]> git.saurik.com Git - apple/xnu.git/blob - bsd/net/pf.c
projects / apple / xnu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
xnu-1504.15.3.tar.gz
[apple/xnu.git] / bsd / net / pf.c
1 /*
2 * Copyright (c) 2007-2009 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 /* $apfw: git commit 6602420f2f101b74305cd78f7cd9e0c8fdedae97 $ */
30 /* $OpenBSD: pf.c,v 1.567 2008/02/20 23:40:13 henning Exp $ */
31
32 /*
33 * Copyright (c) 2001 Daniel Hartmeier
34 * Copyright (c) 2002,2003 Henning Brauer
35 * All rights reserved.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 *
41 * - Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * - Redistributions in binary form must reproduce the above
44 * copyright notice, this list of conditions and the following
45 * disclaimer in the documentation and/or other materials provided
46 * with the distribution.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
49 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
50 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
51 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
52 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
53 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
54 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
55 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
56 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
58 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
59 * POSSIBILITY OF SUCH DAMAGE.
60 *
61 * Effort sponsored in part by the Defense Advanced Research Projects
62 * Agency (DARPA) and Air Force Research Laboratory, Air Force
63 * Materiel Command, USAF, under agreement number F30602-01-2-0537.
64 *
65 */
66
67 #include <machine/endian.h>
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/mbuf.h>
71 #include <sys/filio.h>
72 #include <sys/socket.h>
73 #include <sys/socketvar.h>
74 #include <sys/kernel.h>
75 #include <sys/time.h>
76 #include <sys/proc.h>
77 #include <sys/random.h>
78 #include <sys/mcache.h>
79
80 #include <libkern/crypto/md5.h>
81 #include <libkern/libkern.h>
82
83 #include <mach/thread_act.h>
84
85 #include <net/if.h>
86 #include <net/if_types.h>
87 #include <net/bpf.h>
88 #include <net/route.h>
89
90 #include <netinet/in.h>
91 #include <netinet/in_var.h>
92 #include <netinet/in_systm.h>
93 #include <netinet/ip.h>
94 #include <netinet/ip_var.h>
95 #include <netinet/tcp.h>
96 #include <netinet/tcp_seq.h>
97 #include <netinet/udp.h>
98 #include <netinet/ip_icmp.h>
99 #include <netinet/in_pcb.h>
100 #include <netinet/tcp_timer.h>
101 #include <netinet/tcp_var.h>
102 #include <netinet/tcp_fsm.h>
103 #include <netinet/udp_var.h>
104 #include <netinet/icmp_var.h>
105 #include <net/if_ether.h>
106 #include <net/ethernet.h>
107
108 #include <net/pfvar.h>
109 #include <net/if_pflog.h>
110
111 #if NPFSYNC
112 #include <net/if_pfsync.h>
113 #endif /* NPFSYNC */
114
115 #if INET6
116 #include <netinet/ip6.h>
117 #include <netinet6/in6_pcb.h>
118 #include <netinet6/ip6_var.h>
119 #include <netinet/icmp6.h>
120 #include <netinet6/nd6.h>
121 #endif /* INET6 */
122
123 #ifndef NO_APPLE_EXTENSIONS
124 #define DPFPRINTF(n, x) (pf_status.debug >= (n) ? printf x : ((void)0))
125 #else
126 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x
127 #endif
128
129 /* XXX: should be in header somewhere */
130 #define satosin(sa) ((struct sockaddr_in *)(sa))
131 #define sintosa(sin) ((struct sockaddr *)(sin))
132
133 /*
134 * On Mac OS X, the rtableid value is treated as the interface scope
135 * value that is equivalent to the interface index used for scoped
136 * routing. A valid scope value is anything but IFSCOPE_NONE (0),
137 * as per definition of ifindex which is a positive, non-zero number.
138 * The other BSDs treat a negative rtableid value as invalid, hence
139 * the test against INT_MAX to handle userland apps which initialize
140 * the field with a negative number.
141 */
142 #define PF_RTABLEID_IS_VALID(r) \
143 ((r) > IFSCOPE_NONE && (r) <= INT_MAX)
144
145 /*
146 * Global variables
147 */
148 lck_mtx_t *pf_lock;
149 lck_rw_t *pf_perim_lock;
150
151 /* state tables */
152 struct pf_state_tree_lan_ext pf_statetbl_lan_ext;
153 struct pf_state_tree_ext_gwy pf_statetbl_ext_gwy;
154
155 struct pf_palist pf_pabuf;
156 struct pf_status pf_status;
157
158 #if ALTQ
159 struct pf_altqqueue pf_altqs[2];
160 struct pf_altqqueue *pf_altqs_active;
161 struct pf_altqqueue *pf_altqs_inactive;
162 u_int32_t ticket_altqs_active;
163 u_int32_t ticket_altqs_inactive;
164 int altqs_inactive_open;
165 #endif /* ALTQ */
166 u_int32_t ticket_pabuf;
167
168 static MD5_CTX pf_tcp_secret_ctx;
169 static u_char pf_tcp_secret[16];
170 static int pf_tcp_secret_init;
171 static int pf_tcp_iss_off;
172
173 static struct pf_anchor_stackframe {
174 struct pf_ruleset *rs;
175 struct pf_rule *r;
176 struct pf_anchor_node *parent;
177 struct pf_anchor *child;
178 } pf_anchor_stack[64];
179
180 struct pool pf_src_tree_pl, pf_rule_pl, pf_pooladdr_pl;
181 struct pool pf_state_pl, pf_state_key_pl;
182 #if ALTQ
183 struct pool pf_altq_pl;
184 #endif /* ALTQ */
185
186 #ifndef NO_APPLE_EXTENSIONS
187 typedef void (*hook_fn_t)(void *);
188
189 struct hook_desc {
190 TAILQ_ENTRY(hook_desc) hd_list;
191 hook_fn_t hd_fn;
192 void *hd_arg;
193 };
194
195 #define HOOK_REMOVE 0x01
196 #define HOOK_FREE 0x02
197 #define HOOK_ABORT 0x04
198
199 static void *hook_establish(struct hook_desc_head *, int,
200 hook_fn_t, void *);
201 static void hook_runloop(struct hook_desc_head *, int flags);
202
203 struct pool pf_app_state_pl;
204 static void pf_print_addr(struct pf_addr *addr, sa_family_t af);
205 static void pf_print_sk_host(struct pf_state_host *, u_int8_t, int,
206 u_int8_t);
207 #endif
208
209 static void pf_print_host(struct pf_addr *, u_int16_t, u_int8_t);
210
211 static void pf_init_threshold(struct pf_threshold *, u_int32_t,
212 u_int32_t);
213 static void pf_add_threshold(struct pf_threshold *);
214 static int pf_check_threshold(struct pf_threshold *);
215
216 static void pf_change_ap(int, struct mbuf *, struct pf_addr *,
217 u_int16_t *, u_int16_t *, u_int16_t *,
218 struct pf_addr *, u_int16_t, u_int8_t, sa_family_t);
219 static int pf_modulate_sack(struct mbuf *, int, struct pf_pdesc *,
220 struct tcphdr *, struct pf_state_peer *);
221 #if INET6
222 static void pf_change_a6(struct pf_addr *, u_int16_t *,
223 struct pf_addr *, u_int8_t);
224 #endif /* INET6 */
225 static void pf_change_icmp(struct pf_addr *, u_int16_t *,
226 struct pf_addr *, struct pf_addr *, u_int16_t,
227 u_int16_t *, u_int16_t *, u_int16_t *,
228 u_int16_t *, u_int8_t, sa_family_t);
229 static void pf_send_tcp(const struct pf_rule *, sa_family_t,
230 const struct pf_addr *, const struct pf_addr *,
231 u_int16_t, u_int16_t, u_int32_t, u_int32_t,
232 u_int8_t, u_int16_t, u_int16_t, u_int8_t, int,
233 u_int16_t, struct ether_header *, struct ifnet *);
234 static void pf_send_icmp(struct mbuf *, u_int8_t, u_int8_t,
235 sa_family_t, struct pf_rule *);
236 #ifndef NO_APPLE_EXTENSIONS
237 static struct pf_rule *pf_match_translation(struct pf_pdesc *, struct mbuf *,
238 int, int, struct pfi_kif *, struct pf_addr *,
239 union pf_state_xport *, struct pf_addr *,
240 union pf_state_xport *, int);
241 static struct pf_rule *pf_get_translation_aux(struct pf_pdesc *,
242 struct mbuf *, int, int, struct pfi_kif *,
243 struct pf_src_node **, struct pf_addr *,
244 union pf_state_xport *, struct pf_addr *,
245 union pf_state_xport *, struct pf_addr *,
246 union pf_state_xport *);
247 #else
248 struct pf_rule *pf_match_translation(struct pf_pdesc *, struct mbuf *,
249 int, int, struct pfi_kif *,
250 struct pf_addr *, u_int16_t, struct pf_addr *,
251 u_int16_t, int);
252 struct pf_rule *pf_get_translation(struct pf_pdesc *, struct mbuf *,
253 int, int, struct pfi_kif *, struct pf_src_node **,
254 struct pf_addr *, u_int16_t,
255 struct pf_addr *, u_int16_t,
256 struct pf_addr *, u_int16_t *);
257 #endif
258 static void pf_attach_state(struct pf_state_key *,
259 struct pf_state *, int);
260 static void pf_detach_state(struct pf_state *, int);
261 static u_int32_t pf_tcp_iss(struct pf_pdesc *);
262 static int pf_test_rule(struct pf_rule **, struct pf_state **,
263 int, struct pfi_kif *, struct mbuf *, int,
264 void *, struct pf_pdesc *, struct pf_rule **,
265 struct pf_ruleset **, struct ifqueue *);
266 static int pf_test_fragment(struct pf_rule **, int,
267 struct pfi_kif *, struct mbuf *, void *,
268 struct pf_pdesc *, struct pf_rule **,
269 struct pf_ruleset **);
270 static int pf_test_state_tcp(struct pf_state **, int,
271 struct pfi_kif *, struct mbuf *, int,
272 void *, struct pf_pdesc *, u_short *);
273 #ifndef NO_APPLE_EXTENSIONS
274 static int pf_test_state_udp(struct pf_state **, int,
275 struct pfi_kif *, struct mbuf *, int,
276 void *, struct pf_pdesc *, u_short *);
277 #else
278 static int pf_test_state_udp(struct pf_state **, int,
279 struct pfi_kif *, struct mbuf *, int,
280 void *, struct pf_pdesc *);
281 #endif
282 static int pf_test_state_icmp(struct pf_state **, int,
283 struct pfi_kif *, struct mbuf *, int,
284 void *, struct pf_pdesc *, u_short *);
285 static int pf_test_state_other(struct pf_state **, int,
286 struct pfi_kif *, struct pf_pdesc *);
287 static int pf_match_tag(struct mbuf *, struct pf_rule *,
288 struct pf_mtag *, int *);
289 static void pf_step_into_anchor(int *, struct pf_ruleset **, int,
290 struct pf_rule **, struct pf_rule **, int *);
291 static int pf_step_out_of_anchor(int *, struct pf_ruleset **,
292 int, struct pf_rule **, struct pf_rule **,
293 int *);
294 static void pf_hash(struct pf_addr *, struct pf_addr *,
295 struct pf_poolhashkey *, sa_family_t);
296 static int pf_map_addr(u_int8_t, struct pf_rule *,
297 struct pf_addr *, struct pf_addr *,
298 struct pf_addr *, struct pf_src_node **);
299 #ifndef NO_APPLE_EXTENSIONS
300 static int pf_get_sport(struct pf_pdesc *, struct pfi_kif *,
301 struct pf_rule *, struct pf_addr *,
302 union pf_state_xport *, struct pf_addr *,
303 union pf_state_xport *, struct pf_addr *,
304 union pf_state_xport *, struct pf_src_node **);
305 #else
306 int pf_get_sport(sa_family_t, u_int8_t, struct pf_rule *,
307 struct pf_addr *, struct pf_addr *, u_int16_t,
308 struct pf_addr *, u_int16_t *, u_int16_t, u_int16_t,
309 struct pf_src_node **);
310 #endif
311 static void pf_route(struct mbuf **, struct pf_rule *, int,
312 struct ifnet *, struct pf_state *,
313 struct pf_pdesc *);
314 #if INET6
315 static void pf_route6(struct mbuf **, struct pf_rule *, int,
316 struct ifnet *, struct pf_state *,
317 struct pf_pdesc *);
318 #endif /* INET6 */
319 static u_int8_t pf_get_wscale(struct mbuf *, int, u_int16_t,
320 sa_family_t);
321 static u_int16_t pf_get_mss(struct mbuf *, int, u_int16_t,
322 sa_family_t);
323 static u_int16_t pf_calc_mss(struct pf_addr *, sa_family_t,
324 u_int16_t);
325 static void pf_set_rt_ifp(struct pf_state *,
326 struct pf_addr *);
327 static int pf_check_proto_cksum(struct mbuf *, int, int,
328 u_int8_t, sa_family_t);
329 static int pf_addr_wrap_neq(struct pf_addr_wrap *,
330 struct pf_addr_wrap *);
331 static struct pf_state *pf_find_state(struct pfi_kif *,
332 struct pf_state_key_cmp *, u_int);
333 static int pf_src_connlimit(struct pf_state **);
334 static void pf_stateins_err(const char *, struct pf_state *,
335 struct pfi_kif *);
336 static int pf_check_congestion(struct ifqueue *);
337
338 #ifndef NO_APPLE_EXTENSIONS
339 #if 0
340 static const char *pf_pptp_ctrl_type_name(u_int16_t code);
341 #endif
342 static void pf_pptp_handler(struct pf_state *, int, int,
343 struct pf_pdesc *, struct pfi_kif *);
344 static void pf_pptp_unlink(struct pf_state *);
345 static void pf_grev1_unlink(struct pf_state *);
346 static int pf_test_state_grev1(struct pf_state **, int,
347 struct pfi_kif *, int, struct pf_pdesc *);
348 static int pf_ike_compare(struct pf_app_state *,
349 struct pf_app_state *);
350 static int pf_test_state_esp(struct pf_state **, int,
351 struct pfi_kif *, int, struct pf_pdesc *);
352 #endif
353
354 extern struct pool pfr_ktable_pl;
355 extern struct pool pfr_kentry_pl;
356 extern int path_mtu_discovery;
357
358 struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX] = {
359 { &pf_state_pl, PFSTATE_HIWAT },
360 { &pf_app_state_pl, PFAPPSTATE_HIWAT },
361 { &pf_src_tree_pl, PFSNODE_HIWAT },
362 { &pf_frent_pl, PFFRAG_FRENT_HIWAT },
363 { &pfr_ktable_pl, PFR_KTABLE_HIWAT },
364 { &pfr_kentry_pl, PFR_KENTRY_HIWAT }
365 };
366
367 #ifndef NO_APPLE_EXTENSIONS
368 struct mbuf *
369 pf_lazy_makewritable(struct pf_pdesc *pd, struct mbuf *m, int len)
370 {
371 if (pd->lmw < 0)
372 return (0);
373
374 VERIFY(m == pd->mp);
375
376 if (len > pd->lmw) {
377 if (m_makewritable(&m, 0, len, M_DONTWAIT))
378 len = -1;
379 pd->lmw = len;
380 if (len >= 0 && m != pd->mp) {
381 pd->mp = m;
382
383 switch (pd->af) {
384 case AF_INET: {
385 struct ip *h = mtod(m, struct ip *);
386 pd->src = (struct pf_addr *)&h->ip_src;
387 pd->dst = (struct pf_addr *)&h->ip_dst;
388 pd->ip_sum = &h->ip_sum;
389 break;
390 }
391 #if INET6
392 case AF_INET6: {
393 struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
394 pd->src = (struct pf_addr *)&h->ip6_src;
395 pd->dst = (struct pf_addr *)&h->ip6_dst;
396 break;
397 }
398 #endif /* INET6 */
399 }
400 }
401 }
402
403 return (len < 0 ? 0 : m);
404 }
405
406 static const int *
407 pf_state_lookup_aux(struct pf_state **state, struct pfi_kif *kif,
408 int direction, int *action)
409 {
410 if (*state == NULL || (*state)->timeout == PFTM_PURGE) {
411 *action = PF_DROP;
412 return (action);
413 }
414
415 if (direction == PF_OUT &&
416 (((*state)->rule.ptr->rt == PF_ROUTETO &&
417 (*state)->rule.ptr->direction == PF_OUT) ||
418 ((*state)->rule.ptr->rt == PF_REPLYTO &&
419 (*state)->rule.ptr->direction == PF_IN)) &&
420 (*state)->rt_kif != NULL && (*state)->rt_kif != kif) {
421 *action = PF_PASS;
422 return (action);
423 }
424
425 return (0);
426 }
427
428 #define STATE_LOOKUP() \
429 do { \
430 int action; \
431 *state = pf_find_state(kif, &key, direction); \
432 if (pf_state_lookup_aux(state, kif, direction, &action)) \
433 return (action); \
434 } while (0)
435
436 #define STATE_ADDR_TRANSLATE(sk) \
437 (sk)->lan.addr.addr32[0] != (sk)->gwy.addr.addr32[0] || \
438 ((sk)->af == AF_INET6 && \
439 ((sk)->lan.addr.addr32[1] != (sk)->gwy.addr.addr32[1] || \
440 (sk)->lan.addr.addr32[2] != (sk)->gwy.addr.addr32[2] || \
441 (sk)->lan.addr.addr32[3] != (sk)->gwy.addr.addr32[3]))
442
443 #define STATE_TRANSLATE(sk) \
444 (STATE_ADDR_TRANSLATE(sk) || \
445 (sk)->lan.xport.port != (sk)->gwy.xport.port)
446
447 #define STATE_GRE_TRANSLATE(sk) \
448 (STATE_ADDR_TRANSLATE(sk) || \
449 (sk)->lan.xport.call_id != (sk)->gwy.xport.call_id)
450
451 #else
452 #define STATE_LOOKUP() \
453 do { \
454 *state = pf_find_state(kif, &key, direction); \
455 if (*state == NULL || (*state)->timeout == PFTM_PURGE) \
456 return (PF_DROP); \
457 if (direction == PF_OUT && \
458 (((*state)->rule.ptr->rt == PF_ROUTETO && \
459 (*state)->rule.ptr->direction == PF_OUT) || \
460 ((*state)->rule.ptr->rt == PF_REPLYTO && \
461 (*state)->rule.ptr->direction == PF_IN)) && \
462 (*state)->rt_kif != NULL && \
463 (*state)->rt_kif != kif) \
464 return (PF_PASS); \
465 } while (0)
466
467 #define STATE_TRANSLATE(sk) \
468 (sk)->lan.addr.addr32[0] != (sk)->gwy.addr.addr32[0] || \
469 ((sk)->af == AF_INET6 && \
470 ((sk)->lan.addr.addr32[1] != (sk)->gwy.addr.addr32[1] || \
471 (sk)->lan.addr.addr32[2] != (sk)->gwy.addr.addr32[2] || \
472 (sk)->lan.addr.addr32[3] != (sk)->gwy.addr.addr32[3])) || \
473 (sk)->lan.port != (sk)->gwy.port
474 #endif
475
476 #define BOUND_IFACE(r, k) \
477 ((r)->rule_flag & PFRULE_IFBOUND) ? (k) : pfi_all
478
479 #define STATE_INC_COUNTERS(s) \
480 do { \
481 s->rule.ptr->states++; \
482 VERIFY(s->rule.ptr->states != 0); \
483 if (s->anchor.ptr != NULL) { \
484 s->anchor.ptr->states++; \
485 VERIFY(s->anchor.ptr->states != 0); \
486 } \
487 if (s->nat_rule.ptr != NULL) { \
488 s->nat_rule.ptr->states++; \
489 VERIFY(s->nat_rule.ptr->states != 0); \
490 } \
491 } while (0)
492
493 #define STATE_DEC_COUNTERS(s) \
494 do { \
495 if (s->nat_rule.ptr != NULL) { \
496 VERIFY(s->nat_rule.ptr->states > 0); \
497 s->nat_rule.ptr->states--; \
498 } \
499 if (s->anchor.ptr != NULL) { \
500 VERIFY(s->anchor.ptr->states > 0); \
501 s->anchor.ptr->states--; \
502 } \
503 VERIFY(s->rule.ptr->states > 0); \
504 s->rule.ptr->states--; \
505 } while (0)
506
507 static __inline int pf_src_compare(struct pf_src_node *, struct pf_src_node *);
508 static __inline int pf_state_compare_lan_ext(struct pf_state_key *,
509 struct pf_state_key *);
510 static __inline int pf_state_compare_ext_gwy(struct pf_state_key *,
511 struct pf_state_key *);
512 static __inline int pf_state_compare_id(struct pf_state *,
513 struct pf_state *);
514
515 struct pf_src_tree tree_src_tracking;
516
517 struct pf_state_tree_id tree_id;
518 struct pf_state_queue state_list;
519
520 RB_GENERATE(pf_src_tree, pf_src_node, entry, pf_src_compare);
521 RB_GENERATE(pf_state_tree_lan_ext, pf_state_key,
522 entry_lan_ext, pf_state_compare_lan_ext);
523 RB_GENERATE(pf_state_tree_ext_gwy, pf_state_key,
524 entry_ext_gwy, pf_state_compare_ext_gwy);
525 RB_GENERATE(pf_state_tree_id, pf_state,
526 entry_id, pf_state_compare_id);
527
528 #define PF_DT_SKIP_LANEXT 0x01
529 #define PF_DT_SKIP_EXTGWY 0x02
530
531 #ifndef NO_APPLE_EXTENSIONS
532 static const u_int16_t PF_PPTP_PORT = 1723;
533 static const u_int32_t PF_PPTP_MAGIC_NUMBER = 0x1A2B3C4D;
534
535 struct pf_pptp_hdr {
536 u_int16_t length;
537 u_int16_t type;
538 u_int32_t magic;
539 };
540
541 struct pf_pptp_ctrl_hdr {
542 u_int16_t type;
543 u_int16_t reserved_0;
544 };
545
546 struct pf_pptp_ctrl_generic {
547 u_int16_t data[0];
548 };
549
550 #define PF_PPTP_CTRL_TYPE_START_REQ 1
551 struct pf_pptp_ctrl_start_req {
552 u_int16_t protocol_version;
553 u_int16_t reserved_1;
554 u_int32_t framing_capabilities;
555 u_int32_t bearer_capabilities;
556 u_int16_t maximum_channels;
557 u_int16_t firmware_revision;
558 u_int8_t host_name[64];
559 u_int8_t vendor_string[64];
560 };
561
562 #define PF_PPTP_CTRL_TYPE_START_RPY 2
563 struct pf_pptp_ctrl_start_rpy {
564 u_int16_t protocol_version;
565 u_int8_t result_code;
566 u_int8_t error_code;
567 u_int32_t framing_capabilities;
568 u_int32_t bearer_capabilities;
569 u_int16_t maximum_channels;
570 u_int16_t firmware_revision;
571 u_int8_t host_name[64];
572 u_int8_t vendor_string[64];
573 };
574
575 #define PF_PPTP_CTRL_TYPE_STOP_REQ 3
576 struct pf_pptp_ctrl_stop_req {
577 u_int8_t reason;
578 u_int8_t reserved_1;
579 u_int16_t reserved_2;
580 };
581
582 #define PF_PPTP_CTRL_TYPE_STOP_RPY 4
583 struct pf_pptp_ctrl_stop_rpy {
584 u_int8_t reason;
585 u_int8_t error_code;
586 u_int16_t reserved_1;
587 };
588
589 #define PF_PPTP_CTRL_TYPE_ECHO_REQ 5
590 struct pf_pptp_ctrl_echo_req {
591 u_int32_t identifier;
592 };
593
594 #define PF_PPTP_CTRL_TYPE_ECHO_RPY 6
595 struct pf_pptp_ctrl_echo_rpy {
596 u_int32_t identifier;
597 u_int8_t result_code;
598 u_int8_t error_code;
599 u_int16_t reserved_1;
600 };
601
602 #define PF_PPTP_CTRL_TYPE_CALL_OUT_REQ 7
603 struct pf_pptp_ctrl_call_out_req {
604 u_int16_t call_id;
605 u_int16_t call_sernum;
606 u_int32_t min_bps;
607 u_int32_t bearer_type;
608 u_int32_t framing_type;
609 u_int16_t rxwindow_size;
610 u_int16_t proc_delay;
611 u_int8_t phone_num[64];
612 u_int8_t sub_addr[64];
613 };
614
615 #define PF_PPTP_CTRL_TYPE_CALL_OUT_RPY 8
616 struct pf_pptp_ctrl_call_out_rpy {
617 u_int16_t call_id;
618 u_int16_t peer_call_id;
619 u_int8_t result_code;
620 u_int8_t error_code;
621 u_int16_t cause_code;
622 u_int32_t connect_speed;
623 u_int16_t rxwindow_size;
624 u_int16_t proc_delay;
625 u_int32_t phy_channel_id;
626 };
627
628 #define PF_PPTP_CTRL_TYPE_CALL_IN_1ST 9
629 struct pf_pptp_ctrl_call_in_1st {
630 u_int16_t call_id;
631 u_int16_t call_sernum;
632 u_int32_t bearer_type;
633 u_int32_t phy_channel_id;
634 u_int16_t dialed_number_len;
635 u_int16_t dialing_number_len;
636 u_int8_t dialed_num[64];
637 u_int8_t dialing_num[64];
638 u_int8_t sub_addr[64];
639 };
640
641 #define PF_PPTP_CTRL_TYPE_CALL_IN_2ND 10
642 struct pf_pptp_ctrl_call_in_2nd {
643 u_int16_t call_id;
644 u_int16_t peer_call_id;
645 u_int8_t result_code;
646 u_int8_t error_code;
647 u_int16_t rxwindow_size;
648 u_int16_t txdelay;
649 u_int16_t reserved_1;
650 };
651
652 #define PF_PPTP_CTRL_TYPE_CALL_IN_3RD 11
653 struct pf_pptp_ctrl_call_in_3rd {
654 u_int16_t call_id;
655 u_int16_t reserved_1;
656 u_int32_t connect_speed;
657 u_int16_t rxwindow_size;
658 u_int16_t txdelay;
659 u_int32_t framing_type;
660 };
661
662 #define PF_PPTP_CTRL_TYPE_CALL_CLR 12
663 struct pf_pptp_ctrl_call_clr {
664 u_int16_t call_id;
665 u_int16_t reserved_1;
666 };
667
668 #define PF_PPTP_CTRL_TYPE_CALL_DISC 13
669 struct pf_pptp_ctrl_call_disc {
670 u_int16_t call_id;
671 u_int8_t result_code;
672 u_int8_t error_code;
673 u_int16_t cause_code;
674 u_int16_t reserved_1;
675 u_int8_t statistics[128];
676 };
677
678 #define PF_PPTP_CTRL_TYPE_ERROR 14
679 struct pf_pptp_ctrl_error {
680 u_int16_t peer_call_id;
681 u_int16_t reserved_1;
682 u_int32_t crc_errors;
683 u_int32_t fr_errors;
684 u_int32_t hw_errors;
685 u_int32_t buf_errors;
686 u_int32_t tim_errors;
687 u_int32_t align_errors;
688 };
689
690 #define PF_PPTP_CTRL_TYPE_SET_LINKINFO 15
691 struct pf_pptp_ctrl_set_linkinfo {
692 u_int16_t peer_call_id;
693 u_int16_t reserved_1;
694 u_int32_t tx_accm;
695 u_int32_t rx_accm;
696 };
697
698 #if 0
699 static const char *pf_pptp_ctrl_type_name(u_int16_t code)
700 {
701 code = ntohs(code);
702
703 if (code < PF_PPTP_CTRL_TYPE_START_REQ ||
704 code > PF_PPTP_CTRL_TYPE_SET_LINKINFO) {
705 static char reserved[] = "reserved-00";
706
707 sprintf(&reserved[9], "%02x", code);
708 return (reserved);
709 } else {
710 static const char *name[] = {
711 "start_req", "start_rpy", "stop_req", "stop_rpy",
712 "echo_req", "echo_rpy", "call_out_req", "call_out_rpy",
713 "call_in_1st", "call_in_2nd", "call_in_3rd",
714 "call_clr", "call_disc", "error", "set_linkinfo"
715 };
716
717 return (name[code - 1]);
718 }
719 };
720 #endif
721
722 static const size_t PF_PPTP_CTRL_MSG_MINSIZE =
723 sizeof (struct pf_pptp_hdr) +
724 sizeof (struct pf_pptp_ctrl_hdr) +
725 MIN(sizeof (struct pf_pptp_ctrl_start_req),
726 MIN(sizeof (struct pf_pptp_ctrl_start_rpy),
727 MIN(sizeof (struct pf_pptp_ctrl_stop_req),
728 MIN(sizeof (struct pf_pptp_ctrl_stop_rpy),
729 MIN(sizeof (struct pf_pptp_ctrl_echo_req),
730 MIN(sizeof (struct pf_pptp_ctrl_echo_rpy),
731 MIN(sizeof (struct pf_pptp_ctrl_call_out_req),
732 MIN(sizeof (struct pf_pptp_ctrl_call_out_rpy),
733 MIN(sizeof (struct pf_pptp_ctrl_call_in_1st),
734 MIN(sizeof (struct pf_pptp_ctrl_call_in_2nd),
735 MIN(sizeof (struct pf_pptp_ctrl_call_in_3rd),
736 MIN(sizeof (struct pf_pptp_ctrl_call_clr),
737 MIN(sizeof (struct pf_pptp_ctrl_call_disc),
738 MIN(sizeof (struct pf_pptp_ctrl_error),
739 sizeof (struct pf_pptp_ctrl_set_linkinfo)
740 ))))))))))))));
741
742 union pf_pptp_ctrl_msg_union {
743 struct pf_pptp_ctrl_start_req start_req;
744 struct pf_pptp_ctrl_start_rpy start_rpy;
745 struct pf_pptp_ctrl_stop_req stop_req;
746 struct pf_pptp_ctrl_stop_rpy stop_rpy;
747 struct pf_pptp_ctrl_echo_req echo_req;
748 struct pf_pptp_ctrl_echo_rpy echo_rpy;
749 struct pf_pptp_ctrl_call_out_req call_out_req;
750 struct pf_pptp_ctrl_call_out_rpy call_out_rpy;
751 struct pf_pptp_ctrl_call_in_1st call_in_1st;
752 struct pf_pptp_ctrl_call_in_2nd call_in_2nd;
753 struct pf_pptp_ctrl_call_in_3rd call_in_3rd;
754 struct pf_pptp_ctrl_call_clr call_clr;
755 struct pf_pptp_ctrl_call_disc call_disc;
756 struct pf_pptp_ctrl_error error;
757 struct pf_pptp_ctrl_set_linkinfo set_linkinfo;
758 u_int8_t data[0];
759 };
760
761 struct pf_pptp_ctrl_msg {
762 struct pf_pptp_hdr hdr;
763 struct pf_pptp_ctrl_hdr ctrl;
764 union pf_pptp_ctrl_msg_union msg;
765 };
766
767 #define PF_GRE_FLAG_CHECKSUM_PRESENT 0x8000
768 #define PF_GRE_FLAG_VERSION_MASK 0x0007
769 #define PF_GRE_PPP_ETHERTYPE 0x880B
770
771 struct pf_grev1_hdr {
772 u_int16_t flags;
773 u_int16_t protocol_type;
774 u_int16_t payload_length;
775 u_int16_t call_id;
776 /*
777 u_int32_t seqno;
778 u_int32_t ackno;
779 */
780 };
781
782 static const u_int16_t PF_IKE_PORT = 500;
783
784 struct pf_ike_hdr {
785 u_int64_t initiator_cookie, responder_cookie;
786 u_int8_t next_payload, version, exchange_type, flags;
787 u_int32_t message_id, length;
788 };
789
790 #define PF_IKE_PACKET_MINSIZE (sizeof (struct pf_ike_hdr))
791
792 #define PF_IKEv1_EXCHTYPE_BASE 1
793 #define PF_IKEv1_EXCHTYPE_ID_PROTECT 2
794 #define PF_IKEv1_EXCHTYPE_AUTH_ONLY 3
795 #define PF_IKEv1_EXCHTYPE_AGGRESSIVE 4
796 #define PF_IKEv1_EXCHTYPE_INFORMATIONAL 5
797 #define PF_IKEv2_EXCHTYPE_SA_INIT 34
798 #define PF_IKEv2_EXCHTYPE_AUTH 35
799 #define PF_IKEv2_EXCHTYPE_CREATE_CHILD_SA 36
800 #define PF_IKEv2_EXCHTYPE_INFORMATIONAL 37
801
802 #define PF_IKEv1_FLAG_E 0x01
803 #define PF_IKEv1_FLAG_C 0x02
804 #define PF_IKEv1_FLAG_A 0x04
805 #define PF_IKEv2_FLAG_I 0x08
806 #define PF_IKEv2_FLAG_V 0x10
807 #define PF_IKEv2_FLAG_R 0x20
808
809 struct pf_esp_hdr {
810 u_int32_t spi;
811 u_int32_t seqno;
812 u_int8_t payload[];
813 };
814 #endif
815
816 static __inline int
817 pf_src_compare(struct pf_src_node *a, struct pf_src_node *b)
818 {
819 int diff;
820
821 if (a->rule.ptr > b->rule.ptr)
822 return (1);
823 if (a->rule.ptr < b->rule.ptr)
824 return (-1);
825 if ((diff = a->af - b->af) != 0)
826 return (diff);
827 switch (a->af) {
828 #if INET
829 case AF_INET:
830 if (a->addr.addr32[0] > b->addr.addr32[0])
831 return (1);
832 if (a->addr.addr32[0] < b->addr.addr32[0])
833 return (-1);
834 break;
835 #endif /* INET */
836 #if INET6
837 case AF_INET6:
838 if (a->addr.addr32[3] > b->addr.addr32[3])
839 return (1);
840 if (a->addr.addr32[3] < b->addr.addr32[3])
841 return (-1);
842 if (a->addr.addr32[2] > b->addr.addr32[2])
843 return (1);
844 if (a->addr.addr32[2] < b->addr.addr32[2])
845 return (-1);
846 if (a->addr.addr32[1] > b->addr.addr32[1])
847 return (1);
848 if (a->addr.addr32[1] < b->addr.addr32[1])
849 return (-1);
850 if (a->addr.addr32[0] > b->addr.addr32[0])
851 return (1);
852 if (a->addr.addr32[0] < b->addr.addr32[0])
853 return (-1);
854 break;
855 #endif /* INET6 */
856 }
857 return (0);
858 }
859
860 static __inline int
861 pf_state_compare_lan_ext(struct pf_state_key *a, struct pf_state_key *b)
862 {
863 int diff;
864 #ifndef NO_APPLE_EXTENSIONS
865 int extfilter;
866 #endif
867
868 if ((diff = a->proto - b->proto) != 0)
869 return (diff);
870 if ((diff = a->af - b->af) != 0)
871 return (diff);
872
873 #ifndef NO_APPLE_EXTENSIONS
874 extfilter = PF_EXTFILTER_APD;
875
876 switch (a->proto) {
877 case IPPROTO_ICMP:
878 case IPPROTO_ICMPV6:
879 if ((diff = a->lan.xport.port - b->lan.xport.port) != 0)
880 return (diff);
881 break;
882
883 case IPPROTO_TCP:
884 if ((diff = a->lan.xport.port - b->lan.xport.port) != 0)
885 return (diff);
886 if ((diff = a->ext.xport.port - b->ext.xport.port) != 0)
887 return (diff);
888 break;
889
890 case IPPROTO_UDP:
891 if ((diff = a->proto_variant - b->proto_variant))
892 return (diff);
893 extfilter = a->proto_variant;
894 if ((diff = a->lan.xport.port - b->lan.xport.port) != 0)
895 return (diff);
896 if ((extfilter < PF_EXTFILTER_AD) &&
897 (diff = a->ext.xport.port - b->ext.xport.port) != 0)
898 return (diff);
899 break;
900
901 case IPPROTO_GRE:
902 if (a->proto_variant == PF_GRE_PPTP_VARIANT &&
903 a->proto_variant == b->proto_variant) {
904 if (!!(diff = a->ext.xport.call_id -
905 b->ext.xport.call_id))
906 return (diff);
907 }
908 break;
909
910 case IPPROTO_ESP:
911 if (!!(diff = a->ext.xport.spi - b->ext.xport.spi))
912 return (diff);
913 break;
914
915 default:
916 break;
917 }
918 #endif
919
920 switch (a->af) {
921 #if INET
922 case AF_INET:
923 if (a->lan.addr.addr32[0] > b->lan.addr.addr32[0])
924 return (1);
925 if (a->lan.addr.addr32[0] < b->lan.addr.addr32[0])
926 return (-1);
927 #ifndef NO_APPLE_EXTENSIONS
928 if (extfilter < PF_EXTFILTER_EI) {
929 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
930 return (1);
931 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
932 return (-1);
933 }
934 #else
935 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
936 return (1);
937 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
938 return (-1);
939 #endif
940 break;
941 #endif /* INET */
942 #if INET6
943 case AF_INET6:
944 #ifndef NO_APPLE_EXTENSIONS
945 if (a->lan.addr.addr32[3] > b->lan.addr.addr32[3])
946 return (1);
947 if (a->lan.addr.addr32[3] < b->lan.addr.addr32[3])
948 return (-1);
949 if (a->lan.addr.addr32[2] > b->lan.addr.addr32[2])
950 return (1);
951 if (a->lan.addr.addr32[2] < b->lan.addr.addr32[2])
952 return (-1);
953 if (a->lan.addr.addr32[1] > b->lan.addr.addr32[1])
954 return (1);
955 if (a->lan.addr.addr32[1] < b->lan.addr.addr32[1])
956 return (-1);
957 if (a->lan.addr.addr32[0] > b->lan.addr.addr32[0])
958 return (1);
959 if (a->lan.addr.addr32[0] < b->lan.addr.addr32[0])
960 return (-1);
961 if (extfilter < PF_EXTFILTER_EI ||
962 !PF_AZERO(&b->ext.addr, AF_INET6)) {
963 if (a->ext.addr.addr32[3] > b->ext.addr.addr32[3])
964 return (1);
965 if (a->ext.addr.addr32[3] < b->ext.addr.addr32[3])
966 return (-1);
967 if (a->ext.addr.addr32[2] > b->ext.addr.addr32[2])
968 return (1);
969 if (a->ext.addr.addr32[2] < b->ext.addr.addr32[2])
970 return (-1);
971 if (a->ext.addr.addr32[1] > b->ext.addr.addr32[1])
972 return (1);
973 if (a->ext.addr.addr32[1] < b->ext.addr.addr32[1])
974 return (-1);
975 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
976 return (1);
977 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
978 return (-1);
979 }
980 #else
981 if (a->lan.addr.addr32[3] > b->lan.addr.addr32[3])
982 return (1);
983 if (a->lan.addr.addr32[3] < b->lan.addr.addr32[3])
984 return (-1);
985 if (a->ext.addr.addr32[3] > b->ext.addr.addr32[3])
986 return (1);
987 if (a->ext.addr.addr32[3] < b->ext.addr.addr32[3])
988 return (-1);
989 if (a->lan.addr.addr32[2] > b->lan.addr.addr32[2])
990 return (1);
991 if (a->lan.addr.addr32[2] < b->lan.addr.addr32[2])
992 return (-1);
993 if (a->ext.addr.addr32[2] > b->ext.addr.addr32[2])
994 return (1);
995 if (a->ext.addr.addr32[2] < b->ext.addr.addr32[2])
996 return (-1);
997 if (a->lan.addr.addr32[1] > b->lan.addr.addr32[1])
998 return (1);
999 if (a->lan.addr.addr32[1] < b->lan.addr.addr32[1])
1000 return (-1);
1001 if (a->ext.addr.addr32[1] > b->ext.addr.addr32[1])
1002 return (1);
1003 if (a->ext.addr.addr32[1] < b->ext.addr.addr32[1])
1004 return (-1);
1005 if (a->lan.addr.addr32[0] > b->lan.addr.addr32[0])
1006 return (1);
1007 if (a->lan.addr.addr32[0] < b->lan.addr.addr32[0])
1008 return (-1);
1009 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
1010 return (1);
1011 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
1012 return (-1);
1013 #endif
1014 break;
1015 #endif /* INET6 */
1016 }
1017
1018 #ifndef NO_APPLE_EXTENSIONS
1019 if (a->app_state && b->app_state) {
1020 if (a->app_state->compare_lan_ext &&
1021 b->app_state->compare_lan_ext) {
1022 diff = (const char *)b->app_state->compare_lan_ext -
1023 (const char *)a->app_state->compare_lan_ext;
1024 if (diff != 0)
1025 return (diff);
1026 diff = a->app_state->compare_lan_ext(a->app_state,
1027 b->app_state);
1028 if (diff != 0)
1029 return (diff);
1030 }
1031 }
1032 #else
1033 if ((diff = a->lan.port - b->lan.port) != 0)
1034 return (diff);
1035 if ((diff = a->ext.port - b->ext.port) != 0)
1036 return (diff);
1037 #endif
1038
1039 return (0);
1040 }
1041
1042 static __inline int
1043 pf_state_compare_ext_gwy(struct pf_state_key *a, struct pf_state_key *b)
1044 {
1045 int diff;
1046 #ifndef NO_APPLE_EXTENSIONS
1047 int extfilter;
1048 #endif
1049
1050 if ((diff = a->proto - b->proto) != 0)
1051 return (diff);
1052
1053 if ((diff = a->af - b->af) != 0)
1054 return (diff);
1055
1056 #ifndef NO_APPLE_EXTENSIONS
1057 extfilter = PF_EXTFILTER_APD;
1058
1059 switch (a->proto) {
1060 case IPPROTO_ICMP:
1061 case IPPROTO_ICMPV6:
1062 if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0)
1063 return (diff);
1064 break;
1065
1066 case IPPROTO_TCP:
1067 if ((diff = a->ext.xport.port - b->ext.xport.port) != 0)
1068 return (diff);
1069 if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0)
1070 return (diff);
1071 break;
1072
1073 case IPPROTO_UDP:
1074 if ((diff = a->proto_variant - b->proto_variant))
1075 return (diff);
1076 extfilter = a->proto_variant;
1077 if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0)
1078 return (diff);
1079 if ((extfilter < PF_EXTFILTER_AD) &&
1080 (diff = a->ext.xport.port - b->ext.xport.port) != 0)
1081 return (diff);
1082 break;
1083
1084 case IPPROTO_GRE:
1085 if (a->proto_variant == PF_GRE_PPTP_VARIANT &&
1086 a->proto_variant == b->proto_variant) {
1087 if (!!(diff = a->gwy.xport.call_id -
1088 b->gwy.xport.call_id))
1089 return (diff);
1090 }
1091 break;
1092
1093 case IPPROTO_ESP:
1094 if (!!(diff = a->gwy.xport.spi - b->gwy.xport.spi))
1095 return (diff);
1096 break;
1097
1098 default:
1099 break;
1100 }
1101 #endif
1102
1103 switch (a->af) {
1104 #if INET
1105 case AF_INET:
1106 #ifndef NO_APPLE_EXTENSIONS
1107 if (a->gwy.addr.addr32[0] > b->gwy.addr.addr32[0])
1108 return (1);
1109 if (a->gwy.addr.addr32[0] < b->gwy.addr.addr32[0])
1110 return (-1);
1111 if (extfilter < PF_EXTFILTER_EI) {
1112 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
1113 return (1);
1114 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
1115 return (-1);
1116 }
1117 #else
1118 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
1119 return (1);
1120 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
1121 return (-1);
1122 if (a->gwy.addr.addr32[0] > b->gwy.addr.addr32[0])
1123 return (1);
1124 if (a->gwy.addr.addr32[0] < b->gwy.addr.addr32[0])
1125 return (-1);
1126 #endif
1127 break;
1128 #endif /* INET */
1129 #if INET6
1130 case AF_INET6:
1131 #ifndef NO_APPLE_EXTENSIONS
1132 if (a->gwy.addr.addr32[3] > b->gwy.addr.addr32[3])
1133 return (1);
1134 if (a->gwy.addr.addr32[3] < b->gwy.addr.addr32[3])
1135 return (-1);
1136 if (a->gwy.addr.addr32[2] > b->gwy.addr.addr32[2])
1137 return (1);
1138 if (a->gwy.addr.addr32[2] < b->gwy.addr.addr32[2])
1139 return (-1);
1140 if (a->gwy.addr.addr32[1] > b->gwy.addr.addr32[1])
1141 return (1);
1142 if (a->gwy.addr.addr32[1] < b->gwy.addr.addr32[1])
1143 return (-1);
1144 if (a->gwy.addr.addr32[0] > b->gwy.addr.addr32[0])
1145 return (1);
1146 if (a->gwy.addr.addr32[0] < b->gwy.addr.addr32[0])
1147 return (-1);
1148 if (extfilter < PF_EXTFILTER_EI ||
1149 !PF_AZERO(&b->ext.addr, AF_INET6)) {
1150 if (a->ext.addr.addr32[3] > b->ext.addr.addr32[3])
1151 return (1);
1152 if (a->ext.addr.addr32[3] < b->ext.addr.addr32[3])
1153 return (-1);
1154 if (a->ext.addr.addr32[2] > b->ext.addr.addr32[2])
1155 return (1);
1156 if (a->ext.addr.addr32[2] < b->ext.addr.addr32[2])
1157 return (-1);
1158 if (a->ext.addr.addr32[1] > b->ext.addr.addr32[1])
1159 return (1);
1160 if (a->ext.addr.addr32[1] < b->ext.addr.addr32[1])
1161 return (-1);
1162 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
1163 return (1);
1164 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
1165 return (-1);
1166 }
1167 #else
1168 if (a->ext.addr.addr32[3] > b->ext.addr.addr32[3])
1169 return (1);
1170 if (a->ext.addr.addr32[3] < b->ext.addr.addr32[3])
1171 return (-1);
1172 if (a->gwy.addr.addr32[3] > b->gwy.addr.addr32[3])
1173 return (1);
1174 if (a->gwy.addr.addr32[3] < b->gwy.addr.addr32[3])
1175 return (-1);
1176 if (a->ext.addr.addr32[2] > b->ext.addr.addr32[2])
1177 return (1);
1178 if (a->ext.addr.addr32[2] < b->ext.addr.addr32[2])
1179 return (-1);
1180 if (a->gwy.addr.addr32[2] > b->gwy.addr.addr32[2])
1181 return (1);
1182 if (a->gwy.addr.addr32[2] < b->gwy.addr.addr32[2])
1183 return (-1);
1184 if (a->ext.addr.addr32[1] > b->ext.addr.addr32[1])
1185 return (1);
1186 if (a->ext.addr.addr32[1] < b->ext.addr.addr32[1])
1187 return (-1);
1188 if (a->gwy.addr.addr32[1] > b->gwy.addr.addr32[1])
1189 return (1);
1190 if (a->gwy.addr.addr32[1] < b->gwy.addr.addr32[1])
1191 return (-1);
1192 if (a->ext.addr.addr32[0] > b->ext.addr.addr32[0])
1193 return (1);
1194 if (a->ext.addr.addr32[0] < b->ext.addr.addr32[0])
1195 return (-1);
1196 if (a->gwy.addr.addr32[0] > b->gwy.addr.addr32[0])
1197 return (1);
1198 if (a->gwy.addr.addr32[0] < b->gwy.addr.addr32[0])
1199 return (-1);
1200 #endif
1201 break;
1202 #endif /* INET6 */
1203 }
1204
1205 #ifndef NO_APPLE_EXTENSIONS
1206 if (a->app_state && b->app_state) {
1207 if (a->app_state->compare_ext_gwy &&
1208 b->app_state->compare_ext_gwy) {
1209 diff = (const char *)b->app_state->compare_ext_gwy -
1210 (const char *)a->app_state->compare_ext_gwy;
1211 if (diff != 0)
1212 return (diff);
1213 diff = a->app_state->compare_ext_gwy(a->app_state,
1214 b->app_state);
1215 if (diff != 0)
1216 return (diff);
1217 }
1218 }
1219 #else
1220 if ((diff = a->ext.port - b->ext.port) != 0)
1221 return (diff);
1222 if ((diff = a->gwy.port - b->gwy.port) != 0)
1223 return (diff);
1224 #endif
1225
1226 return (0);
1227 }
1228
1229 static __inline int
1230 pf_state_compare_id(struct pf_state *a, struct pf_state *b)
1231 {
1232 if (a->id > b->id)
1233 return (1);
1234 if (a->id < b->id)
1235 return (-1);
1236 if (a->creatorid > b->creatorid)
1237 return (1);
1238 if (a->creatorid < b->creatorid)
1239 return (-1);
1240
1241 return (0);
1242 }
1243
1244 #if INET6
1245 void
1246 pf_addrcpy(struct pf_addr *dst, struct pf_addr *src, sa_family_t af)
1247 {
1248 switch (af) {
1249 #if INET
1250 case AF_INET:
1251 dst->addr32[0] = src->addr32[0];
1252 break;
1253 #endif /* INET */
1254 case AF_INET6:
1255 dst->addr32[0] = src->addr32[0];
1256 dst->addr32[1] = src->addr32[1];
1257 dst->addr32[2] = src->addr32[2];
1258 dst->addr32[3] = src->addr32[3];
1259 break;
1260 }
1261 }
1262 #endif /* INET6 */
1263
1264 struct pf_state *
1265 pf_find_state_byid(struct pf_state_cmp *key)
1266 {
1267 pf_status.fcounters[FCNT_STATE_SEARCH]++;
1268
1269 return (RB_FIND(pf_state_tree_id, &tree_id, (struct pf_state *)key));
1270 }
1271
1272 static struct pf_state *
1273 pf_find_state(struct pfi_kif *kif, struct pf_state_key_cmp *key, u_int dir)
1274 {
1275 struct pf_state_key *sk = NULL;
1276 struct pf_state *s;
1277
1278 pf_status.fcounters[FCNT_STATE_SEARCH]++;
1279
1280 switch (dir) {
1281 case PF_OUT:
1282 sk = RB_FIND(pf_state_tree_lan_ext, &pf_statetbl_lan_ext,
1283 (struct pf_state_key *)key);
1284 break;
1285 case PF_IN:
1286 sk = RB_FIND(pf_state_tree_ext_gwy, &pf_statetbl_ext_gwy,
1287 (struct pf_state_key *)key);
1288 break;
1289 default:
1290 panic("pf_find_state");
1291 }
1292
1293 /* list is sorted, if-bound states before floating ones */
1294 if (sk != NULL)
1295 TAILQ_FOREACH(s, &sk->states, next)
1296 if (s->kif == pfi_all || s->kif == kif)
1297 return (s);
1298
1299 return (NULL);
1300 }
1301
1302 struct pf_state *
1303 pf_find_state_all(struct pf_state_key_cmp *key, u_int dir, int *more)
1304 {
1305 struct pf_state_key *sk = NULL;
1306 struct pf_state *s, *ret = NULL;
1307
1308 pf_status.fcounters[FCNT_STATE_SEARCH]++;
1309
1310 switch (dir) {
1311 case PF_OUT:
1312 sk = RB_FIND(pf_state_tree_lan_ext,
1313 &pf_statetbl_lan_ext, (struct pf_state_key *)key);
1314 break;
1315 case PF_IN:
1316 sk = RB_FIND(pf_state_tree_ext_gwy,
1317 &pf_statetbl_ext_gwy, (struct pf_state_key *)key);
1318 break;
1319 default:
1320 panic("pf_find_state_all");
1321 }
1322
1323 if (sk != NULL) {
1324 ret = TAILQ_FIRST(&sk->states);
1325 if (more == NULL)
1326 return (ret);
1327
1328 TAILQ_FOREACH(s, &sk->states, next)
1329 (*more)++;
1330 }
1331
1332 return (ret);
1333 }
1334
1335 static void
1336 pf_init_threshold(struct pf_threshold *threshold,
1337 u_int32_t limit, u_int32_t seconds)
1338 {
1339 threshold->limit = limit * PF_THRESHOLD_MULT;
1340 threshold->seconds = seconds;
1341 threshold->count = 0;
1342 threshold->last = pf_time_second();
1343 }
1344
1345 static void
1346 pf_add_threshold(struct pf_threshold *threshold)
1347 {
1348 u_int32_t t = pf_time_second(), diff = t - threshold->last;
1349
1350 if (diff >= threshold->seconds)
1351 threshold->count = 0;
1352 else
1353 threshold->count -= threshold->count * diff /
1354 threshold->seconds;
1355 threshold->count += PF_THRESHOLD_MULT;
1356 threshold->last = t;
1357 }
1358
1359 static int
1360 pf_check_threshold(struct pf_threshold *threshold)
1361 {
1362 return (threshold->count > threshold->limit);
1363 }
1364
1365 static int
1366 pf_src_connlimit(struct pf_state **state)
1367 {
1368 int bad = 0;
1369
1370 (*state)->src_node->conn++;
1371 VERIFY((*state)->src_node->conn != 0);
1372 (*state)->src.tcp_est = 1;
1373 pf_add_threshold(&(*state)->src_node->conn_rate);
1374
1375 if ((*state)->rule.ptr->max_src_conn &&
1376 (*state)->rule.ptr->max_src_conn <
1377 (*state)->src_node->conn) {
1378 pf_status.lcounters[LCNT_SRCCONN]++;
1379 bad++;
1380 }
1381
1382 if ((*state)->rule.ptr->max_src_conn_rate.limit &&
1383 pf_check_threshold(&(*state)->src_node->conn_rate)) {
1384 pf_status.lcounters[LCNT_SRCCONNRATE]++;
1385 bad++;
1386 }
1387
1388 if (!bad)
1389 return (0);
1390
1391 if ((*state)->rule.ptr->overload_tbl) {
1392 struct pfr_addr p;
1393 u_int32_t killed = 0;
1394
1395 pf_status.lcounters[LCNT_OVERLOAD_TABLE]++;
1396 if (pf_status.debug >= PF_DEBUG_MISC) {
1397 printf("pf_src_connlimit: blocking address ");
1398 pf_print_host(&(*state)->src_node->addr, 0,
1399 (*state)->state_key->af);
1400 }
1401
1402 bzero(&p, sizeof (p));
1403 p.pfra_af = (*state)->state_key->af;
1404 switch ((*state)->state_key->af) {
1405 #if INET
1406 case AF_INET:
1407 p.pfra_net = 32;
1408 p.pfra_ip4addr = (*state)->src_node->addr.v4;
1409 break;
1410 #endif /* INET */
1411 #if INET6
1412 case AF_INET6:
1413 p.pfra_net = 128;
1414 p.pfra_ip6addr = (*state)->src_node->addr.v6;
1415 break;
1416 #endif /* INET6 */
1417 }
1418
1419 pfr_insert_kentry((*state)->rule.ptr->overload_tbl,
1420 &p, pf_calendar_time_second());
1421
1422 /* kill existing states if that's required. */
1423 if ((*state)->rule.ptr->flush) {
1424 struct pf_state_key *sk;
1425 struct pf_state *st;
1426
1427 pf_status.lcounters[LCNT_OVERLOAD_FLUSH]++;
1428 RB_FOREACH(st, pf_state_tree_id, &tree_id) {
1429 sk = st->state_key;
1430 /*
1431 * Kill states from this source. (Only those
1432 * from the same rule if PF_FLUSH_GLOBAL is not
1433 * set)
1434 */
1435 if (sk->af ==
1436 (*state)->state_key->af &&
1437 (((*state)->state_key->direction ==
1438 PF_OUT &&
1439 PF_AEQ(&(*state)->src_node->addr,
1440 &sk->lan.addr, sk->af)) ||
1441 ((*state)->state_key->direction == PF_IN &&
1442 PF_AEQ(&(*state)->src_node->addr,
1443 &sk->ext.addr, sk->af))) &&
1444 ((*state)->rule.ptr->flush &
1445 PF_FLUSH_GLOBAL ||
1446 (*state)->rule.ptr == st->rule.ptr)) {
1447 st->timeout = PFTM_PURGE;
1448 st->src.state = st->dst.state =
1449 TCPS_CLOSED;
1450 killed++;
1451 }
1452 }
1453 if (pf_status.debug >= PF_DEBUG_MISC)
1454 printf(", %u states killed", killed);
1455 }
1456 if (pf_status.debug >= PF_DEBUG_MISC)
1457 printf("\n");
1458 }
1459
1460 /* kill this state */
1461 (*state)->timeout = PFTM_PURGE;
1462 (*state)->src.state = (*state)->dst.state = TCPS_CLOSED;
1463 return (1);
1464 }
1465
1466 int
1467 pf_insert_src_node(struct pf_src_node **sn, struct pf_rule *rule,
1468 struct pf_addr *src, sa_family_t af)
1469 {
1470 struct pf_src_node k;
1471
1472 if (*sn == NULL) {
1473 k.af = af;
1474 PF_ACPY(&k.addr, src, af);
1475 if (rule->rule_flag & PFRULE_RULESRCTRACK ||
1476 rule->rpool.opts & PF_POOL_STICKYADDR)
1477 k.rule.ptr = rule;
1478 else
1479 k.rule.ptr = NULL;
1480 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
1481 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k);
1482 }
1483 if (*sn == NULL) {
1484 if (!rule->max_src_nodes ||
1485 rule->src_nodes < rule->max_src_nodes)
1486 (*sn) = pool_get(&pf_src_tree_pl, PR_WAITOK);
1487 else
1488 pf_status.lcounters[LCNT_SRCNODES]++;
1489 if ((*sn) == NULL)
1490 return (-1);
1491 bzero(*sn, sizeof (struct pf_src_node));
1492
1493 pf_init_threshold(&(*sn)->conn_rate,
1494 rule->max_src_conn_rate.limit,
1495 rule->max_src_conn_rate.seconds);
1496
1497 (*sn)->af = af;
1498 if (rule->rule_flag & PFRULE_RULESRCTRACK ||
1499 rule->rpool.opts & PF_POOL_STICKYADDR)
1500 (*sn)->rule.ptr = rule;
1501 else
1502 (*sn)->rule.ptr = NULL;
1503 PF_ACPY(&(*sn)->addr, src, af);
1504 if (RB_INSERT(pf_src_tree,
1505 &tree_src_tracking, *sn) != NULL) {
1506 if (pf_status.debug >= PF_DEBUG_MISC) {
1507 printf("pf: src_tree insert failed: ");
1508 pf_print_host(&(*sn)->addr, 0, af);
1509 printf("\n");
1510 }
1511 pool_put(&pf_src_tree_pl, *sn);
1512 return (-1);
1513 }
1514 (*sn)->creation = pf_time_second();
1515 (*sn)->ruletype = rule->action;
1516 if ((*sn)->rule.ptr != NULL)
1517 (*sn)->rule.ptr->src_nodes++;
1518 pf_status.scounters[SCNT_SRC_NODE_INSERT]++;
1519 pf_status.src_nodes++;
1520 } else {
1521 if (rule->max_src_states &&
1522 (*sn)->states >= rule->max_src_states) {
1523 pf_status.lcounters[LCNT_SRCSTATES]++;
1524 return (-1);
1525 }
1526 }
1527 return (0);
1528 }
1529
1530 static void
1531 pf_stateins_err(const char *tree, struct pf_state *s, struct pfi_kif *kif)
1532 {
1533 struct pf_state_key *sk = s->state_key;
1534
1535 if (pf_status.debug >= PF_DEBUG_MISC) {
1536 #ifndef NO_APPLE_EXTENSIONS
1537 printf("pf: state insert failed: %s %s ", tree, kif->pfik_name);
1538 switch (sk->proto) {
1539 case IPPROTO_TCP:
1540 printf("TCP");
1541 break;
1542 case IPPROTO_UDP:
1543 printf("UDP");
1544 break;
1545 case IPPROTO_ICMP:
1546 printf("ICMP4");
1547 break;
1548 case IPPROTO_ICMPV6:
1549 printf("ICMP6");
1550 break;
1551 default:
1552 printf("PROTO=%u", sk->proto);
1553 break;
1554 }
1555 printf(" lan: ");
1556 pf_print_sk_host(&sk->lan, sk->af, sk->proto,
1557 sk->proto_variant);
1558 printf(" gwy: ");
1559 pf_print_sk_host(&sk->gwy, sk->af, sk->proto,
1560 sk->proto_variant);
1561 printf(" ext: ");
1562 pf_print_sk_host(&sk->ext, sk->af, sk->proto,
1563 sk->proto_variant);
1564 #else
1565 printf("pf: state insert failed: %s %s", tree, kif->pfik_name);
1566 printf(" lan: ");
1567 pf_print_host(&sk->lan.addr, sk->lan.port,
1568 sk->af);
1569 printf(" gwy: ");
1570 pf_print_host(&sk->gwy.addr, sk->gwy.port,
1571 sk->af);
1572 printf(" ext: ");
1573 pf_print_host(&sk->ext.addr, sk->ext.port,
1574 sk->af);
1575 #endif
1576 if (s->sync_flags & PFSTATE_FROMSYNC)
1577 printf(" (from sync)");
1578 printf("\n");
1579 }
1580 }
1581
1582 int
1583 pf_insert_state(struct pfi_kif *kif, struct pf_state *s)
1584 {
1585 struct pf_state_key *cur;
1586 struct pf_state *sp;
1587
1588 VERIFY(s->state_key != NULL);
1589 s->kif = kif;
1590
1591 if ((cur = RB_INSERT(pf_state_tree_lan_ext, &pf_statetbl_lan_ext,
1592 s->state_key)) != NULL) {
1593 /* key exists. check for same kif, if none, add to key */
1594 TAILQ_FOREACH(sp, &cur->states, next)
1595 if (sp->kif == kif) { /* collision! */
1596 pf_stateins_err("tree_lan_ext", s, kif);
1597 pf_detach_state(s,
1598 PF_DT_SKIP_LANEXT|PF_DT_SKIP_EXTGWY);
1599 return (-1);
1600 }
1601 pf_detach_state(s, PF_DT_SKIP_LANEXT|PF_DT_SKIP_EXTGWY);
1602 pf_attach_state(cur, s, kif == pfi_all ? 1 : 0);
1603 }
1604
1605 /* if cur != NULL, we already found a state key and attached to it */
1606 if (cur == NULL && (cur = RB_INSERT(pf_state_tree_ext_gwy,
1607 &pf_statetbl_ext_gwy, s->state_key)) != NULL) {
1608 /* must not happen. we must have found the sk above! */
1609 pf_stateins_err("tree_ext_gwy", s, kif);
1610 pf_detach_state(s, PF_DT_SKIP_EXTGWY);
1611 return (-1);
1612 }
1613
1614 if (s->id == 0 && s->creatorid == 0) {
1615 s->id = htobe64(pf_status.stateid++);
1616 s->creatorid = pf_status.hostid;
1617 }
1618 if (RB_INSERT(pf_state_tree_id, &tree_id, s) != NULL) {
1619 if (pf_status.debug >= PF_DEBUG_MISC) {
1620 printf("pf: state insert failed: "
1621 "id: %016llx creatorid: %08x",
1622 be64toh(s->id), ntohl(s->creatorid));
1623 if (s->sync_flags & PFSTATE_FROMSYNC)
1624 printf(" (from sync)");
1625 printf("\n");
1626 }
1627 pf_detach_state(s, 0);
1628 return (-1);
1629 }
1630 TAILQ_INSERT_TAIL(&state_list, s, entry_list);
1631 pf_status.fcounters[FCNT_STATE_INSERT]++;
1632 pf_status.states++;
1633 VERIFY(pf_status.states != 0);
1634 pfi_kif_ref(kif, PFI_KIF_REF_STATE);
1635 #if NPFSYNC
1636 pfsync_insert_state(s);
1637 #endif
1638 return (0);
1639 }
1640
1641 void
1642 pf_purge_thread_fn(void *v, wait_result_t w)
1643 {
1644 #pragma unused(v, w)
1645 u_int32_t nloops = 0;
1646 int t = 0;
1647
1648 for (;;) {
1649 (void) tsleep(pf_purge_thread_fn, PWAIT, "pftm", t * hz);
1650
1651 lck_rw_lock_shared(pf_perim_lock);
1652 lck_mtx_lock(pf_lock);
1653
1654 /* purge everything if not running */
1655 if (!pf_status.running) {
1656 pf_purge_expired_states(pf_status.states);
1657 pf_purge_expired_fragments();
1658 pf_purge_expired_src_nodes();
1659
1660 /* terminate thread (we don't currently do this) */
1661 if (pf_purge_thread == NULL) {
1662 lck_mtx_unlock(pf_lock);
1663 lck_rw_done(pf_perim_lock);
1664
1665 thread_deallocate(current_thread());
1666 thread_terminate(current_thread());
1667 /* NOTREACHED */
1668 return;
1669 } else {
1670 /* if there's nothing left, sleep w/o timeout */
1671 if (pf_status.states == 0 &&
1672 pf_normalize_isempty() &&
1673 RB_EMPTY(&tree_src_tracking))
1674 t = 0;
1675
1676 lck_mtx_unlock(pf_lock);
1677 lck_rw_done(pf_perim_lock);
1678 continue;
1679 }
1680 } else if (t == 0) {
1681 /* Set timeout to 1 second */
1682 t = 1;
1683 }
1684
1685 /* process a fraction of the state table every second */
1686 pf_purge_expired_states(1 + (pf_status.states
1687 / pf_default_rule.timeout[PFTM_INTERVAL]));
1688
1689 /* purge other expired types every PFTM_INTERVAL seconds */
1690 if (++nloops >= pf_default_rule.timeout[PFTM_INTERVAL]) {
1691 pf_purge_expired_fragments();
1692 pf_purge_expired_src_nodes();
1693 nloops = 0;
1694 }
1695
1696 lck_mtx_unlock(pf_lock);
1697 lck_rw_done(pf_perim_lock);
1698 }
1699 }
1700
1701 u_int64_t
1702 pf_state_expires(const struct pf_state *state)
1703 {
1704 u_int32_t t;
1705 u_int32_t start;
1706 u_int32_t end;
1707 u_int32_t states;
1708
1709 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1710
1711 /* handle all PFTM_* > PFTM_MAX here */
1712 if (state->timeout == PFTM_PURGE)
1713 return (pf_time_second());
1714 if (state->timeout == PFTM_UNTIL_PACKET)
1715 return (0);
1716 VERIFY(state->timeout != PFTM_UNLINKED);
1717 VERIFY(state->timeout < PFTM_MAX);
1718 t = state->rule.ptr->timeout[state->timeout];
1719 if (!t)
1720 t = pf_default_rule.timeout[state->timeout];
1721 start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START];
1722 if (start) {
1723 end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END];
1724 states = state->rule.ptr->states;
1725 } else {
1726 start = pf_default_rule.timeout[PFTM_ADAPTIVE_START];
1727 end = pf_default_rule.timeout[PFTM_ADAPTIVE_END];
1728 states = pf_status.states;
1729 }
1730 if (end && states > start && start < end) {
1731 if (states < end)
1732 return (state->expire + t * (end - states) /
1733 (end - start));
1734 else
1735 return (pf_time_second());
1736 }
1737 return (state->expire + t);
1738 }
1739
1740 void
1741 pf_purge_expired_src_nodes(void)
1742 {
1743 struct pf_src_node *cur, *next;
1744
1745 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1746
1747 for (cur = RB_MIN(pf_src_tree, &tree_src_tracking); cur; cur = next) {
1748 next = RB_NEXT(pf_src_tree, &tree_src_tracking, cur);
1749
1750 if (cur->states <= 0 && cur->expire <= pf_time_second()) {
1751 if (cur->rule.ptr != NULL) {
1752 cur->rule.ptr->src_nodes--;
1753 if (cur->rule.ptr->states <= 0 &&
1754 cur->rule.ptr->max_src_nodes <= 0)
1755 pf_rm_rule(NULL, cur->rule.ptr);
1756 }
1757 RB_REMOVE(pf_src_tree, &tree_src_tracking, cur);
1758 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
1759 pf_status.src_nodes--;
1760 pool_put(&pf_src_tree_pl, cur);
1761 }
1762 }
1763 }
1764
1765 void
1766 pf_src_tree_remove_state(struct pf_state *s)
1767 {
1768 u_int32_t t;
1769
1770 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1771
1772 if (s->src_node != NULL) {
1773 if (s->src.tcp_est) {
1774 VERIFY(s->src_node->conn > 0);
1775 --s->src_node->conn;
1776 }
1777 VERIFY(s->src_node->states > 0);
1778 if (--s->src_node->states <= 0) {
1779 t = s->rule.ptr->timeout[PFTM_SRC_NODE];
1780 if (!t)
1781 t = pf_default_rule.timeout[PFTM_SRC_NODE];
1782 s->src_node->expire = pf_time_second() + t;
1783 }
1784 }
1785 if (s->nat_src_node != s->src_node && s->nat_src_node != NULL) {
1786 VERIFY(s->nat_src_node->states > 0);
1787 if (--s->nat_src_node->states <= 0) {
1788 t = s->rule.ptr->timeout[PFTM_SRC_NODE];
1789 if (!t)
1790 t = pf_default_rule.timeout[PFTM_SRC_NODE];
1791 s->nat_src_node->expire = pf_time_second() + t;
1792 }
1793 }
1794 s->src_node = s->nat_src_node = NULL;
1795 }
1796
1797 void
1798 pf_unlink_state(struct pf_state *cur)
1799 {
1800 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1801
1802 #ifndef NO_APPLE_EXTENSIONS
1803 if (cur->src.state == PF_TCPS_PROXY_DST) {
1804 pf_send_tcp(cur->rule.ptr, cur->state_key->af,
1805 &cur->state_key->ext.addr, &cur->state_key->lan.addr,
1806 cur->state_key->ext.xport.port,
1807 cur->state_key->lan.xport.port,
1808 cur->src.seqhi, cur->src.seqlo + 1,
1809 TH_RST|TH_ACK, 0, 0, 0, 1, cur->tag, NULL, NULL);
1810 }
1811
1812 hook_runloop(&cur->unlink_hooks, HOOK_REMOVE|HOOK_FREE);
1813 #else
1814 if (cur->src.state == PF_TCPS_PROXY_DST) {
1815 pf_send_tcp(cur->rule.ptr, cur->state_key->af,
1816 &cur->state_key->ext.addr, &cur->state_key->lan.addr,
1817 cur->state_key->ext.port, cur->state_key->lan.port,
1818 cur->src.seqhi, cur->src.seqlo + 1,
1819 TH_RST|TH_ACK, 0, 0, 0, 1, cur->tag, NULL, NULL);
1820 }
1821 #endif
1822 RB_REMOVE(pf_state_tree_id, &tree_id, cur);
1823 #if NPFSYNC
1824 if (cur->creatorid == pf_status.hostid)
1825 pfsync_delete_state(cur);
1826 #endif
1827 cur->timeout = PFTM_UNLINKED;
1828 pf_src_tree_remove_state(cur);
1829 pf_detach_state(cur, 0);
1830 }
1831
1832 /* callers should be at splpf and hold the
1833 * write_lock on pf_consistency_lock */
1834 void
1835 pf_free_state(struct pf_state *cur)
1836 {
1837 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1838 #if NPFSYNC
1839 if (pfsyncif != NULL &&
1840 (pfsyncif->sc_bulk_send_next == cur ||
1841 pfsyncif->sc_bulk_terminator == cur))
1842 return;
1843 #endif
1844 VERIFY(cur->timeout == PFTM_UNLINKED);
1845 VERIFY(cur->rule.ptr->states > 0);
1846 if (--cur->rule.ptr->states <= 0 &&
1847 cur->rule.ptr->src_nodes <= 0)
1848 pf_rm_rule(NULL, cur->rule.ptr);
1849 if (cur->nat_rule.ptr != NULL) {
1850 VERIFY(cur->nat_rule.ptr->states > 0);
1851 if (--cur->nat_rule.ptr->states <= 0 &&
1852 cur->nat_rule.ptr->src_nodes <= 0)
1853 pf_rm_rule(NULL, cur->nat_rule.ptr);
1854 }
1855 if (cur->anchor.ptr != NULL) {
1856 VERIFY(cur->anchor.ptr->states > 0);
1857 if (--cur->anchor.ptr->states <= 0)
1858 pf_rm_rule(NULL, cur->anchor.ptr);
1859 }
1860 pf_normalize_tcp_cleanup(cur);
1861 pfi_kif_unref(cur->kif, PFI_KIF_REF_STATE);
1862 TAILQ_REMOVE(&state_list, cur, entry_list);
1863 if (cur->tag)
1864 pf_tag_unref(cur->tag);
1865 pool_put(&pf_state_pl, cur);
1866 pf_status.fcounters[FCNT_STATE_REMOVALS]++;
1867 VERIFY(pf_status.states > 0);
1868 pf_status.states--;
1869 }
1870
1871 void
1872 pf_purge_expired_states(u_int32_t maxcheck)
1873 {
1874 static struct pf_state *cur = NULL;
1875 struct pf_state *next;
1876
1877 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1878
1879 while (maxcheck--) {
1880 /* wrap to start of list when we hit the end */
1881 if (cur == NULL) {
1882 cur = TAILQ_FIRST(&state_list);
1883 if (cur == NULL)
1884 break; /* list empty */
1885 }
1886
1887 /* get next state, as cur may get deleted */
1888 next = TAILQ_NEXT(cur, entry_list);
1889
1890 if (cur->timeout == PFTM_UNLINKED) {
1891 pf_free_state(cur);
1892 } else if (pf_state_expires(cur) <= pf_time_second()) {
1893 /* unlink and free expired state */
1894 pf_unlink_state(cur);
1895 pf_free_state(cur);
1896 }
1897 cur = next;
1898 }
1899 }
1900
1901 int
1902 pf_tbladdr_setup(struct pf_ruleset *rs, struct pf_addr_wrap *aw)
1903 {
1904 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1905
1906 if (aw->type != PF_ADDR_TABLE)
1907 return (0);
1908 if ((aw->p.tbl = pfr_attach_table(rs, aw->v.tblname)) == NULL)
1909 return (1);
1910 return (0);
1911 }
1912
1913 void
1914 pf_tbladdr_remove(struct pf_addr_wrap *aw)
1915 {
1916 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1917
1918 if (aw->type != PF_ADDR_TABLE || aw->p.tbl == NULL)
1919 return;
1920 pfr_detach_table(aw->p.tbl);
1921 aw->p.tbl = NULL;
1922 }
1923
1924 void
1925 pf_tbladdr_copyout(struct pf_addr_wrap *aw)
1926 {
1927 struct pfr_ktable *kt = aw->p.tbl;
1928
1929 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1930
1931 if (aw->type != PF_ADDR_TABLE || kt == NULL)
1932 return;
1933 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1934 kt = kt->pfrkt_root;
1935 aw->p.tbl = NULL;
1936 aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ?
1937 kt->pfrkt_cnt : -1;
1938 }
1939
1940 #ifndef NO_APPLE_EXTENSIONS
1941 static void
1942 pf_print_addr(struct pf_addr *addr, sa_family_t af)
1943 {
1944 switch (af) {
1945 #if INET
1946 case AF_INET: {
1947 u_int32_t a = ntohl(addr->addr32[0]);
1948 printf("%u.%u.%u.%u", (a>>24)&255, (a>>16)&255,
1949 (a>>8)&255, a&255);
1950 break;
1951 }
1952 #endif /* INET */
1953 #if INET6
1954 case AF_INET6: {
1955 u_int16_t b;
1956 u_int8_t i, curstart = 255, curend = 0,
1957 maxstart = 0, maxend = 0;
1958 for (i = 0; i < 8; i++) {
1959 if (!addr->addr16[i]) {
1960 if (curstart == 255)
1961 curstart = i;
1962 else
1963 curend = i;
1964 } else {
1965 if (curstart) {
1966 if ((curend - curstart) >
1967 (maxend - maxstart)) {
1968 maxstart = curstart;
1969 maxend = curend;
1970 curstart = 255;
1971 }
1972 }
1973 }
1974 }
1975 for (i = 0; i < 8; i++) {
1976 if (i >= maxstart && i <= maxend) {
1977 if (maxend != 7) {
1978 if (i == maxstart)
1979 printf(":");
1980 } else {
1981 if (i == maxend)
1982 printf(":");
1983 }
1984 } else {
1985 b = ntohs(addr->addr16[i]);
1986 printf("%x", b);
1987 if (i < 7)
1988 printf(":");
1989 }
1990 }
1991 break;
1992 }
1993 #endif /* INET6 */
1994 }
1995 }
1996
1997 static void
1998 pf_print_sk_host(struct pf_state_host *sh, sa_family_t af, int proto,
1999 u_int8_t proto_variant)
2000 {
2001 pf_print_addr(&sh->addr, af);
2002
2003 switch (proto) {
2004 case IPPROTO_ESP:
2005 if (sh->xport.spi)
2006 printf("[%08x]", ntohl(sh->xport.spi));
2007 break;
2008
2009 case IPPROTO_GRE:
2010 if (proto_variant == PF_GRE_PPTP_VARIANT)
2011 printf("[%u]", ntohs(sh->xport.call_id));
2012 break;
2013
2014 case IPPROTO_TCP:
2015 case IPPROTO_UDP:
2016 printf("[%u]", ntohs(sh->xport.port));
2017 break;
2018
2019 default:
2020 break;
2021 }
2022 }
2023 #endif
2024
2025 static void
2026 pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af)
2027 {
2028 #ifndef NO_APPLE_EXTENSIONS
2029 pf_print_addr(addr, af);
2030 if (p)
2031 printf("[%u]", ntohs(p));
2032 #else
2033 switch (af) {
2034 #if INET
2035 case AF_INET: {
2036 u_int32_t a = ntohl(addr->addr32[0]);
2037 printf("%u.%u.%u.%u", (a>>24)&255, (a>>16)&255,
2038 (a>>8)&255, a&255);
2039 if (p) {
2040 p = ntohs(p);
2041 printf(":%u", p);
2042 }
2043 break;
2044 }
2045 #endif /* INET */
2046 #if INET6
2047 case AF_INET6: {
2048 u_int16_t b;
2049 u_int8_t i, curstart = 255, curend = 0,
2050 maxstart = 0, maxend = 0;
2051 for (i = 0; i < 8; i++) {
2052 if (!addr->addr16[i]) {
2053 if (curstart == 255)
2054 curstart = i;
2055 else
2056 curend = i;
2057 } else {
2058 if (curstart) {
2059 if ((curend - curstart) >
2060 (maxend - maxstart)) {
2061 maxstart = curstart;
2062 maxend = curend;
2063 curstart = 255;
2064 }
2065 }
2066 }
2067 }
2068 for (i = 0; i < 8; i++) {
2069 if (i >= maxstart && i <= maxend) {
2070 if (maxend != 7) {
2071 if (i == maxstart)
2072 printf(":");
2073 } else {
2074 if (i == maxend)
2075 printf(":");
2076 }
2077 } else {
2078 b = ntohs(addr->addr16[i]);
2079 printf("%x", b);
2080 if (i < 7)
2081 printf(":");
2082 }
2083 }
2084 if (p) {
2085 p = ntohs(p);
2086 printf("[%u]", p);
2087 }
2088 break;
2089 }
2090 #endif /* INET6 */
2091 }
2092 #endif
2093 }
2094
2095 void
2096 pf_print_state(struct pf_state *s)
2097 {
2098 struct pf_state_key *sk = s->state_key;
2099 switch (sk->proto) {
2100 #ifndef NO_APPLE_EXTENSIONS
2101 case IPPROTO_ESP:
2102 printf("ESP ");
2103 break;
2104 case IPPROTO_GRE:
2105 printf("GRE%u ", sk->proto_variant);
2106 break;
2107 #endif
2108 case IPPROTO_TCP:
2109 printf("TCP ");
2110 break;
2111 case IPPROTO_UDP:
2112 printf("UDP ");
2113 break;
2114 case IPPROTO_ICMP:
2115 printf("ICMP ");
2116 break;
2117 case IPPROTO_ICMPV6:
2118 printf("ICMPV6 ");
2119 break;
2120 default:
2121 printf("%u ", sk->proto);
2122 break;
2123 }
2124 #ifndef NO_APPLE_EXTENSIONS
2125 pf_print_sk_host(&sk->lan, sk->af, sk->proto, sk->proto_variant);
2126 printf(" ");
2127 pf_print_sk_host(&sk->gwy, sk->af, sk->proto, sk->proto_variant);
2128 printf(" ");
2129 pf_print_sk_host(&sk->ext, sk->af, sk->proto, sk->proto_variant);
2130 #else
2131 pf_print_host(&sk->lan.addr, sk->lan.port, sk->af);
2132 printf(" ");
2133 pf_print_host(&sk->gwy.addr, sk->gwy.port, sk->af);
2134 printf(" ");
2135 pf_print_host(&sk->ext.addr, sk->ext.port, sk->af);
2136 #endif
2137 printf(" [lo=%u high=%u win=%u modulator=%u", s->src.seqlo,
2138 s->src.seqhi, s->src.max_win, s->src.seqdiff);
2139 if (s->src.wscale && s->dst.wscale)
2140 printf(" wscale=%u", s->src.wscale & PF_WSCALE_MASK);
2141 printf("]");
2142 printf(" [lo=%u high=%u win=%u modulator=%u", s->dst.seqlo,
2143 s->dst.seqhi, s->dst.max_win, s->dst.seqdiff);
2144 if (s->src.wscale && s->dst.wscale)
2145 printf(" wscale=%u", s->dst.wscale & PF_WSCALE_MASK);
2146 printf("]");
2147 printf(" %u:%u", s->src.state, s->dst.state);
2148 }
2149
2150 void
2151 pf_print_flags(u_int8_t f)
2152 {
2153 if (f)
2154 printf(" ");
2155 if (f & TH_FIN)
2156 printf("F");
2157 if (f & TH_SYN)
2158 printf("S");
2159 if (f & TH_RST)
2160 printf("R");
2161 if (f & TH_PUSH)
2162 printf("P");
2163 if (f & TH_ACK)
2164 printf("A");
2165 if (f & TH_URG)
2166 printf("U");
2167 if (f & TH_ECE)
2168 printf("E");
2169 if (f & TH_CWR)
2170 printf("W");
2171 }
2172
2173 #define PF_SET_SKIP_STEPS(i) \
2174 do { \
2175 while (head[i] != cur) { \
2176 head[i]->skip[i].ptr = cur; \
2177 head[i] = TAILQ_NEXT(head[i], entries); \
2178 } \
2179 } while (0)
2180
2181 void
2182 pf_calc_skip_steps(struct pf_rulequeue *rules)
2183 {
2184 struct pf_rule *cur, *prev, *head[PF_SKIP_COUNT];
2185 int i;
2186
2187 cur = TAILQ_FIRST(rules);
2188 prev = cur;
2189 for (i = 0; i < PF_SKIP_COUNT; ++i)
2190 head[i] = cur;
2191 while (cur != NULL) {
2192
2193 if (cur->kif != prev->kif || cur->ifnot != prev->ifnot)
2194 PF_SET_SKIP_STEPS(PF_SKIP_IFP);
2195 if (cur->direction != prev->direction)
2196 PF_SET_SKIP_STEPS(PF_SKIP_DIR);
2197 if (cur->af != prev->af)
2198 PF_SET_SKIP_STEPS(PF_SKIP_AF);
2199 if (cur->proto != prev->proto)
2200 PF_SET_SKIP_STEPS(PF_SKIP_PROTO);
2201 if (cur->src.neg != prev->src.neg ||
2202 pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr))
2203 PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR);
2204 #ifndef NO_APPLE_EXTENSIONS
2205 {
2206 union pf_rule_xport *cx = &cur->src.xport;
2207 union pf_rule_xport *px = &prev->src.xport;
2208
2209 switch (cur->proto) {
2210 case IPPROTO_GRE:
2211 case IPPROTO_ESP:
2212 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT);
2213 break;
2214 default:
2215 if (prev->proto == IPPROTO_GRE ||
2216 prev->proto == IPPROTO_ESP ||
2217 cx->range.op != px->range.op ||
2218 cx->range.port[0] != px->range.port[0] ||
2219 cx->range.port[1] != px->range.port[1])
2220 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT);
2221 break;
2222 }
2223 }
2224 #else
2225 if (cur->src.port[0] != prev->src.port[0] ||
2226 cur->src.port[1] != prev->src.port[1] ||
2227 cur->src.port_op != prev->src.port_op)
2228 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT);
2229 #endif
2230 if (cur->dst.neg != prev->dst.neg ||
2231 pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr))
2232 PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR);
2233 #ifndef NO_APPLE_EXTENSIONS
2234 {
2235 union pf_rule_xport *cx = &cur->dst.xport;
2236 union pf_rule_xport *px = &prev->dst.xport;
2237
2238 switch (cur->proto) {
2239 case IPPROTO_GRE:
2240 if (cur->proto != prev->proto ||
2241 cx->call_id != px->call_id)
2242 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
2243 break;
2244 case IPPROTO_ESP:
2245 if (cur->proto != prev->proto ||
2246 cx->spi != px->spi)
2247 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
2248 break;
2249 default:
2250 if (prev->proto == IPPROTO_GRE ||
2251 prev->proto == IPPROTO_ESP ||
2252 cx->range.op != px->range.op ||
2253 cx->range.port[0] != px->range.port[0] ||
2254 cx->range.port[1] != px->range.port[1])
2255 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
2256 break;
2257 }
2258 }
2259 #else
2260 if (cur->dst.port[0] != prev->dst.port[0] ||
2261 cur->dst.port[1] != prev->dst.port[1] ||
2262 cur->dst.port_op != prev->dst.port_op)
2263 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
2264 #endif
2265
2266 prev = cur;
2267 cur = TAILQ_NEXT(cur, entries);
2268 }
2269 for (i = 0; i < PF_SKIP_COUNT; ++i)
2270 PF_SET_SKIP_STEPS(i);
2271 }
2272
2273 static int
2274 pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2)
2275 {
2276 if (aw1->type != aw2->type)
2277 return (1);
2278 switch (aw1->type) {
2279 case PF_ADDR_ADDRMASK:
2280 case PF_ADDR_RANGE:
2281 if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, 0))
2282 return (1);
2283 if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, 0))
2284 return (1);
2285 return (0);
2286 case PF_ADDR_DYNIFTL:
2287 return (aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt);
2288 case PF_ADDR_NOROUTE:
2289 case PF_ADDR_URPFFAILED:
2290 return (0);
2291 case PF_ADDR_TABLE:
2292 return (aw1->p.tbl != aw2->p.tbl);
2293 case PF_ADDR_RTLABEL:
2294 return (aw1->v.rtlabel != aw2->v.rtlabel);
2295 default:
2296 printf("invalid address type: %d\n", aw1->type);
2297 return (1);
2298 }
2299 }
2300
2301 u_int16_t
2302 pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp)
2303 {
2304 u_int32_t l;
2305
2306 if (udp && !cksum)
2307 return (0);
2308 l = cksum + old - new;
2309 l = (l >> 16) + (l & 0xffff);
2310 l = l & 0xffff;
2311 if (udp && !l)
2312 return (0xffff);
2313 return (l);
2314 }
2315
2316 static void
2317 pf_change_ap(int dir, struct mbuf *m, struct pf_addr *a, u_int16_t *p,
2318 u_int16_t *ic, u_int16_t *pc, struct pf_addr *an, u_int16_t pn,
2319 u_int8_t u, sa_family_t af)
2320 {
2321 struct pf_addr ao;
2322 u_int16_t po = *p;
2323
2324 PF_ACPY(&ao, a, af);
2325 PF_ACPY(a, an, af);
2326
2327 *p = pn;
2328
2329 switch (af) {
2330 #if INET
2331 case AF_INET:
2332 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
2333 ao.addr16[0], an->addr16[0], 0),
2334 ao.addr16[1], an->addr16[1], 0);
2335 *p = pn;
2336 /*
2337 * If the packet is originated from an ALG on the NAT gateway
2338 * (source address is loopback or local), in which case the
2339 * TCP/UDP checksum field contains the pseudo header checksum
2340 * that's not yet complemented.
2341 */
2342 if (dir == PF_OUT && m != NULL &&
2343 (m->m_flags & M_PKTHDR) &&
2344 (m->m_pkthdr.csum_flags & (CSUM_TCP | CSUM_UDP))) {
2345 /* Pseudo-header checksum does not include ports */
2346 *pc = ~pf_cksum_fixup(pf_cksum_fixup(~*pc,
2347 ao.addr16[0], an->addr16[0], u),
2348 ao.addr16[1], an->addr16[1], u);
2349 } else {
2350 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc,
2351 ao.addr16[0], an->addr16[0], u),
2352 ao.addr16[1], an->addr16[1], u),
2353 po, pn, u);
2354 }
2355 break;
2356 #endif /* INET */
2357 #if INET6
2358 case AF_INET6:
2359 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2360 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2361 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc,
2362 ao.addr16[0], an->addr16[0], u),
2363 ao.addr16[1], an->addr16[1], u),
2364 ao.addr16[2], an->addr16[2], u),
2365 ao.addr16[3], an->addr16[3], u),
2366 ao.addr16[4], an->addr16[4], u),
2367 ao.addr16[5], an->addr16[5], u),
2368 ao.addr16[6], an->addr16[6], u),
2369 ao.addr16[7], an->addr16[7], u),
2370 po, pn, u);
2371 break;
2372 #endif /* INET6 */
2373 }
2374 }
2375
2376
2377 /* Changes a u_int32_t. Uses a void * so there are no align restrictions */
2378 void
2379 pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u)
2380 {
2381 u_int32_t ao;
2382
2383 memcpy(&ao, a, sizeof (ao));
2384 memcpy(a, &an, sizeof (u_int32_t));
2385 *c = pf_cksum_fixup(pf_cksum_fixup(*c, ao / 65536, an / 65536, u),
2386 ao % 65536, an % 65536, u);
2387 }
2388
2389 #if INET6
2390 static void
2391 pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u)
2392 {
2393 struct pf_addr ao;
2394
2395 PF_ACPY(&ao, a, AF_INET6);
2396 PF_ACPY(a, an, AF_INET6);
2397
2398 *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2399 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2400 pf_cksum_fixup(pf_cksum_fixup(*c,
2401 ao.addr16[0], an->addr16[0], u),
2402 ao.addr16[1], an->addr16[1], u),
2403 ao.addr16[2], an->addr16[2], u),
2404 ao.addr16[3], an->addr16[3], u),
2405 ao.addr16[4], an->addr16[4], u),
2406 ao.addr16[5], an->addr16[5], u),
2407 ao.addr16[6], an->addr16[6], u),
2408 ao.addr16[7], an->addr16[7], u);
2409 }
2410 #endif /* INET6 */
2411
2412 static void
2413 pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa,
2414 struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c,
2415 u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af)
2416 {
2417 struct pf_addr oia, ooa;
2418
2419 PF_ACPY(&oia, ia, af);
2420 PF_ACPY(&ooa, oa, af);
2421
2422 /* Change inner protocol port, fix inner protocol checksum. */
2423 if (ip != NULL) {
2424 u_int16_t oip = *ip;
2425 u_int32_t opc = 0;
2426
2427 if (pc != NULL)
2428 opc = *pc;
2429 *ip = np;
2430 if (pc != NULL)
2431 *pc = pf_cksum_fixup(*pc, oip, *ip, u);
2432 *ic = pf_cksum_fixup(*ic, oip, *ip, 0);
2433 if (pc != NULL)
2434 *ic = pf_cksum_fixup(*ic, opc, *pc, 0);
2435 }
2436 /* Change inner ip address, fix inner ip and icmp checksums. */
2437 PF_ACPY(ia, na, af);
2438 switch (af) {
2439 #if INET
2440 case AF_INET: {
2441 u_int32_t oh2c = *h2c;
2442
2443 *h2c = pf_cksum_fixup(pf_cksum_fixup(*h2c,
2444 oia.addr16[0], ia->addr16[0], 0),
2445 oia.addr16[1], ia->addr16[1], 0);
2446 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
2447 oia.addr16[0], ia->addr16[0], 0),
2448 oia.addr16[1], ia->addr16[1], 0);
2449 *ic = pf_cksum_fixup(*ic, oh2c, *h2c, 0);
2450 break;
2451 }
2452 #endif /* INET */
2453 #if INET6
2454 case AF_INET6:
2455 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2456 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2457 pf_cksum_fixup(pf_cksum_fixup(*ic,
2458 oia.addr16[0], ia->addr16[0], u),
2459 oia.addr16[1], ia->addr16[1], u),
2460 oia.addr16[2], ia->addr16[2], u),
2461 oia.addr16[3], ia->addr16[3], u),
2462 oia.addr16[4], ia->addr16[4], u),
2463 oia.addr16[5], ia->addr16[5], u),
2464 oia.addr16[6], ia->addr16[6], u),
2465 oia.addr16[7], ia->addr16[7], u);
2466 break;
2467 #endif /* INET6 */
2468 }
2469 /* Change outer ip address, fix outer ip or icmpv6 checksum. */
2470 PF_ACPY(oa, na, af);
2471 switch (af) {
2472 #if INET
2473 case AF_INET:
2474 *hc = pf_cksum_fixup(pf_cksum_fixup(*hc,
2475 ooa.addr16[0], oa->addr16[0], 0),
2476 ooa.addr16[1], oa->addr16[1], 0);
2477 break;
2478 #endif /* INET */
2479 #if INET6
2480 case AF_INET6:
2481 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2482 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2483 pf_cksum_fixup(pf_cksum_fixup(*ic,
2484 ooa.addr16[0], oa->addr16[0], u),
2485 ooa.addr16[1], oa->addr16[1], u),
2486 ooa.addr16[2], oa->addr16[2], u),
2487 ooa.addr16[3], oa->addr16[3], u),
2488 ooa.addr16[4], oa->addr16[4], u),
2489 ooa.addr16[5], oa->addr16[5], u),
2490 ooa.addr16[6], oa->addr16[6], u),
2491 ooa.addr16[7], oa->addr16[7], u);
2492 break;
2493 #endif /* INET6 */
2494 }
2495 }
2496
2497
2498 /*
2499 * Need to modulate the sequence numbers in the TCP SACK option
2500 * (credits to Krzysztof Pfaff for report and patch)
2501 */
2502 static int
2503 pf_modulate_sack(struct mbuf *m, int off, struct pf_pdesc *pd,
2504 struct tcphdr *th, struct pf_state_peer *dst)
2505 {
2506 int hlen = (th->th_off << 2) - sizeof (*th), thoptlen = hlen;
2507 u_int8_t opts[MAX_TCPOPTLEN], *opt = opts;
2508 int copyback = 0, i, olen;
2509 struct sackblk sack;
2510
2511 #define TCPOLEN_SACKLEN (TCPOLEN_SACK + 2)
2512 if (hlen < TCPOLEN_SACKLEN ||
2513 !pf_pull_hdr(m, off + sizeof (*th), opts, hlen, NULL, NULL, pd->af))
2514 return (0);
2515
2516 while (hlen >= TCPOLEN_SACKLEN) {
2517 olen = opt[1];
2518 switch (*opt) {
2519 case TCPOPT_EOL: /* FALLTHROUGH */
2520 case TCPOPT_NOP:
2521 opt++;
2522 hlen--;
2523 break;
2524 case TCPOPT_SACK:
2525 if (olen > hlen)
2526 olen = hlen;
2527 if (olen >= TCPOLEN_SACKLEN) {
2528 for (i = 2; i + TCPOLEN_SACK <= olen;
2529 i += TCPOLEN_SACK) {
2530 memcpy(&sack, &opt[i], sizeof (sack));
2531 pf_change_a(&sack.start, &th->th_sum,
2532 htonl(ntohl(sack.start) -
2533 dst->seqdiff), 0);
2534 pf_change_a(&sack.end, &th->th_sum,
2535 htonl(ntohl(sack.end) -
2536 dst->seqdiff), 0);
2537 memcpy(&opt[i], &sack, sizeof (sack));
2538 }
2539 #ifndef NO_APPLE_EXTENSIONS
2540 copyback = off + sizeof (*th) + thoptlen;
2541 #else
2542 copyback = 1;
2543 #endif
2544 }
2545 /* FALLTHROUGH */
2546 default:
2547 if (olen < 2)
2548 olen = 2;
2549 hlen -= olen;
2550 opt += olen;
2551 }
2552 }
2553
2554 #ifndef NO_APPLE_EXTENSIONS
2555 if (copyback) {
2556 m = pf_lazy_makewritable(pd, m, copyback);
2557 if (!m)
2558 return (-1);
2559 m_copyback(m, off + sizeof (*th), thoptlen, opts);
2560 }
2561 #else
2562 if (copyback)
2563 m_copyback(m, off + sizeof (*th), thoptlen, opts);
2564 #endif
2565 return (copyback);
2566 }
2567
2568 static void
2569 pf_send_tcp(const struct pf_rule *r, sa_family_t af,
2570 const struct pf_addr *saddr, const struct pf_addr *daddr,
2571 u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack,
2572 u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl, int tag,
2573 u_int16_t rtag, struct ether_header *eh, struct ifnet *ifp)
2574 {
2575 #pragma unused(eh, ifp)
2576 struct mbuf *m;
2577 int len, tlen;
2578 #if INET
2579 struct ip *h = NULL;
2580 #endif /* INET */
2581 #if INET6
2582 struct ip6_hdr *h6 = NULL;
2583 #endif /* INET6 */
2584 struct tcphdr *th = NULL;
2585 char *opt;
2586 struct pf_mtag *pf_mtag;
2587
2588 /* maximum segment size tcp option */
2589 tlen = sizeof (struct tcphdr);
2590 if (mss)
2591 tlen += 4;
2592
2593 switch (af) {
2594 #if INET
2595 case AF_INET:
2596 len = sizeof (struct ip) + tlen;
2597 break;
2598 #endif /* INET */
2599 #if INET6
2600 case AF_INET6:
2601 len = sizeof (struct ip6_hdr) + tlen;
2602 break;
2603 #endif /* INET6 */
2604 default:
2605 panic("pf_send_tcp: not AF_INET or AF_INET6!");
2606 return;
2607 }
2608
2609 /* create outgoing mbuf */
2610 m = m_gethdr(M_DONTWAIT, MT_HEADER);
2611 if (m == NULL)
2612 return;
2613
2614 if ((pf_mtag = pf_get_mtag(m)) == NULL) {
2615 m_free(m);
2616 return;
2617 }
2618
2619 if (tag)
2620 pf_mtag->flags |= PF_TAG_GENERATED;
2621 pf_mtag->tag = rtag;
2622
2623 if (r != NULL && PF_RTABLEID_IS_VALID(r->rtableid))
2624 pf_mtag->rtableid = r->rtableid;
2625
2626 #if ALTQ
2627 if (r != NULL && r->qid) {
2628 pf_mtag->qid = r->qid;
2629 /* add hints for ecn */
2630 pf_mtag->hdr = mtod(m, struct ip *);
2631 }
2632 #endif /* ALTQ */
2633 m->m_data += max_linkhdr;
2634 m->m_pkthdr.len = m->m_len = len;
2635 m->m_pkthdr.rcvif = NULL;
2636 bzero(m->m_data, len);
2637 switch (af) {
2638 #if INET
2639 case AF_INET:
2640 h = mtod(m, struct ip *);
2641
2642 /* IP header fields included in the TCP checksum */
2643 h->ip_p = IPPROTO_TCP;
2644 h->ip_len = htons(tlen);
2645 h->ip_src.s_addr = saddr->v4.s_addr;
2646 h->ip_dst.s_addr = daddr->v4.s_addr;
2647
2648 th = (struct tcphdr *)((caddr_t)h + sizeof (struct ip));
2649 break;
2650 #endif /* INET */
2651 #if INET6
2652 case AF_INET6:
2653 h6 = mtod(m, struct ip6_hdr *);
2654
2655 /* IP header fields included in the TCP checksum */
2656 h6->ip6_nxt = IPPROTO_TCP;
2657 h6->ip6_plen = htons(tlen);
2658 memcpy(&h6->ip6_src, &saddr->v6, sizeof (struct in6_addr));
2659 memcpy(&h6->ip6_dst, &daddr->v6, sizeof (struct in6_addr));
2660
2661 th = (struct tcphdr *)((caddr_t)h6 + sizeof (struct ip6_hdr));
2662 break;
2663 #endif /* INET6 */
2664 }
2665
2666 /* TCP header */
2667 th->th_sport = sport;
2668 th->th_dport = dport;
2669 th->th_seq = htonl(seq);
2670 th->th_ack = htonl(ack);
2671 th->th_off = tlen >> 2;
2672 th->th_flags = flags;
2673 th->th_win = htons(win);
2674
2675 if (mss) {
2676 opt = (char *)(th + 1);
2677 opt[0] = TCPOPT_MAXSEG;
2678 opt[1] = 4;
2679 #if BYTE_ORDER != BIG_ENDIAN
2680 HTONS(mss);
2681 #endif
2682 bcopy((caddr_t)&mss, (caddr_t)(opt + 2), 2);
2683 }
2684
2685 switch (af) {
2686 #if INET
2687 case AF_INET: {
2688 struct route ro;
2689
2690 /* TCP checksum */
2691 th->th_sum = in_cksum(m, len);
2692
2693 /* Finish the IP header */
2694 h->ip_v = 4;
2695 h->ip_hl = sizeof (*h) >> 2;
2696 h->ip_tos = IPTOS_LOWDELAY;
2697 /*
2698 * ip_output() expects ip_len and ip_off to be in host order.
2699 */
2700 h->ip_len = len;
2701 h->ip_off = (path_mtu_discovery ? IP_DF : 0);
2702 h->ip_ttl = ttl ? ttl : ip_defttl;
2703 h->ip_sum = 0;
2704
2705 bzero(&ro, sizeof (ro));
2706 ip_output(m, NULL, &ro, 0, NULL, NULL);
2707 if (ro.ro_rt != NULL)
2708 rtfree(ro.ro_rt);
2709 break;
2710 }
2711 #endif /* INET */
2712 #if INET6
2713 case AF_INET6: {
2714 struct route_in6 ro6;
2715
2716 /* TCP checksum */
2717 th->th_sum = in6_cksum(m, IPPROTO_TCP,
2718 sizeof (struct ip6_hdr), tlen);
2719
2720 h6->ip6_vfc |= IPV6_VERSION;
2721 h6->ip6_hlim = IPV6_DEFHLIM;
2722
2723 bzero(&ro6, sizeof (ro6));
2724 ip6_output(m, NULL, &ro6, 0, NULL, NULL, 0);
2725 if (ro6.ro_rt != NULL)
2726 rtfree(ro6.ro_rt);
2727 break;
2728 }
2729 #endif /* INET6 */
2730 }
2731 }
2732
2733 static void
2734 pf_send_icmp(struct mbuf *m, u_int8_t type, u_int8_t code, sa_family_t af,
2735 struct pf_rule *r)
2736 {
2737 struct mbuf *m0;
2738 struct pf_mtag *pf_mtag;
2739
2740 m0 = m_copy(m, 0, M_COPYALL);
2741 if (m0 == NULL)
2742 return;
2743
2744 if ((pf_mtag = pf_get_mtag(m0)) == NULL)
2745 return;
2746
2747 pf_mtag->flags |= PF_TAG_GENERATED;
2748
2749 if (PF_RTABLEID_IS_VALID(r->rtableid))
2750 pf_mtag->rtableid = r->rtableid;
2751
2752 #if ALTQ
2753 if (r->qid) {
2754 pf_mtag->qid = r->qid;
2755 /* add hints for ecn */
2756 pf_mtag->hdr = mtod(m0, struct ip *);
2757 }
2758 #endif /* ALTQ */
2759 switch (af) {
2760 #if INET
2761 case AF_INET:
2762 icmp_error(m0, type, code, 0, 0);
2763 break;
2764 #endif /* INET */
2765 #if INET6
2766 case AF_INET6:
2767 icmp6_error(m0, type, code, 0);
2768 break;
2769 #endif /* INET6 */
2770 }
2771 }
2772
2773 /*
2774 * Return 1 if the addresses a and b match (with mask m), otherwise return 0.
2775 * If n is 0, they match if they are equal. If n is != 0, they match if they
2776 * are different.
2777 */
2778 int
2779 pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m,
2780 struct pf_addr *b, sa_family_t af)
2781 {
2782 int match = 0;
2783
2784 switch (af) {
2785 #if INET
2786 case AF_INET:
2787 if ((a->addr32[0] & m->addr32[0]) ==
2788 (b->addr32[0] & m->addr32[0]))
2789 match++;
2790 break;
2791 #endif /* INET */
2792 #if INET6
2793 case AF_INET6:
2794 if (((a->addr32[0] & m->addr32[0]) ==
2795 (b->addr32[0] & m->addr32[0])) &&
2796 ((a->addr32[1] & m->addr32[1]) ==
2797 (b->addr32[1] & m->addr32[1])) &&
2798 ((a->addr32[2] & m->addr32[2]) ==
2799 (b->addr32[2] & m->addr32[2])) &&
2800 ((a->addr32[3] & m->addr32[3]) ==
2801 (b->addr32[3] & m->addr32[3])))
2802 match++;
2803 break;
2804 #endif /* INET6 */
2805 }
2806 if (match) {
2807 if (n)
2808 return (0);
2809 else
2810 return (1);
2811 } else {
2812 if (n)
2813 return (1);
2814 else
2815 return (0);
2816 }
2817 }
2818
2819 /*
2820 * Return 1 if b <= a <= e, otherwise return 0.
2821 */
2822 int
2823 pf_match_addr_range(struct pf_addr *b, struct pf_addr *e,
2824 struct pf_addr *a, sa_family_t af)
2825 {
2826 switch (af) {
2827 #if INET
2828 case AF_INET:
2829 if ((a->addr32[0] < b->addr32[0]) ||
2830 (a->addr32[0] > e->addr32[0]))
2831 return (0);
2832 break;
2833 #endif /* INET */
2834 #if INET6
2835 case AF_INET6: {
2836 int i;
2837
2838 /* check a >= b */
2839 for (i = 0; i < 4; ++i)
2840 if (a->addr32[i] > b->addr32[i])
2841 break;
2842 else if (a->addr32[i] < b->addr32[i])
2843 return (0);
2844 /* check a <= e */
2845 for (i = 0; i < 4; ++i)
2846 if (a->addr32[i] < e->addr32[i])
2847 break;
2848 else if (a->addr32[i] > e->addr32[i])
2849 return (0);
2850 break;
2851 }
2852 #endif /* INET6 */
2853 }
2854 return (1);
2855 }
2856
2857 int
2858 pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p)
2859 {
2860 switch (op) {
2861 case PF_OP_IRG:
2862 return ((p > a1) && (p < a2));
2863 case PF_OP_XRG:
2864 return ((p < a1) || (p > a2));
2865 case PF_OP_RRG:
2866 return ((p >= a1) && (p <= a2));
2867 case PF_OP_EQ:
2868 return (p == a1);
2869 case PF_OP_NE:
2870 return (p != a1);
2871 case PF_OP_LT:
2872 return (p < a1);
2873 case PF_OP_LE:
2874 return (p <= a1);
2875 case PF_OP_GT:
2876 return (p > a1);
2877 case PF_OP_GE:
2878 return (p >= a1);
2879 }
2880 return (0); /* never reached */
2881 }
2882
2883 int
2884 pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p)
2885 {
2886 #if BYTE_ORDER != BIG_ENDIAN
2887 NTOHS(a1);
2888 NTOHS(a2);
2889 NTOHS(p);
2890 #endif
2891 return (pf_match(op, a1, a2, p));
2892 }
2893
2894 #ifndef NO_APPLE_EXTENSIONS
2895 int
2896 pf_match_xport(u_int8_t proto, u_int8_t proto_variant, union pf_rule_xport *rx,
2897 union pf_state_xport *sx)
2898 {
2899 int d = !0;
2900
2901 if (sx) {
2902 switch (proto) {
2903 case IPPROTO_GRE:
2904 if (proto_variant == PF_GRE_PPTP_VARIANT)
2905 d = (rx->call_id == sx->call_id);
2906 break;
2907
2908 case IPPROTO_ESP:
2909 d = (rx->spi == sx->spi);
2910 break;
2911
2912 case IPPROTO_TCP:
2913 case IPPROTO_UDP:
2914 case IPPROTO_ICMP:
2915 case IPPROTO_ICMPV6:
2916 if (rx->range.op)
2917 d = pf_match_port(rx->range.op,
2918 rx->range.port[0], rx->range.port[1],
2919 sx->port);
2920 break;
2921
2922 default:
2923 break;
2924 }
2925 }
2926
2927 return (d);
2928 }
2929 #endif
2930
2931 int
2932 pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u)
2933 {
2934 if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE)
2935 return (0);
2936 return (pf_match(op, a1, a2, u));
2937 }
2938
2939 int
2940 pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g)
2941 {
2942 if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE)
2943 return (0);
2944 return (pf_match(op, a1, a2, g));
2945 }
2946
2947 static int
2948 pf_match_tag(struct mbuf *m, struct pf_rule *r, struct pf_mtag *pf_mtag,
2949 int *tag)
2950 {
2951 #pragma unused(m)
2952 if (*tag == -1)
2953 *tag = pf_mtag->tag;
2954
2955 return ((!r->match_tag_not && r->match_tag == *tag) ||
2956 (r->match_tag_not && r->match_tag != *tag));
2957 }
2958
2959 int
2960 pf_tag_packet(struct mbuf *m, struct pf_mtag *pf_mtag, int tag,
2961 unsigned int rtableid)
2962 {
2963 if (tag <= 0 && !PF_RTABLEID_IS_VALID(rtableid))
2964 return (0);
2965
2966 if (pf_mtag == NULL && (pf_mtag = pf_get_mtag(m)) == NULL)
2967 return (1);
2968
2969 if (tag > 0)
2970 pf_mtag->tag = tag;
2971 if (PF_RTABLEID_IS_VALID(rtableid))
2972 pf_mtag->rtableid = rtableid;
2973
2974 return (0);
2975 }
2976
2977 static void
2978 pf_step_into_anchor(int *depth, struct pf_ruleset **rs, int n,
2979 struct pf_rule **r, struct pf_rule **a, int *match)
2980 {
2981 struct pf_anchor_stackframe *f;
2982
2983 (*r)->anchor->match = 0;
2984 if (match)
2985 *match = 0;
2986 if (*depth >= (int)sizeof (pf_anchor_stack) /
2987 (int)sizeof (pf_anchor_stack[0])) {
2988 printf("pf_step_into_anchor: stack overflow\n");
2989 *r = TAILQ_NEXT(*r, entries);
2990 return;
2991 } else if (*depth == 0 && a != NULL)
2992 *a = *r;
2993 f = pf_anchor_stack + (*depth)++;
2994 f->rs = *rs;
2995 f->r = *r;
2996 if ((*r)->anchor_wildcard) {
2997 f->parent = &(*r)->anchor->children;
2998 if ((f->child = RB_MIN(pf_anchor_node, f->parent)) ==
2999 NULL) {
3000 *r = NULL;
3001 return;
3002 }
3003 *rs = &f->child->ruleset;
3004 } else {
3005 f->parent = NULL;
3006 f->child = NULL;
3007 *rs = &(*r)->anchor->ruleset;
3008 }
3009 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
3010 }
3011
3012 static int
3013 pf_step_out_of_anchor(int *depth, struct pf_ruleset **rs, int n,
3014 struct pf_rule **r, struct pf_rule **a, int *match)
3015 {
3016 struct pf_anchor_stackframe *f;
3017 int quick = 0;
3018
3019 do {
3020 if (*depth <= 0)
3021 break;
3022 f = pf_anchor_stack + *depth - 1;
3023 if (f->parent != NULL && f->child != NULL) {
3024 if (f->child->match ||
3025 (match != NULL && *match)) {
3026 f->r->anchor->match = 1;
3027 *match = 0;
3028 }
3029 f->child = RB_NEXT(pf_anchor_node, f->parent, f->child);
3030 if (f->child != NULL) {
3031 *rs = &f->child->ruleset;
3032 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
3033 if (*r == NULL)
3034 continue;
3035 else
3036 break;
3037 }
3038 }
3039 (*depth)--;
3040 if (*depth == 0 && a != NULL)
3041 *a = NULL;
3042 *rs = f->rs;
3043 if (f->r->anchor->match || (match != NULL && *match))
3044 quick = f->r->quick;
3045 *r = TAILQ_NEXT(f->r, entries);
3046 } while (*r == NULL);
3047
3048 return (quick);
3049 }
3050
3051 #if INET6
3052 void
3053 pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr,
3054 struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af)
3055 {
3056 switch (af) {
3057 #if INET
3058 case AF_INET:
3059 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
3060 ((rmask->addr32[0] ^ 0xffffffff) & saddr->addr32[0]);
3061 break;
3062 #endif /* INET */
3063 case AF_INET6:
3064 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
3065 ((rmask->addr32[0] ^ 0xffffffff) & saddr->addr32[0]);
3066 naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) |
3067 ((rmask->addr32[1] ^ 0xffffffff) & saddr->addr32[1]);
3068 naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) |
3069 ((rmask->addr32[2] ^ 0xffffffff) & saddr->addr32[2]);
3070 naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) |
3071 ((rmask->addr32[3] ^ 0xffffffff) & saddr->addr32[3]);
3072 break;
3073 }
3074 }
3075
3076 void
3077 pf_addr_inc(struct pf_addr *addr, sa_family_t af)
3078 {
3079 switch (af) {
3080 #if INET
3081 case AF_INET:
3082 addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1);
3083 break;
3084 #endif /* INET */
3085 case AF_INET6:
3086 if (addr->addr32[3] == 0xffffffff) {
3087 addr->addr32[3] = 0;
3088 if (addr->addr32[2] == 0xffffffff) {
3089 addr->addr32[2] = 0;
3090 if (addr->addr32[1] == 0xffffffff) {
3091 addr->addr32[1] = 0;
3092 addr->addr32[0] =
3093 htonl(ntohl(addr->addr32[0]) + 1);
3094 } else
3095 addr->addr32[1] =
3096 htonl(ntohl(addr->addr32[1]) + 1);
3097 } else
3098 addr->addr32[2] =
3099 htonl(ntohl(addr->addr32[2]) + 1);
3100 } else
3101 addr->addr32[3] =
3102 htonl(ntohl(addr->addr32[3]) + 1);
3103 break;
3104 }
3105 }
3106 #endif /* INET6 */
3107
3108 #define mix(a, b, c) \
3109 do { \
3110 a -= b; a -= c; a ^= (c >> 13); \
3111 b -= c; b -= a; b ^= (a << 8); \
3112 c -= a; c -= b; c ^= (b >> 13); \
3113 a -= b; a -= c; a ^= (c >> 12); \
3114 b -= c; b -= a; b ^= (a << 16); \
3115 c -= a; c -= b; c ^= (b >> 5); \
3116 a -= b; a -= c; a ^= (c >> 3); \
3117 b -= c; b -= a; b ^= (a << 10); \
3118 c -= a; c -= b; c ^= (b >> 15); \
3119 } while (0)
3120
3121 /*
3122 * hash function based on bridge_hash in if_bridge.c
3123 */
3124 static void
3125 pf_hash(struct pf_addr *inaddr, struct pf_addr *hash,
3126 struct pf_poolhashkey *key, sa_family_t af)
3127 {
3128 u_int32_t a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0];
3129
3130 switch (af) {
3131 #if INET
3132 case AF_INET:
3133 a += inaddr->addr32[0];
3134 b += key->key32[1];
3135 mix(a, b, c);
3136 hash->addr32[0] = c + key->key32[2];
3137 break;
3138 #endif /* INET */
3139 #if INET6
3140 case AF_INET6:
3141 a += inaddr->addr32[0];
3142 b += inaddr->addr32[2];
3143 mix(a, b, c);
3144 hash->addr32[0] = c;
3145 a += inaddr->addr32[1];
3146 b += inaddr->addr32[3];
3147 c += key->key32[1];
3148 mix(a, b, c);
3149 hash->addr32[1] = c;
3150 a += inaddr->addr32[2];
3151 b += inaddr->addr32[1];
3152 c += key->key32[2];
3153 mix(a, b, c);
3154 hash->addr32[2] = c;
3155 a += inaddr->addr32[3];
3156 b += inaddr->addr32[0];
3157 c += key->key32[3];
3158 mix(a, b, c);
3159 hash->addr32[3] = c;
3160 break;
3161 #endif /* INET6 */
3162 }
3163 }
3164
3165 static int
3166 pf_map_addr(sa_family_t af, struct pf_rule *r, struct pf_addr *saddr,
3167 struct pf_addr *naddr, struct pf_addr *init_addr, struct pf_src_node **sn)
3168 {
3169 unsigned char hash[16];
3170 struct pf_pool *rpool = &r->rpool;
3171 struct pf_addr *raddr = &rpool->cur->addr.v.a.addr;
3172 struct pf_addr *rmask = &rpool->cur->addr.v.a.mask;
3173 struct pf_pooladdr *acur = rpool->cur;
3174 struct pf_src_node k;
3175
3176 if (*sn == NULL && r->rpool.opts & PF_POOL_STICKYADDR &&
3177 (r->rpool.opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
3178 k.af = af;
3179 PF_ACPY(&k.addr, saddr, af);
3180 if (r->rule_flag & PFRULE_RULESRCTRACK ||
3181 r->rpool.opts & PF_POOL_STICKYADDR)
3182 k.rule.ptr = r;
3183 else
3184 k.rule.ptr = NULL;
3185 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
3186 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k);
3187 if (*sn != NULL && !PF_AZERO(&(*sn)->raddr, af)) {
3188 PF_ACPY(naddr, &(*sn)->raddr, af);
3189 if (pf_status.debug >= PF_DEBUG_MISC) {
3190 printf("pf_map_addr: src tracking maps ");
3191 pf_print_host(&k.addr, 0, af);
3192 printf(" to ");
3193 pf_print_host(naddr, 0, af);
3194 printf("\n");
3195 }
3196 return (0);
3197 }
3198 }
3199
3200 if (rpool->cur->addr.type == PF_ADDR_NOROUTE)
3201 return (1);
3202 if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
3203 switch (af) {
3204 #if INET
3205 case AF_INET:
3206 if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 &&
3207 (rpool->opts & PF_POOL_TYPEMASK) !=
3208 PF_POOL_ROUNDROBIN)
3209 return (1);
3210 raddr = &rpool->cur->addr.p.dyn->pfid_addr4;
3211 rmask = &rpool->cur->addr.p.dyn->pfid_mask4;
3212 break;
3213 #endif /* INET */
3214 #if INET6
3215 case AF_INET6:
3216 if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 &&
3217 (rpool->opts & PF_POOL_TYPEMASK) !=
3218 PF_POOL_ROUNDROBIN)
3219 return (1);
3220 raddr = &rpool->cur->addr.p.dyn->pfid_addr6;
3221 rmask = &rpool->cur->addr.p.dyn->pfid_mask6;
3222 break;
3223 #endif /* INET6 */
3224 }
3225 } else if (rpool->cur->addr.type == PF_ADDR_TABLE) {
3226 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN)
3227 return (1); /* unsupported */
3228 } else {
3229 raddr = &rpool->cur->addr.v.a.addr;
3230 rmask = &rpool->cur->addr.v.a.mask;
3231 }
3232
3233 switch (rpool->opts & PF_POOL_TYPEMASK) {
3234 case PF_POOL_NONE:
3235 PF_ACPY(naddr, raddr, af);
3236 break;
3237 case PF_POOL_BITMASK:
3238 PF_POOLMASK(naddr, raddr, rmask, saddr, af);
3239 break;
3240 case PF_POOL_RANDOM:
3241 if (init_addr != NULL && PF_AZERO(init_addr, af)) {
3242 switch (af) {
3243 #if INET
3244 case AF_INET:
3245 rpool->counter.addr32[0] = htonl(random());
3246 break;
3247 #endif /* INET */
3248 #if INET6
3249 case AF_INET6:
3250 if (rmask->addr32[3] != 0xffffffff)
3251 rpool->counter.addr32[3] =
3252 htonl(random());
3253 else
3254 break;
3255 if (rmask->addr32[2] != 0xffffffff)
3256 rpool->counter.addr32[2] =
3257 htonl(random());
3258 else
3259 break;
3260 if (rmask->addr32[1] != 0xffffffff)
3261 rpool->counter.addr32[1] =
3262 htonl(random());
3263 else
3264 break;
3265 if (rmask->addr32[0] != 0xffffffff)
3266 rpool->counter.addr32[0] =
3267 htonl(random());
3268 break;
3269 #endif /* INET6 */
3270 }
3271 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af);
3272 PF_ACPY(init_addr, naddr, af);
3273
3274 } else {
3275 PF_AINC(&rpool->counter, af);
3276 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af);
3277 }
3278 break;
3279 case PF_POOL_SRCHASH:
3280 pf_hash(saddr, (struct pf_addr *)&hash, &rpool->key, af);
3281 PF_POOLMASK(naddr, raddr, rmask, (struct pf_addr *)&hash, af);
3282 break;
3283 case PF_POOL_ROUNDROBIN:
3284 if (rpool->cur->addr.type == PF_ADDR_TABLE) {
3285 if (!pfr_pool_get(rpool->cur->addr.p.tbl,
3286 &rpool->tblidx, &rpool->counter,
3287 &raddr, &rmask, af))
3288 goto get_addr;
3289 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
3290 if (!pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
3291 &rpool->tblidx, &rpool->counter,
3292 &raddr, &rmask, af))
3293 goto get_addr;
3294 } else if (pf_match_addr(0, raddr, rmask, &rpool->counter, af))
3295 goto get_addr;
3296
3297 try_next:
3298 if ((rpool->cur = TAILQ_NEXT(rpool->cur, entries)) == NULL)
3299 rpool->cur = TAILQ_FIRST(&rpool->list);
3300 if (rpool->cur->addr.type == PF_ADDR_TABLE) {
3301 rpool->tblidx = -1;
3302 if (pfr_pool_get(rpool->cur->addr.p.tbl,
3303 &rpool->tblidx, &rpool->counter,
3304 &raddr, &rmask, af)) {
3305 /* table contains no address of type 'af' */
3306 if (rpool->cur != acur)
3307 goto try_next;
3308 return (1);
3309 }
3310 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
3311 rpool->tblidx = -1;
3312 if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
3313 &rpool->tblidx, &rpool->counter,
3314 &raddr, &rmask, af)) {
3315 /* table contains no address of type 'af' */
3316 if (rpool->cur != acur)
3317 goto try_next;
3318 return (1);
3319 }
3320 } else {
3321 raddr = &rpool->cur->addr.v.a.addr;
3322 rmask = &rpool->cur->addr.v.a.mask;
3323 PF_ACPY(&rpool->counter, raddr, af);
3324 }
3325
3326 get_addr:
3327 PF_ACPY(naddr, &rpool->counter, af);
3328 if (init_addr != NULL && PF_AZERO(init_addr, af))
3329 PF_ACPY(init_addr, naddr, af);
3330 PF_AINC(&rpool->counter, af);
3331 break;
3332 }
3333 if (*sn != NULL)
3334 PF_ACPY(&(*sn)->raddr, naddr, af);
3335
3336 if (pf_status.debug >= PF_DEBUG_MISC &&
3337 (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
3338 printf("pf_map_addr: selected address ");
3339 pf_print_host(naddr, 0, af);
3340 printf("\n");
3341 }
3342
3343 return (0);
3344 }
3345
3346 #ifndef NO_APPLE_EXTENSIONS
3347 static int
3348 pf_get_sport(struct pf_pdesc *pd, struct pfi_kif *kif, struct pf_rule *r,
3349 struct pf_addr *saddr, union pf_state_xport *sxport, struct pf_addr *daddr,
3350 union pf_state_xport *dxport, struct pf_addr *naddr,
3351 union pf_state_xport *nxport, struct pf_src_node **sn)
3352 #else
3353 int
3354 pf_get_sport(sa_family_t af, u_int8_t proto, struct pf_rule *r,
3355 struct pf_addr *saddr, struct pf_addr *daddr, u_int16_t dport,
3356 struct pf_addr *naddr, u_int16_t *nport, u_int16_t low, u_int16_t high,
3357 struct pf_src_node **sn)
3358 #endif
3359 {
3360 #pragma unused(kif)
3361 struct pf_state_key_cmp key;
3362 struct pf_addr init_addr;
3363 #ifndef NO_APPLE_EXTENSIONS
3364 unsigned int cut;
3365 sa_family_t af = pd->af;
3366 u_int8_t proto = pd->proto;
3367 unsigned int low = r->rpool.proxy_port[0];
3368 unsigned int high = r->rpool.proxy_port[1];
3369 #else
3370 u_int16_t cut;
3371 #endif
3372
3373 bzero(&init_addr, sizeof (init_addr));
3374 if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn))
3375 return (1);
3376
3377 if (proto == IPPROTO_ICMP) {
3378 low = 1;
3379 high = 65535;
3380 }
3381
3382 #ifndef NO_APPLE_EXTENSIONS
3383 if (!nxport)
3384 return (0); /* No output necessary. */
3385
3386 /*--- Special mapping rules for UDP ---*/
3387 if (proto == IPPROTO_UDP) {
3388
3389 /*--- Never float IKE source port ---*/
3390 if (ntohs(sxport->port) == PF_IKE_PORT) {
3391 nxport->port = sxport->port;
3392 return (0);
3393 }
3394
3395 /*--- Apply exterior mapping options ---*/
3396 if (r->extmap > PF_EXTMAP_APD) {
3397 struct pf_state *s;
3398
3399 TAILQ_FOREACH(s, &state_list, entry_list) {
3400 struct pf_state_key *sk = s->state_key;
3401 if (!sk)
3402 continue;
3403 if (s->nat_rule.ptr != r)
3404 continue;
3405 if (sk->proto != IPPROTO_UDP || sk->af != af)
3406 continue;
3407 if (sk->lan.xport.port != sxport->port)
3408 continue;
3409 if (PF_ANEQ(&sk->lan.addr, saddr, af))
3410 continue;
3411 if (r->extmap < PF_EXTMAP_EI &&
3412 PF_ANEQ(&sk->ext.addr, daddr, af))
3413 continue;
3414
3415 nxport->port = sk->gwy.xport.port;
3416 return (0);
3417 }
3418 }
3419 } else if (proto == IPPROTO_TCP) {
3420 struct pf_state* s;
3421 /*
3422 * APPLE MODIFICATION: <rdar://problem/6546358>
3423 * Fix allows....NAT to use a single binding for TCP session
3424 * with same source IP and source port
3425 */
3426 TAILQ_FOREACH(s, &state_list, entry_list) {
3427 struct pf_state_key* sk = s->state_key;
3428 if (!sk)
3429 continue;
3430 if (s->nat_rule.ptr != r)
3431 continue;
3432 if (sk->proto != IPPROTO_TCP || sk->af != af)
3433 continue;
3434 if (sk->lan.xport.port != sxport->port)
3435 continue;
3436 if (!(PF_AEQ(&sk->lan.addr, saddr, af)))
3437 continue;
3438 nxport->port = sk->gwy.xport.port;
3439 return (0);
3440 }
3441 }
3442 #endif
3443 do {
3444 key.af = af;
3445 key.proto = proto;
3446 PF_ACPY(&key.ext.addr, daddr, key.af);
3447 PF_ACPY(&key.gwy.addr, naddr, key.af);
3448 #ifndef NO_APPLE_EXTENSIONS
3449 switch (proto) {
3450 case IPPROTO_UDP:
3451 key.proto_variant = r->extfilter;
3452 break;
3453 default:
3454 key.proto_variant = 0;
3455 break;
3456 }
3457 if (dxport)
3458 key.ext.xport = *dxport;
3459 else
3460 memset(&key.ext.xport, 0, sizeof (key.ext.xport));
3461 #else
3462 key.ext.port = dport;
3463 #endif
3464 /*
3465 * port search; start random, step;
3466 * similar 2 portloop in in_pcbbind
3467 */
3468 if (!(proto == IPPROTO_TCP || proto == IPPROTO_UDP ||
3469 proto == IPPROTO_ICMP)) {
3470 #ifndef NO_APPLE_EXTENSIONS
3471 if (dxport)
3472 key.gwy.xport = *dxport;
3473 else
3474 memset(&key.gwy.xport, 0,
3475 sizeof (key.ext.xport));
3476 #else
3477 key.gwy.port = dport;
3478 #endif
3479 if (pf_find_state_all(&key, PF_IN, NULL) == NULL)
3480 return (0);
3481 } else if (low == 0 && high == 0) {
3482 #ifndef NO_APPLE_EXTENSIONS
3483 key.gwy.xport = *nxport;
3484 #else
3485 key.gwy.port = *nport;
3486 #endif
3487 if (pf_find_state_all(&key, PF_IN, NULL) == NULL)
3488 return (0);
3489 } else if (low == high) {
3490 #ifndef NO_APPLE_EXTENSIONS
3491 key.gwy.xport.port = htons(low);
3492 if (pf_find_state_all(&key, PF_IN, NULL) == NULL) {
3493 nxport->port = htons(low);
3494 return (0);
3495 }
3496 #else
3497 key.gwy.port = htons(low);
3498 if (pf_find_state_all(&key, PF_IN, NULL) == NULL) {
3499 *nport = htons(low);
3500 return (0);
3501 }
3502 #endif
3503 } else {
3504 #ifndef NO_APPLE_EXTENSIONS
3505 unsigned int tmp;
3506 #else
3507 u_int16_t tmp;
3508 #endif
3509 if (low > high) {
3510 tmp = low;
3511 low = high;
3512 high = tmp;
3513 }
3514 /* low < high */
3515 cut = htonl(random()) % (1 + high - low) + low;
3516 /* low <= cut <= high */
3517 for (tmp = cut; tmp <= high; ++(tmp)) {
3518 #ifndef NO_APPLE_EXTENSIONS
3519 key.gwy.xport.port = htons(tmp);
3520 if (pf_find_state_all(&key, PF_IN, NULL) ==
3521 NULL) {
3522 nxport->port = htons(tmp);
3523 return (0);
3524 }
3525 #else
3526 key.gwy.port = htons(tmp);
3527 if (pf_find_state_all(&key, PF_IN, NULL) ==
3528 NULL) {
3529 *nport = htons(tmp);
3530 return (0);
3531 }
3532 #endif
3533 }
3534 for (tmp = cut - 1; tmp >= low; --(tmp)) {
3535 #ifndef NO_APPLE_EXTENSIONS
3536 key.gwy.xport.port = htons(tmp);
3537 if (pf_find_state_all(&key, PF_IN, NULL) ==
3538 NULL) {
3539 nxport->port = htons(tmp);
3540 return (0);
3541 }
3542 #else
3543 key.gwy.port = htons(tmp);
3544 if (pf_find_state_all(&key, PF_IN, NULL) ==
3545 NULL) {
3546 *nport = htons(tmp);
3547 return (0);
3548 }
3549 #endif
3550 }
3551 }
3552
3553 switch (r->rpool.opts & PF_POOL_TYPEMASK) {
3554 case PF_POOL_RANDOM:
3555 case PF_POOL_ROUNDROBIN:
3556 if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn))
3557 return (1);
3558 break;
3559 case PF_POOL_NONE:
3560 case PF_POOL_SRCHASH:
3561 case PF_POOL_BITMASK:
3562 default:
3563 return (1);
3564 }
3565 } while (!PF_AEQ(&init_addr, naddr, af));
3566
3567 return (1); /* none available */
3568 }
3569
3570 #ifndef NO_APPLE_EXTENSIONS
3571 static struct pf_rule *
3572 pf_match_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
3573 int direction, struct pfi_kif *kif, struct pf_addr *saddr,
3574 union pf_state_xport *sxport, struct pf_addr *daddr,
3575 union pf_state_xport *dxport, int rs_num)
3576 #else
3577 struct pf_rule *
3578 pf_match_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
3579 int direction, struct pfi_kif *kif, struct pf_addr *saddr, u_int16_t sport,
3580 struct pf_addr *daddr, u_int16_t dport, int rs_num)
3581 #endif
3582 {
3583 struct pf_rule *r, *rm = NULL;
3584 struct pf_ruleset *ruleset = NULL;
3585 int tag = -1;
3586 unsigned int rtableid = IFSCOPE_NONE;
3587 int asd = 0;
3588
3589 r = TAILQ_FIRST(pf_main_ruleset.rules[rs_num].active.ptr);
3590 while (r && rm == NULL) {
3591 struct pf_rule_addr *src = NULL, *dst = NULL;
3592 struct pf_addr_wrap *xdst = NULL;
3593 #ifndef NO_APPLE_EXTENSIONS
3594 struct pf_addr_wrap *xsrc = NULL;
3595 union pf_rule_xport rdrxport;
3596 #endif
3597
3598 if (r->action == PF_BINAT && direction == PF_IN) {
3599 src = &r->dst;
3600 if (r->rpool.cur != NULL)
3601 xdst = &r->rpool.cur->addr;
3602 #ifndef NO_APPLE_EXTENSIONS
3603 } else if (r->action == PF_RDR && direction == PF_OUT) {
3604 dst = &r->src;
3605 src = &r->dst;
3606 if (r->rpool.cur != NULL) {
3607 rdrxport.range.op = PF_OP_EQ;
3608 rdrxport.range.port[0] =
3609 htons(r->rpool.proxy_port[0]);
3610 xsrc = &r->rpool.cur->addr;
3611 }
3612 #endif
3613 } else {
3614 src = &r->src;
3615 dst = &r->dst;
3616 }
3617
3618 r->evaluations++;
3619 if (pfi_kif_match(r->kif, kif) == r->ifnot)
3620 r = r->skip[PF_SKIP_IFP].ptr;
3621 else if (r->direction && r->direction != direction)
3622 r = r->skip[PF_SKIP_DIR].ptr;
3623 else if (r->af && r->af != pd->af)
3624 r = r->skip[PF_SKIP_AF].ptr;
3625 else if (r->proto && r->proto != pd->proto)
3626 r = r->skip[PF_SKIP_PROTO].ptr;
3627 #ifndef NO_APPLE_EXTENSIONS
3628 else if (xsrc && PF_MISMATCHAW(xsrc, saddr, pd->af, 0, NULL))
3629 r = TAILQ_NEXT(r, entries);
3630 else if (!xsrc && PF_MISMATCHAW(&src->addr, saddr, pd->af,
3631 src->neg, kif))
3632 r = TAILQ_NEXT(r, entries);
3633 else if (xsrc && (!rdrxport.range.port[0] ||
3634 !pf_match_xport(r->proto, r->proto_variant, &rdrxport,
3635 sxport)))
3636 r = TAILQ_NEXT(r, entries);
3637 else if (!xsrc && !pf_match_xport(r->proto,
3638 r->proto_variant, &src->xport, sxport))
3639 #else
3640 else if (PF_MISMATCHAW(&src->addr, saddr, pd->af,
3641 src->neg, kif))
3642 r = r->skip[src == &r->src ? PF_SKIP_SRC_ADDR :
3643 PF_SKIP_DST_ADDR].ptr;
3644 else if (src->port_op && !pf_match_port(src->port_op,
3645 src->port[0], src->port[1], sport))
3646 #endif
3647 r = r->skip[src == &r->src ? PF_SKIP_SRC_PORT :
3648 PF_SKIP_DST_PORT].ptr;
3649 else if (dst != NULL &&
3650 PF_MISMATCHAW(&dst->addr, daddr, pd->af, dst->neg, NULL))
3651 r = r->skip[PF_SKIP_DST_ADDR].ptr;
3652 else if (xdst != NULL && PF_MISMATCHAW(xdst, daddr, pd->af,
3653 0, NULL))
3654 r = TAILQ_NEXT(r, entries);
3655 #ifndef NO_APPLE_EXTENSIONS
3656 else if (dst && !pf_match_xport(r->proto, r->proto_variant,
3657 &dst->xport, dxport))
3658 #else
3659 else if (dst != NULL && dst->port_op &&
3660 !pf_match_port(dst->port_op, dst->port[0],
3661 dst->port[1], dport))
3662 #endif
3663 r = r->skip[PF_SKIP_DST_PORT].ptr;
3664 else if (r->match_tag && !pf_match_tag(m, r, pd->pf_mtag, &tag))
3665 r = TAILQ_NEXT(r, entries);
3666 else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto !=
3667 IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, m,
3668 off, pd->hdr.tcp), r->os_fingerprint)))
3669 r = TAILQ_NEXT(r, entries);
3670 else {
3671 if (r->tag)
3672 tag = r->tag;
3673 if (PF_RTABLEID_IS_VALID(r->rtableid))
3674 rtableid = r->rtableid;
3675 if (r->anchor == NULL) {
3676 rm = r;
3677 } else
3678 pf_step_into_anchor(&asd, &ruleset, rs_num,
3679 &r, NULL, NULL);
3680 }
3681 if (r == NULL)
3682 pf_step_out_of_anchor(&asd, &ruleset, rs_num, &r,
3683 NULL, NULL);
3684 }
3685 if (pf_tag_packet(m, pd->pf_mtag, tag, rtableid))
3686 return (NULL);
3687 if (rm != NULL && (rm->action == PF_NONAT ||
3688 rm->action == PF_NORDR || rm->action == PF_NOBINAT))
3689 return (NULL);
3690 return (rm);
3691 }
3692
3693 #ifndef NO_APPLE_EXTENSIONS
3694 static struct pf_rule *
3695 pf_get_translation_aux(struct pf_pdesc *pd, struct mbuf *m, int off,
3696 int direction, struct pfi_kif *kif, struct pf_src_node **sn,
3697 struct pf_addr *saddr, union pf_state_xport *sxport, struct pf_addr *daddr,
3698 union pf_state_xport *dxport, struct pf_addr *naddr,
3699 union pf_state_xport *nxport)
3700 #else
3701 struct pf_rule *
3702 pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off, int direction,
3703 struct pfi_kif *kif, struct pf_src_node **sn,
3704 struct pf_addr *saddr, u_int16_t sport,
3705 struct pf_addr *daddr, u_int16_t dport,
3706 struct pf_addr *naddr, u_int16_t *nport)
3707 #endif
3708 {
3709 struct pf_rule *r = NULL;
3710
3711 #ifndef NO_APPLE_EXTENSIONS
3712 if (direction == PF_OUT) {
3713 r = pf_match_translation(pd, m, off, direction, kif, saddr,
3714 sxport, daddr, dxport, PF_RULESET_BINAT);
3715 if (r == NULL)
3716 r = pf_match_translation(pd, m, off, direction, kif,
3717 saddr, sxport, daddr, dxport, PF_RULESET_RDR);
3718 if (r == NULL)
3719 r = pf_match_translation(pd, m, off, direction, kif,
3720 saddr, sxport, daddr, dxport, PF_RULESET_NAT);
3721 } else {
3722 r = pf_match_translation(pd, m, off, direction, kif, saddr,
3723 sxport, daddr, dxport, PF_RULESET_RDR);
3724 if (r == NULL)
3725 r = pf_match_translation(pd, m, off, direction, kif,
3726 saddr, sxport, daddr, dxport, PF_RULESET_BINAT);
3727 }
3728 #else
3729 if (direction == PF_OUT) {
3730 r = pf_match_translation(pd, m, off, direction, kif, saddr,
3731 sport, daddr, dport, PF_RULESET_BINAT);
3732 if (r == NULL)
3733 r = pf_match_translation(pd, m, off, direction, kif,
3734 saddr, sport, daddr, dport, PF_RULESET_NAT);
3735 } else {
3736 r = pf_match_translation(pd, m, off, direction, kif, saddr,
3737 sport, daddr, dport, PF_RULESET_RDR);
3738 if (r == NULL)
3739 r = pf_match_translation(pd, m, off, direction, kif,
3740 saddr, sport, daddr, dport, PF_RULESET_BINAT);
3741 }
3742 #endif
3743
3744 if (r != NULL) {
3745 switch (r->action) {
3746 case PF_NONAT:
3747 case PF_NOBINAT:
3748 case PF_NORDR:
3749 return (NULL);
3750 case PF_NAT:
3751 #ifndef NO_APPLE_EXTENSIONS
3752 if (pf_get_sport(pd, kif, r, saddr, sxport, daddr,
3753 dxport, naddr, nxport, sn)) {
3754 #else
3755 if (pf_get_sport(pd->af, pd->proto, r, saddr,
3756 daddr, dport, naddr, nport, r->rpool.proxy_port[0],
3757 r->rpool.proxy_port[1], sn)) {
3758 #endif
3759 DPFPRINTF(PF_DEBUG_MISC,
3760 ("pf: NAT proxy port allocation "
3761 "(%u-%u) failed\n",
3762 r->rpool.proxy_port[0],
3763 r->rpool.proxy_port[1]));
3764 return (NULL);
3765 }
3766 break;
3767 case PF_BINAT:
3768 switch (direction) {
3769 case PF_OUT:
3770 if (r->rpool.cur->addr.type ==
3771 PF_ADDR_DYNIFTL) {
3772 switch (pd->af) {
3773 #if INET
3774 case AF_INET:
3775 if (r->rpool.cur->addr.p.dyn->
3776 pfid_acnt4 < 1)
3777 return (NULL);
3778 PF_POOLMASK(naddr,
3779 &r->rpool.cur->addr.p.dyn->
3780 pfid_addr4,
3781 &r->rpool.cur->addr.p.dyn->
3782 pfid_mask4,
3783 saddr, AF_INET);
3784 break;
3785 #endif /* INET */
3786 #if INET6
3787 case AF_INET6:
3788 if (r->rpool.cur->addr.p.dyn->
3789 pfid_acnt6 < 1)
3790 return (NULL);
3791 PF_POOLMASK(naddr,
3792 &r->rpool.cur->addr.p.dyn->
3793 pfid_addr6,
3794 &r->rpool.cur->addr.p.dyn->
3795 pfid_mask6,
3796 saddr, AF_INET6);
3797 break;
3798 #endif /* INET6 */
3799 }
3800 } else {
3801 PF_POOLMASK(naddr,
3802 &r->rpool.cur->addr.v.a.addr,
3803 &r->rpool.cur->addr.v.a.mask,
3804 saddr, pd->af);
3805 }
3806 break;
3807 case PF_IN:
3808 if (r->src.addr.type == PF_ADDR_DYNIFTL) {
3809 switch (pd->af) {
3810 #if INET
3811 case AF_INET:
3812 if (r->src.addr.p.dyn->
3813 pfid_acnt4 < 1)
3814 return (NULL);
3815 PF_POOLMASK(naddr,
3816 &r->src.addr.p.dyn->
3817 pfid_addr4,
3818 &r->src.addr.p.dyn->
3819 pfid_mask4,
3820 daddr, AF_INET);
3821 break;
3822 #endif /* INET */
3823 #if INET6
3824 case AF_INET6:
3825 if (r->src.addr.p.dyn->
3826 pfid_acnt6 < 1)
3827 return (NULL);
3828 PF_POOLMASK(naddr,
3829 &r->src.addr.p.dyn->
3830 pfid_addr6,
3831 &r->src.addr.p.dyn->
3832 pfid_mask6,
3833 daddr, AF_INET6);
3834 break;
3835 #endif /* INET6 */
3836 }
3837 } else
3838 PF_POOLMASK(naddr,
3839 &r->src.addr.v.a.addr,
3840 &r->src.addr.v.a.mask, daddr,
3841 pd->af);
3842 break;
3843 }
3844 break;
3845 case PF_RDR: {
3846 #ifndef NO_APPLE_EXTENSIONS
3847 switch (direction) {
3848 case PF_OUT:
3849 if (r->dst.addr.type == PF_ADDR_DYNIFTL) {
3850 switch (pd->af) {
3851 #if INET
3852 case AF_INET:
3853 if (r->dst.addr.p.dyn->
3854 pfid_acnt4 < 1)
3855 return (NULL);
3856 PF_POOLMASK(naddr,
3857 &r->dst.addr.p.dyn->
3858 pfid_addr4,
3859 &r->dst.addr.p.dyn->
3860 pfid_mask4,
3861 daddr, AF_INET);
3862 break;
3863 #endif /* INET */
3864 #if INET6
3865 case AF_INET6:
3866 if (r->dst.addr.p.dyn->
3867 pfid_acnt6 < 1)
3868 return (NULL);
3869 PF_POOLMASK(naddr,
3870 &r->dst.addr.p.dyn->
3871 pfid_addr6,
3872 &r->dst.addr.p.dyn->
3873 pfid_mask6,
3874 daddr, AF_INET6);
3875 break;
3876 #endif /* INET6 */
3877 }
3878 } else {
3879 PF_POOLMASK(naddr,
3880 &r->dst.addr.v.a.addr,
3881 &r->dst.addr.v.a.mask,
3882 daddr, pd->af);
3883 }
3884 if (nxport && r->dst.xport.range.port[0])
3885 nxport->port =
3886 r->dst.xport.range.port[0];
3887 break;
3888 case PF_IN:
3889 if (pf_map_addr(pd->af, r, saddr,
3890 naddr, NULL, sn))
3891 return (NULL);
3892 if ((r->rpool.opts & PF_POOL_TYPEMASK) ==
3893 PF_POOL_BITMASK)
3894 PF_POOLMASK(naddr, naddr,
3895 &r->rpool.cur->addr.v.a.mask, daddr,
3896 pd->af);
3897
3898 if (nxport && dxport) {
3899 if (r->rpool.proxy_port[1]) {
3900 u_int32_t tmp_nport;
3901
3902 tmp_nport =
3903 ((ntohs(dxport->port) -
3904 ntohs(r->dst.xport.range.
3905 port[0])) %
3906 (r->rpool.proxy_port[1] -
3907 r->rpool.proxy_port[0] +
3908 1)) + r->rpool.proxy_port[0];
3909
3910 /* wrap around if necessary */
3911 if (tmp_nport > 65535)
3912 tmp_nport -= 65535;
3913 nxport->port =
3914 htons((u_int16_t)tmp_nport);
3915 } else if (r->rpool.proxy_port[0]) {
3916 nxport->port = htons(r->rpool.
3917 proxy_port[0]);
3918 }
3919 }
3920 break;
3921 }
3922 #else
3923 if (pf_map_addr(pd->af, r, saddr, naddr, NULL, sn))
3924 return (NULL);
3925 if ((r->rpool.opts & PF_POOL_TYPEMASK) ==
3926 PF_POOL_BITMASK)
3927 PF_POOLMASK(naddr, naddr,
3928 &r->rpool.cur->addr.v.a.mask, daddr,
3929 pd->af);
3930
3931 if (r->rpool.proxy_port[1]) {
3932 u_int32_t tmp_nport;
3933
3934 tmp_nport = ((ntohs(dport) -
3935 ntohs(r->dst.port[0])) %
3936 (r->rpool.proxy_port[1] -
3937 r->rpool.proxy_port[0] + 1)) +
3938 r->rpool.proxy_port[0];
3939
3940 /* wrap around if necessary */
3941 if (tmp_nport > 65535)
3942 tmp_nport -= 65535;
3943 *nport = htons((u_int16_t)tmp_nport);
3944 } else if (r->rpool.proxy_port[0])
3945 *nport = htons(r->rpool.proxy_port[0]);
3946 #endif
3947 break;
3948 }
3949 default:
3950 return (NULL);
3951 }
3952 }
3953
3954 return (r);
3955 }
3956
3957 int
3958 pf_socket_lookup(int direction, struct pf_pdesc *pd)
3959 {
3960 struct pf_addr *saddr, *daddr;
3961 u_int16_t sport, dport;
3962 struct inpcbinfo *pi;
3963 struct inpcb *inp = NULL;
3964
3965 if (pd == NULL)
3966 return (-1);
3967 pd->lookup.uid = UID_MAX;
3968 pd->lookup.gid = GID_MAX;
3969 pd->lookup.pid = NO_PID;
3970
3971 switch (pd->proto) {
3972 case IPPROTO_TCP:
3973 if (pd->hdr.tcp == NULL)
3974 return (-1);
3975 sport = pd->hdr.tcp->th_sport;
3976 dport = pd->hdr.tcp->th_dport;
3977 pi = &tcbinfo;
3978 break;
3979 case IPPROTO_UDP:
3980 if (pd->hdr.udp == NULL)
3981 return (-1);
3982 sport = pd->hdr.udp->uh_sport;
3983 dport = pd->hdr.udp->uh_dport;
3984 pi = &udbinfo;
3985 break;
3986 default:
3987 return (-1);
3988 }
3989 if (direction == PF_IN) {
3990 saddr = pd->src;
3991 daddr = pd->dst;
3992 } else {
3993 u_int16_t p;
3994
3995 p = sport;
3996 sport = dport;
3997 dport = p;
3998 saddr = pd->dst;
3999 daddr = pd->src;
4000 }
4001 switch (pd->af) {
4002 #if INET
4003 case AF_INET:
4004 inp = in_pcblookup_hash(pi, saddr->v4, sport, daddr->v4, dport,
4005 0, NULL);
4006 #if INET6
4007 if (inp == NULL) {
4008 struct in6_addr s6, d6;
4009
4010 memset(&s6, 0, sizeof (s6));
4011 s6.s6_addr16[5] = htons(0xffff);
4012 memcpy(&s6.s6_addr32[3], &saddr->v4,
4013 sizeof (saddr->v4));
4014
4015 memset(&d6, 0, sizeof (d6));
4016 d6.s6_addr16[5] = htons(0xffff);
4017 memcpy(&d6.s6_addr32[3], &daddr->v4,
4018 sizeof (daddr->v4));
4019
4020 inp = in6_pcblookup_hash(pi, &s6, sport,
4021 &d6, dport, 0, NULL);
4022 if (inp == NULL) {
4023 inp = in_pcblookup_hash(pi, saddr->v4, sport,
4024 daddr->v4, dport, INPLOOKUP_WILDCARD, NULL);
4025 if (inp == NULL) {
4026 inp = in6_pcblookup_hash(pi, &s6, sport,
4027 &d6, dport, INPLOOKUP_WILDCARD,
4028 NULL);
4029 if (inp == NULL)
4030 return (-1);
4031 }
4032 }
4033 }
4034 #else
4035 if (inp == NULL) {
4036 inp = in_pcblookup_hash(pi, saddr->v4, sport,
4037 daddr->v4, dport, INPLOOKUP_WILDCARD, NULL);
4038 if (inp == NULL)
4039 return (-1);
4040 }
4041 #endif /* !INET6 */
4042 break;
4043 #endif /* INET */
4044 #if INET6
4045 case AF_INET6:
4046 inp = in6_pcblookup_hash(pi, &saddr->v6, sport, &daddr->v6,
4047 dport, 0, NULL);
4048 if (inp == NULL) {
4049 inp = in6_pcblookup_hash(pi, &saddr->v6, sport,
4050 &daddr->v6, dport, INPLOOKUP_WILDCARD, NULL);
4051 if (inp == NULL)
4052 return (-1);
4053 }
4054 break;
4055 #endif /* INET6 */
4056
4057 default:
4058 return (-1);
4059 }
4060
4061 if (inp != NULL)
4062 in_pcb_checkstate(inp, WNT_RELEASE, 0);
4063
4064 return (1);
4065 }
4066
4067 static u_int8_t
4068 pf_get_wscale(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af)
4069 {
4070 int hlen;
4071 u_int8_t hdr[60];
4072 u_int8_t *opt, optlen;
4073 u_int8_t wscale = 0;
4074
4075 hlen = th_off << 2; /* hlen <= sizeof (hdr) */
4076 if (hlen <= (int)sizeof (struct tcphdr))
4077 return (0);
4078 if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af))
4079 return (0);
4080 opt = hdr + sizeof (struct tcphdr);
4081 hlen -= sizeof (struct tcphdr);
4082 while (hlen >= 3) {
4083 switch (*opt) {
4084 case TCPOPT_EOL:
4085 case TCPOPT_NOP:
4086 ++opt;
4087 --hlen;
4088 break;
4089 case TCPOPT_WINDOW:
4090 wscale = opt[2];
4091 if (wscale > TCP_MAX_WINSHIFT)
4092 wscale = TCP_MAX_WINSHIFT;
4093 wscale |= PF_WSCALE_FLAG;
4094 /* FALLTHROUGH */
4095 default:
4096 optlen = opt[1];
4097 if (optlen < 2)
4098 optlen = 2;
4099 hlen -= optlen;
4100 opt += optlen;
4101 break;
4102 }
4103 }
4104 return (wscale);
4105 }
4106
4107 static u_int16_t
4108 pf_get_mss(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af)
4109 {
4110 int hlen;
4111 u_int8_t hdr[60];
4112 u_int8_t *opt, optlen;
4113 u_int16_t mss = tcp_mssdflt;
4114
4115 hlen = th_off << 2; /* hlen <= sizeof (hdr) */
4116 if (hlen <= (int)sizeof (struct tcphdr))
4117 return (0);
4118 if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af))
4119 return (0);
4120 opt = hdr + sizeof (struct tcphdr);
4121 hlen -= sizeof (struct tcphdr);
4122 while (hlen >= TCPOLEN_MAXSEG) {
4123 switch (*opt) {
4124 case TCPOPT_EOL:
4125 case TCPOPT_NOP:
4126 ++opt;
4127 --hlen;
4128 break;
4129 case TCPOPT_MAXSEG:
4130 bcopy((caddr_t)(opt + 2), (caddr_t)&mss, 2);
4131 #if BYTE_ORDER != BIG_ENDIAN
4132 NTOHS(mss);
4133 #endif
4134 /* FALLTHROUGH */
4135 default:
4136 optlen = opt[1];
4137 if (optlen < 2)
4138 optlen = 2;
4139 hlen -= optlen;
4140 opt += optlen;
4141 break;
4142 }
4143 }
4144 return (mss);
4145 }
4146
4147 static u_int16_t
4148 pf_calc_mss(struct pf_addr *addr, sa_family_t af, u_int16_t offer)
4149 {
4150 #if INET
4151 struct sockaddr_in *dst;
4152 struct route ro;
4153 #endif /* INET */
4154 #if INET6
4155 struct sockaddr_in6 *dst6;
4156 struct route_in6 ro6;
4157 #endif /* INET6 */
4158 struct rtentry *rt = NULL;
4159 int hlen;
4160 u_int16_t mss = tcp_mssdflt;
4161
4162 switch (af) {
4163 #if INET
4164 case AF_INET:
4165 hlen = sizeof (struct ip);
4166 bzero(&ro, sizeof (ro));
4167 dst = (struct sockaddr_in *)&ro.ro_dst;
4168 dst->sin_family = AF_INET;
4169 dst->sin_len = sizeof (*dst);
4170 dst->sin_addr = addr->v4;
4171 rtalloc(&ro);
4172 rt = ro.ro_rt;
4173 break;
4174 #endif /* INET */
4175 #if INET6
4176 case AF_INET6:
4177 hlen = sizeof (struct ip6_hdr);
4178 bzero(&ro6, sizeof (ro6));
4179 dst6 = (struct sockaddr_in6 *)&ro6.ro_dst;
4180 dst6->sin6_family = AF_INET6;
4181 dst6->sin6_len = sizeof (*dst6);
4182 dst6->sin6_addr = addr->v6;
4183 rtalloc((struct route *)&ro);
4184 rt = ro6.ro_rt;
4185 break;
4186 #endif /* INET6 */
4187 default:
4188 panic("pf_calc_mss: not AF_INET or AF_INET6!");
4189 return (0);
4190 }
4191
4192 if (rt && rt->rt_ifp) {
4193 mss = rt->rt_ifp->if_mtu - hlen - sizeof (struct tcphdr);
4194 mss = max(tcp_mssdflt, mss);
4195 RTFREE(rt);
4196 }
4197 mss = min(mss, offer);
4198 mss = max(mss, 64); /* sanity - at least max opt space */
4199 return (mss);
4200 }
4201
4202 static void
4203 pf_set_rt_ifp(struct pf_state *s, struct pf_addr *saddr)
4204 {
4205 struct pf_rule *r = s->rule.ptr;
4206
4207 s->rt_kif = NULL;
4208 if (!r->rt || r->rt == PF_FASTROUTE)
4209 return;
4210 switch (s->state_key->af) {
4211 #if INET
4212 case AF_INET:
4213 pf_map_addr(AF_INET, r, saddr, &s->rt_addr, NULL,
4214 &s->nat_src_node);
4215 s->rt_kif = r->rpool.cur->kif;
4216 break;
4217 #endif /* INET */
4218 #if INET6
4219 case AF_INET6:
4220 pf_map_addr(AF_INET6, r, saddr, &s->rt_addr, NULL,
4221 &s->nat_src_node);
4222 s->rt_kif = r->rpool.cur->kif;
4223 break;
4224 #endif /* INET6 */
4225 }
4226 }
4227
4228 static void
4229 pf_attach_state(struct pf_state_key *sk, struct pf_state *s, int tail)
4230 {
4231 s->state_key = sk;
4232 sk->refcnt++;
4233
4234 /* list is sorted, if-bound states before floating */
4235 if (tail)
4236 TAILQ_INSERT_TAIL(&sk->states, s, next);
4237 else
4238 TAILQ_INSERT_HEAD(&sk->states, s, next);
4239 }
4240
4241 static void
4242 pf_detach_state(struct pf_state *s, int flags)
4243 {
4244 struct pf_state_key *sk = s->state_key;
4245
4246 if (sk == NULL)
4247 return;
4248
4249 s->state_key = NULL;
4250 TAILQ_REMOVE(&sk->states, s, next);
4251 if (--sk->refcnt == 0) {
4252 if (!(flags & PF_DT_SKIP_EXTGWY))
4253 RB_REMOVE(pf_state_tree_ext_gwy,
4254 &pf_statetbl_ext_gwy, sk);
4255 if (!(flags & PF_DT_SKIP_LANEXT))
4256 RB_REMOVE(pf_state_tree_lan_ext,
4257 &pf_statetbl_lan_ext, sk);
4258 #ifndef NO_APPLE_EXTENSIONS
4259 if (sk->app_state)
4260 pool_put(&pf_app_state_pl, sk->app_state);
4261 #endif
4262 pool_put(&pf_state_key_pl, sk);
4263 }
4264 }
4265
4266 struct pf_state_key *
4267 pf_alloc_state_key(struct pf_state *s)
4268 {
4269 struct pf_state_key *sk;
4270
4271 if ((sk = pool_get(&pf_state_key_pl, PR_WAITOK)) == NULL)
4272 return (NULL);
4273 bzero(sk, sizeof (*sk));
4274 TAILQ_INIT(&sk->states);
4275 pf_attach_state(sk, s, 0);
4276
4277 return (sk);
4278 }
4279
4280 static u_int32_t
4281 pf_tcp_iss(struct pf_pdesc *pd)
4282 {
4283 MD5_CTX ctx;
4284 u_int32_t digest[4];
4285
4286 if (pf_tcp_secret_init == 0) {
4287 read_random(pf_tcp_secret, sizeof (pf_tcp_secret));
4288 MD5Init(&pf_tcp_secret_ctx);
4289 MD5Update(&pf_tcp_secret_ctx, pf_tcp_secret,
4290 sizeof (pf_tcp_secret));
4291 pf_tcp_secret_init = 1;
4292 }
4293 ctx = pf_tcp_secret_ctx;
4294
4295 MD5Update(&ctx, (char *)&pd->hdr.tcp->th_sport, sizeof (u_short));
4296 MD5Update(&ctx, (char *)&pd->hdr.tcp->th_dport, sizeof (u_short));
4297 if (pd->af == AF_INET6) {
4298 MD5Update(&ctx, (char *)&pd->src->v6, sizeof (struct in6_addr));
4299 MD5Update(&ctx, (char *)&pd->dst->v6, sizeof (struct in6_addr));
4300 } else {
4301 MD5Update(&ctx, (char *)&pd->src->v4, sizeof (struct in_addr));
4302 MD5Update(&ctx, (char *)&pd->dst->v4, sizeof (struct in_addr));
4303 }
4304 MD5Final((u_char *)digest, &ctx);
4305 pf_tcp_iss_off += 4096;
4306 return (digest[0] + random() + pf_tcp_iss_off);
4307 }
4308
4309 static int
4310 pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
4311 struct pfi_kif *kif, struct mbuf *m, int off, void *h,
4312 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm,
4313 struct ifqueue *ifq)
4314 {
4315 #pragma unused(h)
4316 struct pf_rule *nr = NULL;
4317 struct pf_addr *saddr = pd->src, *daddr = pd->dst;
4318 #ifdef NO_APPLE_EXTENSIONS
4319 u_int16_t bport, nport = 0;
4320 #endif
4321 sa_family_t af = pd->af;
4322 struct pf_rule *r, *a = NULL;
4323 struct pf_ruleset *ruleset = NULL;
4324 struct pf_src_node *nsn = NULL;
4325 struct tcphdr *th = pd->hdr.tcp;
4326 u_short reason;
4327 int rewrite = 0, hdrlen = 0;
4328 int tag = -1;
4329 unsigned int rtableid = IFSCOPE_NONE;
4330 int asd = 0;
4331 int match = 0;
4332 int state_icmp = 0;
4333 u_int16_t mss = tcp_mssdflt;
4334 #ifdef NO_APPLE_EXTENSIONS
4335 u_int16_t sport, dport;
4336 #endif
4337 u_int8_t icmptype = 0, icmpcode = 0;
4338
4339 #ifndef NO_APPLE_EXTENSIONS
4340 struct pf_grev1_hdr *grev1 = pd->hdr.grev1;
4341 union pf_state_xport bxport, nxport, sxport, dxport;
4342 #endif
4343
4344 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
4345
4346 if (direction == PF_IN && pf_check_congestion(ifq)) {
4347 REASON_SET(&reason, PFRES_CONGEST);
4348 return (PF_DROP);
4349 }
4350
4351 #ifndef NO_APPLE_EXTENSIONS
4352 hdrlen = 0;
4353 sxport.spi = 0;
4354 dxport.spi = 0;
4355 nxport.spi = 0;
4356 #else
4357 sport = dport = hdrlen = 0;
4358 #endif
4359
4360 switch (pd->proto) {
4361 case IPPROTO_TCP:
4362 #ifndef NO_APPLE_EXTENSIONS
4363 sxport.port = th->th_sport;
4364 dxport.port = th->th_dport;
4365 #else
4366 sport = th->th_sport;
4367 dport = th->th_dport;
4368 #endif
4369 hdrlen = sizeof (*th);
4370 break;
4371 case IPPROTO_UDP:
4372 #ifndef NO_APPLE_EXTENSIONS
4373 sxport.port = pd->hdr.udp->uh_sport;
4374 dxport.port = pd->hdr.udp->uh_dport;
4375 #else
4376 sport = pd->hdr.udp->uh_sport;
4377 dport = pd->hdr.udp->uh_dport;
4378 #endif
4379 hdrlen = sizeof (*pd->hdr.udp);
4380 break;
4381 #if INET
4382 case IPPROTO_ICMP:
4383 if (pd->af != AF_INET)
4384 break;
4385 #ifndef NO_APPLE_EXTENSIONS
4386 sxport.port = dxport.port = pd->hdr.icmp->icmp_id;
4387 hdrlen = ICMP_MINLEN;
4388 #else
4389 sport = dport = pd->hdr.icmp->icmp_id;
4390 #endif
4391 icmptype = pd->hdr.icmp->icmp_type;
4392 icmpcode = pd->hdr.icmp->icmp_code;
4393
4394 if (icmptype == ICMP_UNREACH ||
4395 icmptype == ICMP_SOURCEQUENCH ||
4396 icmptype == ICMP_REDIRECT ||
4397 icmptype == ICMP_TIMXCEED ||
4398 icmptype == ICMP_PARAMPROB)
4399 state_icmp++;
4400 break;
4401 #endif /* INET */
4402 #if INET6
4403 case IPPROTO_ICMPV6:
4404 if (pd->af != AF_INET6)
4405 break;
4406 #ifndef NO_APPLE_EXTENSIONS
4407 sxport.port = dxport.port = pd->hdr.icmp6->icmp6_id;
4408 #else
4409 sport = dport = pd->hdr.icmp6->icmp6_id;
4410 #endif
4411 hdrlen = sizeof (*pd->hdr.icmp6);
4412 icmptype = pd->hdr.icmp6->icmp6_type;
4413 icmpcode = pd->hdr.icmp6->icmp6_code;
4414
4415 if (icmptype == ICMP6_DST_UNREACH ||
4416 icmptype == ICMP6_PACKET_TOO_BIG ||
4417 icmptype == ICMP6_TIME_EXCEEDED ||
4418 icmptype == ICMP6_PARAM_PROB)
4419 state_icmp++;
4420 break;
4421 #endif /* INET6 */
4422 #ifndef NO_APPLE_EXTENSIONS
4423 case IPPROTO_GRE:
4424 if (pd->proto_variant == PF_GRE_PPTP_VARIANT) {
4425 sxport.call_id = dxport.call_id =
4426 pd->hdr.grev1->call_id;
4427 hdrlen = sizeof (*pd->hdr.grev1);
4428 }
4429 break;
4430 case IPPROTO_ESP:
4431 sxport.spi = 0;
4432 dxport.spi = pd->hdr.esp->spi;
4433 hdrlen = sizeof (*pd->hdr.esp);
4434 break;
4435 #endif
4436 }
4437
4438 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
4439
4440 if (direction == PF_OUT) {
4441 #ifndef NO_APPLE_EXTENSIONS
4442 bxport = nxport = sxport;
4443 /* check outgoing packet for BINAT/NAT */
4444 if ((nr = pf_get_translation_aux(pd, m, off, PF_OUT, kif, &nsn,
4445 saddr, &sxport, daddr, &dxport, &pd->naddr, &nxport)) !=
4446 NULL) {
4447 #else
4448 bport = nport = sport;
4449 /* check outgoing packet for BINAT/NAT */
4450 if ((nr = pf_get_translation(pd, m, off, PF_OUT, kif, &nsn,
4451 saddr, sport, daddr, dport, &pd->naddr, &nport)) != NULL) {
4452 #endif
4453 PF_ACPY(&pd->baddr, saddr, af);
4454 switch (pd->proto) {
4455 case IPPROTO_TCP:
4456 #ifndef NO_APPLE_EXTENSIONS
4457 pf_change_ap(direction, pd->mp, saddr,
4458 &th->th_sport, pd->ip_sum, &th->th_sum,
4459 &pd->naddr, nxport.port, 0, af);
4460 sxport.port = th->th_sport;
4461 #else
4462 pf_change_ap(saddr, &th->th_sport, pd->ip_sum,
4463 &th->th_sum, &pd->naddr, nport, 0, af);
4464 sport = th->th_sport;
4465 #endif
4466 rewrite++;
4467 break;
4468 case IPPROTO_UDP:
4469 #ifndef NO_APPLE_EXTENSIONS
4470 pf_change_ap(direction, pd->mp, saddr,
4471 &pd->hdr.udp->uh_sport, pd->ip_sum,
4472 &pd->hdr.udp->uh_sum, &pd->naddr,
4473 nxport.port, 1, af);
4474 sxport.port = pd->hdr.udp->uh_sport;
4475 #else
4476 pf_change_ap(saddr, &pd->hdr.udp->uh_sport,
4477 pd->ip_sum, &pd->hdr.udp->uh_sum,
4478 &pd->naddr, nport, 1, af);
4479 sport = pd->hdr.udp->uh_sport;
4480 #endif
4481 rewrite++;
4482 break;
4483 #if INET
4484 case IPPROTO_ICMP:
4485 pf_change_a(&saddr->v4.s_addr, pd->ip_sum,
4486 pd->naddr.v4.s_addr, 0);
4487 #ifndef NO_APPLE_EXTENSIONS
4488 pd->hdr.icmp->icmp_cksum = pf_cksum_fixup(
4489 pd->hdr.icmp->icmp_cksum, sxport.port,
4490 nxport.port, 0);
4491 pd->hdr.icmp->icmp_id = nxport.port;
4492 ++rewrite;
4493 #else
4494 pd->hdr.icmp->icmp_cksum = pf_cksum_fixup(
4495 pd->hdr.icmp->icmp_cksum, sport, nport, 0);
4496 pd->hdr.icmp->icmp_id = nport;
4497 m_copyback(m, off, ICMP_MINLEN, pd->hdr.icmp);
4498 #endif
4499 break;
4500 #endif /* INET */
4501 #if INET6
4502 case IPPROTO_ICMPV6:
4503 pf_change_a6(saddr, &pd->hdr.icmp6->icmp6_cksum,
4504 &pd->naddr, 0);
4505 rewrite++;
4506 break;
4507 #endif /* INET */
4508 #ifndef NO_APPLE_EXTENSIONS
4509 case IPPROTO_GRE:
4510 switch (af) {
4511 #if INET
4512 case AF_INET:
4513 pf_change_a(&saddr->v4.s_addr,
4514 pd->ip_sum, pd->naddr.v4.s_addr, 0);
4515 break;
4516 #endif /* INET */
4517 #if INET6
4518 case AF_INET6:
4519 PF_ACPY(saddr, &pd->naddr, AF_INET6);
4520 break;
4521 #endif /* INET6 */
4522 }
4523 ++rewrite;
4524 break;
4525 case IPPROTO_ESP:
4526 bxport.spi = 0;
4527 switch (af) {
4528 #if INET
4529 case AF_INET:
4530 pf_change_a(&saddr->v4.s_addr,
4531 pd->ip_sum, pd->naddr.v4.s_addr, 0);
4532 break;
4533 #endif /* INET */
4534 #if INET6
4535 case AF_INET6:
4536 PF_ACPY(saddr, &pd->naddr, AF_INET6);
4537 break;
4538 #endif /* INET6 */
4539 }
4540 break;
4541 #endif
4542 default:
4543 switch (af) {
4544 #if INET
4545 case AF_INET:
4546 pf_change_a(&saddr->v4.s_addr,
4547 pd->ip_sum, pd->naddr.v4.s_addr, 0);
4548 break;
4549 #endif /* INET */
4550 #if INET6
4551 case AF_INET6:
4552 PF_ACPY(saddr, &pd->naddr, af);
4553 break;
4554 #endif /* INET */
4555 }
4556 break;
4557 }
4558
4559 if (nr->natpass)
4560 r = NULL;
4561 pd->nat_rule = nr;
4562 }
4563 } else {
4564 #ifndef NO_APPLE_EXTENSIONS
4565 bxport.port = nxport.port = dxport.port;
4566 /* check incoming packet for BINAT/RDR */
4567 if ((nr = pf_get_translation_aux(pd, m, off, PF_IN, kif, &nsn,
4568 saddr, &sxport, daddr, &dxport, &pd->naddr, &nxport)) !=
4569 NULL) {
4570 #else
4571 bport = nport = dport;
4572 /* check incoming packet for BINAT/RDR */
4573 if ((nr = pf_get_translation(pd, m, off, PF_IN, kif, &nsn,
4574 saddr, sport, daddr, dport, &pd->naddr, &nport)) != NULL) {
4575 #endif
4576 PF_ACPY(&pd->baddr, daddr, af);
4577 switch (pd->proto) {
4578 case IPPROTO_TCP:
4579 #ifndef NO_APPLE_EXTENSIONS
4580 pf_change_ap(direction, pd->mp, daddr,
4581 &th->th_dport, pd->ip_sum, &th->th_sum,
4582 &pd->naddr, nxport.port, 0, af);
4583 dxport.port = th->th_dport;
4584 #else
4585 pf_change_ap(daddr, &th->th_dport, pd->ip_sum,
4586 &th->th_sum, &pd->naddr, nport, 0, af);
4587 dport = th->th_dport;
4588 #endif
4589 rewrite++;
4590 break;
4591 case IPPROTO_UDP:
4592 #ifndef NO_APPLE_EXTENSIONS
4593 pf_change_ap(direction, pd->mp, daddr,
4594 &pd->hdr.udp->uh_dport, pd->ip_sum,
4595 &pd->hdr.udp->uh_sum, &pd->naddr,
4596 nxport.port, 1, af);
4597 dxport.port = pd->hdr.udp->uh_dport;
4598 #else
4599 pf_change_ap(direction, daddr,
4600 &pd->hdr.udp->uh_dport,
4601 pd->ip_sum, &pd->hdr.udp->uh_sum,
4602 &pd->naddr, nport, 1, af);
4603 dport = pd->hdr.udp->uh_dport;
4604 #endif
4605 rewrite++;
4606 break;
4607 #if INET
4608 case IPPROTO_ICMP:
4609 pf_change_a(&daddr->v4.s_addr, pd->ip_sum,
4610 pd->naddr.v4.s_addr, 0);
4611 break;
4612 #endif /* INET */
4613 #if INET6
4614 case IPPROTO_ICMPV6:
4615 pf_change_a6(daddr, &pd->hdr.icmp6->icmp6_cksum,
4616 &pd->naddr, 0);
4617 rewrite++;
4618 break;
4619 #endif /* INET6 */
4620 #ifndef NO_APPLE_EXTENSIONS
4621 case IPPROTO_GRE:
4622 if (pd->proto_variant == PF_GRE_PPTP_VARIANT)
4623 grev1->call_id = nxport.call_id;
4624
4625 switch (af) {
4626 #if INET
4627 case AF_INET:
4628 pf_change_a(&daddr->v4.s_addr,
4629 pd->ip_sum, pd->naddr.v4.s_addr, 0);
4630 break;
4631 #endif /* INET */
4632 #if INET6
4633 case AF_INET6:
4634 PF_ACPY(daddr, &pd->naddr, AF_INET6);
4635 break;
4636 #endif /* INET6 */
4637 }
4638 ++rewrite;
4639 break;
4640 case IPPROTO_ESP:
4641 switch (af) {
4642 #if INET
4643 case AF_INET:
4644 pf_change_a(&daddr->v4.s_addr,
4645 pd->ip_sum, pd->naddr.v4.s_addr, 0);
4646 break;
4647 #endif /* INET */
4648 #if INET6
4649 case AF_INET6:
4650 PF_ACPY(daddr, &pd->naddr, AF_INET6);
4651 break;
4652 #endif /* INET6 */
4653 }
4654 break;
4655 #endif
4656 default:
4657 switch (af) {
4658 #if INET
4659 case AF_INET:
4660 pf_change_a(&daddr->v4.s_addr,
4661 pd->ip_sum, pd->naddr.v4.s_addr, 0);
4662 break;
4663 #endif /* INET */
4664 #if INET6
4665 case AF_INET6:
4666 PF_ACPY(daddr, &pd->naddr, af);
4667 break;
4668 #endif /* INET */
4669 }
4670 break;
4671 }
4672
4673 if (nr->natpass)
4674 r = NULL;
4675 pd->nat_rule = nr;
4676 }
4677 }
4678
4679 #ifndef NO_APPLE_EXTENSIONS
4680 if (nr && nr->tag > 0)
4681 tag = nr->tag;
4682 #endif
4683
4684 while (r != NULL) {
4685 r->evaluations++;
4686 if (pfi_kif_match(r->kif, kif) == r->ifnot)
4687 r = r->skip[PF_SKIP_IFP].ptr;
4688 else if (r->direction && r->direction != direction)
4689 r = r->skip[PF_SKIP_DIR].ptr;
4690 else if (r->af && r->af != af)
4691 r = r->skip[PF_SKIP_AF].ptr;
4692 else if (r->proto && r->proto != pd->proto)
4693 r = r->skip[PF_SKIP_PROTO].ptr;
4694 else if (PF_MISMATCHAW(&r->src.addr, saddr, af,
4695 r->src.neg, kif))
4696 r = r->skip[PF_SKIP_SRC_ADDR].ptr;
4697 /* tcp/udp only. port_op always 0 in other cases */
4698 #ifndef NO_APPLE_EXTENSIONS
4699 else if (r->proto == pd->proto &&
4700 (r->proto == IPPROTO_TCP || r->proto == IPPROTO_UDP) &&
4701 r->src.xport.range.op &&
4702 !pf_match_port(r->src.xport.range.op,
4703 r->src.xport.range.port[0], r->src.xport.range.port[1],
4704 th->th_sport))
4705 #else
4706 else if (r->src.port_op && !pf_match_port(r->src.port_op,
4707 r->src.port[0], r->src.port[1], th->th_sport))
4708 #endif
4709 r = r->skip[PF_SKIP_SRC_PORT].ptr;
4710 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af,
4711 r->dst.neg, NULL))
4712 r = r->skip[PF_SKIP_DST_ADDR].ptr;
4713 /* tcp/udp only. port_op always 0 in other cases */
4714 #ifndef NO_APPLE_EXTENSIONS
4715 else if (r->proto == pd->proto &&
4716 (r->proto == IPPROTO_TCP || r->proto == IPPROTO_UDP) &&
4717 r->dst.xport.range.op &&
4718 !pf_match_port(r->dst.xport.range.op,
4719 r->dst.xport.range.port[0], r->dst.xport.range.port[1],
4720 th->th_dport))
4721 #else
4722 else if (r->dst.port_op && !pf_match_port(r->dst.port_op,
4723 r->dst.port[0], r->dst.port[1], th->th_dport))
4724 #endif
4725 r = r->skip[PF_SKIP_DST_PORT].ptr;
4726 /* icmp only. type always 0 in other cases */
4727 else if (r->type && r->type != icmptype + 1)
4728 r = TAILQ_NEXT(r, entries);
4729 /* icmp only. type always 0 in other cases */
4730 else if (r->code && r->code != icmpcode + 1)
4731 r = TAILQ_NEXT(r, entries);
4732 else if (r->tos && !(r->tos == pd->tos))
4733 r = TAILQ_NEXT(r, entries);
4734 else if (r->rule_flag & PFRULE_FRAGMENT)
4735 r = TAILQ_NEXT(r, entries);
4736 else if (pd->proto == IPPROTO_TCP &&
4737 (r->flagset & th->th_flags) != r->flags)
4738 r = TAILQ_NEXT(r, entries);
4739 /* tcp/udp only. uid.op always 0 in other cases */
4740 else if (r->uid.op && (pd->lookup.done || (pd->lookup.done =
4741 pf_socket_lookup(direction, pd), 1)) &&
4742 !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1],
4743 pd->lookup.uid))
4744 r = TAILQ_NEXT(r, entries);
4745 /* tcp/udp only. gid.op always 0 in other cases */
4746 else if (r->gid.op && (pd->lookup.done || (pd->lookup.done =
4747 pf_socket_lookup(direction, pd), 1)) &&
4748 !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1],
4749 pd->lookup.gid))
4750 r = TAILQ_NEXT(r, entries);
4751 else if (r->prob && r->prob <= (random() % (UINT_MAX - 1) + 1))
4752 r = TAILQ_NEXT(r, entries);
4753 else if (r->match_tag && !pf_match_tag(m, r, pd->pf_mtag, &tag))
4754 r = TAILQ_NEXT(r, entries);
4755 else if (r->os_fingerprint != PF_OSFP_ANY &&
4756 (pd->proto != IPPROTO_TCP || !pf_osfp_match(
4757 pf_osfp_fingerprint(pd, m, off, th),
4758 r->os_fingerprint)))
4759 r = TAILQ_NEXT(r, entries);
4760 else {
4761 if (r->tag)
4762 tag = r->tag;
4763 if (PF_RTABLEID_IS_VALID(r->rtableid))
4764 rtableid = r->rtableid;
4765 if (r->anchor == NULL) {
4766 match = 1;
4767 *rm = r;
4768 *am = a;
4769 *rsm = ruleset;
4770 if ((*rm)->quick)
4771 break;
4772 r = TAILQ_NEXT(r, entries);
4773 } else
4774 pf_step_into_anchor(&asd, &ruleset,
4775 PF_RULESET_FILTER, &r, &a, &match);
4776 }
4777 if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset,
4778 PF_RULESET_FILTER, &r, &a, &match))
4779 break;
4780 }
4781 r = *rm;
4782 a = *am;
4783 ruleset = *rsm;
4784
4785 REASON_SET(&reason, PFRES_MATCH);
4786
4787 if (r->log || (nr != NULL && nr->log)) {
4788 #ifndef NO_APPLE_EXTENSIONS
4789 if (rewrite > 0) {
4790 if (rewrite < off + hdrlen)
4791 rewrite = off + hdrlen;
4792
4793 m = pf_lazy_makewritable(pd, m, rewrite);
4794 if (!m) {
4795 REASON_SET(&reason, PFRES_MEMORY);
4796 return (PF_DROP);
4797 }
4798
4799 m_copyback(m, off, hdrlen, pd->hdr.any);
4800 }
4801 #else
4802 if (rewrite)
4803 m_copyback(m, off, hdrlen, pd->hdr.any);
4804 #endif
4805 PFLOG_PACKET(kif, h, m, af, direction, reason, r->log ? r : nr,
4806 a, ruleset, pd);
4807 }
4808
4809 if ((r->action == PF_DROP) &&
4810 ((r->rule_flag & PFRULE_RETURNRST) ||
4811 (r->rule_flag & PFRULE_RETURNICMP) ||
4812 (r->rule_flag & PFRULE_RETURN))) {
4813 /* undo NAT changes, if they have taken place */
4814 if (nr != NULL) {
4815 if (direction == PF_OUT) {
4816 switch (pd->proto) {
4817 case IPPROTO_TCP:
4818 #ifndef NO_APPLE_EXTENSIONS
4819 pf_change_ap(direction, pd->mp, saddr,
4820 &th->th_sport, pd->ip_sum,
4821 &th->th_sum, &pd->baddr,
4822 bxport.port, 0, af);
4823 sxport.port = th->th_sport;
4824 #else
4825 pf_change_ap(saddr, &th->th_sport,
4826 pd->ip_sum, &th->th_sum,
4827 &pd->baddr, bport, 0, af);
4828 sport = th->th_sport;
4829 #endif
4830 rewrite++;
4831 break;
4832 case IPPROTO_UDP:
4833 #ifndef NO_APPLE_EXTENSIONS
4834 pf_change_ap(direction, pd->mp, saddr,
4835 &pd->hdr.udp->uh_sport, pd->ip_sum,
4836 &pd->hdr.udp->uh_sum, &pd->baddr,
4837 bxport.port, 1, af);
4838 sxport.port = pd->hdr.udp->uh_sport;
4839 #else
4840 pf_change_ap(saddr,
4841 &pd->hdr.udp->uh_sport, pd->ip_sum,
4842 &pd->hdr.udp->uh_sum, &pd->baddr,
4843 bport, 1, af);
4844 sport = pd->hdr.udp->uh_sport;
4845 #endif
4846 rewrite++;
4847 break;
4848 case IPPROTO_ICMP:
4849 #if INET6
4850 case IPPROTO_ICMPV6:
4851 #endif
4852 /* nothing! */
4853 break;
4854 #ifndef NO_APPLE_EXTENSIONS
4855 case IPPROTO_GRE:
4856 PF_ACPY(&pd->baddr, saddr, af);
4857 ++rewrite;
4858 switch (af) {
4859 #if INET
4860 case AF_INET:
4861 pf_change_a(&saddr->v4.s_addr,
4862 pd->ip_sum,
4863 pd->baddr.v4.s_addr, 0);
4864 break;
4865 #endif /* INET */
4866 #if INET6
4867 case AF_INET6:
4868 PF_ACPY(saddr, &pd->baddr,
4869 AF_INET6);
4870 break;
4871 #endif /* INET6 */
4872 }
4873 break;
4874 case IPPROTO_ESP:
4875 PF_ACPY(&pd->baddr, saddr, af);
4876 switch (af) {
4877 #if INET
4878 case AF_INET:
4879 pf_change_a(&saddr->v4.s_addr,
4880 pd->ip_sum,
4881 pd->baddr.v4.s_addr, 0);
4882 break;
4883 #endif /* INET */
4884 #if INET6
4885 case AF_INET6:
4886 PF_ACPY(saddr, &pd->baddr,
4887 AF_INET6);
4888 break;
4889 #endif /* INET6 */
4890 }
4891 break;
4892 #endif
4893 default:
4894 switch (af) {
4895 case AF_INET:
4896 pf_change_a(&saddr->v4.s_addr,
4897 pd->ip_sum,
4898 pd->baddr.v4.s_addr, 0);
4899 break;
4900 case AF_INET6:
4901 PF_ACPY(saddr, &pd->baddr, af);
4902 break;
4903 }
4904 }
4905 } else {
4906 switch (pd->proto) {
4907 case IPPROTO_TCP:
4908 #ifndef NO_APPLE_EXTENSIONS
4909 pf_change_ap(direction, pd->mp, daddr,
4910 &th->th_dport, pd->ip_sum,
4911 &th->th_sum, &pd->baddr,
4912 bxport.port, 0, af);
4913 dxport.port = th->th_dport;
4914 #else
4915 pf_change_ap(daddr, &th->th_dport,
4916 pd->ip_sum, &th->th_sum,
4917 &pd->baddr, bport, 0, af);
4918 dport = th->th_dport;
4919 #endif
4920 rewrite++;
4921 break;
4922 case IPPROTO_UDP:
4923 #ifndef NO_APPLE_EXTENSIONS
4924 pf_change_ap(direction, pd->mp, daddr,
4925 &pd->hdr.udp->uh_dport, pd->ip_sum,
4926 &pd->hdr.udp->uh_sum, &pd->baddr,
4927 bxport.port, 1, af);
4928 dxport.port = pd->hdr.udp->uh_dport;
4929 #else
4930 pf_change_ap(daddr,
4931 &pd->hdr.udp->uh_dport, pd->ip_sum,
4932 &pd->hdr.udp->uh_sum, &pd->baddr,
4933 bport, 1, af);
4934 dport = pd->hdr.udp->uh_dport;
4935 #endif
4936 rewrite++;
4937 break;
4938 case IPPROTO_ICMP:
4939 #if INET6
4940 case IPPROTO_ICMPV6:
4941 #endif
4942 /* nothing! */
4943 break;
4944 #ifndef NO_APPLE_EXTENSIONS
4945 case IPPROTO_GRE:
4946 if (pd->proto_variant ==
4947 PF_GRE_PPTP_VARIANT)
4948 grev1->call_id = bxport.call_id;
4949 ++rewrite;
4950 switch (af) {
4951 #if INET
4952 case AF_INET:
4953 pf_change_a(&daddr->v4.s_addr,
4954 pd->ip_sum,
4955 pd->baddr.v4.s_addr, 0);
4956 break;
4957 #endif /* INET */
4958 #if INET6
4959 case AF_INET6:
4960 PF_ACPY(daddr, &pd->baddr,
4961 AF_INET6);
4962 break;
4963 #endif /* INET6 */
4964 }
4965 break;
4966 case IPPROTO_ESP:
4967 switch (af) {
4968 #if INET
4969 case AF_INET:
4970 pf_change_a(&daddr->v4.s_addr,
4971 pd->ip_sum,
4972 pd->baddr.v4.s_addr, 0);
4973 break;
4974 #endif /* INET */
4975 #if INET6
4976 case AF_INET6:
4977 PF_ACPY(daddr, &pd->baddr,
4978 AF_INET6);
4979 break;
4980 #endif /* INET6 */
4981 }
4982 break;
4983 #endif
4984 default:
4985 switch (af) {
4986 case AF_INET:
4987 pf_change_a(&daddr->v4.s_addr,
4988 pd->ip_sum,
4989 pd->baddr.v4.s_addr, 0);
4990 break;
4991 #if INET6
4992 case AF_INET6:
4993 PF_ACPY(daddr, &pd->baddr, af);
4994 break;
4995 #endif /* INET6 */
4996 }
4997 }
4998 }
4999 }
5000 if (pd->proto == IPPROTO_TCP &&
5001 ((r->rule_flag & PFRULE_RETURNRST) ||
5002 (r->rule_flag & PFRULE_RETURN)) &&
5003 !(th->th_flags & TH_RST)) {
5004 u_int32_t ack = ntohl(th->th_seq) + pd->p_len;
5005 int len = 0;
5006 struct ip *h4;
5007 #if INET6
5008 struct ip6_hdr *h6;
5009 #endif /* INET6 */
5010
5011 switch (af) {
5012 case AF_INET:
5013 h4 = mtod(m, struct ip *);
5014 len = ntohs(h4->ip_len) - off;
5015 break;
5016 #if INET6
5017 case AF_INET6:
5018 h6 = mtod(m, struct ip6_hdr *);
5019 len = ntohs(h6->ip6_plen) -
5020 (off - sizeof (*h6));
5021 break;
5022 #endif /* INET6 */
5023 }
5024
5025 if (pf_check_proto_cksum(m, off, len, IPPROTO_TCP, af))
5026 REASON_SET(&reason, PFRES_PROTCKSUM);
5027 else {
5028 if (th->th_flags & TH_SYN)
5029 ack++;
5030 if (th->th_flags & TH_FIN)
5031 ack++;
5032 pf_send_tcp(r, af, pd->dst,
5033 pd->src, th->th_dport, th->th_sport,
5034 ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0,
5035 r->return_ttl, 1, 0, pd->eh, kif->pfik_ifp);
5036 }
5037 } else if (pd->proto != IPPROTO_ICMP && af == AF_INET &&
5038 #ifndef NO_APPLE_EXTENSIONS
5039 pd->proto != IPPROTO_ESP && pd->proto != IPPROTO_AH &&
5040 #endif
5041 r->return_icmp)
5042 pf_send_icmp(m, r->return_icmp >> 8,
5043 r->return_icmp & 255, af, r);
5044 else if (pd->proto != IPPROTO_ICMPV6 && af == AF_INET6 &&
5045 #ifndef NO_APPLE_EXTENSIONS
5046 pd->proto != IPPROTO_ESP && pd->proto != IPPROTO_AH &&
5047 #endif
5048 r->return_icmp6)
5049 pf_send_icmp(m, r->return_icmp6 >> 8,
5050 r->return_icmp6 & 255, af, r);
5051 }
5052
5053 if (r->action == PF_DROP)
5054 return (PF_DROP);
5055
5056 if (pf_tag_packet(m, pd->pf_mtag, tag, rtableid)) {
5057 REASON_SET(&reason, PFRES_MEMORY);
5058 return (PF_DROP);
5059 }
5060
5061 if (!state_icmp && (r->keep_state || nr != NULL ||
5062 (pd->flags & PFDESC_TCP_NORM))) {
5063 /* create new state */
5064 struct pf_state *s = NULL;
5065 struct pf_state_key *sk = NULL;
5066 struct pf_src_node *sn = NULL;
5067 #ifndef NO_APPLE_EXTENSIONS
5068 struct pf_ike_hdr ike;
5069
5070 if (pd->proto == IPPROTO_UDP) {
5071 struct udphdr *uh = pd->hdr.udp;
5072 size_t plen = m->m_pkthdr.len - off - sizeof (*uh);
5073
5074 if (ntohs(uh->uh_sport) == PF_IKE_PORT &&
5075 ntohs(uh->uh_dport) == PF_IKE_PORT &&
5076 plen >= PF_IKE_PACKET_MINSIZE) {
5077 if (plen > PF_IKE_PACKET_MINSIZE)
5078 plen = PF_IKE_PACKET_MINSIZE;
5079 m_copydata(m, off + sizeof (*uh), plen, &ike);
5080 }
5081 }
5082
5083 if (nr != NULL && pd->proto == IPPROTO_ESP &&
5084 direction == PF_OUT) {
5085 struct pf_state_key_cmp sk0;
5086 struct pf_state *s0;
5087
5088 /*
5089 * <jhw@apple.com>
5090 * This squelches state creation if the external
5091 * address matches an existing incomplete state with a
5092 * different internal address. Only one 'blocking'
5093 * partial state is allowed for each external address.
5094 */
5095 memset(&sk0, 0, sizeof (sk0));
5096 sk0.af = pd->af;
5097 sk0.proto = IPPROTO_ESP;
5098 PF_ACPY(&sk0.gwy.addr, saddr, sk0.af);
5099 PF_ACPY(&sk0.ext.addr, daddr, sk0.af);
5100 s0 = pf_find_state(kif, &sk0, PF_IN);
5101
5102 if (s0 && PF_ANEQ(&s0->state_key->lan.addr,
5103 pd->src, pd->af)) {
5104 nsn = 0;
5105 goto cleanup;
5106 }
5107 }
5108 #endif
5109
5110 /* check maximums */
5111 if (r->max_states && (r->states >= r->max_states)) {
5112 pf_status.lcounters[LCNT_STATES]++;
5113 REASON_SET(&reason, PFRES_MAXSTATES);
5114 goto cleanup;
5115 }
5116 /* src node for filter rule */
5117 if ((r->rule_flag & PFRULE_SRCTRACK ||
5118 r->rpool.opts & PF_POOL_STICKYADDR) &&
5119 pf_insert_src_node(&sn, r, saddr, af) != 0) {
5120 REASON_SET(&reason, PFRES_SRCLIMIT);
5121 goto cleanup;
5122 }
5123 /* src node for translation rule */
5124 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) &&
5125 ((direction == PF_OUT &&
5126 #ifndef NO_APPLE_EXTENSIONS
5127 nr->action != PF_RDR &&
5128 #endif
5129 pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) ||
5130 (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) {
5131 REASON_SET(&reason, PFRES_SRCLIMIT);
5132 goto cleanup;
5133 }
5134 s = pool_get(&pf_state_pl, PR_WAITOK);
5135 if (s == NULL) {
5136 REASON_SET(&reason, PFRES_MEMORY);
5137 cleanup:
5138 if (sn != NULL && sn->states == 0 && sn->expire == 0) {
5139 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn);
5140 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
5141 pf_status.src_nodes--;
5142 pool_put(&pf_src_tree_pl, sn);
5143 }
5144 if (nsn != sn && nsn != NULL && nsn->states == 0 &&
5145 nsn->expire == 0) {
5146 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn);
5147 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
5148 pf_status.src_nodes--;
5149 pool_put(&pf_src_tree_pl, nsn);
5150 }
5151 if (sk != NULL) {
5152 #ifndef NO_APPLE_EXTENSIONS
5153 if (sk->app_state)
5154 pool_put(&pf_app_state_pl,
5155 sk->app_state);
5156 #endif
5157 pool_put(&pf_state_key_pl, sk);
5158 }
5159 return (PF_DROP);
5160 }
5161 bzero(s, sizeof (*s));
5162 #ifndef NO_APPLE_EXTENSIONS
5163 TAILQ_INIT(&s->unlink_hooks);
5164 #endif
5165 s->rule.ptr = r;
5166 s->nat_rule.ptr = nr;
5167 s->anchor.ptr = a;
5168 STATE_INC_COUNTERS(s);
5169 s->allow_opts = r->allow_opts;
5170 s->log = r->log & PF_LOG_ALL;
5171 if (nr != NULL)
5172 s->log |= nr->log & PF_LOG_ALL;
5173 switch (pd->proto) {
5174 case IPPROTO_TCP:
5175 s->src.seqlo = ntohl(th->th_seq);
5176 s->src.seqhi = s->src.seqlo + pd->p_len + 1;
5177 if ((th->th_flags & (TH_SYN|TH_ACK)) ==
5178 TH_SYN && r->keep_state == PF_STATE_MODULATE) {
5179 /* Generate sequence number modulator */
5180 if ((s->src.seqdiff = pf_tcp_iss(pd) -
5181 s->src.seqlo) == 0)
5182 s->src.seqdiff = 1;
5183 pf_change_a(&th->th_seq, &th->th_sum,
5184 htonl(s->src.seqlo + s->src.seqdiff), 0);
5185 rewrite = off + sizeof (*th);
5186 } else
5187 s->src.seqdiff = 0;
5188 if (th->th_flags & TH_SYN) {
5189 s->src.seqhi++;
5190 s->src.wscale = pf_get_wscale(m, off,
5191 th->th_off, af);
5192 }
5193 s->src.max_win = MAX(ntohs(th->th_win), 1);
5194 if (s->src.wscale & PF_WSCALE_MASK) {
5195 /* Remove scale factor from initial window */
5196 int win = s->src.max_win;
5197 win += 1 << (s->src.wscale & PF_WSCALE_MASK);
5198 s->src.max_win = (win - 1) >>
5199 (s->src.wscale & PF_WSCALE_MASK);
5200 }
5201 if (th->th_flags & TH_FIN)
5202 s->src.seqhi++;
5203 s->dst.seqhi = 1;
5204 s->dst.max_win = 1;
5205 s->src.state = TCPS_SYN_SENT;
5206 s->dst.state = TCPS_CLOSED;
5207 s->timeout = PFTM_TCP_FIRST_PACKET;
5208 break;
5209 case IPPROTO_UDP:
5210 s->src.state = PFUDPS_SINGLE;
5211 s->dst.state = PFUDPS_NO_TRAFFIC;
5212 s->timeout = PFTM_UDP_FIRST_PACKET;
5213 break;
5214 case IPPROTO_ICMP:
5215 #if INET6
5216 case IPPROTO_ICMPV6:
5217 #endif
5218 s->timeout = PFTM_ICMP_FIRST_PACKET;
5219 break;
5220 #ifndef NO_APPLE_EXTENSIONS
5221 case IPPROTO_GRE:
5222 s->src.state = PFGRE1S_INITIATING;
5223 s->dst.state = PFGRE1S_NO_TRAFFIC;
5224 s->timeout = PFTM_GREv1_INITIATING;
5225 break;
5226 case IPPROTO_ESP:
5227 s->src.state = PFESPS_INITIATING;
5228 s->dst.state = PFESPS_NO_TRAFFIC;
5229 s->timeout = PFTM_ESP_FIRST_PACKET;
5230 break;
5231 #endif
5232 default:
5233 s->src.state = PFOTHERS_SINGLE;
5234 s->dst.state = PFOTHERS_NO_TRAFFIC;
5235 s->timeout = PFTM_OTHER_FIRST_PACKET;
5236 }
5237
5238 s->creation = pf_time_second();
5239 s->expire = pf_time_second();
5240
5241 if (sn != NULL) {
5242 s->src_node = sn;
5243 s->src_node->states++;
5244 VERIFY(s->src_node->states != 0);
5245 }
5246 if (nsn != NULL) {
5247 PF_ACPY(&nsn->raddr, &pd->naddr, af);
5248 s->nat_src_node = nsn;
5249 s->nat_src_node->states++;
5250 VERIFY(s->nat_src_node->states != 0);
5251 }
5252 if (pd->proto == IPPROTO_TCP) {
5253 if ((pd->flags & PFDESC_TCP_NORM) &&
5254 pf_normalize_tcp_init(m, off, pd, th, &s->src,
5255 &s->dst)) {
5256 REASON_SET(&reason, PFRES_MEMORY);
5257 pf_src_tree_remove_state(s);
5258 STATE_DEC_COUNTERS(s);
5259 pool_put(&pf_state_pl, s);
5260 return (PF_DROP);
5261 }
5262 if ((pd->flags & PFDESC_TCP_NORM) && s->src.scrub &&
5263 pf_normalize_tcp_stateful(m, off, pd, &reason,
5264 th, s, &s->src, &s->dst, &rewrite)) {
5265 /* This really shouldn't happen!!! */
5266 DPFPRINTF(PF_DEBUG_URGENT,
5267 ("pf_normalize_tcp_stateful failed on "
5268 "first pkt"));
5269 pf_normalize_tcp_cleanup(s);
5270 pf_src_tree_remove_state(s);
5271 STATE_DEC_COUNTERS(s);
5272 pool_put(&pf_state_pl, s);
5273 return (PF_DROP);
5274 }
5275 }
5276
5277 if ((sk = pf_alloc_state_key(s)) == NULL) {
5278 REASON_SET(&reason, PFRES_MEMORY);
5279 goto cleanup;
5280 }
5281
5282 sk->proto = pd->proto;
5283 sk->direction = direction;
5284 sk->af = af;
5285 #ifndef NO_APPLE_EXTENSIONS
5286 if (pd->proto == IPPROTO_UDP) {
5287 if (ntohs(pd->hdr.udp->uh_sport) == PF_IKE_PORT &&
5288 ntohs(pd->hdr.udp->uh_dport) == PF_IKE_PORT) {
5289 sk->proto_variant = PF_EXTFILTER_APD;
5290 } else {
5291 sk->proto_variant = nr ? nr->extfilter :
5292 r->extfilter;
5293 if (sk->proto_variant < PF_EXTFILTER_APD)
5294 sk->proto_variant = PF_EXTFILTER_APD;
5295 }
5296 } else if (pd->proto == IPPROTO_GRE) {
5297 sk->proto_variant = pd->proto_variant;
5298 }
5299 #endif
5300 if (direction == PF_OUT) {
5301 PF_ACPY(&sk->gwy.addr, saddr, af);
5302 PF_ACPY(&sk->ext.addr, daddr, af);
5303 switch (pd->proto) {
5304 #ifndef NO_APPLE_EXTENSIONS
5305 case IPPROTO_UDP:
5306 sk->gwy.xport = sxport;
5307 sk->ext.xport = dxport;
5308 break;
5309 case IPPROTO_ESP:
5310 sk->gwy.xport.spi = 0;
5311 sk->ext.xport.spi = pd->hdr.esp->spi;
5312 break;
5313 #endif
5314 case IPPROTO_ICMP:
5315 #if INET6
5316 case IPPROTO_ICMPV6:
5317 #endif
5318 #ifndef NO_APPLE_EXTENSIONS
5319 sk->gwy.xport.port = nxport.port;
5320 sk->ext.xport.spi = 0;
5321 #else
5322 sk->gwy.port = nport;
5323 sk->ext.port = 0;
5324 #endif
5325 break;
5326 default:
5327 #ifndef NO_APPLE_EXTENSIONS
5328 sk->gwy.xport = sxport;
5329 sk->ext.xport = dxport;
5330 break;
5331 #else
5332 sk->gwy.port = sport;
5333 sk->ext.port = dport;
5334 #endif
5335 }
5336 #ifndef NO_APPLE_EXTENSIONS
5337 if (nr != NULL) {
5338 PF_ACPY(&sk->lan.addr, &pd->baddr, af);
5339 sk->lan.xport = bxport;
5340 } else {
5341 PF_ACPY(&sk->lan.addr, &sk->gwy.addr, af);
5342 sk->lan.xport = sk->gwy.xport;
5343 }
5344 #else
5345 if (nr != NULL) {
5346 PF_ACPY(&sk->lan.addr, &pd->baddr, af);
5347 sk->lan.port = bport;
5348 } else {
5349 PF_ACPY(&sk->lan.addr, &sk->gwy.addr, af);
5350 sk->lan.port = sk->gwy.port;
5351 }
5352 #endif
5353 } else {
5354 PF_ACPY(&sk->lan.addr, daddr, af);
5355 PF_ACPY(&sk->ext.addr, saddr, af);
5356 switch (pd->proto) {
5357 case IPPROTO_ICMP:
5358 #if INET6
5359 case IPPROTO_ICMPV6:
5360 #endif
5361 #ifndef NO_APPLE_EXTENSIONS
5362 sk->lan.xport = nxport;
5363 sk->ext.xport.spi = 0;
5364 #else
5365 sk->lan.port = nport;
5366 sk->ext.port = 0;
5367 #endif
5368 break;
5369 #ifndef NO_APPLE_EXTENSIONS
5370 case IPPROTO_ESP:
5371 sk->ext.xport.spi = 0;
5372 sk->lan.xport.spi = pd->hdr.esp->spi;
5373 break;
5374 default:
5375 sk->lan.xport = dxport;
5376 sk->ext.xport = sxport;
5377 break;
5378 #else
5379 default:
5380 sk->lan.port = dport;
5381 sk->ext.port = sport;
5382 #endif
5383 }
5384 #ifndef NO_APPLE_EXTENSIONS
5385 if (nr != NULL) {
5386 PF_ACPY(&sk->gwy.addr, &pd->baddr, af);
5387 sk->gwy.xport = bxport;
5388 } else {
5389 PF_ACPY(&sk->gwy.addr, &sk->lan.addr, af);
5390 sk->gwy.xport = sk->lan.xport;
5391 }
5392 }
5393 #else
5394 if (nr != NULL) {
5395 PF_ACPY(&sk->gwy.addr, &pd->baddr, af);
5396 sk->gwy.port = bport;
5397 } else {
5398 PF_ACPY(&sk->gwy.addr, &sk->lan.addr, af);
5399 sk->gwy.port = sk->lan.port;
5400 }
5401 }
5402 #endif
5403
5404 pf_set_rt_ifp(s, saddr); /* needs s->state_key set */
5405
5406 #ifndef NO_APPLE_EXTENSIONS
5407 m = pd->mp;
5408
5409 if (sk->app_state == 0) {
5410 switch (pd->proto) {
5411 case IPPROTO_TCP: {
5412 u_int16_t dport = (direction == PF_OUT) ?
5413 sk->ext.xport.port : sk->gwy.xport.port;
5414
5415 if (nr != NULL &&
5416 ntohs(dport) == PF_PPTP_PORT) {
5417 struct pf_app_state *as;
5418
5419 as = pool_get(&pf_app_state_pl,
5420 PR_WAITOK);
5421 if (!as) {
5422 REASON_SET(&reason,
5423 PFRES_MEMORY);
5424 goto cleanup;
5425 }
5426
5427 bzero(as, sizeof (*as));
5428 as->handler = pf_pptp_handler;
5429 as->compare_lan_ext = 0;
5430 as->compare_ext_gwy = 0;
5431 as->u.pptp.grev1_state = 0;
5432 sk->app_state = as;
5433 (void) hook_establish(&s->unlink_hooks,
5434 0, (hook_fn_t) pf_pptp_unlink, s);
5435 }
5436 break;
5437 }
5438
5439 case IPPROTO_UDP: {
5440 struct udphdr *uh = pd->hdr.udp;
5441
5442 if (nr != NULL &&
5443 ntohs(uh->uh_sport) == PF_IKE_PORT &&
5444 ntohs(uh->uh_dport) == PF_IKE_PORT) {
5445 struct pf_app_state *as;
5446
5447 as = pool_get(&pf_app_state_pl,
5448 PR_WAITOK);
5449 if (!as) {
5450 REASON_SET(&reason,
5451 PFRES_MEMORY);
5452 goto cleanup;
5453 }
5454
5455 bzero(as, sizeof (*as));
5456 as->compare_lan_ext = pf_ike_compare;
5457 as->compare_ext_gwy = pf_ike_compare;
5458 as->u.ike.cookie = ike.initiator_cookie;
5459 sk->app_state = as;
5460 }
5461 break;
5462 }
5463
5464 default:
5465 break;
5466 }
5467 }
5468 #endif
5469
5470 if (pf_insert_state(BOUND_IFACE(r, kif), s)) {
5471 if (pd->proto == IPPROTO_TCP)
5472 pf_normalize_tcp_cleanup(s);
5473 REASON_SET(&reason, PFRES_STATEINS);
5474 pf_src_tree_remove_state(s);
5475 STATE_DEC_COUNTERS(s);
5476 pool_put(&pf_state_pl, s);
5477 return (PF_DROP);
5478 } else
5479 *sm = s;
5480 if (tag > 0) {
5481 pf_tag_ref(tag);
5482 s->tag = tag;
5483 }
5484 if (pd->proto == IPPROTO_TCP &&
5485 (th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN &&
5486 r->keep_state == PF_STATE_SYNPROXY) {
5487 s->src.state = PF_TCPS_PROXY_SRC;
5488 if (nr != NULL) {
5489 #ifndef NO_APPLE_EXTENSIONS
5490 if (direction == PF_OUT) {
5491 pf_change_ap(direction, pd->mp, saddr,
5492 &th->th_sport, pd->ip_sum,
5493 &th->th_sum, &pd->baddr,
5494 bxport.port, 0, af);
5495 sxport.port = th->th_sport;
5496 } else {
5497 pf_change_ap(direction, pd->mp, daddr,
5498 &th->th_dport, pd->ip_sum,
5499 &th->th_sum, &pd->baddr,
5500 bxport.port, 0, af);
5501 sxport.port = th->th_dport;
5502 }
5503 #else
5504 if (direction == PF_OUT) {
5505 pf_change_ap(saddr, &th->th_sport,
5506 pd->ip_sum, &th->th_sum, &pd->baddr,
5507 bport, 0, af);
5508 sport = th->th_sport;
5509 } else {
5510 pf_change_ap(daddr, &th->th_dport,
5511 pd->ip_sum, &th->th_sum, &pd->baddr,
5512 bport, 0, af);
5513 sport = th->th_dport;
5514 }
5515 #endif
5516 }
5517 s->src.seqhi = htonl(random());
5518 /* Find mss option */
5519 mss = pf_get_mss(m, off, th->th_off, af);
5520 mss = pf_calc_mss(saddr, af, mss);
5521 mss = pf_calc_mss(daddr, af, mss);
5522 s->src.mss = mss;
5523 pf_send_tcp(r, af, daddr, saddr, th->th_dport,
5524 th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1,
5525 TH_SYN|TH_ACK, 0, s->src.mss, 0, 1, 0, NULL, NULL);
5526 REASON_SET(&reason, PFRES_SYNPROXY);
5527 return (PF_SYNPROXY_DROP);
5528 }
5529
5530 #ifndef NO_APPLE_EXTENSIONS
5531 if (sk->app_state && sk->app_state->handler) {
5532 int offx = off;
5533
5534 switch (pd->proto) {
5535 case IPPROTO_TCP:
5536 offx += th->th_off << 2;
5537 break;
5538 case IPPROTO_UDP:
5539 offx += pd->hdr.udp->uh_ulen << 2;
5540 break;
5541 default:
5542 /* ALG handlers only apply to TCP and UDP rules */
5543 break;
5544 }
5545
5546 if (offx > off) {
5547 sk->app_state->handler(s, direction, offx,
5548 pd, kif);
5549 if (pd->lmw < 0) {
5550 REASON_SET(&reason, PFRES_MEMORY);
5551 return (PF_DROP);
5552 }
5553 m = pd->mp;
5554 }
5555 }
5556 #endif
5557 }
5558
5559 /* copy back packet headers if we performed NAT operations */
5560 #ifndef NO_APPLE_EXTENSIONS
5561 if (rewrite) {
5562 if (rewrite < off + hdrlen)
5563 rewrite = off + hdrlen;
5564
5565 m = pf_lazy_makewritable(pd, pd->mp, rewrite);
5566 if (!m) {
5567 REASON_SET(&reason, PFRES_MEMORY);
5568 return (PF_DROP);
5569 }
5570
5571 m_copyback(m, off, hdrlen, pd->hdr.any);
5572 }
5573 #else
5574 if (rewrite)
5575 m_copyback(m, off, hdrlen, pd->hdr.any);
5576 #endif
5577
5578 return (PF_PASS);
5579 }
5580
5581 static int
5582 pf_test_fragment(struct pf_rule **rm, int direction, struct pfi_kif *kif,
5583 struct mbuf *m, void *h, struct pf_pdesc *pd, struct pf_rule **am,
5584 struct pf_ruleset **rsm)
5585 {
5586 #pragma unused(h)
5587 struct pf_rule *r, *a = NULL;
5588 struct pf_ruleset *ruleset = NULL;
5589 sa_family_t af = pd->af;
5590 u_short reason;
5591 int tag = -1;
5592 int asd = 0;
5593 int match = 0;
5594
5595 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
5596 while (r != NULL) {
5597 r->evaluations++;
5598 if (pfi_kif_match(r->kif, kif) == r->ifnot)
5599 r = r->skip[PF_SKIP_IFP].ptr;
5600 else if (r->direction && r->direction != direction)
5601 r = r->skip[PF_SKIP_DIR].ptr;
5602 else if (r->af && r->af != af)
5603 r = r->skip[PF_SKIP_AF].ptr;
5604 else if (r->proto && r->proto != pd->proto)
5605 r = r->skip[PF_SKIP_PROTO].ptr;
5606 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af,
5607 r->src.neg, kif))
5608 r = r->skip[PF_SKIP_SRC_ADDR].ptr;
5609 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af,
5610 r->dst.neg, NULL))
5611 r = r->skip[PF_SKIP_DST_ADDR].ptr;
5612 else if (r->tos && !(r->tos == pd->tos))
5613 r = TAILQ_NEXT(r, entries);
5614 else if (r->os_fingerprint != PF_OSFP_ANY)
5615 r = TAILQ_NEXT(r, entries);
5616 #ifndef NO_APPLE_EXTENSIONS
5617 else if (pd->proto == IPPROTO_UDP &&
5618 (r->src.xport.range.op || r->dst.xport.range.op))
5619 r = TAILQ_NEXT(r, entries);
5620 else if (pd->proto == IPPROTO_TCP &&
5621 (r->src.xport.range.op || r->dst.xport.range.op ||
5622 r->flagset))
5623 r = TAILQ_NEXT(r, entries);
5624 #else
5625 else if (pd->proto == IPPROTO_UDP &&
5626 (r->src.port_op || r->dst.port_op))
5627 r = TAILQ_NEXT(r, entries);
5628 else if (pd->proto == IPPROTO_TCP &&
5629 (r->src.port_op || r->dst.port_op || r->flagset))
5630 r = TAILQ_NEXT(r, entries);
5631 #endif
5632 else if ((pd->proto == IPPROTO_ICMP ||
5633 pd->proto == IPPROTO_ICMPV6) &&
5634 (r->type || r->code))
5635 r = TAILQ_NEXT(r, entries);
5636 else if (r->prob && r->prob <= (random() % (UINT_MAX - 1) + 1))
5637 r = TAILQ_NEXT(r, entries);
5638 else if (r->match_tag && !pf_match_tag(m, r, pd->pf_mtag, &tag))
5639 r = TAILQ_NEXT(r, entries);
5640 else {
5641 if (r->anchor == NULL) {
5642 match = 1;
5643 *rm = r;
5644 *am = a;
5645 *rsm = ruleset;
5646 if ((*rm)->quick)
5647 break;
5648 r = TAILQ_NEXT(r, entries);
5649 } else
5650 pf_step_into_anchor(&asd, &ruleset,
5651 PF_RULESET_FILTER, &r, &a, &match);
5652 }
5653 if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset,
5654 PF_RULESET_FILTER, &r, &a, &match))
5655 break;
5656 }
5657 r = *rm;
5658 a = *am;
5659 ruleset = *rsm;
5660
5661 REASON_SET(&reason, PFRES_MATCH);
5662
5663 if (r->log)
5664 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset,
5665 pd);
5666
5667 if (r->action != PF_PASS)
5668 return (PF_DROP);
5669
5670 if (pf_tag_packet(m, pd->pf_mtag, tag, -1)) {
5671 REASON_SET(&reason, PFRES_MEMORY);
5672 return (PF_DROP);
5673 }
5674
5675 return (PF_PASS);
5676 }
5677
5678 #ifndef NO_APPLE_EXTENSIONS
5679 static void
5680 pf_pptp_handler(struct pf_state *s, int direction, int off,
5681 struct pf_pdesc *pd, struct pfi_kif *kif)
5682 {
5683 #pragma unused(direction)
5684 struct tcphdr *th;
5685 struct pf_pptp_state *pptps;
5686 struct pf_pptp_ctrl_msg cm;
5687 size_t plen;
5688 struct pf_state *gs;
5689 u_int16_t ct;
5690 u_int16_t *pac_call_id;
5691 u_int16_t *pns_call_id;
5692 u_int16_t *spoof_call_id;
5693 u_int8_t *pac_state;
5694 u_int8_t *pns_state;
5695 enum { PF_PPTP_PASS, PF_PPTP_INSERT_GRE, PF_PPTP_REMOVE_GRE } op;
5696 struct mbuf *m;
5697 struct pf_state_key *sk;
5698 struct pf_state_key *gsk;
5699 struct pf_app_state *gas;
5700
5701 sk = s->state_key;
5702 pptps = &sk->app_state->u.pptp;
5703 gs = pptps->grev1_state;
5704
5705 if (gs)
5706 gs->expire = pf_time_second();
5707
5708 m = pd->mp;
5709 plen = min(sizeof (cm), m->m_pkthdr.len - off);
5710 if (plen < PF_PPTP_CTRL_MSG_MINSIZE)
5711 return;
5712
5713 m_copydata(m, off, plen, &cm);
5714
5715 if (ntohl(cm.hdr.magic) != PF_PPTP_MAGIC_NUMBER)
5716 return;
5717 if (ntohs(cm.hdr.type) != 1)
5718 return;
5719
5720 if (!gs) {
5721 gs = pool_get(&pf_state_pl, PR_WAITOK);
5722 if (!gs)
5723 return;
5724
5725 memcpy(gs, s, sizeof (*gs));
5726
5727 memset(&gs->entry_id, 0, sizeof (gs->entry_id));
5728 memset(&gs->entry_list, 0, sizeof (gs->entry_list));
5729
5730 TAILQ_INIT(&gs->unlink_hooks);
5731 gs->rt_kif = NULL;
5732 gs->creation = 0;
5733 gs->pfsync_time = 0;
5734 gs->packets[0] = gs->packets[1] = 0;
5735 gs->bytes[0] = gs->bytes[1] = 0;
5736 gs->timeout = PFTM_UNLINKED;
5737 gs->id = gs->creatorid = 0;
5738 gs->src.state = gs->dst.state = PFGRE1S_NO_TRAFFIC;
5739 gs->src.scrub = gs->dst.scrub = 0;
5740
5741 gas = pool_get(&pf_app_state_pl, PR_NOWAIT);
5742 if (!gas) {
5743 pool_put(&pf_state_pl, gs);
5744 return;
5745 }
5746
5747 gsk = pf_alloc_state_key(gs);
5748 if (!gsk) {
5749 pool_put(&pf_app_state_pl, gas);
5750 pool_put(&pf_state_pl, gs);
5751 return;
5752 }
5753
5754 memcpy(&gsk->lan, &sk->lan, sizeof (gsk->lan));
5755 memcpy(&gsk->gwy, &sk->gwy, sizeof (gsk->gwy));
5756 memcpy(&gsk->ext, &sk->ext, sizeof (gsk->ext));
5757 gsk->af = sk->af;
5758 gsk->proto = IPPROTO_GRE;
5759 gsk->proto_variant = PF_GRE_PPTP_VARIANT;
5760 gsk->app_state = gas;
5761 gsk->lan.xport.call_id = 0;
5762 gsk->gwy.xport.call_id = 0;
5763 gsk->ext.xport.call_id = 0;
5764 memset(gas, 0, sizeof (*gas));
5765 gas->u.grev1.pptp_state = s;
5766 STATE_INC_COUNTERS(gs);
5767 pptps->grev1_state = gs;
5768 (void) hook_establish(&gs->unlink_hooks, 0,
5769 (hook_fn_t) pf_grev1_unlink, gs);
5770 } else {
5771 gsk = gs->state_key;
5772 }
5773
5774 switch (sk->direction) {
5775 case PF_IN:
5776 pns_call_id = &gsk->ext.xport.call_id;
5777 pns_state = &gs->dst.state;
5778 pac_call_id = &gsk->lan.xport.call_id;
5779 pac_state = &gs->src.state;
5780 break;
5781
5782 case PF_OUT:
5783 pns_call_id = &gsk->lan.xport.call_id;
5784 pns_state = &gs->src.state;
5785 pac_call_id = &gsk->ext.xport.call_id;
5786 pac_state = &gs->dst.state;
5787 break;
5788
5789 default:
5790 DPFPRINTF(PF_DEBUG_URGENT,
5791 ("pf_pptp_handler: bad directional!\n"));
5792 return;
5793 }
5794
5795 spoof_call_id = 0;
5796 op = PF_PPTP_PASS;
5797
5798 ct = ntohs(cm.ctrl.type);
5799
5800 switch (ct) {
5801 case PF_PPTP_CTRL_TYPE_CALL_OUT_REQ:
5802 *pns_call_id = cm.msg.call_out_req.call_id;
5803 *pns_state = PFGRE1S_INITIATING;
5804 if (s->nat_rule.ptr && pns_call_id == &gsk->lan.xport.call_id)
5805 spoof_call_id = &cm.msg.call_out_req.call_id;
5806 break;
5807
5808 case PF_PPTP_CTRL_TYPE_CALL_OUT_RPY:
5809 *pac_call_id = cm.msg.call_out_rpy.call_id;
5810 if (s->nat_rule.ptr)
5811 spoof_call_id =
5812 (pac_call_id == &gsk->lan.xport.call_id) ?
5813 &cm.msg.call_out_rpy.call_id :
5814 &cm.msg.call_out_rpy.peer_call_id;
5815 if (gs->timeout == PFTM_UNLINKED) {
5816 *pac_state = PFGRE1S_INITIATING;
5817 op = PF_PPTP_INSERT_GRE;
5818 }
5819 break;
5820
5821 case PF_PPTP_CTRL_TYPE_CALL_IN_1ST:
5822 *pns_call_id = cm.msg.call_in_1st.call_id;
5823 *pns_state = PFGRE1S_INITIATING;
5824 if (s->nat_rule.ptr && pns_call_id == &gsk->lan.xport.call_id)
5825 spoof_call_id = &cm.msg.call_in_1st.call_id;
5826 break;
5827
5828 case PF_PPTP_CTRL_TYPE_CALL_IN_2ND:
5829 *pac_call_id = cm.msg.call_in_2nd.call_id;
5830 *pac_state = PFGRE1S_INITIATING;
5831 if (s->nat_rule.ptr)
5832 spoof_call_id =
5833 (pac_call_id == &gsk->lan.xport.call_id) ?
5834 &cm.msg.call_in_2nd.call_id :
5835 &cm.msg.call_in_2nd.peer_call_id;
5836 break;
5837
5838 case PF_PPTP_CTRL_TYPE_CALL_IN_3RD:
5839 if (s->nat_rule.ptr && pns_call_id == &gsk->lan.xport.call_id)
5840 spoof_call_id = &cm.msg.call_in_3rd.call_id;
5841 if (cm.msg.call_in_3rd.call_id != *pns_call_id) {
5842 break;
5843 }
5844 if (gs->timeout == PFTM_UNLINKED)
5845 op = PF_PPTP_INSERT_GRE;
5846 break;
5847
5848 case PF_PPTP_CTRL_TYPE_CALL_CLR:
5849 if (cm.msg.call_clr.call_id != *pns_call_id)
5850 op = PF_PPTP_REMOVE_GRE;
5851 break;
5852
5853 case PF_PPTP_CTRL_TYPE_CALL_DISC:
5854 if (cm.msg.call_clr.call_id != *pac_call_id)
5855 op = PF_PPTP_REMOVE_GRE;
5856 break;
5857
5858 case PF_PPTP_CTRL_TYPE_ERROR:
5859 if (s->nat_rule.ptr && pns_call_id == &gsk->lan.xport.call_id)
5860 spoof_call_id = &cm.msg.error.peer_call_id;
5861 break;
5862
5863 case PF_PPTP_CTRL_TYPE_SET_LINKINFO:
5864 if (s->nat_rule.ptr && pac_call_id == &gsk->lan.xport.call_id)
5865 spoof_call_id = &cm.msg.set_linkinfo.peer_call_id;
5866 break;
5867
5868 default:
5869 op = PF_PPTP_PASS;
5870 break;
5871 }
5872
5873 if (!gsk->gwy.xport.call_id && gsk->lan.xport.call_id) {
5874 gsk->gwy.xport.call_id = gsk->lan.xport.call_id;
5875 if (spoof_call_id) {
5876 u_int16_t call_id = 0;
5877 int n = 0;
5878 struct pf_state_key_cmp key;
5879
5880 key.af = gsk->af;
5881 key.proto = IPPROTO_GRE;
5882 key.proto_variant = PF_GRE_PPTP_VARIANT;
5883 PF_ACPY(&key.gwy.addr, &gsk->gwy.addr, key.af);
5884 PF_ACPY(&key.ext.addr, &gsk->ext.addr, key.af);
5885 key.gwy.xport.call_id = gsk->gwy.xport.call_id;
5886 key.ext.xport.call_id = gsk->ext.xport.call_id;
5887 do {
5888 call_id = htonl(random());
5889 } while (!call_id);
5890
5891 while (pf_find_state_all(&key, PF_IN, 0)) {
5892 call_id = ntohs(call_id);
5893 --call_id;
5894 if (--call_id == 0) call_id = 0xffff;
5895 call_id = htons(call_id);
5896
5897 key.gwy.xport.call_id = call_id;
5898
5899 if (++n > 65535) {
5900 DPFPRINTF(PF_DEBUG_URGENT,
5901 ("pf_pptp_handler: failed to spoof "
5902 "call id\n"));
5903 key.gwy.xport.call_id = 0;
5904 break;
5905 }
5906 }
5907
5908 gsk->gwy.xport.call_id = call_id;
5909 }
5910 }
5911
5912 th = pd->hdr.tcp;
5913
5914 if (spoof_call_id && gsk->lan.xport.call_id != gsk->gwy.xport.call_id) {
5915 if (*spoof_call_id == gsk->gwy.xport.call_id) {
5916 *spoof_call_id = gsk->lan.xport.call_id;
5917 th->th_sum = pf_cksum_fixup(th->th_sum,
5918 gsk->gwy.xport.call_id, gsk->lan.xport.call_id, 0);
5919 } else {
5920 *spoof_call_id = gsk->gwy.xport.call_id;
5921 th->th_sum = pf_cksum_fixup(th->th_sum,
5922 gsk->lan.xport.call_id, gsk->gwy.xport.call_id, 0);
5923 }
5924
5925 m = pf_lazy_makewritable(pd, m, off + plen);
5926 if (!m) {
5927 pptps->grev1_state = NULL;
5928 STATE_DEC_COUNTERS(gs);
5929 pool_put(&pf_state_pl, gs);
5930 return;
5931 }
5932 m_copyback(m, off, plen, &cm);
5933 }
5934
5935 switch (op) {
5936 case PF_PPTP_REMOVE_GRE:
5937 gs->timeout = PFTM_PURGE;
5938 gs->src.state = gs->dst.state = PFGRE1S_NO_TRAFFIC;
5939 gsk->lan.xport.call_id = 0;
5940 gsk->gwy.xport.call_id = 0;
5941 gsk->ext.xport.call_id = 0;
5942 gs->id = gs->creatorid = 0;
5943 break;
5944
5945 case PF_PPTP_INSERT_GRE:
5946 gs->creation = pf_time_second();
5947 gs->expire = pf_time_second();
5948 gs->timeout = PFTM_TCP_ESTABLISHED;
5949 if (gs->src_node != NULL) {
5950 ++gs->src_node->states;
5951 VERIFY(gs->src_node->states != 0);
5952 }
5953 if (gs->nat_src_node != NULL) {
5954 ++gs->nat_src_node->states;
5955 VERIFY(gs->nat_src_node->states != 0);
5956 }
5957 pf_set_rt_ifp(gs, &sk->lan.addr);
5958 if (pf_insert_state(BOUND_IFACE(s->rule.ptr, kif), gs)) {
5959
5960 /*
5961 * <jhw@apple.com>
5962 * FIX ME: insertion can fail when multiple PNS
5963 * behind the same NAT open calls to the same PAC
5964 * simultaneously because spoofed call ID numbers
5965 * are chosen before states are inserted. This is
5966 * hard to fix and happens infrequently enough that
5967 * users will normally try again and this ALG will
5968 * succeed. Failures are expected to be rare enough
5969 * that fixing this is a low priority.
5970 */
5971 pptps->grev1_state = NULL;
5972 pd->lmw = -1; /* Force PF_DROP on PFRES_MEMORY */
5973 pf_src_tree_remove_state(gs);
5974 STATE_DEC_COUNTERS(gs);
5975 pool_put(&pf_state_pl, gs);
5976 DPFPRINTF(PF_DEBUG_URGENT, ("pf_pptp_handler: error "
5977 "inserting GREv1 state.\n"));
5978 }
5979 break;
5980
5981 default:
5982 break;
5983 }
5984 }
5985
5986 static void
5987 pf_pptp_unlink(struct pf_state *s)
5988 {
5989 struct pf_app_state *as = s->state_key->app_state;
5990 struct pf_state *grev1s = as->u.pptp.grev1_state;
5991
5992 if (grev1s) {
5993 struct pf_app_state *gas = grev1s->state_key->app_state;
5994
5995 if (grev1s->timeout < PFTM_MAX)
5996 grev1s->timeout = PFTM_PURGE;
5997 gas->u.grev1.pptp_state = NULL;
5998 as->u.pptp.grev1_state = NULL;
5999 }
6000 }
6001
6002 static void
6003 pf_grev1_unlink(struct pf_state *s)
6004 {
6005 struct pf_app_state *as = s->state_key->app_state;
6006 struct pf_state *pptps = as->u.grev1.pptp_state;
6007
6008 if (pptps) {
6009 struct pf_app_state *pas = pptps->state_key->app_state;
6010
6011 pas->u.pptp.grev1_state = NULL;
6012 as->u.grev1.pptp_state = NULL;
6013 }
6014 }
6015
6016 static int
6017 pf_ike_compare(struct pf_app_state *a, struct pf_app_state *b)
6018 {
6019 int64_t d = a->u.ike.cookie - b->u.ike.cookie;
6020 return ((d > 0) ? 1 : ((d < 0) ? -1 : 0));
6021 }
6022 #endif
6023
6024 static int
6025 pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif,
6026 struct mbuf *m, int off, void *h, struct pf_pdesc *pd,
6027 u_short *reason)
6028 {
6029 #pragma unused(h)
6030 struct pf_state_key_cmp key;
6031 struct tcphdr *th = pd->hdr.tcp;
6032 u_int16_t win = ntohs(th->th_win);
6033 u_int32_t ack, end, seq, orig_seq;
6034 u_int8_t sws, dws;
6035 int ackskew;
6036 int copyback = 0;
6037 struct pf_state_peer *src, *dst;
6038
6039 #ifndef NO_APPLE_EXTENSIONS
6040 key.app_state = 0;
6041 #endif
6042 key.af = pd->af;
6043 key.proto = IPPROTO_TCP;
6044 if (direction == PF_IN) {
6045 PF_ACPY(&key.ext.addr, pd->src, key.af);
6046 PF_ACPY(&key.gwy.addr, pd->dst, key.af);
6047 #ifndef NO_APPLE_EXTENSIONS
6048 key.ext.xport.port = th->th_sport;
6049 key.gwy.xport.port = th->th_dport;
6050 #else
6051 key.ext.port = th->th_sport;
6052 key.gwy.port = th->th_dport;
6053 #endif
6054 } else {
6055 PF_ACPY(&key.lan.addr, pd->src, key.af);
6056 PF_ACPY(&key.ext.addr, pd->dst, key.af);
6057 #ifndef NO_APPLE_EXTENSIONS
6058 key.lan.xport.port = th->th_sport;
6059 key.ext.xport.port = th->th_dport;
6060 #else
6061 key.lan.port = th->th_sport;
6062 key.ext.port = th->th_dport;
6063 #endif
6064 }
6065
6066 STATE_LOOKUP();
6067
6068 if (direction == (*state)->state_key->direction) {
6069 src = &(*state)->src;
6070 dst = &(*state)->dst;
6071 } else {
6072 src = &(*state)->dst;
6073 dst = &(*state)->src;
6074 }
6075
6076 if ((*state)->src.state == PF_TCPS_PROXY_SRC) {
6077 if (direction != (*state)->state_key->direction) {
6078 REASON_SET(reason, PFRES_SYNPROXY);
6079 return (PF_SYNPROXY_DROP);
6080 }
6081 if (th->th_flags & TH_SYN) {
6082 if (ntohl(th->th_seq) != (*state)->src.seqlo) {
6083 REASON_SET(reason, PFRES_SYNPROXY);
6084 return (PF_DROP);
6085 }
6086 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst,
6087 pd->src, th->th_dport, th->th_sport,
6088 (*state)->src.seqhi, ntohl(th->th_seq) + 1,
6089 TH_SYN|TH_ACK, 0, (*state)->src.mss, 0, 1,
6090 0, NULL, NULL);
6091 REASON_SET(reason, PFRES_SYNPROXY);
6092 return (PF_SYNPROXY_DROP);
6093 } else if (!(th->th_flags & TH_ACK) ||
6094 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) ||
6095 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) {
6096 REASON_SET(reason, PFRES_SYNPROXY);
6097 return (PF_DROP);
6098 } else if ((*state)->src_node != NULL &&
6099 pf_src_connlimit(state)) {
6100 REASON_SET(reason, PFRES_SRCLIMIT);
6101 return (PF_DROP);
6102 } else
6103 (*state)->src.state = PF_TCPS_PROXY_DST;
6104 }
6105 if ((*state)->src.state == PF_TCPS_PROXY_DST) {
6106 struct pf_state_host *psrc, *pdst;
6107
6108 if (direction == PF_OUT) {
6109 psrc = &(*state)->state_key->gwy;
6110 pdst = &(*state)->state_key->ext;
6111 } else {
6112 psrc = &(*state)->state_key->ext;
6113 pdst = &(*state)->state_key->lan;
6114 }
6115 if (direction == (*state)->state_key->direction) {
6116 if (((th->th_flags & (TH_SYN|TH_ACK)) != TH_ACK) ||
6117 (ntohl(th->th_ack) != (*state)->src.seqhi + 1) ||
6118 (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) {
6119 REASON_SET(reason, PFRES_SYNPROXY);
6120 return (PF_DROP);
6121 }
6122 (*state)->src.max_win = MAX(ntohs(th->th_win), 1);
6123 if ((*state)->dst.seqhi == 1)
6124 (*state)->dst.seqhi = htonl(random());
6125 pf_send_tcp((*state)->rule.ptr, pd->af, &psrc->addr,
6126 #ifndef NO_APPLE_EXTENSIONS
6127 &pdst->addr, psrc->xport.port, pdst->xport.port,
6128 #else
6129 &pdst->addr, psrc->port, pdst->port,
6130 #endif
6131 (*state)->dst.seqhi, 0, TH_SYN, 0,
6132 (*state)->src.mss, 0, 0, (*state)->tag, NULL, NULL);
6133 REASON_SET(reason, PFRES_SYNPROXY);
6134 return (PF_SYNPROXY_DROP);
6135 } else if (((th->th_flags & (TH_SYN|TH_ACK)) !=
6136 (TH_SYN|TH_ACK)) ||
6137 (ntohl(th->th_ack) != (*state)->dst.seqhi + 1)) {
6138 REASON_SET(reason, PFRES_SYNPROXY);
6139 return (PF_DROP);
6140 } else {
6141 (*state)->dst.max_win = MAX(ntohs(th->th_win), 1);
6142 (*state)->dst.seqlo = ntohl(th->th_seq);
6143 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst,
6144 pd->src, th->th_dport, th->th_sport,
6145 ntohl(th->th_ack), ntohl(th->th_seq) + 1,
6146 TH_ACK, (*state)->src.max_win, 0, 0, 0,
6147 (*state)->tag, NULL, NULL);
6148 pf_send_tcp((*state)->rule.ptr, pd->af, &psrc->addr,
6149 #ifndef NO_APPLE_EXTENSIONS
6150 &pdst->addr, psrc->xport.port, pdst->xport.port,
6151 #else
6152 &pdst->addr, psrc->port, pdst->port,
6153 #endif
6154 (*state)->src.seqhi + 1, (*state)->src.seqlo + 1,
6155 TH_ACK, (*state)->dst.max_win, 0, 0, 1,
6156 0, NULL, NULL);
6157 (*state)->src.seqdiff = (*state)->dst.seqhi -
6158 (*state)->src.seqlo;
6159 (*state)->dst.seqdiff = (*state)->src.seqhi -
6160 (*state)->dst.seqlo;
6161 (*state)->src.seqhi = (*state)->src.seqlo +
6162 (*state)->dst.max_win;
6163 (*state)->dst.seqhi = (*state)->dst.seqlo +
6164 (*state)->src.max_win;
6165 (*state)->src.wscale = (*state)->dst.wscale = 0;
6166 (*state)->src.state = (*state)->dst.state =
6167 TCPS_ESTABLISHED;
6168 REASON_SET(reason, PFRES_SYNPROXY);
6169 return (PF_SYNPROXY_DROP);
6170 }
6171 }
6172
6173 if (((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN) &&
6174 dst->state >= TCPS_FIN_WAIT_2 &&
6175 src->state >= TCPS_FIN_WAIT_2) {
6176 if (pf_status.debug >= PF_DEBUG_MISC) {
6177 printf("pf: state reuse ");
6178 pf_print_state(*state);
6179 pf_print_flags(th->th_flags);
6180 printf("\n");
6181 }
6182 /* XXX make sure it's the same direction ?? */
6183 (*state)->src.state = (*state)->dst.state = TCPS_CLOSED;
6184 pf_unlink_state(*state);
6185 *state = NULL;
6186 return (PF_DROP);
6187 }
6188
6189 if (src->wscale && dst->wscale && !(th->th_flags & TH_SYN)) {
6190 sws = src->wscale & PF_WSCALE_MASK;
6191 dws = dst->wscale & PF_WSCALE_MASK;
6192 } else
6193 sws = dws = 0;
6194
6195 /*
6196 * Sequence tracking algorithm from Guido van Rooij's paper:
6197 * http://www.madison-gurkha.com/publications/tcp_filtering/
6198 * tcp_filtering.ps
6199 */
6200
6201 orig_seq = seq = ntohl(th->th_seq);
6202 if (src->seqlo == 0) {
6203 /* First packet from this end. Set its state */
6204
6205 if ((pd->flags & PFDESC_TCP_NORM || dst->scrub) &&
6206 src->scrub == NULL) {
6207 if (pf_normalize_tcp_init(m, off, pd, th, src, dst)) {
6208 REASON_SET(reason, PFRES_MEMORY);
6209 return (PF_DROP);
6210 }
6211 }
6212
6213 /* Deferred generation of sequence number modulator */
6214 if (dst->seqdiff && !src->seqdiff) {
6215 /* use random iss for the TCP server */
6216 while ((src->seqdiff = random() - seq) == 0)
6217 ;
6218 ack = ntohl(th->th_ack) - dst->seqdiff;
6219 pf_change_a(&th->th_seq, &th->th_sum, htonl(seq +
6220 src->seqdiff), 0);
6221 pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0);
6222 copyback = off + sizeof (*th);
6223 } else {
6224 ack = ntohl(th->th_ack);
6225 }
6226
6227 end = seq + pd->p_len;
6228 if (th->th_flags & TH_SYN) {
6229 end++;
6230 if (dst->wscale & PF_WSCALE_FLAG) {
6231 src->wscale = pf_get_wscale(m, off, th->th_off,
6232 pd->af);
6233 if (src->wscale & PF_WSCALE_FLAG) {
6234 /*
6235 * Remove scale factor from initial
6236 * window
6237 */
6238 sws = src->wscale & PF_WSCALE_MASK;
6239 win = ((u_int32_t)win + (1 << sws) - 1)
6240 >> sws;
6241 dws = dst->wscale & PF_WSCALE_MASK;
6242 } else {
6243 #ifndef NO_APPLE_MODIFICATION
6244 /*
6245 * <rdar://5786370>
6246 *
6247 * Window scale negotiation has failed,
6248 * therefore we must restore the window
6249 * scale in the state record that we
6250 * optimistically removed in
6251 * pf_test_rule(). Care is required to
6252 * prevent arithmetic overflow from
6253 * zeroing the window when it's
6254 * truncated down to 16-bits. --jhw
6255 */
6256 u_int32_t max_win = dst->max_win;
6257 max_win <<=
6258 dst->wscale & PF_WSCALE_MASK;
6259 dst->max_win = MIN(0xffff, max_win);
6260 #else
6261 /* fixup other window */
6262 dst->max_win <<= dst->wscale &
6263 PF_WSCALE_MASK;
6264 #endif
6265 /* in case of a retrans SYN|ACK */
6266 dst->wscale = 0;
6267 }
6268 }
6269 }
6270 if (th->th_flags & TH_FIN)
6271 end++;
6272
6273 src->seqlo = seq;
6274 if (src->state < TCPS_SYN_SENT)
6275 src->state = TCPS_SYN_SENT;
6276
6277 /*
6278 * May need to slide the window (seqhi may have been set by
6279 * the crappy stack check or if we picked up the connection
6280 * after establishment)
6281 */
6282 #ifndef NO_APPLE_MODIFICATIONS
6283 if (src->seqhi == 1 ||
6284 SEQ_GEQ(end + MAX(1, (u_int32_t)dst->max_win << dws),
6285 src->seqhi))
6286 src->seqhi = end + MAX(1, (u_int32_t)dst->max_win << dws);
6287 #else
6288 if (src->seqhi == 1 ||
6289 SEQ_GEQ(end + MAX(1, dst->max_win << dws), src->seqhi))
6290 src->seqhi = end + MAX(1, dst->max_win << dws);
6291 #endif
6292 if (win > src->max_win)
6293 src->max_win = win;
6294
6295 } else {
6296 ack = ntohl(th->th_ack) - dst->seqdiff;
6297 if (src->seqdiff) {
6298 /* Modulate sequence numbers */
6299 pf_change_a(&th->th_seq, &th->th_sum, htonl(seq +
6300 src->seqdiff), 0);
6301 pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0);
6302 copyback = off+ sizeof (*th);
6303 }
6304 end = seq + pd->p_len;
6305 if (th->th_flags & TH_SYN)
6306 end++;
6307 if (th->th_flags & TH_FIN)
6308 end++;
6309 }
6310
6311 if ((th->th_flags & TH_ACK) == 0) {
6312 /* Let it pass through the ack skew check */
6313 ack = dst->seqlo;
6314 } else if ((ack == 0 &&
6315 (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) ||
6316 /* broken tcp stacks do not set ack */
6317 (dst->state < TCPS_SYN_SENT)) {
6318 /*
6319 * Many stacks (ours included) will set the ACK number in an
6320 * FIN|ACK if the SYN times out -- no sequence to ACK.
6321 */
6322 ack = dst->seqlo;
6323 }
6324
6325 if (seq == end) {
6326 /* Ease sequencing restrictions on no data packets */
6327 seq = src->seqlo;
6328 end = seq;
6329 }
6330
6331 ackskew = dst->seqlo - ack;
6332
6333
6334 /*
6335 * Need to demodulate the sequence numbers in any TCP SACK options
6336 * (Selective ACK). We could optionally validate the SACK values
6337 * against the current ACK window, either forwards or backwards, but
6338 * I'm not confident that SACK has been implemented properly
6339 * everywhere. It wouldn't surprise me if several stacks accidently
6340 * SACK too far backwards of previously ACKed data. There really aren't
6341 * any security implications of bad SACKing unless the target stack
6342 * doesn't validate the option length correctly. Someone trying to
6343 * spoof into a TCP connection won't bother blindly sending SACK
6344 * options anyway.
6345 */
6346 if (dst->seqdiff && (th->th_off << 2) > (int)sizeof (struct tcphdr)) {
6347 #ifndef NO_APPLE_EXTENSIONS
6348 copyback = pf_modulate_sack(m, off, pd, th, dst);
6349 if (copyback == -1) {
6350 REASON_SET(reason, PFRES_MEMORY);
6351 return (PF_DROP);
6352 }
6353
6354 m = pd->mp;
6355 #else
6356 if (pf_modulate_sack(m, off, pd, th, dst))
6357 copyback = 1;
6358 #endif
6359 }
6360
6361
6362 #define MAXACKWINDOW (0xffff + 1500) /* 1500 is an arbitrary fudge factor */
6363 if (SEQ_GEQ(src->seqhi, end) &&
6364 /* Last octet inside other's window space */
6365 #ifndef NO_APPLE_MODIFICATIONS
6366 SEQ_GEQ(seq, src->seqlo - ((u_int32_t)dst->max_win << dws)) &&
6367 #else
6368 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) &&
6369 #endif
6370 /* Retrans: not more than one window back */
6371 (ackskew >= -MAXACKWINDOW) &&
6372 /* Acking not more than one reassembled fragment backwards */
6373 (ackskew <= (MAXACKWINDOW << sws)) &&
6374 /* Acking not more than one window forward */
6375 ((th->th_flags & TH_RST) == 0 || orig_seq == src->seqlo ||
6376 (orig_seq == src->seqlo + 1) || (orig_seq + 1 == src->seqlo) ||
6377 (pd->flags & PFDESC_IP_REAS) == 0)) {
6378 /* Require an exact/+1 sequence match on resets when possible */
6379
6380 if (dst->scrub || src->scrub) {
6381 if (pf_normalize_tcp_stateful(m, off, pd, reason, th,
6382 *state, src, dst, &copyback))
6383 return (PF_DROP);
6384
6385 #ifndef NO_APPLE_EXTENSIONS
6386 m = pd->mp;
6387 #endif
6388 }
6389
6390 /* update max window */
6391 if (src->max_win < win)
6392 src->max_win = win;
6393 /* synchronize sequencing */
6394 if (SEQ_GT(end, src->seqlo))
6395 src->seqlo = end;
6396 /* slide the window of what the other end can send */
6397 #ifndef NO_APPLE_MODIFICATIONS
6398 if (SEQ_GEQ(ack + ((u_int32_t)win << sws), dst->seqhi))
6399 dst->seqhi = ack + MAX(((u_int32_t)win << sws), 1);
6400 #else
6401 if (SEQ_GEQ(ack + (win << sws), dst->seqhi))
6402 dst->seqhi = ack + MAX((win << sws), 1);
6403 #endif
6404
6405 /* update states */
6406 if (th->th_flags & TH_SYN)
6407 if (src->state < TCPS_SYN_SENT)
6408 src->state = TCPS_SYN_SENT;
6409 if (th->th_flags & TH_FIN)
6410 if (src->state < TCPS_CLOSING)
6411 src->state = TCPS_CLOSING;
6412 if (th->th_flags & TH_ACK) {
6413 if (dst->state == TCPS_SYN_SENT) {
6414 dst->state = TCPS_ESTABLISHED;
6415 if (src->state == TCPS_ESTABLISHED &&
6416 (*state)->src_node != NULL &&
6417 pf_src_connlimit(state)) {
6418 REASON_SET(reason, PFRES_SRCLIMIT);
6419 return (PF_DROP);
6420 }
6421 } else if (dst->state == TCPS_CLOSING)
6422 dst->state = TCPS_FIN_WAIT_2;
6423 }
6424 if (th->th_flags & TH_RST)
6425 src->state = dst->state = TCPS_TIME_WAIT;
6426
6427 /* update expire time */
6428 (*state)->expire = pf_time_second();
6429 if (src->state >= TCPS_FIN_WAIT_2 &&
6430 dst->state >= TCPS_FIN_WAIT_2)
6431 (*state)->timeout = PFTM_TCP_CLOSED;
6432 else if (src->state >= TCPS_CLOSING &&
6433 dst->state >= TCPS_CLOSING)
6434 (*state)->timeout = PFTM_TCP_FIN_WAIT;
6435 else if (src->state < TCPS_ESTABLISHED ||
6436 dst->state < TCPS_ESTABLISHED)
6437 (*state)->timeout = PFTM_TCP_OPENING;
6438 else if (src->state >= TCPS_CLOSING ||
6439 dst->state >= TCPS_CLOSING)
6440 (*state)->timeout = PFTM_TCP_CLOSING;
6441 else
6442 (*state)->timeout = PFTM_TCP_ESTABLISHED;
6443
6444 /* Fall through to PASS packet */
6445
6446 } else if ((dst->state < TCPS_SYN_SENT ||
6447 dst->state >= TCPS_FIN_WAIT_2 || src->state >= TCPS_FIN_WAIT_2) &&
6448 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) &&
6449 /* Within a window forward of the originating packet */
6450 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW)) {
6451 /* Within a window backward of the originating packet */
6452
6453 /*
6454 * This currently handles three situations:
6455 * 1) Stupid stacks will shotgun SYNs before their peer
6456 * replies.
6457 * 2) When PF catches an already established stream (the
6458 * firewall rebooted, the state table was flushed, routes
6459 * changed...)
6460 * 3) Packets get funky immediately after the connection
6461 * closes (this should catch Solaris spurious ACK|FINs
6462 * that web servers like to spew after a close)
6463 *
6464 * This must be a little more careful than the above code
6465 * since packet floods will also be caught here. We don't
6466 * update the TTL here to mitigate the damage of a packet
6467 * flood and so the same code can handle awkward establishment
6468 * and a loosened connection close.
6469 * In the establishment case, a correct peer response will
6470 * validate the connection, go through the normal state code
6471 * and keep updating the state TTL.
6472 */
6473
6474 if (pf_status.debug >= PF_DEBUG_MISC) {
6475 printf("pf: loose state match: ");
6476 pf_print_state(*state);
6477 pf_print_flags(th->th_flags);
6478 printf(" seq=%u (%u) ack=%u len=%u ackskew=%d "
6479 "pkts=%llu:%llu dir=%s,%s\n", seq, orig_seq, ack,
6480 pd->p_len, ackskew, (*state)->packets[0],
6481 (*state)->packets[1],
6482 direction == PF_IN ? "in" : "out",
6483 direction == (*state)->state_key->direction ?
6484 "fwd" : "rev");
6485 }
6486
6487 if (dst->scrub || src->scrub) {
6488 if (pf_normalize_tcp_stateful(m, off, pd, reason, th,
6489 *state, src, dst, &copyback))
6490 return (PF_DROP);
6491 #ifndef NO_APPLE_EXTENSIONS
6492 m = pd->mp;
6493 #endif
6494 }
6495
6496 /* update max window */
6497 if (src->max_win < win)
6498 src->max_win = win;
6499 /* synchronize sequencing */
6500 if (SEQ_GT(end, src->seqlo))
6501 src->seqlo = end;
6502 /* slide the window of what the other end can send */
6503 #ifndef NO_APPLE_MODIFICATIONS
6504 if (SEQ_GEQ(ack + ((u_int32_t)win << sws), dst->seqhi))
6505 dst->seqhi = ack + MAX(((u_int32_t)win << sws), 1);
6506 #else
6507 if (SEQ_GEQ(ack + (win << sws), dst->seqhi))
6508 dst->seqhi = ack + MAX((win << sws), 1);
6509 #endif
6510
6511 /*
6512 * Cannot set dst->seqhi here since this could be a shotgunned
6513 * SYN and not an already established connection.
6514 */
6515
6516 if (th->th_flags & TH_FIN)
6517 if (src->state < TCPS_CLOSING)
6518 src->state = TCPS_CLOSING;
6519 if (th->th_flags & TH_RST)
6520 src->state = dst->state = TCPS_TIME_WAIT;
6521
6522 /* Fall through to PASS packet */
6523
6524 } else {
6525 if ((*state)->dst.state == TCPS_SYN_SENT &&
6526 (*state)->src.state == TCPS_SYN_SENT) {
6527 /* Send RST for state mismatches during handshake */
6528 if (!(th->th_flags & TH_RST))
6529 pf_send_tcp((*state)->rule.ptr, pd->af,
6530 pd->dst, pd->src, th->th_dport,
6531 th->th_sport, ntohl(th->th_ack), 0,
6532 TH_RST, 0, 0,
6533 (*state)->rule.ptr->return_ttl, 1, 0,
6534 pd->eh, kif->pfik_ifp);
6535 src->seqlo = 0;
6536 src->seqhi = 1;
6537 src->max_win = 1;
6538 } else if (pf_status.debug >= PF_DEBUG_MISC) {
6539 printf("pf: BAD state: ");
6540 pf_print_state(*state);
6541 pf_print_flags(th->th_flags);
6542 printf(" seq=%u (%u) ack=%u len=%u ackskew=%d "
6543 "pkts=%llu:%llu dir=%s,%s\n",
6544 seq, orig_seq, ack, pd->p_len, ackskew,
6545 (*state)->packets[0], (*state)->packets[1],
6546 direction == PF_IN ? "in" : "out",
6547 direction == (*state)->state_key->direction ?
6548 "fwd" : "rev");
6549 printf("pf: State failure on: %c %c %c %c | %c %c\n",
6550 SEQ_GEQ(src->seqhi, end) ? ' ' : '1',
6551 #ifndef NO_APPLE_MODIFICATIONS
6552 SEQ_GEQ(seq,
6553 src->seqlo - ((u_int32_t)dst->max_win << dws)) ?
6554 #else
6555 SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) ?
6556 #endif
6557 ' ': '2',
6558 (ackskew >= -MAXACKWINDOW) ? ' ' : '3',
6559 (ackskew <= (MAXACKWINDOW << sws)) ? ' ' : '4',
6560 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) ?' ' :'5',
6561 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW) ?' ' :'6');
6562 }
6563 REASON_SET(reason, PFRES_BADSTATE);
6564 return (PF_DROP);
6565 }
6566
6567 /* Any packets which have gotten here are to be passed */
6568
6569 #ifndef NO_APPLE_EXTENSIONS
6570 if ((*state)->state_key->app_state &&
6571 (*state)->state_key->app_state->handler) {
6572 (*state)->state_key->app_state->handler(*state, direction,
6573 off + (th->th_off << 2), pd, kif);
6574 if (pd->lmw < 0) {
6575 REASON_SET(reason, PFRES_MEMORY);
6576 return (PF_DROP);
6577 }
6578 m = pd->mp;
6579 }
6580
6581 /* translate source/destination address, if necessary */
6582 if (STATE_TRANSLATE((*state)->state_key)) {
6583 if (direction == PF_OUT)
6584 pf_change_ap(direction, pd->mp, pd->src, &th->th_sport,
6585 pd->ip_sum, &th->th_sum,
6586 &(*state)->state_key->gwy.addr,
6587 (*state)->state_key->gwy.xport.port, 0, pd->af);
6588 else
6589 pf_change_ap(direction, pd->mp, pd->dst, &th->th_dport,
6590 pd->ip_sum, &th->th_sum,
6591 &(*state)->state_key->lan.addr,
6592 (*state)->state_key->lan.xport.port, 0, pd->af);
6593 copyback = off + sizeof (*th);
6594 }
6595
6596 if (copyback) {
6597 m = pf_lazy_makewritable(pd, m, copyback);
6598 if (!m) {
6599 REASON_SET(reason, PFRES_MEMORY);
6600 return (PF_DROP);
6601 }
6602
6603 /* Copyback sequence modulation or stateful scrub changes */
6604 m_copyback(m, off, sizeof (*th), th);
6605 }
6606 #else
6607 /* translate source/destination address, if necessary */
6608 if (STATE_TRANSLATE((*state)->state_key)) {
6609 if (direction == PF_OUT)
6610 pf_change_ap(pd->src, pd->mp, &th->th_sport, pd->ip_sum,
6611 &th->th_sum, &(*state)->state_key->gwy.addr,
6612 (*state)->state_key->gwy.port, 0, pd->af);
6613 else
6614 pf_change_ap(pd->dst, pd->mp, &th->th_dport, pd->ip_sum,
6615 &th->th_sum, &(*state)->state_key->lan.addr,
6616 (*state)->state_key->lan.port, 0, pd->af);
6617 m_copyback(m, off, sizeof (*th), th);
6618 } else if (copyback) {
6619 /* Copyback sequence modulation or stateful scrub changes */
6620 m_copyback(m, off, sizeof (*th), th);
6621 }
6622 #endif
6623
6624 return (PF_PASS);
6625 }
6626
6627 #ifndef NO_APPLE_EXTENSIONS
6628 static int
6629 pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif,
6630 struct mbuf *m, int off, void *h, struct pf_pdesc *pd, u_short *reason)
6631 #else
6632 pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif,
6633 struct mbuf *m, int off, void *h, struct pf_pdesc *pd)
6634 #endif
6635 {
6636 #pragma unused(h)
6637 struct pf_state_peer *src, *dst;
6638 struct pf_state_key_cmp key;
6639 struct udphdr *uh = pd->hdr.udp;
6640 #ifndef NO_APPLE_EXTENSIONS
6641 struct pf_app_state as;
6642 int dx, action, extfilter;
6643 key.app_state = 0;
6644 key.proto_variant = PF_EXTFILTER_APD;
6645 #endif
6646
6647 key.af = pd->af;
6648 key.proto = IPPROTO_UDP;
6649 if (direction == PF_IN) {
6650 PF_ACPY(&key.ext.addr, pd->src, key.af);
6651 PF_ACPY(&key.gwy.addr, pd->dst, key.af);
6652 #ifndef NO_APPLE_EXTENSIONS
6653 key.ext.xport.port = uh->uh_sport;
6654 key.gwy.xport.port = uh->uh_dport;
6655 dx = PF_IN;
6656 #else
6657 key.ext.port = uh->uh_sport;
6658 key.gwy.port = uh->uh_dport;
6659 #endif
6660 } else {
6661 PF_ACPY(&key.lan.addr, pd->src, key.af);
6662 PF_ACPY(&key.ext.addr, pd->dst, key.af);
6663 #ifndef NO_APPLE_EXTENSIONS
6664 key.lan.xport.port = uh->uh_sport;
6665 key.ext.xport.port = uh->uh_dport;
6666 dx = PF_OUT;
6667 #else
6668 key.lan.port = uh->uh_sport;
6669 key.ext.port = uh->uh_dport;
6670 #endif
6671 }
6672
6673 #ifndef NO_APPLE_EXTENSIONS
6674 if (ntohs(uh->uh_sport) == PF_IKE_PORT &&
6675 ntohs(uh->uh_dport) == PF_IKE_PORT) {
6676 struct pf_ike_hdr ike;
6677 size_t plen = m->m_pkthdr.len - off - sizeof (*uh);
6678 if (plen < PF_IKE_PACKET_MINSIZE) {
6679 DPFPRINTF(PF_DEBUG_MISC,
6680 ("pf: IKE message too small.\n"));
6681 return (PF_DROP);
6682 }
6683
6684 if (plen > sizeof (ike))
6685 plen = sizeof (ike);
6686 m_copydata(m, off + sizeof (*uh), plen, &ike);
6687
6688 if (ike.initiator_cookie) {
6689 key.app_state = &as;
6690 as.compare_lan_ext = pf_ike_compare;
6691 as.compare_ext_gwy = pf_ike_compare;
6692 as.u.ike.cookie = ike.initiator_cookie;
6693 } else {
6694 /*
6695 * <http://tools.ietf.org/html/\
6696 * draft-ietf-ipsec-nat-t-ike-01>
6697 * Support non-standard NAT-T implementations that
6698 * push the ESP packet over the top of the IKE packet.
6699 * Do not drop packet.
6700 */
6701 DPFPRINTF(PF_DEBUG_MISC,
6702 ("pf: IKE initiator cookie = 0.\n"));
6703 }
6704 }
6705
6706 *state = pf_find_state(kif, &key, dx);
6707
6708 if (!key.app_state && *state == 0) {
6709 key.proto_variant = PF_EXTFILTER_AD;
6710 *state = pf_find_state(kif, &key, dx);
6711 }
6712
6713 if (!key.app_state && *state == 0) {
6714 key.proto_variant = PF_EXTFILTER_EI;
6715 *state = pf_find_state(kif, &key, dx);
6716 }
6717
6718 if (pf_state_lookup_aux(state, kif, direction, &action))
6719 return (action);
6720 #else
6721 STATE_LOOKUP();
6722 #endif
6723
6724 if (direction == (*state)->state_key->direction) {
6725 src = &(*state)->src;
6726 dst = &(*state)->dst;
6727 } else {
6728 src = &(*state)->dst;
6729 dst = &(*state)->src;
6730 }
6731
6732 /* update states */
6733 if (src->state < PFUDPS_SINGLE)
6734 src->state = PFUDPS_SINGLE;
6735 if (dst->state == PFUDPS_SINGLE)
6736 dst->state = PFUDPS_MULTIPLE;
6737
6738 /* update expire time */
6739 (*state)->expire = pf_time_second();
6740 if (src->state == PFUDPS_MULTIPLE && dst->state == PFUDPS_MULTIPLE)
6741 (*state)->timeout = PFTM_UDP_MULTIPLE;
6742 else
6743 (*state)->timeout = PFTM_UDP_SINGLE;
6744
6745 #ifndef NO_APPLE_EXTENSIONS
6746 extfilter = (*state)->state_key->proto_variant;
6747 if (extfilter > PF_EXTFILTER_APD) {
6748 (*state)->state_key->ext.xport.port = key.ext.xport.port;
6749 if (extfilter > PF_EXTFILTER_AD)
6750 PF_ACPY(&(*state)->state_key->ext.addr,
6751 &key.ext.addr, key.af);
6752 }
6753
6754 if ((*state)->state_key->app_state &&
6755 (*state)->state_key->app_state->handler) {
6756 (*state)->state_key->app_state->handler(*state, direction,
6757 off + uh->uh_ulen, pd, kif);
6758 if (pd->lmw < 0) {
6759 REASON_SET(reason, PFRES_MEMORY);
6760 return (PF_DROP);
6761 }
6762 m = pd->mp;
6763 }
6764
6765 /* translate source/destination address, if necessary */
6766 if (STATE_TRANSLATE((*state)->state_key)) {
6767 m = pf_lazy_makewritable(pd, m, off + sizeof (*uh));
6768 if (!m) {
6769 REASON_SET(reason, PFRES_MEMORY);
6770 return (PF_DROP);
6771 }
6772
6773 if (direction == PF_OUT)
6774 pf_change_ap(direction, pd->mp, pd->src, &uh->uh_sport,
6775 pd->ip_sum, &uh->uh_sum,
6776 &(*state)->state_key->gwy.addr,
6777 (*state)->state_key->gwy.xport.port, 1, pd->af);
6778 else
6779 pf_change_ap(direction, pd->mp, pd->dst, &uh->uh_dport,
6780 pd->ip_sum, &uh->uh_sum,
6781 &(*state)->state_key->lan.addr,
6782 (*state)->state_key->lan.xport.port, 1, pd->af);
6783 m_copyback(m, off, sizeof (*uh), uh);
6784 }
6785 #else
6786 /* translate source/destination address, if necessary */
6787 if (STATE_TRANSLATE((*state)->state_key)) {
6788 if (direction == PF_OUT)
6789 pf_change_ap(pd->src, &uh->uh_sport, pd->ip_sum,
6790 &uh->uh_sum, &(*state)->state_key->gwy.addr,
6791 (*state)->state_key->gwy.port, 1, pd->af);
6792 else
6793 pf_change_ap(pd->dst, &uh->uh_dport, pd->ip_sum,
6794 &uh->uh_sum, &(*state)->state_key->lan.addr,
6795 (*state)->state_key->lan.port, 1, pd->af);
6796 m_copyback(m, off, sizeof (*uh), uh);
6797 }
6798 #endif
6799
6800 return (PF_PASS);
6801 }
6802
6803 static int
6804 pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
6805 struct mbuf *m, int off, void *h, struct pf_pdesc *pd, u_short *reason)
6806 {
6807 #pragma unused(h)
6808 struct pf_addr *saddr = pd->src, *daddr = pd->dst;
6809 u_int16_t icmpid = 0, *icmpsum;
6810 u_int8_t icmptype;
6811 int state_icmp = 0;
6812 struct pf_state_key_cmp key;
6813
6814 #ifndef NO_APPLE_EXTENSIONS
6815 struct pf_app_state as;
6816 key.app_state = 0;
6817 #endif
6818
6819 switch (pd->proto) {
6820 #if INET
6821 case IPPROTO_ICMP:
6822 icmptype = pd->hdr.icmp->icmp_type;
6823 icmpid = pd->hdr.icmp->icmp_id;
6824 icmpsum = &pd->hdr.icmp->icmp_cksum;
6825
6826 if (icmptype == ICMP_UNREACH ||
6827 icmptype == ICMP_SOURCEQUENCH ||
6828 icmptype == ICMP_REDIRECT ||
6829 icmptype == ICMP_TIMXCEED ||
6830 icmptype == ICMP_PARAMPROB)
6831 state_icmp++;
6832 break;
6833 #endif /* INET */
6834 #if INET6
6835 case IPPROTO_ICMPV6:
6836 icmptype = pd->hdr.icmp6->icmp6_type;
6837 icmpid = pd->hdr.icmp6->icmp6_id;
6838 icmpsum = &pd->hdr.icmp6->icmp6_cksum;
6839
6840 if (icmptype == ICMP6_DST_UNREACH ||
6841 icmptype == ICMP6_PACKET_TOO_BIG ||
6842 icmptype == ICMP6_TIME_EXCEEDED ||
6843 icmptype == ICMP6_PARAM_PROB)
6844 state_icmp++;
6845 break;
6846 #endif /* INET6 */
6847 }
6848
6849 if (!state_icmp) {
6850
6851 /*
6852 * ICMP query/reply message not related to a TCP/UDP packet.
6853 * Search for an ICMP state.
6854 */
6855 key.af = pd->af;
6856 key.proto = pd->proto;
6857 if (direction == PF_IN) {
6858 PF_ACPY(&key.ext.addr, pd->src, key.af);
6859 PF_ACPY(&key.gwy.addr, pd->dst, key.af);
6860 #ifndef NO_APPLE_EXTENSIONS
6861 key.ext.xport.port = 0;
6862 key.gwy.xport.port = icmpid;
6863 #else
6864 key.ext.port = 0;
6865 key.gwy.port = icmpid;
6866 #endif
6867 } else {
6868 PF_ACPY(&key.lan.addr, pd->src, key.af);
6869 PF_ACPY(&key.ext.addr, pd->dst, key.af);
6870 #ifndef NO_APPLE_EXTENSIONS
6871 key.lan.xport.port = icmpid;
6872 key.ext.xport.port = 0;
6873 #else
6874 key.lan.port = icmpid;
6875 key.ext.port = 0;
6876 #endif
6877 }
6878
6879 STATE_LOOKUP();
6880
6881 (*state)->expire = pf_time_second();
6882 (*state)->timeout = PFTM_ICMP_ERROR_REPLY;
6883
6884 /* translate source/destination address, if necessary */
6885 if (STATE_TRANSLATE((*state)->state_key)) {
6886 if (direction == PF_OUT) {
6887 switch (pd->af) {
6888 #if INET
6889 case AF_INET:
6890 pf_change_a(&saddr->v4.s_addr,
6891 pd->ip_sum,
6892 (*state)->state_key->gwy.addr.v4.s_addr, 0);
6893 #ifndef NO_APPLE_EXTENSIONS
6894 pd->hdr.icmp->icmp_cksum =
6895 pf_cksum_fixup(
6896 pd->hdr.icmp->icmp_cksum, icmpid,
6897 (*state)->state_key->gwy.xport.port, 0);
6898 pd->hdr.icmp->icmp_id =
6899 (*state)->state_key->gwy.xport.port;
6900 m = pf_lazy_makewritable(pd, m,
6901 off + ICMP_MINLEN);
6902 if (!m)
6903 return (PF_DROP);
6904 #else
6905 pd->hdr.icmp->icmp_cksum =
6906 pf_cksum_fixup(
6907 pd->hdr.icmp->icmp_cksum, icmpid,
6908 (*state)->state_key->gwy.port, 0);
6909 pd->hdr.icmp->icmp_id =
6910 (*state)->state_key->gwy.port;
6911 #endif
6912 m_copyback(m, off, ICMP_MINLEN,
6913 pd->hdr.icmp);
6914 break;
6915 #endif /* INET */
6916 #if INET6
6917 case AF_INET6:
6918 pf_change_a6(saddr,
6919 &pd->hdr.icmp6->icmp6_cksum,
6920 &(*state)->state_key->gwy.addr, 0);
6921 #ifndef NO_APPLE_EXTENSIONS
6922 m = pf_lazy_makewritable(pd, m,
6923 off + sizeof (struct icmp6_hdr));
6924 if (!m)
6925 return (PF_DROP);
6926 #endif
6927 m_copyback(m, off,
6928 sizeof (struct icmp6_hdr),
6929 pd->hdr.icmp6);
6930 break;
6931 #endif /* INET6 */
6932 }
6933 } else {
6934 switch (pd->af) {
6935 #if INET
6936 case AF_INET:
6937 pf_change_a(&daddr->v4.s_addr,
6938 pd->ip_sum,
6939 (*state)->state_key->lan.addr.v4.s_addr, 0);
6940 #ifndef NO_APPLE_EXTENSIONS
6941 pd->hdr.icmp->icmp_cksum =
6942 pf_cksum_fixup(
6943 pd->hdr.icmp->icmp_cksum, icmpid,
6944 (*state)->state_key->lan.xport.port, 0);
6945 pd->hdr.icmp->icmp_id =
6946 (*state)->state_key->lan.xport.port;
6947 m = pf_lazy_makewritable(pd, m,
6948 off + ICMP_MINLEN);
6949 if (!m)
6950 return (PF_DROP);
6951 #else
6952 pd->hdr.icmp->icmp_cksum =
6953 pf_cksum_fixup(
6954 pd->hdr.icmp->icmp_cksum, icmpid,
6955 (*state)->state_key->lan.port, 0);
6956 pd->hdr.icmp->icmp_id =
6957 (*state)->state_key->lan.port;
6958 #endif
6959 m_copyback(m, off, ICMP_MINLEN,
6960 pd->hdr.icmp);
6961 break;
6962 #endif /* INET */
6963 #if INET6
6964 case AF_INET6:
6965 pf_change_a6(daddr,
6966 &pd->hdr.icmp6->icmp6_cksum,
6967 &(*state)->state_key->lan.addr, 0);
6968 #ifndef NO_APPLE_EXTENSIONS
6969 m = pf_lazy_makewritable(pd, m,
6970 off + sizeof (struct icmp6_hdr));
6971 if (!m)
6972 return (PF_DROP);
6973 #endif
6974 m_copyback(m, off,
6975 sizeof (struct icmp6_hdr),
6976 pd->hdr.icmp6);
6977 break;
6978 #endif /* INET6 */
6979 }
6980 }
6981 }
6982
6983 return (PF_PASS);
6984
6985 } else {
6986 /*
6987 * ICMP error message in response to a TCP/UDP packet.
6988 * Extract the inner TCP/UDP header and search for that state.
6989 */
6990
6991 struct pf_pdesc pd2;
6992 #if INET
6993 struct ip h2;
6994 #endif /* INET */
6995 #if INET6
6996 struct ip6_hdr h2_6;
6997 int terminal = 0;
6998 #endif /* INET6 */
6999 int ipoff2 = 0;
7000 int off2 = 0;
7001
7002 memset(&pd2, 0, sizeof (pd2));
7003
7004 pd2.af = pd->af;
7005 switch (pd->af) {
7006 #if INET
7007 case AF_INET:
7008 /* offset of h2 in mbuf chain */
7009 ipoff2 = off + ICMP_MINLEN;
7010
7011 if (!pf_pull_hdr(m, ipoff2, &h2, sizeof (h2),
7012 NULL, reason, pd2.af)) {
7013 DPFPRINTF(PF_DEBUG_MISC,
7014 ("pf: ICMP error message too short "
7015 "(ip)\n"));
7016 return (PF_DROP);
7017 }
7018 /*
7019 * ICMP error messages don't refer to non-first
7020 * fragments
7021 */
7022 if (h2.ip_off & htons(IP_OFFMASK)) {
7023 REASON_SET(reason, PFRES_FRAG);
7024 return (PF_DROP);
7025 }
7026
7027 /* offset of protocol header that follows h2 */
7028 off2 = ipoff2 + (h2.ip_hl << 2);
7029
7030 pd2.proto = h2.ip_p;
7031 pd2.src = (struct pf_addr *)&h2.ip_src;
7032 pd2.dst = (struct pf_addr *)&h2.ip_dst;
7033 pd2.ip_sum = &h2.ip_sum;
7034 break;
7035 #endif /* INET */
7036 #if INET6
7037 case AF_INET6:
7038 ipoff2 = off + sizeof (struct icmp6_hdr);
7039
7040 if (!pf_pull_hdr(m, ipoff2, &h2_6, sizeof (h2_6),
7041 NULL, reason, pd2.af)) {
7042 DPFPRINTF(PF_DEBUG_MISC,
7043 ("pf: ICMP error message too short "
7044 "(ip6)\n"));
7045 return (PF_DROP);
7046 }
7047 pd2.proto = h2_6.ip6_nxt;
7048 pd2.src = (struct pf_addr *)&h2_6.ip6_src;
7049 pd2.dst = (struct pf_addr *)&h2_6.ip6_dst;
7050 pd2.ip_sum = NULL;
7051 off2 = ipoff2 + sizeof (h2_6);
7052 do {
7053 switch (pd2.proto) {
7054 case IPPROTO_FRAGMENT:
7055 /*
7056 * ICMPv6 error messages for
7057 * non-first fragments
7058 */
7059 REASON_SET(reason, PFRES_FRAG);
7060 return (PF_DROP);
7061 case IPPROTO_AH:
7062 case IPPROTO_HOPOPTS:
7063 case IPPROTO_ROUTING:
7064 case IPPROTO_DSTOPTS: {
7065 /* get next header and header length */
7066 struct ip6_ext opt6;
7067
7068 if (!pf_pull_hdr(m, off2, &opt6,
7069 sizeof (opt6), NULL, reason,
7070 pd2.af)) {
7071 DPFPRINTF(PF_DEBUG_MISC,
7072 ("pf: ICMPv6 short opt\n"));
7073 return (PF_DROP);
7074 }
7075 if (pd2.proto == IPPROTO_AH)
7076 off2 += (opt6.ip6e_len + 2) * 4;
7077 else
7078 off2 += (opt6.ip6e_len + 1) * 8;
7079 pd2.proto = opt6.ip6e_nxt;
7080 /* goto the next header */
7081 break;
7082 }
7083 default:
7084 terminal++;
7085 break;
7086 }
7087 } while (!terminal);
7088 break;
7089 #endif /* INET6 */
7090 }
7091
7092 switch (pd2.proto) {
7093 case IPPROTO_TCP: {
7094 struct tcphdr th;
7095 u_int32_t seq;
7096 struct pf_state_peer *src, *dst;
7097 u_int8_t dws;
7098 int copyback = 0;
7099
7100 /*
7101 * Only the first 8 bytes of the TCP header can be
7102 * expected. Don't access any TCP header fields after
7103 * th_seq, an ackskew test is not possible.
7104 */
7105 if (!pf_pull_hdr(m, off2, &th, 8, NULL, reason,
7106 pd2.af)) {
7107 DPFPRINTF(PF_DEBUG_MISC,
7108 ("pf: ICMP error message too short "
7109 "(tcp)\n"));
7110 return (PF_DROP);
7111 }
7112
7113 key.af = pd2.af;
7114 key.proto = IPPROTO_TCP;
7115 if (direction == PF_IN) {
7116 PF_ACPY(&key.ext.addr, pd2.dst, key.af);
7117 PF_ACPY(&key.gwy.addr, pd2.src, key.af);
7118 #ifndef NO_APPLE_EXTENSIONS
7119 key.ext.xport.port = th.th_dport;
7120 key.gwy.xport.port = th.th_sport;
7121 #else
7122 key.ext.port = th.th_dport;
7123 key.gwy.port = th.th_sport;
7124 #endif
7125 } else {
7126 PF_ACPY(&key.lan.addr, pd2.dst, key.af);
7127 PF_ACPY(&key.ext.addr, pd2.src, key.af);
7128 #ifndef NO_APPLE_EXTENSIONS
7129 key.lan.xport.port = th.th_dport;
7130 key.ext.xport.port = th.th_sport;
7131 #else
7132 key.lan.port = th.th_dport;
7133 key.ext.port = th.th_sport;
7134 #endif
7135 }
7136
7137 STATE_LOOKUP();
7138
7139 if (direction == (*state)->state_key->direction) {
7140 src = &(*state)->dst;
7141 dst = &(*state)->src;
7142 } else {
7143 src = &(*state)->src;
7144 dst = &(*state)->dst;
7145 }
7146
7147 if (src->wscale && dst->wscale)
7148 dws = dst->wscale & PF_WSCALE_MASK;
7149 else
7150 dws = 0;
7151
7152 /* Demodulate sequence number */
7153 seq = ntohl(th.th_seq) - src->seqdiff;
7154 if (src->seqdiff) {
7155 pf_change_a(&th.th_seq, icmpsum,
7156 htonl(seq), 0);
7157 copyback = 1;
7158 }
7159
7160 if (!SEQ_GEQ(src->seqhi, seq) ||
7161 #ifndef NO_APPLE_MODIFICATION
7162 !SEQ_GEQ(seq,
7163 src->seqlo - ((u_int32_t)dst->max_win << dws))) {
7164 #else
7165 !SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws))) {
7166 #endif
7167 if (pf_status.debug >= PF_DEBUG_MISC) {
7168 printf("pf: BAD ICMP %d:%d ",
7169 icmptype, pd->hdr.icmp->icmp_code);
7170 pf_print_host(pd->src, 0, pd->af);
7171 printf(" -> ");
7172 pf_print_host(pd->dst, 0, pd->af);
7173 printf(" state: ");
7174 pf_print_state(*state);
7175 printf(" seq=%u\n", seq);
7176 }
7177 REASON_SET(reason, PFRES_BADSTATE);
7178 return (PF_DROP);
7179 }
7180
7181 if (STATE_TRANSLATE((*state)->state_key)) {
7182 if (direction == PF_IN) {
7183 pf_change_icmp(pd2.src, &th.th_sport,
7184 daddr, &(*state)->state_key->lan.addr,
7185 #ifndef NO_APPLE_EXTENSIONS
7186 (*state)->state_key->lan.xport.port, NULL,
7187 #else
7188 (*state)->state_key->lan.port, NULL,
7189 #endif
7190 pd2.ip_sum, icmpsum,
7191 pd->ip_sum, 0, pd2.af);
7192 } else {
7193 pf_change_icmp(pd2.dst, &th.th_dport,
7194 saddr, &(*state)->state_key->gwy.addr,
7195 #ifndef NO_APPLE_EXTENSIONS
7196 (*state)->state_key->gwy.xport.port, NULL,
7197 #else
7198 (*state)->state_key->gwy.port, NULL,
7199 #endif
7200 pd2.ip_sum, icmpsum,
7201 pd->ip_sum, 0, pd2.af);
7202 }
7203 copyback = 1;
7204 }
7205
7206 if (copyback) {
7207 #ifndef NO_APPLE_EXTENSIONS
7208 m = pf_lazy_makewritable(pd, m, off2 + 8);
7209 if (!m)
7210 return (PF_DROP);
7211 #endif
7212 switch (pd2.af) {
7213 #if INET
7214 case AF_INET:
7215 m_copyback(m, off, ICMP_MINLEN,
7216 pd->hdr.icmp);
7217 m_copyback(m, ipoff2, sizeof (h2),
7218 &h2);
7219 break;
7220 #endif /* INET */
7221 #if INET6
7222 case AF_INET6:
7223 m_copyback(m, off,
7224 sizeof (struct icmp6_hdr),
7225 pd->hdr.icmp6);
7226 m_copyback(m, ipoff2, sizeof (h2_6),
7227 &h2_6);
7228 break;
7229 #endif /* INET6 */
7230 }
7231 m_copyback(m, off2, 8, &th);
7232 }
7233
7234 return (PF_PASS);
7235 break;
7236 }
7237 case IPPROTO_UDP: {
7238 struct udphdr uh;
7239 #ifndef NO_APPLE_EXTENSIONS
7240 int dx, action;
7241 #endif
7242 if (!pf_pull_hdr(m, off2, &uh, sizeof (uh),
7243 NULL, reason, pd2.af)) {
7244 DPFPRINTF(PF_DEBUG_MISC,
7245 ("pf: ICMP error message too short "
7246 "(udp)\n"));
7247 return (PF_DROP);
7248 }
7249
7250 key.af = pd2.af;
7251 key.proto = IPPROTO_UDP;
7252 if (direction == PF_IN) {
7253 PF_ACPY(&key.ext.addr, pd2.dst, key.af);
7254 PF_ACPY(&key.gwy.addr, pd2.src, key.af);
7255 #ifndef NO_APPLE_EXTENSIONS
7256 key.ext.xport.port = uh.uh_dport;
7257 key.gwy.xport.port = uh.uh_sport;
7258 dx = PF_IN;
7259 #else
7260 key.ext.port = uh.uh_dport;
7261 key.gwy.port = uh.uh_sport;
7262 #endif
7263 } else {
7264 PF_ACPY(&key.lan.addr, pd2.dst, key.af);
7265 PF_ACPY(&key.ext.addr, pd2.src, key.af);
7266 #ifndef NO_APPLE_EXTENSIONS
7267 key.lan.xport.port = uh.uh_dport;
7268 key.ext.xport.port = uh.uh_sport;
7269 dx = PF_OUT;
7270 #else
7271 key.lan.port = uh.uh_dport;
7272 key.ext.port = uh.uh_sport;
7273 #endif
7274 }
7275
7276 #ifndef NO_APPLE_EXTENSIONS
7277 key.proto_variant = PF_EXTFILTER_APD;
7278
7279 if (ntohs(uh.uh_sport) == PF_IKE_PORT &&
7280 ntohs(uh.uh_dport) == PF_IKE_PORT) {
7281 struct pf_ike_hdr ike;
7282 size_t plen =
7283 m->m_pkthdr.len - off2 - sizeof (uh);
7284 if (direction == PF_IN &&
7285 plen < 8 /* PF_IKE_PACKET_MINSIZE */) {
7286 DPFPRINTF(PF_DEBUG_MISC, ("pf: "
7287 "ICMP error, embedded IKE message "
7288 "too small.\n"));
7289 return (PF_DROP);
7290 }
7291
7292 if (plen > sizeof (ike))
7293 plen = sizeof (ike);
7294 m_copydata(m, off + sizeof (uh), plen, &ike);
7295
7296 key.app_state = &as;
7297 as.compare_lan_ext = pf_ike_compare;
7298 as.compare_ext_gwy = pf_ike_compare;
7299 as.u.ike.cookie = ike.initiator_cookie;
7300 }
7301
7302 *state = pf_find_state(kif, &key, dx);
7303
7304 if (key.app_state && *state == 0) {
7305 key.app_state = 0;
7306 *state = pf_find_state(kif, &key, dx);
7307 }
7308
7309 if (*state == 0) {
7310 key.proto_variant = PF_EXTFILTER_AD;
7311 *state = pf_find_state(kif, &key, dx);
7312 }
7313
7314 if (*state == 0) {
7315 key.proto_variant = PF_EXTFILTER_EI;
7316 *state = pf_find_state(kif, &key, dx);
7317 }
7318
7319 if (pf_state_lookup_aux(state, kif, direction, &action))
7320 return (action);
7321 #else
7322 STATE_LOOKUP();
7323 #endif
7324
7325 if (STATE_TRANSLATE((*state)->state_key)) {
7326 if (direction == PF_IN) {
7327 pf_change_icmp(pd2.src, &uh.uh_sport,
7328 daddr, &(*state)->state_key->lan.addr,
7329 #ifndef NO_APPLE_EXTENSIONS
7330 (*state)->state_key->lan.xport.port, &uh.uh_sum,
7331 #else
7332 (*state)->state_key->lan.port, &uh.uh_sum,
7333 #endif
7334 pd2.ip_sum, icmpsum,
7335 pd->ip_sum, 1, pd2.af);
7336 } else {
7337 pf_change_icmp(pd2.dst, &uh.uh_dport,
7338 saddr, &(*state)->state_key->gwy.addr,
7339 #ifndef NO_APPLE_EXTENSIONS
7340 (*state)->state_key->gwy.xport.port, &uh.uh_sum,
7341 #else
7342 (*state)->state_key->gwy.port, &uh.uh_sum,
7343 #endif
7344 pd2.ip_sum, icmpsum,
7345 pd->ip_sum, 1, pd2.af);
7346 }
7347 #ifndef NO_APPLE_EXTENSIONS
7348 m = pf_lazy_makewritable(pd, m,
7349 off2 + sizeof (uh));
7350 if (!m)
7351 return (PF_DROP);
7352 #endif
7353 switch (pd2.af) {
7354 #if INET
7355 case AF_INET:
7356 m_copyback(m, off, ICMP_MINLEN,
7357 pd->hdr.icmp);
7358 m_copyback(m, ipoff2, sizeof (h2), &h2);
7359 break;
7360 #endif /* INET */
7361 #if INET6
7362 case AF_INET6:
7363 m_copyback(m, off,
7364 sizeof (struct icmp6_hdr),
7365 pd->hdr.icmp6);
7366 m_copyback(m, ipoff2, sizeof (h2_6),
7367 &h2_6);
7368 break;
7369 #endif /* INET6 */
7370 }
7371 m_copyback(m, off2, sizeof (uh), &uh);
7372 }
7373
7374 return (PF_PASS);
7375 break;
7376 }
7377 #if INET
7378 case IPPROTO_ICMP: {
7379 struct icmp iih;
7380
7381 if (!pf_pull_hdr(m, off2, &iih, ICMP_MINLEN,
7382 NULL, reason, pd2.af)) {
7383 DPFPRINTF(PF_DEBUG_MISC,
7384 ("pf: ICMP error message too short i"
7385 "(icmp)\n"));
7386 return (PF_DROP);
7387 }
7388
7389 key.af = pd2.af;
7390 key.proto = IPPROTO_ICMP;
7391 if (direction == PF_IN) {
7392 PF_ACPY(&key.ext.addr, pd2.dst, key.af);
7393 PF_ACPY(&key.gwy.addr, pd2.src, key.af);
7394 #ifndef NO_APPLE_EXTENSIONS
7395 key.ext.xport.port = 0;
7396 key.gwy.xport.port = iih.icmp_id;
7397 #else
7398 key.ext.port = 0;
7399 key.gwy.port = iih.icmp_id;
7400 #endif
7401 } else {
7402 PF_ACPY(&key.lan.addr, pd2.dst, key.af);
7403 PF_ACPY(&key.ext.addr, pd2.src, key.af);
7404 #ifndef NO_APPLE_EXTENSIONS
7405 key.lan.xport.port = iih.icmp_id;
7406 key.ext.xport.port = 0;
7407 #else
7408 key.lan.port = iih.icmp_id;
7409 key.ext.port = 0;
7410 #endif
7411 }
7412
7413 STATE_LOOKUP();
7414
7415 if (STATE_TRANSLATE((*state)->state_key)) {
7416 if (direction == PF_IN) {
7417 pf_change_icmp(pd2.src, &iih.icmp_id,
7418 daddr, &(*state)->state_key->lan.addr,
7419 #ifndef NO_APPLE_EXTENSIONS
7420 (*state)->state_key->lan.xport.port, NULL,
7421 #else
7422 (*state)->state_key->lan.port, NULL,
7423 #endif
7424 pd2.ip_sum, icmpsum,
7425 pd->ip_sum, 0, AF_INET);
7426 } else {
7427 pf_change_icmp(pd2.dst, &iih.icmp_id,
7428 saddr, &(*state)->state_key->gwy.addr,
7429 #ifndef NO_APPLE_EXTENSIONS
7430 (*state)->state_key->gwy.xport.port, NULL,
7431 #else
7432 (*state)->state_key->gwy.port, NULL,
7433 #endif
7434 pd2.ip_sum, icmpsum,
7435 pd->ip_sum, 0, AF_INET);
7436 }
7437 #ifndef NO_APPLE_EXTENSIONS
7438 m = pf_lazy_makewritable(pd, m, off2 + ICMP_MINLEN);
7439 if (!m)
7440 return (PF_DROP);
7441 #endif
7442 m_copyback(m, off, ICMP_MINLEN, pd->hdr.icmp);
7443 m_copyback(m, ipoff2, sizeof (h2), &h2);
7444 m_copyback(m, off2, ICMP_MINLEN, &iih);
7445 }
7446
7447 return (PF_PASS);
7448 break;
7449 }
7450 #endif /* INET */
7451 #if INET6
7452 case IPPROTO_ICMPV6: {
7453 struct icmp6_hdr iih;
7454
7455 if (!pf_pull_hdr(m, off2, &iih,
7456 sizeof (struct icmp6_hdr), NULL, reason, pd2.af)) {
7457 DPFPRINTF(PF_DEBUG_MISC,
7458 ("pf: ICMP error message too short "
7459 "(icmp6)\n"));
7460 return (PF_DROP);
7461 }
7462
7463 key.af = pd2.af;
7464 key.proto = IPPROTO_ICMPV6;
7465 if (direction == PF_IN) {
7466 PF_ACPY(&key.ext.addr, pd2.dst, key.af);
7467 PF_ACPY(&key.gwy.addr, pd2.src, key.af);
7468 #ifndef NO_APPLE_EXTENSIONS
7469 key.ext.xport.port = 0;
7470 key.gwy.xport.port = iih.icmp6_id;
7471 #else
7472 key.ext.port = 0;
7473 key.gwy.port = iih.icmp6_id;
7474 #endif
7475 } else {
7476 PF_ACPY(&key.lan.addr, pd2.dst, key.af);
7477 PF_ACPY(&key.ext.addr, pd2.src, key.af);
7478 #ifndef NO_APPLE_EXTENSIONS
7479 key.lan.xport.port = iih.icmp6_id;
7480 key.ext.xport.port = 0;
7481 #else
7482 key.lan.port = iih.icmp6_id;
7483 key.ext.port = 0;
7484 #endif
7485 }
7486
7487 STATE_LOOKUP();
7488
7489 if (STATE_TRANSLATE((*state)->state_key)) {
7490 if (direction == PF_IN) {
7491 pf_change_icmp(pd2.src, &iih.icmp6_id,
7492 daddr, &(*state)->state_key->lan.addr,
7493 #ifndef NO_APPLE_EXTENSIONS
7494 (*state)->state_key->lan.xport.port, NULL,
7495 #else
7496 (*state)->state_key->lan.port, NULL,
7497 #endif
7498 pd2.ip_sum, icmpsum,
7499 pd->ip_sum, 0, AF_INET6);
7500 } else {
7501 pf_change_icmp(pd2.dst, &iih.icmp6_id,
7502 saddr, &(*state)->state_key->gwy.addr,
7503 #ifndef NO_APPLE_EXTENSIONS
7504 (*state)->state_key->gwy.xport.port, NULL,
7505 #else
7506 (*state)->state_key->gwy.port, NULL,
7507 #endif
7508 pd2.ip_sum, icmpsum,
7509 pd->ip_sum, 0, AF_INET6);
7510 }
7511 #ifndef NO_APPLE_EXTENSIONS
7512 m = pf_lazy_makewritable(pd, m, off2 +
7513 sizeof (struct icmp6_hdr));
7514 if (!m)
7515 return (PF_DROP);
7516 #endif
7517 m_copyback(m, off, sizeof (struct icmp6_hdr),
7518 pd->hdr.icmp6);
7519 m_copyback(m, ipoff2, sizeof (h2_6), &h2_6);
7520 m_copyback(m, off2, sizeof (struct icmp6_hdr),
7521 &iih);
7522 }
7523
7524 return (PF_PASS);
7525 break;
7526 }
7527 #endif /* INET6 */
7528 default: {
7529 key.af = pd2.af;
7530 key.proto = pd2.proto;
7531 if (direction == PF_IN) {
7532 PF_ACPY(&key.ext.addr, pd2.dst, key.af);
7533 PF_ACPY(&key.gwy.addr, pd2.src, key.af);
7534 #ifndef NO_APPLE_EXTENSIONS
7535 key.ext.xport.port = 0;
7536 key.gwy.xport.port = 0;
7537 #else
7538 key.ext.port = 0;
7539 key.gwy.port = 0;
7540 #endif
7541 } else {
7542 PF_ACPY(&key.lan.addr, pd2.dst, key.af);
7543 PF_ACPY(&key.ext.addr, pd2.src, key.af);
7544 #ifndef NO_APPLE_EXTENSIONS
7545 key.lan.xport.port = 0;
7546 key.ext.xport.port = 0;
7547 #else
7548 key.lan.port = 0;
7549 key.ext.port = 0;
7550 #endif
7551 }
7552
7553 STATE_LOOKUP();
7554
7555 if (STATE_TRANSLATE((*state)->state_key)) {
7556 if (direction == PF_IN) {
7557 pf_change_icmp(pd2.src, NULL,
7558 daddr, &(*state)->state_key->lan.addr,
7559 0, NULL,
7560 pd2.ip_sum, icmpsum,
7561 pd->ip_sum, 0, pd2.af);
7562 } else {
7563 pf_change_icmp(pd2.dst, NULL,
7564 saddr, &(*state)->state_key->gwy.addr,
7565 0, NULL,
7566 pd2.ip_sum, icmpsum,
7567 pd->ip_sum, 0, pd2.af);
7568 }
7569 switch (pd2.af) {
7570 #if INET
7571 case AF_INET:
7572 #ifndef NO_APPLE_EXTENSIONS
7573 m = pf_lazy_makewritable(pd, m,
7574 ipoff2 + sizeof (h2));
7575 if (!m)
7576 return (PF_DROP);
7577 #endif
7578 m_copyback(m, off, ICMP_MINLEN,
7579 pd->hdr.icmp);
7580 m_copyback(m, ipoff2, sizeof (h2), &h2);
7581 break;
7582 #endif /* INET */
7583 #if INET6
7584 case AF_INET6:
7585 #ifndef NO_APPLE_EXTENSIONS
7586 m = pf_lazy_makewritable(pd, m,
7587 ipoff2 + sizeof (h2_6));
7588 if (!m)
7589 return (PF_DROP);
7590 #endif
7591 m_copyback(m, off,
7592 sizeof (struct icmp6_hdr),
7593 pd->hdr.icmp6);
7594 m_copyback(m, ipoff2, sizeof (h2_6),
7595 &h2_6);
7596 break;
7597 #endif /* INET6 */
7598 }
7599 }
7600
7601 return (PF_PASS);
7602 break;
7603 }
7604 }
7605 }
7606 }
7607
7608 #ifndef NO_APPLE_EXTENSIONS
7609 static int
7610 pf_test_state_grev1(struct pf_state **state, int direction,
7611 struct pfi_kif *kif, int off, struct pf_pdesc *pd)
7612 {
7613 struct pf_state_peer *src;
7614 struct pf_state_peer *dst;
7615 struct pf_state_key_cmp key;
7616 struct pf_grev1_hdr *grev1 = pd->hdr.grev1;
7617 struct mbuf *m;
7618
7619 key.app_state = 0;
7620 key.af = pd->af;
7621 key.proto = IPPROTO_GRE;
7622 key.proto_variant = PF_GRE_PPTP_VARIANT;
7623 if (direction == PF_IN) {
7624 PF_ACPY(&key.ext.addr, pd->src, key.af);
7625 PF_ACPY(&key.gwy.addr, pd->dst, key.af);
7626 key.gwy.xport.call_id = grev1->call_id;
7627 } else {
7628 PF_ACPY(&key.lan.addr, pd->src, key.af);
7629 PF_ACPY(&key.ext.addr, pd->dst, key.af);
7630 key.ext.xport.call_id = grev1->call_id;
7631 }
7632
7633 STATE_LOOKUP();
7634
7635 if (direction == (*state)->state_key->direction) {
7636 src = &(*state)->src;
7637 dst = &(*state)->dst;
7638 } else {
7639 src = &(*state)->dst;
7640 dst = &(*state)->src;
7641 }
7642
7643 /* update states */
7644 if (src->state < PFGRE1S_INITIATING)
7645 src->state = PFGRE1S_INITIATING;
7646
7647 /* update expire time */
7648 (*state)->expire = pf_time_second();
7649 if (src->state >= PFGRE1S_INITIATING &&
7650 dst->state >= PFGRE1S_INITIATING) {
7651 if ((*state)->timeout != PFTM_TCP_ESTABLISHED)
7652 (*state)->timeout = PFTM_GREv1_ESTABLISHED;
7653 src->state = PFGRE1S_ESTABLISHED;
7654 dst->state = PFGRE1S_ESTABLISHED;
7655 } else {
7656 (*state)->timeout = PFTM_GREv1_INITIATING;
7657 }
7658
7659 if ((*state)->state_key->app_state)
7660 (*state)->state_key->app_state->u.grev1.pptp_state->expire =
7661 pf_time_second();
7662
7663 /* translate source/destination address, if necessary */
7664 if (STATE_GRE_TRANSLATE((*state)->state_key)) {
7665 if (direction == PF_OUT) {
7666 switch (pd->af) {
7667 #if INET
7668 case AF_INET:
7669 pf_change_a(&pd->src->v4.s_addr,
7670 pd->ip_sum,
7671 (*state)->state_key->gwy.addr.v4.s_addr, 0);
7672 break;
7673 #endif /* INET */
7674 #if INET6
7675 case AF_INET6:
7676 PF_ACPY(pd->src, &(*state)->state_key->gwy.addr,
7677 pd->af);
7678 break;
7679 #endif /* INET6 */
7680 }
7681 } else {
7682 grev1->call_id = (*state)->state_key->lan.xport.call_id;
7683
7684 switch (pd->af) {
7685 #if INET
7686 case AF_INET:
7687 pf_change_a(&pd->dst->v4.s_addr,
7688 pd->ip_sum,
7689 (*state)->state_key->lan.addr.v4.s_addr, 0);
7690 break;
7691 #endif /* INET */
7692 #if INET6
7693 case AF_INET6:
7694 PF_ACPY(pd->dst, &(*state)->state_key->lan.addr,
7695 pd->af);
7696 break;
7697 #endif /* INET6 */
7698 }
7699 }
7700
7701 m = pf_lazy_makewritable(pd, pd->mp, off + sizeof (*grev1));
7702 if (!m)
7703 return (PF_DROP);
7704 m_copyback(m, off, sizeof (*grev1), grev1);
7705 }
7706
7707 return (PF_PASS);
7708 }
7709
7710 int
7711 pf_test_state_esp(struct pf_state **state, int direction, struct pfi_kif *kif,
7712 int off, struct pf_pdesc *pd)
7713 {
7714 #pragma unused(off)
7715 struct pf_state_peer *src;
7716 struct pf_state_peer *dst;
7717 struct pf_state_key_cmp key;
7718 struct pf_esp_hdr *esp = pd->hdr.esp;
7719 int action;
7720
7721 memset(&key, 0, sizeof (key));
7722 key.af = pd->af;
7723 key.proto = IPPROTO_ESP;
7724 if (direction == PF_IN) {
7725 PF_ACPY(&key.ext.addr, pd->src, key.af);
7726 PF_ACPY(&key.gwy.addr, pd->dst, key.af);
7727 key.gwy.xport.spi = esp->spi;
7728 } else {
7729 PF_ACPY(&key.lan.addr, pd->src, key.af);
7730 PF_ACPY(&key.ext.addr, pd->dst, key.af);
7731 key.ext.xport.spi = esp->spi;
7732 }
7733
7734 *state = pf_find_state(kif, &key, direction);
7735
7736 if (*state == 0) {
7737 struct pf_state *s;
7738
7739 /*
7740 * <jhw@apple.com>
7741 * No matching state. Look for a blocking state. If we find
7742 * one, then use that state and move it so that it's keyed to
7743 * the SPI in the current packet.
7744 */
7745 if (direction == PF_IN) {
7746 key.gwy.xport.spi = 0;
7747
7748 s = pf_find_state(kif, &key, direction);
7749 if (s) {
7750 struct pf_state_key *sk = s->state_key;
7751
7752 RB_REMOVE(pf_state_tree_ext_gwy,
7753 &pf_statetbl_ext_gwy, sk);
7754 sk->lan.xport.spi = sk->gwy.xport.spi =
7755 esp->spi;
7756
7757 if (RB_INSERT(pf_state_tree_ext_gwy,
7758 &pf_statetbl_ext_gwy, sk))
7759 pf_detach_state(s, PF_DT_SKIP_EXTGWY);
7760 else
7761 *state = s;
7762 }
7763 } else {
7764 key.ext.xport.spi = 0;
7765
7766 s = pf_find_state(kif, &key, direction);
7767 if (s) {
7768 struct pf_state_key *sk = s->state_key;
7769
7770 RB_REMOVE(pf_state_tree_lan_ext,
7771 &pf_statetbl_lan_ext, sk);
7772 sk->ext.xport.spi = esp->spi;
7773
7774 if (RB_INSERT(pf_state_tree_lan_ext,
7775 &pf_statetbl_lan_ext, sk))
7776 pf_detach_state(s, PF_DT_SKIP_LANEXT);
7777 else
7778 *state = s;
7779 }
7780 }
7781
7782 if (s) {
7783 if (*state == 0) {
7784 #if NPFSYNC
7785 if (s->creatorid == pf_status.hostid)
7786 pfsync_delete_state(s);
7787 #endif
7788 s->timeout = PFTM_UNLINKED;
7789 hook_runloop(&s->unlink_hooks,
7790 HOOK_REMOVE|HOOK_FREE);
7791 pf_src_tree_remove_state(s);
7792 pf_free_state(s);
7793 return (PF_DROP);
7794 }
7795 }
7796 }
7797
7798 if (pf_state_lookup_aux(state, kif, direction, &action))
7799 return (action);
7800
7801 if (direction == (*state)->state_key->direction) {
7802 src = &(*state)->src;
7803 dst = &(*state)->dst;
7804 } else {
7805 src = &(*state)->dst;
7806 dst = &(*state)->src;
7807 }
7808
7809 /* update states */
7810 if (src->state < PFESPS_INITIATING)
7811 src->state = PFESPS_INITIATING;
7812
7813 /* update expire time */
7814 (*state)->expire = pf_time_second();
7815 if (src->state >= PFESPS_INITIATING &&
7816 dst->state >= PFESPS_INITIATING) {
7817 (*state)->timeout = PFTM_ESP_ESTABLISHED;
7818 src->state = PFESPS_ESTABLISHED;
7819 dst->state = PFESPS_ESTABLISHED;
7820 } else {
7821 (*state)->timeout = PFTM_ESP_INITIATING;
7822 }
7823 /* translate source/destination address, if necessary */
7824 if (STATE_ADDR_TRANSLATE((*state)->state_key)) {
7825 if (direction == PF_OUT) {
7826 switch (pd->af) {
7827 #if INET
7828 case AF_INET:
7829 pf_change_a(&pd->src->v4.s_addr,
7830 pd->ip_sum,
7831 (*state)->state_key->gwy.addr.v4.s_addr, 0);
7832 break;
7833 #endif /* INET */
7834 #if INET6
7835 case AF_INET6:
7836 PF_ACPY(pd->src, &(*state)->state_key->gwy.addr,
7837 pd->af);
7838 break;
7839 #endif /* INET6 */
7840 }
7841 } else {
7842 switch (pd->af) {
7843 #if INET
7844 case AF_INET:
7845 pf_change_a(&pd->dst->v4.s_addr,
7846 pd->ip_sum,
7847 (*state)->state_key->lan.addr.v4.s_addr, 0);
7848 break;
7849 #endif /* INET */
7850 #if INET6
7851 case AF_INET6:
7852 PF_ACPY(pd->dst, &(*state)->state_key->lan.addr,
7853 pd->af);
7854 break;
7855 #endif /* INET6 */
7856 }
7857 }
7858 }
7859
7860 return (PF_PASS);
7861 }
7862 #endif
7863
7864 static int
7865 pf_test_state_other(struct pf_state **state, int direction, struct pfi_kif *kif,
7866 struct pf_pdesc *pd)
7867 {
7868 struct pf_state_peer *src, *dst;
7869 struct pf_state_key_cmp key;
7870
7871 #ifndef NO_APPLE_EXTENSIONS
7872 key.app_state = 0;
7873 #endif
7874 key.af = pd->af;
7875 key.proto = pd->proto;
7876 if (direction == PF_IN) {
7877 PF_ACPY(&key.ext.addr, pd->src, key.af);
7878 PF_ACPY(&key.gwy.addr, pd->dst, key.af);
7879 #ifndef NO_APPLE_EXTENSIONS
7880 key.ext.xport.port = 0;
7881 key.gwy.xport.port = 0;
7882 #else
7883 key.ext.port = 0;
7884 key.gwy.port = 0;
7885 #endif
7886 } else {
7887 PF_ACPY(&key.lan.addr, pd->src, key.af);
7888 PF_ACPY(&key.ext.addr, pd->dst, key.af);
7889 #ifndef NO_APPLE_EXTENSIONS
7890 key.lan.xport.port = 0;
7891 key.ext.xport.port = 0;
7892 #else
7893 key.lan.port = 0;
7894 key.ext.port = 0;
7895 #endif
7896 }
7897
7898 STATE_LOOKUP();
7899
7900 if (direction == (*state)->state_key->direction) {
7901 src = &(*state)->src;
7902 dst = &(*state)->dst;
7903 } else {
7904 src = &(*state)->dst;
7905 dst = &(*state)->src;
7906 }
7907
7908 /* update states */
7909 if (src->state < PFOTHERS_SINGLE)
7910 src->state = PFOTHERS_SINGLE;
7911 if (dst->state == PFOTHERS_SINGLE)
7912 dst->state = PFOTHERS_MULTIPLE;
7913
7914 /* update expire time */
7915 (*state)->expire = pf_time_second();
7916 if (src->state == PFOTHERS_MULTIPLE && dst->state == PFOTHERS_MULTIPLE)
7917 (*state)->timeout = PFTM_OTHER_MULTIPLE;
7918 else
7919 (*state)->timeout = PFTM_OTHER_SINGLE;
7920
7921 /* translate source/destination address, if necessary */
7922 #ifndef NO_APPLE_EXTENSIONS
7923 if (STATE_ADDR_TRANSLATE((*state)->state_key)) {
7924 #else
7925 if (STATE_TRANSLATE((*state)->state_key)) {
7926 #endif
7927 if (direction == PF_OUT) {
7928 switch (pd->af) {
7929 #if INET
7930 case AF_INET:
7931 pf_change_a(&pd->src->v4.s_addr,
7932 pd->ip_sum,
7933 (*state)->state_key->gwy.addr.v4.s_addr,
7934 0);
7935 break;
7936 #endif /* INET */
7937 #if INET6
7938 case AF_INET6:
7939 PF_ACPY(pd->src,
7940 &(*state)->state_key->gwy.addr, pd->af);
7941 break;
7942 #endif /* INET6 */
7943 }
7944 } else {
7945 switch (pd->af) {
7946 #if INET
7947 case AF_INET:
7948 pf_change_a(&pd->dst->v4.s_addr,
7949 pd->ip_sum,
7950 (*state)->state_key->lan.addr.v4.s_addr,
7951 0);
7952 break;
7953 #endif /* INET */
7954 #if INET6
7955 case AF_INET6:
7956 PF_ACPY(pd->dst,
7957 &(*state)->state_key->lan.addr, pd->af);
7958 break;
7959 #endif /* INET6 */
7960 }
7961 }
7962 }
7963
7964 return (PF_PASS);
7965 }
7966
7967 /*
7968 * ipoff and off are measured from the start of the mbuf chain.
7969 * h must be at "ipoff" on the mbuf chain.
7970 */
7971 void *
7972 pf_pull_hdr(struct mbuf *m, int off, void *p, int len,
7973 u_short *actionp, u_short *reasonp, sa_family_t af)
7974 {
7975 switch (af) {
7976 #if INET
7977 case AF_INET: {
7978 struct ip *h = mtod(m, struct ip *);
7979 u_int16_t fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3;
7980
7981 if (fragoff) {
7982 if (fragoff >= len) {
7983 ACTION_SET(actionp, PF_PASS);
7984 } else {
7985 ACTION_SET(actionp, PF_DROP);
7986 REASON_SET(reasonp, PFRES_FRAG);
7987 }
7988 return (NULL);
7989 }
7990 if (m->m_pkthdr.len < off + len ||
7991 ntohs(h->ip_len) < off + len) {
7992 ACTION_SET(actionp, PF_DROP);
7993 REASON_SET(reasonp, PFRES_SHORT);
7994 return (NULL);
7995 }
7996 break;
7997 }
7998 #endif /* INET */
7999 #if INET6
8000 case AF_INET6: {
8001 struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
8002
8003 if (m->m_pkthdr.len < off + len ||
8004 (ntohs(h->ip6_plen) + sizeof (struct ip6_hdr)) <
8005 (unsigned)(off + len)) {
8006 ACTION_SET(actionp, PF_DROP);
8007 REASON_SET(reasonp, PFRES_SHORT);
8008 return (NULL);
8009 }
8010 break;
8011 }
8012 #endif /* INET6 */
8013 }
8014 m_copydata(m, off, len, p);
8015 return (p);
8016 }
8017
8018 int
8019 pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *kif)
8020 {
8021 #pragma unused(kif)
8022 struct sockaddr_in *dst;
8023 int ret = 1;
8024 #if INET6
8025 struct sockaddr_in6 *dst6;
8026 struct route_in6 ro;
8027 #else
8028 struct route ro;
8029 #endif
8030
8031 bzero(&ro, sizeof (ro));
8032 switch (af) {
8033 case AF_INET:
8034 dst = satosin(&ro.ro_dst);
8035 dst->sin_family = AF_INET;
8036 dst->sin_len = sizeof (*dst);
8037 dst->sin_addr = addr->v4;
8038 break;
8039 #if INET6
8040 case AF_INET6:
8041 dst6 = (struct sockaddr_in6 *)&ro.ro_dst;
8042 dst6->sin6_family = AF_INET6;
8043 dst6->sin6_len = sizeof (*dst6);
8044 dst6->sin6_addr = addr->v6;
8045 break;
8046 #endif /* INET6 */
8047 default:
8048 return (0);
8049 }
8050
8051 /* XXX: IFT_ENC is not currently used by anything*/
8052 /* Skip checks for ipsec interfaces */
8053 if (kif != NULL && kif->pfik_ifp->if_type == IFT_ENC)
8054 goto out;
8055
8056 rtalloc((struct route *)&ro);
8057
8058 out:
8059 if (ro.ro_rt != NULL)
8060 RTFREE(ro.ro_rt);
8061 return (ret);
8062 }
8063
8064 int
8065 pf_rtlabel_match(struct pf_addr *addr, sa_family_t af, struct pf_addr_wrap *aw)
8066 {
8067 #pragma unused(aw)
8068 struct sockaddr_in *dst;
8069 #if INET6
8070 struct sockaddr_in6 *dst6;
8071 struct route_in6 ro;
8072 #else
8073 struct route ro;
8074 #endif
8075 int ret = 0;
8076
8077 bzero(&ro, sizeof (ro));
8078 switch (af) {
8079 case AF_INET:
8080 dst = satosin(&ro.ro_dst);
8081 dst->sin_family = AF_INET;
8082 dst->sin_len = sizeof (*dst);
8083 dst->sin_addr = addr->v4;
8084 break;
8085 #if INET6
8086 case AF_INET6:
8087 dst6 = (struct sockaddr_in6 *)&ro.ro_dst;
8088 dst6->sin6_family = AF_INET6;
8089 dst6->sin6_len = sizeof (*dst6);
8090 dst6->sin6_addr = addr->v6;
8091 break;
8092 #endif /* INET6 */
8093 default:
8094 return (0);
8095 }
8096
8097 rtalloc((struct route *)&ro);
8098
8099 if (ro.ro_rt != NULL) {
8100 RTFREE(ro.ro_rt);
8101 }
8102
8103 return (ret);
8104 }
8105
8106 #if INET
8107 static void
8108 pf_route(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp,
8109 struct pf_state *s, struct pf_pdesc *pd)
8110 {
8111 #pragma unused(pd)
8112 struct mbuf *m0, *m1;
8113 struct route iproute;
8114 struct route *ro = NULL;
8115 struct sockaddr_in *dst;
8116 struct ip *ip;
8117 struct ifnet *ifp = NULL;
8118 struct pf_addr naddr;
8119 struct pf_src_node *sn = NULL;
8120 int error = 0;
8121 int sw_csum = 0;
8122
8123 if (m == NULL || *m == NULL || r == NULL ||
8124 (dir != PF_IN && dir != PF_OUT) || oifp == NULL)
8125 panic("pf_route: invalid parameters");
8126
8127 if (pd->pf_mtag->routed++ > 3) {
8128 m0 = *m;
8129 *m = NULL;
8130 goto bad;
8131 }
8132
8133 if (r->rt == PF_DUPTO) {
8134 if ((m0 = m_copym(*m, 0, M_COPYALL, M_NOWAIT)) == NULL)
8135 return;
8136 } else {
8137 if ((r->rt == PF_REPLYTO) == (r->direction == dir))
8138 return;
8139 m0 = *m;
8140 }
8141
8142 if (m0->m_len < (int)sizeof (struct ip)) {
8143 DPFPRINTF(PF_DEBUG_URGENT,
8144 ("pf_route: m0->m_len < sizeof (struct ip)\n"));
8145 goto bad;
8146 }
8147
8148 ip = mtod(m0, struct ip *);
8149
8150 ro = &iproute;
8151 bzero((caddr_t)ro, sizeof (*ro));
8152 dst = satosin(&ro->ro_dst);
8153 dst->sin_family = AF_INET;
8154 dst->sin_len = sizeof (*dst);
8155 dst->sin_addr = ip->ip_dst;
8156
8157 if (r->rt == PF_FASTROUTE) {
8158 rtalloc(ro);
8159 if (ro->ro_rt == 0) {
8160 ipstat.ips_noroute++;
8161 goto bad;
8162 }
8163
8164 ifp = ro->ro_rt->rt_ifp;
8165 ro->ro_rt->rt_use++;
8166
8167 if (ro->ro_rt->rt_flags & RTF_GATEWAY)
8168 dst = satosin(ro->ro_rt->rt_gateway);
8169 } else {
8170 if (TAILQ_EMPTY(&r->rpool.list)) {
8171 DPFPRINTF(PF_DEBUG_URGENT,
8172 ("pf_route: TAILQ_EMPTY(&r->rpool.list)\n"));
8173 goto bad;
8174 }
8175 if (s == NULL) {
8176 pf_map_addr(AF_INET, r, (struct pf_addr *)&ip->ip_src,
8177 &naddr, NULL, &sn);
8178 if (!PF_AZERO(&naddr, AF_INET))
8179 dst->sin_addr.s_addr = naddr.v4.s_addr;
8180 ifp = r->rpool.cur->kif ?
8181 r->rpool.cur->kif->pfik_ifp : NULL;
8182 } else {
8183 if (!PF_AZERO(&s->rt_addr, AF_INET))
8184 dst->sin_addr.s_addr =
8185 s->rt_addr.v4.s_addr;
8186 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
8187 }
8188 }
8189 if (ifp == NULL)
8190 goto bad;
8191
8192 if (oifp != ifp) {
8193 if (pf_test(PF_OUT, ifp, &m0, NULL) != PF_PASS)
8194 goto bad;
8195 else if (m0 == NULL)
8196 goto done;
8197 if (m0->m_len < (int)sizeof (struct ip)) {
8198 DPFPRINTF(PF_DEBUG_URGENT,
8199 ("pf_route: m0->m_len < sizeof (struct ip)\n"));
8200 goto bad;
8201 }
8202 ip = mtod(m0, struct ip *);
8203 }
8204
8205 /* Copied from ip_output. */
8206
8207 /* Catch routing changes wrt. hardware checksumming for TCP or UDP. */
8208 m0->m_pkthdr.csum_flags |= CSUM_IP;
8209 sw_csum = m0->m_pkthdr.csum_flags &
8210 ~IF_HWASSIST_CSUM_FLAGS(ifp->if_hwassist);
8211
8212 if (ifp->if_hwassist & CSUM_TCP_SUM16) {
8213 /*
8214 * Special case code for GMACE
8215 * frames that can be checksumed by GMACE SUM16 HW:
8216 * frame >64, no fragments, no UDP
8217 */
8218 if (apple_hwcksum_tx && (m0->m_pkthdr.csum_flags & CSUM_TCP) &&
8219 (ntohs(ip->ip_len) > 50) &&
8220 (ntohs(ip->ip_len) <= ifp->if_mtu)) {
8221 /*
8222 * Apple GMAC HW, expects:
8223 * STUFF_OFFSET << 16 | START_OFFSET
8224 */
8225 /* IP+Enet header length */
8226 u_short offset = ((ip->ip_hl) << 2) + 14;
8227 u_short csumprev = m0->m_pkthdr.csum_data & 0xffff;
8228 m0->m_pkthdr.csum_flags = CSUM_DATA_VALID |
8229 CSUM_TCP_SUM16; /* for GMAC */
8230 m0->m_pkthdr.csum_data = (csumprev + offset) << 16 ;
8231 m0->m_pkthdr.csum_data += offset;
8232 /* do IP hdr chksum in software */
8233 sw_csum = CSUM_DELAY_IP;
8234 } else {
8235 /* let the software handle any UDP or TCP checksums */
8236 sw_csum |= (CSUM_DELAY_DATA & m0->m_pkthdr.csum_flags);
8237 }
8238 } else if (apple_hwcksum_tx == 0) {
8239 sw_csum |= (CSUM_DELAY_DATA | CSUM_DELAY_IP) &
8240 m0->m_pkthdr.csum_flags;
8241 }
8242
8243 if (sw_csum & CSUM_DELAY_DATA) {
8244 in_delayed_cksum(m0);
8245 sw_csum &= ~CSUM_DELAY_DATA;
8246 m0->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
8247 }
8248
8249 if (apple_hwcksum_tx != 0) {
8250 m0->m_pkthdr.csum_flags &=
8251 IF_HWASSIST_CSUM_FLAGS(ifp->if_hwassist);
8252 } else {
8253 m0->m_pkthdr.csum_flags = 0;
8254 }
8255
8256 if (ntohs(ip->ip_len) <= ifp->if_mtu ||
8257 (ifp->if_hwassist & CSUM_FRAGMENT)) {
8258 ip->ip_sum = 0;
8259 if (sw_csum & CSUM_DELAY_IP)
8260 ip->ip_sum = in_cksum(m0, ip->ip_hl << 2);
8261 error = ifnet_output(ifp, PF_INET, m0, ro, sintosa(dst));
8262 goto done;
8263 }
8264
8265 /*
8266 * Too large for interface; fragment if possible.
8267 * Must be able to put at least 8 bytes per fragment.
8268 */
8269 if (ip->ip_off & htons(IP_DF)) {
8270 ipstat.ips_cantfrag++;
8271 if (r->rt != PF_DUPTO) {
8272 icmp_error(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 0,
8273 ifp->if_mtu);
8274 goto done;
8275 } else
8276 goto bad;
8277 }
8278
8279 m1 = m0;
8280 error = ip_fragment(m0, ifp, ifp->if_mtu, sw_csum);
8281 if (error) {
8282 m0 = NULL;
8283 goto bad;
8284 }
8285
8286 for (m0 = m1; m0; m0 = m1) {
8287 m1 = m0->m_nextpkt;
8288 m0->m_nextpkt = 0;
8289 if (error == 0)
8290 error = ifnet_output(ifp, PF_INET, m0, ro,
8291 sintosa(dst));
8292 else
8293 m_freem(m0);
8294 }
8295
8296 if (error == 0)
8297 ipstat.ips_fragmented++;
8298
8299 done:
8300 if (r->rt != PF_DUPTO)
8301 *m = NULL;
8302 if (ro == &iproute && ro->ro_rt)
8303 RTFREE(ro->ro_rt);
8304 return;
8305
8306 bad:
8307 m_freem(m0);
8308 goto done;
8309 }
8310 #endif /* INET */
8311
8312 #if INET6
8313 static void
8314 pf_route6(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp,
8315 struct pf_state *s, struct pf_pdesc *pd)
8316 {
8317 #pragma unused(pd)
8318 struct mbuf *m0;
8319 struct route_in6 ip6route;
8320 struct route_in6 *ro;
8321 struct sockaddr_in6 *dst;
8322 struct ip6_hdr *ip6;
8323 struct ifnet *ifp = NULL;
8324 struct pf_addr naddr;
8325 struct pf_src_node *sn = NULL;
8326 int error = 0;
8327
8328 if (m == NULL || *m == NULL || r == NULL ||
8329 (dir != PF_IN && dir != PF_OUT) || oifp == NULL)
8330 panic("pf_route6: invalid parameters");
8331
8332 if (pd->pf_mtag->routed++ > 3) {
8333 m0 = *m;
8334 *m = NULL;
8335 goto bad;
8336 }
8337
8338 if (r->rt == PF_DUPTO) {
8339 if ((m0 = m_copym(*m, 0, M_COPYALL, M_NOWAIT)) == NULL)
8340 return;
8341 } else {
8342 if ((r->rt == PF_REPLYTO) == (r->direction == dir))
8343 return;
8344 m0 = *m;
8345 }
8346
8347 if (m0->m_len < (int)sizeof (struct ip6_hdr)) {
8348 DPFPRINTF(PF_DEBUG_URGENT,
8349 ("pf_route6: m0->m_len < sizeof (struct ip6_hdr)\n"));
8350 goto bad;
8351 }
8352 ip6 = mtod(m0, struct ip6_hdr *);
8353
8354 ro = &ip6route;
8355 bzero((caddr_t)ro, sizeof (*ro));
8356 dst = (struct sockaddr_in6 *)&ro->ro_dst;
8357 dst->sin6_family = AF_INET6;
8358 dst->sin6_len = sizeof (*dst);
8359 dst->sin6_addr = ip6->ip6_dst;
8360
8361 /* Cheat. XXX why only in the v6 case??? */
8362 if (r->rt == PF_FASTROUTE) {
8363 struct pf_mtag *pf_mtag;
8364
8365 if ((pf_mtag = pf_get_mtag(m0)) == NULL)
8366 goto bad;
8367 pf_mtag->flags |= PF_TAG_GENERATED;
8368 ip6_output(m0, NULL, NULL, 0, NULL, NULL, 0);
8369 return;
8370 }
8371
8372 if (TAILQ_EMPTY(&r->rpool.list)) {
8373 DPFPRINTF(PF_DEBUG_URGENT,
8374 ("pf_route6: TAILQ_EMPTY(&r->rpool.list)\n"));
8375 goto bad;
8376 }
8377 if (s == NULL) {
8378 pf_map_addr(AF_INET6, r, (struct pf_addr *)&ip6->ip6_src,
8379 &naddr, NULL, &sn);
8380 if (!PF_AZERO(&naddr, AF_INET6))
8381 PF_ACPY((struct pf_addr *)&dst->sin6_addr,
8382 &naddr, AF_INET6);
8383 ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL;
8384 } else {
8385 if (!PF_AZERO(&s->rt_addr, AF_INET6))
8386 PF_ACPY((struct pf_addr *)&dst->sin6_addr,
8387 &s->rt_addr, AF_INET6);
8388 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
8389 }
8390 if (ifp == NULL)
8391 goto bad;
8392
8393 if (oifp != ifp) {
8394 if (pf_test6(PF_OUT, ifp, &m0, NULL) != PF_PASS)
8395 goto bad;
8396 else if (m0 == NULL)
8397 goto done;
8398 if (m0->m_len < (int)sizeof (struct ip6_hdr)) {
8399 DPFPRINTF(PF_DEBUG_URGENT, ("pf_route6: m0->m_len "
8400 "< sizeof (struct ip6_hdr)\n"));
8401 goto bad;
8402 }
8403 ip6 = mtod(m0, struct ip6_hdr *);
8404 }
8405
8406 /*
8407 * If the packet is too large for the outgoing interface,
8408 * send back an icmp6 error.
8409 */
8410 if (IN6_IS_SCOPE_EMBED(&dst->sin6_addr))
8411 dst->sin6_addr.s6_addr16[1] = htons(ifp->if_index);
8412 if ((unsigned)m0->m_pkthdr.len <= ifp->if_mtu) {
8413 error = nd6_output(ifp, ifp, m0, dst, NULL, 0);
8414 } else {
8415 in6_ifstat_inc(ifp, ifs6_in_toobig);
8416 if (r->rt != PF_DUPTO)
8417 icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu);
8418 else
8419 goto bad;
8420 }
8421
8422 done:
8423 if (r->rt != PF_DUPTO)
8424 *m = NULL;
8425 return;
8426
8427 bad:
8428 m_freem(m0);
8429 goto done;
8430 }
8431 #endif /* INET6 */
8432
8433
8434 /*
8435 * check protocol (tcp/udp/icmp/icmp6) checksum and set mbuf flag
8436 * off is the offset where the protocol header starts
8437 * len is the total length of protocol header plus payload
8438 * returns 0 when the checksum is valid, otherwise returns 1.
8439 */
8440 static int
8441 pf_check_proto_cksum(struct mbuf *m, int off, int len, u_int8_t p,
8442 sa_family_t af)
8443 {
8444 u_int16_t sum;
8445
8446 switch (p) {
8447 case IPPROTO_TCP:
8448 case IPPROTO_UDP:
8449 /*
8450 * Optimize for the common case; if the hardware calculated
8451 * value doesn't include pseudo-header checksum, or if it
8452 * is partially-computed (only 16-bit summation), do it in
8453 * software below.
8454 */
8455 if (apple_hwcksum_rx && (m->m_pkthdr.csum_flags &
8456 (CSUM_DATA_VALID | CSUM_PSEUDO_HDR)) &&
8457 (m->m_pkthdr.csum_data ^ 0xffff) == 0) {
8458 return (0);
8459 }
8460 break;
8461 case IPPROTO_ICMP:
8462 #if INET6
8463 case IPPROTO_ICMPV6:
8464 #endif /* INET6 */
8465 break;
8466 default:
8467 return (1);
8468 }
8469 if (off < (int)sizeof (struct ip) || len < (int)sizeof (struct udphdr))
8470 return (1);
8471 if (m->m_pkthdr.len < off + len)
8472 return (1);
8473 switch (af) {
8474 #if INET
8475 case AF_INET:
8476 if (p == IPPROTO_ICMP) {
8477 if (m->m_len < off)
8478 return (1);
8479 m->m_data += off;
8480 m->m_len -= off;
8481 sum = in_cksum(m, len);
8482 m->m_data -= off;
8483 m->m_len += off;
8484 } else {
8485 if (m->m_len < (int)sizeof (struct ip))
8486 return (1);
8487 sum = inet_cksum(m, p, off, len);
8488 }
8489 break;
8490 #endif /* INET */
8491 #if INET6
8492 case AF_INET6:
8493 if (m->m_len < (int)sizeof (struct ip6_hdr))
8494 return (1);
8495 sum = inet6_cksum(m, p, off, len);
8496 break;
8497 #endif /* INET6 */
8498 default:
8499 return (1);
8500 }
8501 if (sum) {
8502 switch (p) {
8503 case IPPROTO_TCP:
8504 tcpstat.tcps_rcvbadsum++;
8505 break;
8506 case IPPROTO_UDP:
8507 udpstat.udps_badsum++;
8508 break;
8509 case IPPROTO_ICMP:
8510 icmpstat.icps_checksum++;
8511 break;
8512 #if INET6
8513 case IPPROTO_ICMPV6:
8514 icmp6stat.icp6s_checksum++;
8515 break;
8516 #endif /* INET6 */
8517 }
8518 return (1);
8519 }
8520 return (0);
8521 }
8522
8523 #if INET
8524 #ifndef NO_APPLE_EXTENSIONS
8525 #define PF_APPLE_UPDATE_PDESC_IPv4() \
8526 do { \
8527 if (m && pd.mp && m != pd.mp) { \
8528 m = pd.mp; \
8529 h = mtod(m, struct ip *); \
8530 } \
8531 } while (0)
8532 #endif
8533
8534 int
8535 pf_test(int dir, struct ifnet *ifp, struct mbuf **m0,
8536 struct ether_header *eh)
8537 {
8538 struct pfi_kif *kif;
8539 u_short action, reason = 0, log = 0;
8540 struct mbuf *m = *m0;
8541 struct ip *h = 0;
8542 struct pf_rule *a = NULL, *r = &pf_default_rule, *tr, *nr;
8543 struct pf_state *s = NULL;
8544 struct pf_state_key *sk = NULL;
8545 struct pf_ruleset *ruleset = NULL;
8546 struct pf_pdesc pd;
8547 int off, dirndx, pqid = 0;
8548
8549 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
8550
8551 if (!pf_status.running)
8552 return (PF_PASS);
8553
8554 memset(&pd, 0, sizeof (pd));
8555
8556 if ((pd.pf_mtag = pf_get_mtag(m)) == NULL) {
8557 DPFPRINTF(PF_DEBUG_URGENT,
8558 ("pf_test: pf_get_mtag returned NULL\n"));
8559 return (PF_DROP);
8560 }
8561
8562 if (pd.pf_mtag->flags & PF_TAG_GENERATED)
8563 return (PF_PASS);
8564
8565 kif = (struct pfi_kif *)ifp->if_pf_kif;
8566
8567 if (kif == NULL) {
8568 DPFPRINTF(PF_DEBUG_URGENT,
8569 ("pf_test: kif == NULL, if_name %s\n", ifp->if_name));
8570 return (PF_DROP);
8571 }
8572 if (kif->pfik_flags & PFI_IFLAG_SKIP)
8573 return (PF_PASS);
8574
8575 #ifdef DIAGNOSTIC
8576 if ((m->m_flags & M_PKTHDR) == 0)
8577 panic("non-M_PKTHDR is passed to pf_test");
8578 #endif /* DIAGNOSTIC */
8579
8580 if (m->m_pkthdr.len < (int)sizeof (*h)) {
8581 action = PF_DROP;
8582 REASON_SET(&reason, PFRES_SHORT);
8583 log = 1;
8584 goto done;
8585 }
8586
8587 /* We do IP header normalization and packet reassembly here */
8588 if (pf_normalize_ip(m0, dir, kif, &reason, &pd) != PF_PASS) {
8589 action = PF_DROP;
8590 goto done;
8591 }
8592 m = *m0; /* pf_normalize messes with m0 */
8593 h = mtod(m, struct ip *);
8594
8595 off = h->ip_hl << 2;
8596 if (off < (int)sizeof (*h)) {
8597 action = PF_DROP;
8598 REASON_SET(&reason, PFRES_SHORT);
8599 log = 1;
8600 goto done;
8601 }
8602
8603 pd.src = (struct pf_addr *)&h->ip_src;
8604 pd.dst = (struct pf_addr *)&h->ip_dst;
8605 PF_ACPY(&pd.baddr, dir == PF_OUT ? pd.src : pd.dst, AF_INET);
8606 pd.ip_sum = &h->ip_sum;
8607 pd.proto = h->ip_p;
8608 #ifndef NO_APPLE_EXTENSIONS
8609 pd.proto_variant = 0;
8610 pd.mp = m;
8611 pd.lmw = 0;
8612 #endif
8613 pd.af = AF_INET;
8614 pd.tos = h->ip_tos;
8615 pd.tot_len = ntohs(h->ip_len);
8616 pd.eh = eh;
8617
8618 /* handle fragments that didn't get reassembled by normalization */
8619 if (h->ip_off & htons(IP_MF | IP_OFFMASK)) {
8620 action = pf_test_fragment(&r, dir, kif, m, h,
8621 &pd, &a, &ruleset);
8622 goto done;
8623 }
8624
8625 switch (h->ip_p) {
8626
8627 case IPPROTO_TCP: {
8628 struct tcphdr th;
8629 pd.hdr.tcp = &th;
8630 if (!pf_pull_hdr(m, off, &th, sizeof (th),
8631 &action, &reason, AF_INET)) {
8632 log = action != PF_PASS;
8633 goto done;
8634 }
8635 pd.p_len = pd.tot_len - off - (th.th_off << 2);
8636 if ((th.th_flags & TH_ACK) && pd.p_len == 0)
8637 pqid = 1;
8638 action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
8639 #ifndef NO_APPLE_EXTENSIONS
8640 if (pd.lmw < 0)
8641 goto done;
8642 PF_APPLE_UPDATE_PDESC_IPv4();
8643 #endif
8644 if (action == PF_DROP)
8645 goto done;
8646 action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd,
8647 &reason);
8648 #ifndef NO_APPLE_EXTENSIONS
8649 if (pd.lmw < 0)
8650 goto done;
8651 PF_APPLE_UPDATE_PDESC_IPv4();
8652 #endif
8653 if (action == PF_PASS) {
8654 #if NPFSYNC
8655 pfsync_update_state(s);
8656 #endif /* NPFSYNC */
8657 r = s->rule.ptr;
8658 a = s->anchor.ptr;
8659 log = s->log;
8660 } else if (s == NULL)
8661 action = pf_test_rule(&r, &s, dir, kif,
8662 m, off, h, &pd, &a, &ruleset, &ipintrq);
8663 break;
8664 }
8665
8666 case IPPROTO_UDP: {
8667 struct udphdr uh;
8668
8669 pd.hdr.udp = &uh;
8670 if (!pf_pull_hdr(m, off, &uh, sizeof (uh),
8671 &action, &reason, AF_INET)) {
8672 log = action != PF_PASS;
8673 goto done;
8674 }
8675 if (uh.uh_dport == 0 ||
8676 ntohs(uh.uh_ulen) > m->m_pkthdr.len - off ||
8677 ntohs(uh.uh_ulen) < sizeof (struct udphdr)) {
8678 action = PF_DROP;
8679 REASON_SET(&reason, PFRES_SHORT);
8680 goto done;
8681 }
8682 #ifndef NO_APPLE_EXTENSIONS
8683 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd,
8684 &reason);
8685 if (pd.lmw < 0)
8686 goto done;
8687 PF_APPLE_UPDATE_PDESC_IPv4();
8688 #else
8689 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd);
8690 #endif
8691 if (action == PF_PASS) {
8692 #if NPFSYNC
8693 pfsync_update_state(s);
8694 #endif /* NPFSYNC */
8695 r = s->rule.ptr;
8696 a = s->anchor.ptr;
8697 log = s->log;
8698 } else if (s == NULL)
8699 action = pf_test_rule(&r, &s, dir, kif,
8700 m, off, h, &pd, &a, &ruleset, &ipintrq);
8701 break;
8702 }
8703
8704 case IPPROTO_ICMP: {
8705 struct icmp ih;
8706
8707 pd.hdr.icmp = &ih;
8708 if (!pf_pull_hdr(m, off, &ih, ICMP_MINLEN,
8709 &action, &reason, AF_INET)) {
8710 log = action != PF_PASS;
8711 goto done;
8712 }
8713 action = pf_test_state_icmp(&s, dir, kif, m, off, h, &pd,
8714 &reason);
8715 #ifndef NO_APPLE_EXTENSIONS
8716 if (pd.lmw < 0)
8717 goto done;
8718 PF_APPLE_UPDATE_PDESC_IPv4();
8719 #endif
8720 if (action == PF_PASS) {
8721 #if NPFSYNC
8722 pfsync_update_state(s);
8723 #endif /* NPFSYNC */
8724 r = s->rule.ptr;
8725 a = s->anchor.ptr;
8726 log = s->log;
8727 } else if (s == NULL)
8728 action = pf_test_rule(&r, &s, dir, kif,
8729 m, off, h, &pd, &a, &ruleset, &ipintrq);
8730 break;
8731 }
8732
8733 #ifndef NO_APPLE_EXTENSIONS
8734 case IPPROTO_ESP: {
8735 struct pf_esp_hdr esp;
8736
8737 pd.hdr.esp = &esp;
8738 if (!pf_pull_hdr(m, off, &esp, sizeof (esp), &action, &reason,
8739 AF_INET)) {
8740 log = action != PF_PASS;
8741 goto done;
8742 }
8743 action = pf_test_state_esp(&s, dir, kif, off, &pd);
8744 if (pd.lmw < 0)
8745 goto done;
8746 PF_APPLE_UPDATE_PDESC_IPv4();
8747 if (action == PF_PASS) {
8748 #if NPFSYNC
8749 pfsync_update_state(s);
8750 #endif /* NPFSYNC */
8751 r = s->rule.ptr;
8752 a = s->anchor.ptr;
8753 log = s->log;
8754 } else if (s == NULL)
8755 action = pf_test_rule(&r, &s, dir, kif,
8756 m, off, h, &pd, &a, &ruleset, &ipintrq);
8757 break;
8758 }
8759
8760 case IPPROTO_GRE: {
8761 struct pf_grev1_hdr grev1;
8762 pd.hdr.grev1 = &grev1;
8763 if (!pf_pull_hdr(m, off, &grev1, sizeof (grev1), &action,
8764 &reason, AF_INET)) {
8765 log = (action != PF_PASS);
8766 goto done;
8767 }
8768 if ((ntohs(grev1.flags) & PF_GRE_FLAG_VERSION_MASK) == 1 &&
8769 ntohs(grev1.protocol_type) == PF_GRE_PPP_ETHERTYPE) {
8770 if (ntohs(grev1.payload_length) >
8771 m->m_pkthdr.len - off) {
8772 action = PF_DROP;
8773 REASON_SET(&reason, PFRES_SHORT);
8774 goto done;
8775 }
8776 pd.proto_variant = PF_GRE_PPTP_VARIANT;
8777 action = pf_test_state_grev1(&s, dir, kif, off, &pd);
8778 if (pd.lmw < 0) goto done;
8779 PF_APPLE_UPDATE_PDESC_IPv4();
8780 if (action == PF_PASS) {
8781 #if NPFSYNC
8782 pfsync_update_state(s);
8783 #endif /* NPFSYNC */
8784 r = s->rule.ptr;
8785 a = s->anchor.ptr;
8786 log = s->log;
8787 break;
8788 } else if (s == NULL) {
8789 action = pf_test_rule(&r, &s, dir, kif, m, off,
8790 h, &pd, &a, &ruleset, &ipintrq);
8791 if (action == PF_PASS)
8792 break;
8793 }
8794 }
8795
8796 /* not GREv1/PPTP, so treat as ordinary GRE... */
8797 }
8798 #endif
8799
8800 default:
8801 action = pf_test_state_other(&s, dir, kif, &pd);
8802 #ifndef NO_APPLE_EXTENSIONS
8803 if (pd.lmw < 0)
8804 goto done;
8805 PF_APPLE_UPDATE_PDESC_IPv4();
8806 #endif
8807 if (action == PF_PASS) {
8808 #if NPFSYNC
8809 pfsync_update_state(s);
8810 #endif /* NPFSYNC */
8811 r = s->rule.ptr;
8812 a = s->anchor.ptr;
8813 log = s->log;
8814 } else if (s == NULL)
8815 action = pf_test_rule(&r, &s, dir, kif, m, off, h,
8816 &pd, &a, &ruleset, &ipintrq);
8817 break;
8818 }
8819
8820 done:
8821 #ifndef NO_APPLE_EXTENSIONS
8822 *m0 = pd.mp;
8823 PF_APPLE_UPDATE_PDESC_IPv4();
8824 #endif
8825
8826 if (action == PF_PASS && h->ip_hl > 5 &&
8827 !((s && s->allow_opts) || r->allow_opts)) {
8828 action = PF_DROP;
8829 REASON_SET(&reason, PFRES_IPOPTIONS);
8830 log = 1;
8831 DPFPRINTF(PF_DEBUG_MISC,
8832 ("pf: dropping packet with ip options [hlen=%u]\n",
8833 (unsigned int) h->ip_hl));
8834 }
8835
8836 if ((s && s->tag) || PF_RTABLEID_IS_VALID(r->rtableid))
8837 (void) pf_tag_packet(m, pd.pf_mtag, s ? s->tag : 0,
8838 r->rtableid);
8839
8840 #if ALTQ
8841 if (action == PF_PASS && r->qid) {
8842 if (pqid || (pd.tos & IPTOS_LOWDELAY))
8843 pd.pf_mtag->qid = r->pqid;
8844 else
8845 pd.pf_mtag->qid = r->qid;
8846 /* add hints for ecn */
8847 pd.pf_mtag->hdr = h;
8848 }
8849 #endif /* ALTQ */
8850
8851 /*
8852 * connections redirected to loopback should not match sockets
8853 * bound specifically to loopback due to security implications,
8854 * see tcp_input() and in_pcblookup_listen().
8855 */
8856 if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP ||
8857 pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL &&
8858 (s->nat_rule.ptr->action == PF_RDR ||
8859 s->nat_rule.ptr->action == PF_BINAT) &&
8860 (ntohl(pd.dst->v4.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET)
8861 pd.pf_mtag->flags |= PF_TAG_TRANSLATE_LOCALHOST;
8862
8863 if (log) {
8864 struct pf_rule *lr;
8865
8866 if (s != NULL && s->nat_rule.ptr != NULL &&
8867 s->nat_rule.ptr->log & PF_LOG_ALL)
8868 lr = s->nat_rule.ptr;
8869 else
8870 lr = r;
8871 PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, lr, a, ruleset,
8872 &pd);
8873 }
8874
8875 kif->pfik_bytes[0][dir == PF_OUT][action != PF_PASS] += pd.tot_len;
8876 kif->pfik_packets[0][dir == PF_OUT][action != PF_PASS]++;
8877
8878 if (action == PF_PASS || r->action == PF_DROP) {
8879 dirndx = (dir == PF_OUT);
8880 r->packets[dirndx]++;
8881 r->bytes[dirndx] += pd.tot_len;
8882 if (a != NULL) {
8883 a->packets[dirndx]++;
8884 a->bytes[dirndx] += pd.tot_len;
8885 }
8886 if (s != NULL) {
8887 sk = s->state_key;
8888 if (s->nat_rule.ptr != NULL) {
8889 s->nat_rule.ptr->packets[dirndx]++;
8890 s->nat_rule.ptr->bytes[dirndx] += pd.tot_len;
8891 }
8892 if (s->src_node != NULL) {
8893 s->src_node->packets[dirndx]++;
8894 s->src_node->bytes[dirndx] += pd.tot_len;
8895 }
8896 if (s->nat_src_node != NULL) {
8897 s->nat_src_node->packets[dirndx]++;
8898 s->nat_src_node->bytes[dirndx] += pd.tot_len;
8899 }
8900 dirndx = (dir == sk->direction) ? 0 : 1;
8901 s->packets[dirndx]++;
8902 s->bytes[dirndx] += pd.tot_len;
8903 }
8904 tr = r;
8905 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule;
8906 if (nr != NULL) {
8907 struct pf_addr *x;
8908 /*
8909 * XXX: we need to make sure that the addresses
8910 * passed to pfr_update_stats() are the same than
8911 * the addresses used during matching (pfr_match)
8912 */
8913 if (r == &pf_default_rule) {
8914 tr = nr;
8915 x = (sk == NULL || sk->direction == dir) ?
8916 &pd.baddr : &pd.naddr;
8917 } else
8918 x = (sk == NULL || sk->direction == dir) ?
8919 &pd.naddr : &pd.baddr;
8920 if (x == &pd.baddr || s == NULL) {
8921 /* we need to change the address */
8922 if (dir == PF_OUT)
8923 pd.src = x;
8924 else
8925 pd.dst = x;
8926 }
8927 }
8928 if (tr->src.addr.type == PF_ADDR_TABLE)
8929 pfr_update_stats(tr->src.addr.p.tbl, (sk == NULL ||
8930 sk->direction == dir) ?
8931 pd.src : pd.dst, pd.af,
8932 pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
8933 tr->src.neg);
8934 if (tr->dst.addr.type == PF_ADDR_TABLE)
8935 pfr_update_stats(tr->dst.addr.p.tbl, (sk == NULL ||
8936 sk->direction == dir) ? pd.dst : pd.src, pd.af,
8937 pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
8938 tr->dst.neg);
8939 }
8940
8941 #ifndef NO_APPLE_EXTENSIONS
8942 VERIFY(m == NULL || pd.mp == NULL || pd.mp == m);
8943
8944 if (*m0) {
8945 if (pd.lmw < 0) {
8946 REASON_SET(&reason, PFRES_MEMORY);
8947 action = PF_DROP;
8948 }
8949
8950 if (action == PF_DROP) {
8951 m_freem(*m0);
8952 *m0 = NULL;
8953 return (PF_DROP);
8954 }
8955
8956 *m0 = m;
8957 }
8958 #endif
8959
8960 if (action == PF_SYNPROXY_DROP) {
8961 m_freem(*m0);
8962 *m0 = NULL;
8963 action = PF_PASS;
8964 } else if (r->rt)
8965 /* pf_route can free the mbuf causing *m0 to become NULL */
8966 pf_route(m0, r, dir, kif->pfik_ifp, s, &pd);
8967
8968 return (action);
8969 }
8970 #endif /* INET */
8971
8972 #if INET6
8973 #ifndef NO_APPLE_EXTENSIONS
8974 #define PF_APPLE_UPDATE_PDESC_IPv6() \
8975 do { \
8976 if (m && pd.mp && m != pd.mp) { \
8977 if (n == m) \
8978 n = pd.mp; \
8979 m = pd.mp; \
8980 h = mtod(m, struct ip6_hdr *); \
8981 } \
8982 } while (0)
8983 #endif
8984
8985 int
8986 pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0,
8987 struct ether_header *eh)
8988 {
8989 struct pfi_kif *kif;
8990 u_short action, reason = 0, log = 0;
8991 struct mbuf *m = *m0, *n = NULL;
8992 struct ip6_hdr *h;
8993 struct pf_rule *a = NULL, *r = &pf_default_rule, *tr, *nr;
8994 struct pf_state *s = NULL;
8995 struct pf_state_key *sk = NULL;
8996 struct pf_ruleset *ruleset = NULL;
8997 struct pf_pdesc pd;
8998 int off, terminal = 0, dirndx, rh_cnt = 0;
8999
9000 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
9001
9002 if (!pf_status.running)
9003 return (PF_PASS);
9004
9005 memset(&pd, 0, sizeof (pd));
9006
9007 if ((pd.pf_mtag = pf_get_mtag(m)) == NULL) {
9008 DPFPRINTF(PF_DEBUG_URGENT,
9009 ("pf_test6: pf_get_mtag returned NULL\n"));
9010 return (PF_DROP);
9011 }
9012
9013 if (pd.pf_mtag->flags & PF_TAG_GENERATED)
9014 return (PF_PASS);
9015
9016 kif = (struct pfi_kif *)ifp->if_pf_kif;
9017
9018 if (kif == NULL) {
9019 DPFPRINTF(PF_DEBUG_URGENT,
9020 ("pf_test6: kif == NULL, if_name %s\n", ifp->if_name));
9021 return (PF_DROP);
9022 }
9023 if (kif->pfik_flags & PFI_IFLAG_SKIP)
9024 return (PF_PASS);
9025
9026 #ifdef DIAGNOSTIC
9027 if ((m->m_flags & M_PKTHDR) == 0)
9028 panic("non-M_PKTHDR is passed to pf_test6");
9029 #endif /* DIAGNOSTIC */
9030
9031 h = mtod(m, struct ip6_hdr *);
9032
9033 if (m->m_pkthdr.len < (int)sizeof (*h)) {
9034 action = PF_DROP;
9035 REASON_SET(&reason, PFRES_SHORT);
9036 log = 1;
9037 goto done;
9038 }
9039
9040 /* We do IP header normalization and packet reassembly here */
9041 if (pf_normalize_ip6(m0, dir, kif, &reason, &pd) != PF_PASS) {
9042 action = PF_DROP;
9043 goto done;
9044 }
9045 m = *m0; /* pf_normalize messes with m0 */
9046 h = mtod(m, struct ip6_hdr *);
9047
9048 #if 1
9049 /*
9050 * we do not support jumbogram yet. if we keep going, zero ip6_plen
9051 * will do something bad, so drop the packet for now.
9052 */
9053 if (htons(h->ip6_plen) == 0) {
9054 action = PF_DROP;
9055 REASON_SET(&reason, PFRES_NORM); /*XXX*/
9056 goto done;
9057 }
9058 #endif
9059
9060 pd.src = (struct pf_addr *)&h->ip6_src;
9061 pd.dst = (struct pf_addr *)&h->ip6_dst;
9062 PF_ACPY(&pd.baddr, dir == PF_OUT ? pd.src : pd.dst, AF_INET6);
9063 pd.ip_sum = NULL;
9064 pd.af = AF_INET6;
9065 pd.tos = 0;
9066 pd.tot_len = ntohs(h->ip6_plen) + sizeof (struct ip6_hdr);
9067 pd.eh = eh;
9068
9069 off = ((caddr_t)h - m->m_data) + sizeof (struct ip6_hdr);
9070 pd.proto = h->ip6_nxt;
9071 #ifndef NO_APPLE_EXTENSIONS
9072 pd.proto_variant = 0;
9073 pd.mp = m;
9074 pd.lmw = 0;
9075 #endif
9076 do {
9077 switch (pd.proto) {
9078 case IPPROTO_FRAGMENT:
9079 action = pf_test_fragment(&r, dir, kif, m, h,
9080 &pd, &a, &ruleset);
9081 if (action == PF_DROP)
9082 REASON_SET(&reason, PFRES_FRAG);
9083 goto done;
9084 case IPPROTO_ROUTING: {
9085 struct ip6_rthdr rthdr;
9086
9087 if (rh_cnt++) {
9088 DPFPRINTF(PF_DEBUG_MISC,
9089 ("pf: IPv6 more than one rthdr\n"));
9090 action = PF_DROP;
9091 REASON_SET(&reason, PFRES_IPOPTIONS);
9092 log = 1;
9093 goto done;
9094 }
9095 if (!pf_pull_hdr(m, off, &rthdr, sizeof (rthdr), NULL,
9096 &reason, pd.af)) {
9097 DPFPRINTF(PF_DEBUG_MISC,
9098 ("pf: IPv6 short rthdr\n"));
9099 action = PF_DROP;
9100 REASON_SET(&reason, PFRES_SHORT);
9101 log = 1;
9102 goto done;
9103 }
9104 if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
9105 DPFPRINTF(PF_DEBUG_MISC,
9106 ("pf: IPv6 rthdr0\n"));
9107 action = PF_DROP;
9108 REASON_SET(&reason, PFRES_IPOPTIONS);
9109 log = 1;
9110 goto done;
9111 }
9112 /* FALLTHROUGH */
9113 }
9114 case IPPROTO_AH:
9115 case IPPROTO_HOPOPTS:
9116 case IPPROTO_DSTOPTS: {
9117 /* get next header and header length */
9118 struct ip6_ext opt6;
9119
9120 if (!pf_pull_hdr(m, off, &opt6, sizeof (opt6),
9121 NULL, &reason, pd.af)) {
9122 DPFPRINTF(PF_DEBUG_MISC,
9123 ("pf: IPv6 short opt\n"));
9124 action = PF_DROP;
9125 log = 1;
9126 goto done;
9127 }
9128 if (pd.proto == IPPROTO_AH)
9129 off += (opt6.ip6e_len + 2) * 4;
9130 else
9131 off += (opt6.ip6e_len + 1) * 8;
9132 pd.proto = opt6.ip6e_nxt;
9133 /* goto the next header */
9134 break;
9135 }
9136 default:
9137 terminal++;
9138 break;
9139 }
9140 } while (!terminal);
9141
9142 /* if there's no routing header, use unmodified mbuf for checksumming */
9143 if (!n)
9144 n = m;
9145
9146 switch (pd.proto) {
9147
9148 case IPPROTO_TCP: {
9149 struct tcphdr th;
9150
9151 pd.hdr.tcp = &th;
9152 if (!pf_pull_hdr(m, off, &th, sizeof (th),
9153 &action, &reason, AF_INET6)) {
9154 log = action != PF_PASS;
9155 goto done;
9156 }
9157 pd.p_len = pd.tot_len - off - (th.th_off << 2);
9158 action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
9159 #ifndef NO_APPLE_EXTENSIONS
9160 if (pd.lmw < 0)
9161 goto done;
9162 PF_APPLE_UPDATE_PDESC_IPv6();
9163 #endif
9164 if (action == PF_DROP)
9165 goto done;
9166 action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd,
9167 &reason);
9168 #ifndef NO_APPLE_EXTENSIONS
9169 if (pd.lmw < 0)
9170 goto done;
9171 PF_APPLE_UPDATE_PDESC_IPv6();
9172 #endif
9173 if (action == PF_PASS) {
9174 #if NPFSYNC
9175 pfsync_update_state(s);
9176 #endif /* NPFSYNC */
9177 r = s->rule.ptr;
9178 a = s->anchor.ptr;
9179 log = s->log;
9180 } else if (s == NULL)
9181 action = pf_test_rule(&r, &s, dir, kif,
9182 m, off, h, &pd, &a, &ruleset, &ip6intrq);
9183 break;
9184 }
9185
9186 case IPPROTO_UDP: {
9187 struct udphdr uh;
9188
9189 pd.hdr.udp = &uh;
9190 if (!pf_pull_hdr(m, off, &uh, sizeof (uh),
9191 &action, &reason, AF_INET6)) {
9192 log = action != PF_PASS;
9193 goto done;
9194 }
9195 if (uh.uh_dport == 0 ||
9196 ntohs(uh.uh_ulen) > m->m_pkthdr.len - off ||
9197 ntohs(uh.uh_ulen) < sizeof (struct udphdr)) {
9198 action = PF_DROP;
9199 REASON_SET(&reason, PFRES_SHORT);
9200 goto done;
9201 }
9202 #ifndef NO_APPLE_EXTENSIONS
9203 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd,
9204 &reason);
9205 if (pd.lmw < 0)
9206 goto done;
9207 PF_APPLE_UPDATE_PDESC_IPv6();
9208 #else
9209 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd);
9210 #endif
9211 if (action == PF_PASS) {
9212 #if NPFSYNC
9213 pfsync_update_state(s);
9214 #endif /* NPFSYNC */
9215 r = s->rule.ptr;
9216 a = s->anchor.ptr;
9217 log = s->log;
9218 } else if (s == NULL)
9219 action = pf_test_rule(&r, &s, dir, kif,
9220 m, off, h, &pd, &a, &ruleset, &ip6intrq);
9221 break;
9222 }
9223
9224 case IPPROTO_ICMPV6: {
9225 struct icmp6_hdr ih;
9226
9227 pd.hdr.icmp6 = &ih;
9228 if (!pf_pull_hdr(m, off, &ih, sizeof (ih),
9229 &action, &reason, AF_INET6)) {
9230 log = action != PF_PASS;
9231 goto done;
9232 }
9233 action = pf_test_state_icmp(&s, dir, kif,
9234 m, off, h, &pd, &reason);
9235 #ifndef NO_APPLE_EXTENSIONS
9236 if (pd.lmw < 0)
9237 goto done;
9238 PF_APPLE_UPDATE_PDESC_IPv6();
9239 #endif
9240 if (action == PF_PASS) {
9241 #if NPFSYNC
9242 pfsync_update_state(s);
9243 #endif /* NPFSYNC */
9244 r = s->rule.ptr;
9245 a = s->anchor.ptr;
9246 log = s->log;
9247 } else if (s == NULL)
9248 action = pf_test_rule(&r, &s, dir, kif,
9249 m, off, h, &pd, &a, &ruleset, &ip6intrq);
9250 break;
9251 }
9252
9253 #ifndef NO_APPLE_EXTENSIONS
9254 case IPPROTO_ESP: {
9255 struct pf_esp_hdr esp;
9256
9257 pd.hdr.esp = &esp;
9258 if (!pf_pull_hdr(m, off, &esp, sizeof (esp), &action, &reason,
9259 AF_INET6)) {
9260 log = action != PF_PASS;
9261 goto done;
9262 }
9263 action = pf_test_state_esp(&s, dir, kif, off, &pd);
9264 if (pd.lmw < 0)
9265 goto done;
9266 PF_APPLE_UPDATE_PDESC_IPv6();
9267 if (action == PF_PASS) {
9268 #if NPFSYNC
9269 pfsync_update_state(s);
9270 #endif /* NPFSYNC */
9271 r = s->rule.ptr;
9272 a = s->anchor.ptr;
9273 log = s->log;
9274 } else if (s == NULL)
9275 action = pf_test_rule(&r, &s, dir, kif,
9276 m, off, h, &pd, &a, &ruleset, &ip6intrq);
9277 break;
9278 }
9279
9280 case IPPROTO_GRE: {
9281 struct pf_grev1_hdr grev1;
9282
9283 pd.hdr.grev1 = &grev1;
9284 if (!pf_pull_hdr(m, off, &grev1, sizeof (grev1), &action,
9285 &reason, AF_INET6)) {
9286 log = (action != PF_PASS);
9287 goto done;
9288 }
9289 if ((ntohs(grev1.flags) & PF_GRE_FLAG_VERSION_MASK) == 1 &&
9290 ntohs(grev1.protocol_type) == PF_GRE_PPP_ETHERTYPE) {
9291 if (ntohs(grev1.payload_length) >
9292 m->m_pkthdr.len - off) {
9293 action = PF_DROP;
9294 REASON_SET(&reason, PFRES_SHORT);
9295 goto done;
9296 }
9297 action = pf_test_state_grev1(&s, dir, kif, off, &pd);
9298 if (pd.lmw < 0)
9299 goto done;
9300 PF_APPLE_UPDATE_PDESC_IPv6();
9301 if (action == PF_PASS) {
9302 #if NPFSYNC
9303 pfsync_update_state(s);
9304 #endif /* NPFSYNC */
9305 r = s->rule.ptr;
9306 a = s->anchor.ptr;
9307 log = s->log;
9308 break;
9309 } else if (s == NULL) {
9310 action = pf_test_rule(&r, &s, dir, kif, m, off,
9311 h, &pd, &a, &ruleset, &ip6intrq);
9312 if (action == PF_PASS)
9313 break;
9314 }
9315 }
9316
9317 /* not GREv1/PPTP, so treat as ordinary GRE... */
9318 }
9319 #endif
9320
9321 default:
9322 action = pf_test_state_other(&s, dir, kif, &pd);
9323 #ifndef NO_APPLE_EXTENSIONS
9324 if (pd.lmw < 0)
9325 goto done;
9326 PF_APPLE_UPDATE_PDESC_IPv6();
9327 #endif
9328 if (action == PF_PASS) {
9329 #if NPFSYNC
9330 pfsync_update_state(s);
9331 #endif /* NPFSYNC */
9332 r = s->rule.ptr;
9333 a = s->anchor.ptr;
9334 log = s->log;
9335 } else if (s == NULL)
9336 action = pf_test_rule(&r, &s, dir, kif, m, off, h,
9337 &pd, &a, &ruleset, &ip6intrq);
9338 break;
9339 }
9340
9341 done:
9342 #ifndef NO_APPLE_EXTENSIONS
9343 *m0 = pd.mp;
9344 PF_APPLE_UPDATE_PDESC_IPv6();
9345 #endif
9346
9347 if (n != m) {
9348 m_freem(n);
9349 n = NULL;
9350 }
9351
9352 /* handle dangerous IPv6 extension headers. */
9353 if (action == PF_PASS && rh_cnt &&
9354 !((s && s->allow_opts) || r->allow_opts)) {
9355 action = PF_DROP;
9356 REASON_SET(&reason, PFRES_IPOPTIONS);
9357 log = 1;
9358 DPFPRINTF(PF_DEBUG_MISC,
9359 ("pf: dropping packet with dangerous v6 headers\n"));
9360 }
9361
9362 if ((s && s->tag) || PF_RTABLEID_IS_VALID(r->rtableid))
9363 (void) pf_tag_packet(m, pd.pf_mtag, s ? s->tag : 0,
9364 r->rtableid);
9365
9366 #if ALTQ
9367 if (action == PF_PASS && r->qid) {
9368 if (pd.tos & IPTOS_LOWDELAY)
9369 pd.pf_mtag->qid = r->pqid;
9370 else
9371 pd.pf_mtag->qid = r->qid;
9372 /* add hints for ecn */
9373 pd.pf_mtag->hdr = h;
9374 }
9375 #endif /* ALTQ */
9376
9377 if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP ||
9378 pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL &&
9379 (s->nat_rule.ptr->action == PF_RDR ||
9380 s->nat_rule.ptr->action == PF_BINAT) &&
9381 IN6_IS_ADDR_LOOPBACK(&pd.dst->v6))
9382 pd.pf_mtag->flags |= PF_TAG_TRANSLATE_LOCALHOST;
9383
9384 if (log) {
9385 struct pf_rule *lr;
9386
9387 if (s != NULL && s->nat_rule.ptr != NULL &&
9388 s->nat_rule.ptr->log & PF_LOG_ALL)
9389 lr = s->nat_rule.ptr;
9390 else
9391 lr = r;
9392 PFLOG_PACKET(kif, h, m, AF_INET6, dir, reason, lr, a, ruleset,
9393 &pd);
9394 }
9395
9396 kif->pfik_bytes[1][dir == PF_OUT][action != PF_PASS] += pd.tot_len;
9397 kif->pfik_packets[1][dir == PF_OUT][action != PF_PASS]++;
9398
9399 if (action == PF_PASS || r->action == PF_DROP) {
9400 dirndx = (dir == PF_OUT);
9401 r->packets[dirndx]++;
9402 r->bytes[dirndx] += pd.tot_len;
9403 if (a != NULL) {
9404 a->packets[dirndx]++;
9405 a->bytes[dirndx] += pd.tot_len;
9406 }
9407 if (s != NULL) {
9408 sk = s->state_key;
9409 if (s->nat_rule.ptr != NULL) {
9410 s->nat_rule.ptr->packets[dirndx]++;
9411 s->nat_rule.ptr->bytes[dirndx] += pd.tot_len;
9412 }
9413 if (s->src_node != NULL) {
9414 s->src_node->packets[dirndx]++;
9415 s->src_node->bytes[dirndx] += pd.tot_len;
9416 }
9417 if (s->nat_src_node != NULL) {
9418 s->nat_src_node->packets[dirndx]++;
9419 s->nat_src_node->bytes[dirndx] += pd.tot_len;
9420 }
9421 dirndx = (dir == sk->direction) ? 0 : 1;
9422 s->packets[dirndx]++;
9423 s->bytes[dirndx] += pd.tot_len;
9424 }
9425 tr = r;
9426 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule;
9427 if (nr != NULL) {
9428 struct pf_addr *x;
9429 /*
9430 * XXX: we need to make sure that the addresses
9431 * passed to pfr_update_stats() are the same than
9432 * the addresses used during matching (pfr_match)
9433 */
9434 if (r == &pf_default_rule) {
9435 tr = nr;
9436 x = (s == NULL || sk->direction == dir) ?
9437 &pd.baddr : &pd.naddr;
9438 } else {
9439 x = (s == NULL || sk->direction == dir) ?
9440 &pd.naddr : &pd.baddr;
9441 }
9442 if (x == &pd.baddr || s == NULL) {
9443 if (dir == PF_OUT)
9444 pd.src = x;
9445 else
9446 pd.dst = x;
9447 }
9448 }
9449 if (tr->src.addr.type == PF_ADDR_TABLE)
9450 pfr_update_stats(tr->src.addr.p.tbl, (sk == NULL ||
9451 sk->direction == dir) ? pd.src : pd.dst, pd.af,
9452 pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
9453 tr->src.neg);
9454 if (tr->dst.addr.type == PF_ADDR_TABLE)
9455 pfr_update_stats(tr->dst.addr.p.tbl, (sk == NULL ||
9456 sk->direction == dir) ? pd.dst : pd.src, pd.af,
9457 pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
9458 tr->dst.neg);
9459 }
9460
9461 #if 0
9462 if (action == PF_SYNPROXY_DROP) {
9463 m_freem(*m0);
9464 *m0 = NULL;
9465 action = PF_PASS;
9466 } else if (r->rt)
9467 /* pf_route6 can free the mbuf causing *m0 to become NULL */
9468 pf_route6(m0, r, dir, kif->pfik_ifp, s, &pd);
9469 #else
9470 #ifndef NO_APPLE_EXTENSIONS
9471 VERIFY(m == NULL || pd.mp == NULL || pd.mp == m);
9472
9473 if (*m0) {
9474 if (pd.lmw < 0) {
9475 REASON_SET(&reason, PFRES_MEMORY);
9476 action = PF_DROP;
9477 }
9478
9479 if (action == PF_DROP) {
9480 m_freem(*m0);
9481 *m0 = NULL;
9482 return (PF_DROP);
9483 }
9484
9485 *m0 = m;
9486 }
9487
9488 if (action == PF_SYNPROXY_DROP) {
9489 m_freem(*m0);
9490 *m0 = NULL;
9491 action = PF_PASS;
9492 } else if (r->rt) {
9493 if (action == PF_PASS) {
9494 m = *m0;
9495 h = mtod(m, struct ip6_hdr *);
9496 }
9497
9498 /* pf_route6 can free the mbuf causing *m0 to become NULL */
9499 pf_route6(m0, r, dir, kif->pfik_ifp, s, &pd);
9500 }
9501 #else
9502 if (action != PF_SYNPROXY_DROP && r->rt)
9503 /* pf_route6 can free the mbuf causing *m0 to become NULL */
9504 pf_route6(m0, r, dir, kif->pfik_ifp, s, &pd);
9505
9506 if (action == PF_PASS) {
9507 m = *m0;
9508 h = mtod(m, struct ip6_hdr *);
9509 }
9510
9511 if (action == PF_SYNPROXY_DROP) {
9512 m_freem(*m0);
9513 *m0 = NULL;
9514 action = PF_PASS;
9515 }
9516 #endif
9517 #endif
9518
9519 return (action);
9520 }
9521 #endif /* INET6 */
9522
9523 static int
9524 pf_check_congestion(struct ifqueue *ifq)
9525 {
9526 #pragma unused(ifq)
9527 return (0);
9528 }
9529
9530 void
9531 pool_init(struct pool *pp, size_t size, unsigned int align, unsigned int ioff,
9532 int flags, const char *wchan, void *palloc)
9533 {
9534 #pragma unused(align, ioff, flags, palloc)
9535 bzero(pp, sizeof (*pp));
9536 pp->pool_zone = zinit(size, 1024 * size, PAGE_SIZE, wchan);
9537 if (pp->pool_zone != NULL) {
9538 zone_change(pp->pool_zone, Z_EXPAND, TRUE);
9539 pp->pool_hiwat = pp->pool_limit = (unsigned int)-1;
9540 pp->pool_name = wchan;
9541 }
9542 }
9543
9544 /* Zones cannot be currently destroyed */
9545 void
9546 pool_destroy(struct pool *pp)
9547 {
9548 #pragma unused(pp)
9549 }
9550
9551 void
9552 pool_sethiwat(struct pool *pp, int n)
9553 {
9554 pp->pool_hiwat = n; /* Currently unused */
9555 }
9556
9557 void
9558 pool_sethardlimit(struct pool *pp, int n, const char *warnmess, int ratecap)
9559 {
9560 #pragma unused(warnmess, ratecap)
9561 pp->pool_limit = n;
9562 }
9563
9564 void *
9565 pool_get(struct pool *pp, int flags)
9566 {
9567 void *buf;
9568
9569 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
9570
9571 if (pp->pool_count > pp->pool_limit) {
9572 DPFPRINTF(PF_DEBUG_NOISY,
9573 ("pf: pool %s hard limit reached (%d)\n",
9574 pp->pool_name != NULL ? pp->pool_name : "unknown",
9575 pp->pool_limit));
9576 pp->pool_fails++;
9577 return (NULL);
9578 }
9579
9580 buf = zalloc_canblock(pp->pool_zone, (flags & (PR_NOWAIT | PR_WAITOK)));
9581 if (buf != NULL) {
9582 pp->pool_count++;
9583 VERIFY(pp->pool_count != 0);
9584 }
9585 return (buf);
9586 }
9587
9588 void
9589 pool_put(struct pool *pp, void *v)
9590 {
9591 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
9592
9593 zfree(pp->pool_zone, v);
9594 VERIFY(pp->pool_count != 0);
9595 pp->pool_count--;
9596 }
9597
9598 struct pf_mtag *
9599 pf_find_mtag(struct mbuf *m)
9600 {
9601 #if !PF_PKTHDR
9602 struct m_tag *mtag;
9603
9604 if ((mtag = m_tag_locate(m, KERNEL_MODULE_TAG_ID,
9605 KERNEL_TAG_TYPE_PF, NULL)) == NULL)
9606 return (NULL);
9607
9608 return ((struct pf_mtag *)(mtag + 1));
9609 #else
9610 if (!(m->m_flags & M_PKTHDR))
9611 return (NULL);
9612
9613 return (&m->m_pkthdr.pf_mtag);
9614 #endif /* PF_PKTHDR */
9615 }
9616
9617 struct pf_mtag *
9618 pf_get_mtag(struct mbuf *m)
9619 {
9620 #if !PF_PKTHDR
9621 struct m_tag *mtag;
9622
9623 if ((mtag = m_tag_locate(m, KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_PF,
9624 NULL)) == NULL) {
9625 mtag = m_tag_alloc(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_PF,
9626 sizeof (struct pf_mtag), M_NOWAIT);
9627 if (mtag == NULL)
9628 return (NULL);
9629 bzero(mtag + 1, sizeof (struct pf_mtag));
9630 m_tag_prepend(m, mtag);
9631 }
9632 return ((struct pf_mtag *)(mtag + 1));
9633 #else
9634 return (pf_find_mtag(m));
9635 #endif /* PF_PKTHDR */
9636 }
9637
9638 uint64_t
9639 pf_time_second(void)
9640 {
9641 struct timeval t;
9642
9643 microuptime(&t);
9644 return (t.tv_sec);
9645 }
9646
9647 uint64_t
9648 pf_calendar_time_second(void)
9649 {
9650 struct timeval t;
9651
9652 microtime(&t);
9653 return (t.tv_sec);
9654 }
9655
9656 static void *
9657 hook_establish(struct hook_desc_head *head, int tail, hook_fn_t fn, void *arg)
9658 {
9659 struct hook_desc *hd;
9660
9661 hd = _MALLOC(sizeof(*hd), M_DEVBUF, M_WAITOK);
9662 if (hd == NULL)
9663 return (NULL);
9664
9665 hd->hd_fn = fn;
9666 hd->hd_arg = arg;
9667 if (tail)
9668 TAILQ_INSERT_TAIL(head, hd, hd_list);
9669 else
9670 TAILQ_INSERT_HEAD(head, hd, hd_list);
9671
9672 return (hd);
9673 }
9674
9675 static void
9676 hook_runloop(struct hook_desc_head *head, int flags)
9677 {
9678 struct hook_desc *hd;
9679
9680 if (!(flags & HOOK_REMOVE)) {
9681 if (!(flags & HOOK_ABORT))
9682 TAILQ_FOREACH(hd, head, hd_list)
9683 hd->hd_fn(hd->hd_arg);
9684 } else {
9685 while (!!(hd = TAILQ_FIRST(head))) {
9686 TAILQ_REMOVE(head, hd, hd_list);
9687 if (!(flags & HOOK_ABORT))
9688 hd->hd_fn(hd->hd_arg);
9689 if (flags & HOOK_FREE)
9690 _FREE(hd, M_DEVBUF);
9691 }
9692 }
9693 }
mirror of XNU