1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2001 Daniel Hartmeier
5 * Copyright (c) 2002 - 2008 Henning Brauer
6 * Copyright (c) 2012 Gleb Smirnoff <glebius@FreeBSD.org>
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * - Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * - Redistributions in binary form must reproduce the above
16 * copyright notice, this list of conditions and the following
17 * disclaimer in the documentation and/or other materials provided
18 * with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31 * POSSIBILITY OF SUCH DAMAGE.
32 *
33 * Effort sponsored in part by the Defense Advanced Research Projects
34 * Agency (DARPA) and Air Force Research Laboratory, Air Force
35 * Materiel Command, USAF, under agreement number F30602-01-2-0537.
36 *
37 * $OpenBSD: pf.c,v 1.634 2009/02/27 12:37:45 henning Exp $
38 */
39
40 #include <sys/cdefs.h>
41 __FBSDID("$FreeBSD: stable/12/sys/netpfil/pf/pf.c 373284 2023-12-05 18:31:13Z markj $");
42
43 #include "opt_bpf.h"
44 #include "opt_inet.h"
45 #include "opt_inet6.h"
46 #include "opt_pf.h"
47 #include "opt_sctp.h"
48
49 #include <sys/param.h>
50 #include <sys/bus.h>
51 #include <sys/endian.h>
52 #include <sys/gsb_crc32.h>
53 #include <sys/hash.h>
54 #include <sys/interrupt.h>
55 #include <sys/kernel.h>
56 #include <sys/kthread.h>
57 #include <sys/limits.h>
58 #include <sys/mbuf.h>
59 #include <sys/md5.h>
60 #include <sys/random.h>
61 #include <sys/refcount.h>
62 #include <sys/sdt.h>
63 #include <sys/socket.h>
64 #include <sys/sysctl.h>
65 #include <sys/taskqueue.h>
66 #include <sys/ucred.h>
67
68 #include <net/if.h>
69 #include <net/if_var.h>
70 #include <net/if_types.h>
71 #include <net/if_vlan_var.h>
72 #include <net/route.h>
73 #include <net/radix_mpath.h>
74 #include <net/vnet.h>
75
76 #include <net/pfil.h>
77 #include <net/pfvar.h>
78 #include <net/if_pflog.h>
79 #include <net/if_pfsync.h>
80
81 #include <netinet/in_pcb.h>
82 #include <netinet/in_var.h>
83 #include <netinet/in_fib.h>
84 #include <netinet/ip.h>
85 #include <netinet/ip_fw.h>
86 #include <netinet/ip_icmp.h>
87 #include <netinet/icmp_var.h>
88 #include <netinet/ip_var.h>
89 #include <netinet/tcp.h>
90 #include <netinet/tcp_fsm.h>
91 #include <netinet/tcp_seq.h>
92 #include <netinet/tcp_timer.h>
93 #include <netinet/tcp_var.h>
94 #include <netinet/udp.h>
95 #include <netinet/udp_var.h>
96
97 #include <netpfil/ipfw/ip_fw_private.h> /* XXX: only for DIR_IN/DIR_OUT */
98
99 #ifdef INET6
100 #include <netinet/ip6.h>
101 #include <netinet/icmp6.h>
102 #include <netinet6/nd6.h>
103 #include <netinet6/ip6_var.h>
104 #include <netinet6/in6_pcb.h>
105 #include <netinet6/in6_fib.h>
106 #include <netinet6/scope6_var.h>
107 #endif /* INET6 */
108
109 #if defined(SCTP) || defined(SCTP_SUPPORT)
110 #include <netinet/sctp_crc32.h>
111 #endif
112
113 #include <machine/in_cksum.h>
114 #include <security/mac/mac_framework.h>
115
116 #define DPFPRINTF(n, x) if (V_pf_status.debug >= (n)) printf x
117
118 SDT_PROVIDER_DEFINE(pf);
119 SDT_PROBE_DEFINE4(pf, ip, test, done, "int", "int", "struct pf_krule *",
120 "struct pf_kstate *");
121 SDT_PROBE_DEFINE4(pf, ip, test6, done, "int", "int", "struct pf_krule *",
122 "struct pf_kstate *");
123 SDT_PROBE_DEFINE5(pf, ip, state, lookup, "struct pfi_kkif *",
124 "struct pf_state_key_cmp *", "int", "struct pf_pdesc *",
125 "struct pf_kstate *");
126
127 /*
128 * Global variables
129 */
130
131 /* state tables */
132 VNET_DEFINE(struct pf_altqqueue, pf_altqs[4]);
133 VNET_DEFINE(struct pf_kpalist, pf_pabuf);
134 VNET_DEFINE(struct pf_altqqueue *, pf_altqs_active);
135 VNET_DEFINE(struct pf_altqqueue *, pf_altq_ifs_active);
136 VNET_DEFINE(struct pf_altqqueue *, pf_altqs_inactive);
137 VNET_DEFINE(struct pf_altqqueue *, pf_altq_ifs_inactive);
138 VNET_DEFINE(struct pf_kstatus, pf_status);
139
140 VNET_DEFINE(u_int32_t, ticket_altqs_active);
141 VNET_DEFINE(u_int32_t, ticket_altqs_inactive);
142 VNET_DEFINE(int, altqs_inactive_open);
143 VNET_DEFINE(u_int32_t, ticket_pabuf);
144
145 VNET_DEFINE(MD5_CTX, pf_tcp_secret_ctx);
146 #define V_pf_tcp_secret_ctx VNET(pf_tcp_secret_ctx)
147 VNET_DEFINE(u_char, pf_tcp_secret[16]);
148 #define V_pf_tcp_secret VNET(pf_tcp_secret)
149 VNET_DEFINE(int, pf_tcp_secret_init);
150 #define V_pf_tcp_secret_init VNET(pf_tcp_secret_init)
151 VNET_DEFINE(int, pf_tcp_iss_off);
152 #define V_pf_tcp_iss_off VNET(pf_tcp_iss_off)
153 VNET_DECLARE(int, pf_vnet_active);
154 #define V_pf_vnet_active VNET(pf_vnet_active)
155
156 VNET_DEFINE_STATIC(uint32_t, pf_purge_idx);
157 #define V_pf_purge_idx VNET(pf_purge_idx)
158
159 #ifdef PF_WANT_32_TO_64_COUNTER
160 VNET_DEFINE_STATIC(uint32_t, pf_counter_periodic_iter);
161 #define V_pf_counter_periodic_iter VNET(pf_counter_periodic_iter)
162
163 VNET_DEFINE(struct allrulelist_head, pf_allrulelist);
164 VNET_DEFINE(size_t, pf_allrulecount);
165 VNET_DEFINE(struct pf_krule *, pf_rulemarker);
166 #endif
167
168 /*
169 * Queue for pf_intr() sends.
170 */
171 static MALLOC_DEFINE(M_PFTEMP, "pf_temp", "pf(4) temporary allocations");
172 struct pf_send_entry {
173 STAILQ_ENTRY(pf_send_entry) pfse_next;
174 struct mbuf *pfse_m;
175 enum {
176 PFSE_IP,
177 PFSE_IP6,
178 PFSE_ICMP,
179 PFSE_ICMP6,
180 } pfse_type;
181 struct {
182 int type;
183 int code;
184 int mtu;
185 } icmpopts;
186 };
187
188 STAILQ_HEAD(pf_send_head, pf_send_entry);
189 VNET_DEFINE_STATIC(struct pf_send_head, pf_sendqueue);
190 #define V_pf_sendqueue VNET(pf_sendqueue)
191
192 static struct mtx_padalign pf_sendqueue_mtx;
193 MTX_SYSINIT(pf_sendqueue_mtx, &pf_sendqueue_mtx, "pf send queue", MTX_DEF);
194 #define PF_SENDQ_LOCK() mtx_lock(&pf_sendqueue_mtx)
195 #define PF_SENDQ_UNLOCK() mtx_unlock(&pf_sendqueue_mtx)
196
197 /*
198 * Queue for pf_overload_task() tasks.
199 */
200 struct pf_overload_entry {
201 SLIST_ENTRY(pf_overload_entry) next;
202 struct pf_addr addr;
203 sa_family_t af;
204 uint8_t dir;
205 struct pf_krule *rule;
206 };
207
208 SLIST_HEAD(pf_overload_head, pf_overload_entry);
209 VNET_DEFINE_STATIC(struct pf_overload_head, pf_overloadqueue);
210 #define V_pf_overloadqueue VNET(pf_overloadqueue)
211 VNET_DEFINE_STATIC(struct task, pf_overloadtask);
212 #define V_pf_overloadtask VNET(pf_overloadtask)
213
214 static struct mtx_padalign pf_overloadqueue_mtx;
215 MTX_SYSINIT(pf_overloadqueue_mtx, &pf_overloadqueue_mtx,
216 "pf overload/flush queue", MTX_DEF);
217 #define PF_OVERLOADQ_LOCK() mtx_lock(&pf_overloadqueue_mtx)
218 #define PF_OVERLOADQ_UNLOCK() mtx_unlock(&pf_overloadqueue_mtx)
219
220 VNET_DEFINE(struct pf_krulequeue, pf_unlinked_rules);
221 struct mtx_padalign pf_unlnkdrules_mtx;
222 MTX_SYSINIT(pf_unlnkdrules_mtx, &pf_unlnkdrules_mtx, "pf unlinked rules",
223 MTX_DEF);
224
225 struct mtx_padalign pf_table_stats_lock;
226 MTX_SYSINIT(pf_table_stats_lock, &pf_table_stats_lock, "pf table stats",
227 MTX_DEF);
228
229 VNET_DEFINE_STATIC(uma_zone_t, pf_sources_z);
230 #define V_pf_sources_z VNET(pf_sources_z)
231 uma_zone_t pf_mtag_z;
232 VNET_DEFINE(uma_zone_t, pf_state_z);
233 VNET_DEFINE(uma_zone_t, pf_state_key_z);
234
235 VNET_DEFINE(uint64_t, pf_stateid[MAXCPU]);
236 #define PFID_CPUBITS 8
237 #define PFID_CPUSHIFT (sizeof(uint64_t) * NBBY - PFID_CPUBITS)
238 #define PFID_CPUMASK ((uint64_t)((1 << PFID_CPUBITS) - 1) << PFID_CPUSHIFT)
239 #define PFID_MAXID (~PFID_CPUMASK)
240 CTASSERT((1 << PFID_CPUBITS) >= MAXCPU);
241
242 static void pf_src_tree_remove_state(struct pf_kstate *);
243 static void pf_init_threshold(struct pf_threshold *, u_int32_t,
244 u_int32_t);
245 static void pf_add_threshold(struct pf_threshold *);
246 static int pf_check_threshold(struct pf_threshold *);
247
248 static void pf_change_ap(struct mbuf *, struct pf_addr *, u_int16_t *,
249 u_int16_t *, u_int16_t *, struct pf_addr *,
250 u_int16_t, u_int8_t, sa_family_t);
251 static int pf_modulate_sack(struct mbuf *, int, struct pf_pdesc *,
252 struct tcphdr *, struct pf_state_peer *);
253 static void pf_change_icmp(struct pf_addr *, u_int16_t *,
254 struct pf_addr *, struct pf_addr *, u_int16_t,
255 u_int16_t *, u_int16_t *, u_int16_t *,
256 u_int16_t *, u_int8_t, sa_family_t);
257 static void pf_send_icmp(struct mbuf *, u_int8_t, u_int8_t,
258 sa_family_t, struct pf_krule *);
259 static void pf_detach_state(struct pf_kstate *);
260 static int pf_state_key_attach(struct pf_state_key *,
261 struct pf_state_key *, struct pf_kstate *);
262 static void pf_state_key_detach(struct pf_kstate *, int);
263 static int pf_state_key_ctor(void *, int, void *, int);
264 static u_int32_t pf_tcp_iss(struct pf_pdesc *);
265 void pf_rule_to_actions(struct pf_krule *,
266 struct pf_rule_actions *);
267 static int pf_test_rule(struct pf_krule **, struct pf_kstate **,
268 int, struct pfi_kkif *, struct mbuf *, int,
269 struct pf_pdesc *, struct pf_krule **,
270 struct pf_kruleset **, struct inpcb *);
271 static int pf_create_state(struct pf_krule *, struct pf_krule *,
272 struct pf_krule *, struct pf_pdesc *,
273 struct pf_ksrc_node *, struct pf_state_key *,
274 struct pf_state_key *, struct mbuf *, int,
275 u_int16_t, u_int16_t, int *, struct pfi_kkif *,
276 struct pf_kstate **, int, u_int16_t, u_int16_t,
277 int);
278 static int pf_test_fragment(struct pf_krule **, int,
279 struct pfi_kkif *, struct mbuf *, void *,
280 struct pf_pdesc *, struct pf_krule **,
281 struct pf_kruleset **);
282 static int pf_tcp_track_full(struct pf_kstate **,
283 struct pfi_kkif *, struct mbuf *, int,
284 struct pf_pdesc *, u_short *, int *);
285 static int pf_tcp_track_sloppy(struct pf_kstate **,
286 struct pf_pdesc *, u_short *);
287 static int pf_test_state_tcp(struct pf_kstate **, int,
288 struct pfi_kkif *, struct mbuf *, int,
289 void *, struct pf_pdesc *, u_short *);
290 static int pf_test_state_udp(struct pf_kstate **, int,
291 struct pfi_kkif *, struct mbuf *, int,
292 void *, struct pf_pdesc *);
293 static int pf_test_state_icmp(struct pf_kstate **, int,
294 struct pfi_kkif *, struct mbuf *, int,
295 void *, struct pf_pdesc *, u_short *);
296 static int pf_test_state_other(struct pf_kstate **, int,
297 struct pfi_kkif *, struct mbuf *, struct pf_pdesc *);
298 static u_int16_t pf_calc_mss(struct pf_addr *, sa_family_t,
299 int, u_int16_t);
300 static int pf_check_proto_cksum(struct mbuf *, int, int,
301 u_int8_t, sa_family_t);
302 static void pf_print_state_parts(struct pf_kstate *,
303 struct pf_state_key *, struct pf_state_key *);
304 static int pf_addr_wrap_neq(struct pf_addr_wrap *,
305 struct pf_addr_wrap *);
306 static void pf_patch_8(struct mbuf *, u_int16_t *, u_int8_t *, u_int8_t,
307 bool, u_int8_t);
308 static struct pf_kstate *pf_find_state(struct pfi_kkif *,
309 struct pf_state_key_cmp *, u_int);
310 static int pf_src_connlimit(struct pf_kstate **);
311 static void pf_overload_task(void *v, int pending);
312 static int pf_insert_src_node(struct pf_ksrc_node **,
313 struct pf_krule *, struct pf_addr *, sa_family_t);
314 static u_int pf_purge_expired_states(u_int, int);
315 static void pf_purge_unlinked_rules(void);
316 static int pf_mtag_uminit(void *, int, int);
317 static void pf_mtag_free(struct m_tag *);
318 static void pf_packet_rework_nat(struct mbuf *, struct pf_pdesc *,
319 int, struct pf_state_key *);
320 #ifdef INET
321 static void pf_route(struct mbuf **, struct pf_krule *, int,
322 struct ifnet *, struct pf_kstate *,
323 struct pf_pdesc *, struct inpcb *);
324 #endif /* INET */
325 #ifdef INET6
326 static void pf_change_a6(struct pf_addr *, u_int16_t *,
327 struct pf_addr *, u_int8_t);
328 static void pf_route6(struct mbuf **, struct pf_krule *, int,
329 struct ifnet *, struct pf_kstate *,
330 struct pf_pdesc *, struct inpcb *);
331 #endif /* INET6 */
332 static __inline void pf_set_protostate(struct pf_kstate *, int, u_int8_t);
333
334 int in4_cksum(struct mbuf *m, u_int8_t nxt, int off, int len);
335
336 extern int pf_end_threads;
337 extern struct proc *pf_purge_proc;
338
339 VNET_DEFINE(struct pf_limit, pf_limits[PF_LIMIT_MAX]);
340
341 #define PACKET_UNDO_NAT(_m, _pd, _off, _s, _dir) \
342 do { \
343 struct pf_state_key *nk; \
344 if ((_dir) == PF_OUT) \
345 nk = (_s)->key[PF_SK_STACK]; \
346 else \
347 nk = (_s)->key[PF_SK_WIRE]; \
348 pf_packet_rework_nat(_m, _pd, _off, nk); \
349 } while (0)
350
351 #define PACKET_LOOPED(pd) ((pd)->pf_mtag && \
352 (pd)->pf_mtag->flags & PF_PACKET_LOOPED)
353
354 #define STATE_LOOKUP(i, k, d, s, pd) \
355 do { \
356 (s) = pf_find_state((i), (k), (d)); \
357 SDT_PROBE5(pf, ip, state, lookup, i, k, d, pd, (s)); \
358 if ((s) == NULL) \
359 return (PF_DROP); \
360 if (PACKET_LOOPED(pd)) \
361 return (PF_PASS); \
362 } while (0)
363
364 #define BOUND_IFACE(r, k) \
365 ((r)->rule_flag & PFRULE_IFBOUND) ? (k) : V_pfi_all
366
367 #define STATE_INC_COUNTERS(s) \
368 do { \
369 counter_u64_add(s->rule.ptr->states_cur, 1); \
370 counter_u64_add(s->rule.ptr->states_tot, 1); \
371 if (s->anchor.ptr != NULL) { \
372 counter_u64_add(s->anchor.ptr->states_cur, 1); \
373 counter_u64_add(s->anchor.ptr->states_tot, 1); \
374 } \
375 if (s->nat_rule.ptr != NULL) { \
376 counter_u64_add(s->nat_rule.ptr->states_cur, 1);\
377 counter_u64_add(s->nat_rule.ptr->states_tot, 1);\
378 } \
379 } while (0)
380
381 #define STATE_DEC_COUNTERS(s) \
382 do { \
383 if (s->nat_rule.ptr != NULL) \
384 counter_u64_add(s->nat_rule.ptr->states_cur, -1);\
385 if (s->anchor.ptr != NULL) \
386 counter_u64_add(s->anchor.ptr->states_cur, -1); \
387 counter_u64_add(s->rule.ptr->states_cur, -1); \
388 } while (0)
389
390 MALLOC_DEFINE(M_PFHASH, "pf_hash", "pf(4) hash header structures");
391 VNET_DEFINE(struct pf_keyhash *, pf_keyhash);
392 VNET_DEFINE(struct pf_idhash *, pf_idhash);
393 VNET_DEFINE(struct pf_srchash *, pf_srchash);
394
395 SYSCTL_NODE(_net, OID_AUTO, pf, CTLFLAG_RW, 0, "pf(4)");
396
397 u_long pf_hashmask;
398 u_long pf_srchashmask;
399 static u_long pf_hashsize;
400 static u_long pf_srchashsize;
401 u_long pf_ioctl_maxcount = 65535;
402
403 SYSCTL_ULONG(_net_pf, OID_AUTO, states_hashsize, CTLFLAG_RDTUN,
404 &pf_hashsize, 0, "Size of pf(4) states hashtable");
405 SYSCTL_ULONG(_net_pf, OID_AUTO, source_nodes_hashsize, CTLFLAG_RDTUN,
406 &pf_srchashsize, 0, "Size of pf(4) source nodes hashtable");
407 SYSCTL_ULONG(_net_pf, OID_AUTO, request_maxcount, CTLFLAG_RWTUN,
408 &pf_ioctl_maxcount, 0, "Maximum number of tables, addresses, ... in a single ioctl() call");
409
410 VNET_DEFINE(void *, pf_swi_cookie);
411 VNET_DEFINE(struct intr_event *, pf_swi_ie);
412
413 VNET_DEFINE(uint32_t, pf_hashseed);
414 #define V_pf_hashseed VNET(pf_hashseed)
415
416 #ifdef __LP64__
417 static int
pf_bcmp_state_key(struct pf_state_key * k1_orig,struct pf_state_key_cmp * k2_orig)418 pf_bcmp_state_key(struct pf_state_key *k1_orig, struct pf_state_key_cmp *k2_orig)
419 {
420 unsigned long *k1 = (unsigned long *)k1_orig;
421 unsigned long *k2 = (unsigned long *)k2_orig;
422
423 if (k1[0] != k2[0])
424 return (1);
425
426 if (k1[1] != k2[1])
427 return (1);
428
429 if (k1[2] != k2[2])
430 return (1);
431
432 if (k1[3] != k2[3])
433 return (1);
434
435 if (k1[4] != k2[4])
436 return (1);
437
438 return (0);
439 }
440 _Static_assert(sizeof(struct pf_state_key_cmp) == 40, "bad size of pf_state_key_cmp");
441 #else
442 static inline int
pf_bcmp_state_key(struct pf_state_key * k1_orig,struct pf_state_key_cmp * k2_orig)443 pf_bcmp_state_key(struct pf_state_key *k1_orig, struct pf_state_key_cmp *k2_orig)
444 {
445
446 return (bcmp(k1_orig, k2_orig, sizeof(struct pf_state_key_cmp)));
447 }
448 #endif
449
450 int
pf_addr_cmp(struct pf_addr * a,struct pf_addr * b,sa_family_t af)451 pf_addr_cmp(struct pf_addr *a, struct pf_addr *b, sa_family_t af)
452 {
453
454 switch (af) {
455 #ifdef INET
456 case AF_INET:
457 if (a->addr32[0] > b->addr32[0])
458 return (1);
459 if (a->addr32[0] < b->addr32[0])
460 return (-1);
461 break;
462 #endif /* INET */
463 #ifdef INET6
464 case AF_INET6:
465 if (a->addr32[3] > b->addr32[3])
466 return (1);
467 if (a->addr32[3] < b->addr32[3])
468 return (-1);
469 if (a->addr32[2] > b->addr32[2])
470 return (1);
471 if (a->addr32[2] < b->addr32[2])
472 return (-1);
473 if (a->addr32[1] > b->addr32[1])
474 return (1);
475 if (a->addr32[1] < b->addr32[1])
476 return (-1);
477 if (a->addr32[0] > b->addr32[0])
478 return (1);
479 if (a->addr32[0] < b->addr32[0])
480 return (-1);
481 break;
482 #endif /* INET6 */
483 default:
484 panic("%s: unknown address family %u", __func__, af);
485 }
486 return (0);
487 }
488
489 static void
pf_packet_rework_nat(struct mbuf * m,struct pf_pdesc * pd,int off,struct pf_state_key * nk)490 pf_packet_rework_nat(struct mbuf *m, struct pf_pdesc *pd, int off,
491 struct pf_state_key *nk)
492 {
493
494 switch (pd->proto) {
495 case IPPROTO_TCP: {
496 struct tcphdr *th = &pd->hdr.tcp;
497
498 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af))
499 pf_change_ap(m, pd->src, &th->th_sport, pd->ip_sum,
500 &th->th_sum, &nk->addr[pd->sidx],
501 nk->port[pd->sidx], 0, pd->af);
502 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af))
503 pf_change_ap(m, pd->dst, &th->th_dport, pd->ip_sum,
504 &th->th_sum, &nk->addr[pd->didx],
505 nk->port[pd->didx], 0, pd->af);
506 m_copyback(m, off, sizeof(*th), (caddr_t)th);
507 break;
508 }
509 case IPPROTO_UDP: {
510 struct udphdr *uh = &pd->hdr.udp;
511
512 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af))
513 pf_change_ap(m, pd->src, &uh->uh_sport, pd->ip_sum,
514 &uh->uh_sum, &nk->addr[pd->sidx],
515 nk->port[pd->sidx], 1, pd->af);
516 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af))
517 pf_change_ap(m, pd->dst, &uh->uh_dport, pd->ip_sum,
518 &uh->uh_sum, &nk->addr[pd->didx],
519 nk->port[pd->didx], 1, pd->af);
520 m_copyback(m, off, sizeof(*uh), (caddr_t)uh);
521 break;
522 }
523 case IPPROTO_ICMP: {
524 struct icmp *ih = &pd->hdr.icmp;
525
526 if (nk->port[pd->sidx] != ih->icmp_id) {
527 pd->hdr.icmp.icmp_cksum = pf_cksum_fixup(
528 ih->icmp_cksum, ih->icmp_id,
529 nk->port[pd->sidx], 0);
530 ih->icmp_id = nk->port[pd->sidx];
531 pd->sport = &ih->icmp_id;
532
533 m_copyback(m, off, ICMP_MINLEN, (caddr_t)ih);
534 }
535 /* FALLTHROUGH */
536 }
537 default:
538 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af)) {
539 switch (pd->af) {
540 case AF_INET:
541 pf_change_a(&pd->src->v4.s_addr,
542 pd->ip_sum, nk->addr[pd->sidx].v4.s_addr,
543 0);
544 break;
545 case AF_INET6:
546 PF_ACPY(pd->src, &nk->addr[pd->sidx], pd->af);
547 break;
548 }
549 }
550 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af)) {
551 switch (pd->af) {
552 case AF_INET:
553 pf_change_a(&pd->dst->v4.s_addr,
554 pd->ip_sum, nk->addr[pd->didx].v4.s_addr,
555 0);
556 break;
557 case AF_INET6:
558 PF_ACPY(pd->dst, &nk->addr[pd->didx], pd->af);
559 break;
560 }
561 }
562 break;
563 }
564 }
565
566 static __inline uint32_t
pf_hashkey(struct pf_state_key * sk)567 pf_hashkey(struct pf_state_key *sk)
568 {
569 uint32_t h;
570
571 h = murmur3_32_hash32((uint32_t *)sk,
572 sizeof(struct pf_state_key_cmp)/sizeof(uint32_t),
573 V_pf_hashseed);
574
575 return (h & pf_hashmask);
576 }
577
578 static __inline uint32_t
pf_hashsrc(struct pf_addr * addr,sa_family_t af)579 pf_hashsrc(struct pf_addr *addr, sa_family_t af)
580 {
581 uint32_t h;
582
583 switch (af) {
584 case AF_INET:
585 h = murmur3_32_hash32((uint32_t *)&addr->v4,
586 sizeof(addr->v4)/sizeof(uint32_t), V_pf_hashseed);
587 break;
588 case AF_INET6:
589 h = murmur3_32_hash32((uint32_t *)&addr->v6,
590 sizeof(addr->v6)/sizeof(uint32_t), V_pf_hashseed);
591 break;
592 default:
593 panic("%s: unknown address family %u", __func__, af);
594 }
595
596 return (h & pf_srchashmask);
597 }
598
599 #ifdef ALTQ
600 static int
pf_state_hash(struct pf_kstate * s)601 pf_state_hash(struct pf_kstate *s)
602 {
603 u_int32_t hv = (intptr_t)s / sizeof(*s);
604
605 hv ^= crc32(&s->src, sizeof(s->src));
606 hv ^= crc32(&s->dst, sizeof(s->dst));
607 if (hv == 0)
608 hv = 1;
609 return (hv);
610 }
611 #endif
612
613 static __inline void
pf_set_protostate(struct pf_kstate * s,int which,u_int8_t newstate)614 pf_set_protostate(struct pf_kstate *s, int which, u_int8_t newstate)
615 {
616 if (which == PF_PEER_DST || which == PF_PEER_BOTH)
617 s->dst.state = newstate;
618 if (which == PF_PEER_DST)
619 return;
620 if (s->src.state == newstate)
621 return;
622 if (s->creatorid == V_pf_status.hostid &&
623 s->key[PF_SK_STACK] != NULL &&
624 s->key[PF_SK_STACK]->proto == IPPROTO_TCP &&
625 !(TCPS_HAVEESTABLISHED(s->src.state) ||
626 s->src.state == TCPS_CLOSED) &&
627 (TCPS_HAVEESTABLISHED(newstate) || newstate == TCPS_CLOSED))
628 atomic_add_32(&V_pf_status.states_halfopen, -1);
629
630 s->src.state = newstate;
631 }
632
633 #ifdef INET6
634 void
pf_addrcpy(struct pf_addr * dst,struct pf_addr * src,sa_family_t af)635 pf_addrcpy(struct pf_addr *dst, struct pf_addr *src, sa_family_t af)
636 {
637 switch (af) {
638 #ifdef INET
639 case AF_INET:
640 dst->addr32[0] = src->addr32[0];
641 break;
642 #endif /* INET */
643 case AF_INET6:
644 dst->addr32[0] = src->addr32[0];
645 dst->addr32[1] = src->addr32[1];
646 dst->addr32[2] = src->addr32[2];
647 dst->addr32[3] = src->addr32[3];
648 break;
649 }
650 }
651 #endif /* INET6 */
652
653 static void
pf_init_threshold(struct pf_threshold * threshold,u_int32_t limit,u_int32_t seconds)654 pf_init_threshold(struct pf_threshold *threshold,
655 u_int32_t limit, u_int32_t seconds)
656 {
657 threshold->limit = limit * PF_THRESHOLD_MULT;
658 threshold->seconds = seconds;
659 threshold->count = 0;
660 threshold->last = time_uptime;
661 }
662
663 static void
pf_add_threshold(struct pf_threshold * threshold)664 pf_add_threshold(struct pf_threshold *threshold)
665 {
666 u_int32_t t = time_uptime, diff = t - threshold->last;
667
668 if (diff >= threshold->seconds)
669 threshold->count = 0;
670 else
671 threshold->count -= threshold->count * diff /
672 threshold->seconds;
673 threshold->count += PF_THRESHOLD_MULT;
674 threshold->last = t;
675 }
676
677 static int
pf_check_threshold(struct pf_threshold * threshold)678 pf_check_threshold(struct pf_threshold *threshold)
679 {
680 return (threshold->count > threshold->limit);
681 }
682
683 static int
pf_src_connlimit(struct pf_kstate ** state)684 pf_src_connlimit(struct pf_kstate **state)
685 {
686 struct pf_overload_entry *pfoe;
687 int bad = 0;
688
689 PF_STATE_LOCK_ASSERT(*state);
690
691 (*state)->src_node->conn++;
692 (*state)->src.tcp_est = 1;
693 pf_add_threshold(&(*state)->src_node->conn_rate);
694
695 if ((*state)->rule.ptr->max_src_conn &&
696 (*state)->rule.ptr->max_src_conn <
697 (*state)->src_node->conn) {
698 counter_u64_add(V_pf_status.lcounters[LCNT_SRCCONN], 1);
699 bad++;
700 }
701
702 if ((*state)->rule.ptr->max_src_conn_rate.limit &&
703 pf_check_threshold(&(*state)->src_node->conn_rate)) {
704 counter_u64_add(V_pf_status.lcounters[LCNT_SRCCONNRATE], 1);
705 bad++;
706 }
707
708 if (!bad)
709 return (0);
710
711 /* Kill this state. */
712 (*state)->timeout = PFTM_PURGE;
713 pf_set_protostate(*state, PF_PEER_BOTH, TCPS_CLOSED);
714
715 if ((*state)->rule.ptr->overload_tbl == NULL)
716 return (1);
717
718 /* Schedule overloading and flushing task. */
719 pfoe = malloc(sizeof(*pfoe), M_PFTEMP, M_NOWAIT);
720 if (pfoe == NULL)
721 return (1); /* too bad :( */
722
723 bcopy(&(*state)->src_node->addr, &pfoe->addr, sizeof(pfoe->addr));
724 pfoe->af = (*state)->key[PF_SK_WIRE]->af;
725 pfoe->rule = (*state)->rule.ptr;
726 pfoe->dir = (*state)->direction;
727 PF_OVERLOADQ_LOCK();
728 SLIST_INSERT_HEAD(&V_pf_overloadqueue, pfoe, next);
729 PF_OVERLOADQ_UNLOCK();
730 taskqueue_enqueue(taskqueue_swi, &V_pf_overloadtask);
731
732 return (1);
733 }
734
735 static void
pf_overload_task(void * v,int pending)736 pf_overload_task(void *v, int pending)
737 {
738 struct pf_overload_head queue;
739 struct pfr_addr p;
740 struct pf_overload_entry *pfoe, *pfoe1;
741 uint32_t killed = 0;
742
743 CURVNET_SET((struct vnet *)v);
744
745 PF_OVERLOADQ_LOCK();
746 queue = V_pf_overloadqueue;
747 SLIST_INIT(&V_pf_overloadqueue);
748 PF_OVERLOADQ_UNLOCK();
749
750 bzero(&p, sizeof(p));
751 SLIST_FOREACH(pfoe, &queue, next) {
752 counter_u64_add(V_pf_status.lcounters[LCNT_OVERLOAD_TABLE], 1);
753 if (V_pf_status.debug >= PF_DEBUG_MISC) {
754 printf("%s: blocking address ", __func__);
755 pf_print_host(&pfoe->addr, 0, pfoe->af);
756 printf("\n");
757 }
758
759 p.pfra_af = pfoe->af;
760 switch (pfoe->af) {
761 #ifdef INET
762 case AF_INET:
763 p.pfra_net = 32;
764 p.pfra_ip4addr = pfoe->addr.v4;
765 break;
766 #endif
767 #ifdef INET6
768 case AF_INET6:
769 p.pfra_net = 128;
770 p.pfra_ip6addr = pfoe->addr.v6;
771 break;
772 #endif
773 }
774
775 PF_RULES_WLOCK();
776 pfr_insert_kentry(pfoe->rule->overload_tbl, &p, time_second);
777 PF_RULES_WUNLOCK();
778 }
779
780 /*
781 * Remove those entries, that don't need flushing.
782 */
783 SLIST_FOREACH_SAFE(pfoe, &queue, next, pfoe1)
784 if (pfoe->rule->flush == 0) {
785 SLIST_REMOVE(&queue, pfoe, pf_overload_entry, next);
786 free(pfoe, M_PFTEMP);
787 } else
788 counter_u64_add(
789 V_pf_status.lcounters[LCNT_OVERLOAD_FLUSH], 1);
790
791 /* If nothing to flush, return. */
792 if (SLIST_EMPTY(&queue)) {
793 CURVNET_RESTORE();
794 return;
795 }
796
797 for (int i = 0; i <= pf_hashmask; i++) {
798 struct pf_idhash *ih = &V_pf_idhash[i];
799 struct pf_state_key *sk;
800 struct pf_kstate *s;
801
802 PF_HASHROW_LOCK(ih);
803 LIST_FOREACH(s, &ih->states, entry) {
804 sk = s->key[PF_SK_WIRE];
805 SLIST_FOREACH(pfoe, &queue, next)
806 if (sk->af == pfoe->af &&
807 ((pfoe->rule->flush & PF_FLUSH_GLOBAL) ||
808 pfoe->rule == s->rule.ptr) &&
809 ((pfoe->dir == PF_OUT &&
810 PF_AEQ(&pfoe->addr, &sk->addr[1], sk->af)) ||
811 (pfoe->dir == PF_IN &&
812 PF_AEQ(&pfoe->addr, &sk->addr[0], sk->af)))) {
813 s->timeout = PFTM_PURGE;
814 pf_set_protostate(s, PF_PEER_BOTH, TCPS_CLOSED);
815 killed++;
816 }
817 }
818 PF_HASHROW_UNLOCK(ih);
819 }
820 SLIST_FOREACH_SAFE(pfoe, &queue, next, pfoe1)
821 free(pfoe, M_PFTEMP);
822 if (V_pf_status.debug >= PF_DEBUG_MISC)
823 printf("%s: %u states killed", __func__, killed);
824
825 CURVNET_RESTORE();
826 }
827
828 /*
829 * Can return locked on failure, so that we can consistently
830 * allocate and insert a new one.
831 */
832 struct pf_ksrc_node *
pf_find_src_node(struct pf_addr * src,struct pf_krule * rule,sa_family_t af,int returnlocked)833 pf_find_src_node(struct pf_addr *src, struct pf_krule *rule, sa_family_t af,
834 int returnlocked)
835 {
836 struct pf_srchash *sh;
837 struct pf_ksrc_node *n;
838
839 counter_u64_add(V_pf_status.scounters[SCNT_SRC_NODE_SEARCH], 1);
840
841 sh = &V_pf_srchash[pf_hashsrc(src, af)];
842 PF_HASHROW_LOCK(sh);
843 LIST_FOREACH(n, &sh->nodes, entry)
844 if (n->rule.ptr == rule && n->af == af &&
845 ((af == AF_INET && n->addr.v4.s_addr == src->v4.s_addr) ||
846 (af == AF_INET6 && bcmp(&n->addr, src, sizeof(*src)) == 0)))
847 break;
848 if (n != NULL) {
849 n->states++;
850 PF_HASHROW_UNLOCK(sh);
851 } else if (returnlocked == 0)
852 PF_HASHROW_UNLOCK(sh);
853
854 return (n);
855 }
856
857 static void
pf_free_src_node(struct pf_ksrc_node * sn)858 pf_free_src_node(struct pf_ksrc_node *sn)
859 {
860
861 for (int i = 0; i < 2; i++) {
862 counter_u64_free(sn->bytes[i]);
863 counter_u64_free(sn->packets[i]);
864 }
865 uma_zfree(V_pf_sources_z, sn);
866 }
867
868 static int
pf_insert_src_node(struct pf_ksrc_node ** sn,struct pf_krule * rule,struct pf_addr * src,sa_family_t af)869 pf_insert_src_node(struct pf_ksrc_node **sn, struct pf_krule *rule,
870 struct pf_addr *src, sa_family_t af)
871 {
872
873 KASSERT((rule->rule_flag & PFRULE_SRCTRACK ||
874 rule->rpool.opts & PF_POOL_STICKYADDR),
875 ("%s for non-tracking rule %p", __func__, rule));
876
877 if (*sn == NULL)
878 *sn = pf_find_src_node(src, rule, af, 1);
879
880 if (*sn == NULL) {
881 struct pf_srchash *sh = &V_pf_srchash[pf_hashsrc(src, af)];
882
883 PF_HASHROW_ASSERT(sh);
884
885 if (!rule->max_src_nodes ||
886 counter_u64_fetch(rule->src_nodes) < rule->max_src_nodes)
887 (*sn) = uma_zalloc(V_pf_sources_z, M_NOWAIT | M_ZERO);
888 else
889 counter_u64_add(V_pf_status.lcounters[LCNT_SRCNODES],
890 1);
891 if ((*sn) == NULL) {
892 PF_HASHROW_UNLOCK(sh);
893 return (-1);
894 }
895
896 for (int i = 0; i < 2; i++) {
897 (*sn)->bytes[i] = counter_u64_alloc(M_NOWAIT);
898 (*sn)->packets[i] = counter_u64_alloc(M_NOWAIT);
899
900 if ((*sn)->bytes[i] == NULL || (*sn)->packets[i] == NULL) {
901 pf_free_src_node(*sn);
902 PF_HASHROW_UNLOCK(sh);
903 return (-1);
904 }
905 }
906
907 pf_init_threshold(&(*sn)->conn_rate,
908 rule->max_src_conn_rate.limit,
909 rule->max_src_conn_rate.seconds);
910
911 (*sn)->af = af;
912 (*sn)->rule.ptr = rule;
913 PF_ACPY(&(*sn)->addr, src, af);
914 LIST_INSERT_HEAD(&sh->nodes, *sn, entry);
915 (*sn)->creation = time_uptime;
916 (*sn)->ruletype = rule->action;
917 (*sn)->states = 1;
918 if ((*sn)->rule.ptr != NULL)
919 counter_u64_add((*sn)->rule.ptr->src_nodes, 1);
920 PF_HASHROW_UNLOCK(sh);
921 counter_u64_add(V_pf_status.scounters[SCNT_SRC_NODE_INSERT], 1);
922 } else {
923 if (rule->max_src_states &&
924 (*sn)->states >= rule->max_src_states) {
925 counter_u64_add(V_pf_status.lcounters[LCNT_SRCSTATES],
926 1);
927 return (-1);
928 }
929 }
930 return (0);
931 }
932
933 void
pf_unlink_src_node(struct pf_ksrc_node * src)934 pf_unlink_src_node(struct pf_ksrc_node *src)
935 {
936
937 PF_HASHROW_ASSERT(&V_pf_srchash[pf_hashsrc(&src->addr, src->af)]);
938 LIST_REMOVE(src, entry);
939 if (src->rule.ptr)
940 counter_u64_add(src->rule.ptr->src_nodes, -1);
941 }
942
943 u_int
pf_free_src_nodes(struct pf_ksrc_node_list * head)944 pf_free_src_nodes(struct pf_ksrc_node_list *head)
945 {
946 struct pf_ksrc_node *sn, *tmp;
947 u_int count = 0;
948
949 LIST_FOREACH_SAFE(sn, head, entry, tmp) {
950 pf_free_src_node(sn);
951 count++;
952 }
953
954 counter_u64_add(V_pf_status.scounters[SCNT_SRC_NODE_REMOVALS], count);
955
956 return (count);
957 }
958
959 void
pf_mtag_initialize(void)960 pf_mtag_initialize(void)
961 {
962
963 pf_mtag_z = uma_zcreate("pf mtags", sizeof(struct m_tag) +
964 sizeof(struct pf_mtag), NULL, NULL, pf_mtag_uminit, NULL,
965 UMA_ALIGN_PTR, 0);
966 }
967
968 /* Per-vnet data storage structures initialization. */
969 void
pf_initialize(void)970 pf_initialize(void)
971 {
972 struct pf_keyhash *kh;
973 struct pf_idhash *ih;
974 struct pf_srchash *sh;
975 u_int i;
976
977 if (pf_hashsize == 0 || !powerof2(pf_hashsize))
978 pf_hashsize = PF_HASHSIZ;
979 if (pf_srchashsize == 0 || !powerof2(pf_srchashsize))
980 pf_srchashsize = PF_SRCHASHSIZ;
981
982 V_pf_hashseed = arc4random();
983
984 /* States and state keys storage. */
985 V_pf_state_z = uma_zcreate("pf states", sizeof(struct pf_kstate),
986 NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
987 V_pf_limits[PF_LIMIT_STATES].zone = V_pf_state_z;
988 uma_zone_set_max(V_pf_state_z, PFSTATE_HIWAT);
989 uma_zone_set_warning(V_pf_state_z, "PF states limit reached");
990
991 V_pf_state_key_z = uma_zcreate("pf state keys",
992 sizeof(struct pf_state_key), pf_state_key_ctor, NULL, NULL, NULL,
993 UMA_ALIGN_PTR, 0);
994
995 V_pf_keyhash = mallocarray(pf_hashsize, sizeof(struct pf_keyhash),
996 M_PFHASH, M_NOWAIT | M_ZERO);
997 V_pf_idhash = mallocarray(pf_hashsize, sizeof(struct pf_idhash),
998 M_PFHASH, M_NOWAIT | M_ZERO);
999 if (V_pf_keyhash == NULL || V_pf_idhash == NULL) {
1000 printf("pf: Unable to allocate memory for "
1001 "state_hashsize %lu.\n", pf_hashsize);
1002
1003 free(V_pf_keyhash, M_PFHASH);
1004 free(V_pf_idhash, M_PFHASH);
1005
1006 pf_hashsize = PF_HASHSIZ;
1007 V_pf_keyhash = mallocarray(pf_hashsize,
1008 sizeof(struct pf_keyhash), M_PFHASH, M_WAITOK | M_ZERO);
1009 V_pf_idhash = mallocarray(pf_hashsize,
1010 sizeof(struct pf_idhash), M_PFHASH, M_WAITOK | M_ZERO);
1011 }
1012
1013 pf_hashmask = pf_hashsize - 1;
1014 for (i = 0, kh = V_pf_keyhash, ih = V_pf_idhash; i <= pf_hashmask;
1015 i++, kh++, ih++) {
1016 mtx_init(&kh->lock, "pf_keyhash", NULL, MTX_DEF | MTX_DUPOK);
1017 mtx_init(&ih->lock, "pf_idhash", NULL, MTX_DEF);
1018 }
1019
1020 /* Source nodes. */
1021 V_pf_sources_z = uma_zcreate("pf source nodes",
1022 sizeof(struct pf_ksrc_node), NULL, NULL, NULL, NULL, UMA_ALIGN_PTR,
1023 0);
1024 V_pf_limits[PF_LIMIT_SRC_NODES].zone = V_pf_sources_z;
1025 uma_zone_set_max(V_pf_sources_z, PFSNODE_HIWAT);
1026 uma_zone_set_warning(V_pf_sources_z, "PF source nodes limit reached");
1027
1028 V_pf_srchash = mallocarray(pf_srchashsize,
1029 sizeof(struct pf_srchash), M_PFHASH, M_NOWAIT | M_ZERO);
1030 if (V_pf_srchash == NULL) {
1031 printf("pf: Unable to allocate memory for "
1032 "source_hashsize %lu.\n", pf_srchashsize);
1033
1034 pf_srchashsize = PF_SRCHASHSIZ;
1035 V_pf_srchash = mallocarray(pf_srchashsize,
1036 sizeof(struct pf_srchash), M_PFHASH, M_WAITOK | M_ZERO);
1037 }
1038
1039 pf_srchashmask = pf_srchashsize - 1;
1040 for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask; i++, sh++)
1041 mtx_init(&sh->lock, "pf_srchash", NULL, MTX_DEF);
1042
1043 /* ALTQ */
1044 TAILQ_INIT(&V_pf_altqs[0]);
1045 TAILQ_INIT(&V_pf_altqs[1]);
1046 TAILQ_INIT(&V_pf_altqs[2]);
1047 TAILQ_INIT(&V_pf_altqs[3]);
1048 TAILQ_INIT(&V_pf_pabuf);
1049 V_pf_altqs_active = &V_pf_altqs[0];
1050 V_pf_altq_ifs_active = &V_pf_altqs[1];
1051 V_pf_altqs_inactive = &V_pf_altqs[2];
1052 V_pf_altq_ifs_inactive = &V_pf_altqs[3];
1053
1054 /* Send & overload+flush queues. */
1055 STAILQ_INIT(&V_pf_sendqueue);
1056 SLIST_INIT(&V_pf_overloadqueue);
1057 TASK_INIT(&V_pf_overloadtask, 0, pf_overload_task, curvnet);
1058
1059 /* Unlinked, but may be referenced rules. */
1060 TAILQ_INIT(&V_pf_unlinked_rules);
1061 }
1062
1063 void
pf_mtag_cleanup(void)1064 pf_mtag_cleanup(void)
1065 {
1066
1067 uma_zdestroy(pf_mtag_z);
1068 }
1069
1070 void
pf_cleanup(void)1071 pf_cleanup(void)
1072 {
1073 struct pf_keyhash *kh;
1074 struct pf_idhash *ih;
1075 struct pf_srchash *sh;
1076 struct pf_send_entry *pfse, *next;
1077 u_int i;
1078
1079 for (i = 0, kh = V_pf_keyhash, ih = V_pf_idhash; i <= pf_hashmask;
1080 i++, kh++, ih++) {
1081 KASSERT(LIST_EMPTY(&kh->keys), ("%s: key hash not empty",
1082 __func__));
1083 KASSERT(LIST_EMPTY(&ih->states), ("%s: id hash not empty",
1084 __func__));
1085 mtx_destroy(&kh->lock);
1086 mtx_destroy(&ih->lock);
1087 }
1088 free(V_pf_keyhash, M_PFHASH);
1089 free(V_pf_idhash, M_PFHASH);
1090
1091 for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask; i++, sh++) {
1092 KASSERT(LIST_EMPTY(&sh->nodes),
1093 ("%s: source node hash not empty", __func__));
1094 mtx_destroy(&sh->lock);
1095 }
1096 free(V_pf_srchash, M_PFHASH);
1097
1098 STAILQ_FOREACH_SAFE(pfse, &V_pf_sendqueue, pfse_next, next) {
1099 m_freem(pfse->pfse_m);
1100 free(pfse, M_PFTEMP);
1101 }
1102
1103 uma_zdestroy(V_pf_sources_z);
1104 uma_zdestroy(V_pf_state_z);
1105 uma_zdestroy(V_pf_state_key_z);
1106 }
1107
1108 static int
pf_mtag_uminit(void * mem,int size,int how)1109 pf_mtag_uminit(void *mem, int size, int how)
1110 {
1111 struct m_tag *t;
1112
1113 t = (struct m_tag *)mem;
1114 t->m_tag_cookie = MTAG_ABI_COMPAT;
1115 t->m_tag_id = PACKET_TAG_PF;
1116 t->m_tag_len = sizeof(struct pf_mtag);
1117 t->m_tag_free = pf_mtag_free;
1118
1119 return (0);
1120 }
1121
1122 static void
pf_mtag_free(struct m_tag * t)1123 pf_mtag_free(struct m_tag *t)
1124 {
1125
1126 uma_zfree(pf_mtag_z, t);
1127 }
1128
1129 struct pf_mtag *
pf_get_mtag(struct mbuf * m)1130 pf_get_mtag(struct mbuf *m)
1131 {
1132 struct m_tag *mtag;
1133
1134 if ((mtag = m_tag_find(m, PACKET_TAG_PF, NULL)) != NULL)
1135 return ((struct pf_mtag *)(mtag + 1));
1136
1137 mtag = uma_zalloc(pf_mtag_z, M_NOWAIT);
1138 if (mtag == NULL)
1139 return (NULL);
1140 bzero(mtag + 1, sizeof(struct pf_mtag));
1141 m_tag_prepend(m, mtag);
1142
1143 return ((struct pf_mtag *)(mtag + 1));
1144 }
1145
1146 static int
pf_state_key_attach(struct pf_state_key * skw,struct pf_state_key * sks,struct pf_kstate * s)1147 pf_state_key_attach(struct pf_state_key *skw, struct pf_state_key *sks,
1148 struct pf_kstate *s)
1149 {
1150 struct pf_keyhash *khs, *khw, *kh;
1151 struct pf_state_key *sk, *cur;
1152 struct pf_kstate *si, *olds = NULL;
1153 int idx;
1154
1155 KASSERT(s->refs == 0, ("%s: state not pristine", __func__));
1156 KASSERT(s->key[PF_SK_WIRE] == NULL, ("%s: state has key", __func__));
1157 KASSERT(s->key[PF_SK_STACK] == NULL, ("%s: state has key", __func__));
1158
1159 /*
1160 * We need to lock hash slots of both keys. To avoid deadlock
1161 * we always lock the slot with lower address first. Unlock order
1162 * isn't important.
1163 *
1164 * We also need to lock ID hash slot before dropping key
1165 * locks. On success we return with ID hash slot locked.
1166 */
1167
1168 if (skw == sks) {
1169 khs = khw = &V_pf_keyhash[pf_hashkey(skw)];
1170 PF_HASHROW_LOCK(khs);
1171 } else {
1172 khs = &V_pf_keyhash[pf_hashkey(sks)];
1173 khw = &V_pf_keyhash[pf_hashkey(skw)];
1174 if (khs == khw) {
1175 PF_HASHROW_LOCK(khs);
1176 } else if (khs < khw) {
1177 PF_HASHROW_LOCK(khs);
1178 PF_HASHROW_LOCK(khw);
1179 } else {
1180 PF_HASHROW_LOCK(khw);
1181 PF_HASHROW_LOCK(khs);
1182 }
1183 }
1184
1185 #define KEYS_UNLOCK() do { \
1186 if (khs != khw) { \
1187 PF_HASHROW_UNLOCK(khs); \
1188 PF_HASHROW_UNLOCK(khw); \
1189 } else \
1190 PF_HASHROW_UNLOCK(khs); \
1191 } while (0)
1192
1193 /*
1194 * First run: start with wire key.
1195 */
1196 sk = skw;
1197 kh = khw;
1198 idx = PF_SK_WIRE;
1199
1200 MPASS(s->lock == NULL);
1201 s->lock = &V_pf_idhash[PF_IDHASH(s)].lock;
1202
1203 keyattach:
1204 LIST_FOREACH(cur, &kh->keys, entry)
1205 if (pf_bcmp_state_key(cur, (struct pf_state_key_cmp *)sk) == 0)
1206 break;
1207
1208 if (cur != NULL) {
1209 /* Key exists. Check for same kif, if none, add to key. */
1210 TAILQ_FOREACH(si, &cur->states[idx], key_list[idx]) {
1211 struct pf_idhash *ih = &V_pf_idhash[PF_IDHASH(si)];
1212
1213 PF_HASHROW_LOCK(ih);
1214 if (si->kif == s->kif &&
1215 si->direction == s->direction) {
1216 if (sk->proto == IPPROTO_TCP &&
1217 si->src.state >= TCPS_FIN_WAIT_2 &&
1218 si->dst.state >= TCPS_FIN_WAIT_2) {
1219 /*
1220 * New state matches an old >FIN_WAIT_2
1221 * state. We can't drop key hash locks,
1222 * thus we can't unlink it properly.
1223 *
1224 * As a workaround we drop it into
1225 * TCPS_CLOSED state, schedule purge
1226 * ASAP and push it into the very end
1227 * of the slot TAILQ, so that it won't
1228 * conflict with our new state.
1229 */
1230 pf_set_protostate(si, PF_PEER_BOTH,
1231 TCPS_CLOSED);
1232 si->timeout = PFTM_PURGE;
1233 olds = si;
1234 } else {
1235 if (V_pf_status.debug >= PF_DEBUG_MISC) {
1236 printf("pf: %s key attach "
1237 "failed on %s: ",
1238 (idx == PF_SK_WIRE) ?
1239 "wire" : "stack",
1240 s->kif->pfik_name);
1241 pf_print_state_parts(s,
1242 (idx == PF_SK_WIRE) ?
1243 sk : NULL,
1244 (idx == PF_SK_STACK) ?
1245 sk : NULL);
1246 printf(", existing: ");
1247 pf_print_state_parts(si,
1248 (idx == PF_SK_WIRE) ?
1249 sk : NULL,
1250 (idx == PF_SK_STACK) ?
1251 sk : NULL);
1252 printf("\n");
1253 }
1254 PF_HASHROW_UNLOCK(ih);
1255 KEYS_UNLOCK();
1256 uma_zfree(V_pf_state_key_z, sk);
1257 if (idx == PF_SK_STACK)
1258 pf_detach_state(s);
1259 return (EEXIST); /* collision! */
1260 }
1261 }
1262 PF_HASHROW_UNLOCK(ih);
1263 }
1264 uma_zfree(V_pf_state_key_z, sk);
1265 s->key[idx] = cur;
1266 } else {
1267 LIST_INSERT_HEAD(&kh->keys, sk, entry);
1268 s->key[idx] = sk;
1269 }
1270
1271 stateattach:
1272 /* List is sorted, if-bound states before floating. */
1273 if (s->kif == V_pfi_all)
1274 TAILQ_INSERT_TAIL(&s->key[idx]->states[idx], s, key_list[idx]);
1275 else
1276 TAILQ_INSERT_HEAD(&s->key[idx]->states[idx], s, key_list[idx]);
1277
1278 if (olds) {
1279 TAILQ_REMOVE(&s->key[idx]->states[idx], olds, key_list[idx]);
1280 TAILQ_INSERT_TAIL(&s->key[idx]->states[idx], olds,
1281 key_list[idx]);
1282 olds = NULL;
1283 }
1284
1285 /*
1286 * Attach done. See how should we (or should not?)
1287 * attach a second key.
1288 */
1289 if (sks == skw) {
1290 s->key[PF_SK_STACK] = s->key[PF_SK_WIRE];
1291 idx = PF_SK_STACK;
1292 sks = NULL;
1293 goto stateattach;
1294 } else if (sks != NULL) {
1295 /*
1296 * Continue attaching with stack key.
1297 */
1298 sk = sks;
1299 kh = khs;
1300 idx = PF_SK_STACK;
1301 sks = NULL;
1302 goto keyattach;
1303 }
1304
1305 PF_STATE_LOCK(s);
1306 KEYS_UNLOCK();
1307
1308 KASSERT(s->key[PF_SK_WIRE] != NULL && s->key[PF_SK_STACK] != NULL,
1309 ("%s failure", __func__));
1310
1311 return (0);
1312 #undef KEYS_UNLOCK
1313 }
1314
1315 static void
pf_detach_state(struct pf_kstate * s)1316 pf_detach_state(struct pf_kstate *s)
1317 {
1318 struct pf_state_key *sks = s->key[PF_SK_STACK];
1319 struct pf_keyhash *kh;
1320
1321 if (sks != NULL) {
1322 kh = &V_pf_keyhash[pf_hashkey(sks)];
1323 PF_HASHROW_LOCK(kh);
1324 if (s->key[PF_SK_STACK] != NULL)
1325 pf_state_key_detach(s, PF_SK_STACK);
1326 /*
1327 * If both point to same key, then we are done.
1328 */
1329 if (sks == s->key[PF_SK_WIRE]) {
1330 pf_state_key_detach(s, PF_SK_WIRE);
1331 PF_HASHROW_UNLOCK(kh);
1332 return;
1333 }
1334 PF_HASHROW_UNLOCK(kh);
1335 }
1336
1337 if (s->key[PF_SK_WIRE] != NULL) {
1338 kh = &V_pf_keyhash[pf_hashkey(s->key[PF_SK_WIRE])];
1339 PF_HASHROW_LOCK(kh);
1340 if (s->key[PF_SK_WIRE] != NULL)
1341 pf_state_key_detach(s, PF_SK_WIRE);
1342 PF_HASHROW_UNLOCK(kh);
1343 }
1344 }
1345
1346 static void
pf_state_key_detach(struct pf_kstate * s,int idx)1347 pf_state_key_detach(struct pf_kstate *s, int idx)
1348 {
1349 struct pf_state_key *sk = s->key[idx];
1350 #ifdef INVARIANTS
1351 struct pf_keyhash *kh = &V_pf_keyhash[pf_hashkey(sk)];
1352
1353 PF_HASHROW_ASSERT(kh);
1354 #endif
1355 TAILQ_REMOVE(&sk->states[idx], s, key_list[idx]);
1356 s->key[idx] = NULL;
1357
1358 if (TAILQ_EMPTY(&sk->states[0]) && TAILQ_EMPTY(&sk->states[1])) {
1359 LIST_REMOVE(sk, entry);
1360 uma_zfree(V_pf_state_key_z, sk);
1361 }
1362 }
1363
1364 static int
pf_state_key_ctor(void * mem,int size,void * arg,int flags)1365 pf_state_key_ctor(void *mem, int size, void *arg, int flags)
1366 {
1367 struct pf_state_key *sk = mem;
1368
1369 bzero(sk, sizeof(struct pf_state_key_cmp));
1370 TAILQ_INIT(&sk->states[PF_SK_WIRE]);
1371 TAILQ_INIT(&sk->states[PF_SK_STACK]);
1372
1373 return (0);
1374 }
1375
1376 struct pf_state_key *
pf_state_key_setup(struct pf_pdesc * pd,struct pf_addr * saddr,struct pf_addr * daddr,u_int16_t sport,u_int16_t dport)1377 pf_state_key_setup(struct pf_pdesc *pd, struct pf_addr *saddr,
1378 struct pf_addr *daddr, u_int16_t sport, u_int16_t dport)
1379 {
1380 struct pf_state_key *sk;
1381
1382 sk = uma_zalloc(V_pf_state_key_z, M_NOWAIT);
1383 if (sk == NULL)
1384 return (NULL);
1385
1386 PF_ACPY(&sk->addr[pd->sidx], saddr, pd->af);
1387 PF_ACPY(&sk->addr[pd->didx], daddr, pd->af);
1388 sk->port[pd->sidx] = sport;
1389 sk->port[pd->didx] = dport;
1390 sk->proto = pd->proto;
1391 sk->af = pd->af;
1392
1393 return (sk);
1394 }
1395
1396 struct pf_state_key *
pf_state_key_clone(struct pf_state_key * orig)1397 pf_state_key_clone(struct pf_state_key *orig)
1398 {
1399 struct pf_state_key *sk;
1400
1401 sk = uma_zalloc(V_pf_state_key_z, M_NOWAIT);
1402 if (sk == NULL)
1403 return (NULL);
1404
1405 bcopy(orig, sk, sizeof(struct pf_state_key_cmp));
1406
1407 return (sk);
1408 }
1409
1410 int
pf_state_insert(struct pfi_kkif * kif,struct pfi_kkif * orig_kif,struct pf_state_key * skw,struct pf_state_key * sks,struct pf_kstate * s)1411 pf_state_insert(struct pfi_kkif *kif, struct pfi_kkif *orig_kif,
1412 struct pf_state_key *skw, struct pf_state_key *sks, struct pf_kstate *s)
1413 {
1414 struct pf_idhash *ih;
1415 struct pf_kstate *cur;
1416 int error;
1417
1418 KASSERT(TAILQ_EMPTY(&sks->states[0]) && TAILQ_EMPTY(&sks->states[1]),
1419 ("%s: sks not pristine", __func__));
1420 KASSERT(TAILQ_EMPTY(&skw->states[0]) && TAILQ_EMPTY(&skw->states[1]),
1421 ("%s: skw not pristine", __func__));
1422 KASSERT(s->refs == 0, ("%s: state not pristine", __func__));
1423
1424 s->kif = kif;
1425 s->orig_kif = orig_kif;
1426
1427 if (s->id == 0 && s->creatorid == 0) {
1428 /* XXX: should be atomic, but probability of collision low */
1429 if ((s->id = V_pf_stateid[curcpu]++) == PFID_MAXID)
1430 V_pf_stateid[curcpu] = 1;
1431 s->id |= (uint64_t )curcpu << PFID_CPUSHIFT;
1432 s->id = htobe64(s->id);
1433 s->creatorid = V_pf_status.hostid;
1434 }
1435
1436 /* Returns with ID locked on success. */
1437 if ((error = pf_state_key_attach(skw, sks, s)) != 0)
1438 return (error);
1439
1440 ih = &V_pf_idhash[PF_IDHASH(s)];
1441 PF_HASHROW_ASSERT(ih);
1442 LIST_FOREACH(cur, &ih->states, entry)
1443 if (cur->id == s->id && cur->creatorid == s->creatorid)
1444 break;
1445
1446 if (cur != NULL) {
1447 PF_HASHROW_UNLOCK(ih);
1448 if (V_pf_status.debug >= PF_DEBUG_MISC) {
1449 printf("pf: state ID collision: "
1450 "id: %016llx creatorid: %08x\n",
1451 (unsigned long long)be64toh(s->id),
1452 ntohl(s->creatorid));
1453 }
1454 pf_detach_state(s);
1455 return (EEXIST);
1456 }
1457 LIST_INSERT_HEAD(&ih->states, s, entry);
1458 /* One for keys, one for ID hash. */
1459 refcount_init(&s->refs, 2);
1460
1461 pf_counter_u64_add(&V_pf_status.fcounters[FCNT_STATE_INSERT], 1);
1462 if (V_pfsync_insert_state_ptr != NULL)
1463 V_pfsync_insert_state_ptr(s);
1464
1465 /* Returns locked. */
1466 return (0);
1467 }
1468
1469 /*
1470 * Find state by ID: returns with locked row on success.
1471 */
1472 struct pf_kstate *
pf_find_state_byid(uint64_t id,uint32_t creatorid)1473 pf_find_state_byid(uint64_t id, uint32_t creatorid)
1474 {
1475 struct pf_idhash *ih;
1476 struct pf_kstate *s;
1477
1478 pf_counter_u64_add(&V_pf_status.fcounters[FCNT_STATE_SEARCH], 1);
1479
1480 ih = &V_pf_idhash[(be64toh(id) % (pf_hashmask + 1))];
1481
1482 PF_HASHROW_LOCK(ih);
1483 LIST_FOREACH(s, &ih->states, entry)
1484 if (s->id == id && s->creatorid == creatorid)
1485 break;
1486
1487 if (s == NULL)
1488 PF_HASHROW_UNLOCK(ih);
1489
1490 return (s);
1491 }
1492
1493 /*
1494 * Find state by key.
1495 * Returns with ID hash slot locked on success.
1496 */
1497 static struct pf_kstate *
pf_find_state(struct pfi_kkif * kif,struct pf_state_key_cmp * key,u_int dir)1498 pf_find_state(struct pfi_kkif *kif, struct pf_state_key_cmp *key, u_int dir)
1499 {
1500 struct pf_keyhash *kh;
1501 struct pf_state_key *sk;
1502 struct pf_kstate *s;
1503 int idx;
1504
1505 pf_counter_u64_add(&V_pf_status.fcounters[FCNT_STATE_SEARCH], 1);
1506
1507 kh = &V_pf_keyhash[pf_hashkey((struct pf_state_key *)key)];
1508
1509 PF_HASHROW_LOCK(kh);
1510 LIST_FOREACH(sk, &kh->keys, entry)
1511 if (pf_bcmp_state_key(sk, key) == 0)
1512 break;
1513 if (sk == NULL) {
1514 PF_HASHROW_UNLOCK(kh);
1515 return (NULL);
1516 }
1517
1518 idx = (dir == PF_IN ? PF_SK_WIRE : PF_SK_STACK);
1519
1520 /* List is sorted, if-bound states before floating ones. */
1521 TAILQ_FOREACH(s, &sk->states[idx], key_list[idx])
1522 if (s->kif == V_pfi_all || s->kif == kif) {
1523 PF_STATE_LOCK(s);
1524 PF_HASHROW_UNLOCK(kh);
1525 if (__predict_false(s->timeout >= PFTM_MAX)) {
1526 /*
1527 * State is either being processed by
1528 * pf_unlink_state() in an other thread, or
1529 * is scheduled for immediate expiry.
1530 */
1531 PF_STATE_UNLOCK(s);
1532 return (NULL);
1533 }
1534 return (s);
1535 }
1536 PF_HASHROW_UNLOCK(kh);
1537
1538 return (NULL);
1539 }
1540
1541 struct pf_kstate *
pf_find_state_all(struct pf_state_key_cmp * key,u_int dir,int * more)1542 pf_find_state_all(struct pf_state_key_cmp *key, u_int dir, int *more)
1543 {
1544 struct pf_keyhash *kh;
1545 struct pf_state_key *sk;
1546 struct pf_kstate *s, *ret = NULL;
1547 int idx, inout = 0;
1548
1549 pf_counter_u64_add(&V_pf_status.fcounters[FCNT_STATE_SEARCH], 1);
1550
1551 kh = &V_pf_keyhash[pf_hashkey((struct pf_state_key *)key)];
1552
1553 PF_HASHROW_LOCK(kh);
1554 LIST_FOREACH(sk, &kh->keys, entry)
1555 if (pf_bcmp_state_key(sk, key) == 0)
1556 break;
1557 if (sk == NULL) {
1558 PF_HASHROW_UNLOCK(kh);
1559 return (NULL);
1560 }
1561 switch (dir) {
1562 case PF_IN:
1563 idx = PF_SK_WIRE;
1564 break;
1565 case PF_OUT:
1566 idx = PF_SK_STACK;
1567 break;
1568 case PF_INOUT:
1569 idx = PF_SK_WIRE;
1570 inout = 1;
1571 break;
1572 default:
1573 panic("%s: dir %u", __func__, dir);
1574 }
1575 second_run:
1576 TAILQ_FOREACH(s, &sk->states[idx], key_list[idx]) {
1577 if (more == NULL) {
1578 PF_HASHROW_UNLOCK(kh);
1579 return (s);
1580 }
1581
1582 if (ret)
1583 (*more)++;
1584 else
1585 ret = s;
1586 }
1587 if (inout == 1) {
1588 inout = 0;
1589 idx = PF_SK_STACK;
1590 goto second_run;
1591 }
1592 PF_HASHROW_UNLOCK(kh);
1593
1594 return (ret);
1595 }
1596
1597 bool
pf_find_state_all_exists(struct pf_state_key_cmp * key,u_int dir)1598 pf_find_state_all_exists(struct pf_state_key_cmp *key, u_int dir)
1599 {
1600 struct pf_kstate *s;
1601
1602 s = pf_find_state_all(key, dir, NULL);
1603 return (s != NULL);
1604 }
1605
1606 /* END state table stuff */
1607
1608 static void
pf_send(struct pf_send_entry * pfse)1609 pf_send(struct pf_send_entry *pfse)
1610 {
1611
1612 PF_SENDQ_LOCK();
1613 STAILQ_INSERT_TAIL(&V_pf_sendqueue, pfse, pfse_next);
1614 PF_SENDQ_UNLOCK();
1615 swi_sched(V_pf_swi_cookie, 0);
1616 }
1617
1618 static bool
pf_isforlocal(struct mbuf * m,int af)1619 pf_isforlocal(struct mbuf *m, int af)
1620 {
1621 switch (af) {
1622 #ifdef INET
1623 case AF_INET: {
1624 struct rm_priotracker in_ifa_tracker;
1625 struct ip *ip;
1626 struct in_ifaddr *ia = NULL;
1627
1628 ip = mtod(m, struct ip *);
1629 IN_IFADDR_RLOCK(&in_ifa_tracker);
1630 LIST_FOREACH(ia, INADDR_HASH(ip->ip_dst.s_addr), ia_hash) {
1631 if (IA_SIN(ia)->sin_addr.s_addr == ip->ip_dst.s_addr) {
1632 IN_IFADDR_RUNLOCK(&in_ifa_tracker);
1633 return (true);
1634 }
1635 }
1636 IN_IFADDR_RUNLOCK(&in_ifa_tracker);
1637 break;
1638 }
1639 #endif
1640 #ifdef INET6
1641 case AF_INET6: {
1642 struct ip6_hdr *ip6;
1643 struct in6_ifaddr *ia;
1644 ip6 = mtod(m, struct ip6_hdr *);
1645 ia = in6ifa_ifwithaddr(&ip6->ip6_dst, 0 /* XXX */);
1646 if (ia == NULL)
1647 return (false);
1648 return (! (ia->ia6_flags & IN6_IFF_NOTREADY));
1649 }
1650 #endif
1651 default:
1652 panic("Unsupported af %d", af);
1653 }
1654
1655 return (false);
1656 }
1657
1658 void
pf_intr(void * v)1659 pf_intr(void *v)
1660 {
1661 struct pf_send_head queue;
1662 struct pf_send_entry *pfse, *next;
1663
1664 CURVNET_SET((struct vnet *)v);
1665
1666 PF_SENDQ_LOCK();
1667 queue = V_pf_sendqueue;
1668 STAILQ_INIT(&V_pf_sendqueue);
1669 PF_SENDQ_UNLOCK();
1670
1671 STAILQ_FOREACH_SAFE(pfse, &queue, pfse_next, next) {
1672 switch (pfse->pfse_type) {
1673 #ifdef INET
1674 case PFSE_IP: {
1675 if (pf_isforlocal(pfse->pfse_m, AF_INET)) {
1676 pfse->pfse_m->m_flags |= M_SKIP_FIREWALL;
1677 pfse->pfse_m->m_pkthdr.csum_flags |=
1678 CSUM_IP_VALID | CSUM_IP_CHECKED;
1679 ip_input(pfse->pfse_m);
1680 } else {
1681 ip_output(pfse->pfse_m, NULL, NULL, 0, NULL,
1682 NULL);
1683 }
1684 break;
1685 }
1686 case PFSE_ICMP:
1687 icmp_error(pfse->pfse_m, pfse->icmpopts.type,
1688 pfse->icmpopts.code, 0, pfse->icmpopts.mtu);
1689 break;
1690 #endif /* INET */
1691 #ifdef INET6
1692 case PFSE_IP6:
1693 if (pf_isforlocal(pfse->pfse_m, AF_INET6)) {
1694 pfse->pfse_m->m_flags |= M_SKIP_FIREWALL;
1695 ip6_input(pfse->pfse_m);
1696 } else {
1697 ip6_output(pfse->pfse_m, NULL, NULL, 0, NULL,
1698 NULL, NULL);
1699 }
1700 break;
1701 case PFSE_ICMP6:
1702 icmp6_error(pfse->pfse_m, pfse->icmpopts.type,
1703 pfse->icmpopts.code, pfse->icmpopts.mtu);
1704 break;
1705 #endif /* INET6 */
1706 default:
1707 panic("%s: unknown type", __func__);
1708 }
1709 free(pfse, M_PFTEMP);
1710 }
1711 CURVNET_RESTORE();
1712 }
1713
1714 #define pf_purge_thread_period (hz / 10)
1715
1716 #ifdef PF_WANT_32_TO_64_COUNTER
1717 static void
pf_status_counter_u64_periodic(void)1718 pf_status_counter_u64_periodic(void)
1719 {
1720
1721 PF_RULES_RASSERT();
1722
1723 if ((V_pf_counter_periodic_iter % (pf_purge_thread_period * 10 * 60)) != 0) {
1724 return;
1725 }
1726
1727 for (int i = 0; i < FCNT_MAX; i++) {
1728 pf_counter_u64_periodic(&V_pf_status.fcounters[i]);
1729 }
1730 }
1731
1732 static void
pf_kif_counter_u64_periodic(void)1733 pf_kif_counter_u64_periodic(void)
1734 {
1735 struct pfi_kkif *kif;
1736 size_t r, run;
1737
1738 PF_RULES_RASSERT();
1739
1740 if (__predict_false(V_pf_allkifcount == 0)) {
1741 return;
1742 }
1743
1744 if ((V_pf_counter_periodic_iter % (pf_purge_thread_period * 10 * 300)) != 0) {
1745 return;
1746 }
1747
1748 run = V_pf_allkifcount / 10;
1749 if (run < 5)
1750 run = 5;
1751
1752 for (r = 0; r < run; r++) {
1753 kif = LIST_NEXT(V_pf_kifmarker, pfik_allkiflist);
1754 if (kif == NULL) {
1755 LIST_REMOVE(V_pf_kifmarker, pfik_allkiflist);
1756 LIST_INSERT_HEAD(&V_pf_allkiflist, V_pf_kifmarker, pfik_allkiflist);
1757 break;
1758 }
1759
1760 LIST_REMOVE(V_pf_kifmarker, pfik_allkiflist);
1761 LIST_INSERT_AFTER(kif, V_pf_kifmarker, pfik_allkiflist);
1762
1763 for (int i = 0; i < 2; i++) {
1764 for (int j = 0; j < 2; j++) {
1765 for (int k = 0; k < 2; k++) {
1766 pf_counter_u64_periodic(&kif->pfik_packets[i][j][k]);
1767 pf_counter_u64_periodic(&kif->pfik_bytes[i][j][k]);
1768 }
1769 }
1770 }
1771 }
1772 }
1773
1774 static void
pf_rule_counter_u64_periodic(void)1775 pf_rule_counter_u64_periodic(void)
1776 {
1777 struct pf_krule *rule;
1778 size_t r, run;
1779
1780 PF_RULES_RASSERT();
1781
1782 if (__predict_false(V_pf_allrulecount == 0)) {
1783 return;
1784 }
1785
1786 if ((V_pf_counter_periodic_iter % (pf_purge_thread_period * 10 * 300)) != 0) {
1787 return;
1788 }
1789
1790 run = V_pf_allrulecount / 10;
1791 if (run < 5)
1792 run = 5;
1793
1794 for (r = 0; r < run; r++) {
1795 rule = LIST_NEXT(V_pf_rulemarker, allrulelist);
1796 if (rule == NULL) {
1797 LIST_REMOVE(V_pf_rulemarker, allrulelist);
1798 LIST_INSERT_HEAD(&V_pf_allrulelist, V_pf_rulemarker, allrulelist);
1799 break;
1800 }
1801
1802 LIST_REMOVE(V_pf_rulemarker, allrulelist);
1803 LIST_INSERT_AFTER(rule, V_pf_rulemarker, allrulelist);
1804
1805 pf_counter_u64_periodic(&rule->evaluations);
1806 for (int i = 0; i < 2; i++) {
1807 pf_counter_u64_periodic(&rule->packets[i]);
1808 pf_counter_u64_periodic(&rule->bytes[i]);
1809 }
1810 }
1811 }
1812
1813 static void
pf_counter_u64_periodic_main(void)1814 pf_counter_u64_periodic_main(void)
1815 {
1816 PF_RULES_RLOCK_TRACKER;
1817
1818 V_pf_counter_periodic_iter++;
1819
1820 PF_RULES_RLOCK();
1821 pf_counter_u64_critical_enter();
1822 pf_status_counter_u64_periodic();
1823 pf_kif_counter_u64_periodic();
1824 pf_rule_counter_u64_periodic();
1825 pf_counter_u64_critical_exit();
1826 PF_RULES_RUNLOCK();
1827 }
1828 #else
1829 #define pf_counter_u64_periodic_main() do { } while (0)
1830 #endif
1831
1832 void
pf_purge_thread(void * unused __unused)1833 pf_purge_thread(void *unused __unused)
1834 {
1835 VNET_ITERATOR_DECL(vnet_iter);
1836
1837 sx_xlock(&pf_end_lock);
1838 while (pf_end_threads == 0) {
1839 sx_sleep(pf_purge_thread, &pf_end_lock, 0, "pftm", pf_purge_thread_period);
1840
1841 VNET_LIST_RLOCK();
1842 VNET_FOREACH(vnet_iter) {
1843 CURVNET_SET(vnet_iter);
1844
1845
1846 /* Wait until V_pf_default_rule is initialized. */
1847 if (V_pf_vnet_active == 0) {
1848 CURVNET_RESTORE();
1849 continue;
1850 }
1851
1852 pf_counter_u64_periodic_main();
1853
1854 /*
1855 * Process 1/interval fraction of the state
1856 * table every run.
1857 */
1858 V_pf_purge_idx =
1859 pf_purge_expired_states(V_pf_purge_idx, pf_hashmask /
1860 (V_pf_default_rule.timeout[PFTM_INTERVAL] * 10));
1861
1862 /*
1863 * Purge other expired types every
1864 * PFTM_INTERVAL seconds.
1865 */
1866 if (V_pf_purge_idx == 0) {
1867 /*
1868 * Order is important:
1869 * - states and src nodes reference rules
1870 * - states and rules reference kifs
1871 */
1872 pf_purge_expired_fragments();
1873 pf_purge_expired_src_nodes();
1874 pf_purge_unlinked_rules();
1875 pfi_kkif_purge();
1876 }
1877 CURVNET_RESTORE();
1878 }
1879 VNET_LIST_RUNLOCK();
1880 }
1881
1882 pf_end_threads++;
1883 sx_xunlock(&pf_end_lock);
1884 kproc_exit(0);
1885 }
1886
1887 void
pf_unload_vnet_purge(void)1888 pf_unload_vnet_purge(void)
1889 {
1890
1891 /*
1892 * To cleanse up all kifs and rules we need
1893 * two runs: first one clears reference flags,
1894 * then pf_purge_expired_states() doesn't
1895 * raise them, and then second run frees.
1896 */
1897 pf_purge_unlinked_rules();
1898 pfi_kkif_purge();
1899
1900 /*
1901 * Now purge everything.
1902 */
1903 pf_purge_expired_states(0, pf_hashmask);
1904 pf_purge_fragments(UINT_MAX);
1905 pf_purge_expired_src_nodes();
1906
1907 /*
1908 * Now all kifs & rules should be unreferenced,
1909 * thus should be successfully freed.
1910 */
1911 pf_purge_unlinked_rules();
1912 pfi_kkif_purge();
1913 }
1914
1915
1916 u_int32_t
pf_state_expires(const struct pf_kstate * state)1917 pf_state_expires(const struct pf_kstate *state)
1918 {
1919 u_int32_t timeout;
1920 u_int32_t start;
1921 u_int32_t end;
1922 u_int32_t states;
1923
1924 /* handle all PFTM_* > PFTM_MAX here */
1925 if (state->timeout == PFTM_PURGE)
1926 return (time_uptime);
1927 KASSERT(state->timeout != PFTM_UNLINKED,
1928 ("pf_state_expires: timeout == PFTM_UNLINKED"));
1929 KASSERT((state->timeout < PFTM_MAX),
1930 ("pf_state_expires: timeout > PFTM_MAX"));
1931 timeout = state->rule.ptr->timeout[state->timeout];
1932 if (!timeout)
1933 timeout = V_pf_default_rule.timeout[state->timeout];
1934 start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START];
1935 if (start && state->rule.ptr != &V_pf_default_rule) {
1936 end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END];
1937 states = counter_u64_fetch(state->rule.ptr->states_cur);
1938 } else {
1939 start = V_pf_default_rule.timeout[PFTM_ADAPTIVE_START];
1940 end = V_pf_default_rule.timeout[PFTM_ADAPTIVE_END];
1941 states = V_pf_status.states;
1942 }
1943 if (end && states > start && start < end) {
1944 if (states < end) {
1945 timeout = (u_int64_t)timeout * (end - states) /
1946 (end - start);
1947 return (state->expire + timeout);
1948 }
1949 else
1950 return (time_uptime);
1951 }
1952 return (state->expire + timeout);
1953 }
1954
1955 void
pf_purge_expired_src_nodes(void)1956 pf_purge_expired_src_nodes(void)
1957 {
1958 struct pf_ksrc_node_list freelist;
1959 struct pf_srchash *sh;
1960 struct pf_ksrc_node *cur, *next;
1961 int i;
1962
1963 LIST_INIT(&freelist);
1964 for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask; i++, sh++) {
1965 PF_HASHROW_LOCK(sh);
1966 LIST_FOREACH_SAFE(cur, &sh->nodes, entry, next)
1967 if (cur->states == 0 && cur->expire <= time_uptime) {
1968 pf_unlink_src_node(cur);
1969 LIST_INSERT_HEAD(&freelist, cur, entry);
1970 } else if (cur->rule.ptr != NULL)
1971 cur->rule.ptr->rule_ref |= PFRULE_REFS;
1972 PF_HASHROW_UNLOCK(sh);
1973 }
1974
1975 pf_free_src_nodes(&freelist);
1976
1977 V_pf_status.src_nodes = uma_zone_get_cur(V_pf_sources_z);
1978 }
1979
1980 static void
pf_src_tree_remove_state(struct pf_kstate * s)1981 pf_src_tree_remove_state(struct pf_kstate *s)
1982 {
1983 struct pf_ksrc_node *sn;
1984 struct pf_srchash *sh;
1985 uint32_t timeout;
1986
1987 timeout = s->rule.ptr->timeout[PFTM_SRC_NODE] ?
1988 s->rule.ptr->timeout[PFTM_SRC_NODE] :
1989 V_pf_default_rule.timeout[PFTM_SRC_NODE];
1990
1991 if (s->src_node != NULL) {
1992 sn = s->src_node;
1993 sh = &V_pf_srchash[pf_hashsrc(&sn->addr, sn->af)];
1994 PF_HASHROW_LOCK(sh);
1995 if (s->src.tcp_est)
1996 --sn->conn;
1997 if (--sn->states == 0)
1998 sn->expire = time_uptime + timeout;
1999 PF_HASHROW_UNLOCK(sh);
2000 }
2001 if (s->nat_src_node != s->src_node && s->nat_src_node != NULL) {
2002 sn = s->nat_src_node;
2003 sh = &V_pf_srchash[pf_hashsrc(&sn->addr, sn->af)];
2004 PF_HASHROW_LOCK(sh);
2005 if (--sn->states == 0)
2006 sn->expire = time_uptime + timeout;
2007 PF_HASHROW_UNLOCK(sh);
2008 }
2009 s->src_node = s->nat_src_node = NULL;
2010 }
2011
2012 /*
2013 * Unlink and potentilly free a state. Function may be
2014 * called with ID hash row locked, but always returns
2015 * unlocked, since it needs to go through key hash locking.
2016 */
2017 int
pf_unlink_state(struct pf_kstate * s,u_int flags)2018 pf_unlink_state(struct pf_kstate *s, u_int flags)
2019 {
2020 struct pf_idhash *ih = &V_pf_idhash[PF_IDHASH(s)];
2021
2022 if ((flags & PF_ENTER_LOCKED) == 0)
2023 PF_HASHROW_LOCK(ih);
2024 else
2025 PF_HASHROW_ASSERT(ih);
2026
2027 if (s->timeout == PFTM_UNLINKED) {
2028 /*
2029 * State is being processed
2030 * by pf_unlink_state() in
2031 * an other thread.
2032 */
2033 PF_HASHROW_UNLOCK(ih);
2034 return (0); /* XXXGL: undefined actually */
2035 }
2036
2037 if (s->src.state == PF_TCPS_PROXY_DST) {
2038 /* XXX wire key the right one? */
2039 pf_send_tcp(s->rule.ptr, s->key[PF_SK_WIRE]->af,
2040 &s->key[PF_SK_WIRE]->addr[1],
2041 &s->key[PF_SK_WIRE]->addr[0],
2042 s->key[PF_SK_WIRE]->port[1],
2043 s->key[PF_SK_WIRE]->port[0],
2044 s->src.seqhi, s->src.seqlo + 1,
2045 TH_RST|TH_ACK, 0, 0, 0, 1, s->tag);
2046 }
2047
2048 LIST_REMOVE(s, entry);
2049 pf_src_tree_remove_state(s);
2050
2051 if (V_pfsync_delete_state_ptr != NULL)
2052 V_pfsync_delete_state_ptr(s);
2053
2054 STATE_DEC_COUNTERS(s);
2055
2056 s->timeout = PFTM_UNLINKED;
2057
2058 /* Ensure we remove it from the list of halfopen states, if needed. */
2059 if (s->key[PF_SK_STACK] != NULL &&
2060 s->key[PF_SK_STACK]->proto == IPPROTO_TCP)
2061 pf_set_protostate(s, PF_PEER_BOTH, TCPS_CLOSED);
2062
2063 PF_HASHROW_UNLOCK(ih);
2064
2065 pf_detach_state(s);
2066 /* pf_state_insert() initialises refs to 2 */
2067 return (pf_release_staten(s, 2));
2068 }
2069
2070 struct pf_kstate *
pf_alloc_state(int flags)2071 pf_alloc_state(int flags)
2072 {
2073
2074 return (uma_zalloc(V_pf_state_z, flags | M_ZERO));
2075 }
2076
2077 void
pf_free_state(struct pf_kstate * cur)2078 pf_free_state(struct pf_kstate *cur)
2079 {
2080
2081 KASSERT(cur->refs == 0, ("%s: %p has refs", __func__, cur));
2082 KASSERT(cur->timeout == PFTM_UNLINKED, ("%s: timeout %u", __func__,
2083 cur->timeout));
2084
2085 pf_normalize_tcp_cleanup(cur);
2086 uma_zfree(V_pf_state_z, cur);
2087 pf_counter_u64_add(&V_pf_status.fcounters[FCNT_STATE_REMOVALS], 1);
2088 }
2089
2090 /*
2091 * Called only from pf_purge_thread(), thus serialized.
2092 */
2093 static u_int
pf_purge_expired_states(u_int i,int maxcheck)2094 pf_purge_expired_states(u_int i, int maxcheck)
2095 {
2096 struct pf_idhash *ih;
2097 struct pf_kstate *s;
2098
2099 V_pf_status.states = uma_zone_get_cur(V_pf_state_z);
2100
2101 /*
2102 * Go through hash and unlink states that expire now.
2103 */
2104 while (maxcheck > 0) {
2105
2106 ih = &V_pf_idhash[i];
2107
2108 /* only take the lock if we expect to do work */
2109 if (!LIST_EMPTY(&ih->states)) {
2110 relock:
2111 PF_HASHROW_LOCK(ih);
2112 LIST_FOREACH(s, &ih->states, entry) {
2113 if (pf_state_expires(s) <= time_uptime) {
2114 V_pf_status.states -=
2115 pf_unlink_state(s, PF_ENTER_LOCKED);
2116 goto relock;
2117 }
2118 s->rule.ptr->rule_ref |= PFRULE_REFS;
2119 if (s->nat_rule.ptr != NULL)
2120 s->nat_rule.ptr->rule_ref |= PFRULE_REFS;
2121 if (s->anchor.ptr != NULL)
2122 s->anchor.ptr->rule_ref |= PFRULE_REFS;
2123 s->kif->pfik_flags |= PFI_IFLAG_REFS;
2124 if (s->rt_kif)
2125 s->rt_kif->pfik_flags |= PFI_IFLAG_REFS;
2126 }
2127 PF_HASHROW_UNLOCK(ih);
2128 }
2129
2130 /* Return when we hit end of hash. */
2131 if (++i > pf_hashmask) {
2132 V_pf_status.states = uma_zone_get_cur(V_pf_state_z);
2133 return (0);
2134 }
2135
2136 maxcheck--;
2137 }
2138
2139 V_pf_status.states = uma_zone_get_cur(V_pf_state_z);
2140
2141 return (i);
2142 }
2143
2144 static void
pf_purge_unlinked_rules(void)2145 pf_purge_unlinked_rules(void)
2146 {
2147 struct pf_krulequeue tmpq;
2148 struct pf_krule *r, *r1;
2149
2150 /*
2151 * If we have overloading task pending, then we'd
2152 * better skip purging this time. There is a tiny
2153 * probability that overloading task references
2154 * an already unlinked rule.
2155 */
2156 PF_OVERLOADQ_LOCK();
2157 if (!SLIST_EMPTY(&V_pf_overloadqueue)) {
2158 PF_OVERLOADQ_UNLOCK();
2159 return;
2160 }
2161 PF_OVERLOADQ_UNLOCK();
2162
2163 /*
2164 * Do naive mark-and-sweep garbage collecting of old rules.
2165 * Reference flag is raised by pf_purge_expired_states()
2166 * and pf_purge_expired_src_nodes().
2167 *
2168 * To avoid LOR between PF_UNLNKDRULES_LOCK/PF_RULES_WLOCK,
2169 * use a temporary queue.
2170 */
2171 TAILQ_INIT(&tmpq);
2172 PF_UNLNKDRULES_LOCK();
2173 TAILQ_FOREACH_SAFE(r, &V_pf_unlinked_rules, entries, r1) {
2174 if (!(r->rule_ref & PFRULE_REFS)) {
2175 TAILQ_REMOVE(&V_pf_unlinked_rules, r, entries);
2176 TAILQ_INSERT_TAIL(&tmpq, r, entries);
2177 } else
2178 r->rule_ref &= ~PFRULE_REFS;
2179 }
2180 PF_UNLNKDRULES_UNLOCK();
2181
2182 if (!TAILQ_EMPTY(&tmpq)) {
2183 PF_RULES_WLOCK();
2184 TAILQ_FOREACH_SAFE(r, &tmpq, entries, r1) {
2185 TAILQ_REMOVE(&tmpq, r, entries);
2186 pf_free_rule(r);
2187 }
2188 PF_RULES_WUNLOCK();
2189 }
2190 }
2191
2192 void
pf_print_host(struct pf_addr * addr,u_int16_t p,sa_family_t af)2193 pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af)
2194 {
2195 switch (af) {
2196 #ifdef INET
2197 case AF_INET: {
2198 u_int32_t a = ntohl(addr->addr32[0]);
2199 printf("%u.%u.%u.%u", (a>>24)&255, (a>>16)&255,
2200 (a>>8)&255, a&255);
2201 if (p) {
2202 p = ntohs(p);
2203 printf(":%u", p);
2204 }
2205 break;
2206 }
2207 #endif /* INET */
2208 #ifdef INET6
2209 case AF_INET6: {
2210 u_int16_t b;
2211 u_int8_t i, curstart, curend, maxstart, maxend;
2212 curstart = curend = maxstart = maxend = 255;
2213 for (i = 0; i < 8; i++) {
2214 if (!addr->addr16[i]) {
2215 if (curstart == 255)
2216 curstart = i;
2217 curend = i;
2218 } else {
2219 if ((curend - curstart) >
2220 (maxend - maxstart)) {
2221 maxstart = curstart;
2222 maxend = curend;
2223 }
2224 curstart = curend = 255;
2225 }
2226 }
2227 if ((curend - curstart) >
2228 (maxend - maxstart)) {
2229 maxstart = curstart;
2230 maxend = curend;
2231 }
2232 for (i = 0; i < 8; i++) {
2233 if (i >= maxstart && i <= maxend) {
2234 if (i == 0)
2235 printf(":");
2236 if (i == maxend)
2237 printf(":");
2238 } else {
2239 b = ntohs(addr->addr16[i]);
2240 printf("%x", b);
2241 if (i < 7)
2242 printf(":");
2243 }
2244 }
2245 if (p) {
2246 p = ntohs(p);
2247 printf("[%u]", p);
2248 }
2249 break;
2250 }
2251 #endif /* INET6 */
2252 }
2253 }
2254
2255 void
pf_print_state(struct pf_kstate * s)2256 pf_print_state(struct pf_kstate *s)
2257 {
2258 pf_print_state_parts(s, NULL, NULL);
2259 }
2260
2261 static void
pf_print_state_parts(struct pf_kstate * s,struct pf_state_key * skwp,struct pf_state_key * sksp)2262 pf_print_state_parts(struct pf_kstate *s,
2263 struct pf_state_key *skwp, struct pf_state_key *sksp)
2264 {
2265 struct pf_state_key *skw, *sks;
2266 u_int8_t proto, dir;
2267
2268 /* Do our best to fill these, but they're skipped if NULL */
2269 skw = skwp ? skwp : (s ? s->key[PF_SK_WIRE] : NULL);
2270 sks = sksp ? sksp : (s ? s->key[PF_SK_STACK] : NULL);
2271 proto = skw ? skw->proto : (sks ? sks->proto : 0);
2272 dir = s ? s->direction : 0;
2273
2274 switch (proto) {
2275 case IPPROTO_IPV4:
2276 printf("IPv4");
2277 break;
2278 case IPPROTO_IPV6:
2279 printf("IPv6");
2280 break;
2281 case IPPROTO_TCP:
2282 printf("TCP");
2283 break;
2284 case IPPROTO_UDP:
2285 printf("UDP");
2286 break;
2287 case IPPROTO_ICMP:
2288 printf("ICMP");
2289 break;
2290 case IPPROTO_ICMPV6:
2291 printf("ICMPv6");
2292 break;
2293 default:
2294 printf("%u", proto);
2295 break;
2296 }
2297 switch (dir) {
2298 case PF_IN:
2299 printf(" in");
2300 break;
2301 case PF_OUT:
2302 printf(" out");
2303 break;
2304 }
2305 if (skw) {
2306 printf(" wire: ");
2307 pf_print_host(&skw->addr[0], skw->port[0], skw->af);
2308 printf(" ");
2309 pf_print_host(&skw->addr[1], skw->port[1], skw->af);
2310 }
2311 if (sks) {
2312 printf(" stack: ");
2313 if (sks != skw) {
2314 pf_print_host(&sks->addr[0], sks->port[0], sks->af);
2315 printf(" ");
2316 pf_print_host(&sks->addr[1], sks->port[1], sks->af);
2317 } else
2318 printf("-");
2319 }
2320 if (s) {
2321 if (proto == IPPROTO_TCP) {
2322 printf(" [lo=%u high=%u win=%u modulator=%u",
2323 s->src.seqlo, s->src.seqhi,
2324 s->src.max_win, s->src.seqdiff);
2325 if (s->src.wscale && s->dst.wscale)
2326 printf(" wscale=%u",
2327 s->src.wscale & PF_WSCALE_MASK);
2328 printf("]");
2329 printf(" [lo=%u high=%u win=%u modulator=%u",
2330 s->dst.seqlo, s->dst.seqhi,
2331 s->dst.max_win, s->dst.seqdiff);
2332 if (s->src.wscale && s->dst.wscale)
2333 printf(" wscale=%u",
2334 s->dst.wscale & PF_WSCALE_MASK);
2335 printf("]");
2336 }
2337 printf(" %u:%u", s->src.state, s->dst.state);
2338 }
2339 }
2340
2341 void
pf_print_flags(u_int8_t f)2342 pf_print_flags(u_int8_t f)
2343 {
2344 if (f)
2345 printf(" ");
2346 if (f & TH_FIN)
2347 printf("F");
2348 if (f & TH_SYN)
2349 printf("S");
2350 if (f & TH_RST)
2351 printf("R");
2352 if (f & TH_PUSH)
2353 printf("P");
2354 if (f & TH_ACK)
2355 printf("A");
2356 if (f & TH_URG)
2357 printf("U");
2358 if (f & TH_ECE)
2359 printf("E");
2360 if (f & TH_CWR)
2361 printf("W");
2362 }
2363
2364 #define PF_SET_SKIP_STEPS(i) \
2365 do { \
2366 while (head[i] != cur) { \
2367 head[i]->skip[i].ptr = cur; \
2368 head[i] = TAILQ_NEXT(head[i], entries); \
2369 } \
2370 } while (0)
2371
2372 void
pf_calc_skip_steps(struct pf_krulequeue * rules)2373 pf_calc_skip_steps(struct pf_krulequeue *rules)
2374 {
2375 struct pf_krule *cur, *prev, *head[PF_SKIP_COUNT];
2376 int i;
2377
2378 cur = TAILQ_FIRST(rules);
2379 prev = cur;
2380 for (i = 0; i < PF_SKIP_COUNT; ++i)
2381 head[i] = cur;
2382 while (cur != NULL) {
2383
2384 if (cur->kif != prev->kif || cur->ifnot != prev->ifnot)
2385 PF_SET_SKIP_STEPS(PF_SKIP_IFP);
2386 if (cur->direction != prev->direction)
2387 PF_SET_SKIP_STEPS(PF_SKIP_DIR);
2388 if (cur->af != prev->af)
2389 PF_SET_SKIP_STEPS(PF_SKIP_AF);
2390 if (cur->proto != prev->proto)
2391 PF_SET_SKIP_STEPS(PF_SKIP_PROTO);
2392 if (cur->src.neg != prev->src.neg ||
2393 pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr))
2394 PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR);
2395 if (cur->src.port[0] != prev->src.port[0] ||
2396 cur->src.port[1] != prev->src.port[1] ||
2397 cur->src.port_op != prev->src.port_op)
2398 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT);
2399 if (cur->dst.neg != prev->dst.neg ||
2400 pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr))
2401 PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR);
2402 if (cur->dst.port[0] != prev->dst.port[0] ||
2403 cur->dst.port[1] != prev->dst.port[1] ||
2404 cur->dst.port_op != prev->dst.port_op)
2405 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
2406
2407 prev = cur;
2408 cur = TAILQ_NEXT(cur, entries);
2409 }
2410 for (i = 0; i < PF_SKIP_COUNT; ++i)
2411 PF_SET_SKIP_STEPS(i);
2412 }
2413
2414 static int
pf_addr_wrap_neq(struct pf_addr_wrap * aw1,struct pf_addr_wrap * aw2)2415 pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2)
2416 {
2417 if (aw1->type != aw2->type)
2418 return (1);
2419 switch (aw1->type) {
2420 case PF_ADDR_ADDRMASK:
2421 case PF_ADDR_RANGE:
2422 if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, AF_INET6))
2423 return (1);
2424 if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, AF_INET6))
2425 return (1);
2426 return (0);
2427 case PF_ADDR_DYNIFTL:
2428 return (aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt);
2429 case PF_ADDR_NOROUTE:
2430 case PF_ADDR_URPFFAILED:
2431 return (0);
2432 case PF_ADDR_TABLE:
2433 return (aw1->p.tbl != aw2->p.tbl);
2434 default:
2435 printf("invalid address type: %d\n", aw1->type);
2436 return (1);
2437 }
2438 }
2439
2440 /**
2441 * Checksum updates are a little complicated because the checksum in the TCP/UDP
2442 * header isn't always a full checksum. In some cases (i.e. output) it's a
2443 * pseudo-header checksum, which is a partial checksum over src/dst IP
2444 * addresses, protocol number and length.
2445 *
2446 * That means we have the following cases:
2447 * * Input or forwarding: we don't have TSO, the checksum fields are full
2448 * checksums, we need to update the checksum whenever we change anything.
2449 * * Output (i.e. the checksum is a pseudo-header checksum):
2450 * x The field being updated is src/dst address or affects the length of
2451 * the packet. We need to update the pseudo-header checksum (note that this
2452 * checksum is not ones' complement).
2453 * x Some other field is being modified (e.g. src/dst port numbers): We
2454 * don't have to update anything.
2455 **/
2456 u_int16_t
pf_cksum_fixup(u_int16_t cksum,u_int16_t old,u_int16_t new,u_int8_t udp)2457 pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp)
2458 {
2459 u_int32_t x;
2460
2461 x = cksum + old - new;
2462 x = (x + (x >> 16)) & 0xffff;
2463
2464 /* optimise: eliminate a branch when not udp */
2465 if (udp && cksum == 0x0000)
2466 return cksum;
2467 if (udp && x == 0x0000)
2468 x = 0xffff;
2469
2470 return (u_int16_t)(x);
2471 }
2472
2473 static void
pf_patch_8(struct mbuf * m,u_int16_t * cksum,u_int8_t * f,u_int8_t v,bool hi,u_int8_t udp)2474 pf_patch_8(struct mbuf *m, u_int16_t *cksum, u_int8_t *f, u_int8_t v, bool hi,
2475 u_int8_t udp)
2476 {
2477 u_int16_t old = htons(hi ? (*f << 8) : *f);
2478 u_int16_t new = htons(hi ? ( v << 8) : v);
2479
2480 if (*f == v)
2481 return;
2482
2483 *f = v;
2484
2485 if (m->m_pkthdr.csum_flags & (CSUM_DELAY_DATA | CSUM_DELAY_DATA_IPV6))
2486 return;
2487
2488 *cksum = pf_cksum_fixup(*cksum, old, new, udp);
2489 }
2490
2491 void
pf_patch_16_unaligned(struct mbuf * m,u_int16_t * cksum,void * f,u_int16_t v,bool hi,u_int8_t udp)2492 pf_patch_16_unaligned(struct mbuf *m, u_int16_t *cksum, void *f, u_int16_t v,
2493 bool hi, u_int8_t udp)
2494 {
2495 u_int8_t *fb = (u_int8_t *)f;
2496 u_int8_t *vb = (u_int8_t *)&v;
2497
2498 pf_patch_8(m, cksum, fb++, *vb++, hi, udp);
2499 pf_patch_8(m, cksum, fb++, *vb++, !hi, udp);
2500 }
2501
2502 void
pf_patch_32_unaligned(struct mbuf * m,u_int16_t * cksum,void * f,u_int32_t v,bool hi,u_int8_t udp)2503 pf_patch_32_unaligned(struct mbuf *m, u_int16_t *cksum, void *f, u_int32_t v,
2504 bool hi, u_int8_t udp)
2505 {
2506 u_int8_t *fb = (u_int8_t *)f;
2507 u_int8_t *vb = (u_int8_t *)&v;
2508
2509 pf_patch_8(m, cksum, fb++, *vb++, hi, udp);
2510 pf_patch_8(m, cksum, fb++, *vb++, !hi, udp);
2511 pf_patch_8(m, cksum, fb++, *vb++, hi, udp);
2512 pf_patch_8(m, cksum, fb++, *vb++, !hi, udp);
2513 }
2514
2515 u_int16_t
pf_proto_cksum_fixup(struct mbuf * m,u_int16_t cksum,u_int16_t old,u_int16_t new,u_int8_t udp)2516 pf_proto_cksum_fixup(struct mbuf *m, u_int16_t cksum, u_int16_t old,
2517 u_int16_t new, u_int8_t udp)
2518 {
2519 if (m->m_pkthdr.csum_flags & (CSUM_DELAY_DATA | CSUM_DELAY_DATA_IPV6))
2520 return (cksum);
2521
2522 return (pf_cksum_fixup(cksum, old, new, udp));
2523 }
2524
2525 static void
pf_change_ap(struct mbuf * m,struct pf_addr * a,u_int16_t * p,u_int16_t * ic,u_int16_t * pc,struct pf_addr * an,u_int16_t pn,u_int8_t u,sa_family_t af)2526 pf_change_ap(struct mbuf *m, struct pf_addr *a, u_int16_t *p, u_int16_t *ic,
2527 u_int16_t *pc, struct pf_addr *an, u_int16_t pn, u_int8_t u,
2528 sa_family_t af)
2529 {
2530 struct pf_addr ao;
2531 u_int16_t po = *p;
2532
2533 PF_ACPY(&ao, a, af);
2534 PF_ACPY(a, an, af);
2535
2536 if (m->m_pkthdr.csum_flags & (CSUM_DELAY_DATA | CSUM_DELAY_DATA_IPV6))
2537 *pc = ~*pc;
2538
2539 *p = pn;
2540
2541 switch (af) {
2542 #ifdef INET
2543 case AF_INET:
2544 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
2545 ao.addr16[0], an->addr16[0], 0),
2546 ao.addr16[1], an->addr16[1], 0);
2547 *p = pn;
2548
2549 *pc = pf_cksum_fixup(pf_cksum_fixup(*pc,
2550 ao.addr16[0], an->addr16[0], u),
2551 ao.addr16[1], an->addr16[1], u);
2552
2553 *pc = pf_proto_cksum_fixup(m, *pc, po, pn, u);
2554 break;
2555 #endif /* INET */
2556 #ifdef INET6
2557 case AF_INET6:
2558 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2559 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2560 pf_cksum_fixup(pf_cksum_fixup(*pc,
2561 ao.addr16[0], an->addr16[0], u),
2562 ao.addr16[1], an->addr16[1], u),
2563 ao.addr16[2], an->addr16[2], u),
2564 ao.addr16[3], an->addr16[3], u),
2565 ao.addr16[4], an->addr16[4], u),
2566 ao.addr16[5], an->addr16[5], u),
2567 ao.addr16[6], an->addr16[6], u),
2568 ao.addr16[7], an->addr16[7], u);
2569
2570 *pc = pf_proto_cksum_fixup(m, *pc, po, pn, u);
2571 break;
2572 #endif /* INET6 */
2573 }
2574
2575 if (m->m_pkthdr.csum_flags & (CSUM_DELAY_DATA |
2576 CSUM_DELAY_DATA_IPV6)) {
2577 *pc = ~*pc;
2578 if (! *pc)
2579 *pc = 0xffff;
2580 }
2581 }
2582
2583 /* Changes a u_int32_t. Uses a void * so there are no align restrictions */
2584 void
pf_change_a(void * a,u_int16_t * c,u_int32_t an,u_int8_t u)2585 pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u)
2586 {
2587 u_int32_t ao;
2588
2589 memcpy(&ao, a, sizeof(ao));
2590 memcpy(a, &an, sizeof(u_int32_t));
2591 *c = pf_cksum_fixup(pf_cksum_fixup(*c, ao / 65536, an / 65536, u),
2592 ao % 65536, an % 65536, u);
2593 }
2594
2595 void
pf_change_proto_a(struct mbuf * m,void * a,u_int16_t * c,u_int32_t an,u_int8_t udp)2596 pf_change_proto_a(struct mbuf *m, void *a, u_int16_t *c, u_int32_t an, u_int8_t udp)
2597 {
2598 u_int32_t ao;
2599
2600 memcpy(&ao, a, sizeof(ao));
2601 memcpy(a, &an, sizeof(u_int32_t));
2602
2603 *c = pf_proto_cksum_fixup(m,
2604 pf_proto_cksum_fixup(m, *c, ao / 65536, an / 65536, udp),
2605 ao % 65536, an % 65536, udp);
2606 }
2607
2608 #ifdef INET6
2609 static void
pf_change_a6(struct pf_addr * a,u_int16_t * c,struct pf_addr * an,u_int8_t u)2610 pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u)
2611 {
2612 struct pf_addr ao;
2613
2614 PF_ACPY(&ao, a, AF_INET6);
2615 PF_ACPY(a, an, AF_INET6);
2616
2617 *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2618 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2619 pf_cksum_fixup(pf_cksum_fixup(*c,
2620 ao.addr16[0], an->addr16[0], u),
2621 ao.addr16[1], an->addr16[1], u),
2622 ao.addr16[2], an->addr16[2], u),
2623 ao.addr16[3], an->addr16[3], u),
2624 ao.addr16[4], an->addr16[4], u),
2625 ao.addr16[5], an->addr16[5], u),
2626 ao.addr16[6], an->addr16[6], u),
2627 ao.addr16[7], an->addr16[7], u);
2628 }
2629 #endif /* INET6 */
2630
2631 static void
pf_change_icmp(struct pf_addr * ia,u_int16_t * ip,struct pf_addr * oa,struct pf_addr * na,u_int16_t np,u_int16_t * pc,u_int16_t * h2c,u_int16_t * ic,u_int16_t * hc,u_int8_t u,sa_family_t af)2632 pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa,
2633 struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c,
2634 u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af)
2635 {
2636 struct pf_addr oia, ooa;
2637
2638 PF_ACPY(&oia, ia, af);
2639 if (oa)
2640 PF_ACPY(&ooa, oa, af);
2641
2642 /* Change inner protocol port, fix inner protocol checksum. */
2643 if (ip != NULL) {
2644 u_int16_t oip = *ip;
2645 u_int32_t opc;
2646
2647 if (pc != NULL)
2648 opc = *pc;
2649 *ip = np;
2650 if (pc != NULL)
2651 *pc = pf_cksum_fixup(*pc, oip, *ip, u);
2652 *ic = pf_cksum_fixup(*ic, oip, *ip, 0);
2653 if (pc != NULL)
2654 *ic = pf_cksum_fixup(*ic, opc, *pc, 0);
2655 }
2656 /* Change inner ip address, fix inner ip and icmp checksums. */
2657 PF_ACPY(ia, na, af);
2658 switch (af) {
2659 #ifdef INET
2660 case AF_INET: {
2661 u_int32_t oh2c = *h2c;
2662
2663 *h2c = pf_cksum_fixup(pf_cksum_fixup(*h2c,
2664 oia.addr16[0], ia->addr16[0], 0),
2665 oia.addr16[1], ia->addr16[1], 0);
2666 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
2667 oia.addr16[0], ia->addr16[0], 0),
2668 oia.addr16[1], ia->addr16[1], 0);
2669 *ic = pf_cksum_fixup(*ic, oh2c, *h2c, 0);
2670 break;
2671 }
2672 #endif /* INET */
2673 #ifdef INET6
2674 case AF_INET6:
2675 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2676 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2677 pf_cksum_fixup(pf_cksum_fixup(*ic,
2678 oia.addr16[0], ia->addr16[0], u),
2679 oia.addr16[1], ia->addr16[1], u),
2680 oia.addr16[2], ia->addr16[2], u),
2681 oia.addr16[3], ia->addr16[3], u),
2682 oia.addr16[4], ia->addr16[4], u),
2683 oia.addr16[5], ia->addr16[5], u),
2684 oia.addr16[6], ia->addr16[6], u),
2685 oia.addr16[7], ia->addr16[7], u);
2686 break;
2687 #endif /* INET6 */
2688 }
2689 /* Outer ip address, fix outer ip or icmpv6 checksum, if necessary. */
2690 if (oa) {
2691 PF_ACPY(oa, na, af);
2692 switch (af) {
2693 #ifdef INET
2694 case AF_INET:
2695 *hc = pf_cksum_fixup(pf_cksum_fixup(*hc,
2696 ooa.addr16[0], oa->addr16[0], 0),
2697 ooa.addr16[1], oa->addr16[1], 0);
2698 break;
2699 #endif /* INET */
2700 #ifdef INET6
2701 case AF_INET6:
2702 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2703 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2704 pf_cksum_fixup(pf_cksum_fixup(*ic,
2705 ooa.addr16[0], oa->addr16[0], u),
2706 ooa.addr16[1], oa->addr16[1], u),
2707 ooa.addr16[2], oa->addr16[2], u),
2708 ooa.addr16[3], oa->addr16[3], u),
2709 ooa.addr16[4], oa->addr16[4], u),
2710 ooa.addr16[5], oa->addr16[5], u),
2711 ooa.addr16[6], oa->addr16[6], u),
2712 ooa.addr16[7], oa->addr16[7], u);
2713 break;
2714 #endif /* INET6 */
2715 }
2716 }
2717 }
2718
2719
2720 /*
2721 * Need to modulate the sequence numbers in the TCP SACK option
2722 * (credits to Krzysztof Pfaff for report and patch)
2723 */
2724 static int
pf_modulate_sack(struct mbuf * m,int off,struct pf_pdesc * pd,struct tcphdr * th,struct pf_state_peer * dst)2725 pf_modulate_sack(struct mbuf *m, int off, struct pf_pdesc *pd,
2726 struct tcphdr *th, struct pf_state_peer *dst)
2727 {
2728 int hlen = (th->th_off << 2) - sizeof(*th), thoptlen = hlen;
2729 u_int8_t opts[TCP_MAXOLEN], *opt = opts;
2730 int copyback = 0, i, olen;
2731 struct sackblk sack;
2732
2733 #define TCPOLEN_SACKLEN (TCPOLEN_SACK + 2)
2734 if (hlen < TCPOLEN_SACKLEN ||
2735 !pf_pull_hdr(m, off + sizeof(*th), opts, hlen, NULL, NULL, pd->af))
2736 return 0;
2737
2738 while (hlen >= TCPOLEN_SACKLEN) {
2739 size_t startoff = opt - opts;
2740 olen = opt[1];
2741 switch (*opt) {
2742 case TCPOPT_EOL: /* FALLTHROUGH */
2743 case TCPOPT_NOP:
2744 opt++;
2745 hlen--;
2746 break;
2747 case TCPOPT_SACK:
2748 if (olen > hlen)
2749 olen = hlen;
2750 if (olen >= TCPOLEN_SACKLEN) {
2751 for (i = 2; i + TCPOLEN_SACK <= olen;
2752 i += TCPOLEN_SACK) {
2753 memcpy(&sack, &opt[i], sizeof(sack));
2754 pf_patch_32_unaligned(m,
2755 &th->th_sum, &sack.start,
2756 htonl(ntohl(sack.start) - dst->seqdiff),
2757 PF_ALGNMNT(startoff),
2758 0);
2759 pf_patch_32_unaligned(m, &th->th_sum,
2760 &sack.end,
2761 htonl(ntohl(sack.end) - dst->seqdiff),
2762 PF_ALGNMNT(startoff),
2763 0);
2764 memcpy(&opt[i], &sack, sizeof(sack));
2765 }
2766 copyback = 1;
2767 }
2768 /* FALLTHROUGH */
2769 default:
2770 if (olen < 2)
2771 olen = 2;
2772 hlen -= olen;
2773 opt += olen;
2774 }
2775 }
2776
2777 if (copyback)
2778 m_copyback(m, off + sizeof(*th), thoptlen, (caddr_t)opts);
2779 return (copyback);
2780 }
2781
2782 struct mbuf *
pf_build_tcp(const struct pf_krule * r,sa_family_t af,const struct pf_addr * saddr,const struct pf_addr * daddr,u_int16_t sport,u_int16_t dport,u_int32_t seq,u_int32_t ack,u_int8_t flags,u_int16_t win,u_int16_t mss,u_int8_t ttl,int tag,u_int16_t rtag)2783 pf_build_tcp(const struct pf_krule *r, sa_family_t af,
2784 const struct pf_addr *saddr, const struct pf_addr *daddr,
2785 u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack,
2786 u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl, int tag,
2787 u_int16_t rtag)
2788 {
2789 struct mbuf *m;
2790 int len, tlen;
2791 #ifdef INET
2792 struct ip *h = NULL;
2793 #endif /* INET */
2794 #ifdef INET6
2795 struct ip6_hdr *h6 = NULL;
2796 #endif /* INET6 */
2797 struct tcphdr *th;
2798 char *opt;
2799 struct pf_mtag *pf_mtag;
2800
2801 len = 0;
2802 th = NULL;
2803
2804 /* maximum segment size tcp option */
2805 tlen = sizeof(struct tcphdr);
2806 if (mss)
2807 tlen += 4;
2808
2809 switch (af) {
2810 #ifdef INET
2811 case AF_INET:
2812 len = sizeof(struct ip) + tlen;
2813 break;
2814 #endif /* INET */
2815 #ifdef INET6
2816 case AF_INET6:
2817 len = sizeof(struct ip6_hdr) + tlen;
2818 break;
2819 #endif /* INET6 */
2820 default:
2821 panic("%s: unsupported af %d", __func__, af);
2822 }
2823
2824 m = m_gethdr(M_NOWAIT, MT_DATA);
2825 if (m == NULL)
2826 return (NULL);
2827
2828 #ifdef MAC
2829 mac_netinet_firewall_send(m);
2830 #endif
2831 if ((pf_mtag = pf_get_mtag(m)) == NULL) {
2832 m_freem(m);
2833 return (NULL);
2834 }
2835 if (tag)
2836 m->m_flags |= M_SKIP_FIREWALL;
2837 pf_mtag->tag = rtag;
2838
2839 if (r != NULL && r->rtableid >= 0)
2840 M_SETFIB(m, r->rtableid);
2841
2842 #ifdef ALTQ
2843 if (r != NULL && r->qid) {
2844 pf_mtag->qid = r->qid;
2845
2846 /* add hints for ecn */
2847 pf_mtag->hdr = mtod(m, struct ip *);
2848 }
2849 #endif /* ALTQ */
2850 m->m_data += max_linkhdr;
2851 m->m_pkthdr.len = m->m_len = len;
2852 /* The rest of the stack assumes a rcvif, so provide one.
2853 * This is a locally generated packet, so .. close enough. */
2854 m->m_pkthdr.rcvif = V_loif;
2855 bzero(m->m_data, len);
2856 switch (af) {
2857 #ifdef INET
2858 case AF_INET:
2859 h = mtod(m, struct ip *);
2860
2861 /* IP header fields included in the TCP checksum */
2862 h->ip_p = IPPROTO_TCP;
2863 h->ip_len = htons(tlen);
2864 h->ip_src.s_addr = saddr->v4.s_addr;
2865 h->ip_dst.s_addr = daddr->v4.s_addr;
2866
2867 th = (struct tcphdr *)((caddr_t)h + sizeof(struct ip));
2868 break;
2869 #endif /* INET */
2870 #ifdef INET6
2871 case AF_INET6:
2872 h6 = mtod(m, struct ip6_hdr *);
2873
2874 /* IP header fields included in the TCP checksum */
2875 h6->ip6_nxt = IPPROTO_TCP;
2876 h6->ip6_plen = htons(tlen);
2877 memcpy(&h6->ip6_src, &saddr->v6, sizeof(struct in6_addr));
2878 memcpy(&h6->ip6_dst, &daddr->v6, sizeof(struct in6_addr));
2879
2880 th = (struct tcphdr *)((caddr_t)h6 + sizeof(struct ip6_hdr));
2881 break;
2882 #endif /* INET6 */
2883 }
2884
2885 /* TCP header */
2886 th->th_sport = sport;
2887 th->th_dport = dport;
2888 th->th_seq = htonl(seq);
2889 th->th_ack = htonl(ack);
2890 th->th_off = tlen >> 2;
2891 th->th_flags = flags;
2892 th->th_win = htons(win);
2893
2894 if (mss) {
2895 opt = (char *)(th + 1);
2896 opt[0] = TCPOPT_MAXSEG;
2897 opt[1] = 4;
2898 HTONS(mss);
2899 bcopy((caddr_t)&mss, (caddr_t)(opt + 2), 2);
2900 }
2901
2902 switch (af) {
2903 #ifdef INET
2904 case AF_INET:
2905 /* TCP checksum */
2906 th->th_sum = in_cksum(m, len);
2907
2908 /* Finish the IP header */
2909 h->ip_v = 4;
2910 h->ip_hl = sizeof(*h) >> 2;
2911 h->ip_tos = IPTOS_LOWDELAY;
2912 h->ip_off = htons(V_path_mtu_discovery ? IP_DF : 0);
2913 h->ip_len = htons(len);
2914 h->ip_ttl = ttl ? ttl : V_ip_defttl;
2915 h->ip_sum = 0;
2916 break;
2917 #endif /* INET */
2918 #ifdef INET6
2919 case AF_INET6:
2920 /* TCP checksum */
2921 th->th_sum = in6_cksum(m, IPPROTO_TCP,
2922 sizeof(struct ip6_hdr), tlen);
2923
2924 h6->ip6_vfc |= IPV6_VERSION;
2925 h6->ip6_hlim = IPV6_DEFHLIM;
2926 break;
2927 #endif /* INET6 */
2928 }
2929
2930 return (m);
2931 }
2932
2933 void
pf_send_tcp(const struct pf_krule * r,sa_family_t af,const struct pf_addr * saddr,const struct pf_addr * daddr,u_int16_t sport,u_int16_t dport,u_int32_t seq,u_int32_t ack,u_int8_t flags,u_int16_t win,u_int16_t mss,u_int8_t ttl,int tag,u_int16_t rtag)2934 pf_send_tcp(const struct pf_krule *r, sa_family_t af,
2935 const struct pf_addr *saddr, const struct pf_addr *daddr,
2936 u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack,
2937 u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl, int tag,
2938 u_int16_t rtag)
2939 {
2940 struct pf_send_entry *pfse;
2941 struct mbuf *m;
2942
2943 m = pf_build_tcp(r, af, saddr, daddr, sport, dport, seq, ack, flags,
2944 win, mss, ttl, tag, rtag);
2945 if (m == NULL)
2946 return;
2947
2948 /* Allocate outgoing queue entry, mbuf and mbuf tag. */
2949 pfse = malloc(sizeof(*pfse), M_PFTEMP, M_NOWAIT);
2950 if (pfse == NULL) {
2951 m_freem(m);
2952 return;
2953 }
2954
2955 switch (af) {
2956 #ifdef INET
2957 case AF_INET:
2958 pfse->pfse_type = PFSE_IP;
2959 break;
2960 #endif /* INET */
2961 #ifdef INET6
2962 case AF_INET6:
2963 pfse->pfse_type = PFSE_IP6;
2964 break;
2965 #endif /* INET6 */
2966 }
2967
2968 pfse->pfse_m = m;
2969 pf_send(pfse);
2970 }
2971
2972 static void
pf_return(struct pf_krule * r,struct pf_krule * nr,struct pf_pdesc * pd,struct pf_state_key * sk,int off,struct mbuf * m,struct tcphdr * th,struct pfi_kkif * kif,u_int16_t bproto_sum,u_int16_t bip_sum,int hdrlen,u_short * reason)2973 pf_return(struct pf_krule *r, struct pf_krule *nr, struct pf_pdesc *pd,
2974 struct pf_state_key *sk, int off, struct mbuf *m, struct tcphdr *th,
2975 struct pfi_kkif *kif, u_int16_t bproto_sum, u_int16_t bip_sum, int hdrlen,
2976 u_short *reason)
2977 {
2978 struct pf_addr * const saddr = pd->src;
2979 struct pf_addr * const daddr = pd->dst;
2980 sa_family_t af = pd->af;
2981
2982 /* undo NAT changes, if they have taken place */
2983 if (nr != NULL) {
2984 PF_ACPY(saddr, &sk->addr[pd->sidx], af);
2985 PF_ACPY(daddr, &sk->addr[pd->didx], af);
2986 if (pd->sport)
2987 *pd->sport = sk->port[pd->sidx];
2988 if (pd->dport)
2989 *pd->dport = sk->port[pd->didx];
2990 if (pd->proto_sum)
2991 *pd->proto_sum = bproto_sum;
2992 if (pd->ip_sum)
2993 *pd->ip_sum = bip_sum;
2994 m_copyback(m, off, hdrlen, pd->hdr.any);
2995 }
2996 if (pd->proto == IPPROTO_TCP &&
2997 ((r->rule_flag & PFRULE_RETURNRST) ||
2998 (r->rule_flag & PFRULE_RETURN)) &&
2999 !(th->th_flags & TH_RST)) {
3000 u_int32_t ack = ntohl(th->th_seq) + pd->p_len;
3001 int len = 0;
3002 #ifdef INET
3003 struct ip *h4;
3004 #endif
3005 #ifdef INET6
3006 struct ip6_hdr *h6;
3007 #endif
3008
3009 switch (af) {
3010 #ifdef INET
3011 case AF_INET:
3012 h4 = mtod(m, struct ip *);
3013 len = ntohs(h4->ip_len) - off;
3014 break;
3015 #endif
3016 #ifdef INET6
3017 case AF_INET6:
3018 h6 = mtod(m, struct ip6_hdr *);
3019 len = ntohs(h6->ip6_plen) - (off - sizeof(*h6));
3020 break;
3021 #endif
3022 }
3023
3024 if (pf_check_proto_cksum(m, off, len, IPPROTO_TCP, af))
3025 REASON_SET(reason, PFRES_PROTCKSUM);
3026 else {
3027 if (th->th_flags & TH_SYN)
3028 ack++;
3029 if (th->th_flags & TH_FIN)
3030 ack++;
3031 pf_send_tcp(r, af, pd->dst,
3032 pd->src, th->th_dport, th->th_sport,
3033 ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0,
3034 r->return_ttl, 1, 0);
3035 }
3036 } else if (pd->proto != IPPROTO_ICMP && af == AF_INET &&
3037 r->return_icmp)
3038 pf_send_icmp(m, r->return_icmp >> 8,
3039 r->return_icmp & 255, af, r);
3040 else if (pd->proto != IPPROTO_ICMPV6 && af == AF_INET6 &&
3041 r->return_icmp6)
3042 pf_send_icmp(m, r->return_icmp6 >> 8,
3043 r->return_icmp6 & 255, af, r);
3044 }
3045
3046
3047 static int
pf_match_ieee8021q_pcp(u_int8_t prio,struct mbuf * m)3048 pf_match_ieee8021q_pcp(u_int8_t prio, struct mbuf *m)
3049 {
3050 struct m_tag *mtag;
3051 u_int8_t mpcp;
3052
3053 mtag = m_tag_locate(m, MTAG_8021Q, MTAG_8021Q_PCP_IN, NULL);
3054 if (mtag == NULL)
3055 return (0);
3056
3057 if (prio == PF_PRIO_ZERO)
3058 prio = 0;
3059
3060 mpcp = *(uint8_t *)(mtag + 1);
3061
3062 return (mpcp == prio);
3063 }
3064
3065 static void
pf_send_icmp(struct mbuf * m,u_int8_t type,u_int8_t code,sa_family_t af,struct pf_krule * r)3066 pf_send_icmp(struct mbuf *m, u_int8_t type, u_int8_t code, sa_family_t af,
3067 struct pf_krule *r)
3068 {
3069 struct pf_send_entry *pfse;
3070 struct mbuf *m0;
3071 struct pf_mtag *pf_mtag;
3072
3073 /* Allocate outgoing queue entry, mbuf and mbuf tag. */
3074 pfse = malloc(sizeof(*pfse), M_PFTEMP, M_NOWAIT);
3075 if (pfse == NULL)
3076 return;
3077
3078 if ((m0 = m_copypacket(m, M_NOWAIT)) == NULL) {
3079 free(pfse, M_PFTEMP);
3080 return;
3081 }
3082
3083 if ((pf_mtag = pf_get_mtag(m0)) == NULL) {
3084 free(pfse, M_PFTEMP);
3085 return;
3086 }
3087 /* XXX: revisit */
3088 m0->m_flags |= M_SKIP_FIREWALL;
3089
3090 if (r->rtableid >= 0)
3091 M_SETFIB(m0, r->rtableid);
3092
3093 #ifdef ALTQ
3094 if (r->qid) {
3095 pf_mtag->qid = r->qid;
3096 /* add hints for ecn */
3097 pf_mtag->hdr = mtod(m0, struct ip *);
3098 }
3099 #endif /* ALTQ */
3100
3101 switch (af) {
3102 #ifdef INET
3103 case AF_INET:
3104 pfse->pfse_type = PFSE_ICMP;
3105 break;
3106 #endif /* INET */
3107 #ifdef INET6
3108 case AF_INET6:
3109 pfse->pfse_type = PFSE_ICMP6;
3110 break;
3111 #endif /* INET6 */
3112 }
3113 pfse->pfse_m = m0;
3114 pfse->icmpopts.type = type;
3115 pfse->icmpopts.code = code;
3116 pf_send(pfse);
3117 }
3118
3119 /*
3120 * Return 1 if the addresses a and b match (with mask m), otherwise return 0.
3121 * If n is 0, they match if they are equal. If n is != 0, they match if they
3122 * are different.
3123 */
3124 int
pf_match_addr(u_int8_t n,struct pf_addr * a,struct pf_addr * m,struct pf_addr * b,sa_family_t af)3125 pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m,
3126 struct pf_addr *b, sa_family_t af)
3127 {
3128 int match = 0;
3129
3130 switch (af) {
3131 #ifdef INET
3132 case AF_INET:
3133 if ((a->addr32[0] & m->addr32[0]) ==
3134 (b->addr32[0] & m->addr32[0]))
3135 match++;
3136 break;
3137 #endif /* INET */
3138 #ifdef INET6
3139 case AF_INET6:
3140 if (((a->addr32[0] & m->addr32[0]) ==
3141 (b->addr32[0] & m->addr32[0])) &&
3142 ((a->addr32[1] & m->addr32[1]) ==
3143 (b->addr32[1] & m->addr32[1])) &&
3144 ((a->addr32[2] & m->addr32[2]) ==
3145 (b->addr32[2] & m->addr32[2])) &&
3146 ((a->addr32[3] & m->addr32[3]) ==
3147 (b->addr32[3] & m->addr32[3])))
3148 match++;
3149 break;
3150 #endif /* INET6 */
3151 }
3152 if (match) {
3153 if (n)
3154 return (0);
3155 else
3156 return (1);
3157 } else {
3158 if (n)
3159 return (1);
3160 else
3161 return (0);
3162 }
3163 }
3164
3165 /*
3166 * Return 1 if b <= a <= e, otherwise return 0.
3167 */
3168 int
pf_match_addr_range(struct pf_addr * b,struct pf_addr * e,struct pf_addr * a,sa_family_t af)3169 pf_match_addr_range(struct pf_addr *b, struct pf_addr *e,
3170 struct pf_addr *a, sa_family_t af)
3171 {
3172 switch (af) {
3173 #ifdef INET
3174 case AF_INET:
3175 if ((ntohl(a->addr32[0]) < ntohl(b->addr32[0])) ||
3176 (ntohl(a->addr32[0]) > ntohl(e->addr32[0])))
3177 return (0);
3178 break;
3179 #endif /* INET */
3180 #ifdef INET6
3181 case AF_INET6: {
3182 int i;
3183
3184 /* check a >= b */
3185 for (i = 0; i < 4; ++i)
3186 if (ntohl(a->addr32[i]) > ntohl(b->addr32[i]))
3187 break;
3188 else if (ntohl(a->addr32[i]) < ntohl(b->addr32[i]))
3189 return (0);
3190 /* check a <= e */
3191 for (i = 0; i < 4; ++i)
3192 if (ntohl(a->addr32[i]) < ntohl(e->addr32[i]))
3193 break;
3194 else if (ntohl(a->addr32[i]) > ntohl(e->addr32[i]))
3195 return (0);
3196 break;
3197 }
3198 #endif /* INET6 */
3199 }
3200 return (1);
3201 }
3202
3203 static int
pf_match(u_int8_t op,u_int32_t a1,u_int32_t a2,u_int32_t p)3204 pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p)
3205 {
3206 switch (op) {
3207 case PF_OP_IRG:
3208 return ((p > a1) && (p < a2));
3209 case PF_OP_XRG:
3210 return ((p < a1) || (p > a2));
3211 case PF_OP_RRG:
3212 return ((p >= a1) && (p <= a2));
3213 case PF_OP_EQ:
3214 return (p == a1);
3215 case PF_OP_NE:
3216 return (p != a1);
3217 case PF_OP_LT:
3218 return (p < a1);
3219 case PF_OP_LE:
3220 return (p <= a1);
3221 case PF_OP_GT:
3222 return (p > a1);
3223 case PF_OP_GE:
3224 return (p >= a1);
3225 }
3226 return (0); /* never reached */
3227 }
3228
3229 int
pf_match_port(u_int8_t op,u_int16_t a1,u_int16_t a2,u_int16_t p)3230 pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p)
3231 {
3232 NTOHS(a1);
3233 NTOHS(a2);
3234 NTOHS(p);
3235 return (pf_match(op, a1, a2, p));
3236 }
3237
3238 static int
pf_match_uid(u_int8_t op,uid_t a1,uid_t a2,uid_t u)3239 pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u)
3240 {
3241 if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE)
3242 return (0);
3243 return (pf_match(op, a1, a2, u));
3244 }
3245
3246 static int
pf_match_gid(u_int8_t op,gid_t a1,gid_t a2,gid_t g)3247 pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g)
3248 {
3249 if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE)
3250 return (0);
3251 return (pf_match(op, a1, a2, g));
3252 }
3253
3254 int
pf_match_tag(struct mbuf * m,struct pf_krule * r,int * tag,int mtag)3255 pf_match_tag(struct mbuf *m, struct pf_krule *r, int *tag, int mtag)
3256 {
3257 if (*tag == -1)
3258 *tag = mtag;
3259
3260 return ((!r->match_tag_not && r->match_tag == *tag) ||
3261 (r->match_tag_not && r->match_tag != *tag));
3262 }
3263
3264 int
pf_tag_packet(struct mbuf * m,struct pf_pdesc * pd,int tag)3265 pf_tag_packet(struct mbuf *m, struct pf_pdesc *pd, int tag)
3266 {
3267
3268 KASSERT(tag > 0, ("%s: tag %d", __func__, tag));
3269
3270 if (pd->pf_mtag == NULL && ((pd->pf_mtag = pf_get_mtag(m)) == NULL))
3271 return (ENOMEM);
3272
3273 pd->pf_mtag->tag = tag;
3274
3275 return (0);
3276 }
3277
3278 #define PF_ANCHOR_STACKSIZE 32
3279 struct pf_kanchor_stackframe {
3280 struct pf_kruleset *rs;
3281 struct pf_krule *r; /* XXX: + match bit */
3282 struct pf_kanchor *child;
3283 };
3284
3285 /*
3286 * XXX: We rely on malloc(9) returning pointer aligned addresses.
3287 */
3288 #define PF_ANCHORSTACK_MATCH 0x00000001
3289 #define PF_ANCHORSTACK_MASK (PF_ANCHORSTACK_MATCH)
3290
3291 #define PF_ANCHOR_MATCH(f) ((uintptr_t)(f)->r & PF_ANCHORSTACK_MATCH)
3292 #define PF_ANCHOR_RULE(f) (struct pf_krule *) \
3293 ((uintptr_t)(f)->r & ~PF_ANCHORSTACK_MASK)
3294 #define PF_ANCHOR_SET_MATCH(f) do { (f)->r = (void *) \
3295 ((uintptr_t)(f)->r | PF_ANCHORSTACK_MATCH); \
3296 } while (0)
3297
3298 void
pf_step_into_anchor(struct pf_kanchor_stackframe * stack,int * depth,struct pf_kruleset ** rs,int n,struct pf_krule ** r,struct pf_krule ** a,int * match)3299 pf_step_into_anchor(struct pf_kanchor_stackframe *stack, int *depth,
3300 struct pf_kruleset **rs, int n, struct pf_krule **r, struct pf_krule **a,
3301 int *match)
3302 {
3303 struct pf_kanchor_stackframe *f;
3304
3305 PF_RULES_RASSERT();
3306
3307 if (match)
3308 *match = 0;
3309 if (*depth >= PF_ANCHOR_STACKSIZE) {
3310 printf("%s: anchor stack overflow on %s\n",
3311 __func__, (*r)->anchor->name);
3312 *r = TAILQ_NEXT(*r, entries);
3313 return;
3314 } else if (*depth == 0 && a != NULL)
3315 *a = *r;
3316 f = stack + (*depth)++;
3317 f->rs = *rs;
3318 f->r = *r;
3319 if ((*r)->anchor_wildcard) {
3320 struct pf_kanchor_node *parent = &(*r)->anchor->children;
3321
3322 if ((f->child = RB_MIN(pf_kanchor_node, parent)) == NULL) {
3323 *r = NULL;
3324 return;
3325 }
3326 *rs = &f->child->ruleset;
3327 } else {
3328 f->child = NULL;
3329 *rs = &(*r)->anchor->ruleset;
3330 }
3331 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
3332 }
3333
3334 int
pf_step_out_of_anchor(struct pf_kanchor_stackframe * stack,int * depth,struct pf_kruleset ** rs,int n,struct pf_krule ** r,struct pf_krule ** a,int * match)3335 pf_step_out_of_anchor(struct pf_kanchor_stackframe *stack, int *depth,
3336 struct pf_kruleset **rs, int n, struct pf_krule **r, struct pf_krule **a,
3337 int *match)
3338 {
3339 struct pf_kanchor_stackframe *f;
3340 struct pf_krule *fr;
3341 int quick = 0;
3342
3343 PF_RULES_RASSERT();
3344
3345 do {
3346 if (*depth <= 0)
3347 break;
3348 f = stack + *depth - 1;
3349 fr = PF_ANCHOR_RULE(f);
3350 if (f->child != NULL) {
3351 struct pf_kanchor_node *parent;
3352
3353 /*
3354 * This block traverses through
3355 * a wildcard anchor.
3356 */
3357 parent = &fr->anchor->children;
3358 if (match != NULL && *match) {
3359 /*
3360 * If any of "*" matched, then
3361 * "foo/ *" matched, mark frame
3362 * appropriately.
3363 */
3364 PF_ANCHOR_SET_MATCH(f);
3365 *match = 0;
3366 }
3367 f->child = RB_NEXT(pf_kanchor_node, parent, f->child);
3368 if (f->child != NULL) {
3369 *rs = &f->child->ruleset;
3370 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
3371 if (*r == NULL)
3372 continue;
3373 else
3374 break;
3375 }
3376 }
3377 (*depth)--;
3378 if (*depth == 0 && a != NULL)
3379 *a = NULL;
3380 *rs = f->rs;
3381 if (PF_ANCHOR_MATCH(f) || (match != NULL && *match))
3382 quick = fr->quick;
3383 *r = TAILQ_NEXT(fr, entries);
3384 } while (*r == NULL);
3385
3386 return (quick);
3387 }
3388
3389 #ifdef INET6
3390 void
pf_poolmask(struct pf_addr * naddr,struct pf_addr * raddr,struct pf_addr * rmask,struct pf_addr * saddr,sa_family_t af)3391 pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr,
3392 struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af)
3393 {
3394 switch (af) {
3395 #ifdef INET
3396 case AF_INET:
3397 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
3398 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]);
3399 break;
3400 #endif /* INET */
3401 case AF_INET6:
3402 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
3403 ((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]);
3404 naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) |
3405 ((rmask->addr32[1] ^ 0xffffffff ) & saddr->addr32[1]);
3406 naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) |
3407 ((rmask->addr32[2] ^ 0xffffffff ) & saddr->addr32[2]);
3408 naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) |
3409 ((rmask->addr32[3] ^ 0xffffffff ) & saddr->addr32[3]);
3410 break;
3411 }
3412 }
3413
3414 void
pf_addr_inc(struct pf_addr * addr,sa_family_t af)3415 pf_addr_inc(struct pf_addr *addr, sa_family_t af)
3416 {
3417 switch (af) {
3418 #ifdef INET
3419 case AF_INET:
3420 addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1);
3421 break;
3422 #endif /* INET */
3423 case AF_INET6:
3424 if (addr->addr32[3] == 0xffffffff) {
3425 addr->addr32[3] = 0;
3426 if (addr->addr32[2] == 0xffffffff) {
3427 addr->addr32[2] = 0;
3428 if (addr->addr32[1] == 0xffffffff) {
3429 addr->addr32[1] = 0;
3430 addr->addr32[0] =
3431 htonl(ntohl(addr->addr32[0]) + 1);
3432 } else
3433 addr->addr32[1] =
3434 htonl(ntohl(addr->addr32[1]) + 1);
3435 } else
3436 addr->addr32[2] =
3437 htonl(ntohl(addr->addr32[2]) + 1);
3438 } else
3439 addr->addr32[3] =
3440 htonl(ntohl(addr->addr32[3]) + 1);
3441 break;
3442 }
3443 }
3444 #endif /* INET6 */
3445
3446 void
pf_rule_to_actions(struct pf_krule * r,struct pf_rule_actions * a)3447 pf_rule_to_actions(struct pf_krule *r, struct pf_rule_actions *a)
3448 {
3449 if (r->qid)
3450 a->qid = r->qid;
3451 if (r->pqid)
3452 a->pqid = r->pqid;
3453 }
3454
3455 int
pf_socket_lookup(int direction,struct pf_pdesc * pd,struct mbuf * m)3456 pf_socket_lookup(int direction, struct pf_pdesc *pd, struct mbuf *m)
3457 {
3458 struct pf_addr *saddr, *daddr;
3459 u_int16_t sport, dport;
3460 struct inpcbinfo *pi;
3461 struct inpcb *inp;
3462
3463 pd->lookup.uid = UID_MAX;
3464 pd->lookup.gid = GID_MAX;
3465
3466 switch (pd->proto) {
3467 case IPPROTO_TCP:
3468 sport = pd->hdr.tcp.th_sport;
3469 dport = pd->hdr.tcp.th_dport;
3470 pi = &V_tcbinfo;
3471 break;
3472 case IPPROTO_UDP:
3473 sport = pd->hdr.udp.uh_sport;
3474 dport = pd->hdr.udp.uh_dport;
3475 pi = &V_udbinfo;
3476 break;
3477 default:
3478 return (-1);
3479 }
3480 if (direction == PF_IN) {
3481 saddr = pd->src;
3482 daddr = pd->dst;
3483 } else {
3484 u_int16_t p;
3485
3486 p = sport;
3487 sport = dport;
3488 dport = p;
3489 saddr = pd->dst;
3490 daddr = pd->src;
3491 }
3492 switch (pd->af) {
3493 #ifdef INET
3494 case AF_INET:
3495 inp = in_pcblookup_mbuf(pi, saddr->v4, sport, daddr->v4,
3496 dport, INPLOOKUP_RLOCKPCB, NULL, m);
3497 if (inp == NULL) {
3498 inp = in_pcblookup_mbuf(pi, saddr->v4, sport,
3499 daddr->v4, dport, INPLOOKUP_WILDCARD |
3500 INPLOOKUP_RLOCKPCB, NULL, m);
3501 if (inp == NULL)
3502 return (-1);
3503 }
3504 break;
3505 #endif /* INET */
3506 #ifdef INET6
3507 case AF_INET6:
3508 inp = in6_pcblookup_mbuf(pi, &saddr->v6, sport, &daddr->v6,
3509 dport, INPLOOKUP_RLOCKPCB, NULL, m);
3510 if (inp == NULL) {
3511 inp = in6_pcblookup_mbuf(pi, &saddr->v6, sport,
3512 &daddr->v6, dport, INPLOOKUP_WILDCARD |
3513 INPLOOKUP_RLOCKPCB, NULL, m);
3514 if (inp == NULL)
3515 return (-1);
3516 }
3517 break;
3518 #endif /* INET6 */
3519
3520 default:
3521 return (-1);
3522 }
3523 INP_RLOCK_ASSERT(inp);
3524 pd->lookup.uid = inp->inp_cred->cr_uid;
3525 pd->lookup.gid = inp->inp_cred->cr_groups[0];
3526 INP_RUNLOCK(inp);
3527
3528 return (1);
3529 }
3530
3531 u_int8_t
pf_get_wscale(struct mbuf * m,int off,u_int16_t th_off,sa_family_t af)3532 pf_get_wscale(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af)
3533 {
3534 int hlen;
3535 u_int8_t hdr[60];
3536 u_int8_t *opt, optlen;
3537 u_int8_t wscale = 0;
3538
3539 hlen = th_off << 2; /* hlen <= sizeof(hdr) */
3540 if (hlen <= sizeof(struct tcphdr))
3541 return (0);
3542 if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af))
3543 return (0);
3544 opt = hdr + sizeof(struct tcphdr);
3545 hlen -= sizeof(struct tcphdr);
3546 while (hlen >= 3) {
3547 switch (*opt) {
3548 case TCPOPT_EOL:
3549 case TCPOPT_NOP:
3550 ++opt;
3551 --hlen;
3552 break;
3553 case TCPOPT_WINDOW:
3554 wscale = opt[2];
3555 if (wscale > TCP_MAX_WINSHIFT)
3556 wscale = TCP_MAX_WINSHIFT;
3557 wscale |= PF_WSCALE_FLAG;
3558 /* FALLTHROUGH */
3559 default:
3560 optlen = opt[1];
3561 if (optlen < 2)
3562 optlen = 2;
3563 hlen -= optlen;
3564 opt += optlen;
3565 break;
3566 }
3567 }
3568 return (wscale);
3569 }
3570
3571 u_int16_t
pf_get_mss(struct mbuf * m,int off,u_int16_t th_off,sa_family_t af)3572 pf_get_mss(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af)
3573 {
3574 int hlen;
3575 u_int8_t hdr[60];
3576 u_int8_t *opt, optlen;
3577 u_int16_t mss = V_tcp_mssdflt;
3578
3579 hlen = th_off << 2; /* hlen <= sizeof(hdr) */
3580 if (hlen <= sizeof(struct tcphdr))
3581 return (0);
3582 if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af))
3583 return (0);
3584 opt = hdr + sizeof(struct tcphdr);
3585 hlen -= sizeof(struct tcphdr);
3586 while (hlen >= TCPOLEN_MAXSEG) {
3587 switch (*opt) {
3588 case TCPOPT_EOL:
3589 case TCPOPT_NOP:
3590 ++opt;
3591 --hlen;
3592 break;
3593 case TCPOPT_MAXSEG:
3594 bcopy((caddr_t)(opt + 2), (caddr_t)&mss, 2);
3595 NTOHS(mss);
3596 /* FALLTHROUGH */
3597 default:
3598 optlen = opt[1];
3599 if (optlen < 2)
3600 optlen = 2;
3601 hlen -= optlen;
3602 opt += optlen;
3603 break;
3604 }
3605 }
3606 return (mss);
3607 }
3608
3609 static u_int16_t
pf_calc_mss(struct pf_addr * addr,sa_family_t af,int rtableid,u_int16_t offer)3610 pf_calc_mss(struct pf_addr *addr, sa_family_t af, int rtableid, u_int16_t offer)
3611 {
3612 #ifdef INET
3613 struct nhop4_basic nh4;
3614 #endif /* INET */
3615 #ifdef INET6
3616 struct nhop6_basic nh6;
3617 struct in6_addr dst6;
3618 uint32_t scopeid;
3619 #endif /* INET6 */
3620 int hlen = 0;
3621 uint16_t mss = 0;
3622
3623 switch (af) {
3624 #ifdef INET
3625 case AF_INET:
3626 hlen = sizeof(struct ip);
3627 if (fib4_lookup_nh_basic(rtableid, addr->v4, 0, 0, &nh4) == 0)
3628 mss = nh4.nh_mtu - hlen - sizeof(struct tcphdr);
3629 break;
3630 #endif /* INET */
3631 #ifdef INET6
3632 case AF_INET6:
3633 hlen = sizeof(struct ip6_hdr);
3634 in6_splitscope(&addr->v6, &dst6, &scopeid);
3635 if (fib6_lookup_nh_basic(rtableid, &dst6, scopeid, 0,0,&nh6)==0)
3636 mss = nh6.nh_mtu - hlen - sizeof(struct tcphdr);
3637 break;
3638 #endif /* INET6 */
3639 }
3640
3641 mss = max(V_tcp_mssdflt, mss);
3642 mss = min(mss, offer);
3643 mss = max(mss, 64); /* sanity - at least max opt space */
3644 return (mss);
3645 }
3646
3647 static u_int32_t
pf_tcp_iss(struct pf_pdesc * pd)3648 pf_tcp_iss(struct pf_pdesc *pd)
3649 {
3650 MD5_CTX ctx;
3651 u_int32_t digest[4];
3652
3653 if (V_pf_tcp_secret_init == 0) {
3654 arc4random_buf(&V_pf_tcp_secret, sizeof(V_pf_tcp_secret));
3655 MD5Init(&V_pf_tcp_secret_ctx);
3656 MD5Update(&V_pf_tcp_secret_ctx, V_pf_tcp_secret,
3657 sizeof(V_pf_tcp_secret));
3658 V_pf_tcp_secret_init = 1;
3659 }
3660
3661 ctx = V_pf_tcp_secret_ctx;
3662
3663 MD5Update(&ctx, (char *)&pd->hdr.tcp.th_sport, sizeof(u_short));
3664 MD5Update(&ctx, (char *)&pd->hdr.tcp.th_dport, sizeof(u_short));
3665 if (pd->af == AF_INET6) {
3666 MD5Update(&ctx, (char *)&pd->src->v6, sizeof(struct in6_addr));
3667 MD5Update(&ctx, (char *)&pd->dst->v6, sizeof(struct in6_addr));
3668 } else {
3669 MD5Update(&ctx, (char *)&pd->src->v4, sizeof(struct in_addr));
3670 MD5Update(&ctx, (char *)&pd->dst->v4, sizeof(struct in_addr));
3671 }
3672 MD5Final((u_char *)digest, &ctx);
3673 V_pf_tcp_iss_off += 4096;
3674 #define ISN_RANDOM_INCREMENT (4096 - 1)
3675 return (digest[0] + (arc4random() & ISN_RANDOM_INCREMENT) +
3676 V_pf_tcp_iss_off);
3677 #undef ISN_RANDOM_INCREMENT
3678 }
3679
3680 static int
pf_test_rule(struct pf_krule ** rm,struct pf_kstate ** sm,int direction,struct pfi_kkif * kif,struct mbuf * m,int off,struct pf_pdesc * pd,struct pf_krule ** am,struct pf_kruleset ** rsm,struct inpcb * inp)3681 pf_test_rule(struct pf_krule **rm, struct pf_kstate **sm, int direction,
3682 struct pfi_kkif *kif, struct mbuf *m, int off, struct pf_pdesc *pd,
3683 struct pf_krule **am, struct pf_kruleset **rsm, struct inpcb *inp)
3684 {
3685 struct pf_krule *nr = NULL;
3686 struct pf_addr * const saddr = pd->src;
3687 struct pf_addr * const daddr = pd->dst;
3688 sa_family_t af = pd->af;
3689 struct pf_krule *r, *a = NULL;
3690 struct pf_kruleset *ruleset = NULL;
3691 struct pf_ksrc_node *nsn = NULL;
3692 struct tcphdr *th = &pd->hdr.tcp;
3693 struct pf_state_key *sk = NULL, *nk = NULL;
3694 u_short reason;
3695 int rewrite = 0, hdrlen = 0;
3696 int tag = -1, rtableid = -1;
3697 int asd = 0;
3698 int match = 0;
3699 int state_icmp = 0;
3700 u_int16_t sport = 0, dport = 0;
3701 u_int16_t bproto_sum = 0, bip_sum = 0;
3702 u_int8_t icmptype = 0, icmpcode = 0;
3703 struct pf_kanchor_stackframe anchor_stack[PF_ANCHOR_STACKSIZE];
3704
3705 PF_RULES_RASSERT();
3706
3707 if (inp != NULL) {
3708 INP_LOCK_ASSERT(inp);
3709 pd->lookup.uid = inp->inp_cred->cr_uid;
3710 pd->lookup.gid = inp->inp_cred->cr_groups[0];
3711 pd->lookup.done = 1;
3712 }
3713
3714 switch (pd->proto) {
3715 case IPPROTO_TCP:
3716 sport = th->th_sport;
3717 dport = th->th_dport;
3718 hdrlen = sizeof(*th);
3719 break;
3720 case IPPROTO_UDP:
3721 sport = pd->hdr.udp.uh_sport;
3722 dport = pd->hdr.udp.uh_dport;
3723 hdrlen = sizeof(pd->hdr.udp);
3724 break;
3725 #ifdef INET
3726 case IPPROTO_ICMP:
3727 if (pd->af != AF_INET)
3728 break;
3729 sport = dport = pd->hdr.icmp.icmp_id;
3730 hdrlen = sizeof(pd->hdr.icmp);
3731 icmptype = pd->hdr.icmp.icmp_type;
3732 icmpcode = pd->hdr.icmp.icmp_code;
3733
3734 if (icmptype == ICMP_UNREACH ||
3735 icmptype == ICMP_SOURCEQUENCH ||
3736 icmptype == ICMP_REDIRECT ||
3737 icmptype == ICMP_TIMXCEED ||
3738 icmptype == ICMP_PARAMPROB)
3739 state_icmp++;
3740 break;
3741 #endif /* INET */
3742 #ifdef INET6
3743 case IPPROTO_ICMPV6:
3744 if (af != AF_INET6)
3745 break;
3746 sport = dport = pd->hdr.icmp6.icmp6_id;
3747 hdrlen = sizeof(pd->hdr.icmp6);
3748 icmptype = pd->hdr.icmp6.icmp6_type;
3749 icmpcode = pd->hdr.icmp6.icmp6_code;
3750
3751 if (icmptype == ICMP6_DST_UNREACH ||
3752 icmptype == ICMP6_PACKET_TOO_BIG ||
3753 icmptype == ICMP6_TIME_EXCEEDED ||
3754 icmptype == ICMP6_PARAM_PROB)
3755 state_icmp++;
3756 break;
3757 #endif /* INET6 */
3758 default:
3759 sport = dport = hdrlen = 0;
3760 break;
3761 }
3762
3763 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
3764
3765 /* check packet for BINAT/NAT/RDR */
3766 if ((nr = pf_get_translation(pd, m, off, direction, kif, &nsn, &sk,
3767 &nk, saddr, daddr, sport, dport, anchor_stack)) != NULL) {
3768 KASSERT(sk != NULL, ("%s: null sk", __func__));
3769 KASSERT(nk != NULL, ("%s: null nk", __func__));
3770
3771 if (pd->ip_sum)
3772 bip_sum = *pd->ip_sum;
3773
3774 switch (pd->proto) {
3775 case IPPROTO_TCP:
3776 bproto_sum = th->th_sum;
3777 pd->proto_sum = &th->th_sum;
3778
3779 if (PF_ANEQ(saddr, &nk->addr[pd->sidx], af) ||
3780 nk->port[pd->sidx] != sport) {
3781 pf_change_ap(m, saddr, &th->th_sport, pd->ip_sum,
3782 &th->th_sum, &nk->addr[pd->sidx],
3783 nk->port[pd->sidx], 0, af);
3784 pd->sport = &th->th_sport;
3785 sport = th->th_sport;
3786 }
3787
3788 if (PF_ANEQ(daddr, &nk->addr[pd->didx], af) ||
3789 nk->port[pd->didx] != dport) {
3790 pf_change_ap(m, daddr, &th->th_dport, pd->ip_sum,
3791 &th->th_sum, &nk->addr[pd->didx],
3792 nk->port[pd->didx], 0, af);
3793 dport = th->th_dport;
3794 pd->dport = &th->th_dport;
3795 }
3796 rewrite++;
3797 break;
3798 case IPPROTO_UDP:
3799 bproto_sum = pd->hdr.udp.uh_sum;
3800 pd->proto_sum = &pd->hdr.udp.uh_sum;
3801
3802 if (PF_ANEQ(saddr, &nk->addr[pd->sidx], af) ||
3803 nk->port[pd->sidx] != sport) {
3804 pf_change_ap(m, saddr, &pd->hdr.udp.uh_sport,
3805 pd->ip_sum, &pd->hdr.udp.uh_sum,
3806 &nk->addr[pd->sidx],
3807 nk->port[pd->sidx], 1, af);
3808 sport = pd->hdr.udp.uh_sport;
3809 pd->sport = &pd->hdr.udp.uh_sport;
3810 }
3811
3812 if (PF_ANEQ(daddr, &nk->addr[pd->didx], af) ||
3813 nk->port[pd->didx] != dport) {
3814 pf_change_ap(m, daddr, &pd->hdr.udp.uh_dport,
3815 pd->ip_sum, &pd->hdr.udp.uh_sum,
3816 &nk->addr[pd->didx],
3817 nk->port[pd->didx], 1, af);
3818 dport = pd->hdr.udp.uh_dport;
3819 pd->dport = &pd->hdr.udp.uh_dport;
3820 }
3821 rewrite++;
3822 break;
3823 #ifdef INET
3824 case IPPROTO_ICMP:
3825 nk->port[0] = nk->port[1];
3826 if (PF_ANEQ(saddr, &nk->addr[pd->sidx], AF_INET))
3827 pf_change_a(&saddr->v4.s_addr, pd->ip_sum,
3828 nk->addr[pd->sidx].v4.s_addr, 0);
3829
3830 if (PF_ANEQ(daddr, &nk->addr[pd->didx], AF_INET))
3831 pf_change_a(&daddr->v4.s_addr, pd->ip_sum,
3832 nk->addr[pd->didx].v4.s_addr, 0);
3833
3834 if (nk->port[1] != pd->hdr.icmp.icmp_id) {
3835 pd->hdr.icmp.icmp_cksum = pf_cksum_fixup(
3836 pd->hdr.icmp.icmp_cksum, sport,
3837 nk->port[1], 0);
3838 pd->hdr.icmp.icmp_id = nk->port[1];
3839 pd->sport = &pd->hdr.icmp.icmp_id;
3840 }
3841 m_copyback(m, off, ICMP_MINLEN, (caddr_t)&pd->hdr.icmp);
3842 break;
3843 #endif /* INET */
3844 #ifdef INET6
3845 case IPPROTO_ICMPV6:
3846 nk->port[0] = nk->port[1];
3847 if (PF_ANEQ(saddr, &nk->addr[pd->sidx], AF_INET6))
3848 pf_change_a6(saddr, &pd->hdr.icmp6.icmp6_cksum,
3849 &nk->addr[pd->sidx], 0);
3850
3851 if (PF_ANEQ(daddr, &nk->addr[pd->didx], AF_INET6))
3852 pf_change_a6(daddr, &pd->hdr.icmp6.icmp6_cksum,
3853 &nk->addr[pd->didx], 0);
3854 rewrite++;
3855 break;
3856 #endif /* INET */
3857 default:
3858 switch (af) {
3859 #ifdef INET
3860 case AF_INET:
3861 if (PF_ANEQ(saddr,
3862 &nk->addr[pd->sidx], AF_INET))
3863 pf_change_a(&saddr->v4.s_addr,
3864 pd->ip_sum,
3865 nk->addr[pd->sidx].v4.s_addr, 0);
3866
3867 if (PF_ANEQ(daddr,
3868 &nk->addr[pd->didx], AF_INET))
3869 pf_change_a(&daddr->v4.s_addr,
3870 pd->ip_sum,
3871 nk->addr[pd->didx].v4.s_addr, 0);
3872 break;
3873 #endif /* INET */
3874 #ifdef INET6
3875 case AF_INET6:
3876 if (PF_ANEQ(saddr,
3877 &nk->addr[pd->sidx], AF_INET6))
3878 PF_ACPY(saddr, &nk->addr[pd->sidx], af);
3879
3880 if (PF_ANEQ(daddr,
3881 &nk->addr[pd->didx], AF_INET6))
3882 PF_ACPY(daddr, &nk->addr[pd->didx], af);
3883 break;
3884 #endif /* INET */
3885 }
3886 break;
3887 }
3888 if (nr->natpass)
3889 r = NULL;
3890 pd->nat_rule = nr;
3891 }
3892
3893 while (r != NULL) {
3894 pf_counter_u64_add(&r->evaluations, 1);
3895 if (pfi_kkif_match(r->kif, kif) == r->ifnot)
3896 r = r->skip[PF_SKIP_IFP].ptr;
3897 else if (r->direction && r->direction != direction)
3898 r = r->skip[PF_SKIP_DIR].ptr;
3899 else if (r->af && r->af != af)
3900 r = r->skip[PF_SKIP_AF].ptr;
3901 else if (r->proto && r->proto != pd->proto)
3902 r = r->skip[PF_SKIP_PROTO].ptr;
3903 else if (PF_MISMATCHAW(&r->src.addr, saddr, af,
3904 r->src.neg, kif, M_GETFIB(m)))
3905 r = r->skip[PF_SKIP_SRC_ADDR].ptr;
3906 /* tcp/udp only. port_op always 0 in other cases */
3907 else if (r->src.port_op && !pf_match_port(r->src.port_op,
3908 r->src.port[0], r->src.port[1], sport))
3909 r = r->skip[PF_SKIP_SRC_PORT].ptr;
3910 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af,
3911 r->dst.neg, NULL, M_GETFIB(m)))
3912 r = r->skip[PF_SKIP_DST_ADDR].ptr;
3913 /* tcp/udp only. port_op always 0 in other cases */
3914 else if (r->dst.port_op && !pf_match_port(r->dst.port_op,
3915 r->dst.port[0], r->dst.port[1], dport))
3916 r = r->skip[PF_SKIP_DST_PORT].ptr;
3917 /* icmp only. type always 0 in other cases */
3918 else if (r->type && r->type != icmptype + 1)
3919 r = TAILQ_NEXT(r, entries);
3920 /* icmp only. type always 0 in other cases */
3921 else if (r->code && r->code != icmpcode + 1)
3922 r = TAILQ_NEXT(r, entries);
3923 else if (r->tos && !(r->tos == pd->tos))
3924 r = TAILQ_NEXT(r, entries);
3925 else if (r->rule_flag & PFRULE_FRAGMENT)
3926 r = TAILQ_NEXT(r, entries);
3927 else if (pd->proto == IPPROTO_TCP &&
3928 (r->flagset & th->th_flags) != r->flags)
3929 r = TAILQ_NEXT(r, entries);
3930 /* tcp/udp only. uid.op always 0 in other cases */
3931 else if (r->uid.op && (pd->lookup.done || (pd->lookup.done =
3932 pf_socket_lookup(direction, pd, m), 1)) &&
3933 !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1],
3934 pd->lookup.uid))
3935 r = TAILQ_NEXT(r, entries);
3936 /* tcp/udp only. gid.op always 0 in other cases */
3937 else if (r->gid.op && (pd->lookup.done || (pd->lookup.done =
3938 pf_socket_lookup(direction, pd, m), 1)) &&
3939 !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1],
3940 pd->lookup.gid))
3941 r = TAILQ_NEXT(r, entries);
3942 else if (r->prio &&
3943 !pf_match_ieee8021q_pcp(r->prio, m))
3944 r = TAILQ_NEXT(r, entries);
3945 else if (r->prob &&
3946 r->prob <= arc4random())
3947 r = TAILQ_NEXT(r, entries);
3948 else if (r->match_tag && !pf_match_tag(m, r, &tag,
3949 pd->pf_mtag ? pd->pf_mtag->tag : 0))
3950 r = TAILQ_NEXT(r, entries);
3951 else if (r->os_fingerprint != PF_OSFP_ANY &&
3952 (pd->proto != IPPROTO_TCP || !pf_osfp_match(
3953 pf_osfp_fingerprint(pd, m, off, th),
3954 r->os_fingerprint)))
3955 r = TAILQ_NEXT(r, entries);
3956 else {
3957 if (r->tag)
3958 tag = r->tag;
3959 if (r->rtableid >= 0)
3960 rtableid = r->rtableid;
3961 if (r->anchor == NULL) {
3962 if (r->action == PF_MATCH) {
3963 pf_counter_u64_critical_enter();
3964 pf_counter_u64_add_protected(&r->packets[direction == PF_OUT], 1);
3965 pf_counter_u64_add_protected(&r->bytes[direction == PF_OUT], pd->tot_len);
3966 pf_counter_u64_critical_exit();
3967 pf_rule_to_actions(r, &pd->act);
3968 if (r->log)
3969 PFLOG_PACKET(kif, m, af,
3970 direction, PFRES_MATCH, r,
3971 a, ruleset, pd, 1);
3972 } else {
3973 match = 1;
3974 *rm = r;
3975 *am = a;
3976 *rsm = ruleset;
3977 }
3978 if ((*rm)->quick)
3979 break;
3980 r = TAILQ_NEXT(r, entries);
3981 } else
3982 pf_step_into_anchor(anchor_stack, &asd,
3983 &ruleset, PF_RULESET_FILTER, &r, &a,
3984 &match);
3985 }
3986 if (r == NULL && pf_step_out_of_anchor(anchor_stack, &asd,
3987 &ruleset, PF_RULESET_FILTER, &r, &a, &match))
3988 break;
3989 }
3990 r = *rm;
3991 a = *am;
3992 ruleset = *rsm;
3993
3994 REASON_SET(&reason, PFRES_MATCH);
3995
3996 /* apply actions for last matching pass/block rule */
3997 pf_rule_to_actions(r, &pd->act);
3998
3999 if (r->log || (nr != NULL && nr->log)) {
4000 if (rewrite)
4001 m_copyback(m, off, hdrlen, pd->hdr.any);
4002 PFLOG_PACKET(kif, m, af, direction, reason, r->log ? r : nr, a,
4003 ruleset, pd, 1);
4004 }
4005
4006 if ((r->action == PF_DROP) &&
4007 ((r->rule_flag & PFRULE_RETURNRST) ||
4008 (r->rule_flag & PFRULE_RETURNICMP) ||
4009 (r->rule_flag & PFRULE_RETURN))) {
4010 pf_return(r, nr, pd, sk, off, m, th, kif, bproto_sum,
4011 bip_sum, hdrlen, &reason);
4012 }
4013
4014 if (r->action == PF_DROP)
4015 goto cleanup;
4016
4017 if (tag > 0 && pf_tag_packet(m, pd, tag)) {
4018 REASON_SET(&reason, PFRES_MEMORY);
4019 goto cleanup;
4020 }
4021 if (rtableid >= 0)
4022 M_SETFIB(m, rtableid);
4023
4024 if (!state_icmp && (r->keep_state || nr != NULL ||
4025 (pd->flags & PFDESC_TCP_NORM))) {
4026 int action;
4027 action = pf_create_state(r, nr, a, pd, nsn, nk, sk, m, off,
4028 sport, dport, &rewrite, kif, sm, tag, bproto_sum, bip_sum,
4029 hdrlen);
4030 if (action != PF_PASS) {
4031 if (action == PF_DROP &&
4032 (r->rule_flag & PFRULE_RETURN))
4033 pf_return(r, nr, pd, sk, off, m, th, kif,
4034 bproto_sum, bip_sum, hdrlen, &reason);
4035 return (action);
4036 }
4037 } else {
4038 if (sk != NULL)
4039 uma_zfree(V_pf_state_key_z, sk);
4040 if (nk != NULL)
4041 uma_zfree(V_pf_state_key_z, nk);
4042 }
4043
4044 /* copy back packet headers if we performed NAT operations */
4045 if (rewrite)
4046 m_copyback(m, off, hdrlen, pd->hdr.any);
4047
4048 if (*sm != NULL && !((*sm)->state_flags & PFSTATE_NOSYNC) &&
4049 direction == PF_OUT &&
4050 V_pfsync_defer_ptr != NULL && V_pfsync_defer_ptr(*sm, m))
4051 /*
4052 * We want the state created, but we dont
4053 * want to send this in case a partner
4054 * firewall has to know about it to allow
4055 * replies through it.
4056 */
4057 return (PF_DEFER);
4058
4059 return (PF_PASS);
4060
4061 cleanup:
4062 if (sk != NULL)
4063 uma_zfree(V_pf_state_key_z, sk);
4064 if (nk != NULL)
4065 uma_zfree(V_pf_state_key_z, nk);
4066 return (PF_DROP);
4067 }
4068
4069 static int
pf_create_state(struct pf_krule * r,struct pf_krule * nr,struct pf_krule * a,struct pf_pdesc * pd,struct pf_ksrc_node * nsn,struct pf_state_key * nk,struct pf_state_key * sk,struct mbuf * m,int off,u_int16_t sport,u_int16_t dport,int * rewrite,struct pfi_kkif * kif,struct pf_kstate ** sm,int tag,u_int16_t bproto_sum,u_int16_t bip_sum,int hdrlen)4070 pf_create_state(struct pf_krule *r, struct pf_krule *nr, struct pf_krule *a,
4071 struct pf_pdesc *pd, struct pf_ksrc_node *nsn, struct pf_state_key *nk,
4072 struct pf_state_key *sk, struct mbuf *m, int off, u_int16_t sport,
4073 u_int16_t dport, int *rewrite, struct pfi_kkif *kif, struct pf_kstate **sm,
4074 int tag, u_int16_t bproto_sum, u_int16_t bip_sum, int hdrlen)
4075 {
4076 struct pf_kstate *s = NULL;
4077 struct pf_ksrc_node *sn = NULL;
4078 struct tcphdr *th = &pd->hdr.tcp;
4079 u_int16_t mss = V_tcp_mssdflt;
4080 u_short reason;
4081
4082 /* check maximums */
4083 if (r->max_states &&
4084 (counter_u64_fetch(r->states_cur) >= r->max_states)) {
4085 counter_u64_add(V_pf_status.lcounters[LCNT_STATES], 1);
4086 REASON_SET(&reason, PFRES_MAXSTATES);
4087 goto csfailed;
4088 }
4089 /* src node for filter rule */
4090 if ((r->rule_flag & PFRULE_SRCTRACK ||
4091 r->rpool.opts & PF_POOL_STICKYADDR) &&
4092 pf_insert_src_node(&sn, r, pd->src, pd->af) != 0) {
4093 REASON_SET(&reason, PFRES_SRCLIMIT);
4094 goto csfailed;
4095 }
4096 /* src node for translation rule */
4097 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) &&
4098 pf_insert_src_node(&nsn, nr, &sk->addr[pd->sidx], pd->af)) {
4099 REASON_SET(&reason, PFRES_SRCLIMIT);
4100 goto csfailed;
4101 }
4102 s = pf_alloc_state(M_NOWAIT);
4103 if (s == NULL) {
4104 REASON_SET(&reason, PFRES_MEMORY);
4105 goto csfailed;
4106 }
4107 s->rule.ptr = r;
4108 s->nat_rule.ptr = nr;
4109 s->anchor.ptr = a;
4110 STATE_INC_COUNTERS(s);
4111 if (r->allow_opts)
4112 s->state_flags |= PFSTATE_ALLOWOPTS;
4113 if (r->rule_flag & PFRULE_STATESLOPPY)
4114 s->state_flags |= PFSTATE_SLOPPY;
4115 s->log = r->log & PF_LOG_ALL;
4116 s->sync_state = PFSYNC_S_NONE;
4117 s->qid = pd->act.qid;
4118 s->pqid = pd->act.pqid;
4119 if (nr != NULL)
4120 s->log |= nr->log & PF_LOG_ALL;
4121 switch (pd->proto) {
4122 case IPPROTO_TCP:
4123 s->src.seqlo = ntohl(th->th_seq);
4124 s->src.seqhi = s->src.seqlo + pd->p_len + 1;
4125 if ((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN &&
4126 r->keep_state == PF_STATE_MODULATE) {
4127 /* Generate sequence number modulator */
4128 if ((s->src.seqdiff = pf_tcp_iss(pd) - s->src.seqlo) ==
4129 0)
4130 s->src.seqdiff = 1;
4131 pf_change_proto_a(m, &th->th_seq, &th->th_sum,
4132 htonl(s->src.seqlo + s->src.seqdiff), 0);
4133 *rewrite = 1;
4134 } else
4135 s->src.seqdiff = 0;
4136 if (th->th_flags & TH_SYN) {
4137 s->src.seqhi++;
4138 s->src.wscale = pf_get_wscale(m, off,
4139 th->th_off, pd->af);
4140 }
4141 s->src.max_win = MAX(ntohs(th->th_win), 1);
4142 if (s->src.wscale & PF_WSCALE_MASK) {
4143 /* Remove scale factor from initial window */
4144 int win = s->src.max_win;
4145 win += 1 << (s->src.wscale & PF_WSCALE_MASK);
4146 s->src.max_win = (win - 1) >>
4147 (s->src.wscale & PF_WSCALE_MASK);
4148 }
4149 if (th->th_flags & TH_FIN)
4150 s->src.seqhi++;
4151 s->dst.seqhi = 1;
4152 s->dst.max_win = 1;
4153 pf_set_protostate(s, PF_PEER_SRC, TCPS_SYN_SENT);
4154 pf_set_protostate(s, PF_PEER_DST, TCPS_CLOSED);
4155 s->timeout = PFTM_TCP_FIRST_PACKET;
4156 atomic_add_32(&V_pf_status.states_halfopen, 1);
4157 break;
4158 case IPPROTO_UDP:
4159 pf_set_protostate(s, PF_PEER_SRC, PFUDPS_SINGLE);
4160 pf_set_protostate(s, PF_PEER_DST, PFUDPS_NO_TRAFFIC);
4161 s->timeout = PFTM_UDP_FIRST_PACKET;
4162 break;
4163 case IPPROTO_ICMP:
4164 #ifdef INET6
4165 case IPPROTO_ICMPV6:
4166 #endif
4167 s->timeout = PFTM_ICMP_FIRST_PACKET;
4168 break;
4169 default:
4170 pf_set_protostate(s, PF_PEER_SRC, PFOTHERS_SINGLE);
4171 pf_set_protostate(s, PF_PEER_DST, PFOTHERS_NO_TRAFFIC);
4172 s->timeout = PFTM_OTHER_FIRST_PACKET;
4173 }
4174
4175 if (r->rt) {
4176 if (pf_map_addr(pd->af, r, pd->src, &s->rt_addr, NULL, &sn)) {
4177 REASON_SET(&reason, PFRES_MAPFAILED);
4178 pf_src_tree_remove_state(s);
4179 s->timeout = PFTM_UNLINKED;
4180 STATE_DEC_COUNTERS(s);
4181 pf_free_state(s);
4182 goto csfailed;
4183 }
4184 s->rt_kif = r->rpool.cur->kif;
4185 }
4186
4187 s->creation = time_uptime;
4188 s->expire = time_uptime;
4189
4190 if (sn != NULL)
4191 s->src_node = sn;
4192 if (nsn != NULL) {
4193 /* XXX We only modify one side for now. */
4194 PF_ACPY(&nsn->raddr, &nk->addr[1], pd->af);
4195 s->nat_src_node = nsn;
4196 }
4197 if (pd->proto == IPPROTO_TCP) {
4198 if ((pd->flags & PFDESC_TCP_NORM) && pf_normalize_tcp_init(m,
4199 off, pd, th, &s->src, &s->dst)) {
4200 REASON_SET(&reason, PFRES_MEMORY);
4201 pf_src_tree_remove_state(s);
4202 s->timeout = PFTM_UNLINKED;
4203 STATE_DEC_COUNTERS(s);
4204 pf_free_state(s);
4205 return (PF_DROP);
4206 }
4207 if ((pd->flags & PFDESC_TCP_NORM) && s->src.scrub &&
4208 pf_normalize_tcp_stateful(m, off, pd, &reason, th, s,
4209 &s->src, &s->dst, rewrite)) {
4210 /* This really shouldn't happen!!! */
4211 DPFPRINTF(PF_DEBUG_URGENT,
4212 ("pf_normalize_tcp_stateful failed on first "
4213 "pkt\n"));
4214 pf_src_tree_remove_state(s);
4215 s->timeout = PFTM_UNLINKED;
4216 STATE_DEC_COUNTERS(s);
4217 pf_free_state(s);
4218 return (PF_DROP);
4219 }
4220 }
4221 s->direction = pd->dir;
4222
4223 /*
4224 * sk/nk could already been setup by pf_get_translation().
4225 */
4226 if (nr == NULL) {
4227 KASSERT((sk == NULL && nk == NULL), ("%s: nr %p sk %p, nk %p",
4228 __func__, nr, sk, nk));
4229 sk = pf_state_key_setup(pd, pd->src, pd->dst, sport, dport);
4230 if (sk == NULL)
4231 goto csfailed;
4232 nk = sk;
4233 } else
4234 KASSERT((sk != NULL && nk != NULL), ("%s: nr %p sk %p, nk %p",
4235 __func__, nr, sk, nk));
4236
4237 /* Swap sk/nk for PF_OUT. */
4238 if (pf_state_insert(BOUND_IFACE(r, kif), kif,
4239 (pd->dir == PF_IN) ? sk : nk,
4240 (pd->dir == PF_IN) ? nk : sk, s)) {
4241 REASON_SET(&reason, PFRES_STATEINS);
4242 pf_src_tree_remove_state(s);
4243 s->timeout = PFTM_UNLINKED;
4244 STATE_DEC_COUNTERS(s);
4245 pf_free_state(s);
4246 return (PF_DROP);
4247 } else
4248 *sm = s;
4249
4250 if (tag > 0)
4251 s->tag = tag;
4252 if (pd->proto == IPPROTO_TCP && (th->th_flags & (TH_SYN|TH_ACK)) ==
4253 TH_SYN && r->keep_state == PF_STATE_SYNPROXY) {
4254 pf_set_protostate(s, PF_PEER_SRC, PF_TCPS_PROXY_SRC);
4255 /* undo NAT changes, if they have taken place */
4256 if (nr != NULL) {
4257 struct pf_state_key *skt = s->key[PF_SK_WIRE];
4258 if (pd->dir == PF_OUT)
4259 skt = s->key[PF_SK_STACK];
4260 PF_ACPY(pd->src, &skt->addr[pd->sidx], pd->af);
4261 PF_ACPY(pd->dst, &skt->addr[pd->didx], pd->af);
4262 if (pd->sport)
4263 *pd->sport = skt->port[pd->sidx];
4264 if (pd->dport)
4265 *pd->dport = skt->port[pd->didx];
4266 if (pd->proto_sum)
4267 *pd->proto_sum = bproto_sum;
4268 if (pd->ip_sum)
4269 *pd->ip_sum = bip_sum;
4270 m_copyback(m, off, hdrlen, pd->hdr.any);
4271 }
4272 s->src.seqhi = htonl(arc4random());
4273 /* Find mss option */
4274 int rtid = M_GETFIB(m);
4275 mss = pf_get_mss(m, off, th->th_off, pd->af);
4276 mss = pf_calc_mss(pd->src, pd->af, rtid, mss);
4277 mss = pf_calc_mss(pd->dst, pd->af, rtid, mss);
4278 s->src.mss = mss;
4279 pf_send_tcp(r, pd->af, pd->dst, pd->src, th->th_dport,
4280 th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1,
4281 TH_SYN|TH_ACK, 0, s->src.mss, 0, 1, 0);
4282 REASON_SET(&reason, PFRES_SYNPROXY);
4283 return (PF_SYNPROXY_DROP);
4284 }
4285
4286 return (PF_PASS);
4287
4288 csfailed:
4289 if (sk != NULL)
4290 uma_zfree(V_pf_state_key_z, sk);
4291 if (nk != NULL)
4292 uma_zfree(V_pf_state_key_z, nk);
4293
4294 if (sn != NULL) {
4295 struct pf_srchash *sh;
4296
4297 sh = &V_pf_srchash[pf_hashsrc(&sn->addr, sn->af)];
4298 PF_HASHROW_LOCK(sh);
4299 if (--sn->states == 0 && sn->expire == 0) {
4300 pf_unlink_src_node(sn);
4301 uma_zfree(V_pf_sources_z, sn);
4302 counter_u64_add(
4303 V_pf_status.scounters[SCNT_SRC_NODE_REMOVALS], 1);
4304 }
4305 PF_HASHROW_UNLOCK(sh);
4306 }
4307
4308 if (nsn != sn && nsn != NULL) {
4309 struct pf_srchash *sh;
4310
4311 sh = &V_pf_srchash[pf_hashsrc(&nsn->addr, nsn->af)];
4312 PF_HASHROW_LOCK(sh);
4313 if (--nsn->states == 0 && nsn->expire == 0) {
4314 pf_unlink_src_node(nsn);
4315 uma_zfree(V_pf_sources_z, nsn);
4316 counter_u64_add(
4317 V_pf_status.scounters[SCNT_SRC_NODE_REMOVALS], 1);
4318 }
4319 PF_HASHROW_UNLOCK(sh);
4320 }
4321
4322 return (PF_DROP);
4323 }
4324
4325 static int
pf_test_fragment(struct pf_krule ** rm,int direction,struct pfi_kkif * kif,struct mbuf * m,void * h,struct pf_pdesc * pd,struct pf_krule ** am,struct pf_kruleset ** rsm)4326 pf_test_fragment(struct pf_krule **rm, int direction, struct pfi_kkif *kif,
4327 struct mbuf *m, void *h, struct pf_pdesc *pd, struct pf_krule **am,
4328 struct pf_kruleset **rsm)
4329 {
4330 struct pf_krule *r, *a = NULL;
4331 struct pf_kruleset *ruleset = NULL;
4332 sa_family_t af = pd->af;
4333 u_short reason;
4334 int tag = -1;
4335 int asd = 0;
4336 int match = 0;
4337 struct pf_kanchor_stackframe anchor_stack[PF_ANCHOR_STACKSIZE];
4338
4339 PF_RULES_RASSERT();
4340
4341 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
4342 while (r != NULL) {
4343 pf_counter_u64_add(&r->evaluations, 1);
4344 if (pfi_kkif_match(r->kif, kif) == r->ifnot)
4345 r = r->skip[PF_SKIP_IFP].ptr;
4346 else if (r->direction && r->direction != direction)
4347 r = r->skip[PF_SKIP_DIR].ptr;
4348 else if (r->af && r->af != af)
4349 r = r->skip[PF_SKIP_AF].ptr;
4350 else if (r->proto && r->proto != pd->proto)
4351 r = r->skip[PF_SKIP_PROTO].ptr;
4352 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af,
4353 r->src.neg, kif, M_GETFIB(m)))
4354 r = r->skip[PF_SKIP_SRC_ADDR].ptr;
4355 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af,
4356 r->dst.neg, NULL, M_GETFIB(m)))
4357 r = r->skip[PF_SKIP_DST_ADDR].ptr;
4358 else if (r->tos && !(r->tos == pd->tos))
4359 r = TAILQ_NEXT(r, entries);
4360 else if (r->os_fingerprint != PF_OSFP_ANY)
4361 r = TAILQ_NEXT(r, entries);
4362 else if (pd->proto == IPPROTO_UDP &&
4363 (r->src.port_op || r->dst.port_op))
4364 r = TAILQ_NEXT(r, entries);
4365 else if (pd->proto == IPPROTO_TCP &&
4366 (r->src.port_op || r->dst.port_op || r->flagset))
4367 r = TAILQ_NEXT(r, entries);
4368 else if ((pd->proto == IPPROTO_ICMP ||
4369 pd->proto == IPPROTO_ICMPV6) &&
4370 (r->type || r->code))
4371 r = TAILQ_NEXT(r, entries);
4372 else if (r->prio &&
4373 !pf_match_ieee8021q_pcp(r->prio, m))
4374 r = TAILQ_NEXT(r, entries);
4375 else if (r->prob && r->prob <=
4376 (arc4random() % (UINT_MAX - 1) + 1))
4377 r = TAILQ_NEXT(r, entries);
4378 else if (r->match_tag && !pf_match_tag(m, r, &tag,
4379 pd->pf_mtag ? pd->pf_mtag->tag : 0))
4380 r = TAILQ_NEXT(r, entries);
4381 else {
4382 if (r->anchor == NULL) {
4383 if (r->action == PF_MATCH) {
4384 pf_counter_u64_critical_enter();
4385 pf_counter_u64_add_protected(&r->packets[direction == PF_OUT], 1);
4386 pf_counter_u64_add_protected(&r->bytes[direction == PF_OUT], pd->tot_len);
4387 pf_counter_u64_critical_exit();
4388 pf_rule_to_actions(r, &pd->act);
4389 if (r->log)
4390 PFLOG_PACKET(kif, m, af,
4391 direction, PFRES_MATCH, r,
4392 a, ruleset, pd, 1);
4393 } else {
4394 match = 1;
4395 *rm = r;
4396 *am = a;
4397 *rsm = ruleset;
4398 }
4399 if ((*rm)->quick)
4400 break;
4401 r = TAILQ_NEXT(r, entries);
4402 } else
4403 pf_step_into_anchor(anchor_stack, &asd,
4404 &ruleset, PF_RULESET_FILTER, &r, &a,
4405 &match);
4406 }
4407 if (r == NULL && pf_step_out_of_anchor(anchor_stack, &asd,
4408 &ruleset, PF_RULESET_FILTER, &r, &a, &match))
4409 break;
4410 }
4411 r = *rm;
4412 a = *am;
4413 ruleset = *rsm;
4414
4415 REASON_SET(&reason, PFRES_MATCH);
4416
4417 /* apply actions for last matching pass/block rule */
4418 pf_rule_to_actions(r, &pd->act);
4419
4420 if (r->log)
4421 PFLOG_PACKET(kif, m, af, direction, reason, r, a, ruleset, pd,
4422 1);
4423
4424 if (r->action != PF_PASS)
4425 return (PF_DROP);
4426
4427 if (tag > 0 && pf_tag_packet(m, pd, tag)) {
4428 REASON_SET(&reason, PFRES_MEMORY);
4429 return (PF_DROP);
4430 }
4431
4432 return (PF_PASS);
4433 }
4434
4435 static int
pf_tcp_track_full(struct pf_kstate ** state,struct pfi_kkif * kif,struct mbuf * m,int off,struct pf_pdesc * pd,u_short * reason,int * copyback)4436 pf_tcp_track_full(struct pf_kstate **state, struct pfi_kkif *kif,
4437 struct mbuf *m, int off, struct pf_pdesc *pd, u_short *reason,
4438 int *copyback)
4439 {
4440 struct tcphdr *th = &pd->hdr.tcp;
4441 struct pf_state_peer *src, *dst;
4442 u_int16_t win = ntohs(th->th_win);
4443 u_int32_t ack, end, seq, orig_seq;
4444 u_int8_t sws, dws, psrc, pdst;
4445 int ackskew;
4446
4447 if (pd->dir == (*state)->direction) {
4448 src = &(*state)->src;
4449 dst = &(*state)->dst;
4450 psrc = PF_PEER_SRC;
4451 pdst = PF_PEER_DST;
4452 } else {
4453 src = &(*state)->dst;
4454 dst = &(*state)->src;
4455 psrc = PF_PEER_DST;
4456 pdst = PF_PEER_SRC;
4457 }
4458
4459 if (src->wscale && dst->wscale && !(th->th_flags & TH_SYN)) {
4460 sws = src->wscale & PF_WSCALE_MASK;
4461 dws = dst->wscale & PF_WSCALE_MASK;
4462 } else
4463 sws = dws = 0;
4464
4465 /*
4466 * Sequence tracking algorithm from Guido van Rooij's paper:
4467 * http://www.madison-gurkha.com/publications/tcp_filtering/
4468 * tcp_filtering.ps
4469 */
4470
4471 orig_seq = seq = ntohl(th->th_seq);
4472 if (src->seqlo == 0) {
4473 /* First packet from this end. Set its state */
4474
4475 if ((pd->flags & PFDESC_TCP_NORM || dst->scrub) &&
4476 src->scrub == NULL) {
4477 if (pf_normalize_tcp_init(m, off, pd, th, src, dst)) {
4478 REASON_SET(reason, PFRES_MEMORY);
4479 return (PF_DROP);
4480 }
4481 }
4482
4483 /* Deferred generation of sequence number modulator */
4484 if (dst->seqdiff && !src->seqdiff) {
4485 /* use random iss for the TCP server */
4486 while ((src->seqdiff = arc4random() - seq) == 0)
4487 ;
4488 ack = ntohl(th->th_ack) - dst->seqdiff;
4489 pf_change_proto_a(m, &th->th_seq, &th->th_sum, htonl(seq +
4490 src->seqdiff), 0);
4491 pf_change_proto_a(m, &th->th_ack, &th->th_sum, htonl(ack), 0);
4492 *copyback = 1;
4493 } else {
4494 ack = ntohl(th->th_ack);
4495 }
4496
4497 end = seq + pd->p_len;
4498 if (th->th_flags & TH_SYN) {
4499 end++;
4500 if (dst->wscale & PF_WSCALE_FLAG) {
4501 src->wscale = pf_get_wscale(m, off, th->th_off,
4502 pd->af);
4503 if (src->wscale & PF_WSCALE_FLAG) {
4504 /* Remove scale factor from initial
4505 * window */
4506 sws = src->wscale & PF_WSCALE_MASK;
4507 win = ((u_int32_t)win + (1 << sws) - 1)
4508 >> sws;
4509 dws = dst->wscale & PF_WSCALE_MASK;
4510 } else {
4511 /* fixup other window */
4512 dst->max_win <<= dst->wscale &
4513 PF_WSCALE_MASK;
4514 /* in case of a retrans SYN|ACK */
4515 dst->wscale = 0;
4516 }
4517 }
4518 }
4519 if (th->th_flags & TH_FIN)
4520 end++;
4521
4522 src->seqlo = seq;
4523 if (src->state < TCPS_SYN_SENT)
4524 pf_set_protostate(*state, psrc, TCPS_SYN_SENT);
4525
4526 /*
4527 * May need to slide the window (seqhi may have been set by
4528 * the crappy stack check or if we picked up the connection
4529 * after establishment)
4530 */
4531 if (src->seqhi == 1 ||
4532 SEQ_GEQ(end + MAX(1, dst->max_win << dws), src->seqhi))
4533 src->seqhi = end + MAX(1, dst->max_win << dws);
4534 if (win > src->max_win)
4535 src->max_win = win;
4536
4537 } else {
4538 ack = ntohl(th->th_ack) - dst->seqdiff;
4539 if (src->seqdiff) {
4540 /* Modulate sequence numbers */
4541 pf_change_proto_a(m, &th->th_seq, &th->th_sum, htonl(seq +
4542 src->seqdiff), 0);
4543 pf_change_proto_a(m, &th->th_ack, &th->th_sum, htonl(ack), 0);
4544 *copyback = 1;
4545 }
4546 end = seq + pd->p_len;
4547 if (th->th_flags & TH_SYN)
4548 end++;
4549 if (th->th_flags & TH_FIN)
4550 end++;
4551 }
4552
4553 if ((th->th_flags & TH_ACK) == 0) {
4554 /* Let it pass through the ack skew check */
4555 ack = dst->seqlo;
4556 } else if ((ack == 0 &&
4557 (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) ||
4558 /* broken tcp stacks do not set ack */
4559 (dst->state < TCPS_SYN_SENT)) {
4560 /*
4561 * Many stacks (ours included) will set the ACK number in an
4562 * FIN|ACK if the SYN times out -- no sequence to ACK.
4563 */
4564 ack = dst->seqlo;
4565 }
4566
4567 if (seq == end) {
4568 /* Ease sequencing restrictions on no data packets */
4569 seq = src->seqlo;
4570 end = seq;
4571 }
4572
4573 ackskew = dst->seqlo - ack;
4574
4575
4576 /*
4577 * Need to demodulate the sequence numbers in any TCP SACK options
4578 * (Selective ACK). We could optionally validate the SACK values
4579 * against the current ACK window, either forwards or backwards, but
4580 * I'm not confident that SACK has been implemented properly
4581 * everywhere. It wouldn't surprise me if several stacks accidentally
4582 * SACK too far backwards of previously ACKed data. There really aren't
4583 * any security implications of bad SACKing unless the target stack
4584 * doesn't validate the option length correctly. Someone trying to
4585 * spoof into a TCP connection won't bother blindly sending SACK
4586 * options anyway.
4587 */
4588 if (dst->seqdiff && (th->th_off << 2) > sizeof(struct tcphdr)) {
4589 if (pf_modulate_sack(m, off, pd, th, dst))
4590 *copyback = 1;
4591 }
4592
4593
4594 #define MAXACKWINDOW (0xffff + 1500) /* 1500 is an arbitrary fudge factor */
4595 if (SEQ_GEQ(src->seqhi, end) &&
4596 /* Last octet inside other's window space */
4597 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) &&
4598 /* Retrans: not more than one window back */
4599 (ackskew >= -MAXACKWINDOW) &&
4600 /* Acking not more than one reassembled fragment backwards */
4601 (ackskew <= (MAXACKWINDOW << sws)) &&
4602 /* Acking not more than one window forward */
4603 ((th->th_flags & TH_RST) == 0 || orig_seq == src->seqlo ||
4604 (orig_seq == src->seqlo + 1) || (orig_seq + 1 == src->seqlo))) {
4605 /* Require an exact/+1 sequence match on resets when possible */
4606
4607 if (dst->scrub || src->scrub) {
4608 if (pf_normalize_tcp_stateful(m, off, pd, reason, th,
4609 *state, src, dst, copyback))
4610 return (PF_DROP);
4611 }
4612
4613 /* update max window */
4614 if (src->max_win < win)
4615 src->max_win = win;
4616 /* synchronize sequencing */
4617 if (SEQ_GT(end, src->seqlo))
4618 src->seqlo = end;
4619 /* slide the window of what the other end can send */
4620 if (SEQ_GEQ(ack + (win << sws), dst->seqhi))
4621 dst->seqhi = ack + MAX((win << sws), 1);
4622
4623
4624 /* update states */
4625 if (th->th_flags & TH_SYN)
4626 if (src->state < TCPS_SYN_SENT)
4627 pf_set_protostate(*state, psrc, TCPS_SYN_SENT);
4628 if (th->th_flags & TH_FIN)
4629 if (src->state < TCPS_CLOSING)
4630 pf_set_protostate(*state, psrc, TCPS_CLOSING);
4631 if (th->th_flags & TH_ACK) {
4632 if (dst->state == TCPS_SYN_SENT) {
4633 pf_set_protostate(*state, pdst,
4634 TCPS_ESTABLISHED);
4635 if (src->state == TCPS_ESTABLISHED &&
4636 (*state)->src_node != NULL &&
4637 pf_src_connlimit(state)) {
4638 REASON_SET(reason, PFRES_SRCLIMIT);
4639 return (PF_DROP);
4640 }
4641 } else if (dst->state == TCPS_CLOSING)
4642 pf_set_protostate(*state, pdst,
4643 TCPS_FIN_WAIT_2);
4644 }
4645 if (th->th_flags & TH_RST)
4646 pf_set_protostate(*state, PF_PEER_BOTH, TCPS_TIME_WAIT);
4647
4648 /* update expire time */
4649 (*state)->expire = time_uptime;
4650 if (src->state >= TCPS_FIN_WAIT_2 &&
4651 dst->state >= TCPS_FIN_WAIT_2)
4652 (*state)->timeout = PFTM_TCP_CLOSED;
4653 else if (src->state >= TCPS_CLOSING &&
4654 dst->state >= TCPS_CLOSING)
4655 (*state)->timeout = PFTM_TCP_FIN_WAIT;
4656 else if (src->state < TCPS_ESTABLISHED ||
4657 dst->state < TCPS_ESTABLISHED)
4658 (*state)->timeout = PFTM_TCP_OPENING;
4659 else if (src->state >= TCPS_CLOSING ||
4660 dst->state >= TCPS_CLOSING)
4661 (*state)->timeout = PFTM_TCP_CLOSING;
4662 else
4663 (*state)->timeout = PFTM_TCP_ESTABLISHED;
4664
4665 /* Fall through to PASS packet */
4666
4667 } else if ((dst->state < TCPS_SYN_SENT ||
4668 dst->state >= TCPS_FIN_WAIT_2 ||
4669 src->state >= TCPS_FIN_WAIT_2) &&
4670 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) &&
4671 /* Within a window forward of the originating packet */
4672 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW)) {
4673 /* Within a window backward of the originating packet */
4674
4675 /*
4676 * This currently handles three situations:
4677 * 1) Stupid stacks will shotgun SYNs before their peer
4678 * replies.
4679 * 2) When PF catches an already established stream (the
4680 * firewall rebooted, the state table was flushed, routes
4681 * changed...)
4682 * 3) Packets get funky immediately after the connection
4683 * closes (this should catch Solaris spurious ACK|FINs
4684 * that web servers like to spew after a close)
4685 *
4686 * This must be a little more careful than the above code
4687 * since packet floods will also be caught here. We don't
4688 * update the TTL here to mitigate the damage of a packet
4689 * flood and so the same code can handle awkward establishment
4690 * and a loosened connection close.
4691 * In the establishment case, a correct peer response will
4692 * validate the connection, go through the normal state code
4693 * and keep updating the state TTL.
4694 */
4695
4696 if (V_pf_status.debug >= PF_DEBUG_MISC) {
4697 printf("pf: loose state match: ");
4698 pf_print_state(*state);
4699 pf_print_flags(th->th_flags);
4700 printf(" seq=%u (%u) ack=%u len=%u ackskew=%d "
4701 "pkts=%llu:%llu dir=%s,%s\n", seq, orig_seq, ack,
4702 pd->p_len, ackskew, (unsigned long long)(*state)->packets[0],
4703 (unsigned long long)(*state)->packets[1],
4704 pd->dir == PF_IN ? "in" : "out",
4705 pd->dir == (*state)->direction ? "fwd" : "rev");
4706 }
4707
4708 if (dst->scrub || src->scrub) {
4709 if (pf_normalize_tcp_stateful(m, off, pd, reason, th,
4710 *state, src, dst, copyback))
4711 return (PF_DROP);
4712 }
4713
4714 /* update max window */
4715 if (src->max_win < win)
4716 src->max_win = win;
4717 /* synchronize sequencing */
4718 if (SEQ_GT(end, src->seqlo))
4719 src->seqlo = end;
4720 /* slide the window of what the other end can send */
4721 if (SEQ_GEQ(ack + (win << sws), dst->seqhi))
4722 dst->seqhi = ack + MAX((win << sws), 1);
4723
4724 /*
4725 * Cannot set dst->seqhi here since this could be a shotgunned
4726 * SYN and not an already established connection.
4727 */
4728
4729 if (th->th_flags & TH_FIN)
4730 if (src->state < TCPS_CLOSING)
4731 pf_set_protostate(*state, psrc, TCPS_CLOSING);
4732 if (th->th_flags & TH_RST)
4733 pf_set_protostate(*state, PF_PEER_BOTH, TCPS_TIME_WAIT);
4734
4735 /* Fall through to PASS packet */
4736
4737 } else {
4738 if ((*state)->dst.state == TCPS_SYN_SENT &&
4739 (*state)->src.state == TCPS_SYN_SENT) {
4740 /* Send RST for state mismatches during handshake */
4741 if (!(th->th_flags & TH_RST))
4742 pf_send_tcp((*state)->rule.ptr, pd->af,
4743 pd->dst, pd->src, th->th_dport,
4744 th->th_sport, ntohl(th->th_ack), 0,
4745 TH_RST, 0, 0,
4746 (*state)->rule.ptr->return_ttl, 1, 0);
4747 src->seqlo = 0;
4748 src->seqhi = 1;
4749 src->max_win = 1;
4750 } else if (V_pf_status.debug >= PF_DEBUG_MISC) {
4751 printf("pf: BAD state: ");
4752 pf_print_state(*state);
4753 pf_print_flags(th->th_flags);
4754 printf(" seq=%u (%u) ack=%u len=%u ackskew=%d "
4755 "pkts=%llu:%llu dir=%s,%s\n",
4756 seq, orig_seq, ack, pd->p_len, ackskew,
4757 (unsigned long long)(*state)->packets[0],
4758 (unsigned long long)(*state)->packets[1],
4759 pd->dir == PF_IN ? "in" : "out",
4760 pd->dir == (*state)->direction ? "fwd" : "rev");
4761 printf("pf: State failure on: %c %c %c %c | %c %c\n",
4762 SEQ_GEQ(src->seqhi, end) ? ' ' : '1',
4763 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) ?
4764 ' ': '2',
4765 (ackskew >= -MAXACKWINDOW) ? ' ' : '3',
4766 (ackskew <= (MAXACKWINDOW << sws)) ? ' ' : '4',
4767 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) ?' ' :'5',
4768 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW) ?' ' :'6');
4769 }
4770 REASON_SET(reason, PFRES_BADSTATE);
4771 return (PF_DROP);
4772 }
4773
4774 return (PF_PASS);
4775 }
4776
4777 static int
pf_tcp_track_sloppy(struct pf_kstate ** state,struct pf_pdesc * pd,u_short * reason)4778 pf_tcp_track_sloppy(struct pf_kstate **state, struct pf_pdesc *pd, u_short *reason)
4779 {
4780 struct tcphdr *th = &pd->hdr.tcp;
4781 struct pf_state_peer *src, *dst;
4782 u_int8_t psrc, pdst;
4783
4784 if (pd->dir == (*state)->direction) {
4785 src = &(*state)->src;
4786 dst = &(*state)->dst;
4787 psrc = PF_PEER_SRC;
4788 pdst = PF_PEER_DST;
4789 } else {
4790 src = &(*state)->dst;
4791 dst = &(*state)->src;
4792 psrc = PF_PEER_DST;
4793 pdst = PF_PEER_SRC;
4794 }
4795
4796 if (th->th_flags & TH_SYN)
4797 if (src->state < TCPS_SYN_SENT)
4798 pf_set_protostate(*state, psrc, TCPS_SYN_SENT);
4799 if (th->th_flags & TH_FIN)
4800 if (src->state < TCPS_CLOSING)
4801 pf_set_protostate(*state, psrc, TCPS_CLOSING);
4802 if (th->th_flags & TH_ACK) {
4803 if (dst->state == TCPS_SYN_SENT) {
4804 pf_set_protostate(*state, pdst, TCPS_ESTABLISHED);
4805 if (src->state == TCPS_ESTABLISHED &&
4806 (*state)->src_node != NULL &&
4807 pf_src_connlimit(state)) {
4808 REASON_SET(reason, PFRES_SRCLIMIT);
4809 return (PF_DROP);
4810 }
4811 } else if (dst->state == TCPS_CLOSING) {
4812 pf_set_protostate(*state, pdst, TCPS_FIN_WAIT_2);
4813 } else if (src->state == TCPS_SYN_SENT &&
4814 dst->state < TCPS_SYN_SENT) {
4815 /*
4816 * Handle a special sloppy case where we only see one
4817 * half of the connection. If there is a ACK after
4818 * the initial SYN without ever seeing a packet from
4819 * the destination, set the connection to established.
4820 */
4821 pf_set_protostate(*state, PF_PEER_BOTH,
4822 TCPS_ESTABLISHED);
4823 dst->state = src->state = TCPS_ESTABLISHED;
4824 if ((*state)->src_node != NULL &&
4825 pf_src_connlimit(state)) {
4826 REASON_SET(reason, PFRES_SRCLIMIT);
4827 return (PF_DROP);
4828 }
4829 } else if (src->state == TCPS_CLOSING &&
4830 dst->state == TCPS_ESTABLISHED &&
4831 dst->seqlo == 0) {
4832 /*
4833 * Handle the closing of half connections where we
4834 * don't see the full bidirectional FIN/ACK+ACK
4835 * handshake.
4836 */
4837 pf_set_protostate(*state, pdst, TCPS_CLOSING);
4838 }
4839 }
4840 if (th->th_flags & TH_RST)
4841 pf_set_protostate(*state, PF_PEER_BOTH, TCPS_TIME_WAIT);
4842
4843 /* update expire time */
4844 (*state)->expire = time_uptime;
4845 if (src->state >= TCPS_FIN_WAIT_2 &&
4846 dst->state >= TCPS_FIN_WAIT_2)
4847 (*state)->timeout = PFTM_TCP_CLOSED;
4848 else if (src->state >= TCPS_CLOSING &&
4849 dst->state >= TCPS_CLOSING)
4850 (*state)->timeout = PFTM_TCP_FIN_WAIT;
4851 else if (src->state < TCPS_ESTABLISHED ||
4852 dst->state < TCPS_ESTABLISHED)
4853 (*state)->timeout = PFTM_TCP_OPENING;
4854 else if (src->state >= TCPS_CLOSING ||
4855 dst->state >= TCPS_CLOSING)
4856 (*state)->timeout = PFTM_TCP_CLOSING;
4857 else
4858 (*state)->timeout = PFTM_TCP_ESTABLISHED;
4859
4860 return (PF_PASS);
4861 }
4862
4863 static int
pf_synproxy(struct pf_pdesc * pd,struct pf_kstate ** state,u_short * reason)4864 pf_synproxy(struct pf_pdesc *pd, struct pf_kstate **state, u_short *reason)
4865 {
4866 struct pf_state_key *sk = (*state)->key[pd->didx];
4867 struct tcphdr *th = &pd->hdr.tcp;
4868
4869 if ((*state)->src.state == PF_TCPS_PROXY_SRC) {
4870 if (pd->dir != (*state)->direction) {
4871 REASON_SET(reason, PFRES_SYNPROXY);
4872 return (PF_SYNPROXY_DROP);
4873 }
4874 if (th->th_flags & TH_SYN) {
4875 if (ntohl(th->th_seq) != (*state)->src.seqlo) {
4876 REASON_SET(reason, PFRES_SYNPROXY);
4877 return (PF_DROP);
4878 }
4879 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst,
4880 pd->src, th->th_dport, th->th_sport,
4881 (*state)->src.seqhi, ntohl(th->th_seq) + 1,
4882 TH_SYN|TH_ACK, 0, (*state)->src.mss, 0, 1, 0);
4883 REASON_SET(reason, PFRES_SYNPROXY);
4884 return (PF_SYNPROXY_DROP);
4885 } else if ((th->th_flags & (TH_ACK|TH_RST|TH_FIN)) != TH_ACK ||
4886 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) ||
4887 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) {
4888 REASON_SET(reason, PFRES_SYNPROXY);
4889 return (PF_DROP);
4890 } else if ((*state)->src_node != NULL &&
4891 pf_src_connlimit(state)) {
4892 REASON_SET(reason, PFRES_SRCLIMIT);
4893 return (PF_DROP);
4894 } else
4895 pf_set_protostate(*state, PF_PEER_SRC,
4896 PF_TCPS_PROXY_DST);
4897 }
4898 if ((*state)->src.state == PF_TCPS_PROXY_DST) {
4899 if (pd->dir == (*state)->direction) {
4900 if (((th->th_flags & (TH_SYN|TH_ACK)) != TH_ACK) ||
4901 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) ||
4902 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) {
4903 REASON_SET(reason, PFRES_SYNPROXY);
4904 return (PF_DROP);
4905 }
4906 (*state)->src.max_win = MAX(ntohs(th->th_win), 1);
4907 if ((*state)->dst.seqhi == 1)
4908 (*state)->dst.seqhi = htonl(arc4random());
4909 pf_send_tcp((*state)->rule.ptr, pd->af,
4910 &sk->addr[pd->sidx], &sk->addr[pd->didx],
4911 sk->port[pd->sidx], sk->port[pd->didx],
4912 (*state)->dst.seqhi, 0, TH_SYN, 0,
4913 (*state)->src.mss, 0, 0, (*state)->tag);
4914 REASON_SET(reason, PFRES_SYNPROXY);
4915 return (PF_SYNPROXY_DROP);
4916 } else if (((th->th_flags & (TH_SYN|TH_ACK)) !=
4917 (TH_SYN|TH_ACK)) ||
4918 (ntohl(th->th_ack) != (*state)->dst.seqhi + 1)) {
4919 REASON_SET(reason, PFRES_SYNPROXY);
4920 return (PF_DROP);
4921 } else {
4922 (*state)->dst.max_win = MAX(ntohs(th->th_win), 1);
4923 (*state)->dst.seqlo = ntohl(th->th_seq);
4924 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst,
4925 pd->src, th->th_dport, th->th_sport,
4926 ntohl(th->th_ack), ntohl(th->th_seq) + 1,
4927 TH_ACK, (*state)->src.max_win, 0, 0, 0,
4928 (*state)->tag);
4929 pf_send_tcp((*state)->rule.ptr, pd->af,
4930 &sk->addr[pd->sidx], &sk->addr[pd->didx],
4931 sk->port[pd->sidx], sk->port[pd->didx],
4932 (*state)->src.seqhi + 1, (*state)->src.seqlo + 1,
4933 TH_ACK, (*state)->dst.max_win, 0, 0, 1, 0);
4934 (*state)->src.seqdiff = (*state)->dst.seqhi -
4935 (*state)->src.seqlo;
4936 (*state)->dst.seqdiff = (*state)->src.seqhi -
4937 (*state)->dst.seqlo;
4938 (*state)->src.seqhi = (*state)->src.seqlo +
4939 (*state)->dst.max_win;
4940 (*state)->dst.seqhi = (*state)->dst.seqlo +
4941 (*state)->src.max_win;
4942 (*state)->src.wscale = (*state)->dst.wscale = 0;
4943 pf_set_protostate(*state, PF_PEER_BOTH,
4944 TCPS_ESTABLISHED);
4945 REASON_SET(reason, PFRES_SYNPROXY);
4946 return (PF_SYNPROXY_DROP);
4947 }
4948 }
4949
4950 return (PF_PASS);
4951 }
4952
4953 static int
pf_test_state_tcp(struct pf_kstate ** state,int direction,struct pfi_kkif * kif,struct mbuf * m,int off,void * h,struct pf_pdesc * pd,u_short * reason)4954 pf_test_state_tcp(struct pf_kstate **state, int direction, struct pfi_kkif *kif,
4955 struct mbuf *m, int off, void *h, struct pf_pdesc *pd,
4956 u_short *reason)
4957 {
4958 struct pf_state_key_cmp key;
4959 struct tcphdr *th = &pd->hdr.tcp;
4960 int copyback = 0;
4961 int action;
4962 struct pf_state_peer *src, *dst;
4963
4964 bzero(&key, sizeof(key));
4965 key.af = pd->af;
4966 key.proto = IPPROTO_TCP;
4967 if (direction == PF_IN) { /* wire side, straight */
4968 PF_ACPY(&key.addr[0], pd->src, key.af);
4969 PF_ACPY(&key.addr[1], pd->dst, key.af);
4970 key.port[0] = th->th_sport;
4971 key.port[1] = th->th_dport;
4972 } else { /* stack side, reverse */
4973 PF_ACPY(&key.addr[1], pd->src, key.af);
4974 PF_ACPY(&key.addr[0], pd->dst, key.af);
4975 key.port[1] = th->th_sport;
4976 key.port[0] = th->th_dport;
4977 }
4978
4979 STATE_LOOKUP(kif, &key, direction, *state, pd);
4980
4981 if (direction == (*state)->direction) {
4982 src = &(*state)->src;
4983 dst = &(*state)->dst;
4984 } else {
4985 src = &(*state)->dst;
4986 dst = &(*state)->src;
4987 }
4988
4989 if ((action = pf_synproxy(pd, state, reason)) != PF_PASS)
4990 return (action);
4991
4992 if (dst->state >= TCPS_FIN_WAIT_2 &&
4993 src->state >= TCPS_FIN_WAIT_2 &&
4994 (((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN) ||
4995 ((th->th_flags & (TH_SYN|TH_ACK|TH_RST)) == TH_ACK &&
4996 pf_syncookie_check(pd) && pd->dir == PF_IN))) {
4997 if (V_pf_status.debug >= PF_DEBUG_MISC) {
4998 printf("pf: state reuse ");
4999 pf_print_state(*state);
5000 pf_print_flags(th->th_flags);
5001 printf("\n");
5002 }
5003 /* XXX make sure it's the same direction ?? */
5004 pf_set_protostate(*state, PF_PEER_BOTH, TCPS_CLOSED);
5005 pf_unlink_state(*state, PF_ENTER_LOCKED);
5006 *state = NULL;
5007 return (PF_DROP);
5008 }
5009
5010 if ((*state)->state_flags & PFSTATE_SLOPPY) {
5011 if (pf_tcp_track_sloppy(state, pd, reason) == PF_DROP)
5012 return (PF_DROP);
5013 } else {
5014 if (pf_tcp_track_full(state, kif, m, off, pd, reason,
5015 ©back) == PF_DROP)
5016 return (PF_DROP);
5017 }
5018
5019 /* translate source/destination address, if necessary */
5020 if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) {
5021 struct pf_state_key *nk = (*state)->key[pd->didx];
5022
5023 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af) ||
5024 nk->port[pd->sidx] != th->th_sport)
5025 pf_change_ap(m, pd->src, &th->th_sport,
5026 pd->ip_sum, &th->th_sum, &nk->addr[pd->sidx],
5027 nk->port[pd->sidx], 0, pd->af);
5028
5029 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af) ||
5030 nk->port[pd->didx] != th->th_dport)
5031 pf_change_ap(m, pd->dst, &th->th_dport,
5032 pd->ip_sum, &th->th_sum, &nk->addr[pd->didx],
5033 nk->port[pd->didx], 0, pd->af);
5034 copyback = 1;
5035 }
5036
5037 /* Copyback sequence modulation or stateful scrub changes if needed */
5038 if (copyback)
5039 m_copyback(m, off, sizeof(*th), (caddr_t)th);
5040
5041 return (PF_PASS);
5042 }
5043
5044 static int
pf_test_state_udp(struct pf_kstate ** state,int direction,struct pfi_kkif * kif,struct mbuf * m,int off,void * h,struct pf_pdesc * pd)5045 pf_test_state_udp(struct pf_kstate **state, int direction, struct pfi_kkif *kif,
5046 struct mbuf *m, int off, void *h, struct pf_pdesc *pd)
5047 {
5048 struct pf_state_peer *src, *dst;
5049 struct pf_state_key_cmp key;
5050 struct udphdr *uh = &pd->hdr.udp;
5051 uint8_t psrc, pdst;
5052
5053 bzero(&key, sizeof(key));
5054 key.af = pd->af;
5055 key.proto = IPPROTO_UDP;
5056 if (direction == PF_IN) { /* wire side, straight */
5057 PF_ACPY(&key.addr[0], pd->src, key.af);
5058 PF_ACPY(&key.addr[1], pd->dst, key.af);
5059 key.port[0] = uh->uh_sport;
5060 key.port[1] = uh->uh_dport;
5061 } else { /* stack side, reverse */
5062 PF_ACPY(&key.addr[1], pd->src, key.af);
5063 PF_ACPY(&key.addr[0], pd->dst, key.af);
5064 key.port[1] = uh->uh_sport;
5065 key.port[0] = uh->uh_dport;
5066 }
5067
5068 STATE_LOOKUP(kif, &key, direction, *state, pd);
5069
5070 if (direction == (*state)->direction) {
5071 src = &(*state)->src;
5072 dst = &(*state)->dst;
5073 psrc = PF_PEER_SRC;
5074 pdst = PF_PEER_DST;
5075 } else {
5076 src = &(*state)->dst;
5077 dst = &(*state)->src;
5078 psrc = PF_PEER_DST;
5079 pdst = PF_PEER_SRC;
5080 }
5081
5082 /* update states */
5083 if (src->state < PFUDPS_SINGLE)
5084 pf_set_protostate(*state, psrc, PFUDPS_SINGLE);
5085 if (dst->state == PFUDPS_SINGLE)
5086 pf_set_protostate(*state, pdst, PFUDPS_MULTIPLE);
5087
5088 /* update expire time */
5089 (*state)->expire = time_uptime;
5090 if (src->state == PFUDPS_MULTIPLE && dst->state == PFUDPS_MULTIPLE)
5091 (*state)->timeout = PFTM_UDP_MULTIPLE;
5092 else
5093 (*state)->timeout = PFTM_UDP_SINGLE;
5094
5095 /* translate source/destination address, if necessary */
5096 if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) {
5097 struct pf_state_key *nk = (*state)->key[pd->didx];
5098
5099 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af) ||
5100 nk->port[pd->sidx] != uh->uh_sport)
5101 pf_change_ap(m, pd->src, &uh->uh_sport, pd->ip_sum,
5102 &uh->uh_sum, &nk->addr[pd->sidx],
5103 nk->port[pd->sidx], 1, pd->af);
5104
5105 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af) ||
5106 nk->port[pd->didx] != uh->uh_dport)
5107 pf_change_ap(m, pd->dst, &uh->uh_dport, pd->ip_sum,
5108 &uh->uh_sum, &nk->addr[pd->didx],
5109 nk->port[pd->didx], 1, pd->af);
5110 m_copyback(m, off, sizeof(*uh), (caddr_t)uh);
5111 }
5112
5113 return (PF_PASS);
5114 }
5115
5116 static int
pf_test_state_icmp(struct pf_kstate ** state,int direction,struct pfi_kkif * kif,struct mbuf * m,int off,void * h,struct pf_pdesc * pd,u_short * reason)5117 pf_test_state_icmp(struct pf_kstate **state, int direction, struct pfi_kkif *kif,
5118 struct mbuf *m, int off, void *h, struct pf_pdesc *pd, u_short *reason)
5119 {
5120 struct pf_addr *saddr = pd->src, *daddr = pd->dst;
5121 u_int16_t icmpid = 0, *icmpsum;
5122 u_int8_t icmptype, icmpcode;
5123 int state_icmp = 0;
5124 struct pf_state_key_cmp key;
5125
5126 bzero(&key, sizeof(key));
5127 switch (pd->proto) {
5128 #ifdef INET
5129 case IPPROTO_ICMP:
5130 icmptype = pd->hdr.icmp.icmp_type;
5131 icmpcode = pd->hdr.icmp.icmp_code;
5132 icmpid = pd->hdr.icmp.icmp_id;
5133 icmpsum = &pd->hdr.icmp.icmp_cksum;
5134
5135 if (icmptype == ICMP_UNREACH ||
5136 icmptype == ICMP_SOURCEQUENCH ||
5137 icmptype == ICMP_REDIRECT ||
5138 icmptype == ICMP_TIMXCEED ||
5139 icmptype == ICMP_PARAMPROB)
5140 state_icmp++;
5141 break;
5142 #endif /* INET */
5143 #ifdef INET6
5144 case IPPROTO_ICMPV6:
5145 icmptype = pd->hdr.icmp6.icmp6_type;
5146 icmpcode = pd->hdr.icmp6.icmp6_code;
5147 icmpid = pd->hdr.icmp6.icmp6_id;
5148 icmpsum = &pd->hdr.icmp6.icmp6_cksum;
5149
5150 if (icmptype == ICMP6_DST_UNREACH ||
5151 icmptype == ICMP6_PACKET_TOO_BIG ||
5152 icmptype == ICMP6_TIME_EXCEEDED ||
5153 icmptype == ICMP6_PARAM_PROB)
5154 state_icmp++;
5155 break;
5156 #endif /* INET6 */
5157 }
5158
5159 if (!state_icmp) {
5160
5161 /*
5162 * ICMP query/reply message not related to a TCP/UDP packet.
5163 * Search for an ICMP state.
5164 */
5165 key.af = pd->af;
5166 key.proto = pd->proto;
5167 key.port[0] = key.port[1] = icmpid;
5168 if (direction == PF_IN) { /* wire side, straight */
5169 PF_ACPY(&key.addr[0], pd->src, key.af);
5170 PF_ACPY(&key.addr[1], pd->dst, key.af);
5171 } else { /* stack side, reverse */
5172 PF_ACPY(&key.addr[1], pd->src, key.af);
5173 PF_ACPY(&key.addr[0], pd->dst, key.af);
5174 }
5175
5176 STATE_LOOKUP(kif, &key, direction, *state, pd);
5177
5178 (*state)->expire = time_uptime;
5179 (*state)->timeout = PFTM_ICMP_ERROR_REPLY;
5180
5181 /* translate source/destination address, if necessary */
5182 if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) {
5183 struct pf_state_key *nk = (*state)->key[pd->didx];
5184
5185 switch (pd->af) {
5186 #ifdef INET
5187 case AF_INET:
5188 if (PF_ANEQ(pd->src,
5189 &nk->addr[pd->sidx], AF_INET))
5190 pf_change_a(&saddr->v4.s_addr,
5191 pd->ip_sum,
5192 nk->addr[pd->sidx].v4.s_addr, 0);
5193
5194 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx],
5195 AF_INET))
5196 pf_change_a(&daddr->v4.s_addr,
5197 pd->ip_sum,
5198 nk->addr[pd->didx].v4.s_addr, 0);
5199
5200 if (nk->port[0] !=
5201 pd->hdr.icmp.icmp_id) {
5202 pd->hdr.icmp.icmp_cksum =
5203 pf_cksum_fixup(
5204 pd->hdr.icmp.icmp_cksum, icmpid,
5205 nk->port[pd->sidx], 0);
5206 pd->hdr.icmp.icmp_id =
5207 nk->port[pd->sidx];
5208 }
5209
5210 m_copyback(m, off, ICMP_MINLEN,
5211 (caddr_t )&pd->hdr.icmp);
5212 break;
5213 #endif /* INET */
5214 #ifdef INET6
5215 case AF_INET6:
5216 if (PF_ANEQ(pd->src,
5217 &nk->addr[pd->sidx], AF_INET6))
5218 pf_change_a6(saddr,
5219 &pd->hdr.icmp6.icmp6_cksum,
5220 &nk->addr[pd->sidx], 0);
5221
5222 if (PF_ANEQ(pd->dst,
5223 &nk->addr[pd->didx], AF_INET6))
5224 pf_change_a6(daddr,
5225 &pd->hdr.icmp6.icmp6_cksum,
5226 &nk->addr[pd->didx], 0);
5227
5228 m_copyback(m, off, sizeof(struct icmp6_hdr),
5229 (caddr_t )&pd->hdr.icmp6);
5230 break;
5231 #endif /* INET6 */
5232 }
5233 }
5234 return (PF_PASS);
5235
5236 } else {
5237 /*
5238 * ICMP error message in response to a TCP/UDP packet.
5239 * Extract the inner TCP/UDP header and search for that state.
5240 */
5241
5242 struct pf_pdesc pd2;
5243 bzero(&pd2, sizeof pd2);
5244 #ifdef INET
5245 struct ip h2;
5246 #endif /* INET */
5247 #ifdef INET6
5248 struct ip6_hdr h2_6;
5249 int terminal = 0;
5250 #endif /* INET6 */
5251 int ipoff2 = 0;
5252 int off2 = 0;
5253
5254 pd2.af = pd->af;
5255 /* Payload packet is from the opposite direction. */
5256 pd2.sidx = (direction == PF_IN) ? 1 : 0;
5257 pd2.didx = (direction == PF_IN) ? 0 : 1;
5258 switch (pd->af) {
5259 #ifdef INET
5260 case AF_INET:
5261 /* offset of h2 in mbuf chain */
5262 ipoff2 = off + ICMP_MINLEN;
5263
5264 if (!pf_pull_hdr(m, ipoff2, &h2, sizeof(h2),
5265 NULL, reason, pd2.af)) {
5266 DPFPRINTF(PF_DEBUG_MISC,
5267 ("pf: ICMP error message too short "
5268 "(ip)\n"));
5269 return (PF_DROP);
5270 }
5271 /*
5272 * ICMP error messages don't refer to non-first
5273 * fragments
5274 */
5275 if (h2.ip_off & htons(IP_OFFMASK)) {
5276 REASON_SET(reason, PFRES_FRAG);
5277 return (PF_DROP);
5278 }
5279
5280 /* offset of protocol header that follows h2 */
5281 off2 = ipoff2 + (h2.ip_hl << 2);
5282
5283 pd2.proto = h2.ip_p;
5284 pd2.src = (struct pf_addr *)&h2.ip_src;
5285 pd2.dst = (struct pf_addr *)&h2.ip_dst;
5286 pd2.ip_sum = &h2.ip_sum;
5287 break;
5288 #endif /* INET */
5289 #ifdef INET6
5290 case AF_INET6:
5291 ipoff2 = off + sizeof(struct icmp6_hdr);
5292
5293 if (!pf_pull_hdr(m, ipoff2, &h2_6, sizeof(h2_6),
5294 NULL, reason, pd2.af)) {
5295 DPFPRINTF(PF_DEBUG_MISC,
5296 ("pf: ICMP error message too short "
5297 "(ip6)\n"));
5298 return (PF_DROP);
5299 }
5300 pd2.proto = h2_6.ip6_nxt;
5301 pd2.src = (struct pf_addr *)&h2_6.ip6_src;
5302 pd2.dst = (struct pf_addr *)&h2_6.ip6_dst;
5303 pd2.ip_sum = NULL;
5304 off2 = ipoff2 + sizeof(h2_6);
5305 do {
5306 switch (pd2.proto) {
5307 case IPPROTO_FRAGMENT:
5308 /*
5309 * ICMPv6 error messages for
5310 * non-first fragments
5311 */
5312 REASON_SET(reason, PFRES_FRAG);
5313 return (PF_DROP);
5314 case IPPROTO_AH:
5315 case IPPROTO_HOPOPTS:
5316 case IPPROTO_ROUTING:
5317 case IPPROTO_DSTOPTS: {
5318 /* get next header and header length */
5319 struct ip6_ext opt6;
5320
5321 if (!pf_pull_hdr(m, off2, &opt6,
5322 sizeof(opt6), NULL, reason,
5323 pd2.af)) {
5324 DPFPRINTF(PF_DEBUG_MISC,
5325 ("pf: ICMPv6 short opt\n"));
5326 return (PF_DROP);
5327 }
5328 if (pd2.proto == IPPROTO_AH)
5329 off2 += (opt6.ip6e_len + 2) * 4;
5330 else
5331 off2 += (opt6.ip6e_len + 1) * 8;
5332 pd2.proto = opt6.ip6e_nxt;
5333 /* goto the next header */
5334 break;
5335 }
5336 default:
5337 terminal++;
5338 break;
5339 }
5340 } while (!terminal);
5341 break;
5342 #endif /* INET6 */
5343 }
5344
5345 if (PF_ANEQ(pd->dst, pd2.src, pd->af)) {
5346 if (V_pf_status.debug >= PF_DEBUG_MISC) {
5347 printf("pf: BAD ICMP %d:%d outer dst: ",
5348 icmptype, icmpcode);
5349 pf_print_host(pd->src, 0, pd->af);
5350 printf(" -> ");
5351 pf_print_host(pd->dst, 0, pd->af);
5352 printf(" inner src: ");
5353 pf_print_host(pd2.src, 0, pd2.af);
5354 printf(" -> ");
5355 pf_print_host(pd2.dst, 0, pd2.af);
5356 printf("\n");
5357 }
5358 REASON_SET(reason, PFRES_BADSTATE);
5359 return (PF_DROP);
5360 }
5361
5362 switch (pd2.proto) {
5363 case IPPROTO_TCP: {
5364 struct tcphdr th;
5365 u_int32_t seq;
5366 struct pf_state_peer *src, *dst;
5367 u_int8_t dws;
5368 int copyback = 0;
5369
5370 /*
5371 * Only the first 8 bytes of the TCP header can be
5372 * expected. Don't access any TCP header fields after
5373 * th_seq, an ackskew test is not possible.
5374 */
5375 if (!pf_pull_hdr(m, off2, &th, 8, NULL, reason,
5376 pd2.af)) {
5377 DPFPRINTF(PF_DEBUG_MISC,
5378 ("pf: ICMP error message too short "
5379 "(tcp)\n"));
5380 return (PF_DROP);
5381 }
5382
5383 key.af = pd2.af;
5384 key.proto = IPPROTO_TCP;
5385 PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af);
5386 PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af);
5387 key.port[pd2.sidx] = th.th_sport;
5388 key.port[pd2.didx] = th.th_dport;
5389
5390 STATE_LOOKUP(kif, &key, direction, *state, pd);
5391
5392 if (direction == (*state)->direction) {
5393 src = &(*state)->dst;
5394 dst = &(*state)->src;
5395 } else {
5396 src = &(*state)->src;
5397 dst = &(*state)->dst;
5398 }
5399
5400 if (src->wscale && dst->wscale)
5401 dws = dst->wscale & PF_WSCALE_MASK;
5402 else
5403 dws = 0;
5404
5405 /* Demodulate sequence number */
5406 seq = ntohl(th.th_seq) - src->seqdiff;
5407 if (src->seqdiff) {
5408 pf_change_a(&th.th_seq, icmpsum,
5409 htonl(seq), 0);
5410 copyback = 1;
5411 }
5412
5413 if (!((*state)->state_flags & PFSTATE_SLOPPY) &&
5414 (!SEQ_GEQ(src->seqhi, seq) ||
5415 !SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)))) {
5416 if (V_pf_status.debug >= PF_DEBUG_MISC) {
5417 printf("pf: BAD ICMP %d:%d ",
5418 icmptype, icmpcode);
5419 pf_print_host(pd->src, 0, pd->af);
5420 printf(" -> ");
5421 pf_print_host(pd->dst, 0, pd->af);
5422 printf(" state: ");
5423 pf_print_state(*state);
5424 printf(" seq=%u\n", seq);
5425 }
5426 REASON_SET(reason, PFRES_BADSTATE);
5427 return (PF_DROP);
5428 } else {
5429 if (V_pf_status.debug >= PF_DEBUG_MISC) {
5430 printf("pf: OK ICMP %d:%d ",
5431 icmptype, icmpcode);
5432 pf_print_host(pd->src, 0, pd->af);
5433 printf(" -> ");
5434 pf_print_host(pd->dst, 0, pd->af);
5435 printf(" state: ");
5436 pf_print_state(*state);
5437 printf(" seq=%u\n", seq);
5438 }
5439 }
5440
5441 /* translate source/destination address, if necessary */
5442 if ((*state)->key[PF_SK_WIRE] !=
5443 (*state)->key[PF_SK_STACK]) {
5444 struct pf_state_key *nk =
5445 (*state)->key[pd->didx];
5446
5447 if (PF_ANEQ(pd2.src,
5448 &nk->addr[pd2.sidx], pd2.af) ||
5449 nk->port[pd2.sidx] != th.th_sport)
5450 pf_change_icmp(pd2.src, &th.th_sport,
5451 daddr, &nk->addr[pd2.sidx],
5452 nk->port[pd2.sidx], NULL,
5453 pd2.ip_sum, icmpsum,
5454 pd->ip_sum, 0, pd2.af);
5455
5456 if (PF_ANEQ(pd2.dst,
5457 &nk->addr[pd2.didx], pd2.af) ||
5458 nk->port[pd2.didx] != th.th_dport)
5459 pf_change_icmp(pd2.dst, &th.th_dport,
5460 saddr, &nk->addr[pd2.didx],
5461 nk->port[pd2.didx], NULL,
5462 pd2.ip_sum, icmpsum,
5463 pd->ip_sum, 0, pd2.af);
5464 copyback = 1;
5465 }
5466
5467 if (copyback) {
5468 switch (pd2.af) {
5469 #ifdef INET
5470 case AF_INET:
5471 m_copyback(m, off, ICMP_MINLEN,
5472 (caddr_t )&pd->hdr.icmp);
5473 m_copyback(m, ipoff2, sizeof(h2),
5474 (caddr_t )&h2);
5475 break;
5476 #endif /* INET */
5477 #ifdef INET6
5478 case AF_INET6:
5479 m_copyback(m, off,
5480 sizeof(struct icmp6_hdr),
5481 (caddr_t )&pd->hdr.icmp6);
5482 m_copyback(m, ipoff2, sizeof(h2_6),
5483 (caddr_t )&h2_6);
5484 break;
5485 #endif /* INET6 */
5486 }
5487 m_copyback(m, off2, 8, (caddr_t)&th);
5488 }
5489
5490 return (PF_PASS);
5491 break;
5492 }
5493 case IPPROTO_UDP: {
5494 struct udphdr uh;
5495
5496 if (!pf_pull_hdr(m, off2, &uh, sizeof(uh),
5497 NULL, reason, pd2.af)) {
5498 DPFPRINTF(PF_DEBUG_MISC,
5499 ("pf: ICMP error message too short "
5500 "(udp)\n"));
5501 return (PF_DROP);
5502 }
5503
5504 key.af = pd2.af;
5505 key.proto = IPPROTO_UDP;
5506 PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af);
5507 PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af);
5508 key.port[pd2.sidx] = uh.uh_sport;
5509 key.port[pd2.didx] = uh.uh_dport;
5510
5511 STATE_LOOKUP(kif, &key, direction, *state, pd);
5512
5513 /* translate source/destination address, if necessary */
5514 if ((*state)->key[PF_SK_WIRE] !=
5515 (*state)->key[PF_SK_STACK]) {
5516 struct pf_state_key *nk =
5517 (*state)->key[pd->didx];
5518
5519 if (PF_ANEQ(pd2.src,
5520 &nk->addr[pd2.sidx], pd2.af) ||
5521 nk->port[pd2.sidx] != uh.uh_sport)
5522 pf_change_icmp(pd2.src, &uh.uh_sport,
5523 daddr, &nk->addr[pd2.sidx],
5524 nk->port[pd2.sidx], &uh.uh_sum,
5525 pd2.ip_sum, icmpsum,
5526 pd->ip_sum, 1, pd2.af);
5527
5528 if (PF_ANEQ(pd2.dst,
5529 &nk->addr[pd2.didx], pd2.af) ||
5530 nk->port[pd2.didx] != uh.uh_dport)
5531 pf_change_icmp(pd2.dst, &uh.uh_dport,
5532 saddr, &nk->addr[pd2.didx],
5533 nk->port[pd2.didx], &uh.uh_sum,
5534 pd2.ip_sum, icmpsum,
5535 pd->ip_sum, 1, pd2.af);
5536
5537 switch (pd2.af) {
5538 #ifdef INET
5539 case AF_INET:
5540 m_copyback(m, off, ICMP_MINLEN,
5541 (caddr_t )&pd->hdr.icmp);
5542 m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2);
5543 break;
5544 #endif /* INET */
5545 #ifdef INET6
5546 case AF_INET6:
5547 m_copyback(m, off,
5548 sizeof(struct icmp6_hdr),
5549 (caddr_t )&pd->hdr.icmp6);
5550 m_copyback(m, ipoff2, sizeof(h2_6),
5551 (caddr_t )&h2_6);
5552 break;
5553 #endif /* INET6 */
5554 }
5555 m_copyback(m, off2, sizeof(uh), (caddr_t)&uh);
5556 }
5557 return (PF_PASS);
5558 break;
5559 }
5560 #ifdef INET
5561 case IPPROTO_ICMP: {
5562 struct icmp iih;
5563
5564 if (!pf_pull_hdr(m, off2, &iih, ICMP_MINLEN,
5565 NULL, reason, pd2.af)) {
5566 DPFPRINTF(PF_DEBUG_MISC,
5567 ("pf: ICMP error message too short i"
5568 "(icmp)\n"));
5569 return (PF_DROP);
5570 }
5571
5572 key.af = pd2.af;
5573 key.proto = IPPROTO_ICMP;
5574 PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af);
5575 PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af);
5576 key.port[0] = key.port[1] = iih.icmp_id;
5577
5578 STATE_LOOKUP(kif, &key, direction, *state, pd);
5579
5580 /* translate source/destination address, if necessary */
5581 if ((*state)->key[PF_SK_WIRE] !=
5582 (*state)->key[PF_SK_STACK]) {
5583 struct pf_state_key *nk =
5584 (*state)->key[pd->didx];
5585
5586 if (PF_ANEQ(pd2.src,
5587 &nk->addr[pd2.sidx], pd2.af) ||
5588 nk->port[pd2.sidx] != iih.icmp_id)
5589 pf_change_icmp(pd2.src, &iih.icmp_id,
5590 daddr, &nk->addr[pd2.sidx],
5591 nk->port[pd2.sidx], NULL,
5592 pd2.ip_sum, icmpsum,
5593 pd->ip_sum, 0, AF_INET);
5594
5595 if (PF_ANEQ(pd2.dst,
5596 &nk->addr[pd2.didx], pd2.af) ||
5597 nk->port[pd2.didx] != iih.icmp_id)
5598 pf_change_icmp(pd2.dst, &iih.icmp_id,
5599 saddr, &nk->addr[pd2.didx],
5600 nk->port[pd2.didx], NULL,
5601 pd2.ip_sum, icmpsum,
5602 pd->ip_sum, 0, AF_INET);
5603
5604 m_copyback(m, off, ICMP_MINLEN, (caddr_t)&pd->hdr.icmp);
5605 m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2);
5606 m_copyback(m, off2, ICMP_MINLEN, (caddr_t)&iih);
5607 }
5608 return (PF_PASS);
5609 break;
5610 }
5611 #endif /* INET */
5612 #ifdef INET6
5613 case IPPROTO_ICMPV6: {
5614 struct icmp6_hdr iih;
5615
5616 if (!pf_pull_hdr(m, off2, &iih,
5617 sizeof(struct icmp6_hdr), NULL, reason, pd2.af)) {
5618 DPFPRINTF(PF_DEBUG_MISC,
5619 ("pf: ICMP error message too short "
5620 "(icmp6)\n"));
5621 return (PF_DROP);
5622 }
5623
5624 key.af = pd2.af;
5625 key.proto = IPPROTO_ICMPV6;
5626 PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af);
5627 PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af);
5628 key.port[0] = key.port[1] = iih.icmp6_id;
5629
5630 STATE_LOOKUP(kif, &key, direction, *state, pd);
5631
5632 /* translate source/destination address, if necessary */
5633 if ((*state)->key[PF_SK_WIRE] !=
5634 (*state)->key[PF_SK_STACK]) {
5635 struct pf_state_key *nk =
5636 (*state)->key[pd->didx];
5637
5638 if (PF_ANEQ(pd2.src,
5639 &nk->addr[pd2.sidx], pd2.af) ||
5640 nk->port[pd2.sidx] != iih.icmp6_id)
5641 pf_change_icmp(pd2.src, &iih.icmp6_id,
5642 daddr, &nk->addr[pd2.sidx],
5643 nk->port[pd2.sidx], NULL,
5644 pd2.ip_sum, icmpsum,
5645 pd->ip_sum, 0, AF_INET6);
5646
5647 if (PF_ANEQ(pd2.dst,
5648 &nk->addr[pd2.didx], pd2.af) ||
5649 nk->port[pd2.didx] != iih.icmp6_id)
5650 pf_change_icmp(pd2.dst, &iih.icmp6_id,
5651 saddr, &nk->addr[pd2.didx],
5652 nk->port[pd2.didx], NULL,
5653 pd2.ip_sum, icmpsum,
5654 pd->ip_sum, 0, AF_INET6);
5655
5656 m_copyback(m, off, sizeof(struct icmp6_hdr),
5657 (caddr_t)&pd->hdr.icmp6);
5658 m_copyback(m, ipoff2, sizeof(h2_6), (caddr_t)&h2_6);
5659 m_copyback(m, off2, sizeof(struct icmp6_hdr),
5660 (caddr_t)&iih);
5661 }
5662 return (PF_PASS);
5663 break;
5664 }
5665 #endif /* INET6 */
5666 default: {
5667 key.af = pd2.af;
5668 key.proto = pd2.proto;
5669 PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af);
5670 PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af);
5671 key.port[0] = key.port[1] = 0;
5672
5673 STATE_LOOKUP(kif, &key, direction, *state, pd);
5674
5675 /* translate source/destination address, if necessary */
5676 if ((*state)->key[PF_SK_WIRE] !=
5677 (*state)->key[PF_SK_STACK]) {
5678 struct pf_state_key *nk =
5679 (*state)->key[pd->didx];
5680
5681 if (PF_ANEQ(pd2.src,
5682 &nk->addr[pd2.sidx], pd2.af))
5683 pf_change_icmp(pd2.src, NULL, daddr,
5684 &nk->addr[pd2.sidx], 0, NULL,
5685 pd2.ip_sum, icmpsum,
5686 pd->ip_sum, 0, pd2.af);
5687
5688 if (PF_ANEQ(pd2.dst,
5689 &nk->addr[pd2.didx], pd2.af))
5690 pf_change_icmp(pd2.dst, NULL, saddr,
5691 &nk->addr[pd2.didx], 0, NULL,
5692 pd2.ip_sum, icmpsum,
5693 pd->ip_sum, 0, pd2.af);
5694
5695 switch (pd2.af) {
5696 #ifdef INET
5697 case AF_INET:
5698 m_copyback(m, off, ICMP_MINLEN,
5699 (caddr_t)&pd->hdr.icmp);
5700 m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2);
5701 break;
5702 #endif /* INET */
5703 #ifdef INET6
5704 case AF_INET6:
5705 m_copyback(m, off,
5706 sizeof(struct icmp6_hdr),
5707 (caddr_t )&pd->hdr.icmp6);
5708 m_copyback(m, ipoff2, sizeof(h2_6),
5709 (caddr_t )&h2_6);
5710 break;
5711 #endif /* INET6 */
5712 }
5713 }
5714 return (PF_PASS);
5715 break;
5716 }
5717 }
5718 }
5719 }
5720
5721 static int
pf_test_state_other(struct pf_kstate ** state,int direction,struct pfi_kkif * kif,struct mbuf * m,struct pf_pdesc * pd)5722 pf_test_state_other(struct pf_kstate **state, int direction, struct pfi_kkif *kif,
5723 struct mbuf *m, struct pf_pdesc *pd)
5724 {
5725 struct pf_state_peer *src, *dst;
5726 struct pf_state_key_cmp key;
5727 uint8_t psrc, pdst;
5728
5729 bzero(&key, sizeof(key));
5730 key.af = pd->af;
5731 key.proto = pd->proto;
5732 if (direction == PF_IN) {
5733 PF_ACPY(&key.addr[0], pd->src, key.af);
5734 PF_ACPY(&key.addr[1], pd->dst, key.af);
5735 key.port[0] = key.port[1] = 0;
5736 } else {
5737 PF_ACPY(&key.addr[1], pd->src, key.af);
5738 PF_ACPY(&key.addr[0], pd->dst, key.af);
5739 key.port[1] = key.port[0] = 0;
5740 }
5741
5742 STATE_LOOKUP(kif, &key, direction, *state, pd);
5743
5744 if (direction == (*state)->direction) {
5745 src = &(*state)->src;
5746 dst = &(*state)->dst;
5747 psrc = PF_PEER_SRC;
5748 pdst = PF_PEER_DST;
5749 } else {
5750 src = &(*state)->dst;
5751 dst = &(*state)->src;
5752 psrc = PF_PEER_DST;
5753 pdst = PF_PEER_SRC;
5754 }
5755
5756 /* update states */
5757 if (src->state < PFOTHERS_SINGLE)
5758 pf_set_protostate(*state, psrc, PFOTHERS_SINGLE);
5759 if (dst->state == PFOTHERS_SINGLE)
5760 pf_set_protostate(*state, pdst, PFOTHERS_MULTIPLE);
5761
5762 /* update expire time */
5763 (*state)->expire = time_uptime;
5764 if (src->state == PFOTHERS_MULTIPLE && dst->state == PFOTHERS_MULTIPLE)
5765 (*state)->timeout = PFTM_OTHER_MULTIPLE;
5766 else
5767 (*state)->timeout = PFTM_OTHER_SINGLE;
5768
5769 /* translate source/destination address, if necessary */
5770 if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) {
5771 struct pf_state_key *nk = (*state)->key[pd->didx];
5772
5773 KASSERT(nk, ("%s: nk is null", __func__));
5774 KASSERT(pd, ("%s: pd is null", __func__));
5775 KASSERT(pd->src, ("%s: pd->src is null", __func__));
5776 KASSERT(pd->dst, ("%s: pd->dst is null", __func__));
5777 switch (pd->af) {
5778 #ifdef INET
5779 case AF_INET:
5780 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], AF_INET))
5781 pf_change_a(&pd->src->v4.s_addr,
5782 pd->ip_sum,
5783 nk->addr[pd->sidx].v4.s_addr,
5784 0);
5785
5786
5787 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], AF_INET))
5788 pf_change_a(&pd->dst->v4.s_addr,
5789 pd->ip_sum,
5790 nk->addr[pd->didx].v4.s_addr,
5791 0);
5792
5793 break;
5794 #endif /* INET */
5795 #ifdef INET6
5796 case AF_INET6:
5797 if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], AF_INET))
5798 PF_ACPY(pd->src, &nk->addr[pd->sidx], pd->af);
5799
5800 if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], AF_INET))
5801 PF_ACPY(pd->dst, &nk->addr[pd->didx], pd->af);
5802 #endif /* INET6 */
5803 }
5804 }
5805 return (PF_PASS);
5806 }
5807
5808 /*
5809 * ipoff and off are measured from the start of the mbuf chain.
5810 * h must be at "ipoff" on the mbuf chain.
5811 */
5812 void *
pf_pull_hdr(struct mbuf * m,int off,void * p,int len,u_short * actionp,u_short * reasonp,sa_family_t af)5813 pf_pull_hdr(struct mbuf *m, int off, void *p, int len,
5814 u_short *actionp, u_short *reasonp, sa_family_t af)
5815 {
5816 switch (af) {
5817 #ifdef INET
5818 case AF_INET: {
5819 struct ip *h = mtod(m, struct ip *);
5820 u_int16_t fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3;
5821
5822 if (fragoff) {
5823 if (fragoff >= len)
5824 ACTION_SET(actionp, PF_PASS);
5825 else {
5826 ACTION_SET(actionp, PF_DROP);
5827 REASON_SET(reasonp, PFRES_FRAG);
5828 }
5829 return (NULL);
5830 }
5831 if (m->m_pkthdr.len < off + len ||
5832 ntohs(h->ip_len) < off + len) {
5833 ACTION_SET(actionp, PF_DROP);
5834 REASON_SET(reasonp, PFRES_SHORT);
5835 return (NULL);
5836 }
5837 break;
5838 }
5839 #endif /* INET */
5840 #ifdef INET6
5841 case AF_INET6: {
5842 struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
5843
5844 if (m->m_pkthdr.len < off + len ||
5845 (ntohs(h->ip6_plen) + sizeof(struct ip6_hdr)) <
5846 (unsigned)(off + len)) {
5847 ACTION_SET(actionp, PF_DROP);
5848 REASON_SET(reasonp, PFRES_SHORT);
5849 return (NULL);
5850 }
5851 break;
5852 }
5853 #endif /* INET6 */
5854 }
5855 m_copydata(m, off, len, p);
5856 return (p);
5857 }
5858
5859 #ifdef RADIX_MPATH
5860 static int
pf_routable_oldmpath(struct pf_addr * addr,sa_family_t af,struct pfi_kif * kif,int rtableid)5861 pf_routable_oldmpath(struct pf_addr *addr, sa_family_t af, struct pfi_kif *kif,
5862 int rtableid)
5863 {
5864 struct radix_node_head *rnh;
5865 struct sockaddr_in *dst;
5866 int ret = 1;
5867 int check_mpath;
5868 #ifdef INET6
5869 struct sockaddr_in6 *dst6;
5870 struct route_in6 ro;
5871 #else
5872 struct route ro;
5873 #endif
5874 struct radix_node *rn;
5875 struct rtentry *rt;
5876 struct ifnet *ifp;
5877
5878 check_mpath = 0;
5879 /* XXX: stick to table 0 for now */
5880 rnh = rt_tables_get_rnh(0, af);
5881 if (rnh != NULL && rn_mpath_capable(rnh))
5882 check_mpath = 1;
5883 bzero(&ro, sizeof(ro));
5884 switch (af) {
5885 case AF_INET:
5886 dst = satosin(&ro.ro_dst);
5887 dst->sin_family = AF_INET;
5888 dst->sin_len = sizeof(*dst);
5889 dst->sin_addr = addr->v4;
5890 break;
5891 #ifdef INET6
5892 case AF_INET6:
5893 /*
5894 * Skip check for addresses with embedded interface scope,
5895 * as they would always match anyway.
5896 */
5897 if (IN6_IS_SCOPE_EMBED(&addr->v6))
5898 goto out;
5899 dst6 = (struct sockaddr_in6 *)&ro.ro_dst;
5900 dst6->sin6_family = AF_INET6;
5901 dst6->sin6_len = sizeof(*dst6);
5902 dst6->sin6_addr = addr->v6;
5903 break;
5904 #endif /* INET6 */
5905 default:
5906 return (0);
5907 }
5908
5909 /* Skip checks for ipsec interfaces */
5910 if (kif != NULL && kif->pfik_ifp->if_type == IFT_ENC)
5911 goto out;
5912
5913 switch (af) {
5914 #ifdef INET6
5915 case AF_INET6:
5916 in6_rtalloc_ign(&ro, 0, rtableid);
5917 break;
5918 #endif
5919 #ifdef INET
5920 case AF_INET:
5921 in_rtalloc_ign((struct route *)&ro, 0, rtableid);
5922 break;
5923 #endif
5924 }
5925
5926 if (ro.ro_rt != NULL) {
5927 /* No interface given, this is a no-route check */
5928 if (kif == NULL)
5929 goto out;
5930
5931 if (kif->pfik_ifp == NULL) {
5932 ret = 0;
5933 goto out;
5934 }
5935
5936 /* Perform uRPF check if passed input interface */
5937 ret = 0;
5938 rn = (struct radix_node *)ro.ro_rt;
5939 do {
5940 rt = (struct rtentry *)rn;
5941 ifp = rt->rt_ifp;
5942
5943 if (kif->pfik_ifp == ifp)
5944 ret = 1;
5945 rn = rn_mpath_next(rn);
5946 } while (check_mpath == 1 && rn != NULL && ret == 0);
5947 } else
5948 ret = 0;
5949 out:
5950 if (ro.ro_rt != NULL)
5951 RTFREE(ro.ro_rt);
5952 return (ret);
5953 }
5954 #endif
5955
5956 int
pf_routable(struct pf_addr * addr,sa_family_t af,struct pfi_kkif * kif,int rtableid)5957 pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kkif *kif,
5958 int rtableid)
5959 {
5960 #ifdef INET
5961 struct nhop4_basic nh4;
5962 #endif
5963 #ifdef INET6
5964 struct nhop6_basic nh6;
5965 #endif
5966 struct ifnet *ifp;
5967 #ifdef RADIX_MPATH
5968 struct radix_node_head *rnh;
5969
5970 /* XXX: stick to table 0 for now */
5971 rnh = rt_tables_get_rnh(0, af);
5972 if (rnh != NULL && rn_mpath_capable(rnh))
5973 return (pf_routable_oldmpath(addr, af, kif, rtableid));
5974 #endif
5975 /*
5976 * Skip check for addresses with embedded interface scope,
5977 * as they would always match anyway.
5978 */
5979 if (af == AF_INET6 && IN6_IS_SCOPE_EMBED(&addr->v6))
5980 return (1);
5981
5982 if (af != AF_INET && af != AF_INET6)
5983 return (0);
5984
5985 /* Skip checks for ipsec interfaces */
5986 if (kif != NULL && kif->pfik_ifp->if_type == IFT_ENC)
5987 return (1);
5988
5989 ifp = NULL;
5990
5991 switch (af) {
5992 #ifdef INET6
5993 case AF_INET6:
5994 if (fib6_lookup_nh_basic(rtableid, &addr->v6, 0, 0, 0, &nh6)!=0)
5995 return (0);
5996 ifp = nh6.nh_ifp;
5997 break;
5998 #endif
5999 #ifdef INET
6000 case AF_INET:
6001 if (fib4_lookup_nh_basic(rtableid, addr->v4, 0, 0, &nh4) != 0)
6002 return (0);
6003 ifp = nh4.nh_ifp;
6004 break;
6005 #endif
6006 }
6007
6008 /* No interface given, this is a no-route check */
6009 if (kif == NULL)
6010 return (1);
6011
6012 if (kif->pfik_ifp == NULL)
6013 return (0);
6014
6015 /* Perform uRPF check if passed input interface */
6016 if (kif->pfik_ifp == ifp)
6017 return (1);
6018 return (0);
6019 }
6020
6021 #ifdef INET
6022 static void
pf_route(struct mbuf ** m,struct pf_krule * r,int dir,struct ifnet * oifp,struct pf_kstate * s,struct pf_pdesc * pd,struct inpcb * inp)6023 pf_route(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp,
6024 struct pf_kstate *s, struct pf_pdesc *pd, struct inpcb *inp)
6025 {
6026 struct mbuf *m0, *m1;
6027 struct sockaddr_in dst;
6028 struct ip *ip;
6029 struct ifnet *ifp = NULL;
6030 struct pf_addr naddr;
6031 struct pf_ksrc_node *sn = NULL;
6032 int error = 0;
6033 uint16_t ip_len, ip_off;
6034
6035 KASSERT(m && *m && r && oifp, ("%s: invalid parameters", __func__));
6036 KASSERT(dir == PF_IN || dir == PF_OUT, ("%s: invalid direction",
6037 __func__));
6038
6039 if ((pd->pf_mtag == NULL &&
6040 ((pd->pf_mtag = pf_get_mtag(*m)) == NULL)) ||
6041 pd->pf_mtag->routed++ > 3) {
6042 m0 = *m;
6043 *m = NULL;
6044 goto bad_locked;
6045 }
6046
6047 if (r->rt == PF_DUPTO) {
6048 if ((m0 = m_dup(*m, M_NOWAIT)) == NULL) {
6049 if (s)
6050 PF_STATE_UNLOCK(s);
6051 return;
6052 }
6053 } else {
6054 if ((r->rt == PF_REPLYTO) == (r->direction == dir)) {
6055 if (s)
6056 PF_STATE_UNLOCK(s);
6057 return;
6058 }
6059 m0 = *m;
6060 }
6061
6062 ip = mtod(m0, struct ip *);
6063
6064 bzero(&dst, sizeof(dst));
6065 dst.sin_family = AF_INET;
6066 dst.sin_len = sizeof(dst);
6067 dst.sin_addr = ip->ip_dst;
6068
6069 bzero(&naddr, sizeof(naddr));
6070
6071 if (TAILQ_EMPTY(&r->rpool.list)) {
6072 DPFPRINTF(PF_DEBUG_URGENT,
6073 ("%s: TAILQ_EMPTY(&r->rpool.list)\n", __func__));
6074 goto bad_locked;
6075 }
6076 if (s == NULL) {
6077 pf_map_addr(AF_INET, r, (struct pf_addr *)&ip->ip_src,
6078 &naddr, NULL, &sn);
6079 if (!PF_AZERO(&naddr, AF_INET))
6080 dst.sin_addr.s_addr = naddr.v4.s_addr;
6081 ifp = r->rpool.cur->kif ?
6082 r->rpool.cur->kif->pfik_ifp : NULL;
6083 } else {
6084 if (!PF_AZERO(&s->rt_addr, AF_INET))
6085 dst.sin_addr.s_addr =
6086 s->rt_addr.v4.s_addr;
6087 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
6088 PF_STATE_UNLOCK(s);
6089 }
6090 /* If pfsync'd */
6091 if (ifp == NULL)
6092 ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL;
6093 if (ifp == NULL)
6094 goto bad;
6095
6096 if (dir == PF_IN) {
6097 if (pf_test(PF_OUT, 0, ifp, &m0, inp) != PF_PASS)
6098 goto bad;
6099 else if (m0 == NULL)
6100 goto done;
6101 if (m0->m_len < sizeof(struct ip)) {
6102 DPFPRINTF(PF_DEBUG_URGENT,
6103 ("%s: m0->m_len < sizeof(struct ip)\n", __func__));
6104 goto bad;
6105 }
6106 ip = mtod(m0, struct ip *);
6107 }
6108
6109 if (ifp->if_flags & IFF_LOOPBACK)
6110 m0->m_flags |= M_SKIP_FIREWALL;
6111
6112 ip_len = ntohs(ip->ip_len);
6113 ip_off = ntohs(ip->ip_off);
6114
6115 /* Copied from FreeBSD 10.0-CURRENT ip_output. */
6116 m0->m_pkthdr.csum_flags |= CSUM_IP;
6117 if (m0->m_pkthdr.csum_flags & CSUM_DELAY_DATA & ~ifp->if_hwassist) {
6118 in_delayed_cksum(m0);
6119 m0->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
6120 }
6121 #if defined(SCTP) || defined(SCTP_SUPPORT)
6122 if (m0->m_pkthdr.csum_flags & CSUM_SCTP & ~ifp->if_hwassist) {
6123 sctp_delayed_cksum(m0, (uint32_t)(ip->ip_hl << 2));
6124 m0->m_pkthdr.csum_flags &= ~CSUM_SCTP;
6125 }
6126 #endif
6127
6128 /*
6129 * If small enough for interface, or the interface will take
6130 * care of the fragmentation for us, we can just send directly.
6131 */
6132 if (ip_len <= ifp->if_mtu ||
6133 (m0->m_pkthdr.csum_flags & ifp->if_hwassist & CSUM_TSO) != 0) {
6134 ip->ip_sum = 0;
6135 if (m0->m_pkthdr.csum_flags & CSUM_IP & ~ifp->if_hwassist) {
6136 ip->ip_sum = in_cksum(m0, ip->ip_hl << 2);
6137 m0->m_pkthdr.csum_flags &= ~CSUM_IP;
6138 }
6139 m_clrprotoflags(m0); /* Avoid confusing lower layers. */
6140 error = (*ifp->if_output)(ifp, m0, sintosa(&dst), NULL);
6141 goto done;
6142 }
6143
6144 /* Balk when DF bit is set or the interface didn't support TSO. */
6145 if ((ip_off & IP_DF) || (m0->m_pkthdr.csum_flags & CSUM_TSO)) {
6146 error = EMSGSIZE;
6147 KMOD_IPSTAT_INC(ips_cantfrag);
6148 if (r->rt != PF_DUPTO) {
6149 if (s && pd->nat_rule != NULL)
6150 PACKET_UNDO_NAT(m0, pd,
6151 (ip->ip_hl << 2) + (ip_off & IP_OFFMASK),
6152 s, dir);
6153
6154 icmp_error(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 0,
6155 ifp->if_mtu);
6156 goto done;
6157 } else
6158 goto bad;
6159 }
6160
6161 error = ip_fragment(ip, &m0, ifp->if_mtu, ifp->if_hwassist);
6162 if (error)
6163 goto bad;
6164
6165 for (; m0; m0 = m1) {
6166 m1 = m0->m_nextpkt;
6167 m0->m_nextpkt = NULL;
6168 if (error == 0) {
6169 m_clrprotoflags(m0);
6170 error = (*ifp->if_output)(ifp, m0, sintosa(&dst), NULL);
6171 } else
6172 m_freem(m0);
6173 }
6174
6175 if (error == 0)
6176 KMOD_IPSTAT_INC(ips_fragmented);
6177
6178 done:
6179 if (r->rt != PF_DUPTO)
6180 *m = NULL;
6181 return;
6182
6183 bad_locked:
6184 if (s)
6185 PF_STATE_UNLOCK(s);
6186 bad:
6187 m_freem(m0);
6188 goto done;
6189 }
6190 #endif /* INET */
6191
6192 #ifdef INET6
6193 static void
pf_route6(struct mbuf ** m,struct pf_krule * r,int dir,struct ifnet * oifp,struct pf_kstate * s,struct pf_pdesc * pd,struct inpcb * inp)6194 pf_route6(struct mbuf **m, struct pf_krule *r, int dir, struct ifnet *oifp,
6195 struct pf_kstate *s, struct pf_pdesc *pd, struct inpcb *inp)
6196 {
6197 struct mbuf *m0;
6198 struct sockaddr_in6 dst;
6199 struct ip6_hdr *ip6;
6200 struct ifnet *ifp = NULL;
6201 struct pf_addr naddr;
6202 struct pf_ksrc_node *sn = NULL;
6203
6204 KASSERT(m && *m && r && oifp, ("%s: invalid parameters", __func__));
6205 KASSERT(dir == PF_IN || dir == PF_OUT, ("%s: invalid direction",
6206 __func__));
6207
6208 if ((pd->pf_mtag == NULL &&
6209 ((pd->pf_mtag = pf_get_mtag(*m)) == NULL)) ||
6210 pd->pf_mtag->routed++ > 3) {
6211 m0 = *m;
6212 *m = NULL;
6213 goto bad_locked;
6214 }
6215
6216 if (r->rt == PF_DUPTO) {
6217 if ((m0 = m_dup(*m, M_NOWAIT)) == NULL) {
6218 if (s)
6219 PF_STATE_UNLOCK(s);
6220 return;
6221 }
6222 } else {
6223 if ((r->rt == PF_REPLYTO) == (r->direction == dir)) {
6224 if (s)
6225 PF_STATE_UNLOCK(s);
6226 return;
6227 }
6228 m0 = *m;
6229 }
6230
6231 ip6 = mtod(m0, struct ip6_hdr *);
6232
6233 bzero(&dst, sizeof(dst));
6234 dst.sin6_family = AF_INET6;
6235 dst.sin6_len = sizeof(dst);
6236 dst.sin6_addr = ip6->ip6_dst;
6237
6238 bzero(&naddr, sizeof(naddr));
6239
6240 if (TAILQ_EMPTY(&r->rpool.list)) {
6241 DPFPRINTF(PF_DEBUG_URGENT,
6242 ("%s: TAILQ_EMPTY(&r->rpool.list)\n", __func__));
6243 goto bad_locked;
6244 }
6245 if (s == NULL) {
6246 pf_map_addr(AF_INET6, r, (struct pf_addr *)&ip6->ip6_src,
6247 &naddr, NULL, &sn);
6248 if (!PF_AZERO(&naddr, AF_INET6))
6249 PF_ACPY((struct pf_addr *)&dst.sin6_addr,
6250 &naddr, AF_INET6);
6251 ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL;
6252 } else {
6253 if (!PF_AZERO(&s->rt_addr, AF_INET6))
6254 PF_ACPY((struct pf_addr *)&dst.sin6_addr,
6255 &s->rt_addr, AF_INET6);
6256 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
6257 }
6258
6259 if (s)
6260 PF_STATE_UNLOCK(s);
6261
6262 /* If pfsync'd */
6263 if (ifp == NULL)
6264 ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL;
6265 if (ifp == NULL)
6266 goto bad;
6267
6268 if (dir == PF_IN) {
6269 if (pf_test6(PF_OUT, PFIL_FWD, ifp, &m0, inp) != PF_PASS)
6270 goto bad;
6271 else if (m0 == NULL)
6272 goto done;
6273 if (m0->m_len < sizeof(struct ip6_hdr)) {
6274 DPFPRINTF(PF_DEBUG_URGENT,
6275 ("%s: m0->m_len < sizeof(struct ip6_hdr)\n",
6276 __func__));
6277 goto bad;
6278 }
6279 ip6 = mtod(m0, struct ip6_hdr *);
6280 }
6281
6282 if (ifp->if_flags & IFF_LOOPBACK)
6283 m0->m_flags |= M_SKIP_FIREWALL;
6284
6285 if (m0->m_pkthdr.csum_flags & CSUM_DELAY_DATA_IPV6 &
6286 ~ifp->if_hwassist) {
6287 uint32_t plen = m0->m_pkthdr.len - sizeof(*ip6);
6288 in6_delayed_cksum(m0, plen, sizeof(struct ip6_hdr));
6289 m0->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6;
6290 }
6291
6292 /*
6293 * If the packet is too large for the outgoing interface,
6294 * send back an icmp6 error.
6295 */
6296 if (IN6_IS_SCOPE_EMBED(&dst.sin6_addr))
6297 dst.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
6298 if ((u_long)m0->m_pkthdr.len <= ifp->if_mtu)
6299 nd6_output_ifp(ifp, ifp, m0, &dst, NULL);
6300 else {
6301 in6_ifstat_inc(ifp, ifs6_in_toobig);
6302 if (r->rt != PF_DUPTO) {
6303 if (s && pd->nat_rule != NULL)
6304 PACKET_UNDO_NAT(m0, pd,
6305 ((caddr_t)ip6 - m0->m_data) +
6306 sizeof(struct ip6_hdr), s, dir);
6307
6308 icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu);
6309 } else
6310 goto bad;
6311 }
6312
6313 done:
6314 if (r->rt != PF_DUPTO)
6315 *m = NULL;
6316 return;
6317
6318 bad_locked:
6319 if (s)
6320 PF_STATE_UNLOCK(s);
6321 bad:
6322 m_freem(m0);
6323 goto done;
6324 }
6325 #endif /* INET6 */
6326
6327 /*
6328 * FreeBSD supports cksum offloads for the following drivers.
6329 * em(4), fxp(4), lge(4), ndis(4), nge(4), re(4), ti(4), txp(4), xl(4)
6330 *
6331 * CSUM_DATA_VALID | CSUM_PSEUDO_HDR :
6332 * network driver performed cksum including pseudo header, need to verify
6333 * csum_data
6334 * CSUM_DATA_VALID :
6335 * network driver performed cksum, needs to additional pseudo header
6336 * cksum computation with partial csum_data(i.e. lack of H/W support for
6337 * pseudo header, for instance hme(4), sk(4) and possibly gem(4))
6338 *
6339 * After validating the cksum of packet, set both flag CSUM_DATA_VALID and
6340 * CSUM_PSEUDO_HDR in order to avoid recomputation of the cksum in upper
6341 * TCP/UDP layer.
6342 * Also, set csum_data to 0xffff to force cksum validation.
6343 */
6344 static int
pf_check_proto_cksum(struct mbuf * m,int off,int len,u_int8_t p,sa_family_t af)6345 pf_check_proto_cksum(struct mbuf *m, int off, int len, u_int8_t p, sa_family_t af)
6346 {
6347 u_int16_t sum = 0;
6348 int hw_assist = 0;
6349 struct ip *ip;
6350
6351 if (off < sizeof(struct ip) || len < sizeof(struct udphdr))
6352 return (1);
6353 if (m->m_pkthdr.len < off + len)
6354 return (1);
6355
6356 switch (p) {
6357 case IPPROTO_TCP:
6358 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
6359 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
6360 sum = m->m_pkthdr.csum_data;
6361 } else {
6362 ip = mtod(m, struct ip *);
6363 sum = in_pseudo(ip->ip_src.s_addr,
6364 ip->ip_dst.s_addr, htonl((u_short)len +
6365 m->m_pkthdr.csum_data + IPPROTO_TCP));
6366 }
6367 sum ^= 0xffff;
6368 ++hw_assist;
6369 }
6370 break;
6371 case IPPROTO_UDP:
6372 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
6373 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
6374 sum = m->m_pkthdr.csum_data;
6375 } else {
6376 ip = mtod(m, struct ip *);
6377 sum = in_pseudo(ip->ip_src.s_addr,
6378 ip->ip_dst.s_addr, htonl((u_short)len +
6379 m->m_pkthdr.csum_data + IPPROTO_UDP));
6380 }
6381 sum ^= 0xffff;
6382 ++hw_assist;
6383 }
6384 break;
6385 case IPPROTO_ICMP:
6386 #ifdef INET6
6387 case IPPROTO_ICMPV6:
6388 #endif /* INET6 */
6389 break;
6390 default:
6391 return (1);
6392 }
6393
6394 if (!hw_assist) {
6395 switch (af) {
6396 case AF_INET:
6397 if (p == IPPROTO_ICMP) {
6398 if (m->m_len < off)
6399 return (1);
6400 m->m_data += off;
6401 m->m_len -= off;
6402 sum = in_cksum(m, len);
6403 m->m_data -= off;
6404 m->m_len += off;
6405 } else {
6406 if (m->m_len < sizeof(struct ip))
6407 return (1);
6408 sum = in4_cksum(m, p, off, len);
6409 }
6410 break;
6411 #ifdef INET6
6412 case AF_INET6:
6413 if (m->m_len < sizeof(struct ip6_hdr))
6414 return (1);
6415 sum = in6_cksum(m, p, off, len);
6416 break;
6417 #endif /* INET6 */
6418 default:
6419 return (1);
6420 }
6421 }
6422 if (sum) {
6423 switch (p) {
6424 case IPPROTO_TCP:
6425 {
6426 KMOD_TCPSTAT_INC(tcps_rcvbadsum);
6427 break;
6428 }
6429 case IPPROTO_UDP:
6430 {
6431 KMOD_UDPSTAT_INC(udps_badsum);
6432 break;
6433 }
6434 #ifdef INET
6435 case IPPROTO_ICMP:
6436 {
6437 KMOD_ICMPSTAT_INC(icps_checksum);
6438 break;
6439 }
6440 #endif
6441 #ifdef INET6
6442 case IPPROTO_ICMPV6:
6443 {
6444 KMOD_ICMP6STAT_INC(icp6s_checksum);
6445 break;
6446 }
6447 #endif /* INET6 */
6448 }
6449 return (1);
6450 } else {
6451 if (p == IPPROTO_TCP || p == IPPROTO_UDP) {
6452 m->m_pkthdr.csum_flags |=
6453 (CSUM_DATA_VALID | CSUM_PSEUDO_HDR);
6454 m->m_pkthdr.csum_data = 0xffff;
6455 }
6456 }
6457 return (0);
6458 }
6459
6460
6461 #ifdef INET
6462 int
pf_test(int dir,int pflags,struct ifnet * ifp,struct mbuf ** m0,struct inpcb * inp)6463 pf_test(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp)
6464 {
6465 struct pfi_kkif *kif;
6466 u_short action, reason = 0, log = 0;
6467 struct mbuf *m = *m0;
6468 struct ip *h = NULL;
6469 struct m_tag *ipfwtag;
6470 struct pf_krule *a = NULL, *r = &V_pf_default_rule, *tr, *nr;
6471 struct pf_kstate *s = NULL;
6472 struct pf_kruleset *ruleset = NULL;
6473 struct pf_pdesc pd;
6474 int off, dirndx, pqid = 0;
6475
6476 PF_RULES_RLOCK_TRACKER;
6477 KASSERT(dir == PF_IN || dir == PF_OUT, ("%s: bad direction %d\n", __func__, dir));
6478 M_ASSERTPKTHDR(m);
6479
6480 if (!V_pf_status.running)
6481 return (PF_PASS);
6482
6483 memset(&pd, 0, sizeof(pd));
6484
6485 kif = (struct pfi_kkif *)ifp->if_pf_kif;
6486
6487 if (kif == NULL) {
6488 DPFPRINTF(PF_DEBUG_URGENT,
6489 ("pf_test: kif == NULL, if_xname %s\n", ifp->if_xname));
6490 return (PF_DROP);
6491 }
6492 if (kif->pfik_flags & PFI_IFLAG_SKIP)
6493 return (PF_PASS);
6494
6495 if (m->m_flags & M_SKIP_FIREWALL)
6496 return (PF_PASS);
6497
6498 pd.pf_mtag = pf_find_mtag(m);
6499
6500 PF_RULES_RLOCK();
6501
6502 if (__predict_false(ip_divert_ptr != NULL) &&
6503 ((ipfwtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL)) != NULL)) {
6504 struct ipfw_rule_ref *rr = (struct ipfw_rule_ref *)(ipfwtag+1);
6505 if (rr->info & IPFW_IS_DIVERT && rr->rulenum == 0) {
6506 if (pd.pf_mtag == NULL &&
6507 ((pd.pf_mtag = pf_get_mtag(m)) == NULL)) {
6508 action = PF_DROP;
6509 goto done;
6510 }
6511 pd.pf_mtag->flags |= PF_PACKET_LOOPED;
6512 m_tag_delete(m, ipfwtag);
6513 }
6514 if (pd.pf_mtag && pd.pf_mtag->flags & PF_FASTFWD_OURS_PRESENT) {
6515 m->m_flags |= M_FASTFWD_OURS;
6516 pd.pf_mtag->flags &= ~PF_FASTFWD_OURS_PRESENT;
6517 }
6518 } else if (pf_normalize_ip(m0, dir, kif, &reason, &pd) != PF_PASS) {
6519 /* We do IP header normalization and packet reassembly here */
6520 action = PF_DROP;
6521 goto done;
6522 }
6523 m = *m0; /* pf_normalize messes with m0 */
6524 h = mtod(m, struct ip *);
6525
6526 off = h->ip_hl << 2;
6527 if (off < (int)sizeof(struct ip)) {
6528 action = PF_DROP;
6529 REASON_SET(&reason, PFRES_SHORT);
6530 log = 1;
6531 goto done;
6532 }
6533
6534 pd.src = (struct pf_addr *)&h->ip_src;
6535 pd.dst = (struct pf_addr *)&h->ip_dst;
6536 pd.sport = pd.dport = NULL;
6537 pd.ip_sum = &h->ip_sum;
6538 pd.proto_sum = NULL;
6539 pd.proto = h->ip_p;
6540 pd.dir = dir;
6541 pd.sidx = (dir == PF_IN) ? 0 : 1;
6542 pd.didx = (dir == PF_IN) ? 1 : 0;
6543 pd.af = AF_INET;
6544 pd.tos = h->ip_tos & ~IPTOS_ECN_MASK;
6545 pd.tot_len = ntohs(h->ip_len);
6546
6547 /* handle fragments that didn't get reassembled by normalization */
6548 if (h->ip_off & htons(IP_MF | IP_OFFMASK)) {
6549 action = pf_test_fragment(&r, dir, kif, m, h,
6550 &pd, &a, &ruleset);
6551 goto done;
6552 }
6553
6554 switch (h->ip_p) {
6555
6556 case IPPROTO_TCP: {
6557 if (!pf_pull_hdr(m, off, &pd.hdr.tcp, sizeof(pd.hdr.tcp),
6558 &action, &reason, AF_INET)) {
6559 log = action != PF_PASS;
6560 goto done;
6561 }
6562 pd.p_len = pd.tot_len - off - (pd.hdr.tcp.th_off << 2);
6563
6564 pd.sport = &pd.hdr.tcp.th_sport;
6565 pd.dport = &pd.hdr.tcp.th_dport;
6566
6567 /* Respond to SYN with a syncookie. */
6568 if ((pd.hdr.tcp.th_flags & (TH_SYN|TH_ACK|TH_RST)) == TH_SYN &&
6569 pd.dir == PF_IN && pf_synflood_check(&pd)) {
6570 pf_syncookie_send(m, off, &pd);
6571 action = PF_DROP;
6572 break;
6573 }
6574
6575 if ((pd.hdr.tcp.th_flags & TH_ACK) && pd.p_len == 0)
6576 pqid = 1;
6577 action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
6578 if (action == PF_DROP)
6579 goto done;
6580 action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd,
6581 &reason);
6582 if (action == PF_PASS) {
6583 if (V_pfsync_update_state_ptr != NULL)
6584 V_pfsync_update_state_ptr(s);
6585 r = s->rule.ptr;
6586 a = s->anchor.ptr;
6587 log = s->log;
6588 } else if (s == NULL) {
6589 /* Validate remote SYN|ACK, re-create original SYN if
6590 * valid. */
6591 if ((pd.hdr.tcp.th_flags & (TH_SYN|TH_ACK|TH_RST)) ==
6592 TH_ACK && pf_syncookie_validate(&pd) &&
6593 pd.dir == PF_IN) {
6594 struct mbuf *msyn;
6595
6596 msyn = pf_syncookie_recreate_syn(h->ip_ttl,
6597 off,&pd);
6598 if (msyn == NULL) {
6599 action = PF_DROP;
6600 break;
6601 }
6602
6603 action = pf_test(dir, pflags, ifp, &msyn, inp);
6604 m_freem(msyn);
6605
6606 if (action == PF_PASS) {
6607 action = pf_test_state_tcp(&s, dir,
6608 kif, m, off, h, &pd, &reason);
6609 if (action != PF_PASS || s == NULL) {
6610 action = PF_DROP;
6611 break;
6612 }
6613
6614 s->src.seqhi = ntohl(pd.hdr.tcp.th_ack)
6615 - 1;
6616 s->src.seqlo = ntohl(pd.hdr.tcp.th_seq)
6617 - 1;
6618 pf_set_protostate(s, PF_PEER_SRC,
6619 PF_TCPS_PROXY_DST);
6620
6621 action = pf_synproxy(&pd, &s, &reason);
6622 if (action != PF_PASS)
6623 break;
6624 }
6625 break;
6626 }
6627 else {
6628 action = pf_test_rule(&r, &s, dir, kif, m, off,
6629 &pd, &a, &ruleset, inp);
6630 }
6631 }
6632 break;
6633 }
6634
6635 case IPPROTO_UDP: {
6636 if (!pf_pull_hdr(m, off, &pd.hdr.udp, sizeof(pd.hdr.udp),
6637 &action, &reason, AF_INET)) {
6638 log = action != PF_PASS;
6639 goto done;
6640 }
6641 if (pd.hdr.udp.uh_dport == 0 ||
6642 ntohs(pd.hdr.udp.uh_ulen) > m->m_pkthdr.len - off ||
6643 ntohs(pd.hdr.udp.uh_ulen) < sizeof(struct udphdr)) {
6644 action = PF_DROP;
6645 REASON_SET(&reason, PFRES_SHORT);
6646 goto done;
6647 }
6648 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd);
6649 if (action == PF_PASS) {
6650 if (V_pfsync_update_state_ptr != NULL)
6651 V_pfsync_update_state_ptr(s);
6652 r = s->rule.ptr;
6653 a = s->anchor.ptr;
6654 log = s->log;
6655 } else if (s == NULL)
6656 action = pf_test_rule(&r, &s, dir, kif, m, off, &pd,
6657 &a, &ruleset, inp);
6658 break;
6659 }
6660
6661 case IPPROTO_ICMP: {
6662 if (!pf_pull_hdr(m, off, &pd.hdr.icmp, ICMP_MINLEN,
6663 &action, &reason, AF_INET)) {
6664 log = action != PF_PASS;
6665 goto done;
6666 }
6667 action = pf_test_state_icmp(&s, dir, kif, m, off, h, &pd,
6668 &reason);
6669 if (action == PF_PASS) {
6670 if (V_pfsync_update_state_ptr != NULL)
6671 V_pfsync_update_state_ptr(s);
6672 r = s->rule.ptr;
6673 a = s->anchor.ptr;
6674 log = s->log;
6675 } else if (s == NULL)
6676 action = pf_test_rule(&r, &s, dir, kif, m, off, &pd,
6677 &a, &ruleset, inp);
6678 break;
6679 }
6680
6681 #ifdef INET6
6682 case IPPROTO_ICMPV6: {
6683 action = PF_DROP;
6684 DPFPRINTF(PF_DEBUG_MISC,
6685 ("pf: dropping IPv4 packet with ICMPv6 payload\n"));
6686 goto done;
6687 }
6688 #endif
6689
6690 default:
6691 action = pf_test_state_other(&s, dir, kif, m, &pd);
6692 if (action == PF_PASS) {
6693 if (V_pfsync_update_state_ptr != NULL)
6694 V_pfsync_update_state_ptr(s);
6695 r = s->rule.ptr;
6696 a = s->anchor.ptr;
6697 log = s->log;
6698 } else if (s == NULL)
6699 action = pf_test_rule(&r, &s, dir, kif, m, off, &pd,
6700 &a, &ruleset, inp);
6701 break;
6702 }
6703
6704 done:
6705 PF_RULES_RUNLOCK();
6706 if (action == PF_PASS && h->ip_hl > 5 &&
6707 !((s && s->state_flags & PFSTATE_ALLOWOPTS) || r->allow_opts)) {
6708 action = PF_DROP;
6709 REASON_SET(&reason, PFRES_IPOPTIONS);
6710 log = r->log;
6711 DPFPRINTF(PF_DEBUG_MISC,
6712 ("pf: dropping packet with ip options\n"));
6713 }
6714
6715 if (s && s->tag > 0 && pf_tag_packet(m, &pd, s->tag)) {
6716 action = PF_DROP;
6717 REASON_SET(&reason, PFRES_MEMORY);
6718 }
6719 if (r->rtableid >= 0)
6720 M_SETFIB(m, r->rtableid);
6721
6722 if (r->scrub_flags & PFSTATE_SETPRIO) {
6723 if (pd.tos & IPTOS_LOWDELAY)
6724 pqid = 1;
6725 if (vlan_set_pcp(m, r->set_prio[pqid])) {
6726 action = PF_DROP;
6727 REASON_SET(&reason, PFRES_MEMORY);
6728 log = 1;
6729 DPFPRINTF(PF_DEBUG_MISC,
6730 ("pf: failed to allocate 802.1q mtag\n"));
6731 }
6732 }
6733
6734 #ifdef ALTQ
6735 if (s && s->qid) {
6736 pd.act.pqid = s->pqid;
6737 pd.act.qid = s->qid;
6738 } else if (r->qid) {
6739 pd.act.pqid = r->pqid;
6740 pd.act.qid = r->qid;
6741 }
6742 if (action == PF_PASS && pd.act.qid) {
6743 if (pd.pf_mtag == NULL &&
6744 ((pd.pf_mtag = pf_get_mtag(m)) == NULL)) {
6745 action = PF_DROP;
6746 REASON_SET(&reason, PFRES_MEMORY);
6747 } else {
6748 if (s != NULL)
6749 pd.pf_mtag->qid_hash = pf_state_hash(s);
6750 if (pqid || (pd.tos & IPTOS_LOWDELAY))
6751 pd.pf_mtag->qid = pd.act.pqid;
6752 else
6753 pd.pf_mtag->qid = pd.act.qid;
6754 /* Add hints for ecn. */
6755 pd.pf_mtag->hdr = h;
6756 }
6757
6758 }
6759 #endif /* ALTQ */
6760
6761 /*
6762 * connections redirected to loopback should not match sockets
6763 * bound specifically to loopback due to security implications,
6764 * see tcp_input() and in_pcblookup_listen().
6765 */
6766 if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP ||
6767 pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL &&
6768 (s->nat_rule.ptr->action == PF_RDR ||
6769 s->nat_rule.ptr->action == PF_BINAT) &&
6770 IN_LOOPBACK(ntohl(pd.dst->v4.s_addr)))
6771 m->m_flags |= M_SKIP_FIREWALL;
6772
6773 if (__predict_false(ip_divert_ptr != NULL) && action == PF_PASS &&
6774 r->divert.port && !PACKET_LOOPED(&pd)) {
6775 ipfwtag = m_tag_alloc(MTAG_IPFW_RULE, 0,
6776 sizeof(struct ipfw_rule_ref), M_NOWAIT | M_ZERO);
6777 if (ipfwtag != NULL) {
6778 ((struct ipfw_rule_ref *)(ipfwtag+1))->info =
6779 ntohs(r->divert.port);
6780 ((struct ipfw_rule_ref *)(ipfwtag+1))->rulenum = dir;
6781
6782 if (s)
6783 PF_STATE_UNLOCK(s);
6784
6785 m_tag_prepend(m, ipfwtag);
6786 if (m->m_flags & M_FASTFWD_OURS) {
6787 if (pd.pf_mtag == NULL &&
6788 ((pd.pf_mtag = pf_get_mtag(m)) == NULL)) {
6789 action = PF_DROP;
6790 REASON_SET(&reason, PFRES_MEMORY);
6791 log = 1;
6792 DPFPRINTF(PF_DEBUG_MISC,
6793 ("pf: failed to allocate tag\n"));
6794 } else {
6795 pd.pf_mtag->flags |=
6796 PF_FASTFWD_OURS_PRESENT;
6797 m->m_flags &= ~M_FASTFWD_OURS;
6798 }
6799 }
6800 ip_divert_ptr(*m0, dir == PF_IN ? DIR_IN : DIR_OUT);
6801 *m0 = NULL;
6802
6803 return (action);
6804 } else {
6805 /* XXX: ipfw has the same behaviour! */
6806 action = PF_DROP;
6807 REASON_SET(&reason, PFRES_MEMORY);
6808 log = 1;
6809 DPFPRINTF(PF_DEBUG_MISC,
6810 ("pf: failed to allocate divert tag\n"));
6811 }
6812 }
6813
6814 if (log) {
6815 struct pf_krule *lr;
6816
6817 if (s != NULL && s->nat_rule.ptr != NULL &&
6818 s->nat_rule.ptr->log & PF_LOG_ALL)
6819 lr = s->nat_rule.ptr;
6820 else
6821 lr = r;
6822 PFLOG_PACKET(kif, m, AF_INET, dir, reason, lr, a, ruleset, &pd,
6823 (s == NULL));
6824 }
6825
6826 pf_counter_u64_critical_enter();
6827 pf_counter_u64_add_protected(&kif->pfik_bytes[0][dir == PF_OUT][action != PF_PASS],
6828 pd.tot_len);
6829 pf_counter_u64_add_protected(&kif->pfik_packets[0][dir == PF_OUT][action != PF_PASS],
6830 1);
6831
6832 if (action == PF_PASS || r->action == PF_DROP) {
6833 dirndx = (dir == PF_OUT);
6834 pf_counter_u64_add_protected(&r->packets[dirndx], 1);
6835 pf_counter_u64_add_protected(&r->bytes[dirndx], pd.tot_len);
6836 if (a != NULL) {
6837 pf_counter_u64_add_protected(&a->packets[dirndx], 1);
6838 pf_counter_u64_add_protected(&a->bytes[dirndx], pd.tot_len);
6839 }
6840 if (s != NULL) {
6841 if (s->nat_rule.ptr != NULL) {
6842 pf_counter_u64_add_protected(&s->nat_rule.ptr->packets[dirndx],
6843 1);
6844 pf_counter_u64_add_protected(&s->nat_rule.ptr->bytes[dirndx],
6845 pd.tot_len);
6846 }
6847 if (s->src_node != NULL) {
6848 counter_u64_add(s->src_node->packets[dirndx],
6849 1);
6850 counter_u64_add(s->src_node->bytes[dirndx],
6851 pd.tot_len);
6852 }
6853 if (s->nat_src_node != NULL) {
6854 counter_u64_add(s->nat_src_node->packets[dirndx],
6855 1);
6856 counter_u64_add(s->nat_src_node->bytes[dirndx],
6857 pd.tot_len);
6858 }
6859 dirndx = (dir == s->direction) ? 0 : 1;
6860 s->packets[dirndx]++;
6861 s->bytes[dirndx] += pd.tot_len;
6862 }
6863 tr = r;
6864 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule;
6865 if (nr != NULL && r == &V_pf_default_rule)
6866 tr = nr;
6867 if (tr->src.addr.type == PF_ADDR_TABLE)
6868 pfr_update_stats(tr->src.addr.p.tbl,
6869 (s == NULL) ? pd.src :
6870 &s->key[(s->direction == PF_IN)]->
6871 addr[(s->direction == PF_OUT)],
6872 pd.af, pd.tot_len, dir == PF_OUT,
6873 r->action == PF_PASS, tr->src.neg);
6874 if (tr->dst.addr.type == PF_ADDR_TABLE)
6875 pfr_update_stats(tr->dst.addr.p.tbl,
6876 (s == NULL) ? pd.dst :
6877 &s->key[(s->direction == PF_IN)]->
6878 addr[(s->direction == PF_IN)],
6879 pd.af, pd.tot_len, dir == PF_OUT,
6880 r->action == PF_PASS, tr->dst.neg);
6881 }
6882 pf_counter_u64_critical_exit();
6883
6884 switch (action) {
6885 case PF_SYNPROXY_DROP:
6886 m_freem(*m0);
6887 case PF_DEFER:
6888 *m0 = NULL;
6889 action = PF_PASS;
6890 break;
6891 case PF_DROP:
6892 m_freem(*m0);
6893 *m0 = NULL;
6894 break;
6895 default:
6896 /* pf_route() returns unlocked. */
6897 if (r->rt) {
6898 pf_route(m0, r, dir, kif->pfik_ifp, s, &pd, inp);
6899 return (action);
6900 }
6901 break;
6902 }
6903
6904 SDT_PROBE4(pf, ip, test, done, action, reason, r, s);
6905
6906 if (s)
6907 PF_STATE_UNLOCK(s);
6908
6909 return (action);
6910 }
6911 #endif /* INET */
6912
6913 #ifdef INET6
6914 int
pf_test6(int dir,int pflags,struct ifnet * ifp,struct mbuf ** m0,struct inpcb * inp)6915 pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp)
6916 {
6917 struct pfi_kkif *kif;
6918 u_short action, reason = 0, log = 0;
6919 struct mbuf *m = *m0, *n = NULL;
6920 struct m_tag *mtag;
6921 struct ip6_hdr *h = NULL;
6922 struct pf_krule *a = NULL, *r = &V_pf_default_rule, *tr, *nr;
6923 struct pf_kstate *s = NULL;
6924 struct pf_kruleset *ruleset = NULL;
6925 struct pf_pdesc pd;
6926 int off, terminal = 0, dirndx, rh_cnt = 0, pqid = 0;
6927
6928 PF_RULES_RLOCK_TRACKER;
6929 KASSERT(dir == PF_IN || dir == PF_OUT, ("%s: bad direction %d\n", __func__, dir));
6930 M_ASSERTPKTHDR(m);
6931
6932 if (!V_pf_status.running)
6933 return (PF_PASS);
6934
6935 memset(&pd, 0, sizeof(pd));
6936 pd.pf_mtag = pf_find_mtag(m);
6937
6938 if (pd.pf_mtag && pd.pf_mtag->flags & PF_TAG_GENERATED)
6939 return (PF_PASS);
6940
6941 kif = (struct pfi_kkif *)ifp->if_pf_kif;
6942 if (kif == NULL) {
6943 DPFPRINTF(PF_DEBUG_URGENT,
6944 ("pf_test6: kif == NULL, if_xname %s\n", ifp->if_xname));
6945 return (PF_DROP);
6946 }
6947 if (kif->pfik_flags & PFI_IFLAG_SKIP)
6948 return (PF_PASS);
6949
6950 if (m->m_flags & M_SKIP_FIREWALL)
6951 return (PF_PASS);
6952
6953 PF_RULES_RLOCK();
6954
6955 /* We do IP header normalization and packet reassembly here */
6956 if (pf_normalize_ip6(m0, dir, kif, &reason, &pd) != PF_PASS) {
6957 action = PF_DROP;
6958 goto done;
6959 }
6960 m = *m0; /* pf_normalize messes with m0 */
6961 h = mtod(m, struct ip6_hdr *);
6962
6963 #if 1
6964 /*
6965 * we do not support jumbogram yet. if we keep going, zero ip6_plen
6966 * will do something bad, so drop the packet for now.
6967 */
6968 if (htons(h->ip6_plen) == 0) {
6969 action = PF_DROP;
6970 REASON_SET(&reason, PFRES_NORM); /*XXX*/
6971 goto done;
6972 }
6973 #endif
6974
6975 pd.src = (struct pf_addr *)&h->ip6_src;
6976 pd.dst = (struct pf_addr *)&h->ip6_dst;
6977 pd.sport = pd.dport = NULL;
6978 pd.ip_sum = NULL;
6979 pd.proto_sum = NULL;
6980 pd.dir = dir;
6981 pd.sidx = (dir == PF_IN) ? 0 : 1;
6982 pd.didx = (dir == PF_IN) ? 1 : 0;
6983 pd.af = AF_INET6;
6984 pd.tos = (ntohl(h->ip6_flow) >> 20) & 0xfc;
6985 pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
6986
6987 off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
6988 pd.proto = h->ip6_nxt;
6989 do {
6990 switch (pd.proto) {
6991 case IPPROTO_FRAGMENT:
6992 action = pf_test_fragment(&r, dir, kif, m, h,
6993 &pd, &a, &ruleset);
6994 if (action == PF_DROP)
6995 REASON_SET(&reason, PFRES_FRAG);
6996 goto done;
6997 case IPPROTO_ROUTING: {
6998 struct ip6_rthdr rthdr;
6999
7000 if (rh_cnt++) {
7001 DPFPRINTF(PF_DEBUG_MISC,
7002 ("pf: IPv6 more than one rthdr\n"));
7003 action = PF_DROP;
7004 REASON_SET(&reason, PFRES_IPOPTIONS);
7005 log = 1;
7006 goto done;
7007 }
7008 if (!pf_pull_hdr(m, off, &rthdr, sizeof(rthdr), NULL,
7009 &reason, pd.af)) {
7010 DPFPRINTF(PF_DEBUG_MISC,
7011 ("pf: IPv6 short rthdr\n"));
7012 action = PF_DROP;
7013 REASON_SET(&reason, PFRES_SHORT);
7014 log = 1;
7015 goto done;
7016 }
7017 if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
7018 DPFPRINTF(PF_DEBUG_MISC,
7019 ("pf: IPv6 rthdr0\n"));
7020 action = PF_DROP;
7021 REASON_SET(&reason, PFRES_IPOPTIONS);
7022 log = 1;
7023 goto done;
7024 }
7025 /* FALLTHROUGH */
7026 }
7027 case IPPROTO_AH:
7028 case IPPROTO_HOPOPTS:
7029 case IPPROTO_DSTOPTS: {
7030 /* get next header and header length */
7031 struct ip6_ext opt6;
7032
7033 if (!pf_pull_hdr(m, off, &opt6, sizeof(opt6),
7034 NULL, &reason, pd.af)) {
7035 DPFPRINTF(PF_DEBUG_MISC,
7036 ("pf: IPv6 short opt\n"));
7037 action = PF_DROP;
7038 log = 1;
7039 goto done;
7040 }
7041 if (pd.proto == IPPROTO_AH)
7042 off += (opt6.ip6e_len + 2) * 4;
7043 else
7044 off += (opt6.ip6e_len + 1) * 8;
7045 pd.proto = opt6.ip6e_nxt;
7046 /* goto the next header */
7047 break;
7048 }
7049 default:
7050 terminal++;
7051 break;
7052 }
7053 } while (!terminal);
7054
7055 /* if there's no routing header, use unmodified mbuf for checksumming */
7056 if (!n)
7057 n = m;
7058
7059 switch (pd.proto) {
7060
7061 case IPPROTO_TCP: {
7062 if (!pf_pull_hdr(m, off, &pd.hdr.tcp, sizeof(pd.hdr.tcp),
7063 &action, &reason, AF_INET6)) {
7064 log = action != PF_PASS;
7065 goto done;
7066 }
7067 pd.p_len = pd.tot_len - off - (pd.hdr.tcp.th_off << 2);
7068 action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
7069 if (action == PF_DROP)
7070 goto done;
7071 action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd,
7072 &reason);
7073 if (action == PF_PASS) {
7074 if (V_pfsync_update_state_ptr != NULL)
7075 V_pfsync_update_state_ptr(s);
7076 r = s->rule.ptr;
7077 a = s->anchor.ptr;
7078 log = s->log;
7079 } else if (s == NULL)
7080 action = pf_test_rule(&r, &s, dir, kif, m, off, &pd,
7081 &a, &ruleset, inp);
7082 break;
7083 }
7084
7085 case IPPROTO_UDP: {
7086 if (!pf_pull_hdr(m, off, &pd.hdr.udp, sizeof(pd.hdr.udp),
7087 &action, &reason, AF_INET6)) {
7088 log = action != PF_PASS;
7089 goto done;
7090 }
7091 if (pd.hdr.udp.uh_dport == 0 ||
7092 ntohs(pd.hdr.udp.uh_ulen) > m->m_pkthdr.len - off ||
7093 ntohs(pd.hdr.udp.uh_ulen) < sizeof(struct udphdr)) {
7094 action = PF_DROP;
7095 REASON_SET(&reason, PFRES_SHORT);
7096 goto done;
7097 }
7098 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd);
7099 if (action == PF_PASS) {
7100 if (V_pfsync_update_state_ptr != NULL)
7101 V_pfsync_update_state_ptr(s);
7102 r = s->rule.ptr;
7103 a = s->anchor.ptr;
7104 log = s->log;
7105 } else if (s == NULL)
7106 action = pf_test_rule(&r, &s, dir, kif, m, off, &pd,
7107 &a, &ruleset, inp);
7108 break;
7109 }
7110
7111 case IPPROTO_ICMP: {
7112 action = PF_DROP;
7113 DPFPRINTF(PF_DEBUG_MISC,
7114 ("pf: dropping IPv6 packet with ICMPv4 payload\n"));
7115 goto done;
7116 }
7117
7118 case IPPROTO_ICMPV6: {
7119 if (!pf_pull_hdr(m, off, &pd.hdr.icmp6, sizeof(pd.hdr.icmp6),
7120 &action, &reason, AF_INET6)) {
7121 log = action != PF_PASS;
7122 goto done;
7123 }
7124 action = pf_test_state_icmp(&s, dir, kif,
7125 m, off, h, &pd, &reason);
7126 if (action == PF_PASS) {
7127 if (V_pfsync_update_state_ptr != NULL)
7128 V_pfsync_update_state_ptr(s);
7129 r = s->rule.ptr;
7130 a = s->anchor.ptr;
7131 log = s->log;
7132 } else if (s == NULL)
7133 action = pf_test_rule(&r, &s, dir, kif, m, off, &pd,
7134 &a, &ruleset, inp);
7135 break;
7136 }
7137
7138 default:
7139 action = pf_test_state_other(&s, dir, kif, m, &pd);
7140 if (action == PF_PASS) {
7141 if (V_pfsync_update_state_ptr != NULL)
7142 V_pfsync_update_state_ptr(s);
7143 r = s->rule.ptr;
7144 a = s->anchor.ptr;
7145 log = s->log;
7146 } else if (s == NULL)
7147 action = pf_test_rule(&r, &s, dir, kif, m, off, &pd,
7148 &a, &ruleset, inp);
7149 break;
7150 }
7151
7152 done:
7153 PF_RULES_RUNLOCK();
7154 if (n != m) {
7155 m_freem(n);
7156 n = NULL;
7157 }
7158
7159 /* handle dangerous IPv6 extension headers. */
7160 if (action == PF_PASS && rh_cnt &&
7161 !((s && s->state_flags & PFSTATE_ALLOWOPTS) || r->allow_opts)) {
7162 action = PF_DROP;
7163 REASON_SET(&reason, PFRES_IPOPTIONS);
7164 log = r->log;
7165 DPFPRINTF(PF_DEBUG_MISC,
7166 ("pf: dropping packet with dangerous v6 headers\n"));
7167 }
7168
7169 if (s && s->tag > 0 && pf_tag_packet(m, &pd, s->tag)) {
7170 action = PF_DROP;
7171 REASON_SET(&reason, PFRES_MEMORY);
7172 }
7173 if (r->rtableid >= 0)
7174 M_SETFIB(m, r->rtableid);
7175
7176 if (r->scrub_flags & PFSTATE_SETPRIO) {
7177 if (pd.tos & IPTOS_LOWDELAY)
7178 pqid = 1;
7179 if (vlan_set_pcp(m, r->set_prio[pqid])) {
7180 action = PF_DROP;
7181 REASON_SET(&reason, PFRES_MEMORY);
7182 log = 1;
7183 DPFPRINTF(PF_DEBUG_MISC,
7184 ("pf: failed to allocate 802.1q mtag\n"));
7185 }
7186 }
7187
7188 #ifdef ALTQ
7189 if (s && s->qid) {
7190 pd.act.pqid = s->pqid;
7191 pd.act.qid = s->qid;
7192 } else if (r->qid) {
7193 pd.act.pqid = r->pqid;
7194 pd.act.qid = r->qid;
7195 }
7196 if (action == PF_PASS && pd.act.qid) {
7197 if (pd.pf_mtag == NULL &&
7198 ((pd.pf_mtag = pf_get_mtag(m)) == NULL)) {
7199 action = PF_DROP;
7200 REASON_SET(&reason, PFRES_MEMORY);
7201 } else {
7202 if (s != NULL)
7203 pd.pf_mtag->qid_hash = pf_state_hash(s);
7204 if (pd.tos & IPTOS_LOWDELAY)
7205 pd.pf_mtag->qid = pd.act.pqid;
7206 else
7207 pd.pf_mtag->qid = pd.act.qid;
7208 /* Add hints for ecn. */
7209 pd.pf_mtag->hdr = h;
7210 }
7211 }
7212 #endif /* ALTQ */
7213
7214 if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP ||
7215 pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL &&
7216 (s->nat_rule.ptr->action == PF_RDR ||
7217 s->nat_rule.ptr->action == PF_BINAT) &&
7218 IN6_IS_ADDR_LOOPBACK(&pd.dst->v6))
7219 m->m_flags |= M_SKIP_FIREWALL;
7220
7221 /* XXX: Anybody working on it?! */
7222 if (r->divert.port)
7223 printf("pf: divert(9) is not supported for IPv6\n");
7224
7225 if (log) {
7226 struct pf_krule *lr;
7227
7228 if (s != NULL && s->nat_rule.ptr != NULL &&
7229 s->nat_rule.ptr->log & PF_LOG_ALL)
7230 lr = s->nat_rule.ptr;
7231 else
7232 lr = r;
7233 PFLOG_PACKET(kif, m, AF_INET6, dir, reason, lr, a, ruleset,
7234 &pd, (s == NULL));
7235 }
7236
7237 pf_counter_u64_critical_enter();
7238 pf_counter_u64_add_protected(&kif->pfik_bytes[1][dir == PF_OUT][action != PF_PASS],
7239 pd.tot_len);
7240 pf_counter_u64_add_protected(&kif->pfik_packets[1][dir == PF_OUT][action != PF_PASS],
7241 1);
7242
7243 if (action == PF_PASS || r->action == PF_DROP) {
7244 dirndx = (dir == PF_OUT);
7245 pf_counter_u64_add_protected(&r->packets[dirndx], 1);
7246 pf_counter_u64_add_protected(&r->bytes[dirndx], pd.tot_len);
7247 if (a != NULL) {
7248 pf_counter_u64_add_protected(&a->packets[dirndx], 1);
7249 pf_counter_u64_add_protected(&a->bytes[dirndx], pd.tot_len);
7250 }
7251 if (s != NULL) {
7252 if (s->nat_rule.ptr != NULL) {
7253 pf_counter_u64_add_protected(&s->nat_rule.ptr->packets[dirndx],
7254 1);
7255 pf_counter_u64_add_protected(&s->nat_rule.ptr->bytes[dirndx],
7256 pd.tot_len);
7257 }
7258 if (s->src_node != NULL) {
7259 counter_u64_add(s->src_node->packets[dirndx],
7260 1);
7261 counter_u64_add(s->src_node->bytes[dirndx],
7262 pd.tot_len);
7263 }
7264 if (s->nat_src_node != NULL) {
7265 counter_u64_add(s->nat_src_node->packets[dirndx],
7266 1);
7267 counter_u64_add(s->nat_src_node->bytes[dirndx],
7268 pd.tot_len);
7269 }
7270 dirndx = (dir == s->direction) ? 0 : 1;
7271 s->packets[dirndx]++;
7272 s->bytes[dirndx] += pd.tot_len;
7273 }
7274 tr = r;
7275 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule;
7276 if (nr != NULL && r == &V_pf_default_rule)
7277 tr = nr;
7278 if (tr->src.addr.type == PF_ADDR_TABLE)
7279 pfr_update_stats(tr->src.addr.p.tbl,
7280 (s == NULL) ? pd.src :
7281 &s->key[(s->direction == PF_IN)]->addr[0],
7282 pd.af, pd.tot_len, dir == PF_OUT,
7283 r->action == PF_PASS, tr->src.neg);
7284 if (tr->dst.addr.type == PF_ADDR_TABLE)
7285 pfr_update_stats(tr->dst.addr.p.tbl,
7286 (s == NULL) ? pd.dst :
7287 &s->key[(s->direction == PF_IN)]->addr[1],
7288 pd.af, pd.tot_len, dir == PF_OUT,
7289 r->action == PF_PASS, tr->dst.neg);
7290 }
7291 pf_counter_u64_critical_exit();
7292
7293 switch (action) {
7294 case PF_SYNPROXY_DROP:
7295 m_freem(*m0);
7296 case PF_DEFER:
7297 *m0 = NULL;
7298 action = PF_PASS;
7299 break;
7300 case PF_DROP:
7301 m_freem(*m0);
7302 *m0 = NULL;
7303 break;
7304 default:
7305 /* pf_route6() returns unlocked. */
7306 if (r->rt) {
7307 pf_route6(m0, r, dir, kif->pfik_ifp, s, &pd, inp);
7308 return (action);
7309 }
7310 break;
7311 }
7312
7313 if (s)
7314 PF_STATE_UNLOCK(s);
7315
7316 /* If reassembled packet passed, create new fragments. */
7317 if (action == PF_PASS && *m0 && (pflags & PFIL_FWD) &&
7318 (mtag = m_tag_find(m, PF_REASSEMBLED, NULL)) != NULL)
7319 action = pf_refragment6(ifp, m0, mtag);
7320
7321 SDT_PROBE4(pf, ip, test6, done, action, reason, r, s);
7322
7323 return (action);
7324 }
7325 #endif /* INET6 */
7326