1 /* $FreeBSD: src/sys/contrib/pf/net/pf.c,v 1.19 2004/09/11 11:18:25 mlaier Exp $ */
2 /* $OpenBSD: pf.c,v 1.433.2.2 2004/07/17 03:22:34 brad Exp $ */
3 /* add $OpenBSD: pf.c,v 1.448 2004/05/11 07:34:11 dhartmei Exp $ */
4 /* $DragonFly: src/sys/net/pf/pf.c,v 1.3 2004/12/21 02:54:15 hsu Exp $ */
7 * Copyright (c) 2004 The DragonFly Project. All rights reserved.
9 * Copyright (c) 2001 Daniel Hartmeier
10 * Copyright (c) 2002,2003 Henning Brauer
11 * All rights reserved.
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
17 * - Redistributions of source code must retain the above copyright
18 * notice, this list of conditions and the following disclaimer.
19 * - Redistributions in binary form must reproduce the above
20 * copyright notice, this list of conditions and the following
21 * disclaimer in the documentation and/or other materials provided
22 * with the distribution.
24 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
25 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
26 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
27 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
28 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
29 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
30 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
31 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
32 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
34 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35 * POSSIBILITY OF SUCH DAMAGE.
37 * Effort sponsored in part by the Defense Advanced Research Projects
38 * Agency (DARPA) and Air Force Research Laboratory, Air Force
39 * Materiel Command, USAF, under agreement number F30602-01-2-0537.
44 #include "opt_inet6.h"
45 #include "use_pfsync.h"
47 #include <sys/param.h>
48 #include <sys/systm.h>
49 #include <sys/malloc.h>
51 #include <sys/filio.h>
52 #include <sys/socket.h>
53 #include <sys/socketvar.h>
54 #include <sys/kernel.h>
56 #include <sys/sysctl.h>
57 #include <sys/endian.h>
58 #include <vm/vm_zone.h>
60 #include <machine/inttypes.h>
63 #include <net/if_types.h>
65 #include <net/route.h>
67 #include <netinet/in.h>
68 #include <netinet/in_var.h>
69 #include <netinet/in_systm.h>
70 #include <netinet/ip.h>
71 #include <netinet/ip_var.h>
72 #include <netinet/tcp.h>
73 #include <netinet/tcp_seq.h>
74 #include <netinet/udp.h>
75 #include <netinet/ip_icmp.h>
76 #include <netinet/in_pcb.h>
77 #include <netinet/tcp_timer.h>
78 #include <netinet/tcp_var.h>
79 #include <netinet/udp_var.h>
80 #include <netinet/icmp_var.h>
82 #include <net/pf/pfvar.h>
83 #include <net/pf/if_pflog.h>
86 #include <net/pf/if_pfsync.h>
87 #endif /* NPFSYNC > 0 */
90 #include <netinet/ip6.h>
91 #include <netinet/in_pcb.h>
92 #include <netinet/icmp6.h>
93 #include <netinet6/nd6.h>
94 #include <netinet6/ip6_var.h>
95 #include <netinet6/in6_pcb.h>
98 #include <sys/in_cksum.h>
99 #include <machine/limits.h>
100 #include <sys/msgport2.h>
101 #include <sys/ucred.h>
103 extern int ip_optcopy(struct ip
*, struct ip
*);
105 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x
111 struct pf_anchorqueue pf_anchors
;
112 struct pf_ruleset pf_main_ruleset
;
113 struct pf_altqqueue pf_altqs
[2];
114 struct pf_palist pf_pabuf
;
115 struct pf_altqqueue
*pf_altqs_active
;
116 struct pf_altqqueue
*pf_altqs_inactive
;
117 struct pf_status pf_status
;
119 u_int32_t ticket_altqs_active
;
120 u_int32_t ticket_altqs_inactive
;
121 int altqs_inactive_open
;
122 u_int32_t ticket_pabuf
;
124 struct callout pf_expire_to
; /* expire timeout */
126 vm_zone_t pf_src_tree_pl
, pf_rule_pl
;
127 vm_zone_t pf_state_pl
, pf_altq_pl
, pf_pooladdr_pl
;
129 void pf_print_host(struct pf_addr
*, u_int16_t
, u_int8_t
);
130 void pf_print_state(struct pf_state
*);
131 void pf_print_flags(u_int8_t
);
133 u_int16_t
pf_cksum_fixup(u_int16_t
, u_int16_t
, u_int16_t
,
135 void pf_change_ap(struct pf_addr
*, u_int16_t
*,
136 u_int16_t
*, u_int16_t
*, struct pf_addr
*,
137 u_int16_t
, u_int8_t
, sa_family_t
);
139 void pf_change_a6(struct pf_addr
*, u_int16_t
*,
140 struct pf_addr
*, u_int8_t
);
142 void pf_change_icmp(struct pf_addr
*, u_int16_t
*,
143 struct pf_addr
*, struct pf_addr
*, u_int16_t
,
144 u_int16_t
*, u_int16_t
*, u_int16_t
*,
145 u_int16_t
*, u_int8_t
, sa_family_t
);
146 void pf_send_tcp(const struct pf_rule
*, sa_family_t
,
147 const struct pf_addr
*, const struct pf_addr
*,
148 u_int16_t
, u_int16_t
, u_int32_t
, u_int32_t
,
149 u_int8_t
, u_int16_t
, u_int16_t
, u_int8_t
);
150 void pf_send_icmp(struct mbuf
*, u_int8_t
, u_int8_t
,
151 sa_family_t
, struct pf_rule
*);
152 struct pf_rule
*pf_match_translation(struct pf_pdesc
*, struct mbuf
*,
153 int, int, struct pfi_kif
*,
154 struct pf_addr
*, u_int16_t
, struct pf_addr
*,
156 struct pf_rule
*pf_get_translation(struct pf_pdesc
*, struct mbuf
*,
157 int, int, struct pfi_kif
*, struct pf_src_node
**,
158 struct pf_addr
*, u_int16_t
,
159 struct pf_addr
*, u_int16_t
,
160 struct pf_addr
*, u_int16_t
*);
161 int pf_test_tcp(struct pf_rule
**, struct pf_state
**,
162 int, struct pfi_kif
*, struct mbuf
*, int,
163 void *, struct pf_pdesc
*, struct pf_rule
**,
164 struct pf_ruleset
**);
165 int pf_test_udp(struct pf_rule
**, struct pf_state
**,
166 int, struct pfi_kif
*, struct mbuf
*, int,
167 void *, struct pf_pdesc
*, struct pf_rule
**,
168 struct pf_ruleset
**);
169 int pf_test_icmp(struct pf_rule
**, struct pf_state
**,
170 int, struct pfi_kif
*, struct mbuf
*, int,
171 void *, struct pf_pdesc
*, struct pf_rule
**,
172 struct pf_ruleset
**);
173 int pf_test_other(struct pf_rule
**, struct pf_state
**,
174 int, struct pfi_kif
*, struct mbuf
*, int, void *,
175 struct pf_pdesc
*, struct pf_rule
**,
176 struct pf_ruleset
**);
177 int pf_test_fragment(struct pf_rule
**, int,
178 struct pfi_kif
*, struct mbuf
*, void *,
179 struct pf_pdesc
*, struct pf_rule
**,
180 struct pf_ruleset
**);
181 int pf_test_state_tcp(struct pf_state
**, int,
182 struct pfi_kif
*, struct mbuf
*, int,
183 void *, struct pf_pdesc
*, u_short
*);
184 int pf_test_state_udp(struct pf_state
**, int,
185 struct pfi_kif
*, struct mbuf
*, int,
186 void *, struct pf_pdesc
*);
187 int pf_test_state_icmp(struct pf_state
**, int,
188 struct pfi_kif
*, struct mbuf
*, int,
189 void *, struct pf_pdesc
*);
190 int pf_test_state_other(struct pf_state
**, int,
191 struct pfi_kif
*, struct pf_pdesc
*);
192 static int pf_match_tag(struct mbuf
*, struct pf_rule
*,
193 struct pf_rule
*, int *);
194 void pf_hash(struct pf_addr
*, struct pf_addr
*,
195 struct pf_poolhashkey
*, sa_family_t
);
196 int pf_map_addr(u_int8_t
, struct pf_rule
*,
197 struct pf_addr
*, struct pf_addr
*,
198 struct pf_addr
*, struct pf_src_node
**);
199 int pf_get_sport(sa_family_t
, u_int8_t
, struct pf_rule
*,
200 struct pf_addr
*, struct pf_addr
*, u_int16_t
,
201 struct pf_addr
*, u_int16_t
*, u_int16_t
, u_int16_t
,
202 struct pf_src_node
**);
203 void pf_route(struct mbuf
**, struct pf_rule
*, int,
204 struct ifnet
*, struct pf_state
*);
205 void pf_route6(struct mbuf
**, struct pf_rule
*, int,
206 struct ifnet
*, struct pf_state
*);
207 int pf_socket_lookup(uid_t
*, gid_t
*,
208 int, struct pf_pdesc
*);
209 u_int8_t
pf_get_wscale(struct mbuf
*, int, u_int16_t
,
211 u_int16_t
pf_get_mss(struct mbuf
*, int, u_int16_t
,
213 u_int16_t
pf_calc_mss(struct pf_addr
*, sa_family_t
,
215 void pf_set_rt_ifp(struct pf_state
*,
217 int pf_check_proto_cksum(struct mbuf
*, int, int,
218 u_int8_t
, sa_family_t
);
219 int pf_addr_wrap_neq(struct pf_addr_wrap
*,
220 struct pf_addr_wrap
*);
221 struct pf_state
*pf_find_state_recurse(struct pfi_kif
*,
222 struct pf_state
*, u_int8_t
);
224 struct pf_pool_limit pf_pool_limits
[PF_LIMIT_MAX
];
226 #define STATE_LOOKUP() \
228 if (direction == PF_IN) \
229 *state = pf_find_state_recurse( \
230 kif, &key, PF_EXT_GWY); \
232 *state = pf_find_state_recurse( \
233 kif, &key, PF_LAN_EXT); \
234 if (*state == NULL) \
236 if (direction == PF_OUT && \
237 (((*state)->rule.ptr->rt == PF_ROUTETO && \
238 (*state)->rule.ptr->direction == PF_OUT) || \
239 ((*state)->rule.ptr->rt == PF_REPLYTO && \
240 (*state)->rule.ptr->direction == PF_IN)) && \
241 (*state)->rt_kif != NULL && \
242 (*state)->rt_kif != kif) \
246 #define STATE_TRANSLATE(s) \
247 (s)->lan.addr.addr32[0] != (s)->gwy.addr.addr32[0] || \
248 ((s)->af == AF_INET6 && \
249 ((s)->lan.addr.addr32[1] != (s)->gwy.addr.addr32[1] || \
250 (s)->lan.addr.addr32[2] != (s)->gwy.addr.addr32[2] || \
251 (s)->lan.addr.addr32[3] != (s)->gwy.addr.addr32[3])) || \
252 (s)->lan.port != (s)->gwy.port
254 #define BOUND_IFACE(r, k) (((r)->rule_flag & PFRULE_IFBOUND) ? (k) : \
255 ((r)->rule_flag & PFRULE_GRBOUND) ? (k)->pfik_parent : \
256 (k)->pfik_parent->pfik_parent)
258 static int pf_src_compare(struct pf_src_node
*, struct pf_src_node
*);
259 static int pf_state_compare_lan_ext(struct pf_state
*,
261 static int pf_state_compare_ext_gwy(struct pf_state
*,
263 static int pf_state_compare_id(struct pf_state
*,
266 struct pf_src_tree tree_src_tracking
;
268 struct pf_state_tree_id tree_id
;
269 struct pf_state_queue state_updates
;
271 RB_GENERATE(pf_src_tree
, pf_src_node
, entry
, pf_src_compare
);
272 RB_GENERATE(pf_state_tree_lan_ext
, pf_state
,
273 u
.s
.entry_lan_ext
, pf_state_compare_lan_ext
);
274 RB_GENERATE(pf_state_tree_ext_gwy
, pf_state
,
275 u
.s
.entry_ext_gwy
, pf_state_compare_ext_gwy
);
276 RB_GENERATE(pf_state_tree_id
, pf_state
,
277 u
.s
.entry_id
, pf_state_compare_id
);
280 pf_src_compare(struct pf_src_node
*a
, struct pf_src_node
*b
)
284 if (a
->rule
.ptr
> b
->rule
.ptr
)
286 if (a
->rule
.ptr
< b
->rule
.ptr
)
288 if ((diff
= a
->af
- b
->af
) != 0)
293 if (a
->addr
.addr32
[0] > b
->addr
.addr32
[0])
295 if (a
->addr
.addr32
[0] < b
->addr
.addr32
[0])
301 if (a
->addr
.addr32
[3] > b
->addr
.addr32
[3])
303 if (a
->addr
.addr32
[3] < b
->addr
.addr32
[3])
305 if (a
->addr
.addr32
[2] > b
->addr
.addr32
[2])
307 if (a
->addr
.addr32
[2] < b
->addr
.addr32
[2])
309 if (a
->addr
.addr32
[1] > b
->addr
.addr32
[1])
311 if (a
->addr
.addr32
[1] < b
->addr
.addr32
[1])
313 if (a
->addr
.addr32
[0] > b
->addr
.addr32
[0])
315 if (a
->addr
.addr32
[0] < b
->addr
.addr32
[0])
324 pf_state_compare_lan_ext(struct pf_state
*a
, struct pf_state
*b
)
328 if ((diff
= a
->proto
- b
->proto
) != 0)
330 if ((diff
= a
->af
- b
->af
) != 0)
335 if (a
->lan
.addr
.addr32
[0] > b
->lan
.addr
.addr32
[0])
337 if (a
->lan
.addr
.addr32
[0] < b
->lan
.addr
.addr32
[0])
339 if (a
->ext
.addr
.addr32
[0] > b
->ext
.addr
.addr32
[0])
341 if (a
->ext
.addr
.addr32
[0] < b
->ext
.addr
.addr32
[0])
347 if (a
->lan
.addr
.addr32
[3] > b
->lan
.addr
.addr32
[3])
349 if (a
->lan
.addr
.addr32
[3] < b
->lan
.addr
.addr32
[3])
351 if (a
->ext
.addr
.addr32
[3] > b
->ext
.addr
.addr32
[3])
353 if (a
->ext
.addr
.addr32
[3] < b
->ext
.addr
.addr32
[3])
355 if (a
->lan
.addr
.addr32
[2] > b
->lan
.addr
.addr32
[2])
357 if (a
->lan
.addr
.addr32
[2] < b
->lan
.addr
.addr32
[2])
359 if (a
->ext
.addr
.addr32
[2] > b
->ext
.addr
.addr32
[2])
361 if (a
->ext
.addr
.addr32
[2] < b
->ext
.addr
.addr32
[2])
363 if (a
->lan
.addr
.addr32
[1] > b
->lan
.addr
.addr32
[1])
365 if (a
->lan
.addr
.addr32
[1] < b
->lan
.addr
.addr32
[1])
367 if (a
->ext
.addr
.addr32
[1] > b
->ext
.addr
.addr32
[1])
369 if (a
->ext
.addr
.addr32
[1] < b
->ext
.addr
.addr32
[1])
371 if (a
->lan
.addr
.addr32
[0] > b
->lan
.addr
.addr32
[0])
373 if (a
->lan
.addr
.addr32
[0] < b
->lan
.addr
.addr32
[0])
375 if (a
->ext
.addr
.addr32
[0] > b
->ext
.addr
.addr32
[0])
377 if (a
->ext
.addr
.addr32
[0] < b
->ext
.addr
.addr32
[0])
383 if ((diff
= a
->lan
.port
- b
->lan
.port
) != 0)
385 if ((diff
= a
->ext
.port
- b
->ext
.port
) != 0)
392 pf_state_compare_ext_gwy(struct pf_state
*a
, struct pf_state
*b
)
396 if ((diff
= a
->proto
- b
->proto
) != 0)
398 if ((diff
= a
->af
- b
->af
) != 0)
403 if (a
->ext
.addr
.addr32
[0] > b
->ext
.addr
.addr32
[0])
405 if (a
->ext
.addr
.addr32
[0] < b
->ext
.addr
.addr32
[0])
407 if (a
->gwy
.addr
.addr32
[0] > b
->gwy
.addr
.addr32
[0])
409 if (a
->gwy
.addr
.addr32
[0] < b
->gwy
.addr
.addr32
[0])
415 if (a
->ext
.addr
.addr32
[3] > b
->ext
.addr
.addr32
[3])
417 if (a
->ext
.addr
.addr32
[3] < b
->ext
.addr
.addr32
[3])
419 if (a
->gwy
.addr
.addr32
[3] > b
->gwy
.addr
.addr32
[3])
421 if (a
->gwy
.addr
.addr32
[3] < b
->gwy
.addr
.addr32
[3])
423 if (a
->ext
.addr
.addr32
[2] > b
->ext
.addr
.addr32
[2])
425 if (a
->ext
.addr
.addr32
[2] < b
->ext
.addr
.addr32
[2])
427 if (a
->gwy
.addr
.addr32
[2] > b
->gwy
.addr
.addr32
[2])
429 if (a
->gwy
.addr
.addr32
[2] < b
->gwy
.addr
.addr32
[2])
431 if (a
->ext
.addr
.addr32
[1] > b
->ext
.addr
.addr32
[1])
433 if (a
->ext
.addr
.addr32
[1] < b
->ext
.addr
.addr32
[1])
435 if (a
->gwy
.addr
.addr32
[1] > b
->gwy
.addr
.addr32
[1])
437 if (a
->gwy
.addr
.addr32
[1] < b
->gwy
.addr
.addr32
[1])
439 if (a
->ext
.addr
.addr32
[0] > b
->ext
.addr
.addr32
[0])
441 if (a
->ext
.addr
.addr32
[0] < b
->ext
.addr
.addr32
[0])
443 if (a
->gwy
.addr
.addr32
[0] > b
->gwy
.addr
.addr32
[0])
445 if (a
->gwy
.addr
.addr32
[0] < b
->gwy
.addr
.addr32
[0])
451 if ((diff
= a
->ext
.port
- b
->ext
.port
) != 0)
453 if ((diff
= a
->gwy
.port
- b
->gwy
.port
) != 0)
460 pf_state_compare_id(struct pf_state
*a
, struct pf_state
*b
)
466 if (a
->creatorid
> b
->creatorid
)
468 if (a
->creatorid
< b
->creatorid
)
476 pf_addrcpy(struct pf_addr
*dst
, struct pf_addr
*src
, sa_family_t af
)
481 dst
->addr32
[0] = src
->addr32
[0];
485 dst
->addr32
[0] = src
->addr32
[0];
486 dst
->addr32
[1] = src
->addr32
[1];
487 dst
->addr32
[2] = src
->addr32
[2];
488 dst
->addr32
[3] = src
->addr32
[3];
495 pf_find_state_byid(struct pf_state
*key
)
497 pf_status
.fcounters
[FCNT_STATE_SEARCH
]++;
498 return (RB_FIND(pf_state_tree_id
, &tree_id
, key
));
502 pf_find_state_recurse(struct pfi_kif
*kif
, struct pf_state
*key
, u_int8_t tree
)
506 pf_status
.fcounters
[FCNT_STATE_SEARCH
]++;
510 for (; kif
!= NULL
; kif
= kif
->pfik_parent
) {
511 s
= RB_FIND(pf_state_tree_lan_ext
,
512 &kif
->pfik_lan_ext
, key
);
518 for (; kif
!= NULL
; kif
= kif
->pfik_parent
) {
519 s
= RB_FIND(pf_state_tree_ext_gwy
,
520 &kif
->pfik_ext_gwy
, key
);
526 panic("pf_find_state_recurse");
531 pf_find_state_all(struct pf_state
*key
, u_int8_t tree
, int *more
)
533 struct pf_state
*s
, *ss
= NULL
;
536 pf_status
.fcounters
[FCNT_STATE_SEARCH
]++;
540 TAILQ_FOREACH(kif
, &pfi_statehead
, pfik_w_states
) {
541 s
= RB_FIND(pf_state_tree_lan_ext
,
542 &kif
->pfik_lan_ext
, key
);
552 TAILQ_FOREACH(kif
, &pfi_statehead
, pfik_w_states
) {
553 s
= RB_FIND(pf_state_tree_ext_gwy
,
554 &kif
->pfik_ext_gwy
, key
);
564 panic("pf_find_state_all");
569 pf_insert_src_node(struct pf_src_node
**sn
, struct pf_rule
*rule
,
570 struct pf_addr
*src
, sa_family_t af
)
572 struct pf_src_node k
;
576 PF_ACPY(&k
.addr
, src
, af
);
577 if (rule
->rule_flag
& PFRULE_RULESRCTRACK
||
578 rule
->rpool
.opts
& PF_POOL_STICKYADDR
)
582 pf_status
.scounters
[SCNT_SRC_NODE_SEARCH
]++;
583 *sn
= RB_FIND(pf_src_tree
, &tree_src_tracking
, &k
);
586 if (!rule
->max_src_nodes
||
587 rule
->src_nodes
< rule
->max_src_nodes
)
588 (*sn
) = pool_get(&pf_src_tree_pl
, PR_NOWAIT
);
591 bzero(*sn
, sizeof(struct pf_src_node
));
593 if (rule
->rule_flag
& PFRULE_RULESRCTRACK
||
594 rule
->rpool
.opts
& PF_POOL_STICKYADDR
)
595 (*sn
)->rule
.ptr
= rule
;
597 (*sn
)->rule
.ptr
= NULL
;
598 PF_ACPY(&(*sn
)->addr
, src
, af
);
599 if (RB_INSERT(pf_src_tree
,
600 &tree_src_tracking
, *sn
) != NULL
) {
601 if (pf_status
.debug
>= PF_DEBUG_MISC
) {
602 printf("pf: src_tree insert failed: ");
603 pf_print_host(&(*sn
)->addr
, 0, af
);
606 pool_put(&pf_src_tree_pl
, *sn
);
609 (*sn
)->creation
= time_second
;
610 (*sn
)->ruletype
= rule
->action
;
611 if ((*sn
)->rule
.ptr
!= NULL
)
612 (*sn
)->rule
.ptr
->src_nodes
++;
613 pf_status
.scounters
[SCNT_SRC_NODE_INSERT
]++;
614 pf_status
.src_nodes
++;
616 if (rule
->max_src_states
&&
617 (*sn
)->states
>= rule
->max_src_states
)
624 pf_insert_state(struct pfi_kif
*kif
, struct pf_state
*state
)
626 /* Thou MUST NOT insert multiple duplicate keys */
627 state
->u
.s
.kif
= kif
;
628 if (RB_INSERT(pf_state_tree_lan_ext
, &kif
->pfik_lan_ext
, state
)) {
629 if (pf_status
.debug
>= PF_DEBUG_MISC
) {
630 printf("pf: state insert failed: tree_lan_ext");
632 pf_print_host(&state
->lan
.addr
, state
->lan
.port
,
635 pf_print_host(&state
->gwy
.addr
, state
->gwy
.port
,
638 pf_print_host(&state
->ext
.addr
, state
->ext
.port
,
640 if (state
->sync_flags
& PFSTATE_FROMSYNC
)
641 printf(" (from sync)");
647 if (RB_INSERT(pf_state_tree_ext_gwy
, &kif
->pfik_ext_gwy
, state
)) {
648 if (pf_status
.debug
>= PF_DEBUG_MISC
) {
649 printf("pf: state insert failed: tree_ext_gwy");
651 pf_print_host(&state
->lan
.addr
, state
->lan
.port
,
654 pf_print_host(&state
->gwy
.addr
, state
->gwy
.port
,
657 pf_print_host(&state
->ext
.addr
, state
->ext
.port
,
659 if (state
->sync_flags
& PFSTATE_FROMSYNC
)
660 printf(" (from sync)");
663 RB_REMOVE(pf_state_tree_lan_ext
, &kif
->pfik_lan_ext
, state
);
667 if (state
->id
== 0 && state
->creatorid
== 0) {
668 state
->id
= htobe64(pf_status
.stateid
++);
669 state
->creatorid
= pf_status
.hostid
;
671 if (RB_INSERT(pf_state_tree_id
, &tree_id
, state
) != NULL
) {
672 if (pf_status
.debug
>= PF_DEBUG_MISC
) {
673 printf("pf: state insert failed: "
674 "id: %016" PRIx64
" creatorid: %08" PRIx32
,
675 be64toh(state
->id
), ntohl(state
->creatorid
));
676 if (state
->sync_flags
& PFSTATE_FROMSYNC
)
677 printf(" (from sync)");
680 RB_REMOVE(pf_state_tree_lan_ext
, &kif
->pfik_lan_ext
, state
);
681 RB_REMOVE(pf_state_tree_ext_gwy
, &kif
->pfik_ext_gwy
, state
);
684 TAILQ_INSERT_HEAD(&state_updates
, state
, u
.s
.entry_updates
);
686 pf_status
.fcounters
[FCNT_STATE_INSERT
]++;
688 pfi_attach_state(kif
);
690 pfsync_insert_state(state
);
696 pf_purge_timeout(void *arg
)
698 struct callout
*to
= arg
;
702 pf_purge_expired_states();
703 pf_purge_expired_fragments();
704 pf_purge_expired_src_nodes();
707 callout_reset(to
, pf_default_rule
.timeout
[PFTM_INTERVAL
] * hz
,
708 pf_purge_timeout
, to
);
712 pf_state_expires(const struct pf_state
*state
)
719 /* handle all PFTM_* > PFTM_MAX here */
720 if (state
->timeout
== PFTM_PURGE
)
721 return (time_second
);
722 if (state
->timeout
== PFTM_UNTIL_PACKET
)
724 KASSERT((state
->timeout
< PFTM_MAX
),
725 ("pf_state_expires: timeout > PFTM_MAX"));
726 timeout
= state
->rule
.ptr
->timeout
[state
->timeout
];
728 timeout
= pf_default_rule
.timeout
[state
->timeout
];
729 start
= state
->rule
.ptr
->timeout
[PFTM_ADAPTIVE_START
];
731 end
= state
->rule
.ptr
->timeout
[PFTM_ADAPTIVE_END
];
732 states
= state
->rule
.ptr
->states
;
734 start
= pf_default_rule
.timeout
[PFTM_ADAPTIVE_START
];
735 end
= pf_default_rule
.timeout
[PFTM_ADAPTIVE_END
];
736 states
= pf_status
.states
;
738 if (end
&& states
> start
&& start
< end
) {
740 return (state
->expire
+ timeout
* (end
- states
) /
743 return (time_second
);
745 return (state
->expire
+ timeout
);
749 pf_purge_expired_src_nodes(void)
751 struct pf_src_node
*cur
, *next
;
753 for (cur
= RB_MIN(pf_src_tree
, &tree_src_tracking
); cur
; cur
= next
) {
754 next
= RB_NEXT(pf_src_tree
, &tree_src_tracking
, cur
);
756 if (cur
->states
<= 0 && cur
->expire
<= time_second
) {
757 if (cur
->rule
.ptr
!= NULL
) {
758 cur
->rule
.ptr
->src_nodes
--;
759 if (cur
->rule
.ptr
->states
<= 0 &&
760 cur
->rule
.ptr
->max_src_nodes
<= 0)
761 pf_rm_rule(NULL
, cur
->rule
.ptr
);
763 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, cur
);
764 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
765 pf_status
.src_nodes
--;
766 pool_put(&pf_src_tree_pl
, cur
);
772 pf_src_tree_remove_state(struct pf_state
*s
)
776 if (s
->src_node
!= NULL
) {
777 if (--s
->src_node
->states
<= 0) {
778 timeout
= s
->rule
.ptr
->timeout
[PFTM_SRC_NODE
];
781 pf_default_rule
.timeout
[PFTM_SRC_NODE
];
782 s
->src_node
->expire
= time_second
+ timeout
;
785 if (s
->nat_src_node
!= s
->src_node
&& s
->nat_src_node
!= NULL
) {
786 if (--s
->nat_src_node
->states
<= 0) {
787 timeout
= s
->rule
.ptr
->timeout
[PFTM_SRC_NODE
];
790 pf_default_rule
.timeout
[PFTM_SRC_NODE
];
791 s
->nat_src_node
->expire
= time_second
+ timeout
;
794 s
->src_node
= s
->nat_src_node
= NULL
;
798 pf_purge_expired_states(void)
800 struct pf_state
*cur
, *next
;
802 for (cur
= RB_MIN(pf_state_tree_id
, &tree_id
);
804 next
= RB_NEXT(pf_state_tree_id
, &tree_id
, cur
);
806 if (pf_state_expires(cur
) <= time_second
) {
807 if (cur
->src
.state
== PF_TCPS_PROXY_DST
)
808 pf_send_tcp(cur
->rule
.ptr
, cur
->af
,
809 &cur
->ext
.addr
, &cur
->lan
.addr
,
810 cur
->ext
.port
, cur
->lan
.port
,
811 cur
->src
.seqhi
, cur
->src
.seqlo
+ 1, 0,
812 TH_RST
|TH_ACK
, 0, 0);
813 RB_REMOVE(pf_state_tree_ext_gwy
,
814 &cur
->u
.s
.kif
->pfik_ext_gwy
, cur
);
815 RB_REMOVE(pf_state_tree_lan_ext
,
816 &cur
->u
.s
.kif
->pfik_lan_ext
, cur
);
817 RB_REMOVE(pf_state_tree_id
, &tree_id
, cur
);
819 pfsync_delete_state(cur
);
821 pf_src_tree_remove_state(cur
);
822 if (--cur
->rule
.ptr
->states
<= 0 &&
823 cur
->rule
.ptr
->src_nodes
<= 0)
824 pf_rm_rule(NULL
, cur
->rule
.ptr
);
825 if (cur
->nat_rule
.ptr
!= NULL
)
826 if (--cur
->nat_rule
.ptr
->states
<= 0 &&
827 cur
->nat_rule
.ptr
->src_nodes
<= 0)
828 pf_rm_rule(NULL
, cur
->nat_rule
.ptr
);
829 if (cur
->anchor
.ptr
!= NULL
)
830 if (--cur
->anchor
.ptr
->states
<= 0)
831 pf_rm_rule(NULL
, cur
->anchor
.ptr
);
832 pf_normalize_tcp_cleanup(cur
);
833 pfi_detach_state(cur
->u
.s
.kif
);
834 TAILQ_REMOVE(&state_updates
, cur
, u
.s
.entry_updates
);
835 pool_put(&pf_state_pl
, cur
);
836 pf_status
.fcounters
[FCNT_STATE_REMOVALS
]++;
843 pf_tbladdr_setup(struct pf_ruleset
*rs
, struct pf_addr_wrap
*aw
)
845 if (aw
->type
!= PF_ADDR_TABLE
)
847 if ((aw
->p
.tbl
= pfr_attach_table(rs
, aw
->v
.tblname
)) == NULL
)
853 pf_tbladdr_remove(struct pf_addr_wrap
*aw
)
855 if (aw
->type
!= PF_ADDR_TABLE
|| aw
->p
.tbl
== NULL
)
857 pfr_detach_table(aw
->p
.tbl
);
862 pf_tbladdr_copyout(struct pf_addr_wrap
*aw
)
864 struct pfr_ktable
*kt
= aw
->p
.tbl
;
866 if (aw
->type
!= PF_ADDR_TABLE
|| kt
== NULL
)
868 if (!(kt
->pfrkt_flags
& PFR_TFLAG_ACTIVE
) && kt
->pfrkt_root
!= NULL
)
871 aw
->p
.tblcnt
= (kt
->pfrkt_flags
& PFR_TFLAG_ACTIVE
) ?
876 pf_print_host(struct pf_addr
*addr
, u_int16_t p
, sa_family_t af
)
881 u_int32_t a
= ntohl(addr
->addr32
[0]);
882 printf("%u.%u.%u.%u", (a
>>24)&255, (a
>>16)&255,
894 u_int8_t i
, curstart
= 255, curend
= 0,
895 maxstart
= 0, maxend
= 0;
896 for (i
= 0; i
< 8; i
++) {
897 if (!addr
->addr16
[i
]) {
904 if ((curend
- curstart
) >
905 (maxend
- maxstart
)) {
913 for (i
= 0; i
< 8; i
++) {
914 if (i
>= maxstart
&& i
<= maxend
) {
923 b
= ntohs(addr
->addr16
[i
]);
940 pf_print_state(struct pf_state
*s
)
956 printf("%u ", s
->proto
);
959 pf_print_host(&s
->lan
.addr
, s
->lan
.port
, s
->af
);
961 pf_print_host(&s
->gwy
.addr
, s
->gwy
.port
, s
->af
);
963 pf_print_host(&s
->ext
.addr
, s
->ext
.port
, s
->af
);
964 printf(" [lo=%u high=%u win=%u modulator=%u", s
->src
.seqlo
,
965 s
->src
.seqhi
, s
->src
.max_win
, s
->src
.seqdiff
);
966 if (s
->src
.wscale
&& s
->dst
.wscale
)
967 printf(" wscale=%u", s
->src
.wscale
& PF_WSCALE_MASK
);
969 printf(" [lo=%u high=%u win=%u modulator=%u", s
->dst
.seqlo
,
970 s
->dst
.seqhi
, s
->dst
.max_win
, s
->dst
.seqdiff
);
971 if (s
->src
.wscale
&& s
->dst
.wscale
)
972 printf(" wscale=%u", s
->dst
.wscale
& PF_WSCALE_MASK
);
974 printf(" %u:%u", s
->src
.state
, s
->dst
.state
);
978 pf_print_flags(u_int8_t f
)
1000 #define PF_SET_SKIP_STEPS(i) \
1002 while (head[i] != cur) { \
1003 head[i]->skip[i].ptr = cur; \
1004 head[i] = TAILQ_NEXT(head[i], entries); \
1009 pf_calc_skip_steps(struct pf_rulequeue
*rules
)
1011 struct pf_rule
*cur
, *prev
, *head
[PF_SKIP_COUNT
];
1014 cur
= TAILQ_FIRST(rules
);
1016 for (i
= 0; i
< PF_SKIP_COUNT
; ++i
)
1018 while (cur
!= NULL
) {
1020 if (cur
->kif
!= prev
->kif
|| cur
->ifnot
!= prev
->ifnot
)
1021 PF_SET_SKIP_STEPS(PF_SKIP_IFP
);
1022 if (cur
->direction
!= prev
->direction
)
1023 PF_SET_SKIP_STEPS(PF_SKIP_DIR
);
1024 if (cur
->af
!= prev
->af
)
1025 PF_SET_SKIP_STEPS(PF_SKIP_AF
);
1026 if (cur
->proto
!= prev
->proto
)
1027 PF_SET_SKIP_STEPS(PF_SKIP_PROTO
);
1028 if (cur
->src
.not != prev
->src
.not ||
1029 pf_addr_wrap_neq(&cur
->src
.addr
, &prev
->src
.addr
))
1030 PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR
);
1031 if (cur
->src
.port
[0] != prev
->src
.port
[0] ||
1032 cur
->src
.port
[1] != prev
->src
.port
[1] ||
1033 cur
->src
.port_op
!= prev
->src
.port_op
)
1034 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT
);
1035 if (cur
->dst
.not != prev
->dst
.not ||
1036 pf_addr_wrap_neq(&cur
->dst
.addr
, &prev
->dst
.addr
))
1037 PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR
);
1038 if (cur
->dst
.port
[0] != prev
->dst
.port
[0] ||
1039 cur
->dst
.port
[1] != prev
->dst
.port
[1] ||
1040 cur
->dst
.port_op
!= prev
->dst
.port_op
)
1041 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT
);
1044 cur
= TAILQ_NEXT(cur
, entries
);
1046 for (i
= 0; i
< PF_SKIP_COUNT
; ++i
)
1047 PF_SET_SKIP_STEPS(i
);
1051 pf_addr_wrap_neq(struct pf_addr_wrap
*aw1
, struct pf_addr_wrap
*aw2
)
1053 if (aw1
->type
!= aw2
->type
)
1055 switch (aw1
->type
) {
1056 case PF_ADDR_ADDRMASK
:
1057 if (PF_ANEQ(&aw1
->v
.a
.addr
, &aw2
->v
.a
.addr
, 0))
1059 if (PF_ANEQ(&aw1
->v
.a
.mask
, &aw2
->v
.a
.mask
, 0))
1062 case PF_ADDR_DYNIFTL
:
1063 return (aw1
->p
.dyn
->pfid_kt
!= aw2
->p
.dyn
->pfid_kt
);
1064 case PF_ADDR_NOROUTE
:
1067 return (aw1
->p
.tbl
!= aw2
->p
.tbl
);
1069 printf("invalid address type: %d\n", aw1
->type
);
1075 pf_update_anchor_rules()
1077 struct pf_rule
*rule
;
1080 for (i
= 0; i
< PF_RULESET_MAX
; ++i
)
1081 TAILQ_FOREACH(rule
, pf_main_ruleset
.rules
[i
].active
.ptr
,
1083 if (rule
->anchorname
[0])
1084 rule
->anchor
= pf_find_anchor(rule
->anchorname
);
1086 rule
->anchor
= NULL
;
1090 pf_cksum_fixup(u_int16_t cksum
, u_int16_t old
, u_int16_t
new, u_int8_t udp
)
1096 l
= cksum
+ old
- new;
1097 l
= (l
>> 16) + (l
& 65535);
1105 pf_change_ap(struct pf_addr
*a
, u_int16_t
*p
, u_int16_t
*ic
, u_int16_t
*pc
,
1106 struct pf_addr
*an
, u_int16_t pn
, u_int8_t u
, sa_family_t af
)
1111 PF_ACPY(&ao
, a
, af
);
1119 *ic
= pf_cksum_fixup(pf_cksum_fixup(*ic
,
1120 ao
.addr16
[0], an
->addr16
[0], 0),
1121 ao
.addr16
[1], an
->addr16
[1], 0);
1123 *pc
= pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc
,
1124 ao
.addr16
[0], an
->addr16
[0], u
),
1125 ao
.addr16
[1], an
->addr16
[1], u
),
1131 *pc
= pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1132 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1133 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc
,
1134 ao
.addr16
[0], an
->addr16
[0], u
),
1135 ao
.addr16
[1], an
->addr16
[1], u
),
1136 ao
.addr16
[2], an
->addr16
[2], u
),
1137 ao
.addr16
[3], an
->addr16
[3], u
),
1138 ao
.addr16
[4], an
->addr16
[4], u
),
1139 ao
.addr16
[5], an
->addr16
[5], u
),
1140 ao
.addr16
[6], an
->addr16
[6], u
),
1141 ao
.addr16
[7], an
->addr16
[7], u
),
1149 /* Changes a u_int32_t. Uses a void * so there are no align restrictions */
1151 pf_change_a(void *a
, u_int16_t
*c
, u_int32_t an
, u_int8_t u
)
1155 memcpy(&ao
, a
, sizeof(ao
));
1156 memcpy(a
, &an
, sizeof(u_int32_t
));
1157 *c
= pf_cksum_fixup(pf_cksum_fixup(*c
, ao
/ 65536, an
/ 65536, u
),
1158 ao
% 65536, an
% 65536, u
);
1163 pf_change_a6(struct pf_addr
*a
, u_int16_t
*c
, struct pf_addr
*an
, u_int8_t u
)
1167 PF_ACPY(&ao
, a
, AF_INET6
);
1168 PF_ACPY(a
, an
, AF_INET6
);
1170 *c
= pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1171 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1172 pf_cksum_fixup(pf_cksum_fixup(*c
,
1173 ao
.addr16
[0], an
->addr16
[0], u
),
1174 ao
.addr16
[1], an
->addr16
[1], u
),
1175 ao
.addr16
[2], an
->addr16
[2], u
),
1176 ao
.addr16
[3], an
->addr16
[3], u
),
1177 ao
.addr16
[4], an
->addr16
[4], u
),
1178 ao
.addr16
[5], an
->addr16
[5], u
),
1179 ao
.addr16
[6], an
->addr16
[6], u
),
1180 ao
.addr16
[7], an
->addr16
[7], u
);
1185 pf_change_icmp(struct pf_addr
*ia
, u_int16_t
*ip
, struct pf_addr
*oa
,
1186 struct pf_addr
*na
, u_int16_t np
, u_int16_t
*pc
, u_int16_t
*h2c
,
1187 u_int16_t
*ic
, u_int16_t
*hc
, u_int8_t u
, sa_family_t af
)
1189 struct pf_addr oia
, ooa
;
1191 PF_ACPY(&oia
, ia
, af
);
1192 PF_ACPY(&ooa
, oa
, af
);
1194 /* Change inner protocol port, fix inner protocol checksum. */
1196 u_int16_t oip
= *ip
;
1203 *pc
= pf_cksum_fixup(*pc
, oip
, *ip
, u
);
1204 *ic
= pf_cksum_fixup(*ic
, oip
, *ip
, 0);
1206 *ic
= pf_cksum_fixup(*ic
, opc
, *pc
, 0);
1208 /* Change inner ip address, fix inner ip and icmp checksums. */
1209 PF_ACPY(ia
, na
, af
);
1213 u_int32_t oh2c
= *h2c
;
1215 *h2c
= pf_cksum_fixup(pf_cksum_fixup(*h2c
,
1216 oia
.addr16
[0], ia
->addr16
[0], 0),
1217 oia
.addr16
[1], ia
->addr16
[1], 0);
1218 *ic
= pf_cksum_fixup(pf_cksum_fixup(*ic
,
1219 oia
.addr16
[0], ia
->addr16
[0], 0),
1220 oia
.addr16
[1], ia
->addr16
[1], 0);
1221 *ic
= pf_cksum_fixup(*ic
, oh2c
, *h2c
, 0);
1227 *ic
= pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1228 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1229 pf_cksum_fixup(pf_cksum_fixup(*ic
,
1230 oia
.addr16
[0], ia
->addr16
[0], u
),
1231 oia
.addr16
[1], ia
->addr16
[1], u
),
1232 oia
.addr16
[2], ia
->addr16
[2], u
),
1233 oia
.addr16
[3], ia
->addr16
[3], u
),
1234 oia
.addr16
[4], ia
->addr16
[4], u
),
1235 oia
.addr16
[5], ia
->addr16
[5], u
),
1236 oia
.addr16
[6], ia
->addr16
[6], u
),
1237 oia
.addr16
[7], ia
->addr16
[7], u
);
1241 /* Change outer ip address, fix outer ip or icmpv6 checksum. */
1242 PF_ACPY(oa
, na
, af
);
1246 *hc
= pf_cksum_fixup(pf_cksum_fixup(*hc
,
1247 ooa
.addr16
[0], oa
->addr16
[0], 0),
1248 ooa
.addr16
[1], oa
->addr16
[1], 0);
1253 *ic
= pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1254 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
1255 pf_cksum_fixup(pf_cksum_fixup(*ic
,
1256 ooa
.addr16
[0], oa
->addr16
[0], u
),
1257 ooa
.addr16
[1], oa
->addr16
[1], u
),
1258 ooa
.addr16
[2], oa
->addr16
[2], u
),
1259 ooa
.addr16
[3], oa
->addr16
[3], u
),
1260 ooa
.addr16
[4], oa
->addr16
[4], u
),
1261 ooa
.addr16
[5], oa
->addr16
[5], u
),
1262 ooa
.addr16
[6], oa
->addr16
[6], u
),
1263 ooa
.addr16
[7], oa
->addr16
[7], u
);
1270 pf_send_tcp(const struct pf_rule
*r
, sa_family_t af
,
1271 const struct pf_addr
*saddr
, const struct pf_addr
*daddr
,
1272 u_int16_t sport
, u_int16_t dport
, u_int32_t seq
, u_int32_t ack
,
1273 u_int8_t flags
, u_int16_t win
, u_int16_t mss
, u_int8_t ttl
)
1278 struct ip
*h
= NULL
;
1281 struct ip6_hdr
*h6
= NULL
;
1283 struct tcphdr
*th
= NULL
;
1286 /* maximum segment size tcp option */
1287 tlen
= sizeof(struct tcphdr
);
1294 len
= sizeof(struct ip
) + tlen
;
1299 len
= sizeof(struct ip6_hdr
) + tlen
;
1304 /* create outgoing mbuf */
1305 m
= m_gethdr(MB_DONTWAIT
, MT_HEADER
);
1308 m
->m_pkthdr
.pf_flags
|= PF_MBUF_GENERATED
;
1310 if (r
!= NULL
&& r
->qid
) {
1311 struct altq_tag
*atag
;
1313 mtag
= m_tag_get(PACKET_TAG_PF_QID
, sizeof(*atag
), MB_DONTWAIT
);
1315 atag
= (struct altq_tag
*)(mtag
+ 1);
1317 /* add hints for ecn */
1319 atag
->hdr
= mtod(m
, struct ip
*);
1320 m_tag_prepend(m
, mtag
);
1324 m
->m_data
+= max_linkhdr
;
1325 m
->m_pkthdr
.len
= m
->m_len
= len
;
1326 m
->m_pkthdr
.rcvif
= NULL
;
1327 bzero(m
->m_data
, len
);
1331 h
= mtod(m
, struct ip
*);
1333 /* IP header fields included in the TCP checksum */
1334 h
->ip_p
= IPPROTO_TCP
;
1336 h
->ip_src
.s_addr
= saddr
->v4
.s_addr
;
1337 h
->ip_dst
.s_addr
= daddr
->v4
.s_addr
;
1339 th
= (struct tcphdr
*)((caddr_t
)h
+ sizeof(struct ip
));
1344 h6
= mtod(m
, struct ip6_hdr
*);
1346 /* IP header fields included in the TCP checksum */
1347 h6
->ip6_nxt
= IPPROTO_TCP
;
1348 h6
->ip6_plen
= htons(tlen
);
1349 memcpy(&h6
->ip6_src
, &saddr
->v6
, sizeof(struct in6_addr
));
1350 memcpy(&h6
->ip6_dst
, &daddr
->v6
, sizeof(struct in6_addr
));
1352 th
= (struct tcphdr
*)((caddr_t
)h6
+ sizeof(struct ip6_hdr
));
1358 th
->th_sport
= sport
;
1359 th
->th_dport
= dport
;
1360 th
->th_seq
= htonl(seq
);
1361 th
->th_ack
= htonl(ack
);
1362 th
->th_off
= tlen
>> 2;
1363 th
->th_flags
= flags
;
1364 th
->th_win
= htons(win
);
1367 opt
= (char *)(th
+ 1);
1368 opt
[0] = TCPOPT_MAXSEG
;
1371 bcopy((caddr_t
)&mss
, (caddr_t
)(opt
+ 2), 2);
1378 th
->th_sum
= in_cksum(m
, len
);
1380 /* Finish the IP header */
1382 h
->ip_hl
= sizeof(*h
) >> 2;
1383 h
->ip_tos
= IPTOS_LOWDELAY
;
1385 h
->ip_off
= path_mtu_discovery
? IP_DF
: 0;
1386 h
->ip_ttl
= ttl
? ttl
: ip_defttl
;
1388 ip_output(m
, (void *)NULL
, (void *)NULL
, 0, (void *)NULL
,
1395 th
->th_sum
= in6_cksum(m
, IPPROTO_TCP
,
1396 sizeof(struct ip6_hdr
), tlen
);
1398 h6
->ip6_vfc
|= IPV6_VERSION
;
1399 h6
->ip6_hlim
= IPV6_DEFHLIM
;
1401 ip6_output(m
, NULL
, NULL
, 0, NULL
, NULL
, NULL
);
1408 pf_send_icmp(struct mbuf
*m
, u_int8_t type
, u_int8_t code
, sa_family_t af
,
1413 m0
= m_copypacket(m
, MB_DONTWAIT
);
1416 m0
->m_pkthdr
.pf_flags
|= PF_MBUF_GENERATED
;
1420 struct altq_tag
*atag
;
1422 mtag
= m_tag_get(PACKET_TAG_PF_QID
, sizeof(*atag
), MB_DONTWAIT
);
1424 atag
= (struct altq_tag
*)(mtag
+ 1);
1426 /* add hints for ecn */
1428 atag
->hdr
= mtod(m0
, struct ip
*);
1429 m_tag_prepend(m0
, mtag
);
1437 icmp_error(m0
, type
, code
, 0, (void *)NULL
);
1442 icmp6_error(m0
, type
, code
, 0);
1449 * Return 1 if the addresses a and b match (with mask m), otherwise return 0.
1450 * If n is 0, they match if they are equal. If n is != 0, they match if they
1454 pf_match_addr(u_int8_t n
, struct pf_addr
*a
, struct pf_addr
*m
,
1455 struct pf_addr
*b
, sa_family_t af
)
1462 if ((a
->addr32
[0] & m
->addr32
[0]) ==
1463 (b
->addr32
[0] & m
->addr32
[0]))
1469 if (((a
->addr32
[0] & m
->addr32
[0]) ==
1470 (b
->addr32
[0] & m
->addr32
[0])) &&
1471 ((a
->addr32
[1] & m
->addr32
[1]) ==
1472 (b
->addr32
[1] & m
->addr32
[1])) &&
1473 ((a
->addr32
[2] & m
->addr32
[2]) ==
1474 (b
->addr32
[2] & m
->addr32
[2])) &&
1475 ((a
->addr32
[3] & m
->addr32
[3]) ==
1476 (b
->addr32
[3] & m
->addr32
[3])))
1495 pf_match(u_int8_t op
, u_int32_t a1
, u_int32_t a2
, u_int32_t p
)
1499 return ((p
> a1
) && (p
< a2
));
1501 return ((p
< a1
) || (p
> a2
));
1503 return ((p
>= a1
) && (p
<= a2
));
1517 return (0); /* never reached */
1521 pf_match_port(u_int8_t op
, u_int16_t a1
, u_int16_t a2
, u_int16_t p
)
1526 return (pf_match(op
, a1
, a2
, p
));
1530 pf_match_uid(u_int8_t op
, uid_t a1
, uid_t a2
, uid_t u
)
1532 if (u
== UID_MAX
&& op
!= PF_OP_EQ
&& op
!= PF_OP_NE
)
1534 return (pf_match(op
, a1
, a2
, u
));
1538 pf_match_gid(u_int8_t op
, gid_t a1
, gid_t a2
, gid_t g
)
1540 if (g
== GID_MAX
&& op
!= PF_OP_EQ
&& op
!= PF_OP_NE
)
1542 return (pf_match(op
, a1
, a2
, g
));
1546 pf_match_tag(struct mbuf
*m
, struct pf_rule
*r
, struct pf_rule
*nat_rule
,
1549 if (*tag
== -1) { /* find mbuf tag */
1550 if (nat_rule
!= NULL
&& nat_rule
->tag
)
1551 *tag
= nat_rule
->tag
;
1552 else if (m
->m_pkthdr
.pf_flags
& PF_MBUF_TAGGED
)
1553 *tag
= m
->m_pkthdr
.pf_tag
;
1558 return ((!r
->match_tag_not
&& r
->match_tag
== *tag
) ||
1559 (r
->match_tag_not
&& r
->match_tag
!= *tag
));
1563 pf_tag_packet(struct mbuf
*m
, int tag
)
1568 m
->m_pkthdr
.pf_flags
|= PF_MBUF_TAGGED
;
1569 m
->m_pkthdr
.pf_tag
= tag
;
1572 #define PF_STEP_INTO_ANCHOR(r, a, s, n) \
1574 if ((r) == NULL || (r)->anchor == NULL || \
1575 (s) != NULL || (a) != NULL) \
1576 panic("PF_STEP_INTO_ANCHOR"); \
1578 (s) = TAILQ_FIRST(&(r)->anchor->rulesets); \
1580 while ((s) != NULL && ((r) = \
1581 TAILQ_FIRST((s)->rules[n].active.ptr)) == NULL) \
1582 (s) = TAILQ_NEXT((s), entries); \
1583 if ((r) == NULL) { \
1584 (r) = TAILQ_NEXT((a), entries); \
1589 #define PF_STEP_OUT_OF_ANCHOR(r, a, s, n) \
1591 if ((r) != NULL || (a) == NULL || (s) == NULL) \
1592 panic("PF_STEP_OUT_OF_ANCHOR"); \
1593 (s) = TAILQ_NEXT((s), entries); \
1594 while ((s) != NULL && ((r) = \
1595 TAILQ_FIRST((s)->rules[n].active.ptr)) == NULL) \
1596 (s) = TAILQ_NEXT((s), entries); \
1597 if ((r) == NULL) { \
1598 (r) = TAILQ_NEXT((a), entries); \
1605 pf_poolmask(struct pf_addr
*naddr
, struct pf_addr
*raddr
,
1606 struct pf_addr
*rmask
, struct pf_addr
*saddr
, sa_family_t af
)
1611 naddr
->addr32
[0] = (raddr
->addr32
[0] & rmask
->addr32
[0]) |
1612 ((rmask
->addr32
[0] ^ 0xffffffff ) & saddr
->addr32
[0]);
1616 naddr
->addr32
[0] = (raddr
->addr32
[0] & rmask
->addr32
[0]) |
1617 ((rmask
->addr32
[0] ^ 0xffffffff ) & saddr
->addr32
[0]);
1618 naddr
->addr32
[1] = (raddr
->addr32
[1] & rmask
->addr32
[1]) |
1619 ((rmask
->addr32
[1] ^ 0xffffffff ) & saddr
->addr32
[1]);
1620 naddr
->addr32
[2] = (raddr
->addr32
[2] & rmask
->addr32
[2]) |
1621 ((rmask
->addr32
[2] ^ 0xffffffff ) & saddr
->addr32
[2]);
1622 naddr
->addr32
[3] = (raddr
->addr32
[3] & rmask
->addr32
[3]) |
1623 ((rmask
->addr32
[3] ^ 0xffffffff ) & saddr
->addr32
[3]);
1629 pf_addr_inc(struct pf_addr
*addr
, sa_family_t af
)
1634 addr
->addr32
[0] = htonl(ntohl(addr
->addr32
[0]) + 1);
1638 if (addr
->addr32
[3] == 0xffffffff) {
1639 addr
->addr32
[3] = 0;
1640 if (addr
->addr32
[2] == 0xffffffff) {
1641 addr
->addr32
[2] = 0;
1642 if (addr
->addr32
[1] == 0xffffffff) {
1643 addr
->addr32
[1] = 0;
1645 htonl(ntohl(addr
->addr32
[0]) + 1);
1648 htonl(ntohl(addr
->addr32
[1]) + 1);
1651 htonl(ntohl(addr
->addr32
[2]) + 1);
1654 htonl(ntohl(addr
->addr32
[3]) + 1);
1660 #define mix(a,b,c) \
1662 a -= b; a -= c; a ^= (c >> 13); \
1663 b -= c; b -= a; b ^= (a << 8); \
1664 c -= a; c -= b; c ^= (b >> 13); \
1665 a -= b; a -= c; a ^= (c >> 12); \
1666 b -= c; b -= a; b ^= (a << 16); \
1667 c -= a; c -= b; c ^= (b >> 5); \
1668 a -= b; a -= c; a ^= (c >> 3); \
1669 b -= c; b -= a; b ^= (a << 10); \
1670 c -= a; c -= b; c ^= (b >> 15); \
1674 * hash function based on bridge_hash in if_bridge.c
1677 pf_hash(struct pf_addr
*inaddr
, struct pf_addr
*hash
,
1678 struct pf_poolhashkey
*key
, sa_family_t af
)
1680 u_int32_t a
= 0x9e3779b9, b
= 0x9e3779b9, c
= key
->key32
[0];
1685 a
+= inaddr
->addr32
[0];
1688 hash
->addr32
[0] = c
+ key
->key32
[2];
1693 a
+= inaddr
->addr32
[0];
1694 b
+= inaddr
->addr32
[2];
1696 hash
->addr32
[0] = c
;
1697 a
+= inaddr
->addr32
[1];
1698 b
+= inaddr
->addr32
[3];
1701 hash
->addr32
[1] = c
;
1702 a
+= inaddr
->addr32
[2];
1703 b
+= inaddr
->addr32
[1];
1706 hash
->addr32
[2] = c
;
1707 a
+= inaddr
->addr32
[3];
1708 b
+= inaddr
->addr32
[0];
1711 hash
->addr32
[3] = c
;
1718 pf_map_addr(sa_family_t af
, struct pf_rule
*r
, struct pf_addr
*saddr
,
1719 struct pf_addr
*naddr
, struct pf_addr
*init_addr
, struct pf_src_node
**sn
)
1721 unsigned char hash
[16];
1722 struct pf_pool
*rpool
= &r
->rpool
;
1723 struct pf_addr
*raddr
= &rpool
->cur
->addr
.v
.a
.addr
;
1724 struct pf_addr
*rmask
= &rpool
->cur
->addr
.v
.a
.mask
;
1725 struct pf_pooladdr
*acur
= rpool
->cur
;
1726 struct pf_src_node k
;
1728 if (*sn
== NULL
&& r
->rpool
.opts
& PF_POOL_STICKYADDR
&&
1729 (r
->rpool
.opts
& PF_POOL_TYPEMASK
) != PF_POOL_NONE
) {
1731 PF_ACPY(&k
.addr
, saddr
, af
);
1732 if (r
->rule_flag
& PFRULE_RULESRCTRACK
||
1733 r
->rpool
.opts
& PF_POOL_STICKYADDR
)
1737 pf_status
.scounters
[SCNT_SRC_NODE_SEARCH
]++;
1738 *sn
= RB_FIND(pf_src_tree
, &tree_src_tracking
, &k
);
1739 if (*sn
!= NULL
&& !PF_AZERO(&(*sn
)->raddr
, af
)) {
1740 PF_ACPY(naddr
, &(*sn
)->raddr
, af
);
1741 if (pf_status
.debug
>= PF_DEBUG_MISC
) {
1742 printf("pf_map_addr: src tracking maps ");
1743 pf_print_host(&k
.addr
, 0, af
);
1745 pf_print_host(naddr
, 0, af
);
1752 if (rpool
->cur
->addr
.type
== PF_ADDR_NOROUTE
)
1754 if (rpool
->cur
->addr
.type
== PF_ADDR_DYNIFTL
) {
1755 if (af
== AF_INET
) {
1756 if (rpool
->cur
->addr
.p
.dyn
->pfid_acnt4
< 1 &&
1757 (rpool
->opts
& PF_POOL_TYPEMASK
) !=
1760 raddr
= &rpool
->cur
->addr
.p
.dyn
->pfid_addr4
;
1761 rmask
= &rpool
->cur
->addr
.p
.dyn
->pfid_mask4
;
1763 if (rpool
->cur
->addr
.p
.dyn
->pfid_acnt6
< 1 &&
1764 (rpool
->opts
& PF_POOL_TYPEMASK
) !=
1767 raddr
= &rpool
->cur
->addr
.p
.dyn
->pfid_addr6
;
1768 rmask
= &rpool
->cur
->addr
.p
.dyn
->pfid_mask6
;
1770 } else if (rpool
->cur
->addr
.type
== PF_ADDR_TABLE
) {
1771 if ((rpool
->opts
& PF_POOL_TYPEMASK
) != PF_POOL_ROUNDROBIN
)
1772 return (1); /* unsupported */
1774 raddr
= &rpool
->cur
->addr
.v
.a
.addr
;
1775 rmask
= &rpool
->cur
->addr
.v
.a
.mask
;
1778 switch (rpool
->opts
& PF_POOL_TYPEMASK
) {
1780 PF_ACPY(naddr
, raddr
, af
);
1782 case PF_POOL_BITMASK
:
1783 PF_POOLMASK(naddr
, raddr
, rmask
, saddr
, af
);
1785 case PF_POOL_RANDOM
:
1786 if (init_addr
!= NULL
&& PF_AZERO(init_addr
, af
)) {
1790 rpool
->counter
.addr32
[0] = arc4random();
1795 if (rmask
->addr32
[3] != 0xffffffff)
1796 rpool
->counter
.addr32
[3] = arc4random();
1799 if (rmask
->addr32
[2] != 0xffffffff)
1800 rpool
->counter
.addr32
[2] = arc4random();
1803 if (rmask
->addr32
[1] != 0xffffffff)
1804 rpool
->counter
.addr32
[1] = arc4random();
1807 if (rmask
->addr32
[0] != 0xffffffff)
1808 rpool
->counter
.addr32
[0] = arc4random();
1812 PF_POOLMASK(naddr
, raddr
, rmask
, &rpool
->counter
, af
);
1813 PF_ACPY(init_addr
, naddr
, af
);
1816 PF_AINC(&rpool
->counter
, af
);
1817 PF_POOLMASK(naddr
, raddr
, rmask
, &rpool
->counter
, af
);
1820 case PF_POOL_SRCHASH
:
1821 pf_hash(saddr
, (struct pf_addr
*)&hash
, &rpool
->key
, af
);
1822 PF_POOLMASK(naddr
, raddr
, rmask
, (struct pf_addr
*)&hash
, af
);
1824 case PF_POOL_ROUNDROBIN
:
1825 if (rpool
->cur
->addr
.type
== PF_ADDR_TABLE
) {
1826 if (!pfr_pool_get(rpool
->cur
->addr
.p
.tbl
,
1827 &rpool
->tblidx
, &rpool
->counter
,
1828 &raddr
, &rmask
, af
))
1830 } else if (rpool
->cur
->addr
.type
== PF_ADDR_DYNIFTL
) {
1831 if (!pfr_pool_get(rpool
->cur
->addr
.p
.dyn
->pfid_kt
,
1832 &rpool
->tblidx
, &rpool
->counter
,
1833 &raddr
, &rmask
, af
))
1835 } else if (pf_match_addr(0, raddr
, rmask
, &rpool
->counter
, af
))
1839 if ((rpool
->cur
= TAILQ_NEXT(rpool
->cur
, entries
)) == NULL
)
1840 rpool
->cur
= TAILQ_FIRST(&rpool
->list
);
1841 if (rpool
->cur
->addr
.type
== PF_ADDR_TABLE
) {
1843 if (pfr_pool_get(rpool
->cur
->addr
.p
.tbl
,
1844 &rpool
->tblidx
, &rpool
->counter
,
1845 &raddr
, &rmask
, af
)) {
1846 /* table contains no address of type 'af' */
1847 if (rpool
->cur
!= acur
)
1851 } else if (rpool
->cur
->addr
.type
== PF_ADDR_DYNIFTL
) {
1853 if (pfr_pool_get(rpool
->cur
->addr
.p
.dyn
->pfid_kt
,
1854 &rpool
->tblidx
, &rpool
->counter
,
1855 &raddr
, &rmask
, af
)) {
1856 /* table contains no address of type 'af' */
1857 if (rpool
->cur
!= acur
)
1862 raddr
= &rpool
->cur
->addr
.v
.a
.addr
;
1863 rmask
= &rpool
->cur
->addr
.v
.a
.mask
;
1864 PF_ACPY(&rpool
->counter
, raddr
, af
);
1868 PF_ACPY(naddr
, &rpool
->counter
, af
);
1869 PF_AINC(&rpool
->counter
, af
);
1873 PF_ACPY(&(*sn
)->raddr
, naddr
, af
);
1875 if (pf_status
.debug
>= PF_DEBUG_MISC
&&
1876 (rpool
->opts
& PF_POOL_TYPEMASK
) != PF_POOL_NONE
) {
1877 printf("pf_map_addr: selected address ");
1878 pf_print_host(naddr
, 0, af
);
1886 pf_get_sport(sa_family_t af
, u_int8_t proto
, struct pf_rule
*r
,
1887 struct pf_addr
*saddr
, struct pf_addr
*daddr
, u_int16_t dport
,
1888 struct pf_addr
*naddr
, u_int16_t
*nport
, u_int16_t low
, u_int16_t high
,
1889 struct pf_src_node
**sn
)
1891 struct pf_state key
;
1892 struct pf_addr init_addr
;
1895 bzero(&init_addr
, sizeof(init_addr
));
1896 if (pf_map_addr(af
, r
, saddr
, naddr
, &init_addr
, sn
))
1902 PF_ACPY(&key
.ext
.addr
, daddr
, key
.af
);
1903 PF_ACPY(&key
.gwy
.addr
, naddr
, key
.af
);
1904 key
.ext
.port
= dport
;
1907 * port search; start random, step;
1908 * similar 2 portloop in in_pcbbind
1910 if (!(proto
== IPPROTO_TCP
|| proto
== IPPROTO_UDP
)) {
1912 if (pf_find_state_all(&key
, PF_EXT_GWY
, NULL
) == NULL
)
1914 } else if (low
== 0 && high
== 0) {
1915 key
.gwy
.port
= *nport
;
1916 if (pf_find_state_all(&key
, PF_EXT_GWY
, NULL
) == NULL
)
1918 } else if (low
== high
) {
1919 key
.gwy
.port
= htons(low
);
1920 if (pf_find_state_all(&key
, PF_EXT_GWY
, NULL
) == NULL
) {
1921 *nport
= htons(low
);
1933 cut
= arc4random() % (1 + high
- low
) + low
;
1934 /* low <= cut <= high */
1935 for (tmp
= cut
; tmp
<= high
; ++(tmp
)) {
1936 key
.gwy
.port
= htons(tmp
);
1937 if (pf_find_state_all(&key
, PF_EXT_GWY
, NULL
) ==
1939 *nport
= htons(tmp
);
1943 for (tmp
= cut
- 1; tmp
>= low
; --(tmp
)) {
1944 key
.gwy
.port
= htons(tmp
);
1945 if (pf_find_state_all(&key
, PF_EXT_GWY
, NULL
) ==
1947 *nport
= htons(tmp
);
1953 switch (r
->rpool
.opts
& PF_POOL_TYPEMASK
) {
1954 case PF_POOL_RANDOM
:
1955 case PF_POOL_ROUNDROBIN
:
1956 if (pf_map_addr(af
, r
, saddr
, naddr
, &init_addr
, sn
))
1960 case PF_POOL_SRCHASH
:
1961 case PF_POOL_BITMASK
:
1965 } while (! PF_AEQ(&init_addr
, naddr
, af
) );
1967 return (1); /* none available */
1971 pf_match_translation(struct pf_pdesc
*pd
, struct mbuf
*m
, int off
,
1972 int direction
, struct pfi_kif
*kif
, struct pf_addr
*saddr
, u_int16_t sport
,
1973 struct pf_addr
*daddr
, u_int16_t dport
, int rs_num
)
1975 struct pf_rule
*r
, *rm
= NULL
, *anchorrule
= NULL
;
1976 struct pf_ruleset
*ruleset
= NULL
;
1978 r
= TAILQ_FIRST(pf_main_ruleset
.rules
[rs_num
].active
.ptr
);
1979 while (r
&& rm
== NULL
) {
1980 struct pf_rule_addr
*src
= NULL
, *dst
= NULL
;
1981 struct pf_addr_wrap
*xdst
= NULL
;
1983 if (r
->action
== PF_BINAT
&& direction
== PF_IN
) {
1985 if (r
->rpool
.cur
!= NULL
)
1986 xdst
= &r
->rpool
.cur
->addr
;
1993 if (r
->kif
!= NULL
&&
1994 (r
->kif
!= kif
&& r
->kif
!= kif
->pfik_parent
) == !r
->ifnot
)
1995 r
= r
->skip
[PF_SKIP_IFP
].ptr
;
1996 else if (r
->direction
&& r
->direction
!= direction
)
1997 r
= r
->skip
[PF_SKIP_DIR
].ptr
;
1998 else if (r
->af
&& r
->af
!= pd
->af
)
1999 r
= r
->skip
[PF_SKIP_AF
].ptr
;
2000 else if (r
->proto
&& r
->proto
!= pd
->proto
)
2001 r
= r
->skip
[PF_SKIP_PROTO
].ptr
;
2002 else if (PF_MISMATCHAW(&src
->addr
, saddr
, pd
->af
, src
->not))
2003 r
= r
->skip
[src
== &r
->src
? PF_SKIP_SRC_ADDR
:
2004 PF_SKIP_DST_ADDR
].ptr
;
2005 else if (src
->port_op
&& !pf_match_port(src
->port_op
,
2006 src
->port
[0], src
->port
[1], sport
))
2007 r
= r
->skip
[src
== &r
->src
? PF_SKIP_SRC_PORT
:
2008 PF_SKIP_DST_PORT
].ptr
;
2009 else if (dst
!= NULL
&&
2010 PF_MISMATCHAW(&dst
->addr
, daddr
, pd
->af
, dst
->not))
2011 r
= r
->skip
[PF_SKIP_DST_ADDR
].ptr
;
2012 else if (xdst
!= NULL
&& PF_MISMATCHAW(xdst
, daddr
, pd
->af
, 0))
2013 r
= TAILQ_NEXT(r
, entries
);
2014 else if (dst
!= NULL
&& dst
->port_op
&&
2015 !pf_match_port(dst
->port_op
, dst
->port
[0],
2016 dst
->port
[1], dport
))
2017 r
= r
->skip
[PF_SKIP_DST_PORT
].ptr
;
2018 else if (r
->os_fingerprint
!= PF_OSFP_ANY
&& (pd
->proto
!=
2019 IPPROTO_TCP
|| !pf_osfp_match(pf_osfp_fingerprint(pd
, m
,
2020 off
, pd
->hdr
.tcp
), r
->os_fingerprint
)))
2021 r
= TAILQ_NEXT(r
, entries
);
2022 else if (r
->anchorname
[0] && r
->anchor
== NULL
)
2023 r
= TAILQ_NEXT(r
, entries
);
2024 else if (r
->anchor
== NULL
)
2027 PF_STEP_INTO_ANCHOR(r
, anchorrule
, ruleset
, rs_num
);
2028 if (r
== NULL
&& anchorrule
!= NULL
)
2029 PF_STEP_OUT_OF_ANCHOR(r
, anchorrule
, ruleset
,
2032 if (rm
!= NULL
&& (rm
->action
== PF_NONAT
||
2033 rm
->action
== PF_NORDR
|| rm
->action
== PF_NOBINAT
))
2039 pf_get_translation(struct pf_pdesc
*pd
, struct mbuf
*m
, int off
, int direction
,
2040 struct pfi_kif
*kif
, struct pf_src_node
**sn
,
2041 struct pf_addr
*saddr
, u_int16_t sport
,
2042 struct pf_addr
*daddr
, u_int16_t dport
,
2043 struct pf_addr
*naddr
, u_int16_t
*nport
)
2045 struct pf_rule
*r
= NULL
;
2047 if (direction
== PF_OUT
) {
2048 r
= pf_match_translation(pd
, m
, off
, direction
, kif
, saddr
,
2049 sport
, daddr
, dport
, PF_RULESET_BINAT
);
2051 r
= pf_match_translation(pd
, m
, off
, direction
, kif
,
2052 saddr
, sport
, daddr
, dport
, PF_RULESET_NAT
);
2054 r
= pf_match_translation(pd
, m
, off
, direction
, kif
, saddr
,
2055 sport
, daddr
, dport
, PF_RULESET_RDR
);
2057 r
= pf_match_translation(pd
, m
, off
, direction
, kif
,
2058 saddr
, sport
, daddr
, dport
, PF_RULESET_BINAT
);
2062 switch (r
->action
) {
2068 if (pf_get_sport(pd
->af
, pd
->proto
, r
, saddr
,
2069 daddr
, dport
, naddr
, nport
, r
->rpool
.proxy_port
[0],
2070 r
->rpool
.proxy_port
[1], sn
)) {
2071 DPFPRINTF(PF_DEBUG_MISC
,
2072 ("pf: NAT proxy port allocation "
2074 r
->rpool
.proxy_port
[0],
2075 r
->rpool
.proxy_port
[1]));
2080 switch (direction
) {
2082 if (r
->rpool
.cur
->addr
.type
== PF_ADDR_DYNIFTL
){
2083 if (pd
->af
== AF_INET
) {
2084 if (r
->rpool
.cur
->addr
.p
.dyn
->
2088 &r
->rpool
.cur
->addr
.p
.dyn
->
2090 &r
->rpool
.cur
->addr
.p
.dyn
->
2094 if (r
->rpool
.cur
->addr
.p
.dyn
->
2098 &r
->rpool
.cur
->addr
.p
.dyn
->
2100 &r
->rpool
.cur
->addr
.p
.dyn
->
2106 &r
->rpool
.cur
->addr
.v
.a
.addr
,
2107 &r
->rpool
.cur
->addr
.v
.a
.mask
,
2111 if (r
->src
.addr
.type
== PF_ADDR_DYNIFTL
){
2112 if (pd
->af
== AF_INET
) {
2113 if (r
->src
.addr
.p
.dyn
->
2117 &r
->src
.addr
.p
.dyn
->
2119 &r
->src
.addr
.p
.dyn
->
2123 if (r
->src
.addr
.p
.dyn
->
2127 &r
->src
.addr
.p
.dyn
->
2129 &r
->src
.addr
.p
.dyn
->
2135 &r
->src
.addr
.v
.a
.addr
,
2136 &r
->src
.addr
.v
.a
.mask
, daddr
,
2142 if (pf_map_addr(r
->af
, r
, saddr
, naddr
, NULL
, sn
))
2145 if (r
->rpool
.proxy_port
[1]) {
2146 u_int32_t tmp_nport
;
2148 tmp_nport
= ((ntohs(dport
) -
2149 ntohs(r
->dst
.port
[0])) %
2150 (r
->rpool
.proxy_port
[1] -
2151 r
->rpool
.proxy_port
[0] + 1)) +
2152 r
->rpool
.proxy_port
[0];
2154 /* wrap around if necessary */
2155 if (tmp_nport
> 65535)
2157 *nport
= htons((u_int16_t
)tmp_nport
);
2158 } else if (r
->rpool
.proxy_port
[0])
2159 *nport
= htons(r
->rpool
.proxy_port
[0]);
2171 struct netmsg_hashlookup
{
2172 struct lwkt_msg nm_lmsg
;
2173 struct inpcb
**nm_pinp
;
2174 struct inpcbinfo
*nm_pcbinfo
;
2175 struct pf_addr
*nm_saddr
;
2176 struct pf_addr
*nm_daddr
;
2183 in_pcblookup_hash_handler(struct lwkt_msg
*msg0
)
2185 struct netmsg_hashlookup
*msg
= (struct netmsg_hashlookup
*)msg0
;
2187 if (msg
->nm_af
== AF_INET
)
2188 *msg
->nm_pinp
= in_pcblookup_hash(msg
->nm_pcbinfo
,
2189 msg
->nm_saddr
->v4
, msg
->nm_sport
, msg
->nm_daddr
->v4
,
2190 msg
->nm_dport
, INPLOOKUP_WILDCARD
, NULL
);
2193 *msg
->nm_pinp
= in6_pcblookup_hash(msg
->nm_pcbinfo
,
2194 &msg
->nm_saddr
->v6
, msg
->nm_sport
, &msg
->nm_daddr
->v6
,
2195 msg
->nm_dport
, INPLOOKUP_WILDCARD
, NULL
);
2197 lwkt_replymsg(&msg
->nm_lmsg
, 0);
2203 pf_socket_lookup(uid_t
*uid
, gid_t
*gid
, int direction
, struct pf_pdesc
*pd
)
2205 struct pf_addr
*saddr
, *daddr
;
2206 u_int16_t sport
, dport
;
2207 struct inpcbinfo
*pi
;
2210 struct netmsg_hashlookup
*msg
= NULL
;
2216 if (direction
== PF_IN
) {
2223 switch (pd
->proto
) {
2225 sport
= pd
->hdr
.tcp
->th_sport
;
2226 dport
= pd
->hdr
.tcp
->th_dport
;
2228 pi_cpu
= tcp_addrcpu(saddr
->v4
.s_addr
, sport
, daddr
->v4
.s_addr
, dport
);
2229 pi
= &tcbinfo
[pi_cpu
];
2232 * Our netstack runs lockless on MP systems
2233 * (only for TCP connections at the moment).
2235 * As we are not allowed to read another CPU's tcbinfo,
2236 * we have to ask that CPU via remote call to search the
2239 * Prepare a msg iff data belongs to another CPU.
2241 if (pi_cpu
!= mycpu
->gd_cpuid
) {
2242 msg
= malloc(sizeof(*msg
), M_LWKTMSG
, M_INTWAIT
);
2243 lwkt_initmsg(&msg
->nm_lmsg
, &netisr_afree_rport
, 0,
2244 lwkt_cmd_func(in_pcblookup_hash_handler
),
2246 msg
->nm_pinp
= &inp
;
2247 msg
->nm_pcbinfo
= pi
;
2248 msg
->nm_saddr
= saddr
;
2249 msg
->nm_sport
= sport
;
2250 msg
->nm_daddr
= daddr
;
2251 msg
->nm_dport
= dport
;
2252 msg
->nm_af
= pd
->af
;
2257 sport
= pd
->hdr
.udp
->uh_sport
;
2258 dport
= pd
->hdr
.udp
->uh_dport
;
2264 if (direction
!= PF_IN
) {
2276 * Query other CPU, second part
2278 * msg only gets initialized when:
2280 * 2) the info belongs to another CPU
2282 * Use some switch/case magic to avoid code duplication.
2287 inp
= in6_pcblookup_hash(pi
, &saddr
->v6
, sport
,
2288 &daddr
->v6
, dport
, INPLOOKUP_WILDCARD
, NULL
);
2294 /* FALLTHROUGH if SMP and on other CPU */
2299 lwkt_sendmsg(tcp_cport(pi_cpu
), &msg
->nm_lmsg
);
2303 inp
= in_pcblookup_hash(pi
, saddr
->v4
, sport
, daddr
->v4
,
2304 dport
, INPLOOKUP_WILDCARD
, NULL
);
2313 *uid
= inp
->inp_socket
->so_cred
->cr_uid
;
2314 *gid
= inp
->inp_socket
->so_cred
->cr_groups
[0];
2319 pf_get_wscale(struct mbuf
*m
, int off
, u_int16_t th_off
, sa_family_t af
)
2323 u_int8_t
*opt
, optlen
;
2324 u_int8_t wscale
= 0;
2326 hlen
= th_off
<< 2; /* hlen <= sizeof(hdr) */
2327 if (hlen
<= sizeof(struct tcphdr
))
2329 if (!pf_pull_hdr(m
, off
, hdr
, hlen
, NULL
, NULL
, af
))
2331 opt
= hdr
+ sizeof(struct tcphdr
);
2332 hlen
-= sizeof(struct tcphdr
);
2342 if (wscale
> TCP_MAX_WINSHIFT
)
2343 wscale
= TCP_MAX_WINSHIFT
;
2344 wscale
|= PF_WSCALE_FLAG
;
2359 pf_get_mss(struct mbuf
*m
, int off
, u_int16_t th_off
, sa_family_t af
)
2363 u_int8_t
*opt
, optlen
;
2364 u_int16_t mss
= tcp_mssdflt
;
2366 hlen
= th_off
<< 2; /* hlen <= sizeof(hdr) */
2367 if (hlen
<= sizeof(struct tcphdr
))
2369 if (!pf_pull_hdr(m
, off
, hdr
, hlen
, NULL
, NULL
, af
))
2371 opt
= hdr
+ sizeof(struct tcphdr
);
2372 hlen
-= sizeof(struct tcphdr
);
2373 while (hlen
>= TCPOLEN_MAXSEG
) {
2381 bcopy((caddr_t
)(opt
+ 2), (caddr_t
)&mss
, 2);
2396 pf_calc_mss(struct pf_addr
*addr
, sa_family_t af
, u_int16_t offer
)
2399 struct sockaddr_in
*dst
;
2403 struct sockaddr_in6
*dst6
;
2404 struct route_in6 ro6
;
2406 struct rtentry
*rt
= NULL
;
2408 u_int16_t mss
= tcp_mssdflt
;
2413 hlen
= sizeof(struct ip
);
2414 bzero(&ro
, sizeof(ro
));
2415 dst
= (struct sockaddr_in
*)&ro
.ro_dst
;
2416 dst
->sin_family
= AF_INET
;
2417 dst
->sin_len
= sizeof(*dst
);
2418 dst
->sin_addr
= addr
->v4
;
2419 rtalloc_ign(&ro
, (RTF_CLONING
| RTF_PRCLONING
));
2425 hlen
= sizeof(struct ip6_hdr
);
2426 bzero(&ro6
, sizeof(ro6
));
2427 dst6
= (struct sockaddr_in6
*)&ro6
.ro_dst
;
2428 dst6
->sin6_family
= AF_INET6
;
2429 dst6
->sin6_len
= sizeof(*dst6
);
2430 dst6
->sin6_addr
= addr
->v6
;
2431 rtalloc_ign((struct route
*)&ro6
, (RTF_CLONING
| RTF_PRCLONING
));
2437 if (rt
&& rt
->rt_ifp
) {
2438 mss
= rt
->rt_ifp
->if_mtu
- hlen
- sizeof(struct tcphdr
);
2439 mss
= max(tcp_mssdflt
, mss
);
2442 mss
= min(mss
, offer
);
2443 mss
= max(mss
, 64); /* sanity - at least max opt space */
2448 pf_set_rt_ifp(struct pf_state
*s
, struct pf_addr
*saddr
)
2450 struct pf_rule
*r
= s
->rule
.ptr
;
2453 if (!r
->rt
|| r
->rt
== PF_FASTROUTE
)
2458 pf_map_addr(AF_INET
, r
, saddr
, &s
->rt_addr
, NULL
,
2460 s
->rt_kif
= r
->rpool
.cur
->kif
;
2465 pf_map_addr(AF_INET6
, r
, saddr
, &s
->rt_addr
, NULL
,
2467 s
->rt_kif
= r
->rpool
.cur
->kif
;
2474 pf_test_tcp(struct pf_rule
**rm
, struct pf_state
**sm
, int direction
,
2475 struct pfi_kif
*kif
, struct mbuf
*m
, int off
, void *h
,
2476 struct pf_pdesc
*pd
, struct pf_rule
**am
, struct pf_ruleset
**rsm
)
2478 struct pf_rule
*nr
= NULL
;
2479 struct pf_addr
*saddr
= pd
->src
, *daddr
= pd
->dst
;
2480 struct tcphdr
*th
= pd
->hdr
.tcp
;
2481 u_int16_t bport
, nport
= 0;
2482 sa_family_t af
= pd
->af
;
2486 struct pf_rule
*r
, *a
= NULL
;
2487 struct pf_ruleset
*ruleset
= NULL
;
2488 struct pf_src_node
*nsn
= NULL
;
2492 u_int16_t mss
= tcp_mssdflt
;
2494 r
= TAILQ_FIRST(pf_main_ruleset
.rules
[PF_RULESET_FILTER
].active
.ptr
);
2496 if (direction
== PF_OUT
) {
2497 bport
= nport
= th
->th_sport
;
2498 /* check outgoing packet for BINAT/NAT */
2499 if ((nr
= pf_get_translation(pd
, m
, off
, PF_OUT
, kif
, &nsn
,
2500 saddr
, th
->th_sport
, daddr
, th
->th_dport
,
2501 &pd
->naddr
, &nport
)) != NULL
) {
2502 PF_ACPY(&pd
->baddr
, saddr
, af
);
2503 pf_change_ap(saddr
, &th
->th_sport
, pd
->ip_sum
,
2504 &th
->th_sum
, &pd
->naddr
, nport
, 0, af
);
2511 bport
= nport
= th
->th_dport
;
2512 /* check incoming packet for BINAT/RDR */
2513 if ((nr
= pf_get_translation(pd
, m
, off
, PF_IN
, kif
, &nsn
,
2514 saddr
, th
->th_sport
, daddr
, th
->th_dport
,
2515 &pd
->naddr
, &nport
)) != NULL
) {
2516 PF_ACPY(&pd
->baddr
, daddr
, af
);
2517 pf_change_ap(daddr
, &th
->th_dport
, pd
->ip_sum
,
2518 &th
->th_sum
, &pd
->naddr
, nport
, 0, af
);
2528 if (r
->kif
!= NULL
&&
2529 (r
->kif
!= kif
&& r
->kif
!= kif
->pfik_parent
) == !r
->ifnot
)
2530 r
= r
->skip
[PF_SKIP_IFP
].ptr
;
2531 else if (r
->direction
&& r
->direction
!= direction
)
2532 r
= r
->skip
[PF_SKIP_DIR
].ptr
;
2533 else if (r
->af
&& r
->af
!= af
)
2534 r
= r
->skip
[PF_SKIP_AF
].ptr
;
2535 else if (r
->proto
&& r
->proto
!= IPPROTO_TCP
)
2536 r
= r
->skip
[PF_SKIP_PROTO
].ptr
;
2537 else if (PF_MISMATCHAW(&r
->src
.addr
, saddr
, af
, r
->src
.not))
2538 r
= r
->skip
[PF_SKIP_SRC_ADDR
].ptr
;
2539 else if (r
->src
.port_op
&& !pf_match_port(r
->src
.port_op
,
2540 r
->src
.port
[0], r
->src
.port
[1], th
->th_sport
))
2541 r
= r
->skip
[PF_SKIP_SRC_PORT
].ptr
;
2542 else if (PF_MISMATCHAW(&r
->dst
.addr
, daddr
, af
, r
->dst
.not))
2543 r
= r
->skip
[PF_SKIP_DST_ADDR
].ptr
;
2544 else if (r
->dst
.port_op
&& !pf_match_port(r
->dst
.port_op
,
2545 r
->dst
.port
[0], r
->dst
.port
[1], th
->th_dport
))
2546 r
= r
->skip
[PF_SKIP_DST_PORT
].ptr
;
2547 else if (r
->tos
&& !(r
->tos
& pd
->tos
))
2548 r
= TAILQ_NEXT(r
, entries
);
2549 else if (r
->rule_flag
& PFRULE_FRAGMENT
)
2550 r
= TAILQ_NEXT(r
, entries
);
2551 else if ((r
->flagset
& th
->th_flags
) != r
->flags
)
2552 r
= TAILQ_NEXT(r
, entries
);
2553 else if (r
->uid
.op
&& (lookup
!= -1 || (lookup
=
2554 pf_socket_lookup(&uid
, &gid
, direction
, pd
), 1)) &&
2555 !pf_match_uid(r
->uid
.op
, r
->uid
.uid
[0], r
->uid
.uid
[1],
2557 r
= TAILQ_NEXT(r
, entries
);
2558 else if (r
->gid
.op
&& (lookup
!= -1 || (lookup
=
2559 pf_socket_lookup(&uid
, &gid
, direction
, pd
), 1)) &&
2560 !pf_match_gid(r
->gid
.op
, r
->gid
.gid
[0], r
->gid
.gid
[1],
2562 r
= TAILQ_NEXT(r
, entries
);
2563 else if (r
->match_tag
&& !pf_match_tag(m
, r
, nr
, &tag
))
2564 r
= TAILQ_NEXT(r
, entries
);
2565 else if (r
->anchorname
[0] && r
->anchor
== NULL
)
2566 r
= TAILQ_NEXT(r
, entries
);
2567 else if (r
->os_fingerprint
!= PF_OSFP_ANY
&& !pf_osfp_match(
2568 pf_osfp_fingerprint(pd
, m
, off
, th
), r
->os_fingerprint
))
2569 r
= TAILQ_NEXT(r
, entries
);
2573 if (r
->anchor
== NULL
) {
2579 r
= TAILQ_NEXT(r
, entries
);
2581 PF_STEP_INTO_ANCHOR(r
, a
, ruleset
,
2584 if (r
== NULL
&& a
!= NULL
)
2585 PF_STEP_OUT_OF_ANCHOR(r
, a
, ruleset
,
2592 REASON_SET(&reason
, PFRES_MATCH
);
2596 m_copyback(m
, off
, sizeof(*th
), (caddr_t
)th
);
2597 PFLOG_PACKET(kif
, h
, m
, af
, direction
, reason
, r
, a
, ruleset
);
2600 if ((r
->action
== PF_DROP
) &&
2601 ((r
->rule_flag
& PFRULE_RETURNRST
) ||
2602 (r
->rule_flag
& PFRULE_RETURNICMP
) ||
2603 (r
->rule_flag
& PFRULE_RETURN
))) {
2604 /* undo NAT changes, if they have taken place */
2606 if (direction
== PF_OUT
) {
2607 pf_change_ap(saddr
, &th
->th_sport
, pd
->ip_sum
,
2608 &th
->th_sum
, &pd
->baddr
, bport
, 0, af
);
2611 pf_change_ap(daddr
, &th
->th_dport
, pd
->ip_sum
,
2612 &th
->th_sum
, &pd
->baddr
, bport
, 0, af
);
2616 if (((r
->rule_flag
& PFRULE_RETURNRST
) ||
2617 (r
->rule_flag
& PFRULE_RETURN
)) &&
2618 !(th
->th_flags
& TH_RST
)) {
2619 u_int32_t ack
= ntohl(th
->th_seq
) + pd
->p_len
;
2621 if (th
->th_flags
& TH_SYN
)
2623 if (th
->th_flags
& TH_FIN
)
2625 pf_send_tcp(r
, af
, pd
->dst
,
2626 pd
->src
, th
->th_dport
, th
->th_sport
,
2627 ntohl(th
->th_ack
), ack
, TH_RST
|TH_ACK
, 0, 0,
2629 } else if ((af
== AF_INET
) && r
->return_icmp
)
2630 pf_send_icmp(m
, r
->return_icmp
>> 8,
2631 r
->return_icmp
& 255, af
, r
);
2632 else if ((af
== AF_INET6
) && r
->return_icmp6
)
2633 pf_send_icmp(m
, r
->return_icmp6
>> 8,
2634 r
->return_icmp6
& 255, af
, r
);
2637 if (r
->action
== PF_DROP
)
2640 pf_tag_packet(m
, tag
);
2642 if (r
->keep_state
|| nr
!= NULL
||
2643 (pd
->flags
& PFDESC_TCP_NORM
)) {
2644 /* create new state */
2646 struct pf_state
*s
= NULL
;
2647 struct pf_src_node
*sn
= NULL
;
2649 len
= pd
->tot_len
- off
- (th
->th_off
<< 2);
2651 /* check maximums */
2652 if (r
->max_states
&& (r
->states
>= r
->max_states
))
2654 /* src node for flter rule */
2655 if ((r
->rule_flag
& PFRULE_SRCTRACK
||
2656 r
->rpool
.opts
& PF_POOL_STICKYADDR
) &&
2657 pf_insert_src_node(&sn
, r
, saddr
, af
) != 0)
2659 /* src node for translation rule */
2660 if (nr
!= NULL
&& (nr
->rpool
.opts
& PF_POOL_STICKYADDR
) &&
2661 ((direction
== PF_OUT
&&
2662 pf_insert_src_node(&nsn
, nr
, &pd
->baddr
, af
) != 0) ||
2663 (pf_insert_src_node(&nsn
, nr
, saddr
, af
) != 0)))
2665 s
= pool_get(&pf_state_pl
, PR_NOWAIT
);
2668 if (sn
!= NULL
&& sn
->states
== 0 && sn
->expire
== 0) {
2669 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, sn
);
2670 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
2671 pf_status
.src_nodes
--;
2672 pool_put(&pf_src_tree_pl
, sn
);
2674 if (nsn
!= sn
&& nsn
!= NULL
&& nsn
->states
== 0 &&
2676 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, nsn
);
2677 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
2678 pf_status
.src_nodes
--;
2679 pool_put(&pf_src_tree_pl
, nsn
);
2681 REASON_SET(&reason
, PFRES_MEMORY
);
2684 bzero(s
, sizeof(*s
));
2689 s
->nat_rule
.ptr
= nr
;
2690 if (s
->nat_rule
.ptr
!= NULL
)
2691 s
->nat_rule
.ptr
->states
++;
2693 s
->allow_opts
= r
->allow_opts
;
2694 s
->log
= r
->log
& 2;
2695 s
->proto
= IPPROTO_TCP
;
2696 s
->direction
= direction
;
2698 if (direction
== PF_OUT
) {
2699 PF_ACPY(&s
->gwy
.addr
, saddr
, af
);
2700 s
->gwy
.port
= th
->th_sport
; /* sport */
2701 PF_ACPY(&s
->ext
.addr
, daddr
, af
);
2702 s
->ext
.port
= th
->th_dport
;
2704 PF_ACPY(&s
->lan
.addr
, &pd
->baddr
, af
);
2705 s
->lan
.port
= bport
;
2707 PF_ACPY(&s
->lan
.addr
, &s
->gwy
.addr
, af
);
2708 s
->lan
.port
= s
->gwy
.port
;
2711 PF_ACPY(&s
->lan
.addr
, daddr
, af
);
2712 s
->lan
.port
= th
->th_dport
;
2713 PF_ACPY(&s
->ext
.addr
, saddr
, af
);
2714 s
->ext
.port
= th
->th_sport
;
2716 PF_ACPY(&s
->gwy
.addr
, &pd
->baddr
, af
);
2717 s
->gwy
.port
= bport
;
2719 PF_ACPY(&s
->gwy
.addr
, &s
->lan
.addr
, af
);
2720 s
->gwy
.port
= s
->lan
.port
;
2724 s
->src
.seqlo
= ntohl(th
->th_seq
);
2725 s
->src
.seqhi
= s
->src
.seqlo
+ len
+ 1;
2726 if ((th
->th_flags
& (TH_SYN
|TH_ACK
)) == TH_SYN
&&
2727 r
->keep_state
== PF_STATE_MODULATE
) {
2728 /* Generate sequence number modulator */
2729 while ((s
->src
.seqdiff
= arc4random()) == 0)
2731 pf_change_a(&th
->th_seq
, &th
->th_sum
,
2732 htonl(s
->src
.seqlo
+ s
->src
.seqdiff
), 0);
2736 if (th
->th_flags
& TH_SYN
) {
2738 s
->src
.wscale
= pf_get_wscale(m
, off
, th
->th_off
, af
);
2740 s
->src
.max_win
= MAX(ntohs(th
->th_win
), 1);
2741 if (s
->src
.wscale
& PF_WSCALE_MASK
) {
2742 /* Remove scale factor from initial window */
2743 int win
= s
->src
.max_win
;
2744 win
+= 1 << (s
->src
.wscale
& PF_WSCALE_MASK
);
2745 s
->src
.max_win
= (win
- 1) >>
2746 (s
->src
.wscale
& PF_WSCALE_MASK
);
2748 if (th
->th_flags
& TH_FIN
)
2752 s
->src
.state
= TCPS_SYN_SENT
;
2753 s
->dst
.state
= TCPS_CLOSED
;
2754 s
->creation
= time_second
;
2755 s
->expire
= time_second
;
2756 s
->timeout
= PFTM_TCP_FIRST_PACKET
;
2757 pf_set_rt_ifp(s
, saddr
);
2760 s
->src_node
->states
++;
2763 PF_ACPY(&nsn
->raddr
, &pd
->naddr
, af
);
2764 s
->nat_src_node
= nsn
;
2765 s
->nat_src_node
->states
++;
2767 if ((pd
->flags
& PFDESC_TCP_NORM
) && pf_normalize_tcp_init(m
,
2768 off
, pd
, th
, &s
->src
, &s
->dst
)) {
2769 REASON_SET(&reason
, PFRES_MEMORY
);
2770 pf_src_tree_remove_state(s
);
2771 pool_put(&pf_state_pl
, s
);
2774 if ((pd
->flags
& PFDESC_TCP_NORM
) && s
->src
.scrub
&&
2775 pf_normalize_tcp_stateful(m
, off
, pd
, &reason
, th
, &s
->src
,
2776 &s
->dst
, &rewrite
)) {
2777 pf_normalize_tcp_cleanup(s
);
2778 pf_src_tree_remove_state(s
);
2779 pool_put(&pf_state_pl
, s
);
2782 if (pf_insert_state(BOUND_IFACE(r
, kif
), s
)) {
2783 pf_normalize_tcp_cleanup(s
);
2784 REASON_SET(&reason
, PFRES_MEMORY
);
2785 pf_src_tree_remove_state(s
);
2786 pool_put(&pf_state_pl
, s
);
2790 if ((th
->th_flags
& (TH_SYN
|TH_ACK
)) == TH_SYN
&&
2791 r
->keep_state
== PF_STATE_SYNPROXY
) {
2792 s
->src
.state
= PF_TCPS_PROXY_SRC
;
2794 if (direction
== PF_OUT
) {
2795 pf_change_ap(saddr
, &th
->th_sport
,
2796 pd
->ip_sum
, &th
->th_sum
, &pd
->baddr
,
2799 pf_change_ap(daddr
, &th
->th_dport
,
2800 pd
->ip_sum
, &th
->th_sum
, &pd
->baddr
,
2804 s
->src
.seqhi
= arc4random();
2805 /* Find mss option */
2806 mss
= pf_get_mss(m
, off
, th
->th_off
, af
);
2807 mss
= pf_calc_mss(saddr
, af
, mss
);
2808 mss
= pf_calc_mss(daddr
, af
, mss
);
2810 pf_send_tcp(r
, af
, daddr
, saddr
, th
->th_dport
,
2811 th
->th_sport
, s
->src
.seqhi
, ntohl(th
->th_seq
) + 1,
2812 TH_SYN
|TH_ACK
, 0, s
->src
.mss
, 0);
2813 return (PF_SYNPROXY_DROP
);
2817 /* copy back packet headers if we performed NAT operations */
2819 m_copyback(m
, off
, sizeof(*th
), (caddr_t
)th
);
2825 pf_test_udp(struct pf_rule
**rm
, struct pf_state
**sm
, int direction
,
2826 struct pfi_kif
*kif
, struct mbuf
*m
, int off
, void *h
,
2827 struct pf_pdesc
*pd
, struct pf_rule
**am
, struct pf_ruleset
**rsm
)
2829 struct pf_rule
*nr
= NULL
;
2830 struct pf_addr
*saddr
= pd
->src
, *daddr
= pd
->dst
;
2831 struct udphdr
*uh
= pd
->hdr
.udp
;
2832 u_int16_t bport
, nport
= 0;
2833 sa_family_t af
= pd
->af
;
2837 struct pf_rule
*r
, *a
= NULL
;
2838 struct pf_ruleset
*ruleset
= NULL
;
2839 struct pf_src_node
*nsn
= NULL
;
2844 r
= TAILQ_FIRST(pf_main_ruleset
.rules
[PF_RULESET_FILTER
].active
.ptr
);
2846 if (direction
== PF_OUT
) {
2847 bport
= nport
= uh
->uh_sport
;
2848 /* check outgoing packet for BINAT/NAT */
2849 if ((nr
= pf_get_translation(pd
, m
, off
, PF_OUT
, kif
, &nsn
,
2850 saddr
, uh
->uh_sport
, daddr
, uh
->uh_dport
,
2851 &pd
->naddr
, &nport
)) != NULL
) {
2852 PF_ACPY(&pd
->baddr
, saddr
, af
);
2853 pf_change_ap(saddr
, &uh
->uh_sport
, pd
->ip_sum
,
2854 &uh
->uh_sum
, &pd
->naddr
, nport
, 1, af
);
2861 bport
= nport
= uh
->uh_dport
;
2862 /* check incoming packet for BINAT/RDR */
2863 if ((nr
= pf_get_translation(pd
, m
, off
, PF_IN
, kif
, &nsn
,
2864 saddr
, uh
->uh_sport
, daddr
, uh
->uh_dport
, &pd
->naddr
,
2866 PF_ACPY(&pd
->baddr
, daddr
, af
);
2867 pf_change_ap(daddr
, &uh
->uh_dport
, pd
->ip_sum
,
2868 &uh
->uh_sum
, &pd
->naddr
, nport
, 1, af
);
2878 if (r
->kif
!= NULL
&&
2879 (r
->kif
!= kif
&& r
->kif
!= kif
->pfik_parent
) == !r
->ifnot
)
2880 r
= r
->skip
[PF_SKIP_IFP
].ptr
;
2881 else if (r
->direction
&& r
->direction
!= direction
)
2882 r
= r
->skip
[PF_SKIP_DIR
].ptr
;
2883 else if (r
->af
&& r
->af
!= af
)
2884 r
= r
->skip
[PF_SKIP_AF
].ptr
;
2885 else if (r
->proto
&& r
->proto
!= IPPROTO_UDP
)
2886 r
= r
->skip
[PF_SKIP_PROTO
].ptr
;
2887 else if (PF_MISMATCHAW(&r
->src
.addr
, saddr
, af
, r
->src
.not))
2888 r
= r
->skip
[PF_SKIP_SRC_ADDR
].ptr
;
2889 else if (r
->src
.port_op
&& !pf_match_port(r
->src
.port_op
,
2890 r
->src
.port
[0], r
->src
.port
[1], uh
->uh_sport
))
2891 r
= r
->skip
[PF_SKIP_SRC_PORT
].ptr
;
2892 else if (PF_MISMATCHAW(&r
->dst
.addr
, daddr
, af
, r
->dst
.not))
2893 r
= r
->skip
[PF_SKIP_DST_ADDR
].ptr
;
2894 else if (r
->dst
.port_op
&& !pf_match_port(r
->dst
.port_op
,
2895 r
->dst
.port
[0], r
->dst
.port
[1], uh
->uh_dport
))
2896 r
= r
->skip
[PF_SKIP_DST_PORT
].ptr
;
2897 else if (r
->tos
&& !(r
->tos
& pd
->tos
))
2898 r
= TAILQ_NEXT(r
, entries
);
2899 else if (r
->rule_flag
& PFRULE_FRAGMENT
)
2900 r
= TAILQ_NEXT(r
, entries
);
2901 else if (r
->uid
.op
&& (lookup
!= -1 || (lookup
=
2902 pf_socket_lookup(&uid
, &gid
, direction
, pd
), 1)) &&
2903 !pf_match_uid(r
->uid
.op
, r
->uid
.uid
[0], r
->uid
.uid
[1],
2905 r
= TAILQ_NEXT(r
, entries
);
2906 else if (r
->gid
.op
&& (lookup
!= -1 || (lookup
=
2907 pf_socket_lookup(&uid
, &gid
, direction
, pd
), 1)) &&
2908 !pf_match_gid(r
->gid
.op
, r
->gid
.gid
[0], r
->gid
.gid
[1],
2910 r
= TAILQ_NEXT(r
, entries
);
2911 else if (r
->match_tag
&& !pf_match_tag(m
, r
, nr
, &tag
))
2912 r
= TAILQ_NEXT(r
, entries
);
2913 else if (r
->anchorname
[0] && r
->anchor
== NULL
)
2914 r
= TAILQ_NEXT(r
, entries
);
2915 else if (r
->os_fingerprint
!= PF_OSFP_ANY
)
2916 r
= TAILQ_NEXT(r
, entries
);
2920 if (r
->anchor
== NULL
) {
2926 r
= TAILQ_NEXT(r
, entries
);
2928 PF_STEP_INTO_ANCHOR(r
, a
, ruleset
,
2931 if (r
== NULL
&& a
!= NULL
)
2932 PF_STEP_OUT_OF_ANCHOR(r
, a
, ruleset
,
2939 REASON_SET(&reason
, PFRES_MATCH
);
2943 m_copyback(m
, off
, sizeof(*uh
), (caddr_t
)uh
);
2944 PFLOG_PACKET(kif
, h
, m
, af
, direction
, reason
, r
, a
, ruleset
);
2947 if ((r
->action
== PF_DROP
) &&
2948 ((r
->rule_flag
& PFRULE_RETURNICMP
) ||
2949 (r
->rule_flag
& PFRULE_RETURN
))) {
2950 /* undo NAT changes, if they have taken place */
2952 if (direction
== PF_OUT
) {
2953 pf_change_ap(saddr
, &uh
->uh_sport
, pd
->ip_sum
,
2954 &uh
->uh_sum
, &pd
->baddr
, bport
, 1, af
);
2957 pf_change_ap(daddr
, &uh
->uh_dport
, pd
->ip_sum
,
2958 &uh
->uh_sum
, &pd
->baddr
, bport
, 1, af
);
2962 if ((af
== AF_INET
) && r
->return_icmp
)
2963 pf_send_icmp(m
, r
->return_icmp
>> 8,
2964 r
->return_icmp
& 255, af
, r
);
2965 else if ((af
== AF_INET6
) && r
->return_icmp6
)
2966 pf_send_icmp(m
, r
->return_icmp6
>> 8,
2967 r
->return_icmp6
& 255, af
, r
);
2970 if (r
->action
== PF_DROP
)
2973 pf_tag_packet(m
, tag
);
2975 if (r
->keep_state
|| nr
!= NULL
) {
2976 /* create new state */
2977 struct pf_state
*s
= NULL
;
2978 struct pf_src_node
*sn
= NULL
;
2980 /* check maximums */
2981 if (r
->max_states
&& (r
->states
>= r
->max_states
))
2983 /* src node for flter rule */
2984 if ((r
->rule_flag
& PFRULE_SRCTRACK
||
2985 r
->rpool
.opts
& PF_POOL_STICKYADDR
) &&
2986 pf_insert_src_node(&sn
, r
, saddr
, af
) != 0)
2988 /* src node for translation rule */
2989 if (nr
!= NULL
&& (nr
->rpool
.opts
& PF_POOL_STICKYADDR
) &&
2990 ((direction
== PF_OUT
&&
2991 pf_insert_src_node(&nsn
, nr
, &pd
->baddr
, af
) != 0) ||
2992 (pf_insert_src_node(&nsn
, nr
, saddr
, af
) != 0)))
2994 s
= pool_get(&pf_state_pl
, PR_NOWAIT
);
2997 if (sn
!= NULL
&& sn
->states
== 0 && sn
->expire
== 0) {
2998 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, sn
);
2999 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
3000 pf_status
.src_nodes
--;
3001 pool_put(&pf_src_tree_pl
, sn
);
3003 if (nsn
!= sn
&& nsn
!= NULL
&& nsn
->states
== 0 &&
3005 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, nsn
);
3006 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
3007 pf_status
.src_nodes
--;
3008 pool_put(&pf_src_tree_pl
, nsn
);
3010 REASON_SET(&reason
, PFRES_MEMORY
);
3013 bzero(s
, sizeof(*s
));
3018 s
->nat_rule
.ptr
= nr
;
3019 if (s
->nat_rule
.ptr
!= NULL
)
3020 s
->nat_rule
.ptr
->states
++;
3022 s
->allow_opts
= r
->allow_opts
;
3023 s
->log
= r
->log
& 2;
3024 s
->proto
= IPPROTO_UDP
;
3025 s
->direction
= direction
;
3027 if (direction
== PF_OUT
) {
3028 PF_ACPY(&s
->gwy
.addr
, saddr
, af
);
3029 s
->gwy
.port
= uh
->uh_sport
;
3030 PF_ACPY(&s
->ext
.addr
, daddr
, af
);
3031 s
->ext
.port
= uh
->uh_dport
;
3033 PF_ACPY(&s
->lan
.addr
, &pd
->baddr
, af
);
3034 s
->lan
.port
= bport
;
3036 PF_ACPY(&s
->lan
.addr
, &s
->gwy
.addr
, af
);
3037 s
->lan
.port
= s
->gwy
.port
;
3040 PF_ACPY(&s
->lan
.addr
, daddr
, af
);
3041 s
->lan
.port
= uh
->uh_dport
;
3042 PF_ACPY(&s
->ext
.addr
, saddr
, af
);
3043 s
->ext
.port
= uh
->uh_sport
;
3045 PF_ACPY(&s
->gwy
.addr
, &pd
->baddr
, af
);
3046 s
->gwy
.port
= bport
;
3048 PF_ACPY(&s
->gwy
.addr
, &s
->lan
.addr
, af
);
3049 s
->gwy
.port
= s
->lan
.port
;
3052 s
->src
.state
= PFUDPS_SINGLE
;
3053 s
->dst
.state
= PFUDPS_NO_TRAFFIC
;
3054 s
->creation
= time_second
;
3055 s
->expire
= time_second
;
3056 s
->timeout
= PFTM_UDP_FIRST_PACKET
;
3057 pf_set_rt_ifp(s
, saddr
);
3060 s
->src_node
->states
++;
3063 PF_ACPY(&nsn
->raddr
, &pd
->naddr
, af
);
3064 s
->nat_src_node
= nsn
;
3065 s
->nat_src_node
->states
++;
3067 if (pf_insert_state(BOUND_IFACE(r
, kif
), s
)) {
3068 REASON_SET(&reason
, PFRES_MEMORY
);
3069 pf_src_tree_remove_state(s
);
3070 pool_put(&pf_state_pl
, s
);
3076 /* copy back packet headers if we performed NAT operations */
3078 m_copyback(m
, off
, sizeof(*uh
), (caddr_t
)uh
);
3084 pf_test_icmp(struct pf_rule
**rm
, struct pf_state
**sm
, int direction
,
3085 struct pfi_kif
*kif
, struct mbuf
*m
, int off
, void *h
,
3086 struct pf_pdesc
*pd
, struct pf_rule
**am
, struct pf_ruleset
**rsm
)
3088 struct pf_rule
*nr
= NULL
;
3089 struct pf_addr
*saddr
= pd
->src
, *daddr
= pd
->dst
;
3090 struct pf_rule
*r
, *a
= NULL
;
3091 struct pf_ruleset
*ruleset
= NULL
;
3092 struct pf_src_node
*nsn
= NULL
;
3094 u_int16_t icmpid
= 0;
3095 sa_family_t af
= pd
->af
;
3096 u_int8_t icmptype
= 0, icmpcode
= 0;
3103 switch (pd
->proto
) {
3106 icmptype
= pd
->hdr
.icmp
->icmp_type
;
3107 icmpcode
= pd
->hdr
.icmp
->icmp_code
;
3108 icmpid
= pd
->hdr
.icmp
->icmp_id
;
3110 if (icmptype
== ICMP_UNREACH
||
3111 icmptype
== ICMP_SOURCEQUENCH
||
3112 icmptype
== ICMP_REDIRECT
||
3113 icmptype
== ICMP_TIMXCEED
||
3114 icmptype
== ICMP_PARAMPROB
)
3119 case IPPROTO_ICMPV6
:
3120 icmptype
= pd
->hdr
.icmp6
->icmp6_type
;
3121 icmpcode
= pd
->hdr
.icmp6
->icmp6_code
;
3122 icmpid
= pd
->hdr
.icmp6
->icmp6_id
;
3124 if (icmptype
== ICMP6_DST_UNREACH
||
3125 icmptype
== ICMP6_PACKET_TOO_BIG
||
3126 icmptype
== ICMP6_TIME_EXCEEDED
||
3127 icmptype
== ICMP6_PARAM_PROB
)
3133 r
= TAILQ_FIRST(pf_main_ruleset
.rules
[PF_RULESET_FILTER
].active
.ptr
);
3135 if (direction
== PF_OUT
) {
3136 /* check outgoing packet for BINAT/NAT */
3137 if ((nr
= pf_get_translation(pd
, m
, off
, PF_OUT
, kif
, &nsn
,
3138 saddr
, 0, daddr
, 0, &pd
->naddr
, NULL
)) != NULL
) {
3139 PF_ACPY(&pd
->baddr
, saddr
, af
);
3143 pf_change_a(&saddr
->v4
.s_addr
, pd
->ip_sum
,
3144 pd
->naddr
.v4
.s_addr
, 0);
3149 pf_change_a6(saddr
, &pd
->hdr
.icmp6
->icmp6_cksum
,
3160 /* check incoming packet for BINAT/RDR */
3161 if ((nr
= pf_get_translation(pd
, m
, off
, PF_IN
, kif
, &nsn
,
3162 saddr
, 0, daddr
, 0, &pd
->naddr
, NULL
)) != NULL
) {
3163 PF_ACPY(&pd
->baddr
, daddr
, af
);
3167 pf_change_a(&daddr
->v4
.s_addr
,
3168 pd
->ip_sum
, pd
->naddr
.v4
.s_addr
, 0);
3173 pf_change_a6(daddr
, &pd
->hdr
.icmp6
->icmp6_cksum
,
3187 if (r
->kif
!= NULL
&&
3188 (r
->kif
!= kif
&& r
->kif
!= kif
->pfik_parent
) == !r
->ifnot
)
3189 r
= r
->skip
[PF_SKIP_IFP
].ptr
;
3190 else if (r
->direction
&& r
->direction
!= direction
)
3191 r
= r
->skip
[PF_SKIP_DIR
].ptr
;
3192 else if (r
->af
&& r
->af
!= af
)
3193 r
= r
->skip
[PF_SKIP_AF
].ptr
;
3194 else if (r
->proto
&& r
->proto
!= pd
->proto
)
3195 r
= r
->skip
[PF_SKIP_PROTO
].ptr
;
3196 else if (PF_MISMATCHAW(&r
->src
.addr
, saddr
, af
, r
->src
.not))
3197 r
= r
->skip
[PF_SKIP_SRC_ADDR
].ptr
;
3198 else if (PF_MISMATCHAW(&r
->dst
.addr
, daddr
, af
, r
->dst
.not))
3199 r
= r
->skip
[PF_SKIP_DST_ADDR
].ptr
;
3200 else if (r
->type
&& r
->type
!= icmptype
+ 1)
3201 r
= TAILQ_NEXT(r
, entries
);
3202 else if (r
->code
&& r
->code
!= icmpcode
+ 1)
3203 r
= TAILQ_NEXT(r
, entries
);
3204 else if (r
->tos
&& !(r
->tos
& pd
->tos
))
3205 r
= TAILQ_NEXT(r
, entries
);
3206 else if (r
->rule_flag
& PFRULE_FRAGMENT
)
3207 r
= TAILQ_NEXT(r
, entries
);
3208 else if (r
->match_tag
&& !pf_match_tag(m
, r
, nr
, &tag
))
3209 r
= TAILQ_NEXT(r
, entries
);
3210 else if (r
->anchorname
[0] && r
->anchor
== NULL
)
3211 r
= TAILQ_NEXT(r
, entries
);
3212 else if (r
->os_fingerprint
!= PF_OSFP_ANY
)
3213 r
= TAILQ_NEXT(r
, entries
);
3217 if (r
->anchor
== NULL
) {
3223 r
= TAILQ_NEXT(r
, entries
);
3225 PF_STEP_INTO_ANCHOR(r
, a
, ruleset
,
3228 if (r
== NULL
&& a
!= NULL
)
3229 PF_STEP_OUT_OF_ANCHOR(r
, a
, ruleset
,
3236 REASON_SET(&reason
, PFRES_MATCH
);
3241 m_copyback(m
, off
, sizeof(struct icmp6_hdr
),
3242 (caddr_t
)pd
->hdr
.icmp6
);
3244 PFLOG_PACKET(kif
, h
, m
, af
, direction
, reason
, r
, a
, ruleset
);
3247 if (r
->action
!= PF_PASS
)
3250 pf_tag_packet(m
, tag
);
3252 if (!state_icmp
&& (r
->keep_state
|| nr
!= NULL
)) {
3253 /* create new state */
3254 struct pf_state
*s
= NULL
;
3255 struct pf_src_node
*sn
= NULL
;
3257 /* check maximums */
3258 if (r
->max_states
&& (r
->states
>= r
->max_states
))
3260 /* src node for flter rule */
3261 if ((r
->rule_flag
& PFRULE_SRCTRACK
||
3262 r
->rpool
.opts
& PF_POOL_STICKYADDR
) &&
3263 pf_insert_src_node(&sn
, r
, saddr
, af
) != 0)
3265 /* src node for translation rule */
3266 if (nr
!= NULL
&& (nr
->rpool
.opts
& PF_POOL_STICKYADDR
) &&
3267 ((direction
== PF_OUT
&&
3268 pf_insert_src_node(&nsn
, nr
, &pd
->baddr
, af
) != 0) ||
3269 (pf_insert_src_node(&nsn
, nr
, saddr
, af
) != 0)))
3271 s
= pool_get(&pf_state_pl
, PR_NOWAIT
);
3274 if (sn
!= NULL
&& sn
->states
== 0 && sn
->expire
== 0) {
3275 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, sn
);
3276 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
3277 pf_status
.src_nodes
--;
3278 pool_put(&pf_src_tree_pl
, sn
);
3280 if (nsn
!= sn
&& nsn
!= NULL
&& nsn
->states
== 0 &&
3282 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, nsn
);
3283 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
3284 pf_status
.src_nodes
--;
3285 pool_put(&pf_src_tree_pl
, nsn
);
3287 REASON_SET(&reason
, PFRES_MEMORY
);
3290 bzero(s
, sizeof(*s
));
3295 s
->nat_rule
.ptr
= nr
;
3296 if (s
->nat_rule
.ptr
!= NULL
)
3297 s
->nat_rule
.ptr
->states
++;
3299 s
->allow_opts
= r
->allow_opts
;
3300 s
->log
= r
->log
& 2;
3301 s
->proto
= pd
->proto
;
3302 s
->direction
= direction
;
3304 if (direction
== PF_OUT
) {
3305 PF_ACPY(&s
->gwy
.addr
, saddr
, af
);
3306 s
->gwy
.port
= icmpid
;
3307 PF_ACPY(&s
->ext
.addr
, daddr
, af
);
3308 s
->ext
.port
= icmpid
;
3310 PF_ACPY(&s
->lan
.addr
, &pd
->baddr
, af
);
3312 PF_ACPY(&s
->lan
.addr
, &s
->gwy
.addr
, af
);
3313 s
->lan
.port
= icmpid
;
3315 PF_ACPY(&s
->lan
.addr
, daddr
, af
);
3316 s
->lan
.port
= icmpid
;
3317 PF_ACPY(&s
->ext
.addr
, saddr
, af
);
3318 s
->ext
.port
= icmpid
;
3320 PF_ACPY(&s
->gwy
.addr
, &pd
->baddr
, af
);
3322 PF_ACPY(&s
->gwy
.addr
, &s
->lan
.addr
, af
);
3323 s
->gwy
.port
= icmpid
;
3325 s
->creation
= time_second
;
3326 s
->expire
= time_second
;
3327 s
->timeout
= PFTM_ICMP_FIRST_PACKET
;
3328 pf_set_rt_ifp(s
, saddr
);
3331 s
->src_node
->states
++;
3334 PF_ACPY(&nsn
->raddr
, &pd
->naddr
, af
);
3335 s
->nat_src_node
= nsn
;
3336 s
->nat_src_node
->states
++;
3338 if (pf_insert_state(BOUND_IFACE(r
, kif
), s
)) {
3339 REASON_SET(&reason
, PFRES_MEMORY
);
3340 pf_src_tree_remove_state(s
);
3341 pool_put(&pf_state_pl
, s
);
3348 /* copy back packet headers if we performed IPv6 NAT operations */
3350 m_copyback(m
, off
, sizeof(struct icmp6_hdr
),
3351 (caddr_t
)pd
->hdr
.icmp6
);
3358 pf_test_other(struct pf_rule
**rm
, struct pf_state
**sm
, int direction
,
3359 struct pfi_kif
*kif
, struct mbuf
*m
, int off
, void *h
, struct pf_pdesc
*pd
,
3360 struct pf_rule
**am
, struct pf_ruleset
**rsm
)
3362 struct pf_rule
*nr
= NULL
;
3363 struct pf_rule
*r
, *a
= NULL
;
3364 struct pf_ruleset
*ruleset
= NULL
;
3365 struct pf_src_node
*nsn
= NULL
;
3366 struct pf_addr
*saddr
= pd
->src
, *daddr
= pd
->dst
;
3367 sa_family_t af
= pd
->af
;
3371 r
= TAILQ_FIRST(pf_main_ruleset
.rules
[PF_RULESET_FILTER
].active
.ptr
);
3373 if (direction
== PF_OUT
) {
3374 /* check outgoing packet for BINAT/NAT */
3375 if ((nr
= pf_get_translation(pd
, m
, off
, PF_OUT
, kif
, &nsn
,
3376 saddr
, 0, daddr
, 0, &pd
->naddr
, NULL
)) != NULL
) {
3377 PF_ACPY(&pd
->baddr
, saddr
, af
);
3381 pf_change_a(&saddr
->v4
.s_addr
, pd
->ip_sum
,
3382 pd
->naddr
.v4
.s_addr
, 0);
3387 PF_ACPY(saddr
, &pd
->naddr
, af
);
3396 /* check incoming packet for BINAT/RDR */
3397 if ((nr
= pf_get_translation(pd
, m
, off
, PF_IN
, kif
, &nsn
,
3398 saddr
, 0, daddr
, 0, &pd
->naddr
, NULL
)) != NULL
) {
3399 PF_ACPY(&pd
->baddr
, daddr
, af
);
3403 pf_change_a(&daddr
->v4
.s_addr
,
3404 pd
->ip_sum
, pd
->naddr
.v4
.s_addr
, 0);
3409 PF_ACPY(daddr
, &pd
->naddr
, af
);
3421 if (r
->kif
!= NULL
&&
3422 (r
->kif
!= kif
&& r
->kif
!= kif
->pfik_parent
) == !r
->ifnot
)
3423 r
= r
->skip
[PF_SKIP_IFP
].ptr
;
3424 else if (r
->direction
&& r
->direction
!= direction
)
3425 r
= r
->skip
[PF_SKIP_DIR
].ptr
;
3426 else if (r
->af
&& r
->af
!= af
)
3427 r
= r
->skip
[PF_SKIP_AF
].ptr
;
3428 else if (r
->proto
&& r
->proto
!= pd
->proto
)
3429 r
= r
->skip
[PF_SKIP_PROTO
].ptr
;
3430 else if (PF_MISMATCHAW(&r
->src
.addr
, pd
->src
, af
, r
->src
.not))
3431 r
= r
->skip
[PF_SKIP_SRC_ADDR
].ptr
;
3432 else if (PF_MISMATCHAW(&r
->dst
.addr
, pd
->dst
, af
, r
->dst
.not))
3433 r
= r
->skip
[PF_SKIP_DST_ADDR
].ptr
;
3434 else if (r
->tos
&& !(r
->tos
& pd
->tos
))
3435 r
= TAILQ_NEXT(r
, entries
);
3436 else if (r
->rule_flag
& PFRULE_FRAGMENT
)
3437 r
= TAILQ_NEXT(r
, entries
);
3438 else if (r
->match_tag
&& !pf_match_tag(m
, r
, nr
, &tag
))
3439 r
= TAILQ_NEXT(r
, entries
);
3440 else if (r
->anchorname
[0] && r
->anchor
== NULL
)
3441 r
= TAILQ_NEXT(r
, entries
);
3442 else if (r
->os_fingerprint
!= PF_OSFP_ANY
)
3443 r
= TAILQ_NEXT(r
, entries
);
3447 if (r
->anchor
== NULL
) {
3453 r
= TAILQ_NEXT(r
, entries
);
3455 PF_STEP_INTO_ANCHOR(r
, a
, ruleset
,
3458 if (r
== NULL
&& a
!= NULL
)
3459 PF_STEP_OUT_OF_ANCHOR(r
, a
, ruleset
,
3466 REASON_SET(&reason
, PFRES_MATCH
);
3469 PFLOG_PACKET(kif
, h
, m
, af
, direction
, reason
, r
, a
, ruleset
);
3471 if ((r
->action
== PF_DROP
) &&
3472 ((r
->rule_flag
& PFRULE_RETURNICMP
) ||
3473 (r
->rule_flag
& PFRULE_RETURN
))) {
3474 struct pf_addr
*a
= NULL
;
3477 if (direction
== PF_OUT
)
3486 pf_change_a(&a
->v4
.s_addr
, pd
->ip_sum
,
3487 pd
->baddr
.v4
.s_addr
, 0);
3492 PF_ACPY(a
, &pd
->baddr
, af
);
3497 if ((af
== AF_INET
) && r
->return_icmp
)
3498 pf_send_icmp(m
, r
->return_icmp
>> 8,
3499 r
->return_icmp
& 255, af
, r
);
3500 else if ((af
== AF_INET6
) && r
->return_icmp6
)
3501 pf_send_icmp(m
, r
->return_icmp6
>> 8,
3502 r
->return_icmp6
& 255, af
, r
);
3505 if (r
->action
!= PF_PASS
)
3508 pf_tag_packet(m
, tag
);
3510 if (r
->keep_state
|| nr
!= NULL
) {
3511 /* create new state */
3512 struct pf_state
*s
= NULL
;
3513 struct pf_src_node
*sn
= NULL
;
3515 /* check maximums */
3516 if (r
->max_states
&& (r
->states
>= r
->max_states
))
3518 /* src node for flter rule */
3519 if ((r
->rule_flag
& PFRULE_SRCTRACK
||
3520 r
->rpool
.opts
& PF_POOL_STICKYADDR
) &&
3521 pf_insert_src_node(&sn
, r
, saddr
, af
) != 0)
3523 /* src node for translation rule */
3524 if (nr
!= NULL
&& (nr
->rpool
.opts
& PF_POOL_STICKYADDR
) &&
3525 ((direction
== PF_OUT
&&
3526 pf_insert_src_node(&nsn
, nr
, &pd
->baddr
, af
) != 0) ||
3527 (pf_insert_src_node(&nsn
, nr
, saddr
, af
) != 0)))
3529 s
= pool_get(&pf_state_pl
, PR_NOWAIT
);
3532 if (sn
!= NULL
&& sn
->states
== 0 && sn
->expire
== 0) {
3533 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, sn
);
3534 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
3535 pf_status
.src_nodes
--;
3536 pool_put(&pf_src_tree_pl
, sn
);
3538 if (nsn
!= sn
&& nsn
!= NULL
&& nsn
->states
== 0 &&
3540 RB_REMOVE(pf_src_tree
, &tree_src_tracking
, nsn
);
3541 pf_status
.scounters
[SCNT_SRC_NODE_REMOVALS
]++;
3542 pf_status
.src_nodes
--;
3543 pool_put(&pf_src_tree_pl
, nsn
);
3545 REASON_SET(&reason
, PFRES_MEMORY
);
3548 bzero(s
, sizeof(*s
));
3553 s
->nat_rule
.ptr
= nr
;
3554 if (s
->nat_rule
.ptr
!= NULL
)
3555 s
->nat_rule
.ptr
->states
++;
3557 s
->allow_opts
= r
->allow_opts
;
3558 s
->log
= r
->log
& 2;
3559 s
->proto
= pd
->proto
;
3560 s
->direction
= direction
;
3562 if (direction
== PF_OUT
) {
3563 PF_ACPY(&s
->gwy
.addr
, saddr
, af
);
3564 PF_ACPY(&s
->ext
.addr
, daddr
, af
);
3566 PF_ACPY(&s
->lan
.addr
, &pd
->baddr
, af
);
3568 PF_ACPY(&s
->lan
.addr
, &s
->gwy
.addr
, af
);
3570 PF_ACPY(&s
->lan
.addr
, daddr
, af
);
3571 PF_ACPY(&s
->ext
.addr
, saddr
, af
);
3573 PF_ACPY(&s
->gwy
.addr
, &pd
->baddr
, af
);
3575 PF_ACPY(&s
->gwy
.addr
, &s
->lan
.addr
, af
);
3577 s
->src
.state
= PFOTHERS_SINGLE
;
3578 s
->dst
.state
= PFOTHERS_NO_TRAFFIC
;
3579 s
->creation
= time_second
;
3580 s
->expire
= time_second
;
3581 s
->timeout
= PFTM_OTHER_FIRST_PACKET
;
3582 pf_set_rt_ifp(s
, saddr
);
3585 s
->src_node
->states
++;
3588 PF_ACPY(&nsn
->raddr
, &pd
->naddr
, af
);
3589 s
->nat_src_node
= nsn
;
3590 s
->nat_src_node
->states
++;
3592 if (pf_insert_state(BOUND_IFACE(r
, kif
), s
)) {
3593 REASON_SET(&reason
, PFRES_MEMORY
);
3594 pf_src_tree_remove_state(s
);
3595 pool_put(&pf_state_pl
, s
);
3605 pf_test_fragment(struct pf_rule
**rm
, int direction
, struct pfi_kif
*kif
,
3606 struct mbuf
*m
, void *h
, struct pf_pdesc
*pd
, struct pf_rule
**am
,
3607 struct pf_ruleset
**rsm
)
3609 struct pf_rule
*r
, *a
= NULL
;
3610 struct pf_ruleset
*ruleset
= NULL
;
3611 sa_family_t af
= pd
->af
;
3615 r
= TAILQ_FIRST(pf_main_ruleset
.rules
[PF_RULESET_FILTER
].active
.ptr
);
3618 if (r
->kif
!= NULL
&&
3619 (r
->kif
!= kif
&& r
->kif
!= kif
->pfik_parent
) == !r
->ifnot
)
3620 r
= r
->skip
[PF_SKIP_IFP
].ptr
;
3621 else if (r
->direction
&& r
->direction
!= direction
)
3622 r
= r
->skip
[PF_SKIP_DIR
].ptr
;
3623 else if (r
->af
&& r
->af
!= af
)
3624 r
= r
->skip
[PF_SKIP_AF
].ptr
;
3625 else if (r
->proto
&& r
->proto
!= pd
->proto
)
3626 r
= r
->skip
[PF_SKIP_PROTO
].ptr
;
3627 else if (PF_MISMATCHAW(&r
->src
.addr
, pd
->src
, af
, r
->src
.not))
3628 r
= r
->skip
[PF_SKIP_SRC_ADDR
].ptr
;
3629 else if (PF_MISMATCHAW(&r
->dst
.addr
, pd
->dst
, af
, r
->dst
.not))
3630 r
= r
->skip
[PF_SKIP_DST_ADDR
].ptr
;
3631 else if (r
->tos
&& !(r
->tos
& pd
->tos
))
3632 r
= TAILQ_NEXT(r
, entries
);
3633 else if (r
->src
.port_op
|| r
->dst
.port_op
||
3634 r
->flagset
|| r
->type
|| r
->code
||
3635 r
->os_fingerprint
!= PF_OSFP_ANY
)
3636 r
= TAILQ_NEXT(r
, entries
);
3637 else if (r
->match_tag
&& !pf_match_tag(m
, r
, NULL
, &tag
))
3638 r
= TAILQ_NEXT(r
, entries
);
3639 else if (r
->anchorname
[0] && r
->anchor
== NULL
)
3640 r
= TAILQ_NEXT(r
, entries
);
3642 if (r
->anchor
== NULL
) {
3648 r
= TAILQ_NEXT(r
, entries
);
3650 PF_STEP_INTO_ANCHOR(r
, a
, ruleset
,
3653 if (r
== NULL
&& a
!= NULL
)
3654 PF_STEP_OUT_OF_ANCHOR(r
, a
, ruleset
,
3661 REASON_SET(&reason
, PFRES_MATCH
);
3664 PFLOG_PACKET(kif
, h
, m
, af
, direction
, reason
, r
, a
, ruleset
);
3666 if (r
->action
!= PF_PASS
)
3669 pf_tag_packet(m
, tag
);
3675 pf_test_state_tcp(struct pf_state
**state
, int direction
, struct pfi_kif
*kif
,
3676 struct mbuf
*m
, int off
, void *h
, struct pf_pdesc
*pd
,
3679 struct pf_state key
;
3680 struct tcphdr
*th
= pd
->hdr
.tcp
;
3681 u_int16_t win
= ntohs(th
->th_win
);
3682 u_int32_t ack
, end
, seq
;
3686 struct pf_state_peer
*src
, *dst
;
3689 key
.proto
= IPPROTO_TCP
;
3690 if (direction
== PF_IN
) {
3691 PF_ACPY(&key
.ext
.addr
, pd
->src
, key
.af
);
3692 PF_ACPY(&key
.gwy
.addr
, pd
->dst
, key
.af
);
3693 key
.ext
.port
= th
->th_sport
;
3694 key
.gwy
.port
= th
->th_dport
;
3696 PF_ACPY(&key
.lan
.addr
, pd
->src
, key
.af
);
3697 PF_ACPY(&key
.ext
.addr
, pd
->dst
, key
.af
);
3698 key
.lan
.port
= th
->th_sport
;
3699 key
.ext
.port
= th
->th_dport
;
3704 if (direction
== (*state
)->direction
) {
3705 src
= &(*state
)->src
;
3706 dst
= &(*state
)->dst
;
3708 src
= &(*state
)->dst
;
3709 dst
= &(*state
)->src
;
3712 if ((*state
)->src
.state
== PF_TCPS_PROXY_SRC
) {
3713 if (direction
!= (*state
)->direction
)
3714 return (PF_SYNPROXY_DROP
);
3715 if (th
->th_flags
& TH_SYN
) {
3716 if (ntohl(th
->th_seq
) != (*state
)->src
.seqlo
)
3718 pf_send_tcp((*state
)->rule
.ptr
, pd
->af
, pd
->dst
,
3719 pd
->src
, th
->th_dport
, th
->th_sport
,
3720 (*state
)->src
.seqhi
, ntohl(th
->th_seq
) + 1,
3721 TH_SYN
|TH_ACK
, 0, (*state
)->src
.mss
, 0);
3722 return (PF_SYNPROXY_DROP
);
3723 } else if (!(th
->th_flags
& TH_ACK
) ||
3724 (ntohl(th
->th_ack
) != (*state
)->src
.seqhi
+ 1) ||
3725 (ntohl(th
->th_seq
) != (*state
)->src
.seqlo
+ 1))
3728 (*state
)->src
.state
= PF_TCPS_PROXY_DST
;
3730 if ((*state
)->src
.state
== PF_TCPS_PROXY_DST
) {
3731 struct pf_state_host
*src
, *dst
;
3733 if (direction
== PF_OUT
) {
3734 src
= &(*state
)->gwy
;
3735 dst
= &(*state
)->ext
;
3737 src
= &(*state
)->ext
;
3738 dst
= &(*state
)->lan
;
3740 if (direction
== (*state
)->direction
) {
3741 if (((th
->th_flags
& (TH_SYN
|TH_ACK
)) != TH_ACK
) ||
3742 (ntohl(th
->th_ack
) != (*state
)->src
.seqhi
+ 1) ||
3743 (ntohl(th
->th_seq
) != (*state
)->src
.seqlo
+ 1))
3745 (*state
)->src
.max_win
= MAX(ntohs(th
->th_win
), 1);
3746 if ((*state
)->dst
.seqhi
== 1)
3747 (*state
)->dst
.seqhi
= arc4random();
3748 pf_send_tcp((*state
)->rule
.ptr
, pd
->af
, &src
->addr
,
3749 &dst
->addr
, src
->port
, dst
->port
,
3750 (*state
)->dst
.seqhi
, 0, TH_SYN
, 0,
3751 (*state
)->src
.mss
, 0);
3752 return (PF_SYNPROXY_DROP
);
3753 } else if (((th
->th_flags
& (TH_SYN
|TH_ACK
)) !=
3755 (ntohl(th
->th_ack
) != (*state
)->dst
.seqhi
+ 1))
3758 (*state
)->dst
.max_win
= MAX(ntohs(th
->th_win
), 1);
3759 (*state
)->dst
.seqlo
= ntohl(th
->th_seq
);
3760 pf_send_tcp((*state
)->rule
.ptr
, pd
->af
, pd
->dst
,
3761 pd
->src
, th
->th_dport
, th
->th_sport
,
3762 ntohl(th
->th_ack
), ntohl(th
->th_seq
) + 1,
3763 TH_ACK
, (*state
)->src
.max_win
, 0, 0);
3764 pf_send_tcp((*state
)->rule
.ptr
, pd
->af
, &src
->addr
,
3765 &dst
->addr
, src
->port
, dst
->port
,
3766 (*state
)->src
.seqhi
+ 1, (*state
)->src
.seqlo
+ 1,
3767 TH_ACK
, (*state
)->dst
.max_win
, 0, 0);
3768 (*state
)->src
.seqdiff
= (*state
)->dst
.seqhi
-
3769 (*state
)->src
.seqlo
;
3770 (*state
)->dst
.seqdiff
= (*state
)->src
.seqhi
-
3771 (*state
)->dst
.seqlo
;
3772 (*state
)->src
.seqhi
= (*state
)->src
.seqlo
+
3773 (*state
)->src
.max_win
;
3774 (*state
)->dst
.seqhi
= (*state
)->dst
.seqlo
+
3775 (*state
)->dst
.max_win
;
3776 (*state
)->src
.wscale
= (*state
)->dst
.wscale
= 0;
3777 (*state
)->src
.state
= (*state
)->dst
.state
=
3779 return (PF_SYNPROXY_DROP
);
3783 if (src
->wscale
&& dst
->wscale
&& !(th
->th_flags
& TH_SYN
)) {
3784 sws
= src
->wscale
& PF_WSCALE_MASK
;
3785 dws
= dst
->wscale
& PF_WSCALE_MASK
;
3790 * Sequence tracking algorithm from Guido van Rooij's paper:
3791 * http://www.madison-gurkha.com/publications/tcp_filtering/
3795 seq
= ntohl(th
->th_seq
);
3796 if (src
->seqlo
== 0) {
3797 /* First packet from this end. Set its state */
3799 if ((pd
->flags
& PFDESC_TCP_NORM
|| dst
->scrub
) &&
3800 src
->scrub
== NULL
) {
3801 if (pf_normalize_tcp_init(m
, off
, pd
, th
, src
, dst
)) {
3802 REASON_SET(reason
, PFRES_MEMORY
);
3807 /* Deferred generation of sequence number modulator */
3808 if (dst
->seqdiff
&& !src
->seqdiff
) {
3809 while ((src
->seqdiff
= arc4random()) == 0)
3811 ack
= ntohl(th
->th_ack
) - dst
->seqdiff
;
3812 pf_change_a(&th
->th_seq
, &th
->th_sum
, htonl(seq
+
3814 pf_change_a(&th
->th_ack
, &th
->th_sum
, htonl(ack
), 0);
3817 ack
= ntohl(th
->th_ack
);
3820 end
= seq
+ pd
->p_len
;
3821 if (th
->th_flags
& TH_SYN
) {
3823 if (dst
->wscale
& PF_WSCALE_FLAG
) {
3824 src
->wscale
= pf_get_wscale(m
, off
, th
->th_off
,
3826 if (src
->wscale
& PF_WSCALE_FLAG
) {
3827 /* Remove scale factor from initial
3829 sws
= src
->wscale
& PF_WSCALE_MASK
;
3830 win
= ((u_int32_t
)win
+ (1 << sws
) - 1)
3832 dws
= dst
->wscale
& PF_WSCALE_MASK
;
3834 /* fixup other window */
3835 dst
->max_win
<<= dst
->wscale
&
3837 /* in case of a retrans SYN|ACK */
3842 if (th
->th_flags
& TH_FIN
)
3846 if (src
->state
< TCPS_SYN_SENT
)
3847 src
->state
= TCPS_SYN_SENT
;
3850 * May need to slide the window (seqhi may have been set by
3851 * the crappy stack check or if we picked up the connection
3852 * after establishment)
3854 if (src
->seqhi
== 1 ||
3855 SEQ_GEQ(end
+ MAX(1, dst
->max_win
<< dws
), src
->seqhi
))
3856 src
->seqhi
= end
+ MAX(1, dst
->max_win
<< dws
);
3857 if (win
> src
->max_win
)
3861 ack
= ntohl(th
->th_ack
) - dst
->seqdiff
;
3863 /* Modulate sequence numbers */
3864 pf_change_a(&th
->th_seq
, &th
->th_sum
, htonl(seq
+
3866 pf_change_a(&th
->th_ack
, &th
->th_sum
, htonl(ack
), 0);
3869 end
= seq
+ pd
->p_len
;
3870 if (th
->th_flags
& TH_SYN
)
3872 if (th
->th_flags
& TH_FIN
)
3876 if ((th
->th_flags
& TH_ACK
) == 0) {
3877 /* Let it pass through the ack skew check */
3879 } else if ((ack
== 0 &&
3880 (th
->th_flags
& (TH_ACK
|TH_RST
)) == (TH_ACK
|TH_RST
)) ||
3881 /* broken tcp stacks do not set ack */
3882 (dst
->state
< TCPS_SYN_SENT
)) {
3884 * Many stacks (ours included) will set the ACK number in an
3885 * FIN|ACK if the SYN times out -- no sequence to ACK.
3891 /* Ease sequencing restrictions on no data packets */
3896 ackskew
= dst
->seqlo
- ack
;
3898 #define MAXACKWINDOW (0xffff + 1500) /* 1500 is an arbitrary fudge factor */
3899 if (SEQ_GEQ(src
->seqhi
, end
) &&
3900 /* Last octet inside other's window space */
3901 SEQ_GEQ(seq
, src
->seqlo
- (dst
->max_win
<< dws
)) &&
3902 /* Retrans: not more than one window back */
3903 (ackskew
>= -MAXACKWINDOW
) &&
3904 /* Acking not more than one reassembled fragment backwards */
3905 (ackskew
<= (MAXACKWINDOW
<< sws
))) {
3906 /* Acking not more than one window forward */
3908 /* update max window */
3909 if (src
->max_win
< win
)
3911 /* synchronize sequencing */
3912 if (SEQ_GT(end
, src
->seqlo
))
3914 /* slide the window of what the other end can send */
3915 if (SEQ_GEQ(ack
+ (win
<< sws
), dst
->seqhi
))
3916 dst
->seqhi
= ack
+ MAX((win
<< sws
), 1);
3920 if (th
->th_flags
& TH_SYN
)
3921 if (src
->state
< TCPS_SYN_SENT
)
3922 src
->state
= TCPS_SYN_SENT
;
3923 if (th
->th_flags
& TH_FIN
)
3924 if (src
->state
< TCPS_CLOSING
)
3925 src
->state
= TCPS_CLOSING
;
3926 if (th
->th_flags
& TH_ACK
) {
3927 if (dst
->state
== TCPS_SYN_SENT
)
3928 dst
->state
= TCPS_ESTABLISHED
;
3929 else if (dst
->state
== TCPS_CLOSING
)
3930 dst
->state
= TCPS_FIN_WAIT_2
;
3932 if (th
->th_flags
& TH_RST
)
3933 src
->state
= dst
->state
= TCPS_TIME_WAIT
;
3935 /* update expire time */
3936 (*state
)->expire
= time_second
;
3937 if (src
->state
>= TCPS_FIN_WAIT_2
&&
3938 dst
->state
>= TCPS_FIN_WAIT_2
)
3939 (*state
)->timeout
= PFTM_TCP_CLOSED
;
3940 else if (src
->state
>= TCPS_FIN_WAIT_2
||
3941 dst
->state
>= TCPS_FIN_WAIT_2
)
3942 (*state
)->timeout
= PFTM_TCP_FIN_WAIT
;
3943 else if (src
->state
< TCPS_ESTABLISHED
||
3944 dst
->state
< TCPS_ESTABLISHED
)
3945 (*state
)->timeout
= PFTM_TCP_OPENING
;
3946 else if (src
->state
>= TCPS_CLOSING
||
3947 dst
->state
>= TCPS_CLOSING
)
3948 (*state
)->timeout
= PFTM_TCP_CLOSING
;
3950 (*state
)->timeout
= PFTM_TCP_ESTABLISHED
;
3952 /* Fall through to PASS packet */
3954 } else if ((dst
->state
< TCPS_SYN_SENT
||
3955 dst
->state
>= TCPS_FIN_WAIT_2
||
3956 src
->state
>= TCPS_FIN_WAIT_2
) &&
3957 SEQ_GEQ(src
->seqhi
+ MAXACKWINDOW
, end
) &&
3958 /* Within a window forward of the originating packet */
3959 SEQ_GEQ(seq
, src
->seqlo
- MAXACKWINDOW
)) {
3960 /* Within a window backward of the originating packet */
3963 * This currently handles three situations:
3964 * 1) Stupid stacks will shotgun SYNs before their peer
3966 * 2) When PF catches an already established stream (the
3967 * firewall rebooted, the state table was flushed, routes
3969 * 3) Packets get funky immediately after the connection
3970 * closes (this should catch Solaris spurious ACK|FINs
3971 * that web servers like to spew after a close)
3973 * This must be a little more careful than the above code
3974 * since packet floods will also be caught here. We don't
3975 * update the TTL here to mitigate the damage of a packet
3976 * flood and so the same code can handle awkward establishment
3977 * and a loosened connection close.
3978 * In the establishment case, a correct peer response will
3979 * validate the connection, go through the normal state code
3980 * and keep updating the state TTL.
3983 if (pf_status
.debug
>= PF_DEBUG_MISC
) {
3984 printf("pf: loose state match: ");
3985 pf_print_state(*state
);
3986 pf_print_flags(th
->th_flags
);
3987 printf(" seq=%u ack=%u len=%u ackskew=%d pkts=%d:%d\n",
3988 seq
, ack
, pd
->p_len
, ackskew
,
3989 (*state
)->packets
[0], (*state
)->packets
[1]);
3992 /* update max window */
3993 if (src
->max_win
< win
)
3995 /* synchronize sequencing */
3996 if (SEQ_GT(end
, src
->seqlo
))
3998 /* slide the window of what the other end can send */
3999 if (SEQ_GEQ(ack
+ (win
<< sws
), dst
->seqhi
))
4000 dst
->seqhi
= ack
+ MAX((win
<< sws
), 1);
4003 * Cannot set dst->seqhi here since this could be a shotgunned
4004 * SYN and not an already established connection.
4007 if (th
->th_flags
& TH_FIN
)
4008 if (src
->state
< TCPS_CLOSING
)
4009 src
->state
= TCPS_CLOSING
;
4010 if (th
->th_flags
& TH_RST
)
4011 src
->state
= dst
->state
= TCPS_TIME_WAIT
;
4013 /* Fall through to PASS packet */
4016 if ((*state
)->dst
.state
== TCPS_SYN_SENT
&&
4017 (*state
)->src
.state
== TCPS_SYN_SENT
) {
4018 /* Send RST for state mismatches during handshake */
4019 if (!(th
->th_flags
& TH_RST
)) {
4020 u_int32_t ack
= ntohl(th
->th_seq
) + pd
->p_len
;
4022 if (th
->th_flags
& TH_SYN
)
4024 if (th
->th_flags
& TH_FIN
)
4026 pf_send_tcp((*state
)->rule
.ptr
, pd
->af
,
4027 pd
->dst
, pd
->src
, th
->th_dport
,
4028 th
->th_sport
, ntohl(th
->th_ack
), ack
,
4029 TH_RST
|TH_ACK
, 0, 0,
4030 (*state
)->rule
.ptr
->return_ttl
);
4035 } else if (pf_status
.debug
>= PF_DEBUG_MISC
) {
4036 printf("pf: BAD state: ");
4037 pf_print_state(*state
);
4038 pf_print_flags(th
->th_flags
);
4039 printf(" seq=%u ack=%u len=%u ackskew=%d pkts=%d:%d "
4040 "dir=%s,%s\n", seq
, ack
, pd
->p_len
, ackskew
,
4041 (*state
)->packets
[0], (*state
)->packets
[1],
4042 direction
== PF_IN
? "in" : "out",
4043 direction
== (*state
)->direction
? "fwd" : "rev");
4044 printf("pf: State failure on: %c %c %c %c | %c %c\n",
4045 SEQ_GEQ(src
->seqhi
, end
) ? ' ' : '1',
4046 SEQ_GEQ(seq
, src
->seqlo
- (dst
->max_win
<< dws
)) ?
4048 (ackskew
>= -MAXACKWINDOW
) ? ' ' : '3',
4049 (ackskew
<= (MAXACKWINDOW
<< sws
)) ? ' ' : '4',
4050 SEQ_GEQ(src
->seqhi
+ MAXACKWINDOW
, end
) ?' ' :'5',
4051 SEQ_GEQ(seq
, src
->seqlo
- MAXACKWINDOW
) ?' ' :'6');
4056 if (dst
->scrub
|| src
->scrub
) {
4057 if (pf_normalize_tcp_stateful(m
, off
, pd
, reason
, th
,
4058 src
, dst
, ©back
))
4062 /* Any packets which have gotten here are to be passed */
4064 /* translate source/destination address, if necessary */
4065 if (STATE_TRANSLATE(*state
)) {
4066 if (direction
== PF_OUT
)
4067 pf_change_ap(pd
->src
, &th
->th_sport
, pd
->ip_sum
,
4068 &th
->th_sum
, &(*state
)->gwy
.addr
,
4069 (*state
)->gwy
.port
, 0, pd
->af
);
4071 pf_change_ap(pd
->dst
, &th
->th_dport
, pd
->ip_sum
,
4072 &th
->th_sum
, &(*state
)->lan
.addr
,
4073 (*state
)->lan
.port
, 0, pd
->af
);
4074 m_copyback(m
, off
, sizeof(*th
), (caddr_t
)th
);
4075 } else if (copyback
) {
4076 /* Copyback sequence modulation or stateful scrub changes */
4077 m_copyback(m
, off
, sizeof(*th
), (caddr_t
)th
);
4084 pf_test_state_udp(struct pf_state
**state
, int direction
, struct pfi_kif
*kif
,
4085 struct mbuf
*m
, int off
, void *h
, struct pf_pdesc
*pd
)
4087 struct pf_state_peer
*src
, *dst
;
4088 struct pf_state key
;
4089 struct udphdr
*uh
= pd
->hdr
.udp
;
4092 key
.proto
= IPPROTO_UDP
;
4093 if (direction
== PF_IN
) {
4094 PF_ACPY(&key
.ext
.addr
, pd
->src
, key
.af
);
4095 PF_ACPY(&key
.gwy
.addr
, pd
->dst
, key
.af
);
4096 key
.ext
.port
= uh
->uh_sport
;
4097 key
.gwy
.port
= uh
->uh_dport
;
4099 PF_ACPY(&key
.lan
.addr
, pd
->src
, key
.af
);
4100 PF_ACPY(&key
.ext
.addr
, pd
->dst
, key
.af
);
4101 key
.lan
.port
= uh
->uh_sport
;
4102 key
.ext
.port
= uh
->uh_dport
;
4107 if (direction
== (*state
)->direction
) {
4108 src
= &(*state
)->src
;
4109 dst
= &(*state
)->dst
;
4111 src
= &(*state
)->dst
;
4112 dst
= &(*state
)->src
;
4116 if (src
->state
< PFUDPS_SINGLE
)
4117 src
->state
= PFUDPS_SINGLE
;
4118 if (dst
->state
== PFUDPS_SINGLE
)
4119 dst
->state
= PFUDPS_MULTIPLE
;
4121 /* update expire time */
4122 (*state
)->expire
= time_second
;
4123 if (src
->state
== PFUDPS_MULTIPLE
&& dst
->state
== PFUDPS_MULTIPLE
)
4124 (*state
)->timeout
= PFTM_UDP_MULTIPLE
;
4126 (*state
)->timeout
= PFTM_UDP_SINGLE
;
4128 /* translate source/destination address, if necessary */
4129 if (STATE_TRANSLATE(*state
)) {
4130 if (direction
== PF_OUT
)
4131 pf_change_ap(pd
->src
, &uh
->uh_sport
, pd
->ip_sum
,
4132 &uh
->uh_sum
, &(*state
)->gwy
.addr
,
4133 (*state
)->gwy
.port
, 1, pd
->af
);
4135 pf_change_ap(pd
->dst
, &uh
->uh_dport
, pd
->ip_sum
,
4136 &uh
->uh_sum
, &(*state
)->lan
.addr
,
4137 (*state
)->lan
.port
, 1, pd
->af
);
4138 m_copyback(m
, off
, sizeof(*uh
), (caddr_t
)uh
);
4145 pf_test_state_icmp(struct pf_state
**state
, int direction
, struct pfi_kif
*kif
,
4146 struct mbuf
*m
, int off
, void *h
, struct pf_pdesc
*pd
)
4148 struct pf_addr
*saddr
= pd
->src
, *daddr
= pd
->dst
;
4149 u_int16_t icmpid
= 0;
4150 u_int16_t
*icmpsum
= NULL
;
4151 u_int8_t icmptype
= 0;
4154 switch (pd
->proto
) {
4157 icmptype
= pd
->hdr
.icmp
->icmp_type
;
4158 icmpid
= pd
->hdr
.icmp
->icmp_id
;
4159 icmpsum
= &pd
->hdr
.icmp
->icmp_cksum
;
4161 if (icmptype
== ICMP_UNREACH
||
4162 icmptype
== ICMP_SOURCEQUENCH
||
4163 icmptype
== ICMP_REDIRECT
||
4164 icmptype
== ICMP_TIMXCEED
||
4165 icmptype
== ICMP_PARAMPROB
)
4170 case IPPROTO_ICMPV6
:
4171 icmptype
= pd
->hdr
.icmp6
->icmp6_type
;
4172 icmpid
= pd
->hdr
.icmp6
->icmp6_id
;
4173 icmpsum
= &pd
->hdr
.icmp6
->icmp6_cksum
;
4175 if (icmptype
== ICMP6_DST_UNREACH
||
4176 icmptype
== ICMP6_PACKET_TOO_BIG
||
4177 icmptype
== ICMP6_TIME_EXCEEDED
||
4178 icmptype
== ICMP6_PARAM_PROB
)
4187 * ICMP query/reply message not related to a TCP/UDP packet.
4188 * Search for an ICMP state.
4190 struct pf_state key
;
4193 key
.proto
= pd
->proto
;
4194 if (direction
== PF_IN
) {
4195 PF_ACPY(&key
.ext
.addr
, pd
->src
, key
.af
);
4196 PF_ACPY(&key
.gwy
.addr
, pd
->dst
, key
.af
);
4197 key
.ext
.port
= icmpid
;
4198 key
.gwy
.port
= icmpid
;
4200 PF_ACPY(&key
.lan
.addr
, pd
->src
, key
.af
);
4201 PF_ACPY(&key
.ext
.addr
, pd
->dst
, key
.af
);
4202 key
.lan
.port
= icmpid
;
4203 key
.ext
.port
= icmpid
;
4208 (*state
)->expire
= time_second
;
4209 (*state
)->timeout
= PFTM_ICMP_ERROR_REPLY
;
4211 /* translate source/destination address, if necessary */
4212 if (PF_ANEQ(&(*state
)->lan
.addr
, &(*state
)->gwy
.addr
, pd
->af
)) {
4213 if (direction
== PF_OUT
) {
4217 pf_change_a(&saddr
->v4
.s_addr
,
4219 (*state
)->gwy
.addr
.v4
.s_addr
, 0);
4225 &pd
->hdr
.icmp6
->icmp6_cksum
,
4226 &(*state
)->gwy
.addr
, 0);
4228 sizeof(struct icmp6_hdr
),
4229 (caddr_t
)pd
->hdr
.icmp6
);
4237 pf_change_a(&daddr
->v4
.s_addr
,
4239 (*state
)->lan
.addr
.v4
.s_addr
, 0);
4245 &pd
->hdr
.icmp6
->icmp6_cksum
,
4246 &(*state
)->lan
.addr
, 0);
4248 sizeof(struct icmp6_hdr
),
4249 (caddr_t
)pd
->hdr
.icmp6
);
4260 * ICMP error message in response to a TCP/UDP packet.
4261 * Extract the inner TCP/UDP header and search for that state.
4264 struct pf_pdesc pd2
;
4269 struct ip6_hdr h2_6
;
4279 /* offset of h2 in mbuf chain */
4280 ipoff2
= off
+ ICMP_MINLEN
;
4282 if (!pf_pull_hdr(m
, ipoff2
, &h2
, sizeof(h2
),
4283 NULL
, NULL
, pd2
.af
)) {
4284 DPFPRINTF(PF_DEBUG_MISC
,
4285 ("pf: ICMP error message too short "
4290 * ICMP error messages don't refer to non-first
4294 * Note: We are dealing with an encapsulated
4295 * header. This means ip_off/ip_len are not
4296 * in host byte order!
4298 if (h2
.ip_off
& htons(IP_OFFMASK
))
4301 /* offset of protocol header that follows h2 */
4302 off2
= ipoff2
+ (h2
.ip_hl
<< 2);
4304 pd2
.proto
= h2
.ip_p
;
4305 pd2
.src
= (struct pf_addr
*)&h2
.ip_src
;
4306 pd2
.dst
= (struct pf_addr
*)&h2
.ip_dst
;
4307 pd2
.ip_sum
= &h2
.ip_sum
;
4312 ipoff2
= off
+ sizeof(struct icmp6_hdr
);
4314 if (!pf_pull_hdr(m
, ipoff2
, &h2_6
, sizeof(h2_6
),
4315 NULL
, NULL
, pd2
.af
)) {
4316 DPFPRINTF(PF_DEBUG_MISC
,
4317 ("pf: ICMP error message too short "
4321 pd2
.proto
= h2_6
.ip6_nxt
;
4322 pd2
.src
= (struct pf_addr
*)&h2_6
.ip6_src
;
4323 pd2
.dst
= (struct pf_addr
*)&h2_6
.ip6_dst
;
4325 off2
= ipoff2
+ sizeof(h2_6
);
4327 switch (pd2
.proto
) {
4328 case IPPROTO_FRAGMENT
:
4330 * ICMPv6 error messages for
4331 * non-first fragments
4335 case IPPROTO_HOPOPTS
:
4336 case IPPROTO_ROUTING
:
4337 case IPPROTO_DSTOPTS
: {
4338 /* get next header and header length */
4339 struct ip6_ext opt6
;
4341 if (!pf_pull_hdr(m
, off2
, &opt6
,
4342 sizeof(opt6
), NULL
, NULL
, pd2
.af
)) {
4343 DPFPRINTF(PF_DEBUG_MISC
,
4344 ("pf: ICMPv6 short opt\n"));
4347 if (pd2
.proto
== IPPROTO_AH
)
4348 off2
+= (opt6
.ip6e_len
+ 2) * 4;
4350 off2
+= (opt6
.ip6e_len
+ 1) * 8;
4351 pd2
.proto
= opt6
.ip6e_nxt
;
4352 /* goto the next header */
4359 } while (!terminal
);
4364 switch (pd2
.proto
) {
4368 struct pf_state key
;
4369 struct pf_state_peer
*src
, *dst
;
4374 * Only the first 8 bytes of the TCP header can be
4375 * expected. Don't access any TCP header fields after
4376 * th_seq, an ackskew test is not possible.
4378 if (!pf_pull_hdr(m
, off2
, &th
, 8, NULL
, NULL
, pd2
.af
)) {
4379 DPFPRINTF(PF_DEBUG_MISC
,
4380 ("pf: ICMP error message too short "
4386 key
.proto
= IPPROTO_TCP
;
4387 if (direction
== PF_IN
) {
4388 PF_ACPY(&key
.ext
.addr
, pd2
.dst
, key
.af
);
4389 PF_ACPY(&key
.gwy
.addr
, pd2
.src
, key
.af
);
4390 key
.ext
.port
= th
.th_dport
;
4391 key
.gwy
.port
= th
.th_sport
;
4393 PF_ACPY(&key
.lan
.addr
, pd2
.dst
, key
.af
);
4394 PF_ACPY(&key
.ext
.addr
, pd2
.src
, key
.af
);
4395 key
.lan
.port
= th
.th_dport
;
4396 key
.ext
.port
= th
.th_sport
;
4401 if (direction
== (*state
)->direction
) {
4402 src
= &(*state
)->dst
;
4403 dst
= &(*state
)->src
;
4405 src
= &(*state
)->src
;
4406 dst
= &(*state
)->dst
;
4409 if (src
->wscale
&& dst
->wscale
&&
4410 !(th
.th_flags
& TH_SYN
))
4411 dws
= dst
->wscale
& PF_WSCALE_MASK
;
4415 /* Demodulate sequence number */
4416 seq
= ntohl(th
.th_seq
) - src
->seqdiff
;
4418 pf_change_a(&th
.th_seq
, icmpsum
,
4423 if (!SEQ_GEQ(src
->seqhi
, seq
) ||
4424 !SEQ_GEQ(seq
, src
->seqlo
- (dst
->max_win
<< dws
))) {
4425 if (pf_status
.debug
>= PF_DEBUG_MISC
) {
4426 printf("pf: BAD ICMP %d:%d ",
4427 icmptype
, pd
->hdr
.icmp
->icmp_code
);
4428 pf_print_host(pd
->src
, 0, pd
->af
);
4430 pf_print_host(pd
->dst
, 0, pd
->af
);
4432 pf_print_state(*state
);
4433 printf(" seq=%u\n", seq
);
4438 if (STATE_TRANSLATE(*state
)) {
4439 if (direction
== PF_IN
) {
4440 pf_change_icmp(pd2
.src
, &th
.th_sport
,
4441 daddr
, &(*state
)->lan
.addr
,
4442 (*state
)->lan
.port
, NULL
,
4443 pd2
.ip_sum
, icmpsum
,
4444 pd
->ip_sum
, 0, pd2
.af
);
4446 pf_change_icmp(pd2
.dst
, &th
.th_dport
,
4447 saddr
, &(*state
)->gwy
.addr
,
4448 (*state
)->gwy
.port
, NULL
,
4449 pd2
.ip_sum
, icmpsum
,
4450 pd
->ip_sum
, 0, pd2
.af
);
4459 m_copyback(m
, off
, ICMP_MINLEN
,
4460 (caddr_t
)pd
->hdr
.icmp
);
4461 m_copyback(m
, ipoff2
, sizeof(h2
),
4468 sizeof(struct icmp6_hdr
),
4469 (caddr_t
)pd
->hdr
.icmp6
);
4470 m_copyback(m
, ipoff2
, sizeof(h2_6
),
4475 m_copyback(m
, off2
, 8, (caddr_t
)&th
);
4483 struct pf_state key
;
4485 if (!pf_pull_hdr(m
, off2
, &uh
, sizeof(uh
),
4486 NULL
, NULL
, pd2
.af
)) {
4487 DPFPRINTF(PF_DEBUG_MISC
,
4488 ("pf: ICMP error message too short "
4494 key
.proto
= IPPROTO_UDP
;
4495 if (direction
== PF_IN
) {
4496 PF_ACPY(&key
.ext
.addr
, pd2
.dst
, key
.af
);
4497 PF_ACPY(&key
.gwy
.addr
, pd2
.src
, key
.af
);
4498 key
.ext
.port
= uh
.uh_dport
;
4499 key
.gwy
.port
= uh
.uh_sport
;
4501 PF_ACPY(&key
.lan
.addr
, pd2
.dst
, key
.af
);
4502 PF_ACPY(&key
.ext
.addr
, pd2
.src
, key
.af
);
4503 key
.lan
.port
= uh
.uh_dport
;
4504 key
.ext
.port
= uh
.uh_sport
;
4509 if (STATE_TRANSLATE(*state
)) {
4510 if (direction
== PF_IN
) {
4511 pf_change_icmp(pd2
.src
, &uh
.uh_sport
,
4512 daddr
, &(*state
)->lan
.addr
,
4513 (*state
)->lan
.port
, &uh
.uh_sum
,
4514 pd2
.ip_sum
, icmpsum
,
4515 pd
->ip_sum
, 1, pd2
.af
);
4517 pf_change_icmp(pd2
.dst
, &uh
.uh_dport
,
4518 saddr
, &(*state
)->gwy
.addr
,
4519 (*state
)->gwy
.port
, &uh
.uh_sum
,
4520 pd2
.ip_sum
, icmpsum
,
4521 pd
->ip_sum
, 1, pd2
.af
);
4526 m_copyback(m
, off
, ICMP_MINLEN
,
4527 (caddr_t
)pd
->hdr
.icmp
);
4528 m_copyback(m
, ipoff2
, sizeof(h2
), (caddr_t
)&h2
);
4534 sizeof(struct icmp6_hdr
),
4535 (caddr_t
)pd
->hdr
.icmp6
);
4536 m_copyback(m
, ipoff2
, sizeof(h2_6
),
4541 m_copyback(m
, off2
, sizeof(uh
), (caddr_t
)&uh
);
4548 case IPPROTO_ICMP
: {
4550 struct pf_state key
;
4552 if (!pf_pull_hdr(m
, off2
, &iih
, ICMP_MINLEN
,
4553 NULL
, NULL
, pd2
.af
)) {
4554 DPFPRINTF(PF_DEBUG_MISC
,
4555 ("pf: ICMP error message too short i"
4561 key
.proto
= IPPROTO_ICMP
;
4562 if (direction
== PF_IN
) {
4563 PF_ACPY(&key
.ext
.addr
, pd2
.dst
, key
.af
);
4564 PF_ACPY(&key
.gwy
.addr
, pd2
.src
, key
.af
);
4565 key
.ext
.port
= iih
.icmp_id
;
4566 key
.gwy
.port
= iih
.icmp_id
;
4568 PF_ACPY(&key
.lan
.addr
, pd2
.dst
, key
.af
);
4569 PF_ACPY(&key
.ext
.addr
, pd2
.src
, key
.af
);
4570 key
.lan
.port
= iih
.icmp_id
;
4571 key
.ext
.port
= iih
.icmp_id
;
4576 if (STATE_TRANSLATE(*state
)) {
4577 if (direction
== PF_IN
) {
4578 pf_change_icmp(pd2
.src
, &iih
.icmp_id
,
4579 daddr
, &(*state
)->lan
.addr
,
4580 (*state
)->lan
.port
, NULL
,
4581 pd2
.ip_sum
, icmpsum
,
4582 pd
->ip_sum
, 0, AF_INET
);
4584 pf_change_icmp(pd2
.dst
, &iih
.icmp_id
,
4585 saddr
, &(*state
)->gwy
.addr
,
4586 (*state
)->gwy
.port
, NULL
,
4587 pd2
.ip_sum
, icmpsum
,
4588 pd
->ip_sum
, 0, AF_INET
);
4590 m_copyback(m
, off
, ICMP_MINLEN
, (caddr_t
)pd
->hdr
.icmp
);
4591 m_copyback(m
, ipoff2
, sizeof(h2
), (caddr_t
)&h2
);
4592 m_copyback(m
, off2
, ICMP_MINLEN
, (caddr_t
)&iih
);
4600 case IPPROTO_ICMPV6
: {
4601 struct icmp6_hdr iih
;
4602 struct pf_state key
;
4604 if (!pf_pull_hdr(m
, off2
, &iih
,
4605 sizeof(struct icmp6_hdr
), NULL
, NULL
, pd2
.af
)) {
4606 DPFPRINTF(PF_DEBUG_MISC
,
4607 ("pf: ICMP error message too short "
4613 key
.proto
= IPPROTO_ICMPV6
;
4614 if (direction
== PF_IN
) {
4615 PF_ACPY(&key
.ext
.addr
, pd2
.dst
, key
.af
);
4616 PF_ACPY(&key
.gwy
.addr
, pd2
.src
, key
.af
);
4617 key
.ext
.port
= iih
.icmp6_id
;
4618 key
.gwy
.port
= iih
.icmp6_id
;
4620 PF_ACPY(&key
.lan
.addr
, pd2
.dst
, key
.af
);
4621 PF_ACPY(&key
.ext
.addr
, pd2
.src
, key
.af
);
4622 key
.lan
.port
= iih
.icmp6_id
;
4623 key
.ext
.port
= iih
.icmp6_id
;
4628 if (STATE_TRANSLATE(*state
)) {
4629 if (direction
== PF_IN
) {
4630 pf_change_icmp(pd2
.src
, &iih
.icmp6_id
,
4631 daddr
, &(*state
)->lan
.addr
,
4632 (*state
)->lan
.port
, NULL
,
4633 pd2
.ip_sum
, icmpsum
,
4634 pd
->ip_sum
, 0, AF_INET6
);
4636 pf_change_icmp(pd2
.dst
, &iih
.icmp6_id
,
4637 saddr
, &(*state
)->gwy
.addr
,
4638 (*state
)->gwy
.port
, NULL
,
4639 pd2
.ip_sum
, icmpsum
,
4640 pd
->ip_sum
, 0, AF_INET6
);
4642 m_copyback(m
, off
, sizeof(struct icmp6_hdr
),
4643 (caddr_t
)pd
->hdr
.icmp6
);
4644 m_copyback(m
, ipoff2
, sizeof(h2_6
), (caddr_t
)&h2_6
);
4645 m_copyback(m
, off2
, sizeof(struct icmp6_hdr
),
4654 struct pf_state key
;
4657 key
.proto
= pd2
.proto
;
4658 if (direction
== PF_IN
) {
4659 PF_ACPY(&key
.ext
.addr
, pd2
.dst
, key
.af
);
4660 PF_ACPY(&key
.gwy
.addr
, pd2
.src
, key
.af
);
4664 PF_ACPY(&key
.lan
.addr
, pd2
.dst
, key
.af
);
4665 PF_ACPY(&key
.ext
.addr
, pd2
.src
, key
.af
);
4672 if (STATE_TRANSLATE(*state
)) {
4673 if (direction
== PF_IN
) {
4674 pf_change_icmp(pd2
.src
, NULL
,
4675 daddr
, &(*state
)->lan
.addr
,
4677 pd2
.ip_sum
, icmpsum
,
4678 pd
->ip_sum
, 0, pd2
.af
);
4680 pf_change_icmp(pd2
.dst
, NULL
,
4681 saddr
, &(*state
)->gwy
.addr
,
4683 pd2
.ip_sum
, icmpsum
,
4684 pd
->ip_sum
, 0, pd2
.af
);
4689 m_copyback(m
, off
, ICMP_MINLEN
,
4690 (caddr_t
)pd
->hdr
.icmp
);
4691 m_copyback(m
, ipoff2
, sizeof(h2
), (caddr_t
)&h2
);
4697 sizeof(struct icmp6_hdr
),
4698 (caddr_t
)pd
->hdr
.icmp6
);
4699 m_copyback(m
, ipoff2
, sizeof(h2_6
),
4714 pf_test_state_other(struct pf_state
**state
, int direction
, struct pfi_kif
*kif
,
4715 struct pf_pdesc
*pd
)
4717 struct pf_state_peer
*src
, *dst
;
4718 struct pf_state key
;
4721 key
.proto
= pd
->proto
;
4722 if (direction
== PF_IN
) {
4723 PF_ACPY(&key
.ext
.addr
, pd
->src
, key
.af
);
4724 PF_ACPY(&key
.gwy
.addr
, pd
->dst
, key
.af
);
4728 PF_ACPY(&key
.lan
.addr
, pd
->src
, key
.af
);
4729 PF_ACPY(&key
.ext
.addr
, pd
->dst
, key
.af
);
4736 if (direction
== (*state
)->direction
) {
4737 src
= &(*state
)->src
;
4738 dst
= &(*state
)->dst
;
4740 src
= &(*state
)->dst
;
4741 dst
= &(*state
)->src
;
4745 if (src
->state
< PFOTHERS_SINGLE
)
4746 src
->state
= PFOTHERS_SINGLE
;
4747 if (dst
->state
== PFOTHERS_SINGLE
)
4748 dst
->state
= PFOTHERS_MULTIPLE
;
4750 /* update expire time */
4751 (*state
)->expire
= time_second
;
4752 if (src
->state
== PFOTHERS_MULTIPLE
&& dst
->state
== PFOTHERS_MULTIPLE
)
4753 (*state
)->timeout
= PFTM_OTHER_MULTIPLE
;
4755 (*state
)->timeout
= PFTM_OTHER_SINGLE
;
4757 /* translate source/destination address, if necessary */
4758 if (STATE_TRANSLATE(*state
)) {
4759 if (direction
== PF_OUT
)
4763 pf_change_a(&pd
->src
->v4
.s_addr
,
4764 pd
->ip_sum
, (*state
)->gwy
.addr
.v4
.s_addr
,
4770 PF_ACPY(pd
->src
, &(*state
)->gwy
.addr
, pd
->af
);
4778 pf_change_a(&pd
->dst
->v4
.s_addr
,
4779 pd
->ip_sum
, (*state
)->lan
.addr
.v4
.s_addr
,
4785 PF_ACPY(pd
->dst
, &(*state
)->lan
.addr
, pd
->af
);
4795 * ipoff and off are measured from the start of the mbuf chain.
4796 * h must be at "ipoff" on the mbuf chain.
4799 pf_pull_hdr(struct mbuf
*m
, int off
, void *p
, int len
,
4800 u_short
*actionp
, u_short
*reasonp
, sa_family_t af
)
4805 struct ip
*h
= mtod(m
, struct ip
*);
4806 u_int16_t fragoff
= (h
->ip_off
& IP_OFFMASK
) << 3;
4810 ACTION_SET(actionp
, PF_PASS
);
4812 ACTION_SET(actionp
, PF_DROP
);
4813 REASON_SET(reasonp
, PFRES_FRAG
);
4817 if (m
->m_pkthdr
.len
< off
+ len
||
4818 h
->ip_len
< off
+ len
) {
4819 ACTION_SET(actionp
, PF_DROP
);
4820 REASON_SET(reasonp
, PFRES_SHORT
);
4828 struct ip6_hdr
*h
= mtod(m
, struct ip6_hdr
*);
4830 if (m
->m_pkthdr
.len
< off
+ len
||
4831 (ntohs(h
->ip6_plen
) + sizeof(struct ip6_hdr
)) <
4832 (unsigned)(off
+ len
)) {
4833 ACTION_SET(actionp
, PF_DROP
);
4834 REASON_SET(reasonp
, PFRES_SHORT
);
4841 m_copydata(m
, off
, len
, p
);
4846 pf_routable(struct pf_addr
*addr
, sa_family_t af
)
4848 struct sockaddr_in
*dst
;
4852 bzero(&ro
, sizeof(ro
));
4853 dst
= satosin(&ro
.ro_dst
);
4854 dst
->sin_family
= af
;
4855 dst
->sin_len
= sizeof(*dst
);
4856 dst
->sin_addr
= addr
->v4
;
4857 rtalloc_ign(&ro
, (RTF_CLONING
| RTF_PRCLONING
));
4859 if (ro
.ro_rt
!= NULL
) {
4869 pf_route(struct mbuf
**m
, struct pf_rule
*r
, int dir
, struct ifnet
*oifp
,
4872 struct mbuf
*m0
, *m1
;
4873 struct route iproute
;
4874 struct route
*ro
= NULL
;
4875 struct sockaddr_in
*dst
;
4877 struct ifnet
*ifp
= NULL
;
4878 struct pf_addr naddr
;
4879 struct pf_src_node
*sn
= NULL
;
4883 if (m
== NULL
|| *m
== NULL
|| r
== NULL
||
4884 (dir
!= PF_IN
&& dir
!= PF_OUT
) || oifp
== NULL
)
4885 panic("pf_route: invalid parameters");
4887 if (((*m
)->m_pkthdr
.pf_flags
& PF_MBUF_ROUTED
) == 0) {
4888 (*m
)->m_pkthdr
.pf_flags
|= PF_MBUF_ROUTED
;
4889 (*m
)->m_pkthdr
.pf_routed
= 1;
4891 if ((*m
)->m_pkthdr
.pf_routed
> 3) {
4896 (*m
)->m_pkthdr
.pf_routed
++;
4899 if (r
->rt
== PF_DUPTO
) {
4900 if ((m0
= m_dup(*m
, MB_DONTWAIT
)) == NULL
)
4903 if ((r
->rt
== PF_REPLYTO
) == (r
->direction
== dir
))
4908 if (m0
->m_len
< sizeof(struct ip
))
4909 panic("pf_route: m0->m_len < sizeof(struct ip)");
4910 ip
= mtod(m0
, struct ip
*);
4913 bzero((caddr_t
)ro
, sizeof(*ro
));
4914 dst
= satosin(&ro
->ro_dst
);
4915 dst
->sin_family
= AF_INET
;
4916 dst
->sin_len
= sizeof(*dst
);
4917 dst
->sin_addr
= ip
->ip_dst
;
4919 if (r
->rt
== PF_FASTROUTE
) {
4921 if (ro
->ro_rt
== 0) {
4922 ipstat
.ips_noroute
++;
4926 ifp
= ro
->ro_rt
->rt_ifp
;
4927 ro
->ro_rt
->rt_use
++;
4929 if (ro
->ro_rt
->rt_flags
& RTF_GATEWAY
)
4930 dst
= satosin(ro
->ro_rt
->rt_gateway
);
4932 if (TAILQ_EMPTY(&r
->rpool
.list
))
4933 panic("pf_route: TAILQ_EMPTY(&r->rpool.list)");
4935 pf_map_addr(AF_INET
, r
, (struct pf_addr
*)&ip
->ip_src
,
4937 if (!PF_AZERO(&naddr
, AF_INET
))
4938 dst
->sin_addr
.s_addr
= naddr
.v4
.s_addr
;
4939 ifp
= r
->rpool
.cur
->kif
?
4940 r
->rpool
.cur
->kif
->pfik_ifp
: NULL
;
4942 if (!PF_AZERO(&s
->rt_addr
, AF_INET
))
4943 dst
->sin_addr
.s_addr
=
4944 s
->rt_addr
.v4
.s_addr
;
4945 ifp
= s
->rt_kif
? s
->rt_kif
->pfik_ifp
: NULL
;
4952 if (pf_test(PF_OUT
, ifp
, &m0
) != PF_PASS
)
4954 else if (m0
== NULL
)
4956 if (m0
->m_len
< sizeof(struct ip
))
4957 panic("pf_route: m0->m_len < sizeof(struct ip)");
4958 ip
= mtod(m0
, struct ip
*);
4961 /* Copied from ip_output. */
4962 m0
->m_pkthdr
.csum_flags
|= CSUM_IP
;
4963 sw_csum
= m0
->m_pkthdr
.csum_flags
& ~ifp
->if_hwassist
;
4964 if (sw_csum
& CSUM_DELAY_DATA
) {
4965 in_delayed_cksum(m0
);
4966 sw_csum
&= ~CSUM_DELAY_DATA
;
4968 m0
->m_pkthdr
.csum_flags
&= ifp
->if_hwassist
;
4971 * If small enough for interface, or the interface will take
4972 * care of the fragmentation for us, can just send directly.
4974 if (ip
->ip_len
<= ifp
->if_mtu
|| ((ifp
->if_hwassist
& CSUM_FRAGMENT
) &&
4975 (ip
->ip_off
& IP_DF
) == 0)) {
4976 ip
->ip_len
= htons(ip
->ip_len
);
4977 ip
->ip_off
= htons(ip
->ip_off
);
4979 if (sw_csum
& CSUM_DELAY_IP
) {
4981 if (ip
->ip_v
== IPVERSION
&&
4982 (ip
->ip_hl
<< 2) == sizeof(*ip
)) {
4983 ip
->ip_sum
= in_cksum_hdr(ip
);
4985 ip
->ip_sum
= in_cksum(m0
, ip
->ip_hl
<< 2);
4989 error
= (*ifp
->if_output
)(ifp
, m0
, sintosa(dst
), ro
->ro_rt
);
4994 * Too large for interface; fragment if possible.
4995 * Must be able to put at least 8 bytes per fragment.
4997 if (ip
->ip_off
& IP_DF
) {
4998 ipstat
.ips_cantfrag
++;
4999 if (r
->rt
!= PF_DUPTO
) {
5000 icmp_error(m0
, ICMP_UNREACH
, ICMP_UNREACH_NEEDFRAG
, 0,
5008 error
= ip_fragment(ip
, &m0
, ifp
->if_mtu
, ifp
->if_hwassist
, sw_csum
);
5012 for (m0
= m1
; m0
; m0
= m1
) {
5016 error
= (*ifp
->if_output
)(ifp
, m0
, sintosa(dst
),
5023 ipstat
.ips_fragmented
++;
5026 if (r
->rt
!= PF_DUPTO
)
5028 if (ro
== &iproute
&& ro
->ro_rt
)
5040 pf_route6(struct mbuf
**m
, struct pf_rule
*r
, int dir
, struct ifnet
*oifp
,
5044 struct route_in6 ip6route
;
5045 struct route_in6
*ro
;
5046 struct sockaddr_in6
*dst
;
5047 struct ip6_hdr
*ip6
;
5048 struct ifnet
*ifp
= NULL
;
5049 struct pf_addr naddr
;
5050 struct pf_src_node
*sn
= NULL
;
5053 if (m
== NULL
|| *m
== NULL
|| r
== NULL
||
5054 (dir
!= PF_IN
&& dir
!= PF_OUT
) || oifp
== NULL
)
5055 panic("pf_route6: invalid parameters");
5057 if (((*m
)->m_pkthdr
.pf_flags
& PF_MBUF_ROUTED
) == 0) {
5058 (*m
)->m_pkthdr
.pf_flags
|= PF_MBUF_ROUTED
;
5059 (*m
)->m_pkthdr
.pf_routed
= 1;
5061 if ((*m
)->m_pkthdr
.pf_routed
> 3) {
5066 (*m
)->m_pkthdr
.pf_routed
++;
5069 if (r
->rt
== PF_DUPTO
) {
5070 if ((m0
= m_dup(*m
, MB_DONTWAIT
)) == NULL
)
5073 if ((r
->rt
== PF_REPLYTO
) == (r
->direction
== dir
))
5078 if (m0
->m_len
< sizeof(struct ip6_hdr
))
5079 panic("pf_route6: m0->m_len < sizeof(struct ip6_hdr)");
5080 ip6
= mtod(m0
, struct ip6_hdr
*);
5083 bzero((caddr_t
)ro
, sizeof(*ro
));
5084 dst
= (struct sockaddr_in6
*)&ro
->ro_dst
;
5085 dst
->sin6_family
= AF_INET6
;
5086 dst
->sin6_len
= sizeof(*dst
);
5087 dst
->sin6_addr
= ip6
->ip6_dst
;
5090 if (r
->rt
== PF_FASTROUTE
) {
5091 m0
->m_pkthdr
.pf_flags
|= PF_MBUF_GENERATED
;
5092 ip6_output(m0
, NULL
, NULL
, 0, NULL
, NULL
, NULL
);
5096 if (TAILQ_EMPTY(&r
->rpool
.list
))
5097 panic("pf_route6: TAILQ_EMPTY(&r->rpool.list)");
5099 pf_map_addr(AF_INET6
, r
, (struct pf_addr
*)&ip6
->ip6_src
,
5101 if (!PF_AZERO(&naddr
, AF_INET6
))
5102 PF_ACPY((struct pf_addr
*)&dst
->sin6_addr
,
5104 ifp
= r
->rpool
.cur
->kif
? r
->rpool
.cur
->kif
->pfik_ifp
: NULL
;
5106 if (!PF_AZERO(&s
->rt_addr
, AF_INET6
))
5107 PF_ACPY((struct pf_addr
*)&dst
->sin6_addr
,
5108 &s
->rt_addr
, AF_INET6
);
5109 ifp
= s
->rt_kif
? s
->rt_kif
->pfik_ifp
: NULL
;
5115 if (pf_test6(PF_OUT
, ifp
, &m0
) != PF_PASS
)
5117 else if (m0
== NULL
)
5119 if (m0
->m_len
< sizeof(struct ip6_hdr
))
5120 panic("pf_route6: m0->m_len < sizeof(struct ip6_hdr)");
5121 ip6
= mtod(m0
, struct ip6_hdr
*);
5125 * If the packet is too large for the outgoing interface,
5126 * send back an icmp6 error.
5128 if (IN6_IS_ADDR_LINKLOCAL(&dst
->sin6_addr
))
5129 dst
->sin6_addr
.s6_addr16
[1] = htons(ifp
->if_index
);
5130 if ((u_long
)m0
->m_pkthdr
.len
<= ifp
->if_mtu
) {
5131 error
= nd6_output(ifp
, ifp
, m0
, dst
, NULL
);
5133 in6_ifstat_inc(ifp
, ifs6_in_toobig
);
5134 if (r
->rt
!= PF_DUPTO
)
5135 icmp6_error(m0
, ICMP6_PACKET_TOO_BIG
, 0, ifp
->if_mtu
);
5141 if (r
->rt
!= PF_DUPTO
)
5153 * check protocol (tcp/udp/icmp/icmp6) checksum and set mbuf flag
5154 * off is the offset where the protocol header starts
5155 * len is the total length of protocol header plus payload
5156 * returns 0 when the checksum is valid, otherwise returns 1.
5160 * FreeBSD supports cksum offload for the following drivers.
5161 * em(4), gx(4), lge(4), nge(4), ti(4), xl(4)
5162 * If we can make full use of it we would outperform ipfw/ipfilter in
5163 * very heavy traffic.
5164 * I have not tested 'cause I don't have NICs that supports cksum offload.
5165 * (There might be problems. Typical phenomena would be
5166 * 1. No route message for UDP packet.
5167 * 2. No connection acceptance from external hosts regardless of rule set.)
5170 pf_check_proto_cksum(struct mbuf
*m
, int off
, int len
, u_int8_t p
,
5177 if (off
< sizeof(struct ip
) || len
< sizeof(struct udphdr
))
5179 if (m
->m_pkthdr
.len
< off
+ len
)
5185 if (m
->m_pkthdr
.csum_flags
& CSUM_DATA_VALID
) {
5186 if (m
->m_pkthdr
.csum_flags
& CSUM_PSEUDO_HDR
) {
5187 sum
= m
->m_pkthdr
.csum_data
;
5189 ip
= mtod(m
, struct ip
*);
5190 sum
= in_pseudo(ip
->ip_src
.s_addr
,
5191 ip
->ip_dst
.s_addr
, htonl((u_short
)len
+
5192 m
->m_pkthdr
.csum_data
+ p
));
5200 case IPPROTO_ICMPV6
:
5210 if (p
== IPPROTO_ICMP
) {
5215 sum
= in_cksum(m
, len
);
5219 if (m
->m_len
< sizeof(struct ip
))
5221 sum
= in_cksum_range(m
, p
, off
, len
);
5223 m
->m_pkthdr
.csum_flags
|=
5226 m
->m_pkthdr
.csum_data
= 0xffff;
5232 if (m
->m_len
< sizeof(struct ip6_hdr
))
5234 sum
= in6_cksum(m
, p
, off
, len
);
5237 * IPv6 H/W cksum off-load not supported yet!
5240 * m->m_pkthdr.csum_flags |=
5241 * (CSUM_DATA_VALID|CSUM_PSEUDO_HDR);
5242 * m->m_pkthdr.csum_data = 0xffff;
5254 tcpstat
.tcps_rcvbadsum
++;
5257 udpstat
.udps_badsum
++;
5260 icmpstat
.icps_checksum
++;
5263 case IPPROTO_ICMPV6
:
5264 icmp6stat
.icp6s_checksum
++;
5275 pf_test(int dir
, struct ifnet
*ifp
, struct mbuf
**m0
)
5277 struct pfi_kif
*kif
;
5278 u_short action
, reason
= 0, log
= 0;
5279 struct mbuf
*m
= *m0
;
5280 struct ip
*h
= NULL
;
5281 struct pf_rule
*a
= NULL
, *r
= &pf_default_rule
, *tr
, *nr
;
5282 struct pf_state
*s
= NULL
;
5283 struct pf_ruleset
*ruleset
= NULL
;
5285 int off
, dirndx
, pqid
= 0;
5287 if (!pf_status
.running
|| (m
->m_pkthdr
.pf_flags
& PF_MBUF_GENERATED
))
5290 kif
= pfi_index2kif
[ifp
->if_index
];
5295 if ((m
->m_flags
& M_PKTHDR
) == 0)
5296 panic("non-M_PKTHDR is passed to pf_test");
5299 memset(&pd
, 0, sizeof(pd
));
5300 if (m
->m_pkthdr
.len
< (int)sizeof(*h
)) {
5302 REASON_SET(&reason
, PFRES_SHORT
);
5307 /* We do IP header normalization and packet reassembly here */
5308 if (pf_normalize_ip(m0
, dir
, kif
, &reason
) != PF_PASS
) {
5313 h
= mtod(m
, struct ip
*);
5315 off
= h
->ip_hl
<< 2;
5316 if (off
< (int)sizeof(*h
)) {
5318 REASON_SET(&reason
, PFRES_SHORT
);
5323 pd
.src
= (struct pf_addr
*)&h
->ip_src
;
5324 pd
.dst
= (struct pf_addr
*)&h
->ip_dst
;
5325 PF_ACPY(&pd
.baddr
, dir
== PF_OUT
? pd
.src
: pd
.dst
, AF_INET
);
5326 pd
.ip_sum
= &h
->ip_sum
;
5330 pd
.tot_len
= h
->ip_len
;
5332 /* handle fragments that didn't get reassembled by normalization */
5333 if (h
->ip_off
& (IP_MF
| IP_OFFMASK
)) {
5334 action
= pf_test_fragment(&r
, dir
, kif
, m
, h
,
5345 if (!pf_pull_hdr(m
, off
, &th
, sizeof(th
),
5346 &action
, &reason
, AF_INET
)) {
5347 log
= action
!= PF_PASS
;
5350 if (dir
== PF_IN
&& pf_check_proto_cksum(m
, off
,
5351 h
->ip_len
- off
, IPPROTO_TCP
, AF_INET
)) {
5355 pd
.p_len
= pd
.tot_len
- off
- (th
.th_off
<< 2);
5356 if ((th
.th_flags
& TH_ACK
) && pd
.p_len
== 0)
5358 action
= pf_normalize_tcp(dir
, kif
, m
, 0, off
, h
, &pd
);
5359 if (action
== PF_DROP
)
5361 action
= pf_test_state_tcp(&s
, dir
, kif
, m
, off
, h
, &pd
,
5363 if (action
== PF_PASS
) {
5365 pfsync_update_state(s
);
5370 } else if (s
== NULL
)
5371 action
= pf_test_tcp(&r
, &s
, dir
, kif
,
5372 m
, off
, h
, &pd
, &a
, &ruleset
);
5380 if (!pf_pull_hdr(m
, off
, &uh
, sizeof(uh
),
5381 &action
, &reason
, AF_INET
)) {
5382 log
= action
!= PF_PASS
;
5385 if (dir
== PF_IN
&& uh
.uh_sum
&& pf_check_proto_cksum(m
,
5386 off
, h
->ip_len
- off
, IPPROTO_UDP
, AF_INET
)) {
5390 if (uh
.uh_dport
== 0 ||
5391 ntohs(uh
.uh_ulen
) > m
->m_pkthdr
.len
- off
||
5392 ntohs(uh
.uh_ulen
) < sizeof(struct udphdr
)) {
5396 action
= pf_test_state_udp(&s
, dir
, kif
, m
, off
, h
, &pd
);
5397 if (action
== PF_PASS
) {
5399 pfsync_update_state(s
);
5404 } else if (s
== NULL
)
5405 action
= pf_test_udp(&r
, &s
, dir
, kif
,
5406 m
, off
, h
, &pd
, &a
, &ruleset
);
5410 case IPPROTO_ICMP
: {
5414 if (!pf_pull_hdr(m
, off
, &ih
, ICMP_MINLEN
,
5415 &action
, &reason
, AF_INET
)) {
5416 log
= action
!= PF_PASS
;
5419 if (dir
== PF_IN
&& pf_check_proto_cksum(m
, off
,
5420 h
->ip_len
- off
, IPPROTO_ICMP
, AF_INET
)) {
5424 action
= pf_test_state_icmp(&s
, dir
, kif
, m
, off
, h
, &pd
);
5425 if (action
== PF_PASS
) {
5427 pfsync_update_state(s
);
5432 } else if (s
== NULL
)
5433 action
= pf_test_icmp(&r
, &s
, dir
, kif
,
5434 m
, off
, h
, &pd
, &a
, &ruleset
);
5439 action
= pf_test_state_other(&s
, dir
, kif
, &pd
);
5440 if (action
== PF_PASS
) {
5442 pfsync_update_state(s
);
5447 } else if (s
== NULL
)
5448 action
= pf_test_other(&r
, &s
, dir
, kif
, m
, off
, h
,
5454 if (action
== PF_PASS
&& h
->ip_hl
> 5 &&
5455 !((s
&& s
->allow_opts
) || r
->allow_opts
)) {
5457 REASON_SET(&reason
, PFRES_SHORT
);
5459 DPFPRINTF(PF_DEBUG_MISC
,
5460 ("pf: dropping packet with ip options\n"));
5464 if (action
== PF_PASS
&& r
->qid
) {
5466 struct altq_tag
*atag
;
5468 mtag
= m_tag_get(PACKET_TAG_PF_QID
, sizeof(*atag
), MB_DONTWAIT
);
5470 atag
= (struct altq_tag
*)(mtag
+ 1);
5471 if (pqid
|| pd
.tos
== IPTOS_LOWDELAY
)
5472 atag
->qid
= r
->pqid
;
5475 /* add hints for ecn */
5478 m_tag_prepend(m
, mtag
);
5484 * connections redirected to loopback should not match sockets
5485 * bound specifically to loopback due to security implications,
5486 * see tcp_input() and in_pcblookup_listen().
5488 if (dir
== PF_IN
&& action
== PF_PASS
&& (pd
.proto
== IPPROTO_TCP
||
5489 pd
.proto
== IPPROTO_UDP
) && s
!= NULL
&& s
->nat_rule
.ptr
!= NULL
&&
5490 (s
->nat_rule
.ptr
->action
== PF_RDR
||
5491 s
->nat_rule
.ptr
->action
== PF_BINAT
) &&
5492 (ntohl(pd
.dst
->v4
.s_addr
) >> IN_CLASSA_NSHIFT
) == IN_LOOPBACKNET
) {
5494 REASON_SET(&reason
, PFRES_MEMORY
);
5497 m
->m_pkthdr
.pf_flags
|= PF_MBUF_TRANSLATE_LOCALHOST
;
5500 PFLOG_PACKET(kif
, h
, m
, AF_INET
, dir
, reason
, r
, a
, ruleset
);
5502 kif
->pfik_bytes
[0][dir
== PF_OUT
][action
!= PF_PASS
] += pd
.tot_len
;
5503 kif
->pfik_packets
[0][dir
== PF_OUT
][action
!= PF_PASS
]++;
5505 if (action
== PF_PASS
|| r
->action
== PF_DROP
) {
5507 r
->bytes
+= pd
.tot_len
;
5510 a
->bytes
+= pd
.tot_len
;
5513 dirndx
= (dir
== s
->direction
) ? 0 : 1;
5514 s
->packets
[dirndx
]++;
5515 s
->bytes
[dirndx
] += pd
.tot_len
;
5516 if (s
->nat_rule
.ptr
!= NULL
) {
5517 s
->nat_rule
.ptr
->packets
++;
5518 s
->nat_rule
.ptr
->bytes
+= pd
.tot_len
;
5520 if (s
->src_node
!= NULL
) {
5521 s
->src_node
->packets
++;
5522 s
->src_node
->bytes
+= pd
.tot_len
;
5524 if (s
->nat_src_node
!= NULL
) {
5525 s
->nat_src_node
->packets
++;
5526 s
->nat_src_node
->bytes
+= pd
.tot_len
;
5530 nr
= (s
!= NULL
) ? s
->nat_rule
.ptr
: pd
.nat_rule
;
5534 * XXX: we need to make sure that the addresses
5535 * passed to pfr_update_stats() are the same than
5536 * the addresses used during matching (pfr_match)
5538 if (r
== &pf_default_rule
) {
5540 x
= (s
== NULL
|| s
->direction
== dir
) ?
5541 &pd
.baddr
: &pd
.naddr
;
5543 x
= (s
== NULL
|| s
->direction
== dir
) ?
5544 &pd
.naddr
: &pd
.baddr
;
5545 if (x
== &pd
.baddr
|| s
== NULL
) {
5546 /* we need to change the address */
5553 if (tr
->src
.addr
.type
== PF_ADDR_TABLE
)
5554 pfr_update_stats(tr
->src
.addr
.p
.tbl
, (s
== NULL
||
5555 s
->direction
== dir
) ? pd
.src
: pd
.dst
, pd
.af
,
5556 pd
.tot_len
, dir
== PF_OUT
, r
->action
== PF_PASS
,
5558 if (tr
->dst
.addr
.type
== PF_ADDR_TABLE
)
5559 pfr_update_stats(tr
->dst
.addr
.p
.tbl
, (s
== NULL
||
5560 s
->direction
== dir
) ? pd
.dst
: pd
.src
, pd
.af
,
5561 pd
.tot_len
, dir
== PF_OUT
, r
->action
== PF_PASS
,
5566 if (action
== PF_SYNPROXY_DROP
) {
5571 /* pf_route can free the mbuf causing *m0 to become NULL */
5572 pf_route(m0
, r
, dir
, ifp
, s
);
5580 pf_test6(int dir
, struct ifnet
*ifp
, struct mbuf
**m0
)
5582 struct pfi_kif
*kif
;
5583 u_short action
, reason
= 0, log
= 0;
5584 struct mbuf
*m
= *m0
;
5586 struct pf_rule
*a
= NULL
, *r
= &pf_default_rule
, *tr
, *nr
;
5587 struct pf_state
*s
= NULL
;
5588 struct pf_ruleset
*ruleset
= NULL
;
5590 int off
, terminal
= 0, dirndx
;
5592 if (!pf_status
.running
|| (m
->m_pkthdr
.pf_flags
& PF_MBUF_GENERATED
))
5595 kif
= pfi_index2kif
[ifp
->if_index
];
5600 if ((m
->m_flags
& M_PKTHDR
) == 0)
5601 panic("non-M_PKTHDR is passed to pf_test");
5604 memset(&pd
, 0, sizeof(pd
));
5605 if (m
->m_pkthdr
.len
< (int)sizeof(*h
)) {
5607 REASON_SET(&reason
, PFRES_SHORT
);
5612 /* We do IP header normalization and packet reassembly here */
5613 if (pf_normalize_ip6(m0
, dir
, kif
, &reason
) != PF_PASS
) {
5618 h
= mtod(m
, struct ip6_hdr
*);
5620 pd
.src
= (struct pf_addr
*)&h
->ip6_src
;
5621 pd
.dst
= (struct pf_addr
*)&h
->ip6_dst
;
5622 PF_ACPY(&pd
.baddr
, dir
== PF_OUT
? pd
.src
: pd
.dst
, AF_INET6
);
5626 pd
.tot_len
= ntohs(h
->ip6_plen
) + sizeof(struct ip6_hdr
);
5628 off
= ((caddr_t
)h
- m
->m_data
) + sizeof(struct ip6_hdr
);
5629 pd
.proto
= h
->ip6_nxt
;
5632 case IPPROTO_FRAGMENT
:
5633 action
= pf_test_fragment(&r
, dir
, kif
, m
, h
,
5635 if (action
== PF_DROP
)
5636 REASON_SET(&reason
, PFRES_FRAG
);
5639 case IPPROTO_HOPOPTS
:
5640 case IPPROTO_ROUTING
:
5641 case IPPROTO_DSTOPTS
: {
5642 /* get next header and header length */
5643 struct ip6_ext opt6
;
5645 if (!pf_pull_hdr(m
, off
, &opt6
, sizeof(opt6
),
5646 NULL
, NULL
, pd
.af
)) {
5647 DPFPRINTF(PF_DEBUG_MISC
,
5648 ("pf: IPv6 short opt\n"));
5650 REASON_SET(&reason
, PFRES_SHORT
);
5654 if (pd
.proto
== IPPROTO_AH
)
5655 off
+= (opt6
.ip6e_len
+ 2) * 4;
5657 off
+= (opt6
.ip6e_len
+ 1) * 8;
5658 pd
.proto
= opt6
.ip6e_nxt
;
5659 /* goto the next header */
5666 } while (!terminal
);
5674 if (!pf_pull_hdr(m
, off
, &th
, sizeof(th
),
5675 &action
, &reason
, AF_INET6
)) {
5676 log
= action
!= PF_PASS
;
5679 if (dir
== PF_IN
&& pf_check_proto_cksum(m
, off
,
5680 ntohs(h
->ip6_plen
), IPPROTO_TCP
, AF_INET6
)) {
5684 pd
.p_len
= pd
.tot_len
- off
- (th
.th_off
<< 2);
5685 action
= pf_normalize_tcp(dir
, kif
, m
, 0, off
, h
, &pd
);
5686 if (action
== PF_DROP
)
5688 action
= pf_test_state_tcp(&s
, dir
, kif
, m
, off
, h
, &pd
,
5690 if (action
== PF_PASS
) {
5692 pfsync_update_state(s
);
5697 } else if (s
== NULL
)
5698 action
= pf_test_tcp(&r
, &s
, dir
, kif
,
5699 m
, off
, h
, &pd
, &a
, &ruleset
);
5707 if (!pf_pull_hdr(m
, off
, &uh
, sizeof(uh
),
5708 &action
, &reason
, AF_INET6
)) {
5709 log
= action
!= PF_PASS
;
5712 if (dir
== PF_IN
&& uh
.uh_sum
&& pf_check_proto_cksum(m
,
5713 off
, ntohs(h
->ip6_plen
), IPPROTO_UDP
, AF_INET6
)) {
5717 if (uh
.uh_dport
== 0 ||
5718 ntohs(uh
.uh_ulen
) > m
->m_pkthdr
.len
- off
||
5719 ntohs(uh
.uh_ulen
) < sizeof(struct udphdr
)) {
5723 action
= pf_test_state_udp(&s
, dir
, kif
, m
, off
, h
, &pd
);
5724 if (action
== PF_PASS
) {
5726 pfsync_update_state(s
);
5731 } else if (s
== NULL
)
5732 action
= pf_test_udp(&r
, &s
, dir
, kif
,
5733 m
, off
, h
, &pd
, &a
, &ruleset
);
5737 case IPPROTO_ICMPV6
: {
5738 struct icmp6_hdr ih
;
5741 if (!pf_pull_hdr(m
, off
, &ih
, sizeof(ih
),
5742 &action
, &reason
, AF_INET6
)) {
5743 log
= action
!= PF_PASS
;
5746 if (dir
== PF_IN
&& pf_check_proto_cksum(m
, off
,
5747 ntohs(h
->ip6_plen
), IPPROTO_ICMPV6
, AF_INET6
)) {
5751 action
= pf_test_state_icmp(&s
, dir
, kif
,
5753 if (action
== PF_PASS
) {
5755 pfsync_update_state(s
);
5760 } else if (s
== NULL
)
5761 action
= pf_test_icmp(&r
, &s
, dir
, kif
,
5762 m
, off
, h
, &pd
, &a
, &ruleset
);
5767 action
= pf_test_state_other(&s
, dir
, kif
, &pd
);
5768 if (action
== PF_PASS
) {
5772 } else if (s
== NULL
)
5773 action
= pf_test_other(&r
, &s
, dir
, kif
, m
, off
, h
,
5779 /* XXX handle IPv6 options, if not allowed. not implemented. */
5782 if (action
== PF_PASS
&& r
->qid
) {
5784 struct altq_tag
*atag
;
5786 mtag
= m_tag_get(PACKET_TAG_PF_QID
, sizeof(*atag
), MB_DONTWAIT
);
5788 atag
= (struct altq_tag
*)(mtag
+ 1);
5789 if (pd
.tos
== IPTOS_LOWDELAY
)
5790 atag
->qid
= r
->pqid
;
5793 /* add hints for ecn */
5794 atag
->af
= AF_INET6
;
5796 m_tag_prepend(m
, mtag
);
5801 if (dir
== PF_IN
&& action
== PF_PASS
&& (pd
.proto
== IPPROTO_TCP
||
5802 pd
.proto
== IPPROTO_UDP
) && s
!= NULL
&& s
->nat_rule
.ptr
!= NULL
&&
5803 (s
->nat_rule
.ptr
->action
== PF_RDR
||
5804 s
->nat_rule
.ptr
->action
== PF_BINAT
) &&
5805 IN6_IS_ADDR_LOOPBACK(&pd
.dst
->v6
)) {
5807 REASON_SET(&reason
, PFRES_MEMORY
);
5810 m
->m_pkthdr
.pf_flags
|= PF_MBUF_TRANSLATE_LOCALHOST
;
5813 PFLOG_PACKET(kif
, h
, m
, AF_INET6
, dir
, reason
, r
, a
, ruleset
);
5815 kif
->pfik_bytes
[1][dir
== PF_OUT
][action
!= PF_PASS
] += pd
.tot_len
;
5816 kif
->pfik_packets
[1][dir
== PF_OUT
][action
!= PF_PASS
]++;
5818 if (action
== PF_PASS
|| r
->action
== PF_DROP
) {
5820 r
->bytes
+= pd
.tot_len
;
5823 a
->bytes
+= pd
.tot_len
;
5826 dirndx
= (dir
== s
->direction
) ? 0 : 1;
5827 s
->packets
[dirndx
]++;
5828 s
->bytes
[dirndx
] += pd
.tot_len
;
5829 if (s
->nat_rule
.ptr
!= NULL
) {
5830 s
->nat_rule
.ptr
->packets
++;
5831 s
->nat_rule
.ptr
->bytes
+= pd
.tot_len
;
5833 if (s
->src_node
!= NULL
) {
5834 s
->src_node
->packets
++;
5835 s
->src_node
->bytes
+= pd
.tot_len
;
5837 if (s
->nat_src_node
!= NULL
) {
5838 s
->nat_src_node
->packets
++;
5839 s
->nat_src_node
->bytes
+= pd
.tot_len
;
5843 nr
= (s
!= NULL
) ? s
->nat_rule
.ptr
: pd
.nat_rule
;
5847 * XXX: we need to make sure that the addresses
5848 * passed to pfr_update_stats() are the same than
5849 * the addresses used during matching (pfr_match)
5851 if (r
== &pf_default_rule
) {
5853 x
= (s
== NULL
|| s
->direction
== dir
) ?
5854 &pd
.baddr
: &pd
.naddr
;
5856 x
= (s
== NULL
|| s
->direction
== dir
) ?
5857 &pd
.naddr
: &pd
.baddr
;
5859 if (x
== &pd
.baddr
|| s
== NULL
) {
5866 if (tr
->src
.addr
.type
== PF_ADDR_TABLE
)
5867 pfr_update_stats(tr
->src
.addr
.p
.tbl
, (s
== NULL
||
5868 s
->direction
== dir
) ? pd
.src
: pd
.dst
, pd
.af
,
5869 pd
.tot_len
, dir
== PF_OUT
, r
->action
== PF_PASS
,
5871 if (tr
->dst
.addr
.type
== PF_ADDR_TABLE
)
5872 pfr_update_stats(tr
->dst
.addr
.p
.tbl
, (s
== NULL
||
5873 s
->direction
== dir
) ? pd
.dst
: pd
.src
, pd
.af
,
5874 pd
.tot_len
, dir
== PF_OUT
, r
->action
== PF_PASS
,
5879 if (action
== PF_SYNPROXY_DROP
) {
5884 /* pf_route6 can free the mbuf causing *m0 to become NULL */
5885 pf_route6(m0
, r
, dir
, ifp
, s
);