1 /**	$MirOS: src/sys/net/pf_norm.c,v 1.8 2006/10/17 20:48:51 tg Exp $ */
2 /*	$OpenBSD: pf_norm.c,v 1.87 2004/05/11 07:34:11 dhartmei Exp $ */
3 
4 /*
5  * Copyright 2001 Niels Provos <provos@citi.umich.edu>
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 #include "pflog.h"
30 
31 #include <sys/param.h>
32 #include <sys/systm.h>
33 #include <sys/mbuf.h>
34 #include <sys/filio.h>
35 #include <sys/fcntl.h>
36 #include <sys/socket.h>
37 #include <sys/kernel.h>
38 #include <sys/time.h>
39 #include <sys/pool.h>
40 
41 #include <dev/rndvar.h>
42 #include <net/if.h>
43 #include <net/if_types.h>
44 #include <net/bpf.h>
45 #include <net/route.h>
46 #include <net/if_pflog.h>
47 
48 #include <netinet/in.h>
49 #include <netinet/in_var.h>
50 #include <netinet/in_systm.h>
51 #include <netinet/ip.h>
52 #include <netinet/ip_var.h>
53 #include <netinet/tcp.h>
54 #include <netinet/tcp_seq.h>
55 #include <netinet/udp.h>
56 #include <netinet/ip_icmp.h>
57 
58 #ifdef INET6
59 #include <netinet/ip6.h>
60 #endif /* INET6 */
61 
62 #include <net/pfvar.h>
63 
64 struct pf_frent {
65 	LIST_ENTRY(pf_frent) fr_next;
66 	struct ip *fr_ip;
67 	struct mbuf *fr_m;
68 };
69 
70 struct pf_frcache {
71 	LIST_ENTRY(pf_frcache) fr_next;
72 	uint16_t	fr_off;
73 	uint16_t	fr_end;
74 };
75 
76 #define PFFRAG_SEENLAST	0x0001		/* Seen the last fragment for this */
77 #define PFFRAG_NOBUFFER	0x0002		/* Non-buffering fragment cache */
78 #define PFFRAG_DROP	0x0004		/* Drop all fragments */
79 #define BUFFER_FRAGMENTS(fr)	(!((fr)->fr_flags & PFFRAG_NOBUFFER))
80 
81 struct pf_fragment {
82 	RB_ENTRY(pf_fragment) fr_entry;
83 	TAILQ_ENTRY(pf_fragment) frag_next;
84 	struct in_addr	fr_src;
85 	struct in_addr	fr_dst;
86 	u_int8_t	fr_p;		/* protocol of this fragment */
87 	u_int8_t	fr_flags;	/* status flags */
88 	u_int16_t	fr_id;		/* fragment id for reassemble */
89 	u_int16_t	fr_max;		/* fragment data max */
90 	u_int32_t	fr_timeout;	/* XXX time_t vs uint32_t */
91 #define fr_queue	fr_u.fru_queue
92 #define fr_cache	fr_u.fru_cache
93 	union {
94 		LIST_HEAD(pf_fragq, pf_frent) fru_queue;	/* buffering */
95 		LIST_HEAD(pf_cacheq, pf_frcache) fru_cache;	/* non-buf */
96 	} fr_u;
97 };
98 
99 TAILQ_HEAD(pf_fragqueue, pf_fragment)	pf_fragqueue;
100 TAILQ_HEAD(pf_cachequeue, pf_fragment)	pf_cachequeue;
101 
102 static __inline int	 pf_frag_compare(struct pf_fragment *,
103 			    struct pf_fragment *);
104 RB_HEAD(pf_frag_tree, pf_fragment)	pf_frag_tree, pf_cache_tree;
105 RB_PROTOTYPE(pf_frag_tree, pf_fragment, fr_entry, pf_frag_compare);
106 RB_GENERATE(pf_frag_tree, pf_fragment, fr_entry, pf_frag_compare);
107 
108 /* Private prototypes */
109 void			 pf_ip2key(struct pf_fragment *, struct ip *);
110 void			 pf_remove_fragment(struct pf_fragment *);
111 void			 pf_flush_fragments(void);
112 void			 pf_free_fragment(struct pf_fragment *);
113 struct pf_fragment	*pf_find_fragment(struct ip *, struct pf_frag_tree *);
114 struct mbuf		*pf_reassemble(struct mbuf **, struct pf_fragment **,
115 			    struct pf_frent *, int);
116 struct mbuf		*pf_fragcache(struct mbuf **, struct ip*,
117 			    struct pf_fragment **, int, int, int *);
118 int			 pf_normalize_tcpopt(struct pf_rule *, struct mbuf *,
119 			    struct tcphdr *, int);
120 
121 #define	DPFPRINTF(x) do {				\
122 	if (pf_status.debug >= PF_DEBUG_MISC) {		\
123 		printf("%s: ", __func__);		\
124 		printf x ;				\
125 	}						\
126 } while(0)
127 
128 /* Globals */
129 struct pool		 pf_frent_pl, pf_frag_pl, pf_cache_pl, pf_cent_pl;
130 struct pool		 pf_state_scrub_pl;
131 int			 pf_nfrents, pf_ncache;
132 
133 void
pf_normalize_init(void)134 pf_normalize_init(void)
135 {
136 	pool_init(&pf_frent_pl, sizeof(struct pf_frent), 0, 0, 0, "pffrent",
137 	    NULL);
138 	pool_init(&pf_frag_pl, sizeof(struct pf_fragment), 0, 0, 0, "pffrag",
139 	    NULL);
140 	pool_init(&pf_cache_pl, sizeof(struct pf_fragment), 0, 0, 0,
141 	    "pffrcache", NULL);
142 	pool_init(&pf_cent_pl, sizeof(struct pf_frcache), 0, 0, 0, "pffrcent",
143 	    NULL);
144 	pool_init(&pf_state_scrub_pl, sizeof(struct pf_state_scrub), 0, 0, 0,
145 	    "pfstscr", NULL);
146 
147 	pool_sethiwat(&pf_frag_pl, PFFRAG_FRAG_HIWAT);
148 	pool_sethardlimit(&pf_frent_pl, PFFRAG_FRENT_HIWAT, NULL, 0);
149 	pool_sethardlimit(&pf_cache_pl, PFFRAG_FRCACHE_HIWAT, NULL, 0);
150 	pool_sethardlimit(&pf_cent_pl, PFFRAG_FRCENT_HIWAT, NULL, 0);
151 
152 	TAILQ_INIT(&pf_fragqueue);
153 	TAILQ_INIT(&pf_cachequeue);
154 }
155 
156 static __inline int
pf_frag_compare(struct pf_fragment * a,struct pf_fragment * b)157 pf_frag_compare(struct pf_fragment *a, struct pf_fragment *b)
158 {
159 	int	diff;
160 
161 	if ((diff = a->fr_id - b->fr_id))
162 		return (diff);
163 	else if ((diff = a->fr_p - b->fr_p))
164 		return (diff);
165 	else if (a->fr_src.s_addr < b->fr_src.s_addr)
166 		return (-1);
167 	else if (a->fr_src.s_addr > b->fr_src.s_addr)
168 		return (1);
169 	else if (a->fr_dst.s_addr < b->fr_dst.s_addr)
170 		return (-1);
171 	else if (a->fr_dst.s_addr > b->fr_dst.s_addr)
172 		return (1);
173 	return (0);
174 }
175 
176 void
pf_purge_expired_fragments(void)177 pf_purge_expired_fragments(void)
178 {
179 	struct pf_fragment	*frag;
180 	u_int32_t		 expire = time.tv_sec -
181 				    pf_default_rule.timeout[PFTM_FRAG];
182 
183 	while ((frag = TAILQ_LAST(&pf_fragqueue, pf_fragqueue)) != NULL) {
184 		KASSERT(BUFFER_FRAGMENTS(frag));
185 		if (frag->fr_timeout > expire)
186 			break;
187 
188 		DPFPRINTF(("expiring %d(%p)\n", frag->fr_id, frag));
189 		pf_free_fragment(frag);
190 	}
191 
192 	while ((frag = TAILQ_LAST(&pf_cachequeue, pf_cachequeue)) != NULL) {
193 		KASSERT(!BUFFER_FRAGMENTS(frag));
194 		if (frag->fr_timeout > expire)
195 			break;
196 
197 		DPFPRINTF(("expiring %d(%p)\n", frag->fr_id, frag));
198 		pf_free_fragment(frag);
199 		KASSERT(TAILQ_EMPTY(&pf_cachequeue) ||
200 		    TAILQ_LAST(&pf_cachequeue, pf_cachequeue) != frag);
201 	}
202 }
203 
204 /*
205  * Try to flush old fragments to make space for new ones
206  */
207 
208 void
pf_flush_fragments(void)209 pf_flush_fragments(void)
210 {
211 	struct pf_fragment	*frag;
212 	int			 goal;
213 
214 	goal = pf_nfrents * 9 / 10;
215 	DPFPRINTF(("trying to free > %d frents\n",
216 	    pf_nfrents - goal));
217 	while (goal < pf_nfrents) {
218 		frag = TAILQ_LAST(&pf_fragqueue, pf_fragqueue);
219 		if (frag == NULL)
220 			break;
221 		pf_free_fragment(frag);
222 	}
223 
224 
225 	goal = pf_ncache * 9 / 10;
226 	DPFPRINTF(("trying to free > %d cache entries\n",
227 	    pf_ncache - goal));
228 	while (goal < pf_ncache) {
229 		frag = TAILQ_LAST(&pf_cachequeue, pf_cachequeue);
230 		if (frag == NULL)
231 			break;
232 		pf_free_fragment(frag);
233 	}
234 }
235 
236 /* Frees the fragments and all associated entries */
237 
238 void
pf_free_fragment(struct pf_fragment * frag)239 pf_free_fragment(struct pf_fragment *frag)
240 {
241 	struct pf_frent		*frent;
242 	struct pf_frcache	*frcache;
243 
244 	/* Free all fragments */
245 	if (BUFFER_FRAGMENTS(frag)) {
246 		for (frent = LIST_FIRST(&frag->fr_queue); frent;
247 		    frent = LIST_FIRST(&frag->fr_queue)) {
248 			LIST_REMOVE(frent, fr_next);
249 
250 			m_freem(frent->fr_m);
251 			pool_put(&pf_frent_pl, frent);
252 			pf_nfrents--;
253 		}
254 	} else {
255 		for (frcache = LIST_FIRST(&frag->fr_cache); frcache;
256 		    frcache = LIST_FIRST(&frag->fr_cache)) {
257 			LIST_REMOVE(frcache, fr_next);
258 
259 			KASSERT(LIST_EMPTY(&frag->fr_cache) ||
260 			    LIST_FIRST(&frag->fr_cache)->fr_off >
261 			    frcache->fr_end);
262 
263 			pool_put(&pf_cent_pl, frcache);
264 			pf_ncache--;
265 		}
266 	}
267 
268 	pf_remove_fragment(frag);
269 }
270 
271 void
pf_ip2key(struct pf_fragment * key,struct ip * ip)272 pf_ip2key(struct pf_fragment *key, struct ip *ip)
273 {
274 	key->fr_p = ip->ip_p;
275 	key->fr_id = ip->ip_id;
276 	key->fr_src.s_addr = ip->ip_src.s_addr;
277 	key->fr_dst.s_addr = ip->ip_dst.s_addr;
278 }
279 
280 struct pf_fragment *
pf_find_fragment(struct ip * ip,struct pf_frag_tree * tree)281 pf_find_fragment(struct ip *ip, struct pf_frag_tree *tree)
282 {
283 	struct pf_fragment	 key;
284 	struct pf_fragment	*frag;
285 
286 	pf_ip2key(&key, ip);
287 
288 	frag = RB_FIND(pf_frag_tree, tree, &key);
289 	if (frag != NULL) {
290 		/* XXX Are we sure we want to update the timeout? */
291 		frag->fr_timeout = time.tv_sec;
292 		if (BUFFER_FRAGMENTS(frag)) {
293 			TAILQ_REMOVE(&pf_fragqueue, frag, frag_next);
294 			TAILQ_INSERT_HEAD(&pf_fragqueue, frag, frag_next);
295 		} else {
296 			TAILQ_REMOVE(&pf_cachequeue, frag, frag_next);
297 			TAILQ_INSERT_HEAD(&pf_cachequeue, frag, frag_next);
298 		}
299 	}
300 
301 	return (frag);
302 }
303 
304 /* Removes a fragment from the fragment queue and frees the fragment */
305 
306 void
pf_remove_fragment(struct pf_fragment * frag)307 pf_remove_fragment(struct pf_fragment *frag)
308 {
309 	if (BUFFER_FRAGMENTS(frag)) {
310 		RB_REMOVE(pf_frag_tree, &pf_frag_tree, frag);
311 		TAILQ_REMOVE(&pf_fragqueue, frag, frag_next);
312 		pool_put(&pf_frag_pl, frag);
313 	} else {
314 		RB_REMOVE(pf_frag_tree, &pf_cache_tree, frag);
315 		TAILQ_REMOVE(&pf_cachequeue, frag, frag_next);
316 		pool_put(&pf_cache_pl, frag);
317 	}
318 }
319 
320 #define FR_IP_OFF(fr)	((ntohs((fr)->fr_ip->ip_off) & IP_OFFMASK) << 3)
321 struct mbuf *
pf_reassemble(struct mbuf ** m0,struct pf_fragment ** frag,struct pf_frent * frent,int mff)322 pf_reassemble(struct mbuf **m0, struct pf_fragment **frag,
323     struct pf_frent *frent, int mff)
324 {
325 	struct mbuf	*m = *m0, *m2;
326 	struct pf_frent	*frea, *next;
327 	struct pf_frent	*frep = NULL;
328 	struct ip	*ip = frent->fr_ip;
329 	int		 hlen = ip->ip_hl << 2;
330 	u_int16_t	 off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3;
331 	u_int16_t	 ip_len = ntohs(ip->ip_len) - ip->ip_hl * 4;
332 	u_int16_t	 max = ip_len + off;
333 
334 	KASSERT(*frag == NULL || BUFFER_FRAGMENTS(*frag));
335 
336 	/* Strip off ip header */
337 	m->m_data += hlen;
338 	m->m_len -= hlen;
339 
340 	/* Create a new reassembly queue for this packet */
341 	if (*frag == NULL) {
342 		*frag = pool_get(&pf_frag_pl, PR_NOWAIT);
343 		if (*frag == NULL) {
344 			pf_flush_fragments();
345 			*frag = pool_get(&pf_frag_pl, PR_NOWAIT);
346 			if (*frag == NULL)
347 				goto drop_fragment;
348 		}
349 
350 		(*frag)->fr_flags = 0;
351 		(*frag)->fr_max = 0;
352 		(*frag)->fr_src = frent->fr_ip->ip_src;
353 		(*frag)->fr_dst = frent->fr_ip->ip_dst;
354 		(*frag)->fr_p = frent->fr_ip->ip_p;
355 		(*frag)->fr_id = frent->fr_ip->ip_id;
356 		(*frag)->fr_timeout = time.tv_sec;
357 		LIST_INIT(&(*frag)->fr_queue);
358 
359 		RB_INSERT(pf_frag_tree, &pf_frag_tree, *frag);
360 		TAILQ_INSERT_HEAD(&pf_fragqueue, *frag, frag_next);
361 
362 		/* We do not have a previous fragment */
363 		frep = NULL;
364 		goto insert;
365 	}
366 
367 	/*
368 	 * Find a fragment after the current one:
369 	 *  - off contains the real shifted offset.
370 	 */
371 	LIST_FOREACH(frea, &(*frag)->fr_queue, fr_next) {
372 		if (FR_IP_OFF(frea) > off)
373 			break;
374 		frep = frea;
375 	}
376 
377 	KASSERT(frep != NULL || frea != NULL);
378 
379 	if (frep != NULL &&
380 	    FR_IP_OFF(frep) + ntohs(frep->fr_ip->ip_len) - frep->fr_ip->ip_hl *
381 	    4 > off)
382 	{
383 		u_int16_t	precut;
384 
385 		precut = FR_IP_OFF(frep) + ntohs(frep->fr_ip->ip_len) -
386 		    frep->fr_ip->ip_hl * 4 - off;
387 		if (precut >= ip_len)
388 			goto drop_fragment;
389 		m_adj(frent->fr_m, precut);
390 		DPFPRINTF(("overlap -%d\n", precut));
391 		/* Enforce 8 byte boundaries */
392 		ip->ip_off = htons(ntohs(ip->ip_off) + (precut >> 3));
393 		off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3;
394 		ip_len -= precut;
395 		ip->ip_len = htons(ip_len);
396 	}
397 
398 	for (; frea != NULL && ip_len + off > FR_IP_OFF(frea);
399 	    frea = next)
400 	{
401 		u_int16_t	aftercut;
402 
403 		aftercut = ip_len + off - FR_IP_OFF(frea);
404 		DPFPRINTF(("adjust overlap %d\n", aftercut));
405 		if (aftercut < ntohs(frea->fr_ip->ip_len) - frea->fr_ip->ip_hl
406 		    * 4)
407 		{
408 			frea->fr_ip->ip_len =
409 			    htons(ntohs(frea->fr_ip->ip_len) - aftercut);
410 			frea->fr_ip->ip_off = htons(ntohs(frea->fr_ip->ip_off) +
411 			    (aftercut >> 3));
412 			m_adj(frea->fr_m, aftercut);
413 			break;
414 		}
415 
416 		/* This fragment is completely overlapped, loose it */
417 		next = LIST_NEXT(frea, fr_next);
418 		m_freem(frea->fr_m);
419 		LIST_REMOVE(frea, fr_next);
420 		pool_put(&pf_frent_pl, frea);
421 		pf_nfrents--;
422 	}
423 
424  insert:
425 	/* Update maximum data size */
426 	if ((*frag)->fr_max < max)
427 		(*frag)->fr_max = max;
428 	/* This is the last segment */
429 	if (!mff)
430 		(*frag)->fr_flags |= PFFRAG_SEENLAST;
431 
432 	if (frep == NULL)
433 		LIST_INSERT_HEAD(&(*frag)->fr_queue, frent, fr_next);
434 	else
435 		LIST_INSERT_AFTER(frep, frent, fr_next);
436 
437 	/* Check if we are completely reassembled */
438 	if (!((*frag)->fr_flags & PFFRAG_SEENLAST))
439 		return (NULL);
440 
441 	/* Check if we have all the data */
442 	off = 0;
443 	for (frep = LIST_FIRST(&(*frag)->fr_queue); frep; frep = next) {
444 		next = LIST_NEXT(frep, fr_next);
445 
446 		off += ntohs(frep->fr_ip->ip_len) - frep->fr_ip->ip_hl * 4;
447 		if (off < (*frag)->fr_max &&
448 		    (next == NULL || FR_IP_OFF(next) != off))
449 		{
450 			DPFPRINTF(("missing fragment at %d, next %d, max %d\n",
451 			    off, next == NULL ? -1 : FR_IP_OFF(next),
452 			    (*frag)->fr_max));
453 			return (NULL);
454 		}
455 	}
456 	DPFPRINTF(("%d < %d?\n", off, (*frag)->fr_max));
457 	if (off < (*frag)->fr_max)
458 		return (NULL);
459 
460 	/* We have all the data */
461 	frent = LIST_FIRST(&(*frag)->fr_queue);
462 	KASSERT(frent != NULL);
463 	if ((frent->fr_ip->ip_hl << 2) + off > IP_MAXPACKET) {
464 		DPFPRINTF(("drop: too big: %d\n", off));
465 		pf_free_fragment(*frag);
466 		*frag = NULL;
467 		return (NULL);
468 	}
469 	next = LIST_NEXT(frent, fr_next);
470 
471 	/* Magic from ip_input */
472 	ip = frent->fr_ip;
473 	m = frent->fr_m;
474 	m2 = m->m_next;
475 	m->m_next = NULL;
476 	m_cat(m, m2);
477 	pool_put(&pf_frent_pl, frent);
478 	pf_nfrents--;
479 	for (frent = next; frent != NULL; frent = next) {
480 		next = LIST_NEXT(frent, fr_next);
481 
482 		m2 = frent->fr_m;
483 		pool_put(&pf_frent_pl, frent);
484 		pf_nfrents--;
485 		m_cat(m, m2);
486 	}
487 
488 	ip->ip_src = (*frag)->fr_src;
489 	ip->ip_dst = (*frag)->fr_dst;
490 
491 	/* Remove from fragment queue */
492 	pf_remove_fragment(*frag);
493 	*frag = NULL;
494 
495 	hlen = ip->ip_hl << 2;
496 	ip->ip_len = htons(off + hlen);
497 	m->m_len += hlen;
498 	m->m_data -= hlen;
499 
500 	/* some debugging cruft by sklower, below, will go away soon */
501 	/* XXX this should be done elsewhere */
502 	if (m->m_flags & M_PKTHDR) {
503 		int plen = 0;
504 		for (m2 = m; m2; m2 = m2->m_next)
505 			plen += m2->m_len;
506 		m->m_pkthdr.len = plen;
507 	}
508 
509 	DPFPRINTF(("complete: %p(%d)\n", m, ntohs(ip->ip_len)));
510 	return (m);
511 
512  drop_fragment:
513 	/* Oops - fail safe - drop packet */
514 	pool_put(&pf_frent_pl, frent);
515 	pf_nfrents--;
516 	m_freem(m);
517 	return (NULL);
518 }
519 
520 struct mbuf *
pf_fragcache(struct mbuf ** m0,struct ip * h,struct pf_fragment ** frag,int mff,int drop,int * nomem)521 pf_fragcache(struct mbuf **m0, struct ip *h, struct pf_fragment **frag, int mff,
522     int drop, int *nomem)
523 {
524 	struct mbuf		*m = *m0;
525 	struct pf_frcache	*frp, *fra, *cur = NULL;
526 	int			 ip_len = ntohs(h->ip_len) - (h->ip_hl << 2);
527 	u_int16_t		 off = ntohs(h->ip_off) << 3;
528 	u_int16_t		 max = ip_len + off;
529 	int			 hosed = 0;
530 
531 	KASSERT(*frag == NULL || !BUFFER_FRAGMENTS(*frag));
532 
533 	/* Create a new range queue for this packet */
534 	if (*frag == NULL) {
535 		*frag = pool_get(&pf_cache_pl, PR_NOWAIT);
536 		if (*frag == NULL) {
537 			pf_flush_fragments();
538 			*frag = pool_get(&pf_cache_pl, PR_NOWAIT);
539 			if (*frag == NULL)
540 				goto no_mem;
541 		}
542 
543 		/* Get an entry for the queue */
544 		cur = pool_get(&pf_cent_pl, PR_NOWAIT);
545 		if (cur == NULL) {
546 			pool_put(&pf_cache_pl, *frag);
547 			*frag = NULL;
548 			goto no_mem;
549 		}
550 		pf_ncache++;
551 
552 		(*frag)->fr_flags = PFFRAG_NOBUFFER;
553 		(*frag)->fr_max = 0;
554 		(*frag)->fr_src = h->ip_src;
555 		(*frag)->fr_dst = h->ip_dst;
556 		(*frag)->fr_p = h->ip_p;
557 		(*frag)->fr_id = h->ip_id;
558 		(*frag)->fr_timeout = time.tv_sec;
559 
560 		cur->fr_off = off;
561 		cur->fr_end = max;
562 		LIST_INIT(&(*frag)->fr_cache);
563 		LIST_INSERT_HEAD(&(*frag)->fr_cache, cur, fr_next);
564 
565 		RB_INSERT(pf_frag_tree, &pf_cache_tree, *frag);
566 		TAILQ_INSERT_HEAD(&pf_cachequeue, *frag, frag_next);
567 
568 		DPFPRINTF(("fragcache[%d]: new %d-%d\n", h->ip_id, off, max));
569 
570 		goto pass;
571 	}
572 
573 	/*
574 	 * Find a fragment after the current one:
575 	 *  - off contains the real shifted offset.
576 	 */
577 	frp = NULL;
578 	LIST_FOREACH(fra, &(*frag)->fr_cache, fr_next) {
579 		if (fra->fr_off > off)
580 			break;
581 		frp = fra;
582 	}
583 
584 	KASSERT(frp != NULL || fra != NULL);
585 
586 	if (frp != NULL) {
587 		int	precut;
588 
589 		precut = frp->fr_end - off;
590 		if (precut >= ip_len) {
591 			/* Fragment is entirely a duplicate */
592 			DPFPRINTF(("fragcache[%d]: dead (%d-%d) %d-%d\n",
593 			    h->ip_id, frp->fr_off, frp->fr_end, off, max));
594 			goto drop_fragment;
595 		}
596 		if (precut == 0) {
597 			/* They are adjacent.  Fixup cache entry */
598 			DPFPRINTF(("fragcache[%d]: adjacent (%d-%d) %d-%d\n",
599 			    h->ip_id, frp->fr_off, frp->fr_end, off, max));
600 			frp->fr_end = max;
601 		} else if (precut > 0) {
602 			/* The first part of this payload overlaps with a
603 			 * fragment that has already been passed.
604 			 * Need to trim off the first part of the payload.
605 			 * But to do so easily, we need to create another
606 			 * mbuf to throw the original header into.
607 			 */
608 
609 			DPFPRINTF(("fragcache[%d]: chop %d (%d-%d) %d-%d\n",
610 			    h->ip_id, precut, frp->fr_off, frp->fr_end, off,
611 			    max));
612 
613 			off += precut;
614 			max -= precut;
615 			/* Update the previous frag to encompass this one */
616 			frp->fr_end = max;
617 
618 			if (!drop) {
619 				/* XXX Optimization opportunity
620 				 * This is a very heavy way to trim the payload.
621 				 * we could do it much faster by diddling mbuf
622 				 * internals but that would be even less legible
623 				 * than this mbuf magic.  For my next trick,
624 				 * I'll pull a rabbit out of my laptop.
625 				 */
626 				*m0 = m_copym2(m, 0, h->ip_hl << 2, M_NOWAIT);
627 				if (*m0 == NULL)
628 					goto no_mem;
629 				KASSERT((*m0)->m_next == NULL);
630 				m_adj(m, precut + (h->ip_hl << 2));
631 				m_cat(*m0, m);
632 				m = *m0;
633 				if (m->m_flags & M_PKTHDR) {
634 					int plen = 0;
635 					struct mbuf *t;
636 					for (t = m; t; t = t->m_next)
637 						plen += t->m_len;
638 					m->m_pkthdr.len = plen;
639 				}
640 
641 
642 				h = mtod(m, struct ip *);
643 
644 
645 				KASSERT((int)m->m_len ==
646 				    ntohs(h->ip_len) - precut);
647 				h->ip_off = htons(ntohs(h->ip_off) +
648 				    (precut >> 3));
649 				h->ip_len = htons(ntohs(h->ip_len) - precut);
650 			} else {
651 				hosed++;
652 			}
653 		} else {
654 			/* There is a gap between fragments */
655 
656 			DPFPRINTF(("fragcache[%d]: gap %d (%d-%d) %d-%d\n",
657 			    h->ip_id, -precut, frp->fr_off, frp->fr_end, off,
658 			    max));
659 
660 			cur = pool_get(&pf_cent_pl, PR_NOWAIT);
661 			if (cur == NULL)
662 				goto no_mem;
663 			pf_ncache++;
664 
665 			cur->fr_off = off;
666 			cur->fr_end = max;
667 			LIST_INSERT_AFTER(frp, cur, fr_next);
668 		}
669 	}
670 
671 	if (fra != NULL) {
672 		int	aftercut;
673 		int	merge = 0;
674 
675 		aftercut = max - fra->fr_off;
676 		if (aftercut == 0) {
677 			/* Adjacent fragments */
678 			DPFPRINTF(("fragcache[%d]: adjacent %d-%d (%d-%d)\n",
679 			    h->ip_id, off, max, fra->fr_off, fra->fr_end));
680 			fra->fr_off = off;
681 			merge = 1;
682 		} else if (aftercut > 0) {
683 			/* Need to chop off the tail of this fragment */
684 			DPFPRINTF(("fragcache[%d]: chop %d %d-%d (%d-%d)\n",
685 			    h->ip_id, aftercut, off, max, fra->fr_off,
686 			    fra->fr_end));
687 			fra->fr_off = off;
688 			max -= aftercut;
689 
690 			merge = 1;
691 
692 			if (!drop) {
693 				m_adj(m, -aftercut);
694 				if (m->m_flags & M_PKTHDR) {
695 					int plen = 0;
696 					struct mbuf *t;
697 					for (t = m; t; t = t->m_next)
698 						plen += t->m_len;
699 					m->m_pkthdr.len = plen;
700 				}
701 				h = mtod(m, struct ip *);
702 				KASSERT((int)m->m_len ==
703 				    ntohs(h->ip_len) - aftercut);
704 				h->ip_len = htons(ntohs(h->ip_len) - aftercut);
705 			} else {
706 				hosed++;
707 			}
708 		} else {
709 			/* There is a gap between fragments */
710 			DPFPRINTF(("fragcache[%d]: gap %d %d-%d (%d-%d)\n",
711 			    h->ip_id, -aftercut, off, max, fra->fr_off,
712 			    fra->fr_end));
713 
714 			cur = pool_get(&pf_cent_pl, PR_NOWAIT);
715 			if (cur == NULL)
716 				goto no_mem;
717 			pf_ncache++;
718 
719 			cur->fr_off = off;
720 			cur->fr_end = max;
721 			LIST_INSERT_BEFORE(fra, cur, fr_next);
722 		}
723 
724 
725 		/* Need to glue together two separate fragment descriptors */
726 		if (merge) {
727 			if (cur && fra->fr_off <= cur->fr_end) {
728 				/* Need to merge in a previous 'cur' */
729 				DPFPRINTF(("fragcache[%d]: adjacent(merge "
730 				    "%d-%d) %d-%d (%d-%d)\n",
731 				    h->ip_id, cur->fr_off, cur->fr_end, off,
732 				    max, fra->fr_off, fra->fr_end));
733 				fra->fr_off = cur->fr_off;
734 				LIST_REMOVE(cur, fr_next);
735 				pool_put(&pf_cent_pl, cur);
736 				pf_ncache--;
737 				cur = NULL;
738 
739 			} else if (frp && fra->fr_off <= frp->fr_end) {
740 				/* Need to merge in a modified 'frp' */
741 				KASSERT(cur == NULL);
742 				DPFPRINTF(("fragcache[%d]: adjacent(merge "
743 				    "%d-%d) %d-%d (%d-%d)\n",
744 				    h->ip_id, frp->fr_off, frp->fr_end, off,
745 				    max, fra->fr_off, fra->fr_end));
746 				fra->fr_off = frp->fr_off;
747 				LIST_REMOVE(frp, fr_next);
748 				pool_put(&pf_cent_pl, frp);
749 				pf_ncache--;
750 				frp = NULL;
751 
752 			}
753 		}
754 	}
755 
756 	if (hosed) {
757 		/*
758 		 * We must keep tracking the overall fragment even when
759 		 * we're going to drop it anyway so that we know when to
760 		 * free the overall descriptor.  Thus we drop the frag late.
761 		 */
762 		goto drop_fragment;
763 	}
764 
765 
766  pass:
767 	/* Update maximum data size */
768 	if ((*frag)->fr_max < max)
769 		(*frag)->fr_max = max;
770 
771 	/* This is the last segment */
772 	if (!mff)
773 		(*frag)->fr_flags |= PFFRAG_SEENLAST;
774 
775 	/* Check if we are completely reassembled */
776 	if (((*frag)->fr_flags & PFFRAG_SEENLAST) &&
777 	    LIST_FIRST(&(*frag)->fr_cache)->fr_off == 0 &&
778 	    LIST_FIRST(&(*frag)->fr_cache)->fr_end == (*frag)->fr_max) {
779 		/* Remove from fragment queue */
780 		DPFPRINTF(("fragcache[%d]: done 0-%d\n", h->ip_id,
781 		    (*frag)->fr_max));
782 		pf_free_fragment(*frag);
783 		*frag = NULL;
784 	}
785 
786 	return (m);
787 
788  no_mem:
789 	*nomem = 1;
790 
791 	/* Still need to pay attention to !IP_MF */
792 	if (!mff && *frag != NULL)
793 		(*frag)->fr_flags |= PFFRAG_SEENLAST;
794 
795 	m_freem(m);
796 	return (NULL);
797 
798  drop_fragment:
799 
800 	/* Still need to pay attention to !IP_MF */
801 	if (!mff && *frag != NULL)
802 		(*frag)->fr_flags |= PFFRAG_SEENLAST;
803 
804 	if (drop) {
805 		/* This fragment has been deemed bad.  Don't reass */
806 		if (((*frag)->fr_flags & PFFRAG_DROP) == 0)
807 			DPFPRINTF(("fragcache[%d]: dropping overall fragment\n",
808 			    h->ip_id));
809 		(*frag)->fr_flags |= PFFRAG_DROP;
810 	}
811 
812 	m_freem(m);
813 	return (NULL);
814 }
815 
816 int
pf_normalize_ip(struct mbuf ** m0,int dir,struct pfi_kif * kif,u_short * reason,struct pf_pdesc * pd)817 pf_normalize_ip(struct mbuf **m0, int dir, struct pfi_kif *kif, u_short *reason,
818     struct pf_pdesc *pd)
819 {
820 	struct mbuf		*m = *m0;
821 	struct pf_rule		*r;
822 	struct pf_frent		*frent;
823 	struct pf_fragment	*frag = NULL;
824 	struct ip		*h = mtod(m, struct ip *);
825 	int			 mff = (ntohs(h->ip_off) & IP_MF);
826 	int			 hlen = h->ip_hl << 2;
827 	u_int16_t		 fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3;
828 	u_int16_t		 max;
829 	int			 ip_len;
830 	int			 ip_off;
831 
832 	r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr);
833 	while (r != NULL) {
834 		r->evaluations++;
835 		if (r->kif != NULL &&
836 		    (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot)
837 			r = r->skip[PF_SKIP_IFP].ptr;
838 		else if (r->direction && r->direction != dir)
839 			r = r->skip[PF_SKIP_DIR].ptr;
840 		else if (r->af && r->af != AF_INET)
841 			r = r->skip[PF_SKIP_AF].ptr;
842 		else if (r->proto && r->proto != h->ip_p)
843 			r = r->skip[PF_SKIP_PROTO].ptr;
844 		else if (PF_MISMATCHAW(&r->src.addr,
845 		    (struct pf_addr *)&h->ip_src.s_addr, AF_INET, r->src.not))
846 			r = r->skip[PF_SKIP_SRC_ADDR].ptr;
847 		else if (PF_MISMATCHAW(&r->dst.addr,
848 		    (struct pf_addr *)&h->ip_dst.s_addr, AF_INET, r->dst.not))
849 			r = r->skip[PF_SKIP_DST_ADDR].ptr;
850 		else
851 			break;
852 	}
853 
854 	if (r == NULL)
855 		return (PF_PASS);
856 	else
857 		r->packets++;
858 
859 	/* Check for illegal packets */
860 	if (hlen < (int)sizeof(struct ip))
861 		goto drop;
862 
863 	if (hlen > ntohs(h->ip_len))
864 		goto drop;
865 
866 	/* Clear IP_DF if the rule uses the no-df option */
867 	if (r->rule_flag & PFRULE_NODF)
868 		h->ip_off &= htons(~IP_DF);
869 
870 	/* We will need other tests here */
871 	if (!fragoff && !mff)
872 		goto no_fragment;
873 
874 	/* We're dealing with a fragment now. Don't allow fragments
875 	 * with IP_DF to enter the cache. If the flag was cleared by
876 	 * no-df above, fine. Otherwise drop it.
877 	 */
878 	if (h->ip_off & htons(IP_DF)) {
879 		DPFPRINTF(("IP_DF\n"));
880 		goto bad;
881 	}
882 
883 	ip_len = ntohs(h->ip_len) - hlen;
884 	ip_off = (ntohs(h->ip_off) & IP_OFFMASK) << 3;
885 
886 	/* All fragments are 8 byte aligned */
887 	if (mff && (ip_len & 0x7)) {
888 		DPFPRINTF(("mff and %d\n", ip_len));
889 		goto bad;
890 	}
891 
892 	/* Respect maximum length */
893 	if (fragoff + ip_len > IP_MAXPACKET) {
894 		DPFPRINTF(("max packet %d\n", fragoff + ip_len));
895 		goto bad;
896 	}
897 	max = fragoff + ip_len;
898 
899 	if ((r->rule_flag & (PFRULE_FRAGCROP|PFRULE_FRAGDROP)) == 0) {
900 		/* Fully buffer all of the fragments */
901 
902 		frag = pf_find_fragment(h, &pf_frag_tree);
903 
904 		/* Check if we saw the last fragment already */
905 		if (frag != NULL && (frag->fr_flags & PFFRAG_SEENLAST) &&
906 		    max > frag->fr_max)
907 			goto bad;
908 
909 		/* Get an entry for the fragment queue */
910 		frent = pool_get(&pf_frent_pl, PR_NOWAIT);
911 		if (frent == NULL) {
912 			REASON_SET(reason, PFRES_MEMORY);
913 			return (PF_DROP);
914 		}
915 		pf_nfrents++;
916 		frent->fr_ip = h;
917 		frent->fr_m = m;
918 
919 		/* Might return a completely reassembled mbuf, or NULL */
920 		DPFPRINTF(("reass frag %d @ %d-%d\n", h->ip_id, fragoff, max));
921 		*m0 = m = pf_reassemble(m0, &frag, frent, mff);
922 
923 		if (m == NULL)
924 			return (PF_DROP);
925 
926 		if (frag != NULL && (frag->fr_flags & PFFRAG_DROP))
927 			goto drop;
928 
929 		h = mtod(m, struct ip *);
930 	} else {
931 		/* non-buffering fragment cache (drops or masks overlaps) */
932 		int	nomem = 0;
933 
934 		if (dir == PF_OUT) {
935 			if (m_tag_find(m, PACKET_TAG_PF_FRAGCACHE, NULL) !=
936 			    NULL) {
937 				/* Already passed the fragment cache in the
938 				 * input direction.  If we continued, it would
939 				 * appear to be a dup and would be dropped.
940 				 */
941 				goto fragment_pass;
942 			}
943 		}
944 
945 		frag = pf_find_fragment(h, &pf_cache_tree);
946 
947 		/* Check if we saw the last fragment already */
948 		if (frag != NULL && (frag->fr_flags & PFFRAG_SEENLAST) &&
949 		    max > frag->fr_max) {
950 			if (r->rule_flag & PFRULE_FRAGDROP)
951 				frag->fr_flags |= PFFRAG_DROP;
952 			goto bad;
953 		}
954 
955 		*m0 = m = pf_fragcache(m0, h, &frag, mff,
956 		    (r->rule_flag & PFRULE_FRAGDROP) ? 1 : 0, &nomem);
957 		if (m == NULL) {
958 			if (nomem)
959 				goto no_mem;
960 			goto drop;
961 		}
962 
963 		if (dir == PF_IN) {
964 			struct m_tag	*mtag;
965 
966 			mtag = m_tag_get(PACKET_TAG_PF_FRAGCACHE, 0, M_NOWAIT);
967 			if (mtag == NULL)
968 				goto no_mem;
969 			m_tag_prepend(m, mtag);
970 		}
971 		if (frag != NULL && (frag->fr_flags & PFFRAG_DROP))
972 			goto drop;
973 		goto fragment_pass;
974 	}
975 
976  no_fragment:
977 	/* At this point, only IP_DF is allowed in ip_off */
978 	h->ip_off &= htons(IP_DF);
979 
980 	/* Enforce a minimum ttl, may cause endless packet loops */
981 	if (r->min_ttl && h->ip_ttl < r->min_ttl)
982 		h->ip_ttl = r->min_ttl;
983 
984 	if (r->rule_flag & PFRULE_RANDOMID) {
985 		u_int16_t ip_id = h->ip_id;
986 
987 		h->ip_id = ip_randomid();
988 		h->ip_sum = pf_cksum_fixup(h->ip_sum, ip_id, h->ip_id, 0);
989 	}
990 	if ((r->rule_flag & (PFRULE_FRAGCROP|PFRULE_FRAGDROP)) == 0)
991 		pd->flags |= PFDESC_IP_REAS;
992 
993 	return (PF_PASS);
994 
995  fragment_pass:
996 	/* Enforce a minimum ttl, may cause endless packet loops */
997 	if (r->min_ttl && h->ip_ttl < r->min_ttl)
998 		h->ip_ttl = r->min_ttl;
999 	if ((r->rule_flag & (PFRULE_FRAGCROP|PFRULE_FRAGDROP)) == 0)
1000 		pd->flags |= PFDESC_IP_REAS;
1001 	return (PF_PASS);
1002 
1003  no_mem:
1004 	REASON_SET(reason, PFRES_MEMORY);
1005 	if (r != NULL && r->log)
1006 		PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL);
1007 	return (PF_DROP);
1008 
1009  drop:
1010 	REASON_SET(reason, PFRES_NORM);
1011 	if (r != NULL && r->log)
1012 		PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL);
1013 	return (PF_DROP);
1014 
1015  bad:
1016 	DPFPRINTF(("dropping bad fragment\n"));
1017 
1018 	/* Free associated fragments */
1019 	if (frag != NULL)
1020 		pf_free_fragment(frag);
1021 
1022 	REASON_SET(reason, PFRES_FRAG);
1023 	if (r != NULL && r->log)
1024 		PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL);
1025 
1026 	return (PF_DROP);
1027 }
1028 
1029 #ifdef INET6
1030 int
pf_normalize_ip6(struct mbuf ** m0,int dir,struct pfi_kif * kif,u_short * reason,struct pf_pdesc * pd)1031 pf_normalize_ip6(struct mbuf **m0, int dir, struct pfi_kif *kif,
1032     u_short *reason, struct pf_pdesc *pd)
1033 {
1034 	struct mbuf		*m = *m0;
1035 	struct pf_rule		*r;
1036 	struct ip6_hdr		*h = mtod(m, struct ip6_hdr *);
1037 	int			 off;
1038 	struct ip6_ext		 ext;
1039 	struct ip6_opt		 opt;
1040 	struct ip6_opt_jumbo	 jumbo;
1041 	struct ip6_frag		 frag;
1042 	u_int32_t		 jumbolen = 0, plen;
1043 	u_int16_t		 fragoff = 0;
1044 	int			 optend;
1045 	int			 ooff;
1046 	u_int8_t		 proto;
1047 	int			 terminal;
1048 
1049 	r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr);
1050 	while (r != NULL) {
1051 		r->evaluations++;
1052 		if (r->kif != NULL &&
1053 		    (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot)
1054 			r = r->skip[PF_SKIP_IFP].ptr;
1055 		else if (r->direction && r->direction != dir)
1056 			r = r->skip[PF_SKIP_DIR].ptr;
1057 		else if (r->af && r->af != AF_INET6)
1058 			r = r->skip[PF_SKIP_AF].ptr;
1059 #if 0 /* header chain! */
1060 		else if (r->proto && r->proto != h->ip6_nxt)
1061 			r = r->skip[PF_SKIP_PROTO].ptr;
1062 #endif
1063 		else if (PF_MISMATCHAW(&r->src.addr,
1064 		    (struct pf_addr *)&h->ip6_src, AF_INET6, r->src.not))
1065 			r = r->skip[PF_SKIP_SRC_ADDR].ptr;
1066 		else if (PF_MISMATCHAW(&r->dst.addr,
1067 		    (struct pf_addr *)&h->ip6_dst, AF_INET6, r->dst.not))
1068 			r = r->skip[PF_SKIP_DST_ADDR].ptr;
1069 		else
1070 			break;
1071 	}
1072 
1073 	if (r == NULL)
1074 		return (PF_PASS);
1075 	else
1076 		r->packets++;
1077 
1078 	/* Check for illegal packets */
1079 	if (sizeof(struct ip6_hdr) + IPV6_MAXPACKET < m->m_pkthdr.len)
1080 		goto drop;
1081 
1082 	off = sizeof(struct ip6_hdr);
1083 	proto = h->ip6_nxt;
1084 	terminal = 0;
1085 	do {
1086 		switch (proto) {
1087 		case IPPROTO_FRAGMENT:
1088 			goto fragment;
1089 			break;
1090 		case IPPROTO_AH:
1091 		case IPPROTO_ROUTING:
1092 		case IPPROTO_DSTOPTS:
1093 			if (!pf_pull_hdr(m, off, &ext, sizeof(ext), NULL,
1094 			    NULL, AF_INET6))
1095 				goto shortpkt;
1096 			if (proto == IPPROTO_AH)
1097 				off += (ext.ip6e_len + 2) * 4;
1098 			else
1099 				off += (ext.ip6e_len + 1) * 8;
1100 			proto = ext.ip6e_nxt;
1101 			break;
1102 		case IPPROTO_HOPOPTS:
1103 			if (!pf_pull_hdr(m, off, &ext, sizeof(ext), NULL,
1104 			    NULL, AF_INET6))
1105 				goto shortpkt;
1106 			optend = off + (ext.ip6e_len + 1) * 8;
1107 			ooff = off + sizeof(ext);
1108 			do {
1109 				if (!pf_pull_hdr(m, ooff, &opt.ip6o_type,
1110 				    sizeof(opt.ip6o_type), NULL, NULL,
1111 				    AF_INET6))
1112 					goto shortpkt;
1113 				if (opt.ip6o_type == IP6OPT_PAD1) {
1114 					ooff++;
1115 					continue;
1116 				}
1117 				if (!pf_pull_hdr(m, ooff, &opt, sizeof(opt),
1118 				    NULL, NULL, AF_INET6))
1119 					goto shortpkt;
1120 				if (ooff + sizeof(opt) + opt.ip6o_len > optend)
1121 					goto drop;
1122 				switch (opt.ip6o_type) {
1123 				case IP6OPT_JUMBO:
1124 					if (h->ip6_plen != 0)
1125 						goto drop;
1126 					if (!pf_pull_hdr(m, ooff, &jumbo,
1127 					    sizeof(jumbo), NULL, NULL,
1128 					    AF_INET6))
1129 						goto shortpkt;
1130 					memcpy(&jumbolen, jumbo.ip6oj_jumbo_len,
1131 					    sizeof(jumbolen));
1132 					jumbolen = ntohl(jumbolen);
1133 					if (jumbolen <= IPV6_MAXPACKET)
1134 						goto drop;
1135 					if (sizeof(struct ip6_hdr) + jumbolen !=
1136 					    m->m_pkthdr.len)
1137 						goto drop;
1138 					break;
1139 				default:
1140 					break;
1141 				}
1142 				ooff += sizeof(opt) + opt.ip6o_len;
1143 			} while (ooff < optend);
1144 
1145 			off = optend;
1146 			proto = ext.ip6e_nxt;
1147 			break;
1148 		default:
1149 			terminal = 1;
1150 			break;
1151 		}
1152 	} while (!terminal);
1153 
1154 	/* jumbo payload option must be present, or plen > 0 */
1155 	if (ntohs(h->ip6_plen) == 0)
1156 		plen = jumbolen;
1157 	else
1158 		plen = ntohs(h->ip6_plen);
1159 	if (plen == 0)
1160 		goto drop;
1161 	if (sizeof(struct ip6_hdr) + plen > m->m_pkthdr.len)
1162 		goto shortpkt;
1163 
1164 	/* Enforce a minimum ttl, may cause endless packet loops */
1165 	if (r->min_ttl && h->ip6_hlim < r->min_ttl)
1166 		h->ip6_hlim = r->min_ttl;
1167 
1168 	return (PF_PASS);
1169 
1170  fragment:
1171 	if (ntohs(h->ip6_plen) == 0 || jumbolen)
1172 		goto drop;
1173 	plen = ntohs(h->ip6_plen);
1174 
1175 	if (!pf_pull_hdr(m, off, &frag, sizeof(frag), NULL, NULL, AF_INET6))
1176 		goto shortpkt;
1177 	fragoff = ntohs(frag.ip6f_offlg & IP6F_OFF_MASK);
1178 	if (fragoff + (plen - off - sizeof(frag)) > IPV6_MAXPACKET)
1179 		goto badfrag;
1180 
1181 	/* do something about it */
1182 	/* remember to set pd->flags |= PFDESC_IP_REAS */
1183 	return (PF_PASS);
1184 
1185  shortpkt:
1186 	REASON_SET(reason, PFRES_SHORT);
1187 	if (r != NULL && r->log)
1188 		PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL);
1189 	return (PF_DROP);
1190 
1191  drop:
1192 	REASON_SET(reason, PFRES_NORM);
1193 	if (r != NULL && r->log)
1194 		PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL);
1195 	return (PF_DROP);
1196 
1197  badfrag:
1198 	REASON_SET(reason, PFRES_FRAG);
1199 	if (r != NULL && r->log)
1200 		PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL);
1201 	return (PF_DROP);
1202 }
1203 #endif /* INET6 */
1204 
1205 int
pf_normalize_tcp(int dir,struct pfi_kif * kif,struct mbuf * m,int ipoff,int off,void * h,struct pf_pdesc * pd)1206 pf_normalize_tcp(int dir, struct pfi_kif *kif, struct mbuf *m, int ipoff,
1207     int off, void *h, struct pf_pdesc *pd)
1208 {
1209 	struct pf_rule	*r, *rm = NULL;
1210 	struct tcphdr	*th = pd->hdr.tcp;
1211 	int		 rewrite = 0;
1212 	u_short		 reason;
1213 	u_int8_t	 flags;
1214 	sa_family_t	 af = pd->af;
1215 
1216 	r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr);
1217 	while (r != NULL) {
1218 		r->evaluations++;
1219 		if (r->kif != NULL &&
1220 		    (r->kif != kif && r->kif != kif->pfik_parent) == !r->ifnot)
1221 			r = r->skip[PF_SKIP_IFP].ptr;
1222 		else if (r->direction && r->direction != dir)
1223 			r = r->skip[PF_SKIP_DIR].ptr;
1224 		else if (r->af && r->af != af)
1225 			r = r->skip[PF_SKIP_AF].ptr;
1226 		else if (r->proto && r->proto != pd->proto)
1227 			r = r->skip[PF_SKIP_PROTO].ptr;
1228 		else if (PF_MISMATCHAW(&r->src.addr, pd->src, af, r->src.not))
1229 			r = r->skip[PF_SKIP_SRC_ADDR].ptr;
1230 		else if (r->src.port_op && !pf_match_port(r->src.port_op,
1231 			    r->src.port[0], r->src.port[1], th->th_sport))
1232 			r = r->skip[PF_SKIP_SRC_PORT].ptr;
1233 		else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af, r->dst.not))
1234 			r = r->skip[PF_SKIP_DST_ADDR].ptr;
1235 		else if (r->dst.port_op && !pf_match_port(r->dst.port_op,
1236 			    r->dst.port[0], r->dst.port[1], th->th_dport))
1237 			r = r->skip[PF_SKIP_DST_PORT].ptr;
1238 		else if (r->os_fingerprint != PF_OSFP_ANY && !pf_osfp_match(
1239 			    pf_osfp_fingerprint(pd, m, off, th),
1240 			    r->os_fingerprint))
1241 			r = TAILQ_NEXT(r, entries);
1242 		else {
1243 			rm = r;
1244 			break;
1245 		}
1246 	}
1247 
1248 	if (rm == NULL)
1249 		return (PF_PASS);
1250 	else
1251 		r->packets++;
1252 
1253 	if (rm->rule_flag & PFRULE_REASSEMBLE_TCP)
1254 		pd->flags |= PFDESC_TCP_NORM;
1255 
1256 	flags = th->th_flags;
1257 	if (flags & TH_SYN) {
1258 		/* Illegal packet */
1259 		if (flags & TH_RST)
1260 			goto tcp_drop;
1261 
1262 		if (flags & TH_FIN)
1263 			flags &= ~TH_FIN;
1264 	} else {
1265 		/* Illegal packet */
1266 		if (!(flags & (TH_ACK|TH_RST)))
1267 			goto tcp_drop;
1268 	}
1269 
1270 	if (!(flags & TH_ACK)) {
1271 		/* These flags are only valid if ACK is set */
1272 		if ((flags & TH_FIN) || (flags & TH_PUSH) || (flags & TH_URG))
1273 			goto tcp_drop;
1274 	}
1275 
1276 	/* Check for illegal header length */
1277 	if (th->th_off < (sizeof(struct tcphdr) >> 2))
1278 		goto tcp_drop;
1279 
1280 	/* If flags changed, or reserved data set, then adjust */
1281 	if (flags != th->th_flags || th->th_x2 != 0) {
1282 		u_int16_t	ov, nv;
1283 
1284 		ov = *(u_int16_t *)(&th->th_ack + 1);
1285 		th->th_flags = flags;
1286 		th->th_x2 = 0;
1287 		nv = *(u_int16_t *)(&th->th_ack + 1);
1288 
1289 		th->th_sum = pf_cksum_fixup(th->th_sum, ov, nv, 0);
1290 		rewrite = 1;
1291 	}
1292 
1293 	/* Remove urgent pointer, if TH_URG is not set */
1294 	if (!(flags & TH_URG) && th->th_urp) {
1295 		th->th_sum = pf_cksum_fixup(th->th_sum, th->th_urp, 0, 0);
1296 		th->th_urp = 0;
1297 		rewrite = 1;
1298 	}
1299 
1300 	/* Process options */
1301 	if (r->max_mss && pf_normalize_tcpopt(r, m, th, off))
1302 		rewrite = 1;
1303 
1304 	/* copy back packet headers if we sanitized */
1305 	if (rewrite)
1306 		m_copyback(m, off, sizeof(*th), th);
1307 
1308 	return (PF_PASS);
1309 
1310  tcp_drop:
1311 	REASON_SET(&reason, PFRES_NORM);
1312 	if (rm != NULL && r->log)
1313 		PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, r, NULL, NULL);
1314 	return (PF_DROP);
1315 }
1316 
1317 int
pf_normalize_tcp_init(struct mbuf * m,int off,struct pf_pdesc * pd,struct tcphdr * th,struct pf_state_peer * src,struct pf_state_peer * dst)1318 pf_normalize_tcp_init(struct mbuf *m, int off, struct pf_pdesc *pd,
1319     struct tcphdr *th, struct pf_state_peer *src, struct pf_state_peer *dst)
1320 {
1321 	u_int32_t tsval, tsecr;
1322 	u_int8_t hdr[60];
1323 	u_int8_t *opt;
1324 
1325 	KASSERT(src->scrub == NULL);
1326 
1327 	src->scrub = pool_get(&pf_state_scrub_pl, PR_NOWAIT);
1328 	if (src->scrub == NULL)
1329 		return (1);
1330 	bzero(src->scrub, sizeof(*src->scrub));
1331 
1332 	switch (pd->af) {
1333 #ifdef INET
1334 	case AF_INET: {
1335 		struct ip *h = mtod(m, struct ip *);
1336 		src->scrub->pfss_ttl = h->ip_ttl;
1337 		break;
1338 	}
1339 #endif /* INET */
1340 #ifdef INET6
1341 	case AF_INET6: {
1342 		struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
1343 		src->scrub->pfss_ttl = h->ip6_hlim;
1344 		break;
1345 	}
1346 #endif /* INET6 */
1347 	}
1348 
1349 
1350 	/*
1351 	 * All normalizations below are only begun if we see the start of
1352 	 * the connections.  They must all set an enabled bit in pfss_flags
1353 	 */
1354 	if ((th->th_flags & TH_SYN) == 0)
1355 		return (0);
1356 
1357 
1358 	if (th->th_off > (sizeof(struct tcphdr) >> 2) && src->scrub &&
1359 	    pf_pull_hdr(m, off, hdr, th->th_off << 2, NULL, NULL, pd->af)) {
1360 		/* Diddle with TCP options */
1361 		int hlen;
1362 		opt = hdr + sizeof(struct tcphdr);
1363 		hlen = (th->th_off << 2) - sizeof(struct tcphdr);
1364 		while (hlen >= TCPOLEN_TIMESTAMP) {
1365 			switch (*opt) {
1366 			case TCPOPT_EOL:	/* FALLTHROUGH */
1367 			case TCPOPT_NOP:
1368 				opt++;
1369 				hlen--;
1370 				break;
1371 			case TCPOPT_TIMESTAMP:
1372 				if (opt[1] >= TCPOLEN_TIMESTAMP) {
1373 					src->scrub->pfss_flags |=
1374 					    PFSS_TIMESTAMP;
1375 					src->scrub->pfss_ts_mod =
1376 					    arc4random();
1377 
1378 					/* note PFSS_PAWS not set yet */
1379 					memcpy(&tsval, &opt[2],
1380 					    sizeof(u_int32_t));
1381 					memcpy(&tsecr, &opt[6],
1382 					    sizeof(u_int32_t));
1383 		    			src->scrub->pfss_tsval0 = ntohl(tsval);
1384 					src->scrub->pfss_tsval = ntohl(tsval);
1385 					src->scrub->pfss_tsecr = ntohl(tsecr);
1386 					src->scrub->pfss_last = mono_time;
1387 				}
1388 				/* FALLTHROUGH */
1389 			default:
1390 				hlen -= MAX(opt[1], 2);
1391 				opt += MAX(opt[1], 2);
1392 				break;
1393 			}
1394 		}
1395 	}
1396 
1397 	return (0);
1398 }
1399 
1400 void
pf_normalize_tcp_cleanup(struct pf_state * state)1401 pf_normalize_tcp_cleanup(struct pf_state *state)
1402 {
1403 	if (state->src.scrub)
1404 		pool_put(&pf_state_scrub_pl, state->src.scrub);
1405 	if (state->dst.scrub)
1406 		pool_put(&pf_state_scrub_pl, state->dst.scrub);
1407 
1408 	/* Someday... flush the TCP segment reassembly descriptors. */
1409 }
1410 
1411 int
pf_normalize_tcp_stateful(struct mbuf * m,int off,struct pf_pdesc * pd,u_short * reason,struct tcphdr * th,struct pf_state * state,struct pf_state_peer * src,struct pf_state_peer * dst,int * writeback)1412 pf_normalize_tcp_stateful(struct mbuf *m, int off, struct pf_pdesc *pd,
1413     u_short *reason, struct tcphdr *th, struct pf_state *state,
1414     struct pf_state_peer *src, struct pf_state_peer *dst, int *writeback)
1415 {
1416 	u_int32_t tsval, tsecr;
1417 	u_int tsval_from_last;
1418 	u_int8_t hdr[60];
1419 	u_int8_t *opt;
1420 	int copyback = 0;
1421 	int got_ts = 0;
1422 
1423 	KASSERT(src->scrub || dst->scrub);
1424 
1425 	/*
1426 	 * Enforce the minimum TTL seen for this connection.  Negate a common
1427 	 * technique to evade an intrusion detection system and confuse
1428 	 * firewall state code.
1429 	 */
1430 	switch (pd->af) {
1431 #ifdef INET
1432 	case AF_INET: {
1433 		if (src->scrub) {
1434 			struct ip *h = mtod(m, struct ip *);
1435 			if (h->ip_ttl > src->scrub->pfss_ttl)
1436 				src->scrub->pfss_ttl = h->ip_ttl;
1437 			h->ip_ttl = src->scrub->pfss_ttl;
1438 		}
1439 		break;
1440 	}
1441 #endif /* INET */
1442 #ifdef INET6
1443 	case AF_INET6: {
1444 		if (src->scrub) {
1445 			struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
1446 			if (h->ip6_hlim > src->scrub->pfss_ttl)
1447 				src->scrub->pfss_ttl = h->ip6_hlim;
1448 			h->ip6_hlim = src->scrub->pfss_ttl;
1449 		}
1450 		break;
1451 	}
1452 #endif /* INET6 */
1453 	}
1454 
1455 	if (th->th_off > (sizeof(struct tcphdr) >> 2) &&
1456 	    ((src->scrub && (src->scrub->pfss_flags & PFSS_TIMESTAMP)) ||
1457 	    (dst->scrub && (dst->scrub->pfss_flags & PFSS_TIMESTAMP))) &&
1458 	    pf_pull_hdr(m, off, hdr, th->th_off << 2, NULL, NULL, pd->af)) {
1459 		/* Diddle with TCP options */
1460 		int hlen;
1461 		opt = hdr + sizeof(struct tcphdr);
1462 		hlen = (th->th_off << 2) - sizeof(struct tcphdr);
1463 		while (hlen >= TCPOLEN_TIMESTAMP) {
1464 			switch (*opt) {
1465 			case TCPOPT_EOL:	/* FALLTHROUGH */
1466 			case TCPOPT_NOP:
1467 				opt++;
1468 				hlen--;
1469 				break;
1470 			case TCPOPT_TIMESTAMP:
1471 				/* Modulate the timestamps.  Can be used for
1472 				 * NAT detection, OS uptime determination or
1473 				 * reboot detection.
1474 				 */
1475 
1476 				if (got_ts) {
1477 					/* Huh?  Multiple timestamps!? */
1478 					if (pf_status.debug >= PF_DEBUG_MISC) {
1479 						DPFPRINTF(("multiple TS??"));
1480 						pf_print_state(state);
1481 						printf("\n");
1482 					}
1483 					REASON_SET(reason, PFRES_TS);
1484 					return (PF_DROP);
1485 				}
1486 				if (opt[1] >= TCPOLEN_TIMESTAMP) {
1487 					memcpy(&tsval, &opt[2],
1488 					    sizeof(u_int32_t));
1489 					if (tsval && src->scrub &&
1490 					    (src->scrub->pfss_flags &
1491 					    PFSS_TIMESTAMP)) {
1492 						tsval = ntohl(tsval);
1493 						pf_change_a(&opt[2],
1494 						    &th->th_sum,
1495 						    htonl(tsval +
1496 						    src->scrub->pfss_ts_mod),
1497 						    0);
1498 						copyback = 1;
1499 					}
1500 
1501 					/* Modulate TS reply iff valid (!0) */
1502 					memcpy(&tsecr, &opt[6],
1503 					    sizeof(u_int32_t));
1504 					if (tsecr && dst->scrub &&
1505 					    (dst->scrub->pfss_flags &
1506 					    PFSS_TIMESTAMP)) {
1507 						tsecr = ntohl(tsecr)
1508 						    - dst->scrub->pfss_ts_mod;
1509 						pf_change_a(&opt[6],
1510 						    &th->th_sum, htonl(tsecr),
1511 						    0);
1512 						copyback = 1;
1513 					}
1514 					got_ts = 1;
1515 				}
1516 				/* FALLTHROUGH */
1517 			default:
1518 				hlen -= MAX(opt[1], 2);
1519 				opt += MAX(opt[1], 2);
1520 				break;
1521 			}
1522 		}
1523 		if (copyback) {
1524 			/* Copyback the options, caller copys back header */
1525 			*writeback = 1;
1526 			m_copyback(m, off + sizeof(struct tcphdr),
1527 			    (th->th_off << 2) - sizeof(struct tcphdr), hdr +
1528 			    sizeof(struct tcphdr));
1529 		}
1530 	}
1531 
1532 
1533 	/*
1534 	 * Must invalidate PAWS checks on connections idle for too long.
1535 	 * The fastest allowed timestamp clock is 1ms.  That turns out to
1536 	 * be about 24 days before it wraps.  XXX Right now our lowerbound
1537 	 * TS echo check only works for the first 12 days of a connection
1538 	 * when the TS has exhausted half its 32bit space
1539 	 */
1540 #define TS_MAX_IDLE	(24*24*60*60)
1541 #define TS_MAX_CONN	(12*24*60*60)	/* XXX remove when better tsecr check */
1542 	if (src->scrub && (src->scrub->pfss_flags & PFSS_PAWS) &&
1543 	    (mono_time.tv_sec - src->scrub->pfss_last.tv_sec > TS_MAX_IDLE ||
1544 	    time.tv_sec - state->creation > TS_MAX_CONN))  {
1545 		if (pf_status.debug >= PF_DEBUG_MISC) {
1546 			DPFPRINTF(("src idled out of PAWS\n"));
1547 			pf_print_state(state);
1548 			printf("\n");
1549 		}
1550 		src->scrub->pfss_flags = (src->scrub->pfss_flags & ~PFSS_PAWS)
1551 		    | PFSS_PAWS_IDLED;
1552 	}
1553 	if (dst->scrub && (dst->scrub->pfss_flags & PFSS_PAWS) &&
1554 	    mono_time.tv_sec - dst->scrub->pfss_last.tv_sec > TS_MAX_IDLE) {
1555 		if (pf_status.debug >= PF_DEBUG_MISC) {
1556 			DPFPRINTF(("dst idled out of PAWS\n"));
1557 			pf_print_state(state);
1558 			printf("\n");
1559 		}
1560 		dst->scrub->pfss_flags = (dst->scrub->pfss_flags & ~PFSS_PAWS)
1561 		    | PFSS_PAWS_IDLED;
1562 	}
1563 
1564 	if (got_ts && src->scrub && dst->scrub &&
1565 	    (src->scrub->pfss_flags & PFSS_PAWS) &&
1566 	    (dst->scrub->pfss_flags & PFSS_PAWS)) {
1567 		/* Validate that the timestamps are "in-window".
1568 		 * RFC1323 describes TCP Timestamp options that allow
1569 		 * measurement of RTT (round trip time) and PAWS
1570 		 * (protection against wrapped sequence numbers).  PAWS
1571 		 * gives us a set of rules for rejecting packets on
1572 		 * long fat pipes (packets that were somehow delayed
1573 		 * in transit longer than the time it took to send the
1574 		 * full TCP sequence space of 4Gb).  We can use these
1575 		 * rules and infer a few others that will let us treat
1576 		 * the 32bit timestamp and the 32bit echoed timestamp
1577 		 * as sequence numbers to prevent a blind attacker from
1578 		 * inserting packets into a connection.
1579 		 *
1580 		 * RFC1323 tells us:
1581 		 *  - The timestamp on this packet must be greater than
1582 		 *    or equal to the last value echoed by the other
1583 		 *    endpoint.  The RFC says those will be discarded
1584 		 *    since it is a dup that has already been acked.
1585 		 *    This gives us a lowerbound on the timestamp.
1586 		 *        timestamp >= other last echoed timestamp
1587 		 *  - The timestamp will be less than or equal to
1588 		 *    the last timestamp plus the time between the
1589 		 *    last packet and now.  The RFC defines the max
1590 		 *    clock rate as 1ms.  We will allow clocks to be
1591 		 *    up to 10% fast and will allow a total difference
1592 		 *    or 30 seconds due to a route change.  And this
1593 		 *    gives us an upperbound on the timestamp.
1594 		 *        timestamp <= last timestamp + max ticks
1595 		 *    We have to be careful here.  Windows will send an
1596 		 *    initial timestamp of zero and then initialize it
1597 		 *    to a random value after the 3whs; presumably to
1598 		 *    avoid a DoS by having to call an expensive RNG
1599 		 *    during a SYN flood.  Proof MS has at least one
1600 		 *    good security geek.
1601 		 *
1602 		 *  - The TCP timestamp option must also echo the other
1603 		 *    endpoints timestamp.  The timestamp echoed is the
1604 		 *    one carried on the earliest unacknowledged segment
1605 		 *    on the left edge of the sequence window.  The RFC
1606 		 *    states that the host will reject any echoed
1607 		 *    timestamps that were larger than any ever sent.
1608 		 *    This gives us an upperbound on the TS echo.
1609 		 *        tescr <= largest_tsval
1610 		 *  - The lowerbound on the TS echo is a little more
1611 		 *    tricky to determine.  The other endpoint's echoed
1612 		 *    values will not decrease.  But there may be
1613 		 *    network conditions that re-order packets and
1614 		 *    cause our view of them to decrease.  For now the
1615 		 *    only lowerbound we can safely determine is that
1616 		 *    the TS echo will never be less than the orginal
1617 		 *    TS.  XXX There is probably a better lowerbound.
1618 		 *    Remove TS_MAX_CONN with better lowerbound check.
1619 		 *        tescr >= other original TS
1620 		 *
1621 		 * It is also important to note that the fastest
1622 		 * timestamp clock of 1ms will wrap its 32bit space in
1623 		 * 24 days.  So we just disable TS checking after 24
1624 		 * days of idle time.  We actually must use a 12d
1625 		 * connection limit until we can come up with a better
1626 		 * lowerbound to the TS echo check.
1627 		 */
1628 		struct timeval delta_ts;
1629 		int ts_fudge;
1630 
1631 
1632 		/*
1633 		 * PFTM_TS_DIFF is how many seconds of leeway to allow
1634 		 * a host's timestamp.  This can happen if the previous
1635 		 * packet got delayed in transit for much longer than
1636 		 * this packet.
1637 		 */
1638 		if ((ts_fudge = state->rule.ptr->timeout[PFTM_TS_DIFF]) == 0)
1639 			ts_fudge = pf_default_rule.timeout[PFTM_TS_DIFF];
1640 
1641 
1642 		/* Calculate max ticks since the last timestamp */
1643 #define TS_MAXFREQ	1100		/* RFC max TS freq of 1Khz + 10% skew */
1644 #define TS_MICROSECS	1000000		/* microseconds per second */
1645 		timersub(&mono_time, &src->scrub->pfss_last, &delta_ts);
1646 		tsval_from_last = (delta_ts.tv_sec + ts_fudge) * TS_MAXFREQ;
1647 		tsval_from_last += delta_ts.tv_usec / (TS_MICROSECS/TS_MAXFREQ);
1648 
1649 
1650 		if ((src->state >= TCPS_ESTABLISHED &&
1651 		    dst->state >= TCPS_ESTABLISHED) &&
1652 		    (SEQ_LT(tsval, dst->scrub->pfss_tsecr) ||
1653 		    SEQ_GT(tsval, src->scrub->pfss_tsval + tsval_from_last) ||
1654 		    (tsecr && (SEQ_GT(tsecr, dst->scrub->pfss_tsval) ||
1655 		    SEQ_LT(tsecr, dst->scrub->pfss_tsval0))))) {
1656 			/* Bad RFC1323 implementation or an insertion attack.
1657 			 *
1658 			 * - Solaris 2.6 and 2.7 are known to send another ACK
1659 			 *   after the FIN,FIN|ACK,ACK closing that carries
1660 			 *   an old timestamp.
1661 			 */
1662 
1663 			DPFPRINTF(("Timestamp failed %c%c%c%c\n",
1664 			    SEQ_LT(tsval, dst->scrub->pfss_tsecr) ? '0' : ' ',
1665 			    SEQ_GT(tsval, src->scrub->pfss_tsval +
1666 			        tsval_from_last) ? '1' : ' ',
1667 			    SEQ_GT(tsecr, dst->scrub->pfss_tsval) ? '2' : ' ',
1668 			    SEQ_LT(tsecr, dst->scrub->pfss_tsval0)? '3' : ' '));
1669 			DPFPRINTF((" tsval: %lu  tsecr: %lu  +ticks: %lu  idle: %llus %lums\n",
1670 			    (unsigned long)tsval, (unsigned long)tsecr,
1671 			    (unsigned long)tsval_from_last, (int64_t)delta_ts.tv_sec,
1672 			    delta_ts.tv_usec / 1000));
1673 			DPFPRINTF((" src->tsval: %lu  tsecr: %lu\n",
1674 			    (unsigned long)src->scrub->pfss_tsval,
1675 			    (unsigned long)src->scrub->pfss_tsecr));
1676 			DPFPRINTF((" dst->tsval: %lu  tsecr: %lu  tsval0: %lu\n",
1677 			    (unsigned long)dst->scrub->pfss_tsval,
1678 			    (unsigned long)dst->scrub->pfss_tsecr,
1679 			    (unsigned long)dst->scrub->pfss_tsval0));
1680 			if (pf_status.debug >= PF_DEBUG_MISC) {
1681 				pf_print_state(state);
1682 				pf_print_flags(th->th_flags);
1683 				printf("\n");
1684 			}
1685 			REASON_SET(reason, PFRES_TS);
1686 			return (PF_DROP);
1687 		}
1688 
1689 		/* XXX I'd really like to require tsecr but it's optional */
1690 
1691 	} else if (!got_ts && (th->th_flags & TH_RST) == 0 &&
1692 	    ((src->state == TCPS_ESTABLISHED && dst->state == TCPS_ESTABLISHED)
1693 	    || pd->p_len > 0 || (th->th_flags & TH_SYN)) &&
1694 	    src->scrub && dst->scrub &&
1695 	    (src->scrub->pfss_flags & PFSS_PAWS) &&
1696 	    (dst->scrub->pfss_flags & PFSS_PAWS)) {
1697 		/* Didn't send a timestamp.  Timestamps aren't really useful
1698 		 * when:
1699 		 *  - connection opening or closing (often not even sent).
1700 		 *    but we must not let an attacker to put a FIN on a
1701 		 *    data packet to sneak it through our ESTABLISHED check.
1702 		 *  - on a TCP reset.  RFC suggests not even looking at TS.
1703 		 *  - on an empty ACK.  The TS will not be echoed so it will
1704 		 *    probably not help keep the RTT calculation in sync and
1705 		 *    there isn't as much danger when the sequence numbers
1706 		 *    got wrapped.  So some stacks don't include TS on empty
1707 		 *    ACKs :-(
1708 		 *
1709 		 * To minimize the disruption to mostly RFC1323 conformant
1710 		 * stacks, we will only require timestamps on data packets.
1711 		 *
1712 		 * And what do ya know, we cannot require timestamps on data
1713 		 * packets.  There appear to be devices that do legitimate
1714 		 * TCP connection hijacking.  There are HTTP devices that allow
1715 		 * a 3whs (with timestamps) and then buffer the HTTP request.
1716 		 * If the intermediate device has the HTTP response cache, it
1717 		 * will spoof the response but not bother timestamping its
1718 		 * packets.  So we can look for the presence of a timestamp in
1719 		 * the first data packet and if there, require it in all future
1720 		 * packets.
1721 		 */
1722 
1723 		if (pd->p_len > 0 && (src->scrub->pfss_flags & PFSS_DATA_TS)) {
1724 			/*
1725 			 * Hey!  Someone tried to sneak a packet in.  Or the
1726 			 * stack changed its RFC1323 behavior?!?!
1727 			 */
1728 			if (pf_status.debug >= PF_DEBUG_MISC) {
1729 				DPFPRINTF(("Did not receive expected RFC1323 timestamp\n"));
1730 				pf_print_state(state);
1731 				pf_print_flags(th->th_flags);
1732 				printf("\n");
1733 			}
1734 			REASON_SET(reason, PFRES_TS);
1735 			return (PF_DROP);
1736 		}
1737 	}
1738 
1739 
1740 	/*
1741 	 * We will note if a host sends his data packets with or without
1742 	 * timestamps.  And require all data packets to contain a timestamp
1743 	 * if the first does.  PAWS implicitly requires that all data packets be
1744 	 * timestamped.  But I think there are middle-man devices that hijack
1745 	 * TCP streams immedietly after the 3whs and don't timestamp their
1746 	 * packets (seen in a WWW accelerator or cache).
1747 	 */
1748 	if (pd->p_len > 0 && src->scrub && (src->scrub->pfss_flags &
1749 	    (PFSS_TIMESTAMP|PFSS_DATA_TS|PFSS_DATA_NOTS)) == PFSS_TIMESTAMP) {
1750 		if (got_ts)
1751 			src->scrub->pfss_flags |= PFSS_DATA_TS;
1752 		else {
1753 			src->scrub->pfss_flags |= PFSS_DATA_NOTS;
1754 			if (pf_status.debug >= PF_DEBUG_MISC && dst->scrub &&
1755 			    (dst->scrub->pfss_flags & PFSS_TIMESTAMP)) {
1756 				/* Don't warn if other host rejected RFC1323 */
1757 				DPFPRINTF(("Broken RFC1323 stack did not timestamp data packet.  Disabled PAWS security.\n"));
1758 				pf_print_state(state);
1759 				pf_print_flags(th->th_flags);
1760 				printf("\n");
1761 			}
1762 		}
1763 	}
1764 
1765 
1766 	/*
1767 	 * Update PAWS values
1768 	 */
1769 	if (got_ts && src->scrub && PFSS_TIMESTAMP == (src->scrub->pfss_flags &
1770 	    (PFSS_PAWS_IDLED|PFSS_TIMESTAMP))) {
1771 		src->scrub->pfss_last = mono_time;
1772 		if (SEQ_GEQ(tsval, src->scrub->pfss_tsval) ||
1773 		    (src->scrub->pfss_flags & PFSS_PAWS) == 0)
1774 			src->scrub->pfss_tsval = tsval;
1775 
1776 		if (tsecr) {
1777 			if (SEQ_GEQ(tsecr, src->scrub->pfss_tsecr) ||
1778 			    (src->scrub->pfss_flags & PFSS_PAWS) == 0)
1779 				src->scrub->pfss_tsecr = tsecr;
1780 
1781 			if ((src->scrub->pfss_flags & PFSS_PAWS) == 0 &&
1782 			    (SEQ_LT(tsval, src->scrub->pfss_tsval0) ||
1783 			    src->scrub->pfss_tsval0 == 0)) {
1784 				/* tsval0 MUST be the lowest timestamp */
1785 	    			src->scrub->pfss_tsval0 = tsval;
1786 			}
1787 
1788 			/* Only fully initialized after a TS gets echoed */
1789 			if ((src->scrub->pfss_flags & PFSS_PAWS) == 0)
1790 				src->scrub->pfss_flags |= PFSS_PAWS;
1791 		}
1792 	}
1793 
1794 	/* I have a dream....  TCP segment reassembly.... */
1795 	return (0);
1796 }
1797 
1798 int
pf_normalize_tcpopt(struct pf_rule * r,struct mbuf * m,struct tcphdr * th,int off)1799 pf_normalize_tcpopt(struct pf_rule *r, struct mbuf *m, struct tcphdr *th,
1800     int off)
1801 {
1802 	u_int16_t	*mss;
1803 	int		 thoff;
1804 	int		 opt, cnt, optlen = 0;
1805 	int		 rewrite = 0;
1806 	u_char		*optp;
1807 
1808 	thoff = th->th_off << 2;
1809 	cnt = thoff - sizeof(struct tcphdr);
1810 	optp = mtod(m, caddr_t) + off + sizeof(struct tcphdr);
1811 
1812 	for (; cnt > 0; cnt -= optlen, optp += optlen) {
1813 		opt = optp[0];
1814 		if (opt == TCPOPT_EOL)
1815 			break;
1816 		if (opt == TCPOPT_NOP)
1817 			optlen = 1;
1818 		else {
1819 			if (cnt < 2)
1820 				break;
1821 			optlen = optp[1];
1822 			if (optlen < 2 || optlen > cnt)
1823 				break;
1824 		}
1825 		switch (opt) {
1826 		case TCPOPT_MAXSEG:
1827 			mss = (u_int16_t *)(optp + 2);
1828 			if ((ntohs(*mss)) > r->max_mss) {
1829 				th->th_sum = pf_cksum_fixup(th->th_sum,
1830 				    *mss, htons(r->max_mss), 0);
1831 				*mss = htons(r->max_mss);
1832 				rewrite = 1;
1833 			}
1834 			break;
1835 		default:
1836 			break;
1837 		}
1838 	}
1839 
1840 	return (rewrite);
1841 }
1842