]> git.saurik.com Git - apple/xnu.git/blob - bsd/net/pf.c
projects / apple / xnu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
xnu-6153.11.26.tar.gz
[apple/xnu.git] / bsd / net / pf.c
1 /*
2 * Copyright (c) 2007-2019 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 /* $apfw: git commit 6602420f2f101b74305cd78f7cd9e0c8fdedae97 $ */
30 /* $OpenBSD: pf.c,v 1.567 2008/02/20 23:40:13 henning Exp $ */
31
32 /*
33 * Copyright (c) 2001 Daniel Hartmeier
34 * Copyright (c) 2002 - 2013 Henning Brauer
35 * NAT64 - Copyright (c) 2010 Viagenie Inc. (http://www.viagenie.ca)
36 * All rights reserved.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 *
42 * - Redistributions of source code must retain the above copyright
43 * notice, this list of conditions and the following disclaimer.
44 * - Redistributions in binary form must reproduce the above
45 * copyright notice, this list of conditions and the following
46 * disclaimer in the documentation and/or other materials provided
47 * with the distribution.
48 *
49 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
50 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
51 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
52 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
53 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
54 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
55 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
56 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
57 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
58 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
59 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
60 * POSSIBILITY OF SUCH DAMAGE.
61 *
62 * Effort sponsored in part by the Defense Advanced Research Projects
63 * Agency (DARPA) and Air Force Research Laboratory, Air Force
64 * Materiel Command, USAF, under agreement number F30602-01-2-0537.
65 *
66 */
67
68 #include <machine/endian.h>
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/filio.h>
72 #include <sys/socket.h>
73 #include <sys/socketvar.h>
74 #include <sys/kernel.h>
75 #include <sys/time.h>
76 #include <sys/proc.h>
77 #include <sys/random.h>
78 #include <sys/mcache.h>
79 #include <sys/protosw.h>
80
81 #include <libkern/crypto/md5.h>
82 #include <libkern/libkern.h>
83
84 #include <mach/thread_act.h>
85
86 #include <net/if.h>
87 #include <net/if_types.h>
88 #include <net/bpf.h>
89 #include <net/route.h>
90 #include <net/dlil.h>
91
92 #include <netinet/in.h>
93 #include <netinet/in_var.h>
94 #include <netinet/in_systm.h>
95 #include <netinet/ip.h>
96 #include <netinet/ip_var.h>
97 #include <netinet/tcp.h>
98 #include <netinet/tcp_seq.h>
99 #include <netinet/udp.h>
100 #include <netinet/ip_icmp.h>
101 #include <netinet/in_pcb.h>
102 #include <netinet/tcp_timer.h>
103 #include <netinet/tcp_var.h>
104 #include <netinet/tcp_fsm.h>
105 #include <netinet/udp_var.h>
106 #include <netinet/icmp_var.h>
107 #include <net/if_ether.h>
108 #include <net/ethernet.h>
109 #include <net/flowhash.h>
110 #include <net/nat464_utils.h>
111 #include <net/pfvar.h>
112 #include <net/if_pflog.h>
113
114 #if NPFSYNC
115 #include <net/if_pfsync.h>
116 #endif /* NPFSYNC */
117
118 #if INET6
119 #include <netinet/ip6.h>
120 #include <netinet6/in6_pcb.h>
121 #include <netinet6/ip6_var.h>
122 #include <netinet/icmp6.h>
123 #include <netinet6/nd6.h>
124 #endif /* INET6 */
125
126 #if DUMMYNET
127 #include <netinet/ip_dummynet.h>
128 #endif /* DUMMYNET */
129
130 /*
131 * For RandomULong(), to get a 32 bits random value
132 * Note that random() returns a 31 bits value, see rdar://11159750
133 */
134 #include <dev/random/randomdev.h>
135
136 #define DPFPRINTF(n, x) (pf_status.debug >= (n) ? printf x : ((void)0))
137
138 /*
139 * On Mac OS X, the rtableid value is treated as the interface scope
140 * value that is equivalent to the interface index used for scoped
141 * routing. A valid scope value is anything but IFSCOPE_NONE (0),
142 * as per definition of ifindex which is a positive, non-zero number.
143 * The other BSDs treat a negative rtableid value as invalid, hence
144 * the test against INT_MAX to handle userland apps which initialize
145 * the field with a negative number.
146 */
147 #define PF_RTABLEID_IS_VALID(r) \
148 ((r) > IFSCOPE_NONE && (r) <= INT_MAX)
149
150 /*
151 * Global variables
152 */
153 decl_lck_mtx_data(, pf_lock_data);
154 decl_lck_rw_data(, pf_perim_lock_data);
155 lck_mtx_t *pf_lock = &pf_lock_data;
156 lck_rw_t *pf_perim_lock = &pf_perim_lock_data;
157
158 /* state tables */
159 struct pf_state_tree_lan_ext pf_statetbl_lan_ext;
160 struct pf_state_tree_ext_gwy pf_statetbl_ext_gwy;
161
162 struct pf_palist pf_pabuf;
163 struct pf_status pf_status;
164
165 u_int32_t ticket_pabuf;
166
167 static MD5_CTX pf_tcp_secret_ctx;
168 static u_char pf_tcp_secret[16];
169 static int pf_tcp_secret_init;
170 static int pf_tcp_iss_off;
171
172 static struct pf_anchor_stackframe {
173 struct pf_ruleset *rs;
174 struct pf_rule *r;
175 struct pf_anchor_node *parent;
176 struct pf_anchor *child;
177 } pf_anchor_stack[64];
178
179 struct pool pf_src_tree_pl, pf_rule_pl, pf_pooladdr_pl;
180 struct pool pf_state_pl, pf_state_key_pl;
181
182 typedef void (*hook_fn_t)(void *);
183
184 struct hook_desc {
185 TAILQ_ENTRY(hook_desc) hd_list;
186 hook_fn_t hd_fn;
187 void *hd_arg;
188 };
189
190 #define HOOK_REMOVE 0x01
191 #define HOOK_FREE 0x02
192 #define HOOK_ABORT 0x04
193
194 static void *hook_establish(struct hook_desc_head *, int,
195 hook_fn_t, void *);
196 static void hook_runloop(struct hook_desc_head *, int flags);
197
198 struct pool pf_app_state_pl;
199 static void pf_print_addr(struct pf_addr *addr, sa_family_t af);
200 static void pf_print_sk_host(struct pf_state_host *, u_int8_t, int,
201 u_int8_t);
202
203 static void pf_print_host(struct pf_addr *, u_int16_t, u_int8_t);
204
205 static void pf_init_threshold(struct pf_threshold *, u_int32_t,
206 u_int32_t);
207 static void pf_add_threshold(struct pf_threshold *);
208 static int pf_check_threshold(struct pf_threshold *);
209
210 static void pf_change_ap(int, pbuf_t *, struct pf_addr *,
211 u_int16_t *, u_int16_t *, u_int16_t *,
212 struct pf_addr *, u_int16_t, u_int8_t, sa_family_t,
213 sa_family_t, int);
214 static int pf_modulate_sack(pbuf_t *, int, struct pf_pdesc *,
215 struct tcphdr *, struct pf_state_peer *);
216 #if INET6
217 static void pf_change_a6(struct pf_addr *, u_int16_t *,
218 struct pf_addr *, u_int8_t);
219 void pf_change_addr(struct pf_addr *a, u_int16_t *c,
220 struct pf_addr *an, u_int8_t u,
221 sa_family_t af, sa_family_t afn);
222 #endif /* INET6 */
223 static void pf_change_icmp(struct pf_addr *, u_int16_t *,
224 struct pf_addr *, struct pf_addr *, u_int16_t,
225 u_int16_t *, u_int16_t *, u_int16_t *,
226 u_int16_t *, u_int8_t, sa_family_t);
227 static void pf_send_tcp(const struct pf_rule *, sa_family_t,
228 const struct pf_addr *, const struct pf_addr *,
229 u_int16_t, u_int16_t, u_int32_t, u_int32_t,
230 u_int8_t, u_int16_t, u_int16_t, u_int8_t, int,
231 u_int16_t, struct ether_header *, struct ifnet *);
232 static void pf_send_icmp(pbuf_t *, u_int8_t, u_int8_t,
233 sa_family_t, struct pf_rule *);
234 static struct pf_rule *pf_match_translation(struct pf_pdesc *, pbuf_t *,
235 int, int, struct pfi_kif *, struct pf_addr *,
236 union pf_state_xport *, struct pf_addr *,
237 union pf_state_xport *, int);
238 static struct pf_rule *pf_get_translation_aux(struct pf_pdesc *,
239 pbuf_t *, int, int, struct pfi_kif *,
240 struct pf_src_node **, struct pf_addr *,
241 union pf_state_xport *, struct pf_addr *,
242 union pf_state_xport *, union pf_state_xport *
243 );
244 static void pf_attach_state(struct pf_state_key *,
245 struct pf_state *, int);
246 static void pf_detach_state(struct pf_state *, int);
247 static u_int32_t pf_tcp_iss(struct pf_pdesc *);
248 static int pf_test_rule(struct pf_rule **, struct pf_state **,
249 int, struct pfi_kif *, pbuf_t *, int,
250 void *, struct pf_pdesc *, struct pf_rule **,
251 struct pf_ruleset **, struct ifqueue *);
252 #if DUMMYNET
253 static int pf_test_dummynet(struct pf_rule **, int,
254 struct pfi_kif *, pbuf_t **,
255 struct pf_pdesc *, struct ip_fw_args *);
256 #endif /* DUMMYNET */
257 static int pf_test_fragment(struct pf_rule **, int,
258 struct pfi_kif *, pbuf_t *, void *,
259 struct pf_pdesc *, struct pf_rule **,
260 struct pf_ruleset **);
261 static int pf_test_state_tcp(struct pf_state **, int,
262 struct pfi_kif *, pbuf_t *, int,
263 void *, struct pf_pdesc *, u_short *);
264 static int pf_test_state_udp(struct pf_state **, int,
265 struct pfi_kif *, pbuf_t *, int,
266 void *, struct pf_pdesc *, u_short *);
267 static int pf_test_state_icmp(struct pf_state **, int,
268 struct pfi_kif *, pbuf_t *, int,
269 void *, struct pf_pdesc *, u_short *);
270 static int pf_test_state_other(struct pf_state **, int,
271 struct pfi_kif *, struct pf_pdesc *);
272 static int pf_match_tag(struct pf_rule *,
273 struct pf_mtag *, int *);
274 static void pf_hash(struct pf_addr *, struct pf_addr *,
275 struct pf_poolhashkey *, sa_family_t);
276 static int pf_map_addr(u_int8_t, struct pf_rule *,
277 struct pf_addr *, struct pf_addr *,
278 struct pf_addr *, struct pf_src_node **);
279 static int pf_get_sport(struct pf_pdesc *, struct pfi_kif *,
280 struct pf_rule *, struct pf_addr *,
281 union pf_state_xport *, struct pf_addr *,
282 union pf_state_xport *, struct pf_addr *,
283 union pf_state_xport *, struct pf_src_node **
284 );
285 static void pf_route(pbuf_t **, struct pf_rule *, int,
286 struct ifnet *, struct pf_state *,
287 struct pf_pdesc *);
288 #if INET6
289 static void pf_route6(pbuf_t **, struct pf_rule *, int,
290 struct ifnet *, struct pf_state *,
291 struct pf_pdesc *);
292 #endif /* INET6 */
293 static u_int8_t pf_get_wscale(pbuf_t *, int, u_int16_t,
294 sa_family_t);
295 static u_int16_t pf_get_mss(pbuf_t *, int, u_int16_t,
296 sa_family_t);
297 static u_int16_t pf_calc_mss(struct pf_addr *, sa_family_t,
298 u_int16_t);
299 static void pf_set_rt_ifp(struct pf_state *,
300 struct pf_addr *, sa_family_t af);
301 static int pf_check_proto_cksum(pbuf_t *, int, int,
302 u_int8_t, sa_family_t);
303 static int pf_addr_wrap_neq(struct pf_addr_wrap *,
304 struct pf_addr_wrap *);
305 static struct pf_state *pf_find_state(struct pfi_kif *,
306 struct pf_state_key_cmp *, u_int);
307 static int pf_src_connlimit(struct pf_state **);
308 static void pf_stateins_err(const char *, struct pf_state *,
309 struct pfi_kif *);
310 static int pf_check_congestion(struct ifqueue *);
311
312 #if 0
313 static const char *pf_pptp_ctrl_type_name(u_int16_t code);
314 #endif
315 static void pf_pptp_handler(struct pf_state *, int, int,
316 struct pf_pdesc *, struct pfi_kif *);
317 static void pf_pptp_unlink(struct pf_state *);
318 static void pf_grev1_unlink(struct pf_state *);
319 static int pf_test_state_grev1(struct pf_state **, int,
320 struct pfi_kif *, int, struct pf_pdesc *);
321 static int pf_ike_compare(struct pf_app_state *,
322 struct pf_app_state *);
323 static int pf_test_state_esp(struct pf_state **, int,
324 struct pfi_kif *, int, struct pf_pdesc *);
325
326 extern struct pool pfr_ktable_pl;
327 extern struct pool pfr_kentry_pl;
328 extern int path_mtu_discovery;
329
330 struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX] = {
331 { .pp = &pf_state_pl, .limit = PFSTATE_HIWAT },
332 { .pp = &pf_app_state_pl, .limit = PFAPPSTATE_HIWAT },
333 { .pp = &pf_src_tree_pl, .limit = PFSNODE_HIWAT },
334 { .pp = &pf_frent_pl, .limit = PFFRAG_FRENT_HIWAT },
335 { .pp = &pfr_ktable_pl, .limit = PFR_KTABLE_HIWAT },
336 { .pp = &pfr_kentry_pl, .limit = PFR_KENTRY_HIWAT },
337 };
338
339 void *
340 pf_lazy_makewritable(struct pf_pdesc *pd, pbuf_t *pbuf, int len)
341 {
342 void *p;
343
344 if (pd->lmw < 0) {
345 return NULL;
346 }
347
348 VERIFY(pbuf == pd->mp);
349
350 p = pbuf->pb_data;
351 if (len > pd->lmw) {
352 if ((p = pbuf_ensure_writable(pbuf, len)) == NULL) {
353 len = -1;
354 }
355 pd->lmw = len;
356 if (len >= 0) {
357 pd->pf_mtag = pf_find_mtag_pbuf(pbuf);
358
359 switch (pd->af) {
360 case AF_INET: {
361 struct ip *h = p;
362 pd->src = (struct pf_addr *)(uintptr_t)&h->ip_src;
363 pd->dst = (struct pf_addr *)(uintptr_t)&h->ip_dst;
364 pd->ip_sum = &h->ip_sum;
365 break;
366 }
367 #if INET6
368 case AF_INET6: {
369 struct ip6_hdr *h = p;
370 pd->src = (struct pf_addr *)(uintptr_t)&h->ip6_src;
371 pd->dst = (struct pf_addr *)(uintptr_t)&h->ip6_dst;
372 break;
373 }
374 #endif /* INET6 */
375 }
376 }
377 }
378
379 return len < 0 ? NULL : p;
380 }
381
382 static const int *
383 pf_state_lookup_aux(struct pf_state **state, struct pfi_kif *kif,
384 int direction, int *action)
385 {
386 if (*state == NULL || (*state)->timeout == PFTM_PURGE) {
387 *action = PF_DROP;
388 return action;
389 }
390
391 if (direction == PF_OUT &&
392 (((*state)->rule.ptr->rt == PF_ROUTETO &&
393 (*state)->rule.ptr->direction == PF_OUT) ||
394 ((*state)->rule.ptr->rt == PF_REPLYTO &&
395 (*state)->rule.ptr->direction == PF_IN)) &&
396 (*state)->rt_kif != NULL && (*state)->rt_kif != kif) {
397 *action = PF_PASS;
398 return action;
399 }
400
401 return 0;
402 }
403
404 #define STATE_LOOKUP() \
405 do { \
406 int action; \
407 *state = pf_find_state(kif, &key, direction); \
408 if (*state != NULL && pd != NULL && \
409 !(pd->pktflags & PKTF_FLOW_ID)) { \
410 pd->flowsrc = (*state)->state_key->flowsrc; \
411 pd->flowhash = (*state)->state_key->flowhash; \
412 if (pd->flowhash != 0) { \
413 pd->pktflags |= PKTF_FLOW_ID; \
414 pd->pktflags &= ~PKTF_FLOW_ADV; \
415 } \
416 } \
417 if (pf_state_lookup_aux(state, kif, direction, &action)) \
418 return (action); \
419 } while (0)
420
421 #define STATE_ADDR_TRANSLATE(sk) \
422 (sk)->lan.addr.addr32[0] != (sk)->gwy.addr.addr32[0] || \
423 ((sk)->af_lan == AF_INET6 && \
424 ((sk)->lan.addr.addr32[1] != (sk)->gwy.addr.addr32[1] || \
425 (sk)->lan.addr.addr32[2] != (sk)->gwy.addr.addr32[2] || \
426 (sk)->lan.addr.addr32[3] != (sk)->gwy.addr.addr32[3]))
427
428 #define STATE_TRANSLATE(sk) \
429 ((sk)->af_lan != (sk)->af_gwy || \
430 STATE_ADDR_TRANSLATE(sk) || \
431 (sk)->lan.xport.port != (sk)->gwy.xport.port)
432
433 #define STATE_GRE_TRANSLATE(sk) \
434 (STATE_ADDR_TRANSLATE(sk) || \
435 (sk)->lan.xport.call_id != (sk)->gwy.xport.call_id)
436
437 #define BOUND_IFACE(r, k) \
438 ((r)->rule_flag & PFRULE_IFBOUND) ? (k) : pfi_all
439
440 #define STATE_INC_COUNTERS(s) \
441 do { \
442 s->rule.ptr->states++; \
443 VERIFY(s->rule.ptr->states != 0); \
444 if (s->anchor.ptr != NULL) { \
445 s->anchor.ptr->states++; \
446 VERIFY(s->anchor.ptr->states != 0); \
447 } \
448 if (s->nat_rule.ptr != NULL) { \
449 s->nat_rule.ptr->states++; \
450 VERIFY(s->nat_rule.ptr->states != 0); \
451 } \
452 } while (0)
453
454 #define STATE_DEC_COUNTERS(s) \
455 do { \
456 if (s->nat_rule.ptr != NULL) { \
457 VERIFY(s->nat_rule.ptr->states > 0); \
458 s->nat_rule.ptr->states--; \
459 } \
460 if (s->anchor.ptr != NULL) { \
461 VERIFY(s->anchor.ptr->states > 0); \
462 s->anchor.ptr->states--; \
463 } \
464 VERIFY(s->rule.ptr->states > 0); \
465 s->rule.ptr->states--; \
466 } while (0)
467
468 static __inline int pf_src_compare(struct pf_src_node *, struct pf_src_node *);
469 static __inline int pf_state_compare_lan_ext(struct pf_state_key *,
470 struct pf_state_key *);
471 static __inline int pf_state_compare_ext_gwy(struct pf_state_key *,
472 struct pf_state_key *);
473 static __inline int pf_state_compare_id(struct pf_state *,
474 struct pf_state *);
475
476 struct pf_src_tree tree_src_tracking;
477
478 struct pf_state_tree_id tree_id;
479 struct pf_state_queue state_list;
480
481 RB_GENERATE(pf_src_tree, pf_src_node, entry, pf_src_compare);
482 RB_GENERATE(pf_state_tree_lan_ext, pf_state_key,
483 entry_lan_ext, pf_state_compare_lan_ext);
484 RB_GENERATE(pf_state_tree_ext_gwy, pf_state_key,
485 entry_ext_gwy, pf_state_compare_ext_gwy);
486 RB_GENERATE(pf_state_tree_id, pf_state,
487 entry_id, pf_state_compare_id);
488
489 #define PF_DT_SKIP_LANEXT 0x01
490 #define PF_DT_SKIP_EXTGWY 0x02
491
492 static const u_int16_t PF_PPTP_PORT = 1723;
493 static const u_int32_t PF_PPTP_MAGIC_NUMBER = 0x1A2B3C4D;
494
495 struct pf_pptp_hdr {
496 u_int16_t length;
497 u_int16_t type;
498 u_int32_t magic;
499 };
500
501 struct pf_pptp_ctrl_hdr {
502 u_int16_t type;
503 u_int16_t reserved_0;
504 };
505
506 struct pf_pptp_ctrl_generic {
507 u_int16_t data[0];
508 };
509
510 #define PF_PPTP_CTRL_TYPE_START_REQ 1
511 struct pf_pptp_ctrl_start_req {
512 u_int16_t protocol_version;
513 u_int16_t reserved_1;
514 u_int32_t framing_capabilities;
515 u_int32_t bearer_capabilities;
516 u_int16_t maximum_channels;
517 u_int16_t firmware_revision;
518 u_int8_t host_name[64];
519 u_int8_t vendor_string[64];
520 };
521
522 #define PF_PPTP_CTRL_TYPE_START_RPY 2
523 struct pf_pptp_ctrl_start_rpy {
524 u_int16_t protocol_version;
525 u_int8_t result_code;
526 u_int8_t error_code;
527 u_int32_t framing_capabilities;
528 u_int32_t bearer_capabilities;
529 u_int16_t maximum_channels;
530 u_int16_t firmware_revision;
531 u_int8_t host_name[64];
532 u_int8_t vendor_string[64];
533 };
534
535 #define PF_PPTP_CTRL_TYPE_STOP_REQ 3
536 struct pf_pptp_ctrl_stop_req {
537 u_int8_t reason;
538 u_int8_t reserved_1;
539 u_int16_t reserved_2;
540 };
541
542 #define PF_PPTP_CTRL_TYPE_STOP_RPY 4
543 struct pf_pptp_ctrl_stop_rpy {
544 u_int8_t reason;
545 u_int8_t error_code;
546 u_int16_t reserved_1;
547 };
548
549 #define PF_PPTP_CTRL_TYPE_ECHO_REQ 5
550 struct pf_pptp_ctrl_echo_req {
551 u_int32_t identifier;
552 };
553
554 #define PF_PPTP_CTRL_TYPE_ECHO_RPY 6
555 struct pf_pptp_ctrl_echo_rpy {
556 u_int32_t identifier;
557 u_int8_t result_code;
558 u_int8_t error_code;
559 u_int16_t reserved_1;
560 };
561
562 #define PF_PPTP_CTRL_TYPE_CALL_OUT_REQ 7
563 struct pf_pptp_ctrl_call_out_req {
564 u_int16_t call_id;
565 u_int16_t call_sernum;
566 u_int32_t min_bps;
567 u_int32_t bearer_type;
568 u_int32_t framing_type;
569 u_int16_t rxwindow_size;
570 u_int16_t proc_delay;
571 u_int8_t phone_num[64];
572 u_int8_t sub_addr[64];
573 };
574
575 #define PF_PPTP_CTRL_TYPE_CALL_OUT_RPY 8
576 struct pf_pptp_ctrl_call_out_rpy {
577 u_int16_t call_id;
578 u_int16_t peer_call_id;
579 u_int8_t result_code;
580 u_int8_t error_code;
581 u_int16_t cause_code;
582 u_int32_t connect_speed;
583 u_int16_t rxwindow_size;
584 u_int16_t proc_delay;
585 u_int32_t phy_channel_id;
586 };
587
588 #define PF_PPTP_CTRL_TYPE_CALL_IN_1ST 9
589 struct pf_pptp_ctrl_call_in_1st {
590 u_int16_t call_id;
591 u_int16_t call_sernum;
592 u_int32_t bearer_type;
593 u_int32_t phy_channel_id;
594 u_int16_t dialed_number_len;
595 u_int16_t dialing_number_len;
596 u_int8_t dialed_num[64];
597 u_int8_t dialing_num[64];
598 u_int8_t sub_addr[64];
599 };
600
601 #define PF_PPTP_CTRL_TYPE_CALL_IN_2ND 10
602 struct pf_pptp_ctrl_call_in_2nd {
603 u_int16_t call_id;
604 u_int16_t peer_call_id;
605 u_int8_t result_code;
606 u_int8_t error_code;
607 u_int16_t rxwindow_size;
608 u_int16_t txdelay;
609 u_int16_t reserved_1;
610 };
611
612 #define PF_PPTP_CTRL_TYPE_CALL_IN_3RD 11
613 struct pf_pptp_ctrl_call_in_3rd {
614 u_int16_t call_id;
615 u_int16_t reserved_1;
616 u_int32_t connect_speed;
617 u_int16_t rxwindow_size;
618 u_int16_t txdelay;
619 u_int32_t framing_type;
620 };
621
622 #define PF_PPTP_CTRL_TYPE_CALL_CLR 12
623 struct pf_pptp_ctrl_call_clr {
624 u_int16_t call_id;
625 u_int16_t reserved_1;
626 };
627
628 #define PF_PPTP_CTRL_TYPE_CALL_DISC 13
629 struct pf_pptp_ctrl_call_disc {
630 u_int16_t call_id;
631 u_int8_t result_code;
632 u_int8_t error_code;
633 u_int16_t cause_code;
634 u_int16_t reserved_1;
635 u_int8_t statistics[128];
636 };
637
638 #define PF_PPTP_CTRL_TYPE_ERROR 14
639 struct pf_pptp_ctrl_error {
640 u_int16_t peer_call_id;
641 u_int16_t reserved_1;
642 u_int32_t crc_errors;
643 u_int32_t fr_errors;
644 u_int32_t hw_errors;
645 u_int32_t buf_errors;
646 u_int32_t tim_errors;
647 u_int32_t align_errors;
648 };
649
650 #define PF_PPTP_CTRL_TYPE_SET_LINKINFO 15
651 struct pf_pptp_ctrl_set_linkinfo {
652 u_int16_t peer_call_id;
653 u_int16_t reserved_1;
654 u_int32_t tx_accm;
655 u_int32_t rx_accm;
656 };
657
658 #if 0
659 static const char *
660 pf_pptp_ctrl_type_name(u_int16_t code)
661 {
662 code = ntohs(code);
663
664 if (code < PF_PPTP_CTRL_TYPE_START_REQ ||
665 code > PF_PPTP_CTRL_TYPE_SET_LINKINFO) {
666 static char reserved[] = "reserved-00";
667
668 sprintf(&reserved[9], "%02x", code);
669 return reserved;
670 } else {
671 static const char *name[] = {
672 "start_req", "start_rpy", "stop_req", "stop_rpy",
673 "echo_req", "echo_rpy", "call_out_req", "call_out_rpy",
674 "call_in_1st", "call_in_2nd", "call_in_3rd",
675 "call_clr", "call_disc", "error", "set_linkinfo"
676 };
677
678 return name[code - 1];
679 }
680 };
681 #endif
682
683 static const size_t PF_PPTP_CTRL_MSG_MINSIZE =
684 sizeof(struct pf_pptp_hdr) + sizeof(struct pf_pptp_ctrl_hdr);
685
686 union pf_pptp_ctrl_msg_union {
687 struct pf_pptp_ctrl_start_req start_req;
688 struct pf_pptp_ctrl_start_rpy start_rpy;
689 struct pf_pptp_ctrl_stop_req stop_req;
690 struct pf_pptp_ctrl_stop_rpy stop_rpy;
691 struct pf_pptp_ctrl_echo_req echo_req;
692 struct pf_pptp_ctrl_echo_rpy echo_rpy;
693 struct pf_pptp_ctrl_call_out_req call_out_req;
694 struct pf_pptp_ctrl_call_out_rpy call_out_rpy;
695 struct pf_pptp_ctrl_call_in_1st call_in_1st;
696 struct pf_pptp_ctrl_call_in_2nd call_in_2nd;
697 struct pf_pptp_ctrl_call_in_3rd call_in_3rd;
698 struct pf_pptp_ctrl_call_clr call_clr;
699 struct pf_pptp_ctrl_call_disc call_disc;
700 struct pf_pptp_ctrl_error error;
701 struct pf_pptp_ctrl_set_linkinfo set_linkinfo;
702 u_int8_t data[0];
703 };
704
705 struct pf_pptp_ctrl_msg {
706 struct pf_pptp_hdr hdr;
707 struct pf_pptp_ctrl_hdr ctrl;
708 union pf_pptp_ctrl_msg_union msg;
709 };
710
711 #define PF_GRE_FLAG_CHECKSUM_PRESENT 0x8000
712 #define PF_GRE_FLAG_VERSION_MASK 0x0007
713 #define PF_GRE_PPP_ETHERTYPE 0x880B
714
715 struct pf_grev1_hdr {
716 u_int16_t flags;
717 u_int16_t protocol_type;
718 u_int16_t payload_length;
719 u_int16_t call_id;
720 /*
721 * u_int32_t seqno;
722 * u_int32_t ackno;
723 */
724 };
725
726 static const u_int16_t PF_IKE_PORT = 500;
727
728 struct pf_ike_hdr {
729 u_int64_t initiator_cookie, responder_cookie;
730 u_int8_t next_payload, version, exchange_type, flags;
731 u_int32_t message_id, length;
732 };
733
734 #define PF_IKE_PACKET_MINSIZE (sizeof (struct pf_ike_hdr))
735
736 #define PF_IKEv1_EXCHTYPE_BASE 1
737 #define PF_IKEv1_EXCHTYPE_ID_PROTECT 2
738 #define PF_IKEv1_EXCHTYPE_AUTH_ONLY 3
739 #define PF_IKEv1_EXCHTYPE_AGGRESSIVE 4
740 #define PF_IKEv1_EXCHTYPE_INFORMATIONAL 5
741 #define PF_IKEv2_EXCHTYPE_SA_INIT 34
742 #define PF_IKEv2_EXCHTYPE_AUTH 35
743 #define PF_IKEv2_EXCHTYPE_CREATE_CHILD_SA 36
744 #define PF_IKEv2_EXCHTYPE_INFORMATIONAL 37
745
746 #define PF_IKEv1_FLAG_E 0x01
747 #define PF_IKEv1_FLAG_C 0x02
748 #define PF_IKEv1_FLAG_A 0x04
749 #define PF_IKEv2_FLAG_I 0x08
750 #define PF_IKEv2_FLAG_V 0x10
751 #define PF_IKEv2_FLAG_R 0x20
752
753 struct pf_esp_hdr {
754 u_int32_t spi;
755 u_int32_t seqno;
756 u_int8_t payload[];
757 };
758
759 static __inline int
760 pf_addr_compare(struct pf_addr *a, struct pf_addr *b, sa_family_t af)
761 {
762 switch (af) {
763 #ifdef INET
764 case AF_INET:
765 if (a->addr32[0] > b->addr32[0]) {
766 return 1;
767 }
768 if (a->addr32[0] < b->addr32[0]) {
769 return -1;
770 }
771 break;
772 #endif /* INET */
773 #ifdef INET6
774 case AF_INET6:
775 if (a->addr32[3] > b->addr32[3]) {
776 return 1;
777 }
778 if (a->addr32[3] < b->addr32[3]) {
779 return -1;
780 }
781 if (a->addr32[2] > b->addr32[2]) {
782 return 1;
783 }
784 if (a->addr32[2] < b->addr32[2]) {
785 return -1;
786 }
787 if (a->addr32[1] > b->addr32[1]) {
788 return 1;
789 }
790 if (a->addr32[1] < b->addr32[1]) {
791 return -1;
792 }
793 if (a->addr32[0] > b->addr32[0]) {
794 return 1;
795 }
796 if (a->addr32[0] < b->addr32[0]) {
797 return -1;
798 }
799 break;
800 #endif /* INET6 */
801 }
802 return 0;
803 }
804
805 static __inline int
806 pf_src_compare(struct pf_src_node *a, struct pf_src_node *b)
807 {
808 int diff;
809
810 if (a->rule.ptr > b->rule.ptr) {
811 return 1;
812 }
813 if (a->rule.ptr < b->rule.ptr) {
814 return -1;
815 }
816 if ((diff = a->af - b->af) != 0) {
817 return diff;
818 }
819 if ((diff = pf_addr_compare(&a->addr, &b->addr, a->af)) != 0) {
820 return diff;
821 }
822 return 0;
823 }
824
825 static __inline int
826 pf_state_compare_lan_ext(struct pf_state_key *a, struct pf_state_key *b)
827 {
828 int diff;
829 int extfilter;
830
831 if ((diff = a->proto - b->proto) != 0) {
832 return diff;
833 }
834 if ((diff = a->af_lan - b->af_lan) != 0) {
835 return diff;
836 }
837
838 extfilter = PF_EXTFILTER_APD;
839
840 switch (a->proto) {
841 case IPPROTO_ICMP:
842 case IPPROTO_ICMPV6:
843 if ((diff = a->lan.xport.port - b->lan.xport.port) != 0) {
844 return diff;
845 }
846 break;
847
848 case IPPROTO_TCP:
849 if ((diff = a->lan.xport.port - b->lan.xport.port) != 0) {
850 return diff;
851 }
852 if ((diff = a->ext_lan.xport.port - b->ext_lan.xport.port) != 0) {
853 return diff;
854 }
855 break;
856
857 case IPPROTO_UDP:
858 if ((diff = a->proto_variant - b->proto_variant)) {
859 return diff;
860 }
861 extfilter = a->proto_variant;
862 if ((diff = a->lan.xport.port - b->lan.xport.port) != 0) {
863 return diff;
864 }
865 if ((extfilter < PF_EXTFILTER_AD) &&
866 (diff = a->ext_lan.xport.port - b->ext_lan.xport.port) != 0) {
867 return diff;
868 }
869 break;
870
871 case IPPROTO_GRE:
872 if (a->proto_variant == PF_GRE_PPTP_VARIANT &&
873 a->proto_variant == b->proto_variant) {
874 if (!!(diff = a->ext_lan.xport.call_id -
875 b->ext_lan.xport.call_id)) {
876 return diff;
877 }
878 }
879 break;
880
881 case IPPROTO_ESP:
882 if (!!(diff = a->ext_lan.xport.spi - b->ext_lan.xport.spi)) {
883 return diff;
884 }
885 break;
886
887 default:
888 break;
889 }
890
891 switch (a->af_lan) {
892 #if INET
893 case AF_INET:
894 if ((diff = pf_addr_compare(&a->lan.addr, &b->lan.addr,
895 a->af_lan)) != 0) {
896 return diff;
897 }
898
899 if (extfilter < PF_EXTFILTER_EI) {
900 if ((diff = pf_addr_compare(&a->ext_lan.addr,
901 &b->ext_lan.addr,
902 a->af_lan)) != 0) {
903 return diff;
904 }
905 }
906 break;
907 #endif /* INET */
908 #if INET6
909 case AF_INET6:
910 if ((diff = pf_addr_compare(&a->lan.addr, &b->lan.addr,
911 a->af_lan)) != 0) {
912 return diff;
913 }
914
915 if (extfilter < PF_EXTFILTER_EI ||
916 !PF_AZERO(&b->ext_lan.addr, AF_INET6)) {
917 if ((diff = pf_addr_compare(&a->ext_lan.addr,
918 &b->ext_lan.addr,
919 a->af_lan)) != 0) {
920 return diff;
921 }
922 }
923 break;
924 #endif /* INET6 */
925 }
926
927 if (a->app_state && b->app_state) {
928 if (a->app_state->compare_lan_ext &&
929 b->app_state->compare_lan_ext) {
930 diff = (const char *)b->app_state->compare_lan_ext -
931 (const char *)a->app_state->compare_lan_ext;
932 if (diff != 0) {
933 return diff;
934 }
935 diff = a->app_state->compare_lan_ext(a->app_state,
936 b->app_state);
937 if (diff != 0) {
938 return diff;
939 }
940 }
941 }
942
943 return 0;
944 }
945
946 static __inline int
947 pf_state_compare_ext_gwy(struct pf_state_key *a, struct pf_state_key *b)
948 {
949 int diff;
950 int extfilter;
951
952 if ((diff = a->proto - b->proto) != 0) {
953 return diff;
954 }
955
956 if ((diff = a->af_gwy - b->af_gwy) != 0) {
957 return diff;
958 }
959
960 extfilter = PF_EXTFILTER_APD;
961
962 switch (a->proto) {
963 case IPPROTO_ICMP:
964 case IPPROTO_ICMPV6:
965 if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0) {
966 return diff;
967 }
968 break;
969
970 case IPPROTO_TCP:
971 if ((diff = a->ext_gwy.xport.port - b->ext_gwy.xport.port) != 0) {
972 return diff;
973 }
974 if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0) {
975 return diff;
976 }
977 break;
978
979 case IPPROTO_UDP:
980 if ((diff = a->proto_variant - b->proto_variant)) {
981 return diff;
982 }
983 extfilter = a->proto_variant;
984 if ((diff = a->gwy.xport.port - b->gwy.xport.port) != 0) {
985 return diff;
986 }
987 if ((extfilter < PF_EXTFILTER_AD) &&
988 (diff = a->ext_gwy.xport.port - b->ext_gwy.xport.port) != 0) {
989 return diff;
990 }
991 break;
992
993 case IPPROTO_GRE:
994 if (a->proto_variant == PF_GRE_PPTP_VARIANT &&
995 a->proto_variant == b->proto_variant) {
996 if (!!(diff = a->gwy.xport.call_id -
997 b->gwy.xport.call_id)) {
998 return diff;
999 }
1000 }
1001 break;
1002
1003 case IPPROTO_ESP:
1004 if (!!(diff = a->gwy.xport.spi - b->gwy.xport.spi)) {
1005 return diff;
1006 }
1007 break;
1008
1009 default:
1010 break;
1011 }
1012
1013 switch (a->af_gwy) {
1014 #if INET
1015 case AF_INET:
1016 if ((diff = pf_addr_compare(&a->gwy.addr, &b->gwy.addr,
1017 a->af_gwy)) != 0) {
1018 return diff;
1019 }
1020
1021 if (extfilter < PF_EXTFILTER_EI) {
1022 if ((diff = pf_addr_compare(&a->ext_gwy.addr, &b->ext_gwy.addr,
1023 a->af_gwy)) != 0) {
1024 return diff;
1025 }
1026 }
1027 break;
1028 #endif /* INET */
1029 #if INET6
1030 case AF_INET6:
1031 if ((diff = pf_addr_compare(&a->gwy.addr, &b->gwy.addr,
1032 a->af_gwy)) != 0) {
1033 return diff;
1034 }
1035
1036 if (extfilter < PF_EXTFILTER_EI ||
1037 !PF_AZERO(&b->ext_gwy.addr, AF_INET6)) {
1038 if ((diff = pf_addr_compare(&a->ext_gwy.addr, &b->ext_gwy.addr,
1039 a->af_gwy)) != 0) {
1040 return diff;
1041 }
1042 }
1043 break;
1044 #endif /* INET6 */
1045 }
1046
1047 if (a->app_state && b->app_state) {
1048 if (a->app_state->compare_ext_gwy &&
1049 b->app_state->compare_ext_gwy) {
1050 diff = (const char *)b->app_state->compare_ext_gwy -
1051 (const char *)a->app_state->compare_ext_gwy;
1052 if (diff != 0) {
1053 return diff;
1054 }
1055 diff = a->app_state->compare_ext_gwy(a->app_state,
1056 b->app_state);
1057 if (diff != 0) {
1058 return diff;
1059 }
1060 }
1061 }
1062
1063 return 0;
1064 }
1065
1066 static __inline int
1067 pf_state_compare_id(struct pf_state *a, struct pf_state *b)
1068 {
1069 if (a->id > b->id) {
1070 return 1;
1071 }
1072 if (a->id < b->id) {
1073 return -1;
1074 }
1075 if (a->creatorid > b->creatorid) {
1076 return 1;
1077 }
1078 if (a->creatorid < b->creatorid) {
1079 return -1;
1080 }
1081
1082 return 0;
1083 }
1084
1085 #if INET6
1086 void
1087 pf_addrcpy(struct pf_addr *dst, struct pf_addr *src, sa_family_t af)
1088 {
1089 switch (af) {
1090 #if INET
1091 case AF_INET:
1092 dst->addr32[0] = src->addr32[0];
1093 break;
1094 #endif /* INET */
1095 case AF_INET6:
1096 dst->addr32[0] = src->addr32[0];
1097 dst->addr32[1] = src->addr32[1];
1098 dst->addr32[2] = src->addr32[2];
1099 dst->addr32[3] = src->addr32[3];
1100 break;
1101 }
1102 }
1103 #endif /* INET6 */
1104
1105 struct pf_state *
1106 pf_find_state_byid(struct pf_state_cmp *key)
1107 {
1108 pf_status.fcounters[FCNT_STATE_SEARCH]++;
1109
1110 return RB_FIND(pf_state_tree_id, &tree_id,
1111 (struct pf_state *)(void *)key);
1112 }
1113
1114 static struct pf_state *
1115 pf_find_state(struct pfi_kif *kif, struct pf_state_key_cmp *key, u_int dir)
1116 {
1117 struct pf_state_key *sk = NULL;
1118 struct pf_state *s;
1119
1120 pf_status.fcounters[FCNT_STATE_SEARCH]++;
1121
1122 switch (dir) {
1123 case PF_OUT:
1124 sk = RB_FIND(pf_state_tree_lan_ext, &pf_statetbl_lan_ext,
1125 (struct pf_state_key *)key);
1126 break;
1127 case PF_IN:
1128 sk = RB_FIND(pf_state_tree_ext_gwy, &pf_statetbl_ext_gwy,
1129 (struct pf_state_key *)key);
1130 /*
1131 * NAT64 is done only on input, for packets coming in from
1132 * from the LAN side, need to lookup the lan_ext tree.
1133 */
1134 if (sk == NULL) {
1135 sk = RB_FIND(pf_state_tree_lan_ext,
1136 &pf_statetbl_lan_ext,
1137 (struct pf_state_key *)key);
1138 if (sk && sk->af_lan == sk->af_gwy) {
1139 sk = NULL;
1140 }
1141 }
1142 break;
1143 default:
1144 panic("pf_find_state");
1145 }
1146
1147 /* list is sorted, if-bound states before floating ones */
1148 if (sk != NULL) {
1149 TAILQ_FOREACH(s, &sk->states, next)
1150 if (s->kif == pfi_all || s->kif == kif) {
1151 return s;
1152 }
1153 }
1154
1155 return NULL;
1156 }
1157
1158 struct pf_state *
1159 pf_find_state_all(struct pf_state_key_cmp *key, u_int dir, int *more)
1160 {
1161 struct pf_state_key *sk = NULL;
1162 struct pf_state *s, *ret = NULL;
1163
1164 pf_status.fcounters[FCNT_STATE_SEARCH]++;
1165
1166 switch (dir) {
1167 case PF_OUT:
1168 sk = RB_FIND(pf_state_tree_lan_ext,
1169 &pf_statetbl_lan_ext, (struct pf_state_key *)key);
1170 break;
1171 case PF_IN:
1172 sk = RB_FIND(pf_state_tree_ext_gwy,
1173 &pf_statetbl_ext_gwy, (struct pf_state_key *)key);
1174 /*
1175 * NAT64 is done only on input, for packets coming in from
1176 * from the LAN side, need to lookup the lan_ext tree.
1177 */
1178 if ((sk == NULL) && pf_nat64_configured) {
1179 sk = RB_FIND(pf_state_tree_lan_ext,
1180 &pf_statetbl_lan_ext,
1181 (struct pf_state_key *)key);
1182 if (sk && sk->af_lan == sk->af_gwy) {
1183 sk = NULL;
1184 }
1185 }
1186 break;
1187 default:
1188 panic("pf_find_state_all");
1189 }
1190
1191 if (sk != NULL) {
1192 ret = TAILQ_FIRST(&sk->states);
1193 if (more == NULL) {
1194 return ret;
1195 }
1196
1197 TAILQ_FOREACH(s, &sk->states, next)
1198 (*more)++;
1199 }
1200
1201 return ret;
1202 }
1203
1204 static void
1205 pf_init_threshold(struct pf_threshold *threshold,
1206 u_int32_t limit, u_int32_t seconds)
1207 {
1208 threshold->limit = limit * PF_THRESHOLD_MULT;
1209 threshold->seconds = seconds;
1210 threshold->count = 0;
1211 threshold->last = pf_time_second();
1212 }
1213
1214 static void
1215 pf_add_threshold(struct pf_threshold *threshold)
1216 {
1217 u_int32_t t = pf_time_second(), diff = t - threshold->last;
1218
1219 if (diff >= threshold->seconds) {
1220 threshold->count = 0;
1221 } else {
1222 threshold->count -= threshold->count * diff /
1223 threshold->seconds;
1224 }
1225 threshold->count += PF_THRESHOLD_MULT;
1226 threshold->last = t;
1227 }
1228
1229 static int
1230 pf_check_threshold(struct pf_threshold *threshold)
1231 {
1232 return threshold->count > threshold->limit;
1233 }
1234
1235 static int
1236 pf_src_connlimit(struct pf_state **state)
1237 {
1238 int bad = 0;
1239 (*state)->src_node->conn++;
1240 VERIFY((*state)->src_node->conn != 0);
1241 (*state)->src.tcp_est = 1;
1242 pf_add_threshold(&(*state)->src_node->conn_rate);
1243
1244 if ((*state)->rule.ptr->max_src_conn &&
1245 (*state)->rule.ptr->max_src_conn <
1246 (*state)->src_node->conn) {
1247 pf_status.lcounters[LCNT_SRCCONN]++;
1248 bad++;
1249 }
1250
1251 if ((*state)->rule.ptr->max_src_conn_rate.limit &&
1252 pf_check_threshold(&(*state)->src_node->conn_rate)) {
1253 pf_status.lcounters[LCNT_SRCCONNRATE]++;
1254 bad++;
1255 }
1256
1257 if (!bad) {
1258 return 0;
1259 }
1260
1261 if ((*state)->rule.ptr->overload_tbl) {
1262 struct pfr_addr p;
1263 u_int32_t killed = 0;
1264
1265 pf_status.lcounters[LCNT_OVERLOAD_TABLE]++;
1266 if (pf_status.debug >= PF_DEBUG_MISC) {
1267 printf("pf_src_connlimit: blocking address ");
1268 pf_print_host(&(*state)->src_node->addr, 0,
1269 (*state)->state_key->af_lan);
1270 }
1271
1272 bzero(&p, sizeof(p));
1273 p.pfra_af = (*state)->state_key->af_lan;
1274 switch ((*state)->state_key->af_lan) {
1275 #if INET
1276 case AF_INET:
1277 p.pfra_net = 32;
1278 p.pfra_ip4addr = (*state)->src_node->addr.v4addr;
1279 break;
1280 #endif /* INET */
1281 #if INET6
1282 case AF_INET6:
1283 p.pfra_net = 128;
1284 p.pfra_ip6addr = (*state)->src_node->addr.v6addr;
1285 break;
1286 #endif /* INET6 */
1287 }
1288
1289 pfr_insert_kentry((*state)->rule.ptr->overload_tbl,
1290 &p, pf_calendar_time_second());
1291
1292 /* kill existing states if that's required. */
1293 if ((*state)->rule.ptr->flush) {
1294 struct pf_state_key *sk;
1295 struct pf_state *st;
1296
1297 pf_status.lcounters[LCNT_OVERLOAD_FLUSH]++;
1298 RB_FOREACH(st, pf_state_tree_id, &tree_id) {
1299 sk = st->state_key;
1300 /*
1301 * Kill states from this source. (Only those
1302 * from the same rule if PF_FLUSH_GLOBAL is not
1303 * set)
1304 */
1305 if (sk->af_lan ==
1306 (*state)->state_key->af_lan &&
1307 (((*state)->state_key->direction ==
1308 PF_OUT &&
1309 PF_AEQ(&(*state)->src_node->addr,
1310 &sk->lan.addr, sk->af_lan)) ||
1311 ((*state)->state_key->direction == PF_IN &&
1312 PF_AEQ(&(*state)->src_node->addr,
1313 &sk->ext_lan.addr, sk->af_lan))) &&
1314 ((*state)->rule.ptr->flush &
1315 PF_FLUSH_GLOBAL ||
1316 (*state)->rule.ptr == st->rule.ptr)) {
1317 st->timeout = PFTM_PURGE;
1318 st->src.state = st->dst.state =
1319 TCPS_CLOSED;
1320 killed++;
1321 }
1322 }
1323 if (pf_status.debug >= PF_DEBUG_MISC) {
1324 printf(", %u states killed", killed);
1325 }
1326 }
1327 if (pf_status.debug >= PF_DEBUG_MISC) {
1328 printf("\n");
1329 }
1330 }
1331
1332 /* kill this state */
1333 (*state)->timeout = PFTM_PURGE;
1334 (*state)->src.state = (*state)->dst.state = TCPS_CLOSED;
1335 return 1;
1336 }
1337
1338 int
1339 pf_insert_src_node(struct pf_src_node **sn, struct pf_rule *rule,
1340 struct pf_addr *src, sa_family_t af)
1341 {
1342 struct pf_src_node k;
1343
1344 if (*sn == NULL) {
1345 k.af = af;
1346 PF_ACPY(&k.addr, src, af);
1347 if (rule->rule_flag & PFRULE_RULESRCTRACK ||
1348 rule->rpool.opts & PF_POOL_STICKYADDR) {
1349 k.rule.ptr = rule;
1350 } else {
1351 k.rule.ptr = NULL;
1352 }
1353 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
1354 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k);
1355 }
1356 if (*sn == NULL) {
1357 if (!rule->max_src_nodes ||
1358 rule->src_nodes < rule->max_src_nodes) {
1359 (*sn) = pool_get(&pf_src_tree_pl, PR_WAITOK);
1360 } else {
1361 pf_status.lcounters[LCNT_SRCNODES]++;
1362 }
1363 if ((*sn) == NULL) {
1364 return -1;
1365 }
1366 bzero(*sn, sizeof(struct pf_src_node));
1367
1368 pf_init_threshold(&(*sn)->conn_rate,
1369 rule->max_src_conn_rate.limit,
1370 rule->max_src_conn_rate.seconds);
1371
1372 (*sn)->af = af;
1373 if (rule->rule_flag & PFRULE_RULESRCTRACK ||
1374 rule->rpool.opts & PF_POOL_STICKYADDR) {
1375 (*sn)->rule.ptr = rule;
1376 } else {
1377 (*sn)->rule.ptr = NULL;
1378 }
1379 PF_ACPY(&(*sn)->addr, src, af);
1380 if (RB_INSERT(pf_src_tree,
1381 &tree_src_tracking, *sn) != NULL) {
1382 if (pf_status.debug >= PF_DEBUG_MISC) {
1383 printf("pf: src_tree insert failed: ");
1384 pf_print_host(&(*sn)->addr, 0, af);
1385 printf("\n");
1386 }
1387 pool_put(&pf_src_tree_pl, *sn);
1388 return -1;
1389 }
1390 (*sn)->creation = pf_time_second();
1391 (*sn)->ruletype = rule->action;
1392 if ((*sn)->rule.ptr != NULL) {
1393 (*sn)->rule.ptr->src_nodes++;
1394 }
1395 pf_status.scounters[SCNT_SRC_NODE_INSERT]++;
1396 pf_status.src_nodes++;
1397 } else {
1398 if (rule->max_src_states &&
1399 (*sn)->states >= rule->max_src_states) {
1400 pf_status.lcounters[LCNT_SRCSTATES]++;
1401 return -1;
1402 }
1403 }
1404 return 0;
1405 }
1406
1407 static void
1408 pf_stateins_err(const char *tree, struct pf_state *s, struct pfi_kif *kif)
1409 {
1410 struct pf_state_key *sk = s->state_key;
1411
1412 if (pf_status.debug >= PF_DEBUG_MISC) {
1413 printf("pf: state insert failed: %s %s ", tree, kif->pfik_name);
1414 switch (sk->proto) {
1415 case IPPROTO_TCP:
1416 printf("TCP");
1417 break;
1418 case IPPROTO_UDP:
1419 printf("UDP");
1420 break;
1421 case IPPROTO_ICMP:
1422 printf("ICMP4");
1423 break;
1424 case IPPROTO_ICMPV6:
1425 printf("ICMP6");
1426 break;
1427 default:
1428 printf("PROTO=%u", sk->proto);
1429 break;
1430 }
1431 printf(" lan: ");
1432 pf_print_sk_host(&sk->lan, sk->af_lan, sk->proto,
1433 sk->proto_variant);
1434 printf(" gwy: ");
1435 pf_print_sk_host(&sk->gwy, sk->af_gwy, sk->proto,
1436 sk->proto_variant);
1437 printf(" ext_lan: ");
1438 pf_print_sk_host(&sk->ext_lan, sk->af_lan, sk->proto,
1439 sk->proto_variant);
1440 printf(" ext_gwy: ");
1441 pf_print_sk_host(&sk->ext_gwy, sk->af_gwy, sk->proto,
1442 sk->proto_variant);
1443 if (s->sync_flags & PFSTATE_FROMSYNC) {
1444 printf(" (from sync)");
1445 }
1446 printf("\n");
1447 }
1448 }
1449
1450 int
1451 pf_insert_state(struct pfi_kif *kif, struct pf_state *s)
1452 {
1453 struct pf_state_key *cur;
1454 struct pf_state *sp;
1455
1456 VERIFY(s->state_key != NULL);
1457 s->kif = kif;
1458
1459 if ((cur = RB_INSERT(pf_state_tree_lan_ext, &pf_statetbl_lan_ext,
1460 s->state_key)) != NULL) {
1461 /* key exists. check for same kif, if none, add to key */
1462 TAILQ_FOREACH(sp, &cur->states, next)
1463 if (sp->kif == kif) { /* collision! */
1464 pf_stateins_err("tree_lan_ext", s, kif);
1465 pf_detach_state(s,
1466 PF_DT_SKIP_LANEXT | PF_DT_SKIP_EXTGWY);
1467 return -1;
1468 }
1469 pf_detach_state(s, PF_DT_SKIP_LANEXT | PF_DT_SKIP_EXTGWY);
1470 pf_attach_state(cur, s, kif == pfi_all ? 1 : 0);
1471 }
1472
1473 /* if cur != NULL, we already found a state key and attached to it */
1474 if (cur == NULL && (cur = RB_INSERT(pf_state_tree_ext_gwy,
1475 &pf_statetbl_ext_gwy, s->state_key)) != NULL) {
1476 /* must not happen. we must have found the sk above! */
1477 pf_stateins_err("tree_ext_gwy", s, kif);
1478 pf_detach_state(s, PF_DT_SKIP_EXTGWY);
1479 return -1;
1480 }
1481
1482 if (s->id == 0 && s->creatorid == 0) {
1483 s->id = htobe64(pf_status.stateid++);
1484 s->creatorid = pf_status.hostid;
1485 }
1486 if (RB_INSERT(pf_state_tree_id, &tree_id, s) != NULL) {
1487 if (pf_status.debug >= PF_DEBUG_MISC) {
1488 printf("pf: state insert failed: "
1489 "id: %016llx creatorid: %08x",
1490 be64toh(s->id), ntohl(s->creatorid));
1491 if (s->sync_flags & PFSTATE_FROMSYNC) {
1492 printf(" (from sync)");
1493 }
1494 printf("\n");
1495 }
1496 pf_detach_state(s, 0);
1497 return -1;
1498 }
1499 TAILQ_INSERT_TAIL(&state_list, s, entry_list);
1500 pf_status.fcounters[FCNT_STATE_INSERT]++;
1501 pf_status.states++;
1502 VERIFY(pf_status.states != 0);
1503 pfi_kif_ref(kif, PFI_KIF_REF_STATE);
1504 #if NPFSYNC
1505 pfsync_insert_state(s);
1506 #endif
1507 return 0;
1508 }
1509
1510 static int
1511 pf_purge_thread_cont(int err)
1512 {
1513 #pragma unused(err)
1514 static u_int32_t nloops = 0;
1515 int t = 1; /* 1 second */
1516
1517 /*
1518 * Update coarse-grained networking timestamp (in sec.); the idea
1519 * is to piggy-back on the periodic timeout callout to update
1520 * the counter returnable via net_uptime().
1521 */
1522 net_update_uptime();
1523
1524 lck_rw_lock_shared(pf_perim_lock);
1525 lck_mtx_lock(pf_lock);
1526
1527 /* purge everything if not running */
1528 if (!pf_status.running) {
1529 pf_purge_expired_states(pf_status.states);
1530 pf_purge_expired_fragments();
1531 pf_purge_expired_src_nodes();
1532
1533 /* terminate thread (we don't currently do this) */
1534 if (pf_purge_thread == NULL) {
1535 lck_mtx_unlock(pf_lock);
1536 lck_rw_done(pf_perim_lock);
1537
1538 thread_deallocate(current_thread());
1539 thread_terminate(current_thread());
1540 /* NOTREACHED */
1541 return 0;
1542 } else {
1543 /* if there's nothing left, sleep w/o timeout */
1544 if (pf_status.states == 0 &&
1545 pf_normalize_isempty() &&
1546 RB_EMPTY(&tree_src_tracking)) {
1547 nloops = 0;
1548 t = 0;
1549 }
1550 goto done;
1551 }
1552 }
1553
1554 /* process a fraction of the state table every second */
1555 pf_purge_expired_states(1 + (pf_status.states
1556 / pf_default_rule.timeout[PFTM_INTERVAL]));
1557
1558 /* purge other expired types every PFTM_INTERVAL seconds */
1559 if (++nloops >= pf_default_rule.timeout[PFTM_INTERVAL]) {
1560 pf_purge_expired_fragments();
1561 pf_purge_expired_src_nodes();
1562 nloops = 0;
1563 }
1564 done:
1565 lck_mtx_unlock(pf_lock);
1566 lck_rw_done(pf_perim_lock);
1567
1568 (void) tsleep0(pf_purge_thread_fn, PWAIT, "pf_purge_cont",
1569 t * hz, pf_purge_thread_cont);
1570 /* NOTREACHED */
1571 VERIFY(0);
1572
1573 return 0;
1574 }
1575
1576 void
1577 pf_purge_thread_fn(void *v, wait_result_t w)
1578 {
1579 #pragma unused(v, w)
1580 (void) tsleep0(pf_purge_thread_fn, PWAIT, "pf_purge", 0,
1581 pf_purge_thread_cont);
1582 /*
1583 * tsleep0() shouldn't have returned as PCATCH was not set;
1584 * therefore assert in this case.
1585 */
1586 VERIFY(0);
1587 }
1588
1589 u_int64_t
1590 pf_state_expires(const struct pf_state *state)
1591 {
1592 u_int32_t t;
1593 u_int32_t start;
1594 u_int32_t end;
1595 u_int32_t states;
1596
1597 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
1598
1599 /* handle all PFTM_* > PFTM_MAX here */
1600 if (state->timeout == PFTM_PURGE) {
1601 return pf_time_second();
1602 }
1603
1604 VERIFY(state->timeout != PFTM_UNLINKED);
1605 VERIFY(state->timeout < PFTM_MAX);
1606 t = state->rule.ptr->timeout[state->timeout];
1607 if (!t) {
1608 t = pf_default_rule.timeout[state->timeout];
1609 }
1610 start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START];
1611 if (start) {
1612 end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END];
1613 states = state->rule.ptr->states;
1614 } else {
1615 start = pf_default_rule.timeout[PFTM_ADAPTIVE_START];
1616 end = pf_default_rule.timeout[PFTM_ADAPTIVE_END];
1617 states = pf_status.states;
1618 }
1619 if (end && states > start && start < end) {
1620 if (states < end) {
1621 return state->expire + t * (end - states) /
1622 (end - start);
1623 } else {
1624 return pf_time_second();
1625 }
1626 }
1627 return state->expire + t;
1628 }
1629
1630 void
1631 pf_purge_expired_src_nodes(void)
1632 {
1633 struct pf_src_node *cur, *next;
1634
1635 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
1636
1637 for (cur = RB_MIN(pf_src_tree, &tree_src_tracking); cur; cur = next) {
1638 next = RB_NEXT(pf_src_tree, &tree_src_tracking, cur);
1639
1640 if (cur->states <= 0 && cur->expire <= pf_time_second()) {
1641 if (cur->rule.ptr != NULL) {
1642 cur->rule.ptr->src_nodes--;
1643 if (cur->rule.ptr->states <= 0 &&
1644 cur->rule.ptr->max_src_nodes <= 0) {
1645 pf_rm_rule(NULL, cur->rule.ptr);
1646 }
1647 }
1648 RB_REMOVE(pf_src_tree, &tree_src_tracking, cur);
1649 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
1650 pf_status.src_nodes--;
1651 pool_put(&pf_src_tree_pl, cur);
1652 }
1653 }
1654 }
1655
1656 void
1657 pf_src_tree_remove_state(struct pf_state *s)
1658 {
1659 u_int32_t t;
1660
1661 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
1662
1663 if (s->src_node != NULL) {
1664 if (s->src.tcp_est) {
1665 VERIFY(s->src_node->conn > 0);
1666 --s->src_node->conn;
1667 }
1668 VERIFY(s->src_node->states > 0);
1669 if (--s->src_node->states <= 0) {
1670 t = s->rule.ptr->timeout[PFTM_SRC_NODE];
1671 if (!t) {
1672 t = pf_default_rule.timeout[PFTM_SRC_NODE];
1673 }
1674 s->src_node->expire = pf_time_second() + t;
1675 }
1676 }
1677 if (s->nat_src_node != s->src_node && s->nat_src_node != NULL) {
1678 VERIFY(s->nat_src_node->states > 0);
1679 if (--s->nat_src_node->states <= 0) {
1680 t = s->rule.ptr->timeout[PFTM_SRC_NODE];
1681 if (!t) {
1682 t = pf_default_rule.timeout[PFTM_SRC_NODE];
1683 }
1684 s->nat_src_node->expire = pf_time_second() + t;
1685 }
1686 }
1687 s->src_node = s->nat_src_node = NULL;
1688 }
1689
1690 void
1691 pf_unlink_state(struct pf_state *cur)
1692 {
1693 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
1694
1695 if (cur->src.state == PF_TCPS_PROXY_DST) {
1696 pf_send_tcp(cur->rule.ptr, cur->state_key->af_lan,
1697 &cur->state_key->ext_lan.addr, &cur->state_key->lan.addr,
1698 cur->state_key->ext_lan.xport.port,
1699 cur->state_key->lan.xport.port,
1700 cur->src.seqhi, cur->src.seqlo + 1,
1701 TH_RST | TH_ACK, 0, 0, 0, 1, cur->tag, NULL, NULL);
1702 }
1703
1704 hook_runloop(&cur->unlink_hooks, HOOK_REMOVE | HOOK_FREE);
1705 RB_REMOVE(pf_state_tree_id, &tree_id, cur);
1706 #if NPFSYNC
1707 if (cur->creatorid == pf_status.hostid) {
1708 pfsync_delete_state(cur);
1709 }
1710 #endif
1711 cur->timeout = PFTM_UNLINKED;
1712 pf_src_tree_remove_state(cur);
1713 pf_detach_state(cur, 0);
1714 }
1715
1716 /* callers should be at splpf and hold the
1717 * write_lock on pf_consistency_lock */
1718 void
1719 pf_free_state(struct pf_state *cur)
1720 {
1721 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
1722 #if NPFSYNC
1723 if (pfsyncif != NULL &&
1724 (pfsyncif->sc_bulk_send_next == cur ||
1725 pfsyncif->sc_bulk_terminator == cur)) {
1726 return;
1727 }
1728 #endif
1729 VERIFY(cur->timeout == PFTM_UNLINKED);
1730 VERIFY(cur->rule.ptr->states > 0);
1731 if (--cur->rule.ptr->states <= 0 &&
1732 cur->rule.ptr->src_nodes <= 0) {
1733 pf_rm_rule(NULL, cur->rule.ptr);
1734 }
1735 if (cur->nat_rule.ptr != NULL) {
1736 VERIFY(cur->nat_rule.ptr->states > 0);
1737 if (--cur->nat_rule.ptr->states <= 0 &&
1738 cur->nat_rule.ptr->src_nodes <= 0) {
1739 pf_rm_rule(NULL, cur->nat_rule.ptr);
1740 }
1741 }
1742 if (cur->anchor.ptr != NULL) {
1743 VERIFY(cur->anchor.ptr->states > 0);
1744 if (--cur->anchor.ptr->states <= 0) {
1745 pf_rm_rule(NULL, cur->anchor.ptr);
1746 }
1747 }
1748 pf_normalize_tcp_cleanup(cur);
1749 pfi_kif_unref(cur->kif, PFI_KIF_REF_STATE);
1750 TAILQ_REMOVE(&state_list, cur, entry_list);
1751 if (cur->tag) {
1752 pf_tag_unref(cur->tag);
1753 }
1754 pool_put(&pf_state_pl, cur);
1755 pf_status.fcounters[FCNT_STATE_REMOVALS]++;
1756 VERIFY(pf_status.states > 0);
1757 pf_status.states--;
1758 }
1759
1760 void
1761 pf_purge_expired_states(u_int32_t maxcheck)
1762 {
1763 static struct pf_state *cur = NULL;
1764 struct pf_state *next;
1765
1766 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
1767
1768 while (maxcheck--) {
1769 /* wrap to start of list when we hit the end */
1770 if (cur == NULL) {
1771 cur = TAILQ_FIRST(&state_list);
1772 if (cur == NULL) {
1773 break; /* list empty */
1774 }
1775 }
1776
1777 /* get next state, as cur may get deleted */
1778 next = TAILQ_NEXT(cur, entry_list);
1779
1780 if (cur->timeout == PFTM_UNLINKED) {
1781 pf_free_state(cur);
1782 } else if (pf_state_expires(cur) <= pf_time_second()) {
1783 /* unlink and free expired state */
1784 pf_unlink_state(cur);
1785 pf_free_state(cur);
1786 }
1787 cur = next;
1788 }
1789 }
1790
1791 int
1792 pf_tbladdr_setup(struct pf_ruleset *rs, struct pf_addr_wrap *aw)
1793 {
1794 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
1795
1796 if (aw->type != PF_ADDR_TABLE) {
1797 return 0;
1798 }
1799 if ((aw->p.tbl = pfr_attach_table(rs, aw->v.tblname)) == NULL) {
1800 return 1;
1801 }
1802 return 0;
1803 }
1804
1805 void
1806 pf_tbladdr_remove(struct pf_addr_wrap *aw)
1807 {
1808 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
1809
1810 if (aw->type != PF_ADDR_TABLE || aw->p.tbl == NULL) {
1811 return;
1812 }
1813 pfr_detach_table(aw->p.tbl);
1814 aw->p.tbl = NULL;
1815 }
1816
1817 void
1818 pf_tbladdr_copyout(struct pf_addr_wrap *aw)
1819 {
1820 struct pfr_ktable *kt = aw->p.tbl;
1821
1822 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
1823
1824 if (aw->type != PF_ADDR_TABLE || kt == NULL) {
1825 return;
1826 }
1827 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) {
1828 kt = kt->pfrkt_root;
1829 }
1830 aw->p.tbl = NULL;
1831 aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ?
1832 kt->pfrkt_cnt : -1;
1833 }
1834
1835 static void
1836 pf_print_addr(struct pf_addr *addr, sa_family_t af)
1837 {
1838 switch (af) {
1839 #if INET
1840 case AF_INET: {
1841 u_int32_t a = ntohl(addr->addr32[0]);
1842 printf("%u.%u.%u.%u", (a >> 24) & 255, (a >> 16) & 255,
1843 (a >> 8) & 255, a & 255);
1844 break;
1845 }
1846 #endif /* INET */
1847 #if INET6
1848 case AF_INET6: {
1849 u_int16_t b;
1850 u_int8_t i, curstart = 255, curend = 0,
1851 maxstart = 0, maxend = 0;
1852 for (i = 0; i < 8; i++) {
1853 if (!addr->addr16[i]) {
1854 if (curstart == 255) {
1855 curstart = i;
1856 } else {
1857 curend = i;
1858 }
1859 } else {
1860 if (curstart) {
1861 if ((curend - curstart) >
1862 (maxend - maxstart)) {
1863 maxstart = curstart;
1864 maxend = curend;
1865 curstart = 255;
1866 }
1867 }
1868 }
1869 }
1870 for (i = 0; i < 8; i++) {
1871 if (i >= maxstart && i <= maxend) {
1872 if (maxend != 7) {
1873 if (i == maxstart) {
1874 printf(":");
1875 }
1876 } else {
1877 if (i == maxend) {
1878 printf(":");
1879 }
1880 }
1881 } else {
1882 b = ntohs(addr->addr16[i]);
1883 printf("%x", b);
1884 if (i < 7) {
1885 printf(":");
1886 }
1887 }
1888 }
1889 break;
1890 }
1891 #endif /* INET6 */
1892 }
1893 }
1894
1895 static void
1896 pf_print_sk_host(struct pf_state_host *sh, sa_family_t af, int proto,
1897 u_int8_t proto_variant)
1898 {
1899 pf_print_addr(&sh->addr, af);
1900
1901 switch (proto) {
1902 case IPPROTO_ESP:
1903 if (sh->xport.spi) {
1904 printf("[%08x]", ntohl(sh->xport.spi));
1905 }
1906 break;
1907
1908 case IPPROTO_GRE:
1909 if (proto_variant == PF_GRE_PPTP_VARIANT) {
1910 printf("[%u]", ntohs(sh->xport.call_id));
1911 }
1912 break;
1913
1914 case IPPROTO_TCP:
1915 case IPPROTO_UDP:
1916 printf("[%u]", ntohs(sh->xport.port));
1917 break;
1918
1919 default:
1920 break;
1921 }
1922 }
1923
1924 static void
1925 pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af)
1926 {
1927 pf_print_addr(addr, af);
1928 if (p) {
1929 printf("[%u]", ntohs(p));
1930 }
1931 }
1932
1933 void
1934 pf_print_state(struct pf_state *s)
1935 {
1936 struct pf_state_key *sk = s->state_key;
1937 switch (sk->proto) {
1938 case IPPROTO_ESP:
1939 printf("ESP ");
1940 break;
1941 case IPPROTO_GRE:
1942 printf("GRE%u ", sk->proto_variant);
1943 break;
1944 case IPPROTO_TCP:
1945 printf("TCP ");
1946 break;
1947 case IPPROTO_UDP:
1948 printf("UDP ");
1949 break;
1950 case IPPROTO_ICMP:
1951 printf("ICMP ");
1952 break;
1953 case IPPROTO_ICMPV6:
1954 printf("ICMPV6 ");
1955 break;
1956 default:
1957 printf("%u ", sk->proto);
1958 break;
1959 }
1960 pf_print_sk_host(&sk->lan, sk->af_lan, sk->proto, sk->proto_variant);
1961 printf(" ");
1962 pf_print_sk_host(&sk->gwy, sk->af_gwy, sk->proto, sk->proto_variant);
1963 printf(" ");
1964 pf_print_sk_host(&sk->ext_lan, sk->af_lan, sk->proto,
1965 sk->proto_variant);
1966 printf(" ");
1967 pf_print_sk_host(&sk->ext_gwy, sk->af_gwy, sk->proto,
1968 sk->proto_variant);
1969 printf(" [lo=%u high=%u win=%u modulator=%u", s->src.seqlo,
1970 s->src.seqhi, s->src.max_win, s->src.seqdiff);
1971 if (s->src.wscale && s->dst.wscale) {
1972 printf(" wscale=%u", s->src.wscale & PF_WSCALE_MASK);
1973 }
1974 printf("]");
1975 printf(" [lo=%u high=%u win=%u modulator=%u", s->dst.seqlo,
1976 s->dst.seqhi, s->dst.max_win, s->dst.seqdiff);
1977 if (s->src.wscale && s->dst.wscale) {
1978 printf(" wscale=%u", s->dst.wscale & PF_WSCALE_MASK);
1979 }
1980 printf("]");
1981 printf(" %u:%u", s->src.state, s->dst.state);
1982 }
1983
1984 void
1985 pf_print_flags(u_int8_t f)
1986 {
1987 if (f) {
1988 printf(" ");
1989 }
1990 if (f & TH_FIN) {
1991 printf("F");
1992 }
1993 if (f & TH_SYN) {
1994 printf("S");
1995 }
1996 if (f & TH_RST) {
1997 printf("R");
1998 }
1999 if (f & TH_PUSH) {
2000 printf("P");
2001 }
2002 if (f & TH_ACK) {
2003 printf("A");
2004 }
2005 if (f & TH_URG) {
2006 printf("U");
2007 }
2008 if (f & TH_ECE) {
2009 printf("E");
2010 }
2011 if (f & TH_CWR) {
2012 printf("W");
2013 }
2014 }
2015
2016 #define PF_SET_SKIP_STEPS(i) \
2017 do { \
2018 while (head[i] != cur) { \
2019 head[i]->skip[i].ptr = cur; \
2020 head[i] = TAILQ_NEXT(head[i], entries); \
2021 } \
2022 } while (0)
2023
2024 void
2025 pf_calc_skip_steps(struct pf_rulequeue *rules)
2026 {
2027 struct pf_rule *cur, *prev, *head[PF_SKIP_COUNT];
2028 int i;
2029
2030 cur = TAILQ_FIRST(rules);
2031 prev = cur;
2032 for (i = 0; i < PF_SKIP_COUNT; ++i) {
2033 head[i] = cur;
2034 }
2035 while (cur != NULL) {
2036 if (cur->kif != prev->kif || cur->ifnot != prev->ifnot) {
2037 PF_SET_SKIP_STEPS(PF_SKIP_IFP);
2038 }
2039 if (cur->direction != prev->direction) {
2040 PF_SET_SKIP_STEPS(PF_SKIP_DIR);
2041 }
2042 if (cur->af != prev->af) {
2043 PF_SET_SKIP_STEPS(PF_SKIP_AF);
2044 }
2045 if (cur->proto != prev->proto) {
2046 PF_SET_SKIP_STEPS(PF_SKIP_PROTO);
2047 }
2048 if (cur->src.neg != prev->src.neg ||
2049 pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr)) {
2050 PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR);
2051 }
2052 {
2053 union pf_rule_xport *cx = &cur->src.xport;
2054 union pf_rule_xport *px = &prev->src.xport;
2055
2056 switch (cur->proto) {
2057 case IPPROTO_GRE:
2058 case IPPROTO_ESP:
2059 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT);
2060 break;
2061 default:
2062 if (prev->proto == IPPROTO_GRE ||
2063 prev->proto == IPPROTO_ESP ||
2064 cx->range.op != px->range.op ||
2065 cx->range.port[0] != px->range.port[0] ||
2066 cx->range.port[1] != px->range.port[1]) {
2067 PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT);
2068 }
2069 break;
2070 }
2071 }
2072 if (cur->dst.neg != prev->dst.neg ||
2073 pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr)) {
2074 PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR);
2075 }
2076 {
2077 union pf_rule_xport *cx = &cur->dst.xport;
2078 union pf_rule_xport *px = &prev->dst.xport;
2079
2080 switch (cur->proto) {
2081 case IPPROTO_GRE:
2082 if (cur->proto != prev->proto ||
2083 cx->call_id != px->call_id) {
2084 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
2085 }
2086 break;
2087 case IPPROTO_ESP:
2088 if (cur->proto != prev->proto ||
2089 cx->spi != px->spi) {
2090 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
2091 }
2092 break;
2093 default:
2094 if (prev->proto == IPPROTO_GRE ||
2095 prev->proto == IPPROTO_ESP ||
2096 cx->range.op != px->range.op ||
2097 cx->range.port[0] != px->range.port[0] ||
2098 cx->range.port[1] != px->range.port[1]) {
2099 PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
2100 }
2101 break;
2102 }
2103 }
2104
2105 prev = cur;
2106 cur = TAILQ_NEXT(cur, entries);
2107 }
2108 for (i = 0; i < PF_SKIP_COUNT; ++i) {
2109 PF_SET_SKIP_STEPS(i);
2110 }
2111 }
2112
2113 u_int32_t
2114 pf_calc_state_key_flowhash(struct pf_state_key *sk)
2115 {
2116 struct pf_flowhash_key fh __attribute__((aligned(8)));
2117 uint32_t flowhash = 0;
2118
2119 bzero(&fh, sizeof(fh));
2120 if (PF_ALEQ(&sk->lan.addr, &sk->ext_lan.addr, sk->af_lan)) {
2121 bcopy(&sk->lan.addr, &fh.ap1.addr, sizeof(fh.ap1.addr));
2122 bcopy(&sk->ext_lan.addr, &fh.ap2.addr, sizeof(fh.ap2.addr));
2123 } else {
2124 bcopy(&sk->ext_lan.addr, &fh.ap1.addr, sizeof(fh.ap1.addr));
2125 bcopy(&sk->lan.addr, &fh.ap2.addr, sizeof(fh.ap2.addr));
2126 }
2127 if (sk->lan.xport.spi <= sk->ext_lan.xport.spi) {
2128 fh.ap1.xport.spi = sk->lan.xport.spi;
2129 fh.ap2.xport.spi = sk->ext_lan.xport.spi;
2130 } else {
2131 fh.ap1.xport.spi = sk->ext_lan.xport.spi;
2132 fh.ap2.xport.spi = sk->lan.xport.spi;
2133 }
2134 fh.af = sk->af_lan;
2135 fh.proto = sk->proto;
2136
2137 try_again:
2138 flowhash = net_flowhash(&fh, sizeof(fh), pf_hash_seed);
2139 if (flowhash == 0) {
2140 /* try to get a non-zero flowhash */
2141 pf_hash_seed = RandomULong();
2142 goto try_again;
2143 }
2144
2145 return flowhash;
2146 }
2147
2148 static int
2149 pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2)
2150 {
2151 if (aw1->type != aw2->type) {
2152 return 1;
2153 }
2154 switch (aw1->type) {
2155 case PF_ADDR_ADDRMASK:
2156 case PF_ADDR_RANGE:
2157 if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, 0)) {
2158 return 1;
2159 }
2160 if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, 0)) {
2161 return 1;
2162 }
2163 return 0;
2164 case PF_ADDR_DYNIFTL:
2165 return aw1->p.dyn == NULL || aw2->p.dyn == NULL ||
2166 aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt;
2167 case PF_ADDR_NOROUTE:
2168 case PF_ADDR_URPFFAILED:
2169 return 0;
2170 case PF_ADDR_TABLE:
2171 return aw1->p.tbl != aw2->p.tbl;
2172 case PF_ADDR_RTLABEL:
2173 return aw1->v.rtlabel != aw2->v.rtlabel;
2174 default:
2175 printf("invalid address type: %d\n", aw1->type);
2176 return 1;
2177 }
2178 }
2179
2180 u_int16_t
2181 pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp)
2182 {
2183 return nat464_cksum_fixup(cksum, old, new, udp);
2184 }
2185
2186 /*
2187 * change ip address & port
2188 * dir : packet direction
2189 * a : address to be changed
2190 * p : port to be changed
2191 * ic : ip header checksum
2192 * pc : protocol checksum
2193 * an : new ip address
2194 * pn : new port
2195 * u : should be 1 if UDP packet else 0
2196 * af : address family of the packet
2197 * afn : address family of the new address
2198 * ua : should be 1 if ip address needs to be updated in the packet else
2199 * only the checksum is recalculated & updated.
2200 */
2201 static void
2202 pf_change_ap(int dir, pbuf_t *pbuf, struct pf_addr *a, u_int16_t *p,
2203 u_int16_t *ic, u_int16_t *pc, struct pf_addr *an, u_int16_t pn,
2204 u_int8_t u, sa_family_t af, sa_family_t afn, int ua)
2205 {
2206 struct pf_addr ao;
2207 u_int16_t po = *p;
2208
2209 PF_ACPY(&ao, a, af);
2210 if (ua) {
2211 PF_ACPY(a, an, afn);
2212 }
2213
2214 *p = pn;
2215
2216 switch (af) {
2217 #if INET
2218 case AF_INET:
2219 switch (afn) {
2220 case AF_INET:
2221 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
2222 ao.addr16[0], an->addr16[0], 0),
2223 ao.addr16[1], an->addr16[1], 0);
2224 *p = pn;
2225 /*
2226 * If the packet is originated from an ALG on the NAT gateway
2227 * (source address is loopback or local), in which case the
2228 * TCP/UDP checksum field contains the pseudo header checksum
2229 * that's not yet complemented.
2230 * In that case we do not need to fixup the checksum for port
2231 * translation as the pseudo header checksum doesn't include ports.
2232 *
2233 * A packet generated locally will have UDP/TCP CSUM flag
2234 * set (gets set in protocol output).
2235 *
2236 * It should be noted that the fixup doesn't do anything if the
2237 * checksum is 0.
2238 */
2239 if (dir == PF_OUT && pbuf != NULL &&
2240 (*pbuf->pb_csum_flags & (CSUM_TCP | CSUM_UDP))) {
2241 /* Pseudo-header checksum does not include ports */
2242 *pc = ~pf_cksum_fixup(pf_cksum_fixup(~*pc,
2243 ao.addr16[0], an->addr16[0], u),
2244 ao.addr16[1], an->addr16[1], u);
2245 } else {
2246 *pc =
2247 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2248 *pc, ao.addr16[0], an->addr16[0], u),
2249 ao.addr16[1], an->addr16[1], u),
2250 po, pn, u);
2251 }
2252 break;
2253 #ifdef INET6
2254 case AF_INET6:
2255 *p = pn;
2256 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2257 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2258
2259 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc,
2260 ao.addr16[0], an->addr16[0], u),
2261 ao.addr16[1], an->addr16[1], u),
2262 0, an->addr16[2], u),
2263 0, an->addr16[3], u),
2264 0, an->addr16[4], u),
2265 0, an->addr16[5], u),
2266 0, an->addr16[6], u),
2267 0, an->addr16[7], u),
2268 po, pn, u);
2269 break;
2270 #endif /* INET6 */
2271 }
2272 break;
2273 #endif /* INET */
2274 #if INET6
2275 case AF_INET6:
2276 switch (afn) {
2277 case AF_INET6:
2278 /*
2279 * If the packet is originated from an ALG on the NAT gateway
2280 * (source address is loopback or local), in which case the
2281 * TCP/UDP checksum field contains the pseudo header checksum
2282 * that's not yet complemented.
2283 * A packet generated locally
2284 * will have UDP/TCP CSUM flag set (gets set in protocol
2285 * output).
2286 */
2287 if (dir == PF_OUT && pbuf != NULL &&
2288 (*pbuf->pb_csum_flags & (CSUM_TCPIPV6 |
2289 CSUM_UDPIPV6))) {
2290 /* Pseudo-header checksum does not include ports */
2291 *pc =
2292 ~pf_cksum_fixup(pf_cksum_fixup(
2293 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2294 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2295 ~*pc,
2296 ao.addr16[0], an->addr16[0], u),
2297 ao.addr16[1], an->addr16[1], u),
2298 ao.addr16[2], an->addr16[2], u),
2299 ao.addr16[3], an->addr16[3], u),
2300 ao.addr16[4], an->addr16[4], u),
2301 ao.addr16[5], an->addr16[5], u),
2302 ao.addr16[6], an->addr16[6], u),
2303 ao.addr16[7], an->addr16[7], u);
2304 } else {
2305 *pc =
2306 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2307 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2308 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2309 *pc,
2310 ao.addr16[0], an->addr16[0], u),
2311 ao.addr16[1], an->addr16[1], u),
2312 ao.addr16[2], an->addr16[2], u),
2313 ao.addr16[3], an->addr16[3], u),
2314 ao.addr16[4], an->addr16[4], u),
2315 ao.addr16[5], an->addr16[5], u),
2316 ao.addr16[6], an->addr16[6], u),
2317 ao.addr16[7], an->addr16[7], u),
2318 po, pn, u);
2319 }
2320 break;
2321 #ifdef INET
2322 case AF_INET:
2323 *pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2324 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2325 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc,
2326 ao.addr16[0], an->addr16[0], u),
2327 ao.addr16[1], an->addr16[1], u),
2328 ao.addr16[2], 0, u),
2329 ao.addr16[3], 0, u),
2330 ao.addr16[4], 0, u),
2331 ao.addr16[5], 0, u),
2332 ao.addr16[6], 0, u),
2333 ao.addr16[7], 0, u),
2334 po, pn, u);
2335 break;
2336 #endif /* INET */
2337 }
2338 break;
2339 #endif /* INET6 */
2340 }
2341 }
2342
2343
2344 /* Changes a u_int32_t. Uses a void * so there are no align restrictions */
2345 void
2346 pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u)
2347 {
2348 u_int32_t ao;
2349
2350 memcpy(&ao, a, sizeof(ao));
2351 memcpy(a, &an, sizeof(u_int32_t));
2352 *c = pf_cksum_fixup(pf_cksum_fixup(*c, ao / 65536, an / 65536, u),
2353 ao % 65536, an % 65536, u);
2354 }
2355
2356 #if INET6
2357 static void
2358 pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u)
2359 {
2360 struct pf_addr ao;
2361
2362 PF_ACPY(&ao, a, AF_INET6);
2363 PF_ACPY(a, an, AF_INET6);
2364
2365 *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2366 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2367 pf_cksum_fixup(pf_cksum_fixup(*c,
2368 ao.addr16[0], an->addr16[0], u),
2369 ao.addr16[1], an->addr16[1], u),
2370 ao.addr16[2], an->addr16[2], u),
2371 ao.addr16[3], an->addr16[3], u),
2372 ao.addr16[4], an->addr16[4], u),
2373 ao.addr16[5], an->addr16[5], u),
2374 ao.addr16[6], an->addr16[6], u),
2375 ao.addr16[7], an->addr16[7], u);
2376 }
2377
2378 void
2379 pf_change_addr(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u,
2380 sa_family_t af, sa_family_t afn)
2381 {
2382 struct pf_addr ao;
2383
2384 if (af != afn) {
2385 PF_ACPY(&ao, a, af);
2386 PF_ACPY(a, an, afn);
2387 }
2388
2389 switch (af) {
2390 case AF_INET:
2391 switch (afn) {
2392 case AF_INET:
2393 pf_change_a(a, c, an->v4addr.s_addr, u);
2394 break;
2395 case AF_INET6:
2396 *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2397 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2398 pf_cksum_fixup(pf_cksum_fixup(*c,
2399 ao.addr16[0], an->addr16[0], u),
2400 ao.addr16[1], an->addr16[1], u),
2401 0, an->addr16[2], u),
2402 0, an->addr16[3], u),
2403 0, an->addr16[4], u),
2404 0, an->addr16[5], u),
2405 0, an->addr16[6], u),
2406 0, an->addr16[7], u);
2407 break;
2408 }
2409 break;
2410 case AF_INET6:
2411 switch (afn) {
2412 case AF_INET:
2413 *c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2414 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2415 pf_cksum_fixup(pf_cksum_fixup(*c,
2416 ao.addr16[0], an->addr16[0], u),
2417 ao.addr16[1], an->addr16[1], u),
2418 ao.addr16[2], 0, u),
2419 ao.addr16[3], 0, u),
2420 ao.addr16[4], 0, u),
2421 ao.addr16[5], 0, u),
2422 ao.addr16[6], 0, u),
2423 ao.addr16[7], 0, u);
2424 break;
2425 case AF_INET6:
2426 pf_change_a6(a, c, an, u);
2427 break;
2428 }
2429 break;
2430 }
2431 }
2432
2433 #endif /* INET6 */
2434
2435 static void
2436 pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa,
2437 struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c,
2438 u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af)
2439 {
2440 struct pf_addr oia, ooa;
2441
2442 PF_ACPY(&oia, ia, af);
2443 PF_ACPY(&ooa, oa, af);
2444
2445 /* Change inner protocol port, fix inner protocol checksum. */
2446 if (ip != NULL) {
2447 u_int16_t oip = *ip;
2448 u_int32_t opc = 0;
2449
2450 if (pc != NULL) {
2451 opc = *pc;
2452 }
2453 *ip = np;
2454 if (pc != NULL) {
2455 *pc = pf_cksum_fixup(*pc, oip, *ip, u);
2456 }
2457 *ic = pf_cksum_fixup(*ic, oip, *ip, 0);
2458 if (pc != NULL) {
2459 *ic = pf_cksum_fixup(*ic, opc, *pc, 0);
2460 }
2461 }
2462 /* Change inner ip address, fix inner ip and icmp checksums. */
2463 PF_ACPY(ia, na, af);
2464 switch (af) {
2465 #if INET
2466 case AF_INET: {
2467 u_int32_t oh2c = *h2c;
2468
2469 *h2c = pf_cksum_fixup(pf_cksum_fixup(*h2c,
2470 oia.addr16[0], ia->addr16[0], 0),
2471 oia.addr16[1], ia->addr16[1], 0);
2472 *ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
2473 oia.addr16[0], ia->addr16[0], 0),
2474 oia.addr16[1], ia->addr16[1], 0);
2475 *ic = pf_cksum_fixup(*ic, oh2c, *h2c, 0);
2476 break;
2477 }
2478 #endif /* INET */
2479 #if INET6
2480 case AF_INET6:
2481 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2482 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2483 pf_cksum_fixup(pf_cksum_fixup(*ic,
2484 oia.addr16[0], ia->addr16[0], u),
2485 oia.addr16[1], ia->addr16[1], u),
2486 oia.addr16[2], ia->addr16[2], u),
2487 oia.addr16[3], ia->addr16[3], u),
2488 oia.addr16[4], ia->addr16[4], u),
2489 oia.addr16[5], ia->addr16[5], u),
2490 oia.addr16[6], ia->addr16[6], u),
2491 oia.addr16[7], ia->addr16[7], u);
2492 break;
2493 #endif /* INET6 */
2494 }
2495 /* Change outer ip address, fix outer ip or icmpv6 checksum. */
2496 PF_ACPY(oa, na, af);
2497 switch (af) {
2498 #if INET
2499 case AF_INET:
2500 *hc = pf_cksum_fixup(pf_cksum_fixup(*hc,
2501 ooa.addr16[0], oa->addr16[0], 0),
2502 ooa.addr16[1], oa->addr16[1], 0);
2503 break;
2504 #endif /* INET */
2505 #if INET6
2506 case AF_INET6:
2507 *ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2508 pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
2509 pf_cksum_fixup(pf_cksum_fixup(*ic,
2510 ooa.addr16[0], oa->addr16[0], u),
2511 ooa.addr16[1], oa->addr16[1], u),
2512 ooa.addr16[2], oa->addr16[2], u),
2513 ooa.addr16[3], oa->addr16[3], u),
2514 ooa.addr16[4], oa->addr16[4], u),
2515 ooa.addr16[5], oa->addr16[5], u),
2516 ooa.addr16[6], oa->addr16[6], u),
2517 ooa.addr16[7], oa->addr16[7], u);
2518 break;
2519 #endif /* INET6 */
2520 }
2521 }
2522
2523
2524 /*
2525 * Need to modulate the sequence numbers in the TCP SACK option
2526 * (credits to Krzysztof Pfaff for report and patch)
2527 */
2528 static int
2529 pf_modulate_sack(pbuf_t *pbuf, int off, struct pf_pdesc *pd,
2530 struct tcphdr *th, struct pf_state_peer *dst)
2531 {
2532 int hlen = (th->th_off << 2) - sizeof(*th), thoptlen = hlen;
2533 u_int8_t opts[MAX_TCPOPTLEN], *opt = opts;
2534 int copyback = 0, i, olen;
2535 struct sackblk sack;
2536
2537 #define TCPOLEN_SACKLEN (TCPOLEN_SACK + 2)
2538 if (hlen < TCPOLEN_SACKLEN ||
2539 !pf_pull_hdr(pbuf, off + sizeof(*th), opts, hlen, NULL, NULL, pd->af)) {
2540 return 0;
2541 }
2542
2543 while (hlen >= TCPOLEN_SACKLEN) {
2544 olen = opt[1];
2545 switch (*opt) {
2546 case TCPOPT_EOL: /* FALLTHROUGH */
2547 case TCPOPT_NOP:
2548 opt++;
2549 hlen--;
2550 break;
2551 case TCPOPT_SACK:
2552 if (olen > hlen) {
2553 olen = hlen;
2554 }
2555 if (olen >= TCPOLEN_SACKLEN) {
2556 for (i = 2; i + TCPOLEN_SACK <= olen;
2557 i += TCPOLEN_SACK) {
2558 memcpy(&sack, &opt[i], sizeof(sack));
2559 pf_change_a(&sack.start, &th->th_sum,
2560 htonl(ntohl(sack.start) -
2561 dst->seqdiff), 0);
2562 pf_change_a(&sack.end, &th->th_sum,
2563 htonl(ntohl(sack.end) -
2564 dst->seqdiff), 0);
2565 memcpy(&opt[i], &sack, sizeof(sack));
2566 }
2567 copyback = off + sizeof(*th) + thoptlen;
2568 }
2569 /* FALLTHROUGH */
2570 default:
2571 if (olen < 2) {
2572 olen = 2;
2573 }
2574 hlen -= olen;
2575 opt += olen;
2576 }
2577 }
2578
2579 if (copyback) {
2580 if (pf_lazy_makewritable(pd, pbuf, copyback) == NULL) {
2581 return -1;
2582 }
2583 pbuf_copy_back(pbuf, off + sizeof(*th), thoptlen, opts);
2584 }
2585 return copyback;
2586 }
2587
2588 /*
2589 * XXX
2590 *
2591 * The following functions (pf_send_tcp and pf_send_icmp) are somewhat
2592 * special in that they originate "spurious" packets rather than
2593 * filter/NAT existing packets. As such, they're not a great fit for
2594 * the 'pbuf' shim, which assumes the underlying packet buffers are
2595 * allocated elsewhere.
2596 *
2597 * Since these functions are rarely used, we'll carry on allocating mbufs
2598 * and passing them to the IP stack for eventual routing.
2599 */
2600 static void
2601 pf_send_tcp(const struct pf_rule *r, sa_family_t af,
2602 const struct pf_addr *saddr, const struct pf_addr *daddr,
2603 u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack,
2604 u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl, int tag,
2605 u_int16_t rtag, struct ether_header *eh, struct ifnet *ifp)
2606 {
2607 #pragma unused(eh, ifp)
2608 struct mbuf *m;
2609 int len, tlen;
2610 #if INET
2611 struct ip *h = NULL;
2612 #endif /* INET */
2613 #if INET6
2614 struct ip6_hdr *h6 = NULL;
2615 #endif /* INET6 */
2616 struct tcphdr *th = NULL;
2617 char *opt;
2618 struct pf_mtag *pf_mtag;
2619
2620 /* maximum segment size tcp option */
2621 tlen = sizeof(struct tcphdr);
2622 if (mss) {
2623 tlen += 4;
2624 }
2625
2626 switch (af) {
2627 #if INET
2628 case AF_INET:
2629 len = sizeof(struct ip) + tlen;
2630 break;
2631 #endif /* INET */
2632 #if INET6
2633 case AF_INET6:
2634 len = sizeof(struct ip6_hdr) + tlen;
2635 break;
2636 #endif /* INET6 */
2637 default:
2638 panic("pf_send_tcp: not AF_INET or AF_INET6!");
2639 return;
2640 }
2641
2642 /* create outgoing mbuf */
2643 m = m_gethdr(M_DONTWAIT, MT_HEADER);
2644 if (m == NULL) {
2645 return;
2646 }
2647
2648 if ((pf_mtag = pf_get_mtag(m)) == NULL) {
2649 return;
2650 }
2651
2652 if (tag) {
2653 pf_mtag->pftag_flags |= PF_TAG_GENERATED;
2654 }
2655 pf_mtag->pftag_tag = rtag;
2656
2657 if (r != NULL && PF_RTABLEID_IS_VALID(r->rtableid)) {
2658 pf_mtag->pftag_rtableid = r->rtableid;
2659 }
2660
2661 #if PF_ECN
2662 /* add hints for ecn */
2663 pf_mtag->pftag_hdr = mtod(m, struct ip *);
2664 /* record address family */
2665 pf_mtag->pftag_flags &= ~(PF_TAG_HDR_INET | PF_TAG_HDR_INET6);
2666 switch (af) {
2667 #if INET
2668 case AF_INET:
2669 pf_mtag->pftag_flags |= PF_TAG_HDR_INET;
2670 break;
2671 #endif /* INET */
2672 #if INET6
2673 case AF_INET6:
2674 pf_mtag->pftag_flags |= PF_TAG_HDR_INET6;
2675 break;
2676 #endif /* INET6 */
2677 }
2678 #endif /* PF_ECN */
2679
2680 /* indicate this is TCP */
2681 m->m_pkthdr.pkt_proto = IPPROTO_TCP;
2682
2683 /* Make sure headers are 32-bit aligned */
2684 m->m_data += max_linkhdr;
2685 m->m_pkthdr.len = m->m_len = len;
2686 m->m_pkthdr.rcvif = NULL;
2687 bzero(m->m_data, len);
2688 switch (af) {
2689 #if INET
2690 case AF_INET:
2691 h = mtod(m, struct ip *);
2692
2693 /* IP header fields included in the TCP checksum */
2694 h->ip_p = IPPROTO_TCP;
2695 h->ip_len = htons(tlen);
2696 h->ip_src.s_addr = saddr->v4addr.s_addr;
2697 h->ip_dst.s_addr = daddr->v4addr.s_addr;
2698
2699 th = (struct tcphdr *)(void *)((caddr_t)h + sizeof(struct ip));
2700 break;
2701 #endif /* INET */
2702 #if INET6
2703 case AF_INET6:
2704 h6 = mtod(m, struct ip6_hdr *);
2705
2706 /* IP header fields included in the TCP checksum */
2707 h6->ip6_nxt = IPPROTO_TCP;
2708 h6->ip6_plen = htons(tlen);
2709 memcpy(&h6->ip6_src, &saddr->v6addr, sizeof(struct in6_addr));
2710 memcpy(&h6->ip6_dst, &daddr->v6addr, sizeof(struct in6_addr));
2711
2712 th = (struct tcphdr *)(void *)
2713 ((caddr_t)h6 + sizeof(struct ip6_hdr));
2714 break;
2715 #endif /* INET6 */
2716 }
2717
2718 /* TCP header */
2719 th->th_sport = sport;
2720 th->th_dport = dport;
2721 th->th_seq = htonl(seq);
2722 th->th_ack = htonl(ack);
2723 th->th_off = tlen >> 2;
2724 th->th_flags = flags;
2725 th->th_win = htons(win);
2726
2727 if (mss) {
2728 opt = (char *)(th + 1);
2729 opt[0] = TCPOPT_MAXSEG;
2730 opt[1] = 4;
2731 #if BYTE_ORDER != BIG_ENDIAN
2732 HTONS(mss);
2733 #endif
2734 bcopy((caddr_t)&mss, (caddr_t)(opt + 2), 2);
2735 }
2736
2737 switch (af) {
2738 #if INET
2739 case AF_INET: {
2740 struct route ro;
2741
2742 /* TCP checksum */
2743 th->th_sum = in_cksum(m, len);
2744
2745 /* Finish the IP header */
2746 h->ip_v = 4;
2747 h->ip_hl = sizeof(*h) >> 2;
2748 h->ip_tos = IPTOS_LOWDELAY;
2749 /*
2750 * ip_output() expects ip_len and ip_off to be in host order.
2751 */
2752 h->ip_len = len;
2753 h->ip_off = (path_mtu_discovery ? IP_DF : 0);
2754 h->ip_ttl = ttl ? ttl : ip_defttl;
2755 h->ip_sum = 0;
2756
2757 bzero(&ro, sizeof(ro));
2758 ip_output(m, NULL, &ro, 0, NULL, NULL);
2759 ROUTE_RELEASE(&ro);
2760 break;
2761 }
2762 #endif /* INET */
2763 #if INET6
2764 case AF_INET6: {
2765 struct route_in6 ro6;
2766
2767 /* TCP checksum */
2768 th->th_sum = in6_cksum(m, IPPROTO_TCP,
2769 sizeof(struct ip6_hdr), tlen);
2770
2771 h6->ip6_vfc |= IPV6_VERSION;
2772 h6->ip6_hlim = IPV6_DEFHLIM;
2773
2774 bzero(&ro6, sizeof(ro6));
2775 ip6_output(m, NULL, &ro6, 0, NULL, NULL, NULL);
2776 ROUTE_RELEASE(&ro6);
2777 break;
2778 }
2779 #endif /* INET6 */
2780 }
2781 }
2782
2783 static void
2784 pf_send_icmp(pbuf_t *pbuf, u_int8_t type, u_int8_t code, sa_family_t af,
2785 struct pf_rule *r)
2786 {
2787 struct mbuf *m0;
2788 struct pf_mtag *pf_mtag;
2789
2790 m0 = pbuf_clone_to_mbuf(pbuf);
2791 if (m0 == NULL) {
2792 return;
2793 }
2794
2795 if ((pf_mtag = pf_get_mtag(m0)) == NULL) {
2796 return;
2797 }
2798
2799 pf_mtag->pftag_flags |= PF_TAG_GENERATED;
2800
2801 if (PF_RTABLEID_IS_VALID(r->rtableid)) {
2802 pf_mtag->pftag_rtableid = r->rtableid;
2803 }
2804
2805 #if PF_ECN
2806 /* add hints for ecn */
2807 pf_mtag->pftag_hdr = mtod(m0, struct ip *);
2808 /* record address family */
2809 pf_mtag->pftag_flags &= ~(PF_TAG_HDR_INET | PF_TAG_HDR_INET6);
2810 switch (af) {
2811 #if INET
2812 case AF_INET:
2813 pf_mtag->pftag_flags |= PF_TAG_HDR_INET;
2814 m0->m_pkthdr.pkt_proto = IPPROTO_ICMP;
2815 break;
2816 #endif /* INET */
2817 #if INET6
2818 case AF_INET6:
2819 pf_mtag->pftag_flags |= PF_TAG_HDR_INET6;
2820 m0->m_pkthdr.pkt_proto = IPPROTO_ICMPV6;
2821 break;
2822 #endif /* INET6 */
2823 }
2824 #endif /* PF_ECN */
2825
2826 switch (af) {
2827 #if INET
2828 case AF_INET:
2829 icmp_error(m0, type, code, 0, 0);
2830 break;
2831 #endif /* INET */
2832 #if INET6
2833 case AF_INET6:
2834 icmp6_error(m0, type, code, 0);
2835 break;
2836 #endif /* INET6 */
2837 }
2838 }
2839
2840 /*
2841 * Return 1 if the addresses a and b match (with mask m), otherwise return 0.
2842 * If n is 0, they match if they are equal. If n is != 0, they match if they
2843 * are different.
2844 */
2845 int
2846 pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m,
2847 struct pf_addr *b, sa_family_t af)
2848 {
2849 int match = 0;
2850
2851 switch (af) {
2852 #if INET
2853 case AF_INET:
2854 if ((a->addr32[0] & m->addr32[0]) ==
2855 (b->addr32[0] & m->addr32[0])) {
2856 match++;
2857 }
2858 break;
2859 #endif /* INET */
2860 #if INET6
2861 case AF_INET6:
2862 if (((a->addr32[0] & m->addr32[0]) ==
2863 (b->addr32[0] & m->addr32[0])) &&
2864 ((a->addr32[1] & m->addr32[1]) ==
2865 (b->addr32[1] & m->addr32[1])) &&
2866 ((a->addr32[2] & m->addr32[2]) ==
2867 (b->addr32[2] & m->addr32[2])) &&
2868 ((a->addr32[3] & m->addr32[3]) ==
2869 (b->addr32[3] & m->addr32[3]))) {
2870 match++;
2871 }
2872 break;
2873 #endif /* INET6 */
2874 }
2875 if (match) {
2876 if (n) {
2877 return 0;
2878 } else {
2879 return 1;
2880 }
2881 } else {
2882 if (n) {
2883 return 1;
2884 } else {
2885 return 0;
2886 }
2887 }
2888 }
2889
2890 /*
2891 * Return 1 if b <= a <= e, otherwise return 0.
2892 */
2893 int
2894 pf_match_addr_range(struct pf_addr *b, struct pf_addr *e,
2895 struct pf_addr *a, sa_family_t af)
2896 {
2897 switch (af) {
2898 #if INET
2899 case AF_INET:
2900 if ((a->addr32[0] < b->addr32[0]) ||
2901 (a->addr32[0] > e->addr32[0])) {
2902 return 0;
2903 }
2904 break;
2905 #endif /* INET */
2906 #if INET6
2907 case AF_INET6: {
2908 int i;
2909
2910 /* check a >= b */
2911 for (i = 0; i < 4; ++i) {
2912 if (a->addr32[i] > b->addr32[i]) {
2913 break;
2914 } else if (a->addr32[i] < b->addr32[i]) {
2915 return 0;
2916 }
2917 }
2918 /* check a <= e */
2919 for (i = 0; i < 4; ++i) {
2920 if (a->addr32[i] < e->addr32[i]) {
2921 break;
2922 } else if (a->addr32[i] > e->addr32[i]) {
2923 return 0;
2924 }
2925 }
2926 break;
2927 }
2928 #endif /* INET6 */
2929 }
2930 return 1;
2931 }
2932
2933 int
2934 pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p)
2935 {
2936 switch (op) {
2937 case PF_OP_IRG:
2938 return (p > a1) && (p < a2);
2939 case PF_OP_XRG:
2940 return (p < a1) || (p > a2);
2941 case PF_OP_RRG:
2942 return (p >= a1) && (p <= a2);
2943 case PF_OP_EQ:
2944 return p == a1;
2945 case PF_OP_NE:
2946 return p != a1;
2947 case PF_OP_LT:
2948 return p < a1;
2949 case PF_OP_LE:
2950 return p <= a1;
2951 case PF_OP_GT:
2952 return p > a1;
2953 case PF_OP_GE:
2954 return p >= a1;
2955 }
2956 return 0; /* never reached */
2957 }
2958
2959 int
2960 pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p)
2961 {
2962 #if BYTE_ORDER != BIG_ENDIAN
2963 NTOHS(a1);
2964 NTOHS(a2);
2965 NTOHS(p);
2966 #endif
2967 return pf_match(op, a1, a2, p);
2968 }
2969
2970 int
2971 pf_match_xport(u_int8_t proto, u_int8_t proto_variant, union pf_rule_xport *rx,
2972 union pf_state_xport *sx)
2973 {
2974 int d = !0;
2975
2976 if (sx) {
2977 switch (proto) {
2978 case IPPROTO_GRE:
2979 if (proto_variant == PF_GRE_PPTP_VARIANT) {
2980 d = (rx->call_id == sx->call_id);
2981 }
2982 break;
2983
2984 case IPPROTO_ESP:
2985 d = (rx->spi == sx->spi);
2986 break;
2987
2988 case IPPROTO_TCP:
2989 case IPPROTO_UDP:
2990 case IPPROTO_ICMP:
2991 case IPPROTO_ICMPV6:
2992 if (rx->range.op) {
2993 d = pf_match_port(rx->range.op,
2994 rx->range.port[0], rx->range.port[1],
2995 sx->port);
2996 }
2997 break;
2998
2999 default:
3000 break;
3001 }
3002 }
3003
3004 return d;
3005 }
3006
3007 int
3008 pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u)
3009 {
3010 if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE) {
3011 return 0;
3012 }
3013 return pf_match(op, a1, a2, u);
3014 }
3015
3016 int
3017 pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g)
3018 {
3019 if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE) {
3020 return 0;
3021 }
3022 return pf_match(op, a1, a2, g);
3023 }
3024
3025 static int
3026 pf_match_tag(struct pf_rule *r, struct pf_mtag *pf_mtag,
3027 int *tag)
3028 {
3029 if (*tag == -1) {
3030 *tag = pf_mtag->pftag_tag;
3031 }
3032
3033 return (!r->match_tag_not && r->match_tag == *tag) ||
3034 (r->match_tag_not && r->match_tag != *tag);
3035 }
3036
3037 int
3038 pf_tag_packet(pbuf_t *pbuf, struct pf_mtag *pf_mtag, int tag,
3039 unsigned int rtableid, struct pf_pdesc *pd)
3040 {
3041 if (tag <= 0 && !PF_RTABLEID_IS_VALID(rtableid) &&
3042 (pd == NULL || !(pd->pktflags & PKTF_FLOW_ID))) {
3043 return 0;
3044 }
3045
3046 if (pf_mtag == NULL && (pf_mtag = pf_get_mtag_pbuf(pbuf)) == NULL) {
3047 return 1;
3048 }
3049
3050 if (tag > 0) {
3051 pf_mtag->pftag_tag = tag;
3052 }
3053 if (PF_RTABLEID_IS_VALID(rtableid)) {
3054 pf_mtag->pftag_rtableid = rtableid;
3055 }
3056 if (pd != NULL && (pd->pktflags & PKTF_FLOW_ID)) {
3057 *pbuf->pb_flowsrc = pd->flowsrc;
3058 *pbuf->pb_flowid = pd->flowhash;
3059 *pbuf->pb_flags |= pd->pktflags;
3060 *pbuf->pb_proto = pd->proto;
3061 }
3062
3063 return 0;
3064 }
3065
3066 void
3067 pf_step_into_anchor(int *depth, struct pf_ruleset **rs, int n,
3068 struct pf_rule **r, struct pf_rule **a, int *match)
3069 {
3070 struct pf_anchor_stackframe *f;
3071
3072 (*r)->anchor->match = 0;
3073 if (match) {
3074 *match = 0;
3075 }
3076 if (*depth >= (int)sizeof(pf_anchor_stack) /
3077 (int)sizeof(pf_anchor_stack[0])) {
3078 printf("pf_step_into_anchor: stack overflow\n");
3079 *r = TAILQ_NEXT(*r, entries);
3080 return;
3081 } else if (*depth == 0 && a != NULL) {
3082 *a = *r;
3083 }
3084 f = pf_anchor_stack + (*depth)++;
3085 f->rs = *rs;
3086 f->r = *r;
3087 if ((*r)->anchor_wildcard) {
3088 f->parent = &(*r)->anchor->children;
3089 if ((f->child = RB_MIN(pf_anchor_node, f->parent)) ==
3090 NULL) {
3091 *r = NULL;
3092 return;
3093 }
3094 *rs = &f->child->ruleset;
3095 } else {
3096 f->parent = NULL;
3097 f->child = NULL;
3098 *rs = &(*r)->anchor->ruleset;
3099 }
3100 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
3101 }
3102
3103 int
3104 pf_step_out_of_anchor(int *depth, struct pf_ruleset **rs, int n,
3105 struct pf_rule **r, struct pf_rule **a, int *match)
3106 {
3107 struct pf_anchor_stackframe *f;
3108 int quick = 0;
3109
3110 do {
3111 if (*depth <= 0) {
3112 break;
3113 }
3114 f = pf_anchor_stack + *depth - 1;
3115 if (f->parent != NULL && f->child != NULL) {
3116 if (f->child->match ||
3117 (match != NULL && *match)) {
3118 f->r->anchor->match = 1;
3119 if (match) {
3120 *match = 0;
3121 }
3122 }
3123 f->child = RB_NEXT(pf_anchor_node, f->parent, f->child);
3124 if (f->child != NULL) {
3125 *rs = &f->child->ruleset;
3126 *r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
3127 if (*r == NULL) {
3128 continue;
3129 } else {
3130 break;
3131 }
3132 }
3133 }
3134 (*depth)--;
3135 if (*depth == 0 && a != NULL) {
3136 *a = NULL;
3137 }
3138 *rs = f->rs;
3139 if (f->r->anchor->match || (match != NULL && *match)) {
3140 quick = f->r->quick;
3141 }
3142 *r = TAILQ_NEXT(f->r, entries);
3143 } while (*r == NULL);
3144
3145 return quick;
3146 }
3147
3148 #if INET6
3149 void
3150 pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr,
3151 struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af)
3152 {
3153 switch (af) {
3154 #if INET
3155 case AF_INET:
3156 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
3157 ((rmask->addr32[0] ^ 0xffffffff) & saddr->addr32[0]);
3158 break;
3159 #endif /* INET */
3160 case AF_INET6:
3161 naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
3162 ((rmask->addr32[0] ^ 0xffffffff) & saddr->addr32[0]);
3163 naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) |
3164 ((rmask->addr32[1] ^ 0xffffffff) & saddr->addr32[1]);
3165 naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) |
3166 ((rmask->addr32[2] ^ 0xffffffff) & saddr->addr32[2]);
3167 naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) |
3168 ((rmask->addr32[3] ^ 0xffffffff) & saddr->addr32[3]);
3169 break;
3170 }
3171 }
3172
3173 void
3174 pf_addr_inc(struct pf_addr *addr, sa_family_t af)
3175 {
3176 switch (af) {
3177 #if INET
3178 case AF_INET:
3179 addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1);
3180 break;
3181 #endif /* INET */
3182 case AF_INET6:
3183 if (addr->addr32[3] == 0xffffffff) {
3184 addr->addr32[3] = 0;
3185 if (addr->addr32[2] == 0xffffffff) {
3186 addr->addr32[2] = 0;
3187 if (addr->addr32[1] == 0xffffffff) {
3188 addr->addr32[1] = 0;
3189 addr->addr32[0] =
3190 htonl(ntohl(addr->addr32[0]) + 1);
3191 } else {
3192 addr->addr32[1] =
3193 htonl(ntohl(addr->addr32[1]) + 1);
3194 }
3195 } else {
3196 addr->addr32[2] =
3197 htonl(ntohl(addr->addr32[2]) + 1);
3198 }
3199 } else {
3200 addr->addr32[3] =
3201 htonl(ntohl(addr->addr32[3]) + 1);
3202 }
3203 break;
3204 }
3205 }
3206 #endif /* INET6 */
3207
3208 #define mix(a, b, c) \
3209 do { \
3210 a -= b; a -= c; a ^= (c >> 13); \
3211 b -= c; b -= a; b ^= (a << 8); \
3212 c -= a; c -= b; c ^= (b >> 13); \
3213 a -= b; a -= c; a ^= (c >> 12); \
3214 b -= c; b -= a; b ^= (a << 16); \
3215 c -= a; c -= b; c ^= (b >> 5); \
3216 a -= b; a -= c; a ^= (c >> 3); \
3217 b -= c; b -= a; b ^= (a << 10); \
3218 c -= a; c -= b; c ^= (b >> 15); \
3219 } while (0)
3220
3221 /*
3222 * hash function based on bridge_hash in if_bridge.c
3223 */
3224 static void
3225 pf_hash(struct pf_addr *inaddr, struct pf_addr *hash,
3226 struct pf_poolhashkey *key, sa_family_t af)
3227 {
3228 u_int32_t a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0];
3229
3230 switch (af) {
3231 #if INET
3232 case AF_INET:
3233 a += inaddr->addr32[0];
3234 b += key->key32[1];
3235 mix(a, b, c);
3236 hash->addr32[0] = c + key->key32[2];
3237 break;
3238 #endif /* INET */
3239 #if INET6
3240 case AF_INET6:
3241 a += inaddr->addr32[0];
3242 b += inaddr->addr32[2];
3243 mix(a, b, c);
3244 hash->addr32[0] = c;
3245 a += inaddr->addr32[1];
3246 b += inaddr->addr32[3];
3247 c += key->key32[1];
3248 mix(a, b, c);
3249 hash->addr32[1] = c;
3250 a += inaddr->addr32[2];
3251 b += inaddr->addr32[1];
3252 c += key->key32[2];
3253 mix(a, b, c);
3254 hash->addr32[2] = c;
3255 a += inaddr->addr32[3];
3256 b += inaddr->addr32[0];
3257 c += key->key32[3];
3258 mix(a, b, c);
3259 hash->addr32[3] = c;
3260 break;
3261 #endif /* INET6 */
3262 }
3263 }
3264
3265 static int
3266 pf_map_addr(sa_family_t af, struct pf_rule *r, struct pf_addr *saddr,
3267 struct pf_addr *naddr, struct pf_addr *init_addr, struct pf_src_node **sn)
3268 {
3269 unsigned char hash[16];
3270 struct pf_pool *rpool = &r->rpool;
3271 struct pf_addr *raddr = &rpool->cur->addr.v.a.addr;
3272 struct pf_addr *rmask = &rpool->cur->addr.v.a.mask;
3273 struct pf_pooladdr *acur = rpool->cur;
3274 struct pf_src_node k;
3275
3276 if (*sn == NULL && r->rpool.opts & PF_POOL_STICKYADDR &&
3277 (r->rpool.opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
3278 k.af = af;
3279 PF_ACPY(&k.addr, saddr, af);
3280 if (r->rule_flag & PFRULE_RULESRCTRACK ||
3281 r->rpool.opts & PF_POOL_STICKYADDR) {
3282 k.rule.ptr = r;
3283 } else {
3284 k.rule.ptr = NULL;
3285 }
3286 pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
3287 *sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k);
3288 if (*sn != NULL && !PF_AZERO(&(*sn)->raddr, rpool->af)) {
3289 PF_ACPY(naddr, &(*sn)->raddr, rpool->af);
3290 if (pf_status.debug >= PF_DEBUG_MISC) {
3291 printf("pf_map_addr: src tracking maps ");
3292 pf_print_host(&k.addr, 0, af);
3293 printf(" to ");
3294 pf_print_host(naddr, 0, rpool->af);
3295 printf("\n");
3296 }
3297 return 0;
3298 }
3299 }
3300
3301 if (rpool->cur->addr.type == PF_ADDR_NOROUTE) {
3302 return 1;
3303 }
3304 if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
3305 if (rpool->cur->addr.p.dyn == NULL) {
3306 return 1;
3307 }
3308 switch (rpool->af) {
3309 #if INET
3310 case AF_INET:
3311 if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 &&
3312 (rpool->opts & PF_POOL_TYPEMASK) !=
3313 PF_POOL_ROUNDROBIN) {
3314 return 1;
3315 }
3316 raddr = &rpool->cur->addr.p.dyn->pfid_addr4;
3317 rmask = &rpool->cur->addr.p.dyn->pfid_mask4;
3318 break;
3319 #endif /* INET */
3320 #if INET6
3321 case AF_INET6:
3322 if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 &&
3323 (rpool->opts & PF_POOL_TYPEMASK) !=
3324 PF_POOL_ROUNDROBIN) {
3325 return 1;
3326 }
3327 raddr = &rpool->cur->addr.p.dyn->pfid_addr6;
3328 rmask = &rpool->cur->addr.p.dyn->pfid_mask6;
3329 break;
3330 #endif /* INET6 */
3331 }
3332 } else if (rpool->cur->addr.type == PF_ADDR_TABLE) {
3333 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN) {
3334 return 1; /* unsupported */
3335 }
3336 } else {
3337 raddr = &rpool->cur->addr.v.a.addr;
3338 rmask = &rpool->cur->addr.v.a.mask;
3339 }
3340
3341 switch (rpool->opts & PF_POOL_TYPEMASK) {
3342 case PF_POOL_NONE:
3343 PF_ACPY(naddr, raddr, rpool->af);
3344 break;
3345 case PF_POOL_BITMASK:
3346 ASSERT(af == rpool->af);
3347 PF_POOLMASK(naddr, raddr, rmask, saddr, af);
3348 break;
3349 case PF_POOL_RANDOM:
3350 if (init_addr != NULL && PF_AZERO(init_addr, rpool->af)) {
3351 switch (af) {
3352 #if INET
3353 case AF_INET:
3354 rpool->counter.addr32[0] = htonl(random());
3355 break;
3356 #endif /* INET */
3357 #if INET6
3358 case AF_INET6:
3359 if (rmask->addr32[3] != 0xffffffff) {
3360 rpool->counter.addr32[3] =
3361 RandomULong();
3362 } else {
3363 break;
3364 }
3365 if (rmask->addr32[2] != 0xffffffff) {
3366 rpool->counter.addr32[2] =
3367 RandomULong();
3368 } else {
3369 break;
3370 }
3371 if (rmask->addr32[1] != 0xffffffff) {
3372 rpool->counter.addr32[1] =
3373 RandomULong();
3374 } else {
3375 break;
3376 }
3377 if (rmask->addr32[0] != 0xffffffff) {
3378 rpool->counter.addr32[0] =
3379 RandomULong();
3380 }
3381 break;
3382 #endif /* INET6 */
3383 }
3384 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter,
3385 rpool->af);
3386 PF_ACPY(init_addr, naddr, rpool->af);
3387 } else {
3388 PF_AINC(&rpool->counter, rpool->af);
3389 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter,
3390 rpool->af);
3391 }
3392 break;
3393 case PF_POOL_SRCHASH:
3394 ASSERT(af == rpool->af);
3395 PF_POOLMASK(naddr, raddr, rmask, saddr, af);
3396 pf_hash(saddr, (struct pf_addr *)(void *)&hash,
3397 &rpool->key, af);
3398 PF_POOLMASK(naddr, raddr, rmask,
3399 (struct pf_addr *)(void *)&hash, af);
3400 break;
3401 case PF_POOL_ROUNDROBIN:
3402 if (rpool->cur->addr.type == PF_ADDR_TABLE) {
3403 if (!pfr_pool_get(rpool->cur->addr.p.tbl,
3404 &rpool->tblidx, &rpool->counter,
3405 &raddr, &rmask, rpool->af)) {
3406 goto get_addr;
3407 }
3408 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
3409 if (rpool->cur->addr.p.dyn != NULL &&
3410 !pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
3411 &rpool->tblidx, &rpool->counter,
3412 &raddr, &rmask, af)) {
3413 goto get_addr;
3414 }
3415 } else if (pf_match_addr(0, raddr, rmask, &rpool->counter,
3416 rpool->af)) {
3417 goto get_addr;
3418 }
3419
3420 try_next:
3421 if ((rpool->cur = TAILQ_NEXT(rpool->cur, entries)) == NULL) {
3422 rpool->cur = TAILQ_FIRST(&rpool->list);
3423 }
3424 if (rpool->cur->addr.type == PF_ADDR_TABLE) {
3425 rpool->tblidx = -1;
3426 if (pfr_pool_get(rpool->cur->addr.p.tbl,
3427 &rpool->tblidx, &rpool->counter,
3428 &raddr, &rmask, rpool->af)) {
3429 /* table contains no address of type
3430 * 'rpool->af' */
3431 if (rpool->cur != acur) {
3432 goto try_next;
3433 }
3434 return 1;
3435 }
3436 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
3437 rpool->tblidx = -1;
3438 if (rpool->cur->addr.p.dyn == NULL) {
3439 return 1;
3440 }
3441 if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
3442 &rpool->tblidx, &rpool->counter,
3443 &raddr, &rmask, rpool->af)) {
3444 /* table contains no address of type
3445 * 'rpool->af' */
3446 if (rpool->cur != acur) {
3447 goto try_next;
3448 }
3449 return 1;
3450 }
3451 } else {
3452 raddr = &rpool->cur->addr.v.a.addr;
3453 rmask = &rpool->cur->addr.v.a.mask;
3454 PF_ACPY(&rpool->counter, raddr, rpool->af);
3455 }
3456
3457 get_addr:
3458 PF_ACPY(naddr, &rpool->counter, rpool->af);
3459 if (init_addr != NULL && PF_AZERO(init_addr, rpool->af)) {
3460 PF_ACPY(init_addr, naddr, rpool->af);
3461 }
3462 PF_AINC(&rpool->counter, rpool->af);
3463 break;
3464 }
3465 if (*sn != NULL) {
3466 PF_ACPY(&(*sn)->raddr, naddr, rpool->af);
3467 }
3468
3469 if (pf_status.debug >= PF_DEBUG_MISC &&
3470 (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
3471 printf("pf_map_addr: selected address ");
3472 pf_print_host(naddr, 0, rpool->af);
3473 printf("\n");
3474 }
3475
3476 return 0;
3477 }
3478
3479 static int
3480 pf_get_sport(struct pf_pdesc *pd, struct pfi_kif *kif, struct pf_rule *r,
3481 struct pf_addr *saddr, union pf_state_xport *sxport, struct pf_addr *daddr,
3482 union pf_state_xport *dxport, struct pf_addr *naddr,
3483 union pf_state_xport *nxport, struct pf_src_node **sn
3484 )
3485 {
3486 #pragma unused(kif)
3487 struct pf_state_key_cmp key;
3488 struct pf_addr init_addr;
3489 unsigned int cut;
3490 sa_family_t af = pd->af;
3491 u_int8_t proto = pd->proto;
3492 unsigned int low = r->rpool.proxy_port[0];
3493 unsigned int high = r->rpool.proxy_port[1];
3494
3495 bzero(&init_addr, sizeof(init_addr));
3496 if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn)) {
3497 return 1;
3498 }
3499
3500 if (proto == IPPROTO_ICMP) {
3501 low = 1;
3502 high = 65535;
3503 }
3504
3505 if (!nxport) {
3506 return 0; /* No output necessary. */
3507 }
3508 /*--- Special mapping rules for UDP ---*/
3509 if (proto == IPPROTO_UDP) {
3510 /*--- Never float IKE source port ---*/
3511 if (ntohs(sxport->port) == PF_IKE_PORT) {
3512 nxport->port = sxport->port;
3513 return 0;
3514 }
3515
3516 /*--- Apply exterior mapping options ---*/
3517 if (r->extmap > PF_EXTMAP_APD) {
3518 struct pf_state *s;
3519
3520 TAILQ_FOREACH(s, &state_list, entry_list) {
3521 struct pf_state_key *sk = s->state_key;
3522 if (!sk) {
3523 continue;
3524 }
3525 if (s->nat_rule.ptr != r) {
3526 continue;
3527 }
3528 if (sk->proto != IPPROTO_UDP ||
3529 sk->af_lan != af) {
3530 continue;
3531 }
3532 if (sk->lan.xport.port != sxport->port) {
3533 continue;
3534 }
3535 if (PF_ANEQ(&sk->lan.addr, saddr, af)) {
3536 continue;
3537 }
3538 if (r->extmap < PF_EXTMAP_EI &&
3539 PF_ANEQ(&sk->ext_lan.addr, daddr, af)) {
3540 continue;
3541 }
3542
3543 nxport->port = sk->gwy.xport.port;
3544 return 0;
3545 }
3546 }
3547 } else if (proto == IPPROTO_TCP) {
3548 struct pf_state* s;
3549 /*
3550 * APPLE MODIFICATION: <rdar://problem/6546358>
3551 * Fix allows....NAT to use a single binding for TCP session
3552 * with same source IP and source port
3553 */
3554 TAILQ_FOREACH(s, &state_list, entry_list) {
3555 struct pf_state_key* sk = s->state_key;
3556 if (!sk) {
3557 continue;
3558 }
3559 if (s->nat_rule.ptr != r) {
3560 continue;
3561 }
3562 if (sk->proto != IPPROTO_TCP || sk->af_lan != af) {
3563 continue;
3564 }
3565 if (sk->lan.xport.port != sxport->port) {
3566 continue;
3567 }
3568 if (!(PF_AEQ(&sk->lan.addr, saddr, af))) {
3569 continue;
3570 }
3571 nxport->port = sk->gwy.xport.port;
3572 return 0;
3573 }
3574 }
3575 do {
3576 key.af_gwy = af;
3577 key.proto = proto;
3578 PF_ACPY(&key.ext_gwy.addr, daddr, key.af_gwy);
3579 PF_ACPY(&key.gwy.addr, naddr, key.af_gwy);
3580 switch (proto) {
3581 case IPPROTO_UDP:
3582 key.proto_variant = r->extfilter;
3583 break;
3584 default:
3585 key.proto_variant = 0;
3586 break;
3587 }
3588 if (dxport) {
3589 key.ext_gwy.xport = *dxport;
3590 } else {
3591 memset(&key.ext_gwy.xport, 0,
3592 sizeof(key.ext_gwy.xport));
3593 }
3594 /*
3595 * port search; start random, step;
3596 * similar 2 portloop in in_pcbbind
3597 */
3598 if (!(proto == IPPROTO_TCP || proto == IPPROTO_UDP ||
3599 proto == IPPROTO_ICMP)) {
3600 if (dxport) {
3601 key.gwy.xport = *dxport;
3602 } else {
3603 memset(&key.gwy.xport, 0,
3604 sizeof(key.gwy.xport));
3605 }
3606 if (pf_find_state_all(&key, PF_IN, NULL) == NULL) {
3607 return 0;
3608 }
3609 } else if (low == 0 && high == 0) {
3610 key.gwy.xport = *nxport;
3611 if (pf_find_state_all(&key, PF_IN, NULL) == NULL
3612 ) {
3613 return 0;
3614 }
3615 } else if (low == high) {
3616 key.gwy.xport.port = htons(low);
3617 if (pf_find_state_all(&key, PF_IN, NULL) == NULL
3618 ) {
3619 nxport->port = htons(low);
3620 return 0;
3621 }
3622 } else {
3623 unsigned int tmp;
3624 if (low > high) {
3625 tmp = low;
3626 low = high;
3627 high = tmp;
3628 }
3629 /* low < high */
3630 cut = htonl(random()) % (1 + high - low) + low;
3631 /* low <= cut <= high */
3632 for (tmp = cut; tmp <= high; ++(tmp)) {
3633 key.gwy.xport.port = htons(tmp);
3634 if (pf_find_state_all(&key, PF_IN, NULL) == NULL
3635 ) {
3636 nxport->port = htons(tmp);
3637 return 0;
3638 }
3639 }
3640 for (tmp = cut - 1; tmp >= low; --(tmp)) {
3641 key.gwy.xport.port = htons(tmp);
3642 if (pf_find_state_all(&key, PF_IN, NULL) == NULL
3643 ) {
3644 nxport->port = htons(tmp);
3645 return 0;
3646 }
3647 }
3648 }
3649
3650 switch (r->rpool.opts & PF_POOL_TYPEMASK) {
3651 case PF_POOL_RANDOM:
3652 case PF_POOL_ROUNDROBIN:
3653 if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn)) {
3654 return 1;
3655 }
3656 break;
3657 case PF_POOL_NONE:
3658 case PF_POOL_SRCHASH:
3659 case PF_POOL_BITMASK:
3660 default:
3661 return 1;
3662 }
3663 } while (!PF_AEQ(&init_addr, naddr, af));
3664
3665 return 1; /* none available */
3666 }
3667
3668 static struct pf_rule *
3669 pf_match_translation(struct pf_pdesc *pd, pbuf_t *pbuf, int off,
3670 int direction, struct pfi_kif *kif, struct pf_addr *saddr,
3671 union pf_state_xport *sxport, struct pf_addr *daddr,
3672 union pf_state_xport *dxport, int rs_num)
3673 {
3674 struct pf_rule *r, *rm = NULL;
3675 struct pf_ruleset *ruleset = NULL;
3676 int tag = -1;
3677 unsigned int rtableid = IFSCOPE_NONE;
3678 int asd = 0;
3679
3680 r = TAILQ_FIRST(pf_main_ruleset.rules[rs_num].active.ptr);
3681 while (r && rm == NULL) {
3682 struct pf_rule_addr *src = NULL, *dst = NULL;
3683 struct pf_addr_wrap *xdst = NULL;
3684 struct pf_addr_wrap *xsrc = NULL;
3685 union pf_rule_xport rdrxport;
3686
3687 if (r->action == PF_BINAT && direction == PF_IN) {
3688 src = &r->dst;
3689 if (r->rpool.cur != NULL) {
3690 xdst = &r->rpool.cur->addr;
3691 }
3692 } else if (r->action == PF_RDR && direction == PF_OUT) {
3693 dst = &r->src;
3694 src = &r->dst;
3695 if (r->rpool.cur != NULL) {
3696 rdrxport.range.op = PF_OP_EQ;
3697 rdrxport.range.port[0] =
3698 htons(r->rpool.proxy_port[0]);
3699 xsrc = &r->rpool.cur->addr;
3700 }
3701 } else {
3702 src = &r->src;
3703 dst = &r->dst;
3704 }
3705
3706 r->evaluations++;
3707 if (pfi_kif_match(r->kif, kif) == r->ifnot) {
3708 r = r->skip[PF_SKIP_IFP].ptr;
3709 } else if (r->direction && r->direction != direction) {
3710 r = r->skip[PF_SKIP_DIR].ptr;
3711 } else if (r->af && r->af != pd->af) {
3712 r = r->skip[PF_SKIP_AF].ptr;
3713 } else if (r->proto && r->proto != pd->proto) {
3714 r = r->skip[PF_SKIP_PROTO].ptr;
3715 } else if (xsrc && PF_MISMATCHAW(xsrc, saddr, pd->af, 0, NULL)) {
3716 r = TAILQ_NEXT(r, entries);
3717 } else if (!xsrc && PF_MISMATCHAW(&src->addr, saddr, pd->af,
3718 src->neg, kif)) {
3719 r = TAILQ_NEXT(r, entries);
3720 } else if (xsrc && (!rdrxport.range.port[0] ||
3721 !pf_match_xport(r->proto, r->proto_variant, &rdrxport,
3722 sxport))) {
3723 r = TAILQ_NEXT(r, entries);
3724 } else if (!xsrc && !pf_match_xport(r->proto,
3725 r->proto_variant, &src->xport, sxport)) {
3726 r = r->skip[src == &r->src ? PF_SKIP_SRC_PORT :
3727 PF_SKIP_DST_PORT].ptr;
3728 } else if (dst != NULL &&
3729 PF_MISMATCHAW(&dst->addr, daddr, pd->af, dst->neg, NULL)) {
3730 r = r->skip[PF_SKIP_DST_ADDR].ptr;
3731 } else if (xdst != NULL && PF_MISMATCHAW(xdst, daddr, pd->af,
3732 0, NULL)) {
3733 r = TAILQ_NEXT(r, entries);
3734 } else if (dst && !pf_match_xport(r->proto, r->proto_variant,
3735 &dst->xport, dxport)) {
3736 r = r->skip[PF_SKIP_DST_PORT].ptr;
3737 } else if (r->match_tag && !pf_match_tag(r, pd->pf_mtag, &tag)) {
3738 r = TAILQ_NEXT(r, entries);
3739 } else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto !=
3740 IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, pbuf,
3741 off, pd->hdr.tcp), r->os_fingerprint))) {
3742 r = TAILQ_NEXT(r, entries);
3743 } else {
3744 if (r->tag) {
3745 tag = r->tag;
3746 }
3747 if (PF_RTABLEID_IS_VALID(r->rtableid)) {
3748 rtableid = r->rtableid;
3749 }
3750 if (r->anchor == NULL) {
3751 rm = r;
3752 } else {
3753 pf_step_into_anchor(&asd, &ruleset, rs_num,
3754 &r, NULL, NULL);
3755 }
3756 }
3757 if (r == NULL) {
3758 pf_step_out_of_anchor(&asd, &ruleset, rs_num, &r,
3759 NULL, NULL);
3760 }
3761 }
3762 if (pf_tag_packet(pbuf, pd->pf_mtag, tag, rtableid, NULL)) {
3763 return NULL;
3764 }
3765 if (rm != NULL && (rm->action == PF_NONAT ||
3766 rm->action == PF_NORDR || rm->action == PF_NOBINAT ||
3767 rm->action == PF_NONAT64)) {
3768 return NULL;
3769 }
3770 return rm;
3771 }
3772
3773 /*
3774 * Get address translation information for NAT/BINAT/RDR
3775 * pd : pf packet descriptor
3776 * pbuf : pbuf holding the packet
3777 * off : offset to protocol header
3778 * direction : direction of packet
3779 * kif : pf interface info obtained from the packet's recv interface
3780 * sn : source node pointer (output)
3781 * saddr : packet source address
3782 * sxport : packet source port
3783 * daddr : packet destination address
3784 * dxport : packet destination port
3785 * nsxport : translated source port (output)
3786 *
3787 * Translated source & destination address are updated in pd->nsaddr &
3788 * pd->ndaddr
3789 */
3790 static struct pf_rule *
3791 pf_get_translation_aux(struct pf_pdesc *pd, pbuf_t *pbuf, int off,
3792 int direction, struct pfi_kif *kif, struct pf_src_node **sn,
3793 struct pf_addr *saddr, union pf_state_xport *sxport, struct pf_addr *daddr,
3794 union pf_state_xport *dxport, union pf_state_xport *nsxport
3795 )
3796 {
3797 struct pf_rule *r = NULL;
3798 pd->naf = pd->af;
3799
3800 if (direction == PF_OUT) {
3801 r = pf_match_translation(pd, pbuf, off, direction, kif, saddr,
3802 sxport, daddr, dxport, PF_RULESET_BINAT);
3803 if (r == NULL) {
3804 r = pf_match_translation(pd, pbuf, off, direction, kif,
3805 saddr, sxport, daddr, dxport, PF_RULESET_RDR);
3806 }
3807 if (r == NULL) {
3808 r = pf_match_translation(pd, pbuf, off, direction, kif,
3809 saddr, sxport, daddr, dxport, PF_RULESET_NAT);
3810 }
3811 } else {
3812 r = pf_match_translation(pd, pbuf, off, direction, kif, saddr,
3813 sxport, daddr, dxport, PF_RULESET_RDR);
3814 if (r == NULL) {
3815 r = pf_match_translation(pd, pbuf, off, direction, kif,
3816 saddr, sxport, daddr, dxport, PF_RULESET_BINAT);
3817 }
3818 }
3819
3820 if (r != NULL) {
3821 struct pf_addr *nsaddr = &pd->naddr;
3822 struct pf_addr *ndaddr = &pd->ndaddr;
3823
3824 *nsaddr = *saddr;
3825 *ndaddr = *daddr;
3826
3827 switch (r->action) {
3828 case PF_NONAT:
3829 case PF_NONAT64:
3830 case PF_NOBINAT:
3831 case PF_NORDR:
3832 return NULL;
3833 case PF_NAT:
3834 case PF_NAT64:
3835 /*
3836 * we do NAT64 on incoming path and we call ip_input
3837 * which asserts receive interface to be not NULL.
3838 * The below check is to prevent NAT64 action on any
3839 * packet generated by local entity using synthesized
3840 * IPv6 address.
3841 */
3842 if ((r->action == PF_NAT64) && (direction == PF_OUT)) {
3843 return NULL;
3844 }
3845
3846 if (pf_get_sport(pd, kif, r, saddr, sxport, daddr,
3847 dxport, nsaddr, nsxport, sn
3848 )) {
3849 DPFPRINTF(PF_DEBUG_MISC,
3850 ("pf: NAT proxy port allocation "
3851 "(%u-%u) failed\n",
3852 r->rpool.proxy_port[0],
3853 r->rpool.proxy_port[1]));
3854 return NULL;
3855 }
3856 /*
3857 * For NAT64 the destination IPv4 address is derived
3858 * from the last 32 bits of synthesized IPv6 address
3859 */
3860 if (r->action == PF_NAT64) {
3861 ndaddr->v4addr.s_addr = daddr->addr32[3];
3862 pd->naf = AF_INET;
3863 }
3864 break;
3865 case PF_BINAT:
3866 switch (direction) {
3867 case PF_OUT:
3868 if (r->rpool.cur->addr.type ==
3869 PF_ADDR_DYNIFTL) {
3870 if (r->rpool.cur->addr.p.dyn == NULL) {
3871 return NULL;
3872 }
3873 switch (pd->af) {
3874 #if INET
3875 case AF_INET:
3876 if (r->rpool.cur->addr.p.dyn->
3877 pfid_acnt4 < 1) {
3878 return NULL;
3879 }
3880 PF_POOLMASK(nsaddr,
3881 &r->rpool.cur->addr.p.dyn->
3882 pfid_addr4,
3883 &r->rpool.cur->addr.p.dyn->
3884 pfid_mask4,
3885 saddr, AF_INET);
3886 break;
3887 #endif /* INET */
3888 #if INET6
3889 case AF_INET6:
3890 if (r->rpool.cur->addr.p.dyn->
3891 pfid_acnt6 < 1) {
3892 return NULL;
3893 }
3894 PF_POOLMASK(nsaddr,
3895 &r->rpool.cur->addr.p.dyn->
3896 pfid_addr6,
3897 &r->rpool.cur->addr.p.dyn->
3898 pfid_mask6,
3899 saddr, AF_INET6);
3900 break;
3901 #endif /* INET6 */
3902 }
3903 } else {
3904 PF_POOLMASK(nsaddr,
3905 &r->rpool.cur->addr.v.a.addr,
3906 &r->rpool.cur->addr.v.a.mask,
3907 saddr, pd->af);
3908 }
3909 break;
3910 case PF_IN:
3911 if (r->src.addr.type == PF_ADDR_DYNIFTL) {
3912 if (r->src.addr.p.dyn == NULL) {
3913 return NULL;
3914 }
3915 switch (pd->af) {
3916 #if INET
3917 case AF_INET:
3918 if (r->src.addr.p.dyn->
3919 pfid_acnt4 < 1) {
3920 return NULL;
3921 }
3922 PF_POOLMASK(ndaddr,
3923 &r->src.addr.p.dyn->
3924 pfid_addr4,
3925 &r->src.addr.p.dyn->
3926 pfid_mask4,
3927 daddr, AF_INET);
3928 break;
3929 #endif /* INET */
3930 #if INET6
3931 case AF_INET6:
3932 if (r->src.addr.p.dyn->
3933 pfid_acnt6 < 1) {
3934 return NULL;
3935 }
3936 PF_POOLMASK(ndaddr,
3937 &r->src.addr.p.dyn->
3938 pfid_addr6,
3939 &r->src.addr.p.dyn->
3940 pfid_mask6,
3941 daddr, AF_INET6);
3942 break;
3943 #endif /* INET6 */
3944 }
3945 } else {
3946 PF_POOLMASK(ndaddr,
3947 &r->src.addr.v.a.addr,
3948 &r->src.addr.v.a.mask, daddr,
3949 pd->af);
3950 }
3951 break;
3952 }
3953 break;
3954 case PF_RDR: {
3955 switch (direction) {
3956 case PF_OUT:
3957 if (r->dst.addr.type == PF_ADDR_DYNIFTL) {
3958 if (r->dst.addr.p.dyn == NULL) {
3959 return NULL;
3960 }
3961 switch (pd->af) {
3962 #if INET
3963 case AF_INET:
3964 if (r->dst.addr.p.dyn->
3965 pfid_acnt4 < 1) {
3966 return NULL;
3967 }
3968 PF_POOLMASK(nsaddr,
3969 &r->dst.addr.p.dyn->
3970 pfid_addr4,
3971 &r->dst.addr.p.dyn->
3972 pfid_mask4,
3973 daddr, AF_INET);
3974 break;
3975 #endif /* INET */
3976 #if INET6
3977 case AF_INET6:
3978 if (r->dst.addr.p.dyn->
3979 pfid_acnt6 < 1) {
3980 return NULL;
3981 }
3982 PF_POOLMASK(nsaddr,
3983 &r->dst.addr.p.dyn->
3984 pfid_addr6,
3985 &r->dst.addr.p.dyn->
3986 pfid_mask6,
3987 daddr, AF_INET6);
3988 break;
3989 #endif /* INET6 */
3990 }
3991 } else {
3992 PF_POOLMASK(nsaddr,
3993 &r->dst.addr.v.a.addr,
3994 &r->dst.addr.v.a.mask,
3995 daddr, pd->af);
3996 }
3997 if (nsxport && r->dst.xport.range.port[0]) {
3998 nsxport->port =
3999 r->dst.xport.range.port[0];
4000 }
4001 break;
4002 case PF_IN:
4003 if (pf_map_addr(pd->af, r, saddr,
4004 ndaddr, NULL, sn)) {
4005 return NULL;
4006 }
4007 if ((r->rpool.opts & PF_POOL_TYPEMASK) ==
4008 PF_POOL_BITMASK) {
4009 PF_POOLMASK(ndaddr, ndaddr,
4010 &r->rpool.cur->addr.v.a.mask, daddr,
4011 pd->af);
4012 }
4013
4014 if (nsxport && dxport) {
4015 if (r->rpool.proxy_port[1]) {
4016 u_int32_t tmp_nport;
4017
4018 tmp_nport =
4019 ((ntohs(dxport->port) -
4020 ntohs(r->dst.xport.range.
4021 port[0])) %
4022 (r->rpool.proxy_port[1] -
4023 r->rpool.proxy_port[0] +
4024 1)) + r->rpool.proxy_port[0];
4025
4026 /* wrap around if necessary */
4027 if (tmp_nport > 65535) {
4028 tmp_nport -= 65535;
4029 }
4030 nsxport->port =
4031 htons((u_int16_t)tmp_nport);
4032 } else if (r->rpool.proxy_port[0]) {
4033 nsxport->port = htons(r->rpool.
4034 proxy_port[0]);
4035 }
4036 }
4037 break;
4038 }
4039 break;
4040 }
4041 default:
4042 return NULL;
4043 }
4044 }
4045
4046 return r;
4047 }
4048
4049 int
4050 pf_socket_lookup(int direction, struct pf_pdesc *pd)
4051 {
4052 struct pf_addr *saddr, *daddr;
4053 u_int16_t sport, dport;
4054 struct inpcbinfo *pi;
4055 int inp = 0;
4056
4057 if (pd == NULL) {
4058 return -1;
4059 }
4060 pd->lookup.uid = UID_MAX;
4061 pd->lookup.gid = GID_MAX;
4062 pd->lookup.pid = NO_PID;
4063
4064 switch (pd->proto) {
4065 case IPPROTO_TCP:
4066 if (pd->hdr.tcp == NULL) {
4067 return -1;
4068 }
4069 sport = pd->hdr.tcp->th_sport;
4070 dport = pd->hdr.tcp->th_dport;
4071 pi = &tcbinfo;
4072 break;
4073 case IPPROTO_UDP:
4074 if (pd->hdr.udp == NULL) {
4075 return -1;
4076 }
4077 sport = pd->hdr.udp->uh_sport;
4078 dport = pd->hdr.udp->uh_dport;
4079 pi = &udbinfo;
4080 break;
4081 default:
4082 return -1;
4083 }
4084 if (direction == PF_IN) {
4085 saddr = pd->src;
4086 daddr = pd->dst;
4087 } else {
4088 u_int16_t p;
4089
4090 p = sport;
4091 sport = dport;
4092 dport = p;
4093 saddr = pd->dst;
4094 daddr = pd->src;
4095 }
4096 switch (pd->af) {
4097 #if INET
4098 case AF_INET:
4099 inp = in_pcblookup_hash_exists(pi, saddr->v4addr, sport, daddr->v4addr, dport,
4100 0, &pd->lookup.uid, &pd->lookup.gid, NULL);
4101 #if INET6
4102 if (inp == 0) {
4103 struct in6_addr s6, d6;
4104
4105 memset(&s6, 0, sizeof(s6));
4106 s6.s6_addr16[5] = htons(0xffff);
4107 memcpy(&s6.s6_addr32[3], &saddr->v4addr,
4108 sizeof(saddr->v4addr));
4109
4110 memset(&d6, 0, sizeof(d6));
4111 d6.s6_addr16[5] = htons(0xffff);
4112 memcpy(&d6.s6_addr32[3], &daddr->v4addr,
4113 sizeof(daddr->v4addr));
4114
4115 inp = in6_pcblookup_hash_exists(pi, &s6, sport,
4116 &d6, dport, 0, &pd->lookup.uid, &pd->lookup.gid, NULL);
4117 if (inp == 0) {
4118 inp = in_pcblookup_hash_exists(pi, saddr->v4addr, sport,
4119 daddr->v4addr, dport, INPLOOKUP_WILDCARD, &pd->lookup.uid, &pd->lookup.gid, NULL);
4120 if (inp == 0) {
4121 inp = in6_pcblookup_hash_exists(pi, &s6, sport,
4122 &d6, dport, INPLOOKUP_WILDCARD,
4123 &pd->lookup.uid, &pd->lookup.gid, NULL);
4124 if (inp == 0) {
4125 return -1;
4126 }
4127 }
4128 }
4129 }
4130 #else
4131 if (inp == 0) {
4132 inp = in_pcblookup_hash_exists(pi, saddr->v4addr, sport,
4133 daddr->v4addr, dport, INPLOOKUP_WILDCARD,
4134 &pd->lookup.uid, &pd->lookup.gid, NULL);
4135 if (inp == 0) {
4136 return -1;
4137 }
4138 }
4139 #endif /* !INET6 */
4140 break;
4141 #endif /* INET */
4142 #if INET6
4143 case AF_INET6:
4144 inp = in6_pcblookup_hash_exists(pi, &saddr->v6addr, sport, &daddr->v6addr,
4145 dport, 0, &pd->lookup.uid, &pd->lookup.gid, NULL);
4146 if (inp == 0) {
4147 inp = in6_pcblookup_hash_exists(pi, &saddr->v6addr, sport,
4148 &daddr->v6addr, dport, INPLOOKUP_WILDCARD,
4149 &pd->lookup.uid, &pd->lookup.gid, NULL);
4150 if (inp == 0) {
4151 return -1;
4152 }
4153 }
4154 break;
4155 #endif /* INET6 */
4156
4157 default:
4158 return -1;
4159 }
4160
4161 return 1;
4162 }
4163
4164 static u_int8_t
4165 pf_get_wscale(pbuf_t *pbuf, int off, u_int16_t th_off, sa_family_t af)
4166 {
4167 int hlen;
4168 u_int8_t hdr[60];
4169 u_int8_t *opt, optlen;
4170 u_int8_t wscale = 0;
4171
4172 hlen = th_off << 2; /* hlen <= sizeof (hdr) */
4173 if (hlen <= (int)sizeof(struct tcphdr)) {
4174 return 0;
4175 }
4176 if (!pf_pull_hdr(pbuf, off, hdr, hlen, NULL, NULL, af)) {
4177 return 0;
4178 }
4179 opt = hdr + sizeof(struct tcphdr);
4180 hlen -= sizeof(struct tcphdr);
4181 while (hlen >= 3) {
4182 switch (*opt) {
4183 case TCPOPT_EOL:
4184 case TCPOPT_NOP:
4185 ++opt;
4186 --hlen;
4187 break;
4188 case TCPOPT_WINDOW:
4189 wscale = opt[2];
4190 if (wscale > TCP_MAX_WINSHIFT) {
4191 wscale = TCP_MAX_WINSHIFT;
4192 }
4193 wscale |= PF_WSCALE_FLAG;
4194 /* FALLTHROUGH */
4195 default:
4196 optlen = opt[1];
4197 if (optlen < 2) {
4198 optlen = 2;
4199 }
4200 hlen -= optlen;
4201 opt += optlen;
4202 break;
4203 }
4204 }
4205 return wscale;
4206 }
4207
4208 static u_int16_t
4209 pf_get_mss(pbuf_t *pbuf, int off, u_int16_t th_off, sa_family_t af)
4210 {
4211 int hlen;
4212 u_int8_t hdr[60];
4213 u_int8_t *opt, optlen;
4214 u_int16_t mss = tcp_mssdflt;
4215
4216 hlen = th_off << 2; /* hlen <= sizeof (hdr) */
4217 if (hlen <= (int)sizeof(struct tcphdr)) {
4218 return 0;
4219 }
4220 if (!pf_pull_hdr(pbuf, off, hdr, hlen, NULL, NULL, af)) {
4221 return 0;
4222 }
4223 opt = hdr + sizeof(struct tcphdr);
4224 hlen -= sizeof(struct tcphdr);
4225 while (hlen >= TCPOLEN_MAXSEG) {
4226 switch (*opt) {
4227 case TCPOPT_EOL:
4228 case TCPOPT_NOP:
4229 ++opt;
4230 --hlen;
4231 break;
4232 case TCPOPT_MAXSEG:
4233 bcopy((caddr_t)(opt + 2), (caddr_t)&mss, 2);
4234 #if BYTE_ORDER != BIG_ENDIAN
4235 NTOHS(mss);
4236 #endif
4237 /* FALLTHROUGH */
4238 default:
4239 optlen = opt[1];
4240 if (optlen < 2) {
4241 optlen = 2;
4242 }
4243 hlen -= optlen;
4244 opt += optlen;
4245 break;
4246 }
4247 }
4248 return mss;
4249 }
4250
4251 static u_int16_t
4252 pf_calc_mss(struct pf_addr *addr, sa_family_t af, u_int16_t offer)
4253 {
4254 #if INET
4255 struct sockaddr_in *dst;
4256 struct route ro;
4257 #endif /* INET */
4258 #if INET6
4259 struct sockaddr_in6 *dst6;
4260 struct route_in6 ro6;
4261 #endif /* INET6 */
4262 struct rtentry *rt = NULL;
4263 int hlen;
4264 u_int16_t mss = tcp_mssdflt;
4265
4266 switch (af) {
4267 #if INET
4268 case AF_INET:
4269 hlen = sizeof(struct ip);
4270 bzero(&ro, sizeof(ro));
4271 dst = (struct sockaddr_in *)(void *)&ro.ro_dst;
4272 dst->sin_family = AF_INET;
4273 dst->sin_len = sizeof(*dst);
4274 dst->sin_addr = addr->v4addr;
4275 rtalloc(&ro);
4276 rt = ro.ro_rt;
4277 break;
4278 #endif /* INET */
4279 #if INET6
4280 case AF_INET6:
4281 hlen = sizeof(struct ip6_hdr);
4282 bzero(&ro6, sizeof(ro6));
4283 dst6 = (struct sockaddr_in6 *)(void *)&ro6.ro_dst;
4284 dst6->sin6_family = AF_INET6;
4285 dst6->sin6_len = sizeof(*dst6);
4286 dst6->sin6_addr = addr->v6addr;
4287 rtalloc((struct route *)&ro);
4288 rt = ro6.ro_rt;
4289 break;
4290 #endif /* INET6 */
4291 default:
4292 panic("pf_calc_mss: not AF_INET or AF_INET6!");
4293 return 0;
4294 }
4295
4296 if (rt && rt->rt_ifp) {
4297 /* This is relevant only for PF SYN Proxy */
4298 int interface_mtu = rt->rt_ifp->if_mtu;
4299
4300 if (af == AF_INET &&
4301 INTF_ADJUST_MTU_FOR_CLAT46(rt->rt_ifp)) {
4302 interface_mtu = IN6_LINKMTU(rt->rt_ifp);
4303 /* Further adjust the size for CLAT46 expansion */
4304 interface_mtu -= CLAT46_HDR_EXPANSION_OVERHD;
4305 }
4306 mss = interface_mtu - hlen - sizeof(struct tcphdr);
4307 mss = max(tcp_mssdflt, mss);
4308 rtfree(rt);
4309 }
4310 mss = min(mss, offer);
4311 mss = max(mss, 64); /* sanity - at least max opt space */
4312 return mss;
4313 }
4314
4315 static void
4316 pf_set_rt_ifp(struct pf_state *s, struct pf_addr *saddr, sa_family_t af)
4317 {
4318 struct pf_rule *r = s->rule.ptr;
4319
4320 s->rt_kif = NULL;
4321
4322 if (!r->rt || r->rt == PF_FASTROUTE) {
4323 return;
4324 }
4325 if ((af == AF_INET) || (af == AF_INET6)) {
4326 pf_map_addr(af, r, saddr, &s->rt_addr, NULL,
4327 &s->nat_src_node);
4328 s->rt_kif = r->rpool.cur->kif;
4329 }
4330
4331 return;
4332 }
4333
4334 static void
4335 pf_attach_state(struct pf_state_key *sk, struct pf_state *s, int tail)
4336 {
4337 s->state_key = sk;
4338 sk->refcnt++;
4339
4340 /* list is sorted, if-bound states before floating */
4341 if (tail) {
4342 TAILQ_INSERT_TAIL(&sk->states, s, next);
4343 } else {
4344 TAILQ_INSERT_HEAD(&sk->states, s, next);
4345 }
4346 }
4347
4348 static void
4349 pf_detach_state(struct pf_state *s, int flags)
4350 {
4351 struct pf_state_key *sk = s->state_key;
4352
4353 if (sk == NULL) {
4354 return;
4355 }
4356
4357 s->state_key = NULL;
4358 TAILQ_REMOVE(&sk->states, s, next);
4359 if (--sk->refcnt == 0) {
4360 if (!(flags & PF_DT_SKIP_EXTGWY)) {
4361 RB_REMOVE(pf_state_tree_ext_gwy,
4362 &pf_statetbl_ext_gwy, sk);
4363 }
4364 if (!(flags & PF_DT_SKIP_LANEXT)) {
4365 RB_REMOVE(pf_state_tree_lan_ext,
4366 &pf_statetbl_lan_ext, sk);
4367 }
4368 if (sk->app_state) {
4369 pool_put(&pf_app_state_pl, sk->app_state);
4370 }
4371 pool_put(&pf_state_key_pl, sk);
4372 }
4373 }
4374
4375 struct pf_state_key *
4376 pf_alloc_state_key(struct pf_state *s, struct pf_state_key *psk)
4377 {
4378 struct pf_state_key *sk;
4379
4380 if ((sk = pool_get(&pf_state_key_pl, PR_WAITOK)) == NULL) {
4381 return NULL;
4382 }
4383 bzero(sk, sizeof(*sk));
4384 TAILQ_INIT(&sk->states);
4385 pf_attach_state(sk, s, 0);
4386
4387 /* initialize state key from psk, if provided */
4388 if (psk != NULL) {
4389 bcopy(&psk->lan, &sk->lan, sizeof(sk->lan));
4390 bcopy(&psk->gwy, &sk->gwy, sizeof(sk->gwy));
4391 bcopy(&psk->ext_lan, &sk->ext_lan, sizeof(sk->ext_lan));
4392 bcopy(&psk->ext_gwy, &sk->ext_gwy, sizeof(sk->ext_gwy));
4393 sk->af_lan = psk->af_lan;
4394 sk->af_gwy = psk->af_gwy;
4395 sk->proto = psk->proto;
4396 sk->direction = psk->direction;
4397 sk->proto_variant = psk->proto_variant;
4398 VERIFY(psk->app_state == NULL);
4399 sk->flowsrc = psk->flowsrc;
4400 sk->flowhash = psk->flowhash;
4401 /* don't touch tree entries, states and refcnt on sk */
4402 }
4403
4404 return sk;
4405 }
4406
4407 static u_int32_t
4408 pf_tcp_iss(struct pf_pdesc *pd)
4409 {
4410 MD5_CTX ctx;
4411 u_int32_t digest[4];
4412
4413 if (pf_tcp_secret_init == 0) {
4414 read_frandom(pf_tcp_secret, sizeof(pf_tcp_secret));
4415 MD5Init(&pf_tcp_secret_ctx);
4416 MD5Update(&pf_tcp_secret_ctx, pf_tcp_secret,
4417 sizeof(pf_tcp_secret));
4418 pf_tcp_secret_init = 1;
4419 }
4420 ctx = pf_tcp_secret_ctx;
4421
4422 MD5Update(&ctx, (char *)&pd->hdr.tcp->th_sport, sizeof(u_short));
4423 MD5Update(&ctx, (char *)&pd->hdr.tcp->th_dport, sizeof(u_short));
4424 if (pd->af == AF_INET6) {
4425 MD5Update(&ctx, (char *)&pd->src->v6addr, sizeof(struct in6_addr));
4426 MD5Update(&ctx, (char *)&pd->dst->v6addr, sizeof(struct in6_addr));
4427 } else {
4428 MD5Update(&ctx, (char *)&pd->src->v4addr, sizeof(struct in_addr));
4429 MD5Update(&ctx, (char *)&pd->dst->v4addr, sizeof(struct in_addr));
4430 }
4431 MD5Final((u_char *)digest, &ctx);
4432 pf_tcp_iss_off += 4096;
4433 return digest[0] + random() + pf_tcp_iss_off;
4434 }
4435
4436 /*
4437 * This routine is called to perform address family translation on the
4438 * inner IP header (that may come as payload) of an ICMP(v4addr/6) error
4439 * response.
4440 */
4441 static int
4442 pf_change_icmp_af(pbuf_t *pbuf, int off,
4443 struct pf_pdesc *pd, struct pf_pdesc *pd2, struct pf_addr *src,
4444 struct pf_addr *dst, sa_family_t af, sa_family_t naf)
4445 {
4446 struct ip *ip4 = NULL;
4447 struct ip6_hdr *ip6 = NULL;
4448 void *hdr;
4449 int hlen, olen;
4450
4451 if (af == naf || (af != AF_INET && af != AF_INET6) ||
4452 (naf != AF_INET && naf != AF_INET6)) {
4453 return -1;
4454 }
4455
4456 /* old header */
4457 olen = pd2->off - off;
4458 /* new header */
4459 hlen = naf == AF_INET ? sizeof(*ip4) : sizeof(*ip6);
4460
4461 /* Modify the pbuf to accommodate the new header */
4462 hdr = pbuf_resize_segment(pbuf, off, olen, hlen);
4463 if (hdr == NULL) {
4464 return -1;
4465 }
4466
4467 /* translate inner ip/ip6 header */
4468 switch (naf) {
4469 case AF_INET:
4470 ip4 = hdr;
4471 bzero(ip4, sizeof(*ip4));
4472 ip4->ip_v = IPVERSION;
4473 ip4->ip_hl = sizeof(*ip4) >> 2;
4474 ip4->ip_len = htons(sizeof(*ip4) + pd2->tot_len - olen);
4475 ip4->ip_id = rfc6864 ? 0 : htons(ip_randomid());
4476 ip4->ip_off = htons(IP_DF);
4477 ip4->ip_ttl = pd2->ttl;
4478 if (pd2->proto == IPPROTO_ICMPV6) {
4479 ip4->ip_p = IPPROTO_ICMP;
4480 } else {
4481 ip4->ip_p = pd2->proto;
4482 }
4483 ip4->ip_src = src->v4addr;
4484 ip4->ip_dst = dst->v4addr;
4485 ip4->ip_sum = pbuf_inet_cksum(pbuf, 0, 0, ip4->ip_hl << 2);
4486 break;
4487 case AF_INET6:
4488 ip6 = hdr;
4489 bzero(ip6, sizeof(*ip6));
4490 ip6->ip6_vfc = IPV6_VERSION;
4491 ip6->ip6_plen = htons(pd2->tot_len - olen);
4492 if (pd2->proto == IPPROTO_ICMP) {
4493 ip6->ip6_nxt = IPPROTO_ICMPV6;
4494 } else {
4495 ip6->ip6_nxt = pd2->proto;
4496 }
4497 if (!pd2->ttl || pd2->ttl > IPV6_DEFHLIM) {
4498 ip6->ip6_hlim = IPV6_DEFHLIM;
4499 } else {
4500 ip6->ip6_hlim = pd2->ttl;
4501 }
4502 ip6->ip6_src = src->v6addr;
4503 ip6->ip6_dst = dst->v6addr;
4504 break;
4505 }
4506
4507 /* adjust payload offset and total packet length */
4508 pd2->off += hlen - olen;
4509 pd->tot_len += hlen - olen;
4510
4511 return 0;
4512 }
4513
4514 #define PTR_IP(field) ((int32_t)offsetof(struct ip, field))
4515 #define PTR_IP6(field) ((int32_t)offsetof(struct ip6_hdr, field))
4516
4517 static int
4518 pf_translate_icmp_af(int af, void *arg)
4519 {
4520 struct icmp *icmp4;
4521 struct icmp6_hdr *icmp6;
4522 u_int32_t mtu;
4523 int32_t ptr = -1;
4524 u_int8_t type;
4525 u_int8_t code;
4526
4527 switch (af) {
4528 case AF_INET:
4529 icmp6 = arg;
4530 type = icmp6->icmp6_type;
4531 code = icmp6->icmp6_code;
4532 mtu = ntohl(icmp6->icmp6_mtu);
4533
4534 switch (type) {
4535 case ICMP6_ECHO_REQUEST:
4536 type = ICMP_ECHO;
4537 break;
4538 case ICMP6_ECHO_REPLY:
4539 type = ICMP_ECHOREPLY;
4540 break;
4541 case ICMP6_DST_UNREACH:
4542 type = ICMP_UNREACH;
4543 switch (code) {
4544 case ICMP6_DST_UNREACH_NOROUTE:
4545 case ICMP6_DST_UNREACH_BEYONDSCOPE:
4546 case ICMP6_DST_UNREACH_ADDR:
4547 code = ICMP_UNREACH_HOST;
4548 break;
4549 case ICMP6_DST_UNREACH_ADMIN:
4550 code = ICMP_UNREACH_HOST_PROHIB;
4551 break;
4552 case ICMP6_DST_UNREACH_NOPORT:
4553 code = ICMP_UNREACH_PORT;
4554 break;
4555 default:
4556 return -1;
4557 }
4558 break;
4559 case ICMP6_PACKET_TOO_BIG:
4560 type = ICMP_UNREACH;
4561 code = ICMP_UNREACH_NEEDFRAG;
4562 mtu -= 20;
4563 break;
4564 case ICMP6_TIME_EXCEEDED:
4565 type = ICMP_TIMXCEED;
4566 break;
4567 case ICMP6_PARAM_PROB:
4568 switch (code) {
4569 case ICMP6_PARAMPROB_HEADER:
4570 type = ICMP_PARAMPROB;
4571 code = ICMP_PARAMPROB_ERRATPTR;
4572 ptr = ntohl(icmp6->icmp6_pptr);
4573
4574 if (ptr == PTR_IP6(ip6_vfc)) {
4575 ; /* preserve */
4576 } else if (ptr == PTR_IP6(ip6_vfc) + 1) {
4577 ptr = PTR_IP(ip_tos);
4578 } else if (ptr == PTR_IP6(ip6_plen) ||
4579 ptr == PTR_IP6(ip6_plen) + 1) {
4580 ptr = PTR_IP(ip_len);
4581 } else if (ptr == PTR_IP6(ip6_nxt)) {
4582 ptr = PTR_IP(ip_p);
4583 } else if (ptr == PTR_IP6(ip6_hlim)) {
4584 ptr = PTR_IP(ip_ttl);
4585 } else if (ptr >= PTR_IP6(ip6_src) &&
4586 ptr < PTR_IP6(ip6_dst)) {
4587 ptr = PTR_IP(ip_src);
4588 } else if (ptr >= PTR_IP6(ip6_dst) &&
4589 ptr < (int32_t)sizeof(struct ip6_hdr)) {
4590 ptr = PTR_IP(ip_dst);
4591 } else {
4592 return -1;
4593 }
4594 break;
4595 case ICMP6_PARAMPROB_NEXTHEADER:
4596 type = ICMP_UNREACH;
4597 code = ICMP_UNREACH_PROTOCOL;
4598 break;
4599 default:
4600 return -1;
4601 }
4602 break;
4603 default:
4604 return -1;
4605 }
4606 icmp6->icmp6_type = type;
4607 icmp6->icmp6_code = code;
4608 /* aligns well with a icmpv4 nextmtu */
4609 icmp6->icmp6_mtu = htonl(mtu);
4610 /* icmpv4 pptr is a one most significant byte */
4611 if (ptr >= 0) {
4612 icmp6->icmp6_pptr = htonl(ptr << 24);
4613 }
4614 break;
4615
4616 case AF_INET6:
4617 icmp4 = arg;
4618 type = icmp4->icmp_type;
4619 code = icmp4->icmp_code;
4620 mtu = ntohs(icmp4->icmp_nextmtu);
4621
4622 switch (type) {
4623 case ICMP_ECHO:
4624 type = ICMP6_ECHO_REQUEST;
4625 break;
4626 case ICMP_ECHOREPLY:
4627 type = ICMP6_ECHO_REPLY;
4628 break;
4629 case ICMP_UNREACH:
4630 type = ICMP6_DST_UNREACH;
4631 switch (code) {
4632 case ICMP_UNREACH_NET:
4633 case ICMP_UNREACH_HOST:
4634 case ICMP_UNREACH_NET_UNKNOWN:
4635 case ICMP_UNREACH_HOST_UNKNOWN:
4636 case ICMP_UNREACH_ISOLATED:
4637 case ICMP_UNREACH_TOSNET:
4638 case ICMP_UNREACH_TOSHOST:
4639 code = ICMP6_DST_UNREACH_NOROUTE;
4640 break;
4641 case ICMP_UNREACH_PORT:
4642 code = ICMP6_DST_UNREACH_NOPORT;
4643 break;
4644 case ICMP_UNREACH_NET_PROHIB:
4645 case ICMP_UNREACH_HOST_PROHIB:
4646 case ICMP_UNREACH_FILTER_PROHIB:
4647 case ICMP_UNREACH_PRECEDENCE_CUTOFF:
4648 code = ICMP6_DST_UNREACH_ADMIN;
4649 break;
4650 case ICMP_UNREACH_PROTOCOL:
4651 type = ICMP6_PARAM_PROB;
4652 code = ICMP6_PARAMPROB_NEXTHEADER;
4653 ptr = offsetof(struct ip6_hdr, ip6_nxt);
4654 break;
4655 case ICMP_UNREACH_NEEDFRAG:
4656 type = ICMP6_PACKET_TOO_BIG;
4657 code = 0;
4658 mtu += 20;
4659 break;
4660 default:
4661 return -1;
4662 }
4663 break;
4664 case ICMP_TIMXCEED:
4665 type = ICMP6_TIME_EXCEEDED;
4666 break;
4667 case ICMP_PARAMPROB:
4668 type = ICMP6_PARAM_PROB;
4669 switch (code) {
4670 case ICMP_PARAMPROB_ERRATPTR:
4671 code = ICMP6_PARAMPROB_HEADER;
4672 break;
4673 case ICMP_PARAMPROB_LENGTH:
4674 code = ICMP6_PARAMPROB_HEADER;
4675 break;
4676 default:
4677 return -1;
4678 }
4679
4680 ptr = icmp4->icmp_pptr;
4681 if (ptr == 0 || ptr == PTR_IP(ip_tos)) {
4682 ; /* preserve */
4683 } else if (ptr == PTR_IP(ip_len) ||
4684 ptr == PTR_IP(ip_len) + 1) {
4685 ptr = PTR_IP6(ip6_plen);
4686 } else if (ptr == PTR_IP(ip_ttl)) {
4687 ptr = PTR_IP6(ip6_hlim);
4688 } else if (ptr == PTR_IP(ip_p)) {
4689 ptr = PTR_IP6(ip6_nxt);
4690 } else if (ptr >= PTR_IP(ip_src) &&
4691 ptr < PTR_IP(ip_dst)) {
4692 ptr = PTR_IP6(ip6_src);
4693 } else if (ptr >= PTR_IP(ip_dst) &&
4694 ptr < (int32_t)sizeof(struct ip)) {
4695 ptr = PTR_IP6(ip6_dst);
4696 } else {
4697 return -1;
4698 }
4699 break;
4700 default:
4701 return -1;
4702 }
4703 icmp4->icmp_type = type;
4704 icmp4->icmp_code = code;
4705 icmp4->icmp_nextmtu = htons(mtu);
4706 if (ptr >= 0) {
4707 icmp4->icmp_void = htonl(ptr);
4708 }
4709 break;
4710 }
4711
4712 return 0;
4713 }
4714
4715 /* Note: frees pbuf if PF_NAT64 is returned */
4716 static int
4717 pf_nat64_ipv6(pbuf_t *pbuf, int off, struct pf_pdesc *pd)
4718 {
4719 struct ip *ip4;
4720 struct mbuf *m;
4721
4722 /*
4723 * ip_input asserts for rcvif to be not NULL
4724 * That may not be true for two corner cases
4725 * 1. If for some reason a local app sends DNS
4726 * AAAA query to local host
4727 * 2. If IPv6 stack in kernel internally generates a
4728 * message destined for a synthesized IPv6 end-point.
4729 */
4730 if (pbuf->pb_ifp == NULL) {
4731 return PF_DROP;
4732 }
4733
4734 ip4 = (struct ip *)pbuf_resize_segment(pbuf, 0, off, sizeof(*ip4));
4735 if (ip4 == NULL) {
4736 return PF_DROP;
4737 }
4738
4739 ip4->ip_v = 4;
4740 ip4->ip_hl = 5;
4741 ip4->ip_tos = pd->tos & htonl(0x0ff00000);
4742 ip4->ip_len = htons(sizeof(*ip4) + (pd->tot_len - off));
4743 ip4->ip_id = 0;
4744 ip4->ip_off = htons(IP_DF);
4745 ip4->ip_ttl = pd->ttl;
4746 ip4->ip_p = pd->proto;
4747 ip4->ip_sum = 0;
4748 ip4->ip_src = pd->naddr.v4addr;
4749 ip4->ip_dst = pd->ndaddr.v4addr;
4750 ip4->ip_sum = pbuf_inet_cksum(pbuf, 0, 0, ip4->ip_hl << 2);
4751
4752 /* recalculate icmp checksums */
4753 if (pd->proto == IPPROTO_ICMP) {
4754 struct icmp *icmp;
4755 int hlen = sizeof(*ip4);
4756
4757 icmp = (struct icmp *)pbuf_contig_segment(pbuf, hlen,
4758 ICMP_MINLEN);
4759 if (icmp == NULL) {
4760 return PF_DROP;
4761 }
4762
4763 icmp->icmp_cksum = 0;
4764 icmp->icmp_cksum = pbuf_inet_cksum(pbuf, 0, hlen,
4765 ntohs(ip4->ip_len) - hlen);
4766 }
4767
4768 if ((m = pbuf_to_mbuf(pbuf, TRUE)) != NULL) {
4769 ip_input(m);
4770 }
4771
4772 return PF_NAT64;
4773 }
4774
4775 static int
4776 pf_nat64_ipv4(pbuf_t *pbuf, int off, struct pf_pdesc *pd)
4777 {
4778 struct ip6_hdr *ip6;
4779 struct mbuf *m;
4780
4781 if (pbuf->pb_ifp == NULL) {
4782 return PF_DROP;
4783 }
4784
4785 ip6 = (struct ip6_hdr *)pbuf_resize_segment(pbuf, 0, off, sizeof(*ip6));
4786 if (ip6 == NULL) {
4787 return PF_DROP;
4788 }
4789
4790 ip6->ip6_vfc = htonl((6 << 28) | (pd->tos << 20));
4791 ip6->ip6_plen = htons(pd->tot_len - off);
4792 ip6->ip6_nxt = pd->proto;
4793 ip6->ip6_hlim = pd->ttl;
4794 ip6->ip6_src = pd->naddr.v6addr;
4795 ip6->ip6_dst = pd->ndaddr.v6addr;
4796
4797 /* recalculate icmp6 checksums */
4798 if (pd->proto == IPPROTO_ICMPV6) {
4799 struct icmp6_hdr *icmp6;
4800 int hlen = sizeof(*ip6);
4801
4802 icmp6 = (struct icmp6_hdr *)pbuf_contig_segment(pbuf, hlen,
4803 sizeof(*icmp6));
4804 if (icmp6 == NULL) {
4805 return PF_DROP;
4806 }
4807
4808 icmp6->icmp6_cksum = 0;
4809 icmp6->icmp6_cksum = pbuf_inet6_cksum(pbuf,
4810 IPPROTO_ICMPV6, hlen,
4811 ntohs(ip6->ip6_plen));
4812 } else if (pd->proto == IPPROTO_UDP) {
4813 struct udphdr *uh;
4814 int hlen = sizeof(*ip6);
4815
4816 uh = (struct udphdr *)pbuf_contig_segment(pbuf, hlen,
4817 sizeof(*uh));
4818 if (uh == NULL) {
4819 return PF_DROP;
4820 }
4821
4822 if (uh->uh_sum == 0) {
4823 uh->uh_sum = pbuf_inet6_cksum(pbuf, IPPROTO_UDP,
4824 hlen, ntohs(ip6->ip6_plen));
4825 }
4826 }
4827
4828 if ((m = pbuf_to_mbuf(pbuf, TRUE)) != NULL) {
4829 ip6_input(m);
4830 }
4831
4832 return PF_NAT64;
4833 }
4834
4835 static int
4836 pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
4837 struct pfi_kif *kif, pbuf_t *pbuf, int off, void *h,
4838 struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm,
4839 struct ifqueue *ifq)
4840 {
4841 #pragma unused(h)
4842 struct pf_rule *nr = NULL;
4843 struct pf_addr *saddr = pd->src, *daddr = pd->dst;
4844 sa_family_t af = pd->af;
4845 struct pf_rule *r, *a = NULL;
4846 struct pf_ruleset *ruleset = NULL;
4847 struct pf_src_node *nsn = NULL;
4848 struct tcphdr *th = pd->hdr.tcp;
4849 struct udphdr *uh = pd->hdr.udp;
4850 u_short reason;
4851 int rewrite = 0, hdrlen = 0;
4852 int tag = -1;
4853 unsigned int rtableid = IFSCOPE_NONE;
4854 int asd = 0;
4855 int match = 0;
4856 int state_icmp = 0;
4857 u_int16_t mss = tcp_mssdflt;
4858 u_int8_t icmptype = 0, icmpcode = 0;
4859
4860 struct pf_grev1_hdr *grev1 = pd->hdr.grev1;
4861 union pf_state_xport bxport, bdxport, nxport, sxport, dxport;
4862 struct pf_state_key psk;
4863
4864 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
4865
4866 if (direction == PF_IN && pf_check_congestion(ifq)) {
4867 REASON_SET(&reason, PFRES_CONGEST);
4868 return PF_DROP;
4869 }
4870
4871 hdrlen = 0;
4872 sxport.spi = 0;
4873 dxport.spi = 0;
4874 nxport.spi = 0;
4875
4876 switch (pd->proto) {
4877 case IPPROTO_TCP:
4878 sxport.port = th->th_sport;
4879 dxport.port = th->th_dport;
4880 hdrlen = sizeof(*th);
4881 break;
4882 case IPPROTO_UDP:
4883 sxport.port = uh->uh_sport;
4884 dxport.port = uh->uh_dport;
4885 hdrlen = sizeof(*uh);
4886 break;
4887 #if INET
4888 case IPPROTO_ICMP:
4889 if (pd->af != AF_INET) {
4890 break;
4891 }
4892 sxport.port = dxport.port = pd->hdr.icmp->icmp_id;
4893 hdrlen = ICMP_MINLEN;
4894 icmptype = pd->hdr.icmp->icmp_type;
4895 icmpcode = pd->hdr.icmp->icmp_code;
4896
4897 if (ICMP_ERRORTYPE(icmptype)) {
4898 state_icmp++;
4899 }
4900 break;
4901 #endif /* INET */
4902 #if INET6
4903 case IPPROTO_ICMPV6:
4904 if (pd->af != AF_INET6) {
4905 break;
4906 }
4907 sxport.port = dxport.port = pd->hdr.icmp6->icmp6_id;
4908 hdrlen = sizeof(*pd->hdr.icmp6);
4909 icmptype = pd->hdr.icmp6->icmp6_type;
4910 icmpcode = pd->hdr.icmp6->icmp6_code;
4911
4912 if (ICMP6_ERRORTYPE(icmptype)) {
4913 state_icmp++;
4914 }
4915 break;
4916 #endif /* INET6 */
4917 case IPPROTO_GRE:
4918 if (pd->proto_variant == PF_GRE_PPTP_VARIANT) {
4919 sxport.call_id = dxport.call_id =
4920 pd->hdr.grev1->call_id;
4921 hdrlen = sizeof(*pd->hdr.grev1);
4922 }
4923 break;
4924 case IPPROTO_ESP:
4925 sxport.spi = 0;
4926 dxport.spi = pd->hdr.esp->spi;
4927 hdrlen = sizeof(*pd->hdr.esp);
4928 break;
4929 }
4930
4931 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
4932
4933 bxport = sxport;
4934 bdxport = dxport;
4935
4936 if (direction == PF_OUT) {
4937 nxport = sxport;
4938 } else {
4939 nxport = dxport;
4940 }
4941
4942 /* check packet for BINAT/NAT/RDR */
4943 if ((nr = pf_get_translation_aux(pd, pbuf, off, direction, kif, &nsn,
4944 saddr, &sxport, daddr, &dxport, &nxport
4945 )) != NULL) {
4946 int ua;
4947 u_int16_t dport;
4948
4949 if (pd->af != pd->naf) {
4950 ua = 0;
4951 } else {
4952 ua = 1;
4953 }
4954
4955 PF_ACPY(&pd->baddr, saddr, af);
4956 PF_ACPY(&pd->bdaddr, daddr, af);
4957
4958 switch (pd->proto) {
4959 case IPPROTO_TCP:
4960 if (pd->af != pd->naf ||
4961 PF_ANEQ(saddr, &pd->naddr, pd->af)) {
4962 pf_change_ap(direction, pd->mp, saddr,
4963 &th->th_sport, pd->ip_sum, &th->th_sum,
4964 &pd->naddr, nxport.port, 0, af,
4965 pd->naf, ua);
4966 sxport.port = th->th_sport;
4967 }
4968
4969 if (pd->af != pd->naf ||
4970 PF_ANEQ(daddr, &pd->ndaddr, pd->af) ||
4971 (nr && (nr->action == PF_RDR) &&
4972 (th->th_dport != nxport.port))) {
4973 if (nr && nr->action == PF_RDR) {
4974 dport = nxport.port;
4975 } else {
4976 dport = th->th_dport;
4977 }
4978 pf_change_ap(direction, pd->mp, daddr,
4979 &th->th_dport, pd->ip_sum,
4980 &th->th_sum, &pd->ndaddr,
4981 dport, 0, af, pd->naf, ua);
4982 dxport.port = th->th_dport;
4983 }
4984 rewrite++;
4985 break;
4986
4987 case IPPROTO_UDP:
4988 if (pd->af != pd->naf ||
4989 PF_ANEQ(saddr, &pd->naddr, pd->af)) {
4990 pf_change_ap(direction, pd->mp, saddr,
4991 &uh->uh_sport, pd->ip_sum,
4992 &uh->uh_sum, &pd->naddr,
4993 nxport.port, 1, af, pd->naf, ua);
4994 sxport.port = uh->uh_sport;
4995 }
4996
4997 if (pd->af != pd->naf ||
4998 PF_ANEQ(daddr, &pd->ndaddr, pd->af) ||
4999 (nr && (nr->action == PF_RDR) &&
5000 (uh->uh_dport != nxport.port))) {
5001 if (nr && nr->action == PF_RDR) {
5002 dport = nxport.port;
5003 } else {
5004 dport = uh->uh_dport;
5005 }
5006 pf_change_ap(direction, pd->mp, daddr,
5007 &uh->uh_dport, pd->ip_sum,
5008 &uh->uh_sum, &pd->ndaddr,
5009 dport, 0, af, pd->naf, ua);
5010 dxport.port = uh->uh_dport;
5011 }
5012 rewrite++;
5013 break;
5014 #if INET
5015 case IPPROTO_ICMP:
5016 if (pd->af != AF_INET) {
5017 break;
5018 }
5019 /*
5020 * TODO:
5021 * pd->af != pd->naf not handled yet here and would be
5022 * needed for NAT46 needed to support XLAT.
5023 * Will cross the bridge when it comes.
5024 */
5025 if (PF_ANEQ(saddr, &pd->naddr, pd->af)) {
5026 pf_change_a(&saddr->v4addr.s_addr, pd->ip_sum,
5027 pd->naddr.v4addr.s_addr, 0);
5028 pd->hdr.icmp->icmp_cksum = pf_cksum_fixup(
5029 pd->hdr.icmp->icmp_cksum, sxport.port,
5030 nxport.port, 0);
5031 pd->hdr.icmp->icmp_id = nxport.port;
5032 }
5033
5034 if (PF_ANEQ(daddr, &pd->ndaddr, pd->af)) {
5035 pf_change_a(&daddr->v4addr.s_addr, pd->ip_sum,
5036 pd->ndaddr.v4addr.s_addr, 0);
5037 }
5038 ++rewrite;
5039 break;
5040 #endif /* INET */
5041 #if INET6
5042 case IPPROTO_ICMPV6:
5043 if (pd->af != AF_INET6) {
5044 break;
5045 }
5046
5047 if (pd->af != pd->naf ||
5048 PF_ANEQ(saddr, &pd->naddr, pd->af)) {
5049 pf_change_addr(saddr,
5050 &pd->hdr.icmp6->icmp6_cksum,
5051 &pd->naddr, 0, pd->af, pd->naf);
5052 }
5053
5054 if (pd->af != pd->naf ||
5055 PF_ANEQ(daddr, &pd->ndaddr, pd->af)) {
5056 pf_change_addr(daddr,
5057 &pd->hdr.icmp6->icmp6_cksum,
5058 &pd->ndaddr, 0, pd->af, pd->naf);
5059 }
5060
5061 if (pd->af != pd->naf) {
5062 if (pf_translate_icmp_af(AF_INET,
5063 pd->hdr.icmp6)) {
5064 return PF_DROP;
5065 }
5066 pd->proto = IPPROTO_ICMP;
5067 }
5068 rewrite++;
5069 break;
5070 #endif /* INET */
5071 case IPPROTO_GRE:
5072 if ((direction == PF_IN) &&
5073 (pd->proto_variant == PF_GRE_PPTP_VARIANT)) {
5074 grev1->call_id = nxport.call_id;
5075 }
5076
5077 switch (pd->af) {
5078 #if INET
5079 case AF_INET:
5080 if (PF_ANEQ(saddr, &pd->naddr, pd->af)) {
5081 pf_change_a(&saddr->v4addr.s_addr,
5082 pd->ip_sum,
5083 pd->naddr.v4addr.s_addr, 0);
5084 }
5085 if (PF_ANEQ(daddr, &pd->ndaddr, pd->af)) {
5086 pf_change_a(&daddr->v4addr.s_addr,
5087 pd->ip_sum,
5088 pd->ndaddr.v4addr.s_addr, 0);
5089 }
5090 break;
5091 #endif /* INET */
5092 #if INET6
5093 case AF_INET6:
5094 if (PF_ANEQ(saddr, &pd->naddr, pd->af)) {
5095 PF_ACPY(saddr, &pd->naddr, AF_INET6);
5096 }
5097 if (PF_ANEQ(daddr, &pd->ndaddr, pd->af)) {
5098 PF_ACPY(daddr, &pd->ndaddr, AF_INET6);
5099 }
5100 break;
5101 #endif /* INET6 */
5102 }
5103 ++rewrite;
5104 break;
5105 case IPPROTO_ESP:
5106 if (direction == PF_OUT) {
5107 bxport.spi = 0;
5108 }
5109
5110 switch (pd->af) {
5111 #if INET
5112 case AF_INET:
5113 if (PF_ANEQ(saddr, &pd->naddr, pd->af)) {
5114 pf_change_a(&saddr->v4addr.s_addr,
5115 pd->ip_sum, pd->naddr.v4addr.s_addr, 0);
5116 }
5117 if (PF_ANEQ(daddr, &pd->ndaddr, pd->af)) {
5118 pf_change_a(&daddr->v4addr.s_addr,
5119 pd->ip_sum,
5120 pd->ndaddr.v4addr.s_addr, 0);
5121 }
5122 break;
5123 #endif /* INET */
5124 #if INET6
5125 case AF_INET6:
5126 if (PF_ANEQ(saddr, &pd->naddr, pd->af)) {
5127 PF_ACPY(saddr, &pd->naddr, AF_INET6);
5128 }
5129 if (PF_ANEQ(daddr, &pd->ndaddr, pd->af)) {
5130 PF_ACPY(daddr, &pd->ndaddr, AF_INET6);
5131 }
5132 break;
5133 #endif /* INET6 */
5134 }
5135 break;
5136 default:
5137 switch (pd->af) {
5138 #if INET
5139 case AF_INET:
5140 if ((pd->naf != AF_INET) ||
5141 (PF_ANEQ(saddr, &pd->naddr, pd->af))) {
5142 pf_change_addr(saddr, pd->ip_sum,
5143 &pd->naddr, 0, af, pd->naf);
5144 }
5145
5146 if ((pd->naf != AF_INET) ||
5147 (PF_ANEQ(daddr, &pd->ndaddr, pd->af))) {
5148 pf_change_addr(daddr, pd->ip_sum,
5149 &pd->ndaddr, 0, af, pd->naf);
5150 }
5151 break;
5152 #endif /* INET */
5153 #if INET6
5154 case AF_INET6:
5155 if (PF_ANEQ(saddr, &pd->naddr, pd->af)) {
5156 PF_ACPY(saddr, &pd->naddr, af);
5157 }
5158 if (PF_ANEQ(daddr, &pd->ndaddr, pd->af)) {
5159 PF_ACPY(daddr, &pd->ndaddr, af);
5160 }
5161 break;
5162 #endif /* INET */
5163 }
5164 break;
5165 }
5166
5167 if (nr->natpass) {
5168 r = NULL;
5169 }
5170 pd->nat_rule = nr;
5171 pd->af = pd->naf;
5172 } else {
5173 }
5174
5175 if (nr && nr->tag > 0) {
5176 tag = nr->tag;
5177 }
5178
5179 while (r != NULL) {
5180 r->evaluations++;
5181 if (pfi_kif_match(r->kif, kif) == r->ifnot) {
5182 r = r->skip[PF_SKIP_IFP].ptr;
5183 } else if (r->direction && r->direction != direction) {
5184 r = r->skip[PF_SKIP_DIR].ptr;
5185 } else if (r->af && r->af != pd->af) {
5186 r = r->skip[PF_SKIP_AF].ptr;
5187 } else if (r->proto && r->proto != pd->proto) {
5188 r = r->skip[PF_SKIP_PROTO].ptr;
5189 } else if (PF_MISMATCHAW(&r->src.addr, saddr, pd->af,
5190 r->src.neg, kif)) {
5191 r = r->skip[PF_SKIP_SRC_ADDR].ptr;
5192 }
5193 /* tcp/udp only. port_op always 0 in other cases */
5194 else if (r->proto == pd->proto &&
5195 (r->proto == IPPROTO_TCP || r->proto == IPPROTO_UDP) &&
5196 r->src.xport.range.op &&
5197 !pf_match_port(r->src.xport.range.op,
5198 r->src.xport.range.port[0], r->src.xport.range.port[1],
5199 th->th_sport)) {
5200 r = r->skip[PF_SKIP_SRC_PORT].ptr;
5201 } else if (PF_MISMATCHAW(&r->dst.addr, daddr, pd->af,
5202 r->dst.neg, NULL)) {
5203 r = r->skip[PF_SKIP_DST_ADDR].ptr;
5204 }
5205 /* tcp/udp only. port_op always 0 in other cases */
5206 else if (r->proto == pd->proto &&
5207 (r->proto == IPPROTO_TCP || r->proto == IPPROTO_UDP) &&
5208 r->dst.xport.range.op &&
5209 !pf_match_port(r->dst.xport.range.op,
5210 r->dst.xport.range.port[0], r->dst.xport.range.port[1],
5211 th->th_dport)) {
5212 r = r->skip[PF_SKIP_DST_PORT].ptr;
5213 }
5214 /* icmp only. type always 0 in other cases */
5215 else if (r->type && r->type != icmptype + 1) {
5216 r = TAILQ_NEXT(r, entries);
5217 }
5218 /* icmp only. type always 0 in other cases */
5219 else if (r->code && r->code != icmpcode + 1) {
5220 r = TAILQ_NEXT(r, entries);
5221 } else if ((r->rule_flag & PFRULE_TOS) && r->tos &&
5222 !(r->tos & pd->tos)) {
5223 r = TAILQ_NEXT(r, entries);
5224 } else if ((r->rule_flag & PFRULE_DSCP) && r->tos &&
5225 !(r->tos & (pd->tos & DSCP_MASK))) {
5226 r = TAILQ_NEXT(r, entries);
5227 } else if ((r->rule_flag & PFRULE_SC) && r->tos &&
5228 ((r->tos & SCIDX_MASK) != pd->sc)) {
5229 r = TAILQ_NEXT(r, entries);
5230 } else if (r->rule_flag & PFRULE_FRAGMENT) {
5231 r = TAILQ_NEXT(r, entries);
5232 } else if (pd->proto == IPPROTO_TCP &&
5233 (r->flagset & th->th_flags) != r->flags) {
5234 r = TAILQ_NEXT(r, entries);
5235 }
5236 /* tcp/udp only. uid.op always 0 in other cases */
5237 else if (r->uid.op && (pd->lookup.done || ((void)(pd->lookup.done =
5238 pf_socket_lookup(direction, pd)), 1)) &&
5239 !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1],
5240 pd->lookup.uid)) {
5241 r = TAILQ_NEXT(r, entries);
5242 }
5243 /* tcp/udp only. gid.op always 0 in other cases */
5244 else if (r->gid.op && (pd->lookup.done || ((void)(pd->lookup.done =
5245 pf_socket_lookup(direction, pd)), 1)) &&
5246 !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1],
5247 pd->lookup.gid)) {
5248 r = TAILQ_NEXT(r, entries);
5249 } else if (r->prob && r->prob <= (RandomULong() % (UINT_MAX - 1) + 1)) {
5250 r = TAILQ_NEXT(r, entries);
5251 } else if (r->match_tag && !pf_match_tag(r, pd->pf_mtag, &tag)) {
5252 r = TAILQ_NEXT(r, entries);
5253 } else if (r->os_fingerprint != PF_OSFP_ANY &&
5254 (pd->proto != IPPROTO_TCP || !pf_osfp_match(
5255 pf_osfp_fingerprint(pd, pbuf, off, th),
5256 r->os_fingerprint))) {
5257 r = TAILQ_NEXT(r, entries);
5258 } else {
5259 if (r->tag) {
5260 tag = r->tag;
5261 }
5262 if (PF_RTABLEID_IS_VALID(r->rtableid)) {
5263 rtableid = r->rtableid;
5264 }
5265 if (r->anchor == NULL) {
5266 match = 1;
5267 *rm = r;
5268 *am = a;
5269 *rsm = ruleset;
5270 if ((*rm)->quick) {
5271 break;
5272 }
5273 r = TAILQ_NEXT(r, entries);
5274 } else {
5275 pf_step_into_anchor(&asd, &ruleset,
5276 PF_RULESET_FILTER, &r, &a, &match);
5277 }
5278 }
5279 if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset,
5280 PF_RULESET_FILTER, &r, &a, &match)) {
5281 break;
5282 }
5283 }
5284 r = *rm;
5285 a = *am;
5286 ruleset = *rsm;
5287
5288 REASON_SET(&reason, PFRES_MATCH);
5289
5290 if (r->log || (nr != NULL && nr->log)) {
5291 if (rewrite > 0) {
5292 if (rewrite < off + hdrlen) {
5293 rewrite = off + hdrlen;
5294 }
5295
5296 if (pf_lazy_makewritable(pd, pbuf, rewrite) == NULL) {
5297 REASON_SET(&reason, PFRES_MEMORY);
5298 return PF_DROP;
5299 }
5300
5301 pbuf_copy_back(pbuf, off, hdrlen, pd->hdr.any);
5302 }
5303 PFLOG_PACKET(kif, h, pbuf, pd->af, direction, reason,
5304 r->log ? r : nr, a, ruleset, pd);
5305 }
5306
5307 if ((r->action == PF_DROP) &&
5308 ((r->rule_flag & PFRULE_RETURNRST) ||
5309 (r->rule_flag & PFRULE_RETURNICMP) ||
5310 (r->rule_flag & PFRULE_RETURN))) {
5311 /* undo NAT changes, if they have taken place */
5312 /* XXX For NAT64 we are not reverting the changes */
5313 if (nr != NULL && nr->action != PF_NAT64) {
5314 if (direction == PF_OUT) {
5315 pd->af = af;
5316 switch (pd->proto) {
5317 case IPPROTO_TCP:
5318 pf_change_ap(direction, pd->mp, saddr,
5319 &th->th_sport, pd->ip_sum,
5320 &th->th_sum, &pd->baddr,
5321 bxport.port, 0, af, pd->af, 1);
5322 sxport.port = th->th_sport;
5323 rewrite++;
5324 break;
5325 case IPPROTO_UDP:
5326 pf_change_ap(direction, pd->mp, saddr,
5327 &pd->hdr.udp->uh_sport, pd->ip_sum,
5328 &pd->hdr.udp->uh_sum, &pd->baddr,
5329 bxport.port, 1, af, pd->af, 1);
5330 sxport.port = pd->hdr.udp->uh_sport;
5331 rewrite++;
5332 break;
5333 case IPPROTO_ICMP:
5334 #if INET6
5335 case IPPROTO_ICMPV6:
5336 #endif
5337 /* nothing! */
5338 break;
5339 case IPPROTO_GRE:
5340 PF_ACPY(&pd->baddr, saddr, af);
5341 ++rewrite;
5342 switch (af) {
5343 #if INET
5344 case AF_INET:
5345 pf_change_a(&saddr->v4addr.s_addr,
5346 pd->ip_sum,
5347 pd->baddr.v4addr.s_addr, 0);
5348 break;
5349 #endif /* INET */
5350 #if INET6
5351 case AF_INET6:
5352 PF_ACPY(saddr, &pd->baddr,
5353 AF_INET6);
5354 break;
5355 #endif /* INET6 */
5356 }
5357 break;
5358 case IPPROTO_ESP:
5359 PF_ACPY(&pd->baddr, saddr, af);
5360 switch (af) {
5361 #if INET
5362 case AF_INET:
5363 pf_change_a(&saddr->v4addr.s_addr,
5364 pd->ip_sum,
5365 pd->baddr.v4addr.s_addr, 0);
5366 break;
5367 #endif /* INET */
5368 #if INET6
5369 case AF_INET6:
5370 PF_ACPY(saddr, &pd->baddr,
5371 AF_INET6);
5372 break;
5373 #endif /* INET6 */
5374 }
5375 break;
5376 default:
5377 switch (af) {
5378 case AF_INET:
5379 pf_change_a(&saddr->v4addr.s_addr,
5380 pd->ip_sum,
5381 pd->baddr.v4addr.s_addr, 0);
5382 break;
5383 case AF_INET6:
5384 PF_ACPY(saddr, &pd->baddr, af);
5385 break;
5386 }
5387 }
5388 } else {
5389 switch (pd->proto) {
5390 case IPPROTO_TCP:
5391 pf_change_ap(direction, pd->mp, daddr,
5392 &th->th_dport, pd->ip_sum,
5393 &th->th_sum, &pd->bdaddr,
5394 bdxport.port, 0, af, pd->af, 1);
5395 dxport.port = th->th_dport;
5396 rewrite++;
5397 break;
5398 case IPPROTO_UDP:
5399 pf_change_ap(direction, pd->mp, daddr,
5400 &pd->hdr.udp->uh_dport, pd->ip_sum,
5401 &pd->hdr.udp->uh_sum, &pd->bdaddr,
5402 bdxport.port, 1, af, pd->af, 1);
5403 dxport.port = pd->hdr.udp->uh_dport;
5404 rewrite++;
5405 break;
5406 case IPPROTO_ICMP:
5407 #if INET6
5408 case IPPROTO_ICMPV6:
5409 #endif
5410 /* nothing! */
5411 break;
5412 case IPPROTO_GRE:
5413 if (pd->proto_variant ==
5414 PF_GRE_PPTP_VARIANT) {
5415 grev1->call_id =
5416 bdxport.call_id;
5417 }
5418 ++rewrite;
5419 switch (af) {
5420 #if INET
5421 case AF_INET:
5422 pf_change_a(&daddr->v4addr.s_addr,
5423 pd->ip_sum,
5424 pd->bdaddr.v4addr.s_addr, 0);
5425 break;
5426 #endif /* INET */
5427 #if INET6
5428 case AF_INET6:
5429 PF_ACPY(daddr, &pd->bdaddr,
5430 AF_INET6);
5431 break;
5432 #endif /* INET6 */
5433 }
5434 break;
5435 case IPPROTO_ESP:
5436 switch (af) {
5437 #if INET
5438 case AF_INET:
5439 pf_change_a(&daddr->v4addr.s_addr,
5440 pd->ip_sum,
5441 pd->bdaddr.v4addr.s_addr, 0);
5442 break;
5443 #endif /* INET */
5444 #if INET6
5445 case AF_INET6:
5446 PF_ACPY(daddr, &pd->bdaddr,
5447 AF_INET6);
5448 break;
5449 #endif /* INET6 */
5450 }
5451 break;
5452 default:
5453 switch (af) {
5454 case AF_INET:
5455 pf_change_a(&daddr->v4addr.s_addr,
5456 pd->ip_sum,
5457 pd->bdaddr.v4addr.s_addr, 0);
5458 break;
5459 #if INET6
5460 case AF_INET6:
5461 PF_ACPY(daddr, &pd->bdaddr, af);
5462 break;
5463 #endif /* INET6 */
5464 }
5465 }
5466 }
5467 }
5468 if (pd->proto == IPPROTO_TCP &&
5469 ((r->rule_flag & PFRULE_RETURNRST) ||
5470 (r->rule_flag & PFRULE_RETURN)) &&
5471 !(th->th_flags & TH_RST)) {
5472 u_int32_t ack = ntohl(th->th_seq) + pd->p_len;
5473 int len = 0;
5474 struct ip *h4;
5475 #if INET6
5476 struct ip6_hdr *h6;
5477 #endif /* INET6 */
5478
5479 switch (pd->af) {
5480 case AF_INET:
5481 h4 = pbuf->pb_data;
5482 len = ntohs(h4->ip_len) - off;
5483 break;
5484 #if INET6
5485 case AF_INET6:
5486 h6 = pbuf->pb_data;
5487 len = ntohs(h6->ip6_plen) -
5488 (off - sizeof(*h6));
5489 break;
5490 #endif /* INET6 */
5491 }
5492
5493 if (pf_check_proto_cksum(pbuf, off, len, IPPROTO_TCP,
5494 pd->af)) {
5495 REASON_SET(&reason, PFRES_PROTCKSUM);
5496 } else {
5497 if (th->th_flags & TH_SYN) {
5498 ack++;
5499 }
5500 if (th->th_flags & TH_FIN) {
5501 ack++;
5502 }
5503 pf_send_tcp(r, pd->af, pd->dst,
5504 pd->src, th->th_dport, th->th_sport,
5505 ntohl(th->th_ack), ack, TH_RST | TH_ACK, 0, 0,
5506 r->return_ttl, 1, 0, pd->eh, kif->pfik_ifp);
5507 }
5508 } else if (pd->proto != IPPROTO_ICMP && pd->af == AF_INET &&
5509 pd->proto != IPPROTO_ESP && pd->proto != IPPROTO_AH &&
5510 r->return_icmp) {
5511 pf_send_icmp(pbuf, r->return_icmp >> 8,
5512 r->return_icmp & 255, pd->af, r);
5513 } else if (pd->proto != IPPROTO_ICMPV6 && af == AF_INET6 &&
5514 pd->proto != IPPROTO_ESP && pd->proto != IPPROTO_AH &&
5515 r->return_icmp6) {
5516 pf_send_icmp(pbuf, r->return_icmp6 >> 8,
5517 r->return_icmp6 & 255, pd->af, r);
5518 }
5519 }
5520
5521 if (r->action == PF_DROP) {
5522 return PF_DROP;
5523 }
5524
5525 /* prepare state key, for flowhash and/or the state (if created) */
5526 bzero(&psk, sizeof(psk));
5527 psk.proto = pd->proto;
5528 psk.direction = direction;
5529 if (pd->proto == IPPROTO_UDP) {
5530 if (ntohs(pd->hdr.udp->uh_sport) == PF_IKE_PORT &&
5531 ntohs(pd->hdr.udp->uh_dport) == PF_IKE_PORT) {
5532 psk.proto_variant = PF_EXTFILTER_APD;
5533 } else {
5534 psk.proto_variant = nr ? nr->extfilter : r->extfilter;
5535 if (psk.proto_variant < PF_EXTFILTER_APD) {
5536 psk.proto_variant = PF_EXTFILTER_APD;
5537 }
5538 }
5539 } else if (pd->proto == IPPROTO_GRE) {
5540 psk.proto_variant = pd->proto_variant;
5541 }
5542 if (direction == PF_OUT) {
5543 psk.af_gwy = af;
5544 PF_ACPY(&psk.gwy.addr, saddr, af);
5545 PF_ACPY(&psk.ext_gwy.addr, daddr, af);
5546 switch (pd->proto) {
5547 case IPPROTO_ESP:
5548 psk.gwy.xport.spi = 0;
5549 psk.ext_gwy.xport.spi = pd->hdr.esp->spi;
5550 break;
5551 case IPPROTO_ICMP:
5552 #if INET6
5553 case IPPROTO_ICMPV6:
5554 #endif
5555 /*
5556 * NAT64 requires protocol translation between ICMPv4
5557 * and ICMPv6. TCP and UDP do not require protocol
5558 * translation. To avoid adding complexity just to
5559 * handle ICMP(v4addr/v6addr), we always lookup for
5560 * proto = IPPROTO_ICMP on both LAN and WAN side
5561 */
5562 psk.proto = IPPROTO_ICMP;
5563 psk.gwy.xport.port = nxport.port;
5564 psk.ext_gwy.xport.spi = 0;
5565 break;
5566 default:
5567 psk.gwy.xport = sxport;
5568 psk.ext_gwy.xport = dxport;
5569 break;
5570 }
5571 psk.af_lan = af;
5572 if (nr != NULL) {
5573 PF_ACPY(&psk.lan.addr, &pd->baddr, af);
5574 psk.lan.xport = bxport;
5575 PF_ACPY(&psk.ext_lan.addr, &pd->bdaddr, af);
5576 psk.ext_lan.xport = bdxport;
5577 } else {
5578 PF_ACPY(&psk.lan.addr, &psk.gwy.addr, af);
5579 psk.lan.xport = psk.gwy.xport;
5580 PF_ACPY(&psk.ext_lan.addr, &psk.ext_gwy.addr, af);
5581 psk.ext_lan.xport = psk.ext_gwy.xport;
5582 }
5583 } else {
5584 psk.af_lan = af;
5585 if (nr && nr->action == PF_NAT64) {
5586 PF_ACPY(&psk.lan.addr, &pd->baddr, af);
5587 PF_ACPY(&psk.ext_lan.addr, &pd->bdaddr, af);
5588 } else {
5589 PF_ACPY(&psk.lan.addr, daddr, af);
5590 PF_ACPY(&psk.ext_lan.addr, saddr, af);
5591 }
5592 switch (pd->proto) {
5593 case IPPROTO_ICMP:
5594 #if INET6
5595 case IPPROTO_ICMPV6:
5596 #endif
5597 /*
5598 * NAT64 requires protocol translation between ICMPv4
5599 * and ICMPv6. TCP and UDP do not require protocol
5600 * translation. To avoid adding complexity just to
5601 * handle ICMP(v4addr/v6addr), we always lookup for
5602 * proto = IPPROTO_ICMP on both LAN and WAN side
5603 */
5604 psk.proto = IPPROTO_ICMP;
5605 if (nr && nr->action == PF_NAT64) {
5606 psk.lan.xport = bxport;
5607 psk.ext_lan.xport = bxport;
5608 } else {
5609 psk.lan.xport = nxport;
5610 psk.ext_lan.xport.spi = 0;
5611 }
5612 break;
5613 case IPPROTO_ESP:
5614 psk.ext_lan.xport.spi = 0;
5615 psk.lan.xport.spi = pd->hdr.esp->spi;
5616 break;
5617 default:
5618 if (nr != NULL) {
5619 if (nr->action == PF_NAT64) {
5620 psk.lan.xport = bxport;
5621 psk.ext_lan.xport = bdxport;
5622 } else {
5623 psk.lan.xport = dxport;
5624 psk.ext_lan.xport = sxport;
5625 }
5626 } else {
5627 psk.lan.xport = dxport;
5628 psk.ext_lan.xport = sxport;
5629 }
5630 break;
5631 }
5632 psk.af_gwy = pd->naf;
5633 if (nr != NULL) {
5634 if (nr->action == PF_NAT64) {
5635 PF_ACPY(&psk.gwy.addr, &pd->naddr, pd->naf);
5636 PF_ACPY(&psk.ext_gwy.addr, &pd->ndaddr,
5637 pd->naf);
5638 if ((pd->proto == IPPROTO_ICMPV6) ||
5639 (pd->proto == IPPROTO_ICMP)) {
5640 psk.gwy.xport = nxport;
5641 psk.ext_gwy.xport = nxport;
5642 } else {
5643 psk.gwy.xport = sxport;
5644 psk.ext_gwy.xport = dxport;
5645 }
5646 } else {
5647 PF_ACPY(&psk.gwy.addr, &pd->bdaddr, af);
5648 psk.gwy.xport = bdxport;
5649 PF_ACPY(&psk.ext_gwy.addr, saddr, af);
5650 psk.ext_gwy.xport = sxport;
5651 }
5652 } else {
5653 PF_ACPY(&psk.gwy.addr, &psk.lan.addr, af);
5654 psk.gwy.xport = psk.lan.xport;
5655 PF_ACPY(&psk.ext_gwy.addr, &psk.ext_lan.addr, af);
5656 psk.ext_gwy.xport = psk.ext_lan.xport;
5657 }
5658 }
5659 if (pd->pktflags & PKTF_FLOW_ID) {
5660 /* flow hash was already computed outside of PF */
5661 psk.flowsrc = pd->flowsrc;
5662 psk.flowhash = pd->flowhash;
5663 } else {
5664 /* compute flow hash and store it in state key */
5665 psk.flowsrc = FLOWSRC_PF;
5666 psk.flowhash = pf_calc_state_key_flowhash(&psk);
5667 pd->flowsrc = psk.flowsrc;
5668 pd->flowhash = psk.flowhash;
5669 pd->pktflags |= PKTF_FLOW_ID;
5670 pd->pktflags &= ~PKTF_FLOW_ADV;
5671 }
5672
5673 if (pf_tag_packet(pbuf, pd->pf_mtag, tag, rtableid, pd)) {
5674 REASON_SET(&reason, PFRES_MEMORY);
5675 return PF_DROP;
5676 }
5677
5678 if (!state_icmp && (r->keep_state || nr != NULL ||
5679 (pd->flags & PFDESC_TCP_NORM))) {
5680 /* create new state */
5681 struct pf_state *s = NULL;
5682 struct pf_state_key *sk = NULL;
5683 struct pf_src_node *sn = NULL;
5684 struct pf_ike_hdr ike;
5685
5686 if (pd->proto == IPPROTO_UDP) {
5687 size_t plen = pbuf->pb_packet_len - off - sizeof(*uh);
5688
5689 if (ntohs(uh->uh_sport) == PF_IKE_PORT &&
5690 ntohs(uh->uh_dport) == PF_IKE_PORT &&
5691 plen >= PF_IKE_PACKET_MINSIZE) {
5692 if (plen > PF_IKE_PACKET_MINSIZE) {
5693 plen = PF_IKE_PACKET_MINSIZE;
5694 }
5695 pbuf_copy_data(pbuf, off + sizeof(*uh), plen,
5696 &ike);
5697 }
5698 }
5699
5700 if (nr != NULL && pd->proto == IPPROTO_ESP &&
5701 direction == PF_OUT) {
5702 struct pf_state_key_cmp sk0;
5703 struct pf_state *s0;
5704
5705 /*
5706 * <jhw@apple.com>
5707 * This squelches state creation if the external
5708 * address matches an existing incomplete state with a
5709 * different internal address. Only one 'blocking'
5710 * partial state is allowed for each external address.
5711 */
5712 memset(&sk0, 0, sizeof(sk0));
5713 sk0.af_gwy = pd->af;
5714 sk0.proto = IPPROTO_ESP;
5715 PF_ACPY(&sk0.gwy.addr, saddr, sk0.af_gwy);
5716 PF_ACPY(&sk0.ext_gwy.addr, daddr, sk0.af_gwy);
5717 s0 = pf_find_state(kif, &sk0, PF_IN);
5718
5719 if (s0 && PF_ANEQ(&s0->state_key->lan.addr,
5720 pd->src, pd->af)) {
5721 nsn = 0;
5722 goto cleanup;
5723 }
5724 }
5725
5726 /* check maximums */
5727 if (r->max_states && (r->states >= r->max_states)) {
5728 pf_status.lcounters[LCNT_STATES]++;
5729 REASON_SET(&reason, PFRES_MAXSTATES);
5730 goto cleanup;
5731 }
5732 /* src node for filter rule */
5733 if ((r->rule_flag & PFRULE_SRCTRACK ||
5734 r->rpool.opts & PF_POOL_STICKYADDR) &&
5735 pf_insert_src_node(&sn, r, saddr, af) != 0) {
5736 REASON_SET(&reason, PFRES_SRCLIMIT);
5737 goto cleanup;
5738 }
5739 /* src node for translation rule */
5740 if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) &&
5741 ((direction == PF_OUT &&
5742 nr->action != PF_RDR &&
5743 pf_insert_src_node(&nsn, nr, &pd->baddr, af) != 0) ||
5744 (pf_insert_src_node(&nsn, nr, saddr, af) != 0))) {
5745 REASON_SET(&reason, PFRES_SRCLIMIT);
5746 goto cleanup;
5747 }
5748 s = pool_get(&pf_state_pl, PR_WAITOK);
5749 if (s == NULL) {
5750 REASON_SET(&reason, PFRES_MEMORY);
5751 cleanup:
5752 if (sn != NULL && sn->states == 0 && sn->expire == 0) {
5753 RB_REMOVE(pf_src_tree, &tree_src_tracking, sn);
5754 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
5755 pf_status.src_nodes--;
5756 pool_put(&pf_src_tree_pl, sn);
5757 }
5758 if (nsn != sn && nsn != NULL && nsn->states == 0 &&
5759 nsn->expire == 0) {
5760 RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn);
5761 pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
5762 pf_status.src_nodes--;
5763 pool_put(&pf_src_tree_pl, nsn);
5764 }
5765 if (sk != NULL) {
5766 if (sk->app_state) {
5767 pool_put(&pf_app_state_pl,
5768 sk->app_state);
5769 }
5770 pool_put(&pf_state_key_pl, sk);
5771 }
5772 return PF_DROP;
5773 }
5774 bzero(s, sizeof(*s));
5775 TAILQ_INIT(&s->unlink_hooks);
5776 s->rule.ptr = r;
5777 s->nat_rule.ptr = nr;
5778 s->anchor.ptr = a;
5779 STATE_INC_COUNTERS(s);
5780 s->allow_opts = r->allow_opts;
5781 s->log = r->log & PF_LOG_ALL;
5782 if (nr != NULL) {
5783 s->log |= nr->log & PF_LOG_ALL;
5784 }
5785 switch (pd->proto) {
5786 case IPPROTO_TCP:
5787 s->src.seqlo = ntohl(th->th_seq);
5788 s->src.seqhi = s->src.seqlo + pd->p_len + 1;
5789 if ((th->th_flags & (TH_SYN | TH_ACK)) ==
5790 TH_SYN && r->keep_state == PF_STATE_MODULATE) {
5791 /* Generate sequence number modulator */
5792 if ((s->src.seqdiff = pf_tcp_iss(pd) -
5793 s->src.seqlo) == 0) {
5794 s->src.seqdiff = 1;
5795 }
5796 pf_change_a(&th->th_seq, &th->th_sum,
5797 htonl(s->src.seqlo + s->src.seqdiff), 0);
5798 rewrite = off + sizeof(*th);
5799 } else {
5800 s->src.seqdiff = 0;
5801 }
5802 if (th->th_flags & TH_SYN) {
5803 s->src.seqhi++;
5804 s->src.wscale = pf_get_wscale(pbuf, off,
5805 th->th_off, af);
5806 }
5807 s->src.max_win = MAX(ntohs(th->th_win), 1);
5808 if (s->src.wscale & PF_WSCALE_MASK) {
5809 /* Remove scale factor from initial window */
5810 int win = s->src.max_win;
5811 win += 1 << (s->src.wscale & PF_WSCALE_MASK);
5812 s->src.max_win = (win - 1) >>
5813 (s->src.wscale & PF_WSCALE_MASK);
5814 }
5815 if (th->th_flags & TH_FIN) {
5816 s->src.seqhi++;
5817 }
5818 s->dst.seqhi = 1;
5819 s->dst.max_win = 1;
5820 s->src.state = TCPS_SYN_SENT;
5821 s->dst.state = TCPS_CLOSED;
5822 s->timeout = PFTM_TCP_FIRST_PACKET;
5823 break;
5824 case IPPROTO_UDP:
5825 s->src.state = PFUDPS_SINGLE;
5826 s->dst.state = PFUDPS_NO_TRAFFIC;
5827 s->timeout = PFTM_UDP_FIRST_PACKET;
5828 break;
5829 case IPPROTO_ICMP:
5830 #if INET6
5831 case IPPROTO_ICMPV6:
5832 #endif
5833 s->timeout = PFTM_ICMP_FIRST_PACKET;
5834 break;
5835 case IPPROTO_GRE:
5836 s->src.state = PFGRE1S_INITIATING;
5837 s->dst.state = PFGRE1S_NO_TRAFFIC;
5838 s->timeout = PFTM_GREv1_INITIATING;
5839 break;
5840 case IPPROTO_ESP:
5841 s->src.state = PFESPS_INITIATING;
5842 s->dst.state = PFESPS_NO_TRAFFIC;
5843 s->timeout = PFTM_ESP_FIRST_PACKET;
5844 break;
5845 default:
5846 s->src.state = PFOTHERS_SINGLE;
5847 s->dst.state = PFOTHERS_NO_TRAFFIC;
5848 s->timeout = PFTM_OTHER_FIRST_PACKET;
5849 }
5850
5851 s->creation = pf_time_second();
5852 s->expire = pf_time_second();
5853
5854 if (sn != NULL) {
5855 s->src_node = sn;
5856 s->src_node->states++;
5857 VERIFY(s->src_node->states != 0);
5858 }
5859 if (nsn != NULL) {
5860 PF_ACPY(&nsn->raddr, &pd->naddr, af);
5861 s->nat_src_node = nsn;
5862 s->nat_src_node->states++;
5863 VERIFY(s->nat_src_node->states != 0);
5864 }
5865 if (pd->proto == IPPROTO_TCP) {
5866 if ((pd->flags & PFDESC_TCP_NORM) &&
5867 pf_normalize_tcp_init(pbuf, off, pd, th, &s->src,
5868 &s->dst)) {
5869 REASON_SET(&reason, PFRES_MEMORY);
5870 pf_src_tree_remove_state(s);
5871 STATE_DEC_COUNTERS(s);
5872 pool_put(&pf_state_pl, s);
5873 return PF_DROP;
5874 }
5875 if ((pd->flags & PFDESC_TCP_NORM) && s->src.scrub &&
5876 pf_normalize_tcp_stateful(pbuf, off, pd, &reason,
5877 th, s, &s->src, &s->dst, &rewrite)) {
5878 /* This really shouldn't happen!!! */
5879 DPFPRINTF(PF_DEBUG_URGENT,
5880 ("pf_normalize_tcp_stateful failed on "
5881 "first pkt"));
5882 pf_normalize_tcp_cleanup(s);
5883 pf_src_tree_remove_state(s);
5884 STATE_DEC_COUNTERS(s);
5885 pool_put(&pf_state_pl, s);
5886 return PF_DROP;
5887 }
5888 }
5889
5890 /* allocate state key and import values from psk */
5891 if ((sk = pf_alloc_state_key(s, &psk)) == NULL) {
5892 REASON_SET(&reason, PFRES_MEMORY);
5893 /*
5894 * XXXSCW: This will leak the freshly-allocated
5895 * state structure 's'. Although it should
5896 * eventually be aged-out and removed.
5897 */
5898 goto cleanup;
5899 }
5900
5901 pf_set_rt_ifp(s, saddr, af); /* needs s->state_key set */
5902
5903 pbuf = pd->mp; // XXXSCW: Why?
5904
5905 if (sk->app_state == 0) {
5906 switch (pd->proto) {
5907 case IPPROTO_TCP: {
5908 u_int16_t dport = (direction == PF_OUT) ?
5909 sk->ext_gwy.xport.port : sk->gwy.xport.port;
5910
5911 if (nr != NULL &&
5912 ntohs(dport) == PF_PPTP_PORT) {
5913 struct pf_app_state *as;
5914
5915 as = pool_get(&pf_app_state_pl,
5916 PR_WAITOK);
5917 if (!as) {
5918 REASON_SET(&reason,
5919 PFRES_MEMORY);
5920 goto cleanup;
5921 }
5922
5923 bzero(as, sizeof(*as));
5924 as->handler = pf_pptp_handler;
5925 as->compare_lan_ext = 0;
5926 as->compare_ext_gwy = 0;
5927 as->u.pptp.grev1_state = 0;
5928 sk->app_state = as;
5929 (void) hook_establish(&s->unlink_hooks,
5930 0, (hook_fn_t) pf_pptp_unlink, s);
5931 }
5932 break;
5933 }
5934
5935 case IPPROTO_UDP: {
5936 if (nr != NULL &&
5937 ntohs(uh->uh_sport) == PF_IKE_PORT &&
5938 ntohs(uh->uh_dport) == PF_IKE_PORT) {
5939 struct pf_app_state *as;
5940
5941 as = pool_get(&pf_app_state_pl,
5942 PR_WAITOK);
5943 if (!as) {
5944 REASON_SET(&reason,
5945 PFRES_MEMORY);
5946 goto cleanup;
5947 }
5948
5949 bzero(as, sizeof(*as));
5950 as->compare_lan_ext = pf_ike_compare;
5951 as->compare_ext_gwy = pf_ike_compare;
5952 as->u.ike.cookie = ike.initiator_cookie;
5953 sk->app_state = as;
5954 }
5955 break;
5956 }
5957
5958 default:
5959 break;
5960 }
5961 }
5962
5963 if (pf_insert_state(BOUND_IFACE(r, kif), s)) {
5964 if (pd->proto == IPPROTO_TCP) {
5965 pf_normalize_tcp_cleanup(s);
5966 }
5967 REASON_SET(&reason, PFRES_STATEINS);
5968 pf_src_tree_remove_state(s);
5969 STATE_DEC_COUNTERS(s);
5970 pool_put(&pf_state_pl, s);
5971 return PF_DROP;
5972 } else {
5973 *sm = s;
5974 }
5975 if (tag > 0) {
5976 pf_tag_ref(tag);
5977 s->tag = tag;
5978 }
5979 if (pd->proto == IPPROTO_TCP &&
5980 (th->th_flags & (TH_SYN | TH_ACK)) == TH_SYN &&
5981 r->keep_state == PF_STATE_SYNPROXY) {
5982 int ua = (sk->af_lan == sk->af_gwy) ? 1 : 0;
5983 s->src.state = PF_TCPS_PROXY_SRC;
5984 if (nr != NULL) {
5985 if (direction == PF_OUT) {
5986 pf_change_ap(direction, pd->mp, saddr,
5987 &th->th_sport, pd->ip_sum,
5988 &th->th_sum, &pd->baddr,
5989 bxport.port, 0, af, pd->af, ua);
5990 sxport.port = th->th_sport;
5991 } else {
5992 pf_change_ap(direction, pd->mp, daddr,
5993 &th->th_dport, pd->ip_sum,
5994 &th->th_sum, &pd->baddr,
5995 bxport.port, 0, af, pd->af, ua);
5996 sxport.port = th->th_dport;
5997 }
5998 }
5999 s->src.seqhi = htonl(random());
6000 /* Find mss option */
6001 mss = pf_get_mss(pbuf, off, th->th_off, af);
6002 mss = pf_calc_mss(saddr, af, mss);
6003 mss = pf_calc_mss(daddr, af, mss);
6004 s->src.mss = mss;
6005 pf_send_tcp(r, af, daddr, saddr, th->th_dport,
6006 th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1,
6007 TH_SYN | TH_ACK, 0, s->src.mss, 0, 1, 0, NULL, NULL);
6008 REASON_SET(&reason, PFRES_SYNPROXY);
6009 return PF_SYNPROXY_DROP;
6010 }
6011
6012 if (sk->app_state && sk->app_state->handler) {
6013 int offx = off;
6014
6015 switch (pd->proto) {
6016 case IPPROTO_TCP:
6017 offx += th->th_off << 2;
6018 break;
6019 case IPPROTO_UDP:
6020 offx += pd->hdr.udp->uh_ulen << 2;
6021 break;
6022 default:
6023 /* ALG handlers only apply to TCP and UDP rules */
6024 break;
6025 }
6026
6027 if (offx > off) {
6028 sk->app_state->handler(s, direction, offx,
6029 pd, kif);
6030 if (pd->lmw < 0) {
6031 REASON_SET(&reason, PFRES_MEMORY);
6032 return PF_DROP;
6033 }
6034 pbuf = pd->mp; // XXXSCW: Why?
6035 }
6036 }
6037 }
6038
6039 /* copy back packet headers if we performed NAT operations */
6040 if (rewrite) {
6041 if (rewrite < off + hdrlen) {
6042 rewrite = off + hdrlen;
6043 }
6044
6045 if (pf_lazy_makewritable(pd, pd->mp, rewrite) == NULL) {
6046 REASON_SET(&reason, PFRES_MEMORY);
6047 return PF_DROP;
6048 }
6049
6050 pbuf_copy_back(pbuf, off, hdrlen, pd->hdr.any);
6051 if (af == AF_INET6 && pd->naf == AF_INET) {
6052 return pf_nat64_ipv6(pbuf, off, pd);
6053 } else if (af == AF_INET && pd->naf == AF_INET6) {
6054 return pf_nat64_ipv4(pbuf, off, pd);
6055 }
6056 }
6057
6058 return PF_PASS;
6059 }
6060
6061 boolean_t is_nlc_enabled_glb = FALSE;
6062
6063 static inline boolean_t
6064 pf_is_dummynet_enabled(void)
6065 {
6066 #if DUMMYNET
6067 if (__probable(!PF_IS_ENABLED)) {
6068 return FALSE;
6069 }
6070
6071 if (__probable(!DUMMYNET_LOADED)) {
6072 return FALSE;
6073 }
6074
6075 if (__probable(TAILQ_EMPTY(pf_main_ruleset.
6076 rules[PF_RULESET_DUMMYNET].active.ptr))) {
6077 return FALSE;
6078 }
6079
6080 return TRUE;
6081 #else
6082 return FALSE;
6083 #endif /* DUMMYNET */
6084 }
6085
6086 #if DUMMYNET
6087 /*
6088 * When pf_test_dummynet() returns PF_PASS, the rule matching parameter "rm"
6089 * remains unchanged, meaning the packet did not match a dummynet rule.
6090 * when the packet does match a dummynet rule, pf_test_dummynet() returns
6091 * PF_PASS and zero out the mbuf rule as the packet is effectively siphoned
6092 * out by dummynet.
6093 */
6094 static int
6095 pf_test_dummynet(struct pf_rule **rm, int direction, struct pfi_kif *kif,
6096 pbuf_t **pbuf0, struct pf_pdesc *pd, struct ip_fw_args *fwa)
6097 {
6098 pbuf_t *pbuf = *pbuf0;
6099 struct pf_rule *am = NULL;
6100 struct pf_ruleset *rsm = NULL;
6101 struct pf_addr *saddr = pd->src, *daddr = pd->dst;
6102 sa_family_t af = pd->af;
6103 struct pf_rule *r, *a = NULL;
6104 struct pf_ruleset *ruleset = NULL;
6105 struct tcphdr *th = pd->hdr.tcp;
6106 u_short reason;
6107 int hdrlen = 0;
6108 int tag = -1;
6109 unsigned int rtableid = IFSCOPE_NONE;
6110 int asd = 0;
6111 int match = 0;
6112 u_int8_t icmptype = 0, icmpcode = 0;
6113 struct ip_fw_args dnflow;
6114 struct pf_rule *prev_matching_rule = fwa ? fwa->fwa_pf_rule : NULL;
6115 int found_prev_rule = (prev_matching_rule) ? 0 : 1;
6116
6117 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
6118
6119 if (!pf_is_dummynet_enabled()) {
6120 return PF_PASS;
6121 }
6122
6123 bzero(&dnflow, sizeof(dnflow));
6124
6125 hdrlen = 0;
6126
6127 /* Fragments don't gave protocol headers */
6128 if (!(pd->flags & PFDESC_IP_FRAG)) {
6129 switch (pd->proto) {
6130 case IPPROTO_TCP:
6131 dnflow.fwa_id.flags = pd->hdr.tcp->th_flags;
6132 dnflow.fwa_id.dst_port = ntohs(pd->hdr.tcp->th_dport);
6133 dnflow.fwa_id.src_port = ntohs(pd->hdr.tcp->th_sport);
6134 hdrlen = sizeof(*th);
6135 break;
6136 case IPPROTO_UDP:
6137 dnflow.fwa_id.dst_port = ntohs(pd->hdr.udp->uh_dport);
6138 dnflow.fwa_id.src_port = ntohs(pd->hdr.udp->uh_sport);
6139 hdrlen = sizeof(*pd->hdr.udp);
6140 break;
6141 #if INET
6142 case IPPROTO_ICMP:
6143 if (af != AF_INET) {
6144 break;
6145 }
6146 hdrlen = ICMP_MINLEN;
6147 icmptype = pd->hdr.icmp->icmp_type;
6148 icmpcode = pd->hdr.icmp->icmp_code;
6149 break;
6150 #endif /* INET */
6151 #if INET6
6152 case IPPROTO_ICMPV6:
6153 if (af != AF_INET6) {
6154 break;
6155 }
6156 hdrlen = sizeof(*pd->hdr.icmp6);
6157 icmptype = pd->hdr.icmp6->icmp6_type;
6158 icmpcode = pd->hdr.icmp6->icmp6_code;
6159 break;
6160 #endif /* INET6 */
6161 case IPPROTO_GRE:
6162 if (pd->proto_variant == PF_GRE_PPTP_VARIANT) {
6163 hdrlen = sizeof(*pd->hdr.grev1);
6164 }
6165 break;
6166 case IPPROTO_ESP:
6167 hdrlen = sizeof(*pd->hdr.esp);
6168 break;
6169 }
6170 }
6171
6172 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_DUMMYNET].active.ptr);
6173
6174 while (r != NULL) {
6175 r->evaluations++;
6176 if (pfi_kif_match(r->kif, kif) == r->ifnot) {
6177 r = r->skip[PF_SKIP_IFP].ptr;
6178 } else if (r->direction && r->direction != direction) {
6179 r = r->skip[PF_SKIP_DIR].ptr;
6180 } else if (r->af && r->af != af) {
6181 r = r->skip[PF_SKIP_AF].ptr;
6182 } else if (r->proto && r->proto != pd->proto) {
6183 r = r->skip[PF_SKIP_PROTO].ptr;
6184 } else if (PF_MISMATCHAW(&r->src.addr, saddr, af,
6185 r->src.neg, kif)) {
6186 r = r->skip[PF_SKIP_SRC_ADDR].ptr;
6187 }
6188 /* tcp/udp only. port_op always 0 in other cases */
6189 else if (r->proto == pd->proto &&
6190 (r->proto == IPPROTO_TCP || r->proto == IPPROTO_UDP) &&
6191 ((pd->flags & PFDESC_IP_FRAG) ||
6192 ((r->src.xport.range.op &&
6193 !pf_match_port(r->src.xport.range.op,
6194 r->src.xport.range.port[0], r->src.xport.range.port[1],
6195 th->th_sport))))) {
6196 r = r->skip[PF_SKIP_SRC_PORT].ptr;
6197 } else if (PF_MISMATCHAW(&r->dst.addr, daddr, af,
6198 r->dst.neg, NULL)) {
6199 r = r->skip[PF_SKIP_DST_ADDR].ptr;
6200 }
6201 /* tcp/udp only. port_op always 0 in other cases */
6202 else if (r->proto == pd->proto &&
6203 (r->proto == IPPROTO_TCP || r->proto == IPPROTO_UDP) &&
6204 r->dst.xport.range.op &&
6205 ((pd->flags & PFDESC_IP_FRAG) ||
6206 !pf_match_port(r->dst.xport.range.op,
6207 r->dst.xport.range.port[0], r->dst.xport.range.port[1],
6208 th->th_dport))) {
6209 r = r->skip[PF_SKIP_DST_PORT].ptr;
6210 }
6211 /* icmp only. type always 0 in other cases */
6212 else if (r->type &&
6213 ((pd->flags & PFDESC_IP_FRAG) ||
6214 r->type != icmptype + 1)) {
6215 r = TAILQ_NEXT(r, entries);
6216 }
6217 /* icmp only. type always 0 in other cases */
6218 else if (r->code &&
6219 ((pd->flags & PFDESC_IP_FRAG) ||
6220 r->code != icmpcode + 1)) {
6221 r = TAILQ_NEXT(r, entries);
6222 } else if (r->tos && !(r->tos == pd->tos)) {
6223 r = TAILQ_NEXT(r, entries);
6224 } else if (r->rule_flag & PFRULE_FRAGMENT) {
6225 r = TAILQ_NEXT(r, entries);
6226 } else if (pd->proto == IPPROTO_TCP &&
6227 ((pd->flags & PFDESC_IP_FRAG) ||
6228 (r->flagset & th->th_flags) != r->flags)) {
6229 r = TAILQ_NEXT(r, entries);
6230 } else if (r->prob && r->prob <= (RandomULong() % (UINT_MAX - 1) + 1)) {
6231 r = TAILQ_NEXT(r, entries);
6232 } else if (r->match_tag && !pf_match_tag(r, pd->pf_mtag, &tag)) {
6233 r = TAILQ_NEXT(r, entries);
6234 } else {
6235 /*
6236 * Need to go past the previous dummynet matching rule
6237 */
6238 if (r->anchor == NULL) {
6239 if (found_prev_rule) {
6240 if (r->tag) {
6241 tag = r->tag;
6242 }
6243 if (PF_RTABLEID_IS_VALID(r->rtableid)) {
6244 rtableid = r->rtableid;
6245 }
6246 match = 1;
6247 *rm = r;
6248 am = a;
6249 rsm = ruleset;
6250 if ((*rm)->quick) {
6251 break;
6252 }
6253 } else if (r == prev_matching_rule) {
6254 found_prev_rule = 1;
6255 }
6256 r = TAILQ_NEXT(r, entries);
6257 } else {
6258 pf_step_into_anchor(&asd, &ruleset,
6259 PF_RULESET_DUMMYNET, &r, &a, &match);
6260 }
6261 }
6262 if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset,
6263 PF_RULESET_DUMMYNET, &r, &a, &match)) {
6264 break;
6265 }
6266 }
6267 r = *rm;
6268 a = am;
6269 ruleset = rsm;
6270
6271 if (!match) {
6272 return PF_PASS;
6273 }
6274
6275 REASON_SET(&reason, PFRES_DUMMYNET);
6276
6277 if (r->log) {
6278 PFLOG_PACKET(kif, h, pbuf, af, direction, reason, r,
6279 a, ruleset, pd);
6280 }
6281
6282 if (r->action == PF_NODUMMYNET) {
6283 int dirndx = (direction == PF_OUT);
6284
6285 r->packets[dirndx]++;
6286 r->bytes[dirndx] += pd->tot_len;
6287
6288 return PF_PASS;
6289 }
6290 if (pf_tag_packet(pbuf, pd->pf_mtag, tag, rtableid, pd)) {
6291 REASON_SET(&reason, PFRES_MEMORY);
6292
6293 return PF_DROP;
6294 }
6295
6296 if (r->dnpipe && ip_dn_io_ptr != NULL) {
6297 struct mbuf *m;
6298 int dirndx = (direction == PF_OUT);
6299
6300 r->packets[dirndx]++;
6301 r->bytes[dirndx] += pd->tot_len;
6302
6303 dnflow.fwa_cookie = r->dnpipe;
6304 dnflow.fwa_pf_rule = r;
6305 dnflow.fwa_id.proto = pd->proto;
6306 dnflow.fwa_flags = r->dntype;
6307 switch (af) {
6308 case AF_INET:
6309 dnflow.fwa_id.addr_type = 4;
6310 dnflow.fwa_id.src_ip = ntohl(saddr->v4addr.s_addr);
6311 dnflow.fwa_id.dst_ip = ntohl(daddr->v4addr.s_addr);
6312 break;
6313 case AF_INET6:
6314 dnflow.fwa_id.addr_type = 6;
6315 dnflow.fwa_id.src_ip6 = saddr->v6addr;
6316 dnflow.fwa_id.dst_ip6 = saddr->v6addr;
6317 break;
6318 }
6319
6320 if (fwa != NULL) {
6321 dnflow.fwa_oif = fwa->fwa_oif;
6322 dnflow.fwa_oflags = fwa->fwa_oflags;
6323 /*
6324 * Note that fwa_ro, fwa_dst and fwa_ipoa are
6325 * actually in a union so the following does work
6326 * for both IPv4 and IPv6
6327 */
6328 dnflow.fwa_ro = fwa->fwa_ro;
6329 dnflow.fwa_dst = fwa->fwa_dst;
6330 dnflow.fwa_ipoa = fwa->fwa_ipoa;
6331 dnflow.fwa_ro6_pmtu = fwa->fwa_ro6_pmtu;
6332 dnflow.fwa_origifp = fwa->fwa_origifp;
6333 dnflow.fwa_mtu = fwa->fwa_mtu;
6334 dnflow.fwa_unfragpartlen = fwa->fwa_unfragpartlen;
6335 dnflow.fwa_exthdrs = fwa->fwa_exthdrs;
6336 }
6337
6338 if (af == AF_INET) {
6339 struct ip *iphdr = pbuf->pb_data;
6340 NTOHS(iphdr->ip_len);
6341 NTOHS(iphdr->ip_off);
6342 }
6343 /*
6344 * Don't need to unlock pf_lock as NET_THREAD_HELD_PF
6345 * allows for recursive behavior
6346 */
6347 m = pbuf_to_mbuf(pbuf, TRUE);
6348 if (m != NULL) {
6349 ip_dn_io_ptr(m,
6350 dnflow.fwa_cookie, (af == AF_INET) ?
6351 ((direction == PF_IN) ? DN_TO_IP_IN : DN_TO_IP_OUT) :
6352 ((direction == PF_IN) ? DN_TO_IP6_IN : DN_TO_IP6_OUT),
6353 &dnflow, DN_CLIENT_PF);
6354 }
6355
6356 /*
6357 * The packet is siphoned out by dummynet so return a NULL
6358 * pbuf so the caller can still return success.
6359 */
6360 *pbuf0 = NULL;
6361
6362 return PF_PASS;
6363 }
6364
6365 return PF_PASS;
6366 }
6367 #endif /* DUMMYNET */
6368
6369 static int
6370 pf_test_fragment(struct pf_rule **rm, int direction, struct pfi_kif *kif,
6371 pbuf_t *pbuf, void *h, struct pf_pdesc *pd, struct pf_rule **am,
6372 struct pf_ruleset **rsm)
6373 {
6374 #pragma unused(h)
6375 struct pf_rule *r, *a = NULL;
6376 struct pf_ruleset *ruleset = NULL;
6377 sa_family_t af = pd->af;
6378 u_short reason;
6379 int tag = -1;
6380 int asd = 0;
6381 int match = 0;
6382
6383 r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
6384 while (r != NULL) {
6385 r->evaluations++;
6386 if (pfi_kif_match(r->kif, kif) == r->ifnot) {
6387 r = r->skip[PF_SKIP_IFP].ptr;
6388 } else if (r->direction && r->direction != direction) {
6389 r = r->skip[PF_SKIP_DIR].ptr;
6390 } else if (r->af && r->af != af) {
6391 r = r->skip[PF_SKIP_AF].ptr;
6392 } else if (r->proto && r->proto != pd->proto) {
6393 r = r->skip[PF_SKIP_PROTO].ptr;
6394 } else if (PF_MISMATCHAW(&r->src.addr, pd->src, af,
6395 r->src.neg, kif)) {
6396 r = r->skip[PF_SKIP_SRC_ADDR].ptr;
6397 } else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af,
6398 r->dst.neg, NULL)) {
6399 r = r->skip[PF_SKIP_DST_ADDR].ptr;
6400 } else if ((r->rule_flag & PFRULE_TOS) && r->tos &&
6401 !(r->tos & pd->tos)) {
6402 r = TAILQ_NEXT(r, entries);
6403 } else if ((r->rule_flag & PFRULE_DSCP) && r->tos &&
6404 !(r->tos & (pd->tos & DSCP_MASK))) {
6405 r = TAILQ_NEXT(r, entries);
6406 } else if ((r->rule_flag & PFRULE_SC) && r->tos &&
6407 ((r->tos & SCIDX_MASK) != pd->sc)) {
6408 r = TAILQ_NEXT(r, entries);
6409 } else if (r->os_fingerprint != PF_OSFP_ANY) {
6410 r = TAILQ_NEXT(r, entries);
6411 } else if (pd->proto == IPPROTO_UDP &&
6412 (r->src.xport.range.op || r->dst.xport.range.op)) {
6413 r = TAILQ_NEXT(r, entries);
6414 } else if (pd->proto == IPPROTO_TCP &&
6415 (r->src.xport.range.op || r->dst.xport.range.op ||
6416 r->flagset)) {
6417 r = TAILQ_NEXT(r, entries);
6418 } else if ((pd->proto == IPPROTO_ICMP ||
6419 pd->proto == IPPROTO_ICMPV6) &&
6420 (r->type || r->code)) {
6421 r = TAILQ_NEXT(r, entries);
6422 } else if (r->prob && r->prob <= (RandomULong() % (UINT_MAX - 1) + 1)) {
6423 r = TAILQ_NEXT(r, entries);
6424 } else if (r->match_tag && !pf_match_tag(r, pd->pf_mtag, &tag)) {
6425 r = TAILQ_NEXT(r, entries);
6426 } else {
6427 if (r->anchor == NULL) {
6428 match = 1;
6429 *rm = r;
6430 *am = a;
6431 *rsm = ruleset;
6432 if ((*rm)->quick) {
6433 break;
6434 }
6435 r = TAILQ_NEXT(r, entries);
6436 } else {
6437 pf_step_into_anchor(&asd, &ruleset,
6438 PF_RULESET_FILTER, &r, &a, &match);
6439 }
6440 }
6441 if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset,
6442 PF_RULESET_FILTER, &r, &a, &match)) {
6443 break;
6444 }
6445 }
6446 r = *rm;
6447 a = *am;
6448 ruleset = *rsm;
6449
6450 REASON_SET(&reason, PFRES_MATCH);
6451
6452 if (r->log) {
6453 PFLOG_PACKET(kif, h, pbuf, af, direction, reason, r, a, ruleset,
6454 pd);
6455 }
6456
6457 if (r->action != PF_PASS) {
6458 return PF_DROP;
6459 }
6460
6461 if (pf_tag_packet(pbuf, pd->pf_mtag, tag, -1, NULL)) {
6462 REASON_SET(&reason, PFRES_MEMORY);
6463 return PF_DROP;
6464 }
6465
6466 return PF_PASS;
6467 }
6468
6469 static void
6470 pf_pptp_handler(struct pf_state *s, int direction, int off,
6471 struct pf_pdesc *pd, struct pfi_kif *kif)
6472 {
6473 #pragma unused(direction)
6474 struct tcphdr *th;
6475 struct pf_pptp_state *pptps;
6476 struct pf_pptp_ctrl_msg cm;
6477 size_t plen, tlen;
6478 struct pf_state *gs;
6479 u_int16_t ct;
6480 u_int16_t *pac_call_id;
6481 u_int16_t *pns_call_id;
6482 u_int16_t *spoof_call_id;
6483 u_int8_t *pac_state;
6484 u_int8_t *pns_state;
6485 enum { PF_PPTP_PASS, PF_PPTP_INSERT_GRE, PF_PPTP_REMOVE_GRE } op;
6486 pbuf_t *pbuf;
6487 struct pf_state_key *sk;
6488 struct pf_state_key *gsk;
6489 struct pf_app_state *gas;
6490
6491 sk = s->state_key;
6492 pptps = &sk->app_state->u.pptp;
6493 gs = pptps->grev1_state;
6494
6495 if (gs) {
6496 gs->expire = pf_time_second();
6497 }
6498
6499 pbuf = pd->mp;
6500 plen = min(sizeof(cm), pbuf->pb_packet_len - off);
6501 if (plen < PF_PPTP_CTRL_MSG_MINSIZE) {
6502 return;
6503 }
6504 tlen = plen - PF_PPTP_CTRL_MSG_MINSIZE;
6505 pbuf_copy_data(pbuf, off, plen, &cm);
6506
6507 if (ntohl(cm.hdr.magic) != PF_PPTP_MAGIC_NUMBER) {
6508 return;
6509 }
6510 if (ntohs(cm.hdr.type) != 1) {
6511 return;
6512 }
6513
6514 #define TYPE_LEN_CHECK(_type, _name) \
6515 case PF_PPTP_CTRL_TYPE_##_type: \
6516 if (tlen < sizeof(struct pf_pptp_ctrl_##_name)) \
6517 return; \
6518 break;
6519
6520 switch (cm.ctrl.type) {
6521 TYPE_LEN_CHECK(START_REQ, start_req);
6522 TYPE_LEN_CHECK(START_RPY, start_rpy);
6523 TYPE_LEN_CHECK(STOP_REQ, stop_req);
6524 TYPE_LEN_CHECK(STOP_RPY, stop_rpy);
6525 TYPE_LEN_CHECK(ECHO_REQ, echo_req);
6526 TYPE_LEN_CHECK(ECHO_RPY, echo_rpy);
6527 TYPE_LEN_CHECK(CALL_OUT_REQ, call_out_req);
6528 TYPE_LEN_CHECK(CALL_OUT_RPY, call_out_rpy);
6529 TYPE_LEN_CHECK(CALL_IN_1ST, call_in_1st);
6530 TYPE_LEN_CHECK(CALL_IN_2ND, call_in_2nd);
6531 TYPE_LEN_CHECK(CALL_IN_3RD, call_in_3rd);
6532 TYPE_LEN_CHECK(CALL_CLR, call_clr);
6533 TYPE_LEN_CHECK(CALL_DISC, call_disc);
6534 TYPE_LEN_CHECK(ERROR, error);
6535 TYPE_LEN_CHECK(SET_LINKINFO, set_linkinfo);
6536 default:
6537 return;
6538 }
6539 #undef TYPE_LEN_CHECK
6540
6541 if (!gs) {
6542 gs = pool_get(&pf_state_pl, PR_WAITOK);
6543 if (!gs) {
6544 return;
6545 }
6546
6547 memcpy(gs, s, sizeof(*gs));
6548
6549 memset(&gs->entry_id, 0, sizeof(gs->entry_id));
6550 memset(&gs->entry_list, 0, sizeof(gs->entry_list));
6551
6552 TAILQ_INIT(&gs->unlink_hooks);
6553 gs->rt_kif = NULL;
6554 gs->creation = 0;
6555 gs->pfsync_time = 0;
6556 gs->packets[0] = gs->packets[1] = 0;
6557 gs->bytes[0] = gs->bytes[1] = 0;
6558 gs->timeout = PFTM_UNLINKED;
6559 gs->id = gs->creatorid = 0;
6560 gs->src.state = gs->dst.state = PFGRE1S_NO_TRAFFIC;
6561 gs->src.scrub = gs->dst.scrub = 0;
6562
6563 gas = pool_get(&pf_app_state_pl, PR_NOWAIT);
6564 if (!gas) {
6565 pool_put(&pf_state_pl, gs);
6566 return;
6567 }
6568
6569 gsk = pf_alloc_state_key(gs, NULL);
6570 if (!gsk) {
6571 pool_put(&pf_app_state_pl, gas);
6572 pool_put(&pf_state_pl, gs);
6573 return;
6574 }
6575
6576 memcpy(&gsk->lan, &sk->lan, sizeof(gsk->lan));
6577 memcpy(&gsk->gwy, &sk->gwy, sizeof(gsk->gwy));
6578 memcpy(&gsk->ext_lan, &sk->ext_lan, sizeof(gsk->ext_lan));
6579 memcpy(&gsk->ext_gwy, &sk->ext_gwy, sizeof(gsk->ext_gwy));
6580 gsk->af_lan = sk->af_lan;
6581 gsk->af_gwy = sk->af_gwy;
6582 gsk->proto = IPPROTO_GRE;
6583 gsk->proto_variant = PF_GRE_PPTP_VARIANT;
6584 gsk->app_state = gas;
6585 gsk->lan.xport.call_id = 0;
6586 gsk->gwy.xport.call_id = 0;
6587 gsk->ext_lan.xport.call_id = 0;
6588 gsk->ext_gwy.xport.call_id = 0;
6589 gsk->flowsrc = FLOWSRC_PF;
6590 gsk->flowhash = pf_calc_state_key_flowhash(gsk);
6591 memset(gas, 0, sizeof(*gas));
6592 gas->u.grev1.pptp_state = s;
6593 STATE_INC_COUNTERS(gs);
6594 pptps->grev1_state = gs;
6595 (void) hook_establish(&gs->unlink_hooks, 0,
6596 (hook_fn_t) pf_grev1_unlink, gs);
6597 } else {
6598 gsk = gs->state_key;
6599 }
6600
6601 switch (sk->direction) {
6602 case PF_IN:
6603 pns_call_id = &gsk->ext_lan.xport.call_id;
6604 pns_state = &gs->dst.state;
6605 pac_call_id = &gsk->lan.xport.call_id;
6606 pac_state = &gs->src.state;
6607 break;
6608
6609 case PF_OUT:
6610 pns_call_id = &gsk->lan.xport.call_id;
6611 pns_state = &gs->src.state;
6612 pac_call_id = &gsk->ext_lan.xport.call_id;
6613 pac_state = &gs->dst.state;
6614 break;
6615
6616 default:
6617 DPFPRINTF(PF_DEBUG_URGENT,
6618 ("pf_pptp_handler: bad directional!\n"));
6619 return;
6620 }
6621
6622 spoof_call_id = 0;
6623 op = PF_PPTP_PASS;
6624
6625 ct = ntohs(cm.ctrl.type);
6626
6627 switch (ct) {
6628 case PF_PPTP_CTRL_TYPE_CALL_OUT_REQ:
6629 *pns_call_id = cm.msg.call_out_req.call_id;
6630 *pns_state = PFGRE1S_INITIATING;
6631 if (s->nat_rule.ptr && pns_call_id == &gsk->lan.xport.call_id) {
6632 spoof_call_id = &cm.msg.call_out_req.call_id;
6633 }
6634 break;
6635
6636 case PF_PPTP_CTRL_TYPE_CALL_OUT_RPY:
6637 *pac_call_id = cm.msg.call_out_rpy.call_id;
6638 if (s->nat_rule.ptr) {
6639 spoof_call_id =
6640 (pac_call_id == &gsk->lan.xport.call_id) ?
6641 &cm.msg.call_out_rpy.call_id :
6642 &cm.msg.call_out_rpy.peer_call_id;
6643 }
6644 if (gs->timeout == PFTM_UNLINKED) {
6645 *pac_state = PFGRE1S_INITIATING;
6646 op = PF_PPTP_INSERT_GRE;
6647 }
6648 break;
6649
6650 case PF_PPTP_CTRL_TYPE_CALL_IN_1ST:
6651 *pns_call_id = cm.msg.call_in_1st.call_id;
6652 *pns_state = PFGRE1S_INITIATING;
6653 if (s->nat_rule.ptr && pns_call_id == &gsk->lan.xport.call_id) {
6654 spoof_call_id = &cm.msg.call_in_1st.call_id;
6655 }
6656 break;
6657
6658 case PF_PPTP_CTRL_TYPE_CALL_IN_2ND:
6659 *pac_call_id = cm.msg.call_in_2nd.call_id;
6660 *pac_state = PFGRE1S_INITIATING;
6661 if (s->nat_rule.ptr) {
6662 spoof_call_id =
6663 (pac_call_id == &gsk->lan.xport.call_id) ?
6664 &cm.msg.call_in_2nd.call_id :
6665 &cm.msg.call_in_2nd.peer_call_id;
6666 }
6667 break;
6668
6669 case PF_PPTP_CTRL_TYPE_CALL_IN_3RD:
6670 if (s->nat_rule.ptr && pns_call_id == &gsk->lan.xport.call_id) {
6671 spoof_call_id = &cm.msg.call_in_3rd.call_id;
6672 }
6673 if (cm.msg.call_in_3rd.call_id != *pns_call_id) {
6674 break;
6675 }
6676 if (gs->timeout == PFTM_UNLINKED) {
6677 op = PF_PPTP_INSERT_GRE;
6678 }
6679 break;
6680
6681 case PF_PPTP_CTRL_TYPE_CALL_CLR:
6682 if (cm.msg.call_clr.call_id != *pns_call_id) {
6683 op = PF_PPTP_REMOVE_GRE;
6684 }
6685 break;
6686
6687 case PF_PPTP_CTRL_TYPE_CALL_DISC:
6688 if (cm.msg.call_clr.call_id != *pac_call_id) {
6689 op = PF_PPTP_REMOVE_GRE;
6690 }
6691 break;
6692
6693 case PF_PPTP_CTRL_TYPE_ERROR:
6694 if (s->nat_rule.ptr && pns_call_id == &gsk->lan.xport.call_id) {
6695 spoof_call_id = &cm.msg.error.peer_call_id;
6696 }
6697 break;
6698
6699 case PF_PPTP_CTRL_TYPE_SET_LINKINFO:
6700 if (s->nat_rule.ptr && pac_call_id == &gsk->lan.xport.call_id) {
6701 spoof_call_id = &cm.msg.set_linkinfo.peer_call_id;
6702 }
6703 break;
6704
6705 default:
6706 op = PF_PPTP_PASS;
6707 break;
6708 }
6709
6710 if (!gsk->gwy.xport.call_id && gsk->lan.xport.call_id) {
6711 gsk->gwy.xport.call_id = gsk->lan.xport.call_id;
6712 if (spoof_call_id) {
6713 u_int16_t call_id = 0;
6714 int n = 0;
6715 struct pf_state_key_cmp key;
6716
6717 key.af_gwy = gsk->af_gwy;
6718 key.proto = IPPROTO_GRE;
6719 key.proto_variant = PF_GRE_PPTP_VARIANT;
6720 PF_ACPY(&key.gwy.addr, &gsk->gwy.addr, key.af_gwy);
6721 PF_ACPY(&key.ext_gwy.addr, &gsk->ext_gwy.addr, key.af_gwy);
6722 key.gwy.xport.call_id = gsk->gwy.xport.call_id;
6723 key.ext_gwy.xport.call_id = gsk->ext_gwy.xport.call_id;
6724 do {
6725 call_id = htonl(random());
6726 } while (!call_id);
6727
6728 while (pf_find_state_all(&key, PF_IN, 0)) {
6729 call_id = ntohs(call_id);
6730 --call_id;
6731 if (--call_id == 0) {
6732 call_id = 0xffff;
6733 }
6734 call_id = htons(call_id);
6735
6736 key.gwy.xport.call_id = call_id;
6737
6738 if (++n > 65535) {
6739 DPFPRINTF(PF_DEBUG_URGENT,
6740 ("pf_pptp_handler: failed to spoof "
6741 "call id\n"));
6742 key.gwy.xport.call_id = 0;
6743 break;
6744 }
6745 }
6746
6747 gsk->gwy.xport.call_id = call_id;
6748 }
6749 }
6750
6751 th = pd->hdr.tcp;
6752
6753 if (spoof_call_id && gsk->lan.xport.call_id != gsk->gwy.xport.call_id) {
6754 if (*spoof_call_id == gsk->gwy.xport.call_id) {
6755 *spoof_call_id = gsk->lan.xport.call_id;
6756 th->th_sum = pf_cksum_fixup(th->th_sum,
6757 gsk->gwy.xport.call_id, gsk->lan.xport.call_id, 0);
6758 } else {
6759 *spoof_call_id = gsk->gwy.xport.call_id;
6760 th->th_sum = pf_cksum_fixup(th->th_sum,
6761 gsk->lan.xport.call_id, gsk->gwy.xport.call_id, 0);
6762 }
6763
6764 if (pf_lazy_makewritable(pd, pbuf, off + plen) == NULL) {
6765 pptps->grev1_state = NULL;
6766 STATE_DEC_COUNTERS(gs);
6767 pool_put(&pf_state_pl, gs);
6768 return;
6769 }
6770 pbuf_copy_back(pbuf, off, plen, &cm);
6771 }
6772
6773 switch (op) {
6774 case PF_PPTP_REMOVE_GRE:
6775 gs->timeout = PFTM_PURGE;
6776 gs->src.state = gs->dst.state = PFGRE1S_NO_TRAFFIC;
6777 gsk->lan.xport.call_id = 0;
6778 gsk->gwy.xport.call_id = 0;
6779 gsk->ext_lan.xport.call_id = 0;
6780 gsk->ext_gwy.xport.call_id = 0;
6781 gs->id = gs->creatorid = 0;
6782 break;
6783
6784 case PF_PPTP_INSERT_GRE:
6785 gs->creation = pf_time_second();
6786 gs->expire = pf_time_second();
6787 gs->timeout = PFTM_TCP_ESTABLISHED;
6788 if (gs->src_node != NULL) {
6789 ++gs->src_node->states;
6790 VERIFY(gs->src_node->states != 0);
6791 }
6792 if (gs->nat_src_node != NULL) {
6793 ++gs->nat_src_node->states;
6794 VERIFY(gs->nat_src_node->states != 0);
6795 }
6796 pf_set_rt_ifp(gs, &sk->lan.addr, sk->af_lan);
6797 if (pf_insert_state(BOUND_IFACE(s->rule.ptr, kif), gs)) {
6798 /*
6799 * <jhw@apple.com>
6800 * FIX ME: insertion can fail when multiple PNS
6801 * behind the same NAT open calls to the same PAC
6802 * simultaneously because spoofed call ID numbers
6803 * are chosen before states are inserted. This is
6804 * hard to fix and happens infrequently enough that
6805 * users will normally try again and this ALG will
6806 * succeed. Failures are expected to be rare enough
6807 * that fixing this is a low priority.
6808 */
6809 pptps->grev1_state = NULL;
6810 pd->lmw = -1; /* Force PF_DROP on PFRES_MEMORY */
6811 pf_src_tree_remove_state(gs);
6812 STATE_DEC_COUNTERS(gs);
6813 pool_put(&pf_state_pl, gs);
6814 DPFPRINTF(PF_DEBUG_URGENT, ("pf_pptp_handler: error "
6815 "inserting GREv1 state.\n"));
6816 }
6817 break;
6818
6819 default:
6820 break;
6821 }
6822 }
6823
6824 static void
6825 pf_pptp_unlink(struct pf_state *s)
6826 {
6827 struct pf_app_state *as = s->state_key->app_state;
6828 struct pf_state *grev1s = as->u.pptp.grev1_state;
6829
6830 if (grev1s) {
6831 struct pf_app_state *gas = grev1s->state_key->app_state;
6832
6833 if (grev1s->timeout < PFTM_MAX) {
6834 grev1s->timeout = PFTM_PURGE;
6835 }
6836 gas->u.grev1.pptp_state = NULL;
6837 as->u.pptp.grev1_state = NULL;
6838 }
6839 }
6840
6841 static void
6842 pf_grev1_unlink(struct pf_state *s)
6843 {
6844 struct pf_app_state *as = s->state_key->app_state;
6845 struct pf_state *pptps = as->u.grev1.pptp_state;
6846
6847 if (pptps) {
6848 struct pf_app_state *pas = pptps->state_key->app_state;
6849
6850 pas->u.pptp.grev1_state = NULL;
6851 as->u.grev1.pptp_state = NULL;
6852 }
6853 }
6854
6855 static int
6856 pf_ike_compare(struct pf_app_state *a, struct pf_app_state *b)
6857 {
6858 int64_t d = a->u.ike.cookie - b->u.ike.cookie;
6859 return (d > 0) ? 1 : ((d < 0) ? -1 : 0);
6860 }
6861
6862 static int
6863 pf_do_nat64(struct pf_state_key *sk, struct pf_pdesc *pd, pbuf_t *pbuf,
6864 int off)
6865 {
6866 if (pd->af == AF_INET) {
6867 if (pd->af != sk->af_lan) {
6868 pd->ndaddr = sk->lan.addr;
6869 pd->naddr = sk->ext_lan.addr;
6870 } else {
6871 pd->naddr = sk->gwy.addr;
6872 pd->ndaddr = sk->ext_gwy.addr;
6873 }
6874 return pf_nat64_ipv4(pbuf, off, pd);
6875 } else if (pd->af == AF_INET6) {
6876 if (pd->af != sk->af_lan) {
6877 pd->ndaddr = sk->lan.addr;
6878 pd->naddr = sk->ext_lan.addr;
6879 } else {
6880 pd->naddr = sk->gwy.addr;
6881 pd->ndaddr = sk->ext_gwy.addr;
6882 }
6883 return pf_nat64_ipv6(pbuf, off, pd);
6884 }
6885 return PF_DROP;
6886 }
6887
6888 static int
6889 pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif,
6890 pbuf_t *pbuf, int off, void *h, struct pf_pdesc *pd,
6891 u_short *reason)
6892 {
6893 #pragma unused(h)
6894 struct pf_state_key_cmp key;
6895 struct tcphdr *th = pd->hdr.tcp;
6896 u_int16_t win = ntohs(th->th_win);
6897 u_int32_t ack, end, seq, orig_seq;
6898 u_int8_t sws, dws;
6899 int ackskew;
6900 int copyback = 0;
6901 struct pf_state_peer *src, *dst;
6902 struct pf_state_key *sk;
6903
6904 key.app_state = 0;
6905 key.proto = IPPROTO_TCP;
6906 key.af_lan = key.af_gwy = pd->af;
6907
6908 /*
6909 * For NAT64 the first time rule search and state creation
6910 * is done on the incoming side only.
6911 * Once the state gets created, NAT64's LAN side (ipv6) will
6912 * not be able to find the state in ext-gwy tree as that normally
6913 * is intended to be looked up for incoming traffic from the
6914 * WAN side.
6915 * Therefore to handle NAT64 case we init keys here for both
6916 * lan-ext as well as ext-gwy trees.
6917 * In the state lookup we attempt a lookup on both trees if
6918 * first one does not return any result and return a match if
6919 * the match state's was created by NAT64 rule.
6920 */
6921 PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy);
6922 PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy);
6923 key.ext_gwy.xport.port = th->th_sport;
6924 key.gwy.xport.port = th->th_dport;
6925
6926 PF_ACPY(&key.lan.addr, pd->src, key.af_lan);
6927 PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan);
6928 key.lan.xport.port = th->th_sport;
6929 key.ext_lan.xport.port = th->th_dport;
6930
6931 STATE_LOOKUP();
6932
6933 sk = (*state)->state_key;
6934 /*
6935 * In case of NAT64 the translation is first applied on the LAN
6936 * side. Therefore for stack's address family comparison
6937 * we use sk->af_lan.
6938 */
6939 if ((direction == sk->direction) && (pd->af == sk->af_lan)) {
6940 src = &(*state)->src;
6941 dst = &(*state)->dst;
6942 } else {
6943 src = &(*state)->dst;
6944 dst = &(*state)->src;
6945 }
6946
6947 if (src->state == PF_TCPS_PROXY_SRC) {
6948 if (direction != sk->direction) {
6949 REASON_SET(reason, PFRES_SYNPROXY);
6950 return PF_SYNPROXY_DROP;
6951 }
6952 if (th->th_flags & TH_SYN) {
6953 if (ntohl(th->th_seq) != src->seqlo) {
6954 REASON_SET(reason, PFRES_SYNPROXY);
6955 return PF_DROP;
6956 }
6957 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst,
6958 pd->src, th->th_dport, th->th_sport,
6959 src->seqhi, ntohl(th->th_seq) + 1,
6960 TH_SYN | TH_ACK, 0, src->mss, 0, 1,
6961 0, NULL, NULL);
6962 REASON_SET(reason, PFRES_SYNPROXY);
6963 return PF_SYNPROXY_DROP;
6964 } else if (!(th->th_flags & TH_ACK) ||
6965 (ntohl(th->th_ack) != src->seqhi + 1) ||
6966 (ntohl(th->th_seq) != src->seqlo + 1)) {
6967 REASON_SET(reason, PFRES_SYNPROXY);
6968 return PF_DROP;
6969 } else if ((*state)->src_node != NULL &&
6970 pf_src_connlimit(state)) {
6971 REASON_SET(reason, PFRES_SRCLIMIT);
6972 return PF_DROP;
6973 } else {
6974 src->state = PF_TCPS_PROXY_DST;
6975 }
6976 }
6977 if (src->state == PF_TCPS_PROXY_DST) {
6978 struct pf_state_host *psrc, *pdst;
6979
6980 if (direction == PF_OUT) {
6981 psrc = &sk->gwy;
6982 pdst = &sk->ext_gwy;
6983 } else {
6984 psrc = &sk->ext_lan;
6985 pdst = &sk->lan;
6986 }
6987 if (direction == sk->direction) {
6988 if (((th->th_flags & (TH_SYN | TH_ACK)) != TH_ACK) ||
6989 (ntohl(th->th_ack) != src->seqhi + 1) ||
6990 (ntohl(th->th_seq) != src->seqlo + 1)) {
6991 REASON_SET(reason, PFRES_SYNPROXY);
6992 return PF_DROP;
6993 }
6994 src->max_win = MAX(ntohs(th->th_win), 1);
6995 if (dst->seqhi == 1) {
6996 dst->seqhi = htonl(random());
6997 }
6998 pf_send_tcp((*state)->rule.ptr, pd->af, &psrc->addr,
6999 &pdst->addr, psrc->xport.port, pdst->xport.port,
7000 dst->seqhi, 0, TH_SYN, 0,
7001 src->mss, 0, 0, (*state)->tag, NULL, NULL);
7002 REASON_SET(reason, PFRES_SYNPROXY);
7003 return PF_SYNPROXY_DROP;
7004 } else if (((th->th_flags & (TH_SYN | TH_ACK)) !=
7005 (TH_SYN | TH_ACK)) ||
7006 (ntohl(th->th_ack) != dst->seqhi + 1)) {
7007 REASON_SET(reason, PFRES_SYNPROXY);
7008 return PF_DROP;
7009 } else {
7010 dst->max_win = MAX(ntohs(th->th_win), 1);
7011 dst->seqlo = ntohl(th->th_seq);
7012 pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst,
7013 pd->src, th->th_dport, th->th_sport,
7014 ntohl(th->th_ack), ntohl(th->th_seq) + 1,
7015 TH_ACK, src->max_win, 0, 0, 0,
7016 (*state)->tag, NULL, NULL);
7017 pf_send_tcp((*state)->rule.ptr, pd->af, &psrc->addr,
7018 &pdst->addr, psrc->xport.port, pdst->xport.port,
7019 src->seqhi + 1, src->seqlo + 1,
7020 TH_ACK, dst->max_win, 0, 0, 1,
7021 0, NULL, NULL);
7022 src->seqdiff = dst->seqhi -
7023 src->seqlo;
7024 dst->seqdiff = src->seqhi -
7025 dst->seqlo;
7026 src->seqhi = src->seqlo +
7027 dst->max_win;
7028 dst->seqhi = dst->seqlo +
7029 src->max_win;
7030 src->wscale = dst->wscale = 0;
7031 src->state = dst->state =
7032 TCPS_ESTABLISHED;
7033 REASON_SET(reason, PFRES_SYNPROXY);
7034 return PF_SYNPROXY_DROP;
7035 }
7036 }
7037
7038 if (((th->th_flags & (TH_SYN | TH_ACK)) == TH_SYN) &&
7039 dst->state >= TCPS_FIN_WAIT_2 &&
7040 src->state >= TCPS_FIN_WAIT_2) {
7041 if (pf_status.debug >= PF_DEBUG_MISC) {
7042 printf("pf: state reuse ");
7043 pf_print_state(*state);
7044 pf_print_flags(th->th_flags);
7045 printf("\n");
7046 }
7047 /* XXX make sure it's the same direction ?? */
7048 src->state = dst->state = TCPS_CLOSED;
7049 pf_unlink_state(*state);
7050 *state = NULL;
7051 return PF_DROP;
7052 }
7053
7054 if ((th->th_flags & TH_SYN) == 0) {
7055 sws = (src->wscale & PF_WSCALE_FLAG) ?
7056 (src->wscale & PF_WSCALE_MASK) : TCP_MAX_WINSHIFT;
7057 dws = (dst->wscale & PF_WSCALE_FLAG) ?
7058 (dst->wscale & PF_WSCALE_MASK) : TCP_MAX_WINSHIFT;
7059 } else {
7060 sws = dws = 0;
7061 }
7062
7063 /*
7064 * Sequence tracking algorithm from Guido van Rooij's paper:
7065 * http://www.madison-gurkha.com/publications/tcp_filtering/
7066 * tcp_filtering.ps
7067 */
7068
7069 orig_seq = seq = ntohl(th->th_seq);
7070 if (src->seqlo == 0) {
7071 /* First packet from this end. Set its state */
7072
7073 if ((pd->flags & PFDESC_TCP_NORM || dst->scrub) &&
7074 src->scrub == NULL) {
7075 if (pf_normalize_tcp_init(pbuf, off, pd, th, src, dst)) {
7076 REASON_SET(reason, PFRES_MEMORY);
7077 return PF_DROP;
7078 }
7079 }
7080
7081 /* Deferred generation of sequence number modulator */
7082 if (dst->seqdiff && !src->seqdiff) {
7083 /* use random iss for the TCP server */
7084 while ((src->seqdiff = random() - seq) == 0) {
7085 ;
7086 }
7087 ack = ntohl(th->th_ack) - dst->seqdiff;
7088 pf_change_a(&th->th_seq, &th->th_sum, htonl(seq +
7089 src->seqdiff), 0);
7090 pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0);
7091 copyback = off + sizeof(*th);
7092 } else {
7093 ack = ntohl(th->th_ack);
7094 }
7095
7096 end = seq + pd->p_len;
7097 if (th->th_flags & TH_SYN) {
7098 end++;
7099 if (dst->wscale & PF_WSCALE_FLAG) {
7100 src->wscale = pf_get_wscale(pbuf, off,
7101 th->th_off, pd->af);
7102 if (src->wscale & PF_WSCALE_FLAG) {
7103 /*
7104 * Remove scale factor from initial
7105 * window
7106 */
7107 sws = src->wscale & PF_WSCALE_MASK;
7108 win = ((u_int32_t)win + (1 << sws) - 1)
7109 >> sws;
7110 dws = dst->wscale & PF_WSCALE_MASK;
7111 } else {
7112 /*
7113 * Window scale negotiation has failed,
7114 * therefore we must restore the window
7115 * scale in the state record that we
7116 * optimistically removed in
7117 * pf_test_rule(). Care is required to
7118 * prevent arithmetic overflow from
7119 * zeroing the window when it's
7120 * truncated down to 16-bits.
7121 */
7122 u_int32_t max_win = dst->max_win;
7123 max_win <<=
7124 dst->wscale & PF_WSCALE_MASK;
7125 dst->max_win = MIN(0xffff, max_win);
7126 /* in case of a retrans SYN|ACK */
7127 dst->wscale = 0;
7128 }
7129 }
7130 }
7131 if (th->th_flags & TH_FIN) {
7132 end++;
7133 }
7134
7135 src->seqlo = seq;
7136 if (src->state < TCPS_SYN_SENT) {
7137 src->state = TCPS_SYN_SENT;
7138 }
7139
7140 /*
7141 * May need to slide the window (seqhi may have been set by
7142 * the crappy stack check or if we picked up the connection
7143 * after establishment)
7144 */
7145 if (src->seqhi == 1 ||
7146 SEQ_GEQ(end + MAX(1, (u_int32_t)dst->max_win << dws),
7147 src->seqhi)) {
7148 src->seqhi = end + MAX(1, (u_int32_t)dst->max_win << dws);
7149 }
7150 if (win > src->max_win) {
7151 src->max_win = win;
7152 }
7153 } else {
7154 ack = ntohl(th->th_ack) - dst->seqdiff;
7155 if (src->seqdiff) {
7156 /* Modulate sequence numbers */
7157 pf_change_a(&th->th_seq, &th->th_sum, htonl(seq +
7158 src->seqdiff), 0);
7159 pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0);
7160 copyback = off + sizeof(*th);
7161 }
7162 end = seq + pd->p_len;
7163 if (th->th_flags & TH_SYN) {
7164 end++;
7165 }
7166 if (th->th_flags & TH_FIN) {
7167 end++;
7168 }
7169 }
7170
7171 if ((th->th_flags & TH_ACK) == 0) {
7172 /* Let it pass through the ack skew check */
7173 ack = dst->seqlo;
7174 } else if ((ack == 0 &&
7175 (th->th_flags & (TH_ACK | TH_RST)) == (TH_ACK | TH_RST)) ||
7176 /* broken tcp stacks do not set ack */
7177 (dst->state < TCPS_SYN_SENT)) {
7178 /*
7179 * Many stacks (ours included) will set the ACK number in an
7180 * FIN|ACK if the SYN times out -- no sequence to ACK.
7181 */
7182 ack = dst->seqlo;
7183 }
7184
7185 if (seq == end) {
7186 /* Ease sequencing restrictions on no data packets */
7187 seq = src->seqlo;
7188 end = seq;
7189 }
7190
7191 ackskew = dst->seqlo - ack;
7192
7193
7194 /*
7195 * Need to demodulate the sequence numbers in any TCP SACK options
7196 * (Selective ACK). We could optionally validate the SACK values
7197 * against the current ACK window, either forwards or backwards, but
7198 * I'm not confident that SACK has been implemented properly
7199 * everywhere. It wouldn't surprise me if several stacks accidently
7200 * SACK too far backwards of previously ACKed data. There really aren't
7201 * any security implications of bad SACKing unless the target stack
7202 * doesn't validate the option length correctly. Someone trying to
7203 * spoof into a TCP connection won't bother blindly sending SACK
7204 * options anyway.
7205 */
7206 if (dst->seqdiff && (th->th_off << 2) > (int)sizeof(struct tcphdr)) {
7207 copyback = pf_modulate_sack(pbuf, off, pd, th, dst);
7208 if (copyback == -1) {
7209 REASON_SET(reason, PFRES_MEMORY);
7210 return PF_DROP;
7211 }
7212
7213 pbuf = pd->mp; // XXXSCW: Why?
7214 }
7215
7216
7217 #define MAXACKWINDOW (0xffff + 1500) /* 1500 is an arbitrary fudge factor */
7218 if (SEQ_GEQ(src->seqhi, end) &&
7219 /* Last octet inside other's window space */
7220 SEQ_GEQ(seq, src->seqlo - ((u_int32_t)dst->max_win << dws)) &&
7221 /* Retrans: not more than one window back */
7222 (ackskew >= -MAXACKWINDOW) &&
7223 /* Acking not more than one reassembled fragment backwards */
7224 (ackskew <= (MAXACKWINDOW << sws)) &&
7225 /* Acking not more than one window forward */
7226 ((th->th_flags & TH_RST) == 0 || orig_seq == src->seqlo ||
7227 (orig_seq == src->seqlo + 1) || (orig_seq + 1 == src->seqlo) ||
7228 (pd->flags & PFDESC_IP_REAS) == 0)) {
7229 /* Require an exact/+1 sequence match on resets when possible */
7230
7231 if (dst->scrub || src->scrub) {
7232 if (pf_normalize_tcp_stateful(pbuf, off, pd, reason, th,
7233 *state, src, dst, &copyback)) {
7234 return PF_DROP;
7235 }
7236
7237 pbuf = pd->mp; // XXXSCW: Why?
7238 }
7239
7240 /* update max window */
7241 if (src->max_win < win) {
7242 src->max_win = win;
7243 }
7244 /* synchronize sequencing */
7245 if (SEQ_GT(end, src->seqlo)) {
7246 src->seqlo = end;
7247 }
7248 /* slide the window of what the other end can send */
7249 if (SEQ_GEQ(ack + ((u_int32_t)win << sws), dst->seqhi)) {
7250 dst->seqhi = ack + MAX(((u_int32_t)win << sws), 1);
7251 }
7252
7253 /* update states */
7254 if (th->th_flags & TH_SYN) {
7255 if (src->state < TCPS_SYN_SENT) {
7256 src->state = TCPS_SYN_SENT;
7257 }
7258 }
7259 if (th->th_flags & TH_FIN) {
7260 if (src->state < TCPS_CLOSING) {
7261 src->state = TCPS_CLOSING;
7262 }
7263 }
7264 if (th->th_flags & TH_ACK) {
7265 if (dst->state == TCPS_SYN_SENT) {
7266 dst->state = TCPS_ESTABLISHED;
7267 if (src->state == TCPS_ESTABLISHED &&
7268 (*state)->src_node != NULL &&
7269 pf_src_connlimit(state)) {
7270 REASON_SET(reason, PFRES_SRCLIMIT);
7271 return PF_DROP;
7272 }
7273 } else if (dst->state == TCPS_CLOSING) {
7274 dst->state = TCPS_FIN_WAIT_2;
7275 }
7276 }
7277 if (th->th_flags & TH_RST) {
7278 src->state = dst->state = TCPS_TIME_WAIT;
7279 }
7280
7281 /* update expire time */
7282 (*state)->expire = pf_time_second();
7283 if (src->state >= TCPS_FIN_WAIT_2 &&
7284 dst->state >= TCPS_FIN_WAIT_2) {
7285 (*state)->timeout = PFTM_TCP_CLOSED;
7286 } else if (src->state >= TCPS_CLOSING &&
7287 dst->state >= TCPS_CLOSING) {
7288 (*state)->timeout = PFTM_TCP_FIN_WAIT;
7289 } else if (src->state < TCPS_ESTABLISHED ||
7290 dst->state < TCPS_ESTABLISHED) {
7291 (*state)->timeout = PFTM_TCP_OPENING;
7292 } else if (src->state >= TCPS_CLOSING ||
7293 dst->state >= TCPS_CLOSING) {
7294 (*state)->timeout = PFTM_TCP_CLOSING;
7295 } else {
7296 (*state)->timeout = PFTM_TCP_ESTABLISHED;
7297 }
7298
7299 /* Fall through to PASS packet */
7300 } else if ((dst->state < TCPS_SYN_SENT ||
7301 dst->state >= TCPS_FIN_WAIT_2 || src->state >= TCPS_FIN_WAIT_2) &&
7302 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) &&
7303 /* Within a window forward of the originating packet */
7304 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW)) {
7305 /* Within a window backward of the originating packet */
7306
7307 /*
7308 * This currently handles three situations:
7309 * 1) Stupid stacks will shotgun SYNs before their peer
7310 * replies.
7311 * 2) When PF catches an already established stream (the
7312 * firewall rebooted, the state table was flushed, routes
7313 * changed...)
7314 * 3) Packets get funky immediately after the connection
7315 * closes (this should catch Solaris spurious ACK|FINs
7316 * that web servers like to spew after a close)
7317 *
7318 * This must be a little more careful than the above code
7319 * since packet floods will also be caught here. We don't
7320 * update the TTL here to mitigate the damage of a packet
7321 * flood and so the same code can handle awkward establishment
7322 * and a loosened connection close.
7323 * In the establishment case, a correct peer response will
7324 * validate the connection, go through the normal state code
7325 * and keep updating the state TTL.
7326 */
7327
7328 if (pf_status.debug >= PF_DEBUG_MISC) {
7329 printf("pf: loose state match: ");
7330 pf_print_state(*state);
7331 pf_print_flags(th->th_flags);
7332 printf(" seq=%u (%u) ack=%u len=%u ackskew=%d "
7333 "pkts=%llu:%llu dir=%s,%s\n", seq, orig_seq, ack,
7334 pd->p_len, ackskew, (*state)->packets[0],
7335 (*state)->packets[1],
7336 direction == PF_IN ? "in" : "out",
7337 direction == sk->direction ?
7338 "fwd" : "rev");
7339 }
7340
7341 if (dst->scrub || src->scrub) {
7342 if (pf_normalize_tcp_stateful(pbuf, off, pd, reason, th,
7343 *state, src, dst, &copyback)) {
7344 return PF_DROP;
7345 }
7346 pbuf = pd->mp; // XXXSCW: Why?
7347 }
7348
7349 /* update max window */
7350 if (src->max_win < win) {
7351 src->max_win = win;
7352 }
7353 /* synchronize sequencing */
7354 if (SEQ_GT(end, src->seqlo)) {
7355 src->seqlo = end;
7356 }
7357 /* slide the window of what the other end can send */
7358 if (SEQ_GEQ(ack + ((u_int32_t)win << sws), dst->seqhi)) {
7359 dst->seqhi = ack + MAX(((u_int32_t)win << sws), 1);
7360 }
7361
7362 /*
7363 * Cannot set dst->seqhi here since this could be a shotgunned
7364 * SYN and not an already established connection.
7365 */
7366
7367 if (th->th_flags & TH_FIN) {
7368 if (src->state < TCPS_CLOSING) {
7369 src->state = TCPS_CLOSING;
7370 }
7371 }
7372 if (th->th_flags & TH_RST) {
7373 src->state = dst->state = TCPS_TIME_WAIT;
7374 }
7375
7376 /* Fall through to PASS packet */
7377 } else {
7378 if (dst->state == TCPS_SYN_SENT &&
7379 src->state == TCPS_SYN_SENT) {
7380 /* Send RST for state mismatches during handshake */
7381 if (!(th->th_flags & TH_RST)) {
7382 pf_send_tcp((*state)->rule.ptr, pd->af,
7383 pd->dst, pd->src, th->th_dport,
7384 th->th_sport, ntohl(th->th_ack), 0,
7385 TH_RST, 0, 0,
7386 (*state)->rule.ptr->return_ttl, 1, 0,
7387 pd->eh, kif->pfik_ifp);
7388 }
7389 src->seqlo = 0;
7390 src->seqhi = 1;
7391 src->max_win = 1;
7392 } else if (pf_status.debug >= PF_DEBUG_MISC) {
7393 printf("pf: BAD state: ");
7394 pf_print_state(*state);
7395 pf_print_flags(th->th_flags);
7396 printf("\n seq=%u (%u) ack=%u len=%u ackskew=%d "
7397 "sws=%u dws=%u pkts=%llu:%llu dir=%s,%s\n",
7398 seq, orig_seq, ack, pd->p_len, ackskew,
7399 (unsigned int)sws, (unsigned int)dws,
7400 (*state)->packets[0], (*state)->packets[1],
7401 direction == PF_IN ? "in" : "out",
7402 direction == sk->direction ?
7403 "fwd" : "rev");
7404 printf("pf: State failure on: %c %c %c %c | %c %c\n",
7405 SEQ_GEQ(src->seqhi, end) ? ' ' : '1',
7406 SEQ_GEQ(seq,
7407 src->seqlo - ((u_int32_t)dst->max_win << dws)) ?
7408 ' ': '2',
7409 (ackskew >= -MAXACKWINDOW) ? ' ' : '3',
7410 (ackskew <= (MAXACKWINDOW << sws)) ? ' ' : '4',
7411 SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) ?' ' :'5',
7412 SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW) ?' ' :'6');
7413 }
7414 REASON_SET(reason, PFRES_BADSTATE);
7415 return PF_DROP;
7416 }
7417
7418 /* Any packets which have gotten here are to be passed */
7419
7420 if (sk->app_state &&
7421 sk->app_state->handler) {
7422 sk->app_state->handler(*state, direction,
7423 off + (th->th_off << 2), pd, kif);
7424 if (pd->lmw < 0) {
7425 REASON_SET(reason, PFRES_MEMORY);
7426 return PF_DROP;
7427 }
7428 pbuf = pd->mp; // XXXSCW: Why?
7429 }
7430
7431 /* translate source/destination address, if necessary */
7432 if (STATE_TRANSLATE(sk)) {
7433 pd->naf = (pd->af == sk->af_lan) ? sk->af_gwy : sk->af_lan;
7434
7435 if (direction == PF_OUT) {
7436 pf_change_ap(direction, pd->mp, pd->src, &th->th_sport,
7437 pd->ip_sum, &th->th_sum, &sk->gwy.addr,
7438 sk->gwy.xport.port, 0, pd->af, pd->naf, 1);
7439 } else {
7440 if (pd->af != pd->naf) {
7441 if (pd->af == sk->af_gwy) {
7442 pf_change_ap(direction, pd->mp, pd->dst,
7443 &th->th_dport, pd->ip_sum,
7444 &th->th_sum, &sk->lan.addr,
7445 sk->lan.xport.port, 0,
7446 pd->af, pd->naf, 0);
7447
7448 pf_change_ap(direction, pd->mp, pd->src,
7449 &th->th_sport, pd->ip_sum,
7450 &th->th_sum, &sk->ext_lan.addr,
7451 th->th_sport, 0, pd->af,
7452 pd->naf, 0);
7453 } else {
7454 pf_change_ap(direction, pd->mp, pd->dst,
7455 &th->th_dport, pd->ip_sum,
7456 &th->th_sum, &sk->ext_gwy.addr,
7457 th->th_dport, 0, pd->af,
7458 pd->naf, 0);
7459
7460 pf_change_ap(direction, pd->mp, pd->src,
7461 &th->th_sport, pd->ip_sum,
7462 &th->th_sum, &sk->gwy.addr,
7463 sk->gwy.xport.port, 0, pd->af,
7464 pd->naf, 0);
7465 }
7466 } else {
7467 pf_change_ap(direction, pd->mp, pd->dst,
7468 &th->th_dport, pd->ip_sum,
7469 &th->th_sum, &sk->lan.addr,
7470 sk->lan.xport.port, 0, pd->af,
7471 pd->naf, 1);
7472 }
7473 }
7474
7475 copyback = off + sizeof(*th);
7476 }
7477
7478 if (copyback) {
7479 if (pf_lazy_makewritable(pd, pbuf, copyback) == NULL) {
7480 REASON_SET(reason, PFRES_MEMORY);
7481 return PF_DROP;
7482 }
7483
7484 /* Copyback sequence modulation or stateful scrub changes */
7485 pbuf_copy_back(pbuf, off, sizeof(*th), th);
7486
7487 if (sk->af_lan != sk->af_gwy) {
7488 return pf_do_nat64(sk, pd, pbuf, off);
7489 }
7490 }
7491 return PF_PASS;
7492 }
7493
7494 static int
7495 pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif,
7496 pbuf_t *pbuf, int off, void *h, struct pf_pdesc *pd, u_short *reason)
7497 {
7498 #pragma unused(h)
7499 struct pf_state_peer *src, *dst;
7500 struct pf_state_key_cmp key;
7501 struct pf_state_key *sk;
7502 struct udphdr *uh = pd->hdr.udp;
7503 struct pf_app_state as;
7504 int action, extfilter;
7505 key.app_state = 0;
7506 key.proto_variant = PF_EXTFILTER_APD;
7507
7508 key.proto = IPPROTO_UDP;
7509 key.af_lan = key.af_gwy = pd->af;
7510
7511 /*
7512 * For NAT64 the first time rule search and state creation
7513 * is done on the incoming side only.
7514 * Once the state gets created, NAT64's LAN side (ipv6) will
7515 * not be able to find the state in ext-gwy tree as that normally
7516 * is intended to be looked up for incoming traffic from the
7517 * WAN side.
7518 * Therefore to handle NAT64 case we init keys here for both
7519 * lan-ext as well as ext-gwy trees.
7520 * In the state lookup we attempt a lookup on both trees if
7521 * first one does not return any result and return a match if
7522 * the match state's was created by NAT64 rule.
7523 */
7524 PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy);
7525 PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy);
7526 key.ext_gwy.xport.port = uh->uh_sport;
7527 key.gwy.xport.port = uh->uh_dport;
7528
7529 PF_ACPY(&key.lan.addr, pd->src, key.af_lan);
7530 PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan);
7531 key.lan.xport.port = uh->uh_sport;
7532 key.ext_lan.xport.port = uh->uh_dport;
7533
7534 if (ntohs(uh->uh_sport) == PF_IKE_PORT &&
7535 ntohs(uh->uh_dport) == PF_IKE_PORT) {
7536 struct pf_ike_hdr ike;
7537 size_t plen = pbuf->pb_packet_len - off - sizeof(*uh);
7538 if (plen < PF_IKE_PACKET_MINSIZE) {
7539 DPFPRINTF(PF_DEBUG_MISC,
7540 ("pf: IKE message too small.\n"));
7541 return PF_DROP;
7542 }
7543
7544 if (plen > sizeof(ike)) {
7545 plen = sizeof(ike);
7546 }
7547 pbuf_copy_data(pbuf, off + sizeof(*uh), plen, &ike);
7548
7549 if (ike.initiator_cookie) {
7550 key.app_state = &as;
7551 as.compare_lan_ext = pf_ike_compare;
7552 as.compare_ext_gwy = pf_ike_compare;
7553 as.u.ike.cookie = ike.initiator_cookie;
7554 } else {
7555 /*
7556 * <http://tools.ietf.org/html/\
7557 * draft-ietf-ipsec-nat-t-ike-01>
7558 * Support non-standard NAT-T implementations that
7559 * push the ESP packet over the top of the IKE packet.
7560 * Do not drop packet.
7561 */
7562 DPFPRINTF(PF_DEBUG_MISC,
7563 ("pf: IKE initiator cookie = 0.\n"));
7564 }
7565 }
7566
7567 *state = pf_find_state(kif, &key, direction);
7568
7569 if (!key.app_state && *state == 0) {
7570 key.proto_variant = PF_EXTFILTER_AD;
7571 *state = pf_find_state(kif, &key, direction);
7572 }
7573
7574 if (!key.app_state && *state == 0) {
7575 key.proto_variant = PF_EXTFILTER_EI;
7576 *state = pf_find_state(kif, &key, direction);
7577 }
7578
7579 /* similar to STATE_LOOKUP() */
7580 if (*state != NULL && pd != NULL && !(pd->pktflags & PKTF_FLOW_ID)) {
7581 pd->flowsrc = (*state)->state_key->flowsrc;
7582 pd->flowhash = (*state)->state_key->flowhash;
7583 if (pd->flowhash != 0) {
7584 pd->pktflags |= PKTF_FLOW_ID;
7585 pd->pktflags &= ~PKTF_FLOW_ADV;
7586 }
7587 }
7588
7589 if (pf_state_lookup_aux(state, kif, direction, &action)) {
7590 return action;
7591 }
7592
7593 sk = (*state)->state_key;
7594
7595 /*
7596 * In case of NAT64 the translation is first applied on the LAN
7597 * side. Therefore for stack's address family comparison
7598 * we use sk->af_lan.
7599 */
7600 if ((direction == sk->direction) && (pd->af == sk->af_lan)) {
7601 src = &(*state)->src;
7602 dst = &(*state)->dst;
7603 } else {
7604 src = &(*state)->dst;
7605 dst = &(*state)->src;
7606 }
7607
7608 /* update states */
7609 if (src->state < PFUDPS_SINGLE) {
7610 src->state = PFUDPS_SINGLE;
7611 }
7612 if (dst->state == PFUDPS_SINGLE) {
7613 dst->state = PFUDPS_MULTIPLE;
7614 }
7615
7616 /* update expire time */
7617 (*state)->expire = pf_time_second();
7618 if (src->state == PFUDPS_MULTIPLE && dst->state == PFUDPS_MULTIPLE) {
7619 (*state)->timeout = PFTM_UDP_MULTIPLE;
7620 } else {
7621 (*state)->timeout = PFTM_UDP_SINGLE;
7622 }
7623
7624 extfilter = sk->proto_variant;
7625 if (extfilter > PF_EXTFILTER_APD) {
7626 if (direction == PF_OUT) {
7627 sk->ext_lan.xport.port = key.ext_lan.xport.port;
7628 if (extfilter > PF_EXTFILTER_AD) {
7629 PF_ACPY(&sk->ext_lan.addr, &key.ext_lan.addr,
7630 key.af_lan);
7631 }
7632 } else {
7633 sk->ext_gwy.xport.port = key.ext_gwy.xport.port;
7634 if (extfilter > PF_EXTFILTER_AD) {
7635 PF_ACPY(&sk->ext_gwy.addr, &key.ext_gwy.addr,
7636 key.af_gwy);
7637 }
7638 }
7639 }
7640
7641 if (sk->app_state && sk->app_state->handler) {
7642 sk->app_state->handler(*state, direction, off + uh->uh_ulen,
7643 pd, kif);
7644 if (pd->lmw < 0) {
7645 REASON_SET(reason, PFRES_MEMORY);
7646 return PF_DROP;
7647 }
7648 pbuf = pd->mp; // XXXSCW: Why?
7649 }
7650
7651 /* translate source/destination address, if necessary */
7652 if (STATE_TRANSLATE(sk)) {
7653 if (pf_lazy_makewritable(pd, pbuf, off + sizeof(*uh)) == NULL) {
7654 REASON_SET(reason, PFRES_MEMORY);
7655 return PF_DROP;
7656 }
7657
7658 pd->naf = (pd->af == sk->af_lan) ? sk->af_gwy : sk->af_lan;
7659
7660 if (direction == PF_OUT) {
7661 pf_change_ap(direction, pd->mp, pd->src, &uh->uh_sport,
7662 pd->ip_sum, &uh->uh_sum, &sk->gwy.addr,
7663 sk->gwy.xport.port, 1, pd->af, pd->naf, 1);
7664 } else {
7665 if (pd->af != pd->naf) {
7666 if (pd->af == sk->af_gwy) {
7667 pf_change_ap(direction, pd->mp, pd->dst,
7668 &uh->uh_dport, pd->ip_sum,
7669 &uh->uh_sum, &sk->lan.addr,
7670 sk->lan.xport.port, 1,
7671 pd->af, pd->naf, 0);
7672
7673 pf_change_ap(direction, pd->mp, pd->src,
7674 &uh->uh_sport, pd->ip_sum,
7675 &uh->uh_sum, &sk->ext_lan.addr,
7676 uh->uh_sport, 1, pd->af,
7677 pd->naf, 0);
7678 } else {
7679 pf_change_ap(direction, pd->mp, pd->dst,
7680 &uh->uh_dport, pd->ip_sum,
7681 &uh->uh_sum, &sk->ext_gwy.addr,
7682 uh->uh_dport, 1, pd->af,
7683 pd->naf, 0);
7684
7685 pf_change_ap(direction, pd->mp, pd->src,
7686 &uh->uh_sport, pd->ip_sum,
7687 &uh->uh_sum, &sk->gwy.addr,
7688 sk->gwy.xport.port, 1, pd->af,
7689 pd->naf, 0);
7690 }
7691 } else {
7692 pf_change_ap(direction, pd->mp, pd->dst,
7693 &uh->uh_dport, pd->ip_sum,
7694 &uh->uh_sum, &sk->lan.addr,
7695 sk->lan.xport.port, 1,
7696 pd->af, pd->naf, 1);
7697 }
7698 }
7699
7700 pbuf_copy_back(pbuf, off, sizeof(*uh), uh);
7701 if (sk->af_lan != sk->af_gwy) {
7702 return pf_do_nat64(sk, pd, pbuf, off);
7703 }
7704 }
7705 return PF_PASS;
7706 }
7707
7708 static int
7709 pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
7710 pbuf_t *pbuf, int off, void *h, struct pf_pdesc *pd, u_short *reason)
7711 {
7712 #pragma unused(h)
7713 struct pf_addr *saddr = pd->src, *daddr = pd->dst;
7714 struct in_addr srcv4_inaddr = saddr->v4addr;
7715 u_int16_t icmpid = 0, *icmpsum = NULL;
7716 u_int8_t icmptype = 0;
7717 int state_icmp = 0;
7718 struct pf_state_key_cmp key;
7719 struct pf_state_key *sk;
7720
7721 struct pf_app_state as;
7722 key.app_state = 0;
7723
7724 pd->off = off;
7725
7726 switch (pd->proto) {
7727 #if INET
7728 case IPPROTO_ICMP:
7729 icmptype = pd->hdr.icmp->icmp_type;
7730 icmpid = pd->hdr.icmp->icmp_id;
7731 icmpsum = &pd->hdr.icmp->icmp_cksum;
7732
7733 if (ICMP_ERRORTYPE(icmptype)) {
7734 state_icmp++;
7735 }
7736 break;
7737 #endif /* INET */
7738 #if INET6
7739 case IPPROTO_ICMPV6:
7740 icmptype = pd->hdr.icmp6->icmp6_type;
7741 icmpid = pd->hdr.icmp6->icmp6_id;
7742 icmpsum = &pd->hdr.icmp6->icmp6_cksum;
7743
7744 if (ICMP6_ERRORTYPE(icmptype)) {
7745 state_icmp++;
7746 }
7747 break;
7748 #endif /* INET6 */
7749 }
7750
7751 if (!state_icmp) {
7752 /*
7753 * ICMP query/reply message not related to a TCP/UDP packet.
7754 * Search for an ICMP state.
7755 */
7756 /*
7757 * NAT64 requires protocol translation between ICMPv4
7758 * and ICMPv6. TCP and UDP do not require protocol
7759 * translation. To avoid adding complexity just to
7760 * handle ICMP(v4addr/v6addr), we always lookup for
7761 * proto = IPPROTO_ICMP on both LAN and WAN side
7762 */
7763 key.proto = IPPROTO_ICMP;
7764 key.af_lan = key.af_gwy = pd->af;
7765
7766 PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy);
7767 PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy);
7768 key.ext_gwy.xport.port = 0;
7769 key.gwy.xport.port = icmpid;
7770
7771 PF_ACPY(&key.lan.addr, pd->src, key.af_lan);
7772 PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan);
7773 key.lan.xport.port = icmpid;
7774 key.ext_lan.xport.port = 0;
7775
7776 STATE_LOOKUP();
7777
7778 sk = (*state)->state_key;
7779 (*state)->expire = pf_time_second();
7780 (*state)->timeout = PFTM_ICMP_ERROR_REPLY;
7781
7782 /* translate source/destination address, if necessary */
7783 if (STATE_TRANSLATE(sk)) {
7784 pd->naf = (pd->af == sk->af_lan) ?
7785 sk->af_gwy : sk->af_lan;
7786 if (direction == PF_OUT) {
7787 switch (pd->af) {
7788 #if INET
7789 case AF_INET:
7790 pf_change_a(&saddr->v4addr.s_addr,
7791 pd->ip_sum,
7792 sk->gwy.addr.v4addr.s_addr, 0);
7793 pd->hdr.icmp->icmp_cksum =
7794 pf_cksum_fixup(
7795 pd->hdr.icmp->icmp_cksum, icmpid,
7796 sk->gwy.xport.port, 0);
7797 pd->hdr.icmp->icmp_id =
7798 sk->gwy.xport.port;
7799 if (pf_lazy_makewritable(pd, pbuf,
7800 off + ICMP_MINLEN) == NULL) {
7801 return PF_DROP;
7802 }
7803 pbuf_copy_back(pbuf, off, ICMP_MINLEN,
7804 pd->hdr.icmp);
7805 break;
7806 #endif /* INET */
7807 #if INET6
7808 case AF_INET6:
7809 pf_change_a6(saddr,
7810 &pd->hdr.icmp6->icmp6_cksum,
7811 &sk->gwy.addr, 0);
7812 if (pf_lazy_makewritable(pd, pbuf,
7813 off + sizeof(struct icmp6_hdr)) ==
7814 NULL) {
7815 return PF_DROP;
7816 }
7817 pbuf_copy_back(pbuf, off,
7818 sizeof(struct icmp6_hdr),
7819 pd->hdr.icmp6);
7820 break;
7821 #endif /* INET6 */
7822 }
7823 } else {
7824 switch (pd->af) {
7825 #if INET
7826 case AF_INET:
7827 if (pd->naf != AF_INET) {
7828 if (pf_translate_icmp_af(
7829 AF_INET6, pd->hdr.icmp)) {
7830 return PF_DROP;
7831 }
7832
7833 pd->proto = IPPROTO_ICMPV6;
7834 } else {
7835 pf_change_a(&daddr->v4addr.s_addr,
7836 pd->ip_sum,
7837 sk->lan.addr.v4addr.s_addr, 0);
7838
7839 pd->hdr.icmp->icmp_cksum =
7840 pf_cksum_fixup(
7841 pd->hdr.icmp->icmp_cksum,
7842 icmpid, sk->lan.xport.port, 0);
7843
7844 pd->hdr.icmp->icmp_id =
7845 sk->lan.xport.port;
7846 }
7847
7848 if (pf_lazy_makewritable(pd, pbuf,
7849 off + ICMP_MINLEN) == NULL) {
7850 return PF_DROP;
7851 }
7852 pbuf_copy_back(pbuf, off, ICMP_MINLEN,
7853 pd->hdr.icmp);
7854 if (sk->af_lan != sk->af_gwy) {
7855 return pf_do_nat64(sk, pd,
7856 pbuf, off);
7857 }
7858 break;
7859 #endif /* INET */
7860 #if INET6
7861 case AF_INET6:
7862 if (pd->naf != AF_INET6) {
7863 if (pf_translate_icmp_af(
7864 AF_INET, pd->hdr.icmp6)) {
7865 return PF_DROP;
7866 }
7867
7868 pd->proto = IPPROTO_ICMP;
7869 } else {
7870 pf_change_a6(daddr,
7871 &pd->hdr.icmp6->icmp6_cksum,
7872 &sk->lan.addr, 0);
7873 }
7874 if (pf_lazy_makewritable(pd, pbuf,
7875 off + sizeof(struct icmp6_hdr)) ==
7876 NULL) {
7877 return PF_DROP;
7878 }
7879 pbuf_copy_back(pbuf, off,
7880 sizeof(struct icmp6_hdr),
7881 pd->hdr.icmp6);
7882 if (sk->af_lan != sk->af_gwy) {
7883 return pf_do_nat64(sk, pd,
7884 pbuf, off);
7885 }
7886 break;
7887 #endif /* INET6 */
7888 }
7889 }
7890 }
7891
7892 return PF_PASS;
7893 } else {
7894 /*
7895 * ICMP error message in response to a TCP/UDP packet.
7896 * Extract the inner TCP/UDP header and search for that state.
7897 */
7898 struct pf_pdesc pd2; /* For inner (original) header */
7899 #if INET
7900 struct ip h2;
7901 #endif /* INET */
7902 #if INET6
7903 struct ip6_hdr h2_6;
7904 int terminal = 0;
7905 #endif /* INET6 */
7906 int ipoff2 = 0;
7907 int off2 = 0;
7908
7909 memset(&pd2, 0, sizeof(pd2));
7910
7911 pd2.af = pd->af;
7912 switch (pd->af) {
7913 #if INET
7914 case AF_INET:
7915 /* offset of h2 in mbuf chain */
7916 ipoff2 = off + ICMP_MINLEN;
7917
7918 if (!pf_pull_hdr(pbuf, ipoff2, &h2, sizeof(h2),
7919 NULL, reason, pd2.af)) {
7920 DPFPRINTF(PF_DEBUG_MISC,
7921 ("pf: ICMP error message too short "
7922 "(ip)\n"));
7923 return PF_DROP;
7924 }
7925 /*
7926 * ICMP error messages don't refer to non-first
7927 * fragments
7928 */
7929 if (h2.ip_off & htons(IP_OFFMASK)) {
7930 REASON_SET(reason, PFRES_FRAG);
7931 return PF_DROP;
7932 }
7933
7934 /* offset of protocol header that follows h2 */
7935 off2 = ipoff2 + (h2.ip_hl << 2);
7936 /* TODO */
7937 pd2.off = ipoff2 + (h2.ip_hl << 2);
7938
7939 pd2.proto = h2.ip_p;
7940 pd2.src = (struct pf_addr *)&h2.ip_src;
7941 pd2.dst = (struct pf_addr *)&h2.ip_dst;
7942 pd2.ip_sum = &h2.ip_sum;
7943 break;
7944 #endif /* INET */
7945 #if INET6
7946 case AF_INET6:
7947 ipoff2 = off + sizeof(struct icmp6_hdr);
7948
7949 if (!pf_pull_hdr(pbuf, ipoff2, &h2_6, sizeof(h2_6),
7950 NULL, reason, pd2.af)) {
7951 DPFPRINTF(PF_DEBUG_MISC,
7952 ("pf: ICMP error message too short "
7953 "(ip6)\n"));
7954 return PF_DROP;
7955 }
7956 pd2.proto = h2_6.ip6_nxt;
7957 pd2.src = (struct pf_addr *)(uintptr_t)&h2_6.ip6_src;
7958 pd2.dst = (struct pf_addr *)(uintptr_t)&h2_6.ip6_dst;
7959 pd2.ip_sum = NULL;
7960 off2 = ipoff2 + sizeof(h2_6);
7961 do {
7962 switch (pd2.proto) {
7963 case IPPROTO_FRAGMENT:
7964 /*
7965 * ICMPv6 error messages for
7966 * non-first fragments
7967 */
7968 REASON_SET(reason, PFRES_FRAG);
7969 return PF_DROP;
7970 case IPPROTO_AH:
7971 case IPPROTO_HOPOPTS:
7972 case IPPROTO_ROUTING:
7973 case IPPROTO_DSTOPTS: {
7974 /* get next header and header length */
7975 struct ip6_ext opt6;
7976
7977 if (!pf_pull_hdr(pbuf, off2, &opt6,
7978 sizeof(opt6), NULL, reason,
7979 pd2.af)) {
7980 DPFPRINTF(PF_DEBUG_MISC,
7981 ("pf: ICMPv6 short opt\n"));
7982 return PF_DROP;
7983 }
7984 if (pd2.proto == IPPROTO_AH) {
7985 off2 += (opt6.ip6e_len + 2) * 4;
7986 } else {
7987 off2 += (opt6.ip6e_len + 1) * 8;
7988 }
7989 pd2.proto = opt6.ip6e_nxt;
7990 /* goto the next header */
7991 break;
7992 }
7993 default:
7994 terminal++;
7995 break;
7996 }
7997 } while (!terminal);
7998 /* TODO */
7999 pd2.off = ipoff2;
8000 break;
8001 #endif /* INET6 */
8002 }
8003
8004 switch (pd2.proto) {
8005 case IPPROTO_TCP: {
8006 struct tcphdr th;
8007 u_int32_t seq;
8008 struct pf_state_peer *src, *dst;
8009 u_int8_t dws;
8010 int copyback = 0;
8011
8012 /*
8013 * Only the first 8 bytes of the TCP header can be
8014 * expected. Don't access any TCP header fields after
8015 * th_seq, an ackskew test is not possible.
8016 */
8017 if (!pf_pull_hdr(pbuf, off2, &th, 8, NULL, reason,
8018 pd2.af)) {
8019 DPFPRINTF(PF_DEBUG_MISC,
8020 ("pf: ICMP error message too short "
8021 "(tcp)\n"));
8022 return PF_DROP;
8023 }
8024
8025 key.proto = IPPROTO_TCP;
8026 key.af_gwy = pd2.af;
8027 PF_ACPY(&key.ext_gwy.addr, pd2.dst, key.af_gwy);
8028 PF_ACPY(&key.gwy.addr, pd2.src, key.af_gwy);
8029 key.ext_gwy.xport.port = th.th_dport;
8030 key.gwy.xport.port = th.th_sport;
8031
8032 key.af_lan = pd2.af;
8033 PF_ACPY(&key.lan.addr, pd2.dst, key.af_lan);
8034 PF_ACPY(&key.ext_lan.addr, pd2.src, key.af_lan);
8035 key.lan.xport.port = th.th_dport;
8036 key.ext_lan.xport.port = th.th_sport;
8037
8038 STATE_LOOKUP();
8039
8040 sk = (*state)->state_key;
8041 if ((direction == sk->direction) &&
8042 ((sk->af_lan == sk->af_gwy) ||
8043 (pd2.af == sk->af_lan))) {
8044 src = &(*state)->dst;
8045 dst = &(*state)->src;
8046 } else {
8047 src = &(*state)->src;
8048 dst = &(*state)->dst;
8049 }
8050
8051 if (src->wscale && (dst->wscale & PF_WSCALE_FLAG)) {
8052 dws = dst->wscale & PF_WSCALE_MASK;
8053 } else {
8054 dws = TCP_MAX_WINSHIFT;
8055 }
8056
8057 /* Demodulate sequence number */
8058 seq = ntohl(th.th_seq) - src->seqdiff;
8059 if (src->seqdiff) {
8060 pf_change_a(&th.th_seq, icmpsum,
8061 htonl(seq), 0);
8062 copyback = 1;
8063 }
8064
8065 if (!SEQ_GEQ(src->seqhi, seq) ||
8066 !SEQ_GEQ(seq,
8067 src->seqlo - ((u_int32_t)dst->max_win << dws))) {
8068 if (pf_status.debug >= PF_DEBUG_MISC) {
8069 printf("pf: BAD ICMP %d:%d ",
8070 icmptype, pd->hdr.icmp->icmp_code);
8071 pf_print_host(pd->src, 0, pd->af);
8072 printf(" -> ");
8073 pf_print_host(pd->dst, 0, pd->af);
8074 printf(" state: ");
8075 pf_print_state(*state);
8076 printf(" seq=%u\n", seq);
8077 }
8078 REASON_SET(reason, PFRES_BADSTATE);
8079 return PF_DROP;
8080 }
8081
8082 pd->naf = pd2.naf = (pd2.af == sk->af_lan) ?
8083 sk->af_gwy : sk->af_lan;
8084
8085 if (STATE_TRANSLATE(sk)) {
8086 /* NAT64 case */
8087 if (sk->af_lan != sk->af_gwy) {
8088 struct pf_state_host *saddr2, *daddr2;
8089
8090 if (pd2.naf == sk->af_lan) {
8091 saddr2 = &sk->lan;
8092 daddr2 = &sk->ext_lan;
8093 } else {
8094 saddr2 = &sk->ext_gwy;
8095 daddr2 = &sk->gwy;
8096 }
8097
8098 /* translate ICMP message types and codes */
8099 if (pf_translate_icmp_af(pd->naf,
8100 pd->hdr.icmp)) {
8101 return PF_DROP;
8102 }
8103
8104 if (pf_lazy_makewritable(pd, pbuf,
8105 off2 + 8) == NULL) {
8106 return PF_DROP;
8107 }
8108
8109 pbuf_copy_back(pbuf, pd->off,
8110 sizeof(struct icmp6_hdr),
8111 pd->hdr.icmp6);
8112
8113 /*
8114 * translate inner ip header within the
8115 * ICMP message
8116 */
8117 if (pf_change_icmp_af(pbuf, ipoff2, pd,
8118 &pd2, &saddr2->addr, &daddr2->addr,
8119 pd->af, pd->naf)) {
8120 return PF_DROP;
8121 }
8122
8123 if (pd->naf == AF_INET) {
8124 pd->proto = IPPROTO_ICMP;
8125 } else {
8126 pd->proto = IPPROTO_ICMPV6;
8127 }
8128
8129 /*
8130 * translate inner tcp header within
8131 * the ICMP message
8132 */
8133 pf_change_ap(direction, NULL, pd2.src,
8134 &th.th_sport, pd2.ip_sum,
8135 &th.th_sum, &daddr2->addr,
8136 saddr2->xport.port, 0, pd2.af,
8137 pd2.naf, 0);
8138
8139 pf_change_ap(direction, NULL, pd2.dst,
8140 &th.th_dport, pd2.ip_sum,
8141 &th.th_sum, &saddr2->addr,
8142 daddr2->xport.port, 0, pd2.af,
8143 pd2.naf, 0);
8144
8145 pbuf_copy_back(pbuf, pd2.off, 8, &th);
8146
8147 /* translate outer ip header */
8148 PF_ACPY(&pd->naddr, &daddr2->addr,
8149 pd->naf);
8150 PF_ACPY(&pd->ndaddr, &saddr2->addr,
8151 pd->naf);
8152 if (pd->af == AF_INET) {
8153 memcpy(&pd->naddr.addr32[3],
8154 &srcv4_inaddr,
8155 sizeof(pd->naddr.addr32[3]));
8156 return pf_nat64_ipv4(pbuf, off,
8157 pd);
8158 } else {
8159 return pf_nat64_ipv6(pbuf, off,
8160 pd);
8161 }
8162 }
8163 if (direction == PF_IN) {
8164 pf_change_icmp(pd2.src, &th.th_sport,
8165 daddr, &sk->lan.addr,
8166 sk->lan.xport.port, NULL,
8167 pd2.ip_sum, icmpsum,
8168 pd->ip_sum, 0, pd2.af);
8169 } else {
8170 pf_change_icmp(pd2.dst, &th.th_dport,
8171 saddr, &sk->gwy.addr,
8172 sk->gwy.xport.port, NULL,
8173 pd2.ip_sum, icmpsum,
8174 pd->ip_sum, 0, pd2.af);
8175 }
8176 copyback = 1;
8177 }
8178
8179 if (copyback) {
8180 if (pf_lazy_makewritable(pd, pbuf, off2 + 8) ==
8181 NULL) {
8182 return PF_DROP;
8183 }
8184 switch (pd2.af) {
8185 #if INET
8186 case AF_INET:
8187 pbuf_copy_back(pbuf, off, ICMP_MINLEN,
8188 pd->hdr.icmp);
8189 pbuf_copy_back(pbuf, ipoff2, sizeof(h2),
8190 &h2);
8191 break;
8192 #endif /* INET */
8193 #if INET6
8194 case AF_INET6:
8195 pbuf_copy_back(pbuf, off,
8196 sizeof(struct icmp6_hdr),
8197 pd->hdr.icmp6);
8198 pbuf_copy_back(pbuf, ipoff2,
8199 sizeof(h2_6), &h2_6);
8200 break;
8201 #endif /* INET6 */
8202 }
8203 pbuf_copy_back(pbuf, off2, 8, &th);
8204 }
8205
8206 return PF_PASS;
8207 }
8208 case IPPROTO_UDP: {
8209 struct udphdr uh;
8210 int dx, action;
8211 if (!pf_pull_hdr(pbuf, off2, &uh, sizeof(uh),
8212 NULL, reason, pd2.af)) {
8213 DPFPRINTF(PF_DEBUG_MISC,
8214 ("pf: ICMP error message too short "
8215 "(udp)\n"));
8216 return PF_DROP;
8217 }
8218
8219 key.af_gwy = pd2.af;
8220 PF_ACPY(&key.ext_gwy.addr, pd2.dst, key.af_gwy);
8221 PF_ACPY(&key.gwy.addr, pd2.src, key.af_gwy);
8222 key.ext_gwy.xport.port = uh.uh_dport;
8223 key.gwy.xport.port = uh.uh_sport;
8224
8225 key.af_lan = pd2.af;
8226 PF_ACPY(&key.lan.addr, pd2.dst, key.af_lan);
8227 PF_ACPY(&key.ext_lan.addr, pd2.src, key.af_lan);
8228 key.lan.xport.port = uh.uh_dport;
8229 key.ext_lan.xport.port = uh.uh_sport;
8230
8231 key.proto = IPPROTO_UDP;
8232 key.proto_variant = PF_EXTFILTER_APD;
8233 dx = direction;
8234
8235 if (ntohs(uh.uh_sport) == PF_IKE_PORT &&
8236 ntohs(uh.uh_dport) == PF_IKE_PORT) {
8237 struct pf_ike_hdr ike;
8238 size_t plen = pbuf->pb_packet_len - off2 -
8239 sizeof(uh);
8240 if (direction == PF_IN &&
8241 plen < 8 /* PF_IKE_PACKET_MINSIZE */) {
8242 DPFPRINTF(PF_DEBUG_MISC, ("pf: "
8243 "ICMP error, embedded IKE message "
8244 "too small.\n"));
8245 return PF_DROP;
8246 }
8247
8248 if (plen > sizeof(ike)) {
8249 plen = sizeof(ike);
8250 }
8251 pbuf_copy_data(pbuf, off + sizeof(uh), plen,
8252 &ike);
8253
8254 key.app_state = &as;
8255 as.compare_lan_ext = pf_ike_compare;
8256 as.compare_ext_gwy = pf_ike_compare;
8257 as.u.ike.cookie = ike.initiator_cookie;
8258 }
8259
8260 *state = pf_find_state(kif, &key, dx);
8261
8262 if (key.app_state && *state == 0) {
8263 key.app_state = 0;
8264 *state = pf_find_state(kif, &key, dx);
8265 }
8266
8267 if (*state == 0) {
8268 key.proto_variant = PF_EXTFILTER_AD;
8269 *state = pf_find_state(kif, &key, dx);
8270 }
8271
8272 if (*state == 0) {
8273 key.proto_variant = PF_EXTFILTER_EI;
8274 *state = pf_find_state(kif, &key, dx);
8275 }
8276
8277 /* similar to STATE_LOOKUP() */
8278 if (*state != NULL && pd != NULL &&
8279 !(pd->pktflags & PKTF_FLOW_ID)) {
8280 pd->flowsrc = (*state)->state_key->flowsrc;
8281 pd->flowhash = (*state)->state_key->flowhash;
8282 if (pd->flowhash != 0) {
8283 pd->pktflags |= PKTF_FLOW_ID;
8284 pd->pktflags &= ~PKTF_FLOW_ADV;
8285 }
8286 }
8287
8288 if (pf_state_lookup_aux(state, kif, direction, &action)) {
8289 return action;
8290 }
8291
8292 sk = (*state)->state_key;
8293 pd->naf = pd2.naf = (pd2.af == sk->af_lan) ?
8294 sk->af_gwy : sk->af_lan;
8295
8296 if (STATE_TRANSLATE(sk)) {
8297 /* NAT64 case */
8298 if (sk->af_lan != sk->af_gwy) {
8299 struct pf_state_host *saddr2, *daddr2;
8300
8301 if (pd2.naf == sk->af_lan) {
8302 saddr2 = &sk->lan;
8303 daddr2 = &sk->ext_lan;
8304 } else {
8305 saddr2 = &sk->ext_gwy;
8306 daddr2 = &sk->gwy;
8307 }
8308
8309 /* translate ICMP message */
8310 if (pf_translate_icmp_af(pd->naf,
8311 pd->hdr.icmp)) {
8312 return PF_DROP;
8313 }
8314 if (pf_lazy_makewritable(pd, pbuf,
8315 off2 + 8) == NULL) {
8316 return PF_DROP;
8317 }
8318
8319 pbuf_copy_back(pbuf, pd->off,
8320 sizeof(struct icmp6_hdr),
8321 pd->hdr.icmp6);
8322
8323 /*
8324 * translate inner ip header within the
8325 * ICMP message
8326 */
8327 if (pf_change_icmp_af(pbuf, ipoff2, pd,
8328 &pd2, &saddr2->addr, &daddr2->addr,
8329 pd->af, pd->naf)) {
8330 return PF_DROP;
8331 }
8332
8333 if (pd->naf == AF_INET) {
8334 pd->proto = IPPROTO_ICMP;
8335 } else {
8336 pd->proto = IPPROTO_ICMPV6;
8337 }
8338
8339 /*
8340 * translate inner udp header within
8341 * the ICMP message
8342 */
8343 pf_change_ap(direction, NULL, pd2.src,
8344 &uh.uh_sport, pd2.ip_sum,
8345 &uh.uh_sum, &daddr2->addr,
8346 saddr2->xport.port, 0, pd2.af,
8347 pd2.naf, 0);
8348
8349 pf_change_ap(direction, NULL, pd2.dst,
8350 &uh.uh_dport, pd2.ip_sum,
8351 &uh.uh_sum, &saddr2->addr,
8352 daddr2->xport.port, 0, pd2.af,
8353 pd2.naf, 0);
8354
8355 pbuf_copy_back(pbuf, pd2.off,
8356 sizeof(uh), &uh);
8357
8358 /* translate outer ip header */
8359 PF_ACPY(&pd->naddr, &daddr2->addr,
8360 pd->naf);
8361 PF_ACPY(&pd->ndaddr, &saddr2->addr,
8362 pd->naf);
8363 if (pd->af == AF_INET) {
8364 memcpy(&pd->naddr.addr32[3],
8365 &srcv4_inaddr,
8366 sizeof(pd->naddr.addr32[3]));
8367 return pf_nat64_ipv4(pbuf, off,
8368 pd);
8369 } else {
8370 return pf_nat64_ipv6(pbuf, off,
8371 pd);
8372 }
8373 }
8374 if (direction == PF_IN) {
8375 pf_change_icmp(pd2.src, &uh.uh_sport,
8376 daddr, &sk->lan.addr,
8377 sk->lan.xport.port, &uh.uh_sum,
8378 pd2.ip_sum, icmpsum,
8379 pd->ip_sum, 1, pd2.af);
8380 } else {
8381 pf_change_icmp(pd2.dst, &uh.uh_dport,
8382 saddr, &sk->gwy.addr,
8383 sk->gwy.xport.port, &uh.uh_sum,
8384 pd2.ip_sum, icmpsum,
8385 pd->ip_sum, 1, pd2.af);
8386 }
8387 if (pf_lazy_makewritable(pd, pbuf,
8388 off2 + sizeof(uh)) == NULL) {
8389 return PF_DROP;
8390 }
8391 switch (pd2.af) {
8392 #if INET
8393 case AF_INET:
8394 pbuf_copy_back(pbuf, off, ICMP_MINLEN,
8395 pd->hdr.icmp);
8396 pbuf_copy_back(pbuf, ipoff2,
8397 sizeof(h2), &h2);
8398 break;
8399 #endif /* INET */
8400 #if INET6
8401 case AF_INET6:
8402 pbuf_copy_back(pbuf, off,
8403 sizeof(struct icmp6_hdr),
8404 pd->hdr.icmp6);
8405 pbuf_copy_back(pbuf, ipoff2,
8406 sizeof(h2_6), &h2_6);
8407 break;
8408 #endif /* INET6 */
8409 }
8410 pbuf_copy_back(pbuf, off2, sizeof(uh), &uh);
8411 }
8412
8413 return PF_PASS;
8414 }
8415 #if INET
8416 case IPPROTO_ICMP: {
8417 struct icmp iih;
8418
8419 if (!pf_pull_hdr(pbuf, off2, &iih, ICMP_MINLEN,
8420 NULL, reason, pd2.af)) {
8421 DPFPRINTF(PF_DEBUG_MISC,
8422 ("pf: ICMP error message too short i"
8423 "(icmp)\n"));
8424 return PF_DROP;
8425 }
8426
8427 key.proto = IPPROTO_ICMP;
8428 if (direction == PF_IN) {
8429 key.af_gwy = pd2.af;
8430 PF_ACPY(&key.ext_gwy.addr, pd2.dst, key.af_gwy);
8431 PF_ACPY(&key.gwy.addr, pd2.src, key.af_gwy);
8432 key.ext_gwy.xport.port = 0;
8433 key.gwy.xport.port = iih.icmp_id;
8434 } else {
8435 key.af_lan = pd2.af;
8436 PF_ACPY(&key.lan.addr, pd2.dst, key.af_lan);
8437 PF_ACPY(&key.ext_lan.addr, pd2.src, key.af_lan);
8438 key.lan.xport.port = iih.icmp_id;
8439 key.ext_lan.xport.port = 0;
8440 }
8441
8442 STATE_LOOKUP();
8443
8444 sk = (*state)->state_key;
8445 if (STATE_TRANSLATE(sk)) {
8446 if (direction == PF_IN) {
8447 pf_change_icmp(pd2.src, &iih.icmp_id,
8448 daddr, &sk->lan.addr,
8449 sk->lan.xport.port, NULL,
8450 pd2.ip_sum, icmpsum,
8451 pd->ip_sum, 0, AF_INET);
8452 } else {
8453 pf_change_icmp(pd2.dst, &iih.icmp_id,
8454 saddr, &sk->gwy.addr,
8455 sk->gwy.xport.port, NULL,
8456 pd2.ip_sum, icmpsum,
8457 pd->ip_sum, 0, AF_INET);
8458 }
8459 if (pf_lazy_makewritable(pd, pbuf,
8460 off2 + ICMP_MINLEN) == NULL) {
8461 return PF_DROP;
8462 }
8463 pbuf_copy_back(pbuf, off, ICMP_MINLEN,
8464 pd->hdr.icmp);
8465 pbuf_copy_back(pbuf, ipoff2, sizeof(h2), &h2);
8466 pbuf_copy_back(pbuf, off2, ICMP_MINLEN, &iih);
8467 }
8468
8469 return PF_PASS;
8470 }
8471 #endif /* INET */
8472 #if INET6
8473 case IPPROTO_ICMPV6: {
8474 struct icmp6_hdr iih;
8475
8476 if (!pf_pull_hdr(pbuf, off2, &iih,
8477 sizeof(struct icmp6_hdr), NULL, reason, pd2.af)) {
8478 DPFPRINTF(PF_DEBUG_MISC,
8479 ("pf: ICMP error message too short "
8480 "(icmp6)\n"));
8481 return PF_DROP;
8482 }
8483
8484 key.proto = IPPROTO_ICMPV6;
8485 if (direction == PF_IN) {
8486 key.af_gwy = pd2.af;
8487 PF_ACPY(&key.ext_gwy.addr, pd2.dst, key.af_gwy);
8488 PF_ACPY(&key.gwy.addr, pd2.src, key.af_gwy);
8489 key.ext_gwy.xport.port = 0;
8490 key.gwy.xport.port = iih.icmp6_id;
8491 } else {
8492 key.af_lan = pd2.af;
8493 PF_ACPY(&key.lan.addr, pd2.dst, key.af_lan);
8494 PF_ACPY(&key.ext_lan.addr, pd2.src, key.af_lan);
8495 key.lan.xport.port = iih.icmp6_id;
8496 key.ext_lan.xport.port = 0;
8497 }
8498
8499 STATE_LOOKUP();
8500
8501 sk = (*state)->state_key;
8502 if (STATE_TRANSLATE(sk)) {
8503 if (direction == PF_IN) {
8504 pf_change_icmp(pd2.src, &iih.icmp6_id,
8505 daddr, &sk->lan.addr,
8506 sk->lan.xport.port, NULL,
8507 pd2.ip_sum, icmpsum,
8508 pd->ip_sum, 0, AF_INET6);
8509 } else {
8510 pf_change_icmp(pd2.dst, &iih.icmp6_id,
8511 saddr, &sk->gwy.addr,
8512 sk->gwy.xport.port, NULL,
8513 pd2.ip_sum, icmpsum,
8514 pd->ip_sum, 0, AF_INET6);
8515 }
8516 if (pf_lazy_makewritable(pd, pbuf, off2 +
8517 sizeof(struct icmp6_hdr)) == NULL) {
8518 return PF_DROP;
8519 }
8520 pbuf_copy_back(pbuf, off,
8521 sizeof(struct icmp6_hdr), pd->hdr.icmp6);
8522 pbuf_copy_back(pbuf, ipoff2, sizeof(h2_6),
8523 &h2_6);
8524 pbuf_copy_back(pbuf, off2,
8525 sizeof(struct icmp6_hdr), &iih);
8526 }
8527
8528 return PF_PASS;
8529 }
8530 #endif /* INET6 */
8531 default: {
8532 key.proto = pd2.proto;
8533 if (direction == PF_IN) {
8534 key.af_gwy = pd2.af;
8535 PF_ACPY(&key.ext_gwy.addr, pd2.dst, key.af_gwy);
8536 PF_ACPY(&key.gwy.addr, pd2.src, key.af_gwy);
8537 key.ext_gwy.xport.port = 0;
8538 key.gwy.xport.port = 0;
8539 } else {
8540 key.af_lan = pd2.af;
8541 PF_ACPY(&key.lan.addr, pd2.dst, key.af_lan);
8542 PF_ACPY(&key.ext_lan.addr, pd2.src, key.af_lan);
8543 key.lan.xport.port = 0;
8544 key.ext_lan.xport.port = 0;
8545 }
8546
8547 STATE_LOOKUP();
8548
8549 sk = (*state)->state_key;
8550 if (STATE_TRANSLATE(sk)) {
8551 if (direction == PF_IN) {
8552 pf_change_icmp(pd2.src, NULL, daddr,
8553 &sk->lan.addr, 0, NULL,
8554 pd2.ip_sum, icmpsum,
8555 pd->ip_sum, 0, pd2.af);
8556 } else {
8557 pf_change_icmp(pd2.dst, NULL, saddr,
8558 &sk->gwy.addr, 0, NULL,
8559 pd2.ip_sum, icmpsum,
8560 pd->ip_sum, 0, pd2.af);
8561 }
8562 switch (pd2.af) {
8563 #if INET
8564 case AF_INET:
8565 if (pf_lazy_makewritable(pd, pbuf,
8566 ipoff2 + sizeof(h2)) == NULL) {
8567 return PF_DROP;
8568 }
8569 /*
8570 * <XXXSCW>
8571 * Xnu was missing the following...
8572 */
8573 pbuf_copy_back(pbuf, off, ICMP_MINLEN,
8574 pd->hdr.icmp);
8575 pbuf_copy_back(pbuf, ipoff2,
8576 sizeof(h2), &h2);
8577 break;
8578 /*
8579 * </XXXSCW>
8580 */
8581 #endif /* INET */
8582 #if INET6
8583 case AF_INET6:
8584 if (pf_lazy_makewritable(pd, pbuf,
8585 ipoff2 + sizeof(h2_6)) == NULL) {
8586 return PF_DROP;
8587 }
8588 pbuf_copy_back(pbuf, off,
8589 sizeof(struct icmp6_hdr),
8590 pd->hdr.icmp6);
8591 pbuf_copy_back(pbuf, ipoff2,
8592 sizeof(h2_6), &h2_6);
8593 break;
8594 #endif /* INET6 */
8595 }
8596 }
8597
8598 return PF_PASS;
8599 }
8600 }
8601 }
8602 }
8603
8604 static int
8605 pf_test_state_grev1(struct pf_state **state, int direction,
8606 struct pfi_kif *kif, int off, struct pf_pdesc *pd)
8607 {
8608 struct pf_state_peer *src;
8609 struct pf_state_peer *dst;
8610 struct pf_state_key_cmp key;
8611 struct pf_grev1_hdr *grev1 = pd->hdr.grev1;
8612
8613 key.app_state = 0;
8614 key.proto = IPPROTO_GRE;
8615 key.proto_variant = PF_GRE_PPTP_VARIANT;
8616 if (direction == PF_IN) {
8617 key.af_gwy = pd->af;
8618 PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy);
8619 PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy);
8620 key.gwy.xport.call_id = grev1->call_id;
8621 } else {
8622 key.af_lan = pd->af;
8623 PF_ACPY(&key.lan.addr, pd->src, key.af_lan);
8624 PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan);
8625 key.ext_lan.xport.call_id = grev1->call_id;
8626 }
8627
8628 STATE_LOOKUP();
8629
8630 if (direction == (*state)->state_key->direction) {
8631 src = &(*state)->src;
8632 dst = &(*state)->dst;
8633 } else {
8634 src = &(*state)->dst;
8635 dst = &(*state)->src;
8636 }
8637
8638 /* update states */
8639 if (src->state < PFGRE1S_INITIATING) {
8640 src->state = PFGRE1S_INITIATING;
8641 }
8642
8643 /* update expire time */
8644 (*state)->expire = pf_time_second();
8645 if (src->state >= PFGRE1S_INITIATING &&
8646 dst->state >= PFGRE1S_INITIATING) {
8647 if ((*state)->timeout != PFTM_TCP_ESTABLISHED) {
8648 (*state)->timeout = PFTM_GREv1_ESTABLISHED;
8649 }
8650 src->state = PFGRE1S_ESTABLISHED;
8651 dst->state = PFGRE1S_ESTABLISHED;
8652 } else {
8653 (*state)->timeout = PFTM_GREv1_INITIATING;
8654 }
8655
8656 if ((*state)->state_key->app_state) {
8657 (*state)->state_key->app_state->u.grev1.pptp_state->expire =
8658 pf_time_second();
8659 }
8660
8661 /* translate source/destination address, if necessary */
8662 if (STATE_GRE_TRANSLATE((*state)->state_key)) {
8663 if (direction == PF_OUT) {
8664 switch (pd->af) {
8665 #if INET
8666 case AF_INET:
8667 pf_change_a(&pd->src->v4addr.s_addr,
8668 pd->ip_sum,
8669 (*state)->state_key->gwy.addr.v4addr.s_addr, 0);
8670 break;
8671 #endif /* INET */
8672 #if INET6
8673 case AF_INET6:
8674 PF_ACPY(pd->src, &(*state)->state_key->gwy.addr,
8675 pd->af);
8676 break;
8677 #endif /* INET6 */
8678 }
8679 } else {
8680 grev1->call_id = (*state)->state_key->lan.xport.call_id;
8681
8682 switch (pd->af) {
8683 #if INET
8684 case AF_INET:
8685 pf_change_a(&pd->dst->v4addr.s_addr,
8686 pd->ip_sum,
8687 (*state)->state_key->lan.addr.v4addr.s_addr, 0);
8688 break;
8689 #endif /* INET */
8690 #if INET6
8691 case AF_INET6:
8692 PF_ACPY(pd->dst, &(*state)->state_key->lan.addr,
8693 pd->af);
8694 break;
8695 #endif /* INET6 */
8696 }
8697 }
8698
8699 if (pf_lazy_makewritable(pd, pd->mp, off + sizeof(*grev1)) ==
8700 NULL) {
8701 return PF_DROP;
8702 }
8703 pbuf_copy_back(pd->mp, off, sizeof(*grev1), grev1);
8704 }
8705
8706 return PF_PASS;
8707 }
8708
8709 static int
8710 pf_test_state_esp(struct pf_state **state, int direction, struct pfi_kif *kif,
8711 int off, struct pf_pdesc *pd)
8712 {
8713 #pragma unused(off)
8714 struct pf_state_peer *src;
8715 struct pf_state_peer *dst;
8716 struct pf_state_key_cmp key;
8717 struct pf_esp_hdr *esp = pd->hdr.esp;
8718 int action;
8719
8720 memset(&key, 0, sizeof(key));
8721 key.proto = IPPROTO_ESP;
8722 if (direction == PF_IN) {
8723 key.af_gwy = pd->af;
8724 PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy);
8725 PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy);
8726 key.gwy.xport.spi = esp->spi;
8727 } else {
8728 key.af_lan = pd->af;
8729 PF_ACPY(&key.lan.addr, pd->src, key.af_lan);
8730 PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan);
8731 key.ext_lan.xport.spi = esp->spi;
8732 }
8733
8734 *state = pf_find_state(kif, &key, direction);
8735
8736 if (*state == 0) {
8737 struct pf_state *s;
8738
8739 /*
8740 * <jhw@apple.com>
8741 * No matching state. Look for a blocking state. If we find
8742 * one, then use that state and move it so that it's keyed to
8743 * the SPI in the current packet.
8744 */
8745 if (direction == PF_IN) {
8746 key.gwy.xport.spi = 0;
8747
8748 s = pf_find_state(kif, &key, direction);
8749 if (s) {
8750 struct pf_state_key *sk = s->state_key;
8751
8752 RB_REMOVE(pf_state_tree_ext_gwy,
8753 &pf_statetbl_ext_gwy, sk);
8754 sk->lan.xport.spi = sk->gwy.xport.spi =
8755 esp->spi;
8756
8757 if (RB_INSERT(pf_state_tree_ext_gwy,
8758 &pf_statetbl_ext_gwy, sk)) {
8759 pf_detach_state(s, PF_DT_SKIP_EXTGWY);
8760 } else {
8761 *state = s;
8762 }
8763 }
8764 } else {
8765 key.ext_lan.xport.spi = 0;
8766
8767 s = pf_find_state(kif, &key, direction);
8768 if (s) {
8769 struct pf_state_key *sk = s->state_key;
8770
8771 RB_REMOVE(pf_state_tree_lan_ext,
8772 &pf_statetbl_lan_ext, sk);
8773 sk->ext_lan.xport.spi = esp->spi;
8774
8775 if (RB_INSERT(pf_state_tree_lan_ext,
8776 &pf_statetbl_lan_ext, sk)) {
8777 pf_detach_state(s, PF_DT_SKIP_LANEXT);
8778 } else {
8779 *state = s;
8780 }
8781 }
8782 }
8783
8784 if (s) {
8785 if (*state == 0) {
8786 #if NPFSYNC
8787 if (s->creatorid == pf_status.hostid) {
8788 pfsync_delete_state(s);
8789 }
8790 #endif
8791 s->timeout = PFTM_UNLINKED;
8792 hook_runloop(&s->unlink_hooks,
8793 HOOK_REMOVE | HOOK_FREE);
8794 pf_src_tree_remove_state(s);
8795 pf_free_state(s);
8796 return PF_DROP;
8797 }
8798 }
8799 }
8800
8801 /* similar to STATE_LOOKUP() */
8802 if (*state != NULL && pd != NULL && !(pd->pktflags & PKTF_FLOW_ID)) {
8803 pd->flowsrc = (*state)->state_key->flowsrc;
8804 pd->flowhash = (*state)->state_key->flowhash;
8805 if (pd->flowhash != 0) {
8806 pd->pktflags |= PKTF_FLOW_ID;
8807 pd->pktflags &= ~PKTF_FLOW_ADV;
8808 }
8809 }
8810
8811 if (pf_state_lookup_aux(state, kif, direction, &action)) {
8812 return action;
8813 }
8814
8815 if (direction == (*state)->state_key->direction) {
8816 src = &(*state)->src;
8817 dst = &(*state)->dst;
8818 } else {
8819 src = &(*state)->dst;
8820 dst = &(*state)->src;
8821 }
8822
8823 /* update states */
8824 if (src->state < PFESPS_INITIATING) {
8825 src->state = PFESPS_INITIATING;
8826 }
8827
8828 /* update expire time */
8829 (*state)->expire = pf_time_second();
8830 if (src->state >= PFESPS_INITIATING &&
8831 dst->state >= PFESPS_INITIATING) {
8832 (*state)->timeout = PFTM_ESP_ESTABLISHED;
8833 src->state = PFESPS_ESTABLISHED;
8834 dst->state = PFESPS_ESTABLISHED;
8835 } else {
8836 (*state)->timeout = PFTM_ESP_INITIATING;
8837 }
8838 /* translate source/destination address, if necessary */
8839 if (STATE_ADDR_TRANSLATE((*state)->state_key)) {
8840 if (direction == PF_OUT) {
8841 switch (pd->af) {
8842 #if INET
8843 case AF_INET:
8844 pf_change_a(&pd->src->v4addr.s_addr,
8845 pd->ip_sum,
8846 (*state)->state_key->gwy.addr.v4addr.s_addr, 0);
8847 break;
8848 #endif /* INET */
8849 #if INET6
8850 case AF_INET6:
8851 PF_ACPY(pd->src, &(*state)->state_key->gwy.addr,
8852 pd->af);
8853 break;
8854 #endif /* INET6 */
8855 }
8856 } else {
8857 switch (pd->af) {
8858 #if INET
8859 case AF_INET:
8860 pf_change_a(&pd->dst->v4addr.s_addr,
8861 pd->ip_sum,
8862 (*state)->state_key->lan.addr.v4addr.s_addr, 0);
8863 break;
8864 #endif /* INET */
8865 #if INET6
8866 case AF_INET6:
8867 PF_ACPY(pd->dst, &(*state)->state_key->lan.addr,
8868 pd->af);
8869 break;
8870 #endif /* INET6 */
8871 }
8872 }
8873 }
8874
8875 return PF_PASS;
8876 }
8877
8878 static int
8879 pf_test_state_other(struct pf_state **state, int direction, struct pfi_kif *kif,
8880 struct pf_pdesc *pd)
8881 {
8882 struct pf_state_peer *src, *dst;
8883 struct pf_state_key_cmp key;
8884
8885 key.app_state = 0;
8886 key.proto = pd->proto;
8887 if (direction == PF_IN) {
8888 key.af_gwy = pd->af;
8889 PF_ACPY(&key.ext_gwy.addr, pd->src, key.af_gwy);
8890 PF_ACPY(&key.gwy.addr, pd->dst, key.af_gwy);
8891 key.ext_gwy.xport.port = 0;
8892 key.gwy.xport.port = 0;
8893 } else {
8894 key.af_lan = pd->af;
8895 PF_ACPY(&key.lan.addr, pd->src, key.af_lan);
8896 PF_ACPY(&key.ext_lan.addr, pd->dst, key.af_lan);
8897 key.lan.xport.port = 0;
8898 key.ext_lan.xport.port = 0;
8899 }
8900
8901 STATE_LOOKUP();
8902
8903 if (direction == (*state)->state_key->direction) {
8904 src = &(*state)->src;
8905 dst = &(*state)->dst;
8906 } else {
8907 src = &(*state)->dst;
8908 dst = &(*state)->src;
8909 }
8910
8911 /* update states */
8912 if (src->state < PFOTHERS_SINGLE) {
8913 src->state = PFOTHERS_SINGLE;
8914 }
8915 if (dst->state == PFOTHERS_SINGLE) {
8916 dst->state = PFOTHERS_MULTIPLE;
8917 }
8918
8919 /* update expire time */
8920 (*state)->expire = pf_time_second();
8921 if (src->state == PFOTHERS_MULTIPLE && dst->state == PFOTHERS_MULTIPLE) {
8922 (*state)->timeout = PFTM_OTHER_MULTIPLE;
8923 } else {
8924 (*state)->timeout = PFTM_OTHER_SINGLE;
8925 }
8926
8927 /* translate source/destination address, if necessary */
8928 if (STATE_ADDR_TRANSLATE((*state)->state_key)) {
8929 if (direction == PF_OUT) {
8930 switch (pd->af) {
8931 #if INET
8932 case AF_INET:
8933 pf_change_a(&pd->src->v4addr.s_addr,
8934 pd->ip_sum,
8935 (*state)->state_key->gwy.addr.v4addr.s_addr,
8936 0);
8937 break;
8938 #endif /* INET */
8939 #if INET6
8940 case AF_INET6:
8941 PF_ACPY(pd->src,
8942 &(*state)->state_key->gwy.addr, pd->af);
8943 break;
8944 #endif /* INET6 */
8945 }
8946 } else {
8947 switch (pd->af) {
8948 #if INET
8949 case AF_INET:
8950 pf_change_a(&pd->dst->v4addr.s_addr,
8951 pd->ip_sum,
8952 (*state)->state_key->lan.addr.v4addr.s_addr,
8953 0);
8954 break;
8955 #endif /* INET */
8956 #if INET6
8957 case AF_INET6:
8958 PF_ACPY(pd->dst,
8959 &(*state)->state_key->lan.addr, pd->af);
8960 break;
8961 #endif /* INET6 */
8962 }
8963 }
8964 }
8965
8966 return PF_PASS;
8967 }
8968
8969 /*
8970 * ipoff and off are measured from the start of the mbuf chain.
8971 * h must be at "ipoff" on the mbuf chain.
8972 */
8973 void *
8974 pf_pull_hdr(pbuf_t *pbuf, int off, void *p, int len,
8975 u_short *actionp, u_short *reasonp, sa_family_t af)
8976 {
8977 switch (af) {
8978 #if INET
8979 case AF_INET: {
8980 struct ip *h = pbuf->pb_data;
8981 u_int16_t fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3;
8982
8983 if (fragoff) {
8984 if (fragoff >= len) {
8985 ACTION_SET(actionp, PF_PASS);
8986 } else {
8987 ACTION_SET(actionp, PF_DROP);
8988 REASON_SET(reasonp, PFRES_FRAG);
8989 }
8990 return NULL;
8991 }
8992 if (pbuf->pb_packet_len < (unsigned)(off + len) ||
8993 ntohs(h->ip_len) < off + len) {
8994 ACTION_SET(actionp, PF_DROP);
8995 REASON_SET(reasonp, PFRES_SHORT);
8996 return NULL;
8997 }
8998 break;
8999 }
9000 #endif /* INET */
9001 #if INET6
9002 case AF_INET6: {
9003 struct ip6_hdr *h = pbuf->pb_data;
9004
9005 if (pbuf->pb_packet_len < (unsigned)(off + len) ||
9006 (ntohs(h->ip6_plen) + sizeof(struct ip6_hdr)) <
9007 (unsigned)(off + len)) {
9008 ACTION_SET(actionp, PF_DROP);
9009 REASON_SET(reasonp, PFRES_SHORT);
9010 return NULL;
9011 }
9012 break;
9013 }
9014 #endif /* INET6 */
9015 }
9016 pbuf_copy_data(pbuf, off, len, p);
9017 return p;
9018 }
9019
9020 int
9021 pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *kif)
9022 {
9023 #pragma unused(kif)
9024 struct sockaddr_in *dst;
9025 int ret = 1;
9026 #if INET6
9027 struct sockaddr_in6 *dst6;
9028 struct route_in6 ro;
9029 #else
9030 struct route ro;
9031 #endif
9032
9033 bzero(&ro, sizeof(ro));
9034 switch (af) {
9035 case AF_INET:
9036 dst = satosin(&ro.ro_dst);
9037 dst->sin_family = AF_INET;
9038 dst->sin_len = sizeof(*dst);
9039 dst->sin_addr = addr->v4addr;
9040 break;
9041 #if INET6
9042 case AF_INET6:
9043 dst6 = (struct sockaddr_in6 *)&ro.ro_dst;
9044 dst6->sin6_family = AF_INET6;
9045 dst6->sin6_len = sizeof(*dst6);
9046 dst6->sin6_addr = addr->v6addr;
9047 break;
9048 #endif /* INET6 */
9049 default:
9050 return 0;
9051 }
9052
9053 /* XXX: IFT_ENC is not currently used by anything*/
9054 /* Skip checks for ipsec interfaces */
9055 if (kif != NULL && kif->pfik_ifp->if_type == IFT_ENC) {
9056 goto out;
9057 }
9058
9059 /* XXX: what is the point of this? */
9060 rtalloc((struct route *)&ro);
9061
9062 out:
9063 ROUTE_RELEASE(&ro);
9064 return ret;
9065 }
9066
9067 int
9068 pf_rtlabel_match(struct pf_addr *addr, sa_family_t af, struct pf_addr_wrap *aw)
9069 {
9070 #pragma unused(aw)
9071 struct sockaddr_in *dst;
9072 #if INET6
9073 struct sockaddr_in6 *dst6;
9074 struct route_in6 ro;
9075 #else
9076 struct route ro;
9077 #endif
9078 int ret = 0;
9079
9080 bzero(&ro, sizeof(ro));
9081 switch (af) {
9082 case AF_INET:
9083 dst = satosin(&ro.ro_dst);
9084 dst->sin_family = AF_INET;
9085 dst->sin_len = sizeof(*dst);
9086 dst->sin_addr = addr->v4addr;
9087 break;
9088 #if INET6
9089 case AF_INET6:
9090 dst6 = (struct sockaddr_in6 *)&ro.ro_dst;
9091 dst6->sin6_family = AF_INET6;
9092 dst6->sin6_len = sizeof(*dst6);
9093 dst6->sin6_addr = addr->v6addr;
9094 break;
9095 #endif /* INET6 */
9096 default:
9097 return 0;
9098 }
9099
9100 /* XXX: what is the point of this? */
9101 rtalloc((struct route *)&ro);
9102
9103 ROUTE_RELEASE(&ro);
9104
9105 return ret;
9106 }
9107
9108 #if INET
9109 static void
9110 pf_route(pbuf_t **pbufp, struct pf_rule *r, int dir, struct ifnet *oifp,
9111 struct pf_state *s, struct pf_pdesc *pd)
9112 {
9113 #pragma unused(pd)
9114 struct mbuf *m0, *m1;
9115 struct route iproute;
9116 struct route *ro = &iproute;
9117 struct sockaddr_in *dst;
9118 struct ip *ip;
9119 struct ifnet *ifp = NULL;
9120 struct pf_addr naddr;
9121 struct pf_src_node *sn = NULL;
9122 int error = 0;
9123 uint32_t sw_csum;
9124 int interface_mtu = 0;
9125 bzero(&iproute, sizeof(iproute));
9126
9127 if (pbufp == NULL || !pbuf_is_valid(*pbufp) || r == NULL ||
9128 (dir != PF_IN && dir != PF_OUT) || oifp == NULL) {
9129 panic("pf_route: invalid parameters");
9130 }
9131
9132 if (pd->pf_mtag->pftag_routed++ > 3) {
9133 pbuf_destroy(*pbufp);
9134 *pbufp = NULL;
9135 m0 = NULL;
9136 goto bad;
9137 }
9138
9139 /*
9140 * Since this is something of an edge case and may involve the
9141 * host stack (for routing, at least for now), we convert the
9142 * incoming pbuf into an mbuf.
9143 */
9144 if (r->rt == PF_DUPTO) {
9145 m0 = pbuf_clone_to_mbuf(*pbufp);
9146 } else if ((r->rt == PF_REPLYTO) == (r->direction == dir)) {
9147 return;
9148 } else {
9149 /* We're going to consume this packet */
9150 m0 = pbuf_to_mbuf(*pbufp, TRUE);
9151 *pbufp = NULL;
9152 }
9153
9154 if (m0 == NULL) {
9155 goto bad;
9156 }
9157
9158 /* We now have the packet in an mbuf (m0) */
9159
9160 if (m0->m_len < (int)sizeof(struct ip)) {
9161 DPFPRINTF(PF_DEBUG_URGENT,
9162 ("pf_route: packet length < sizeof (struct ip)\n"));
9163 goto bad;
9164 }
9165
9166 ip = mtod(m0, struct ip *);
9167
9168 dst = satosin((void *)&ro->ro_dst);
9169 dst->sin_family = AF_INET;
9170 dst->sin_len = sizeof(*dst);
9171 dst->sin_addr = ip->ip_dst;
9172
9173 if (r->rt == PF_FASTROUTE) {
9174 rtalloc(ro);
9175 if (ro->ro_rt == NULL) {
9176 ipstat.ips_noroute++;
9177 goto bad;
9178 }
9179
9180 ifp = ro->ro_rt->rt_ifp;
9181 RT_LOCK(ro->ro_rt);
9182 ro->ro_rt->rt_use++;
9183
9184 if (ro->ro_rt->rt_flags & RTF_GATEWAY) {
9185 dst = satosin((void *)ro->ro_rt->rt_gateway);
9186 }
9187 RT_UNLOCK(ro->ro_rt);
9188 } else {
9189 if (TAILQ_EMPTY(&r->rpool.list)) {
9190 DPFPRINTF(PF_DEBUG_URGENT,
9191 ("pf_route: TAILQ_EMPTY(&r->rpool.list)\n"));
9192 goto bad;
9193 }
9194 if (s == NULL) {
9195 pf_map_addr(AF_INET, r, (struct pf_addr *)&ip->ip_src,
9196 &naddr, NULL, &sn);
9197 if (!PF_AZERO(&naddr, AF_INET)) {
9198 dst->sin_addr.s_addr = naddr.v4addr.s_addr;
9199 }
9200 ifp = r->rpool.cur->kif ?
9201 r->rpool.cur->kif->pfik_ifp : NULL;
9202 } else {
9203 if (!PF_AZERO(&s->rt_addr, AF_INET)) {
9204 dst->sin_addr.s_addr =
9205 s->rt_addr.v4addr.s_addr;
9206 }
9207 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
9208 }
9209 }
9210 if (ifp == NULL) {
9211 goto bad;
9212 }
9213
9214 if (oifp != ifp) {
9215 if (pf_test_mbuf(PF_OUT, ifp, &m0, NULL, NULL) != PF_PASS) {
9216 goto bad;
9217 } else if (m0 == NULL) {
9218 goto done;
9219 }
9220 if (m0->m_len < (int)sizeof(struct ip)) {
9221 DPFPRINTF(PF_DEBUG_URGENT,
9222 ("pf_route: packet length < sizeof (struct ip)\n"));
9223 goto bad;
9224 }
9225 ip = mtod(m0, struct ip *);
9226 }
9227
9228 /* Catch routing changes wrt. hardware checksumming for TCP or UDP. */
9229 ip_output_checksum(ifp, m0, ((ip->ip_hl) << 2), ntohs(ip->ip_len),
9230 &sw_csum);
9231
9232 interface_mtu = ifp->if_mtu;
9233
9234 if (INTF_ADJUST_MTU_FOR_CLAT46(ifp)) {
9235 interface_mtu = IN6_LINKMTU(ifp);
9236 /* Further adjust the size for CLAT46 expansion */
9237 interface_mtu -= CLAT46_HDR_EXPANSION_OVERHD;
9238 }
9239
9240 if (ntohs(ip->ip_len) <= interface_mtu || TSO_IPV4_OK(ifp, m0) ||
9241 (!(ip->ip_off & htons(IP_DF)) &&
9242 (ifp->if_hwassist & CSUM_FRAGMENT))) {
9243 ip->ip_sum = 0;
9244 if (sw_csum & CSUM_DELAY_IP) {
9245 ip->ip_sum = in_cksum(m0, ip->ip_hl << 2);
9246 sw_csum &= ~CSUM_DELAY_IP;
9247 m0->m_pkthdr.csum_flags &= ~CSUM_DELAY_IP;
9248 }
9249 error = ifnet_output(ifp, PF_INET, m0, ro->ro_rt, sintosa(dst));
9250 goto done;
9251 }
9252
9253 /*
9254 * Too large for interface; fragment if possible.
9255 * Must be able to put at least 8 bytes per fragment.
9256 * Balk when DF bit is set or the interface didn't support TSO.
9257 */
9258 if ((ip->ip_off & htons(IP_DF)) ||
9259 (m0->m_pkthdr.csum_flags & CSUM_TSO_IPV4)) {
9260 ipstat.ips_cantfrag++;
9261 if (r->rt != PF_DUPTO) {
9262 icmp_error(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 0,
9263 interface_mtu);
9264 goto done;
9265 } else {
9266 goto bad;
9267 }
9268 }
9269
9270 m1 = m0;
9271
9272 /* PR-8933605: send ip_len,ip_off to ip_fragment in host byte order */
9273 #if BYTE_ORDER != BIG_ENDIAN
9274 NTOHS(ip->ip_off);
9275 NTOHS(ip->ip_len);
9276 #endif
9277 error = ip_fragment(m0, ifp, interface_mtu, sw_csum);
9278
9279 if (error) {
9280 m0 = NULL;
9281 goto bad;
9282 }
9283
9284 for (m0 = m1; m0; m0 = m1) {
9285 m1 = m0->m_nextpkt;
9286 m0->m_nextpkt = 0;
9287 if (error == 0) {
9288 error = ifnet_output(ifp, PF_INET, m0, ro->ro_rt,
9289 sintosa(dst));
9290 } else {
9291 m_freem(m0);
9292 }
9293 }
9294
9295 if (error == 0) {
9296 ipstat.ips_fragmented++;
9297 }
9298
9299 done:
9300 ROUTE_RELEASE(&iproute);
9301 return;
9302
9303 bad:
9304 if (m0) {
9305 m_freem(m0);
9306 }
9307 goto done;
9308 }
9309 #endif /* INET */
9310
9311 #if INET6
9312 static void
9313 pf_route6(pbuf_t **pbufp, struct pf_rule *r, int dir, struct ifnet *oifp,
9314 struct pf_state *s, struct pf_pdesc *pd)
9315 {
9316 #pragma unused(pd)
9317 struct mbuf *m0;
9318 struct route_in6 ip6route;
9319 struct route_in6 *ro;
9320 struct sockaddr_in6 *dst;
9321 struct ip6_hdr *ip6;
9322 struct ifnet *ifp = NULL;
9323 struct pf_addr naddr;
9324 struct pf_src_node *sn = NULL;
9325 int error = 0;
9326 struct pf_mtag *pf_mtag;
9327
9328 if (pbufp == NULL || !pbuf_is_valid(*pbufp) || r == NULL ||
9329 (dir != PF_IN && dir != PF_OUT) || oifp == NULL) {
9330 panic("pf_route6: invalid parameters");
9331 }
9332
9333 if (pd->pf_mtag->pftag_routed++ > 3) {
9334 pbuf_destroy(*pbufp);
9335 *pbufp = NULL;
9336 m0 = NULL;
9337 goto bad;
9338 }
9339
9340 /*
9341 * Since this is something of an edge case and may involve the
9342 * host stack (for routing, at least for now), we convert the
9343 * incoming pbuf into an mbuf.
9344 */
9345 if (r->rt == PF_DUPTO) {
9346 m0 = pbuf_clone_to_mbuf(*pbufp);
9347 } else if ((r->rt == PF_REPLYTO) == (r->direction == dir)) {
9348 return;
9349 } else {
9350 /* We're about to consume this packet */
9351 m0 = pbuf_to_mbuf(*pbufp, TRUE);
9352 *pbufp = NULL;
9353 }
9354
9355 if (m0 == NULL) {
9356 goto bad;
9357 }
9358
9359 if (m0->m_len < (int)sizeof(struct ip6_hdr)) {
9360 DPFPRINTF(PF_DEBUG_URGENT,
9361 ("pf_route6: m0->m_len < sizeof (struct ip6_hdr)\n"));
9362 goto bad;
9363 }
9364 ip6 = mtod(m0, struct ip6_hdr *);
9365
9366 ro = &ip6route;
9367 bzero((caddr_t)ro, sizeof(*ro));
9368 dst = (struct sockaddr_in6 *)&ro->ro_dst;
9369 dst->sin6_family = AF_INET6;
9370 dst->sin6_len = sizeof(*dst);
9371 dst->sin6_addr = ip6->ip6_dst;
9372
9373 /* Cheat. XXX why only in the v6addr case??? */
9374 if (r->rt == PF_FASTROUTE) {
9375 pf_mtag = pf_get_mtag(m0);
9376 ASSERT(pf_mtag != NULL);
9377 pf_mtag->pftag_flags |= PF_TAG_GENERATED;
9378 ip6_output(m0, NULL, NULL, 0, NULL, NULL, NULL);
9379 return;
9380 }
9381
9382 if (TAILQ_EMPTY(&r->rpool.list)) {
9383 DPFPRINTF(PF_DEBUG_URGENT,
9384 ("pf_route6: TAILQ_EMPTY(&r->rpool.list)\n"));
9385 goto bad;
9386 }
9387 if (s == NULL) {
9388 pf_map_addr(AF_INET6, r, (struct pf_addr *)(uintptr_t)&ip6->ip6_src,
9389 &naddr, NULL, &sn);
9390 if (!PF_AZERO(&naddr, AF_INET6)) {
9391 PF_ACPY((struct pf_addr *)&dst->sin6_addr,
9392 &naddr, AF_INET6);
9393 }
9394 ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL;
9395 } else {
9396 if (!PF_AZERO(&s->rt_addr, AF_INET6)) {
9397 PF_ACPY((struct pf_addr *)&dst->sin6_addr,
9398 &s->rt_addr, AF_INET6);
9399 }
9400 ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
9401 }
9402 if (ifp == NULL) {
9403 goto bad;
9404 }
9405
9406 if (oifp != ifp) {
9407 if (pf_test6_mbuf(PF_OUT, ifp, &m0, NULL, NULL) != PF_PASS) {
9408 goto bad;
9409 } else if (m0 == NULL) {
9410 goto done;
9411 }
9412 if (m0->m_len < (int)sizeof(struct ip6_hdr)) {
9413 DPFPRINTF(PF_DEBUG_URGENT, ("pf_route6: m0->m_len "
9414 "< sizeof (struct ip6_hdr)\n"));
9415 goto bad;
9416 }
9417 pf_mtag = pf_get_mtag(m0);
9418 /*
9419 * send refragmented packets.
9420 */
9421 if ((pf_mtag->pftag_flags & PF_TAG_REFRAGMENTED) != 0) {
9422 pf_mtag->pftag_flags &= ~PF_TAG_REFRAGMENTED;
9423 /*
9424 * nd6_output() frees packet chain in both success and
9425 * failure cases.
9426 */
9427 error = nd6_output(ifp, ifp, m0, dst, NULL, NULL);
9428 m0 = NULL;
9429 if (error) {
9430 DPFPRINTF(PF_DEBUG_URGENT, ("pf_route6:"
9431 "dropped refragmented packet\n"));
9432 }
9433 goto done;
9434 }
9435 ip6 = mtod(m0, struct ip6_hdr *);
9436 }
9437
9438 /*
9439 * If the packet is too large for the outgoing interface,
9440 * send back an icmp6 error.
9441 */
9442 if (IN6_IS_SCOPE_EMBED(&dst->sin6_addr)) {
9443 dst->sin6_addr.s6_addr16[1] = htons(ifp->if_index);
9444 }
9445 if ((unsigned)m0->m_pkthdr.len <= ifp->if_mtu) {
9446 error = nd6_output(ifp, ifp, m0, dst, NULL, NULL);
9447 } else {
9448 in6_ifstat_inc(ifp, ifs6_in_toobig);
9449 if (r->rt != PF_DUPTO) {
9450 icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu);
9451 } else {
9452 goto bad;
9453 }
9454 }
9455
9456 done:
9457 return;
9458
9459 bad:
9460 if (m0) {
9461 m_freem(m0);
9462 m0 = NULL;
9463 }
9464 goto done;
9465 }
9466 #endif /* INET6 */
9467
9468
9469 /*
9470 * check protocol (tcp/udp/icmp/icmp6) checksum and set mbuf flag
9471 * off is the offset where the protocol header starts
9472 * len is the total length of protocol header plus payload
9473 * returns 0 when the checksum is valid, otherwise returns 1.
9474 */
9475 static int
9476 pf_check_proto_cksum(pbuf_t *pbuf, int off, int len, u_int8_t p,
9477 sa_family_t af)
9478 {
9479 u_int16_t sum;
9480
9481 switch (p) {
9482 case IPPROTO_TCP:
9483 case IPPROTO_UDP:
9484 /*
9485 * Optimize for the common case; if the hardware calculated
9486 * value doesn't include pseudo-header checksum, or if it
9487 * is partially-computed (only 16-bit summation), do it in
9488 * software below.
9489 */
9490 if ((*pbuf->pb_csum_flags &
9491 (CSUM_DATA_VALID | CSUM_PSEUDO_HDR)) ==
9492 (CSUM_DATA_VALID | CSUM_PSEUDO_HDR) &&
9493 (*pbuf->pb_csum_data ^ 0xffff) == 0) {
9494 return 0;
9495 }
9496 break;
9497 case IPPROTO_ICMP:
9498 #if INET6
9499 case IPPROTO_ICMPV6:
9500 #endif /* INET6 */
9501 break;
9502 default:
9503 return 1;
9504 }
9505 if (off < (int)sizeof(struct ip) || len < (int)sizeof(struct udphdr)) {
9506 return 1;
9507 }
9508 if (pbuf->pb_packet_len < (unsigned)(off + len)) {
9509 return 1;
9510 }
9511 switch (af) {
9512 #if INET
9513 case AF_INET:
9514 if (p == IPPROTO_ICMP) {
9515 #if 0
9516 if (m->m_len < off) {
9517 return 1;
9518 }
9519 m->m_data += off;
9520 m->m_len -= off;
9521 sum = in_cksum(m, len);
9522 m->m_data -= off;
9523 m->m_len += off;
9524 #else
9525 if (pbuf->pb_contig_len < (unsigned)off) {
9526 return 1;
9527 }
9528 sum = pbuf_inet_cksum(pbuf, 0, off, len);
9529 #endif
9530 } else {
9531 if (pbuf->pb_contig_len < (int)sizeof(struct ip)) {
9532 return 1;
9533 }
9534 sum = pbuf_inet_cksum(pbuf, p, off, len);
9535 }
9536 break;
9537 #endif /* INET */
9538 #if INET6
9539 case AF_INET6:
9540 if (pbuf->pb_contig_len < (int)sizeof(struct ip6_hdr)) {
9541 return 1;
9542 }
9543 sum = pbuf_inet6_cksum(pbuf, p, off, len);
9544 break;
9545 #endif /* INET6 */
9546 default:
9547 return 1;
9548 }
9549 if (sum) {
9550 switch (p) {
9551 case IPPROTO_TCP:
9552 tcpstat.tcps_rcvbadsum++;
9553 break;
9554 case IPPROTO_UDP:
9555 udpstat.udps_badsum++;
9556 break;
9557 case IPPROTO_ICMP:
9558 icmpstat.icps_checksum++;
9559 break;
9560 #if INET6
9561 case IPPROTO_ICMPV6:
9562 icmp6stat.icp6s_checksum++;
9563 break;
9564 #endif /* INET6 */
9565 }
9566 return 1;
9567 }
9568 return 0;
9569 }
9570
9571 #if INET
9572 #define PF_APPLE_UPDATE_PDESC_IPv4() \
9573 do { \
9574 if (pbuf && pd.mp && pbuf != pd.mp) { \
9575 pbuf = pd.mp; \
9576 h = pbuf->pb_data; \
9577 pd.pf_mtag = pf_get_mtag_pbuf(pbuf); \
9578 } \
9579 } while (0)
9580
9581 int
9582 pf_test_mbuf(int dir, struct ifnet *ifp, struct mbuf **m0,
9583 struct ether_header *eh, struct ip_fw_args *fwa)
9584 {
9585 pbuf_t pbuf_store, *pbuf;
9586 int rv;
9587
9588 pbuf_init_mbuf(&pbuf_store, *m0, (*m0)->m_pkthdr.rcvif);
9589 pbuf = &pbuf_store;
9590
9591 rv = pf_test(dir, ifp, &pbuf, eh, fwa);
9592
9593 if (pbuf_is_valid(pbuf)) {
9594 *m0 = pbuf->pb_mbuf;
9595 pbuf->pb_mbuf = NULL;
9596 pbuf_destroy(pbuf);
9597 } else {
9598 *m0 = NULL;
9599 }
9600
9601 return rv;
9602 }
9603
9604 int
9605 pf_test(int dir, struct ifnet *ifp, pbuf_t **pbufp,
9606 struct ether_header *eh, struct ip_fw_args *fwa)
9607 {
9608 #if !DUMMYNET
9609 #pragma unused(fwa)
9610 #endif
9611 struct pfi_kif *kif;
9612 u_short action = PF_PASS, reason = 0, log = 0;
9613 pbuf_t *pbuf = *pbufp;
9614 struct ip *h = 0;
9615 struct pf_rule *a = NULL, *r = &pf_default_rule, *tr, *nr;
9616 struct pf_state *s = NULL;
9617 struct pf_state_key *sk = NULL;
9618 struct pf_ruleset *ruleset = NULL;
9619 struct pf_pdesc pd;
9620 int off, dirndx, pqid = 0;
9621
9622 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
9623
9624 if (!pf_status.running) {
9625 return PF_PASS;
9626 }
9627
9628 memset(&pd, 0, sizeof(pd));
9629
9630 if ((pd.pf_mtag = pf_get_mtag_pbuf(pbuf)) == NULL) {
9631 DPFPRINTF(PF_DEBUG_URGENT,
9632 ("pf_test: pf_get_mtag_pbuf returned NULL\n"));
9633 return PF_DROP;
9634 }
9635
9636 if (pd.pf_mtag->pftag_flags & PF_TAG_GENERATED) {
9637 return PF_PASS;
9638 }
9639
9640 kif = (struct pfi_kif *)ifp->if_pf_kif;
9641
9642 if (kif == NULL) {
9643 DPFPRINTF(PF_DEBUG_URGENT,
9644 ("pf_test: kif == NULL, if_name %s\n", ifp->if_name));
9645 return PF_DROP;
9646 }
9647 if (kif->pfik_flags & PFI_IFLAG_SKIP) {
9648 return PF_PASS;
9649 }
9650
9651 if (pbuf->pb_packet_len < (int)sizeof(*h)) {
9652 REASON_SET(&reason, PFRES_SHORT);
9653 return PF_DROP;
9654 }
9655
9656 /* initialize enough of pd for the done label */
9657 h = pbuf->pb_data;
9658 pd.mp = pbuf;
9659 pd.lmw = 0;
9660 pd.pf_mtag = pf_get_mtag_pbuf(pbuf);
9661 pd.src = (struct pf_addr *)&h->ip_src;
9662 pd.dst = (struct pf_addr *)&h->ip_dst;
9663 PF_ACPY(&pd.baddr, pd.src, AF_INET);
9664 PF_ACPY(&pd.bdaddr, pd.dst, AF_INET);
9665 pd.ip_sum = &h->ip_sum;
9666 pd.proto = h->ip_p;
9667 pd.proto_variant = 0;
9668 pd.af = AF_INET;
9669 pd.tos = h->ip_tos;
9670 pd.ttl = h->ip_ttl;
9671 pd.tot_len = ntohs(h->ip_len);
9672 pd.eh = eh;
9673
9674 #if DUMMYNET
9675 if (fwa != NULL && fwa->fwa_pf_rule != NULL) {
9676 goto nonormalize;
9677 }
9678 #endif /* DUMMYNET */
9679
9680 /* We do IP header normalization and packet reassembly here */
9681 action = pf_normalize_ip(pbuf, dir, kif, &reason, &pd);
9682 if (action != PF_PASS || pd.lmw < 0) {
9683 action = PF_DROP;
9684 goto done;
9685 }
9686
9687 #if DUMMYNET
9688 nonormalize:
9689 #endif /* DUMMYNET */
9690 /* pf_normalize can mess with pb_data */
9691 h = pbuf->pb_data;
9692
9693 off = h->ip_hl << 2;
9694 if (off < (int)sizeof(*h)) {
9695 action = PF_DROP;
9696 REASON_SET(&reason, PFRES_SHORT);
9697 log = 1;
9698 goto done;
9699 }
9700
9701 pd.src = (struct pf_addr *)&h->ip_src;
9702 pd.dst = (struct pf_addr *)&h->ip_dst;
9703 PF_ACPY(&pd.baddr, pd.src, AF_INET);
9704 PF_ACPY(&pd.bdaddr, pd.dst, AF_INET);
9705 pd.ip_sum = &h->ip_sum;
9706 pd.proto = h->ip_p;
9707 pd.proto_variant = 0;
9708 pd.mp = pbuf;
9709 pd.lmw = 0;
9710 pd.pf_mtag = pf_get_mtag_pbuf(pbuf);
9711 pd.af = AF_INET;
9712 pd.tos = h->ip_tos;
9713 pd.ttl = h->ip_ttl;
9714 pd.sc = MBUF_SCIDX(pbuf_get_service_class(pbuf));
9715 pd.tot_len = ntohs(h->ip_len);
9716 pd.eh = eh;
9717
9718 if (*pbuf->pb_flags & PKTF_FLOW_ID) {
9719 pd.flowsrc = *pbuf->pb_flowsrc;
9720 pd.flowhash = *pbuf->pb_flowid;
9721 pd.pktflags = *pbuf->pb_flags & PKTF_FLOW_MASK;
9722 }
9723
9724 /* handle fragments that didn't get reassembled by normalization */
9725 if (h->ip_off & htons(IP_MF | IP_OFFMASK)) {
9726 pd.flags |= PFDESC_IP_FRAG;
9727 #if DUMMYNET
9728 /* Traffic goes through dummynet first */
9729 action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa);
9730 if (action == PF_DROP || pbuf == NULL) {
9731 *pbufp = NULL;
9732 return action;
9733 }
9734 #endif /* DUMMYNET */
9735 action = pf_test_fragment(&r, dir, kif, pbuf, h,
9736 &pd, &a, &ruleset);
9737 goto done;
9738 }
9739
9740 switch (h->ip_p) {
9741 case IPPROTO_TCP: {
9742 struct tcphdr th;
9743 pd.hdr.tcp = &th;
9744 if (!pf_pull_hdr(pbuf, off, &th, sizeof(th),
9745 &action, &reason, AF_INET)) {
9746 log = action != PF_PASS;
9747 goto done;
9748 }
9749 pd.p_len = pd.tot_len - off - (th.th_off << 2);
9750 if ((th.th_flags & TH_ACK) && pd.p_len == 0) {
9751 pqid = 1;
9752 }
9753 #if DUMMYNET
9754 /* Traffic goes through dummynet first */
9755 action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa);
9756 if (action == PF_DROP || pbuf == NULL) {
9757 *pbufp = NULL;
9758 return action;
9759 }
9760 #endif /* DUMMYNET */
9761 action = pf_normalize_tcp(dir, kif, pbuf, 0, off, h, &pd);
9762 if (pd.lmw < 0) {
9763 goto done;
9764 }
9765 PF_APPLE_UPDATE_PDESC_IPv4();
9766 if (action == PF_DROP) {
9767 goto done;
9768 }
9769 action = pf_test_state_tcp(&s, dir, kif, pbuf, off, h, &pd,
9770 &reason);
9771 if (action == PF_NAT64) {
9772 goto done;
9773 }
9774 if (pd.lmw < 0) {
9775 goto done;
9776 }
9777 PF_APPLE_UPDATE_PDESC_IPv4();
9778 if (action == PF_PASS) {
9779 #if NPFSYNC
9780 pfsync_update_state(s);
9781 #endif /* NPFSYNC */
9782 r = s->rule.ptr;
9783 a = s->anchor.ptr;
9784 log = s->log;
9785 } else if (s == NULL) {
9786 action = pf_test_rule(&r, &s, dir, kif,
9787 pbuf, off, h, &pd, &a, &ruleset, NULL);
9788 }
9789 break;
9790 }
9791
9792 case IPPROTO_UDP: {
9793 struct udphdr uh;
9794
9795 pd.hdr.udp = &uh;
9796 if (!pf_pull_hdr(pbuf, off, &uh, sizeof(uh),
9797 &action, &reason, AF_INET)) {
9798 log = action != PF_PASS;
9799 goto done;
9800 }
9801 if (uh.uh_dport == 0 ||
9802 ntohs(uh.uh_ulen) > pbuf->pb_packet_len - off ||
9803 ntohs(uh.uh_ulen) < sizeof(struct udphdr)) {
9804 action = PF_DROP;
9805 REASON_SET(&reason, PFRES_SHORT);
9806 goto done;
9807 }
9808 #if DUMMYNET
9809 /* Traffic goes through dummynet first */
9810 action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa);
9811 if (action == PF_DROP || pbuf == NULL) {
9812 *pbufp = NULL;
9813 return action;
9814 }
9815 #endif /* DUMMYNET */
9816 action = pf_test_state_udp(&s, dir, kif, pbuf, off, h, &pd,
9817 &reason);
9818 if (action == PF_NAT64) {
9819 goto done;
9820 }
9821 if (pd.lmw < 0) {
9822 goto done;
9823 }
9824 PF_APPLE_UPDATE_PDESC_IPv4();
9825 if (action == PF_PASS) {
9826 #if NPFSYNC
9827 pfsync_update_state(s);
9828 #endif /* NPFSYNC */
9829 r = s->rule.ptr;
9830 a = s->anchor.ptr;
9831 log = s->log;
9832 } else if (s == NULL) {
9833 action = pf_test_rule(&r, &s, dir, kif,
9834 pbuf, off, h, &pd, &a, &ruleset, NULL);
9835 }
9836 break;
9837 }
9838
9839 case IPPROTO_ICMP: {
9840 struct icmp ih;
9841
9842 pd.hdr.icmp = &ih;
9843 if (!pf_pull_hdr(pbuf, off, &ih, ICMP_MINLEN,
9844 &action, &reason, AF_INET)) {
9845 log = action != PF_PASS;
9846 goto done;
9847 }
9848 #if DUMMYNET
9849 /* Traffic goes through dummynet first */
9850 action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa);
9851 if (action == PF_DROP || pbuf == NULL) {
9852 *pbufp = NULL;
9853 return action;
9854 }
9855 #endif /* DUMMYNET */
9856 action = pf_test_state_icmp(&s, dir, kif, pbuf, off, h, &pd,
9857 &reason);
9858 if (action == PF_NAT64) {
9859 goto done;
9860 }
9861 if (pd.lmw < 0) {
9862 goto done;
9863 }
9864 PF_APPLE_UPDATE_PDESC_IPv4();
9865 if (action == PF_PASS) {
9866 #if NPFSYNC
9867 pfsync_update_state(s);
9868 #endif /* NPFSYNC */
9869 r = s->rule.ptr;
9870 a = s->anchor.ptr;
9871 log = s->log;
9872 } else if (s == NULL) {
9873 action = pf_test_rule(&r, &s, dir, kif,
9874 pbuf, off, h, &pd, &a, &ruleset, NULL);
9875 }
9876 break;
9877 }
9878
9879 case IPPROTO_ESP: {
9880 struct pf_esp_hdr esp;
9881
9882 pd.hdr.esp = &esp;
9883 if (!pf_pull_hdr(pbuf, off, &esp, sizeof(esp), &action, &reason,
9884 AF_INET)) {
9885 log = action != PF_PASS;
9886 goto done;
9887 }
9888 #if DUMMYNET
9889 /* Traffic goes through dummynet first */
9890 action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa);
9891 if (action == PF_DROP || pbuf == NULL) {
9892 *pbufp = NULL;
9893 return action;
9894 }
9895 #endif /* DUMMYNET */
9896 action = pf_test_state_esp(&s, dir, kif, off, &pd);
9897 if (pd.lmw < 0) {
9898 goto done;
9899 }
9900 PF_APPLE_UPDATE_PDESC_IPv4();
9901 if (action == PF_PASS) {
9902 #if NPFSYNC
9903 pfsync_update_state(s);
9904 #endif /* NPFSYNC */
9905 r = s->rule.ptr;
9906 a = s->anchor.ptr;
9907 log = s->log;
9908 } else if (s == NULL) {
9909 action = pf_test_rule(&r, &s, dir, kif,
9910 pbuf, off, h, &pd, &a, &ruleset, NULL);
9911 }
9912 break;
9913 }
9914
9915 case IPPROTO_GRE: {
9916 struct pf_grev1_hdr grev1;
9917 pd.hdr.grev1 = &grev1;
9918 if (!pf_pull_hdr(pbuf, off, &grev1, sizeof(grev1), &action,
9919 &reason, AF_INET)) {
9920 log = (action != PF_PASS);
9921 goto done;
9922 }
9923 #if DUMMYNET
9924 /* Traffic goes through dummynet first */
9925 action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa);
9926 if (action == PF_DROP || pbuf == NULL) {
9927 *pbufp = NULL;
9928 return action;
9929 }
9930 #endif /* DUMMYNET */
9931 if ((ntohs(grev1.flags) & PF_GRE_FLAG_VERSION_MASK) == 1 &&
9932 ntohs(grev1.protocol_type) == PF_GRE_PPP_ETHERTYPE) {
9933 if (ntohs(grev1.payload_length) >
9934 pbuf->pb_packet_len - off) {
9935 action = PF_DROP;
9936 REASON_SET(&reason, PFRES_SHORT);
9937 goto done;
9938 }
9939 pd.proto_variant = PF_GRE_PPTP_VARIANT;
9940 action = pf_test_state_grev1(&s, dir, kif, off, &pd);
9941 if (pd.lmw < 0) {
9942 goto done;
9943 }
9944 PF_APPLE_UPDATE_PDESC_IPv4();
9945 if (action == PF_PASS) {
9946 #if NPFSYNC
9947 pfsync_update_state(s);
9948 #endif /* NPFSYNC */
9949 r = s->rule.ptr;
9950 a = s->anchor.ptr;
9951 log = s->log;
9952 break;
9953 } else if (s == NULL) {
9954 action = pf_test_rule(&r, &s, dir, kif, pbuf,
9955 off, h, &pd, &a, &ruleset, NULL);
9956 if (action == PF_PASS) {
9957 break;
9958 }
9959 }
9960 }
9961
9962 /* not GREv1/PPTP, so treat as ordinary GRE... */
9963 }
9964
9965 default:
9966 #if DUMMYNET
9967 /* Traffic goes through dummynet first */
9968 action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa);
9969 if (action == PF_DROP || pbuf == NULL) {
9970 *pbufp = NULL;
9971 return action;
9972 }
9973 #endif /* DUMMYNET */
9974 action = pf_test_state_other(&s, dir, kif, &pd);
9975 if (pd.lmw < 0) {
9976 goto done;
9977 }
9978 PF_APPLE_UPDATE_PDESC_IPv4();
9979 if (action == PF_PASS) {
9980 #if NPFSYNC
9981 pfsync_update_state(s);
9982 #endif /* NPFSYNC */
9983 r = s->rule.ptr;
9984 a = s->anchor.ptr;
9985 log = s->log;
9986 } else if (s == NULL) {
9987 action = pf_test_rule(&r, &s, dir, kif, pbuf, off, h,
9988 &pd, &a, &ruleset, NULL);
9989 }
9990 break;
9991 }
9992
9993 done:
9994 if (action == PF_NAT64) {
9995 *pbufp = NULL;
9996 return action;
9997 }
9998
9999 *pbufp = pd.mp;
10000 PF_APPLE_UPDATE_PDESC_IPv4();
10001
10002 if (action != PF_DROP) {
10003 if (action == PF_PASS && h->ip_hl > 5 &&
10004 !((s && s->allow_opts) || r->allow_opts)) {
10005 action = PF_DROP;
10006 REASON_SET(&reason, PFRES_IPOPTIONS);
10007 log = 1;
10008 DPFPRINTF(PF_DEBUG_MISC,
10009 ("pf: dropping packet with ip options [hlen=%u]\n",
10010 (unsigned int) h->ip_hl));
10011 }
10012
10013 if ((s && s->tag) || PF_RTABLEID_IS_VALID(r->rtableid) ||
10014 (pd.pktflags & PKTF_FLOW_ID)) {
10015 (void) pf_tag_packet(pbuf, pd.pf_mtag, s ? s->tag : 0,
10016 r->rtableid, &pd);
10017 }
10018
10019 if (action == PF_PASS) {
10020 #if PF_ECN
10021 /* add hints for ecn */
10022 pd.pf_mtag->pftag_hdr = h;
10023 /* record address family */
10024 pd.pf_mtag->pftag_flags &= ~PF_TAG_HDR_INET6;
10025 pd.pf_mtag->pftag_flags |= PF_TAG_HDR_INET;
10026 #endif /* PF_ECN */
10027 /* record protocol */
10028 *pbuf->pb_proto = pd.proto;
10029
10030 /*
10031 * connections redirected to loopback should not match sockets
10032 * bound specifically to loopback due to security implications,
10033 * see tcp_input() and in_pcblookup_listen().
10034 */
10035 if (dir == PF_IN && (pd.proto == IPPROTO_TCP ||
10036 pd.proto == IPPROTO_UDP) && s != NULL &&
10037 s->nat_rule.ptr != NULL &&
10038 (s->nat_rule.ptr->action == PF_RDR ||
10039 s->nat_rule.ptr->action == PF_BINAT) &&
10040 (ntohl(pd.dst->v4addr.s_addr) >> IN_CLASSA_NSHIFT)
10041 == IN_LOOPBACKNET) {
10042 pd.pf_mtag->pftag_flags |= PF_TAG_TRANSLATE_LOCALHOST;
10043 }
10044 }
10045 }
10046
10047 if (log) {
10048 struct pf_rule *lr;
10049
10050 if (s != NULL && s->nat_rule.ptr != NULL &&
10051 s->nat_rule.ptr->log & PF_LOG_ALL) {
10052 lr = s->nat_rule.ptr;
10053 } else {
10054 lr = r;
10055 }
10056 PFLOG_PACKET(kif, h, pbuf, AF_INET, dir, reason, lr, a, ruleset,
10057 &pd);
10058 }
10059
10060 kif->pfik_bytes[0][dir == PF_OUT][action != PF_PASS] += pd.tot_len;
10061 kif->pfik_packets[0][dir == PF_OUT][action != PF_PASS]++;
10062
10063 if (action == PF_PASS || r->action == PF_DROP) {
10064 dirndx = (dir == PF_OUT);
10065 r->packets[dirndx]++;
10066 r->bytes[dirndx] += pd.tot_len;
10067 if (a != NULL) {
10068 a->packets[dirndx]++;
10069 a->bytes[dirndx] += pd.tot_len;
10070 }
10071 if (s != NULL) {
10072 sk = s->state_key;
10073 if (s->nat_rule.ptr != NULL) {
10074 s->nat_rule.ptr->packets[dirndx]++;
10075 s->nat_rule.ptr->bytes[dirndx] += pd.tot_len;
10076 }
10077 if (s->src_node != NULL) {
10078 s->src_node->packets[dirndx]++;
10079 s->src_node->bytes[dirndx] += pd.tot_len;
10080 }
10081 if (s->nat_src_node != NULL) {
10082 s->nat_src_node->packets[dirndx]++;
10083 s->nat_src_node->bytes[dirndx] += pd.tot_len;
10084 }
10085 dirndx = (dir == sk->direction) ? 0 : 1;
10086 s->packets[dirndx]++;
10087 s->bytes[dirndx] += pd.tot_len;
10088 }
10089 tr = r;
10090 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule;
10091 if (nr != NULL) {
10092 struct pf_addr *x;
10093 /*
10094 * XXX: we need to make sure that the addresses
10095 * passed to pfr_update_stats() are the same than
10096 * the addresses used during matching (pfr_match)
10097 */
10098 if (r == &pf_default_rule) {
10099 tr = nr;
10100 x = (sk == NULL || sk->direction == dir) ?
10101 &pd.baddr : &pd.naddr;
10102 } else {
10103 x = (sk == NULL || sk->direction == dir) ?
10104 &pd.naddr : &pd.baddr;
10105 }
10106 if (x == &pd.baddr || s == NULL) {
10107 /* we need to change the address */
10108 if (dir == PF_OUT) {
10109 pd.src = x;
10110 } else {
10111 pd.dst = x;
10112 }
10113 }
10114 }
10115 if (tr->src.addr.type == PF_ADDR_TABLE) {
10116 pfr_update_stats(tr->src.addr.p.tbl, (sk == NULL ||
10117 sk->direction == dir) ?
10118 pd.src : pd.dst, pd.af,
10119 pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
10120 tr->src.neg);
10121 }
10122 if (tr->dst.addr.type == PF_ADDR_TABLE) {
10123 pfr_update_stats(tr->dst.addr.p.tbl, (sk == NULL ||
10124 sk->direction == dir) ? pd.dst : pd.src, pd.af,
10125 pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
10126 tr->dst.neg);
10127 }
10128 }
10129
10130 VERIFY(pbuf == NULL || pd.mp == NULL || pd.mp == pbuf);
10131
10132 if (*pbufp) {
10133 if (pd.lmw < 0) {
10134 REASON_SET(&reason, PFRES_MEMORY);
10135 action = PF_DROP;
10136 }
10137
10138 if (action == PF_DROP) {
10139 pbuf_destroy(*pbufp);
10140 *pbufp = NULL;
10141 return PF_DROP;
10142 }
10143
10144 *pbufp = pbuf;
10145 }
10146
10147 if (action == PF_SYNPROXY_DROP) {
10148 pbuf_destroy(*pbufp);
10149 *pbufp = NULL;
10150 action = PF_PASS;
10151 } else if (r->rt) {
10152 /* pf_route can free the pbuf causing *pbufp to become NULL */
10153 pf_route(pbufp, r, dir, kif->pfik_ifp, s, &pd);
10154 }
10155
10156 return action;
10157 }
10158 #endif /* INET */
10159
10160 #if INET6
10161 #define PF_APPLE_UPDATE_PDESC_IPv6() \
10162 do { \
10163 if (pbuf && pd.mp && pbuf != pd.mp) { \
10164 pbuf = pd.mp; \
10165 } \
10166 h = pbuf->pb_data; \
10167 } while (0)
10168
10169 int
10170 pf_test6_mbuf(int dir, struct ifnet *ifp, struct mbuf **m0,
10171 struct ether_header *eh, struct ip_fw_args *fwa)
10172 {
10173 pbuf_t pbuf_store, *pbuf;
10174 int rv;
10175
10176 pbuf_init_mbuf(&pbuf_store, *m0, (*m0)->m_pkthdr.rcvif);
10177 pbuf = &pbuf_store;
10178
10179 rv = pf_test6(dir, ifp, &pbuf, eh, fwa);
10180
10181 if (pbuf_is_valid(pbuf)) {
10182 *m0 = pbuf->pb_mbuf;
10183 pbuf->pb_mbuf = NULL;
10184 pbuf_destroy(pbuf);
10185 } else {
10186 *m0 = NULL;
10187 }
10188
10189 return rv;
10190 }
10191
10192 int
10193 pf_test6(int dir, struct ifnet *ifp, pbuf_t **pbufp,
10194 struct ether_header *eh, struct ip_fw_args *fwa)
10195 {
10196 #if !DUMMYNET
10197 #pragma unused(fwa)
10198 #endif
10199 struct pfi_kif *kif;
10200 u_short action = PF_PASS, reason = 0, log = 0;
10201 pbuf_t *pbuf = *pbufp;
10202 struct ip6_hdr *h;
10203 struct pf_rule *a = NULL, *r = &pf_default_rule, *tr, *nr;
10204 struct pf_state *s = NULL;
10205 struct pf_state_key *sk = NULL;
10206 struct pf_ruleset *ruleset = NULL;
10207 struct pf_pdesc pd;
10208 int off, terminal = 0, dirndx, rh_cnt = 0;
10209 u_int8_t nxt;
10210 boolean_t fwd = FALSE;
10211
10212 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
10213
10214 ASSERT(ifp != NULL);
10215 if ((dir == PF_OUT) && (pbuf->pb_ifp) && (ifp != pbuf->pb_ifp)) {
10216 fwd = TRUE;
10217 }
10218
10219 if (!pf_status.running) {
10220 return PF_PASS;
10221 }
10222
10223 memset(&pd, 0, sizeof(pd));
10224
10225 if ((pd.pf_mtag = pf_get_mtag_pbuf(pbuf)) == NULL) {
10226 DPFPRINTF(PF_DEBUG_URGENT,
10227 ("pf_test6: pf_get_mtag_pbuf returned NULL\n"));
10228 return PF_DROP;
10229 }
10230
10231 if (pd.pf_mtag->pftag_flags & PF_TAG_GENERATED) {
10232 return PF_PASS;
10233 }
10234
10235 kif = (struct pfi_kif *)ifp->if_pf_kif;
10236
10237 if (kif == NULL) {
10238 DPFPRINTF(PF_DEBUG_URGENT,
10239 ("pf_test6: kif == NULL, if_name %s\n", ifp->if_name));
10240 return PF_DROP;
10241 }
10242 if (kif->pfik_flags & PFI_IFLAG_SKIP) {
10243 return PF_PASS;
10244 }
10245
10246 if (pbuf->pb_packet_len < (int)sizeof(*h)) {
10247 REASON_SET(&reason, PFRES_SHORT);
10248 return PF_DROP;
10249 }
10250
10251 h = pbuf->pb_data;
10252 nxt = h->ip6_nxt;
10253 off = ((caddr_t)h - (caddr_t)pbuf->pb_data) + sizeof(struct ip6_hdr);
10254 pd.mp = pbuf;
10255 pd.lmw = 0;
10256 pd.pf_mtag = pf_get_mtag_pbuf(pbuf);
10257 pd.src = (struct pf_addr *)(uintptr_t)&h->ip6_src;
10258 pd.dst = (struct pf_addr *)(uintptr_t)&h->ip6_dst;
10259 PF_ACPY(&pd.baddr, pd.src, AF_INET6);
10260 PF_ACPY(&pd.bdaddr, pd.dst, AF_INET6);
10261 pd.ip_sum = NULL;
10262 pd.af = AF_INET6;
10263 pd.proto = nxt;
10264 pd.proto_variant = 0;
10265 pd.tos = 0;
10266 pd.ttl = h->ip6_hlim;
10267 pd.sc = MBUF_SCIDX(pbuf_get_service_class(pbuf));
10268 pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
10269 pd.eh = eh;
10270
10271 if (*pbuf->pb_flags & PKTF_FLOW_ID) {
10272 pd.flowsrc = *pbuf->pb_flowsrc;
10273 pd.flowhash = *pbuf->pb_flowid;
10274 pd.pktflags = (*pbuf->pb_flags & PKTF_FLOW_MASK);
10275 }
10276
10277 #if DUMMYNET
10278 if (fwa != NULL && fwa->fwa_pf_rule != NULL) {
10279 goto nonormalize;
10280 }
10281 #endif /* DUMMYNET */
10282
10283 /* We do IP header normalization and packet reassembly here */
10284 action = pf_normalize_ip6(pbuf, dir, kif, &reason, &pd);
10285 if (action != PF_PASS || pd.lmw < 0) {
10286 action = PF_DROP;
10287 goto done;
10288 }
10289
10290 #if DUMMYNET
10291 nonormalize:
10292 #endif /* DUMMYNET */
10293 h = pbuf->pb_data;
10294
10295 #if 1
10296 /*
10297 * we do not support jumbogram yet. if we keep going, zero ip6_plen
10298 * will do something bad, so drop the packet for now.
10299 */
10300 if (htons(h->ip6_plen) == 0) {
10301 action = PF_DROP;
10302 REASON_SET(&reason, PFRES_NORM); /*XXX*/
10303 goto done;
10304 }
10305 #endif
10306 pd.src = (struct pf_addr *)(uintptr_t)&h->ip6_src;
10307 pd.dst = (struct pf_addr *)(uintptr_t)&h->ip6_dst;
10308 PF_ACPY(&pd.baddr, pd.src, AF_INET6);
10309 PF_ACPY(&pd.bdaddr, pd.dst, AF_INET6);
10310 pd.ip_sum = NULL;
10311 pd.af = AF_INET6;
10312 pd.tos = 0;
10313 pd.ttl = h->ip6_hlim;
10314 pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
10315 pd.eh = eh;
10316
10317 off = ((caddr_t)h - (caddr_t)pbuf->pb_data) + sizeof(struct ip6_hdr);
10318 pd.proto = h->ip6_nxt;
10319 pd.proto_variant = 0;
10320 pd.mp = pbuf;
10321 pd.lmw = 0;
10322 pd.pf_mtag = pf_get_mtag_pbuf(pbuf);
10323
10324 do {
10325 switch (pd.proto) {
10326 case IPPROTO_FRAGMENT: {
10327 struct ip6_frag ip6f;
10328
10329 pd.flags |= PFDESC_IP_FRAG;
10330 if (!pf_pull_hdr(pbuf, off, &ip6f, sizeof ip6f, NULL,
10331 &reason, pd.af)) {
10332 DPFPRINTF(PF_DEBUG_MISC,
10333 ("pf: IPv6 short fragment header\n"));
10334 action = PF_DROP;
10335 REASON_SET(&reason, PFRES_SHORT);
10336 log = 1;
10337 goto done;
10338 }
10339 pd.proto = ip6f.ip6f_nxt;
10340 #if DUMMYNET
10341 /* Traffic goes through dummynet first */
10342 action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd,
10343 fwa);
10344 if (action == PF_DROP || pbuf == NULL) {
10345 *pbufp = NULL;
10346 return action;
10347 }
10348 #endif /* DUMMYNET */
10349 action = pf_test_fragment(&r, dir, kif, pbuf, h, &pd,
10350 &a, &ruleset);
10351 if (action == PF_DROP) {
10352 REASON_SET(&reason, PFRES_FRAG);
10353 log = 1;
10354 }
10355 goto done;
10356 }
10357 case IPPROTO_ROUTING:
10358 ++rh_cnt;
10359 /* FALL THROUGH */
10360
10361 case IPPROTO_AH:
10362 case IPPROTO_HOPOPTS:
10363 case IPPROTO_DSTOPTS: {
10364 /* get next header and header length */
10365 struct ip6_ext opt6;
10366
10367 if (!pf_pull_hdr(pbuf, off, &opt6, sizeof(opt6),
10368 NULL, &reason, pd.af)) {
10369 DPFPRINTF(PF_DEBUG_MISC,
10370 ("pf: IPv6 short opt\n"));
10371 action = PF_DROP;
10372 log = 1;
10373 goto done;
10374 }
10375 if (pd.proto == IPPROTO_AH) {
10376 off += (opt6.ip6e_len + 2) * 4;
10377 } else {
10378 off += (opt6.ip6e_len + 1) * 8;
10379 }
10380 pd.proto = opt6.ip6e_nxt;
10381 /* goto the next header */
10382 break;
10383 }
10384 default:
10385 terminal++;
10386 break;
10387 }
10388 } while (!terminal);
10389
10390
10391 switch (pd.proto) {
10392 case IPPROTO_TCP: {
10393 struct tcphdr th;
10394
10395 pd.hdr.tcp = &th;
10396 if (!pf_pull_hdr(pbuf, off, &th, sizeof(th),
10397 &action, &reason, AF_INET6)) {
10398 log = action != PF_PASS;
10399 goto done;
10400 }
10401 pd.p_len = pd.tot_len - off - (th.th_off << 2);
10402 #if DUMMYNET
10403 /* Traffic goes through dummynet first */
10404 action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa);
10405 if (action == PF_DROP || pbuf == NULL) {
10406 *pbufp = NULL;
10407 return action;
10408 }
10409 #endif /* DUMMYNET */
10410 action = pf_normalize_tcp(dir, kif, pbuf, 0, off, h, &pd);
10411 if (pd.lmw < 0) {
10412 goto done;
10413 }
10414 PF_APPLE_UPDATE_PDESC_IPv6();
10415 if (action == PF_DROP) {
10416 goto done;
10417 }
10418 action = pf_test_state_tcp(&s, dir, kif, pbuf, off, h, &pd,
10419 &reason);
10420 if (action == PF_NAT64) {
10421 goto done;
10422 }
10423 if (pd.lmw < 0) {
10424 goto done;
10425 }
10426 PF_APPLE_UPDATE_PDESC_IPv6();
10427 if (action == PF_PASS) {
10428 #if NPFSYNC
10429 pfsync_update_state(s);
10430 #endif /* NPFSYNC */
10431 r = s->rule.ptr;
10432 a = s->anchor.ptr;
10433 log = s->log;
10434 } else if (s == NULL) {
10435 action = pf_test_rule(&r, &s, dir, kif,
10436 pbuf, off, h, &pd, &a, &ruleset, NULL);
10437 }
10438 break;
10439 }
10440
10441 case IPPROTO_UDP: {
10442 struct udphdr uh;
10443
10444 pd.hdr.udp = &uh;
10445 if (!pf_pull_hdr(pbuf, off, &uh, sizeof(uh),
10446 &action, &reason, AF_INET6)) {
10447 log = action != PF_PASS;
10448 goto done;
10449 }
10450 if (uh.uh_dport == 0 ||
10451 ntohs(uh.uh_ulen) > pbuf->pb_packet_len - off ||
10452 ntohs(uh.uh_ulen) < sizeof(struct udphdr)) {
10453 action = PF_DROP;
10454 REASON_SET(&reason, PFRES_SHORT);
10455 goto done;
10456 }
10457 #if DUMMYNET
10458 /* Traffic goes through dummynet first */
10459 action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa);
10460 if (action == PF_DROP || pbuf == NULL) {
10461 *pbufp = NULL;
10462 return action;
10463 }
10464 #endif /* DUMMYNET */
10465 action = pf_test_state_udp(&s, dir, kif, pbuf, off, h, &pd,
10466 &reason);
10467 if (action == PF_NAT64) {
10468 goto done;
10469 }
10470 if (pd.lmw < 0) {
10471 goto done;
10472 }
10473 PF_APPLE_UPDATE_PDESC_IPv6();
10474 if (action == PF_PASS) {
10475 #if NPFSYNC
10476 pfsync_update_state(s);
10477 #endif /* NPFSYNC */
10478 r = s->rule.ptr;
10479 a = s->anchor.ptr;
10480 log = s->log;
10481 } else if (s == NULL) {
10482 action = pf_test_rule(&r, &s, dir, kif,
10483 pbuf, off, h, &pd, &a, &ruleset, NULL);
10484 }
10485 break;
10486 }
10487
10488 case IPPROTO_ICMPV6: {
10489 struct icmp6_hdr ih;
10490
10491 pd.hdr.icmp6 = &ih;
10492 if (!pf_pull_hdr(pbuf, off, &ih, sizeof(ih),
10493 &action, &reason, AF_INET6)) {
10494 log = action != PF_PASS;
10495 goto done;
10496 }
10497 #if DUMMYNET
10498 /* Traffic goes through dummynet first */
10499 action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa);
10500 if (action == PF_DROP || pbuf == NULL) {
10501 *pbufp = NULL;
10502 return action;
10503 }
10504 #endif /* DUMMYNET */
10505 action = pf_test_state_icmp(&s, dir, kif,
10506 pbuf, off, h, &pd, &reason);
10507 if (action == PF_NAT64) {
10508 goto done;
10509 }
10510 if (pd.lmw < 0) {
10511 goto done;
10512 }
10513 PF_APPLE_UPDATE_PDESC_IPv6();
10514 if (action == PF_PASS) {
10515 #if NPFSYNC
10516 pfsync_update_state(s);
10517 #endif /* NPFSYNC */
10518 r = s->rule.ptr;
10519 a = s->anchor.ptr;
10520 log = s->log;
10521 } else if (s == NULL) {
10522 action = pf_test_rule(&r, &s, dir, kif,
10523 pbuf, off, h, &pd, &a, &ruleset, NULL);
10524 }
10525 break;
10526 }
10527
10528 case IPPROTO_ESP: {
10529 struct pf_esp_hdr esp;
10530
10531 pd.hdr.esp = &esp;
10532 if (!pf_pull_hdr(pbuf, off, &esp, sizeof(esp), &action,
10533 &reason, AF_INET6)) {
10534 log = action != PF_PASS;
10535 goto done;
10536 }
10537 #if DUMMYNET
10538 /* Traffic goes through dummynet first */
10539 action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa);
10540 if (action == PF_DROP || pbuf == NULL) {
10541 *pbufp = NULL;
10542 return action;
10543 }
10544 #endif /* DUMMYNET */
10545 action = pf_test_state_esp(&s, dir, kif, off, &pd);
10546 if (pd.lmw < 0) {
10547 goto done;
10548 }
10549 PF_APPLE_UPDATE_PDESC_IPv6();
10550 if (action == PF_PASS) {
10551 #if NPFSYNC
10552 pfsync_update_state(s);
10553 #endif /* NPFSYNC */
10554 r = s->rule.ptr;
10555 a = s->anchor.ptr;
10556 log = s->log;
10557 } else if (s == NULL) {
10558 action = pf_test_rule(&r, &s, dir, kif,
10559 pbuf, off, h, &pd, &a, &ruleset, NULL);
10560 }
10561 break;
10562 }
10563
10564 case IPPROTO_GRE: {
10565 struct pf_grev1_hdr grev1;
10566
10567 pd.hdr.grev1 = &grev1;
10568 if (!pf_pull_hdr(pbuf, off, &grev1, sizeof(grev1), &action,
10569 &reason, AF_INET6)) {
10570 log = (action != PF_PASS);
10571 goto done;
10572 }
10573 #if DUMMYNET
10574 /* Traffic goes through dummynet first */
10575 action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa);
10576 if (action == PF_DROP || pbuf == NULL) {
10577 *pbufp = NULL;
10578 return action;
10579 }
10580 #endif /* DUMMYNET */
10581 if ((ntohs(grev1.flags) & PF_GRE_FLAG_VERSION_MASK) == 1 &&
10582 ntohs(grev1.protocol_type) == PF_GRE_PPP_ETHERTYPE) {
10583 if (ntohs(grev1.payload_length) >
10584 pbuf->pb_packet_len - off) {
10585 action = PF_DROP;
10586 REASON_SET(&reason, PFRES_SHORT);
10587 goto done;
10588 }
10589 action = pf_test_state_grev1(&s, dir, kif, off, &pd);
10590 if (pd.lmw < 0) {
10591 goto done;
10592 }
10593 PF_APPLE_UPDATE_PDESC_IPv6();
10594 if (action == PF_PASS) {
10595 #if NPFSYNC
10596 pfsync_update_state(s);
10597 #endif /* NPFSYNC */
10598 r = s->rule.ptr;
10599 a = s->anchor.ptr;
10600 log = s->log;
10601 break;
10602 } else if (s == NULL) {
10603 action = pf_test_rule(&r, &s, dir, kif, pbuf,
10604 off, h, &pd, &a, &ruleset, NULL);
10605 if (action == PF_PASS) {
10606 break;
10607 }
10608 }
10609 }
10610
10611 /* not GREv1/PPTP, so treat as ordinary GRE... */
10612 }
10613
10614 default:
10615 #if DUMMYNET
10616 /* Traffic goes through dummynet first */
10617 action = pf_test_dummynet(&r, dir, kif, &pbuf, &pd, fwa);
10618 if (action == PF_DROP || pbuf == NULL) {
10619 *pbufp = NULL;
10620 return action;
10621 }
10622 #endif /* DUMMYNET */
10623 action = pf_test_state_other(&s, dir, kif, &pd);
10624 if (pd.lmw < 0) {
10625 goto done;
10626 }
10627 PF_APPLE_UPDATE_PDESC_IPv6();
10628 if (action == PF_PASS) {
10629 #if NPFSYNC
10630 pfsync_update_state(s);
10631 #endif /* NPFSYNC */
10632 r = s->rule.ptr;
10633 a = s->anchor.ptr;
10634 log = s->log;
10635 } else if (s == NULL) {
10636 action = pf_test_rule(&r, &s, dir, kif, pbuf, off, h,
10637 &pd, &a, &ruleset, NULL);
10638 }
10639 break;
10640 }
10641
10642 done:
10643 if (action == PF_NAT64) {
10644 *pbufp = NULL;
10645 return action;
10646 }
10647
10648 *pbufp = pd.mp;
10649 PF_APPLE_UPDATE_PDESC_IPv6();
10650
10651 /* handle dangerous IPv6 extension headers. */
10652 if (action != PF_DROP) {
10653 if (action == PF_PASS && rh_cnt &&
10654 !((s && s->allow_opts) || r->allow_opts)) {
10655 action = PF_DROP;
10656 REASON_SET(&reason, PFRES_IPOPTIONS);
10657 log = 1;
10658 DPFPRINTF(PF_DEBUG_MISC,
10659 ("pf: dropping packet with dangerous v6addr headers\n"));
10660 }
10661
10662 if ((s && s->tag) || PF_RTABLEID_IS_VALID(r->rtableid) ||
10663 (pd.pktflags & PKTF_FLOW_ID)) {
10664 (void) pf_tag_packet(pbuf, pd.pf_mtag, s ? s->tag : 0,
10665 r->rtableid, &pd);
10666 }
10667
10668 if (action == PF_PASS) {
10669 #if PF_ECN
10670 /* add hints for ecn */
10671 pd.pf_mtag->pftag_hdr = h;
10672 /* record address family */
10673 pd.pf_mtag->pftag_flags &= ~PF_TAG_HDR_INET;
10674 pd.pf_mtag->pftag_flags |= PF_TAG_HDR_INET6;
10675 #endif /* PF_ECN */
10676 /* record protocol */
10677 *pbuf->pb_proto = pd.proto;
10678 if (dir == PF_IN && (pd.proto == IPPROTO_TCP ||
10679 pd.proto == IPPROTO_UDP) && s != NULL &&
10680 s->nat_rule.ptr != NULL &&
10681 (s->nat_rule.ptr->action == PF_RDR ||
10682 s->nat_rule.ptr->action == PF_BINAT) &&
10683 IN6_IS_ADDR_LOOPBACK(&pd.dst->v6addr)) {
10684 pd.pf_mtag->pftag_flags |= PF_TAG_TRANSLATE_LOCALHOST;
10685 }
10686 }
10687 }
10688
10689
10690 if (log) {
10691 struct pf_rule *lr;
10692
10693 if (s != NULL && s->nat_rule.ptr != NULL &&
10694 s->nat_rule.ptr->log & PF_LOG_ALL) {
10695 lr = s->nat_rule.ptr;
10696 } else {
10697 lr = r;
10698 }
10699 PFLOG_PACKET(kif, h, pbuf, AF_INET6, dir, reason, lr, a, ruleset,
10700 &pd);
10701 }
10702
10703 kif->pfik_bytes[1][dir == PF_OUT][action != PF_PASS] += pd.tot_len;
10704 kif->pfik_packets[1][dir == PF_OUT][action != PF_PASS]++;
10705
10706 if (action == PF_PASS || r->action == PF_DROP) {
10707 dirndx = (dir == PF_OUT);
10708 r->packets[dirndx]++;
10709 r->bytes[dirndx] += pd.tot_len;
10710 if (a != NULL) {
10711 a->packets[dirndx]++;
10712 a->bytes[dirndx] += pd.tot_len;
10713 }
10714 if (s != NULL) {
10715 sk = s->state_key;
10716 if (s->nat_rule.ptr != NULL) {
10717 s->nat_rule.ptr->packets[dirndx]++;
10718 s->nat_rule.ptr->bytes[dirndx] += pd.tot_len;
10719 }
10720 if (s->src_node != NULL) {
10721 s->src_node->packets[dirndx]++;
10722 s->src_node->bytes[dirndx] += pd.tot_len;
10723 }
10724 if (s->nat_src_node != NULL) {
10725 s->nat_src_node->packets[dirndx]++;
10726 s->nat_src_node->bytes[dirndx] += pd.tot_len;
10727 }
10728 dirndx = (dir == sk->direction) ? 0 : 1;
10729 s->packets[dirndx]++;
10730 s->bytes[dirndx] += pd.tot_len;
10731 }
10732 tr = r;
10733 nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule;
10734 if (nr != NULL) {
10735 struct pf_addr *x;
10736 /*
10737 * XXX: we need to make sure that the addresses
10738 * passed to pfr_update_stats() are the same than
10739 * the addresses used during matching (pfr_match)
10740 */
10741 if (r == &pf_default_rule) {
10742 tr = nr;
10743 x = (s == NULL || sk->direction == dir) ?
10744 &pd.baddr : &pd.naddr;
10745 } else {
10746 x = (s == NULL || sk->direction == dir) ?
10747 &pd.naddr : &pd.baddr;
10748 }
10749 if (x == &pd.baddr || s == NULL) {
10750 if (dir == PF_OUT) {
10751 pd.src = x;
10752 } else {
10753 pd.dst = x;
10754 }
10755 }
10756 }
10757 if (tr->src.addr.type == PF_ADDR_TABLE) {
10758 pfr_update_stats(tr->src.addr.p.tbl, (sk == NULL ||
10759 sk->direction == dir) ? pd.src : pd.dst, pd.af,
10760 pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
10761 tr->src.neg);
10762 }
10763 if (tr->dst.addr.type == PF_ADDR_TABLE) {
10764 pfr_update_stats(tr->dst.addr.p.tbl, (sk == NULL ||
10765 sk->direction == dir) ? pd.dst : pd.src, pd.af,
10766 pd.tot_len, dir == PF_OUT, r->action == PF_PASS,
10767 tr->dst.neg);
10768 }
10769 }
10770
10771 #if 0
10772 if (action == PF_SYNPROXY_DROP) {
10773 m_freem(*m0);
10774 *m0 = NULL;
10775 action = PF_PASS;
10776 } else if (r->rt) {
10777 /* pf_route6 can free the mbuf causing *m0 to become NULL */
10778 pf_route6(m0, r, dir, kif->pfik_ifp, s, &pd);
10779 }
10780 #else
10781 VERIFY(pbuf == NULL || pd.mp == NULL || pd.mp == pbuf);
10782
10783 if (*pbufp) {
10784 if (pd.lmw < 0) {
10785 REASON_SET(&reason, PFRES_MEMORY);
10786 action = PF_DROP;
10787 }
10788
10789 if (action == PF_DROP) {
10790 pbuf_destroy(*pbufp);
10791 *pbufp = NULL;
10792 return PF_DROP;
10793 }
10794
10795 *pbufp = pbuf;
10796 }
10797
10798 if (action == PF_SYNPROXY_DROP) {
10799 pbuf_destroy(*pbufp);
10800 *pbufp = NULL;
10801 action = PF_PASS;
10802 } else if (r->rt) {
10803 /* pf_route6 can free the mbuf causing *pbufp to become NULL */
10804 pf_route6(pbufp, r, dir, kif->pfik_ifp, s, &pd);
10805 }
10806 #endif /* 0 */
10807
10808 /* if reassembled packet passed, create new fragments */
10809 struct pf_fragment_tag *ftag = NULL;
10810 if ((action == PF_PASS) && (*pbufp != NULL) && (fwd) &&
10811 ((ftag = pf_find_fragment_tag_pbuf(*pbufp)) != NULL)) {
10812 action = pf_refragment6(ifp, pbufp, ftag);
10813 }
10814 return action;
10815 }
10816 #endif /* INET6 */
10817
10818 static int
10819 pf_check_congestion(struct ifqueue *ifq)
10820 {
10821 #pragma unused(ifq)
10822 return 0;
10823 }
10824
10825 void
10826 pool_init(struct pool *pp, size_t size, unsigned int align, unsigned int ioff,
10827 int flags, const char *wchan, void *palloc)
10828 {
10829 #pragma unused(align, ioff, flags, palloc)
10830 bzero(pp, sizeof(*pp));
10831 pp->pool_zone = zinit(size, 1024 * size, PAGE_SIZE, wchan);
10832 if (pp->pool_zone != NULL) {
10833 zone_change(pp->pool_zone, Z_EXPAND, TRUE);
10834 zone_change(pp->pool_zone, Z_CALLERACCT, FALSE);
10835 pp->pool_hiwat = pp->pool_limit = (unsigned int)-1;
10836 pp->pool_name = wchan;
10837 }
10838 }
10839
10840 /* Zones cannot be currently destroyed */
10841 void
10842 pool_destroy(struct pool *pp)
10843 {
10844 #pragma unused(pp)
10845 }
10846
10847 void
10848 pool_sethiwat(struct pool *pp, int n)
10849 {
10850 pp->pool_hiwat = n; /* Currently unused */
10851 }
10852
10853 void
10854 pool_sethardlimit(struct pool *pp, int n, const char *warnmess, int ratecap)
10855 {
10856 #pragma unused(warnmess, ratecap)
10857 pp->pool_limit = n;
10858 }
10859
10860 void *
10861 pool_get(struct pool *pp, int flags)
10862 {
10863 void *buf;
10864
10865 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
10866
10867 if (pp->pool_count > pp->pool_limit) {
10868 DPFPRINTF(PF_DEBUG_NOISY,
10869 ("pf: pool %s hard limit reached (%d)\n",
10870 pp->pool_name != NULL ? pp->pool_name : "unknown",
10871 pp->pool_limit));
10872 pp->pool_fails++;
10873 return NULL;
10874 }
10875
10876 buf = zalloc_canblock(pp->pool_zone, (flags & (PR_NOWAIT | PR_WAITOK)));
10877 if (buf != NULL) {
10878 pp->pool_count++;
10879 VERIFY(pp->pool_count != 0);
10880 }
10881 return buf;
10882 }
10883
10884 void
10885 pool_put(struct pool *pp, void *v)
10886 {
10887 LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED);
10888
10889 zfree(pp->pool_zone, v);
10890 VERIFY(pp->pool_count != 0);
10891 pp->pool_count--;
10892 }
10893
10894 struct pf_mtag *
10895 pf_find_mtag_pbuf(pbuf_t *pbuf)
10896 {
10897 return pbuf->pb_pftag;
10898 }
10899
10900 struct pf_mtag *
10901 pf_find_mtag(struct mbuf *m)
10902 {
10903 return m_pftag(m);
10904 }
10905
10906 struct pf_mtag *
10907 pf_get_mtag(struct mbuf *m)
10908 {
10909 return pf_find_mtag(m);
10910 }
10911
10912 struct pf_mtag *
10913 pf_get_mtag_pbuf(pbuf_t *pbuf)
10914 {
10915 return pf_find_mtag_pbuf(pbuf);
10916 }
10917
10918 struct pf_fragment_tag *
10919 pf_copy_fragment_tag(struct mbuf *m, struct pf_fragment_tag *ftag, int how)
10920 {
10921 struct m_tag *tag;
10922 struct pf_mtag *pftag = pf_find_mtag(m);
10923
10924 tag = m_tag_create(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_PF_REASS,
10925 sizeof(*ftag), how, m);
10926 if (tag == NULL) {
10927 return NULL;
10928 } else {
10929 m_tag_prepend(m, tag);
10930 tag = tag + 1;
10931 }
10932 bcopy(ftag, tag, sizeof(*ftag));
10933 pftag->pftag_flags |= PF_TAG_REASSEMBLED;
10934 return (struct pf_fragment_tag *)tag;
10935 }
10936
10937 struct pf_fragment_tag *
10938 pf_find_fragment_tag(struct mbuf *m)
10939 {
10940 struct m_tag *tag;
10941 struct pf_fragment_tag *ftag;
10942 struct pf_mtag *pftag = pf_find_mtag(m);
10943
10944 tag = m_tag_locate(m, KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_PF_REASS,
10945 NULL);
10946 VERIFY((tag == NULL) || (pftag->pftag_flags & PF_TAG_REASSEMBLED));
10947 if (tag != NULL) {
10948 tag = tag + 1;
10949 }
10950 ftag = (struct pf_fragment_tag *)tag;
10951 return ftag;
10952 }
10953
10954 struct pf_fragment_tag *
10955 pf_find_fragment_tag_pbuf(pbuf_t *pbuf)
10956 {
10957 struct pf_mtag *mtag = pf_find_mtag_pbuf(pbuf);
10958
10959 return (mtag->pftag_flags & PF_TAG_REASSEMBLED) ?
10960 pbuf->pb_pf_fragtag : NULL;
10961 }
10962
10963 uint64_t
10964 pf_time_second(void)
10965 {
10966 struct timeval t;
10967
10968 microuptime(&t);
10969 return t.tv_sec;
10970 }
10971
10972 uint64_t
10973 pf_calendar_time_second(void)
10974 {
10975 struct timeval t;
10976
10977 getmicrotime(&t);
10978 return t.tv_sec;
10979 }
10980
10981 static void *
10982 hook_establish(struct hook_desc_head *head, int tail, hook_fn_t fn, void *arg)
10983 {
10984 struct hook_desc *hd;
10985
10986 hd = _MALLOC(sizeof(*hd), M_DEVBUF, M_WAITOK);
10987 if (hd == NULL) {
10988 return NULL;
10989 }
10990
10991 hd->hd_fn = fn;
10992 hd->hd_arg = arg;
10993 if (tail) {
10994 TAILQ_INSERT_TAIL(head, hd, hd_list);
10995 } else {
10996 TAILQ_INSERT_HEAD(head, hd, hd_list);
10997 }
10998
10999 return hd;
11000 }
11001
11002 static void
11003 hook_runloop(struct hook_desc_head *head, int flags)
11004 {
11005 struct hook_desc *hd;
11006
11007 if (!(flags & HOOK_REMOVE)) {
11008 if (!(flags & HOOK_ABORT)) {
11009 TAILQ_FOREACH(hd, head, hd_list)
11010 hd->hd_fn(hd->hd_arg);
11011 }
11012 } else {
11013 while (!!(hd = TAILQ_FIRST(head))) {
11014 TAILQ_REMOVE(head, hd, hd_list);
11015 if (!(flags & HOOK_ABORT)) {
11016 hd->hd_fn(hd->hd_arg);
11017 }
11018 if (flags & HOOK_FREE) {
11019 _FREE(hd, M_DEVBUF);
11020 }
11021 }
11022 }
11023 }
mirror of XNU