1ab25eeb5Syz155240 /* 2ab25eeb5Syz155240 * Copyright (C) 1995-2003 by Darren Reed. 3ab25eeb5Syz155240 * 4ab25eeb5Syz155240 * See the IPFILTER.LICENCE file for details on licencing. 5ab25eeb5Syz155240 * 6*52239d04San207044 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 7ab25eeb5Syz155240 * Use is subject to license terms. 8ab25eeb5Syz155240 */ 9ab25eeb5Syz155240 10ab25eeb5Syz155240 #pragma ident "%Z%%M% %I% %E% SMI" 11ab25eeb5Syz155240 12ab25eeb5Syz155240 #if defined(KERNEL) || defined(_KERNEL) 13ab25eeb5Syz155240 # undef KERNEL 14ab25eeb5Syz155240 # undef _KERNEL 15ab25eeb5Syz155240 # define KERNEL 1 16ab25eeb5Syz155240 # define _KERNEL 1 17ab25eeb5Syz155240 #endif 18ab25eeb5Syz155240 #include <sys/errno.h> 19ab25eeb5Syz155240 #include <sys/types.h> 20ab25eeb5Syz155240 #include <sys/param.h> 21ab25eeb5Syz155240 #include <sys/file.h> 22ab25eeb5Syz155240 #if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \ 23ab25eeb5Syz155240 defined(_KERNEL) 24ab25eeb5Syz155240 # include "opt_ipfilter_log.h" 25ab25eeb5Syz155240 #endif 26ab25eeb5Syz155240 #if defined(_KERNEL) && defined(__FreeBSD_version) && \ 27ab25eeb5Syz155240 (__FreeBSD_version >= 400000) && !defined(KLD_MODULE) 28ab25eeb5Syz155240 #include "opt_inet6.h" 29ab25eeb5Syz155240 #endif 30ab25eeb5Syz155240 #if !defined(_KERNEL) && !defined(__KERNEL__) 31ab25eeb5Syz155240 # include <stdio.h> 32ab25eeb5Syz155240 # include <stdlib.h> 33ab25eeb5Syz155240 # include <string.h> 34ab25eeb5Syz155240 # define _KERNEL 35ab25eeb5Syz155240 # ifdef __OpenBSD__ 36ab25eeb5Syz155240 struct file; 37ab25eeb5Syz155240 # endif 38ab25eeb5Syz155240 # include <sys/uio.h> 39ab25eeb5Syz155240 # undef _KERNEL 40ab25eeb5Syz155240 #endif 41ab25eeb5Syz155240 #if defined(_KERNEL) && (__FreeBSD_version >= 220000) 42ab25eeb5Syz155240 # include <sys/filio.h> 43ab25eeb5Syz155240 # include <sys/fcntl.h> 44ab25eeb5Syz155240 # if (__FreeBSD_version >= 300000) && !defined(IPFILTER_LKM) 45ab25eeb5Syz155240 # include "opt_ipfilter.h" 46ab25eeb5Syz155240 # endif 47ab25eeb5Syz155240 #else 48ab25eeb5Syz155240 # include <sys/ioctl.h> 49ab25eeb5Syz155240 #endif 50ab25eeb5Syz155240 #include <sys/time.h> 51ab25eeb5Syz155240 #if !defined(linux) 52ab25eeb5Syz155240 # include <sys/protosw.h> 53ab25eeb5Syz155240 #endif 54ab25eeb5Syz155240 #include <sys/socket.h> 55ab25eeb5Syz155240 #if defined(_KERNEL) 56ab25eeb5Syz155240 # include <sys/systm.h> 57ab25eeb5Syz155240 # if !defined(__SVR4) && !defined(__svr4__) 58ab25eeb5Syz155240 # include <sys/mbuf.h> 59ab25eeb5Syz155240 # endif 60ab25eeb5Syz155240 #endif 61ab25eeb5Syz155240 #if defined(__SVR4) || defined(__svr4__) 62ab25eeb5Syz155240 # include <sys/filio.h> 63ab25eeb5Syz155240 # include <sys/byteorder.h> 64ab25eeb5Syz155240 # ifdef _KERNEL 65ab25eeb5Syz155240 # include <sys/dditypes.h> 66ab25eeb5Syz155240 # endif 67ab25eeb5Syz155240 # include <sys/stream.h> 68ab25eeb5Syz155240 # include <sys/kmem.h> 69ab25eeb5Syz155240 #endif 70ab25eeb5Syz155240 71ab25eeb5Syz155240 #include <net/if.h> 72ab25eeb5Syz155240 #ifdef sun 73ab25eeb5Syz155240 # include <net/af.h> 74ab25eeb5Syz155240 #endif 75ab25eeb5Syz155240 #include <net/route.h> 76ab25eeb5Syz155240 #include <netinet/in.h> 77ab25eeb5Syz155240 #include <netinet/in_systm.h> 78ab25eeb5Syz155240 #include <netinet/ip.h> 79ab25eeb5Syz155240 #include <netinet/tcp.h> 80ab25eeb5Syz155240 #if !defined(linux) 81ab25eeb5Syz155240 # include <netinet/ip_var.h> 82ab25eeb5Syz155240 #endif 83ab25eeb5Syz155240 #if !defined(__hpux) && !defined(linux) 84ab25eeb5Syz155240 # include <netinet/tcp_fsm.h> 85ab25eeb5Syz155240 #endif 86ab25eeb5Syz155240 #include <netinet/udp.h> 87ab25eeb5Syz155240 #include <netinet/ip_icmp.h> 88ab25eeb5Syz155240 #include "netinet/ip_compat.h" 89ab25eeb5Syz155240 #include <netinet/tcpip.h> 90ab25eeb5Syz155240 #include "netinet/ip_fil.h" 91ab25eeb5Syz155240 #include "netinet/ip_nat.h" 92ab25eeb5Syz155240 #include "netinet/ip_frag.h" 93ab25eeb5Syz155240 #include "netinet/ip_state.h" 94ab25eeb5Syz155240 #include "netinet/ip_proxy.h" 95f4b3ec61Sdh155122 #include "netinet/ipf_stack.h" 96ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 97ab25eeb5Syz155240 #include "netinet/ip_sync.h" 98ab25eeb5Syz155240 #endif 99ab25eeb5Syz155240 #ifdef IPFILTER_SCAN 100ab25eeb5Syz155240 #include "netinet/ip_scan.h" 101ab25eeb5Syz155240 #endif 102ab25eeb5Syz155240 #ifdef USE_INET6 103ab25eeb5Syz155240 #include <netinet/icmp6.h> 104ab25eeb5Syz155240 #endif 105ab25eeb5Syz155240 #if (__FreeBSD_version >= 300000) 106ab25eeb5Syz155240 # include <sys/malloc.h> 107ab25eeb5Syz155240 # if defined(_KERNEL) && !defined(IPFILTER_LKM) 108ab25eeb5Syz155240 # include <sys/libkern.h> 109ab25eeb5Syz155240 # include <sys/systm.h> 110ab25eeb5Syz155240 # endif 111ab25eeb5Syz155240 #endif 112ab25eeb5Syz155240 /* END OF INCLUDES */ 113ab25eeb5Syz155240 114ab25eeb5Syz155240 115ab25eeb5Syz155240 #if !defined(lint) 116ab25eeb5Syz155240 static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed"; 117ab25eeb5Syz155240 static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.186.2.36 2005/08/11 19:58:03 darrenr Exp $"; 118ab25eeb5Syz155240 #endif 119ab25eeb5Syz155240 120ab25eeb5Syz155240 #ifdef USE_INET6 121ab25eeb5Syz155240 static ipstate_t *fr_checkicmp6matchingstate __P((fr_info_t *)); 122ab25eeb5Syz155240 #endif 123ab25eeb5Syz155240 static ipstate_t *fr_matchsrcdst __P((fr_info_t *, ipstate_t *, i6addr_t *, 124ab25eeb5Syz155240 i6addr_t *, tcphdr_t *, u_32_t)); 125ab25eeb5Syz155240 static ipstate_t *fr_checkicmpmatchingstate __P((fr_info_t *)); 126f4b3ec61Sdh155122 static int fr_state_flush __P((int, int, ipf_stack_t *)); 127f4b3ec61Sdh155122 static ips_stat_t *fr_statetstats __P((ipf_stack_t *)); 128f4b3ec61Sdh155122 static void fr_delstate __P((ipstate_t *, int, ipf_stack_t *)); 129f4b3ec61Sdh155122 static int fr_state_remove __P((caddr_t, ipf_stack_t *)); 130f4b3ec61Sdh155122 static void fr_ipsmove __P((ipstate_t *, u_int, ipf_stack_t *)); 131ab25eeb5Syz155240 static int fr_tcpstate __P((fr_info_t *, tcphdr_t *, ipstate_t *)); 132ab25eeb5Syz155240 static int fr_tcpoptions __P((fr_info_t *, tcphdr_t *, tcpdata_t *)); 133ab25eeb5Syz155240 static ipstate_t *fr_stclone __P((fr_info_t *, tcphdr_t *, ipstate_t *)); 134ab25eeb5Syz155240 static void fr_fixinisn __P((fr_info_t *, ipstate_t *)); 135ab25eeb5Syz155240 static void fr_fixoutisn __P((fr_info_t *, ipstate_t *)); 136ab25eeb5Syz155240 static void fr_checknewisn __P((fr_info_t *, ipstate_t *)); 137f4b3ec61Sdh155122 static int fr_stateiter __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *)); 138ab25eeb5Syz155240 139f4b3ec61Sdh155122 int fr_stputent __P((caddr_t, ipf_stack_t *)); 140f4b3ec61Sdh155122 int fr_stgetent __P((caddr_t, ipf_stack_t *)); 141ab25eeb5Syz155240 142ab25eeb5Syz155240 #define ONE_DAY IPF_TTLVAL(1 * 86400) /* 1 day */ 143ab25eeb5Syz155240 #define FIVE_DAYS (5 * ONE_DAY) 144f4b3ec61Sdh155122 #define DOUBLE_HASH(x, ifs) \ 145f4b3ec61Sdh155122 (((x) + ifs->ifs_ips_seed[(x) % ifs->ifs_fr_statesize]) % ifs->ifs_fr_statesize) 146ab25eeb5Syz155240 147ab25eeb5Syz155240 148ab25eeb5Syz155240 149ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 150ab25eeb5Syz155240 /* Function: fr_stateinit */ 151ab25eeb5Syz155240 /* Returns: int - 0 == success, -1 == failure */ 152ab25eeb5Syz155240 /* Parameters: Nil */ 153ab25eeb5Syz155240 /* */ 154ab25eeb5Syz155240 /* Initialise all the global variables used within the state code. */ 155ab25eeb5Syz155240 /* This action also includes initiailising locks. */ 156ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 157f4b3ec61Sdh155122 int fr_stateinit(ifs) 158f4b3ec61Sdh155122 ipf_stack_t *ifs; 159ab25eeb5Syz155240 { 160ab25eeb5Syz155240 int i; 161ab25eeb5Syz155240 162f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_ips_table, ipstate_t **, 163f4b3ec61Sdh155122 ifs->ifs_fr_statesize * sizeof(ipstate_t *)); 164f4b3ec61Sdh155122 if (ifs->ifs_ips_table == NULL) 165f4b3ec61Sdh155122 return -1; 166f4b3ec61Sdh155122 bzero((char *)ifs->ifs_ips_table, 167f4b3ec61Sdh155122 ifs->ifs_fr_statesize * sizeof(ipstate_t *)); 168f4b3ec61Sdh155122 169f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_ips_seed, u_long *, 170f4b3ec61Sdh155122 ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_seed)); 171f4b3ec61Sdh155122 if (ifs->ifs_ips_seed == NULL) 172ab25eeb5Syz155240 return -2; 173f4b3ec61Sdh155122 for (i = 0; i < ifs->ifs_fr_statesize; i++) { 174ab25eeb5Syz155240 /* 175ab25eeb5Syz155240 * XXX - ips_seed[X] should be a random number of sorts. 176ab25eeb5Syz155240 */ 177ab25eeb5Syz155240 #if (__FreeBSD_version >= 400000) 178f4b3ec61Sdh155122 ifs->ifs_ips_seed[i] = arc4random(); 179ab25eeb5Syz155240 #else 180f4b3ec61Sdh155122 ifs->ifs_ips_seed[i] = ((u_long)ifs->ifs_ips_seed + i) * 181f4b3ec61Sdh155122 ifs->ifs_fr_statesize; 182f4b3ec61Sdh155122 ifs->ifs_ips_seed[i] ^= 0xa5a55a5a; 183f4b3ec61Sdh155122 ifs->ifs_ips_seed[i] *= (u_long)ifs->ifs_ips_seed; 184f4b3ec61Sdh155122 ifs->ifs_ips_seed[i] ^= 0x5a5aa5a5; 185f4b3ec61Sdh155122 ifs->ifs_ips_seed[i] *= ifs->ifs_fr_statemax; 186ab25eeb5Syz155240 #endif 187ab25eeb5Syz155240 } 188ab25eeb5Syz155240 189ab25eeb5Syz155240 /* fill icmp reply type table */ 190ab25eeb5Syz155240 for (i = 0; i <= ICMP_MAXTYPE; i++) 191ab25eeb5Syz155240 icmpreplytype4[i] = -1; 192ab25eeb5Syz155240 icmpreplytype4[ICMP_ECHO] = ICMP_ECHOREPLY; 193ab25eeb5Syz155240 icmpreplytype4[ICMP_TSTAMP] = ICMP_TSTAMPREPLY; 194ab25eeb5Syz155240 icmpreplytype4[ICMP_IREQ] = ICMP_IREQREPLY; 195ab25eeb5Syz155240 icmpreplytype4[ICMP_MASKREQ] = ICMP_MASKREPLY; 196ab25eeb5Syz155240 #ifdef USE_INET6 197ab25eeb5Syz155240 /* fill icmp reply type table */ 198ab25eeb5Syz155240 for (i = 0; i <= ICMP6_MAXTYPE; i++) 199ab25eeb5Syz155240 icmpreplytype6[i] = -1; 200ab25eeb5Syz155240 icmpreplytype6[ICMP6_ECHO_REQUEST] = ICMP6_ECHO_REPLY; 201ab25eeb5Syz155240 icmpreplytype6[ICMP6_MEMBERSHIP_QUERY] = ICMP6_MEMBERSHIP_REPORT; 202ab25eeb5Syz155240 icmpreplytype6[ICMP6_NI_QUERY] = ICMP6_NI_REPLY; 203ab25eeb5Syz155240 icmpreplytype6[ND_ROUTER_SOLICIT] = ND_ROUTER_ADVERT; 204ab25eeb5Syz155240 icmpreplytype6[ND_NEIGHBOR_SOLICIT] = ND_NEIGHBOR_ADVERT; 205ab25eeb5Syz155240 #endif 206ab25eeb5Syz155240 207f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_ips_stats.iss_bucketlen, u_long *, 208f4b3ec61Sdh155122 ifs->ifs_fr_statesize * sizeof(u_long)); 209f4b3ec61Sdh155122 if (ifs->ifs_ips_stats.iss_bucketlen == NULL) 210ab25eeb5Syz155240 return -1; 211f4b3ec61Sdh155122 bzero((char *)ifs->ifs_ips_stats.iss_bucketlen, 212f4b3ec61Sdh155122 ifs->ifs_fr_statesize * sizeof(u_long)); 213ab25eeb5Syz155240 214f4b3ec61Sdh155122 if (ifs->ifs_fr_state_maxbucket == 0) { 215f4b3ec61Sdh155122 for (i = ifs->ifs_fr_statesize; i > 0; i >>= 1) 216f4b3ec61Sdh155122 ifs->ifs_fr_state_maxbucket++; 217f4b3ec61Sdh155122 ifs->ifs_fr_state_maxbucket *= 2; 218ab25eeb5Syz155240 } 219ab25eeb5Syz155240 220f4b3ec61Sdh155122 fr_sttab_init(ifs->ifs_ips_tqtqb, ifs); 221f4b3ec61Sdh155122 ifs->ifs_ips_tqtqb[IPF_TCP_NSTATES - 1].ifq_next = &ifs->ifs_ips_udptq; 222f4b3ec61Sdh155122 ifs->ifs_ips_udptq.ifq_ttl = (u_long)ifs->ifs_fr_udptimeout; 223f4b3ec61Sdh155122 ifs->ifs_ips_udptq.ifq_ref = 1; 224f4b3ec61Sdh155122 ifs->ifs_ips_udptq.ifq_head = NULL; 225f4b3ec61Sdh155122 ifs->ifs_ips_udptq.ifq_tail = &ifs->ifs_ips_udptq.ifq_head; 226f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ips_udptq.ifq_lock, "ipftq udp tab"); 227f4b3ec61Sdh155122 ifs->ifs_ips_udptq.ifq_next = &ifs->ifs_ips_udpacktq; 228f4b3ec61Sdh155122 ifs->ifs_ips_udpacktq.ifq_ttl = (u_long)ifs->ifs_fr_udpacktimeout; 229f4b3ec61Sdh155122 ifs->ifs_ips_udpacktq.ifq_ref = 1; 230f4b3ec61Sdh155122 ifs->ifs_ips_udpacktq.ifq_head = NULL; 231f4b3ec61Sdh155122 ifs->ifs_ips_udpacktq.ifq_tail = &ifs->ifs_ips_udpacktq.ifq_head; 232f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ips_udpacktq.ifq_lock, "ipftq udpack tab"); 233f4b3ec61Sdh155122 ifs->ifs_ips_udpacktq.ifq_next = &ifs->ifs_ips_icmptq; 234f4b3ec61Sdh155122 ifs->ifs_ips_icmptq.ifq_ttl = (u_long)ifs->ifs_fr_icmptimeout; 235f4b3ec61Sdh155122 ifs->ifs_ips_icmptq.ifq_ref = 1; 236f4b3ec61Sdh155122 ifs->ifs_ips_icmptq.ifq_head = NULL; 237f4b3ec61Sdh155122 ifs->ifs_ips_icmptq.ifq_tail = &ifs->ifs_ips_icmptq.ifq_head; 238f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ips_icmptq.ifq_lock, "ipftq icmp tab"); 239f4b3ec61Sdh155122 ifs->ifs_ips_icmptq.ifq_next = &ifs->ifs_ips_icmpacktq; 240f4b3ec61Sdh155122 ifs->ifs_ips_icmpacktq.ifq_ttl = (u_long)ifs->ifs_fr_icmpacktimeout; 241f4b3ec61Sdh155122 ifs->ifs_ips_icmpacktq.ifq_ref = 1; 242f4b3ec61Sdh155122 ifs->ifs_ips_icmpacktq.ifq_head = NULL; 243f4b3ec61Sdh155122 ifs->ifs_ips_icmpacktq.ifq_tail = &ifs->ifs_ips_icmpacktq.ifq_head; 244f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ips_icmpacktq.ifq_lock, "ipftq icmpack tab"); 245f4b3ec61Sdh155122 ifs->ifs_ips_icmpacktq.ifq_next = &ifs->ifs_ips_iptq; 246f4b3ec61Sdh155122 ifs->ifs_ips_iptq.ifq_ttl = (u_long)ifs->ifs_fr_iptimeout; 247f4b3ec61Sdh155122 ifs->ifs_ips_iptq.ifq_ref = 1; 248f4b3ec61Sdh155122 ifs->ifs_ips_iptq.ifq_head = NULL; 249f4b3ec61Sdh155122 ifs->ifs_ips_iptq.ifq_tail = &ifs->ifs_ips_iptq.ifq_head; 250f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ips_iptq.ifq_lock, "ipftq ip tab"); 2511e6b25a4San207044 ifs->ifs_ips_iptq.ifq_next = &ifs->ifs_ips_deletetq; 2521e6b25a4San207044 /* entry's ttl in deletetq is just 1 tick */ 2531e6b25a4San207044 ifs->ifs_ips_deletetq.ifq_ttl = (u_long) 1; 2541e6b25a4San207044 ifs->ifs_ips_deletetq.ifq_ref = 1; 2551e6b25a4San207044 ifs->ifs_ips_deletetq.ifq_head = NULL; 2561e6b25a4San207044 ifs->ifs_ips_deletetq.ifq_tail = &ifs->ifs_ips_deletetq.ifq_head; 2571e6b25a4San207044 MUTEX_INIT(&ifs->ifs_ips_deletetq.ifq_lock, "state delete queue"); 2581e6b25a4San207044 ifs->ifs_ips_deletetq.ifq_next = NULL; 259ab25eeb5Syz155240 260f4b3ec61Sdh155122 RWLOCK_INIT(&ifs->ifs_ipf_state, "ipf IP state rwlock"); 261f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ipf_stinsert, "ipf state insert mutex"); 262f4b3ec61Sdh155122 ifs->ifs_fr_state_init = 1; 263ab25eeb5Syz155240 264f4b3ec61Sdh155122 ifs->ifs_ips_last_force_flush = ifs->ifs_fr_ticks; 265ab25eeb5Syz155240 return 0; 266ab25eeb5Syz155240 } 267ab25eeb5Syz155240 268ab25eeb5Syz155240 269ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 270ab25eeb5Syz155240 /* Function: fr_stateunload */ 271ab25eeb5Syz155240 /* Returns: Nil */ 272ab25eeb5Syz155240 /* Parameters: Nil */ 273ab25eeb5Syz155240 /* */ 274ab25eeb5Syz155240 /* Release and destroy any resources acquired or initialised so that */ 275ab25eeb5Syz155240 /* IPFilter can be unloaded or re-initialised. */ 276ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 277f4b3ec61Sdh155122 void fr_stateunload(ifs) 278f4b3ec61Sdh155122 ipf_stack_t *ifs; 279ab25eeb5Syz155240 { 280ab25eeb5Syz155240 ipftq_t *ifq, *ifqnext; 281ab25eeb5Syz155240 ipstate_t *is; 282ab25eeb5Syz155240 283f4b3ec61Sdh155122 while ((is = ifs->ifs_ips_list) != NULL) 284f4b3ec61Sdh155122 fr_delstate(is, 0, ifs); 285ab25eeb5Syz155240 286ab25eeb5Syz155240 /* 287ab25eeb5Syz155240 * Proxy timeout queues are not cleaned here because although they 288ab25eeb5Syz155240 * exist on the state list, appr_unload is called after fr_stateunload 289ab25eeb5Syz155240 * and the proxies actually are responsible for them being created. 290ab25eeb5Syz155240 * Should the proxy timeouts have their own list? There's no real 291ab25eeb5Syz155240 * justification as this is the only complicationA 292ab25eeb5Syz155240 */ 293f4b3ec61Sdh155122 for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) { 294ab25eeb5Syz155240 ifqnext = ifq->ifq_next; 295ab25eeb5Syz155240 if (((ifq->ifq_flags & IFQF_PROXY) == 0) && 296ab25eeb5Syz155240 (fr_deletetimeoutqueue(ifq) == 0)) 297f4b3ec61Sdh155122 fr_freetimeoutqueue(ifq, ifs); 298ab25eeb5Syz155240 } 299ab25eeb5Syz155240 300f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_inuse = 0; 301f4b3ec61Sdh155122 ifs->ifs_ips_num = 0; 302ab25eeb5Syz155240 303f4b3ec61Sdh155122 if (ifs->ifs_fr_state_init == 1) { 304f4b3ec61Sdh155122 fr_sttab_destroy(ifs->ifs_ips_tqtqb); 305f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ips_udptq.ifq_lock); 306f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ips_icmptq.ifq_lock); 307f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ips_udpacktq.ifq_lock); 308f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ips_icmpacktq.ifq_lock); 309f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ips_iptq.ifq_lock); 3101e6b25a4San207044 MUTEX_DESTROY(&ifs->ifs_ips_deletetq.ifq_lock); 311ab25eeb5Syz155240 } 312ab25eeb5Syz155240 313f4b3ec61Sdh155122 if (ifs->ifs_ips_table != NULL) { 314f4b3ec61Sdh155122 KFREES(ifs->ifs_ips_table, 315f4b3ec61Sdh155122 ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_table)); 316f4b3ec61Sdh155122 ifs->ifs_ips_table = NULL; 317ab25eeb5Syz155240 } 318ab25eeb5Syz155240 319f4b3ec61Sdh155122 if (ifs->ifs_ips_seed != NULL) { 320f4b3ec61Sdh155122 KFREES(ifs->ifs_ips_seed, 321f4b3ec61Sdh155122 ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_seed)); 322f4b3ec61Sdh155122 ifs->ifs_ips_seed = NULL; 323ab25eeb5Syz155240 } 324ab25eeb5Syz155240 325f4b3ec61Sdh155122 if (ifs->ifs_ips_stats.iss_bucketlen != NULL) { 326f4b3ec61Sdh155122 KFREES(ifs->ifs_ips_stats.iss_bucketlen, 327f4b3ec61Sdh155122 ifs->ifs_fr_statesize * sizeof(u_long)); 328f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_bucketlen = NULL; 329ab25eeb5Syz155240 } 330ab25eeb5Syz155240 331f4b3ec61Sdh155122 if (ifs->ifs_fr_state_maxbucket_reset == 1) 332f4b3ec61Sdh155122 ifs->ifs_fr_state_maxbucket = 0; 333ab25eeb5Syz155240 334f4b3ec61Sdh155122 if (ifs->ifs_fr_state_init == 1) { 335f4b3ec61Sdh155122 ifs->ifs_fr_state_init = 0; 336f4b3ec61Sdh155122 RW_DESTROY(&ifs->ifs_ipf_state); 337f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ipf_stinsert); 338ab25eeb5Syz155240 } 339ab25eeb5Syz155240 } 340ab25eeb5Syz155240 341ab25eeb5Syz155240 342ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 343ab25eeb5Syz155240 /* Function: fr_statetstats */ 344ab25eeb5Syz155240 /* Returns: ips_state_t* - pointer to state stats structure */ 345ab25eeb5Syz155240 /* Parameters: Nil */ 346ab25eeb5Syz155240 /* */ 347ab25eeb5Syz155240 /* Put all the current numbers and pointers into a single struct and return */ 348ab25eeb5Syz155240 /* a pointer to it. */ 349ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 350f4b3ec61Sdh155122 static ips_stat_t *fr_statetstats(ifs) 351f4b3ec61Sdh155122 ipf_stack_t *ifs; 352ab25eeb5Syz155240 { 353f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_active = ifs->ifs_ips_num; 354f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_statesize = ifs->ifs_fr_statesize; 355f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_statemax = ifs->ifs_fr_statemax; 356f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_table = ifs->ifs_ips_table; 357f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_list = ifs->ifs_ips_list; 358f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_ticks = ifs->ifs_fr_ticks; 359f4b3ec61Sdh155122 return &ifs->ifs_ips_stats; 360ab25eeb5Syz155240 } 361ab25eeb5Syz155240 362ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 363ab25eeb5Syz155240 /* Function: fr_state_remove */ 364ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 == failure */ 365ab25eeb5Syz155240 /* Parameters: data(I) - pointer to state structure to delete from table */ 366ab25eeb5Syz155240 /* */ 367ab25eeb5Syz155240 /* Search for a state structure that matches the one passed, according to */ 368ab25eeb5Syz155240 /* the IP addresses and other protocol specific information. */ 369ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 370f4b3ec61Sdh155122 static int fr_state_remove(data, ifs) 371ab25eeb5Syz155240 caddr_t data; 372f4b3ec61Sdh155122 ipf_stack_t *ifs; 373ab25eeb5Syz155240 { 374ab25eeb5Syz155240 ipstate_t *sp, st; 375ab25eeb5Syz155240 int error; 376ab25eeb5Syz155240 377ab25eeb5Syz155240 sp = &st; 378ab25eeb5Syz155240 error = fr_inobj(data, &st, IPFOBJ_IPSTATE); 379ab25eeb5Syz155240 if (error) 380ab25eeb5Syz155240 return EFAULT; 381ab25eeb5Syz155240 382f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state); 383f4b3ec61Sdh155122 for (sp = ifs->ifs_ips_list; sp; sp = sp->is_next) 384ab25eeb5Syz155240 if ((sp->is_p == st.is_p) && (sp->is_v == st.is_v) && 385ab25eeb5Syz155240 !bcmp((caddr_t)&sp->is_src, (caddr_t)&st.is_src, 386ab25eeb5Syz155240 sizeof(st.is_src)) && 387ab25eeb5Syz155240 !bcmp((caddr_t)&sp->is_dst, (caddr_t)&st.is_src, 388ab25eeb5Syz155240 sizeof(st.is_dst)) && 389ab25eeb5Syz155240 !bcmp((caddr_t)&sp->is_ps, (caddr_t)&st.is_ps, 390ab25eeb5Syz155240 sizeof(st.is_ps))) { 391f4b3ec61Sdh155122 fr_delstate(sp, ISL_REMOVE, ifs); 392f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 393ab25eeb5Syz155240 return 0; 394ab25eeb5Syz155240 } 395f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 396ab25eeb5Syz155240 return ESRCH; 397ab25eeb5Syz155240 } 398ab25eeb5Syz155240 399ab25eeb5Syz155240 400ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 401ab25eeb5Syz155240 /* Function: fr_state_ioctl */ 402ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 == failure */ 403ab25eeb5Syz155240 /* Parameters: data(I) - pointer to ioctl data */ 404ab25eeb5Syz155240 /* cmd(I) - ioctl command integer */ 405ab25eeb5Syz155240 /* mode(I) - file mode bits used with open */ 406ab25eeb5Syz155240 /* */ 407ab25eeb5Syz155240 /* Processes an ioctl call made to operate on the IP Filter state device. */ 408ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 409f4b3ec61Sdh155122 int fr_state_ioctl(data, cmd, mode, uid, ctx, ifs) 410ab25eeb5Syz155240 caddr_t data; 411ab25eeb5Syz155240 ioctlcmd_t cmd; 412f4b3ec61Sdh155122 int mode, uid; 413f4b3ec61Sdh155122 void *ctx; 414f4b3ec61Sdh155122 ipf_stack_t *ifs; 415ab25eeb5Syz155240 { 416ab25eeb5Syz155240 int arg, ret, error = 0; 417ab25eeb5Syz155240 418ab25eeb5Syz155240 switch (cmd) 419ab25eeb5Syz155240 { 420ab25eeb5Syz155240 /* 421ab25eeb5Syz155240 * Delete an entry from the state table. 422ab25eeb5Syz155240 */ 423ab25eeb5Syz155240 case SIOCDELST : 424f4b3ec61Sdh155122 error = fr_state_remove(data, ifs); 425ab25eeb5Syz155240 break; 426ab25eeb5Syz155240 /* 427ab25eeb5Syz155240 * Flush the state table 428ab25eeb5Syz155240 */ 429ab25eeb5Syz155240 case SIOCIPFFL : 430ab25eeb5Syz155240 BCOPYIN(data, (char *)&arg, sizeof(arg)); 431ab25eeb5Syz155240 if (arg == 0 || arg == 1) { 432f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state); 433f4b3ec61Sdh155122 ret = fr_state_flush(arg, 4, ifs); 434f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 435ab25eeb5Syz155240 BCOPYOUT((char *)&ret, data, sizeof(ret)); 436ab25eeb5Syz155240 } else 437ab25eeb5Syz155240 error = EINVAL; 438ab25eeb5Syz155240 break; 439ab25eeb5Syz155240 #ifdef USE_INET6 440ab25eeb5Syz155240 case SIOCIPFL6 : 441ab25eeb5Syz155240 BCOPYIN(data, (char *)&arg, sizeof(arg)); 442ab25eeb5Syz155240 if (arg == 0 || arg == 1) { 443f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state); 444f4b3ec61Sdh155122 ret = fr_state_flush(arg, 6, ifs); 445f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 446ab25eeb5Syz155240 BCOPYOUT((char *)&ret, data, sizeof(ret)); 447ab25eeb5Syz155240 } else 448ab25eeb5Syz155240 error = EINVAL; 449ab25eeb5Syz155240 break; 450ab25eeb5Syz155240 #endif 451ab25eeb5Syz155240 #ifdef IPFILTER_LOG 452ab25eeb5Syz155240 /* 453ab25eeb5Syz155240 * Flush the state log. 454ab25eeb5Syz155240 */ 455ab25eeb5Syz155240 case SIOCIPFFB : 456ab25eeb5Syz155240 if (!(mode & FWRITE)) 457ab25eeb5Syz155240 error = EPERM; 458ab25eeb5Syz155240 else { 459ab25eeb5Syz155240 int tmp; 460ab25eeb5Syz155240 461f4b3ec61Sdh155122 tmp = ipflog_clear(IPL_LOGSTATE, ifs); 462ab25eeb5Syz155240 BCOPYOUT((char *)&tmp, data, sizeof(tmp)); 463ab25eeb5Syz155240 } 464ab25eeb5Syz155240 break; 465ab25eeb5Syz155240 /* 466ab25eeb5Syz155240 * Turn logging of state information on/off. 467ab25eeb5Syz155240 */ 468ab25eeb5Syz155240 case SIOCSETLG : 469ab25eeb5Syz155240 if (!(mode & FWRITE)) 470ab25eeb5Syz155240 error = EPERM; 471ab25eeb5Syz155240 else { 472f4b3ec61Sdh155122 BCOPYIN((char *)data, 473f4b3ec61Sdh155122 (char *)&ifs->ifs_ipstate_logging, 474f4b3ec61Sdh155122 sizeof(ifs->ifs_ipstate_logging)); 475ab25eeb5Syz155240 } 476ab25eeb5Syz155240 break; 477ab25eeb5Syz155240 /* 478ab25eeb5Syz155240 * Return the current state of logging. 479ab25eeb5Syz155240 */ 480ab25eeb5Syz155240 case SIOCGETLG : 481f4b3ec61Sdh155122 BCOPYOUT((char *)&ifs->ifs_ipstate_logging, (char *)data, 482f4b3ec61Sdh155122 sizeof(ifs->ifs_ipstate_logging)); 483ab25eeb5Syz155240 break; 484ab25eeb5Syz155240 /* 485ab25eeb5Syz155240 * Return the number of bytes currently waiting to be read. 486ab25eeb5Syz155240 */ 487ab25eeb5Syz155240 case FIONREAD : 488f4b3ec61Sdh155122 arg = ifs->ifs_iplused[IPL_LOGSTATE]; /* returned in an int */ 489ab25eeb5Syz155240 BCOPYOUT((char *)&arg, data, sizeof(arg)); 490ab25eeb5Syz155240 break; 491ab25eeb5Syz155240 #endif 492ab25eeb5Syz155240 /* 493ab25eeb5Syz155240 * Get the current state statistics. 494ab25eeb5Syz155240 */ 495ab25eeb5Syz155240 case SIOCGETFS : 496f4b3ec61Sdh155122 error = fr_outobj(data, fr_statetstats(ifs), IPFOBJ_STATESTAT); 497ab25eeb5Syz155240 break; 498ab25eeb5Syz155240 /* 499ab25eeb5Syz155240 * Lock/Unlock the state table. (Locking prevents any changes, which 500ab25eeb5Syz155240 * means no packets match). 501ab25eeb5Syz155240 */ 502ab25eeb5Syz155240 case SIOCSTLCK : 503ab25eeb5Syz155240 if (!(mode & FWRITE)) { 504ab25eeb5Syz155240 error = EPERM; 505ab25eeb5Syz155240 } else { 506f4b3ec61Sdh155122 fr_lock(data, &ifs->ifs_fr_state_lock); 507ab25eeb5Syz155240 } 508ab25eeb5Syz155240 break; 509ab25eeb5Syz155240 /* 510ab25eeb5Syz155240 * Add an entry to the current state table. 511ab25eeb5Syz155240 */ 512ab25eeb5Syz155240 case SIOCSTPUT : 513f4b3ec61Sdh155122 if (!ifs->ifs_fr_state_lock || !(mode &FWRITE)) { 514ab25eeb5Syz155240 error = EACCES; 515ab25eeb5Syz155240 break; 516ab25eeb5Syz155240 } 517f4b3ec61Sdh155122 error = fr_stputent(data, ifs); 518ab25eeb5Syz155240 break; 519ab25eeb5Syz155240 /* 520ab25eeb5Syz155240 * Get a state table entry. 521ab25eeb5Syz155240 */ 522ab25eeb5Syz155240 case SIOCSTGET : 523f4b3ec61Sdh155122 if (!ifs->ifs_fr_state_lock) { 524ab25eeb5Syz155240 error = EACCES; 525ab25eeb5Syz155240 break; 526ab25eeb5Syz155240 } 527f4b3ec61Sdh155122 error = fr_stgetent(data, ifs); 528ab25eeb5Syz155240 break; 529f4b3ec61Sdh155122 530f4b3ec61Sdh155122 case SIOCGENITER : 531f4b3ec61Sdh155122 { 532f4b3ec61Sdh155122 ipftoken_t *token; 533f4b3ec61Sdh155122 ipfgeniter_t iter; 534f4b3ec61Sdh155122 535f4b3ec61Sdh155122 error = fr_inobj(data, &iter, IPFOBJ_GENITER); 536f4b3ec61Sdh155122 if (error != 0) 537f4b3ec61Sdh155122 break; 538f4b3ec61Sdh155122 539f4b3ec61Sdh155122 token = ipf_findtoken(IPFGENITER_STATE, uid, ctx, ifs); 540f4b3ec61Sdh155122 if (token != NULL) 541f4b3ec61Sdh155122 error = fr_stateiter(token, &iter, ifs); 542f4b3ec61Sdh155122 else 543f4b3ec61Sdh155122 error = ESRCH; 544f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_tokens); 545f4b3ec61Sdh155122 break; 546f4b3ec61Sdh155122 } 547f4b3ec61Sdh155122 548f4b3ec61Sdh155122 case SIOCIPFDELTOK : 549f4b3ec61Sdh155122 (void) BCOPYIN(data, (char *)&arg, sizeof(arg)); 550f4b3ec61Sdh155122 error = ipf_deltoken(arg, uid, ctx, ifs); 551f4b3ec61Sdh155122 break; 552f4b3ec61Sdh155122 553ab25eeb5Syz155240 default : 554ab25eeb5Syz155240 error = EINVAL; 555ab25eeb5Syz155240 break; 556ab25eeb5Syz155240 } 557ab25eeb5Syz155240 return error; 558ab25eeb5Syz155240 } 559ab25eeb5Syz155240 560ab25eeb5Syz155240 561ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 562ab25eeb5Syz155240 /* Function: fr_stgetent */ 563ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 == failure */ 564ab25eeb5Syz155240 /* Parameters: data(I) - pointer to state structure to retrieve from table */ 565ab25eeb5Syz155240 /* */ 566ab25eeb5Syz155240 /* Copy out state information from the kernel to a user space process. If */ 567ab25eeb5Syz155240 /* there is a filter rule associated with the state entry, copy that out */ 568ab25eeb5Syz155240 /* as well. The entry to copy out is taken from the value of "ips_next" in */ 569ab25eeb5Syz155240 /* the struct passed in and if not null and not found in the list of current*/ 570ab25eeb5Syz155240 /* state entries, the retrieval fails. */ 571ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 572f4b3ec61Sdh155122 int fr_stgetent(data, ifs) 573ab25eeb5Syz155240 caddr_t data; 574f4b3ec61Sdh155122 ipf_stack_t *ifs; 575ab25eeb5Syz155240 { 576ab25eeb5Syz155240 ipstate_t *is, *isn; 577ab25eeb5Syz155240 ipstate_save_t ips; 578ab25eeb5Syz155240 int error; 579ab25eeb5Syz155240 580ab25eeb5Syz155240 error = fr_inobj(data, &ips, IPFOBJ_STATESAVE); 581ab25eeb5Syz155240 if (error) 582ab25eeb5Syz155240 return EFAULT; 583ab25eeb5Syz155240 584ab25eeb5Syz155240 isn = ips.ips_next; 585ab25eeb5Syz155240 if (isn == NULL) { 586f4b3ec61Sdh155122 isn = ifs->ifs_ips_list; 587ab25eeb5Syz155240 if (isn == NULL) { 588ab25eeb5Syz155240 if (ips.ips_next == NULL) 589ab25eeb5Syz155240 return ENOENT; 590ab25eeb5Syz155240 return 0; 591ab25eeb5Syz155240 } 592ab25eeb5Syz155240 } else { 593ab25eeb5Syz155240 /* 594ab25eeb5Syz155240 * Make sure the pointer we're copying from exists in the 595ab25eeb5Syz155240 * current list of entries. Security precaution to prevent 596ab25eeb5Syz155240 * copying of random kernel data. 597ab25eeb5Syz155240 */ 598f4b3ec61Sdh155122 for (is = ifs->ifs_ips_list; is; is = is->is_next) 599ab25eeb5Syz155240 if (is == isn) 600ab25eeb5Syz155240 break; 601ab25eeb5Syz155240 if (!is) 602ab25eeb5Syz155240 return ESRCH; 603ab25eeb5Syz155240 } 604ab25eeb5Syz155240 ips.ips_next = isn->is_next; 605ab25eeb5Syz155240 bcopy((char *)isn, (char *)&ips.ips_is, sizeof(ips.ips_is)); 606ab25eeb5Syz155240 ips.ips_rule = isn->is_rule; 607ab25eeb5Syz155240 if (isn->is_rule != NULL) 608ab25eeb5Syz155240 bcopy((char *)isn->is_rule, (char *)&ips.ips_fr, 609ab25eeb5Syz155240 sizeof(ips.ips_fr)); 610ab25eeb5Syz155240 error = fr_outobj(data, &ips, IPFOBJ_STATESAVE); 611ab25eeb5Syz155240 if (error) 612ab25eeb5Syz155240 return EFAULT; 613ab25eeb5Syz155240 return 0; 614ab25eeb5Syz155240 } 615ab25eeb5Syz155240 616ab25eeb5Syz155240 617ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 618ab25eeb5Syz155240 /* Function: fr_stputent */ 619ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 == failure */ 620ab25eeb5Syz155240 /* Parameters: data(I) - pointer to state information struct */ 621ab25eeb5Syz155240 /* */ 622ab25eeb5Syz155240 /* This function implements the SIOCSTPUT ioctl: insert a state entry into */ 623ab25eeb5Syz155240 /* the state table. If the state info. includes a pointer to a filter rule */ 624ab25eeb5Syz155240 /* then also add in an orphaned rule (will not show up in any "ipfstat -io" */ 625ab25eeb5Syz155240 /* output. */ 626ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 627f4b3ec61Sdh155122 int fr_stputent(data, ifs) 628ab25eeb5Syz155240 caddr_t data; 629f4b3ec61Sdh155122 ipf_stack_t *ifs; 630ab25eeb5Syz155240 { 631ab25eeb5Syz155240 ipstate_t *is, *isn; 632ab25eeb5Syz155240 ipstate_save_t ips; 633ab25eeb5Syz155240 int error, i; 634ab25eeb5Syz155240 frentry_t *fr; 635ab25eeb5Syz155240 char *name; 636ab25eeb5Syz155240 637ab25eeb5Syz155240 error = fr_inobj(data, &ips, IPFOBJ_STATESAVE); 638ab25eeb5Syz155240 if (error) 639ab25eeb5Syz155240 return EFAULT; 640ab25eeb5Syz155240 641ab25eeb5Syz155240 KMALLOC(isn, ipstate_t *); 642ab25eeb5Syz155240 if (isn == NULL) 643ab25eeb5Syz155240 return ENOMEM; 644ab25eeb5Syz155240 645ab25eeb5Syz155240 bcopy((char *)&ips.ips_is, (char *)isn, sizeof(*isn)); 646ab25eeb5Syz155240 bzero((char *)isn, offsetof(struct ipstate, is_pkts)); 647ab25eeb5Syz155240 isn->is_sti.tqe_pnext = NULL; 648ab25eeb5Syz155240 isn->is_sti.tqe_next = NULL; 649ab25eeb5Syz155240 isn->is_sti.tqe_ifq = NULL; 650ab25eeb5Syz155240 isn->is_sti.tqe_parent = isn; 651ab25eeb5Syz155240 isn->is_ifp[0] = NULL; 652ab25eeb5Syz155240 isn->is_ifp[1] = NULL; 653ab25eeb5Syz155240 isn->is_ifp[2] = NULL; 654ab25eeb5Syz155240 isn->is_ifp[3] = NULL; 655ab25eeb5Syz155240 isn->is_sync = NULL; 656ab25eeb5Syz155240 fr = ips.ips_rule; 657ab25eeb5Syz155240 658ab25eeb5Syz155240 if (fr == NULL) { 659f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 660f4b3ec61Sdh155122 fr_stinsert(isn, 0, ifs); 661ab25eeb5Syz155240 MUTEX_EXIT(&isn->is_lock); 662f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 663ab25eeb5Syz155240 return 0; 664ab25eeb5Syz155240 } 665ab25eeb5Syz155240 666ab25eeb5Syz155240 if (isn->is_flags & SI_NEWFR) { 667ab25eeb5Syz155240 KMALLOC(fr, frentry_t *); 668ab25eeb5Syz155240 if (fr == NULL) { 669ab25eeb5Syz155240 KFREE(isn); 670ab25eeb5Syz155240 return ENOMEM; 671ab25eeb5Syz155240 } 672ab25eeb5Syz155240 bcopy((char *)&ips.ips_fr, (char *)fr, sizeof(*fr)); 673ab25eeb5Syz155240 isn->is_rule = fr; 674ab25eeb5Syz155240 ips.ips_is.is_rule = fr; 675ab25eeb5Syz155240 MUTEX_NUKE(&fr->fr_lock); 676ab25eeb5Syz155240 MUTEX_INIT(&fr->fr_lock, "state filter rule lock"); 677ab25eeb5Syz155240 678ab25eeb5Syz155240 /* 679ab25eeb5Syz155240 * Look up all the interface names in the rule. 680ab25eeb5Syz155240 */ 681ab25eeb5Syz155240 for (i = 0; i < 4; i++) { 682ab25eeb5Syz155240 name = fr->fr_ifnames[i]; 683f4b3ec61Sdh155122 fr->fr_ifas[i] = fr_resolvenic(name, fr->fr_v, ifs); 684ab25eeb5Syz155240 name = isn->is_ifname[i]; 685f4b3ec61Sdh155122 isn->is_ifp[i] = fr_resolvenic(name, isn->is_v, ifs); 686ab25eeb5Syz155240 } 687ab25eeb5Syz155240 688ab25eeb5Syz155240 fr->fr_ref = 0; 689ab25eeb5Syz155240 fr->fr_dsize = 0; 690ab25eeb5Syz155240 fr->fr_data = NULL; 691ab25eeb5Syz155240 692f4b3ec61Sdh155122 fr_resolvedest(&fr->fr_tif, fr->fr_v, ifs); 693f4b3ec61Sdh155122 fr_resolvedest(&fr->fr_dif, fr->fr_v, ifs); 694d3675867Sjojemann fr_resolvedest(&fr->fr_rif, fr->fr_v, ifs); 695ab25eeb5Syz155240 696ab25eeb5Syz155240 /* 697ab25eeb5Syz155240 * send a copy back to userland of what we ended up 698ab25eeb5Syz155240 * to allow for verification. 699ab25eeb5Syz155240 */ 700ab25eeb5Syz155240 error = fr_outobj(data, &ips, IPFOBJ_STATESAVE); 701ab25eeb5Syz155240 if (error) { 702ab25eeb5Syz155240 KFREE(isn); 703ab25eeb5Syz155240 MUTEX_DESTROY(&fr->fr_lock); 704ab25eeb5Syz155240 KFREE(fr); 705ab25eeb5Syz155240 return EFAULT; 706ab25eeb5Syz155240 } 707f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 708f4b3ec61Sdh155122 fr_stinsert(isn, 0, ifs); 709ab25eeb5Syz155240 MUTEX_EXIT(&isn->is_lock); 710f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 711ab25eeb5Syz155240 712ab25eeb5Syz155240 } else { 713f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 714f4b3ec61Sdh155122 for (is = ifs->ifs_ips_list; is; is = is->is_next) 715ab25eeb5Syz155240 if (is->is_rule == fr) { 716f4b3ec61Sdh155122 fr_stinsert(isn, 0, ifs); 717ab25eeb5Syz155240 MUTEX_EXIT(&isn->is_lock); 718ab25eeb5Syz155240 break; 719ab25eeb5Syz155240 } 720ab25eeb5Syz155240 721ab25eeb5Syz155240 if (is == NULL) { 722ab25eeb5Syz155240 KFREE(isn); 723ab25eeb5Syz155240 isn = NULL; 724ab25eeb5Syz155240 } 725f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 726ab25eeb5Syz155240 727ab25eeb5Syz155240 return (isn == NULL) ? ESRCH : 0; 728ab25eeb5Syz155240 } 729ab25eeb5Syz155240 730ab25eeb5Syz155240 return 0; 731ab25eeb5Syz155240 } 732ab25eeb5Syz155240 733ab25eeb5Syz155240 734ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 735ab25eeb5Syz155240 /* Function: fr_stinsert */ 736ab25eeb5Syz155240 /* Returns: Nil */ 737ab25eeb5Syz155240 /* Parameters: is(I) - pointer to state structure */ 738ab25eeb5Syz155240 /* rev(I) - flag indicating forward/reverse direction of packet */ 739ab25eeb5Syz155240 /* */ 740ab25eeb5Syz155240 /* Inserts a state structure into the hash table (for lookups) and the list */ 741ab25eeb5Syz155240 /* of state entries (for enumeration). Resolves all of the interface names */ 742ab25eeb5Syz155240 /* to pointers and adjusts running stats for the hash table as appropriate. */ 743ab25eeb5Syz155240 /* */ 744ab25eeb5Syz155240 /* Locking: it is assumed that some kind of lock on ipf_state is held. */ 745ab25eeb5Syz155240 /* Exits with is_lock initialised and held. */ 746ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 747f4b3ec61Sdh155122 void fr_stinsert(is, rev, ifs) 748ab25eeb5Syz155240 ipstate_t *is; 749ab25eeb5Syz155240 int rev; 750f4b3ec61Sdh155122 ipf_stack_t *ifs; 751ab25eeb5Syz155240 { 752ab25eeb5Syz155240 frentry_t *fr; 753ab25eeb5Syz155240 u_int hv; 754ab25eeb5Syz155240 int i; 755ab25eeb5Syz155240 756ab25eeb5Syz155240 MUTEX_INIT(&is->is_lock, "ipf state entry"); 757ab25eeb5Syz155240 758ab25eeb5Syz155240 fr = is->is_rule; 759ab25eeb5Syz155240 if (fr != NULL) { 760ab25eeb5Syz155240 MUTEX_ENTER(&fr->fr_lock); 761ab25eeb5Syz155240 fr->fr_ref++; 762ab25eeb5Syz155240 fr->fr_statecnt++; 763ab25eeb5Syz155240 MUTEX_EXIT(&fr->fr_lock); 764ab25eeb5Syz155240 } 765ab25eeb5Syz155240 766ab25eeb5Syz155240 /* 767ab25eeb5Syz155240 * Look up all the interface names in the state entry. 768ab25eeb5Syz155240 */ 769ab25eeb5Syz155240 for (i = 0; i < 4; i++) { 770ab25eeb5Syz155240 if (is->is_ifp[i] != NULL) 771ab25eeb5Syz155240 continue; 772f4b3ec61Sdh155122 is->is_ifp[i] = fr_resolvenic(is->is_ifname[i], is->is_v, ifs); 773ab25eeb5Syz155240 } 774ab25eeb5Syz155240 775ab25eeb5Syz155240 /* 776ab25eeb5Syz155240 * If we could trust is_hv, then the modulous would not be needed, but 777ab25eeb5Syz155240 * when running with IPFILTER_SYNC, this stops bad values. 778ab25eeb5Syz155240 */ 779f4b3ec61Sdh155122 hv = is->is_hv % ifs->ifs_fr_statesize; 780ab25eeb5Syz155240 is->is_hv = hv; 781ab25eeb5Syz155240 782ab25eeb5Syz155240 /* 783ab25eeb5Syz155240 * We need to get both of these locks...the first because it is 784ab25eeb5Syz155240 * possible that once the insert is complete another packet might 785ab25eeb5Syz155240 * come along, match the entry and want to update it. 786ab25eeb5Syz155240 */ 787ab25eeb5Syz155240 MUTEX_ENTER(&is->is_lock); 788f4b3ec61Sdh155122 MUTEX_ENTER(&ifs->ifs_ipf_stinsert); 789ab25eeb5Syz155240 790ab25eeb5Syz155240 /* 791ab25eeb5Syz155240 * add into list table. 792ab25eeb5Syz155240 */ 793f4b3ec61Sdh155122 if (ifs->ifs_ips_list != NULL) 794f4b3ec61Sdh155122 ifs->ifs_ips_list->is_pnext = &is->is_next; 795f4b3ec61Sdh155122 is->is_pnext = &ifs->ifs_ips_list; 796f4b3ec61Sdh155122 is->is_next = ifs->ifs_ips_list; 797f4b3ec61Sdh155122 ifs->ifs_ips_list = is; 798ab25eeb5Syz155240 799f4b3ec61Sdh155122 if (ifs->ifs_ips_table[hv] != NULL) 800f4b3ec61Sdh155122 ifs->ifs_ips_table[hv]->is_phnext = &is->is_hnext; 801ab25eeb5Syz155240 else 802f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_inuse++; 803f4b3ec61Sdh155122 is->is_phnext = ifs->ifs_ips_table + hv; 804f4b3ec61Sdh155122 is->is_hnext = ifs->ifs_ips_table[hv]; 805f4b3ec61Sdh155122 ifs->ifs_ips_table[hv] = is; 806f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_bucketlen[hv]++; 807f4b3ec61Sdh155122 ifs->ifs_ips_num++; 808f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_stinsert); 809ab25eeb5Syz155240 810f4b3ec61Sdh155122 fr_setstatequeue(is, rev, ifs); 811ab25eeb5Syz155240 } 812ab25eeb5Syz155240 813*52239d04San207044 /* ------------------------------------------------------------------------ */ 814*52239d04San207044 /* Function: fr_match_ipv4addrs */ 815*52239d04San207044 /* Returns: int - 2 strong match (same addresses, same direction) */ 816*52239d04San207044 /* 1 weak match (same address, opposite direction) */ 817*52239d04San207044 /* 0 no match */ 818*52239d04San207044 /* */ 819*52239d04San207044 /* Function matches IPv4 addresses. */ 820*52239d04San207044 /* ------------------------------------------------------------------------ */ 821*52239d04San207044 static int fr_match_ipv4addrs(is1, is2) 822*52239d04San207044 ipstate_t *is1; 823*52239d04San207044 ipstate_t *is2; 824*52239d04San207044 { 825*52239d04San207044 int rv; 826*52239d04San207044 827*52239d04San207044 if (is1->is_saddr == is2->is_saddr && is1->is_daddr == is2->is_daddr) 828*52239d04San207044 rv = 2; 829*52239d04San207044 else if (is1->is_saddr == is2->is_daddr && 830*52239d04San207044 is1->is_daddr == is2->is_saddr) 831*52239d04San207044 rv = 1; 832*52239d04San207044 else 833*52239d04San207044 rv = 0; 834*52239d04San207044 835*52239d04San207044 return (rv); 836*52239d04San207044 } 837*52239d04San207044 838*52239d04San207044 /* ------------------------------------------------------------------------ */ 839*52239d04San207044 /* Function: fr_match_ipv6addrs */ 840*52239d04San207044 /* Returns: int - 2 strong match (same addresses, same direction) */ 841*52239d04San207044 /* 1 weak match (same addresses, opposite direction) */ 842*52239d04San207044 /* 0 no match */ 843*52239d04San207044 /* */ 844*52239d04San207044 /* Function matches IPv6 addresses. */ 845*52239d04San207044 /* ------------------------------------------------------------------------ */ 846*52239d04San207044 static int fr_match_ipv6addrs(is1, is2) 847*52239d04San207044 ipstate_t *is1; 848*52239d04San207044 ipstate_t *is2; 849*52239d04San207044 { 850*52239d04San207044 int rv; 851*52239d04San207044 852*52239d04San207044 if (IP6_EQ(&is1->is_src, &is2->is_src) && 853*52239d04San207044 IP6_EQ(&is1->is_dst, &is2->is_dst)) 854*52239d04San207044 rv = 2; 855*52239d04San207044 else if (IP6_EQ(&is1->is_src, &is2->is_dst) && 856*52239d04San207044 IP6_EQ(&is1->is_dst, &is2->is_src)) { 857*52239d04San207044 rv = 1; 858*52239d04San207044 } 859*52239d04San207044 else 860*52239d04San207044 rv = 0; 861*52239d04San207044 862*52239d04San207044 return (rv); 863*52239d04San207044 } 864*52239d04San207044 /* ------------------------------------------------------------------------ */ 865*52239d04San207044 /* Function: fr_match_addresses */ 866*52239d04San207044 /* Returns: int - 2 strong match (same addresses, same direction) */ 867*52239d04San207044 /* 1 weak match (same address, opposite directions) */ 868*52239d04San207044 /* 0 no match */ 869*52239d04San207044 /* Parameters: is1, is2 pointers to states we are checking */ 870*52239d04San207044 /* */ 871*52239d04San207044 /* Matches addresses, function uses fr_match_ipvXaddrs() to deal with IPv4 */ 872*52239d04San207044 /* and IPv6 address format. */ 873*52239d04San207044 /* ------------------------------------------------------------------------ */ 874*52239d04San207044 static int fr_match_addresses(is1, is2) 875*52239d04San207044 ipstate_t *is1; 876*52239d04San207044 ipstate_t *is2; 877*52239d04San207044 { 878*52239d04San207044 int rv; 879*52239d04San207044 880*52239d04San207044 if (is1->is_v == 4) { 881*52239d04San207044 rv = fr_match_ipv4addrs(is1, is2); 882*52239d04San207044 } 883*52239d04San207044 else { 884*52239d04San207044 rv = fr_match_ipv6addrs(is1, is2); 885*52239d04San207044 } 886*52239d04San207044 887*52239d04San207044 return (rv); 888*52239d04San207044 } 889*52239d04San207044 890*52239d04San207044 /* ------------------------------------------------------------------------ */ 891*52239d04San207044 /* Function: fr_match_ppairs */ 892*52239d04San207044 /* Returns: int - 2 strong match (same ports, same direction) */ 893*52239d04San207044 /* 1 weak match (same ports, different direction) */ 894*52239d04San207044 /* 0 no match */ 895*52239d04San207044 /* Parameters ppairs1, ppairs - src, dst ports we want to match. */ 896*52239d04San207044 /* */ 897*52239d04San207044 /* Matches two port_pair_t types (port pairs). Each port pair contains */ 898*52239d04San207044 /* src, dst port, which belong to session (state entry). */ 899*52239d04San207044 /* ------------------------------------------------------------------------ */ 900*52239d04San207044 static int fr_match_ppairs(ppairs1, ppairs2) 901*52239d04San207044 port_pair_t *ppairs1; 902*52239d04San207044 port_pair_t *ppairs2; 903*52239d04San207044 { 904*52239d04San207044 int rv; 905*52239d04San207044 906*52239d04San207044 if (ppairs1->pp_sport == ppairs2->pp_sport && 907*52239d04San207044 ppairs1->pp_dport == ppairs2->pp_dport) 908*52239d04San207044 rv = 2; 909*52239d04San207044 else if (ppairs1->pp_sport == ppairs2->pp_dport && 910*52239d04San207044 ppairs1->pp_dport == ppairs2->pp_sport) 911*52239d04San207044 rv = 1; 912*52239d04San207044 else 913*52239d04San207044 rv = 0; 914*52239d04San207044 915*52239d04San207044 return (rv); 916*52239d04San207044 } 917*52239d04San207044 918*52239d04San207044 /* ------------------------------------------------------------------------ */ 919*52239d04San207044 /* Function: fr_match_l4_hdr */ 920*52239d04San207044 /* Returns: int - 0 no match, */ 921*52239d04San207044 /* 1 weak match (same ports, different directions) */ 922*52239d04San207044 /* 2 strong match (same ports, same direction) */ 923*52239d04San207044 /* Parameters is1, is2 - states we want to match */ 924*52239d04San207044 /* */ 925*52239d04San207044 /* Function matches L4 header data (source ports for TCP, UDP, CallIds for */ 926*52239d04San207044 /* GRE protocol). */ 927*52239d04San207044 /* ------------------------------------------------------------------------ */ 928*52239d04San207044 static int fr_match_l4_hdr(is1, is2) 929*52239d04San207044 ipstate_t *is1; 930*52239d04San207044 ipstate_t *is2; 931*52239d04San207044 { 932*52239d04San207044 int rv = 0; 933*52239d04San207044 port_pair_t pp1; 934*52239d04San207044 port_pair_t pp2; 935*52239d04San207044 936*52239d04San207044 if (is1->is_p != is2->is_p) 937*52239d04San207044 return (0); 938*52239d04San207044 939*52239d04San207044 switch (is1->is_p) { 940*52239d04San207044 case IPPROTO_TCP: 941*52239d04San207044 pp1.pp_sport = is1->is_ps.is_ts.ts_sport; 942*52239d04San207044 pp1.pp_dport = is1->is_ps.is_ts.ts_dport; 943*52239d04San207044 pp2.pp_sport = is2->is_ps.is_ts.ts_sport; 944*52239d04San207044 pp2.pp_dport = is2->is_ps.is_ts.ts_dport; 945*52239d04San207044 rv = fr_match_ppairs(&pp1, &pp2); 946*52239d04San207044 break; 947*52239d04San207044 case IPPROTO_UDP: 948*52239d04San207044 pp1.pp_sport = is1->is_ps.is_us.us_sport; 949*52239d04San207044 pp1.pp_dport = is1->is_ps.is_us.us_dport; 950*52239d04San207044 pp2.pp_sport = is2->is_ps.is_us.us_sport; 951*52239d04San207044 pp2.pp_dport = is2->is_ps.is_us.us_dport; 952*52239d04San207044 rv = fr_match_ppairs(&pp1, &pp2); 953*52239d04San207044 break; 954*52239d04San207044 case IPPROTO_GRE: 955*52239d04San207044 /* greinfo_t can be also interprted as port pair */ 956*52239d04San207044 pp1.pp_sport = is1->is_ps.is_ug.gs_call[0]; 957*52239d04San207044 pp1.pp_dport = is1->is_ps.is_ug.gs_call[1]; 958*52239d04San207044 pp2.pp_sport = is2->is_ps.is_ug.gs_call[0]; 959*52239d04San207044 pp2.pp_dport = is2->is_ps.is_ug.gs_call[1]; 960*52239d04San207044 rv = fr_match_ppairs(&pp1, &pp2); 961*52239d04San207044 break; 962*52239d04San207044 case IPPROTO_ICMP: 963*52239d04San207044 case IPPROTO_ICMPV6: 964*52239d04San207044 if (bcmp(&is1->is_ps, &is2->is_ps, sizeof(icmpinfo_t))) 965*52239d04San207044 rv = 1; 966*52239d04San207044 else 967*52239d04San207044 rv = 0; 968*52239d04San207044 break; 969*52239d04San207044 default: 970*52239d04San207044 rv = 0; 971*52239d04San207044 } 972*52239d04San207044 973*52239d04San207044 return (rv); 974*52239d04San207044 } 975*52239d04San207044 976*52239d04San207044 /* ------------------------------------------------------------------------ */ 977*52239d04San207044 /* Function: fr_matchstates */ 978*52239d04San207044 /* Returns: int - nonzero match, zero no match */ 979*52239d04San207044 /* Parameters is1, is2 - states we want to match */ 980*52239d04San207044 /* */ 981*52239d04San207044 /* The state entries are equal (identical match) if they belong to the same */ 982*52239d04San207044 /* session. Any time new state entry is being added the fr_addstate() */ 983*52239d04San207044 /* function creates temporal state entry from the data it gets from IP and */ 984*52239d04San207044 /* L4 header. The fr_matchstats() must be also aware of packet direction, */ 985*52239d04San207044 /* which is also stored within the state entry. We should keep in mind the */ 986*52239d04San207044 /* information about packet direction is spread accross L3 (addresses) and */ 987*52239d04San207044 /* L4 (ports). There are three possible relationships betwee is1, is2: */ 988*52239d04San207044 /* - no match (match(is1, is2) == 0)) */ 989*52239d04San207044 /* - weak match same addresses (ports), but different */ 990*52239d04San207044 /* directions (1) (fr_match_xxxx(is1, is2) == 1) */ 991*52239d04San207044 /* - strong match same addresses (ports) and same directions */ 992*52239d04San207044 /* (2) (fr_match_xxxx(is1, is2) == 2) */ 993*52239d04San207044 /* */ 994*52239d04San207044 /* There are functions, which match match addresses (L3 header) in is1, is2 */ 995*52239d04San207044 /* and functions, which are used to compare ports (L4 header) data. We say */ 996*52239d04San207044 /* the is1 and is2 are same (identical) if there is a match */ 997*52239d04San207044 /* (fr_match_l4_hdr(is1, is2) != 0) and matchlevels are same for entries */ 998*52239d04San207044 /* (fr_match_l3_hdr(is1, is2) == fr_match_l4_hdr(is1, is2)) for is1, is2. */ 999*52239d04San207044 /* Such requirement deals with case as follows: */ 1000*52239d04San207044 /* suppose there are two connections between hosts A, B. Connection 1: */ 1001*52239d04San207044 /* a.a.a.a:12345 <=> b.b.b.b:54321 */ 1002*52239d04San207044 /* Connection 2: */ 1003*52239d04San207044 /* a.a.a.a:54321 <=> b.b.b.b:12345 */ 1004*52239d04San207044 /* since we've introduced match levels into our fr_matchstates(), we are */ 1005*52239d04San207044 /* able to identify, which packets belong to connection A and which belong */ 1006*52239d04San207044 /* to connection B. Assume there are two entries is1, is2. is1 has been */ 1007*52239d04San207044 /* from con. 1 packet, which travelled from A to B: */ 1008*52239d04San207044 /* a.a.a.a:12345 -> b.b.b.b:54321 */ 1009*52239d04San207044 /* while s2, has been created from packet which belongs to con. 2 and is */ 1010*52239d04San207044 /* also coming from A to B: */ 1011*52239d04San207044 /* a.a.a.a:54321 -> b.b.b.b:12345 */ 1012*52239d04San207044 /* fr_match_l3_hdr(is1, is2) == 2 -> strong match, while */ 1013*52239d04San207044 /* fr_match_l4_hdr(is1, is2) == 1 -> weak match. Since match levels are */ 1014*52239d04San207044 /* different the state entries are not identical -> no match as a final */ 1015*52239d04San207044 /* result. */ 1016*52239d04San207044 /* ------------------------------------------------------------------------ */ 1017*52239d04San207044 static int fr_matchstates(is1, is2) 1018*52239d04San207044 ipstate_t *is1; 1019*52239d04San207044 ipstate_t *is2; 1020*52239d04San207044 { 1021*52239d04San207044 int rv; 1022*52239d04San207044 int amatch; 1023*52239d04San207044 int pmatch; 1024*52239d04San207044 1025*52239d04San207044 if (bcmp(&is1->is_pass, &is2->is_pass, 1026*52239d04San207044 offsetof(struct ipstate, is_ps) - 1027*52239d04San207044 offsetof(struct ipstate, is_pass)) == 0) { 1028*52239d04San207044 1029*52239d04San207044 pmatch = fr_match_l4_hdr(is1, is2); 1030*52239d04San207044 amatch = fr_match_addresses(is1, is2); 1031*52239d04San207044 /* 1032*52239d04San207044 * If addresses match (amatch != 0), then 'match levels' 1033*52239d04San207044 * must be same for matching entries. If amatch and pmatch 1034*52239d04San207044 * have different values (different match levels), then 1035*52239d04San207044 * is1 and is2 belong to different sessions. 1036*52239d04San207044 */ 1037*52239d04San207044 rv = (amatch != 0) && (amatch == pmatch); 1038*52239d04San207044 } 1039*52239d04San207044 else 1040*52239d04San207044 rv = 0; 1041*52239d04San207044 1042*52239d04San207044 return (rv); 1043*52239d04San207044 } 1044ab25eeb5Syz155240 1045ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1046ab25eeb5Syz155240 /* Function: fr_addstate */ 1047ab25eeb5Syz155240 /* Returns: ipstate_t* - NULL == failure, else pointer to new state */ 1048ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 1049ab25eeb5Syz155240 /* stsave(O) - pointer to place to save pointer to created */ 1050ab25eeb5Syz155240 /* state structure. */ 1051ab25eeb5Syz155240 /* flags(I) - flags to use when creating the structure */ 1052ab25eeb5Syz155240 /* */ 1053ab25eeb5Syz155240 /* Creates a new IP state structure from the packet information collected. */ 1054ab25eeb5Syz155240 /* Inserts it into the state table and appends to the bottom of the active */ 1055ab25eeb5Syz155240 /* list. If the capacity of the table has reached the maximum allowed then */ 1056ab25eeb5Syz155240 /* the call will fail and a flush is scheduled for the next timeout call. */ 1057ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1058ab25eeb5Syz155240 ipstate_t *fr_addstate(fin, stsave, flags) 1059ab25eeb5Syz155240 fr_info_t *fin; 1060ab25eeb5Syz155240 ipstate_t **stsave; 1061ab25eeb5Syz155240 u_int flags; 1062ab25eeb5Syz155240 { 1063ab25eeb5Syz155240 ipstate_t *is, ips; 1064ab25eeb5Syz155240 struct icmp *ic; 1065ab25eeb5Syz155240 u_int pass, hv; 1066ab25eeb5Syz155240 frentry_t *fr; 1067ab25eeb5Syz155240 tcphdr_t *tcp; 1068ab25eeb5Syz155240 grehdr_t *gre; 1069ab25eeb5Syz155240 void *ifp; 1070ab25eeb5Syz155240 int out; 1071f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 1072ab25eeb5Syz155240 1073f4b3ec61Sdh155122 if (ifs->ifs_fr_state_lock || 1074ab25eeb5Syz155240 (fin->fin_flx & (FI_SHORT|FI_STATE|FI_FRAGBODY|FI_BAD))) 1075ab25eeb5Syz155240 return NULL; 1076ab25eeb5Syz155240 1077ab25eeb5Syz155240 if ((fin->fin_flx & FI_OOW) && !(fin->fin_tcpf & TH_SYN)) 1078ab25eeb5Syz155240 return NULL; 1079ab25eeb5Syz155240 108020a07c48Sjojemann /* 108120a07c48Sjojemann * If a "keep state" rule has reached the maximum number of references 108220a07c48Sjojemann * to it, then schedule an automatic flush in case we can clear out 108320a07c48Sjojemann * some "dead old wood". Note that because the lock isn't held on 108420a07c48Sjojemann * fr it is possible that we could overflow. The cost of overflowing 108520a07c48Sjojemann * is being ignored here as the number by which it can overflow is 108620a07c48Sjojemann * a product of the number of simultaneous threads that could be 108720a07c48Sjojemann * executing in here, so a limit of 100 won't result in 200, but could 108820a07c48Sjojemann * result in 101 or 102. 108920a07c48Sjojemann */ 1090ab25eeb5Syz155240 fr = fin->fin_fr; 109120a07c48Sjojemann if (fr != NULL) { 1092f4b3ec61Sdh155122 if ((ifs->ifs_ips_num == ifs->ifs_fr_statemax) && (fr->fr_statemax == 0)) { 1093f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_max); 1094f4b3ec61Sdh155122 ifs->ifs_fr_state_doflush = 1; 1095ab25eeb5Syz155240 return NULL; 1096ab25eeb5Syz155240 } 109720a07c48Sjojemann if ((fr->fr_statemax != 0) && 1098ab25eeb5Syz155240 (fr->fr_statecnt >= fr->fr_statemax)) { 1099f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_maxref); 1100f4b3ec61Sdh155122 ifs->ifs_fr_state_doflush = 1; 1101ab25eeb5Syz155240 return NULL; 1102ab25eeb5Syz155240 } 110320a07c48Sjojemann } 1104ab25eeb5Syz155240 1105ab25eeb5Syz155240 ic = NULL; 1106ab25eeb5Syz155240 tcp = NULL; 1107ab25eeb5Syz155240 out = fin->fin_out; 1108ab25eeb5Syz155240 is = &ips; 1109ab25eeb5Syz155240 bzero((char *)is, sizeof(*is)); 1110*52239d04San207044 1111*52239d04San207044 if (fr == NULL) { 1112*52239d04San207044 pass = ifs->ifs_fr_flags; 1113*52239d04San207044 is->is_tag = FR_NOLOGTAG; 1114*52239d04San207044 } 1115*52239d04San207044 else { 1116*52239d04San207044 pass = fr->fr_flags; 1117*52239d04San207044 } 1118*52239d04San207044 1119f4b3ec61Sdh155122 is->is_die = 1 + ifs->ifs_fr_ticks; 1120*52239d04San207044 /* 1121*52239d04San207044 * We want to check everything that is a property of this packet, 1122*52239d04San207044 * but we don't (automatically) care about it's fragment status as 1123*52239d04San207044 * this may change. 1124*52239d04San207044 */ 1125*52239d04San207044 is->is_pass = pass; 1126*52239d04San207044 is->is_v = fin->fin_v; 1127*52239d04San207044 is->is_opt[0] = fin->fin_optmsk; 1128*52239d04San207044 is->is_optmsk[0] = 0xffffffff; 1129*52239d04San207044 is->is_optmsk[1] = 0xffffffff; 1130*52239d04San207044 if (is->is_v == 6) { 1131*52239d04San207044 is->is_opt[0] &= ~0x8; 1132*52239d04San207044 is->is_optmsk[0] &= ~0x8; 1133*52239d04San207044 is->is_optmsk[1] &= ~0x8; 1134*52239d04San207044 } 1135*52239d04San207044 is->is_sec = fin->fin_secmsk; 1136*52239d04San207044 is->is_secmsk = 0xffff; 1137*52239d04San207044 is->is_auth = fin->fin_auth; 1138*52239d04San207044 is->is_authmsk = 0xffff; 1139ab25eeb5Syz155240 1140ab25eeb5Syz155240 /* 1141ab25eeb5Syz155240 * Copy and calculate... 1142ab25eeb5Syz155240 */ 1143ab25eeb5Syz155240 hv = (is->is_p = fin->fin_fi.fi_p); 1144ab25eeb5Syz155240 is->is_src = fin->fin_fi.fi_src; 1145ab25eeb5Syz155240 hv += is->is_saddr; 1146ab25eeb5Syz155240 is->is_dst = fin->fin_fi.fi_dst; 1147ab25eeb5Syz155240 hv += is->is_daddr; 1148ab25eeb5Syz155240 #ifdef USE_INET6 1149ab25eeb5Syz155240 if (fin->fin_v == 6) { 1150ab25eeb5Syz155240 /* 1151ab25eeb5Syz155240 * For ICMPv6, we check to see if the destination address is 1152ab25eeb5Syz155240 * a multicast address. If it is, do not include it in the 1153ab25eeb5Syz155240 * calculation of the hash because the correct reply will come 1154ab25eeb5Syz155240 * back from a real address, not a multicast address. 1155ab25eeb5Syz155240 */ 1156ab25eeb5Syz155240 if ((is->is_p == IPPROTO_ICMPV6) && 1157ab25eeb5Syz155240 IN6_IS_ADDR_MULTICAST(&is->is_dst.in6)) { 1158ab25eeb5Syz155240 /* 1159ab25eeb5Syz155240 * So you can do keep state with neighbour discovery. 1160ab25eeb5Syz155240 * 1161ab25eeb5Syz155240 * Here we could use the address from the neighbour 1162ab25eeb5Syz155240 * solicit message to put in the state structure and 1163ab25eeb5Syz155240 * we could use that without a wildcard flag too... 1164ab25eeb5Syz155240 */ 1165ab25eeb5Syz155240 is->is_flags |= SI_W_DADDR; 1166ab25eeb5Syz155240 hv -= is->is_daddr; 1167ab25eeb5Syz155240 } else { 1168ab25eeb5Syz155240 hv += is->is_dst.i6[1]; 1169ab25eeb5Syz155240 hv += is->is_dst.i6[2]; 1170ab25eeb5Syz155240 hv += is->is_dst.i6[3]; 1171ab25eeb5Syz155240 } 1172ab25eeb5Syz155240 hv += is->is_src.i6[1]; 1173ab25eeb5Syz155240 hv += is->is_src.i6[2]; 1174ab25eeb5Syz155240 hv += is->is_src.i6[3]; 1175ab25eeb5Syz155240 } 1176ab25eeb5Syz155240 #endif 1177ab25eeb5Syz155240 1178ab25eeb5Syz155240 switch (is->is_p) 1179ab25eeb5Syz155240 { 1180ab25eeb5Syz155240 #ifdef USE_INET6 1181ab25eeb5Syz155240 case IPPROTO_ICMPV6 : 1182ab25eeb5Syz155240 ic = fin->fin_dp; 1183ab25eeb5Syz155240 1184ab25eeb5Syz155240 switch (ic->icmp_type) 1185ab25eeb5Syz155240 { 1186ab25eeb5Syz155240 case ICMP6_ECHO_REQUEST : 1187ab25eeb5Syz155240 is->is_icmp.ici_type = ic->icmp_type; 1188ab25eeb5Syz155240 hv += (is->is_icmp.ici_id = ic->icmp_id); 1189ab25eeb5Syz155240 break; 1190ab25eeb5Syz155240 case ICMP6_MEMBERSHIP_QUERY : 1191ab25eeb5Syz155240 case ND_ROUTER_SOLICIT : 1192ab25eeb5Syz155240 case ND_NEIGHBOR_SOLICIT : 1193ab25eeb5Syz155240 case ICMP6_NI_QUERY : 1194ab25eeb5Syz155240 is->is_icmp.ici_type = ic->icmp_type; 1195ab25eeb5Syz155240 break; 1196ab25eeb5Syz155240 default : 1197ab25eeb5Syz155240 return NULL; 1198ab25eeb5Syz155240 } 1199f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_icmp); 1200ab25eeb5Syz155240 break; 1201ab25eeb5Syz155240 #endif 1202ab25eeb5Syz155240 case IPPROTO_ICMP : 1203ab25eeb5Syz155240 ic = fin->fin_dp; 1204ab25eeb5Syz155240 1205ab25eeb5Syz155240 switch (ic->icmp_type) 1206ab25eeb5Syz155240 { 1207ab25eeb5Syz155240 case ICMP_ECHO : 1208ab25eeb5Syz155240 case ICMP_TSTAMP : 1209ab25eeb5Syz155240 case ICMP_IREQ : 1210ab25eeb5Syz155240 case ICMP_MASKREQ : 1211ab25eeb5Syz155240 is->is_icmp.ici_type = ic->icmp_type; 1212ab25eeb5Syz155240 hv += (is->is_icmp.ici_id = ic->icmp_id); 1213ab25eeb5Syz155240 break; 1214ab25eeb5Syz155240 default : 1215ab25eeb5Syz155240 return NULL; 1216ab25eeb5Syz155240 } 1217f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_icmp); 1218ab25eeb5Syz155240 break; 1219ab25eeb5Syz155240 1220ab25eeb5Syz155240 case IPPROTO_GRE : 1221ab25eeb5Syz155240 gre = fin->fin_dp; 1222ab25eeb5Syz155240 1223ab25eeb5Syz155240 is->is_gre.gs_flags = gre->gr_flags; 1224ab25eeb5Syz155240 is->is_gre.gs_ptype = gre->gr_ptype; 1225ab25eeb5Syz155240 if (GRE_REV(is->is_gre.gs_flags) == 1) { 1226ab25eeb5Syz155240 is->is_call[0] = fin->fin_data[0]; 1227ab25eeb5Syz155240 is->is_call[1] = fin->fin_data[1]; 1228ab25eeb5Syz155240 } 1229ab25eeb5Syz155240 break; 1230ab25eeb5Syz155240 1231ab25eeb5Syz155240 case IPPROTO_TCP : 1232ab25eeb5Syz155240 tcp = fin->fin_dp; 1233ab25eeb5Syz155240 1234ab25eeb5Syz155240 if (tcp->th_flags & TH_RST) 1235ab25eeb5Syz155240 return NULL; 1236ab25eeb5Syz155240 /* 1237ab25eeb5Syz155240 * The endian of the ports doesn't matter, but the ack and 1238ab25eeb5Syz155240 * sequence numbers do as we do mathematics on them later. 1239ab25eeb5Syz155240 */ 1240ab25eeb5Syz155240 is->is_sport = htons(fin->fin_data[0]); 1241ab25eeb5Syz155240 is->is_dport = htons(fin->fin_data[1]); 1242ab25eeb5Syz155240 if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) { 1243ab25eeb5Syz155240 hv += is->is_sport; 1244ab25eeb5Syz155240 hv += is->is_dport; 1245ab25eeb5Syz155240 } 1246ab25eeb5Syz155240 1247ab25eeb5Syz155240 /* 1248ab25eeb5Syz155240 * If this is a real packet then initialise fields in the 1249ab25eeb5Syz155240 * state information structure from the TCP header information. 1250ab25eeb5Syz155240 */ 1251ab25eeb5Syz155240 1252ab25eeb5Syz155240 is->is_maxdwin = 1; 1253ab25eeb5Syz155240 is->is_maxswin = ntohs(tcp->th_win); 1254ab25eeb5Syz155240 if (is->is_maxswin == 0) 1255ab25eeb5Syz155240 is->is_maxswin = 1; 1256ab25eeb5Syz155240 1257ab25eeb5Syz155240 if ((fin->fin_flx & FI_IGNORE) == 0) { 1258ab25eeb5Syz155240 is->is_send = ntohl(tcp->th_seq) + fin->fin_dlen - 1259ab25eeb5Syz155240 (TCP_OFF(tcp) << 2) + 1260ab25eeb5Syz155240 ((tcp->th_flags & TH_SYN) ? 1 : 0) + 1261ab25eeb5Syz155240 ((tcp->th_flags & TH_FIN) ? 1 : 0); 1262ab25eeb5Syz155240 is->is_maxsend = is->is_send; 1263ab25eeb5Syz155240 1264ab25eeb5Syz155240 /* 1265ab25eeb5Syz155240 * Window scale option is only present in 1266ab25eeb5Syz155240 * SYN/SYN-ACK packet. 1267ab25eeb5Syz155240 */ 1268ab25eeb5Syz155240 if ((tcp->th_flags & ~(TH_FIN|TH_ACK|TH_ECNALL)) == 1269ab25eeb5Syz155240 TH_SYN && 1270ab25eeb5Syz155240 (TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) { 1271ab25eeb5Syz155240 if (fr_tcpoptions(fin, tcp, 1272ab25eeb5Syz155240 &is->is_tcp.ts_data[0])) 1273ab25eeb5Syz155240 is->is_swinflags = TCP_WSCALE_SEEN| 1274ab25eeb5Syz155240 TCP_WSCALE_FIRST; 1275ab25eeb5Syz155240 } 1276ab25eeb5Syz155240 1277ab25eeb5Syz155240 if ((fin->fin_out != 0) && (pass & FR_NEWISN) != 0) { 1278ab25eeb5Syz155240 fr_checknewisn(fin, is); 1279ab25eeb5Syz155240 fr_fixoutisn(fin, is); 1280ab25eeb5Syz155240 } 1281ab25eeb5Syz155240 1282ab25eeb5Syz155240 if ((tcp->th_flags & TH_OPENING) == TH_SYN) 1283ab25eeb5Syz155240 flags |= IS_TCPFSM; 1284ab25eeb5Syz155240 else { 1285ab25eeb5Syz155240 is->is_maxdwin = is->is_maxswin * 2; 1286ab25eeb5Syz155240 is->is_dend = ntohl(tcp->th_ack); 1287ab25eeb5Syz155240 is->is_maxdend = ntohl(tcp->th_ack); 1288ab25eeb5Syz155240 is->is_maxdwin *= 2; 1289ab25eeb5Syz155240 } 1290ab25eeb5Syz155240 } 1291ab25eeb5Syz155240 1292ab25eeb5Syz155240 /* 1293ab25eeb5Syz155240 * If we're creating state for a starting connection, start the 1294ab25eeb5Syz155240 * timer on it as we'll never see an error if it fails to 1295ab25eeb5Syz155240 * connect. 1296ab25eeb5Syz155240 */ 1297f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_tcp); 1298ab25eeb5Syz155240 break; 1299ab25eeb5Syz155240 1300ab25eeb5Syz155240 case IPPROTO_UDP : 1301ab25eeb5Syz155240 tcp = fin->fin_dp; 1302ab25eeb5Syz155240 1303ab25eeb5Syz155240 is->is_sport = htons(fin->fin_data[0]); 1304ab25eeb5Syz155240 is->is_dport = htons(fin->fin_data[1]); 1305ab25eeb5Syz155240 if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) { 1306ab25eeb5Syz155240 hv += tcp->th_dport; 1307ab25eeb5Syz155240 hv += tcp->th_sport; 1308ab25eeb5Syz155240 } 1309f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_udp); 1310ab25eeb5Syz155240 break; 1311ab25eeb5Syz155240 1312ab25eeb5Syz155240 default : 1313ab25eeb5Syz155240 break; 1314ab25eeb5Syz155240 } 1315f4b3ec61Sdh155122 hv = DOUBLE_HASH(hv, ifs); 1316ab25eeb5Syz155240 is->is_hv = hv; 1317ab25eeb5Syz155240 is->is_rule = fr; 1318ab25eeb5Syz155240 is->is_flags = flags & IS_INHERITED; 1319ab25eeb5Syz155240 1320ab25eeb5Syz155240 /* 1321ab25eeb5Syz155240 * Look for identical state. 1322ab25eeb5Syz155240 */ 1323f4b3ec61Sdh155122 for (is = ifs->ifs_ips_table[is->is_hv % ifs->ifs_fr_statesize]; 1324f4b3ec61Sdh155122 is != NULL; 1325ab25eeb5Syz155240 is = is->is_hnext) { 1326*52239d04San207044 if (fr_matchstates(&ips, is) == 1) 1327ab25eeb5Syz155240 break; 1328ab25eeb5Syz155240 } 1329*52239d04San207044 1330*52239d04San207044 /* 1331*52239d04San207044 * we've found a matching state -> state already exists, 1332*52239d04San207044 * we are not going to add a duplicate record. 1333*52239d04San207044 */ 1334ab25eeb5Syz155240 if (is != NULL) 1335ab25eeb5Syz155240 return NULL; 1336ab25eeb5Syz155240 1337f4b3ec61Sdh155122 if (ifs->ifs_ips_stats.iss_bucketlen[hv] >= ifs->ifs_fr_state_maxbucket) { 1338f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_bucketfull); 1339ab25eeb5Syz155240 return NULL; 1340ab25eeb5Syz155240 } 1341ab25eeb5Syz155240 KMALLOC(is, ipstate_t *); 1342ab25eeb5Syz155240 if (is == NULL) { 1343f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_nomem); 1344ab25eeb5Syz155240 return NULL; 1345ab25eeb5Syz155240 } 1346ab25eeb5Syz155240 bcopy((char *)&ips, (char *)is, sizeof(*is)); 1347ab25eeb5Syz155240 /* 1348ab25eeb5Syz155240 * Do not do the modulous here, it is done in fr_stinsert(). 1349ab25eeb5Syz155240 */ 1350ab25eeb5Syz155240 if (fr != NULL) { 1351ab25eeb5Syz155240 (void) strncpy(is->is_group, fr->fr_group, FR_GROUPLEN); 1352ab25eeb5Syz155240 if (fr->fr_age[0] != 0) { 1353f4b3ec61Sdh155122 is->is_tqehead[0] = 1354f4b3ec61Sdh155122 fr_addtimeoutqueue(&ifs->ifs_ips_utqe, 1355f4b3ec61Sdh155122 fr->fr_age[0], ifs); 1356ab25eeb5Syz155240 is->is_sti.tqe_flags |= TQE_RULEBASED; 1357ab25eeb5Syz155240 } 1358ab25eeb5Syz155240 if (fr->fr_age[1] != 0) { 1359f4b3ec61Sdh155122 is->is_tqehead[1] = 1360f4b3ec61Sdh155122 fr_addtimeoutqueue(&ifs->ifs_ips_utqe, 1361f4b3ec61Sdh155122 fr->fr_age[1], ifs); 1362ab25eeb5Syz155240 is->is_sti.tqe_flags |= TQE_RULEBASED; 1363ab25eeb5Syz155240 } 1364ab25eeb5Syz155240 is->is_tag = fr->fr_logtag; 1365ab25eeb5Syz155240 1366ab25eeb5Syz155240 is->is_ifp[(out << 1) + 1] = fr->fr_ifas[1]; 1367ab25eeb5Syz155240 is->is_ifp[(1 - out) << 1] = fr->fr_ifas[2]; 1368ab25eeb5Syz155240 is->is_ifp[((1 - out) << 1) + 1] = fr->fr_ifas[3]; 1369ab25eeb5Syz155240 1370ab25eeb5Syz155240 if (((ifp = fr->fr_ifas[1]) != NULL) && 1371ab25eeb5Syz155240 (ifp != (void *)-1)) { 1372381a2a9aSdr146992 COPYIFNAME(ifp, is->is_ifname[(out << 1) + 1], fr->fr_v); 1373ab25eeb5Syz155240 } 1374ab25eeb5Syz155240 if (((ifp = fr->fr_ifas[2]) != NULL) && 1375ab25eeb5Syz155240 (ifp != (void *)-1)) { 1376381a2a9aSdr146992 COPYIFNAME(ifp, is->is_ifname[(1 - out) << 1], fr->fr_v); 1377ab25eeb5Syz155240 } 1378ab25eeb5Syz155240 if (((ifp = fr->fr_ifas[3]) != NULL) && 1379ab25eeb5Syz155240 (ifp != (void *)-1)) { 1380381a2a9aSdr146992 COPYIFNAME(ifp, is->is_ifname[((1 - out) << 1) + 1], fr->fr_v); 1381ab25eeb5Syz155240 } 1382ab25eeb5Syz155240 } 1383ab25eeb5Syz155240 1384ab25eeb5Syz155240 is->is_ifp[out << 1] = fin->fin_ifp; 1385ab25eeb5Syz155240 if (fin->fin_ifp != NULL) { 1386381a2a9aSdr146992 COPYIFNAME(fin->fin_ifp, is->is_ifname[out << 1], fr->fr_v); 1387ab25eeb5Syz155240 } 1388ab25eeb5Syz155240 1389ab25eeb5Syz155240 /* 1390ab25eeb5Syz155240 * It may seem strange to set is_ref to 2, but fr_check() will call 1391ab25eeb5Syz155240 * fr_statederef() after calling fr_addstate() and the idea is to 1392ab25eeb5Syz155240 * have it exist at the end of fr_check() with is_ref == 1. 1393ab25eeb5Syz155240 */ 1394ab25eeb5Syz155240 is->is_ref = 2; 1395ab25eeb5Syz155240 is->is_pkts[0] = 0, is->is_bytes[0] = 0; 1396ab25eeb5Syz155240 is->is_pkts[1] = 0, is->is_bytes[1] = 0; 1397ab25eeb5Syz155240 is->is_pkts[2] = 0, is->is_bytes[2] = 0; 1398ab25eeb5Syz155240 is->is_pkts[3] = 0, is->is_bytes[3] = 0; 1399ab25eeb5Syz155240 if ((fin->fin_flx & FI_IGNORE) == 0) { 1400ab25eeb5Syz155240 is->is_pkts[out] = 1; 1401ab25eeb5Syz155240 is->is_bytes[out] = fin->fin_plen; 1402ab25eeb5Syz155240 is->is_flx[out][0] = fin->fin_flx & FI_CMP; 1403ab25eeb5Syz155240 is->is_flx[out][0] &= ~FI_OOW; 1404ab25eeb5Syz155240 } 1405ab25eeb5Syz155240 1406ab25eeb5Syz155240 if (pass & FR_STSTRICT) 1407ab25eeb5Syz155240 is->is_flags |= IS_STRICT; 1408ab25eeb5Syz155240 1409ab25eeb5Syz155240 if (pass & FR_STATESYNC) 1410ab25eeb5Syz155240 is->is_flags |= IS_STATESYNC; 1411ab25eeb5Syz155240 1412ab25eeb5Syz155240 if (flags & (SI_WILDP|SI_WILDA)) { 1413f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_wild); 1414ab25eeb5Syz155240 } 1415ab25eeb5Syz155240 is->is_rulen = fin->fin_rule; 1416ab25eeb5Syz155240 1417ab25eeb5Syz155240 1418ab25eeb5Syz155240 if (pass & FR_LOGFIRST) 1419ab25eeb5Syz155240 is->is_pass &= ~(FR_LOGFIRST|FR_LOG); 1420ab25eeb5Syz155240 1421f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 1422ab25eeb5Syz155240 is->is_me = stsave; 1423ab25eeb5Syz155240 1424f4b3ec61Sdh155122 fr_stinsert(is, fin->fin_rev, ifs); 1425ab25eeb5Syz155240 1426ab25eeb5Syz155240 if (fin->fin_p == IPPROTO_TCP) { 1427ab25eeb5Syz155240 /* 1428ab25eeb5Syz155240 * If we're creating state for a starting connection, start the 1429ab25eeb5Syz155240 * timer on it as we'll never see an error if it fails to 1430ab25eeb5Syz155240 * connect. 1431ab25eeb5Syz155240 */ 1432f4b3ec61Sdh155122 (void) fr_tcp_age(&is->is_sti, fin, ifs->ifs_ips_tqtqb, 1433f4b3ec61Sdh155122 is->is_flags); 1434ab25eeb5Syz155240 MUTEX_EXIT(&is->is_lock); 1435ab25eeb5Syz155240 #ifdef IPFILTER_SCAN 1436ab25eeb5Syz155240 if ((is->is_flags & SI_CLONE) == 0) 1437ab25eeb5Syz155240 (void) ipsc_attachis(is); 1438ab25eeb5Syz155240 #endif 1439ab25eeb5Syz155240 } else { 1440ab25eeb5Syz155240 MUTEX_EXIT(&is->is_lock); 1441ab25eeb5Syz155240 } 1442ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 1443ab25eeb5Syz155240 if ((is->is_flags & IS_STATESYNC) && ((is->is_flags & SI_CLONE) == 0)) 1444ab25eeb5Syz155240 is->is_sync = ipfsync_new(SMC_STATE, fin, is); 1445ab25eeb5Syz155240 #endif 1446f4b3ec61Sdh155122 if (ifs->ifs_ipstate_logging) 1447f4b3ec61Sdh155122 ipstate_log(is, ISL_NEW, ifs); 1448ab25eeb5Syz155240 1449f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 1450ab25eeb5Syz155240 fin->fin_state = is; 1451ab25eeb5Syz155240 fin->fin_rev = IP6_NEQ(&is->is_dst, &fin->fin_daddr); 1452ab25eeb5Syz155240 fin->fin_flx |= FI_STATE; 1453ab25eeb5Syz155240 if (fin->fin_flx & FI_FRAG) 1454ab25eeb5Syz155240 (void) fr_newfrag(fin, pass ^ FR_KEEPSTATE); 1455ab25eeb5Syz155240 1456ab25eeb5Syz155240 return is; 1457ab25eeb5Syz155240 } 1458ab25eeb5Syz155240 1459ab25eeb5Syz155240 1460ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1461ab25eeb5Syz155240 /* Function: fr_tcpoptions */ 1462ab25eeb5Syz155240 /* Returns: int - 1 == packet matches state entry, 0 == it does not */ 1463ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 1464ab25eeb5Syz155240 /* tcp(I) - pointer to TCP packet header */ 1465ab25eeb5Syz155240 /* td(I) - pointer to TCP data held as part of the state */ 1466ab25eeb5Syz155240 /* */ 1467ab25eeb5Syz155240 /* Look after the TCP header for any options and deal with those that are */ 1468ab25eeb5Syz155240 /* present. Record details about those that we recogise. */ 1469ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1470ab25eeb5Syz155240 static int fr_tcpoptions(fin, tcp, td) 1471ab25eeb5Syz155240 fr_info_t *fin; 1472ab25eeb5Syz155240 tcphdr_t *tcp; 1473ab25eeb5Syz155240 tcpdata_t *td; 1474ab25eeb5Syz155240 { 1475ab25eeb5Syz155240 int off, mlen, ol, i, len, retval; 1476ab25eeb5Syz155240 char buf[64], *s, opt; 1477ab25eeb5Syz155240 mb_t *m = NULL; 1478ab25eeb5Syz155240 1479ab25eeb5Syz155240 len = (TCP_OFF(tcp) << 2); 1480ab25eeb5Syz155240 if (fin->fin_dlen < len) 1481ab25eeb5Syz155240 return 0; 1482ab25eeb5Syz155240 len -= sizeof(*tcp); 1483ab25eeb5Syz155240 1484ab25eeb5Syz155240 off = fin->fin_plen - fin->fin_dlen + sizeof(*tcp) + fin->fin_ipoff; 1485ab25eeb5Syz155240 1486ab25eeb5Syz155240 m = fin->fin_m; 1487ab25eeb5Syz155240 mlen = MSGDSIZE(m) - off; 1488ab25eeb5Syz155240 if (len > mlen) { 1489ab25eeb5Syz155240 len = mlen; 1490ab25eeb5Syz155240 retval = 0; 1491ab25eeb5Syz155240 } else { 1492ab25eeb5Syz155240 retval = 1; 1493ab25eeb5Syz155240 } 1494ab25eeb5Syz155240 1495ab25eeb5Syz155240 COPYDATA(m, off, len, buf); 1496ab25eeb5Syz155240 1497ab25eeb5Syz155240 for (s = buf; len > 0; ) { 1498ab25eeb5Syz155240 opt = *s; 1499ab25eeb5Syz155240 if (opt == TCPOPT_EOL) 1500ab25eeb5Syz155240 break; 1501ab25eeb5Syz155240 else if (opt == TCPOPT_NOP) 1502ab25eeb5Syz155240 ol = 1; 1503ab25eeb5Syz155240 else { 1504ab25eeb5Syz155240 if (len < 2) 1505ab25eeb5Syz155240 break; 1506ab25eeb5Syz155240 ol = (int)*(s + 1); 1507ab25eeb5Syz155240 if (ol < 2 || ol > len) 1508ab25eeb5Syz155240 break; 1509ab25eeb5Syz155240 1510ab25eeb5Syz155240 /* 1511ab25eeb5Syz155240 * Extract the TCP options we are interested in out of 1512ab25eeb5Syz155240 * the header and store them in the the tcpdata struct. 1513ab25eeb5Syz155240 */ 1514ab25eeb5Syz155240 switch (opt) 1515ab25eeb5Syz155240 { 1516ab25eeb5Syz155240 case TCPOPT_WINDOW : 1517ab25eeb5Syz155240 if (ol == TCPOLEN_WINDOW) { 1518ab25eeb5Syz155240 i = (int)*(s + 2); 1519ab25eeb5Syz155240 if (i > TCP_WSCALE_MAX) 1520ab25eeb5Syz155240 i = TCP_WSCALE_MAX; 1521ab25eeb5Syz155240 else if (i < 0) 1522ab25eeb5Syz155240 i = 0; 1523ab25eeb5Syz155240 td->td_winscale = i; 1524ab25eeb5Syz155240 } 1525ab25eeb5Syz155240 break; 1526ab25eeb5Syz155240 case TCPOPT_MAXSEG : 1527ab25eeb5Syz155240 /* 1528ab25eeb5Syz155240 * So, if we wanted to set the TCP MAXSEG, 1529ab25eeb5Syz155240 * it should be done here... 1530ab25eeb5Syz155240 */ 1531ab25eeb5Syz155240 if (ol == TCPOLEN_MAXSEG) { 1532ab25eeb5Syz155240 i = (int)*(s + 2); 1533ab25eeb5Syz155240 i <<= 8; 1534ab25eeb5Syz155240 i += (int)*(s + 3); 1535ab25eeb5Syz155240 td->td_maxseg = i; 1536ab25eeb5Syz155240 } 1537ab25eeb5Syz155240 break; 1538ab25eeb5Syz155240 } 1539ab25eeb5Syz155240 } 1540ab25eeb5Syz155240 len -= ol; 1541ab25eeb5Syz155240 s += ol; 1542ab25eeb5Syz155240 } 1543ab25eeb5Syz155240 return retval; 1544ab25eeb5Syz155240 } 1545ab25eeb5Syz155240 1546ab25eeb5Syz155240 1547ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1548ab25eeb5Syz155240 /* Function: fr_tcpstate */ 1549ab25eeb5Syz155240 /* Returns: int - 1 == packet matches state entry, 0 == it does not */ 1550ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 1551ab25eeb5Syz155240 /* tcp(I) - pointer to TCP packet header */ 1552ab25eeb5Syz155240 /* is(I) - pointer to master state structure */ 1553ab25eeb5Syz155240 /* */ 1554ab25eeb5Syz155240 /* Check to see if a packet with TCP headers fits within the TCP window. */ 1555ab25eeb5Syz155240 /* Change timeout depending on whether new packet is a SYN-ACK returning */ 1556ab25eeb5Syz155240 /* for a SYN or a RST or FIN which indicate time to close up shop. */ 1557ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1558ab25eeb5Syz155240 static int fr_tcpstate(fin, tcp, is) 1559ab25eeb5Syz155240 fr_info_t *fin; 1560ab25eeb5Syz155240 tcphdr_t *tcp; 1561ab25eeb5Syz155240 ipstate_t *is; 1562ab25eeb5Syz155240 { 1563ab25eeb5Syz155240 int source, ret = 0, flags; 1564ab25eeb5Syz155240 tcpdata_t *fdata, *tdata; 1565f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 1566ab25eeb5Syz155240 1567ab25eeb5Syz155240 source = !fin->fin_rev; 1568ab25eeb5Syz155240 if (((is->is_flags & IS_TCPFSM) != 0) && (source == 1) && 1569ab25eeb5Syz155240 (ntohs(is->is_sport) != fin->fin_data[0])) 1570ab25eeb5Syz155240 source = 0; 1571ab25eeb5Syz155240 fdata = &is->is_tcp.ts_data[!source]; 1572ab25eeb5Syz155240 tdata = &is->is_tcp.ts_data[source]; 1573ab25eeb5Syz155240 1574ab25eeb5Syz155240 MUTEX_ENTER(&is->is_lock); 15751e6b25a4San207044 15761e6b25a4San207044 /* 15771e6b25a4San207044 * If a SYN packet is received for a connection that is in a half 15781e6b25a4San207044 * closed state, then move its state entry to deletetq. In such case 15791e6b25a4San207044 * the SYN packet will be consequently dropped. This allows new state 15801e6b25a4San207044 * entry to be created with a retransmited SYN packet. 15811e6b25a4San207044 */ 15821e6b25a4San207044 if ((tcp->th_flags & TH_OPENING) == TH_SYN) { 15831e6b25a4San207044 if (((is->is_state[source] > IPF_TCPS_ESTABLISHED) || 15841e6b25a4San207044 (is->is_state[source] == IPF_TCPS_CLOSED)) && 15851e6b25a4San207044 ((is->is_state[!source] > IPF_TCPS_ESTABLISHED) || 15861e6b25a4San207044 (is->is_state[!source] == IPF_TCPS_CLOSED))) { 15871e6b25a4San207044 /* 15881e6b25a4San207044 * Do not update is->is_sti.tqe_die in case state entry 15891e6b25a4San207044 * is already present in deletetq. It prevents state 15901e6b25a4San207044 * entry ttl update by retransmitted SYN packets, which 15911e6b25a4San207044 * may arrive before timer tick kicks off. The SYN 15921e6b25a4San207044 * packet will be dropped again. 15931e6b25a4San207044 */ 15941e6b25a4San207044 if (is->is_sti.tqe_ifq != &ifs->ifs_ips_deletetq) 15951e6b25a4San207044 fr_movequeue(&is->is_sti, is->is_sti.tqe_ifq, 15961e6b25a4San207044 &fin->fin_ifs->ifs_ips_deletetq, 15971e6b25a4San207044 fin->fin_ifs); 15981e6b25a4San207044 15991e6b25a4San207044 MUTEX_EXIT(&is->is_lock); 16001e6b25a4San207044 return 0; 16011e6b25a4San207044 } 16021e6b25a4San207044 } 16031e6b25a4San207044 1604ab25eeb5Syz155240 if (fr_tcpinwindow(fin, fdata, tdata, tcp, is->is_flags)) { 1605ab25eeb5Syz155240 #ifdef IPFILTER_SCAN 1606ab25eeb5Syz155240 if (is->is_flags & (IS_SC_CLIENT|IS_SC_SERVER)) { 1607ab25eeb5Syz155240 ipsc_packet(fin, is); 1608ab25eeb5Syz155240 if (FR_ISBLOCK(is->is_pass)) { 1609ab25eeb5Syz155240 MUTEX_EXIT(&is->is_lock); 1610ab25eeb5Syz155240 return 1; 1611ab25eeb5Syz155240 } 1612ab25eeb5Syz155240 } 1613ab25eeb5Syz155240 #endif 1614ab25eeb5Syz155240 1615ab25eeb5Syz155240 /* 1616ab25eeb5Syz155240 * Nearing end of connection, start timeout. 1617ab25eeb5Syz155240 */ 1618f4b3ec61Sdh155122 ret = fr_tcp_age(&is->is_sti, fin, ifs->ifs_ips_tqtqb, 1619f4b3ec61Sdh155122 is->is_flags); 1620ab25eeb5Syz155240 if (ret == 0) { 1621ab25eeb5Syz155240 MUTEX_EXIT(&is->is_lock); 1622ab25eeb5Syz155240 return 0; 1623ab25eeb5Syz155240 } 1624ab25eeb5Syz155240 1625ab25eeb5Syz155240 /* 1626ab25eeb5Syz155240 * set s0's as appropriate. Use syn-ack packet as it 1627ab25eeb5Syz155240 * contains both pieces of required information. 1628ab25eeb5Syz155240 */ 1629ab25eeb5Syz155240 /* 1630ab25eeb5Syz155240 * Window scale option is only present in SYN/SYN-ACK packet. 1631ab25eeb5Syz155240 * Compare with ~TH_FIN to mask out T/TCP setups. 1632ab25eeb5Syz155240 */ 1633ab25eeb5Syz155240 flags = tcp->th_flags & ~(TH_FIN|TH_ECNALL); 1634ab25eeb5Syz155240 if (flags == (TH_SYN|TH_ACK)) { 1635ab25eeb5Syz155240 is->is_s0[source] = ntohl(tcp->th_ack); 1636ab25eeb5Syz155240 is->is_s0[!source] = ntohl(tcp->th_seq) + 1; 1637ab25eeb5Syz155240 if ((TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2)) && 1638ab25eeb5Syz155240 tdata->td_winscale) { 1639ab25eeb5Syz155240 if (fr_tcpoptions(fin, tcp, fdata)) { 1640ab25eeb5Syz155240 fdata->td_winflags = TCP_WSCALE_SEEN| 1641ab25eeb5Syz155240 TCP_WSCALE_FIRST; 1642ab25eeb5Syz155240 } else { 1643ab25eeb5Syz155240 if (!fdata->td_winscale) 1644ab25eeb5Syz155240 tdata->td_winscale = 0; 1645ab25eeb5Syz155240 } 1646ab25eeb5Syz155240 } 1647ab25eeb5Syz155240 if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN)) 1648ab25eeb5Syz155240 fr_checknewisn(fin, is); 1649ab25eeb5Syz155240 } else if (flags == TH_SYN) { 1650ab25eeb5Syz155240 is->is_s0[source] = ntohl(tcp->th_seq) + 1; 1651ab25eeb5Syz155240 if ((TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) 1652ab25eeb5Syz155240 if (fr_tcpoptions(fin, tcp, tdata)) { 1653ab25eeb5Syz155240 tdata->td_winflags = TCP_WSCALE_SEEN| 1654ab25eeb5Syz155240 TCP_WSCALE_FIRST; 1655ab25eeb5Syz155240 } 1656ab25eeb5Syz155240 1657ab25eeb5Syz155240 if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN)) 1658ab25eeb5Syz155240 fr_checknewisn(fin, is); 1659ab25eeb5Syz155240 1660ab25eeb5Syz155240 } 1661ab25eeb5Syz155240 ret = 1; 1662ab25eeb5Syz155240 } else 1663ab25eeb5Syz155240 fin->fin_flx |= FI_OOW; 1664ab25eeb5Syz155240 MUTEX_EXIT(&is->is_lock); 1665ab25eeb5Syz155240 return ret; 1666ab25eeb5Syz155240 } 1667ab25eeb5Syz155240 1668ab25eeb5Syz155240 1669ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1670ab25eeb5Syz155240 /* Function: fr_checknewisn */ 1671ab25eeb5Syz155240 /* Returns: Nil */ 1672ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 1673ab25eeb5Syz155240 /* is(I) - pointer to master state structure */ 1674ab25eeb5Syz155240 /* */ 1675ab25eeb5Syz155240 /* Check to see if this TCP connection is expecting and needs a new */ 1676ab25eeb5Syz155240 /* sequence number for a particular direction of the connection. */ 1677ab25eeb5Syz155240 /* */ 1678ab25eeb5Syz155240 /* NOTE: This does not actually change the sequence numbers, only gets new */ 1679ab25eeb5Syz155240 /* one ready. */ 1680ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1681ab25eeb5Syz155240 static void fr_checknewisn(fin, is) 1682ab25eeb5Syz155240 fr_info_t *fin; 1683ab25eeb5Syz155240 ipstate_t *is; 1684ab25eeb5Syz155240 { 1685ab25eeb5Syz155240 u_32_t sumd, old, new; 1686ab25eeb5Syz155240 tcphdr_t *tcp; 1687ab25eeb5Syz155240 int i; 1688ab25eeb5Syz155240 1689ab25eeb5Syz155240 i = fin->fin_rev; 1690ab25eeb5Syz155240 tcp = fin->fin_dp; 1691ab25eeb5Syz155240 1692ab25eeb5Syz155240 if (((i == 0) && !(is->is_flags & IS_ISNSYN)) || 1693ab25eeb5Syz155240 ((i == 1) && !(is->is_flags & IS_ISNACK))) { 1694ab25eeb5Syz155240 old = ntohl(tcp->th_seq); 1695ab25eeb5Syz155240 new = fr_newisn(fin); 1696ab25eeb5Syz155240 is->is_isninc[i] = new - old; 1697ab25eeb5Syz155240 CALC_SUMD(old, new, sumd); 1698ab25eeb5Syz155240 is->is_sumd[i] = (sumd & 0xffff) + (sumd >> 16); 1699ab25eeb5Syz155240 1700ab25eeb5Syz155240 is->is_flags |= ((i == 0) ? IS_ISNSYN : IS_ISNACK); 1701ab25eeb5Syz155240 } 1702ab25eeb5Syz155240 } 1703ab25eeb5Syz155240 1704ab25eeb5Syz155240 1705ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1706ab25eeb5Syz155240 /* Function: fr_tcpinwindow */ 1707ab25eeb5Syz155240 /* Returns: int - 1 == packet inside TCP "window", 0 == not inside. */ 1708ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 1709ab25eeb5Syz155240 /* fdata(I) - pointer to tcp state informatio (forward) */ 1710ab25eeb5Syz155240 /* tdata(I) - pointer to tcp state informatio (reverse) */ 1711ab25eeb5Syz155240 /* tcp(I) - pointer to TCP packet header */ 1712ab25eeb5Syz155240 /* */ 1713ab25eeb5Syz155240 /* Given a packet has matched addresses and ports, check to see if it is */ 1714ab25eeb5Syz155240 /* within the TCP data window. In a show of generosity, allow packets that */ 1715ab25eeb5Syz155240 /* are within the window space behind the current sequence # as well. */ 1716ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1717ab25eeb5Syz155240 int fr_tcpinwindow(fin, fdata, tdata, tcp, flags) 1718ab25eeb5Syz155240 fr_info_t *fin; 1719ab25eeb5Syz155240 tcpdata_t *fdata, *tdata; 1720ab25eeb5Syz155240 tcphdr_t *tcp; 1721ab25eeb5Syz155240 int flags; 1722ab25eeb5Syz155240 { 1723ab25eeb5Syz155240 tcp_seq seq, ack, end; 1724ab25eeb5Syz155240 int ackskew, tcpflags; 1725ab25eeb5Syz155240 u_32_t win, maxwin; 1726ab25eeb5Syz155240 1727ab25eeb5Syz155240 /* 1728ab25eeb5Syz155240 * Find difference between last checked packet and this packet. 1729ab25eeb5Syz155240 */ 1730ab25eeb5Syz155240 tcpflags = tcp->th_flags; 1731ab25eeb5Syz155240 seq = ntohl(tcp->th_seq); 1732ab25eeb5Syz155240 ack = ntohl(tcp->th_ack); 1733ab25eeb5Syz155240 if (tcpflags & TH_SYN) 1734ab25eeb5Syz155240 win = ntohs(tcp->th_win); 1735ab25eeb5Syz155240 else 1736ab25eeb5Syz155240 win = ntohs(tcp->th_win) << fdata->td_winscale; 1737ab25eeb5Syz155240 if (win == 0) 1738ab25eeb5Syz155240 win = 1; 1739ab25eeb5Syz155240 1740ab25eeb5Syz155240 /* 1741ab25eeb5Syz155240 * if window scaling is present, the scaling is only allowed 1742ab25eeb5Syz155240 * for windows not in the first SYN packet. In that packet the 1743ab25eeb5Syz155240 * window is 65535 to specify the largest window possible 1744ab25eeb5Syz155240 * for receivers not implementing the window scale option. 1745ab25eeb5Syz155240 * Currently, we do not assume TTCP here. That means that 1746ab25eeb5Syz155240 * if we see a second packet from a host (after the initial 1747ab25eeb5Syz155240 * SYN), we can assume that the receiver of the SYN did 1748ab25eeb5Syz155240 * already send back the SYN/ACK (and thus that we know if 1749ab25eeb5Syz155240 * the receiver also does window scaling) 1750ab25eeb5Syz155240 */ 1751ab25eeb5Syz155240 if (!(tcpflags & TH_SYN) && (fdata->td_winflags & TCP_WSCALE_FIRST)) { 1752ab25eeb5Syz155240 if (tdata->td_winflags & TCP_WSCALE_SEEN) { 1753ab25eeb5Syz155240 fdata->td_winflags &= ~TCP_WSCALE_FIRST; 1754ab25eeb5Syz155240 fdata->td_maxwin = win; 1755ab25eeb5Syz155240 } else { 1756ab25eeb5Syz155240 fdata->td_winscale = 0; 1757ab25eeb5Syz155240 fdata->td_winflags = 0; 1758ab25eeb5Syz155240 tdata->td_winscale = 0; 1759ab25eeb5Syz155240 tdata->td_winflags = 0; 1760ab25eeb5Syz155240 } 1761ab25eeb5Syz155240 } 1762ab25eeb5Syz155240 1763ab25eeb5Syz155240 end = seq + fin->fin_dlen - (TCP_OFF(tcp) << 2) + 1764ab25eeb5Syz155240 ((tcpflags & TH_SYN) ? 1 : 0) + ((tcpflags & TH_FIN) ? 1 : 0); 1765ab25eeb5Syz155240 1766ab25eeb5Syz155240 if ((fdata->td_end == 0) && 1767ab25eeb5Syz155240 (!(flags & IS_TCPFSM) || 1768ab25eeb5Syz155240 ((tcpflags & TH_OPENING) == TH_OPENING))) { 1769ab25eeb5Syz155240 /* 1770ab25eeb5Syz155240 * Must be a (outgoing) SYN-ACK in reply to a SYN. 1771ab25eeb5Syz155240 */ 1772ab25eeb5Syz155240 fdata->td_end = end; 1773ab25eeb5Syz155240 fdata->td_maxwin = 1; 1774ab25eeb5Syz155240 fdata->td_maxend = end + win; 1775ab25eeb5Syz155240 } 1776ab25eeb5Syz155240 1777ab25eeb5Syz155240 if (!(tcpflags & TH_ACK)) { /* Pretend an ack was sent */ 1778ab25eeb5Syz155240 ack = tdata->td_end; 1779ab25eeb5Syz155240 } else if (((tcpflags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) && 1780ab25eeb5Syz155240 (ack == 0)) { 1781ab25eeb5Syz155240 /* gross hack to get around certain broken tcp stacks */ 1782ab25eeb5Syz155240 ack = tdata->td_end; 1783ab25eeb5Syz155240 } 1784ab25eeb5Syz155240 1785ab25eeb5Syz155240 if (seq == end) 1786ab25eeb5Syz155240 seq = end = fdata->td_end; 1787ab25eeb5Syz155240 1788ab25eeb5Syz155240 maxwin = tdata->td_maxwin; 1789ab25eeb5Syz155240 ackskew = tdata->td_end - ack; 1790ab25eeb5Syz155240 1791ab25eeb5Syz155240 /* 1792ab25eeb5Syz155240 * Strict sequencing only allows in-order delivery. 1793ab25eeb5Syz155240 */ 1794ab25eeb5Syz155240 if ((flags & IS_STRICT) != 0) { 1795ab25eeb5Syz155240 if (seq != fdata->td_end) { 1796ab25eeb5Syz155240 return 0; 1797ab25eeb5Syz155240 } 1798ab25eeb5Syz155240 } 1799ab25eeb5Syz155240 1800ab25eeb5Syz155240 #define SEQ_GE(a,b) ((int)((a) - (b)) >= 0) 1801ab25eeb5Syz155240 #define SEQ_GT(a,b) ((int)((a) - (b)) > 0) 1802ab25eeb5Syz155240 if ( 1803ab25eeb5Syz155240 #if defined(_KERNEL) 1804ab25eeb5Syz155240 (SEQ_GE(fdata->td_maxend, end)) && 1805ab25eeb5Syz155240 (SEQ_GE(seq, fdata->td_end - maxwin)) && 1806ab25eeb5Syz155240 #endif 1807ab25eeb5Syz155240 /* XXX what about big packets */ 1808ab25eeb5Syz155240 #define MAXACKWINDOW 66000 1809ab25eeb5Syz155240 (-ackskew <= (MAXACKWINDOW << fdata->td_winscale)) && 1810ab25eeb5Syz155240 ( ackskew <= (MAXACKWINDOW << fdata->td_winscale))) { 1811ab25eeb5Syz155240 1812ab25eeb5Syz155240 /* if ackskew < 0 then this should be due to fragmented 1813ab25eeb5Syz155240 * packets. There is no way to know the length of the 1814ab25eeb5Syz155240 * total packet in advance. 1815ab25eeb5Syz155240 * We do know the total length from the fragment cache though. 1816ab25eeb5Syz155240 * Note however that there might be more sessions with 1817ab25eeb5Syz155240 * exactly the same source and destination parameters in the 1818ab25eeb5Syz155240 * state cache (and source and destination is the only stuff 1819ab25eeb5Syz155240 * that is saved in the fragment cache). Note further that 1820ab25eeb5Syz155240 * some TCP connections in the state cache are hashed with 1821ab25eeb5Syz155240 * sport and dport as well which makes it not worthwhile to 1822ab25eeb5Syz155240 * look for them. 1823ab25eeb5Syz155240 * Thus, when ackskew is negative but still seems to belong 1824ab25eeb5Syz155240 * to this session, we bump up the destinations end value. 1825ab25eeb5Syz155240 */ 1826ab25eeb5Syz155240 if (ackskew < 0) 1827ab25eeb5Syz155240 tdata->td_end = ack; 1828ab25eeb5Syz155240 1829ab25eeb5Syz155240 /* update max window seen */ 1830ab25eeb5Syz155240 if (fdata->td_maxwin < win) 1831ab25eeb5Syz155240 fdata->td_maxwin = win; 1832ab25eeb5Syz155240 if (SEQ_GT(end, fdata->td_end)) 1833ab25eeb5Syz155240 fdata->td_end = end; 1834ab25eeb5Syz155240 if (SEQ_GE(ack + win, tdata->td_maxend)) 1835ab25eeb5Syz155240 tdata->td_maxend = ack + win; 1836ab25eeb5Syz155240 return 1; 1837ab25eeb5Syz155240 } 1838ab25eeb5Syz155240 return 0; 1839ab25eeb5Syz155240 } 1840ab25eeb5Syz155240 1841ab25eeb5Syz155240 1842ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1843ab25eeb5Syz155240 /* Function: fr_stclone */ 1844ab25eeb5Syz155240 /* Returns: ipstate_t* - NULL == cloning failed, */ 1845ab25eeb5Syz155240 /* else pointer to new state structure */ 1846ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 1847ab25eeb5Syz155240 /* tcp(I) - pointer to TCP/UDP header */ 1848ab25eeb5Syz155240 /* is(I) - pointer to master state structure */ 1849ab25eeb5Syz155240 /* */ 1850ab25eeb5Syz155240 /* Create a "duplcate" state table entry from the master. */ 1851ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1852ab25eeb5Syz155240 static ipstate_t *fr_stclone(fin, tcp, is) 1853ab25eeb5Syz155240 fr_info_t *fin; 1854ab25eeb5Syz155240 tcphdr_t *tcp; 1855ab25eeb5Syz155240 ipstate_t *is; 1856ab25eeb5Syz155240 { 1857ab25eeb5Syz155240 ipstate_t *clone; 1858ab25eeb5Syz155240 u_32_t send; 1859f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 1860ab25eeb5Syz155240 1861f4b3ec61Sdh155122 if (ifs->ifs_ips_num == ifs->ifs_fr_statemax) { 1862f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_max); 1863f4b3ec61Sdh155122 ifs->ifs_fr_state_doflush = 1; 1864ab25eeb5Syz155240 return NULL; 1865ab25eeb5Syz155240 } 1866ab25eeb5Syz155240 KMALLOC(clone, ipstate_t *); 1867ab25eeb5Syz155240 if (clone == NULL) 1868ab25eeb5Syz155240 return NULL; 1869ab25eeb5Syz155240 bcopy((char *)is, (char *)clone, sizeof(*clone)); 1870ab25eeb5Syz155240 1871ab25eeb5Syz155240 MUTEX_NUKE(&clone->is_lock); 1872ab25eeb5Syz155240 1873f4b3ec61Sdh155122 clone->is_die = ONE_DAY + ifs->ifs_fr_ticks; 1874ab25eeb5Syz155240 clone->is_state[0] = 0; 1875ab25eeb5Syz155240 clone->is_state[1] = 0; 1876ab25eeb5Syz155240 send = ntohl(tcp->th_seq) + fin->fin_dlen - (TCP_OFF(tcp) << 2) + 1877ab25eeb5Syz155240 ((tcp->th_flags & TH_SYN) ? 1 : 0) + 1878ab25eeb5Syz155240 ((tcp->th_flags & TH_FIN) ? 1 : 0); 1879ab25eeb5Syz155240 1880ab25eeb5Syz155240 if (fin->fin_rev == 1) { 1881ab25eeb5Syz155240 clone->is_dend = send; 1882ab25eeb5Syz155240 clone->is_maxdend = send; 1883ab25eeb5Syz155240 clone->is_send = 0; 1884ab25eeb5Syz155240 clone->is_maxswin = 1; 1885ab25eeb5Syz155240 clone->is_maxdwin = ntohs(tcp->th_win); 1886ab25eeb5Syz155240 if (clone->is_maxdwin == 0) 1887ab25eeb5Syz155240 clone->is_maxdwin = 1; 1888ab25eeb5Syz155240 } else { 1889ab25eeb5Syz155240 clone->is_send = send; 1890ab25eeb5Syz155240 clone->is_maxsend = send; 1891ab25eeb5Syz155240 clone->is_dend = 0; 1892ab25eeb5Syz155240 clone->is_maxdwin = 1; 1893ab25eeb5Syz155240 clone->is_maxswin = ntohs(tcp->th_win); 1894ab25eeb5Syz155240 if (clone->is_maxswin == 0) 1895ab25eeb5Syz155240 clone->is_maxswin = 1; 1896ab25eeb5Syz155240 } 1897ab25eeb5Syz155240 1898ab25eeb5Syz155240 clone->is_flags &= ~SI_CLONE; 1899ab25eeb5Syz155240 clone->is_flags |= SI_CLONED; 1900f4b3ec61Sdh155122 fr_stinsert(clone, fin->fin_rev, ifs); 1901ab25eeb5Syz155240 clone->is_ref = 2; 1902ab25eeb5Syz155240 if (clone->is_p == IPPROTO_TCP) { 1903f4b3ec61Sdh155122 (void) fr_tcp_age(&clone->is_sti, fin, ifs->ifs_ips_tqtqb, 1904ab25eeb5Syz155240 clone->is_flags); 1905ab25eeb5Syz155240 } 1906ab25eeb5Syz155240 MUTEX_EXIT(&clone->is_lock); 1907ab25eeb5Syz155240 #ifdef IPFILTER_SCAN 1908ab25eeb5Syz155240 (void) ipsc_attachis(is); 1909ab25eeb5Syz155240 #endif 1910ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 1911ab25eeb5Syz155240 if (is->is_flags & IS_STATESYNC) 1912ab25eeb5Syz155240 clone->is_sync = ipfsync_new(SMC_STATE, fin, clone); 1913ab25eeb5Syz155240 #endif 1914ab25eeb5Syz155240 return clone; 1915ab25eeb5Syz155240 } 1916ab25eeb5Syz155240 1917ab25eeb5Syz155240 1918ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1919ab25eeb5Syz155240 /* Function: fr_matchsrcdst */ 1920ab25eeb5Syz155240 /* Returns: Nil */ 1921ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 1922ab25eeb5Syz155240 /* is(I) - pointer to state structure */ 1923ab25eeb5Syz155240 /* src(I) - pointer to source address */ 1924ab25eeb5Syz155240 /* dst(I) - pointer to destination address */ 1925ab25eeb5Syz155240 /* tcp(I) - pointer to TCP/UDP header */ 1926ab25eeb5Syz155240 /* */ 1927ab25eeb5Syz155240 /* Match a state table entry against an IP packet. The logic below is that */ 1928ab25eeb5Syz155240 /* ret gets set to one if the match succeeds, else remains 0. If it is */ 1929ab25eeb5Syz155240 /* still 0 after the test. no match. */ 1930ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1931ab25eeb5Syz155240 static ipstate_t *fr_matchsrcdst(fin, is, src, dst, tcp, cmask) 1932ab25eeb5Syz155240 fr_info_t *fin; 1933ab25eeb5Syz155240 ipstate_t *is; 1934ab25eeb5Syz155240 i6addr_t *src, *dst; 1935ab25eeb5Syz155240 tcphdr_t *tcp; 1936ab25eeb5Syz155240 u_32_t cmask; 1937ab25eeb5Syz155240 { 1938ab25eeb5Syz155240 int ret = 0, rev, out, flags, flx = 0, idx; 1939ab25eeb5Syz155240 u_short sp, dp; 1940ab25eeb5Syz155240 u_32_t cflx; 1941ab25eeb5Syz155240 void *ifp; 1942f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 1943ab25eeb5Syz155240 1944ab25eeb5Syz155240 rev = IP6_NEQ(&is->is_dst, dst); 1945ab25eeb5Syz155240 ifp = fin->fin_ifp; 1946ab25eeb5Syz155240 out = fin->fin_out; 1947ab25eeb5Syz155240 flags = is->is_flags; 1948ab25eeb5Syz155240 sp = 0; 1949ab25eeb5Syz155240 dp = 0; 1950ab25eeb5Syz155240 1951ab25eeb5Syz155240 if (tcp != NULL) { 1952ab25eeb5Syz155240 sp = htons(fin->fin_sport); 1953ab25eeb5Syz155240 dp = ntohs(fin->fin_dport); 1954ab25eeb5Syz155240 } 1955ab25eeb5Syz155240 if (!rev) { 1956ab25eeb5Syz155240 if (tcp != NULL) { 1957ab25eeb5Syz155240 if (!(flags & SI_W_SPORT) && (sp != is->is_sport)) 1958ab25eeb5Syz155240 rev = 1; 1959ab25eeb5Syz155240 else if (!(flags & SI_W_DPORT) && (dp != is->is_dport)) 1960ab25eeb5Syz155240 rev = 1; 1961ab25eeb5Syz155240 } 1962ab25eeb5Syz155240 } 1963ab25eeb5Syz155240 1964ab25eeb5Syz155240 idx = (out << 1) + rev; 1965ab25eeb5Syz155240 1966ab25eeb5Syz155240 /* 1967ab25eeb5Syz155240 * If the interface for this 'direction' is set, make sure it matches. 1968ab25eeb5Syz155240 * An interface name that is not set matches any, as does a name of *. 1969ab25eeb5Syz155240 */ 1970ab25eeb5Syz155240 if ((is->is_ifp[idx] == NULL && 1971ab25eeb5Syz155240 (*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '*')) || 1972ab25eeb5Syz155240 is->is_ifp[idx] == ifp) 1973ab25eeb5Syz155240 ret = 1; 1974ab25eeb5Syz155240 1975ab25eeb5Syz155240 if (ret == 0) 1976ab25eeb5Syz155240 return NULL; 1977ab25eeb5Syz155240 ret = 0; 1978ab25eeb5Syz155240 1979ab25eeb5Syz155240 /* 1980ab25eeb5Syz155240 * Match addresses and ports. 1981ab25eeb5Syz155240 */ 1982ab25eeb5Syz155240 if (rev == 0) { 1983ab25eeb5Syz155240 if ((IP6_EQ(&is->is_dst, dst) || (flags & SI_W_DADDR)) && 1984ab25eeb5Syz155240 (IP6_EQ(&is->is_src, src) || (flags & SI_W_SADDR))) { 1985ab25eeb5Syz155240 if (tcp) { 1986ab25eeb5Syz155240 if ((sp == is->is_sport || flags & SI_W_SPORT)&& 1987ab25eeb5Syz155240 (dp == is->is_dport || flags & SI_W_DPORT)) 1988ab25eeb5Syz155240 ret = 1; 1989ab25eeb5Syz155240 } else { 1990ab25eeb5Syz155240 ret = 1; 1991ab25eeb5Syz155240 } 1992ab25eeb5Syz155240 } 1993ab25eeb5Syz155240 } else { 1994ab25eeb5Syz155240 if ((IP6_EQ(&is->is_dst, src) || (flags & SI_W_DADDR)) && 1995ab25eeb5Syz155240 (IP6_EQ(&is->is_src, dst) || (flags & SI_W_SADDR))) { 1996ab25eeb5Syz155240 if (tcp) { 1997ab25eeb5Syz155240 if ((dp == is->is_sport || flags & SI_W_SPORT)&& 1998ab25eeb5Syz155240 (sp == is->is_dport || flags & SI_W_DPORT)) 1999ab25eeb5Syz155240 ret = 1; 2000ab25eeb5Syz155240 } else { 2001ab25eeb5Syz155240 ret = 1; 2002ab25eeb5Syz155240 } 2003ab25eeb5Syz155240 } 2004ab25eeb5Syz155240 } 2005ab25eeb5Syz155240 2006ab25eeb5Syz155240 if (ret == 0) 2007ab25eeb5Syz155240 return NULL; 2008ab25eeb5Syz155240 2009ab25eeb5Syz155240 /* 2010ab25eeb5Syz155240 * Whether or not this should be here, is questionable, but the aim 2011ab25eeb5Syz155240 * is to get this out of the main line. 2012ab25eeb5Syz155240 */ 2013ab25eeb5Syz155240 if (tcp == NULL) 2014ab25eeb5Syz155240 flags = is->is_flags & ~(SI_WILDP|SI_NEWFR|SI_CLONE|SI_CLONED); 2015ab25eeb5Syz155240 2016ab25eeb5Syz155240 /* 2017ab25eeb5Syz155240 * Only one of the source or destination address can be flaged as a 2018ab25eeb5Syz155240 * wildcard. Fill in the missing address, if set. 2019ab25eeb5Syz155240 * For IPv6, if the address being copied in is multicast, then 2020ab25eeb5Syz155240 * don't reset the wild flag - multicast causes it to be set in the 2021ab25eeb5Syz155240 * first place! 2022ab25eeb5Syz155240 */ 2023ab25eeb5Syz155240 if ((flags & (SI_W_SADDR|SI_W_DADDR))) { 2024ab25eeb5Syz155240 fr_ip_t *fi = &fin->fin_fi; 2025ab25eeb5Syz155240 2026ab25eeb5Syz155240 if ((flags & SI_W_SADDR) != 0) { 2027ab25eeb5Syz155240 if (rev == 0) { 2028ab25eeb5Syz155240 #ifdef USE_INET6 2029ab25eeb5Syz155240 if (is->is_v == 6 && 2030ab25eeb5Syz155240 IN6_IS_ADDR_MULTICAST(&fi->fi_src.in6)) 2031ab25eeb5Syz155240 /*EMPTY*/; 2032ab25eeb5Syz155240 else 2033ab25eeb5Syz155240 #endif 2034ab25eeb5Syz155240 { 2035ab25eeb5Syz155240 is->is_src = fi->fi_src; 2036ab25eeb5Syz155240 is->is_flags &= ~SI_W_SADDR; 2037ab25eeb5Syz155240 } 2038ab25eeb5Syz155240 } else { 2039ab25eeb5Syz155240 #ifdef USE_INET6 2040ab25eeb5Syz155240 if (is->is_v == 6 && 2041ab25eeb5Syz155240 IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6)) 2042ab25eeb5Syz155240 /*EMPTY*/; 2043ab25eeb5Syz155240 else 2044ab25eeb5Syz155240 #endif 2045ab25eeb5Syz155240 { 2046ab25eeb5Syz155240 is->is_src = fi->fi_dst; 2047ab25eeb5Syz155240 is->is_flags &= ~SI_W_SADDR; 2048ab25eeb5Syz155240 } 2049ab25eeb5Syz155240 } 2050ab25eeb5Syz155240 } else if ((flags & SI_W_DADDR) != 0) { 2051ab25eeb5Syz155240 if (rev == 0) { 2052ab25eeb5Syz155240 #ifdef USE_INET6 2053ab25eeb5Syz155240 if (is->is_v == 6 && 2054ab25eeb5Syz155240 IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6)) 2055ab25eeb5Syz155240 /*EMPTY*/; 2056ab25eeb5Syz155240 else 2057ab25eeb5Syz155240 #endif 2058ab25eeb5Syz155240 { 2059ab25eeb5Syz155240 is->is_dst = fi->fi_dst; 2060ab25eeb5Syz155240 is->is_flags &= ~SI_W_DADDR; 2061ab25eeb5Syz155240 } 2062ab25eeb5Syz155240 } else { 2063ab25eeb5Syz155240 #ifdef USE_INET6 2064ab25eeb5Syz155240 if (is->is_v == 6 && 2065ab25eeb5Syz155240 IN6_IS_ADDR_MULTICAST(&fi->fi_src.in6)) 2066ab25eeb5Syz155240 /*EMPTY*/; 2067ab25eeb5Syz155240 else 2068ab25eeb5Syz155240 #endif 2069ab25eeb5Syz155240 { 2070ab25eeb5Syz155240 is->is_dst = fi->fi_src; 2071ab25eeb5Syz155240 is->is_flags &= ~SI_W_DADDR; 2072ab25eeb5Syz155240 } 2073ab25eeb5Syz155240 } 2074ab25eeb5Syz155240 } 2075ab25eeb5Syz155240 if ((is->is_flags & (SI_WILDA|SI_WILDP)) == 0) { 2076f4b3ec61Sdh155122 ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild); 2077ab25eeb5Syz155240 } 2078ab25eeb5Syz155240 } 2079ab25eeb5Syz155240 2080ab25eeb5Syz155240 flx = fin->fin_flx & cmask; 2081ab25eeb5Syz155240 cflx = is->is_flx[out][rev]; 2082ab25eeb5Syz155240 2083ab25eeb5Syz155240 /* 2084ab25eeb5Syz155240 * Match up any flags set from IP options. 2085ab25eeb5Syz155240 */ 2086ab25eeb5Syz155240 if ((cflx && (flx != (cflx & cmask))) || 2087ab25eeb5Syz155240 ((fin->fin_optmsk & is->is_optmsk[rev]) != is->is_opt[rev]) || 2088ab25eeb5Syz155240 ((fin->fin_secmsk & is->is_secmsk) != is->is_sec) || 2089ab25eeb5Syz155240 ((fin->fin_auth & is->is_authmsk) != is->is_auth)) 2090ab25eeb5Syz155240 return NULL; 2091ab25eeb5Syz155240 2092ab25eeb5Syz155240 /* 2093ab25eeb5Syz155240 * Only one of the source or destination port can be flagged as a 2094ab25eeb5Syz155240 * wildcard. When filling it in, fill in a copy of the matched entry 2095ab25eeb5Syz155240 * if it has the cloning flag set. 2096ab25eeb5Syz155240 */ 2097ab25eeb5Syz155240 if ((fin->fin_flx & FI_IGNORE) != 0) { 2098ab25eeb5Syz155240 fin->fin_rev = rev; 2099ab25eeb5Syz155240 return is; 2100ab25eeb5Syz155240 } 2101ab25eeb5Syz155240 2102ab25eeb5Syz155240 if ((flags & (SI_W_SPORT|SI_W_DPORT))) { 2103ab25eeb5Syz155240 if ((flags & SI_CLONE) != 0) { 2104ab25eeb5Syz155240 ipstate_t *clone; 2105ab25eeb5Syz155240 2106ab25eeb5Syz155240 clone = fr_stclone(fin, tcp, is); 2107ab25eeb5Syz155240 if (clone == NULL) 2108ab25eeb5Syz155240 return NULL; 2109ab25eeb5Syz155240 is = clone; 2110ab25eeb5Syz155240 } else { 2111f4b3ec61Sdh155122 ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild); 2112ab25eeb5Syz155240 } 2113ab25eeb5Syz155240 2114ab25eeb5Syz155240 if ((flags & SI_W_SPORT) != 0) { 2115ab25eeb5Syz155240 if (rev == 0) { 2116ab25eeb5Syz155240 is->is_sport = sp; 2117ab25eeb5Syz155240 is->is_send = ntohl(tcp->th_seq); 2118ab25eeb5Syz155240 } else { 2119ab25eeb5Syz155240 is->is_sport = dp; 2120ab25eeb5Syz155240 is->is_send = ntohl(tcp->th_ack); 2121ab25eeb5Syz155240 } 2122ab25eeb5Syz155240 is->is_maxsend = is->is_send + 1; 2123ab25eeb5Syz155240 } else if ((flags & SI_W_DPORT) != 0) { 2124ab25eeb5Syz155240 if (rev == 0) { 2125ab25eeb5Syz155240 is->is_dport = dp; 2126ab25eeb5Syz155240 is->is_dend = ntohl(tcp->th_ack); 2127ab25eeb5Syz155240 } else { 2128ab25eeb5Syz155240 is->is_dport = sp; 2129ab25eeb5Syz155240 is->is_dend = ntohl(tcp->th_seq); 2130ab25eeb5Syz155240 } 2131ab25eeb5Syz155240 is->is_maxdend = is->is_dend + 1; 2132ab25eeb5Syz155240 } 2133ab25eeb5Syz155240 is->is_flags &= ~(SI_W_SPORT|SI_W_DPORT); 2134f4b3ec61Sdh155122 if ((flags & SI_CLONED) && ifs->ifs_ipstate_logging) 2135f4b3ec61Sdh155122 ipstate_log(is, ISL_CLONE, ifs); 2136ab25eeb5Syz155240 } 2137ab25eeb5Syz155240 2138ab25eeb5Syz155240 ret = -1; 2139ab25eeb5Syz155240 2140ab25eeb5Syz155240 if (is->is_flx[out][rev] == 0) { 2141ab25eeb5Syz155240 is->is_flx[out][rev] = flx; 2142ab25eeb5Syz155240 is->is_opt[rev] = fin->fin_optmsk; 2143ab25eeb5Syz155240 if (is->is_v == 6) { 2144ab25eeb5Syz155240 is->is_opt[rev] &= ~0x8; 2145ab25eeb5Syz155240 is->is_optmsk[rev] &= ~0x8; 2146ab25eeb5Syz155240 } 2147ab25eeb5Syz155240 } 2148ab25eeb5Syz155240 2149ab25eeb5Syz155240 /* 2150ab25eeb5Syz155240 * Check if the interface name for this "direction" is set and if not, 2151ab25eeb5Syz155240 * fill it in. 2152ab25eeb5Syz155240 */ 2153ab25eeb5Syz155240 if (is->is_ifp[idx] == NULL && 2154ab25eeb5Syz155240 (*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '*')) { 2155ab25eeb5Syz155240 is->is_ifp[idx] = ifp; 2156381a2a9aSdr146992 COPYIFNAME(ifp, is->is_ifname[idx], fin->fin_v); 2157ab25eeb5Syz155240 } 2158ab25eeb5Syz155240 fin->fin_rev = rev; 2159ab25eeb5Syz155240 return is; 2160ab25eeb5Syz155240 } 2161ab25eeb5Syz155240 2162ab25eeb5Syz155240 2163ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2164ab25eeb5Syz155240 /* Function: fr_checkicmpmatchingstate */ 2165ab25eeb5Syz155240 /* Returns: Nil */ 2166ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2167ab25eeb5Syz155240 /* */ 2168ab25eeb5Syz155240 /* If we've got an ICMP error message, using the information stored in the */ 2169ab25eeb5Syz155240 /* ICMP packet, look for a matching state table entry. */ 2170ab25eeb5Syz155240 /* */ 2171ab25eeb5Syz155240 /* If we return NULL then no lock on ipf_state is held. */ 2172ab25eeb5Syz155240 /* If we return non-null then a read-lock on ipf_state is held. */ 2173ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2174ab25eeb5Syz155240 static ipstate_t *fr_checkicmpmatchingstate(fin) 2175ab25eeb5Syz155240 fr_info_t *fin; 2176ab25eeb5Syz155240 { 2177ab25eeb5Syz155240 ipstate_t *is, **isp; 2178ab25eeb5Syz155240 u_short sport, dport; 2179ab25eeb5Syz155240 u_char pr; 2180ab25eeb5Syz155240 int backward, i, oi; 2181ab25eeb5Syz155240 i6addr_t dst, src; 2182ab25eeb5Syz155240 struct icmp *ic; 2183ab25eeb5Syz155240 u_short savelen; 2184ab25eeb5Syz155240 icmphdr_t *icmp; 2185ab25eeb5Syz155240 fr_info_t ofin; 2186ab25eeb5Syz155240 tcphdr_t *tcp; 2187ab25eeb5Syz155240 int len; 2188ab25eeb5Syz155240 ip_t *oip; 2189ab25eeb5Syz155240 u_int hv; 2190f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 2191ab25eeb5Syz155240 2192ab25eeb5Syz155240 /* 2193ab25eeb5Syz155240 * Does it at least have the return (basic) IP header ? 2194ab25eeb5Syz155240 * Is it an actual recognised ICMP error type? 2195ab25eeb5Syz155240 * Only a basic IP header (no options) should be with 2196ab25eeb5Syz155240 * an ICMP error header. 2197ab25eeb5Syz155240 */ 2198ab25eeb5Syz155240 if ((fin->fin_v != 4) || (fin->fin_hlen != sizeof(ip_t)) || 2199ab25eeb5Syz155240 (fin->fin_plen < ICMPERR_MINPKTLEN) || 2200ab25eeb5Syz155240 !(fin->fin_flx & FI_ICMPERR)) 2201ab25eeb5Syz155240 return NULL; 2202ab25eeb5Syz155240 ic = fin->fin_dp; 2203ab25eeb5Syz155240 2204ab25eeb5Syz155240 oip = (ip_t *)((char *)ic + ICMPERR_ICMPHLEN); 2205ab25eeb5Syz155240 /* 2206ab25eeb5Syz155240 * Check if the at least the old IP header (with options) and 2207ab25eeb5Syz155240 * 8 bytes of payload is present. 2208ab25eeb5Syz155240 */ 2209ab25eeb5Syz155240 if (fin->fin_plen < ICMPERR_MAXPKTLEN + ((IP_HL(oip) - 5) << 2)) 2210ab25eeb5Syz155240 return NULL; 2211ab25eeb5Syz155240 2212ab25eeb5Syz155240 /* 2213ab25eeb5Syz155240 * Sanity Checks. 2214ab25eeb5Syz155240 */ 2215ab25eeb5Syz155240 len = fin->fin_dlen - ICMPERR_ICMPHLEN; 2216ab25eeb5Syz155240 if ((len <= 0) || ((IP_HL(oip) << 2) > len)) 2217ab25eeb5Syz155240 return NULL; 2218ab25eeb5Syz155240 2219ab25eeb5Syz155240 /* 2220ab25eeb5Syz155240 * Is the buffer big enough for all of it ? It's the size of the IP 2221ab25eeb5Syz155240 * header claimed in the encapsulated part which is of concern. It 2222ab25eeb5Syz155240 * may be too big to be in this buffer but not so big that it's 2223ab25eeb5Syz155240 * outside the ICMP packet, leading to TCP deref's causing problems. 2224ab25eeb5Syz155240 * This is possible because we don't know how big oip_hl is when we 2225ab25eeb5Syz155240 * do the pullup early in fr_check() and thus can't guarantee it is 2226ab25eeb5Syz155240 * all here now. 2227ab25eeb5Syz155240 */ 2228ab25eeb5Syz155240 #ifdef _KERNEL 2229ab25eeb5Syz155240 { 2230ab25eeb5Syz155240 mb_t *m; 2231ab25eeb5Syz155240 2232ab25eeb5Syz155240 m = fin->fin_m; 2233ab25eeb5Syz155240 # if defined(MENTAT) 2234ab25eeb5Syz155240 if ((char *)oip + len > (char *)m->b_wptr) 2235ab25eeb5Syz155240 return NULL; 2236ab25eeb5Syz155240 # else 2237ab25eeb5Syz155240 if ((char *)oip + len > (char *)fin->fin_ip + m->m_len) 2238ab25eeb5Syz155240 return NULL; 2239ab25eeb5Syz155240 # endif 2240ab25eeb5Syz155240 } 2241ab25eeb5Syz155240 #endif 22426f8d8657Szf203873 bcopy((char *)fin, (char *)&ofin, sizeof(*fin)); 2243ab25eeb5Syz155240 2244ab25eeb5Syz155240 /* 2245ab25eeb5Syz155240 * in the IPv4 case we must zero the i6addr union otherwise 2246ab25eeb5Syz155240 * the IP6_EQ and IP6_NEQ macros produce the wrong results because 2247ab25eeb5Syz155240 * of the 'junk' in the unused part of the union 2248ab25eeb5Syz155240 */ 2249ab25eeb5Syz155240 bzero((char *)&src, sizeof(src)); 2250ab25eeb5Syz155240 bzero((char *)&dst, sizeof(dst)); 2251ab25eeb5Syz155240 2252ab25eeb5Syz155240 /* 2253ab25eeb5Syz155240 * we make an fin entry to be able to feed it to 2254ab25eeb5Syz155240 * matchsrcdst note that not all fields are encessary 2255ab25eeb5Syz155240 * but this is the cleanest way. Note further we fill 2256ab25eeb5Syz155240 * in fin_mp such that if someone uses it we'll get 2257ab25eeb5Syz155240 * a kernel panic. fr_matchsrcdst does not use this. 2258ab25eeb5Syz155240 * 2259ab25eeb5Syz155240 * watch out here, as ip is in host order and oip in network 2260ab25eeb5Syz155240 * order. Any change we make must be undone afterwards, like 2261ab25eeb5Syz155240 * oip->ip_off - it is still in network byte order so fix it. 2262ab25eeb5Syz155240 */ 2263ab25eeb5Syz155240 savelen = oip->ip_len; 2264ab25eeb5Syz155240 oip->ip_len = len; 2265ab25eeb5Syz155240 oip->ip_off = ntohs(oip->ip_off); 2266ab25eeb5Syz155240 2267ab25eeb5Syz155240 ofin.fin_flx = FI_NOCKSUM; 2268ab25eeb5Syz155240 ofin.fin_v = 4; 2269ab25eeb5Syz155240 ofin.fin_ip = oip; 2270ab25eeb5Syz155240 ofin.fin_m = NULL; /* if dereferenced, panic XXX */ 2271ab25eeb5Syz155240 ofin.fin_mp = NULL; /* if dereferenced, panic XXX */ 2272ab25eeb5Syz155240 ofin.fin_plen = fin->fin_dlen - ICMPERR_ICMPHLEN; 2273ab25eeb5Syz155240 (void) fr_makefrip(IP_HL(oip) << 2, oip, &ofin); 2274ab25eeb5Syz155240 ofin.fin_ifp = fin->fin_ifp; 2275ab25eeb5Syz155240 ofin.fin_out = !fin->fin_out; 2276ab25eeb5Syz155240 /* 2277ab25eeb5Syz155240 * Reset the short and bad flag here because in fr_matchsrcdst() 2278ab25eeb5Syz155240 * the flags for the current packet (fin_flx) are compared against 2279ab25eeb5Syz155240 * those for the existing session. 2280ab25eeb5Syz155240 */ 2281ab25eeb5Syz155240 ofin.fin_flx &= ~(FI_BAD|FI_SHORT); 2282ab25eeb5Syz155240 2283ab25eeb5Syz155240 /* 2284ab25eeb5Syz155240 * Put old values of ip_len and ip_off back as we don't know 2285ab25eeb5Syz155240 * if we have to forward the packet (or process it again. 2286ab25eeb5Syz155240 */ 2287ab25eeb5Syz155240 oip->ip_len = savelen; 2288ab25eeb5Syz155240 oip->ip_off = htons(oip->ip_off); 2289ab25eeb5Syz155240 2290ab25eeb5Syz155240 switch (oip->ip_p) 2291ab25eeb5Syz155240 { 2292ab25eeb5Syz155240 case IPPROTO_ICMP : 2293ab25eeb5Syz155240 /* 2294ab25eeb5Syz155240 * an ICMP error can only be generated as a result of an 2295ab25eeb5Syz155240 * ICMP query, not as the response on an ICMP error 2296ab25eeb5Syz155240 * 2297ab25eeb5Syz155240 * XXX theoretically ICMP_ECHOREP and the other reply's are 2298ab25eeb5Syz155240 * ICMP query's as well, but adding them here seems strange XXX 2299ab25eeb5Syz155240 */ 2300ab25eeb5Syz155240 if ((ofin.fin_flx & FI_ICMPERR) != 0) 2301ab25eeb5Syz155240 return NULL; 2302ab25eeb5Syz155240 2303ab25eeb5Syz155240 /* 2304ab25eeb5Syz155240 * perform a lookup of the ICMP packet in the state table 2305ab25eeb5Syz155240 */ 2306ab25eeb5Syz155240 icmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 2307ab25eeb5Syz155240 hv = (pr = oip->ip_p); 2308ab25eeb5Syz155240 src.in4 = oip->ip_src; 2309ab25eeb5Syz155240 hv += src.in4.s_addr; 2310ab25eeb5Syz155240 dst.in4 = oip->ip_dst; 2311ab25eeb5Syz155240 hv += dst.in4.s_addr; 2312ab25eeb5Syz155240 hv += icmp->icmp_id; 2313f4b3ec61Sdh155122 hv = DOUBLE_HASH(hv, ifs); 2314ab25eeb5Syz155240 2315f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 2316f4b3ec61Sdh155122 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) { 2317ab25eeb5Syz155240 isp = &is->is_hnext; 2318ab25eeb5Syz155240 if ((is->is_p != pr) || (is->is_v != 4)) 2319ab25eeb5Syz155240 continue; 2320ab25eeb5Syz155240 if (is->is_pass & FR_NOICMPERR) 2321ab25eeb5Syz155240 continue; 2322ab25eeb5Syz155240 is = fr_matchsrcdst(&ofin, is, &src, &dst, 2323ab25eeb5Syz155240 NULL, FI_ICMPCMP); 2324ab25eeb5Syz155240 if (is != NULL) { 2325ab25eeb5Syz155240 if ((is->is_pass & FR_NOICMPERR) != 0) { 2326f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 2327ab25eeb5Syz155240 return NULL; 2328ab25eeb5Syz155240 } 2329ab25eeb5Syz155240 /* 2330ab25eeb5Syz155240 * i : the index of this packet (the icmp 2331ab25eeb5Syz155240 * unreachable) 2332ab25eeb5Syz155240 * oi : the index of the original packet found 2333ab25eeb5Syz155240 * in the icmp header (i.e. the packet 2334ab25eeb5Syz155240 * causing this icmp) 2335ab25eeb5Syz155240 * backward : original packet was backward 2336ab25eeb5Syz155240 * compared to the state 2337ab25eeb5Syz155240 */ 2338ab25eeb5Syz155240 backward = IP6_NEQ(&is->is_src, &src); 2339ab25eeb5Syz155240 fin->fin_rev = !backward; 2340ab25eeb5Syz155240 i = (!backward << 1) + fin->fin_out; 2341ab25eeb5Syz155240 oi = (backward << 1) + ofin.fin_out; 2342ab25eeb5Syz155240 if (is->is_icmppkts[i] > is->is_pkts[oi]) 2343ab25eeb5Syz155240 continue; 2344f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_hits++; 2345ab25eeb5Syz155240 is->is_icmppkts[i]++; 2346ab25eeb5Syz155240 return is; 2347ab25eeb5Syz155240 } 2348ab25eeb5Syz155240 } 2349f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 2350ab25eeb5Syz155240 return NULL; 2351ab25eeb5Syz155240 case IPPROTO_TCP : 2352ab25eeb5Syz155240 case IPPROTO_UDP : 2353ab25eeb5Syz155240 break; 2354ab25eeb5Syz155240 default : 2355ab25eeb5Syz155240 return NULL; 2356ab25eeb5Syz155240 } 2357ab25eeb5Syz155240 2358ab25eeb5Syz155240 tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 2359ab25eeb5Syz155240 dport = tcp->th_dport; 2360ab25eeb5Syz155240 sport = tcp->th_sport; 2361ab25eeb5Syz155240 2362ab25eeb5Syz155240 hv = (pr = oip->ip_p); 2363ab25eeb5Syz155240 src.in4 = oip->ip_src; 2364ab25eeb5Syz155240 hv += src.in4.s_addr; 2365ab25eeb5Syz155240 dst.in4 = oip->ip_dst; 2366ab25eeb5Syz155240 hv += dst.in4.s_addr; 2367ab25eeb5Syz155240 hv += dport; 2368ab25eeb5Syz155240 hv += sport; 2369f4b3ec61Sdh155122 hv = DOUBLE_HASH(hv, ifs); 2370ab25eeb5Syz155240 2371f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 2372f4b3ec61Sdh155122 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) { 2373ab25eeb5Syz155240 isp = &is->is_hnext; 2374ab25eeb5Syz155240 /* 2375ab25eeb5Syz155240 * Only allow this icmp though if the 2376ab25eeb5Syz155240 * encapsulated packet was allowed through the 2377ab25eeb5Syz155240 * other way around. Note that the minimal amount 2378ab25eeb5Syz155240 * of info present does not allow for checking against 2379ab25eeb5Syz155240 * tcp internals such as seq and ack numbers. Only the 2380ab25eeb5Syz155240 * ports are known to be present and can be even if the 2381ab25eeb5Syz155240 * short flag is set. 2382ab25eeb5Syz155240 */ 2383ab25eeb5Syz155240 if ((is->is_p == pr) && (is->is_v == 4) && 2384ab25eeb5Syz155240 (is = fr_matchsrcdst(&ofin, is, &src, &dst, 2385ab25eeb5Syz155240 tcp, FI_ICMPCMP))) { 2386ab25eeb5Syz155240 /* 2387ab25eeb5Syz155240 * i : the index of this packet (the icmp unreachable) 2388ab25eeb5Syz155240 * oi : the index of the original packet found in the 2389ab25eeb5Syz155240 * icmp header (i.e. the packet causing this icmp) 2390ab25eeb5Syz155240 * backward : original packet was backward compared to 2391ab25eeb5Syz155240 * the state 2392ab25eeb5Syz155240 */ 2393ab25eeb5Syz155240 backward = IP6_NEQ(&is->is_src, &src); 2394ab25eeb5Syz155240 fin->fin_rev = !backward; 2395ab25eeb5Syz155240 i = (!backward << 1) + fin->fin_out; 2396ab25eeb5Syz155240 oi = (backward << 1) + ofin.fin_out; 2397ab25eeb5Syz155240 2398ab25eeb5Syz155240 if (((is->is_pass & FR_NOICMPERR) != 0) || 2399ab25eeb5Syz155240 (is->is_icmppkts[i] > is->is_pkts[oi])) 2400ab25eeb5Syz155240 break; 2401f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_hits++; 2402ab25eeb5Syz155240 is->is_icmppkts[i]++; 2403ab25eeb5Syz155240 /* 2404ab25eeb5Syz155240 * we deliberately do not touch the timeouts 2405ab25eeb5Syz155240 * for the accompanying state table entry. 2406ab25eeb5Syz155240 * It remains to be seen if that is correct. XXX 2407ab25eeb5Syz155240 */ 2408ab25eeb5Syz155240 return is; 2409ab25eeb5Syz155240 } 2410ab25eeb5Syz155240 } 2411f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 2412ab25eeb5Syz155240 return NULL; 2413ab25eeb5Syz155240 } 2414ab25eeb5Syz155240 2415ab25eeb5Syz155240 2416ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2417ab25eeb5Syz155240 /* Function: fr_ipsmove */ 2418ab25eeb5Syz155240 /* Returns: Nil */ 2419ab25eeb5Syz155240 /* Parameters: is(I) - pointer to state table entry */ 2420ab25eeb5Syz155240 /* hv(I) - new hash value for state table entry */ 2421ab25eeb5Syz155240 /* Write Locks: ipf_state */ 2422ab25eeb5Syz155240 /* */ 2423ab25eeb5Syz155240 /* Move a state entry from one position in the hash table to another. */ 2424ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2425f4b3ec61Sdh155122 static void fr_ipsmove(is, hv, ifs) 2426ab25eeb5Syz155240 ipstate_t *is; 2427ab25eeb5Syz155240 u_int hv; 2428f4b3ec61Sdh155122 ipf_stack_t *ifs; 2429ab25eeb5Syz155240 { 2430ab25eeb5Syz155240 ipstate_t **isp; 2431ab25eeb5Syz155240 u_int hvm; 2432ab25eeb5Syz155240 2433f4b3ec61Sdh155122 ASSERT(rw_read_locked(&ifs->ifs_ipf_state.ipf_lk) == 0); 2434ab25eeb5Syz155240 2435ab25eeb5Syz155240 hvm = is->is_hv; 2436ab25eeb5Syz155240 /* 2437ab25eeb5Syz155240 * Remove the hash from the old location... 2438ab25eeb5Syz155240 */ 2439ab25eeb5Syz155240 isp = is->is_phnext; 2440ab25eeb5Syz155240 if (is->is_hnext) 2441ab25eeb5Syz155240 is->is_hnext->is_phnext = isp; 2442ab25eeb5Syz155240 *isp = is->is_hnext; 2443f4b3ec61Sdh155122 if (ifs->ifs_ips_table[hvm] == NULL) 2444f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_inuse--; 2445f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_bucketlen[hvm]--; 2446ab25eeb5Syz155240 2447ab25eeb5Syz155240 /* 2448ab25eeb5Syz155240 * ...and put the hash in the new one. 2449ab25eeb5Syz155240 */ 2450f4b3ec61Sdh155122 hvm = DOUBLE_HASH(hv, ifs); 2451ab25eeb5Syz155240 is->is_hv = hvm; 2452f4b3ec61Sdh155122 isp = &ifs->ifs_ips_table[hvm]; 2453ab25eeb5Syz155240 if (*isp) 2454ab25eeb5Syz155240 (*isp)->is_phnext = &is->is_hnext; 2455ab25eeb5Syz155240 else 2456f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_inuse++; 2457f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_bucketlen[hvm]++; 2458ab25eeb5Syz155240 is->is_phnext = isp; 2459ab25eeb5Syz155240 is->is_hnext = *isp; 2460ab25eeb5Syz155240 *isp = is; 2461ab25eeb5Syz155240 } 2462ab25eeb5Syz155240 2463ab25eeb5Syz155240 2464ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2465ab25eeb5Syz155240 /* Function: fr_stlookup */ 2466ab25eeb5Syz155240 /* Returns: ipstate_t* - NULL == no matching state found, */ 2467ab25eeb5Syz155240 /* else pointer to state information is returned */ 2468ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2469ab25eeb5Syz155240 /* tcp(I) - pointer to TCP/UDP header. */ 2470ab25eeb5Syz155240 /* */ 2471ab25eeb5Syz155240 /* Search the state table for a matching entry to the packet described by */ 2472ab25eeb5Syz155240 /* the contents of *fin. */ 2473ab25eeb5Syz155240 /* */ 2474ab25eeb5Syz155240 /* If we return NULL then no lock on ipf_state is held. */ 2475ab25eeb5Syz155240 /* If we return non-null then a read-lock on ipf_state is held. */ 2476ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2477ab25eeb5Syz155240 ipstate_t *fr_stlookup(fin, tcp, ifqp) 2478ab25eeb5Syz155240 fr_info_t *fin; 2479ab25eeb5Syz155240 tcphdr_t *tcp; 2480ab25eeb5Syz155240 ipftq_t **ifqp; 2481ab25eeb5Syz155240 { 2482ab25eeb5Syz155240 u_int hv, hvm, pr, v, tryagain; 2483ab25eeb5Syz155240 ipstate_t *is, **isp; 2484ab25eeb5Syz155240 u_short dport, sport; 2485ab25eeb5Syz155240 i6addr_t src, dst; 2486ab25eeb5Syz155240 struct icmp *ic; 2487ab25eeb5Syz155240 ipftq_t *ifq; 2488ab25eeb5Syz155240 int oow; 2489f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 2490ab25eeb5Syz155240 2491ab25eeb5Syz155240 is = NULL; 2492ab25eeb5Syz155240 ifq = NULL; 2493ab25eeb5Syz155240 tcp = fin->fin_dp; 2494ab25eeb5Syz155240 ic = (struct icmp *)tcp; 2495ab25eeb5Syz155240 hv = (pr = fin->fin_fi.fi_p); 2496ab25eeb5Syz155240 src = fin->fin_fi.fi_src; 2497ab25eeb5Syz155240 dst = fin->fin_fi.fi_dst; 2498ab25eeb5Syz155240 hv += src.in4.s_addr; 2499ab25eeb5Syz155240 hv += dst.in4.s_addr; 2500ab25eeb5Syz155240 2501ab25eeb5Syz155240 v = fin->fin_fi.fi_v; 2502ab25eeb5Syz155240 #ifdef USE_INET6 2503ab25eeb5Syz155240 if (v == 6) { 2504ab25eeb5Syz155240 hv += fin->fin_fi.fi_src.i6[1]; 2505ab25eeb5Syz155240 hv += fin->fin_fi.fi_src.i6[2]; 2506ab25eeb5Syz155240 hv += fin->fin_fi.fi_src.i6[3]; 2507ab25eeb5Syz155240 2508ab25eeb5Syz155240 if ((fin->fin_p == IPPROTO_ICMPV6) && 2509ab25eeb5Syz155240 IN6_IS_ADDR_MULTICAST(&fin->fin_fi.fi_dst.in6)) { 2510ab25eeb5Syz155240 hv -= dst.in4.s_addr; 2511ab25eeb5Syz155240 } else { 2512ab25eeb5Syz155240 hv += fin->fin_fi.fi_dst.i6[1]; 2513ab25eeb5Syz155240 hv += fin->fin_fi.fi_dst.i6[2]; 2514ab25eeb5Syz155240 hv += fin->fin_fi.fi_dst.i6[3]; 2515ab25eeb5Syz155240 } 2516ab25eeb5Syz155240 } 2517ab25eeb5Syz155240 #endif 2518ab25eeb5Syz155240 2519ab25eeb5Syz155240 /* 2520ab25eeb5Syz155240 * Search the hash table for matching packet header info. 2521ab25eeb5Syz155240 */ 2522ab25eeb5Syz155240 switch (pr) 2523ab25eeb5Syz155240 { 2524ab25eeb5Syz155240 #ifdef USE_INET6 2525ab25eeb5Syz155240 case IPPROTO_ICMPV6 : 2526ab25eeb5Syz155240 tryagain = 0; 2527ab25eeb5Syz155240 if (v == 6) { 2528ab25eeb5Syz155240 if ((ic->icmp_type == ICMP6_ECHO_REQUEST) || 2529ab25eeb5Syz155240 (ic->icmp_type == ICMP6_ECHO_REPLY)) { 2530ab25eeb5Syz155240 hv += ic->icmp_id; 2531ab25eeb5Syz155240 } 2532ab25eeb5Syz155240 } 2533f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 2534ab25eeb5Syz155240 icmp6again: 2535f4b3ec61Sdh155122 hvm = DOUBLE_HASH(hv, ifs); 2536f4b3ec61Sdh155122 for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) { 2537ab25eeb5Syz155240 isp = &is->is_hnext; 2538ab25eeb5Syz155240 if ((is->is_p != pr) || (is->is_v != v)) 2539ab25eeb5Syz155240 continue; 2540ab25eeb5Syz155240 is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP); 2541ab25eeb5Syz155240 if (is != NULL && 2542ab25eeb5Syz155240 fr_matchicmpqueryreply(v, &is->is_icmp, 2543ab25eeb5Syz155240 ic, fin->fin_rev)) { 2544ab25eeb5Syz155240 if (fin->fin_rev) 2545f4b3ec61Sdh155122 ifq = &ifs->ifs_ips_icmpacktq; 2546ab25eeb5Syz155240 else 2547f4b3ec61Sdh155122 ifq = &ifs->ifs_ips_icmptq; 2548ab25eeb5Syz155240 break; 2549ab25eeb5Syz155240 } 2550ab25eeb5Syz155240 } 2551ab25eeb5Syz155240 2552ab25eeb5Syz155240 if (is != NULL) { 2553ab25eeb5Syz155240 if ((tryagain != 0) && !(is->is_flags & SI_W_DADDR)) { 2554ab25eeb5Syz155240 hv += fin->fin_fi.fi_src.i6[0]; 2555ab25eeb5Syz155240 hv += fin->fin_fi.fi_src.i6[1]; 2556ab25eeb5Syz155240 hv += fin->fin_fi.fi_src.i6[2]; 2557ab25eeb5Syz155240 hv += fin->fin_fi.fi_src.i6[3]; 2558f4b3ec61Sdh155122 fr_ipsmove(is, hv, ifs); 2559f4b3ec61Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_state); 2560ab25eeb5Syz155240 } 2561ab25eeb5Syz155240 break; 2562ab25eeb5Syz155240 } 2563f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 2564ab25eeb5Syz155240 2565ab25eeb5Syz155240 /* 2566ab25eeb5Syz155240 * No matching icmp state entry. Perhaps this is a 2567ab25eeb5Syz155240 * response to another state entry. 2568ab25eeb5Syz155240 * 2569ab25eeb5Syz155240 * XXX With some ICMP6 packets, the "other" address is already 2570ab25eeb5Syz155240 * in the packet, after the ICMP6 header, and this could be 2571ab25eeb5Syz155240 * used in place of the multicast address. However, taking 2572ab25eeb5Syz155240 * advantage of this requires some significant code changes 2573ab25eeb5Syz155240 * to handle the specific types where that is the case. 2574ab25eeb5Syz155240 */ 2575f4b3ec61Sdh155122 if ((ifs->ifs_ips_stats.iss_wild != 0) && (v == 6) && (tryagain == 0) && 2576ab25eeb5Syz155240 !IN6_IS_ADDR_MULTICAST(&fin->fin_fi.fi_src.in6)) { 2577ab25eeb5Syz155240 hv -= fin->fin_fi.fi_src.i6[0]; 2578ab25eeb5Syz155240 hv -= fin->fin_fi.fi_src.i6[1]; 2579ab25eeb5Syz155240 hv -= fin->fin_fi.fi_src.i6[2]; 2580ab25eeb5Syz155240 hv -= fin->fin_fi.fi_src.i6[3]; 2581ab25eeb5Syz155240 tryagain = 1; 2582f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state); 2583ab25eeb5Syz155240 goto icmp6again; 2584ab25eeb5Syz155240 } 2585ab25eeb5Syz155240 2586ab25eeb5Syz155240 is = fr_checkicmp6matchingstate(fin); 2587ab25eeb5Syz155240 if (is != NULL) 2588ab25eeb5Syz155240 return is; 2589ab25eeb5Syz155240 break; 2590ab25eeb5Syz155240 #endif 2591ab25eeb5Syz155240 2592ab25eeb5Syz155240 case IPPROTO_ICMP : 2593ab25eeb5Syz155240 if (v == 4) { 2594ab25eeb5Syz155240 hv += ic->icmp_id; 2595ab25eeb5Syz155240 } 2596f4b3ec61Sdh155122 hv = DOUBLE_HASH(hv, ifs); 2597f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 2598f4b3ec61Sdh155122 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) { 2599ab25eeb5Syz155240 isp = &is->is_hnext; 2600ab25eeb5Syz155240 if ((is->is_p != pr) || (is->is_v != v)) 2601ab25eeb5Syz155240 continue; 2602ab25eeb5Syz155240 is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP); 2603ab25eeb5Syz155240 if (is != NULL && 2604ab25eeb5Syz155240 fr_matchicmpqueryreply(v, &is->is_icmp, 2605ab25eeb5Syz155240 ic, fin->fin_rev)) { 2606ab25eeb5Syz155240 if (fin->fin_rev) 2607f4b3ec61Sdh155122 ifq = &ifs->ifs_ips_icmpacktq; 2608ab25eeb5Syz155240 else 2609f4b3ec61Sdh155122 ifq = &ifs->ifs_ips_icmptq; 2610ab25eeb5Syz155240 break; 2611ab25eeb5Syz155240 } 2612ab25eeb5Syz155240 } 2613ab25eeb5Syz155240 if (is == NULL) { 2614f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 2615ab25eeb5Syz155240 } 2616ab25eeb5Syz155240 break; 2617ab25eeb5Syz155240 2618ab25eeb5Syz155240 case IPPROTO_TCP : 2619ab25eeb5Syz155240 case IPPROTO_UDP : 2620ab25eeb5Syz155240 ifqp = NULL; 2621ab25eeb5Syz155240 sport = htons(fin->fin_data[0]); 2622ab25eeb5Syz155240 hv += sport; 2623ab25eeb5Syz155240 dport = htons(fin->fin_data[1]); 2624ab25eeb5Syz155240 hv += dport; 2625ab25eeb5Syz155240 oow = 0; 2626ab25eeb5Syz155240 tryagain = 0; 2627f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 2628ab25eeb5Syz155240 retry_tcpudp: 2629f4b3ec61Sdh155122 hvm = DOUBLE_HASH(hv, ifs); 2630f4b3ec61Sdh155122 for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) { 2631ab25eeb5Syz155240 isp = &is->is_hnext; 2632ab25eeb5Syz155240 if ((is->is_p != pr) || (is->is_v != v)) 2633ab25eeb5Syz155240 continue; 2634ab25eeb5Syz155240 fin->fin_flx &= ~FI_OOW; 2635ab25eeb5Syz155240 is = fr_matchsrcdst(fin, is, &src, &dst, tcp, FI_CMP); 2636ab25eeb5Syz155240 if (is != NULL) { 2637ab25eeb5Syz155240 if (pr == IPPROTO_TCP) { 2638ab25eeb5Syz155240 if (!fr_tcpstate(fin, tcp, is)) { 2639ab25eeb5Syz155240 oow |= fin->fin_flx & FI_OOW; 2640ab25eeb5Syz155240 continue; 2641ab25eeb5Syz155240 } 2642ab25eeb5Syz155240 } 2643ab25eeb5Syz155240 break; 2644ab25eeb5Syz155240 } 2645ab25eeb5Syz155240 } 2646ab25eeb5Syz155240 if (is != NULL) { 2647ab25eeb5Syz155240 if (tryagain && 2648ab25eeb5Syz155240 !(is->is_flags & (SI_CLONE|SI_WILDP|SI_WILDA))) { 2649ab25eeb5Syz155240 hv += dport; 2650ab25eeb5Syz155240 hv += sport; 2651f4b3ec61Sdh155122 fr_ipsmove(is, hv, ifs); 2652f4b3ec61Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_state); 2653ab25eeb5Syz155240 } 2654ab25eeb5Syz155240 break; 2655ab25eeb5Syz155240 } 2656f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 2657ab25eeb5Syz155240 2658f4b3ec61Sdh155122 if (!tryagain && ifs->ifs_ips_stats.iss_wild) { 2659ab25eeb5Syz155240 hv -= dport; 2660ab25eeb5Syz155240 hv -= sport; 2661ab25eeb5Syz155240 tryagain = 1; 2662f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state); 2663ab25eeb5Syz155240 goto retry_tcpudp; 2664ab25eeb5Syz155240 } 2665ab25eeb5Syz155240 fin->fin_flx |= oow; 2666ab25eeb5Syz155240 break; 2667ab25eeb5Syz155240 2668ab25eeb5Syz155240 #if 0 2669ab25eeb5Syz155240 case IPPROTO_GRE : 2670ab25eeb5Syz155240 gre = fin->fin_dp; 2671ab25eeb5Syz155240 if (GRE_REV(gre->gr_flags) == 1) { 2672ab25eeb5Syz155240 hv += gre->gr_call; 2673ab25eeb5Syz155240 } 2674ab25eeb5Syz155240 /* FALLTHROUGH */ 2675ab25eeb5Syz155240 #endif 2676ab25eeb5Syz155240 default : 2677ab25eeb5Syz155240 ifqp = NULL; 2678f4b3ec61Sdh155122 hvm = DOUBLE_HASH(hv, ifs); 2679f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 2680f4b3ec61Sdh155122 for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) { 2681ab25eeb5Syz155240 isp = &is->is_hnext; 2682ab25eeb5Syz155240 if ((is->is_p != pr) || (is->is_v != v)) 2683ab25eeb5Syz155240 continue; 2684ab25eeb5Syz155240 is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP); 2685ab25eeb5Syz155240 if (is != NULL) { 2686f4b3ec61Sdh155122 ifq = &ifs->ifs_ips_iptq; 2687ab25eeb5Syz155240 break; 2688ab25eeb5Syz155240 } 2689ab25eeb5Syz155240 } 2690ab25eeb5Syz155240 if (is == NULL) { 2691f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 2692ab25eeb5Syz155240 } 2693ab25eeb5Syz155240 break; 2694ab25eeb5Syz155240 } 2695ab25eeb5Syz155240 2696ab25eeb5Syz155240 if ((is != NULL) && ((is->is_sti.tqe_flags & TQE_RULEBASED) != 0) && 2697ab25eeb5Syz155240 (is->is_tqehead[fin->fin_rev] != NULL)) 2698ab25eeb5Syz155240 ifq = is->is_tqehead[fin->fin_rev]; 2699ab25eeb5Syz155240 if (ifq != NULL && ifqp != NULL) 2700ab25eeb5Syz155240 *ifqp = ifq; 2701ab25eeb5Syz155240 return is; 2702ab25eeb5Syz155240 } 2703ab25eeb5Syz155240 2704ab25eeb5Syz155240 2705ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2706ab25eeb5Syz155240 /* Function: fr_updatestate */ 2707ab25eeb5Syz155240 /* Returns: Nil */ 2708ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2709ab25eeb5Syz155240 /* is(I) - pointer to state table entry */ 2710ab25eeb5Syz155240 /* Read Locks: ipf_state */ 2711ab25eeb5Syz155240 /* */ 2712ab25eeb5Syz155240 /* Updates packet and byte counters for a newly received packet. Seeds the */ 2713ab25eeb5Syz155240 /* fragment cache with a new entry as required. */ 2714ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2715ab25eeb5Syz155240 void fr_updatestate(fin, is, ifq) 2716ab25eeb5Syz155240 fr_info_t *fin; 2717ab25eeb5Syz155240 ipstate_t *is; 2718ab25eeb5Syz155240 ipftq_t *ifq; 2719ab25eeb5Syz155240 { 2720ab25eeb5Syz155240 ipftqent_t *tqe; 2721ab25eeb5Syz155240 int i, pass; 2722f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 2723ab25eeb5Syz155240 2724ab25eeb5Syz155240 i = (fin->fin_rev << 1) + fin->fin_out; 2725ab25eeb5Syz155240 2726ab25eeb5Syz155240 /* 2727ab25eeb5Syz155240 * For TCP packets, ifq == NULL. For all others, check if this new 2728ab25eeb5Syz155240 * queue is different to the last one it was on and move it if so. 2729ab25eeb5Syz155240 */ 2730ab25eeb5Syz155240 tqe = &is->is_sti; 2731ab25eeb5Syz155240 MUTEX_ENTER(&is->is_lock); 2732ab25eeb5Syz155240 if ((tqe->tqe_flags & TQE_RULEBASED) != 0) 2733ab25eeb5Syz155240 ifq = is->is_tqehead[fin->fin_rev]; 2734ab25eeb5Syz155240 2735ab25eeb5Syz155240 if (ifq != NULL) 2736f4b3ec61Sdh155122 fr_movequeue(tqe, tqe->tqe_ifq, ifq, ifs); 2737ab25eeb5Syz155240 2738ab25eeb5Syz155240 is->is_pkts[i]++; 2739ab25eeb5Syz155240 is->is_bytes[i] += fin->fin_plen; 2740ab25eeb5Syz155240 MUTEX_EXIT(&is->is_lock); 2741ab25eeb5Syz155240 2742ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 2743ab25eeb5Syz155240 if (is->is_flags & IS_STATESYNC) 2744ab25eeb5Syz155240 ipfsync_update(SMC_STATE, fin, is->is_sync); 2745ab25eeb5Syz155240 #endif 2746ab25eeb5Syz155240 2747f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_hits); 2748ab25eeb5Syz155240 2749ab25eeb5Syz155240 fin->fin_fr = is->is_rule; 2750ab25eeb5Syz155240 2751ab25eeb5Syz155240 /* 2752ab25eeb5Syz155240 * If this packet is a fragment and the rule says to track fragments, 2753ab25eeb5Syz155240 * then create a new fragment cache entry. 2754ab25eeb5Syz155240 */ 2755ab25eeb5Syz155240 pass = is->is_pass; 2756ab25eeb5Syz155240 if ((fin->fin_flx & FI_FRAG) && FR_ISPASS(pass)) 2757ab25eeb5Syz155240 (void) fr_newfrag(fin, pass ^ FR_KEEPSTATE); 2758ab25eeb5Syz155240 } 2759ab25eeb5Syz155240 2760ab25eeb5Syz155240 2761ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2762ab25eeb5Syz155240 /* Function: fr_checkstate */ 2763ab25eeb5Syz155240 /* Returns: frentry_t* - NULL == search failed, */ 2764ab25eeb5Syz155240 /* else pointer to rule for matching state */ 2765ab25eeb5Syz155240 /* Parameters: ifp(I) - pointer to interface */ 2766ab25eeb5Syz155240 /* passp(I) - pointer to filtering result flags */ 2767ab25eeb5Syz155240 /* */ 2768ab25eeb5Syz155240 /* Check if a packet is associated with an entry in the state table. */ 2769ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2770ab25eeb5Syz155240 frentry_t *fr_checkstate(fin, passp) 2771ab25eeb5Syz155240 fr_info_t *fin; 2772ab25eeb5Syz155240 u_32_t *passp; 2773ab25eeb5Syz155240 { 2774ab25eeb5Syz155240 ipstate_t *is; 2775ab25eeb5Syz155240 frentry_t *fr; 2776ab25eeb5Syz155240 tcphdr_t *tcp; 2777ab25eeb5Syz155240 ipftq_t *ifq; 2778ab25eeb5Syz155240 u_int pass; 2779f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 2780ab25eeb5Syz155240 2781f4b3ec61Sdh155122 if (ifs->ifs_fr_state_lock || (ifs->ifs_ips_list == NULL) || 2782ab25eeb5Syz155240 (fin->fin_flx & (FI_SHORT|FI_STATE|FI_FRAGBODY|FI_BAD))) 2783ab25eeb5Syz155240 return NULL; 2784ab25eeb5Syz155240 2785ab25eeb5Syz155240 is = NULL; 2786ab25eeb5Syz155240 if ((fin->fin_flx & FI_TCPUDP) || 2787ab25eeb5Syz155240 (fin->fin_fi.fi_p == IPPROTO_ICMP) 2788ab25eeb5Syz155240 #ifdef USE_INET6 2789ab25eeb5Syz155240 || (fin->fin_fi.fi_p == IPPROTO_ICMPV6) 2790ab25eeb5Syz155240 #endif 2791ab25eeb5Syz155240 ) 2792ab25eeb5Syz155240 tcp = fin->fin_dp; 2793ab25eeb5Syz155240 else 2794ab25eeb5Syz155240 tcp = NULL; 2795ab25eeb5Syz155240 2796ab25eeb5Syz155240 /* 2797ab25eeb5Syz155240 * Search the hash table for matching packet header info. 2798ab25eeb5Syz155240 */ 2799ab25eeb5Syz155240 ifq = NULL; 2800ab25eeb5Syz155240 is = fin->fin_state; 2801ab25eeb5Syz155240 if (is == NULL) 2802ab25eeb5Syz155240 is = fr_stlookup(fin, tcp, &ifq); 2803ab25eeb5Syz155240 switch (fin->fin_p) 2804ab25eeb5Syz155240 { 2805ab25eeb5Syz155240 #ifdef USE_INET6 2806ab25eeb5Syz155240 case IPPROTO_ICMPV6 : 2807ab25eeb5Syz155240 if (is != NULL) 2808ab25eeb5Syz155240 break; 2809ab25eeb5Syz155240 if (fin->fin_v == 6) { 2810ab25eeb5Syz155240 is = fr_checkicmp6matchingstate(fin); 2811ab25eeb5Syz155240 if (is != NULL) 2812ab25eeb5Syz155240 goto matched; 2813ab25eeb5Syz155240 } 2814ab25eeb5Syz155240 break; 2815ab25eeb5Syz155240 #endif 2816ab25eeb5Syz155240 case IPPROTO_ICMP : 2817ab25eeb5Syz155240 if (is != NULL) 2818ab25eeb5Syz155240 break; 2819ab25eeb5Syz155240 /* 2820ab25eeb5Syz155240 * No matching icmp state entry. Perhaps this is a 2821ab25eeb5Syz155240 * response to another state entry. 2822ab25eeb5Syz155240 */ 2823ab25eeb5Syz155240 is = fr_checkicmpmatchingstate(fin); 2824ab25eeb5Syz155240 if (is != NULL) 2825ab25eeb5Syz155240 goto matched; 2826ab25eeb5Syz155240 break; 2827ab25eeb5Syz155240 case IPPROTO_TCP : 2828ab25eeb5Syz155240 if (is == NULL) 2829ab25eeb5Syz155240 break; 2830ab25eeb5Syz155240 2831ab25eeb5Syz155240 if (is->is_pass & FR_NEWISN) { 2832ab25eeb5Syz155240 if (fin->fin_out == 0) 2833ab25eeb5Syz155240 fr_fixinisn(fin, is); 2834ab25eeb5Syz155240 else if (fin->fin_out == 1) 2835ab25eeb5Syz155240 fr_fixoutisn(fin, is); 2836ab25eeb5Syz155240 } 2837ab25eeb5Syz155240 break; 2838ab25eeb5Syz155240 default : 2839ab25eeb5Syz155240 if (fin->fin_rev) 2840f4b3ec61Sdh155122 ifq = &ifs->ifs_ips_udpacktq; 2841ab25eeb5Syz155240 else 2842f4b3ec61Sdh155122 ifq = &ifs->ifs_ips_udptq; 2843ab25eeb5Syz155240 break; 2844ab25eeb5Syz155240 } 2845ab25eeb5Syz155240 if (is == NULL) { 2846f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_miss); 2847ab25eeb5Syz155240 return NULL; 2848ab25eeb5Syz155240 } 2849ab25eeb5Syz155240 2850ab25eeb5Syz155240 matched: 2851ab25eeb5Syz155240 fr = is->is_rule; 2852ab25eeb5Syz155240 if (fr != NULL) { 2853ab25eeb5Syz155240 if ((fin->fin_out == 0) && (fr->fr_nattag.ipt_num[0] != 0)) { 2854ab25eeb5Syz155240 if (fin->fin_nattag == NULL) 2855ab25eeb5Syz155240 return NULL; 2856ab25eeb5Syz155240 if (fr_matchtag(&fr->fr_nattag, fin->fin_nattag) != 0) 2857ab25eeb5Syz155240 return NULL; 2858ab25eeb5Syz155240 } 2859ab25eeb5Syz155240 (void) strncpy(fin->fin_group, fr->fr_group, FR_GROUPLEN); 2860ab25eeb5Syz155240 fin->fin_icode = fr->fr_icode; 2861ab25eeb5Syz155240 } 2862ab25eeb5Syz155240 2863ab25eeb5Syz155240 fin->fin_rule = is->is_rulen; 2864ab25eeb5Syz155240 pass = is->is_pass; 2865ab25eeb5Syz155240 fr_updatestate(fin, is, ifq); 2866ab25eeb5Syz155240 if (fin->fin_out == 1) 2867ab25eeb5Syz155240 fin->fin_nat = is->is_nat[fin->fin_rev]; 2868ab25eeb5Syz155240 2869ab25eeb5Syz155240 fin->fin_state = is; 2870f4b3ec61Sdh155122 is->is_touched = ifs->ifs_fr_ticks; 2871ab25eeb5Syz155240 MUTEX_ENTER(&is->is_lock); 2872ab25eeb5Syz155240 is->is_ref++; 2873ab25eeb5Syz155240 MUTEX_EXIT(&is->is_lock); 2874f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 2875ab25eeb5Syz155240 fin->fin_flx |= FI_STATE; 2876ab25eeb5Syz155240 if ((pass & FR_LOGFIRST) != 0) 2877ab25eeb5Syz155240 pass &= ~(FR_LOGFIRST|FR_LOG); 2878ab25eeb5Syz155240 *passp = pass; 2879ab25eeb5Syz155240 return fr; 2880ab25eeb5Syz155240 } 2881ab25eeb5Syz155240 2882ab25eeb5Syz155240 2883ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2884ab25eeb5Syz155240 /* Function: fr_fixoutisn */ 2885ab25eeb5Syz155240 /* Returns: Nil */ 2886ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2887ab25eeb5Syz155240 /* is(I) - pointer to master state structure */ 2888ab25eeb5Syz155240 /* */ 2889ab25eeb5Syz155240 /* Called only for outbound packets, adjusts the sequence number and the */ 2890ab25eeb5Syz155240 /* TCP checksum to match that change. */ 2891ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2892ab25eeb5Syz155240 static void fr_fixoutisn(fin, is) 2893ab25eeb5Syz155240 fr_info_t *fin; 2894ab25eeb5Syz155240 ipstate_t *is; 2895ab25eeb5Syz155240 { 2896ab25eeb5Syz155240 tcphdr_t *tcp; 2897ab25eeb5Syz155240 int rev; 2898ab25eeb5Syz155240 u_32_t seq; 2899ab25eeb5Syz155240 2900ab25eeb5Syz155240 tcp = fin->fin_dp; 2901ab25eeb5Syz155240 rev = fin->fin_rev; 2902ab25eeb5Syz155240 if ((is->is_flags & IS_ISNSYN) != 0) { 2903ab25eeb5Syz155240 if (rev == 0) { 2904ab25eeb5Syz155240 seq = ntohl(tcp->th_seq); 2905ab25eeb5Syz155240 seq += is->is_isninc[0]; 2906ab25eeb5Syz155240 tcp->th_seq = htonl(seq); 2907381a2a9aSdr146992 fix_outcksum(&tcp->th_sum, is->is_sumd[0]); 2908ab25eeb5Syz155240 } 2909ab25eeb5Syz155240 } 2910ab25eeb5Syz155240 if ((is->is_flags & IS_ISNACK) != 0) { 2911ab25eeb5Syz155240 if (rev == 1) { 2912ab25eeb5Syz155240 seq = ntohl(tcp->th_seq); 2913ab25eeb5Syz155240 seq += is->is_isninc[1]; 2914ab25eeb5Syz155240 tcp->th_seq = htonl(seq); 2915381a2a9aSdr146992 fix_outcksum(&tcp->th_sum, is->is_sumd[1]); 2916ab25eeb5Syz155240 } 2917ab25eeb5Syz155240 } 2918ab25eeb5Syz155240 } 2919ab25eeb5Syz155240 2920ab25eeb5Syz155240 2921ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2922ab25eeb5Syz155240 /* Function: fr_fixinisn */ 2923ab25eeb5Syz155240 /* Returns: Nil */ 2924ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2925ab25eeb5Syz155240 /* is(I) - pointer to master state structure */ 2926ab25eeb5Syz155240 /* */ 2927ab25eeb5Syz155240 /* Called only for inbound packets, adjusts the acknowledge number and the */ 2928ab25eeb5Syz155240 /* TCP checksum to match that change. */ 2929ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2930ab25eeb5Syz155240 static void fr_fixinisn(fin, is) 2931ab25eeb5Syz155240 fr_info_t *fin; 2932ab25eeb5Syz155240 ipstate_t *is; 2933ab25eeb5Syz155240 { 2934ab25eeb5Syz155240 tcphdr_t *tcp; 2935ab25eeb5Syz155240 int rev; 2936ab25eeb5Syz155240 u_32_t ack; 2937ab25eeb5Syz155240 2938ab25eeb5Syz155240 tcp = fin->fin_dp; 2939ab25eeb5Syz155240 rev = fin->fin_rev; 2940ab25eeb5Syz155240 if ((is->is_flags & IS_ISNSYN) != 0) { 2941ab25eeb5Syz155240 if (rev == 1) { 2942ab25eeb5Syz155240 ack = ntohl(tcp->th_ack); 2943ab25eeb5Syz155240 ack -= is->is_isninc[0]; 2944ab25eeb5Syz155240 tcp->th_ack = htonl(ack); 2945381a2a9aSdr146992 fix_incksum(&tcp->th_sum, is->is_sumd[0]); 2946ab25eeb5Syz155240 } 2947ab25eeb5Syz155240 } 2948ab25eeb5Syz155240 if ((is->is_flags & IS_ISNACK) != 0) { 2949ab25eeb5Syz155240 if (rev == 0) { 2950ab25eeb5Syz155240 ack = ntohl(tcp->th_ack); 2951ab25eeb5Syz155240 ack -= is->is_isninc[1]; 2952ab25eeb5Syz155240 tcp->th_ack = htonl(ack); 2953381a2a9aSdr146992 fix_incksum(&tcp->th_sum, is->is_sumd[1]); 2954ab25eeb5Syz155240 } 2955ab25eeb5Syz155240 } 2956ab25eeb5Syz155240 } 2957ab25eeb5Syz155240 2958ab25eeb5Syz155240 2959ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2960ab25eeb5Syz155240 /* Function: fr_statesync */ 2961ab25eeb5Syz155240 /* Returns: Nil */ 2962381a2a9aSdr146992 /* Parameters: action(I) - type of synchronisation to do */ 2963381a2a9aSdr146992 /* v(I) - IP version being sync'd (v4 or v6) */ 2964381a2a9aSdr146992 /* ifp(I) - interface identifier associated with action */ 2965381a2a9aSdr146992 /* name(I) - name associated with ifp parameter */ 2966ab25eeb5Syz155240 /* */ 2967ab25eeb5Syz155240 /* Walk through all state entries and if an interface pointer match is */ 2968ab25eeb5Syz155240 /* found then look it up again, based on its name in case the pointer has */ 2969ab25eeb5Syz155240 /* changed since last time. */ 2970ab25eeb5Syz155240 /* */ 2971ab25eeb5Syz155240 /* If ifp is passed in as being non-null then we are only doing updates for */ 2972ab25eeb5Syz155240 /* existing, matching, uses of it. */ 2973ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2974f4b3ec61Sdh155122 void fr_statesync(action, v, ifp, name, ifs) 2975381a2a9aSdr146992 int action, v; 2976ab25eeb5Syz155240 void *ifp; 2977381a2a9aSdr146992 char *name; 2978f4b3ec61Sdh155122 ipf_stack_t *ifs; 2979ab25eeb5Syz155240 { 2980ab25eeb5Syz155240 ipstate_t *is; 2981ab25eeb5Syz155240 int i; 2982ab25eeb5Syz155240 2983f4b3ec61Sdh155122 if (ifs->ifs_fr_running <= 0) 2984ab25eeb5Syz155240 return; 2985ab25eeb5Syz155240 2986f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state); 2987ab25eeb5Syz155240 2988f4b3ec61Sdh155122 if (ifs->ifs_fr_running <= 0) { 2989f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 2990ab25eeb5Syz155240 return; 2991ab25eeb5Syz155240 } 2992ab25eeb5Syz155240 2993381a2a9aSdr146992 switch (action) 2994381a2a9aSdr146992 { 2995381a2a9aSdr146992 case IPFSYNC_RESYNC : 2996f4b3ec61Sdh155122 for (is = ifs->ifs_ips_list; is; is = is->is_next) { 2997381a2a9aSdr146992 if (v != 0 && is->is_v != v) 2998381a2a9aSdr146992 continue; 2999ab25eeb5Syz155240 /* 3000ab25eeb5Syz155240 * Look up all the interface names in the state entry. 3001ab25eeb5Syz155240 */ 3002ab25eeb5Syz155240 for (i = 0; i < 4; i++) { 3003ab25eeb5Syz155240 is->is_ifp[i] = fr_resolvenic(is->is_ifname[i], 3004f4b3ec61Sdh155122 is->is_v, ifs); 3005ab25eeb5Syz155240 } 3006ab25eeb5Syz155240 } 3007381a2a9aSdr146992 break; 3008381a2a9aSdr146992 case IPFSYNC_NEWIFP : 3009f4b3ec61Sdh155122 for (is = ifs->ifs_ips_list; is; is = is->is_next) { 3010381a2a9aSdr146992 if (v != 0 && is->is_v != v) 3011381a2a9aSdr146992 continue; 3012381a2a9aSdr146992 /* 3013381a2a9aSdr146992 * Look up all the interface names in the state entry. 3014381a2a9aSdr146992 */ 3015381a2a9aSdr146992 for (i = 0; i < 4; i++) { 3016381a2a9aSdr146992 if (!strncmp(is->is_ifname[i], name, 3017381a2a9aSdr146992 sizeof(is->is_ifname[i]))) 3018381a2a9aSdr146992 is->is_ifp[i] = ifp; 3019381a2a9aSdr146992 } 3020381a2a9aSdr146992 } 3021381a2a9aSdr146992 break; 3022381a2a9aSdr146992 case IPFSYNC_OLDIFP : 3023f4b3ec61Sdh155122 for (is = ifs->ifs_ips_list; is; is = is->is_next) { 3024381a2a9aSdr146992 if (v != 0 && is->is_v != v) 3025381a2a9aSdr146992 continue; 3026381a2a9aSdr146992 /* 3027381a2a9aSdr146992 * Look up all the interface names in the state entry. 3028381a2a9aSdr146992 */ 3029381a2a9aSdr146992 for (i = 0; i < 4; i++) { 3030381a2a9aSdr146992 if (is->is_ifp[i] == ifp) 3031381a2a9aSdr146992 is->is_ifp[i] = (void *)-1; 3032381a2a9aSdr146992 } 3033381a2a9aSdr146992 } 3034381a2a9aSdr146992 break; 3035381a2a9aSdr146992 } 3036f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 3037ab25eeb5Syz155240 } 3038ab25eeb5Syz155240 3039ab25eeb5Syz155240 3040ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3041ab25eeb5Syz155240 /* Function: fr_delstate */ 3042ab25eeb5Syz155240 /* Returns: Nil */ 3043ab25eeb5Syz155240 /* Parameters: is(I) - pointer to state structure to delete */ 3044ab25eeb5Syz155240 /* why(I) - if not 0, log reason why it was deleted */ 3045a9a89b0dSdr146992 /* Write Locks: ipf_state/ipf_global */ 3046ab25eeb5Syz155240 /* */ 3047ab25eeb5Syz155240 /* Deletes a state entry from the enumerated list as well as the hash table */ 3048ab25eeb5Syz155240 /* and timeout queue lists. Make adjustments to hash table statistics and */ 3049ab25eeb5Syz155240 /* global counters as required. */ 3050ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3051f4b3ec61Sdh155122 static void fr_delstate(is, why, ifs) 3052ab25eeb5Syz155240 ipstate_t *is; 3053ab25eeb5Syz155240 int why; 3054f4b3ec61Sdh155122 ipf_stack_t *ifs; 3055ab25eeb5Syz155240 { 3056ab25eeb5Syz155240 3057f4b3ec61Sdh155122 ASSERT(rw_write_held(&ifs->ifs_ipf_global.ipf_lk) == 0 || 3058f4b3ec61Sdh155122 rw_write_held(&ifs->ifs_ipf_state.ipf_lk) == 0); 3059ab25eeb5Syz155240 3060ab25eeb5Syz155240 /* 3061ab25eeb5Syz155240 * Since we want to delete this, remove it from the state table, 3062ab25eeb5Syz155240 * where it can be found & used, first. 3063ab25eeb5Syz155240 */ 3064ab25eeb5Syz155240 if (is->is_pnext != NULL) { 3065ab25eeb5Syz155240 *is->is_pnext = is->is_next; 3066ab25eeb5Syz155240 3067ab25eeb5Syz155240 if (is->is_next != NULL) 3068ab25eeb5Syz155240 is->is_next->is_pnext = is->is_pnext; 3069ab25eeb5Syz155240 3070ab25eeb5Syz155240 is->is_pnext = NULL; 3071ab25eeb5Syz155240 is->is_next = NULL; 3072ab25eeb5Syz155240 } 3073ab25eeb5Syz155240 3074ab25eeb5Syz155240 if (is->is_phnext != NULL) { 3075ab25eeb5Syz155240 *is->is_phnext = is->is_hnext; 3076ab25eeb5Syz155240 if (is->is_hnext != NULL) 3077ab25eeb5Syz155240 is->is_hnext->is_phnext = is->is_phnext; 3078f4b3ec61Sdh155122 if (ifs->ifs_ips_table[is->is_hv] == NULL) 3079f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_inuse--; 3080f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_bucketlen[is->is_hv]--; 3081ab25eeb5Syz155240 3082ab25eeb5Syz155240 is->is_phnext = NULL; 3083ab25eeb5Syz155240 is->is_hnext = NULL; 3084ab25eeb5Syz155240 } 3085ab25eeb5Syz155240 3086ab25eeb5Syz155240 /* 3087f4b3ec61Sdh155122 * Because ifs->ifs_ips_stats.iss_wild is a count of entries in the state 3088ab25eeb5Syz155240 * table that have wildcard flags set, only decerement it once 3089ab25eeb5Syz155240 * and do it here. 3090ab25eeb5Syz155240 */ 3091ab25eeb5Syz155240 if (is->is_flags & (SI_WILDP|SI_WILDA)) { 3092ab25eeb5Syz155240 if (!(is->is_flags & SI_CLONED)) { 3093f4b3ec61Sdh155122 ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild); 3094ab25eeb5Syz155240 } 3095ab25eeb5Syz155240 is->is_flags &= ~(SI_WILDP|SI_WILDA); 3096ab25eeb5Syz155240 } 3097ab25eeb5Syz155240 3098ab25eeb5Syz155240 /* 3099ab25eeb5Syz155240 * Next, remove it from the timeout queue it is in. 3100ab25eeb5Syz155240 */ 3101ab25eeb5Syz155240 fr_deletequeueentry(&is->is_sti); 3102ab25eeb5Syz155240 3103ab25eeb5Syz155240 is->is_me = NULL; 3104ab25eeb5Syz155240 3105ab25eeb5Syz155240 /* 3106ab25eeb5Syz155240 * If it is still in use by something else, do not go any further, 3107ab25eeb5Syz155240 * but note that at this point it is now an orphan. 3108ab25eeb5Syz155240 */ 31090e01ff8bSdr146992 MUTEX_ENTER(&is->is_lock); 31100e01ff8bSdr146992 if (is->is_ref > 1) { 3111ab25eeb5Syz155240 is->is_ref--; 31120e01ff8bSdr146992 MUTEX_EXIT(&is->is_lock); 3113ab25eeb5Syz155240 return; 31140e01ff8bSdr146992 } 31150e01ff8bSdr146992 MUTEX_EXIT(&is->is_lock); 31160e01ff8bSdr146992 31170e01ff8bSdr146992 is->is_ref = 0; 3118ab25eeb5Syz155240 3119ab25eeb5Syz155240 if (is->is_tqehead[0] != NULL) { 3120ab25eeb5Syz155240 if (fr_deletetimeoutqueue(is->is_tqehead[0]) == 0) 3121f4b3ec61Sdh155122 fr_freetimeoutqueue(is->is_tqehead[0], ifs); 3122ab25eeb5Syz155240 } 3123ab25eeb5Syz155240 if (is->is_tqehead[1] != NULL) { 3124ab25eeb5Syz155240 if (fr_deletetimeoutqueue(is->is_tqehead[1]) == 0) 3125f4b3ec61Sdh155122 fr_freetimeoutqueue(is->is_tqehead[1], ifs); 3126ab25eeb5Syz155240 } 3127ab25eeb5Syz155240 3128ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 3129ab25eeb5Syz155240 if (is->is_sync) 3130ab25eeb5Syz155240 ipfsync_del(is->is_sync); 3131ab25eeb5Syz155240 #endif 3132ab25eeb5Syz155240 #ifdef IPFILTER_SCAN 3133ab25eeb5Syz155240 (void) ipsc_detachis(is); 3134ab25eeb5Syz155240 #endif 3135ab25eeb5Syz155240 3136f4b3ec61Sdh155122 if (ifs->ifs_ipstate_logging != 0 && why != 0) 3137f4b3ec61Sdh155122 ipstate_log(is, why, ifs); 3138ab25eeb5Syz155240 3139ab25eeb5Syz155240 if (is->is_rule != NULL) { 3140ab25eeb5Syz155240 is->is_rule->fr_statecnt--; 3141f4b3ec61Sdh155122 (void)fr_derefrule(&is->is_rule, ifs); 3142ab25eeb5Syz155240 } 3143ab25eeb5Syz155240 3144ab25eeb5Syz155240 MUTEX_DESTROY(&is->is_lock); 3145ab25eeb5Syz155240 KFREE(is); 3146f4b3ec61Sdh155122 ifs->ifs_ips_num--; 3147ab25eeb5Syz155240 } 3148ab25eeb5Syz155240 3149ab25eeb5Syz155240 3150ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3151ab25eeb5Syz155240 /* Function: fr_timeoutstate */ 3152ab25eeb5Syz155240 /* Returns: Nil */ 3153ab25eeb5Syz155240 /* Parameters: Nil */ 3154ab25eeb5Syz155240 /* */ 3155ab25eeb5Syz155240 /* Slowly expire held state for thingslike UDP and ICMP. The algorithm */ 3156ab25eeb5Syz155240 /* used here is to keep the queue sorted with the oldest things at the top */ 3157ab25eeb5Syz155240 /* and the youngest at the bottom. So if the top one doesn't need to be */ 3158ab25eeb5Syz155240 /* expired then neither will any under it. */ 3159ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3160f4b3ec61Sdh155122 void fr_timeoutstate(ifs) 3161f4b3ec61Sdh155122 ipf_stack_t *ifs; 3162ab25eeb5Syz155240 { 3163ab25eeb5Syz155240 ipftq_t *ifq, *ifqnext; 3164ab25eeb5Syz155240 ipftqent_t *tqe, *tqn; 3165ab25eeb5Syz155240 ipstate_t *is; 3166ab25eeb5Syz155240 SPL_INT(s); 3167ab25eeb5Syz155240 3168ab25eeb5Syz155240 SPL_NET(s); 3169f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_state); 3170f4b3ec61Sdh155122 for (ifq = ifs->ifs_ips_tqtqb; ifq != NULL; ifq = ifq->ifq_next) 3171ab25eeb5Syz155240 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 3172f4b3ec61Sdh155122 if (tqe->tqe_die > ifs->ifs_fr_ticks) 3173ab25eeb5Syz155240 break; 3174ab25eeb5Syz155240 tqn = tqe->tqe_next; 3175ab25eeb5Syz155240 is = tqe->tqe_parent; 3176f4b3ec61Sdh155122 fr_delstate(is, ISL_EXPIRE, ifs); 3177ab25eeb5Syz155240 } 3178ab25eeb5Syz155240 3179f4b3ec61Sdh155122 for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) { 3180ab25eeb5Syz155240 ifqnext = ifq->ifq_next; 3181ab25eeb5Syz155240 3182ab25eeb5Syz155240 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 3183f4b3ec61Sdh155122 if (tqe->tqe_die > ifs->ifs_fr_ticks) 3184ab25eeb5Syz155240 break; 3185ab25eeb5Syz155240 tqn = tqe->tqe_next; 3186ab25eeb5Syz155240 is = tqe->tqe_parent; 3187f4b3ec61Sdh155122 fr_delstate(is, ISL_EXPIRE, ifs); 3188ab25eeb5Syz155240 } 3189ab25eeb5Syz155240 } 3190ab25eeb5Syz155240 3191f4b3ec61Sdh155122 for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) { 3192ab25eeb5Syz155240 ifqnext = ifq->ifq_next; 3193ab25eeb5Syz155240 3194ab25eeb5Syz155240 if (((ifq->ifq_flags & IFQF_DELETE) != 0) && 3195ab25eeb5Syz155240 (ifq->ifq_ref == 0)) { 3196f4b3ec61Sdh155122 fr_freetimeoutqueue(ifq, ifs); 3197ab25eeb5Syz155240 } 3198ab25eeb5Syz155240 } 3199ab25eeb5Syz155240 3200f4b3ec61Sdh155122 if (ifs->ifs_fr_state_doflush) { 3201f4b3ec61Sdh155122 (void) fr_state_flush(2, 0, ifs); 3202f4b3ec61Sdh155122 ifs->ifs_fr_state_doflush = 0; 3203ab25eeb5Syz155240 } 3204f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 3205ab25eeb5Syz155240 SPL_X(s); 3206ab25eeb5Syz155240 } 3207ab25eeb5Syz155240 3208ab25eeb5Syz155240 3209ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3210ab25eeb5Syz155240 /* Function: fr_state_flush */ 3211ab25eeb5Syz155240 /* Returns: int - 0 == success, -1 == failure */ 3212ab25eeb5Syz155240 /* Parameters: Nil */ 3213ab25eeb5Syz155240 /* Write Locks: ipf_state */ 3214ab25eeb5Syz155240 /* */ 3215ab25eeb5Syz155240 /* Flush state tables. Three actions currently defined: */ 3216ab25eeb5Syz155240 /* which == 0 : flush all state table entries */ 3217ab25eeb5Syz155240 /* which == 1 : flush TCP connections which have started to close but are */ 3218ab25eeb5Syz155240 /* stuck for some reason. */ 3219ab25eeb5Syz155240 /* which == 2 : flush TCP connections which have been idle for a long time, */ 3220ab25eeb5Syz155240 /* starting at > 4 days idle and working back in successive half-*/ 3221ab25eeb5Syz155240 /* days to at most 12 hours old. If this fails to free enough */ 3222ab25eeb5Syz155240 /* slots then work backwards in half hour slots to 30 minutes. */ 3223ab25eeb5Syz155240 /* If that too fails, then work backwards in 30 second intervals */ 3224ab25eeb5Syz155240 /* for the last 30 minutes to at worst 30 seconds idle. */ 3225ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3226f4b3ec61Sdh155122 static int fr_state_flush(which, proto, ifs) 3227ab25eeb5Syz155240 int which, proto; 3228f4b3ec61Sdh155122 ipf_stack_t *ifs; 3229ab25eeb5Syz155240 { 3230ab25eeb5Syz155240 ipftq_t *ifq, *ifqnext; 3231ab25eeb5Syz155240 ipftqent_t *tqe, *tqn; 3232ab25eeb5Syz155240 ipstate_t *is, **isp; 3233ab25eeb5Syz155240 int delete, removed; 3234ab25eeb5Syz155240 long try, maxtick; 3235ab25eeb5Syz155240 u_long interval; 3236ab25eeb5Syz155240 SPL_INT(s); 3237ab25eeb5Syz155240 3238ab25eeb5Syz155240 removed = 0; 3239ab25eeb5Syz155240 3240ab25eeb5Syz155240 SPL_NET(s); 3241f4b3ec61Sdh155122 for (isp = &ifs->ifs_ips_list; ((is = *isp) != NULL); ) { 3242ab25eeb5Syz155240 delete = 0; 3243ab25eeb5Syz155240 3244ab25eeb5Syz155240 if ((proto != 0) && (is->is_v != proto)) { 3245ab25eeb5Syz155240 isp = &is->is_next; 3246ab25eeb5Syz155240 continue; 3247ab25eeb5Syz155240 } 3248ab25eeb5Syz155240 3249ab25eeb5Syz155240 switch (which) 3250ab25eeb5Syz155240 { 3251ab25eeb5Syz155240 case 0 : 3252ab25eeb5Syz155240 delete = 1; 3253ab25eeb5Syz155240 break; 3254ab25eeb5Syz155240 case 1 : 3255ab25eeb5Syz155240 case 2 : 3256ab25eeb5Syz155240 if (is->is_p != IPPROTO_TCP) 3257ab25eeb5Syz155240 break; 3258ab25eeb5Syz155240 if ((is->is_state[0] != IPF_TCPS_ESTABLISHED) || 3259ab25eeb5Syz155240 (is->is_state[1] != IPF_TCPS_ESTABLISHED)) 3260ab25eeb5Syz155240 delete = 1; 3261ab25eeb5Syz155240 break; 3262ab25eeb5Syz155240 } 3263ab25eeb5Syz155240 3264ab25eeb5Syz155240 if (delete) { 3265ab25eeb5Syz155240 if (is->is_p == IPPROTO_TCP) 3266f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_fin++; 3267ab25eeb5Syz155240 else 3268f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_expire++; 3269f4b3ec61Sdh155122 fr_delstate(is, ISL_FLUSH, ifs); 3270ab25eeb5Syz155240 removed++; 3271ab25eeb5Syz155240 } else 3272ab25eeb5Syz155240 isp = &is->is_next; 3273ab25eeb5Syz155240 } 3274ab25eeb5Syz155240 3275ab25eeb5Syz155240 if (which != 2) { 3276ab25eeb5Syz155240 SPL_X(s); 3277ab25eeb5Syz155240 return removed; 3278ab25eeb5Syz155240 } 3279ab25eeb5Syz155240 3280ab25eeb5Syz155240 /* 3281ab25eeb5Syz155240 * Asked to remove inactive entries because the table is full, try 3282ab25eeb5Syz155240 * again, 3 times, if first attempt failed with a different criteria 3283ab25eeb5Syz155240 * each time. The order tried in must be in decreasing age. 3284ab25eeb5Syz155240 * Another alternative is to implement random drop and drop N entries 3285ab25eeb5Syz155240 * at random until N have been freed up. 3286ab25eeb5Syz155240 */ 3287f4b3ec61Sdh155122 if (ifs->ifs_fr_ticks - ifs->ifs_ips_last_force_flush < IPF_TTLVAL(5)) 3288ab25eeb5Syz155240 goto force_flush_skipped; 3289f4b3ec61Sdh155122 ifs->ifs_ips_last_force_flush = ifs->ifs_fr_ticks; 3290ab25eeb5Syz155240 3291f4b3ec61Sdh155122 if (ifs->ifs_fr_ticks > IPF_TTLVAL(43200)) 3292ab25eeb5Syz155240 interval = IPF_TTLVAL(43200); 3293f4b3ec61Sdh155122 else if (ifs->ifs_fr_ticks > IPF_TTLVAL(1800)) 3294ab25eeb5Syz155240 interval = IPF_TTLVAL(1800); 3295f4b3ec61Sdh155122 else if (ifs->ifs_fr_ticks > IPF_TTLVAL(30)) 3296ab25eeb5Syz155240 interval = IPF_TTLVAL(30); 3297ab25eeb5Syz155240 else 3298ab25eeb5Syz155240 interval = IPF_TTLVAL(10); 3299f4b3ec61Sdh155122 try = ifs->ifs_fr_ticks - (ifs->ifs_fr_ticks - interval); 3300ab25eeb5Syz155240 if (try < 0) 3301ab25eeb5Syz155240 goto force_flush_skipped; 3302ab25eeb5Syz155240 3303ab25eeb5Syz155240 while (removed == 0) { 3304f4b3ec61Sdh155122 maxtick = ifs->ifs_fr_ticks - interval; 3305ab25eeb5Syz155240 if (maxtick < 0) 3306ab25eeb5Syz155240 break; 3307ab25eeb5Syz155240 3308ab25eeb5Syz155240 while (try < maxtick) { 3309f4b3ec61Sdh155122 for (ifq = ifs->ifs_ips_tqtqb; ifq != NULL; 3310ab25eeb5Syz155240 ifq = ifq->ifq_next) { 3311ab25eeb5Syz155240 for (tqn = ifq->ifq_head; 3312ab25eeb5Syz155240 ((tqe = tqn) != NULL); ) { 3313ab25eeb5Syz155240 if (tqe->tqe_die > try) 3314ab25eeb5Syz155240 break; 3315ab25eeb5Syz155240 tqn = tqe->tqe_next; 3316ab25eeb5Syz155240 is = tqe->tqe_parent; 3317f4b3ec61Sdh155122 fr_delstate(is, ISL_EXPIRE, ifs); 3318ab25eeb5Syz155240 removed++; 3319ab25eeb5Syz155240 } 3320ab25eeb5Syz155240 } 3321ab25eeb5Syz155240 3322f4b3ec61Sdh155122 for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) { 3323ab25eeb5Syz155240 ifqnext = ifq->ifq_next; 3324ab25eeb5Syz155240 3325ab25eeb5Syz155240 for (tqn = ifq->ifq_head; 3326ab25eeb5Syz155240 ((tqe = tqn) != NULL); ) { 3327ab25eeb5Syz155240 if (tqe->tqe_die > try) 3328ab25eeb5Syz155240 break; 3329ab25eeb5Syz155240 tqn = tqe->tqe_next; 3330ab25eeb5Syz155240 is = tqe->tqe_parent; 3331f4b3ec61Sdh155122 fr_delstate(is, ISL_EXPIRE, ifs); 3332ab25eeb5Syz155240 removed++; 3333ab25eeb5Syz155240 } 3334ab25eeb5Syz155240 } 3335ab25eeb5Syz155240 if (try + interval > maxtick) 3336ab25eeb5Syz155240 break; 3337ab25eeb5Syz155240 try += interval; 3338ab25eeb5Syz155240 } 3339ab25eeb5Syz155240 3340ab25eeb5Syz155240 if (removed == 0) { 3341ab25eeb5Syz155240 if (interval == IPF_TTLVAL(43200)) { 3342ab25eeb5Syz155240 interval = IPF_TTLVAL(1800); 3343ab25eeb5Syz155240 } else if (interval == IPF_TTLVAL(1800)) { 3344ab25eeb5Syz155240 interval = IPF_TTLVAL(30); 3345ab25eeb5Syz155240 } else if (interval == IPF_TTLVAL(30)) { 3346ab25eeb5Syz155240 interval = IPF_TTLVAL(10); 3347ab25eeb5Syz155240 } else { 3348ab25eeb5Syz155240 break; 3349ab25eeb5Syz155240 } 3350ab25eeb5Syz155240 } 3351ab25eeb5Syz155240 } 3352ab25eeb5Syz155240 force_flush_skipped: 3353ab25eeb5Syz155240 SPL_X(s); 3354ab25eeb5Syz155240 return removed; 3355ab25eeb5Syz155240 } 3356ab25eeb5Syz155240 3357ab25eeb5Syz155240 3358ab25eeb5Syz155240 3359ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3360ab25eeb5Syz155240 /* Function: fr_tcp_age */ 3361ab25eeb5Syz155240 /* Returns: int - 1 == state transition made, 0 == no change (rejected) */ 3362ab25eeb5Syz155240 /* Parameters: tq(I) - pointer to timeout queue information */ 3363ab25eeb5Syz155240 /* fin(I) - pointer to packet information */ 3364ab25eeb5Syz155240 /* tqtab(I) - TCP timeout queue table this is in */ 3365ab25eeb5Syz155240 /* flags(I) - flags from state/NAT entry */ 3366ab25eeb5Syz155240 /* */ 3367ab25eeb5Syz155240 /* Rewritten by Arjan de Vet <Arjan.deVet@adv.iae.nl>, 2000-07-29: */ 3368ab25eeb5Syz155240 /* */ 3369ab25eeb5Syz155240 /* - (try to) base state transitions on real evidence only, */ 3370ab25eeb5Syz155240 /* i.e. packets that are sent and have been received by ipfilter; */ 3371ab25eeb5Syz155240 /* diagram 18.12 of TCP/IP volume 1 by W. Richard Stevens was used. */ 3372ab25eeb5Syz155240 /* */ 3373ab25eeb5Syz155240 /* - deal with half-closed connections correctly; */ 3374ab25eeb5Syz155240 /* */ 3375ab25eeb5Syz155240 /* - store the state of the source in state[0] such that ipfstat */ 3376ab25eeb5Syz155240 /* displays the state as source/dest instead of dest/source; the calls */ 3377ab25eeb5Syz155240 /* to fr_tcp_age have been changed accordingly. */ 3378ab25eeb5Syz155240 /* */ 3379ab25eeb5Syz155240 /* Internal Parameters: */ 3380ab25eeb5Syz155240 /* */ 3381ab25eeb5Syz155240 /* state[0] = state of source (host that initiated connection) */ 3382ab25eeb5Syz155240 /* state[1] = state of dest (host that accepted the connection) */ 3383ab25eeb5Syz155240 /* */ 3384ab25eeb5Syz155240 /* dir == 0 : a packet from source to dest */ 3385ab25eeb5Syz155240 /* dir == 1 : a packet from dest to source */ 3386ab25eeb5Syz155240 /* */ 3387ab25eeb5Syz155240 /* Locking: it is assumed that the parent of the tqe structure is locked. */ 3388ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3389ab25eeb5Syz155240 int fr_tcp_age(tqe, fin, tqtab, flags) 3390ab25eeb5Syz155240 ipftqent_t *tqe; 3391ab25eeb5Syz155240 fr_info_t *fin; 3392ab25eeb5Syz155240 ipftq_t *tqtab; 3393ab25eeb5Syz155240 int flags; 3394ab25eeb5Syz155240 { 3395ab25eeb5Syz155240 int dlen, ostate, nstate, rval, dir; 3396ab25eeb5Syz155240 u_char tcpflags; 3397ab25eeb5Syz155240 tcphdr_t *tcp; 3398f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3399ab25eeb5Syz155240 3400ab25eeb5Syz155240 tcp = fin->fin_dp; 3401ab25eeb5Syz155240 3402ab25eeb5Syz155240 rval = 0; 3403ab25eeb5Syz155240 dir = fin->fin_rev; 3404ab25eeb5Syz155240 tcpflags = tcp->th_flags; 3405ab25eeb5Syz155240 dlen = fin->fin_dlen - (TCP_OFF(tcp) << 2); 3406ab25eeb5Syz155240 3407ab25eeb5Syz155240 if (tcpflags & TH_RST) { 3408ab25eeb5Syz155240 if (!(tcpflags & TH_PUSH) && !dlen) 3409ab25eeb5Syz155240 nstate = IPF_TCPS_CLOSED; 3410ab25eeb5Syz155240 else 3411ab25eeb5Syz155240 nstate = IPF_TCPS_CLOSE_WAIT; 3412ab25eeb5Syz155240 rval = 1; 3413ab25eeb5Syz155240 } else { 3414ab25eeb5Syz155240 ostate = tqe->tqe_state[1 - dir]; 3415ab25eeb5Syz155240 nstate = tqe->tqe_state[dir]; 3416ab25eeb5Syz155240 3417ab25eeb5Syz155240 switch (nstate) 3418ab25eeb5Syz155240 { 3419ab25eeb5Syz155240 case IPF_TCPS_CLOSED: /* 0 */ 3420ab25eeb5Syz155240 if ((tcpflags & TH_OPENING) == TH_OPENING) { 3421ab25eeb5Syz155240 /* 3422ab25eeb5Syz155240 * 'dir' received an S and sends SA in 3423ab25eeb5Syz155240 * response, CLOSED -> SYN_RECEIVED 3424ab25eeb5Syz155240 */ 3425ab25eeb5Syz155240 nstate = IPF_TCPS_SYN_RECEIVED; 3426ab25eeb5Syz155240 rval = 1; 3427ab25eeb5Syz155240 } else if ((tcpflags & TH_OPENING) == TH_SYN) { 3428ab25eeb5Syz155240 /* 'dir' sent S, CLOSED -> SYN_SENT */ 3429ab25eeb5Syz155240 nstate = IPF_TCPS_SYN_SENT; 3430ab25eeb5Syz155240 rval = 1; 3431ab25eeb5Syz155240 } 3432ab25eeb5Syz155240 /* 3433ab25eeb5Syz155240 * the next piece of code makes it possible to get 3434ab25eeb5Syz155240 * already established connections into the state table 3435ab25eeb5Syz155240 * after a restart or reload of the filter rules; this 3436ab25eeb5Syz155240 * does not work when a strict 'flags S keep state' is 3437ab25eeb5Syz155240 * used for tcp connections of course 3438ab25eeb5Syz155240 */ 3439ab25eeb5Syz155240 if (((flags & IS_TCPFSM) == 0) && 3440ab25eeb5Syz155240 ((tcpflags & TH_ACKMASK) == TH_ACK)) { 3441ab25eeb5Syz155240 /* 3442ab25eeb5Syz155240 * we saw an A, guess 'dir' is in ESTABLISHED 3443ab25eeb5Syz155240 * mode 3444ab25eeb5Syz155240 */ 3445ab25eeb5Syz155240 switch (ostate) 3446ab25eeb5Syz155240 { 3447ab25eeb5Syz155240 case IPF_TCPS_CLOSED : 3448ab25eeb5Syz155240 case IPF_TCPS_SYN_RECEIVED : 3449ab25eeb5Syz155240 nstate = IPF_TCPS_HALF_ESTAB; 3450ab25eeb5Syz155240 rval = 1; 3451ab25eeb5Syz155240 break; 3452ab25eeb5Syz155240 case IPF_TCPS_HALF_ESTAB : 3453ab25eeb5Syz155240 case IPF_TCPS_ESTABLISHED : 3454ab25eeb5Syz155240 nstate = IPF_TCPS_ESTABLISHED; 3455ab25eeb5Syz155240 rval = 1; 3456ab25eeb5Syz155240 break; 3457ab25eeb5Syz155240 default : 3458ab25eeb5Syz155240 break; 3459ab25eeb5Syz155240 } 3460ab25eeb5Syz155240 } 3461ab25eeb5Syz155240 /* 3462ab25eeb5Syz155240 * TODO: besides regular ACK packets we can have other 3463ab25eeb5Syz155240 * packets as well; it is yet to be determined how we 3464ab25eeb5Syz155240 * should initialize the states in those cases 3465ab25eeb5Syz155240 */ 3466ab25eeb5Syz155240 break; 3467ab25eeb5Syz155240 3468ab25eeb5Syz155240 case IPF_TCPS_LISTEN: /* 1 */ 3469ab25eeb5Syz155240 /* NOT USED */ 3470ab25eeb5Syz155240 break; 3471ab25eeb5Syz155240 3472ab25eeb5Syz155240 case IPF_TCPS_SYN_SENT: /* 2 */ 3473ab25eeb5Syz155240 if ((tcpflags & ~(TH_ECN|TH_CWR)) == TH_SYN) { 3474ab25eeb5Syz155240 /* 3475ab25eeb5Syz155240 * A retransmitted SYN packet. We do not reset 3476ab25eeb5Syz155240 * the timeout here to fr_tcptimeout because a 3477ab25eeb5Syz155240 * connection connect timeout does not renew 3478ab25eeb5Syz155240 * after every packet that is sent. We need to 3479ab25eeb5Syz155240 * set rval so as to indicate the packet has 3480ab25eeb5Syz155240 * passed the check for its flags being valid 3481ab25eeb5Syz155240 * in the TCP FSM. Setting rval to 2 has the 3482ab25eeb5Syz155240 * result of not resetting the timeout. 3483ab25eeb5Syz155240 */ 3484ab25eeb5Syz155240 rval = 2; 3485ab25eeb5Syz155240 } else if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) == 3486ab25eeb5Syz155240 TH_ACK) { 3487ab25eeb5Syz155240 /* 3488ab25eeb5Syz155240 * we see an A from 'dir' which is in SYN_SENT 3489ab25eeb5Syz155240 * state: 'dir' sent an A in response to an SA 3490ab25eeb5Syz155240 * which it received, SYN_SENT -> ESTABLISHED 3491ab25eeb5Syz155240 */ 3492ab25eeb5Syz155240 nstate = IPF_TCPS_ESTABLISHED; 3493ab25eeb5Syz155240 rval = 1; 3494ab25eeb5Syz155240 } else if (tcpflags & TH_FIN) { 3495ab25eeb5Syz155240 /* 3496ab25eeb5Syz155240 * we see an F from 'dir' which is in SYN_SENT 3497ab25eeb5Syz155240 * state and wants to close its side of the 3498ab25eeb5Syz155240 * connection; SYN_SENT -> FIN_WAIT_1 3499ab25eeb5Syz155240 */ 3500ab25eeb5Syz155240 nstate = IPF_TCPS_FIN_WAIT_1; 3501ab25eeb5Syz155240 rval = 1; 3502ab25eeb5Syz155240 } else if ((tcpflags & TH_OPENING) == TH_OPENING) { 3503ab25eeb5Syz155240 /* 3504ab25eeb5Syz155240 * we see an SA from 'dir' which is already in 3505ab25eeb5Syz155240 * SYN_SENT state, this means we have a 3506ab25eeb5Syz155240 * simultaneous open; SYN_SENT -> SYN_RECEIVED 3507ab25eeb5Syz155240 */ 3508ab25eeb5Syz155240 nstate = IPF_TCPS_SYN_RECEIVED; 3509ab25eeb5Syz155240 rval = 1; 3510ab25eeb5Syz155240 } 3511ab25eeb5Syz155240 break; 3512ab25eeb5Syz155240 3513ab25eeb5Syz155240 case IPF_TCPS_SYN_RECEIVED: /* 3 */ 3514ab25eeb5Syz155240 if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) == TH_ACK) { 3515ab25eeb5Syz155240 /* 3516ab25eeb5Syz155240 * we see an A from 'dir' which was in 3517ab25eeb5Syz155240 * SYN_RECEIVED state so it must now be in 3518ab25eeb5Syz155240 * established state, SYN_RECEIVED -> 3519ab25eeb5Syz155240 * ESTABLISHED 3520ab25eeb5Syz155240 */ 3521ab25eeb5Syz155240 nstate = IPF_TCPS_ESTABLISHED; 3522ab25eeb5Syz155240 rval = 1; 3523ab25eeb5Syz155240 } else if ((tcpflags & ~(TH_ECN|TH_CWR)) == 3524ab25eeb5Syz155240 TH_OPENING) { 3525ab25eeb5Syz155240 /* 3526ab25eeb5Syz155240 * We see an SA from 'dir' which is already in 3527ab25eeb5Syz155240 * SYN_RECEIVED state. 3528ab25eeb5Syz155240 */ 3529ab25eeb5Syz155240 rval = 2; 3530ab25eeb5Syz155240 } else if (tcpflags & TH_FIN) { 3531ab25eeb5Syz155240 /* 3532ab25eeb5Syz155240 * we see an F from 'dir' which is in 3533ab25eeb5Syz155240 * SYN_RECEIVED state and wants to close its 3534ab25eeb5Syz155240 * side of the connection; SYN_RECEIVED -> 3535ab25eeb5Syz155240 * FIN_WAIT_1 3536ab25eeb5Syz155240 */ 3537ab25eeb5Syz155240 nstate = IPF_TCPS_FIN_WAIT_1; 3538ab25eeb5Syz155240 rval = 1; 3539ab25eeb5Syz155240 } 3540ab25eeb5Syz155240 break; 3541ab25eeb5Syz155240 3542ab25eeb5Syz155240 case IPF_TCPS_HALF_ESTAB: /* 4 */ 3543ab25eeb5Syz155240 if (ostate >= IPF_TCPS_HALF_ESTAB) { 3544ab25eeb5Syz155240 if ((tcpflags & TH_ACKMASK) == TH_ACK) { 3545ab25eeb5Syz155240 nstate = IPF_TCPS_ESTABLISHED; 3546ab25eeb5Syz155240 rval = 1; 3547ab25eeb5Syz155240 } 3548ab25eeb5Syz155240 } 3549ab25eeb5Syz155240 3550ab25eeb5Syz155240 break; 3551ab25eeb5Syz155240 3552ab25eeb5Syz155240 case IPF_TCPS_ESTABLISHED: /* 5 */ 3553ab25eeb5Syz155240 rval = 1; 3554ab25eeb5Syz155240 if (tcpflags & TH_FIN) { 3555ab25eeb5Syz155240 /* 3556ab25eeb5Syz155240 * 'dir' closed its side of the connection; 3557ab25eeb5Syz155240 * this gives us a half-closed connection; 3558ab25eeb5Syz155240 * ESTABLISHED -> FIN_WAIT_1 3559ab25eeb5Syz155240 */ 3560ab25eeb5Syz155240 nstate = IPF_TCPS_FIN_WAIT_1; 3561ab25eeb5Syz155240 } else if (tcpflags & TH_ACK) { 3562ab25eeb5Syz155240 /* 3563ab25eeb5Syz155240 * an ACK, should we exclude other flags here? 3564ab25eeb5Syz155240 */ 3565ab25eeb5Syz155240 if (ostate == IPF_TCPS_FIN_WAIT_1) { 3566ab25eeb5Syz155240 /* 3567ab25eeb5Syz155240 * We know the other side did an active 3568ab25eeb5Syz155240 * close, so we are ACKing the recvd 3569ab25eeb5Syz155240 * FIN packet (does the window matching 3570ab25eeb5Syz155240 * code guarantee this?) and go into 3571ab25eeb5Syz155240 * CLOSE_WAIT state; this gives us a 3572ab25eeb5Syz155240 * half-closed connection 3573ab25eeb5Syz155240 */ 3574ab25eeb5Syz155240 nstate = IPF_TCPS_CLOSE_WAIT; 3575ab25eeb5Syz155240 } else if (ostate < IPF_TCPS_CLOSE_WAIT) { 3576ab25eeb5Syz155240 /* 3577ab25eeb5Syz155240 * still a fully established 3578ab25eeb5Syz155240 * connection reset timeout 3579ab25eeb5Syz155240 */ 3580ab25eeb5Syz155240 nstate = IPF_TCPS_ESTABLISHED; 3581ab25eeb5Syz155240 } 3582ab25eeb5Syz155240 } 3583ab25eeb5Syz155240 break; 3584ab25eeb5Syz155240 3585ab25eeb5Syz155240 case IPF_TCPS_CLOSE_WAIT: /* 6 */ 3586ab25eeb5Syz155240 rval = 1; 3587ab25eeb5Syz155240 if (tcpflags & TH_FIN) { 3588ab25eeb5Syz155240 /* 3589ab25eeb5Syz155240 * application closed and 'dir' sent a FIN, 3590ab25eeb5Syz155240 * we're now going into LAST_ACK state 3591ab25eeb5Syz155240 */ 3592ab25eeb5Syz155240 nstate = IPF_TCPS_LAST_ACK; 3593ab25eeb5Syz155240 } else { 3594ab25eeb5Syz155240 /* 3595ab25eeb5Syz155240 * we remain in CLOSE_WAIT because the other 3596ab25eeb5Syz155240 * side has closed already and we did not 3597ab25eeb5Syz155240 * close our side yet; reset timeout 3598ab25eeb5Syz155240 */ 3599ab25eeb5Syz155240 nstate = IPF_TCPS_CLOSE_WAIT; 3600ab25eeb5Syz155240 } 3601ab25eeb5Syz155240 break; 3602ab25eeb5Syz155240 3603ab25eeb5Syz155240 case IPF_TCPS_FIN_WAIT_1: /* 7 */ 3604ab25eeb5Syz155240 rval = 1; 3605ab25eeb5Syz155240 if ((tcpflags & TH_ACK) && 3606ab25eeb5Syz155240 ostate > IPF_TCPS_CLOSE_WAIT) { 3607ab25eeb5Syz155240 /* 3608ab25eeb5Syz155240 * if the other side is not active anymore 3609ab25eeb5Syz155240 * it has sent us a FIN packet that we are 3610ab25eeb5Syz155240 * ack'ing now with an ACK; this means both 3611ab25eeb5Syz155240 * sides have now closed the connection and 3612ab25eeb5Syz155240 * we go into TIME_WAIT 3613ab25eeb5Syz155240 */ 3614ab25eeb5Syz155240 /* 3615ab25eeb5Syz155240 * XXX: how do we know we really are ACKing 3616ab25eeb5Syz155240 * the FIN packet here? does the window code 3617ab25eeb5Syz155240 * guarantee that? 3618ab25eeb5Syz155240 */ 3619ab25eeb5Syz155240 nstate = IPF_TCPS_TIME_WAIT; 3620ab25eeb5Syz155240 } else { 3621ab25eeb5Syz155240 /* 3622ab25eeb5Syz155240 * we closed our side of the connection 3623ab25eeb5Syz155240 * already but the other side is still active 3624ab25eeb5Syz155240 * (ESTABLISHED/CLOSE_WAIT); continue with 3625ab25eeb5Syz155240 * this half-closed connection 3626ab25eeb5Syz155240 */ 3627ab25eeb5Syz155240 nstate = IPF_TCPS_FIN_WAIT_1; 3628ab25eeb5Syz155240 } 3629ab25eeb5Syz155240 break; 3630ab25eeb5Syz155240 3631ab25eeb5Syz155240 case IPF_TCPS_CLOSING: /* 8 */ 3632ab25eeb5Syz155240 /* NOT USED */ 3633ab25eeb5Syz155240 break; 3634ab25eeb5Syz155240 3635ab25eeb5Syz155240 case IPF_TCPS_LAST_ACK: /* 9 */ 3636ab25eeb5Syz155240 if (tcpflags & TH_ACK) { 3637ab25eeb5Syz155240 if ((tcpflags & TH_PUSH) || dlen) 3638ab25eeb5Syz155240 /* 3639ab25eeb5Syz155240 * there is still data to be delivered, 3640ab25eeb5Syz155240 * reset timeout 3641ab25eeb5Syz155240 */ 3642ab25eeb5Syz155240 rval = 1; 3643ab25eeb5Syz155240 else 3644ab25eeb5Syz155240 rval = 2; 3645ab25eeb5Syz155240 } 3646ab25eeb5Syz155240 /* 3647ab25eeb5Syz155240 * we cannot detect when we go out of LAST_ACK state to 3648ab25eeb5Syz155240 * CLOSED because that is based on the reception of ACK 3649ab25eeb5Syz155240 * packets; ipfilter can only detect that a packet 3650ab25eeb5Syz155240 * has been sent by a host 3651ab25eeb5Syz155240 */ 3652ab25eeb5Syz155240 break; 3653ab25eeb5Syz155240 3654ab25eeb5Syz155240 case IPF_TCPS_FIN_WAIT_2: /* 10 */ 3655ab25eeb5Syz155240 rval = 1; 3656ab25eeb5Syz155240 if ((tcpflags & TH_OPENING) == TH_OPENING) 3657ab25eeb5Syz155240 nstate = IPF_TCPS_SYN_RECEIVED; 3658ab25eeb5Syz155240 else if (tcpflags & TH_SYN) 3659ab25eeb5Syz155240 nstate = IPF_TCPS_SYN_SENT; 3660ab25eeb5Syz155240 break; 3661ab25eeb5Syz155240 3662ab25eeb5Syz155240 case IPF_TCPS_TIME_WAIT: /* 11 */ 3663ab25eeb5Syz155240 /* we're in 2MSL timeout now */ 3664ab25eeb5Syz155240 rval = 1; 3665ab25eeb5Syz155240 break; 3666ab25eeb5Syz155240 3667ab25eeb5Syz155240 default : 3668ab25eeb5Syz155240 #if defined(_KERNEL) 3669ab25eeb5Syz155240 # if SOLARIS 3670ab25eeb5Syz155240 cmn_err(CE_NOTE, 3671ab25eeb5Syz155240 "tcp %lx flags %x si %lx nstate %d ostate %d\n", 3672ab25eeb5Syz155240 (u_long)tcp, tcpflags, (u_long)tqe, 3673ab25eeb5Syz155240 nstate, ostate); 3674ab25eeb5Syz155240 # else 3675ab25eeb5Syz155240 printf("tcp %lx flags %x si %lx nstate %d ostate %d\n", 3676ab25eeb5Syz155240 (u_long)tcp, tcpflags, (u_long)tqe, 3677ab25eeb5Syz155240 nstate, ostate); 3678ab25eeb5Syz155240 # endif 3679ab25eeb5Syz155240 #else 3680ab25eeb5Syz155240 abort(); 3681ab25eeb5Syz155240 #endif 3682ab25eeb5Syz155240 break; 3683ab25eeb5Syz155240 } 3684ab25eeb5Syz155240 } 3685ab25eeb5Syz155240 3686ab25eeb5Syz155240 /* 3687ab25eeb5Syz155240 * If rval == 2 then do not update the queue position, but treat the 3688ab25eeb5Syz155240 * packet as being ok. 3689ab25eeb5Syz155240 */ 3690ab25eeb5Syz155240 if (rval == 2) 3691ab25eeb5Syz155240 rval = 1; 3692ab25eeb5Syz155240 else if (rval == 1) { 3693ab25eeb5Syz155240 tqe->tqe_state[dir] = nstate; 3694ab25eeb5Syz155240 if ((tqe->tqe_flags & TQE_RULEBASED) == 0) 3695f4b3ec61Sdh155122 fr_movequeue(tqe, tqe->tqe_ifq, tqtab + nstate, ifs); 3696ab25eeb5Syz155240 } 3697ab25eeb5Syz155240 3698ab25eeb5Syz155240 return rval; 3699ab25eeb5Syz155240 } 3700ab25eeb5Syz155240 3701ab25eeb5Syz155240 3702ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3703ab25eeb5Syz155240 /* Function: ipstate_log */ 3704ab25eeb5Syz155240 /* Returns: Nil */ 3705ab25eeb5Syz155240 /* Parameters: is(I) - pointer to state structure */ 3706ab25eeb5Syz155240 /* type(I) - type of log entry to create */ 3707ab25eeb5Syz155240 /* */ 3708ab25eeb5Syz155240 /* Creates a state table log entry using the state structure and type info. */ 3709ab25eeb5Syz155240 /* passed in. Log packet/byte counts, source/destination address and other */ 3710ab25eeb5Syz155240 /* protocol specific information. */ 3711ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3712f4b3ec61Sdh155122 void ipstate_log(is, type, ifs) 3713ab25eeb5Syz155240 struct ipstate *is; 3714ab25eeb5Syz155240 u_int type; 3715f4b3ec61Sdh155122 ipf_stack_t *ifs; 3716ab25eeb5Syz155240 { 3717ab25eeb5Syz155240 #ifdef IPFILTER_LOG 3718ab25eeb5Syz155240 struct ipslog ipsl; 3719ab25eeb5Syz155240 size_t sizes[1]; 3720ab25eeb5Syz155240 void *items[1]; 3721ab25eeb5Syz155240 int types[1]; 3722ab25eeb5Syz155240 3723ab25eeb5Syz155240 /* 3724ab25eeb5Syz155240 * Copy information out of the ipstate_t structure and into the 3725ab25eeb5Syz155240 * structure used for logging. 3726ab25eeb5Syz155240 */ 3727ab25eeb5Syz155240 ipsl.isl_type = type; 3728ab25eeb5Syz155240 ipsl.isl_pkts[0] = is->is_pkts[0] + is->is_icmppkts[0]; 3729ab25eeb5Syz155240 ipsl.isl_bytes[0] = is->is_bytes[0]; 3730ab25eeb5Syz155240 ipsl.isl_pkts[1] = is->is_pkts[1] + is->is_icmppkts[1]; 3731ab25eeb5Syz155240 ipsl.isl_bytes[1] = is->is_bytes[1]; 3732ab25eeb5Syz155240 ipsl.isl_pkts[2] = is->is_pkts[2] + is->is_icmppkts[2]; 3733ab25eeb5Syz155240 ipsl.isl_bytes[2] = is->is_bytes[2]; 3734ab25eeb5Syz155240 ipsl.isl_pkts[3] = is->is_pkts[3] + is->is_icmppkts[3]; 3735ab25eeb5Syz155240 ipsl.isl_bytes[3] = is->is_bytes[3]; 3736ab25eeb5Syz155240 ipsl.isl_src = is->is_src; 3737ab25eeb5Syz155240 ipsl.isl_dst = is->is_dst; 3738ab25eeb5Syz155240 ipsl.isl_p = is->is_p; 3739ab25eeb5Syz155240 ipsl.isl_v = is->is_v; 3740ab25eeb5Syz155240 ipsl.isl_flags = is->is_flags; 3741ab25eeb5Syz155240 ipsl.isl_tag = is->is_tag; 3742ab25eeb5Syz155240 ipsl.isl_rulen = is->is_rulen; 3743ab25eeb5Syz155240 (void) strncpy(ipsl.isl_group, is->is_group, FR_GROUPLEN); 3744ab25eeb5Syz155240 3745ab25eeb5Syz155240 if (ipsl.isl_p == IPPROTO_TCP || ipsl.isl_p == IPPROTO_UDP) { 3746ab25eeb5Syz155240 ipsl.isl_sport = is->is_sport; 3747ab25eeb5Syz155240 ipsl.isl_dport = is->is_dport; 3748ab25eeb5Syz155240 if (ipsl.isl_p == IPPROTO_TCP) { 3749ab25eeb5Syz155240 ipsl.isl_state[0] = is->is_state[0]; 3750ab25eeb5Syz155240 ipsl.isl_state[1] = is->is_state[1]; 3751ab25eeb5Syz155240 } 3752ab25eeb5Syz155240 } else if (ipsl.isl_p == IPPROTO_ICMP) { 3753ab25eeb5Syz155240 ipsl.isl_itype = is->is_icmp.ici_type; 3754ab25eeb5Syz155240 } else if (ipsl.isl_p == IPPROTO_ICMPV6) { 3755ab25eeb5Syz155240 ipsl.isl_itype = is->is_icmp.ici_type; 3756ab25eeb5Syz155240 } else { 3757ab25eeb5Syz155240 ipsl.isl_ps.isl_filler[0] = 0; 3758ab25eeb5Syz155240 ipsl.isl_ps.isl_filler[1] = 0; 3759ab25eeb5Syz155240 } 3760ab25eeb5Syz155240 3761ab25eeb5Syz155240 items[0] = &ipsl; 3762ab25eeb5Syz155240 sizes[0] = sizeof(ipsl); 3763ab25eeb5Syz155240 types[0] = 0; 3764ab25eeb5Syz155240 3765f4b3ec61Sdh155122 if (ipllog(IPL_LOGSTATE, NULL, items, sizes, types, 1, ifs)) { 3766f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_logged); 3767ab25eeb5Syz155240 } else { 3768f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_ips_stats.iss_logfail); 3769ab25eeb5Syz155240 } 3770ab25eeb5Syz155240 #endif 3771ab25eeb5Syz155240 } 3772ab25eeb5Syz155240 3773ab25eeb5Syz155240 3774ab25eeb5Syz155240 #ifdef USE_INET6 3775ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3776ab25eeb5Syz155240 /* Function: fr_checkicmp6matchingstate */ 3777ab25eeb5Syz155240 /* Returns: ipstate_t* - NULL == no match found, */ 3778ab25eeb5Syz155240 /* else pointer to matching state entry */ 3779ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 3780ab25eeb5Syz155240 /* Locks: NULL == no locks, else Read Lock on ipf_state */ 3781ab25eeb5Syz155240 /* */ 3782ab25eeb5Syz155240 /* If we've got an ICMPv6 error message, using the information stored in */ 3783ab25eeb5Syz155240 /* the ICMPv6 packet, look for a matching state table entry. */ 3784ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3785ab25eeb5Syz155240 static ipstate_t *fr_checkicmp6matchingstate(fin) 3786ab25eeb5Syz155240 fr_info_t *fin; 3787ab25eeb5Syz155240 { 3788ab25eeb5Syz155240 struct icmp6_hdr *ic6, *oic; 3789ab25eeb5Syz155240 int backward, i; 3790ab25eeb5Syz155240 ipstate_t *is, **isp; 3791ab25eeb5Syz155240 u_short sport, dport; 3792ab25eeb5Syz155240 i6addr_t dst, src; 3793ab25eeb5Syz155240 u_short savelen; 3794ab25eeb5Syz155240 icmpinfo_t *ic; 3795ab25eeb5Syz155240 fr_info_t ofin; 3796ab25eeb5Syz155240 tcphdr_t *tcp; 3797ab25eeb5Syz155240 ip6_t *oip6; 3798ab25eeb5Syz155240 u_char pr; 3799ab25eeb5Syz155240 u_int hv; 3800f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3801ab25eeb5Syz155240 3802ab25eeb5Syz155240 /* 3803ab25eeb5Syz155240 * Does it at least have the return (basic) IP header ? 3804ab25eeb5Syz155240 * Is it an actual recognised ICMP error type? 3805ab25eeb5Syz155240 * Only a basic IP header (no options) should be with 3806ab25eeb5Syz155240 * an ICMP error header. 3807ab25eeb5Syz155240 */ 3808ab25eeb5Syz155240 if ((fin->fin_v != 6) || (fin->fin_plen < ICMP6ERR_MINPKTLEN) || 3809ab25eeb5Syz155240 !(fin->fin_flx & FI_ICMPERR)) 3810ab25eeb5Syz155240 return NULL; 3811ab25eeb5Syz155240 3812ab25eeb5Syz155240 ic6 = fin->fin_dp; 3813ab25eeb5Syz155240 3814ab25eeb5Syz155240 oip6 = (ip6_t *)((char *)ic6 + ICMPERR_ICMPHLEN); 3815ab25eeb5Syz155240 if (fin->fin_plen < sizeof(*oip6)) 3816ab25eeb5Syz155240 return NULL; 3817ab25eeb5Syz155240 38186f8d8657Szf203873 bcopy((char *)fin, (char *)&ofin, sizeof(*fin)); 3819ab25eeb5Syz155240 ofin.fin_v = 6; 3820ab25eeb5Syz155240 ofin.fin_ifp = fin->fin_ifp; 3821ab25eeb5Syz155240 ofin.fin_out = !fin->fin_out; 3822ab25eeb5Syz155240 ofin.fin_m = NULL; /* if dereferenced, panic XXX */ 3823ab25eeb5Syz155240 ofin.fin_mp = NULL; /* if dereferenced, panic XXX */ 3824ab25eeb5Syz155240 3825ab25eeb5Syz155240 /* 3826ab25eeb5Syz155240 * We make a fin entry to be able to feed it to 3827ab25eeb5Syz155240 * matchsrcdst. Note that not all fields are necessary 3828ab25eeb5Syz155240 * but this is the cleanest way. Note further we fill 3829ab25eeb5Syz155240 * in fin_mp such that if someone uses it we'll get 3830ab25eeb5Syz155240 * a kernel panic. fr_matchsrcdst does not use this. 3831ab25eeb5Syz155240 * 3832ab25eeb5Syz155240 * watch out here, as ip is in host order and oip6 in network 3833ab25eeb5Syz155240 * order. Any change we make must be undone afterwards. 3834ab25eeb5Syz155240 */ 3835ab25eeb5Syz155240 savelen = oip6->ip6_plen; 3836ab25eeb5Syz155240 oip6->ip6_plen = fin->fin_dlen - ICMPERR_ICMPHLEN; 3837ab25eeb5Syz155240 ofin.fin_flx = FI_NOCKSUM; 3838ab25eeb5Syz155240 ofin.fin_ip = (ip_t *)oip6; 3839ab25eeb5Syz155240 ofin.fin_plen = oip6->ip6_plen; 3840ab25eeb5Syz155240 (void) fr_makefrip(sizeof(*oip6), (ip_t *)oip6, &ofin); 3841ab25eeb5Syz155240 ofin.fin_flx &= ~(FI_BAD|FI_SHORT); 3842ab25eeb5Syz155240 oip6->ip6_plen = savelen; 3843ab25eeb5Syz155240 3844ab25eeb5Syz155240 if (oip6->ip6_nxt == IPPROTO_ICMPV6) { 3845ab25eeb5Syz155240 oic = (struct icmp6_hdr *)(oip6 + 1); 3846ab25eeb5Syz155240 /* 3847ab25eeb5Syz155240 * an ICMP error can only be generated as a result of an 3848ab25eeb5Syz155240 * ICMP query, not as the response on an ICMP error 3849ab25eeb5Syz155240 * 3850ab25eeb5Syz155240 * XXX theoretically ICMP_ECHOREP and the other reply's are 3851ab25eeb5Syz155240 * ICMP query's as well, but adding them here seems strange XXX 3852ab25eeb5Syz155240 */ 3853ab25eeb5Syz155240 if (!(oic->icmp6_type & ICMP6_INFOMSG_MASK)) 3854ab25eeb5Syz155240 return NULL; 3855ab25eeb5Syz155240 3856ab25eeb5Syz155240 /* 3857ab25eeb5Syz155240 * perform a lookup of the ICMP packet in the state table 3858ab25eeb5Syz155240 */ 3859ab25eeb5Syz155240 hv = (pr = oip6->ip6_nxt); 3860ab25eeb5Syz155240 src.in6 = oip6->ip6_src; 3861ab25eeb5Syz155240 hv += src.in4.s_addr; 3862ab25eeb5Syz155240 dst.in6 = oip6->ip6_dst; 3863ab25eeb5Syz155240 hv += dst.in4.s_addr; 3864ab25eeb5Syz155240 hv += oic->icmp6_id; 3865ab25eeb5Syz155240 hv += oic->icmp6_seq; 3866f4b3ec61Sdh155122 hv = DOUBLE_HASH(hv, ifs); 3867ab25eeb5Syz155240 3868f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 3869f4b3ec61Sdh155122 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) { 3870ab25eeb5Syz155240 ic = &is->is_icmp; 3871ab25eeb5Syz155240 isp = &is->is_hnext; 3872ab25eeb5Syz155240 if ((is->is_p == pr) && 3873ab25eeb5Syz155240 !(is->is_pass & FR_NOICMPERR) && 3874ab25eeb5Syz155240 (oic->icmp6_id == ic->ici_id) && 3875ab25eeb5Syz155240 (oic->icmp6_seq == ic->ici_seq) && 3876ab25eeb5Syz155240 (is = fr_matchsrcdst(&ofin, is, &src, 3877ab25eeb5Syz155240 &dst, NULL, FI_ICMPCMP))) { 3878ab25eeb5Syz155240 /* 3879ab25eeb5Syz155240 * in the state table ICMP query's are stored 3880ab25eeb5Syz155240 * with the type of the corresponding ICMP 3881ab25eeb5Syz155240 * response. Correct here 3882ab25eeb5Syz155240 */ 3883ab25eeb5Syz155240 if (((ic->ici_type == ICMP6_ECHO_REPLY) && 3884ab25eeb5Syz155240 (oic->icmp6_type == ICMP6_ECHO_REQUEST)) || 3885ab25eeb5Syz155240 (ic->ici_type - 1 == oic->icmp6_type )) { 3886f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_hits++; 3887ab25eeb5Syz155240 backward = IP6_NEQ(&is->is_dst, &src); 3888ab25eeb5Syz155240 fin->fin_rev = !backward; 3889ab25eeb5Syz155240 i = (backward << 1) + fin->fin_out; 3890ab25eeb5Syz155240 is->is_icmppkts[i]++; 3891ab25eeb5Syz155240 return is; 3892ab25eeb5Syz155240 } 3893ab25eeb5Syz155240 } 3894ab25eeb5Syz155240 } 3895f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 3896ab25eeb5Syz155240 return NULL; 3897ab25eeb5Syz155240 } 3898ab25eeb5Syz155240 3899ab25eeb5Syz155240 hv = (pr = oip6->ip6_nxt); 3900ab25eeb5Syz155240 src.in6 = oip6->ip6_src; 3901ab25eeb5Syz155240 hv += src.i6[0]; 3902ab25eeb5Syz155240 hv += src.i6[1]; 3903ab25eeb5Syz155240 hv += src.i6[2]; 3904ab25eeb5Syz155240 hv += src.i6[3]; 3905ab25eeb5Syz155240 dst.in6 = oip6->ip6_dst; 3906ab25eeb5Syz155240 hv += dst.i6[0]; 3907ab25eeb5Syz155240 hv += dst.i6[1]; 3908ab25eeb5Syz155240 hv += dst.i6[2]; 3909ab25eeb5Syz155240 hv += dst.i6[3]; 3910ab25eeb5Syz155240 3911ab25eeb5Syz155240 if ((oip6->ip6_nxt == IPPROTO_TCP) || (oip6->ip6_nxt == IPPROTO_UDP)) { 3912ab25eeb5Syz155240 tcp = (tcphdr_t *)(oip6 + 1); 3913ab25eeb5Syz155240 dport = tcp->th_dport; 3914ab25eeb5Syz155240 sport = tcp->th_sport; 3915ab25eeb5Syz155240 hv += dport; 3916ab25eeb5Syz155240 hv += sport; 3917ab25eeb5Syz155240 } else 3918ab25eeb5Syz155240 tcp = NULL; 3919f4b3ec61Sdh155122 hv = DOUBLE_HASH(hv, ifs); 3920ab25eeb5Syz155240 3921f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 3922f4b3ec61Sdh155122 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) { 3923ab25eeb5Syz155240 isp = &is->is_hnext; 3924ab25eeb5Syz155240 /* 3925ab25eeb5Syz155240 * Only allow this icmp though if the 3926ab25eeb5Syz155240 * encapsulated packet was allowed through the 3927ab25eeb5Syz155240 * other way around. Note that the minimal amount 3928ab25eeb5Syz155240 * of info present does not allow for checking against 3929ab25eeb5Syz155240 * tcp internals such as seq and ack numbers. 3930ab25eeb5Syz155240 */ 3931ab25eeb5Syz155240 if ((is->is_p != pr) || (is->is_v != 6) || 3932ab25eeb5Syz155240 (is->is_pass & FR_NOICMPERR)) 3933ab25eeb5Syz155240 continue; 3934ab25eeb5Syz155240 is = fr_matchsrcdst(&ofin, is, &src, &dst, tcp, FI_ICMPCMP); 3935ab25eeb5Syz155240 if (is != NULL) { 3936f4b3ec61Sdh155122 ifs->ifs_ips_stats.iss_hits++; 3937ab25eeb5Syz155240 backward = IP6_NEQ(&is->is_dst, &src); 3938ab25eeb5Syz155240 fin->fin_rev = !backward; 3939ab25eeb5Syz155240 i = (backward << 1) + fin->fin_out; 3940ab25eeb5Syz155240 is->is_icmppkts[i]++; 3941ab25eeb5Syz155240 /* 3942ab25eeb5Syz155240 * we deliberately do not touch the timeouts 3943ab25eeb5Syz155240 * for the accompanying state table entry. 3944ab25eeb5Syz155240 * It remains to be seen if that is correct. XXX 3945ab25eeb5Syz155240 */ 3946ab25eeb5Syz155240 return is; 3947ab25eeb5Syz155240 } 3948ab25eeb5Syz155240 } 3949f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 3950ab25eeb5Syz155240 return NULL; 3951ab25eeb5Syz155240 } 3952ab25eeb5Syz155240 #endif 3953ab25eeb5Syz155240 3954ab25eeb5Syz155240 3955ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3956ab25eeb5Syz155240 /* Function: fr_sttab_init */ 3957ab25eeb5Syz155240 /* Returns: Nil */ 3958ab25eeb5Syz155240 /* Parameters: tqp(I) - pointer to an array of timeout queues for TCP */ 3959ab25eeb5Syz155240 /* */ 3960ab25eeb5Syz155240 /* Initialise the array of timeout queues for TCP. */ 3961ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3962f4b3ec61Sdh155122 void fr_sttab_init(tqp, ifs) 3963ab25eeb5Syz155240 ipftq_t *tqp; 3964f4b3ec61Sdh155122 ipf_stack_t *ifs; 3965ab25eeb5Syz155240 { 3966ab25eeb5Syz155240 int i; 3967ab25eeb5Syz155240 3968ab25eeb5Syz155240 for (i = IPF_TCP_NSTATES - 1; i >= 0; i--) { 3969ab25eeb5Syz155240 tqp[i].ifq_ttl = 0; 3970ab25eeb5Syz155240 tqp[i].ifq_ref = 1; 3971ab25eeb5Syz155240 tqp[i].ifq_head = NULL; 3972ab25eeb5Syz155240 tqp[i].ifq_tail = &tqp[i].ifq_head; 3973ab25eeb5Syz155240 tqp[i].ifq_next = tqp + i + 1; 3974ab25eeb5Syz155240 MUTEX_INIT(&tqp[i].ifq_lock, "ipftq tcp tab"); 3975ab25eeb5Syz155240 } 3976ab25eeb5Syz155240 tqp[IPF_TCP_NSTATES - 1].ifq_next = NULL; 3977f4b3ec61Sdh155122 tqp[IPF_TCPS_CLOSED].ifq_ttl = ifs->ifs_fr_tcpclosed; 3978f4b3ec61Sdh155122 tqp[IPF_TCPS_LISTEN].ifq_ttl = ifs->ifs_fr_tcptimeout; 3979f4b3ec61Sdh155122 tqp[IPF_TCPS_SYN_SENT].ifq_ttl = ifs->ifs_fr_tcptimeout; 3980f4b3ec61Sdh155122 tqp[IPF_TCPS_SYN_RECEIVED].ifq_ttl = ifs->ifs_fr_tcptimeout; 3981f4b3ec61Sdh155122 tqp[IPF_TCPS_ESTABLISHED].ifq_ttl = ifs->ifs_fr_tcpidletimeout; 3982f4b3ec61Sdh155122 tqp[IPF_TCPS_CLOSE_WAIT].ifq_ttl = ifs->ifs_fr_tcphalfclosed; 3983f4b3ec61Sdh155122 tqp[IPF_TCPS_FIN_WAIT_1].ifq_ttl = ifs->ifs_fr_tcphalfclosed; 3984f4b3ec61Sdh155122 tqp[IPF_TCPS_CLOSING].ifq_ttl = ifs->ifs_fr_tcptimeout; 3985f4b3ec61Sdh155122 tqp[IPF_TCPS_LAST_ACK].ifq_ttl = ifs->ifs_fr_tcplastack; 3986f4b3ec61Sdh155122 tqp[IPF_TCPS_FIN_WAIT_2].ifq_ttl = ifs->ifs_fr_tcpclosewait; 3987f4b3ec61Sdh155122 tqp[IPF_TCPS_TIME_WAIT].ifq_ttl = ifs->ifs_fr_tcptimeout; 3988f4b3ec61Sdh155122 tqp[IPF_TCPS_HALF_ESTAB].ifq_ttl = ifs->ifs_fr_tcptimeout; 3989ab25eeb5Syz155240 } 3990ab25eeb5Syz155240 3991ab25eeb5Syz155240 3992ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3993ab25eeb5Syz155240 /* Function: fr_sttab_destroy */ 3994ab25eeb5Syz155240 /* Returns: Nil */ 3995ab25eeb5Syz155240 /* Parameters: tqp(I) - pointer to an array of timeout queues for TCP */ 3996ab25eeb5Syz155240 /* */ 3997ab25eeb5Syz155240 /* Do whatever is necessary to "destroy" each of the entries in the array */ 3998ab25eeb5Syz155240 /* of timeout queues for TCP. */ 3999ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4000ab25eeb5Syz155240 void fr_sttab_destroy(tqp) 4001ab25eeb5Syz155240 ipftq_t *tqp; 4002ab25eeb5Syz155240 { 4003ab25eeb5Syz155240 int i; 4004ab25eeb5Syz155240 4005ab25eeb5Syz155240 for (i = IPF_TCP_NSTATES - 1; i >= 0; i--) 4006ab25eeb5Syz155240 MUTEX_DESTROY(&tqp[i].ifq_lock); 4007ab25eeb5Syz155240 } 4008ab25eeb5Syz155240 4009ab25eeb5Syz155240 4010ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4011ab25eeb5Syz155240 /* Function: fr_statederef */ 4012ab25eeb5Syz155240 /* Returns: Nil */ 4013ab25eeb5Syz155240 /* Parameters: isp(I) - pointer to pointer to state table entry */ 401490b0a856Sjojemann /* ifs - ipf stack instance */ 4015ab25eeb5Syz155240 /* */ 4016ab25eeb5Syz155240 /* Decrement the reference counter for this state table entry and free it */ 4017ab25eeb5Syz155240 /* if there are no more things using it. */ 4018ab25eeb5Syz155240 /* */ 4019ab25eeb5Syz155240 /* Internal parameters: */ 4020ab25eeb5Syz155240 /* state[0] = state of source (host that initiated connection) */ 4021ab25eeb5Syz155240 /* state[1] = state of dest (host that accepted the connection) */ 4022ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 402390b0a856Sjojemann void fr_statederef(isp, ifs) 4024ab25eeb5Syz155240 ipstate_t **isp; 4025f4b3ec61Sdh155122 ipf_stack_t *ifs; 4026ab25eeb5Syz155240 { 402790b0a856Sjojemann ipstate_t *is; 4028ab25eeb5Syz155240 4029ab25eeb5Syz155240 is = *isp; 4030ab25eeb5Syz155240 *isp = NULL; 40310e01ff8bSdr146992 40320e01ff8bSdr146992 MUTEX_ENTER(&is->is_lock); 40330e01ff8bSdr146992 if (is->is_ref > 1) { 4034ab25eeb5Syz155240 is->is_ref--; 40350e01ff8bSdr146992 MUTEX_EXIT(&is->is_lock); 4036ab25eeb5Syz155240 #ifndef _KERNEL 40370e01ff8bSdr146992 if ((is->is_sti.tqe_state[0] > IPF_TCPS_ESTABLISHED) || 4038ab25eeb5Syz155240 (is->is_sti.tqe_state[1] > IPF_TCPS_ESTABLISHED)) { 4039f4b3ec61Sdh155122 fr_delstate(is, ISL_ORPHAN, ifs); 4040ab25eeb5Syz155240 } 40410e01ff8bSdr146992 #endif 40420e01ff8bSdr146992 return; 40430e01ff8bSdr146992 } 40440e01ff8bSdr146992 MUTEX_EXIT(&is->is_lock); 40450e01ff8bSdr146992 40460e01ff8bSdr146992 WRITE_ENTER(&ifs->ifs_ipf_state); 40470e01ff8bSdr146992 fr_delstate(is, ISL_EXPIRE, ifs); 4048f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 4049ab25eeb5Syz155240 } 4050ab25eeb5Syz155240 4051ab25eeb5Syz155240 4052ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4053ab25eeb5Syz155240 /* Function: fr_setstatequeue */ 4054ab25eeb5Syz155240 /* Returns: Nil */ 4055ab25eeb5Syz155240 /* Parameters: is(I) - pointer to state structure */ 4056ab25eeb5Syz155240 /* rev(I) - forward(0) or reverse(1) direction */ 4057ab25eeb5Syz155240 /* Locks: ipf_state (read or write) */ 4058ab25eeb5Syz155240 /* */ 4059ab25eeb5Syz155240 /* Put the state entry on its default queue entry, using rev as a helped in */ 4060ab25eeb5Syz155240 /* determining which queue it should be placed on. */ 4061ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4062f4b3ec61Sdh155122 void fr_setstatequeue(is, rev, ifs) 4063ab25eeb5Syz155240 ipstate_t *is; 4064ab25eeb5Syz155240 int rev; 4065f4b3ec61Sdh155122 ipf_stack_t *ifs; 4066ab25eeb5Syz155240 { 4067ab25eeb5Syz155240 ipftq_t *oifq, *nifq; 4068ab25eeb5Syz155240 4069ab25eeb5Syz155240 4070ab25eeb5Syz155240 if ((is->is_sti.tqe_flags & TQE_RULEBASED) != 0) 4071ab25eeb5Syz155240 nifq = is->is_tqehead[rev]; 4072ab25eeb5Syz155240 else 4073ab25eeb5Syz155240 nifq = NULL; 4074ab25eeb5Syz155240 4075ab25eeb5Syz155240 if (nifq == NULL) { 4076ab25eeb5Syz155240 switch (is->is_p) 4077ab25eeb5Syz155240 { 4078ab25eeb5Syz155240 #ifdef USE_INET6 4079ab25eeb5Syz155240 case IPPROTO_ICMPV6 : 4080ab25eeb5Syz155240 if (rev == 1) 4081f4b3ec61Sdh155122 nifq = &ifs->ifs_ips_icmpacktq; 4082ab25eeb5Syz155240 else 4083f4b3ec61Sdh155122 nifq = &ifs->ifs_ips_icmptq; 4084ab25eeb5Syz155240 break; 4085ab25eeb5Syz155240 #endif 4086ab25eeb5Syz155240 case IPPROTO_ICMP : 4087ab25eeb5Syz155240 if (rev == 1) 4088f4b3ec61Sdh155122 nifq = &ifs->ifs_ips_icmpacktq; 4089ab25eeb5Syz155240 else 4090f4b3ec61Sdh155122 nifq = &ifs->ifs_ips_icmptq; 4091ab25eeb5Syz155240 break; 4092ab25eeb5Syz155240 case IPPROTO_TCP : 4093f4b3ec61Sdh155122 nifq = ifs->ifs_ips_tqtqb + is->is_state[rev]; 4094ab25eeb5Syz155240 break; 4095ab25eeb5Syz155240 4096ab25eeb5Syz155240 case IPPROTO_UDP : 4097ab25eeb5Syz155240 if (rev == 1) 4098f4b3ec61Sdh155122 nifq = &ifs->ifs_ips_udpacktq; 4099ab25eeb5Syz155240 else 4100f4b3ec61Sdh155122 nifq = &ifs->ifs_ips_udptq; 4101ab25eeb5Syz155240 break; 4102ab25eeb5Syz155240 4103ab25eeb5Syz155240 default : 4104f4b3ec61Sdh155122 nifq = &ifs->ifs_ips_iptq; 4105ab25eeb5Syz155240 break; 4106ab25eeb5Syz155240 } 4107ab25eeb5Syz155240 } 4108ab25eeb5Syz155240 4109ab25eeb5Syz155240 oifq = is->is_sti.tqe_ifq; 4110ab25eeb5Syz155240 /* 4111ab25eeb5Syz155240 * If it's currently on a timeout queue, move it from one queue to 4112ab25eeb5Syz155240 * another, else put it on the end of the newly determined queue. 4113ab25eeb5Syz155240 */ 4114ab25eeb5Syz155240 if (oifq != NULL) 4115f4b3ec61Sdh155122 fr_movequeue(&is->is_sti, oifq, nifq, ifs); 4116ab25eeb5Syz155240 else 4117f4b3ec61Sdh155122 fr_queueappend(&is->is_sti, nifq, is, ifs); 4118ab25eeb5Syz155240 return; 4119ab25eeb5Syz155240 } 4120f4b3ec61Sdh155122 4121f4b3ec61Sdh155122 4122f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */ 4123f4b3ec61Sdh155122 /* Function: fr_stateiter */ 4124f4b3ec61Sdh155122 /* Returns: int - 0 == success, else error */ 4125f4b3ec61Sdh155122 /* Parameters: token(I) - pointer to ipftoken structure */ 4126f4b3ec61Sdh155122 /* itp(I) - pointer to ipfgeniter structure */ 4127f4b3ec61Sdh155122 /* */ 4128f4b3ec61Sdh155122 /* This function handles the SIOCGENITER ioctl for the state tables and */ 4129f4b3ec61Sdh155122 /* walks through the list of entries in the state table list (ips_list.) */ 4130f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */ 4131f4b3ec61Sdh155122 static int fr_stateiter(token, itp, ifs) 4132f4b3ec61Sdh155122 ipftoken_t *token; 4133f4b3ec61Sdh155122 ipfgeniter_t *itp; 4134f4b3ec61Sdh155122 ipf_stack_t *ifs; 4135f4b3ec61Sdh155122 { 4136f4b3ec61Sdh155122 ipstate_t *is, *next, zero; 413790b0a856Sjojemann int error, count; 413890b0a856Sjojemann char *dst; 4139f4b3ec61Sdh155122 4140f4b3ec61Sdh155122 if (itp->igi_data == NULL) 4141f4b3ec61Sdh155122 return EFAULT; 4142f4b3ec61Sdh155122 414390b0a856Sjojemann if (itp->igi_nitems == 0) 414490b0a856Sjojemann return EINVAL; 414590b0a856Sjojemann 4146f4b3ec61Sdh155122 if (itp->igi_type != IPFGENITER_STATE) 4147f4b3ec61Sdh155122 return EINVAL; 4148f4b3ec61Sdh155122 4149f4b3ec61Sdh155122 is = token->ipt_data; 4150f4b3ec61Sdh155122 if (is == (void *)-1) { 4151f4b3ec61Sdh155122 ipf_freetoken(token, ifs); 4152f4b3ec61Sdh155122 return ESRCH; 4153f4b3ec61Sdh155122 } 4154f4b3ec61Sdh155122 415590b0a856Sjojemann error = 0; 415690b0a856Sjojemann dst = itp->igi_data; 415790b0a856Sjojemann 4158f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_state); 4159f4b3ec61Sdh155122 if (is == NULL) { 4160f4b3ec61Sdh155122 next = ifs->ifs_ips_list; 4161f4b3ec61Sdh155122 } else { 4162f4b3ec61Sdh155122 next = is->is_next; 4163f4b3ec61Sdh155122 } 4164f4b3ec61Sdh155122 416590b0a856Sjojemann for (count = itp->igi_nitems; count > 0; count--) { 4166f4b3ec61Sdh155122 if (next != NULL) { 4167f4b3ec61Sdh155122 /* 416890b0a856Sjojemann * If we find a state entry to use, bump its 416990b0a856Sjojemann * reference count so that it can be used for 417090b0a856Sjojemann * is_next when we come back. 4171f4b3ec61Sdh155122 */ 4172f4b3ec61Sdh155122 MUTEX_ENTER(&next->is_lock); 4173f4b3ec61Sdh155122 next->is_ref++; 4174f4b3ec61Sdh155122 MUTEX_EXIT(&next->is_lock); 4175f4b3ec61Sdh155122 token->ipt_data = next; 4176f4b3ec61Sdh155122 } else { 4177f4b3ec61Sdh155122 bzero(&zero, sizeof(zero)); 4178f4b3ec61Sdh155122 next = &zero; 4179f4b3ec61Sdh155122 token->ipt_data = (void *)-1; 418090b0a856Sjojemann count = 1; 4181f4b3ec61Sdh155122 } 4182f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_state); 4183f4b3ec61Sdh155122 4184f4b3ec61Sdh155122 /* 4185f4b3ec61Sdh155122 * If we had a prior pointer to a state entry, release it. 4186f4b3ec61Sdh155122 */ 4187f4b3ec61Sdh155122 if (is != NULL) { 418890b0a856Sjojemann fr_statederef(&is, ifs); 4189f4b3ec61Sdh155122 } 4190f4b3ec61Sdh155122 4191f4b3ec61Sdh155122 /* 4192f4b3ec61Sdh155122 * This should arguably be via fr_outobj() so that the state 4193f4b3ec61Sdh155122 * structure can (if required) be massaged going out. 4194f4b3ec61Sdh155122 */ 419590b0a856Sjojemann error = COPYOUT(next, dst, sizeof(*next)); 4196f4b3ec61Sdh155122 if (error != 0) 4197f4b3ec61Sdh155122 error = EFAULT; 419890b0a856Sjojemann if ((count == 1) || (error != 0)) 419990b0a856Sjojemann break; 420090b0a856Sjojemann 420190b0a856Sjojemann dst += sizeof(*next); 420290b0a856Sjojemann READ_ENTER(&ifs->ifs_ipf_state); 420390b0a856Sjojemann is = next; 420490b0a856Sjojemann next = is->is_next; 420590b0a856Sjojemann } 4206f4b3ec61Sdh155122 4207f4b3ec61Sdh155122 return error; 4208f4b3ec61Sdh155122 } 4209