1 /* 2 * Copyright (C) 1995-2003 by Darren Reed. 3 * 4 * See the IPFILTER.LICENCE file for details on licencing. 5 * 6 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 7 * Use is subject to license terms. 8 */ 9 10 #if defined(KERNEL) || defined(_KERNEL) 11 # undef KERNEL 12 # undef _KERNEL 13 # define KERNEL 1 14 # define _KERNEL 1 15 #endif 16 #include <sys/errno.h> 17 #include <sys/types.h> 18 #include <sys/param.h> 19 #include <sys/file.h> 20 #if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \ 21 defined(_KERNEL) 22 # include "opt_ipfilter_log.h" 23 #endif 24 #if defined(_KERNEL) && defined(__FreeBSD_version) && \ 25 (__FreeBSD_version >= 400000) && !defined(KLD_MODULE) 26 #include "opt_inet6.h" 27 #endif 28 #if !defined(_KERNEL) && !defined(__KERNEL__) 29 # include <stdio.h> 30 # include <stdlib.h> 31 # include <string.h> 32 # define _KERNEL 33 # ifdef __OpenBSD__ 34 struct file; 35 # endif 36 # include <sys/uio.h> 37 # undef _KERNEL 38 #endif 39 #if defined(_KERNEL) && (__FreeBSD_version >= 220000) 40 # include <sys/filio.h> 41 # include <sys/fcntl.h> 42 # if (__FreeBSD_version >= 300000) && !defined(IPFILTER_LKM) 43 # include "opt_ipfilter.h" 44 # endif 45 #else 46 # include <sys/ioctl.h> 47 #endif 48 #include <sys/time.h> 49 #if !defined(linux) 50 # include <sys/protosw.h> 51 #endif 52 #include <sys/socket.h> 53 #if defined(_KERNEL) 54 # include <sys/systm.h> 55 # if !defined(__SVR4) && !defined(__svr4__) 56 # include <sys/mbuf.h> 57 # endif 58 #endif 59 #if defined(__SVR4) || defined(__svr4__) 60 # include <sys/filio.h> 61 # include <sys/byteorder.h> 62 # ifdef _KERNEL 63 # include <sys/dditypes.h> 64 # endif 65 # include <sys/stream.h> 66 # include <sys/kmem.h> 67 #endif 68 69 #include <net/if.h> 70 #ifdef sun 71 # include <net/af.h> 72 #endif 73 #include <net/route.h> 74 #include <netinet/in.h> 75 #include <netinet/in_systm.h> 76 #include <netinet/ip.h> 77 #include <netinet/tcp.h> 78 #if !defined(linux) 79 # include <netinet/ip_var.h> 80 #endif 81 #if !defined(__hpux) && !defined(linux) 82 # include <netinet/tcp_fsm.h> 83 #endif 84 #include <netinet/udp.h> 85 #include <netinet/ip_icmp.h> 86 #include "netinet/ip_compat.h" 87 #include <netinet/tcpip.h> 88 #include "netinet/ip_fil.h" 89 #include "netinet/ip_nat.h" 90 #include "netinet/ip_frag.h" 91 #include "netinet/ip_state.h" 92 #include "netinet/ip_proxy.h" 93 #include "netinet/ipf_stack.h" 94 #ifdef IPFILTER_SYNC 95 #include "netinet/ip_sync.h" 96 #endif 97 #ifdef IPFILTER_SCAN 98 #include "netinet/ip_scan.h" 99 #endif 100 #ifdef USE_INET6 101 #include <netinet/icmp6.h> 102 #endif 103 #if (__FreeBSD_version >= 300000) 104 # include <sys/malloc.h> 105 # if defined(_KERNEL) && !defined(IPFILTER_LKM) 106 # include <sys/libkern.h> 107 # include <sys/systm.h> 108 # endif 109 #endif 110 /* END OF INCLUDES */ 111 112 113 #if !defined(lint) 114 static const char sccsid[] = "@(#)ip_state.c 1.8 6/5/96 (C) 1993-2000 Darren Reed"; 115 static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.186.2.36 2005/08/11 19:58:03 darrenr Exp $"; 116 #endif 117 118 #ifdef USE_INET6 119 static ipstate_t *fr_checkicmp6matchingstate __P((fr_info_t *)); 120 #endif 121 static ipstate_t *fr_matchsrcdst __P((fr_info_t *, ipstate_t *, i6addr_t *, 122 i6addr_t *, tcphdr_t *, u_32_t)); 123 static ipstate_t *fr_checkicmpmatchingstate __P((fr_info_t *)); 124 static int fr_state_flush __P((int, int, ipf_stack_t *)); 125 static ips_stat_t *fr_statetstats __P((ipf_stack_t *)); 126 static int fr_state_remove __P((caddr_t, ipf_stack_t *)); 127 static void fr_ipsmove __P((ipstate_t *, u_int, ipf_stack_t *)); 128 static int fr_tcpstate __P((fr_info_t *, tcphdr_t *, ipstate_t *)); 129 static int fr_tcpoptions __P((fr_info_t *, tcphdr_t *, tcpdata_t *)); 130 static ipstate_t *fr_stclone __P((fr_info_t *, tcphdr_t *, ipstate_t *)); 131 static void fr_fixinisn __P((fr_info_t *, ipstate_t *)); 132 static void fr_fixoutisn __P((fr_info_t *, ipstate_t *)); 133 static void fr_checknewisn __P((fr_info_t *, ipstate_t *)); 134 static int fr_stateiter __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *)); 135 136 int fr_stputent __P((caddr_t, ipf_stack_t *)); 137 int fr_stgetent __P((caddr_t, ipf_stack_t *)); 138 139 #define ONE_DAY IPF_TTLVAL(1 * 86400) /* 1 day */ 140 #define FIVE_DAYS (5 * ONE_DAY) 141 #define DOUBLE_HASH(x, ifs) \ 142 (((x) + ifs->ifs_ips_seed[(x) % ifs->ifs_fr_statesize]) % ifs->ifs_fr_statesize) 143 144 145 /* ------------------------------------------------------------------------ */ 146 /* Function: fr_stateinit */ 147 /* Returns: int - 0 == success, -1 == failure */ 148 /* Parameters: ifs - ipf stack instance */ 149 /* */ 150 /* Initialise all the global variables used within the state code. */ 151 /* This action also includes initiailising locks. */ 152 /* ------------------------------------------------------------------------ */ 153 int fr_stateinit(ifs) 154 ipf_stack_t *ifs; 155 { 156 #if defined(NEED_LOCAL_RAND) || !defined(_KERNEL) 157 struct timeval tv; 158 #endif 159 int i; 160 161 KMALLOCS(ifs->ifs_ips_table, ipstate_t **, 162 ifs->ifs_fr_statesize * sizeof(ipstate_t *)); 163 if (ifs->ifs_ips_table == NULL) 164 return -1; 165 bzero((char *)ifs->ifs_ips_table, 166 ifs->ifs_fr_statesize * sizeof(ipstate_t *)); 167 168 KMALLOCS(ifs->ifs_ips_seed, u_long *, 169 ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_seed)); 170 if (ifs->ifs_ips_seed == NULL) 171 return -2; 172 #if defined(NEED_LOCAL_RAND) || !defined(_KERNEL) 173 tv.tv_sec = 0; 174 GETKTIME(&tv); 175 #endif 176 for (i = 0; i < ifs->ifs_fr_statesize; i++) { 177 /* 178 * XXX - ips_seed[X] should be a random number of sorts. 179 */ 180 #if !defined(NEED_LOCAL_RAND) && defined(_KERNEL) 181 ifs->ifs_ips_seed[i] = ipf_random(); 182 #else 183 ifs->ifs_ips_seed[i] = ((u_long)ifs->ifs_ips_seed + i) * 184 ifs->ifs_fr_statesize; 185 ifs->ifs_ips_seed[i] += tv.tv_sec; 186 ifs->ifs_ips_seed[i] *= (u_long)ifs->ifs_ips_seed; 187 ifs->ifs_ips_seed[i] ^= 0x5a5aa5a5; 188 ifs->ifs_ips_seed[i] *= ifs->ifs_fr_statemax; 189 #endif 190 } 191 192 /* fill icmp reply type table */ 193 for (i = 0; i <= ICMP_MAXTYPE; i++) 194 icmpreplytype4[i] = -1; 195 icmpreplytype4[ICMP_ECHO] = ICMP_ECHOREPLY; 196 icmpreplytype4[ICMP_TSTAMP] = ICMP_TSTAMPREPLY; 197 icmpreplytype4[ICMP_IREQ] = ICMP_IREQREPLY; 198 icmpreplytype4[ICMP_MASKREQ] = ICMP_MASKREPLY; 199 #ifdef USE_INET6 200 /* fill icmp reply type table */ 201 for (i = 0; i <= ICMP6_MAXTYPE; i++) 202 icmpreplytype6[i] = -1; 203 icmpreplytype6[ICMP6_ECHO_REQUEST] = ICMP6_ECHO_REPLY; 204 icmpreplytype6[ICMP6_MEMBERSHIP_QUERY] = ICMP6_MEMBERSHIP_REPORT; 205 icmpreplytype6[ICMP6_NI_QUERY] = ICMP6_NI_REPLY; 206 icmpreplytype6[ND_ROUTER_SOLICIT] = ND_ROUTER_ADVERT; 207 icmpreplytype6[ND_NEIGHBOR_SOLICIT] = ND_NEIGHBOR_ADVERT; 208 #endif 209 210 KMALLOCS(ifs->ifs_ips_stats.iss_bucketlen, u_long *, 211 ifs->ifs_fr_statesize * sizeof(u_long)); 212 if (ifs->ifs_ips_stats.iss_bucketlen == NULL) 213 return -1; 214 bzero((char *)ifs->ifs_ips_stats.iss_bucketlen, 215 ifs->ifs_fr_statesize * sizeof(u_long)); 216 217 if (ifs->ifs_fr_state_maxbucket == 0) { 218 for (i = ifs->ifs_fr_statesize; i > 0; i >>= 1) 219 ifs->ifs_fr_state_maxbucket++; 220 ifs->ifs_fr_state_maxbucket *= 2; 221 } 222 223 fr_sttab_init(ifs->ifs_ips_tqtqb, ifs); 224 ifs->ifs_ips_tqtqb[IPF_TCP_NSTATES - 1].ifq_next = &ifs->ifs_ips_udptq; 225 ifs->ifs_ips_udptq.ifq_ttl = (u_long)ifs->ifs_fr_udptimeout; 226 ifs->ifs_ips_udptq.ifq_ref = 1; 227 ifs->ifs_ips_udptq.ifq_head = NULL; 228 ifs->ifs_ips_udptq.ifq_tail = &ifs->ifs_ips_udptq.ifq_head; 229 MUTEX_INIT(&ifs->ifs_ips_udptq.ifq_lock, "ipftq udp tab"); 230 ifs->ifs_ips_udptq.ifq_next = &ifs->ifs_ips_udpacktq; 231 ifs->ifs_ips_udpacktq.ifq_ttl = (u_long)ifs->ifs_fr_udpacktimeout; 232 ifs->ifs_ips_udpacktq.ifq_ref = 1; 233 ifs->ifs_ips_udpacktq.ifq_head = NULL; 234 ifs->ifs_ips_udpacktq.ifq_tail = &ifs->ifs_ips_udpacktq.ifq_head; 235 MUTEX_INIT(&ifs->ifs_ips_udpacktq.ifq_lock, "ipftq udpack tab"); 236 ifs->ifs_ips_udpacktq.ifq_next = &ifs->ifs_ips_icmptq; 237 ifs->ifs_ips_icmptq.ifq_ttl = (u_long)ifs->ifs_fr_icmptimeout; 238 ifs->ifs_ips_icmptq.ifq_ref = 1; 239 ifs->ifs_ips_icmptq.ifq_head = NULL; 240 ifs->ifs_ips_icmptq.ifq_tail = &ifs->ifs_ips_icmptq.ifq_head; 241 MUTEX_INIT(&ifs->ifs_ips_icmptq.ifq_lock, "ipftq icmp tab"); 242 ifs->ifs_ips_icmptq.ifq_next = &ifs->ifs_ips_icmpacktq; 243 ifs->ifs_ips_icmpacktq.ifq_ttl = (u_long)ifs->ifs_fr_icmpacktimeout; 244 ifs->ifs_ips_icmpacktq.ifq_ref = 1; 245 ifs->ifs_ips_icmpacktq.ifq_head = NULL; 246 ifs->ifs_ips_icmpacktq.ifq_tail = &ifs->ifs_ips_icmpacktq.ifq_head; 247 MUTEX_INIT(&ifs->ifs_ips_icmpacktq.ifq_lock, "ipftq icmpack tab"); 248 ifs->ifs_ips_icmpacktq.ifq_next = &ifs->ifs_ips_iptq; 249 ifs->ifs_ips_iptq.ifq_ttl = (u_long)ifs->ifs_fr_iptimeout; 250 ifs->ifs_ips_iptq.ifq_ref = 1; 251 ifs->ifs_ips_iptq.ifq_head = NULL; 252 ifs->ifs_ips_iptq.ifq_tail = &ifs->ifs_ips_iptq.ifq_head; 253 MUTEX_INIT(&ifs->ifs_ips_iptq.ifq_lock, "ipftq ip tab"); 254 ifs->ifs_ips_iptq.ifq_next = &ifs->ifs_ips_deletetq; 255 /* entry's ttl in deletetq is just 1 tick */ 256 ifs->ifs_ips_deletetq.ifq_ttl = (u_long) 1; 257 ifs->ifs_ips_deletetq.ifq_ref = 1; 258 ifs->ifs_ips_deletetq.ifq_head = NULL; 259 ifs->ifs_ips_deletetq.ifq_tail = &ifs->ifs_ips_deletetq.ifq_head; 260 MUTEX_INIT(&ifs->ifs_ips_deletetq.ifq_lock, "state delete queue"); 261 ifs->ifs_ips_deletetq.ifq_next = NULL; 262 263 RWLOCK_INIT(&ifs->ifs_ipf_state, "ipf IP state rwlock"); 264 MUTEX_INIT(&ifs->ifs_ipf_stinsert, "ipf state insert mutex"); 265 ifs->ifs_fr_state_init = 1; 266 267 ifs->ifs_ips_last_force_flush = ifs->ifs_fr_ticks; 268 return 0; 269 } 270 271 272 /* ------------------------------------------------------------------------ */ 273 /* Function: fr_stateunload */ 274 /* Returns: Nil */ 275 /* Parameters: ifs - ipf stack instance */ 276 /* */ 277 /* Release and destroy any resources acquired or initialised so that */ 278 /* IPFilter can be unloaded or re-initialised. */ 279 /* ------------------------------------------------------------------------ */ 280 void fr_stateunload(ifs) 281 ipf_stack_t *ifs; 282 { 283 ipftq_t *ifq, *ifqnext; 284 ipstate_t *is; 285 286 while ((is = ifs->ifs_ips_list) != NULL) 287 (void) fr_delstate(is, 0, ifs); 288 289 /* 290 * Proxy timeout queues are not cleaned here because although they 291 * exist on the state list, appr_unload is called after fr_stateunload 292 * and the proxies actually are responsible for them being created. 293 * Should the proxy timeouts have their own list? There's no real 294 * justification as this is the only complicationA 295 */ 296 for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) { 297 ifqnext = ifq->ifq_next; 298 if (((ifq->ifq_flags & IFQF_PROXY) == 0) && 299 (fr_deletetimeoutqueue(ifq) == 0)) 300 fr_freetimeoutqueue(ifq, ifs); 301 } 302 303 ifs->ifs_ips_stats.iss_inuse = 0; 304 ifs->ifs_ips_num = 0; 305 306 if (ifs->ifs_fr_state_init == 1) { 307 fr_sttab_destroy(ifs->ifs_ips_tqtqb); 308 MUTEX_DESTROY(&ifs->ifs_ips_udptq.ifq_lock); 309 MUTEX_DESTROY(&ifs->ifs_ips_icmptq.ifq_lock); 310 MUTEX_DESTROY(&ifs->ifs_ips_udpacktq.ifq_lock); 311 MUTEX_DESTROY(&ifs->ifs_ips_icmpacktq.ifq_lock); 312 MUTEX_DESTROY(&ifs->ifs_ips_iptq.ifq_lock); 313 MUTEX_DESTROY(&ifs->ifs_ips_deletetq.ifq_lock); 314 } 315 316 if (ifs->ifs_ips_table != NULL) { 317 KFREES(ifs->ifs_ips_table, 318 ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_table)); 319 ifs->ifs_ips_table = NULL; 320 } 321 322 if (ifs->ifs_ips_seed != NULL) { 323 KFREES(ifs->ifs_ips_seed, 324 ifs->ifs_fr_statesize * sizeof(*ifs->ifs_ips_seed)); 325 ifs->ifs_ips_seed = NULL; 326 } 327 328 if (ifs->ifs_ips_stats.iss_bucketlen != NULL) { 329 KFREES(ifs->ifs_ips_stats.iss_bucketlen, 330 ifs->ifs_fr_statesize * sizeof(u_long)); 331 ifs->ifs_ips_stats.iss_bucketlen = NULL; 332 } 333 334 if (ifs->ifs_fr_state_maxbucket_reset == 1) 335 ifs->ifs_fr_state_maxbucket = 0; 336 337 if (ifs->ifs_fr_state_init == 1) { 338 ifs->ifs_fr_state_init = 0; 339 RW_DESTROY(&ifs->ifs_ipf_state); 340 MUTEX_DESTROY(&ifs->ifs_ipf_stinsert); 341 } 342 } 343 344 345 /* ------------------------------------------------------------------------ */ 346 /* Function: fr_statetstats */ 347 /* Returns: ips_state_t* - pointer to state stats structure */ 348 /* Parameters: Nil */ 349 /* */ 350 /* Put all the current numbers and pointers into a single struct and return */ 351 /* a pointer to it. */ 352 /* ------------------------------------------------------------------------ */ 353 static ips_stat_t *fr_statetstats(ifs) 354 ipf_stack_t *ifs; 355 { 356 ifs->ifs_ips_stats.iss_active = ifs->ifs_ips_num; 357 ifs->ifs_ips_stats.iss_statesize = ifs->ifs_fr_statesize; 358 ifs->ifs_ips_stats.iss_statemax = ifs->ifs_fr_statemax; 359 ifs->ifs_ips_stats.iss_table = ifs->ifs_ips_table; 360 ifs->ifs_ips_stats.iss_list = ifs->ifs_ips_list; 361 ifs->ifs_ips_stats.iss_ticks = ifs->ifs_fr_ticks; 362 return &ifs->ifs_ips_stats; 363 } 364 365 /* ------------------------------------------------------------------------ */ 366 /* Function: fr_state_remove */ 367 /* Returns: int - 0 == success, != 0 == failure */ 368 /* Parameters: data(I) - pointer to state structure to delete from table */ 369 /* ifs - ipf stack instance */ 370 /* */ 371 /* Search for a state structure that matches the one passed, according to */ 372 /* the IP addresses and other protocol specific information. */ 373 /* ------------------------------------------------------------------------ */ 374 static int fr_state_remove(data, ifs) 375 caddr_t data; 376 ipf_stack_t *ifs; 377 { 378 ipstate_t *sp, st; 379 int error; 380 381 sp = &st; 382 error = fr_inobj(data, &st, IPFOBJ_IPSTATE); 383 if (error) 384 return EFAULT; 385 386 WRITE_ENTER(&ifs->ifs_ipf_state); 387 for (sp = ifs->ifs_ips_list; sp; sp = sp->is_next) 388 if ((sp->is_p == st.is_p) && (sp->is_v == st.is_v) && 389 !bcmp((caddr_t)&sp->is_src, (caddr_t)&st.is_src, 390 sizeof(st.is_src)) && 391 !bcmp((caddr_t)&sp->is_dst, (caddr_t)&st.is_dst, 392 sizeof(st.is_dst)) && 393 !bcmp((caddr_t)&sp->is_ps, (caddr_t)&st.is_ps, 394 sizeof(st.is_ps))) { 395 (void) fr_delstate(sp, ISL_REMOVE, ifs); 396 RWLOCK_EXIT(&ifs->ifs_ipf_state); 397 return 0; 398 } 399 RWLOCK_EXIT(&ifs->ifs_ipf_state); 400 return ESRCH; 401 } 402 403 404 /* ------------------------------------------------------------------------ */ 405 /* Function: fr_state_ioctl */ 406 /* Returns: int - 0 == success, != 0 == failure */ 407 /* Parameters: data(I) - pointer to ioctl data */ 408 /* cmd(I) - ioctl command integer */ 409 /* mode(I) - file mode bits used with open */ 410 /* uid(I) - uid of caller */ 411 /* ctx(I) - pointer to give the uid context */ 412 /* ifs - ipf stack instance */ 413 /* */ 414 /* Processes an ioctl call made to operate on the IP Filter state device. */ 415 /* ------------------------------------------------------------------------ */ 416 int fr_state_ioctl(data, cmd, mode, uid, ctx, ifs) 417 caddr_t data; 418 ioctlcmd_t cmd; 419 int mode, uid; 420 void *ctx; 421 ipf_stack_t *ifs; 422 { 423 int arg, ret, error = 0; 424 425 switch (cmd) 426 { 427 /* 428 * Delete an entry from the state table. 429 */ 430 case SIOCDELST : 431 error = fr_state_remove(data, ifs); 432 break; 433 /* 434 * Flush the state table 435 */ 436 case SIOCIPFFL : 437 error = BCOPYIN(data, (char *)&arg, sizeof(arg)); 438 if (error != 0) { 439 error = EFAULT; 440 } else { 441 if (VALID_TABLE_FLUSH_OPT(arg)) { 442 WRITE_ENTER(&ifs->ifs_ipf_state); 443 ret = fr_state_flush(arg, 4, ifs); 444 RWLOCK_EXIT(&ifs->ifs_ipf_state); 445 error = BCOPYOUT((char *)&ret, data, 446 sizeof(ret)); 447 if (error != 0) 448 return EFAULT; 449 } else { 450 error = EINVAL; 451 } 452 } 453 break; 454 455 #ifdef USE_INET6 456 case SIOCIPFL6 : 457 error = BCOPYIN(data, (char *)&arg, sizeof(arg)); 458 if (error != 0) { 459 error = EFAULT; 460 } else { 461 if (VALID_TABLE_FLUSH_OPT(arg)) { 462 WRITE_ENTER(&ifs->ifs_ipf_state); 463 ret = fr_state_flush(arg, 6, ifs); 464 RWLOCK_EXIT(&ifs->ifs_ipf_state); 465 error = BCOPYOUT((char *)&ret, data, 466 sizeof(ret)); 467 if (error != 0) 468 return EFAULT; 469 } else { 470 error = EINVAL; 471 } 472 } 473 break; 474 #endif 475 #ifdef IPFILTER_LOG 476 /* 477 * Flush the state log. 478 */ 479 case SIOCIPFFB : 480 if (!(mode & FWRITE)) 481 error = EPERM; 482 else { 483 int tmp; 484 485 tmp = ipflog_clear(IPL_LOGSTATE, ifs); 486 error = BCOPYOUT((char *)&tmp, data, sizeof(tmp)); 487 if (error != 0) 488 error = EFAULT; 489 } 490 break; 491 /* 492 * Turn logging of state information on/off. 493 */ 494 case SIOCSETLG : 495 if (!(mode & FWRITE)) { 496 error = EPERM; 497 } else { 498 error = BCOPYIN((char *)data, 499 (char *)&ifs->ifs_ipstate_logging, 500 sizeof(ifs->ifs_ipstate_logging)); 501 if (error != 0) 502 error = EFAULT; 503 } 504 break; 505 /* 506 * Return the current state of logging. 507 */ 508 case SIOCGETLG : 509 error = BCOPYOUT((char *)&ifs->ifs_ipstate_logging, 510 (char *)data, 511 sizeof(ifs->ifs_ipstate_logging)); 512 if (error != 0) 513 error = EFAULT; 514 break; 515 /* 516 * Return the number of bytes currently waiting to be read. 517 */ 518 case FIONREAD : 519 arg = ifs->ifs_iplused[IPL_LOGSTATE]; /* returned in an int */ 520 error = BCOPYOUT((char *)&arg, data, sizeof(arg)); 521 if (error != 0) 522 error = EFAULT; 523 break; 524 #endif 525 /* 526 * Get the current state statistics. 527 */ 528 case SIOCGETFS : 529 error = fr_outobj(data, fr_statetstats(ifs), IPFOBJ_STATESTAT); 530 break; 531 /* 532 * Lock/Unlock the state table. (Locking prevents any changes, which 533 * means no packets match). 534 */ 535 case SIOCSTLCK : 536 if (!(mode & FWRITE)) { 537 error = EPERM; 538 } else { 539 error = fr_lock(data, &ifs->ifs_fr_state_lock); 540 } 541 break; 542 /* 543 * Add an entry to the current state table. 544 */ 545 case SIOCSTPUT : 546 if (!ifs->ifs_fr_state_lock || !(mode & FWRITE)) { 547 error = EACCES; 548 break; 549 } 550 error = fr_stputent(data, ifs); 551 break; 552 /* 553 * Get a state table entry. 554 */ 555 case SIOCSTGET : 556 if (!ifs->ifs_fr_state_lock) { 557 error = EACCES; 558 break; 559 } 560 error = fr_stgetent(data, ifs); 561 break; 562 563 case SIOCGENITER : 564 { 565 ipftoken_t *token; 566 ipfgeniter_t iter; 567 568 error = fr_inobj(data, &iter, IPFOBJ_GENITER); 569 if (error != 0) 570 break; 571 572 token = ipf_findtoken(IPFGENITER_STATE, uid, ctx, ifs); 573 if (token != NULL) 574 error = fr_stateiter(token, &iter, ifs); 575 else 576 error = ESRCH; 577 RWLOCK_EXIT(&ifs->ifs_ipf_tokens); 578 break; 579 } 580 581 case SIOCIPFDELTOK : 582 error = BCOPYIN(data, (char *)&arg, sizeof(arg)); 583 if (error != 0) { 584 error = EFAULT; 585 } else { 586 error = ipf_deltoken(arg, uid, ctx, ifs); 587 } 588 break; 589 590 default : 591 error = EINVAL; 592 break; 593 } 594 return error; 595 } 596 597 598 /* ------------------------------------------------------------------------ */ 599 /* Function: fr_stgetent */ 600 /* Returns: int - 0 == success, != 0 == failure */ 601 /* Parameters: data(I) - pointer to state structure to retrieve from table */ 602 /* */ 603 /* Copy out state information from the kernel to a user space process. If */ 604 /* there is a filter rule associated with the state entry, copy that out */ 605 /* as well. The entry to copy out is taken from the value of "ips_next" in */ 606 /* the struct passed in and if not null and not found in the list of current*/ 607 /* state entries, the retrieval fails. */ 608 /* ------------------------------------------------------------------------ */ 609 int fr_stgetent(data, ifs) 610 caddr_t data; 611 ipf_stack_t *ifs; 612 { 613 ipstate_t *is, *isn; 614 ipstate_save_t ips; 615 int error; 616 617 error = fr_inobj(data, &ips, IPFOBJ_STATESAVE); 618 if (error) 619 return EFAULT; 620 621 isn = ips.ips_next; 622 if (isn == NULL) { 623 isn = ifs->ifs_ips_list; 624 if (isn == NULL) { 625 if (ips.ips_next == NULL) 626 return ENOENT; 627 return 0; 628 } 629 } else { 630 /* 631 * Make sure the pointer we're copying from exists in the 632 * current list of entries. Security precaution to prevent 633 * copying of random kernel data. 634 */ 635 for (is = ifs->ifs_ips_list; is; is = is->is_next) 636 if (is == isn) 637 break; 638 if (!is) 639 return ESRCH; 640 } 641 ips.ips_next = isn->is_next; 642 bcopy((char *)isn, (char *)&ips.ips_is, sizeof(ips.ips_is)); 643 ips.ips_rule = isn->is_rule; 644 if (isn->is_rule != NULL) 645 bcopy((char *)isn->is_rule, (char *)&ips.ips_fr, 646 sizeof(ips.ips_fr)); 647 error = fr_outobj(data, &ips, IPFOBJ_STATESAVE); 648 if (error) 649 return EFAULT; 650 return 0; 651 } 652 653 654 /* ------------------------------------------------------------------------ */ 655 /* Function: fr_stputent */ 656 /* Returns: int - 0 == success, != 0 == failure */ 657 /* Parameters: data(I) - pointer to state information struct */ 658 /* ifs - ipf stack instance */ 659 /* */ 660 /* This function implements the SIOCSTPUT ioctl: insert a state entry into */ 661 /* the state table. If the state info. includes a pointer to a filter rule */ 662 /* then also add in an orphaned rule (will not show up in any "ipfstat -io" */ 663 /* output. */ 664 /* ------------------------------------------------------------------------ */ 665 int fr_stputent(data, ifs) 666 caddr_t data; 667 ipf_stack_t *ifs; 668 { 669 ipstate_t *is, *isn; 670 ipstate_save_t ips; 671 int error, i; 672 frentry_t *fr; 673 char *name; 674 675 error = fr_inobj(data, &ips, IPFOBJ_STATESAVE); 676 if (error) 677 return EFAULT; 678 679 /* 680 * Trigger automatic call to fr_state_flush() if the 681 * table has reached capacity specified by hi watermark. 682 */ 683 if (ST_TAB_WATER_LEVEL(ifs) > ifs->ifs_state_flush_level_hi) 684 ifs->ifs_fr_state_doflush = 1; 685 686 /* 687 * If automatic flushing did not do its job, and the table 688 * has filled up, don't try to create a new entry. 689 */ 690 if (ifs->ifs_ips_num >= ifs->ifs_fr_statemax) { 691 ATOMIC_INCL(ifs->ifs_ips_stats.iss_max); 692 return ENOMEM; 693 } 694 695 KMALLOC(isn, ipstate_t *); 696 if (isn == NULL) 697 return ENOMEM; 698 699 bcopy((char *)&ips.ips_is, (char *)isn, sizeof(*isn)); 700 bzero((char *)isn, offsetof(struct ipstate, is_pkts)); 701 isn->is_sti.tqe_pnext = NULL; 702 isn->is_sti.tqe_next = NULL; 703 isn->is_sti.tqe_ifq = NULL; 704 isn->is_sti.tqe_parent = isn; 705 isn->is_ifp[0] = NULL; 706 isn->is_ifp[1] = NULL; 707 isn->is_ifp[2] = NULL; 708 isn->is_ifp[3] = NULL; 709 isn->is_sync = NULL; 710 fr = ips.ips_rule; 711 712 if (fr == NULL) { 713 READ_ENTER(&ifs->ifs_ipf_state); 714 fr_stinsert(isn, 0, ifs); 715 MUTEX_EXIT(&isn->is_lock); 716 RWLOCK_EXIT(&ifs->ifs_ipf_state); 717 return 0; 718 } 719 720 if (isn->is_flags & SI_NEWFR) { 721 KMALLOC(fr, frentry_t *); 722 if (fr == NULL) { 723 KFREE(isn); 724 return ENOMEM; 725 } 726 bcopy((char *)&ips.ips_fr, (char *)fr, sizeof(*fr)); 727 isn->is_rule = fr; 728 ips.ips_is.is_rule = fr; 729 MUTEX_NUKE(&fr->fr_lock); 730 MUTEX_INIT(&fr->fr_lock, "state filter rule lock"); 731 732 /* 733 * Look up all the interface names in the rule. 734 */ 735 for (i = 0; i < 4; i++) { 736 name = fr->fr_ifnames[i]; 737 fr->fr_ifas[i] = fr_resolvenic(name, fr->fr_v, ifs); 738 name = isn->is_ifname[i]; 739 isn->is_ifp[i] = fr_resolvenic(name, isn->is_v, ifs); 740 } 741 742 fr->fr_ref = 0; 743 fr->fr_dsize = 0; 744 fr->fr_data = NULL; 745 fr->fr_type = FR_T_NONE; 746 747 fr_resolvedest(&fr->fr_tif, fr->fr_v, ifs); 748 fr_resolvedest(&fr->fr_dif, fr->fr_v, ifs); 749 fr_resolvedest(&fr->fr_rif, fr->fr_v, ifs); 750 751 /* 752 * send a copy back to userland of what we ended up 753 * to allow for verification. 754 */ 755 error = fr_outobj(data, &ips, IPFOBJ_STATESAVE); 756 if (error) { 757 KFREE(isn); 758 MUTEX_DESTROY(&fr->fr_lock); 759 KFREE(fr); 760 return EFAULT; 761 } 762 READ_ENTER(&ifs->ifs_ipf_state); 763 fr_stinsert(isn, 0, ifs); 764 MUTEX_EXIT(&isn->is_lock); 765 RWLOCK_EXIT(&ifs->ifs_ipf_state); 766 767 } else { 768 READ_ENTER(&ifs->ifs_ipf_state); 769 for (is = ifs->ifs_ips_list; is; is = is->is_next) 770 if (is->is_rule == fr) { 771 fr_stinsert(isn, 0, ifs); 772 MUTEX_EXIT(&isn->is_lock); 773 break; 774 } 775 776 if (is == NULL) { 777 KFREE(isn); 778 isn = NULL; 779 } 780 RWLOCK_EXIT(&ifs->ifs_ipf_state); 781 782 return (isn == NULL) ? ESRCH : 0; 783 } 784 785 return 0; 786 } 787 788 789 /* ------------------------------------------------------------------------ */ 790 /* Function: fr_stinsert */ 791 /* Returns: Nil */ 792 /* Parameters: is(I) - pointer to state structure */ 793 /* rev(I) - flag indicating forward/reverse direction of packet */ 794 /* */ 795 /* Inserts a state structure into the hash table (for lookups) and the list */ 796 /* of state entries (for enumeration). Resolves all of the interface names */ 797 /* to pointers and adjusts running stats for the hash table as appropriate. */ 798 /* */ 799 /* Locking: it is assumed that some kind of lock on ipf_state is held. */ 800 /* Exits with is_lock initialised and held. */ 801 /* ------------------------------------------------------------------------ */ 802 void fr_stinsert(is, rev, ifs) 803 ipstate_t *is; 804 int rev; 805 ipf_stack_t *ifs; 806 { 807 frentry_t *fr; 808 u_int hv; 809 int i; 810 811 MUTEX_INIT(&is->is_lock, "ipf state entry"); 812 813 fr = is->is_rule; 814 if (fr != NULL) { 815 MUTEX_ENTER(&fr->fr_lock); 816 fr->fr_ref++; 817 fr->fr_statecnt++; 818 MUTEX_EXIT(&fr->fr_lock); 819 } 820 821 /* 822 * Look up all the interface names in the state entry. 823 */ 824 for (i = 0; i < 4; i++) { 825 if (is->is_ifp[i] != NULL) 826 continue; 827 is->is_ifp[i] = fr_resolvenic(is->is_ifname[i], is->is_v, ifs); 828 } 829 830 /* 831 * If we could trust is_hv, then the modulous would not be needed, but 832 * when running with IPFILTER_SYNC, this stops bad values. 833 */ 834 hv = is->is_hv % ifs->ifs_fr_statesize; 835 is->is_hv = hv; 836 837 /* 838 * We need to get both of these locks...the first because it is 839 * possible that once the insert is complete another packet might 840 * come along, match the entry and want to update it. 841 */ 842 MUTEX_ENTER(&is->is_lock); 843 MUTEX_ENTER(&ifs->ifs_ipf_stinsert); 844 845 /* 846 * add into list table. 847 */ 848 if (ifs->ifs_ips_list != NULL) 849 ifs->ifs_ips_list->is_pnext = &is->is_next; 850 is->is_pnext = &ifs->ifs_ips_list; 851 is->is_next = ifs->ifs_ips_list; 852 ifs->ifs_ips_list = is; 853 854 if (ifs->ifs_ips_table[hv] != NULL) 855 ifs->ifs_ips_table[hv]->is_phnext = &is->is_hnext; 856 else 857 ifs->ifs_ips_stats.iss_inuse++; 858 is->is_phnext = ifs->ifs_ips_table + hv; 859 is->is_hnext = ifs->ifs_ips_table[hv]; 860 ifs->ifs_ips_table[hv] = is; 861 ifs->ifs_ips_stats.iss_bucketlen[hv]++; 862 ifs->ifs_ips_num++; 863 MUTEX_EXIT(&ifs->ifs_ipf_stinsert); 864 865 fr_setstatequeue(is, rev, ifs); 866 } 867 868 /* ------------------------------------------------------------------------ */ 869 /* Function: fr_match_ipv4addrs */ 870 /* Returns: int - 2 strong match (same addresses, same direction) */ 871 /* 1 weak match (same address, opposite direction) */ 872 /* 0 no match */ 873 /* */ 874 /* Function matches IPv4 addresses. */ 875 /* ------------------------------------------------------------------------ */ 876 static int fr_match_ipv4addrs(is1, is2) 877 ipstate_t *is1; 878 ipstate_t *is2; 879 { 880 int rv; 881 882 if (is1->is_saddr == is2->is_saddr && is1->is_daddr == is2->is_daddr) 883 rv = 2; 884 else if (is1->is_saddr == is2->is_daddr && 885 is1->is_daddr == is2->is_saddr) 886 rv = 1; 887 else 888 rv = 0; 889 890 return (rv); 891 } 892 893 /* ------------------------------------------------------------------------ */ 894 /* Function: fr_match_ipv6addrs */ 895 /* Returns: int - 2 strong match (same addresses, same direction) */ 896 /* 1 weak match (same addresses, opposite direction) */ 897 /* 0 no match */ 898 /* */ 899 /* Function matches IPv6 addresses. */ 900 /* ------------------------------------------------------------------------ */ 901 static int fr_match_ipv6addrs(is1, is2) 902 ipstate_t *is1; 903 ipstate_t *is2; 904 { 905 int rv; 906 907 if (IP6_EQ(&is1->is_src, &is2->is_src) && 908 IP6_EQ(&is1->is_dst, &is2->is_dst)) 909 rv = 2; 910 else if (IP6_EQ(&is1->is_src, &is2->is_dst) && 911 IP6_EQ(&is1->is_dst, &is2->is_src)) { 912 rv = 1; 913 } 914 else 915 rv = 0; 916 917 return (rv); 918 } 919 /* ------------------------------------------------------------------------ */ 920 /* Function: fr_match_addresses */ 921 /* Returns: int - 2 strong match (same addresses, same direction) */ 922 /* 1 weak match (same address, opposite directions) */ 923 /* 0 no match */ 924 /* Parameters: is1, is2 pointers to states we are checking */ 925 /* */ 926 /* Matches addresses, function uses fr_match_ipvXaddrs() to deal with IPv4 */ 927 /* and IPv6 address format. */ 928 /* ------------------------------------------------------------------------ */ 929 static int fr_match_addresses(is1, is2) 930 ipstate_t *is1; 931 ipstate_t *is2; 932 { 933 int rv; 934 935 if (is1->is_v == 4) { 936 rv = fr_match_ipv4addrs(is1, is2); 937 } else { 938 rv = fr_match_ipv6addrs(is1, is2); 939 } 940 941 return (rv); 942 } 943 944 /* ------------------------------------------------------------------------ */ 945 /* Function: fr_match_ppairs */ 946 /* Returns: int - 2 strong match (same ports, same direction) */ 947 /* 1 weak match (same ports, different direction) */ 948 /* 0 no match */ 949 /* Parameters ppairs1, ppairs - src, dst ports we want to match. */ 950 /* */ 951 /* Matches two port_pair_t types (port pairs). Each port pair contains */ 952 /* src, dst port, which belong to session (state entry). */ 953 /* ------------------------------------------------------------------------ */ 954 static int fr_match_ppairs(ppairs1, ppairs2) 955 port_pair_t *ppairs1; 956 port_pair_t *ppairs2; 957 { 958 int rv; 959 960 if (ppairs1->pp_sport == ppairs2->pp_sport && 961 ppairs1->pp_dport == ppairs2->pp_dport) 962 rv = 2; 963 else if (ppairs1->pp_sport == ppairs2->pp_dport && 964 ppairs1->pp_dport == ppairs2->pp_sport) 965 rv = 1; 966 else 967 rv = 0; 968 969 return (rv); 970 } 971 972 /* ------------------------------------------------------------------------ */ 973 /* Function: fr_match_l4_hdr */ 974 /* Returns: int - 0 no match, */ 975 /* 1 weak match (same ports, different directions) */ 976 /* 2 strong match (same ports, same direction) */ 977 /* Parameters is1, is2 - states we want to match */ 978 /* */ 979 /* Function matches L4 header data (source ports for TCP, UDP, CallIds for */ 980 /* GRE protocol). */ 981 /* ------------------------------------------------------------------------ */ 982 static int fr_match_l4_hdr(is1, is2) 983 ipstate_t *is1; 984 ipstate_t *is2; 985 { 986 int rv = 0; 987 port_pair_t pp1; 988 port_pair_t pp2; 989 990 if (is1->is_p != is2->is_p) 991 return (0); 992 993 switch (is1->is_p) { 994 case IPPROTO_TCP: 995 pp1.pp_sport = is1->is_ps.is_ts.ts_sport; 996 pp1.pp_dport = is1->is_ps.is_ts.ts_dport; 997 pp2.pp_sport = is2->is_ps.is_ts.ts_sport; 998 pp2.pp_dport = is2->is_ps.is_ts.ts_dport; 999 rv = fr_match_ppairs(&pp1, &pp2); 1000 break; 1001 case IPPROTO_UDP: 1002 pp1.pp_sport = is1->is_ps.is_us.us_sport; 1003 pp1.pp_dport = is1->is_ps.is_us.us_dport; 1004 pp2.pp_sport = is2->is_ps.is_us.us_sport; 1005 pp2.pp_dport = is2->is_ps.is_us.us_dport; 1006 rv = fr_match_ppairs(&pp1, &pp2); 1007 break; 1008 case IPPROTO_GRE: 1009 /* greinfo_t can be also interprted as port pair */ 1010 pp1.pp_sport = is1->is_ps.is_ug.gs_call[0]; 1011 pp1.pp_dport = is1->is_ps.is_ug.gs_call[1]; 1012 pp2.pp_sport = is2->is_ps.is_ug.gs_call[0]; 1013 pp2.pp_dport = is2->is_ps.is_ug.gs_call[1]; 1014 rv = fr_match_ppairs(&pp1, &pp2); 1015 break; 1016 case IPPROTO_ICMP: 1017 case IPPROTO_ICMPV6: 1018 if (bcmp(&is1->is_ps, &is2->is_ps, sizeof (icmpinfo_t))) 1019 rv = 1; 1020 else 1021 rv = 0; 1022 break; 1023 default: 1024 rv = 0; 1025 } 1026 1027 return (rv); 1028 } 1029 1030 /* ------------------------------------------------------------------------ */ 1031 /* Function: fr_matchstates */ 1032 /* Returns: int - nonzero match, zero no match */ 1033 /* Parameters is1, is2 - states we want to match */ 1034 /* */ 1035 /* The state entries are equal (identical match) if they belong to the same */ 1036 /* session. Any time new state entry is being added the fr_addstate() */ 1037 /* function creates temporal state entry from the data it gets from IP and */ 1038 /* L4 header. The fr_matchstats() must be also aware of packet direction, */ 1039 /* which is also stored within the state entry. We should keep in mind the */ 1040 /* information about packet direction is spread accross L3 (addresses) and */ 1041 /* L4 (ports). There are three possible relationships betwee is1, is2: */ 1042 /* - no match (match(is1, is2) == 0)) */ 1043 /* - weak match same addresses (ports), but different */ 1044 /* directions (1) (fr_match_xxxx(is1, is2) == 1) */ 1045 /* - strong match same addresses (ports) and same directions */ 1046 /* (2) (fr_match_xxxx(is1, is2) == 2) */ 1047 /* */ 1048 /* There are functions, which match match addresses (L3 header) in is1, is2 */ 1049 /* and functions, which are used to compare ports (L4 header) data. We say */ 1050 /* the is1 and is2 are same (identical) if there is a match */ 1051 /* (fr_match_l4_hdr(is1, is2) != 0) and matchlevels are same for entries */ 1052 /* (fr_match_l3_hdr(is1, is2) == fr_match_l4_hdr(is1, is2)) for is1, is2. */ 1053 /* Such requirement deals with case as follows: */ 1054 /* suppose there are two connections between hosts A, B. Connection 1: */ 1055 /* a.a.a.a:12345 <=> b.b.b.b:54321 */ 1056 /* Connection 2: */ 1057 /* a.a.a.a:54321 <=> b.b.b.b:12345 */ 1058 /* since we've introduced match levels into our fr_matchstates(), we are */ 1059 /* able to identify, which packets belong to connection A and which belong */ 1060 /* to connection B. Assume there are two entries is1, is2. is1 has been */ 1061 /* from con. 1 packet, which travelled from A to B: */ 1062 /* a.a.a.a:12345 -> b.b.b.b:54321 */ 1063 /* while s2, has been created from packet which belongs to con. 2 and is */ 1064 /* also coming from A to B: */ 1065 /* a.a.a.a:54321 -> b.b.b.b:12345 */ 1066 /* fr_match_l3_hdr(is1, is2) == 2 -> strong match, while */ 1067 /* fr_match_l4_hdr(is1, is2) == 1 -> weak match. Since match levels are */ 1068 /* different the state entries are not identical -> no match as a final */ 1069 /* result. */ 1070 /* ------------------------------------------------------------------------ */ 1071 static int fr_matchstates(is1, is2) 1072 ipstate_t *is1; 1073 ipstate_t *is2; 1074 { 1075 int rv; 1076 int amatch; 1077 int pmatch; 1078 1079 if (bcmp(&is1->is_pass, &is2->is_pass, 1080 offsetof(struct ipstate, is_ps) - 1081 offsetof(struct ipstate, is_pass)) == 0) { 1082 1083 pmatch = fr_match_l4_hdr(is1, is2); 1084 amatch = fr_match_addresses(is1, is2); 1085 /* 1086 * If addresses match (amatch != 0), then 'match levels' 1087 * must be same for matching entries. If amatch and pmatch 1088 * have different values (different match levels), then 1089 * is1 and is2 belong to different sessions. 1090 */ 1091 rv = (amatch != 0) && (amatch == pmatch); 1092 } 1093 else 1094 rv = 0; 1095 1096 return (rv); 1097 } 1098 1099 /* ------------------------------------------------------------------------ */ 1100 /* Function: fr_addstate */ 1101 /* Returns: ipstate_t* - NULL == failure, else pointer to new state */ 1102 /* Parameters: fin(I) - pointer to packet information */ 1103 /* stsave(O) - pointer to place to save pointer to created */ 1104 /* state structure. */ 1105 /* flags(I) - flags to use when creating the structure */ 1106 /* */ 1107 /* Creates a new IP state structure from the packet information collected. */ 1108 /* Inserts it into the state table and appends to the bottom of the active */ 1109 /* list. If the capacity of the table has reached the maximum allowed then */ 1110 /* the call will fail and a flush is scheduled for the next timeout call. */ 1111 /* ------------------------------------------------------------------------ */ 1112 ipstate_t *fr_addstate(fin, stsave, flags) 1113 fr_info_t *fin; 1114 ipstate_t **stsave; 1115 u_int flags; 1116 { 1117 ipstate_t *is, ips; 1118 struct icmp *ic; 1119 u_int pass, hv; 1120 frentry_t *fr; 1121 tcphdr_t *tcp; 1122 grehdr_t *gre; 1123 void *ifp; 1124 int out; 1125 ipf_stack_t *ifs = fin->fin_ifs; 1126 1127 if (ifs->ifs_fr_state_lock || 1128 (fin->fin_flx & (FI_SHORT|FI_STATE|FI_FRAGBODY|FI_BAD))) 1129 return NULL; 1130 1131 if ((fin->fin_flx & FI_OOW) && !(fin->fin_tcpf & TH_SYN)) 1132 return NULL; 1133 1134 /* 1135 * Trigger automatic call to fr_state_flush() if the 1136 * table has reached capacity specified by hi watermark. 1137 */ 1138 if (ST_TAB_WATER_LEVEL(ifs) > ifs->ifs_state_flush_level_hi) 1139 ifs->ifs_fr_state_doflush = 1; 1140 1141 /* 1142 * If the max number of state entries has been reached, and there is no 1143 * limit on the state count for the rule, then do not continue. In the 1144 * case where a limit exists, it's ok allow the entries to be created as 1145 * long as specified limit itself has not been reached. 1146 * 1147 * Note that because the lock isn't held on fr, it is possible to exceed 1148 * the specified size of the table. However, the cost of this is being 1149 * ignored here; as the number by which it can go over is a product of 1150 * the number of simultaneous threads that could be executing in here. 1151 * So, a limit of 100 won't result in 200, but could result in 101 or 102. 1152 * 1153 * Also note that, since the automatic flush should have been triggered 1154 * well before we reach the maximum number of state table entries, the 1155 * likelihood of reaching the max (and thus exceedng it) is minimal. 1156 */ 1157 fr = fin->fin_fr; 1158 if (fr != NULL) { 1159 if ((ifs->ifs_ips_num >= ifs->ifs_fr_statemax) && 1160 (fr->fr_statemax == 0)) { 1161 ATOMIC_INCL(ifs->ifs_ips_stats.iss_max); 1162 return NULL; 1163 } 1164 if ((fr->fr_statemax != 0) && 1165 (fr->fr_statecnt >= fr->fr_statemax)) { 1166 ATOMIC_INCL(ifs->ifs_ips_stats.iss_maxref); 1167 ifs->ifs_fr_state_doflush = 1; 1168 return NULL; 1169 } 1170 } 1171 1172 ic = NULL; 1173 tcp = NULL; 1174 out = fin->fin_out; 1175 is = &ips; 1176 bzero((char *)is, sizeof(*is)); 1177 1178 if (fr == NULL) { 1179 pass = ifs->ifs_fr_flags; 1180 is->is_tag = FR_NOLOGTAG; 1181 } else { 1182 pass = fr->fr_flags; 1183 } 1184 1185 is->is_die = 1 + ifs->ifs_fr_ticks; 1186 /* 1187 * We want to check everything that is a property of this packet, 1188 * but we don't (automatically) care about it's fragment status as 1189 * this may change. 1190 */ 1191 is->is_pass = pass; 1192 is->is_v = fin->fin_v; 1193 is->is_opt[0] = fin->fin_optmsk; 1194 is->is_optmsk[0] = 0xffffffff; 1195 is->is_optmsk[1] = 0xffffffff; 1196 if (is->is_v == 6) { 1197 is->is_opt[0] &= ~0x8; 1198 is->is_optmsk[0] &= ~0x8; 1199 is->is_optmsk[1] &= ~0x8; 1200 } 1201 is->is_sec = fin->fin_secmsk; 1202 is->is_secmsk = 0xffff; 1203 is->is_auth = fin->fin_auth; 1204 is->is_authmsk = 0xffff; 1205 1206 /* 1207 * Copy and calculate... 1208 */ 1209 hv = (is->is_p = fin->fin_fi.fi_p); 1210 is->is_src = fin->fin_fi.fi_src; 1211 hv += is->is_saddr; 1212 is->is_dst = fin->fin_fi.fi_dst; 1213 hv += is->is_daddr; 1214 #ifdef USE_INET6 1215 if (fin->fin_v == 6) { 1216 /* 1217 * For ICMPv6, we check to see if the destination address is 1218 * a multicast address. If it is, do not include it in the 1219 * calculation of the hash because the correct reply will come 1220 * back from a real address, not a multicast address. 1221 */ 1222 if ((is->is_p == IPPROTO_ICMPV6) && 1223 IN6_IS_ADDR_MULTICAST(&is->is_dst.in6)) { 1224 /* 1225 * So you can do keep state with neighbour discovery. 1226 * 1227 * Here we could use the address from the neighbour 1228 * solicit message to put in the state structure and 1229 * we could use that without a wildcard flag too... 1230 */ 1231 is->is_flags |= SI_W_DADDR; 1232 hv -= is->is_daddr; 1233 } else { 1234 hv += is->is_dst.i6[1]; 1235 hv += is->is_dst.i6[2]; 1236 hv += is->is_dst.i6[3]; 1237 } 1238 hv += is->is_src.i6[1]; 1239 hv += is->is_src.i6[2]; 1240 hv += is->is_src.i6[3]; 1241 } 1242 #endif 1243 if ((fin->fin_v == 4) && 1244 (fin->fin_flx & (FI_MULTICAST|FI_BROADCAST|FI_MBCAST))) { 1245 if (fin->fin_out == 0) { 1246 flags |= SI_W_DADDR|SI_CLONE; 1247 hv -= is->is_daddr; 1248 } else { 1249 flags |= SI_W_SADDR|SI_CLONE; 1250 hv -= is->is_saddr; 1251 } 1252 } 1253 1254 switch (is->is_p) 1255 { 1256 #ifdef USE_INET6 1257 case IPPROTO_ICMPV6 : 1258 ic = fin->fin_dp; 1259 1260 switch (ic->icmp_type) 1261 { 1262 case ICMP6_ECHO_REQUEST : 1263 is->is_icmp.ici_type = ic->icmp_type; 1264 hv += (is->is_icmp.ici_id = ic->icmp_id); 1265 break; 1266 case ICMP6_MEMBERSHIP_QUERY : 1267 case ND_ROUTER_SOLICIT : 1268 case ND_NEIGHBOR_SOLICIT : 1269 case ICMP6_NI_QUERY : 1270 is->is_icmp.ici_type = ic->icmp_type; 1271 break; 1272 default : 1273 return NULL; 1274 } 1275 ATOMIC_INCL(ifs->ifs_ips_stats.iss_icmp); 1276 break; 1277 #endif 1278 case IPPROTO_ICMP : 1279 ic = fin->fin_dp; 1280 1281 switch (ic->icmp_type) 1282 { 1283 case ICMP_ECHO : 1284 case ICMP_TSTAMP : 1285 case ICMP_IREQ : 1286 case ICMP_MASKREQ : 1287 is->is_icmp.ici_type = ic->icmp_type; 1288 hv += (is->is_icmp.ici_id = ic->icmp_id); 1289 break; 1290 default : 1291 return NULL; 1292 } 1293 ATOMIC_INCL(ifs->ifs_ips_stats.iss_icmp); 1294 break; 1295 1296 case IPPROTO_GRE : 1297 gre = fin->fin_dp; 1298 1299 is->is_gre.gs_flags = gre->gr_flags; 1300 is->is_gre.gs_ptype = gre->gr_ptype; 1301 if (GRE_REV(is->is_gre.gs_flags) == 1) { 1302 is->is_call[0] = fin->fin_data[0]; 1303 is->is_call[1] = fin->fin_data[1]; 1304 } 1305 break; 1306 1307 case IPPROTO_TCP : 1308 tcp = fin->fin_dp; 1309 1310 if (tcp->th_flags & TH_RST) 1311 return NULL; 1312 /* 1313 * The endian of the ports doesn't matter, but the ack and 1314 * sequence numbers do as we do mathematics on them later. 1315 */ 1316 is->is_sport = htons(fin->fin_data[0]); 1317 is->is_dport = htons(fin->fin_data[1]); 1318 if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) { 1319 hv += is->is_sport; 1320 hv += is->is_dport; 1321 } 1322 1323 /* 1324 * If this is a real packet then initialise fields in the 1325 * state information structure from the TCP header information. 1326 */ 1327 1328 is->is_maxdwin = 1; 1329 is->is_maxswin = ntohs(tcp->th_win); 1330 if (is->is_maxswin == 0) 1331 is->is_maxswin = 1; 1332 1333 if ((fin->fin_flx & FI_IGNORE) == 0) { 1334 is->is_send = ntohl(tcp->th_seq) + fin->fin_dlen - 1335 (TCP_OFF(tcp) << 2) + 1336 ((tcp->th_flags & TH_SYN) ? 1 : 0) + 1337 ((tcp->th_flags & TH_FIN) ? 1 : 0); 1338 is->is_maxsend = is->is_send; 1339 1340 /* 1341 * Window scale option is only present in 1342 * SYN/SYN-ACK packet. 1343 */ 1344 if ((tcp->th_flags & ~(TH_FIN|TH_ACK|TH_ECNALL)) == 1345 TH_SYN && 1346 (TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) { 1347 if (fr_tcpoptions(fin, tcp, 1348 &is->is_tcp.ts_data[0]) == -1) { 1349 fin->fin_flx |= FI_BAD; 1350 } 1351 } 1352 1353 if ((fin->fin_out != 0) && (pass & FR_NEWISN) != 0) { 1354 fr_checknewisn(fin, is); 1355 fr_fixoutisn(fin, is); 1356 } 1357 1358 if ((tcp->th_flags & TH_OPENING) == TH_SYN) 1359 flags |= IS_TCPFSM; 1360 else { 1361 is->is_maxdwin = is->is_maxswin * 2; 1362 is->is_dend = ntohl(tcp->th_ack); 1363 is->is_maxdend = ntohl(tcp->th_ack); 1364 is->is_maxdwin *= 2; 1365 } 1366 } 1367 1368 /* 1369 * If we're creating state for a starting connection, start the 1370 * timer on it as we'll never see an error if it fails to 1371 * connect. 1372 */ 1373 ATOMIC_INCL(ifs->ifs_ips_stats.iss_tcp); 1374 break; 1375 1376 case IPPROTO_UDP : 1377 tcp = fin->fin_dp; 1378 1379 is->is_sport = htons(fin->fin_data[0]); 1380 is->is_dport = htons(fin->fin_data[1]); 1381 if ((flags & (SI_W_DPORT|SI_W_SPORT)) == 0) { 1382 hv += tcp->th_dport; 1383 hv += tcp->th_sport; 1384 } 1385 ATOMIC_INCL(ifs->ifs_ips_stats.iss_udp); 1386 break; 1387 1388 default : 1389 break; 1390 } 1391 hv = DOUBLE_HASH(hv, ifs); 1392 is->is_hv = hv; 1393 is->is_rule = fr; 1394 is->is_flags = flags & IS_INHERITED; 1395 1396 /* 1397 * Look for identical state. 1398 */ 1399 for (is = ifs->ifs_ips_table[is->is_hv % ifs->ifs_fr_statesize]; 1400 is != NULL; 1401 is = is->is_hnext) { 1402 if (fr_matchstates(&ips, is) == 1) 1403 break; 1404 } 1405 1406 /* 1407 * we've found a matching state -> state already exists, 1408 * we are not going to add a duplicate record. 1409 */ 1410 if (is != NULL) 1411 return NULL; 1412 1413 if (ifs->ifs_ips_stats.iss_bucketlen[hv] >= ifs->ifs_fr_state_maxbucket) { 1414 ATOMIC_INCL(ifs->ifs_ips_stats.iss_bucketfull); 1415 return NULL; 1416 } 1417 KMALLOC(is, ipstate_t *); 1418 if (is == NULL) { 1419 ATOMIC_INCL(ifs->ifs_ips_stats.iss_nomem); 1420 return NULL; 1421 } 1422 bcopy((char *)&ips, (char *)is, sizeof(*is)); 1423 /* 1424 * Do not do the modulous here, it is done in fr_stinsert(). 1425 */ 1426 if (fr != NULL) { 1427 (void) strncpy(is->is_group, fr->fr_group, FR_GROUPLEN); 1428 if (fr->fr_age[0] != 0) { 1429 is->is_tqehead[0] = 1430 fr_addtimeoutqueue(&ifs->ifs_ips_utqe, 1431 fr->fr_age[0], ifs); 1432 is->is_sti.tqe_flags |= TQE_RULEBASED; 1433 } 1434 if (fr->fr_age[1] != 0) { 1435 is->is_tqehead[1] = 1436 fr_addtimeoutqueue(&ifs->ifs_ips_utqe, 1437 fr->fr_age[1], ifs); 1438 is->is_sti.tqe_flags |= TQE_RULEBASED; 1439 } 1440 is->is_tag = fr->fr_logtag; 1441 1442 is->is_ifp[(out << 1) + 1] = fr->fr_ifas[1]; 1443 is->is_ifp[(1 - out) << 1] = fr->fr_ifas[2]; 1444 is->is_ifp[((1 - out) << 1) + 1] = fr->fr_ifas[3]; 1445 1446 if (((ifp = fr->fr_ifas[1]) != NULL) && 1447 (ifp != (void *)-1)) { 1448 COPYIFNAME(ifp, is->is_ifname[(out << 1) + 1], fr->fr_v); 1449 } 1450 if (((ifp = fr->fr_ifas[2]) != NULL) && 1451 (ifp != (void *)-1)) { 1452 COPYIFNAME(ifp, is->is_ifname[(1 - out) << 1], fr->fr_v); 1453 } 1454 if (((ifp = fr->fr_ifas[3]) != NULL) && 1455 (ifp != (void *)-1)) { 1456 COPYIFNAME(ifp, is->is_ifname[((1 - out) << 1) + 1], fr->fr_v); 1457 } 1458 } 1459 1460 is->is_ifp[out << 1] = fin->fin_ifp; 1461 if (fin->fin_ifp != NULL) { 1462 COPYIFNAME(fin->fin_ifp, is->is_ifname[out << 1], fr->fr_v); 1463 } 1464 1465 /* 1466 * It may seem strange to set is_ref to 2, but fr_check() will call 1467 * fr_statederef() after calling fr_addstate() and the idea is to 1468 * have it exist at the end of fr_check() with is_ref == 1. 1469 */ 1470 is->is_ref = 2; 1471 is->is_pkts[0] = 0, is->is_bytes[0] = 0; 1472 is->is_pkts[1] = 0, is->is_bytes[1] = 0; 1473 is->is_pkts[2] = 0, is->is_bytes[2] = 0; 1474 is->is_pkts[3] = 0, is->is_bytes[3] = 0; 1475 if ((fin->fin_flx & FI_IGNORE) == 0) { 1476 is->is_pkts[out] = 1; 1477 is->is_bytes[out] = fin->fin_plen; 1478 is->is_flx[out][0] = fin->fin_flx & FI_CMP; 1479 is->is_flx[out][0] &= ~FI_OOW; 1480 } 1481 1482 if (pass & FR_STSTRICT) 1483 is->is_flags |= IS_STRICT; 1484 1485 if (pass & FR_STATESYNC) 1486 is->is_flags |= IS_STATESYNC; 1487 1488 if (flags & (SI_WILDP|SI_WILDA)) { 1489 ATOMIC_INCL(ifs->ifs_ips_stats.iss_wild); 1490 } 1491 is->is_rulen = fin->fin_rule; 1492 1493 1494 if (pass & FR_LOGFIRST) 1495 is->is_pass &= ~(FR_LOGFIRST|FR_LOG); 1496 1497 READ_ENTER(&ifs->ifs_ipf_state); 1498 is->is_me = stsave; 1499 1500 fr_stinsert(is, fin->fin_rev, ifs); 1501 1502 if (fin->fin_p == IPPROTO_TCP) { 1503 /* 1504 * If we're creating state for a starting connection, start the 1505 * timer on it as we'll never see an error if it fails to 1506 * connect. 1507 */ 1508 (void) fr_tcp_age(&is->is_sti, fin, ifs->ifs_ips_tqtqb, 1509 is->is_flags); 1510 MUTEX_EXIT(&is->is_lock); 1511 #ifdef IPFILTER_SCAN 1512 if ((is->is_flags & SI_CLONE) == 0) 1513 (void) ipsc_attachis(is); 1514 #endif 1515 } else { 1516 MUTEX_EXIT(&is->is_lock); 1517 } 1518 #ifdef IPFILTER_SYNC 1519 if ((is->is_flags & IS_STATESYNC) && ((is->is_flags & SI_CLONE) == 0)) 1520 is->is_sync = ipfsync_new(SMC_STATE, fin, is); 1521 #endif 1522 if (ifs->ifs_ipstate_logging) 1523 ipstate_log(is, ISL_NEW, ifs); 1524 1525 RWLOCK_EXIT(&ifs->ifs_ipf_state); 1526 fin->fin_state = is; 1527 fin->fin_rev = IP6_NEQ(&is->is_dst, &fin->fin_daddr); 1528 fin->fin_flx |= FI_STATE; 1529 if (fin->fin_flx & FI_FRAG) 1530 (void) fr_newfrag(fin, pass ^ FR_KEEPSTATE); 1531 1532 return is; 1533 } 1534 1535 1536 /* ------------------------------------------------------------------------ */ 1537 /* Function: fr_tcpoptions */ 1538 /* Returns: int - 1 == packet matches state entry, 0 == it does not */ 1539 /* Parameters: fin(I) - pointer to packet information */ 1540 /* tcp(I) - pointer to TCP packet header */ 1541 /* td(I) - pointer to TCP data held as part of the state */ 1542 /* */ 1543 /* Look after the TCP header for any options and deal with those that are */ 1544 /* present. Record details about those that we recogise. */ 1545 /* ------------------------------------------------------------------------ */ 1546 static int fr_tcpoptions(fin, tcp, td) 1547 fr_info_t *fin; 1548 tcphdr_t *tcp; 1549 tcpdata_t *td; 1550 { 1551 int off, mlen, ol, i, len, retval; 1552 char buf[64], *s, opt; 1553 mb_t *m = NULL; 1554 1555 len = (TCP_OFF(tcp) << 2); 1556 if (fin->fin_dlen < len) 1557 return 0; 1558 len -= sizeof(*tcp); 1559 1560 off = fin->fin_plen - fin->fin_dlen + sizeof(*tcp) + fin->fin_ipoff; 1561 1562 m = fin->fin_m; 1563 mlen = MSGDSIZE(m) - off; 1564 if (len > mlen) { 1565 len = mlen; 1566 retval = 0; 1567 } else { 1568 retval = 1; 1569 } 1570 1571 COPYDATA(m, off, len, buf); 1572 1573 for (s = buf; len > 0; ) { 1574 opt = *s; 1575 if (opt == TCPOPT_EOL) 1576 break; 1577 else if (opt == TCPOPT_NOP) 1578 ol = 1; 1579 else { 1580 if (len < 2) 1581 break; 1582 ol = (int)*(s + 1); 1583 if (ol < 2 || ol > len) 1584 break; 1585 1586 /* 1587 * Extract the TCP options we are interested in out of 1588 * the header and store them in the the tcpdata struct. 1589 */ 1590 switch (opt) 1591 { 1592 case TCPOPT_WINDOW : 1593 if (ol == TCPOLEN_WINDOW) { 1594 i = (int)*(s + 2); 1595 if (i > TCP_WSCALE_MAX) 1596 i = TCP_WSCALE_MAX; 1597 else if (i < 0) 1598 i = 0; 1599 td->td_winscale = i; 1600 td->td_winflags |= TCP_WSCALE_SEEN | 1601 TCP_WSCALE_FIRST; 1602 } else 1603 retval = -1; 1604 break; 1605 case TCPOPT_MAXSEG : 1606 /* 1607 * So, if we wanted to set the TCP MAXSEG, 1608 * it should be done here... 1609 */ 1610 if (ol == TCPOLEN_MAXSEG) { 1611 i = (int)*(s + 2); 1612 i <<= 8; 1613 i += (int)*(s + 3); 1614 td->td_maxseg = i; 1615 } else 1616 retval = -1; 1617 break; 1618 case TCPOPT_SACK_PERMITTED : 1619 if (ol == TCPOLEN_SACK_PERMITTED) 1620 td->td_winflags |= TCP_SACK_PERMIT; 1621 else 1622 retval = -1; 1623 break; 1624 } 1625 } 1626 len -= ol; 1627 s += ol; 1628 } 1629 return retval; 1630 } 1631 1632 1633 /* ------------------------------------------------------------------------ */ 1634 /* Function: fr_tcpstate */ 1635 /* Returns: int - 1 == packet matches state entry, 0 == it does not */ 1636 /* Parameters: fin(I) - pointer to packet information */ 1637 /* tcp(I) - pointer to TCP packet header */ 1638 /* is(I) - pointer to master state structure */ 1639 /* */ 1640 /* Check to see if a packet with TCP headers fits within the TCP window. */ 1641 /* Change timeout depending on whether new packet is a SYN-ACK returning */ 1642 /* for a SYN or a RST or FIN which indicate time to close up shop. */ 1643 /* ------------------------------------------------------------------------ */ 1644 static int fr_tcpstate(fin, tcp, is) 1645 fr_info_t *fin; 1646 tcphdr_t *tcp; 1647 ipstate_t *is; 1648 { 1649 int source, ret = 0, flags; 1650 tcpdata_t *fdata, *tdata; 1651 ipf_stack_t *ifs = fin->fin_ifs; 1652 1653 source = !fin->fin_rev; 1654 if (((is->is_flags & IS_TCPFSM) != 0) && (source == 1) && 1655 (ntohs(is->is_sport) != fin->fin_data[0])) 1656 source = 0; 1657 fdata = &is->is_tcp.ts_data[!source]; 1658 tdata = &is->is_tcp.ts_data[source]; 1659 1660 MUTEX_ENTER(&is->is_lock); 1661 1662 /* 1663 * If a SYN packet is received for a connection that is in a half 1664 * closed state, then move its state entry to deletetq. In such case 1665 * the SYN packet will be consequently dropped. This allows new state 1666 * entry to be created with a retransmited SYN packet. 1667 */ 1668 if ((tcp->th_flags & TH_OPENING) == TH_SYN) { 1669 if (((is->is_state[source] > IPF_TCPS_ESTABLISHED) || 1670 (is->is_state[source] == IPF_TCPS_CLOSED)) && 1671 ((is->is_state[!source] > IPF_TCPS_ESTABLISHED) || 1672 (is->is_state[!source] == IPF_TCPS_CLOSED))) { 1673 /* 1674 * Do not update is->is_sti.tqe_die in case state entry 1675 * is already present in deletetq. It prevents state 1676 * entry ttl update by retransmitted SYN packets, which 1677 * may arrive before timer tick kicks off. The SYN 1678 * packet will be dropped again. 1679 */ 1680 if (is->is_sti.tqe_ifq != &ifs->ifs_ips_deletetq) 1681 fr_movequeue(&is->is_sti, is->is_sti.tqe_ifq, 1682 &fin->fin_ifs->ifs_ips_deletetq, 1683 fin->fin_ifs); 1684 1685 MUTEX_EXIT(&is->is_lock); 1686 return 0; 1687 } 1688 } 1689 1690 if (fr_tcpinwindow(fin, fdata, tdata, tcp, is->is_flags)) { 1691 #ifdef IPFILTER_SCAN 1692 if (is->is_flags & (IS_SC_CLIENT|IS_SC_SERVER)) { 1693 ipsc_packet(fin, is); 1694 if (FR_ISBLOCK(is->is_pass)) { 1695 MUTEX_EXIT(&is->is_lock); 1696 return 1; 1697 } 1698 } 1699 #endif 1700 1701 /* 1702 * Nearing end of connection, start timeout. 1703 */ 1704 ret = fr_tcp_age(&is->is_sti, fin, ifs->ifs_ips_tqtqb, 1705 is->is_flags); 1706 if (ret == 0) { 1707 MUTEX_EXIT(&is->is_lock); 1708 return 0; 1709 } 1710 1711 /* 1712 * set s0's as appropriate. Use syn-ack packet as it 1713 * contains both pieces of required information. 1714 */ 1715 /* 1716 * Window scale option is only present in SYN/SYN-ACK packet. 1717 * Compare with ~TH_FIN to mask out T/TCP setups. 1718 */ 1719 flags = tcp->th_flags & ~(TH_FIN|TH_ECNALL); 1720 if (flags == (TH_SYN|TH_ACK)) { 1721 is->is_s0[source] = ntohl(tcp->th_ack); 1722 is->is_s0[!source] = ntohl(tcp->th_seq) + 1; 1723 if (TCP_OFF(tcp) > (sizeof (tcphdr_t) >> 2)) { 1724 (void) fr_tcpoptions(fin, tcp, fdata); 1725 } 1726 if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN)) 1727 fr_checknewisn(fin, is); 1728 } else if (flags == TH_SYN) { 1729 is->is_s0[source] = ntohl(tcp->th_seq) + 1; 1730 if ((TCP_OFF(tcp) > (sizeof(tcphdr_t) >> 2))) 1731 (void) fr_tcpoptions(fin, tcp, tdata); 1732 1733 if ((fin->fin_out != 0) && (is->is_pass & FR_NEWISN)) 1734 fr_checknewisn(fin, is); 1735 1736 } 1737 ret = 1; 1738 } else 1739 fin->fin_flx |= FI_OOW; 1740 MUTEX_EXIT(&is->is_lock); 1741 return ret; 1742 } 1743 1744 1745 /* ------------------------------------------------------------------------ */ 1746 /* Function: fr_checknewisn */ 1747 /* Returns: Nil */ 1748 /* Parameters: fin(I) - pointer to packet information */ 1749 /* is(I) - pointer to master state structure */ 1750 /* */ 1751 /* Check to see if this TCP connection is expecting and needs a new */ 1752 /* sequence number for a particular direction of the connection. */ 1753 /* */ 1754 /* NOTE: This does not actually change the sequence numbers, only gets new */ 1755 /* one ready. */ 1756 /* ------------------------------------------------------------------------ */ 1757 static void fr_checknewisn(fin, is) 1758 fr_info_t *fin; 1759 ipstate_t *is; 1760 { 1761 u_32_t sumd, old, new; 1762 tcphdr_t *tcp; 1763 int i; 1764 1765 i = fin->fin_rev; 1766 tcp = fin->fin_dp; 1767 1768 if (((i == 0) && !(is->is_flags & IS_ISNSYN)) || 1769 ((i == 1) && !(is->is_flags & IS_ISNACK))) { 1770 old = ntohl(tcp->th_seq); 1771 new = fr_newisn(fin); 1772 is->is_isninc[i] = new - old; 1773 CALC_SUMD(old, new, sumd); 1774 is->is_sumd[i] = (sumd & 0xffff) + (sumd >> 16); 1775 1776 is->is_flags |= ((i == 0) ? IS_ISNSYN : IS_ISNACK); 1777 } 1778 } 1779 1780 1781 /* ------------------------------------------------------------------------ */ 1782 /* Function: fr_tcpinwindow */ 1783 /* Returns: int - 1 == packet inside TCP "window", 0 == not inside. */ 1784 /* Parameters: fin(I) - pointer to packet information */ 1785 /* fdata(I) - pointer to tcp state informatio (forward) */ 1786 /* tdata(I) - pointer to tcp state informatio (reverse) */ 1787 /* tcp(I) - pointer to TCP packet header */ 1788 /* */ 1789 /* Given a packet has matched addresses and ports, check to see if it is */ 1790 /* within the TCP data window. In a show of generosity, allow packets that */ 1791 /* are within the window space behind the current sequence # as well. */ 1792 /* ------------------------------------------------------------------------ */ 1793 int fr_tcpinwindow(fin, fdata, tdata, tcp, flags) 1794 fr_info_t *fin; 1795 tcpdata_t *fdata, *tdata; 1796 tcphdr_t *tcp; 1797 int flags; 1798 { 1799 tcp_seq seq, ack, end; 1800 int ackskew, tcpflags; 1801 u_32_t win, maxwin; 1802 int dsize, inseq; 1803 1804 /* 1805 * Find difference between last checked packet and this packet. 1806 */ 1807 tcpflags = tcp->th_flags; 1808 seq = ntohl(tcp->th_seq); 1809 ack = ntohl(tcp->th_ack); 1810 1811 if (tcpflags & TH_SYN) 1812 win = ntohs(tcp->th_win); 1813 else 1814 win = ntohs(tcp->th_win) << fdata->td_winscale; 1815 1816 /* 1817 * win 0 means the receiving endpoint has closed the window, because it 1818 * has not enough memory to receive data from sender. In such case we 1819 * are pretending window size to be 1 to let TCP probe data through. 1820 * TCP probe data can be either 0 or 1 octet of data, the RFC does not 1821 * state this accurately, so we have to allow 1 octet (win = 1) even if 1822 * the window is closed (win == 0). 1823 */ 1824 if (win == 0) 1825 win = 1; 1826 1827 dsize = fin->fin_dlen - (TCP_OFF(tcp) << 2) + 1828 ((tcpflags & TH_SYN) ? 1 : 0) + ((tcpflags & TH_FIN) ? 1 : 0); 1829 1830 /* 1831 * if window scaling is present, the scaling is only allowed 1832 * for windows not in the first SYN packet. In that packet the 1833 * window is 65535 to specify the largest window possible 1834 * for receivers not implementing the window scale option. 1835 * Currently, we do not assume TTCP here. That means that 1836 * if we see a second packet from a host (after the initial 1837 * SYN), we can assume that the receiver of the SYN did 1838 * already send back the SYN/ACK (and thus that we know if 1839 * the receiver also does window scaling) 1840 */ 1841 if (!(tcpflags & TH_SYN) && (fdata->td_winflags & TCP_WSCALE_FIRST)) { 1842 fdata->td_maxwin = win; 1843 } 1844 1845 end = seq + dsize; 1846 1847 if ((fdata->td_end == 0) && 1848 (!(flags & IS_TCPFSM) || 1849 ((tcpflags & TH_OPENING) == TH_OPENING))) { 1850 /* 1851 * Must be a (outgoing) SYN-ACK in reply to a SYN. 1852 */ 1853 fdata->td_end = end - 1; 1854 fdata->td_maxwin = 1; 1855 fdata->td_maxend = end + win; 1856 } 1857 1858 if (!(tcpflags & TH_ACK)) { /* Pretend an ack was sent */ 1859 ack = tdata->td_end; 1860 } else if (((tcpflags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) && 1861 (ack == 0)) { 1862 /* gross hack to get around certain broken tcp stacks */ 1863 ack = tdata->td_end; 1864 } 1865 1866 maxwin = tdata->td_maxwin; 1867 ackskew = tdata->td_end - ack; 1868 1869 /* 1870 * Strict sequencing only allows in-order delivery. 1871 */ 1872 if ((flags & IS_STRICT) != 0) { 1873 if (seq != fdata->td_end) { 1874 DTRACE_PROBE(strict_check); 1875 return 0; 1876 } 1877 } 1878 1879 #define SEQ_GE(a,b) ((int)((a) - (b)) >= 0) 1880 #define SEQ_GT(a,b) ((int)((a) - (b)) > 0) 1881 inseq = 0; 1882 DTRACE_PROBE4( 1883 dyn_params, 1884 int, dsize, 1885 int, ackskew, 1886 int, maxwin, 1887 int, win 1888 ); 1889 if ( 1890 #if defined(_KERNEL) 1891 /* 1892 * end <-> s + n 1893 * maxend <-> ack + win 1894 * this is upperbound check 1895 */ 1896 (SEQ_GE(fdata->td_maxend, end)) && 1897 /* 1898 * this is lowerbound check 1899 */ 1900 (SEQ_GE(seq, fdata->td_end - maxwin)) && 1901 #endif 1902 /* XXX what about big packets */ 1903 #define MAXACKWINDOW 66000 1904 (-ackskew <= (MAXACKWINDOW << fdata->td_winscale)) && 1905 ( ackskew <= (MAXACKWINDOW << fdata->td_winscale))) { 1906 inseq = 1; 1907 /* 1908 * Microsoft Windows will send the next packet to the right of the 1909 * window if SACK is in use. 1910 */ 1911 } else if ((seq == fdata->td_maxend) && (ackskew == 0) && 1912 (fdata->td_winflags & TCP_SACK_PERMIT) && 1913 (tdata->td_winflags & TCP_SACK_PERMIT)) { 1914 inseq = 1; 1915 /* 1916 * RST ACK with SEQ equal to 0 is sent by some OSes (i.e. Solaris) as a 1917 * response to initial SYN packet, when there is no application 1918 * listeing to on a port, where the SYN packet has came to. 1919 */ 1920 } else if ((seq == 0) && (tcpflags == (TH_RST|TH_ACK)) && 1921 (ackskew >= -1) && (ackskew <= 1)) { 1922 inseq = 1; 1923 } else if (!(flags & IS_TCPFSM)) { 1924 1925 if (!(fdata->td_winflags & 1926 (TCP_WSCALE_SEEN|TCP_WSCALE_FIRST))) { 1927 /* 1928 * No TCPFSM and no window scaling, so make some 1929 * extra guesses. 1930 */ 1931 if ((seq == fdata->td_maxend) && (ackskew == 0)) 1932 inseq = 1; 1933 else if (SEQ_GE(seq + maxwin, fdata->td_end - maxwin)) 1934 inseq = 1; 1935 } 1936 } 1937 1938 if (inseq) { 1939 /* if ackskew < 0 then this should be due to fragmented 1940 * packets. There is no way to know the length of the 1941 * total packet in advance. 1942 * We do know the total length from the fragment cache though. 1943 * Note however that there might be more sessions with 1944 * exactly the same source and destination parameters in the 1945 * state cache (and source and destination is the only stuff 1946 * that is saved in the fragment cache). Note further that 1947 * some TCP connections in the state cache are hashed with 1948 * sport and dport as well which makes it not worthwhile to 1949 * look for them. 1950 * Thus, when ackskew is negative but still seems to belong 1951 * to this session, we bump up the destinations end value. 1952 */ 1953 if (ackskew < 0) { 1954 DTRACE_PROBE2(end_update_td, 1955 int, tdata->td_end, 1956 int, ack 1957 ); 1958 tdata->td_end = ack; 1959 } 1960 1961 /* update max window seen */ 1962 if (fdata->td_maxwin < win) { 1963 DTRACE_PROBE2(win_update_fd, 1964 int, fdata->td_maxwin, 1965 int, win 1966 ); 1967 fdata->td_maxwin = win; 1968 } 1969 1970 if (SEQ_GT(end, fdata->td_end)) { 1971 DTRACE_PROBE2(end_update_fd, 1972 int, fdata->td_end, 1973 int, end 1974 ); 1975 fdata->td_end = end; 1976 } 1977 1978 if (SEQ_GE(ack + win, tdata->td_maxend)) { 1979 DTRACE_PROBE2(max_end_update_td, 1980 int, tdata->td_maxend, 1981 int, ack + win 1982 ); 1983 tdata->td_maxend = ack + win; 1984 } 1985 1986 return 1; 1987 } 1988 fin->fin_flx |= FI_OOW; 1989 1990 #if defined(_KERNEL) 1991 if (!(SEQ_GE(seq, fdata->td_end - maxwin))) 1992 fin->fin_flx |= FI_NEG_OOW; 1993 #endif 1994 1995 return 0; 1996 } 1997 1998 1999 /* ------------------------------------------------------------------------ */ 2000 /* Function: fr_stclone */ 2001 /* Returns: ipstate_t* - NULL == cloning failed, */ 2002 /* else pointer to new state structure */ 2003 /* Parameters: fin(I) - pointer to packet information */ 2004 /* tcp(I) - pointer to TCP/UDP header */ 2005 /* is(I) - pointer to master state structure */ 2006 /* */ 2007 /* Create a "duplcate" state table entry from the master. */ 2008 /* ------------------------------------------------------------------------ */ 2009 static ipstate_t *fr_stclone(fin, tcp, is) 2010 fr_info_t *fin; 2011 tcphdr_t *tcp; 2012 ipstate_t *is; 2013 { 2014 ipstate_t *clone; 2015 u_32_t send; 2016 ipf_stack_t *ifs = fin->fin_ifs; 2017 2018 /* 2019 * Trigger automatic call to fr_state_flush() if the 2020 * table has reached capacity specified by hi watermark. 2021 */ 2022 if (ST_TAB_WATER_LEVEL(ifs) > ifs->ifs_state_flush_level_hi) 2023 ifs->ifs_fr_state_doflush = 1; 2024 2025 /* 2026 * If automatic flushing did not do its job, and the table 2027 * has filled up, don't try to create a new entry. A NULL 2028 * return will indicate that the cloning has failed. 2029 */ 2030 if (ifs->ifs_ips_num >= ifs->ifs_fr_statemax) { 2031 ATOMIC_INCL(ifs->ifs_ips_stats.iss_max); 2032 return NULL; 2033 } 2034 2035 KMALLOC(clone, ipstate_t *); 2036 if (clone == NULL) 2037 return NULL; 2038 bcopy((char *)is, (char *)clone, sizeof(*clone)); 2039 2040 MUTEX_NUKE(&clone->is_lock); 2041 2042 clone->is_die = ONE_DAY + ifs->ifs_fr_ticks; 2043 clone->is_state[0] = 0; 2044 clone->is_state[1] = 0; 2045 send = ntohl(tcp->th_seq) + fin->fin_dlen - (TCP_OFF(tcp) << 2) + 2046 ((tcp->th_flags & TH_SYN) ? 1 : 0) + 2047 ((tcp->th_flags & TH_FIN) ? 1 : 0); 2048 2049 if (fin->fin_rev == 1) { 2050 clone->is_dend = send; 2051 clone->is_maxdend = send; 2052 clone->is_send = 0; 2053 clone->is_maxswin = 1; 2054 clone->is_maxdwin = ntohs(tcp->th_win); 2055 if (clone->is_maxdwin == 0) 2056 clone->is_maxdwin = 1; 2057 } else { 2058 clone->is_send = send; 2059 clone->is_maxsend = send; 2060 clone->is_dend = 0; 2061 clone->is_maxdwin = 1; 2062 clone->is_maxswin = ntohs(tcp->th_win); 2063 if (clone->is_maxswin == 0) 2064 clone->is_maxswin = 1; 2065 } 2066 2067 clone->is_flags &= ~SI_CLONE; 2068 clone->is_flags |= SI_CLONED; 2069 fr_stinsert(clone, fin->fin_rev, ifs); 2070 clone->is_ref = 2; 2071 if (clone->is_p == IPPROTO_TCP) { 2072 (void) fr_tcp_age(&clone->is_sti, fin, ifs->ifs_ips_tqtqb, 2073 clone->is_flags); 2074 } 2075 MUTEX_EXIT(&clone->is_lock); 2076 #ifdef IPFILTER_SCAN 2077 (void) ipsc_attachis(is); 2078 #endif 2079 #ifdef IPFILTER_SYNC 2080 if (is->is_flags & IS_STATESYNC) 2081 clone->is_sync = ipfsync_new(SMC_STATE, fin, clone); 2082 #endif 2083 return clone; 2084 } 2085 2086 2087 /* ------------------------------------------------------------------------ */ 2088 /* Function: fr_matchsrcdst */ 2089 /* Returns: Nil */ 2090 /* Parameters: fin(I) - pointer to packet information */ 2091 /* is(I) - pointer to state structure */ 2092 /* src(I) - pointer to source address */ 2093 /* dst(I) - pointer to destination address */ 2094 /* tcp(I) - pointer to TCP/UDP header */ 2095 /* */ 2096 /* Match a state table entry against an IP packet. The logic below is that */ 2097 /* ret gets set to one if the match succeeds, else remains 0. If it is */ 2098 /* still 0 after the test. no match. */ 2099 /* ------------------------------------------------------------------------ */ 2100 static ipstate_t *fr_matchsrcdst(fin, is, src, dst, tcp, cmask) 2101 fr_info_t *fin; 2102 ipstate_t *is; 2103 i6addr_t *src, *dst; 2104 tcphdr_t *tcp; 2105 u_32_t cmask; 2106 { 2107 int ret = 0, rev, out, flags, flx = 0, idx; 2108 u_short sp, dp; 2109 u_32_t cflx; 2110 void *ifp; 2111 ipf_stack_t *ifs = fin->fin_ifs; 2112 2113 rev = IP6_NEQ(&is->is_dst, dst); 2114 ifp = fin->fin_ifp; 2115 out = fin->fin_out; 2116 flags = is->is_flags; 2117 sp = 0; 2118 dp = 0; 2119 2120 if (tcp != NULL) { 2121 sp = htons(fin->fin_sport); 2122 dp = ntohs(fin->fin_dport); 2123 } 2124 if (!rev) { 2125 if (tcp != NULL) { 2126 if (!(flags & SI_W_SPORT) && (sp != is->is_sport)) 2127 rev = 1; 2128 else if (!(flags & SI_W_DPORT) && (dp != is->is_dport)) 2129 rev = 1; 2130 } 2131 } 2132 2133 idx = (out << 1) + rev; 2134 2135 /* 2136 * If the interface for this 'direction' is set, make sure it matches. 2137 * An interface name that is not set matches any, as does a name of *. 2138 */ 2139 if ((is->is_ifp[idx] == NULL && 2140 (*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '*')) || 2141 is->is_ifp[idx] == ifp) 2142 ret = 1; 2143 2144 if (ret == 0) 2145 return NULL; 2146 ret = 0; 2147 2148 /* 2149 * Match addresses and ports. 2150 */ 2151 if (rev == 0) { 2152 if ((IP6_EQ(&is->is_dst, dst) || (flags & SI_W_DADDR)) && 2153 (IP6_EQ(&is->is_src, src) || (flags & SI_W_SADDR))) { 2154 if (tcp) { 2155 if ((sp == is->is_sport || flags & SI_W_SPORT)&& 2156 (dp == is->is_dport || flags & SI_W_DPORT)) 2157 ret = 1; 2158 } else { 2159 ret = 1; 2160 } 2161 } 2162 } else { 2163 if ((IP6_EQ(&is->is_dst, src) || (flags & SI_W_DADDR)) && 2164 (IP6_EQ(&is->is_src, dst) || (flags & SI_W_SADDR))) { 2165 if (tcp) { 2166 if ((dp == is->is_sport || flags & SI_W_SPORT)&& 2167 (sp == is->is_dport || flags & SI_W_DPORT)) 2168 ret = 1; 2169 } else { 2170 ret = 1; 2171 } 2172 } 2173 } 2174 2175 if (ret == 0) 2176 return NULL; 2177 2178 /* 2179 * Whether or not this should be here, is questionable, but the aim 2180 * is to get this out of the main line. 2181 */ 2182 if (tcp == NULL) 2183 flags = is->is_flags & ~(SI_WILDP|SI_NEWFR|SI_CLONE|SI_CLONED); 2184 2185 /* 2186 * Only one of the source or destination address can be flaged as a 2187 * wildcard. Fill in the missing address, if set. 2188 * For IPv6, if the address being copied in is multicast, then 2189 * don't reset the wild flag - multicast causes it to be set in the 2190 * first place! 2191 */ 2192 if ((flags & (SI_W_SADDR|SI_W_DADDR))) { 2193 fr_ip_t *fi = &fin->fin_fi; 2194 2195 if ((flags & SI_W_SADDR) != 0) { 2196 if (rev == 0) { 2197 #ifdef USE_INET6 2198 if (is->is_v == 6 && 2199 IN6_IS_ADDR_MULTICAST(&fi->fi_src.in6)) 2200 /*EMPTY*/; 2201 else 2202 #endif 2203 { 2204 is->is_src = fi->fi_src; 2205 is->is_flags &= ~SI_W_SADDR; 2206 } 2207 } else { 2208 #ifdef USE_INET6 2209 if (is->is_v == 6 && 2210 IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6)) 2211 /*EMPTY*/; 2212 else 2213 #endif 2214 { 2215 is->is_src = fi->fi_dst; 2216 is->is_flags &= ~SI_W_SADDR; 2217 } 2218 } 2219 } else if ((flags & SI_W_DADDR) != 0) { 2220 if (rev == 0) { 2221 #ifdef USE_INET6 2222 if (is->is_v == 6 && 2223 IN6_IS_ADDR_MULTICAST(&fi->fi_dst.in6)) 2224 /*EMPTY*/; 2225 else 2226 #endif 2227 { 2228 is->is_dst = fi->fi_dst; 2229 is->is_flags &= ~SI_W_DADDR; 2230 } 2231 } else { 2232 #ifdef USE_INET6 2233 if (is->is_v == 6 && 2234 IN6_IS_ADDR_MULTICAST(&fi->fi_src.in6)) 2235 /*EMPTY*/; 2236 else 2237 #endif 2238 { 2239 is->is_dst = fi->fi_src; 2240 is->is_flags &= ~SI_W_DADDR; 2241 } 2242 } 2243 } 2244 if ((is->is_flags & (SI_WILDA|SI_WILDP)) == 0) { 2245 ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild); 2246 } 2247 } 2248 2249 flx = fin->fin_flx & cmask; 2250 cflx = is->is_flx[out][rev]; 2251 2252 /* 2253 * Match up any flags set from IP options. 2254 */ 2255 if ((cflx && (flx != (cflx & cmask))) || 2256 ((fin->fin_optmsk & is->is_optmsk[rev]) != is->is_opt[rev]) || 2257 ((fin->fin_secmsk & is->is_secmsk) != is->is_sec) || 2258 ((fin->fin_auth & is->is_authmsk) != is->is_auth)) 2259 return NULL; 2260 2261 /* 2262 * Only one of the source or destination port can be flagged as a 2263 * wildcard. When filling it in, fill in a copy of the matched entry 2264 * if it has the cloning flag set. 2265 */ 2266 if ((fin->fin_flx & FI_IGNORE) != 0) { 2267 fin->fin_rev = rev; 2268 return is; 2269 } 2270 2271 if ((flags & (SI_W_SPORT|SI_W_DPORT))) { 2272 if ((flags & SI_CLONE) != 0) { 2273 ipstate_t *clone; 2274 2275 clone = fr_stclone(fin, tcp, is); 2276 if (clone == NULL) 2277 return NULL; 2278 is = clone; 2279 } else { 2280 ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild); 2281 } 2282 2283 if ((flags & SI_W_SPORT) != 0) { 2284 if (rev == 0) { 2285 is->is_sport = sp; 2286 is->is_send = ntohl(tcp->th_seq); 2287 } else { 2288 is->is_sport = dp; 2289 is->is_send = ntohl(tcp->th_ack); 2290 } 2291 is->is_maxsend = is->is_send + 1; 2292 } else if ((flags & SI_W_DPORT) != 0) { 2293 if (rev == 0) { 2294 is->is_dport = dp; 2295 is->is_dend = ntohl(tcp->th_ack); 2296 } else { 2297 is->is_dport = sp; 2298 is->is_dend = ntohl(tcp->th_seq); 2299 } 2300 is->is_maxdend = is->is_dend + 1; 2301 } 2302 is->is_flags &= ~(SI_W_SPORT|SI_W_DPORT); 2303 if ((flags & SI_CLONED) && ifs->ifs_ipstate_logging) 2304 ipstate_log(is, ISL_CLONE, ifs); 2305 } 2306 2307 ret = -1; 2308 2309 if (is->is_flx[out][rev] == 0) { 2310 is->is_flx[out][rev] = flx; 2311 is->is_opt[rev] = fin->fin_optmsk; 2312 if (is->is_v == 6) { 2313 is->is_opt[rev] &= ~0x8; 2314 is->is_optmsk[rev] &= ~0x8; 2315 } 2316 } 2317 2318 /* 2319 * Check if the interface name for this "direction" is set and if not, 2320 * fill it in. 2321 */ 2322 if (is->is_ifp[idx] == NULL && 2323 (*is->is_ifname[idx] == '\0' || *is->is_ifname[idx] == '*')) { 2324 is->is_ifp[idx] = ifp; 2325 COPYIFNAME(ifp, is->is_ifname[idx], fin->fin_v); 2326 } 2327 fin->fin_rev = rev; 2328 return is; 2329 } 2330 2331 2332 /* ------------------------------------------------------------------------ */ 2333 /* Function: fr_checkicmpmatchingstate */ 2334 /* Returns: Nil */ 2335 /* Parameters: fin(I) - pointer to packet information */ 2336 /* */ 2337 /* If we've got an ICMP error message, using the information stored in the */ 2338 /* ICMP packet, look for a matching state table entry. */ 2339 /* */ 2340 /* If we return NULL then no lock on ipf_state is held. */ 2341 /* If we return non-null then a read-lock on ipf_state is held. */ 2342 /* ------------------------------------------------------------------------ */ 2343 static ipstate_t *fr_checkicmpmatchingstate(fin) 2344 fr_info_t *fin; 2345 { 2346 ipstate_t *is, **isp; 2347 u_short sport, dport; 2348 u_char pr; 2349 int backward, i, oi; 2350 i6addr_t dst, src; 2351 struct icmp *ic; 2352 u_short savelen; 2353 icmphdr_t *icmp; 2354 fr_info_t ofin; 2355 tcphdr_t *tcp; 2356 int len; 2357 ip_t *oip; 2358 u_int hv; 2359 ipf_stack_t *ifs = fin->fin_ifs; 2360 2361 /* 2362 * Does it at least have the return (basic) IP header ? 2363 * Is it an actual recognised ICMP error type? 2364 * Only a basic IP header (no options) should be with 2365 * an ICMP error header. 2366 */ 2367 if ((fin->fin_v != 4) || (fin->fin_hlen != sizeof(ip_t)) || 2368 (fin->fin_plen < ICMPERR_MINPKTLEN) || 2369 !(fin->fin_flx & FI_ICMPERR)) 2370 return NULL; 2371 ic = fin->fin_dp; 2372 2373 oip = (ip_t *)((char *)ic + ICMPERR_ICMPHLEN); 2374 /* 2375 * Check if the at least the old IP header (with options) and 2376 * 8 bytes of payload is present. 2377 */ 2378 if (fin->fin_plen < ICMPERR_MAXPKTLEN + ((IP_HL(oip) - 5) << 2)) 2379 return NULL; 2380 2381 /* 2382 * Sanity Checks. 2383 */ 2384 len = fin->fin_dlen - ICMPERR_ICMPHLEN; 2385 if ((len <= 0) || ((IP_HL(oip) << 2) > len)) 2386 return NULL; 2387 2388 /* 2389 * Is the buffer big enough for all of it ? It's the size of the IP 2390 * header claimed in the encapsulated part which is of concern. It 2391 * may be too big to be in this buffer but not so big that it's 2392 * outside the ICMP packet, leading to TCP deref's causing problems. 2393 * This is possible because we don't know how big oip_hl is when we 2394 * do the pullup early in fr_check() and thus can't guarantee it is 2395 * all here now. 2396 */ 2397 #ifdef _KERNEL 2398 { 2399 mb_t *m; 2400 2401 m = fin->fin_m; 2402 # if defined(MENTAT) 2403 if ((char *)oip + len > (char *)m->b_wptr) 2404 return NULL; 2405 # else 2406 if ((char *)oip + len > (char *)fin->fin_ip + m->m_len) 2407 return NULL; 2408 # endif 2409 } 2410 #endif 2411 bcopy((char *)fin, (char *)&ofin, sizeof(*fin)); 2412 2413 /* 2414 * in the IPv4 case we must zero the i6addr union otherwise 2415 * the IP6_EQ and IP6_NEQ macros produce the wrong results because 2416 * of the 'junk' in the unused part of the union 2417 */ 2418 bzero((char *)&src, sizeof(src)); 2419 bzero((char *)&dst, sizeof(dst)); 2420 2421 /* 2422 * we make an fin entry to be able to feed it to 2423 * matchsrcdst note that not all fields are encessary 2424 * but this is the cleanest way. Note further we fill 2425 * in fin_mp such that if someone uses it we'll get 2426 * a kernel panic. fr_matchsrcdst does not use this. 2427 * 2428 * watch out here, as ip is in host order and oip in network 2429 * order. Any change we make must be undone afterwards, like 2430 * oip->ip_off - it is still in network byte order so fix it. 2431 */ 2432 savelen = oip->ip_len; 2433 oip->ip_len = len; 2434 oip->ip_off = ntohs(oip->ip_off); 2435 2436 ofin.fin_flx = FI_NOCKSUM; 2437 ofin.fin_v = 4; 2438 ofin.fin_ip = oip; 2439 ofin.fin_m = NULL; /* if dereferenced, panic XXX */ 2440 ofin.fin_mp = NULL; /* if dereferenced, panic XXX */ 2441 ofin.fin_plen = fin->fin_dlen - ICMPERR_ICMPHLEN; 2442 (void) fr_makefrip(IP_HL(oip) << 2, oip, &ofin); 2443 ofin.fin_ifp = fin->fin_ifp; 2444 ofin.fin_out = !fin->fin_out; 2445 /* 2446 * Reset the short and bad flag here because in fr_matchsrcdst() 2447 * the flags for the current packet (fin_flx) are compared against 2448 * those for the existing session. 2449 */ 2450 ofin.fin_flx &= ~(FI_BAD|FI_SHORT); 2451 2452 /* 2453 * Put old values of ip_len and ip_off back as we don't know 2454 * if we have to forward the packet (or process it again. 2455 */ 2456 oip->ip_len = savelen; 2457 oip->ip_off = htons(oip->ip_off); 2458 2459 switch (oip->ip_p) 2460 { 2461 case IPPROTO_ICMP : 2462 /* 2463 * an ICMP error can only be generated as a result of an 2464 * ICMP query, not as the response on an ICMP error 2465 * 2466 * XXX theoretically ICMP_ECHOREP and the other reply's are 2467 * ICMP query's as well, but adding them here seems strange XXX 2468 */ 2469 if ((ofin.fin_flx & FI_ICMPERR) != 0) 2470 return NULL; 2471 2472 /* 2473 * perform a lookup of the ICMP packet in the state table 2474 */ 2475 icmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 2476 hv = (pr = oip->ip_p); 2477 src.in4 = oip->ip_src; 2478 hv += src.in4.s_addr; 2479 dst.in4 = oip->ip_dst; 2480 hv += dst.in4.s_addr; 2481 hv += icmp->icmp_id; 2482 hv = DOUBLE_HASH(hv, ifs); 2483 2484 READ_ENTER(&ifs->ifs_ipf_state); 2485 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) { 2486 isp = &is->is_hnext; 2487 if ((is->is_p != pr) || (is->is_v != 4)) 2488 continue; 2489 if (is->is_pass & FR_NOICMPERR) 2490 continue; 2491 is = fr_matchsrcdst(&ofin, is, &src, &dst, 2492 NULL, FI_ICMPCMP); 2493 if (is != NULL) { 2494 if ((is->is_pass & FR_NOICMPERR) != 0) { 2495 RWLOCK_EXIT(&ifs->ifs_ipf_state); 2496 return NULL; 2497 } 2498 /* 2499 * i : the index of this packet (the icmp 2500 * unreachable) 2501 * oi : the index of the original packet found 2502 * in the icmp header (i.e. the packet 2503 * causing this icmp) 2504 * backward : original packet was backward 2505 * compared to the state 2506 */ 2507 backward = IP6_NEQ(&is->is_src, &src); 2508 fin->fin_rev = !backward; 2509 i = (!backward << 1) + fin->fin_out; 2510 oi = (backward << 1) + ofin.fin_out; 2511 if (is->is_icmppkts[i] > is->is_pkts[oi]) 2512 continue; 2513 ifs->ifs_ips_stats.iss_hits++; 2514 is->is_icmppkts[i]++; 2515 return is; 2516 } 2517 } 2518 RWLOCK_EXIT(&ifs->ifs_ipf_state); 2519 return NULL; 2520 case IPPROTO_TCP : 2521 case IPPROTO_UDP : 2522 break; 2523 default : 2524 return NULL; 2525 } 2526 2527 tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 2528 dport = tcp->th_dport; 2529 sport = tcp->th_sport; 2530 2531 hv = (pr = oip->ip_p); 2532 src.in4 = oip->ip_src; 2533 hv += src.in4.s_addr; 2534 dst.in4 = oip->ip_dst; 2535 hv += dst.in4.s_addr; 2536 hv += dport; 2537 hv += sport; 2538 hv = DOUBLE_HASH(hv, ifs); 2539 2540 READ_ENTER(&ifs->ifs_ipf_state); 2541 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) { 2542 isp = &is->is_hnext; 2543 /* 2544 * Only allow this icmp though if the 2545 * encapsulated packet was allowed through the 2546 * other way around. Note that the minimal amount 2547 * of info present does not allow for checking against 2548 * tcp internals such as seq and ack numbers. Only the 2549 * ports are known to be present and can be even if the 2550 * short flag is set. 2551 */ 2552 if ((is->is_p == pr) && (is->is_v == 4) && 2553 (is = fr_matchsrcdst(&ofin, is, &src, &dst, 2554 tcp, FI_ICMPCMP))) { 2555 /* 2556 * i : the index of this packet (the icmp unreachable) 2557 * oi : the index of the original packet found in the 2558 * icmp header (i.e. the packet causing this icmp) 2559 * backward : original packet was backward compared to 2560 * the state 2561 */ 2562 backward = IP6_NEQ(&is->is_src, &src); 2563 fin->fin_rev = !backward; 2564 i = (!backward << 1) + fin->fin_out; 2565 oi = (backward << 1) + ofin.fin_out; 2566 2567 if (((is->is_pass & FR_NOICMPERR) != 0) || 2568 (is->is_icmppkts[i] > is->is_pkts[oi])) 2569 break; 2570 ifs->ifs_ips_stats.iss_hits++; 2571 is->is_icmppkts[i]++; 2572 /* 2573 * we deliberately do not touch the timeouts 2574 * for the accompanying state table entry. 2575 * It remains to be seen if that is correct. XXX 2576 */ 2577 return is; 2578 } 2579 } 2580 RWLOCK_EXIT(&ifs->ifs_ipf_state); 2581 return NULL; 2582 } 2583 2584 2585 /* ------------------------------------------------------------------------ */ 2586 /* Function: fr_ipsmove */ 2587 /* Returns: Nil */ 2588 /* Parameters: is(I) - pointer to state table entry */ 2589 /* hv(I) - new hash value for state table entry */ 2590 /* Write Locks: ipf_state */ 2591 /* */ 2592 /* Move a state entry from one position in the hash table to another. */ 2593 /* ------------------------------------------------------------------------ */ 2594 static void fr_ipsmove(is, hv, ifs) 2595 ipstate_t *is; 2596 u_int hv; 2597 ipf_stack_t *ifs; 2598 { 2599 ipstate_t **isp; 2600 u_int hvm; 2601 2602 ASSERT(rw_read_locked(&ifs->ifs_ipf_state.ipf_lk) == 0); 2603 2604 hvm = is->is_hv; 2605 /* 2606 * Remove the hash from the old location... 2607 */ 2608 isp = is->is_phnext; 2609 if (is->is_hnext) 2610 is->is_hnext->is_phnext = isp; 2611 *isp = is->is_hnext; 2612 if (ifs->ifs_ips_table[hvm] == NULL) 2613 ifs->ifs_ips_stats.iss_inuse--; 2614 ifs->ifs_ips_stats.iss_bucketlen[hvm]--; 2615 2616 /* 2617 * ...and put the hash in the new one. 2618 */ 2619 hvm = DOUBLE_HASH(hv, ifs); 2620 is->is_hv = hvm; 2621 isp = &ifs->ifs_ips_table[hvm]; 2622 if (*isp) 2623 (*isp)->is_phnext = &is->is_hnext; 2624 else 2625 ifs->ifs_ips_stats.iss_inuse++; 2626 ifs->ifs_ips_stats.iss_bucketlen[hvm]++; 2627 is->is_phnext = isp; 2628 is->is_hnext = *isp; 2629 *isp = is; 2630 } 2631 2632 2633 /* ------------------------------------------------------------------------ */ 2634 /* Function: fr_stlookup */ 2635 /* Returns: ipstate_t* - NULL == no matching state found, */ 2636 /* else pointer to state information is returned */ 2637 /* Parameters: fin(I) - pointer to packet information */ 2638 /* tcp(I) - pointer to TCP/UDP header. */ 2639 /* */ 2640 /* Search the state table for a matching entry to the packet described by */ 2641 /* the contents of *fin. */ 2642 /* */ 2643 /* If we return NULL then no lock on ipf_state is held. */ 2644 /* If we return non-null then a read-lock on ipf_state is held. */ 2645 /* ------------------------------------------------------------------------ */ 2646 ipstate_t *fr_stlookup(fin, tcp, ifqp) 2647 fr_info_t *fin; 2648 tcphdr_t *tcp; 2649 ipftq_t **ifqp; 2650 { 2651 u_int hv, hvm, pr, v, tryagain; 2652 ipstate_t *is, **isp; 2653 u_short dport, sport; 2654 i6addr_t src, dst; 2655 struct icmp *ic; 2656 ipftq_t *ifq; 2657 int oow; 2658 ipf_stack_t *ifs = fin->fin_ifs; 2659 2660 is = NULL; 2661 ifq = NULL; 2662 tcp = fin->fin_dp; 2663 ic = (struct icmp *)tcp; 2664 hv = (pr = fin->fin_fi.fi_p); 2665 src = fin->fin_fi.fi_src; 2666 dst = fin->fin_fi.fi_dst; 2667 hv += src.in4.s_addr; 2668 hv += dst.in4.s_addr; 2669 2670 v = fin->fin_fi.fi_v; 2671 #ifdef USE_INET6 2672 if (v == 6) { 2673 hv += fin->fin_fi.fi_src.i6[1]; 2674 hv += fin->fin_fi.fi_src.i6[2]; 2675 hv += fin->fin_fi.fi_src.i6[3]; 2676 2677 if ((fin->fin_p == IPPROTO_ICMPV6) && 2678 IN6_IS_ADDR_MULTICAST(&fin->fin_fi.fi_dst.in6)) { 2679 hv -= dst.in4.s_addr; 2680 } else { 2681 hv += fin->fin_fi.fi_dst.i6[1]; 2682 hv += fin->fin_fi.fi_dst.i6[2]; 2683 hv += fin->fin_fi.fi_dst.i6[3]; 2684 } 2685 } 2686 #endif 2687 if ((v == 4) && 2688 (fin->fin_flx & (FI_MULTICAST|FI_BROADCAST|FI_MBCAST))) { 2689 if (fin->fin_out == 0) { 2690 hv -= src.in4.s_addr; 2691 } else { 2692 hv -= dst.in4.s_addr; 2693 } 2694 } 2695 2696 /* 2697 * Search the hash table for matching packet header info. 2698 */ 2699 switch (pr) 2700 { 2701 #ifdef USE_INET6 2702 case IPPROTO_ICMPV6 : 2703 tryagain = 0; 2704 if (v == 6) { 2705 if ((ic->icmp_type == ICMP6_ECHO_REQUEST) || 2706 (ic->icmp_type == ICMP6_ECHO_REPLY)) { 2707 hv += ic->icmp_id; 2708 } 2709 } 2710 READ_ENTER(&ifs->ifs_ipf_state); 2711 icmp6again: 2712 hvm = DOUBLE_HASH(hv, ifs); 2713 for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) { 2714 isp = &is->is_hnext; 2715 if ((is->is_p != pr) || (is->is_v != v)) 2716 continue; 2717 is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP); 2718 if (is != NULL && 2719 fr_matchicmpqueryreply(v, &is->is_icmp, 2720 ic, fin->fin_rev)) { 2721 if (fin->fin_rev) 2722 ifq = &ifs->ifs_ips_icmpacktq; 2723 else 2724 ifq = &ifs->ifs_ips_icmptq; 2725 break; 2726 } 2727 } 2728 2729 if (is != NULL) { 2730 if ((tryagain != 0) && !(is->is_flags & SI_W_DADDR)) { 2731 hv += fin->fin_fi.fi_src.i6[0]; 2732 hv += fin->fin_fi.fi_src.i6[1]; 2733 hv += fin->fin_fi.fi_src.i6[2]; 2734 hv += fin->fin_fi.fi_src.i6[3]; 2735 fr_ipsmove(is, hv, ifs); 2736 MUTEX_DOWNGRADE(&ifs->ifs_ipf_state); 2737 } 2738 break; 2739 } 2740 RWLOCK_EXIT(&ifs->ifs_ipf_state); 2741 2742 /* 2743 * No matching icmp state entry. Perhaps this is a 2744 * response to another state entry. 2745 * 2746 * XXX With some ICMP6 packets, the "other" address is already 2747 * in the packet, after the ICMP6 header, and this could be 2748 * used in place of the multicast address. However, taking 2749 * advantage of this requires some significant code changes 2750 * to handle the specific types where that is the case. 2751 */ 2752 if ((ifs->ifs_ips_stats.iss_wild != 0) && (v == 6) && (tryagain == 0) && 2753 !IN6_IS_ADDR_MULTICAST(&fin->fin_fi.fi_src.in6)) { 2754 hv -= fin->fin_fi.fi_src.i6[0]; 2755 hv -= fin->fin_fi.fi_src.i6[1]; 2756 hv -= fin->fin_fi.fi_src.i6[2]; 2757 hv -= fin->fin_fi.fi_src.i6[3]; 2758 tryagain = 1; 2759 WRITE_ENTER(&ifs->ifs_ipf_state); 2760 goto icmp6again; 2761 } 2762 2763 is = fr_checkicmp6matchingstate(fin); 2764 if (is != NULL) 2765 return is; 2766 break; 2767 #endif 2768 2769 case IPPROTO_ICMP : 2770 if (v == 4) { 2771 hv += ic->icmp_id; 2772 } 2773 hv = DOUBLE_HASH(hv, ifs); 2774 READ_ENTER(&ifs->ifs_ipf_state); 2775 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) { 2776 isp = &is->is_hnext; 2777 if ((is->is_p != pr) || (is->is_v != v)) 2778 continue; 2779 is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP); 2780 if (is != NULL && 2781 fr_matchicmpqueryreply(v, &is->is_icmp, 2782 ic, fin->fin_rev)) { 2783 if (fin->fin_rev) 2784 ifq = &ifs->ifs_ips_icmpacktq; 2785 else 2786 ifq = &ifs->ifs_ips_icmptq; 2787 break; 2788 } 2789 } 2790 if (is == NULL) { 2791 RWLOCK_EXIT(&ifs->ifs_ipf_state); 2792 } 2793 break; 2794 2795 case IPPROTO_TCP : 2796 case IPPROTO_UDP : 2797 ifqp = NULL; 2798 sport = htons(fin->fin_data[0]); 2799 hv += sport; 2800 dport = htons(fin->fin_data[1]); 2801 hv += dport; 2802 oow = 0; 2803 tryagain = 0; 2804 READ_ENTER(&ifs->ifs_ipf_state); 2805 retry_tcpudp: 2806 hvm = DOUBLE_HASH(hv, ifs); 2807 for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) { 2808 isp = &is->is_hnext; 2809 if ((is->is_p != pr) || (is->is_v != v)) 2810 continue; 2811 fin->fin_flx &= ~FI_OOW; 2812 is = fr_matchsrcdst(fin, is, &src, &dst, tcp, FI_CMP); 2813 if (is != NULL) { 2814 if (pr == IPPROTO_TCP) { 2815 if (!fr_tcpstate(fin, tcp, is)) { 2816 oow |= fin->fin_flx & FI_OOW; 2817 continue; 2818 } 2819 } 2820 break; 2821 } 2822 } 2823 if (is != NULL) { 2824 if (tryagain && 2825 !(is->is_flags & (SI_CLONE|SI_WILDP|SI_WILDA))) { 2826 hv += dport; 2827 hv += sport; 2828 fr_ipsmove(is, hv, ifs); 2829 MUTEX_DOWNGRADE(&ifs->ifs_ipf_state); 2830 } 2831 break; 2832 } 2833 RWLOCK_EXIT(&ifs->ifs_ipf_state); 2834 2835 if (ifs->ifs_ips_stats.iss_wild) { 2836 if (tryagain == 0) { 2837 hv -= dport; 2838 hv -= sport; 2839 } else if (tryagain == 1) { 2840 hv = fin->fin_fi.fi_p; 2841 /* 2842 * If we try to pretend this is a reply to a 2843 * multicast/broadcast packet then we need to 2844 * exclude part of the address from the hash 2845 * calculation. 2846 */ 2847 if (fin->fin_out == 0) { 2848 hv += src.in4.s_addr; 2849 } else { 2850 hv += dst.in4.s_addr; 2851 } 2852 hv += dport; 2853 hv += sport; 2854 } 2855 tryagain++; 2856 if (tryagain <= 2) { 2857 WRITE_ENTER(&ifs->ifs_ipf_state); 2858 goto retry_tcpudp; 2859 } 2860 } 2861 fin->fin_flx |= oow; 2862 break; 2863 2864 #if 0 2865 case IPPROTO_GRE : 2866 gre = fin->fin_dp; 2867 if (GRE_REV(gre->gr_flags) == 1) { 2868 hv += gre->gr_call; 2869 } 2870 /* FALLTHROUGH */ 2871 #endif 2872 default : 2873 ifqp = NULL; 2874 hvm = DOUBLE_HASH(hv, ifs); 2875 READ_ENTER(&ifs->ifs_ipf_state); 2876 for (isp = &ifs->ifs_ips_table[hvm]; ((is = *isp) != NULL); ) { 2877 isp = &is->is_hnext; 2878 if ((is->is_p != pr) || (is->is_v != v)) 2879 continue; 2880 is = fr_matchsrcdst(fin, is, &src, &dst, NULL, FI_CMP); 2881 if (is != NULL) { 2882 ifq = &ifs->ifs_ips_iptq; 2883 break; 2884 } 2885 } 2886 if (is == NULL) { 2887 RWLOCK_EXIT(&ifs->ifs_ipf_state); 2888 } 2889 break; 2890 } 2891 2892 if ((is != NULL) && ((is->is_sti.tqe_flags & TQE_RULEBASED) != 0) && 2893 (is->is_tqehead[fin->fin_rev] != NULL)) 2894 ifq = is->is_tqehead[fin->fin_rev]; 2895 if (ifq != NULL && ifqp != NULL) 2896 *ifqp = ifq; 2897 return is; 2898 } 2899 2900 2901 /* ------------------------------------------------------------------------ */ 2902 /* Function: fr_updatestate */ 2903 /* Returns: Nil */ 2904 /* Parameters: fin(I) - pointer to packet information */ 2905 /* is(I) - pointer to state table entry */ 2906 /* Read Locks: ipf_state */ 2907 /* */ 2908 /* Updates packet and byte counters for a newly received packet. Seeds the */ 2909 /* fragment cache with a new entry as required. */ 2910 /* ------------------------------------------------------------------------ */ 2911 void fr_updatestate(fin, is, ifq) 2912 fr_info_t *fin; 2913 ipstate_t *is; 2914 ipftq_t *ifq; 2915 { 2916 ipftqent_t *tqe; 2917 int i, pass; 2918 ipf_stack_t *ifs = fin->fin_ifs; 2919 2920 i = (fin->fin_rev << 1) + fin->fin_out; 2921 2922 /* 2923 * For TCP packets, ifq == NULL. For all others, check if this new 2924 * queue is different to the last one it was on and move it if so. 2925 */ 2926 tqe = &is->is_sti; 2927 MUTEX_ENTER(&is->is_lock); 2928 if ((tqe->tqe_flags & TQE_RULEBASED) != 0) 2929 ifq = is->is_tqehead[fin->fin_rev]; 2930 2931 if (ifq != NULL) 2932 fr_movequeue(tqe, tqe->tqe_ifq, ifq, ifs); 2933 2934 is->is_pkts[i]++; 2935 is->is_bytes[i] += fin->fin_plen; 2936 MUTEX_EXIT(&is->is_lock); 2937 2938 #ifdef IPFILTER_SYNC 2939 if (is->is_flags & IS_STATESYNC) 2940 ipfsync_update(SMC_STATE, fin, is->is_sync); 2941 #endif 2942 2943 ATOMIC_INCL(ifs->ifs_ips_stats.iss_hits); 2944 2945 fin->fin_fr = is->is_rule; 2946 2947 /* 2948 * If this packet is a fragment and the rule says to track fragments, 2949 * then create a new fragment cache entry. 2950 */ 2951 pass = is->is_pass; 2952 if ((fin->fin_flx & FI_FRAG) && FR_ISPASS(pass)) 2953 (void) fr_newfrag(fin, pass ^ FR_KEEPSTATE); 2954 } 2955 2956 2957 /* ------------------------------------------------------------------------ */ 2958 /* Function: fr_checkstate */ 2959 /* Returns: frentry_t* - NULL == search failed, */ 2960 /* else pointer to rule for matching state */ 2961 /* Parameters: ifp(I) - pointer to interface */ 2962 /* passp(I) - pointer to filtering result flags */ 2963 /* */ 2964 /* Check if a packet is associated with an entry in the state table. */ 2965 /* ------------------------------------------------------------------------ */ 2966 frentry_t *fr_checkstate(fin, passp) 2967 fr_info_t *fin; 2968 u_32_t *passp; 2969 { 2970 ipstate_t *is; 2971 frentry_t *fr; 2972 tcphdr_t *tcp; 2973 ipftq_t *ifq; 2974 u_int pass; 2975 ipf_stack_t *ifs = fin->fin_ifs; 2976 2977 if (ifs->ifs_fr_state_lock || (ifs->ifs_ips_list == NULL) || 2978 (fin->fin_flx & (FI_SHORT|FI_STATE|FI_FRAGBODY|FI_BAD))) 2979 return NULL; 2980 2981 is = NULL; 2982 if ((fin->fin_flx & FI_TCPUDP) || 2983 (fin->fin_fi.fi_p == IPPROTO_ICMP) 2984 #ifdef USE_INET6 2985 || (fin->fin_fi.fi_p == IPPROTO_ICMPV6) 2986 #endif 2987 ) 2988 tcp = fin->fin_dp; 2989 else 2990 tcp = NULL; 2991 2992 /* 2993 * Search the hash table for matching packet header info. 2994 */ 2995 ifq = NULL; 2996 is = fin->fin_state; 2997 if (is == NULL) 2998 is = fr_stlookup(fin, tcp, &ifq); 2999 switch (fin->fin_p) 3000 { 3001 #ifdef USE_INET6 3002 case IPPROTO_ICMPV6 : 3003 if (is != NULL) 3004 break; 3005 if (fin->fin_v == 6) { 3006 is = fr_checkicmp6matchingstate(fin); 3007 if (is != NULL) 3008 goto matched; 3009 } 3010 break; 3011 #endif 3012 case IPPROTO_ICMP : 3013 if (is != NULL) 3014 break; 3015 /* 3016 * No matching icmp state entry. Perhaps this is a 3017 * response to another state entry. 3018 */ 3019 is = fr_checkicmpmatchingstate(fin); 3020 if (is != NULL) 3021 goto matched; 3022 break; 3023 case IPPROTO_TCP : 3024 if (is == NULL) 3025 break; 3026 3027 if (is->is_pass & FR_NEWISN) { 3028 if (fin->fin_out == 0) 3029 fr_fixinisn(fin, is); 3030 else if (fin->fin_out == 1) 3031 fr_fixoutisn(fin, is); 3032 } 3033 break; 3034 default : 3035 if (fin->fin_rev) 3036 ifq = &ifs->ifs_ips_udpacktq; 3037 else 3038 ifq = &ifs->ifs_ips_udptq; 3039 break; 3040 } 3041 if (is == NULL) { 3042 ATOMIC_INCL(ifs->ifs_ips_stats.iss_miss); 3043 return NULL; 3044 } 3045 3046 matched: 3047 fr = is->is_rule; 3048 if (fr != NULL) { 3049 if ((fin->fin_out == 0) && (fr->fr_nattag.ipt_num[0] != 0)) { 3050 if (fin->fin_nattag == NULL) 3051 return NULL; 3052 if (fr_matchtag(&fr->fr_nattag, fin->fin_nattag) != 0) 3053 return NULL; 3054 } 3055 (void) strncpy(fin->fin_group, fr->fr_group, FR_GROUPLEN); 3056 fin->fin_icode = fr->fr_icode; 3057 } 3058 3059 fin->fin_rule = is->is_rulen; 3060 pass = is->is_pass; 3061 fr_updatestate(fin, is, ifq); 3062 if (fin->fin_out == 1) 3063 fin->fin_nat = is->is_nat[fin->fin_rev]; 3064 3065 fin->fin_state = is; 3066 MUTEX_ENTER(&is->is_lock); 3067 is->is_ref++; 3068 MUTEX_EXIT(&is->is_lock); 3069 RWLOCK_EXIT(&ifs->ifs_ipf_state); 3070 fin->fin_flx |= FI_STATE; 3071 if ((pass & FR_LOGFIRST) != 0) 3072 pass &= ~(FR_LOGFIRST|FR_LOG); 3073 *passp = pass; 3074 return fr; 3075 } 3076 3077 3078 /* ------------------------------------------------------------------------ */ 3079 /* Function: fr_fixoutisn */ 3080 /* Returns: Nil */ 3081 /* Parameters: fin(I) - pointer to packet information */ 3082 /* is(I) - pointer to master state structure */ 3083 /* */ 3084 /* Called only for outbound packets, adjusts the sequence number and the */ 3085 /* TCP checksum to match that change. */ 3086 /* ------------------------------------------------------------------------ */ 3087 static void fr_fixoutisn(fin, is) 3088 fr_info_t *fin; 3089 ipstate_t *is; 3090 { 3091 tcphdr_t *tcp; 3092 int rev; 3093 u_32_t seq; 3094 3095 tcp = fin->fin_dp; 3096 rev = fin->fin_rev; 3097 if ((is->is_flags & IS_ISNSYN) != 0) { 3098 if (rev == 0) { 3099 seq = ntohl(tcp->th_seq); 3100 seq += is->is_isninc[0]; 3101 tcp->th_seq = htonl(seq); 3102 fix_outcksum(&tcp->th_sum, is->is_sumd[0]); 3103 } 3104 } 3105 if ((is->is_flags & IS_ISNACK) != 0) { 3106 if (rev == 1) { 3107 seq = ntohl(tcp->th_seq); 3108 seq += is->is_isninc[1]; 3109 tcp->th_seq = htonl(seq); 3110 fix_outcksum(&tcp->th_sum, is->is_sumd[1]); 3111 } 3112 } 3113 } 3114 3115 3116 /* ------------------------------------------------------------------------ */ 3117 /* Function: fr_fixinisn */ 3118 /* Returns: Nil */ 3119 /* Parameters: fin(I) - pointer to packet information */ 3120 /* is(I) - pointer to master state structure */ 3121 /* */ 3122 /* Called only for inbound packets, adjusts the acknowledge number and the */ 3123 /* TCP checksum to match that change. */ 3124 /* ------------------------------------------------------------------------ */ 3125 static void fr_fixinisn(fin, is) 3126 fr_info_t *fin; 3127 ipstate_t *is; 3128 { 3129 tcphdr_t *tcp; 3130 int rev; 3131 u_32_t ack; 3132 3133 tcp = fin->fin_dp; 3134 rev = fin->fin_rev; 3135 if ((is->is_flags & IS_ISNSYN) != 0) { 3136 if (rev == 1) { 3137 ack = ntohl(tcp->th_ack); 3138 ack -= is->is_isninc[0]; 3139 tcp->th_ack = htonl(ack); 3140 fix_incksum(&tcp->th_sum, is->is_sumd[0]); 3141 } 3142 } 3143 if ((is->is_flags & IS_ISNACK) != 0) { 3144 if (rev == 0) { 3145 ack = ntohl(tcp->th_ack); 3146 ack -= is->is_isninc[1]; 3147 tcp->th_ack = htonl(ack); 3148 fix_incksum(&tcp->th_sum, is->is_sumd[1]); 3149 } 3150 } 3151 } 3152 3153 3154 /* ------------------------------------------------------------------------ */ 3155 /* Function: fr_statesync */ 3156 /* Returns: Nil */ 3157 /* Parameters: action(I) - type of synchronisation to do */ 3158 /* v(I) - IP version being sync'd (v4 or v6) */ 3159 /* ifp(I) - interface identifier associated with action */ 3160 /* name(I) - name associated with ifp parameter */ 3161 /* */ 3162 /* Walk through all state entries and if an interface pointer match is */ 3163 /* found then look it up again, based on its name in case the pointer has */ 3164 /* changed since last time. */ 3165 /* */ 3166 /* If ifp is passed in as being non-null then we are only doing updates for */ 3167 /* existing, matching, uses of it. */ 3168 /* ------------------------------------------------------------------------ */ 3169 void fr_statesync(action, v, ifp, name, ifs) 3170 int action, v; 3171 void *ifp; 3172 char *name; 3173 ipf_stack_t *ifs; 3174 { 3175 ipstate_t *is; 3176 int i; 3177 3178 if (ifs->ifs_fr_running <= 0) 3179 return; 3180 3181 WRITE_ENTER(&ifs->ifs_ipf_state); 3182 3183 if (ifs->ifs_fr_running <= 0) { 3184 RWLOCK_EXIT(&ifs->ifs_ipf_state); 3185 return; 3186 } 3187 3188 switch (action) 3189 { 3190 case IPFSYNC_RESYNC : 3191 for (is = ifs->ifs_ips_list; is; is = is->is_next) { 3192 if (v != 0 && is->is_v != v) 3193 continue; 3194 /* 3195 * Look up all the interface names in the state entry. 3196 */ 3197 for (i = 0; i < 4; i++) { 3198 is->is_ifp[i] = fr_resolvenic(is->is_ifname[i], 3199 is->is_v, ifs); 3200 } 3201 } 3202 break; 3203 case IPFSYNC_NEWIFP : 3204 for (is = ifs->ifs_ips_list; is; is = is->is_next) { 3205 if (v != 0 && is->is_v != v) 3206 continue; 3207 /* 3208 * Look up all the interface names in the state entry. 3209 */ 3210 for (i = 0; i < 4; i++) { 3211 if (!strncmp(is->is_ifname[i], name, 3212 sizeof(is->is_ifname[i]))) 3213 is->is_ifp[i] = ifp; 3214 } 3215 } 3216 break; 3217 case IPFSYNC_OLDIFP : 3218 for (is = ifs->ifs_ips_list; is; is = is->is_next) { 3219 if (v != 0 && is->is_v != v) 3220 continue; 3221 /* 3222 * Look up all the interface names in the state entry. 3223 */ 3224 for (i = 0; i < 4; i++) { 3225 if (is->is_ifp[i] == ifp) 3226 is->is_ifp[i] = (void *)-1; 3227 } 3228 } 3229 break; 3230 } 3231 RWLOCK_EXIT(&ifs->ifs_ipf_state); 3232 } 3233 3234 3235 /* ------------------------------------------------------------------------ */ 3236 /* Function: fr_delstate */ 3237 /* Returns: int - 0 = entry deleted, else ref count on entry */ 3238 /* Parameters: is(I) - pointer to state structure to delete */ 3239 /* why(I) - if not 0, log reason why it was deleted */ 3240 /* ifs - ipf stack instance */ 3241 /* Write Locks: ipf_state/ipf_global */ 3242 /* */ 3243 /* Deletes a state entry from the enumerated list as well as the hash table */ 3244 /* and timeout queue lists. Make adjustments to hash table statistics and */ 3245 /* global counters as required. */ 3246 /* ------------------------------------------------------------------------ */ 3247 int fr_delstate(is, why, ifs) 3248 ipstate_t *is; 3249 int why; 3250 ipf_stack_t *ifs; 3251 { 3252 int removed = 0; 3253 3254 ASSERT(rw_write_held(&ifs->ifs_ipf_global.ipf_lk) == 0 || 3255 rw_write_held(&ifs->ifs_ipf_state.ipf_lk) == 0); 3256 3257 /* 3258 * Start by removing the entry from the hash table of state entries 3259 * so it will not be "used" again. 3260 * 3261 * It will remain in the "list" of state entries until all references 3262 * have been accounted for. 3263 */ 3264 if (is->is_phnext != NULL) { 3265 removed = 1; 3266 *is->is_phnext = is->is_hnext; 3267 if (is->is_hnext != NULL) 3268 is->is_hnext->is_phnext = is->is_phnext; 3269 if (ifs->ifs_ips_table[is->is_hv] == NULL) 3270 ifs->ifs_ips_stats.iss_inuse--; 3271 ifs->ifs_ips_stats.iss_bucketlen[is->is_hv]--; 3272 3273 is->is_phnext = NULL; 3274 is->is_hnext = NULL; 3275 } 3276 3277 /* 3278 * Because ifs->ifs_ips_stats.iss_wild is a count of entries in the state 3279 * table that have wildcard flags set, only decerement it once 3280 * and do it here. 3281 */ 3282 if (is->is_flags & (SI_WILDP|SI_WILDA)) { 3283 if (!(is->is_flags & SI_CLONED)) { 3284 ATOMIC_DECL(ifs->ifs_ips_stats.iss_wild); 3285 } 3286 is->is_flags &= ~(SI_WILDP|SI_WILDA); 3287 } 3288 3289 /* 3290 * Next, remove it from the timeout queue it is in. 3291 */ 3292 fr_deletequeueentry(&is->is_sti); 3293 3294 is->is_me = NULL; 3295 3296 /* 3297 * If it is still in use by something else, do not go any further, 3298 * but note that at this point it is now an orphan. 3299 */ 3300 MUTEX_ENTER(&is->is_lock); 3301 if (is->is_ref > 1) { 3302 is->is_ref--; 3303 MUTEX_EXIT(&is->is_lock); 3304 if (removed) 3305 ifs->ifs_ips_stats.iss_orphans++; 3306 return (is->is_ref); 3307 } 3308 MUTEX_EXIT(&is->is_lock); 3309 3310 is->is_ref = 0; 3311 3312 /* 3313 * If entry has already been removed from table, 3314 * it means we're simply cleaning up an orphan. 3315 */ 3316 if (!removed) 3317 ifs->ifs_ips_stats.iss_orphans--; 3318 3319 if (is->is_tqehead[0] != NULL) 3320 (void) fr_deletetimeoutqueue(is->is_tqehead[0]); 3321 3322 if (is->is_tqehead[1] != NULL) 3323 (void) fr_deletetimeoutqueue(is->is_tqehead[1]); 3324 3325 #ifdef IPFILTER_SYNC 3326 if (is->is_sync) 3327 ipfsync_del(is->is_sync); 3328 #endif 3329 #ifdef IPFILTER_SCAN 3330 (void) ipsc_detachis(is); 3331 #endif 3332 3333 /* 3334 * Now remove it from master list of state table entries. 3335 */ 3336 if (is->is_pnext != NULL) { 3337 *is->is_pnext = is->is_next; 3338 if (is->is_next != NULL) { 3339 is->is_next->is_pnext = is->is_pnext; 3340 is->is_next = NULL; 3341 } 3342 is->is_pnext = NULL; 3343 } 3344 3345 if (ifs->ifs_ipstate_logging != 0 && why != 0) 3346 ipstate_log(is, why, ifs); 3347 3348 if (is->is_rule != NULL) { 3349 is->is_rule->fr_statecnt--; 3350 (void)fr_derefrule(&is->is_rule, ifs); 3351 } 3352 3353 MUTEX_DESTROY(&is->is_lock); 3354 KFREE(is); 3355 ifs->ifs_ips_num--; 3356 3357 return (0); 3358 } 3359 3360 3361 /* ------------------------------------------------------------------------ */ 3362 /* Function: fr_timeoutstate */ 3363 /* Returns: Nil */ 3364 /* Parameters: ifs - ipf stack instance */ 3365 /* */ 3366 /* Slowly expire held state for thingslike UDP and ICMP. The algorithm */ 3367 /* used here is to keep the queue sorted with the oldest things at the top */ 3368 /* and the youngest at the bottom. So if the top one doesn't need to be */ 3369 /* expired then neither will any under it. */ 3370 /* ------------------------------------------------------------------------ */ 3371 void fr_timeoutstate(ifs) 3372 ipf_stack_t *ifs; 3373 { 3374 ipftq_t *ifq, *ifqnext; 3375 ipftqent_t *tqe, *tqn; 3376 ipstate_t *is; 3377 SPL_INT(s); 3378 3379 SPL_NET(s); 3380 WRITE_ENTER(&ifs->ifs_ipf_state); 3381 for (ifq = ifs->ifs_ips_tqtqb; ifq != NULL; ifq = ifq->ifq_next) 3382 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 3383 if (tqe->tqe_die > ifs->ifs_fr_ticks) 3384 break; 3385 tqn = tqe->tqe_next; 3386 is = tqe->tqe_parent; 3387 (void) fr_delstate(is, ISL_EXPIRE, ifs); 3388 } 3389 3390 for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifq->ifq_next) { 3391 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); ) { 3392 if (tqe->tqe_die > ifs->ifs_fr_ticks) 3393 break; 3394 tqn = tqe->tqe_next; 3395 is = tqe->tqe_parent; 3396 (void) fr_delstate(is, ISL_EXPIRE, ifs); 3397 } 3398 } 3399 3400 for (ifq = ifs->ifs_ips_utqe; ifq != NULL; ifq = ifqnext) { 3401 ifqnext = ifq->ifq_next; 3402 3403 if (((ifq->ifq_flags & IFQF_DELETE) != 0) && 3404 (ifq->ifq_ref == 0)) { 3405 fr_freetimeoutqueue(ifq, ifs); 3406 } 3407 } 3408 3409 if (ifs->ifs_fr_state_doflush) { 3410 (void) fr_state_flush(FLUSH_TABLE_EXTRA, 0, ifs); 3411 ifs->ifs_fr_state_doflush = 0; 3412 } 3413 RWLOCK_EXIT(&ifs->ifs_ipf_state); 3414 SPL_X(s); 3415 } 3416 3417 3418 /* ---------------------------------------------------------------------- */ 3419 /* Function: fr_state_flush */ 3420 /* Returns: int - 0 == success, -1 == failure */ 3421 /* Parameters: flush_option - how to flush the active State table */ 3422 /* proto - IP version to flush (4, 6, or both) */ 3423 /* ifs - ipf stack instance */ 3424 /* Write Locks: ipf_state */ 3425 /* */ 3426 /* Flush state tables. Three possible flush options currently defined: */ 3427 /* */ 3428 /* FLUSH_TABLE_ALL : Flush all state table entries */ 3429 /* */ 3430 /* FLUSH_TABLE_CLOSING : Flush entries with TCP connections which */ 3431 /* have started to close on both ends using */ 3432 /* ipf_flushclosing(). */ 3433 /* */ 3434 /* FLUSH_TABLE_EXTRA : First, flush entries which are "almost" closed. */ 3435 /* Then, if needed, flush entries with TCP */ 3436 /* connections which have been idle for a long */ 3437 /* time with ipf_extraflush(). */ 3438 /* ---------------------------------------------------------------------- */ 3439 static int fr_state_flush(flush_option, proto, ifs) 3440 int flush_option, proto; 3441 ipf_stack_t *ifs; 3442 { 3443 ipstate_t *is, *isn; 3444 int removed; 3445 SPL_INT(s); 3446 3447 removed = 0; 3448 3449 SPL_NET(s); 3450 switch (flush_option) 3451 { 3452 case FLUSH_TABLE_ALL: 3453 isn = ifs->ifs_ips_list; 3454 while ((is = isn) != NULL) { 3455 isn = is->is_next; 3456 if ((proto != 0) && (is->is_v != proto)) 3457 continue; 3458 if (fr_delstate(is, ISL_FLUSH, ifs) == 0) 3459 removed++; 3460 } 3461 break; 3462 3463 case FLUSH_TABLE_CLOSING: 3464 removed = ipf_flushclosing(STATE_FLUSH, 3465 IPF_TCPS_CLOSE_WAIT, 3466 ifs->ifs_ips_tqtqb, 3467 ifs->ifs_ips_utqe, 3468 ifs); 3469 break; 3470 3471 case FLUSH_TABLE_EXTRA: 3472 removed = ipf_flushclosing(STATE_FLUSH, 3473 IPF_TCPS_FIN_WAIT_2, 3474 ifs->ifs_ips_tqtqb, 3475 ifs->ifs_ips_utqe, 3476 ifs); 3477 3478 /* 3479 * Be sure we haven't done this in the last 10 seconds. 3480 */ 3481 if (ifs->ifs_fr_ticks - ifs->ifs_ips_last_force_flush < 3482 IPF_TTLVAL(10)) 3483 break; 3484 ifs->ifs_ips_last_force_flush = ifs->ifs_fr_ticks; 3485 removed += ipf_extraflush(STATE_FLUSH, 3486 &ifs->ifs_ips_tqtqb[IPF_TCPS_ESTABLISHED], 3487 ifs->ifs_ips_utqe, 3488 ifs); 3489 break; 3490 3491 default: /* Flush Nothing */ 3492 break; 3493 } 3494 3495 SPL_X(s); 3496 return (removed); 3497 } 3498 3499 3500 /* ------------------------------------------------------------------------ */ 3501 /* Function: fr_tcp_age */ 3502 /* Returns: int - 1 == state transition made, 0 == no change (rejected) */ 3503 /* Parameters: tq(I) - pointer to timeout queue information */ 3504 /* fin(I) - pointer to packet information */ 3505 /* tqtab(I) - TCP timeout queue table this is in */ 3506 /* flags(I) - flags from state/NAT entry */ 3507 /* */ 3508 /* Rewritten by Arjan de Vet <Arjan.deVet@adv.iae.nl>, 2000-07-29: */ 3509 /* */ 3510 /* - (try to) base state transitions on real evidence only, */ 3511 /* i.e. packets that are sent and have been received by ipfilter; */ 3512 /* diagram 18.12 of TCP/IP volume 1 by W. Richard Stevens was used. */ 3513 /* */ 3514 /* - deal with half-closed connections correctly; */ 3515 /* */ 3516 /* - store the state of the source in state[0] such that ipfstat */ 3517 /* displays the state as source/dest instead of dest/source; the calls */ 3518 /* to fr_tcp_age have been changed accordingly. */ 3519 /* */ 3520 /* Internal Parameters: */ 3521 /* */ 3522 /* state[0] = state of source (host that initiated connection) */ 3523 /* state[1] = state of dest (host that accepted the connection) */ 3524 /* */ 3525 /* dir == 0 : a packet from source to dest */ 3526 /* dir == 1 : a packet from dest to source */ 3527 /* */ 3528 /* Locking: it is assumed that the parent of the tqe structure is locked. */ 3529 /* ------------------------------------------------------------------------ */ 3530 int fr_tcp_age(tqe, fin, tqtab, flags) 3531 ipftqent_t *tqe; 3532 fr_info_t *fin; 3533 ipftq_t *tqtab; 3534 int flags; 3535 { 3536 int dlen, ostate, nstate, rval, dir; 3537 u_char tcpflags; 3538 tcphdr_t *tcp; 3539 ipf_stack_t *ifs = fin->fin_ifs; 3540 3541 tcp = fin->fin_dp; 3542 3543 rval = 0; 3544 dir = fin->fin_rev; 3545 tcpflags = tcp->th_flags; 3546 dlen = fin->fin_dlen - (TCP_OFF(tcp) << 2); 3547 3548 if (tcpflags & TH_RST) { 3549 if (!(tcpflags & TH_PUSH) && !dlen) 3550 nstate = IPF_TCPS_CLOSED; 3551 else 3552 nstate = IPF_TCPS_CLOSE_WAIT; 3553 rval = 1; 3554 } else { 3555 ostate = tqe->tqe_state[1 - dir]; 3556 nstate = tqe->tqe_state[dir]; 3557 3558 switch (nstate) 3559 { 3560 case IPF_TCPS_CLOSED: /* 0 */ 3561 if ((tcpflags & TH_OPENING) == TH_OPENING) { 3562 /* 3563 * 'dir' received an S and sends SA in 3564 * response, CLOSED -> SYN_RECEIVED 3565 */ 3566 nstate = IPF_TCPS_SYN_RECEIVED; 3567 rval = 1; 3568 } else if ((tcpflags & TH_OPENING) == TH_SYN) { 3569 /* 'dir' sent S, CLOSED -> SYN_SENT */ 3570 nstate = IPF_TCPS_SYN_SENT; 3571 rval = 1; 3572 } 3573 /* 3574 * the next piece of code makes it possible to get 3575 * already established connections into the state table 3576 * after a restart or reload of the filter rules; this 3577 * does not work when a strict 'flags S keep state' is 3578 * used for tcp connections of course 3579 */ 3580 if (((flags & IS_TCPFSM) == 0) && 3581 ((tcpflags & TH_ACKMASK) == TH_ACK)) { 3582 /* 3583 * we saw an A, guess 'dir' is in ESTABLISHED 3584 * mode 3585 */ 3586 switch (ostate) 3587 { 3588 case IPF_TCPS_CLOSED : 3589 case IPF_TCPS_SYN_RECEIVED : 3590 nstate = IPF_TCPS_HALF_ESTAB; 3591 rval = 1; 3592 break; 3593 case IPF_TCPS_HALF_ESTAB : 3594 case IPF_TCPS_ESTABLISHED : 3595 nstate = IPF_TCPS_ESTABLISHED; 3596 rval = 1; 3597 break; 3598 default : 3599 break; 3600 } 3601 } 3602 /* 3603 * TODO: besides regular ACK packets we can have other 3604 * packets as well; it is yet to be determined how we 3605 * should initialize the states in those cases 3606 */ 3607 break; 3608 3609 case IPF_TCPS_LISTEN: /* 1 */ 3610 /* NOT USED */ 3611 break; 3612 3613 case IPF_TCPS_SYN_SENT: /* 2 */ 3614 if ((tcpflags & ~(TH_ECN|TH_CWR)) == TH_SYN) { 3615 /* 3616 * A retransmitted SYN packet. We do not reset 3617 * the timeout here to fr_tcptimeout because a 3618 * connection connect timeout does not renew 3619 * after every packet that is sent. We need to 3620 * set rval so as to indicate the packet has 3621 * passed the check for its flags being valid 3622 * in the TCP FSM. Setting rval to 2 has the 3623 * result of not resetting the timeout. 3624 */ 3625 rval = 2; 3626 } else if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) == 3627 TH_ACK) { 3628 /* 3629 * we see an A from 'dir' which is in SYN_SENT 3630 * state: 'dir' sent an A in response to an SA 3631 * which it received, SYN_SENT -> ESTABLISHED 3632 */ 3633 nstate = IPF_TCPS_ESTABLISHED; 3634 rval = 1; 3635 } else if (tcpflags & TH_FIN) { 3636 /* 3637 * we see an F from 'dir' which is in SYN_SENT 3638 * state and wants to close its side of the 3639 * connection; SYN_SENT -> FIN_WAIT_1 3640 */ 3641 nstate = IPF_TCPS_FIN_WAIT_1; 3642 rval = 1; 3643 } else if ((tcpflags & TH_OPENING) == TH_OPENING) { 3644 /* 3645 * we see an SA from 'dir' which is already in 3646 * SYN_SENT state, this means we have a 3647 * simultaneous open; SYN_SENT -> SYN_RECEIVED 3648 */ 3649 nstate = IPF_TCPS_SYN_RECEIVED; 3650 rval = 1; 3651 } 3652 break; 3653 3654 case IPF_TCPS_SYN_RECEIVED: /* 3 */ 3655 if ((tcpflags & (TH_SYN|TH_FIN|TH_ACK)) == TH_ACK) { 3656 /* 3657 * we see an A from 'dir' which was in 3658 * SYN_RECEIVED state so it must now be in 3659 * established state, SYN_RECEIVED -> 3660 * ESTABLISHED 3661 */ 3662 nstate = IPF_TCPS_ESTABLISHED; 3663 rval = 1; 3664 } else if ((tcpflags & ~(TH_ECN|TH_CWR)) == 3665 TH_OPENING) { 3666 /* 3667 * We see an SA from 'dir' which is already in 3668 * SYN_RECEIVED state. 3669 */ 3670 rval = 2; 3671 } else if (tcpflags & TH_FIN) { 3672 /* 3673 * we see an F from 'dir' which is in 3674 * SYN_RECEIVED state and wants to close its 3675 * side of the connection; SYN_RECEIVED -> 3676 * FIN_WAIT_1 3677 */ 3678 nstate = IPF_TCPS_FIN_WAIT_1; 3679 rval = 1; 3680 } 3681 break; 3682 3683 case IPF_TCPS_HALF_ESTAB: /* 4 */ 3684 if (ostate >= IPF_TCPS_HALF_ESTAB) { 3685 if ((tcpflags & TH_ACKMASK) == TH_ACK) { 3686 nstate = IPF_TCPS_ESTABLISHED; 3687 } 3688 } 3689 rval = 1; 3690 3691 break; 3692 3693 case IPF_TCPS_ESTABLISHED: /* 5 */ 3694 rval = 1; 3695 if (tcpflags & TH_FIN) { 3696 /* 3697 * 'dir' closed its side of the connection; 3698 * this gives us a half-closed connection; 3699 * ESTABLISHED -> FIN_WAIT_1 3700 */ 3701 nstate = IPF_TCPS_FIN_WAIT_1; 3702 } else if (tcpflags & TH_ACK) { 3703 /* 3704 * an ACK, should we exclude other flags here? 3705 */ 3706 if (ostate == IPF_TCPS_FIN_WAIT_1) { 3707 /* 3708 * We know the other side did an active 3709 * close, so we are ACKing the recvd 3710 * FIN packet (does the window matching 3711 * code guarantee this?) and go into 3712 * CLOSE_WAIT state; this gives us a 3713 * half-closed connection 3714 */ 3715 nstate = IPF_TCPS_CLOSE_WAIT; 3716 } else if (ostate < IPF_TCPS_CLOSE_WAIT) { 3717 /* 3718 * still a fully established 3719 * connection reset timeout 3720 */ 3721 nstate = IPF_TCPS_ESTABLISHED; 3722 } 3723 } 3724 break; 3725 3726 case IPF_TCPS_CLOSE_WAIT: /* 6 */ 3727 rval = 1; 3728 if (tcpflags & TH_FIN) { 3729 /* 3730 * application closed and 'dir' sent a FIN, 3731 * we're now going into LAST_ACK state 3732 */ 3733 nstate = IPF_TCPS_LAST_ACK; 3734 } else { 3735 /* 3736 * we remain in CLOSE_WAIT because the other 3737 * side has closed already and we did not 3738 * close our side yet; reset timeout 3739 */ 3740 nstate = IPF_TCPS_CLOSE_WAIT; 3741 } 3742 break; 3743 3744 case IPF_TCPS_FIN_WAIT_1: /* 7 */ 3745 rval = 1; 3746 if ((tcpflags & TH_ACK) && 3747 ostate > IPF_TCPS_CLOSE_WAIT) { 3748 /* 3749 * if the other side is not active anymore 3750 * it has sent us a FIN packet that we are 3751 * ack'ing now with an ACK; this means both 3752 * sides have now closed the connection and 3753 * we go into TIME_WAIT 3754 */ 3755 /* 3756 * XXX: how do we know we really are ACKing 3757 * the FIN packet here? does the window code 3758 * guarantee that? 3759 */ 3760 nstate = IPF_TCPS_TIME_WAIT; 3761 } else { 3762 /* 3763 * we closed our side of the connection 3764 * already but the other side is still active 3765 * (ESTABLISHED/CLOSE_WAIT); continue with 3766 * this half-closed connection 3767 */ 3768 nstate = IPF_TCPS_FIN_WAIT_1; 3769 } 3770 break; 3771 3772 case IPF_TCPS_CLOSING: /* 8 */ 3773 /* NOT USED */ 3774 break; 3775 3776 case IPF_TCPS_LAST_ACK: /* 9 */ 3777 /* 3778 * We want to reset timer here to keep state in table. 3779 * If we would allow the state to time out here, while 3780 * there would still be packets being retransmitted, we 3781 * would cut off line between the two peers preventing 3782 * them to close connection properly. 3783 */ 3784 rval = 1; 3785 break; 3786 3787 case IPF_TCPS_FIN_WAIT_2: /* 10 */ 3788 rval = 1; 3789 if ((tcpflags & TH_OPENING) == TH_OPENING) 3790 nstate = IPF_TCPS_SYN_RECEIVED; 3791 else if (tcpflags & TH_SYN) 3792 nstate = IPF_TCPS_SYN_SENT; 3793 break; 3794 3795 case IPF_TCPS_TIME_WAIT: /* 11 */ 3796 /* we're in 2MSL timeout now */ 3797 rval = 1; 3798 break; 3799 3800 default : 3801 #if defined(_KERNEL) 3802 # if SOLARIS 3803 cmn_err(CE_NOTE, 3804 "tcp %lx flags %x si %lx nstate %d ostate %d\n", 3805 (u_long)tcp, tcpflags, (u_long)tqe, 3806 nstate, ostate); 3807 # else 3808 printf("tcp %lx flags %x si %lx nstate %d ostate %d\n", 3809 (u_long)tcp, tcpflags, (u_long)tqe, 3810 nstate, ostate); 3811 # endif 3812 #else 3813 abort(); 3814 #endif 3815 break; 3816 } 3817 } 3818 3819 /* 3820 * If rval == 2 then do not update the queue position, but treat the 3821 * packet as being ok. 3822 */ 3823 if (rval == 2) 3824 rval = 1; 3825 else if (rval == 1) { 3826 tqe->tqe_state[dir] = nstate; 3827 if ((tqe->tqe_flags & TQE_RULEBASED) == 0) 3828 fr_movequeue(tqe, tqe->tqe_ifq, tqtab + nstate, ifs); 3829 } 3830 3831 return rval; 3832 } 3833 3834 3835 /* ------------------------------------------------------------------------ */ 3836 /* Function: ipstate_log */ 3837 /* Returns: Nil */ 3838 /* Parameters: is(I) - pointer to state structure */ 3839 /* type(I) - type of log entry to create */ 3840 /* */ 3841 /* Creates a state table log entry using the state structure and type info. */ 3842 /* passed in. Log packet/byte counts, source/destination address and other */ 3843 /* protocol specific information. */ 3844 /* ------------------------------------------------------------------------ */ 3845 void ipstate_log(is, type, ifs) 3846 struct ipstate *is; 3847 u_int type; 3848 ipf_stack_t *ifs; 3849 { 3850 #ifdef IPFILTER_LOG 3851 struct ipslog ipsl; 3852 size_t sizes[1]; 3853 void *items[1]; 3854 int types[1]; 3855 3856 /* 3857 * Copy information out of the ipstate_t structure and into the 3858 * structure used for logging. 3859 */ 3860 ipsl.isl_type = type; 3861 ipsl.isl_pkts[0] = is->is_pkts[0] + is->is_icmppkts[0]; 3862 ipsl.isl_bytes[0] = is->is_bytes[0]; 3863 ipsl.isl_pkts[1] = is->is_pkts[1] + is->is_icmppkts[1]; 3864 ipsl.isl_bytes[1] = is->is_bytes[1]; 3865 ipsl.isl_pkts[2] = is->is_pkts[2] + is->is_icmppkts[2]; 3866 ipsl.isl_bytes[2] = is->is_bytes[2]; 3867 ipsl.isl_pkts[3] = is->is_pkts[3] + is->is_icmppkts[3]; 3868 ipsl.isl_bytes[3] = is->is_bytes[3]; 3869 ipsl.isl_src = is->is_src; 3870 ipsl.isl_dst = is->is_dst; 3871 ipsl.isl_p = is->is_p; 3872 ipsl.isl_v = is->is_v; 3873 ipsl.isl_flags = is->is_flags; 3874 ipsl.isl_tag = is->is_tag; 3875 ipsl.isl_rulen = is->is_rulen; 3876 (void) strncpy(ipsl.isl_group, is->is_group, FR_GROUPLEN); 3877 3878 if (ipsl.isl_p == IPPROTO_TCP || ipsl.isl_p == IPPROTO_UDP) { 3879 ipsl.isl_sport = is->is_sport; 3880 ipsl.isl_dport = is->is_dport; 3881 if (ipsl.isl_p == IPPROTO_TCP) { 3882 ipsl.isl_state[0] = is->is_state[0]; 3883 ipsl.isl_state[1] = is->is_state[1]; 3884 } 3885 } else if (ipsl.isl_p == IPPROTO_ICMP) { 3886 ipsl.isl_itype = is->is_icmp.ici_type; 3887 } else if (ipsl.isl_p == IPPROTO_ICMPV6) { 3888 ipsl.isl_itype = is->is_icmp.ici_type; 3889 } else { 3890 ipsl.isl_ps.isl_filler[0] = 0; 3891 ipsl.isl_ps.isl_filler[1] = 0; 3892 } 3893 3894 items[0] = &ipsl; 3895 sizes[0] = sizeof(ipsl); 3896 types[0] = 0; 3897 3898 if (ipllog(IPL_LOGSTATE, NULL, items, sizes, types, 1, ifs)) { 3899 ATOMIC_INCL(ifs->ifs_ips_stats.iss_logged); 3900 } else { 3901 ATOMIC_INCL(ifs->ifs_ips_stats.iss_logfail); 3902 } 3903 #endif 3904 } 3905 3906 3907 #ifdef USE_INET6 3908 /* ------------------------------------------------------------------------ */ 3909 /* Function: fr_checkicmp6matchingstate */ 3910 /* Returns: ipstate_t* - NULL == no match found, */ 3911 /* else pointer to matching state entry */ 3912 /* Parameters: fin(I) - pointer to packet information */ 3913 /* Locks: NULL == no locks, else Read Lock on ipf_state */ 3914 /* */ 3915 /* If we've got an ICMPv6 error message, using the information stored in */ 3916 /* the ICMPv6 packet, look for a matching state table entry. */ 3917 /* ------------------------------------------------------------------------ */ 3918 static ipstate_t *fr_checkicmp6matchingstate(fin) 3919 fr_info_t *fin; 3920 { 3921 struct icmp6_hdr *ic6, *oic; 3922 int backward, i; 3923 ipstate_t *is, **isp; 3924 u_short sport, dport; 3925 i6addr_t dst, src; 3926 u_short savelen; 3927 icmpinfo_t *ic; 3928 fr_info_t ofin; 3929 tcphdr_t *tcp; 3930 ip6_t *oip6; 3931 u_char pr; 3932 u_int hv; 3933 ipf_stack_t *ifs = fin->fin_ifs; 3934 3935 /* 3936 * Does it at least have the return (basic) IP header ? 3937 * Is it an actual recognised ICMP error type? 3938 * Only a basic IP header (no options) should be with 3939 * an ICMP error header. 3940 */ 3941 if ((fin->fin_v != 6) || (fin->fin_plen < ICMP6ERR_MINPKTLEN) || 3942 !(fin->fin_flx & FI_ICMPERR)) 3943 return NULL; 3944 3945 ic6 = fin->fin_dp; 3946 3947 oip6 = (ip6_t *)((char *)ic6 + ICMPERR_ICMPHLEN); 3948 if (fin->fin_plen < sizeof(*oip6)) 3949 return NULL; 3950 3951 bcopy((char *)fin, (char *)&ofin, sizeof(*fin)); 3952 ofin.fin_v = 6; 3953 ofin.fin_ifp = fin->fin_ifp; 3954 ofin.fin_out = !fin->fin_out; 3955 ofin.fin_m = NULL; /* if dereferenced, panic XXX */ 3956 ofin.fin_mp = NULL; /* if dereferenced, panic XXX */ 3957 3958 /* 3959 * We make a fin entry to be able to feed it to 3960 * matchsrcdst. Note that not all fields are necessary 3961 * but this is the cleanest way. Note further we fill 3962 * in fin_mp such that if someone uses it we'll get 3963 * a kernel panic. fr_matchsrcdst does not use this. 3964 * 3965 * watch out here, as ip is in host order and oip6 in network 3966 * order. Any change we make must be undone afterwards. 3967 */ 3968 savelen = oip6->ip6_plen; 3969 oip6->ip6_plen = fin->fin_dlen - ICMPERR_ICMPHLEN; 3970 ofin.fin_flx = FI_NOCKSUM; 3971 ofin.fin_ip = (ip_t *)oip6; 3972 ofin.fin_plen = oip6->ip6_plen; 3973 (void) fr_makefrip(sizeof(*oip6), (ip_t *)oip6, &ofin); 3974 ofin.fin_flx &= ~(FI_BAD|FI_SHORT); 3975 oip6->ip6_plen = savelen; 3976 3977 if (oip6->ip6_nxt == IPPROTO_ICMPV6) { 3978 oic = (struct icmp6_hdr *)(oip6 + 1); 3979 /* 3980 * an ICMP error can only be generated as a result of an 3981 * ICMP query, not as the response on an ICMP error 3982 * 3983 * XXX theoretically ICMP_ECHOREP and the other reply's are 3984 * ICMP query's as well, but adding them here seems strange XXX 3985 */ 3986 if (!(oic->icmp6_type & ICMP6_INFOMSG_MASK)) 3987 return NULL; 3988 3989 /* 3990 * perform a lookup of the ICMP packet in the state table 3991 */ 3992 hv = (pr = oip6->ip6_nxt); 3993 src.in6 = oip6->ip6_src; 3994 hv += src.in4.s_addr; 3995 dst.in6 = oip6->ip6_dst; 3996 hv += dst.in4.s_addr; 3997 hv += oic->icmp6_id; 3998 hv += oic->icmp6_seq; 3999 hv = DOUBLE_HASH(hv, ifs); 4000 4001 READ_ENTER(&ifs->ifs_ipf_state); 4002 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) { 4003 ic = &is->is_icmp; 4004 isp = &is->is_hnext; 4005 if ((is->is_p == pr) && 4006 !(is->is_pass & FR_NOICMPERR) && 4007 (oic->icmp6_id == ic->ici_id) && 4008 (oic->icmp6_seq == ic->ici_seq) && 4009 (is = fr_matchsrcdst(&ofin, is, &src, 4010 &dst, NULL, FI_ICMPCMP))) { 4011 /* 4012 * in the state table ICMP query's are stored 4013 * with the type of the corresponding ICMP 4014 * response. Correct here 4015 */ 4016 if (((ic->ici_type == ICMP6_ECHO_REPLY) && 4017 (oic->icmp6_type == ICMP6_ECHO_REQUEST)) || 4018 (ic->ici_type - 1 == oic->icmp6_type )) { 4019 ifs->ifs_ips_stats.iss_hits++; 4020 backward = IP6_NEQ(&is->is_dst, &src); 4021 fin->fin_rev = !backward; 4022 i = (backward << 1) + fin->fin_out; 4023 is->is_icmppkts[i]++; 4024 return is; 4025 } 4026 } 4027 } 4028 RWLOCK_EXIT(&ifs->ifs_ipf_state); 4029 return NULL; 4030 } 4031 4032 hv = (pr = oip6->ip6_nxt); 4033 src.in6 = oip6->ip6_src; 4034 hv += src.i6[0]; 4035 hv += src.i6[1]; 4036 hv += src.i6[2]; 4037 hv += src.i6[3]; 4038 dst.in6 = oip6->ip6_dst; 4039 hv += dst.i6[0]; 4040 hv += dst.i6[1]; 4041 hv += dst.i6[2]; 4042 hv += dst.i6[3]; 4043 4044 if ((oip6->ip6_nxt == IPPROTO_TCP) || (oip6->ip6_nxt == IPPROTO_UDP)) { 4045 tcp = (tcphdr_t *)(oip6 + 1); 4046 dport = tcp->th_dport; 4047 sport = tcp->th_sport; 4048 hv += dport; 4049 hv += sport; 4050 } else 4051 tcp = NULL; 4052 hv = DOUBLE_HASH(hv, ifs); 4053 4054 READ_ENTER(&ifs->ifs_ipf_state); 4055 for (isp = &ifs->ifs_ips_table[hv]; ((is = *isp) != NULL); ) { 4056 isp = &is->is_hnext; 4057 /* 4058 * Only allow this icmp though if the 4059 * encapsulated packet was allowed through the 4060 * other way around. Note that the minimal amount 4061 * of info present does not allow for checking against 4062 * tcp internals such as seq and ack numbers. 4063 */ 4064 if ((is->is_p != pr) || (is->is_v != 6) || 4065 (is->is_pass & FR_NOICMPERR)) 4066 continue; 4067 is = fr_matchsrcdst(&ofin, is, &src, &dst, tcp, FI_ICMPCMP); 4068 if (is != NULL) { 4069 ifs->ifs_ips_stats.iss_hits++; 4070 backward = IP6_NEQ(&is->is_dst, &src); 4071 fin->fin_rev = !backward; 4072 i = (backward << 1) + fin->fin_out; 4073 is->is_icmppkts[i]++; 4074 /* 4075 * we deliberately do not touch the timeouts 4076 * for the accompanying state table entry. 4077 * It remains to be seen if that is correct. XXX 4078 */ 4079 return is; 4080 } 4081 } 4082 RWLOCK_EXIT(&ifs->ifs_ipf_state); 4083 return NULL; 4084 } 4085 #endif 4086 4087 4088 /* ------------------------------------------------------------------------ */ 4089 /* Function: fr_sttab_init */ 4090 /* Returns: Nil */ 4091 /* Parameters: tqp(I) - pointer to an array of timeout queues for TCP */ 4092 /* */ 4093 /* Initialise the array of timeout queues for TCP. */ 4094 /* ------------------------------------------------------------------------ */ 4095 void fr_sttab_init(tqp, ifs) 4096 ipftq_t *tqp; 4097 ipf_stack_t *ifs; 4098 { 4099 int i; 4100 4101 for (i = IPF_TCP_NSTATES - 1; i >= 0; i--) { 4102 tqp[i].ifq_ttl = 0; 4103 tqp[i].ifq_ref = 1; 4104 tqp[i].ifq_head = NULL; 4105 tqp[i].ifq_tail = &tqp[i].ifq_head; 4106 tqp[i].ifq_next = tqp + i + 1; 4107 MUTEX_INIT(&tqp[i].ifq_lock, "ipftq tcp tab"); 4108 } 4109 tqp[IPF_TCP_NSTATES - 1].ifq_next = NULL; 4110 tqp[IPF_TCPS_CLOSED].ifq_ttl = ifs->ifs_fr_tcpclosed; 4111 tqp[IPF_TCPS_LISTEN].ifq_ttl = ifs->ifs_fr_tcptimeout; 4112 tqp[IPF_TCPS_SYN_SENT].ifq_ttl = ifs->ifs_fr_tcptimeout; 4113 tqp[IPF_TCPS_SYN_RECEIVED].ifq_ttl = ifs->ifs_fr_tcptimeout; 4114 tqp[IPF_TCPS_ESTABLISHED].ifq_ttl = ifs->ifs_fr_tcpidletimeout; 4115 tqp[IPF_TCPS_CLOSE_WAIT].ifq_ttl = ifs->ifs_fr_tcphalfclosed; 4116 tqp[IPF_TCPS_FIN_WAIT_1].ifq_ttl = ifs->ifs_fr_tcphalfclosed; 4117 tqp[IPF_TCPS_CLOSING].ifq_ttl = ifs->ifs_fr_tcptimeout; 4118 tqp[IPF_TCPS_LAST_ACK].ifq_ttl = ifs->ifs_fr_tcplastack; 4119 tqp[IPF_TCPS_FIN_WAIT_2].ifq_ttl = ifs->ifs_fr_tcpclosewait; 4120 tqp[IPF_TCPS_TIME_WAIT].ifq_ttl = ifs->ifs_fr_tcptimeout; 4121 tqp[IPF_TCPS_HALF_ESTAB].ifq_ttl = ifs->ifs_fr_tcptimeout; 4122 } 4123 4124 4125 /* ------------------------------------------------------------------------ */ 4126 /* Function: fr_sttab_destroy */ 4127 /* Returns: Nil */ 4128 /* Parameters: tqp(I) - pointer to an array of timeout queues for TCP */ 4129 /* */ 4130 /* Do whatever is necessary to "destroy" each of the entries in the array */ 4131 /* of timeout queues for TCP. */ 4132 /* ------------------------------------------------------------------------ */ 4133 void fr_sttab_destroy(tqp) 4134 ipftq_t *tqp; 4135 { 4136 int i; 4137 4138 for (i = IPF_TCP_NSTATES - 1; i >= 0; i--) 4139 MUTEX_DESTROY(&tqp[i].ifq_lock); 4140 } 4141 4142 4143 /* ------------------------------------------------------------------------ */ 4144 /* Function: fr_statederef */ 4145 /* Returns: Nil */ 4146 /* Parameters: isp(I) - pointer to pointer to state table entry */ 4147 /* ifs - ipf stack instance */ 4148 /* */ 4149 /* Decrement the reference counter for this state table entry and free it */ 4150 /* if there are no more things using it. */ 4151 /* */ 4152 /* Internal parameters: */ 4153 /* state[0] = state of source (host that initiated connection) */ 4154 /* state[1] = state of dest (host that accepted the connection) */ 4155 /* ------------------------------------------------------------------------ */ 4156 void fr_statederef(isp, ifs) 4157 ipstate_t **isp; 4158 ipf_stack_t *ifs; 4159 { 4160 ipstate_t *is; 4161 4162 is = *isp; 4163 *isp = NULL; 4164 4165 MUTEX_ENTER(&is->is_lock); 4166 if (is->is_ref > 1) { 4167 is->is_ref--; 4168 MUTEX_EXIT(&is->is_lock); 4169 #ifndef _KERNEL 4170 if ((is->is_sti.tqe_state[0] > IPF_TCPS_ESTABLISHED) || 4171 (is->is_sti.tqe_state[1] > IPF_TCPS_ESTABLISHED)) { 4172 (void) fr_delstate(is, ISL_ORPHAN, ifs); 4173 } 4174 #endif 4175 return; 4176 } 4177 MUTEX_EXIT(&is->is_lock); 4178 4179 WRITE_ENTER(&ifs->ifs_ipf_state); 4180 (void) fr_delstate(is, ISL_EXPIRE, ifs); 4181 RWLOCK_EXIT(&ifs->ifs_ipf_state); 4182 } 4183 4184 4185 /* ------------------------------------------------------------------------ */ 4186 /* Function: fr_setstatequeue */ 4187 /* Returns: Nil */ 4188 /* Parameters: is(I) - pointer to state structure */ 4189 /* rev(I) - forward(0) or reverse(1) direction */ 4190 /* Locks: ipf_state (read or write) */ 4191 /* */ 4192 /* Put the state entry on its default queue entry, using rev as a helped in */ 4193 /* determining which queue it should be placed on. */ 4194 /* ------------------------------------------------------------------------ */ 4195 void fr_setstatequeue(is, rev, ifs) 4196 ipstate_t *is; 4197 int rev; 4198 ipf_stack_t *ifs; 4199 { 4200 ipftq_t *oifq, *nifq; 4201 4202 4203 if ((is->is_sti.tqe_flags & TQE_RULEBASED) != 0) 4204 nifq = is->is_tqehead[rev]; 4205 else 4206 nifq = NULL; 4207 4208 if (nifq == NULL) { 4209 switch (is->is_p) 4210 { 4211 #ifdef USE_INET6 4212 case IPPROTO_ICMPV6 : 4213 if (rev == 1) 4214 nifq = &ifs->ifs_ips_icmpacktq; 4215 else 4216 nifq = &ifs->ifs_ips_icmptq; 4217 break; 4218 #endif 4219 case IPPROTO_ICMP : 4220 if (rev == 1) 4221 nifq = &ifs->ifs_ips_icmpacktq; 4222 else 4223 nifq = &ifs->ifs_ips_icmptq; 4224 break; 4225 case IPPROTO_TCP : 4226 nifq = ifs->ifs_ips_tqtqb + is->is_state[rev]; 4227 break; 4228 4229 case IPPROTO_UDP : 4230 if (rev == 1) 4231 nifq = &ifs->ifs_ips_udpacktq; 4232 else 4233 nifq = &ifs->ifs_ips_udptq; 4234 break; 4235 4236 default : 4237 nifq = &ifs->ifs_ips_iptq; 4238 break; 4239 } 4240 } 4241 4242 oifq = is->is_sti.tqe_ifq; 4243 /* 4244 * If it's currently on a timeout queue, move it from one queue to 4245 * another, else put it on the end of the newly determined queue. 4246 */ 4247 if (oifq != NULL) 4248 fr_movequeue(&is->is_sti, oifq, nifq, ifs); 4249 else 4250 fr_queueappend(&is->is_sti, nifq, is, ifs); 4251 return; 4252 } 4253 4254 4255 /* ------------------------------------------------------------------------ */ 4256 /* Function: fr_stateiter */ 4257 /* Returns: int - 0 == success, else error */ 4258 /* Parameters: token(I) - pointer to ipftoken structure */ 4259 /* itp(I) - pointer to ipfgeniter structure */ 4260 /* */ 4261 /* This function handles the SIOCGENITER ioctl for the state tables and */ 4262 /* walks through the list of entries in the state table list (ips_list.) */ 4263 /* ------------------------------------------------------------------------ */ 4264 static int fr_stateiter(token, itp, ifs) 4265 ipftoken_t *token; 4266 ipfgeniter_t *itp; 4267 ipf_stack_t *ifs; 4268 { 4269 ipstate_t *is, *next, zero; 4270 int error, count; 4271 char *dst; 4272 4273 if (itp->igi_data == NULL) 4274 return EFAULT; 4275 4276 if (itp->igi_nitems == 0) 4277 return EINVAL; 4278 4279 if (itp->igi_type != IPFGENITER_STATE) 4280 return EINVAL; 4281 4282 error = 0; 4283 4284 READ_ENTER(&ifs->ifs_ipf_state); 4285 4286 /* 4287 * Get "previous" entry from the token and find the next entry. 4288 */ 4289 is = token->ipt_data; 4290 if (is == NULL) { 4291 next = ifs->ifs_ips_list; 4292 } else { 4293 next = is->is_next; 4294 } 4295 4296 dst = itp->igi_data; 4297 for (count = itp->igi_nitems; count > 0; count--) { 4298 /* 4299 * If we found an entry, add a reference to it and update the token. 4300 * Otherwise, zero out data to be returned and NULL out token. 4301 */ 4302 if (next != NULL) { 4303 MUTEX_ENTER(&next->is_lock); 4304 next->is_ref++; 4305 MUTEX_EXIT(&next->is_lock); 4306 token->ipt_data = next; 4307 } else { 4308 bzero(&zero, sizeof(zero)); 4309 next = &zero; 4310 token->ipt_data = NULL; 4311 } 4312 4313 /* 4314 * Safe to release lock now the we have a reference. 4315 */ 4316 RWLOCK_EXIT(&ifs->ifs_ipf_state); 4317 4318 /* 4319 * Copy out data and clean up references and tokens. 4320 */ 4321 error = COPYOUT(next, dst, sizeof(*next)); 4322 if (error != 0) 4323 error = EFAULT; 4324 if (token->ipt_data == NULL) { 4325 ipf_freetoken(token, ifs); 4326 break; 4327 } else { 4328 if (is != NULL) 4329 fr_statederef(&is, ifs); 4330 if (next->is_next == NULL) { 4331 ipf_freetoken(token, ifs); 4332 break; 4333 } 4334 } 4335 4336 if ((count == 1) || (error != 0)) 4337 break; 4338 4339 READ_ENTER(&ifs->ifs_ipf_state); 4340 dst += sizeof(*next); 4341 is = next; 4342 next = is->is_next; 4343 } 4344 4345 return error; 4346 } 4347