1 /* $FreeBSD: src/sys/contrib/pf/net/pf.c,v 1.19 2004/09/11 11:18:25 mlaier Exp $ */
2 /* $OpenBSD: pf.c,v 1.433.2.2 2004/07/17 03:22:34 brad Exp $ */
3 /* add $OpenBSD: pf.c,v 1.448 2004/05/11 07:34:11 dhartmei Exp $ */
4 /* $DragonFly: src/sys/net/pf/pf.c,v 1.20 2008/06/05 18:06:32 swildner Exp $ */
7 * Copyright (c) 2004 The DragonFly Project. All rights reserved.
9 * Copyright (c) 2001 Daniel Hartmeier
10 * Copyright (c) 2002,2003 Henning Brauer
11 * All rights reserved.
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
17 * - Redistributions of source code must retain the above copyright
18 * notice, this list of conditions and the following disclaimer.
19 * - Redistributions in binary form must reproduce the above
20 * copyright notice, this list of conditions and the following
21 * disclaimer in the documentation and/or other materials provided
22 * with the distribution.
24 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
25 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
26 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
27 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
28 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
29 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
30 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
31 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
32 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
34 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35 * POSSIBILITY OF SUCH DAMAGE.
37 * Effort sponsored in part by the Defense Advanced Research Projects
38 * Agency (DARPA) and Air Force Research Laboratory, Air Force
39 * Materiel Command, USAF, under agreement number F30602-01-2-0537.
44 #include "opt_inet6.h"
45 #include "use_pfsync.h"
47 #include <sys/param.h>
48 #include <sys/systm.h>
49 #include <sys/malloc.h>
51 #include <sys/filio.h>
52 #include <sys/socket.h>
53 #include <sys/socketvar.h>
54 #include <sys/kernel.h>
56 #include <sys/sysctl.h>
57 #include <sys/endian.h>
58 #include <vm/vm_zone.h>
60 #include <machine/inttypes.h>
63 #include <net/if_types.h>
65 #include <net/netisr.h>
66 #include <net/route.h>
68 #include <netinet/in.h>
69 #include <netinet/in_var.h>
70 #include <netinet/in_systm.h>
71 #include <netinet/ip.h>
72 #include <netinet/ip_var.h>
73 #include <netinet/tcp.h>
74 #include <netinet/tcp_seq.h>
75 #include <netinet/udp.h>
76 #include <netinet/ip_icmp.h>
77 #include <netinet/in_pcb.h>
78 #include <netinet/tcp_timer.h>
79 #include <netinet/tcp_var.h>
80 #include <netinet/udp_var.h>
81 #include <netinet/icmp_var.h>
83 #include <net/pf/pfvar.h>
84 #include <net/pf/if_pflog.h>
87 #include <net/pf/if_pfsync.h>
88 #endif /* NPFSYNC > 0 */
91 #include <netinet/ip6.h>
92 #include <netinet/in_pcb.h>
93 #include <netinet/icmp6.h>
94 #include <netinet6/nd6.h>
95 #include <netinet6/ip6_var.h>
96 #include <netinet6/in6_pcb.h>
99 #include <sys/in_cksum.h>
100 #include <sys/ucred.h>
101 #include <machine/limits.h>
102 #include <sys/msgport2.h>
103 #include <net/netmsg2.h>
105 extern int ip_optcopy(struct ip
*, struct ip
*);
107 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) kprintf x
113 struct pf_anchorqueue pf_anchors
;
114 struct pf_ruleset pf_main_ruleset
;
115 struct pf_altqqueue pf_altqs
[2];
116 struct pf_palist pf_pabuf
;
117 struct pf_altqqueue
*pf_altqs_active
;
118 struct pf_altqqueue
*pf_altqs_inactive
;
119 struct pf_status pf_status
;
121 u_int32_t ticket_altqs_active
;
122 u_int32_t ticket_altqs_inactive
;
123 int altqs_inactive_open
;
124 u_int32_t ticket_pabuf
;
126 struct callout pf_expire_to
; /* expire timeout */
128 vm_zone_t pf_src_tree_pl
, pf_rule_pl
;
129 vm_zone_t pf_state_pl
, pf_altq_pl
, pf_pooladdr_pl
;
131 void pf_print_host(struct pf_addr
*, u_int16_t
, u_int8_t
);
132 void pf_print_state(struct pf_state
*);
133 void pf_print_flags(u_int8_t
);
135 u_int16_t
pf_cksum_fixup(u_int16_t
, u_int16_t
, u_int16_t
,
137 void pf_change_ap(struct pf_addr
*, u_int16_t
*,
138 u_int16_t
*, u_int16_t
*, struct pf_addr
*,
139 u_int16_t
, u_int8_t
, sa_family_t
);
141 void pf_change_a6(struct pf_addr
*, u_int16_t
*,
142 struct pf_addr
*, u_int8_t
);
144 void pf_change_icmp(struct pf_addr
*, u_int16_t
*,
145 struct pf_addr
*, struct pf_addr
*, u_int16_t
,
146 u_int16_t
*, u_int16_t
*, u_int16_t
*,
147 u_int16_t
*, u_int8_t
, sa_family_t
);
148 void pf_send_tcp(const struct pf_rule
*, sa_family_t
,
149 const struct pf_addr
*, const struct pf_addr
*,
150 u_int16_t
, u_int16_t
, u_int32_t
, u_int32_t
,
151 u_int8_t
, u_int16_t
, u_int16_t
, u_int8_t
);
152 void pf_send_icmp(struct mbuf
*, u_int8_t
, u_int8_t
,
153 sa_family_t
, struct pf_rule
*);
154 struct pf_rule
*pf_match_translation(struct pf_pdesc
*, struct mbuf
*,
155 int, int, struct pfi_kif
*,
156 struct pf_addr
*, u_int16_t
, struct pf_addr
*,
158 struct pf_rule
*pf_get_translation(struct pf_pdesc
*, struct mbuf
*,
159 int, int, struct pfi_kif
*, struct pf_src_node
**,
160 struct pf_addr
*, u_int16_t
,
161 struct pf_addr
*, u_int16_t
,
162 struct pf_addr
*, u_int16_t
*);
163 int pf_test_tcp(struct pf_rule
**, struct pf_state
**,
164 int, struct pfi_kif
*, struct mbuf
*, int,
165 void *, struct pf_pdesc
*, struct pf_rule
**,
166 struct pf_ruleset
**);
167 int pf_test_udp(struct pf_rule
**, struct pf_state
**,
168 int, struct pfi_kif
*, struct mbuf
*, int,
169 void *, struct pf_pdesc
*, struct pf_rule
**,
170 struct pf_ruleset
**);
171 int pf_test_icmp(struct pf_rule
**, struct pf_state
**,
172 int, struct pfi_kif
*, struct mbuf
*, int,
173 void *, struct pf_pdesc
*, struct pf_rule
**,
174 struct pf_ruleset
**);
175 int pf_test_other(struct pf_rule
**, struct pf_state
**,
176 int, struct pfi_kif
*, struct mbuf
*, int, void *,
177 struct pf_pdesc
*, struct pf_rule
**,
178 struct pf_ruleset
**);
179 int pf_test_fragment(struct pf_rule
**, int,
180 struct pfi_kif
*, struct mbuf
*, void *,
181 struct pf_pdesc
*, struct pf_rule
**,
182 struct pf_ruleset
**);
183 int pf_test_state_tcp(struct pf_state
**, int,
184 struct pfi_kif
*, struct mbuf
*, int,
185 void *, struct pf_pdesc
*, u_short
*);
186 int pf_test_state_udp(struct pf_state
**, int,
187 struct pfi_kif
*, struct mbuf
*, int,
188 void *, struct pf_pdesc
*);
189 int pf_test_state_icmp(struct pf_state
**, int,
190 struct pfi_kif
*, struct mbuf
*, int,
191 void *, struct pf_pdesc
*);
192 int pf_test_state_other(struct pf_state
**, int,
193 struct pfi_kif
*, struct pf_pdesc
*);
194 static int pf_match_tag(struct mbuf
*, struct pf_rule
*,
195 struct pf_rule
*, int *);
196 void pf_hash(struct pf_addr
*, struct pf_addr
*,
197 struct pf_poolhashkey
*, sa_family_t
);
198 int pf_map_addr(u_int8_t
, struct pf_rule
*,
199 struct pf_addr
*, struct pf_addr
*,
200 struct pf_addr
*, struct pf_src_node
**);
201 int pf_get_sport(sa_family_t
, u_int8_t
, struct pf_rule
*,
202 struct pf_addr
*, struct pf_addr
*, u_int16_t
,
203 struct pf_addr
*, u_int16_t
*, u_int16_t
, u_int16_t
,
204 struct pf_src_node
**);
205 void pf_route(struct mbuf
**, struct pf_rule
*, int,
206 struct ifnet
*, struct pf_state
*);
207 void pf_route6(struct mbuf
**, struct pf_rule
*, int,
208 struct ifnet
*, struct pf_state
*);
209 int pf_socket_lookup(uid_t
*, gid_t
*,
210 int, struct pf_pdesc
*);
211 u_int8_t
pf_get_wscale(struct mbuf
*, int, u_int16_t
,
213 u_int16_t
pf_get_mss(struct mbuf
*, int, u_int16_t
,
215 u_int16_t
pf_calc_mss(struct pf_addr
*, sa_family_t
,
217 void pf_set_rt_ifp(struct pf_state
*,
219 int pf_check_proto_cksum(struct mbuf
*, int, int,
220 u_int8_t
, sa_family_t
);
221 int pf_addr_wrap_neq(struct pf_addr_wrap
*,
222 struct pf_addr_wrap
*);
223 struct pf_state
*pf_find_state_recurse(struct pfi_kif
*,
224 struct pf_state
*, u_int8_t
);
226 struct pf_pool_limit pf_pool_limits
[PF_LIMIT_MAX
];
228 #define STATE_LOOKUP() \
230 if (direction == PF_IN) \
231 *state = pf_find_state_recurse( \
232 kif, &key, PF_EXT_GWY); \
234 *state = pf_find_state_recurse( \
235 kif, &key, PF_LAN_EXT); \
236 if (*state == NULL) \
238 if (direction == PF_OUT && \
239 (((*state)->rule.ptr->rt == PF_ROUTETO && \
240 (*state)->rule.ptr->direction == PF_OUT) || \
241 ((*state)->rule.ptr->rt == PF_REPLYTO && \
242 (*state)->rule.ptr->direction == PF_IN)) && \
243 (*state)->rt_kif != NULL && \
244 (*state)->rt_kif != kif) \
248 #define STATE_TRANSLATE(s) \
249 (s)->lan.addr.addr32[0] != (s)->gwy.addr.addr32[0] || \
250 ((s)->af == AF_INET6 && \
251 ((s)->lan.addr.addr32[1] != (s)->gwy.addr.addr32[1] || \
252 (s)->lan.addr.addr32[2] != (s)->gwy.addr.addr32[2] || \
253 (s)->lan.addr.addr32[3] != (s)->gwy.addr.addr32[3])) || \
254 (s)->lan.port != (s)->gwy.port
256 #define BOUND_IFACE(r, k) (((r)->rule_flag & PFRULE_IFBOUND) ? (k) : \
257 ((r)->rule_flag & PFRULE_GRBOUND) ? (k)->pfik_parent : \
258 (k)->pfik_parent->pfik_parent)
260 static int pf_src_compare(struct pf_src_node
*, struct pf_src_node
*);
261 static int pf_state_compare_lan_ext(struct pf_state
*,
263 static int pf_state_compare_ext_gwy(struct pf_state
*,
265 static int pf_state_compare_id(struct pf_state
*,
268 struct pf_src_tree tree_src_tracking
;
270 struct pf_state_tree_id tree_id
;
271 struct pf_state_queue state_updates
;
273 RB_GENERATE(pf_src_tree
, pf_src_node
, entry
, pf_src_compare
);
274 RB_GENERATE(pf_state_tree_lan_ext
, pf_state
,
275 u
.s
.entry_lan_ext
, pf_state_compare_lan_ext
);
276 RB_GENERATE(pf_state_tree_ext_gwy
, pf_state
,
277 u
.s
.entry_ext_gwy
, pf_state_compare_ext_gwy
);
278 RB_GENERATE(pf_state_tree_id
, pf_state
,
279 u
.s
.entry_id
, pf_state_compare_id
);
282 pf_src_compare(struct pf_src_node
*a
, struct pf_src_node
*b
)
286 if (a
->rule
.ptr
> b
->rule
.ptr
)
288 if (a
->rule
.ptr
< b
->rule
.ptr
)
290 if ((diff
= a
->af
- b
->af
) != 0)
295 if (a
->addr
.addr32
[0] > b
->addr
.addr32
[0])
297 if (a
->addr
.addr32
[0] < b
->addr
.addr32
[0])
303 if (a
->addr
.addr32
[3] > b
->addr
.addr32
[3])
305 if (a
->addr
.addr32
[3] < b
->addr
.addr32
[3])
307 if (a
->addr
.addr32
[2] > b
->addr
.addr32
[2])
309 if (a
->addr
.addr32
[2] < b
->addr
.addr32
[2])
311 if (a
->addr
.addr32
[1] > b
->addr
.addr32
[1])
313 if (a
->addr
.addr32
[1] < b
->addr
.addr32
[1])
315 if (a
->addr
.addr32
[0] > b
->addr
.addr32
[0])
317 if (a
->addr
.addr32
[0] < b
->addr
.addr32
[0])
326 pf_state_hash(struct pf_state
*s
)
328 u_int32_t hv
= (intptr_t)s
/ sizeof(*s
);
330 hv
^= crc32(&s
->lan
, sizeof(s
->lan
));
331 hv
^= crc32(&s
->gwy
, sizeof(s
->gwy
));
332 hv
^= crc32(&s
->ext
, sizeof(s
->ext
));
333 if (hv
== 0) /* disallow 0 */
339 pf_state_compare_lan_ext(struct pf_state
*a
, struct pf_state
*b
)
343 if ((diff
= a
->proto
- b
->proto
) != 0)
345 if ((diff
= a
->af
- b
->af
) != 0)
350 if (a
->lan
.addr
.addr32
[0] > b
->lan
.addr
.addr32
[0])
352 if (a
->lan
.addr
.addr32
[0] < b
->lan
.addr
.addr32
[0])
354 if (a
->ext
.addr
.addr32
[0] > b
->ext
.addr
.addr32
[0])
356 if (a
->ext
.addr
.addr32
[0] < b
->ext
.addr
.addr32
[0])
362 if (a
->lan
.addr
.addr32
[3] > b
->lan
.addr
.addr32
[3])
364 if (a
->lan
.addr
.addr32
[3] < b
->lan
.addr
.addr32
[3])
366 if (a
->ext
.addr
.addr32
[3] > b
->ext
.addr
.addr32
[3])
368 if (a
->ext
.addr
.addr32
[3] < b
->ext
.addr
.addr32
[3])
370 if (a
->lan
.addr
.addr32
[2] > b
->lan
.addr
.addr32
[2])
372 if (a
->lan
.addr
.addr32
[2] < b
->lan
.addr
.addr32
[2])
374 if (a
->ext
.addr
.addr32
[2] > b
->ext
.addr
.addr32
[2])
376 if (a
->ext
.addr
.addr32
[2] < b
->ext
.addr
.addr32
[2])
378 if (a
->lan
.addr
.addr32
[1] > b
->lan
.addr
.addr32
[1])
380 if (a
->lan
.addr
.addr32
[1] < b
->lan
.addr
.addr32
[1])
382 if (a
->ext
.addr
.addr32
[1] > b
->ext
.addr
.addr32
[1])
384 if (a
->ext
.addr
.addr32
[1] < b
->ext
.addr
.addr32
[1])
386 if (a
->lan
.addr
.addr32
[0] > b
->lan
.addr
.addr32
[0])
388 if (a
->lan
.addr
.addr32
[0] < b
->lan
.addr
.addr32
[0])
390 if (a
->ext
.addr
.addr32
[0] > b
->ext
.addr
.addr32
[0])
392 if (a
->ext
.addr
.addr32
[0] < b
->ext
.addr
.addr32
[0])
398 if ((diff
= a
->lan
.port
- b
->lan
.port
) != 0)
400 if ((diff
= a
->ext
.port
- b
->ext
.port
) != 0)
407 pf_state_compare_ext_gwy(struct pf_state
*a
, struct pf_state
*b
)
411 if ((diff
= a
->proto
- b
->proto
) != 0)
413 if ((diff
= a
->af
- b
->af
) != 0)
418 if (a
->ext
.addr
.addr32
[0] > b
->ext
.addr
.addr32
[0])
420 if (a
->ext
.addr
.addr32
[0] < b
->ext
.addr
.addr32
[0])
422 if (a
->gwy
.addr
.addr32
[0] > b
->gwy
.addr
.addr32
[0])
424 if (a
->gwy
.addr
.addr32
[0] < b
->gwy
.addr
.addr32
[0])
430 if (a
->ext
.addr
.addr32
[3] > b
->ext
.addr
.addr32
[3])
432 if (a
->ext
.addr
.addr32
[3] < b
->ext
.addr
.addr32
[3])
434 if (a
->gwy
.addr
.addr32
[3] > b
->gwy
.addr
.addr32
[3])
436 if (a
->gwy
.addr
.addr32
[3] < b
->gwy
.addr
.addr32
[3])
438 if (a
->ext
.addr
.addr32
[2] > b
->ext
.addr
.addr32
[2])
440 if (a
->ext
.addr
.addr32
[2] < b
->ext
.addr
.addr32
[2])
442 if (a
->gwy
.addr
.addr32
[2] > b
->gwy
.addr
.addr32
[2])
444 if (a
->gwy
.addr
.addr32
[2] < b
->gwy
.addr
.addr32
[2])
446 if (a
->ext
.addr
.addr32
[1] > b
->ext
.addr
.addr32
[1])
448 if (a
->ext
.addr
.addr32
[1] < b
->ext
.addr
.addr32
[1])
450 if (a
->gwy
.addr
.addr32
[1] > b
->gwy
.addr
.addr32
[1])
452 if (a
->gwy
.addr
.addr32
[1] < b
->gwy
.addr
.addr32
[1])
454 if (a
->ext
.addr
.addr32
[0] > b
->ext
.addr
.addr32
[0])
456 if (a
->ext
.addr
.addr32
[0] < b
->ext
.addr
.addr32
[0])
458 if (a
->gwy
.addr
.addr32
[0] > b
->gwy
.addr
.addr32
[0])
460 if (a
->gwy
.addr
.addr32
[0] < b
->gwy
.addr
.addr32
[0])
466 if ((diff
= a
->ext
.port
- b
->ext
.port
) != 0)
468 if ((diff
= a
->gwy
.port
- b
->gwy
.port
) != 0)
475 pf_state_compare_id(struct pf_state
*a
, struct pf_state
*b
)
481 if (a
->creatorid
> b
->creatorid
)
483 if (a
->creatorid
< b
->creatorid
)
491 pf_addrcpy(struct pf_addr
*dst
, struct pf_addr
*src
, sa_family_t af
)
496 dst
->addr32
[0] = src
->addr32
[0];
500 dst
->addr32
[0] = src
->addr32
[0];
501 dst
->addr32
[1] = src
->addr32
[1];
502 dst
->addr32
[2] = src
->addr32
[2];
503 dst
->addr32
[3] = src
->addr32
[3];
510 pf_find_state_byid(struct pf_state
*key
)
512 pf_status
.fcounters
[FCNT_STATE_SEARCH
]++;
513 return (RB_FIND(pf_state_tree_id
, &tree_id
, key
));
517 pf_find_state_recurse(struct pfi_kif
*kif
, struct pf_state
*key
, u_int8_t tree
)
521 pf_status
.fcounters
[FCNT_STATE_SEARCH
]++;
525 for (; kif
!= NULL
; kif
= kif
->pfik_parent
) {
526 s
= RB_FIND(pf_state_tree_lan_ext
,
527 &kif
->pfik_lan_ext
, key
);
533 for (; kif
!= NULL
; kif
= kif
->pfik_parent
) {
534 s
= RB_FIND(pf_state_tree_ext_gwy
,
535 &kif
->pfik_ext_gwy
, key
);
541 panic("pf_find_state_recurse");
546 pf_find_state_all(struct pf_state
*key
, u_int8_t tree
, int *more
)
548 struct pf_state
*s
, *ss
= NULL
;
551 pf_status
.fcounters
[FCNT_STATE_SEARCH
]++;
555 TAILQ_FOREACH(kif
, &pfi_statehead
, pfik_w_states
) {
556 s
= RB_FIND(pf_state_tree_lan_ext
,
557 &kif
->pfik_lan_ext
, key
);
567 TAILQ_FOREACH(kif
, &pfi_statehead
, pfik_w_states
) {
568 s
= RB_FIND(pf_state_tree_ext_gwy
,
569 &kif
->pfik_ext_gwy
, key
);
579 panic("pf_find_state_all");
584 pf_insert_src_node(struct pf_src_node
**sn
, struct pf_rule
*rule
,
585 struct pf_addr
*src
, sa_family_t af
)
587 struct pf_src_node k
;
591 PF_ACPY(&k
.addr
, src
, af
);
592 if (rule
->rule_flag
& PFRULE_RULESRCTRACK
||
593 rule
->rpool
.opts
& PF_POOL_STICKYADDR
)
597 pf_status
.scounters
[SCNT_SRC_NODE_SEARCH
]++;
598 *sn
= RB_FIND(pf_src_tree
, &tree_src_tracking
, &k
);
601 if (!rule
->max_src_nodes
||
602 rule
->src_nodes
< rule
->max_src_nodes
)
603 (*sn
) = pool_get(&pf_src_tree_pl
, PR_NOWAIT
);
606 bzero(*sn
, sizeof(struct pf_src_node
));
608 if (rule
->rule_flag
& PFRULE_RULESRCTRACK
||
609 rule
->rpool
.opts
& PF_POOL_STICKYADDR
)
610 (*sn
)->rule
.ptr
= rule
;
612 (*sn
)->rule
.ptr
= NULL
;
613 PF_ACPY(&(*sn
)->addr
, src
, af
);
614 if (RB_INSERT(pf_src_tree
,
615 &tree_src_tracking
, *sn
) != NULL
) {
616 if (pf_status
.debug
>= PF_DEBUG_MISC
) {
617 kprintf("pf: src_tree insert failed: ");
618 pf_print_host(&(*sn
)->addr
, 0, af
);
621 pool_put(&pf_src_tree_pl
, *sn
);
624 (*sn
)->creation
= time_second
;
625 (*sn
)->ruletype
= rule
->action
;
626 if ((*sn
)->rule
.ptr
!= NULL
)
627 (*sn
)->rule
.ptr
->src_nodes
++;
628 pf_status
.scounters
[SCNT_SRC_NODE_INSERT
]++;
629 pf_status
.src_nodes
++;
631 if (rule
->max_src_states
&&
632 (*sn
)->states
>= rule
->max_src_states
)
639 pf_insert_state(struct pfi_kif
*kif
, struct pf_state
*state
)
641 /* Thou MUST NOT insert multiple duplicate keys */
642 state
->u
.s
.kif
= kif
;
643 if (RB_INSERT(pf_state_tree_lan_ext
, &kif
->pfik_lan_ext
, state
)) {
644 if (pf_status
.debug
>= PF_DEBUG_MISC
) {
645 kprintf("pf: state insert failed: tree_lan_ext");
647 pf_print_host(&state
->lan
.addr
, state
->lan
.port
,
650 pf_print_host(&state
->gwy
.addr
, state
->gwy
.port
,
653 pf_print_host(&state
->ext
.addr
, state
->ext
.port
,
655 if (state
->sync_flags
& PFSTATE_FROMSYNC
)
656 kprintf(" (from sync)");
662 if (RB_INSERT(pf_state_tree_ext_gwy
, &kif
->pfik_ext_gwy
, state
)) {
663 if (pf_status
.debug
>= PF_DEBUG_MISC
) {
664 kprintf("pf: state insert failed: tree_ext_gwy");
666 pf_print_host(&state
->lan
.addr
, state
->lan
.port
,
669 pf_print_host(&state
->gwy
.addr
, state
->gwy
.port
,
672 pf_print_host(&state
->ext
.addr
, state
->ext
.port
,
674 if (state
->sync_flags
& PFSTATE_FROMSYNC
)
675 kprintf(" (from sync)");
678 RB_REMOVE(pf_state_tree_lan_ext
, &kif
->pfik_lan_ext
, state
);
682 if (state
->id
== 0 && state
->creatorid
== 0) {
683 state
->id
= htobe64(pf_status
.stateid
++);
684 state
->creatorid
= pf_status
.hostid
;
686 if (RB_INSERT(pf_state_tree_id
, &tree_id
, state
) != NULL
) {
687 if (pf_status
.debug
>= PF_DEBUG_MISC
) {
688 kprintf("pf: state insert failed: "
689 "id: %016" PRIx64
" creatorid: %08" PRIx32
,
690 be64toh(state
->id
), ntohl(state
->creatorid
));
691 if (state
->sync_flags
& PFSTATE_FROMSYNC
)
692 kprintf(" (from sync)");
695 RB_REMOVE(pf_state_tree_lan_ext
, &kif
->pfik_lan_ext
, state
);
696 RB_REMOVE(pf_state_tree_ext_gwy
, &kif
->pfik_ext_gwy
, state
);
699 TAILQ_INSERT_HEAD(&state_updates
, state
, u
.s
.entry_updates
);
701 pf_status
.fcounters
[FCNT_STATE_INSERT
]++;
703 pfi_attach_state(kif
);
705 pfsync_insert_state(state
);
711 pf_purge_timeout(void *arg
)
713 struct callout
*to
= arg
;
716 pf_purge_expired_states();
717 pf_purge_expired_fragments();
718 pf_purge_expired_src_nodes();
721 callout_reset(to
, pf_default_rule
.timeout
[PFTM_INTERVAL
] * hz
,
722 pf_purge_timeout
, to
);
726 pf_state_expires(const struct pf_state
*state
)
733 /* handle all PFTM_* > PFTM_MAX here */
734 if (state
->timeout
== PFTM_PURGE
)
735 return (time_second
);
736 if (state
->timeout
== PFTM_UNTIL_PACKET
)
738 KASSERT((state
->timeout
< PFTM_MAX
),
739 ("pf_state_expires: timeout > PFTM_MAX"));
740 timeout
= state
->rule
.ptr
->timeout
[state
->timeout
];
742 timeout
= pf_default_rule
.timeout
[state
->timeout
];
743 start
= state
->rule
.ptr
->timeout
[PFTM_ADAPTIVE_START
];
745 end
= state
->rule
.ptr
->timeout
[PFTM_ADAPTIVE_END
];
746 states
= state
->rule
.ptr
->states
;
748 start
= pf_default_rule
.timeout
[PFTM_ADAPTIVE_START
];
749 end
= pf_default_rule
.timeout
[PFTM_ADAPTIVE_END
];
750 states
= pf_status
.states
;
752 if (end
&& states
> start
&& start
< end
) {
754 return (state
->expire
+ timeout
* (end
- states
) /
757 return (time_second
);
759 return (state
->expire
+ timeout
);
763 pf_purge_expired_src_nodes(void)
765 struct pf_src_node
*cur
, *next
;
767 for (cur
= RB_MIN(pf_src_tree
, &tree_src_tracking
); cur
; cur
= next
) {
768 next
= RB_NEXT(pf_src_tree
, &tree_src_tracking
, cur
);
770 if (cur
->states
<= 0 && cur
->expire
<= time_second
) {
771 if (cur
->rule
.ptr
!= NULL
) {
772 cur
->rule
.ptr
->src_nodes
--;
773 if (cur
->rule
.ptr
->states
<= 0 &&
774 cur
->rule
.ptr
->max_src_nodes
<= 0)
775 pf_rm_rule(NULL
, cur
->rule
.ptr
);
777 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, cur
);
778 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
779 pf_status
.src_nodes
--;
780 pool_put(&pf_src_tree_pl
, cur
);
786 pf_src_tree_remove_state(struct pf_state
*s
)
790 if (s
->src_node
!= NULL
) {
791 if (--s
->src_node
->states
<= 0) {
792 timeout
= s
->rule
.ptr
->timeout
[PFTM_SRC_NODE
];
795 pf_default_rule
.timeout
[PFTM_SRC_NODE
];
796 s
->src_node
->expire
= time_second
+ timeout
;
799 if (s
->nat_src_node
!= s
->src_node
&& s
->nat_src_node
!= NULL
) {
800 if (--s
->nat_src_node
->states
<= 0) {
801 timeout
= s
->rule
.ptr
->timeout
[PFTM_SRC_NODE
];
804 pf_default_rule
.timeout
[PFTM_SRC_NODE
];
805 s
->nat_src_node
->expire
= time_second
+ timeout
;
808 s
->src_node
= s
->nat_src_node
= NULL
;
812 pf_purge_expired_states_callback(struct pf_state
*cur
, void *data __unused
)
814 if (pf_state_expires(cur
) <= time_second
) {
815 RB_REMOVE(pf_state_tree_ext_gwy
,
816 &cur
->u
.s
.kif
->pfik_ext_gwy
, cur
);
817 RB_REMOVE(pf_state_tree_lan_ext
,
818 &cur
->u
.s
.kif
->pfik_lan_ext
, cur
);
819 RB_REMOVE(pf_state_tree_id
, &tree_id
, cur
);
820 if (cur
->src
.state
== PF_TCPS_PROXY_DST
) {
821 pf_send_tcp(cur
->rule
.ptr
, cur
->af
,
822 &cur
->ext
.addr
, &cur
->lan
.addr
,
823 cur
->ext
.port
, cur
->lan
.port
,
824 cur
->src
.seqhi
, cur
->src
.seqlo
+ 1, 0,
825 TH_RST
|TH_ACK
, 0, 0);
828 pfsync_delete_state(cur
);
830 pf_src_tree_remove_state(cur
);
831 if (--cur
->rule
.ptr
->states
<= 0 &&
832 cur
->rule
.ptr
->src_nodes
<= 0)
833 pf_rm_rule(NULL
, cur
->rule
.ptr
);
834 if (cur
->nat_rule
.ptr
!= NULL
)
835 if (--cur
->nat_rule
.ptr
->states
<= 0 &&
836 cur
->nat_rule
.ptr
->src_nodes
<= 0)
837 pf_rm_rule(NULL
, cur
->nat_rule
.ptr
);
838 if (cur
->anchor
.ptr
!= NULL
)
839 if (--cur
->anchor
.ptr
->states
<= 0)
840 pf_rm_rule(NULL
, cur
->anchor
.ptr
);
841 pf_normalize_tcp_cleanup(cur
);
842 pfi_detach_state(cur
->u
.s
.kif
);
843 TAILQ_REMOVE(&state_updates
, cur
, u
.s
.entry_updates
);
844 pool_put(&pf_state_pl
, cur
);
845 pf_status
.fcounters
[FCNT_STATE_REMOVALS
]++;
852 pf_purge_expired_states(void)
854 RB_SCAN(pf_state_tree_id
, &tree_id
, NULL
,
855 pf_purge_expired_states_callback
, NULL
);
860 pf_tbladdr_setup(struct pf_ruleset
*rs
, struct pf_addr_wrap
*aw
)
862 if (aw
->type
!= PF_ADDR_TABLE
)
864 if ((aw
->p
.tbl
= pfr_attach_table(rs
, aw
->v
.tblname
)) == NULL
)
870 pf_tbladdr_remove(struct pf_addr_wrap
*aw
)
872 if (aw
->type
!= PF_ADDR_TABLE
|| aw
->p
.tbl
== NULL
)
874 pfr_detach_table(aw
->p
.tbl
);
879 pf_tbladdr_copyout(struct pf_addr_wrap
*aw
)
881 struct pfr_ktable
*kt
= aw
->p
.tbl
;
883 if (aw
->type
!= PF_ADDR_TABLE
|| kt
== NULL
)
885 if (!(kt
->pfrkt_flags
& PFR_TFLAG_ACTIVE
) && kt
->pfrkt_root
!= NULL
)
888 aw
->p
.tblcnt
= (kt
->pfrkt_flags
& PFR_TFLAG_ACTIVE
) ?
893 pf_print_host(struct pf_addr
*addr
, u_int16_t p
, sa_family_t af
)
898 u_int32_t a
= ntohl(addr
->addr32
[0]);
899 kprintf("%u.%u.%u.%u", (a
>>24)&255, (a
>>16)&255,
911 u_int8_t i
, curstart
= 255, curend
= 0,
912 maxstart
= 0, maxend
= 0;
913 for (i
= 0; i
< 8; i
++) {
914 if (!addr
->addr16
[i
]) {
921 if ((curend
- curstart
) >
922 (maxend
- maxstart
)) {
930 for (i
= 0; i
< 8; i
++) {
931 if (i
>= maxstart
&& i
<= maxend
) {
940 b
= ntohs(addr
->addr16
[i
]);
957 pf_print_state(struct pf_state
*s
)
973 kprintf("%u ", s
->proto
);
976 pf_print_host(&s
->lan
.addr
, s
->lan
.port
, s
->af
);
978 pf_print_host(&s
->gwy
.addr
, s
->gwy
.port
, s
->af
);
980 pf_print_host(&s
->ext
.addr
, s
->ext
.port
, s
->af
);
981 kprintf(" [lo=%u high=%u win=%u modulator=%u", s
->src
.seqlo
,
982 s
->src
.seqhi
, s
->src
.max_win
, s
->src
.seqdiff
);
983 if (s
->src
.wscale
&& s
->dst
.wscale
)
984 kprintf(" wscale=%u", s
->src
.wscale
& PF_WSCALE_MASK
);
986 kprintf(" [lo=%u high=%u win=%u modulator=%u", s
->dst
.seqlo
,
987 s
->dst
.seqhi
, s
->dst
.max_win
, s
->dst
.seqdiff
);
988 if (s
->src
.wscale
&& s
->dst
.wscale
)
989 kprintf(" wscale=%u", s
->dst
.wscale
& PF_WSCALE_MASK
);
991 kprintf(" %u:%u", s
->src
.state
, s
->dst
.state
);
995 pf_print_flags(u_int8_t f
)
1017 #define PF_SET_SKIP_STEPS(i) \
1019 while (head[i] != cur) { \
1020 head[i]->skip[i].ptr = cur; \
1021 head[i] = TAILQ_NEXT(head[i], entries); \
1026 pf_calc_skip_steps(struct pf_rulequeue
*rules
)
1028 struct pf_rule
*cur
, *prev
, *head
[PF_SKIP_COUNT
];
1031 cur
= TAILQ_FIRST(rules
);
1033 for (i
= 0; i
< PF_SKIP_COUNT
; ++i
)
1035 while (cur
!= NULL
) {
1037 if (cur
->kif
!= prev
->kif
|| cur
->ifnot
!= prev
->ifnot
)
1038 PF_SET_SKIP_STEPS(PF_SKIP_IFP
);
1039 if (cur
->direction
!= prev
->direction
)
1040 PF_SET_SKIP_STEPS(PF_SKIP_DIR
);
1041 if (cur
->af
!= prev
->af
)
1042 PF_SET_SKIP_STEPS(PF_SKIP_AF
);
1043 if (cur
->proto
!= prev
->proto
)
1044 PF_SET_SKIP_STEPS(PF_SKIP_PROTO
);
1045 if (cur
->src
.not != prev
->src
.not ||
1046 pf_addr_wrap_neq(&cur
->src
.addr
, &prev
->src
.addr
))
1047 PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR
);
1048 if (cur
->src
.port
[0] != prev
->src
.port
[0] ||
1049 cur
->src
.port
[1] != prev
->src
.port
[1] ||
1050 cur
->src
.port_op
!= prev
->src
.port_op
)
1051 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT
);
1052 if (cur
->dst
.not != prev
->dst
.not ||
1053 pf_addr_wrap_neq(&cur
->dst
.addr
, &prev
->dst
.addr
))
1054 PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR
);
1055 if (cur
->dst
.port
[0] != prev
->dst
.port
[0] ||
1056 cur
->dst
.port
[1] != prev
->dst
.port
[1] ||
1057 cur
->dst
.port_op
!= prev
->dst
.port_op
)
1058 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT
);
1061 cur
= TAILQ_NEXT(cur
, entries
);
1063 for (i
= 0; i
< PF_SKIP_COUNT
; ++i
)
1064 PF_SET_SKIP_STEPS(i
);
1068 pf_addr_wrap_neq(struct pf_addr_wrap
*aw1
, struct pf_addr_wrap
*aw2
)
1070 if (aw1
->type
!= aw2
->type
)
1072 switch (aw1
->type
) {
1073 case PF_ADDR_ADDRMASK
:
1074 if (PF_ANEQ(&aw1
->v
.a
.addr
, &aw2
->v
.a
.addr
, 0))
1076 if (PF_ANEQ(&aw1
->v
.a
.mask
, &aw2
->v
.a
.mask
, 0))
1079 case PF_ADDR_DYNIFTL
:
1080 return (aw1
->p
.dyn
->pfid_kt
!= aw2
->p
.dyn
->pfid_kt
);
1081 case PF_ADDR_NOROUTE
:
1084 return (aw1
->p
.tbl
!= aw2
->p
.tbl
);
1086 kprintf("invalid address type: %d\n", aw1
->type
);
1092 pf_update_anchor_rules(void)
1094 struct pf_rule
*rule
;
1097 for (i
= 0; i
< PF_RULESET_MAX
; ++i
)
1098 TAILQ_FOREACH(rule
, pf_main_ruleset
.rules
[i
].active
.ptr
,
1100 if (rule
->anchorname
[0])
1101 rule
->anchor
= pf_find_anchor(rule
->anchorname
);
1103 rule
->anchor
= NULL
;
1107 pf_cksum_fixup(u_int16_t cksum
, u_int16_t old
, u_int16_t
new, u_int8_t udp
)
1113 l
= cksum
+ old
- new;
1114 l
= (l
>> 16) + (l
& 65535);
1122 pf_change_ap(struct pf_addr
*a
, u_int16_t
*p
, u_int16_t
*ic
, u_int16_t
*pc
,
1123 struct pf_addr
*an
, u_int16_t pn
, u_int8_t u
, sa_family_t af
)
1128 PF_ACPY(&ao
, a
, af
);
1136 *ic
= pf_cksum_fixup(pf_cksum_fixup(*ic
,
1137 ao
.addr16
[0], an
->addr16
[0], 0),
1138 ao
.addr16
[1], an
->addr16
[1], 0);
1140 *pc
= pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc
,
1141 ao
.addr16
[0], an
->addr16
[0], u
),
1142 ao
.addr16
[1], an
->addr16
[1], u
),
1148 *pc
= pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1149 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1150 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc
,
1151 ao
.addr16
[0], an
->addr16
[0], u
),
1152 ao
.addr16
[1], an
->addr16
[1], u
),
1153 ao
.addr16
[2], an
->addr16
[2], u
),
1154 ao
.addr16
[3], an
->addr16
[3], u
),
1155 ao
.addr16
[4], an
->addr16
[4], u
),
1156 ao
.addr16
[5], an
->addr16
[5], u
),
1157 ao
.addr16
[6], an
->addr16
[6], u
),
1158 ao
.addr16
[7], an
->addr16
[7], u
),
1166 /* Changes a u_int32_t. Uses a void * so there are no align restrictions */
1168 pf_change_a(void *a
, u_int16_t
*c
, u_int32_t an
, u_int8_t u
)
1172 memcpy(&ao
, a
, sizeof(ao
));
1173 memcpy(a
, &an
, sizeof(u_int32_t
));
1174 *c
= pf_cksum_fixup(pf_cksum_fixup(*c
, ao
/ 65536, an
/ 65536, u
),
1175 ao
% 65536, an
% 65536, u
);
1180 pf_change_a6(struct pf_addr
*a
, u_int16_t
*c
, struct pf_addr
*an
, u_int8_t u
)
1184 PF_ACPY(&ao
, a
, AF_INET6
);
1185 PF_ACPY(a
, an
, AF_INET6
);
1187 *c
= pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1188 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1189 pf_cksum_fixup(pf_cksum_fixup(*c
,
1190 ao
.addr16
[0], an
->addr16
[0], u
),
1191 ao
.addr16
[1], an
->addr16
[1], u
),
1192 ao
.addr16
[2], an
->addr16
[2], u
),
1193 ao
.addr16
[3], an
->addr16
[3], u
),
1194 ao
.addr16
[4], an
->addr16
[4], u
),
1195 ao
.addr16
[5], an
->addr16
[5], u
),
1196 ao
.addr16
[6], an
->addr16
[6], u
),
1197 ao
.addr16
[7], an
->addr16
[7], u
);
1202 pf_change_icmp(struct pf_addr
*ia
, u_int16_t
*ip
, struct pf_addr
*oa
,
1203 struct pf_addr
*na
, u_int16_t np
, u_int16_t
*pc
, u_int16_t
*h2c
,
1204 u_int16_t
*ic
, u_int16_t
*hc
, u_int8_t u
, sa_family_t af
)
1206 struct pf_addr oia
, ooa
;
1208 PF_ACPY(&oia
, ia
, af
);
1209 PF_ACPY(&ooa
, oa
, af
);
1211 /* Change inner protocol port, fix inner protocol checksum. */
1213 u_int16_t oip
= *ip
;
1220 *pc
= pf_cksum_fixup(*pc
, oip
, *ip
, u
);
1221 *ic
= pf_cksum_fixup(*ic
, oip
, *ip
, 0);
1223 *ic
= pf_cksum_fixup(*ic
, opc
, *pc
, 0);
1225 /* Change inner ip address, fix inner ip and icmp checksums. */
1226 PF_ACPY(ia
, na
, af
);
1230 u_int32_t oh2c
= *h2c
;
1232 *h2c
= pf_cksum_fixup(pf_cksum_fixup(*h2c
,
1233 oia
.addr16
[0], ia
->addr16
[0], 0),
1234 oia
.addr16
[1], ia
->addr16
[1], 0);
1235 *ic
= pf_cksum_fixup(pf_cksum_fixup(*ic
,
1236 oia
.addr16
[0], ia
->addr16
[0], 0),
1237 oia
.addr16
[1], ia
->addr16
[1], 0);
1238 *ic
= pf_cksum_fixup(*ic
, oh2c
, *h2c
, 0);
1244 *ic
= pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1245 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1246 pf_cksum_fixup(pf_cksum_fixup(*ic
,
1247 oia
.addr16
[0], ia
->addr16
[0], u
),
1248 oia
.addr16
[1], ia
->addr16
[1], u
),
1249 oia
.addr16
[2], ia
->addr16
[2], u
),
1250 oia
.addr16
[3], ia
->addr16
[3], u
),
1251 oia
.addr16
[4], ia
->addr16
[4], u
),
1252 oia
.addr16
[5], ia
->addr16
[5], u
),
1253 oia
.addr16
[6], ia
->addr16
[6], u
),
1254 oia
.addr16
[7], ia
->addr16
[7], u
);
1258 /* Change outer ip address, fix outer ip or icmpv6 checksum. */
1259 PF_ACPY(oa
, na
, af
);
1263 *hc
= pf_cksum_fixup(pf_cksum_fixup(*hc
,
1264 ooa
.addr16
[0], oa
->addr16
[0], 0),
1265 ooa
.addr16
[1], oa
->addr16
[1], 0);
1270 *ic
= pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1271 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1272 pf_cksum_fixup(pf_cksum_fixup(*ic
,
1273 ooa
.addr16
[0], oa
->addr16
[0], u
),
1274 ooa
.addr16
[1], oa
->addr16
[1], u
),
1275 ooa
.addr16
[2], oa
->addr16
[2], u
),
1276 ooa
.addr16
[3], oa
->addr16
[3], u
),
1277 ooa
.addr16
[4], oa
->addr16
[4], u
),
1278 ooa
.addr16
[5], oa
->addr16
[5], u
),
1279 ooa
.addr16
[6], oa
->addr16
[6], u
),
1280 ooa
.addr16
[7], oa
->addr16
[7], u
);
1287 pf_send_tcp(const struct pf_rule
*r
, sa_family_t af
,
1288 const struct pf_addr
*saddr
, const struct pf_addr
*daddr
,
1289 u_int16_t sport
, u_int16_t dport
, u_int32_t seq
, u_int32_t ack
,
1290 u_int8_t flags
, u_int16_t win
, u_int16_t mss
, u_int8_t ttl
)
1295 struct ip
*h
= NULL
;
1298 struct ip6_hdr
*h6
= NULL
;
1300 struct tcphdr
*th
= NULL
;
1303 /* maximum segment size tcp option */
1304 tlen
= sizeof(struct tcphdr
);
1311 len
= sizeof(struct ip
) + tlen
;
1316 len
= sizeof(struct ip6_hdr
) + tlen
;
1321 /* create outgoing mbuf */
1322 m
= m_gethdr(MB_DONTWAIT
, MT_HEADER
);
1325 m
->m_pkthdr
.fw_flags
= PF_MBUF_GENERATED
;
1327 if (r
!= NULL
&& r
->qid
) {
1328 m
->m_pkthdr
.fw_flags
|= ALTQ_MBUF_TAGGED
;
1329 m
->m_pkthdr
.altq_qid
= r
->qid
;
1330 m
->m_pkthdr
.ecn_af
= af
;
1331 m
->m_pkthdr
.header
= mtod(m
, struct ip
*);
1334 m
->m_data
+= max_linkhdr
;
1335 m
->m_pkthdr
.len
= m
->m_len
= len
;
1336 m
->m_pkthdr
.rcvif
= NULL
;
1337 bzero(m
->m_data
, len
);
1341 h
= mtod(m
, struct ip
*);
1343 /* IP header fields included in the TCP checksum */
1344 h
->ip_p
= IPPROTO_TCP
;
1346 h
->ip_src
.s_addr
= saddr
->v4
.s_addr
;
1347 h
->ip_dst
.s_addr
= daddr
->v4
.s_addr
;
1349 th
= (struct tcphdr
*)((caddr_t
)h
+ sizeof(struct ip
));
1354 h6
= mtod(m
, struct ip6_hdr
*);
1356 /* IP header fields included in the TCP checksum */
1357 h6
->ip6_nxt
= IPPROTO_TCP
;
1358 h6
->ip6_plen
= htons(tlen
);
1359 memcpy(&h6
->ip6_src
, &saddr
->v6
, sizeof(struct in6_addr
));
1360 memcpy(&h6
->ip6_dst
, &daddr
->v6
, sizeof(struct in6_addr
));
1362 th
= (struct tcphdr
*)((caddr_t
)h6
+ sizeof(struct ip6_hdr
));
1368 th
->th_sport
= sport
;
1369 th
->th_dport
= dport
;
1370 th
->th_seq
= htonl(seq
);
1371 th
->th_ack
= htonl(ack
);
1372 th
->th_off
= tlen
>> 2;
1373 th
->th_flags
= flags
;
1374 th
->th_win
= htons(win
);
1377 opt
= (char *)(th
+ 1);
1378 opt
[0] = TCPOPT_MAXSEG
;
1381 bcopy((caddr_t
)&mss
, (caddr_t
)(opt
+ 2), 2);
1388 th
->th_sum
= in_cksum(m
, len
);
1390 /* Finish the IP header */
1392 h
->ip_hl
= sizeof(*h
) >> 2;
1393 h
->ip_tos
= IPTOS_LOWDELAY
;
1395 h
->ip_off
= path_mtu_discovery
? IP_DF
: 0;
1396 h
->ip_ttl
= ttl
? ttl
: ip_defttl
;
1398 ip_output(m
, NULL
, NULL
, 0, NULL
, NULL
);
1404 th
->th_sum
= in6_cksum(m
, IPPROTO_TCP
,
1405 sizeof(struct ip6_hdr
), tlen
);
1407 h6
->ip6_vfc
|= IPV6_VERSION
;
1408 h6
->ip6_hlim
= IPV6_DEFHLIM
;
1410 ip6_output(m
, NULL
, NULL
, 0, NULL
, NULL
, NULL
);
1417 pf_send_icmp(struct mbuf
*m
, u_int8_t type
, u_int8_t code
, sa_family_t af
,
1422 m0
= m_copypacket(m
, MB_DONTWAIT
);
1425 m0
->m_pkthdr
.fw_flags
|= PF_MBUF_GENERATED
;
1429 m
->m_pkthdr
.fw_flags
|= ALTQ_MBUF_TAGGED
;
1430 m
->m_pkthdr
.altq_qid
= r
->qid
;
1431 m
->m_pkthdr
.ecn_af
= af
;
1432 m
->m_pkthdr
.header
= mtod(m0
, struct ip
*);
1439 icmp_error(m0
, type
, code
, 0, 0);
1444 icmp6_error(m0
, type
, code
, 0);
1451 * Return 1 if the addresses a and b match (with mask m), otherwise return 0.
1452 * If n is 0, they match if they are equal. If n is != 0, they match if they
1456 pf_match_addr(u_int8_t n
, struct pf_addr
*a
, struct pf_addr
*m
,
1457 struct pf_addr
*b
, sa_family_t af
)
1464 if ((a
->addr32
[0] & m
->addr32
[0]) ==
1465 (b
->addr32
[0] & m
->addr32
[0]))
1471 if (((a
->addr32
[0] & m
->addr32
[0]) ==
1472 (b
->addr32
[0] & m
->addr32
[0])) &&
1473 ((a
->addr32
[1] & m
->addr32
[1]) ==
1474 (b
->addr32
[1] & m
->addr32
[1])) &&
1475 ((a
->addr32
[2] & m
->addr32
[2]) ==
1476 (b
->addr32
[2] & m
->addr32
[2])) &&
1477 ((a
->addr32
[3] & m
->addr32
[3]) ==
1478 (b
->addr32
[3] & m
->addr32
[3])))
1497 pf_match(u_int8_t op
, u_int32_t a1
, u_int32_t a2
, u_int32_t p
)
1501 return ((p
> a1
) && (p
< a2
));
1503 return ((p
< a1
) || (p
> a2
));
1505 return ((p
>= a1
) && (p
<= a2
));
1519 return (0); /* never reached */
1523 pf_match_port(u_int8_t op
, u_int16_t a1
, u_int16_t a2
, u_int16_t p
)
1528 return (pf_match(op
, a1
, a2
, p
));
1532 pf_match_uid(u_int8_t op
, uid_t a1
, uid_t a2
, uid_t u
)
1534 if (u
== UID_MAX
&& op
!= PF_OP_EQ
&& op
!= PF_OP_NE
)
1536 return (pf_match(op
, a1
, a2
, u
));
1540 pf_match_gid(u_int8_t op
, gid_t a1
, gid_t a2
, gid_t g
)
1542 if (g
== GID_MAX
&& op
!= PF_OP_EQ
&& op
!= PF_OP_NE
)
1544 return (pf_match(op
, a1
, a2
, g
));
1548 pf_match_tag(struct mbuf
*m
, struct pf_rule
*r
, struct pf_rule
*nat_rule
,
1551 if (*tag
== -1) { /* find mbuf tag */
1552 if (nat_rule
!= NULL
&& nat_rule
->tag
)
1553 *tag
= nat_rule
->tag
;
1554 else if (m
->m_pkthdr
.fw_flags
& PF_MBUF_TAGGED
)
1555 *tag
= m
->m_pkthdr
.pf_tag
;
1560 return ((!r
->match_tag_not
&& r
->match_tag
== *tag
) ||
1561 (r
->match_tag_not
&& r
->match_tag
!= *tag
));
1565 pf_tag_packet(struct mbuf
*m
, int tag
)
1570 m
->m_pkthdr
.fw_flags
|= PF_MBUF_TAGGED
;
1571 m
->m_pkthdr
.pf_tag
= tag
;
1574 #define PF_STEP_INTO_ANCHOR(r, a, s, n) \
1576 if ((r) == NULL || (r)->anchor == NULL || \
1577 (s) != NULL || (a) != NULL) \
1578 panic("PF_STEP_INTO_ANCHOR"); \
1580 (s) = TAILQ_FIRST(&(r)->anchor->rulesets); \
1582 while ((s) != NULL && ((r) = \
1583 TAILQ_FIRST((s)->rules[n].active.ptr)) == NULL) \
1584 (s) = TAILQ_NEXT((s), entries); \
1585 if ((r) == NULL) { \
1586 (r) = TAILQ_NEXT((a), entries); \
1591 #define PF_STEP_OUT_OF_ANCHOR(r, a, s, n) \
1593 if ((r) != NULL || (a) == NULL || (s) == NULL) \
1594 panic("PF_STEP_OUT_OF_ANCHOR"); \
1595 (s) = TAILQ_NEXT((s), entries); \
1596 while ((s) != NULL && ((r) = \
1597 TAILQ_FIRST((s)->rules[n].active.ptr)) == NULL) \
1598 (s) = TAILQ_NEXT((s), entries); \
1599 if ((r) == NULL) { \
1600 (r) = TAILQ_NEXT((a), entries); \
1607 pf_poolmask(struct pf_addr
*naddr
, struct pf_addr
*raddr
,
1608 struct pf_addr
*rmask
, struct pf_addr
*saddr
, sa_family_t af
)
1613 naddr
->addr32
[0] = (raddr
->addr32
[0] & rmask
->addr32
[0]) |
1614 ((rmask
->addr32
[0] ^ 0xffffffff ) & saddr
->addr32
[0]);
1618 naddr
->addr32
[0] = (raddr
->addr32
[0] & rmask
->addr32
[0]) |
1619 ((rmask
->addr32
[0] ^ 0xffffffff ) & saddr
->addr32
[0]);
1620 naddr
->addr32
[1] = (raddr
->addr32
[1] & rmask
->addr32
[1]) |
1621 ((rmask
->addr32
[1] ^ 0xffffffff ) & saddr
->addr32
[1]);
1622 naddr
->addr32
[2] = (raddr
->addr32
[2] & rmask
->addr32
[2]) |
1623 ((rmask
->addr32
[2] ^ 0xffffffff ) & saddr
->addr32
[2]);
1624 naddr
->addr32
[3] = (raddr
->addr32
[3] & rmask
->addr32
[3]) |
1625 ((rmask
->addr32
[3] ^ 0xffffffff ) & saddr
->addr32
[3]);
1631 pf_addr_inc(struct pf_addr
*addr
, sa_family_t af
)
1636 addr
->addr32
[0] = htonl(ntohl(addr
->addr32
[0]) + 1);
1640 if (addr
->addr32
[3] == 0xffffffff) {
1641 addr
->addr32
[3] = 0;
1642 if (addr
->addr32
[2] == 0xffffffff) {
1643 addr
->addr32
[2] = 0;
1644 if (addr
->addr32
[1] == 0xffffffff) {
1645 addr
->addr32
[1] = 0;
1647 htonl(ntohl(addr
->addr32
[0]) + 1);
1650 htonl(ntohl(addr
->addr32
[1]) + 1);
1653 htonl(ntohl(addr
->addr32
[2]) + 1);
1656 htonl(ntohl(addr
->addr32
[3]) + 1);
1662 #define mix(a,b,c) \
1664 a -= b; a -= c; a ^= (c >> 13); \
1665 b -= c; b -= a; b ^= (a << 8); \
1666 c -= a; c -= b; c ^= (b >> 13); \
1667 a -= b; a -= c; a ^= (c >> 12); \
1668 b -= c; b -= a; b ^= (a << 16); \
1669 c -= a; c -= b; c ^= (b >> 5); \
1670 a -= b; a -= c; a ^= (c >> 3); \
1671 b -= c; b -= a; b ^= (a << 10); \
1672 c -= a; c -= b; c ^= (b >> 15); \
1676 * hash function based on bridge_hash in if_bridge.c
1679 pf_hash(struct pf_addr
*inaddr
, struct pf_addr
*hash
,
1680 struct pf_poolhashkey
*key
, sa_family_t af
)
1682 u_int32_t a
= 0x9e3779b9, b
= 0x9e3779b9, c
= key
->key32
[0];
1687 a
+= inaddr
->addr32
[0];
1690 hash
->addr32
[0] = c
+ key
->key32
[2];
1695 a
+= inaddr
->addr32
[0];
1696 b
+= inaddr
->addr32
[2];
1698 hash
->addr32
[0] = c
;
1699 a
+= inaddr
->addr32
[1];
1700 b
+= inaddr
->addr32
[3];
1703 hash
->addr32
[1] = c
;
1704 a
+= inaddr
->addr32
[2];
1705 b
+= inaddr
->addr32
[1];
1708 hash
->addr32
[2] = c
;
1709 a
+= inaddr
->addr32
[3];
1710 b
+= inaddr
->addr32
[0];
1713 hash
->addr32
[3] = c
;
1720 pf_map_addr(sa_family_t af
, struct pf_rule
*r
, struct pf_addr
*saddr
,
1721 struct pf_addr
*naddr
, struct pf_addr
*init_addr
, struct pf_src_node
**sn
)
1723 unsigned char hash
[16];
1724 struct pf_pool
*rpool
= &r
->rpool
;
1725 struct pf_addr
*raddr
= &rpool
->cur
->addr
.v
.a
.addr
;
1726 struct pf_addr
*rmask
= &rpool
->cur
->addr
.v
.a
.mask
;
1727 struct pf_pooladdr
*acur
= rpool
->cur
;
1728 struct pf_src_node k
;
1730 if (*sn
== NULL
&& r
->rpool
.opts
& PF_POOL_STICKYADDR
&&
1731 (r
->rpool
.opts
& PF_POOL_TYPEMASK
) != PF_POOL_NONE
) {
1733 PF_ACPY(&k
.addr
, saddr
, af
);
1734 if (r
->rule_flag
& PFRULE_RULESRCTRACK
||
1735 r
->rpool
.opts
& PF_POOL_STICKYADDR
)
1739 pf_status
.scounters
[SCNT_SRC_NODE_SEARCH
]++;
1740 *sn
= RB_FIND(pf_src_tree
, &tree_src_tracking
, &k
);
1741 if (*sn
!= NULL
&& !PF_AZERO(&(*sn
)->raddr
, af
)) {
1742 PF_ACPY(naddr
, &(*sn
)->raddr
, af
);
1743 if (pf_status
.debug
>= PF_DEBUG_MISC
) {
1744 kprintf("pf_map_addr: src tracking maps ");
1745 pf_print_host(&k
.addr
, 0, af
);
1747 pf_print_host(naddr
, 0, af
);
1754 if (rpool
->cur
->addr
.type
== PF_ADDR_NOROUTE
)
1756 if (rpool
->cur
->addr
.type
== PF_ADDR_DYNIFTL
) {
1757 if (af
== AF_INET
) {
1758 if (rpool
->cur
->addr
.p
.dyn
->pfid_acnt4
< 1 &&
1759 (rpool
->opts
& PF_POOL_TYPEMASK
) !=
1762 raddr
= &rpool
->cur
->addr
.p
.dyn
->pfid_addr4
;
1763 rmask
= &rpool
->cur
->addr
.p
.dyn
->pfid_mask4
;
1765 if (rpool
->cur
->addr
.p
.dyn
->pfid_acnt6
< 1 &&
1766 (rpool
->opts
& PF_POOL_TYPEMASK
) !=
1769 raddr
= &rpool
->cur
->addr
.p
.dyn
->pfid_addr6
;
1770 rmask
= &rpool
->cur
->addr
.p
.dyn
->pfid_mask6
;
1772 } else if (rpool
->cur
->addr
.type
== PF_ADDR_TABLE
) {
1773 if ((rpool
->opts
& PF_POOL_TYPEMASK
) != PF_POOL_ROUNDROBIN
)
1774 return (1); /* unsupported */
1776 raddr
= &rpool
->cur
->addr
.v
.a
.addr
;
1777 rmask
= &rpool
->cur
->addr
.v
.a
.mask
;
1780 switch (rpool
->opts
& PF_POOL_TYPEMASK
) {
1782 PF_ACPY(naddr
, raddr
, af
);
1784 case PF_POOL_BITMASK
:
1785 PF_POOLMASK(naddr
, raddr
, rmask
, saddr
, af
);
1787 case PF_POOL_RANDOM
:
1788 if (init_addr
!= NULL
&& PF_AZERO(init_addr
, af
)) {
1792 rpool
->counter
.addr32
[0] = karc4random();
1797 if (rmask
->addr32
[3] != 0xffffffff)
1798 rpool
->counter
.addr32
[3] = karc4random();
1801 if (rmask
->addr32
[2] != 0xffffffff)
1802 rpool
->counter
.addr32
[2] = karc4random();
1805 if (rmask
->addr32
[1] != 0xffffffff)
1806 rpool
->counter
.addr32
[1] = karc4random();
1809 if (rmask
->addr32
[0] != 0xffffffff)
1810 rpool
->counter
.addr32
[0] = karc4random();
1814 PF_POOLMASK(naddr
, raddr
, rmask
, &rpool
->counter
, af
);
1815 PF_ACPY(init_addr
, naddr
, af
);
1818 PF_AINC(&rpool
->counter
, af
);
1819 PF_POOLMASK(naddr
, raddr
, rmask
, &rpool
->counter
, af
);
1822 case PF_POOL_SRCHASH
:
1823 pf_hash(saddr
, (struct pf_addr
*)&hash
, &rpool
->key
, af
);
1824 PF_POOLMASK(naddr
, raddr
, rmask
, (struct pf_addr
*)&hash
, af
);
1826 case PF_POOL_ROUNDROBIN
:
1827 if (rpool
->cur
->addr
.type
== PF_ADDR_TABLE
) {
1828 if (!pfr_pool_get(rpool
->cur
->addr
.p
.tbl
,
1829 &rpool
->tblidx
, &rpool
->counter
,
1830 &raddr
, &rmask
, af
))
1832 } else if (rpool
->cur
->addr
.type
== PF_ADDR_DYNIFTL
) {
1833 if (!pfr_pool_get(rpool
->cur
->addr
.p
.dyn
->pfid_kt
,
1834 &rpool
->tblidx
, &rpool
->counter
,
1835 &raddr
, &rmask
, af
))
1837 } else if (pf_match_addr(0, raddr
, rmask
, &rpool
->counter
, af
))
1841 if ((rpool
->cur
= TAILQ_NEXT(rpool
->cur
, entries
)) == NULL
)
1842 rpool
->cur
= TAILQ_FIRST(&rpool
->list
);
1843 if (rpool
->cur
->addr
.type
== PF_ADDR_TABLE
) {
1845 if (pfr_pool_get(rpool
->cur
->addr
.p
.tbl
,
1846 &rpool
->tblidx
, &rpool
->counter
,
1847 &raddr
, &rmask
, af
)) {
1848 /* table contains no address of type 'af' */
1849 if (rpool
->cur
!= acur
)
1853 } else if (rpool
->cur
->addr
.type
== PF_ADDR_DYNIFTL
) {
1855 if (pfr_pool_get(rpool
->cur
->addr
.p
.dyn
->pfid_kt
,
1856 &rpool
->tblidx
, &rpool
->counter
,
1857 &raddr
, &rmask
, af
)) {
1858 /* table contains no address of type 'af' */
1859 if (rpool
->cur
!= acur
)
1864 raddr
= &rpool
->cur
->addr
.v
.a
.addr
;
1865 rmask
= &rpool
->cur
->addr
.v
.a
.mask
;
1866 PF_ACPY(&rpool
->counter
, raddr
, af
);
1870 PF_ACPY(naddr
, &rpool
->counter
, af
);
1871 PF_AINC(&rpool
->counter
, af
);
1875 PF_ACPY(&(*sn
)->raddr
, naddr
, af
);
1877 if (pf_status
.debug
>= PF_DEBUG_MISC
&&
1878 (rpool
->opts
& PF_POOL_TYPEMASK
) != PF_POOL_NONE
) {
1879 kprintf("pf_map_addr: selected address ");
1880 pf_print_host(naddr
, 0, af
);
1888 pf_get_sport(sa_family_t af
, u_int8_t proto
, struct pf_rule
*r
,
1889 struct pf_addr
*saddr
, struct pf_addr
*daddr
, u_int16_t dport
,
1890 struct pf_addr
*naddr
, u_int16_t
*nport
, u_int16_t low
, u_int16_t high
,
1891 struct pf_src_node
**sn
)
1893 struct pf_state key
;
1894 struct pf_addr init_addr
;
1897 bzero(&init_addr
, sizeof(init_addr
));
1898 if (pf_map_addr(af
, r
, saddr
, naddr
, &init_addr
, sn
))
1904 PF_ACPY(&key
.ext
.addr
, daddr
, key
.af
);
1905 PF_ACPY(&key
.gwy
.addr
, naddr
, key
.af
);
1906 key
.ext
.port
= dport
;
1909 * port search; start random, step;
1910 * similar 2 portloop in in_pcbbind
1912 if (!(proto
== IPPROTO_TCP
|| proto
== IPPROTO_UDP
)) {
1914 if (pf_find_state_all(&key
, PF_EXT_GWY
, NULL
) == NULL
)
1916 } else if (low
== 0 && high
== 0) {
1917 key
.gwy
.port
= *nport
;
1918 if (pf_find_state_all(&key
, PF_EXT_GWY
, NULL
) == NULL
)
1920 } else if (low
== high
) {
1921 key
.gwy
.port
= htons(low
);
1922 if (pf_find_state_all(&key
, PF_EXT_GWY
, NULL
) == NULL
) {
1923 *nport
= htons(low
);
1935 cut
= karc4random() % (1 + high
- low
) + low
;
1936 /* low <= cut <= high */
1937 for (tmp
= cut
; tmp
<= high
; ++(tmp
)) {
1938 key
.gwy
.port
= htons(tmp
);
1939 if (pf_find_state_all(&key
, PF_EXT_GWY
, NULL
) ==
1941 *nport
= htons(tmp
);
1945 for (tmp
= cut
- 1; tmp
>= low
; --(tmp
)) {
1946 key
.gwy
.port
= htons(tmp
);
1947 if (pf_find_state_all(&key
, PF_EXT_GWY
, NULL
) ==
1949 *nport
= htons(tmp
);
1955 switch (r
->rpool
.opts
& PF_POOL_TYPEMASK
) {
1956 case PF_POOL_RANDOM
:
1957 case PF_POOL_ROUNDROBIN
:
1958 if (pf_map_addr(af
, r
, saddr
, naddr
, &init_addr
, sn
))
1962 case PF_POOL_SRCHASH
:
1963 case PF_POOL_BITMASK
:
1967 } while (! PF_AEQ(&init_addr
, naddr
, af
) );
1969 return (1); /* none available */
1973 pf_match_translation(struct pf_pdesc
*pd
, struct mbuf
*m
, int off
,
1974 int direction
, struct pfi_kif
*kif
, struct pf_addr
*saddr
, u_int16_t sport
,
1975 struct pf_addr
*daddr
, u_int16_t dport
, int rs_num
)
1977 struct pf_rule
*r
, *rm
= NULL
, *anchorrule
= NULL
;
1978 struct pf_ruleset
*ruleset
= NULL
;
1980 r
= TAILQ_FIRST(pf_main_ruleset
.rules
[rs_num
].active
.ptr
);
1981 while (r
&& rm
== NULL
) {
1982 struct pf_rule_addr
*src
= NULL
, *dst
= NULL
;
1983 struct pf_addr_wrap
*xdst
= NULL
;
1985 if (r
->action
== PF_BINAT
&& direction
== PF_IN
) {
1987 if (r
->rpool
.cur
!= NULL
)
1988 xdst
= &r
->rpool
.cur
->addr
;
1995 if (r
->kif
!= NULL
&&
1996 (r
->kif
!= kif
&& r
->kif
!= kif
->pfik_parent
) == !r
->ifnot
)
1997 r
= r
->skip
[PF_SKIP_IFP
].ptr
;
1998 else if (r
->direction
&& r
->direction
!= direction
)
1999 r
= r
->skip
[PF_SKIP_DIR
].ptr
;
2000 else if (r
->af
&& r
->af
!= pd
->af
)
2001 r
= r
->skip
[PF_SKIP_AF
].ptr
;
2002 else if (r
->proto
&& r
->proto
!= pd
->proto
)
2003 r
= r
->skip
[PF_SKIP_PROTO
].ptr
;
2004 else if (PF_MISMATCHAW(&src
->addr
, saddr
, pd
->af
, src
->not))
2005 r
= r
->skip
[src
== &r
->src
? PF_SKIP_SRC_ADDR
:
2006 PF_SKIP_DST_ADDR
].ptr
;
2007 else if (src
->port_op
&& !pf_match_port(src
->port_op
,
2008 src
->port
[0], src
->port
[1], sport
))
2009 r
= r
->skip
[src
== &r
->src
? PF_SKIP_SRC_PORT
:
2010 PF_SKIP_DST_PORT
].ptr
;
2011 else if (dst
!= NULL
&&
2012 PF_MISMATCHAW(&dst
->addr
, daddr
, pd
->af
, dst
->not))
2013 r
= r
->skip
[PF_SKIP_DST_ADDR
].ptr
;
2014 else if (xdst
!= NULL
&& PF_MISMATCHAW(xdst
, daddr
, pd
->af
, 0))
2015 r
= TAILQ_NEXT(r
, entries
);
2016 else if (dst
!= NULL
&& dst
->port_op
&&
2017 !pf_match_port(dst
->port_op
, dst
->port
[0],
2018 dst
->port
[1], dport
))
2019 r
= r
->skip
[PF_SKIP_DST_PORT
].ptr
;
2020 else if (r
->os_fingerprint
!= PF_OSFP_ANY
&& (pd
->proto
!=
2021 IPPROTO_TCP
|| !pf_osfp_match(pf_osfp_fingerprint(pd
, m
,
2022 off
, pd
->hdr
.tcp
), r
->os_fingerprint
)))
2023 r
= TAILQ_NEXT(r
, entries
);
2024 else if (r
->anchorname
[0] && r
->anchor
== NULL
)
2025 r
= TAILQ_NEXT(r
, entries
);
2026 else if (r
->anchor
== NULL
)
2029 PF_STEP_INTO_ANCHOR(r
, anchorrule
, ruleset
, rs_num
);
2030 if (r
== NULL
&& anchorrule
!= NULL
)
2031 PF_STEP_OUT_OF_ANCHOR(r
, anchorrule
, ruleset
,
2034 if (rm
!= NULL
&& (rm
->action
== PF_NONAT
||
2035 rm
->action
== PF_NORDR
|| rm
->action
== PF_NOBINAT
))
2041 pf_get_translation(struct pf_pdesc
*pd
, struct mbuf
*m
, int off
, int direction
,
2042 struct pfi_kif
*kif
, struct pf_src_node
**sn
,
2043 struct pf_addr
*saddr
, u_int16_t sport
,
2044 struct pf_addr
*daddr
, u_int16_t dport
,
2045 struct pf_addr
*naddr
, u_int16_t
*nport
)
2047 struct pf_rule
*r
= NULL
;
2049 if (direction
== PF_OUT
) {
2050 r
= pf_match_translation(pd
, m
, off
, direction
, kif
, saddr
,
2051 sport
, daddr
, dport
, PF_RULESET_BINAT
);
2053 r
= pf_match_translation(pd
, m
, off
, direction
, kif
,
2054 saddr
, sport
, daddr
, dport
, PF_RULESET_NAT
);
2056 r
= pf_match_translation(pd
, m
, off
, direction
, kif
, saddr
,
2057 sport
, daddr
, dport
, PF_RULESET_RDR
);
2059 r
= pf_match_translation(pd
, m
, off
, direction
, kif
,
2060 saddr
, sport
, daddr
, dport
, PF_RULESET_BINAT
);
2064 switch (r
->action
) {
2070 if (pf_get_sport(pd
->af
, pd
->proto
, r
, saddr
,
2071 daddr
, dport
, naddr
, nport
, r
->rpool
.proxy_port
[0],
2072 r
->rpool
.proxy_port
[1], sn
)) {
2073 DPFPRINTF(PF_DEBUG_MISC
,
2074 ("pf: NAT proxy port allocation "
2076 r
->rpool
.proxy_port
[0],
2077 r
->rpool
.proxy_port
[1]));
2082 switch (direction
) {
2084 if (r
->rpool
.cur
->addr
.type
== PF_ADDR_DYNIFTL
){
2085 if (pd
->af
== AF_INET
) {
2086 if (r
->rpool
.cur
->addr
.p
.dyn
->
2090 &r
->rpool
.cur
->addr
.p
.dyn
->
2092 &r
->rpool
.cur
->addr
.p
.dyn
->
2096 if (r
->rpool
.cur
->addr
.p
.dyn
->
2100 &r
->rpool
.cur
->addr
.p
.dyn
->
2102 &r
->rpool
.cur
->addr
.p
.dyn
->
2108 &r
->rpool
.cur
->addr
.v
.a
.addr
,
2109 &r
->rpool
.cur
->addr
.v
.a
.mask
,
2113 if (r
->src
.addr
.type
== PF_ADDR_DYNIFTL
){
2114 if (pd
->af
== AF_INET
) {
2115 if (r
->src
.addr
.p
.dyn
->
2119 &r
->src
.addr
.p
.dyn
->
2121 &r
->src
.addr
.p
.dyn
->
2125 if (r
->src
.addr
.p
.dyn
->
2129 &r
->src
.addr
.p
.dyn
->
2131 &r
->src
.addr
.p
.dyn
->
2137 &r
->src
.addr
.v
.a
.addr
,
2138 &r
->src
.addr
.v
.a
.mask
, daddr
,
2144 if (pf_map_addr(r
->af
, r
, saddr
, naddr
, NULL
, sn
))
2147 if (r
->rpool
.proxy_port
[1]) {
2148 u_int32_t tmp_nport
;
2150 tmp_nport
= ((ntohs(dport
) -
2151 ntohs(r
->dst
.port
[0])) %
2152 (r
->rpool
.proxy_port
[1] -
2153 r
->rpool
.proxy_port
[0] + 1)) +
2154 r
->rpool
.proxy_port
[0];
2156 /* wrap around if necessary */
2157 if (tmp_nport
> 65535)
2159 *nport
= htons((u_int16_t
)tmp_nport
);
2160 } else if (r
->rpool
.proxy_port
[0])
2161 *nport
= htons(r
->rpool
.proxy_port
[0]);
2173 struct netmsg_hashlookup
{
2174 struct netmsg nm_netmsg
;
2175 struct inpcb
**nm_pinp
;
2176 struct inpcbinfo
*nm_pcbinfo
;
2177 struct pf_addr
*nm_saddr
;
2178 struct pf_addr
*nm_daddr
;
2185 in_pcblookup_hash_handler(struct netmsg
*msg0
)
2187 struct netmsg_hashlookup
*msg
= (struct netmsg_hashlookup
*)msg0
;
2189 if (msg
->nm_af
== AF_INET
)
2190 *msg
->nm_pinp
= in_pcblookup_hash(msg
->nm_pcbinfo
,
2191 msg
->nm_saddr
->v4
, msg
->nm_sport
, msg
->nm_daddr
->v4
,
2192 msg
->nm_dport
, INPLOOKUP_WILDCARD
, NULL
);
2195 *msg
->nm_pinp
= in6_pcblookup_hash(msg
->nm_pcbinfo
,
2196 &msg
->nm_saddr
->v6
, msg
->nm_sport
, &msg
->nm_daddr
->v6
,
2197 msg
->nm_dport
, INPLOOKUP_WILDCARD
, NULL
);
2199 lwkt_replymsg(&msg
->nm_netmsg
.nm_lmsg
, 0);
2204 pf_socket_lookup(uid_t
*uid
, gid_t
*gid
, int direction
, struct pf_pdesc
*pd
)
2206 struct pf_addr
*saddr
, *daddr
;
2207 u_int16_t sport
, dport
;
2208 struct inpcbinfo
*pi
;
2211 struct netmsg_hashlookup
*msg
= NULL
;
2217 if (direction
== PF_IN
) {
2224 switch (pd
->proto
) {
2226 sport
= pd
->hdr
.tcp
->th_sport
;
2227 dport
= pd
->hdr
.tcp
->th_dport
;
2229 pi_cpu
= tcp_addrcpu(saddr
->v4
.s_addr
, sport
, daddr
->v4
.s_addr
, dport
);
2230 pi
= &tcbinfo
[pi_cpu
];
2233 * Our netstack runs lockless on MP systems
2234 * (only for TCP connections at the moment).
2236 * As we are not allowed to read another CPU's tcbinfo,
2237 * we have to ask that CPU via remote call to search the
2240 * Prepare a msg iff data belongs to another CPU.
2242 if (pi_cpu
!= mycpu
->gd_cpuid
) {
2243 msg
= kmalloc(sizeof(*msg
), M_LWKTMSG
, M_INTWAIT
);
2244 netmsg_init(&msg
->nm_netmsg
, &netisr_afree_rport
, 0,
2245 in_pcblookup_hash_handler
);
2246 msg
->nm_pinp
= &inp
;
2247 msg
->nm_pcbinfo
= pi
;
2248 msg
->nm_saddr
= saddr
;
2249 msg
->nm_sport
= sport
;
2250 msg
->nm_daddr
= daddr
;
2251 msg
->nm_dport
= dport
;
2252 msg
->nm_af
= pd
->af
;
2257 sport
= pd
->hdr
.udp
->uh_sport
;
2258 dport
= pd
->hdr
.udp
->uh_dport
;
2264 if (direction
!= PF_IN
) {
2276 * Query other CPU, second part
2278 * msg only gets initialized when:
2280 * 2) the info belongs to another CPU
2282 * Use some switch/case magic to avoid code duplication.
2287 inp
= in6_pcblookup_hash(pi
, &saddr
->v6
, sport
,
2288 &daddr
->v6
, dport
, INPLOOKUP_WILDCARD
, NULL
);
2294 /* FALLTHROUGH if SMP and on other CPU */
2299 lwkt_sendmsg(tcp_cport(pi_cpu
),
2300 &msg
->nm_netmsg
.nm_lmsg
);
2304 inp
= in_pcblookup_hash(pi
, saddr
->v4
, sport
, daddr
->v4
,
2305 dport
, INPLOOKUP_WILDCARD
, NULL
);
2314 *uid
= inp
->inp_socket
->so_cred
->cr_uid
;
2315 *gid
= inp
->inp_socket
->so_cred
->cr_groups
[0];
2320 pf_get_wscale(struct mbuf
*m
, int off
, u_int16_t th_off
, sa_family_t af
)
2324 u_int8_t
*opt
, optlen
;
2325 u_int8_t wscale
= 0;
2327 hlen
= th_off
<< 2; /* hlen <= sizeof(hdr) */
2328 if (hlen
<= sizeof(struct tcphdr
))
2330 if (!pf_pull_hdr(m
, off
, hdr
, hlen
, NULL
, NULL
, af
))
2332 opt
= hdr
+ sizeof(struct tcphdr
);
2333 hlen
-= sizeof(struct tcphdr
);
2343 if (wscale
> TCP_MAX_WINSHIFT
)
2344 wscale
= TCP_MAX_WINSHIFT
;
2345 wscale
|= PF_WSCALE_FLAG
;
2360 pf_get_mss(struct mbuf
*m
, int off
, u_int16_t th_off
, sa_family_t af
)
2364 u_int8_t
*opt
, optlen
;
2365 u_int16_t mss
= tcp_mssdflt
;
2367 hlen
= th_off
<< 2; /* hlen <= sizeof(hdr) */
2368 if (hlen
<= sizeof(struct tcphdr
))
2370 if (!pf_pull_hdr(m
, off
, hdr
, hlen
, NULL
, NULL
, af
))
2372 opt
= hdr
+ sizeof(struct tcphdr
);
2373 hlen
-= sizeof(struct tcphdr
);
2374 while (hlen
>= TCPOLEN_MAXSEG
) {
2382 bcopy((caddr_t
)(opt
+ 2), (caddr_t
)&mss
, 2);
2397 pf_calc_mss(struct pf_addr
*addr
, sa_family_t af
, u_int16_t offer
)
2400 struct sockaddr_in
*dst
;
2404 struct sockaddr_in6
*dst6
;
2405 struct route_in6 ro6
;
2407 struct rtentry
*rt
= NULL
;
2409 u_int16_t mss
= tcp_mssdflt
;
2414 hlen
= sizeof(struct ip
);
2415 bzero(&ro
, sizeof(ro
));
2416 dst
= (struct sockaddr_in
*)&ro
.ro_dst
;
2417 dst
->sin_family
= AF_INET
;
2418 dst
->sin_len
= sizeof(*dst
);
2419 dst
->sin_addr
= addr
->v4
;
2420 rtalloc_ign(&ro
, (RTF_CLONING
| RTF_PRCLONING
));
2426 hlen
= sizeof(struct ip6_hdr
);
2427 bzero(&ro6
, sizeof(ro6
));
2428 dst6
= (struct sockaddr_in6
*)&ro6
.ro_dst
;
2429 dst6
->sin6_family
= AF_INET6
;
2430 dst6
->sin6_len
= sizeof(*dst6
);
2431 dst6
->sin6_addr
= addr
->v6
;
2432 rtalloc_ign((struct route
*)&ro6
, (RTF_CLONING
| RTF_PRCLONING
));
2438 if (rt
&& rt
->rt_ifp
) {
2439 mss
= rt
->rt_ifp
->if_mtu
- hlen
- sizeof(struct tcphdr
);
2440 mss
= max(tcp_mssdflt
, mss
);
2443 mss
= min(mss
, offer
);
2444 mss
= max(mss
, 64); /* sanity - at least max opt space */
2449 pf_set_rt_ifp(struct pf_state
*s
, struct pf_addr
*saddr
)
2451 struct pf_rule
*r
= s
->rule
.ptr
;
2454 if (!r
->rt
|| r
->rt
== PF_FASTROUTE
)
2459 pf_map_addr(AF_INET
, r
, saddr
, &s
->rt_addr
, NULL
,
2461 s
->rt_kif
= r
->rpool
.cur
->kif
;
2466 pf_map_addr(AF_INET6
, r
, saddr
, &s
->rt_addr
, NULL
,
2468 s
->rt_kif
= r
->rpool
.cur
->kif
;
2475 pf_test_tcp(struct pf_rule
**rm
, struct pf_state
**sm
, int direction
,
2476 struct pfi_kif
*kif
, struct mbuf
*m
, int off
, void *h
,
2477 struct pf_pdesc
*pd
, struct pf_rule
**am
, struct pf_ruleset
**rsm
)
2479 struct pf_rule
*nr
= NULL
;
2480 struct pf_addr
*saddr
= pd
->src
, *daddr
= pd
->dst
;
2481 struct tcphdr
*th
= pd
->hdr
.tcp
;
2482 u_int16_t bport
, nport
= 0;
2483 sa_family_t af
= pd
->af
;
2487 struct pf_rule
*r
, *a
= NULL
;
2488 struct pf_ruleset
*ruleset
= NULL
;
2489 struct pf_src_node
*nsn
= NULL
;
2494 r
= TAILQ_FIRST(pf_main_ruleset
.rules
[PF_RULESET_FILTER
].active
.ptr
);
2496 if (direction
== PF_OUT
) {
2497 bport
= nport
= th
->th_sport
;
2498 /* check outgoing packet for BINAT/NAT */
2499 if ((nr
= pf_get_translation(pd
, m
, off
, PF_OUT
, kif
, &nsn
,
2500 saddr
, th
->th_sport
, daddr
, th
->th_dport
,
2501 &pd
->naddr
, &nport
)) != NULL
) {
2502 PF_ACPY(&pd
->baddr
, saddr
, af
);
2503 pf_change_ap(saddr
, &th
->th_sport
, pd
->ip_sum
,
2504 &th
->th_sum
, &pd
->naddr
, nport
, 0, af
);
2511 bport
= nport
= th
->th_dport
;
2512 /* check incoming packet for BINAT/RDR */
2513 if ((nr
= pf_get_translation(pd
, m
, off
, PF_IN
, kif
, &nsn
,
2514 saddr
, th
->th_sport
, daddr
, th
->th_dport
,
2515 &pd
->naddr
, &nport
)) != NULL
) {
2516 PF_ACPY(&pd
->baddr
, daddr
, af
);
2517 pf_change_ap(daddr
, &th
->th_dport
, pd
->ip_sum
,
2518 &th
->th_sum
, &pd
->naddr
, nport
, 0, af
);
2528 if (r
->kif
!= NULL
&&
2529 (r
->kif
!= kif
&& r
->kif
!= kif
->pfik_parent
) == !r
->ifnot
)
2530 r
= r
->skip
[PF_SKIP_IFP
].ptr
;
2531 else if (r
->direction
&& r
->direction
!= direction
)
2532 r
= r
->skip
[PF_SKIP_DIR
].ptr
;
2533 else if (r
->af
&& r
->af
!= af
)
2534 r
= r
->skip
[PF_SKIP_AF
].ptr
;
2535 else if (r
->proto
&& r
->proto
!= IPPROTO_TCP
)
2536 r
= r
->skip
[PF_SKIP_PROTO
].ptr
;
2537 else if (PF_MISMATCHAW(&r
->src
.addr
, saddr
, af
, r
->src
.not))
2538 r
= r
->skip
[PF_SKIP_SRC_ADDR
].ptr
;
2539 else if (r
->src
.port_op
&& !pf_match_port(r
->src
.port_op
,
2540 r
->src
.port
[0], r
->src
.port
[1], th
->th_sport
))
2541 r
= r
->skip
[PF_SKIP_SRC_PORT
].ptr
;
2542 else if (PF_MISMATCHAW(&r
->dst
.addr
, daddr
, af
, r
->dst
.not))
2543 r
= r
->skip
[PF_SKIP_DST_ADDR
].ptr
;
2544 else if (r
->dst
.port_op
&& !pf_match_port(r
->dst
.port_op
,
2545 r
->dst
.port
[0], r
->dst
.port
[1], th
->th_dport
))
2546 r
= r
->skip
[PF_SKIP_DST_PORT
].ptr
;
2547 else if (r
->tos
&& !(r
->tos
& pd
->tos
))
2548 r
= TAILQ_NEXT(r
, entries
);
2549 else if (r
->rule_flag
& PFRULE_FRAGMENT
)
2550 r
= TAILQ_NEXT(r
, entries
);
2551 else if ((r
->flagset
& th
->th_flags
) != r
->flags
)
2552 r
= TAILQ_NEXT(r
, entries
);
2553 else if (r
->uid
.op
&& (lookup
!= -1 || (lookup
=
2554 pf_socket_lookup(&uid
, &gid
, direction
, pd
), 1)) &&
2555 !pf_match_uid(r
->uid
.op
, r
->uid
.uid
[0], r
->uid
.uid
[1],
2557 r
= TAILQ_NEXT(r
, entries
);
2558 else if (r
->gid
.op
&& (lookup
!= -1 || (lookup
=
2559 pf_socket_lookup(&uid
, &gid
, direction
, pd
), 1)) &&
2560 !pf_match_gid(r
->gid
.op
, r
->gid
.gid
[0], r
->gid
.gid
[1],
2562 r
= TAILQ_NEXT(r
, entries
);
2563 else if (r
->prob
&& r
->prob
<= karc4random())
2564 r
= TAILQ_NEXT(r
, entries
);
2565 else if (r
->match_tag
&& !pf_match_tag(m
, r
, nr
, &tag
))
2566 r
= TAILQ_NEXT(r
, entries
);
2567 else if (r
->anchorname
[0] && r
->anchor
== NULL
)
2568 r
= TAILQ_NEXT(r
, entries
);
2569 else if (r
->os_fingerprint
!= PF_OSFP_ANY
&& !pf_osfp_match(
2570 pf_osfp_fingerprint(pd
, m
, off
, th
), r
->os_fingerprint
))
2571 r
= TAILQ_NEXT(r
, entries
);
2575 if (r
->anchor
== NULL
) {
2581 r
= TAILQ_NEXT(r
, entries
);
2583 PF_STEP_INTO_ANCHOR(r
, a
, ruleset
,
2586 if (r
== NULL
&& a
!= NULL
)
2587 PF_STEP_OUT_OF_ANCHOR(r
, a
, ruleset
,
2594 REASON_SET(&reason
, PFRES_MATCH
);
2598 m_copyback(m
, off
, sizeof(*th
), (caddr_t
)th
);
2599 PFLOG_PACKET(kif
, h
, m
, af
, direction
, reason
, r
, a
, ruleset
);
2602 if ((r
->action
== PF_DROP
) &&
2603 ((r
->rule_flag
& PFRULE_RETURNRST
) ||
2604 (r
->rule_flag
& PFRULE_RETURNICMP
) ||
2605 (r
->rule_flag
& PFRULE_RETURN
))) {
2606 /* undo NAT changes, if they have taken place */
2608 if (direction
== PF_OUT
) {
2609 pf_change_ap(saddr
, &th
->th_sport
, pd
->ip_sum
,
2610 &th
->th_sum
, &pd
->baddr
, bport
, 0, af
);
2613 pf_change_ap(daddr
, &th
->th_dport
, pd
->ip_sum
,
2614 &th
->th_sum
, &pd
->baddr
, bport
, 0, af
);
2618 if (((r
->rule_flag
& PFRULE_RETURNRST
) ||
2619 (r
->rule_flag
& PFRULE_RETURN
)) &&
2620 !(th
->th_flags
& TH_RST
)) {
2621 u_int32_t ack
= ntohl(th
->th_seq
) + pd
->p_len
;
2623 if (th
->th_flags
& TH_SYN
)
2625 if (th
->th_flags
& TH_FIN
)
2627 pf_send_tcp(r
, af
, pd
->dst
,
2628 pd
->src
, th
->th_dport
, th
->th_sport
,
2629 ntohl(th
->th_ack
), ack
, TH_RST
|TH_ACK
, 0, 0,
2631 } else if ((af
== AF_INET
) && r
->return_icmp
)
2632 pf_send_icmp(m
, r
->return_icmp
>> 8,
2633 r
->return_icmp
& 255, af
, r
);
2634 else if ((af
== AF_INET6
) && r
->return_icmp6
)
2635 pf_send_icmp(m
, r
->return_icmp6
>> 8,
2636 r
->return_icmp6
& 255, af
, r
);
2639 if (r
->action
== PF_DROP
)
2642 pf_tag_packet(m
, tag
);
2644 if (r
->keep_state
|| nr
!= NULL
||
2645 (pd
->flags
& PFDESC_TCP_NORM
)) {
2646 /* create new state */
2648 struct pf_state
*s
= NULL
;
2649 struct pf_src_node
*sn
= NULL
;
2651 len
= pd
->tot_len
- off
- (th
->th_off
<< 2);
2653 /* check maximums */
2654 if (r
->max_states
&& (r
->states
>= r
->max_states
))
2656 /* src node for flter rule */
2657 if ((r
->rule_flag
& PFRULE_SRCTRACK
||
2658 r
->rpool
.opts
& PF_POOL_STICKYADDR
) &&
2659 pf_insert_src_node(&sn
, r
, saddr
, af
) != 0)
2661 /* src node for translation rule */
2662 if (nr
!= NULL
&& (nr
->rpool
.opts
& PF_POOL_STICKYADDR
) &&
2663 ((direction
== PF_OUT
&&
2664 pf_insert_src_node(&nsn
, nr
, &pd
->baddr
, af
) != 0) ||
2665 (pf_insert_src_node(&nsn
, nr
, saddr
, af
) != 0)))
2667 s
= pool_get(&pf_state_pl
, PR_NOWAIT
);
2670 if (sn
!= NULL
&& sn
->states
== 0 && sn
->expire
== 0) {
2671 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, sn
);
2672 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
2673 pf_status
.src_nodes
--;
2674 pool_put(&pf_src_tree_pl
, sn
);
2676 if (nsn
!= sn
&& nsn
!= NULL
&& nsn
->states
== 0 &&
2678 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, nsn
);
2679 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
2680 pf_status
.src_nodes
--;
2681 pool_put(&pf_src_tree_pl
, nsn
);
2683 REASON_SET(&reason
, PFRES_MEMORY
);
2686 bzero(s
, sizeof(*s
));
2691 s
->nat_rule
.ptr
= nr
;
2692 if (s
->nat_rule
.ptr
!= NULL
)
2693 s
->nat_rule
.ptr
->states
++;
2695 s
->allow_opts
= r
->allow_opts
;
2696 s
->log
= r
->log
& 2;
2697 s
->proto
= IPPROTO_TCP
;
2698 s
->direction
= direction
;
2700 if (direction
== PF_OUT
) {
2701 PF_ACPY(&s
->gwy
.addr
, saddr
, af
);
2702 s
->gwy
.port
= th
->th_sport
; /* sport */
2703 PF_ACPY(&s
->ext
.addr
, daddr
, af
);
2704 s
->ext
.port
= th
->th_dport
;
2706 PF_ACPY(&s
->lan
.addr
, &pd
->baddr
, af
);
2707 s
->lan
.port
= bport
;
2709 PF_ACPY(&s
->lan
.addr
, &s
->gwy
.addr
, af
);
2710 s
->lan
.port
= s
->gwy
.port
;
2713 PF_ACPY(&s
->lan
.addr
, daddr
, af
);
2714 s
->lan
.port
= th
->th_dport
;
2715 PF_ACPY(&s
->ext
.addr
, saddr
, af
);
2716 s
->ext
.port
= th
->th_sport
;
2718 PF_ACPY(&s
->gwy
.addr
, &pd
->baddr
, af
);
2719 s
->gwy
.port
= bport
;
2721 PF_ACPY(&s
->gwy
.addr
, &s
->lan
.addr
, af
);
2722 s
->gwy
.port
= s
->lan
.port
;
2726 s
->hash
= pf_state_hash(s
);
2727 s
->src
.seqlo
= ntohl(th
->th_seq
);
2728 s
->src
.seqhi
= s
->src
.seqlo
+ len
+ 1;
2729 s
->pickup_mode
= r
->pickup_mode
;
2731 if ((th
->th_flags
& (TH_SYN
|TH_ACK
)) == TH_SYN
&&
2732 r
->keep_state
== PF_STATE_MODULATE
) {
2733 /* Generate sequence number modulator */
2734 while ((s
->src
.seqdiff
= karc4random()) == 0)
2736 pf_change_a(&th
->th_seq
, &th
->th_sum
,
2737 htonl(s
->src
.seqlo
+ s
->src
.seqdiff
), 0);
2743 * WARNING! NetBSD patched this to not scale max_win up
2744 * on the initial SYN, but they failed to correct the code
2745 * in pf_test_state_tcp() that 'undid' the scaling, and they
2746 * failed to remove the scale factor on successful window
2747 * scale negotiation (and doing so would be difficult in the
2748 * face of retransmission, without adding more flags to the
2751 * After discussions with Daniel Hartmeier and Max Laier
2752 * I've decided not to apply the NetBSD patch.
2754 * The worst that happens is that the undo code on window
2755 * scale negotiation failures will produce a larger
2756 * max_win then actual.
2758 if (th
->th_flags
& TH_SYN
) {
2760 s
->src
.wscale
= pf_get_wscale(m
, off
, th
->th_off
, af
);
2761 s
->sync_flags
|= PFSTATE_GOT_SYN1
;
2763 s
->src
.max_win
= MAX(ntohs(th
->th_win
), 1);
2764 if (s
->src
.wscale
& PF_WSCALE_MASK
) {
2765 /* Remove scale factor from initial window */
2766 u_int win
= s
->src
.max_win
;
2767 win
+= 1 << (s
->src
.wscale
& PF_WSCALE_MASK
);
2768 s
->src
.max_win
= (win
- 1) >>
2769 (s
->src
.wscale
& PF_WSCALE_MASK
);
2771 if (th
->th_flags
& TH_FIN
)
2775 s
->src
.state
= TCPS_SYN_SENT
;
2776 s
->dst
.state
= TCPS_CLOSED
;
2777 s
->creation
= time_second
;
2778 s
->expire
= time_second
;
2779 s
->timeout
= PFTM_TCP_FIRST_PACKET
;
2780 pf_set_rt_ifp(s
, saddr
);
2783 s
->src_node
->states
++;
2786 PF_ACPY(&nsn
->raddr
, &pd
->naddr
, af
);
2787 s
->nat_src_node
= nsn
;
2788 s
->nat_src_node
->states
++;
2790 if ((pd
->flags
& PFDESC_TCP_NORM
) && pf_normalize_tcp_init(m
,
2791 off
, pd
, th
, &s
->src
, &s
->dst
)) {
2792 REASON_SET(&reason
, PFRES_MEMORY
);
2793 pf_src_tree_remove_state(s
);
2794 pool_put(&pf_state_pl
, s
);
2797 if ((pd
->flags
& PFDESC_TCP_NORM
) && s
->src
.scrub
&&
2798 pf_normalize_tcp_stateful(m
, off
, pd
, &reason
, th
, &s
->src
,
2799 &s
->dst
, &rewrite
)) {
2800 pf_normalize_tcp_cleanup(s
);
2801 pf_src_tree_remove_state(s
);
2802 pool_put(&pf_state_pl
, s
);
2805 if (pf_insert_state(BOUND_IFACE(r
, kif
), s
)) {
2806 pf_normalize_tcp_cleanup(s
);
2807 REASON_SET(&reason
, PFRES_MEMORY
);
2808 pf_src_tree_remove_state(s
);
2809 pool_put(&pf_state_pl
, s
);
2813 if ((th
->th_flags
& (TH_SYN
|TH_ACK
)) == TH_SYN
&&
2814 r
->keep_state
== PF_STATE_SYNPROXY
) {
2817 s
->src
.state
= PF_TCPS_PROXY_SRC
;
2819 if (direction
== PF_OUT
) {
2820 pf_change_ap(saddr
, &th
->th_sport
,
2821 pd
->ip_sum
, &th
->th_sum
, &pd
->baddr
,
2824 pf_change_ap(daddr
, &th
->th_dport
,
2825 pd
->ip_sum
, &th
->th_sum
, &pd
->baddr
,
2829 s
->src
.seqhi
= karc4random();
2830 /* Find mss option */
2831 mss
= pf_get_mss(m
, off
, th
->th_off
, af
);
2832 mss
= pf_calc_mss(saddr
, af
, mss
);
2833 mss
= pf_calc_mss(daddr
, af
, mss
);
2835 pf_send_tcp(r
, af
, daddr
, saddr
, th
->th_dport
,
2836 th
->th_sport
, s
->src
.seqhi
, ntohl(th
->th_seq
) + 1,
2837 TH_SYN
|TH_ACK
, 0, s
->src
.mss
, 0);
2838 return (PF_SYNPROXY_DROP
);
2842 /* copy back packet headers if we performed NAT operations */
2844 m_copyback(m
, off
, sizeof(*th
), (caddr_t
)th
);
2850 pf_test_udp(struct pf_rule
**rm
, struct pf_state
**sm
, int direction
,
2851 struct pfi_kif
*kif
, struct mbuf
*m
, int off
, void *h
,
2852 struct pf_pdesc
*pd
, struct pf_rule
**am
, struct pf_ruleset
**rsm
)
2854 struct pf_rule
*nr
= NULL
;
2855 struct pf_addr
*saddr
= pd
->src
, *daddr
= pd
->dst
;
2856 struct udphdr
*uh
= pd
->hdr
.udp
;
2857 u_int16_t bport
, nport
= 0;
2858 sa_family_t af
= pd
->af
;
2862 struct pf_rule
*r
, *a
= NULL
;
2863 struct pf_ruleset
*ruleset
= NULL
;
2864 struct pf_src_node
*nsn
= NULL
;
2869 r
= TAILQ_FIRST(pf_main_ruleset
.rules
[PF_RULESET_FILTER
].active
.ptr
);
2871 if (direction
== PF_OUT
) {
2872 bport
= nport
= uh
->uh_sport
;
2873 /* check outgoing packet for BINAT/NAT */
2874 if ((nr
= pf_get_translation(pd
, m
, off
, PF_OUT
, kif
, &nsn
,
2875 saddr
, uh
->uh_sport
, daddr
, uh
->uh_dport
,
2876 &pd
->naddr
, &nport
)) != NULL
) {
2877 PF_ACPY(&pd
->baddr
, saddr
, af
);
2878 pf_change_ap(saddr
, &uh
->uh_sport
, pd
->ip_sum
,
2879 &uh
->uh_sum
, &pd
->naddr
, nport
, 1, af
);
2886 bport
= nport
= uh
->uh_dport
;
2887 /* check incoming packet for BINAT/RDR */
2888 if ((nr
= pf_get_translation(pd
, m
, off
, PF_IN
, kif
, &nsn
,
2889 saddr
, uh
->uh_sport
, daddr
, uh
->uh_dport
, &pd
->naddr
,
2891 PF_ACPY(&pd
->baddr
, daddr
, af
);
2892 pf_change_ap(daddr
, &uh
->uh_dport
, pd
->ip_sum
,
2893 &uh
->uh_sum
, &pd
->naddr
, nport
, 1, af
);
2903 if (r
->kif
!= NULL
&&
2904 (r
->kif
!= kif
&& r
->kif
!= kif
->pfik_parent
) == !r
->ifnot
)
2905 r
= r
->skip
[PF_SKIP_IFP
].ptr
;
2906 else if (r
->direction
&& r
->direction
!= direction
)
2907 r
= r
->skip
[PF_SKIP_DIR
].ptr
;
2908 else if (r
->af
&& r
->af
!= af
)
2909 r
= r
->skip
[PF_SKIP_AF
].ptr
;
2910 else if (r
->proto
&& r
->proto
!= IPPROTO_UDP
)
2911 r
= r
->skip
[PF_SKIP_PROTO
].ptr
;
2912 else if (PF_MISMATCHAW(&r
->src
.addr
, saddr
, af
, r
->src
.not))
2913 r
= r
->skip
[PF_SKIP_SRC_ADDR
].ptr
;
2914 else if (r
->src
.port_op
&& !pf_match_port(r
->src
.port_op
,
2915 r
->src
.port
[0], r
->src
.port
[1], uh
->uh_sport
))
2916 r
= r
->skip
[PF_SKIP_SRC_PORT
].ptr
;
2917 else if (PF_MISMATCHAW(&r
->dst
.addr
, daddr
, af
, r
->dst
.not))
2918 r
= r
->skip
[PF_SKIP_DST_ADDR
].ptr
;
2919 else if (r
->dst
.port_op
&& !pf_match_port(r
->dst
.port_op
,
2920 r
->dst
.port
[0], r
->dst
.port
[1], uh
->uh_dport
))
2921 r
= r
->skip
[PF_SKIP_DST_PORT
].ptr
;
2922 else if (r
->tos
&& !(r
->tos
& pd
->tos
))
2923 r
= TAILQ_NEXT(r
, entries
);
2924 else if (r
->rule_flag
& PFRULE_FRAGMENT
)
2925 r
= TAILQ_NEXT(r
, entries
);
2926 else if (r
->uid
.op
&& (lookup
!= -1 || (lookup
=
2927 pf_socket_lookup(&uid
, &gid
, direction
, pd
), 1)) &&
2928 !pf_match_uid(r
->uid
.op
, r
->uid
.uid
[0], r
->uid
.uid
[1],
2930 r
= TAILQ_NEXT(r
, entries
);
2931 else if (r
->gid
.op
&& (lookup
!= -1 || (lookup
=
2932 pf_socket_lookup(&uid
, &gid
, direction
, pd
), 1)) &&
2933 !pf_match_gid(r
->gid
.op
, r
->gid
.gid
[0], r
->gid
.gid
[1],
2935 r
= TAILQ_NEXT(r
, entries
);
2936 else if (r
->prob
&& r
->prob
<= karc4random())
2937 r
= TAILQ_NEXT(r
, entries
);
2938 else if (r
->match_tag
&& !pf_match_tag(m
, r
, nr
, &tag
))
2939 r
= TAILQ_NEXT(r
, entries
);
2940 else if (r
->anchorname
[0] && r
->anchor
== NULL
)
2941 r
= TAILQ_NEXT(r
, entries
);
2942 else if (r
->os_fingerprint
!= PF_OSFP_ANY
)
2943 r
= TAILQ_NEXT(r
, entries
);
2947 if (r
->anchor
== NULL
) {
2953 r
= TAILQ_NEXT(r
, entries
);
2955 PF_STEP_INTO_ANCHOR(r
, a
, ruleset
,
2958 if (r
== NULL
&& a
!= NULL
)
2959 PF_STEP_OUT_OF_ANCHOR(r
, a
, ruleset
,
2966 REASON_SET(&reason
, PFRES_MATCH
);
2970 m_copyback(m
, off
, sizeof(*uh
), (caddr_t
)uh
);
2971 PFLOG_PACKET(kif
, h
, m
, af
, direction
, reason
, r
, a
, ruleset
);
2974 if ((r
->action
== PF_DROP
) &&
2975 ((r
->rule_flag
& PFRULE_RETURNICMP
) ||
2976 (r
->rule_flag
& PFRULE_RETURN
))) {
2977 /* undo NAT changes, if they have taken place */
2979 if (direction
== PF_OUT
) {
2980 pf_change_ap(saddr
, &uh
->uh_sport
, pd
->ip_sum
,
2981 &uh
->uh_sum
, &pd
->baddr
, bport
, 1, af
);
2984 pf_change_ap(daddr
, &uh
->uh_dport
, pd
->ip_sum
,
2985 &uh
->uh_sum
, &pd
->baddr
, bport
, 1, af
);
2989 if ((af
== AF_INET
) && r
->return_icmp
)
2990 pf_send_icmp(m
, r
->return_icmp
>> 8,
2991 r
->return_icmp
& 255, af
, r
);
2992 else if ((af
== AF_INET6
) && r
->return_icmp6
)
2993 pf_send_icmp(m
, r
->return_icmp6
>> 8,
2994 r
->return_icmp6
& 255, af
, r
);
2997 if (r
->action
== PF_DROP
)
3000 pf_tag_packet(m
, tag
);
3002 if (r
->keep_state
|| nr
!= NULL
) {
3003 /* create new state */
3004 struct pf_state
*s
= NULL
;
3005 struct pf_src_node
*sn
= NULL
;
3007 /* check maximums */
3008 if (r
->max_states
&& (r
->states
>= r
->max_states
))
3010 /* src node for flter rule */
3011 if ((r
->rule_flag
& PFRULE_SRCTRACK
||
3012 r
->rpool
.opts
& PF_POOL_STICKYADDR
) &&
3013 pf_insert_src_node(&sn
, r
, saddr
, af
) != 0)
3015 /* src node for translation rule */
3016 if (nr
!= NULL
&& (nr
->rpool
.opts
& PF_POOL_STICKYADDR
) &&
3017 ((direction
== PF_OUT
&&
3018 pf_insert_src_node(&nsn
, nr
, &pd
->baddr
, af
) != 0) ||
3019 (pf_insert_src_node(&nsn
, nr
, saddr
, af
) != 0)))
3021 s
= pool_get(&pf_state_pl
, PR_NOWAIT
);
3024 if (sn
!= NULL
&& sn
->states
== 0 && sn
->expire
== 0) {
3025 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, sn
);
3026 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
3027 pf_status
.src_nodes
--;
3028 pool_put(&pf_src_tree_pl
, sn
);
3030 if (nsn
!= sn
&& nsn
!= NULL
&& nsn
->states
== 0 &&
3032 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, nsn
);
3033 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
3034 pf_status
.src_nodes
--;
3035 pool_put(&pf_src_tree_pl
, nsn
);
3037 REASON_SET(&reason
, PFRES_MEMORY
);
3040 bzero(s
, sizeof(*s
));
3045 s
->nat_rule
.ptr
= nr
;
3046 if (s
->nat_rule
.ptr
!= NULL
)
3047 s
->nat_rule
.ptr
->states
++;
3049 s
->allow_opts
= r
->allow_opts
;
3050 s
->log
= r
->log
& 2;
3051 s
->proto
= IPPROTO_UDP
;
3052 s
->direction
= direction
;
3054 if (direction
== PF_OUT
) {
3055 PF_ACPY(&s
->gwy
.addr
, saddr
, af
);
3056 s
->gwy
.port
= uh
->uh_sport
;
3057 PF_ACPY(&s
->ext
.addr
, daddr
, af
);
3058 s
->ext
.port
= uh
->uh_dport
;
3060 PF_ACPY(&s
->lan
.addr
, &pd
->baddr
, af
);
3061 s
->lan
.port
= bport
;
3063 PF_ACPY(&s
->lan
.addr
, &s
->gwy
.addr
, af
);
3064 s
->lan
.port
= s
->gwy
.port
;
3067 PF_ACPY(&s
->lan
.addr
, daddr
, af
);
3068 s
->lan
.port
= uh
->uh_dport
;
3069 PF_ACPY(&s
->ext
.addr
, saddr
, af
);
3070 s
->ext
.port
= uh
->uh_sport
;
3072 PF_ACPY(&s
->gwy
.addr
, &pd
->baddr
, af
);
3073 s
->gwy
.port
= bport
;
3075 PF_ACPY(&s
->gwy
.addr
, &s
->lan
.addr
, af
);
3076 s
->gwy
.port
= s
->lan
.port
;
3079 s
->hash
= pf_state_hash(s
);
3080 s
->src
.state
= PFUDPS_SINGLE
;
3081 s
->dst
.state
= PFUDPS_NO_TRAFFIC
;
3082 s
->creation
= time_second
;
3083 s
->expire
= time_second
;
3084 s
->timeout
= PFTM_UDP_FIRST_PACKET
;
3085 pf_set_rt_ifp(s
, saddr
);
3088 s
->src_node
->states
++;
3091 PF_ACPY(&nsn
->raddr
, &pd
->naddr
, af
);
3092 s
->nat_src_node
= nsn
;
3093 s
->nat_src_node
->states
++;
3095 if (pf_insert_state(BOUND_IFACE(r
, kif
), s
)) {
3096 REASON_SET(&reason
, PFRES_MEMORY
);
3097 pf_src_tree_remove_state(s
);
3098 pool_put(&pf_state_pl
, s
);
3104 /* copy back packet headers if we performed NAT operations */
3106 m_copyback(m
, off
, sizeof(*uh
), (caddr_t
)uh
);
3112 pf_test_icmp(struct pf_rule
**rm
, struct pf_state
**sm
, int direction
,
3113 struct pfi_kif
*kif
, struct mbuf
*m
, int off
, void *h
,
3114 struct pf_pdesc
*pd
, struct pf_rule
**am
, struct pf_ruleset
**rsm
)
3116 struct pf_rule
*nr
= NULL
;
3117 struct pf_addr
*saddr
= pd
->src
, *daddr
= pd
->dst
;
3118 struct pf_rule
*r
, *a
= NULL
;
3119 struct pf_ruleset
*ruleset
= NULL
;
3120 struct pf_src_node
*nsn
= NULL
;
3122 u_int16_t icmpid
= 0;
3123 sa_family_t af
= pd
->af
;
3124 u_int8_t icmptype
= 0, icmpcode
= 0;
3131 switch (pd
->proto
) {
3134 icmptype
= pd
->hdr
.icmp
->icmp_type
;
3135 icmpcode
= pd
->hdr
.icmp
->icmp_code
;
3136 icmpid
= pd
->hdr
.icmp
->icmp_id
;
3138 if (icmptype
== ICMP_UNREACH
||
3139 icmptype
== ICMP_SOURCEQUENCH
||
3140 icmptype
== ICMP_REDIRECT
||
3141 icmptype
== ICMP_TIMXCEED
||
3142 icmptype
== ICMP_PARAMPROB
)
3147 case IPPROTO_ICMPV6
:
3148 icmptype
= pd
->hdr
.icmp6
->icmp6_type
;
3149 icmpcode
= pd
->hdr
.icmp6
->icmp6_code
;
3150 icmpid
= pd
->hdr
.icmp6
->icmp6_id
;
3152 if (icmptype
== ICMP6_DST_UNREACH
||
3153 icmptype
== ICMP6_PACKET_TOO_BIG
||
3154 icmptype
== ICMP6_TIME_EXCEEDED
||
3155 icmptype
== ICMP6_PARAM_PROB
)
3161 r
= TAILQ_FIRST(pf_main_ruleset
.rules
[PF_RULESET_FILTER
].active
.ptr
);
3163 if (direction
== PF_OUT
) {
3164 /* check outgoing packet for BINAT/NAT */
3165 if ((nr
= pf_get_translation(pd
, m
, off
, PF_OUT
, kif
, &nsn
,
3166 saddr
, 0, daddr
, 0, &pd
->naddr
, NULL
)) != NULL
) {
3167 PF_ACPY(&pd
->baddr
, saddr
, af
);
3171 pf_change_a(&saddr
->v4
.s_addr
, pd
->ip_sum
,
3172 pd
->naddr
.v4
.s_addr
, 0);
3177 pf_change_a6(saddr
, &pd
->hdr
.icmp6
->icmp6_cksum
,
3188 /* check incoming packet for BINAT/RDR */
3189 if ((nr
= pf_get_translation(pd
, m
, off
, PF_IN
, kif
, &nsn
,
3190 saddr
, 0, daddr
, 0, &pd
->naddr
, NULL
)) != NULL
) {
3191 PF_ACPY(&pd
->baddr
, daddr
, af
);
3195 pf_change_a(&daddr
->v4
.s_addr
,
3196 pd
->ip_sum
, pd
->naddr
.v4
.s_addr
, 0);
3201 pf_change_a6(daddr
, &pd
->hdr
.icmp6
->icmp6_cksum
,
3215 if (r
->kif
!= NULL
&&
3216 (r
->kif
!= kif
&& r
->kif
!= kif
->pfik_parent
) == !r
->ifnot
)
3217 r
= r
->skip
[PF_SKIP_IFP
].ptr
;
3218 else if (r
->direction
&& r
->direction
!= direction
)
3219 r
= r
->skip
[PF_SKIP_DIR
].ptr
;
3220 else if (r
->af
&& r
->af
!= af
)
3221 r
= r
->skip
[PF_SKIP_AF
].ptr
;
3222 else if (r
->proto
&& r
->proto
!= pd
->proto
)
3223 r
= r
->skip
[PF_SKIP_PROTO
].ptr
;
3224 else if (PF_MISMATCHAW(&r
->src
.addr
, saddr
, af
, r
->src
.not))
3225 r
= r
->skip
[PF_SKIP_SRC_ADDR
].ptr
;
3226 else if (PF_MISMATCHAW(&r
->dst
.addr
, daddr
, af
, r
->dst
.not))
3227 r
= r
->skip
[PF_SKIP_DST_ADDR
].ptr
;
3228 else if (r
->type
&& r
->type
!= icmptype
+ 1)
3229 r
= TAILQ_NEXT(r
, entries
);
3230 else if (r
->code
&& r
->code
!= icmpcode
+ 1)
3231 r
= TAILQ_NEXT(r
, entries
);
3232 else if (r
->tos
&& !(r
->tos
& pd
->tos
))
3233 r
= TAILQ_NEXT(r
, entries
);
3234 else if (r
->rule_flag
& PFRULE_FRAGMENT
)
3235 r
= TAILQ_NEXT(r
, entries
);
3236 else if (r
->prob
&& r
->prob
<= karc4random())
3237 r
= TAILQ_NEXT(r
, entries
);
3238 else if (r
->match_tag
&& !pf_match_tag(m
, r
, nr
, &tag
))
3239 r
= TAILQ_NEXT(r
, entries
);
3240 else if (r
->anchorname
[0] && r
->anchor
== NULL
)
3241 r
= TAILQ_NEXT(r
, entries
);
3242 else if (r
->os_fingerprint
!= PF_OSFP_ANY
)
3243 r
= TAILQ_NEXT(r
, entries
);
3247 if (r
->anchor
== NULL
) {
3253 r
= TAILQ_NEXT(r
, entries
);
3255 PF_STEP_INTO_ANCHOR(r
, a
, ruleset
,
3258 if (r
== NULL
&& a
!= NULL
)
3259 PF_STEP_OUT_OF_ANCHOR(r
, a
, ruleset
,
3266 REASON_SET(&reason
, PFRES_MATCH
);
3271 m_copyback(m
, off
, sizeof(struct icmp6_hdr
),
3272 (caddr_t
)pd
->hdr
.icmp6
);
3274 PFLOG_PACKET(kif
, h
, m
, af
, direction
, reason
, r
, a
, ruleset
);
3277 if (r
->action
!= PF_PASS
)
3280 pf_tag_packet(m
, tag
);
3282 if (!state_icmp
&& (r
->keep_state
|| nr
!= NULL
)) {
3283 /* create new state */
3284 struct pf_state
*s
= NULL
;
3285 struct pf_src_node
*sn
= NULL
;
3287 /* check maximums */
3288 if (r
->max_states
&& (r
->states
>= r
->max_states
))
3290 /* src node for flter rule */
3291 if ((r
->rule_flag
& PFRULE_SRCTRACK
||
3292 r
->rpool
.opts
& PF_POOL_STICKYADDR
) &&
3293 pf_insert_src_node(&sn
, r
, saddr
, af
) != 0)
3295 /* src node for translation rule */
3296 if (nr
!= NULL
&& (nr
->rpool
.opts
& PF_POOL_STICKYADDR
) &&
3297 ((direction
== PF_OUT
&&
3298 pf_insert_src_node(&nsn
, nr
, &pd
->baddr
, af
) != 0) ||
3299 (pf_insert_src_node(&nsn
, nr
, saddr
, af
) != 0)))
3301 s
= pool_get(&pf_state_pl
, PR_NOWAIT
);
3304 if (sn
!= NULL
&& sn
->states
== 0 && sn
->expire
== 0) {
3305 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, sn
);
3306 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
3307 pf_status
.src_nodes
--;
3308 pool_put(&pf_src_tree_pl
, sn
);
3310 if (nsn
!= sn
&& nsn
!= NULL
&& nsn
->states
== 0 &&
3312 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, nsn
);
3313 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
3314 pf_status
.src_nodes
--;
3315 pool_put(&pf_src_tree_pl
, nsn
);
3317 REASON_SET(&reason
, PFRES_MEMORY
);
3320 bzero(s
, sizeof(*s
));
3325 s
->nat_rule
.ptr
= nr
;
3326 if (s
->nat_rule
.ptr
!= NULL
)
3327 s
->nat_rule
.ptr
->states
++;
3329 s
->allow_opts
= r
->allow_opts
;
3330 s
->log
= r
->log
& 2;
3331 s
->proto
= pd
->proto
;
3332 s
->direction
= direction
;
3334 if (direction
== PF_OUT
) {
3335 PF_ACPY(&s
->gwy
.addr
, saddr
, af
);
3336 s
->gwy
.port
= icmpid
;
3337 PF_ACPY(&s
->ext
.addr
, daddr
, af
);
3338 s
->ext
.port
= icmpid
;
3340 PF_ACPY(&s
->lan
.addr
, &pd
->baddr
, af
);
3342 PF_ACPY(&s
->lan
.addr
, &s
->gwy
.addr
, af
);
3343 s
->lan
.port
= icmpid
;
3345 PF_ACPY(&s
->lan
.addr
, daddr
, af
);
3346 s
->lan
.port
= icmpid
;
3347 PF_ACPY(&s
->ext
.addr
, saddr
, af
);
3348 s
->ext
.port
= icmpid
;
3350 PF_ACPY(&s
->gwy
.addr
, &pd
->baddr
, af
);
3352 PF_ACPY(&s
->gwy
.addr
, &s
->lan
.addr
, af
);
3353 s
->gwy
.port
= icmpid
;
3355 s
->hash
= pf_state_hash(s
);
3356 s
->creation
= time_second
;
3357 s
->expire
= time_second
;
3358 s
->timeout
= PFTM_ICMP_FIRST_PACKET
;
3359 pf_set_rt_ifp(s
, saddr
);
3362 s
->src_node
->states
++;
3365 PF_ACPY(&nsn
->raddr
, &pd
->naddr
, af
);
3366 s
->nat_src_node
= nsn
;
3367 s
->nat_src_node
->states
++;
3369 if (pf_insert_state(BOUND_IFACE(r
, kif
), s
)) {
3370 REASON_SET(&reason
, PFRES_MEMORY
);
3371 pf_src_tree_remove_state(s
);
3372 pool_put(&pf_state_pl
, s
);
3379 /* copy back packet headers if we performed IPv6 NAT operations */
3381 m_copyback(m
, off
, sizeof(struct icmp6_hdr
),
3382 (caddr_t
)pd
->hdr
.icmp6
);
3389 pf_test_other(struct pf_rule
**rm
, struct pf_state
**sm
, int direction
,
3390 struct pfi_kif
*kif
, struct mbuf
*m
, int off
, void *h
, struct pf_pdesc
*pd
,
3391 struct pf_rule
**am
, struct pf_ruleset
**rsm
)
3393 struct pf_rule
*nr
= NULL
;
3394 struct pf_rule
*r
, *a
= NULL
;
3395 struct pf_ruleset
*ruleset
= NULL
;
3396 struct pf_src_node
*nsn
= NULL
;
3397 struct pf_addr
*saddr
= pd
->src
, *daddr
= pd
->dst
;
3398 sa_family_t af
= pd
->af
;
3402 r
= TAILQ_FIRST(pf_main_ruleset
.rules
[PF_RULESET_FILTER
].active
.ptr
);
3404 if (direction
== PF_OUT
) {
3405 /* check outgoing packet for BINAT/NAT */
3406 if ((nr
= pf_get_translation(pd
, m
, off
, PF_OUT
, kif
, &nsn
,
3407 saddr
, 0, daddr
, 0, &pd
->naddr
, NULL
)) != NULL
) {
3408 PF_ACPY(&pd
->baddr
, saddr
, af
);
3412 pf_change_a(&saddr
->v4
.s_addr
, pd
->ip_sum
,
3413 pd
->naddr
.v4
.s_addr
, 0);
3418 PF_ACPY(saddr
, &pd
->naddr
, af
);
3427 /* check incoming packet for BINAT/RDR */
3428 if ((nr
= pf_get_translation(pd
, m
, off
, PF_IN
, kif
, &nsn
,
3429 saddr
, 0, daddr
, 0, &pd
->naddr
, NULL
)) != NULL
) {
3430 PF_ACPY(&pd
->baddr
, daddr
, af
);
3434 pf_change_a(&daddr
->v4
.s_addr
,
3435 pd
->ip_sum
, pd
->naddr
.v4
.s_addr
, 0);
3440 PF_ACPY(daddr
, &pd
->naddr
, af
);
3452 if (r
->kif
!= NULL
&&
3453 (r
->kif
!= kif
&& r
->kif
!= kif
->pfik_parent
) == !r
->ifnot
)
3454 r
= r
->skip
[PF_SKIP_IFP
].ptr
;
3455 else if (r
->direction
&& r
->direction
!= direction
)
3456 r
= r
->skip
[PF_SKIP_DIR
].ptr
;
3457 else if (r
->af
&& r
->af
!= af
)
3458 r
= r
->skip
[PF_SKIP_AF
].ptr
;
3459 else if (r
->proto
&& r
->proto
!= pd
->proto
)
3460 r
= r
->skip
[PF_SKIP_PROTO
].ptr
;
3461 else if (PF_MISMATCHAW(&r
->src
.addr
, pd
->src
, af
, r
->src
.not))
3462 r
= r
->skip
[PF_SKIP_SRC_ADDR
].ptr
;
3463 else if (PF_MISMATCHAW(&r
->dst
.addr
, pd
->dst
, af
, r
->dst
.not))
3464 r
= r
->skip
[PF_SKIP_DST_ADDR
].ptr
;
3465 else if (r
->tos
&& !(r
->tos
& pd
->tos
))
3466 r
= TAILQ_NEXT(r
, entries
);
3467 else if (r
->rule_flag
& PFRULE_FRAGMENT
)
3468 r
= TAILQ_NEXT(r
, entries
);
3469 else if (r
->prob
&& r
->prob
<= karc4random())
3470 r
= TAILQ_NEXT(r
, entries
);
3471 else if (r
->match_tag
&& !pf_match_tag(m
, r
, nr
, &tag
))
3472 r
= TAILQ_NEXT(r
, entries
);
3473 else if (r
->anchorname
[0] && r
->anchor
== NULL
)
3474 r
= TAILQ_NEXT(r
, entries
);
3475 else if (r
->os_fingerprint
!= PF_OSFP_ANY
)
3476 r
= TAILQ_NEXT(r
, entries
);
3480 if (r
->anchor
== NULL
) {
3486 r
= TAILQ_NEXT(r
, entries
);
3488 PF_STEP_INTO_ANCHOR(r
, a
, ruleset
,
3491 if (r
== NULL
&& a
!= NULL
)
3492 PF_STEP_OUT_OF_ANCHOR(r
, a
, ruleset
,
3499 REASON_SET(&reason
, PFRES_MATCH
);
3502 PFLOG_PACKET(kif
, h
, m
, af
, direction
, reason
, r
, a
, ruleset
);
3504 if ((r
->action
== PF_DROP
) &&
3505 ((r
->rule_flag
& PFRULE_RETURNICMP
) ||
3506 (r
->rule_flag
& PFRULE_RETURN
))) {
3507 struct pf_addr
*a
= NULL
;
3510 if (direction
== PF_OUT
)
3519 pf_change_a(&a
->v4
.s_addr
, pd
->ip_sum
,
3520 pd
->baddr
.v4
.s_addr
, 0);
3525 PF_ACPY(a
, &pd
->baddr
, af
);
3530 if ((af
== AF_INET
) && r
->return_icmp
)
3531 pf_send_icmp(m
, r
->return_icmp
>> 8,
3532 r
->return_icmp
& 255, af
, r
);
3533 else if ((af
== AF_INET6
) && r
->return_icmp6
)
3534 pf_send_icmp(m
, r
->return_icmp6
>> 8,
3535 r
->return_icmp6
& 255, af
, r
);
3538 if (r
->action
!= PF_PASS
)
3541 pf_tag_packet(m
, tag
);
3543 if (r
->keep_state
|| nr
!= NULL
) {
3544 /* create new state */
3545 struct pf_state
*s
= NULL
;
3546 struct pf_src_node
*sn
= NULL
;
3548 /* check maximums */
3549 if (r
->max_states
&& (r
->states
>= r
->max_states
))
3551 /* src node for flter rule */
3552 if ((r
->rule_flag
& PFRULE_SRCTRACK
||
3553 r
->rpool
.opts
& PF_POOL_STICKYADDR
) &&
3554 pf_insert_src_node(&sn
, r
, saddr
, af
) != 0)
3556 /* src node for translation rule */
3557 if (nr
!= NULL
&& (nr
->rpool
.opts
& PF_POOL_STICKYADDR
) &&
3558 ((direction
== PF_OUT
&&
3559 pf_insert_src_node(&nsn
, nr
, &pd
->baddr
, af
) != 0) ||
3560 (pf_insert_src_node(&nsn
, nr
, saddr
, af
) != 0)))
3562 s
= pool_get(&pf_state_pl
, PR_NOWAIT
);
3565 if (sn
!= NULL
&& sn
->states
== 0 && sn
->expire
== 0) {
3566 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, sn
);
3567 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
3568 pf_status
.src_nodes
--;
3569 pool_put(&pf_src_tree_pl
, sn
);
3571 if (nsn
!= sn
&& nsn
!= NULL
&& nsn
->states
== 0 &&
3573 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, nsn
);
3574 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
3575 pf_status
.src_nodes
--;
3576 pool_put(&pf_src_tree_pl
, nsn
);
3578 REASON_SET(&reason
, PFRES_MEMORY
);
3581 bzero(s
, sizeof(*s
));
3586 s
->nat_rule
.ptr
= nr
;
3587 if (s
->nat_rule
.ptr
!= NULL
)
3588 s
->nat_rule
.ptr
->states
++;
3590 s
->allow_opts
= r
->allow_opts
;
3591 s
->log
= r
->log
& 2;
3592 s
->proto
= pd
->proto
;
3593 s
->direction
= direction
;
3595 if (direction
== PF_OUT
) {
3596 PF_ACPY(&s
->gwy
.addr
, saddr
, af
);
3597 PF_ACPY(&s
->ext
.addr
, daddr
, af
);
3599 PF_ACPY(&s
->lan
.addr
, &pd
->baddr
, af
);
3601 PF_ACPY(&s
->lan
.addr
, &s
->gwy
.addr
, af
);
3603 PF_ACPY(&s
->lan
.addr
, daddr
, af
);
3604 PF_ACPY(&s
->ext
.addr
, saddr
, af
);
3606 PF_ACPY(&s
->gwy
.addr
, &pd
->baddr
, af
);
3608 PF_ACPY(&s
->gwy
.addr
, &s
->lan
.addr
, af
);
3610 s
->hash
= pf_state_hash(s
);
3611 s
->src
.state
= PFOTHERS_SINGLE
;
3612 s
->dst
.state
= PFOTHERS_NO_TRAFFIC
;
3613 s
->creation
= time_second
;
3614 s
->expire
= time_second
;
3615 s
->timeout
= PFTM_OTHER_FIRST_PACKET
;
3616 pf_set_rt_ifp(s
, saddr
);
3619 s
->src_node
->states
++;
3622 PF_ACPY(&nsn
->raddr
, &pd
->naddr
, af
);
3623 s
->nat_src_node
= nsn
;
3624 s
->nat_src_node
->states
++;
3626 if (pf_insert_state(BOUND_IFACE(r
, kif
), s
)) {
3627 REASON_SET(&reason
, PFRES_MEMORY
);
3628 pf_src_tree_remove_state(s
);
3629 pool_put(&pf_state_pl
, s
);
3639 pf_test_fragment(struct pf_rule
**rm
, int direction
, struct pfi_kif
*kif
,
3640 struct mbuf
*m
, void *h
, struct pf_pdesc
*pd
, struct pf_rule
**am
,
3641 struct pf_ruleset
**rsm
)
3643 struct pf_rule
*r
, *a
= NULL
;
3644 struct pf_ruleset
*ruleset
= NULL
;
3645 sa_family_t af
= pd
->af
;
3649 r
= TAILQ_FIRST(pf_main_ruleset
.rules
[PF_RULESET_FILTER
].active
.ptr
);
3652 if (r
->kif
!= NULL
&&
3653 (r
->kif
!= kif
&& r
->kif
!= kif
->pfik_parent
) == !r
->ifnot
)
3654 r
= r
->skip
[PF_SKIP_IFP
].ptr
;
3655 else if (r
->direction
&& r
->direction
!= direction
)
3656 r
= r
->skip
[PF_SKIP_DIR
].ptr
;
3657 else if (r
->af
&& r
->af
!= af
)
3658 r
= r
->skip
[PF_SKIP_AF
].ptr
;
3659 else if (r
->proto
&& r
->proto
!= pd
->proto
)
3660 r
= r
->skip
[PF_SKIP_PROTO
].ptr
;
3661 else if (PF_MISMATCHAW(&r
->src
.addr
, pd
->src
, af
, r
->src
.not))
3662 r
= r
->skip
[PF_SKIP_SRC_ADDR
].ptr
;
3663 else if (PF_MISMATCHAW(&r
->dst
.addr
, pd
->dst
, af
, r
->dst
.not))
3664 r
= r
->skip
[PF_SKIP_DST_ADDR
].ptr
;
3665 else if (r
->tos
&& !(r
->tos
& pd
->tos
))
3666 r
= TAILQ_NEXT(r
, entries
);
3667 else if (r
->os_fingerprint
!= PF_OSFP_ANY
)
3668 r
= TAILQ_NEXT(r
, entries
);
3669 else if (pd
->proto
== IPPROTO_UDP
&&
3670 (r
->src
.port_op
|| r
->dst
.port_op
))
3671 r
= TAILQ_NEXT(r
, entries
);
3672 else if (pd
->proto
== IPPROTO_TCP
&&
3673 (r
->src
.port_op
|| r
->dst
.port_op
|| r
->flagset
))
3674 r
= TAILQ_NEXT(r
, entries
);
3675 else if ((pd
->proto
== IPPROTO_ICMP
||
3676 pd
->proto
== IPPROTO_ICMPV6
) &&
3677 (r
->type
|| r
->code
))
3678 r
= TAILQ_NEXT(r
, entries
);
3679 else if (r
->prob
&& r
->prob
<= karc4random())
3680 r
= TAILQ_NEXT(r
, entries
);
3681 else if (r
->match_tag
&& !pf_match_tag(m
, r
, NULL
, &tag
))
3682 r
= TAILQ_NEXT(r
, entries
);
3683 else if (r
->anchorname
[0] && r
->anchor
== NULL
)
3684 r
= TAILQ_NEXT(r
, entries
);
3686 if (r
->anchor
== NULL
) {
3692 r
= TAILQ_NEXT(r
, entries
);
3694 PF_STEP_INTO_ANCHOR(r
, a
, ruleset
,
3697 if (r
== NULL
&& a
!= NULL
)
3698 PF_STEP_OUT_OF_ANCHOR(r
, a
, ruleset
,
3705 REASON_SET(&reason
, PFRES_MATCH
);
3708 PFLOG_PACKET(kif
, h
, m
, af
, direction
, reason
, r
, a
, ruleset
);
3710 if (r
->action
!= PF_PASS
)
3713 pf_tag_packet(m
, tag
);
3719 pf_test_state_tcp(struct pf_state
**state
, int direction
, struct pfi_kif
*kif
,
3720 struct mbuf
*m
, int off
, void *h
, struct pf_pdesc
*pd
,
3723 struct pf_state key
;
3724 struct tcphdr
*th
= pd
->hdr
.tcp
;
3725 u_int16_t win
= ntohs(th
->th_win
);
3726 u_int32_t ack
, end
, seq
;
3730 struct pf_state_peer
*src
, *dst
;
3733 key
.proto
= IPPROTO_TCP
;
3734 if (direction
== PF_IN
) {
3735 PF_ACPY(&key
.ext
.addr
, pd
->src
, key
.af
);
3736 PF_ACPY(&key
.gwy
.addr
, pd
->dst
, key
.af
);
3737 key
.ext
.port
= th
->th_sport
;
3738 key
.gwy
.port
= th
->th_dport
;
3740 PF_ACPY(&key
.lan
.addr
, pd
->src
, key
.af
);
3741 PF_ACPY(&key
.ext
.addr
, pd
->dst
, key
.af
);
3742 key
.lan
.port
= th
->th_sport
;
3743 key
.ext
.port
= th
->th_dport
;
3748 if (direction
== (*state
)->direction
) {
3749 src
= &(*state
)->src
;
3750 dst
= &(*state
)->dst
;
3752 src
= &(*state
)->dst
;
3753 dst
= &(*state
)->src
;
3756 if ((*state
)->src
.state
== PF_TCPS_PROXY_SRC
) {
3757 if (direction
!= (*state
)->direction
)
3758 return (PF_SYNPROXY_DROP
);
3759 if (th
->th_flags
& TH_SYN
) {
3760 if (ntohl(th
->th_seq
) != (*state
)->src
.seqlo
)
3762 pf_send_tcp((*state
)->rule
.ptr
, pd
->af
, pd
->dst
,
3763 pd
->src
, th
->th_dport
, th
->th_sport
,
3764 (*state
)->src
.seqhi
, ntohl(th
->th_seq
) + 1,
3765 TH_SYN
|TH_ACK
, 0, (*state
)->src
.mss
, 0);
3766 return (PF_SYNPROXY_DROP
);
3767 } else if (!(th
->th_flags
& TH_ACK
) ||
3768 (ntohl(th
->th_ack
) != (*state
)->src
.seqhi
+ 1) ||
3769 (ntohl(th
->th_seq
) != (*state
)->src
.seqlo
+ 1))
3772 (*state
)->src
.state
= PF_TCPS_PROXY_DST
;
3774 if ((*state
)->src
.state
== PF_TCPS_PROXY_DST
) {
3775 struct pf_state_host
*src
, *dst
;
3777 if (direction
== PF_OUT
) {
3778 src
= &(*state
)->gwy
;
3779 dst
= &(*state
)->ext
;
3781 src
= &(*state
)->ext
;
3782 dst
= &(*state
)->lan
;
3784 if (direction
== (*state
)->direction
) {
3785 if (((th
->th_flags
& (TH_SYN
|TH_ACK
)) != TH_ACK
) ||
3786 (ntohl(th
->th_ack
) != (*state
)->src
.seqhi
+ 1) ||
3787 (ntohl(th
->th_seq
) != (*state
)->src
.seqlo
+ 1))
3789 (*state
)->src
.max_win
= MAX(ntohs(th
->th_win
), 1);
3790 if ((*state
)->dst
.seqhi
== 1)
3791 (*state
)->dst
.seqhi
= karc4random();
3792 pf_send_tcp((*state
)->rule
.ptr
, pd
->af
, &src
->addr
,
3793 &dst
->addr
, src
->port
, dst
->port
,
3794 (*state
)->dst
.seqhi
, 0, TH_SYN
, 0,
3795 (*state
)->src
.mss
, 0);
3796 return (PF_SYNPROXY_DROP
);
3797 } else if (((th
->th_flags
& (TH_SYN
|TH_ACK
)) !=
3799 (ntohl(th
->th_ack
) != (*state
)->dst
.seqhi
+ 1))
3802 (*state
)->dst
.max_win
= MAX(ntohs(th
->th_win
), 1);
3803 (*state
)->dst
.seqlo
= ntohl(th
->th_seq
);
3804 pf_send_tcp((*state
)->rule
.ptr
, pd
->af
, pd
->dst
,
3805 pd
->src
, th
->th_dport
, th
->th_sport
,
3806 ntohl(th
->th_ack
), ntohl(th
->th_seq
) + 1,
3807 TH_ACK
, (*state
)->src
.max_win
, 0, 0);
3808 pf_send_tcp((*state
)->rule
.ptr
, pd
->af
, &src
->addr
,
3809 &dst
->addr
, src
->port
, dst
->port
,
3810 (*state
)->src
.seqhi
+ 1, (*state
)->src
.seqlo
+ 1,
3811 TH_ACK
, (*state
)->dst
.max_win
, 0, 0);
3812 (*state
)->src
.seqdiff
= (*state
)->dst
.seqhi
-
3813 (*state
)->src
.seqlo
;
3814 (*state
)->dst
.seqdiff
= (*state
)->src
.seqhi
-
3815 (*state
)->dst
.seqlo
;
3816 (*state
)->src
.seqhi
= (*state
)->src
.seqlo
+
3817 (*state
)->dst
.max_win
;
3818 (*state
)->dst
.seqhi
= (*state
)->dst
.seqlo
+
3819 (*state
)->src
.max_win
;
3820 (*state
)->src
.wscale
= (*state
)->dst
.wscale
= 0;
3821 (*state
)->src
.state
= (*state
)->dst
.state
=
3823 return (PF_SYNPROXY_DROP
);
3827 if (src
->wscale
&& dst
->wscale
&& !(th
->th_flags
& TH_SYN
)) {
3828 sws
= src
->wscale
& PF_WSCALE_MASK
;
3829 dws
= dst
->wscale
& PF_WSCALE_MASK
;
3834 * Sequence tracking algorithm from Guido van Rooij's paper:
3835 * http://www.madison-gurkha.com/publications/tcp_filtering/
3839 seq
= ntohl(th
->th_seq
);
3840 if (src
->seqlo
== 0) {
3842 * First packet from this end. The other end has already set
3843 * the seqlo field. Set its state.
3845 if ((pd
->flags
& PFDESC_TCP_NORM
|| dst
->scrub
) &&
3846 src
->scrub
== NULL
) {
3847 if (pf_normalize_tcp_init(m
, off
, pd
, th
, src
, dst
)) {
3848 REASON_SET(reason
, PFRES_MEMORY
);
3853 /* Deferred generation of sequence number modulator */
3854 if (dst
->seqdiff
&& !src
->seqdiff
) {
3855 while ((src
->seqdiff
= karc4random()) == 0)
3857 ack
= ntohl(th
->th_ack
) - dst
->seqdiff
;
3858 pf_change_a(&th
->th_seq
, &th
->th_sum
, htonl(seq
+
3860 pf_change_a(&th
->th_ack
, &th
->th_sum
, htonl(ack
), 0);
3863 ack
= ntohl(th
->th_ack
);
3866 end
= seq
+ pd
->p_len
;
3867 if (th
->th_flags
& TH_SYN
) {
3869 (*state
)->sync_flags
|= PFSTATE_GOT_SYN2
;
3870 if (dst
->wscale
& PF_WSCALE_FLAG
) {
3871 src
->wscale
= pf_get_wscale(m
, off
, th
->th_off
,
3873 if (src
->wscale
& PF_WSCALE_FLAG
) {
3874 /* Remove scale factor from initial
3876 sws
= src
->wscale
& PF_WSCALE_MASK
;
3877 win
= ((u_int32_t
)win
+ (1 << sws
) - 1)
3879 dws
= dst
->wscale
& PF_WSCALE_MASK
;
3882 * Fixup other window. Undo the
3883 * normalization that was done on
3884 * the initial SYN. This can result
3885 * in max_win being larger then
3886 * actual but we don't really have
3889 dst
->max_win
<<= dst
->wscale
&
3891 /* in case of a retrans SYN|ACK */
3896 if (th
->th_flags
& TH_FIN
)
3900 if (src
->state
< TCPS_SYN_SENT
)
3901 src
->state
= TCPS_SYN_SENT
;
3904 * May need to slide the window (seqhi may have been set by
3905 * the crappy stack check or if we picked up the connection
3906 * after establishment)
3908 if (src
->seqhi
== 1 ||
3909 SEQ_GEQ(end
+ MAX(1, dst
->max_win
<< dws
), src
->seqhi
))
3910 src
->seqhi
= end
+ MAX(1, dst
->max_win
<< dws
);
3911 if (win
> src
->max_win
)
3915 ack
= ntohl(th
->th_ack
) - dst
->seqdiff
;
3917 /* Modulate sequence numbers */
3918 pf_change_a(&th
->th_seq
, &th
->th_sum
, htonl(seq
+
3920 pf_change_a(&th
->th_ack
, &th
->th_sum
, htonl(ack
), 0);
3923 end
= seq
+ pd
->p_len
;
3924 if (th
->th_flags
& TH_SYN
)
3926 if (th
->th_flags
& TH_FIN
)
3930 if ((th
->th_flags
& TH_ACK
) == 0) {
3931 /* Let it pass through the ack skew check */
3933 } else if ((ack
== 0 &&
3934 (th
->th_flags
& (TH_ACK
|TH_RST
)) == (TH_ACK
|TH_RST
)) ||
3935 /* broken tcp stacks do not set ack */
3936 (dst
->state
< TCPS_SYN_SENT
)) {
3938 * Many stacks (ours included) will set the ACK number in an
3939 * FIN|ACK if the SYN times out -- no sequence to ACK.
3945 /* Ease sequencing restrictions on no data packets */
3950 ackskew
= dst
->seqlo
- ack
;
3952 #define MAXACKWINDOW (0xffff + 1500) /* 1500 is an arbitrary fudge factor */
3954 if (SEQ_GEQ(src
->seqhi
, end
) &&
3955 /* Last octet inside other's window space */
3956 SEQ_GEQ(seq
, src
->seqlo
- (dst
->max_win
<< dws
)) &&
3957 /* Retrans: not more than one window back */
3958 (ackskew
>= -MAXACKWINDOW
) &&
3959 /* Acking not more than one reassembled fragment backwards */
3960 (ackskew
<= (MAXACKWINDOW
<< sws
))) {
3961 /* Acking not more than one window forward */
3963 /* update max window */
3964 if (src
->max_win
< win
)
3966 /* synchronize sequencing */
3967 if (SEQ_GT(end
, src
->seqlo
))
3969 /* slide the window of what the other end can send */
3970 if (SEQ_GEQ(ack
+ (win
<< sws
), dst
->seqhi
))
3971 dst
->seqhi
= ack
+ MAX((win
<< sws
), 1);
3975 if (th
->th_flags
& TH_SYN
)
3976 if (src
->state
< TCPS_SYN_SENT
)
3977 src
->state
= TCPS_SYN_SENT
;
3978 if (th
->th_flags
& TH_FIN
)
3979 if (src
->state
< TCPS_CLOSING
)
3980 src
->state
= TCPS_CLOSING
;
3981 if (th
->th_flags
& TH_ACK
) {
3982 if (dst
->state
== TCPS_SYN_SENT
)
3983 dst
->state
= TCPS_ESTABLISHED
;
3984 else if (dst
->state
== TCPS_CLOSING
)
3985 dst
->state
= TCPS_FIN_WAIT_2
;
3987 if (th
->th_flags
& TH_RST
)
3988 src
->state
= dst
->state
= TCPS_TIME_WAIT
;
3990 /* update expire time */
3991 (*state
)->expire
= time_second
;
3992 if (src
->state
>= TCPS_FIN_WAIT_2
&&
3993 dst
->state
>= TCPS_FIN_WAIT_2
)
3994 (*state
)->timeout
= PFTM_TCP_CLOSED
;
3995 else if (src
->state
>= TCPS_FIN_WAIT_2
||
3996 dst
->state
>= TCPS_FIN_WAIT_2
)
3997 (*state
)->timeout
= PFTM_TCP_FIN_WAIT
;
3998 else if (src
->state
< TCPS_ESTABLISHED
||
3999 dst
->state
< TCPS_ESTABLISHED
)
4000 (*state
)->timeout
= PFTM_TCP_OPENING
;
4001 else if (src
->state
>= TCPS_CLOSING
||
4002 dst
->state
>= TCPS_CLOSING
)
4003 (*state
)->timeout
= PFTM_TCP_CLOSING
;
4005 (*state
)->timeout
= PFTM_TCP_ESTABLISHED
;
4007 /* Fall through to PASS packet */
4009 } else if ((dst
->state
< TCPS_SYN_SENT
||
4010 dst
->state
>= TCPS_FIN_WAIT_2
||
4011 src
->state
>= TCPS_FIN_WAIT_2
) &&
4012 SEQ_GEQ(src
->seqhi
+ MAXACKWINDOW
, end
) &&
4013 /* Within a window forward of the originating packet */
4014 SEQ_GEQ(seq
, src
->seqlo
- MAXACKWINDOW
)) {
4015 /* Within a window backward of the originating packet */
4018 * This currently handles three situations:
4019 * 1) Stupid stacks will shotgun SYNs before their peer
4021 * 2) When PF catches an already established stream (the
4022 * firewall rebooted, the state table was flushed, routes
4024 * 3) Packets get funky immediately after the connection
4025 * closes (this should catch Solaris spurious ACK|FINs
4026 * that web servers like to spew after a close)
4028 * This must be a little more careful than the above code
4029 * since packet floods will also be caught here. We don't
4030 * update the TTL here to mitigate the damage of a packet
4031 * flood and so the same code can handle awkward establishment
4032 * and a loosened connection close.
4033 * In the establishment case, a correct peer response will
4034 * validate the connection, go through the normal state code
4035 * and keep updating the state TTL.
4038 if (pf_status
.debug
>= PF_DEBUG_MISC
) {
4039 kprintf("pf: loose state match: ");
4040 pf_print_state(*state
);
4041 pf_print_flags(th
->th_flags
);
4042 kprintf(" seq=%u ack=%u len=%u ackskew=%d pkts=%d:%d\n",
4043 seq
, ack
, pd
->p_len
, ackskew
,
4044 (*state
)->packets
[0], (*state
)->packets
[1]);
4047 /* update max window */
4048 if (src
->max_win
< win
)
4050 /* synchronize sequencing */
4051 if (SEQ_GT(end
, src
->seqlo
))
4053 /* slide the window of what the other end can send */
4054 if (SEQ_GEQ(ack
+ (win
<< sws
), dst
->seqhi
))
4055 dst
->seqhi
= ack
+ MAX((win
<< sws
), 1);
4058 * Cannot set dst->seqhi here since this could be a shotgunned
4059 * SYN and not an already established connection.
4062 if (th
->th_flags
& TH_FIN
)
4063 if (src
->state
< TCPS_CLOSING
)
4064 src
->state
= TCPS_CLOSING
;
4065 if (th
->th_flags
& TH_RST
)
4066 src
->state
= dst
->state
= TCPS_TIME_WAIT
;
4068 /* Fall through to PASS packet */
4070 } else if ((*state
)->pickup_mode
== PF_PICKUPS_HASHONLY
||
4071 ((*state
)->pickup_mode
== PF_PICKUPS_ENABLED
&&
4072 ((*state
)->sync_flags
& PFSTATE_GOT_SYN_MASK
) !=
4073 PFSTATE_GOT_SYN_MASK
)) {
4075 * If pickup mode is hash only, do not fail on sequence checks.
4077 * If pickup mode is enabled and we did not see the SYN in
4078 * both direction, do not fail on sequence checks because
4079 * we do not have complete information on window scale.
4081 * Adjust expiration and fall through to PASS packet.
4082 * XXX Add a FIN check to reduce timeout?
4084 (*state
)->expire
= time_second
;
4087 * Failure processing
4089 if ((*state
)->dst
.state
== TCPS_SYN_SENT
&&
4090 (*state
)->src
.state
== TCPS_SYN_SENT
) {
4091 /* Send RST for state mismatches during handshake */
4092 if (!(th
->th_flags
& TH_RST
)) {
4093 u_int32_t ack
= ntohl(th
->th_seq
) + pd
->p_len
;
4095 if (th
->th_flags
& TH_SYN
)
4097 if (th
->th_flags
& TH_FIN
)
4099 pf_send_tcp((*state
)->rule
.ptr
, pd
->af
,
4100 pd
->dst
, pd
->src
, th
->th_dport
,
4101 th
->th_sport
, ntohl(th
->th_ack
), ack
,
4102 TH_RST
|TH_ACK
, 0, 0,
4103 (*state
)->rule
.ptr
->return_ttl
);
4108 } else if (pf_status
.debug
>= PF_DEBUG_MISC
) {
4109 kprintf("pf: BAD state: ");
4110 pf_print_state(*state
);
4111 pf_print_flags(th
->th_flags
);
4112 kprintf(" seq=%u ack=%u len=%u ackskew=%d pkts=%d:%d "
4113 "dir=%s,%s\n", seq
, ack
, pd
->p_len
, ackskew
,
4114 (*state
)->packets
[0], (*state
)->packets
[1],
4115 direction
== PF_IN
? "in" : "out",
4116 direction
== (*state
)->direction
? "fwd" : "rev");
4117 kprintf("pf: State failure on: %c %c %c %c | %c %c\n",
4118 SEQ_GEQ(src
->seqhi
, end
) ? ' ' : '1',
4119 SEQ_GEQ(seq
, src
->seqlo
- (dst
->max_win
<< dws
)) ?
4121 (ackskew
>= -MAXACKWINDOW
) ? ' ' : '3',
4122 (ackskew
<= (MAXACKWINDOW
<< sws
)) ? ' ' : '4',
4123 SEQ_GEQ(src
->seqhi
+ MAXACKWINDOW
, end
) ?' ' :'5',
4124 SEQ_GEQ(seq
, src
->seqlo
- MAXACKWINDOW
) ?' ' :'6');
4129 if (dst
->scrub
|| src
->scrub
) {
4130 if (pf_normalize_tcp_stateful(m
, off
, pd
, reason
, th
,
4131 src
, dst
, ©back
))
4135 /* Any packets which have gotten here are to be passed */
4137 /* translate source/destination address, if necessary */
4138 if (STATE_TRANSLATE(*state
)) {
4139 if (direction
== PF_OUT
)
4140 pf_change_ap(pd
->src
, &th
->th_sport
, pd
->ip_sum
,
4141 &th
->th_sum
, &(*state
)->gwy
.addr
,
4142 (*state
)->gwy
.port
, 0, pd
->af
);
4144 pf_change_ap(pd
->dst
, &th
->th_dport
, pd
->ip_sum
,
4145 &th
->th_sum
, &(*state
)->lan
.addr
,
4146 (*state
)->lan
.port
, 0, pd
->af
);
4147 m_copyback(m
, off
, sizeof(*th
), (caddr_t
)th
);
4148 } else if (copyback
) {
4149 /* Copyback sequence modulation or stateful scrub changes */
4150 m_copyback(m
, off
, sizeof(*th
), (caddr_t
)th
);
4157 pf_test_state_udp(struct pf_state
**state
, int direction
, struct pfi_kif
*kif
,
4158 struct mbuf
*m
, int off
, void *h
, struct pf_pdesc
*pd
)
4160 struct pf_state_peer
*src
, *dst
;
4161 struct pf_state key
;
4162 struct udphdr
*uh
= pd
->hdr
.udp
;
4165 key
.proto
= IPPROTO_UDP
;
4166 if (direction
== PF_IN
) {
4167 PF_ACPY(&key
.ext
.addr
, pd
->src
, key
.af
);
4168 PF_ACPY(&key
.gwy
.addr
, pd
->dst
, key
.af
);
4169 key
.ext
.port
= uh
->uh_sport
;
4170 key
.gwy
.port
= uh
->uh_dport
;
4172 PF_ACPY(&key
.lan
.addr
, pd
->src
, key
.af
);
4173 PF_ACPY(&key
.ext
.addr
, pd
->dst
, key
.af
);
4174 key
.lan
.port
= uh
->uh_sport
;
4175 key
.ext
.port
= uh
->uh_dport
;
4180 if (direction
== (*state
)->direction
) {
4181 src
= &(*state
)->src
;
4182 dst
= &(*state
)->dst
;
4184 src
= &(*state
)->dst
;
4185 dst
= &(*state
)->src
;
4189 if (src
->state
< PFUDPS_SINGLE
)
4190 src
->state
= PFUDPS_SINGLE
;
4191 if (dst
->state
== PFUDPS_SINGLE
)
4192 dst
->state
= PFUDPS_MULTIPLE
;
4194 /* update expire time */
4195 (*state
)->expire
= time_second
;
4196 if (src
->state
== PFUDPS_MULTIPLE
&& dst
->state
== PFUDPS_MULTIPLE
)
4197 (*state
)->timeout
= PFTM_UDP_MULTIPLE
;
4199 (*state
)->timeout
= PFTM_UDP_SINGLE
;
4201 /* translate source/destination address, if necessary */
4202 if (STATE_TRANSLATE(*state
)) {
4203 if (direction
== PF_OUT
)
4204 pf_change_ap(pd
->src
, &uh
->uh_sport
, pd
->ip_sum
,
4205 &uh
->uh_sum
, &(*state
)->gwy
.addr
,
4206 (*state
)->gwy
.port
, 1, pd
->af
);
4208 pf_change_ap(pd
->dst
, &uh
->uh_dport
, pd
->ip_sum
,
4209 &uh
->uh_sum
, &(*state
)->lan
.addr
,
4210 (*state
)->lan
.port
, 1, pd
->af
);
4211 m_copyback(m
, off
, sizeof(*uh
), (caddr_t
)uh
);
4218 pf_test_state_icmp(struct pf_state
**state
, int direction
, struct pfi_kif
*kif
,
4219 struct mbuf
*m
, int off
, void *h
, struct pf_pdesc
*pd
)
4221 struct pf_addr
*saddr
= pd
->src
, *daddr
= pd
->dst
;
4222 u_int16_t icmpid
= 0;
4223 u_int16_t
*icmpsum
= NULL
;
4224 u_int8_t icmptype
= 0;
4227 switch (pd
->proto
) {
4230 icmptype
= pd
->hdr
.icmp
->icmp_type
;
4231 icmpid
= pd
->hdr
.icmp
->icmp_id
;
4232 icmpsum
= &pd
->hdr
.icmp
->icmp_cksum
;
4234 if (icmptype
== ICMP_UNREACH
||
4235 icmptype
== ICMP_SOURCEQUENCH
||
4236 icmptype
== ICMP_REDIRECT
||
4237 icmptype
== ICMP_TIMXCEED
||
4238 icmptype
== ICMP_PARAMPROB
)
4243 case IPPROTO_ICMPV6
:
4244 icmptype
= pd
->hdr
.icmp6
->icmp6_type
;
4245 icmpid
= pd
->hdr
.icmp6
->icmp6_id
;
4246 icmpsum
= &pd
->hdr
.icmp6
->icmp6_cksum
;
4248 if (icmptype
== ICMP6_DST_UNREACH
||
4249 icmptype
== ICMP6_PACKET_TOO_BIG
||
4250 icmptype
== ICMP6_TIME_EXCEEDED
||
4251 icmptype
== ICMP6_PARAM_PROB
)
4260 * ICMP query/reply message not related to a TCP/UDP packet.
4261 * Search for an ICMP state.
4263 struct pf_state key
;
4266 key
.proto
= pd
->proto
;
4267 if (direction
== PF_IN
) {
4268 PF_ACPY(&key
.ext
.addr
, pd
->src
, key
.af
);
4269 PF_ACPY(&key
.gwy
.addr
, pd
->dst
, key
.af
);
4270 key
.ext
.port
= icmpid
;
4271 key
.gwy
.port
= icmpid
;
4273 PF_ACPY(&key
.lan
.addr
, pd
->src
, key
.af
);
4274 PF_ACPY(&key
.ext
.addr
, pd
->dst
, key
.af
);
4275 key
.lan
.port
= icmpid
;
4276 key
.ext
.port
= icmpid
;
4281 (*state
)->expire
= time_second
;
4282 (*state
)->timeout
= PFTM_ICMP_ERROR_REPLY
;
4284 /* translate source/destination address, if necessary */
4285 if (PF_ANEQ(&(*state
)->lan
.addr
, &(*state
)->gwy
.addr
, pd
->af
)) {
4286 if (direction
== PF_OUT
) {
4290 pf_change_a(&saddr
->v4
.s_addr
,
4292 (*state
)->gwy
.addr
.v4
.s_addr
, 0);
4298 &pd
->hdr
.icmp6
->icmp6_cksum
,
4299 &(*state
)->gwy
.addr
, 0);
4301 sizeof(struct icmp6_hdr
),
4302 (caddr_t
)pd
->hdr
.icmp6
);
4310 pf_change_a(&daddr
->v4
.s_addr
,
4312 (*state
)->lan
.addr
.v4
.s_addr
, 0);
4318 &pd
->hdr
.icmp6
->icmp6_cksum
,
4319 &(*state
)->lan
.addr
, 0);
4321 sizeof(struct icmp6_hdr
),
4322 (caddr_t
)pd
->hdr
.icmp6
);
4333 * ICMP error message in response to a TCP/UDP packet.
4334 * Extract the inner TCP/UDP header and search for that state.
4337 struct pf_pdesc pd2
;
4342 struct ip6_hdr h2_6
;
4352 /* offset of h2 in mbuf chain */
4353 ipoff2
= off
+ ICMP_MINLEN
;
4355 if (!pf_pull_hdr(m
, ipoff2
, &h2
, sizeof(h2
),
4356 NULL
, NULL
, pd2
.af
)) {
4357 DPFPRINTF(PF_DEBUG_MISC
,
4358 ("pf: ICMP error message too short "
4363 * ICMP error messages don't refer to non-first
4367 * Note: We are dealing with an encapsulated
4368 * header. This means ip_off/ip_len are not
4369 * in host byte order!
4371 if (h2
.ip_off
& htons(IP_OFFMASK
))
4374 /* offset of protocol header that follows h2 */
4375 off2
= ipoff2
+ (h2
.ip_hl
<< 2);
4377 pd2
.proto
= h2
.ip_p
;
4378 pd2
.src
= (struct pf_addr
*)&h2
.ip_src
;
4379 pd2
.dst
= (struct pf_addr
*)&h2
.ip_dst
;
4380 pd2
.ip_sum
= &h2
.ip_sum
;
4385 ipoff2
= off
+ sizeof(struct icmp6_hdr
);
4387 if (!pf_pull_hdr(m
, ipoff2
, &h2_6
, sizeof(h2_6
),
4388 NULL
, NULL
, pd2
.af
)) {
4389 DPFPRINTF(PF_DEBUG_MISC
,
4390 ("pf: ICMP error message too short "
4394 pd2
.proto
= h2_6
.ip6_nxt
;
4395 pd2
.src
= (struct pf_addr
*)&h2_6
.ip6_src
;
4396 pd2
.dst
= (struct pf_addr
*)&h2_6
.ip6_dst
;
4398 off2
= ipoff2
+ sizeof(h2_6
);
4400 switch (pd2
.proto
) {
4401 case IPPROTO_FRAGMENT
:
4403 * ICMPv6 error messages for
4404 * non-first fragments
4408 case IPPROTO_HOPOPTS
:
4409 case IPPROTO_ROUTING
:
4410 case IPPROTO_DSTOPTS
: {
4411 /* get next header and header length */
4412 struct ip6_ext opt6
;
4414 if (!pf_pull_hdr(m
, off2
, &opt6
,
4415 sizeof(opt6
), NULL
, NULL
, pd2
.af
)) {
4416 DPFPRINTF(PF_DEBUG_MISC
,
4417 ("pf: ICMPv6 short opt\n"));
4420 if (pd2
.proto
== IPPROTO_AH
)
4421 off2
+= (opt6
.ip6e_len
+ 2) * 4;
4423 off2
+= (opt6
.ip6e_len
+ 1) * 8;
4424 pd2
.proto
= opt6
.ip6e_nxt
;
4425 /* goto the next header */
4432 } while (!terminal
);
4437 switch (pd2
.proto
) {
4441 struct pf_state key
;
4442 struct pf_state_peer
*src
, *dst
;
4447 * Only the first 8 bytes of the TCP header can be
4448 * expected. Don't access any TCP header fields after
4449 * th_seq, an ackskew test is not possible.
4451 if (!pf_pull_hdr(m
, off2
, &th
, 8, NULL
, NULL
, pd2
.af
)) {
4452 DPFPRINTF(PF_DEBUG_MISC
,
4453 ("pf: ICMP error message too short "
4459 key
.proto
= IPPROTO_TCP
;
4460 if (direction
== PF_IN
) {
4461 PF_ACPY(&key
.ext
.addr
, pd2
.dst
, key
.af
);
4462 PF_ACPY(&key
.gwy
.addr
, pd2
.src
, key
.af
);
4463 key
.ext
.port
= th
.th_dport
;
4464 key
.gwy
.port
= th
.th_sport
;
4466 PF_ACPY(&key
.lan
.addr
, pd2
.dst
, key
.af
);
4467 PF_ACPY(&key
.ext
.addr
, pd2
.src
, key
.af
);
4468 key
.lan
.port
= th
.th_dport
;
4469 key
.ext
.port
= th
.th_sport
;
4474 if (direction
== (*state
)->direction
) {
4475 src
= &(*state
)->dst
;
4476 dst
= &(*state
)->src
;
4478 src
= &(*state
)->src
;
4479 dst
= &(*state
)->dst
;
4482 if (src
->wscale
&& dst
->wscale
&&
4483 !(th
.th_flags
& TH_SYN
))
4484 dws
= dst
->wscale
& PF_WSCALE_MASK
;
4488 /* Demodulate sequence number */
4489 seq
= ntohl(th
.th_seq
) - src
->seqdiff
;
4491 pf_change_a(&th
.th_seq
, icmpsum
,
4496 if (!SEQ_GEQ(src
->seqhi
, seq
) ||
4497 !SEQ_GEQ(seq
, src
->seqlo
- (dst
->max_win
<< dws
))) {
4498 if (pf_status
.debug
>= PF_DEBUG_MISC
) {
4499 kprintf("pf: BAD ICMP %d:%d ",
4500 icmptype
, pd
->hdr
.icmp
->icmp_code
);
4501 pf_print_host(pd
->src
, 0, pd
->af
);
4503 pf_print_host(pd
->dst
, 0, pd
->af
);
4504 kprintf(" state: ");
4505 pf_print_state(*state
);
4506 kprintf(" seq=%u\n", seq
);
4511 if (STATE_TRANSLATE(*state
)) {
4512 if (direction
== PF_IN
) {
4513 pf_change_icmp(pd2
.src
, &th
.th_sport
,
4514 daddr
, &(*state
)->lan
.addr
,
4515 (*state
)->lan
.port
, NULL
,
4516 pd2
.ip_sum
, icmpsum
,
4517 pd
->ip_sum
, 0, pd2
.af
);
4519 pf_change_icmp(pd2
.dst
, &th
.th_dport
,
4520 saddr
, &(*state
)->gwy
.addr
,
4521 (*state
)->gwy
.port
, NULL
,
4522 pd2
.ip_sum
, icmpsum
,
4523 pd
->ip_sum
, 0, pd2
.af
);
4532 m_copyback(m
, off
, ICMP_MINLEN
,
4533 (caddr_t
)pd
->hdr
.icmp
);
4534 m_copyback(m
, ipoff2
, sizeof(h2
),
4541 sizeof(struct icmp6_hdr
),
4542 (caddr_t
)pd
->hdr
.icmp6
);
4543 m_copyback(m
, ipoff2
, sizeof(h2_6
),
4548 m_copyback(m
, off2
, 8, (caddr_t
)&th
);
4556 struct pf_state key
;
4558 if (!pf_pull_hdr(m
, off2
, &uh
, sizeof(uh
),
4559 NULL
, NULL
, pd2
.af
)) {
4560 DPFPRINTF(PF_DEBUG_MISC
,
4561 ("pf: ICMP error message too short "
4567 key
.proto
= IPPROTO_UDP
;
4568 if (direction
== PF_IN
) {
4569 PF_ACPY(&key
.ext
.addr
, pd2
.dst
, key
.af
);
4570 PF_ACPY(&key
.gwy
.addr
, pd2
.src
, key
.af
);
4571 key
.ext
.port
= uh
.uh_dport
;
4572 key
.gwy
.port
= uh
.uh_sport
;
4574 PF_ACPY(&key
.lan
.addr
, pd2
.dst
, key
.af
);
4575 PF_ACPY(&key
.ext
.addr
, pd2
.src
, key
.af
);
4576 key
.lan
.port
= uh
.uh_dport
;
4577 key
.ext
.port
= uh
.uh_sport
;
4582 if (STATE_TRANSLATE(*state
)) {
4583 if (direction
== PF_IN
) {
4584 pf_change_icmp(pd2
.src
, &uh
.uh_sport
,
4585 daddr
, &(*state
)->lan
.addr
,
4586 (*state
)->lan
.port
, &uh
.uh_sum
,
4587 pd2
.ip_sum
, icmpsum
,
4588 pd
->ip_sum
, 1, pd2
.af
);
4590 pf_change_icmp(pd2
.dst
, &uh
.uh_dport
,
4591 saddr
, &(*state
)->gwy
.addr
,
4592 (*state
)->gwy
.port
, &uh
.uh_sum
,
4593 pd2
.ip_sum
, icmpsum
,
4594 pd
->ip_sum
, 1, pd2
.af
);
4599 m_copyback(m
, off
, ICMP_MINLEN
,
4600 (caddr_t
)pd
->hdr
.icmp
);
4601 m_copyback(m
, ipoff2
, sizeof(h2
), (caddr_t
)&h2
);
4607 sizeof(struct icmp6_hdr
),
4608 (caddr_t
)pd
->hdr
.icmp6
);
4609 m_copyback(m
, ipoff2
, sizeof(h2_6
),
4614 m_copyback(m
, off2
, sizeof(uh
), (caddr_t
)&uh
);
4621 case IPPROTO_ICMP
: {
4623 struct pf_state key
;
4625 if (!pf_pull_hdr(m
, off2
, &iih
, ICMP_MINLEN
,
4626 NULL
, NULL
, pd2
.af
)) {
4627 DPFPRINTF(PF_DEBUG_MISC
,
4628 ("pf: ICMP error message too short i"
4634 key
.proto
= IPPROTO_ICMP
;
4635 if (direction
== PF_IN
) {
4636 PF_ACPY(&key
.ext
.addr
, pd2
.dst
, key
.af
);
4637 PF_ACPY(&key
.gwy
.addr
, pd2
.src
, key
.af
);
4638 key
.ext
.port
= iih
.icmp_id
;
4639 key
.gwy
.port
= iih
.icmp_id
;
4641 PF_ACPY(&key
.lan
.addr
, pd2
.dst
, key
.af
);
4642 PF_ACPY(&key
.ext
.addr
, pd2
.src
, key
.af
);
4643 key
.lan
.port
= iih
.icmp_id
;
4644 key
.ext
.port
= iih
.icmp_id
;
4649 if (STATE_TRANSLATE(*state
)) {
4650 if (direction
== PF_IN
) {
4651 pf_change_icmp(pd2
.src
, &iih
.icmp_id
,
4652 daddr
, &(*state
)->lan
.addr
,
4653 (*state
)->lan
.port
, NULL
,
4654 pd2
.ip_sum
, icmpsum
,
4655 pd
->ip_sum
, 0, AF_INET
);
4657 pf_change_icmp(pd2
.dst
, &iih
.icmp_id
,
4658 saddr
, &(*state
)->gwy
.addr
,
4659 (*state
)->gwy
.port
, NULL
,
4660 pd2
.ip_sum
, icmpsum
,
4661 pd
->ip_sum
, 0, AF_INET
);
4663 m_copyback(m
, off
, ICMP_MINLEN
, (caddr_t
)pd
->hdr
.icmp
);
4664 m_copyback(m
, ipoff2
, sizeof(h2
), (caddr_t
)&h2
);
4665 m_copyback(m
, off2
, ICMP_MINLEN
, (caddr_t
)&iih
);
4673 case IPPROTO_ICMPV6
: {
4674 struct icmp6_hdr iih
;
4675 struct pf_state key
;
4677 if (!pf_pull_hdr(m
, off2
, &iih
,
4678 sizeof(struct icmp6_hdr
), NULL
, NULL
, pd2
.af
)) {
4679 DPFPRINTF(PF_DEBUG_MISC
,
4680 ("pf: ICMP error message too short "
4686 key
.proto
= IPPROTO_ICMPV6
;
4687 if (direction
== PF_IN
) {
4688 PF_ACPY(&key
.ext
.addr
, pd2
.dst
, key
.af
);
4689 PF_ACPY(&key
.gwy
.addr
, pd2
.src
, key
.af
);
4690 key
.ext
.port
= iih
.icmp6_id
;
4691 key
.gwy
.port
= iih
.icmp6_id
;
4693 PF_ACPY(&key
.lan
.addr
, pd2
.dst
, key
.af
);
4694 PF_ACPY(&key
.ext
.addr
, pd2
.src
, key
.af
);
4695 key
.lan
.port
= iih
.icmp6_id
;
4696 key
.ext
.port
= iih
.icmp6_id
;
4701 if (STATE_TRANSLATE(*state
)) {
4702 if (direction
== PF_IN
) {
4703 pf_change_icmp(pd2
.src
, &iih
.icmp6_id
,
4704 daddr
, &(*state
)->lan
.addr
,
4705 (*state
)->lan
.port
, NULL
,
4706 pd2
.ip_sum
, icmpsum
,
4707 pd
->ip_sum
, 0, AF_INET6
);
4709 pf_change_icmp(pd2
.dst
, &iih
.icmp6_id
,
4710 saddr
, &(*state
)->gwy
.addr
,
4711 (*state
)->gwy
.port
, NULL
,
4712 pd2
.ip_sum
, icmpsum
,
4713 pd
->ip_sum
, 0, AF_INET6
);
4715 m_copyback(m
, off
, sizeof(struct icmp6_hdr
),
4716 (caddr_t
)pd
->hdr
.icmp6
);
4717 m_copyback(m
, ipoff2
, sizeof(h2_6
), (caddr_t
)&h2_6
);
4718 m_copyback(m
, off2
, sizeof(struct icmp6_hdr
),
4727 struct pf_state key
;
4730 key
.proto
= pd2
.proto
;
4731 if (direction
== PF_IN
) {
4732 PF_ACPY(&key
.ext
.addr
, pd2
.dst
, key
.af
);
4733 PF_ACPY(&key
.gwy
.addr
, pd2
.src
, key
.af
);
4737 PF_ACPY(&key
.lan
.addr
, pd2
.dst
, key
.af
);
4738 PF_ACPY(&key
.ext
.addr
, pd2
.src
, key
.af
);
4745 if (STATE_TRANSLATE(*state
)) {
4746 if (direction
== PF_IN
) {
4747 pf_change_icmp(pd2
.src
, NULL
,
4748 daddr
, &(*state
)->lan
.addr
,
4750 pd2
.ip_sum
, icmpsum
,
4751 pd
->ip_sum
, 0, pd2
.af
);
4753 pf_change_icmp(pd2
.dst
, NULL
,
4754 saddr
, &(*state
)->gwy
.addr
,
4756 pd2
.ip_sum
, icmpsum
,
4757 pd
->ip_sum
, 0, pd2
.af
);
4762 m_copyback(m
, off
, ICMP_MINLEN
,
4763 (caddr_t
)pd
->hdr
.icmp
);
4764 m_copyback(m
, ipoff2
, sizeof(h2
), (caddr_t
)&h2
);
4770 sizeof(struct icmp6_hdr
),
4771 (caddr_t
)pd
->hdr
.icmp6
);
4772 m_copyback(m
, ipoff2
, sizeof(h2_6
),
4787 pf_test_state_other(struct pf_state
**state
, int direction
, struct pfi_kif
*kif
,
4788 struct pf_pdesc
*pd
)
4790 struct pf_state_peer
*src
, *dst
;
4791 struct pf_state key
;
4794 key
.proto
= pd
->proto
;
4795 if (direction
== PF_IN
) {
4796 PF_ACPY(&key
.ext
.addr
, pd
->src
, key
.af
);
4797 PF_ACPY(&key
.gwy
.addr
, pd
->dst
, key
.af
);
4801 PF_ACPY(&key
.lan
.addr
, pd
->src
, key
.af
);
4802 PF_ACPY(&key
.ext
.addr
, pd
->dst
, key
.af
);
4809 if (direction
== (*state
)->direction
) {
4810 src
= &(*state
)->src
;
4811 dst
= &(*state
)->dst
;
4813 src
= &(*state
)->dst
;
4814 dst
= &(*state
)->src
;
4818 if (src
->state
< PFOTHERS_SINGLE
)
4819 src
->state
= PFOTHERS_SINGLE
;
4820 if (dst
->state
== PFOTHERS_SINGLE
)
4821 dst
->state
= PFOTHERS_MULTIPLE
;
4823 /* update expire time */
4824 (*state
)->expire
= time_second
;
4825 if (src
->state
== PFOTHERS_MULTIPLE
&& dst
->state
== PFOTHERS_MULTIPLE
)
4826 (*state
)->timeout
= PFTM_OTHER_MULTIPLE
;
4828 (*state
)->timeout
= PFTM_OTHER_SINGLE
;
4830 /* translate source/destination address, if necessary */
4831 if (STATE_TRANSLATE(*state
)) {
4832 if (direction
== PF_OUT
)
4836 pf_change_a(&pd
->src
->v4
.s_addr
,
4837 pd
->ip_sum
, (*state
)->gwy
.addr
.v4
.s_addr
,
4843 PF_ACPY(pd
->src
, &(*state
)->gwy
.addr
, pd
->af
);
4851 pf_change_a(&pd
->dst
->v4
.s_addr
,
4852 pd
->ip_sum
, (*state
)->lan
.addr
.v4
.s_addr
,
4858 PF_ACPY(pd
->dst
, &(*state
)->lan
.addr
, pd
->af
);
4868 * ipoff and off are measured from the start of the mbuf chain.
4869 * h must be at "ipoff" on the mbuf chain.
4872 pf_pull_hdr(struct mbuf
*m
, int off
, void *p
, int len
,
4873 u_short
*actionp
, u_short
*reasonp
, sa_family_t af
)
4878 struct ip
*h
= mtod(m
, struct ip
*);
4879 u_int16_t fragoff
= (h
->ip_off
& IP_OFFMASK
) << 3;
4883 ACTION_SET(actionp
, PF_PASS
);
4885 ACTION_SET(actionp
, PF_DROP
);
4886 REASON_SET(reasonp
, PFRES_FRAG
);
4890 if (m
->m_pkthdr
.len
< off
+ len
||
4891 h
->ip_len
< off
+ len
) {
4892 ACTION_SET(actionp
, PF_DROP
);
4893 REASON_SET(reasonp
, PFRES_SHORT
);
4901 struct ip6_hdr
*h
= mtod(m
, struct ip6_hdr
*);
4903 if (m
->m_pkthdr
.len
< off
+ len
||
4904 (ntohs(h
->ip6_plen
) + sizeof(struct ip6_hdr
)) <
4905 (unsigned)(off
+ len
)) {
4906 ACTION_SET(actionp
, PF_DROP
);
4907 REASON_SET(reasonp
, PFRES_SHORT
);
4914 m_copydata(m
, off
, len
, p
);
4919 pf_routable(struct pf_addr
*addr
, sa_family_t af
)
4921 struct sockaddr_in
*dst
;
4925 bzero(&ro
, sizeof(ro
));
4926 dst
= satosin(&ro
.ro_dst
);
4927 dst
->sin_family
= af
;
4928 dst
->sin_len
= sizeof(*dst
);
4929 dst
->sin_addr
= addr
->v4
;
4930 rtalloc_ign(&ro
, (RTF_CLONING
| RTF_PRCLONING
));
4932 if (ro
.ro_rt
!= NULL
) {
4942 pf_route(struct mbuf
**m
, struct pf_rule
*r
, int dir
, struct ifnet
*oifp
,
4945 struct mbuf
*m0
, *m1
;
4946 struct route iproute
;
4947 struct route
*ro
= NULL
;
4948 struct sockaddr_in
*dst
;
4950 struct ifnet
*ifp
= NULL
;
4951 struct pf_addr naddr
;
4952 struct pf_src_node
*sn
= NULL
;
4956 if (m
== NULL
|| *m
== NULL
|| r
== NULL
||
4957 (dir
!= PF_IN
&& dir
!= PF_OUT
) || oifp
== NULL
)
4958 panic("pf_route: invalid parameters");
4960 if (((*m
)->m_pkthdr
.fw_flags
& PF_MBUF_ROUTED
) == 0) {
4961 (*m
)->m_pkthdr
.fw_flags
|= PF_MBUF_ROUTED
;
4962 (*m
)->m_pkthdr
.pf_routed
= 1;
4964 if ((*m
)->m_pkthdr
.pf_routed
> 3) {
4969 (*m
)->m_pkthdr
.pf_routed
++;
4972 if (r
->rt
== PF_DUPTO
) {
4973 if ((m0
= m_dup(*m
, MB_DONTWAIT
)) == NULL
)
4976 if ((r
->rt
== PF_REPLYTO
) == (r
->direction
== dir
))
4981 if (m0
->m_len
< sizeof(struct ip
))
4982 panic("pf_route: m0->m_len < sizeof(struct ip)");
4983 ip
= mtod(m0
, struct ip
*);
4986 bzero((caddr_t
)ro
, sizeof(*ro
));
4987 dst
= satosin(&ro
->ro_dst
);
4988 dst
->sin_family
= AF_INET
;
4989 dst
->sin_len
= sizeof(*dst
);
4990 dst
->sin_addr
= ip
->ip_dst
;
4992 if (r
->rt
== PF_FASTROUTE
) {
4994 if (ro
->ro_rt
== 0) {
4995 ipstat
.ips_noroute
++;
4999 ifp
= ro
->ro_rt
->rt_ifp
;
5000 ro
->ro_rt
->rt_use
++;
5002 if (ro
->ro_rt
->rt_flags
& RTF_GATEWAY
)
5003 dst
= satosin(ro
->ro_rt
->rt_gateway
);
5005 if (TAILQ_EMPTY(&r
->rpool
.list
))
5006 panic("pf_route: TAILQ_EMPTY(&r->rpool.list)");
5008 pf_map_addr(AF_INET
, r
, (struct pf_addr
*)&ip
->ip_src
,
5010 if (!PF_AZERO(&naddr
, AF_INET
))
5011 dst
->sin_addr
.s_addr
= naddr
.v4
.s_addr
;
5012 ifp
= r
->rpool
.cur
->kif
?
5013 r
->rpool
.cur
->kif
->pfik_ifp
: NULL
;
5015 if (!PF_AZERO(&s
->rt_addr
, AF_INET
))
5016 dst
->sin_addr
.s_addr
=
5017 s
->rt_addr
.v4
.s_addr
;
5018 ifp
= s
->rt_kif
? s
->rt_kif
->pfik_ifp
: NULL
;
5025 if (pf_test(PF_OUT
, ifp
, &m0
) != PF_PASS
)
5027 else if (m0
== NULL
)
5029 if (m0
->m_len
< sizeof(struct ip
))
5030 panic("pf_route: m0->m_len < sizeof(struct ip)");
5031 ip
= mtod(m0
, struct ip
*);
5034 /* Copied from ip_output. */
5035 m0
->m_pkthdr
.csum_flags
|= CSUM_IP
;
5036 sw_csum
= m0
->m_pkthdr
.csum_flags
& ~ifp
->if_hwassist
;
5037 if (sw_csum
& CSUM_DELAY_DATA
) {
5038 in_delayed_cksum(m0
);
5039 sw_csum
&= ~CSUM_DELAY_DATA
;
5041 m0
->m_pkthdr
.csum_flags
&= ifp
->if_hwassist
;
5044 * If small enough for interface, or the interface will take
5045 * care of the fragmentation for us, can just send directly.
5047 if (ip
->ip_len
<= ifp
->if_mtu
|| ((ifp
->if_hwassist
& CSUM_FRAGMENT
) &&
5048 (ip
->ip_off
& IP_DF
) == 0)) {
5049 ip
->ip_len
= htons(ip
->ip_len
);
5050 ip
->ip_off
= htons(ip
->ip_off
);
5052 if (sw_csum
& CSUM_DELAY_IP
) {
5054 if (ip
->ip_v
== IPVERSION
&&
5055 (ip
->ip_hl
<< 2) == sizeof(*ip
)) {
5056 ip
->ip_sum
= in_cksum_hdr(ip
);
5058 ip
->ip_sum
= in_cksum(m0
, ip
->ip_hl
<< 2);
5062 error
= ifp
->if_output(ifp
, m0
, sintosa(dst
), ro
->ro_rt
);
5067 * Too large for interface; fragment if possible.
5068 * Must be able to put at least 8 bytes per fragment.
5070 if (ip
->ip_off
& IP_DF
) {
5071 ipstat
.ips_cantfrag
++;
5072 if (r
->rt
!= PF_DUPTO
) {
5073 icmp_error(m0
, ICMP_UNREACH
, ICMP_UNREACH_NEEDFRAG
, 0,
5081 error
= ip_fragment(ip
, &m0
, ifp
->if_mtu
, ifp
->if_hwassist
, sw_csum
);
5085 for (m0
= m1
; m0
; m0
= m1
) {
5089 error
= ifp
->if_output(ifp
, m0
, sintosa(dst
), NULL
);
5096 ipstat
.ips_fragmented
++;
5099 if (r
->rt
!= PF_DUPTO
)
5101 if (ro
== &iproute
&& ro
->ro_rt
)
5113 pf_route6(struct mbuf
**m
, struct pf_rule
*r
, int dir
, struct ifnet
*oifp
,
5117 struct route_in6 ip6route
;
5118 struct route_in6
*ro
;
5119 struct sockaddr_in6
*dst
;
5120 struct ip6_hdr
*ip6
;
5121 struct ifnet
*ifp
= NULL
;
5122 struct pf_addr naddr
;
5123 struct pf_src_node
*sn
= NULL
;
5126 if (m
== NULL
|| *m
== NULL
|| r
== NULL
||
5127 (dir
!= PF_IN
&& dir
!= PF_OUT
) || oifp
== NULL
)
5128 panic("pf_route6: invalid parameters");
5130 if (((*m
)->m_pkthdr
.fw_flags
& PF_MBUF_ROUTED
) == 0) {
5131 (*m
)->m_pkthdr
.fw_flags
|= PF_MBUF_ROUTED
;
5132 (*m
)->m_pkthdr
.pf_routed
= 1;
5134 if ((*m
)->m_pkthdr
.pf_routed
> 3) {
5139 (*m
)->m_pkthdr
.pf_routed
++;
5142 if (r
->rt
== PF_DUPTO
) {
5143 if ((m0
= m_dup(*m
, MB_DONTWAIT
)) == NULL
)
5146 if ((r
->rt
== PF_REPLYTO
) == (r
->direction
== dir
))
5151 if (m0
->m_len
< sizeof(struct ip6_hdr
))
5152 panic("pf_route6: m0->m_len < sizeof(struct ip6_hdr)");
5153 ip6
= mtod(m0
, struct ip6_hdr
*);
5156 bzero((caddr_t
)ro
, sizeof(*ro
));
5157 dst
= (struct sockaddr_in6
*)&ro
->ro_dst
;
5158 dst
->sin6_family
= AF_INET6
;
5159 dst
->sin6_len
= sizeof(*dst
);
5160 dst
->sin6_addr
= ip6
->ip6_dst
;
5163 if (r
->rt
== PF_FASTROUTE
) {
5164 m0
->m_pkthdr
.fw_flags
|= PF_MBUF_GENERATED
;
5165 ip6_output(m0
, NULL
, NULL
, 0, NULL
, NULL
, NULL
);
5169 if (TAILQ_EMPTY(&r
->rpool
.list
))
5170 panic("pf_route6: TAILQ_EMPTY(&r->rpool.list)");
5172 pf_map_addr(AF_INET6
, r
, (struct pf_addr
*)&ip6
->ip6_src
,
5174 if (!PF_AZERO(&naddr
, AF_INET6
))
5175 PF_ACPY((struct pf_addr
*)&dst
->sin6_addr
,
5177 ifp
= r
->rpool
.cur
->kif
? r
->rpool
.cur
->kif
->pfik_ifp
: NULL
;
5179 if (!PF_AZERO(&s
->rt_addr
, AF_INET6
))
5180 PF_ACPY((struct pf_addr
*)&dst
->sin6_addr
,
5181 &s
->rt_addr
, AF_INET6
);
5182 ifp
= s
->rt_kif
? s
->rt_kif
->pfik_ifp
: NULL
;
5188 if (pf_test6(PF_OUT
, ifp
, &m0
) != PF_PASS
)
5190 else if (m0
== NULL
)
5192 if (m0
->m_len
< sizeof(struct ip6_hdr
))
5193 panic("pf_route6: m0->m_len < sizeof(struct ip6_hdr)");
5194 ip6
= mtod(m0
, struct ip6_hdr
*);
5198 * If the packet is too large for the outgoing interface,
5199 * send back an icmp6 error.
5201 if (IN6_IS_ADDR_LINKLOCAL(&dst
->sin6_addr
))
5202 dst
->sin6_addr
.s6_addr16
[1] = htons(ifp
->if_index
);
5203 if ((u_long
)m0
->m_pkthdr
.len
<= ifp
->if_mtu
) {
5204 error
= nd6_output(ifp
, ifp
, m0
, dst
, NULL
);
5206 in6_ifstat_inc(ifp
, ifs6_in_toobig
);
5207 if (r
->rt
!= PF_DUPTO
)
5208 icmp6_error(m0
, ICMP6_PACKET_TOO_BIG
, 0, ifp
->if_mtu
);
5214 if (r
->rt
!= PF_DUPTO
)
5226 * check protocol (tcp/udp/icmp/icmp6) checksum and set mbuf flag
5227 * off is the offset where the protocol header starts
5228 * len is the total length of protocol header plus payload
5229 * returns 0 when the checksum is valid, otherwise returns 1.
5233 * FreeBSD supports cksum offload for the following drivers.
5234 * em(4), gx(4), lge(4), nge(4), ti(4), xl(4)
5235 * If we can make full use of it we would outperform ipfw/ipfilter in
5236 * very heavy traffic.
5237 * I have not tested 'cause I don't have NICs that supports cksum offload.
5238 * (There might be problems. Typical phenomena would be
5239 * 1. No route message for UDP packet.
5240 * 2. No connection acceptance from external hosts regardless of rule set.)
5243 pf_check_proto_cksum(struct mbuf
*m
, int off
, int len
, u_int8_t p
,
5250 if (off
< sizeof(struct ip
) || len
< sizeof(struct udphdr
))
5252 if (m
->m_pkthdr
.len
< off
+ len
)
5258 if (m
->m_pkthdr
.csum_flags
& CSUM_DATA_VALID
) {
5259 if (m
->m_pkthdr
.csum_flags
& CSUM_PSEUDO_HDR
) {
5260 sum
= m
->m_pkthdr
.csum_data
;
5262 ip
= mtod(m
, struct ip
*);
5263 sum
= in_pseudo(ip
->ip_src
.s_addr
,
5264 ip
->ip_dst
.s_addr
, htonl((u_short
)len
+
5265 m
->m_pkthdr
.csum_data
+ p
));
5273 case IPPROTO_ICMPV6
:
5283 if (p
== IPPROTO_ICMP
) {
5288 sum
= in_cksum(m
, len
);
5292 if (m
->m_len
< sizeof(struct ip
))
5294 sum
= in_cksum_range(m
, p
, off
, len
);
5296 m
->m_pkthdr
.csum_flags
|=
5299 m
->m_pkthdr
.csum_data
= 0xffff;
5305 if (m
->m_len
< sizeof(struct ip6_hdr
))
5307 sum
= in6_cksum(m
, p
, off
, len
);
5310 * IPv6 H/W cksum off-load not supported yet!
5313 * m->m_pkthdr.csum_flags |=
5314 * (CSUM_DATA_VALID|CSUM_PSEUDO_HDR);
5315 * m->m_pkthdr.csum_data = 0xffff;
5327 tcpstat
.tcps_rcvbadsum
++;
5330 udpstat
.udps_badsum
++;
5333 icmpstat
.icps_checksum
++;
5336 case IPPROTO_ICMPV6
:
5337 icmp6stat
.icp6s_checksum
++;
5348 pf_test(int dir
, struct ifnet
*ifp
, struct mbuf
**m0
)
5350 struct pfi_kif
*kif
;
5351 u_short action
, reason
= 0, log
= 0;
5352 struct mbuf
*m
= *m0
;
5353 struct ip
*h
= NULL
;
5354 struct pf_rule
*a
= NULL
, *r
= &pf_default_rule
, *tr
, *nr
;
5355 struct pf_state
*s
= NULL
;
5356 struct pf_ruleset
*ruleset
= NULL
;
5358 int off
, dirndx
, pqid
= 0;
5360 if (!pf_status
.running
|| (m
->m_pkthdr
.fw_flags
& PF_MBUF_GENERATED
))
5363 kif
= pfi_index2kif
[ifp
->if_index
];
5368 if ((m
->m_flags
& M_PKTHDR
) == 0)
5369 panic("non-M_PKTHDR is passed to pf_test");
5372 memset(&pd
, 0, sizeof(pd
));
5373 if (m
->m_pkthdr
.len
< (int)sizeof(*h
)) {
5375 REASON_SET(&reason
, PFRES_SHORT
);
5380 /* We do IP header normalization and packet reassembly here */
5381 if (pf_normalize_ip(m0
, dir
, kif
, &reason
) != PF_PASS
) {
5386 h
= mtod(m
, struct ip
*);
5388 off
= h
->ip_hl
<< 2;
5389 if (off
< (int)sizeof(*h
)) {
5391 REASON_SET(&reason
, PFRES_SHORT
);
5396 pd
.src
= (struct pf_addr
*)&h
->ip_src
;
5397 pd
.dst
= (struct pf_addr
*)&h
->ip_dst
;
5398 PF_ACPY(&pd
.baddr
, dir
== PF_OUT
? pd
.src
: pd
.dst
, AF_INET
);
5399 pd
.ip_sum
= &h
->ip_sum
;
5403 pd
.tot_len
= h
->ip_len
;
5405 /* handle fragments that didn't get reassembled by normalization */
5406 if (h
->ip_off
& (IP_MF
| IP_OFFMASK
)) {
5407 action
= pf_test_fragment(&r
, dir
, kif
, m
, h
,
5418 if (!pf_pull_hdr(m
, off
, &th
, sizeof(th
),
5419 &action
, &reason
, AF_INET
)) {
5420 log
= action
!= PF_PASS
;
5423 if (dir
== PF_IN
&& pf_check_proto_cksum(m
, off
,
5424 h
->ip_len
- off
, IPPROTO_TCP
, AF_INET
)) {
5428 pd
.p_len
= pd
.tot_len
- off
- (th
.th_off
<< 2);
5429 if ((th
.th_flags
& TH_ACK
) && pd
.p_len
== 0)
5431 action
= pf_normalize_tcp(dir
, kif
, m
, 0, off
, h
, &pd
);
5432 if (action
== PF_DROP
)
5434 action
= pf_test_state_tcp(&s
, dir
, kif
, m
, off
, h
, &pd
,
5436 if (action
== PF_PASS
) {
5438 pfsync_update_state(s
);
5443 } else if (s
== NULL
)
5444 action
= pf_test_tcp(&r
, &s
, dir
, kif
,
5445 m
, off
, h
, &pd
, &a
, &ruleset
);
5453 if (!pf_pull_hdr(m
, off
, &uh
, sizeof(uh
),
5454 &action
, &reason
, AF_INET
)) {
5455 log
= action
!= PF_PASS
;
5458 if (dir
== PF_IN
&& uh
.uh_sum
&& pf_check_proto_cksum(m
,
5459 off
, h
->ip_len
- off
, IPPROTO_UDP
, AF_INET
)) {
5463 if (uh
.uh_dport
== 0 ||
5464 ntohs(uh
.uh_ulen
) > m
->m_pkthdr
.len
- off
||
5465 ntohs(uh
.uh_ulen
) < sizeof(struct udphdr
)) {
5469 action
= pf_test_state_udp(&s
, dir
, kif
, m
, off
, h
, &pd
);
5470 if (action
== PF_PASS
) {
5472 pfsync_update_state(s
);
5477 } else if (s
== NULL
)
5478 action
= pf_test_udp(&r
, &s
, dir
, kif
,
5479 m
, off
, h
, &pd
, &a
, &ruleset
);
5483 case IPPROTO_ICMP
: {
5487 if (!pf_pull_hdr(m
, off
, &ih
, ICMP_MINLEN
,
5488 &action
, &reason
, AF_INET
)) {
5489 log
= action
!= PF_PASS
;
5492 if (dir
== PF_IN
&& pf_check_proto_cksum(m
, off
,
5493 h
->ip_len
- off
, IPPROTO_ICMP
, AF_INET
)) {
5497 action
= pf_test_state_icmp(&s
, dir
, kif
, m
, off
, h
, &pd
);
5498 if (action
== PF_PASS
) {
5500 pfsync_update_state(s
);
5505 } else if (s
== NULL
)
5506 action
= pf_test_icmp(&r
, &s
, dir
, kif
,
5507 m
, off
, h
, &pd
, &a
, &ruleset
);
5512 action
= pf_test_state_other(&s
, dir
, kif
, &pd
);
5513 if (action
== PF_PASS
) {
5515 pfsync_update_state(s
);
5520 } else if (s
== NULL
)
5521 action
= pf_test_other(&r
, &s
, dir
, kif
, m
, off
, h
,
5527 if (action
== PF_PASS
&& h
->ip_hl
> 5 &&
5528 !((s
&& s
->allow_opts
) || r
->allow_opts
)) {
5530 REASON_SET(&reason
, PFRES_SHORT
);
5532 DPFPRINTF(PF_DEBUG_MISC
,
5533 ("pf: dropping packet with ip options\n"));
5537 if (action
== PF_PASS
&& r
->qid
) {
5538 m
->m_pkthdr
.fw_flags
|= ALTQ_MBUF_TAGGED
;
5539 if (pd
.tos
== IPTOS_LOWDELAY
)
5540 m
->m_pkthdr
.altq_qid
= r
->pqid
;
5542 m
->m_pkthdr
.altq_qid
= r
->qid
;
5544 KKASSERT(s
->hash
!= 0);
5545 m
->m_pkthdr
.fw_flags
|= ALTQ_MBUF_STATE_HASHED
;
5546 m
->m_pkthdr
.altq_state_hash
= s
->hash
;
5548 m
->m_pkthdr
.ecn_af
= AF_INET
;
5549 m
->m_pkthdr
.header
= h
;
5554 * connections redirected to loopback should not match sockets
5555 * bound specifically to loopback due to security implications,
5556 * see tcp_input() and in_pcblookup_listen().
5558 if (dir
== PF_IN
&& action
== PF_PASS
&& (pd
.proto
== IPPROTO_TCP
||
5559 pd
.proto
== IPPROTO_UDP
) && s
!= NULL
&& s
->nat_rule
.ptr
!= NULL
&&
5560 (s
->nat_rule
.ptr
->action
== PF_RDR
||
5561 s
->nat_rule
.ptr
->action
== PF_BINAT
) &&
5562 (ntohl(pd
.dst
->v4
.s_addr
) >> IN_CLASSA_NSHIFT
) == IN_LOOPBACKNET
) {
5564 REASON_SET(&reason
, PFRES_MEMORY
);
5567 m
->m_pkthdr
.fw_flags
|= PF_MBUF_TRANSLATE_LOCALHOST
;
5570 PFLOG_PACKET(kif
, h
, m
, AF_INET
, dir
, reason
, r
, a
, ruleset
);
5572 kif
->pfik_bytes
[0][dir
== PF_OUT
][action
!= PF_PASS
] += pd
.tot_len
;
5573 kif
->pfik_packets
[0][dir
== PF_OUT
][action
!= PF_PASS
]++;
5575 if (action
== PF_PASS
|| r
->action
== PF_DROP
) {
5577 r
->bytes
+= pd
.tot_len
;
5580 a
->bytes
+= pd
.tot_len
;
5583 dirndx
= (dir
== s
->direction
) ? 0 : 1;
5584 s
->packets
[dirndx
]++;
5585 s
->bytes
[dirndx
] += pd
.tot_len
;
5586 if (s
->nat_rule
.ptr
!= NULL
) {
5587 s
->nat_rule
.ptr
->packets
++;
5588 s
->nat_rule
.ptr
->bytes
+= pd
.tot_len
;
5590 if (s
->src_node
!= NULL
) {
5591 s
->src_node
->packets
++;
5592 s
->src_node
->bytes
+= pd
.tot_len
;
5594 if (s
->nat_src_node
!= NULL
) {
5595 s
->nat_src_node
->packets
++;
5596 s
->nat_src_node
->bytes
+= pd
.tot_len
;
5600 nr
= (s
!= NULL
) ? s
->nat_rule
.ptr
: pd
.nat_rule
;
5604 * XXX: we need to make sure that the addresses
5605 * passed to pfr_update_stats() are the same than
5606 * the addresses used during matching (pfr_match)
5608 if (r
== &pf_default_rule
) {
5610 x
= (s
== NULL
|| s
->direction
== dir
) ?
5611 &pd
.baddr
: &pd
.naddr
;
5613 x
= (s
== NULL
|| s
->direction
== dir
) ?
5614 &pd
.naddr
: &pd
.baddr
;
5615 if (x
== &pd
.baddr
|| s
== NULL
) {
5616 /* we need to change the address */
5623 if (tr
->src
.addr
.type
== PF_ADDR_TABLE
)
5624 pfr_update_stats(tr
->src
.addr
.p
.tbl
, (s
== NULL
||
5625 s
->direction
== dir
) ? pd
.src
: pd
.dst
, pd
.af
,
5626 pd
.tot_len
, dir
== PF_OUT
, r
->action
== PF_PASS
,
5628 if (tr
->dst
.addr
.type
== PF_ADDR_TABLE
)
5629 pfr_update_stats(tr
->dst
.addr
.p
.tbl
, (s
== NULL
||
5630 s
->direction
== dir
) ? pd
.dst
: pd
.src
, pd
.af
,
5631 pd
.tot_len
, dir
== PF_OUT
, r
->action
== PF_PASS
,
5636 if (action
== PF_SYNPROXY_DROP
) {
5641 /* pf_route can free the mbuf causing *m0 to become NULL */
5642 pf_route(m0
, r
, dir
, ifp
, s
);
5650 pf_test6(int dir
, struct ifnet
*ifp
, struct mbuf
**m0
)
5652 struct pfi_kif
*kif
;
5653 u_short action
, reason
= 0, log
= 0;
5654 struct mbuf
*m
= *m0
;
5655 struct ip6_hdr
*h
= NULL
;
5656 struct pf_rule
*a
= NULL
, *r
= &pf_default_rule
, *tr
, *nr
;
5657 struct pf_state
*s
= NULL
;
5658 struct pf_ruleset
*ruleset
= NULL
;
5660 int off
, terminal
= 0, dirndx
;
5662 if (!pf_status
.running
|| (m
->m_pkthdr
.fw_flags
& PF_MBUF_GENERATED
))
5665 kif
= pfi_index2kif
[ifp
->if_index
];
5670 if ((m
->m_flags
& M_PKTHDR
) == 0)
5671 panic("non-M_PKTHDR is passed to pf_test");
5674 memset(&pd
, 0, sizeof(pd
));
5675 if (m
->m_pkthdr
.len
< (int)sizeof(*h
)) {
5677 REASON_SET(&reason
, PFRES_SHORT
);
5682 /* We do IP header normalization and packet reassembly here */
5683 if (pf_normalize_ip6(m0
, dir
, kif
, &reason
) != PF_PASS
) {
5688 h
= mtod(m
, struct ip6_hdr
*);
5690 pd
.src
= (struct pf_addr
*)&h
->ip6_src
;
5691 pd
.dst
= (struct pf_addr
*)&h
->ip6_dst
;
5692 PF_ACPY(&pd
.baddr
, dir
== PF_OUT
? pd
.src
: pd
.dst
, AF_INET6
);
5696 pd
.tot_len
= ntohs(h
->ip6_plen
) + sizeof(struct ip6_hdr
);
5698 off
= ((caddr_t
)h
- m
->m_data
) + sizeof(struct ip6_hdr
);
5699 pd
.proto
= h
->ip6_nxt
;
5702 case IPPROTO_FRAGMENT
:
5703 action
= pf_test_fragment(&r
, dir
, kif
, m
, h
,
5705 if (action
== PF_DROP
)
5706 REASON_SET(&reason
, PFRES_FRAG
);
5709 case IPPROTO_HOPOPTS
:
5710 case IPPROTO_ROUTING
:
5711 case IPPROTO_DSTOPTS
: {
5712 /* get next header and header length */
5713 struct ip6_ext opt6
;
5715 if (!pf_pull_hdr(m
, off
, &opt6
, sizeof(opt6
),
5716 NULL
, NULL
, pd
.af
)) {
5717 DPFPRINTF(PF_DEBUG_MISC
,
5718 ("pf: IPv6 short opt\n"));
5720 REASON_SET(&reason
, PFRES_SHORT
);
5724 if (pd
.proto
== IPPROTO_AH
)
5725 off
+= (opt6
.ip6e_len
+ 2) * 4;
5727 off
+= (opt6
.ip6e_len
+ 1) * 8;
5728 pd
.proto
= opt6
.ip6e_nxt
;
5729 /* goto the next header */
5736 } while (!terminal
);
5744 if (!pf_pull_hdr(m
, off
, &th
, sizeof(th
),
5745 &action
, &reason
, AF_INET6
)) {
5746 log
= action
!= PF_PASS
;
5749 if (dir
== PF_IN
&& pf_check_proto_cksum(m
, off
,
5750 ntohs(h
->ip6_plen
), IPPROTO_TCP
, AF_INET6
)) {
5754 pd
.p_len
= pd
.tot_len
- off
- (th
.th_off
<< 2);
5755 action
= pf_normalize_tcp(dir
, kif
, m
, 0, off
, h
, &pd
);
5756 if (action
== PF_DROP
)
5758 action
= pf_test_state_tcp(&s
, dir
, kif
, m
, off
, h
, &pd
,
5760 if (action
== PF_PASS
) {
5762 pfsync_update_state(s
);
5767 } else if (s
== NULL
)
5768 action
= pf_test_tcp(&r
, &s
, dir
, kif
,
5769 m
, off
, h
, &pd
, &a
, &ruleset
);
5777 if (!pf_pull_hdr(m
, off
, &uh
, sizeof(uh
),
5778 &action
, &reason
, AF_INET6
)) {
5779 log
= action
!= PF_PASS
;
5782 if (dir
== PF_IN
&& uh
.uh_sum
&& pf_check_proto_cksum(m
,
5783 off
, ntohs(h
->ip6_plen
), IPPROTO_UDP
, AF_INET6
)) {
5787 if (uh
.uh_dport
== 0 ||
5788 ntohs(uh
.uh_ulen
) > m
->m_pkthdr
.len
- off
||
5789 ntohs(uh
.uh_ulen
) < sizeof(struct udphdr
)) {
5793 action
= pf_test_state_udp(&s
, dir
, kif
, m
, off
, h
, &pd
);
5794 if (action
== PF_PASS
) {
5796 pfsync_update_state(s
);
5801 } else if (s
== NULL
)
5802 action
= pf_test_udp(&r
, &s
, dir
, kif
,
5803 m
, off
, h
, &pd
, &a
, &ruleset
);
5807 case IPPROTO_ICMPV6
: {
5808 struct icmp6_hdr ih
;
5811 if (!pf_pull_hdr(m
, off
, &ih
, sizeof(ih
),
5812 &action
, &reason
, AF_INET6
)) {
5813 log
= action
!= PF_PASS
;
5816 if (dir
== PF_IN
&& pf_check_proto_cksum(m
, off
,
5817 ntohs(h
->ip6_plen
), IPPROTO_ICMPV6
, AF_INET6
)) {
5821 action
= pf_test_state_icmp(&s
, dir
, kif
,
5823 if (action
== PF_PASS
) {
5825 pfsync_update_state(s
);
5830 } else if (s
== NULL
)
5831 action
= pf_test_icmp(&r
, &s
, dir
, kif
,
5832 m
, off
, h
, &pd
, &a
, &ruleset
);
5837 action
= pf_test_state_other(&s
, dir
, kif
, &pd
);
5838 if (action
== PF_PASS
) {
5842 } else if (s
== NULL
)
5843 action
= pf_test_other(&r
, &s
, dir
, kif
, m
, off
, h
,
5849 /* XXX handle IPv6 options, if not allowed. not implemented. */
5852 if (action
== PF_PASS
&& r
->qid
) {
5853 m
->m_pkthdr
.fw_flags
|= ALTQ_MBUF_TAGGED
;
5854 if (pd
.tos
== IPTOS_LOWDELAY
)
5855 m
->m_pkthdr
.altq_qid
= r
->pqid
;
5857 m
->m_pkthdr
.altq_qid
= r
->qid
;
5859 KKASSERT(s
->hash
!= 0);
5860 m
->m_pkthdr
.fw_flags
|= ALTQ_MBUF_STATE_HASHED
;
5861 m
->m_pkthdr
.altq_state_hash
= s
->hash
;
5863 m
->m_pkthdr
.ecn_af
= AF_INET6
;
5864 m
->m_pkthdr
.header
= h
;
5868 if (dir
== PF_IN
&& action
== PF_PASS
&& (pd
.proto
== IPPROTO_TCP
||
5869 pd
.proto
== IPPROTO_UDP
) && s
!= NULL
&& s
->nat_rule
.ptr
!= NULL
&&
5870 (s
->nat_rule
.ptr
->action
== PF_RDR
||
5871 s
->nat_rule
.ptr
->action
== PF_BINAT
) &&
5872 IN6_IS_ADDR_LOOPBACK(&pd
.dst
->v6
)) {
5874 REASON_SET(&reason
, PFRES_MEMORY
);
5877 m
->m_pkthdr
.fw_flags
|= PF_MBUF_TRANSLATE_LOCALHOST
;
5880 PFLOG_PACKET(kif
, h
, m
, AF_INET6
, dir
, reason
, r
, a
, ruleset
);
5882 kif
->pfik_bytes
[1][dir
== PF_OUT
][action
!= PF_PASS
] += pd
.tot_len
;
5883 kif
->pfik_packets
[1][dir
== PF_OUT
][action
!= PF_PASS
]++;
5885 if (action
== PF_PASS
|| r
->action
== PF_DROP
) {
5887 r
->bytes
+= pd
.tot_len
;
5890 a
->bytes
+= pd
.tot_len
;
5893 dirndx
= (dir
== s
->direction
) ? 0 : 1;
5894 s
->packets
[dirndx
]++;
5895 s
->bytes
[dirndx
] += pd
.tot_len
;
5896 if (s
->nat_rule
.ptr
!= NULL
) {
5897 s
->nat_rule
.ptr
->packets
++;
5898 s
->nat_rule
.ptr
->bytes
+= pd
.tot_len
;
5900 if (s
->src_node
!= NULL
) {
5901 s
->src_node
->packets
++;
5902 s
->src_node
->bytes
+= pd
.tot_len
;
5904 if (s
->nat_src_node
!= NULL
) {
5905 s
->nat_src_node
->packets
++;
5906 s
->nat_src_node
->bytes
+= pd
.tot_len
;
5910 nr
= (s
!= NULL
) ? s
->nat_rule
.ptr
: pd
.nat_rule
;
5914 * XXX: we need to make sure that the addresses
5915 * passed to pfr_update_stats() are the same than
5916 * the addresses used during matching (pfr_match)
5918 if (r
== &pf_default_rule
) {
5920 x
= (s
== NULL
|| s
->direction
== dir
) ?
5921 &pd
.baddr
: &pd
.naddr
;
5923 x
= (s
== NULL
|| s
->direction
== dir
) ?
5924 &pd
.naddr
: &pd
.baddr
;
5926 if (x
== &pd
.baddr
|| s
== NULL
) {
5933 if (tr
->src
.addr
.type
== PF_ADDR_TABLE
)
5934 pfr_update_stats(tr
->src
.addr
.p
.tbl
, (s
== NULL
||
5935 s
->direction
== dir
) ? pd
.src
: pd
.dst
, pd
.af
,
5936 pd
.tot_len
, dir
== PF_OUT
, r
->action
== PF_PASS
,
5938 if (tr
->dst
.addr
.type
== PF_ADDR_TABLE
)
5939 pfr_update_stats(tr
->dst
.addr
.p
.tbl
, (s
== NULL
||
5940 s
->direction
== dir
) ? pd
.dst
: pd
.src
, pd
.af
,
5941 pd
.tot_len
, dir
== PF_OUT
, r
->action
== PF_PASS
,
5946 if (action
== PF_SYNPROXY_DROP
) {
5951 /* pf_route6 can free the mbuf causing *m0 to become NULL */
5952 pf_route6(m0
, r
, dir
, ifp
, s
);