ab25eeb5Syz155240 /* is(I) - pointer to state table entry */
2927ab25eeb5Syz155240 /* Read Locks: ipf_state */
2928ab25eeb5Syz155240 /* */
2929ab25eeb5Syz155240 /* Updates packet and byte counters for a newly received packet. Seeds the */
2930ab25eeb5Syz155240 /* fragment cache with a new entry as required. */
2931ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_updatestate(fin,is,ifq)2932ab25eeb5Syz155240 void fr_updatestate(fin, is, ifq)
2933ab25eeb5Syz155240 fr_info_t *fin;
2934ab25eeb5Syz155240 ipstate_t *is;
2935ab25eeb5Syz155240 ipftq_t *ifq;
2936ab25eeb5Syz155240 {
2937ab25eeb5Syz155240 ipftqent_t *tqe;
2938ab25eeb5Syz155240 int i, pass;
2939f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs;
2940ab25eeb5Syz155240
2941ab25eeb5Syz155240 i = (fin->fin_rev << 1) + fin->fin_out;
2942ab25eeb5Syz155240
2943ab25eeb5Syz155240 /*
2944ab25eeb5Syz155240 * For TCP packets, ifq == NULL. For all others, check if this new
2945ab25eeb5Syz155240 * queue is different to the last one it was on and move it if so.
2946ab25eeb5Syz155240 */
2947ab25eeb5Syz155240 tqe = &is->is_sti;
2948ab25eeb5Syz155240 MUTEX_ENTER(&is->is_lock);
2949ab25eeb5Syz155240 if ((tqe->tqe_flags & TQE_RULEBASED) != 0)
2950ab25eeb5Syz155240 ifq = is->is_tqehead[fin->fin_rev];
2951ab25eeb5Syz155240
2952ab25eeb5Syz155240 if (ifq != NULL)
2953f4b3ec61Sdh155122 fr_movequeue(tqe, tqe->tqe_ifq, ifq, ifs);
2954ab25eeb5Syz155240
2955ab25eeb5Syz155240 is->is_pkts[i]++;
295633f2fefdSDarren Reed fin->fin_pktnum = is->is_pkts[i] + is->is_icmppkts[i];
2957ab25eeb5Syz155240 is->is_bytes[i] += fin->fin_plen;
2958ab25eeb5Syz155240 MUTEX_EXIT(&is->is_lock);
2959ab25eeb5Syz155240
2960ab25eeb5Syz155240 #ifdef IPFILTER_SYNC
2961ab25eeb5Syz155240 if (is->is_flags & IS_STATESYNC)
2962ab25eeb5Syz155240 ipfsync_update(SMC_STATE, fin, is->is_sync);
2963ab25eeb5Syz155240 #endif
2964ab25eeb5Syz155240
2965f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_hits);
2966ab25eeb5Syz155240
2967ab25eeb5Syz155240 fin->fin_fr = is->is_rule;
2968ab25eeb5Syz155240
2969ab25eeb5Syz155240 /*
2970ab25eeb5Syz155240 * If this packet is a fragment and the rule says to track fragments,
2971ab25eeb5Syz155240 * then create a new fragment cache entry.
2972ab25eeb5Syz155240 */
2973ab25eeb5Syz155240 pass = is->is_pass;
2974ab25eeb5Syz155240 if ((fin->fin_flx & FI_FRAG) && FR_ISPASS(pass))
2975ab25eeb5Syz155240 (void) fr_newfrag(fin, pass ^ FR_KEEPSTATE);
2976ab25eeb5Syz155240 }
2977ab25eeb5Syz155240
2978ab25eeb5Syz155240
2979ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
2980ab25eeb5Syz155240 /* Function: fr_checkstate */
2981ab25eeb5Syz155240 /* Returns: frentry_t* - NULL == search failed, */
2982ab25eeb5Syz155240 /* else pointer to rule for matching state */
2983ab25eeb5Syz155240 /* Parameters: ifp(I) - pointer to interface */
2984ab25eeb5Syz155240 /* passp(I) - pointer to filtering result flags */
2985ab25eeb5Syz155240 /* */
2986ab25eeb5Syz155240 /* Check if a packet is associated with an entry in the state table. */
2987ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_checkstate(fin,passp)2988ab25eeb5Syz155240 frentry_t *fr_checkstate(fin, passp)
2989ab25eeb5Syz155240 fr_info_t *fin;
2990ab25eeb5Syz155240 u_32_t *passp;
2991ab25eeb5Syz155240 {
2992ab25eeb5Syz155240 ipstate_t *is;
2993ab25eeb5Syz155240 frentry_t *fr;
2994ab25eeb5Syz155240 tcphdr_t *tcp;
2995ab25eeb5Syz155240 ipftq_t *ifq;
2996ab25eeb5Syz155240 u_int pass;
2997f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs;
2998ab25eeb5Syz155240
2999f4b3ec61Sdh155122 if (ifs->ifs_fr_state_lock || (ifs->ifs_ips_list == NULL) ||
3000ab25eeb5Syz155240 (fin->fin_flx & (FI_SHORT|FI_STATE|FI_FRAGBODY|FI_BAD)))
3001ab25eeb5Syz155240 return NULL;
3002ab25eeb5Syz155240
3003ab25eeb5Syz155240 is = NULL;
3004ab25eeb5Syz155240 if ((fin->fin_flx & FI_TCPUDP) ||
3005ab25eeb5Syz155240 (fin->fin_fi.fi_p == IPPROTO_ICMP)
3006ab25eeb5Syz155240 #ifdef USE_INET6
3007ab25eeb5Syz155240 || (fin->fin_fi.fi_p == IPPROTO_ICMPV6)
3008ab25eeb5Syz155240 #endif
3009ab25eeb5Syz155240 )
3010ab25eeb5Syz155240 tcp = fin->fin_dp;
3011ab25eeb5Syz155240 else
3012ab25eeb5Syz155240 tcp = NULL;
3013ab25eeb5Syz155240
3014ab25eeb5Syz155240 /*
3015ab25eeb5Syz155240 * Search the hash table for matching packet header info.
3016ab25eeb5Syz155240 */
3017ab25eeb5Syz155240 ifq = NULL;
3018ab25eeb5Syz155240 is = fr_stlookup(fin, tcp, &ifq);
3019ab25eeb5Syz155240 switch (fin->fin_p)
3020ab25eeb5Syz155240 {
3021ab25eeb5Syz155240 #ifdef USE_INET6
3022ab25eeb5Syz155240 case IPPROTO_ICMPV6 :
3023ab25eeb5Syz155240 if (is != NULL)
3024ab25eeb5Syz155240 break;
3025ab25eeb5Syz155240 if (fin->fin_v == 6) {
3026ab25eeb5Syz155240 is = fr_checkicmp6matchingstate(fin);
3027ab25eeb5Syz155240 if (is != NULL)
3028ab25eeb5Syz155240 goto matched;
3029ab25eeb5Syz155240 }
3030ab25eeb5Syz155240 break;
3031ab25eeb5Syz155240 #endif
3032ab25eeb5Syz155240 case IPPROTO_ICMP :
3033ab25eeb5Syz155240 if (is != NULL)
3034ab25eeb5Syz155240 break;
3035ab25eeb5Syz155240 /*
3036ab25eeb5Syz155240 * No matching icmp state entry. Perhaps this is a
3037ab25eeb5Syz155240 * response to another state entry.
3038ab25eeb5Syz155240 */
3039ab25eeb5Syz155240 is = fr_checkicmpmatchingstate(fin);
3040ab25eeb5Syz155240 if (is != NULL)
3041ab25eeb5Syz155240 goto matched;
3042ab25eeb5Syz155240 break;
3043ab25eeb5Syz155240 case IPPROTO_TCP :
3044ab25eeb5Syz155240 if (is == NULL)
3045ab25eeb5Syz155240 break;
3046ab25eeb5Syz155240
3047ab25eeb5Syz155240 if (is->is_pass & FR_NEWISN) {
3048ab25eeb5Syz155240 if (fin->fin_out == 0)
3049ab25eeb5Syz155240 fr_fixinisn(fin, is);
3050ab25eeb5Syz155240 else if (fin->fin_out == 1)
3051ab25eeb5Syz155240 fr_fixoutisn(fin, is);
3052ab25eeb5Syz155240 }
3053ab25eeb5Syz155240 break;
3054ab25eeb5Syz155240 default :
3055ab25eeb5Syz155240 if (fin->fin_rev)
3056f4b3ec61Sdh155122 ifq = &ifs->ifs_ips_udpacktq;
3057ab25eeb5Syz155240 else
3058f4b3ec61Sdh155122 ifq = &ifs->ifs_ips_udptq;
3059ab25eeb5Syz155240 break;
3060ab25eeb5Syz155240 }
3061ab25eeb5Syz155240 if (is == NULL) {
3062f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_miss);
3063ab25eeb5Syz155240 return NULL;
3064ab25eeb5Syz155240 }
3065ab25eeb5Syz155240
3066ab25eeb5Syz155240 matched:
3067ab25eeb5Syz155240 fr = is->is_rule;
3068ab25eeb5Syz155240 if (fr != NULL) {
3069ab25eeb5Syz155240 if ((fin->fin_out == 0) && (fr->fr_nattag.ipt_num[0] != 0)) {
3070231bdc74SZdenek Kotala if (fin->fin_nattag == NULL) {
3071231bdc74SZdenek Kotala RWLOCK_EXIT(&ifs->ifs_ipf_state);
3072ab25eeb5Syz155240 return NULL;
3073231bdc74SZdenek Kotala }
3074231bdc74SZdenek Kotala if (fr_matchtag(&fr->fr_nattag, fin->fin_nattag) != 0) {
3075231bdc74SZdenek Kotala RWLOCK_EXIT(&ifs->ifs_ipf_state);
3076ab25eeb5Syz155240 return NULL;
3077ab25eeb5Syz155240 }
3078231bdc74SZdenek Kotala }
3079ab25eeb5Syz155240 (void) strncpy(fin->fin_group, fr->fr_group, FR_GROUPLEN);
3080ab25eeb5Syz155240 fin->fin_icode = fr->fr_icode;
3081ab25eeb5Syz155240 }
3082ab25eeb5Syz155240
3083ab25eeb5Syz155240 fin->fin_rule = is->is_rulen;
3084ab25eeb5Syz155240 pass = is->is_pass;
3085ab25eeb5Syz155240 fr_updatestate(fin, is, ifq);
3086ab25eeb5Syz155240
3087f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
3088ab25eeb5Syz155240 fin->fin_flx |= FI_STATE;
3089ab25eeb5Syz155240 if ((pass & FR_LOGFIRST) != 0)
3090ab25eeb5Syz155240 pass &= ~(FR_LOGFIRST|FR_LOG);
3091ab25eeb5Syz155240 *passp = pass;
3092ab25eeb5Syz155240 return fr;
3093ab25eeb5Syz155240 }
3094ab25eeb5Syz155240
3095ab25eeb5Syz155240
3096ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
3097ab25eeb5Syz155240 /* Function: fr_fixoutisn */
3098ab25eeb5Syz155240 /* Returns: Nil */
3099ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */
3100ab25eeb5Syz155240 /* is(I) - pointer to master state structure */
3101ab25eeb5Syz155240 /* */
3102ab25eeb5Syz155240 /* Called only for outbound packets, adjusts the sequence number and the */
3103ab25eeb5Syz155240 /* TCP checksum to match that change. */
3104ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_fixoutisn(fin,is)3105ab25eeb5Syz155240 static void fr_fixoutisn(fin, is)
3106ab25eeb5Syz155240 fr_info_t *fin;
3107ab25eeb5Syz155240 ipstate_t *is;
3108ab25eeb5Syz155240 {
3109ab25eeb5Syz155240 tcphdr_t *tcp;
3110ab25eeb5Syz155240 int rev;
3111ab25eeb5Syz155240 u_32_t seq;
3112ab25eeb5Syz155240
3113ab25eeb5Syz155240 tcp = fin->fin_dp;
3114ab25eeb5Syz155240 rev = fin->fin_rev;
3115ab25eeb5Syz155240 if ((is->is_flags & IS_ISNSYN) != 0) {
3116ab25eeb5Syz155240 if (rev == 0) {
3117ab25eeb5Syz155240 seq = ntohl(tcp->th_seq);
3118ab25eeb5Syz155240 seq += is->is_isninc[0];
3119ab25eeb5Syz155240 tcp->th_seq = htonl(seq);
3120381a2a9aSdr146992 fix_outcksum(&tcp->th_sum, is->is_sumd[0]);
3121ab25eeb5Syz155240 }
3122ab25eeb5Syz155240 }
3123ab25eeb5Syz155240 if ((is->is_flags & IS_ISNACK) != 0) {
3124ab25eeb5Syz155240 if (rev == 1) {
3125ab25eeb5Syz155240 seq = ntohl(tcp->th_seq);
3126ab25eeb5Syz155240 seq += is->is_isninc[1];
3127ab25eeb5Syz155240 tcp->th_seq = htonl(seq);
3128381a2a9aSdr146992 fix_outcksum(&tcp->th_sum, is->is_sumd[1]);
3129ab25eeb5Syz155240 }
3130ab25eeb5Syz155240 }
3131ab25eeb5Syz155240 }
3132ab25eeb5Syz155240
3133ab25eeb5Syz155240
3134ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
3135ab25eeb5Syz155240 /* Function: fr_fixinisn */
3136ab25eeb5Syz155240 /* Returns: Nil */
3137ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */
3138ab25eeb5Syz155240 /* is(I) - pointer to master state structure */
3139ab25eeb5Syz155240 /* */
3140ab25eeb5Syz155240 /* Called only for inbound packets, adjusts the acknowledge number and the */
3141ab25eeb5Syz155240 /* TCP checksum to match that change. */
3142ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_fixinisn(fin,is)3143ab25eeb5Syz155240 static void fr_fixinisn(fin, is)
3144ab25eeb5Syz155240 fr_info_t *fin;
3145ab25eeb5Syz155240 ipstate_t *is;
3146ab25eeb5Syz155240 {
3147ab25eeb5Syz155240 tcphdr_t *tcp;
3148ab25eeb5Syz155240 int rev;
3149ab25eeb5Syz155240 u_32_t ack;
3150ab25eeb5Syz155240
3151ab25eeb5Syz155240 tcp = fin->fin_dp;
3152ab25eeb5Syz155240 rev = fin->fin_rev;
3153ab25eeb5Syz155240 if ((is->is_flags & IS_ISNSYN) != 0) {
3154ab25eeb5Syz155240 if (rev == 1) {
3155ab25eeb5Syz155240 ack = ntohl(tcp->th_ack);
3156ab25eeb5Syz155240 ack -= is->is_isninc[0];
3157ab25eeb5Syz155240 tcp->th_ack = htonl(ack);
3158381a2a9aSdr146992 fix_incksum(&tcp->th_sum, is->is_sumd[0]);
3159ab25eeb5Syz155240 }
3160ab25eeb5Syz155240 }
3161ab25eeb5Syz155240 if ((is->is_flags & IS_ISNACK) != 0) {
3162ab25eeb5Syz155240 if (rev == 0) {
3163ab25eeb5Syz155240 ack = ntohl(tcp->th_ack);
3164ab25eeb5Syz155240 ack -= is->is_isninc[1];
3165ab25eeb5Syz155240 tcp->th_ack = htonl(ack);
3166381a2a9aSdr146992 fix_incksum(&tcp->th_sum, is->is_sumd[1]);
3167ab25eeb5Syz155240 }
3168ab25eeb5Syz155240 }
3169ab25eeb5Syz155240 }
3170ab25eeb5Syz155240
3171ab25eeb5Syz155240
3172ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
3173ab25eeb5Syz155240 /* Function: fr_statesync */
3174ab25eeb5Syz155240 /* Returns: Nil */
3175381a2a9aSdr146992 /* Parameters: action(I) - type of synchronisation to do */
3176381a2a9aSdr146992 /* v(I) - IP version being sync'd (v4 or v6) */
3177381a2a9aSdr146992 /* ifp(I) - interface identifier associated with action */
3178381a2a9aSdr146992 /* name(I) - name associated with ifp parameter */
3179ab25eeb5Syz155240 /* */
3180ab25eeb5Syz155240 /* Walk through all state entries and if an interface pointer match is */
3181ab25eeb5Syz155240 /* found then look it up again, based on its name in case the pointer has */
3182ab25eeb5Syz155240 /* changed since last time. */
3183ab25eeb5Syz155240 /* */
3184ab25eeb5Syz155240 /* If ifp is passed in as being non-null then we are only doing updates for */
3185ab25eeb5Syz155240 /* existing, matching, uses of it. */
3186ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_statesync(action,v,ifp,name,ifs)3187f4b3ec61Sdh155122 void fr_statesync(action, v, ifp, name, ifs)
3188381a2a9aSdr146992 int action, v;
3189ab25eeb5Syz155240 void *ifp;
3190381a2a9aSdr146992 char *name;
3191f4b3ec61Sdh155122 ipf_stack_t *ifs;
3192ab25eeb5Syz155240 {
3193ab25eeb5Syz155240 ipstate_t *is;
3194ab25eeb5Syz155240 int i;
3195ab25eeb5Syz155240
3196f4b3ec61Sdh155122 if (ifs->ifs_fr_running <= 0)
3197ab25eeb5Syz155240 return;
3198ab25eeb5Syz155240
3199f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state);
3200ab25eeb5Syz155240
3201f4b3ec61Sdh155122 if (ifs->ifs_fr_running <= 0) {
3202f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
3203ab25eeb5Syz155240 return;
3204ab25eeb5Syz155240 }
3205ab25eeb5Syz155240
3206381a2a9aSdr146992 switch (action)
3207381a2a9aSdr146992 {
3208381a2a9aSdr146992 case IPFSYNC_RESYNC :
3209f4b3ec61Sdh155122 for (is = ifs->ifs_ips_list; is; is = is->is_next) {
3210381a2a9aSdr146992 if (v != 0 && is->is_v != v)
3211381a2a9aSdr146992 continue;
3212ab25eeb5Syz155240 /*
3213ab25eeb5Syz155240 * Look up all the interface names in the state entry.
3214ab25eeb5Syz155240 */
3215ab25eeb5Syz155240 for (i = 0; i < 4; i++) {
3216ab25eeb5Syz155240 is->is_ifp[i] = fr_resolvenic(is->is_ifname[i],
3217f4b3ec61Sdh155122 is->is_v, ifs);
3218ab25eeb5Syz155240 }
3219ab25eeb5Syz155240 }
3220381a2a9aSdr146992 break;
3221381a2a9aSdr146992 case IPFSYNC_NEWIFP :
3222f4b3ec61Sdh155122 for (is = ifs->ifs_ips_list; is; is = is->is_next) {
3223381a2a9aSdr146992 if (v != 0 && is->is_v != v)
3224381a2a9aSdr146992 continue;
3225381a2a9aSdr146992 /*
3226381a2a9aSdr146992 * Look up all the interface names in the state entry.
3227381a2a9aSdr146992 */
3228381a2a9aSdr146992 for (i = 0; i < 4; i++) {
3229381a2a9aSdr146992 if (!strncmp(is->is_ifname[i], name,
3230381a2a9aSdr146992 sizeof(is->is_ifname[i])))
3231381a2a9aSdr146992 is->is_ifp[i] = ifp;
3232381a2a9aSdr146992 }
3233381a2a9aSdr146992 }
3234381a2a9aSdr146992 break;
3235381a2a9aSdr146992 case IPFSYNC_OLDIFP :
3236f4b3ec61Sdh155122 for (is = ifs->ifs_ips_list; is; is = is->is_next) {
3237381a2a9aSdr146992 if (v != 0 && is->is_v != v)
3238381a2a9aSdr146992 continue;
3239381a2a9aSdr146992 /*
3240381a2a9aSdr146992 * Look up all the interface names in the state entry.
3241381a2a9aSdr146992 */
3242381a2a9aSdr146992 for (i = 0; i < 4; i++) {
3243381a2a9aSdr146992 if (is->is_ifp[i] == ifp)
3244381a2a9aSdr146992 is->is_ifp[i] = (void *)-1;
3245381a2a9aSdr146992 }
3246381a2a9aSdr146992 }
3247381a2a9aSdr146992 break;
3248381a2a9aSdr146992 }
3249f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
3250ab25eeb5Syz155240 }
3251ab25eeb5Syz155240
3252ab25eeb5Syz155240
3253e8d569f4SAlexandr Nedvedicky #if SOLARIS2 >= 10
3254e8d569f4SAlexandr Nedvedicky /* ------------------------------------------------------------------------ */
3255e8d569f4SAlexandr Nedvedicky /* Function: fr_stateifindexsync */
3256e8d569f4SAlexandr Nedvedicky /* Returns: void */
3257e8d569f4SAlexandr Nedvedicky /* Parameters: ifp - current network interface descriptor (ifindex) */
3258e8d569f4SAlexandr Nedvedicky /* newifp - new interface descriptor (new ifindex) */
3259e8d569f4SAlexandr Nedvedicky /* ifs - pointer to IPF stack */
3260e8d569f4SAlexandr Nedvedicky /* */
3261e8d569f4SAlexandr Nedvedicky /* Write Locks: assumes ipf_mutex is locked */
3262e8d569f4SAlexandr Nedvedicky /* */
3263e8d569f4SAlexandr Nedvedicky /* Updates all interface indeces matching to ifp with new interface index */
3264e8d569f4SAlexandr Nedvedicky /* value. */
3265e8d569f4SAlexandr Nedvedicky /* ------------------------------------------------------------------------ */
fr_stateifindexsync(ifp,newifp,ifs)3266e8d569f4SAlexandr Nedvedicky void fr_stateifindexsync(ifp, newifp, ifs)
3267e8d569f4SAlexandr Nedvedicky void *ifp;
3268e8d569f4SAlexandr Nedvedicky void *newifp;
3269e8d569f4SAlexandr Nedvedicky ipf_stack_t *ifs;
3270e8d569f4SAlexandr Nedvedicky {
3271e8d569f4SAlexandr Nedvedicky ipstate_t *is;
3272e8d569f4SAlexandr Nedvedicky int i;
3273e8d569f4SAlexandr Nedvedicky
3274e8d569f4SAlexandr Nedvedicky WRITE_ENTER(&ifs->ifs_ipf_state);
3275e8d569f4SAlexandr Nedvedicky
3276e8d569f4SAlexandr Nedvedicky for (is = ifs->ifs_ips_list; is != NULL; is = is->is_next) {
3277e8d569f4SAlexandr Nedvedicky
3278e8d569f4SAlexandr Nedvedicky for (i = 0; i < 4; i++) {
3279e8d569f4SAlexandr Nedvedicky if (is->is_ifp[i] == ifp)
3280e8d569f4SAlexandr Nedvedicky is->is_ifp[i] = newifp;
3281e8d569f4SAlexandr Nedvedicky }
3282e8d569f4SAlexandr Nedvedicky }
3283e8d569f4SAlexandr Nedvedicky
3284e8d569f4SAlexandr Nedvedicky RWLOCK_EXIT(&ifs->ifs_ipf_state);
3285e8d569f4SAlexandr Nedvedicky }
3286e8d569f4SAlexandr Nedvedicky #endif
3287e8d569f4SAlexandr Nedvedicky
3288ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
3289ab25eeb5Syz155240 /* Function: fr_delstate */
3290ea8244dcSJohn Ojemann /* Returns: int - 0 = entry deleted, else ref count on entry */
3291ab25eeb5Syz155240 /* Parameters: is(I) - pointer to state structure to delete */
3292ab25eeb5Syz155240 /* why(I) - if not 0, log reason why it was deleted */
32935b48165cSJohn Ojemann /* ifs - ipf stack instance */
3294a9a89b0dSdr146992 /* Write Locks: ipf_state/ipf_global */
3295ab25eeb5Syz155240 /* */
3296ab25eeb5Syz155240 /* Deletes a state entry from the enumerated list as well as the hash table */
3297ab25eeb5Syz155240 /* and timeout queue lists. Make adjustments to hash table statistics and */
3298ab25eeb5Syz155240 /* global counters as required. */
3299ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_delstate(is,why,ifs)3300ea8244dcSJohn Ojemann int fr_delstate(is, why, ifs)
3301ab25eeb5Syz155240 ipstate_t *is;
3302ab25eeb5Syz155240 int why;
3303f4b3ec61Sdh155122 ipf_stack_t *ifs;
3304ab25eeb5Syz155240 {
33055b48165cSJohn Ojemann int removed = 0;
3306ab25eeb5Syz155240
3307f4b3ec61Sdh155122 ASSERT(rw_write_held(&ifs->ifs_ipf_global.ipf_lk) == 0 ||
3308f4b3ec61Sdh155122 rw_write_held(&ifs->ifs_ipf_state.ipf_lk) == 0);
3309ab25eeb5Syz155240
3310ab25eeb5Syz155240 /*
33115b48165cSJohn Ojemann * Start by removing the entry from the hash table of state entries
33125b48165cSJohn Ojemann * so it will not be "used" again.
33135b48165cSJohn Ojemann *
33145b48165cSJohn Ojemann * It will remain in the "list" of state entries until all references
33155b48165cSJohn Ojemann * have been accounted for.
3316ab25eeb5Syz155240 */
3317ab25eeb5Syz155240 if (is->is_phnext != NULL) {
33185b48165cSJohn Ojemann removed = 1;
3319ab25eeb5Syz155240 *is->is_phnext = is->is_hnext;
3320ab25eeb5Syz155240 if (is->is_hnext != NULL)
3321ab25eeb5Syz155240 is->is_hnext->is_phnext = is->is_phnext;
3322f4b3ec61Sdh155122 if (ifs->ifs_ips_table[is->is_hv] == NULL)
3323f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_inuse--;
3324f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_bucketlen[is->is_hv]--;
3325ab25eeb5Syz155240
3326ab25eeb5Syz155240 is->is_phnext = NULL;
3327ab25eeb5Syz155240 is->is_hnext = NULL;
3328ab25eeb5Syz155240 }
3329ab25eeb5Syz155240
3330ab25eeb5Syz155240 /*
3331f4b3ec61Sdh155122 * Because ifs->ifs_ips_stats.iss_wild is a count of entries in the state
3332ab25eeb5Syz155240 * table that have wildcard flags set, only decerement it once
3333ab25eeb5Syz155240 * and do it here.
3334ab25eeb5Syz155240 */
3335ab25eeb5Syz155240 if (is->is_flags & (SI_WILDP|SI_WILDA)) {
3336ab25eeb5Syz155240 if (!(is->is_flags & SI_CLONED)) {
3337f4b3ec61Sdh155122 ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild);
3338ab25eeb5Syz155240 }
3339ab25eeb5Syz155240 is->is_flags &= ~(SI_WILDP|SI_WILDA);
3340ab25eeb5Syz155240 }
3341ab25eeb5Syz155240
3342ab25eeb5Syz155240 /*
3343ab25eeb5Syz155240 * Next, remove it from the timeout queue it is in.
3344ab25eeb5Syz155240 */
3345ab25eeb5Syz155240 fr_deletequeueentry(&is->is_sti);
3346ab25eeb5Syz155240
3347ab25eeb5Syz155240 is->is_me = NULL;
3348ab25eeb5Syz155240
3349ab25eeb5Syz155240 /*
3350ab25eeb5Syz155240 * If it is still in use by something else, do not go any further,
3351ab25eeb5Syz155240 * but note that at this point it is now an orphan.
3352ab25eeb5Syz155240 */
33530e01ff8bSdr146992 MUTEX_ENTER(&is->is_lock);
33540e01ff8bSdr146992 if (is->is_ref > 1) {
3355ab25eeb5Syz155240 is->is_ref--;
33560e01ff8bSdr146992 MUTEX_EXIT(&is->is_lock);
33575b48165cSJohn Ojemann if (removed)
33585b48165cSJohn Ojemann ifs->ifs_ips_stats.iss_orphans++;
3359ea8244dcSJohn Ojemann return (is->is_ref);
33600e01ff8bSdr146992 }
33610e01ff8bSdr146992 MUTEX_EXIT(&is->is_lock);
33620e01ff8bSdr146992
33630e01ff8bSdr146992 is->is_ref = 0;
3364ab25eeb5Syz155240
33655b48165cSJohn Ojemann /*
33665b48165cSJohn Ojemann * If entry has already been removed from table,
33675b48165cSJohn Ojemann * it means we're simply cleaning up an orphan.
33685b48165cSJohn Ojemann */
33695b48165cSJohn Ojemann if (!removed)
33705b48165cSJohn Ojemann ifs->ifs_ips_stats.iss_orphans--;
33715b48165cSJohn Ojemann
337244aaa2b6Sjojemann if (is->is_tqehead[0] != NULL)
337344aaa2b6Sjojemann (void) fr_deletetimeoutqueue(is->is_tqehead[0]);
337444aaa2b6Sjojemann
337544aaa2b6Sjojemann if (is->is_tqehead[1] != NULL)
337644aaa2b6Sjojemann (void) fr_deletetimeoutqueue(is->is_tqehead[1]);
3377ab25eeb5Syz155240
3378ab25eeb5Syz155240 #ifdef IPFILTER_SYNC
3379ab25eeb5Syz155240 if (is->is_sync)
3380ab25eeb5Syz155240 ipfsync_del(is->is_sync);
3381ab25eeb5Syz155240 #endif
3382ab25eeb5Syz155240 #ifdef IPFILTER_SCAN
3383ab25eeb5Syz155240 (void) ipsc_detachis(is);
3384ab25eeb5Syz155240 #endif
3385ab25eeb5Syz155240
33865b48165cSJohn Ojemann /*
33875b48165cSJohn Ojemann * Now remove it from master list of state table entries.
33885b48165cSJohn Ojemann */
33895b48165cSJohn Ojemann if (is->is_pnext != NULL) {
33905b48165cSJohn Ojemann *is->is_pnext = is->is_next;
33915b48165cSJohn Ojemann if (is->is_next != NULL) {
33925b48165cSJohn Ojemann is->is_next->is_pnext = is->is_pnext;
33935b48165cSJohn Ojemann is->is_next = NULL;
33945b48165cSJohn Ojemann }
33955b48165cSJohn Ojemann is->is_pnext = NULL;
33965b48165cSJohn Ojemann }
33975b48165cSJohn Ojemann
3398f4b3ec61Sdh155122 if (ifs->ifs_ipstate_logging != 0 && why != 0)
3399f4b3ec61Sdh155122 ipstate_log(is, why, ifs);
3400ab25eeb5Syz155240
3401ab25eeb5Syz155240 if (is->is_rule != NULL) {
3402ab25eeb5Syz155240 is->is_rule->fr_statecnt--;
3403f4b3ec61Sdh155122 (void)fr_derefrule(&is->is_rule, ifs);
3404ab25eeb5Syz155240 }
3405ab25eeb5Syz155240
3406ab25eeb5Syz155240 MUTEX_DESTROY(&is->is_lock);
3407ab25eeb5Syz155240 KFREE(is);
3408f4b3ec61Sdh155122 ifs->ifs_ips_num--;
3409ea8244dcSJohn Ojemann
3410ea8244dcSJohn Ojemann return (0);
3411ab25eeb5Syz155240 }
3412ab25eeb5Syz155240
3413ab25eeb5Syz155240
3414ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
3415ab25eeb5Syz155240 /* Function: fr_timeoutstate */
3416ab25eeb5Syz155240 /* Returns: Nil */
3417ea8244dcSJohn Ojemann /* Parameters: ifs - ipf stack instance */
3418ab25eeb5Syz155240 /* */
3419ab25eeb5Syz155240 /* Slowly expire held state for thingslike UDP and ICMP. The algorithm */
3420ab25eeb5Syz155240 /* used here is to keep the queue sorted with the oldest things at the top */
3421ab25eeb5Syz155240 /* and the youngest at the bottom. So if the top one doesn't need to be */
3422ab25eeb5Syz155240 /* expired then neither will any under it. */
3423ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_timeoutstate(ifs)3424f4b3ec61Sdh155122 void fr_timeoutstate(ifs)
3425f4b3ec61Sdh155122 ipf_stack_t *ifs;
3426ab25eeb5Syz155240 {
3427ab25eeb5Syz155240 ipftq_t *ifq, *ifqnext;
3428ab25eeb5Syz155240 ipftqent_t *tqe, *tqn;
3429ab25eeb5Syz155240 ipstate_t *is;
3430ab25eeb5Syz155240 SPL_INT(s);
3431ab25eeb5Syz155240
3432ab25eeb5Syz155240 SPL_NET(s);
3433f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state);
3434f4b3ec61Sdh155122 for (ifq = ifs->ifs_ips_tqtqb; ifq != NULL; ifq = ifq->ifq_next)
3435ab25eeb5Syz155240 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) {
3436f4b3ec61Sdh155122 if (tqe->tqe_die > ifs->ifs_fr_ticks)
3437ab25eeb5Syz155240 break;
3438ab25eeb5Syz155240 tqn = tqe->tqe_next;
3439ab25eeb5Syz155240 is = tqe->tqe_parent;
3440ea8244dcSJohn Ojemann (void) fr_delstate(is, ISL_EXPIRE, ifs);
3441ab25eeb5Syz155240 }
3442ab25eeb5Syz155240
344344aaa2b6Sjojemann for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifq->ifq_next) {
3444ab25eeb5Syz155240 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) {
3445f4b3ec61Sdh155122 if (tqe->tqe_die > ifs->ifs_fr_ticks)
3446ab25eeb5Syz155240 break;
3447ab25eeb5Syz155240 tqn = tqe->tqe_next;
3448ab25eeb5Syz155240 is = tqe->tqe_parent;
3449ea8244dcSJohn Ojemann (void) fr_delstate(is, ISL_EXPIRE, ifs);
3450ab25eeb5Syz155240 }
3451ab25eeb5Syz155240 }
3452ab25eeb5Syz155240
3453f4b3ec61Sdh155122 for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) {
3454ab25eeb5Syz155240 ifqnext = ifq->ifq_next;
3455ab25eeb5Syz155240
3456ab25eeb5Syz155240 if (((ifq->ifq_flags & IFQF_DELETE) != 0) &&
3457ab25eeb5Syz155240 (ifq->ifq_ref == 0)) {
3458f4b3ec61Sdh155122 fr_freetimeoutqueue(ifq, ifs);
3459ab25eeb5Syz155240 }
3460ab25eeb5Syz155240 }
3461ab25eeb5Syz155240
3462f4b3ec61Sdh155122 if (ifs->ifs_fr_state_doflush) {
3463ea8244dcSJohn Ojemann (void) fr_state_flush(FLUSH_TABLE_EXTRA, 0, ifs);
3464f4b3ec61Sdh155122 ifs->ifs_fr_state_doflush = 0;
3465ab25eeb5Syz155240 }
3466f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
3467ab25eeb5Syz155240 SPL_X(s);
3468ab25eeb5Syz155240 }
3469ab25eeb5Syz155240
3470ab25eeb5Syz155240
3471ea8244dcSJohn Ojemann /* ---------------------------------------------------------------------- */
3472ab25eeb5Syz155240 /* Function: fr_state_flush */
3473ab25eeb5Syz155240 /* Returns: int - 0 == success, -1 == failure */
3474ea8244dcSJohn Ojemann /* Parameters: flush_option - how to flush the active State table */
3475ea8244dcSJohn Ojemann /* proto - IP version to flush (4, 6, or both) */
3476ea8244dcSJohn Ojemann /* ifs - ipf stack instance */
3477ab25eeb5Syz155240 /* Write Locks: ipf_state */
3478ab25eeb5Syz155240 /* */
3479ea8244dcSJohn Ojemann /* Flush state tables. Three possible flush options currently defined: */
3480ea8244dcSJohn Ojemann /* */
3481ea8244dcSJohn Ojemann /* FLUSH_TABLE_ALL : Flush all state table entries */
3482ea8244dcSJohn Ojemann /* */
3483ea8244dcSJohn Ojemann /* FLUSH_TABLE_CLOSING : Flush entries with TCP connections which */
3484ea8244dcSJohn Ojemann /* have started to close on both ends using */
3485ea8244dcSJohn Ojemann /* ipf_flushclosing(). */
3486ea8244dcSJohn Ojemann /* */
3487ea8244dcSJohn Ojemann /* FLUSH_TABLE_EXTRA : First, flush entries which are "almost" closed. */
3488ea8244dcSJohn Ojemann /* Then, if needed, flush entries with TCP */
3489ea8244dcSJohn Ojemann /* connections which have been idle for a long */
3490ea8244dcSJohn Ojemann /* time with ipf_extraflush(). */
3491ea8244dcSJohn Ojemann /* ---------------------------------------------------------------------- */
fr_state_flush(flush_option,proto,ifs)3492ea8244dcSJohn Ojemann static int fr_state_flush(flush_option, proto, ifs)
3493ea8244dcSJohn Ojemann int flush_option, proto;
3494f4b3ec61Sdh155122 ipf_stack_t *ifs;
3495ab25eeb5Syz155240 {
3496ea8244dcSJohn Ojemann ipstate_t *is, *isn;
3497ea8244dcSJohn Ojemann int removed;
3498ab25eeb5Syz155240 SPL_INT(s);
3499ab25eeb5Syz155240
3500ab25eeb5Syz155240 removed = 0;
3501ab25eeb5Syz155240
3502ab25eeb5Syz155240 SPL_NET(s);
3503ea8244dcSJohn Ojemann switch (flush_option)
3504ab25eeb5Syz155240 {
3505ea8244dcSJohn Ojemann case FLUSH_TABLE_ALL:
3506ea8244dcSJohn Ojemann isn = ifs->ifs_ips_list;
3507ea8244dcSJohn Ojemann while ((is = isn) != NULL) {
3508ea8244dcSJohn Ojemann isn = is->is_next;
3509ea8244dcSJohn Ojemann if ((proto != 0) && (is->is_v != proto))
3510ea8244dcSJohn Ojemann continue;
3511ea8244dcSJohn Ojemann if (fr_delstate(is, ISL_FLUSH, ifs) == 0)
3512ab25eeb5Syz155240 removed++;
3513ab25eeb5Syz155240 }
3514ea8244dcSJohn Ojemann break;
3515ab25eeb5Syz155240
3516ea8244dcSJohn Ojemann case FLUSH_TABLE_CLOSING:
3517ea8244dcSJohn Ojemann removed = ipf_flushclosing(STATE_FLUSH,
3518ea8244dcSJohn Ojemann IPF_TCPS_CLOSE_WAIT,
3519ea8244dcSJohn Ojemann ifs->ifs_ips_tqtqb,
3520ea8244dcSJohn Ojemann ifs->ifs_ips_utqe,
3521ea8244dcSJohn Ojemann ifs);
3522ea8244dcSJohn Ojemann break;
3523ea8244dcSJohn Ojemann
3524ea8244dcSJohn Ojemann case FLUSH_TABLE_EXTRA:
3525ea8244dcSJohn Ojemann removed = ipf_flushclosing(STATE_FLUSH,
3526ea8244dcSJohn Ojemann IPF_TCPS_FIN_WAIT_2,
3527ea8244dcSJohn Ojemann ifs->ifs_ips_tqtqb,
3528ea8244dcSJohn Ojemann ifs->ifs_ips_utqe,
3529ea8244dcSJohn Ojemann ifs);
3530ab25eeb5Syz155240
3531ab25eeb5Syz155240 /*
3532ea8244dcSJohn Ojemann * Be sure we haven't done this in the last 10 seconds.
3533ab25eeb5Syz155240 */
3534ea8244dcSJohn Ojemann if (ifs->ifs_fr_ticks - ifs->ifs_ips_last_force_flush <
3535ea8244dcSJohn Ojemann IPF_TTLVAL(10))
3536ea8244dcSJohn Ojemann break;
3537f4b3ec61Sdh155122 ifs->ifs_ips_last_force_flush = ifs->ifs_fr_ticks;
3538ea8244dcSJohn Ojemann removed += ipf_extraflush(STATE_FLUSH,
3539ea8244dcSJohn Ojemann &ifs->ifs_ips_tqtqb[IPF_TCPS_ESTABLISHED],
3540ea8244dcSJohn Ojemann ifs->ifs_ips_utqe,
3541ea8244dcSJohn Ojemann ifs);
3542ab25eeb5Syz155240 break;
3543ab25eeb5Syz155240
3544ea8244dcSJohn Ojemann default: /* Flush Nothing */
3545ab25eeb5Syz155240 break;
3546ab25eeb5Syz155240 }
3547ab25eeb5Syz155240
3548ab25eeb5Syz155240 SPL_X(s);
3549ea8244dcSJohn Ojemann return (removed);
3550ab25eeb5Syz155240 }
3551ab25eeb5Syz155240
3552ab25eeb5Syz155240
3553ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
3554ab25eeb5Syz155240 /* Function: fr_tcp_age */
3555ab25eeb5Syz155240 /* Returns: int - 1 == state transition made, 0 == no change (rejected) */
3556ab25eeb5Syz155240 /* Parameters: tq(I) - pointer to timeout queue information */
3557ab25eeb5Syz155240 /* fin(I) - pointer to packet information */
3558ab25eeb5Syz155240 /* tqtab(I) - TCP timeout queue table this is in */
3559ab25eeb5Syz155240 /* flags(I) - flags from state/NAT entry */
3560ab25eeb5Syz155240 /* */
3561ab25eeb5Syz155240 /* Rewritten by Arjan de Vet <Arjan.deVet@adv.iae.nl>, 2000-07-29: */
3562ab25eeb5Syz155240 /* */
3563ab25eeb5Syz155240 /* - (try to) base state transitions on real evidence only, */
3564ab25eeb5Syz155240 /* i.e. packets that are sent and have been received by ipfilter; */
3565ab25eeb5Syz155240 /* diagram 18.12 of TCP/IP volume 1 by W. Richard Stevens was used. */
3566ab25eeb5Syz155240 /* */
3567ab25eeb5Syz155240 /* - deal with half-closed connections correctly; */
3568ab25eeb5Syz155240 /* */
3569ab25eeb5Syz155240 /* - store the state of the source in state[0] such that ipfstat */
3570ab25eeb5Syz155240 /* displays the state as source/dest instead of dest/source; the calls */
3571ab25eeb5Syz155240 /* to fr_tcp_age have been changed accordingly. */
3572ab25eeb5Syz155240 /* */
3573ab25eeb5Syz155240 /* Internal Parameters: */
3574ab25eeb5Syz155240 /* */
3575ab25eeb5Syz155240 /* state[0] = state of source (host that initiated connection) */
3576ab25eeb5Syz155240 /* state[1] = state of dest (host that accepted the connection) */
3577ab25eeb5Syz155240 /* */
3578ab25eeb5Syz155240 /* dir == 0 : a packet from source to dest */
3579ab25eeb5Syz155240 /* dir == 1 : a packet from dest to source */
3580ab25eeb5Syz155240 /* */
3581ab25eeb5Syz155240 /* Locking: it is assumed that the parent of the tqe structure is locked. */
3582ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_tcp_age(tqe,fin,tqtab,flags)3583ab25eeb5Syz155240 int fr_tcp_age(tqe, fin, tqtab, flags)
3584ab25eeb5Syz155240 ipftqent_t *tqe;
3585ab25eeb5Syz155240 fr_info_t *fin;
3586ab25eeb5Syz155240 ipftq_t *tqtab;
3587ab25eeb5Syz155240 int flags;
3588ab25eeb5Syz155240 {
3589ab25eeb5Syz155240 int dlen, ostate, nstate, rval, dir;
3590ab25eeb5Syz155240 u_char tcpflags;
3591ab25eeb5Syz155240 tcphdr_t *tcp;
3592f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs;
3593ab25eeb5Syz155240
3594ab25eeb5Syz155240 tcp = fin->fin_dp;
3595ab25eeb5Syz155240
3596ab25eeb5Syz155240 rval = 0;
3597ab25eeb5Syz155240 dir = fin->fin_rev;
3598ab25eeb5Syz155240 tcpflags = tcp->th_flags;
3599ab25eeb5Syz155240 dlen = fin->fin_dlen - (TCP_OFF(tcp) << 2);
3600ab25eeb5Syz155240
36016ccacea7SAlexandr Nedvedicky ostate = tqe->tqe_state[1 - dir];
36026ccacea7SAlexandr Nedvedicky nstate = tqe->tqe_state[dir];
36036ccacea7SAlexandr Nedvedicky
36046ccacea7SAlexandr Nedvedicky DTRACE_PROBE4(
36056ccacea7SAlexandr Nedvedicky indata,
36066ccacea7SAlexandr Nedvedicky fr_info_t *, fin,
36076ccacea7SAlexandr Nedvedicky int, ostate,
36086ccacea7SAlexandr Nedvedicky int, nstate,
36096ccacea7SAlexandr Nedvedicky u_char, tcpflags
36106ccacea7SAlexandr Nedvedicky );
36116ccacea7SAlexandr Nedvedicky
3612ab25eeb5Syz155240 if (tcpflags & TH_RST) {
3613ab25eeb5Syz155240 if (!(tcpflags & TH_PUSH) && !dlen)
3614ab25eeb5Syz155240 nstate = IPF_TCPS_CLOSED;
3615ab25eeb5Syz155240 else
3616ab25eeb5Syz155240 nstate = IPF_TCPS_CLOSE_WAIT;
36176ccacea7SAlexandr Nedvedicky
36186ccacea7SAlexandr Nedvedicky /*
36196ccacea7SAlexandr Nedvedicky * Once RST is received, we must advance peer's state to
36206ccacea7SAlexandr Nedvedicky * CLOSE_WAIT.
36216ccacea7SAlexandr Nedvedicky */
36226ccacea7SAlexandr Nedvedicky if (ostate <= IPF_TCPS_ESTABLISHED) {
36236ccacea7SAlexandr Nedvedicky tqe->tqe_state[1 - dir] = IPF_TCPS_CLOSE_WAIT;
36246ccacea7SAlexandr Nedvedicky }
3625ab25eeb5Syz155240 rval = 1;
3626ab25eeb5Syz155240 } else {
3627ab25eeb5Syz155240
3628ab25eeb5Syz155240 switch (nstate)
3629ab25eeb5Syz155240 {
36306ccacea7SAlexandr Nedvedicky case IPF_TCPS_LISTEN: /* 0 */
3631ab25eeb5Syz155240 if ((tcpflags & TH_OPENING) == TH_OPENING) {
3632ab25eeb5Syz155240 /*
3633ab25eeb5Syz155240 * 'dir' received an S and sends SA in
3634ab25eeb5Syz155240 * response, CLOSED -> SYN_RECEIVED
3635ab25eeb5Syz155240 */
3636ab25eeb5Syz155240 nstate = IPF_TCPS_SYN_RECEIVED;
3637ab25eeb5Syz155240 rval = 1;
3638ab25eeb5Syz155240 } else if ((tcpflags & TH_OPENING) == TH_SYN) {
3639ab25eeb5Syz155240 /* 'dir' sent S, CLOSED -> SYN_SENT */
3640ab25eeb5Syz155240 nstate = IPF_TCPS_SYN_SENT;
3641ab25eeb5Syz155240 rval = 1;
3642ab25eeb5Syz155240 }
3643ab25eeb5Syz155240 /*
3644ab25eeb5Syz155240 * the next piece of code makes it possible to get
3645ab25eeb5Syz155240 * already established connections into the state table
3646ab25eeb5Syz155240 * after a restart or reload of the filter rules; this
3647ab25eeb5Syz155240 * does not work when a strict 'flags S keep state' is
3648ab25eeb5Syz155240 * used for tcp connections of course
3649ab25eeb5Syz155240 */
3650ab25eeb5Syz155240 if (((flags & IS_TCPFSM) == 0) &&
3651ab25eeb5Syz155240 ((tcpflags & TH_ACKMASK) == TH_ACK)) {
3652ab25eeb5Syz155240 /*
3653ab25eeb5Syz155240 * we saw an A, guess 'dir' is in ESTABLISHED
3654ab25eeb5Syz155240 * mode
3655ab25eeb5Syz155240 */
3656ab25eeb5Syz155240 switch (ostate)
3657ab25eeb5Syz155240 {
36586ccacea7SAlexandr Nedvedicky case IPF_TCPS_LISTEN :
3659ab25eeb5Syz155240 case IPF_TCPS_SYN_RECEIVED :
3660ab25eeb5Syz155240 nstate = IPF_TCPS_HALF_ESTAB;
3661ab25eeb5Syz155240 rval = 1;
3662ab25eeb5Syz155240 break;
3663ab25eeb5Syz155240 case IPF_TCPS_HALF_ESTAB :
3664ab25eeb5Syz155240 case IPF_TCPS_ESTABLISHED :
3665ab25eeb5Syz155240 nstate = IPF_TCPS_ESTABLISHED;
3666ab25eeb5Syz155240 rval = 1;
3667ab25eeb5Syz155240 break;
3668ab25eeb5Syz155240 default :
3669ab25eeb5Syz155240 break;
3670ab25eeb5Syz155240 }
3671ab25eeb5Syz155240 }
3672ab25eeb5Syz155240 /*
3673ab25eeb5Syz155240 * TODO: besides regular ACK packets we can have other
3674ab25eeb5Syz155240 * packets as well; it is yet to be determined how we
3675ab25eeb5Syz155240 * should initialize the states in those cases
3676ab25eeb5Syz155240 */
3677ab25eeb5Syz155240 break;
3678ab25eeb5Syz155240
36796ccacea7SAlexandr Nedvedicky case IPF_TCPS_SYN_SENT: /* 1 */
3680ab25eeb5Syz155240 if ((tcpflags & ~(TH_ECN|TH_CWR)) == TH_SYN) {
3681ab25eeb5Syz155240 /*
3682ab25eeb5Syz155240 * A retransmitted SYN packet. We do not reset
3683ab25eeb5Syz155240 * the timeout here to fr_tcptimeout because a
3684ab25eeb5Syz155240 * connection connect timeout does not renew
3685ab25eeb5Syz155240 * after every packet that is sent. We need to
3686ab25eeb5Syz155240 * set rval so as to indicate the packet has
3687ab25eeb5Syz155240 * passed the check for its flags being valid
3688ab25eeb5Syz155240 * in the TCP FSM. Setting rval to 2 has the
3689ab25eeb5Syz155240 * result of not resetting the timeout.
3690ab25eeb5Syz155240 */
3691ab25eeb5Syz155240 rval = 2;
3692ab25eeb5Syz155240 } else if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) ==
3693ab25eeb5Syz155240 TH_ACK) {
3694ab25eeb5Syz155240 /*
3695ab25eeb5Syz155240 * we see an A from 'dir' which is in SYN_SENT
3696ab25eeb5Syz155240 * state: 'dir' sent an A in response to an SA
3697ab25eeb5Syz155240 * which it received, SYN_SENT -> ESTABLISHED
3698ab25eeb5Syz155240 */
3699ab25eeb5Syz155240 nstate = IPF_TCPS_ESTABLISHED;
3700ab25eeb5Syz155240 rval = 1;
3701ab25eeb5Syz155240 } else if (tcpflags & TH_FIN) {
3702ab25eeb5Syz155240 /*
3703ab25eeb5Syz155240 * we see an F from 'dir' which is in SYN_SENT
3704ab25eeb5Syz155240 * state and wants to close its side of the
3705ab25eeb5Syz155240 * connection; SYN_SENT -> FIN_WAIT_1
3706ab25eeb5Syz155240 */
3707ab25eeb5Syz155240 nstate = IPF_TCPS_FIN_WAIT_1;
3708ab25eeb5Syz155240 rval = 1;
3709ab25eeb5Syz155240 } else if ((tcpflags & TH_OPENING) == TH_OPENING) {
3710ab25eeb5Syz155240 /*
3711ab25eeb5Syz155240 * we see an SA from 'dir' which is already in
3712ab25eeb5Syz155240 * SYN_SENT state, this means we have a
3713ab25eeb5Syz155240 * simultaneous open; SYN_SENT -> SYN_RECEIVED
3714ab25eeb5Syz155240 */
3715ab25eeb5Syz155240 nstate = IPF_TCPS_SYN_RECEIVED;
3716ab25eeb5Syz155240 rval = 1;
3717ab25eeb5Syz155240 }
3718ab25eeb5Syz155240 break;
3719ab25eeb5Syz155240
37206ccacea7SAlexandr Nedvedicky case IPF_TCPS_SYN_RECEIVED: /* 2 */
3721ab25eeb5Syz155240 if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) == TH_ACK) {
3722ab25eeb5Syz155240 /*
3723ab25eeb5Syz155240 * we see an A from 'dir' which was in
3724ab25eeb5Syz155240 * SYN_RECEIVED state so it must now be in
3725ab25eeb5Syz155240 * established state, SYN_RECEIVED ->
3726ab25eeb5Syz155240 * ESTABLISHED
3727ab25eeb5Syz155240 */
3728ab25eeb5Syz155240 nstate = IPF_TCPS_ESTABLISHED;
3729ab25eeb5Syz155240 rval = 1;
3730ab25eeb5Syz155240 } else if ((tcpflags & ~(TH_ECN|TH_CWR)) ==
3731ab25eeb5Syz155240 TH_OPENING) {
3732ab25eeb5Syz155240 /*
3733ab25eeb5Syz155240 * We see an SA from 'dir' which is already in
3734ab25eeb5Syz155240 * SYN_RECEIVED state.
3735ab25eeb5Syz155240 */
3736ab25eeb5Syz155240 rval = 2;
3737ab25eeb5Syz155240 } else if (tcpflags & TH_FIN) {
3738ab25eeb5Syz155240 /*
3739ab25eeb5Syz155240 * we see an F from 'dir' which is in
3740ab25eeb5Syz155240 * SYN_RECEIVED state and wants to close its
3741ab25eeb5Syz155240 * side of the connection; SYN_RECEIVED ->
3742ab25eeb5Syz155240 * FIN_WAIT_1
3743ab25eeb5Syz155240 */
3744ab25eeb5Syz155240 nstate = IPF_TCPS_FIN_WAIT_1;
3745ab25eeb5Syz155240 rval = 1;
3746ab25eeb5Syz155240 }
3747ab25eeb5Syz155240 break;
3748ab25eeb5Syz155240
37496ccacea7SAlexandr Nedvedicky case IPF_TCPS_HALF_ESTAB: /* 3 */
37506ccacea7SAlexandr Nedvedicky if (tcpflags & TH_FIN) {
37516ccacea7SAlexandr Nedvedicky nstate = IPF_TCPS_FIN_WAIT_1;
3752ab25eeb5Syz155240 rval = 1;
37536ccacea7SAlexandr Nedvedicky } else if ((tcpflags & TH_ACKMASK) == TH_ACK) {
37546ccacea7SAlexandr Nedvedicky /*
37556ccacea7SAlexandr Nedvedicky * If we've picked up a connection in mid
37566ccacea7SAlexandr Nedvedicky * flight, we could be looking at a follow on
37576ccacea7SAlexandr Nedvedicky * packet from the same direction as the one
37586ccacea7SAlexandr Nedvedicky * that created this state. Recognise it but
37596ccacea7SAlexandr Nedvedicky * do not advance the entire connection's
37606ccacea7SAlexandr Nedvedicky * state.
37616ccacea7SAlexandr Nedvedicky */
37626ccacea7SAlexandr Nedvedicky switch (ostate)
37636ccacea7SAlexandr Nedvedicky {
37646ccacea7SAlexandr Nedvedicky case IPF_TCPS_LISTEN :
37656ccacea7SAlexandr Nedvedicky case IPF_TCPS_SYN_SENT :
37666ccacea7SAlexandr Nedvedicky case IPF_TCPS_SYN_RECEIVED :
37676ccacea7SAlexandr Nedvedicky rval = 1;
37686ccacea7SAlexandr Nedvedicky break;
37696ccacea7SAlexandr Nedvedicky case IPF_TCPS_HALF_ESTAB :
37706ccacea7SAlexandr Nedvedicky case IPF_TCPS_ESTABLISHED :
37716ccacea7SAlexandr Nedvedicky nstate = IPF_TCPS_ESTABLISHED;
37726ccacea7SAlexandr Nedvedicky rval = 1;
37736ccacea7SAlexandr Nedvedicky break;
37746ccacea7SAlexandr Nedvedicky default :
37756ccacea7SAlexandr Nedvedicky break;
37766ccacea7SAlexandr Nedvedicky }
37776ccacea7SAlexandr Nedvedicky }
3778ab25eeb5Syz155240 break;
3779ab25eeb5Syz155240
37806ccacea7SAlexandr Nedvedicky case IPF_TCPS_ESTABLISHED: /* 4 */
3781ab25eeb5Syz155240 rval = 1;
3782ab25eeb5Syz155240 if (tcpflags & TH_FIN) {
3783ab25eeb5Syz155240 /*
3784ab25eeb5Syz155240 * 'dir' closed its side of the connection;
3785ab25eeb5Syz155240 * this gives us a half-closed connection;
3786ab25eeb5Syz155240 * ESTABLISHED -> FIN_WAIT_1
3787ab25eeb5Syz155240 */
37886ccacea7SAlexandr Nedvedicky if (ostate == IPF_TCPS_FIN_WAIT_1) {
37896ccacea7SAlexandr Nedvedicky nstate = IPF_TCPS_CLOSING;
37906ccacea7SAlexandr Nedvedicky } else {
3791ab25eeb5Syz155240 nstate = IPF_TCPS_FIN_WAIT_1;
37926ccacea7SAlexandr Nedvedicky }
3793ab25eeb5Syz155240 } else if (tcpflags & TH_ACK) {
3794ab25eeb5Syz155240 /*
3795ab25eeb5Syz155240 * an ACK, should we exclude other flags here?
3796ab25eeb5Syz155240 */
3797ab25eeb5Syz155240 if (ostate == IPF_TCPS_FIN_WAIT_1) {
3798ab25eeb5Syz155240 /*
3799ab25eeb5Syz155240 * We know the other side did an active
3800ab25eeb5Syz155240 * close, so we are ACKing the recvd
3801ab25eeb5Syz155240 * FIN packet (does the window matching
3802ab25eeb5Syz155240 * code guarantee this?) and go into
3803ab25eeb5Syz155240 * CLOSE_WAIT state; this gives us a
3804ab25eeb5Syz155240 * half-closed connection
3805ab25eeb5Syz155240 */
3806ab25eeb5Syz155240 nstate = IPF_TCPS_CLOSE_WAIT;
3807ab25eeb5Syz155240 } else if (ostate < IPF_TCPS_CLOSE_WAIT) {
3808ab25eeb5Syz155240 /*
3809ab25eeb5Syz155240 * still a fully established
3810ab25eeb5Syz155240 * connection reset timeout
3811ab25eeb5Syz155240 */
3812ab25eeb5Syz155240 nstate = IPF_TCPS_ESTABLISHED;
3813ab25eeb5Syz155240 }
3814ab25eeb5Syz155240 }
3815ab25eeb5Syz155240 break;
3816ab25eeb5Syz155240
38176ccacea7SAlexandr Nedvedicky case IPF_TCPS_CLOSE_WAIT: /* 5 */
3818ab25eeb5Syz155240 rval = 1;
3819ab25eeb5Syz155240 if (tcpflags & TH_FIN) {
3820ab25eeb5Syz155240 /*
3821ab25eeb5Syz155240 * application closed and 'dir' sent a FIN,
3822ab25eeb5Syz155240 * we're now going into LAST_ACK state
3823ab25eeb5Syz155240 */
3824ab25eeb5Syz155240 nstate = IPF_TCPS_LAST_ACK;
3825ab25eeb5Syz155240 } else {
3826ab25eeb5Syz155240 /*
3827ab25eeb5Syz155240 * we remain in CLOSE_WAIT because the other
3828ab25eeb5Syz155240 * side has closed already and we did not
3829ab25eeb5Syz155240 * close our side yet; reset timeout
3830ab25eeb5Syz155240 */
3831ab25eeb5Syz155240 nstate = IPF_TCPS_CLOSE_WAIT;
3832ab25eeb5Syz155240 }
3833ab25eeb5Syz155240 break;
3834ab25eeb5Syz155240
38356ccacea7SAlexandr Nedvedicky case IPF_TCPS_FIN_WAIT_1: /* 6 */
3836ab25eeb5Syz155240 rval = 1;
3837ab25eeb5Syz155240 if ((tcpflags & TH_ACK) &&
3838ab25eeb5Syz155240 ostate > IPF_TCPS_CLOSE_WAIT) {
3839ab25eeb5Syz155240 /*
3840ab25eeb5Syz155240 * if the other side is not active anymore
3841ab25eeb5Syz155240 * it has sent us a FIN packet that we are
3842ab25eeb5Syz155240 * ack'ing now with an ACK; this means both
3843ab25eeb5Syz155240 * sides have now closed the connection and
38446ccacea7SAlexandr Nedvedicky * we go into LAST_ACK
3845ab25eeb5Syz155240 */
3846ab25eeb5Syz155240 /*
3847ab25eeb5Syz155240 * XXX: how do we know we really are ACKing
3848ab25eeb5Syz155240 * the FIN packet here? does the window code
3849ab25eeb5Syz155240 * guarantee that?
3850ab25eeb5Syz155240 */
38516ccacea7SAlexandr Nedvedicky nstate = IPF_TCPS_LAST_ACK;
3852ab25eeb5Syz155240 } else {
3853ab25eeb5Syz155240 /*
3854ab25eeb5Syz155240 * we closed our side of the connection
3855ab25eeb5Syz155240 * already but the other side is still active
3856ab25eeb5Syz155240 * (ESTABLISHED/CLOSE_WAIT); continue with
3857ab25eeb5Syz155240 * this half-closed connection
3858ab25eeb5Syz155240 */
3859ab25eeb5Syz155240 nstate = IPF_TCPS_FIN_WAIT_1;
3860ab25eeb5Syz155240 }
3861ab25eeb5Syz155240 break;
3862ab25eeb5Syz155240
38636ccacea7SAlexandr Nedvedicky case IPF_TCPS_CLOSING: /* 7 */
38646ccacea7SAlexandr Nedvedicky if ((tcpflags & (TH_FIN|TH_ACK)) == TH_ACK) {
38656ccacea7SAlexandr Nedvedicky nstate = IPF_TCPS_TIME_WAIT;
38666ccacea7SAlexandr Nedvedicky }
38676ccacea7SAlexandr Nedvedicky rval = 1;
3868ab25eeb5Syz155240 break;
3869ab25eeb5Syz155240
38706ccacea7SAlexandr Nedvedicky case IPF_TCPS_LAST_ACK: /* 8 */
3871ab25eeb5Syz155240 /*
3872f17d2b41San207044 * We want to reset timer here to keep state in table.
3873f17d2b41San207044 * If we would allow the state to time out here, while
3874f17d2b41San207044 * there would still be packets being retransmitted, we
3875f17d2b41San207044 * would cut off line between the two peers preventing
3876f17d2b41San207044 * them to close connection properly.
3877ab25eeb5Syz155240 */
3878ab25eeb5Syz155240 rval = 1;
3879ab25eeb5Syz155240 break;
3880ab25eeb5Syz155240
38816ccacea7SAlexandr Nedvedicky case IPF_TCPS_FIN_WAIT_2: /* 9 */
38826ccacea7SAlexandr Nedvedicky /* NOT USED */
3883ab25eeb5Syz155240 break;
3884ab25eeb5Syz155240
38856ccacea7SAlexandr Nedvedicky case IPF_TCPS_TIME_WAIT: /* 10 */
3886ab25eeb5Syz155240 /* we're in 2MSL timeout now */
38876ccacea7SAlexandr Nedvedicky if (ostate == IPF_TCPS_LAST_ACK) {
38886ccacea7SAlexandr Nedvedicky nstate = IPF_TCPS_CLOSED;
3889ab25eeb5Syz155240 rval = 1;
38906ccacea7SAlexandr Nedvedicky } else {
38916ccacea7SAlexandr Nedvedicky rval = 2;
38926ccacea7SAlexandr Nedvedicky }
38936ccacea7SAlexandr Nedvedicky break;
38946ccacea7SAlexandr Nedvedicky
38956ccacea7SAlexandr Nedvedicky case IPF_TCPS_CLOSED: /* 11 */
38966ccacea7SAlexandr Nedvedicky rval = 2;
3897ab25eeb5Syz155240 break;
3898ab25eeb5Syz155240
3899ab25eeb5Syz155240 default :
3900ab25eeb5Syz155240 #if defined(_KERNEL)
39016ccacea7SAlexandr Nedvedicky ASSERT(nstate >= IPF_TCPS_LISTEN &&
39026ccacea7SAlexandr Nedvedicky nstate <= IPF_TCPS_CLOSED);
3903ab25eeb5Syz155240 #else
3904ab25eeb5Syz155240 abort();
3905ab25eeb5Syz155240 #endif
3906ab25eeb5Syz155240 break;
3907ab25eeb5Syz155240 }
3908ab25eeb5Syz155240 }
3909ab25eeb5Syz155240
3910ab25eeb5Syz155240 /*
3911ab25eeb5Syz155240 * If rval == 2 then do not update the queue position, but treat the
3912ab25eeb5Syz155240 * packet as being ok.
3913ab25eeb5Syz155240 */
39146ccacea7SAlexandr Nedvedicky if (rval == 2) {
39156ccacea7SAlexandr Nedvedicky DTRACE_PROBE1(state_keeping_timer, int, nstate);
3916ab25eeb5Syz155240 rval = 1;
39176ccacea7SAlexandr Nedvedicky }
3918ab25eeb5Syz155240 else if (rval == 1) {
3919ab25eeb5Syz155240 tqe->tqe_state[dir] = nstate;
39206ccacea7SAlexandr Nedvedicky /*
39216ccacea7SAlexandr Nedvedicky * The nstate can either advance to a new state, or remain
39226ccacea7SAlexandr Nedvedicky * unchanged, resetting the timer by moving to the bottom of
39236ccacea7SAlexandr Nedvedicky * the queue.
39246ccacea7SAlexandr Nedvedicky */
39256ccacea7SAlexandr Nedvedicky DTRACE_PROBE1(state_done, int, nstate);
39266ccacea7SAlexandr Nedvedicky
3927ab25eeb5Syz155240 if ((tqe->tqe_flags & TQE_RULEBASED) == 0)
3928f4b3ec61Sdh155122 fr_movequeue(tqe, tqe->tqe_ifq, tqtab + nstate, ifs);
3929ab25eeb5Syz155240 }
3930ab25eeb5Syz155240
3931ab25eeb5Syz155240 return rval;
3932ab25eeb5Syz155240 }
3933ab25eeb5Syz155240
3934ab25eeb5Syz155240
3935ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
3936ab25eeb5Syz155240 /* Function: ipstate_log */
3937ab25eeb5Syz155240 /* Returns: Nil */
3938ab25eeb5Syz155240 /* Parameters: is(I) - pointer to state structure */
3939ab25eeb5Syz155240 /* type(I) - type of log entry to create */
3940ab25eeb5Syz155240 /* */
3941ab25eeb5Syz155240 /* Creates a state table log entry using the state structure and type info. */
3942ab25eeb5Syz155240 /* passed in. Log packet/byte counts, source/destination address and other */
3943ab25eeb5Syz155240 /* protocol specific information. */
3944ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
ipstate_log(is,type,ifs)3945f4b3ec61Sdh155122 void ipstate_log(is, type, ifs)
3946ab25eeb5Syz155240 struct ipstate *is;
3947ab25eeb5Syz155240 u_int type;
3948f4b3ec61Sdh155122 ipf_stack_t *ifs;
3949ab25eeb5Syz155240 {
3950ab25eeb5Syz155240 #ifdef IPFILTER_LOG
3951ab25eeb5Syz155240 struct ipslog ipsl;
3952ab25eeb5Syz155240 size_t sizes[1];
3953ab25eeb5Syz155240 void *items[1];
3954ab25eeb5Syz155240 int types[1];
3955ab25eeb5Syz155240
3956ab25eeb5Syz155240 /*
3957ab25eeb5Syz155240 * Copy information out of the ipstate_t structure and into the
3958ab25eeb5Syz155240 * structure used for logging.
3959ab25eeb5Syz155240 */
3960ab25eeb5Syz155240 ipsl.isl_type = type;
3961ab25eeb5Syz155240 ipsl.isl_pkts[0] = is->is_pkts[0] + is->is_icmppkts[0];
3962ab25eeb5Syz155240 ipsl.isl_bytes[0] = is->is_bytes[0];
3963ab25eeb5Syz155240 ipsl.isl_pkts[1] = is->is_pkts[1] + is->is_icmppkts[1];
3964ab25eeb5Syz155240 ipsl.isl_bytes[1] = is->is_bytes[1];
3965ab25eeb5Syz155240 ipsl.isl_pkts[2] = is->is_pkts[2] + is->is_icmppkts[2];
3966ab25eeb5Syz155240 ipsl.isl_bytes[2] = is->is_bytes[2];
3967ab25eeb5Syz155240 ipsl.isl_pkts[3] = is->is_pkts[3] + is->is_icmppkts[3];
3968ab25eeb5Syz155240 ipsl.isl_bytes[3] = is->is_bytes[3];
3969ab25eeb5Syz155240 ipsl.isl_src = is->is_src;
3970ab25eeb5Syz155240 ipsl.isl_dst = is->is_dst;
3971ab25eeb5Syz155240 ipsl.isl_p = is->is_p;
3972ab25eeb5Syz155240 ipsl.isl_v = is->is_v;
3973ab25eeb5Syz155240 ipsl.isl_flags = is->is_flags;
3974ab25eeb5Syz155240 ipsl.isl_tag = is->is_tag;
3975ab25eeb5Syz155240 ipsl.isl_rulen = is->is_rulen;
3976ab25eeb5Syz155240 (void) strncpy(ipsl.isl_group, is->is_group, FR_GROUPLEN);
3977ab25eeb5Syz155240
3978ab25eeb5Syz155240 if (ipsl.isl_p == IPPROTO_TCP || ipsl.isl_p == IPPROTO_UDP) {
3979ab25eeb5Syz155240 ipsl.isl_sport = is->is_sport;
3980ab25eeb5Syz155240 ipsl.isl_dport = is->is_dport;
3981ab25eeb5Syz155240 if (ipsl.isl_p == IPPROTO_TCP) {
3982ab25eeb5Syz155240 ipsl.isl_state[0] = is->is_state[0];
3983ab25eeb5Syz155240 ipsl.isl_state[1] = is->is_state[1];
3984ab25eeb5Syz155240 }
3985ab25eeb5Syz155240 } else if (ipsl.isl_p == IPPROTO_ICMP) {
3986ab25eeb5Syz155240 ipsl.isl_itype = is->is_icmp.ici_type;
3987ab25eeb5Syz155240 } else if (ipsl.isl_p == IPPROTO_ICMPV6) {
3988ab25eeb5Syz155240 ipsl.isl_itype = is->is_icmp.ici_type;
3989ab25eeb5Syz155240 } else {
3990ab25eeb5Syz155240 ipsl.isl_ps.isl_filler[0] = 0;
3991ab25eeb5Syz155240 ipsl.isl_ps.isl_filler[1] = 0;
3992ab25eeb5Syz155240 }
3993ab25eeb5Syz155240
3994ab25eeb5Syz155240 items[0] = &ipsl;
3995ab25eeb5Syz155240 sizes[0] = sizeof(ipsl);
3996ab25eeb5Syz155240 types[0] = 0;
3997ab25eeb5Syz155240
3998f4b3ec61Sdh155122 if (ipllog(IPL_LOGSTATE, NULL, items, sizes, types, 1, ifs)) {
3999f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_logged);
4000ab25eeb5Syz155240 } else {
4001f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_logfail);
4002ab25eeb5Syz155240 }
4003ab25eeb5Syz155240 #endif
4004ab25eeb5Syz155240 }
4005ab25eeb5Syz155240
4006ab25eeb5Syz155240
4007ab25eeb5Syz155240 #ifdef USE_INET6
4008ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
4009ab25eeb5Syz155240 /* Function: fr_checkicmp6matchingstate */
4010ab25eeb5Syz155240 /* Returns: ipstate_t* - NULL == no match found, */
4011ab25eeb5Syz155240 /* else pointer to matching state entry */
4012ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */
4013ab25eeb5Syz155240 /* Locks: NULL == no locks, else Read Lock on ipf_state */
4014ab25eeb5Syz155240 /* */
4015ab25eeb5Syz155240 /* If we've got an ICMPv6 error message, using the information stored in */
4016ab25eeb5Syz155240 /* the ICMPv6 packet, look for a matching state table entry. */
4017ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_checkicmp6matchingstate(fin)4018ab25eeb5Syz155240 static ipstate_t *fr_checkicmp6matchingstate(fin)
4019ab25eeb5Syz155240 fr_info_t *fin;
4020ab25eeb5Syz155240 {
4021ab25eeb5Syz155240 struct icmp6_hdr *ic6, *oic;
4022ab25eeb5Syz155240 int backward, i;
4023ab25eeb5Syz155240 ipstate_t *is, **isp;
4024ab25eeb5Syz155240 u_short sport, dport;
4025ab25eeb5Syz155240 i6addr_t dst, src;
4026ab25eeb5Syz155240 u_short savelen;
4027ab25eeb5Syz155240 icmpinfo_t *ic;
4028ab25eeb5Syz155240 fr_info_t ofin;
4029ab25eeb5Syz155240 tcphdr_t *tcp;
4030ab25eeb5Syz155240 ip6_t *oip6;
4031ab25eeb5Syz155240 u_char pr;
4032ab25eeb5Syz155240 u_int hv;
4033f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs;
4034ab25eeb5Syz155240
4035ab25eeb5Syz155240 /*
4036ab25eeb5Syz155240 * Does it at least have the return (basic) IP header ?
4037ab25eeb5Syz155240 * Is it an actual recognised ICMP error type?
4038ab25eeb5Syz155240 * Only a basic IP header (no options) should be with
4039ab25eeb5Syz155240 * an ICMP error header.
4040ab25eeb5Syz155240 */
4041ab25eeb5Syz155240 if ((fin->fin_v != 6) || (fin->fin_plen < ICMP6ERR_MINPKTLEN) ||
4042ab25eeb5Syz155240 !(fin->fin_flx & FI_ICMPERR))
4043ab25eeb5Syz155240 return NULL;
4044ab25eeb5Syz155240
4045ab25eeb5Syz155240 ic6 = fin->fin_dp;
4046ab25eeb5Syz155240
4047ab25eeb5Syz155240 oip6 = (ip6_t *)((char *)ic6 + ICMPERR_ICMPHLEN);
4048ab25eeb5Syz155240 if (fin->fin_plen < sizeof(*oip6))
4049ab25eeb5Syz155240 return NULL;
4050ab25eeb5Syz155240
40516f8d8657Szf203873 bcopy((char *)fin, (char *)&ofin, sizeof(*fin));
4052ab25eeb5Syz155240 ofin.fin_v = 6;
4053ab25eeb5Syz155240 ofin.fin_ifp = fin->fin_ifp;
4054ab25eeb5Syz155240 ofin.fin_out = !fin->fin_out;
4055ab25eeb5Syz155240 ofin.fin_m = NULL; /* if dereferenced, panic XXX */
4056ab25eeb5Syz155240 ofin.fin_mp = NULL; /* if dereferenced, panic XXX */
4057ab25eeb5Syz155240
4058ab25eeb5Syz155240 /*
4059ab25eeb5Syz155240 * We make a fin entry to be able to feed it to
4060ab25eeb5Syz155240 * matchsrcdst. Note that not all fields are necessary
4061ab25eeb5Syz155240 * but this is the cleanest way. Note further we fill
4062ab25eeb5Syz155240 * in fin_mp such that if someone uses it we'll get
4063ab25eeb5Syz155240 * a kernel panic. fr_matchsrcdst does not use this.
4064ab25eeb5Syz155240 *
4065ab25eeb5Syz155240 * watch out here, as ip is in host order and oip6 in network
4066ab25eeb5Syz155240 * order. Any change we make must be undone afterwards.
4067ab25eeb5Syz155240 */
4068ab25eeb5Syz155240 savelen = oip6->ip6_plen;
4069ab25eeb5Syz155240 oip6->ip6_plen = fin->fin_dlen - ICMPERR_ICMPHLEN;
4070ab25eeb5Syz155240 ofin.fin_flx = FI_NOCKSUM;
4071ab25eeb5Syz155240 ofin.fin_ip = (ip_t *)oip6;
4072ab25eeb5Syz155240 ofin.fin_plen = oip6->ip6_plen;
4073ab25eeb5Syz155240 (void) fr_makefrip(sizeof(*oip6), (ip_t *)oip6, &ofin);
4074ab25eeb5Syz155240 ofin.fin_flx &= ~(FI_BAD|FI_SHORT);
4075ab25eeb5Syz155240 oip6->ip6_plen = savelen;
4076ab25eeb5Syz155240
4077ab25eeb5Syz155240 if (oip6->ip6_nxt == IPPROTO_ICMPV6) {
4078ab25eeb5Syz155240 oic = (struct icmp6_hdr *)(oip6 + 1);
4079ab25eeb5Syz155240 /*
4080ab25eeb5Syz155240 * an ICMP error can only be generated as a result of an
4081ab25eeb5Syz155240 * ICMP query, not as the response on an ICMP error
4082ab25eeb5Syz155240 *
4083ab25eeb5Syz155240 * XXX theoretically ICMP_ECHOREP and the other reply's are
4084ab25eeb5Syz155240 * ICMP query's as well, but adding them here seems strange XXX
4085ab25eeb5Syz155240 */
4086ab25eeb5Syz155240 if (!(oic->icmp6_type & ICMP6_INFOMSG_MASK))
4087ab25eeb5Syz155240 return NULL;
4088ab25eeb5Syz155240
4089ab25eeb5Syz155240 /*
4090ab25eeb5Syz155240 * perform a lookup of the ICMP packet in the state table
4091ab25eeb5Syz155240 */
4092ab25eeb5Syz155240 hv = (pr = oip6->ip6_nxt);
4093ab25eeb5Syz155240 src.in6 = oip6->ip6_src;
4094ab25eeb5Syz155240 hv += src.in4.s_addr;
4095ab25eeb5Syz155240 dst.in6 = oip6->ip6_dst;
4096ab25eeb5Syz155240 hv += dst.in4.s_addr;
4097ab25eeb5Syz155240 hv += oic->icmp6_id;
4098ab25eeb5Syz155240 hv += oic->icmp6_seq;
4099f4b3ec61Sdh155122 hv = DOUBLE_HASH(hv, ifs);
4100ab25eeb5Syz155240
4101f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state);
4102f4b3ec61Sdh155122 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) {
4103ab25eeb5Syz155240 ic = &is->is_icmp;
4104ab25eeb5Syz155240 isp = &is->is_hnext;
4105ab25eeb5Syz155240 if ((is->is_p == pr) &&
4106ab25eeb5Syz155240 !(is->is_pass & FR_NOICMPERR) &&
4107ab25eeb5Syz155240 (oic->icmp6_id == ic->ici_id) &&
4108ab25eeb5Syz155240 (oic->icmp6_seq == ic->ici_seq) &&
4109ab25eeb5Syz155240 (is = fr_matchsrcdst(&ofin, is, &src,
4110ab25eeb5Syz155240 &dst, NULL, FI_ICMPCMP))) {
4111ab25eeb5Syz155240 /*
4112ab25eeb5Syz155240 * in the state table ICMP query's are stored
4113ab25eeb5Syz155240 * with the type of the corresponding ICMP
4114ab25eeb5Syz155240 * response. Correct here
4115ab25eeb5Syz155240 */
4116ab25eeb5Syz155240 if (((ic->ici_type == ICMP6_ECHO_REPLY) &&
4117ab25eeb5Syz155240 (oic->icmp6_type == ICMP6_ECHO_REQUEST)) ||
4118ab25eeb5Syz155240 (ic->ici_type - 1 == oic->icmp6_type )) {
4119f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_hits++;
4120ab25eeb5Syz155240 backward = IP6_NEQ(&is->is_dst, &src);
4121ab25eeb5Syz155240 fin->fin_rev = !backward;
4122ab25eeb5Syz155240 i = (backward << 1) + fin->fin_out;
4123ab25eeb5Syz155240 is->is_icmppkts[i]++;
4124ab25eeb5Syz155240 return is;
4125ab25eeb5Syz155240 }
4126ab25eeb5Syz155240 }
4127ab25eeb5Syz155240 }
4128f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
4129ab25eeb5Syz155240 return NULL;
4130ab25eeb5Syz155240 }
4131ab25eeb5Syz155240
4132ab25eeb5Syz155240 hv = (pr = oip6->ip6_nxt);
4133ab25eeb5Syz155240 src.in6 = oip6->ip6_src;
4134ab25eeb5Syz155240 hv += src.i6[0];
4135ab25eeb5Syz155240 hv += src.i6[1];
4136ab25eeb5Syz155240 hv += src.i6[2];
4137ab25eeb5Syz155240 hv += src.i6[3];
4138ab25eeb5Syz155240 dst.in6 = oip6->ip6_dst;
4139ab25eeb5Syz155240 hv += dst.i6[0];
4140ab25eeb5Syz155240 hv += dst.i6[1];
4141ab25eeb5Syz155240 hv += dst.i6[2];
4142ab25eeb5Syz155240 hv += dst.i6[3];
4143ab25eeb5Syz155240
4144ab25eeb5Syz155240 if ((oip6->ip6_nxt == IPPROTO_TCP) || (oip6->ip6_nxt == IPPROTO_UDP)) {
4145ab25eeb5Syz155240 tcp = (tcphdr_t *)(oip6 + 1);
4146ab25eeb5Syz155240 dport = tcp->th_dport;
4147ab25eeb5Syz155240 sport = tcp->th_sport;
4148ab25eeb5Syz155240 hv += dport;
4149ab25eeb5Syz155240 hv += sport;
4150ab25eeb5Syz155240 } else
4151ab25eeb5Syz155240 tcp = NULL;
4152f4b3ec61Sdh155122 hv = DOUBLE_HASH(hv, ifs);
4153ab25eeb5Syz155240
4154f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state);
4155f4b3ec61Sdh155122 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) {
4156ab25eeb5Syz155240 isp = &is->is_hnext;
4157ab25eeb5Syz155240 /*
4158ab25eeb5Syz155240 * Only allow this icmp though if the
4159ab25eeb5Syz155240 * encapsulated packet was allowed through the
4160ab25eeb5Syz155240 * other way around. Note that the minimal amount
4161ab25eeb5Syz155240 * of info present does not allow for checking against
4162ab25eeb5Syz155240 * tcp internals such as seq and ack numbers.
4163ab25eeb5Syz155240 */
4164ab25eeb5Syz155240 if ((is->is_p != pr) || (is->is_v != 6) ||
4165ab25eeb5Syz155240 (is->is_pass & FR_NOICMPERR))
4166ab25eeb5Syz155240 continue;
4167ab25eeb5Syz155240 is = fr_matchsrcdst(&ofin, is, &src, &dst, tcp, FI_ICMPCMP);
4168ab25eeb5Syz155240 if (is != NULL) {
4169f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_hits++;
4170ab25eeb5Syz155240 backward = IP6_NEQ(&is->is_dst, &src);
4171ab25eeb5Syz155240 fin->fin_rev = !backward;
4172ab25eeb5Syz155240 i = (backward << 1) + fin->fin_out;
4173ab25eeb5Syz155240 is->is_icmppkts[i]++;
4174ab25eeb5Syz155240 /*
4175ab25eeb5Syz155240 * we deliberately do not touch the timeouts
4176ab25eeb5Syz155240 * for the accompanying state table entry.
4177ab25eeb5Syz155240 * It remains to be seen if that is correct. XXX
4178ab25eeb5Syz155240 */
4179ab25eeb5Syz155240 return is;
4180ab25eeb5Syz155240 }
4181ab25eeb5Syz155240 }
4182f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
4183ab25eeb5Syz155240 return NULL;
4184ab25eeb5Syz155240 }
4185ab25eeb5Syz155240 #endif
4186ab25eeb5Syz155240
4187ab25eeb5Syz155240
4188ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
4189ab25eeb5Syz155240 /* Function: fr_sttab_init */
4190ab25eeb5Syz155240 /* Returns: Nil */
4191ab25eeb5Syz155240 /* Parameters: tqp(I) - pointer to an array of timeout queues for TCP */
4192ab25eeb5Syz155240 /* */
4193ab25eeb5Syz155240 /* Initialise the array of timeout queues for TCP. */
4194ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_sttab_init(tqp,ifs)4195f4b3ec61Sdh155122 void fr_sttab_init(tqp, ifs)
4196ab25eeb5Syz155240 ipftq_t *tqp;
4197f4b3ec61Sdh155122 ipf_stack_t *ifs;
4198ab25eeb5Syz155240 {
4199ab25eeb5Syz155240 int i;
4200ab25eeb5Syz155240
4201ab25eeb5Syz155240 for (i = IPF_TCP_NSTATES - 1; i >= 0; i--) {
4202ab25eeb5Syz155240 tqp[i].ifq_ttl = 0;
4203ab25eeb5Syz155240 tqp[i].ifq_ref = 1;
4204ab25eeb5Syz155240 tqp[i].ifq_head = NULL;
4205ab25eeb5Syz155240 tqp[i].ifq_tail = &tqp[i].ifq_head;
4206ab25eeb5Syz155240 tqp[i].ifq_next = tqp + i + 1;
4207ab25eeb5Syz155240 MUTEX_INIT(&tqp[i].ifq_lock, "ipftq tcp tab");
4208ab25eeb5Syz155240 }
4209ab25eeb5Syz155240 tqp[IPF_TCP_NSTATES - 1].ifq_next = NULL;
4210f4b3ec61Sdh155122 tqp[IPF_TCPS_CLOSED].ifq_ttl = ifs->ifs_fr_tcpclosed;
4211f4b3ec61Sdh155122 tqp[IPF_TCPS_LISTEN].ifq_ttl = ifs->ifs_fr_tcptimeout;
4212f4b3ec61Sdh155122 tqp[IPF_TCPS_SYN_SENT].ifq_ttl = ifs->ifs_fr_tcptimeout;
4213f4b3ec61Sdh155122 tqp[IPF_TCPS_SYN_RECEIVED].ifq_ttl = ifs->ifs_fr_tcptimeout;
4214f4b3ec61Sdh155122 tqp[IPF_TCPS_ESTABLISHED].ifq_ttl = ifs->ifs_fr_tcpidletimeout;
4215f4b3ec61Sdh155122 tqp[IPF_TCPS_CLOSE_WAIT].ifq_ttl = ifs->ifs_fr_tcphalfclosed;
4216f4b3ec61Sdh155122 tqp[IPF_TCPS_FIN_WAIT_1].ifq_ttl = ifs->ifs_fr_tcphalfclosed;
4217f4b3ec61Sdh155122 tqp[IPF_TCPS_CLOSING].ifq_ttl = ifs->ifs_fr_tcptimeout;
4218f4b3ec61Sdh155122 tqp[IPF_TCPS_LAST_ACK].ifq_ttl = ifs->ifs_fr_tcplastack;
4219f4b3ec61Sdh155122 tqp[IPF_TCPS_FIN_WAIT_2].ifq_ttl = ifs->ifs_fr_tcpclosewait;
4220f4b3ec61Sdh155122 tqp[IPF_TCPS_TIME_WAIT].ifq_ttl = ifs->ifs_fr_tcptimeout;
4221f4b3ec61Sdh155122 tqp[IPF_TCPS_HALF_ESTAB].ifq_ttl = ifs->ifs_fr_tcptimeout;
4222ab25eeb5Syz155240 }
4223ab25eeb5Syz155240
4224ab25eeb5Syz155240
4225ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
4226ab25eeb5Syz155240 /* Function: fr_sttab_destroy */
4227ab25eeb5Syz155240 /* Returns: Nil */
4228ab25eeb5Syz155240 /* Parameters: tqp(I) - pointer to an array of timeout queues for TCP */
4229ab25eeb5Syz155240 /* */
4230ab25eeb5Syz155240 /* Do whatever is necessary to "destroy" each of the entries in the array */
4231ab25eeb5Syz155240 /* of timeout queues for TCP. */
4232ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_sttab_destroy(tqp)4233ab25eeb5Syz155240 void fr_sttab_destroy(tqp)
4234ab25eeb5Syz155240 ipftq_t *tqp;
4235ab25eeb5Syz155240 {
4236ab25eeb5Syz155240 int i;
4237ab25eeb5Syz155240
4238ab25eeb5Syz155240 for (i = IPF_TCP_NSTATES - 1; i >= 0; i--)
4239ab25eeb5Syz155240 MUTEX_DESTROY(&tqp[i].ifq_lock);
4240ab25eeb5Syz155240 }
4241ab25eeb5Syz155240
4242ab25eeb5Syz155240
4243ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
4244ab25eeb5Syz155240 /* Function: fr_statederef */
4245ab25eeb5Syz155240 /* Returns: Nil */
4246ab25eeb5Syz155240 /* Parameters: isp(I) - pointer to pointer to state table entry */
424790b0a856Sjojemann /* ifs - ipf stack instance */
4248ab25eeb5Syz155240 /* */
4249ab25eeb5Syz155240 /* Decrement the reference counter for this state table entry and free it */
4250ab25eeb5Syz155240 /* if there are no more things using it. */
4251ab25eeb5Syz155240 /* */
4252ab25eeb5Syz155240 /* Internal parameters: */
4253ab25eeb5Syz155240 /* state[0] = state of source (host that initiated connection) */
4254ab25eeb5Syz155240 /* state[1] = state of dest (host that accepted the connection) */
4255ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_statederef(isp,ifs)425690b0a856Sjojemann void fr_statederef(isp, ifs)
4257ab25eeb5Syz155240 ipstate_t **isp;
4258f4b3ec61Sdh155122 ipf_stack_t *ifs;
4259ab25eeb5Syz155240 {
426090b0a856Sjojemann ipstate_t *is;
4261ab25eeb5Syz155240
4262ab25eeb5Syz155240 is = *isp;
4263ab25eeb5Syz155240 *isp = NULL;
42640e01ff8bSdr146992
42650e01ff8bSdr146992 MUTEX_ENTER(&is->is_lock);
42660e01ff8bSdr146992 if (is->is_ref > 1) {
4267ab25eeb5Syz155240 is->is_ref--;
42680e01ff8bSdr146992 MUTEX_EXIT(&is->is_lock);
4269ab25eeb5Syz155240 #ifndef _KERNEL
42700e01ff8bSdr146992 if ((is->is_sti.tqe_state[0] > IPF_TCPS_ESTABLISHED) ||
4271ab25eeb5Syz155240 (is->is_sti.tqe_state[1] > IPF_TCPS_ESTABLISHED)) {
4272ea8244dcSJohn Ojemann (void) fr_delstate(is, ISL_ORPHAN, ifs);
4273ab25eeb5Syz155240 }
42740e01ff8bSdr146992 #endif
42750e01ff8bSdr146992 return;
42760e01ff8bSdr146992 }
42770e01ff8bSdr146992 MUTEX_EXIT(&is->is_lock);
42780e01ff8bSdr146992
42790e01ff8bSdr146992 WRITE_ENTER(&ifs->ifs_ipf_state);
4280ea8244dcSJohn Ojemann (void) fr_delstate(is, ISL_EXPIRE, ifs);
4281f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
4282ab25eeb5Syz155240 }
4283ab25eeb5Syz155240
4284ab25eeb5Syz155240
4285ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
4286ab25eeb5Syz155240 /* Function: fr_setstatequeue */
4287ab25eeb5Syz155240 /* Returns: Nil */
4288ab25eeb5Syz155240 /* Parameters: is(I) - pointer to state structure */
4289ab25eeb5Syz155240 /* rev(I) - forward(0) or reverse(1) direction */
4290ab25eeb5Syz155240 /* Locks: ipf_state (read or write) */
4291ab25eeb5Syz155240 /* */
4292ab25eeb5Syz155240 /* Put the state entry on its default queue entry, using rev as a helped in */
4293ab25eeb5Syz155240 /* determining which queue it should be placed on. */
4294ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */
fr_setstatequeue(is,rev,ifs)4295f4b3ec61Sdh155122 void fr_setstatequeue(is, rev, ifs)
4296ab25eeb5Syz155240 ipstate_t *is;
4297ab25eeb5Syz155240 int rev;
4298f4b3ec61Sdh155122 ipf_stack_t *ifs;
4299ab25eeb5Syz155240 {
4300ab25eeb5Syz155240 ipftq_t *oifq, *nifq;
4301ab25eeb5Syz155240
4302ab25eeb5Syz155240
4303ab25eeb5Syz155240 if ((is->is_sti.tqe_flags & TQE_RULEBASED) != 0)
4304ab25eeb5Syz155240 nifq = is->is_tqehead[rev];
4305ab25eeb5Syz155240 else
4306ab25eeb5Syz155240 nifq = NULL;
4307ab25eeb5Syz155240
4308ab25eeb5Syz155240 if (nifq == NULL) {
4309ab25eeb5Syz155240 switch (is->is_p)
4310ab25eeb5Syz155240 {
4311ab25eeb5Syz155240 #ifdef USE_INET6
4312ab25eeb5Syz155240 case IPPROTO_ICMPV6 :
4313ab25eeb5Syz155240 if (rev == 1)
4314f4b3ec61Sdh155122 nifq = &ifs->ifs_ips_icmpacktq;
4315ab25eeb5Syz155240 else
4316f4b3ec61Sdh155122 nifq = &ifs->ifs_ips_icmptq;
4317ab25eeb5Syz155240 break;
4318ab25eeb5Syz155240 #endif
4319ab25eeb5Syz155240 case IPPROTO_ICMP :
4320ab25eeb5Syz155240 if (rev == 1)
4321f4b3ec61Sdh155122 nifq = &ifs->ifs_ips_icmpacktq;
4322ab25eeb5Syz155240 else
4323f4b3ec61Sdh155122 nifq = &ifs->ifs_ips_icmptq;
4324ab25eeb5Syz155240 break;
4325ab25eeb5Syz155240 case IPPROTO_TCP :
4326f4b3ec61Sdh155122 nifq = ifs->ifs_ips_tqtqb + is->is_state[rev];
4327ab25eeb5Syz155240 break;
4328ab25eeb5Syz155240
4329ab25eeb5Syz155240 case IPPROTO_UDP :
4330ab25eeb5Syz155240 if (rev == 1)
4331f4b3ec61Sdh155122 nifq = &ifs->ifs_ips_udpacktq;
4332ab25eeb5Syz155240 else
4333f4b3ec61Sdh155122 nifq = &ifs->ifs_ips_udptq;
4334ab25eeb5Syz155240 break;
4335ab25eeb5Syz155240
4336ab25eeb5Syz155240 default :
4337f4b3ec61Sdh155122 nifq = &ifs->ifs_ips_iptq;
4338ab25eeb5Syz155240 break;
4339ab25eeb5Syz155240 }
4340ab25eeb5Syz155240 }
4341ab25eeb5Syz155240
4342ab25eeb5Syz155240 oifq = is->is_sti.tqe_ifq;
4343ab25eeb5Syz155240 /*
4344ab25eeb5Syz155240 * If it's currently on a timeout queue, move it from one queue to
4345ab25eeb5Syz155240 * another, else put it on the end of the newly determined queue.
4346ab25eeb5Syz155240 */
4347ab25eeb5Syz155240 if (oifq != NULL)
4348f4b3ec61Sdh155122 fr_movequeue(&is->is_sti, oifq, nifq, ifs);
4349ab25eeb5Syz155240 else
4350f4b3ec61Sdh155122 fr_queueappend(&is->is_sti, nifq, is, ifs);
4351ab25eeb5Syz155240 return;
4352ab25eeb5Syz155240 }
4353f4b3ec61Sdh155122
4354f4b3ec61Sdh155122
4355f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */
4356f4b3ec61Sdh155122 /* Function: fr_stateiter */
4357f4b3ec61Sdh155122 /* Returns: int - 0 == success, else error */
4358f4b3ec61Sdh155122 /* Parameters: token(I) - pointer to ipftoken structure */
4359f4b3ec61Sdh155122 /* itp(I) - pointer to ipfgeniter structure */
4360f4b3ec61Sdh155122 /* */
4361f4b3ec61Sdh155122 /* This function handles the SIOCGENITER ioctl for the state tables and */
4362f4b3ec61Sdh155122 /* walks through the list of entries in the state table list (ips_list.) */
4363f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */
fr_stateiter(token,itp,ifs)4364f4b3ec61Sdh155122 static int fr_stateiter(token, itp, ifs)
4365f4b3ec61Sdh155122 ipftoken_t *token;
4366f4b3ec61Sdh155122 ipfgeniter_t *itp;
4367f4b3ec61Sdh155122 ipf_stack_t *ifs;
4368f4b3ec61Sdh155122 {
4369f4b3ec61Sdh155122 ipstate_t *is, *next, zero;
437090b0a856Sjojemann int error, count;
437190b0a856Sjojemann char *dst;
4372f4b3ec61Sdh155122
4373f4b3ec61Sdh155122 if (itp->igi_data == NULL)
4374f4b3ec61Sdh155122 return EFAULT;
4375f4b3ec61Sdh155122
437690b0a856Sjojemann if (itp->igi_nitems == 0)
437790b0a856Sjojemann return EINVAL;
437890b0a856Sjojemann
4379f4b3ec61Sdh155122 if (itp->igi_type != IPFGENITER_STATE)
4380f4b3ec61Sdh155122 return EINVAL;
4381f4b3ec61Sdh155122
438290b0a856Sjojemann error = 0;
438390b0a856Sjojemann
4384f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state);
4385786c7074Sjojemann
4386786c7074Sjojemann /*
4387786c7074Sjojemann * Get "previous" entry from the token and find the next entry.
4388786c7074Sjojemann */
4389786c7074Sjojemann is = token->ipt_data;
4390f4b3ec61Sdh155122 if (is == NULL) {
4391f4b3ec61Sdh155122 next = ifs->ifs_ips_list;
4392f4b3ec61Sdh155122 } else {
4393f4b3ec61Sdh155122 next = is->is_next;
4394f4b3ec61Sdh155122 }
4395f4b3ec61Sdh155122
4396786c7074Sjojemann dst = itp->igi_data;
439790b0a856Sjojemann for (count = itp->igi_nitems; count > 0; count--) {
4398f4b3ec61Sdh155122 /*
4399786c7074Sjojemann * If we found an entry, add a reference to it and update the token.
4400786c7074Sjojemann * Otherwise, zero out data to be returned and NULL out token.
4401f4b3ec61Sdh155122 */
4402786c7074Sjojemann if (next != NULL) {
4403f4b3ec61Sdh155122 MUTEX_ENTER(&next->is_lock);
4404f4b3ec61Sdh155122 next->is_ref++;
4405f4b3ec61Sdh155122 MUTEX_EXIT(&next->is_lock);
4406f4b3ec61Sdh155122 token->ipt_data = next;
4407f4b3ec61Sdh155122 } else {
4408f4b3ec61Sdh155122 bzero(&zero, sizeof(zero));
4409f4b3ec61Sdh155122 next = &zero;
4410786c7074Sjojemann token->ipt_data = NULL;
4411f4b3ec61Sdh155122 }
4412786c7074Sjojemann
4413786c7074Sjojemann /*
4414786c7074Sjojemann * Safe to release lock now the we have a reference.
4415786c7074Sjojemann */
4416f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state);
4417f4b3ec61Sdh155122
4418f4b3ec61Sdh155122 /*
4419786c7074Sjojemann * Copy out data and clean up references and tokens.
4420f4b3ec61Sdh155122 */
442190b0a856Sjojemann error = COPYOUT(next, dst, sizeof(*next));
4422f4b3ec61Sdh155122 if (error != 0)
4423f4b3ec61Sdh155122 error = EFAULT;
4424786c7074Sjojemann if (token->ipt_data == NULL) {
4425786c7074Sjojemann ipf_freetoken(token, ifs);
4426786c7074Sjojemann break;
4427786c7074Sjojemann } else {
4428786c7074Sjojemann if (is != NULL)
4429786c7074Sjojemann fr_statederef(&is, ifs);
4430786c7074Sjojemann if (next->is_next == NULL) {
4431786c7074Sjojemann ipf_freetoken(token, ifs);
4432786c7074Sjojemann break;
4433786c7074Sjojemann }
4434786c7074Sjojemann }
4435786c7074Sjojemann
443690b0a856Sjojemann if ((count == 1) || (error != 0))
443790b0a856Sjojemann break;
443890b0a856Sjojemann
443990b0a856Sjojemann READ_ENTER(&ifs->ifs_ipf_state);
4440786c7074Sjojemann dst += sizeof(*next);
444190b0a856Sjojemann is = next;
444290b0a856Sjojemann next = is->is_next;
444390b0a856Sjojemann }
4444f4b3ec61Sdh155122
4445f4b3ec61Sdh155122 return error;
4446f4b3ec61Sdh155122 }
4447