?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
sbin/fsck_hammer2: Fix destination FILE* in print_media()
[dragonfly.git] / sys / net / ipfw / ip_fw2.c
blobf047fe0254eac7bb005eb493cb54f2b2af9415ad
1 /*
2 * Copyright (c) 2002 Luigi Rizzo, Universita` di Pisa
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
14 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
16 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
17 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
18 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
19 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
20 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
21 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
22 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
23 * SUCH DAMAGE.
24 *
25 * $FreeBSD: src/sys/netinet/ip_fw2.c,v 1.6.2.12 2003/04/08 10:42:32 maxim Exp $
26 */
27
28 /*
29 * Implement IP packet firewall (new version)
30 */
31
32 #include "opt_ipfw.h"
33 #include "opt_inet.h"
34 #ifndef INET
35 #error IPFIREWALL requires INET.
36 #endif /* INET */
37
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/malloc.h>
41 #include <sys/mbuf.h>
42 #include <sys/kernel.h>
43 #include <sys/proc.h>
44 #include <sys/socket.h>
45 #include <sys/socketvar.h>
46 #include <sys/sysctl.h>
47 #include <sys/syslog.h>
48 #include <sys/ucred.h>
49 #include <sys/in_cksum.h>
50 #include <sys/limits.h>
51 #include <sys/lock.h>
52 #include <sys/tree.h>
53
54 #include <net/if.h>
55 #include <net/route.h>
56 #include <net/pfil.h>
57 #include <net/dummynet/ip_dummynet.h>
58
59 #include <sys/thread2.h>
60 #include <net/netmsg2.h>
61
62 #include <netinet/in.h>
63 #include <netinet/in_systm.h>
64 #include <netinet/in_var.h>
65 #include <netinet/in_pcb.h>
66 #include <netinet/ip.h>
67 #include <netinet/ip_var.h>
68 #include <netinet/ip_icmp.h>
69 #include <netinet/tcp.h>
70 #include <netinet/tcp_seq.h>
71 #include <netinet/tcp_timer.h>
72 #include <netinet/tcp_var.h>
73 #include <netinet/tcpip.h>
74 #include <netinet/udp.h>
75 #include <netinet/udp_var.h>
76 #include <netinet/ip_divert.h>
77 #include <netinet/if_ether.h> /* XXX for ETHERTYPE_IP */
78
79 #include <net/ipfw/ip_fw2.h>
80
81 #ifdef IPFIREWALL_DEBUG
82 #define DPRINTF(fmt, ...) \
83 do { \
84 if (fw_debug > 0) \
85 kprintf(fmt, __VA_ARGS__); \
86 } while (0)
87 #else
88 #define DPRINTF(fmt, ...) ((void)0)
89 #endif
90
91 /*
92 * Description about per-CPU rule duplication:
93 *
94 * Module loading/unloading and all ioctl operations are serialized
95 * by netisr0, so we don't have any ordering or locking problems.
96 *
97 * Following graph shows how operation on per-CPU rule list is
98 * performed [2 CPU case]:
99 *
100 * CPU0 CPU1
101 *
102 * netisr0 <------------------------------------+
103 * domsg |
104 * : |
105 * :(delete/add...) |
106 * : |
107 * : netmsg | netmsg
108 * forwardmsg---------->netisr1 |
109 * : |
110 * :(delete/add...) |
111 * : |
112 * : |
113 * replymsg--------------+
114 *
115 *
116 *
117 * Rule structure [2 CPU case]
118 *
119 * CPU0 CPU1
120 *
121 * layer3_chain layer3_chain
122 * | |
123 * V V
124 * +-------+ sibling +-------+ sibling
125 * | rule1 |--------->| rule1 |--------->NULL
126 * +-------+ +-------+
127 * | |
128 * |next |next
129 * V V
130 * +-------+ sibling +-------+ sibling
131 * | rule2 |--------->| rule2 |--------->NULL
132 * +-------+ +-------+
133 *
134 * ip_fw.sibling:
135 * 1) Ease statistics calculation during IP_FW_GET. We only need to
136 * iterate layer3_chain in netisr0; the current rule's duplication
137 * to the other CPUs could safely be read-only accessed through
138 * ip_fw.sibling.
139 * 2) Accelerate rule insertion and deletion, e.g. rule insertion:
140 * a) In netisr0 rule3 is determined to be inserted between rule1
141 * and rule2. To make this decision we need to iterate the
142 * layer3_chain in netisr0. The netmsg, which is used to insert
143 * the rule, will contain rule1 in netisr0 as prev_rule and rule2
144 * in netisr0 as next_rule.
145 * b) After the insertion in netisr0 is done, we will move on to
146 * netisr1. But instead of relocating the rule3's position in
147 * netisr1 by iterating the layer3_chain in netisr1, we set the
148 * netmsg's prev_rule to rule1->sibling and next_rule to
149 * rule2->sibling before the netmsg is forwarded to netisr1 from
150 * netisr0.
151 */
152
153 /*
154 * Description of states and tracks.
155 *
156 * Both states and tracks are stored in per-cpu RB trees instead of
157 * per-cpu hash tables to avoid the worst case hash degeneration.
158 *
159 * The lifetimes of states and tracks are regulated by dyn_*_lifetime,
160 * measured in seconds and depending on the flags.
161 *
162 * When a packet is received, its address fields are first masked with
163 * the mask defined for the rule, then matched against the entries in
164 * the per-cpu state RB tree. States are generated by 'keep-state'
165 * and 'limit' options.
166 *
167 * The max number of states is ipfw_state_max. When we reach the
168 * maximum number of states we do not create anymore. This is done to
169 * avoid consuming too much memory, but also too much time when
170 * searching on each packet.
171 *
172 * Each state holds a pointer to the parent ipfw rule of the current
173 * CPU so we know what action to perform. States are removed when the
174 * parent rule is deleted. XXX we should make them survive.
175 *
176 * There are some limitations with states -- we do not obey the
177 * 'randomized match', and we do not do multiple passes through the
178 * firewall. XXX check the latter!!!
179 *
180 * States grow independently on each CPU, e.g. 2 CPU case:
181 *
182 * CPU0 CPU1
183 * ................... ...................
184 * : state RB tree : : state RB tree :
185 * : : : :
186 * : state1 state2 : : state3 :
187 * : | | : : | :
188 * :.....|....|......: :........|........:
189 * | | |
190 * | | |st_rule
191 * | | |
192 * V V V
193 * +-------+ +-------+
194 * | rule1 | | rule1 |
195 * +-------+ +-------+
196 *
197 * Tracks are used to enforce limits on the number of sessions. Tracks
198 * are generated by 'limit' option.
199 *
200 * The max number of tracks is ipfw_track_max. When we reach the
201 * maximum number of tracks we do not create anymore. This is done to
202 * avoid consuming too much memory.
203 *
204 * Tracks are organized into two layers, track counter RB tree is
205 * shared between CPUs, track RB tree is per-cpu. States generated by
206 * 'limit' option are linked to the track in addition to the per-cpu
207 * state RB tree; mainly to ease expiration. e.g. 2 CPU case:
208 *
209 * ..............................
210 * : track counter RB tree :
211 * : :
212 * : +-----------+ :
213 * : | trkcnt1 | :
214 * : | | :
215 * : +--->counter<----+ :
216 * : | | | | :
217 * : | +-----------+ | :
218 * :......|................|....:
219 * | |
220 * CPU0 | | CPU1
221 * ................. |t_count | .................
222 * : track RB tree : | | : track RB tree :
223 * : : | | : :
224 * : +-->track1-------+ +--------track2 :
225 * : | A : : :
226 * : | | : : :
227 * :.|.....|.......: :...............:
228 * | +----------------+
229 * | .................... |
230 * | : state RB tree : |st_track
231 * | : : |
232 * +---state1 state2---+
233 * : | | :
234 * :.....|.......|....:
235 * | |
236 * | |st_rule
237 * V V
238 * +----------+
239 * | rule1 |
240 * +----------+
241 */
242
243 #define IPFW_AUTOINC_STEP_MIN 1
244 #define IPFW_AUTOINC_STEP_MAX 1000
245 #define IPFW_AUTOINC_STEP_DEF 100
246
247 #define IPFW_TABLE_MAX_DEF 64
248
249 #define IPFW_DEFAULT_RULE 65535 /* rulenum for the default rule */
250 #define IPFW_DEFAULT_SET 31 /* set number for the default rule */
251
252 #define MATCH_REVERSE 0
253 #define MATCH_FORWARD 1
254 #define MATCH_NONE 2
255 #define MATCH_UNKNOWN 3
256
257 #define TIME_LEQ(a, b) ((a) - (b) <= 0)
258
259 #define IPFW_STATE_TCPFLAGS (TH_SYN | TH_FIN | TH_RST)
260 #define IPFW_STATE_TCPSTATES (IPFW_STATE_TCPFLAGS | \
261 (IPFW_STATE_TCPFLAGS << 8))
262
263 #define BOTH_SYN (TH_SYN | (TH_SYN << 8))
264 #define BOTH_FIN (TH_FIN | (TH_FIN << 8))
265 #define BOTH_RST (TH_RST | (TH_RST << 8))
266 /* TH_ACK here means FIN was ACKed. */
267 #define BOTH_FINACK (TH_ACK | (TH_ACK << 8))
268
269 #define IPFW_STATE_TCPCLOSED(s) ((s)->st_proto == IPPROTO_TCP && \
270 (((s)->st_state & BOTH_RST) || \
271 ((s)->st_state & BOTH_FINACK) == BOTH_FINACK))
272
273 #define O_ANCHOR O_NOP
274
275 #define IPFW_ISXLAT(type) ((type) == O_REDIRECT)
276 #define IPFW_XLAT_INVALID(s) (IPFW_ISXLAT((s)->st_type) && \
277 ((struct ipfw_xlat *)(s))->xlat_invalid)
278
279 #define IPFW_MBUF_XLATINS FW_MBUF_PRIVATE1
280 #define IPFW_MBUF_XLATFWD FW_MBUF_PRIVATE2
281
282 #define IPFW_XLATE_INSERT 0x0001
283 #define IPFW_XLATE_FORWARD 0x0002
284 #define IPFW_XLATE_OUTPUT 0x0004
285
286 struct netmsg_ipfw {
287 struct netmsg_base base;
288 const struct ipfw_ioc_rule *ioc_rule;
289 struct ip_fw *next_rule;
290 struct ip_fw *prev_rule;
291 struct ip_fw *sibling;
292 uint32_t rule_flags;
293 struct ip_fw **cross_rules;
294 };
295
296 struct netmsg_del {
297 struct netmsg_base base;
298 struct ip_fw *start_rule;
299 struct ip_fw *prev_rule;
300 uint16_t rulenum;
301 uint8_t from_set;
302 uint8_t to_set;
303 };
304
305 struct netmsg_zent {
306 struct netmsg_base base;
307 struct ip_fw *start_rule;
308 uint16_t rulenum;
309 uint16_t log_only;
310 };
311
312 struct netmsg_cpstate {
313 struct netmsg_base base;
314 struct ipfw_ioc_state *ioc_state;
315 int state_cntmax;
316 int state_cnt;
317 };
318
319 struct netmsg_tblent {
320 struct netmsg_base base;
321 struct sockaddr *key;
322 struct sockaddr *netmask;
323 struct ipfw_tblent *sibling;
324 int tableid;
325 };
326
327 struct netmsg_tblflush {
328 struct netmsg_base base;
329 int tableid;
330 int destroy;
331 };
332
333 struct netmsg_tblexp {
334 struct netmsg_base base;
335 time_t expire;
336 int tableid;
337 int cnt;
338 int expcnt;
339 struct radix_node_head *rnh;
340 };
341
342 struct ipfw_table_cp {
343 struct ipfw_ioc_tblent *te;
344 int te_idx;
345 int te_cnt;
346 };
347
348 struct ip_fw_local {
349 /*
350 * offset The offset of a fragment. offset != 0 means that
351 * we have a fragment at this offset of an IPv4 packet.
352 * offset == 0 means that (if this is an IPv4 packet)
353 * this is the first or only fragment.
354 */
355 u_short offset;
356
357 /*
358 * Local copies of addresses. They are only valid if we have
359 * an IP packet.
360 *
361 * proto The protocol. Set to 0 for non-ip packets,
362 * or to the protocol read from the packet otherwise.
363 * proto != 0 means that we have an IPv4 packet.
364 *
365 * src_port, dst_port port numbers, in HOST format. Only
366 * valid for TCP and UDP packets.
367 *
368 * src_ip, dst_ip ip addresses, in NETWORK format.
369 * Only valid for IPv4 packets.
370 */
371 uint8_t proto;
372 uint16_t src_port; /* NOTE: host format */
373 uint16_t dst_port; /* NOTE: host format */
374 struct in_addr src_ip; /* NOTE: network format */
375 struct in_addr dst_ip; /* NOTE: network format */
376 uint16_t ip_len; /* NOTE: host format */
377 struct tcphdr *tcp;
378 };
379
380 struct ipfw_addrs {
381 uint32_t addr1; /* host byte order */
382 uint32_t addr2; /* host byte order */
383 };
384
385 struct ipfw_ports {
386 uint16_t port1; /* host byte order */
387 uint16_t port2; /* host byte order */
388 };
389
390 struct ipfw_key {
391 union {
392 struct ipfw_addrs addrs;
393 uint64_t value;
394 } addr_u;
395 union {
396 struct ipfw_ports ports;
397 uint32_t value;
398 } port_u;
399 uint8_t proto;
400 uint8_t swap; /* IPFW_KEY_SWAP_ */
401 uint16_t rsvd2;
402 };
403
404 #define IPFW_KEY_SWAP_ADDRS 0x1
405 #define IPFW_KEY_SWAP_PORTS 0x2
406 #define IPFW_KEY_SWAP_ALL (IPFW_KEY_SWAP_ADDRS | IPFW_KEY_SWAP_PORTS)
407
408 struct ipfw_trkcnt {
409 RB_ENTRY(ipfw_trkcnt) tc_rblink;
410 struct ipfw_key tc_key;
411 uintptr_t tc_ruleid;
412 int tc_refs;
413 int tc_count;
414 time_t tc_expire; /* userland get-only */
415 uint16_t tc_rulenum; /* userland get-only */
416 } __cachealign;
417
418 #define tc_addrs tc_key.addr_u.value
419 #define tc_ports tc_key.port_u.value
420 #define tc_proto tc_key.proto
421 #define tc_saddr tc_key.addr_u.addrs.addr1
422 #define tc_daddr tc_key.addr_u.addrs.addr2
423 #define tc_sport tc_key.port_u.ports.port1
424 #define tc_dport tc_key.port_u.ports.port2
425
426 RB_HEAD(ipfw_trkcnt_tree, ipfw_trkcnt);
427
428 struct ipfw_state;
429
430 struct ipfw_track {
431 RB_ENTRY(ipfw_track) t_rblink;
432 struct ipfw_key t_key;
433 struct ip_fw *t_rule;
434 time_t t_lastexp;
435 LIST_HEAD(, ipfw_state) t_state_list;
436 time_t t_expire;
437 volatile int *t_count;
438 struct ipfw_trkcnt *t_trkcnt;
439 TAILQ_ENTRY(ipfw_track) t_link;
440 };
441
442 #define t_addrs t_key.addr_u.value
443 #define t_ports t_key.port_u.value
444 #define t_proto t_key.proto
445 #define t_saddr t_key.addr_u.addrs.addr1
446 #define t_daddr t_key.addr_u.addrs.addr2
447 #define t_sport t_key.port_u.ports.port1
448 #define t_dport t_key.port_u.ports.port2
449
450 RB_HEAD(ipfw_track_tree, ipfw_track);
451 TAILQ_HEAD(ipfw_track_list, ipfw_track);
452
453 struct ipfw_state {
454 RB_ENTRY(ipfw_state) st_rblink;
455 struct ipfw_key st_key;
456
457 time_t st_expire; /* expire time */
458 struct ip_fw *st_rule;
459
460 uint64_t st_pcnt; /* packets */
461 uint64_t st_bcnt; /* bytes */
462
463 /*
464 * st_state:
465 * State of this rule, typically a combination of TCP flags.
466 *
467 * st_ack_fwd/st_ack_rev:
468 * Most recent ACKs in forward and reverse direction. They
469 * are used to generate keepalives.
470 */
471 uint32_t st_state;
472 uint32_t st_ack_fwd; /* host byte order */
473 uint32_t st_seq_fwd; /* host byte order */
474 uint32_t st_ack_rev; /* host byte order */
475 uint32_t st_seq_rev; /* host byte order */
476
477 uint16_t st_flags; /* IPFW_STATE_F_ */
478 uint16_t st_type; /* KEEP_STATE/LIMIT/RDR */
479 struct ipfw_track *st_track;
480
481 LIST_ENTRY(ipfw_state) st_trklink;
482 TAILQ_ENTRY(ipfw_state) st_link;
483 };
484
485 #define st_addrs st_key.addr_u.value
486 #define st_ports st_key.port_u.value
487 #define st_proto st_key.proto
488 #define st_swap st_key.swap
489
490 #define IPFW_STATE_F_ACKFWD 0x0001
491 #define IPFW_STATE_F_SEQFWD 0x0002
492 #define IPFW_STATE_F_ACKREV 0x0004
493 #define IPFW_STATE_F_SEQREV 0x0008
494 #define IPFW_STATE_F_XLATSRC 0x0010
495 #define IPFW_STATE_F_XLATSLAVE 0x0020
496 #define IPFW_STATE_F_LINKED 0x0040
497
498 #define IPFW_STATE_SCANSKIP(s) ((s)->st_type == O_ANCHOR || \
499 ((s)->st_flags & IPFW_STATE_F_XLATSLAVE))
500
501 /* Expired or being deleted. */
502 #define IPFW_STATE_ISDEAD(s) (TIME_LEQ((s)->st_expire, time_uptime) || \
503 IPFW_XLAT_INVALID((s)))
504
505 TAILQ_HEAD(ipfw_state_list, ipfw_state);
506 RB_HEAD(ipfw_state_tree, ipfw_state);
507
508 struct ipfw_xlat {
509 struct ipfw_state xlat_st; /* MUST be the first field */
510 uint32_t xlat_addr; /* network byte order */
511 uint16_t xlat_port; /* network byte order */
512 uint16_t xlat_dir; /* MATCH_ */
513 struct ifnet *xlat_ifp; /* matching ifnet */
514 struct ipfw_xlat *xlat_pair; /* paired state */
515 int xlat_pcpu; /* paired cpu */
516 volatile int xlat_invalid; /* invalid, but not dtor yet */
517 volatile uint64_t xlat_crefs; /* cross references */
518 struct netmsg_base xlat_freenm; /* for remote free */
519 };
520
521 #define xlat_type xlat_st.st_type
522 #define xlat_flags xlat_st.st_flags
523 #define xlat_rule xlat_st.st_rule
524 #define xlat_bcnt xlat_st.st_bcnt
525 #define xlat_pcnt xlat_st.st_pcnt
526
527 struct ipfw_tblent {
528 struct radix_node te_nodes[2];
529 struct sockaddr_in te_key;
530 u_long te_use;
531 time_t te_lastuse;
532 struct ipfw_tblent *te_sibling;
533 volatile int te_expired;
534 };
535
536 struct ipfw_context {
537 struct ip_fw *ipfw_layer3_chain; /* rules for layer3 */
538 struct ip_fw *ipfw_default_rule; /* default rule */
539 uint64_t ipfw_norule_counter; /* ipfw_log(NULL) stat*/
540
541 /*
542 * ipfw_set_disable contains one bit per set value (0..31).
543 * If the bit is set, all rules with the corresponding set
544 * are disabled. Set IPDW_DEFAULT_SET is reserved for the
545 * default rule and CANNOT be disabled.
546 */
547 uint32_t ipfw_set_disable;
548
549 uint8_t ipfw_flags; /* IPFW_FLAG_ */
550
551 struct ip_fw *ipfw_cont_rule;
552 struct ipfw_xlat *ipfw_cont_xlat;
553
554 struct ipfw_state_tree ipfw_state_tree;
555 struct ipfw_state_list ipfw_state_list;
556 int ipfw_state_loosecnt;
557 int ipfw_state_cnt;
558
559 union {
560 struct ipfw_state state;
561 struct ipfw_track track;
562 struct ipfw_trkcnt trkcnt;
563 } ipfw_tmpkey;
564
565 struct ipfw_track_tree ipfw_track_tree;
566 struct ipfw_track_list ipfw_track_list;
567 struct ipfw_trkcnt *ipfw_trkcnt_spare;
568
569 struct callout ipfw_stateto_ch;
570 time_t ipfw_state_lastexp;
571 struct netmsg_base ipfw_stateexp_nm;
572 struct netmsg_base ipfw_stateexp_more;
573 struct ipfw_state ipfw_stateexp_anch;
574
575 struct callout ipfw_trackto_ch;
576 time_t ipfw_track_lastexp;
577 struct netmsg_base ipfw_trackexp_nm;
578 struct netmsg_base ipfw_trackexp_more;
579 struct ipfw_track ipfw_trackexp_anch;
580
581 struct callout ipfw_keepalive_ch;
582 struct netmsg_base ipfw_keepalive_nm;
583 struct netmsg_base ipfw_keepalive_more;
584 struct ipfw_state ipfw_keepalive_anch;
585
586 struct callout ipfw_xlatreap_ch;
587 struct netmsg_base ipfw_xlatreap_nm;
588 struct ipfw_state_list ipfw_xlatreap;
589
590 /*
591 * Statistics
592 */
593 u_long ipfw_sts_reap;
594 u_long ipfw_sts_reapfailed;
595 u_long ipfw_sts_overflow;
596 u_long ipfw_sts_nomem;
597 u_long ipfw_sts_tcprecycled;
598
599 u_long ipfw_tks_nomem;
600 u_long ipfw_tks_reap;
601 u_long ipfw_tks_reapfailed;
602 u_long ipfw_tks_overflow;
603 u_long ipfw_tks_cntnomem;
604
605 u_long ipfw_frags;
606 u_long ipfw_defraged;
607 u_long ipfw_defrag_remote;
608
609 u_long ipfw_xlated;
610 u_long ipfw_xlate_split;
611 u_long ipfw_xlate_conflicts;
612 u_long ipfw_xlate_cresolved;
613
614 /* Last field */
615 struct radix_node_head *ipfw_tables[];
616 };
617
618 #define IPFW_FLAG_KEEPALIVE 0x01
619 #define IPFW_FLAG_STATEEXP 0x02
620 #define IPFW_FLAG_TRACKEXP 0x04
621 #define IPFW_FLAG_STATEREAP 0x08
622 #define IPFW_FLAG_TRACKREAP 0x10
623
624 #define ipfw_state_tmpkey ipfw_tmpkey.state
625 #define ipfw_track_tmpkey ipfw_tmpkey.track
626 #define ipfw_trkcnt_tmpkey ipfw_tmpkey.trkcnt
627
628 struct ipfw_global {
629 int ipfw_state_loosecnt; /* cache aligned */
630 time_t ipfw_state_globexp __cachealign;
631
632 struct lwkt_token ipfw_trkcnt_token __cachealign;
633 struct ipfw_trkcnt_tree ipfw_trkcnt_tree;
634 int ipfw_trkcnt_cnt;
635 time_t ipfw_track_globexp;
636
637 /* Accessed in netisr0. */
638 struct ip_fw *ipfw_crossref_free __cachealign;
639 struct callout ipfw_crossref_ch;
640 struct netmsg_base ipfw_crossref_nm;
641
642 #ifdef KLD_MODULE
643 /*
644 * Module can not be unloaded, if there are references to
645 * certains rules of ipfw(4), e.g. dummynet(4)
646 */
647 int ipfw_refcnt __cachealign;
648 #endif
649 } __cachealign;
650
651 static struct ipfw_context *ipfw_ctx[MAXCPU];
652
653 MALLOC_DEFINE(M_IPFW, "IpFw/IpAcct", "IpFw/IpAcct chain's");
654
655 /*
656 * Following two global variables are accessed and updated only
657 * in netisr0.
658 */
659 static uint32_t static_count; /* # of static rules */
660 static uint32_t static_ioc_len; /* bytes of static rules */
661
662 /*
663 * If 1, then ipfw static rules are being flushed,
664 * ipfw_chk() will skip to the default rule.
665 */
666 static int ipfw_flushing;
667
668 static int fw_verbose;
669 static int verbose_limit;
670
671 static int fw_debug;
672 static int autoinc_step = IPFW_AUTOINC_STEP_DEF;
673
674 static int ipfw_table_max = IPFW_TABLE_MAX_DEF;
675
676 static int ipfw_sysctl_enable(SYSCTL_HANDLER_ARGS);
677 static int ipfw_sysctl_autoinc_step(SYSCTL_HANDLER_ARGS);
678
679 TUNABLE_INT("net.inet.ip.fw.table_max", &ipfw_table_max);
680
681 SYSCTL_NODE(_net_inet_ip, OID_AUTO, fw, CTLFLAG_RW, 0, "Firewall");
682 SYSCTL_NODE(_net_inet_ip_fw, OID_AUTO, stats, CTLFLAG_RW, 0,
683 "Firewall statistics");
684
685 SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, enable, CTLTYPE_INT | CTLFLAG_RW,
686 &fw_enable, 0, ipfw_sysctl_enable, "I", "Enable ipfw");
687 SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, autoinc_step, CTLTYPE_INT | CTLFLAG_RW,
688 &autoinc_step, 0, ipfw_sysctl_autoinc_step, "I",
689 "Rule number autincrement step");
690 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO,one_pass,CTLFLAG_RW,
691 &fw_one_pass, 0,
692 "Only do a single pass through ipfw when using dummynet(4)");
693 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, debug, CTLFLAG_RW,
694 &fw_debug, 0, "Enable printing of debug ip_fw statements");
695 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, verbose, CTLFLAG_RW,
696 &fw_verbose, 0, "Log matches to ipfw rules");
697 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, verbose_limit, CTLFLAG_RW,
698 &verbose_limit, 0, "Set upper limit of matches of ipfw rules logged");
699 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, table_max, CTLFLAG_RD,
700 &ipfw_table_max, 0, "Max # of tables");
701
702 static int ipfw_sysctl_dyncnt(SYSCTL_HANDLER_ARGS);
703 static int ipfw_sysctl_dynmax(SYSCTL_HANDLER_ARGS);
704 static int ipfw_sysctl_statecnt(SYSCTL_HANDLER_ARGS);
705 static int ipfw_sysctl_statemax(SYSCTL_HANDLER_ARGS);
706 static int ipfw_sysctl_scancnt(SYSCTL_HANDLER_ARGS);
707 static int ipfw_sysctl_stat(SYSCTL_HANDLER_ARGS);
708
709 /*
710 * Timeouts for various events in handing states.
711 *
712 * NOTE:
713 * 1 == 0~1 second.
714 * 2 == 1~2 second(s).
715 *
716 * We use 2 seconds for FIN lifetime, so that the states will not be
717 * ripped prematurely.
718 */
719 static uint32_t dyn_ack_lifetime = 300;
720 static uint32_t dyn_syn_lifetime = 20;
721 static uint32_t dyn_finwait_lifetime = 20;
722 static uint32_t dyn_fin_lifetime = 2;
723 static uint32_t dyn_rst_lifetime = 2;
724 static uint32_t dyn_udp_lifetime = 10;
725 static uint32_t dyn_short_lifetime = 5; /* used by tracks too */
726
727 /*
728 * Keepalives are sent if dyn_keepalive is set. They are sent every
729 * dyn_keepalive_period seconds, in the last dyn_keepalive_interval
730 * seconds of lifetime of a rule.
731 */
732 static uint32_t dyn_keepalive_interval = 20;
733 static uint32_t dyn_keepalive_period = 5;
734 static uint32_t dyn_keepalive = 1; /* do send keepalives */
735
736 static struct ipfw_global ipfw_gd;
737 static int ipfw_state_loosecnt_updthr;
738 static int ipfw_state_max = 4096; /* max # of states */
739 static int ipfw_track_max = 4096; /* max # of tracks */
740
741 static int ipfw_state_headroom; /* setup at module load time */
742 static int ipfw_state_reap_min = 8;
743 static int ipfw_state_expire_max = 32;
744 static int ipfw_state_scan_max = 256;
745 static int ipfw_keepalive_max = 8;
746 static int ipfw_track_reap_max = 4;
747 static int ipfw_track_expire_max = 16;
748 static int ipfw_track_scan_max = 128;
749
750 static eventhandler_tag ipfw_ifaddr_event;
751
752 /* Compat */
753 SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, dyn_count,
754 CTLTYPE_INT | CTLFLAG_RD, NULL, 0, ipfw_sysctl_dyncnt, "I",
755 "Number of states and tracks");
756 SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, dyn_max,
757 CTLTYPE_INT | CTLFLAG_RW, NULL, 0, ipfw_sysctl_dynmax, "I",
758 "Max number of states and tracks");
759
760 SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, state_cnt,
761 CTLTYPE_INT | CTLFLAG_RD, NULL, 0, ipfw_sysctl_statecnt, "I",
762 "Number of states");
763 SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, state_max,
764 CTLTYPE_INT | CTLFLAG_RW, NULL, 0, ipfw_sysctl_statemax, "I",
765 "Max number of states");
766 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, state_headroom, CTLFLAG_RW,
767 &ipfw_state_headroom, 0, "headroom for state reap");
768 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, track_cnt, CTLFLAG_RD,
769 &ipfw_gd.ipfw_trkcnt_cnt, 0, "Number of tracks");
770 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, track_max, CTLFLAG_RW,
771 &ipfw_track_max, 0, "Max number of tracks");
772 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, static_count, CTLFLAG_RD,
773 &static_count, 0, "Number of static rules");
774 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, dyn_ack_lifetime, CTLFLAG_RW,
775 &dyn_ack_lifetime, 0, "Lifetime of dyn. rules for acks");
776 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, dyn_syn_lifetime, CTLFLAG_RW,
777 &dyn_syn_lifetime, 0, "Lifetime of dyn. rules for syn");
778 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, dyn_fin_lifetime, CTLFLAG_RW,
779 &dyn_fin_lifetime, 0, "Lifetime of dyn. rules for fin");
780 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, dyn_finwait_lifetime, CTLFLAG_RW,
781 &dyn_finwait_lifetime, 0, "Lifetime of dyn. rules for fin wait");
782 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, dyn_rst_lifetime, CTLFLAG_RW,
783 &dyn_rst_lifetime, 0, "Lifetime of dyn. rules for rst");
784 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, dyn_udp_lifetime, CTLFLAG_RW,
785 &dyn_udp_lifetime, 0, "Lifetime of dyn. rules for UDP");
786 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, dyn_short_lifetime, CTLFLAG_RW,
787 &dyn_short_lifetime, 0, "Lifetime of dyn. rules for other situations");
788 SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, dyn_keepalive, CTLFLAG_RW,
789 &dyn_keepalive, 0, "Enable keepalives for dyn. rules");
790 SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, state_scan_max,
791 CTLTYPE_INT | CTLFLAG_RW, &ipfw_state_scan_max, 0, ipfw_sysctl_scancnt,
792 "I", "# of states to scan for each expire iteration");
793 SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, state_expire_max,
794 CTLTYPE_INT | CTLFLAG_RW, &ipfw_state_expire_max, 0, ipfw_sysctl_scancnt,
795 "I", "# of states to expire for each expire iteration");
796 SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, keepalive_max,
797 CTLTYPE_INT | CTLFLAG_RW, &ipfw_keepalive_max, 0, ipfw_sysctl_scancnt,
798 "I", "# of states to expire for each expire iteration");
799 SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, state_reap_min,
800 CTLTYPE_INT | CTLFLAG_RW, &ipfw_state_reap_min, 0, ipfw_sysctl_scancnt,
801 "I", "# of states to reap for state shortage");
802 SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, track_scan_max,
803 CTLTYPE_INT | CTLFLAG_RW, &ipfw_track_scan_max, 0, ipfw_sysctl_scancnt,
804 "I", "# of tracks to scan for each expire iteration");
805 SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, track_expire_max,
806 CTLTYPE_INT | CTLFLAG_RW, &ipfw_track_expire_max, 0, ipfw_sysctl_scancnt,
807 "I", "# of tracks to expire for each expire iteration");
808 SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, track_reap_max,
809 CTLTYPE_INT | CTLFLAG_RW, &ipfw_track_reap_max, 0, ipfw_sysctl_scancnt,
810 "I", "# of tracks to reap for track shortage");
811
812 SYSCTL_PROC(_net_inet_ip_fw_stats, OID_AUTO, state_reap,
813 CTLTYPE_ULONG | CTLFLAG_RW, NULL,
814 __offsetof(struct ipfw_context, ipfw_sts_reap), ipfw_sysctl_stat,
815 "LU", "# of state reaps due to states shortage");
816 SYSCTL_PROC(_net_inet_ip_fw_stats, OID_AUTO, state_reapfailed,
817 CTLTYPE_ULONG | CTLFLAG_RW, NULL,
818 __offsetof(struct ipfw_context, ipfw_sts_reapfailed), ipfw_sysctl_stat,
819 "LU", "# of state reap failure");
820 SYSCTL_PROC(_net_inet_ip_fw_stats, OID_AUTO, state_overflow,
821 CTLTYPE_ULONG | CTLFLAG_RW, NULL,
822 __offsetof(struct ipfw_context, ipfw_sts_overflow), ipfw_sysctl_stat,
823 "LU", "# of state overflow");
824 SYSCTL_PROC(_net_inet_ip_fw_stats, OID_AUTO, state_nomem,
825 CTLTYPE_ULONG | CTLFLAG_RW, NULL,
826 __offsetof(struct ipfw_context, ipfw_sts_nomem), ipfw_sysctl_stat,
827 "LU", "# of state allocation failure");
828 SYSCTL_PROC(_net_inet_ip_fw_stats, OID_AUTO, state_tcprecycled,
829 CTLTYPE_ULONG | CTLFLAG_RW, NULL,
830 __offsetof(struct ipfw_context, ipfw_sts_tcprecycled), ipfw_sysctl_stat,
831 "LU", "# of state deleted due to fast TCP port recycling");
832
833 SYSCTL_PROC(_net_inet_ip_fw_stats, OID_AUTO, track_nomem,
834 CTLTYPE_ULONG | CTLFLAG_RW, NULL,
835 __offsetof(struct ipfw_context, ipfw_tks_nomem), ipfw_sysctl_stat,
836 "LU", "# of track allocation failure");
837 SYSCTL_PROC(_net_inet_ip_fw_stats, OID_AUTO, track_reap,
838 CTLTYPE_ULONG | CTLFLAG_RW, NULL,
839 __offsetof(struct ipfw_context, ipfw_tks_reap), ipfw_sysctl_stat,
840 "LU", "# of track reap due to tracks shortage");
841 SYSCTL_PROC(_net_inet_ip_fw_stats, OID_AUTO, track_reapfailed,
842 CTLTYPE_ULONG | CTLFLAG_RW, NULL,
843 __offsetof(struct ipfw_context, ipfw_tks_reapfailed), ipfw_sysctl_stat,
844 "LU", "# of track reap failure");
845 SYSCTL_PROC(_net_inet_ip_fw_stats, OID_AUTO, track_overflow,
846 CTLTYPE_ULONG | CTLFLAG_RW, NULL,
847 __offsetof(struct ipfw_context, ipfw_tks_overflow), ipfw_sysctl_stat,
848 "LU", "# of track overflow");
849 SYSCTL_PROC(_net_inet_ip_fw_stats, OID_AUTO, track_cntnomem,
850 CTLTYPE_ULONG | CTLFLAG_RW, NULL,
851 __offsetof(struct ipfw_context, ipfw_tks_cntnomem), ipfw_sysctl_stat,
852 "LU", "# of track counter allocation failure");
853 SYSCTL_PROC(_net_inet_ip_fw_stats, OID_AUTO, frags,
854 CTLTYPE_ULONG | CTLFLAG_RW, NULL,
855 __offsetof(struct ipfw_context, ipfw_frags), ipfw_sysctl_stat,
856 "LU", "# of IP fragements defraged");
857 SYSCTL_PROC(_net_inet_ip_fw_stats, OID_AUTO, defraged,
858 CTLTYPE_ULONG | CTLFLAG_RW, NULL,
859 __offsetof(struct ipfw_context, ipfw_defraged), ipfw_sysctl_stat,
860 "LU", "# of IP packets after defrag");
861 SYSCTL_PROC(_net_inet_ip_fw_stats, OID_AUTO, defrag_remote,
862 CTLTYPE_ULONG | CTLFLAG_RW, NULL,
863 __offsetof(struct ipfw_context, ipfw_defrag_remote), ipfw_sysctl_stat,
864 "LU", "# of IP packets after defrag dispatched to remote cpus");
865 SYSCTL_PROC(_net_inet_ip_fw_stats, OID_AUTO, xlated,
866 CTLTYPE_ULONG | CTLFLAG_RW, NULL,
867 __offsetof(struct ipfw_context, ipfw_xlated), ipfw_sysctl_stat,
868 "LU", "# address/port translations");
869 SYSCTL_PROC(_net_inet_ip_fw_stats, OID_AUTO, xlate_split,
870 CTLTYPE_ULONG | CTLFLAG_RW, NULL,
871 __offsetof(struct ipfw_context, ipfw_xlate_split), ipfw_sysctl_stat,
872 "LU", "# address/port translations split between different cpus");
873 SYSCTL_PROC(_net_inet_ip_fw_stats, OID_AUTO, xlate_conflicts,
874 CTLTYPE_ULONG | CTLFLAG_RW, NULL,
875 __offsetof(struct ipfw_context, ipfw_xlate_conflicts), ipfw_sysctl_stat,
876 "LU", "# address/port translations conflicts on remote cpu");
877 SYSCTL_PROC(_net_inet_ip_fw_stats, OID_AUTO, xlate_cresolved,
878 CTLTYPE_ULONG | CTLFLAG_RW, NULL,
879 __offsetof(struct ipfw_context, ipfw_xlate_cresolved), ipfw_sysctl_stat,
880 "LU", "# address/port translations conflicts resolved on remote cpu");
881
882 static int ipfw_state_cmp(struct ipfw_state *,
883 struct ipfw_state *);
884 static int ipfw_trkcnt_cmp(struct ipfw_trkcnt *,
885 struct ipfw_trkcnt *);
886 static int ipfw_track_cmp(struct ipfw_track *,
887 struct ipfw_track *);
888
889 RB_PROTOTYPE(ipfw_state_tree, ipfw_state, st_rblink, ipfw_state_cmp);
890 RB_GENERATE(ipfw_state_tree, ipfw_state, st_rblink, ipfw_state_cmp);
891
892 RB_PROTOTYPE(ipfw_trkcnt_tree, ipfw_trkcnt, tc_rblink, ipfw_trkcnt_cmp);
893 RB_GENERATE(ipfw_trkcnt_tree, ipfw_trkcnt, tc_rblink, ipfw_trkcnt_cmp);
894
895 RB_PROTOTYPE(ipfw_track_tree, ipfw_track, t_rblink, ipfw_track_cmp);
896 RB_GENERATE(ipfw_track_tree, ipfw_track, t_rblink, ipfw_track_cmp);
897
898 static int ipfw_chk(struct ip_fw_args *);
899 static void ipfw_track_expire_ipifunc(void *);
900 static void ipfw_state_expire_ipifunc(void *);
901 static void ipfw_keepalive(void *);
902 static int ipfw_state_expire_start(struct ipfw_context *,
903 int, int);
904 static void ipfw_crossref_timeo(void *);
905 static void ipfw_state_remove(struct ipfw_context *,
906 struct ipfw_state *);
907 static void ipfw_xlat_reap_timeo(void *);
908 static void ipfw_defrag_redispatch(struct mbuf *, int,
909 struct ip_fw *);
910
911 #define IPFW_TRKCNT_TOKGET lwkt_gettoken(&ipfw_gd.ipfw_trkcnt_token)
912 #define IPFW_TRKCNT_TOKREL lwkt_reltoken(&ipfw_gd.ipfw_trkcnt_token)
913 #define IPFW_TRKCNT_TOKINIT \
914 lwkt_token_init(&ipfw_gd.ipfw_trkcnt_token, "ipfw_trkcnt");
915
916 static void
917 sa_maskedcopy(const struct sockaddr *src, struct sockaddr *dst,
918 const struct sockaddr *netmask)
919 {
920 const u_char *cp1 = (const u_char *)src;
921 u_char *cp2 = (u_char *)dst;
922 const u_char *cp3 = (const u_char *)netmask;
923 u_char *cplim = cp2 + *cp3;
924 u_char *cplim2 = cp2 + *cp1;
925
926 *cp2++ = *cp1++; *cp2++ = *cp1++; /* copies sa_len & sa_family */
927 cp3 += 2;
928 if (cplim > cplim2)
929 cplim = cplim2;
930 while (cp2 < cplim)
931 *cp2++ = *cp1++ & *cp3++;
932 if (cp2 < cplim2)
933 bzero(cp2, cplim2 - cp2);
934 }
935
936 static __inline uint16_t
937 pfil_cksum_fixup(uint16_t cksum, uint16_t old, uint16_t new, uint8_t udp)
938 {
939 uint32_t l;
940
941 if (udp && !cksum)
942 return (0x0000);
943 l = cksum + old - new;
944 l = (l >> 16) + (l & 65535);
945 l = l & 65535;
946 if (udp && !l)
947 return (0xFFFF);
948 return (l);
949 }
950
951 static __inline void
952 ipfw_key_build(struct ipfw_key *key, in_addr_t saddr, uint16_t sport,
953 in_addr_t daddr, uint16_t dport, uint8_t proto)
954 {
955
956 key->proto = proto;
957 key->swap = 0;
958
959 if (saddr < daddr) {
960 key->addr_u.addrs.addr1 = daddr;
961 key->addr_u.addrs.addr2 = saddr;
962 key->swap |= IPFW_KEY_SWAP_ADDRS;
963 } else {
964 key->addr_u.addrs.addr1 = saddr;
965 key->addr_u.addrs.addr2 = daddr;
966 }
967
968 if (sport < dport) {
969 key->port_u.ports.port1 = dport;
970 key->port_u.ports.port2 = sport;
971 key->swap |= IPFW_KEY_SWAP_PORTS;
972 } else {
973 key->port_u.ports.port1 = sport;
974 key->port_u.ports.port2 = dport;
975 }
976
977 if (sport == dport && (key->swap & IPFW_KEY_SWAP_ADDRS))
978 key->swap |= IPFW_KEY_SWAP_PORTS;
979 if (saddr == daddr && (key->swap & IPFW_KEY_SWAP_PORTS))
980 key->swap |= IPFW_KEY_SWAP_ADDRS;
981 }
982
983 static __inline void
984 ipfw_key_4tuple(const struct ipfw_key *key, in_addr_t *saddr, uint16_t *sport,
985 in_addr_t *daddr, uint16_t *dport)
986 {
987
988 if (key->swap & IPFW_KEY_SWAP_ADDRS) {
989 *saddr = key->addr_u.addrs.addr2;
990 *daddr = key->addr_u.addrs.addr1;
991 } else {
992 *saddr = key->addr_u.addrs.addr1;
993 *daddr = key->addr_u.addrs.addr2;
994 }
995
996 if (key->swap & IPFW_KEY_SWAP_PORTS) {
997 *sport = key->port_u.ports.port2;
998 *dport = key->port_u.ports.port1;
999 } else {
1000 *sport = key->port_u.ports.port1;
1001 *dport = key->port_u.ports.port2;
1002 }
1003 }
1004
1005 static int
1006 ipfw_state_cmp(struct ipfw_state *s1, struct ipfw_state *s2)
1007 {
1008
1009 if (s1->st_proto > s2->st_proto)
1010 return (1);
1011 if (s1->st_proto < s2->st_proto)
1012 return (-1);
1013
1014 if (s1->st_addrs > s2->st_addrs)
1015 return (1);
1016 if (s1->st_addrs < s2->st_addrs)
1017 return (-1);
1018
1019 if (s1->st_ports > s2->st_ports)
1020 return (1);
1021 if (s1->st_ports < s2->st_ports)
1022 return (-1);
1023
1024 if (s1->st_swap == s2->st_swap ||
1025 (s1->st_swap ^ s2->st_swap) == IPFW_KEY_SWAP_ALL)
1026 return (0);
1027
1028 if (s1->st_swap > s2->st_swap)
1029 return (1);
1030 else
1031 return (-1);
1032 }
1033
1034 static int
1035 ipfw_trkcnt_cmp(struct ipfw_trkcnt *t1, struct ipfw_trkcnt *t2)
1036 {
1037
1038 if (t1->tc_proto > t2->tc_proto)
1039 return (1);
1040 if (t1->tc_proto < t2->tc_proto)
1041 return (-1);
1042
1043 if (t1->tc_addrs > t2->tc_addrs)
1044 return (1);
1045 if (t1->tc_addrs < t2->tc_addrs)
1046 return (-1);
1047
1048 if (t1->tc_ports > t2->tc_ports)
1049 return (1);
1050 if (t1->tc_ports < t2->tc_ports)
1051 return (-1);
1052
1053 if (t1->tc_ruleid > t2->tc_ruleid)
1054 return (1);
1055 if (t1->tc_ruleid < t2->tc_ruleid)
1056 return (-1);
1057
1058 return (0);
1059 }
1060
1061 static int
1062 ipfw_track_cmp(struct ipfw_track *t1, struct ipfw_track *t2)
1063 {
1064
1065 if (t1->t_proto > t2->t_proto)
1066 return (1);
1067 if (t1->t_proto < t2->t_proto)
1068 return (-1);
1069
1070 if (t1->t_addrs > t2->t_addrs)
1071 return (1);
1072 if (t1->t_addrs < t2->t_addrs)
1073 return (-1);
1074
1075 if (t1->t_ports > t2->t_ports)
1076 return (1);
1077 if (t1->t_ports < t2->t_ports)
1078 return (-1);
1079
1080 if ((uintptr_t)t1->t_rule > (uintptr_t)t2->t_rule)
1081 return (1);
1082 if ((uintptr_t)t1->t_rule < (uintptr_t)t2->t_rule)
1083 return (-1);
1084
1085 return (0);
1086 }
1087
1088 static __inline struct ipfw_state *
1089 ipfw_state_link(struct ipfw_context *ctx, struct ipfw_state *s)
1090 {
1091 struct ipfw_state *dup;
1092
1093 KASSERT((s->st_flags & IPFW_STATE_F_LINKED) == 0,
1094 ("state %p was linked", s));
1095 dup = RB_INSERT(ipfw_state_tree, &ctx->ipfw_state_tree, s);
1096 if (dup == NULL) {
1097 TAILQ_INSERT_TAIL(&ctx->ipfw_state_list, s, st_link);
1098 s->st_flags |= IPFW_STATE_F_LINKED;
1099 }
1100 return (dup);
1101 }
1102
1103 static __inline void
1104 ipfw_state_unlink(struct ipfw_context *ctx, struct ipfw_state *s)
1105 {
1106
1107 KASSERT(s->st_flags & IPFW_STATE_F_LINKED,
1108 ("state %p was not linked", s));
1109 RB_REMOVE(ipfw_state_tree, &ctx->ipfw_state_tree, s);
1110 TAILQ_REMOVE(&ctx->ipfw_state_list, s, st_link);
1111 s->st_flags &= ~IPFW_STATE_F_LINKED;
1112 }
1113
1114 static void
1115 ipfw_state_max_set(int state_max)
1116 {
1117
1118 ipfw_state_max = state_max;
1119 /* Allow 5% states over-allocation. */
1120 ipfw_state_loosecnt_updthr = (state_max / 20) / netisr_ncpus;
1121 }
1122
1123 static __inline int
1124 ipfw_state_cntcoll(void)
1125 {
1126 int cpu, state_cnt = 0;
1127
1128 for (cpu = 0; cpu < netisr_ncpus; ++cpu)
1129 state_cnt += ipfw_ctx[cpu]->ipfw_state_cnt;
1130 return (state_cnt);
1131 }
1132
1133 static __inline int
1134 ipfw_state_cntsync(void)
1135 {
1136 int state_cnt;
1137
1138 state_cnt = ipfw_state_cntcoll();
1139 ipfw_gd.ipfw_state_loosecnt = state_cnt;
1140 return (state_cnt);
1141 }
1142
1143 static __inline int
1144 ipfw_free_rule(struct ip_fw *rule)
1145 {
1146 KASSERT(rule->cpuid == mycpuid, ("rule freed on cpu%d", mycpuid));
1147 KASSERT(rule->refcnt > 0, ("invalid refcnt %u", rule->refcnt));
1148 rule->refcnt--;
1149 if (rule->refcnt == 0) {
1150 if (rule->cross_rules != NULL)
1151 kfree(rule->cross_rules, M_IPFW);
1152 kfree(rule, M_IPFW);
1153 return 1;
1154 }
1155 return 0;
1156 }
1157
1158 static void
1159 ipfw_unref_rule(void *priv)
1160 {
1161 ipfw_free_rule(priv);
1162 #ifdef KLD_MODULE
1163 KASSERT(ipfw_gd.ipfw_refcnt > 0,
1164 ("invalid ipfw_refcnt %d", ipfw_gd.ipfw_refcnt));
1165 atomic_subtract_int(&ipfw_gd.ipfw_refcnt, 1);
1166 #endif
1167 }
1168
1169 static __inline void
1170 ipfw_ref_rule(struct ip_fw *rule)
1171 {
1172 KASSERT(rule->cpuid == mycpuid, ("rule used on cpu%d", mycpuid));
1173 #ifdef KLD_MODULE
1174 atomic_add_int(&ipfw_gd.ipfw_refcnt, 1);
1175 #endif
1176 rule->refcnt++;
1177 }
1178
1179 /*
1180 * This macro maps an ip pointer into a layer3 header pointer of type T
1181 */
1182 #define L3HDR(T, ip) ((T *)((uint32_t *)(ip) + (ip)->ip_hl))
1183
1184 static __inline int
1185 icmptype_match(struct ip *ip, ipfw_insn_u32 *cmd)
1186 {
1187 int type = L3HDR(struct icmp,ip)->icmp_type;
1188 int idx_max = F_LEN(&cmd->o) - F_INSN_SIZE(ipfw_insn);
1189 int idx = type / 32;
1190
1191 if (idx >= idx_max)
1192 return (0);
1193 return (cmd->d[idx] & (1 << (type % 32)));
1194 }
1195
1196 static __inline int
1197 icmpcode_match(struct ip *ip, ipfw_insn_u32 *cmd)
1198 {
1199 int code = L3HDR(struct icmp,ip)->icmp_code;
1200 int idx_max = F_LEN(&cmd->o) - F_INSN_SIZE(ipfw_insn);
1201 int idx = code / 32;
1202
1203 if (idx >= idx_max)
1204 return (0);
1205 return (cmd->d[idx] & (1 << (code % 32)));
1206 }
1207
1208 #define TT ((1 << ICMP_ECHO) | \
1209 (1 << ICMP_ROUTERSOLICIT) | \
1210 (1 << ICMP_TSTAMP) | \
1211 (1 << ICMP_IREQ) | \
1212 (1 << ICMP_MASKREQ))
1213
1214 static int
1215 is_icmp_query(struct ip *ip)
1216 {
1217 int type = L3HDR(struct icmp, ip)->icmp_type;
1218
1219 return (type < 32 && (TT & (1 << type)));
1220 }
1221
1222 #undef TT
1223
1224 /*
1225 * The following checks use two arrays of 8 or 16 bits to store the
1226 * bits that we want set or clear, respectively. They are in the
1227 * low and high half of cmd->arg1 or cmd->d[0].
1228 *
1229 * We scan options and store the bits we find set. We succeed if
1230 *
1231 * (want_set & ~bits) == 0 && (want_clear & ~bits) == want_clear
1232 *
1233 * The code is sometimes optimized not to store additional variables.
1234 */
1235 static int
1236 flags_match(ipfw_insn *cmd, uint8_t bits)
1237 {
1238 u_char want_clear;
1239 bits = ~bits;
1240
1241 if (((cmd->arg1 & 0xff) & bits) != 0)
1242 return 0; /* some bits we want set were clear */
1243
1244 want_clear = (cmd->arg1 >> 8) & 0xff;
1245 if ((want_clear & bits) != want_clear)
1246 return 0; /* some bits we want clear were set */
1247 return 1;
1248 }
1249
1250 static int
1251 ipopts_match(struct ip *ip, ipfw_insn *cmd)
1252 {
1253 int optlen, bits = 0;
1254 u_char *cp = (u_char *)(ip + 1);
1255 int x = (ip->ip_hl << 2) - sizeof(struct ip);
1256
1257 for (; x > 0; x -= optlen, cp += optlen) {
1258 int opt = cp[IPOPT_OPTVAL];
1259
1260 if (opt == IPOPT_EOL)
1261 break;
1262
1263 if (opt == IPOPT_NOP) {
1264 optlen = 1;
1265 } else {
1266 optlen = cp[IPOPT_OLEN];
1267 if (optlen <= 0 || optlen > x)
1268 return 0; /* invalid or truncated */
1269 }
1270
1271 switch (opt) {
1272 case IPOPT_LSRR:
1273 bits |= IP_FW_IPOPT_LSRR;
1274 break;
1275
1276 case IPOPT_SSRR:
1277 bits |= IP_FW_IPOPT_SSRR;
1278 break;
1279
1280 case IPOPT_RR:
1281 bits |= IP_FW_IPOPT_RR;
1282 break;
1283
1284 case IPOPT_TS:
1285 bits |= IP_FW_IPOPT_TS;
1286 break;
1287
1288 default:
1289 break;
1290 }
1291 }
1292 return (flags_match(cmd, bits));
1293 }
1294
1295 static int
1296 tcpopts_match(struct ip *ip, ipfw_insn *cmd)
1297 {
1298 int optlen, bits = 0;
1299 struct tcphdr *tcp = L3HDR(struct tcphdr,ip);
1300 u_char *cp = (u_char *)(tcp + 1);
1301 int x = (tcp->th_off << 2) - sizeof(struct tcphdr);
1302
1303 for (; x > 0; x -= optlen, cp += optlen) {
1304 int opt = cp[0];
1305
1306 if (opt == TCPOPT_EOL)
1307 break;
1308
1309 if (opt == TCPOPT_NOP) {
1310 optlen = 1;
1311 } else {
1312 optlen = cp[1];
1313 if (optlen <= 0)
1314 break;
1315 }
1316
1317 switch (opt) {
1318 case TCPOPT_MAXSEG:
1319 bits |= IP_FW_TCPOPT_MSS;
1320 break;
1321
1322 case TCPOPT_WINDOW:
1323 bits |= IP_FW_TCPOPT_WINDOW;
1324 break;
1325
1326 case TCPOPT_SACK_PERMITTED:
1327 case TCPOPT_SACK:
1328 bits |= IP_FW_TCPOPT_SACK;
1329 break;
1330
1331 case TCPOPT_TIMESTAMP:
1332 bits |= IP_FW_TCPOPT_TS;
1333 break;
1334
1335 case TCPOPT_CC:
1336 case TCPOPT_CCNEW:
1337 case TCPOPT_CCECHO:
1338 bits |= IP_FW_TCPOPT_CC;
1339 break;
1340
1341 default:
1342 break;
1343 }
1344 }
1345 return (flags_match(cmd, bits));
1346 }
1347
1348 static int
1349 iface_match(struct ifnet *ifp, ipfw_insn_if *cmd)
1350 {
1351 if (ifp == NULL) /* no iface with this packet, match fails */
1352 return 0;
1353
1354 /* Check by name or by IP address */
1355 if (cmd->name[0] != '\0') { /* match by name */
1356 /* Check name */
1357 if (cmd->p.glob) {
1358 if (kfnmatch(cmd->name, ifp->if_xname, 0) == 0)
1359 return(1);
1360 } else {
1361 if (strncmp(ifp->if_xname, cmd->name, IFNAMSIZ) == 0)
1362 return(1);
1363 }
1364 } else {
1365 struct ifaddr_container *ifac;
1366
1367 TAILQ_FOREACH(ifac, &ifp->if_addrheads[mycpuid], ifa_link) {
1368 struct ifaddr *ia = ifac->ifa;
1369
1370 if (ia->ifa_addr == NULL)
1371 continue;
1372 if (ia->ifa_addr->sa_family != AF_INET)
1373 continue;
1374 if (cmd->p.ip.s_addr == ((struct sockaddr_in *)
1375 (ia->ifa_addr))->sin_addr.s_addr)
1376 return(1); /* match */
1377 }
1378 }
1379 return(0); /* no match, fail ... */
1380 }
1381
1382 #define SNPARGS(buf, len) buf + len, sizeof(buf) > len ? sizeof(buf) - len : 0
1383
1384 /*
1385 * We enter here when we have a rule with O_LOG.
1386 * XXX this function alone takes about 2Kbytes of code!
1387 */
1388 static void
1389 ipfw_log(struct ipfw_context *ctx, struct ip_fw *f, u_int hlen,
1390 struct ether_header *eh, struct mbuf *m, struct ifnet *oif)
1391 {
1392 char *action;
1393 int limit_reached = 0;
1394 char action2[40], proto[48], fragment[28], abuf[INET_ADDRSTRLEN];
1395
1396 fragment[0] = '\0';
1397 proto[0] = '\0';
1398
1399 if (f == NULL) { /* bogus pkt */
1400 if (verbose_limit != 0 &&
1401 ctx->ipfw_norule_counter >= verbose_limit)
1402 return;
1403 ctx->ipfw_norule_counter++;
1404 if (ctx->ipfw_norule_counter == verbose_limit)
1405 limit_reached = verbose_limit;
1406 action = "Refuse";
1407 } else { /* O_LOG is the first action, find the real one */
1408 ipfw_insn *cmd = ACTION_PTR(f);
1409 ipfw_insn_log *l = (ipfw_insn_log *)cmd;
1410
1411 if (l->max_log != 0 && l->log_left == 0)
1412 return;
1413 l->log_left--;
1414 if (l->log_left == 0)
1415 limit_reached = l->max_log;
1416 cmd += F_LEN(cmd); /* point to first action */
1417 if (cmd->opcode == O_PROB)
1418 cmd += F_LEN(cmd);
1419
1420 action = action2;
1421 switch (cmd->opcode) {
1422 case O_DENY:
1423 action = "Deny";
1424 break;
1425
1426 case O_REJECT:
1427 if (cmd->arg1==ICMP_REJECT_RST) {
1428 action = "Reset";
1429 } else if (cmd->arg1==ICMP_UNREACH_HOST) {
1430 action = "Reject";
1431 } else {
1432 ksnprintf(SNPARGS(action2, 0), "Unreach %d",
1433 cmd->arg1);
1434 }
1435 break;
1436
1437 case O_ACCEPT:
1438 action = "Accept";
1439 break;
1440
1441 case O_COUNT:
1442 action = "Count";
1443 break;
1444
1445 case O_DIVERT:
1446 ksnprintf(SNPARGS(action2, 0), "Divert %d", cmd->arg1);
1447 break;
1448
1449 case O_TEE:
1450 ksnprintf(SNPARGS(action2, 0), "Tee %d", cmd->arg1);
1451 break;
1452
1453 case O_SKIPTO:
1454 ksnprintf(SNPARGS(action2, 0), "SkipTo %d", cmd->arg1);
1455 break;
1456
1457 case O_PIPE:
1458 ksnprintf(SNPARGS(action2, 0), "Pipe %d", cmd->arg1);
1459 break;
1460
1461 case O_QUEUE:
1462 ksnprintf(SNPARGS(action2, 0), "Queue %d", cmd->arg1);
1463 break;
1464
1465 case O_FORWARD_IP:
1466 {
1467 ipfw_insn_sa *sa = (ipfw_insn_sa *)cmd;
1468 int len;
1469
1470 len = ksnprintf(SNPARGS(action2, 0),
1471 "Forward to %s",
1472 kinet_ntoa(sa->sa.sin_addr, abuf));
1473 if (sa->sa.sin_port) {
1474 ksnprintf(SNPARGS(action2, len), ":%d",
1475 sa->sa.sin_port);
1476 }
1477 }
1478 break;
1479
1480 default:
1481 action = "UNKNOWN";
1482 break;
1483 }
1484 }
1485
1486 if (hlen == 0) { /* non-ip */
1487 ksnprintf(SNPARGS(proto, 0), "MAC");
1488 } else {
1489 struct ip *ip = mtod(m, struct ip *);
1490 /* these three are all aliases to the same thing */
1491 struct icmp *const icmp = L3HDR(struct icmp, ip);
1492 struct tcphdr *const tcp = (struct tcphdr *)icmp;
1493 struct udphdr *const udp = (struct udphdr *)icmp;
1494
1495 int ip_off, offset, ip_len;
1496 int len;
1497
1498 ip_off = ntohs(ip->ip_off);
1499 ip_len = ntohs(ip->ip_len);
1500 offset = ip_off & IP_OFFMASK;
1501
1502 switch (ip->ip_p) {
1503 case IPPROTO_TCP:
1504 len = ksnprintf(SNPARGS(proto, 0), "TCP %s",
1505 kinet_ntoa(ip->ip_src, abuf));
1506 if (offset == 0) {
1507 ksnprintf(SNPARGS(proto, len), ":%d %s:%d",
1508 ntohs(tcp->th_sport),
1509 kinet_ntoa(ip->ip_dst, abuf),
1510 ntohs(tcp->th_dport));
1511 } else {
1512 ksnprintf(SNPARGS(proto, len), " %s",
1513 kinet_ntoa(ip->ip_dst, abuf));
1514 }
1515 break;
1516
1517 case IPPROTO_UDP:
1518 len = ksnprintf(SNPARGS(proto, 0), "UDP %s",
1519 kinet_ntoa(ip->ip_src, abuf));
1520 if (offset == 0) {
1521 ksnprintf(SNPARGS(proto, len), ":%d %s:%d",
1522 ntohs(udp->uh_sport),
1523 kinet_ntoa(ip->ip_dst, abuf),
1524 ntohs(udp->uh_dport));
1525 } else {
1526 ksnprintf(SNPARGS(proto, len), " %s",
1527 kinet_ntoa(ip->ip_dst, abuf));
1528 }
1529 break;
1530
1531 case IPPROTO_ICMP:
1532 if (offset == 0) {
1533 len = ksnprintf(SNPARGS(proto, 0),
1534 "ICMP:%u.%u ",
1535 icmp->icmp_type,
1536 icmp->icmp_code);
1537 } else {
1538 len = ksnprintf(SNPARGS(proto, 0), "ICMP ");
1539 }
1540 len += ksnprintf(SNPARGS(proto, len), "%s",
1541 kinet_ntoa(ip->ip_src, abuf));
1542 ksnprintf(SNPARGS(proto, len), " %s",
1543 kinet_ntoa(ip->ip_dst, abuf));
1544 break;
1545
1546 default:
1547 len = ksnprintf(SNPARGS(proto, 0), "P:%d %s", ip->ip_p,
1548 kinet_ntoa(ip->ip_src, abuf));
1549 ksnprintf(SNPARGS(proto, len), " %s",
1550 kinet_ntoa(ip->ip_dst, abuf));
1551 break;
1552 }
1553
1554 if (ip_off & (IP_MF | IP_OFFMASK)) {
1555 ksnprintf(SNPARGS(fragment, 0), " (frag %d:%d@%d%s)",
1556 ntohs(ip->ip_id), ip_len - (ip->ip_hl << 2),
1557 offset << 3, (ip_off & IP_MF) ? "+" : "");
1558 }
1559 }
1560
1561 if (oif || m->m_pkthdr.rcvif) {
1562 log(LOG_SECURITY | LOG_INFO,
1563 "ipfw: %d %s %s %s via %s%s\n",
1564 f ? f->rulenum : -1,
1565 action, proto, oif ? "out" : "in",
1566 oif ? oif->if_xname : m->m_pkthdr.rcvif->if_xname,
1567 fragment);
1568 } else {
1569 log(LOG_SECURITY | LOG_INFO,
1570 "ipfw: %d %s %s [no if info]%s\n",
1571 f ? f->rulenum : -1,
1572 action, proto, fragment);
1573 }
1574
1575 if (limit_reached) {
1576 log(LOG_SECURITY | LOG_NOTICE,
1577 "ipfw: limit %d reached on entry %d\n",
1578 limit_reached, f ? f->rulenum : -1);
1579 }
1580 }
1581
1582 #undef SNPARGS
1583
1584 static void
1585 ipfw_xlat_reap(struct ipfw_xlat *x, struct ipfw_xlat *slave_x)
1586 {
1587 struct ip_fw *rule = slave_x->xlat_rule;
1588
1589 KKASSERT(rule->cpuid == mycpuid);
1590
1591 /* No more cross references; free this pair now. */
1592 kfree(x, M_IPFW);
1593 kfree(slave_x, M_IPFW);
1594
1595 /* See the comment in ipfw_ip_xlate_dispatch(). */
1596 rule->cross_refs--;
1597 }
1598
1599 static void
1600 ipfw_xlat_reap_dispatch(netmsg_t nm)
1601 {
1602 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
1603 struct ipfw_state *s, *ns;
1604
1605 ASSERT_NETISR_NCPUS(mycpuid);
1606
1607 crit_enter();
1608 /* Reply ASAP. */
1609 netisr_replymsg(&ctx->ipfw_xlatreap_nm, 0);
1610 crit_exit();
1611
1612 /* TODO: limit scanning depth */
1613 TAILQ_FOREACH_MUTABLE(s, &ctx->ipfw_xlatreap, st_link, ns) {
1614 struct ipfw_xlat *x = (struct ipfw_xlat *)s;
1615 struct ipfw_xlat *slave_x = x->xlat_pair;
1616 uint64_t crefs;
1617
1618 crefs = slave_x->xlat_crefs + x->xlat_crefs;
1619 if (crefs == 0) {
1620 TAILQ_REMOVE(&ctx->ipfw_xlatreap, &x->xlat_st, st_link);
1621 ipfw_xlat_reap(x, slave_x);
1622 }
1623 }
1624 if (!TAILQ_EMPTY(&ctx->ipfw_xlatreap)) {
1625 callout_reset(&ctx->ipfw_xlatreap_ch, 2, ipfw_xlat_reap_timeo,
1626 &ctx->ipfw_xlatreap_nm);
1627 }
1628 }
1629
1630 static void
1631 ipfw_xlat_reap_timeo(void *xnm)
1632 {
1633 struct netmsg_base *nm = xnm;
1634
1635 KKASSERT(mycpuid < netisr_ncpus);
1636
1637 crit_enter();
1638 if (nm->lmsg.ms_flags & MSGF_DONE)
1639 netisr_sendmsg_oncpu(nm);
1640 crit_exit();
1641 }
1642
1643 static void
1644 ipfw_xlat_free_dispatch(netmsg_t nmsg)
1645 {
1646 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
1647 struct ipfw_xlat *x = nmsg->lmsg.u.ms_resultp;
1648 struct ipfw_xlat *slave_x = x->xlat_pair;
1649 uint64_t crefs;
1650
1651 ASSERT_NETISR_NCPUS(mycpuid);
1652
1653 KKASSERT(slave_x != NULL);
1654 KKASSERT(slave_x->xlat_invalid && x->xlat_invalid);
1655
1656 KASSERT((x->xlat_flags & IPFW_STATE_F_LINKED) == 0,
1657 ("master xlat is still linked"));
1658 if (slave_x->xlat_flags & IPFW_STATE_F_LINKED)
1659 ipfw_state_unlink(ctx, &slave_x->xlat_st);
1660
1661 /* See the comment in ipfw_ip_xlate_dispatch(). */
1662 slave_x->xlat_crefs--;
1663
1664 crefs = slave_x->xlat_crefs + x->xlat_crefs;
1665 if (crefs == 0) {
1666 ipfw_xlat_reap(x, slave_x);
1667 return;
1668 }
1669
1670 if (TAILQ_EMPTY(&ctx->ipfw_xlatreap)) {
1671 callout_reset(&ctx->ipfw_xlatreap_ch, 2, ipfw_xlat_reap_timeo,
1672 &ctx->ipfw_xlatreap_nm);
1673 }
1674
1675 /*
1676 * This pair is still referenced; defer its destruction.
1677 * YYY reuse st_link.
1678 */
1679 TAILQ_INSERT_TAIL(&ctx->ipfw_xlatreap, &x->xlat_st, st_link);
1680 }
1681
1682 static __inline void
1683 ipfw_xlat_invalidate(struct ipfw_xlat *x)
1684 {
1685
1686 x->xlat_invalid = 1;
1687 x->xlat_pair->xlat_invalid = 1;
1688 }
1689
1690 static void
1691 ipfw_state_del(struct ipfw_context *ctx, struct ipfw_state *s)
1692 {
1693 struct ipfw_xlat *x, *slave_x;
1694 struct netmsg_base *nm;
1695
1696 KASSERT(s->st_type == O_KEEP_STATE || s->st_type == O_LIMIT ||
1697 IPFW_ISXLAT(s->st_type), ("invalid state type %u", s->st_type));
1698 KASSERT((s->st_flags & IPFW_STATE_F_XLATSLAVE) == 0,
1699 ("delete slave xlat"));
1700
1701 KASSERT(ctx->ipfw_state_cnt > 0,
1702 ("invalid state count %d", ctx->ipfw_state_cnt));
1703 ctx->ipfw_state_cnt--;
1704 if (ctx->ipfw_state_loosecnt > 0)
1705 ctx->ipfw_state_loosecnt--;
1706
1707 /*
1708 * Unhook this state.
1709 */
1710 if (s->st_track != NULL) {
1711 struct ipfw_track *t = s->st_track;
1712
1713 KASSERT(!LIST_EMPTY(&t->t_state_list),
1714 ("track state list is empty"));
1715 LIST_REMOVE(s, st_trklink);
1716
1717 KASSERT(*t->t_count > 0,
1718 ("invalid track count %d", *t->t_count));
1719 atomic_subtract_int(t->t_count, 1);
1720 }
1721 ipfw_state_unlink(ctx, s);
1722
1723 /*
1724 * Free this state. Xlat requires special processing,
1725 * since xlat are paired state and they could be on
1726 * different cpus.
1727 */
1728
1729 if (!IPFW_ISXLAT(s->st_type)) {
1730 /* Not xlat; free now. */
1731 kfree(s, M_IPFW);
1732 /* Done! */
1733 return;
1734 }
1735 x = (struct ipfw_xlat *)s;
1736
1737 if (x->xlat_pair == NULL) {
1738 /* Not setup yet; free now. */
1739 kfree(x, M_IPFW);
1740 /* Done! */
1741 return;
1742 }
1743 slave_x = x->xlat_pair;
1744 KKASSERT(slave_x->xlat_flags & IPFW_STATE_F_XLATSLAVE);
1745
1746 if (x->xlat_pcpu == mycpuid) {
1747 /*
1748 * Paired states are on the same cpu; delete this
1749 * pair now.
1750 */
1751 KKASSERT(x->xlat_crefs == 0);
1752 KKASSERT(slave_x->xlat_crefs == 0);
1753 if (slave_x->xlat_flags & IPFW_STATE_F_LINKED)
1754 ipfw_state_unlink(ctx, &slave_x->xlat_st);
1755 kfree(x, M_IPFW);
1756 kfree(slave_x, M_IPFW);
1757 return;
1758 }
1759
1760 /*
1761 * Free the paired states on the cpu owning the slave xlat.
1762 */
1763
1764 /*
1765 * Mark the state pair invalid; completely deleting them
1766 * may take some time.
1767 */
1768 ipfw_xlat_invalidate(x);
1769
1770 nm = &x->xlat_freenm;
1771 netmsg_init(nm, NULL, &netisr_apanic_rport, MSGF_PRIORITY,
1772 ipfw_xlat_free_dispatch);
1773 nm->lmsg.u.ms_resultp = x;
1774
1775 /* See the comment in ipfw_xlate_redispatch(). */
1776 x->xlat_rule->cross_refs++;
1777 x->xlat_crefs++;
1778
1779 netisr_sendmsg(nm, x->xlat_pcpu);
1780 }
1781
1782 static void
1783 ipfw_state_remove(struct ipfw_context *ctx, struct ipfw_state *s)
1784 {
1785
1786 if (s->st_flags & IPFW_STATE_F_XLATSLAVE) {
1787 KKASSERT(IPFW_ISXLAT(s->st_type));
1788 ipfw_xlat_invalidate((struct ipfw_xlat *)s);
1789 ipfw_state_unlink(ctx, s);
1790 return;
1791 }
1792 ipfw_state_del(ctx, s);
1793 }
1794
1795 static int
1796 ipfw_state_reap(struct ipfw_context *ctx, int reap_max)
1797 {
1798 struct ipfw_state *s, *anchor;
1799 int expired;
1800
1801 if (reap_max < ipfw_state_reap_min)
1802 reap_max = ipfw_state_reap_min;
1803
1804 if ((ctx->ipfw_flags & IPFW_FLAG_STATEEXP) == 0) {
1805 /*
1806 * Kick start state expiring. Ignore scan limit,
1807 * we are short of states.
1808 */
1809 ctx->ipfw_flags |= IPFW_FLAG_STATEREAP;
1810 expired = ipfw_state_expire_start(ctx, INT_MAX, reap_max);
1811 ctx->ipfw_flags &= ~IPFW_FLAG_STATEREAP;
1812 return (expired);
1813 }
1814
1815 /*
1816 * States are being expired.
1817 */
1818
1819 if (ctx->ipfw_state_cnt == 0)
1820 return (0);
1821
1822 expired = 0;
1823 anchor = &ctx->ipfw_stateexp_anch;
1824 while ((s = TAILQ_NEXT(anchor, st_link)) != NULL) {
1825 /*
1826 * Ignore scan limit; we are short of states.
1827 */
1828
1829 TAILQ_REMOVE(&ctx->ipfw_state_list, anchor, st_link);
1830 TAILQ_INSERT_AFTER(&ctx->ipfw_state_list, s, anchor, st_link);
1831
1832 if (IPFW_STATE_SCANSKIP(s))
1833 continue;
1834
1835 if (IPFW_STATE_ISDEAD(s) || IPFW_STATE_TCPCLOSED(s)) {
1836 ipfw_state_del(ctx, s);
1837 if (++expired >= reap_max)
1838 break;
1839 if ((expired & 0xff) == 0 &&
1840 ipfw_state_cntcoll() + ipfw_state_headroom <=
1841 ipfw_state_max)
1842 break;
1843 }
1844 }
1845 /*
1846 * NOTE:
1847 * Leave the anchor on the list, even if the end of the list has
1848 * been reached. ipfw_state_expire_more_dispatch() will handle
1849 * the removal.
1850 */
1851 return (expired);
1852 }
1853
1854 static void
1855 ipfw_state_flush(struct ipfw_context *ctx, const struct ip_fw *rule)
1856 {
1857 struct ipfw_state *s, *sn;
1858
1859 TAILQ_FOREACH_MUTABLE(s, &ctx->ipfw_state_list, st_link, sn) {
1860 if (IPFW_STATE_SCANSKIP(s))
1861 continue;
1862 if (rule != NULL && s->st_rule != rule)
1863 continue;
1864 ipfw_state_del(ctx, s);
1865 }
1866 }
1867
1868 static void
1869 ipfw_state_expire_done(struct ipfw_context *ctx)
1870 {
1871
1872 KASSERT(ctx->ipfw_flags & IPFW_FLAG_STATEEXP,
1873 ("stateexp is not in progress"));
1874 ctx->ipfw_flags &= ~IPFW_FLAG_STATEEXP;
1875 callout_reset(&ctx->ipfw_stateto_ch, hz,
1876 ipfw_state_expire_ipifunc, NULL);
1877 }
1878
1879 static void
1880 ipfw_state_expire_more(struct ipfw_context *ctx)
1881 {
1882 struct netmsg_base *nm = &ctx->ipfw_stateexp_more;
1883
1884 KASSERT(ctx->ipfw_flags & IPFW_FLAG_STATEEXP,
1885 ("stateexp is not in progress"));
1886 KASSERT(nm->lmsg.ms_flags & MSGF_DONE,
1887 ("stateexp more did not finish"));
1888 netisr_sendmsg_oncpu(nm);
1889 }
1890
1891 static int
1892 ipfw_state_expire_loop(struct ipfw_context *ctx, struct ipfw_state *anchor,
1893 int scan_max, int expire_max)
1894 {
1895 struct ipfw_state *s;
1896 int scanned = 0, expired = 0;
1897
1898 KASSERT(ctx->ipfw_flags & IPFW_FLAG_STATEEXP,
1899 ("stateexp is not in progress"));
1900
1901 while ((s = TAILQ_NEXT(anchor, st_link)) != NULL) {
1902 if (scanned++ >= scan_max) {
1903 ipfw_state_expire_more(ctx);
1904 return (expired);
1905 }
1906
1907 TAILQ_REMOVE(&ctx->ipfw_state_list, anchor, st_link);
1908 TAILQ_INSERT_AFTER(&ctx->ipfw_state_list, s, anchor, st_link);
1909
1910 if (IPFW_STATE_SCANSKIP(s))
1911 continue;
1912
1913 if (IPFW_STATE_ISDEAD(s) ||
1914 ((ctx->ipfw_flags & IPFW_FLAG_STATEREAP) &&
1915 IPFW_STATE_TCPCLOSED(s))) {
1916 ipfw_state_del(ctx, s);
1917 if (++expired >= expire_max) {
1918 ipfw_state_expire_more(ctx);
1919 return (expired);
1920 }
1921 if ((ctx->ipfw_flags & IPFW_FLAG_STATEREAP) &&
1922 (expired & 0xff) == 0 &&
1923 ipfw_state_cntcoll() + ipfw_state_headroom <=
1924 ipfw_state_max) {
1925 ipfw_state_expire_more(ctx);
1926 return (expired);
1927 }
1928 }
1929 }
1930 TAILQ_REMOVE(&ctx->ipfw_state_list, anchor, st_link);
1931 ipfw_state_expire_done(ctx);
1932 return (expired);
1933 }
1934
1935 static void
1936 ipfw_state_expire_more_dispatch(netmsg_t nm)
1937 {
1938 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
1939 struct ipfw_state *anchor;
1940
1941 ASSERT_NETISR_NCPUS(mycpuid);
1942 KASSERT(ctx->ipfw_flags & IPFW_FLAG_STATEEXP,
1943 ("statexp is not in progress"));
1944
1945 /* Reply ASAP */
1946 netisr_replymsg(&nm->base, 0);
1947
1948 anchor = &ctx->ipfw_stateexp_anch;
1949 if (ctx->ipfw_state_cnt == 0) {
1950 TAILQ_REMOVE(&ctx->ipfw_state_list, anchor, st_link);
1951 ipfw_state_expire_done(ctx);
1952 return;
1953 }
1954 ipfw_state_expire_loop(ctx, anchor,
1955 ipfw_state_scan_max, ipfw_state_expire_max);
1956 }
1957
1958 static int
1959 ipfw_state_expire_start(struct ipfw_context *ctx, int scan_max, int expire_max)
1960 {
1961 struct ipfw_state *anchor;
1962
1963 KASSERT((ctx->ipfw_flags & IPFW_FLAG_STATEEXP) == 0,
1964 ("stateexp is in progress"));
1965 ctx->ipfw_flags |= IPFW_FLAG_STATEEXP;
1966
1967 if (ctx->ipfw_state_cnt == 0) {
1968 ipfw_state_expire_done(ctx);
1969 return (0);
1970 }
1971
1972 /*
1973 * Do not expire more than once per second, it is useless.
1974 */
1975 if ((ctx->ipfw_flags & IPFW_FLAG_STATEREAP) == 0 &&
1976 ctx->ipfw_state_lastexp == time_uptime) {
1977 ipfw_state_expire_done(ctx);
1978 return (0);
1979 }
1980 ctx->ipfw_state_lastexp = time_uptime;
1981
1982 anchor = &ctx->ipfw_stateexp_anch;
1983 TAILQ_INSERT_HEAD(&ctx->ipfw_state_list, anchor, st_link);
1984 return (ipfw_state_expire_loop(ctx, anchor, scan_max, expire_max));
1985 }
1986
1987 static void
1988 ipfw_state_expire_dispatch(netmsg_t nm)
1989 {
1990 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
1991
1992 ASSERT_NETISR_NCPUS(mycpuid);
1993
1994 /* Reply ASAP */
1995 crit_enter();
1996 netisr_replymsg(&nm->base, 0);
1997 crit_exit();
1998
1999 if (ctx->ipfw_flags & IPFW_FLAG_STATEEXP) {
2000 /* Running; done. */
2001 return;
2002 }
2003 ipfw_state_expire_start(ctx,
2004 ipfw_state_scan_max, ipfw_state_expire_max);
2005 }
2006
2007 static void
2008 ipfw_state_expire_ipifunc(void *dummy __unused)
2009 {
2010 struct netmsg_base *msg;
2011
2012 KKASSERT(mycpuid < netisr_ncpus);
2013 msg = &ipfw_ctx[mycpuid]->ipfw_stateexp_nm;
2014
2015 crit_enter();
2016 if (msg->lmsg.ms_flags & MSGF_DONE)
2017 netisr_sendmsg_oncpu(msg);
2018 crit_exit();
2019 }
2020
2021 static boolean_t
2022 ipfw_state_update_tcp(struct ipfw_state *s, int dir, const struct tcphdr *tcp)
2023 {
2024 uint32_t seq = ntohl(tcp->th_seq);
2025 uint32_t ack = ntohl(tcp->th_ack);
2026
2027 if (tcp->th_flags & TH_RST)
2028 return (TRUE);
2029
2030 if (dir == MATCH_FORWARD) {
2031 if ((s->st_flags & IPFW_STATE_F_SEQFWD) == 0) {
2032 s->st_flags |= IPFW_STATE_F_SEQFWD;
2033 s->st_seq_fwd = seq;
2034 } else if (SEQ_GEQ(seq, s->st_seq_fwd)) {
2035 s->st_seq_fwd = seq;
2036 } else {
2037 /* Out-of-sequence; done. */
2038 return (FALSE);
2039 }
2040 if (tcp->th_flags & TH_ACK) {
2041 if ((s->st_flags & IPFW_STATE_F_ACKFWD) == 0) {
2042 s->st_flags |= IPFW_STATE_F_ACKFWD;
2043 s->st_ack_fwd = ack;
2044 } else if (SEQ_GEQ(ack, s->st_ack_fwd)) {
2045 s->st_ack_fwd = ack;
2046 } else {
2047 /* Out-of-sequence; done. */
2048 return (FALSE);
2049 }
2050
2051 if ((s->st_state & ((TH_FIN | TH_ACK) << 8)) ==
2052 (TH_FIN << 8) && s->st_ack_fwd == s->st_seq_rev + 1)
2053 s->st_state |= (TH_ACK << 8);
2054 }
2055 } else {
2056 if ((s->st_flags & IPFW_STATE_F_SEQREV) == 0) {
2057 s->st_flags |= IPFW_STATE_F_SEQREV;
2058 s->st_seq_rev = seq;
2059 } else if (SEQ_GEQ(seq, s->st_seq_rev)) {
2060 s->st_seq_rev = seq;
2061 } else {
2062 /* Out-of-sequence; done. */
2063 return (FALSE);
2064 }
2065 if (tcp->th_flags & TH_ACK) {
2066 if ((s->st_flags & IPFW_STATE_F_ACKREV) == 0) {
2067 s->st_flags |= IPFW_STATE_F_ACKREV;
2068 s->st_ack_rev= ack;
2069 } else if (SEQ_GEQ(ack, s->st_ack_rev)) {
2070 s->st_ack_rev = ack;
2071 } else {
2072 /* Out-of-sequence; done. */
2073 return (FALSE);
2074 }
2075
2076 if ((s->st_state & (TH_FIN | TH_ACK)) == TH_FIN &&
2077 s->st_ack_rev == s->st_seq_fwd + 1)
2078 s->st_state |= TH_ACK;
2079 }
2080 }
2081 return (TRUE);
2082 }
2083
2084 static void
2085 ipfw_state_update(const struct ipfw_flow_id *pkt, int dir,
2086 const struct tcphdr *tcp, struct ipfw_state *s)
2087 {
2088
2089 if (pkt->proto == IPPROTO_TCP) { /* update state according to flags */
2090 u_char flags = pkt->flags & IPFW_STATE_TCPFLAGS;
2091
2092 if (tcp != NULL && !ipfw_state_update_tcp(s, dir, tcp))
2093 return;
2094
2095 s->st_state |= (dir == MATCH_FORWARD) ? flags : (flags << 8);
2096 switch (s->st_state & IPFW_STATE_TCPSTATES) {
2097 case TH_SYN: /* opening */
2098 s->st_expire = time_uptime + dyn_syn_lifetime;
2099 break;
2100
2101 case BOTH_SYN: /* move to established */
2102 case BOTH_SYN | TH_FIN: /* one side tries to close */
2103 case BOTH_SYN | (TH_FIN << 8):
2104 s->st_expire = time_uptime + dyn_ack_lifetime;
2105 break;
2106
2107 case BOTH_SYN | BOTH_FIN: /* both sides closed */
2108 if ((s->st_state & BOTH_FINACK) == BOTH_FINACK) {
2109 /* And both FINs were ACKed. */
2110 s->st_expire = time_uptime + dyn_fin_lifetime;
2111 } else {
2112 s->st_expire = time_uptime +
2113 dyn_finwait_lifetime;
2114 }
2115 break;
2116
2117 default:
2118 #if 0
2119 /*
2120 * reset or some invalid combination, but can also
2121 * occur if we use keep-state the wrong way.
2122 */
2123 if ((s->st_state & ((TH_RST << 8) | TH_RST)) == 0)
2124 kprintf("invalid state: 0x%x\n", s->st_state);
2125 #endif
2126 s->st_expire = time_uptime + dyn_rst_lifetime;
2127 break;
2128 }
2129 } else if (pkt->proto == IPPROTO_UDP) {
2130 s->st_expire = time_uptime + dyn_udp_lifetime;
2131 } else {
2132 /* other protocols */
2133 s->st_expire = time_uptime + dyn_short_lifetime;
2134 }
2135 }
2136
2137 /*
2138 * Lookup a state.
2139 */
2140 static struct ipfw_state *
2141 ipfw_state_lookup(struct ipfw_context *ctx, const struct ipfw_flow_id *pkt,
2142 int *match_direction, const struct tcphdr *tcp)
2143 {
2144 struct ipfw_state *key, *s;
2145 int dir = MATCH_NONE;
2146
2147 key = &ctx->ipfw_state_tmpkey;
2148 ipfw_key_build(&key->st_key, pkt->src_ip, pkt->src_port,
2149 pkt->dst_ip, pkt->dst_port, pkt->proto);
2150 s = RB_FIND(ipfw_state_tree, &ctx->ipfw_state_tree, key);
2151 if (s == NULL)
2152 goto done; /* not found. */
2153 if (IPFW_STATE_ISDEAD(s)) {
2154 ipfw_state_remove(ctx, s);
2155 s = NULL;
2156 goto done;
2157 }
2158 if ((pkt->flags & TH_SYN) && IPFW_STATE_TCPCLOSED(s)) {
2159 /* TCP ports recycling is too fast. */
2160 ctx->ipfw_sts_tcprecycled++;
2161 ipfw_state_remove(ctx, s);
2162 s = NULL;
2163 goto done;
2164 }
2165
2166 if (s->st_swap == key->st_swap) {
2167 dir = MATCH_FORWARD;
2168 } else {
2169 KASSERT((s->st_swap & key->st_swap) == 0,
2170 ("found mismatch state"));
2171 dir = MATCH_REVERSE;
2172 }
2173
2174 /* Update this state. */
2175 ipfw_state_update(pkt, dir, tcp, s);
2176
2177 if (s->st_track != NULL) {
2178 /* This track has been used. */
2179 s->st_track->t_expire = time_uptime + dyn_short_lifetime;
2180 }
2181 done:
2182 if (match_direction)
2183 *match_direction = dir;
2184 return (s);
2185 }
2186
2187 static struct ipfw_state *
2188 ipfw_state_alloc(struct ipfw_context *ctx, const struct ipfw_flow_id *id,
2189 uint16_t type, struct ip_fw *rule, const struct tcphdr *tcp)
2190 {
2191 struct ipfw_state *s;
2192 size_t sz;
2193
2194 KASSERT(type == O_KEEP_STATE || type == O_LIMIT || IPFW_ISXLAT(type),
2195 ("invalid state type %u", type));
2196
2197 sz = sizeof(struct ipfw_state);
2198 if (IPFW_ISXLAT(type))
2199 sz = sizeof(struct ipfw_xlat);
2200
2201 s = kmalloc(sz, M_IPFW, M_INTWAIT | M_NULLOK | M_ZERO);
2202 if (s == NULL) {
2203 ctx->ipfw_sts_nomem++;
2204 return (NULL);
2205 }
2206
2207 ipfw_key_build(&s->st_key, id->src_ip, id->src_port,
2208 id->dst_ip, id->dst_port, id->proto);
2209
2210 s->st_rule = rule;
2211 s->st_type = type;
2212 if (IPFW_ISXLAT(type)) {
2213 struct ipfw_xlat *x = (struct ipfw_xlat *)s;
2214
2215 x->xlat_dir = MATCH_NONE;
2216 x->xlat_pcpu = -1;
2217 }
2218
2219 /*
2220 * Update this state:
2221 * Set st_expire and st_state.
2222 */
2223 ipfw_state_update(id, MATCH_FORWARD, tcp, s);
2224
2225 return (s);
2226 }
2227
2228 static struct ipfw_state *
2229 ipfw_state_add(struct ipfw_context *ctx, const struct ipfw_flow_id *id,
2230 uint16_t type, struct ip_fw *rule, struct ipfw_track *t,
2231 const struct tcphdr *tcp)
2232 {
2233 struct ipfw_state *s, *dup;
2234
2235 s = ipfw_state_alloc(ctx, id, type, rule, tcp);
2236 if (s == NULL)
2237 return (NULL);
2238
2239 ctx->ipfw_state_cnt++;
2240 ctx->ipfw_state_loosecnt++;
2241 if (ctx->ipfw_state_loosecnt >= ipfw_state_loosecnt_updthr) {
2242 ipfw_gd.ipfw_state_loosecnt += ctx->ipfw_state_loosecnt;
2243 ctx->ipfw_state_loosecnt = 0;
2244 }
2245
2246 dup = ipfw_state_link(ctx, s);
2247 if (dup != NULL)
2248 panic("ipfw: %u state exists %p", type, dup);
2249
2250 if (t != NULL) {
2251 /* Keep the track referenced. */
2252 LIST_INSERT_HEAD(&t->t_state_list, s, st_trklink);
2253 s->st_track = t;
2254 }
2255 return (s);
2256 }
2257
2258 static boolean_t
2259 ipfw_track_free(struct ipfw_context *ctx, struct ipfw_track *t)
2260 {
2261 struct ipfw_trkcnt *trk;
2262 boolean_t trk_freed = FALSE;
2263
2264 KASSERT(t->t_count != NULL, ("track anchor"));
2265 KASSERT(LIST_EMPTY(&t->t_state_list),
2266 ("invalid track is still referenced"));
2267
2268 trk = t->t_trkcnt;
2269 KASSERT(trk != NULL, ("track has no trkcnt"));
2270
2271 RB_REMOVE(ipfw_track_tree, &ctx->ipfw_track_tree, t);
2272 TAILQ_REMOVE(&ctx->ipfw_track_list, t, t_link);
2273 kfree(t, M_IPFW);
2274
2275 /*
2276 * fdrop() style reference counting.
2277 * See kern/kern_descrip.c fdrop().
2278 */
2279 for (;;) {
2280 int refs = trk->tc_refs;
2281
2282 cpu_ccfence();
2283 KASSERT(refs > 0, ("invalid trkcnt refs %d", refs));
2284 if (refs == 1) {
2285 IPFW_TRKCNT_TOKGET;
2286 if (atomic_cmpset_int(&trk->tc_refs, refs, 0)) {
2287 KASSERT(trk->tc_count == 0,
2288 ("%d states reference this trkcnt",
2289 trk->tc_count));
2290 RB_REMOVE(ipfw_trkcnt_tree,
2291 &ipfw_gd.ipfw_trkcnt_tree, trk);
2292
2293 KASSERT(ipfw_gd.ipfw_trkcnt_cnt > 0,
2294 ("invalid trkcnt cnt %d",
2295 ipfw_gd.ipfw_trkcnt_cnt));
2296 ipfw_gd.ipfw_trkcnt_cnt--;
2297 IPFW_TRKCNT_TOKREL;
2298
2299 if (ctx->ipfw_trkcnt_spare == NULL)
2300 ctx->ipfw_trkcnt_spare = trk;
2301 else
2302 kfree(trk, M_IPFW);
2303 trk_freed = TRUE;
2304 break; /* done! */
2305 }
2306 IPFW_TRKCNT_TOKREL;
2307 /* retry */
2308 } else if (atomic_cmpset_int(&trk->tc_refs, refs, refs - 1)) {
2309 break; /* done! */
2310 }
2311 /* retry */
2312 }
2313 return (trk_freed);
2314 }
2315
2316 static void
2317 ipfw_track_flush(struct ipfw_context *ctx, struct ip_fw *rule)
2318 {
2319 struct ipfw_track *t, *tn;
2320
2321 TAILQ_FOREACH_MUTABLE(t, &ctx->ipfw_track_list, t_link, tn) {
2322 if (t->t_count == NULL) /* anchor */
2323 continue;
2324 if (rule != NULL && t->t_rule != rule)
2325 continue;
2326 ipfw_track_free(ctx, t);
2327 }
2328 }
2329
2330 static boolean_t
2331 ipfw_track_state_expire(struct ipfw_context *ctx, struct ipfw_track *t,
2332 boolean_t reap)
2333 {
2334 struct ipfw_state *s, *sn;
2335 boolean_t ret = FALSE;
2336
2337 KASSERT(t->t_count != NULL, ("track anchor"));
2338
2339 if (LIST_EMPTY(&t->t_state_list))
2340 return (FALSE);
2341
2342 /*
2343 * Do not expire more than once per second, it is useless.
2344 */
2345 if (t->t_lastexp == time_uptime)
2346 return (FALSE);
2347 t->t_lastexp = time_uptime;
2348
2349 LIST_FOREACH_MUTABLE(s, &t->t_state_list, st_trklink, sn) {
2350 if (IPFW_STATE_ISDEAD(s) || (reap && IPFW_STATE_TCPCLOSED(s))) {
2351 KASSERT(s->st_track == t,
2352 ("state track %p does not match %p",
2353 s->st_track, t));
2354 ipfw_state_del(ctx, s);
2355 ret = TRUE;
2356 }
2357 }
2358 return (ret);
2359 }
2360
2361 static __inline struct ipfw_trkcnt *
2362 ipfw_trkcnt_alloc(struct ipfw_context *ctx)
2363 {
2364 struct ipfw_trkcnt *trk;
2365
2366 if (ctx->ipfw_trkcnt_spare != NULL) {
2367 trk = ctx->ipfw_trkcnt_spare;
2368 ctx->ipfw_trkcnt_spare = NULL;
2369 } else {
2370 trk = kmalloc(sizeof(*trk), M_IPFW,
2371 M_INTWAIT | M_NULLOK | M_CACHEALIGN);
2372 }
2373 return (trk);
2374 }
2375
2376 static void
2377 ipfw_track_expire_done(struct ipfw_context *ctx)
2378 {
2379
2380 KASSERT(ctx->ipfw_flags & IPFW_FLAG_TRACKEXP,
2381 ("trackexp is not in progress"));
2382 ctx->ipfw_flags &= ~IPFW_FLAG_TRACKEXP;
2383 callout_reset(&ctx->ipfw_trackto_ch, hz,
2384 ipfw_track_expire_ipifunc, NULL);
2385 }
2386
2387 static void
2388 ipfw_track_expire_more(struct ipfw_context *ctx)
2389 {
2390 struct netmsg_base *nm = &ctx->ipfw_trackexp_more;
2391
2392 KASSERT(ctx->ipfw_flags & IPFW_FLAG_TRACKEXP,
2393 ("trackexp is not in progress"));
2394 KASSERT(nm->lmsg.ms_flags & MSGF_DONE,
2395 ("trackexp more did not finish"));
2396 netisr_sendmsg_oncpu(nm);
2397 }
2398
2399 static int
2400 ipfw_track_expire_loop(struct ipfw_context *ctx, struct ipfw_track *anchor,
2401 int scan_max, int expire_max)
2402 {
2403 struct ipfw_track *t;
2404 int scanned = 0, expired = 0;
2405 boolean_t reap = FALSE;
2406
2407 KASSERT(ctx->ipfw_flags & IPFW_FLAG_TRACKEXP,
2408 ("trackexp is not in progress"));
2409
2410 if (ctx->ipfw_flags & IPFW_FLAG_TRACKREAP)
2411 reap = TRUE;
2412
2413 while ((t = TAILQ_NEXT(anchor, t_link)) != NULL) {
2414 if (scanned++ >= scan_max) {
2415 ipfw_track_expire_more(ctx);
2416 return (expired);
2417 }
2418
2419 TAILQ_REMOVE(&ctx->ipfw_track_list, anchor, t_link);
2420 TAILQ_INSERT_AFTER(&ctx->ipfw_track_list, t, anchor, t_link);
2421
2422 if (t->t_count == NULL) /* anchor */
2423 continue;
2424
2425 ipfw_track_state_expire(ctx, t, reap);
2426 if (!LIST_EMPTY(&t->t_state_list)) {
2427 /* There are states referencing this track. */
2428 continue;
2429 }
2430
2431 if (TIME_LEQ(t->t_expire, time_uptime) || reap) {
2432 /* Expired. */
2433 if (ipfw_track_free(ctx, t)) {
2434 if (++expired >= expire_max) {
2435 ipfw_track_expire_more(ctx);
2436 return (expired);
2437 }
2438 }
2439 }
2440 }
2441 TAILQ_REMOVE(&ctx->ipfw_track_list, anchor, t_link);
2442 ipfw_track_expire_done(ctx);
2443 return (expired);
2444 }
2445
2446 static int
2447 ipfw_track_expire_start(struct ipfw_context *ctx, int scan_max, int expire_max)
2448 {
2449 struct ipfw_track *anchor;
2450
2451 KASSERT((ctx->ipfw_flags & IPFW_FLAG_TRACKEXP) == 0,
2452 ("trackexp is in progress"));
2453 ctx->ipfw_flags |= IPFW_FLAG_TRACKEXP;
2454
2455 if (RB_EMPTY(&ctx->ipfw_track_tree)) {
2456 ipfw_track_expire_done(ctx);
2457 return (0);
2458 }
2459
2460 /*
2461 * Do not expire more than once per second, it is useless.
2462 */
2463 if ((ctx->ipfw_flags & IPFW_FLAG_TRACKREAP) == 0 &&
2464 ctx->ipfw_track_lastexp == time_uptime) {
2465 ipfw_track_expire_done(ctx);
2466 return (0);
2467 }
2468 ctx->ipfw_track_lastexp = time_uptime;
2469
2470 anchor = &ctx->ipfw_trackexp_anch;
2471 TAILQ_INSERT_HEAD(&ctx->ipfw_track_list, anchor, t_link);
2472 return (ipfw_track_expire_loop(ctx, anchor, scan_max, expire_max));
2473 }
2474
2475 static void
2476 ipfw_track_expire_more_dispatch(netmsg_t nm)
2477 {
2478 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
2479 struct ipfw_track *anchor;
2480
2481 ASSERT_NETISR_NCPUS(mycpuid);
2482 KASSERT(ctx->ipfw_flags & IPFW_FLAG_TRACKEXP,
2483 ("trackexp is not in progress"));
2484
2485 /* Reply ASAP */
2486 netisr_replymsg(&nm->base, 0);
2487
2488 anchor = &ctx->ipfw_trackexp_anch;
2489 if (RB_EMPTY(&ctx->ipfw_track_tree)) {
2490 TAILQ_REMOVE(&ctx->ipfw_track_list, anchor, t_link);
2491 ipfw_track_expire_done(ctx);
2492 return;
2493 }
2494 ipfw_track_expire_loop(ctx, anchor,
2495 ipfw_track_scan_max, ipfw_track_expire_max);
2496 }
2497
2498 static void
2499 ipfw_track_expire_dispatch(netmsg_t nm)
2500 {
2501 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
2502
2503 ASSERT_NETISR_NCPUS(mycpuid);
2504
2505 /* Reply ASAP */
2506 crit_enter();
2507 netisr_replymsg(&nm->base, 0);
2508 crit_exit();
2509
2510 if (ctx->ipfw_flags & IPFW_FLAG_TRACKEXP) {
2511 /* Running; done. */
2512 return;
2513 }
2514 ipfw_track_expire_start(ctx,
2515 ipfw_track_scan_max, ipfw_track_expire_max);
2516 }
2517
2518 static void
2519 ipfw_track_expire_ipifunc(void *dummy __unused)
2520 {
2521 struct netmsg_base *msg;
2522
2523 KKASSERT(mycpuid < netisr_ncpus);
2524 msg = &ipfw_ctx[mycpuid]->ipfw_trackexp_nm;
2525
2526 crit_enter();
2527 if (msg->lmsg.ms_flags & MSGF_DONE)
2528 netisr_sendmsg_oncpu(msg);
2529 crit_exit();
2530 }
2531
2532 static int
2533 ipfw_track_reap(struct ipfw_context *ctx)
2534 {
2535 struct ipfw_track *t, *anchor;
2536 int expired;
2537
2538 if ((ctx->ipfw_flags & IPFW_FLAG_TRACKEXP) == 0) {
2539 /*
2540 * Kick start track expiring. Ignore scan limit,
2541 * we are short of tracks.
2542 */
2543 ctx->ipfw_flags |= IPFW_FLAG_TRACKREAP;
2544 expired = ipfw_track_expire_start(ctx, INT_MAX,
2545 ipfw_track_reap_max);
2546 ctx->ipfw_flags &= ~IPFW_FLAG_TRACKREAP;
2547 return (expired);
2548 }
2549
2550 /*
2551 * Tracks are being expired.
2552 */
2553
2554 if (RB_EMPTY(&ctx->ipfw_track_tree))
2555 return (0);
2556
2557 expired = 0;
2558 anchor = &ctx->ipfw_trackexp_anch;
2559 while ((t = TAILQ_NEXT(anchor, t_link)) != NULL) {
2560 /*
2561 * Ignore scan limit; we are short of tracks.
2562 */
2563
2564 TAILQ_REMOVE(&ctx->ipfw_track_list, anchor, t_link);
2565 TAILQ_INSERT_AFTER(&ctx->ipfw_track_list, t, anchor, t_link);
2566
2567 if (t->t_count == NULL) /* anchor */
2568 continue;
2569
2570 ipfw_track_state_expire(ctx, t, TRUE);
2571 if (!LIST_EMPTY(&t->t_state_list)) {
2572 /* There are states referencing this track. */
2573 continue;
2574 }
2575
2576 if (ipfw_track_free(ctx, t)) {
2577 if (++expired >= ipfw_track_reap_max) {
2578 ipfw_track_expire_more(ctx);
2579 break;
2580 }
2581 }
2582 }
2583 /*
2584 * NOTE:
2585 * Leave the anchor on the list, even if the end of the list has
2586 * been reached. ipfw_track_expire_more_dispatch() will handle
2587 * the removal.
2588 */
2589 return (expired);
2590 }
2591
2592 static struct ipfw_track *
2593 ipfw_track_alloc(struct ipfw_context *ctx, const struct ipfw_flow_id *id,
2594 uint16_t limit_mask, struct ip_fw *rule)
2595 {
2596 struct ipfw_track *key, *t, *dup;
2597 struct ipfw_trkcnt *trk, *ret;
2598 boolean_t do_expire = FALSE;
2599
2600 KASSERT(rule->track_ruleid != 0,
2601 ("rule %u has no track ruleid", rule->rulenum));
2602
2603 key = &ctx->ipfw_track_tmpkey;
2604 key->t_proto = id->proto;
2605 key->t_addrs = 0;
2606 key->t_ports = 0;
2607 key->t_rule = rule;
2608 if (limit_mask & DYN_SRC_ADDR)
2609 key->t_saddr = id->src_ip;
2610 if (limit_mask & DYN_DST_ADDR)
2611 key->t_daddr = id->dst_ip;
2612 if (limit_mask & DYN_SRC_PORT)
2613 key->t_sport = id->src_port;
2614 if (limit_mask & DYN_DST_PORT)
2615 key->t_dport = id->dst_port;
2616
2617 t = RB_FIND(ipfw_track_tree, &ctx->ipfw_track_tree, key);
2618 if (t != NULL)
2619 goto done;
2620
2621 t = kmalloc(sizeof(*t), M_IPFW, M_INTWAIT | M_NULLOK);
2622 if (t == NULL) {
2623 ctx->ipfw_tks_nomem++;
2624 return (NULL);
2625 }
2626
2627 t->t_key = key->t_key;
2628 t->t_rule = rule;
2629 t->t_lastexp = 0;
2630 LIST_INIT(&t->t_state_list);
2631
2632 if (ipfw_gd.ipfw_trkcnt_cnt >= ipfw_track_max) {
2633 time_t globexp, uptime;
2634
2635 trk = NULL;
2636 do_expire = TRUE;
2637
2638 /*
2639 * Do not expire globally more than once per second,
2640 * it is useless.
2641 */
2642 uptime = time_uptime;
2643 globexp = ipfw_gd.ipfw_track_globexp;
2644 if (globexp != uptime &&
2645 atomic_cmpset_long(&ipfw_gd.ipfw_track_globexp,
2646 globexp, uptime)) {
2647 int cpu;
2648
2649 /* Expire tracks on other CPUs. */
2650 for (cpu = 0; cpu < netisr_ncpus; ++cpu) {
2651 if (cpu == mycpuid)
2652 continue;
2653 lwkt_send_ipiq(globaldata_find(cpu),
2654 ipfw_track_expire_ipifunc, NULL);
2655 }
2656 }
2657 } else {
2658 trk = ipfw_trkcnt_alloc(ctx);
2659 }
2660 if (trk == NULL) {
2661 struct ipfw_trkcnt *tkey;
2662
2663 tkey = &ctx->ipfw_trkcnt_tmpkey;
2664 key = NULL; /* tkey overlaps key */
2665
2666 tkey->tc_key = t->t_key;
2667 tkey->tc_ruleid = rule->track_ruleid;
2668
2669 IPFW_TRKCNT_TOKGET;
2670 trk = RB_FIND(ipfw_trkcnt_tree, &ipfw_gd.ipfw_trkcnt_tree,
2671 tkey);
2672 if (trk == NULL) {
2673 IPFW_TRKCNT_TOKREL;
2674 if (do_expire) {
2675 ctx->ipfw_tks_reap++;
2676 if (ipfw_track_reap(ctx) > 0) {
2677 if (ipfw_gd.ipfw_trkcnt_cnt <
2678 ipfw_track_max) {
2679 trk = ipfw_trkcnt_alloc(ctx);
2680 if (trk != NULL)
2681 goto install;
2682 ctx->ipfw_tks_cntnomem++;
2683 } else {
2684 ctx->ipfw_tks_overflow++;
2685 }
2686 } else {
2687 ctx->ipfw_tks_reapfailed++;
2688 ctx->ipfw_tks_overflow++;
2689 }
2690 } else {
2691 ctx->ipfw_tks_cntnomem++;
2692 }
2693 kfree(t, M_IPFW);
2694 return (NULL);
2695 }
2696 KASSERT(trk->tc_refs > 0 && trk->tc_refs < netisr_ncpus,
2697 ("invalid trkcnt refs %d", trk->tc_refs));
2698 atomic_add_int(&trk->tc_refs, 1);
2699 IPFW_TRKCNT_TOKREL;
2700 } else {
2701 install:
2702 trk->tc_key = t->t_key;
2703 trk->tc_ruleid = rule->track_ruleid;
2704 trk->tc_refs = 0;
2705 trk->tc_count = 0;
2706 trk->tc_expire = 0;
2707 trk->tc_rulenum = rule->rulenum;
2708
2709 IPFW_TRKCNT_TOKGET;
2710 ret = RB_INSERT(ipfw_trkcnt_tree, &ipfw_gd.ipfw_trkcnt_tree,
2711 trk);
2712 if (ret != NULL) {
2713 KASSERT(ret->tc_refs > 0 &&
2714 ret->tc_refs < netisr_ncpus,
2715 ("invalid trkcnt refs %d", ret->tc_refs));
2716 KASSERT(ctx->ipfw_trkcnt_spare == NULL,
2717 ("trkcnt spare was installed"));
2718 ctx->ipfw_trkcnt_spare = trk;
2719 trk = ret;
2720 } else {
2721 ipfw_gd.ipfw_trkcnt_cnt++;
2722 }
2723 atomic_add_int(&trk->tc_refs, 1);
2724 IPFW_TRKCNT_TOKREL;
2725 }
2726 t->t_count = &trk->tc_count;
2727 t->t_trkcnt = trk;
2728
2729 dup = RB_INSERT(ipfw_track_tree, &ctx->ipfw_track_tree, t);
2730 if (dup != NULL)
2731 panic("ipfw: track exists");
2732 TAILQ_INSERT_TAIL(&ctx->ipfw_track_list, t, t_link);
2733 done:
2734 t->t_expire = time_uptime + dyn_short_lifetime;
2735 return (t);
2736 }
2737
2738 /*
2739 * Install state for rule type cmd->o.opcode
2740 *
2741 * Returns NULL if state is not installed because of errors or because
2742 * states limitations are enforced.
2743 */
2744 static struct ipfw_state *
2745 ipfw_state_install(struct ipfw_context *ctx, struct ip_fw *rule,
2746 ipfw_insn_limit *cmd, struct ip_fw_args *args, const struct tcphdr *tcp)
2747 {
2748 struct ipfw_state *s;
2749 struct ipfw_track *t;
2750 int count, diff;
2751
2752 if (ipfw_gd.ipfw_state_loosecnt >= ipfw_state_max &&
2753 (diff = (ipfw_state_cntsync() - ipfw_state_max)) >= 0) {
2754 boolean_t overflow = TRUE;
2755
2756 ctx->ipfw_sts_reap++;
2757 if (ipfw_state_reap(ctx, diff) == 0)
2758 ctx->ipfw_sts_reapfailed++;
2759 if (ipfw_state_cntsync() < ipfw_state_max)
2760 overflow = FALSE;
2761
2762 if (overflow) {
2763 time_t globexp, uptime;
2764 int cpu;
2765
2766 /*
2767 * Do not expire globally more than once per second,
2768 * it is useless.
2769 */
2770 uptime = time_uptime;
2771 globexp = ipfw_gd.ipfw_state_globexp;
2772 if (globexp == uptime ||
2773 !atomic_cmpset_long(&ipfw_gd.ipfw_state_globexp,
2774 globexp, uptime)) {
2775 ctx->ipfw_sts_overflow++;
2776 return (NULL);
2777 }
2778
2779 /* Expire states on other CPUs. */
2780 for (cpu = 0; cpu < netisr_ncpus; ++cpu) {
2781 if (cpu == mycpuid)
2782 continue;
2783 lwkt_send_ipiq(globaldata_find(cpu),
2784 ipfw_state_expire_ipifunc, NULL);
2785 }
2786 ctx->ipfw_sts_overflow++;
2787 return (NULL);
2788 }
2789 }
2790
2791 switch (cmd->o.opcode) {
2792 case O_KEEP_STATE: /* bidir rule */
2793 case O_REDIRECT:
2794 s = ipfw_state_add(ctx, &args->f_id, cmd->o.opcode, rule, NULL,
2795 tcp);
2796 if (s == NULL)
2797 return (NULL);
2798 break;
2799
2800 case O_LIMIT: /* limit number of sessions */
2801 t = ipfw_track_alloc(ctx, &args->f_id, cmd->limit_mask, rule);
2802 if (t == NULL)
2803 return (NULL);
2804
2805 if (*t->t_count >= cmd->conn_limit) {
2806 if (!ipfw_track_state_expire(ctx, t, TRUE))
2807 return (NULL);
2808 }
2809 for (;;) {
2810 count = *t->t_count;
2811 if (count >= cmd->conn_limit)
2812 return (NULL);
2813 if (atomic_cmpset_int(t->t_count, count, count + 1))
2814 break;
2815 }
2816
2817 s = ipfw_state_add(ctx, &args->f_id, O_LIMIT, rule, t, tcp);
2818 if (s == NULL) {
2819 /* Undo damage. */
2820 atomic_subtract_int(t->t_count, 1);
2821 return (NULL);
2822 }
2823 break;
2824
2825 default:
2826 panic("unknown state type %u\n", cmd->o.opcode);
2827 }
2828
2829 if (s->st_type == O_REDIRECT) {
2830 struct ipfw_xlat *x = (struct ipfw_xlat *)s;
2831 ipfw_insn_rdr *r = (ipfw_insn_rdr *)cmd;
2832
2833 x->xlat_addr = r->addr.s_addr;
2834 x->xlat_port = r->port;
2835 x->xlat_ifp = args->m->m_pkthdr.rcvif;
2836 x->xlat_dir = MATCH_FORWARD;
2837 KKASSERT(x->xlat_ifp != NULL);
2838 }
2839 return (s);
2840 }
2841
2842 static int
2843 ipfw_table_lookup(struct ipfw_context *ctx, uint16_t tableid,
2844 const struct in_addr *in)
2845 {
2846 struct radix_node_head *rnh;
2847 struct sockaddr_in sin;
2848 struct ipfw_tblent *te;
2849
2850 KASSERT(tableid < ipfw_table_max, ("invalid tableid %u", tableid));
2851 rnh = ctx->ipfw_tables[tableid];
2852 if (rnh == NULL)
2853 return (0); /* no match */
2854
2855 memset(&sin, 0, sizeof(sin));
2856 sin.sin_family = AF_INET;
2857 sin.sin_len = sizeof(sin);
2858 sin.sin_addr = *in;
2859
2860 te = (struct ipfw_tblent *)rnh->rnh_matchaddr(&sin, rnh);
2861 if (te == NULL)
2862 return (0); /* no match */
2863
2864 te->te_use++;
2865 te->te_lastuse = time_second;
2866 return (1); /* match */
2867 }
2868
2869 /*
2870 * Transmit a TCP packet, containing either a RST or a keepalive.
2871 * When flags & TH_RST, we are sending a RST packet, because of a
2872 * "reset" action matched the packet.
2873 * Otherwise we are sending a keepalive, and flags & TH_
2874 *
2875 * Only {src,dst}_{ip,port} of "id" are used.
2876 */
2877 static void
2878 send_pkt(const struct ipfw_flow_id *id, uint32_t seq, uint32_t ack, int flags)
2879 {
2880 struct mbuf *m;
2881 struct ip *ip;
2882 struct tcphdr *tcp;
2883 struct route sro; /* fake route */
2884
2885 MGETHDR(m, M_NOWAIT, MT_HEADER);
2886 if (m == NULL)
2887 return;
2888 m->m_pkthdr.rcvif = NULL;
2889 m->m_pkthdr.len = m->m_len = sizeof(struct ip) + sizeof(struct tcphdr);
2890 m->m_data += max_linkhdr;
2891
2892 ip = mtod(m, struct ip *);
2893 bzero(ip, m->m_len);
2894 tcp = (struct tcphdr *)(ip + 1); /* no IP options */
2895 ip->ip_p = IPPROTO_TCP;
2896 tcp->th_off = 5;
2897
2898 /*
2899 * Assume we are sending a RST (or a keepalive in the reverse
2900 * direction), swap src and destination addresses and ports.
2901 */
2902 ip->ip_src.s_addr = htonl(id->dst_ip);
2903 ip->ip_dst.s_addr = htonl(id->src_ip);
2904 tcp->th_sport = htons(id->dst_port);
2905 tcp->th_dport = htons(id->src_port);
2906 if (flags & TH_RST) { /* we are sending a RST */
2907 if (flags & TH_ACK) {
2908 tcp->th_seq = htonl(ack);
2909 tcp->th_ack = htonl(0);
2910 tcp->th_flags = TH_RST;
2911 } else {
2912 if (flags & TH_SYN)
2913 seq++;
2914 tcp->th_seq = htonl(0);
2915 tcp->th_ack = htonl(seq);
2916 tcp->th_flags = TH_RST | TH_ACK;
2917 }
2918 } else {
2919 /*
2920 * We are sending a keepalive. flags & TH_SYN determines
2921 * the direction, forward if set, reverse if clear.
2922 * NOTE: seq and ack are always assumed to be correct
2923 * as set by the caller. This may be confusing...
2924 */
2925 if (flags & TH_SYN) {
2926 /*
2927 * we have to rewrite the correct addresses!
2928 */
2929 ip->ip_dst.s_addr = htonl(id->dst_ip);
2930 ip->ip_src.s_addr = htonl(id->src_ip);
2931 tcp->th_dport = htons(id->dst_port);
2932 tcp->th_sport = htons(id->src_port);
2933 }
2934 tcp->th_seq = htonl(seq);
2935 tcp->th_ack = htonl(ack);
2936 tcp->th_flags = TH_ACK;
2937 }
2938
2939 /*
2940 * set ip_len to the payload size so we can compute
2941 * the tcp checksum on the pseudoheader
2942 * XXX check this, could save a couple of words ?
2943 */
2944 ip->ip_len = htons(sizeof(struct tcphdr));
2945 tcp->th_sum = in_cksum(m, m->m_pkthdr.len);
2946
2947 /*
2948 * now fill fields left out earlier
2949 */
2950 ip->ip_ttl = ip_defttl;
2951 ip->ip_len = htons(m->m_pkthdr.len);
2952
2953 bzero(&sro, sizeof(sro));
2954 ip_rtaddr(ip->ip_dst, &sro);
2955
2956 m->m_pkthdr.fw_flags |= IPFW_MBUF_GENERATED;
2957 ip_output(m, NULL, &sro, 0, NULL, NULL);
2958 if (sro.ro_rt)
2959 RTFREE(sro.ro_rt);
2960 }
2961
2962 /*
2963 * Send a reject message, consuming the mbuf passed as an argument.
2964 */
2965 static void
2966 send_reject(struct ip_fw_args *args, int code, int offset, int ip_len)
2967 {
2968 if (code != ICMP_REJECT_RST) { /* Send an ICMP unreach */
2969 /* IP header is always left in network order */
2970 icmp_error(args->m, ICMP_UNREACH, code, 0L, 0);
2971 } else if (offset == 0 && args->f_id.proto == IPPROTO_TCP) {
2972 struct tcphdr *const tcp =
2973 L3HDR(struct tcphdr, mtod(args->m, struct ip *));
2974
2975 if ((tcp->th_flags & TH_RST) == 0) {
2976 send_pkt(&args->f_id, ntohl(tcp->th_seq),
2977 ntohl(tcp->th_ack), tcp->th_flags | TH_RST);
2978 }
2979 m_freem(args->m);
2980 } else {
2981 m_freem(args->m);
2982 }
2983 args->m = NULL;
2984 }
2985
2986 /*
2987 * Given an ip_fw *, lookup_next_rule will return a pointer
2988 * to the next rule, which can be either the jump
2989 * target (for skipto instructions) or the next one in the list (in
2990 * all other cases including a missing jump target).
2991 * The result is also written in the "next_rule" field of the rule.
2992 * Backward jumps are not allowed, so start looking from the next
2993 * rule...
2994 *
2995 * This never returns NULL -- in case we do not have an exact match,
2996 * the next rule is returned. When the ruleset is changed,
2997 * pointers are flushed so we are always correct.
2998 */
2999 static struct ip_fw *
3000 lookup_next_rule(struct ip_fw *me)
3001 {
3002 struct ip_fw *rule = NULL;
3003 ipfw_insn *cmd;
3004
3005 /* look for action, in case it is a skipto */
3006 cmd = ACTION_PTR(me);
3007 if (cmd->opcode == O_LOG)
3008 cmd += F_LEN(cmd);
3009 if (cmd->opcode == O_SKIPTO) {
3010 for (rule = me->next; rule; rule = rule->next) {
3011 if (rule->rulenum >= cmd->arg1)
3012 break;
3013 }
3014 }
3015 if (rule == NULL) /* failure or not a skipto */
3016 rule = me->next;
3017 me->next_rule = rule;
3018 return rule;
3019 }
3020
3021 static int
3022 ipfw_match_uid(const struct ipfw_flow_id *fid, struct ifnet *oif,
3023 enum ipfw_opcodes opcode, uid_t uid)
3024 {
3025 struct in_addr src_ip, dst_ip;
3026 struct inpcbinfo *pi;
3027 boolean_t wildcard;
3028 struct inpcb *pcb;
3029
3030 if (fid->proto == IPPROTO_TCP) {
3031 wildcard = FALSE;
3032 pi = &tcbinfo[mycpuid];
3033 } else if (fid->proto == IPPROTO_UDP) {
3034 wildcard = TRUE;
3035 pi = &udbinfo[mycpuid];
3036 } else {
3037 return 0;
3038 }
3039
3040 /*
3041 * Values in 'fid' are in host byte order
3042 */
3043 dst_ip.s_addr = htonl(fid->dst_ip);
3044 src_ip.s_addr = htonl(fid->src_ip);
3045 if (oif) {
3046 pcb = in_pcblookup_hash(pi,
3047 dst_ip, htons(fid->dst_port),
3048 src_ip, htons(fid->src_port),
3049 wildcard, oif);
3050 } else {
3051 pcb = in_pcblookup_hash(pi,
3052 src_ip, htons(fid->src_port),
3053 dst_ip, htons(fid->dst_port),
3054 wildcard, NULL);
3055 }
3056 if (pcb == NULL || pcb->inp_socket == NULL)
3057 return 0;
3058
3059 if (opcode == O_UID) {
3060 #define socheckuid(a,b) ((a)->so_cred->cr_uid != (b))
3061 return !socheckuid(pcb->inp_socket, uid);
3062 #undef socheckuid
3063 } else {
3064 return groupmember(uid, pcb->inp_socket->so_cred);
3065 }
3066 }
3067
3068 static int
3069 ipfw_match_ifip(ipfw_insn_ifip *cmd, const struct in_addr *ip)
3070 {
3071
3072 if (__predict_false((cmd->o.arg1 & IPFW_IFIP_VALID) == 0)) {
3073 struct ifaddr_container *ifac;
3074 struct ifnet *ifp;
3075
3076 ifp = ifunit_netisr(cmd->ifname);
3077 if (ifp == NULL)
3078 return (0);
3079
3080 TAILQ_FOREACH(ifac, &ifp->if_addrheads[mycpuid], ifa_link) {
3081 struct ifaddr *ia = ifac->ifa;
3082
3083 if (ia->ifa_addr == NULL)
3084 continue;
3085 if (ia->ifa_addr->sa_family != AF_INET)
3086 continue;
3087
3088 cmd->mask.s_addr = INADDR_ANY;
3089 if (cmd->o.arg1 & IPFW_IFIP_NET) {
3090 cmd->mask = ((struct sockaddr_in *)
3091 ia->ifa_netmask)->sin_addr;
3092 }
3093 if (cmd->mask.s_addr == INADDR_ANY)
3094 cmd->mask.s_addr = INADDR_BROADCAST;
3095
3096 cmd->addr =
3097 ((struct sockaddr_in *)ia->ifa_addr)->sin_addr;
3098 cmd->addr.s_addr &= cmd->mask.s_addr;
3099
3100 cmd->o.arg1 |= IPFW_IFIP_VALID;
3101 break;
3102 }
3103 if ((cmd->o.arg1 & IPFW_IFIP_VALID) == 0)
3104 return (0);
3105 }
3106 return ((ip->s_addr & cmd->mask.s_addr) == cmd->addr.s_addr);
3107 }
3108
3109 static void
3110 ipfw_xlate(const struct ipfw_xlat *x, struct mbuf *m,
3111 struct in_addr *old_addr, uint16_t *old_port)
3112 {
3113 struct ip *ip = mtod(m, struct ip *);
3114 struct in_addr *addr;
3115 uint16_t *port, *csum, dlen = 0;
3116 uint8_t udp = 0;
3117 boolean_t pseudo = FALSE;
3118
3119 if (x->xlat_flags & IPFW_STATE_F_XLATSRC) {
3120 addr = &ip->ip_src;
3121 switch (ip->ip_p) {
3122 case IPPROTO_TCP:
3123 port = &L3HDR(struct tcphdr, ip)->th_sport;
3124 csum = &L3HDR(struct tcphdr, ip)->th_sum;
3125 break;
3126 case IPPROTO_UDP:
3127 port = &L3HDR(struct udphdr, ip)->uh_sport;
3128 csum = &L3HDR(struct udphdr, ip)->uh_sum;
3129 udp = 1;
3130 break;
3131 default:
3132 panic("ipfw: unsupported src xlate proto %u", ip->ip_p);
3133 }
3134 } else {
3135 addr = &ip->ip_dst;
3136 switch (ip->ip_p) {
3137 case IPPROTO_TCP:
3138 port = &L3HDR(struct tcphdr, ip)->th_dport;
3139 csum = &L3HDR(struct tcphdr, ip)->th_sum;
3140 break;
3141 case IPPROTO_UDP:
3142 port = &L3HDR(struct udphdr, ip)->uh_dport;
3143 csum = &L3HDR(struct udphdr, ip)->uh_sum;
3144 udp = 1;
3145 break;
3146 default:
3147 panic("ipfw: unsupported dst xlate proto %u", ip->ip_p);
3148 }
3149 }
3150 if (old_addr != NULL)
3151 *old_addr = *addr;
3152 if (old_port != NULL) {
3153 if (x->xlat_port != 0)
3154 *old_port = *port;
3155 else
3156 *old_port = 0;
3157 }
3158
3159 if (m->m_pkthdr.csum_flags & (CSUM_UDP | CSUM_TCP | CSUM_TSO)) {
3160 if ((m->m_pkthdr.csum_flags & CSUM_TSO) == 0)
3161 dlen = ntohs(ip->ip_len) - (ip->ip_hl << 2);
3162 pseudo = TRUE;
3163 }
3164
3165 if (!pseudo) {
3166 const uint16_t *oaddr, *naddr;
3167
3168 oaddr = (const uint16_t *)&addr->s_addr;
3169 naddr = (const uint16_t *)&x->xlat_addr;
3170
3171 ip->ip_sum = pfil_cksum_fixup(pfil_cksum_fixup(ip->ip_sum,
3172 oaddr[0], naddr[0], 0), oaddr[1], naddr[1], 0);
3173 *csum = pfil_cksum_fixup(pfil_cksum_fixup(*csum,
3174 oaddr[0], naddr[0], udp), oaddr[1], naddr[1], udp);
3175 }
3176 addr->s_addr = x->xlat_addr;
3177
3178 if (x->xlat_port != 0) {
3179 if (!pseudo) {
3180 *csum = pfil_cksum_fixup(*csum, *port, x->xlat_port,
3181 udp);
3182 }
3183 *port = x->xlat_port;
3184 }
3185
3186 if (pseudo) {
3187 *csum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
3188 htons(dlen + ip->ip_p));
3189 }
3190 }
3191
3192 static void
3193 ipfw_ip_xlate_dispatch(netmsg_t nmsg)
3194 {
3195 struct netmsg_genpkt *nm = (struct netmsg_genpkt *)nmsg;
3196 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
3197 struct mbuf *m = nm->m;
3198 struct ipfw_xlat *x = nm->arg1;
3199 struct ip_fw *rule = x->xlat_rule;
3200
3201 ASSERT_NETISR_NCPUS(mycpuid);
3202 KASSERT(rule->cpuid == mycpuid,
3203 ("rule does not belong to cpu%d", mycpuid));
3204 KASSERT(m->m_pkthdr.fw_flags & IPFW_MBUF_CONTINUE,
3205 ("mbuf does not have ipfw continue rule"));
3206
3207 KASSERT(ctx->ipfw_cont_rule == NULL,
3208 ("pending ipfw continue rule"));
3209 KASSERT(ctx->ipfw_cont_xlat == NULL,
3210 ("pending ipfw continue xlat"));
3211 ctx->ipfw_cont_rule = rule;
3212 ctx->ipfw_cont_xlat = x;
3213
3214 if (nm->arg2 == 0)
3215 ip_input(m);
3216 else
3217 ip_output(m, NULL, NULL, IP_FORWARDING, NULL, NULL);
3218
3219 /* May not be cleared, if ipfw was unload/disabled. */
3220 ctx->ipfw_cont_rule = NULL;
3221 ctx->ipfw_cont_xlat = NULL;
3222
3223 /*
3224 * This state is no longer used; decrement its xlat_crefs,
3225 * so this state can be deleted.
3226 */
3227 x->xlat_crefs--;
3228 /*
3229 * This rule is no longer used; decrement its cross_refs,
3230 * so this rule can be deleted.
3231 *
3232 * NOTE:
3233 * Decrement cross_refs in the last step of this function,
3234 * so that the module could be unloaded safely.
3235 */
3236 rule->cross_refs--;
3237 }
3238
3239 static void
3240 ipfw_xlate_redispatch(struct mbuf *m, int cpuid, struct ipfw_xlat *x,
3241 uint32_t flags)
3242 {
3243 struct netmsg_genpkt *nm;
3244
3245 KASSERT(x->xlat_pcpu == cpuid, ("xlat paired cpu%d, target cpu%d",
3246 x->xlat_pcpu, cpuid));
3247
3248 /*
3249 * Bump cross_refs to prevent this rule and its siblings
3250 * from being deleted, while this mbuf is inflight. The
3251 * cross_refs of the sibling rule on the target cpu will
3252 * be decremented, once this mbuf is going to be filtered
3253 * on the target cpu.
3254 */
3255 x->xlat_rule->cross_refs++;
3256 /*
3257 * Bump xlat_crefs to prevent this state and its paired
3258 * state from being deleted, while this mbuf is inflight.
3259 * The xlat_crefs of the paired state on the target cpu
3260 * will be decremented, once this mbuf is going to be
3261 * filtered on the target cpu.
3262 */
3263 x->xlat_crefs++;
3264
3265 m->m_pkthdr.fw_flags |= IPFW_MBUF_CONTINUE;
3266 if (flags & IPFW_XLATE_INSERT)
3267 m->m_pkthdr.fw_flags |= IPFW_MBUF_XLATINS;
3268 if (flags & IPFW_XLATE_FORWARD)
3269 m->m_pkthdr.fw_flags |= IPFW_MBUF_XLATFWD;
3270
3271 /*
3272 * NOTE: We always leave ip_len and ip_off in network
3273 * order across all network layers.
3274 */
3275 nm = &m->m_hdr.mh_genmsg;
3276 netmsg_init(&nm->base, NULL, &netisr_apanic_rport, 0,
3277 ipfw_ip_xlate_dispatch);
3278 nm->m = m;
3279 nm->arg1 = x->xlat_pair;
3280 nm->arg2 = 0;
3281 if (flags & IPFW_XLATE_OUTPUT)
3282 nm->arg2 = 1;
3283 netisr_sendmsg(&nm->base, cpuid);
3284 }
3285
3286 static struct mbuf *
3287 ipfw_setup_local(struct mbuf *m, const int hlen, struct ip_fw_args *args,
3288 struct ip_fw_local *local, struct ip **ip0)
3289 {
3290 struct ip *ip = mtod(m, struct ip *);
3291 struct tcphdr *tcp;
3292 struct udphdr *udp;
3293
3294 /*
3295 * Collect parameters into local variables for faster matching.
3296 */
3297 if (hlen == 0) { /* do not grab addresses for non-ip pkts */
3298 local->proto = args->f_id.proto = 0; /* mark f_id invalid */
3299 goto done;
3300 }
3301
3302 local->proto = args->f_id.proto = ip->ip_p;
3303 local->src_ip = ip->ip_src;
3304 local->dst_ip = ip->ip_dst;
3305 local->offset = ntohs(ip->ip_off) & IP_OFFMASK;
3306 local->ip_len = ntohs(ip->ip_len);
3307
3308 #define PULLUP_TO(len) \
3309 do { \
3310 if (m->m_len < (len)) { \
3311 args->m = m = m_pullup(m, (len)); \
3312 if (m == NULL) { \
3313 ip = NULL; \
3314 goto done; \
3315 } \
3316 ip = mtod(m, struct ip *); \
3317 } \
3318 } while (0)
3319
3320 if (local->offset == 0) {
3321 switch (local->proto) {
3322 case IPPROTO_TCP:
3323 PULLUP_TO(hlen + sizeof(struct tcphdr));
3324 local->tcp = tcp = L3HDR(struct tcphdr, ip);
3325 local->dst_port = tcp->th_dport;
3326 local->src_port = tcp->th_sport;
3327 args->f_id.flags = tcp->th_flags;
3328 break;
3329
3330 case IPPROTO_UDP:
3331 PULLUP_TO(hlen + sizeof(struct udphdr));
3332 udp = L3HDR(struct udphdr, ip);
3333 local->dst_port = udp->uh_dport;
3334 local->src_port = udp->uh_sport;
3335 break;
3336
3337 case IPPROTO_ICMP:
3338 PULLUP_TO(hlen + 4); /* type, code and checksum. */
3339 args->f_id.flags = L3HDR(struct icmp, ip)->icmp_type;
3340 break;
3341
3342 default:
3343 break;
3344 }
3345 }
3346
3347 #undef PULLUP_TO
3348
3349 args->f_id.src_ip = ntohl(local->src_ip.s_addr);
3350 args->f_id.dst_ip = ntohl(local->dst_ip.s_addr);
3351 args->f_id.src_port = local->src_port = ntohs(local->src_port);
3352 args->f_id.dst_port = local->dst_port = ntohs(local->dst_port);
3353 done:
3354 *ip0 = ip;
3355 return (m);
3356 }
3357
3358 static struct mbuf *
3359 ipfw_rehashm(struct mbuf *m, const int hlen, struct ip_fw_args *args,
3360 struct ip_fw_local *local, struct ip **ip0)
3361 {
3362 m->m_flags &= ~M_HASH;
3363 ip_hashfn(&m, 0);
3364 args->m = m;
3365 if (m == NULL) {
3366 *ip0 = NULL;
3367 return (NULL);
3368 }
3369 KASSERT(m->m_flags & M_HASH, ("no hash"));
3370
3371 /* 'm' might be changed by ip_hashfn(). */
3372 return (ipfw_setup_local(m, hlen, args, local, ip0));
3373 }
3374
3375 /*
3376 * The main check routine for the firewall.
3377 *
3378 * All arguments are in args so we can modify them and return them
3379 * back to the caller.
3380 *
3381 * Parameters:
3382 *
3383 * args->m (in/out) The packet; we set to NULL when/if we nuke it.
3384 * Starts with the IP header.
3385 * args->eh (in) Mac header if present, or NULL for layer3 packet.
3386 * args->oif Outgoing interface, or NULL if packet is incoming.
3387 * The incoming interface is in the mbuf. (in)
3388 *
3389 * args->rule Pointer to the last matching rule (in/out)
3390 * args->f_id Addresses grabbed from the packet (out)
3391 *
3392 * Return value:
3393 *
3394 * If the packet was denied/rejected and has been dropped, *m is equal
3395 * to NULL upon return.
3396 *
3397 * IP_FW_DENY the packet must be dropped.
3398 * IP_FW_PASS The packet is to be accepted and routed normally.
3399 * IP_FW_DIVERT Divert the packet to port (args->cookie)
3400 * IP_FW_TEE Tee the packet to port (args->cookie)
3401 * IP_FW_DUMMYNET Send the packet to pipe/queue (args->cookie)
3402 * IP_FW_CONTINUE Continue processing on another cpu.
3403 */
3404 static int
3405 ipfw_chk(struct ip_fw_args *args)
3406 {
3407 /*
3408 * Local variables hold state during the processing of a packet.
3409 *
3410 * IMPORTANT NOTE: to speed up the processing of rules, there
3411 * are some assumption on the values of the variables, which
3412 * are documented here. Should you change them, please check
3413 * the implementation of the various instructions to make sure
3414 * that they still work.
3415 *
3416 * args->eh The MAC header. It is non-null for a layer2
3417 * packet, it is NULL for a layer-3 packet.
3418 *
3419 * m | args->m Pointer to the mbuf, as received from the caller.
3420 * It may change if ipfw_chk() does an m_pullup, or if it
3421 * consumes the packet because it calls send_reject().
3422 * XXX This has to change, so that ipfw_chk() never modifies
3423 * or consumes the buffer.
3424 * ip is simply an alias of the value of m, and it is kept
3425 * in sync with it (the packet is supposed to start with
3426 * the ip header).
3427 */
3428 struct mbuf *m = args->m;
3429 struct ip *ip = mtod(m, struct ip *);
3430
3431 /*
3432 * oif | args->oif If NULL, ipfw_chk has been called on the
3433 * inbound path (ether_input, ip_input).
3434 * If non-NULL, ipfw_chk has been called on the outbound path
3435 * (ether_output, ip_output).
3436 */
3437 struct ifnet *oif = args->oif;
3438
3439 struct ip_fw *f = NULL; /* matching rule */
3440 int retval = IP_FW_PASS;
3441 struct m_tag *mtag;
3442 struct divert_info *divinfo;
3443 struct ipfw_state *s;
3444
3445 /*
3446 * hlen The length of the IPv4 header.
3447 * hlen >0 means we have an IPv4 packet.
3448 */
3449 u_int hlen = 0; /* hlen >0 means we have an IP pkt */
3450
3451 struct ip_fw_local lc;
3452
3453 /*
3454 * dyn_dir = MATCH_UNKNOWN when rules unchecked,
3455 * MATCH_NONE when checked and not matched (dyn_f = NULL),
3456 * MATCH_FORWARD or MATCH_REVERSE otherwise (dyn_f != NULL)
3457 */
3458 int dyn_dir = MATCH_UNKNOWN;
3459 struct ip_fw *dyn_f = NULL;
3460 int cpuid = mycpuid;
3461 struct ipfw_context *ctx;
3462
3463 ASSERT_NETISR_NCPUS(cpuid);
3464 ctx = ipfw_ctx[cpuid];
3465
3466 if (m->m_pkthdr.fw_flags & IPFW_MBUF_GENERATED)
3467 return IP_FW_PASS; /* accept */
3468
3469 if (args->eh == NULL || /* layer 3 packet */
3470 (m->m_pkthdr.len >= sizeof(struct ip) &&
3471 ntohs(args->eh->ether_type) == ETHERTYPE_IP))
3472 hlen = ip->ip_hl << 2;
3473
3474 memset(&lc, 0, sizeof(lc));
3475
3476 m = ipfw_setup_local(m, hlen, args, &lc, &ip);
3477 if (m == NULL)
3478 goto pullup_failed;
3479
3480 if (args->rule) {
3481 /*
3482 * Packet has already been tagged. Look for the next rule
3483 * to restart processing.
3484 *
3485 * If fw_one_pass != 0 then just accept it.
3486 * XXX should not happen here, but optimized out in
3487 * the caller.
3488 */
3489 if (fw_one_pass && (args->flags & IP_FWARG_F_CONT) == 0)
3490 return IP_FW_PASS;
3491 args->flags &= ~IP_FWARG_F_CONT;
3492
3493 /* This rule is being/has been flushed */
3494 if (ipfw_flushing)
3495 return IP_FW_DENY;
3496
3497 KASSERT(args->rule->cpuid == cpuid,
3498 ("rule used on cpu%d", cpuid));
3499
3500 /* This rule was deleted */
3501 if (args->rule->rule_flags & IPFW_RULE_F_INVALID)
3502 return IP_FW_DENY;
3503
3504 if (args->xlat != NULL) {
3505 struct ipfw_xlat *x = args->xlat;
3506
3507 /* This xlat is being deleted. */
3508 if (x->xlat_invalid)
3509 return IP_FW_DENY;
3510
3511 f = args->rule;
3512
3513 dyn_f = f;
3514 dyn_dir = (args->flags & IP_FWARG_F_XLATFWD) ?
3515 MATCH_FORWARD : MATCH_REVERSE;
3516
3517 if (args->flags & IP_FWARG_F_XLATINS) {
3518 KASSERT(x->xlat_flags & IPFW_STATE_F_XLATSLAVE,
3519 ("not slave %u state", x->xlat_type));
3520 s = ipfw_state_link(ctx, &x->xlat_st);
3521 if (s != NULL) {
3522 ctx->ipfw_xlate_conflicts++;
3523 if (IPFW_STATE_ISDEAD(s)) {
3524 ipfw_state_remove(ctx, s);
3525 s = ipfw_state_link(ctx,
3526 &x->xlat_st);
3527 }
3528 if (s != NULL) {
3529 if (bootverbose) {
3530 kprintf("ipfw: "
3531 "slave %u state "
3532 "conflicts %u state\n",
3533 x->xlat_type,
3534 s->st_type);
3535 }
3536 ipfw_xlat_invalidate(x);
3537 return IP_FW_DENY;
3538 }
3539 ctx->ipfw_xlate_cresolved++;
3540 }
3541 } else {
3542 ipfw_state_update(&args->f_id, dyn_dir,
3543 lc.tcp, &x->xlat_st);
3544 }
3545 } else {
3546 /* TODO: setup dyn_f, dyn_dir */
3547
3548 f = args->rule->next_rule;
3549 if (f == NULL)
3550 f = lookup_next_rule(args->rule);
3551 }
3552 } else {
3553 /*
3554 * Find the starting rule. It can be either the first
3555 * one, or the one after divert_rule if asked so.
3556 */
3557 int skipto;
3558
3559 KKASSERT((args->flags &
3560 (IP_FWARG_F_XLATINS | IP_FWARG_F_CONT)) == 0);
3561 KKASSERT(args->xlat == NULL);
3562
3563 mtag = m_tag_find(m, PACKET_TAG_IPFW_DIVERT, NULL);
3564 if (mtag != NULL) {
3565 divinfo = m_tag_data(mtag);
3566 skipto = divinfo->skipto;
3567 } else {
3568 skipto = 0;
3569 }
3570
3571 f = ctx->ipfw_layer3_chain;
3572 if (args->eh == NULL && skipto != 0) {
3573 /* No skipto during rule flushing */
3574 if (ipfw_flushing)
3575 return IP_FW_DENY;
3576
3577 if (skipto >= IPFW_DEFAULT_RULE)
3578 return IP_FW_DENY; /* invalid */
3579
3580 while (f && f->rulenum <= skipto)
3581 f = f->next;
3582 if (f == NULL) /* drop packet */
3583 return IP_FW_DENY;
3584 } else if (ipfw_flushing) {
3585 /* Rules are being flushed; skip to default rule */
3586 f = ctx->ipfw_default_rule;
3587 }
3588 }
3589 if ((mtag = m_tag_find(m, PACKET_TAG_IPFW_DIVERT, NULL)) != NULL)
3590 m_tag_delete(m, mtag);
3591
3592 /*
3593 * Now scan the rules, and parse microinstructions for each rule.
3594 */
3595 for (; f; f = f->next) {
3596 int l, cmdlen;
3597 ipfw_insn *cmd;
3598 int skip_or; /* skip rest of OR block */
3599
3600 again:
3601 if (ctx->ipfw_set_disable & (1 << f->set)) {
3602 args->xlat = NULL;
3603 continue;
3604 }
3605
3606 if (args->xlat != NULL) {
3607 args->xlat = NULL;
3608 l = f->cmd_len - f->act_ofs;
3609 cmd = ACTION_PTR(f);
3610 } else {
3611 l = f->cmd_len;
3612 cmd = f->cmd;
3613 }
3614
3615 skip_or = 0;
3616 for (; l > 0; l -= cmdlen, cmd += cmdlen) {
3617 int match;
3618
3619 /*
3620 * check_body is a jump target used when we find a
3621 * CHECK_STATE, and need to jump to the body of
3622 * the target rule.
3623 */
3624 check_body:
3625 cmdlen = F_LEN(cmd);
3626 /*
3627 * An OR block (insn_1 || .. || insn_n) has the
3628 * F_OR bit set in all but the last instruction.
3629 * The first match will set "skip_or", and cause
3630 * the following instructions to be skipped until
3631 * past the one with the F_OR bit clear.
3632 */
3633 if (skip_or) { /* skip this instruction */
3634 if ((cmd->len & F_OR) == 0)
3635 skip_or = 0; /* next one is good */
3636 continue;
3637 }
3638 match = 0; /* set to 1 if we succeed */
3639
3640 switch (cmd->opcode) {
3641 /*
3642 * The first set of opcodes compares the packet's
3643 * fields with some pattern, setting 'match' if a
3644 * match is found. At the end of the loop there is
3645 * logic to deal with F_NOT and F_OR flags associated
3646 * with the opcode.
3647 */
3648 case O_NOP:
3649 match = 1;
3650 break;
3651
3652 case O_FORWARD_MAC:
3653 kprintf("ipfw: opcode %d unimplemented\n",
3654 cmd->opcode);
3655 break;
3656
3657 case O_GID:
3658 case O_UID:
3659 /*
3660 * We only check offset == 0 && proto != 0,
3661 * as this ensures that we have an IPv4
3662 * packet with the ports info.
3663 */
3664 if (lc.offset!=0)
3665 break;
3666
3667 match = ipfw_match_uid(&args->f_id, oif,
3668 cmd->opcode,
3669 (uid_t)((ipfw_insn_u32 *)cmd)->d[0]);
3670 break;
3671
3672 case O_RECV:
3673 match = iface_match(m->m_pkthdr.rcvif,
3674 (ipfw_insn_if *)cmd);
3675 break;
3676
3677 case O_XMIT:
3678 match = iface_match(oif, (ipfw_insn_if *)cmd);
3679 break;
3680
3681 case O_VIA:
3682 match = iface_match(oif ? oif :
3683 m->m_pkthdr.rcvif, (ipfw_insn_if *)cmd);
3684 break;
3685
3686 case O_MACADDR2:
3687 if (args->eh != NULL) { /* have MAC header */
3688 uint32_t *want = (uint32_t *)
3689 ((ipfw_insn_mac *)cmd)->addr;
3690 uint32_t *mask = (uint32_t *)
3691 ((ipfw_insn_mac *)cmd)->mask;
3692 uint32_t *hdr = (uint32_t *)args->eh;
3693
3694 match =
3695 (want[0] == (hdr[0] & mask[0]) &&
3696 want[1] == (hdr[1] & mask[1]) &&
3697 want[2] == (hdr[2] & mask[2]));
3698 }
3699 break;
3700
3701 case O_MAC_TYPE:
3702 if (args->eh != NULL) {
3703 uint16_t t =
3704 ntohs(args->eh->ether_type);
3705 uint16_t *p =
3706 ((ipfw_insn_u16 *)cmd)->ports;
3707 int i;
3708
3709 /* Special vlan handling */
3710 if (m->m_flags & M_VLANTAG)
3711 t = ETHERTYPE_VLAN;
3712
3713 for (i = cmdlen - 1; !match && i > 0;
3714 i--, p += 2) {
3715 match =
3716 (t >= p[0] && t <= p[1]);
3717 }
3718 }
3719 break;
3720
3721 case O_FRAG:
3722 match = (hlen > 0 && lc.offset != 0);
3723 break;
3724
3725 case O_IPFRAG:
3726 if (hlen > 0) {
3727 uint16_t off;
3728
3729 off = ntohs(ip->ip_off);
3730 if (off & (IP_MF | IP_OFFMASK))
3731 match = 1;
3732 }
3733 break;
3734
3735 case O_IN: /* "out" is "not in" */
3736 match = (oif == NULL);
3737 break;
3738
3739 case O_LAYER2:
3740 match = (args->eh != NULL);
3741 break;
3742
3743 case O_PROTO:
3744 /*
3745 * We do not allow an arg of 0 so the
3746 * check of "proto" only suffices.
3747 */
3748 match = (lc.proto == cmd->arg1);
3749 break;
3750
3751 case O_IP_SRC:
3752 match = (hlen > 0 &&
3753 ((ipfw_insn_ip *)cmd)->addr.s_addr ==
3754 lc.src_ip.s_addr);
3755 break;
3756
3757 case O_IP_SRC_MASK:
3758 match = (hlen > 0 &&
3759 ((ipfw_insn_ip *)cmd)->addr.s_addr ==
3760 (lc.src_ip.s_addr &
3761 ((ipfw_insn_ip *)cmd)->mask.s_addr));
3762 break;
3763
3764 case O_IP_SRC_ME:
3765 if (hlen > 0) {
3766 struct ifnet *tif;
3767
3768 tif = INADDR_TO_IFP(&lc.src_ip);
3769 match = (tif != NULL);
3770 }
3771 break;
3772
3773 case O_IP_SRC_TABLE:
3774 match = ipfw_table_lookup(ctx, cmd->arg1,
3775 &lc.src_ip);
3776 break;
3777
3778 case O_IP_SRC_IFIP:
3779 match = ipfw_match_ifip((ipfw_insn_ifip *)cmd,
3780 &lc.src_ip);
3781 break;
3782
3783 case O_IP_DST_SET:
3784 case O_IP_SRC_SET:
3785 if (hlen > 0) {
3786 uint32_t *d = (uint32_t *)(cmd + 1);
3787 uint32_t addr =
3788 cmd->opcode == O_IP_DST_SET ?
3789 args->f_id.dst_ip :
3790 args->f_id.src_ip;
3791
3792 if (addr < d[0])
3793 break;
3794 addr -= d[0]; /* subtract base */
3795 match =
3796 (addr < cmd->arg1) &&
3797 (d[1 + (addr >> 5)] &
3798 (1 << (addr & 0x1f)));
3799 }
3800 break;
3801
3802 case O_IP_DST:
3803 match = (hlen > 0 &&
3804 ((ipfw_insn_ip *)cmd)->addr.s_addr ==
3805 lc.dst_ip.s_addr);
3806 break;
3807
3808 case O_IP_DST_MASK:
3809 match = (hlen > 0) &&
3810 (((ipfw_insn_ip *)cmd)->addr.s_addr ==
3811 (lc.dst_ip.s_addr &
3812 ((ipfw_insn_ip *)cmd)->mask.s_addr));
3813 break;
3814
3815 case O_IP_DST_ME:
3816 if (hlen > 0) {
3817 struct ifnet *tif;
3818
3819 tif = INADDR_TO_IFP(&lc.dst_ip);
3820 match = (tif != NULL);
3821 }
3822 break;
3823
3824 case O_IP_DST_TABLE:
3825 match = ipfw_table_lookup(ctx, cmd->arg1,
3826 &lc.dst_ip);
3827 break;
3828
3829 case O_IP_DST_IFIP:
3830 match = ipfw_match_ifip((ipfw_insn_ifip *)cmd,
3831 &lc.dst_ip);
3832 break;
3833
3834 case O_IP_SRCPORT:
3835 case O_IP_DSTPORT:
3836 /*
3837 * offset == 0 && proto != 0 is enough
3838 * to guarantee that we have an IPv4
3839 * packet with port info.
3840 */
3841 if ((lc.proto==IPPROTO_UDP ||
3842 lc.proto==IPPROTO_TCP)
3843 && lc.offset == 0) {
3844 uint16_t x =
3845 (cmd->opcode == O_IP_SRCPORT) ?
3846 lc.src_port : lc.dst_port;
3847 uint16_t *p =
3848 ((ipfw_insn_u16 *)cmd)->ports;
3849 int i;
3850
3851 for (i = cmdlen - 1; !match && i > 0;
3852 i--, p += 2) {
3853 match =
3854 (x >= p[0] && x <= p[1]);
3855 }
3856 }
3857 break;
3858
3859 case O_ICMPCODE:
3860 match = (lc.offset == 0 &&
3861 lc.proto==IPPROTO_ICMP &&
3862 icmpcode_match(ip, (ipfw_insn_u32 *)cmd));
3863 break;
3864
3865 case O_ICMPTYPE:
3866 match = (lc.offset == 0 &&
3867 lc.proto==IPPROTO_ICMP &&
3868 icmptype_match(ip, (ipfw_insn_u32 *)cmd));
3869 break;
3870
3871 case O_IPOPT:
3872 match = (hlen > 0 && ipopts_match(ip, cmd));
3873 break;
3874
3875 case O_IPVER:
3876 match = (hlen > 0 && cmd->arg1 == ip->ip_v);
3877 break;
3878
3879 case O_IPTTL:
3880 match = (hlen > 0 && cmd->arg1 == ip->ip_ttl);
3881 break;
3882
3883 case O_IPID:
3884 match = (hlen > 0 &&
3885 cmd->arg1 == ntohs(ip->ip_id));
3886 break;
3887
3888 case O_IPLEN:
3889 match = (hlen > 0 && cmd->arg1 == lc.ip_len);
3890 break;
3891
3892 case O_IPPRECEDENCE:
3893 match = (hlen > 0 &&
3894 (cmd->arg1 == (ip->ip_tos & 0xe0)));
3895 break;
3896
3897 case O_IPTOS:
3898 match = (hlen > 0 &&
3899 flags_match(cmd, ip->ip_tos));
3900 break;
3901
3902 case O_TCPFLAGS:
3903 match = (lc.proto == IPPROTO_TCP &&
3904 lc.offset == 0 &&
3905 flags_match(cmd,
3906 L3HDR(struct tcphdr,ip)->th_flags));
3907 break;
3908
3909 case O_TCPOPTS:
3910 match = (lc.proto == IPPROTO_TCP &&
3911 lc.offset == 0 && tcpopts_match(ip, cmd));
3912 break;
3913
3914 case O_TCPSEQ:
3915 match = (lc.proto == IPPROTO_TCP &&
3916 lc.offset == 0 &&
3917 ((ipfw_insn_u32 *)cmd)->d[0] ==
3918 L3HDR(struct tcphdr,ip)->th_seq);
3919 break;
3920
3921 case O_TCPACK:
3922 match = (lc.proto == IPPROTO_TCP &&
3923 lc.offset == 0 &&
3924 ((ipfw_insn_u32 *)cmd)->d[0] ==
3925 L3HDR(struct tcphdr,ip)->th_ack);
3926 break;
3927
3928 case O_TCPWIN:
3929 match = (lc.proto == IPPROTO_TCP &&
3930 lc.offset == 0 &&
3931 cmd->arg1 ==
3932 L3HDR(struct tcphdr,ip)->th_win);
3933 break;
3934
3935 case O_ESTAB:
3936 /* reject packets which have SYN only */
3937 /* XXX should i also check for TH_ACK ? */
3938 match = (lc.proto == IPPROTO_TCP &&
3939 lc.offset == 0 &&
3940 (L3HDR(struct tcphdr,ip)->th_flags &
3941 (TH_RST | TH_ACK | TH_SYN)) != TH_SYN);
3942 break;
3943
3944 case O_LOG:
3945 if (fw_verbose) {
3946 ipfw_log(ctx, f, hlen, args->eh, m,
3947 oif);
3948 }
3949 match = 1;
3950 break;
3951
3952 case O_PROB:
3953 match = (krandom() <
3954 ((ipfw_insn_u32 *)cmd)->d[0]);
3955 break;
3956
3957 /*
3958 * The second set of opcodes represents 'actions',
3959 * i.e. the terminal part of a rule once the packet
3960 * matches all previous patterns.
3961 * Typically there is only one action for each rule,
3962 * and the opcode is stored at the end of the rule
3963 * (but there are exceptions -- see below).
3964 *
3965 * In general, here we set retval and terminate the
3966 * outer loop (would be a 'break 3' in some language,
3967 * but we need to do a 'goto done').
3968 *
3969 * Exceptions:
3970 * O_COUNT and O_SKIPTO actions:
3971 * instead of terminating, we jump to the next rule
3972 * ('goto next_rule', equivalent to a 'break 2'),
3973 * or to the SKIPTO target ('goto again' after
3974 * having set f, cmd and l), respectively.
3975 *
3976 * O_LIMIT and O_KEEP_STATE, O_REDIRECT: these opcodes
3977 * are not real 'actions', and are stored right
3978 * before the 'action' part of the rule.
3979 * These opcodes try to install an entry in the
3980 * state tables; if successful, we continue with
3981 * the next opcode (match=1; break;), otherwise
3982 * the packet must be dropped ('goto done' after
3983 * setting retval). If static rules are changed
3984 * during the state installation, the packet will
3985 * be dropped and rule's stats will not beupdated
3986 * ('return IP_FW_DENY').
3987 *
3988 * O_PROBE_STATE and O_CHECK_STATE: these opcodes
3989 * cause a lookup of the state table, and a jump
3990 * to the 'action' part of the parent rule
3991 * ('goto check_body') if an entry is found, or
3992 * (CHECK_STATE only) a jump to the next rule if
3993 * the entry is not found ('goto next_rule').
3994 * The result of the lookup is cached to make
3995 * further instances of these opcodes are
3996 * effectively NOPs. If static rules are changed
3997 * during the state looking up, the packet will
3998 * be dropped and rule's stats will not be updated
3999 * ('return IP_FW_DENY').
4000 */
4001 case O_REDIRECT:
4002 if (f->cross_rules == NULL) {
4003 /*
4004 * This rule was not completely setup;
4005 * move on to the next rule.
4006 */
4007 goto next_rule;
4008 }
4009 /*
4010 * Apply redirect only on input path and
4011 * only to non-fragment TCP segments or
4012 * UDP datagrams.
4013 *
4014 * Does _not_ work with layer2 filtering.
4015 */
4016 if (oif != NULL || args->eh != NULL ||
4017 (ip->ip_off & htons(IP_MF | IP_OFFMASK)) ||
4018 (lc.proto != IPPROTO_TCP &&
4019 lc.proto != IPPROTO_UDP))
4020 break;
4021 /* FALL THROUGH */
4022 case O_LIMIT:
4023 case O_KEEP_STATE:
4024 if (hlen == 0)
4025 break;
4026 s = ipfw_state_install(ctx, f,
4027 (ipfw_insn_limit *)cmd, args, lc.tcp);
4028 if (s == NULL) {
4029 retval = IP_FW_DENY;
4030 goto done; /* error/limit violation */
4031 }
4032 s->st_pcnt++;
4033 s->st_bcnt += lc.ip_len;
4034
4035 if (s->st_type == O_REDIRECT) {
4036 struct in_addr oaddr;
4037 uint16_t oport;
4038 struct ipfw_xlat *slave_x, *x;
4039 struct ipfw_state *dup;
4040
4041 x = (struct ipfw_xlat *)s;
4042 ipfw_xlate(x, m, &oaddr, &oport);
4043 m = ipfw_rehashm(m, hlen, args, &lc,
4044 &ip);
4045 if (m == NULL) {
4046 ipfw_state_del(ctx, s);
4047 goto pullup_failed;
4048 }
4049
4050 cpuid = netisr_hashcpu(
4051 m->m_pkthdr.hash);
4052
4053 slave_x = (struct ipfw_xlat *)
4054 ipfw_state_alloc(ctx, &args->f_id,
4055 O_REDIRECT, f->cross_rules[cpuid],
4056 lc.tcp);
4057 if (slave_x == NULL) {
4058 ipfw_state_del(ctx, s);
4059 retval = IP_FW_DENY;
4060 goto done;
4061 }
4062 slave_x->xlat_addr = oaddr.s_addr;
4063 slave_x->xlat_port = oport;
4064 slave_x->xlat_dir = MATCH_REVERSE;
4065 slave_x->xlat_flags |=
4066 IPFW_STATE_F_XLATSRC |
4067 IPFW_STATE_F_XLATSLAVE;
4068
4069 slave_x->xlat_pair = x;
4070 slave_x->xlat_pcpu = mycpuid;
4071 x->xlat_pair = slave_x;
4072 x->xlat_pcpu = cpuid;
4073
4074 ctx->ipfw_xlated++;
4075 if (cpuid != mycpuid) {
4076 ctx->ipfw_xlate_split++;
4077 ipfw_xlate_redispatch(
4078 m, cpuid, x,
4079 IPFW_XLATE_INSERT |
4080 IPFW_XLATE_FORWARD);
4081 args->m = NULL;
4082 return (IP_FW_REDISPATCH);
4083 }
4084
4085 dup = ipfw_state_link(ctx,
4086 &slave_x->xlat_st);
4087 if (dup != NULL) {
4088 ctx->ipfw_xlate_conflicts++;
4089 if (IPFW_STATE_ISDEAD(dup)) {
4090 ipfw_state_remove(ctx,
4091 dup);
4092 dup = ipfw_state_link(
4093 ctx, &slave_x->xlat_st);
4094 }
4095 if (dup != NULL) {
4096 if (bootverbose) {
4097 kprintf("ipfw: "
4098 "slave %u state "
4099 "conflicts "
4100 "%u state\n",
4101 x->xlat_type,
4102 s->st_type);
4103 }
4104 ipfw_state_del(ctx, s);
4105 return (IP_FW_DENY);
4106 }
4107 ctx->ipfw_xlate_cresolved++;
4108 }
4109 }
4110 match = 1;
4111 break;
4112
4113 case O_PROBE_STATE:
4114 case O_CHECK_STATE:
4115 /*
4116 * States are checked at the first keep-state
4117 * check-state occurrence, with the result
4118 * being stored in dyn_dir. The compiler
4119 * introduces a PROBE_STATE instruction for
4120 * us when we have a KEEP_STATE/LIMIT/RDR
4121 * (because PROBE_STATE needs to be run first).
4122 */
4123 s = NULL;
4124 if (dyn_dir == MATCH_UNKNOWN) {
4125 s = ipfw_state_lookup(ctx,
4126 &args->f_id, &dyn_dir, lc.tcp);
4127 }
4128 if (s == NULL ||
4129 (s->st_type == O_REDIRECT &&
4130 (args->eh != NULL ||
4131 (ip->ip_off & htons(IP_MF | IP_OFFMASK)) ||
4132 (lc.proto != IPPROTO_TCP &&
4133 lc.proto != IPPROTO_UDP)))) {
4134 /*
4135 * State not found. If CHECK_STATE,
4136 * skip to next rule, if PROBE_STATE
4137 * just ignore and continue with next
4138 * opcode.
4139 */
4140 if (cmd->opcode == O_CHECK_STATE)
4141 goto next_rule;
4142 match = 1;
4143 break;
4144 }
4145
4146 s->st_pcnt++;
4147 s->st_bcnt += lc.ip_len;
4148
4149 if (s->st_type == O_REDIRECT) {
4150 struct ipfw_xlat *x =
4151 (struct ipfw_xlat *)s;
4152
4153 if (oif != NULL &&
4154 x->xlat_ifp == NULL) {
4155 KASSERT(x->xlat_flags &
4156 IPFW_STATE_F_XLATSLAVE,
4157 ("master rdr state "
4158 "missing ifp"));
4159 x->xlat_ifp = oif;
4160 } else if (
4161 (oif != NULL && x->xlat_ifp!=oif) ||
4162 (oif == NULL &&
4163 x->xlat_ifp!=m->m_pkthdr.rcvif)) {
4164 retval = IP_FW_DENY;
4165 goto done;
4166 }
4167 if (x->xlat_dir != dyn_dir)
4168 goto skip_xlate;
4169
4170 ipfw_xlate(x, m, NULL, NULL);
4171 m = ipfw_rehashm(m, hlen, args, &lc,
4172 &ip);
4173 if (m == NULL)
4174 goto pullup_failed;
4175
4176 cpuid = netisr_hashcpu(
4177 m->m_pkthdr.hash);
4178 if (cpuid != mycpuid) {
4179 uint32_t xlate = 0;
4180
4181 if (oif != NULL) {
4182 xlate |=
4183 IPFW_XLATE_OUTPUT;
4184 }
4185 if (dyn_dir == MATCH_FORWARD) {
4186 xlate |=
4187 IPFW_XLATE_FORWARD;
4188 }
4189 ipfw_xlate_redispatch(m, cpuid,
4190 x, xlate);
4191 args->m = NULL;
4192 return (IP_FW_REDISPATCH);
4193 }
4194
4195 KKASSERT(x->xlat_pcpu == mycpuid);
4196 ipfw_state_update(&args->f_id, dyn_dir,
4197 lc.tcp, &x->xlat_pair->xlat_st);
4198 }
4199 skip_xlate:
4200 /*
4201 * Found a rule from a state; jump to the
4202 * 'action' part of the rule.
4203 */
4204 f = s->st_rule;
4205 KKASSERT(f->cpuid == mycpuid);
4206
4207 cmd = ACTION_PTR(f);
4208 l = f->cmd_len - f->act_ofs;
4209 dyn_f = f;
4210 goto check_body;
4211
4212 case O_ACCEPT:
4213 retval = IP_FW_PASS; /* accept */
4214 goto done;
4215
4216 case O_DEFRAG:
4217 if (f->cross_rules == NULL) {
4218 /*
4219 * This rule was not completely setup;
4220 * move on to the next rule.
4221 */
4222 goto next_rule;
4223 }
4224
4225 /*
4226 * Don't defrag for l2 packets, output packets
4227 * or non-fragments.
4228 */
4229 if (oif != NULL || args->eh != NULL ||
4230 (ip->ip_off & htons(IP_MF | IP_OFFMASK)) == 0)
4231 goto next_rule;
4232
4233 ctx->ipfw_frags++;
4234 m = ip_reass(m);
4235 args->m = m;
4236 if (m == NULL) {
4237 retval = IP_FW_PASS;
4238 goto done;
4239 }
4240 ctx->ipfw_defraged++;
4241 KASSERT((m->m_flags & M_HASH) == 0,
4242 ("hash not cleared"));
4243
4244 /* Update statistics */
4245 f->pcnt++;
4246 f->bcnt += lc.ip_len;
4247 f->timestamp = time_second;
4248
4249 ip = mtod(m, struct ip *);
4250 hlen = ip->ip_hl << 2;
4251 ip->ip_len = htons(ntohs(ip->ip_len) + hlen);
4252
4253 ip_hashfn(&m, 0);
4254 args->m = m;
4255 if (m == NULL)
4256 goto pullup_failed;
4257
4258 KASSERT(m->m_flags & M_HASH, ("no hash"));
4259 cpuid = netisr_hashcpu(m->m_pkthdr.hash);
4260 if (cpuid != mycpuid) {
4261 ctx->ipfw_defrag_remote++;
4262 ipfw_defrag_redispatch(m, cpuid, f);
4263 args->m = NULL;
4264 return (IP_FW_REDISPATCH);
4265 }
4266
4267 /* 'm' might be changed by ip_hashfn(). */
4268 ip = mtod(m, struct ip *);
4269
4270 m = ipfw_setup_local(m, hlen, args, &lc, &ip);
4271 if (m == NULL)
4272 goto pullup_failed;
4273
4274 /* Move on. */
4275 goto next_rule;
4276
4277 case O_PIPE:
4278 case O_QUEUE:
4279 args->rule = f; /* report matching rule */
4280 args->cookie = cmd->arg1;
4281 retval = IP_FW_DUMMYNET;
4282 goto done;
4283
4284 case O_DIVERT:
4285 case O_TEE:
4286 if (args->eh) /* not on layer 2 */
4287 break;
4288
4289 mtag = m_tag_get(PACKET_TAG_IPFW_DIVERT,
4290 sizeof(*divinfo), M_INTWAIT | M_NULLOK);
4291 if (mtag == NULL) {
4292 retval = IP_FW_DENY;
4293 goto done;
4294 }
4295 divinfo = m_tag_data(mtag);
4296
4297 divinfo->skipto = f->rulenum;
4298 divinfo->port = cmd->arg1;
4299 divinfo->tee = (cmd->opcode == O_TEE);
4300 m_tag_prepend(m, mtag);
4301
4302 args->cookie = cmd->arg1;
4303 retval = (cmd->opcode == O_DIVERT) ?
4304 IP_FW_DIVERT : IP_FW_TEE;
4305 goto done;
4306
4307 case O_COUNT:
4308 case O_SKIPTO:
4309 f->pcnt++; /* update stats */
4310 f->bcnt += lc.ip_len;
4311 f->timestamp = time_second;
4312 if (cmd->opcode == O_COUNT)
4313 goto next_rule;
4314 /* handle skipto */
4315 if (f->next_rule == NULL)
4316 lookup_next_rule(f);
4317 f = f->next_rule;
4318 goto again;
4319
4320 case O_REJECT:
4321 /*
4322 * Drop the packet and send a reject notice
4323 * if the packet is not ICMP (or is an ICMP
4324 * query), and it is not multicast/broadcast.
4325 */
4326 if (hlen > 0 &&
4327 (lc.proto != IPPROTO_ICMP ||
4328 is_icmp_query(ip)) &&
4329 !(m->m_flags & (M_BCAST|M_MCAST)) &&
4330 !IN_MULTICAST(ntohl(lc.dst_ip.s_addr))) {
4331 send_reject(args, cmd->arg1,
4332 lc.offset, lc.ip_len);
4333 retval = IP_FW_DENY;
4334 goto done;
4335 }
4336 /* FALLTHROUGH */
4337 case O_DENY:
4338 retval = IP_FW_DENY;
4339 goto done;
4340
4341 case O_FORWARD_IP:
4342 if (args->eh) /* not valid on layer2 pkts */
4343 break;
4344 if (!dyn_f || dyn_dir == MATCH_FORWARD) {
4345 struct sockaddr_in *sin;
4346
4347 mtag = m_tag_get(PACKET_TAG_IPFORWARD,
4348 sizeof(*sin), M_INTWAIT | M_NULLOK);
4349 if (mtag == NULL) {
4350 retval = IP_FW_DENY;
4351 goto done;
4352 }
4353 sin = m_tag_data(mtag);
4354
4355 /* Structure copy */
4356 *sin = ((ipfw_insn_sa *)cmd)->sa;
4357
4358 m_tag_prepend(m, mtag);
4359 m->m_pkthdr.fw_flags |=
4360 IPFORWARD_MBUF_TAGGED;
4361 m->m_pkthdr.fw_flags &=
4362 ~BRIDGE_MBUF_TAGGED;
4363 }
4364 retval = IP_FW_PASS;
4365 goto done;
4366
4367 default:
4368 panic("-- unknown opcode %d", cmd->opcode);
4369 } /* end of switch() on opcodes */
4370
4371 if (cmd->len & F_NOT)
4372 match = !match;
4373
4374 if (match) {
4375 if (cmd->len & F_OR)
4376 skip_or = 1;
4377 } else {
4378 if (!(cmd->len & F_OR)) /* not an OR block, */
4379 break; /* try next rule */
4380 }
4381
4382 } /* end of inner for, scan opcodes */
4383
4384 next_rule:; /* try next rule */
4385
4386 } /* end of outer for, scan rules */
4387 kprintf("+++ ipfw: ouch!, skip past end of rules, denying packet\n");
4388 return IP_FW_DENY;
4389
4390 done:
4391 /* Update statistics */
4392 f->pcnt++;
4393 f->bcnt += lc.ip_len;
4394 f->timestamp = time_second;
4395 return retval;
4396
4397 pullup_failed:
4398 if (fw_verbose)
4399 kprintf("pullup failed\n");
4400 return IP_FW_DENY;
4401 }
4402
4403 static struct mbuf *
4404 ipfw_dummynet_io(struct mbuf *m, int pipe_nr, int dir, struct ip_fw_args *fwa)
4405 {
4406 struct m_tag *mtag;
4407 struct dn_pkt *pkt;
4408 ipfw_insn *cmd;
4409 const struct ipfw_flow_id *id;
4410 struct dn_flow_id *fid;
4411
4412 M_ASSERTPKTHDR(m);
4413
4414 mtag = m_tag_get(PACKET_TAG_DUMMYNET, sizeof(*pkt),
4415 M_INTWAIT | M_NULLOK);
4416 if (mtag == NULL) {
4417 m_freem(m);
4418 return (NULL);
4419 }
4420 m_tag_prepend(m, mtag);
4421
4422 pkt = m_tag_data(mtag);
4423 bzero(pkt, sizeof(*pkt));
4424
4425 cmd = fwa->rule->cmd + fwa->rule->act_ofs;
4426 if (cmd->opcode == O_LOG)
4427 cmd += F_LEN(cmd);
4428 KASSERT(cmd->opcode == O_PIPE || cmd->opcode == O_QUEUE,
4429 ("Rule is not PIPE or QUEUE, opcode %d", cmd->opcode));
4430
4431 pkt->dn_m = m;
4432 pkt->dn_flags = (dir & DN_FLAGS_DIR_MASK);
4433 pkt->ifp = fwa->oif;
4434 pkt->pipe_nr = pipe_nr;
4435
4436 pkt->cpuid = mycpuid;
4437 pkt->msgport = netisr_curport();
4438
4439 id = &fwa->f_id;
4440 fid = &pkt->id;
4441 fid->fid_dst_ip = id->dst_ip;
4442 fid->fid_src_ip = id->src_ip;
4443 fid->fid_dst_port = id->dst_port;
4444 fid->fid_src_port = id->src_port;
4445 fid->fid_proto = id->proto;
4446 fid->fid_flags = id->flags;
4447
4448 ipfw_ref_rule(fwa->rule);
4449 pkt->dn_priv = fwa->rule;
4450 pkt->dn_unref_priv = ipfw_unref_rule;
4451
4452 if (cmd->opcode == O_PIPE)
4453 pkt->dn_flags |= DN_FLAGS_IS_PIPE;
4454
4455 m->m_pkthdr.fw_flags |= DUMMYNET_MBUF_TAGGED;
4456 return (m);
4457 }
4458
4459 /*
4460 * When a rule is added/deleted, clear the next_rule pointers in all rules.
4461 * These will be reconstructed on the fly as packets are matched.
4462 */
4463 static void
4464 ipfw_flush_rule_ptrs(struct ipfw_context *ctx)
4465 {
4466 struct ip_fw *rule;
4467
4468 for (rule = ctx->ipfw_layer3_chain; rule; rule = rule->next)
4469 rule->next_rule = NULL;
4470 }
4471
4472 static void
4473 ipfw_inc_static_count(struct ip_fw *rule)
4474 {
4475 /* Static rule's counts are updated only on CPU0 */
4476 KKASSERT(mycpuid == 0);
4477
4478 static_count++;
4479 static_ioc_len += IOC_RULESIZE(rule);
4480 }
4481
4482 static void
4483 ipfw_dec_static_count(struct ip_fw *rule)
4484 {
4485 int l = IOC_RULESIZE(rule);
4486
4487 /* Static rule's counts are updated only on CPU0 */
4488 KKASSERT(mycpuid == 0);
4489
4490 KASSERT(static_count > 0, ("invalid static count %u", static_count));
4491 static_count--;
4492
4493 KASSERT(static_ioc_len >= l,
4494 ("invalid static len %u", static_ioc_len));
4495 static_ioc_len -= l;
4496 }
4497
4498 static void
4499 ipfw_link_sibling(struct netmsg_ipfw *fwmsg, struct ip_fw *rule)
4500 {
4501 if (fwmsg->sibling != NULL) {
4502 KKASSERT(mycpuid > 0 && fwmsg->sibling->cpuid == mycpuid - 1);
4503 fwmsg->sibling->sibling = rule;
4504 }
4505 fwmsg->sibling = rule;
4506 }
4507
4508 static struct ip_fw *
4509 ipfw_create_rule(const struct ipfw_ioc_rule *ioc_rule, uint32_t rule_flags)
4510 {
4511 struct ip_fw *rule;
4512
4513 rule = kmalloc(RULESIZE(ioc_rule), M_IPFW, M_WAITOK | M_ZERO);
4514
4515 rule->act_ofs = ioc_rule->act_ofs;
4516 rule->cmd_len = ioc_rule->cmd_len;
4517 rule->rulenum = ioc_rule->rulenum;
4518 rule->set = ioc_rule->set;
4519 rule->usr_flags = ioc_rule->usr_flags;
4520
4521 bcopy(ioc_rule->cmd, rule->cmd, rule->cmd_len * 4 /* XXX */);
4522
4523 rule->refcnt = 1;
4524 rule->cpuid = mycpuid;
4525 rule->rule_flags = rule_flags;
4526
4527 return rule;
4528 }
4529
4530 static void
4531 ipfw_add_rule_dispatch(netmsg_t nmsg)
4532 {
4533 struct netmsg_ipfw *fwmsg = (struct netmsg_ipfw *)nmsg;
4534 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
4535 struct ip_fw *rule;
4536
4537 ASSERT_NETISR_NCPUS(mycpuid);
4538
4539 rule = ipfw_create_rule(fwmsg->ioc_rule, fwmsg->rule_flags);
4540
4541 /*
4542 * Insert rule into the pre-determined position
4543 */
4544 if (fwmsg->prev_rule != NULL) {
4545 struct ip_fw *prev, *next;
4546
4547 prev = fwmsg->prev_rule;
4548 KKASSERT(prev->cpuid == mycpuid);
4549
4550 next = fwmsg->next_rule;
4551 KKASSERT(next->cpuid == mycpuid);
4552
4553 rule->next = next;
4554 prev->next = rule;
4555
4556 /*
4557 * Move to the position on the next CPU
4558 * before the msg is forwarded.
4559 */
4560 fwmsg->prev_rule = prev->sibling;
4561 fwmsg->next_rule = next->sibling;
4562 } else {
4563 KKASSERT(fwmsg->next_rule == NULL);
4564 rule->next = ctx->ipfw_layer3_chain;
4565 ctx->ipfw_layer3_chain = rule;
4566 }
4567
4568 /* Link rule CPU sibling */
4569 ipfw_link_sibling(fwmsg, rule);
4570
4571 ipfw_flush_rule_ptrs(ctx);
4572
4573 if (mycpuid == 0) {
4574 /* Statistics only need to be updated once */
4575 ipfw_inc_static_count(rule);
4576
4577 /* Return the rule on CPU0 */
4578 nmsg->lmsg.u.ms_resultp = rule;
4579 }
4580
4581 if (rule->rule_flags & IPFW_RULE_F_GENTRACK)
4582 rule->track_ruleid = (uintptr_t)nmsg->lmsg.u.ms_resultp;
4583
4584 if (fwmsg->cross_rules != NULL) {
4585 /* Save rules for later use. */
4586 fwmsg->cross_rules[mycpuid] = rule;
4587 }
4588
4589 netisr_forwardmsg(&nmsg->base, mycpuid + 1);
4590 }
4591
4592 static void
4593 ipfw_crossref_rule_dispatch(netmsg_t nmsg)
4594 {
4595 struct netmsg_ipfw *fwmsg = (struct netmsg_ipfw *)nmsg;
4596 struct ip_fw *rule = fwmsg->sibling;
4597 int sz = sizeof(struct ip_fw *) * netisr_ncpus;
4598
4599 ASSERT_NETISR_NCPUS(mycpuid);
4600 KASSERT(rule->rule_flags & IPFW_RULE_F_CROSSREF,
4601 ("not crossref rule"));
4602
4603 rule->cross_rules = kmalloc(sz, M_IPFW, M_WAITOK);
4604 memcpy(rule->cross_rules, fwmsg->cross_rules, sz);
4605
4606 fwmsg->sibling = rule->sibling;
4607 netisr_forwardmsg(&fwmsg->base, mycpuid + 1);
4608 }
4609
4610 /*
4611 * Add a new rule to the list. Copy the rule into a malloc'ed area,
4612 * then possibly create a rule number and add the rule to the list.
4613 * Update the rule_number in the input struct so the caller knows
4614 * it as well.
4615 */
4616 static void
4617 ipfw_add_rule(struct ipfw_ioc_rule *ioc_rule, uint32_t rule_flags)
4618 {
4619 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
4620 struct netmsg_ipfw fwmsg;
4621 struct ip_fw *f, *prev, *rule;
4622
4623 ASSERT_NETISR0;
4624
4625 /*
4626 * If rulenum is 0, find highest numbered rule before the
4627 * default rule, and add rule number incremental step.
4628 */
4629 if (ioc_rule->rulenum == 0) {
4630 int step = autoinc_step;
4631
4632 KKASSERT(step >= IPFW_AUTOINC_STEP_MIN &&
4633 step <= IPFW_AUTOINC_STEP_MAX);
4634
4635 /*
4636 * Locate the highest numbered rule before default
4637 */
4638 for (f = ctx->ipfw_layer3_chain; f; f = f->next) {
4639 if (f->rulenum == IPFW_DEFAULT_RULE)
4640 break;
4641 ioc_rule->rulenum = f->rulenum;
4642 }
4643 if (ioc_rule->rulenum < IPFW_DEFAULT_RULE - step)
4644 ioc_rule->rulenum += step;
4645 }
4646 KASSERT(ioc_rule->rulenum != IPFW_DEFAULT_RULE &&
4647 ioc_rule->rulenum != 0,
4648 ("invalid rule num %d", ioc_rule->rulenum));
4649
4650 /*
4651 * Now find the right place for the new rule in the sorted list.
4652 */
4653 for (prev = NULL, f = ctx->ipfw_layer3_chain; f;
4654 prev = f, f = f->next) {
4655 if (f->rulenum > ioc_rule->rulenum) {
4656 /* Found the location */
4657 break;
4658 }
4659 }
4660 KASSERT(f != NULL, ("no default rule?!"));
4661
4662 /*
4663 * Duplicate the rule onto each CPU.
4664 * The rule duplicated on CPU0 will be returned.
4665 */
4666 bzero(&fwmsg, sizeof(fwmsg));
4667 netmsg_init(&fwmsg.base, NULL, &curthread->td_msgport, MSGF_PRIORITY,
4668 ipfw_add_rule_dispatch);
4669 fwmsg.ioc_rule = ioc_rule;
4670 fwmsg.prev_rule = prev;
4671 fwmsg.next_rule = prev == NULL ? NULL : f;
4672 fwmsg.rule_flags = rule_flags;
4673 if (rule_flags & IPFW_RULE_F_CROSSREF) {
4674 fwmsg.cross_rules = kmalloc(
4675 sizeof(struct ip_fw *) * netisr_ncpus, M_TEMP,
4676 M_WAITOK | M_ZERO);
4677 }
4678
4679 netisr_domsg_global(&fwmsg.base);
4680 KKASSERT(fwmsg.prev_rule == NULL && fwmsg.next_rule == NULL);
4681
4682 rule = fwmsg.base.lmsg.u.ms_resultp;
4683 KKASSERT(rule != NULL && rule->cpuid == mycpuid);
4684
4685 if (fwmsg.cross_rules != NULL) {
4686 netmsg_init(&fwmsg.base, NULL, &curthread->td_msgport,
4687 MSGF_PRIORITY, ipfw_crossref_rule_dispatch);
4688 fwmsg.sibling = rule;
4689 netisr_domsg_global(&fwmsg.base);
4690 KKASSERT(fwmsg.sibling == NULL);
4691
4692 kfree(fwmsg.cross_rules, M_TEMP);
4693
4694 #ifdef KLD_MODULE
4695 atomic_add_int(&ipfw_gd.ipfw_refcnt, 1);
4696 #endif
4697 }
4698
4699 DPRINTF("++ installed rule %d, static count now %d\n",
4700 rule->rulenum, static_count);
4701 }
4702
4703 /*
4704 * Free storage associated with a static rule (including derived
4705 * states/tracks).
4706 * The caller is in charge of clearing rule pointers to avoid
4707 * dangling pointers.
4708 * @return a pointer to the next entry.
4709 * Arguments are not checked, so they better be correct.
4710 */
4711 static struct ip_fw *
4712 ipfw_delete_rule(struct ipfw_context *ctx,
4713 struct ip_fw *prev, struct ip_fw *rule)
4714 {
4715 struct ip_fw *n;
4716
4717 n = rule->next;
4718 if (prev == NULL)
4719 ctx->ipfw_layer3_chain = n;
4720 else
4721 prev->next = n;
4722
4723 /* Mark the rule as invalid */
4724 rule->rule_flags |= IPFW_RULE_F_INVALID;
4725 rule->next_rule = NULL;
4726 rule->sibling = NULL;
4727 #ifdef foo
4728 /* Don't reset cpuid here; keep various assertion working */
4729 rule->cpuid = -1;
4730 #endif
4731
4732 /* Statistics only need to be updated once */
4733 if (mycpuid == 0)
4734 ipfw_dec_static_count(rule);
4735
4736 if ((rule->rule_flags & IPFW_RULE_F_CROSSREF) == 0) {
4737 /* Try to free this rule */
4738 ipfw_free_rule(rule);
4739 } else {
4740 /* TODO: check staging area. */
4741 if (mycpuid == 0) {
4742 rule->next = ipfw_gd.ipfw_crossref_free;
4743 ipfw_gd.ipfw_crossref_free = rule;
4744 }
4745 }
4746
4747 /* Return the next rule */
4748 return n;
4749 }
4750
4751 static void
4752 ipfw_flush_dispatch(netmsg_t nmsg)
4753 {
4754 int kill_default = nmsg->lmsg.u.ms_result;
4755 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
4756 struct ip_fw *rule;
4757
4758 ASSERT_NETISR_NCPUS(mycpuid);
4759
4760 /*
4761 * Flush states.
4762 */
4763 ipfw_state_flush(ctx, NULL);
4764 KASSERT(ctx->ipfw_state_cnt == 0,
4765 ("%d pcpu states remain", ctx->ipfw_state_cnt));
4766 ctx->ipfw_state_loosecnt = 0;
4767 ctx->ipfw_state_lastexp = 0;
4768
4769 /*
4770 * Flush tracks.
4771 */
4772 ipfw_track_flush(ctx, NULL);
4773 ctx->ipfw_track_lastexp = 0;
4774 if (ctx->ipfw_trkcnt_spare != NULL) {
4775 kfree(ctx->ipfw_trkcnt_spare, M_IPFW);
4776 ctx->ipfw_trkcnt_spare = NULL;
4777 }
4778
4779 ipfw_flush_rule_ptrs(ctx); /* more efficient to do outside the loop */
4780
4781 while ((rule = ctx->ipfw_layer3_chain) != NULL &&
4782 (kill_default || rule->rulenum != IPFW_DEFAULT_RULE))
4783 ipfw_delete_rule(ctx, NULL, rule);
4784
4785 netisr_forwardmsg(&nmsg->base, mycpuid + 1);
4786 }
4787
4788 /*
4789 * Deletes all rules from a chain (including the default rule
4790 * if the second argument is set).
4791 */
4792 static void
4793 ipfw_flush(int kill_default)
4794 {
4795 struct netmsg_base nmsg;
4796 #ifdef INVARIANTS
4797 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
4798 int state_cnt;
4799 #endif
4800
4801 ASSERT_NETISR0;
4802
4803 /*
4804 * If 'kill_default' then caller has done the necessary
4805 * msgport syncing; unnecessary to do it again.
4806 */
4807 if (!kill_default) {
4808 /*
4809 * Let ipfw_chk() know the rules are going to
4810 * be flushed, so it could jump directly to
4811 * the default rule.
4812 */
4813 ipfw_flushing = 1;
4814 /* XXX use priority sync */
4815 netmsg_service_sync();
4816 }
4817
4818 /*
4819 * Press the 'flush' button
4820 */
4821 bzero(&nmsg, sizeof(nmsg));
4822 netmsg_init(&nmsg, NULL, &curthread->td_msgport, MSGF_PRIORITY,
4823 ipfw_flush_dispatch);
4824 nmsg.lmsg.u.ms_result = kill_default;
4825 netisr_domsg_global(&nmsg);
4826 ipfw_gd.ipfw_state_loosecnt = 0;
4827 ipfw_gd.ipfw_state_globexp = 0;
4828 ipfw_gd.ipfw_track_globexp = 0;
4829
4830 #ifdef INVARIANTS
4831 state_cnt = ipfw_state_cntcoll();
4832 KASSERT(state_cnt == 0, ("%d states remain", state_cnt));
4833
4834 KASSERT(ipfw_gd.ipfw_trkcnt_cnt == 0,
4835 ("%d trkcnts remain", ipfw_gd.ipfw_trkcnt_cnt));
4836
4837 if (kill_default) {
4838 KASSERT(static_count == 0,
4839 ("%u static rules remain", static_count));
4840 KASSERT(static_ioc_len == 0,
4841 ("%u bytes of static rules remain", static_ioc_len));
4842 } else {
4843 KASSERT(static_count == 1,
4844 ("%u static rules remain", static_count));
4845 KASSERT(static_ioc_len == IOC_RULESIZE(ctx->ipfw_default_rule),
4846 ("%u bytes of static rules remain, should be %lu",
4847 static_ioc_len,
4848 (u_long)IOC_RULESIZE(ctx->ipfw_default_rule)));
4849 }
4850 #endif
4851
4852 /* Flush is done */
4853 ipfw_flushing = 0;
4854 }
4855
4856 static void
4857 ipfw_alt_delete_rule_dispatch(netmsg_t nmsg)
4858 {
4859 struct netmsg_del *dmsg = (struct netmsg_del *)nmsg;
4860 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
4861 struct ip_fw *rule, *prev;
4862
4863 ASSERT_NETISR_NCPUS(mycpuid);
4864
4865 rule = dmsg->start_rule;
4866 KKASSERT(rule->cpuid == mycpuid);
4867 dmsg->start_rule = rule->sibling;
4868
4869 prev = dmsg->prev_rule;
4870 if (prev != NULL) {
4871 KKASSERT(prev->cpuid == mycpuid);
4872
4873 /*
4874 * Move to the position on the next CPU
4875 * before the msg is forwarded.
4876 */
4877 dmsg->prev_rule = prev->sibling;
4878 }
4879
4880 /*
4881 * flush pointers outside the loop, then delete all matching
4882 * rules. 'prev' remains the same throughout the cycle.
4883 */
4884 ipfw_flush_rule_ptrs(ctx);
4885 while (rule && rule->rulenum == dmsg->rulenum) {
4886 if (rule->rule_flags & IPFW_RULE_F_GENSTATE) {
4887 /* Flush states generated by this rule. */
4888 ipfw_state_flush(ctx, rule);
4889 }
4890 if (rule->rule_flags & IPFW_RULE_F_GENTRACK) {
4891 /* Flush tracks generated by this rule. */
4892 ipfw_track_flush(ctx, rule);
4893 }
4894 rule = ipfw_delete_rule(ctx, prev, rule);
4895 }
4896
4897 netisr_forwardmsg(&nmsg->base, mycpuid + 1);
4898 }
4899
4900 static int
4901 ipfw_alt_delete_rule(uint16_t rulenum)
4902 {
4903 struct ip_fw *prev, *rule;
4904 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
4905 struct netmsg_del dmsg;
4906
4907 ASSERT_NETISR0;
4908
4909 /*
4910 * Locate first rule to delete
4911 */
4912 for (prev = NULL, rule = ctx->ipfw_layer3_chain;
4913 rule && rule->rulenum < rulenum;
4914 prev = rule, rule = rule->next)
4915 ; /* EMPTY */
4916 if (rule->rulenum != rulenum)
4917 return EINVAL;
4918
4919 /*
4920 * Get rid of the rule duplications on all CPUs
4921 */
4922 bzero(&dmsg, sizeof(dmsg));
4923 netmsg_init(&dmsg.base, NULL, &curthread->td_msgport, MSGF_PRIORITY,
4924 ipfw_alt_delete_rule_dispatch);
4925 dmsg.prev_rule = prev;
4926 dmsg.start_rule = rule;
4927 dmsg.rulenum = rulenum;
4928
4929 netisr_domsg_global(&dmsg.base);
4930 KKASSERT(dmsg.prev_rule == NULL && dmsg.start_rule == NULL);
4931 return 0;
4932 }
4933
4934 static void
4935 ipfw_alt_delete_ruleset_dispatch(netmsg_t nmsg)
4936 {
4937 struct netmsg_del *dmsg = (struct netmsg_del *)nmsg;
4938 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
4939 struct ip_fw *prev, *rule;
4940 #ifdef INVARIANTS
4941 int del = 0;
4942 #endif
4943
4944 ASSERT_NETISR_NCPUS(mycpuid);
4945
4946 ipfw_flush_rule_ptrs(ctx);
4947
4948 prev = NULL;
4949 rule = ctx->ipfw_layer3_chain;
4950 while (rule != NULL) {
4951 if (rule->set == dmsg->from_set) {
4952 if (rule->rule_flags & IPFW_RULE_F_GENSTATE) {
4953 /* Flush states generated by this rule. */
4954 ipfw_state_flush(ctx, rule);
4955 }
4956 if (rule->rule_flags & IPFW_RULE_F_GENTRACK) {
4957 /* Flush tracks generated by this rule. */
4958 ipfw_track_flush(ctx, rule);
4959 }
4960 rule = ipfw_delete_rule(ctx, prev, rule);
4961 #ifdef INVARIANTS
4962 del = 1;
4963 #endif
4964 } else {
4965 prev = rule;
4966 rule = rule->next;
4967 }
4968 }
4969 KASSERT(del, ("no match set?!"));
4970
4971 netisr_forwardmsg(&nmsg->base, mycpuid + 1);
4972 }
4973
4974 static int
4975 ipfw_alt_delete_ruleset(uint8_t set)
4976 {
4977 struct netmsg_del dmsg;
4978 int del;
4979 struct ip_fw *rule;
4980 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
4981
4982 ASSERT_NETISR0;
4983
4984 /*
4985 * Check whether the 'set' exists. If it exists,
4986 * then check whether any rules within the set will
4987 * try to create states.
4988 */
4989 del = 0;
4990 for (rule = ctx->ipfw_layer3_chain; rule; rule = rule->next) {
4991 if (rule->set == set)
4992 del = 1;
4993 }
4994 if (!del)
4995 return 0; /* XXX EINVAL? */
4996
4997 /*
4998 * Delete this set
4999 */
5000 bzero(&dmsg, sizeof(dmsg));
5001 netmsg_init(&dmsg.base, NULL, &curthread->td_msgport, MSGF_PRIORITY,
5002 ipfw_alt_delete_ruleset_dispatch);
5003 dmsg.from_set = set;
5004 netisr_domsg_global(&dmsg.base);
5005
5006 return 0;
5007 }
5008
5009 static void
5010 ipfw_alt_move_rule_dispatch(netmsg_t nmsg)
5011 {
5012 struct netmsg_del *dmsg = (struct netmsg_del *)nmsg;
5013 struct ip_fw *rule;
5014
5015 ASSERT_NETISR_NCPUS(mycpuid);
5016
5017 rule = dmsg->start_rule;
5018 KKASSERT(rule->cpuid == mycpuid);
5019
5020 /*
5021 * Move to the position on the next CPU
5022 * before the msg is forwarded.
5023 */
5024 dmsg->start_rule = rule->sibling;
5025
5026 while (rule && rule->rulenum <= dmsg->rulenum) {
5027 if (rule->rulenum == dmsg->rulenum)
5028 rule->set = dmsg->to_set;
5029 rule = rule->next;
5030 }
5031 netisr_forwardmsg(&nmsg->base, mycpuid + 1);
5032 }
5033
5034 static int
5035 ipfw_alt_move_rule(uint16_t rulenum, uint8_t set)
5036 {
5037 struct netmsg_del dmsg;
5038 struct netmsg_base *nmsg;
5039 struct ip_fw *rule;
5040 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
5041
5042 ASSERT_NETISR0;
5043
5044 /*
5045 * Locate first rule to move
5046 */
5047 for (rule = ctx->ipfw_layer3_chain; rule && rule->rulenum <= rulenum;
5048 rule = rule->next) {
5049 if (rule->rulenum == rulenum && rule->set != set)
5050 break;
5051 }
5052 if (rule == NULL || rule->rulenum > rulenum)
5053 return 0; /* XXX error? */
5054
5055 bzero(&dmsg, sizeof(dmsg));
5056 nmsg = &dmsg.base;
5057 netmsg_init(nmsg, NULL, &curthread->td_msgport, MSGF_PRIORITY,
5058 ipfw_alt_move_rule_dispatch);
5059 dmsg.start_rule = rule;
5060 dmsg.rulenum = rulenum;
5061 dmsg.to_set = set;
5062
5063 netisr_domsg_global(nmsg);
5064 KKASSERT(dmsg.start_rule == NULL);
5065 return 0;
5066 }
5067
5068 static void
5069 ipfw_alt_move_ruleset_dispatch(netmsg_t nmsg)
5070 {
5071 struct netmsg_del *dmsg = (struct netmsg_del *)nmsg;
5072 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
5073 struct ip_fw *rule;
5074
5075 ASSERT_NETISR_NCPUS(mycpuid);
5076
5077 for (rule = ctx->ipfw_layer3_chain; rule; rule = rule->next) {
5078 if (rule->set == dmsg->from_set)
5079 rule->set = dmsg->to_set;
5080 }
5081 netisr_forwardmsg(&nmsg->base, mycpuid + 1);
5082 }
5083
5084 static int
5085 ipfw_alt_move_ruleset(uint8_t from_set, uint8_t to_set)
5086 {
5087 struct netmsg_del dmsg;
5088 struct netmsg_base *nmsg;
5089
5090 ASSERT_NETISR0;
5091
5092 bzero(&dmsg, sizeof(dmsg));
5093 nmsg = &dmsg.base;
5094 netmsg_init(nmsg, NULL, &curthread->td_msgport, MSGF_PRIORITY,
5095 ipfw_alt_move_ruleset_dispatch);
5096 dmsg.from_set = from_set;
5097 dmsg.to_set = to_set;
5098
5099 netisr_domsg_global(nmsg);
5100 return 0;
5101 }
5102
5103 static void
5104 ipfw_alt_swap_ruleset_dispatch(netmsg_t nmsg)
5105 {
5106 struct netmsg_del *dmsg = (struct netmsg_del *)nmsg;
5107 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
5108 struct ip_fw *rule;
5109
5110 ASSERT_NETISR_NCPUS(mycpuid);
5111
5112 for (rule = ctx->ipfw_layer3_chain; rule; rule = rule->next) {
5113 if (rule->set == dmsg->from_set)
5114 rule->set = dmsg->to_set;
5115 else if (rule->set == dmsg->to_set)
5116 rule->set = dmsg->from_set;
5117 }
5118 netisr_forwardmsg(&nmsg->base, mycpuid + 1);
5119 }
5120
5121 static int
5122 ipfw_alt_swap_ruleset(uint8_t set1, uint8_t set2)
5123 {
5124 struct netmsg_del dmsg;
5125 struct netmsg_base *nmsg;
5126
5127 ASSERT_NETISR0;
5128
5129 bzero(&dmsg, sizeof(dmsg));
5130 nmsg = &dmsg.base;
5131 netmsg_init(nmsg, NULL, &curthread->td_msgport, MSGF_PRIORITY,
5132 ipfw_alt_swap_ruleset_dispatch);
5133 dmsg.from_set = set1;
5134 dmsg.to_set = set2;
5135
5136 netisr_domsg_global(nmsg);
5137 return 0;
5138 }
5139
5140 /*
5141 * Remove all rules with given number, and also do set manipulation.
5142 *
5143 * The argument is an uint32_t. The low 16 bit are the rule or set number,
5144 * the next 8 bits are the new set, the top 8 bits are the command:
5145 *
5146 * 0 delete rules with given number
5147 * 1 delete rules with given set number
5148 * 2 move rules with given number to new set
5149 * 3 move rules with given set number to new set
5150 * 4 swap sets with given numbers
5151 */
5152 static int
5153 ipfw_ctl_alter(uint32_t arg)
5154 {
5155 uint16_t rulenum;
5156 uint8_t cmd, new_set;
5157 int error = 0;
5158
5159 ASSERT_NETISR0;
5160
5161 rulenum = arg & 0xffff;
5162 cmd = (arg >> 24) & 0xff;
5163 new_set = (arg >> 16) & 0xff;
5164
5165 if (cmd > 4)
5166 return EINVAL;
5167 if (new_set >= IPFW_DEFAULT_SET)
5168 return EINVAL;
5169 if (cmd == 0 || cmd == 2) {
5170 if (rulenum == IPFW_DEFAULT_RULE)
5171 return EINVAL;
5172 } else {
5173 if (rulenum >= IPFW_DEFAULT_SET)
5174 return EINVAL;
5175 }
5176
5177 switch (cmd) {
5178 case 0: /* delete rules with given number */
5179 error = ipfw_alt_delete_rule(rulenum);
5180 break;
5181
5182 case 1: /* delete all rules with given set number */
5183 error = ipfw_alt_delete_ruleset(rulenum);
5184 break;
5185
5186 case 2: /* move rules with given number to new set */
5187 error = ipfw_alt_move_rule(rulenum, new_set);
5188 break;
5189
5190 case 3: /* move rules with given set number to new set */
5191 error = ipfw_alt_move_ruleset(rulenum, new_set);
5192 break;
5193
5194 case 4: /* swap two sets */
5195 error = ipfw_alt_swap_ruleset(rulenum, new_set);
5196 break;
5197 }
5198 return error;
5199 }
5200
5201 /*
5202 * Clear counters for a specific rule.
5203 */
5204 static void
5205 clear_counters(struct ip_fw *rule, int log_only)
5206 {
5207 ipfw_insn_log *l = (ipfw_insn_log *)ACTION_PTR(rule);
5208
5209 if (log_only == 0) {
5210 rule->bcnt = rule->pcnt = 0;
5211 rule->timestamp = 0;
5212 }
5213 if (l->o.opcode == O_LOG)
5214 l->log_left = l->max_log;
5215 }
5216
5217 static void
5218 ipfw_zero_entry_dispatch(netmsg_t nmsg)
5219 {
5220 struct netmsg_zent *zmsg = (struct netmsg_zent *)nmsg;
5221 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
5222 struct ip_fw *rule;
5223
5224 ASSERT_NETISR_NCPUS(mycpuid);
5225
5226 if (zmsg->rulenum == 0) {
5227 KKASSERT(zmsg->start_rule == NULL);
5228
5229 ctx->ipfw_norule_counter = 0;
5230 for (rule = ctx->ipfw_layer3_chain; rule; rule = rule->next)
5231 clear_counters(rule, zmsg->log_only);
5232 } else {
5233 struct ip_fw *start = zmsg->start_rule;
5234
5235 KKASSERT(start->cpuid == mycpuid);
5236 KKASSERT(start->rulenum == zmsg->rulenum);
5237
5238 /*
5239 * We can have multiple rules with the same number, so we
5240 * need to clear them all.
5241 */
5242 for (rule = start; rule && rule->rulenum == zmsg->rulenum;
5243 rule = rule->next)
5244 clear_counters(rule, zmsg->log_only);
5245
5246 /*
5247 * Move to the position on the next CPU
5248 * before the msg is forwarded.
5249 */
5250 zmsg->start_rule = start->sibling;
5251 }
5252 netisr_forwardmsg(&nmsg->base, mycpuid + 1);
5253 }
5254
5255 /*
5256 * Reset some or all counters on firewall rules.
5257 * @arg frwl is null to clear all entries, or contains a specific
5258 * rule number.
5259 * @arg log_only is 1 if we only want to reset logs, zero otherwise.
5260 */
5261 static int
5262 ipfw_ctl_zero_entry(int rulenum, int log_only)
5263 {
5264 struct netmsg_zent zmsg;
5265 struct netmsg_base *nmsg;
5266 const char *msg;
5267 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
5268
5269 ASSERT_NETISR0;
5270
5271 bzero(&zmsg, sizeof(zmsg));
5272 nmsg = &zmsg.base;
5273 netmsg_init(nmsg, NULL, &curthread->td_msgport, MSGF_PRIORITY,
5274 ipfw_zero_entry_dispatch);
5275 zmsg.log_only = log_only;
5276
5277 if (rulenum == 0) {
5278 msg = log_only ? "ipfw: All logging counts reset.\n"
5279 : "ipfw: Accounting cleared.\n";
5280 } else {
5281 struct ip_fw *rule;
5282
5283 /*
5284 * Locate the first rule with 'rulenum'
5285 */
5286 for (rule = ctx->ipfw_layer3_chain; rule; rule = rule->next) {
5287 if (rule->rulenum == rulenum)
5288 break;
5289 }
5290 if (rule == NULL) /* we did not find any matching rules */
5291 return (EINVAL);
5292 zmsg.start_rule = rule;
5293 zmsg.rulenum = rulenum;
5294
5295 msg = log_only ? "ipfw: Entry %d logging count reset.\n"
5296 : "ipfw: Entry %d cleared.\n";
5297 }
5298 netisr_domsg_global(nmsg);
5299 KKASSERT(zmsg.start_rule == NULL);
5300
5301 if (fw_verbose)
5302 log(LOG_SECURITY | LOG_NOTICE, msg, rulenum);
5303 return (0);
5304 }
5305
5306 /*
5307 * Check validity of the structure before insert.
5308 * Fortunately rules are simple, so this mostly need to check rule sizes.
5309 */
5310 static int
5311 ipfw_check_ioc_rule(struct ipfw_ioc_rule *rule, int size, uint32_t *rule_flags)
5312 {
5313 int l, cmdlen = 0;
5314 int have_action = 0;
5315 ipfw_insn *cmd;
5316
5317 *rule_flags = 0;
5318
5319 /* Check for valid size */
5320 if (size < sizeof(*rule)) {
5321 kprintf("ipfw: rule too short\n");
5322 return EINVAL;
5323 }
5324 l = IOC_RULESIZE(rule);
5325 if (l != size) {
5326 kprintf("ipfw: size mismatch (have %d want %d)\n", size, l);
5327 return EINVAL;
5328 }
5329
5330 /* Check rule number */
5331 if (rule->rulenum == IPFW_DEFAULT_RULE) {
5332 kprintf("ipfw: invalid rule number\n");
5333 return EINVAL;
5334 }
5335
5336 /*
5337 * Now go for the individual checks. Very simple ones, basically only
5338 * instruction sizes.
5339 */
5340 for (l = rule->cmd_len, cmd = rule->cmd; l > 0;
5341 l -= cmdlen, cmd += cmdlen) {
5342 cmdlen = F_LEN(cmd);
5343 if (cmdlen > l) {
5344 kprintf("ipfw: opcode %d size truncated\n",
5345 cmd->opcode);
5346 return EINVAL;
5347 }
5348
5349 DPRINTF("ipfw: opcode %d\n", cmd->opcode);
5350
5351 if (cmd->opcode == O_KEEP_STATE || cmd->opcode == O_LIMIT ||
5352 IPFW_ISXLAT(cmd->opcode)) {
5353 /* This rule will generate states. */
5354 *rule_flags |= IPFW_RULE_F_GENSTATE;
5355 if (cmd->opcode == O_LIMIT)
5356 *rule_flags |= IPFW_RULE_F_GENTRACK;
5357 }
5358 if (cmd->opcode == O_DEFRAG || IPFW_ISXLAT(cmd->opcode))
5359 *rule_flags |= IPFW_RULE_F_CROSSREF;
5360 if (cmd->opcode == O_IP_SRC_IFIP ||
5361 cmd->opcode == O_IP_DST_IFIP) {
5362 *rule_flags |= IPFW_RULE_F_DYNIFADDR;
5363 cmd->arg1 &= IPFW_IFIP_SETTINGS;
5364 }
5365
5366 switch (cmd->opcode) {
5367 case O_NOP:
5368 case O_PROBE_STATE:
5369 case O_KEEP_STATE:
5370 case O_PROTO:
5371 case O_IP_SRC_ME:
5372 case O_IP_DST_ME:
5373 case O_LAYER2:
5374 case O_IN:
5375 case O_FRAG:
5376 case O_IPFRAG:
5377 case O_IPOPT:
5378 case O_IPLEN:
5379 case O_IPID:
5380 case O_IPTOS:
5381 case O_IPPRECEDENCE:
5382 case O_IPTTL:
5383 case O_IPVER:
5384 case O_TCPWIN:
5385 case O_TCPFLAGS:
5386 case O_TCPOPTS:
5387 case O_ESTAB:
5388 if (cmdlen != F_INSN_SIZE(ipfw_insn))
5389 goto bad_size;
5390 break;
5391
5392 case O_IP_SRC_TABLE:
5393 case O_IP_DST_TABLE:
5394 if (cmdlen != F_INSN_SIZE(ipfw_insn))
5395 goto bad_size;
5396 if (cmd->arg1 >= ipfw_table_max) {
5397 kprintf("ipfw: invalid table id %u, max %d\n",
5398 cmd->arg1, ipfw_table_max);
5399 return EINVAL;
5400 }
5401 break;
5402
5403 case O_IP_SRC_IFIP:
5404 case O_IP_DST_IFIP:
5405 if (cmdlen != F_INSN_SIZE(ipfw_insn_ifip))
5406 goto bad_size;
5407 break;
5408
5409 case O_ICMPCODE:
5410 case O_ICMPTYPE:
5411 if (cmdlen < F_INSN_SIZE(ipfw_insn_u32))
5412 goto bad_size;
5413 break;
5414
5415 case O_UID:
5416 case O_GID:
5417 case O_IP_SRC:
5418 case O_IP_DST:
5419 case O_TCPSEQ:
5420 case O_TCPACK:
5421 case O_PROB:
5422 if (cmdlen != F_INSN_SIZE(ipfw_insn_u32))
5423 goto bad_size;
5424 break;
5425
5426 case O_LIMIT:
5427 if (cmdlen != F_INSN_SIZE(ipfw_insn_limit))
5428 goto bad_size;
5429 break;
5430 case O_REDIRECT:
5431 if (cmdlen != F_INSN_SIZE(ipfw_insn_rdr))
5432 goto bad_size;
5433 break;
5434
5435 case O_LOG:
5436 if (cmdlen != F_INSN_SIZE(ipfw_insn_log))
5437 goto bad_size;
5438
5439 ((ipfw_insn_log *)cmd)->log_left =
5440 ((ipfw_insn_log *)cmd)->max_log;
5441
5442 break;
5443
5444 case O_IP_SRC_MASK:
5445 case O_IP_DST_MASK:
5446 if (cmdlen != F_INSN_SIZE(ipfw_insn_ip))
5447 goto bad_size;
5448 if (((ipfw_insn_ip *)cmd)->mask.s_addr == 0) {
5449 kprintf("ipfw: opcode %d, useless rule\n",
5450 cmd->opcode);
5451 return EINVAL;
5452 }
5453 break;
5454
5455 case O_IP_SRC_SET:
5456 case O_IP_DST_SET:
5457 if (cmd->arg1 == 0 || cmd->arg1 > 256) {
5458 kprintf("ipfw: invalid set size %d\n",
5459 cmd->arg1);
5460 return EINVAL;
5461 }
5462 if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) +
5463 (cmd->arg1+31)/32 )
5464 goto bad_size;
5465 break;
5466
5467 case O_MACADDR2:
5468 if (cmdlen != F_INSN_SIZE(ipfw_insn_mac))
5469 goto bad_size;
5470 break;
5471
5472 case O_MAC_TYPE:
5473 case O_IP_SRCPORT:
5474 case O_IP_DSTPORT: /* XXX artificial limit, 30 port pairs */
5475 if (cmdlen < 2 || cmdlen > 31)
5476 goto bad_size;
5477 break;
5478
5479 case O_RECV:
5480 case O_XMIT:
5481 case O_VIA:
5482 if (cmdlen != F_INSN_SIZE(ipfw_insn_if))
5483 goto bad_size;
5484 break;
5485
5486 case O_PIPE:
5487 case O_QUEUE:
5488 if (cmdlen != F_INSN_SIZE(ipfw_insn_pipe))
5489 goto bad_size;
5490 goto check_action;
5491
5492 case O_FORWARD_IP:
5493 if (cmdlen != F_INSN_SIZE(ipfw_insn_sa)) {
5494 goto bad_size;
5495 } else {
5496 in_addr_t fwd_addr;
5497
5498 fwd_addr = ((ipfw_insn_sa *)cmd)->
5499 sa.sin_addr.s_addr;
5500 if (IN_MULTICAST(ntohl(fwd_addr))) {
5501 kprintf("ipfw: try forwarding to "
5502 "multicast address\n");
5503 return EINVAL;
5504 }
5505 }
5506 goto check_action;
5507
5508 case O_FORWARD_MAC: /* XXX not implemented yet */
5509 case O_CHECK_STATE:
5510 case O_COUNT:
5511 case O_ACCEPT:
5512 case O_DENY:
5513 case O_REJECT:
5514 case O_SKIPTO:
5515 case O_DIVERT:
5516 case O_TEE:
5517 case O_DEFRAG:
5518 if (cmdlen != F_INSN_SIZE(ipfw_insn))
5519 goto bad_size;
5520 check_action:
5521 if (have_action) {
5522 kprintf("ipfw: opcode %d, multiple actions"
5523 " not allowed\n",
5524 cmd->opcode);
5525 return EINVAL;
5526 }
5527 have_action = 1;
5528 if (l != cmdlen) {
5529 kprintf("ipfw: opcode %d, action must be"
5530 " last opcode\n",
5531 cmd->opcode);
5532 return EINVAL;
5533 }
5534 break;
5535 default:
5536 kprintf("ipfw: opcode %d, unknown opcode\n",
5537 cmd->opcode);
5538 return EINVAL;
5539 }
5540 }
5541 if (have_action == 0) {
5542 kprintf("ipfw: missing action\n");
5543 return EINVAL;
5544 }
5545 return 0;
5546
5547 bad_size:
5548 kprintf("ipfw: opcode %d size %d wrong\n",
5549 cmd->opcode, cmdlen);
5550 return EINVAL;
5551 }
5552
5553 static int
5554 ipfw_ctl_add_rule(struct sockopt *sopt)
5555 {
5556 struct ipfw_ioc_rule *ioc_rule;
5557 size_t size;
5558 uint32_t rule_flags;
5559 int error;
5560
5561 ASSERT_NETISR0;
5562
5563 size = sopt->sopt_valsize;
5564 if (size > (sizeof(uint32_t) * IPFW_RULE_SIZE_MAX) ||
5565 size < sizeof(*ioc_rule)) {
5566 return EINVAL;
5567 }
5568 if (size != (sizeof(uint32_t) * IPFW_RULE_SIZE_MAX)) {
5569 sopt->sopt_val = krealloc(sopt->sopt_val, sizeof(uint32_t) *
5570 IPFW_RULE_SIZE_MAX, M_TEMP, M_WAITOK);
5571 }
5572 ioc_rule = sopt->sopt_val;
5573
5574 error = ipfw_check_ioc_rule(ioc_rule, size, &rule_flags);
5575 if (error)
5576 return error;
5577
5578 ipfw_add_rule(ioc_rule, rule_flags);
5579
5580 if (sopt->sopt_dir == SOPT_GET)
5581 sopt->sopt_valsize = IOC_RULESIZE(ioc_rule);
5582 return 0;
5583 }
5584
5585 static void *
5586 ipfw_copy_rule(const struct ipfw_context *ctx, const struct ip_fw *rule,
5587 struct ipfw_ioc_rule *ioc_rule)
5588 {
5589 const struct ip_fw *sibling;
5590 #ifdef INVARIANTS
5591 int i;
5592 #endif
5593
5594 ASSERT_NETISR0;
5595 KASSERT(rule->cpuid == 0, ("rule does not belong to cpu0"));
5596
5597 ioc_rule->act_ofs = rule->act_ofs;
5598 ioc_rule->cmd_len = rule->cmd_len;
5599 ioc_rule->rulenum = rule->rulenum;
5600 ioc_rule->set = rule->set;
5601 ioc_rule->usr_flags = rule->usr_flags;
5602
5603 ioc_rule->set_disable = ctx->ipfw_set_disable;
5604 ioc_rule->static_count = static_count;
5605 ioc_rule->static_len = static_ioc_len;
5606
5607 /*
5608 * Visit (read-only) all of the rule's duplications to get
5609 * the necessary statistics
5610 */
5611 #ifdef INVARIANTS
5612 i = 0;
5613 #endif
5614 ioc_rule->pcnt = 0;
5615 ioc_rule->bcnt = 0;
5616 ioc_rule->timestamp = 0;
5617 for (sibling = rule; sibling != NULL; sibling = sibling->sibling) {
5618 ioc_rule->pcnt += sibling->pcnt;
5619 ioc_rule->bcnt += sibling->bcnt;
5620 if (sibling->timestamp > ioc_rule->timestamp)
5621 ioc_rule->timestamp = sibling->timestamp;
5622 #ifdef INVARIANTS
5623 ++i;
5624 #endif
5625 }
5626 KASSERT(i == netisr_ncpus,
5627 ("static rule is not duplicated on netisr_ncpus %d", netisr_ncpus));
5628
5629 bcopy(rule->cmd, ioc_rule->cmd, ioc_rule->cmd_len * 4 /* XXX */);
5630
5631 return ((uint8_t *)ioc_rule + IOC_RULESIZE(ioc_rule));
5632 }
5633
5634 static boolean_t
5635 ipfw_track_copy(const struct ipfw_trkcnt *trk, struct ipfw_ioc_state *ioc_state)
5636 {
5637 struct ipfw_ioc_flowid *ioc_id;
5638
5639 if (trk->tc_expire == 0) {
5640 /* Not a scanned one. */
5641 return (FALSE);
5642 }
5643
5644 ioc_state->expire = TIME_LEQ(trk->tc_expire, time_uptime) ?
5645 0 : trk->tc_expire - time_uptime;
5646 ioc_state->pcnt = 0;
5647 ioc_state->bcnt = 0;
5648
5649 ioc_state->dyn_type = O_LIMIT_PARENT;
5650 ioc_state->count = trk->tc_count;
5651
5652 ioc_state->rulenum = trk->tc_rulenum;
5653
5654 ioc_id = &ioc_state->id;
5655 ioc_id->type = ETHERTYPE_IP;
5656 ioc_id->u.ip.proto = trk->tc_proto;
5657 ioc_id->u.ip.src_ip = trk->tc_saddr;
5658 ioc_id->u.ip.dst_ip = trk->tc_daddr;
5659 ioc_id->u.ip.src_port = trk->tc_sport;
5660 ioc_id->u.ip.dst_port = trk->tc_dport;
5661
5662 return (TRUE);
5663 }
5664
5665 static boolean_t
5666 ipfw_state_copy(const struct ipfw_state *s, struct ipfw_ioc_state *ioc_state)
5667 {
5668 struct ipfw_ioc_flowid *ioc_id;
5669
5670 if (IPFW_STATE_SCANSKIP(s))
5671 return (FALSE);
5672
5673 ioc_state->expire = TIME_LEQ(s->st_expire, time_uptime) ?
5674 0 : s->st_expire - time_uptime;
5675 ioc_state->pcnt = s->st_pcnt;
5676 ioc_state->bcnt = s->st_bcnt;
5677
5678 ioc_state->dyn_type = s->st_type;
5679 ioc_state->count = 0;
5680
5681 ioc_state->rulenum = s->st_rule->rulenum;
5682
5683 ioc_id = &ioc_state->id;
5684 ioc_id->type = ETHERTYPE_IP;
5685 ioc_id->u.ip.proto = s->st_proto;
5686 ipfw_key_4tuple(&s->st_key,
5687 &ioc_id->u.ip.src_ip, &ioc_id->u.ip.src_port,
5688 &ioc_id->u.ip.dst_ip, &ioc_id->u.ip.dst_port);
5689
5690 if (IPFW_ISXLAT(s->st_type)) {
5691 const struct ipfw_xlat *x = (const struct ipfw_xlat *)s;
5692
5693 if (x->xlat_port == 0)
5694 ioc_state->xlat_port = ioc_id->u.ip.dst_port;
5695 else
5696 ioc_state->xlat_port = ntohs(x->xlat_port);
5697 ioc_state->xlat_addr = ntohl(x->xlat_addr);
5698
5699 ioc_state->pcnt += x->xlat_pair->xlat_pcnt;
5700 ioc_state->bcnt += x->xlat_pair->xlat_bcnt;
5701 }
5702
5703 return (TRUE);
5704 }
5705
5706 static void
5707 ipfw_state_copy_dispatch(netmsg_t nmsg)
5708 {
5709 struct netmsg_cpstate *nm = (struct netmsg_cpstate *)nmsg;
5710 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
5711 const struct ipfw_state *s;
5712 const struct ipfw_track *t;
5713
5714 ASSERT_NETISR_NCPUS(mycpuid);
5715 KASSERT(nm->state_cnt < nm->state_cntmax,
5716 ("invalid state count %d, max %d",
5717 nm->state_cnt, nm->state_cntmax));
5718
5719 TAILQ_FOREACH(s, &ctx->ipfw_state_list, st_link) {
5720 if (ipfw_state_copy(s, nm->ioc_state)) {
5721 nm->ioc_state++;
5722 nm->state_cnt++;
5723 if (nm->state_cnt == nm->state_cntmax)
5724 goto done;
5725 }
5726 }
5727
5728 /*
5729 * Prepare tracks in the global track tree for userland.
5730 */
5731 TAILQ_FOREACH(t, &ctx->ipfw_track_list, t_link) {
5732 struct ipfw_trkcnt *trk;
5733
5734 if (t->t_count == NULL) /* anchor */
5735 continue;
5736 trk = t->t_trkcnt;
5737
5738 /*
5739 * Only one netisr can run this function at
5740 * any time, and only this function accesses
5741 * trkcnt's tc_expire, so this is safe w/o
5742 * ipfw_gd.ipfw_trkcnt_token.
5743 */
5744 if (trk->tc_expire > t->t_expire)
5745 continue;
5746 trk->tc_expire = t->t_expire;
5747 }
5748
5749 /*
5750 * Copy tracks in the global track tree to userland in
5751 * the last netisr.
5752 */
5753 if (mycpuid == netisr_ncpus - 1) {
5754 struct ipfw_trkcnt *trk;
5755
5756 KASSERT(nm->state_cnt < nm->state_cntmax,
5757 ("invalid state count %d, max %d",
5758 nm->state_cnt, nm->state_cntmax));
5759
5760 IPFW_TRKCNT_TOKGET;
5761 RB_FOREACH(trk, ipfw_trkcnt_tree, &ipfw_gd.ipfw_trkcnt_tree) {
5762 if (ipfw_track_copy(trk, nm->ioc_state)) {
5763 nm->ioc_state++;
5764 nm->state_cnt++;
5765 if (nm->state_cnt == nm->state_cntmax) {
5766 IPFW_TRKCNT_TOKREL;
5767 goto done;
5768 }
5769 }
5770 }
5771 IPFW_TRKCNT_TOKREL;
5772 }
5773 done:
5774 if (nm->state_cnt == nm->state_cntmax) {
5775 /* No more space; done. */
5776 netisr_replymsg(&nm->base, 0);
5777 } else {
5778 netisr_forwardmsg(&nm->base, mycpuid + 1);
5779 }
5780 }
5781
5782 static int
5783 ipfw_ctl_get_rules(struct sockopt *sopt)
5784 {
5785 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
5786 struct ip_fw *rule;
5787 void *bp;
5788 size_t size;
5789 int state_cnt;
5790
5791 ASSERT_NETISR0;
5792
5793 /*
5794 * pass up a copy of the current rules. Static rules
5795 * come first (the last of which has number IPFW_DEFAULT_RULE),
5796 * followed by a possibly empty list of states.
5797 */
5798
5799 size = static_ioc_len; /* size of static rules */
5800
5801 /*
5802 * Size of the states.
5803 * XXX take tracks as state for userland compat.
5804 */
5805 state_cnt = ipfw_state_cntcoll() + ipfw_gd.ipfw_trkcnt_cnt;
5806 state_cnt = (state_cnt * 5) / 4; /* leave 25% headroom */
5807 size += state_cnt * sizeof(struct ipfw_ioc_state);
5808
5809 if (sopt->sopt_valsize < size) {
5810 /* short length, no need to return incomplete rules */
5811 /* XXX: if superuser, no need to zero buffer */
5812 bzero(sopt->sopt_val, sopt->sopt_valsize);
5813 return 0;
5814 }
5815 bp = sopt->sopt_val;
5816
5817 for (rule = ctx->ipfw_layer3_chain; rule; rule = rule->next)
5818 bp = ipfw_copy_rule(ctx, rule, bp);
5819
5820 if (state_cnt) {
5821 struct netmsg_cpstate nm;
5822 #ifdef INVARIANTS
5823 size_t old_size = size;
5824 #endif
5825
5826 netmsg_init(&nm.base, NULL, &curthread->td_msgport,
5827 MSGF_PRIORITY, ipfw_state_copy_dispatch);
5828 nm.ioc_state = bp;
5829 nm.state_cntmax = state_cnt;
5830 nm.state_cnt = 0;
5831 netisr_domsg_global(&nm.base);
5832
5833 /*
5834 * The # of states may be shrinked after the snapshot
5835 * of the state count was taken. To give user a correct
5836 * state count, nm->state_cnt is used to recalculate
5837 * the actual size.
5838 */
5839 size = static_ioc_len +
5840 (nm.state_cnt * sizeof(struct ipfw_ioc_state));
5841 KKASSERT(size <= old_size);
5842 }
5843
5844 sopt->sopt_valsize = size;
5845 return 0;
5846 }
5847
5848 static void
5849 ipfw_set_disable_dispatch(netmsg_t nmsg)
5850 {
5851 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
5852
5853 ASSERT_NETISR_NCPUS(mycpuid);
5854
5855 ctx->ipfw_set_disable = nmsg->lmsg.u.ms_result32;
5856 netisr_forwardmsg(&nmsg->base, mycpuid + 1);
5857 }
5858
5859 static void
5860 ipfw_ctl_set_disable(uint32_t disable, uint32_t enable)
5861 {
5862 struct netmsg_base nmsg;
5863 uint32_t set_disable;
5864
5865 ASSERT_NETISR0;
5866
5867 /* IPFW_DEFAULT_SET is always enabled */
5868 enable |= (1 << IPFW_DEFAULT_SET);
5869 set_disable = (ipfw_ctx[mycpuid]->ipfw_set_disable | disable) & ~enable;
5870
5871 bzero(&nmsg, sizeof(nmsg));
5872 netmsg_init(&nmsg, NULL, &curthread->td_msgport, MSGF_PRIORITY,
5873 ipfw_set_disable_dispatch);
5874 nmsg.lmsg.u.ms_result32 = set_disable;
5875
5876 netisr_domsg_global(&nmsg);
5877 }
5878
5879 static void
5880 ipfw_table_create_dispatch(netmsg_t nm)
5881 {
5882 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
5883 int tblid = nm->lmsg.u.ms_result;
5884
5885 ASSERT_NETISR_NCPUS(mycpuid);
5886
5887 if (!rn_inithead(&ctx->ipfw_tables[tblid], rn_cpumaskhead(mycpuid),
5888 offsetof(struct sockaddr_in, sin_addr)))
5889 panic("ipfw: create table%d failed", tblid);
5890
5891 netisr_forwardmsg(&nm->base, mycpuid + 1);
5892 }
5893
5894 static int
5895 ipfw_table_create(struct sockopt *sopt)
5896 {
5897 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
5898 struct ipfw_ioc_table *tbl;
5899 struct netmsg_base nm;
5900
5901 ASSERT_NETISR0;
5902
5903 if (sopt->sopt_valsize != sizeof(*tbl))
5904 return (EINVAL);
5905
5906 tbl = sopt->sopt_val;
5907 if (tbl->tableid < 0 || tbl->tableid >= ipfw_table_max)
5908 return (EINVAL);
5909
5910 if (ctx->ipfw_tables[tbl->tableid] != NULL)
5911 return (EEXIST);
5912
5913 netmsg_init(&nm, NULL, &curthread->td_msgport, MSGF_PRIORITY,
5914 ipfw_table_create_dispatch);
5915 nm.lmsg.u.ms_result = tbl->tableid;
5916 netisr_domsg_global(&nm);
5917
5918 return (0);
5919 }
5920
5921 static void
5922 ipfw_table_killent(struct radix_node *rn)
5923 {
5924 struct ipfw_tblent *te;
5925
5926 te = (struct ipfw_tblent *)rn;
5927 kfree(te, M_IPFW);
5928 }
5929
5930 static void
5931 ipfw_table_flush_oncpu(struct ipfw_context *ctx, int tableid,
5932 int destroy)
5933 {
5934 struct radix_node_head *rnh;
5935
5936 ASSERT_NETISR_NCPUS(mycpuid);
5937
5938 rnh = ctx->ipfw_tables[tableid];
5939 rn_flush(rnh, ipfw_table_killent);
5940 if (destroy) {
5941 rn_freehead(rnh);
5942 ctx->ipfw_tables[tableid] = NULL;
5943 }
5944 }
5945
5946 static void
5947 ipfw_table_flush_dispatch(netmsg_t nmsg)
5948 {
5949 struct netmsg_tblflush *nm = (struct netmsg_tblflush *)nmsg;
5950 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
5951
5952 ASSERT_NETISR_NCPUS(mycpuid);
5953
5954 ipfw_table_flush_oncpu(ctx, nm->tableid, nm->destroy);
5955 netisr_forwardmsg(&nm->base, mycpuid + 1);
5956 }
5957
5958 static void
5959 ipfw_table_flushall_oncpu(struct ipfw_context *ctx, int destroy)
5960 {
5961 int i;
5962
5963 ASSERT_NETISR_NCPUS(mycpuid);
5964
5965 for (i = 0; i < ipfw_table_max; ++i) {
5966 if (ctx->ipfw_tables[i] != NULL)
5967 ipfw_table_flush_oncpu(ctx, i, destroy);
5968 }
5969 }
5970
5971 static void
5972 ipfw_table_flushall_dispatch(netmsg_t nmsg)
5973 {
5974 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
5975
5976 ASSERT_NETISR_NCPUS(mycpuid);
5977
5978 ipfw_table_flushall_oncpu(ctx, 0);
5979 netisr_forwardmsg(&nmsg->base, mycpuid + 1);
5980 }
5981
5982 static int
5983 ipfw_table_flush(struct sockopt *sopt)
5984 {
5985 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
5986 struct ipfw_ioc_table *tbl;
5987 struct netmsg_tblflush nm;
5988
5989 ASSERT_NETISR0;
5990
5991 if (sopt->sopt_valsize != sizeof(*tbl))
5992 return (EINVAL);
5993
5994 tbl = sopt->sopt_val;
5995 if (sopt->sopt_name == IP_FW_TBL_FLUSH && tbl->tableid < 0) {
5996 netmsg_init(&nm.base, NULL, &curthread->td_msgport,
5997 MSGF_PRIORITY, ipfw_table_flushall_dispatch);
5998 netisr_domsg_global(&nm.base);
5999 return (0);
6000 }
6001
6002 if (tbl->tableid < 0 || tbl->tableid >= ipfw_table_max)
6003 return (EINVAL);
6004
6005 if (ctx->ipfw_tables[tbl->tableid] == NULL)
6006 return (ENOENT);
6007
6008 netmsg_init(&nm.base, NULL, &curthread->td_msgport, MSGF_PRIORITY,
6009 ipfw_table_flush_dispatch);
6010 nm.tableid = tbl->tableid;
6011 nm.destroy = 0;
6012 if (sopt->sopt_name == IP_FW_TBL_DESTROY)
6013 nm.destroy = 1;
6014 netisr_domsg_global(&nm.base);
6015
6016 return (0);
6017 }
6018
6019 static int
6020 ipfw_table_cntent(struct radix_node *rn __unused, void *xcnt)
6021 {
6022 int *cnt = xcnt;
6023
6024 (*cnt)++;
6025 return (0);
6026 }
6027
6028 static int
6029 ipfw_table_cpent(struct radix_node *rn, void *xcp)
6030 {
6031 struct ipfw_table_cp *cp = xcp;
6032 struct ipfw_tblent *te = (struct ipfw_tblent *)rn;
6033 struct ipfw_ioc_tblent *ioc_te;
6034 #ifdef INVARIANTS
6035 int cnt;
6036 #endif
6037
6038 KASSERT(cp->te_idx < cp->te_cnt, ("invalid table cp idx %d, cnt %d",
6039 cp->te_idx, cp->te_cnt));
6040 ioc_te = &cp->te[cp->te_idx];
6041
6042 if (te->te_nodes->rn_mask != NULL) {
6043 memcpy(&ioc_te->netmask, te->te_nodes->rn_mask,
6044 *te->te_nodes->rn_mask);
6045 } else {
6046 ioc_te->netmask.sin_len = 0;
6047 }
6048 memcpy(&ioc_te->key, &te->te_key, sizeof(ioc_te->key));
6049
6050 ioc_te->use = te->te_use;
6051 ioc_te->last_used = te->te_lastuse;
6052 #ifdef INVARIANTS
6053 cnt = 1;
6054 #endif
6055
6056 while ((te = te->te_sibling) != NULL) {
6057 #ifdef INVARIANTS
6058 ++cnt;
6059 #endif
6060 ioc_te->use += te->te_use;
6061 if (te->te_lastuse > ioc_te->last_used)
6062 ioc_te->last_used = te->te_lastuse;
6063 }
6064 KASSERT(cnt == netisr_ncpus,
6065 ("invalid # of tblent %d, should be %d", cnt, netisr_ncpus));
6066
6067 cp->te_idx++;
6068
6069 return (0);
6070 }
6071
6072 static int
6073 ipfw_table_get(struct sockopt *sopt)
6074 {
6075 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
6076 struct radix_node_head *rnh;
6077 struct ipfw_ioc_table *tbl;
6078 struct ipfw_ioc_tblcont *cont;
6079 struct ipfw_table_cp cp;
6080 int cnt = 0, sz;
6081
6082 ASSERT_NETISR0;
6083
6084 if (sopt->sopt_valsize < sizeof(*tbl))
6085 return (EINVAL);
6086
6087 tbl = sopt->sopt_val;
6088 if (tbl->tableid < 0) {
6089 struct ipfw_ioc_tbllist *list;
6090 int i;
6091
6092 /*
6093 * List available table ids.
6094 */
6095 for (i = 0; i < ipfw_table_max; ++i) {
6096 if (ctx->ipfw_tables[i] != NULL)
6097 ++cnt;
6098 }
6099
6100 sz = __offsetof(struct ipfw_ioc_tbllist, tables[cnt]);
6101 if (sopt->sopt_valsize < sz) {
6102 bzero(sopt->sopt_val, sopt->sopt_valsize);
6103 return (E2BIG);
6104 }
6105 list = sopt->sopt_val;
6106 list->tablecnt = cnt;
6107
6108 cnt = 0;
6109 for (i = 0; i < ipfw_table_max; ++i) {
6110 if (ctx->ipfw_tables[i] != NULL) {
6111 KASSERT(cnt < list->tablecnt,
6112 ("invalid idx %d, cnt %d",
6113 cnt, list->tablecnt));
6114 list->tables[cnt++] = i;
6115 }
6116 }
6117 sopt->sopt_valsize = sz;
6118 return (0);
6119 } else if (tbl->tableid >= ipfw_table_max) {
6120 return (EINVAL);
6121 }
6122
6123 rnh = ctx->ipfw_tables[tbl->tableid];
6124 if (rnh == NULL)
6125 return (ENOENT);
6126 rnh->rnh_walktree(rnh, ipfw_table_cntent, &cnt);
6127
6128 sz = __offsetof(struct ipfw_ioc_tblcont, ent[cnt]);
6129 if (sopt->sopt_valsize < sz) {
6130 bzero(sopt->sopt_val, sopt->sopt_valsize);
6131 return (E2BIG);
6132 }
6133 cont = sopt->sopt_val;
6134 cont->entcnt = cnt;
6135
6136 cp.te = cont->ent;
6137 cp.te_idx = 0;
6138 cp.te_cnt = cnt;
6139 rnh->rnh_walktree(rnh, ipfw_table_cpent, &cp);
6140
6141 sopt->sopt_valsize = sz;
6142 return (0);
6143 }
6144
6145 static void
6146 ipfw_table_add_dispatch(netmsg_t nmsg)
6147 {
6148 struct netmsg_tblent *nm = (struct netmsg_tblent *)nmsg;
6149 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
6150 struct radix_node_head *rnh;
6151 struct ipfw_tblent *te;
6152
6153 ASSERT_NETISR_NCPUS(mycpuid);
6154
6155 rnh = ctx->ipfw_tables[nm->tableid];
6156
6157 te = kmalloc(sizeof(*te), M_IPFW, M_WAITOK | M_ZERO);
6158 te->te_nodes->rn_key = (char *)&te->te_key;
6159 memcpy(&te->te_key, nm->key, sizeof(te->te_key));
6160
6161 if (rnh->rnh_addaddr(&te->te_key, nm->netmask, rnh, te->te_nodes)
6162 == NULL) {
6163 if (mycpuid == 0) {
6164 kfree(te, M_IPFW);
6165 netisr_replymsg(&nm->base, EEXIST);
6166 return;
6167 }
6168 panic("rnh_addaddr failed");
6169 }
6170
6171 /* Link siblings. */
6172 if (nm->sibling != NULL)
6173 nm->sibling->te_sibling = te;
6174 nm->sibling = te;
6175
6176 netisr_forwardmsg(&nm->base, mycpuid + 1);
6177 }
6178
6179 static void
6180 ipfw_table_del_dispatch(netmsg_t nmsg)
6181 {
6182 struct netmsg_tblent *nm = (struct netmsg_tblent *)nmsg;
6183 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
6184 struct radix_node_head *rnh;
6185 struct radix_node *rn;
6186
6187 ASSERT_NETISR_NCPUS(mycpuid);
6188
6189 rnh = ctx->ipfw_tables[nm->tableid];
6190 rn = rnh->rnh_deladdr(nm->key, nm->netmask, rnh);
6191 if (rn == NULL) {
6192 if (mycpuid == 0) {
6193 netisr_replymsg(&nm->base, ESRCH);
6194 return;
6195 }
6196 panic("rnh_deladdr failed");
6197 }
6198 kfree(rn, M_IPFW);
6199
6200 netisr_forwardmsg(&nm->base, mycpuid + 1);
6201 }
6202
6203 static int
6204 ipfw_table_alt(struct sockopt *sopt)
6205 {
6206 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
6207 struct ipfw_ioc_tblcont *tbl;
6208 struct ipfw_ioc_tblent *te;
6209 struct sockaddr_in key0;
6210 struct sockaddr *netmask = NULL, *key;
6211 struct netmsg_tblent nm;
6212
6213 ASSERT_NETISR0;
6214
6215 if (sopt->sopt_valsize != sizeof(*tbl))
6216 return (EINVAL);
6217 tbl = sopt->sopt_val;
6218
6219 if (tbl->tableid < 0 || tbl->tableid >= ipfw_table_max)
6220 return (EINVAL);
6221 if (tbl->entcnt != 1)
6222 return (EINVAL);
6223
6224 if (ctx->ipfw_tables[tbl->tableid] == NULL)
6225 return (ENOENT);
6226 te = &tbl->ent[0];
6227
6228 if (te->key.sin_family != AF_INET ||
6229 te->key.sin_port != 0 ||
6230 te->key.sin_len != sizeof(struct sockaddr_in))
6231 return (EINVAL);
6232 key = (struct sockaddr *)&te->key;
6233
6234 if (te->netmask.sin_len != 0) {
6235 if (te->netmask.sin_port != 0 ||
6236 te->netmask.sin_len > sizeof(struct sockaddr_in))
6237 return (EINVAL);
6238 netmask = (struct sockaddr *)&te->netmask;
6239 sa_maskedcopy(key, (struct sockaddr *)&key0, netmask);
6240 key = (struct sockaddr *)&key0;
6241 }
6242
6243 if (sopt->sopt_name == IP_FW_TBL_ADD) {
6244 netmsg_init(&nm.base, NULL, &curthread->td_msgport,
6245 MSGF_PRIORITY, ipfw_table_add_dispatch);
6246 } else {
6247 netmsg_init(&nm.base, NULL, &curthread->td_msgport,
6248 MSGF_PRIORITY, ipfw_table_del_dispatch);
6249 }
6250 nm.key = key;
6251 nm.netmask = netmask;
6252 nm.tableid = tbl->tableid;
6253 nm.sibling = NULL;
6254 return (netisr_domsg_global(&nm.base));
6255 }
6256
6257 static int
6258 ipfw_table_zeroent(struct radix_node *rn, void *arg __unused)
6259 {
6260 struct ipfw_tblent *te = (struct ipfw_tblent *)rn;
6261
6262 te->te_use = 0;
6263 te->te_lastuse = 0;
6264 return (0);
6265 }
6266
6267 static void
6268 ipfw_table_zero_dispatch(netmsg_t nmsg)
6269 {
6270 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
6271 struct radix_node_head *rnh;
6272
6273 ASSERT_NETISR_NCPUS(mycpuid);
6274
6275 rnh = ctx->ipfw_tables[nmsg->lmsg.u.ms_result];
6276 rnh->rnh_walktree(rnh, ipfw_table_zeroent, NULL);
6277
6278 netisr_forwardmsg(&nmsg->base, mycpuid + 1);
6279 }
6280
6281 static void
6282 ipfw_table_zeroall_dispatch(netmsg_t nmsg)
6283 {
6284 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
6285 int i;
6286
6287 ASSERT_NETISR_NCPUS(mycpuid);
6288
6289 for (i = 0; i < ipfw_table_max; ++i) {
6290 struct radix_node_head *rnh = ctx->ipfw_tables[i];
6291
6292 if (rnh != NULL)
6293 rnh->rnh_walktree(rnh, ipfw_table_zeroent, NULL);
6294 }
6295 netisr_forwardmsg(&nmsg->base, mycpuid + 1);
6296 }
6297
6298 static int
6299 ipfw_table_zero(struct sockopt *sopt)
6300 {
6301 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
6302 struct netmsg_base nm;
6303 struct ipfw_ioc_table *tbl;
6304
6305 ASSERT_NETISR0;
6306
6307 if (sopt->sopt_valsize != sizeof(*tbl))
6308 return (EINVAL);
6309 tbl = sopt->sopt_val;
6310
6311 if (tbl->tableid < 0) {
6312 netmsg_init(&nm, NULL, &curthread->td_msgport, MSGF_PRIORITY,
6313 ipfw_table_zeroall_dispatch);
6314 netisr_domsg_global(&nm);
6315 return (0);
6316 } else if (tbl->tableid >= ipfw_table_max) {
6317 return (EINVAL);
6318 } else if (ctx->ipfw_tables[tbl->tableid] == NULL) {
6319 return (ENOENT);
6320 }
6321
6322 netmsg_init(&nm, NULL, &curthread->td_msgport, MSGF_PRIORITY,
6323 ipfw_table_zero_dispatch);
6324 nm.lmsg.u.ms_result = tbl->tableid;
6325 netisr_domsg_global(&nm);
6326
6327 return (0);
6328 }
6329
6330 static int
6331 ipfw_table_killexp(struct radix_node *rn, void *xnm)
6332 {
6333 struct netmsg_tblexp *nm = xnm;
6334 struct ipfw_tblent *te = (struct ipfw_tblent *)rn;
6335 struct radix_node *ret;
6336
6337 if (te->te_expired) {
6338 ret = nm->rnh->rnh_deladdr(rn->rn_key, rn->rn_mask, nm->rnh);
6339 if (ret != rn)
6340 panic("deleted other table entry");
6341 kfree(ret, M_IPFW);
6342 nm->expcnt++;
6343 }
6344 return (0);
6345 }
6346
6347 static void
6348 ipfw_table_expire_dispatch(netmsg_t nmsg)
6349 {
6350 struct netmsg_tblexp *nm = (struct netmsg_tblexp *)nmsg;
6351 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
6352 struct radix_node_head *rnh;
6353
6354 ASSERT_NETISR_NCPUS(mycpuid);
6355
6356 rnh = ctx->ipfw_tables[nm->tableid];
6357 nm->rnh = rnh;
6358 rnh->rnh_walktree(rnh, ipfw_table_killexp, nm);
6359
6360 KASSERT(nm->expcnt == nm->cnt * (mycpuid + 1),
6361 ("not all expired addresses (%d) were deleted (%d)",
6362 nm->cnt * (mycpuid + 1), nm->expcnt));
6363
6364 netisr_forwardmsg(&nm->base, mycpuid + 1);
6365 }
6366
6367 static void
6368 ipfw_table_expireall_dispatch(netmsg_t nmsg)
6369 {
6370 struct netmsg_tblexp *nm = (struct netmsg_tblexp *)nmsg;
6371 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
6372 int i;
6373
6374 ASSERT_NETISR_NCPUS(mycpuid);
6375
6376 for (i = 0; i < ipfw_table_max; ++i) {
6377 struct radix_node_head *rnh = ctx->ipfw_tables[i];
6378
6379 if (rnh == NULL)
6380 continue;
6381 nm->rnh = rnh;
6382 rnh->rnh_walktree(rnh, ipfw_table_killexp, nm);
6383 }
6384
6385 KASSERT(nm->expcnt == nm->cnt * (mycpuid + 1),
6386 ("not all expired addresses (%d) were deleted (%d)",
6387 nm->cnt * (mycpuid + 1), nm->expcnt));
6388
6389 netisr_forwardmsg(&nm->base, mycpuid + 1);
6390 }
6391
6392 static int
6393 ipfw_table_markexp(struct radix_node *rn, void *xnm)
6394 {
6395 struct netmsg_tblexp *nm = xnm;
6396 struct ipfw_tblent *te;
6397 time_t lastuse;
6398
6399 te = (struct ipfw_tblent *)rn;
6400 lastuse = te->te_lastuse;
6401
6402 while ((te = te->te_sibling) != NULL) {
6403 if (te->te_lastuse > lastuse)
6404 lastuse = te->te_lastuse;
6405 }
6406 if (!TIME_LEQ(lastuse + nm->expire, time_second)) {
6407 /* Not expired */
6408 return (0);
6409 }
6410
6411 te = (struct ipfw_tblent *)rn;
6412 te->te_expired = 1;
6413 while ((te = te->te_sibling) != NULL)
6414 te->te_expired = 1;
6415 nm->cnt++;
6416
6417 return (0);
6418 }
6419
6420 static int
6421 ipfw_table_expire(struct sockopt *sopt)
6422 {
6423 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
6424 struct netmsg_tblexp nm;
6425 struct ipfw_ioc_tblexp *tbl;
6426 struct radix_node_head *rnh;
6427
6428 ASSERT_NETISR0;
6429
6430 if (sopt->sopt_valsize != sizeof(*tbl))
6431 return (EINVAL);
6432 tbl = sopt->sopt_val;
6433 tbl->expcnt = 0;
6434
6435 nm.expcnt = 0;
6436 nm.cnt = 0;
6437 nm.expire = tbl->expire;
6438
6439 if (tbl->tableid < 0) {
6440 int i;
6441
6442 for (i = 0; i < ipfw_table_max; ++i) {
6443 rnh = ctx->ipfw_tables[i];
6444 if (rnh == NULL)
6445 continue;
6446 rnh->rnh_walktree(rnh, ipfw_table_markexp, &nm);
6447 }
6448 if (nm.cnt == 0) {
6449 /* No addresses can be expired. */
6450 return (0);
6451 }
6452 tbl->expcnt = nm.cnt;
6453
6454 netmsg_init(&nm.base, NULL, &curthread->td_msgport,
6455 MSGF_PRIORITY, ipfw_table_expireall_dispatch);
6456 nm.tableid = -1;
6457 netisr_domsg_global(&nm.base);
6458 KASSERT(nm.expcnt == nm.cnt * netisr_ncpus,
6459 ("not all expired addresses (%d) were deleted (%d)",
6460 nm.cnt * netisr_ncpus, nm.expcnt));
6461
6462 return (0);
6463 } else if (tbl->tableid >= ipfw_table_max) {
6464 return (EINVAL);
6465 }
6466
6467 rnh = ctx->ipfw_tables[tbl->tableid];
6468 if (rnh == NULL)
6469 return (ENOENT);
6470 rnh->rnh_walktree(rnh, ipfw_table_markexp, &nm);
6471 if (nm.cnt == 0) {
6472 /* No addresses can be expired. */
6473 return (0);
6474 }
6475 tbl->expcnt = nm.cnt;
6476
6477 netmsg_init(&nm.base, NULL, &curthread->td_msgport, MSGF_PRIORITY,
6478 ipfw_table_expire_dispatch);
6479 nm.tableid = tbl->tableid;
6480 netisr_domsg_global(&nm.base);
6481 KASSERT(nm.expcnt == nm.cnt * netisr_ncpus,
6482 ("not all expired addresses (%d) were deleted (%d)",
6483 nm.cnt * netisr_ncpus, nm.expcnt));
6484 return (0);
6485 }
6486
6487 static void
6488 ipfw_crossref_free_dispatch(netmsg_t nmsg)
6489 {
6490 struct ip_fw *rule = nmsg->lmsg.u.ms_resultp;
6491
6492 KKASSERT((rule->rule_flags &
6493 (IPFW_RULE_F_CROSSREF | IPFW_RULE_F_INVALID)) ==
6494 (IPFW_RULE_F_CROSSREF | IPFW_RULE_F_INVALID));
6495 ipfw_free_rule(rule);
6496
6497 netisr_replymsg(&nmsg->base, 0);
6498 }
6499
6500 static void
6501 ipfw_crossref_reap(void)
6502 {
6503 struct ip_fw *rule, *prev = NULL;
6504
6505 ASSERT_NETISR0;
6506
6507 rule = ipfw_gd.ipfw_crossref_free;
6508 while (rule != NULL) {
6509 uint64_t inflight = 0;
6510 int i;
6511
6512 for (i = 0; i < netisr_ncpus; ++i)
6513 inflight += rule->cross_rules[i]->cross_refs;
6514 if (inflight == 0) {
6515 struct ip_fw *f = rule;
6516
6517 /*
6518 * Unlink.
6519 */
6520 rule = rule->next;
6521 if (prev != NULL)
6522 prev->next = rule;
6523 else
6524 ipfw_gd.ipfw_crossref_free = rule;
6525
6526 /*
6527 * Free.
6528 */
6529 for (i = 1; i < netisr_ncpus; ++i) {
6530 struct netmsg_base nm;
6531
6532 netmsg_init(&nm, NULL, &curthread->td_msgport,
6533 MSGF_PRIORITY, ipfw_crossref_free_dispatch);
6534 nm.lmsg.u.ms_resultp = f->cross_rules[i];
6535 netisr_domsg(&nm, i);
6536 }
6537 KKASSERT((f->rule_flags &
6538 (IPFW_RULE_F_CROSSREF | IPFW_RULE_F_INVALID)) ==
6539 (IPFW_RULE_F_CROSSREF | IPFW_RULE_F_INVALID));
6540 ipfw_unref_rule(f);
6541 } else {
6542 prev = rule;
6543 rule = rule->next;
6544 }
6545 }
6546
6547 if (ipfw_gd.ipfw_crossref_free != NULL) {
6548 callout_reset(&ipfw_gd.ipfw_crossref_ch, hz,
6549 ipfw_crossref_timeo, NULL);
6550 }
6551 }
6552
6553 /*
6554 * {set|get}sockopt parser.
6555 */
6556 static int
6557 ipfw_ctl(struct sockopt *sopt)
6558 {
6559 int error, rulenum;
6560 uint32_t *masks;
6561 size_t size;
6562
6563 ASSERT_NETISR0;
6564
6565 error = 0;
6566
6567 switch (sopt->sopt_name) {
6568 case IP_FW_GET:
6569 error = ipfw_ctl_get_rules(sopt);
6570 break;
6571
6572 case IP_FW_FLUSH:
6573 ipfw_flush(0 /* keep default rule */);
6574 break;
6575
6576 case IP_FW_ADD:
6577 error = ipfw_ctl_add_rule(sopt);
6578 break;
6579
6580 case IP_FW_DEL:
6581 /*
6582 * IP_FW_DEL is used for deleting single rules or sets,
6583 * and (ab)used to atomically manipulate sets.
6584 * Argument size is used to distinguish between the two:
6585 * sizeof(uint32_t)
6586 * delete single rule or set of rules,
6587 * or reassign rules (or sets) to a different set.
6588 * 2 * sizeof(uint32_t)
6589 * atomic disable/enable sets.
6590 * first uint32_t contains sets to be disabled,
6591 * second uint32_t contains sets to be enabled.
6592 */
6593 masks = sopt->sopt_val;
6594 size = sopt->sopt_valsize;
6595 if (size == sizeof(*masks)) {
6596 /*
6597 * Delete or reassign static rule
6598 */
6599 error = ipfw_ctl_alter(masks[0]);
6600 } else if (size == (2 * sizeof(*masks))) {
6601 /*
6602 * Set enable/disable
6603 */
6604 ipfw_ctl_set_disable(masks[0], masks[1]);
6605 } else {
6606 error = EINVAL;
6607 }
6608 break;
6609
6610 case IP_FW_ZERO:
6611 case IP_FW_RESETLOG: /* argument is an int, the rule number */
6612 rulenum = 0;
6613
6614 if (sopt->sopt_val != 0) {
6615 error = soopt_to_kbuf(sopt, &rulenum,
6616 sizeof(int), sizeof(int));
6617 if (error)
6618 break;
6619 }
6620 error = ipfw_ctl_zero_entry(rulenum,
6621 sopt->sopt_name == IP_FW_RESETLOG);
6622 break;
6623
6624 case IP_FW_TBL_CREATE:
6625 error = ipfw_table_create(sopt);
6626 break;
6627
6628 case IP_FW_TBL_ADD:
6629 case IP_FW_TBL_DEL:
6630 error = ipfw_table_alt(sopt);
6631 break;
6632
6633 case IP_FW_TBL_FLUSH:
6634 case IP_FW_TBL_DESTROY:
6635 error = ipfw_table_flush(sopt);
6636 break;
6637
6638 case IP_FW_TBL_GET:
6639 error = ipfw_table_get(sopt);
6640 break;
6641
6642 case IP_FW_TBL_ZERO:
6643 error = ipfw_table_zero(sopt);
6644 break;
6645
6646 case IP_FW_TBL_EXPIRE:
6647 error = ipfw_table_expire(sopt);
6648 break;
6649
6650 default:
6651 kprintf("ipfw_ctl invalid option %d\n", sopt->sopt_name);
6652 error = EINVAL;
6653 }
6654
6655 ipfw_crossref_reap();
6656 return error;
6657 }
6658
6659 static void
6660 ipfw_keepalive_done(struct ipfw_context *ctx)
6661 {
6662
6663 KASSERT(ctx->ipfw_flags & IPFW_FLAG_KEEPALIVE,
6664 ("keepalive is not in progress"));
6665 ctx->ipfw_flags &= ~IPFW_FLAG_KEEPALIVE;
6666 callout_reset(&ctx->ipfw_keepalive_ch, dyn_keepalive_period * hz,
6667 ipfw_keepalive, NULL);
6668 }
6669
6670 static void
6671 ipfw_keepalive_more(struct ipfw_context *ctx)
6672 {
6673 struct netmsg_base *nm = &ctx->ipfw_keepalive_more;
6674
6675 KASSERT(ctx->ipfw_flags & IPFW_FLAG_KEEPALIVE,
6676 ("keepalive is not in progress"));
6677 KASSERT(nm->lmsg.ms_flags & MSGF_DONE,
6678 ("keepalive more did not finish"));
6679 netisr_sendmsg_oncpu(nm);
6680 }
6681
6682 static void
6683 ipfw_keepalive_loop(struct ipfw_context *ctx, struct ipfw_state *anchor)
6684 {
6685 struct ipfw_state *s;
6686 int scanned = 0, expired = 0, kept = 0;
6687
6688 KASSERT(ctx->ipfw_flags & IPFW_FLAG_KEEPALIVE,
6689 ("keepalive is not in progress"));
6690
6691 while ((s = TAILQ_NEXT(anchor, st_link)) != NULL) {
6692 uint32_t ack_rev, ack_fwd;
6693 struct ipfw_flow_id id;
6694 uint8_t send_dir;
6695
6696 if (scanned++ >= ipfw_state_scan_max) {
6697 ipfw_keepalive_more(ctx);
6698 return;
6699 }
6700
6701 TAILQ_REMOVE(&ctx->ipfw_state_list, anchor, st_link);
6702 TAILQ_INSERT_AFTER(&ctx->ipfw_state_list, s, anchor, st_link);
6703
6704 /*
6705 * NOTE:
6706 * Don't use IPFW_STATE_SCANSKIP; need to perform keepalive
6707 * on slave xlat.
6708 */
6709 if (s->st_type == O_ANCHOR)
6710 continue;
6711
6712 if (IPFW_STATE_ISDEAD(s)) {
6713 ipfw_state_remove(ctx, s);
6714 if (++expired >= ipfw_state_expire_max) {
6715 ipfw_keepalive_more(ctx);
6716 return;
6717 }
6718 continue;
6719 }
6720
6721 /*
6722 * Keep alive processing
6723 */
6724
6725 if (s->st_proto != IPPROTO_TCP)
6726 continue;
6727 if ((s->st_state & IPFW_STATE_TCPSTATES) != BOTH_SYN)
6728 continue;
6729 if (TIME_LEQ(time_uptime + dyn_keepalive_interval,
6730 s->st_expire))
6731 continue; /* too early */
6732
6733 ipfw_key_4tuple(&s->st_key, &id.src_ip, &id.src_port,
6734 &id.dst_ip, &id.dst_port);
6735 ack_rev = s->st_ack_rev;
6736 ack_fwd = s->st_ack_fwd;
6737
6738 #define SEND_FWD 0x1
6739 #define SEND_REV 0x2
6740
6741 if (IPFW_ISXLAT(s->st_type)) {
6742 const struct ipfw_xlat *x = (const struct ipfw_xlat *)s;
6743
6744 if (x->xlat_dir == MATCH_FORWARD)
6745 send_dir = SEND_FWD;
6746 else
6747 send_dir = SEND_REV;
6748 } else {
6749 send_dir = SEND_FWD | SEND_REV;
6750 }
6751
6752 if (send_dir & SEND_REV)
6753 send_pkt(&id, ack_rev - 1, ack_fwd, TH_SYN);
6754 if (send_dir & SEND_FWD)
6755 send_pkt(&id, ack_fwd - 1, ack_rev, 0);
6756
6757 #undef SEND_FWD
6758 #undef SEND_REV
6759
6760 if (++kept >= ipfw_keepalive_max) {
6761 ipfw_keepalive_more(ctx);
6762 return;
6763 }
6764 }
6765 TAILQ_REMOVE(&ctx->ipfw_state_list, anchor, st_link);
6766 ipfw_keepalive_done(ctx);
6767 }
6768
6769 static void
6770 ipfw_keepalive_more_dispatch(netmsg_t nm)
6771 {
6772 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
6773 struct ipfw_state *anchor;
6774
6775 ASSERT_NETISR_NCPUS(mycpuid);
6776 KASSERT(ctx->ipfw_flags & IPFW_FLAG_KEEPALIVE,
6777 ("keepalive is not in progress"));
6778
6779 /* Reply ASAP */
6780 netisr_replymsg(&nm->base, 0);
6781
6782 anchor = &ctx->ipfw_keepalive_anch;
6783 if (!dyn_keepalive || ctx->ipfw_state_cnt == 0) {
6784 TAILQ_REMOVE(&ctx->ipfw_state_list, anchor, st_link);
6785 ipfw_keepalive_done(ctx);
6786 return;
6787 }
6788 ipfw_keepalive_loop(ctx, anchor);
6789 }
6790
6791 /*
6792 * This procedure is only used to handle keepalives. It is invoked
6793 * every dyn_keepalive_period
6794 */
6795 static void
6796 ipfw_keepalive_dispatch(netmsg_t nm)
6797 {
6798 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
6799 struct ipfw_state *anchor;
6800
6801 ASSERT_NETISR_NCPUS(mycpuid);
6802 KASSERT((ctx->ipfw_flags & IPFW_FLAG_KEEPALIVE) == 0,
6803 ("keepalive is in progress"));
6804 ctx->ipfw_flags |= IPFW_FLAG_KEEPALIVE;
6805
6806 /* Reply ASAP */
6807 crit_enter();
6808 netisr_replymsg(&nm->base, 0);
6809 crit_exit();
6810
6811 if (!dyn_keepalive || ctx->ipfw_state_cnt == 0) {
6812 ipfw_keepalive_done(ctx);
6813 return;
6814 }
6815
6816 anchor = &ctx->ipfw_keepalive_anch;
6817 TAILQ_INSERT_HEAD(&ctx->ipfw_state_list, anchor, st_link);
6818 ipfw_keepalive_loop(ctx, anchor);
6819 }
6820
6821 /*
6822 * This procedure is only used to handle keepalives. It is invoked
6823 * every dyn_keepalive_period
6824 */
6825 static void
6826 ipfw_keepalive(void *dummy __unused)
6827 {
6828 struct netmsg_base *msg;
6829
6830 KKASSERT(mycpuid < netisr_ncpus);
6831 msg = &ipfw_ctx[mycpuid]->ipfw_keepalive_nm;
6832
6833 crit_enter();
6834 if (msg->lmsg.ms_flags & MSGF_DONE)
6835 netisr_sendmsg_oncpu(msg);
6836 crit_exit();
6837 }
6838
6839 static void
6840 ipfw_ip_input_dispatch(netmsg_t nmsg)
6841 {
6842 struct netmsg_genpkt *nm = (struct netmsg_genpkt *)nmsg;
6843 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
6844 struct mbuf *m = nm->m;
6845 struct ip_fw *rule = nm->arg1;
6846
6847 ASSERT_NETISR_NCPUS(mycpuid);
6848 KASSERT(rule->cpuid == mycpuid,
6849 ("rule does not belong to cpu%d", mycpuid));
6850 KASSERT(m->m_pkthdr.fw_flags & IPFW_MBUF_CONTINUE,
6851 ("mbuf does not have ipfw continue rule"));
6852
6853 KASSERT(ctx->ipfw_cont_rule == NULL,
6854 ("pending ipfw continue rule"));
6855 ctx->ipfw_cont_rule = rule;
6856 ip_input(m);
6857
6858 /* May not be cleared, if ipfw was unload/disabled. */
6859 ctx->ipfw_cont_rule = NULL;
6860
6861 /*
6862 * This rule is no longer used; decrement its cross_refs,
6863 * so this rule can be deleted.
6864 */
6865 rule->cross_refs--;
6866 }
6867
6868 static void
6869 ipfw_defrag_redispatch(struct mbuf *m, int cpuid, struct ip_fw *rule)
6870 {
6871 struct netmsg_genpkt *nm;
6872
6873 KASSERT(cpuid != mycpuid, ("continue on the same cpu%d", cpuid));
6874
6875 /*
6876 * NOTE:
6877 * Bump cross_refs to prevent this rule and its siblings
6878 * from being deleted, while this mbuf is inflight. The
6879 * cross_refs of the sibling rule on the target cpu will
6880 * be decremented, once this mbuf is going to be filtered
6881 * on the target cpu.
6882 */
6883 rule->cross_refs++;
6884 m->m_pkthdr.fw_flags |= IPFW_MBUF_CONTINUE;
6885
6886 nm = &m->m_hdr.mh_genmsg;
6887 netmsg_init(&nm->base, NULL, &netisr_apanic_rport, 0,
6888 ipfw_ip_input_dispatch);
6889 nm->m = m;
6890 nm->arg1 = rule->cross_rules[cpuid];
6891 netisr_sendmsg(&nm->base, cpuid);
6892 }
6893
6894 static void
6895 ipfw_init_args(struct ip_fw_args *args, struct mbuf *m, struct ifnet *oif)
6896 {
6897
6898 args->flags = 0;
6899 args->rule = NULL;
6900 args->xlat = NULL;
6901
6902 if (m->m_pkthdr.fw_flags & DUMMYNET_MBUF_TAGGED) {
6903 struct m_tag *mtag;
6904
6905 /* Extract info from dummynet tag */
6906 mtag = m_tag_find(m, PACKET_TAG_DUMMYNET, NULL);
6907 KKASSERT(mtag != NULL);
6908 args->rule = ((struct dn_pkt *)m_tag_data(mtag))->dn_priv;
6909 KKASSERT(args->rule != NULL);
6910
6911 m_tag_delete(m, mtag);
6912 m->m_pkthdr.fw_flags &= ~DUMMYNET_MBUF_TAGGED;
6913 } else if (m->m_pkthdr.fw_flags & IPFW_MBUF_CONTINUE) {
6914 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
6915
6916 KKASSERT(ctx->ipfw_cont_rule != NULL);
6917 args->rule = ctx->ipfw_cont_rule;
6918 ctx->ipfw_cont_rule = NULL;
6919
6920 if (ctx->ipfw_cont_xlat != NULL) {
6921 args->xlat = ctx->ipfw_cont_xlat;
6922 ctx->ipfw_cont_xlat = NULL;
6923 if (m->m_pkthdr.fw_flags & IPFW_MBUF_XLATINS) {
6924 args->flags |= IP_FWARG_F_XLATINS;
6925 m->m_pkthdr.fw_flags &= ~IPFW_MBUF_XLATINS;
6926 }
6927 if (m->m_pkthdr.fw_flags & IPFW_MBUF_XLATFWD) {
6928 args->flags |= IP_FWARG_F_XLATFWD;
6929 m->m_pkthdr.fw_flags &= ~IPFW_MBUF_XLATFWD;
6930 }
6931 }
6932 KKASSERT((m->m_pkthdr.fw_flags &
6933 (IPFW_MBUF_XLATINS | IPFW_MBUF_XLATFWD)) == 0);
6934
6935 args->flags |= IP_FWARG_F_CONT;
6936 m->m_pkthdr.fw_flags &= ~IPFW_MBUF_CONTINUE;
6937 }
6938
6939 args->eh = NULL;
6940 args->oif = oif;
6941 args->m = m;
6942 }
6943
6944 static int
6945 ipfw_check_in(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir)
6946 {
6947 struct ip_fw_args args;
6948 struct mbuf *m = *m0;
6949 int tee = 0, error = 0, ret;
6950
6951 ipfw_init_args(&args, m, NULL);
6952
6953 ret = ipfw_chk(&args);
6954 m = args.m;
6955 if (m == NULL) {
6956 if (ret != IP_FW_REDISPATCH)
6957 error = EACCES;
6958 goto back;
6959 }
6960
6961 switch (ret) {
6962 case IP_FW_PASS:
6963 break;
6964
6965 case IP_FW_DENY:
6966 m_freem(m);
6967 m = NULL;
6968 error = EACCES;
6969 break;
6970
6971 case IP_FW_DUMMYNET:
6972 /* Send packet to the appropriate pipe */
6973 m = ipfw_dummynet_io(m, args.cookie, DN_TO_IP_IN, &args);
6974 break;
6975
6976 case IP_FW_TEE:
6977 tee = 1;
6978 /* FALL THROUGH */
6979
6980 case IP_FW_DIVERT:
6981 /*
6982 * Must clear bridge tag when changing
6983 */
6984 m->m_pkthdr.fw_flags &= ~BRIDGE_MBUF_TAGGED;
6985 if (ip_divert_p != NULL) {
6986 m = ip_divert_p(m, tee, 1);
6987 } else {
6988 m_freem(m);
6989 m = NULL;
6990 /* not sure this is the right error msg */
6991 error = EACCES;
6992 }
6993 break;
6994
6995 default:
6996 panic("unknown ipfw return value: %d", ret);
6997 }
6998 back:
6999 *m0 = m;
7000 return error;
7001 }
7002
7003 static int
7004 ipfw_check_out(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir)
7005 {
7006 struct ip_fw_args args;
7007 struct mbuf *m = *m0;
7008 int tee = 0, error = 0, ret;
7009
7010 ipfw_init_args(&args, m, ifp);
7011
7012 ret = ipfw_chk(&args);
7013 m = args.m;
7014 if (m == NULL) {
7015 if (ret != IP_FW_REDISPATCH)
7016 error = EACCES;
7017 goto back;
7018 }
7019
7020 switch (ret) {
7021 case IP_FW_PASS:
7022 break;
7023
7024 case IP_FW_DENY:
7025 m_freem(m);
7026 m = NULL;
7027 error = EACCES;
7028 break;
7029
7030 case IP_FW_DUMMYNET:
7031 m = ipfw_dummynet_io(m, args.cookie, DN_TO_IP_OUT, &args);
7032 break;
7033
7034 case IP_FW_TEE:
7035 tee = 1;
7036 /* FALL THROUGH */
7037
7038 case IP_FW_DIVERT:
7039 if (ip_divert_p != NULL) {
7040 m = ip_divert_p(m, tee, 0);
7041 } else {
7042 m_freem(m);
7043 m = NULL;
7044 /* not sure this is the right error msg */
7045 error = EACCES;
7046 }
7047 break;
7048
7049 default:
7050 panic("unknown ipfw return value: %d", ret);
7051 }
7052 back:
7053 *m0 = m;
7054 return error;
7055 }
7056
7057 static void
7058 ipfw_hook(void)
7059 {
7060 struct pfil_head *pfh;
7061
7062 ASSERT_NETISR0;
7063
7064 pfh = pfil_head_get(PFIL_TYPE_AF, AF_INET);
7065 if (pfh == NULL)
7066 return;
7067
7068 pfil_add_hook(ipfw_check_in, NULL, PFIL_IN, pfh);
7069 pfil_add_hook(ipfw_check_out, NULL, PFIL_OUT, pfh);
7070 }
7071
7072 static void
7073 ipfw_dehook(void)
7074 {
7075 struct pfil_head *pfh;
7076
7077 ASSERT_NETISR0;
7078
7079 pfh = pfil_head_get(PFIL_TYPE_AF, AF_INET);
7080 if (pfh == NULL)
7081 return;
7082
7083 pfil_remove_hook(ipfw_check_in, NULL, PFIL_IN, pfh);
7084 pfil_remove_hook(ipfw_check_out, NULL, PFIL_OUT, pfh);
7085 }
7086
7087 static int
7088 ipfw_sysctl_dyncnt(SYSCTL_HANDLER_ARGS)
7089 {
7090 int dyn_cnt;
7091
7092 dyn_cnt = ipfw_state_cntcoll();
7093 dyn_cnt += ipfw_gd.ipfw_trkcnt_cnt;
7094
7095 return (sysctl_handle_int(oidp, &dyn_cnt, 0, req));
7096 }
7097
7098 static int
7099 ipfw_sysctl_statecnt(SYSCTL_HANDLER_ARGS)
7100 {
7101 int state_cnt;
7102
7103 state_cnt = ipfw_state_cntcoll();
7104 return (sysctl_handle_int(oidp, &state_cnt, 0, req));
7105 }
7106
7107 static int
7108 ipfw_sysctl_statemax(SYSCTL_HANDLER_ARGS)
7109 {
7110 int state_max, error;
7111
7112 state_max = ipfw_state_max;
7113 error = sysctl_handle_int(oidp, &state_max, 0, req);
7114 if (error || req->newptr == NULL)
7115 return (error);
7116
7117 if (state_max < 1)
7118 return (EINVAL);
7119
7120 ipfw_state_max_set(state_max);
7121 return (0);
7122 }
7123
7124 static int
7125 ipfw_sysctl_dynmax(SYSCTL_HANDLER_ARGS)
7126 {
7127 int dyn_max, error;
7128
7129 dyn_max = ipfw_state_max + ipfw_track_max;
7130
7131 error = sysctl_handle_int(oidp, &dyn_max, 0, req);
7132 if (error || req->newptr == NULL)
7133 return (error);
7134
7135 if (dyn_max < 2)
7136 return (EINVAL);
7137
7138 ipfw_state_max_set(dyn_max / 2);
7139 ipfw_track_max = dyn_max / 2;
7140 return (0);
7141 }
7142
7143 static void
7144 ipfw_sysctl_enable_dispatch(netmsg_t nmsg)
7145 {
7146 int enable = nmsg->lmsg.u.ms_result;
7147
7148 ASSERT_NETISR0;
7149
7150 if (fw_enable == enable)
7151 goto reply;
7152
7153 fw_enable = enable;
7154 if (fw_enable)
7155 ipfw_hook();
7156 else
7157 ipfw_dehook();
7158 reply:
7159 netisr_replymsg(&nmsg->base, 0);
7160 }
7161
7162 static int
7163 ipfw_sysctl_enable(SYSCTL_HANDLER_ARGS)
7164 {
7165 struct netmsg_base nmsg;
7166 int enable, error;
7167
7168 enable = fw_enable;
7169 error = sysctl_handle_int(oidp, &enable, 0, req);
7170 if (error || req->newptr == NULL)
7171 return error;
7172
7173 netmsg_init(&nmsg, NULL, &curthread->td_msgport, MSGF_PRIORITY,
7174 ipfw_sysctl_enable_dispatch);
7175 nmsg.lmsg.u.ms_result = enable;
7176
7177 return netisr_domsg(&nmsg, 0);
7178 }
7179
7180 static int
7181 ipfw_sysctl_autoinc_step(SYSCTL_HANDLER_ARGS)
7182 {
7183 return sysctl_int_range(oidp, arg1, arg2, req,
7184 IPFW_AUTOINC_STEP_MIN, IPFW_AUTOINC_STEP_MAX);
7185 }
7186
7187 static int
7188 ipfw_sysctl_scancnt(SYSCTL_HANDLER_ARGS)
7189 {
7190
7191 return sysctl_int_range(oidp, arg1, arg2, req, 1, INT_MAX);
7192 }
7193
7194 static int
7195 ipfw_sysctl_stat(SYSCTL_HANDLER_ARGS)
7196 {
7197 u_long stat = 0;
7198 int cpu, error;
7199
7200 for (cpu = 0; cpu < netisr_ncpus; ++cpu)
7201 stat += *((u_long *)((uint8_t *)ipfw_ctx[cpu] + arg2));
7202
7203 error = sysctl_handle_long(oidp, &stat, 0, req);
7204 if (error || req->newptr == NULL)
7205 return (error);
7206
7207 /* Zero out this stat. */
7208 for (cpu = 0; cpu < netisr_ncpus; ++cpu)
7209 *((u_long *)((uint8_t *)ipfw_ctx[cpu] + arg2)) = 0;
7210 return (0);
7211 }
7212
7213 static void
7214 ipfw_ctx_init_dispatch(netmsg_t nmsg)
7215 {
7216 struct netmsg_ipfw *fwmsg = (struct netmsg_ipfw *)nmsg;
7217 struct ipfw_context *ctx;
7218 struct ip_fw *def_rule;
7219
7220 ASSERT_NETISR_NCPUS(mycpuid);
7221
7222 ctx = kmalloc(__offsetof(struct ipfw_context,
7223 ipfw_tables[ipfw_table_max]), M_IPFW, M_WAITOK | M_ZERO);
7224
7225 RB_INIT(&ctx->ipfw_state_tree);
7226 TAILQ_INIT(&ctx->ipfw_state_list);
7227
7228 RB_INIT(&ctx->ipfw_track_tree);
7229 TAILQ_INIT(&ctx->ipfw_track_list);
7230
7231 callout_init_mp(&ctx->ipfw_stateto_ch);
7232 netmsg_init(&ctx->ipfw_stateexp_nm, NULL, &netisr_adone_rport,
7233 MSGF_DROPABLE | MSGF_PRIORITY, ipfw_state_expire_dispatch);
7234 ctx->ipfw_stateexp_anch.st_type = O_ANCHOR;
7235 netmsg_init(&ctx->ipfw_stateexp_more, NULL, &netisr_adone_rport,
7236 MSGF_DROPABLE, ipfw_state_expire_more_dispatch);
7237
7238 callout_init_mp(&ctx->ipfw_trackto_ch);
7239 netmsg_init(&ctx->ipfw_trackexp_nm, NULL, &netisr_adone_rport,
7240 MSGF_DROPABLE | MSGF_PRIORITY, ipfw_track_expire_dispatch);
7241 netmsg_init(&ctx->ipfw_trackexp_more, NULL, &netisr_adone_rport,
7242 MSGF_DROPABLE, ipfw_track_expire_more_dispatch);
7243
7244 callout_init_mp(&ctx->ipfw_keepalive_ch);
7245 netmsg_init(&ctx->ipfw_keepalive_nm, NULL, &netisr_adone_rport,
7246 MSGF_DROPABLE | MSGF_PRIORITY, ipfw_keepalive_dispatch);
7247 ctx->ipfw_keepalive_anch.st_type = O_ANCHOR;
7248 netmsg_init(&ctx->ipfw_keepalive_more, NULL, &netisr_adone_rport,
7249 MSGF_DROPABLE, ipfw_keepalive_more_dispatch);
7250
7251 callout_init_mp(&ctx->ipfw_xlatreap_ch);
7252 netmsg_init(&ctx->ipfw_xlatreap_nm, NULL, &netisr_adone_rport,
7253 MSGF_DROPABLE | MSGF_PRIORITY, ipfw_xlat_reap_dispatch);
7254 TAILQ_INIT(&ctx->ipfw_xlatreap);
7255
7256 ipfw_ctx[mycpuid] = ctx;
7257
7258 def_rule = kmalloc(sizeof(*def_rule), M_IPFW, M_WAITOK | M_ZERO);
7259
7260 def_rule->act_ofs = 0;
7261 def_rule->rulenum = IPFW_DEFAULT_RULE;
7262 def_rule->cmd_len = 1;
7263 def_rule->set = IPFW_DEFAULT_SET;
7264
7265 def_rule->cmd[0].len = 1;
7266 #ifdef IPFIREWALL_DEFAULT_TO_ACCEPT
7267 def_rule->cmd[0].opcode = O_ACCEPT;
7268 #else
7269 if (filters_default_to_accept)
7270 def_rule->cmd[0].opcode = O_ACCEPT;
7271 else
7272 def_rule->cmd[0].opcode = O_DENY;
7273 #endif
7274
7275 def_rule->refcnt = 1;
7276 def_rule->cpuid = mycpuid;
7277
7278 /* Install the default rule */
7279 ctx->ipfw_default_rule = def_rule;
7280 ctx->ipfw_layer3_chain = def_rule;
7281
7282 /* Link rule CPU sibling */
7283 ipfw_link_sibling(fwmsg, def_rule);
7284
7285 /* Statistics only need to be updated once */
7286 if (mycpuid == 0)
7287 ipfw_inc_static_count(def_rule);
7288
7289 netisr_forwardmsg(&nmsg->base, mycpuid + 1);
7290 }
7291
7292 static void
7293 ipfw_crossref_reap_dispatch(netmsg_t nmsg)
7294 {
7295
7296 crit_enter();
7297 /* Reply ASAP */
7298 netisr_replymsg(&nmsg->base, 0);
7299 crit_exit();
7300 ipfw_crossref_reap();
7301 }
7302
7303 static void
7304 ipfw_crossref_timeo(void *dummy __unused)
7305 {
7306 struct netmsg_base *msg = &ipfw_gd.ipfw_crossref_nm;
7307
7308 KKASSERT(mycpuid == 0);
7309
7310 crit_enter();
7311 if (msg->lmsg.ms_flags & MSGF_DONE)
7312 netisr_sendmsg_oncpu(msg);
7313 crit_exit();
7314 }
7315
7316 static void
7317 ipfw_ifaddr_dispatch(netmsg_t nmsg)
7318 {
7319 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
7320 struct ifnet *ifp = nmsg->lmsg.u.ms_resultp;
7321 struct ip_fw *f;
7322
7323 ASSERT_NETISR_NCPUS(mycpuid);
7324
7325 for (f = ctx->ipfw_layer3_chain; f != NULL; f = f->next) {
7326 int l, cmdlen;
7327 ipfw_insn *cmd;
7328
7329 if ((f->rule_flags & IPFW_RULE_F_DYNIFADDR) == 0)
7330 continue;
7331
7332 for (l = f->cmd_len, cmd = f->cmd; l > 0;
7333 l -= cmdlen, cmd += cmdlen) {
7334 cmdlen = F_LEN(cmd);
7335 if (cmd->opcode == O_IP_SRC_IFIP ||
7336 cmd->opcode == O_IP_DST_IFIP) {
7337 if (strncmp(ifp->if_xname,
7338 ((ipfw_insn_ifip *)cmd)->ifname,
7339 IFNAMSIZ) == 0)
7340 cmd->arg1 &= ~IPFW_IFIP_VALID;
7341 }
7342 }
7343 }
7344 netisr_forwardmsg(&nmsg->base, mycpuid + 1);
7345 }
7346
7347 static void
7348 ipfw_ifaddr(void *arg __unused, struct ifnet *ifp,
7349 enum ifaddr_event event __unused, struct ifaddr *ifa __unused)
7350 {
7351 struct netmsg_base nm;
7352
7353 netmsg_init(&nm, NULL, &curthread->td_msgport, MSGF_PRIORITY,
7354 ipfw_ifaddr_dispatch);
7355 nm.lmsg.u.ms_resultp = ifp;
7356 netisr_domsg_global(&nm);
7357 }
7358
7359 static void
7360 ipfw_init_dispatch(netmsg_t nmsg)
7361 {
7362 struct netmsg_ipfw fwmsg;
7363 int error = 0, cpu;
7364
7365 ASSERT_NETISR0;
7366
7367 if (IPFW_LOADED) {
7368 kprintf("IP firewall already loaded\n");
7369 error = EEXIST;
7370 goto reply;
7371 }
7372
7373 if (ipfw_table_max > UINT16_MAX || ipfw_table_max <= 0)
7374 ipfw_table_max = UINT16_MAX;
7375
7376 /* Initialize global track tree. */
7377 RB_INIT(&ipfw_gd.ipfw_trkcnt_tree);
7378 IPFW_TRKCNT_TOKINIT;
7379
7380 /* GC for freed crossref rules. */
7381 callout_init_mp(&ipfw_gd.ipfw_crossref_ch);
7382 netmsg_init(&ipfw_gd.ipfw_crossref_nm, NULL, &netisr_adone_rport,
7383 MSGF_PRIORITY | MSGF_DROPABLE, ipfw_crossref_reap_dispatch);
7384
7385 ipfw_state_max_set(ipfw_state_max);
7386 ipfw_state_headroom = 8 * netisr_ncpus;
7387
7388 bzero(&fwmsg, sizeof(fwmsg));
7389 netmsg_init(&fwmsg.base, NULL, &curthread->td_msgport, MSGF_PRIORITY,
7390 ipfw_ctx_init_dispatch);
7391 netisr_domsg_global(&fwmsg.base);
7392
7393 ip_fw_chk_ptr = ipfw_chk;
7394 ip_fw_ctl_ptr = ipfw_ctl;
7395 ip_fw_dn_io_ptr = ipfw_dummynet_io;
7396
7397 kprintf("ipfw2 initialized, default to %s, logging ",
7398 ipfw_ctx[mycpuid]->ipfw_default_rule->cmd[0].opcode ==
7399 O_ACCEPT ? "accept" : "deny");
7400
7401 #ifdef IPFIREWALL_VERBOSE
7402 fw_verbose = 1;
7403 #endif
7404 #ifdef IPFIREWALL_VERBOSE_LIMIT
7405 verbose_limit = IPFIREWALL_VERBOSE_LIMIT;
7406 #endif
7407 if (fw_verbose == 0) {
7408 kprintf("disabled\n");
7409 } else if (verbose_limit == 0) {
7410 kprintf("unlimited\n");
7411 } else {
7412 kprintf("limited to %d packets/entry by default\n",
7413 verbose_limit);
7414 }
7415
7416 ip_fw_loaded = 1;
7417 for (cpu = 0; cpu < netisr_ncpus; ++cpu) {
7418 callout_reset_bycpu(&ipfw_ctx[cpu]->ipfw_stateto_ch, hz,
7419 ipfw_state_expire_ipifunc, NULL, cpu);
7420 callout_reset_bycpu(&ipfw_ctx[cpu]->ipfw_trackto_ch, hz,
7421 ipfw_track_expire_ipifunc, NULL, cpu);
7422 callout_reset_bycpu(&ipfw_ctx[cpu]->ipfw_keepalive_ch, hz,
7423 ipfw_keepalive, NULL, cpu);
7424 }
7425
7426 if (fw_enable)
7427 ipfw_hook();
7428
7429 ipfw_ifaddr_event = EVENTHANDLER_REGISTER(ifaddr_event, ipfw_ifaddr,
7430 NULL, EVENTHANDLER_PRI_ANY);
7431 if (ipfw_ifaddr_event == NULL)
7432 kprintf("ipfw: ifaddr_event register failed\n");
7433
7434 reply:
7435 netisr_replymsg(&nmsg->base, error);
7436 }
7437
7438 static int
7439 ipfw_init(void)
7440 {
7441 struct netmsg_base smsg;
7442
7443 netmsg_init(&smsg, NULL, &curthread->td_msgport, MSGF_PRIORITY,
7444 ipfw_init_dispatch);
7445 return netisr_domsg(&smsg, 0);
7446 }
7447
7448 #ifdef KLD_MODULE
7449
7450 static void
7451 ipfw_ctx_fini_dispatch(netmsg_t nmsg)
7452 {
7453 struct ipfw_context *ctx = ipfw_ctx[mycpuid];
7454
7455 ASSERT_NETISR_NCPUS(mycpuid);
7456
7457 callout_cancel(&ctx->ipfw_stateto_ch);
7458 callout_cancel(&ctx->ipfw_trackto_ch);
7459 callout_cancel(&ctx->ipfw_keepalive_ch);
7460 callout_cancel(&ctx->ipfw_xlatreap_ch);
7461
7462 crit_enter();
7463 netisr_dropmsg(&ctx->ipfw_stateexp_more);
7464 netisr_dropmsg(&ctx->ipfw_stateexp_nm);
7465 netisr_dropmsg(&ctx->ipfw_trackexp_more);
7466 netisr_dropmsg(&ctx->ipfw_trackexp_nm);
7467 netisr_dropmsg(&ctx->ipfw_keepalive_more);
7468 netisr_dropmsg(&ctx->ipfw_keepalive_nm);
7469 netisr_dropmsg(&ctx->ipfw_xlatreap_nm);
7470 crit_exit();
7471
7472 ipfw_table_flushall_oncpu(ctx, 1);
7473
7474 netisr_forwardmsg(&nmsg->base, mycpuid + 1);
7475 }
7476
7477 static void
7478 ipfw_fini_dispatch(netmsg_t nmsg)
7479 {
7480 struct netmsg_base nm;
7481 int error = 0, cpu;
7482
7483 ASSERT_NETISR0;
7484
7485 ipfw_crossref_reap();
7486
7487 if (ipfw_gd.ipfw_refcnt != 0) {
7488 error = EBUSY;
7489 goto reply;
7490 }
7491
7492 ip_fw_loaded = 0;
7493 ipfw_dehook();
7494
7495 /* Synchronize any inflight state/track expire IPIs. */
7496 lwkt_synchronize_ipiqs("ipfwfini");
7497
7498 netmsg_init(&nm, NULL, &curthread->td_msgport, MSGF_PRIORITY,
7499 ipfw_ctx_fini_dispatch);
7500 netisr_domsg_global(&nm);
7501
7502 callout_cancel(&ipfw_gd.ipfw_crossref_ch);
7503 crit_enter();
7504 netisr_dropmsg(&ipfw_gd.ipfw_crossref_nm);
7505 crit_exit();
7506
7507 if (ipfw_ifaddr_event != NULL)
7508 EVENTHANDLER_DEREGISTER(ifaddr_event, ipfw_ifaddr_event);
7509
7510 ip_fw_chk_ptr = NULL;
7511 ip_fw_ctl_ptr = NULL;
7512 ip_fw_dn_io_ptr = NULL;
7513 ipfw_flush(1 /* kill default rule */);
7514
7515 /* Free pre-cpu context */
7516 for (cpu = 0; cpu < netisr_ncpus; ++cpu)
7517 kfree(ipfw_ctx[cpu], M_IPFW);
7518
7519 kprintf("IP firewall unloaded\n");
7520 reply:
7521 netisr_replymsg(&nmsg->base, error);
7522 }
7523
7524 static void
7525 ipfw_fflush_dispatch(netmsg_t nmsg)
7526 {
7527
7528 ipfw_flush(0 /* keep default rule */);
7529 ipfw_crossref_reap();
7530 netisr_replymsg(&nmsg->base, 0);
7531 }
7532
7533 static int
7534 ipfw_fini(void)
7535 {
7536 struct netmsg_base smsg;
7537 int i = 0;
7538
7539 for (;;) {
7540 netmsg_init(&smsg, NULL, &curthread->td_msgport, MSGF_PRIORITY,
7541 ipfw_fflush_dispatch);
7542 netisr_domsg(&smsg, 0);
7543
7544 if (ipfw_gd.ipfw_refcnt == 0)
7545 break;
7546 kprintf("ipfw: flush pending %d\n", ++i);
7547 tsleep(&smsg, 0, "ipfwff", (3 * hz) / 2);
7548 }
7549
7550 netmsg_init(&smsg, NULL, &curthread->td_msgport, MSGF_PRIORITY,
7551 ipfw_fini_dispatch);
7552 return netisr_domsg(&smsg, 0);
7553 }
7554
7555 #endif /* KLD_MODULE */
7556
7557 static int
7558 ipfw_modevent(module_t mod, int type, void *unused)
7559 {
7560 int err = 0;
7561
7562 switch (type) {
7563 case MOD_LOAD:
7564 err = ipfw_init();
7565 break;
7566
7567 case MOD_UNLOAD:
7568 #ifndef KLD_MODULE
7569 kprintf("ipfw statically compiled, cannot unload\n");
7570 err = EBUSY;
7571 #else
7572 err = ipfw_fini();
7573 #endif
7574 break;
7575 default:
7576 break;
7577 }
7578 return err;
7579 }
7580
7581 static moduledata_t ipfwmod = {
7582 "ipfw",
7583 ipfw_modevent,
7584 0
7585 };
7586 DECLARE_MODULE(ipfw, ipfwmod, SI_SUB_PROTO_END, SI_ORDER_ANY);
7587 MODULE_VERSION(ipfw, 1);
DragonFly BSD