]> git.saurik.com Git - apple/xnu.git/blob - bsd/net/pf.c
projects / apple / xnu.git / blob
? search:


70ea3cf3395eba1ecef2b24461572cf7bccb7607
[apple/xnu.git] / bsd / net / pf.c
1 /*
2 * Copyright (c) 2007-2016 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 /* $apfw: git commit 6602420f2f101b74305cd78f7cd9e0c8fdedae97 $ */
30 /* $OpenBSD: pf.c,v 1.567 2008/02/20 23:40:13 henning Exp $ */
31
32 /*
33 * Copyright (c) 2001 Daniel Hartmeier
34 * Copyright (c) 2002 - 2013 Henning Brauer
35 * NAT64 - Copyright (c) 2010 Viagenie Inc. (http://www.viagenie.ca)
36 * All rights reserved.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 *
42 * - Redistributions of source code must retain the above copyright
43 * notice, this list of conditions and the following disclaimer.
44 * - Redistributions in binary form must reproduce the above
45 * copyright notice, this list of conditions and the following
46 * disclaimer in the documentation and/or other materials provided
47 * with the distribution.
48 *
49 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
50 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
51 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
52 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
53 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
54 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
55 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
56 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
57 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
58 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
59 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
60 * POSSIBILITY OF SUCH DAMAGE.
61 *
62 * Effort sponsored in part by the Defense Advanced Research Projects
63 * Agency (DARPA) and Air Force Research Laboratory, Air Force
64 * Materiel Command, USAF, under agreement number F30602-01-2-0537.
65 *
66 */
67
68 #include <machine/endian.h>
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/mbuf.h>
72 #include <sys/filio.h>
73 #include <sys/socket.h>
74 #include <sys/socketvar.h>
75 #include <sys/kernel.h>
76 #include <sys/time.h>
77 #include <sys/proc.h>
78 #include <sys/random.h>
79 #include <sys/mcache.h>
80 #include <sys/protosw.h>
81
82 #include <libkern/crypto/md5.h>
83 #include <libkern/libkern.h>
84
85 #include <mach/thread_act.h>
86
87 #include <net/if.h>
88 #include <net/if_types.h>
89 #include <net/bpf.h>
90 #include <net/route.h>
91 #include <net/dlil.h>
92
93 #include <netinet/in.h>
94 #include <netinet/in_var.h>
95 #include <netinet/in_systm.h>
96 #include <netinet/ip.h>
97 #include <netinet/ip_var.h>
98 #include <netinet/tcp.h>
99 #include <netinet/tcp_seq.h>
100 #include <netinet/udp.h>
101 #include <netinet/ip_icmp.h>
102 #include <netinet/in_pcb.h>
103 #include <netinet/tcp_timer.h>
104 #include <netinet/tcp_var.h>
105 #include <netinet/tcp_fsm.h>
106 #include <netinet/udp_var.h>
107 #include <netinet/icmp_var.h>
108 #include <net/if_ether.h>
109 #include <net/ethernet.h>
110 #include <net/flowhash.h>
111 #include <net/pfvar.h>
112 #include <net/if_pflog.h>
113
114 #if NPFSYNC
115 #include <net/if_pfsync.h>
116 #endif /* NPFSYNC */
117
118 #if INET6
119 #include <netinet/ip6.h>
120 #include <netinet6/in6_pcb.h>
121 #include <netinet6/ip6_var.h>
122 #include <netinet/icmp6.h>
123 #include <netinet6/nd6.h>
124 #endif /* INET6 */
125
126 #if DUMMYNET
127 #include <netinet/ip_dummynet.h>
128 #endif /* DUMMYNET */
129
130 /*
131 * For RandomULong(), to get a 32 bits random value
132 * Note that random() returns a 31 bits value, see rdar://11159750
133 */
134 #include <dev/random/randomdev.h>
135
136 #define DPFPRINTF(n, x) (pf_status.debug >= (n) ? printf x : ((void)0))
137
138 /*
139 * On Mac OS X, the rtableid value is treated as the interface scope
140 * value that is equivalent to the interface index used for scoped
141 * routing. A valid scope value is anything but IFSCOPE_NONE (0),
142 * as per definition of ifindex which is a positive, non-zero number.
143 * The other BSDs treat a negative rtableid value as invalid, hence
144 * the test against INT_MAX to handle userland apps which initialize
145 * the field with a negative number.
146 */
147 #define PF_RTABLEID_IS_VALID(r) \
148 ((r) > IFSCOPE_NONE && (r) <= INT_MAX)
149
150 /*
151 * Global variables
152 */
153 decl_lck_mtx_data(,pf_lock_data);
154 decl_lck_rw_data(,pf_perim_lock_data);
155 lck_mtx_t *pf_lock = &pf_lock_data;
156 lck_rw_t *pf_perim_lock = &pf_perim_lock_data;
157
158 /* state tables */
159 struct pf_state_tree_lan_ext pf_statetbl_lan_ext;
160 struct pf_state_tree_ext_gwy pf_statetbl_ext_gwy;
161
162 struct pf_palist pf_pabuf;
163 struct pf_status pf_status;
164
165 #if PF_ALTQ
166 struct pf_altqqueue pf_altqs[2];
167 struct pf_altqqueue *pf_altqs_active;
168 struct pf_altqqueue *pf_altqs_inactive;
169 u_int32_t ticket_altqs_active;
170 u_int32_t ticket_altqs_inactive;
171 int altqs_inactive_open;
172 #endif /* PF_ALTQ */
173 u_int32_t ticket_pabuf;
174
175 static MD5_CTX pf_tcp_secret_ctx;
176 static u_char pf_tcp_secret[16];
177 static int pf_tcp_secret_init;
178 static int pf_tcp_iss_off;
179
180 static struct pf_anchor_stackframe {
181 struct pf_ruleset *rs;
182 struct pf_rule *r;
183 struct pf_anchor_node *parent;
184 struct pf_anchor *child;
185 } pf_anchor_stack[64];
186
187 struct pool pf_src_tree_pl, pf_rule_pl, pf_pooladdr_pl;
188 struct pool pf_state_pl, pf_state_key_pl;
189 #if PF_ALTQ
190 struct pool pf_altq_pl;
191 #endif /* PF_ALTQ */
192
193 typedef void (*hook_fn_t)(void *);
194
195 struct hook_desc {
196 TAILQ_ENTRY(hook_desc) hd_list;
197 hook_fn_t hd_fn;
198 void *hd_arg;
199 };
200
201 #define HOOK_REMOVE 0x01
202 #define HOOK_FREE 0x02
203 #define HOOK_ABORT 0x04
204
205 static void *hook_establish(struct hook_desc_head *, int,
206 hook_fn_t, void *);
207 static void hook_runloop(struct hook_desc_head *, int flags);
208
209 struct pool pf_app_state_pl;
210 static void pf_print_addr(struct pf_addr *addr, sa_family_t af);
211 static void pf_print_sk_host(struct pf_state_host *, u_int8_t, int,
212 u_int8_t);
213
214 static void pf_print_host(struct pf_addr *, u_int16_t, u_int8_t);
215
216 static void pf_init_threshold(struct pf_threshold *, u_int32_t,
217 u_int32_t);
218 static void pf_add_threshold(struct pf_threshold *);
219 static int pf_check_threshold(struct pf_threshold *);
220
221 static void pf_change_ap(int, struct mbuf *, struct pf_addr *,
222 u_int16_t *, u_int16_t *, u_int16_t *,
223 struct pf_addr *, u_int16_t, u_int8_t, sa_family_t,
224 sa_family_t, int);
225 static int pf_modulate_sack(struct mbuf *, int, struct pf_pdesc *,
226 struct tcphdr *, struct pf_state_peer *);
227 #if INET6
228 static void pf_change_a6(struct pf_addr *, u_int16_t *,
229 struct pf_addr *, u_int8_t);
230 void pf_change_addr(struct pf_addr *a, u_int16_t *c,
231 struct pf_addr *an, u_int8_t u,
232 sa_family_t af, sa_family_t afn);
233 #endif /* INET6 */
234 static void pf_change_icmp(struct pf_addr *, u_int16_t *,
235 struct pf_addr *, struct pf_addr *, u_int16_t,
236 u_int16_t *, u_int16_t *, u_int16_t *,
237 u_int16_t *, u_int8_t, sa_family_t);
238 static void pf_send_tcp(const struct pf_rule *, sa_family_t,
239 const struct pf_addr *, const struct pf_addr *,
240 u_int16_t, u_int16_t, u_int32_t, u_int32_t,
241 u_int8_t, u_int16_t, u_int16_t, u_int8_t, int,
242 u_int16_t, struct ether_header *, struct ifnet *);
243 static void pf_send_icmp(struct mbuf *, u_int8_t, u_int8_t,
244 sa_family_t, struct pf_rule *);
245 static struct pf_rule *pf_match_translation(struct pf_pdesc *, struct mbuf *,
246 int, int, struct pfi_kif *, struct pf_addr *,
247 union pf_state_xport *, struct pf_addr *,
248 union pf_state_xport *, int);
249 static struct pf_rule *pf_get_translation_aux(struct pf_pdesc *,
250 struct mbuf *, int, int, struct pfi_kif *,
251 struct pf_src_node **, struct pf_addr *,
252 union pf_state_xport *, struct pf_addr *,
253 union pf_state_xport *, union pf_state_xport *);
254 static void pf_attach_state(struct pf_state_key *,
255 struct pf_state *, int);
256 static void pf_detach_state(struct pf_state *, int);
257 static u_int32_t pf_tcp_iss(struct pf_pdesc *);
258 static int pf_test_rule(struct pf_rule **, struct pf_state **,
259 int, struct pfi_kif *, struct mbuf *, int,
260 void *, struct pf_pdesc *, struct pf_rule **,
261 struct pf_ruleset **, struct ifqueue *);
262 #if DUMMYNET
263 static int pf_test_dummynet(struct pf_rule **, int,
264 struct pfi_kif *, struct mbuf **,
265 struct pf_pdesc *, struct ip_fw_args *);
266 #endif /* DUMMYNET */
267 static int pf_test_fragment(struct pf_rule **, int,
268 struct pfi_kif *, struct mbuf *, void *,
269 struct pf_pdesc *, struct pf_rule **,
270 struct pf_ruleset **);
271 static int pf_test_state_tcp(struct pf_state **, int,
272 struct pfi_kif *, struct mbuf *, int,
273 void *, struct pf_pdesc *, u_short *);
274 static int pf_test_state_udp(struct pf_state **, int,
275 struct pfi_kif *, struct mbuf *, int,
276 void *, struct pf_pdesc *, u_short *);
277 static int pf_test_state_icmp(struct pf_state **, int,
278 struct pfi_kif *, struct mbuf *, int,
279 void *, struct pf_pdesc *, u_short *);
280 static int pf_test_state_other(struct pf_state **, int,
281 struct pfi_kif *, struct pf_pdesc *);
282 static int pf_match_tag(struct mbuf *, struct pf_rule *,
283 struct pf_mtag *, int *);
284 static void pf_hash(struct pf_addr *, struct pf_addr *,
285 struct pf_poolhashkey *, sa_family_t);
286 static int pf_map_addr(u_int8_t, struct pf_rule *,
287 struct pf_addr *, struct pf_addr *,
288 struct pf_addr *, struct pf_src_node **);
289 static int pf_get_sport(struct pf_pdesc *, struct pfi_kif *,
290 struct pf_rule *, struct pf_addr *,
291 union pf_state_xport *, struct pf_addr *,
292 union pf_state_xport *, struct pf_addr *,
293 union pf_state_xport *, struct pf_src_node **);
294 static void pf_route(struct mbuf **, struct pf_rule *, int,
295 struct ifnet *, struct pf_state *,
296 struct pf_pdesc *);
297 #if INET6
298 static void pf_route6(struct mbuf **, struct pf_rule *, int,
299 struct ifnet *, struct pf_state *,
300 struct pf_pdesc *);
301 #endif /* INET6 */
302 static u_int8_t pf_get_wscale(struct mbuf *, int, u_int16_t,
303 sa_family_t);
304 static u_int16_t pf_get_mss(struct mbuf *, int, u_int16_t,
305 sa_family_t);
306 static u_int16_t pf_calc_mss(struct pf_addr *, sa_family_t,
307 u_int16_t);
308 static void pf_set_rt_ifp(struct pf_state *,
309 struct pf_addr *, sa_family_t af);
310 static int pf_check_proto_cksum(struct mbuf *, int, int,
311 u_int8_t, sa_family_t);
312 static int pf_addr_wrap_neq(struct pf_addr_wrap *,
313 struct pf_addr_wrap *);
314 static struct pf_state *pf_find_state(struct pfi_kif *,
315 struct pf_state_key_cmp *, u_int);
316 static int pf_src_connlimit(struct pf_state **);
317 static void pf_stateins_err(const char *, struct pf_state *,
318 struct pfi_kif *);
319 static int pf_check_congestion(struct ifqueue *);
320
321 #if 0
322 static const char *pf_pptp_ctrl_type_name(u_int16_t code);
323 #endif
324 static void pf_pptp_handler(struct pf_state *, int, int,
325 struct pf_pdesc *, struct pfi_kif *);
326 static void pf_pptp_unlink(struct pf_state *);
327 static void pf_grev1_unlink(struct pf_state *);
328 static int pf_test_state_grev1(struct pf_state **, int,
329 struct pfi_kif *, int, struct pf_pdesc *);
330 static int pf_ike_compare(struct pf_app_state *,
331 struct pf_app_state *);
332 static int pf_test_state_esp(struct pf_state **, int,
333 struct pfi_kif *, int, struct pf_pdesc *);
334
335 extern struct pool pfr_ktable_pl;
336 extern struct pool pfr_kentry_pl;
337 extern int path_mtu_discovery;
338
339 struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX] = {
340 { &pf_state_pl, PFSTATE_HIWAT },
341 { &pf_app_state_pl, PFAPPSTATE_HIWAT },
342 { &pf_src_tree_pl, PFSNODE_HIWAT },
343 { &pf_frent_pl, PFFRAG_FRENT_HIWAT },
344 { &pfr_ktable_pl, PFR_KTABLE_HIWAT },
345 { &pfr_kentry_pl, PFR_KENTRY_HIWAT },
346 };
347
348 struct mbuf *
349 pf_lazy_makewritable(struct pf_pdesc *pd, struct mbuf *m, int len)
350 {
351 if (pd->lmw < 0)
352 return (0);
353
354 VERIFY(m == pd->mp);
355
356 if (len > pd->lmw) {
357 if (m_makewritable(&m, 0, len, M_DONTWAIT))
358 len = -1;
359 pd->lmw = len;
360 if (len >= 0 && m != pd->mp) {
361 pd->mp = m;
362 pd->pf_mtag = pf_find_mtag(m);
363
364 switch (pd->af) {
365 case AF_INET: {
366 struct ip *h = mtod(m, struct ip *);
367 pd->src = (struct pf_addr *)&h->ip_src;
368 pd->dst = (struct pf_addr *)&h->ip_dst;
369 pd->ip_sum = &h->ip_sum;
370 break;
371 }
372 #if INET6
373 case AF_INET6: {
374 struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
375 pd->src = (struct pf_addr *)&h->ip6_src;
376 pd->dst = (struct pf_addr *)&h->ip6_dst;
377 break;
378 }
379 #endif /* INET6 */
380 }
381 }
382 }
383
384 return (len < 0 ? 0 : m);
385 }
386
387 static const int *
388 pf_state_lookup_aux(struct pf_state **state, struct pfi_kif *kif,
389 int direction, int *action)
390 {
391 if (*state == NULL || (*state)->timeout == PFTM_PURGE) {
392 *action = PF_DROP;
393 return (action);
394 }
395
396 if (direction == PF_OUT &&
397 (((*state)->rule.ptr->rt == PF_ROUTETO &&
398 (*state)->rule.ptr->direction == PF_OUT) ||
399 ((*state)->rule.ptr->rt == PF_REPLYTO &&
400 (*state)->rule.ptr->direction == PF_IN)) &&
401 (*state)->rt_kif != NULL && (*state)->rt_kif != kif) {
402 *action = PF_PASS;
403 return (action);
404 }
405
406 return (0);
407 }
408
409 #define STATE_LOOKUP() \
410 do { \
411 int action; \
412 *state = pf_find_state(kif, &key, direction); \
413 if (*state != NULL && pd != NULL && \
414 !(pd->pktflags & PKTF_FLOW_ID)) { \
415 pd->flowsrc = (*state)->state_key->flowsrc; \
416 pd->flowhash = (*state)->state_key->flowhash; \
417 if (pd->flowhash != 0) { \
418 pd->pktflags |= PKTF_FLOW_ID; \
419 pd->pktflags &= ~PKTF_FLOW_ADV; \
420 } \
421 } \
422 if (pf_state_lookup_aux(state, kif, direction, &action)) \
423 return (action); \
424 } while (0)
425
426 #define STATE_ADDR_TRANSLATE(sk) \
427 (sk)->lan.addr.addr32[0] != (sk)->gwy.addr.addr32[0] || \
428 ((sk)->af_lan == AF_INET6 && \
429 ((sk)->lan.addr.addr32[1] != (sk)->gwy.addr.addr32[1] || \
430 (sk)->lan.addr.addr32[2] != (sk)->gwy.addr.addr32[2] || \
431 (sk)->lan.addr.addr32[3] != (sk)->gwy.addr.addr32[3]))
432
433 #define STATE_TRANSLATE(sk) \
434 ((sk)->af_lan != (sk)->af_gwy || \
435 STATE_ADDR_TRANSLATE(sk) || \
436 (sk)->lan.xport.port != (sk)->gwy.xport.port)
437
438 #define STATE_GRE_TRANSLATE(sk) \
439 (STATE_ADDR_TRANSLATE(sk) || \
440 (sk)->lan.xport.call_id != (sk)->gwy.xport.call_id)
441
442 #define BOUND_IFACE(r, k) \
443 ((r)->rule_flag & PFRULE_IFBOUND) ? (k) : pfi_all
444
445 #define STATE_INC_COUNTERS(s) \
446 do { \
447 s->rule.ptr->states++; \
448 VERIFY(s->rule.ptr->states != 0); \
449 if (s->anchor.ptr != NULL) { \
450 s->anchor.ptr->states++; \
451 VERIFY(s->anchor.ptr->states != 0); \
452 } \
453 if (s->nat_rule.ptr != NULL) { \
454 s->nat_rule.ptr->states++; \
455 VERIFY(s->nat_rule.ptr->states != 0); \
456 } \
457 } while (0)
458
459 #define STATE_DEC_COUNTERS(s) \
460 do { \
461 if (s->nat_rule.ptr != NULL) { \
462 VERIFY(s->nat_rule.ptr->states > 0); \
463 s->nat_rule.ptr->states--; \
464 } \
465 if (s->anchor.ptr != NULL) { \
466 VERIFY(s->anchor.ptr->states > 0); \
467 s->anchor.ptr->states--; \
468 } \
469 VERIFY(s->rule.ptr->states > 0); \
470 s->rule.ptr->states--; \
471 } while (0)
472
473 static __inline int pf_src_compare(struct pf_src_node *, struct pf_src_node *);
474 static __inline int pf_state_compare_lan_ext(struct pf_state_key *,
475 struct pf_state_key *);
476 static __inline int pf_state_compare_ext_gwy(struct pf_state_key *,
477 struct pf_state_key *);
478 static __inline int pf_state_compare_id(struct pf_state *,
479 struct pf_state *);
480
481 struct pf_src_tree tree_src_tracking;
482
483 struct pf_state_tree_id tree_id;
484 struct pf_state_queue state_list;
485
486 RB_GENERATE(pf_src_tree, pf_src_node, entry, pf_src_compare);
487 RB_GENERATE(pf_state_tree_lan_ext, pf_state_key,
488 entry_lan_ext, pf_state_compare_lan_ext);
489 RB_GENERATE(pf_state_tree_ext_gwy, pf_state_key,
490 entry_ext_gwy, pf_state_compare_ext_gwy);
491 RB_GENERATE(pf_state_tree_id, pf_state,
492 entry_id, pf_state_compare_id);
493
494 #define PF_DT_SKIP_LANEXT 0x01
495 #define PF_DT_SKIP_EXTGWY 0x02
496
497 static const u_int16_t PF_PPTP_PORT = 1723;
498 static const u_int32_t PF_PPTP_MAGIC_NUMBER = 0x1A2B3C4D;
499
500 struct pf_pptp_hdr {
501 u_int16_t length;
502 u_int16_t type;
503 u_int32_t magic;
504 };
505
506 struct pf_pptp_ctrl_hdr {
507 u_int16_t type;
508 u_int16_t reserved_0;
509 };
510
511 struct pf_pptp_ctrl_generic {
512 u_int16_t data[0];
513 };
514
515 #define PF_PPTP_CTRL_TYPE_START_REQ 1
516 struct pf_pptp_ctrl_start_req {
517 u_int16_t protocol_version;
518 u_int16_t reserved_1;
519 u_int32_t framing_capabilities;
520 u_int32_t bearer_capabilities;
521 u_int16_t maximum_channels;
522 u_int16_t firmware_revision;
523 u_int8_t host_name[64];
524 u_int8_t vendor_string[64];
525 };
526
527 #define PF_PPTP_CTRL_TYPE_START_RPY 2
528 struct pf_pptp_ctrl_start_rpy {
529 u_int16_t protocol_version;
530 u_int8_t result_code;
531 u_int8_t error_code;
532 u_int32_t framing_capabilities;
533 u_int32_t bearer_capabilities;
534 u_int16_t maximum_channels;
535 u_int16_t firmware_revision;
536 u_int8_t host_name[64];
537 u_int8_t vendor_string[64];
538 };
539
540 #define PF_PPTP_CTRL_TYPE_STOP_REQ 3
541 struct pf_pptp_ctrl_stop_req {
542 u_int8_t reason;
543 u_int8_t reserved_1;
544 u_int16_t reserved_2;
545 };
546
547 #define PF_PPTP_CTRL_TYPE_STOP_RPY 4
548 struct pf_pptp_ctrl_stop_rpy {
549 u_int8_t reason;
550 u_int8_t error_code;
551 u_int16_t reserved_1;
552 };
553
554 #define PF_PPTP_CTRL_TYPE_ECHO_REQ 5
555 struct pf_pptp_ctrl_echo_req {
556 u_int32_t identifier;
557 };
558
559 #define PF_PPTP_CTRL_TYPE_ECHO_RPY 6
560 struct pf_pptp_ctrl_echo_rpy {
561 u_int32_t identifier;
562 u_int8_t result_code;
563 u_int8_t error_code;
564 u_int16_t reserved_1;
565 };
566
567 #define PF_PPTP_CTRL_TYPE_CALL_OUT_REQ 7
568 struct pf_pptp_ctrl_call_out_req {
569 u_int16_t call_id;
570 u_int16_t call_sernum;
571 u_int32_t min_bps;
572 u_int32_t bearer_type;
573 u_int32_t framing_type;
574 u_int16_t rxwindow_size;
575 u_int16_t proc_delay;
576 u_int8_t phone_num[64];
577 u_int8_t sub_addr[64];
578 };
579
580 #define PF_PPTP_CTRL_TYPE_CALL_OUT_RPY 8
581 struct pf_pptp_ctrl_call_out_rpy {
582 u_int16_t call_id;
583 u_int16_t peer_call_id;
584 u_int8_t result_code;
585 u_int8_t error_code;
586 u_int16_t cause_code;
587 u_int32_t connect_speed;
588 u_int16_t rxwindow_size;
589 u_int16_t proc_delay;
590 u_int32_t phy_channel_id;
591 };
592
593 #define PF_PPTP_CTRL_TYPE_CALL_IN_1ST 9
594 struct pf_pptp_ctrl_call_in_1st {
595 u_int16_t call_id;
596 u_int16_t call_sernum;
597 u_int32_t bearer_type;
598 u_int32_t phy_channel_id;
599 u_int16_t dialed_number_len;
600 u_int16_t dialing_number_len;
601 u_int8_t dialed_num[64];
602 u_int8_t dialing_num[64];
603 u_int8_t sub_addr[64];
604 };
605
606 #define PF_PPTP_CTRL_TYPE_CALL_IN_2ND 10
607 struct pf_pptp_ctrl_call_in_2nd {
608 u_int16_t call_id;
609 u_int16_t peer_call_id;
610 u_int8_t result_code;
611 u_int8_t error_code;
612 u_int16_t rxwindow_size;
613 u_int16_t txdelay;
614 u_int16_t reserved_1;
615 };
616
617 #define PF_PPTP_CTRL_TYPE_CALL_IN_3RD 11
618 struct pf_pptp_ctrl_call_in_3rd {
619 u_int16_t call_id;
620 u_int16_t reserved_1;
621 u_int32_t connect_speed;
622 u_int16_t rxwindow_size;
623 u_int16_t txdelay;
624 u_int32_t framing_type;
625 };
626
627 #define PF_PPTP_CTRL_TYPE_CALL_CLR 12
628 struct pf_pptp_ctrl_call_clr {
629 u_int16_t call_id;
630 u_int16_t reserved_1;
631 };
632
633 #define PF_PPTP_CTRL_TYPE_CALL_DISC 13
634 struct pf_pptp_ctrl_call_disc {
635 u_int16_t call_id;
636 u_int8_t result_code;
637 u_int8_t error_code;
638 u_int16_t cause_code;
639 u_int16_t reserved_1;
640 u_int8_t statistics[128];
641 };
642
643 #define PF_PPTP_CTRL_TYPE_ERROR 14
644 struct pf_pptp_ctrl_error {
645 u_int16_t peer_call_id;
646 u_int16_t reserved_1;
647 u_int32_t crc_errors;
648 u_int32_t fr_errors;
649 u_int32_t hw_errors;
650 u_int32_t buf_errors;
651 u_int32_t tim_errors;
652 u_int32_t align_errors;
653 };
654
655 #define PF_PPTP_CTRL_TYPE_SET_LINKINFO 15
656 struct pf_pptp_ctrl_set_linkinfo {
657 u_int16_t peer_call_id;
658 u_int16_t reserved_1;
659 u_int32_t tx_accm;
660 u_int32_t rx_accm;
661 };
662
663 #if 0
664 static const char *pf_pptp_ctrl_type_name(u_int16_t code)
665 {
666 code = ntohs(code);
667
668 if (code < PF_PPTP_CTRL_TYPE_START_REQ ||
669 code > PF_PPTP_CTRL_TYPE_SET_LINKINFO) {
670 static char reserved[] = "reserved-00";
671
672 sprintf(&reserved[9], "%02x", code);
673 return (reserved);
674 } else {
675 static const char *name[] = {
676 "start_req", "start_rpy", "stop_req", "stop_rpy",
677 "echo_req", "echo_rpy", "call_out_req", "call_out_rpy",
678 "call_in_1st", "call_in_2nd", "call_in_3rd",
679 "call_clr", "call_disc", "error", "set_linkinfo"
680 };
681
682 return (name[code - 1]);
683 }
684 };
685 #endif
686
687 static const size_t PF_PPTP_CTRL_MSG_MINSIZE =
688 sizeof (struct pf_pptp_hdr) + sizeof (struct pf_pptp_ctrl_hdr);
689
690 union pf_pptp_ctrl_msg_union {
691 struct pf_pptp_ctrl_start_req start_req;
692 struct pf_pptp_ctrl_start_rpy start_rpy;
693 struct pf_pptp_ctrl_stop_req stop_req;
694 struct pf_pptp_ctrl_stop_rpy stop_rpy;
695 struct pf_pptp_ctrl_echo_req echo_req;
696 struct pf_pptp_ctrl_echo_rpy echo_rpy;
697 struct pf_pptp_ctrl_call_out_req call_out_req;
698 struct pf_pptp_ctrl_call_out_rpy call_out_rpy;
699 struct pf_pptp_ctrl_call_in_1st call_in_1st;
700 struct pf_pptp_ctrl_call_in_2nd call_in_2nd;
701 struct pf_pptp_ctrl_call_in_3rd call_in_3rd;
702 struct pf_pptp_ctrl_call_clr call_clr;
703 struct pf_pptp_ctrl_call_disc call_disc;
704 struct pf_pptp_ctrl_error error;
705 struct pf_pptp_ctrl_set_linkinfo set_linkinfo;
706 u_int8_t data[0];
707 };
708
709 struct pf_pptp_ctrl_msg {
710 struct pf_pptp_hdr hdr;
711 struct pf_pptp_ctrl_hdr ctrl;
712 union pf_pptp_ctrl_msg_union msg;
713 };
714
715 #define PF_GRE_FLAG_CHECKSUM_PRESENT 0x8000
716 #define PF_GRE_FLAG_VERSION_MASK 0x0007
717 #define PF_GRE_PPP_ETHERTYPE 0x880B
718
719 struct pf_grev1_hdr {
720 u_int16_t flags;
721 u_int16_t protocol_type;
722 u_int16_t payload_length;
723 u_int16_t call_id;
724 /*
725 u_int32_t seqno;
726 u_int32_t ackno;
727 */
728 };
729
730 static const u_int16_t PF_IKE_PORT = 500;
731
732 struct pf_ike_hdr {
733 u_int64_t initiator_cookie, responder_cookie;
734 u_int8_t next_payload, version, exchange_type, flags;
735 u_int32_t message_id, length;
736 };
737
738 #define PF_IKE_PACKET_MINSIZE (sizeof (struct pf_ike_hdr))
739
740 #define PF_IKEv1_EXCHTYPE_BASE 1
741 #define PF_IKEv1_EXCHTYPE_ID_PROTECT 2
742 #define PF_IKEv1_EXCHTYPE_AUTH_ONLY 3
743 #define PF_IKEv1_EXCHTYPE_AGGRESSIVE 4
744 #define PF_IKEv1_EXCHTYPE_INFORMATIONAL 5
745 #define PF_IKEv2_EXCHTYPE_SA_INIT 34
746 #define PF_IKEv2_EXCHTYPE_AUTH 35
747 #define PF_IKEv2_EXCHTYPE_CREATE_CHILD_SA 36
748 #define PF_IKEv2_EXCHTYPE_INFORMATIONAL 37
749
750 #define PF_IKEv1_FLAG_E 0x01
751 #define PF_IKEv1_FLAG_C 0x02
752 #define PF_IKEv1_FLAG_A 0x04
753 #define PF_IKEv2_FLAG_I 0x08
754 #define PF_IKEv2_FLAG_V 0x10
755 #define PF_IKEv2_FLAG_R 0x20
756
757 struct pf_esp_hdr {
758 u_int32_t spi;
759 u_int32_t seqno;
760 u_int8_t payload[];
761 };
762
763 static __inline int
764 pf_addr_compare(struct pf_addr *a, struct pf_addr *b, sa_family_t af)
765 {
766 switch (af) {
767 #ifdef INET
768 case AF_INET:
769 if (a->addr32[0] > b->addr32[0])
770 return (1);
771 if (a->addr32[0] < b->addr32[0])
772 return (-1);
773 break;
774 #endif /* INET */
775 #ifdef INET6
776 case AF_INET6:
777 if (a->addr32[3] > b->addr32[3])
778 return (1);
779 if (a->addr32[3] < b->addr32[3])
780 return (-1);
781 if (a->addr32[2] > b->addr32[2])
782 return (1);
783 if (a->addr32[2] < b->addr32[2])
784 return (-1);
785 if (a->addr32[1] > b->addr32[1])
786 return (1);
787 if (a->addr32[1] < b->addr32[1])
788 return (-1);
789 if (a->addr32[0] > b->addr32[0])
790 return (1);
791 if (a->addr32[0] < b->addr32[0])
792 return (-1);
793 break;
794 #endif /* INET6 */
795 }
796 return (0);
797 }
798
799 static __inline int
800 pf_src_compare(struct pf_src_node *a, struct pf_src_node *b)
801 {
802 int diff;
803
804 if (a->rule.ptr > b->rule.ptr)
805 return (1);
806 if (a->rule.ptr < b->rule.ptr)
807 return (-1);
808 if ((diff = a->af - b->af) != 0)
809 return (diff);
810 if ((diff = pf_addr_compare(&a->addr, &b->addr, a->af)) != 0)
811 return (diff);
812 return (0);
813 }
814
815 static __inline int
816 pf_state_compare_lan_ext(struct pf_state_key *a, struct pf_state_key *b)
817 {
818 int diff;
819 int extfilter;
820
821 if ((diff = a->proto - b->proto) != 0)
822 return (diff);
823 if ((diff = a->af_lan - b->af_lan) != 0)
824 return (diff);
825
826 extfilter = PF_EXTFILTER_APD;
827
828 switch (a->proto) {
829 case IPPROTO_ICMP:
830 case IPPROTO_ICMPV6:
831 if ((diff = a->lan.xport.port - b->lan.xport.port) != 0)
832 return (diff);
833 break;
834
835 case IPPROTO_TCP:
836 if ((diff = a->lan.xport.port - b->lan.xport.port) != 0)
837 return (diff);
838 if ((diff = a->ext_lan.xport.port - b->ext_lan.xport.port) != 0)
839 return (diff);
840 break;
841
842 case IPPROTO_UDP:
843 if ((diff = a->proto_variant - b->proto_variant))
844 return (diff);
845 extfilter = a->proto_variant;
846 if ((diff = a->lan.xport.port - b->lan.xport.port) != 0)
847 return (diff);
848 if ((extfilter < PF_EXTFILTER_AD) &&
849 (diff = a->ext_lan.xport.port - b->ext_lan.xport.port) != 0)
850 return (diff);
851 break;
852
853 case IPPROTO_GRE:
854 if (a->proto_variant == PF_GRE_PPTP_VARIANT &&
855 a->proto_variant == b->proto_variant) {
856 if (!!(diff = a->ext_lan.xport.call_id -
857 b->ext_lan.xport.call_id))
858 return (diff);
859 }
860 break;
861
862 case IPPROTO_ESP:
863 if (!!(diff = a->ext_lan.xport.spi - b->ext_lan.xport.spi))
864 return (diff);
865 break;
866
867 default:
868 break;
869 }
870
871 switch (a->af_lan) {
872 #if INET
873 case AF_INET:
874 if ((diff = pf_addr_compare(&a->lan.addr, &b->lan.addr,
875 a->af_lan)) != 0)
876 return (diff);
877
878 if (extfilter < PF_EXTFILTER_EI) {
879 if ((diff = pf_addr_compare(&a->ext_lan.addr,
880 &b->ext_lan.addr,
881 a->af_lan)) != 0)
882 return (diff);
883 }
884 break;
885 #endif /* INET */
886 #if INET6
887 case AF_INET6:
888 if ((diff = pf_addr_compare(&a->lan.addr, &b->lan.addr,
889 a->af_lan)) != 0)
890 return (diff);
891
892 if (extfilter < PF_EXTFILTER_EI ||
893 !PF_AZERO(&b->ext_lan.addr, AF_INET6)) {
894 if ((diff = pf_addr_compare(&a->ext_lan.addr,
895 &b->ext_lan.addr,
896 a->af_lan)) != 0)
897 return (diff);
898 }
899 break;
900 #endif /* INET6 */
901 }
902
903 if (a->app_state && b->app_state) {
904 if (a->app_state->compare_lan_ext &&
905 b->app_state->compare_lan_ext) {
906 diff = (const char *)b->app_state->compare_lan_ext -
907 (const char *)a->app_state->compare_lan_ext;
908 if (diff != 0)
909 return (diff);
910 diff = a->app_state->compare_lan_ext(a->app_state,
911 b->app_state);
912 if (diff != 0)
913 return (diff);
914 }
915 }
916
917 return (0);
918 }
919
920 static __inline int
921 pf_state_compare_ext_gwy(struct pf_state_key *a, struct pf_state_key *b)
922 {
923 int diff;
924 int extfilter;
925
926 if ((diff = a->proto - b->proto) != 0)
927 return (diff);
928
929 if ((diff = a->af_gwy - b->af_gwy) != 0)
930 return (diff);
931
932 extfilter = PF_EXTFILTER_APD;
933
934 switch (a->proto) {
935 case IPPROTO_ICMP:
936 case IPPROTO_ICMPV6:
937 if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0)
938 return (diff);
939 break;
940
941 case IPPROTO_TCP:
942 if ((diff = a->ext_gwy.xport.port - b->ext_gwy.xport.port) != 0)
943 return (diff);
944 if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0)
945 return (diff);
946 break;
947
948 case IPPROTO_UDP:
949 if ((diff = a->proto_variant - b->proto_variant))
950 return (diff);
951 extfilter = a->proto_variant;
952 if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0)
953 return (diff);
954 if ((extfilter < PF_EXTFILTER_AD) &&
955 (diff = a->ext_gwy.xport.port - b->ext_gwy.xport.port) != 0)
956 return (diff);
957 break;
958
959 case IPPROTO_GRE:
960 if (a->proto_variant == PF_GRE_PPTP_VARIANT &&
961 a->proto_variant == b->proto_variant) {
962 if (!!(diff = a->gwy.xport.call_id -
963 b->gwy.xport.call_id))
964 return (diff);
965 }
966 break;
967
968 case IPPROTO_ESP:
969 if (!!(diff = a->gwy.xport.spi - b->gwy.xport.spi))
970 return (diff);
971 break;
972
973 default:
974 break;
975 }
976
977 switch (a->af_gwy) {
978 #if INET
979 case AF_INET:
980 if ((diff = pf_addr_compare(&a->gwy.addr, &b->gwy.addr,
981 a->af_gwy)) != 0)
982 return (diff);
983
984 if (extfilter < PF_EXTFILTER_EI) {
985 if ((diff = pf_addr_compare(&a->ext_gwy.addr, &b->ext_gwy.addr,
986 a->af_gwy)) != 0)
987 return (diff);
988 }
989 break;
990 #endif /* INET */
991 #if INET6
992 case AF_INET6:
993 if ((diff = pf_addr_compare(&a->gwy.addr, &b->gwy.addr,
994 a->af_gwy)) != 0)
995 return (diff);
996
997 if (extfilter < PF_EXTFILTER_EI ||
998 !PF_AZERO(&b->ext_gwy.addr, AF_INET6)) {
999 if ((diff = pf_addr_compare(&a->ext_gwy.addr, &b->ext_gwy.addr,
1000 a->af_gwy)) != 0)
1001 return (diff);
1002 }
1003 break;
1004 #endif /* INET6 */
1005 }
1006
1007 if (a->app_state && b->app_state) {
1008 if (a->app_state->compare_ext_gwy &&
1009 b->app_state->compare_ext_gwy) {
1010 diff = (const char *)b->app_state->compare_ext_gwy -
1011 (const char *)a->app_state->compare_ext_gwy;
1012 if (diff != 0)
1013 return (diff);
1014 diff = a->app_state->compare_ext_gwy(a->app_state,
1015 b->app_state);
1016 if (diff != 0)
1017 return (diff);
1018 }
1019 }
1020
1021 return (0);
1022 }
1023
1024 static __inline int
1025 pf_state_compare_id(struct pf_state *a, struct pf_state *b)
1026 {
1027 if (a->id > b->id)
1028 return (1);
1029 if (a->id < b->id)
1030 return (-1);
1031 if (a->creatorid > b->creatorid)
1032 return (1);
1033 if (a->creatorid < b->creatorid)
1034 return (-1);
1035
1036 return (0);
1037 }
1038
1039 #if INET6
1040 void
1041 pf_addrcpy(struct pf_addr *dst, struct pf_addr *src, sa_family_t af)
1042 {
1043 switch (af) {
1044 #if INET
1045 case AF_INET:
1046 dst->addr32[0] = src->addr32[0];
1047 break;
1048 #endif /* INET */
1049 case AF_INET6:
1050 dst->addr32[0] = src->addr32[0];
1051 dst->addr32[1] = src->addr32[1];
1052 dst->addr32[2] = src->addr32[2];
1053 dst->addr32[3] = src->addr32[3];
1054 break;
1055 }
1056 }
1057 #endif /* INET6 */
1058
1059 struct pf_state *
1060 pf_find_state_byid(struct pf_state_cmp *key)
1061 {
1062 pf_status.fcounters[FCNT_STATE_SEARCH]++;
1063
1064 return (RB_FIND(pf_state_tree_id, &tree_id,
1065 (struct pf_state *)(void *)key));
1066 }
1067
1068 static struct pf_state *
1069 pf_find_state(struct pfi_kif *kif, struct pf_state_key_cmp *key, u_int dir)
1070 {
1071 struct pf_state_key *sk = NULL;
1072 struct pf_state *s;
1073
1074 pf_status.fcounters[FCNT_STATE_SEARCH]++;
1075
1076 switch (dir) {
1077 case PF_OUT:
1078 sk = RB_FIND(pf_state_tree_lan_ext, &pf_statetbl_lan_ext,
1079 (struct pf_state_key *)key);
1080 break;
1081 case PF_IN:
1082 sk = RB_FIND(pf_state_tree_ext_gwy, &pf_statetbl_ext_gwy,
1083 (struct pf_state_key *)key);
1084 /*
1085 * NAT64 is done only on input, for packets coming in from
1086 * from the LAN side, need to lookup the lan_ext tree.
1087 */
1088 if (sk == NULL) {
1089 sk = RB_FIND(pf_state_tree_lan_ext,
1090 &pf_statetbl_lan_ext,
1091 (struct pf_state_key *)key);
1092 if (sk && sk->af_lan == sk->af_gwy)
1093 sk = NULL;
1094 }
1095 break;
1096 default:
1097 panic("pf_find_state");
1098 }
1099
1100 /* list is sorted, if-bound states before floating ones */
1101 if (sk != NULL)
1102 TAILQ_FOREACH(s, &sk->states, next)
1103 if (s->kif == pfi_all || s->kif == kif)
1104 return (s);
1105
1106 return (NULL);
1107 }
1108
1109 struct pf_state *
1110 pf_find_state_all(struct pf_state_key_cmp *key, u_int dir, int *more)
1111 {
1112 struct pf_state_key *sk = NULL;
1113 struct pf_state *s, *ret = NULL;
1114
1115 pf_status.fcounters[FCNT_STATE_SEARCH]++;
1116
1117 switch (dir) {
1118 case PF_OUT:
1119 sk = RB_FIND(pf_state_tree_lan_ext,
1120 &pf_statetbl_lan_ext, (struct pf_state_key *)key);
1121 break;
1122 case PF_IN:
1123 sk = RB_FIND(pf_state_tree_ext_gwy,
1124 &pf_statetbl_ext_gwy, (struct pf_state_key *)key);
1125 /*
1126 * NAT64 is done only on input, for packets coming in from
1127 * from the LAN side, need to lookup the lan_ext tree.
1128 */
1129 if ((sk == NULL) && pf_nat64_configured) {
1130 sk = RB_FIND(pf_state_tree_lan_ext,
1131 &pf_statetbl_lan_ext,
1132 (struct pf_state_key *)key);
1133 if (sk && sk->af_lan == sk->af_gwy)
1134 sk = NULL;
1135 }
1136 break;
1137 default:
1138 panic("pf_find_state_all");
1139 }
1140
1141 if (sk != NULL) {
1142 ret = TAILQ_FIRST(&sk->states);
1143 if (more == NULL)
1144 return (ret);
1145
1146 TAILQ_FOREACH(s, &sk->states, next)
1147 (*more)++;
1148 }
1149
1150 return (ret);
1151 }
1152
1153 static void
1154 pf_init_threshold(struct pf_threshold *threshold,
1155 u_int32_t limit, u_int32_t seconds)
1156 {
1157 threshold->limit = limit * PF_THRESHOLD_MULT;
1158 threshold->seconds = seconds;
1159 threshold->count = 0;
1160 threshold->last = pf_time_second();
1161 }
1162
1163 static void
1164 pf_add_threshold(struct pf_threshold *threshold)
1165 {
1166 u_int32_t t = pf_time_second(), diff = t - threshold->last;
1167
1168 if (diff >= threshold->seconds)
1169 threshold->count = 0;
1170 else
1171 threshold->count -= threshold->count * diff /
1172 threshold->seconds;
1173 threshold->count += PF_THRESHOLD_MULT;
1174 threshold->last = t;
1175 }
1176
1177 static int
1178 pf_check_threshold(struct pf_threshold *threshold)
1179 {
1180 return (threshold->count > threshold->limit);
1181 }
1182
1183 static int
1184 pf_src_connlimit(struct pf_state **state)
1185 {
1186 int bad = 0;
1187 (*state)->src_node->conn++;
1188 VERIFY((*state)->src_node->conn != 0);
1189 (*state)->src.tcp_est = 1;
1190 pf_add_threshold(&(*state)->src_node->conn_rate);
1191
1192 if ((*state)->rule.ptr->max_src_conn &&
1193 (*state)->rule.ptr->max_src_conn <
1194 (*state)->src_node->conn) {
1195 pf_status.lcounters[LCNT_SRCCONN]++;
1196 bad++;
1197 }
1198
1199 if ((*state)->rule.ptr->max_src_conn_rate.limit &&
1200 pf_check_threshold(&(*state)->src_node->conn_rate)) {
1201 pf_status.lcounters[LCNT_SRCCONNRATE]++;
1202 bad++;
1203 }
1204
1205 if (!bad)
1206 return (0);
1207
1208 if ((*state)->rule.ptr->overload_tbl) {
1209 struct pfr_addr p;
1210 u_int32_t killed = 0;
1211
1212 pf_status.lcounters[LCNT_OVERLOAD_TABLE]++;
1213 if (pf_status.debug >= PF_DEBUG_MISC) {
1214 printf("pf_src_connlimit: blocking address ");
1215 pf_print_host(&(*state)->src_node->addr, 0,
1216 (*state)->state_key->af_lan);
1217 }
1218
1219 bzero(&p, sizeof (p));
1220 p.pfra_af = (*state)->state_key->af_lan;
1221 switch ((*state)->state_key->af_lan) {
1222 #if INET
1223 case AF_INET:
1224 p.pfra_net = 32;
1225 p.pfra_ip4addr = (*state)->src_node->addr.v4;
1226 break;
1227 #endif /* INET */
1228 #if INET6
1229 case AF_INET6:
1230 p.pfra_net = 128;
1231 p.pfra_ip6addr = (*state)->src_node->addr.v6;
1232 break;
1233 #endif /* INET6 */
1234 }
1235
1236 pfr_insert_kentry((*state)->rule.ptr->overload_tbl,
1237 &p, pf_calendar_time_second());
1238
1239 /* kill existing states if that's required. */
1240 if ((*state)->rule.ptr->flush) {
1241 struct pf_state_key *sk;
1242 struct pf_state *st;
1243
1244 pf_status.lcounters[LCNT_OVERLOAD_FLUSH]++;
1245 RB_FOREACH(st, pf_state_tree_id, &tree_id) {
1246 sk = st->state_key;
1247 /*
1248 * Kill states from this source. (Only those
1249 * from the same rule if PF_FLUSH_GLOBAL is not
1250 * set)
1251 */
1252 if (sk->af_lan ==
1253 (*state)->state_key->af_lan &&
1254 (((*state)->state_key->direction ==
1255 PF_OUT &&
1256 PF_AEQ(&(*state)->src_node->addr,
1257 &sk->lan.addr, sk->af_lan)) ||
1258 ((*state)->state_key->direction == PF_IN &&
1259 PF_AEQ(&(*state)->src_node->addr,
1260 &sk->ext_lan.addr, sk->af_lan))) &&
1261 ((*state)->rule.ptr->flush &
1262 PF_FLUSH_GLOBAL ||
1263 (*state)->rule.ptr == st->rule.ptr)) {
1264 st->timeout = PFTM_PURGE;
1265 st->src.state = st->dst.state =
1266 TCPS_CLOSED;
1267 killed++;
1268 }
1269 }
1270 if (pf_status.debug >= PF_DEBUG_MISC)
1271 printf(", %u states killed", killed);
1272 }
1273 if (pf_status.debug >= PF_DEBUG_MISC)
1274 printf("\n");
1275 }
1276
1277 /* kill this state */
1278 (*state)->timeout = PFTM_PURGE;
1279 (*state)->src.state = (*state)->dst.state = TCPS_CLOSED;
1280 return (1);
1281 }
1282
1283 int
1284 pf_insert_src_node(struct pf_src_node **sn, struct pf_rule *rule,
1285 struct pf_addr *src, sa_family_t af)
1286 {
1287 struct pf_src_node k;
1288
1289 if (*sn == NULL) {
1290 k.af = af;
1291 PF_ACPY(&k.addr, src, af);
1292 if (rule->rule_flag & PFRULE_RULESRCTRACK ||
1293 rule->rpool.opts & PF_POOL_STICKYADDR)
1294 k.rule.ptr = rule;
1295 else
1296 k.rule.ptr = NULL;
1297 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
1298 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k);
1299 }
1300 if (*sn == NULL) {
1301 if (!rule->max_src_nodes ||
1302 rule->src_nodes < rule->max_src_nodes)
1303 (*sn) = pool_get(&pf_src_tree_pl, PR_WAITOK);
1304 else
1305 pf_status.lcounters[LCNT_SRCNODES]++;
1306 if ((*sn) == NULL)
1307 return (-1);
1308 bzero(*sn, sizeof (struct pf_src_node));
1309
1310 pf_init_threshold(&(*sn)->conn_rate,
1311 rule->max_src_conn_rate.limit,
1312 rule->max_src_conn_rate.seconds);
1313
1314 (*sn)->af = af;
1315 if (rule->rule_flag & PFRULE_RULESRCTRACK ||
1316 rule->rpool.opts & PF_POOL_STICKYADDR)
1317 (*sn)->rule.ptr = rule;
1318 else
1319 (*sn)->rule.ptr = NULL;
1320 PF_ACPY(&(*sn)->addr, src, af);
1321 if (RB_INSERT(pf_src_tree,
1322 &tree_src_tracking, *sn) != NULL) {
1323 if (pf_status.debug >= PF_DEBUG_MISC) {
1324 printf("pf: src_tree insert failed: ");
1325 pf_print_host(&(*sn)->addr, 0, af);
1326 printf("\n");
1327 }
1328 pool_put(&pf_src_tree_pl, *sn);
1329 return (-1);
1330 }
1331 (*sn)->creation = pf_time_second();
1332 (*sn)->ruletype = rule->action;
1333 if ((*sn)->rule.ptr != NULL)
1334 (*sn)->rule.ptr->src_nodes++;
1335 pf_status.scounters[SCNT_SRC_NODE_INSERT]++;
1336 pf_status.src_nodes++;
1337 } else {
1338 if (rule->max_src_states &&
1339 (*sn)->states >= rule->max_src_states) {
1340 pf_status.lcounters[LCNT_SRCSTATES]++;
1341 return (-1);
1342 }
1343 }
1344 return (0);
1345 }
1346
1347 static void
1348 pf_stateins_err(const char *tree, struct pf_state *s, struct pfi_kif *kif)
1349 {
1350 struct pf_state_key *sk = s->state_key;
1351
1352 if (pf_status.debug >= PF_DEBUG_MISC) {
1353 printf("pf: state insert failed: %s %s ", tree, kif->pfik_name);
1354 switch (sk->proto) {
1355 case IPPROTO_TCP:
1356 printf("TCP");
1357 break;
1358 case IPPROTO_UDP:
1359 printf("UDP");
1360 break;
1361 case IPPROTO_ICMP:
1362 printf("ICMP4");
1363 break;
1364 case IPPROTO_ICMPV6:
1365 printf("ICMP6");
1366 break;
1367 default:
1368 printf("PROTO=%u", sk->proto);
1369 break;
1370 }
1371 printf(" lan: ");
1372 pf_print_sk_host(&sk->lan, sk->af_lan, sk->proto,
1373 sk->proto_variant);
1374 printf(" gwy: ");
1375 pf_print_sk_host(&sk->gwy, sk->af_gwy, sk->proto,
1376 sk->proto_variant);
1377 printf(" ext_lan: ");
1378 pf_print_sk_host(&sk->ext_lan, sk->af_lan, sk->proto,
1379 sk->proto_variant);
1380 printf(" ext_gwy: ");
1381 pf_print_sk_host(&sk->ext_gwy, sk->af_gwy, sk->proto,
1382 sk->proto_variant);
1383 if (s->sync_flags & PFSTATE_FROMSYNC)
1384 printf(" (from sync)");
1385 printf("\n");
1386 }
1387 }
1388
1389 int
1390 pf_insert_state(struct pfi_kif *kif, struct pf_state *s)
1391 {
1392 struct pf_state_key *cur;
1393 struct pf_state *sp;
1394
1395 VERIFY(s->state_key != NULL);
1396 s->kif = kif;
1397
1398 if ((cur = RB_INSERT(pf_state_tree_lan_ext, &pf_statetbl_lan_ext,
1399 s->state_key)) != NULL) {
1400 /* key exists. check for same kif, if none, add to key */
1401 TAILQ_FOREACH(sp, &cur->states, next)
1402 if (sp->kif == kif) { /* collision! */
1403 pf_stateins_err("tree_lan_ext", s, kif);
1404 pf_detach_state(s,
1405 PF_DT_SKIP_LANEXT|PF_DT_SKIP_EXTGWY);
1406 return (-1);
1407 }
1408 pf_detach_state(s, PF_DT_SKIP_LANEXT|PF_DT_SKIP_EXTGWY);
1409 pf_attach_state(cur, s, kif == pfi_all ? 1 : 0);
1410 }
1411
1412 /* if cur != NULL, we already found a state key and attached to it */
1413 if (cur == NULL && (cur = RB_INSERT(pf_state_tree_ext_gwy,
1414 &pf_statetbl_ext_gwy, s->state_key)) != NULL) {
1415 /* must not happen. we must have found the sk above! */
1416 pf_stateins_err("tree_ext_gwy", s, kif);
1417 pf_detach_state(s, PF_DT_SKIP_EXTGWY);
1418 return (-1);
1419 }
1420
1421 if (s->id == 0 && s->creatorid == 0) {
1422 s->id = htobe64(pf_status.stateid++);
1423 s->creatorid = pf_status.hostid;
1424 }
1425 if (RB_INSERT(pf_state_tree_id, &tree_id, s) != NULL) {
1426 if (pf_status.debug >= PF_DEBUG_MISC) {
1427 printf("pf: state insert failed: "
1428 "id: %016llx creatorid: %08x",
1429 be64toh(s->id), ntohl(s->creatorid));
1430 if (s->sync_flags & PFSTATE_FROMSYNC)
1431 printf(" (from sync)");
1432 printf("\n");
1433 }
1434 pf_detach_state(s, 0);
1435 return (-1);
1436 }
1437 TAILQ_INSERT_TAIL(&state_list, s, entry_list);
1438 pf_status.fcounters[FCNT_STATE_INSERT]++;
1439 pf_status.states++;
1440 VERIFY(pf_status.states != 0);
1441 pfi_kif_ref(kif, PFI_KIF_REF_STATE);
1442 #if NPFSYNC
1443 pfsync_insert_state(s);
1444 #endif
1445 return (0);
1446 }
1447
1448 static int
1449 pf_purge_thread_cont(int err)
1450 {
1451 #pragma unused(err)
1452 static u_int32_t nloops = 0;
1453 int t = 1; /* 1 second */
1454
1455 /*
1456 * Update coarse-grained networking timestamp (in sec.); the idea
1457 * is to piggy-back on the periodic timeout callout to update
1458 * the counter returnable via net_uptime().
1459 */
1460 net_update_uptime();
1461
1462 lck_rw_lock_shared(pf_perim_lock);
1463 lck_mtx_lock(pf_lock);
1464
1465 /* purge everything if not running */
1466 if (!pf_status.running) {
1467 pf_purge_expired_states(pf_status.states);
1468 pf_purge_expired_fragments();
1469 pf_purge_expired_src_nodes();
1470
1471 /* terminate thread (we don't currently do this) */
1472 if (pf_purge_thread == NULL) {
1473 lck_mtx_unlock(pf_lock);
1474 lck_rw_done(pf_perim_lock);
1475
1476 thread_deallocate(current_thread());
1477 thread_terminate(current_thread());
1478 /* NOTREACHED */
1479 return (0);
1480 } else {
1481 /* if there's nothing left, sleep w/o timeout */
1482 if (pf_status.states == 0 &&
1483 pf_normalize_isempty() &&
1484 RB_EMPTY(&tree_src_tracking)) {
1485 nloops = 0;
1486 t = 0;
1487 }
1488 goto done;
1489 }
1490 }
1491
1492 /* process a fraction of the state table every second */
1493 pf_purge_expired_states(1 + (pf_status.states
1494 / pf_default_rule.timeout[PFTM_INTERVAL]));
1495
1496 /* purge other expired types every PFTM_INTERVAL seconds */
1497 if (++nloops >= pf_default_rule.timeout[PFTM_INTERVAL]) {
1498 pf_purge_expired_fragments();
1499 pf_purge_expired_src_nodes();
1500 nloops = 0;
1501 }
1502 done:
1503 lck_mtx_unlock(pf_lock);
1504 lck_rw_done(pf_perim_lock);
1505
1506 (void) tsleep0(pf_purge_thread_fn, PWAIT, "pf_purge_cont",
1507 t * hz, pf_purge_thread_cont);
1508 /* NOTREACHED */
1509 VERIFY(0);
1510
1511 return (0);
1512 }
1513
1514 void
1515 pf_purge_thread_fn(void *v, wait_result_t w)
1516 {
1517 #pragma unused(v, w)
1518 (void) tsleep0(pf_purge_thread_fn, PWAIT, "pf_purge", 0,
1519 pf_purge_thread_cont);
1520 /*
1521 * tsleep0() shouldn't have returned as PCATCH was not set;
1522 * therefore assert in this case.
1523 */
1524 VERIFY(0);
1525 }
1526
1527 u_int64_t
1528 pf_state_expires(const struct pf_state *state)
1529 {
1530 u_int32_t t;
1531 u_int32_t start;
1532 u_int32_t end;
1533 u_int32_t states;
1534
1535 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1536
1537 /* handle all PFTM_* > PFTM_MAX here */
1538 if (state->timeout == PFTM_PURGE)
1539 return (pf_time_second());
1540
1541 VERIFY(state->timeout != PFTM_UNLINKED);
1542 VERIFY(state->timeout < PFTM_MAX);
1543 t = state->rule.ptr->timeout[state->timeout];
1544 if (!t)
1545 t = pf_default_rule.timeout[state->timeout];
1546 start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START];
1547 if (start) {
1548 end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END];
1549 states = state->rule.ptr->states;
1550 } else {
1551 start = pf_default_rule.timeout[PFTM_ADAPTIVE_START];
1552 end = pf_default_rule.timeout[PFTM_ADAPTIVE_END];
1553 states = pf_status.states;
1554 }
1555 if (end && states > start && start < end) {
1556 if (states < end)
1557 return (state->expire + t * (end - states) /
1558 (end - start));
1559 else
1560 return (pf_time_second());
1561 }
1562 return (state->expire + t);
1563 }
1564
1565 void
1566 pf_purge_expired_src_nodes(void)
1567 {
1568 struct pf_src_node *cur, *next;
1569
1570 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1571
1572 for (cur = RB_MIN(pf_src_tree, &tree_src_tracking); cur; cur = next) {
1573 next = RB_NEXT(pf_src_tree, &tree_src_tracking, cur);
1574
1575 if (cur->states <= 0 && cur->expire <= pf_time_second()) {
1576 if (cur->rule.ptr != NULL) {
1577 cur->rule.ptr->src_nodes--;
1578 if (cur->rule.ptr->states <= 0 &&
1579 cur->rule.ptr->max_src_nodes <= 0)
1580 pf_rm_rule(NULL, cur->rule.ptr);
1581 }
1582 RB_REMOVE(pf_src_tree, &tree_src_tracking, cur);
1583 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
1584 pf_status.src_nodes--;
1585 pool_put(&pf_src_tree_pl, cur);
1586 }
1587 }
1588 }
1589
1590 void
1591 pf_src_tree_remove_state(struct pf_state *s)
1592 {
1593 u_int32_t t;
1594
1595 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1596
1597 if (s->src_node != NULL) {
1598 if (s->src.tcp_est) {
1599 VERIFY(s->src_node->conn > 0);
1600 --s->src_node->conn;
1601 }
1602 VERIFY(s->src_node->states > 0);
1603 if (--s->src_node->states <= 0) {
1604 t = s->rule.ptr->timeout[PFTM_SRC_NODE];
1605 if (!t)
1606 t = pf_default_rule.timeout[PFTM_SRC_NODE];
1607 s->src_node->expire = pf_time_second() + t;
1608 }
1609 }
1610 if (s->nat_src_node != s->src_node && s->nat_src_node != NULL) {
1611 VERIFY(s->nat_src_node->states > 0);
1612 if (--s->nat_src_node->states <= 0) {
1613 t = s->rule.ptr->timeout[PFTM_SRC_NODE];
1614 if (!t)
1615 t = pf_default_rule.timeout[PFTM_SRC_NODE];
1616 s->nat_src_node->expire = pf_time_second() + t;
1617 }
1618 }
1619 s->src_node = s->nat_src_node = NULL;
1620 }
1621
1622 void
1623 pf_unlink_state(struct pf_state *cur)
1624 {
1625 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1626
1627 if (cur->src.state == PF_TCPS_PROXY_DST) {
1628 pf_send_tcp(cur->rule.ptr, cur->state_key->af_lan,
1629 &cur->state_key->ext_lan.addr, &cur->state_key->lan.addr,
1630 cur->state_key->ext_lan.xport.port,
1631 cur->state_key->lan.xport.port,
1632 cur->src.seqhi, cur->src.seqlo + 1,
1633 TH_RST|TH_ACK, 0, 0, 0, 1, cur->tag, NULL, NULL);
1634 }
1635
1636 hook_runloop(&cur->unlink_hooks, HOOK_REMOVE|HOOK_FREE);
1637 RB_REMOVE(pf_state_tree_id, &tree_id, cur);
1638 #if NPFSYNC
1639 if (cur->creatorid == pf_status.hostid)
1640 pfsync_delete_state(cur);
1641 #endif
1642 cur->timeout = PFTM_UNLINKED;
1643 pf_src_tree_remove_state(cur);
1644 pf_detach_state(cur, 0);
1645 }
1646
1647 /* callers should be at splpf and hold the
1648 * write_lock on pf_consistency_lock */
1649 void
1650 pf_free_state(struct pf_state *cur)
1651 {
1652 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1653 #if NPFSYNC
1654 if (pfsyncif != NULL &&
1655 (pfsyncif->sc_bulk_send_next == cur ||
1656 pfsyncif->sc_bulk_terminator == cur))
1657 return;
1658 #endif
1659 VERIFY(cur->timeout == PFTM_UNLINKED);
1660 VERIFY(cur->rule.ptr->states > 0);
1661 if (--cur->rule.ptr->states <= 0 &&
1662 cur->rule.ptr->src_nodes <= 0)
1663 pf_rm_rule(NULL, cur->rule.ptr);
1664 if (cur->nat_rule.ptr != NULL) {
1665 VERIFY(cur->nat_rule.ptr->states > 0);
1666 if (--cur->nat_rule.ptr->states <= 0 &&
1667 cur->nat_rule.ptr->src_nodes <= 0)
1668 pf_rm_rule(NULL, cur->nat_rule.ptr);
1669 }
1670 if (cur->anchor.ptr != NULL) {
1671 VERIFY(cur->anchor.ptr->states > 0);
1672 if (--cur->anchor.ptr->states <= 0)
1673 pf_rm_rule(NULL, cur->anchor.ptr);
1674 }
1675 pf_normalize_tcp_cleanup(cur);
1676 pfi_kif_unref(cur->kif, PFI_KIF_REF_STATE);
1677 TAILQ_REMOVE(&state_list, cur, entry_list);
1678 if (cur->tag)
1679 pf_tag_unref(cur->tag);
1680 pool_put(&pf_state_pl, cur);
1681 pf_status.fcounters[FCNT_STATE_REMOVALS]++;
1682 VERIFY(pf_status.states > 0);
1683 pf_status.states--;
1684 }
1685
1686 void
1687 pf_purge_expired_states(u_int32_t maxcheck)
1688 {
1689 static struct pf_state *cur = NULL;
1690 struct pf_state *next;
1691
1692 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1693
1694 while (maxcheck--) {
1695 /* wrap to start of list when we hit the end */
1696 if (cur == NULL) {
1697 cur = TAILQ_FIRST(&state_list);
1698 if (cur == NULL)
1699 break; /* list empty */
1700 }
1701
1702 /* get next state, as cur may get deleted */
1703 next = TAILQ_NEXT(cur, entry_list);
1704
1705 if (cur->timeout == PFTM_UNLINKED) {
1706 pf_free_state(cur);
1707 } else if (pf_state_expires(cur) <= pf_time_second()) {
1708 /* unlink and free expired state */
1709 pf_unlink_state(cur);
1710 pf_free_state(cur);
1711 }
1712 cur = next;
1713 }
1714 }
1715
1716 int
1717 pf_tbladdr_setup(struct pf_ruleset *rs, struct pf_addr_wrap *aw)
1718 {
1719 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1720
1721 if (aw->type != PF_ADDR_TABLE)
1722 return (0);
1723 if ((aw->p.tbl = pfr_attach_table(rs, aw->v.tblname)) == NULL)
1724 return (1);
1725 return (0);
1726 }
1727
1728 void
1729 pf_tbladdr_remove(struct pf_addr_wrap *aw)
1730 {
1731 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1732
1733 if (aw->type != PF_ADDR_TABLE || aw->p.tbl == NULL)
1734 return;
1735 pfr_detach_table(aw->p.tbl);
1736 aw->p.tbl = NULL;
1737 }
1738
1739 void
1740 pf_tbladdr_copyout(struct pf_addr_wrap *aw)
1741 {
1742 struct pfr_ktable *kt = aw->p.tbl;
1743
1744 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1745
1746 if (aw->type != PF_ADDR_TABLE || kt == NULL)
1747 return;
1748 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1749 kt = kt->pfrkt_root;
1750 aw->p.tbl = NULL;
1751 aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ?
1752 kt->pfrkt_cnt : -1;
1753 }
1754
1755 static void
1756 pf_print_addr(struct pf_addr *addr, sa_family_t af)
1757 {
1758 switch (af) {
1759 #if INET
1760 case AF_INET: {
1761 u_int32_t a = ntohl(addr->addr32[0]);
1762 printf("%u.%u.%u.%u", (a>>24)&255, (a>>16)&255,
1763 (a>>8)&255, a&255);
1764 break;
1765 }
1766 #endif /* INET */
1767 #if INET6
1768 case AF_INET6: {
1769 u_int16_t b;
1770 u_int8_t i, curstart = 255, curend = 0,
1771 maxstart = 0, maxend = 0;
1772 for (i = 0; i < 8; i++) {
1773 if (!addr->addr16[i]) {
1774 if (curstart == 255)
1775 curstart = i;
1776 else
1777 curend = i;
1778 } else {
1779 if (curstart) {
1780 if ((curend - curstart) >
1781 (maxend - maxstart)) {
1782 maxstart = curstart;
1783 maxend = curend;
1784 curstart = 255;
1785 }
1786 }
1787 }
1788 }
1789 for (i = 0; i < 8; i++) {
1790 if (i >= maxstart && i <= maxend) {
1791 if (maxend != 7) {
1792 if (i == maxstart)
1793 printf(":");
1794 } else {
1795 if (i == maxend)
1796 printf(":");
1797 }
1798 } else {
1799 b = ntohs(addr->addr16[i]);
1800 printf("%x", b);
1801 if (i < 7)
1802 printf(":");
1803 }
1804 }
1805 break;
1806 }
1807 #endif /* INET6 */
1808 }
1809 }
1810
1811 static void
1812 pf_print_sk_host(struct pf_state_host *sh, sa_family_t af, int proto,
1813 u_int8_t proto_variant)
1814 {
1815 pf_print_addr(&sh->addr, af);
1816
1817 switch (proto) {
1818 case IPPROTO_ESP:
1819 if (sh->xport.spi)
1820 printf("[%08x]", ntohl(sh->xport.spi));
1821 break;
1822
1823 case IPPROTO_GRE:
1824 if (proto_variant == PF_GRE_PPTP_VARIANT)
1825 printf("[%u]", ntohs(sh->xport.call_id));
1826 break;
1827
1828 case IPPROTO_TCP:
1829 case IPPROTO_UDP:
1830 printf("[%u]", ntohs(sh->xport.port));
1831 break;
1832
1833 default:
1834 break;
1835 }
1836 }
1837
1838 static void
1839 pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af)
1840 {
1841 pf_print_addr(addr, af);
1842 if (p)
1843 printf("[%u]", ntohs(p));
1844 }
1845
1846 void
1847 pf_print_state(struct pf_state *s)
1848 {
1849 struct pf_state_key *sk = s->state_key;
1850 switch (sk->proto) {
1851 case IPPROTO_ESP:
1852 printf("ESP ");
1853 break;
1854 case IPPROTO_GRE:
1855 printf("GRE%u ", sk->proto_variant);
1856 break;
1857 case IPPROTO_TCP:
1858 printf("TCP ");
1859 break;
1860 case IPPROTO_UDP:
1861 printf("UDP ");
1862 break;
1863 case IPPROTO_ICMP:
1864 printf("ICMP ");
1865 break;
1866 case IPPROTO_ICMPV6:
1867 printf("ICMPV6 ");
1868 break;
1869 default:
1870 printf("%u ", sk->proto);
1871 break;
1872 }
1873 pf_print_sk_host(&sk->lan, sk->af_lan, sk->proto, sk->proto_variant);
1874 printf(" ");
1875 pf_print_sk_host(&sk->gwy, sk->af_gwy, sk->proto, sk->proto_variant);
1876 printf(" ");
1877 pf_print_sk_host(&sk->ext_lan, sk->af_lan, sk->proto,
1878 sk->proto_variant);
1879 printf(" ");
1880 pf_print_sk_host(&sk->ext_gwy, sk->af_gwy, sk->proto,
1881 sk->proto_variant);
1882 printf(" [lo=%u high=%u win=%u modulator=%u", s->src.seqlo,
1883 s->src.seqhi, s->src.max_win, s->src.seqdiff);
1884 if (s->src.wscale && s->dst.wscale)
1885 printf(" wscale=%u", s->src.wscale & PF_WSCALE_MASK);
1886 printf("]");
1887 printf(" [lo=%u high=%u win=%u modulator=%u", s->dst.seqlo,
1888 s->dst.seqhi, s->dst.max_win, s->dst.seqdiff);
1889 if (s->src.wscale && s->dst.wscale)
1890 printf(" wscale=%u", s->dst.wscale & PF_WSCALE_MASK);
1891 printf("]");
1892 printf(" %u:%u", s->src.state, s->dst.state);
1893 }
1894
1895 void
1896 pf_print_flags(u_int8_t f)
1897 {
1898 if (f)
1899 printf(" ");
1900 if (f & TH_FIN)
1901 printf("F");
1902 if (f & TH_SYN)
1903 printf("S");
1904 if (f & TH_RST)
1905 printf("R");
1906 if (f & TH_PUSH)
1907 printf("P");
1908 if (f & TH_ACK)
1909 printf("A");
1910 if (f & TH_URG)
1911 printf("U");
1912 if (f & TH_ECE)
1913 printf("E");
1914 if (f & TH_CWR)
1915 printf("W");
1916 }
1917
1918 #define PF_SET_SKIP_STEPS(i) \
1919 do { \
1920 while (head[i] != cur) { \
1921 head[i]->skip[i].ptr = cur; \
1922 head[i] = TAILQ_NEXT(head[i], entries); \
1923 } \
1924 } while (0)
1925
1926 void
1927 pf_calc_skip_steps(struct pf_rulequeue *rules)
1928 {
1929 struct pf_rule *cur, *prev, *head[PF_SKIP_COUNT];
1930 int i;
1931
1932 cur = TAILQ_FIRST(rules);
1933 prev = cur;
1934 for (i = 0; i < PF_SKIP_COUNT; ++i)
1935 head[i] = cur;
1936 while (cur != NULL) {
1937
1938 if (cur->kif != prev->kif || cur->ifnot != prev->ifnot)
1939 PF_SET_SKIP_STEPS(PF_SKIP_IFP);
1940 if (cur->direction != prev->direction)
1941 PF_SET_SKIP_STEPS(PF_SKIP_DIR);
1942 if (cur->af != prev->af)
1943 PF_SET_SKIP_STEPS(PF_SKIP_AF);
1944 if (cur->proto != prev->proto)
1945 PF_SET_SKIP_STEPS(PF_SKIP_PROTO);
1946 if (cur->src.neg != prev->src.neg ||
1947 pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr))
1948 PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR);
1949 {
1950 union pf_rule_xport *cx = &cur->src.xport;
1951 union pf_rule_xport *px = &prev->src.xport;
1952
1953 switch (cur->proto) {
1954 case IPPROTO_GRE:
1955 case IPPROTO_ESP:
1956 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT);
1957 break;
1958 default:
1959 if (prev->proto == IPPROTO_GRE ||
1960 prev->proto == IPPROTO_ESP ||
1961 cx->range.op != px->range.op ||
1962 cx->range.port[0] != px->range.port[0] ||
1963 cx->range.port[1] != px->range.port[1])
1964 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT);
1965 break;
1966 }
1967 }
1968 if (cur->dst.neg != prev->dst.neg ||
1969 pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr))
1970 PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR);
1971 {
1972 union pf_rule_xport *cx = &cur->dst.xport;
1973 union pf_rule_xport *px = &prev->dst.xport;
1974
1975 switch (cur->proto) {
1976 case IPPROTO_GRE:
1977 if (cur->proto != prev->proto ||
1978 cx->call_id != px->call_id)
1979 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
1980 break;
1981 case IPPROTO_ESP:
1982 if (cur->proto != prev->proto ||
1983 cx->spi != px->spi)
1984 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
1985 break;
1986 default:
1987 if (prev->proto == IPPROTO_GRE ||
1988 prev->proto == IPPROTO_ESP ||
1989 cx->range.op != px->range.op ||
1990 cx->range.port[0] != px->range.port[0] ||
1991 cx->range.port[1] != px->range.port[1])
1992 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
1993 break;
1994 }
1995 }
1996
1997 prev = cur;
1998 cur = TAILQ_NEXT(cur, entries);
1999 }
2000 for (i = 0; i < PF_SKIP_COUNT; ++i)
2001 PF_SET_SKIP_STEPS(i);
2002 }
2003
2004 u_int32_t
2005 pf_calc_state_key_flowhash(struct pf_state_key *sk)
2006 {
2007 struct pf_flowhash_key fh __attribute__((aligned(8)));
2008 uint32_t flowhash = 0;
2009
2010 bzero(&fh, sizeof (fh));
2011 if (PF_ALEQ(&sk->lan.addr, &sk->ext_lan.addr, sk->af_lan)) {
2012 bcopy(&sk->lan.addr, &fh.ap1.addr, sizeof (fh.ap1.addr));
2013 bcopy(&sk->ext_lan.addr, &fh.ap2.addr, sizeof (fh.ap2.addr));
2014 } else {
2015 bcopy(&sk->ext_lan.addr, &fh.ap1.addr, sizeof (fh.ap1.addr));
2016 bcopy(&sk->lan.addr, &fh.ap2.addr, sizeof (fh.ap2.addr));
2017 }
2018 if (sk->lan.xport.spi <= sk->ext_lan.xport.spi) {
2019 fh.ap1.xport.spi = sk->lan.xport.spi;
2020 fh.ap2.xport.spi = sk->ext_lan.xport.spi;
2021 } else {
2022 fh.ap1.xport.spi = sk->ext_lan.xport.spi;
2023 fh.ap2.xport.spi = sk->lan.xport.spi;
2024 }
2025 fh.af = sk->af_lan;
2026 fh.proto = sk->proto;
2027
2028 try_again:
2029 flowhash = net_flowhash(&fh, sizeof (fh), pf_hash_seed);
2030 if (flowhash == 0) {
2031 /* try to get a non-zero flowhash */
2032 pf_hash_seed = RandomULong();
2033 goto try_again;
2034 }
2035
2036 return (flowhash);
2037 }
2038
2039 static int
2040 pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2)
2041 {
2042 if (aw1->type != aw2->type)
2043 return (1);
2044 switch (aw1->type) {
2045 case PF_ADDR_ADDRMASK:
2046 case PF_ADDR_RANGE:
2047 if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, 0))
2048 return (1);
2049 if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, 0))
2050 return (1);
2051 return (0);
2052 case PF_ADDR_DYNIFTL:
2053 return (aw1->p.dyn == NULL || aw2->p.dyn == NULL ||
2054 aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt);
2055 case PF_ADDR_NOROUTE:
2056 case PF_ADDR_URPFFAILED:
2057 return (0);
2058 case PF_ADDR_TABLE:
2059 return (aw1->p.tbl != aw2->p.tbl);
2060 case PF_ADDR_RTLABEL:
2061 return (aw1->v.rtlabel != aw2->v.rtlabel);
2062 default:
2063 printf("invalid address type: %d\n", aw1->type);
2064 return (1);
2065 }
2066 }
2067
2068 u_int16_t
2069 pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp)
2070 {
2071 u_int32_t l;
2072
2073 if (udp && !cksum)
2074 return (0);
2075 l = cksum + old - new;
2076 l = (l >> 16) + (l & 0xffff);
2077 l = l & 0xffff;
2078 if (udp && !l)
2079 return (0xffff);
2080 return (l);
2081 }
2082
2083 /*
2084 * change ip address & port
2085 * dir : packet direction
2086 * a : address to be changed
2087 * p : port to be changed
2088 * ic : ip header checksum
2089 * pc : protocol checksum
2090 * an : new ip address
2091 * pn : new port
2092 * u : should be 1 if UDP packet else 0
2093 * af : address family of the packet
2094 * afn : address family of the new address
2095 * ua : should be 1 if ip address needs to be updated in the packet else
2096 * only the checksum is recalculated & updated.
2097 */
2098 static void
2099 pf_change_ap(int dir, struct mbuf *m, struct pf_addr *a, u_int16_t *p,
2100 u_int16_t *ic, u_int16_t *pc, struct pf_addr *an, u_int16_t pn,
2101 u_int8_t u, sa_family_t af, sa_family_t afn, int ua)
2102 {
2103 struct pf_addr ao;
2104 u_int16_t po = *p;
2105
2106 PF_ACPY(&ao, a, af);
2107 if (ua)
2108 PF_ACPY(a, an, afn);
2109
2110 *p = pn;
2111
2112 switch (af) {
2113 #if INET
2114 case AF_INET:
2115 switch (afn) {
2116 case AF_INET:
2117 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
2118 ao.addr16[0], an->addr16[0], 0),
2119 ao.addr16[1], an->addr16[1], 0);
2120 *p = pn;
2121 /*
2122 * If the packet is originated from an ALG on the NAT gateway
2123 * (source address is loopback or local), in which case the
2124 * TCP/UDP checksum field contains the pseudo header checksum
2125 * that's not yet complemented. A packet generated locally
2126 * will have UDP/TCP CSUM flag set (gets set in protocol
2127 * output).
2128 */
2129 if (dir == PF_OUT && m != NULL &&
2130 (m->m_flags & M_PKTHDR) &&
2131 (m->m_pkthdr.csum_flags & (CSUM_TCP | CSUM_UDP))) {
2132 /* Pseudo-header checksum does not include ports */
2133 *pc = ~pf_cksum_fixup(pf_cksum_fixup(~*pc,
2134 ao.addr16[0], an->addr16[0], u),
2135 ao.addr16[1], an->addr16[1], u);
2136 } else {
2137 *pc =
2138 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2139 *pc, ao.addr16[0], an->addr16[0], u),
2140 ao.addr16[1], an->addr16[1], u),
2141 po, pn, u);
2142 }
2143 break;
2144 #ifdef INET6
2145 case AF_INET6:
2146 *p = pn;
2147 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2148 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2149
2150 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc,
2151 ao.addr16[0], an->addr16[0], u),
2152 ao.addr16[1], an->addr16[1], u),
2153 0, an->addr16[2], u),
2154 0, an->addr16[3], u),
2155 0, an->addr16[4], u),
2156 0, an->addr16[5], u),
2157 0, an->addr16[6], u),
2158 0, an->addr16[7], u),
2159 po, pn, u);
2160 break;
2161 #endif /* INET6 */
2162 }
2163 break;
2164 #endif /* INET */
2165 #if INET6
2166 case AF_INET6:
2167 switch (afn) {
2168 case AF_INET6:
2169 /*
2170 * If the packet is originated from an ALG on the NAT gateway
2171 * (source address is loopback or local), in which case the
2172 * TCP/UDP checksum field contains the pseudo header checksum
2173 * that's not yet complemented.
2174 * A packet generated locally
2175 * will have UDP/TCP CSUM flag set (gets set in protocol
2176 * output).
2177 */
2178 if (dir == PF_OUT && m != NULL &&
2179 (m->m_flags & M_PKTHDR) &&
2180 (m->m_pkthdr.csum_flags & (CSUM_TCPIPV6 |
2181 CSUM_UDPIPV6))) {
2182 /* Pseudo-header checksum does not include ports */
2183 *pc =
2184 ~pf_cksum_fixup(pf_cksum_fixup(
2185 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2186 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2187 ~*pc,
2188 ao.addr16[0], an->addr16[0], u),
2189 ao.addr16[1], an->addr16[1], u),
2190 ao.addr16[2], an->addr16[2], u),
2191 ao.addr16[3], an->addr16[3], u),
2192 ao.addr16[4], an->addr16[4], u),
2193 ao.addr16[5], an->addr16[5], u),
2194 ao.addr16[6], an->addr16[6], u),
2195 ao.addr16[7], an->addr16[7], u);
2196 } else {
2197 *pc =
2198 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2199 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2200 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2201 *pc,
2202 ao.addr16[0], an->addr16[0], u),
2203 ao.addr16[1], an->addr16[1], u),
2204 ao.addr16[2], an->addr16[2], u),
2205 ao.addr16[3], an->addr16[3], u),
2206 ao.addr16[4], an->addr16[4], u),
2207 ao.addr16[5], an->addr16[5], u),
2208 ao.addr16[6], an->addr16[6], u),
2209 ao.addr16[7], an->addr16[7], u),
2210 po, pn, u);
2211 }
2212 break;
2213 #ifdef INET
2214 case AF_INET:
2215 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2216 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2217 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc,
2218 ao.addr16[0], an->addr16[0], u),
2219 ao.addr16[1], an->addr16[1], u),
2220 ao.addr16[2], 0, u),
2221 ao.addr16[3], 0, u),
2222 ao.addr16[4], 0, u),
2223 ao.addr16[5], 0, u),
2224 ao.addr16[6], 0, u),
2225 ao.addr16[7], 0, u),
2226 po, pn, u);
2227 break;
2228 #endif /* INET */
2229 }
2230 break;
2231 #endif /* INET6 */
2232 }
2233 }
2234
2235
2236 /* Changes a u_int32_t. Uses a void * so there are no align restrictions */
2237 void
2238 pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u)
2239 {
2240 u_int32_t ao;
2241
2242 memcpy(&ao, a, sizeof (ao));
2243 memcpy(a, &an, sizeof (u_int32_t));
2244 *c = pf_cksum_fixup(pf_cksum_fixup(*c, ao / 65536, an / 65536, u),
2245 ao % 65536, an % 65536, u);
2246 }
2247
2248 #if INET6
2249 static void
2250 pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u)
2251 {
2252 struct pf_addr ao;
2253
2254 PF_ACPY(&ao, a, AF_INET6);
2255 PF_ACPY(a, an, AF_INET6);
2256
2257 *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2258 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2259 pf_cksum_fixup(pf_cksum_fixup(*c,
2260 ao.addr16[0], an->addr16[0], u),
2261 ao.addr16[1], an->addr16[1], u),
2262 ao.addr16[2], an->addr16[2], u),
2263 ao.addr16[3], an->addr16[3], u),
2264 ao.addr16[4], an->addr16[4], u),
2265 ao.addr16[5], an->addr16[5], u),
2266 ao.addr16[6], an->addr16[6], u),
2267 ao.addr16[7], an->addr16[7], u);
2268 }
2269
2270 void
2271 pf_change_addr(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u,
2272 sa_family_t af, sa_family_t afn)
2273 {
2274 struct pf_addr ao;
2275
2276 PF_ACPY(&ao, a, af);
2277 PF_ACPY(a, an, afn);
2278
2279 switch (af) {
2280 case AF_INET:
2281 switch (afn) {
2282 case AF_INET:
2283 pf_change_a(a, c, an->v4.s_addr, u);
2284 break;
2285 case AF_INET6:
2286 *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2287 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2288 pf_cksum_fixup(pf_cksum_fixup(*c,
2289 ao.addr16[0], an->addr16[0], u),
2290 ao.addr16[1], an->addr16[1], u),
2291 0, an->addr16[2], u),
2292 0, an->addr16[3], u),
2293 0, an->addr16[4], u),
2294 0, an->addr16[5], u),
2295 0, an->addr16[6], u),
2296 0, an->addr16[7], u);
2297 break;
2298 }
2299 break;
2300 case AF_INET6:
2301 switch (afn) {
2302 case AF_INET:
2303 *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2304 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2305 pf_cksum_fixup(pf_cksum_fixup(*c,
2306 ao.addr16[0], an->addr16[0], u),
2307 ao.addr16[1], an->addr16[1], u),
2308 ao.addr16[2], 0, u),
2309 ao.addr16[3], 0, u),
2310 ao.addr16[4], 0, u),
2311 ao.addr16[5], 0, u),
2312 ao.addr16[6], 0, u),
2313 ao.addr16[7], 0, u);
2314 break;
2315 case AF_INET6:
2316 pf_change_a6(a, c, an, u);
2317 break;
2318 }
2319 break;
2320 }
2321 }
2322
2323 #endif /* INET6 */
2324
2325 static void
2326 pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa,
2327 struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c,
2328 u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af)
2329 {
2330 struct pf_addr oia, ooa;
2331
2332 PF_ACPY(&oia, ia, af);
2333 PF_ACPY(&ooa, oa, af);
2334
2335 /* Change inner protocol port, fix inner protocol checksum. */
2336 if (ip != NULL) {
2337 u_int16_t oip = *ip;
2338 u_int32_t opc = 0;
2339
2340 if (pc != NULL)
2341 opc = *pc;
2342 *ip = np;
2343 if (pc != NULL)
2344 *pc = pf_cksum_fixup(*pc, oip, *ip, u);
2345 *ic = pf_cksum_fixup(*ic, oip, *ip, 0);
2346 if (pc != NULL)
2347 *ic = pf_cksum_fixup(*ic, opc, *pc, 0);
2348 }
2349 /* Change inner ip address, fix inner ip and icmp checksums. */
2350 PF_ACPY(ia, na, af);
2351 switch (af) {
2352 #if INET
2353 case AF_INET: {
2354 u_int32_t oh2c = *h2c;
2355
2356 *h2c = pf_cksum_fixup(pf_cksum_fixup(*h2c,
2357 oia.addr16[0], ia->addr16[0], 0),
2358 oia.addr16[1], ia->addr16[1], 0);
2359 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
2360 oia.addr16[0], ia->addr16[0], 0),
2361 oia.addr16[1], ia->addr16[1], 0);
2362 *ic = pf_cksum_fixup(*ic, oh2c, *h2c, 0);
2363 break;
2364 }
2365 #endif /* INET */
2366 #if INET6
2367 case AF_INET6:
2368 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2369 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2370 pf_cksum_fixup(pf_cksum_fixup(*ic,
2371 oia.addr16[0], ia->addr16[0], u),
2372 oia.addr16[1], ia->addr16[1], u),
2373 oia.addr16[2], ia->addr16[2], u),
2374 oia.addr16[3], ia->addr16[3], u),
2375 oia.addr16[4], ia->addr16[4], u),
2376 oia.addr16[5], ia->addr16[5], u),
2377 oia.addr16[6], ia->addr16[6], u),
2378 oia.addr16[7], ia->addr16[7], u);
2379 break;
2380 #endif /* INET6 */
2381 }
2382 /* Change outer ip address, fix outer ip or icmpv6 checksum. */
2383 PF_ACPY(oa, na, af);
2384 switch (af) {
2385 #if INET
2386 case AF_INET:
2387 *hc = pf_cksum_fixup(pf_cksum_fixup(*hc,
2388 ooa.addr16[0], oa->addr16[0], 0),
2389 ooa.addr16[1], oa->addr16[1], 0);
2390 break;
2391 #endif /* INET */
2392 #if INET6
2393 case AF_INET6:
2394 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2395 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2396 pf_cksum_fixup(pf_cksum_fixup(*ic,
2397 ooa.addr16[0], oa->addr16[0], u),
2398 ooa.addr16[1], oa->addr16[1], u),
2399 ooa.addr16[2], oa->addr16[2], u),
2400 ooa.addr16[3], oa->addr16[3], u),
2401 ooa.addr16[4], oa->addr16[4], u),
2402 ooa.addr16[5], oa->addr16[5], u),
2403 ooa.addr16[6], oa->addr16[6], u),
2404 ooa.addr16[7], oa->addr16[7], u);
2405 break;
2406 #endif /* INET6 */
2407 }
2408 }
2409
2410
2411 /*
2412 * Need to modulate the sequence numbers in the TCP SACK option
2413 * (credits to Krzysztof Pfaff for report and patch)
2414 */
2415 static int
2416 pf_modulate_sack(struct mbuf *m, int off, struct pf_pdesc *pd,
2417 struct tcphdr *th, struct pf_state_peer *dst)
2418 {
2419 int hlen = (th->th_off << 2) - sizeof (*th), thoptlen = hlen;
2420 u_int8_t opts[MAX_TCPOPTLEN], *opt = opts;
2421 int copyback = 0, i, olen;
2422 struct sackblk sack;
2423
2424 #define TCPOLEN_SACKLEN (TCPOLEN_SACK + 2)
2425 if (hlen < TCPOLEN_SACKLEN ||
2426 !pf_pull_hdr(m, off + sizeof (*th), opts, hlen, NULL, NULL, pd->af))
2427 return (0);
2428
2429 while (hlen >= TCPOLEN_SACKLEN) {
2430 olen = opt[1];
2431 switch (*opt) {
2432 case TCPOPT_EOL: /* FALLTHROUGH */
2433 case TCPOPT_NOP:
2434 opt++;
2435 hlen--;
2436 break;
2437 case TCPOPT_SACK:
2438 if (olen > hlen)
2439 olen = hlen;
2440 if (olen >= TCPOLEN_SACKLEN) {
2441 for (i = 2; i + TCPOLEN_SACK <= olen;
2442 i += TCPOLEN_SACK) {
2443 memcpy(&sack, &opt[i], sizeof (sack));
2444 pf_change_a(&sack.start, &th->th_sum,
2445 htonl(ntohl(sack.start) -
2446 dst->seqdiff), 0);
2447 pf_change_a(&sack.end, &th->th_sum,
2448 htonl(ntohl(sack.end) -
2449 dst->seqdiff), 0);
2450 memcpy(&opt[i], &sack, sizeof (sack));
2451 }
2452 copyback = off + sizeof (*th) + thoptlen;
2453 }
2454 /* FALLTHROUGH */
2455 default:
2456 if (olen < 2)
2457 olen = 2;
2458 hlen -= olen;
2459 opt += olen;
2460 }
2461 }
2462
2463 if (copyback) {
2464 m = pf_lazy_makewritable(pd, m, copyback);
2465 if (!m)
2466 return (-1);
2467 m_copyback(m, off + sizeof (*th), thoptlen, opts);
2468 }
2469 return (copyback);
2470 }
2471
2472 static void
2473 pf_send_tcp(const struct pf_rule *r, sa_family_t af,
2474 const struct pf_addr *saddr, const struct pf_addr *daddr,
2475 u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack,
2476 u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl, int tag,
2477 u_int16_t rtag, struct ether_header *eh, struct ifnet *ifp)
2478 {
2479 #pragma unused(eh, ifp)
2480 struct mbuf *m;
2481 int len, tlen;
2482 #if INET
2483 struct ip *h = NULL;
2484 #endif /* INET */
2485 #if INET6
2486 struct ip6_hdr *h6 = NULL;
2487 #endif /* INET6 */
2488 struct tcphdr *th = NULL;
2489 char *opt;
2490 struct pf_mtag *pf_mtag;
2491
2492 /* maximum segment size tcp option */
2493 tlen = sizeof (struct tcphdr);
2494 if (mss)
2495 tlen += 4;
2496
2497 switch (af) {
2498 #if INET
2499 case AF_INET:
2500 len = sizeof (struct ip) + tlen;
2501 break;
2502 #endif /* INET */
2503 #if INET6
2504 case AF_INET6:
2505 len = sizeof (struct ip6_hdr) + tlen;
2506 break;
2507 #endif /* INET6 */
2508 default:
2509 panic("pf_send_tcp: not AF_INET or AF_INET6!");
2510 return;
2511 }
2512
2513 /* create outgoing mbuf */
2514 m = m_gethdr(M_DONTWAIT, MT_HEADER);
2515 if (m == NULL)
2516 return;
2517
2518 if ((pf_mtag = pf_get_mtag(m)) == NULL) {
2519 m_free(m);
2520 return;
2521 }
2522
2523 if (tag)
2524 pf_mtag->pftag_flags |= PF_TAG_GENERATED;
2525 pf_mtag->pftag_tag = rtag;
2526
2527 if (r != NULL && PF_RTABLEID_IS_VALID(r->rtableid))
2528 pf_mtag->pftag_rtableid = r->rtableid;
2529
2530 #if PF_ALTQ
2531 if (altq_allowed && r != NULL && r->qid)
2532 pf_mtag->pftag_qid = r->qid;
2533 #endif /* PF_ALTQ */
2534
2535 #if PF_ECN
2536 /* add hints for ecn */
2537 pf_mtag->pftag_hdr = mtod(m, struct ip *);
2538 /* record address family */
2539 pf_mtag->pftag_flags &= ~(PF_TAG_HDR_INET | PF_TAG_HDR_INET6);
2540 switch (af) {
2541 #if INET
2542 case AF_INET:
2543 pf_mtag->pftag_flags |= PF_TAG_HDR_INET;
2544 break;
2545 #endif /* INET */
2546 #if INET6
2547 case AF_INET6:
2548 pf_mtag->pftag_flags |= PF_TAG_HDR_INET6;
2549 break;
2550 #endif /* INET6 */
2551 }
2552 #endif /* PF_ECN */
2553
2554 /* indicate this is TCP */
2555 m->m_pkthdr.pkt_proto = IPPROTO_TCP;
2556
2557 /* Make sure headers are 32-bit aligned */
2558 m->m_data += max_linkhdr;
2559 m->m_pkthdr.len = m->m_len = len;
2560 m->m_pkthdr.rcvif = NULL;
2561 bzero(m->m_data, len);
2562 switch (af) {
2563 #if INET
2564 case AF_INET:
2565 h = mtod(m, struct ip *);
2566
2567 /* IP header fields included in the TCP checksum */
2568 h->ip_p = IPPROTO_TCP;
2569 h->ip_len = htons(tlen);
2570 h->ip_src.s_addr = saddr->v4.s_addr;
2571 h->ip_dst.s_addr = daddr->v4.s_addr;
2572
2573 th = (struct tcphdr *)(void *)((caddr_t)h + sizeof (struct ip));
2574 break;
2575 #endif /* INET */
2576 #if INET6
2577 case AF_INET6:
2578 h6 = mtod(m, struct ip6_hdr *);
2579
2580 /* IP header fields included in the TCP checksum */
2581 h6->ip6_nxt = IPPROTO_TCP;
2582 h6->ip6_plen = htons(tlen);
2583 memcpy(&h6->ip6_src, &saddr->v6, sizeof (struct in6_addr));
2584 memcpy(&h6->ip6_dst, &daddr->v6, sizeof (struct in6_addr));
2585
2586 th = (struct tcphdr *)(void *)
2587 ((caddr_t)h6 + sizeof (struct ip6_hdr));
2588 break;
2589 #endif /* INET6 */
2590 }
2591
2592 /* TCP header */
2593 th->th_sport = sport;
2594 th->th_dport = dport;
2595 th->th_seq = htonl(seq);
2596 th->th_ack = htonl(ack);
2597 th->th_off = tlen >> 2;
2598 th->th_flags = flags;
2599 th->th_win = htons(win);
2600
2601 if (mss) {
2602 opt = (char *)(th + 1);
2603 opt[0] = TCPOPT_MAXSEG;
2604 opt[1] = 4;
2605 #if BYTE_ORDER != BIG_ENDIAN
2606 HTONS(mss);
2607 #endif
2608 bcopy((caddr_t)&mss, (caddr_t)(opt + 2), 2);
2609 }
2610
2611 switch (af) {
2612 #if INET
2613 case AF_INET: {
2614 struct route ro;
2615
2616 /* TCP checksum */
2617 th->th_sum = in_cksum(m, len);
2618
2619 /* Finish the IP header */
2620 h->ip_v = 4;
2621 h->ip_hl = sizeof (*h) >> 2;
2622 h->ip_tos = IPTOS_LOWDELAY;
2623 /*
2624 * ip_output() expects ip_len and ip_off to be in host order.
2625 */
2626 h->ip_len = len;
2627 h->ip_off = (path_mtu_discovery ? IP_DF : 0);
2628 h->ip_ttl = ttl ? ttl : ip_defttl;
2629 h->ip_sum = 0;
2630
2631 bzero(&ro, sizeof (ro));
2632 ip_output(m, NULL, &ro, 0, NULL, NULL);
2633 ROUTE_RELEASE(&ro);
2634 break;
2635 }
2636 #endif /* INET */
2637 #if INET6
2638 case AF_INET6: {
2639 struct route_in6 ro6;
2640
2641 /* TCP checksum */
2642 th->th_sum = in6_cksum(m, IPPROTO_TCP,
2643 sizeof (struct ip6_hdr), tlen);
2644
2645 h6->ip6_vfc |= IPV6_VERSION;
2646 h6->ip6_hlim = IPV6_DEFHLIM;
2647
2648 bzero(&ro6, sizeof (ro6));
2649 ip6_output(m, NULL, &ro6, 0, NULL, NULL, NULL);
2650 ROUTE_RELEASE(&ro6);
2651 break;
2652 }
2653 #endif /* INET6 */
2654 }
2655 }
2656
2657 static void
2658 pf_send_icmp(struct mbuf *m, u_int8_t type, u_int8_t code, sa_family_t af,
2659 struct pf_rule *r)
2660 {
2661 struct mbuf *m0;
2662 struct pf_mtag *pf_mtag;
2663
2664 m0 = m_copy(m, 0, M_COPYALL);
2665 if (m0 == NULL)
2666 return;
2667
2668 if ((pf_mtag = pf_get_mtag(m0)) == NULL)
2669 return;
2670
2671 pf_mtag->pftag_flags |= PF_TAG_GENERATED;
2672
2673 if (PF_RTABLEID_IS_VALID(r->rtableid))
2674 pf_mtag->pftag_rtableid = r->rtableid;
2675
2676 #if PF_ALTQ
2677 if (altq_allowed && r->qid)
2678 pf_mtag->pftag_qid = r->qid;
2679 #endif /* PF_ALTQ */
2680
2681 #if PF_ECN
2682 /* add hints for ecn */
2683 pf_mtag->pftag_hdr = mtod(m0, struct ip *);
2684 /* record address family */
2685 pf_mtag->pftag_flags &= ~(PF_TAG_HDR_INET | PF_TAG_HDR_INET6);
2686 switch (af) {
2687 #if INET
2688 case AF_INET:
2689 pf_mtag->pftag_flags |= PF_TAG_HDR_INET;
2690 m0->m_pkthdr.pkt_proto = IPPROTO_ICMP;
2691 break;
2692 #endif /* INET */
2693 #if INET6
2694 case AF_INET6:
2695 pf_mtag->pftag_flags |= PF_TAG_HDR_INET6;
2696 m0->m_pkthdr.pkt_proto = IPPROTO_ICMPV6;
2697 break;
2698 #endif /* INET6 */
2699 }
2700 #endif /* PF_ECN */
2701
2702 switch (af) {
2703 #if INET
2704 case AF_INET:
2705 icmp_error(m0, type, code, 0, 0);
2706 break;
2707 #endif /* INET */
2708 #if INET6
2709 case AF_INET6:
2710 icmp6_error(m0, type, code, 0);
2711 break;
2712 #endif /* INET6 */
2713 }
2714 }
2715
2716 /*
2717 * Return 1 if the addresses a and b match (with mask m), otherwise return 0.
2718 * If n is 0, they match if they are equal. If n is != 0, they match if they
2719 * are different.
2720 */
2721 int
2722 pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m,
2723 struct pf_addr *b, sa_family_t af)
2724 {
2725 int match = 0;
2726
2727 switch (af) {
2728 #if INET
2729 case AF_INET:
2730 if ((a->addr32[0] & m->addr32[0]) ==
2731 (b->addr32[0] & m->addr32[0]))
2732 match++;
2733 break;
2734 #endif /* INET */
2735 #if INET6
2736 case AF_INET6:
2737 if (((a->addr32[0] & m->addr32[0]) ==
2738 (b->addr32[0] & m->addr32[0])) &&
2739 ((a->addr32[1] & m->addr32[1]) ==
2740 (b->addr32[1] & m->addr32[1])) &&
2741 ((a->addr32[2] & m->addr32[2]) ==
2742 (b->addr32[2] & m->addr32[2])) &&
2743 ((a->addr32[3] & m->addr32[3]) ==
2744 (b->addr32[3] & m->addr32[3])))
2745 match++;
2746 break;
2747 #endif /* INET6 */
2748 }
2749 if (match) {
2750 if (n)
2751 return (0);
2752 else
2753 return (1);
2754 } else {
2755 if (n)
2756 return (1);
2757 else
2758 return (0);
2759 }
2760 }
2761
2762 /*
2763 * Return 1 if b <= a <= e, otherwise return 0.
2764 */
2765 int
2766 pf_match_addr_range(struct pf_addr *b, struct pf_addr *e,
2767 struct pf_addr *a, sa_family_t af)
2768 {
2769 switch (af) {
2770 #if INET
2771 case AF_INET:
2772 if ((a->addr32[0] < b->addr32[0]) ||
2773 (a->addr32[0] > e->addr32[0]))
2774 return (0);
2775 break;
2776 #endif /* INET */
2777 #if INET6
2778 case AF_INET6: {
2779 int i;
2780
2781 /* check a >= b */
2782 for (i = 0; i < 4; ++i)
2783 if (a->addr32[i] > b->addr32[i])
2784 break;
2785 else if (a->addr32[i] < b->addr32[i])
2786 return (0);
2787 /* check a <= e */
2788 for (i = 0; i < 4; ++i)
2789 if (a->addr32[i] < e->addr32[i])
2790 break;
2791 else if (a->addr32[i] > e->addr32[i])
2792 return (0);
2793 break;
2794 }
2795 #endif /* INET6 */
2796 }
2797 return (1);
2798 }
2799
2800 int
2801 pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p)
2802 {
2803 switch (op) {
2804 case PF_OP_IRG:
2805 return ((p > a1) && (p < a2));
2806 case PF_OP_XRG:
2807 return ((p < a1) || (p > a2));
2808 case PF_OP_RRG:
2809 return ((p >= a1) && (p <= a2));
2810 case PF_OP_EQ:
2811 return (p == a1);
2812 case PF_OP_NE:
2813 return (p != a1);
2814 case PF_OP_LT:
2815 return (p < a1);
2816 case PF_OP_LE:
2817 return (p <= a1);
2818 case PF_OP_GT:
2819 return (p > a1);
2820 case PF_OP_GE:
2821 return (p >= a1);
2822 }
2823 return (0); /* never reached */
2824 }
2825
2826 int
2827 pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p)
2828 {
2829 #if BYTE_ORDER != BIG_ENDIAN
2830 NTOHS(a1);
2831 NTOHS(a2);
2832 NTOHS(p);
2833 #endif
2834 return (pf_match(op, a1, a2, p));
2835 }
2836
2837 int
2838 pf_match_xport(u_int8_t proto, u_int8_t proto_variant, union pf_rule_xport *rx,
2839 union pf_state_xport *sx)
2840 {
2841 int d = !0;
2842
2843 if (sx) {
2844 switch (proto) {
2845 case IPPROTO_GRE:
2846 if (proto_variant == PF_GRE_PPTP_VARIANT)
2847 d = (rx->call_id == sx->call_id);
2848 break;
2849
2850 case IPPROTO_ESP:
2851 d = (rx->spi == sx->spi);
2852 break;
2853
2854 case IPPROTO_TCP:
2855 case IPPROTO_UDP:
2856 case IPPROTO_ICMP:
2857 case IPPROTO_ICMPV6:
2858 if (rx->range.op)
2859 d = pf_match_port(rx->range.op,
2860 rx->range.port[0], rx->range.port[1],
2861 sx->port);
2862 break;
2863
2864 default:
2865 break;
2866 }
2867 }
2868
2869 return (d);
2870 }
2871
2872 int
2873 pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u)
2874 {
2875 if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE)
2876 return (0);
2877 return (pf_match(op, a1, a2, u));
2878 }
2879
2880 int
2881 pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g)
2882 {
2883 if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE)
2884 return (0);
2885 return (pf_match(op, a1, a2, g));
2886 }
2887
2888 static int
2889 pf_match_tag(struct mbuf *m, struct pf_rule *r, struct pf_mtag *pf_mtag,
2890 int *tag)
2891 {
2892 #pragma unused(m)
2893 if (*tag == -1)
2894 *tag = pf_mtag->pftag_tag;
2895
2896 return ((!r->match_tag_not && r->match_tag == *tag) ||
2897 (r->match_tag_not && r->match_tag != *tag));
2898 }
2899
2900 int
2901 pf_tag_packet(struct mbuf *m, struct pf_mtag *pf_mtag, int tag,
2902 unsigned int rtableid, struct pf_pdesc *pd)
2903 {
2904 if (tag <= 0 && !PF_RTABLEID_IS_VALID(rtableid) &&
2905 (pd == NULL || !(pd->pktflags & PKTF_FLOW_ID)))
2906 return (0);
2907
2908 if (pf_mtag == NULL && (pf_mtag = pf_get_mtag(m)) == NULL)
2909 return (1);
2910
2911 if (tag > 0)
2912 pf_mtag->pftag_tag = tag;
2913 if (PF_RTABLEID_IS_VALID(rtableid))
2914 pf_mtag->pftag_rtableid = rtableid;
2915 if (pd != NULL && (pd->pktflags & PKTF_FLOW_ID)) {
2916 m->m_pkthdr.pkt_flowsrc = pd->flowsrc;
2917 m->m_pkthdr.pkt_flowid = pd->flowhash;
2918 m->m_pkthdr.pkt_flags |= pd->pktflags;
2919 m->m_pkthdr.pkt_proto = pd->proto;
2920 }
2921
2922 return (0);
2923 }
2924
2925 void
2926 pf_step_into_anchor(int *depth, struct pf_ruleset **rs, int n,
2927 struct pf_rule **r, struct pf_rule **a, int *match)
2928 {
2929 struct pf_anchor_stackframe *f;
2930
2931 (*r)->anchor->match = 0;
2932 if (match)
2933 *match = 0;
2934 if (*depth >= (int)sizeof (pf_anchor_stack) /
2935 (int)sizeof (pf_anchor_stack[0])) {
2936 printf("pf_step_into_anchor: stack overflow\n");
2937 *r = TAILQ_NEXT(*r, entries);
2938 return;
2939 } else if (*depth == 0 && a != NULL)
2940 *a = *r;
2941 f = pf_anchor_stack + (*depth)++;
2942 f->rs = *rs;
2943 f->r = *r;
2944 if ((*r)->anchor_wildcard) {
2945 f->parent = &(*r)->anchor->children;
2946 if ((f->child = RB_MIN(pf_anchor_node, f->parent)) ==
2947 NULL) {
2948 *r = NULL;
2949 return;
2950 }
2951 *rs = &f->child->ruleset;
2952 } else {
2953 f->parent = NULL;
2954 f->child = NULL;
2955 *rs = &(*r)->anchor->ruleset;
2956 }
2957 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
2958 }
2959
2960 int
2961 pf_step_out_of_anchor(int *depth, struct pf_ruleset **rs, int n,
2962 struct pf_rule **r, struct pf_rule **a, int *match)
2963 {
2964 struct pf_anchor_stackframe *f;
2965 int quick = 0;
2966
2967 do {
2968 if (*depth <= 0)
2969 break;
2970 f = pf_anchor_stack + *depth - 1;
2971 if (f->parent != NULL && f->child != NULL) {
2972 if (f->child->match ||
2973 (match != NULL && *match)) {
2974 f->r->anchor->match = 1;
2975 *match = 0;
2976 }
2977 f->child = RB_NEXT(pf_anchor_node, f->parent, f->child);
2978 if (f->child != NULL) {
2979 *rs = &f->child->ruleset;
2980 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
2981 if (*r == NULL)
2982 continue;
2983 else
2984 break;
2985 }
2986 }
2987 (*depth)--;
2988 if (*depth == 0 && a != NULL)
2989 *a = NULL;
2990 *rs = f->rs;
2991 if (f->r->anchor->match || (match != NULL && *match))
2992 quick = f->r->quick;
2993 *r = TAILQ_NEXT(f->r, entries);
2994 } while (*r == NULL);
2995
2996 return (quick);
2997 }
2998
2999 #if INET6
3000 void
3001 pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr,
3002 struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af)
3003 {
3004 switch (af) {
3005 #if INET
3006 case AF_INET:
3007 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
3008 ((rmask->addr32[0] ^ 0xffffffff) & saddr->addr32[0]);
3009 break;
3010 #endif /* INET */
3011 case AF_INET6:
3012 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
3013 ((rmask->addr32[0] ^ 0xffffffff) & saddr->addr32[0]);
3014 naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) |
3015 ((rmask->addr32[1] ^ 0xffffffff) & saddr->addr32[1]);
3016 naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) |
3017 ((rmask->addr32[2] ^ 0xffffffff) & saddr->addr32[2]);
3018 naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) |
3019 ((rmask->addr32[3] ^ 0xffffffff) & saddr->addr32[3]);
3020 break;
3021 }
3022 }
3023
3024 void
3025 pf_addr_inc(struct pf_addr *addr, sa_family_t af)
3026 {
3027 switch (af) {
3028 #if INET
3029 case AF_INET:
3030 addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1);
3031 break;
3032 #endif /* INET */
3033 case AF_INET6:
3034 if (addr->addr32[3] == 0xffffffff) {
3035 addr->addr32[3] = 0;
3036 if (addr->addr32[2] == 0xffffffff) {
3037 addr->addr32[2] = 0;
3038 if (addr->addr32[1] == 0xffffffff) {
3039 addr->addr32[1] = 0;
3040 addr->addr32[0] =
3041 htonl(ntohl(addr->addr32[0]) + 1);
3042 } else
3043 addr->addr32[1] =
3044 htonl(ntohl(addr->addr32[1]) + 1);
3045 } else
3046 addr->addr32[2] =
3047 htonl(ntohl(addr->addr32[2]) + 1);
3048 } else
3049 addr->addr32[3] =
3050 htonl(ntohl(addr->addr32[3]) + 1);
3051 break;
3052 }
3053 }
3054 #endif /* INET6 */
3055
3056 #define mix(a, b, c) \
3057 do { \
3058 a -= b; a -= c; a ^= (c >> 13); \
3059 b -= c; b -= a; b ^= (a << 8); \
3060 c -= a; c -= b; c ^= (b >> 13); \
3061 a -= b; a -= c; a ^= (c >> 12); \
3062 b -= c; b -= a; b ^= (a << 16); \
3063 c -= a; c -= b; c ^= (b >> 5); \
3064 a -= b; a -= c; a ^= (c >> 3); \
3065 b -= c; b -= a; b ^= (a << 10); \
3066 c -= a; c -= b; c ^= (b >> 15); \
3067 } while (0)
3068
3069 /*
3070 * hash function based on bridge_hash in if_bridge.c
3071 */
3072 static void
3073 pf_hash(struct pf_addr *inaddr, struct pf_addr *hash,
3074 struct pf_poolhashkey *key, sa_family_t af)
3075 {
3076 u_int32_t a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0];
3077
3078 switch (af) {
3079 #if INET
3080 case AF_INET:
3081 a += inaddr->addr32[0];
3082 b += key->key32[1];
3083 mix(a, b, c);
3084 hash->addr32[0] = c + key->key32[2];
3085 break;
3086 #endif /* INET */
3087 #if INET6
3088 case AF_INET6:
3089 a += inaddr->addr32[0];
3090 b += inaddr->addr32[2];
3091 mix(a, b, c);
3092 hash->addr32[0] = c;
3093 a += inaddr->addr32[1];
3094 b += inaddr->addr32[3];
3095 c += key->key32[1];
3096 mix(a, b, c);
3097 hash->addr32[1] = c;
3098 a += inaddr->addr32[2];
3099 b += inaddr->addr32[1];
3100 c += key->key32[2];
3101 mix(a, b, c);
3102 hash->addr32[2] = c;
3103 a += inaddr->addr32[3];
3104 b += inaddr->addr32[0];
3105 c += key->key32[3];
3106 mix(a, b, c);
3107 hash->addr32[3] = c;
3108 break;
3109 #endif /* INET6 */
3110 }
3111 }
3112
3113 static int
3114 pf_map_addr(sa_family_t af, struct pf_rule *r, struct pf_addr *saddr,
3115 struct pf_addr *naddr, struct pf_addr *init_addr, struct pf_src_node **sn)
3116 {
3117 unsigned char hash[16];
3118 struct pf_pool *rpool = &r->rpool;
3119 struct pf_addr *raddr = &rpool->cur->addr.v.a.addr;
3120 struct pf_addr *rmask = &rpool->cur->addr.v.a.mask;
3121 struct pf_pooladdr *acur = rpool->cur;
3122 struct pf_src_node k;
3123
3124 if (*sn == NULL && r->rpool.opts & PF_POOL_STICKYADDR &&
3125 (r->rpool.opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
3126 k.af = af;
3127 PF_ACPY(&k.addr, saddr, af);
3128 if (r->rule_flag & PFRULE_RULESRCTRACK ||
3129 r->rpool.opts & PF_POOL_STICKYADDR)
3130 k.rule.ptr = r;
3131 else
3132 k.rule.ptr = NULL;
3133 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
3134 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k);
3135 if (*sn != NULL && !PF_AZERO(&(*sn)->raddr, rpool->af)) {
3136 PF_ACPY(naddr, &(*sn)->raddr, rpool->af);
3137 if (pf_status.debug >= PF_DEBUG_MISC) {
3138 printf("pf_map_addr: src tracking maps ");
3139 pf_print_host(&k.addr, 0, af);
3140 printf(" to ");
3141 pf_print_host(naddr, 0, rpool->af);
3142 printf("\n");
3143 }
3144 return (0);
3145 }
3146 }
3147
3148 if (rpool->cur->addr.type == PF_ADDR_NOROUTE)
3149 return (1);
3150 if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
3151 if (rpool->cur->addr.p.dyn == NULL)
3152 return (1);
3153 switch (rpool->af) {
3154 #if INET
3155 case AF_INET:
3156 if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 &&
3157 (rpool->opts & PF_POOL_TYPEMASK) !=
3158 PF_POOL_ROUNDROBIN)
3159 return (1);
3160 raddr = &rpool->cur->addr.p.dyn->pfid_addr4;
3161 rmask = &rpool->cur->addr.p.dyn->pfid_mask4;
3162 break;
3163 #endif /* INET */
3164 #if INET6
3165 case AF_INET6:
3166 if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 &&
3167 (rpool->opts & PF_POOL_TYPEMASK) !=
3168 PF_POOL_ROUNDROBIN)
3169 return (1);
3170 raddr = &rpool->cur->addr.p.dyn->pfid_addr6;
3171 rmask = &rpool->cur->addr.p.dyn->pfid_mask6;
3172 break;
3173 #endif /* INET6 */
3174 }
3175 } else if (rpool->cur->addr.type == PF_ADDR_TABLE) {
3176 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN)
3177 return (1); /* unsupported */
3178 } else {
3179 raddr = &rpool->cur->addr.v.a.addr;
3180 rmask = &rpool->cur->addr.v.a.mask;
3181 }
3182
3183 switch (rpool->opts & PF_POOL_TYPEMASK) {
3184 case PF_POOL_NONE:
3185 PF_ACPY(naddr, raddr, rpool->af);
3186 break;
3187 case PF_POOL_BITMASK:
3188 ASSERT(af == rpool->af);
3189 PF_POOLMASK(naddr, raddr, rmask, saddr, af);
3190 break;
3191 case PF_POOL_RANDOM:
3192 if (init_addr != NULL && PF_AZERO(init_addr, rpool->af)) {
3193 switch (af) {
3194 #if INET
3195 case AF_INET:
3196 rpool->counter.addr32[0] = htonl(random());
3197 break;
3198 #endif /* INET */
3199 #if INET6
3200 case AF_INET6:
3201 if (rmask->addr32[3] != 0xffffffff)
3202 rpool->counter.addr32[3] =
3203 RandomULong();
3204 else
3205 break;
3206 if (rmask->addr32[2] != 0xffffffff)
3207 rpool->counter.addr32[2] =
3208 RandomULong();
3209 else
3210 break;
3211 if (rmask->addr32[1] != 0xffffffff)
3212 rpool->counter.addr32[1] =
3213 RandomULong();
3214 else
3215 break;
3216 if (rmask->addr32[0] != 0xffffffff)
3217 rpool->counter.addr32[0] =
3218 RandomULong();
3219 break;
3220 #endif /* INET6 */
3221 }
3222 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter,
3223 rpool->af);
3224 PF_ACPY(init_addr, naddr, rpool->af);
3225
3226 } else {
3227 PF_AINC(&rpool->counter, rpool->af);
3228 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter,
3229 rpool->af);
3230 }
3231 break;
3232 case PF_POOL_SRCHASH:
3233 ASSERT(af == rpool->af);
3234 PF_POOLMASK(naddr, raddr, rmask, saddr, af);
3235 pf_hash(saddr, (struct pf_addr *)(void *)&hash,
3236 &rpool->key, af);
3237 PF_POOLMASK(naddr, raddr, rmask,
3238 (struct pf_addr *)(void *)&hash, af);
3239 break;
3240 case PF_POOL_ROUNDROBIN:
3241 if (rpool->cur->addr.type == PF_ADDR_TABLE) {
3242 if (!pfr_pool_get(rpool->cur->addr.p.tbl,
3243 &rpool->tblidx, &rpool->counter,
3244 &raddr, &rmask, rpool->af))
3245 goto get_addr;
3246 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
3247 if (rpool->cur->addr.p.dyn != NULL &&
3248 !pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
3249 &rpool->tblidx, &rpool->counter,
3250 &raddr, &rmask, af))
3251 goto get_addr;
3252 } else if (pf_match_addr(0, raddr, rmask, &rpool->counter,
3253 rpool->af))
3254 goto get_addr;
3255
3256 try_next:
3257 if ((rpool->cur = TAILQ_NEXT(rpool->cur, entries)) == NULL)
3258 rpool->cur = TAILQ_FIRST(&rpool->list);
3259 if (rpool->cur->addr.type == PF_ADDR_TABLE) {
3260 rpool->tblidx = -1;
3261 if (pfr_pool_get(rpool->cur->addr.p.tbl,
3262 &rpool->tblidx, &rpool->counter,
3263 &raddr, &rmask, rpool->af)) {
3264 /* table contains no address of type
3265 * 'rpool->af' */
3266 if (rpool->cur != acur)
3267 goto try_next;
3268 return (1);
3269 }
3270 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
3271 rpool->tblidx = -1;
3272 if (rpool->cur->addr.p.dyn == NULL)
3273 return (1);
3274 if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
3275 &rpool->tblidx, &rpool->counter,
3276 &raddr, &rmask, rpool->af)) {
3277 /* table contains no address of type
3278 * 'rpool->af' */
3279 if (rpool->cur != acur)
3280 goto try_next;
3281 return (1);
3282 }
3283 } else {
3284 raddr = &rpool->cur->addr.v.a.addr;
3285 rmask = &rpool->cur->addr.v.a.mask;
3286 PF_ACPY(&rpool->counter, raddr, rpool->af);
3287 }
3288
3289 get_addr:
3290 PF_ACPY(naddr, &rpool->counter, rpool->af);
3291 if (init_addr != NULL && PF_AZERO(init_addr, rpool->af))
3292 PF_ACPY(init_addr, naddr, rpool->af);
3293 PF_AINC(&rpool->counter, rpool->af);
3294 break;
3295 }
3296 if (*sn != NULL)
3297 PF_ACPY(&(*sn)->raddr, naddr, rpool->af);
3298
3299 if (pf_status.debug >= PF_DEBUG_MISC &&
3300 (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
3301 printf("pf_map_addr: selected address ");
3302 pf_print_host(naddr, 0, rpool->af);
3303 printf("\n");
3304 }
3305
3306 return (0);
3307 }
3308
3309 static int
3310 pf_get_sport(struct pf_pdesc *pd, struct pfi_kif *kif, struct pf_rule *r,
3311 struct pf_addr *saddr, union pf_state_xport *sxport, struct pf_addr *daddr,
3312 union pf_state_xport *dxport, struct pf_addr *naddr,
3313 union pf_state_xport *nxport, struct pf_src_node **sn)
3314 {
3315 #pragma unused(kif)
3316 struct pf_state_key_cmp key;
3317 struct pf_addr init_addr;
3318 unsigned int cut;
3319 sa_family_t af = pd->af;
3320 u_int8_t proto = pd->proto;
3321 unsigned int low = r->rpool.proxy_port[0];
3322 unsigned int high = r->rpool.proxy_port[1];
3323
3324 bzero(&init_addr, sizeof (init_addr));
3325 if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn))
3326 return (1);
3327
3328 if (proto == IPPROTO_ICMP) {
3329 low = 1;
3330 high = 65535;
3331 }
3332
3333 if (!nxport)
3334 return (0); /* No output necessary. */
3335
3336 /*--- Special mapping rules for UDP ---*/
3337 if (proto == IPPROTO_UDP) {
3338
3339 /*--- Never float IKE source port ---*/
3340 if (ntohs(sxport->port) == PF_IKE_PORT) {
3341 nxport->port = sxport->port;
3342 return (0);
3343 }
3344
3345 /*--- Apply exterior mapping options ---*/
3346 if (r->extmap > PF_EXTMAP_APD) {
3347 struct pf_state *s;
3348
3349 TAILQ_FOREACH(s, &state_list, entry_list) {
3350 struct pf_state_key *sk = s->state_key;
3351 if (!sk)
3352 continue;
3353 if (s->nat_rule.ptr != r)
3354 continue;
3355 if (sk->proto != IPPROTO_UDP ||
3356 sk->af_lan != af)
3357 continue;
3358 if (sk->lan.xport.port != sxport->port)
3359 continue;
3360 if (PF_ANEQ(&sk->lan.addr, saddr, af))
3361 continue;
3362 if (r->extmap < PF_EXTMAP_EI &&
3363 PF_ANEQ(&sk->ext_lan.addr, daddr, af))
3364 continue;
3365
3366 nxport->port = sk->gwy.xport.port;
3367 return (0);
3368 }
3369 }
3370 } else if (proto == IPPROTO_TCP) {
3371 struct pf_state* s;
3372 /*
3373 * APPLE MODIFICATION: <rdar://problem/6546358>
3374 * Fix allows....NAT to use a single binding for TCP session
3375 * with same source IP and source port
3376 */
3377 TAILQ_FOREACH(s, &state_list, entry_list) {
3378 struct pf_state_key* sk = s->state_key;
3379 if (!sk)
3380 continue;
3381 if (s->nat_rule.ptr != r)
3382 continue;
3383 if (sk->proto != IPPROTO_TCP || sk->af_lan != af)
3384 continue;
3385 if (sk->lan.xport.port != sxport->port)
3386 continue;
3387 if (!(PF_AEQ(&sk->lan.addr, saddr, af)))
3388 continue;
3389 nxport->port = sk->gwy.xport.port;
3390 return (0);
3391 }
3392 }
3393 do {
3394 key.af_gwy = af;
3395 key.proto = proto;
3396 PF_ACPY(&key.ext_gwy.addr, daddr, key.af_gwy);
3397 PF_ACPY(&key.gwy.addr, naddr, key.af_gwy);
3398 switch (proto) {
3399 case IPPROTO_UDP:
3400 key.proto_variant = r->extfilter;
3401 break;
3402 default:
3403 key.proto_variant = 0;
3404 break;
3405 }
3406 if (dxport)
3407 key.ext_gwy.xport = *dxport;
3408 else
3409 memset(&key.ext_gwy.xport, 0,
3410 sizeof (key.ext_gwy.xport));
3411 /*
3412 * port search; start random, step;
3413 * similar 2 portloop in in_pcbbind
3414 */
3415 if (!(proto == IPPROTO_TCP || proto == IPPROTO_UDP ||
3416 proto == IPPROTO_ICMP)) {
3417 if (dxport)
3418 key.gwy.xport = *dxport;
3419 else
3420 memset(&key.gwy.xport, 0,
3421 sizeof (key.gwy.xport));
3422 if (pf_find_state_all(&key, PF_IN, NULL) == NULL)
3423 return (0);
3424 } else if (low == 0 && high == 0) {
3425 key.gwy.xport = *nxport;
3426 if (pf_find_state_all(&key, PF_IN, NULL) == NULL)
3427 return (0);
3428 } else if (low == high) {
3429 key.gwy.xport.port = htons(low);
3430 if (pf_find_state_all(&key, PF_IN, NULL) == NULL) {
3431 nxport->port = htons(low);
3432 return (0);
3433 }
3434 } else {
3435 unsigned int tmp;
3436 if (low > high) {
3437 tmp = low;
3438 low = high;
3439 high = tmp;
3440 }
3441 /* low < high */
3442 cut = htonl(random()) % (1 + high - low) + low;
3443 /* low <= cut <= high */
3444 for (tmp = cut; tmp <= high; ++(tmp)) {
3445 key.gwy.xport.port = htons(tmp);
3446 if (pf_find_state_all(&key, PF_IN, NULL) ==
3447 NULL) {
3448 nxport->port = htons(tmp);
3449 return (0);
3450 }
3451 }
3452 for (tmp = cut - 1; tmp >= low; --(tmp)) {
3453 key.gwy.xport.port = htons(tmp);
3454 if (pf_find_state_all(&key, PF_IN, NULL) ==
3455 NULL) {
3456 nxport->port = htons(tmp);
3457 return (0);
3458 }
3459 }
3460 }
3461
3462 switch (r->rpool.opts & PF_POOL_TYPEMASK) {
3463 case PF_POOL_RANDOM:
3464 case PF_POOL_ROUNDROBIN:
3465 if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn))
3466 return (1);
3467 break;
3468 case PF_POOL_NONE:
3469 case PF_POOL_SRCHASH:
3470 case PF_POOL_BITMASK:
3471 default:
3472 return (1);
3473 }
3474 } while (!PF_AEQ(&init_addr, naddr, af));
3475
3476 return (1); /* none available */
3477 }
3478
3479 static struct pf_rule *
3480 pf_match_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
3481 int direction, struct pfi_kif *kif, struct pf_addr *saddr,
3482 union pf_state_xport *sxport, struct pf_addr *daddr,
3483 union pf_state_xport *dxport, int rs_num)
3484 {
3485 struct pf_rule *r, *rm = NULL;
3486 struct pf_ruleset *ruleset = NULL;
3487 int tag = -1;
3488 unsigned int rtableid = IFSCOPE_NONE;
3489 int asd = 0;
3490
3491 r = TAILQ_FIRST(pf_main_ruleset.rules[rs_num].active.ptr);
3492 while (r && rm == NULL) {
3493 struct pf_rule_addr *src = NULL, *dst = NULL;
3494 struct pf_addr_wrap *xdst = NULL;
3495 struct pf_addr_wrap *xsrc = NULL;
3496 union pf_rule_xport rdrxport;
3497
3498 if (r->action == PF_BINAT && direction == PF_IN) {
3499 src = &r->dst;
3500 if (r->rpool.cur != NULL)
3501 xdst = &r->rpool.cur->addr;
3502 } else if (r->action == PF_RDR && direction == PF_OUT) {
3503 dst = &r->src;
3504 src = &r->dst;
3505 if (r->rpool.cur != NULL) {
3506 rdrxport.range.op = PF_OP_EQ;
3507 rdrxport.range.port[0] =
3508 htons(r->rpool.proxy_port[0]);
3509 xsrc = &r->rpool.cur->addr;
3510 }
3511 } else {
3512 src = &r->src;
3513 dst = &r->dst;
3514 }
3515
3516 r->evaluations++;
3517 if (pfi_kif_match(r->kif, kif) == r->ifnot)
3518 r = r->skip[PF_SKIP_IFP].ptr;
3519 else if (r->direction && r->direction != direction)
3520 r = r->skip[PF_SKIP_DIR].ptr;
3521 else if (r->af && r->af != pd->af)
3522 r = r->skip[PF_SKIP_AF].ptr;
3523 else if (r->proto && r->proto != pd->proto)
3524 r = r->skip[PF_SKIP_PROTO].ptr;
3525 else if (xsrc && PF_MISMATCHAW(xsrc, saddr, pd->af, 0, NULL))
3526 r = TAILQ_NEXT(r, entries);
3527 else if (!xsrc && PF_MISMATCHAW(&src->addr, saddr, pd->af,
3528 src->neg, kif))
3529 r = TAILQ_NEXT(r, entries);
3530 else if (xsrc && (!rdrxport.range.port[0] ||
3531 !pf_match_xport(r->proto, r->proto_variant, &rdrxport,
3532 sxport)))
3533 r = TAILQ_NEXT(r, entries);
3534 else if (!xsrc && !pf_match_xport(r->proto,
3535 r->proto_variant, &src->xport, sxport))
3536 r = r->skip[src == &r->src ? PF_SKIP_SRC_PORT :
3537 PF_SKIP_DST_PORT].ptr;
3538 else if (dst != NULL &&
3539 PF_MISMATCHAW(&dst->addr, daddr, pd->af, dst->neg, NULL))
3540 r = r->skip[PF_SKIP_DST_ADDR].ptr;
3541 else if (xdst != NULL && PF_MISMATCHAW(xdst, daddr, pd->af,
3542 0, NULL))
3543 r = TAILQ_NEXT(r, entries);
3544 else if (dst && !pf_match_xport(r->proto, r->proto_variant,
3545 &dst->xport, dxport))
3546 r = r->skip[PF_SKIP_DST_PORT].ptr;
3547 else if (r->match_tag && !pf_match_tag(m, r, pd->pf_mtag, &tag))
3548 r = TAILQ_NEXT(r, entries);
3549 else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto !=
3550 IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, m,
3551 off, pd->hdr.tcp), r->os_fingerprint)))
3552 r = TAILQ_NEXT(r, entries);
3553 else {
3554 if (r->tag)
3555 tag = r->tag;
3556 if (PF_RTABLEID_IS_VALID(r->rtableid))
3557 rtableid = r->rtableid;
3558 if (r->anchor == NULL) {
3559 rm = r;
3560 } else
3561 pf_step_into_anchor(&asd, &ruleset, rs_num,
3562 &r, NULL, NULL);
3563 }
3564 if (r == NULL)
3565 pf_step_out_of_anchor(&asd, &ruleset, rs_num, &r,
3566 NULL, NULL);
3567 }
3568 if (pf_tag_packet(m, pd->pf_mtag, tag, rtableid, NULL))
3569 return (NULL);
3570 if (rm != NULL && (rm->action == PF_NONAT ||
3571 rm->action == PF_NORDR || rm->action == PF_NOBINAT ||
3572 rm->action == PF_NONAT64))
3573 return (NULL);
3574 return (rm);
3575 }
3576
3577 /*
3578 * Get address translation information for NAT/BINAT/RDR
3579 * pd : pf packet descriptor
3580 * m : mbuf holding the packet
3581 * off : offset to protocol header
3582 * direction : direction of packet
3583 * kif : pf interface info obtained from the packet's recv interface
3584 * sn : source node pointer (output)
3585 * saddr : packet source address
3586 * sxport : packet source port
3587 * daddr : packet destination address
3588 * dxport : packet destination port
3589 * nsxport : translated source port (output)
3590 *
3591 * Translated source & destination address are updated in pd->nsaddr &
3592 * pd->ndaddr
3593 */
3594 static struct pf_rule *
3595 pf_get_translation_aux(struct pf_pdesc *pd, struct mbuf *m, int off,
3596 int direction, struct pfi_kif *kif, struct pf_src_node **sn,
3597 struct pf_addr *saddr, union pf_state_xport *sxport, struct pf_addr *daddr,
3598 union pf_state_xport *dxport, union pf_state_xport *nsxport)
3599 {
3600 struct pf_rule *r = NULL;
3601 pd->naf = pd->af;
3602
3603 if (direction == PF_OUT) {
3604 r = pf_match_translation(pd, m, off, direction, kif, saddr,
3605 sxport, daddr, dxport, PF_RULESET_BINAT);
3606 if (r == NULL)
3607 r = pf_match_translation(pd, m, off, direction, kif,
3608 saddr, sxport, daddr, dxport, PF_RULESET_RDR);
3609 if (r == NULL)
3610 r = pf_match_translation(pd, m, off, direction, kif,
3611 saddr, sxport, daddr, dxport, PF_RULESET_NAT);
3612 } else {
3613 r = pf_match_translation(pd, m, off, direction, kif, saddr,
3614 sxport, daddr, dxport, PF_RULESET_RDR);
3615 if (r == NULL)
3616 r = pf_match_translation(pd, m, off, direction, kif,
3617 saddr, sxport, daddr, dxport, PF_RULESET_BINAT);
3618 }
3619
3620 if (r != NULL) {
3621 struct pf_addr *nsaddr = &pd->naddr;
3622 struct pf_addr *ndaddr = &pd->ndaddr;
3623
3624 *nsaddr = *saddr;
3625 *ndaddr = *daddr;
3626
3627 switch (r->action) {
3628 case PF_NONAT:
3629 case PF_NONAT64:
3630 case PF_NOBINAT:
3631 case PF_NORDR:
3632 return (NULL);
3633 case PF_NAT:
3634 case PF_NAT64:
3635 /*
3636 * we do NAT64 on incoming path and we call ip_input
3637 * which asserts receive interface to be not NULL.
3638 * The below check is to prevent NAT64 action on any
3639 * packet generated by local entity using synthesized
3640 * IPv6 address.
3641 */
3642 if ((r->action == PF_NAT64) && (direction == PF_OUT))
3643 return (NULL);
3644
3645 if (pf_get_sport(pd, kif, r, saddr, sxport, daddr,
3646 dxport, nsaddr, nsxport, sn)) {
3647 DPFPRINTF(PF_DEBUG_MISC,
3648 ("pf: NAT proxy port allocation "
3649 "(%u-%u) failed\n",
3650 r->rpool.proxy_port[0],
3651 r->rpool.proxy_port[1]));
3652 return (NULL);
3653 }
3654 /*
3655 * For NAT64 the destination IPv4 address is derived
3656 * from the last 32 bits of synthesized IPv6 address
3657 */
3658 if (r->action == PF_NAT64) {
3659 ndaddr->v4.s_addr = daddr->addr32[3];
3660 pd->naf = AF_INET;
3661 }
3662 break;
3663 case PF_BINAT:
3664 switch (direction) {
3665 case PF_OUT:
3666 if (r->rpool.cur->addr.type ==
3667 PF_ADDR_DYNIFTL) {
3668 if (r->rpool.cur->addr.p.dyn == NULL)
3669 return (NULL);
3670 switch (pd->af) {
3671 #if INET
3672 case AF_INET:
3673 if (r->rpool.cur->addr.p.dyn->
3674 pfid_acnt4 < 1)
3675 return (NULL);
3676 PF_POOLMASK(nsaddr,
3677 &r->rpool.cur->addr.p.dyn->
3678 pfid_addr4,
3679 &r->rpool.cur->addr.p.dyn->
3680 pfid_mask4,
3681 saddr, AF_INET);
3682 break;
3683 #endif /* INET */
3684 #if INET6
3685 case AF_INET6:
3686 if (r->rpool.cur->addr.p.dyn->
3687 pfid_acnt6 < 1)
3688 return (NULL);
3689 PF_POOLMASK(nsaddr,
3690 &r->rpool.cur->addr.p.dyn->
3691 pfid_addr6,
3692 &r->rpool.cur->addr.p.dyn->
3693 pfid_mask6,
3694 saddr, AF_INET6);
3695 break;
3696 #endif /* INET6 */
3697 }
3698 } else {
3699 PF_POOLMASK(nsaddr,
3700 &r->rpool.cur->addr.v.a.addr,
3701 &r->rpool.cur->addr.v.a.mask,
3702 saddr, pd->af);
3703 }
3704 break;
3705 case PF_IN:
3706 if (r->src.addr.type == PF_ADDR_DYNIFTL) {
3707 if (r->src.addr.p.dyn == NULL)
3708 return (NULL);
3709 switch (pd->af) {
3710 #if INET
3711 case AF_INET:
3712 if (r->src.addr.p.dyn->
3713 pfid_acnt4 < 1)
3714 return (NULL);
3715 PF_POOLMASK(ndaddr,
3716 &r->src.addr.p.dyn->
3717 pfid_addr4,
3718 &r->src.addr.p.dyn->
3719 pfid_mask4,
3720 daddr, AF_INET);
3721 break;
3722 #endif /* INET */
3723 #if INET6
3724 case AF_INET6:
3725 if (r->src.addr.p.dyn->
3726 pfid_acnt6 < 1)
3727 return (NULL);
3728 PF_POOLMASK(ndaddr,
3729 &r->src.addr.p.dyn->
3730 pfid_addr6,
3731 &r->src.addr.p.dyn->
3732 pfid_mask6,
3733 daddr, AF_INET6);
3734 break;
3735 #endif /* INET6 */
3736 }
3737 } else
3738 PF_POOLMASK(ndaddr,
3739 &r->src.addr.v.a.addr,
3740 &r->src.addr.v.a.mask, daddr,
3741 pd->af);
3742 break;
3743 }
3744 break;
3745 case PF_RDR: {
3746 switch (direction) {
3747 case PF_OUT:
3748 if (r->dst.addr.type == PF_ADDR_DYNIFTL) {
3749 if (r->dst.addr.p.dyn == NULL)
3750 return (NULL);
3751 switch (pd->af) {
3752 #if INET
3753 case AF_INET:
3754 if (r->dst.addr.p.dyn->
3755 pfid_acnt4 < 1)
3756 return (NULL);
3757 PF_POOLMASK(nsaddr,
3758 &r->dst.addr.p.dyn->
3759 pfid_addr4,
3760 &r->dst.addr.p.dyn->
3761 pfid_mask4,
3762 daddr, AF_INET);
3763 break;
3764 #endif /* INET */
3765 #if INET6
3766 case AF_INET6:
3767 if (r->dst.addr.p.dyn->
3768 pfid_acnt6 < 1)
3769 return (NULL);
3770 PF_POOLMASK(nsaddr,
3771 &r->dst.addr.p.dyn->
3772 pfid_addr6,
3773 &r->dst.addr.p.dyn->
3774 pfid_mask6,
3775 daddr, AF_INET6);
3776 break;
3777 #endif /* INET6 */
3778 }
3779 } else {
3780 PF_POOLMASK(nsaddr,
3781 &r->dst.addr.v.a.addr,
3782 &r->dst.addr.v.a.mask,
3783 daddr, pd->af);
3784 }
3785 if (nsxport && r->dst.xport.range.port[0])
3786 nsxport->port =
3787 r->dst.xport.range.port[0];
3788 break;
3789 case PF_IN:
3790 if (pf_map_addr(pd->af, r, saddr,
3791 ndaddr, NULL, sn))
3792 return (NULL);
3793 if ((r->rpool.opts & PF_POOL_TYPEMASK) ==
3794 PF_POOL_BITMASK)
3795 PF_POOLMASK(ndaddr, ndaddr,
3796 &r->rpool.cur->addr.v.a.mask, daddr,
3797 pd->af);
3798
3799 if (nsxport && dxport) {
3800 if (r->rpool.proxy_port[1]) {
3801 u_int32_t tmp_nport;
3802
3803 tmp_nport =
3804 ((ntohs(dxport->port) -
3805 ntohs(r->dst.xport.range.
3806 port[0])) %
3807 (r->rpool.proxy_port[1] -
3808 r->rpool.proxy_port[0] +
3809 1)) + r->rpool.proxy_port[0];
3810
3811 /* wrap around if necessary */
3812 if (tmp_nport > 65535)
3813 tmp_nport -= 65535;
3814 nsxport->port =
3815 htons((u_int16_t)tmp_nport);
3816 } else if (r->rpool.proxy_port[0]) {
3817 nsxport->port = htons(r->rpool.
3818 proxy_port[0]);
3819 }
3820 }
3821 break;
3822 }
3823 break;
3824 }
3825 default:
3826 return (NULL);
3827 }
3828 }
3829
3830 return (r);
3831 }
3832
3833 int
3834 pf_socket_lookup(int direction, struct pf_pdesc *pd)
3835 {
3836 struct pf_addr *saddr, *daddr;
3837 u_int16_t sport, dport;
3838 struct inpcbinfo *pi;
3839 int inp = 0;
3840
3841 if (pd == NULL)
3842 return (-1);
3843 pd->lookup.uid = UID_MAX;
3844 pd->lookup.gid = GID_MAX;
3845 pd->lookup.pid = NO_PID;
3846
3847 switch (pd->proto) {
3848 case IPPROTO_TCP:
3849 if (pd->hdr.tcp == NULL)
3850 return (-1);
3851 sport = pd->hdr.tcp->th_sport;
3852 dport = pd->hdr.tcp->th_dport;
3853 pi = &tcbinfo;
3854 break;
3855 case IPPROTO_UDP:
3856 if (pd->hdr.udp == NULL)
3857 return (-1);
3858 sport = pd->hdr.udp->uh_sport;
3859 dport = pd->hdr.udp->uh_dport;
3860 pi = &udbinfo;
3861 break;
3862 default:
3863 return (-1);
3864 }
3865 if (direction == PF_IN) {
3866 saddr = pd->src;
3867 daddr = pd->dst;
3868 } else {
3869 u_int16_t p;
3870
3871 p = sport;
3872 sport = dport;
3873 dport = p;
3874 saddr = pd->dst;
3875 daddr = pd->src;
3876 }
3877 switch (pd->af) {
3878 #if INET
3879 case AF_INET:
3880 inp = in_pcblookup_hash_exists(pi, saddr->v4, sport, daddr->v4, dport,
3881 0, &pd->lookup.uid, &pd->lookup.gid, NULL);
3882 #if INET6
3883 if (inp == 0) {
3884 struct in6_addr s6, d6;
3885
3886 memset(&s6, 0, sizeof (s6));
3887 s6.s6_addr16[5] = htons(0xffff);
3888 memcpy(&s6.s6_addr32[3], &saddr->v4,
3889 sizeof (saddr->v4));
3890
3891 memset(&d6, 0, sizeof (d6));
3892 d6.s6_addr16[5] = htons(0xffff);
3893 memcpy(&d6.s6_addr32[3], &daddr->v4,
3894 sizeof (daddr->v4));
3895
3896 inp = in6_pcblookup_hash_exists(pi, &s6, sport,
3897 &d6, dport, 0, &pd->lookup.uid, &pd->lookup.gid, NULL);
3898 if (inp == 0) {
3899 inp = in_pcblookup_hash_exists(pi, saddr->v4, sport,
3900 daddr->v4, dport, INPLOOKUP_WILDCARD, &pd->lookup.uid, &pd->lookup.gid, NULL);
3901 if (inp == 0) {
3902 inp = in6_pcblookup_hash_exists(pi, &s6, sport,
3903 &d6, dport, INPLOOKUP_WILDCARD,
3904 &pd->lookup.uid, &pd->lookup.gid, NULL);
3905 if (inp == 0)
3906 return (-1);
3907 }
3908 }
3909 }
3910 #else
3911 if (inp == 0) {
3912 inp = in_pcblookup_hash_exists(pi, saddr->v4, sport,
3913 daddr->v4, dport, INPLOOKUP_WILDCARD,
3914 &pd->lookup.uid, &pd->lookup.gid, NULL);
3915 if (inp == 0)
3916 return (-1);
3917 }
3918 #endif /* !INET6 */
3919 break;
3920 #endif /* INET */
3921 #if INET6
3922 case AF_INET6:
3923 inp = in6_pcblookup_hash_exists(pi, &saddr->v6, sport, &daddr->v6,
3924 dport, 0, &pd->lookup.uid, &pd->lookup.gid, NULL);
3925 if (inp == 0) {
3926 inp = in6_pcblookup_hash_exists(pi, &saddr->v6, sport,
3927 &daddr->v6, dport, INPLOOKUP_WILDCARD,
3928 &pd->lookup.uid, &pd->lookup.gid, NULL);
3929 if (inp == 0)
3930 return (-1);
3931 }
3932 break;
3933 #endif /* INET6 */
3934
3935 default:
3936 return (-1);
3937 }
3938
3939 return (1);
3940 }
3941
3942 static u_int8_t
3943 pf_get_wscale(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af)
3944 {
3945 int hlen;
3946 u_int8_t hdr[60];
3947 u_int8_t *opt, optlen;
3948 u_int8_t wscale = 0;
3949
3950 hlen = th_off << 2; /* hlen <= sizeof (hdr) */
3951 if (hlen <= (int)sizeof (struct tcphdr))
3952 return (0);
3953 if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af))
3954 return (0);
3955 opt = hdr + sizeof (struct tcphdr);
3956 hlen -= sizeof (struct tcphdr);
3957 while (hlen >= 3) {
3958 switch (*opt) {
3959 case TCPOPT_EOL:
3960 case TCPOPT_NOP:
3961 ++opt;
3962 --hlen;
3963 break;
3964 case TCPOPT_WINDOW:
3965 wscale = opt[2];
3966 if (wscale > TCP_MAX_WINSHIFT)
3967 wscale = TCP_MAX_WINSHIFT;
3968 wscale |= PF_WSCALE_FLAG;
3969 /* FALLTHROUGH */
3970 default:
3971 optlen = opt[1];
3972 if (optlen < 2)
3973 optlen = 2;
3974 hlen -= optlen;
3975 opt += optlen;
3976 break;
3977 }
3978 }
3979 return (wscale);
3980 }
3981
3982 static u_int16_t
3983 pf_get_mss(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af)
3984 {
3985 int hlen;
3986 u_int8_t hdr[60];
3987 u_int8_t *opt, optlen;
3988 u_int16_t mss = tcp_mssdflt;
3989
3990 hlen = th_off << 2; /* hlen <= sizeof (hdr) */
3991 if (hlen <= (int)sizeof (struct tcphdr))
3992 return (0);
3993 if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af))
3994 return (0);
3995 opt = hdr + sizeof (struct tcphdr);
3996 hlen -= sizeof (struct tcphdr);
3997 while (hlen >= TCPOLEN_MAXSEG) {
3998 switch (*opt) {
3999 case TCPOPT_EOL:
4000 case TCPOPT_NOP:
4001 ++opt;
4002 --hlen;
4003 break;
4004 case TCPOPT_MAXSEG:
4005 bcopy((caddr_t)(opt + 2), (caddr_t)&mss, 2);
4006 #if BYTE_ORDER != BIG_ENDIAN
4007 NTOHS(mss);
4008 #endif
4009 /* FALLTHROUGH */
4010 default:
4011 optlen = opt[1];
4012 if (optlen < 2)
4013 optlen = 2;
4014 hlen -= optlen;
4015 opt += optlen;
4016 break;
4017 }
4018 }
4019 return (mss);
4020 }
4021
4022 static u_int16_t
4023 pf_calc_mss(struct pf_addr *addr, sa_family_t af, u_int16_t offer)
4024 {
4025 #if INET
4026 struct sockaddr_in *dst;
4027 struct route ro;
4028 #endif /* INET */
4029 #if INET6
4030 struct sockaddr_in6 *dst6;
4031 struct route_in6 ro6;
4032 #endif /* INET6 */
4033 struct rtentry *rt = NULL;
4034 int hlen;
4035 u_int16_t mss = tcp_mssdflt;
4036
4037 switch (af) {
4038 #if INET
4039 case AF_INET:
4040 hlen = sizeof (struct ip);
4041 bzero(&ro, sizeof (ro));
4042 dst = (struct sockaddr_in *)(void *)&ro.ro_dst;
4043 dst->sin_family = AF_INET;
4044 dst->sin_len = sizeof (*dst);
4045 dst->sin_addr = addr->v4;
4046 rtalloc(&ro);
4047 rt = ro.ro_rt;
4048 break;
4049 #endif /* INET */
4050 #if INET6
4051 case AF_INET6:
4052 hlen = sizeof (struct ip6_hdr);
4053 bzero(&ro6, sizeof (ro6));
4054 dst6 = (struct sockaddr_in6 *)(void *)&ro6.ro_dst;
4055 dst6->sin6_family = AF_INET6;
4056 dst6->sin6_len = sizeof (*dst6);
4057 dst6->sin6_addr = addr->v6;
4058 rtalloc((struct route *)&ro);
4059 rt = ro6.ro_rt;
4060 break;
4061 #endif /* INET6 */
4062 default:
4063 panic("pf_calc_mss: not AF_INET or AF_INET6!");
4064 return (0);
4065 }
4066
4067 if (rt && rt->rt_ifp) {
4068 mss = rt->rt_ifp->if_mtu - hlen - sizeof (struct tcphdr);
4069 mss = max(tcp_mssdflt, mss);
4070 rtfree(rt);
4071 }
4072 mss = min(mss, offer);
4073 mss = max(mss, 64); /* sanity - at least max opt space */
4074 return (mss);
4075 }
4076
4077 static void
4078 pf_set_rt_ifp(struct pf_state *s, struct pf_addr *saddr, sa_family_t af)
4079 {
4080 struct pf_rule *r = s->rule.ptr;
4081
4082 s->rt_kif = NULL;
4083
4084 if (!r->rt || r->rt == PF_FASTROUTE)
4085 return;
4086 if ((af == AF_INET) || (af == AF_INET6)) {
4087 pf_map_addr(af, r, saddr, &s->rt_addr, NULL,
4088 &s->nat_src_node);
4089 s->rt_kif = r->rpool.cur->kif;
4090 }
4091
4092 return;
4093 }
4094
4095 static void
4096 pf_attach_state(struct pf_state_key *sk, struct pf_state *s, int tail)
4097 {
4098 s->state_key = sk;
4099 sk->refcnt++;
4100
4101 /* list is sorted, if-bound states before floating */
4102 if (tail)
4103 TAILQ_INSERT_TAIL(&sk->states, s, next);
4104 else
4105 TAILQ_INSERT_HEAD(&sk->states, s, next);
4106 }
4107
4108 static void
4109 pf_detach_state(struct pf_state *s, int flags)
4110 {
4111 struct pf_state_key *sk = s->state_key;
4112
4113 if (sk == NULL)
4114 return;
4115
4116 s->state_key = NULL;
4117 TAILQ_REMOVE(&sk->states, s, next);
4118 if (--sk->refcnt == 0) {
4119 if (!(flags & PF_DT_SKIP_EXTGWY))
4120 RB_REMOVE(pf_state_tree_ext_gwy,
4121 &pf_statetbl_ext_gwy, sk);
4122 if (!(flags & PF_DT_SKIP_LANEXT))
4123 RB_REMOVE(pf_state_tree_lan_ext,
4124 &pf_statetbl_lan_ext, sk);
4125 if (sk->app_state)
4126 pool_put(&pf_app_state_pl, sk->app_state);
4127 pool_put(&pf_state_key_pl, sk);
4128 }
4129 }
4130
4131 struct pf_state_key *
4132 pf_alloc_state_key(struct pf_state *s, struct pf_state_key *psk)
4133 {
4134 struct pf_state_key *sk;
4135
4136 if ((sk = pool_get(&pf_state_key_pl, PR_WAITOK)) == NULL)
4137 return (NULL);
4138 bzero(sk, sizeof (*sk));
4139 TAILQ_INIT(&sk->states);
4140 pf_attach_state(sk, s, 0);
4141
4142 /* initialize state key from psk, if provided */
4143 if (psk != NULL) {
4144 bcopy(&psk->lan, &sk->lan, sizeof (sk->lan));
4145 bcopy(&psk->gwy, &sk->gwy, sizeof (sk->gwy));
4146 bcopy(&psk->ext_lan, &sk->ext_lan, sizeof (sk->ext_lan));
4147 bcopy(&psk->ext_gwy, &sk->ext_gwy, sizeof (sk->ext_gwy));
4148 sk->af_lan = psk->af_lan;
4149 sk->af_gwy = psk->af_gwy;
4150 sk->proto = psk->proto;
4151 sk->direction = psk->direction;
4152 sk->proto_variant = psk->proto_variant;
4153 VERIFY(psk->app_state == NULL);
4154 sk->flowsrc = psk->flowsrc;
4155 sk->flowhash = psk->flowhash;
4156 /* don't touch tree entries, states and refcnt on sk */
4157 }
4158
4159 return (sk);
4160 }
4161
4162 static u_int32_t
4163 pf_tcp_iss(struct pf_pdesc *pd)
4164 {
4165 MD5_CTX ctx;
4166 u_int32_t digest[4];
4167
4168 if (pf_tcp_secret_init == 0) {
4169 read_random(pf_tcp_secret, sizeof (pf_tcp_secret));
4170 MD5Init(&pf_tcp_secret_ctx);
4171 MD5Update(&pf_tcp_secret_ctx, pf_tcp_secret,
4172 sizeof (pf_tcp_secret));
4173 pf_tcp_secret_init = 1;
4174 }
4175 ctx = pf_tcp_secret_ctx;
4176
4177 MD5Update(&ctx, (char *)&pd->hdr.tcp->th_sport, sizeof (u_short));
4178 MD5Update(&ctx, (char *)&pd->hdr.tcp->th_dport, sizeof (u_short));
4179 if (pd->af == AF_INET6) {
4180 MD5Update(&ctx, (char *)&pd->src->v6, sizeof (struct in6_addr));
4181 MD5Update(&ctx, (char *)&pd->dst->v6, sizeof (struct in6_addr));
4182 } else {
4183 MD5Update(&ctx, (char *)&pd->src->v4, sizeof (struct in_addr));
4184 MD5Update(&ctx, (char *)&pd->dst->v4, sizeof (struct in_addr));
4185 }
4186 MD5Final((u_char *)digest, &ctx);
4187 pf_tcp_iss_off += 4096;
4188 return (digest[0] + random() + pf_tcp_iss_off);
4189 }
4190
4191 /*
4192 * This routine is called to perform address family translation on the
4193 * inner IP header (that may come as payload) of an ICMP(v4/6) error
4194 * response.
4195 */
4196 static int
4197 pf_change_icmp_af(struct mbuf *m, int off,
4198 struct pf_pdesc *pd, struct pf_pdesc *pd2, struct pf_addr *src,
4199 struct pf_addr *dst, sa_family_t af, sa_family_t naf)
4200 {
4201 struct mbuf *n = NULL;
4202 struct ip *ip4 = NULL;
4203 struct ip6_hdr *ip6 = NULL;
4204 int hlen, olen, mlen;
4205
4206 if (af == naf || (af != AF_INET && af != AF_INET6) ||
4207 (naf != AF_INET && naf != AF_INET6))
4208 return (-1);
4209
4210 /* split the mbuf chain on the inner ip/ip6 header boundary */
4211 if ((n = m_split(m, off, M_DONTWAIT)) == NULL)
4212 return (-1);
4213
4214 /* old header */
4215 olen = pd2->off - off;
4216 /* new header */
4217 hlen = naf == AF_INET ? sizeof(*ip4) : sizeof(*ip6);
4218
4219 /* trim old header */
4220 m_adj(n, olen);
4221
4222 /* prepend a new one */
4223 if (M_PREPEND(n, hlen, M_DONTWAIT, 0) == NULL)
4224 return (-1);
4225
4226 /* translate inner ip/ip6 header */
4227 switch (naf) {
4228 case AF_INET:
4229 ip4 = mtod(n, struct ip *);
4230 bzero(ip4, sizeof(*ip4));
4231 ip4->ip_v = IPVERSION;
4232 ip4->ip_hl = sizeof(*ip4) >> 2;
4233 ip4->ip_len = htons(sizeof(*ip4) + pd2->tot_len - olen);
4234 ip4->ip_id = htons(ip_randomid());
4235 ip4->ip_off = htons(IP_DF);
4236 ip4->ip_ttl = pd2->ttl;
4237 if (pd2->proto == IPPROTO_ICMPV6)
4238 ip4->ip_p = IPPROTO_ICMP;
4239 else
4240 ip4->ip_p = pd2->proto;
4241 ip4->ip_src = src->v4;
4242 ip4->ip_dst = dst->v4;
4243 ip4->ip_sum = in_cksum(n, ip4->ip_hl << 2);
4244 break;
4245 case AF_INET6:
4246 ip6 = mtod(n, struct ip6_hdr *);
4247 bzero(ip6, sizeof(*ip6));
4248 ip6->ip6_vfc = IPV6_VERSION;
4249 ip6->ip6_plen = htons(pd2->tot_len - olen);
4250 if (pd2->proto == IPPROTO_ICMP)
4251 ip6->ip6_nxt = IPPROTO_ICMPV6;
4252 else
4253 ip6->ip6_nxt = pd2->proto;
4254 if (!pd2->ttl || pd2->ttl > IPV6_DEFHLIM)
4255 ip6->ip6_hlim = IPV6_DEFHLIM;
4256 else
4257 ip6->ip6_hlim = pd2->ttl;
4258 ip6->ip6_src = src->v6;
4259 ip6->ip6_dst = dst->v6;
4260 break;
4261 }
4262
4263 /* adjust payload offset and total packet length */
4264 pd2->off += hlen - olen;
4265 pd->tot_len += hlen - olen;
4266
4267 /* merge modified inner packet with the original header */
4268 mlen = n->m_pkthdr.len;
4269 m_cat(m, n);
4270 m->m_pkthdr.len += mlen;
4271
4272 return (0);
4273 }
4274
4275 #define PTR_IP(field) ((int32_t)offsetof(struct ip, field))
4276 #define PTR_IP6(field) ((int32_t)offsetof(struct ip6_hdr, field))
4277
4278 static int
4279 pf_translate_icmp_af(int af, void *arg)
4280 {
4281 struct icmp *icmp4;
4282 struct icmp6_hdr *icmp6;
4283 u_int32_t mtu;
4284 int32_t ptr = -1;
4285 u_int8_t type;
4286 u_int8_t code;
4287
4288 switch (af) {
4289 case AF_INET:
4290 icmp6 = arg;
4291 type = icmp6->icmp6_type;
4292 code = icmp6->icmp6_code;
4293 mtu = ntohl(icmp6->icmp6_mtu);
4294
4295 switch (type) {
4296 case ICMP6_ECHO_REQUEST:
4297 type = ICMP_ECHO;
4298 break;
4299 case ICMP6_ECHO_REPLY:
4300 type = ICMP_ECHOREPLY;
4301 break;
4302 case ICMP6_DST_UNREACH:
4303 type = ICMP_UNREACH;
4304 switch (code) {
4305 case ICMP6_DST_UNREACH_NOROUTE:
4306 case ICMP6_DST_UNREACH_BEYONDSCOPE:
4307 case ICMP6_DST_UNREACH_ADDR:
4308 code = ICMP_UNREACH_HOST;
4309 break;
4310 case ICMP6_DST_UNREACH_ADMIN:
4311 code = ICMP_UNREACH_HOST_PROHIB;
4312 break;
4313 case ICMP6_DST_UNREACH_NOPORT:
4314 code = ICMP_UNREACH_PORT;
4315 break;
4316 default:
4317 return (-1);
4318 }
4319 break;
4320 case ICMP6_PACKET_TOO_BIG:
4321 type = ICMP_UNREACH;
4322 code = ICMP_UNREACH_NEEDFRAG;
4323 mtu -= 20;
4324 break;
4325 case ICMP6_TIME_EXCEEDED:
4326 type = ICMP_TIMXCEED;
4327 break;
4328 case ICMP6_PARAM_PROB:
4329 switch (code) {
4330 case ICMP6_PARAMPROB_HEADER:
4331 type = ICMP_PARAMPROB;
4332 code = ICMP_PARAMPROB_ERRATPTR;
4333 ptr = ntohl(icmp6->icmp6_pptr);
4334
4335 if (ptr == PTR_IP6(ip6_vfc))
4336 ; /* preserve */
4337 else if (ptr == PTR_IP6(ip6_vfc) + 1)
4338 ptr = PTR_IP(ip_tos);
4339 else if (ptr == PTR_IP6(ip6_plen) ||
4340 ptr == PTR_IP6(ip6_plen) + 1)
4341 ptr = PTR_IP(ip_len);
4342 else if (ptr == PTR_IP6(ip6_nxt))
4343 ptr = PTR_IP(ip_p);
4344 else if (ptr == PTR_IP6(ip6_hlim))
4345 ptr = PTR_IP(ip_ttl);
4346 else if (ptr >= PTR_IP6(ip6_src) &&
4347 ptr < PTR_IP6(ip6_dst))
4348 ptr = PTR_IP(ip_src);
4349 else if (ptr >= PTR_IP6(ip6_dst) &&
4350 ptr < (int32_t)sizeof(struct ip6_hdr))
4351 ptr = PTR_IP(ip_dst);
4352 else {
4353 return (-1);
4354 }
4355 break;
4356 case ICMP6_PARAMPROB_NEXTHEADER:
4357 type = ICMP_UNREACH;
4358 code = ICMP_UNREACH_PROTOCOL;
4359 break;
4360 default:
4361 return (-1);
4362 }
4363 break;
4364 default:
4365 return (-1);
4366 }
4367 icmp6->icmp6_type = type;
4368 icmp6->icmp6_code = code;
4369 /* aligns well with a icmpv4 nextmtu */
4370 icmp6->icmp6_mtu = htonl(mtu);
4371 /* icmpv4 pptr is a one most significant byte */
4372 if (ptr >= 0)
4373 icmp6->icmp6_pptr = htonl(ptr << 24);
4374 break;
4375
4376 case AF_INET6:
4377 icmp4 = arg;
4378 type = icmp4->icmp_type;
4379 code = icmp4->icmp_code;
4380 mtu = ntohs(icmp4->icmp_nextmtu);
4381
4382 switch (type) {
4383 case ICMP_ECHO:
4384 type = ICMP6_ECHO_REQUEST;
4385 break;
4386 case ICMP_ECHOREPLY:
4387 type = ICMP6_ECHO_REPLY;
4388 break;
4389 case ICMP_UNREACH:
4390 type = ICMP6_DST_UNREACH;
4391 switch (code) {
4392 case ICMP_UNREACH_NET:
4393 case ICMP_UNREACH_HOST:
4394 case ICMP_UNREACH_NET_UNKNOWN:
4395 case ICMP_UNREACH_HOST_UNKNOWN:
4396 case ICMP_UNREACH_ISOLATED:
4397 case ICMP_UNREACH_TOSNET:
4398 case ICMP_UNREACH_TOSHOST:
4399 code = ICMP6_DST_UNREACH_NOROUTE;
4400 break;
4401 case ICMP_UNREACH_PORT:
4402 code = ICMP6_DST_UNREACH_NOPORT;
4403 break;
4404 case ICMP_UNREACH_NET_PROHIB:
4405 case ICMP_UNREACH_HOST_PROHIB:
4406 case ICMP_UNREACH_FILTER_PROHIB:
4407 case ICMP_UNREACH_PRECEDENCE_CUTOFF:
4408 code = ICMP6_DST_UNREACH_ADMIN;
4409 break;
4410 case ICMP_UNREACH_PROTOCOL:
4411 type = ICMP6_PARAM_PROB;
4412 code = ICMP6_PARAMPROB_NEXTHEADER;
4413 ptr = offsetof(struct ip6_hdr, ip6_nxt);
4414 break;
4415 case ICMP_UNREACH_NEEDFRAG:
4416 type = ICMP6_PACKET_TOO_BIG;
4417 code = 0;
4418 mtu += 20;
4419 break;
4420 default:
4421 return (-1);
4422 }
4423 break;
4424 case ICMP_TIMXCEED:
4425 type = ICMP6_TIME_EXCEEDED;
4426 break;
4427 case ICMP_PARAMPROB:
4428 type = ICMP6_PARAM_PROB;
4429 switch (code) {
4430 case ICMP_PARAMPROB_ERRATPTR:
4431 code = ICMP6_PARAMPROB_HEADER;
4432 break;
4433 case ICMP_PARAMPROB_LENGTH:
4434 code = ICMP6_PARAMPROB_HEADER;
4435 break;
4436 default:
4437 return (-1);
4438 }
4439
4440 ptr = icmp4->icmp_pptr;
4441 if (ptr == 0 || ptr == PTR_IP(ip_tos))
4442 ; /* preserve */
4443 else if (ptr == PTR_IP(ip_len) ||
4444 ptr == PTR_IP(ip_len) + 1)
4445 ptr = PTR_IP6(ip6_plen);
4446 else if (ptr == PTR_IP(ip_ttl))
4447 ptr = PTR_IP6(ip6_hlim);
4448 else if (ptr == PTR_IP(ip_p))
4449 ptr = PTR_IP6(ip6_nxt);
4450 else if (ptr >= PTR_IP(ip_src) &&
4451 ptr < PTR_IP(ip_dst))
4452 ptr = PTR_IP6(ip6_src);
4453 else if (ptr >= PTR_IP(ip_dst) &&
4454 ptr < (int32_t)sizeof(struct ip))
4455 ptr = PTR_IP6(ip6_dst);
4456 else {
4457 return (-1);
4458 }
4459 break;
4460 default:
4461 return (-1);
4462 }
4463 icmp4->icmp_type = type;
4464 icmp4->icmp_code = code;
4465 icmp4->icmp_nextmtu = htons(mtu);
4466 if (ptr >= 0)
4467 icmp4->icmp_void = htonl(ptr);
4468 break;
4469 }
4470
4471 return (0);
4472 }
4473
4474 static int
4475 pf_nat64_ipv6(struct mbuf *m, int off, struct pf_pdesc *pd)
4476 {
4477 struct ip *ip4;
4478
4479 /*
4480 * ip_input asserts for rcvif to be not NULL
4481 * That may not be true for two corner cases
4482 * 1. If for some reason a local app sends DNS
4483 * AAAA query to local host
4484 * 2. If IPv6 stack in kernel internally generates a
4485 * message destined for a synthesized IPv6 end-point.
4486 */
4487 if (m->m_pkthdr.rcvif == NULL)
4488 return (PF_DROP);
4489
4490 /* trim the old header */
4491 m_adj(m, off);
4492
4493 /* prepend the new one */
4494 if (M_PREPEND(m, sizeof(*ip4), M_DONTWAIT, 0) == NULL)
4495 return (PF_DROP);
4496
4497 ip4 = mtod(m, struct ip *);
4498 ip4->ip_v = 4;
4499 ip4->ip_hl = 5;
4500 ip4->ip_tos = pd->tos & htonl(0x0ff00000);
4501 ip4->ip_len = htons(sizeof(*ip4) + (pd->tot_len - off));
4502 ip4->ip_id = 0;
4503 ip4->ip_off = htons(IP_DF);
4504 ip4->ip_ttl = pd->ttl;
4505 ip4->ip_p = pd->proto;
4506 ip4->ip_sum = 0;
4507 ip4->ip_src = pd->naddr.v4;
4508 ip4->ip_dst = pd->ndaddr.v4;
4509 ip4->ip_sum = in_cksum(m, ip4->ip_hl << 2);
4510
4511 /* recalculate icmp checksums */
4512 if (pd->proto == IPPROTO_ICMP) {
4513 struct mbuf *mp;
4514 struct icmp *icmp;
4515 int moff, hlen = sizeof(*ip4);
4516
4517 if ((mp = m_pulldown(m, hlen, ICMP_MINLEN, &moff)) == NULL)
4518 return (PF_DROP);
4519
4520 icmp = (struct icmp *)(void *)(mtod(mp, char *) + moff);
4521 icmp->icmp_cksum = 0;
4522 icmp->icmp_cksum = inet_cksum(m, 0, hlen,
4523 ntohs(ip4->ip_len) - hlen);
4524 }
4525
4526 ip_input(m);
4527 return (PF_NAT64);
4528 }
4529
4530 static int
4531 pf_nat64_ipv4(struct mbuf *m, int off, struct pf_pdesc *pd)
4532 {
4533 struct ip6_hdr *ip6;
4534
4535 if (m->m_pkthdr.rcvif == NULL)
4536 return (PF_DROP);
4537
4538 m_adj(m, off);
4539 if (M_PREPEND(m, sizeof(*ip6), M_DONTWAIT, 0) == NULL)
4540 return (PF_DROP);
4541
4542 ip6 = mtod(m, struct ip6_hdr *);
4543 ip6->ip6_vfc = htonl((6 << 28) | (pd->tos << 20));
4544 ip6->ip6_plen = htons(pd->tot_len - off);
4545 ip6->ip6_nxt = pd->proto;
4546 ip6->ip6_hlim = pd->ttl;
4547 ip6->ip6_src = pd->naddr.v6;
4548 ip6->ip6_dst = pd->ndaddr.v6;
4549
4550 /* recalculate icmp6 checksums */
4551 if (pd->proto == IPPROTO_ICMPV6) {
4552 struct mbuf *mp;
4553 struct icmp6_hdr *icmp6;
4554 int moff, hlen = sizeof(*ip6);
4555
4556 if ((mp = m_pulldown(m, hlen, sizeof(*icmp6), &moff)) == NULL)
4557 return (PF_DROP);
4558
4559 icmp6 = (struct icmp6_hdr *)(void *)(mtod(mp, char *) + moff);
4560 icmp6->icmp6_cksum = 0;
4561 icmp6->icmp6_cksum = inet6_cksum(m, IPPROTO_ICMPV6, hlen,
4562 ntohs(ip6->ip6_plen));
4563 } else if (pd->proto == IPPROTO_UDP) {
4564 struct mbuf *mp;
4565 struct udphdr *uh;
4566 int moff, hlen = sizeof(*ip6);
4567 if ((mp = m_pulldown(m, hlen, sizeof(*uh), &moff)) == NULL)
4568 return (PF_DROP);
4569 uh = (struct udphdr *)(void *)(mtod(mp, char *) + moff);
4570 if (uh->uh_sum == 0)
4571 uh->uh_sum = inet6_cksum(m, IPPROTO_UDP, hlen,
4572 ntohs(ip6->ip6_plen));
4573 }
4574
4575 ip6_input(m);
4576 return (PF_NAT64);
4577 }
4578
4579 static int
4580 pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
4581 struct pfi_kif *kif, struct mbuf *m, int off, void *h,
4582 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm,
4583 struct ifqueue *ifq)
4584 {
4585 #pragma unused(h)
4586 struct pf_rule *nr = NULL;
4587 struct pf_addr *saddr = pd->src, *daddr = pd->dst;
4588 sa_family_t af = pd->af;
4589 struct pf_rule *r, *a = NULL;
4590 struct pf_ruleset *ruleset = NULL;
4591 struct pf_src_node *nsn = NULL;
4592 struct tcphdr *th = pd->hdr.tcp;
4593 struct udphdr *uh = pd->hdr.udp;
4594 u_short reason;
4595 int rewrite = 0, hdrlen = 0;
4596 int tag = -1;
4597 unsigned int rtableid = IFSCOPE_NONE;
4598 int asd = 0;
4599 int match = 0;
4600 int state_icmp = 0;
4601 u_int16_t mss = tcp_mssdflt;
4602 u_int8_t icmptype = 0, icmpcode = 0;
4603
4604 struct pf_grev1_hdr *grev1 = pd->hdr.grev1;
4605 union pf_state_xport bxport, bdxport, nxport, sxport, dxport;
4606 struct pf_state_key psk;
4607
4608 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
4609
4610 if (direction == PF_IN && pf_check_congestion(ifq)) {
4611 REASON_SET(&reason, PFRES_CONGEST);
4612 return (PF_DROP);
4613 }
4614
4615 hdrlen = 0;
4616 sxport.spi = 0;
4617 dxport.spi = 0;
4618 nxport.spi = 0;
4619
4620 switch (pd->proto) {
4621 case IPPROTO_TCP:
4622 sxport.port = th->th_sport;
4623 dxport.port = th->th_dport;
4624 hdrlen = sizeof (*th);
4625 break;
4626 case IPPROTO_UDP:
4627 sxport.port = uh->uh_sport;
4628 dxport.port = uh->uh_dport;
4629 hdrlen = sizeof (*uh);
4630 break;
4631 #if INET
4632 case IPPROTO_ICMP:
4633 if (pd->af != AF_INET)
4634 break;
4635 sxport.port = dxport.port = pd->hdr.icmp->icmp_id;
4636 hdrlen = ICMP_MINLEN;
4637 icmptype = pd->hdr.icmp->icmp_type;
4638 icmpcode = pd->hdr.icmp->icmp_code;
4639
4640 if (icmptype == ICMP_UNREACH ||
4641 icmptype == ICMP_SOURCEQUENCH ||
4642 icmptype == ICMP_REDIRECT ||
4643 icmptype == ICMP_TIMXCEED ||
4644 icmptype == ICMP_PARAMPROB)
4645 state_icmp++;
4646 break;
4647 #endif /* INET */
4648 #if INET6
4649 case IPPROTO_ICMPV6:
4650 if (pd->af != AF_INET6)
4651 break;
4652 sxport.port = dxport.port = pd->hdr.icmp6->icmp6_id;
4653 hdrlen = sizeof (*pd->hdr.icmp6);
4654 icmptype = pd->hdr.icmp6->icmp6_type;
4655 icmpcode = pd->hdr.icmp6->icmp6_code;
4656
4657 if (icmptype == ICMP6_DST_UNREACH ||
4658 icmptype == ICMP6_PACKET_TOO_BIG ||
4659 icmptype == ICMP6_TIME_EXCEEDED ||
4660 icmptype == ICMP6_PARAM_PROB)
4661 state_icmp++;
4662 break;
4663 #endif /* INET6 */
4664 case IPPROTO_GRE:
4665 if (pd->proto_variant == PF_GRE_PPTP_VARIANT) {
4666 sxport.call_id = dxport.call_id =
4667 pd->hdr.grev1->call_id;
4668 hdrlen = sizeof (*pd->hdr.grev1);
4669 }
4670 break;
4671 case IPPROTO_ESP:
4672 sxport.spi = 0;
4673 dxport.spi = pd->hdr.esp->spi;
4674 hdrlen = sizeof (*pd->hdr.esp);
4675 break;
4676 }
4677
4678 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
4679
4680 bxport = sxport;
4681 bdxport = dxport;
4682
4683 if (direction == PF_OUT)
4684 nxport = sxport;
4685 else
4686 nxport = dxport;
4687
4688 /* check packet for BINAT/NAT/RDR */
4689 if ((nr = pf_get_translation_aux(pd, m, off, direction, kif, &nsn,
4690 saddr, &sxport, daddr, &dxport, &nxport)) !=
4691 NULL) {
4692 int ua;
4693 u_int16_t dport;
4694
4695 if (pd->af != pd->naf)
4696 ua = 0;
4697 else
4698 ua = 1;
4699
4700 PF_ACPY(&pd->baddr, saddr, af);
4701 PF_ACPY(&pd->bdaddr, daddr, af);
4702
4703 switch (pd->proto) {
4704 case IPPROTO_TCP:
4705 if (pd->af != pd->naf ||
4706 PF_ANEQ(saddr, &pd->naddr, pd->af)) {
4707 pf_change_ap(direction, pd->mp, saddr,
4708 &th->th_sport, pd->ip_sum, &th->th_sum,
4709 &pd->naddr, nxport.port, 0, af,
4710 pd->naf, ua);
4711 sxport.port = th->th_sport;
4712 }
4713
4714 if (pd->af != pd->naf ||
4715 PF_ANEQ(daddr, &pd->ndaddr, pd->af) ||
4716 (nr && (nr->action == PF_RDR) &&
4717 (th->th_dport != nxport.port))) {
4718 if (nr && nr->action == PF_RDR)
4719 dport = nxport.port;
4720 else
4721 dport = th->th_dport;
4722 pf_change_ap(direction, pd->mp, daddr,
4723 &th->th_dport, pd->ip_sum,
4724 &th->th_sum, &pd->ndaddr,
4725 dport, 0, af, pd->naf, ua);
4726 dxport.port = th->th_dport;
4727 }
4728 rewrite++;
4729 break;
4730
4731 case IPPROTO_UDP:
4732 if (pd->af != pd->naf ||
4733 PF_ANEQ(saddr, &pd->naddr, pd->af)) {
4734 pf_change_ap(direction, pd->mp, saddr,
4735 &uh->uh_sport, pd->ip_sum,
4736 &uh->uh_sum, &pd->naddr,
4737 nxport.port, 1, af, pd->naf, ua);
4738 sxport.port = uh->uh_sport;
4739 }
4740
4741 if (pd->af != pd->naf ||
4742 PF_ANEQ(daddr, &pd->ndaddr, pd->af) ||
4743 (nr && (nr->action == PF_RDR) &&
4744 (uh->uh_dport != nxport.port))) {
4745 if (nr && nr->action == PF_RDR)
4746 dport = nxport.port;
4747 else
4748 dport = uh->uh_dport;
4749 pf_change_ap(direction, pd->mp, daddr,
4750 &uh->uh_dport, pd->ip_sum,
4751 &uh->uh_sum, &pd->ndaddr,
4752 dport, 0, af, pd->naf, ua);
4753 dxport.port = uh->uh_dport;
4754 }
4755 rewrite++;
4756 break;
4757 #if INET
4758 case IPPROTO_ICMP:
4759 if (pd->af != AF_INET)
4760 break;
4761 /*
4762 * TODO:
4763 * pd->af != pd->naf not handled yet here and would be
4764 * needed for NAT46 needed to support XLAT.
4765 * Will cross the bridge when it comes.
4766 */
4767 if (PF_ANEQ(saddr, &pd->naddr, pd->af)) {
4768 pf_change_a(&saddr->v4.s_addr, pd->ip_sum,
4769 pd->naddr.v4.s_addr, 0);
4770 pd->hdr.icmp->icmp_cksum = pf_cksum_fixup(
4771 pd->hdr.icmp->icmp_cksum, sxport.port,
4772 nxport.port, 0);
4773 pd->hdr.icmp->icmp_id = nxport.port;
4774 }
4775
4776 if (PF_ANEQ(daddr, &pd->ndaddr, pd->af)) {
4777 pf_change_a(&daddr->v4.s_addr, pd->ip_sum,
4778 pd->ndaddr.v4.s_addr, 0);
4779 }
4780 ++rewrite;
4781 break;
4782 #endif /* INET */
4783 #if INET6
4784 case IPPROTO_ICMPV6:
4785 if (pd->af != AF_INET6)
4786 break;
4787
4788 if (pd->af != pd->naf ||
4789 PF_ANEQ(saddr, &pd->naddr, pd->af)) {
4790 pf_change_addr(saddr,
4791 &pd->hdr.icmp6->icmp6_cksum,
4792 &pd->naddr, 0, pd->af, pd->naf);
4793 }
4794
4795 if (pd->af != pd->naf ||
4796 PF_ANEQ(daddr, &pd->ndaddr, pd->af)) {
4797 pf_change_addr(daddr,
4798 &pd->hdr.icmp6->icmp6_cksum,
4799 &pd->ndaddr, 0, pd->af, pd->naf);
4800 }
4801
4802 if (pd->af != pd->naf) {
4803 if (pf_translate_icmp_af(AF_INET,
4804 pd->hdr.icmp6))
4805 return (PF_DROP);
4806 pd->proto = IPPROTO_ICMP;
4807 }
4808 rewrite++;
4809 break;
4810 #endif /* INET */
4811 case IPPROTO_GRE:
4812 if ((direction == PF_IN) &&
4813 (pd->proto_variant == PF_GRE_PPTP_VARIANT))
4814 grev1->call_id = nxport.call_id;
4815
4816 switch (pd->af) {
4817 #if INET
4818 case AF_INET:
4819 if (PF_ANEQ(saddr, &pd->naddr, pd->af)) {
4820 pf_change_a(&saddr->v4.s_addr,
4821 pd->ip_sum,
4822 pd->naddr.v4.s_addr, 0);
4823 }
4824 if (PF_ANEQ(daddr, &pd->ndaddr, pd->af)) {
4825 pf_change_a(&daddr->v4.s_addr,
4826 pd->ip_sum,
4827 pd->ndaddr.v4.s_addr, 0);
4828 }
4829 break;
4830 #endif /* INET */
4831 #if INET6
4832 case AF_INET6:
4833 if (PF_ANEQ(saddr, &pd->naddr, pd->af))
4834 PF_ACPY(saddr, &pd->naddr, AF_INET6);
4835 if (PF_ANEQ(daddr, &pd->ndaddr, pd->af))
4836 PF_ACPY(daddr, &pd->ndaddr, AF_INET6);
4837 break;
4838 #endif /* INET6 */
4839 }
4840 ++rewrite;
4841 break;
4842 case IPPROTO_ESP:
4843 if (direction == PF_OUT)
4844 bxport.spi = 0;
4845
4846 switch (pd->af) {
4847 #if INET
4848 case AF_INET:
4849 if (PF_ANEQ(saddr, &pd->naddr, pd->af)) {
4850 pf_change_a(&saddr->v4.s_addr,
4851 pd->ip_sum, pd->naddr.v4.s_addr, 0);
4852 }
4853 if (PF_ANEQ(daddr, &pd->ndaddr, pd->af)) {
4854 pf_change_a(&daddr->v4.s_addr,
4855 pd->ip_sum,
4856 pd->ndaddr.v4.s_addr, 0);
4857 }
4858 break;
4859 #endif /* INET */
4860 #if INET6
4861 case AF_INET6:
4862 if (PF_ANEQ(saddr, &pd->naddr, pd->af))
4863 PF_ACPY(saddr, &pd->naddr, AF_INET6);
4864 if (PF_ANEQ(daddr, &pd->ndaddr, pd->af))
4865 PF_ACPY(daddr, &pd->ndaddr, AF_INET6);
4866 break;
4867 #endif /* INET6 */
4868 }
4869 break;
4870 default:
4871 switch (pd->af) {
4872 #if INET
4873 case AF_INET:
4874 if ((pd->naf != AF_INET) ||
4875 (PF_ANEQ(saddr, &pd->naddr, pd->af))) {
4876 pf_change_addr(saddr, pd->ip_sum,
4877 &pd->naddr, 0, af, pd->naf);
4878 }
4879
4880 if ((pd->naf != AF_INET) ||
4881 (PF_ANEQ(daddr, &pd->ndaddr, pd->af))) {
4882 pf_change_addr(daddr, pd->ip_sum,
4883 &pd->ndaddr, 0, af, pd->naf);
4884 }
4885 break;
4886 #endif /* INET */
4887 #if INET6
4888 case AF_INET6:
4889 if (PF_ANEQ(saddr, &pd->naddr, pd->af))
4890 PF_ACPY(saddr, &pd->naddr, af);
4891 if (PF_ANEQ(daddr, &pd->ndaddr, pd->af))
4892 PF_ACPY(daddr, &pd->ndaddr, af);
4893 break;
4894 #endif /* INET */
4895 }
4896 break;
4897 }
4898
4899 if (nr->natpass)
4900 r = NULL;
4901 pd->nat_rule = nr;
4902 pd->af = pd->naf;
4903 }
4904
4905 if (nr && nr->tag > 0)
4906 tag = nr->tag;
4907
4908 while (r != NULL) {
4909 r->evaluations++;
4910 if (pfi_kif_match(r->kif, kif) == r->ifnot)
4911 r = r->skip[PF_SKIP_IFP].ptr;
4912 else if (r->direction && r->direction != direction)
4913 r = r->skip[PF_SKIP_DIR].ptr;
4914 else if (r->af && r->af != pd->af)
4915 r = r->skip[PF_SKIP_AF].ptr;
4916 else if (r->proto && r->proto != pd->proto)
4917 r = r->skip[PF_SKIP_PROTO].ptr;
4918 else if (PF_MISMATCHAW(&r->src.addr, saddr, pd->af,
4919 r->src.neg, kif))
4920 r = r->skip[PF_SKIP_SRC_ADDR].ptr;
4921 /* tcp/udp only. port_op always 0 in other cases */
4922 else if (r->proto == pd->proto &&
4923 (r->proto == IPPROTO_TCP || r->proto == IPPROTO_UDP) &&
4924 r->src.xport.range.op &&
4925 !pf_match_port(r->src.xport.range.op,
4926 r->src.xport.range.port[0], r->src.xport.range.port[1],
4927 th->th_sport))
4928 r = r->skip[PF_SKIP_SRC_PORT].ptr;
4929 else if (PF_MISMATCHAW(&r->dst.addr, daddr, pd->af,
4930 r->dst.neg, NULL))
4931 r = r->skip[PF_SKIP_DST_ADDR].ptr;
4932 /* tcp/udp only. port_op always 0 in other cases */
4933 else if (r->proto == pd->proto &&
4934 (r->proto == IPPROTO_TCP || r->proto == IPPROTO_UDP) &&
4935 r->dst.xport.range.op &&
4936 !pf_match_port(r->dst.xport.range.op,
4937 r->dst.xport.range.port[0], r->dst.xport.range.port[1],
4938 th->th_dport))
4939 r = r->skip[PF_SKIP_DST_PORT].ptr;
4940 /* icmp only. type always 0 in other cases */
4941 else if (r->type && r->type != icmptype + 1)
4942 r = TAILQ_NEXT(r, entries);
4943 /* icmp only. type always 0 in other cases */
4944 else if (r->code && r->code != icmpcode + 1)
4945 r = TAILQ_NEXT(r, entries);
4946 else if ((r->rule_flag & PFRULE_TOS) && r->tos &&
4947 !(r->tos & pd->tos))
4948 r = TAILQ_NEXT(r, entries);
4949 else if ((r->rule_flag & PFRULE_DSCP) && r->tos &&
4950 !(r->tos & (pd->tos & DSCP_MASK)))
4951 r = TAILQ_NEXT(r, entries);
4952 else if ((r->rule_flag & PFRULE_SC) && r->tos &&
4953 ((r->tos & SCIDX_MASK) != pd->sc))
4954 r = TAILQ_NEXT(r, entries);
4955 else if (r->rule_flag & PFRULE_FRAGMENT)
4956 r = TAILQ_NEXT(r, entries);
4957 else if (pd->proto == IPPROTO_TCP &&
4958 (r->flagset & th->th_flags) != r->flags)
4959 r = TAILQ_NEXT(r, entries);
4960 /* tcp/udp only. uid.op always 0 in other cases */
4961 else if (r->uid.op && (pd->lookup.done || ((void)(pd->lookup.done =
4962 pf_socket_lookup(direction, pd)), 1)) &&
4963 !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1],
4964 pd->lookup.uid))
4965 r = TAILQ_NEXT(r, entries);
4966 /* tcp/udp only. gid.op always 0 in other cases */
4967 else if (r->gid.op && (pd->lookup.done || ((void)(pd->lookup.done =
4968 pf_socket_lookup(direction, pd)), 1)) &&
4969 !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1],
4970 pd->lookup.gid))
4971 r = TAILQ_NEXT(r, entries);
4972 else if (r->prob && r->prob <= (RandomULong() % (UINT_MAX - 1) + 1))
4973 r = TAILQ_NEXT(r, entries);
4974 else if (r->match_tag && !pf_match_tag(m, r, pd->pf_mtag, &tag))
4975 r = TAILQ_NEXT(r, entries);
4976 else if (r->os_fingerprint != PF_OSFP_ANY &&
4977 (pd->proto != IPPROTO_TCP || !pf_osfp_match(
4978 pf_osfp_fingerprint(pd, m, off, th),
4979 r->os_fingerprint)))
4980 r = TAILQ_NEXT(r, entries);
4981 else {
4982 if (r->tag)
4983 tag = r->tag;
4984 if (PF_RTABLEID_IS_VALID(r->rtableid))
4985 rtableid = r->rtableid;
4986 if (r->anchor == NULL) {
4987 match = 1;
4988 *rm = r;
4989 *am = a;
4990 *rsm = ruleset;
4991 if ((*rm)->quick)
4992 break;
4993 r = TAILQ_NEXT(r, entries);
4994 } else
4995 pf_step_into_anchor(&asd, &ruleset,
4996 PF_RULESET_FILTER, &r, &a, &match);
4997 }
4998 if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset,
4999 PF_RULESET_FILTER, &r, &a, &match))
5000 break;
5001 }
5002 r = *rm;
5003 a = *am;
5004 ruleset = *rsm;
5005
5006 REASON_SET(&reason, PFRES_MATCH);
5007
5008 if (r->log || (nr != NULL && nr->log)) {
5009 if (rewrite > 0) {
5010 if (rewrite < off + hdrlen)
5011 rewrite = off + hdrlen;
5012
5013 m = pf_lazy_makewritable(pd, m, rewrite);
5014 if (!m) {
5015 REASON_SET(&reason, PFRES_MEMORY);
5016 return (PF_DROP);
5017 }
5018
5019 m_copyback(m, off, hdrlen, pd->hdr.any);
5020 }
5021 PFLOG_PACKET(kif, h, m, pd->af, direction, reason,
5022 r->log ? r : nr, a, ruleset, pd);
5023 }
5024
5025 if ((r->action == PF_DROP) &&
5026 ((r->rule_flag & PFRULE_RETURNRST) ||
5027 (r->rule_flag & PFRULE_RETURNICMP) ||
5028 (r->rule_flag & PFRULE_RETURN))) {
5029 /* undo NAT changes, if they have taken place */
5030 /* XXX For NAT64 we are not reverting the changes */
5031 if (nr != NULL && nr->action != PF_NAT64) {
5032 if (direction == PF_OUT) {
5033 pd->af = af;
5034 switch (pd->proto) {
5035 case IPPROTO_TCP:
5036 pf_change_ap(direction, pd->mp, saddr,
5037 &th->th_sport, pd->ip_sum,
5038 &th->th_sum, &pd->baddr,
5039 bxport.port, 0, af, pd->af, 1);
5040 sxport.port = th->th_sport;
5041 rewrite++;
5042 break;
5043 case IPPROTO_UDP:
5044 pf_change_ap(direction, pd->mp, saddr,
5045 &pd->hdr.udp->uh_sport, pd->ip_sum,
5046 &pd->hdr.udp->uh_sum, &pd->baddr,
5047 bxport.port, 1, af, pd->af, 1);
5048 sxport.port = pd->hdr.udp->uh_sport;
5049 rewrite++;
5050 break;
5051 case IPPROTO_ICMP:
5052 #if INET6
5053 case IPPROTO_ICMPV6:
5054 #endif
5055 /* nothing! */
5056 break;
5057 case IPPROTO_GRE:
5058 PF_ACPY(&pd->baddr, saddr, af);
5059 ++rewrite;
5060 switch (af) {
5061 #if INET
5062 case AF_INET:
5063 pf_change_a(&saddr->v4.s_addr,
5064 pd->ip_sum,
5065 pd->baddr.v4.s_addr, 0);
5066 break;
5067 #endif /* INET */
5068 #if INET6
5069 case AF_INET6:
5070 PF_ACPY(saddr, &pd->baddr,
5071 AF_INET6);
5072 break;
5073 #endif /* INET6 */
5074 }
5075 break;
5076 case IPPROTO_ESP:
5077 PF_ACPY(&pd->baddr, saddr, af);
5078 switch (af) {
5079 #if INET
5080 case AF_INET:
5081 pf_change_a(&saddr->v4.s_addr,
5082 pd->ip_sum,
5083 pd->baddr.v4.s_addr, 0);
5084 break;
5085 #endif /* INET */
5086 #if INET6
5087 case AF_INET6:
5088 PF_ACPY(saddr, &pd->baddr,
5089 AF_INET6);
5090 break;
5091 #endif /* INET6 */
5092 }
5093 break;
5094 default:
5095 switch (af) {
5096 case AF_INET:
5097 pf_change_a(&saddr->v4.s_addr,
5098 pd->ip_sum,
5099 pd->baddr.v4.s_addr, 0);
5100 break;
5101 case AF_INET6:
5102 PF_ACPY(saddr, &pd->baddr, af);
5103 break;
5104 }
5105 }
5106 } else {
5107 switch (pd->proto) {
5108 case IPPROTO_TCP:
5109 pf_change_ap(direction, pd->mp, daddr,
5110 &th->th_dport, pd->ip_sum,
5111 &th->th_sum, &pd->bdaddr,
5112 bdxport.port, 0, af, pd->af, 1);
5113 dxport.port = th->th_dport;
5114 rewrite++;
5115 break;
5116 case IPPROTO_UDP:
5117 pf_change_ap(direction, pd->mp, daddr,
5118 &pd->hdr.udp->uh_dport, pd->ip_sum,
5119 &pd->hdr.udp->uh_sum, &pd->bdaddr,
5120 bdxport.port, 1, af, pd->af, 1);
5121 dxport.port = pd->hdr.udp->uh_dport;
5122 rewrite++;
5123 break;
5124 case IPPROTO_ICMP:
5125 #if INET6
5126 case IPPROTO_ICMPV6:
5127 #endif
5128 /* nothing! */
5129 break;
5130 case IPPROTO_GRE:
5131 if (pd->proto_variant ==
5132 PF_GRE_PPTP_VARIANT)
5133 grev1->call_id =
5134 bdxport.call_id;
5135 ++rewrite;
5136 switch (af) {
5137 #if INET
5138 case AF_INET:
5139 pf_change_a(&daddr->v4.s_addr,
5140 pd->ip_sum,
5141 pd->bdaddr.v4.s_addr, 0);
5142 break;
5143 #endif /* INET */
5144 #if INET6
5145 case AF_INET6:
5146 PF_ACPY(daddr, &pd->bdaddr,
5147 AF_INET6);
5148 break;
5149 #endif /* INET6 */
5150 }
5151 break;
5152 case IPPROTO_ESP:
5153 switch (af) {
5154 #if INET
5155 case AF_INET:
5156 pf_change_a(&daddr->v4.s_addr,
5157 pd->ip_sum,
5158 pd->bdaddr.v4.s_addr, 0);
5159 break;
5160 #endif /* INET */
5161 #if INET6
5162 case AF_INET6:
5163 PF_ACPY(daddr, &pd->bdaddr,
5164 AF_INET6);
5165 break;
5166 #endif /* INET6 */
5167 }
5168 break;
5169 default:
5170 switch (af) {
5171 case AF_INET:
5172 pf_change_a(&daddr->v4.s_addr,
5173 pd->ip_sum,
5174 pd->bdaddr.v4.s_addr, 0);
5175 break;
5176 #if INET6
5177 case AF_INET6:
5178 PF_ACPY(daddr, &pd->bdaddr, af);
5179 break;
5180 #endif /* INET6 */
5181 }
5182 }
5183 }
5184 }
5185 if (pd->proto == IPPROTO_TCP &&
5186 ((r->rule_flag & PFRULE_RETURNRST) ||
5187 (r->rule_flag & PFRULE_RETURN)) &&
5188 !(th->th_flags & TH_RST)) {
5189 u_int32_t ack = ntohl(th->th_seq) + pd->p_len;
5190 int len = 0;
5191 struct ip *h4;
5192 #if INET6
5193 struct ip6_hdr *h6;
5194 #endif /* INET6 */
5195
5196 switch (pd->af) {
5197 case AF_INET:
5198 h4 = mtod(m, struct ip *);
5199 len = ntohs(h4->ip_len) - off;
5200 break;
5201 #if INET6
5202 case AF_INET6:
5203 h6 = mtod(m, struct ip6_hdr *);
5204 len = ntohs(h6->ip6_plen) -
5205 (off - sizeof (*h6));
5206 break;
5207 #endif /* INET6 */
5208 }
5209
5210 if (pf_check_proto_cksum(m, off, len, IPPROTO_TCP,
5211 pd->af))
5212 REASON_SET(&reason, PFRES_PROTCKSUM);
5213 else {
5214 if (th->th_flags & TH_SYN)
5215 ack++;
5216 if (th->th_flags & TH_FIN)
5217 ack++;
5218 pf_send_tcp(r, pd->af, pd->dst,
5219 pd->src, th->th_dport, th->th_sport,
5220 ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0,
5221 r->return_ttl, 1, 0, pd->eh, kif->pfik_ifp);
5222 }
5223 } else if (pd->proto != IPPROTO_ICMP && pd->af == AF_INET &&
5224 pd->proto != IPPROTO_ESP && pd->proto != IPPROTO_AH &&
5225 r->return_icmp)
5226 pf_send_icmp(m, r->return_icmp >> 8,
5227 r->return_icmp & 255, pd->af, r);
5228 else if (pd->proto != IPPROTO_ICMPV6 && af == AF_INET6 &&
5229 pd->proto != IPPROTO_ESP && pd->proto != IPPROTO_AH &&
5230 r->return_icmp6)
5231 pf_send_icmp(m, r->return_icmp6 >> 8,
5232 r->return_icmp6 & 255, pd->af, r);
5233 }
5234
5235 if (r->action == PF_DROP)
5236 return (PF_DROP);
5237
5238 /* prepare state key, for flowhash and/or the state (if created) */
5239 bzero(&psk, sizeof (psk));
5240 psk.proto = pd->proto;
5241 psk.direction = direction;
5242 if (pd->proto == IPPROTO_UDP) {
5243 if (ntohs(pd->hdr.udp->uh_sport) == PF_IKE_PORT &&
5244 ntohs(pd->hdr.udp->uh_dport) == PF_IKE_PORT) {
5245 psk.proto_variant = PF_EXTFILTER_APD;
5246 } else {
5247 psk.proto_variant = nr ? nr->extfilter : r->extfilter;
5248 if (psk.proto_variant < PF_EXTFILTER_APD)
5249 psk.proto_variant = PF_EXTFILTER_APD;
5250 }
5251 } else if (pd->proto == IPPROTO_GRE) {
5252 psk.proto_variant = pd->proto_variant;
5253 }
5254 if (direction == PF_OUT) {
5255 psk.af_gwy = af;
5256 PF_ACPY(&psk.gwy.addr, saddr, af);
5257 PF_ACPY(&psk.ext_gwy.addr, daddr, af);
5258 switch (pd->proto) {
5259 case IPPROTO_ESP:
5260 psk.gwy.xport.spi = 0;
5261 psk.ext_gwy.xport.spi = pd->hdr.esp->spi;
5262 break;
5263 case IPPROTO_ICMP:
5264 #if INET6
5265 case IPPROTO_ICMPV6:
5266 #endif
5267 /*
5268 * NAT64 requires protocol translation between ICMPv4
5269 * and ICMPv6. TCP and UDP do not require protocol
5270 * translation. To avoid adding complexity just to
5271 * handle ICMP(v4/v6), we always lookup for
5272 * proto = IPPROTO_ICMP on both LAN and WAN side
5273 */
5274 psk.proto = IPPROTO_ICMP;
5275 psk.gwy.xport.port = nxport.port;
5276 psk.ext_gwy.xport.spi = 0;
5277 break;
5278 default:
5279 psk.gwy.xport = sxport;
5280 psk.ext_gwy.xport = dxport;
5281 break;
5282 }
5283 psk.af_lan = af;
5284 if (nr != NULL) {
5285 PF_ACPY(&psk.lan.addr, &pd->baddr, af);
5286 psk.lan.xport = bxport;
5287 PF_ACPY(&psk.ext_lan.addr, &pd->bdaddr, af);
5288 psk.ext_lan.xport = bdxport;
5289 } else {
5290 PF_ACPY(&psk.lan.addr, &psk.gwy.addr, af);
5291 psk.lan.xport = psk.gwy.xport;
5292 PF_ACPY(&psk.ext_lan.addr, &psk.ext_gwy.addr, af);
5293 psk.ext_lan.xport = psk.ext_gwy.xport;
5294 }
5295 } else {
5296 psk.af_lan = af;
5297 if (nr && nr->action == PF_NAT64) {
5298 PF_ACPY(&psk.lan.addr, &pd->baddr, af);
5299 PF_ACPY(&psk.ext_lan.addr, &pd->bdaddr, af);
5300 } else {
5301 PF_ACPY(&psk.lan.addr, daddr, af);
5302 PF_ACPY(&psk.ext_lan.addr, saddr, af);
5303 }
5304 switch (pd->proto) {
5305 case IPPROTO_ICMP:
5306 #if INET6
5307 case IPPROTO_ICMPV6:
5308 #endif
5309 /*
5310 * NAT64 requires protocol translation between ICMPv4
5311 * and ICMPv6. TCP and UDP do not require protocol
5312 * translation. To avoid adding complexity just to
5313 * handle ICMP(v4/v6), we always lookup for
5314 * proto = IPPROTO_ICMP on both LAN and WAN side
5315 */
5316 psk.proto = IPPROTO_ICMP;
5317 if (nr && nr->action == PF_NAT64) {
5318 psk.lan.xport = bxport;
5319 psk.ext_lan.xport = bxport;
5320 } else {
5321 psk.lan.xport = nxport;
5322 psk.ext_lan.xport.spi = 0;
5323 }
5324 break;
5325 case IPPROTO_ESP:
5326 psk.ext_lan.xport.spi = 0;
5327 psk.lan.xport.spi = pd->hdr.esp->spi;
5328 break;
5329 default:
5330 if (nr != NULL) {
5331 if (nr->action == PF_NAT64) {
5332 psk.lan.xport = bxport;
5333 psk.ext_lan.xport = bdxport;
5334 } else {
5335 psk.lan.xport = dxport;
5336 psk.ext_lan.xport = sxport;
5337 }
5338 } else {
5339 psk.lan.xport = dxport;
5340 psk.ext_lan.xport = sxport;
5341 }
5342 break;
5343 }
5344 psk.af_gwy = pd->naf;
5345 if (nr != NULL) {
5346 if (nr->action == PF_NAT64) {
5347 PF_ACPY(&psk.gwy.addr, &pd->naddr, pd->naf);
5348 PF_ACPY(&psk.ext_gwy.addr, &pd->ndaddr,
5349 pd->naf);
5350 if ((pd->proto == IPPROTO_ICMPV6) ||
5351 (pd->proto == IPPROTO_ICMP)) {
5352 psk.gwy.xport = nxport;
5353 psk.ext_gwy.xport = nxport;
5354 } else {
5355 psk.gwy.xport = sxport;
5356 psk.ext_gwy.xport = dxport;
5357 }
5358 } else {
5359 PF_ACPY(&psk.gwy.addr, &pd->bdaddr, af);
5360 psk.gwy.xport = bdxport;
5361 PF_ACPY(&psk.ext_gwy.addr, saddr, af);
5362 psk.ext_gwy.xport = sxport;
5363 }
5364 } else {
5365 PF_ACPY(&psk.gwy.addr, &psk.lan.addr, af);
5366 psk.gwy.xport = psk.lan.xport;
5367 PF_ACPY(&psk.ext_gwy.addr, &psk.ext_lan.addr, af);
5368 psk.ext_gwy.xport = psk.ext_lan.xport;
5369 }
5370 }
5371 if (pd->pktflags & PKTF_FLOW_ID) {
5372 /* flow hash was already computed outside of PF */
5373 psk.flowsrc = pd->flowsrc;
5374 psk.flowhash = pd->flowhash;
5375 } else {
5376 /* compute flow hash and store it in state key */
5377 psk.flowsrc = FLOWSRC_PF;
5378 psk.flowhash = pf_calc_state_key_flowhash(&psk);
5379 pd->flowsrc = psk.flowsrc;
5380 pd->flowhash = psk.flowhash;
5381 pd->pktflags |= PKTF_FLOW_ID;
5382 pd->pktflags &= ~PKTF_FLOW_ADV;
5383 }
5384
5385 if (pf_tag_packet(m, pd->pf_mtag, tag, rtableid, pd)) {
5386 REASON_SET(&reason, PFRES_MEMORY);
5387 return (PF_DROP);
5388 }
5389
5390 if (!state_icmp && (r->keep_state || nr != NULL ||
5391 (pd->flags & PFDESC_TCP_NORM))) {
5392 /* create new state */
5393 struct pf_state *s = NULL;
5394 struct pf_state_key *sk = NULL;
5395 struct pf_src_node *sn = NULL;
5396 struct pf_ike_hdr ike;
5397
5398 if (pd->proto == IPPROTO_UDP) {
5399 size_t plen = m->m_pkthdr.len - off - sizeof (*uh);
5400
5401 if (ntohs(uh->uh_sport) == PF_IKE_PORT &&
5402 ntohs(uh->uh_dport) == PF_IKE_PORT &&
5403 plen >= PF_IKE_PACKET_MINSIZE) {
5404 if (plen > PF_IKE_PACKET_MINSIZE)
5405 plen = PF_IKE_PACKET_MINSIZE;
5406 m_copydata(m, off + sizeof (*uh), plen, &ike);
5407 }
5408 }
5409
5410 if (nr != NULL && pd->proto == IPPROTO_ESP &&
5411 direction == PF_OUT) {
5412 struct pf_state_key_cmp sk0;
5413 struct pf_state *s0;
5414
5415 /*
5416 * <jhw@apple.com>
5417 * This squelches state creation if the external
5418 * address matches an existing incomplete state with a
5419 * different internal address. Only one 'blocking'
5420 * partial state is allowed for each external address.
5421 */
5422 memset(&sk0, 0, sizeof (sk0));
5423 sk0.af_gwy = pd->af;
5424 sk0.proto = IPPROTO_ESP;
5425 PF_ACPY(&sk0.gwy.addr, saddr, sk0.af_gwy);
5426 PF_ACPY(&sk0.ext_gwy.addr, daddr, sk0.af_gwy);
5427 s0 = pf_find_state(kif, &sk0, PF_IN);
5428
5429 if (s0 && PF_ANEQ(&s0->state_key->lan.addr,
5430 pd->src, pd->af)) {
5431 nsn = 0;
5432 goto cleanup;
5433 }
5434 }
5435
5436 /* check maximums */
5437 if (r->max_states && (r->states >= r->max_states)) {
5438 pf_status.lcounters[LCNT_STATES]++;
5439 REASON_SET(&reason, PFRES_MAXSTATES);
5440 goto cleanup;
5441 }
5442 /* src node for filter rule */
5443 if ((r->rule_flag & PFRULE_SRCTRACK ||
5444 r->rpool.opts & PF_POOL_STICKYADDR) &&
5445 pf_insert_src_node(&sn, r, saddr, af) != 0) {
5446 REASON_SET(&reason, PFRES_SRCLIMIT);
5447 goto cleanup;
5448 }
5449 /* src node for translation rule */
5450 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) &&
5451 ((direction == PF_OUT &&
5452 nr->action != PF_RDR &&
5453 pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) ||
5454 (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) {
5455 REASON_SET(&reason, PFRES_SRCLIMIT);
5456 goto cleanup;
5457 }
5458 s = pool_get(&pf_state_pl, PR_WAITOK);
5459 if (s == NULL) {
5460 REASON_SET(&reason, PFRES_MEMORY);
5461 cleanup:
5462 if (sn != NULL && sn->states == 0 && sn->expire == 0) {
5463 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn);
5464 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
5465 pf_status.src_nodes--;
5466 pool_put(&pf_src_tree_pl, sn);
5467 }
5468 if (nsn != sn && nsn != NULL && nsn->states == 0 &&
5469 nsn->expire == 0) {
5470 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn);
5471 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
5472 pf_status.src_nodes--;
5473 pool_put(&pf_src_tree_pl, nsn);
5474 }
5475 if (sk != NULL) {
5476 if (sk->app_state)
5477 pool_put(&pf_app_state_pl,
5478 sk->app_state);
5479 pool_put(&pf_state_key_pl, sk);
5480 }
5481 return (PF_DROP);
5482 }
5483 bzero(s, sizeof (*s));
5484 TAILQ_INIT(&s->unlink_hooks);
5485 s->rule.ptr = r;
5486 s->nat_rule.ptr = nr;
5487 s->anchor.ptr = a;
5488 STATE_INC_COUNTERS(s);
5489 s->allow_opts = r->allow_opts;
5490 s->log = r->log & PF_LOG_ALL;
5491 if (nr != NULL)
5492 s->log |= nr->log & PF_LOG_ALL;
5493 switch (pd->proto) {
5494 case IPPROTO_TCP:
5495 s->src.seqlo = ntohl(th->th_seq);
5496 s->src.seqhi = s->src.seqlo + pd->p_len + 1;
5497 if ((th->th_flags & (TH_SYN|TH_ACK)) ==
5498 TH_SYN && r->keep_state == PF_STATE_MODULATE) {
5499 /* Generate sequence number modulator */
5500 if ((s->src.seqdiff = pf_tcp_iss(pd) -
5501 s->src.seqlo) == 0)
5502 s->src.seqdiff = 1;
5503 pf_change_a(&th->th_seq, &th->th_sum,
5504 htonl(s->src.seqlo + s->src.seqdiff), 0);
5505 rewrite = off + sizeof (*th);
5506 } else
5507 s->src.seqdiff = 0;
5508 if (th->th_flags & TH_SYN) {
5509 s->src.seqhi++;
5510 s->src.wscale = pf_get_wscale(m, off,
5511 th->th_off, af);
5512 }
5513 s->src.max_win = MAX(ntohs(th->th_win), 1);
5514 if (s->src.wscale & PF_WSCALE_MASK) {
5515 /* Remove scale factor from initial window */
5516 int win = s->src.max_win;
5517 win += 1 << (s->src.wscale & PF_WSCALE_MASK);
5518 s->src.max_win = (win - 1) >>
5519 (s->src.wscale & PF_WSCALE_MASK);
5520 }
5521 if (th->th_flags & TH_FIN)
5522 s->src.seqhi++;
5523 s->dst.seqhi = 1;
5524 s->dst.max_win = 1;
5525 s->src.state = TCPS_SYN_SENT;
5526 s->dst.state = TCPS_CLOSED;
5527 s->timeout = PFTM_TCP_FIRST_PACKET;
5528 break;
5529 case IPPROTO_UDP:
5530 s->src.state = PFUDPS_SINGLE;
5531 s->dst.state = PFUDPS_NO_TRAFFIC;
5532 s->timeout = PFTM_UDP_FIRST_PACKET;
5533 break;
5534 case IPPROTO_ICMP:
5535 #if INET6
5536 case IPPROTO_ICMPV6:
5537 #endif
5538 s->timeout = PFTM_ICMP_FIRST_PACKET;
5539 break;
5540 case IPPROTO_GRE:
5541 s->src.state = PFGRE1S_INITIATING;
5542 s->dst.state = PFGRE1S_NO_TRAFFIC;
5543 s->timeout = PFTM_GREv1_INITIATING;
5544 break;
5545 case IPPROTO_ESP:
5546 s->src.state = PFESPS_INITIATING;
5547 s->dst.state = PFESPS_NO_TRAFFIC;
5548 s->timeout = PFTM_ESP_FIRST_PACKET;
5549 break;
5550 default:
5551 s->src.state = PFOTHERS_SINGLE;
5552 s->dst.state = PFOTHERS_NO_TRAFFIC;
5553 s->timeout = PFTM_OTHER_FIRST_PACKET;
5554 }
5555
5556 s->creation = pf_time_second();
5557 s->expire = pf_time_second();
5558
5559 if (sn != NULL) {
5560 s->src_node = sn;
5561 s->src_node->states++;
5562 VERIFY(s->src_node->states != 0);
5563 }
5564 if (nsn != NULL) {
5565 PF_ACPY(&nsn->raddr, &pd->naddr, af);
5566 s->nat_src_node = nsn;
5567 s->nat_src_node->states++;
5568 VERIFY(s->nat_src_node->states != 0);
5569 }
5570 if (pd->proto == IPPROTO_TCP) {
5571 if ((pd->flags & PFDESC_TCP_NORM) &&
5572 pf_normalize_tcp_init(m, off, pd, th, &s->src,
5573 &s->dst)) {
5574 REASON_SET(&reason, PFRES_MEMORY);
5575 pf_src_tree_remove_state(s);
5576 STATE_DEC_COUNTERS(s);
5577 pool_put(&pf_state_pl, s);
5578 return (PF_DROP);
5579 }
5580 if ((pd->flags & PFDESC_TCP_NORM) && s->src.scrub &&
5581 pf_normalize_tcp_stateful(m, off, pd, &reason,
5582 th, s, &s->src, &s->dst, &rewrite)) {
5583 /* This really shouldn't happen!!! */
5584 DPFPRINTF(PF_DEBUG_URGENT,
5585 ("pf_normalize_tcp_stateful failed on "
5586 "first pkt"));
5587 pf_normalize_tcp_cleanup(s);
5588 pf_src_tree_remove_state(s);
5589 STATE_DEC_COUNTERS(s);
5590 pool_put(&pf_state_pl, s);
5591 return (PF_DROP);
5592 }
5593 }
5594
5595 /* allocate state key and import values from psk */
5596 if ((sk = pf_alloc_state_key(s, &psk)) == NULL) {
5597 REASON_SET(&reason, PFRES_MEMORY);
5598 goto cleanup;
5599 }
5600
5601 pf_set_rt_ifp(s, saddr, af); /* needs s->state_key set */
5602
5603 m = pd->mp;
5604
5605 if (sk->app_state == 0) {
5606 switch (pd->proto) {
5607 case IPPROTO_TCP: {
5608 u_int16_t dport = (direction == PF_OUT) ?
5609 sk->ext_gwy.xport.port : sk->gwy.xport.port;
5610
5611 if (nr != NULL &&
5612 ntohs(dport) == PF_PPTP_PORT) {
5613 struct pf_app_state *as;
5614
5615 as = pool_get(&pf_app_state_pl,
5616 PR_WAITOK);
5617 if (!as) {
5618 REASON_SET(&reason,
5619 PFRES_MEMORY);
5620 goto cleanup;
5621 }
5622
5623 bzero(as, sizeof (*as));
5624 as->handler = pf_pptp_handler;
5625 as->compare_lan_ext = 0;
5626 as->compare_ext_gwy = 0;
5627 as->u.pptp.grev1_state = 0;
5628 sk->app_state = as;
5629 (void) hook_establish(&s->unlink_hooks,
5630 0, (hook_fn_t) pf_pptp_unlink, s);
5631 }
5632 break;
5633 }
5634
5635 case IPPROTO_UDP: {
5636 if (nr != NULL &&
5637 ntohs(uh->uh_sport) == PF_IKE_PORT &&
5638 ntohs(uh->uh_dport) == PF_IKE_PORT) {
5639 struct pf_app_state *as;
5640
5641 as = pool_get(&pf_app_state_pl,
5642 PR_WAITOK);
5643 if (!as) {
5644 REASON_SET(&reason,
5645 PFRES_MEMORY);
5646 goto cleanup;
5647 }
5648
5649 bzero(as, sizeof (*as));
5650 as->compare_lan_ext = pf_ike_compare;
5651 as->compare_ext_gwy = pf_ike_compare;
5652 as->u.ike.cookie = ike.initiator_cookie;
5653 sk->app_state = as;
5654 }
5655 break;
5656 }
5657
5658 default:
5659 break;
5660 }
5661 }
5662
5663 if (pf_insert_state(BOUND_IFACE(r, kif), s)) {
5664 if (pd->proto == IPPROTO_TCP)
5665 pf_normalize_tcp_cleanup(s);
5666 REASON_SET(&reason, PFRES_STATEINS);
5667 pf_src_tree_remove_state(s);
5668 STATE_DEC_COUNTERS(s);
5669 pool_put(&pf_state_pl, s);
5670 return (PF_DROP);
5671 } else
5672 *sm = s;
5673 if (tag > 0) {
5674 pf_tag_ref(tag);
5675 s->tag = tag;
5676 }
5677 if (pd->proto == IPPROTO_TCP &&
5678 (th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN &&
5679 r->keep_state == PF_STATE_SYNPROXY) {
5680 int ua = (sk->af_lan == sk->af_gwy) ? 1 : 0;
5681 s->src.state = PF_TCPS_PROXY_SRC;
5682 if (nr != NULL) {
5683 if (direction == PF_OUT) {
5684 pf_change_ap(direction, pd->mp, saddr,
5685 &th->th_sport, pd->ip_sum,
5686 &th->th_sum, &pd->baddr,
5687 bxport.port, 0, af, pd->af, ua);
5688 sxport.port = th->th_sport;
5689 } else {
5690 pf_change_ap(direction, pd->mp, daddr,
5691 &th->th_dport, pd->ip_sum,
5692 &th->th_sum, &pd->baddr,
5693 bxport.port, 0, af, pd->af, ua);
5694 sxport.port = th->th_dport;
5695 }
5696 }
5697 s->src.seqhi = htonl(random());
5698 /* Find mss option */
5699 mss = pf_get_mss(m, off, th->th_off, af);
5700 mss = pf_calc_mss(saddr, af, mss);
5701 mss = pf_calc_mss(daddr, af, mss);
5702 s->src.mss = mss;
5703 pf_send_tcp(r, af, daddr, saddr, th->th_dport,
5704 th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1,
5705 TH_SYN|TH_ACK, 0, s->src.mss, 0, 1, 0, NULL, NULL);
5706 REASON_SET(&reason, PFRES_SYNPROXY);
5707 return (PF_SYNPROXY_DROP);
5708 }
5709
5710 if (sk->app_state && sk->app_state->handler) {
5711 int offx = off;
5712
5713 switch (pd->proto) {
5714 case IPPROTO_TCP:
5715 offx += th->th_off << 2;
5716 break;
5717 case IPPROTO_UDP:
5718 offx += pd->hdr.udp->uh_ulen << 2;
5719 break;
5720 default:
5721 /* ALG handlers only apply to TCP and UDP rules */
5722 break;
5723 }
5724
5725 if (offx > off) {
5726 sk->app_state->handler(s, direction, offx,
5727 pd, kif);
5728 if (pd->lmw < 0) {
5729 REASON_SET(&reason, PFRES_MEMORY);
5730 return (PF_DROP);
5731 }
5732 m = pd->mp;
5733 }
5734 }
5735 }
5736
5737 /* copy back packet headers if we performed NAT operations */
5738 if (rewrite) {
5739 if (rewrite < off + hdrlen)
5740 rewrite = off + hdrlen;
5741
5742 m = pf_lazy_makewritable(pd, pd->mp, rewrite);
5743 if (!m) {
5744 REASON_SET(&reason, PFRES_MEMORY);
5745 return (PF_DROP);
5746 }
5747
5748 m_copyback(m, off, hdrlen, pd->hdr.any);
5749 if (af == AF_INET6 && pd->naf == AF_INET)
5750 return pf_nat64_ipv6(m, off, pd);
5751 else if (af == AF_INET && pd->naf == AF_INET6)
5752 return pf_nat64_ipv4(m, off, pd);
5753
5754 }
5755
5756 return (PF_PASS);
5757 }
5758
5759 #if DUMMYNET
5760 /*
5761 * When pf_test_dummynet() returns PF_PASS, the rule matching parameter "rm"
5762 * remains unchanged, meaning the packet did not match a dummynet rule.
5763 * when the packet does match a dummynet rule, pf_test_dummynet() returns
5764 * PF_PASS and zero out the mbuf rule as the packet is effectively siphoned
5765 * out by dummynet.
5766 */
5767 static int
5768 pf_test_dummynet(struct pf_rule **rm, int direction, struct pfi_kif *kif,
5769 struct mbuf **m0, struct pf_pdesc *pd, struct ip_fw_args *fwa)
5770 {
5771 struct mbuf *m = *m0;
5772 struct pf_rule *am = NULL;
5773 struct pf_ruleset *rsm = NULL;
5774 struct pf_addr *saddr = pd->src, *daddr = pd->dst;
5775 sa_family_t af = pd->af;
5776 struct pf_rule *r, *a = NULL;
5777 struct pf_ruleset *ruleset = NULL;
5778 struct tcphdr *th = pd->hdr.tcp;
5779 u_short reason;
5780 int hdrlen = 0;
5781 int tag = -1;
5782 unsigned int rtableid = IFSCOPE_NONE;
5783 int asd = 0;
5784 int match = 0;
5785 u_int8_t icmptype = 0, icmpcode = 0;
5786 struct ip_fw_args dnflow;
5787 struct pf_rule *prev_matching_rule = fwa ? fwa->fwa_pf_rule : NULL;
5788 int found_prev_rule = (prev_matching_rule) ? 0 : 1;
5789
5790 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
5791
5792 if (!DUMMYNET_LOADED)
5793 return (PF_PASS);
5794
5795 if (TAILQ_EMPTY(pf_main_ruleset.rules[PF_RULESET_DUMMYNET].active.ptr))
5796 return (PF_PASS);
5797
5798 bzero(&dnflow, sizeof(dnflow));
5799
5800 hdrlen = 0;
5801
5802 /* Fragments don't gave protocol headers */
5803 if (!(pd->flags & PFDESC_IP_FRAG))
5804 switch (pd->proto) {
5805 case IPPROTO_TCP:
5806 dnflow.fwa_id.flags = pd->hdr.tcp->th_flags;
5807 dnflow.fwa_id.dst_port = ntohs(pd->hdr.tcp->th_dport);
5808 dnflow.fwa_id.src_port = ntohs(pd->hdr.tcp->th_sport);
5809 hdrlen = sizeof (*th);
5810 break;
5811 case IPPROTO_UDP:
5812 dnflow.fwa_id.dst_port = ntohs(pd->hdr.udp->uh_dport);
5813 dnflow.fwa_id.src_port = ntohs(pd->hdr.udp->uh_sport);
5814 hdrlen = sizeof (*pd->hdr.udp);
5815 break;
5816 #if INET
5817 case IPPROTO_ICMP:
5818 if (af != AF_INET)
5819 break;
5820 hdrlen = ICMP_MINLEN;
5821 icmptype = pd->hdr.icmp->icmp_type;
5822 icmpcode = pd->hdr.icmp->icmp_code;
5823 break;
5824 #endif /* INET */
5825 #if INET6
5826 case IPPROTO_ICMPV6:
5827 if (af != AF_INET6)
5828 break;
5829 hdrlen = sizeof (*pd->hdr.icmp6);
5830 icmptype = pd->hdr.icmp6->icmp6_type;
5831 icmpcode = pd->hdr.icmp6->icmp6_code;
5832 break;
5833 #endif /* INET6 */
5834 case IPPROTO_GRE:
5835 if (pd->proto_variant == PF_GRE_PPTP_VARIANT)
5836 hdrlen = sizeof (*pd->hdr.grev1);
5837 break;
5838 case IPPROTO_ESP:
5839 hdrlen = sizeof (*pd->hdr.esp);
5840 break;
5841 }
5842
5843 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_DUMMYNET].active.ptr);
5844
5845 while (r != NULL) {
5846 r->evaluations++;
5847 if (pfi_kif_match(r->kif, kif) == r->ifnot)
5848 r = r->skip[PF_SKIP_IFP].ptr;
5849 else if (r->direction && r->direction != direction)
5850 r = r->skip[PF_SKIP_DIR].ptr;
5851 else if (r->af && r->af != af)
5852 r = r->skip[PF_SKIP_AF].ptr;
5853 else if (r->proto && r->proto != pd->proto)
5854 r = r->skip[PF_SKIP_PROTO].ptr;
5855 else if (PF_MISMATCHAW(&r->src.addr, saddr, af,
5856 r->src.neg, kif))
5857 r = r->skip[PF_SKIP_SRC_ADDR].ptr;
5858 /* tcp/udp only. port_op always 0 in other cases */
5859 else if (r->proto == pd->proto &&
5860 (r->proto == IPPROTO_TCP || r->proto == IPPROTO_UDP) &&
5861 ((pd->flags & PFDESC_IP_FRAG) ||
5862 ((r->src.xport.range.op &&
5863 !pf_match_port(r->src.xport.range.op,
5864 r->src.xport.range.port[0], r->src.xport.range.port[1],
5865 th->th_sport)))))
5866 r = r->skip[PF_SKIP_SRC_PORT].ptr;
5867 else if (PF_MISMATCHAW(&r->dst.addr, daddr, af,
5868 r->dst.neg, NULL))
5869 r = r->skip[PF_SKIP_DST_ADDR].ptr;
5870 /* tcp/udp only. port_op always 0 in other cases */
5871 else if (r->proto == pd->proto &&
5872 (r->proto == IPPROTO_TCP || r->proto == IPPROTO_UDP) &&
5873 r->dst.xport.range.op &&
5874 ((pd->flags & PFDESC_IP_FRAG) ||
5875 !pf_match_port(r->dst.xport.range.op,
5876 r->dst.xport.range.port[0], r->dst.xport.range.port[1],
5877 th->th_dport)))
5878 r = r->skip[PF_SKIP_DST_PORT].ptr;
5879 /* icmp only. type always 0 in other cases */
5880 else if (r->type &&
5881 ((pd->flags & PFDESC_IP_FRAG) ||
5882 r->type != icmptype + 1))
5883 r = TAILQ_NEXT(r, entries);
5884 /* icmp only. type always 0 in other cases */
5885 else if (r->code &&
5886 ((pd->flags & PFDESC_IP_FRAG) ||
5887 r->code != icmpcode + 1))
5888 r = TAILQ_NEXT(r, entries);
5889 else if (r->tos && !(r->tos == pd->tos))
5890 r = TAILQ_NEXT(r, entries);
5891 else if (r->rule_flag & PFRULE_FRAGMENT)
5892 r = TAILQ_NEXT(r, entries);
5893 else if (pd->proto == IPPROTO_TCP &&
5894 ((pd->flags & PFDESC_IP_FRAG) ||
5895 (r->flagset & th->th_flags) != r->flags))
5896 r = TAILQ_NEXT(r, entries);
5897 else if (r->prob && r->prob <= (RandomULong() % (UINT_MAX - 1) + 1))
5898 r = TAILQ_NEXT(r, entries);
5899 else if (r->match_tag && !pf_match_tag(m, r, pd->pf_mtag, &tag))
5900 r = TAILQ_NEXT(r, entries);
5901 else {
5902 /*
5903 * Need to go past the previous dummynet matching rule
5904 */
5905 if (r->anchor == NULL) {
5906 if (found_prev_rule) {
5907 if (r->tag)
5908 tag = r->tag;
5909 if (PF_RTABLEID_IS_VALID(r->rtableid))
5910 rtableid = r->rtableid;
5911 match = 1;
5912 *rm = r;
5913 am = a;
5914 rsm = ruleset;
5915 if ((*rm)->quick)
5916 break;
5917 } else if (r == prev_matching_rule) {
5918 found_prev_rule = 1;
5919 }
5920 r = TAILQ_NEXT(r, entries);
5921 } else {
5922 pf_step_into_anchor(&asd, &ruleset,
5923 PF_RULESET_DUMMYNET, &r, &a, &match);
5924 }
5925 }
5926 if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset,
5927 PF_RULESET_DUMMYNET, &r, &a, &match))
5928 break;
5929 }
5930 r = *rm;
5931 a = am;
5932 ruleset = rsm;
5933
5934 if (!match)
5935 return (PF_PASS);
5936
5937 REASON_SET(&reason, PFRES_DUMMYNET);
5938
5939 if (r->log) {
5940 PFLOG_PACKET(kif, h, m, af, direction, reason, r,
5941 a, ruleset, pd);
5942 }
5943
5944 if (r->action == PF_NODUMMYNET) {
5945 int dirndx = (direction == PF_OUT);
5946
5947 r->packets[dirndx]++;
5948 r->bytes[dirndx] += pd->tot_len;
5949
5950 return (PF_PASS);
5951 }
5952 if (pf_tag_packet(m, pd->pf_mtag, tag, rtableid, pd)) {
5953 REASON_SET(&reason, PFRES_MEMORY);
5954
5955 return (PF_DROP);
5956 }
5957
5958 if (r->dnpipe && ip_dn_io_ptr != NULL) {
5959 int dirndx = (direction == PF_OUT);
5960
5961 r->packets[dirndx]++;
5962 r->bytes[dirndx] += pd->tot_len;
5963
5964 dnflow.fwa_cookie = r->dnpipe;
5965 dnflow.fwa_pf_rule = r;
5966 dnflow.fwa_id.proto = pd->proto;
5967 dnflow.fwa_flags = r->dntype;
5968 switch (af) {
5969 case AF_INET:
5970 dnflow.fwa_id.addr_type = 4;
5971 dnflow.fwa_id.src_ip = ntohl(saddr->v4.s_addr);
5972 dnflow.fwa_id.dst_ip = ntohl(daddr->v4.s_addr);
5973 break;
5974 case AF_INET6:
5975 dnflow.fwa_id.addr_type = 6;
5976 dnflow.fwa_id.src_ip6 = saddr->v6;
5977 dnflow.fwa_id.dst_ip6 = saddr->v6;
5978 break;
5979 }
5980
5981 if (fwa != NULL) {
5982 dnflow.fwa_oif = fwa->fwa_oif;
5983 dnflow.fwa_oflags = fwa->fwa_oflags;
5984 /*
5985 * Note that fwa_ro, fwa_dst and fwa_ipoa are
5986 * actually in a union so the following does work
5987 * for both IPv4 and IPv6
5988 */
5989 dnflow.fwa_ro = fwa->fwa_ro;
5990 dnflow.fwa_dst = fwa->fwa_dst;
5991 dnflow.fwa_ipoa = fwa->fwa_ipoa;
5992 dnflow.fwa_ro6_pmtu = fwa->fwa_ro6_pmtu;
5993 dnflow.fwa_origifp = fwa->fwa_origifp;
5994 dnflow.fwa_mtu = fwa->fwa_mtu;
5995 dnflow.fwa_alwaysfrag = fwa->fwa_alwaysfrag;
5996 dnflow.fwa_unfragpartlen = fwa->fwa_unfragpartlen;
5997 dnflow.fwa_exthdrs = fwa->fwa_exthdrs;
5998 }
5999
6000 if (af == AF_INET) {
6001 struct ip *iphdr = mtod(m, struct ip *);
6002 NTOHS(iphdr->ip_len);
6003 NTOHS(iphdr->ip_off);
6004 }
6005 /*
6006 * Don't need to unlock pf_lock as NET_THREAD_HELD_PF
6007 * allows for recursive behavior
6008 */
6009 ip_dn_io_ptr(m,
6010 dnflow.fwa_cookie,
6011 af == AF_INET ?
6012 direction == PF_IN ? DN_TO_IP_IN : DN_TO_IP_OUT :
6013 direction == PF_IN ? DN_TO_IP6_IN : DN_TO_IP6_OUT,
6014 &dnflow, DN_CLIENT_PF);
6015
6016 /*
6017 * The packet is siphoned out by dummynet so return a NULL
6018 * mbuf so the caller can still return success.
6019 */
6020 *m0 = NULL;
6021
6022 return (PF_PASS);
6023 }
6024
6025 return (PF_PASS);
6026 }
6027 #endif /* DUMMYNET */
6028
6029 static int
6030 pf_test_fragment(struct pf_rule **rm, int direction, struct pfi_kif *kif,
6031 struct mbuf *m, void *h, struct pf_pdesc *pd, struct pf_rule **am,
6032 struct pf_ruleset **rsm)
6033 {
6034 #pragma unused(h)
6035 struct pf_rule *r, *a = NULL;
6036 struct pf_ruleset *ruleset = NULL;
6037 sa_family_t af = pd->af;
6038 u_short reason;
6039 int tag = -1;
6040 int asd = 0;
6041 int match = 0;
6042
6043 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
6044 while (r != NULL) {
6045 r->evaluations++;
6046 if (pfi_kif_match(r->kif, kif) == r->ifnot)
6047 r = r->skip[PF_SKIP_IFP].ptr;
6048 else if (r->direction && r->direction != direction)
6049 r = r->skip[PF_SKIP_DIR].ptr;
6050 else if (r->af && r->af != af)
6051 r = r->skip[PF_SKIP_AF].ptr;
6052 else if (r->proto && r->proto != pd->proto)
6053 r = r->skip[PF_SKIP_PROTO].ptr;
6054 else if (PF_MISMATCHAW(&r->src.addr, pd->src, af,
6055 r->src.neg, kif))
6056 r = r->skip[PF_SKIP_SRC_ADDR].ptr;
6057 else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af,
6058 r->dst.neg, NULL))
6059 r = r->skip[PF_SKIP_DST_ADDR].ptr;
6060 else if ((r->rule_flag & PFRULE_TOS) && r->tos &&
6061 !(r->tos & pd->tos))
6062 r = TAILQ_NEXT(r, entries);
6063 else if ((r->rule_flag & PFRULE_DSCP) && r->tos &&
6064 !(r->tos & (pd->tos & DSCP_MASK)))
6065 r = TAILQ_NEXT(r, entries);
6066 else if ((r->rule_flag & PFRULE_SC) && r->tos &&
6067 ((r->tos & SCIDX_MASK) != pd->sc))
6068 r = TAILQ_NEXT(r, entries);
6069 else if (r->os_fingerprint != PF_OSFP_ANY)
6070 r = TAILQ_NEXT(r, entries);
6071 else if (pd->proto == IPPROTO_UDP &&
6072 (r->src.xport.range.op || r->dst.xport.range.op))
6073 r = TAILQ_NEXT(r, entries);
6074 else if (pd->proto == IPPROTO_TCP &&
6075 (r->src.xport.range.op || r->dst.xport.range.op ||
6076 r->flagset))
6077 r = TAILQ_NEXT(r, entries);
6078 else if ((pd->proto == IPPROTO_ICMP ||
6079 pd->proto == IPPROTO_ICMPV6) &&
6080 (r->type || r->code))
6081 r = TAILQ_NEXT(r, entries);
6082 else if (r->prob && r->prob <= (RandomULong() % (UINT_MAX - 1) + 1))
6083 r = TAILQ_NEXT(r, entries);
6084 else if (r->match_tag && !pf_match_tag(m, r, pd->pf_mtag, &tag))
6085 r = TAILQ_NEXT(r, entries);
6086 else {
6087 if (r->anchor == NULL) {
6088 match = 1;
6089 *rm = r;
6090 *am = a;
6091 *rsm = ruleset;
6092 if ((*rm)->quick)
6093 break;
6094 r = TAILQ_NEXT(r, entries);
6095 } else
6096 pf_step_into_anchor(&asd, &ruleset,
6097 PF_RULESET_FILTER, &r, &a, &match);
6098 }
6099 if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset,
6100 PF_RULESET_FILTER, &r, &a, &match))
6101 break;
6102 }
6103 r = *rm;
6104 a = *am;
6105 ruleset = *rsm;
6106
6107 REASON_SET(&reason, PFRES_MATCH);
6108
6109 if (r->log)
6110 PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset,
6111 pd);
6112
6113 if (r->action != PF_PASS)
6114 return (PF_DROP);
6115
6116 if (pf_tag_packet(m, pd->pf_mtag, tag, -1, NULL)) {
6117 REASON_SET(&reason, PFRES_MEMORY);
6118 return (PF_DROP);
6119 }
6120
6121 return (PF_PASS);
6122 }
6123
6124 static void
6125 pf_pptp_handler(struct pf_state *s, int direction, int off,
6126 struct pf_pdesc *pd, struct pfi_kif *kif)
6127 {
6128 #pragma unused(direction)
6129 struct tcphdr *th;
6130 struct pf_pptp_state *pptps;
6131 struct pf_pptp_ctrl_msg cm;
6132 size_t plen, tlen;
6133 struct pf_state *gs;
6134 u_int16_t ct;
6135 u_int16_t *pac_call_id;
6136 u_int16_t *pns_call_id;
6137 u_int16_t *spoof_call_id;
6138 u_int8_t *pac_state;
6139 u_int8_t *pns_state;
6140 enum { PF_PPTP_PASS, PF_PPTP_INSERT_GRE, PF_PPTP_REMOVE_GRE } op;
6141 struct mbuf *m;
6142 struct pf_state_key *sk;
6143 struct pf_state_key *gsk;
6144 struct pf_app_state *gas;
6145
6146 sk = s->state_key;
6147 pptps = &sk->app_state->u.pptp;
6148 gs = pptps->grev1_state;
6149
6150 if (gs)
6151 gs->expire = pf_time_second();
6152
6153 m = pd->mp;
6154 plen = min(sizeof (cm), m->m_pkthdr.len - off);
6155 if (plen < PF_PPTP_CTRL_MSG_MINSIZE)
6156 return;
6157 tlen = plen - PF_PPTP_CTRL_MSG_MINSIZE;
6158 m_copydata(m, off, plen, &cm);
6159
6160 if (ntohl(cm.hdr.magic) != PF_PPTP_MAGIC_NUMBER)
6161 return;
6162 if (ntohs(cm.hdr.type) != 1)
6163 return;
6164
6165 #define TYPE_LEN_CHECK(_type, _name) \
6166 case PF_PPTP_CTRL_TYPE_##_type: \
6167 if (tlen < sizeof(struct pf_pptp_ctrl_##_name)) \
6168 return; \
6169 break;
6170
6171 switch (cm.ctrl.type) {
6172 TYPE_LEN_CHECK(START_REQ, start_req);
6173 TYPE_LEN_CHECK(START_RPY, start_rpy);
6174 TYPE_LEN_CHECK(STOP_REQ, stop_req);
6175 TYPE_LEN_CHECK(STOP_RPY, stop_rpy);
6176 TYPE_LEN_CHECK(ECHO_REQ, echo_req);
6177 TYPE_LEN_CHECK(ECHO_RPY, echo_rpy);
6178 TYPE_LEN_CHECK(CALL_OUT_REQ, call_out_req);
6179 TYPE_LEN_CHECK(CALL_OUT_RPY, call_out_rpy);
6180 TYPE_LEN_CHECK(CALL_IN_1ST, call_in_1st);
6181 TYPE_LEN_CHECK(CALL_IN_2ND, call_in_2nd);
6182 TYPE_LEN_CHECK(CALL_IN_3RD, call_in_3rd);
6183 TYPE_LEN_CHECK(CALL_CLR, call_clr);
6184 TYPE_LEN_CHECK(CALL_DISC, call_disc);
6185 TYPE_LEN_CHECK(ERROR, error);
6186 TYPE_LEN_CHECK(SET_LINKINFO, set_linkinfo);
6187 default:
6188 return;
6189 }
6190 #undef TYPE_LEN_CHECK
6191
6192 if (!gs) {
6193 gs = pool_get(&pf_state_pl, PR_WAITOK);
6194 if (!gs)
6195 return;
6196
6197 memcpy(gs, s, sizeof (*gs));
6198
6199 memset(&gs->entry_id, 0, sizeof (gs->entry_id));
6200 memset(&gs->entry_list, 0, sizeof (gs->entry_list));
6201
6202 TAILQ_INIT(&gs->unlink_hooks);
6203 gs->rt_kif = NULL;
6204 gs->creation = 0;
6205 gs->pfsync_time = 0;
6206 gs->packets[0] = gs->packets[1] = 0;
6207 gs->bytes[0] = gs->bytes[1] = 0;
6208 gs->timeout = PFTM_UNLINKED;
6209 gs->id = gs->creatorid = 0;
6210 gs->src.state = gs->dst.state = PFGRE1S_NO_TRAFFIC;
6211 gs->src.scrub = gs->dst.scrub = 0;
6212
6213 gas = pool_get(&pf_app_state_pl, PR_NOWAIT);
6214 if (!gas) {
6215 pool_put(&pf_state_pl, gs);
6216 return;
6217 }
6218
6219 gsk = pf_alloc_state_key(gs, NULL);
6220 if (!gsk) {
6221 pool_put(&pf_app_state_pl, gas);
6222 pool_put(&pf_state_pl, gs);
6223 return;
6224 }
6225
6226 memcpy(&gsk->lan, &sk->lan, sizeof (gsk->lan));
6227 memcpy(&gsk->gwy, &sk->gwy, sizeof (gsk->gwy));
6228 memcpy(&gsk->ext_lan, &sk->ext_lan, sizeof (gsk->ext_lan));
6229 memcpy(&gsk->ext_gwy, &sk->ext_gwy, sizeof (gsk->ext_gwy));
6230 gsk->af_lan = sk->af_lan;
6231 gsk->af_gwy = sk->af_gwy;
6232 gsk->proto = IPPROTO_GRE;
6233 gsk->proto_variant = PF_GRE_PPTP_VARIANT;
6234 gsk->app_state = gas;
6235 gsk->lan.xport.call_id = 0;
6236 gsk->gwy.xport.call_id = 0;
6237 gsk->ext_lan.xport.call_id = 0;
6238 gsk->ext_gwy.xport.call_id = 0;
6239 gsk->flowsrc = FLOWSRC_PF;
6240 gsk->flowhash = pf_calc_state_key_flowhash(gsk);
6241 memset(gas, 0, sizeof (*gas));
6242 gas->u.grev1.pptp_state = s;
6243 STATE_INC_COUNTERS(gs);
6244 pptps->grev1_state = gs;
6245 (void) hook_establish(&gs->unlink_hooks, 0,
6246 (hook_fn_t) pf_grev1_unlink, gs);
6247 } else {
6248 gsk = gs->state_key;
6249 }
6250
6251 switch (sk->direction) {
6252 case PF_IN:
6253 pns_call_id = &gsk->ext_lan.xport.call_id;
6254 pns_state = &gs->dst.state;
6255 pac_call_id = &gsk->lan.xport.call_id;
6256 pac_state = &gs->src.state;
6257 break;
6258
6259 case PF_OUT:
6260 pns_call_id = &gsk->lan.xport.call_id;
6261 pns_state = &gs->src.state;
6262 pac_call_id = &gsk->ext_lan.xport.call_id;
6263 pac_state = &gs->dst.state;
6264 break;
6265
6266 default:
6267 DPFPRINTF(PF_DEBUG_URGENT,
6268 ("pf_pptp_handler: bad directional!\n"));
6269 return;
6270 }
6271
6272 spoof_call_id = 0;
6273 op = PF_PPTP_PASS;
6274
6275 ct = ntohs(cm.ctrl.type);
6276
6277 switch (ct) {
6278 case PF_PPTP_CTRL_TYPE_CALL_OUT_REQ:
6279 *pns_call_id = cm.msg.call_out_req.call_id;
6280 *pns_state = PFGRE1S_INITIATING;
6281 if (s->nat_rule.ptr && pns_call_id == &gsk->lan.xport.call_id)
6282 spoof_call_id = &cm.msg.call_out_req.call_id;
6283 break;
6284
6285 case PF_PPTP_CTRL_TYPE_CALL_OUT_RPY:
6286 *pac_call_id = cm.msg.call_out_rpy.call_id;
6287 if (s->nat_rule.ptr)
6288 spoof_call_id =
6289 (pac_call_id == &gsk->lan.xport.call_id) ?
6290 &cm.msg.call_out_rpy.call_id :
6291 &cm.msg.call_out_rpy.peer_call_id;
6292 if (gs->timeout == PFTM_UNLINKED) {
6293 *pac_state = PFGRE1S_INITIATING;
6294 op = PF_PPTP_INSERT_GRE;
6295 }
6296 break;
6297
6298 case PF_PPTP_CTRL_TYPE_CALL_IN_1ST:
6299 *pns_call_id = cm.msg.call_in_1st.call_id;
6300 *pns_state = PFGRE1S_INITIATING;
6301 if (s->nat_rule.ptr && pns_call_id == &gsk->lan.xport.call_id)
6302 spoof_call_id = &cm.msg.call_in_1st.call_id;
6303 break;
6304
6305 case PF_PPTP_CTRL_TYPE_CALL_IN_2ND:
6306 *pac_call_id = cm.msg.call_in_2nd.call_id;
6307 *pac_state = PFGRE1S_INITIATING;
6308 if (s->nat_rule.ptr)
6309 spoof_call_id =
6310 (pac_call_id == &gsk->lan.xport.call_id) ?
6311 &cm.msg.call_in_2nd.call_id :
6312 &cm.msg.call_in_2nd.peer_call_id;
6313 break;
6314
6315 case PF_PPTP_CTRL_TYPE_CALL_IN_3RD:
6316 if (s->nat_rule.ptr && pns_call_id == &gsk->lan.xport.call_id)
6317 spoof_call_id = &cm.msg.call_in_3rd.call_id;
6318 if (cm.msg.call_in_3rd.call_id != *pns_call_id) {
6319 break;
6320 }
6321 if (gs->timeout == PFTM_UNLINKED)
6322 op = PF_PPTP_INSERT_GRE;
6323 break;
6324
6325 case PF_PPTP_CTRL_TYPE_CALL_CLR:
6326 if (cm.msg.call_clr.call_id != *pns_call_id)
6327 op = PF_PPTP_REMOVE_GRE;
6328 break;
6329
6330 case PF_PPTP_CTRL_TYPE_CALL_DISC:
6331 if (cm.msg.call_clr.call_id != *pac_call_id)
6332 op = PF_PPTP_REMOVE_GRE;
6333 break;
6334
6335 case PF_PPTP_CTRL_TYPE_ERROR:
6336 if (s->nat_rule.ptr && pns_call_id == &gsk->lan.xport.call_id)
6337 spoof_call_id = &cm.msg.error.peer_call_id;
6338 break;
6339
6340 case PF_PPTP_CTRL_TYPE_SET_LINKINFO:
6341 if (s->nat_rule.ptr && pac_call_id == &gsk->lan.xport.call_id)
6342 spoof_call_id = &cm.msg.set_linkinfo.peer_call_id;
6343 break;
6344
6345 default:
6346 op = PF_PPTP_PASS;
6347 break;
6348 }
6349
6350 if (!gsk->gwy.xport.call_id && gsk->lan.xport.call_id) {
6351 gsk->gwy.xport.call_id = gsk->lan.xport.call_id;
6352 if (spoof_call_id) {
6353 u_int16_t call_id = 0;
6354 int n = 0;
6355 struct pf_state_key_cmp key;
6356
6357 key.af_gwy = gsk->af_gwy;
6358 key.proto = IPPROTO_GRE;
6359 key.proto_variant = PF_GRE_PPTP_VARIANT;
6360 PF_ACPY(&key.gwy.addr, &gsk->gwy.addr, key.af_gwy);
6361 PF_ACPY(&key.ext_gwy.addr, &gsk->ext_gwy.addr, key.af_gwy);
6362 key.gwy.xport.call_id = gsk->gwy.xport.call_id;
6363 key.ext_gwy.xport.call_id = gsk->ext_gwy.xport.call_id;
6364 do {
6365 call_id = htonl(random());
6366 } while (!call_id);
6367
6368 while (pf_find_state_all(&key, PF_IN, 0)) {
6369 call_id = ntohs(call_id);
6370 --call_id;
6371 if (--call_id == 0) call_id = 0xffff;
6372 call_id = htons(call_id);
6373
6374 key.gwy.xport.call_id = call_id;
6375
6376 if (++n > 65535) {
6377 DPFPRINTF(PF_DEBUG_URGENT,
6378 ("pf_pptp_handler: failed to spoof "
6379 "call id\n"));
6380 key.gwy.xport.call_id = 0;
6381 break;
6382 }
6383 }
6384
6385 gsk->gwy.xport.call_id = call_id;
6386 }
6387 }
6388
6389 th = pd->hdr.tcp;
6390
6391 if (spoof_call_id && gsk->lan.xport.call_id != gsk->gwy.xport.call_id) {
6392 if (*spoof_call_id == gsk->gwy.xport.call_id) {
6393 *spoof_call_id = gsk->lan.xport.call_id;
6394 th->th_sum = pf_cksum_fixup(th->th_sum,
6395 gsk->gwy.xport.call_id, gsk->lan.xport.call_id, 0);
6396 } else {
6397 *spoof_call_id = gsk->gwy.xport.call_id;
6398 th->th_sum = pf_cksum_fixup(th->th_sum,
6399 gsk->lan.xport.call_id, gsk->gwy.xport.call_id, 0);
6400 }
6401
6402 m = pf_lazy_makewritable(pd, m, off + plen);
6403 if (!m) {
6404 pptps->grev1_state = NULL;
6405 STATE_DEC_COUNTERS(gs);
6406 pool_put(&pf_state_pl, gs);
6407 return;
6408 }
6409 m_copyback(m, off, plen, &cm);
6410 }
6411
6412 switch (op) {
6413 case PF_PPTP_REMOVE_GRE:
6414 gs->timeout = PFTM_PURGE;
6415 gs->src.state = gs->dst.state = PFGRE1S_NO_TRAFFIC;
6416 gsk->lan.xport.call_id = 0;
6417 gsk->gwy.xport.call_id = 0;
6418 gsk->ext_lan.xport.call_id = 0;
6419 gsk->ext_gwy.xport.call_id = 0;
6420 gs->id = gs->creatorid = 0;
6421 break;
6422
6423 case PF_PPTP_INSERT_GRE:
6424 gs->creation = pf_time_second();
6425 gs->expire = pf_time_second();
6426 gs->timeout = PFTM_TCP_ESTABLISHED;
6427 if (gs->src_node != NULL) {
6428 ++gs->src_node->states;
6429 VERIFY(gs->src_node->states != 0);
6430 }
6431 if (gs->nat_src_node != NULL) {
6432 ++gs->nat_src_node->states;
6433 VERIFY(gs->nat_src_node->states != 0);
6434 }
6435 pf_set_rt_ifp(gs, &sk->lan.addr, sk->af_lan);
6436 if (pf_insert_state(BOUND_IFACE(s->rule.ptr, kif), gs)) {
6437
6438 /*
6439 * <jhw@apple.com>
6440 * FIX ME: insertion can fail when multiple PNS
6441 * behind the same NAT open calls to the same PAC
6442 * simultaneously because spoofed call ID numbers
6443 * are chosen before states are inserted. This is
6444 * hard to fix and happens infrequently enough that
6445 * users will normally try again and this ALG will
6446 * succeed. Failures are expected to be rare enough
6447 * that fixing this is a low priority.
6448 */
6449 pptps->grev1_state = NULL;
6450 pd->lmw = -1; /* Force PF_DROP on PFRES_MEMORY */
6451 pf_src_tree_remove_state(gs);
6452 STATE_DEC_COUNTERS(gs);
6453 pool_put(&pf_state_pl, gs);
6454 DPFPRINTF(PF_DEBUG_URGENT, ("pf_pptp_handler: error "
6455 "inserting GREv1 state.\n"));
6456 }
6457 break;
6458
6459 default:
6460 break;
6461 }
6462 }
6463
6464 static void
6465 pf_pptp_unlink(struct pf_state *s)
6466 {
6467 struct pf_app_state *as = s->state_key->app_state;
6468 struct pf_state *grev1s = as->u.pptp.grev1_state;
6469
6470 if (grev1s) {
6471 struct pf_app_state *gas = grev1s->state_key->app_state;
6472
6473 if (grev1s->timeout < PFTM_MAX)
6474 grev1s->timeout = PFTM_PURGE;
6475 gas->u.grev1.pptp_state = NULL;
6476 as->u.pptp.grev1_state = NULL;
6477 }
6478 }
6479
6480 static void
6481 pf_grev1_unlink(struct pf_state *s)
6482 {
6483 struct pf_app_state *as = s->state_key->app_state;
6484 struct pf_state *pptps = as->u.grev1.pptp_state;
6485
6486 if (pptps) {
6487 struct pf_app_state *pas = pptps->state_key->app_state;
6488
6489 pas->u.pptp.grev1_state = NULL;
6490 as->u.grev1.pptp_state = NULL;
6491 }
6492 }
6493
6494 static int
6495 pf_ike_compare(struct pf_app_state *a, struct pf_app_state *b)
6496 {
6497 int64_t d = a->u.ike.cookie - b->u.ike.cookie;
6498 return ((d > 0) ? 1 : ((d < 0) ? -1 : 0));
6499 }
6500
6501 static int
6502 pf_do_nat64(struct pf_state_key *sk, struct pf_pdesc *pd, struct mbuf *m,
6503 int off)
6504 {
6505 if (pd->af == AF_INET) {
6506 if (pd->af != sk->af_lan) {
6507 pd->ndaddr = sk->lan.addr;
6508 pd->naddr = sk->ext_lan.addr;
6509 } else {
6510 pd->naddr = sk->gwy.addr;
6511 pd->ndaddr = sk->ext_gwy.addr;
6512 }
6513 return (pf_nat64_ipv4(m, off, pd));
6514 }
6515 else if (pd->af == AF_INET6) {
6516 if (pd->af != sk->af_lan) {
6517 pd->ndaddr = sk->lan.addr;
6518 pd->naddr = sk->ext_lan.addr;
6519 } else {
6520 pd->naddr = sk->gwy.addr;
6521 pd->ndaddr = sk->ext_gwy.addr;
6522 }
6523 return (pf_nat64_ipv6(m, off, pd));
6524 }
6525 return (PF_DROP);
6526 }
6527
6528 static int
6529 pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif,
6530 struct mbuf *m, int off, void *h, struct pf_pdesc *pd,
6531 u_short *reason)
6532 {
6533 #pragma unused(h)
6534 struct pf_state_key_cmp key;
6535 struct tcphdr *th = pd->hdr.tcp;
6536 u_int16_t win = ntohs(th->th_win);
6537 u_int32_t ack, end, seq, orig_seq;
6538 u_int8_t sws, dws;
6539 int ackskew;
6540 int copyback = 0;
6541 struct pf_state_peer *src, *dst;
6542 struct pf_state_key *sk;
6543
6544 key.app_state = 0;
6545 key.proto = IPPROTO_TCP;
6546 key.af_lan = key.af_gwy = pd->af;
6547
6548 /*
6549 * For NAT64 the first time rule search and state creation
6550 * is done on the incoming side only.
6551 * Once the state gets created, NAT64's LAN side (ipv6) will
6552 * not be able to find the state in ext-gwy tree as that normally
6553 * is intended to be looked up for incoming traffic from the
6554 * WAN side.
6555 * Therefore to handle NAT64 case we init keys here for both
6556 * lan-ext as well as ext-gwy trees.
6557 * In the state lookup we attempt a lookup on both trees if
6558 * first one does not return any result and return a match if
6559 * the match state's was created by NAT64 rule.
6560 */
6561 PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy);
6562 PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy);
6563 key.ext_gwy.xport.port = th->th_sport;
6564 key.gwy.xport.port = th->th_dport;
6565
6566 PF_ACPY(&key.lan.addr, pd->src, key.af_lan);
6567 PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan);
6568 key.lan.xport.port = th->th_sport;
6569 key.ext_lan.xport.port = th->th_dport;
6570
6571 STATE_LOOKUP();
6572
6573 sk = (*state)->state_key;
6574 /*
6575 * In case of NAT64 the translation is first applied on the LAN
6576 * side. Therefore for stack's address family comparison
6577 * we use sk->af_lan.
6578 */
6579 if ((direction == sk->direction) && (pd->af == sk->af_lan)) {
6580 src = &(*state)->src;
6581 dst = &(*state)->dst;
6582 } else {
6583 src = &(*state)->dst;
6584 dst = &(*state)->src;
6585 }
6586
6587 if (src->state == PF_TCPS_PROXY_SRC) {
6588 if (direction != sk->direction) {
6589 REASON_SET(reason, PFRES_SYNPROXY);
6590 return (PF_SYNPROXY_DROP);
6591 }
6592 if (th->th_flags & TH_SYN) {
6593 if (ntohl(th->th_seq) != src->seqlo) {
6594 REASON_SET(reason, PFRES_SYNPROXY);
6595 return (PF_DROP);
6596 }
6597 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst,
6598 pd->src, th->th_dport, th->th_sport,
6599 src->seqhi, ntohl(th->th_seq) + 1,
6600 TH_SYN|TH_ACK, 0, src->mss, 0, 1,
6601 0, NULL, NULL);
6602 REASON_SET(reason, PFRES_SYNPROXY);
6603 return (PF_SYNPROXY_DROP);
6604 } else if (!(th->th_flags & TH_ACK) ||
6605 (ntohl(th->th_ack) != src->seqhi + 1) ||
6606 (ntohl(th->th_seq) != src->seqlo + 1)) {
6607 REASON_SET(reason, PFRES_SYNPROXY);
6608 return (PF_DROP);
6609 } else if ((*state)->src_node != NULL &&
6610 pf_src_connlimit(state)) {
6611 REASON_SET(reason, PFRES_SRCLIMIT);
6612 return (PF_DROP);
6613 } else
6614 src->state = PF_TCPS_PROXY_DST;
6615 }
6616 if (src->state == PF_TCPS_PROXY_DST) {
6617 struct pf_state_host *psrc, *pdst;
6618
6619 if (direction == PF_OUT) {
6620 psrc = &sk->gwy;
6621 pdst = &sk->ext_gwy;
6622 } else {
6623 psrc = &sk->ext_lan;
6624 pdst = &sk->lan;
6625 }
6626 if (direction == sk->direction) {
6627 if (((th->th_flags & (TH_SYN|TH_ACK)) != TH_ACK) ||
6628 (ntohl(th->th_ack) != src->seqhi + 1) ||
6629 (ntohl(th->th_seq) != src->seqlo + 1)) {
6630 REASON_SET(reason, PFRES_SYNPROXY);
6631 return (PF_DROP);
6632 }
6633 src->max_win = MAX(ntohs(th->th_win), 1);
6634 if (dst->seqhi == 1)
6635 dst->seqhi = htonl(random());
6636 pf_send_tcp((*state)->rule.ptr, pd->af, &psrc->addr,
6637 &pdst->addr, psrc->xport.port, pdst->xport.port,
6638 dst->seqhi, 0, TH_SYN, 0,
6639 src->mss, 0, 0, (*state)->tag, NULL, NULL);
6640 REASON_SET(reason, PFRES_SYNPROXY);
6641 return (PF_SYNPROXY_DROP);
6642 } else if (((th->th_flags & (TH_SYN|TH_ACK)) !=
6643 (TH_SYN|TH_ACK)) ||
6644 (ntohl(th->th_ack) != dst->seqhi + 1)) {
6645 REASON_SET(reason, PFRES_SYNPROXY);
6646 return (PF_DROP);
6647 } else {
6648 dst->max_win = MAX(ntohs(th->th_win), 1);
6649 dst->seqlo = ntohl(th->th_seq);
6650 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst,
6651 pd->src, th->th_dport, th->th_sport,
6652 ntohl(th->th_ack), ntohl(th->th_seq) + 1,
6653 TH_ACK, src->max_win, 0, 0, 0,
6654 (*state)->tag, NULL, NULL);
6655 pf_send_tcp((*state)->rule.ptr, pd->af, &psrc->addr,
6656 &pdst->addr, psrc->xport.port, pdst->xport.port,
6657 src->seqhi + 1, src->seqlo + 1,
6658 TH_ACK, dst->max_win, 0, 0, 1,
6659 0, NULL, NULL);
6660 src->seqdiff = dst->seqhi -
6661 src->seqlo;
6662 dst->seqdiff = src->seqhi -
6663 dst->seqlo;
6664 src->seqhi = src->seqlo +
6665 dst->max_win;
6666 dst->seqhi = dst->seqlo +
6667 src->max_win;
6668 src->wscale = dst->wscale = 0;
6669 src->state = dst->state =
6670 TCPS_ESTABLISHED;
6671 REASON_SET(reason, PFRES_SYNPROXY);
6672 return (PF_SYNPROXY_DROP);
6673 }
6674 }
6675
6676 if (((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN) &&
6677 dst->state >= TCPS_FIN_WAIT_2 &&
6678 src->state >= TCPS_FIN_WAIT_2) {
6679 if (pf_status.debug >= PF_DEBUG_MISC) {
6680 printf("pf: state reuse ");
6681 pf_print_state(*state);
6682 pf_print_flags(th->th_flags);
6683 printf("\n");
6684 }
6685 /* XXX make sure it's the same direction ?? */
6686 src->state = dst->state = TCPS_CLOSED;
6687 pf_unlink_state(*state);
6688 *state = NULL;
6689 return (PF_DROP);
6690 }
6691
6692 if ((th->th_flags & TH_SYN) == 0) {
6693 sws = (src->wscale & PF_WSCALE_FLAG) ?
6694 (src->wscale & PF_WSCALE_MASK) : TCP_MAX_WINSHIFT;
6695 dws = (dst->wscale & PF_WSCALE_FLAG) ?
6696 (dst->wscale & PF_WSCALE_MASK) : TCP_MAX_WINSHIFT;
6697 }
6698 else
6699 sws = dws = 0;
6700
6701 /*
6702 * Sequence tracking algorithm from Guido van Rooij's paper:
6703 * http://www.madison-gurkha.com/publications/tcp_filtering/
6704 * tcp_filtering.ps
6705 */
6706
6707 orig_seq = seq = ntohl(th->th_seq);
6708 if (src->seqlo == 0) {
6709 /* First packet from this end. Set its state */
6710
6711 if ((pd->flags & PFDESC_TCP_NORM || dst->scrub) &&
6712 src->scrub == NULL) {
6713 if (pf_normalize_tcp_init(m, off, pd, th, src, dst)) {
6714 REASON_SET(reason, PFRES_MEMORY);
6715 return (PF_DROP);
6716 }
6717 }
6718
6719 /* Deferred generation of sequence number modulator */
6720 if (dst->seqdiff && !src->seqdiff) {
6721 /* use random iss for the TCP server */
6722 while ((src->seqdiff = random() - seq) == 0)
6723 ;
6724 ack = ntohl(th->th_ack) - dst->seqdiff;
6725 pf_change_a(&th->th_seq, &th->th_sum, htonl(seq +
6726 src->seqdiff), 0);
6727 pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0);
6728 copyback = off + sizeof (*th);
6729 } else {
6730 ack = ntohl(th->th_ack);
6731 }
6732
6733 end = seq + pd->p_len;
6734 if (th->th_flags & TH_SYN) {
6735 end++;
6736 if (dst->wscale & PF_WSCALE_FLAG) {
6737 src->wscale = pf_get_wscale(m, off, th->th_off,
6738 pd->af);
6739 if (src->wscale & PF_WSCALE_FLAG) {
6740 /*
6741 * Remove scale factor from initial
6742 * window
6743 */
6744 sws = src->wscale & PF_WSCALE_MASK;
6745 win = ((u_int32_t)win + (1 << sws) - 1)
6746 >> sws;
6747 dws = dst->wscale & PF_WSCALE_MASK;
6748 } else {
6749 /*
6750 * Window scale negotiation has failed,
6751 * therefore we must restore the window
6752 * scale in the state record that we
6753 * optimistically removed in
6754 * pf_test_rule(). Care is required to
6755 * prevent arithmetic overflow from
6756 * zeroing the window when it's
6757 * truncated down to 16-bits.
6758 */
6759 u_int32_t max_win = dst->max_win;
6760 max_win <<=
6761 dst->wscale & PF_WSCALE_MASK;
6762 dst->max_win = MIN(0xffff, max_win);
6763 /* in case of a retrans SYN|ACK */
6764 dst->wscale = 0;
6765 }
6766 }
6767 }
6768 if (th->th_flags & TH_FIN)
6769 end++;
6770
6771 src->seqlo = seq;
6772 if (src->state < TCPS_SYN_SENT)
6773 src->state = TCPS_SYN_SENT;
6774
6775 /*
6776 * May need to slide the window (seqhi may have been set by
6777 * the crappy stack check or if we picked up the connection
6778 * after establishment)
6779 */
6780 if (src->seqhi == 1 ||
6781 SEQ_GEQ(end + MAX(1, (u_int32_t)dst->max_win << dws),
6782 src->seqhi))
6783 src->seqhi = end + MAX(1, (u_int32_t)dst->max_win << dws);
6784 if (win > src->max_win)
6785 src->max_win = win;
6786
6787 } else {
6788 ack = ntohl(th->th_ack) - dst->seqdiff;
6789 if (src->seqdiff) {
6790 /* Modulate sequence numbers */
6791 pf_change_a(&th->th_seq, &th->th_sum, htonl(seq +
6792 src->seqdiff), 0);
6793 pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0);
6794 copyback = off+ sizeof (*th);
6795 }
6796 end = seq + pd->p_len;
6797 if (th->th_flags & TH_SYN)
6798 end++;
6799 if (th->th_flags & TH_FIN)
6800 end++;
6801 }
6802
6803 if ((th->th_flags & TH_ACK) == 0) {
6804 /* Let it pass through the ack skew check */
6805 ack = dst->seqlo;
6806 } else if ((ack == 0 &&
6807 (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) ||
6808 /* broken tcp stacks do not set ack */
6809 (dst->state < TCPS_SYN_SENT)) {
6810 /*
6811 * Many stacks (ours included) will set the ACK number in an
6812 * FIN|ACK if the SYN times out -- no sequence to ACK.
6813 */
6814 ack = dst->seqlo;
6815 }
6816
6817 if (seq == end) {
6818 /* Ease sequencing restrictions on no data packets */
6819 seq = src->seqlo;
6820 end = seq;
6821 }
6822
6823 ackskew = dst->seqlo - ack;
6824
6825
6826 /*
6827 * Need to demodulate the sequence numbers in any TCP SACK options
6828 * (Selective ACK). We could optionally validate the SACK values
6829 * against the current ACK window, either forwards or backwards, but
6830 * I'm not confident that SACK has been implemented properly
6831 * everywhere. It wouldn't surprise me if several stacks accidently
6832 * SACK too far backwards of previously ACKed data. There really aren't
6833 * any security implications of bad SACKing unless the target stack
6834 * doesn't validate the option length correctly. Someone trying to
6835 * spoof into a TCP connection won't bother blindly sending SACK
6836 * options anyway.
6837 */
6838 if (dst->seqdiff && (th->th_off << 2) > (int)sizeof (struct tcphdr)) {
6839 copyback = pf_modulate_sack(m, off, pd, th, dst);
6840 if (copyback == -1) {
6841 REASON_SET(reason, PFRES_MEMORY);
6842 return (PF_DROP);
6843 }
6844
6845 m = pd->mp;
6846 }
6847
6848
6849 #define MAXACKWINDOW (0xffff + 1500) /* 1500 is an arbitrary fudge factor */
6850 if (SEQ_GEQ(src->seqhi, end) &&
6851 /* Last octet inside other's window space */
6852 SEQ_GEQ(seq, src->seqlo - ((u_int32_t)dst->max_win << dws)) &&
6853 /* Retrans: not more than one window back */
6854 (ackskew >= -MAXACKWINDOW) &&
6855 /* Acking not more than one reassembled fragment backwards */
6856 (ackskew <= (MAXACKWINDOW << sws)) &&
6857 /* Acking not more than one window forward */
6858 ((th->th_flags & TH_RST) == 0 || orig_seq == src->seqlo ||
6859 (orig_seq == src->seqlo + 1) || (orig_seq + 1 == src->seqlo) ||
6860 (pd->flags & PFDESC_IP_REAS) == 0)) {
6861 /* Require an exact/+1 sequence match on resets when possible */
6862
6863 if (dst->scrub || src->scrub) {
6864 if (pf_normalize_tcp_stateful(m, off, pd, reason, th,
6865 *state, src, dst, &copyback))
6866 return (PF_DROP);
6867
6868 m = pd->mp;
6869 }
6870
6871 /* update max window */
6872 if (src->max_win < win)
6873 src->max_win = win;
6874 /* synchronize sequencing */
6875 if (SEQ_GT(end, src->seqlo))
6876 src->seqlo = end;
6877 /* slide the window of what the other end can send */
6878 if (SEQ_GEQ(ack + ((u_int32_t)win << sws), dst->seqhi))
6879 dst->seqhi = ack + MAX(((u_int32_t)win << sws), 1);
6880
6881 /* update states */
6882 if (th->th_flags & TH_SYN)
6883 if (src->state < TCPS_SYN_SENT)
6884 src->state = TCPS_SYN_SENT;
6885 if (th->th_flags & TH_FIN)
6886 if (src->state < TCPS_CLOSING)
6887 src->state = TCPS_CLOSING;
6888 if (th->th_flags & TH_ACK) {
6889 if (dst->state == TCPS_SYN_SENT) {
6890 dst->state = TCPS_ESTABLISHED;
6891 if (src->state == TCPS_ESTABLISHED &&
6892 (*state)->src_node != NULL &&
6893 pf_src_connlimit(state)) {
6894 REASON_SET(reason, PFRES_SRCLIMIT);
6895 return (PF_DROP);
6896 }
6897 } else if (dst->state == TCPS_CLOSING)
6898 dst->state = TCPS_FIN_WAIT_2;
6899 }
6900 if (th->th_flags & TH_RST)
6901 src->state = dst->state = TCPS_TIME_WAIT;
6902
6903 /* update expire time */
6904 (*state)->expire = pf_time_second();
6905 if (src->state >= TCPS_FIN_WAIT_2 &&
6906 dst->state >= TCPS_FIN_WAIT_2)
6907 (*state)->timeout = PFTM_TCP_CLOSED;
6908 else if (src->state >= TCPS_CLOSING &&
6909 dst->state >= TCPS_CLOSING)
6910 (*state)->timeout = PFTM_TCP_FIN_WAIT;
6911 else if (src->state < TCPS_ESTABLISHED ||
6912 dst->state < TCPS_ESTABLISHED)
6913 (*state)->timeout = PFTM_TCP_OPENING;
6914 else if (src->state >= TCPS_CLOSING ||
6915 dst->state >= TCPS_CLOSING)
6916 (*state)->timeout = PFTM_TCP_CLOSING;
6917 else
6918 (*state)->timeout = PFTM_TCP_ESTABLISHED;
6919
6920 /* Fall through to PASS packet */
6921
6922 } else if ((dst->state < TCPS_SYN_SENT ||
6923 dst->state >= TCPS_FIN_WAIT_2 || src->state >= TCPS_FIN_WAIT_2) &&
6924 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) &&
6925 /* Within a window forward of the originating packet */
6926 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW)) {
6927 /* Within a window backward of the originating packet */
6928
6929 /*
6930 * This currently handles three situations:
6931 * 1) Stupid stacks will shotgun SYNs before their peer
6932 * replies.
6933 * 2) When PF catches an already established stream (the
6934 * firewall rebooted, the state table was flushed, routes
6935 * changed...)
6936 * 3) Packets get funky immediately after the connection
6937 * closes (this should catch Solaris spurious ACK|FINs
6938 * that web servers like to spew after a close)
6939 *
6940 * This must be a little more careful than the above code
6941 * since packet floods will also be caught here. We don't
6942 * update the TTL here to mitigate the damage of a packet
6943 * flood and so the same code can handle awkward establishment
6944 * and a loosened connection close.
6945 * In the establishment case, a correct peer response will
6946 * validate the connection, go through the normal state code
6947 * and keep updating the state TTL.
6948 */
6949
6950 if (pf_status.debug >= PF_DEBUG_MISC) {
6951 printf("pf: loose state match: ");
6952 pf_print_state(*state);
6953 pf_print_flags(th->th_flags);
6954 printf(" seq=%u (%u) ack=%u len=%u ackskew=%d "
6955 "pkts=%llu:%llu dir=%s,%s\n", seq, orig_seq, ack,
6956 pd->p_len, ackskew, (*state)->packets[0],
6957 (*state)->packets[1],
6958 direction == PF_IN ? "in" : "out",
6959 direction == sk->direction ?
6960 "fwd" : "rev");
6961 }
6962
6963 if (dst->scrub || src->scrub) {
6964 if (pf_normalize_tcp_stateful(m, off, pd, reason, th,
6965 *state, src, dst, &copyback))
6966 return (PF_DROP);
6967 m = pd->mp;
6968 }
6969
6970 /* update max window */
6971 if (src->max_win < win)
6972 src->max_win = win;
6973 /* synchronize sequencing */
6974 if (SEQ_GT(end, src->seqlo))
6975 src->seqlo = end;
6976 /* slide the window of what the other end can send */
6977 if (SEQ_GEQ(ack + ((u_int32_t)win << sws), dst->seqhi))
6978 dst->seqhi = ack + MAX(((u_int32_t)win << sws), 1);
6979
6980 /*
6981 * Cannot set dst->seqhi here since this could be a shotgunned
6982 * SYN and not an already established connection.
6983 */
6984
6985 if (th->th_flags & TH_FIN)
6986 if (src->state < TCPS_CLOSING)
6987 src->state = TCPS_CLOSING;
6988 if (th->th_flags & TH_RST)
6989 src->state = dst->state = TCPS_TIME_WAIT;
6990
6991 /* Fall through to PASS packet */
6992
6993 } else {
6994 if (dst->state == TCPS_SYN_SENT &&
6995 src->state == TCPS_SYN_SENT) {
6996 /* Send RST for state mismatches during handshake */
6997 if (!(th->th_flags & TH_RST))
6998 pf_send_tcp((*state)->rule.ptr, pd->af,
6999 pd->dst, pd->src, th->th_dport,
7000 th->th_sport, ntohl(th->th_ack), 0,
7001 TH_RST, 0, 0,
7002 (*state)->rule.ptr->return_ttl, 1, 0,
7003 pd->eh, kif->pfik_ifp);
7004 src->seqlo = 0;
7005 src->seqhi = 1;
7006 src->max_win = 1;
7007 } else if (pf_status.debug >= PF_DEBUG_MISC) {
7008 printf("pf: BAD state: ");
7009 pf_print_state(*state);
7010 pf_print_flags(th->th_flags);
7011 printf("\n seq=%u (%u) ack=%u len=%u ackskew=%d "
7012 "sws=%u dws=%u pkts=%llu:%llu dir=%s,%s\n",
7013 seq, orig_seq, ack, pd->p_len, ackskew,
7014 (unsigned int)sws, (unsigned int)dws,
7015 (*state)->packets[0], (*state)->packets[1],
7016 direction == PF_IN ? "in" : "out",
7017 direction == sk->direction ?
7018 "fwd" : "rev");
7019 printf("pf: State failure on: %c %c %c %c | %c %c\n",
7020 SEQ_GEQ(src->seqhi, end) ? ' ' : '1',
7021 SEQ_GEQ(seq,
7022 src->seqlo - ((u_int32_t)dst->max_win << dws)) ?
7023 ' ': '2',
7024 (ackskew >= -MAXACKWINDOW) ? ' ' : '3',
7025 (ackskew <= (MAXACKWINDOW << sws)) ? ' ' : '4',
7026 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) ?' ' :'5',
7027 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW) ?' ' :'6');
7028 }
7029 REASON_SET(reason, PFRES_BADSTATE);
7030 return (PF_DROP);
7031 }
7032
7033 /* Any packets which have gotten here are to be passed */
7034
7035 if (sk->app_state &&
7036 sk->app_state->handler) {
7037 sk->app_state->handler(*state, direction,
7038 off + (th->th_off << 2), pd, kif);
7039 if (pd->lmw < 0) {
7040 REASON_SET(reason, PFRES_MEMORY);
7041 return (PF_DROP);
7042 }
7043 m = pd->mp;
7044 }
7045
7046 /* translate source/destination address, if necessary */
7047 if (STATE_TRANSLATE(sk)) {
7048 pd->naf = (pd->af == sk->af_lan) ? sk->af_gwy : sk->af_lan;
7049
7050 if (direction == PF_OUT) {
7051 pf_change_ap(direction, pd->mp, pd->src, &th->th_sport,
7052 pd->ip_sum, &th->th_sum, &sk->gwy.addr,
7053 sk->gwy.xport.port, 0, pd->af, pd->naf, 1);
7054 } else {
7055 if (pd->af != pd->naf) {
7056 if (pd->af == sk->af_gwy) {
7057 pf_change_ap(direction, pd->mp, pd->dst,
7058 &th->th_dport, pd->ip_sum,
7059 &th->th_sum, &sk->lan.addr,
7060 sk->lan.xport.port, 0,
7061 pd->af, pd->naf, 0);
7062
7063 pf_change_ap(direction, pd->mp, pd->src,
7064 &th->th_sport, pd->ip_sum,
7065 &th->th_sum, &sk->ext_lan.addr,
7066 th->th_sport, 0, pd->af,
7067 pd->naf, 0);
7068
7069 } else {
7070 pf_change_ap(direction, pd->mp, pd->dst,
7071 &th->th_dport, pd->ip_sum,
7072 &th->th_sum, &sk->ext_gwy.addr,
7073 th->th_dport, 0, pd->af,
7074 pd->naf, 0);
7075
7076 pf_change_ap(direction, pd->mp, pd->src,
7077 &th->th_sport, pd->ip_sum,
7078 &th->th_sum, &sk->gwy.addr,
7079 sk->gwy.xport.port, 0, pd->af,
7080 pd->naf, 0);
7081 }
7082 } else {
7083 pf_change_ap(direction, pd->mp, pd->dst,
7084 &th->th_dport, pd->ip_sum,
7085 &th->th_sum, &sk->lan.addr,
7086 sk->lan.xport.port, 0, pd->af,
7087 pd->naf, 1);
7088 }
7089 }
7090
7091 copyback = off + sizeof (*th);
7092 }
7093
7094 if (copyback) {
7095 m = pf_lazy_makewritable(pd, m, copyback);
7096 if (!m) {
7097 REASON_SET(reason, PFRES_MEMORY);
7098 return (PF_DROP);
7099 }
7100
7101 /* Copyback sequence modulation or stateful scrub changes */
7102 m_copyback(m, off, sizeof (*th), th);
7103
7104 if (sk->af_lan != sk->af_gwy)
7105 return (pf_do_nat64(sk, pd, m, off));
7106 }
7107 return (PF_PASS);
7108 }
7109
7110 static int
7111 pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif,
7112 struct mbuf *m, int off, void *h, struct pf_pdesc *pd, u_short *reason)
7113 {
7114 #pragma unused(h)
7115 struct pf_state_peer *src, *dst;
7116 struct pf_state_key_cmp key;
7117 struct pf_state_key *sk;
7118 struct udphdr *uh = pd->hdr.udp;
7119 struct pf_app_state as;
7120 int action, extfilter;
7121 key.app_state = 0;
7122 key.proto_variant = PF_EXTFILTER_APD;
7123
7124 key.proto = IPPROTO_UDP;
7125 key.af_lan = key.af_gwy = pd->af;
7126
7127 /*
7128 * For NAT64 the first time rule search and state creation
7129 * is done on the incoming side only.
7130 * Once the state gets created, NAT64's LAN side (ipv6) will
7131 * not be able to find the state in ext-gwy tree as that normally
7132 * is intended to be looked up for incoming traffic from the
7133 * WAN side.
7134 * Therefore to handle NAT64 case we init keys here for both
7135 * lan-ext as well as ext-gwy trees.
7136 * In the state lookup we attempt a lookup on both trees if
7137 * first one does not return any result and return a match if
7138 * the match state's was created by NAT64 rule.
7139 */
7140 PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy);
7141 PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy);
7142 key.ext_gwy.xport.port = uh->uh_sport;
7143 key.gwy.xport.port = uh->uh_dport;
7144
7145 PF_ACPY(&key.lan.addr, pd->src, key.af_lan);
7146 PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan);
7147 key.lan.xport.port = uh->uh_sport;
7148 key.ext_lan.xport.port = uh->uh_dport;
7149
7150 if (ntohs(uh->uh_sport) == PF_IKE_PORT &&
7151 ntohs(uh->uh_dport) == PF_IKE_PORT) {
7152 struct pf_ike_hdr ike;
7153 size_t plen = m->m_pkthdr.len - off - sizeof (*uh);
7154 if (plen < PF_IKE_PACKET_MINSIZE) {
7155 DPFPRINTF(PF_DEBUG_MISC,
7156 ("pf: IKE message too small.\n"));
7157 return (PF_DROP);
7158 }
7159
7160 if (plen > sizeof (ike))
7161 plen = sizeof (ike);
7162 m_copydata(m, off + sizeof (*uh), plen, &ike);
7163
7164 if (ike.initiator_cookie) {
7165 key.app_state = &as;
7166 as.compare_lan_ext = pf_ike_compare;
7167 as.compare_ext_gwy = pf_ike_compare;
7168 as.u.ike.cookie = ike.initiator_cookie;
7169 } else {
7170 /*
7171 * <http://tools.ietf.org/html/\
7172 * draft-ietf-ipsec-nat-t-ike-01>
7173 * Support non-standard NAT-T implementations that
7174 * push the ESP packet over the top of the IKE packet.
7175 * Do not drop packet.
7176 */
7177 DPFPRINTF(PF_DEBUG_MISC,
7178 ("pf: IKE initiator cookie = 0.\n"));
7179 }
7180 }
7181
7182 *state = pf_find_state(kif, &key, direction);
7183
7184 if (!key.app_state && *state == 0) {
7185 key.proto_variant = PF_EXTFILTER_AD;
7186 *state = pf_find_state(kif, &key, direction);
7187 }
7188
7189 if (!key.app_state && *state == 0) {
7190 key.proto_variant = PF_EXTFILTER_EI;
7191 *state = pf_find_state(kif, &key, direction);
7192 }
7193
7194 /* similar to STATE_LOOKUP() */
7195 if (*state != NULL && pd != NULL && !(pd->pktflags & PKTF_FLOW_ID)) {
7196 pd->flowsrc = (*state)->state_key->flowsrc;
7197 pd->flowhash = (*state)->state_key->flowhash;
7198 if (pd->flowhash != 0) {
7199 pd->pktflags |= PKTF_FLOW_ID;
7200 pd->pktflags &= ~PKTF_FLOW_ADV;
7201 }
7202 }
7203
7204 if (pf_state_lookup_aux(state, kif, direction, &action))
7205 return (action);
7206
7207 sk = (*state)->state_key;
7208
7209 /*
7210 * In case of NAT64 the translation is first applied on the LAN
7211 * side. Therefore for stack's address family comparison
7212 * we use sk->af_lan.
7213 */
7214 if ((direction == sk->direction) && (pd->af == sk->af_lan)) {
7215 src = &(*state)->src;
7216 dst = &(*state)->dst;
7217 } else {
7218 src = &(*state)->dst;
7219 dst = &(*state)->src;
7220 }
7221
7222 /* update states */
7223 if (src->state < PFUDPS_SINGLE)
7224 src->state = PFUDPS_SINGLE;
7225 if (dst->state == PFUDPS_SINGLE)
7226 dst->state = PFUDPS_MULTIPLE;
7227
7228 /* update expire time */
7229 (*state)->expire = pf_time_second();
7230 if (src->state == PFUDPS_MULTIPLE && dst->state == PFUDPS_MULTIPLE)
7231 (*state)->timeout = PFTM_UDP_MULTIPLE;
7232 else
7233 (*state)->timeout = PFTM_UDP_SINGLE;
7234
7235 extfilter = sk->proto_variant;
7236 if (extfilter > PF_EXTFILTER_APD) {
7237 if (direction == PF_OUT) {
7238 sk->ext_lan.xport.port = key.ext_lan.xport.port;
7239 if (extfilter > PF_EXTFILTER_AD)
7240 PF_ACPY(&sk->ext_lan.addr, &key.ext_lan.addr,
7241 key.af_lan);
7242 } else {
7243 sk->ext_gwy.xport.port = key.ext_gwy.xport.port;
7244 if (extfilter > PF_EXTFILTER_AD)
7245 PF_ACPY(&sk->ext_gwy.addr, &key.ext_gwy.addr,
7246 key.af_gwy);
7247 }
7248 }
7249
7250 if (sk->app_state && sk->app_state->handler) {
7251 sk->app_state->handler(*state, direction, off + uh->uh_ulen,
7252 pd, kif);
7253 if (pd->lmw < 0) {
7254 REASON_SET(reason, PFRES_MEMORY);
7255 return (PF_DROP);
7256 }
7257 m = pd->mp;
7258 }
7259
7260 /* translate source/destination address, if necessary */
7261 if (STATE_TRANSLATE(sk)) {
7262 m = pf_lazy_makewritable(pd, m, off + sizeof (*uh));
7263 if (!m) {
7264 REASON_SET(reason, PFRES_MEMORY);
7265 return (PF_DROP);
7266 }
7267
7268 pd->naf = (pd->af == sk->af_lan) ? sk->af_gwy : sk->af_lan;
7269
7270 if (direction == PF_OUT) {
7271 pf_change_ap(direction, pd->mp, pd->src, &uh->uh_sport,
7272 pd->ip_sum, &uh->uh_sum, &sk->gwy.addr,
7273 sk->gwy.xport.port, 1, pd->af, pd->naf, 1);
7274 } else {
7275 if (pd->af != pd->naf) {
7276
7277 if (pd->af == sk->af_gwy) {
7278 pf_change_ap(direction, pd->mp, pd->dst,
7279 &uh->uh_dport, pd->ip_sum,
7280 &uh->uh_sum, &sk->lan.addr,
7281 sk->lan.xport.port, 1,
7282 pd->af, pd->naf, 0);
7283
7284 pf_change_ap(direction, pd->mp, pd->src,
7285 &uh->uh_sport, pd->ip_sum,
7286 &uh->uh_sum, &sk->ext_lan.addr,
7287 uh->uh_sport, 1, pd->af,
7288 pd->naf, 0);
7289
7290 } else {
7291 pf_change_ap(direction, pd->mp, pd->dst,
7292 &uh->uh_dport, pd->ip_sum,
7293 &uh->uh_sum, &sk->ext_gwy.addr,
7294 uh->uh_dport, 1, pd->af,
7295 pd->naf, 0);
7296
7297 pf_change_ap(direction, pd->mp, pd->src,
7298 &uh->uh_sport, pd->ip_sum,
7299 &uh->uh_sum, &sk->gwy.addr,
7300 sk->gwy.xport.port, 1, pd->af,
7301 pd->naf, 0);
7302 }
7303 } else {
7304 pf_change_ap(direction, pd->mp, pd->dst,
7305 &uh->uh_dport, pd->ip_sum,
7306 &uh->uh_sum, &sk->lan.addr,
7307 sk->lan.xport.port, 1,
7308 pd->af, pd->naf, 1);
7309 }
7310 }
7311
7312 m_copyback(m, off, sizeof (*uh), uh);
7313 if (sk->af_lan != sk->af_gwy)
7314 return (pf_do_nat64(sk, pd, m, off));
7315 }
7316 return (PF_PASS);
7317 }
7318
7319 static int
7320 pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
7321 struct mbuf *m, int off, void *h, struct pf_pdesc *pd, u_short *reason)
7322 {
7323 #pragma unused(h)
7324 struct pf_addr *saddr = pd->src, *daddr = pd->dst;
7325 struct in_addr srcv4_inaddr = saddr->v4;
7326 u_int16_t icmpid = 0, *icmpsum;
7327 u_int8_t icmptype;
7328 int state_icmp = 0;
7329 struct pf_state_key_cmp key;
7330 struct pf_state_key *sk;
7331
7332 struct pf_app_state as;
7333 key.app_state = 0;
7334
7335 pd->off = off;
7336
7337 switch (pd->proto) {
7338 #if INET
7339 case IPPROTO_ICMP:
7340 icmptype = pd->hdr.icmp->icmp_type;
7341 icmpid = pd->hdr.icmp->icmp_id;
7342 icmpsum = &pd->hdr.icmp->icmp_cksum;
7343
7344 if (icmptype == ICMP_UNREACH ||
7345 icmptype == ICMP_SOURCEQUENCH ||
7346 icmptype == ICMP_REDIRECT ||
7347 icmptype == ICMP_TIMXCEED ||
7348 icmptype == ICMP_PARAMPROB)
7349 state_icmp++;
7350 break;
7351 #endif /* INET */
7352 #if INET6
7353 case IPPROTO_ICMPV6:
7354 icmptype = pd->hdr.icmp6->icmp6_type;
7355 icmpid = pd->hdr.icmp6->icmp6_id;
7356 icmpsum = &pd->hdr.icmp6->icmp6_cksum;
7357
7358 if (icmptype == ICMP6_DST_UNREACH ||
7359 icmptype == ICMP6_PACKET_TOO_BIG ||
7360 icmptype == ICMP6_TIME_EXCEEDED ||
7361 icmptype == ICMP6_PARAM_PROB)
7362 state_icmp++;
7363 break;
7364 #endif /* INET6 */
7365 }
7366
7367 if (!state_icmp) {
7368
7369 /*
7370 * ICMP query/reply message not related to a TCP/UDP packet.
7371 * Search for an ICMP state.
7372 */
7373 /*
7374 * NAT64 requires protocol translation between ICMPv4
7375 * and ICMPv6. TCP and UDP do not require protocol
7376 * translation. To avoid adding complexity just to
7377 * handle ICMP(v4/v6), we always lookup for
7378 * proto = IPPROTO_ICMP on both LAN and WAN side
7379 */
7380 key.proto = IPPROTO_ICMP;
7381 key.af_lan = key.af_gwy = pd->af;
7382
7383 PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy);
7384 PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy);
7385 key.ext_gwy.xport.port = 0;
7386 key.gwy.xport.port = icmpid;
7387
7388 PF_ACPY(&key.lan.addr, pd->src, key.af_lan);
7389 PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan);
7390 key.lan.xport.port = icmpid;
7391 key.ext_lan.xport.port = 0;
7392
7393 STATE_LOOKUP();
7394
7395 sk = (*state)->state_key;
7396 (*state)->expire = pf_time_second();
7397 (*state)->timeout = PFTM_ICMP_ERROR_REPLY;
7398
7399 /* translate source/destination address, if necessary */
7400 if (STATE_TRANSLATE(sk)) {
7401 pd->naf = (pd->af == sk->af_lan) ?
7402 sk->af_gwy : sk->af_lan;
7403 if (direction == PF_OUT) {
7404 switch (pd->af) {
7405 #if INET
7406 case AF_INET:
7407 pf_change_a(&saddr->v4.s_addr,
7408 pd->ip_sum,
7409 sk->gwy.addr.v4.s_addr, 0);
7410 pd->hdr.icmp->icmp_cksum =
7411 pf_cksum_fixup(
7412 pd->hdr.icmp->icmp_cksum, icmpid,
7413 sk->gwy.xport.port, 0);
7414 pd->hdr.icmp->icmp_id =
7415 sk->gwy.xport.port;
7416 m = pf_lazy_makewritable(pd, m,
7417 off + ICMP_MINLEN);
7418 if (!m)
7419 return (PF_DROP);
7420 m_copyback(m, off, ICMP_MINLEN,
7421 pd->hdr.icmp);
7422 break;
7423 #endif /* INET */
7424 #if INET6
7425 case AF_INET6:
7426 pf_change_a6(saddr,
7427 &pd->hdr.icmp6->icmp6_cksum,
7428 &sk->gwy.addr, 0);
7429 m = pf_lazy_makewritable(pd, m,
7430 off + sizeof (struct icmp6_hdr));
7431 if (!m)
7432 return (PF_DROP);
7433 m_copyback(m, off,
7434 sizeof (struct icmp6_hdr),
7435 pd->hdr.icmp6);
7436 break;
7437 #endif /* INET6 */
7438 }
7439 } else {
7440 switch (pd->af) {
7441 #if INET
7442 case AF_INET:
7443 if (pd->naf != AF_INET) {
7444 if (pf_translate_icmp_af(
7445 AF_INET6, pd->hdr.icmp))
7446 return (PF_DROP);
7447
7448 pd->proto = IPPROTO_ICMPV6;
7449
7450 } else {
7451
7452 pf_change_a(&daddr->v4.s_addr,
7453 pd->ip_sum,
7454 sk->lan.addr.v4.s_addr, 0);
7455
7456 pd->hdr.icmp->icmp_cksum =
7457 pf_cksum_fixup(
7458 pd->hdr.icmp->icmp_cksum,
7459 icmpid, sk->lan.xport.port, 0);
7460
7461 pd->hdr.icmp->icmp_id =
7462 sk->lan.xport.port;
7463 }
7464
7465 m = pf_lazy_makewritable(pd, m,
7466 off + ICMP_MINLEN);
7467 if (!m)
7468 return (PF_DROP);
7469 m_copyback(m, off, ICMP_MINLEN,
7470 pd->hdr.icmp);
7471 if (sk->af_lan != sk->af_gwy)
7472 return (pf_do_nat64(sk, pd, m,
7473 off));
7474 break;
7475 #endif /* INET */
7476 #if INET6
7477 case AF_INET6:
7478 if (pd->naf != AF_INET6) {
7479 if (pf_translate_icmp_af(
7480 AF_INET, pd->hdr.icmp6))
7481 return (PF_DROP);
7482
7483 pd->proto = IPPROTO_ICMP;
7484 } else {
7485 pf_change_a6(daddr,
7486 &pd->hdr.icmp6->icmp6_cksum,
7487 &sk->lan.addr, 0);
7488 }
7489 m = pf_lazy_makewritable(pd, m,
7490 off + sizeof (struct icmp6_hdr));
7491 if (!m)
7492 return (PF_DROP);
7493 m_copyback(m, off,
7494 sizeof (struct icmp6_hdr),
7495 pd->hdr.icmp6);
7496 if (sk->af_lan != sk->af_gwy)
7497 return (pf_do_nat64(sk, pd, m,
7498 off));
7499 break;
7500 #endif /* INET6 */
7501 }
7502 }
7503 }
7504
7505 return (PF_PASS);
7506
7507 } else {
7508 /*
7509 * ICMP error message in response to a TCP/UDP packet.
7510 * Extract the inner TCP/UDP header and search for that state.
7511 */
7512 struct pf_pdesc pd2; /* For inner (original) header */
7513 #if INET
7514 struct ip h2;
7515 #endif /* INET */
7516 #if INET6
7517 struct ip6_hdr h2_6;
7518 int terminal = 0;
7519 #endif /* INET6 */
7520 int ipoff2 = 0;
7521 int off2 = 0;
7522
7523 memset(&pd2, 0, sizeof (pd2));
7524
7525 pd2.af = pd->af;
7526 switch (pd->af) {
7527 #if INET
7528 case AF_INET:
7529 /* offset of h2 in mbuf chain */
7530 ipoff2 = off + ICMP_MINLEN;
7531
7532 if (!pf_pull_hdr(m, ipoff2, &h2, sizeof (h2),
7533 NULL, reason, pd2.af)) {
7534 DPFPRINTF(PF_DEBUG_MISC,
7535 ("pf: ICMP error message too short "
7536 "(ip)\n"));
7537 return (PF_DROP);
7538 }
7539 /*
7540 * ICMP error messages don't refer to non-first
7541 * fragments
7542 */
7543 if (h2.ip_off & htons(IP_OFFMASK)) {
7544 REASON_SET(reason, PFRES_FRAG);
7545 return (PF_DROP);
7546 }
7547
7548 /* offset of protocol header that follows h2 */
7549 off2 = ipoff2 + (h2.ip_hl << 2);
7550 /* TODO */
7551 pd2.off = ipoff2 + (h2.ip_hl << 2);
7552
7553 pd2.proto = h2.ip_p;
7554 pd2.src = (struct pf_addr *)&h2.ip_src;
7555 pd2.dst = (struct pf_addr *)&h2.ip_dst;
7556 pd2.ip_sum = &h2.ip_sum;
7557 break;
7558 #endif /* INET */
7559 #if INET6
7560 case AF_INET6:
7561 ipoff2 = off + sizeof (struct icmp6_hdr);
7562
7563 if (!pf_pull_hdr(m, ipoff2, &h2_6, sizeof (h2_6),
7564 NULL, reason, pd2.af)) {
7565 DPFPRINTF(PF_DEBUG_MISC,
7566 ("pf: ICMP error message too short "
7567 "(ip6)\n"));
7568 return (PF_DROP);
7569 }
7570 pd2.proto = h2_6.ip6_nxt;
7571 pd2.src = (struct pf_addr *)&h2_6.ip6_src;
7572 pd2.dst = (struct pf_addr *)&h2_6.ip6_dst;
7573 pd2.ip_sum = NULL;
7574 off2 = ipoff2 + sizeof (h2_6);
7575 do {
7576 switch (pd2.proto) {
7577 case IPPROTO_FRAGMENT:
7578 /*
7579 * ICMPv6 error messages for
7580 * non-first fragments
7581 */
7582 REASON_SET(reason, PFRES_FRAG);
7583 return (PF_DROP);
7584 case IPPROTO_AH:
7585 case IPPROTO_HOPOPTS:
7586 case IPPROTO_ROUTING:
7587 case IPPROTO_DSTOPTS: {
7588 /* get next header and header length */
7589 struct ip6_ext opt6;
7590
7591 if (!pf_pull_hdr(m, off2, &opt6,
7592 sizeof (opt6), NULL, reason,
7593 pd2.af)) {
7594 DPFPRINTF(PF_DEBUG_MISC,
7595 ("pf: ICMPv6 short opt\n"));
7596 return (PF_DROP);
7597 }
7598 if (pd2.proto == IPPROTO_AH)
7599 off2 += (opt6.ip6e_len + 2) * 4;
7600 else
7601 off2 += (opt6.ip6e_len + 1) * 8;
7602 pd2.proto = opt6.ip6e_nxt;
7603 /* goto the next header */
7604 break;
7605 }
7606 default:
7607 terminal++;
7608 break;
7609 }
7610 } while (!terminal);
7611 /* TODO */
7612 pd2.off = ipoff2;
7613 break;
7614 #endif /* INET6 */
7615 }
7616
7617 switch (pd2.proto) {
7618 case IPPROTO_TCP: {
7619 struct tcphdr th;
7620 u_int32_t seq;
7621 struct pf_state_peer *src, *dst;
7622 u_int8_t dws;
7623 int copyback = 0;
7624
7625 /*
7626 * Only the first 8 bytes of the TCP header can be
7627 * expected. Don't access any TCP header fields after
7628 * th_seq, an ackskew test is not possible.
7629 */
7630 if (!pf_pull_hdr(m, off2, &th, 8, NULL, reason,
7631 pd2.af)) {
7632 DPFPRINTF(PF_DEBUG_MISC,
7633 ("pf: ICMP error message too short "
7634 "(tcp)\n"));
7635 return (PF_DROP);
7636 }
7637
7638 key.proto = IPPROTO_TCP;
7639 key.af_gwy = pd2.af;
7640 PF_ACPY(&key.ext_gwy.addr, pd2.dst, key.af_gwy);
7641 PF_ACPY(&key.gwy.addr, pd2.src, key.af_gwy);
7642 key.ext_gwy.xport.port = th.th_dport;
7643 key.gwy.xport.port = th.th_sport;
7644
7645 key.af_lan = pd2.af;
7646 PF_ACPY(&key.lan.addr, pd2.dst, key.af_lan);
7647 PF_ACPY(&key.ext_lan.addr, pd2.src, key.af_lan);
7648 key.lan.xport.port = th.th_dport;
7649 key.ext_lan.xport.port = th.th_sport;
7650
7651 STATE_LOOKUP();
7652
7653 sk = (*state)->state_key;
7654 if ((direction == sk->direction) &&
7655 ((sk->af_lan == sk->af_gwy) ||
7656 (pd2.af == sk->af_lan))) {
7657 src = &(*state)->dst;
7658 dst = &(*state)->src;
7659 } else {
7660 src = &(*state)->src;
7661 dst = &(*state)->dst;
7662 }
7663
7664 if (src->wscale && (dst->wscale & PF_WSCALE_FLAG))
7665 dws = dst->wscale & PF_WSCALE_MASK;
7666 else
7667 dws = TCP_MAX_WINSHIFT;
7668
7669 /* Demodulate sequence number */
7670 seq = ntohl(th.th_seq) - src->seqdiff;
7671 if (src->seqdiff) {
7672 pf_change_a(&th.th_seq, icmpsum,
7673 htonl(seq), 0);
7674 copyback = 1;
7675 }
7676
7677 if (!SEQ_GEQ(src->seqhi, seq) ||
7678 !SEQ_GEQ(seq,
7679 src->seqlo - ((u_int32_t)dst->max_win << dws))) {
7680 if (pf_status.debug >= PF_DEBUG_MISC) {
7681 printf("pf: BAD ICMP %d:%d ",
7682 icmptype, pd->hdr.icmp->icmp_code);
7683 pf_print_host(pd->src, 0, pd->af);
7684 printf(" -> ");
7685 pf_print_host(pd->dst, 0, pd->af);
7686 printf(" state: ");
7687 pf_print_state(*state);
7688 printf(" seq=%u\n", seq);
7689 }
7690 REASON_SET(reason, PFRES_BADSTATE);
7691 return (PF_DROP);
7692 }
7693
7694 pd->naf = pd2.naf = (pd2.af == sk->af_lan) ?
7695 sk->af_gwy : sk->af_lan;
7696
7697 if (STATE_TRANSLATE(sk)) {
7698 /* NAT64 case */
7699 if (sk->af_lan != sk->af_gwy) {
7700 struct pf_state_host *saddr2, *daddr2;
7701
7702 if (pd2.naf == sk->af_lan) {
7703 saddr2 = &sk->lan;
7704 daddr2 = &sk->ext_lan;
7705 } else {
7706 saddr2 = &sk->ext_gwy;
7707 daddr2 = &sk->gwy;
7708 }
7709
7710 /* translate ICMP message types and codes */
7711 if (pf_translate_icmp_af(pd->naf,
7712 pd->hdr.icmp))
7713 return (PF_DROP);
7714 m =
7715 pf_lazy_makewritable(pd, m, off2 + 8);
7716 if (!m)
7717 return (PF_DROP);
7718
7719 m_copyback(m, pd->off,
7720 sizeof(struct icmp6_hdr),
7721 pd->hdr.icmp6);
7722
7723 /*
7724 * translate inner ip header within the
7725 * ICMP message
7726 */
7727 if (pf_change_icmp_af(m, ipoff2, pd,
7728 &pd2, &saddr2->addr, &daddr2->addr,
7729 pd->af, pd->naf))
7730 return (PF_DROP);
7731
7732 if (pd->naf == AF_INET)
7733 pd->proto = IPPROTO_ICMP;
7734 else
7735 pd->proto = IPPROTO_ICMPV6;
7736
7737 /*
7738 * translate inner tcp header within
7739 * the ICMP message
7740 */
7741 pf_change_ap(direction, NULL, pd2.src,
7742 &th.th_sport, pd2.ip_sum,
7743 &th.th_sum, &daddr2->addr,
7744 saddr2->xport.port, 0, pd2.af,
7745 pd2.naf, 0);
7746
7747 pf_change_ap(direction, NULL, pd2.dst,
7748 &th.th_dport, pd2.ip_sum,
7749 &th.th_sum, &saddr2->addr,
7750 daddr2->xport.port, 0, pd2.af,
7751 pd2.naf, 0);
7752
7753 m_copyback(m, pd2.off, 8, &th);
7754
7755 /* translate outer ip header */
7756 PF_ACPY(&pd->naddr, &daddr2->addr,
7757 pd->naf);
7758 PF_ACPY(&pd->ndaddr, &saddr2->addr,
7759 pd->naf);
7760 if (pd->af == AF_INET) {
7761 memcpy(&pd->naddr.addr32[3],
7762 &srcv4_inaddr,
7763 sizeof(pd->naddr.addr32[3]));
7764 return (pf_nat64_ipv4(m, off,
7765 pd));
7766 } else {
7767 return (pf_nat64_ipv6(m, off,
7768 pd));
7769 }
7770 }
7771 if (direction == PF_IN) {
7772 pf_change_icmp(pd2.src, &th.th_sport,
7773 daddr, &sk->lan.addr,
7774 sk->lan.xport.port, NULL,
7775 pd2.ip_sum, icmpsum,
7776 pd->ip_sum, 0, pd2.af);
7777 } else {
7778 pf_change_icmp(pd2.dst, &th.th_dport,
7779 saddr, &sk->gwy.addr,
7780 sk->gwy.xport.port, NULL,
7781 pd2.ip_sum, icmpsum,
7782 pd->ip_sum, 0, pd2.af);
7783 }
7784 copyback = 1;
7785 }
7786
7787 if (copyback) {
7788 m = pf_lazy_makewritable(pd, m, off2 + 8);
7789 if (!m)
7790 return (PF_DROP);
7791 switch (pd2.af) {
7792 #if INET
7793 case AF_INET:
7794 m_copyback(m, off, ICMP_MINLEN,
7795 pd->hdr.icmp);
7796 m_copyback(m, ipoff2, sizeof (h2),
7797 &h2);
7798 break;
7799 #endif /* INET */
7800 #if INET6
7801 case AF_INET6:
7802 m_copyback(m, off,
7803 sizeof (struct icmp6_hdr),
7804 pd->hdr.icmp6);
7805 m_copyback(m, ipoff2, sizeof (h2_6),
7806 &h2_6);
7807 break;
7808 #endif /* INET6 */
7809 }
7810 m_copyback(m, off2, 8, &th);
7811 }
7812
7813 return (PF_PASS);
7814 }
7815 case IPPROTO_UDP: {
7816 struct udphdr uh;
7817 int dx, action;
7818 if (!pf_pull_hdr(m, off2, &uh, sizeof (uh),
7819 NULL, reason, pd2.af)) {
7820 DPFPRINTF(PF_DEBUG_MISC,
7821 ("pf: ICMP error message too short "
7822 "(udp)\n"));
7823 return (PF_DROP);
7824 }
7825
7826 key.af_gwy = pd2.af;
7827 PF_ACPY(&key.ext_gwy.addr, pd2.dst, key.af_gwy);
7828 PF_ACPY(&key.gwy.addr, pd2.src, key.af_gwy);
7829 key.ext_gwy.xport.port = uh.uh_dport;
7830 key.gwy.xport.port = uh.uh_sport;
7831
7832 key.af_lan = pd2.af;
7833 PF_ACPY(&key.lan.addr, pd2.dst, key.af_lan);
7834 PF_ACPY(&key.ext_lan.addr, pd2.src, key.af_lan);
7835 key.lan.xport.port = uh.uh_dport;
7836 key.ext_lan.xport.port = uh.uh_sport;
7837
7838 key.proto = IPPROTO_UDP;
7839 key.proto_variant = PF_EXTFILTER_APD;
7840 dx = direction;
7841
7842 if (ntohs(uh.uh_sport) == PF_IKE_PORT &&
7843 ntohs(uh.uh_dport) == PF_IKE_PORT) {
7844 struct pf_ike_hdr ike;
7845 size_t plen =
7846 m->m_pkthdr.len - off2 - sizeof (uh);
7847 if (direction == PF_IN &&
7848 plen < 8 /* PF_IKE_PACKET_MINSIZE */) {
7849 DPFPRINTF(PF_DEBUG_MISC, ("pf: "
7850 "ICMP error, embedded IKE message "
7851 "too small.\n"));
7852 return (PF_DROP);
7853 }
7854
7855 if (plen > sizeof (ike))
7856 plen = sizeof (ike);
7857 m_copydata(m, off + sizeof (uh), plen, &ike);
7858
7859 key.app_state = &as;
7860 as.compare_lan_ext = pf_ike_compare;
7861 as.compare_ext_gwy = pf_ike_compare;
7862 as.u.ike.cookie = ike.initiator_cookie;
7863 }
7864
7865 *state = pf_find_state(kif, &key, dx);
7866
7867 if (key.app_state && *state == 0) {
7868 key.app_state = 0;
7869 *state = pf_find_state(kif, &key, dx);
7870 }
7871
7872 if (*state == 0) {
7873 key.proto_variant = PF_EXTFILTER_AD;
7874 *state = pf_find_state(kif, &key, dx);
7875 }
7876
7877 if (*state == 0) {
7878 key.proto_variant = PF_EXTFILTER_EI;
7879 *state = pf_find_state(kif, &key, dx);
7880 }
7881
7882 /* similar to STATE_LOOKUP() */
7883 if (*state != NULL && pd != NULL &&
7884 !(pd->pktflags & PKTF_FLOW_ID)) {
7885 pd->flowsrc = (*state)->state_key->flowsrc;
7886 pd->flowhash = (*state)->state_key->flowhash;
7887 if (pd->flowhash != 0) {
7888 pd->pktflags |= PKTF_FLOW_ID;
7889 pd->pktflags &= ~PKTF_FLOW_ADV;
7890 }
7891 }
7892
7893 if (pf_state_lookup_aux(state, kif, direction, &action))
7894 return (action);
7895
7896 sk = (*state)->state_key;
7897 pd->naf = pd2.naf = (pd2.af == sk->af_lan) ?
7898 sk->af_gwy : sk->af_lan;
7899
7900 if (STATE_TRANSLATE(sk)) {
7901 /* NAT64 case */
7902 if (sk->af_lan != sk->af_gwy) {
7903 struct pf_state_host *saddr2, *daddr2;
7904
7905 if (pd2.naf == sk->af_lan) {
7906 saddr2 = &sk->lan;
7907 daddr2 = &sk->ext_lan;
7908 } else {
7909 saddr2 = &sk->ext_gwy;
7910 daddr2 = &sk->gwy;
7911 }
7912
7913 /* translate ICMP message */
7914 if (pf_translate_icmp_af(pd->naf,
7915 pd->hdr.icmp))
7916 return (PF_DROP);
7917 m =
7918 pf_lazy_makewritable(pd, m, off2 + 8);
7919 if (!m)
7920 return (PF_DROP);
7921
7922 m_copyback(m, pd->off,
7923 sizeof(struct icmp6_hdr),
7924 pd->hdr.icmp6);
7925
7926 /*
7927 * translate inner ip header within the
7928 * ICMP message
7929 */
7930 if (pf_change_icmp_af(m, ipoff2, pd,
7931 &pd2, &saddr2->addr, &daddr2->addr,
7932 pd->af, pd->naf))
7933 return (PF_DROP);
7934
7935 if (pd->naf == AF_INET)
7936 pd->proto = IPPROTO_ICMP;
7937 else
7938 pd->proto = IPPROTO_ICMPV6;
7939
7940 /*
7941 * translate inner udp header within
7942 * the ICMP message
7943 */
7944 pf_change_ap(direction, NULL, pd2.src,
7945 &uh.uh_sport, pd2.ip_sum,
7946 &uh.uh_sum, &daddr2->addr,
7947 saddr2->xport.port, 0, pd2.af,
7948 pd2.naf, 0);
7949
7950 pf_change_ap(direction, NULL, pd2.dst,
7951 &uh.uh_dport, pd2.ip_sum,
7952 &uh.uh_sum, &saddr2->addr,
7953 daddr2->xport.port, 0, pd2.af,
7954 pd2.naf, 0);
7955
7956 m_copyback(m, pd2.off, sizeof(uh), &uh);
7957
7958 /* translate outer ip header */
7959 PF_ACPY(&pd->naddr, &daddr2->addr,
7960 pd->naf);
7961 PF_ACPY(&pd->ndaddr, &saddr2->addr,
7962 pd->naf);
7963 if (pd->af == AF_INET) {
7964 memcpy(&pd->naddr.addr32[3],
7965 &srcv4_inaddr,
7966 sizeof(pd->naddr.addr32[3]));
7967 return (pf_nat64_ipv4(m, off,
7968 pd));
7969 } else {
7970 return (pf_nat64_ipv6(m, off,
7971 pd));
7972 }
7973 }
7974 if (direction == PF_IN) {
7975 pf_change_icmp(pd2.src, &uh.uh_sport,
7976 daddr, &sk->lan.addr,
7977 sk->lan.xport.port, &uh.uh_sum,
7978 pd2.ip_sum, icmpsum,
7979 pd->ip_sum, 1, pd2.af);
7980 } else {
7981 pf_change_icmp(pd2.dst, &uh.uh_dport,
7982 saddr, &sk->gwy.addr,
7983 sk->gwy.xport.port, &uh.uh_sum,
7984 pd2.ip_sum, icmpsum,
7985 pd->ip_sum, 1, pd2.af);
7986 }
7987 m = pf_lazy_makewritable(pd, m,
7988 off2 + sizeof (uh));
7989 if (!m)
7990 return (PF_DROP);
7991 switch (pd2.af) {
7992 #if INET
7993 case AF_INET:
7994 m_copyback(m, off, ICMP_MINLEN,
7995 pd->hdr.icmp);
7996 m_copyback(m, ipoff2, sizeof (h2), &h2);
7997 break;
7998 #endif /* INET */
7999 #if INET6
8000 case AF_INET6:
8001 m_copyback(m, off,
8002 sizeof (struct icmp6_hdr),
8003 pd->hdr.icmp6);
8004 m_copyback(m, ipoff2, sizeof (h2_6),
8005 &h2_6);
8006 break;
8007 #endif /* INET6 */
8008 }
8009 m_copyback(m, off2, sizeof (uh), &uh);
8010 }
8011
8012 return (PF_PASS);
8013 }
8014 #if INET
8015 case IPPROTO_ICMP: {
8016 struct icmp iih;
8017
8018 if (!pf_pull_hdr(m, off2, &iih, ICMP_MINLEN,
8019 NULL, reason, pd2.af)) {
8020 DPFPRINTF(PF_DEBUG_MISC,
8021 ("pf: ICMP error message too short i"
8022 "(icmp)\n"));
8023 return (PF_DROP);
8024 }
8025
8026 key.proto = IPPROTO_ICMP;
8027 if (direction == PF_IN) {
8028 key.af_gwy = pd2.af;
8029 PF_ACPY(&key.ext_gwy.addr, pd2.dst, key.af_gwy);
8030 PF_ACPY(&key.gwy.addr, pd2.src, key.af_gwy);
8031 key.ext_gwy.xport.port = 0;
8032 key.gwy.xport.port = iih.icmp_id;
8033 } else {
8034 key.af_lan = pd2.af;
8035 PF_ACPY(&key.lan.addr, pd2.dst, key.af_lan);
8036 PF_ACPY(&key.ext_lan.addr, pd2.src, key.af_lan);
8037 key.lan.xport.port = iih.icmp_id;
8038 key.ext_lan.xport.port = 0;
8039 }
8040
8041 STATE_LOOKUP();
8042
8043 sk = (*state)->state_key;
8044 if (STATE_TRANSLATE(sk)) {
8045 if (direction == PF_IN) {
8046 pf_change_icmp(pd2.src, &iih.icmp_id,
8047 daddr, &sk->lan.addr,
8048 sk->lan.xport.port, NULL,
8049 pd2.ip_sum, icmpsum,
8050 pd->ip_sum, 0, AF_INET);
8051 } else {
8052 pf_change_icmp(pd2.dst, &iih.icmp_id,
8053 saddr, &sk->gwy.addr,
8054 sk->gwy.xport.port, NULL,
8055 pd2.ip_sum, icmpsum,
8056 pd->ip_sum, 0, AF_INET);
8057 }
8058 m = pf_lazy_makewritable(pd, m,
8059 off2 + ICMP_MINLEN);
8060 if (!m)
8061 return (PF_DROP);
8062 m_copyback(m, off, ICMP_MINLEN, pd->hdr.icmp);
8063 m_copyback(m, ipoff2, sizeof (h2), &h2);
8064 m_copyback(m, off2, ICMP_MINLEN, &iih);
8065 }
8066
8067 return (PF_PASS);
8068 }
8069 #endif /* INET */
8070 #if INET6
8071 case IPPROTO_ICMPV6: {
8072 struct icmp6_hdr iih;
8073
8074 if (!pf_pull_hdr(m, off2, &iih,
8075 sizeof (struct icmp6_hdr), NULL, reason, pd2.af)) {
8076 DPFPRINTF(PF_DEBUG_MISC,
8077 ("pf: ICMP error message too short "
8078 "(icmp6)\n"));
8079 return (PF_DROP);
8080 }
8081
8082 key.proto = IPPROTO_ICMPV6;
8083 if (direction == PF_IN) {
8084 key.af_gwy = pd2.af;
8085 PF_ACPY(&key.ext_gwy.addr, pd2.dst, key.af_gwy);
8086 PF_ACPY(&key.gwy.addr, pd2.src, key.af_gwy);
8087 key.ext_gwy.xport.port = 0;
8088 key.gwy.xport.port = iih.icmp6_id;
8089 } else {
8090 key.af_lan = pd2.af;
8091 PF_ACPY(&key.lan.addr, pd2.dst, key.af_lan);
8092 PF_ACPY(&key.ext_lan.addr, pd2.src, key.af_lan);
8093 key.lan.xport.port = iih.icmp6_id;
8094 key.ext_lan.xport.port = 0;
8095 }
8096
8097 STATE_LOOKUP();
8098
8099 sk = (*state)->state_key;
8100 if (STATE_TRANSLATE(sk)) {
8101 if (direction == PF_IN) {
8102 pf_change_icmp(pd2.src, &iih.icmp6_id,
8103 daddr, &sk->lan.addr,
8104 sk->lan.xport.port, NULL,
8105 pd2.ip_sum, icmpsum,
8106 pd->ip_sum, 0, AF_INET6);
8107 } else {
8108 pf_change_icmp(pd2.dst, &iih.icmp6_id,
8109 saddr, &sk->gwy.addr,
8110 sk->gwy.xport.port, NULL,
8111 pd2.ip_sum, icmpsum,
8112 pd->ip_sum, 0, AF_INET6);
8113 }
8114 m = pf_lazy_makewritable(pd, m, off2 +
8115 sizeof (struct icmp6_hdr));
8116 if (!m)
8117 return (PF_DROP);
8118 m_copyback(m, off, sizeof (struct icmp6_hdr),
8119 pd->hdr.icmp6);
8120 m_copyback(m, ipoff2, sizeof (h2_6), &h2_6);
8121 m_copyback(m, off2, sizeof (struct icmp6_hdr),
8122 &iih);
8123 }
8124
8125 return (PF_PASS);
8126 }
8127 #endif /* INET6 */
8128 default: {
8129 key.proto = pd2.proto;
8130 if (direction == PF_IN) {
8131 key.af_gwy = pd2.af;
8132 PF_ACPY(&key.ext_gwy.addr, pd2.dst, key.af_gwy);
8133 PF_ACPY(&key.gwy.addr, pd2.src, key.af_gwy);
8134 key.ext_gwy.xport.port = 0;
8135 key.gwy.xport.port = 0;
8136 } else {
8137 key.af_lan = pd2.af;
8138 PF_ACPY(&key.lan.addr, pd2.dst, key.af_lan);
8139 PF_ACPY(&key.ext_lan.addr, pd2.src, key.af_lan);
8140 key.lan.xport.port = 0;
8141 key.ext_lan.xport.port = 0;
8142 }
8143
8144 STATE_LOOKUP();
8145
8146 sk = (*state)->state_key;
8147 if (STATE_TRANSLATE(sk)) {
8148 if (direction == PF_IN) {
8149 pf_change_icmp(pd2.src, NULL, daddr,
8150 &sk->lan.addr, 0, NULL,
8151 pd2.ip_sum, icmpsum,
8152 pd->ip_sum, 0, pd2.af);
8153 } else {
8154 pf_change_icmp(pd2.dst, NULL, saddr,
8155 &sk->gwy.addr, 0, NULL,
8156 pd2.ip_sum, icmpsum,
8157 pd->ip_sum, 0, pd2.af);
8158 }
8159 switch (pd2.af) {
8160 #if INET
8161 case AF_INET:
8162 m = pf_lazy_makewritable(pd, m,
8163 ipoff2 + sizeof (h2));
8164 if (!m)
8165 return (PF_DROP);
8166 #endif /* INET */
8167 #if INET6
8168 case AF_INET6:
8169 m = pf_lazy_makewritable(pd, m,
8170 ipoff2 + sizeof (h2_6));
8171 if (!m)
8172 return (PF_DROP);
8173 m_copyback(m, off,
8174 sizeof (struct icmp6_hdr),
8175 pd->hdr.icmp6);
8176 m_copyback(m, ipoff2, sizeof (h2_6),
8177 &h2_6);
8178 break;
8179 #endif /* INET6 */
8180 }
8181 }
8182
8183 return (PF_PASS);
8184 }
8185 }
8186 }
8187 }
8188
8189 static int
8190 pf_test_state_grev1(struct pf_state **state, int direction,
8191 struct pfi_kif *kif, int off, struct pf_pdesc *pd)
8192 {
8193 struct pf_state_peer *src;
8194 struct pf_state_peer *dst;
8195 struct pf_state_key_cmp key;
8196 struct pf_grev1_hdr *grev1 = pd->hdr.grev1;
8197 struct mbuf *m;
8198
8199 key.app_state = 0;
8200 key.proto = IPPROTO_GRE;
8201 key.proto_variant = PF_GRE_PPTP_VARIANT;
8202 if (direction == PF_IN) {
8203 key.af_gwy = pd->af;
8204 PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy);
8205 PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy);
8206 key.gwy.xport.call_id = grev1->call_id;
8207 } else {
8208 key.af_lan = pd->af;
8209 PF_ACPY(&key.lan.addr, pd->src, key.af_lan);
8210 PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan);
8211 key.ext_lan.xport.call_id = grev1->call_id;
8212 }
8213
8214 STATE_LOOKUP();
8215
8216 if (direction == (*state)->state_key->direction) {
8217 src = &(*state)->src;
8218 dst = &(*state)->dst;
8219 } else {
8220 src = &(*state)->dst;
8221 dst = &(*state)->src;
8222 }
8223
8224 /* update states */
8225 if (src->state < PFGRE1S_INITIATING)
8226 src->state = PFGRE1S_INITIATING;
8227
8228 /* update expire time */
8229 (*state)->expire = pf_time_second();
8230 if (src->state >= PFGRE1S_INITIATING &&
8231 dst->state >= PFGRE1S_INITIATING) {
8232 if ((*state)->timeout != PFTM_TCP_ESTABLISHED)
8233 (*state)->timeout = PFTM_GREv1_ESTABLISHED;
8234 src->state = PFGRE1S_ESTABLISHED;
8235 dst->state = PFGRE1S_ESTABLISHED;
8236 } else {
8237 (*state)->timeout = PFTM_GREv1_INITIATING;
8238 }
8239
8240 if ((*state)->state_key->app_state)
8241 (*state)->state_key->app_state->u.grev1.pptp_state->expire =
8242 pf_time_second();
8243
8244 /* translate source/destination address, if necessary */
8245 if (STATE_GRE_TRANSLATE((*state)->state_key)) {
8246 if (direction == PF_OUT) {
8247 switch (pd->af) {
8248 #if INET
8249 case AF_INET:
8250 pf_change_a(&pd->src->v4.s_addr,
8251 pd->ip_sum,
8252 (*state)->state_key->gwy.addr.v4.s_addr, 0);
8253 break;
8254 #endif /* INET */
8255 #if INET6
8256 case AF_INET6:
8257 PF_ACPY(pd->src, &(*state)->state_key->gwy.addr,
8258 pd->af);
8259 break;
8260 #endif /* INET6 */
8261 }
8262 } else {
8263 grev1->call_id = (*state)->state_key->lan.xport.call_id;
8264
8265 switch (pd->af) {
8266 #if INET
8267 case AF_INET:
8268 pf_change_a(&pd->dst->v4.s_addr,
8269 pd->ip_sum,
8270 (*state)->state_key->lan.addr.v4.s_addr, 0);
8271 break;
8272 #endif /* INET */
8273 #if INET6
8274 case AF_INET6:
8275 PF_ACPY(pd->dst, &(*state)->state_key->lan.addr,
8276 pd->af);
8277 break;
8278 #endif /* INET6 */
8279 }
8280 }
8281
8282 m = pf_lazy_makewritable(pd, pd->mp, off + sizeof (*grev1));
8283 if (!m)
8284 return (PF_DROP);
8285 m_copyback(m, off, sizeof (*grev1), grev1);
8286 }
8287
8288 return (PF_PASS);
8289 }
8290
8291 static int
8292 pf_test_state_esp(struct pf_state **state, int direction, struct pfi_kif *kif,
8293 int off, struct pf_pdesc *pd)
8294 {
8295 #pragma unused(off)
8296 struct pf_state_peer *src;
8297 struct pf_state_peer *dst;
8298 struct pf_state_key_cmp key;
8299 struct pf_esp_hdr *esp = pd->hdr.esp;
8300 int action;
8301
8302 memset(&key, 0, sizeof (key));
8303 key.proto = IPPROTO_ESP;
8304 if (direction == PF_IN) {
8305 key.af_gwy = pd->af;
8306 PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy);
8307 PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy);
8308 key.gwy.xport.spi = esp->spi;
8309 } else {
8310 key.af_lan = pd->af;
8311 PF_ACPY(&key.lan.addr, pd->src, key.af_lan);
8312 PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan);
8313 key.ext_lan.xport.spi = esp->spi;
8314 }
8315
8316 *state = pf_find_state(kif, &key, direction);
8317
8318 if (*state == 0) {
8319 struct pf_state *s;
8320
8321 /*
8322 * <jhw@apple.com>
8323 * No matching state. Look for a blocking state. If we find
8324 * one, then use that state and move it so that it's keyed to
8325 * the SPI in the current packet.
8326 */
8327 if (direction == PF_IN) {
8328 key.gwy.xport.spi = 0;
8329
8330 s = pf_find_state(kif, &key, direction);
8331 if (s) {
8332 struct pf_state_key *sk = s->state_key;
8333
8334 RB_REMOVE(pf_state_tree_ext_gwy,
8335 &pf_statetbl_ext_gwy, sk);
8336 sk->lan.xport.spi = sk->gwy.xport.spi =
8337 esp->spi;
8338
8339 if (RB_INSERT(pf_state_tree_ext_gwy,
8340 &pf_statetbl_ext_gwy, sk))
8341 pf_detach_state(s, PF_DT_SKIP_EXTGWY);
8342 else
8343 *state = s;
8344 }
8345 } else {
8346 key.ext_lan.xport.spi = 0;
8347
8348 s = pf_find_state(kif, &key, direction);
8349 if (s) {
8350 struct pf_state_key *sk = s->state_key;
8351
8352 RB_REMOVE(pf_state_tree_lan_ext,
8353 &pf_statetbl_lan_ext, sk);
8354 sk->ext_lan.xport.spi = esp->spi;
8355
8356 if (RB_INSERT(pf_state_tree_lan_ext,
8357 &pf_statetbl_lan_ext, sk))
8358 pf_detach_state(s, PF_DT_SKIP_LANEXT);
8359 else
8360 *state = s;
8361 }
8362 }
8363
8364 if (s) {
8365 if (*state == 0) {
8366 #if NPFSYNC
8367 if (s->creatorid == pf_status.hostid)
8368 pfsync_delete_state(s);
8369 #endif
8370 s->timeout = PFTM_UNLINKED;
8371 hook_runloop(&s->unlink_hooks,
8372 HOOK_REMOVE|HOOK_FREE);
8373 pf_src_tree_remove_state(s);
8374 pf_free_state(s);
8375 return (PF_DROP);
8376 }
8377 }
8378 }
8379
8380 /* similar to STATE_LOOKUP() */
8381 if (*state != NULL && pd != NULL && !(pd->pktflags & PKTF_FLOW_ID)) {
8382 pd->flowsrc = (*state)->state_key->flowsrc;
8383 pd->flowhash = (*state)->state_key->flowhash;
8384 if (pd->flowhash != 0) {
8385 pd->pktflags |= PKTF_FLOW_ID;
8386 pd->pktflags &= ~PKTF_FLOW_ADV;
8387 }
8388 }
8389
8390 if (pf_state_lookup_aux(state, kif, direction, &action))
8391 return (action);
8392
8393 if (direction == (*state)->state_key->direction) {
8394 src = &(*state)->src;
8395 dst = &(*state)->dst;
8396 } else {
8397 src = &(*state)->dst;
8398 dst = &(*state)->src;
8399 }
8400
8401 /* update states */
8402 if (src->state < PFESPS_INITIATING)
8403 src->state = PFESPS_INITIATING;
8404
8405 /* update expire time */
8406 (*state)->expire = pf_time_second();
8407 if (src->state >= PFESPS_INITIATING &&
8408 dst->state >= PFESPS_INITIATING) {
8409 (*state)->timeout = PFTM_ESP_ESTABLISHED;
8410 src->state = PFESPS_ESTABLISHED;
8411 dst->state = PFESPS_ESTABLISHED;
8412 } else {
8413 (*state)->timeout = PFTM_ESP_INITIATING;
8414 }
8415 /* translate source/destination address, if necessary */
8416 if (STATE_ADDR_TRANSLATE((*state)->state_key)) {
8417 if (direction == PF_OUT) {
8418 switch (pd->af) {
8419 #if INET
8420 case AF_INET:
8421 pf_change_a(&pd->src->v4.s_addr,
8422 pd->ip_sum,
8423 (*state)->state_key->gwy.addr.v4.s_addr, 0);
8424 break;
8425 #endif /* INET */
8426 #if INET6
8427 case AF_INET6:
8428 PF_ACPY(pd->src, &(*state)->state_key->gwy.addr,
8429 pd->af);
8430 break;
8431 #endif /* INET6 */
8432 }
8433 } else {
8434 switch (pd->af) {
8435 #if INET
8436 case AF_INET:
8437 pf_change_a(&pd->dst->v4.s_addr,
8438 pd->ip_sum,
8439 (*state)->state_key->lan.addr.v4.s_addr, 0);
8440 break;
8441 #endif /* INET */
8442 #if INET6
8443 case AF_INET6:
8444 PF_ACPY(pd->dst, &(*state)->state_key->lan.addr,
8445 pd->af);
8446 break;
8447 #endif /* INET6 */
8448 }
8449 }
8450 }
8451
8452 return (PF_PASS);
8453 }
8454
8455 static int
8456 pf_test_state_other(struct pf_state **state, int direction, struct pfi_kif *kif,
8457 struct pf_pdesc *pd)
8458 {
8459 struct pf_state_peer *src, *dst;
8460 struct pf_state_key_cmp key;
8461
8462 key.app_state = 0;
8463 key.proto = pd->proto;
8464 if (direction == PF_IN) {
8465 key.af_gwy = pd->af;
8466 PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy);
8467 PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy);
8468 key.ext_gwy.xport.port = 0;
8469 key.gwy.xport.port = 0;
8470 } else {
8471 key.af_lan = pd->af;
8472 PF_ACPY(&key.lan.addr, pd->src, key.af_lan);
8473 PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan);
8474 key.lan.xport.port = 0;
8475 key.ext_lan.xport.port = 0;
8476 }
8477
8478 STATE_LOOKUP();
8479
8480 if (direction == (*state)->state_key->direction) {
8481 src = &(*state)->src;
8482 dst = &(*state)->dst;
8483 } else {
8484 src = &(*state)->dst;
8485 dst = &(*state)->src;
8486 }
8487
8488 /* update states */
8489 if (src->state < PFOTHERS_SINGLE)
8490 src->state = PFOTHERS_SINGLE;
8491 if (dst->state == PFOTHERS_SINGLE)
8492 dst->state = PFOTHERS_MULTIPLE;
8493
8494 /* update expire time */
8495 (*state)->expire = pf_time_second();
8496 if (src->state == PFOTHERS_MULTIPLE && dst->state == PFOTHERS_MULTIPLE)
8497 (*state)->timeout = PFTM_OTHER_MULTIPLE;
8498 else
8499 (*state)->timeout = PFTM_OTHER_SINGLE;
8500
8501 /* translate source/destination address, if necessary */
8502 if (STATE_ADDR_TRANSLATE((*state)->state_key)) {
8503 if (direction == PF_OUT) {
8504 switch (pd->af) {
8505 #if INET
8506 case AF_INET:
8507 pf_change_a(&pd->src->v4.s_addr,
8508 pd->ip_sum,
8509 (*state)->state_key->gwy.addr.v4.s_addr,
8510 0);
8511 break;
8512 #endif /* INET */
8513 #if INET6
8514 case AF_INET6:
8515 PF_ACPY(pd->src,
8516 &(*state)->state_key->gwy.addr, pd->af);
8517 break;
8518 #endif /* INET6 */
8519 }
8520 } else {
8521 switch (pd->af) {
8522 #if INET
8523 case AF_INET:
8524 pf_change_a(&pd->dst->v4.s_addr,
8525 pd->ip_sum,
8526 (*state)->state_key->lan.addr.v4.s_addr,
8527 0);
8528 break;
8529 #endif /* INET */
8530 #if INET6
8531 case AF_INET6:
8532 PF_ACPY(pd->dst,
8533 &(*state)->state_key->lan.addr, pd->af);
8534 break;
8535 #endif /* INET6 */
8536 }
8537 }
8538 }
8539
8540 return (PF_PASS);
8541 }
8542
8543 /*
8544 * ipoff and off are measured from the start of the mbuf chain.
8545 * h must be at "ipoff" on the mbuf chain.
8546 */
8547 void *
8548 pf_pull_hdr(struct mbuf *m, int off, void *p, int len,
8549 u_short *actionp, u_short *reasonp, sa_family_t af)
8550 {
8551 switch (af) {
8552 #if INET
8553 case AF_INET: {
8554 struct ip *h = mtod(m, struct ip *);
8555 u_int16_t fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3;
8556
8557 if (fragoff) {
8558 if (fragoff >= len) {
8559 ACTION_SET(actionp, PF_PASS);
8560 } else {
8561 ACTION_SET(actionp, PF_DROP);
8562 REASON_SET(reasonp, PFRES_FRAG);
8563 }
8564 return (NULL);
8565 }
8566 if (m->m_pkthdr.len < off + len ||
8567 ntohs(h->ip_len) < off + len) {
8568 ACTION_SET(actionp, PF_DROP);
8569 REASON_SET(reasonp, PFRES_SHORT);
8570 return (NULL);
8571 }
8572 break;
8573 }
8574 #endif /* INET */
8575 #if INET6
8576 case AF_INET6: {
8577 struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
8578
8579 if (m->m_pkthdr.len < off + len ||
8580 (ntohs(h->ip6_plen) + sizeof (struct ip6_hdr)) <
8581 (unsigned)(off + len)) {
8582 ACTION_SET(actionp, PF_DROP);
8583 REASON_SET(reasonp, PFRES_SHORT);
8584 return (NULL);
8585 }
8586 break;
8587 }
8588 #endif /* INET6 */
8589 }
8590 m_copydata(m, off, len, p);
8591 return (p);
8592 }
8593
8594 int
8595 pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *kif)
8596 {
8597 #pragma unused(kif)
8598 struct sockaddr_in *dst;
8599 int ret = 1;
8600 #if INET6
8601 struct sockaddr_in6 *dst6;
8602 struct route_in6 ro;
8603 #else
8604 struct route ro;
8605 #endif
8606
8607 bzero(&ro, sizeof (ro));
8608 switch (af) {
8609 case AF_INET:
8610 dst = satosin(&ro.ro_dst);
8611 dst->sin_family = AF_INET;
8612 dst->sin_len = sizeof (*dst);
8613 dst->sin_addr = addr->v4;
8614 break;
8615 #if INET6
8616 case AF_INET6:
8617 dst6 = (struct sockaddr_in6 *)&ro.ro_dst;
8618 dst6->sin6_family = AF_INET6;
8619 dst6->sin6_len = sizeof (*dst6);
8620 dst6->sin6_addr = addr->v6;
8621 break;
8622 #endif /* INET6 */
8623 default:
8624 return (0);
8625 }
8626
8627 /* XXX: IFT_ENC is not currently used by anything*/
8628 /* Skip checks for ipsec interfaces */
8629 if (kif != NULL && kif->pfik_ifp->if_type == IFT_ENC)
8630 goto out;
8631
8632 /* XXX: what is the point of this? */
8633 rtalloc((struct route *)&ro);
8634
8635 out:
8636 ROUTE_RELEASE(&ro);
8637 return (ret);
8638 }
8639
8640 int
8641 pf_rtlabel_match(struct pf_addr *addr, sa_family_t af, struct pf_addr_wrap *aw)
8642 {
8643 #pragma unused(aw)
8644 struct sockaddr_in *dst;
8645 #if INET6
8646 struct sockaddr_in6 *dst6;
8647 struct route_in6 ro;
8648 #else
8649 struct route ro;
8650 #endif
8651 int ret = 0;
8652
8653 bzero(&ro, sizeof (ro));
8654 switch (af) {
8655 case AF_INET:
8656 dst = satosin(&ro.ro_dst);
8657 dst->sin_family = AF_INET;
8658 dst->sin_len = sizeof (*dst);
8659 dst->sin_addr = addr->v4;
8660 break;
8661 #if INET6
8662 case AF_INET6:
8663 dst6 = (struct sockaddr_in6 *)&ro.ro_dst;
8664 dst6->sin6_family = AF_INET6;
8665 dst6->sin6_len = sizeof (*dst6);
8666 dst6->sin6_addr = addr->v6;
8667 break;
8668 #endif /* INET6 */
8669 default:
8670 return (0);
8671 }
8672
8673 /* XXX: what is the point of this? */
8674 rtalloc((struct route *)&ro);
8675
8676 ROUTE_RELEASE(&ro);
8677
8678 return (ret);
8679 }
8680
8681 #if INET
8682 static void
8683 pf_route(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp,
8684 struct pf_state *s, struct pf_pdesc *pd)
8685 {
8686 #pragma unused(pd)
8687 struct mbuf *m0, *m1;
8688 struct route iproute;
8689 struct route *ro = &iproute;
8690 struct sockaddr_in *dst;
8691 struct ip *ip;
8692 struct ifnet *ifp = NULL;
8693 struct pf_addr naddr;
8694 struct pf_src_node *sn = NULL;
8695 int error = 0;
8696 uint32_t sw_csum;
8697
8698 bzero(&iproute, sizeof (iproute));
8699
8700 if (m == NULL || *m == NULL || r == NULL ||
8701 (dir != PF_IN && dir != PF_OUT) || oifp == NULL)
8702 panic("pf_route: invalid parameters");
8703
8704 if (pd->pf_mtag->pftag_routed++ > 3) {
8705 m0 = *m;
8706 *m = NULL;
8707 goto bad;
8708 }
8709
8710 if (r->rt == PF_DUPTO) {
8711 if ((m0 = m_copym(*m, 0, M_COPYALL, M_NOWAIT)) == NULL)
8712 return;
8713 } else {
8714 if ((r->rt == PF_REPLYTO) == (r->direction == dir))
8715 return;
8716 m0 = *m;
8717 }
8718
8719 if (m0->m_len < (int)sizeof (struct ip)) {
8720 DPFPRINTF(PF_DEBUG_URGENT,
8721 ("pf_route: m0->m_len < sizeof (struct ip)\n"));
8722 goto bad;
8723 }
8724
8725 ip = mtod(m0, struct ip *);
8726
8727 dst = satosin((void *)&ro->ro_dst);
8728 dst->sin_family = AF_INET;
8729 dst->sin_len = sizeof (*dst);
8730 dst->sin_addr = ip->ip_dst;
8731
8732 if (r->rt == PF_FASTROUTE) {
8733 rtalloc(ro);
8734 if (ro->ro_rt == NULL) {
8735 ipstat.ips_noroute++;
8736 goto bad;
8737 }
8738
8739 ifp = ro->ro_rt->rt_ifp;
8740 RT_LOCK(ro->ro_rt);
8741 ro->ro_rt->rt_use++;
8742
8743 if (ro->ro_rt->rt_flags & RTF_GATEWAY)
8744 dst = satosin((void *)ro->ro_rt->rt_gateway);
8745 RT_UNLOCK(ro->ro_rt);
8746 } else {
8747 if (TAILQ_EMPTY(&r->rpool.list)) {
8748 DPFPRINTF(PF_DEBUG_URGENT,
8749 ("pf_route: TAILQ_EMPTY(&r->rpool.list)\n"));
8750 goto bad;
8751 }
8752 if (s == NULL) {
8753 pf_map_addr(AF_INET, r, (struct pf_addr *)&ip->ip_src,
8754 &naddr, NULL, &sn);
8755 if (!PF_AZERO(&naddr, AF_INET))
8756 dst->sin_addr.s_addr = naddr.v4.s_addr;
8757 ifp = r->rpool.cur->kif ?
8758 r->rpool.cur->kif->pfik_ifp : NULL;
8759 } else {
8760 if (!PF_AZERO(&s->rt_addr, AF_INET))
8761 dst->sin_addr.s_addr =
8762 s->rt_addr.v4.s_addr;
8763 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
8764 }
8765 }
8766 if (ifp == NULL)
8767 goto bad;
8768
8769 if (oifp != ifp) {
8770 if (pf_test(PF_OUT, ifp, &m0, NULL, NULL) != PF_PASS)
8771 goto bad;
8772 else if (m0 == NULL)
8773 goto done;
8774 if (m0->m_len < (int)sizeof (struct ip)) {
8775 DPFPRINTF(PF_DEBUG_URGENT,
8776 ("pf_route: m0->m_len < sizeof (struct ip)\n"));
8777 goto bad;
8778 }
8779 ip = mtod(m0, struct ip *);
8780 }
8781
8782 /* Catch routing changes wrt. hardware checksumming for TCP or UDP. */
8783 ip_output_checksum(ifp, m0, ((ip->ip_hl) << 2), ntohs(ip->ip_len),
8784 &sw_csum);
8785
8786 if (ntohs(ip->ip_len) <= ifp->if_mtu || TSO_IPV4_OK(ifp, m0) ||
8787 (!(ip->ip_off & htons(IP_DF)) &&
8788 (ifp->if_hwassist & CSUM_FRAGMENT))) {
8789 ip->ip_sum = 0;
8790 if (sw_csum & CSUM_DELAY_IP) {
8791 ip->ip_sum = in_cksum(m0, ip->ip_hl << 2);
8792 sw_csum &= ~CSUM_DELAY_IP;
8793 m0->m_pkthdr.csum_flags &= ~CSUM_DELAY_IP;
8794 }
8795 error = ifnet_output(ifp, PF_INET, m0, ro->ro_rt, sintosa(dst));
8796 goto done;
8797 }
8798
8799 /*
8800 * Too large for interface; fragment if possible.
8801 * Must be able to put at least 8 bytes per fragment.
8802 * Balk when DF bit is set or the interface didn't support TSO.
8803 */
8804 if ((ip->ip_off & htons(IP_DF)) ||
8805 (m0->m_pkthdr.csum_flags & CSUM_TSO_IPV4)) {
8806 ipstat.ips_cantfrag++;
8807 if (r->rt != PF_DUPTO) {
8808 icmp_error(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 0,
8809 ifp->if_mtu);
8810 goto done;
8811 } else
8812 goto bad;
8813 }
8814
8815 m1 = m0;
8816
8817 /* PR-8933605: send ip_len,ip_off to ip_fragment in host byte order */
8818 #if BYTE_ORDER != BIG_ENDIAN
8819 NTOHS(ip->ip_off);
8820 NTOHS(ip->ip_len);
8821 #endif
8822 error = ip_fragment(m0, ifp, ifp->if_mtu, sw_csum);
8823
8824 if (error) {
8825 m0 = NULL;
8826 goto bad;
8827 }
8828
8829 for (m0 = m1; m0; m0 = m1) {
8830 m1 = m0->m_nextpkt;
8831 m0->m_nextpkt = 0;
8832 if (error == 0)
8833 error = ifnet_output(ifp, PF_INET, m0, ro->ro_rt,
8834 sintosa(dst));
8835 else
8836 m_freem(m0);
8837 }
8838
8839 if (error == 0)
8840 ipstat.ips_fragmented++;
8841
8842 done:
8843 if (r->rt != PF_DUPTO)
8844 *m = NULL;
8845
8846 ROUTE_RELEASE(&iproute);
8847 return;
8848
8849 bad:
8850 m_freem(m0);
8851 goto done;
8852 }
8853 #endif /* INET */
8854
8855 #if INET6
8856 static void
8857 pf_route6(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp,
8858 struct pf_state *s, struct pf_pdesc *pd)
8859 {
8860 #pragma unused(pd)
8861 struct mbuf *m0;
8862 struct route_in6 ip6route;
8863 struct route_in6 *ro;
8864 struct sockaddr_in6 *dst;
8865 struct ip6_hdr *ip6;
8866 struct ifnet *ifp = NULL;
8867 struct pf_addr naddr;
8868 struct pf_src_node *sn = NULL;
8869 int error = 0;
8870
8871 if (m == NULL || *m == NULL || r == NULL ||
8872 (dir != PF_IN && dir != PF_OUT) || oifp == NULL)
8873 panic("pf_route6: invalid parameters");
8874
8875 if (pd->pf_mtag->pftag_routed++ > 3) {
8876 m0 = *m;
8877 *m = NULL;
8878 goto bad;
8879 }
8880
8881 if (r->rt == PF_DUPTO) {
8882 if ((m0 = m_copym(*m, 0, M_COPYALL, M_NOWAIT)) == NULL)
8883 return;
8884 } else {
8885 if ((r->rt == PF_REPLYTO) == (r->direction == dir))
8886 return;
8887 m0 = *m;
8888 }
8889
8890 if (m0->m_len < (int)sizeof (struct ip6_hdr)) {
8891 DPFPRINTF(PF_DEBUG_URGENT,
8892 ("pf_route6: m0->m_len < sizeof (struct ip6_hdr)\n"));
8893 goto bad;
8894 }
8895 ip6 = mtod(m0, struct ip6_hdr *);
8896
8897 ro = &ip6route;
8898 bzero((caddr_t)ro, sizeof (*ro));
8899 dst = (struct sockaddr_in6 *)&ro->ro_dst;
8900 dst->sin6_family = AF_INET6;
8901 dst->sin6_len = sizeof (*dst);
8902 dst->sin6_addr = ip6->ip6_dst;
8903
8904 /* Cheat. XXX why only in the v6 case??? */
8905 if (r->rt == PF_FASTROUTE) {
8906 struct pf_mtag *pf_mtag;
8907
8908 if ((pf_mtag = pf_get_mtag(m0)) == NULL)
8909 goto bad;
8910 pf_mtag->pftag_flags |= PF_TAG_GENERATED;
8911 ip6_output(m0, NULL, NULL, 0, NULL, NULL, NULL);
8912 return;
8913 }
8914
8915 if (TAILQ_EMPTY(&r->rpool.list)) {
8916 DPFPRINTF(PF_DEBUG_URGENT,
8917 ("pf_route6: TAILQ_EMPTY(&r->rpool.list)\n"));
8918 goto bad;
8919 }
8920 if (s == NULL) {
8921 pf_map_addr(AF_INET6, r, (struct pf_addr *)&ip6->ip6_src,
8922 &naddr, NULL, &sn);
8923 if (!PF_AZERO(&naddr, AF_INET6))
8924 PF_ACPY((struct pf_addr *)&dst->sin6_addr,
8925 &naddr, AF_INET6);
8926 ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL;
8927 } else {
8928 if (!PF_AZERO(&s->rt_addr, AF_INET6))
8929 PF_ACPY((struct pf_addr *)&dst->sin6_addr,
8930 &s->rt_addr, AF_INET6);
8931 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
8932 }
8933 if (ifp == NULL)
8934 goto bad;
8935
8936 if (oifp != ifp) {
8937 if (pf_test6(PF_OUT, ifp, &m0, NULL, NULL) != PF_PASS)
8938 goto bad;
8939 else if (m0 == NULL)
8940 goto done;
8941 if (m0->m_len < (int)sizeof (struct ip6_hdr)) {
8942 DPFPRINTF(PF_DEBUG_URGENT, ("pf_route6: m0->m_len "
8943 "< sizeof (struct ip6_hdr)\n"));
8944 goto bad;
8945 }
8946 ip6 = mtod(m0, struct ip6_hdr *);
8947 }
8948
8949 /*
8950 * If the packet is too large for the outgoing interface,
8951 * send back an icmp6 error.
8952 */
8953 if (IN6_IS_SCOPE_EMBED(&dst->sin6_addr))
8954 dst->sin6_addr.s6_addr16[1] = htons(ifp->if_index);
8955 if ((unsigned)m0->m_pkthdr.len <= ifp->if_mtu) {
8956 error = nd6_output(ifp, ifp, m0, dst, NULL, NULL);
8957 } else {
8958 in6_ifstat_inc(ifp, ifs6_in_toobig);
8959 if (r->rt != PF_DUPTO)
8960 icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu);
8961 else
8962 goto bad;
8963 }
8964
8965 done:
8966 if (r->rt != PF_DUPTO)
8967 *m = NULL;
8968 return;
8969
8970 bad:
8971 m_freem(m0);
8972 goto done;
8973 }
8974 #endif /* INET6 */
8975
8976
8977 /*
8978 * check protocol (tcp/udp/icmp/icmp6) checksum and set mbuf flag
8979 * off is the offset where the protocol header starts
8980 * len is the total length of protocol header plus payload
8981 * returns 0 when the checksum is valid, otherwise returns 1.
8982 */
8983 static int
8984 pf_check_proto_cksum(struct mbuf *m, int off, int len, u_int8_t p,
8985 sa_family_t af)
8986 {
8987 u_int16_t sum;
8988
8989 switch (p) {
8990 case IPPROTO_TCP:
8991 case IPPROTO_UDP:
8992 /*
8993 * Optimize for the common case; if the hardware calculated
8994 * value doesn't include pseudo-header checksum, or if it
8995 * is partially-computed (only 16-bit summation), do it in
8996 * software below.
8997 */
8998 if ((m->m_pkthdr.csum_flags &
8999 (CSUM_DATA_VALID | CSUM_PSEUDO_HDR)) ==
9000 (CSUM_DATA_VALID | CSUM_PSEUDO_HDR) &&
9001 (m->m_pkthdr.csum_data ^ 0xffff) == 0) {
9002 return (0);
9003 }
9004 break;
9005 case IPPROTO_ICMP:
9006 #if INET6
9007 case IPPROTO_ICMPV6:
9008 #endif /* INET6 */
9009 break;
9010 default:
9011 return (1);
9012 }
9013 if (off < (int)sizeof (struct ip) || len < (int)sizeof (struct udphdr))
9014 return (1);
9015 if (m->m_pkthdr.len < off + len)
9016 return (1);
9017 switch (af) {
9018 #if INET
9019 case AF_INET:
9020 if (p == IPPROTO_ICMP) {
9021 if (m->m_len < off)
9022 return (1);
9023 m->m_data += off;
9024 m->m_len -= off;
9025 sum = in_cksum(m, len);
9026 m->m_data -= off;
9027 m->m_len += off;
9028 } else {
9029 if (m->m_len < (int)sizeof (struct ip))
9030 return (1);
9031 sum = inet_cksum(m, p, off, len);
9032 }
9033 break;
9034 #endif /* INET */
9035 #if INET6
9036 case AF_INET6:
9037 if (m->m_len < (int)sizeof (struct ip6_hdr))
9038 return (1);
9039 sum = inet6_cksum(m, p, off, len);
9040 break;
9041 #endif /* INET6 */
9042 default:
9043 return (1);
9044 }
9045 if (sum) {
9046 switch (p) {
9047 case IPPROTO_TCP:
9048 tcpstat.tcps_rcvbadsum++;
9049 break;
9050 case IPPROTO_UDP:
9051 udpstat.udps_badsum++;
9052 break;
9053 case IPPROTO_ICMP:
9054 icmpstat.icps_checksum++;
9055 break;
9056 #if INET6
9057 case IPPROTO_ICMPV6:
9058 icmp6stat.icp6s_checksum++;
9059 break;
9060 #endif /* INET6 */
9061 }
9062 return (1);
9063 }
9064 return (0);
9065 }
9066
9067 #if INET
9068 #define PF_APPLE_UPDATE_PDESC_IPv4() \
9069 do { \
9070 if (m && pd.mp && m != pd.mp) { \
9071 m = pd.mp; \
9072 h = mtod(m, struct ip *); \
9073 pd.pf_mtag = pf_get_mtag(m); \
9074 } \
9075 } while (0)
9076
9077 int
9078 pf_test(int dir, struct ifnet *ifp, struct mbuf **m0,
9079 struct ether_header *eh, struct ip_fw_args *fwa)
9080 {
9081 #if !DUMMYNET
9082 #pragma unused(fwa)
9083 #endif
9084 struct pfi_kif *kif;
9085 u_short action = PF_PASS, reason = 0, log = 0;
9086 struct mbuf *m = *m0;
9087 struct ip *h = 0;
9088 struct pf_rule *a = NULL, *r = &pf_default_rule, *tr, *nr;
9089 struct pf_state *s = NULL;
9090 struct pf_state_key *sk = NULL;
9091 struct pf_ruleset *ruleset = NULL;
9092 struct pf_pdesc pd;
9093 int off, dirndx, pqid = 0;
9094
9095 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
9096
9097 if (!pf_status.running)
9098 return (PF_PASS);
9099
9100 memset(&pd, 0, sizeof (pd));
9101
9102 if ((pd.pf_mtag = pf_get_mtag(m)) == NULL) {
9103 DPFPRINTF(PF_DEBUG_URGENT,
9104 ("pf_test: pf_get_mtag returned NULL\n"));
9105 return (PF_DROP);
9106 }
9107
9108 if (pd.pf_mtag->pftag_flags & PF_TAG_GENERATED)
9109 return (PF_PASS);
9110
9111 kif = (struct pfi_kif *)ifp->if_pf_kif;
9112
9113 if (kif == NULL) {
9114 DPFPRINTF(PF_DEBUG_URGENT,
9115 ("pf_test: kif == NULL, if_name %s\n", ifp->if_name));
9116 return (PF_DROP);
9117 }
9118 if (kif->pfik_flags & PFI_IFLAG_SKIP)
9119 return (PF_PASS);
9120
9121 VERIFY(m->m_flags & M_PKTHDR);
9122
9123 /* initialize enough of pd for the done label */
9124 h = mtod(m, struct ip *);
9125 pd.mp = m;
9126 pd.lmw = 0;
9127 pd.pf_mtag = pf_get_mtag(m);
9128 pd.src = (struct pf_addr *)&h->ip_src;
9129 pd.dst = (struct pf_addr *)&h->ip_dst;
9130 PF_ACPY(&pd.baddr, pd.src, AF_INET);
9131 PF_ACPY(&pd.bdaddr, pd.dst, AF_INET);
9132 pd.ip_sum = &h->ip_sum;
9133 pd.proto = h->ip_p;
9134 pd.proto_variant = 0;
9135 pd.af = AF_INET;
9136 pd.tos = h->ip_tos;
9137 pd.ttl = h->ip_ttl;
9138 pd.tot_len = ntohs(h->ip_len);
9139 pd.eh = eh;
9140
9141 if (m->m_pkthdr.len < (int)sizeof (*h)) {
9142 action = PF_DROP;
9143 REASON_SET(&reason, PFRES_SHORT);
9144 log = 1;
9145 goto done;
9146 }
9147
9148 #if DUMMYNET
9149 if (fwa != NULL && fwa->fwa_pf_rule != NULL)
9150 goto nonormalize;
9151 #endif /* DUMMYNET */
9152
9153 /* We do IP header normalization and packet reassembly here */
9154 action = pf_normalize_ip(m0, dir, kif, &reason, &pd);
9155 pd.mp = m = *m0;
9156 if (action != PF_PASS || pd.lmw < 0) {
9157 action = PF_DROP;
9158 goto done;
9159 }
9160
9161 #if DUMMYNET
9162 nonormalize:
9163 #endif /* DUMMYNET */
9164 m = *m0; /* pf_normalize messes with m0 */
9165 h = mtod(m, struct ip *);
9166
9167 off = h->ip_hl << 2;
9168 if (off < (int)sizeof (*h)) {
9169 action = PF_DROP;
9170 REASON_SET(&reason, PFRES_SHORT);
9171 log = 1;
9172 goto done;
9173 }
9174
9175 pd.src = (struct pf_addr *)&h->ip_src;
9176 pd.dst = (struct pf_addr *)&h->ip_dst;
9177 PF_ACPY(&pd.baddr, pd.src, AF_INET);
9178 PF_ACPY(&pd.bdaddr, pd.dst, AF_INET);
9179 pd.ip_sum = &h->ip_sum;
9180 pd.proto = h->ip_p;
9181 pd.proto_variant = 0;
9182 pd.mp = m;
9183 pd.lmw = 0;
9184 pd.pf_mtag = pf_get_mtag(m);
9185 pd.af = AF_INET;
9186 pd.tos = h->ip_tos;
9187 pd.ttl = h->ip_ttl;
9188 pd.sc = MBUF_SCIDX(mbuf_get_service_class(m));
9189 pd.tot_len = ntohs(h->ip_len);
9190 pd.eh = eh;
9191
9192 if (m->m_pkthdr.pkt_flags & PKTF_FLOW_ID) {
9193 pd.flowsrc = m->m_pkthdr.pkt_flowsrc;
9194 pd.flowhash = m->m_pkthdr.pkt_flowid;
9195 pd.pktflags = (m->m_pkthdr.pkt_flags & PKTF_FLOW_MASK);
9196 }
9197
9198 /* handle fragments that didn't get reassembled by normalization */
9199 if (h->ip_off & htons(IP_MF | IP_OFFMASK)) {
9200 pd.flags |= PFDESC_IP_FRAG;
9201 #if DUMMYNET
9202 /* Traffic goes through dummynet first */
9203 action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
9204 if (action == PF_DROP || m == NULL) {
9205 *m0 = NULL;
9206 return (action);
9207 }
9208 #endif /* DUMMYNET */
9209 action = pf_test_fragment(&r, dir, kif, m, h,
9210 &pd, &a, &ruleset);
9211 goto done;
9212 }
9213
9214 switch (h->ip_p) {
9215
9216 case IPPROTO_TCP: {
9217 struct tcphdr th;
9218 pd.hdr.tcp = &th;
9219 if (!pf_pull_hdr(m, off, &th, sizeof (th),
9220 &action, &reason, AF_INET)) {
9221 log = action != PF_PASS;
9222 goto done;
9223 }
9224 pd.p_len = pd.tot_len - off - (th.th_off << 2);
9225 if ((th.th_flags & TH_ACK) && pd.p_len == 0)
9226 pqid = 1;
9227 #if DUMMYNET
9228 /* Traffic goes through dummynet first */
9229 action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
9230 if (action == PF_DROP || m == NULL) {
9231 *m0 = NULL;
9232 return (action);
9233 }
9234 #endif /* DUMMYNET */
9235 action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
9236 if (pd.lmw < 0)
9237 goto done;
9238 PF_APPLE_UPDATE_PDESC_IPv4();
9239 if (action == PF_DROP)
9240 goto done;
9241 action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd,
9242 &reason);
9243 if (action == PF_NAT64)
9244 goto done;
9245 if (pd.lmw < 0)
9246 goto done;
9247 PF_APPLE_UPDATE_PDESC_IPv4();
9248 if (action == PF_PASS) {
9249 #if NPFSYNC
9250 pfsync_update_state(s);
9251 #endif /* NPFSYNC */
9252 r = s->rule.ptr;
9253 a = s->anchor.ptr;
9254 log = s->log;
9255 } else if (s == NULL)
9256 action = pf_test_rule(&r, &s, dir, kif,
9257 m, off, h, &pd, &a, &ruleset, NULL);
9258 break;
9259 }
9260
9261 case IPPROTO_UDP: {
9262 struct udphdr uh;
9263
9264 pd.hdr.udp = &uh;
9265 if (!pf_pull_hdr(m, off, &uh, sizeof (uh),
9266 &action, &reason, AF_INET)) {
9267 log = action != PF_PASS;
9268 goto done;
9269 }
9270 if (uh.uh_dport == 0 ||
9271 ntohs(uh.uh_ulen) > m->m_pkthdr.len - off ||
9272 ntohs(uh.uh_ulen) < sizeof (struct udphdr)) {
9273 action = PF_DROP;
9274 REASON_SET(&reason, PFRES_SHORT);
9275 goto done;
9276 }
9277 #if DUMMYNET
9278 /* Traffic goes through dummynet first */
9279 action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
9280 if (action == PF_DROP || m == NULL) {
9281 *m0 = NULL;
9282 return (action);
9283 }
9284 #endif /* DUMMYNET */
9285 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd,
9286 &reason);
9287 if (action == PF_NAT64)
9288 goto done;
9289 if (pd.lmw < 0)
9290 goto done;
9291 PF_APPLE_UPDATE_PDESC_IPv4();
9292 if (action == PF_PASS) {
9293 #if NPFSYNC
9294 pfsync_update_state(s);
9295 #endif /* NPFSYNC */
9296 r = s->rule.ptr;
9297 a = s->anchor.ptr;
9298 log = s->log;
9299 } else if (s == NULL)
9300 action = pf_test_rule(&r, &s, dir, kif,
9301 m, off, h, &pd, &a, &ruleset, NULL);
9302 break;
9303 }
9304
9305 case IPPROTO_ICMP: {
9306 struct icmp ih;
9307
9308 pd.hdr.icmp = &ih;
9309 if (!pf_pull_hdr(m, off, &ih, ICMP_MINLEN,
9310 &action, &reason, AF_INET)) {
9311 log = action != PF_PASS;
9312 goto done;
9313 }
9314 #if DUMMYNET
9315 /* Traffic goes through dummynet first */
9316 action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
9317 if (action == PF_DROP || m == NULL) {
9318 *m0 = NULL;
9319 return (action);
9320 }
9321 #endif /* DUMMYNET */
9322 action = pf_test_state_icmp(&s, dir, kif, m, off, h, &pd,
9323 &reason);
9324 if (action == PF_NAT64)
9325 goto done;
9326 if (pd.lmw < 0)
9327 goto done;
9328 PF_APPLE_UPDATE_PDESC_IPv4();
9329 if (action == PF_PASS) {
9330 #if NPFSYNC
9331 pfsync_update_state(s);
9332 #endif /* NPFSYNC */
9333 r = s->rule.ptr;
9334 a = s->anchor.ptr;
9335 log = s->log;
9336 } else if (s == NULL)
9337 action = pf_test_rule(&r, &s, dir, kif,
9338 m, off, h, &pd, &a, &ruleset, NULL);
9339 break;
9340 }
9341
9342 case IPPROTO_ESP: {
9343 struct pf_esp_hdr esp;
9344
9345 pd.hdr.esp = &esp;
9346 if (!pf_pull_hdr(m, off, &esp, sizeof (esp), &action, &reason,
9347 AF_INET)) {
9348 log = action != PF_PASS;
9349 goto done;
9350 }
9351 #if DUMMYNET
9352 /* Traffic goes through dummynet first */
9353 action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
9354 if (action == PF_DROP || m == NULL) {
9355 *m0 = NULL;
9356 return (action);
9357 }
9358 #endif /* DUMMYNET */
9359 action = pf_test_state_esp(&s, dir, kif, off, &pd);
9360 if (pd.lmw < 0)
9361 goto done;
9362 PF_APPLE_UPDATE_PDESC_IPv4();
9363 if (action == PF_PASS) {
9364 #if NPFSYNC
9365 pfsync_update_state(s);
9366 #endif /* NPFSYNC */
9367 r = s->rule.ptr;
9368 a = s->anchor.ptr;
9369 log = s->log;
9370 } else if (s == NULL)
9371 action = pf_test_rule(&r, &s, dir, kif,
9372 m, off, h, &pd, &a, &ruleset, NULL);
9373 break;
9374 }
9375
9376 case IPPROTO_GRE: {
9377 struct pf_grev1_hdr grev1;
9378 pd.hdr.grev1 = &grev1;
9379 if (!pf_pull_hdr(m, off, &grev1, sizeof (grev1), &action,
9380 &reason, AF_INET)) {
9381 log = (action != PF_PASS);
9382 goto done;
9383 }
9384 #if DUMMYNET
9385 /* Traffic goes through dummynet first */
9386 action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
9387 if (action == PF_DROP || m == NULL) {
9388 *m0 = NULL;
9389 return (action);
9390 }
9391 #endif /* DUMMYNET */
9392 if ((ntohs(grev1.flags) & PF_GRE_FLAG_VERSION_MASK) == 1 &&
9393 ntohs(grev1.protocol_type) == PF_GRE_PPP_ETHERTYPE) {
9394 if (ntohs(grev1.payload_length) >
9395 m->m_pkthdr.len - off) {
9396 action = PF_DROP;
9397 REASON_SET(&reason, PFRES_SHORT);
9398 goto done;
9399 }
9400 pd.proto_variant = PF_GRE_PPTP_VARIANT;
9401 action = pf_test_state_grev1(&s, dir, kif, off, &pd);
9402 if (pd.lmw < 0) goto done;
9403 PF_APPLE_UPDATE_PDESC_IPv4();
9404 if (action == PF_PASS) {
9405 #if NPFSYNC
9406 pfsync_update_state(s);
9407 #endif /* NPFSYNC */
9408 r = s->rule.ptr;
9409 a = s->anchor.ptr;
9410 log = s->log;
9411 break;
9412 } else if (s == NULL) {
9413 action = pf_test_rule(&r, &s, dir, kif, m, off,
9414 h, &pd, &a, &ruleset, NULL);
9415 if (action == PF_PASS)
9416 break;
9417 }
9418 }
9419
9420 /* not GREv1/PPTP, so treat as ordinary GRE... */
9421 }
9422
9423 default:
9424 #if DUMMYNET
9425 /* Traffic goes through dummynet first */
9426 action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
9427 if (action == PF_DROP || m == NULL) {
9428 *m0 = NULL;
9429 return (action);
9430 }
9431 #endif /* DUMMYNET */
9432 action = pf_test_state_other(&s, dir, kif, &pd);
9433 if (pd.lmw < 0)
9434 goto done;
9435 PF_APPLE_UPDATE_PDESC_IPv4();
9436 if (action == PF_PASS) {
9437 #if NPFSYNC
9438 pfsync_update_state(s);
9439 #endif /* NPFSYNC */
9440 r = s->rule.ptr;
9441 a = s->anchor.ptr;
9442 log = s->log;
9443 } else if (s == NULL)
9444 action = pf_test_rule(&r, &s, dir, kif, m, off, h,
9445 &pd, &a, &ruleset, NULL);
9446 break;
9447 }
9448
9449 done:
9450 if (action == PF_NAT64) {
9451 *m0 = NULL;
9452 return (action);
9453 }
9454
9455 *m0 = pd.mp;
9456 PF_APPLE_UPDATE_PDESC_IPv4();
9457
9458 if (action != PF_DROP) {
9459 if (action == PF_PASS && h->ip_hl > 5 &&
9460 !((s && s->allow_opts) || r->allow_opts)) {
9461 action = PF_DROP;
9462 REASON_SET(&reason, PFRES_IPOPTIONS);
9463 log = 1;
9464 DPFPRINTF(PF_DEBUG_MISC,
9465 ("pf: dropping packet with ip options [hlen=%u]\n",
9466 (unsigned int) h->ip_hl));
9467 }
9468
9469 if ((s && s->tag) || PF_RTABLEID_IS_VALID(r->rtableid) ||
9470 (pd.pktflags & PKTF_FLOW_ID))
9471 (void) pf_tag_packet(m, pd.pf_mtag, s ? s->tag : 0,
9472 r->rtableid, &pd);
9473
9474 if (action == PF_PASS) {
9475 #if PF_ALTQ
9476 if (altq_allowed && r->qid) {
9477 if (pqid || (pd.tos & IPTOS_LOWDELAY))
9478 pd.pf_mtag->pftag_qid = r->pqid;
9479 else
9480 pd.pf_mtag->pftag_qid = r->qid;
9481 }
9482 #endif /* PF_ALTQ */
9483 #if PF_ECN
9484 /* add hints for ecn */
9485 pd.pf_mtag->pftag_hdr = h;
9486 /* record address family */
9487 pd.pf_mtag->pftag_flags &= ~PF_TAG_HDR_INET6;
9488 pd.pf_mtag->pftag_flags |= PF_TAG_HDR_INET;
9489 #endif /* PF_ECN */
9490 /* record protocol */
9491 m->m_pkthdr.pkt_proto = pd.proto;
9492
9493 /*
9494 * connections redirected to loopback should not match sockets
9495 * bound specifically to loopback due to security implications,
9496 * see tcp_input() and in_pcblookup_listen().
9497 */
9498 if (dir == PF_IN && (pd.proto == IPPROTO_TCP ||
9499 pd.proto == IPPROTO_UDP) && s != NULL &&
9500 s->nat_rule.ptr != NULL &&
9501 (s->nat_rule.ptr->action == PF_RDR ||
9502 s->nat_rule.ptr->action == PF_BINAT) &&
9503 (ntohl(pd.dst->v4.s_addr) >> IN_CLASSA_NSHIFT)
9504 == IN_LOOPBACKNET)
9505 pd.pf_mtag->pftag_flags |= PF_TAG_TRANSLATE_LOCALHOST;
9506 }
9507 }
9508
9509 if (log) {
9510 struct pf_rule *lr;
9511
9512 if (s != NULL && s->nat_rule.ptr != NULL &&
9513 s->nat_rule.ptr->log & PF_LOG_ALL)
9514 lr = s->nat_rule.ptr;
9515 else
9516 lr = r;
9517 PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, lr, a, ruleset,
9518 &pd);
9519 }
9520
9521 kif->pfik_bytes[0][dir == PF_OUT][action != PF_PASS] += pd.tot_len;
9522 kif->pfik_packets[0][dir == PF_OUT][action != PF_PASS]++;
9523
9524 if (action == PF_PASS || r->action == PF_DROP) {
9525 dirndx = (dir == PF_OUT);
9526 r->packets[dirndx]++;
9527 r->bytes[dirndx] += pd.tot_len;
9528 if (a != NULL) {
9529 a->packets[dirndx]++;
9530 a->bytes[dirndx] += pd.tot_len;
9531 }
9532 if (s != NULL) {
9533 sk = s->state_key;
9534 if (s->nat_rule.ptr != NULL) {
9535 s->nat_rule.ptr->packets[dirndx]++;
9536 s->nat_rule.ptr->bytes[dirndx] += pd.tot_len;
9537 }
9538 if (s->src_node != NULL) {
9539 s->src_node->packets[dirndx]++;
9540 s->src_node->bytes[dirndx] += pd.tot_len;
9541 }
9542 if (s->nat_src_node != NULL) {
9543 s->nat_src_node->packets[dirndx]++;
9544 s->nat_src_node->bytes[dirndx] += pd.tot_len;
9545 }
9546 dirndx = (dir == sk->direction) ? 0 : 1;
9547 s->packets[dirndx]++;
9548 s->bytes[dirndx] += pd.tot_len;
9549 }
9550 tr = r;
9551 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule;
9552 if (nr != NULL) {
9553 struct pf_addr *x;
9554 /*
9555 * XXX: we need to make sure that the addresses
9556 * passed to pfr_update_stats() are the same than
9557 * the addresses used during matching (pfr_match)
9558 */
9559 if (r == &pf_default_rule) {
9560 tr = nr;
9561 x = (sk == NULL || sk->direction == dir) ?
9562 &pd.baddr : &pd.naddr;
9563 } else
9564 x = (sk == NULL || sk->direction == dir) ?
9565 &pd.naddr : &pd.baddr;
9566 if (x == &pd.baddr || s == NULL) {
9567 /* we need to change the address */
9568 if (dir == PF_OUT)
9569 pd.src = x;
9570 else
9571 pd.dst = x;
9572 }
9573 }
9574 if (tr->src.addr.type == PF_ADDR_TABLE)
9575 pfr_update_stats(tr->src.addr.p.tbl, (sk == NULL ||
9576 sk->direction == dir) ?
9577 pd.src : pd.dst, pd.af,
9578 pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
9579 tr->src.neg);
9580 if (tr->dst.addr.type == PF_ADDR_TABLE)
9581 pfr_update_stats(tr->dst.addr.p.tbl, (sk == NULL ||
9582 sk->direction == dir) ? pd.dst : pd.src, pd.af,
9583 pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
9584 tr->dst.neg);
9585 }
9586
9587 VERIFY(m == NULL || pd.mp == NULL || pd.mp == m);
9588
9589 if (*m0) {
9590 if (pd.lmw < 0) {
9591 REASON_SET(&reason, PFRES_MEMORY);
9592 action = PF_DROP;
9593 }
9594
9595 if (action == PF_DROP) {
9596 m_freem(*m0);
9597 *m0 = NULL;
9598 return (PF_DROP);
9599 }
9600
9601 *m0 = m;
9602 }
9603
9604 if (action == PF_SYNPROXY_DROP) {
9605 m_freem(*m0);
9606 *m0 = NULL;
9607 action = PF_PASS;
9608 } else if (r->rt)
9609 /* pf_route can free the mbuf causing *m0 to become NULL */
9610 pf_route(m0, r, dir, kif->pfik_ifp, s, &pd);
9611
9612 return (action);
9613 }
9614 #endif /* INET */
9615
9616 #if INET6
9617 #define PF_APPLE_UPDATE_PDESC_IPv6() \
9618 do { \
9619 if (m && pd.mp && m != pd.mp) { \
9620 if (n == m) \
9621 n = pd.mp; \
9622 m = pd.mp; \
9623 h = mtod(m, struct ip6_hdr *); \
9624 } \
9625 } while (0)
9626
9627 int
9628 pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0,
9629 struct ether_header *eh, struct ip_fw_args *fwa)
9630 {
9631 #if !DUMMYNET
9632 #pragma unused(fwa)
9633 #endif
9634 struct pfi_kif *kif;
9635 u_short action = PF_PASS, reason = 0, log = 0;
9636 struct mbuf *m = *m0, *n = NULL;
9637 struct ip6_hdr *h;
9638 struct pf_rule *a = NULL, *r = &pf_default_rule, *tr, *nr;
9639 struct pf_state *s = NULL;
9640 struct pf_state_key *sk = NULL;
9641 struct pf_ruleset *ruleset = NULL;
9642 struct pf_pdesc pd;
9643 int off, terminal = 0, dirndx, rh_cnt = 0;
9644 u_int8_t nxt;
9645
9646 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
9647
9648 if (!pf_status.running)
9649 return (PF_PASS);
9650
9651 memset(&pd, 0, sizeof (pd));
9652
9653 if ((pd.pf_mtag = pf_get_mtag(m)) == NULL) {
9654 DPFPRINTF(PF_DEBUG_URGENT,
9655 ("pf_test6: pf_get_mtag returned NULL\n"));
9656 return (PF_DROP);
9657 }
9658
9659 if (pd.pf_mtag->pftag_flags & PF_TAG_GENERATED)
9660 return (PF_PASS);
9661
9662 kif = (struct pfi_kif *)ifp->if_pf_kif;
9663
9664 if (kif == NULL) {
9665 DPFPRINTF(PF_DEBUG_URGENT,
9666 ("pf_test6: kif == NULL, if_name %s\n", ifp->if_name));
9667 return (PF_DROP);
9668 }
9669 if (kif->pfik_flags & PFI_IFLAG_SKIP)
9670 return (PF_PASS);
9671
9672 VERIFY(m->m_flags & M_PKTHDR);
9673
9674 h = mtod(m, struct ip6_hdr *);
9675
9676 nxt = h->ip6_nxt;
9677 off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
9678 pd.mp = m;
9679 pd.lmw = 0;
9680 pd.pf_mtag = pf_get_mtag(m);
9681 pd.src = (struct pf_addr *)&h->ip6_src;
9682 pd.dst = (struct pf_addr *)&h->ip6_dst;
9683 PF_ACPY(&pd.baddr, pd.src, AF_INET6);
9684 PF_ACPY(&pd.bdaddr, pd.dst, AF_INET6);
9685 pd.ip_sum = NULL;
9686 pd.af = AF_INET6;
9687 pd.proto = nxt;
9688 pd.proto_variant = 0;
9689 pd.tos = 0;
9690 pd.ttl = h->ip6_hlim;
9691 pd.sc = MBUF_SCIDX(mbuf_get_service_class(m));
9692 pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
9693 pd.eh = eh;
9694
9695 if (m->m_pkthdr.pkt_flags & PKTF_FLOW_ID) {
9696 pd.flowsrc = m->m_pkthdr.pkt_flowsrc;
9697 pd.flowhash = m->m_pkthdr.pkt_flowid;
9698 pd.pktflags = (m->m_pkthdr.pkt_flags & PKTF_FLOW_MASK);
9699 }
9700
9701 if (m->m_pkthdr.len < (int)sizeof (*h)) {
9702 action = PF_DROP;
9703 REASON_SET(&reason, PFRES_SHORT);
9704 log = 1;
9705 goto done;
9706 }
9707
9708 #if DUMMYNET
9709 if (fwa != NULL && fwa->fwa_pf_rule != NULL)
9710 goto nonormalize;
9711 #endif /* DUMMYNET */
9712
9713 /* We do IP header normalization and packet reassembly here */
9714 action = pf_normalize_ip6(m0, dir, kif, &reason, &pd);
9715 pd.mp = m = *m0;
9716 if (action != PF_PASS || pd.lmw < 0) {
9717 action = PF_DROP;
9718 goto done;
9719 }
9720
9721 #if DUMMYNET
9722 nonormalize:
9723 #endif /* DUMMYNET */
9724 h = mtod(m, struct ip6_hdr *);
9725
9726 #if 1
9727 /*
9728 * we do not support jumbogram yet. if we keep going, zero ip6_plen
9729 * will do something bad, so drop the packet for now.
9730 */
9731 if (htons(h->ip6_plen) == 0) {
9732 action = PF_DROP;
9733 REASON_SET(&reason, PFRES_NORM); /*XXX*/
9734 goto done;
9735 }
9736 #endif
9737
9738 pd.src = (struct pf_addr *)&h->ip6_src;
9739 pd.dst = (struct pf_addr *)&h->ip6_dst;
9740 PF_ACPY(&pd.baddr, pd.src, AF_INET6);
9741 PF_ACPY(&pd.bdaddr, pd.dst, AF_INET6);
9742 pd.ip_sum = NULL;
9743 pd.af = AF_INET6;
9744 pd.tos = 0;
9745 pd.ttl = h->ip6_hlim;
9746 pd.tot_len = ntohs(h->ip6_plen) + sizeof (struct ip6_hdr);
9747 pd.eh = eh;
9748
9749 off = ((caddr_t)h - m->m_data) + sizeof (struct ip6_hdr);
9750 pd.proto = h->ip6_nxt;
9751 pd.proto_variant = 0;
9752 pd.mp = m;
9753 pd.lmw = 0;
9754 pd.pf_mtag = pf_get_mtag(m);
9755
9756 do {
9757 switch (nxt) {
9758 case IPPROTO_FRAGMENT: {
9759 struct ip6_frag ip6f;
9760
9761 pd.flags |= PFDESC_IP_FRAG;
9762 if (!pf_pull_hdr(m, off, &ip6f, sizeof ip6f, NULL,
9763 &reason, pd.af)) {
9764 DPFPRINTF(PF_DEBUG_MISC,
9765 ("pf: IPv6 short fragment header\n"));
9766 action = PF_DROP;
9767 REASON_SET(&reason, PFRES_SHORT);
9768 log = 1;
9769 goto done;
9770 }
9771 pd.proto = nxt = ip6f.ip6f_nxt;
9772 #if DUMMYNET
9773 /* Traffic goes through dummynet first */
9774 action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
9775 if (action == PF_DROP || m == NULL) {
9776 *m0 = NULL;
9777 return (action);
9778 }
9779 #endif /* DUMMYNET */
9780 action = pf_test_fragment(&r, dir, kif, m, h, &pd, &a,
9781 &ruleset);
9782 if (action == PF_DROP) {
9783 REASON_SET(&reason, PFRES_FRAG);
9784 log = 1;
9785 }
9786 goto done;
9787 }
9788 case IPPROTO_ROUTING:
9789 ++rh_cnt;
9790 /* FALL THROUGH */
9791
9792 case IPPROTO_AH:
9793 case IPPROTO_HOPOPTS:
9794 case IPPROTO_DSTOPTS: {
9795 /* get next header and header length */
9796 struct ip6_ext opt6;
9797
9798 if (!pf_pull_hdr(m, off, &opt6, sizeof(opt6),
9799 NULL, &reason, pd.af)) {
9800 DPFPRINTF(PF_DEBUG_MISC,
9801 ("pf: IPv6 short opt\n"));
9802 action = PF_DROP;
9803 log = 1;
9804 goto done;
9805 }
9806 if (pd.proto == IPPROTO_AH)
9807 off += (opt6.ip6e_len + 2) * 4;
9808 else
9809 off += (opt6.ip6e_len + 1) * 8;
9810 nxt = opt6.ip6e_nxt;
9811 /* goto the next header */
9812 break;
9813 }
9814 default:
9815 terminal++;
9816 break;
9817 }
9818 } while (!terminal);
9819
9820 /* if there's no routing header, use unmodified mbuf for checksumming */
9821 if (!n)
9822 n = m;
9823
9824 switch (pd.proto) {
9825
9826 case IPPROTO_TCP: {
9827 struct tcphdr th;
9828
9829 pd.hdr.tcp = &th;
9830 if (!pf_pull_hdr(m, off, &th, sizeof (th),
9831 &action, &reason, AF_INET6)) {
9832 log = action != PF_PASS;
9833 goto done;
9834 }
9835 pd.p_len = pd.tot_len - off - (th.th_off << 2);
9836 #if DUMMYNET
9837 /* Traffic goes through dummynet first */
9838 action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
9839 if (action == PF_DROP || m == NULL) {
9840 *m0 = NULL;
9841 return (action);
9842 }
9843 #endif /* DUMMYNET */
9844 action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
9845 if (pd.lmw < 0)
9846 goto done;
9847 PF_APPLE_UPDATE_PDESC_IPv6();
9848 if (action == PF_DROP)
9849 goto done;
9850 action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd,
9851 &reason);
9852 if (action == PF_NAT64)
9853 goto done;
9854 if (pd.lmw < 0)
9855 goto done;
9856 PF_APPLE_UPDATE_PDESC_IPv6();
9857 if (action == PF_PASS) {
9858 #if NPFSYNC
9859 pfsync_update_state(s);
9860 #endif /* NPFSYNC */
9861 r = s->rule.ptr;
9862 a = s->anchor.ptr;
9863 log = s->log;
9864 } else if (s == NULL)
9865 action = pf_test_rule(&r, &s, dir, kif,
9866 m, off, h, &pd, &a, &ruleset, NULL);
9867 break;
9868 }
9869
9870 case IPPROTO_UDP: {
9871 struct udphdr uh;
9872
9873 pd.hdr.udp = &uh;
9874 if (!pf_pull_hdr(m, off, &uh, sizeof (uh),
9875 &action, &reason, AF_INET6)) {
9876 log = action != PF_PASS;
9877 goto done;
9878 }
9879 if (uh.uh_dport == 0 ||
9880 ntohs(uh.uh_ulen) > m->m_pkthdr.len - off ||
9881 ntohs(uh.uh_ulen) < sizeof (struct udphdr)) {
9882 action = PF_DROP;
9883 REASON_SET(&reason, PFRES_SHORT);
9884 goto done;
9885 }
9886 #if DUMMYNET
9887 /* Traffic goes through dummynet first */
9888 action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
9889 if (action == PF_DROP || m == NULL) {
9890 *m0 = NULL;
9891 return (action);
9892 }
9893 #endif /* DUMMYNET */
9894 action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd,
9895 &reason);
9896 if (action == PF_NAT64)
9897 goto done;
9898 if (pd.lmw < 0)
9899 goto done;
9900 PF_APPLE_UPDATE_PDESC_IPv6();
9901 if (action == PF_PASS) {
9902 #if NPFSYNC
9903 pfsync_update_state(s);
9904 #endif /* NPFSYNC */
9905 r = s->rule.ptr;
9906 a = s->anchor.ptr;
9907 log = s->log;
9908 } else if (s == NULL)
9909 action = pf_test_rule(&r, &s, dir, kif,
9910 m, off, h, &pd, &a, &ruleset, NULL);
9911 break;
9912 }
9913
9914 case IPPROTO_ICMPV6: {
9915 struct icmp6_hdr ih;
9916
9917 pd.hdr.icmp6 = &ih;
9918 if (!pf_pull_hdr(m, off, &ih, sizeof (ih),
9919 &action, &reason, AF_INET6)) {
9920 log = action != PF_PASS;
9921 goto done;
9922 }
9923 #if DUMMYNET
9924 /* Traffic goes through dummynet first */
9925 action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
9926 if (action == PF_DROP || m == NULL) {
9927 *m0 = NULL;
9928 return (action);
9929 }
9930 #endif /* DUMMYNET */
9931 action = pf_test_state_icmp(&s, dir, kif,
9932 m, off, h, &pd, &reason);
9933 if (action == PF_NAT64)
9934 goto done;
9935 if (pd.lmw < 0)
9936 goto done;
9937 PF_APPLE_UPDATE_PDESC_IPv6();
9938 if (action == PF_PASS) {
9939 #if NPFSYNC
9940 pfsync_update_state(s);
9941 #endif /* NPFSYNC */
9942 r = s->rule.ptr;
9943 a = s->anchor.ptr;
9944 log = s->log;
9945 } else if (s == NULL)
9946 action = pf_test_rule(&r, &s, dir, kif,
9947 m, off, h, &pd, &a, &ruleset, NULL);
9948 break;
9949 }
9950
9951 case IPPROTO_ESP: {
9952 struct pf_esp_hdr esp;
9953
9954 pd.hdr.esp = &esp;
9955 if (!pf_pull_hdr(m, off, &esp, sizeof (esp), &action, &reason,
9956 AF_INET6)) {
9957 log = action != PF_PASS;
9958 goto done;
9959 }
9960 #if DUMMYNET
9961 /* Traffic goes through dummynet first */
9962 action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
9963 if (action == PF_DROP || m == NULL) {
9964 *m0 = NULL;
9965 return (action);
9966 }
9967 #endif /* DUMMYNET */
9968 action = pf_test_state_esp(&s, dir, kif, off, &pd);
9969 if (pd.lmw < 0)
9970 goto done;
9971 PF_APPLE_UPDATE_PDESC_IPv6();
9972 if (action == PF_PASS) {
9973 #if NPFSYNC
9974 pfsync_update_state(s);
9975 #endif /* NPFSYNC */
9976 r = s->rule.ptr;
9977 a = s->anchor.ptr;
9978 log = s->log;
9979 } else if (s == NULL)
9980 action = pf_test_rule(&r, &s, dir, kif,
9981 m, off, h, &pd, &a, &ruleset, NULL);
9982 break;
9983 }
9984
9985 case IPPROTO_GRE: {
9986 struct pf_grev1_hdr grev1;
9987
9988 pd.hdr.grev1 = &grev1;
9989 if (!pf_pull_hdr(m, off, &grev1, sizeof (grev1), &action,
9990 &reason, AF_INET6)) {
9991 log = (action != PF_PASS);
9992 goto done;
9993 }
9994 #if DUMMYNET
9995 /* Traffic goes through dummynet first */
9996 action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
9997 if (action == PF_DROP || m == NULL) {
9998 *m0 = NULL;
9999 return (action);
10000 }
10001 #endif /* DUMMYNET */
10002 if ((ntohs(grev1.flags) & PF_GRE_FLAG_VERSION_MASK) == 1 &&
10003 ntohs(grev1.protocol_type) == PF_GRE_PPP_ETHERTYPE) {
10004 if (ntohs(grev1.payload_length) >
10005 m->m_pkthdr.len - off) {
10006 action = PF_DROP;
10007 REASON_SET(&reason, PFRES_SHORT);
10008 goto done;
10009 }
10010 action = pf_test_state_grev1(&s, dir, kif, off, &pd);
10011 if (pd.lmw < 0)
10012 goto done;
10013 PF_APPLE_UPDATE_PDESC_IPv6();
10014 if (action == PF_PASS) {
10015 #if NPFSYNC
10016 pfsync_update_state(s);
10017 #endif /* NPFSYNC */
10018 r = s->rule.ptr;
10019 a = s->anchor.ptr;
10020 log = s->log;
10021 break;
10022 } else if (s == NULL) {
10023 action = pf_test_rule(&r, &s, dir, kif, m, off,
10024 h, &pd, &a, &ruleset, NULL);
10025 if (action == PF_PASS)
10026 break;
10027 }
10028 }
10029
10030 /* not GREv1/PPTP, so treat as ordinary GRE... */
10031 }
10032
10033 default:
10034 #if DUMMYNET
10035 /* Traffic goes through dummynet first */
10036 action = pf_test_dummynet(&r, dir, kif, &m, &pd, fwa);
10037 if (action == PF_DROP || m == NULL) {
10038 *m0 = NULL;
10039 return (action);
10040 }
10041 #endif /* DUMMYNET */
10042 action = pf_test_state_other(&s, dir, kif, &pd);
10043 if (pd.lmw < 0)
10044 goto done;
10045 PF_APPLE_UPDATE_PDESC_IPv6();
10046 if (action == PF_PASS) {
10047 #if NPFSYNC
10048 pfsync_update_state(s);
10049 #endif /* NPFSYNC */
10050 r = s->rule.ptr;
10051 a = s->anchor.ptr;
10052 log = s->log;
10053 } else if (s == NULL)
10054 action = pf_test_rule(&r, &s, dir, kif, m, off, h,
10055 &pd, &a, &ruleset, NULL);
10056 break;
10057 }
10058
10059 done:
10060 if (action == PF_NAT64) {
10061 *m0 = NULL;
10062 return (action);
10063 }
10064
10065 *m0 = pd.mp;
10066 PF_APPLE_UPDATE_PDESC_IPv6();
10067
10068 if (n != m) {
10069 m_freem(n);
10070 n = NULL;
10071 }
10072
10073 /* handle dangerous IPv6 extension headers. */
10074 if (action != PF_DROP) {
10075 if (action == PF_PASS && rh_cnt &&
10076 !((s && s->allow_opts) || r->allow_opts)) {
10077 action = PF_DROP;
10078 REASON_SET(&reason, PFRES_IPOPTIONS);
10079 log = 1;
10080 DPFPRINTF(PF_DEBUG_MISC,
10081 ("pf: dropping packet with dangerous v6 headers\n"));
10082 }
10083
10084 if ((s && s->tag) || PF_RTABLEID_IS_VALID(r->rtableid) ||
10085 (pd.pktflags & PKTF_FLOW_ID))
10086 (void) pf_tag_packet(m, pd.pf_mtag, s ? s->tag : 0,
10087 r->rtableid, &pd);
10088
10089 if (action == PF_PASS) {
10090 #if PF_ALTQ
10091 if (altq_allowed && r->qid) {
10092 if (pd.tos & IPTOS_LOWDELAY)
10093 pd.pf_mtag->pftag_qid = r->pqid;
10094 else
10095 pd.pf_mtag->pftag_qid = r->qid;
10096 }
10097 #endif /* PF_ALTQ */
10098 #if PF_ECN
10099 /* add hints for ecn */
10100 pd.pf_mtag->pftag_hdr = h;
10101 /* record address family */
10102 pd.pf_mtag->pftag_flags &= ~PF_TAG_HDR_INET;
10103 pd.pf_mtag->pftag_flags |= PF_TAG_HDR_INET6;
10104 #endif /* PF_ECN */
10105 /* record protocol */
10106 m->m_pkthdr.pkt_proto = pd.proto;
10107 if (dir == PF_IN && (pd.proto == IPPROTO_TCP ||
10108 pd.proto == IPPROTO_UDP) && s != NULL &&
10109 s->nat_rule.ptr != NULL &&
10110 (s->nat_rule.ptr->action == PF_RDR ||
10111 s->nat_rule.ptr->action == PF_BINAT) &&
10112 IN6_IS_ADDR_LOOPBACK(&pd.dst->v6))
10113 pd.pf_mtag->pftag_flags |= PF_TAG_TRANSLATE_LOCALHOST;
10114 }
10115 }
10116
10117
10118 if (log) {
10119 struct pf_rule *lr;
10120
10121 if (s != NULL && s->nat_rule.ptr != NULL &&
10122 s->nat_rule.ptr->log & PF_LOG_ALL)
10123 lr = s->nat_rule.ptr;
10124 else
10125 lr = r;
10126 PFLOG_PACKET(kif, h, m, AF_INET6, dir, reason, lr, a, ruleset,
10127 &pd);
10128 }
10129
10130 kif->pfik_bytes[1][dir == PF_OUT][action != PF_PASS] += pd.tot_len;
10131 kif->pfik_packets[1][dir == PF_OUT][action != PF_PASS]++;
10132
10133 if (action == PF_PASS || r->action == PF_DROP) {
10134 dirndx = (dir == PF_OUT);
10135 r->packets[dirndx]++;
10136 r->bytes[dirndx] += pd.tot_len;
10137 if (a != NULL) {
10138 a->packets[dirndx]++;
10139 a->bytes[dirndx] += pd.tot_len;
10140 }
10141 if (s != NULL) {
10142 sk = s->state_key;
10143 if (s->nat_rule.ptr != NULL) {
10144 s->nat_rule.ptr->packets[dirndx]++;
10145 s->nat_rule.ptr->bytes[dirndx] += pd.tot_len;
10146 }
10147 if (s->src_node != NULL) {
10148 s->src_node->packets[dirndx]++;
10149 s->src_node->bytes[dirndx] += pd.tot_len;
10150 }
10151 if (s->nat_src_node != NULL) {
10152 s->nat_src_node->packets[dirndx]++;
10153 s->nat_src_node->bytes[dirndx] += pd.tot_len;
10154 }
10155 dirndx = (dir == sk->direction) ? 0 : 1;
10156 s->packets[dirndx]++;
10157 s->bytes[dirndx] += pd.tot_len;
10158 }
10159 tr = r;
10160 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule;
10161 if (nr != NULL) {
10162 struct pf_addr *x;
10163 /*
10164 * XXX: we need to make sure that the addresses
10165 * passed to pfr_update_stats() are the same than
10166 * the addresses used during matching (pfr_match)
10167 */
10168 if (r == &pf_default_rule) {
10169 tr = nr;
10170 x = (s == NULL || sk->direction == dir) ?
10171 &pd.baddr : &pd.naddr;
10172 } else {
10173 x = (s == NULL || sk->direction == dir) ?
10174 &pd.naddr : &pd.baddr;
10175 }
10176 if (x == &pd.baddr || s == NULL) {
10177 if (dir == PF_OUT)
10178 pd.src = x;
10179 else
10180 pd.dst = x;
10181 }
10182 }
10183 if (tr->src.addr.type == PF_ADDR_TABLE)
10184 pfr_update_stats(tr->src.addr.p.tbl, (sk == NULL ||
10185 sk->direction == dir) ? pd.src : pd.dst, pd.af,
10186 pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
10187 tr->src.neg);
10188 if (tr->dst.addr.type == PF_ADDR_TABLE)
10189 pfr_update_stats(tr->dst.addr.p.tbl, (sk == NULL ||
10190 sk->direction == dir) ? pd.dst : pd.src, pd.af,
10191 pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
10192 tr->dst.neg);
10193 }
10194
10195 #if 0
10196 if (action == PF_SYNPROXY_DROP) {
10197 m_freem(*m0);
10198 *m0 = NULL;
10199 action = PF_PASS;
10200 } else if (r->rt)
10201 /* pf_route6 can free the mbuf causing *m0 to become NULL */
10202 pf_route6(m0, r, dir, kif->pfik_ifp, s, &pd);
10203 #else
10204 VERIFY(m == NULL || pd.mp == NULL || pd.mp == m);
10205
10206 if (*m0) {
10207 if (pd.lmw < 0) {
10208 REASON_SET(&reason, PFRES_MEMORY);
10209 action = PF_DROP;
10210 }
10211
10212 if (action == PF_DROP) {
10213 m_freem(*m0);
10214 *m0 = NULL;
10215 return (PF_DROP);
10216 }
10217
10218 *m0 = m;
10219 }
10220
10221 if (action == PF_SYNPROXY_DROP) {
10222 m_freem(*m0);
10223 *m0 = NULL;
10224 action = PF_PASS;
10225 } else if (r->rt) {
10226 if (action == PF_PASS) {
10227 m = *m0;
10228 h = mtod(m, struct ip6_hdr *);
10229 }
10230
10231 /* pf_route6 can free the mbuf causing *m0 to become NULL */
10232 pf_route6(m0, r, dir, kif->pfik_ifp, s, &pd);
10233 }
10234 #endif /* 0 */
10235
10236 return (action);
10237 }
10238 #endif /* INET6 */
10239
10240 static int
10241 pf_check_congestion(struct ifqueue *ifq)
10242 {
10243 #pragma unused(ifq)
10244 return (0);
10245 }
10246
10247 void
10248 pool_init(struct pool *pp, size_t size, unsigned int align, unsigned int ioff,
10249 int flags, const char *wchan, void *palloc)
10250 {
10251 #pragma unused(align, ioff, flags, palloc)
10252 bzero(pp, sizeof (*pp));
10253 pp->pool_zone = zinit(size, 1024 * size, PAGE_SIZE, wchan);
10254 if (pp->pool_zone != NULL) {
10255 zone_change(pp->pool_zone, Z_EXPAND, TRUE);
10256 zone_change(pp->pool_zone, Z_CALLERACCT, FALSE);
10257 pp->pool_hiwat = pp->pool_limit = (unsigned int)-1;
10258 pp->pool_name = wchan;
10259 }
10260 }
10261
10262 /* Zones cannot be currently destroyed */
10263 void
10264 pool_destroy(struct pool *pp)
10265 {
10266 #pragma unused(pp)
10267 }
10268
10269 void
10270 pool_sethiwat(struct pool *pp, int n)
10271 {
10272 pp->pool_hiwat = n; /* Currently unused */
10273 }
10274
10275 void
10276 pool_sethardlimit(struct pool *pp, int n, const char *warnmess, int ratecap)
10277 {
10278 #pragma unused(warnmess, ratecap)
10279 pp->pool_limit = n;
10280 }
10281
10282 void *
10283 pool_get(struct pool *pp, int flags)
10284 {
10285 void *buf;
10286
10287 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
10288
10289 if (pp->pool_count > pp->pool_limit) {
10290 DPFPRINTF(PF_DEBUG_NOISY,
10291 ("pf: pool %s hard limit reached (%d)\n",
10292 pp->pool_name != NULL ? pp->pool_name : "unknown",
10293 pp->pool_limit));
10294 pp->pool_fails++;
10295 return (NULL);
10296 }
10297
10298 buf = zalloc_canblock(pp->pool_zone, (flags & (PR_NOWAIT | PR_WAITOK)));
10299 if (buf != NULL) {
10300 pp->pool_count++;
10301 VERIFY(pp->pool_count != 0);
10302 }
10303 return (buf);
10304 }
10305
10306 void
10307 pool_put(struct pool *pp, void *v)
10308 {
10309 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
10310
10311 zfree(pp->pool_zone, v);
10312 VERIFY(pp->pool_count != 0);
10313 pp->pool_count--;
10314 }
10315
10316 struct pf_mtag *
10317 pf_find_mtag(struct mbuf *m)
10318 {
10319 if (!(m->m_flags & M_PKTHDR))
10320 return (NULL);
10321
10322 return (m_pftag(m));
10323 }
10324
10325 struct pf_mtag *
10326 pf_get_mtag(struct mbuf *m)
10327 {
10328 return (pf_find_mtag(m));
10329 }
10330
10331 uint64_t
10332 pf_time_second(void)
10333 {
10334 struct timeval t;
10335
10336 microuptime(&t);
10337 return (t.tv_sec);
10338 }
10339
10340 uint64_t
10341 pf_calendar_time_second(void)
10342 {
10343 struct timeval t;
10344
10345 getmicrotime(&t);
10346 return (t.tv_sec);
10347 }
10348
10349 static void *
10350 hook_establish(struct hook_desc_head *head, int tail, hook_fn_t fn, void *arg)
10351 {
10352 struct hook_desc *hd;
10353
10354 hd = _MALLOC(sizeof(*hd), M_DEVBUF, M_WAITOK);
10355 if (hd == NULL)
10356 return (NULL);
10357
10358 hd->hd_fn = fn;
10359 hd->hd_arg = arg;
10360 if (tail)
10361 TAILQ_INSERT_TAIL(head, hd, hd_list);
10362 else
10363 TAILQ_INSERT_HEAD(head, hd, hd_list);
10364
10365 return (hd);
10366 }
10367
10368 static void
10369 hook_runloop(struct hook_desc_head *head, int flags)
10370 {
10371 struct hook_desc *hd;
10372
10373 if (!(flags & HOOK_REMOVE)) {
10374 if (!(flags & HOOK_ABORT))
10375 TAILQ_FOREACH(hd, head, hd_list)
10376 hd->hd_fn(hd->hd_arg);
10377 } else {
10378 while (!!(hd = TAILQ_FIRST(head))) {
10379 TAILQ_REMOVE(head, hd, hd_list);
10380 if (!(flags & HOOK_ABORT))
10381 hd->hd_fn(hd->hd_arg);
10382 if (flags & HOOK_FREE)
10383 _FREE(hd, M_DEVBUF);
10384 }
10385 }
10386 }
mirror of XNU